diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 000000000..a1336cdab
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+language: en-US
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  poem: false
+  review_status: true
+  auto_review:
+    enabled: true
+    drafts: false
+  path_filters:
+    - "!**/*.tsx"
+    - "!**/*.ts"
+    - "!**/*.js"
+    - "!**/*.svg"
+  pre_merge_checks:
+    custom_checks:
+      - name: "No attribution trailers"
+        mode: error
+        instructions: >-
+          Fail when the PR description or any commit message carries an
+          attribution trailer or footer: Co-Authored-By, Claude-Session,
+          Generated-By, or a "Generated with"/"Generated by" tool line.
+          Contributors own their contributions (AGENTS.md); ask for the
+          lines to be removed.
+chat:
+  auto_reply: true
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 80809e667..9b6a0edfd 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-bookworm
+FROM golang:1.26.7-bookworm
 
 RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
     && apt-get -y install --no-install-recommends\
@@ -6,7 +6,6 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
         iptables=1.8.9-2 \
         libgl1-mesa-dev=22.3.6-1+deb12u1 \
         xorg-dev=1:7.7+23 \
-        libayatana-appindicator3-dev=0.5.92-1 \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* \
     && go install -v golang.org/x/tools/gopls@latest
diff --git a/.git-branches.toml b/.git-branches.toml
index d1818090f..4c34d7928 100644
--- a/.git-branches.toml
+++ b/.git-branches.toml
@@ -3,7 +3,7 @@
 [branches]
 main = "main"
 perennials = []
-perennial-regex = ""
+perennial-regex = "^release-"
 
 [create]
 new-branch-type = "feature"
diff --git a/.githooks/commit-msg b/.githooks/commit-msg
new file mode 100755
index 000000000..e5699bd9c
--- /dev/null
+++ b/.githooks/commit-msg
@@ -0,0 +1,26 @@
+#!/bin/bash
+# Refuses commit messages that carry attribution trailers. Contributors own
+# their contributions (AGENTS.md, "No Co-Authored-By or tool-attribution
+# trailers"); a trailer spreads that ownership onto a tool or a bystander.
+
+msg_file="$1"
+
+# Trailer keys in any casing, with any bullet or emoji in front.
+trailers='^[^[:alnum:]]*(co-authored-by|claude-session|generated-by):'
+# "Generated with/by" footers, including "Generated with <emoji> by".
+footer='^[^[:alnum:]]*generated (with|by)( [^[:alnum:]]*by)? '
+# A footer names a product, so a capitalized word must follow the phrase
+# itself. Prose such as "generated by the protobuf compiler" stays legal.
+tool='[Gg][Ee][Nn][Ee][Rr][Aa][Tt][Ee][Dd] ([Ww][Ii][Tt][Hh]|[Bb][Yy])( [^[:alnum:]]*[Bb][Yy])? [^[:alnum:]]*[A-Z]'
+
+offending=$( {
+    grep -Ein "$trailers" "$msg_file"
+    grep -Ein "$footer" "$msg_file" | grep -E "$tool"
+} | sort -un )
+
+if [ -n "$offending" ]; then
+    echo "commit-msg: attribution trailers are not accepted in this repository:" >&2
+    printf '%s\n' "$offending" | sed 's/^/  /' >&2
+    echo "Remove them and commit again (see AGENTS.md)." >&2
+    exit 1
+fi
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b78b1417a..ded77ec58 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,8 +3,8 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
-    open-pull-requests-limit: 15
+      interval: "weekly"
+    open-pull-requests-limit: 3
     groups:
       actions:
         patterns:
@@ -22,9 +22,12 @@ updates:
     directories:
       - "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
     open-pull-requests-limit: 15
     groups:
+      golang-x-packages:
+        patterns:
+          - "golang.org/x/*"
       aws-sdk:
         patterns:
           - "github.com/aws/aws-sdk-go-v2/*"
@@ -43,3 +46,25 @@ updates:
       wireguard:
         patterns:
           - "golang.zx2c4.com/wireguard*"
+
+  # Base images of the source-build Dockerfiles, pinned by digest (Chainguard
+  # publishes only :latest for free). Dockerfile.release files feed goreleaser
+  # and keep the published images as they are, so their bases are left alone.
+  - package-ecosystem: "docker"
+    directories:
+      - "/upload-server"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      base-images:
+        patterns:
+          - "*"
+    ignore:
+      - dependency-name: "gcr.io/distroless/base"
+      # Go minor and major versions move with the rest of the repository;
+      # patch releases and new digests of the pinned tag still come through.
+      - dependency-name: "golang"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-major"
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 8e68054bd..9b796f262 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -2,6 +2,12 @@
 
 ## Issue ticket number and link
 
+<!--
+Required for anything that changes behavior. Link the issue (or the validated
+discussion it came from) that the NetBird team already agreed on. See
+https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#ticket-first-pr-second
+-->
+
 ## Stack
 
 <!-- branch-stack -->
@@ -12,7 +18,9 @@
 - [ ] Is a feature enhancement
 - [ ] It is a refactor
 - [ ] Created tests that fail without the change (if possible)
-- [ ] This change does **not** modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — **OR** I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See [CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first).
+- [ ] I ran and tested this change locally — I did not rely on CI to find out whether it works
+- [ ] This PR has a single purpose (not a fix + refactor + feature in one)
+- [ ] This change is a trivial fix, **OR** it links an issue the NetBird team agreed on beforehand. Changes to the public API, gRPC protocols, functionality behavior, CLI / service flags, or new features always need that agreement first. See [CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#ticket-first-pr-second).
 
 > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md).
 
diff --git a/.github/scripts/test-homebrew-cask.sh b/.github/scripts/test-homebrew-cask.sh
new file mode 100755
index 000000000..9c1041bdd
--- /dev/null
+++ b/.github/scripts/test-homebrew-cask.sh
@@ -0,0 +1,338 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+fail() {
+    echo "::error::$*" >&2
+    exit 1
+}
+
+if [[ ${RUNNER_ENVIRONMENT:-} != github-hosted || ${RUNNER_OS:-} != macOS || $(uname -s) != Darwin ]]; then
+    fail "This test installs a system daemon and must run on a disposable GitHub macOS runner."
+fi
+if [[ $EUID == 0 ]]; then
+    fail "Run this script as the Homebrew user, not root."
+fi
+
+readonly test_dir="${RUNNER_TEMP:?}/homebrew-cask"
+readonly results_dir="$test_dir/results"
+readonly app='/Applications/Netbird UI.app'
+readonly plist='/Library/LaunchDaemons/netbird.plist'
+readonly cask='netbirdio/tap/netbird-ui'
+readonly formula='netbirdio/tap/netbird'
+readonly published_cask="$test_dir/published-netbird-ui.rb"
+readonly legacy_cask="$test_dir/legacy-netbird-ui.rb"
+readonly rendered_cask="$test_dir/rendered-netbird-ui.rb"
+readonly fixture_dir="$test_dir/fixture"
+readonly serve_dir="$test_dir/serve"
+readonly fixture_zip="$serve_dir/netbird-ui.zip"
+readonly fixture_port=18080
+readonly fixture_url="http://127.0.0.1:$fixture_port/netbird-ui.zip"
+readonly marker="$test_dir/installer.marker"
+
+mkdir -p "$results_dir" "$fixture_dir/netbird_ui_darwin" "$serve_dir" "$test_dir/downloads"
+exec > >(tee "$results_dir/test.log") 2>&1
+
+sudo -n true
+if command -v netbird || [[ -e "$app" || -e "$plist" ]] || pgrep -x netbird-ui; then
+    fail "The runner already has NetBird installed or running."
+fi
+if sudo launchctl print system/netbird > "$results_dir/initial-service.log" 2>&1; then
+    fail "The runner already has a NetBird service loaded."
+fi
+
+install_attempted=false
+server_pid=''
+daemon_pid=''
+version=''
+
+stop_ui() {
+    local status=0
+    sudo pkill -x netbird-ui || status=$?
+    # pkill returns 1 when the UI is already closed.
+    [[ $status == 0 || $status == 1 ]]
+}
+
+cleanup() {
+    local status=$?
+    trap - EXIT
+    set +e
+
+    if [[ $install_attempted == true ]]; then
+        stop_ui || status=1
+        if [[ -S /var/run/netbird.sock ]]; then
+            sudo netbird down || status=1
+        fi
+        if brew list --cask "$cask" >/dev/null 2>&1 || [[ -e "$app" ]]; then
+            brew uninstall --cask --force "$cask" || status=1
+        fi
+        # A failed cask install can leave a daemon even after Homebrew rolls back the app.
+        if sudo launchctl print system/netbird > "$results_dir/cleanup-service.log" 2>&1; then
+            sudo netbird service stop || status=1
+        fi
+        if [[ -e "$plist" ]]; then
+            sudo netbird service uninstall || status=1
+        fi
+    fi
+    if [[ -f /var/log/netbird/client.log ]]; then
+        sudo cat /var/log/netbird/client.log > "$results_dir/client.log" || status=1
+    fi
+    if command -v netbird >/dev/null; then
+        brew uninstall --formula "$formula" || status=1
+    fi
+    if [[ -n $server_pid ]]; then
+        kill "$server_pid" 2>/dev/null || true
+    fi
+    exit "$status"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+run_logged() {
+    local name=$1
+    shift
+    "$@" 2>&1 | tee "$results_dir/$name.log"
+}
+
+cask_field() {
+    local stanza=$1 file=$2
+    sed -nE "s/^[[:space:]]*$stanza \"([^\"]+)\".*/\\1/p" "$file"
+}
+
+release_fields() {
+    local file=$1
+    grep -E '^[[:space:]]*(version|url|sha256|app) ' "$file"
+}
+
+use_cask() {
+    local file=$1
+    cp "$file" "$tap_dir/Casks/netbird-ui.rb"
+}
+
+# The released installer opens the UI as root, which never returns on a headless
+# runner. The cask only needs two script paths and a version argument, so the test
+# ships a stub bundle that records what it received and starts the daemon.
+build_fixture() {
+    local bundle="$fixture_dir/netbird_ui_darwin"
+    printf '#!/bin/sh\nexit 0\n' > "$bundle/netbird-ui"
+    chmod 755 "$bundle/netbird-ui"
+    # After a bootout launchd keeps tearing the previous daemon down for a couple of
+    # seconds, and loading the same label again fails until that finishes.
+    cat > "$bundle/installer.sh" <<EOF
+#!/bin/sh
+set -eu
+export PATH=\$PATH:/usr/local/bin:/opt/homebrew/bin
+printf 'version=%s\\nuid=%s\\n' "\$1" "\$(id -u)" > '$marker'
+netbird service install
+attempt=0
+until netbird service start; do
+    attempt=\$((attempt + 1))
+    [ "\$attempt" -lt 15 ] || exit 1
+    sleep 1
+done
+EOF
+    printf '#!/bin/sh\nexit 0\n' > "$bundle/uninstaller.sh"
+    # Shipped without the executable bit so the 0755 seen after install can only come from the cask.
+    chmod 644 "$bundle/installer.sh" "$bundle/uninstaller.sh"
+    rm -f "$fixture_zip"
+    (cd "$fixture_dir" && zip -qr "$fixture_zip" netbird_ui_darwin)
+}
+
+start_fixture_server() {
+    python3 -m http.server "$fixture_port" --bind 127.0.0.1 --directory "$serve_dir" \
+        > "$results_dir/fixture-server.log" 2>&1 &
+    server_pid=$!
+    local attempt
+    for attempt in {1..20}; do
+        if curl --silent --fail --output /dev/null "$fixture_url"; then
+            return
+        fi
+        sleep 0.5
+    done
+    fail "The fixture HTTP server did not come up on port $fixture_port."
+}
+
+assert_published_layout() {
+    local url archive script
+    while read -r url; do
+        archive="$test_dir/downloads/${url##*/}"
+        curl --fail --location --silent --retry 3 --output "$archive" "$url"
+        for script in installer.sh uninstaller.sh; do
+            unzip -l "$archive" | grep -q " netbird_ui_darwin/$script\$" ||
+                fail "The published archive ${url##*/} has no netbird_ui_darwin/$script."
+        done
+    done < <(cask_field url "$published_cask")
+}
+
+assert_no_deprecations() {
+    if grep -Ei '(postflight|uninstall_preflight).*deprecated|deprecated.*(postflight|uninstall_preflight)' "$@"; then
+        fail "Homebrew reported a deprecated cask lifecycle hook."
+    fi
+}
+
+wait_for_daemon() {
+    local attempt
+    for attempt in {1..30}; do
+        if sudo launchctl print system/netbird > "$results_dir/service.log" 2>&1 &&
+            grep -Eq '^[[:space:]]*state = running$' "$results_dir/service.log"; then
+            return
+        fi
+        sleep 1
+    done
+    cat "$results_dir/service.log"
+    fail "The installed daemon did not reach the running state."
+}
+
+wait_for_exit() {
+    local pid=$1 attempt
+    for attempt in {1..30}; do
+        if ! sudo kill -0 "$pid" 2>/dev/null; then
+            return
+        fi
+        sleep 1
+    done
+    fail "Daemon process $pid is still running after removal."
+}
+
+assert_service_absent() {
+    if sudo launchctl print system/netbird > "$results_dir/removed-service.log" 2>&1; then
+        fail "The NetBird service is still loaded after removal."
+    fi
+}
+
+assert_installed() {
+    local script
+    [[ -f $marker ]] || fail "The cask did not run installer.sh."
+    grep -qx "version=$version" "$marker" || fail "installer.sh did not receive the cask version: $(cat "$marker")"
+    grep -qx 'uid=0' "$marker" || fail "installer.sh did not run as root: $(cat "$marker")"
+    [[ -d "$app" && -x "$app/netbird-ui" ]] || fail "The UI was not installed."
+    for script in installer.sh uninstaller.sh; do
+        [[ $(stat -f '%Lp' "$app/$script") == 755 ]] || fail "Incorrect permissions on $script."
+    done
+    [[ -f "$plist" ]] || fail "The installer did not create the daemon plist."
+    wait_for_daemon
+    daemon_pid=$(awk '/^[[:space:]]*pid = / { print $3; exit }' "$results_dir/service.log")
+    [[ $daemon_pid =~ ^[0-9]+$ ]] || fail "The running daemon has no PID."
+    sudo kill -0 "$daemon_pid"
+}
+
+assert_uninstalled() {
+    local log=$1
+    assert_no_deprecations "$log"
+    [[ ! -e "$app" ]] || fail "The UI app remains after uninstall."
+    [[ ! -e "$plist" ]] || fail "The daemon plist remains after uninstall."
+    assert_service_absent
+    wait_for_exit "$daemon_pid"
+    [[ $(netbird version) == "$version" ]] || fail "Cask uninstall removed the CLI dependency."
+}
+
+installed_caskfiles() {
+    local extension=$1
+    find "$(brew --caskroom)/netbird-ui/.metadata" -name "netbird-ui.$extension" 2>/dev/null
+}
+
+assert_legacy_metadata() {
+    installed_caskfiles rb | grep -q . || fail "The legacy cask did not leave a Ruby caskfile behind."
+}
+
+assert_steps_metadata() {
+    if installed_caskfiles rb | grep -q .; then
+        fail "Homebrew still keeps the legacy Ruby caskfile after reinstall."
+    fi
+    installed_caskfiles json | grep -q . || fail "Homebrew did not save the reinstalled cask as JSON."
+}
+
+brew --version
+sw_vers
+brew tap netbirdio/tap "${GITHUB_WORKSPACE:?}/.homebrew-cask-tap"
+tap_dir=$(brew --repository netbirdio/tap)
+readonly tap_dir
+
+[[ -f "$tap_dir/Casks/netbird-ui.rb" ]] || fail "The tap has no Casks/netbird-ui.rb."
+cp "$tap_dir/Casks/netbird-ui.rb" "$published_cask"
+cp "$published_cask" "$results_dir/published-netbird-ui.rb"
+
+version=$(brew info --json=v2 --formula "$formula" | jq -r '.formulae[0].versions.stable')
+readonly version
+[[ -n $version && $version != null ]] || fail "Could not read the formula version from the tap."
+
+assert_published_layout
+
+build_fixture
+fixture_sha=$(shasum -a 256 "$fixture_zip" | cut -d' ' -f1)
+readonly fixture_sha
+start_fixture_server
+
+export PROJECT=netbird-ui VERSION="$version"
+export AMD="$fixture_zip" ARM="$fixture_zip" AMD_URL="$fixture_url" ARM_URL="$fixture_url"
+gomplate -f "$GITHUB_WORKSPACE/client/ui/netbird-ui.rb.tmpl" -o "$rendered_cask"
+cp "$rendered_cask" "$results_dir/rendered-netbird-ui.rb"
+
+sed -E "s|^([[:space:]]*version) \"[^\"]+\"|\\1 \"$version\"|; s|^([[:space:]]*url) \"[^\"]+\"|\\1 \"$fixture_url\"|; s|^([[:space:]]*sha256) \"[^\"]+\"|\\1 \"$fixture_sha\"|" \
+    "$published_cask" > "$legacy_cask"
+cp "$legacy_cask" "$results_dir/legacy-netbird-ui.rb"
+if ! diff <(release_fields "$legacy_cask") <(release_fields "$rendered_cask"); then
+    fail "The rendered cask changes release data, not only lifecycle stanzas."
+fi
+
+use_cask "$rendered_cask"
+brew info --json=v2 --cask "$cask" > "$results_dir/cask.json" 2> "$results_dir/load.log"
+cat "$results_dir/load.log"
+assert_no_deprecations "$results_dir/load.log"
+run_logged style brew style --cask --only-cops=Cask/InstallSteps "$cask"
+
+run_logged install-cli brew install --formula "$formula"
+[[ $(netbird version) == "$version" ]] || fail "The installed CLI does not report the formula version."
+
+for scenario in running stopped missing; do
+    echo "::group::Uninstall with $scenario service"
+    install_attempted=true
+    sudo rm -f "$marker"
+    run_logged "install-$scenario" brew install --cask "$cask"
+    assert_no_deprecations "$results_dir/install-$scenario.log"
+    assert_installed
+    stop_ui
+
+    case "$scenario" in
+        running) ;;
+        stopped)
+            run_logged stop-daemon sudo netbird service stop
+            wait_for_exit "$daemon_pid"
+            [[ -f "$plist" ]] || fail "Stopping the daemon unexpectedly removed its plist."
+            ;;
+        missing)
+            run_logged stop-missing-daemon sudo netbird service stop
+            run_logged remove-daemon sudo netbird service uninstall
+            wait_for_exit "$daemon_pid"
+            [[ ! -e "$plist" ]] || fail "The missing-service scenario still has a plist."
+            assert_service_absent
+            ;;
+        *) fail "Unknown uninstall scenario: $scenario" ;;
+    esac
+
+    run_logged "uninstall-$scenario" brew uninstall --cask "$cask"
+    assert_uninstalled "$results_dir/uninstall-$scenario.log"
+    echo "::endgroup::"
+done
+
+# Every existing user first meets the new cask through an upgrade of the published
+# one, whose legacy flight blocks Homebrew replays from the saved Ruby caskfile.
+echo "::group::Reinstall over the published legacy cask"
+install_attempted=true
+use_cask "$legacy_cask"
+sudo rm -f "$marker"
+run_logged install-legacy brew install --cask "$cask"
+assert_installed
+assert_legacy_metadata
+stop_ui
+
+use_cask "$rendered_cask"
+sudo rm -f "$marker"
+run_logged reinstall-legacy brew reinstall --cask "$cask"
+assert_installed
+assert_steps_metadata
+stop_ui
+
+run_logged uninstall-legacy brew uninstall --cask "$cask"
+assert_uninstalled "$results_dir/uninstall-legacy.log"
+echo "::endgroup::"
diff --git a/.github/workflows/agent-network-e2e.yml b/.github/workflows/agent-network-e2e.yml
index d78e3bbd3..41bfe153d 100644
--- a/.github/workflows/agent-network-e2e.yml
+++ b/.github/workflows/agent-network-e2e.yml
@@ -5,6 +5,20 @@ on:
   schedule:
     - cron: "0 3 * * *"
   workflow_dispatch:
+    inputs:
+      bedrock_model:
+        description: >-
+          Bedrock inference-profile id to drive the matrix with, exactly as
+          AWS issues it. Leave empty for the Sonnet 4.6 default.
+        required: false
+        default: ""
+      test_pattern:
+        description: >-
+          Package pattern to run. Defaults to the whole suite; narrow it to one
+          package (e.g. ./e2e/agentnetwork/...) when a run only needs that
+          package's answer and not the sixteen minutes the container suite costs.
+        required: false
+        default: "./e2e/..."
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -38,7 +52,7 @@ jobs:
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-anet-e2e-buildx-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage', 'e2e/harness/Dockerfile.client') }}
+          key: ${{ runner.os }}-anet-e2e-buildx-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage', 'e2e/harness/Dockerfile.client', 'e2e/harness/Dockerfile.nblink') }}
           restore-keys: |
             ${{ runner.os }}-anet-e2e-buildx-
 
@@ -51,6 +65,9 @@ jobs:
           # token (and URL, for gateways) is unset, so partial coverage is fine.
           OPENAI_TOKEN: ${{ secrets.E2E_OPENAI_TOKEN }}
           ANTHROPIC_TOKEN: ${{ secrets.E2E_ANTHROPIC_TOKEN }}
+          # Moonshot AI platform key (platform.kimi.ai); drives both Kimi wire
+          # shapes (OpenAI /v1 and Anthropic /anthropic) through kimi_api.
+          KIMI_TOKEN: ${{ secrets.E2E_KIMI_TOKEN }}
           VERCEL_URL: ${{ secrets.E2E_VERCEL_URL }}
           VERCEL_TOKEN: ${{ secrets.E2E_VERCEL_TOKEN }}
           OPENROUTER_URL: ${{ secrets.E2E_OPENROUTER_URL }}
@@ -59,10 +76,16 @@ jobs:
           CLOUDFLARE_TOKEN: ${{ secrets.E2E_CLOUDFLARE_TOKEN }}
           AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.E2E_AWS_BEARER_TOKEN_BEDROCK }}
           AWS_REGION: ${{ secrets.E2E_AWS_REGION }}
+          # Bedrock model override: dispatch input wins, then the repo variable, else the test default.
+          AWS_BEDROCK_MODEL: ${{ inputs.bedrock_model || vars.E2E_AWS_BEDROCK_MODEL }}
           # Vertex (Anthropic-on-Vertex): SA + project required; region defaults
           # to "global", model to a pinned claude snapshot.
           GOOGLE_VERTEX_SA_BASE64: ${{ secrets.E2E_GOOGLE_VERTEX_SA_BASE64 }}
           GOOGLE_VERTEX_PROJECT: ${{ secrets.E2E_GOOGLE_VERTEX_PROJECT }}
           GOOGLE_VERTEX_REGION: ${{ secrets.E2E_GOOGLE_VERTEX_REGION }}
           GOOGLE_VERTEX_MODEL: ${{ secrets.E2E_GOOGLE_VERTEX_MODEL }}
-        run: go test -tags e2e -timeout 40m -v ./e2e/...
+          # Read through an env var rather than interpolated into the run
+          # script: a dispatch input reaching a shell command directly is a
+          # script-injection seam, however trusted the dispatcher.
+          TEST_PATTERN: ${{ inputs.test_pattern || './e2e/...' }}
+        run: go test -tags e2e -timeout 40m -v "$TEST_PATTERN"
diff --git a/.github/workflows/buf.yml b/.github/workflows/buf.yml
new file mode 100644
index 000000000..cc7629534
--- /dev/null
+++ b/.github/workflows/buf.yml
@@ -0,0 +1,48 @@
+name: protobuf checks
+on:
+  push:
+    branches:
+      - main
+      - "release-*"
+  pull_request:
+    paths:
+      - ".github/workflows/buf.yml"
+      - "**/buf.yaml"
+      - "**/buf.lock"
+      - "**/buf.gen.yaml"
+      - "**.proto"
+permissions:
+  contents: read
+  pull-requests: read
+jobs:
+  buf:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: bufbuild/buf-action@8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3 # v1.5.0
+        with:
+          push: false
+          archive: false
+          pr_comment: false
+          lint: false
+          format: false
+          # A push that creates a branch carries no `before` commit, so the
+          # action's default baseline is the all-zero SHA and `buf breaking`
+          # dies cloning it. Skipping costs nothing: every commit on a freshly
+          # cut release branch should have already passed this check on main.
+          breaking: ${{ !github.event.created }}
+          # The alternative is to compare against the default branch instead of
+          # skipping. Not used: buf clones the baseline when the job runs, so a
+          # main that has moved on since the branch was cut reads as protos
+          # deleted on the release branch. Resolving to an empty string on every
+          # other event is what keeps the action's own default in place, which
+          # stacked pull requests need.
+          # breaking_against: >-
+          #   ${{ github.event.created
+          #     && format('{0}#format=git,branch={1}',
+          #               github.event.repository.clone_url,
+          #               github.event.repository.default_branch)
+          #     || '' }}
diff --git a/.github/workflows/check-license-dependencies.yml b/.github/workflows/check-license-dependencies.yml
index 17c9fdc8d..27c59f8d6 100644
--- a/.github/workflows/check-license-dependencies.yml
+++ b/.github/workflows/check-license-dependencies.yml
@@ -2,7 +2,7 @@ name: Check License Dependencies
 
 on:
   push:
-    branches: [main]
+    branches: [main, "release-*"]
     paths:
       - "go.mod"
       - "go.sum"
@@ -34,7 +34,7 @@ jobs:
           while IFS= read -r dir; do
             echo "=== Checking $dir ==="
             # Search for problematic imports, excluding test files
-            RESULTS=$(grep -r "github.com/netbirdio/netbird/\(management\|signal\|relay\|proxy\)" "$dir" --include="*.go" 2>/dev/null | grep -v "_test.go" | grep -v "test_" | grep -v "/test/" | grep -v "tools/idp-migrate/" || true)
+            RESULTS=$(grep -r "github.com/netbirdio/netbird/\(management\|signal\|relay\|proxy\)" "$dir" --include="*.go" 2>/dev/null | grep -v "_test.go" | grep -v "test_" | grep -v "/test/" | grep -v "tools/idp-migrate/" | grep -v "tools/mysql-migrate/" || true)
             if [ -n "$RESULTS" ]; then
               echo "❌ Found problematic dependencies:"
               echo "$RESULTS"
@@ -93,7 +93,7 @@ jobs:
                 IMPORTERS=$(go list -json -deps ./... 2>/dev/null | jq -r "select(.Imports[]? == \"$package\") | .ImportPath")
 
                 # Check if any importer is NOT in management/signal/relay
-                BSD_IMPORTER=$(echo "$IMPORTERS" | grep -v "github.com/netbirdio/netbird/\(management\|signal\|relay\|proxy\|combined\|tools/idp-migrate\)" | head -1)
+                BSD_IMPORTER=$(echo "$IMPORTERS" | grep -v "github.com/netbirdio/netbird/\(management\|signal\|relay\|proxy\|combined\|tools/idp-migrate\|tools/mysql-migrate\)" | head -1)
 
                 if [ -n "$BSD_IMPORTER" ]; then
                   echo "❌ $package ($license) is imported by BSD-licensed code: $BSD_IMPORTER"
diff --git a/.github/workflows/docs-ack.yml b/.github/workflows/docs-ack.yml
index 7e34e2f8a..edd1eebff 100644
--- a/.github/workflows/docs-ack.yml
+++ b/.github/workflows/docs-ack.yml
@@ -12,6 +12,8 @@ jobs:
   docs-ack:
     name: Require docs PR URL or explicit "not needed"
     runs-on: ubuntu-latest
+    # Crowdin's translation-sync service PRs are auto-generated without the PR template.
+    if: github.event.pull_request.user.login != 'netbirddev'
 
     steps:
       - name: Read PR body
diff --git a/.github/workflows/frontend-ui.yml b/.github/workflows/frontend-ui.yml
new file mode 100644
index 000000000..2ad43c581
--- /dev/null
+++ b/.github/workflows/frontend-ui.yml
@@ -0,0 +1,99 @@
+name: UI Frontend
+
+on:
+  pull_request:
+    paths:
+      - "client/ui/frontend/**"
+      - "client/ui/i18n/**"
+      - "client/ui/**/*.go"
+      - ".github/workflows/frontend-ui.yml"
+  push:
+    branches:
+      - main
+      - "release-*"
+    paths:
+      - "client/ui/frontend/**"
+      - "client/ui/i18n/**"
+      - "client/ui/**/*.go"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
+  cancel-in-progress: true
+
+jobs:
+  lint-and-build:
+    name: Lint & Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: client/ui/frontend
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          version: 11
+
+      # Bindings are generated by wails3 from the Go service definitions and
+      # are not checked in (see client/ui/frontend/bindings/). Without them,
+      # typecheck/build fail on missing module imports.
+      - name: Set up Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      # wails3 CLI links against GTK4 / WebKitGTK 6.0 via its internal/operatingsystem
+      # package, so the dev libraries must be present before `go install`.
+      - name: Install Wails Linux system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            pkg-config \
+            libgtk-4-dev \
+            libwebkitgtk-6.0-dev
+
+      - name: Install wails3 CLI
+        # Version derived from go.mod so the binding generator always matches
+        # the wails runtime the daemon links against.
+        working-directory: ${{ github.workspace }}
+        run: |
+          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
+          go install github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
+
+      - name: Get pnpm store directory
+        id: pnpm-store
+        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v6
+        with:
+          path: ${{ steps.pnpm-store.outputs.path }}
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('client/ui/frontend/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Generate Wails bindings
+        run: pnpm run bindings
+
+      - name: Lint, typecheck, format
+        run: pnpm check
+
+      - name: Build
+        run: pnpm build
diff --git a/.github/workflows/golang-test-darwin.yml b/.github/workflows/golang-test-darwin.yml
index 748e3f996..dec57dc80 100644
--- a/.github/workflows/golang-test-darwin.yml
+++ b/.github/workflows/golang-test-darwin.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - "release-*"
   pull_request:
 
 concurrency:
@@ -45,7 +46,17 @@ jobs:
         run: git --no-pager diff --exit-code
 
       - name: Test
-        run: NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 5m -p 1 $(go list ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/testutil/privileged)
+        # Exclude the client/ui package itself: its main.go uses //go:embed
+        # all:frontend/dist, which fails to compile until the frontend has been
+        # built, and its release pipeline runs `pnpm build` before goreleaser.
+        # The pattern is anchored so the subpackages (services, preferences,
+        # i18n, authsession) still run: they hold Go-side unit tests and need no
+        # frontend bundle.
+        # `go list -e` lets the listing succeed even though the embed fails to
+        # resolve; the grep then drops the broken package by path. Without -e,
+        # go list aborts with empty stdout and `go test` falls back to the repo
+        # root, which has no Go files.
+        run: NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 5m -p 1 $(go list -e ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e '/client/ui$' -e /client/testutil/privileged)
 
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f #v7.0.0
diff --git a/.github/workflows/golang-test-freebsd.yml b/.github/workflows/golang-test-freebsd.yml
index 9c795e783..7bd48e3d0 100644
--- a/.github/workflows/golang-test-freebsd.yml
+++ b/.github/workflows/golang-test-freebsd.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - "release-*"
   pull_request:
 
 concurrency:
@@ -32,7 +33,7 @@ jobs:
         with:
           usesh: true
           copyback: false
-          release: "15.0"
+          release: "15.1"
           envs: "GO_VERSION"
           prepare: |
             pkg install -y curl pkgconf xorg
diff --git a/.github/workflows/golang-test-linux.yml b/.github/workflows/golang-test-linux.yml
index ce53261a4..880370ede 100644
--- a/.github/workflows/golang-test-linux.yml
+++ b/.github/workflows/golang-test-linux.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - "release-*"
   pull_request:
 
 concurrency:
@@ -53,7 +54,7 @@ jobs:
 
       - name: Install dependencies
         if: steps.cache.outputs.cache-hit != 'true'
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
 
       - name: Install 32-bit libpcap
         if: steps.cache.outputs.cache-hit != 'true'
@@ -145,7 +146,7 @@ jobs:
             ${{ runner.os }}-gotest-cache-
 
       - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
 
       - name: Install 32-bit libpcap
         if: matrix.arch == '386'
@@ -158,7 +159,16 @@ jobs:
         run: git --no-pager diff --exit-code
 
       - name: Test
-        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,CGO_ENABLED' -timeout 10m -p 1 $(go list ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/testutil/privileged)
+        # Exclude client/ui: its main.go uses //go:embed all:frontend/dist,
+        # which fails to compile until the frontend has been built, and its
+        # release pipeline runs `pnpm build` before goreleaser. The subpackages
+        # go with it because this runner's gtk4 is older than the wails runtime
+        # needs; the Client UI / Unit job below covers them instead.
+        # `go list -e` lets the listing succeed even though the embed fails to
+        # resolve; the grep then drops the broken package by path. Without -e,
+        # go list aborts with empty stdout and `go test` falls back to the repo
+        # root, which has no Go files.
+        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,CGO_ENABLED' -timeout 10m -p 1 $(go list -e ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /client/testutil/privileged)
 
       - name: Upload coverage reports to Codecov
         if: matrix.arch == 'amd64'
@@ -168,6 +178,71 @@ jobs:
           slug: netbirdio/netbird
           flags: unit,client
 
+  test_client_ui:
+    name: "Client UI / Unit"
+    # Pinned to 24.04 rather than the 22.04 the other client jobs use: the wails
+    # runtime's linux cgo layer needs GtkFileDialog, which arrived in gtk4 4.10,
+    # and jammy ships 4.6. Not ubuntu-latest, so a runner image rollover cannot
+    # move this out from under us.
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - name: Install dependencies
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev
+
+      - name: Test
+        # client/ui itself stays out: its main.go embeds all:frontend/dist,
+        # which only exists after `pnpm build`. The subpackages carry the
+        # Go-side unit tests, including the window manager re-entrancy
+        # regression test, and need no frontend bundle.
+        run: CGO_ENABLED=1 go test -timeout 5m ./client/ui/authsession/... ./client/ui/i18n/... ./client/ui/preferences/... ./client/ui/services/...
+
+  test_client_pkcs11:
+    name: "Client PKCS#11 / Unit"
+    # The deb and rpm packages ship the client built with the pkcs11 tag, which loads
+    # PKCS#11 modules through purego. The other jobs build without the tag, so this one
+    # compiles that driver and signs with a real SoftHSM token, the build release ships.
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - name: Install SoftHSM
+        run: sudo apt update && sudo apt install -y -q softhsm2
+
+      - name: Initialise token
+        run: |
+          mkdir -p "$RUNNER_TEMP/softhsm/tokens"
+          printf 'directories.tokendir = %s\nobjectstore.backend = file\n' "$RUNNER_TEMP/softhsm/tokens" > "$RUNNER_TEMP/softhsm/softhsm2.conf"
+          echo "SOFTHSM2_CONF=$RUNNER_TEMP/softhsm/softhsm2.conf" >> "$GITHUB_ENV"
+          SOFTHSM2_CONF="$RUNNER_TEMP/softhsm/softhsm2.conf" softhsm2-util --init-token --free --label netbird --pin 1234 --so-pin 1234
+
+      - name: Vet
+        run: CGO_ENABLED=0 go vet -tags pkcs11 ./client/internal/pkcs11/... ./client/internal/certproof/...
+
+      - name: Test
+        env:
+          NB_TEST_PKCS11_URI: "pkcs11:token=netbird?module-path=/usr/lib/softhsm/libsofthsm2.so&pin-value=1234"
+          NB_TEST_PKCS11_DISPOSABLE: "1"
+        run: CGO_ENABLED=0 go test -tags pkcs11 -timeout 5m ./client/internal/pkcs11/... ./client/internal/certproof/...
 
   test_client_on_docker:
     name: "Client (Docker) / Unit"
@@ -203,6 +278,9 @@ jobs:
             ${{ runner.os }}-gotest-cache-
 
       - name: Run tests in container
+        # Unlike the native job above, this one drops all of client/ui including
+        # the subpackages: the alpine container has no gtk4/webkitgtk, so the
+        # Wails application package they import would fail to link.
         env:
           HOST_GOCACHE: ${{ steps.go-env.outputs.cache_dir }}
           HOST_GOMODCACHE: ${{ steps.go-env.outputs.modcache_dir }}
@@ -225,11 +303,11 @@ jobs:
             -e GOCACHE=${CONTAINER_GOCACHE} \
             -e GOMODCACHE=${CONTAINER_GOMODCACHE} \
             -e CONTAINER=${CONTAINER} \
-            golang:1.25-alpine \
+            golang:1.26.7-alpine \
             sh -c ' \
               apk update; apk add --no-cache \
                 ca-certificates iptables ip6tables dbus dbus-dev libpcap-dev build-base; \
-              go test -buildvcs=false -tags "devcert privileged" -v -timeout 10m -p 1 $(go list -buildvcs=false ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /upload-server -e /client/testutil/privileged)
+              go test -buildvcs=false -tags "devcert privileged" -v -timeout 10m -p 1 $(go list -e -buildvcs=false ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /upload-server -e /client/testutil/privileged -e tools/mysql-migrate)
             '
 
   test_relay:
@@ -473,14 +551,32 @@ jobs:
         if: matrix.store == 'mysql'
         run: docker pull mlsmaycon/warmed-mysql:8
 
+      # The -json stream goes through tools/gotestsummary so the log shows one
+      # line per test, the output of failed tests, the head of a timeout panic
+      # with the still-running tests, and the slowest tests per package.
       - name: Test
+        shell: bash
         run: |
+          set -o pipefail
           CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
           NETBIRD_STORE_ENGINE=${{ matrix.store }} \
             CI=true \
-          go test -tags=devcert -coverprofile=coverage.txt \
+          go test -json -tags=devcert -coverprofile=coverage.txt \
             -exec "sudo --preserve-env=CI,NETBIRD_STORE_ENGINE" \
-            -timeout 20m ./management/... ./shared/management/...
+            -timeout 20m ./management/... ./shared/management/... \
+            | tee management-test-events.jsonl \
+            | go run ./tools/gotestsummary
+
+      # The summary trims long outputs; the raw stream keeps every line for
+      # the failures that need it. A green run has no use for it.
+      - name: Upload raw test events
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
+        with:
+          name: management-unit-test-events-${{ matrix.store }}
+          path: management-test-events.jsonl
+          if-no-files-found: ignore
+          retention-days: 14
 
       - name: Upload coverage reports to Codecov
         if: matrix.arch == 'amd64'
@@ -722,17 +818,35 @@ jobs:
       - name: Install modules
         run: go mod tidy
 
+      - name: Run Mage
+        uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4.0.0
+        with:
+          install-only: true
+
       - name: check git status
         run: git --no-pager diff --exit-code
 
+      # Same summary as the unit job: a timeout here names the tests still
+      # running instead of ending in a goroutine dump.
       - name: Test
+        shell: bash
         run: |
+          set -o pipefail
           CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
           NETBIRD_STORE_ENGINE=${{ matrix.store }} \
           CI=true \
-          go test -tags=integration -coverprofile=coverage.txt \
-          -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' \
-          -timeout 20m ./management/server/http/...
+          mage integrationtest:all -gotestflags="-json -coverprofile=coverage.txt" \
+            | tee management-integration-test-events.jsonl \
+            | go run ./tools/gotestsummary
+
+      - name: Upload raw test events
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
+        with:
+          name: management-integration-test-events-${{ matrix.store }}
+          path: management-integration-test-events.jsonl
+          if-no-files-found: ignore
+          retention-days: 14
 
       - name: Upload coverage reports to Codecov
         if: matrix.arch == 'amd64'
diff --git a/.github/workflows/golang-test-windows.yml b/.github/workflows/golang-test-windows.yml
index b61c87cf6..49be3af58 100644
--- a/.github/workflows/golang-test-windows.yml
+++ b/.github/workflows/golang-test-windows.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - "release-*"
   pull_request:
 
 env:
@@ -65,8 +66,17 @@ jobs:
       - run: PsExec64 -s -w ${{ github.workspace }} C:\hostedtoolcache\windows\go\${{ steps.go.outputs.go-version }}\x64\bin\go.exe env -w GOCACHE=${{ env.modcache }}
       - run: PsExec64 -s -w ${{ github.workspace }} C:\hostedtoolcache\windows\go\${{ steps.go.outputs.go-version }}\x64\bin\go.exe mod tidy
       - name: Generate test script
+        # Exclude the client/ui package itself: its main.go uses //go:embed
+        # all:frontend/dist, which fails to compile until the frontend has been
+        # built, and its release pipeline runs `pnpm build` before goreleaser.
+        # The pattern is anchored so the subpackages (services, preferences,
+        # i18n, authsession) still run: they hold Go-side unit tests and need no
+        # frontend bundle.
+        # `go list -e` lets the listing succeed even though the embed fails to
+        # resolve; the Where-Object pipeline then drops the broken package by
+        # path. Without -e, go list aborts with empty stdout.
         run: |
-          $packages = go list ./... | Where-Object { $_ -notmatch '/management' } | Where-Object { $_ -notmatch '/relay' } | Where-Object { $_ -notmatch '/signal' } | Where-Object { $_ -notmatch '/proxy' } | Where-Object { $_ -notmatch '/combined' }
+          $packages = go list -e ./... | Where-Object { $_ -notmatch '/management' } | Where-Object { $_ -notmatch '/relay' } | Where-Object { $_ -notmatch '/signal' } | Where-Object { $_ -notmatch '/proxy' } | Where-Object { $_ -notmatch '/combined' } | Where-Object { $_ -notmatch '/client/ui$' } | Where-Object { $_ -notmatch '/tools/mysql-migrate' }
           $goExe = "C:\hostedtoolcache\windows\go\${{ steps.go.outputs.go-version }}\x64\bin\go.exe"
           $cmd = "$goExe test -tags `"devcert privileged`" -timeout 10m -p 1 $($packages -join ' ') > test-out.txt 2>&1"
           Set-Content -Path "${{ github.workspace }}\run-tests.cmd" -Value $cmd
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 511e54b62..843177b88 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -22,7 +22,15 @@ jobs:
         uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2
         with:
           ignore_words_list: erro,clienta,hastable,iif,groupd,testin,groupe,cros,ans,deriver,te,userA,ede,additionals,flate,recordin,unparseable
-          skip: go.mod,go.sum,**/proxy/web/**
+          # Non-English UI translations trip codespell on real foreign words
+          # (de: "Sie", "oder", "ist"). Only en/common.json is the source of
+          # truth that should be spell-checked. List each translated locale
+          # dir below and add new ones as languages are added under
+          # client/ui/i18n/locales/. Single-star globs are matched per path
+          # segment by codespell and behave the same across versions; the
+          # recursive "**" form did not take effect with the codespell shipped
+          # by this action.
+          skip: go.mod,go.sum,*/proxy/web/*,*pnpm-lock.yaml,*package-lock.json,*/locales/de/*,*/locales/es/*,*/locales/fr/*,*/locales/gl/*,*/locales/hu/*,*/locales/it/*,*/locales/pt/*,*/locales/ru/*,*/locales/zh-CN/*,*/i18n/TRANSLATING.md
   golangci:
     strategy:
       fail-fast: false
@@ -37,7 +45,7 @@ jobs:
             display_name: Linux
     name: ${{ matrix.display_name }}
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 15
+    timeout-minutes: 25
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -54,7 +62,16 @@ jobs:
           cache: false
       - name: Install dependencies
         if: matrix.os == 'ubuntu-latest'
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev libpcap-dev
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev libpcap-dev
+      - name: Stub Wails frontend bundle
+        # client/ui/main.go has //go:embed all:frontend/dist. The
+        # directory is produced by `pnpm run build` and is gitignored, so
+        # lint-only runs (no frontend toolchain) need a placeholder file
+        # for the embed pattern to match.
+        shell: bash
+        run: |
+          mkdir -p client/ui/frontend/dist
+          touch client/ui/frontend/dist/.embed-placeholder
       - name: golangci-lint
         uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #v9.2.1
         with:
@@ -62,4 +79,50 @@ jobs:
           skip-cache: true
           skip-save-cache: true
           cache-invalidation-interval: 0
-          args: --timeout=12m
+          args: --timeout=20m
+
+  # Separate job rather than extra rows in the matrix above: those rows pick a
+  # GOOS by picking a runner OS, while android/ios are cross-compiled from
+  # ubuntu — an `include` entry with os: ubuntu-latest would merge into the
+  # Linux row instead of adding one. The package path is restricted because a
+  # whole-repo run under GOOS=android pulls *_linux.go files into packages that
+  # have no android counterpart.
+  golangci-mobile:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: android
+            goarch: arm64
+            packages: ./client/android/...
+            display_name: Android
+          - goos: ios
+            goarch: arm64
+            packages: ./client/ios/...
+            display_name: iOS
+    name: ${{ matrix.display_name }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    env:
+      CGO_ENABLED: 0
+      GOOS: ${{ matrix.goos }}
+      GOARCH: ${{ matrix.goarch }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #v9.2.1
+        with:
+          version: latest
+          install-mode: binary
+          skip-cache: true
+          skip-save-cache: true
+          cache-invalidation-interval: 0
+          args: --timeout=20m ${{ matrix.packages }}
diff --git a/.github/workflows/install-script-test.yml b/.github/workflows/install-script-test.yml
index 1514caedc..61709501c 100644
--- a/.github/workflows/install-script-test.yml
+++ b/.github/workflows/install-script-test.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - "release-*"
   pull_request:
     paths:
       - "release_files/install.sh"
diff --git a/.github/workflows/mobile-build-validation.yml b/.github/workflows/mobile-build-validation.yml
index 44e912c73..613a39b3d 100644
--- a/.github/workflows/mobile-build-validation.yml
+++ b/.github/workflows/mobile-build-validation.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - "release-*"
   pull_request:
 
 concurrency:
@@ -14,6 +15,14 @@ jobs:
   android_build:
     name: "Android / Build"
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        goarch: [arm64, arm, amd64, "386"]
+    env:
+      CGO_ENABLED: 0
+      GOOS: android
+      GOARCH: ${{ matrix.goarch }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -23,35 +32,23 @@ jobs:
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: "go.mod"
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
-        with:
-          cmdline-tools-version: 8512546
-      - name: Setup Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520
-        with:
-          java-version: "11"
-          distribution: "adopt"
-      - name: NDK Cache
-        id: ndk-cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
-        with:
-          path: /usr/local/lib/android/sdk/ndk
-          key: ndk-cache-23.1.7779620
-      - name: Setup NDK
-        run: /usr/local/lib/android/sdk/cmdline-tools/7.0/bin/sdkmanager --install "ndk;23.1.7779620"
-      - name: install gomobile
-        run: go install golang.org/x/mobile/cmd/gomobile@v0.0.0-20251113184115-a159579294ab
-      - name: gomobile init
-        run: gomobile init
-      - name: build android netbird lib
-        run: PATH=$PATH:$(go env GOPATH) gomobile bind -o $GITHUB_WORKSPACE/netbird.aar -javapkg=io.netbird.gomobile -ldflags="-checklinkname=0 -X golang.zx2c4.com/wireguard/ipc.socketDirectory=/data/data/io.netbird.client/cache/wireguard -X github.com/netbirdio/netbird/version.version=buildtest"  $GITHUB_WORKSPACE/client/android
-        env:
-          CGO_ENABLED: 0
-          ANDROID_NDK_HOME: /usr/local/lib/android/sdk/ndk/23.1.7779620
+      - name: Build Android bridge
+        run: go build ./client/android/...
+      - name: Vet Android bridge
+        if: matrix.goarch == 'arm64'
+        run: go vet ./client/android/...
+
   ios_build:
     name: "iOS / Build"
-    runs-on: macos-latest
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        goarch: [arm64, amd64]
+    env:
+      CGO_ENABLED: 0
+      GOOS: ios
+      GOARCH: ${{ matrix.goarch }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -61,11 +58,7 @@ jobs:
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: "go.mod"
-      - name: install gomobile
-        run: go install golang.org/x/mobile/cmd/gomobile@v0.0.0-20251113184115-a159579294ab
-      - name: gomobile init
-        run: gomobile init
-      - name: build iOS netbird lib
-        run: PATH=$PATH:$(go env GOPATH) gomobile bind -target=ios -bundleid=io.netbird.framework -ldflags="-X github.com/netbirdio/netbird/version.version=buildtest" -o ./NetBirdSDK.xcframework ./client/ios/NetBirdSDK
-        env:
-          CGO_ENABLED: 0
+      # No `go vet` counterpart: every ios target requires external (cgo)
+      # linking, which needs an Xcode toolchain the runner does not have.
+      - name: Build iOS SDK
+        run: go build ./client/ios/...
diff --git a/.github/workflows/no-new-replace.yml b/.github/workflows/no-new-replace.yml
new file mode 100644
index 000000000..b906ce450
--- /dev/null
+++ b/.github/workflows/no-new-replace.yml
@@ -0,0 +1,78 @@
+name: No New Replace Directives
+
+on:
+  pull_request:
+    paths:
+      - "go.mod"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
+  cancel-in-progress: true
+
+jobs:
+  check-replace-directives:
+    name: check-replace-directives
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+
+      - name: Compare replace directives against the base branch
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+
+          # A replace directive only applies when this module is the main
+          # module. Anything importing netbird as a library, the embedded
+          # clients among them, resolves the replaced path upstream instead and
+          # fails to build against whatever the replacement provides. Requiring
+          # a fork under its own module path avoids that; a replace does not.
+          #
+          # go.mod is parsed rather than diffed so that reordering, comments and
+          # single-line versus block syntax do not register as changes.
+          #
+          # Versions are part of the key because a replace can be scoped to one
+          # version of a module. Keyed on paths alone, retargeting such a
+          # directive at a different version would read as unchanged.
+          list_replaces() {
+            go mod edit -json "$1" \
+              | jq -r '
+                  def ref: .Path + (if (.Version // "") == "" then "" else " " + .Version end);
+                  (.Replace // [])[] | "\(.Old | ref) => \(.New | ref)"
+                ' \
+              | sort
+          }
+
+          git show "${BASE_SHA}:go.mod" > /tmp/base-go.mod
+          list_replaces /tmp/base-go.mod > /tmp/base-replaces
+          list_replaces go.mod > /tmp/head-replaces
+
+          added=$(comm -13 /tmp/base-replaces /tmp/head-replaces)
+          if [ -n "$added" ]; then
+            echo "::error::This PR adds a replace directive to go.mod:"
+            echo "$added" | sed 's/^/  /'
+            echo ""
+            echo "A replace directive applies only to the main module, so it does not"
+            echo "reach anything that imports netbird as a library. Require the module"
+            echo "under a path you control instead, as done for github.com/netbirdio/go-nat."
+            exit 1
+          fi
+
+          removed=$(comm -23 /tmp/base-replaces /tmp/head-replaces)
+          if [ -n "$removed" ]; then
+            echo "This PR removes replace directives:"
+            echo "$removed" | sed 's/^/  /'
+          fi
+          echo "No new replace directives."
diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
index 67d65356c..5b769e2f7 100644
--- a/.github/workflows/pr-title-check.yml
+++ b/.github/workflows/pr-title-check.yml
@@ -7,6 +7,8 @@ on:
 jobs:
   check-title:
     runs-on: ubuntu-latest
+    # Crowdin's translation-sync service PRs are auto-generated with a fixed title.
+    if: github.event.pull_request.user.login != 'netbirddev'
     steps:
       - name: Validate PR title prefix
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -16,6 +18,8 @@ jobs:
             const allowedTags = [
               'management',
               'client',
+              'android',
+              'ios',
               'signal',
               'proxy',
               'relay',
diff --git a/.github/workflows/redhat-certify.yml b/.github/workflows/redhat-certify.yml
new file mode 100644
index 000000000..96d50de9f
--- /dev/null
+++ b/.github/workflows/redhat-certify.yml
@@ -0,0 +1,207 @@
+name: Red Hat Certification
+
+# Certify published UBI images in the Red Hat Ecosystem Catalog. Called by
+# release.yml on stable tags, or run by hand to (re)certify any released
+# version. preflight submits every architecture of an image's manifest list
+# to Pyxis; auto-publish on the component makes it public once certified.
+#
+# Each component's Partner Connect ID comes from the REDHAT_CERT_ID_<NAME>
+# repository variable, e.g. REDHAT_CERT_ID_CLIENT_ROOTLESS. The run fails
+# before certifying anything if a selected component's variable is not set.
+
+on:
+  workflow_call:
+    inputs:
+      component:
+        type: string
+        required: true
+      version:
+        type: string
+        required: true
+    secrets:
+      PYXIS_API_TOKEN:
+        required: true
+  workflow_dispatch:
+    inputs:
+      component:
+        description: "Component to certify"
+        type: choice
+        required: true
+        default: all
+        options:
+          - all
+          - client-rootless
+          - reverse-proxy
+          - netbird-server
+          - management
+          - signal
+          - relay
+      version:
+        description: "Released version, e.g. v0.80.0"
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  resolve:
+    name: Resolve components
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.resolve.outputs.version }}
+      matrix: ${{ steps.resolve.outputs.matrix }}
+    steps:
+      - name: Resolve components and images
+        id: resolve
+        env:
+          COMPONENT: ${{ inputs.component }}
+          INPUT_VERSION: ${{ inputs.version }}
+          REPO_VARS: ${{ toJSON(vars) }}
+        run: |
+          set -euo pipefail
+          version="${INPUT_VERSION#v}"
+          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Only stable x.y.z versions are certified, got '${INPUT_VERSION}'"
+            exit 1
+          fi
+          # name, image repository, tag suffix (must match .goreleaser.yaml).
+          # Keep the names in sync with the workflow_dispatch options above.
+          components=(
+            "client-rootless ghcr.io/netbirdio/netbird -rootless-ubi"
+            "reverse-proxy ghcr.io/netbirdio/reverse-proxy -ubi"
+            "netbird-server ghcr.io/netbirdio/netbird-server -ubi"
+            "management ghcr.io/netbirdio/management -ubi"
+            "signal ghcr.io/netbirdio/signal -ubi"
+            "relay ghcr.io/netbirdio/relay -ubi"
+          )
+          matrix="[]"
+          missing=()
+          for c in "${components[@]}"; do
+            read -r name repo suffix <<< "$c"
+            [[ "$COMPONENT" == all || "$COMPONENT" == "$name" ]] || continue
+            var="REDHAT_CERT_ID_${name^^}"; var="${var//-/_}"
+            id="$(jq -r --arg v "$var" '.[$v] // empty' <<< "$REPO_VARS")"
+            if [[ -z "$id" ]]; then
+              missing+=("$var")
+              continue
+            fi
+            matrix="$(jq -c --arg n "$name" --arg t "${version}${suffix}" --arg r "${repo}:${version}${suffix}" --arg i "$id" \
+              '. + [{component: $n, tag: $t, ref: $r, component_id: $i}]' <<< "$matrix")"
+          done
+          if (( ${#missing[@]} )); then
+            echo "::error::Set these repository variables to the Partner Connect component IDs: ${missing[*]}"
+            exit 1
+          fi
+          if [[ "$matrix" == "[]" ]]; then
+            echo "::error::No component to certify for '${COMPONENT}'"
+            exit 1
+          fi
+          echo "Components to certify: ${matrix}"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "matrix=${matrix}" >> "$GITHUB_OUTPUT"
+
+  certify:
+    name: "Certify ${{ matrix.component }} UBI image"
+    needs: resolve
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.resolve.outputs.matrix) }}
+    env:
+      PREFLIGHT_VERSION: "1.21.0"
+      # sha256 of preflight-linux-amd64 from the 1.21.0 GitHub release.
+      # Red Hat publishes no checksum file, so the value is pinned here.
+      PREFLIGHT_SHA256: "5e653135503c72f8702bbe31d7643197d12937c68086879133dd6b9650a9a449"
+    steps:
+      - name: Verify the multi-arch image is on ghcr.io
+        env:
+          IMAGE_REF: ${{ matrix.ref }}
+        run: |
+          set -euo pipefail
+          docker buildx imagetools inspect "$IMAGE_REF" --raw > manifest.json
+          for arch in amd64 arm64; do
+            if ! jq -e --arg a "$arch" '.manifests[] | select(.platform.architecture == $a)' manifest.json > /dev/null; then
+              echo "::error::${IMAGE_REF} has no ${arch} manifest"
+              exit 1
+            fi
+          done
+          echo "Manifest list for ${IMAGE_REF}:"
+          jq -r '.manifests[] | "\(.platform.os)/\(.platform.architecture) \(.digest)"' manifest.json
+
+      - name: Install preflight
+        run: |
+          set -euo pipefail
+          curl -fsSL --proto '=https' --proto-redir '=https' -o preflight \
+            "https://github.com/redhat-openshift-ecosystem/openshift-preflight/releases/download/${PREFLIGHT_VERSION}/preflight-linux-amd64"
+          echo "${PREFLIGHT_SHA256}  preflight" | sha256sum -c -
+          chmod +x preflight
+          ./preflight --version
+
+      - name: Run preflight checks and submit to Red Hat
+        env:
+          IMAGE_REF: ${{ matrix.ref }}
+          PFLT_PYXIS_API_TOKEN: ${{ secrets.PYXIS_API_TOKEN }}
+          PFLT_CERTIFICATION_COMPONENT_ID: ${{ matrix.component_id }}
+          PFLT_ARTIFACTS: artifacts
+          PFLT_LOGFILE: artifacts/preflight.log
+          PFLT_LOGLEVEL: info
+          PFLT_JUNIT: "true"
+        run: |
+          set -euo pipefail
+          # No --platform: preflight walks the manifest list and submits every
+          # architecture in one run, grouped under one manifest-list digest.
+          # preflight does not create the PFLT_LOGFILE directory, and --submit
+          # fails if the log file is missing.
+          mkdir -p artifacts
+          ./preflight check container "$IMAGE_REF" --submit
+
+      - name: Fail if any check did not pass
+        run: |
+          set -euo pipefail
+          shopt -s nullglob globstar
+          results=(artifacts/**/results.json)
+          if [[ ${#results[@]} -eq 0 ]]; then
+            echo "::error::preflight produced no results.json"
+            exit 1
+          fi
+          status=0
+          for f in "${results[@]}"; do
+            arch="$(basename "$(dirname "$f")")"
+            passed="$(jq -r '.passed' "$f")"
+            failed="$(jq -r '[.results.failed[]?.name] | join(", ")' "$f")"
+            echo "${arch}: passed=${passed} ${failed:+failed checks: ${failed}}"
+            [[ "$passed" == "true" ]] || status=1
+          done
+          exit $status
+
+      - name: Upload preflight artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: redhat-preflight-${{ matrix.component }}-${{ needs.resolve.outputs.version }}
+          path: artifacts/
+          retention-days: 30
+
+      - name: Wait for Pyxis to mark both architectures certified
+        env:
+          TAG: ${{ matrix.tag }}
+          COMPONENT_ID: ${{ matrix.component_id }}
+          PFLT_PYXIS_API_TOKEN: ${{ secrets.PYXIS_API_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Filter on the tag server-side so older versions are found past the first page.
+          url="https://catalog.redhat.com/api/containers/v1/projects/certification/id/${COMPONENT_ID}/images?filter=repositories.tags.name==${TAG}&page_size=100"
+          for attempt in $(seq 1 20); do
+            certified="$(curl -fsS --proto '=https' --proto-redir '=https' -H "X-API-KEY: ${PFLT_PYXIS_API_TOKEN}" "$url" \
+              | jq -r --arg t "$TAG" '[.data[] | select(.repositories[]?.tags[]?.name == $t) | select(.certified == true) | .architecture] | unique | join(",")')"
+            echo "attempt ${attempt}: certified architectures for ${TAG}: ${certified:-none}"
+            if [[ "$certified" == "amd64,arm64" ]]; then
+              echo "Both architectures certified. Auto-publish is enabled on the component, so the catalog updates on its own."
+              exit 0
+            fi
+            sleep 30
+          done
+          echo "::error::Pyxis has not marked both architectures certified after 10 minutes. Check https://connect.redhat.com/component/view/${COMPONENT_ID}/images"
+          exit 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cd431a389..22ab7f566 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,10 +6,11 @@ on:
       - "v*"
     branches:
       - main
+      - "release-*"
   pull_request:
 
 env:
-  SIGN_PIPE_VER: "v0.1.6"
+  SIGN_PIPE_VER: "v0.1.8"
   GORELEASER_VER: "v2.16.0"
   PRODUCT_NAME: "NetBird"
   COPYRIGHT: "NetBird GmbH"
@@ -22,8 +23,50 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  freebsd_port_trigger:
+    name: "FreeBSD Port / Trigger"
+    runs-on: ubuntu-22.04
+    outputs:
+      run: ${{ steps.decide.outputs.run }}
+      version: ${{ steps.decide.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Decide whether the port job runs
+        id: decide
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          run=false
+          case "$GITHUB_EVENT_NAME" in
+            push)
+              if [[ "$GITHUB_REF" == "refs/heads/main" ]]; then
+                run=true
+              elif [[ "$GITHUB_REF" == refs/tags/* && "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+                # The port tracks stable releases only, so a canary or rc tag has nothing to submit.
+                run=true
+                echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+              fi
+              ;;
+            pull_request)
+              git fetch --depth=1 origin "$BASE_SHA"
+              if git diff --name-only "$BASE_SHA" HEAD | \
+                  grep -qE '^(release_files/freebsd-port-.*\.sh|\.github/workflows/release\.yml)$'; then
+                run=true
+              fi
+              ;;
+          esac
+          echo "run=$run" >> "$GITHUB_OUTPUT"
+          echo "FreeBSD port job runs: $run"
+
   release_freebsd_port:
     name: "FreeBSD Port / Build & Test"
+    needs: freebsd_port_trigger
+    if: needs.freebsd_port_trigger.outputs.run == 'true'
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
@@ -32,18 +75,19 @@ jobs:
           persist-credentials: false
 
       - name: Generate FreeBSD port diff
-        run: bash -x release_files/freebsd-port-diff.sh
-
-      - name: Generate FreeBSD port issue body
-        run: bash -x release_files/freebsd-port-issue-body.sh
+        env:
+          TARGET_VERSION: ${{ needs.freebsd_port_trigger.outputs.version }}
+        run: bash -x release_files/freebsd-port-diff.sh "$TARGET_VERSION"
 
       - name: Check if diff was generated
         id: check_diff
         run: |
-          if ls netbird-*.diff 1> /dev/null 2>&1; then
-            echo "diff_exists=true" >> $GITHUB_OUTPUT
+          shopt -s nullglob
+          diffs=(netbird-*.diff)
+          if [[ ${#diffs[@]} -gt 0 ]]; then
+            echo "diff_exists=true" >> "$GITHUB_OUTPUT"
           else
-            echo "diff_exists=false" >> $GITHUB_OUTPUT
+            echo "diff_exists=false" >> "$GITHUB_OUTPUT"
             echo "No diff file generated (port may already be up to date)"
           fi
 
@@ -51,10 +95,18 @@ jobs:
         if: steps.check_diff.outputs.diff_exists == 'true'
         id: version
         run: |
-          VERSION=$(ls netbird-*.diff | sed 's/netbird-\(.*\)\.diff/\1/')
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          diffs=(netbird-*.diff)
+          VERSION="${diffs[0]#netbird-}"
+          VERSION="${VERSION%.diff}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "Generated files for version: $VERSION"
-          cat netbird-*.diff
+          cat "${diffs[0]}"
+
+      - name: Generate FreeBSD port issue body
+        if: steps.check_diff.outputs.diff_exists == 'true'
+        env:
+          TARGET_VERSION: ${{ steps.version.outputs.version }}
+        run: bash -x release_files/freebsd-port-issue-body.sh "" "$TARGET_VERSION"
 
       - name: Read Go version from go.mod
         id: goversion
@@ -68,7 +120,7 @@ jobs:
         with:
           usesh: true
           copyback: false
-          release: "15.0"
+          release: "15.1"
           envs: "GO_VERSION"
           prepare: |
             # Install required packages
@@ -185,6 +237,22 @@ jobs:
         run: bash shared/management/http/api/generate.sh
       - name: check git status
         run: git --no-pager diff --exit-code
+      - name: Generate RPM changelog from git tags
+        # nfpm embeds changelog.yml into the RPM; Red Hat software certification
+        # requires a changelog. Generated, not committed (see .gitignore).
+        # chglog is a go.mod tool directive, so go.sum pins it and its deps.
+        run: bash release_files/rpm-changelog.sh
+      - name: Fill the RPM ISA provide version
+        # nfpm cannot emit rpmbuild's ISA provide and GoReleaser cannot template it.
+        run: bash release_files/rpm-provides.sh
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+      - name: Install proxy web dependencies for license collection
+        # release_files/collect-licenses.sh -w reads the proxy UI's license terms from node_modules.
+        working-directory: proxy/web
+        run: npm ci --ignore-scripts
       - name: Set up QEMU
         uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 #v4.1.0
       - name: Set up Docker Buildx
@@ -214,24 +282,28 @@ jobs:
           echo "GPG_RPM_KEY_FILE=/tmp/gpg-rpm-signing-key.asc" >> $GITHUB_ENV
 
       - name: Install goversioninfo
-        run: go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@233067e
+        run: go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@b66839b # v1.7.0
       - name: Generate windows syso amd64
-        run: goversioninfo  -icon client/ui/assets/netbird.ico -manifest client/manifest.xml -product-name ${{ env.PRODUCT_NAME }} -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/resources_windows_amd64.syso
+        run: goversioninfo  -icon client/ui/build/windows/icon.ico -manifest client/manifest.xml -product-name ${{ env.PRODUCT_NAME }} -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/resources_windows_amd64.syso
       - name: Generate windows syso arm64
-        run: goversioninfo -arm -64 -icon client/ui/assets/netbird.ico -manifest client/manifest.xml -product-name ${{ env.PRODUCT_NAME }} -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/resources_windows_arm64.syso
+        run: goversioninfo -arm -64 -icon client/ui/build/windows/icon.ico -manifest client/manifest.xml -product-name ${{ env.PRODUCT_NAME }} -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/resources_windows_arm64.syso
       - name: Run GoReleaser
         id: goreleaser
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           version: ${{ env.GORELEASER_VER }}
-          args: release --clean ${{ env.flags }}
+          args: release --config .goreleaser.generated.yaml --clean ${{ env.flags }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
           UPLOAD_DEBIAN_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
           UPLOAD_YUM_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
           GPG_RPM_KEY_FILE: ${{ env.GPG_RPM_KEY_FILE }}
-          NFPM_NETBIRD_RPM_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
+          # One per nfpm id: GoReleaser looks the passphrase up as NFPM_<ID>_PASSPHRASE.
+          NFPM_NETBIRD_RPM_AMD64_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
+          NFPM_NETBIRD_RPM_ARM64_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
+          NFPM_NETBIRD_RPM_ARM_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
+          NFPM_NETBIRD_RPM_386_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
           SKIP_PUBLISH: ${{ env.SKIP_PUBLISH }}
           SKIP_DOCKER_PUSH: ${{ env.SKIP_DOCKER_PUSH }}
       - name: Verify RPM signatures
@@ -254,15 +326,23 @@ jobs:
         id: tag_and_push_images
         if: |
           (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
-          (github.event_name == 'push' && github.ref == 'refs/heads/main')
+          (github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')))
         run: |
           set -euo pipefail
 
+          # $GITHUB_REF / $GITHUB_EVENT_NAME are read from the runner
+          # environment rather than substituted into this script with the
+          # workflow expression syntax: branch names may legally contain
+          # $(…), and interpolating github.ref would execute it.
           resolve_tags() {
-            if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
               echo "pr-${{ github.event.pull_request.number }}"
-            else
+            elif [[ "$GITHUB_REF" == "refs/heads/main" ]]; then
               echo "main sha-$(git rev-parse --short HEAD)"
+            else
+              # Release branches get an immutable sha-* tag only — the floating
+              # "main" tag must never move from a release branch.
+              echo "sha-$(git rev-parse --short HEAD)"
             fi
           }
 
@@ -278,10 +358,17 @@ jobs:
           image_refs=()
 
           tag_and_push() {
-            local src="$1" img_name tag dst
+            local src="$1" img_name tag dst variant=""
             img_name="${src%%:*}"
+            # Variants share a repository with their default image, so keep
+            # their tag suffixes. Order matters: the first matching pattern wins.
+            case "$src" in
+              *-rootless-ubi-amd64) variant="-rootless-ubi" ;;
+              *-rootless-amd64) variant="-rootless" ;;
+              *-ubi-amd64) variant="-ubi" ;;
+            esac
             for tag in $(resolve_tags); do
-              dst="${img_name}:${tag}"
+              dst="${img_name}:${tag}${variant}"
               echo "Tagging ${src} -> ${dst}"
               docker tag "$src" "$dst"
               docker push "$dst"
@@ -327,7 +414,11 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
           name: linux-packages
-          path: dist/netbird_linux**
+          path: |
+            dist/netbird_linux**
+            dist/netbird-pkcs11_linux**
+            dist/netbird-deb-32bit_linux**
+            dist/netbird-rpm-*_linux**
           retention-days: 7
       - name: upload windows packages
         id: upload_windows_packages
@@ -344,6 +435,24 @@ jobs:
           path: dist/netbird_darwin**
           retention-days: 7
 
+  # Certify the UBI images in the Red Hat Ecosystem Catalog on stable tags.
+  # See redhat-certify.yml, which can also be run by hand for any released version.
+  redhat_certification:
+    name: "Red Hat"
+    needs: release
+    if: |
+      github.repository == 'netbirdio/netbird' &&
+      startsWith(github.ref, 'refs/tags/v') &&
+      !contains(github.ref_name, '-')
+    permissions:
+      contents: read
+    uses: ./.github/workflows/redhat-certify.yml
+    with:
+      component: all
+      version: ${{ github.ref_name }}
+    secrets:
+      PYXIS_API_TOKEN: ${{ secrets.PYXIS_API_TOKEN }}
+
   release_ui:
     runs-on: ubuntu-latest
     outputs:
@@ -397,8 +506,18 @@ jobs:
       - name: check git status
         run: git --no-pager diff --exit-code
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          version: 11
+
       - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libappindicator3-dev gir1.2-appindicator3-0.1 libxxf86vm-dev gcc-mingw-w64-x86-64
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev gcc-mingw-w64-x86-64
 
       - name: Decode GPG signing key
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
@@ -416,11 +535,17 @@ jobs:
           tar -xf llvm-mingw-20250709-ucrt-ubuntu-22.04-x86_64.tar.xz
           echo "/tmp/llvm-mingw-20250709-ucrt-ubuntu-22.04-x86_64/bin" >> $GITHUB_PATH
       - name: Install goversioninfo
-        run: go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@233067e
+        run: go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@b66839b # v1.7.0
+      - name: Install wails3 CLI
+        # Version derived from go.mod so the binding generator always matches
+        # the wails runtime the binary links against.
+        run: |
+          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
+          go install github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
       - name: Generate windows syso amd64
-        run: goversioninfo -64 -icon client/ui/assets/netbird.ico -manifest client/ui/manifest.xml -product-name ${{ env.PRODUCT_NAME }}-"UI" -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/ui/resources_windows_amd64.syso
+        run: goversioninfo -64 -icon client/ui/build/windows/icon.ico -manifest client/ui/build/windows/wails.exe.manifest -product-name ${{ env.PRODUCT_NAME }}-"UI" -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/ui/resources_windows_amd64.syso
       - name: Generate windows syso arm64
-        run: goversioninfo -arm -64 -icon client/ui/assets/netbird.ico -manifest client/ui/manifest.xml -product-name ${{ env.PRODUCT_NAME }}-"UI" -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/ui/resources_windows_arm64.syso
+        run: goversioninfo -arm -64 -icon client/ui/build/windows/icon.ico -manifest client/ui/build/windows/wails.exe.manifest -product-name ${{ env.PRODUCT_NAME }}-"UI" -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/ui/resources_windows_arm64.syso
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
@@ -459,6 +584,132 @@ jobs:
           path: dist/
           retention-days: 3
 
+  release_ui_gtk3:
+    # Legacy GTK3/WebKit2GTK 4.1 UI build for distros without WebKitGTK 6.0
+    # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). Runs on ubuntu-22.04 so
+    # the binary links against the oldest supported glibc.
+    runs-on: ubuntu-22.04
+    outputs:
+      release_ui_gtk3_artifact_url: ${{ steps.upload_release_ui_gtk3.outputs.artifact-url }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0 # It is required for GoReleaser to work properly
+          persist-credentials: false
+
+      - name: Parse semver string
+        id: semver_parser
+        uses: netbirdio/shared-actions/actions/parse-semver@be5df6047383da2236e02243cceb857d8567c27e # v0.0.2
+
+      - name: Set snapshot flag
+        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        run: |
+          echo "flags=--snapshot" >> $GITHUB_ENV
+
+      - name: Set build vars
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        run: |
+          if [[ "x-${{ steps.semver_parser.outputs.prerelease }}" == "x-" && "x-${{ github.repository }}" == "x-netbirdio/netbird" ]]; then
+            echo "x-${{ github.repository }}"
+            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
+            echo "SKIP_PUBLISH=false" >> $GITHUB_ENV
+          else
+            echo "x-${{ github.repository }}"
+            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
+          fi
+
+      - name: Set up Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+      - name: Cache Go modules
+        # Restore-only from the release_ui cache written by trusted runs; the
+        # module cache is identical (same go.sum) and stale build-cache
+        # entries just miss.
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-ui-go-releaser-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-ui-go-releaser-
+
+      - name: Install modules
+        run: go mod tidy
+
+      - name: check git status
+        run: git --no-pager diff --exit-code
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          version: 11
+
+      - name: Install dependencies
+        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libwebkit2gtk-4.1-dev
+
+      - name: Decode GPG signing key
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          GPG_RPM_PRIVATE_KEY: ${{ secrets.GPG_RPM_PRIVATE_KEY }}
+        run: |
+          echo "$GPG_RPM_PRIVATE_KEY" | base64 -d > /tmp/gpg-rpm-signing-key.asc
+          echo "GPG_RPM_KEY_FILE=/tmp/gpg-rpm-signing-key.asc" >> $GITHUB_ENV
+
+      - name: Install wails3 CLI
+        # Version derived from go.mod so the binding generator always matches
+        # the wails runtime the binary links against.
+        # -tags gtk3: the CLI links the wails runtime's cgo packages, and the
+        # default tags request gtk4/webkitgtk-6.0 pkg-config entries that do
+        # not exist on ubuntu-22.04.
+        run: |
+          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
+          go install -tags gtk3 github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        with:
+          version: ${{ env.GORELEASER_VER }}
+          args: release --config .goreleaser_ui_gtk3.yaml --clean ${{ env.flags }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          UPLOAD_DEBIAN_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
+          UPLOAD_YUM_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
+          GPG_RPM_KEY_FILE: ${{ env.GPG_RPM_KEY_FILE }}
+          NFPM_NETBIRD_UI_RPM_GTK3_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
+          SKIP_PUBLISH: ${{ env.SKIP_PUBLISH }}
+      - name: Verify RPM signatures
+        run: |
+          docker run --rm -v $(pwd)/dist:/dist fedora:41 bash -c '
+            dnf install -y -q rpm-sign curl >/dev/null 2>&1
+            curl -sSL https://pkgs.netbird.io/yum/repodata/repomd.xml.key -o /tmp/rpm-pub.key
+            rpm --import /tmp/rpm-pub.key
+            echo "=== Verifying RPM signatures ==="
+            for rpm_file in /dist/*.rpm; do
+              [ -f "$rpm_file" ] || continue
+              echo "--- $(basename $rpm_file) ---"
+              rpm -K "$rpm_file"
+            done
+          '
+      - name: Clean up GPG key
+        if: always()
+        run: rm -f /tmp/gpg-rpm-signing-key.asc
+      - name: upload non tags for debug purposes
+        id: upload_release_ui_gtk3
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
+        with:
+          name: release-ui-gtk3
+          path: dist/
+          retention-days: 3
+
   release_ui_darwin:
     runs-on: macos-latest
     outputs:
@@ -489,6 +740,20 @@ jobs:
         run: go mod tidy
       - name: check git status
         run: git --no-pager diff --exit-code
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+      - name: Set up pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          version: 11
+      - name: Install wails3 CLI
+        # Version derived from go.mod so the binding generator always matches
+        # the wails runtime the binary links against.
+        run: |
+          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
+          go install github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
       - name: Run GoReleaser
         id: goreleaser
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
@@ -576,23 +841,6 @@ jobs:
       - name: Move wintun.dll into dist
         run: mv ${{ env.downloadPath }}\wintun\bin\${{ matrix.wintun_arch }}\wintun.dll ${{ github.workspace }}\dist\${{ env.PackageWorkdir }}\
 
-      - name: Download Mesa3D (amd64 only)
-        id: download-mesa3d
-        if: matrix.arch == 'amd64'
-        uses: netbirdio/shared-actions/actions/win-download-and-verify@be5df6047383da2236e02243cceb857d8567c27e # v0.0.2
-        with:
-          url: https://pkgs.netbird.io/mesa3d/MesaForWindows-x64-20.1.8.7z
-          destination: ${{ env.downloadPath }}\mesa3d.7z
-          sha256: 71c7cb64ec229a1d6b8d62fa08e1889ed2bd17c0eeede8689daf0f25cb31d6b9
-
-      - name: Extract Mesa3D driver (amd64 only)
-        if: matrix.arch == 'amd64'
-        run: 7z x -o"${{ env.downloadPath }}" "${{ env.downloadPath }}/mesa3d.7z"
-
-      - name: Move opengl32.dll into dist (amd64 only)
-        if: matrix.arch == 'amd64'
-        run: mv ${{ env.downloadPath }}\opengl32.dll ${{ github.workspace }}\dist\${{ env.PackageWorkdir }}\
-
       - name: Download EnVar plugin for NSIS
         uses: netbirdio/shared-actions/actions/win-download-and-verify@be5df6047383da2236e02243cceb857d8567c27e # v0.0.2
         with:
@@ -615,6 +863,28 @@ jobs:
         if: matrix.arch == 'amd64'
         run: 7z x -o"${{ github.workspace }}/NSIS_Plugins" "${{ github.workspace }}/ShellExecAsUser_amd64-Unicode.7z"
 
+      - name: Set up Go for wails3 CLI
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - name: Install wails3 CLI
+        # Version derived from go.mod so the bootstrapper payload always
+        # matches the wails runtime the binary links against.
+        shell: bash
+        run: |
+          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
+          go install github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
+
+      - name: Stage WebView2 bootstrapper for installers
+        # Both client/installer.nsis and client/netbird.wxs reference
+        # client/MicrosoftEdgeWebview2Setup.exe. wails3 writes it there.
+        # The signing pipeline (netbirdio/sign-pipelines) does the same
+        # step for release builds; this mirrors it for PR sanity testing.
+        shell: bash
+        run: wails3 generate webview2bootstrapper -dir client
+
       - name: Build NSIS installer
         shell: pwsh
         env:
@@ -653,7 +923,7 @@ jobs:
   comment_release_artifacts:
     name: Comment release artifacts
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_darwin]
+    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin]
     if: ${{ always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
     permissions:
       contents: read
@@ -665,12 +935,14 @@ jobs:
         env:
           RELEASE_RESULT: ${{ needs.release.result }}
           RELEASE_UI_RESULT: ${{ needs.release_ui.result }}
+          RELEASE_UI_GTK3_RESULT: ${{ needs.release_ui_gtk3.result }}
           RELEASE_UI_DARWIN_RESULT: ${{ needs.release_ui_darwin.result }}
           RELEASE_ARTIFACT_URL: ${{ needs.release.outputs.release_artifact_url }}
           LINUX_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.linux_packages_artifact_url }}
           WINDOWS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.windows_packages_artifact_url }}
           MACOS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.macos_packages_artifact_url }}
           RELEASE_UI_ARTIFACT_URL: ${{ needs.release_ui.outputs.release_ui_artifact_url }}
+          RELEASE_UI_GTK3_ARTIFACT_URL: ${{ needs.release_ui_gtk3.outputs.release_ui_gtk3_artifact_url }}
           RELEASE_UI_DARWIN_ARTIFACT_URL: ${{ needs.release_ui_darwin.outputs.release_ui_darwin_artifact_url }}
           GHCR_IMAGES_MARKDOWN: ${{ needs.release.outputs.ghcr_images }}
         with:
@@ -693,6 +965,7 @@ jobs:
               ['Windows packages', process.env.WINDOWS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['macOS packages', process.env.MACOS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['UI artifacts', process.env.RELEASE_UI_ARTIFACT_URL, process.env.RELEASE_UI_RESULT],
+              ['UI GTK3 artifacts', process.env.RELEASE_UI_GTK3_ARTIFACT_URL, process.env.RELEASE_UI_GTK3_RESULT],
               ['UI macOS artifacts', process.env.RELEASE_UI_DARWIN_ARTIFACT_URL, process.env.RELEASE_UI_DARWIN_RESULT],
             ];
 
@@ -749,7 +1022,7 @@ jobs:
 
   trigger_signer:
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_darwin, test_windows_installer]
+    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin, test_windows_installer]
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Trigger binaries sign pipelines
diff --git a/.github/workflows/reverse-proxy-e2e.yml b/.github/workflows/reverse-proxy-e2e.yml
new file mode 100644
index 000000000..934a6d4c9
--- /dev/null
+++ b/.github/workflows/reverse-proxy-e2e.yml
@@ -0,0 +1,53 @@
+name: Reverse Proxy E2E
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/reverse-proxy-e2e.yml'
+      - '**/*.go'
+      - 'e2e/**'
+      - 'shared/management/**'
+      - 'combined/Dockerfile*'
+      - 'proxy/Dockerfile*'
+      - '.dockerignore'
+      - 'go.mod'
+      - 'go.sum'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  reverse-proxy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - name: Cache Docker layers
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: /tmp/.reverse-proxy-buildx-cache
+          key: ${{ runner.os }}-reverse-proxy-e2e-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage') }}
+          restore-keys: |
+            ${{ runner.os }}-reverse-proxy-e2e-
+
+      - name: Run reverse-proxy E2E
+        env:
+          NB_E2E_BUILDX_CACHE: /tmp/.reverse-proxy-buildx-cache
+        run: go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
diff --git a/.github/workflows/sync-tag.yml b/.github/workflows/sync-tag.yml
index d99f88b54..608f3c6d7 100644
--- a/.github/workflows/sync-tag.yml
+++ b/.github/workflows/sync-tag.yml
@@ -9,21 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
   cancel-in-progress: true
 
-# Receiving workflows (cloud sync-tag, mobile bump-netbird) expect the short
-# tag form (e.g. v0.30.0), not refs/tags/v0.30.0 — github.ref_name, not github.ref.
+# The receiving bump-netbird workflows expect the short tag form
+# (e.g. v0.30.0), not refs/tags/v0.30.0 — github.ref_name, not github.ref.
 jobs:
-  trigger_sync_tag:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger release tag sync
-        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
-        with:
-          workflow: sync-tag.yml
-          ref: main
-          repo: ${{ secrets.UPSTREAM_REPO }}
-          token: ${{ secrets.NC_GITHUB_TOKEN }}
-          inputs: '{ "tag": "${{ github.ref_name }}" }'
-
   trigger_android_bump:
     runs-on: ubuntu-latest
     if: github.event.created && !github.event.deleted && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
@@ -49,3 +37,16 @@ jobs:
           repo: netbirdio/ios-client
           token: ${{ secrets.NC_GITHUB_TOKEN }}
           inputs: '{ "tag": "${{ github.ref_name }}" }'
+
+  trigger_dashboard_bump:
+    runs-on: ubuntu-latest
+    if: github.event.created && !github.event.deleted && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
+    steps:
+      - name: Trigger dashboard wasm client bump
+        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
+        with:
+          workflow: bump-netbird.yml
+          ref: main
+          repo: netbirdio/dashboard
+          token: ${{ secrets.NC_GITHUB_TOKEN }}
+          inputs: '{ "tag": "${{ github.ref_name }}" }'
diff --git a/.github/workflows/test-homebrew-cask.yml b/.github/workflows/test-homebrew-cask.yml
new file mode 100644
index 000000000..a75951425
--- /dev/null
+++ b/.github/workflows/test-homebrew-cask.yml
@@ -0,0 +1,46 @@
+name: Test Homebrew cask
+
+on:
+  pull_request:
+    paths:
+      - "client/ui/netbird-ui.rb.tmpl"
+      - ".github/scripts/test-homebrew-cask.sh"
+      - ".github/workflows/test-homebrew-cask.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
+  cancel-in-progress: true
+
+jobs:
+  install-uninstall:
+    runs-on: macos-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Clone the Homebrew tap
+        run: git clone https://github.com/netbirdio/homebrew-tap.git .homebrew-cask-tap
+
+      - name: Update Homebrew and install gomplate
+        # The runner image disables auto-update; the cask steps DSL needs Homebrew 6.0.20 or newer.
+        run: |
+          brew update
+          brew install gomplate
+
+      - name: Install and uninstall the cask
+        run: .github/scripts/test-homebrew-cask.sh
+
+      - name: Upload logs
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
+        with:
+          name: homebrew-cask-results
+          path: ${{ runner.temp }}/homebrew-cask/results
+          if-no-files-found: ignore
diff --git a/.github/workflows/test-infrastructure-files.yml b/.github/workflows/test-infrastructure-files.yml
index 0a4f2e371..4875adc31 100644
--- a/.github/workflows/test-infrastructure-files.yml
+++ b/.github/workflows/test-infrastructure-files.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - "release-*"
   pull_request:
     paths:
       - "infrastructure_files/**"
@@ -249,78 +250,56 @@ jobs:
           docker compose exec management ls -l /var/lib/netbird/ | grep -i GeoLite2-City_[0-9]*.mmdb
           docker compose exec management ls -l /var/lib/netbird/ | grep -i geonames_[0-9]*.db
 
-  test-getting-started-script:
+  test-legacy-getting-started-scripts:
     runs-on: ubuntu-latest
     steps:
-      - name: Install jq
-        run: sudo apt-get install -y jq
-
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - name: run script with Zitadel PostgreSQL
-        run: NETBIRD_DOMAIN=use-ip bash -x infrastructure_files/getting-started-with-zitadel.sh
+      - name: Verify enterprise Traefik tag validation
+        run: bash infrastructure_files/tests/test-getting-started-enterprise.sh
 
-      - name: test Caddy file gen postgres
-        run: test -f Caddyfile
+      - name: Verify community Traefik image validation
+        run: bash infrastructure_files/tests/test-getting-started.sh
 
-      - name: test docker-compose file gen postgres
-        run: test -f docker-compose.yml
+      - name: Verify community Compose network scoping
+        run: bash infrastructure_files/tests/test-getting-started-networks.sh
 
-      - name: test management.json file gen postgres
-        run: test -f management.json
+      - name: Verify migration Compose network scoping
+        run: bash infrastructure_files/tests/test-getting-started-networks.sh --migration
 
-      - name: test turnserver.conf file gen postgres
+      - name: Verify fresh-install session cookie key hardening
         run: |
-          set -x
-          test -f turnserver.conf
-          grep external-ip turnserver.conf
+          grep -Fxq '  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)' infrastructure_files/getting-started.sh
+          grep -Fxq '    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"' infrastructure_files/getting-started.sh
+          grep -Fxq '  install -m 600 /dev/null config.yaml' infrastructure_files/getting-started.sh
+          grep -Fxq '  openssl rand -base64 32' infrastructure_files/getting-started-enterprise.sh
+          grep -Fxq '  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)' infrastructure_files/getting-started-enterprise.sh
+          grep -Fxq '    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"' infrastructure_files/getting-started-enterprise.sh
 
-      - name: test zitadel.env file gen postgres
-        run: test -f zitadel.env
-
-      - name: test dashboard.env file gen postgres
-        run: test -f dashboard.env
-
-      - name: test relay.env file gen postgres
-        run: test -f relay.env
-
-      - name: test zdb.env file gen postgres
-        run: test -f zdb.env
-
-      - name: Postgres run cleanup
+      - name: Verify Dex retirement notice
         run: |
-          docker compose down --volumes --rmi all
-          rm -rf docker-compose.yml Caddyfile zitadel.env dashboard.env machinekey/zitadel-admin-sa.token turnserver.conf management.json zdb.env
+          if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then
+            echo "Expected the retired Dex installer to fail"
+            exit 1
+          fi
+          test ! -s stdout.txt
+          grep -Fq "Dex support is not deprecated." stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-quickstart" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/identity-providers/local" stderr.txt
+          grep -Fq "removed in NetBird v0.80" stderr.txt
 
-      - name: run script with Zitadel CockroachDB
-        run: bash -x infrastructure_files/getting-started-with-zitadel.sh
-        env:
-          NETBIRD_DOMAIN: use-ip
-          ZITADEL_DATABASE: cockroach
-
-      - name: test Caddy file gen CockroachDB
-        run: test -f Caddyfile
-
-      - name: test docker-compose file gen CockroachDB
-        run: test -f docker-compose.yml
-
-      - name: test management.json file gen CockroachDB
-        run: test -f management.json
-
-      - name: test turnserver.conf file gen CockroachDB
+      - name: Verify Zitadel retirement notice
         run: |
-          set -x
-          test -f turnserver.conf
-          grep external-ip turnserver.conf
-
-      - name: test zitadel.env file gen CockroachDB
-        run: test -f zitadel.env
-
-      - name: test dashboard.env file gen CockroachDB
-        run: test -f dashboard.env
-
-      - name: test relay.env file gen CockroachDB
-        run: test -f relay.env
+          if bash infrastructure_files/getting-started-with-zitadel.sh >stdout.txt 2>stderr.txt; then
+            echo "Expected the retired Zitadel installer to fail"
+            exit 1
+          fi
+          test ! -s stdout.txt
+          grep -Fq "Zitadel support and existing Zitadel deployments are not deprecated." stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-quickstart" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/identity-providers/zitadel" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-guide" stderr.txt
+          grep -Fq "removed in NetBird v0.80" stderr.txt
diff --git a/.github/workflows/ui-translations.yml b/.github/workflows/ui-translations.yml
new file mode 100644
index 000000000..9ac524495
--- /dev/null
+++ b/.github/workflows/ui-translations.yml
@@ -0,0 +1,43 @@
+name: UI Translations
+
+on:
+  pull_request:
+    paths:
+      - "client/ui/i18n/locales/**"
+      - "client/ui/i18n/check-translations.mjs"
+      - ".github/workflows/ui-translations.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "client/ui/i18n/locales/**"
+      - "client/ui/i18n/check-translations.mjs"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
+  cancel-in-progress: true
+
+jobs:
+  check-translations:
+    name: Check translation key parity
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+
+      # English (en) is the source of truth for translation keys. Locales declared
+      # in _index.json fail on orphaned keys or placeholder mismatches; missing
+      # keys only warn, since they fall back to English at runtime.
+      - name: Check translation key parity
+        run: node client/ui/i18n/check-translations.mjs
diff --git a/.github/workflows/wasm-build-validation.yml b/.github/workflows/wasm-build-validation.yml
index 35855918d..5f21472e5 100644
--- a/.github/workflows/wasm-build-validation.yml
+++ b/.github/workflows/wasm-build-validation.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - "release-*"
   pull_request:
 
 concurrency:
@@ -27,7 +28,7 @@ jobs:
         with:
           go-version-file: "go.mod"
       - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev libpcap-dev
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev libpcap-dev
       - name: Install golangci-lint
         uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #v9.2.1
         with:
diff --git a/.gitignore b/.gitignore
index 305f3cb50..5c01f6e60 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,10 @@ vendor/
 /netbird
 client/netbird-electron/
 management/server/types/testdata/
+
+# generated by chglog in the release workflow, embedded into the RPM
+changelog.yml
+
+# generated by rpm-provides.sh, the config GoReleaser actually runs
+.goreleaser.generated.yaml
+.chglog.yml
diff --git a/.golangci.yaml b/.golangci.yaml
index 900af4ac0..e350b9de7 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -114,6 +114,16 @@ linters:
       - linters:
           - staticcheck
         text: "QF1012"
+      # client/ui/main.go uses //go:embed all:frontend/dist; the
+      # directory is populated by `pnpm build` in the release pipeline
+      # and missing at lint time, so the embed parses to "no matching
+      # files found" — surfaced by golangci-lint's typecheck pre-pass.
+      # Suppress just that one diagnostic; the rest of the package
+      # (services/, tray.go, grpc.go, ...) still gets linted normally.
+      - linters:
+          - typecheck
+        path: client/ui/main\.go
+        text: "pattern all:frontend/dist"
     paths:
       - third_party$
       - builtin$
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index a2640dc8e..41c330a64 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -40,6 +40,73 @@ builds:
     tags:
       - load_wgnt_from_rsrc
 
+  # deb and rpm packages target glibc distributions, so on amd64 and arm64, the only
+  # architectures with a PKCS#11 driver, they carry the PKCS#11 store, which links libc.
+  # Tarballs, the Alpine-based images and the other architectures keep the static build.
+  - id: netbird-pkcs11
+    dir: client
+    binary: netbird
+    env: [CGO_ENABLED=0]
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - load_wgnt_from_rsrc
+      - pkcs11
+
+  # The 32-bit deb architectures, which have no PKCS#11 driver.
+  - id: netbird-deb-32bit
+    dir: client
+    binary: netbird
+    env: [CGO_ENABLED=0]
+    goos:
+      - linux
+    goarch:
+      - arm
+      - 386
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - load_wgnt_from_rsrc
+
+  # Single-arch builds: nfpm provides is not templated, so the RPM splits per arch. The
+  # ones with a PKCS#11 driver carry the store like the deb build above.
+  - &netbird_rpm_build
+    id: netbird-rpm-amd64
+    dir: client
+    binary: netbird
+    env: [CGO_ENABLED=0]
+    goos: [linux]
+    goarch: [amd64]
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - load_wgnt_from_rsrc
+      - pkcs11
+
+  - <<: *netbird_rpm_build
+    id: netbird-rpm-arm64
+    goarch: [arm64]
+
+  - <<: *netbird_rpm_build
+    id: netbird-rpm-arm
+    goarch: [arm]
+    tags:
+      - load_wgnt_from_rsrc
+
+  - <<: *netbird_rpm_build
+    id: netbird-rpm-386
+    goarch: [386]
+    tags:
+      - load_wgnt_from_rsrc
+
   - id: netbird-static
     dir: client
     binary: netbird
@@ -168,6 +235,29 @@ builds:
       - -s -w -X main.Version={{.Version}} -X main.Commit={{.Commit}} -X main.BuildDate={{.CommitDate}}
     mod_timestamp: "{{ .CommitTimestamp }}"
 
+  - id: nblink
+    dir: client/link/cmd/nblink
+    env: [CGO_ENABLED=0]
+    binary: nblink
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+      - arm
+    goarm:
+      - 7
+    ignore:
+      - goos: windows
+        goarch: arm
+      - goos: darwin
+        goarch: arm
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}}
+    mod_timestamp: "{{ .CommitTimestamp }}"
+
   - id: netbird-idp-migrate
     dir: tools/idp-migrate
     env:
@@ -190,6 +280,28 @@ builds:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
     mod_timestamp: "{{ .CommitTimestamp }}"
 
+  - id: netbird-mysql-migrate
+    dir: tools/mysql-migrate
+    env:
+      - CGO_ENABLED=1
+      - >-
+        {{- if eq .Runtime.Goos "linux" }}
+          {{- if eq .Arch "arm64"}}CC=aarch64-linux-gnu-gcc{{- end }}
+          {{- if eq .Arch "arm"}}CC=arm-linux-gnueabihf-gcc{{- end }}
+        {{- end }}
+    binary: netbird-mysql-migrate
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+      - arm
+    goarm:
+      - 7
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
+    mod_timestamp: "{{ .CommitTimestamp }}"
+
 universal_binaries:
   - id: netbird
 
@@ -206,38 +318,106 @@ archives:
     builds:
       - netbird-idp-migrate
     name_template: "netbird-idp-migrate_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+  - id: netbird-mysql-migrate
+    builds:
+      - netbird-mysql-migrate
+    name_template: "netbird-mysql-migrate_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+  - id: nblink
+    builds:
+      - nblink
+    name_template: "nblink_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    # goreleaser archives as tar.gz everywhere unless told otherwise, and
+    # nblink is downloaded and extracted by hand on Windows too.
+    format_overrides:
+      - goos: windows
+        format: zip
 
 nfpms:
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client.
     homepage: https://netbird.io/
     license: BSD-3-Clause
+    vendor: NetBird
     id: netbird_deb
     bindir: /usr/bin
     builds:
-      - netbird
+      - netbird-pkcs11
+      - netbird-deb-32bit
     formats:
       - deb
     scripts:
       postinstall: "release_files/post_install.sh"
       preremove: "release_files/pre_remove.sh"
 
-  - maintainer: Netbird <dev@netbird.io>
+  - &netbird_rpm
+    maintainer: Netbird <dev@netbird.io>
     description: Netbird client.
     homepage: https://netbird.io/
     license: BSD-3-Clause
-    id: netbird_rpm
+    vendor: NetBird
+    id: netbird_rpm_amd64
     bindir: /usr/bin
-    builds:
-      - netbird
+    ids:
+      - netbird-rpm-amd64
     formats:
       - rpm
+    # Red Hat certification (RPM Version Handling) requires rpmbuild's ISA
+    # provide, which nfpm does not emit. The version is filled in by the release job.
+    provides:
+      - "netbird(x86-64) = @RPM_EVR@"
+    # The client verifies TLS to management and signal against the system trust
+    # store. Red Hat software certification (RPM Dependency Tracking) also
+    # rejects packages that declare no dependencies at all.
+    dependencies:
+      - ca-certificates
+    # Generated in CI by chglog from git tags; Red Hat certification requires an
+    # RPM changelog (RPM Version Handling subtest).
+    changelog: changelog.yml
+    # License, documentation and a config file so the RPM Provenance subtest sees
+    # %license, %doc and %config entries instead of a bare binary.
+    contents:
+      - src: LICENSE
+        dst: /usr/share/licenses/netbird/LICENSE
+        type: license
+      - src: README.md
+        dst: /usr/share/doc/netbird/README.md
+        type: doc
+      - src: release_files/netbird.sysconfig
+        dst: /etc/sysconfig/netbird
+        type: config|noreplace
+        # May hold the PKCS#11 token PIN (NB_TPM_PIN), so readable by root alone.
+        file_info:
+          mode: 0600
     scripts:
       postinstall: "release_files/post_install.sh"
       preremove: "release_files/pre_remove.sh"
     rpm:
+      summary: NetBird client
+      group: Applications/Internet
+      packager: NetBird <dev@netbird.io>
       signature:
         key_file: '{{ if index .Env "GPG_RPM_KEY_FILE" }}{{ .Env.GPG_RPM_KEY_FILE }}{{ end }}'
+
+  - <<: *netbird_rpm
+    id: netbird_rpm_arm64
+    ids:
+      - netbird-rpm-arm64
+    provides:
+      - "netbird(aarch-64) = @RPM_EVR@"
+
+  - <<: *netbird_rpm
+    id: netbird_rpm_arm
+    ids:
+      - netbird-rpm-arm
+    provides:
+      - "netbird(armv6hl-32) = @RPM_EVR@"
+
+  - <<: *netbird_rpm
+    id: netbird_rpm_386
+    ids:
+      - netbird-rpm-386
+    provides:
+      - "netbird(x86-32) = @RPM_EVR@"
 dockers_v2:
    - id: netbird
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
@@ -271,8 +451,8 @@ dockers_v2:
        - netbirdio/netbird
        - ghcr.io/netbirdio/netbird
      tags:
-       - "v{{ .Version }}-rootless"
-       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}latest{{ end }}"
+       - "{{ .Version }}-rootless"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}rootless-latest{{ end }}"
      dockerfile: client/Dockerfile-rootless
      extra_files:
        - client/netbird-entrypoint.sh
@@ -287,6 +467,43 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: netbird-rootless-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird
+     images:
+       - netbirdio/netbird
+       - ghcr.io/netbirdio/netbird
+     tags:
+       - "{{ .Version }}-rootless-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}rootless-ubi-latest{{ end }}"
+     dockerfile: client/Dockerfile-rootless.ubi
+     extra_files:
+       - client/netbird-entrypoint.sh
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh release_files/collect-licenses.sh -t load_wgnt_from_rsrc "{{ .ContextDir }}/licenses" ./client amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=0
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: relay
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
@@ -309,6 +526,41 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: relay-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird-relay
+     images:
+       - netbirdio/relay
+       - ghcr.io/netbirdio/relay
+     tags:
+       - "{{ .Version }}-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}ubi-latest{{ end }}"
+     dockerfile: relay/Dockerfile.ubi
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh release_files/collect-licenses.sh -l relay/LICENSE "{{ .ContextDir }}/licenses" ./relay amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=0
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: signal
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
@@ -331,6 +583,41 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: signal-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird-signal
+     images:
+       - netbirdio/signal
+       - ghcr.io/netbirdio/signal
+     tags:
+       - "{{ .Version }}-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}ubi-latest{{ end }}"
+     dockerfile: signal/Dockerfile.ubi
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh release_files/collect-licenses.sh -l signal/LICENSE "{{ .ContextDir }}/licenses" ./signal amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=0
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: management
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
@@ -353,6 +640,41 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: management-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird-mgmt
+     images:
+       - netbirdio/management
+       - ghcr.io/netbirdio/management
+     tags:
+       - "{{ .Version }}-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}ubi-latest{{ end }}"
+     dockerfile: management/Dockerfile.ubi
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh release_files/collect-licenses.sh -l management/LICENSE "{{ .ContextDir }}/licenses" ./management amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=1
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: upload
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
@@ -363,7 +685,7 @@ dockers_v2:
      tags:
        - "{{ .Version }}"
        - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}latest{{ end }}"
-     dockerfile: upload-server/Dockerfile
+     dockerfile: upload-server/Dockerfile.release
      platforms:
        - linux/amd64
        - linux/arm64
@@ -397,6 +719,41 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: netbird-server-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird-server
+     images:
+       - netbirdio/netbird-server
+       - ghcr.io/netbirdio/netbird-server
+     tags:
+       - "{{ .Version }}-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}ubi-latest{{ end }}"
+     dockerfile: combined/Dockerfile.ubi
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh release_files/collect-licenses.sh -l combined/LICENSE "{{ .ContextDir }}/licenses" ./combined amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=1
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: netbird-proxy
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
@@ -419,6 +776,63 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: nblink
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - nblink
+     images:
+       - netbirdio/nblink
+       - ghcr.io/netbirdio/nblink
+     tags:
+       - "{{ .Version }}"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}latest{{ end }}"
+     dockerfile: client/Dockerfile-nblink
+     platforms:
+       - linux/amd64
+       - linux/arm64
+       - linux/arm
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "nblink"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
+   - id: proxy-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird-proxy
+     images:
+       - netbirdio/reverse-proxy
+       - ghcr.io/netbirdio/reverse-proxy
+     tags:
+       - "{{ .Version }}-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}ubi-latest{{ end }}"
+     dockerfile: proxy/Dockerfile.ubi
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh release_files/collect-licenses.sh -l proxy/LICENSE -w "{{ .ContextDir }}/licenses" ./proxy/cmd/proxy amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=0
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
 
 brews:
   - ids:
@@ -451,7 +865,10 @@ uploads:
   - name: yum
     skip: "{{ .Env.SKIP_PUBLISH }}"
     ids:
-      - netbird_rpm
+      - netbird_rpm_amd64
+      - netbird_rpm_arm64
+      - netbird_rpm_arm
+      - netbird_rpm_386
     mode: archive
     target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
@@ -466,6 +883,13 @@ checksum:
     - glob: ./infrastructure_files/migrate-to-enterprise.sh
 
 release:
+  # The signing pipeline (netbirdio/sign-pipelines, dispatched by
+  # trigger_signer) marks the release latest once the Windows and macOS
+  # artifacts are signed. Without this override goreleaser marks it latest
+  # at publish time, while those artifacts are still unsigned.
+  make_latest: false
+  # Mark x.y.z-rc.* and other prerelease tags as prereleases on GitHub.
+  prerelease: auto
   extra_files:
     - glob: ./infrastructure_files/getting-started-with-zitadel.sh
     - glob: ./release_files/install.sh
diff --git a/.goreleaser_ui.yaml b/.goreleaser_ui.yaml
index 6f9b7c059..24903188f 100644
--- a/.goreleaser_ui.yaml
+++ b/.goreleaser_ui.yaml
@@ -2,6 +2,15 @@ version: 2
 env:
   - SKIP_PUBLISH={{ if index .Env "SKIP_PUBLISH" }}{{ .Env.SKIP_PUBLISH }}{{ else }}true{{ end }}
 project_name: netbird-ui
+
+before:
+  hooks:
+    # Bindings are gitignored; regenerate before the frontend build so
+    # the @wailsio/runtime Vite plugin can resolve them (vite refuses to
+    # build without them).
+    - sh -c 'cd client/ui && wails3 generate bindings -clean=true -ts'
+    - sh -c 'cd client/ui/frontend && pnpm install --frozen-lockfile && pnpm build'
+
 builds:
   - id: netbird-ui
     dir: client/ui
@@ -15,6 +24,8 @@ builds:
     ldflags:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
     mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - production
 
   - id: netbird-ui-windows-amd64
     dir: client/ui
@@ -30,6 +41,8 @@ builds:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
       - -H windowsgui
     mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - production
 
   - id: netbird-ui-windows-arm64
     dir: client/ui
@@ -46,6 +59,8 @@ builds:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
       - -H windowsgui
     mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - production
 
 archives:
   - id: linux-arch
@@ -62,6 +77,8 @@ nfpms:
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
     homepage: https://netbird.io/
+    license: BSD-3-Clause
+    vendor: NetBird
     id: netbird_ui_deb
     package_name: netbird-ui
     builds:
@@ -71,16 +88,26 @@ nfpms:
     scripts:
       postinstall: "release_files/ui-post-install.sh"
     contents:
-      - src: client/ui/build/netbird.desktop
-        dst: /usr/share/applications/netbird.desktop
-      - src: client/ui/assets/netbird.png
+      - src: client/ui/build/linux/netbird.desktop
+        dst: /usr/share/applications/org.wails.netbird.desktop
+      - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
+      # Names the polkit action for the elevation prompt the app raises when an
+      # unprivileged user changes a privileged setting; without it the dialog
+      # shows a raw command line.
+      - src: client/ui/build/linux/polkit/io.netbird.settings.policy
+        dst: /usr/share/polkit-1/actions/io.netbird.settings.policy
     dependencies:
-      - netbird
+      - netbird (>= 0.75.0)
+      - libgtk-4-1 (>= 4.14)
+      - libwebkitgtk-6.0-4
+      - xdg-utils
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
     homepage: https://netbird.io/
+    license: BSD-3-Clause
+    vendor: NetBird
     id: netbird_ui_rpm
     package_name: netbird-ui
     builds:
@@ -90,12 +117,21 @@ nfpms:
     scripts:
       postinstall: "release_files/ui-post-install.sh"
     contents:
-      - src: client/ui/build/netbird.desktop
-        dst: /usr/share/applications/netbird.desktop
-      - src: client/ui/assets/netbird.png
+      - src: client/ui/build/linux/netbird.desktop
+        dst: /usr/share/applications/org.wails.netbird.desktop
+      - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
+      # Names the polkit action for the elevation prompt the app raises when an
+      # unprivileged user changes a privileged setting; without it the dialog
+      # shows a raw command line.
+      - src: client/ui/build/linux/polkit/io.netbird.settings.policy
+        dst: /usr/share/polkit-1/actions/io.netbird.settings.policy
     dependencies:
-      - netbird
+      - netbird >= 0.75.0
+      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
+      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
+      - xdg-utils
+
     rpm:
       signature:
         key_file: '{{ if index .Env "GPG_RPM_KEY_FILE" }}{{ .Env.GPG_RPM_KEY_FILE }}{{ end }}'
@@ -118,3 +154,11 @@ uploads:
     target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
     method: PUT
+
+release:
+  # Uploads into the release created by the main .goreleaser.yaml run.
+  # make_latest stays false everywhere: the signing pipeline
+  # (netbirdio/sign-pipelines) marks the release latest after the Windows
+  # and macOS artifacts are signed.
+  make_latest: false
+  prerelease: auto
diff --git a/.goreleaser_ui_darwin.yaml b/.goreleaser_ui_darwin.yaml
index 0a0082075..8ca0e8da6 100644
--- a/.goreleaser_ui_darwin.yaml
+++ b/.goreleaser_ui_darwin.yaml
@@ -1,6 +1,15 @@
 version: 2
 
 project_name: netbird-ui
+
+before:
+  hooks:
+    # Bindings are gitignored; regenerate before the frontend build so
+    # the @wailsio/runtime Vite plugin can resolve them (vite refuses to
+    # build without them).
+    - sh -c 'cd client/ui && wails3 generate bindings -clean=true -ts'
+    - sh -c 'cd client/ui/frontend && pnpm install --frozen-lockfile && pnpm build'
+
 builds:
   - id: netbird-ui-darwin
     dir: client/ui
@@ -21,7 +30,7 @@ builds:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
     mod_timestamp: "{{ .CommitTimestamp }}"
     tags:
-      - load_wgnt_from_rsrc
+      - production
 
 universal_binaries:
   - id: netbird-ui-darwin
@@ -34,3 +43,11 @@ checksum:
   name_template: "{{ .ProjectName }}_darwin_checksums.txt"
 changelog:
   disable: true
+
+release:
+  # Uploads into the release created by the main .goreleaser.yaml run.
+  # make_latest stays false everywhere: the signing pipeline
+  # (netbirdio/sign-pipelines) marks the release latest after the Windows
+  # and macOS artifacts are signed.
+  make_latest: false
+  prerelease: auto
diff --git a/.goreleaser_ui_gtk3.yaml b/.goreleaser_ui_gtk3.yaml
new file mode 100644
index 000000000..a9b2ca650
--- /dev/null
+++ b/.goreleaser_ui_gtk3.yaml
@@ -0,0 +1,144 @@
+version: 2
+env:
+  - SKIP_PUBLISH={{ if index .Env "SKIP_PUBLISH" }}{{ .Env.SKIP_PUBLISH }}{{ else }}true{{ end }}
+project_name: netbird-ui
+
+before:
+  hooks:
+    # Bindings are gitignored; regenerate before the frontend build so
+    # the @wailsio/runtime Vite plugin can resolve them (vite refuses to
+    # build without them).
+    # -f '-tags gtk3': the generator type-checks client/ui, whose cgo imports
+    # would otherwise resolve gtk4/webkitgtk-6.0 pkg-config entries that do
+    # not exist on ubuntu-22.04.
+    - sh -c 'cd client/ui && wails3 generate bindings -clean=true -ts -f "-tags gtk3"'
+    - sh -c 'cd client/ui/frontend && pnpm install --frozen-lockfile && pnpm build'
+
+builds:
+  # Legacy GTK3 / WebKit2GTK 4.1 build for distros without WebKitGTK 6.0
+  # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). The gtk3 tag flips the
+  # Wails Linux backend to the GTK3 stack and swaps our GTK4-only XEmbed
+  # tray host for the pure-Go stub (client/ui/xembed_host_gtk3_linux.go).
+  # Must be built on the oldest supported glibc (ubuntu-22.04 runner).
+  - id: netbird-ui-gtk3
+    dir: client/ui
+    binary: netbird-ui
+    env:
+      - CGO_ENABLED=1
+    goos:
+      - linux
+    goarch:
+      - amd64
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - production
+      - gtk3
+
+archives:
+  - id: linux-gtk3-arch
+    name_template: "{{ .ProjectName }}-linux-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    builds:
+      - netbird-ui-gtk3
+
+nfpms:
+  # Mutually-exclusive alternative to the GTK4 netbird-ui package -- both
+  # ship the same /usr/bin/netbird-ui from the shared stable/yum repos, so
+  # this one carries its own name and conflicts with the GTK4 package.
+  - maintainer: Netbird <dev@netbird.io>
+    description: Netbird client UI.
+    homepage: https://netbird.io/
+    license: BSD-3-Clause
+    vendor: NetBird
+    id: netbird_ui_deb_gtk3
+    package_name: netbird-ui-gtk3
+    file_name_template: "{{ .PackageName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    builds:
+      - netbird-ui-gtk3
+    formats:
+      - deb
+    scripts:
+      postinstall: "release_files/ui-post-install.sh"
+    contents:
+      - src: client/ui/build/linux/netbird.desktop
+        dst: /usr/share/applications/org.wails.netbird.desktop
+      - src: client/ui/build/appicon.png
+        dst: /usr/share/pixmaps/netbird.png
+    conflicts:
+      - netbird-ui
+    replaces:
+      - netbird-ui
+    dependencies:
+      - netbird (>= 0.75.0)
+      - libgtk-3-0
+      - libwebkit2gtk-4.1-0
+      - xdg-utils
+
+  - maintainer: Netbird <dev@netbird.io>
+    description: Netbird client UI.
+    homepage: https://netbird.io/
+    license: BSD-3-Clause
+    vendor: NetBird
+    id: netbird_ui_rpm_gtk3
+    package_name: netbird-ui-gtk3
+    file_name_template: "{{ .PackageName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    builds:
+      - netbird-ui-gtk3
+    formats:
+      - rpm
+    scripts:
+      postinstall: "release_files/ui-post-install.sh"
+    contents:
+      - src: client/ui/build/linux/netbird.desktop
+        dst: /usr/share/applications/org.wails.netbird.desktop
+      - src: client/ui/build/appicon.png
+        dst: /usr/share/pixmaps/netbird.png
+    # No `replaces` here: nfpm maps it to rpm Obsoletes, which would make
+    # dnf swap installed GTK4 netbird-ui packages for this one on upgrade.
+    conflicts:
+      - netbird-ui
+    dependencies:
+      - netbird >= 0.75.0
+      - (gtk3 or libgtk-3-0)
+      - (webkit2gtk4.1 or libwebkit2gtk-4_1-0)
+      - xdg-utils
+
+    rpm:
+      signature:
+        key_file: '{{ if index .Env "GPG_RPM_KEY_FILE" }}{{ .Env.GPG_RPM_KEY_FILE }}{{ end }}'
+
+# The GTK4 UI job shares project_name, so the default checksum file name would
+# collide with it on the shared GitHub release.
+checksum:
+  name_template: "{{ .ProjectName }}_gtk3_checksums.txt"
+
+changelog:
+  disable: true
+
+uploads:
+  - name: debian
+    skip: "{{ .Env.SKIP_PUBLISH }}"
+    ids:
+      - netbird_ui_deb_gtk3
+    mode: archive
+    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=stable;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
+    username: dev@wiretrustee.com
+    method: PUT
+
+  - name: yum
+    skip: "{{ .Env.SKIP_PUBLISH }}"
+    ids:
+      - netbird_ui_rpm_gtk3
+    mode: archive
+    target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
+    username: dev@wiretrustee.com
+    method: PUT
+
+release:
+  # Uploads into the release created by the main .goreleaser.yaml run.
+  # make_latest stays false everywhere: the signing pipeline
+  # (netbirdio/sign-pipelines) marks the release latest after the Windows
+  # and macOS artifacts are signed.
+  make_latest: false
+  prerelease: auto
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 000000000..3838a7913
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,783 @@
+# NetBird Agent Guidelines
+
+**NetBird** is an open source connectivity platform: a WireGuard®-based overlay
+network with a control plane. The **agent** (`client/`) runs on user machines as
+a privileged daemon and manages the WireGuard interface, routing, firewall, and
+DNS. **Management** (`management/`) is the control plane and REST/gRPC API,
+**Signal** (`signal/`) brokers peer handshakes, **Relay** (`relay/`) carries
+traffic when a direct tunnel is impossible, and **Proxy** (`proxy/`) is the
+identity-aware proxy behind Agent Network.
+
+This file applies to the whole repository, and is the single source of truth for
+agent guidance here. `CLAUDE.md` is a one-line pointer to it — keep the guidance
+in this file, not duplicated there.
+
+## Contents
+
+- [STOP and ask the user before](#stop-and-ask-the-user-before)
+- [Quick reference](#quick-reference)
+- [Structure](#structure)
+- [Where to look](#where-to-look)
+- [Security](#security)
+- [Agent conventions](#agent-conventions)
+- [Repo-wide principles](#repo-wide-principles)
+- [Type safety](#type-safety)
+- [Concurrency and lifecycle](#concurrency-and-lifecycle)
+- [Error handling](#error-handling)
+- [Comments](#comments)
+- [Testing](#testing)
+- [Pitfalls](#pitfalls)
+- [Commits, PRs, releases](#commits-prs-releases)
+- [After you push: CI and review bots](#after-you-push-ci-and-review-bots)
+- [Discussion and support](#discussion-and-support)
+
+## STOP and ask the user before
+
+- **Opening a pull request for anything beyond a trivial fix, without an agreed
+  ticket.** Ask the user directly: *"Is there a discussion or issue for this
+  change?"* NetBird is discussion-first — community reports start in
+  [Discussions](https://github.com/netbirdio/netbird/discussions), DevRel
+  validates them, and only validated discussions become issues. A PR that
+  changes behavior with no linked issue may be closed on arrival. If there is no
+  ticket, offer to draft the discussion post **instead of** the PR, and wait for
+  the user's call. Only typos, broken links, documentation corrections, and
+  one-line fixes that already have an issue can skip this.
+- **Designing in any high-risk area** (see
+  [CONTRIBUTING.md](CONTRIBUTING.md#high-risk-areas)): public API and OpenAPI
+  schema, gRPC protos, behavior existing deployments would notice after an
+  upgrade, peer connectivity (ICE, NAT traversal, relay selection, WireGuard® or
+  Rosenpass key handling), client system integration (routing, firewall, DNS,
+  interface), authentication and authorization, CLI or service flags, config
+  file format, daemon IPC, store schema and migrations, or a new feature. The
+  design gets agreed in the ticket before code is written.
+- **Writing a store migration or changing a persisted model.** Migrations are
+  one-way in the field and both the GORM and pgx paths may need the change.
+- **Hand-editing generated code.** `*.pb.go`, `*.gen.go`, and mocks are outputs.
+  Edit the source (`.proto`, `openapi.yml`) and rerun the matching
+  `generate.sh`.
+- **Adding, removing, or bumping a dependency**, and never vendor a fork.
+- **Weakening a security control** — authentication, authorization, certificate
+  verification, privilege dropping, or peer identity checks — even when it is
+  the fastest way to make a test pass.
+- **Force-pushing to `main`**, force-pushing any branch that is already under
+  review, amending pushed commits, or bypassing hooks with `--no-verify`.
+
+## Quick reference
+
+```bash
+# Build
+go build ./...
+cd client && CGO_ENABLED=0 go build .        # agent
+cd management && go build .                  # management service
+cd signal && go build .                      # signal service
+
+# Verify (run before every push)
+go fmt ./...
+make lint            # golangci-lint on files changed vs origin/main (also the pre-push hook)
+make lint-all        # full-repository lint, matches CI
+make test-unit       # host-safe unit tests, -tags devcert, no sudo
+make test-privileged # privileged-tagged suite in a Docker container with NET_ADMIN
+make setup-hooks     # wire .githooks: pre-push runs make lint, commit-msg refuses attribution trailers
+
+# Narrow runs
+go test ./client/internal/dns/...
+go test -race -run TestPeerConn ./client/internal/peer/...
+PRIV_RUN=TestNftablesManager PRIV_PKGS=./client/firewall/nftables/... make test-privileged
+
+# Code generation (never hand-edit the output)
+./shared/management/http/api/generate.sh   # REST types from openapi.yml
+./shared/management/proto/generate.sh
+./shared/signal/proto/generate.sh
+./client/proto/generate.sh
+./flow/proto/generate.sh
+
+# Run locally (lab only, never on a machine you rely on)
+sudo ./client/netbird up --log-level debug --log-file console
+sudo ./client/netbird down                   # teardown: restores routing, firewall, DNS
+./signal/signal run --log-level debug --log-file console
+./management/management management --log-level debug --log-file console --config ./management.json
+```
+
+`netbird up` needs root and rewrites the host's routing table, firewall rules,
+DNS configuration, and WireGuard® interface. Run it only in a disposable test
+environment (a VM, container, or throwaway host) that you can rebuild, never on
+a workstation or server whose connectivity matters. Run `sudo netbird down`
+before you stop working, before rebuilding the binary, and on every failure
+path, so the host's networking state is restored instead of left half-applied.
+See [Pitfalls](#pitfalls) for why cleanup on every exit path matters.
+
+## Structure
+
+```text
+netbird/
+├── client/              NetBird agent
+│   ├── cmd/             agent CLI
+│   ├── internal/        agent business logic (engine, peer, dns, routemanager, ...)
+│   ├── server/          daemon for background execution
+│   ├── proto/           daemon gRPC protos
+│   ├── iface/           WireGuard® interface management
+│   ├── firewall/        nftables, iptables, pf, WFP, userspace backends
+│   ├── ssh/             built-in SSH server and client
+│   ├── ui/              desktop UI (Wails v3 + React)
+│   ├── android/, ios/   mobile bindings
+│   ├── wasm/            WebAssembly build
+│   └── mdm/, system/    MDM policy, host information
+├── management/          control plane
+│   └── server/          account, peer, groups, networks, posture, permissions,
+│                        settings, store, http (REST), idp, integrations, migration
+├── signal/              handshake broker (peer/, server/)
+├── relay/               relay service (protocol/, server/, healthcheck/)
+├── proxy/               identity-aware proxy (llm/, acme/, accesslog/, middleware/, tcp/, udp/)
+├── agent-network/       Agent Network overview
+├── shared/              imported by both agent and services
+│   ├── management/      proto/, client/, http/api (OpenAPI + generated types)
+│   ├── signal/          proto/, client/
+│   └── relay/, auth/, sshauth/, metrics/
+├── e2e/                 end-to-end suites and harness
+├── encryption/, dns/, route/, stun/, sharedsock/, util/, flow/
+├── infrastructure_files/  docker compose and getting-started templates
+└── release_files/       files packaged into releases
+```
+
+## Where to look
+
+| Task                        | Location                                                     |
+| --------------------------- | ------------------------------------------------------------ |
+| REST API / OpenAPI          | `shared/management/http/api/` + `management/server/http/`    |
+| Management gRPC protocol    | `shared/management/proto/`                                   |
+| Signal protocol             | `shared/signal/proto/`                                       |
+| Daemon IPC protocol         | `client/proto/`                                              |
+| Peer connection and NAT     | `client/internal/peer/`                                      |
+| Network map handling        | `client/internal/engine.go`, `shared/management/networkmap/` |
+| Routing                     | `client/internal/routemanager/`, `route/`                    |
+| Firewall backends           | `client/firewall/`                                           |
+| DNS                         | `client/internal/dns/`, `dns/`                               |
+| WireGuard® interface        | `client/iface/`                                              |
+| Persistence and migrations  | `management/server/store/`, `management/server/migration/`   |
+| IdP integrations            | `management/server/idp/`                                     |
+| Permissions model           | `management/server/permissions/`                             |
+| LLM routing / Agent Network | `proxy/internal/llm/`, `agent-network/`                      |
+| End-to-end tests            | `e2e/`                                                       |
+
+## Security
+
+### Never fail open
+
+When a security check — access control, an IP restriction, an auth decision —
+hits an error such as an unparseable value, an unavailable lookup, or a state it
+does not recognize, it must **deny**. Never skip the check or allow the request
+through because the check itself failed, and make the `default` and unknown cases
+of a security-related `switch` deny rather than fall through.
+
+### Daemon RPC input is untrusted
+
+The agent runs as root (LocalSystem on Windows), so a daemon RPC crosses a
+privilege boundary: treat every field as untrusted input rather than as something
+the UI or CLI validated on the way in.
+
+When you add or change an RPC, ask what the handler does with caller input while
+running as root. If the answer touches a filesystem path, a URL or host, or a
+privileged state change, it needs a gate **in the handler** — a check in the client
+that normally calls it is not a check at all.
+
+- **A caller-supplied path the daemon opens.** Never `os.Open` it as root.
+  Constrain it, then open it *as the caller* with `ipcauth.OpenOwnedFile`, which
+  opens `O_NOFOLLOW`, requires a regular file, and refuses a file the caller does
+  not own — so a symlink or hardlink aimed at a root-only file is rejected.
+- **A caller-supplied URL or host the daemon fetches.** Restrict the scheme and
+  allow only known hosts for unprivileged callers. Prefer a lexical host
+  allowlist plus TLS verification over "resolve the host, then reject private
+  IPs": the resolve-then-trust pattern has a DNS-rebinding race (public IP at
+  check time, attacker IP at connect time), while a name allowlist has no IP
+  check to race. Never accept `http://` where `https://` is expected.
+- **A privileged state change** (SSH root login, management URL, deregistration)
+  gates on the caller identity from `ipcauth.CallerIdentity(ctx)`.
+
+Caller identity comes from the kernel — `SO_PEERCRED`, `LOCAL_PEERCRED`, or the
+named-pipe client token — and never from an RPC field. When
+`ipcauth.CallerIdentity` reports that it could not determine an identity, **deny**;
+do not fall back to treating the caller as the transport peer.
+
+## Agent conventions
+
+### Three networking modes
+
+Where packets actually flow depends on the mode the agent is running in. The
+three are not interchangeable, so establish which one a change applies to — and
+what it should do in the other two — before you write it.
+
+- **kernel mode** (Linux only): in-kernel WireGuard®. The kernel handles both
+  peer-to-peer and routed traffic, and ACLs are iptables or nftables rules. The
+  client programs kernel facilities but never sees the traffic itself.
+- **userspace mode** (wireguard-go with a TUN): wireguard-go runs in-process. The
+  kernel handles peer-to-peer traffic once it leaves the TUN, while routed traffic
+  — exit nodes and network routes — goes through the userspace forwarder, which
+  terminates the connection and re-establishes it over OS sockets. Used on
+  platforms without kernel WireGuard® or when the user opts out.
+- **netstack mode**: wireguard-go in-process with no TUN and no kernel
+  networking. The forwarder does all routing by stitching userspace sockets, and
+  listeners such as the embedded SSH and DNS servers bind on a gVisor netstack.
+  Used where the process cannot create a TUN device, such as the embedded client
+  (`client/embed/`) and the WASM build.
+
+### The overlay interface is not "WireGuard"
+
+Do not put "WireGuard" in identifiers or comments unless the code is genuinely
+coupled to WireGuard® specifically — a wireguard-go call, a handshake field, a
+kernel WireGuard® netlink attribute. For the interface, the host, peers, or
+traffic in general, say "the NetBird interface", "the interface", or "the overlay".
+Most firewall, routing, and DNS code is transport-agnostic, so a WireGuard®
+reference there is simply inaccurate and rots as the transports change.
+
+### IPv6 is a soft feature
+
+The IPv6 overlay is opt-in dual-stack, and capability can change at runtime. Treat
+it as soft rather than a requirement:
+
+- Gate local v6 paths on the interface accessor (`wgIface.Address().HasIPv6()`),
+  not on raw state fields, and skip the v6 path when the host has no v6 rather
+  than returning an error.
+- Treat an empty or unparseable peer v6 address as "no v6 for that peer" and skip
+  it, keeping the v4 path working.
+- Never let a missing v6 break v4. Fail-closed is for security checks; a
+  capability mismatch skips the v6 work and carries on.
+
+### Environment variables
+
+Name the variable in a constant and parse booleans with `strconv.ParseBool` rather
+than comparing strings inline, so an unexpected value is logged instead of
+silently meaning false:
+
+```go
+const EnvDisableFeature = "NB_DISABLE_FEATURE"
+
+func isDisabledByEnv() bool {
+    val := os.Getenv(EnvDisableFeature)
+    if val == "" {
+        return false
+    }
+    disabled, err := strconv.ParseBool(val)
+    if err != nil {
+        log.Warnf("failed to parse %s: %v", EnvDisableFeature, err)
+        return false
+    }
+    return disabled
+}
+```
+
+### Validating against protocol specs
+
+When a change depends on what a protocol actually mandates, read the specification
+text from the [IETF datatracker](https://datatracker.ietf.org/) rather than a
+summary, and check that you have the current RFC — the widely cited one for a
+protocol is often superseded. Cite the section, not just the document, so a
+reviewer can jump straight to the rule.
+
+## Repo-wide principles
+
+1. **Run `go fmt` on every modified Go file.** Formatting is not optional.
+2. **Zero unaddressed linter warnings.** Fix what `golangci-lint` reports on code
+   you touch, and delete imports, helpers, and parameters your refactor orphaned.
+   Exception: unused parameters in shared code may be consumed by builds outside
+   this repository — do not remove them, ask instead.
+3. **Function comments are mandatory for exported functions**, written as full
+   sentences with a period, starting with the identifier name.
+4. **Prefer private functions and constants.** Export only what a caller outside
+   the package genuinely needs.
+5. **Early returns and guard clauses.** Handle errors and edge cases first
+   instead of nesting `if`/`else` chains.
+6. **Split complex functions.** If a function trips a complexity warning, break
+   it into named helpers rather than silencing the warning.
+7. **Avoid LLM-slop tells:** em dashes, hedging narration, restating the diff in
+   prose, trailing summaries. Defaults, not absolute bans. Applies to code,
+   comments, commit messages, and PR descriptions alike.
+8. **Concurrency: do a two-pass race analysis after every change** that touches
+   shared state, including reads of existing maps and slices. Guard them with a
+   mutex (or an atomic or channel where that fits better), keep critical
+   sections short, and run `go test -race` on the touched packages. See
+   [Concurrency and lifecycle](#concurrency-and-lifecycle) for the failure modes
+   to check for.
+9. **Cross-platform builds must keep working.** The agent targets Linux, macOS,
+   Windows, FreeBSD, Android, and iOS. When you add a platform-specific file,
+   add the counterpart or a build-tagged fallback for the others.
+10. **Never hand-edit generated files.** Change the source and regenerate.
+11. **Never log secrets** — private keys, setup keys, tokens, PAT values — and
+    keep peer IPs and hostnames out of logs above debug level.
+
+## Type safety
+
+**No bare primitives for domain concepts.** A `string` parameter for an account
+ID next to a `string` parameter for a peer ID is two bugs waiting to happen,
+because the compiler cannot catch the swap. Declare the type once and use it
+throughout, converting only at the boundaries where data enters or leaves —
+protobuf, gRPC, HTTP, an external library.
+
+```go
+type ServiceID string
+type AccountID string
+
+// Internal: typed all the way through
+func (r *Router) RemoveRoute(host SNIHost, svcID ServiceID) { ... }
+
+// Proto boundary: convert once, on the way in and on the way out
+svcID := ServiceID(mapping.GetId())
+req.ServiceId = string(svcID)
+```
+
+- **IP addresses are `netip.Addr`**, not `string` and not `net.IP`. Parse at the
+  boundary and pass the typed value inward.
+- **Always `Unmap()`** after parsing an address, after converting from `net.IP`,
+  and after extracting one from `RemoteAddr()`. This normalizes a v4-mapped v6
+  address (`::ffff:10.1.2.3`) to plain v4 so IPv4 rules match it. A stored or
+  compared mapped address silently fails to match those rules.
+- **Ports are `uint16`** internally; use `int` only where a library forces it and
+  convert immediately.
+- **Enums are a typed string with constants**, so the valid set is discoverable
+  and a typo fails to compile.
+- **Map keys follow the same rule**, and must be a real type (`type ServiceID
+  string`) rather than an alias (`type serviceID = string`) — an alias silently
+  accepts bare strings.
+
+## Concurrency and lifecycle
+
+Beyond the mutex hygiene in the principles above, check for these failure
+modes.
+
+- **Never read a struct field inside a goroutine** when another goroutine may nil
+  or reassign it. Pass the value as a parameter, or capture it into a local before
+  launching. This matters most when `Stop()` nils a field without waiting for the
+  goroutine to finish.
+
+  ```go
+  go func(ifaceName string) {   // good: passed in, cannot be nilled underneath
+      m.Start(ctx, ifaceName)
+  }(iface.Name())
+  ```
+
+- **Never wait on a channel while holding a lock the sender needs.** Copy what you
+  need out from under the lock, release it, then wait.
+
+  ```go
+  func (m *Manager) Stop() {
+      m.mu.Lock()
+      cancel, done := m.cancel, m.done
+      m.mu.Unlock()
+      if cancel != nil {
+          cancel()
+          <-done
+      }
+  }
+  ```
+
+- **`Stop`/`Close` must be idempotent** — guard on an already-stopped flag or a
+  nil cancel — and must release the state they guarded. Clear maps and caches;
+  a cancelled goroutine holding a live map still pins that memory. Note that a
+  nil map only panics on writes; reads and iteration behave like an empty map,
+  so where post-close use must be rejected, check the stopped flag explicitly.
+- **Publish coupled state only after every fallible step succeeds.** When several
+  fields form an invariant, build them into locals and assign them to the receiver
+  at the end. Assigning as you go leaves the object half-initialized when a later
+  step fails, so a readiness predicate reports ready while a coupled field is nil.
+  If an earlier step already had an external side effect — a created chain, an
+  opened handle, an inserted rule — roll it back before returning the error.
+- **Clean up what you own on constructor error paths.** Once a constructor has
+  started something, every later error path must undo it: cancel a goroutine and
+  wait for it to exit, stop a ticker, close a watcher. The object is never
+  returned, so its `Close` will never run.
+- **A failed `Start` must undo everything it started.** When a component brings up
+  several subsystems in sequence — connection manager, watchers, routing, DNS,
+  flow, persisted state — a failure partway through has to tear down the ones
+  already running, not just close the handle the error came from. Put the
+  already-started guard *before* that teardown path, so a rejected second `Start`
+  cannot dismantle the one that is running.
+
+## Error handling
+
+Use single-assignment form when the error is only needed inside the `if`:
+
+```go
+// Good
+if err := someCall(); err != nil {
+    return fmt.Errorf("context: %w", err)
+}
+
+// Bad - unnecessary split
+err := someCall()
+if err != nil {
+    return fmt.Errorf("context: %w", err)
+}
+```
+
+Use multiple assignment when the value is needed after the block:
+
+```go
+result, err := someCall()
+if err != nil {
+    return fmt.Errorf("context: %w", err)
+}
+```
+
+Add short, meaningful context, and **do not** start `fmt.Errorf` messages with
+obvious words like "failed to" or "error":
+
+```go
+// Good
+return fmt.Errorf("parse remote address: %w", err)
+return fmt.Errorf("listen on %s: %w", addr, err)
+
+// Bad
+return fmt.Errorf("failed to parse remote address: %w", err)
+return fmt.Errorf("error listening on %s: %w", addr, err)
+
+// "failed" is fine in log messages
+log.Debugf("failed to parse remote address: %v", err)
+```
+
+Skip the wrapping when a function only extracts or delegates and the wrap would
+add nothing:
+
+```go
+func parseAddr(addr string) (string, int, error) {
+    host, portStr, err := net.SplitHostPort(addr)
+    if err != nil {
+        return "", 0, err
+    }
+    // ...
+}
+```
+
+Log the errors you choose not to act on:
+
+- `log.Debugf()` for errors that do not affect program flow but help debugging.
+- `log.Tracef()` for very verbose errors that would otherwise spam logs.
+- **Never ignore** errors from writes, network sends, or critical cleanup.
+- Close errors may be ignored for read-only operations; log them at debug for
+  writes.
+
+**Do not log and return the same error.** It gets reported twice, from two places,
+and the second reader cannot tell whether it happened once or twice. Return it and
+let the caller decide. The exception is an API handler that has already written a
+response. Internal helpers return errors rather than logging and swallowing them.
+
+**Never return a typed nil as an error.** A nil `*MyError` stored in an `error`
+interface is not nil, so `err != nil` is true and callers take the failure path on
+success. Return the error only where it is actually set:
+
+```go
+if _, err := conn.Write(buf); err != nil {   // good
+    return err
+}
+return nil
+```
+
+**Accumulate with `multierror` when an operation should continue past individual
+failures** — teardown, cleanup, or setup where partial success is acceptable.
+`client/errors.FormatErrorOrNil` returns nil for an empty accumulator, so callers
+still see a plain nil on full success:
+
+```go
+func (m *Manager) Cleanup() error {
+    var merr *multierror.Error
+    for _, r := range m.resources {
+        if err := r.Close(); err != nil {
+            merr = multierror.Append(merr, fmt.Errorf("close %s: %w", r.Name, err))
+        }
+    }
+    return nberrors.FormatErrorOrNil(merr)
+}
+```
+
+| Scenario              | Approach              | Why                                       |
+| --------------------- | --------------------- | ----------------------------------------- |
+| Cleanup / teardown    | Accumulate            | Clean up as much as possible              |
+| Setup with rollback   | Abort on first error  | Partial state is invalid; undo what stuck |
+| Setup with partial OK | Accumulate            | Degraded operation is still useful        |
+
+## Comments
+
+Comment the **why**, never the **what**. Default to no comment, and add one only
+when a hidden constraint or workaround would surprise a future reader. Never
+reference the current task, PR, or your own changes in a comment.
+
+```go
+// Bad - trailing comments explaining the obvious
+defer localConn.Close() // Close the connection
+if err != nil {         // Check if error occurred
+
+// Good
+defer localConn.Close()
+
+// Good - explains a non-obvious constraint
+// Use incremental checksum update per RFC 1624 for performance.
+checksum = updateChecksum(checksum, oldPort, newPort)
+```
+
+### Length budget
+
+Neither of these is linter-enforced, so they are conventions the surrounding code
+mostly follows rather than hard limits:
+
+- **Around 90 characters per line.** Wrap the comment rather than running well past
+  it.
+- **Roughly 250 characters per comment**, about three wrapped lines. Doc comments
+  on exported identifiers may exceed it when the API genuinely needs the
+  explanation; inline comments inside a function body rarely should.
+
+The budget is a smell detector, not a rule to game. Do not compress a needed
+explanation into cryptic shorthand to fit — if a block of code needs more than
+250 characters of prose, the code is doing too much. Fix the code:
+
+- **Extract a named function.** A well-named function replaces the comment: the
+  name says *what*, the body shows *how*, and the comment you no longer write
+  was the *what* anyway. Clean Code calls this "explain yourself in code".
+- **Extract a named constant or predicate.** `if isExpiredSetupKey(key)` needs
+  no comment; `if key.ExpiresAt.Before(now) && !key.Revoked && key.UsageLimit > 0`
+  does.
+- **Keep the surviving comment for the why** — the RFC, the kernel quirk, the
+  ordering constraint. That part is usually one or two lines.
+
+### Long switch and if/else chains
+
+A `switch` whose cases carry multi-line explanations is the usual place this
+budget is breached, and the comment is a symptom. In order of preference:
+
+1. **Extract each case body into a named function.** The case becomes one line,
+   the name carries the meaning, and the switch reads as a table of contents.
+2. **Replace the switch with a lookup table** — `map[Kind]handlerFunc` — when the
+   branches are uniform. Adding a case stops meaning editing a growing function.
+3. **Replace conditional with polymorphism** when branches vary by type and the
+   same switch shape starts appearing in more than one place. Clean Code's rule
+   of thumb: tolerate a switch statement if it appears **once**, is buried in a
+   factory that returns an interface, and no other switch dispatches on the same
+   type. A second switch over the same enum is the signal to introduce the
+   interface.
+
+Do not restructure a switch purely to satisfy the budget when the cases are one
+line each and self-evident — a flat, boring `switch` over an enum is fine and
+needs no comments at all.
+
+Explanatory comments in tests are welcome — they document the scenario being set
+up, and the 250-character budget does not apply to them.
+
+## Testing
+
+- **Unit tests** live beside the code as `_test.go`. `make test-unit` runs the
+  host-safe set with `-tags devcert` and no sudo.
+- **Privileged tests** carry the `privileged` build tag and mutate host
+  networking. They run through `make test-privileged`, inside a Docker container
+  with `NET_ADMIN`. Never bypass that harness by running them directly on the
+  host.
+- **End-to-end suites** live in `e2e/` with a shared harness.
+- **Test real behavior, not API existence.** Assert on the observable end state
+  a consumer would see — bytes that arrived, the packet after translation, the
+  row after the write — not merely that a method exists or returns an error.
+- **Avoid mocks for code we own.** Exercise the real store, manager, or
+  controller and assert what the caller actually receives.
+- **`require` for setup and preconditions, `assert` for the conditions under
+  test.** Use `require` whenever a later line would panic or be meaningless
+  otherwise.
+- **Message guidance:** optional for `NoError`/`Error`; always give context for
+  comparison, boolean, and collection assertions.
+- **Reproduce a bug before fixing it.** Write the test, watch it fail *for the
+  reason you expect* — a test that fails for an unrelated reason proves nothing —
+  then apply the fix and confirm it passes. Add the thin surrounding cases while
+  you are there.
+- **Use `t.Setenv`** rather than `os.Setenv` so the previous value is restored on
+  cleanup. To test the unset case, call `t.Setenv` first to register the restore,
+  then `os.Unsetenv`.
+- **Prefer `t.Cleanup` over `defer`** in any test with parallel subtests: the
+  parent function returns, running its `defer`s, while parallel subtests are
+  still suspended. Sequential subtests finish inside `t.Run`, so `defer` is safe
+  there, but `t.Cleanup` works in both cases.
+- **Explanatory comments in tests are welcome.** Describe the scenario being set
+  up; the comment budget below does not apply to them.
+
+```go
+server, err := StartTestServer()
+require.NoError(t, err, "Test server setup must succeed")
+defer server.Close()
+
+result, err := client.DoOperation()
+assert.NoError(t, err)
+assert.Equal(t, expectedResult, result, "Result should match expected")
+```
+
+## Pitfalls
+
+- **The agent runs as root.** Anything touching routing, firewall, DNS, or the
+  interface can take a user's machine off the network. Prefer a reversible
+  change and make sure cleanup runs on every exit path.
+- **Management has two account loaders** (GORM and pgx). Adding a relation to an
+  account often means updating both, or it silently comes back empty in
+  production.
+- **`go test ./...` without `-tags devcert` skips tests** that need the
+  development certificate. Use `make test-unit`.
+- **`make lint` only checks the diff against `origin/main`.** CI runs
+  `make lint-all`; run it too before pushing a large change.
+- **Protos are consumed by released clients.** An old agent must keep working
+  against a new Management, so fields are added, never renumbered or removed.
+- **Windows requires the wintun driver**, and the daemon serves a named pipe
+  (`npipe://netbird`) rather than loopback TCP. Loopback TCP carries no caller
+  identity, so privileged operations are refused over it.
+
+## Commits, PRs, releases
+
+- **PR titles must start with a bracketed tag.** Before you propose a title,
+  **read [`.github/workflows/pr-title-check.yml`](.github/workflows/pr-title-check.yml)
+  and take the allowed tags from the `allowedTags` array in that file.** It is
+  the only source of truth, it changes as components are added, and the check
+  runs on every title edit — a tag that is not in that array is a red build. Do
+  not rely on a list memorized from anywhere else, including this file.
+
+  ```text
+  [client] Authorize daemon IPC callers by their local identity
+  [management,client] Add MDM policy support
+  ```
+
+  Multiple tags are comma-separated inside one pair of brackets. Match the tag
+  to the component you actually changed, not to the one you read the most.
+
+- **Use the repository's PR template.** Fill in
+  [`.github/pull_request_template.md`](.github/pull_request_template.md) rather
+  than replacing it with your own summary: describe the change, link the issue,
+  tick the checklist honestly (including "ran locally" and "single purpose"),
+  and complete the documentation section. Do not tick a box you have not
+  verified, and do not delete rows that do not apply — the docs gate in CI reads
+  that section and fails when it is missing.
+
+- **Keep the PR description short.** Under 1000 words on top of the template's
+  own text, and usually far less — a few paragraphs. Reviewers read the diff;
+  the description exists to explain what the diff cannot say for itself. This is
+  well below what an agent will produce by default, so cut before you post.
+
+- **Body: why before what.** Lead with the problem and the reason for this
+  approach, then the shape of the change. No bullet list of files changed, no
+  per-function walkthrough, no restating the diff in prose, no trailing summary
+  section, no self-congratulatory closing line.
+
+- **No `Co-Authored-By` or tool-attribution trailers in the PR description**,
+  and none in commits either. Contributors own their contributions. Whatever
+  tooling produced the diff, the person opening the PR is its author: they have
+  read every line, they can explain why it works, they can answer review
+  questions without going back to a model, and they are accountable for the
+  consequences of merging it. Do not add a trailer, footer, or description line
+  that spreads that ownership onto a tool.
+
+- **Commit subjects follow the same `[scope] Subject` convention.** Keep the
+  subject short, and use the body for why before what. No bullet lists of files
+  changed.
+
+- **Push review fixes as separate commits.** The PR is squashed on merge, so
+  there is no reason to rewrite history mid-review; many small commits make the
+  re-review readable.
+
+- **Do not force-push a branch that is under review.** A force-push detaches
+  existing review comments from the lines they were written against, destroys
+  the "changes since your last review" diff a reviewer relies on, and discards
+  the CI history that showed which commit broke what. Add commits instead —
+  including for fixups and reverts. Force-push only when there is no
+  alternative: a rebase to clear a genuine conflict, or removing a secret or a
+  large binary that was committed by mistake. When you must, ask the user first,
+  then say so in a PR comment so reviewers know their anchors moved. Never
+  force-push `main`, and never force-push a branch you do not own.
+
+- **One PR, one purpose.** Split refactors out of fixes and fixes out of
+  features.
+
+- **Keep the PR small.** Size is the single strongest predictor of how long a PR
+  waits. Aim for **under ~400 changed lines across under ~20 files**; past
+  roughly **1000 lines or 50 files** a community PR is likely to be sent back to
+  be split, or left unreviewed until it is. Large PRs from outside the core team
+  may be blocked outright when the size was never agreed in the ticket —
+  reviewing a sprawling change against a privileged networking daemon is a
+  security risk in itself, not just a time cost.
+
+  Judge the size by hand-written code: exclude generated output, `go.sum`,
+  vendored files, and test fixtures from the estimate, but do not use their
+  presence to argue a 3000-line PR is small.
+
+  When a change genuinely cannot be small — a protocol migration, a
+  cross-component rename — agree the split in the ticket **before** writing
+  code, and land it as a sequence of PRs that each build, test, and make sense
+  on their own. Propose that split to the user rather than opening one large PR
+  and hoping.
+
+  Prefer GitHub's stacked pull requests for such a sequence, rather than
+  hand-managing base branches: open each PR against the branch below it instead of
+  `main`, so every PR's diff shows only its own change. Merging a layer retargets
+  the PRs above it, and branch protections and required checks on the base branch
+  still apply to each one.
+
+- **User-facing changes need a docs PR** in
+  [netbirdio/docs](https://github.com/netbirdio/docs), linked from the PR
+  description.
+
+## After you push: CI and review bots
+
+Opening the PR is not the end of the task. Watch the run, read what the bots
+say, and drive the PR to green before you report the work as done.
+
+```bash
+gh pr checks <pr>            --watch    # all checks, live
+gh run view <run-id> --log-failed       # only the failing steps
+gh pr view <pr> --comments              # bot and human review comments
+```
+
+**Never report a change as finished while checks are pending or red**, and never
+describe a red PR as passing. If you ran out of turn before CI finished, say
+which checks were still running.
+
+### The checks
+
+- **Go tests** — `golang-test-{linux,darwin,windows,freebsd}.yml`, sharded per
+  component. A failure in a component you did not touch is usually a real
+  interaction, not noise; read the log before assuming flake.
+- **golangci-lint** — `golangci-lint.yml` runs the full repository, while
+  `make lint` only checks your diff. A clean local lint does not guarantee green
+  CI on a large change.
+- **PR Title Check** — `pr-title-check.yml`, see above.
+- **Codecov** — uploaded from the Linux test workflow with per-component flags
+  (`unit,client`, `unit,management`, `unit,relay`, `unit,proxy`, `unit,signal`,
+  `integration,management`). Coverage on new code should not go backwards. Add
+  tests for the paths you introduced; do not adjust thresholds or exclude files
+  to clear the report.
+- **CodeRabbit** — configured in [`.coderabbit.yaml`](.coderabbit.yaml): `chill`
+  profile, auto-review on every non-draft PR, TypeScript/JavaScript/SVG paths
+  filtered out. Chat auto-reply is on, so `@coderabbitai` in a comment reaches
+  it.
+- **SonarCloud** — project `netbirdio_netbird`, quality gate on new code (bugs,
+  vulnerabilities, code smells, duplication, coverage).
+- **Snyk** — dependency and code scanning.
+
+Sonar and Snyk report as GitHub App checks rather than workflows in this
+repository, so their detail lives on the PR check, not in the Actions logs.
+
+### Handling bot findings
+
+- **Read every comment and act on it.** Either fix it, or reply with the reason
+  it does not apply. Do not bulk-resolve threads to clear the count, and do not
+  silently ignore a finding because the check is advisory.
+- **Bots are frequently wrong here.** NetBird has privileged, platform-specific,
+  and concurrency-heavy code that static analysis reads poorly. A confident
+  CodeRabbit or Sonar comment can still be nonsense. Verify the claim against
+  the code before you change anything — never edit correct code just to silence
+  a bot.
+- **Security findings get the opposite default.** For a Snyk or Sonar
+  vulnerability, or a CodeRabbit comment about authentication, authorization,
+  certificate verification, or key handling, assume it is real until you have
+  disproved it. Surface it to the user rather than dismissing it yourself.
+- **A new vulnerable dependency is a stop.** Bumping or replacing dependencies
+  needs the user's decision, as above.
+- **Never change a workflow, threshold, lint exclusion, or bot config to make a
+  check pass.** If a check is genuinely wrong, say so and let the user decide.
+- **Do not paper over flakes with blind re-runs.** Identify the failure first. If
+  it is a known flake, name it; if you cannot tell, report it as unresolved
+  rather than re-running until it goes green.
+
+## Discussion and support
+
+- Discussions: <https://github.com/netbirdio/netbird/discussions>
+- Slack: <https://docs.netbird.io/slack-url>
+- Docs: <https://docs.netbird.io>
+- Security: <https://github.com/netbirdio/netbird/security/policy> — never in public
+- Contribution process: [CONTRIBUTING.md](CONTRIBUTING.md)
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 000000000..72681748e
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,4 @@
+The agent guidelines live in [AGENTS.md](AGENTS.md). It is imported here so
+every session loads it in full rather than following a pointer.
+
+@AGENTS.md
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cd1c087bb..aef749cfa 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,6 +1,6 @@
 # Contributing to NetBird
 
-Thanks for your interest in contributing to NetBird. 
+Thanks for your interest in contributing to NetBird.
 
 There are many ways that you can contribute:
 - Reporting issues
@@ -10,12 +10,99 @@ There are many ways that you can contribute:
 
 If you haven't already, join our slack workspace [here](https://docs.netbird.io/slack-url), we would love to discuss topics that need community contribution and enhancements to existing features.
 
+## Ticket first, PR second
+
+**Open a ticket and wait for feedback before you open a pull request.** Every PR
+that changes behavior must link to an issue the NetBird team has agreed on. A PR
+that arrives without one may be closed and redirected to a discussion, no matter
+how good the code is.
+
+Issues in this repository are maintainer-curated work items, so the flow starts
+in [Discussions](https://github.com/netbirdio/netbird/discussions):
+
+1. **Open a discussion.** Use
+   [Issue Triage](https://github.com/netbirdio/netbird/discussions/new?category=issue-triage)
+   for a bug, regression, or unexpected behavior, and
+   [Ideas & Feature Requests](https://github.com/netbirdio/netbird/discussions/new?category=ideas-feature-requests)
+   for a feature, enhancement, or integration idea. Setup and usage questions
+   belong in
+   [Q&A / Support](https://github.com/netbirdio/netbird/discussions/new?category=q-a-support).
+   Never report a security vulnerability in public — follow the
+   [security policy](https://github.com/netbirdio/netbird/security/policy)
+   instead.
+2. **Wait for feedback.** DevRel validates and reproduces the report, and a
+   maintainer confirms the direction. We may ask for more detail or propose a
+   different approach. Validated discussions become issues.
+3. **Then write the code**, following the approach agreed in the issue, and open
+   the PR linking that issue.
+
+Trivial fixes — a typo, a broken link, a documentation correction, or a one-line
+fix that already has an issue — can go straight to a PR. Everything else starts
+with a ticket. When in doubt, ask in the discussion or on
+[Slack](https://docs.netbird.io/slack-url); an hour of conversation up front
+regularly saves a week of rework.
+
+### High-risk areas
+
+These always need the design discussed and agreed in the issue **before** you
+write code:
+
+- **Public API** — REST / management API, OpenAPI schema, dashboard-facing contracts
+- **gRPC protocols** — management, signal, relay, and client daemon protos
+- **Functionality behavior** — anything existing deployments would experience differently after an upgrade
+- **Peer connectivity** — ICE and NAT traversal, relay selection, WireGuard® and Rosenpass key handling
+- **Client system integration** — routing, firewall, DNS, and interface management
+- **Authentication and authorization** — IdP integration, tokens, permissions, cryptography
+- **CLI / service flags**, configuration file format, and daemon IPC
+- **Store and database schema** — models and migrations
+- **New features**
+
+These surfaces are NetBird's contract with operators, self-hosters, and
+downstream integrators, and changes to them have compatibility, security, and
+release-planning implications. Agreeing on the direction early lets the PR
+review focus on implementation rather than design.
+
+Typical bug fixes, internal refactors, documentation updates, and tests do not
+need a design discussion, but should still be tied to an issue so the work is
+visible and nobody duplicates it.
+
+### Using AI coding agents
+
+We have no policy for or against using an AI agent to write NetBird code. That
+choice is yours, and we are not going to interrogate anyone about their tools.
+
+What we do have is a lot of incoming contributions that were plainly drafted with
+one, and enough experience reviewing them to see the same avoidable problems
+again and again: no ticket behind the change, a diff far too large to review, a
+description longer than the code it describes, an approach that was never going
+to be accepted, and an author who cannot answer questions about their own PR.
+None of that is caused by the tooling — it is what happens when a tool is pointed
+at a repository whose expectations it has never been told.
+
+So rather than a rule, there is a guide. [AGENTS.md](AGENTS.md) restates the
+expectations from this document in the form agents read automatically
+(`CLAUDE.md` points to it), so pointing your tool at the repository is usually
+enough. Among other things it tells the agent to ask you for the
+discussion or issue before drafting a PR, to keep the change small and
+single-purpose, to run the tests locally, to use this repository's PR template
+and title tags, and to write a description a reviewer can get through.
+
+The guardrails are the point, and they are the same ones we apply to everyone: an
+agreed ticket, a change you have actually run, a diff small enough to review with
+care, and an author who can explain it. Whatever wrote the diff, you are its
+author — you own every line you submit and the consequences of opening a PR with it.
+
+We may assess whether a contribution is maintainable and whether its merged code
+aligns with our security standards and design expectations.
+
 ## Contents
 
 - [Contributing to NetBird](#contributing-to-netbird)
+    - [Ticket first, PR second](#ticket-first-pr-second)
+        - [High-risk areas](#high-risk-areas)
+        - [Using AI coding agents](#using-ai-coding-agents)
     - [Contents](#contents)
     - [Code of conduct](#code-of-conduct)
-    - [Discuss changes with the NetBird team first](#discuss-changes-with-the-netbird-team-first)
     - [Directory structure](#directory-structure)
     - [Development setup](#development-setup)
         - [Requirements](#requirements)
@@ -24,6 +111,8 @@ If you haven't already, join our slack workspace [here](https://docs.netbird.io/
         - [Build and start](#build-and-start)
         - [Test suite](#test-suite)
     - [Checklist before submitting a PR](#checklist-before-submitting-a-pr)
+    - [When we close a PR](#when-we-close-a-pr)
+    - [Translations](#translations)
     - [Other project repositories](#other-project-repositories)
     - [Contributor License Agreement](#contributor-license-agreement)
 
@@ -34,42 +123,66 @@ Conduct which can be found in the file [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
 By participating, you are expected to uphold this code. Please report
 unacceptable behavior to community@netbird.io.
 
-## Discuss changes with the NetBird team first
-
-Changes to the **public API**, **gRPC protocols**, **functionality behavior**, **CLI / service flags**, or **new features** should be discussed with the NetBird team before you start the work. These surfaces are part of NetBird's contract with operators, self-hosters, and downstream integrators, and changes to them have compatibility, security, and release-planning implications that benefit from an early conversation.
-
-Open an issue or reach out on [Slack](https://docs.netbird.io/slack-url) to talk through what you have in mind. We'll help shape the change, flag any constraints we know about, and confirm the direction so the PR review can focus on implementation rather than design.
-
-Typical bug fixes, internal refactors, documentation updates, and tests do not need pre-discussion — open the PR directly.
-
 ## Directory structure
 
-The NetBird project monorepo is organized to maintain most of its individual dependencies code within their directories, except for a few auxiliary or shared packages.
+The NetBird project monorepo keeps most of each component's code within its own
+directory, except for a few auxiliary or shared packages. Protocol definitions
+and the client-side service clients live under [/shared](/shared), because both
+the agent and the services import them.
 
-The most important directories are:
+**Agent**
 
-- [/.github](/.github) - Github actions workflow files and issue templates
 - [/client](/client) - NetBird agent code
-- [/client/cmd](/client/cmd) - NetBird agent cli code
+- [/client/cmd](/client/cmd) - NetBird agent CLI code
 - [/client/internal](/client/internal) - NetBird agent business logic code
-- [/client/proto](/client/proto) - NetBird agent daemon GRPC proto files
 - [/client/server](/client/server) - NetBird agent daemon code for background execution
-- [/client/ui](/client/ui) - NetBird agent UI code
-- [/encryption](/encryption) - Contain main encryption code for agent communication
-- [/iface](/iface) - Wireguard® interface code
-- [/infrastructure_files](/infrastructure_files) - Getting started files containing docker and template scripts
+- [/client/proto](/client/proto) - NetBird agent daemon gRPC proto files
+- [/client/iface](/client/iface) - WireGuard® interface code
+- [/client/firewall](/client/firewall) - Platform firewall backends (nftables, iptables, pf, WFP, userspace)
+- [/client/ssh](/client/ssh) - Built-in SSH server and client
+- [/client/ui](/client/ui) - NetBird agent UI code (Wails v3 + React)
+- [/client/android](/client/android), [/client/ios](/client/ios) - Mobile platform bindings
+- [/client/wasm](/client/wasm) - WebAssembly build of the agent
+- [/client/mdm](/client/mdm) - MDM-delivered policy handling
+- [/client/system](/client/system) - Host and system information collection
+
+**Control plane services**
+
 - [/management](/management) - Management service code
-- [/management/client](/management/client) - Management service client code which is imported by the agent code
-- [/management/proto](/management/proto) - Management service GRPC proto files
 - [/management/server](/management/server) - Management service server code
 - [/management/server/http](/management/server/http) - Management service REST API code
+- [/management/server/store](/management/server/store) - Persistence layer and migrations
 - [/management/server/idp](/management/server/idp) - Management service IDP management code
-- [/release_files](/release_files) - Files that goes into release packages
+- [/management/server/peer](/management/server/peer), [/management/server/groups](/management/server/groups), [/management/server/networks](/management/server/networks), [/management/server/posture](/management/server/posture), [/management/server/permissions](/management/server/permissions) - Core domain packages
 - [/signal](/signal) - Signal service code
-- [/signal/client](/signal/client) - Signal service client code which is imported by the agent code
 - [/signal/peer](/signal/peer) - Signal service peer message logic
-- [/signal/proto](/signal/proto) - Signal service GRPC proto files
 - [/signal/server](/signal/server) - Signal service server code
+- [/relay](/relay) - Relay service code
+- [/relay/protocol](/relay/protocol) - Relay wire protocol
+- [/proxy](/proxy) - Identity-aware proxy used by Agent Network (LLM routing, ACME, access logs)
+- [/agent-network](/agent-network) - Agent Network overview and documentation
+- [/upload-server](/upload-server) - Debug bundle upload service
+
+**Shared code**
+
+- [/shared/management/proto](/shared/management/proto) - Management service gRPC proto files
+- [/shared/management/client](/shared/management/client) - Management service client code which is imported by the agent code
+- [/shared/management/http/api](/shared/management/http/api) - OpenAPI specification and generated REST API types
+- [/shared/signal/proto](/shared/signal/proto) - Signal service gRPC proto files
+- [/shared/signal/client](/shared/signal/client) - Signal service client code which is imported by the agent code
+- [/shared/relay](/shared/relay) - Relay client and shared relay types
+- [/shared/auth](/shared/auth), [/shared/sshauth](/shared/sshauth) - Shared authentication primitives
+- [/encryption](/encryption) - Contain main encryption code for agent communication
+- [/dns](/dns), [/route](/route), [/stun](/stun), [/sharedsock](/sharedsock), [/util](/util) - Shared networking and utility primitives
+- [/flow](/flow) - Flow event protocol shared by the agent and Management
+
+**Build, test, and packaging**
+
+- [/.github](/.github) - Github actions workflow files, issue templates, and the pull request template
+- [/e2e](/e2e) - End-to-end test suites and harness
+- [/infrastructure_files](/infrastructure_files) - Getting started files containing docker and template scripts
+- [/release_files](/release_files) - Files that goes into release packages
+- [/tools](/tools) - Development and maintenance tooling
 
 
 ## Development setup
@@ -79,13 +192,21 @@ dependencies are installed. Here is a short guide on how that can be done.
 
 ### Requirements
 
-#### Go 1.21
+#### Go 1.26
 
 Follow the installation guide from https://go.dev/
 
-#### UI client - Fyne toolkit 
+#### UI client - Wails v3 + React
 
-We use the fyne toolkit in our UI client. You can follow its requirement guide to have all its dependencies installed: https://developer.fyne.io/started/#prerequisites
+The desktop UI client (`client/ui`) is built with [Wails v3](https://v3.wails.io/) and a React frontend rendered in a WebView. To build it you need:
+
+- Go ≥ 1.26
+- Node ≥ 20 and **pnpm** (`corepack enable && corepack prepare pnpm@latest --activate`)
+- The `wails3` CLI: `go install github.com/wailsapp/wails/v3/cmd/wails3@latest`
+- The `task` runner: `go install github.com/go-task/task/v3/cmd/task@latest`
+- Linux only: `libwebkitgtk-6.0-dev`, `libgtk-4-dev`, `libsoup-3.0-dev`
+
+All UI build, dev-loop, and cross-compile commands are described in the [UI client](#ui-client) section below.
 
 #### gRPC
 You can follow the instructions from the quickstarter guide https://grpc.io/docs/languages/go/quickstart/#prerequisites and then run the `generate.sh` files located in each `proto` directory to generate changes.
@@ -214,6 +335,49 @@ To start NetBird the client in the foreground:
 sudo ./client up --log-level debug --log-file console
 ```
 > On Windows use a powershell with administrator privileges
+
+#### UI client
+
+The desktop UI lives in `client/ui` and is built with Wails v3 (see [Requirements](#ui-client---wails-v3--react)). All commands run from `client/ui`.
+
+Live-reload development (Vite + Go binary + `*.go` watcher):
+
+```
+cd client/ui
+task dev
+```
+
+Pass daemon flags after `--`, pointing the UI at the socket the daemon serves:
+
+```
+task dev -- --daemon-addr=unix:///var/run/netbird.sock   # Linux, macOS
+task dev -- --daemon-addr=npipe://netbird                # Windows
+```
+
+On Windows the daemon serves a named pipe (`npipe://netbird`). Which path that
+ends up being depends on what the daemon may create: as a service or elevated it
+serves `\\.\pipe\ProtectedPrefix\Administrators\netbird`, which no unprivileged
+process can take from it, and otherwise it falls back to `\\.\pipe\netbird`.
+Clients try both and check who owns the pipe before using the plain one. Avoid
+`tcp://127.0.0.1:41731`: loopback TCP carries no caller identity, so the daemon
+refuses the operations that require an administrator and you will not exercise
+those paths.
+
+Production build (frontend assets embedded into the binary, output in `client/ui/bin/`):
+
+```
+cd client/ui
+task build
+```
+
+Cross-compile the Windows binary from Linux (requires the mingw-w64 toolchain, e.g. `sudo apt install gcc-mingw-w64-x86-64`):
+
+```
+CGO_ENABLED=1 task windows:build
+```
+
+> macOS cross-compile from Linux is not supported (signing and notarization need a real Mac).
+
 #### Signal service
 
 To start NetBird's signal, execute:
@@ -251,10 +415,10 @@ Create dist directory
 mkdir -p dist/netbird_windows_amd64
 ```
 
-UI client
+UI client (built with Wails v3 — see the [UI client](#ui-client) section above)
 ```shell
-CC=x86_64-w64-mingw32-gcc CGO_ENABLED=1 GOOS=windows GOARCH=amd64 go build -o netbird-ui.exe -ldflags "-s -w -H windowsgui" ./client/ui
-mv netbird-ui.exe ./dist/netbird_windows_amd64/
+(cd client/ui && CGO_ENABLED=1 task windows:build)
+mv client/ui/bin/netbird-ui.exe ./dist/netbird_windows_amd64/
 ```
 
 Client
@@ -283,25 +447,183 @@ The installer `netbird-installer.exe` will be created in root directory.
 
 ### Test suite
 
-The tests can be started via:
+The host-safe unit tests run as a normal user and leave host networking
+untouched:
 
 ```
-cd netbird
-go test -exec sudo ./...
+make test-unit
 ```
+
+Tests that need root and mutate host networking (firewall, routing, interface
+management) carry the `privileged` build tag and run inside a
+`--privileged --cap-add=NET_ADMIN` Docker container:
+
+```
+make test-privileged
+```
+
+Narrow a privileged run with environment variables:
+
+```
+PRIV_RUN=TestNftablesManager PRIV_PKGS=./client/firewall/nftables/... make test-privileged
+```
+
+Single packages can be run directly, adding `-race` when the change touches
+shared state:
+
+```
+go test -race ./client/internal/dns/...
+```
+
 > On Windows use a powershell with administrator privileges
 
-> Non-GTK environments will need the `libayatana-appindicator3-dev` (debian/ubuntu) package installed
-
 ## Checklist before submitting a PR
-As a critical network service and open-source project, we must enforce a few things before submitting the pull-requests:
+
+As a critical network service and open source project, we must enforce a few
+things before submitting a pull request. The
+[pull request template](/.github/pull_request_template.md) mirrors this list —
+fill it in rather than deleting it.
+
+### Link the issue
+
+The PR description must link the agreed issue (or the validated discussion it
+came from). See [Ticket first, PR second](#ticket-first-pr-second).
+
+### Run it locally
+
+**If you can't run it, you can't submit it.** Build the affected components and
+exercise the change on a real setup — see [Build and start](#build-and-start).
+"CI will tell me" is not acceptable for a VPN agent that runs as root on other
+people's machines.
+
+### Green CI, and answer the bots
+
+We do not start reviewing while CI is red. Get the pipeline green first — a
+failing build, lint, or test means the PR is not ready for review.
+
+Alongside the test workflows, your PR is reviewed by CodeRabbit and scanned by
+SonarCloud, Snyk, and Codecov. Read what they report and either fix it or reply
+with why it does not apply; please do not resolve the threads without a
+response. They are not always right — this codebase has privileged,
+platform-specific, and concurrency-heavy paths that static analysis reads poorly
+— so push back when a finding is wrong rather than changing correct code to
+silence it. Security and dependency findings are the exception: treat those as
+real until shown otherwise. Do not edit workflows, thresholds, or scanner
+configuration to make a check pass.
+
+### One PR, one purpose
+
+Bug fix, refactor, feature: separate PRs. Mixed PRs are slow to review, hard to
+revert, and may be closed with a request to split them.
+
+### Keep it small
+
+Size is the strongest predictor of how long a PR waits for review. Aim for under
+roughly 400 changed lines across under 20 files. Past about 1000 lines or 50
+files, expect to be asked to split the change — and large PRs from outside the
+core team may be blocked until the scope has been agreed in a ticket. This is
+not only about reviewer time: NetBird's agent runs as root on other people's
+machines, and a sprawling diff cannot be reviewed with the care that deserves.
+
+Measure by hand-written code, excluding generated output, `go.sum`, and
+fixtures. If a change genuinely cannot be small — a protocol migration, a
+cross-component rename — agree the split in the issue before you start, and land
+it as a series of PRs that each build and make sense on their own.
+
+### Avoid force-pushing during review
+
+Once a PR is open, push new commits instead of rewriting history. A force-push
+detaches existing review comments from their lines, throws away the
+"changes since your last review" diff, and loses the CI history that showed
+which commit broke what. Since we squash on merge, there is nothing to gain from
+a tidy branch history.
+
+Force-pushing is sometimes unavoidable — rebasing to clear a real conflict, or
+removing a secret or large binary committed by mistake. When that happens, leave
+a comment on the PR so reviewers know their anchors moved.
+
+### Quality checks
+
+Run these from the repository root before pushing:
+
+```shell
+go fmt ./...
+make lint        # golangci-lint on files changed against origin/main
+make lint-all    # full-repository lint, matches CI
+make test-unit   # host-safe unit tests
+```
+
+`make setup-hooks` wires `make lint` into a pre-push hook so the fast lint runs
+automatically. If your change touches privileged paths (firewall, routing,
+interface management), also run `make test-privileged`, which executes the
+`privileged`-tagged suite inside a Docker container with `NET_ADMIN`.
+
+### Code standards
+
 - Keep functions as simple as possible, with a single purpose
 - Use private functions and constants where possible
 - Comment on any new public functions
 - Add unit tests for any new public function
+- Comment the **why**, not the **what** — explain non-obvious decisions, invariants, and constraints, not the line below
+- Keep comments within 90 characters per line and roughly 250 characters per comment; when a block needs more explanation than that, extract a named function instead of writing a longer comment (see [AGENTS.md](AGENTS.md#length-budget))
+
+### PR title and commits
+
+PR titles must start with a bracketed tag, enforced by
+[pr-title-check.yml](/.github/workflows/pr-title-check.yml):
+
+```text
+[client] Authorize daemon IPC callers by their local identity
+[management,client] Add MDM policy support
+```
+
+Use a comma-separated list inside a single pair of brackets when a change spans
+components. The `allowedTags` array in
+[pr-title-check.yml](/.github/workflows/pr-title-check.yml) is the source of
+truth — at the time of writing it accepts `management`, `client`, `signal`,
+`proxy`, `relay`, `misc`, `infrastructure`, `self-hosted`, and `doc`.
+
+Commit subjects follow the same convention — keep them short and put the
+reasoning in the body, why before what, with no bullet list of files changed.
+
+Keep the PR description itself under 1000 words on top of the template text.
+Reviewers read the diff; the description explains what the diff cannot.
 
 > When pushing fixes to the PR comments, please push as separate commits; we will squash the PR before merging, so there is no need to squash it before pushing it, and we are more than okay with 10-100 commits in a single PR. This helps review the fixes to the requested changes.
 
+### Documentation
+
+User-facing changes need a matching PR in
+[netbirdio/docs](https://github.com/netbirdio/docs); link it in the PR
+description, or state why documentation is not needed.
+
+## When we close a PR
+
+We would rather redirect early than let a PR sit. We may close one if:
+
+- It changes behavior with no linked issue, or the approach was never agreed with a maintainer
+- The change was clearly never run or tested locally
+- CI has been red without a response
+- It mixes unrelated purposes, or the purpose is not clear
+- It is far too large to review and the scope was never agreed in a ticket
+- The author cannot answer questions about their own change — including PRs that read as unreviewed model output, where review turns into a relay between the maintainer and an LLM. Tooling is fine; unreviewed output is not, you are responsible for the code you sign your name to
+- There has been no activity for 14 days after we requested changes
+
+A closed PR is not a rejected idea. Take it back to the
+[discussion](https://github.com/netbirdio/netbird/discussions), settle the
+approach, and reopen the work from there.
+
+## Translations
+
+Desktop UI translations are not contributed through pull requests. Translate on
+[Crowdin](https://crowdin.com/project/netbird) instead: no ticket needed, just
+join the project and pick your language. Crowdin syncs with this repository and
+opens the service PRs itself, so hand-edited locale files would conflict with
+the next sync. Style, terminology, and review guidance live in
+[client/ui/i18n/TRANSLATING.md](client/ui/i18n/TRANSLATING.md). To request a
+language the project does not offer yet, ask on the Crowdin project page or in
+a [discussion](https://github.com/netbirdio/netbird/discussions).
+
 ## Other project repositories
 
 NetBird project is composed of 3 main repositories:
diff --git a/LICENSE b/LICENSE
index d922f155a..4d0551de8 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,9 +1,9 @@
-This BSD‑3‑Clause license applies to all parts of the repository except for the directories management/, signal/, relay/ and combined/.
+This BSD-3-Clause license applies to all parts of the repository except for the directories management/, signal/, relay/ and combined/.
 Those directories are licensed under the GNU Affero General Public License version 3.0 (AGPLv3). See the respective LICENSE files inside each directory.
 
 BSD 3-Clause License
 
-Copyright (c) 2022 NetBird GmbH & AUTHORS
+Copyright (c) 2022-2026 NetBird GmbH & AUTHORS
 
 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
 
diff --git a/LICENSES/BSD-3-Clause.txt b/LICENSES/BSD-3-Clause.txt
index 7cba76dfd..5e9a2539c 100644
--- a/LICENSES/BSD-3-Clause.txt
+++ b/LICENSES/BSD-3-Clause.txt
@@ -1,6 +1,6 @@
 BSD 3-Clause License
 
-Copyright (c) 2022 NetBird GmbH & AUTHORS
+Copyright (c) 2022-2026 NetBird GmbH & AUTHORS
 
 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
 
diff --git a/Makefile b/Makefile
index 0a4fad2f2..26c5b932e 100644
--- a/Makefile
+++ b/Makefile
@@ -23,8 +23,8 @@ lint-install: $(GOLANGCI_LINT)
 # Setup git hooks for all developers
 setup-hooks:
 	@git config core.hooksPath .githooks
-	@chmod +x .githooks/pre-push
-	@echo "✅ Git hooks configured! Pre-push will now run 'make lint'"
+	@chmod +x .githooks/pre-push .githooks/commit-msg
+	@echo "✅ Git hooks configured! Pre-push runs 'make lint'; commit-msg refuses attribution trailers"
 
 # Host-safe unit tests: excludes the privileged-tagged tests (root / system-mutating).
 # Runs as a normal user with no sudo and leaves host networking untouched.
diff --git a/README.md b/README.md
index 40c6b9ed5..4dbfc7bd0 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@
   <strong>
     Start using NetBird at <a href="https://netbird.io/pricing">netbird.io</a>
     <br/>
-    See <a href="https://netbird.io/docs/">Documentation</a>
+    See <a href="https://docs.netbird.io/">Documentation</a>
     <br/>
     Join our <a href="https://docs.netbird.io/slack-url">Slack channel</a> or our <a href="https://forum.netbird.io">Community forum</a>
   </strong>
@@ -115,6 +115,56 @@ export NETBIRD_DOMAIN=netbird.example.com; curl -fsSL https://github.com/netbird
 
 See a complete [architecture overview](https://docs.netbird.io/about-netbird/how-netbird-works#architecture) for details.
 
+### Reporting bugs and requesting features
+
+NetBird uses a discussion-first workflow. Bug reports and feature requests start in
+[Discussions](https://github.com/netbirdio/netbird/discussions), not as issues.
+
+| What you want to do | Where to go |
+| --- | --- |
+| Report a bug, regression, or unexpected behavior | [Issue Triage](https://github.com/netbirdio/netbird/discussions/new?category=issue-triage) |
+| Request a feature or share an idea | [Ideas & Feature Requests](https://github.com/netbirdio/netbird/discussions/new?category=ideas-feature-requests) |
+| Ask about setup, configuration, or self-hosting | [Q&A / Support](https://github.com/netbirdio/netbird/discussions/new?category=q-a-support) |
+| Report a security vulnerability | [Security policy](https://github.com/netbirdio/netbird/security/policy), never a public thread |
+
+Our team and maintainers triage discussions, ask follow-up questions, check for duplicates,
+and reproduce bugs. Validated reports are promoted to issues. This keeps the issue tracker a clear
+answer to one question: what is the team working on.
+
+Please search existing discussions and issues first, including closed ones. If something similar
+already exists, upvote it and add your details there instead of opening a duplicate.
+
+For bug reports, include your NetBird version, operating system, deployment type (Cloud,
+self-hosted, Kubernetes, or Docker), reproduction steps, expected and actual behavior, and a debug
+bundle where relevant:
+
+```shell
+netbird version
+netbird status -d -A
+netbird debug for 1m -A -S -U
+```
+
+`-U` uploads the bundle and prints a file key you can paste instead of attaching the archive.
+`-A` anonymizes the output, which matters on a public thread. It masks most identifying details
+but is not full redaction, so read the bundle before posting it. Two levels are available:
+
+| Level | How to select | What it masks |
+| --- | --- | --- |
+| `default` | `-A` / `--anonymize` | Public IP addresses, IPv6 ULA addresses, MAC addresses, and domains other than `netbird.io`, `netbird.cloud`, `netbird.selfhosted`, and `netbird.stage`. IPv4 private, CGNAT, and link-local ranges are kept |
+| `strict` | `--anonymize-level strict` (implies `-A`) | The above, plus IPv4 private, CGNAT, and link-local ranges, peer names in front of `netbird.cloud`, `netbird.selfhosted`, and `netbird.stage`, and WireGuard public keys. Labels under `netbird.io` are kept, since it only hosts infrastructure |
+
+See [collecting a debug bundle](https://docs.netbird.io/help/troubleshooting-client#debug-bundle)
+and the [CLI reference](https://docs.netbird.io/get-started/cli#debug-for) for details.
+
+See [How to use Discussions, Issues, and Pull Requests](https://github.com/netbirdio/netbird/discussions/6075)
+for the full workflow, or [SUPPORT.md](SUPPORT.md) for a shorter version.
+
+### Contributing
+
+Contributions are welcome. Read [CONTRIBUTING.md](CONTRIBUTING.md) first. NetBird works ticket
+first, anything that changes behavior needs an issue the team has agreed on before you open a pull
+request.
+
 ### Community projects
 - [NetBird installer script](https://github.com/physk/netbird-installer)
 - [netbird-tui](https://github.com/n0pashkov/netbird-tui) - terminal UI for managing NetBird peers, routes, and settings
@@ -130,7 +180,7 @@ In November 2022, NetBird joined the [StartUpSecure program](https://www.forschu
 ![CISPA_Logo_BLACK_EN_RZ_RGB (1)](https://user-images.githubusercontent.com/700848/203091324-c6d311a0-22b5-4b05-a288-91cbc6cdcc46.png)
 
 ### Acknowledgements
-We build on open-source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
+We build on open source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
 
 ### Legal
 This repository is licensed under the BSD-3-Clause license, which applies to all parts of the repository except for the directories management/, signal/ and relay/.
diff --git a/SECURITY.md b/SECURITY.md
index 745c66e61..cbcc975ba 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,12 +1,70 @@
 # Security Policy
 
-NetBird's goal is to provide a secure network. If you find a vulnerability or bug, please report it by opening an issue [here](https://github.com/netbirdio/netbird/issues/new?assignees=&labels=&template=bug-issue-report.md&title=) or by contacting us by email.
-
-There has yet to be an official bug bounty program for the NetBird project.
-
-## Supported Versions
-- We currently support only the latest version
+NetBird's goal is to provide a secure network. The client runs as a privileged service on every machine it is installed on,
+so we take reports about it seriously and we publish what we fix.
 
 ## Reporting a Vulnerability
 
-Please report security issues to `security@netbird.io`
+**Please do not open a public issue for a security vulnerability.** Public issues are visible to everyone, including before
+a fix is available.
+
+Report security issues one of these two ways:
+
+- **GitHub private vulnerability reporting** — [open a private report](https://github.com/netbirdio/netbird/security/advisories/new)
+  on this repository. This is the preferred route: it keeps the discussion, the draft advisory, and the credit in one place.
+- **Email** — `security@netbird.io`.
+
+If the finding affects NetBird Cloud or our hosted infrastructure rather than the open source code, email us rather than
+filing a repository report.
+
+### What to include
+
+A report is easier to act on when it contains:
+
+- The affected component (client, management, signal, relay, dashboard) and the version or commit you tested
+- The platform and configuration, where relevant — operating system, self-hosted or NetBird Cloud, container or host install
+- What an attacker needs before they can exploit it: network position, an account, local access, a specific privilege level
+- Steps to reproduce, and a proof of concept if you have one
+- The impact you believe it has
+
+Partial reports are still welcome. If you are unsure whether something is a security issue, send it to `security@netbird.io`
+and let us make that call.
+
+## What to expect from us
+
+- **We acknowledge your report** and tell you whether we can reproduce it.
+- **We work with you on severity and scope.** If we assess it differently than you do, we will explain why rather than
+  silently downgrade it.
+- **We fix and release**, then publish a [GitHub Security Advisory](https://github.com/netbirdio/netbird/security/advisories)
+  naming the affected version range and the patched version.
+- **We credit reporters who want to be credited.** Tell us the name or handle you would like used, or that you would rather
+  stay anonymous.
+- **We keep you in the loop** until the advisory is published.
+
+We ask that you give us a reasonable opportunity to ship a fix before disclosing the issue publicly, and that you avoid
+accessing, modifying, or exfiltrating data belonging to other people while testing. Testing against your own installation
+or your own account is always fine.
+
+## Supported Versions
+
+We support the latest release. Security fixes ship in the next version rather than as backports to older releases, so
+upgrading to the current release is how you get them.
+
+Release notifications are available by watching [releases](https://github.com/netbirdio/netbird/releases).
+
+## Published advisories
+
+Every vulnerability we fix is published as a GitHub Security Advisory on the
+[advisories page](https://github.com/netbirdio/netbird/security/advisories), including the affected version range, the
+patched version, and the reporter's credit. Advisories for the Go module are also distributed through the Go vulnerability
+database, so `govulncheck` will report them against your dependencies.
+
+## Bug bounty
+
+There is no official bug bounty program for the NetBird project. We credit reporters in advisories, and we are grateful for
+the work, but we cannot currently offer payment for reports.
+
+## Non-security bugs
+
+For bugs that are not security issues, please use the
+[issue tracker](https://github.com/netbirdio/netbird/discussions/new/choose).
diff --git a/SUPPORT.md b/SUPPORT.md
new file mode 100644
index 000000000..fade37286
--- /dev/null
+++ b/SUPPORT.md
@@ -0,0 +1,121 @@
+# Getting help with NetBird
+
+Where to go depends on what you need. If you are not sure, start with
+[Q&A / Support](https://github.com/netbirdio/netbird/discussions/new?category=q-a-support)
+and we will move it.
+
+## Before you post
+
+1. Search existing [discussions](https://github.com/netbirdio/netbird/discussions) and
+   [issues](https://github.com/netbirdio/netbird/issues), including closed ones.
+2. Check the [documentation](https://docs.netbird.io) and the troubleshooting guides for
+   [clients](https://docs.netbird.io/help/troubleshooting-client) and
+   [self-hosted deployments](https://docs.netbird.io/selfhosted/troubleshooting).
+3. Remove or anonymize sensitive information from logs, screenshots, and configuration.
+
+If a discussion already covers your problem, upvote it and add your details there rather than
+opening a duplicate. Extra reproduction detail, affected versions, and deployment notes are
+useful even on an existing thread.
+
+## Community support
+
+Free, for everyone. Covers the NetBird client, open source self-hosted deployments, and general
+questions.
+
+| What you want to do | Where to go |
+| --- | --- |
+| Report a bug, regression, or unexpected behavior | [Issue Triage](https://github.com/netbirdio/netbird/discussions/new?category=issue-triage) |
+| Request a feature or share an idea | [Ideas & Feature Requests](https://github.com/netbirdio/netbird/discussions/new?category=ideas-feature-requests) |
+| Ask about setup, configuration, or self-hosting | [Q&A / Support](https://github.com/netbirdio/netbird/discussions/new?category=q-a-support) |
+| Chat with the community | [Slack](https://docs.netbird.io/slack-url) |
+
+## Paid support
+
+For NetBird Cloud customers and commercial-license self-hosted deployments, covering the
+dashboard, control plane, billing, and subscriptions, see
+[reporting bugs and issues](https://docs.netbird.io/help/report-bug-issues).
+
+## Security
+
+Do not report security vulnerabilities in public issues or discussions, and do not post secrets,
+private keys, internal hostnames, or sensitive logs. Use the
+[security policy](https://github.com/netbirdio/netbird/security/policy).
+
+## What makes a report we can act on
+
+For a bug, the most useful reports include:
+
+- NetBird version, and component versions where applicable
+- Operating system or environment
+- Deployment type: NetBird Cloud, self-hosted, Kubernetes, Docker, or local development
+- Current behavior and expected behavior
+- The smallest set of steps that reproduces the problem
+- Logs, status output, screenshots, or a debug bundle when relevant
+- Whether this worked before, and the last known working version
+
+For client reports, these commands usually give us what we need:
+
+```shell
+netbird version
+netbird status -d -A
+netbird debug for 1m -A -S -U
+```
+
+`-A` (`--anonymize`) replaces sensitive values consistently across every file in the bundle, so
+it stays readable while masking most identifying details. It is not a guarantee of full redaction:
+internal address ranges survive at the default level, and interface names, indexes, MTUs, and
+flags are never anonymized. Read the bundle before posting it publicly. Two levels are
+available:
+
+| Level | How to select | What it masks |
+| --- | --- | --- |
+| `default` | `-A` / `--anonymize`, or `--anonymize-level default` | Public IP addresses, IPv6 ULA addresses, MAC addresses, and domains other than `netbird.io`, `netbird.cloud`, `netbird.selfhosted`, and `netbird.stage`. IPv4 private, CGNAT, and link-local ranges are kept, and interface names are not anonymized |
+| `strict` | `--anonymize-level strict` (implies `-A`) | The above, plus IPv4 private, CGNAT, and link-local ranges, peer names in front of `netbird.cloud`, `netbird.selfhosted`, and `netbird.stage`, and WireGuard public keys. Labels under `netbird.io` are kept, since it only hosts infrastructure |
+
+Use `strict` when internal addressing or peer naming is itself sensitive. Either way, private
+keys and SSH keys are never included, and the packet capture (`capture.pcap`) is left out of
+anonymized bundles because it holds raw decrypted packets.
+
+`-U` (`--upload-bundle`) uploads the bundle and returns a file key you can paste into the thread
+instead of attaching an archive. Retention is controlled by the upload service; check its policy
+before uploading, and configure cleanup for self-hosted deployments.
+
+For more detail, see [troubleshooting client issues](https://docs.netbird.io/help/troubleshooting-client),
+which explains [what a debug bundle contains](https://docs.netbird.io/help/troubleshooting-client#debug-bundle),
+and the [CLI reference](https://docs.netbird.io/get-started/cli#debug-for).
+
+Intermittent problems are still worth reporting. They just need enough detail to investigate:
+trigger, frequency, timing, timestamps, and any related logs.
+
+For a feature request, describe the problem before the solution: what you are trying to
+accomplish, who is affected and how often, why the current behavior or workaround is not enough,
+and what you would like to see instead.
+
+## What happens after you post
+
+Our team, maintainers, or community members may ask for missing details, link related
+threads, merge duplicates, move your post to a better category, or try to reproduce the problem.
+
+Not every discussion becomes an issue. Some are answered in Q&A, some turn out to be
+configuration problems, and some need more information before engineering can act. A
+well-answered discussion is still a useful outcome.
+
+When a report is confirmed and actionable, a maintainer opens a validated issue linked back to
+the discussion, in whichever repository the fix belongs to. You do not need to know which
+repository that is. Routing is part of triage.
+
+## A note on issues
+
+Issues in this repository are maintainer-curated work items. Every open issue is something a
+maintainer or contributor can pick up and act on. Issues opened without a linked validated
+discussion may be closed and redirected here.
+
+Maintainers can still open issues directly for work found internally, such as regressions caught
+during development, planned maintenance, or release blockers.
+
+## Related reading
+
+- [How to use Discussions, Issues, and Pull Requests](https://github.com/netbirdio/netbird/discussions/6075)
+- [Moving to a discussion-first approach](https://github.com/netbirdio/netbird/discussions/6074)
+- [CONTRIBUTING.md](CONTRIBUTING.md) for opening pull requests
+- [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
diff --git a/agent-network/README.md b/agent-network/README.md
index a09d3979e..35b9c6668 100644
--- a/agent-network/README.md
+++ b/agent-network/README.md
@@ -1,16 +1,76 @@
 # NetBird Agent Network
 
-Agent Network is NetBird's access control layer for AI agents and the people who run
-them. It gives every agent a real identity, tied to your identity provider (IdP), and
-governs what it can reach — the LLM APIs and AI gateways it can call, and the internal
-resources it can access. Traffic flows only over the encrypted NetBird tunnel, scoped by
-policy, with no API keys to leak.
+Agent Network is NetBird's access control layer for AI agents and the people who run them. 
+It gives every agent a real identity, tied to an identity provider (IdP), and governs what it can reach: LLM APIs and 
+AI gateways it can call, and the internal resources it can access. Traffic flows only over the encrypted NetBird tunnel, 
+scoped by policy, with no API keys or other credentials to leak. It also gives you control over cost and token usage.
 
-> **Beta.** Agent Network is open source and can be self-hosted on your own
-> infrastructure.
+Because every LLM request passes through an
+identity-aware proxy, you can:
+
+- **Set spending and rate limits** per agent, per user, or per team — with hard caps
+  that stop requests once a budget is reached.
+- **Restrict models and providers** so agents can only call approved (and cost-appropriate)
+  endpoints, keeping expensive models off-limits unless explicitly allowed.
+- **Attribute usage** by tracking token consumption and cost per identity, group, or cost center so every
+  request is tied back to the agent and person responsible.
+- **Reuse your existing AI gateway** — point the proxy at a gateway you already run,
+  keeping its routing and config in place while it adds identity on top, so you skip
+  API key distribution.
+
+https://github.com/user-attachments/assets/44d18286-d8ab-49f8-a457-98ccd66f3268
+
+> **Beta.** Agent Network is in beta, but it's stable and already running in
+> production environments. It's fully open source and can be self-hosted on your own
+> infrastructure, with no vendor lock-in and no data leaving your environment.
 
 ## How it works
 
+Say you have a simple use case: your Engineering or IT team needs access to Claude Code or Codex, and you want visibility into usage plus the ability to enforce budgets.
+How can you do that without creating a dedicated API key for every team?
+
+With Agent Network you get a private endpoint inside your network, for example: https://mirror.netbird.ai
+Teams configure their agents to point to that endpoint instead of using individual API keys directly. 
+
+This endpoint is only reachable when users are connected to your NetBird network and authenticated through your IdP. Otherwise, it is not accessible from the public internet.
+You can then use this private endpoint to configure your AI agents, whether that is Claude Code, Codex, or another tool.
+
+## Quickstart
+
+Full step-by-step setup:
+**https://docs.netbird.io/agent-network/quickstart**
+
+## Client settings that don't follow the endpoint
+
+Most of an agent's traffic follows the base URL you hand it, but a few
+client-side checks call their vendor directly and never reach the proxy. On a
+network that blocks direct egress they fail even though inference works, so
+they are worth setting once when you roll the endpoint out.
+
+For Claude Code:
+
+- **Fast mode** checks availability against `api.anthropic.com` rather than the
+  configured base URL. Set `CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK=1` when the
+  agent authenticates with `ANTHROPIC_AUTH_TOKEN` alone (the usual shape when
+  the proxy injects the real provider key) or when a TLS-inspecting proxy
+  answers the check itself. Set
+  `CLAUDE_CODE_SKIP_FAST_MODE_NETWORK_ERRORS=1` when the network refuses the
+  connection outright. Fast mode is an Anthropic-API feature, so it is
+  unavailable on a Bedrock- or Vertex-backed endpoint whatever you set.
+- **Model discovery** is off by default. Set
+  `CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1` for the picker to list the
+  models your policies authorise; the proxy filters the response to that set.
+  The client gives discovery a three-second budget and treats any redirect as
+  a failure, so the endpoint must serve `/v1/models` directly.
+- **The WebFetch domain safety check** also calls `api.anthropic.com` directly
+  and is unaffected by the variables above.
+
+Allowing direct egress to `api.anthropic.com` covers the network cases but not
+the credential one, where the check reaches Anthropic and is rejected because
+the agent presents a proxy-issued key.
+
+## Architecture 
+
 Agent Network is built on two existing NetBird capabilities:
 
 - **Overlay network** — the encrypted WireGuard mesh between peers.
@@ -22,6 +82,9 @@ LLM traffic is routed through the proxy's identity-aware pipeline, while interna
 resources (databases, internal APIs, self-hosted models) are reached directly over
 peer-to-peer WireGuard tunnels, governed by the same identities and access policies.
 
+<img width="4720" height="2218" alt="image" src="https://github.com/user-attachments/assets/1afa5da1-4b82-4f8a-a7a8-f417efadf1eb" />
+
+
 ## Where the code lives
 
 There is no separate "agent-network" service — it reuses the reverse-proxy and management
@@ -33,6 +96,42 @@ components:
   — the management-side control plane: providers, policies, guardrails, limits, routing,
   and usage/access logs.
 
+## Access roles
+
+Agent Network permissions build on the account permission matrix
+([`management/server/permissions/`](../management/server/permissions)). The
+`agent_network` area is split into dotted submodules (`agent_network.providers`,
+`.policies`, `.guardrails`, `.budgets`, `.usage`, `.logs`, `.settings`); a role may
+grant a single submodule or the parent, which cascades to all of them.
+
+Two roles delegate Agent Network access without account-admin rights:
+
+- **`agent_network_admin`** — full control over the whole `agent_network` area plus
+  read-only users, groups, peers, and account info (needed to build policies).
+  Nothing else in the account.
+- **`usage_viewer`** — the regular User baseline plus read on
+  `agent_network.usage` (the aggregated usage and cost overview) and
+  `agent_network.logs` (the account-wide request-level access logs, which can
+  contain captured prompts), and read-only access to the resources those
+  filters resolve against: users, groups, peers, and the provider list
+  (connection config redacted — no upstream URLs or operator-supplied header
+  values). No policies, guardrails, budgets, or settings.
+
+Every authenticated user, regardless of role, can read the caller-scoped
+self-service endpoint `GET /api/agent-network/agent-config` (the endpoint, providers,
+and models the caller's own policies allow — what a local AI tool needs and nothing
+more). The regular usage and access-log endpoints self-scope instead of denying:
+a caller without the account-wide grant gets their own rows back, so "my usage"
+and "my requests" are the same endpoints the admin dashboard uses. The provider
+list self-scopes the same way — a caller without the providers grant gets the
+providers their own policies authorize, reduced to the display surface, with
+each provider's model list cut to what the caller's policy guardrails and the
+provider's declared models effectively permit (the same computation the setup
+answer and the proxy use). This feeds the dashboard's provider and model
+filters. Role
+definitions live in
+[`management/server/permissions/roles/`](../management/server/permissions/roles).
+
 ## Documentation
 
 Full documentation, architecture, and quickstart:
diff --git a/base62/base62.go b/base62/base62.go
index efafbc768..1a02e98e2 100644
--- a/base62/base62.go
+++ b/base62/base62.go
@@ -3,56 +3,75 @@ package base62
 import (
 	"fmt"
 	"math"
-	"strings"
 )
 
 const (
-	alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
-	base     = uint32(len(alphabet))
+	alphabet        = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+	base            = uint32(len(alphabet))
+	maxBase62Digits = 6 // max number of digits required to encode MaxUint32
+
 )
 
+var (
+	ErrEmptyString = fmt.Errorf("empty string")
+	ErrInvalidChar = fmt.Errorf("invalid character")
+	ErrOverflow    = fmt.Errorf("integer overflow")
+)
+
+// Fixed-size arrays have better performance and lower memory overhead compared to maps for small static sets of data
+var charToIndex [123]int8 // Assuming ASCII from '\0' - 'z'
+
+func init() {
+	for i := range charToIndex {
+		charToIndex[i] = -1
+	}
+	for i, c := range alphabet {
+		charToIndex[c] = int8(i)
+	}
+}
+
 // Encode encodes a uint32 value to a base62 string.
-func Encode(num uint32) string {
-	if num == 0 {
-		return string(alphabet[0])
+// The returned string will be between 1-6 characters long.
+func Encode(n uint32) string {
+	if n < base {
+		return string(alphabet[n])
+	}
+	// avoid dynamic memory usage for small, fixed size data
+	buf := [maxBase62Digits]byte{}
+	idx := len(buf)
+
+	for n > 0 {
+		idx--
+		buf[idx] = alphabet[n%base]
+		n /= base
 	}
 
-	var encoded strings.Builder
-
-	for num > 0 {
-		remainder := num % base
-		encoded.WriteByte(alphabet[remainder])
-		num /= base
-	}
-
-	// Reverse the encoded string
-	encodedString := encoded.String()
-	reversed := reverse(encodedString)
-	return reversed
+	return string(buf[idx:])
 }
 
 // Decode decodes a base62 string to a uint32 value.
+// Returns an error if the input string is empty, contains invalid characters,
+// or would result in integer overflow.
 func Decode(encoded string) (uint32, error) {
+	if len(encoded) == 0 {
+		return 0, ErrEmptyString
+	}
 	var decoded uint32
-	strLen := len(encoded)
-
-	for i, char := range encoded {
-		index := strings.IndexRune(alphabet, char)
+	for _, char := range encoded {
+		index := int8(-1)
+		if int(char) < len(charToIndex) {
+			index = charToIndex[char]
+		}
 		if index < 0 {
-			return 0, fmt.Errorf("invalid character: %c", char)
+			return 0, fmt.Errorf("%w: %c", ErrInvalidChar, char)
+		}
+		// Add overflow check when calculating the decoded value to prevent silent overflow of uint32
+		if decoded > (math.MaxUint32-uint32(index))/base {
+			return 0, fmt.Errorf("%w: %s", ErrOverflow, encoded)
 		}
 
-		decoded += uint32(index) * uint32(math.Pow(float64(base), float64(strLen-i-1)))
+		decoded = decoded*base + uint32(index)
 	}
 
 	return decoded, nil
 }
-
-// Reverse a string.
-func reverse(s string) string {
-	runes := []rune(s)
-	for i, j := 0, len(runes)-1; i < j; i, j = i+1, j-1 {
-		runes[i], runes[j] = runes[j], runes[i]
-	}
-	return string(runes)
-}
diff --git a/base62/base62_test.go b/base62/base62_test.go
index 00da2124a..f2ad06d6f 100644
--- a/base62/base62_test.go
+++ b/base62/base62_test.go
@@ -1,31 +1,67 @@
 package base62
 
 import (
+	"errors"
+	"math"
 	"testing"
 )
 
 func TestEncodeDecode(t *testing.T) {
-	tests := []struct {
-		num uint32
+	testCases := []struct {
+		input    uint32
+		expected string
 	}{
-		{0},
-		{1},
-		{42},
-		{12345},
-		{99999},
-		{123456789},
+		{0, "0"},
+		{1, "1"},
+		{5, "5"},
+		{9, "9"},
+		{10, "A"},
+		{42, "g"},
+		{61, "z"},
+		{62, "10"},
+		{'0', "m"},
+		{'9', "v"},
+		{'A', "13"},
+		{'Z', "1S"},
+		{'a', "1Z"},
+		{'z', "1y"},
+		{99999, "Q0t"},
+		{12345, "3D7"},
+		{123456789, "8M0kX"},
+		{math.MaxUint32, "4gfFC3"},
 	}
 
-	for _, tt := range tests {
-		encoded := Encode(tt.num)
+	for _, tc := range testCases {
+		encoded := Encode(tc.input)
+		if encoded != tc.expected {
+			t.Errorf("Encode(%d) = %s; want %s", tc.input, encoded, tc.expected)
+		}
 		decoded, err := Decode(encoded)
-
 		if err != nil {
-			t.Errorf("Decode error: %v", err)
+			t.Errorf("Expected error nil, got %v", err)
 		}
 
-		if decoded != tt.num {
-			t.Errorf("Decode(%v) = %v, want %v", encoded, decoded, tt.num)
+		if decoded != tc.input {
+			t.Errorf("Decode(%v) = %v, want %v", encoded, decoded, tc.input)
 		}
 	}
 }
+
+// Decode handles empty string input with appropriate error
+func TestDecodeEmptyString(t *testing.T) {
+	if _, err := Decode(""); !errors.Is(err, ErrEmptyString) {
+		t.Errorf("Expected error %v, got %v", ErrEmptyString, err)
+	}
+}
+
+func TestDecodeOverflow(t *testing.T) {
+	if _, err := Decode("4gfFC4"); !errors.Is(err, ErrOverflow) {
+		t.Errorf("Expected error %v, got %v", ErrOverflow, err)
+	}
+}
+
+func TestDecodeInvalid(t *testing.T) {
+	if _, err := Decode("/"); !errors.Is(err, ErrInvalidChar) {
+		t.Errorf("Expected error %v, got %v", ErrInvalidChar, err)
+	}
+}
diff --git a/client/Dockerfile-nblink b/client/Dockerfile-nblink
new file mode 100644
index 000000000..63177a6c0
--- /dev/null
+++ b/client/Dockerfile-nblink
@@ -0,0 +1,34 @@
+# nblink runs unprivileged: no TUN device, no capabilities, no host networking.
+#
+# The image is built for platforms that assign an arbitrary UID at run time, so
+# it must not depend on a passwd entry and its state directory has to be
+# writable by the root group rather than by one named user.
+FROM alpine:3.22 AS build
+
+# Group 0 owns the state directory so a container started as any UID in that
+# group can still persist its identity. Mode 770 rather than g=u, because the
+# directory holds the peer's keys and nothing outside owner and group should
+# read them, including when the path is bind-mounted from a host.
+RUN mkdir -p /tmp/state/nblink \
+    && chgrp -R 0 /tmp/state/nblink \
+    && chmod -R 770 /tmp/state/nblink
+
+FROM gcr.io/distroless/static-debian13:nonroot
+
+ARG TARGETPLATFORM
+COPY ${TARGETPLATFORM}/nblink /usr/local/bin/nblink
+# COPY of a directory copies its contents and creates the target with mode
+# 755, which group 0 cannot write. Copying the parent makes nblink/ itself the
+# copied entry, so its mode survives.
+COPY --from=build --chown=65532:0 /tmp/state/ /var/lib/
+
+# Numeric so the runtime can substitute its own UID without a passwd lookup.
+USER 65532:0
+
+# No NB_STATE_DIR by default: state stays in memory, so the image runs on a
+# read-only root filesystem without a volume. Set NB_STATE_DIR=/var/lib/nblink
+# and mount a volume there to keep the peer identity; a volume mounted over
+# the directory starts out with its group-0 ownership.
+ENV NB_LOG_LEVEL=info
+
+ENTRYPOINT ["/usr/local/bin/nblink"]
diff --git a/client/Dockerfile-rootless.ubi b/client/Dockerfile-rootless.ubi
new file mode 100644
index 000000000..4701728c1
--- /dev/null
+++ b/client/Dockerfile-rootless.ubi
@@ -0,0 +1,45 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG NETBIRD_BINARY=$TARGETPLATFORM/netbird
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-rootless" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Rootless Client" \
+      description="NetBird connects devices through an encrypted overlay using userspace networking without a TUN device or network administration capabilities."
+
+RUN microdnf install -y bash ca-certificates && microdnf clean all
+
+COPY --chmod=0555 client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
+COPY --chmod=0555 ${NETBIRD_BINARY} /usr/local/bin/netbird
+COPY licenses/ /licenses/
+# Only application storage is group-writable for arbitrary non-root UIDs.
+# Runtime-created credentials keep the client's restrictive file modes.
+RUN mkdir -p /var/lib/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+WORKDIR /var/lib/netbird
+USER 1000:0
+
+ENV \
+    HOME="/var/lib/netbird" \
+    NETBIRD_BIN="/usr/local/bin/netbird" \
+    NB_USE_NETSTACK_MODE="true" \
+    NB_ENABLE_NETSTACK_LOCAL_FORWARDING="true" \
+    NB_CONFIG="/var/lib/netbird/config.json" \
+    NB_STATE_DIR="/var/lib/netbird" \
+    NB_DAEMON_ADDR="unix:///var/lib/netbird/netbird.sock" \
+    NB_LOG_FILE="console,/var/lib/netbird/client.log" \
+    NB_DISABLE_DNS="true" \
+    NB_ENABLE_CAPTURE="false" \
+    NB_ENTRYPOINT_SERVICE_TIMEOUT="30"
+
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/usr/local/bin/netbird-entrypoint.sh"]
diff --git a/client/android/client.go b/client/android/client.go
index 99ccdf393..9705db8e0 100644
--- a/client/android/client.go
+++ b/client/android/client.go
@@ -7,13 +7,16 @@ import (
 	"fmt"
 	"os"
 	"slices"
+	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"golang.org/x/exp/maps"
 
 	log "github.com/sirupsen/logrus"
 
+	nbAnonymize "github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/debug"
@@ -24,6 +27,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/client/net"
+	"github.com/netbirdio/netbird/client/netevents"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -31,10 +35,12 @@ import (
 	types "github.com/netbirdio/netbird/upload-server/types"
 )
 
-// ConnectionListener export internal Listener for mobile
-type ConnectionListener interface {
-	peer.Listener
-}
+// AnonymizeLevelDefault and AnonymizeLevelStrict are the accepted
+// anonymizeLevel values for DebugBundle.
+const (
+	AnonymizeLevelDefault = nbAnonymize.LevelDefaultString
+	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
+)
 
 // TunAdapter export internal TunAdapter for mobile
 type TunAdapter interface {
@@ -56,6 +62,12 @@ type DnsReadyListener interface {
 	dns.ReadyListener
 }
 
+// TunSettings is a snapshot of the settings the TUN device is rebuilt with
+type TunSettings struct {
+	Routes        string
+	SearchDomains string
+}
+
 func init() {
 	formatter.SetLogcatFormatter(log.StandardLogger())
 }
@@ -70,18 +82,50 @@ type Client struct {
 	deviceName            string
 	uiVersion             string
 	networkChangeListener listener.NetworkChangeListener
+	// netMgr outlives engine restarts: it mirrors the OS connectivity, not
+	// the engine lifecycle. Run and RunWithoutLogin inject its state and
+	// sweeper into each new ConnectClient.
+	netMgr *netevents.Manager
 
 	stateMu       sync.RWMutex
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
+
+	// mdmSource holds the per-Client MDM policy source and its change
+	// detector as one unit. Set by SetMDMPolicyFetcher (called from the
+	// Kotlin side). Each Run passes the loader to the resolved Config so
+	// applyMDMPolicy picks up the active overlay. Nil means "MDM
+	// enforcement off for this Client".
+	mdmSource atomic.Pointer[mdmSource]
+
+	// Identifies the running profile for the SSO login hint; see profile_state.go.
+	cfgPath string
+
+	stateChangeMu    sync.Mutex
+	stateChangeSubID string
+	// Closed to stop the watch goroutine from delivering buffered ticks to a
+	// listener that has been removed or replaced. See stopStateChangeWatchLocked.
+	stateChangeDone chan struct{}
+
+	// Latched "the server wants an interactive login": survives the engine
+	// restarts that replace the run loop's context state. See Client.Status.
+	// Guarded by loginRequiredMu together with loginCleared, which counts
+	// clears so a stale observation cannot re-latch over one.
+	loginRequiredMu sync.Mutex
+	loginRequired   bool
+	loginCleared    uint64
+
+	extendMu     sync.Mutex
+	extendCancel context.CancelFunc
 }
 
-func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cc *internal.ConnectClient) {
+func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cfgPath string, cc *internal.ConnectClient) {
 	c.stateMu.Lock()
 	defer c.stateMu.Unlock()
 	c.config = cfg
 	c.cacheDir = cacheDir
+	c.cfgPath = cfgPath
 	c.connectClient = cc
 }
 
@@ -91,6 +135,16 @@ func (c *Client) stateSnapshot() (*profilemanager.Config, string, *internal.Conn
 	return c.config, c.cacheDir, c.connectClient
 }
 
+// authSnapshot returns the config together with the path it was loaded from, in
+// one lock: the path identifies the profile whose account email backs the login
+// hint, so reading it separately could pair one profile's config with another's
+// hint when a profile switch lands in between.
+func (c *Client) authSnapshot() (*profilemanager.Config, string, *internal.ConnectClient) {
+	c.stateMu.RLock()
+	defer c.stateMu.RUnlock()
+	return c.config, c.cfgPath, c.connectClient
+}
+
 func (c *Client) getConnectClient() *internal.ConnectClient {
 	c.stateMu.RLock()
 	defer c.stateMu.RUnlock()
@@ -102,14 +156,17 @@ func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAd
 	execWorkaround(androidSDKVersion)
 
 	net.SetAndroidProtectSocketFn(tunAdapter.ProtectSocket)
+	system.SetIFaceDiscover(iFaceDiscover)
+	recorder := peer.NewRecorder("")
 	return &Client{
 		deviceName:            deviceName,
 		uiVersion:             uiVersion,
 		tunAdapter:            tunAdapter,
 		iFaceDiscover:         iFaceDiscover,
-		recorder:              peer.NewRecorder(""),
+		recorder:              recorder,
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
+		netMgr:                netevents.NewManager(recorder),
 	}
 }
 
@@ -129,6 +186,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	if err != nil {
 		return err
 	}
+	c.applyMDMOverlay(cfg)
 	c.recorder.UpdateManagementAddress(cfg.ManagementURL.String())
 	c.recorder.UpdateRosenpass(cfg.RosenpassEnabled, cfg.RosenpassPermissive)
 
@@ -143,16 +201,24 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	defer c.ctxCancel()
 	c.ctxCancelLock.Unlock()
 
-	auth := NewAuthWithConfig(ctx, cfg)
+	auth := NewAuthWithConfig(ctx, cfg, cfgFile)
 	err = auth.login(urlOpener, isAndroidTV)
 	if err != nil {
 		return err
 	}
-
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, connectClient)
+
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
+		internal.WithNetEvents(c.netMgr))
+	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	connectClient.SetSyncResponsePersistence(true)
+	// This path runs the interactive SSO flow, so reaching here means the peer
+	// is authenticated again — release the latch Status() reports from. Clear
+	// only once the fresh connect client is installed: until then Status()
+	// still reads the previous run's context state, which holds the NeedsLogin
+	// that prompted this login, and would re-latch what was just cleared.
+	c.clearLoginRequired()
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
 
@@ -173,6 +239,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	if err != nil {
 		return err
 	}
+	c.applyMDMOverlay(cfg)
 	c.recorder.UpdateManagementAddress(cfg.ManagementURL.String())
 	c.recorder.UpdateRosenpass(cfg.RosenpassEnabled, cfg.RosenpassPermissive)
 
@@ -186,8 +253,10 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, connectClient)
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
+		internal.WithNetEvents(c.netMgr))
+	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	connectClient.SetSyncResponsePersistence(true)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
 
@@ -216,9 +285,62 @@ func (c *Client) RenewTun(fd int) error {
 	return e.RenewTun(fd)
 }
 
+func (c *Client) GetTunSettings() (*TunSettings, error) {
+	cc := c.getConnectClient()
+	if cc == nil {
+		return nil, fmt.Errorf("engine not running")
+	}
+
+	e := cc.Engine()
+	if e == nil {
+		return nil, fmt.Errorf("engine not initialized")
+	}
+
+	routes, searchDomains := e.TunSettings()
+	return &TunSettings{
+		Routes:        strings.Join(routes, ";"),
+		SearchDomains: strings.Join(searchDomains, ";"),
+	}, nil
+}
+
+// SetNetworkAvailable feeds OS-reported network availability into the client.
+// While unavailable, the internal reconnect loops suspend their attempts and
+// the connection listener reports NoNetwork instead of Connecting; when
+// availability returns, the loops resume immediately with a fresh backoff.
+// Losing the last network also sweeps the registered connections: nothing can
+// redial while offline, so the stale sockets would otherwise stay silently
+// "connected" until their own timeouts and the client would keep reporting
+// Connected with no network at all.
+func (c *Client) SetNetworkAvailable(available bool) {
+	c.netMgr.SetNetworkAvailable(available)
+}
+
+// NotifyNetworkChange marks the management, signal and relay connections
+// stale after the OS switched networks and schedules a sweep that cuts
+// whatever has not redialed on the new network by then. The engine and the
+// TUN device stay untouched.
+func (c *Client) NotifyNetworkChange() {
+	c.netMgr.NotifyNetworkChange()
+}
+
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
-// It works both with and without a running engine.
-func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (string, error) {
+// It works both with and without a running engine. anonymizeLevel is "default"
+// or "strict"; strict also anonymizes internal IP ranges, peer names, and
+// WireGuard public keys, and implies anonymize.
+func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonymizeLevel string) (string, error) {
+	return c.debugBundle(platformFiles, anonymize, anonymizeLevel, true)
+}
+
+// DebugBundleFile generates a debug bundle and returns the path of the zip in
+// the cache directory instead of uploading it, so the app can hand the file to
+// the user for inspection. The caller owns the file and removes it once done;
+// the stale-bundle cleanup of later runs removes it only after a day.
+// anonymize and anonymizeLevel behave as in DebugBundle.
+func (c *Client) DebugBundleFile(platformFiles PlatformFiles, anonymize bool, anonymizeLevel string) (string, error) {
+	return c.debugBundle(platformFiles, anonymize, anonymizeLevel, false)
+}
+
+func (c *Client) debugBundle(platformFiles PlatformFiles, anonymize bool, anonymizeLevel string, upload bool) (string, error) {
 	cfg, cacheDir, cc := c.stateSnapshot()
 
 	// If the engine hasn't been started, load config from disk
@@ -230,13 +352,20 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 		if err != nil {
 			return "", fmt.Errorf("load config: %w", err)
 		}
+		c.applyMDMOverlay(cfg)
 		cacheDir = platformFiles.CacheDir()
 	}
 
+	// Clear what an interrupted earlier run may have left in the cache before
+	// adding to it. Remote debug jobs write to the same directory, so anything
+	// younger than an hour is treated as possibly still in use.
+	debug.RemoveStaleBundles(cacheDir, time.Hour)
+
 	deps := debug.GeneratorDependencies{
 		InternalConfig: cfg,
 		StatusRecorder: c.recorder,
 		TempDir:        cacheDir,
+		StatePath:      platformFiles.StateFilePath(),
 	}
 
 	if cc != nil {
@@ -247,6 +376,9 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
+			deps.RefreshStatus = func() {
+				e.RunHealthProbes(context.Background(), true)
+			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}
@@ -257,6 +389,7 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 		deps,
 		debug.BundleConfig{
 			Anonymize:         anonymize,
+			AnonymizeLevel:    nbAnonymize.ParseLevel(anonymizeLevel),
 			IncludeSystemInfo: true,
 		},
 	)
@@ -265,6 +398,9 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 	if err != nil {
 		return "", fmt.Errorf("generate debug bundle: %w", err)
 	}
+	if !upload {
+		return debug.ExportBundle(path)
+	}
 	defer func() {
 		if err := os.Remove(path); err != nil {
 			log.Errorf("failed to remove debug bundle file: %v", err)
@@ -274,7 +410,7 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 	uploadCtx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 	defer cancel()
 
-	key, err := debug.UploadDebugBundle(uploadCtx, types.DefaultBundleURL, cfg.ManagementURL.String(), path)
+	key, err := debug.UploadDebugBundle(uploadCtx, types.DefaultBundleURL, cfg.ManagementURL.String(), path, false)
 	if err != nil {
 		return "", fmt.Errorf("upload debug bundle: %w", err)
 	}
@@ -296,6 +432,13 @@ func (c *Client) SetInfoLogLevel() {
 // PeersList return with the list of the PeerInfos
 func (c *Client) PeersList() *PeerInfoArray {
 
+	// The recorder only caches transfer counters and handshake times; nothing
+	// refreshes them on its own, so without this they read as zero. The desktop
+	// daemon does the same before serving a full peer status.
+	if err := c.recorder.RefreshWireGuardStats(); err != nil {
+		log.Debugf("failed to refresh WireGuard stats: %v", err)
+	}
+
 	fullStatus := c.recorder.GetFullStatus()
 
 	peerInfos := make([]PeerInfo, len(fullStatus.Peers))
@@ -306,6 +449,20 @@ func (c *Client) PeersList() *PeerInfoArray {
 			FQDN:       p.FQDN,
 			ConnStatus: int(p.ConnStatus),
 			Routes:     PeerRoutes{routes: maps.Keys(p.GetRoutes())},
+
+			PubKey:                     p.PubKey,
+			Latency:                    formatDuration(p.Latency),
+			LatencyMs:                  p.Latency.Milliseconds(),
+			BytesRx:                    p.BytesRx,
+			BytesTx:                    p.BytesTx,
+			ConnStatusUpdate:           formatTime(p.ConnStatusUpdate),
+			Relayed:                    p.Relayed,
+			RosenpassEnabled:           p.RosenpassEnabled,
+			LastWireguardHandshake:     formatTime(p.LastWireguardHandshake),
+			LocalIceCandidateType:      p.LocalIceCandidateType,
+			RemoteIceCandidateType:     p.RemoteIceCandidateType,
+			LocalIceCandidateEndpoint:  p.LocalIceCandidateEndpoint,
+			RemoteIceCandidateEndpoint: p.RemoteIceCandidateEndpoint,
 		}
 		peerInfos[n] = pi
 	}
@@ -340,6 +497,7 @@ func (c *Client) Networks() *NetworkArray {
 	routesMap := routeManager.GetClientRoutesWithNetID()
 	v6Merged := route.V6ExitMergeSet(routesMap)
 	resolvedDomains := c.recorder.GetResolvedDomainsStates()
+	activeRoutePeers := c.recorder.GetActiveRoutePeers()
 
 	networkArray := &NetworkArray{
 		items: make([]Network, 0),
@@ -353,7 +511,7 @@ func (c *Client) Networks() *NetworkArray {
 			continue
 		}
 
-		network := c.buildNetwork(id, routes, routeSelector.IsSelected(id), resolvedDomains, v6Merged)
+		network := c.buildNetwork(id, routes, routeSelector.IsSelected(id), resolvedDomains, v6Merged, activeRoutePeers)
 		if network == nil {
 			continue
 		}
@@ -362,14 +520,14 @@ func (c *Client) Networks() *NetworkArray {
 	return networkArray
 }
 
-func (c *Client) buildNetwork(id route.NetID, routes []*route.Route, selected bool, resolvedDomains map[domain.Domain]peer.ResolvedDomainInfo, v6Merged map[route.NetID]struct{}) *Network {
+func (c *Client) buildNetwork(id route.NetID, routes []*route.Route, selected bool, resolvedDomains map[domain.Domain]peer.ResolvedDomainInfo, v6Merged map[route.NetID]struct{}, activeRoutePeers map[route.HAUniqueID]string) *Network {
 	r := routes[0]
 	netStr := r.Network.String()
 	if r.IsDynamic() {
 		netStr = r.Domains.SafeString()
 	}
 
-	routePeer, err := c.findBestRoutePeer(routes)
+	routePeer, err := c.findBestRoutePeer(routes, activeRoutePeers)
 	if err != nil {
 		log.Errorf("could not get peer info for route %s: %v", id, err)
 		return nil
@@ -393,12 +551,9 @@ func (c *Client) buildNetwork(id route.NetID, routes []*route.Route, selected bo
 
 // findBestRoutePeer returns the peer actively routing traffic for the given
 // HA route group. Falls back to the first connected peer, then the first peer.
-func (c *Client) findBestRoutePeer(routes []*route.Route) (peer.State, error) {
-	netStr := routes[0].Network.String()
-
-	fullStatus := c.recorder.GetFullStatus()
-	for _, p := range fullStatus.Peers {
-		if _, ok := p.GetRoutes()[netStr]; ok {
+func (c *Client) findBestRoutePeer(routes []*route.Route, activeRoutePeers map[route.HAUniqueID]string) (peer.State, error) {
+	if peerKey, ok := activeRoutePeers[routes[0].GetHAUniqueID()]; ok {
+		if p, err := c.recorder.GetPeer(peerKey); err == nil {
 			return p, nil
 		}
 	}
@@ -428,7 +583,11 @@ func (c *Client) OnUpdatedHostDNS(list *DNSList) error {
 
 // SetConnectionListener set the network connection listener
 func (c *Client) SetConnectionListener(listener ConnectionListener) {
-	c.recorder.SetConnectionListener(listener)
+	if listener == nil {
+		c.recorder.RemoveConnectionListener()
+		return
+	}
+	c.recorder.SetConnectionListener(connectionListenerAdapter{listener})
 }
 
 // RemoveConnectionListener remove connection listener
@@ -436,10 +595,6 @@ func (c *Client) RemoveConnectionListener() {
 	c.recorder.RemoveConnectionListener()
 }
 
-func (c *Client) toggleRoute(command routeCommand) error {
-	return command.toggleRoute()
-}
-
 func (c *Client) getRouteManager() (routemanager.Manager, error) {
 	client := c.getConnectClient()
 	if client == nil {
@@ -459,22 +614,22 @@ func (c *Client) getRouteManager() (routemanager.Manager, error) {
 	return manager, nil
 }
 
-func (c *Client) SelectRoute(route string) error {
+func (c *Client) SelectRoute(id string) error {
 	manager, err := c.getRouteManager()
 	if err != nil {
 		return err
 	}
 
-	return c.toggleRoute(selectRouteCommand{route: route, manager: manager})
+	return manager.SelectRoutes([]route.NetID{route.NetID(id)}, true)
 }
 
-func (c *Client) DeselectRoute(route string) error {
+func (c *Client) DeselectRoute(id string) error {
 	manager, err := c.getRouteManager()
 	if err != nil {
 		return err
 	}
 
-	return c.toggleRoute(deselectRouteCommand{route: route, manager: manager})
+	return manager.DeselectRoutes([]route.NetID{route.NetID(id)})
 }
 
 // getNetworkDomainsFromRoute extracts domains from a route and enriches each domain
@@ -509,3 +664,28 @@ func exportEnvList(list *EnvList) {
 		}
 	}
 }
+
+// formatDuration renders a duration for display, trimming the fractional part
+// to two digits so latencies read as "12.34ms" rather than "12.345678ms".
+func formatDuration(d time.Duration) string {
+	ds := d.String()
+	dotIndex := strings.Index(ds, ".")
+	if dotIndex == -1 {
+		return ds
+	}
+
+	endIndex := min(dotIndex+3, len(ds))
+
+	// Skip the remaining digits so only the unit suffix is appended back.
+	unitStart := endIndex
+	for unitStart < len(ds) && ds[unitStart] >= '0' && ds[unitStart] <= '9' {
+		unitStart++
+	}
+	return ds[:endIndex] + ds[unitStart:]
+}
+
+// formatTime renders a timestamp in UTC using a fixed layout. The zero time is
+// passed through as-is so the UI can recognise it and show "never" instead.
+func formatTime(t time.Time) string {
+	return t.UTC().Format("2006-01-02 15:04:05")
+}
diff --git a/client/android/client_mdm.go b/client/android/client_mdm.go
new file mode 100644
index 000000000..d043b85d3
--- /dev/null
+++ b/client/android/client_mdm.go
@@ -0,0 +1,52 @@
+//go:build android
+
+package android
+
+import (
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+type mdmSource struct {
+	loader   *mdm.Loader
+	detector *mdm.ChangeDetector
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this Client; passing nil disables MDM enforcement.
+func (c *Client) SetMDMPolicyFetcher(p PolicyFetcher) {
+	loader := loaderFor(p)
+	c.mdmSource.Store(&mdmSource{loader: loader, detector: mdm.NewChangeDetector(loader)})
+}
+
+// HasMDMPolicyChanged re-reads the managed configuration and reports whether
+// it changed since the last observation; call it from the native OS-change
+// notification and restart the engine only on true.
+func (c *Client) HasMDMPolicyChanged() bool {
+	src := c.mdmSource.Load()
+	if src == nil {
+		return false
+	}
+	return src.detector.Changed()
+}
+
+// GetRestrictionsJSON returns the UI enforcement snapshot derived from the
+// active MDM policy, in the JSON shape shared with the desktop frontend.
+func (c *Client) GetRestrictionsJSON() (string, error) {
+	return mdm.BuildRestrictions(c.mdmLoader().Load()).JSON()
+}
+
+func (c *Client) applyMDMOverlay(cfg *profilemanager.Config) {
+	loader := c.mdmLoader()
+	if cfg == nil || loader == nil {
+		return
+	}
+	cfg.ApplyMDMPolicy(loader.Load())
+}
+
+func (c *Client) mdmLoader() *mdm.Loader {
+	if src := c.mdmSource.Load(); src != nil {
+		return src.loader
+	}
+	return nil
+}
diff --git a/client/android/connection_listener.go b/client/android/connection_listener.go
new file mode 100644
index 000000000..77c47574b
--- /dev/null
+++ b/client/android/connection_listener.go
@@ -0,0 +1,41 @@
+//go:build android
+
+package android
+
+import (
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// Client state values delivered via ConnectionListener.OnStateChanged,
+// re-exported as basic constants so gomobile emits them into the generated
+// Java bindings. They mirror peer.ClientState*: append-only, never reorder.
+const (
+	ClientStateDisconnected  = int(peer.ClientStateDisconnected)
+	ClientStateConnected     = int(peer.ClientStateConnected)
+	ClientStateConnecting    = int(peer.ClientStateConnecting)
+	ClientStateDisconnecting = int(peer.ClientStateDisconnecting)
+	ClientStateNoNetwork     = int(peer.ClientStateNoNetwork)
+)
+
+// ConnectionListener export internal Listener for mobile. It mirrors
+// peer.Listener with OnStateChanged taking a plain int (one of the
+// ClientState* constants), because gomobile cannot bind named types.
+type ConnectionListener interface {
+	OnStateChanged(state int)
+	OnConnected()
+	OnDisconnected()
+	OnConnecting()
+	OnDisconnecting()
+	OnAddressChanged(string, string)
+	OnPeersListChanged(int)
+}
+
+// connectionListenerAdapter adapts the gomobile-facing ConnectionListener to
+// peer.Listener, converting the typed state to the int the binding carries.
+type connectionListenerAdapter struct {
+	ConnectionListener
+}
+
+func (a connectionListenerAdapter) OnStateChanged(state peer.ClientState) {
+	a.ConnectionListener.OnStateChanged(int(state))
+}
diff --git a/client/android/login.go b/client/android/login.go
index a9422cdbf..b9ec21b39 100644
--- a/client/android/login.go
+++ b/client/android/login.go
@@ -4,8 +4,12 @@ import (
 	"context"
 	"fmt"
 
+	log "github.com/sirupsen/logrus"
+
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/mobile"
 	"github.com/netbirdio/netbird/client/system"
 )
 
@@ -36,15 +40,31 @@ type Auth struct {
 }
 
 // NewAuth instantiate Auth struct and validate the management URL
-func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
-	inputCfg := profilemanager.ConfigInput{
-		ManagementURL: mgmURL,
+//
+// The configuration at cfgPath is reused when one is already there, and only created when it is
+// not. Building a fresh in-memory config unconditionally gives the client a new WireGuard key on
+// every call: the peer registers under that key, the key is written out, and any peer registered by
+// an earlier call is orphaned on the server. It also breaks a client that enrols and then runs from
+// the persisted config, because the identity it registered is not the one it runs with — the
+// management stream rejects it with "no peer auth method provided".
+//
+// Auth is constructed under the active MDM policy: the policy is overlaid on
+// the resolved config so the login runs against the enforced values, while
+// the persisted config keeps the caller-supplied ones; a caller-supplied
+// management URL is ignored while MDM manages that key. A nil fetcher
+// disables MDM enforcement.
+func NewAuth(cfgPath string, mgmURL string, fetcher PolicyFetcher) (*Auth, error) {
+	policy := loaderFor(fetcher).Load()
+	inputCfg := profilemanager.ConfigInput{ConfigPath: cfgPath}
+	if _, managed := policy.GetString(mdm.KeyManagementURL); !managed {
+		inputCfg.ManagementURL = mgmURL
 	}
 
-	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
+	cfg, err := profilemanager.UpdateOrCreateConfig(inputCfg)
 	if err != nil {
 		return nil, err
 	}
+	cfg.ApplyMDMPolicy(policy)
 
 	return &Auth{
 		ctx:     context.Background(),
@@ -53,17 +73,18 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	}, nil
 }
 
-// NewAuthWithConfig instantiate Auth based on existing config
-func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config) *Auth {
+// NewAuthWithConfig instantiate Auth based on existing config. cfgPath is the
+// file the config was loaded from; it identifies the profile whose account email
+// backs the login_hint.
+func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config, cfgPath string) *Auth {
 	return &Auth{
-		ctx:    ctx,
-		config: config,
+		ctx:     ctx,
+		config:  config,
+		cfgPath: cfgPath,
 	}
 }
 
-// SaveConfigIfSSOSupported test the connectivity with the management server by retrieving the server device flow info.
-// If it returns a flow info than save the configuration and return true. If it gets a codes.NotFound, it means that SSO
-// is not supported and returns false without saving the configuration. For other errors return false.
+// SaveConfigIfSSOSupported reports whether the management server supports SSO; the config is already persisted by NewAuth.
 func (a *Auth) SaveConfigIfSSOSupported(listener SSOListener) {
 	go func() {
 		sso, err := a.saveConfigIfSSOSupported()
@@ -87,15 +108,10 @@ func (a *Auth) saveConfigIfSSOSupported() (bool, error) {
 		return false, fmt.Errorf("failed to check SSO support: %v", err)
 	}
 
-	if !supportsSSO {
-		return false, nil
-	}
-
-	err = profilemanager.WriteOutConfig(a.cfgPath, a.config)
-	return true, err
+	return supportsSSO, nil
 }
 
-// LoginWithSetupKeyAndSaveConfig test the connectivity with the management server with the setup key.
+// LoginWithSetupKeyAndSaveConfig registers the peer with the setup key; the config is already persisted by NewAuth.
 func (a *Auth) LoginWithSetupKeyAndSaveConfig(resultListener ErrListener, setupKey string, deviceName string) {
 	go func() {
 		err := a.loginWithSetupKeyAndSaveConfig(setupKey, deviceName)
@@ -120,8 +136,7 @@ func (a *Auth) loginWithSetupKeyAndSaveConfig(setupKey string, deviceName string
 	if err != nil {
 		return fmt.Errorf("login failed: %v", err)
 	}
-
-	return profilemanager.WriteOutConfig(a.cfgPath, a.config)
+	return nil
 }
 
 // Login try register the client on the server
@@ -150,12 +165,14 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	}
 
 	jwtToken := ""
+	email := ""
 	if needsLogin {
 		tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 		if err != nil {
 			return fmt.Errorf("interactive sso login failed: %v", err)
 		}
 		jwtToken = tokenInfo.GetTokenToUse()
+		email = tokenInfo.Email
 	}
 
 	err, _ = authClient.Login(a.ctx, "", jwtToken)
@@ -163,27 +180,99 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 		return fmt.Errorf("login failed: %v", err)
 	}
 
+	// Stored after Login, not before: a rejected token must not leave a hint
+	// pointing at an account that cannot be used.
+	if email != "" && a.cfgPath != "" {
+		if err := mobile.WriteProfileEmail(a.cfgPath, email); err != nil {
+			log.Warnf("failed to store profile account email: %v", err)
+		}
+	}
+
 	go urlOpener.OnLoginSuccess()
 
 	return nil
 }
 
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV)
+	return a.foregroundGetTokenInfoFlow(authClient, urlOpener, isAndroidTV, false)
+}
+
+// foregroundGetTokenInfoFlow runs the interactive flow. sessionExtend tells the
+// server the token will renew this peer's session rather than log a peer in, so
+// it can rule out a silent authorization the IdP could answer from an unrelated
+// account. See PKCEAuthorizationFlowRequest.
+func (a *Auth) foregroundGetTokenInfoFlow(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool, sessionExtend bool) (*auth.TokenInfo, error) {
+	hint := profileLoginHint(a.cfgPath)
+
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV, sessionExtend, hint)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
+	tokenInfo, err := runOAuthFlow(a.ctx, oAuthFlow, urlOpener, nil)
 	if err != nil {
-		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)
+		return nil, err
 	}
 
-	go urlOpener.Open(flowInfo.VerificationURIComplete, flowInfo.UserCode)
+	if tokenInfo.MatchesAccount(hint) {
+		return tokenInfo, nil
+	}
 
-	tokenInfo, err := oAuthFlow.WaitToken(a.ctx, flowInfo)
+	// The IdP answered from a session belonging to another account. Retrying is
+	// what makes this recoverable: on a peer already registered the server would
+	// reject the token, and on a fresh one it would silently register the peer
+	// under the wrong account and bind the profile to it.
+	log.Infof("login returned an account other than the one this profile is bound to, retrying with an account prompt")
+	retryFlow := auth.RetryFlowForAccount(oAuthFlow)
+	if retryFlow == nil {
+		return tokenInfo, nil
+	}
+
+	retryToken, err := runOAuthFlow(a.ctx, retryFlow, urlOpener, nil)
 	if err != nil {
-		return nil, fmt.Errorf("waiting for browser login failed: %v", err)
+		return nil, err
+	}
+	if !retryToken.MatchesAccount(hint) {
+		log.Warnf("login still returned a different account after the prompt, continuing with it")
+	}
+
+	return retryToken, nil
+}
+
+// profileLoginHint returns the stored account email for the profile at cfgPath.
+// An empty hint is deliberate, not a fallback: a fresh profile leaves the
+// choice to the IdP. Switching accounts is done by switching or removing
+// profiles, not by logging out — logout keeps the email.
+func profileLoginHint(cfgPath string) string {
+	if cfgPath == "" {
+		return ""
+	}
+	return mobile.ReadProfileEmail(cfgPath)
+}
+
+// runOAuthFlow drives an already acquired OAuth flow to a token: requests the
+// flow info, presents the verification URL through the opener and waits for
+// the browser round-trip. Open is called synchronously — it is what marks the
+// surface as opened on the client side, and a fast token's OnLoginSuccess is
+// a no-op until it has, so the dismissal would be dropped rather than
+// delayed. Openers must therefore not block: they post their UI work and
+// return. onWaiting, when set, runs after the URL is shown, right before the
+// blocking wait.
+func runOAuthFlow(ctx context.Context, flow auth.OAuthFlow, urlOpener URLOpener, onWaiting func()) (*auth.TokenInfo, error) {
+	flowInfo, err := flow.RequestAuthInfo(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("request auth info: %w", err)
+	}
+
+	urlOpener.Open(flowInfo.VerificationURIComplete, flowInfo.UserCode)
+
+	if onWaiting != nil {
+		onWaiting()
+	}
+
+	tokenInfo, err := flow.WaitToken(ctx, flowInfo)
+	if err != nil {
+		return nil, fmt.Errorf("wait for token: %w", err)
 	}
 
 	return &tokenInfo, nil
diff --git a/client/android/login_test.go b/client/android/login_test.go
new file mode 100644
index 000000000..130a846fc
--- /dev/null
+++ b/client/android/login_test.go
@@ -0,0 +1,51 @@
+package android
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+// NewAuth must reuse the configuration already at cfgPath rather than building a fresh one.
+//
+// Creating a new in-memory config on every call gives the client a new WireGuard private key each
+// time. The peer registers under that key and the key is written out, so a peer registered by an
+// earlier call is orphaned on the server — a client that enrols twice leaves two entries and owns
+// neither. It also breaks enrol-then-run: RunWithoutLogin reloads the configuration from disk, so
+// the identity that registered is not the identity that runs, and the management stream rejects it
+// with "no peer auth method provided, please use a setup key or interactive SSO login".
+func TestNewAuth_ReusesPersistedIdentity(t *testing.T) {
+	cfgPath := filepath.Join(t.TempDir(), "config.json")
+
+	first, err := NewAuth(cfgPath, "https://api.example.com:443", nil)
+	if err != nil {
+		t.Fatalf("first NewAuth: %v", err)
+	}
+	if first.config.PrivateKey == "" {
+		t.Fatal("first NewAuth produced no private key")
+	}
+
+	second, err := NewAuth(cfgPath, "https://api.example.com:443", nil)
+	if err != nil {
+		t.Fatalf("second NewAuth: %v", err)
+	}
+
+	if second.config.PrivateKey != first.config.PrivateKey {
+		t.Errorf("private key changed between calls: a second enrolment would orphan the peer registered by the first")
+	}
+}
+
+// A missing configuration is still created, so a first enrolment works unchanged.
+func TestNewAuth_CreatesConfigWhenAbsent(t *testing.T) {
+	cfgPath := filepath.Join(t.TempDir(), "config.json")
+
+	auth, err := NewAuth(cfgPath, "https://api.example.com:443", nil)
+	if err != nil {
+		t.Fatalf("NewAuth: %v", err)
+	}
+	if auth.config == nil || auth.config.PrivateKey == "" {
+		t.Fatal("NewAuth did not create a usable configuration")
+	}
+	if auth.cfgPath != cfgPath {
+		t.Errorf("cfgPath = %q, want %q", auth.cfgPath, cfgPath)
+	}
+}
diff --git a/client/android/mdm.go b/client/android/mdm.go
new file mode 100644
index 000000000..617d8f7cb
--- /dev/null
+++ b/client/android/mdm.go
@@ -0,0 +1,19 @@
+package android
+
+import (
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+// PolicyFetcher is implemented by the native layer to return the current
+// managed configuration as a JSON-encoded object string; "" means no MDM
+// source is present.
+type PolicyFetcher interface {
+	FetchJSON() string
+}
+
+func loaderFor(p PolicyFetcher) *mdm.Loader {
+	if p == nil {
+		return mdm.NewJSONLoader(nil)
+	}
+	return mdm.NewJSONLoader(p.FetchJSON)
+}
diff --git a/client/android/peer_notifier.go b/client/android/peer_notifier.go
index c2595e574..f525055bb 100644
--- a/client/android/peer_notifier.go
+++ b/client/android/peer_notifier.go
@@ -12,12 +12,30 @@ const (
 )
 
 // PeerInfo describe information about the peers. It designed for the UI usage
+//
+// The fields below ConnStatus back the peer detail screen. Durations and times
+// are pre-formatted into strings so the UI does not have to know Go's layouts;
+// Latency is additionally exposed as LatencyMs for colour coding.
 type PeerInfo struct {
 	IP         string
 	IPv6       string
 	FQDN       string
 	ConnStatus int
 	Routes     PeerRoutes
+
+	PubKey                     string
+	Latency                    string
+	LatencyMs                  int64
+	BytesRx                    int64
+	BytesTx                    int64
+	ConnStatusUpdate           string
+	Relayed                    bool
+	RosenpassEnabled           bool
+	LastWireguardHandshake     string
+	LocalIceCandidateType      string
+	RemoteIceCandidateType     string
+	LocalIceCandidateEndpoint  string
+	RemoteIceCandidateEndpoint string
 }
 
 func (p *PeerInfo) GetPeerRoutes() *PeerRoutes {
diff --git a/client/android/preferences.go b/client/android/preferences.go
index 066477293..3623de23f 100644
--- a/client/android/preferences.go
+++ b/client/android/preferences.go
@@ -1,12 +1,16 @@
 package android
 
 import (
+	"sync/atomic"
+
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 )
 
 // Preferences exports a subset of the internal config for gomobile
 type Preferences struct {
 	configInput profilemanager.ConfigInput
+	mdmLoader   atomic.Pointer[mdm.Loader]
 }
 
 // NewPreferences creates a new Preferences instance
@@ -14,20 +18,39 @@ func NewPreferences(configPath string) *Preferences {
 	ci := profilemanager.ConfigInput{
 		ConfigPath: configPath,
 	}
-	return &Preferences{ci}
+	return &Preferences{configInput: ci}
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this Preferences instance; passing nil disables MDM enforcement.
+func (p *Preferences) SetMDMPolicyFetcher(f PolicyFetcher) {
+	p.mdmLoader.Store(loaderFor(f))
+}
+
+// GetRestrictionsJSON returns the UI enforcement snapshot derived from the
+// active MDM policy, in the JSON shape shared with the desktop frontend.
+func (p *Preferences) GetRestrictionsJSON() (string, error) {
+	return mdm.BuildRestrictions(p.policy()).JSON()
+}
+
+func (p *Preferences) policy() *mdm.Policy {
+	return p.mdmLoader.Load().Load()
 }
 
 // GetManagementURL reads URL from config file
 func (p *Preferences) GetManagementURL() (string, error) {
+	if v, ok := p.policy().GetString(mdm.KeyManagementURL); ok {
+		return mdm.CanonicalURL(v), nil
+	}
 	if p.configInput.ManagementURL != "" {
 		return p.configInput.ManagementURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
-	return cfg.ManagementURL.String(), err
+	return cfg.ManagementURL.String(), nil
 }
 
 // SetManagementURL stores the given URL and waits for commit
@@ -41,7 +64,7 @@ func (p *Preferences) GetAdminURL() (string, error) {
 		return p.configInput.AdminURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -53,17 +76,21 @@ func (p *Preferences) SetAdminURL(url string) {
 	p.configInput.AdminURL = url
 }
 
-// GetPreSharedKey reads pre-shared key from config file
-func (p *Preferences) GetPreSharedKey() (string, error) {
+// HasPreSharedKey reports whether a pre-shared key is staged, persisted, or
+// enforced by MDM; the key itself is never handed to the native layer.
+func (p *Preferences) HasPreSharedKey() (bool, error) {
+	if _, ok := p.policy().GetString(mdm.KeyPreSharedKey); ok {
+		return true, nil
+	}
 	if p.configInput.PreSharedKey != nil {
-		return *p.configInput.PreSharedKey, nil
+		return *p.configInput.PreSharedKey != "", nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
-		return "", err
+		return false, err
 	}
-	return cfg.PreSharedKey, err
+	return cfg.PreSharedKey != "", nil
 }
 
 // SetPreSharedKey stores the given key and waits for commit
@@ -78,11 +105,14 @@ func (p *Preferences) SetRosenpassEnabled(enabled bool) {
 
 // GetRosenpassEnabled reads Rosenpass enabled status from config file
 func (p *Preferences) GetRosenpassEnabled() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyRosenpassEnabled); ok {
+		return v, nil
+	}
 	if p.configInput.RosenpassEnabled != nil {
 		return *p.configInput.RosenpassEnabled, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -96,11 +126,14 @@ func (p *Preferences) SetRosenpassPermissive(permissive bool) {
 
 // GetRosenpassPermissive reads Rosenpass permissive setting from config file
 func (p *Preferences) GetRosenpassPermissive() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyRosenpassPermissive); ok {
+		return v, nil
+	}
 	if p.configInput.RosenpassPermissive != nil {
 		return *p.configInput.RosenpassPermissive, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -109,11 +142,14 @@ func (p *Preferences) GetRosenpassPermissive() (bool, error) {
 
 // GetDisableClientRoutes reads disable client routes setting from config file
 func (p *Preferences) GetDisableClientRoutes() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyDisableClientRoutes); ok {
+		return v, nil
+	}
 	if p.configInput.DisableClientRoutes != nil {
 		return *p.configInput.DisableClientRoutes, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -127,11 +163,14 @@ func (p *Preferences) SetDisableClientRoutes(disable bool) {
 
 // GetDisableServerRoutes reads disable server routes setting from config file
 func (p *Preferences) GetDisableServerRoutes() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyDisableServerRoutes); ok {
+		return v, nil
+	}
 	if p.configInput.DisableServerRoutes != nil {
 		return *p.configInput.DisableServerRoutes, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -149,7 +188,7 @@ func (p *Preferences) GetDisableDNS() (bool, error) {
 		return *p.configInput.DisableDNS, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -167,7 +206,7 @@ func (p *Preferences) GetDisableFirewall() (bool, error) {
 		return *p.configInput.DisableFirewall, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -181,11 +220,14 @@ func (p *Preferences) SetDisableFirewall(disable bool) {
 
 // GetServerSSHAllowed reads server SSH allowed setting from config file
 func (p *Preferences) GetServerSSHAllowed() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyAllowServerSSH); ok {
+		return v, nil
+	}
 	if p.configInput.ServerSSHAllowed != nil {
 		return *p.configInput.ServerSSHAllowed, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -207,7 +249,7 @@ func (p *Preferences) GetEnableSSHRoot() (bool, error) {
 		return *p.configInput.EnableSSHRoot, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -229,7 +271,7 @@ func (p *Preferences) GetEnableSSHSFTP() (bool, error) {
 		return *p.configInput.EnableSSHSFTP, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -251,7 +293,7 @@ func (p *Preferences) GetEnableSSHLocalPortForwarding() (bool, error) {
 		return *p.configInput.EnableSSHLocalPortForwarding, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -273,7 +315,7 @@ func (p *Preferences) GetEnableSSHRemotePortForwarding() (bool, error) {
 		return *p.configInput.EnableSSHRemotePortForwarding, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -291,11 +333,14 @@ func (p *Preferences) SetEnableSSHRemotePortForwarding(enabled bool) {
 
 // GetBlockInbound reads block inbound setting from config file
 func (p *Preferences) GetBlockInbound() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyBlockInbound); ok {
+		return v, nil
+	}
 	if p.configInput.BlockInbound != nil {
 		return *p.configInput.BlockInbound, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -313,7 +358,7 @@ func (p *Preferences) GetDisableIPv6() (bool, error) {
 		return *p.configInput.DisableIPv6, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -325,8 +370,34 @@ func (p *Preferences) SetDisableIPv6(disable bool) {
 	p.configInput.DisableIPv6 = &disable
 }
 
+// GetRemoteJobsAllowed reads the remote jobs opt-in from config file
+func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
+	policy := p.policy()
+	if !policy.HasKey(mdm.KeyRemoteJobsAllowed) && p.configInput.RemoteJobsAllowed != nil {
+		return *p.configInput.RemoteJobsAllowed, nil
+	}
+
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
+	if err != nil {
+		return false, err
+	}
+	cfg.ApplyMDMPolicy(policy)
+	if cfg.RemoteJobsAllowed == nil {
+		return false, nil
+	}
+	return *cfg.RemoteJobsAllowed, nil
+}
+
+// SetRemoteJobsAllowed stores the given value and waits for commit
+func (p *Preferences) SetRemoteJobsAllowed(allowed bool) {
+	p.configInput.RemoteJobsAllowed = &allowed
+}
+
 // Commit writes out the changes to the config file
 func (p *Preferences) Commit() error {
+	if err := profilemanager.CheckMDMConflicts(p.configInput, p.policy()); err != nil {
+		return err
+	}
 	_, err := profilemanager.UpdateOrCreateConfig(p.configInput)
 	return err
 }
diff --git a/client/android/preferences_test.go b/client/android/preferences_test.go
index 2bbccef86..d9f5b1918 100644
--- a/client/android/preferences_test.go
+++ b/client/android/preferences_test.go
@@ -28,14 +28,13 @@ func TestPreferences_DefaultValues(t *testing.T) {
 		t.Errorf("invalid default management url: %s", defaultVar)
 	}
 
-	var preSharedKey string
-	preSharedKey, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read default preshared key: %s", err)
+		t.Fatalf("failed to read default preshared key presence: %s", err)
 	}
 
-	if preSharedKey != "" {
-		t.Errorf("invalid preshared key: %s", preSharedKey)
+	if hasPSK {
+		t.Errorf("unexpected preshared key presence on fresh config")
 	}
 }
 
@@ -65,13 +64,13 @@ func TestPreferences_ReadUncommitedValues(t *testing.T) {
 	}
 
 	p.SetPreSharedKey(exampleString)
-	resp, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read preshared key: %s", err)
+		t.Fatalf("failed to read preshared key presence: %s", err)
 	}
 
-	if resp != exampleString {
-		t.Errorf("unexpected preshared key: %s", resp)
+	if !hasPSK {
+		t.Errorf("expected preshared key presence after staging one")
 	}
 }
 
@@ -109,12 +108,12 @@ func TestPreferences_Commit(t *testing.T) {
 		t.Errorf("unexpected management url: %s", resp)
 	}
 
-	resp, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read preshared key: %s", err)
+		t.Fatalf("failed to read preshared key presence: %s", err)
 	}
 
-	if resp != examplePresharedKey {
-		t.Errorf("unexpected preshared key: %s", resp)
+	if !hasPSK {
+		t.Errorf("expected preshared key presence after commit")
 	}
 }
diff --git a/client/android/profile_manager.go b/client/android/profile_manager.go
index 87c001396..4bc60c453 100644
--- a/client/android/profile_manager.go
+++ b/client/android/profile_manager.go
@@ -3,42 +3,37 @@
 package android
 
 import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mobile"
 )
 
 const (
-	// Android-specific config filename (different from desktop default.json)
-	defaultConfigFilename = "netbird.cfg"
-	// Subdirectory for non-default profiles (must match Java Preferences.java)
-	profilesSubdir = "profiles"
-	// Android uses a single user context per app (non-empty username required by ServiceManager)
+	// Android uses a single user context per app.
 	androidUsername = "android"
 )
 
-// Profile represents a profile for gomobile
+// Profile represents a profile for gomobile.
 type Profile struct {
-	ID       string
-	Name     string
+	ID   string
+	Name string
+	// Email is the account this profile last logged in with, "" if it never
+	// completed an SSO login. Kept across logouts; cleared when the profile is
+	// removed. See client/mobile/profile_state.go.
+	Email    string
 	IsActive bool
 }
 
-// ProfileArray wraps profiles for gomobile compatibility
+// ProfileArray wraps profiles for gomobile compatibility (gomobile cannot
+// bind Go slices directly).
 type ProfileArray struct {
 	items []*Profile
 }
 
-// Length returns the number of profiles
+// Length returns the number of profiles.
 func (p *ProfileArray) Length() int {
 	return len(p.items)
 }
 
-// Get returns the profile at index i
+// Get returns the profile at index i, or nil if out of range.
 func (p *ProfileArray) Get(i int) *Profile {
 	if i < 0 || i >= len(p.items) {
 		return nil
@@ -46,214 +41,104 @@ func (p *ProfileArray) Get(i int) *Profile {
 	return p.items[i]
 }
 
-/*
-
-/data/data/io.netbird.client/files/           ← configDir parameter
-├── netbird.cfg                                 ← Default profile config
-├── state.json                                  ← Default profile state
-├── active_profile.json                         ← Active profile tracker (JSON with Name + Username)
-└── profiles/                                   ← Subdirectory for non-default profiles
-    ├── work.json                              			← Legacy work profile config
-    ├── work.state.json                        			← Legacy work profile state
-    ├── 4c5f5c8198c3989cffb5b5394f5a7ae0.json  			← ID profile config
-    ├── 4c5f5c8198c3989cffb5b5394f5a7ae0.state.json ← ID profile state
-*/
-
-// ProfileManager manages profiles for Android
-// It wraps the internal profilemanager to provide Android-specific behavior
+// ProfileManager adapts the shared mobile profile manager (client/mobile) to
+// gomobile-friendly types. See that package for the on-disk layout and
+// semantics.
 type ProfileManager struct {
-	configDir  string
-	serviceMgr *profilemanager.ServiceManager
+	impl *mobile.ProfileManager
 }
 
-// NewProfileManager creates a new profile manager for Android
+// NewProfileManager creates a new profile manager for Android. configDir is
+// the app's files directory.
 func NewProfileManager(configDir string) *ProfileManager {
-	// Set the default config path for Android (stored in root configDir, not profiles/)
-	defaultConfigPath := filepath.Join(configDir, defaultConfigFilename)
-
-	// Set global paths for Android
-	profilemanager.DefaultConfigPathDir = configDir
-	profilemanager.DefaultConfigPath = defaultConfigPath
-	profilemanager.ActiveProfileStatePath = filepath.Join(configDir, "active_profile.json")
-
-	// Create ServiceManager with profiles/ subdirectory
-	// This avoids modifying the global ConfigDirOverride for profile listing
-	profilesDir := filepath.Join(configDir, profilesSubdir)
-	serviceMgr := profilemanager.NewServiceManagerWithProfilesDir(defaultConfigPath, profilesDir)
-
-	return &ProfileManager{
-		configDir:  configDir,
-		serviceMgr: serviceMgr,
-	}
+	return &ProfileManager{impl: mobile.NewProfileManager(configDir, androidUsername)}
 }
 
-// ListProfiles returns all available profiles
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this ProfileManager; passing nil disables MDM enforcement.
+func (pm *ProfileManager) SetMDMPolicyFetcher(f PolicyFetcher) {
+	pm.impl.SetMDMLoader(loaderFor(f))
+}
+
+// ListProfiles returns all available profiles, including the default profile,
+// with their active status set.
 func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
-	// Use ServiceManager (looks in profiles/ directory, checks active_profile.json for IsActive)
-	internalProfiles, err := pm.serviceMgr.ListProfiles(androidUsername)
+	profiles, err := pm.impl.ListProfiles()
 	if err != nil {
-		return nil, fmt.Errorf("failed to list profiles: %w", err)
+		return nil, err
 	}
 
-	// Convert internal profiles to Android Profile type
-	var profiles []*Profile
-	for _, p := range internalProfiles {
-		profiles = append(profiles, &Profile{
-			ID:       p.ID.String(),
-			Name:     p.Name,
-			IsActive: p.IsActive,
-		})
+	items := make([]*Profile, 0, len(profiles))
+	for i := range profiles {
+		items = append(items, fromMobileProfile(&profiles[i]))
 	}
-
-	return &ProfileArray{items: profiles}, nil
+	return &ProfileArray{items: items}, nil
 }
 
-// GetActiveProfile returns the currently active profile name
+// GetActiveProfile returns the currently active profile.
 func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
-	// Use ServiceManager to stay consistent with ListProfiles
-	// ServiceManager uses active_profile.json
-	activeState, err := pm.serviceMgr.GetActiveProfileState()
+	p, err := pm.impl.GetActiveProfile()
 	if err != nil {
-		return nil, fmt.Errorf("failed to get active profile: %w", err)
+		return nil, err
 	}
-
-	// ActiveProfileState only stores the ID (and username), not the display
-	// name. Resolve the ID to the full profile so callers get the real Name.
-	prof, err := pm.serviceMgr.ResolveProfile(activeState.ID.String(), androidUsername)
-	if err != nil {
-		return nil, fmt.Errorf("failed to resolve active profile %q: %w", activeState.ID, err)
-	}
-	return &Profile{ID: prof.ID.String(), Name: prof.Name, IsActive: true}, nil
+	return fromMobileProfile(p), nil
 }
 
-// SwitchProfile switches to a different profile
+// SwitchProfile records the given profile ID as the active profile. The caller
+// must stop the VPN tunnel before switching.
 func (pm *ProfileManager) SwitchProfile(id string) error {
-	// Use ServiceManager to stay consistent with ListProfiles
-	// ServiceManager uses active_profile.json
-	err := pm.serviceMgr.SetActiveProfileState(&profilemanager.ActiveProfileState{
-		ID:       profilemanager.ID(id),
-		Username: androidUsername,
-	})
-	if err != nil {
-		return fmt.Errorf("failed to switch profile: %w", err)
-	}
-
-	log.Infof("switched to profile: %s", id)
-	return nil
+	return pm.impl.SwitchProfile(id)
 }
 
-// AddProfile creates a new profile
+// AddProfile creates a new profile with the given display name and a
+// generated ID.
 func (pm *ProfileManager) AddProfile(profileName string) error {
-	// Use ServiceManager (creates profile in profiles/ directory)
-	profile, err := pm.serviceMgr.AddProfile(profileName, androidUsername)
-	if err != nil {
-		return fmt.Errorf("failed to add profile: %w", err)
-	}
-
-	log.Infof("created new profile: %s", profile.ID)
-	return nil
+	_, err := pm.impl.AddProfile(profileName)
+	return err
 }
 
-// LogoutProfile logs out from a profile (clears authentication)
+// RenameProfile changes the display name of the profile identified by id. The
+// on-disk filename (the ID) is left unchanged.
+func (pm *ProfileManager) RenameProfile(id string, newName string) error {
+	return pm.impl.RenameProfile(id, newName)
+}
+
+// LogoutProfile clears authentication data for a profile, forcing a re-login.
+// The management URL and other settings are preserved.
 func (pm *ProfileManager) LogoutProfile(id string) error {
-	configPath, err := pm.getProfileConfigPath(id)
-	if err != nil {
-		return err
-	}
-
-	if !profilemanager.IsValidProfileFilenameStem(profilemanager.ID(id)) {
-		return fmt.Errorf("id '%s' is not valid", id)
-	}
-
-	// Check if profile exists
-	if _, err := os.Stat(configPath); os.IsNotExist(err) {
-		return fmt.Errorf("profile '%s' does not exist", id)
-	}
-
-	// Read current config using internal profilemanager
-	config, err := profilemanager.ReadConfig(configPath)
-	if err != nil {
-		return fmt.Errorf("failed to read profile config: %w", err)
-	}
-
-	// Clear authentication by removing private key and SSH key
-	config.PrivateKey = ""
-	config.SSHKey = ""
-
-	// Save config using internal profilemanager
-	if err := profilemanager.WriteOutConfig(configPath, config); err != nil {
-		return fmt.Errorf("failed to save config: %w", err)
-	}
-
-	log.Infof("logged out from profile: %s", id)
-	return nil
+	return pm.impl.LogoutProfile(id)
 }
 
-// RemoveProfile deletes a profile
+// RemoveProfile deletes a profile. The default profile and the active profile
+// cannot be removed.
 func (pm *ProfileManager) RemoveProfile(id string) error {
-	// Use ServiceManager (removes profile from profiles/ directory)
-	if err := pm.serviceMgr.RemoveProfile(profilemanager.ID(id), androidUsername); err != nil {
-		return fmt.Errorf("failed to remove profile: %w", err)
-	}
-
-	log.Infof("removed profile: %s", id)
-	return nil
+	return pm.impl.RemoveProfile(id)
 }
 
-// getProfileConfigPath returns the config file path for a profile
-// This is needed for Android-specific path handling (netbird.cfg for default profile)
-func (pm *ProfileManager) getProfileConfigPath(id string) (string, error) {
-	if !profilemanager.IsValidProfileFilenameStem(profilemanager.ID(id)) {
-		return "", fmt.Errorf("id %q is not valid", id)
-	}
-
-	if id == profilemanager.DefaultProfileName {
-		// Android uses netbird.cfg for default profile instead of default.json
-		// Default profile is stored in root configDir, not in profiles/
-		return filepath.Join(pm.configDir, defaultConfigFilename), nil
-	}
-
-	profilesDir := filepath.Join(pm.configDir, profilesSubdir)
-	return filepath.Join(profilesDir, id+".json"), nil
-}
-
-// GetConfigPath returns the config file path for a given profile id
-// Java should call this instead of constructing paths with Preferences.configFile()
+// GetConfigPath returns the config file path for the given profile ID. Java
+// should call this instead of constructing paths with Preferences.configFile().
 func (pm *ProfileManager) GetConfigPath(id string) (string, error) {
-	return pm.getProfileConfigPath(id)
+	return pm.impl.GetConfigPath(id)
 }
 
-// GetStateFilePath returns the state file path for a given profile
-// Java should call this instead of constructing paths with Preferences.stateFile()
+// GetStateFilePath returns the state file path for the given profile ID. Java
+// should call this instead of constructing paths with Preferences.stateFile().
 func (pm *ProfileManager) GetStateFilePath(id string) (string, error) {
-	if id == "" || id == profilemanager.DefaultProfileName {
-		return filepath.Join(pm.configDir, "state.json"), nil
-	}
-
-	if !profilemanager.IsValidProfileFilenameStem(profilemanager.ID(id)) {
-		return "", fmt.Errorf("id %q is not valid", id)
-	}
-
-	profilesDir := filepath.Join(pm.configDir, profilesSubdir)
-	return filepath.Join(profilesDir, id+".state.json"), nil
+	return pm.impl.GetStateFilePath(id)
 }
 
-// GetActiveConfigPath returns the config file path for the currently active profile
-// Java should call this instead of Preferences.getActiveProfileName() + Preferences.configFile()
+// GetActiveConfigPath returns the config file path for the currently active
+// profile.
 func (pm *ProfileManager) GetActiveConfigPath() (string, error) {
-	activeProfile, err := pm.GetActiveProfile()
-	if err != nil {
-		return "", fmt.Errorf("failed to get active profile: %w", err)
-	}
-	return pm.GetConfigPath(activeProfile.ID)
+	return pm.impl.GetActiveConfigPath()
 }
 
-// GetActiveStateFilePath returns the state file path for the currently active profile
-// Java should call this instead of Preferences.getActiveProfileName() + Preferences.stateFile()
+// GetActiveStateFilePath returns the state file path for the currently active
+// profile.
 func (pm *ProfileManager) GetActiveStateFilePath() (string, error) {
-	activeProfile, err := pm.GetActiveProfile()
-	if err != nil {
-		return "", fmt.Errorf("failed to get active profile: %w", err)
-	}
-	return pm.GetStateFilePath(activeProfile.ID)
+	return pm.impl.GetActiveStateFilePath()
+}
+
+func fromMobileProfile(p *mobile.Profile) *Profile {
+	return &Profile{ID: p.ID, Name: p.Name, Email: p.Email, IsActive: p.IsActive}
 }
diff --git a/client/android/profile_prefs.go b/client/android/profile_prefs.go
new file mode 100644
index 000000000..a761ebbcf
--- /dev/null
+++ b/client/android/profile_prefs.go
@@ -0,0 +1,37 @@
+//go:build android
+
+package android
+
+import (
+	"fmt"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+type prefsStore interface {
+	Get(namespace string, v any) (bool, error)
+	Put(namespace string, v any) error
+}
+
+type profilePrefs struct {
+	prefs *profilemanager.Prefs
+}
+
+func newProfilePrefs(configDir, profileID string) (*profilePrefs, error) {
+	if configDir == "" || profileID == "" {
+		return nil, fmt.Errorf("profile prefs require a config dir and profile ID")
+	}
+	prefs, err := NewProfileManager(configDir).impl.ProfilePrefs(profileID)
+	if err != nil {
+		return nil, err
+	}
+	return &profilePrefs{prefs: prefs}, nil
+}
+
+func (p *profilePrefs) Get(namespace string, v any) (bool, error) {
+	return p.prefs.Get(namespace, v)
+}
+
+func (p *profilePrefs) Put(namespace string, v any) error {
+	return p.prefs.Put(namespace, v)
+}
diff --git a/client/android/route_command.go b/client/android/route_command.go
deleted file mode 100644
index 5e7357335..000000000
--- a/client/android/route_command.go
+++ /dev/null
@@ -1,70 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"fmt"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"
-
-	"github.com/netbirdio/netbird/client/internal/routemanager"
-	"github.com/netbirdio/netbird/route"
-)
-
-func executeRouteToggle(id string, manager routemanager.Manager,
-	operationName string,
-	routeOperation func(routes []route.NetID, allRoutes []route.NetID) error) error {
-	netID := route.NetID(id)
-	routes := []route.NetID{netID}
-
-	routesMap := manager.GetClientRoutesWithNetID()
-	routes = route.ExpandV6ExitPairs(routes, routesMap)
-
-	log.Debugf("%s with ids: %v", operationName, routes)
-
-	if err := routeOperation(routes, maps.Keys(routesMap)); err != nil {
-		log.Debugf("error when %s: %s", operationName, err)
-		return fmt.Errorf("error %s: %w", operationName, err)
-	}
-
-	manager.TriggerSelection(manager.GetClientRoutes())
-
-	return nil
-}
-
-type routeCommand interface {
-	toggleRoute() error
-}
-
-type selectRouteCommand struct {
-	route   string
-	manager routemanager.Manager
-}
-
-func (s selectRouteCommand) toggleRoute() error {
-	routeSelector := s.manager.GetRouteSelector()
-	if routeSelector == nil {
-		return fmt.Errorf("no route selector available")
-	}
-
-	routeOperation := func(routes []route.NetID, allRoutes []route.NetID) error {
-		return routeSelector.SelectRoutes(routes, true, allRoutes)
-	}
-
-	return executeRouteToggle(s.route, s.manager, "selecting route", routeOperation)
-}
-
-type deselectRouteCommand struct {
-	route   string
-	manager routemanager.Manager
-}
-
-func (d deselectRouteCommand) toggleRoute() error {
-	routeSelector := d.manager.GetRouteSelector()
-	if routeSelector == nil {
-		return fmt.Errorf("no route selector available")
-	}
-
-	return executeRouteToggle(d.route, d.manager, "deselecting route", routeSelector.DeselectRoutes)
-}
diff --git a/client/android/session.go b/client/android/session.go
new file mode 100644
index 000000000..b2de8dadb
--- /dev/null
+++ b/client/android/session.go
@@ -0,0 +1,243 @@
+//go:build android
+
+package android
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/auth"
+)
+
+// StateChangeListener receives client state notifications.
+//
+// OnStateChanged is a payload-free wake-up whenever the state snapshot
+// changed: connection state, the run-loop status label (e.g. NeedsLogin) or
+// the session deadline. It mirrors the daemon's SubscribeStatus stream
+// trigger — on each signal the consumer pulls the fresh values via
+// Status() / SessionExpiresAtUnix(). The engine arms no expiry-warning
+// timers on Android; the app schedules the warnings from the deadline it
+// reads here.
+type StateChangeListener interface {
+	OnStateChanged()
+}
+
+// Status returns the connect run-loop's status label — the same value the
+// desktop daemon serves in StatusResponse.Status. "NeedsLogin" means the
+// management server rejected the peer and an interactive login is required.
+//
+// The label is latched: the run loop keeps its status in a per-run context
+// state, which a restart replaces with a fresh Idle one, so an engine restart
+// (network change, always-on) would otherwise erase the fact that the peer
+// still needs to log in. Only a successful interactive login or extend clears
+// it — see clearLoginRequired.
+func (c *Client) Status() string {
+	latched, generation := c.loginRequiredState()
+	if latched {
+		return string(internal.StatusNeedsLogin)
+	}
+	cc := c.getConnectClient()
+	if cc == nil {
+		return string(internal.StatusIdle)
+	}
+	status := cc.Status()
+	if status == internal.StatusNeedsLogin {
+		c.latchLoginRequired(generation)
+	}
+	return string(status)
+}
+
+func (c *Client) loginRequiredState() (bool, uint64) {
+	c.loginRequiredMu.Lock()
+	defer c.loginRequiredMu.Unlock()
+	return c.loginRequired, c.loginCleared
+}
+
+// latchLoginRequired records a NeedsLogin observation, unless a clear landed
+// while the caller was reading the run loop's status: cc.Status() is read
+// outside the lock, so a login or extend completing in that window would
+// otherwise be undone by this stale observation, stranding the UI on
+// "login required" over a healthy session.
+func (c *Client) latchLoginRequired(observedGeneration uint64) {
+	c.loginRequiredMu.Lock()
+	defer c.loginRequiredMu.Unlock()
+	if c.loginCleared != observedGeneration {
+		return
+	}
+	c.loginRequired = true
+}
+
+// clearLoginRequired releases the latch after a successful interactive login
+// or session extend, and invalidates any observation already in flight.
+func (c *Client) clearLoginRequired() {
+	c.loginRequiredMu.Lock()
+	defer c.loginRequiredMu.Unlock()
+	c.loginRequired = false
+	c.loginCleared++
+}
+
+// SessionExpiresAtUnix returns the SSO session deadline as unix seconds, or 0
+// when no deadline is known (not SSO-registered, expiry disabled, or the
+// engine has not received one yet). A past value means the session expired.
+// Mirror of StatusResponse.sessionExpiresAt on the desktop daemon.
+func (c *Client) SessionExpiresAtUnix() int64 {
+	deadline := c.recorder.GetSessionExpiresAt()
+	if deadline.IsZero() {
+		return 0
+	}
+	return deadline.Unix()
+}
+
+// SetStateChangeListener registers the state notification listener.
+// Replaces any previously registered listener; remove it with
+// RemoveStateChangeListener.
+func (c *Client) SetStateChangeListener(listener StateChangeListener) {
+	c.stateChangeMu.Lock()
+	defer c.stateChangeMu.Unlock()
+	c.stopStateChangeWatchLocked()
+	if listener == nil {
+		return
+	}
+
+	// The subscription is buffered (one pending tick), so unsubscribing is
+	// not enough to stop callbacks: the loop would drain what is already
+	// queued and deliver it to a listener the caller has already removed or
+	// replaced. Gate every callback on this registration's own signal, which
+	// is closed before unsubscribing.
+	done := make(chan struct{})
+	c.stateChangeDone = done
+
+	id, ch := c.recorder.SubscribeToStateChanges()
+	c.stateChangeSubID = id
+	// The channel is closed by UnsubscribeFromStateChanges, which ends the
+	// goroutine. Ticks are coalesced (buffer of one), so a burst of changes
+	// wakes the listener once.
+	go func() {
+		for range ch {
+			select {
+			case <-done:
+				return
+			default:
+			}
+			listener.OnStateChanged()
+		}
+	}()
+}
+
+// RemoveStateChangeListener unregisters the state notification listener.
+func (c *Client) RemoveStateChangeListener() {
+	c.stateChangeMu.Lock()
+	defer c.stateChangeMu.Unlock()
+	c.stopStateChangeWatchLocked()
+}
+
+// ExtendAuthSession runs the interactive SSO flow to obtain a fresh JWT and
+// asks the management server to extend the session deadline. The tunnel is
+// untouched: no resync, no reconnect. Async; the result arrives on the
+// listener. Mirror of the daemon's RequestExtendAuthSession /
+// WaitExtendAuthSession RPC pair, with URLOpener playing the "UI opens the
+// browser" role.
+//
+// Only one flow may be in flight: the PKCE step binds a fixed loopback port,
+// so a second concurrent flow would fail on that bind. Call
+// CancelExtendAuthSession when the user abandons the browser.
+func (c *Client) ExtendAuthSession(urlOpener URLOpener, isAndroidTV bool, resultListener ErrListener) {
+	ctx, err := c.beginExtend()
+	if err != nil {
+		resultListener.OnError(err)
+		return
+	}
+
+	go func() {
+		defer c.endExtend()
+		if err := c.extendAuthSession(ctx, urlOpener, isAndroidTV); err != nil {
+			resultListener.OnError(err)
+			return
+		}
+		resultListener.OnSuccess()
+	}()
+}
+
+// CancelExtendAuthSession aborts an in-flight ExtendAuthSession. The tunnel is
+// left alone — unlike the login flow, which cancels the whole client context
+// by stopping the engine. Without this the abandoned PKCE wait keeps its
+// loopback port for the full flow timeout and blocks every later attempt.
+// No-op when no flow is running.
+func (c *Client) CancelExtendAuthSession() {
+	c.extendMu.Lock()
+	defer c.extendMu.Unlock()
+	if c.extendCancel != nil {
+		c.extendCancel()
+	}
+}
+
+func (c *Client) stopStateChangeWatchLocked() {
+	// Signal first, unsubscribe second: closing the channel only stops new
+	// items, and the loop would still hand whatever is buffered to a listener
+	// that is no longer registered.
+	if c.stateChangeDone != nil {
+		close(c.stateChangeDone)
+		c.stateChangeDone = nil
+	}
+	if c.stateChangeSubID != "" {
+		c.recorder.UnsubscribeFromStateChanges(c.stateChangeSubID)
+		c.stateChangeSubID = ""
+	}
+}
+
+func (c *Client) beginExtend() (context.Context, error) {
+	c.extendMu.Lock()
+	defer c.extendMu.Unlock()
+	if c.extendCancel != nil {
+		return nil, fmt.Errorf("session extend already in progress")
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	c.extendCancel = cancel
+	return ctx, nil
+}
+
+func (c *Client) endExtend() {
+	c.extendMu.Lock()
+	defer c.extendMu.Unlock()
+	if c.extendCancel != nil {
+		c.extendCancel()
+		c.extendCancel = nil
+	}
+}
+
+func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isAndroidTV bool) error {
+	cfg, cfgPath, cc := c.authSnapshot()
+	if cfg == nil || cc == nil {
+		return fmt.Errorf("engine is not running")
+	}
+	engine := cc.Engine()
+	if engine == nil {
+		return fmt.Errorf("engine is not initialized")
+	}
+
+	authClient, err := auth.NewAuth(ctx, cfg.PrivateKey, cfg.ManagementURL, cfg)
+	if err != nil {
+		return fmt.Errorf("failed to create auth client: %v", err)
+	}
+	defer authClient.Close()
+
+	// Passing the config path makes the flow pick up the login_hint. That alone
+	// cannot keep the IdP on this profile's account though — a hint is only a
+	// suggestion, and a silent authorization is answered from whatever session the
+	// IdP already has, which need not be this peer's when several accounts are
+	// signed in. Marking the flow as an extend lets the server rule that out.
+	a := NewAuthWithConfig(ctx, cfg, cfgPath)
+	tokenInfo, err := a.foregroundGetTokenInfoFlow(authClient, urlOpener, isAndroidTV, true)
+	if err != nil {
+		return fmt.Errorf("interactive sso login failed: %v", err)
+	}
+
+	if _, err := engine.ExtendAuthSession(ctx, tokenInfo.GetTokenToUse()); err != nil {
+		return err
+	}
+	c.clearLoginRequired()
+
+	go urlOpener.OnLoginSuccess()
+	return nil
+}
diff --git a/client/android/split_tunnel.go b/client/android/split_tunnel.go
new file mode 100644
index 000000000..60e1ceeb8
--- /dev/null
+++ b/client/android/split_tunnel.go
@@ -0,0 +1,125 @@
+package android
+
+// SplitTunnelMode is which of the two selections, if either, the tunnel applies.
+// Its values land in the profile's stored preferences, so the constants below
+// are append-only and must never be reordered.
+type SplitTunnelMode int
+
+const (
+	modeOff SplitTunnelMode = iota
+	modeExclude
+	modeInclude
+)
+
+// The same modes as basic ints. gomobile drops a constant whose type is not a
+// basic one, so these are what reaches the generated Java bindings, and they
+// keep the Android side tied to the values above instead of repeating 0, 1, 2.
+const (
+	SplitTunnelModeOff     = int(modeOff)
+	SplitTunnelModeExclude = int(modeExclude)
+	SplitTunnelModeInclude = int(modeInclude)
+)
+
+type splitTunnelSection struct {
+	Mode     SplitTunnelMode `json:"mode"`
+	Excluded []string        `json:"excluded"`
+	Included []string        `json:"included"`
+}
+
+// PackageList wraps []string for gomobile compatibility.
+type PackageList struct {
+	items []string
+}
+
+// NewPackageList creates an empty list to fill via Add.
+func NewPackageList() *PackageList {
+	return &PackageList{}
+}
+
+// Add appends a package name, ignoring empty ones.
+func (l *PackageList) Add(s string) {
+	if s == "" {
+		return
+	}
+	l.items = append(l.items, s)
+}
+
+// Size returns the number of entries.
+func (l *PackageList) Size() int {
+	return len(l.items)
+}
+
+// Get returns the entry at index i, or an empty string when out of range.
+func (l *PackageList) Get(i int) string {
+	if i < 0 || i >= len(l.items) {
+		return ""
+	}
+	return l.items[i]
+}
+
+// SplitTunnelSettings is one profile's choice of which applications the tunnel
+// carries. The two selections are kept apart because the platform applies one
+// or the other and never both, and so that switching mode does not throw away
+// the picks made in the other one.
+//
+// Mode is an int rather than a SplitTunnelMode because gomobile carries only
+// basic types across the binding. It holds one of the SplitTunnelMode*
+// constants.
+type SplitTunnelSettings struct {
+	Mode     int
+	Excluded *PackageList
+	Included *PackageList
+}
+
+// NewSplitTunnelSettings creates settings that carry every application.
+func NewSplitTunnelSettings() *SplitTunnelSettings {
+	return &SplitTunnelSettings{
+		Mode:     SplitTunnelModeOff,
+		Excluded: NewPackageList(),
+		Included: NewPackageList(),
+	}
+}
+
+func packagesOf(list *PackageList) []string {
+	if list == nil {
+		return nil
+	}
+	out := make([]string, 0, len(list.items))
+	out = append(out, list.items...)
+	return out
+}
+
+// normalizeSplitTunnelMode maps anything outside the known set to off, so a mode
+// written by a newer build degrades to carrying every application rather than to
+// some other mode's behaviour.
+func normalizeSplitTunnelMode(mode SplitTunnelMode) SplitTunnelMode {
+	switch mode {
+	case modeExclude, modeInclude:
+		return mode
+	default:
+		return modeOff
+	}
+}
+
+func settingsFromSection(section splitTunnelSection) *SplitTunnelSettings {
+	out := NewSplitTunnelSettings()
+	out.Mode = int(normalizeSplitTunnelMode(section.Mode))
+	for _, pkg := range section.Excluded {
+		out.Excluded.Add(pkg)
+	}
+	for _, pkg := range section.Included {
+		out.Included.Add(pkg)
+	}
+	return out
+}
+
+func sectionFromSettings(settings *SplitTunnelSettings) splitTunnelSection {
+	if settings == nil {
+		settings = NewSplitTunnelSettings()
+	}
+	return splitTunnelSection{
+		Mode:     normalizeSplitTunnelMode(SplitTunnelMode(settings.Mode)),
+		Excluded: packagesOf(settings.Excluded),
+		Included: packagesOf(settings.Included),
+	}
+}
diff --git a/client/android/split_tunnel_store.go b/client/android/split_tunnel_store.go
new file mode 100644
index 000000000..f54e0c8ef
--- /dev/null
+++ b/client/android/split_tunnel_store.go
@@ -0,0 +1,34 @@
+//go:build android
+
+package android
+
+const splitTunnelNamespace = "split-tunnel"
+
+// SplitTunnelStore reads and writes a profile's split tunnelling settings.
+type SplitTunnelStore struct {
+	prefs prefsStore
+}
+
+// NewSplitTunnelStore opens the split tunnelling store of the given profile.
+func NewSplitTunnelStore(configDir, profileID string) (*SplitTunnelStore, error) {
+	prefs, err := newProfilePrefs(configDir, profileID)
+	if err != nil {
+		return nil, err
+	}
+	return &SplitTunnelStore{prefs: prefs}, nil
+}
+
+// Load returns the stored settings, or settings that carry every application
+// when the profile has none saved.
+func (s *SplitTunnelStore) Load() (*SplitTunnelSettings, error) {
+	var section splitTunnelSection
+	if _, err := s.prefs.Get(splitTunnelNamespace, &section); err != nil {
+		return nil, err
+	}
+	return settingsFromSection(section), nil
+}
+
+// Save replaces the stored settings.
+func (s *SplitTunnelStore) Save(settings *SplitTunnelSettings) error {
+	return s.prefs.Put(splitTunnelNamespace, sectionFromSettings(settings))
+}
diff --git a/client/android/split_tunnel_test.go b/client/android/split_tunnel_test.go
new file mode 100644
index 000000000..bf6e0267e
--- /dev/null
+++ b/client/android/split_tunnel_test.go
@@ -0,0 +1,151 @@
+package android
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+)
+
+func TestNormalizeSplitTunnelMode(t *testing.T) {
+	tests := []struct {
+		name string
+		mode SplitTunnelMode
+		want SplitTunnelMode
+	}{
+		{name: "exclude is kept", mode: modeExclude, want: modeExclude},
+		{name: "include is kept", mode: modeInclude, want: modeInclude},
+		{name: "off is kept", mode: modeOff, want: modeOff},
+		{name: "a mode from a newer build falls back to off", mode: SplitTunnelMode(7), want: modeOff},
+		{name: "a negative mode falls back to off", mode: SplitTunnelMode(-1), want: modeOff},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := normalizeSplitTunnelMode(tt.mode); got != tt.want {
+				t.Errorf("normalizeSplitTunnelMode(%d) = %d, want %d", tt.mode, got, tt.want)
+			}
+		})
+	}
+}
+
+// The constants the Android side reads must stay the values the store writes:
+// gomobile carries the ints below, not the typed constants they mirror.
+func TestSplitTunnelModeConstantsMirrorTheTypedOnes(t *testing.T) {
+	if SplitTunnelModeOff != int(modeOff) {
+		t.Errorf("off = %d, want %d", SplitTunnelModeOff, modeOff)
+	}
+	if SplitTunnelModeExclude != int(modeExclude) {
+		t.Errorf("exclude = %d, want %d", SplitTunnelModeExclude, modeExclude)
+	}
+	if SplitTunnelModeInclude != int(modeInclude) {
+		t.Errorf("include = %d, want %d", SplitTunnelModeInclude, modeInclude)
+	}
+}
+
+func TestSettingsFromSection(t *testing.T) {
+	got := settingsFromSection(splitTunnelSection{
+		Mode:     modeExclude,
+		Excluded: []string{"com.example.a", "com.example.b"},
+		Included: []string{"com.example.c"},
+	})
+
+	if got.Mode != SplitTunnelModeExclude {
+		t.Errorf("mode = %d, want %d", got.Mode, SplitTunnelModeExclude)
+	}
+	if got.Excluded.Size() != 2 || got.Excluded.Get(0) != "com.example.a" {
+		t.Errorf("excluded = %v, want the two stored packages", packagesOf(got.Excluded))
+	}
+	if got.Included.Size() != 1 || got.Included.Get(0) != "com.example.c" {
+		t.Errorf("included = %v, want the stored package", packagesOf(got.Included))
+	}
+}
+
+// A profile that has never stored anything decodes into an empty section, and
+// must come back as settings that carry every application rather than as nil
+// lists the caller would have to guard against.
+func TestSettingsFromEmptySectionCarriesEverything(t *testing.T) {
+	got := settingsFromSection(splitTunnelSection{})
+
+	if got.Mode != SplitTunnelModeOff {
+		t.Errorf("mode = %d, want %d", got.Mode, SplitTunnelModeOff)
+	}
+	if got.Excluded == nil || got.Included == nil {
+		t.Fatal("both selections must be usable lists, not nil")
+	}
+	if got.Excluded.Size() != 0 || got.Included.Size() != 0 {
+		t.Errorf("selections = %v/%v, want both empty", packagesOf(got.Excluded), packagesOf(got.Included))
+	}
+}
+
+// The section is what the profile's preference file holds, so the mode has to
+// survive a JSON round trip as the number the constants name.
+func TestSectionEncodesTheModeAsItsNumber(t *testing.T) {
+	raw, err := json.Marshal(sectionFromSettings(&SplitTunnelSettings{Mode: SplitTunnelModeInclude}))
+	if err != nil {
+		t.Fatalf("marshal section: %v", err)
+	}
+
+	var back splitTunnelSection
+	if err := json.Unmarshal(raw, &back); err != nil {
+		t.Fatalf("unmarshal section: %v", err)
+	}
+	if back.Mode != modeInclude {
+		t.Errorf("mode = %d, want %d, from %s", back.Mode, modeInclude, raw)
+	}
+}
+
+func TestSectionFromSettingsRoundTrip(t *testing.T) {
+	settings := NewSplitTunnelSettings()
+	settings.Mode = SplitTunnelModeInclude
+	settings.Included.Add("com.example.a")
+	settings.Excluded.Add("com.example.b")
+
+	section := sectionFromSettings(settings)
+	back := settingsFromSection(section)
+
+	if back.Mode != SplitTunnelModeInclude {
+		t.Errorf("mode = %d, want %d", back.Mode, SplitTunnelModeInclude)
+	}
+	if !reflect.DeepEqual(packagesOf(back.Included), []string{"com.example.a"}) {
+		t.Errorf("included = %v, want [com.example.a]", packagesOf(back.Included))
+	}
+	// The inactive selection survives, so switching mode back does not make the
+	// user pick their applications again.
+	if !reflect.DeepEqual(packagesOf(back.Excluded), []string{"com.example.b"}) {
+		t.Errorf("excluded = %v, want [com.example.b]", packagesOf(back.Excluded))
+	}
+}
+
+// A mode the Java side never sets, such as one left by a newer build, must not
+// reach the stored section either.
+func TestSectionFromSettingsNormalizesAnUnknownMode(t *testing.T) {
+	section := sectionFromSettings(&SplitTunnelSettings{Mode: 7})
+
+	if section.Mode != modeOff {
+		t.Errorf("mode = %d, want %d", section.Mode, modeOff)
+	}
+}
+
+func TestSectionFromNilSettings(t *testing.T) {
+	section := sectionFromSettings(nil)
+
+	if section.Mode != modeOff {
+		t.Errorf("mode = %d, want %d", section.Mode, modeOff)
+	}
+	if len(section.Excluded) != 0 || len(section.Included) != 0 {
+		t.Errorf("selections = %v/%v, want both empty", section.Excluded, section.Included)
+	}
+}
+
+func TestPackageListIgnoresEmptyAndBounds(t *testing.T) {
+	list := NewPackageList()
+	list.Add("com.example.a")
+	list.Add("")
+
+	if list.Size() != 1 {
+		t.Errorf("size = %d, want 1", list.Size())
+	}
+	if list.Get(-1) != "" || list.Get(5) != "" {
+		t.Error("out of range access must return an empty string")
+	}
+}
diff --git a/client/android/ssh_client.go b/client/android/ssh_client.go
new file mode 100644
index 000000000..e05249e98
--- /dev/null
+++ b/client/android/ssh_client.go
@@ -0,0 +1,651 @@
+//go:build android
+
+package android
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	gossh "golang.org/x/crypto/ssh"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/auth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/client/ssh/detection"
+)
+
+const (
+	sshDialTimeout      = 30 * time.Second
+	sshDetectionTimeout = 5 * time.Second
+)
+
+// PasswordRequiredMarker tells Java to prompt for a password and retry. It is
+// a string because gomobile flattens errors to their message, so a sentinel
+// value would not survive the binding.
+//
+//nolint:gosec // G101 false positive: a sentinel marker, not a credential
+const PasswordRequiredMarker = "netbird-ssh-password-required"
+
+// HostKeyUnknownMarker tells Java to show the fingerprint and, on confirmation,
+// retry with TrustHostKey set. The presented fingerprint is appended after the
+// marker so the prompt can display it and the retry can guard against a key
+// that changed between the two connects. Only regular (non-NetBird) servers
+// reach this: NetBird peers verify against the registry.
+const HostKeyUnknownMarker = "netbird-ssh-hostkey-unknown"
+
+var (
+	errPasswordRequired = errors.New(PasswordRequiredMarker)
+	errClientClosed     = errors.New("ssh client closed")
+)
+
+// errHostKeyUnknown carries the presented fingerprint so Connect can build the
+// marker message the Java side parses.
+type errHostKeyUnknown struct {
+	fingerprint string
+}
+
+func (e *errHostKeyUnknown) Error() string {
+	return HostKeyUnknownMarker + ":" + e.fingerprint
+}
+
+// SSHTerminalListener receives SSH session events. It is implemented in Java.
+//
+// All callbacks are invoked from goroutines and may run concurrently with each
+// other; the implementation must be safe to call from any thread.
+type SSHTerminalListener interface {
+	OnConnected()
+	OnData(data []byte)
+	OnClose(reason string)
+	OnError(message string)
+}
+
+// SSHClient is a NetBird-aware SSH client exposed to Java via gomobile.
+//
+// It dials through the running NetBird tunnel and runs a standard SSH session
+// on top with PTY enabled. Host-key verification uses the NetBird-provided
+// peer SSH host keys, identical to the desktop client.
+type SSHClient struct {
+	nb        *Client
+	mu        sync.Mutex
+	listener  SSHTerminalListener
+	urlOpener URLOpener
+
+	sshClient *gossh.Client
+	session   *gossh.Session
+	stdin     io.WriteCloser
+	closed    bool
+
+	// gen identifies the current connection attempt. Connect and Close bump it,
+	// so an in-flight dial or a reader left over from a previous connection
+	// finds itself stale and stays silent instead of publishing OnConnected or
+	// OnClose for a connection the caller already abandoned.
+	gen        uint64
+	dialCancel context.CancelFunc
+
+	// knownHostsConfigDir and knownHostsProfile locate the TOFU store for
+	// regular SSH servers in the profile's preferences. Java supplies them,
+	// since an overlay IP is a different host under a different profile. Empty
+	// until set: without them a regular server cannot be verified and Connect
+	// refuses one.
+	knownHostsConfigDir string
+	knownHostsProfile   string
+	// trustHostKey carries the fingerprint the user confirmed on a previous
+	// attempt, so the retry accepts exactly that key and persists it.
+	trustHostKey string
+}
+
+// NewSSHClient creates a new SSH client bound to the running NetBird Client.
+func NewSSHClient(c *Client) *SSHClient {
+	return &SSHClient{nb: c}
+}
+
+// SetListener registers the Java listener. Must be called before Connect to
+// receive any events.
+func (s *SSHClient) SetListener(l SSHTerminalListener) {
+	s.mu.Lock()
+	s.listener = l
+	s.mu.Unlock()
+}
+
+// SetURLOpener registers the Java URL opener used to display the device-code
+// authorization page in a Custom Tabs window when the target peer requires
+// JWT authentication. Must be set before Connect to be effective.
+func (s *SSHClient) SetURLOpener(opener URLOpener) {
+	s.mu.Lock()
+	s.urlOpener = opener
+	s.mu.Unlock()
+}
+
+// SetKnownHostsStore points the TOFU host-key store at a profile's preferences.
+// Must be set before connecting to a regular SSH server; without it such a
+// server cannot be verified and Connect refuses one.
+func (s *SSHClient) SetKnownHostsStore(configDir, profileID string) {
+	s.mu.Lock()
+	s.knownHostsConfigDir = configDir
+	s.knownHostsProfile = profileID
+	s.mu.Unlock()
+}
+
+// TrustHostKey records the fingerprint the user confirmed for a regular server,
+// so the next Connect accepts that exact key and adds it to the known-hosts
+// store. Passing a fingerprint that no longer matches makes the connect fail
+// rather than trust a key that changed since the prompt.
+func (s *SSHClient) TrustHostKey(fingerprint string) {
+	s.mu.Lock()
+	s.trustHostKey = fingerprint
+	s.mu.Unlock()
+}
+
+// Connect dials the SSH server through the NetBird tunnel and performs the
+// SSH handshake. It auto-detects the server type via SSH banner inspection
+// and selects the appropriate authentication path:
+//
+//   - NetBird-SSH server requiring JWT: launches the OAuth 2.0 device-code
+//     flow, opens the verification URL through the registered URLOpener, and
+//     uses the resulting token as the SSH password. Host-key verification
+//     uses the NetBird peer registry.
+//   - NetBird-SSH server without JWT: authenticates with the NetBird SSH
+//     private key. Host-key verification uses the NetBird peer registry.
+//   - Regular SSH server (e.g. OpenSSH): authenticates with the NetBird key
+//     first (so a user-installed NetBird public key works), then falls back
+//     to the supplied password if non-empty. Host-key verification is
+//     trust-on-first-use against the per-profile known-hosts store.
+//
+// The password parameter is only consulted for regular SSH servers.
+func (s *SSHClient) Connect(host string, port int, user, password string) error {
+	if port < 1 || port > 65535 {
+		return fmt.Errorf("invalid port: %d", port)
+	}
+
+	cfg, cfgPath, cc := s.nb.authSnapshot()
+	if cc == nil {
+		return errors.New("netbird client not running")
+	}
+	if cfg == nil {
+		return errors.New("netbird config not loaded")
+	}
+	engine := cc.Engine()
+	if engine == nil {
+		return errors.New("netbird engine not available")
+	}
+
+	s.mu.Lock()
+	s.gen++
+	gen := s.gen
+	s.mu.Unlock()
+
+	serverType := detectServerType(host, port)
+	log.Debugf("SSH server type: %s", serverType)
+
+	authMethods, hostKeyCallback, err := s.buildAuth(cfg, cfgPath, engine, serverType, password)
+	if err != nil {
+		return err
+	}
+
+	clientConfig := &gossh.ClientConfig{
+		User:            user,
+		Auth:            authMethods,
+		HostKeyCallback: hostKeyCallback,
+		Timeout:         sshDialTimeout,
+	}
+	err = s.dialAndHandshake(gen, host, port, clientConfig)
+
+	// An unknown host key is a prompt, not a failure: return the marker intact
+	// (rootCause would unwrap it) so Java can show the fingerprint and retry.
+	var unknownHost *errHostKeyUnknown
+	if errors.As(err, &unknownHost) {
+		return errors.New(unknownHost.Error())
+	}
+
+	// A regular server may still accept a password, so let the caller ask for
+	// one instead of failing. NetBird servers never use a password, so a
+	// failure there is genuine.
+	if err != nil && serverType != detection.ServerTypeNetBirdJWT &&
+		serverType != detection.ServerTypeNetBirdNoJWT && isAuthFailure(err) &&
+		passwordCouldHelp(err, password != "") {
+		return errPasswordRequired
+	}
+	if err != nil {
+		return rootCause(err)
+	}
+	return nil
+}
+
+// StartSession requests a PTY and starts an interactive shell. Output from
+// the session is forwarded to the listener via OnData.
+func (s *SSHClient) StartSession(cols, rows int) error {
+	err := s.startSession(cols, rows)
+	if err != nil {
+		log.Infof("SSH: start session failed: %v", err)
+		return rootCause(err)
+	}
+	return nil
+}
+
+// Write sends data to the SSH session stdin.
+func (s *SSHClient) Write(data []byte) error {
+	s.mu.Lock()
+	stdin := s.stdin
+	s.mu.Unlock()
+	if stdin == nil {
+		return errors.New("ssh session not started")
+	}
+	if _, err := stdin.Write(data); err != nil {
+		return fmt.Errorf("write stdin: %w", err)
+	}
+	return nil
+}
+
+// Resize updates the PTY window size.
+func (s *SSHClient) Resize(cols, rows int) error {
+	s.mu.Lock()
+	session := s.session
+	s.mu.Unlock()
+	if session == nil {
+		return errors.New("ssh session not started")
+	}
+	return session.WindowChange(rows, cols)
+}
+
+// Reset makes a closed client usable for another Connect: Close leaves the
+// one-shot guard set, and clearing it lets the same client back a reconnect.
+func (s *SSHClient) Reset() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.closed = false
+}
+
+// Close terminates the SSH session and underlying connection. Safe to call
+// multiple times.
+func (s *SSHClient) Close() error {
+	s.mu.Lock()
+	s.gen++
+	if s.dialCancel != nil {
+		s.dialCancel()
+		s.dialCancel = nil
+	}
+	sshClient := s.sshClient
+	session := s.session
+	stdin := s.stdin
+	s.sshClient = nil
+	s.session = nil
+	s.stdin = nil
+	notify := !s.closed
+	s.closed = true
+	listener := s.listener
+	s.mu.Unlock()
+
+	if stdin != nil {
+		if err := stdin.Close(); err != nil {
+			log.Debugf("ssh: stdin close: %v", err)
+		}
+	}
+	if session != nil {
+		if err := session.Close(); err != nil && !errors.Is(err, io.EOF) {
+			log.Debugf("ssh: session close: %v", err)
+		}
+	}
+	var firstErr error
+	if sshClient != nil {
+		if err := sshClient.Close(); err != nil {
+			firstErr = err
+		}
+	}
+	if notify && listener != nil {
+		listener.OnClose("closed by client")
+	}
+	return firstErr
+}
+
+func (s *SSHClient) startSession(cols, rows int) error {
+	log.Debugf("SSH: starting session %dx%d", cols, rows)
+	s.mu.Lock()
+	sshClient := s.sshClient
+	gen := s.gen
+	s.mu.Unlock()
+
+	if sshClient == nil {
+		return errors.New("ssh client not connected")
+	}
+
+	pty, err := nbssh.StartPTYSession(sshClient, cols, rows)
+	if err != nil {
+		return err
+	}
+
+	s.mu.Lock()
+	if gen != s.gen {
+		s.mu.Unlock()
+		closeQuiet(pty.Session, "stale session")
+		return errClientClosed
+	}
+	s.session = pty.Session
+	s.stdin = pty.Stdin
+	s.mu.Unlock()
+
+	readerDone := make(chan string, 2)
+	go func() { readerDone <- s.readLoop(pty.Stdout, "stdout") }()
+	go func() { readerDone <- s.readLoop(pty.Stderr, "stderr") }()
+	go func() {
+		reason := <-readerDone
+		if second := <-readerDone; reason == "" {
+			reason = second
+		}
+		s.notifyClose(gen, reason)
+	}()
+	log.Debug("SSH: session started, shell running")
+	return nil
+}
+
+func (s *SSHClient) buildAuth(cfg *profilemanager.Config, cfgPath string, engine *internal.Engine,
+	serverType detection.ServerType, password string) ([]gossh.AuthMethod, gossh.HostKeyCallback, error) {
+
+	switch serverType {
+	case detection.ServerTypeNetBirdJWT:
+		token, err := s.requestJWTToken(cfg, cfgPath)
+		if err != nil {
+			return nil, nil, fmt.Errorf("jwt: %w", err)
+		}
+		auths := []gossh.AuthMethod{gossh.Password(token)}
+		return auths, nbssh.CreateHostKeyCallback(nbssh.PeerKeyLookup(engine.GetPeerSSHKey)), nil
+
+	case detection.ServerTypeNetBirdNoJWT:
+		if cfg.SSHKey == "" {
+			return nil, nil, errors.New("no NetBird SSH key available")
+		}
+		signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey))
+		if err != nil {
+			return nil, nil, fmt.Errorf("parse netbird ssh key: %w", err)
+		}
+		auths := []gossh.AuthMethod{gossh.PublicKeys(signer)}
+		return auths, nbssh.CreateHostKeyCallback(nbssh.PeerKeyLookup(engine.GetPeerSSHKey)), nil
+
+	case detection.ServerTypeRegular:
+		var auths []gossh.AuthMethod
+		if cfg.SSHKey != "" {
+			if signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey)); err == nil {
+				auths = append(auths, gossh.PublicKeys(signer))
+			} else {
+				log.Debugf("ssh: parse netbird key for regular auth: %v", err)
+			}
+		}
+		if password != "" {
+			pw := password
+			auths = append(auths, gossh.Password(pw))
+			auths = append(auths, gossh.KeyboardInteractive(func(_, _ string, questions []string, _ []bool) ([]string, error) {
+				answers := make([]string, len(questions))
+				for i := range questions {
+					answers[i] = pw
+				}
+				return answers, nil
+			}))
+		}
+		if len(auths) == 0 {
+			// Nothing to offer at all: ask for a password rather than failing,
+			// so the caller can retry once the user supplies one.
+			return nil, nil, errPasswordRequired
+		}
+		callback, err := s.tofuHostKeyCallback()
+		if err != nil {
+			return nil, nil, err
+		}
+		return auths, callback, nil
+
+	default:
+		return nil, nil, fmt.Errorf("unsupported SSH server type: %v", serverType)
+	}
+}
+
+// tofuHostKeyCallback verifies a regular server's host key against the
+// per-profile known-hosts store. An unknown host returns errHostKeyUnknown so
+// Java can show the fingerprint and, once confirmed, retry with the key
+// trusted; a changed key is rejected outright, as OpenSSH does. When the user
+// has confirmed a fingerprint, the callback accepts exactly that key and
+// appends it to the store.
+func (s *SSHClient) tofuHostKeyCallback() (gossh.HostKeyCallback, error) {
+	s.mu.Lock()
+	configDir := s.knownHostsConfigDir
+	profileID := s.knownHostsProfile
+	trusted := s.trustHostKey
+	s.mu.Unlock()
+
+	if configDir == "" || profileID == "" {
+		return nil, errors.New("no known-hosts store configured for regular SSH")
+	}
+
+	store, err := openKnownHostsStore(configDir, profileID)
+	if err != nil {
+		return nil, fmt.Errorf("load known-hosts store: %w", err)
+	}
+
+	return func(hostname string, remote net.Addr, key gossh.PublicKey) error {
+		verdict, err := store.verify(hostname, remote, key)
+		if err != nil {
+			return err
+		}
+		if verdict == hostKeyMatched {
+			return nil
+		}
+		if verdict == hostKeyChanged {
+			return fmt.Errorf("SSH host key changed for %s (possible attack)", hostname)
+		}
+
+		fingerprint := gossh.FingerprintSHA256(key)
+		if trusted == "" {
+			return &errHostKeyUnknown{fingerprint: fingerprint}
+		}
+		if trusted != fingerprint {
+			return fmt.Errorf("SSH host key changed since it was confirmed for %s", hostname)
+		}
+		if err := store.append(hostname, remote, key); err != nil {
+			return fmt.Errorf("persist trusted host key: %w", err)
+		}
+		// The confirmation is spent: now that the key is stored, a later
+		// reconnect must verify against the file, not re-accept this fingerprint.
+		s.mu.Lock()
+		s.trustHostKey = ""
+		s.mu.Unlock()
+		return nil
+	}, nil
+}
+
+func (s *SSHClient) requestJWTToken(cfg *profilemanager.Config, cfgPath string) (string, error) {
+	s.mu.Lock()
+	urlOpener := s.urlOpener
+	s.mu.Unlock()
+	if urlOpener == nil {
+		return "", errors.New("URL opener not configured for JWT auth")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	flow, err := auth.NewOAuthFlow(ctx, cfg, false, true, profileLoginHint(cfgPath), false)
+	if err != nil {
+		return "", fmt.Errorf("create oauth flow: %w", err)
+	}
+
+	// The status callback covers the browser round-trip, which would
+	// otherwise leave the terminal blank.
+	tokenInfo, err := runOAuthFlow(ctx, flow, urlOpener, func() {
+		s.notifyStatus("Waiting for browser authentication...")
+	})
+	if err != nil {
+		return "", err
+	}
+
+	token := tokenInfo.GetTokenToUse()
+	if token == "" {
+		return "", errors.New("empty token returned by IdP")
+	}
+
+	// Tells the client the browser round-trip is over so it can dismiss the
+	// surface it opened, the same way the login and session-extend flows do.
+	// Without it the Custom Tab stays in front of the terminal even though the
+	// token has already been collected.
+	urlOpener.OnLoginSuccess()
+
+	return token, nil
+}
+
+func (s *SSHClient) dialAndHandshake(gen uint64, host string, port int, clientConfig *gossh.ClientConfig) error {
+	addr := net.JoinHostPort(host, strconv.Itoa(port))
+	ctx, cancel := context.WithTimeout(context.Background(), sshDialTimeout)
+	defer cancel()
+
+	s.mu.Lock()
+	if gen != s.gen {
+		s.mu.Unlock()
+		return errClientClosed
+	}
+	s.dialCancel = cancel
+	s.mu.Unlock()
+
+	var dialer net.Dialer
+	conn, err := dialer.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return fmt.Errorf("dial %s: %w", addr, err)
+	}
+
+	client, err := nbssh.Handshake(ctx, conn, addr, clientConfig)
+	if err != nil {
+		return err
+	}
+
+	s.mu.Lock()
+	if gen != s.gen {
+		s.mu.Unlock()
+		closeQuiet(client, "stale ssh client")
+		return errClientClosed
+	}
+	s.sshClient = client
+	listener := s.listener
+	s.mu.Unlock()
+
+	if listener != nil {
+		listener.OnConnected()
+	}
+	return nil
+}
+
+func (s *SSHClient) readLoop(r io.Reader, name string) string {
+	buf := make([]byte, 4096)
+	for {
+		n, err := r.Read(buf)
+		if n > 0 {
+			s.mu.Lock()
+			listener := s.listener
+			s.mu.Unlock()
+			if listener != nil {
+				chunk := make([]byte, n)
+				copy(chunk, buf[:n])
+				listener.OnData(chunk)
+			}
+		}
+		if err != nil {
+			// EOF is a normal shell exit, so report it without a reason.
+			if errors.Is(err, io.EOF) {
+				return ""
+			}
+			log.Debugf("ssh %s read: %v", name, err)
+			return rootCause(err).Error()
+		}
+	}
+}
+
+// notifyStatus writes a progress line to the terminal through the normal
+// output path, so long steps are visible while nothing else is arriving.
+func (s *SSHClient) notifyStatus(text string) {
+	s.mu.Lock()
+	listener := s.listener
+	s.mu.Unlock()
+	if listener != nil {
+		listener.OnData([]byte("\r\n\x1b[33m" + text + "\x1b[0m\r\n"))
+	}
+}
+
+func (s *SSHClient) notifyClose(gen uint64, reason string) {
+	s.mu.Lock()
+	if gen != s.gen || s.closed {
+		s.mu.Unlock()
+		return
+	}
+	s.closed = true
+	listener := s.listener
+	s.mu.Unlock()
+	if listener != nil {
+		listener.OnClose(reason)
+	}
+}
+
+func closeQuiet(c io.Closer, label string) {
+	if c == nil {
+		return
+	}
+	if err := c.Close(); err != nil && !errors.Is(err, io.EOF) {
+		log.Debugf("ssh: close %s: %v", label, err)
+	}
+}
+
+func detectServerType(host string, port int) detection.ServerType {
+	ctx, cancel := context.WithTimeout(context.Background(), sshDetectionTimeout)
+	defer cancel()
+
+	dialer := &net.Dialer{}
+	serverType, err := detection.DetectSSHServerType(ctx, dialer, host, port)
+	if err != nil {
+		log.Debugf("ssh: server detection failed: %v (assuming regular SSH)", err)
+		return detection.ServerTypeRegular
+	}
+	return serverType
+}
+
+// rootCause returns the innermost error of a %w chain, so the terminal shows
+// "i/o timeout" rather than every layer that added context on the way up.
+func rootCause(err error) error {
+	for {
+		// A joined error has no single root, so keep it as-is.
+		if _, ok := err.(interface{ Unwrap() []error }); ok {
+			return err
+		}
+		next := errors.Unwrap(err)
+		if next == nil {
+			return err
+		}
+		err = next
+	}
+}
+
+// isAuthFailure distinguishes credential rejection from dial, timeout and
+// host-key errors, which retrying with a password would not fix.
+func isAuthFailure(err error) bool {
+	if errors.Is(err, errPasswordRequired) {
+		return true
+	}
+	var partial *gossh.PartialSuccessError
+	if errors.As(err, &partial) {
+		return true
+	}
+	return strings.Contains(err.Error(), "unable to authenticate")
+}
+
+// passwordCouldHelp reports whether prompting for a password again can change
+// the outcome. gossh lists a method under "attempted methods" only when the
+// server offered it, so a supplied password that was never attempted means the
+// server does not accept passwords and the real error should surface instead.
+func passwordCouldHelp(err error, passwordOffered bool) bool {
+	if !passwordOffered {
+		return true
+	}
+	msg := err.Error()
+	return strings.Contains(msg, "password") || strings.Contains(msg, "keyboard-interactive")
+}
diff --git a/client/android/ssh_known_hosts.go b/client/android/ssh_known_hosts.go
new file mode 100644
index 000000000..eea90fd32
--- /dev/null
+++ b/client/android/ssh_known_hosts.go
@@ -0,0 +1,168 @@
+//go:build android
+
+package android
+
+import (
+	"bytes"
+	"net"
+	"strconv"
+	"strings"
+	"sync"
+
+	gossh "golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/knownhosts"
+)
+
+const knownHostsNamespace = "ssh"
+
+const (
+	hostKeyUnknown hostKeyVerdict = iota
+	hostKeyMatched
+	hostKeyChanged
+)
+
+var knownHostsMu sync.Mutex
+
+type hostKeyVerdict uint8
+
+type knownHostsSection struct {
+	KnownHosts []string `json:"knownHosts"`
+}
+
+type knownHostsStore struct {
+	prefs prefsStore
+}
+
+// RemoveKnownHost deletes every known-hosts entry for host:port from the
+// profile's store, so a host trusted for a session that is being deleted does
+// not linger. Java calls this only once no session targets that host, so a
+// shared host stays trusted. A missing entry is not an error: the goal state
+// is "absent".
+func RemoveKnownHost(configDir, profileID, host string, port int) error {
+	store, err := openKnownHostsStore(configDir, profileID)
+	if err != nil {
+		return err
+	}
+	return store.removeHost(host, port)
+}
+
+func openKnownHostsStore(configDir, profileID string) (*knownHostsStore, error) {
+	prefs, err := newProfilePrefs(configDir, profileID)
+	if err != nil {
+		return nil, err
+	}
+	return &knownHostsStore{prefs: prefs}, nil
+}
+
+func (st *knownHostsStore) verify(hostname string, remote net.Addr, key gossh.PublicKey) (hostKeyVerdict, error) {
+	lines, err := st.lines()
+	if err != nil {
+		return hostKeyUnknown, err
+	}
+	targets := knownHostsTargets(hostname, remote)
+
+	verdict := hostKeyUnknown
+	for _, line := range lines {
+		pubKey, ok := knownHostsLineKey(line, targets)
+		if !ok {
+			continue
+		}
+		if pubKey.Type() == key.Type() && bytes.Equal(pubKey.Marshal(), key.Marshal()) {
+			return hostKeyMatched, nil
+		}
+		verdict = hostKeyChanged
+	}
+	return verdict, nil
+}
+
+func (st *knownHostsStore) append(hostname string, remote net.Addr, key gossh.PublicKey) error {
+	line := knownhosts.Line(knownHostsTargets(hostname, remote), key)
+
+	knownHostsMu.Lock()
+	defer knownHostsMu.Unlock()
+
+	lines, err := st.lines()
+	if err != nil {
+		return err
+	}
+	return st.prefs.Put(knownHostsNamespace, knownHostsSection{KnownHosts: append(lines, line)})
+}
+
+func (st *knownHostsStore) removeHost(host string, port int) error {
+	target := knownhosts.Normalize(net.JoinHostPort(host, strconv.Itoa(port)))
+
+	knownHostsMu.Lock()
+	defer knownHostsMu.Unlock()
+
+	lines, err := st.lines()
+	if err != nil {
+		return err
+	}
+	kept := make([]string, 0, len(lines))
+	for _, line := range lines {
+		if knownHostsLineMatches(line, target) {
+			continue
+		}
+		kept = append(kept, line)
+	}
+	if len(kept) == len(lines) {
+		return nil
+	}
+	return st.prefs.Put(knownHostsNamespace, knownHostsSection{KnownHosts: kept})
+}
+
+func (st *knownHostsStore) lines() ([]string, error) {
+	var section knownHostsSection
+	if _, err := st.prefs.Get(knownHostsNamespace, &section); err != nil {
+		return nil, err
+	}
+	return section.KnownHosts, nil
+}
+
+func knownHostsTargets(hostname string, remote net.Addr) []string {
+	targets := []string{knownhosts.Normalize(hostname)}
+	if remote != nil {
+		if normalized := knownhosts.Normalize(remote.String()); normalized != targets[0] {
+			targets = append(targets, normalized)
+		}
+	}
+	return targets
+}
+
+func knownHostsLineKey(line string, targets []string) (gossh.PublicKey, bool) {
+	trimmed := strings.TrimSpace(line)
+	if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+		return nil, false
+	}
+	_, hosts, pubKey, _, _, err := gossh.ParseKnownHosts([]byte(trimmed))
+	if err != nil {
+		return nil, false
+	}
+	for _, host := range hosts {
+		for _, target := range targets {
+			if host == target {
+				return pubKey, true
+			}
+		}
+	}
+	return nil, false
+}
+
+// knownHostsLineMatches reports whether a known-hosts line's address list
+// contains the normalized target. Comment and blank lines never match.
+func knownHostsLineMatches(line, target string) bool {
+	trimmed := strings.TrimSpace(line)
+	if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+		return false
+	}
+	fields := strings.Fields(trimmed)
+	if len(fields) == 0 {
+		return false
+	}
+	for _, addr := range strings.Split(fields[0], ",") {
+		if addr == target {
+			return true
+		}
+	}
+	return false
+}
diff --git a/client/android/ssh_sessions.go b/client/android/ssh_sessions.go
new file mode 100644
index 000000000..44b5464e9
--- /dev/null
+++ b/client/android/ssh_sessions.go
@@ -0,0 +1,104 @@
+//go:build android
+
+package android
+
+const (
+	sshSessionsNamespace = "ssh-sessions"
+	maxStoredSSHSessions = 50
+)
+
+type sshSessionRecord struct {
+	ID   string `json:"id"`
+	Host string `json:"host"`
+	Port int    `json:"port"`
+	User string `json:"user"`
+}
+
+type sshSessionsSection struct {
+	Sessions []sshSessionRecord `json:"sessions"`
+}
+
+// SSHSessionEntry is one stored SSH session, without any credential.
+type SSHSessionEntry struct {
+	ID   string
+	Host string
+	Port int
+	User string
+}
+
+// SSHSessionArray wraps stored SSH sessions for gomobile compatibility.
+type SSHSessionArray struct {
+	items []*SSHSessionEntry
+}
+
+// NewSSHSessionArray creates an empty session array to fill via Add.
+func NewSSHSessionArray() *SSHSessionArray {
+	return &SSHSessionArray{}
+}
+
+// Add appends a session entry, oldest first.
+func (a *SSHSessionArray) Add(id, host string, port int, user string) {
+	a.items = append(a.items, &SSHSessionEntry{ID: id, Host: host, Port: port, User: user})
+}
+
+// Length returns the number of entries.
+func (a *SSHSessionArray) Length() int {
+	return len(a.items)
+}
+
+// Get returns the entry at index i, or nil when out of range.
+func (a *SSHSessionArray) Get(i int) *SSHSessionEntry {
+	if i < 0 || i >= len(a.items) {
+		return nil
+	}
+	return a.items[i]
+}
+
+// SSHSessionStore reads and writes a profile's stored SSH sessions.
+type SSHSessionStore struct {
+	prefs prefsStore
+}
+
+// NewSSHSessionStore opens the session store of the given profile.
+func NewSSHSessionStore(configDir, profileID string) (*SSHSessionStore, error) {
+	prefs, err := newProfilePrefs(configDir, profileID)
+	if err != nil {
+		return nil, err
+	}
+	return &SSHSessionStore{prefs: prefs}, nil
+}
+
+// Load returns the stored sessions, oldest first.
+func (s *SSHSessionStore) Load() (*SSHSessionArray, error) {
+	var section sshSessionsSection
+	if _, err := s.prefs.Get(sshSessionsNamespace, &section); err != nil {
+		return nil, err
+	}
+
+	out := NewSSHSessionArray()
+	for _, record := range section.Sessions {
+		if record.ID == "" || record.Host == "" {
+			continue
+		}
+		out.Add(record.ID, record.Host, record.Port, record.User)
+	}
+	return out, nil
+}
+
+// Save replaces the stored sessions, keeping only the newest entries when the
+// list exceeds the storage cap.
+func (s *SSHSessionStore) Save(sessions *SSHSessionArray) error {
+	var items []*SSHSessionEntry
+	if sessions != nil {
+		items = sessions.items
+	}
+	if len(items) > maxStoredSSHSessions {
+		items = items[len(items)-maxStoredSSHSessions:]
+	}
+
+	records := make([]sshSessionRecord, 0, len(items))
+	for _, item := range items {
+		records = append(records, sshSessionRecord{ID: item.ID, Host: item.Host, Port: item.Port, User: item.User})
+	}
+	return s.prefs.Put(sshSessionsNamespace, sshSessionsSection{Sessions: records})
+}
diff --git a/client/anonymize/anonymize.go b/client/anonymize/anonymize.go
index c140cef89..c5d43ed55 100644
--- a/client/anonymize/anonymize.go
+++ b/client/anonymize/anonymize.go
@@ -2,6 +2,7 @@ package anonymize
 
 import (
 	"crypto/rand"
+	"encoding/base64"
 	"fmt"
 	"math/big"
 	"net"
@@ -15,13 +16,88 @@ import (
 
 const anonTLD = ".domain"
 
+// Level selects how much the anonymizer redacts. Levels are ordered: a higher
+// level redacts strictly more. On the wire (protos, flags) levels travel as
+// their string form.
+type Level int
+
+const (
+	// LevelDefault anonymizes public IP addresses, IPv6 ULA, domains, and MAC
+	// addresses. Internal IPv4 ranges (RFC 1918, CGNAT, link-local) are
+	// preserved so support can reason about the real topology.
+	LevelDefault Level = iota
+	// LevelStrict additionally anonymizes internal IP ranges, peer names, and
+	// WireGuard public keys.
+	LevelStrict
+)
+
+// LevelDefaultString and LevelStrictString are the wire forms of the levels,
+// for boundaries that pass levels as strings (flags, protos, mobile bindings).
+const (
+	LevelDefaultString = "default"
+	LevelStrictString  = "strict"
+)
+
+// ParseLevel maps s to a Level. Empty means LevelDefault; anything
+// unrecognized maps to LevelStrict so an unknown request never yields less
+// anonymization than intended.
+func ParseLevel(s string) Level {
+	switch strings.ToLower(s) {
+	case "", LevelDefaultString:
+		return LevelDefault
+	default:
+		return LevelStrict
+	}
+}
+
+// String returns the wire form of the level: "default" or "strict".
+func (l Level) String() string {
+	if l >= LevelStrict {
+		return LevelStrictString
+	}
+	return LevelDefaultString
+}
+
+// protectedDomains are NetBird-operated suffixes that stay recognizable in an
+// anonymized bundle. At LevelStrict the labels in front of them (the peer
+// name) are still replaced, except under netbird.io, which only hosts
+// NetBird infrastructure (api, signal, flow), never peer names.
+var protectedDomains = []string{"netbird.io", "netbird.selfhosted", "netbird.cloud", "netbird.stage"}
+
+const infraDomain = "netbird.io"
+
+var (
+	macColonRegex = regexp.MustCompile(`\b[0-9a-fA-F]{2}(?::[0-9a-fA-F]{2}){5}\b`)
+	macDashRegex  = regexp.MustCompile(`\b[0-9a-fA-F]{2}(?:-[0-9a-fA-F]{2}){5}\b`)
+	wgKeyRegex    = regexp.MustCompile(`\b[A-Za-z0-9+/]{43}=`)
+)
+
 type Anonymizer struct {
 	ipAnonymizer     map[netip.Addr]netip.Addr
 	domainAnonymizer map[string]string
-	currentAnonIPv4  netip.Addr
-	currentAnonIPv6  netip.Addr
-	startAnonIPv4    netip.Addr
-	startAnonIPv6    netip.Addr
+	// domainOrder caches the keys of domainAnonymizer sorted longest-first
+	// for AnonymizeString; it is rebuilt when the map gains entries.
+	domainOrder     []string
+	labelAnonymizer map[string]string
+	labelAnonymized map[string]struct{}
+	labelCounter    uint32
+	macAnonymizer   map[string]string
+	macCounter      uint32
+	wgKeyAnonymizer map[string]string
+	wgKeyAnonymized map[string]struct{}
+	currentAnonIPv4 netip.Addr
+	currentAnonIPv6 netip.Addr
+	startAnonIPv4   netip.Addr
+	startAnonIPv6   netip.Addr
+
+	// LevelStrict also anonymizes internal ranges (RFC 1918, CGNAT,
+	// link-local), replacing them from the dedicated internal pools below so
+	// a reader can still tell an internal address from a public one.
+	level                   Level
+	currentAnonInternalIPv4 netip.Addr
+	currentAnonInternalIPv6 netip.Addr
+	startAnonInternalIPv4   netip.Addr
+	startAnonInternalIPv6   netip.Addr
 
 	domainKeyRegex *regexp.Regexp
 }
@@ -32,25 +108,50 @@ func DefaultAddresses() (netip.Addr, netip.Addr) {
 	return netip.AddrFrom4([4]byte{198, 51, 100, 0}), netip.MustParseAddr("2001:db8:ffff::")
 }
 
+// InternalAddresses returns the pool starts used in strict mode for internal
+// ranges. Both are reserved ranges that cannot collide with real addressing:
+// 198.18.0.0 (RFC 2544 benchmarking), 2001:db8:1:: (RFC 3849 documentation).
+func InternalAddresses() (netip.Addr, netip.Addr) {
+	return netip.AddrFrom4([4]byte{198, 18, 0, 0}), netip.MustParseAddr("2001:db8:1::")
+}
+
 func NewAnonymizer(startIPv4, startIPv6 netip.Addr) *Anonymizer {
+	internalIPv4, internalIPv6 := InternalAddresses()
 	return &Anonymizer{
 		ipAnonymizer:     map[netip.Addr]netip.Addr{},
 		domainAnonymizer: map[string]string{},
+		labelAnonymizer:  map[string]string{},
+		labelAnonymized:  map[string]struct{}{},
+		macAnonymizer:    map[string]string{},
+		wgKeyAnonymizer:  map[string]string{},
+		wgKeyAnonymized:  map[string]struct{}{},
 		currentAnonIPv4:  startIPv4,
 		currentAnonIPv6:  startIPv6,
 		startAnonIPv4:    startIPv4,
 		startAnonIPv6:    startIPv6,
 
+		level:                   LevelDefault,
+		currentAnonInternalIPv4: internalIPv4,
+		currentAnonInternalIPv6: internalIPv6,
+		startAnonInternalIPv4:   internalIPv4,
+		startAnonInternalIPv6:   internalIPv6,
+
 		domainKeyRegex: regexp.MustCompile(`\bdomain=([^\s,:"]+)`),
 	}
 }
 
+// SetLevel selects the anonymization level. The zero value of a new
+// Anonymizer is LevelDefault.
+func (a *Anonymizer) SetLevel(level Level) {
+	a.level = level
+}
+
 func (a *Anonymizer) AnonymizeIP(ip netip.Addr) netip.Addr {
+	// Normalize 4-in-6 addresses so ::ffff:192.168.1.1 classifies and maps
+	// like 192.168.1.1.
+	ip = ip.Unmap()
+
 	if ip.IsLoopback() ||
-		ip.IsLinkLocalUnicast() ||
-		ip.IsLinkLocalMulticast() ||
-		ip.IsInterfaceLocalMulticast() ||
-		(ip.Is4() && ip.IsPrivate()) ||
 		ip.IsUnspecified() ||
 		ip.IsMulticast() ||
 		isWellKnown(ip) ||
@@ -59,18 +160,100 @@ func (a *Anonymizer) AnonymizeIP(ip netip.Addr) netip.Addr {
 		return ip
 	}
 
+	if isInternal(ip) && a.level < LevelStrict {
+		return ip
+	}
+
 	if _, ok := a.ipAnonymizer[ip]; !ok {
-		if ip.Is4() {
-			a.ipAnonymizer[ip] = a.currentAnonIPv4
-			a.currentAnonIPv4 = a.currentAnonIPv4.Next()
-		} else {
-			a.ipAnonymizer[ip] = a.currentAnonIPv6
-			a.currentAnonIPv6 = a.currentAnonIPv6.Next()
-		}
+		a.ipAnonymizer[ip] = a.nextAnonIP(ip)
 	}
 	return a.ipAnonymizer[ip]
 }
 
+func (a *Anonymizer) nextAnonIP(ip netip.Addr) netip.Addr {
+	// At the strict level, internal addresses (including IPv6 ULA, matched
+	// by IsPrivate) come from the internal pools so they remain recognizable
+	// as internal without disclosing the real values.
+	if a.level >= LevelStrict && (isInternal(ip) || ip.IsPrivate()) {
+		if ip.Is4() {
+			anon := a.currentAnonInternalIPv4
+			a.currentAnonInternalIPv4 = a.currentAnonInternalIPv4.Next()
+			return anon
+		}
+		anon := a.currentAnonInternalIPv6
+		a.currentAnonInternalIPv6 = a.currentAnonInternalIPv6.Next()
+		return anon
+	}
+
+	if ip.Is4() {
+		anon := a.currentAnonIPv4
+		a.currentAnonIPv4 = a.currentAnonIPv4.Next()
+		return anon
+	}
+	anon := a.currentAnonIPv6
+	a.currentAnonIPv6 = a.currentAnonIPv6.Next()
+	return anon
+}
+
+// AnonymizeMAC replaces a MAC address with a consistent placeholder from the
+// locally administered range starting at 02:00:00:00:00:01, at every
+// anonymization level. Broadcast, multicast, all-zero, and already assigned
+// placeholder addresses are preserved. The colon and dash spellings of the
+// same address share one placeholder; the output keeps the input's separator.
+func (a *Anonymizer) AnonymizeMAC(mac string) string {
+	hw, err := net.ParseMAC(mac)
+	if err != nil || len(hw) != 6 {
+		return mac
+	}
+
+	if isWellKnownMAC(hw) || a.isAnonymizedMAC(hw) {
+		return mac
+	}
+
+	key := hw.String()
+	anon, ok := a.macAnonymizer[key]
+	if !ok {
+		a.macCounter++
+		anon = fmt.Sprintf("02:00:00:%02x:%02x:%02x", byte(a.macCounter>>16), byte(a.macCounter>>8), byte(a.macCounter))
+		a.macAnonymizer[key] = anon
+	}
+
+	if strings.Contains(mac, "-") {
+		anon = strings.ReplaceAll(anon, ":", "-")
+	}
+	return anon
+}
+
+// isAnonymizedMAC reports whether hw is a placeholder this anonymizer already
+// handed out, so a second pass over anonymized output leaves it unchanged.
+func (a *Anonymizer) isAnonymizedMAC(hw net.HardwareAddr) bool {
+	if hw[0] != 0x02 || hw[1] != 0 || hw[2] != 0 {
+		return false
+	}
+	value := uint32(hw[3])<<16 | uint32(hw[4])<<8 | uint32(hw[5])
+	return value <= a.macCounter
+}
+
+// AnonymizeWGKey replaces a WireGuard public key with a consistent random
+// placeholder of the same shape. Keys are only anonymized at LevelStrict;
+// placeholders already handed out pass through unchanged.
+func (a *Anonymizer) AnonymizeWGKey(key string) string {
+	if a.level < LevelStrict || !looksLikeWGKey(key) {
+		return key
+	}
+	if _, ok := a.wgKeyAnonymized[key]; ok {
+		return key
+	}
+
+	anon, ok := a.wgKeyAnonymizer[key]
+	if !ok {
+		anon = generateAnonymousKey()
+		a.wgKeyAnonymizer[key] = anon
+		a.wgKeyAnonymized[anon] = struct{}{}
+	}
+	return anon
+}
+
 func (a *Anonymizer) AnonymizeUDPAddr(addr net.UDPAddr) net.UDPAddr {
 	// Convert IP to netip.Addr
 	ip, ok := netip.AddrFromSlice(addr.IP)
@@ -89,12 +272,12 @@ func (a *Anonymizer) AnonymizeUDPAddr(addr net.UDPAddr) net.UDPAddr {
 
 // isInAnonymizedRange checks if an IP is within the range of already assigned anonymized IPs
 func (a *Anonymizer) isInAnonymizedRange(ip netip.Addr) bool {
-	if ip.Is4() && ip.Compare(a.startAnonIPv4) >= 0 && ip.Compare(a.currentAnonIPv4) <= 0 {
-		return true
-	} else if !ip.Is4() && ip.Compare(a.startAnonIPv6) >= 0 && ip.Compare(a.currentAnonIPv6) <= 0 {
-		return true
+	if ip.Is4() {
+		return inPoolRange(ip, a.startAnonIPv4, a.currentAnonIPv4) ||
+			inPoolRange(ip, a.startAnonInternalIPv4, a.currentAnonInternalIPv4)
 	}
-	return false
+	return inPoolRange(ip, a.startAnonIPv6, a.currentAnonIPv6) ||
+		inPoolRange(ip, a.startAnonInternalIPv6, a.currentAnonInternalIPv6)
 }
 
 func (a *Anonymizer) AnonymizeIPString(ip string) string {
@@ -118,14 +301,23 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 		baseDomain = domain[:len(domain)-1]
 	}
 
-	if strings.HasSuffix(baseDomain, "netbird.io") ||
-		strings.HasSuffix(baseDomain, "netbird.selfhosted") ||
-		strings.HasSuffix(baseDomain, "netbird.cloud") ||
-		strings.HasSuffix(baseDomain, "netbird.stage") ||
-		strings.HasSuffix(baseDomain, anonTLD) {
+	if strings.HasSuffix(baseDomain, anonTLD) {
 		return domain
 	}
 
+	// A reverse zone names an address prefix, so it follows the address rules,
+	// which also keeps its digit labels intact.
+	if zone, ok := a.anonymizeReverseZone(baseDomain); ok {
+		return withTrailingDot(zone, hasDot)
+	}
+
+	if suffix := protectedSuffix(baseDomain); suffix != "" {
+		if a.level < LevelStrict || baseDomain == suffix || suffix == infraDomain {
+			return domain
+		}
+		return withTrailingDot(a.anonymizePeerName(baseDomain, suffix), hasDot)
+	}
+
 	parts := strings.Split(baseDomain, ".")
 	if len(parts) < 2 {
 		return domain
@@ -141,12 +333,53 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 	}
 
 	result := strings.Replace(baseDomain, baseForLookup, anonymized, 1)
-	if hasDot {
-		result += "."
+	if a.level >= LevelStrict && len(parts) > 2 {
+		prefix := strings.TrimSuffix(baseDomain, "."+baseForLookup)
+		result = a.anonymizeLabels(prefix, "host") + "." + anonymized
+		// The full mapping feeds AnonymizeString so seeded FQDNs are caught
+		// in log lines as a whole, labels included.
+		a.domainAnonymizer[baseDomain] = result
+	}
+	return withTrailingDot(result, hasDot)
+}
+
+// anonymizePeerName replaces the labels in front of a protected suffix with
+// numbered peer placeholders, keeping the suffix, and records the full
+// mapping for string replacement in logs. The numbering keeps a peer
+// recognizable across the whole bundle without disclosing its name.
+func (a *Anonymizer) anonymizePeerName(baseDomain, suffix string) string {
+	prefix := strings.TrimSuffix(baseDomain, "."+suffix)
+	result := a.anonymizeLabels(prefix, "peer") + "." + suffix
+	if result != baseDomain {
+		a.domainAnonymizer[baseDomain] = result
 	}
 	return result
 }
 
+// anonymizeLabels replaces each dot-separated label with a consistent
+// numbered placeholder ("<placeholder>-<n>"). Wildcard labels and
+// placeholders already handed out pass through unchanged.
+func (a *Anonymizer) anonymizeLabels(prefix, placeholder string) string {
+	labels := strings.Split(prefix, ".")
+	for i, label := range labels {
+		if label == "*" {
+			continue
+		}
+		if _, ok := a.labelAnonymized[label]; ok {
+			continue
+		}
+		anon, ok := a.labelAnonymizer[label]
+		if !ok {
+			a.labelCounter++
+			anon = fmt.Sprintf("%s-%d", placeholder, a.labelCounter)
+			a.labelAnonymizer[label] = anon
+			a.labelAnonymized[anon] = struct{}{}
+		}
+		labels[i] = anon
+	}
+	return strings.Join(labels, ".")
+}
+
 func (a *Anonymizer) AnonymizeURI(uri string) string {
 	u, err := url.Parse(uri)
 	if err != nil {
@@ -178,17 +411,75 @@ func (a *Anonymizer) AnonymizeString(str string) string {
 	ipv4Regex := regexp.MustCompile(`\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b`)
 	ipv6Regex := regexp.MustCompile(`\b([0-9a-fA-F:]+:+[0-9a-fA-F]{0,4})(?:%[0-9a-zA-Z]+)?(?:\/[0-9]{1,3})?(?::[0-9]{1,5})?\b`)
 
+	// Reverse zones go first and are then held out of the passes below: their
+	// labels are digits, which the address patterns would otherwise consume.
+	str, restoreZones := a.replaceReverseZones(str)
+
 	str = ipv4Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 	str = ipv6Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 
-	for domain, anonDomain := range a.domainAnonymizer {
-		str = strings.ReplaceAll(str, domain, anonDomain)
+	for _, domain := range a.sortedDomains() {
+		str = strings.ReplaceAll(str, domain, a.domainAnonymizer[domain])
 	}
 
 	str = a.AnonymizeSchemeURI(str)
 	str = a.AnonymizeDNSLogLine(str)
 
-	return str
+	// MAC handling runs after the IP passes so preserved IPv6 addresses are
+	// already out of the way; the separator guard skips matches embedded in a
+	// longer colon- or dash-separated sequence (such as an IPv6 tail).
+	str = a.anonymizeMACsInString(str, macColonRegex, ':')
+	str = a.anonymizeMACsInString(str, macDashRegex, '-')
+
+	if a.level >= LevelStrict {
+		str = wgKeyRegex.ReplaceAllStringFunc(str, a.AnonymizeWGKey)
+	}
+
+	return restoreZones(str)
+}
+
+// sortedDomains returns the domain mappings longest-first, so a full-FQDN
+// mapping (strict level) is applied before the base-domain mapping it
+// contains. The order is rebuilt only when domainAnonymizer has grown.
+func (a *Anonymizer) sortedDomains() []string {
+	if len(a.domainOrder) == len(a.domainAnonymizer) {
+		return a.domainOrder
+	}
+
+	a.domainOrder = a.domainOrder[:0]
+	for domain := range a.domainAnonymizer {
+		a.domainOrder = append(a.domainOrder, domain)
+	}
+	slices.SortFunc(a.domainOrder, func(x, y string) int {
+		if d := len(y) - len(x); d != 0 {
+			return d
+		}
+		return strings.Compare(x, y)
+	})
+	return a.domainOrder
+}
+
+// anonymizeMACsInString replaces MAC addresses matched by re, skipping
+// matches that directly adjoin another sep so a six-group run inside a longer
+// separated sequence is left alone.
+func (a *Anonymizer) anonymizeMACsInString(str string, re *regexp.Regexp, sep byte) string {
+	matches := re.FindAllStringIndex(str, -1)
+	if len(matches) == 0 {
+		return str
+	}
+
+	var b strings.Builder
+	last := 0
+	for _, m := range matches {
+		if (m[0] > 0 && str[m[0]-1] == sep) || (m[1] < len(str) && str[m[1]] == sep) {
+			continue
+		}
+		b.WriteString(str[last:m[0]])
+		b.WriteString(a.AnonymizeMAC(str[m[0]:m[1]]))
+		last = m[1]
+	}
+	b.WriteString(str[last:])
+	return b.String()
 }
 
 // AnonymizeSchemeURI finds and anonymizes URIs with ws, wss, rel, rels, stun, stuns, turn, and turns schemes.
@@ -239,10 +530,79 @@ func isWellKnown(addr netip.Addr) bool {
 		"128.0.0.0", "8000::", // 2nd split subnet for default routes
 	}
 
-	if slices.Contains(wellKnown, addr.String()) {
+	return slices.Contains(wellKnown, addr.String())
+}
+
+// isInternal reports whether ip identifies a host only within the local
+// network: IPv4 private (RFC 1918), CGNAT (RFC 6598), and link-local (v4 and
+// v6). These are preserved at the default level so support can reason about
+// the real topology, and replaced from the internal pools at the strict
+// level. IPv6 ULA is deliberately not internal: its random global ID uniquely
+// fingerprints the network, so it is anonymized at every level.
+func isInternal(ip netip.Addr) bool {
+	return (ip.Is4() && ip.IsPrivate()) ||
+		ip.IsLinkLocalUnicast() ||
+		isCGNAT(ip)
+}
+
+func inPoolRange(ip, start, current netip.Addr) bool {
+	return ip.Compare(start) >= 0 && ip.Compare(current) <= 0
+}
+
+// isWellKnownMAC reports whether hw carries no stable host identity: all-zero
+// or a group address (broadcast and multicast).
+func isWellKnownMAC(hw net.HardwareAddr) bool {
+	if hw[0]&1 == 1 {
 		return true
 	}
+	for _, b := range hw {
+		if b != 0 {
+			return false
+		}
+	}
+	return true
+}
 
+// looksLikeWGKey reports whether s has the shape of a WireGuard key:
+// 44 base64 characters decoding to 32 bytes.
+func looksLikeWGKey(s string) bool {
+	if len(s) != 44 || s[43] != '=' {
+		return false
+	}
+	decoded, err := base64.StdEncoding.DecodeString(s)
+	return err == nil && len(decoded) == 32
+}
+
+func generateAnonymousKey() string {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return strings.Repeat("A", 43) + "="
+	}
+	return base64.StdEncoding.EncodeToString(buf)
+}
+
+// protectedSuffix returns the protected NetBird suffix baseDomain ends with,
+// or empty. The match is label-anchored so an unrelated domain that merely
+// ends in the same characters is not preserved.
+func protectedSuffix(baseDomain string) string {
+	for _, d := range protectedDomains {
+		if baseDomain == d || strings.HasSuffix(baseDomain, "."+d) {
+			return d
+		}
+	}
+	return ""
+}
+
+func withTrailingDot(domain string, hasDot bool) string {
+	if hasDot {
+		return domain + "."
+	}
+	return domain
+}
+
+// isCGNAT reports whether addr is in 100.64.0.0/10 (RFC 6598), the range
+// NetBird assigns overlay peer addresses from.
+func isCGNAT(addr netip.Addr) bool {
 	cgnatRangeStart := netip.AddrFrom4([4]byte{100, 64, 0, 0})
 	cgnatRange := netip.PrefixFrom(cgnatRangeStart, 10)
 
diff --git a/client/anonymize/anonymize_test.go b/client/anonymize/anonymize_test.go
index 852315fa1..7c3c7bcf8 100644
--- a/client/anonymize/anonymize_test.go
+++ b/client/anonymize/anonymize_test.go
@@ -1,8 +1,11 @@
 package anonymize_test
 
 import (
+	"bytes"
+	"encoding/base64"
 	"net/netip"
 	"regexp"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -44,6 +47,301 @@ func TestAnonymizeIP(t *testing.T) {
 	}
 }
 
+func TestParseLevel(t *testing.T) {
+	tests := []struct {
+		input  string
+		expect anonymize.Level
+	}{
+		{"", anonymize.LevelDefault},
+		{"default", anonymize.LevelDefault},
+		{"DEFAULT", anonymize.LevelDefault},
+		{"strict", anonymize.LevelStrict},
+		{"STRICT", anonymize.LevelStrict},
+		// Unknown values must never yield less anonymization than requested.
+		{"garbage", anonymize.LevelStrict},
+	}
+
+	for _, tc := range tests {
+		t.Run("input="+tc.input, func(t *testing.T) {
+			assert.Equal(t, tc.expect, anonymize.ParseLevel(tc.input), "parsed level should match")
+		})
+	}
+}
+
+func TestAnonymizeIP_DefaultLevelInternalRanges(t *testing.T) {
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+
+	tests := []struct {
+		name   string
+		ip     string
+		expect string
+	}{
+		{"RFC1918 10/8", "10.1.2.3", "10.1.2.3"},
+		{"RFC1918 172.16/12", "172.16.5.5", "172.16.5.5"},
+		{"RFC1918 192.168/16", "192.168.1.1", "192.168.1.1"},
+		{"CGNAT", "100.64.0.5", "100.64.0.5"},
+		{"IPv4 link-local", "169.254.1.1", "169.254.1.1"},
+		{"IPv6 link-local", "fe80::1", "fe80::1"},
+		// ULA is anonymized even at the default level: its random global ID
+		// uniquely fingerprints the network, unlike shared RFC 1918 space.
+		{"IPv6 ULA", "fd12:3456:789a::1", "2001:db8:ffff::"},
+		// 4-in-6 addresses classify like their unmapped IPv4 form.
+		{"4-in-6 RFC1918", "::ffff:192.168.1.1", "192.168.1.1"},
+		{"4-in-6 CGNAT", "::ffff:100.64.0.5", "100.64.0.5"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			result := anonymizer.AnonymizeIP(netip.MustParseAddr(tc.ip))
+			assert.Equal(t, tc.expect, result.String(), "default level should preserve internal ranges except ULA")
+		})
+	}
+}
+
+func TestAnonymizeIP_StrictLevel(t *testing.T) {
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+	anonymizer.SetLevel(anonymize.LevelStrict)
+
+	// Order matters: internal pool addresses are assigned sequentially.
+	tests := []struct {
+		name   string
+		ip     string
+		expect string
+	}{
+		{"RFC1918 192.168/16", "192.168.1.1", "198.18.0.0"},
+		{"Second RFC1918", "192.168.1.2", "198.18.0.1"},
+		{"Repeated RFC1918", "192.168.1.1", "198.18.0.0"},
+		{"RFC1918 10/8", "10.1.2.3", "198.18.0.2"},
+		{"RFC1918 172.16/12", "172.16.5.5", "198.18.0.3"},
+		{"CGNAT", "100.64.0.5", "198.18.0.4"},
+		{"IPv4 link-local", "169.254.1.1", "198.18.0.5"},
+		{"Public IPv4 uses public pool", "1.2.3.4", "198.51.100.0"},
+		{"IPv6 link-local", "fe80::1", "2001:db8:1::"},
+		{"IPv6 ULA", "fd12:3456:789a::1", "2001:db8:1::1"},
+		{"Public IPv6 uses public pool", "2607:f8b0:4005:805::200e", "2001:db8:ffff::"},
+		{"Loopback IPv4", "127.0.0.1", "127.0.0.1"},
+		{"Loopback IPv6", "::1", "::1"},
+		{"Unspecified", "0.0.0.0", "0.0.0.0"},
+		{"Multicast", "224.0.0.251", "224.0.0.251"},
+		{"Well known resolver", "8.8.8.8", "8.8.8.8"},
+		{"Well known split marker", "128.0.0.0", "128.0.0.0"},
+		{"In internal pool range", "198.18.0.3", "198.18.0.3"},
+		{"In public pool range", "198.51.100.0", "198.51.100.0"},
+		{"4-in-6 repeated RFC1918", "::ffff:192.168.1.1", "198.18.0.0"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			result := anonymizer.AnonymizeIP(netip.MustParseAddr(tc.ip))
+			assert.Equal(t, tc.expect, result.String(), "strict level should replace internal ranges from the internal pools")
+		})
+	}
+}
+
+func TestAnonymizeString_StrictInternalIPs(t *testing.T) {
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+	anonymizer.SetLevel(anonymize.LevelStrict)
+
+	input := "route 10.20.30.0/24 via 192.168.1.1 dev eth0 src 100.64.0.7"
+	firstPass := anonymizer.AnonymizeString(input)
+	secondPass := anonymizer.AnonymizeString(firstPass)
+
+	assert.NotContains(t, firstPass, "10.20.30.0", "private network address should be anonymized")
+	assert.NotContains(t, firstPass, "192.168.1.1", "private gateway should be anonymized")
+	assert.NotContains(t, firstPass, "100.64.0.7", "CGNAT address should be anonymized")
+	assert.Contains(t, firstPass, "/24", "prefix length should be preserved")
+	assert.Equal(t, firstPass, secondPass, "second pass should not further anonymize the string")
+}
+
+func TestAnonymizeMAC(t *testing.T) {
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+
+	first := anonymizer.AnonymizeMAC("aa:bb:cc:dd:ee:0f")
+	assert.Equal(t, "02:00:00:00:00:01", first, "first MAC should get the first placeholder")
+	assert.Equal(t, first, anonymizer.AnonymizeMAC("aa:bb:cc:dd:ee:0f"), "repeated MAC should map to the same placeholder")
+	assert.Equal(t, first, anonymizer.AnonymizeMAC("AA:BB:CC:DD:EE:0F"), "case should not affect the mapping")
+	assert.Equal(t, "02-00-00-00-00-01", anonymizer.AnonymizeMAC("AA-BB-CC-DD-EE-0F"), "dash form should keep its separator but share the mapping")
+
+	second := anonymizer.AnonymizeMAC("10:22:33:44:55:66")
+	assert.Equal(t, "02:00:00:00:00:02", second, "second distinct MAC should get the next placeholder")
+
+	tests := []struct {
+		name string
+		mac  string
+	}{
+		{"Broadcast", "ff:ff:ff:ff:ff:ff"},
+		{"IPv4 multicast", "01:00:5e:00:00:fb"},
+		{"IPv6 multicast", "33:33:00:00:00:01"},
+		{"All zero", "00:00:00:00:00:00"},
+		{"Assigned placeholder", "02:00:00:00:00:01"},
+		{"Invalid", "not-a-mac"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.mac, anonymizer.AnonymizeMAC(tc.mac), "should be preserved")
+		})
+	}
+}
+
+func TestAnonymizeString_MACAddresses(t *testing.T) {
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+
+	tests := []struct {
+		name   string
+		input  string
+		expect string
+	}{
+		{
+			name:   "nftables ether rule",
+			input:  "ether saddr aa:bb:cc:dd:ee:ff drop",
+			expect: "ether saddr 02:00:00:00:00:01 drop",
+		},
+		{
+			name:   "Windows dash form",
+			input:  "Physical Address : AA-BB-CC-DD-EE-FF",
+			expect: "Physical Address : 02-00-00-00-00-01",
+		},
+		{
+			name:   "IPv6 address tail is not treated as MAC",
+			input:  "addr fe80:0:11:22:33:44:55:66 scope link",
+			expect: "addr fe80:0:11:22:33:44:55:66 scope link",
+		},
+		{
+			name:   "broadcast MAC preserved",
+			input:  "dst ff:ff:ff:ff:ff:ff type ARP",
+			expect: "dst ff:ff:ff:ff:ff:ff type ARP",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			result := anonymizer.AnonymizeString(tc.input)
+			assert.Equal(t, tc.expect, result, "MAC addresses should be anonymized at every level")
+			assert.Equal(t, result, anonymizer.AnonymizeString(result), "second pass should not change the result")
+		})
+	}
+}
+
+func TestAnonymizeWGKey(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0x42}, 32))
+
+	t.Run("default level preserves keys", func(t *testing.T) {
+		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+		assert.Equal(t, key, anonymizer.AnonymizeWGKey(key), "default level should not touch WireGuard keys")
+	})
+
+	t.Run("strict level replaces keys", func(t *testing.T) {
+		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+		anonymizer.SetLevel(anonymize.LevelStrict)
+
+		anon := anonymizer.AnonymizeWGKey(key)
+		assert.NotEqual(t, key, anon, "strict level should replace the key")
+		assert.Regexp(t, `^[A-Za-z0-9+/]{43}=$`, anon, "placeholder should keep the WireGuard key shape")
+		assert.Equal(t, anon, anonymizer.AnonymizeWGKey(key), "repeated key should map to the same placeholder")
+		assert.Equal(t, anon, anonymizer.AnonymizeWGKey(anon), "an assigned placeholder should pass through unchanged")
+
+		assert.Equal(t, "not-a-key", anonymizer.AnonymizeWGKey("not-a-key"), "non-key values should be preserved")
+	})
+}
+
+func TestAnonymizeString_WGKeys(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0x42}, 32))
+	input := "peer " + key + " handshake completed"
+
+	t.Run("default level preserves keys", func(t *testing.T) {
+		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+		assert.Equal(t, input, anonymizer.AnonymizeString(input), "default level should not touch WireGuard keys in strings")
+	})
+
+	t.Run("strict level replaces keys", func(t *testing.T) {
+		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+		anonymizer.SetLevel(anonymize.LevelStrict)
+
+		firstPass := anonymizer.AnonymizeString(input)
+		assert.NotContains(t, firstPass, key, "the key should not survive strict anonymization")
+		assert.Equal(t, anonymizer.AnonymizeWGKey(key), extractKey(t, firstPass), "string replacement should be consistent with AnonymizeWGKey")
+		assert.Equal(t, firstPass, anonymizer.AnonymizeString(firstPass), "second pass should not change the result")
+	})
+}
+
+func extractKey(t *testing.T, logLine string) string {
+	t.Helper()
+	fields := strings.Fields(logLine)
+	require.Len(t, fields, 4, "log line should keep its structure")
+	return fields[1]
+}
+
+func TestAnonymizeDomain_StrictLevel(t *testing.T) {
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+	anonymizer.SetLevel(anonymize.LevelStrict)
+
+	t.Run("netbird peer name", func(t *testing.T) {
+		result := anonymizer.AnonymizeDomain("my-laptop.netbird.cloud")
+		assert.Regexp(t, `^peer-\d+\.netbird\.cloud$`, result, "peer name should be anonymized, suffix kept")
+		assert.NotContains(t, result, "my-laptop", "the peer name should not survive")
+		assert.Equal(t, result, anonymizer.AnonymizeDomain("my-laptop.netbird.cloud"), "repeated domain should map consistently")
+		assert.Equal(t, result, anonymizer.AnonymizeDomain(result), "an anonymized domain should pass through unchanged")
+	})
+
+	t.Run("bare netbird domain", func(t *testing.T) {
+		assert.Equal(t, "netbird.cloud", anonymizer.AnonymizeDomain("netbird.cloud"), "the bare protected suffix should be preserved")
+	})
+
+	t.Run("netbird infrastructure preserved", func(t *testing.T) {
+		assert.Equal(t, "api.netbird.io", anonymizer.AnonymizeDomain("api.netbird.io"),
+			"netbird.io hosts infrastructure, not peer names, and should stay readable")
+	})
+
+	t.Run("leading labels of other domains", func(t *testing.T) {
+		result := anonymizer.AnonymizeDomain("host1.corp.example.com")
+		assert.Regexp(t, `^host-\d+\.host-\d+\.anon-[a-zA-Z0-9]+\.domain$`, result, "every label should be anonymized")
+		for _, label := range []string{"host1", "corp", "example"} {
+			assert.NotContains(t, result, label, "no original label should survive")
+		}
+		assert.Equal(t, result, anonymizer.AnonymizeDomain("host1.corp.example.com"), "repeated domain should map consistently")
+	})
+
+	t.Run("same label maps consistently across domains", func(t *testing.T) {
+		first := anonymizer.AnonymizeDomain("shared.one.com")
+		second := anonymizer.AnonymizeDomain("shared.two.com")
+		assert.Equal(t, strings.Split(first, ".")[0], strings.Split(second, ".")[0], "the shared host label should get one placeholder")
+	})
+
+	t.Run("wildcard label preserved", func(t *testing.T) {
+		result := anonymizer.AnonymizeDomain("*.example.com")
+		assert.Regexp(t, `^\*\.anon-[a-zA-Z0-9]+\.domain$`, result, "the wildcard label should stay a wildcard")
+	})
+}
+
+func TestAnonymizeDomain_DefaultLevelKeepsPeerNames(t *testing.T) {
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+
+	assert.Equal(t, "my-laptop.netbird.cloud", anonymizer.AnonymizeDomain("my-laptop.netbird.cloud"),
+		"default level should preserve netbird FQDNs including the peer name")
+	assert.Regexp(t, `^sub\.anon-[a-zA-Z0-9]+\.domain$`, anonymizer.AnonymizeDomain("sub.example.com"),
+		"default level should keep subdomain labels")
+}
+
+func TestAnonymizeString_StrictPeerNames(t *testing.T) {
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+	anonymizer.SetLevel(anonymize.LevelStrict)
+
+	// Seed like the bundle generator does from the status: base first, then
+	// the full FQDN, so replacement must prefer the longer mapping.
+	anonBase := anonymizer.AnonymizeDomain("example.com")
+	anonPeer := anonymizer.AnonymizeDomain("peer1.netbird.cloud")
+	anonHost := anonymizer.AnonymizeDomain("host1.example.com")
+
+	logLine := "connected to peer1.netbird.cloud via host1.example.com endpoint"
+	firstPass := anonymizer.AnonymizeString(logLine)
+	assert.NotContains(t, firstPass, "peer1", "the peer name should not survive in logs")
+	assert.NotContains(t, firstPass, "host1", "the host label should not survive in logs")
+	assert.Contains(t, firstPass, anonPeer, "the seeded peer mapping should be applied")
+	assert.Contains(t, firstPass, anonHost, "the seeded host mapping should be applied, not just the base mapping")
+	assert.NotContains(t, firstPass, "host1."+anonBase, "the base mapping must not preempt the longer FQDN mapping")
+	assert.Equal(t, firstPass, anonymizer.AnonymizeString(firstPass), "second pass should not change the result")
+}
+
 func TestAnonymizeDNSLogLine(t *testing.T) {
 	anonymizer := anonymize.NewAnonymizer(netip.Addr{}, netip.Addr{})
 	tests := []struct {
diff --git a/client/anonymize/reverse_zone.go b/client/anonymize/reverse_zone.go
new file mode 100644
index 000000000..b521b71b7
--- /dev/null
+++ b/client/anonymize/reverse_zone.go
@@ -0,0 +1,174 @@
+package anonymize
+
+import (
+	"encoding/hex"
+	"net/netip"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+const (
+	reverseZoneSuffixV4 = ".in-addr.arpa"
+	reverseZoneSuffixV6 = ".ip6.arpa"
+
+	v6Nibbles = 32
+	v4Octets  = 4
+)
+
+// reverseZoneRegexes match a reverse zone or a full reverse name in free text.
+// They are applied before the address passes of AnonymizeString, whose IPv4
+// pattern would otherwise consume the digit labels of a zone and replace parts
+// of it with unrelated addresses.
+var reverseZoneRegexes = []*regexp.Regexp{
+	regexp.MustCompile(`(?:[0-9]{1,3}\.){1,4}in-addr\.arpa\b`),
+	regexp.MustCompile(`(?:[0-9a-fA-F]\.){1,32}ip6\.arpa\b`),
+}
+
+// anonymizeReverseZone maps a reverse zone to the zone of the anonymized form
+// of the prefix it encodes, so it follows the address rules rather than the
+// domain ones: the zone of an address that is preserved is preserved too, and
+// the zone of one that is replaced names the replacement. This keeps a reverse
+// zone recognizable as such, and consistent with the addresses it belongs to
+// elsewhere in the same output. It reports false for anything that is not a
+// reverse zone.
+func (a *Anonymizer) anonymizeReverseZone(domain string) (string, bool) {
+	prefix, labelCount, suffix, ok := parseReverseZone(domain)
+	if !ok {
+		return "", false
+	}
+
+	anonymized := a.AnonymizeIP(prefix)
+	if anonymized == prefix {
+		return domain, true
+	}
+
+	return reverseZoneName(anonymized, labelCount) + suffix, true
+}
+
+// replaceReverseZones anonymizes every reverse zone in str and swaps each one
+// for a placeholder, returning a function that puts the anonymized zones back.
+// The placeholders carry no dots, digits or colons, so no later pass matches
+// them.
+func (a *Anonymizer) replaceReverseZones(str string) (string, func(string) string) {
+	var zones []string
+
+	for _, re := range reverseZoneRegexes {
+		str = re.ReplaceAllStringFunc(str, func(match string) string {
+			zone, ok := a.anonymizeReverseZone(match)
+			if !ok {
+				return match
+			}
+
+			zones = append(zones, zone)
+			return reverseZonePlaceholder(len(zones) - 1)
+		})
+	}
+
+	if len(zones) == 0 {
+		return str, func(s string) string { return s }
+	}
+
+	return str, func(s string) string {
+		for i, zone := range zones {
+			s = strings.ReplaceAll(s, reverseZonePlaceholder(i), zone)
+		}
+		return s
+	}
+}
+
+func reverseZonePlaceholder(index int) string {
+	return "\x00reversezone" + strconv.Itoa(index) + "\x00"
+}
+
+// parseReverseZone turns a reverse zone into the address of the prefix its
+// labels spell backwards, padding the absent low-order part with zeroes, and
+// returns the label count and zone suffix so the name can be rebuilt.
+func parseReverseZone(domain string) (netip.Addr, int, string, bool) {
+	lower := strings.ToLower(domain)
+
+	switch {
+	case strings.HasSuffix(lower, reverseZoneSuffixV4):
+		labels := strings.Split(strings.TrimSuffix(lower, reverseZoneSuffixV4), ".")
+		addr, ok := reverseZoneAddrV4(labels)
+		return addr, len(labels), reverseZoneSuffixV4, ok
+	case strings.HasSuffix(lower, reverseZoneSuffixV6):
+		labels := strings.Split(strings.TrimSuffix(lower, reverseZoneSuffixV6), ".")
+		addr, ok := reverseZoneAddrV6(labels)
+		return addr, len(labels), reverseZoneSuffixV6, ok
+	default:
+		return netip.Addr{}, 0, "", false
+	}
+}
+
+func reverseZoneAddrV4(labels []string) (netip.Addr, bool) {
+	if len(labels) == 0 || len(labels) > v4Octets {
+		return netip.Addr{}, false
+	}
+
+	var octets [v4Octets]byte
+	for i, label := range labels {
+		octet, err := strconv.ParseUint(label, 10, 8)
+		if err != nil {
+			return netip.Addr{}, false
+		}
+		octets[len(labels)-1-i] = byte(octet)
+	}
+
+	return netip.AddrFrom4(octets), true
+}
+
+func reverseZoneAddrV6(labels []string) (netip.Addr, bool) {
+	if len(labels) == 0 || len(labels) > v6Nibbles {
+		return netip.Addr{}, false
+	}
+
+	nibbles := make([]byte, 0, v6Nibbles)
+	for i := len(labels) - 1; i >= 0; i-- {
+		if len(labels[i]) != 1 || !isHexDigit(labels[i][0]) {
+			return netip.Addr{}, false
+		}
+		nibbles = append(nibbles, labels[i][0])
+	}
+	for len(nibbles) < v6Nibbles {
+		nibbles = append(nibbles, '0')
+	}
+
+	var groups []string
+	for i := 0; i < len(nibbles); i += 4 {
+		groups = append(groups, string(nibbles[i:i+4]))
+	}
+
+	addr, err := netip.ParseAddr(strings.Join(groups, ":"))
+	if err != nil {
+		return netip.Addr{}, false
+	}
+
+	return addr, true
+}
+
+// reverseZoneName spells the first labelCount labels of addr backwards, the
+// inverse of parseReverseZone, without the zone suffix.
+func reverseZoneName(addr netip.Addr, labelCount int) string {
+	labels := make([]string, 0, labelCount)
+
+	if addr.Is4() {
+		octets := addr.As4()
+		for i := labelCount - 1; i >= 0; i-- {
+			labels = append(labels, strconv.Itoa(int(octets[i])))
+		}
+		return strings.Join(labels, ".")
+	}
+
+	address := addr.As16()
+	nibbles := hex.EncodeToString(address[:])
+	for i := labelCount - 1; i >= 0; i-- {
+		labels = append(labels, string(nibbles[i]))
+	}
+
+	return strings.Join(labels, ".")
+}
+
+func isHexDigit(c byte) bool {
+	return c >= '0' && c <= '9' || c >= 'a' && c <= 'f' || c >= 'A' && c <= 'F'
+}
diff --git a/client/anonymize/reverse_zone_test.go b/client/anonymize/reverse_zone_test.go
new file mode 100644
index 000000000..8c3b8954a
--- /dev/null
+++ b/client/anonymize/reverse_zone_test.go
@@ -0,0 +1,171 @@
+package anonymize
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newLeveledAnonymizer(level Level) *Anonymizer {
+	a := NewAnonymizer(DefaultAddresses())
+	a.SetLevel(level)
+	return a
+}
+
+// TestAnonymizeDomainReverseZone covers reverse zones going through the address
+// rules instead of the domain ones, so a zone stays a zone and an address that
+// is preserved keeps the zone that names it.
+func TestAnonymizeDomainReverseZone(t *testing.T) {
+	// 100.64.0.0/10 is the overlay range, which is CGNAT: preserved at the
+	// default level and replaced from the internal pool at the strict one
+	const overlayZone = "64.100.in-addr.arpa"
+
+	t.Run("overlay zone preserved at the default level", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelDefault)
+		assert.Equal(t, overlayZone, a.AnonymizeDomain(overlayZone), "should keep the zone of a preserved address")
+	})
+
+	t.Run("private zone preserved at the default level", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelDefault)
+		assert.Equal(t, "168.192.in-addr.arpa", a.AnonymizeDomain("168.192.in-addr.arpa"), "should keep the zone of a private address")
+	})
+
+	t.Run("overlay zone replaced at the strict level", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelStrict)
+
+		got := a.AnonymizeDomain(overlayZone)
+		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV4), "should stay a reverse zone, got %q", got)
+		assert.NotEqual(t, overlayZone, got, "should replace the encoded prefix")
+		assert.Len(t, strings.Split(strings.TrimSuffix(got, reverseZoneSuffixV4), "."), 2,
+			"should keep the label count, got %q", got)
+	})
+
+	t.Run("public zone replaced at the default level", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelDefault)
+
+		got := a.AnonymizeDomain("113.0.203.in-addr.arpa")
+		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV4), "should stay a reverse zone, got %q", got)
+		assert.NotEqual(t, "113.0.203.in-addr.arpa", got, "should replace a public prefix")
+	})
+
+	t.Run("zone of an address keeps that address mapping", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelDefault)
+
+		anonymizedAddr := a.AnonymizeIPString("203.0.113.7")
+		got := a.AnonymizeDomain("7.113.0.203.in-addr.arpa")
+
+		octets := strings.Split(anonymizedAddr, ".")
+		want := octets[3] + "." + octets[2] + "." + octets[1] + "." + octets[0] + reverseZoneSuffixV4
+		assert.Equal(t, want, got, "should name the same replacement as the address itself")
+	})
+
+	t.Run("ipv6 nibble labels stay single digits", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelDefault)
+
+		zone := "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6
+		got := a.AnonymizeDomain(zone)
+
+		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV6), "should stay a reverse zone, got %q", got)
+		labels := strings.Split(strings.TrimSuffix(got, reverseZoneSuffixV6), ".")
+		assert.Len(t, labels, 28, "should keep every nibble label, got %q", got)
+		for _, label := range labels {
+			assert.Len(t, label, 1, "nibble label %q should stay a single digit", label)
+		}
+	})
+
+	t.Run("trailing dot is kept", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelDefault)
+		assert.Equal(t, "64.100.in-addr.arpa.", a.AnonymizeDomain("64.100.in-addr.arpa."), "should keep the trailing dot")
+	})
+
+	t.Run("a domain that only looks like a zone is anonymized as a domain", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelDefault)
+
+		got := a.AnonymizeDomain("not-a-zone.in-addr.arpa")
+		assert.NotContains(t, got, "in-addr.arpa", "should fall back to domain anonymization")
+	})
+}
+
+// TestAnonymizeStringReverseZone verifies that a zone inside free text, such as
+// a DNS log line, is not chewed up by the address passes. The IPv4 pattern
+// matches any run of dotted digits, which a reverse zone is made of.
+func TestAnonymizeStringReverseZone(t *testing.T) {
+	t.Run("ipv6 zone survives the address passes", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelDefault)
+
+		zone := "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6
+		got := a.AnonymizeString("question: domain=" + zone + " type=PTR")
+
+		assert.Contains(t, got, "type=PTR", "should keep the rest of the line")
+		assert.NotContains(t, got, "198.51.100", "should not rewrite nibble labels as an address")
+
+		labels := strings.Split(strings.TrimSuffix(strings.TrimPrefix(got, "question: domain="), reverseZoneSuffixV6+" type=PTR"), ".")
+		assert.Len(t, labels, 28, "should keep every nibble label, got %q", got)
+	})
+
+	t.Run("preserved ipv4 zone is untouched", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelDefault)
+
+		line := "reverse zone 64.100.in-addr.arpa registered"
+		assert.Equal(t, line, a.AnonymizeString(line), "should keep the zone of a preserved address")
+	})
+
+	t.Run("public ipv4 zone is replaced consistently", func(t *testing.T) {
+		a := newLeveledAnonymizer(LevelDefault)
+
+		got := a.AnonymizeString("zone 113.0.203.in-addr.arpa and address 203.0.113.7")
+		assert.NotContains(t, got, "113.0.203.in-addr.arpa", "should replace the zone")
+		assert.NotContains(t, got, "203.0.113.7", "should replace the address")
+		assert.Contains(t, got, reverseZoneSuffixV4, "should keep the zone suffix")
+	})
+}
+
+func TestParseReverseZone(t *testing.T) {
+	tests := []struct {
+		name   string
+		zone   string
+		addr   string
+		labels int
+	}{
+		{name: "v4 two labels", zone: "0.100" + reverseZoneSuffixV4, addr: "100.0.0.0", labels: 2},
+		{name: "v4 three labels", zone: "1.168.192" + reverseZoneSuffixV4, addr: "192.168.1.0", labels: 3},
+		{name: "v4 full address", zone: "7.113.0.203" + reverseZoneSuffixV4, addr: "203.0.113.7", labels: 4},
+		{
+			name:   "v6 prefix",
+			zone:   "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6,
+			addr:   "2::",
+			labels: 28,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			addr, labels, suffix, ok := parseReverseZone(tc.zone)
+			require.True(t, ok, "should decode the reverse zone")
+			assert.Equal(t, tc.addr, addr.String(), "should decode to the encoded prefix")
+			assert.Equal(t, tc.labels, labels, "should count the labels")
+			assert.Equal(t, tc.zone, reverseZoneName(addr, labels)+suffix, "should re-encode to the original zone")
+		})
+	}
+}
+
+func TestParseReverseZoneRejectsNonZones(t *testing.T) {
+	tests := []string{
+		"example.com",
+		"in-addr.arpa",
+		"x.100" + reverseZoneSuffixV4,
+		"256" + reverseZoneSuffixV4,
+		"1.2.3.4.5" + reverseZoneSuffixV4,
+		"ab" + reverseZoneSuffixV6,
+		"g" + reverseZoneSuffixV6,
+	}
+
+	for _, zone := range tests {
+		t.Run(zone, func(t *testing.T) {
+			_, _, _, ok := parseReverseZone(zone)
+			assert.False(t, ok, "should reject %q", zone)
+		})
+	}
+}
diff --git a/client/cmd/daemon_error.go b/client/cmd/daemon_error.go
new file mode 100644
index 000000000..0d5b1307e
--- /dev/null
+++ b/client/cmd/daemon_error.go
@@ -0,0 +1,66 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// daemonCallError prepares a daemon error for display. A refusal the daemon
+// raised because the operation needs root/administrator is already guidance
+// written for the user, so it is surfaced on its own instead of buried under the
+// gRPC envelope and the name of the RPC that hit it. Anything else is wrapped
+// with context as usual.
+func daemonCallError(context string, err error) error {
+	if guidance, ok := privilegeGuidance(err); ok {
+		return errors.New(guidance)
+	}
+	return fmt.Errorf("%s: %w", context, err)
+}
+
+// privilegeGuidance renders the daemon's privilege refusal as a summary and the
+// command that performs the operation with the privileges it needs. It reports
+// false for any other error.
+func privilegeGuidance(err error) (string, bool) {
+	info, ok := privilegeErrorInfo(err)
+	if !ok {
+		return "", false
+	}
+
+	summary := info.GetMetadata()[ipcauth.ErrorMetaSummary]
+	command := info.GetMetadata()[ipcauth.ErrorMetaCommand]
+	if summary == "" {
+		// Detail without a summary: fall back to the status message, which
+		// carries the same text.
+		summary = strings.TrimSpace(gstatus.Convert(err).Message())
+	}
+	if command == "" {
+		return summary, true
+	}
+
+	return fmt.Sprintf("%s\n\n    %s\n", summary, command), true
+}
+
+// privilegeErrorInfo returns the daemon's privilege-refusal detail, if the error
+// carries one.
+func privilegeErrorInfo(err error) (*errdetails.ErrorInfo, bool) {
+	if err == nil {
+		return nil, false
+	}
+
+	for _, detail := range gstatus.Convert(err).Details() {
+		info, ok := detail.(*errdetails.ErrorInfo)
+		if !ok {
+			continue
+		}
+		if info.GetReason() == ipcauth.ErrorReasonPrivilegeRequired && info.GetDomain() == ipcauth.ErrorDomain {
+			return info, true
+		}
+	}
+	return nil, false
+}
diff --git a/client/cmd/debug.go b/client/cmd/debug.go
index 57e75f663..c4d5ad6d7 100644
--- a/client/cmd/debug.go
+++ b/client/cmd/debug.go
@@ -3,7 +3,6 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"os/user"
 	"strings"
 	"time"
 
@@ -24,13 +23,17 @@ import (
 	"github.com/netbirdio/netbird/version"
 )
 
-const errCloseConnection = "Failed to close connection: %v"
+const (
+	errCloseConnection = "Failed to close connection: %v"
+	noUpDownFlag       = "no-updown"
+)
 
 var (
-	logFileCount        uint32
-	systemInfoFlag      bool
-	uploadBundleFlag    bool
-	uploadBundleURLFlag string
+	logFileCount             uint32
+	systemInfoFlag           bool
+	uploadBundleFlag         bool
+	uploadBundleURLFlag      string
+	uploadBundleInsecureFlag bool
 )
 
 var debugCmd = &cobra.Command{
@@ -113,7 +116,7 @@ func debugConfigDump(cmd *cobra.Command, _ []string) error {
 	if err != nil {
 		return fmt.Errorf("get active profile: %v", err)
 	}
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %v", err)
 	}
@@ -155,6 +158,11 @@ func debugConfigDump(cmd *cobra.Command, _ []string) error {
 // request. Returns an error if the RPC fails or if the daemon reports
 // an upload failure reason.
 func debugBundle(cmd *cobra.Command, _ []string) error {
+	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
+	if err != nil {
+		return err
+	}
+
 	conn, err := getClient(cmd)
 	if err != nil {
 		return err
@@ -167,17 +175,19 @@ func debugBundle(cmd *cobra.Command, _ []string) error {
 
 	client := proto.NewDaemonServiceClient(conn)
 	request := &proto.DebugBundleRequest{
-		Anonymize:    anonymizeFlag,
-		SystemInfo:   systemInfoFlag,
-		LogFileCount: logFileCount,
-		CliVersion:   version.NetbirdVersion(),
+		Anonymize:      anonymizeEnabled,
+		AnonymizeLevel: anonymizeLevel.String(),
+		SystemInfo:     systemInfoFlag,
+		LogFileCount:   logFileCount,
+		CliVersion:     version.NetbirdVersion(),
 	}
 	if uploadBundleFlag {
 		request.UploadURL = uploadBundleURLFlag
+		request.UploadInsecure = uploadBundleInsecureFlag
 	}
 	resp, err := client.DebugBundle(cmd.Context(), request)
 	if err != nil {
-		return fmt.Errorf("failed to bundle debug: %v", status.Convert(err).Message())
+		return daemonCallError("bundle debug", err)
 	}
 	cmd.Printf("Local file:\n%s\n", resp.GetPath())
 
@@ -227,6 +237,11 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("invalid duration format: %v", err)
 	}
 
+	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
+	if err != nil {
+		return err
+	}
+
 	conn, err := getClient(cmd)
 	if err != nil {
 		return err
@@ -245,13 +260,14 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 	}
 
 	stateWasDown := stat.Status != string(internal.StatusConnected) && stat.Status != string(internal.StatusConnecting)
+	noUpDown, _ := cmd.Flags().GetBool(noUpDownFlag)
 
 	initialLogLevel, err := client.GetLogLevel(cmd.Context(), &proto.GetLogLevelRequest{})
 	if err != nil {
 		return fmt.Errorf("failed to get log level: %v", status.Convert(err).Message())
 	}
 
-	if stateWasDown {
+	if stateWasDown && !noUpDown {
 		if _, err := client.Up(cmd.Context(), &proto.UpRequest{}); err != nil {
 			cmd.PrintErrf("Failed to bring service up: %v\n", status.Convert(err).Message())
 		} else {
@@ -272,34 +288,20 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 	}
 
 	needsRestoreUp := false
-	if _, err := client.Down(cmd.Context(), &proto.DownRequest{}); err != nil {
-		cmd.PrintErrf("Failed to bring service down: %v\n", status.Convert(err).Message())
+	if noUpDown {
+		enableSyncResponsePersistence(cmd, client)
 	} else {
-		needsRestoreUp = !stateWasDown
-		cmd.Println("netbird down")
+		needsRestoreUp = restartDaemon(cmd, client, stateWasDown)
 	}
 
-	time.Sleep(1 * time.Second)
-
-	// Enable sync response persistence before bringing the service up
-	if _, err := client.SetSyncResponsePersistence(cmd.Context(), &proto.SetSyncResponsePersistenceRequest{
-		Enabled: true,
-	}); err != nil {
-		cmd.PrintErrf("Failed to enable sync response persistence: %v\n", status.Convert(err).Message())
-	}
-
-	if _, err := client.Up(cmd.Context(), &proto.UpRequest{}); err != nil {
-		cmd.PrintErrf("Failed to bring service up: %v\n", status.Convert(err).Message())
-	} else {
-		needsRestoreUp = false
-		cmd.Println("netbird up")
-	}
-
-	time.Sleep(3 * time.Second)
-
 	cpuProfilingStarted := false
 	if _, err := client.StartCPUProfile(cmd.Context(), &proto.StartCPUProfileRequest{}); err != nil {
-		cmd.PrintErrf("Failed to start CPU profiling: %v\n", err)
+		if msg := status.Convert(err).Message(); strings.Contains(msg, "already in progress") {
+			cmd.PrintErrln("CPU profiling is already running (started with `netbird debug cpu start`). " +
+				"It is left running and is included in a bundle created after `netbird debug cpu stop`.")
+		} else {
+			cmd.PrintErrf("Failed to start CPU profiling: %v\n", msg)
+		}
 	} else {
 		cpuProfilingStarted = true
 		defer func() {
@@ -366,17 +368,19 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 	cmd.Println("Creating debug bundle...")
 
 	request := &proto.DebugBundleRequest{
-		Anonymize:    anonymizeFlag,
-		SystemInfo:   systemInfoFlag,
-		LogFileCount: logFileCount,
-		CliVersion:   version.NetbirdVersion(),
+		Anonymize:      anonymizeEnabled,
+		AnonymizeLevel: anonymizeLevel.String(),
+		SystemInfo:     systemInfoFlag,
+		LogFileCount:   logFileCount,
+		CliVersion:     version.NetbirdVersion(),
 	}
 	if uploadBundleFlag {
 		request.UploadURL = uploadBundleURLFlag
+		request.UploadInsecure = uploadBundleInsecureFlag
 	}
 	resp, err := client.DebugBundle(cmd.Context(), request)
 	if err != nil {
-		return fmt.Errorf("failed to bundle debug: %v", status.Convert(err).Message())
+		return daemonCallError("bundle debug", err)
 	}
 
 	if needsRestoreUp {
@@ -387,7 +391,7 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	if stateWasDown {
+	if stateWasDown && !noUpDown {
 		if _, err := client.Down(cmd.Context(), &proto.DownRequest{}); err != nil {
 			cmd.PrintErrf("Failed to restore service down state: %v\n", status.Convert(err).Message())
 		} else {
@@ -444,6 +448,47 @@ func setSyncResponsePersistence(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
+// enableSyncResponsePersistence asks the daemon to keep the latest sync
+// response so the bundle carries the network map. With a running daemon only
+// syncs received after the call are kept.
+func enableSyncResponsePersistence(cmd *cobra.Command, client proto.DaemonServiceClient) {
+	if _, err := client.SetSyncResponsePersistence(cmd.Context(), &proto.SetSyncResponsePersistenceRequest{
+		Enabled: true,
+	}); err != nil {
+		cmd.PrintErrf("Failed to enable sync response persistence: %v\n", status.Convert(err).Message())
+	}
+}
+
+// restartDaemon cycles the daemon down and up with sync response persistence
+// enabled so the bundle carries the network map. It reports whether the
+// daemon was left down although it was running before, so the caller can
+// bring it back up.
+func restartDaemon(cmd *cobra.Command, client proto.DaemonServiceClient, stateWasDown bool) bool {
+	needsRestoreUp := false
+	if _, err := client.Down(cmd.Context(), &proto.DownRequest{}); err != nil {
+		cmd.PrintErrf("Failed to bring service down: %v\n", status.Convert(err).Message())
+	} else {
+		needsRestoreUp = !stateWasDown
+		cmd.Println("netbird down")
+	}
+
+	time.Sleep(1 * time.Second)
+
+	// Enable sync response persistence before bringing the service up
+	enableSyncResponsePersistence(cmd, client)
+
+	if _, err := client.Up(cmd.Context(), &proto.UpRequest{}); err != nil {
+		cmd.PrintErrf("Failed to bring service up: %v\n", status.Convert(err).Message())
+	} else {
+		needsRestoreUp = false
+		cmd.Println("netbird up")
+	}
+
+	time.Sleep(3 * time.Second)
+
+	return needsRestoreUp
+}
+
 func waitForDurationOrCancel(ctx context.Context, duration time.Duration, cmd *cobra.Command) error {
 	ticker := time.NewTicker(1 * time.Second)
 	defer ticker.Stop()
@@ -524,10 +569,13 @@ func init() {
 	debugBundleCmd.Flags().BoolVarP(&systemInfoFlag, "system-info", "S", true, "Adds system information to the debug bundle")
 	debugBundleCmd.Flags().BoolVarP(&uploadBundleFlag, "upload-bundle", "U", false, "Uploads the debug bundle to a server")
 	debugBundleCmd.Flags().StringVar(&uploadBundleURLFlag, "upload-bundle-url", types.DefaultBundleURL, "Service URL to get an URL to upload the debug bundle")
+	debugBundleCmd.Flags().BoolVar(&uploadBundleInsecureFlag, "upload-bundle-insecure", false, "Allow uploading to an http or untrusted-TLS upload server (self-hosted); requires root")
 
 	forCmd.Flags().Uint32VarP(&logFileCount, "log-file-count", "C", 1, "Number of rotated log files to include in debug bundle")
 	forCmd.Flags().BoolVarP(&systemInfoFlag, "system-info", "S", true, "Adds system information to the debug bundle")
 	forCmd.Flags().BoolVarP(&uploadBundleFlag, "upload-bundle", "U", false, "Uploads the debug bundle to a server")
 	forCmd.Flags().StringVar(&uploadBundleURLFlag, "upload-bundle-url", types.DefaultBundleURL, "Service URL to get an URL to upload the debug bundle")
+	forCmd.Flags().BoolVar(&uploadBundleInsecureFlag, "upload-bundle-insecure", false, "Allow uploading to an http or untrusted-TLS upload server (self-hosted); requires root")
 	forCmd.Flags().Bool("capture", false, "Capture packets during the debug duration and include in bundle")
+	forCmd.Flags().Bool(noUpDownFlag, false, "Keep the daemon running instead of bringing it down and up before collecting. The bundle only includes the network map if a sync arrives during the run")
 }
diff --git a/client/cmd/debug_cpu.go b/client/cmd/debug_cpu.go
new file mode 100644
index 000000000..a01b845cf
--- /dev/null
+++ b/client/cmd/debug_cpu.go
@@ -0,0 +1,83 @@
+package cmd
+
+import (
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+var debugCPUCmd = &cobra.Command{
+	Use:   "cpu",
+	Short: "Profile the daemon's CPU usage",
+	Long: `Starts and stops CPU profiling in the running daemon without restarting it.
+The profile is included in the next debug bundle as cpu.prof.
+
+Profiling is not time limited: it keeps running, and keeps costing CPU, until
+"netbird debug cpu stop" is run.`,
+}
+
+var debugCPUStartCmd = &cobra.Command{
+	Use:     "start",
+	Short:   "Start CPU profiling in the daemon",
+	Example: "  netbird debug cpu start",
+	Args:    cobra.NoArgs,
+	RunE:    debugCPUStart,
+}
+
+var debugCPUStopCmd = &cobra.Command{
+	Use:   "stop",
+	Short: "Stop CPU profiling in the daemon",
+	Long: `Stops CPU profiling. The captured profile stays in the daemon until the next
+debug bundle is created, which includes it as cpu.prof.`,
+	Example: "  netbird debug cpu stop && netbird debug bundle",
+	Args:    cobra.NoArgs,
+	RunE:    debugCPUStop,
+}
+
+func debugCPUStart(cmd *cobra.Command, _ []string) error {
+	conn, err := getClient(cmd)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := conn.Close(); err != nil {
+			log.Errorf(errCloseConnection, err)
+		}
+	}()
+
+	if _, err := proto.NewDaemonServiceClient(conn).StartCPUProfile(cmd.Context(), &proto.StartCPUProfileRequest{}); err != nil {
+		return fmt.Errorf("start CPU profiling: %v", status.Convert(err).Message())
+	}
+
+	cmd.Println("CPU profiling started and runs until stopped. Run `netbird debug cpu stop` and then `netbird debug bundle` to collect it.")
+	return nil
+}
+
+func debugCPUStop(cmd *cobra.Command, _ []string) error {
+	conn, err := getClient(cmd)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := conn.Close(); err != nil {
+			log.Errorf(errCloseConnection, err)
+		}
+	}()
+
+	if _, err := proto.NewDaemonServiceClient(conn).StopCPUProfile(cmd.Context(), &proto.StopCPUProfileRequest{}); err != nil {
+		return fmt.Errorf("stop CPU profiling: %v", status.Convert(err).Message())
+	}
+
+	cmd.Println("CPU profiling stopped. Run `netbird debug bundle` to include cpu.prof.")
+	return nil
+}
+
+func init() {
+	debugCPUCmd.AddCommand(debugCPUStartCmd)
+	debugCPUCmd.AddCommand(debugCPUStopCmd)
+	debugCmd.AddCommand(debugCPUCmd)
+}
diff --git a/client/cmd/debug_cpu_test.go b/client/cmd/debug_cpu_test.go
new file mode 100644
index 000000000..85fffd462
--- /dev/null
+++ b/client/cmd/debug_cpu_test.go
@@ -0,0 +1,164 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"os/user"
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// startDebugTestDaemon starts an in-process daemon with an isolated profile
+// directory and returns the address the CLI should dial.
+func startDebugTestDaemon(t *testing.T) string {
+	t.Helper()
+
+	tempDir := t.TempDir()
+	origDefaultProfileDir := profilemanager.DefaultConfigPathDir
+	origActiveProfileStatePath := profilemanager.ActiveProfileStatePath
+	origConfigDirOverride := profilemanager.ConfigDirOverride
+	origDaemonAddr := daemonAddr
+	t.Cleanup(func() {
+		profilemanager.DefaultConfigPathDir = origDefaultProfileDir
+		profilemanager.ActiveProfileStatePath = origActiveProfileStatePath
+		profilemanager.ConfigDirOverride = origConfigDirOverride
+		daemonAddr = origDaemonAddr
+	})
+
+	profilemanager.DefaultConfigPathDir = tempDir
+	profilemanager.ActiveProfileStatePath = tempDir + "/active_profile.json"
+	profilemanager.ConfigDirOverride = tempDir
+
+	currUser, err := user.Current()
+	require.NoError(t, err)
+	sm := profilemanager.ServiceManager{}
+	created, err := sm.AddProfile("test1", currUser.Username)
+	require.NoError(t, err)
+	require.NoError(t, sm.SetActiveProfileState(&profilemanager.ActiveProfileState{
+		ID:       created.ID,
+		Username: currUser.Username,
+	}))
+
+	ctx, cancel := context.WithCancel(internal.CtxInitState(context.Background()))
+	srv, lis := startClientDaemon(t, ctx, "", tempDir+"/config.json")
+	t.Cleanup(func() {
+		cancel()
+		srv.Stop()
+	})
+
+	return "tcp://" + lis.Addr().String()
+}
+
+// runDebugCmd runs `netbird debug <args>` against the daemon at addr and
+// returns everything the command printed.
+func runDebugCmd(addr string, args ...string) (string, error) {
+	daemonAddr = addr
+	var out bytes.Buffer
+	rootCmd.SetOut(&out)
+	rootCmd.SetErr(&out)
+	rootCmd.SetArgs(append(append([]string{"debug"}, args...), "--daemon-addr", addr, "--log-file", ""))
+	err := rootCmd.Execute()
+	rootCmd.SetOut(nil)
+	rootCmd.SetErr(nil)
+	rootCmd.SetArgs(nil)
+	resetFlags(rootCmd)
+	return out.String(), err
+}
+
+// resetFlags puts every flag of the command and its subcommands back to its
+// default so a value parsed in one run does not leak into the next in-process
+// execution.
+func resetFlags(cmd *cobra.Command) {
+	reset := func(f *pflag.Flag) {
+		// Set appends to a slice flag and would parse the "[a,b]" default
+		// text as elements, so slices are replaced instead.
+		if sv, ok := f.Value.(pflag.SliceValue); ok {
+			var def []string
+			if trimmed := strings.Trim(f.DefValue, "[]"); trimmed != "" {
+				def = strings.Split(trimmed, ",")
+			}
+			_ = sv.Replace(def)
+		} else {
+			_ = f.Value.Set(f.DefValue)
+		}
+		f.Changed = false
+	}
+	cmd.Flags().VisitAll(reset)
+	cmd.PersistentFlags().VisitAll(reset)
+	// Commands pin their writers to the buffer of the run that first used
+	// them, so a later run would print into the old buffer.
+	cmd.SetOut(nil)
+	cmd.SetErr(nil)
+	for _, sub := range cmd.Commands() {
+		resetFlags(sub)
+	}
+}
+
+// TestResetFlagsSliceDefault guards against Set("[]") on slice flags, which
+// stores a literal "[]" element instead of the empty default.
+func TestResetFlagsSliceDefault(t *testing.T) {
+	cmd := &cobra.Command{Use: "x"}
+	var env, withDefault []string
+	cmd.Flags().StringSliceVar(&env, "env", nil, "")
+	cmd.Flags().StringSliceVar(&withDefault, "names", []string{"a", "b"}, "")
+	require.NoError(t, cmd.Flags().Parse([]string{"--env", "K=V", "--names", "c"}))
+
+	resetFlags(cmd)
+
+	assert.Empty(t, env, "slice flag with no default must reset to empty")
+	assert.Equal(t, []string{"a", "b"}, withDefault, "slice flag must reset to its default")
+}
+
+func TestDebugCPUStartStop(t *testing.T) {
+	addr := startDebugTestDaemon(t)
+
+	run := func(args ...string) error {
+		_, err := runDebugCmd(addr, append([]string{"cpu"}, args...)...)
+		return err
+	}
+
+	require.Error(t, run("stop"), "stop without a running profile must fail")
+	require.NoError(t, run("start"))
+	assert.Error(t, run("start"), "second start must be rejected while profiling")
+	require.NoError(t, run("stop"))
+	assert.Error(t, run("stop"), "second stop must be rejected")
+	assert.NoError(t, run("start"), "profiling can be started again after a stop")
+	assert.NoError(t, run("stop"))
+}
+
+// TestDebugForKeepsRunningCPUProfile covers `debug for` started while a
+// profile from `debug cpu start` is running: it must say so, leave the
+// profile alone, and still create the bundle.
+func TestDebugForKeepsRunningCPUProfile(t *testing.T) {
+	addr := startDebugTestDaemon(t)
+
+	_, err := runDebugCmd(addr, "cpu", "start")
+	require.NoError(t, err)
+
+	out, err := runDebugCmd(addr, "for", "1s", "-S=false", "--no-updown")
+	require.NoError(t, err, "output: %s", out)
+	assert.Contains(t, out, "CPU profiling is already running", "the conflict must be explained")
+	assert.NotContains(t, out, "rpc error", "the raw RPC error must not reach the user")
+	assert.Contains(t, out, "Local file:", "the bundle must still be created")
+
+	_, err = runDebugCmd(addr, "cpu", "stop")
+	assert.NoError(t, err, "the profile started by the user must still be running")
+}
+
+func TestDebugForNoUpDown(t *testing.T) {
+	addr := startDebugTestDaemon(t)
+
+	out, err := runDebugCmd(addr, "for", "1s", "-S=false", "--no-updown")
+	require.NoError(t, err, "output: %s", out)
+	assert.NotContains(t, out, "netbird down", "--no-updown must not bring the daemon down")
+	assert.NotContains(t, out, "netbird up", "--no-updown must not bring the daemon up")
+	assert.Contains(t, out, "Local file:", "the bundle must still be created")
+}
diff --git a/client/cmd/forwarding_rules.go b/client/cmd/forwarding_rules.go
deleted file mode 100644
index b3052746a..000000000
--- a/client/cmd/forwarding_rules.go
+++ /dev/null
@@ -1,98 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"sort"
-
-	"github.com/spf13/cobra"
-	"google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-var forwardingRulesCmd = &cobra.Command{
-	Use:   "forwarding",
-	Short: "List forwarding rules",
-	Long:  `Commands to list forwarding rules.`,
-}
-
-var forwardingRulesListCmd = &cobra.Command{
-	Use:     "list",
-	Aliases: []string{"ls"},
-	Short:   "List forwarding rules",
-	Example: "  netbird forwarding list",
-	Long:    "Commands to list forwarding rules.",
-	RunE:    listForwardingRules,
-}
-
-func listForwardingRules(cmd *cobra.Command, _ []string) error {
-	conn, err := getClient(cmd)
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-
-	client := proto.NewDaemonServiceClient(conn)
-	resp, err := client.ForwardingRules(cmd.Context(), &proto.EmptyRequest{})
-	if err != nil {
-		return fmt.Errorf("failed to list network: %v", status.Convert(err).Message())
-	}
-
-	if len(resp.GetRules()) == 0 {
-		cmd.Println("No forwarding rules available.")
-		return nil
-	}
-
-	printForwardingRules(cmd, resp.GetRules())
-	return nil
-}
-
-func printForwardingRules(cmd *cobra.Command, rules []*proto.ForwardingRule) {
-	cmd.Println("Available forwarding rules:")
-
-	// Sort rules by translated address
-	sort.Slice(rules, func(i, j int) bool {
-		if rules[i].GetTranslatedAddress() != rules[j].GetTranslatedAddress() {
-			return rules[i].GetTranslatedAddress() < rules[j].GetTranslatedAddress()
-		}
-		if rules[i].GetProtocol() != rules[j].GetProtocol() {
-			return rules[i].GetProtocol() < rules[j].GetProtocol()
-		}
-
-		return getFirstPort(rules[i].GetDestinationPort()) < getFirstPort(rules[j].GetDestinationPort())
-	})
-
-	var lastIP string
-	for _, rule := range rules {
-		dPort := portToString(rule.GetDestinationPort())
-		tPort := portToString(rule.GetTranslatedPort())
-		if lastIP != rule.GetTranslatedAddress() {
-			lastIP = rule.GetTranslatedAddress()
-			cmd.Printf("\nTranslated peer: %s\n", rule.GetTranslatedHostname())
-		}
-
-		cmd.Printf("  Local %s/%s to %s:%s\n", rule.GetProtocol(), dPort, rule.GetTranslatedAddress(), tPort)
-	}
-}
-
-func getFirstPort(portInfo *proto.PortInfo) int {
-	switch v := portInfo.PortSelection.(type) {
-	case *proto.PortInfo_Port:
-		return int(v.Port)
-	case *proto.PortInfo_Range_:
-		return int(v.Range.GetStart())
-	default:
-		return 0
-	}
-}
-
-func portToString(translatedPort *proto.PortInfo) string {
-	switch v := translatedPort.PortSelection.(type) {
-	case *proto.PortInfo_Port:
-		return fmt.Sprintf("%d", v.Port)
-	case *proto.PortInfo_Range_:
-		return fmt.Sprintf("%d-%d", v.Range.GetStart(), v.Range.GetEnd())
-	default:
-		return "No port specified"
-	}
-}
diff --git a/client/cmd/jobs.go b/client/cmd/jobs.go
new file mode 100644
index 000000000..36aab3570
--- /dev/null
+++ b/client/cmd/jobs.go
@@ -0,0 +1,13 @@
+package cmd
+
+// remoteJobsAllowedFlag opts this peer into running remote jobs (e.g. debug
+// bundles) requested by the management server. It defaults to false: remote
+// jobs are an explicit opt-in, and enabling it is a privileged change (see the
+// daemon gate in client/server), mirroring the SSH server opt-in.
+const remoteJobsAllowedFlag = "allow-remote-jobs"
+
+var remoteJobsAllowed bool
+
+func init() {
+	upCmd.PersistentFlags().BoolVar(&remoteJobsAllowed, remoteJobsAllowedFlag, false, "Allow the management server to run remote jobs (e.g. debug bundles) on this peer")
+}
diff --git a/client/cmd/login.go b/client/cmd/login.go
index a7ee960b1..764fdd5b1 100644
--- a/client/cmd/login.go
+++ b/client/cmd/login.go
@@ -4,29 +4,36 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"os/user"
-	"runtime"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"golang.org/x/term"
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/util"
 )
 
+// extendSessionFlag drives the `netbird login --extend` flow: refresh the
+// SSO session expiry on the management server without tearing down the
+// tunnel. Mutually exclusive with setup-key login (a setup-key cannot
+// refresh an SSO-tracked peer — see auth.errSetupKeyOnSSOExpiredPeer).
+var extendSessionFlag bool
+
 func init() {
 	loginCmd.PersistentFlags().BoolVar(&noBrowser, noBrowserFlag, false, noBrowserDesc)
 	loginCmd.PersistentFlags().BoolVar(&showQR, showQRFlag, false, showQRDesc)
 	loginCmd.PersistentFlags().StringVar(&profileName, profileNameFlag, "", profileNameDesc)
 	loginCmd.PersistentFlags().StringVarP(&configPath, "config", "c", "", "(DEPRECATED) Netbird config file location")
+	loginCmd.PersistentFlags().BoolVar(&extendSessionFlag, "extend", false,
+		"refresh the SSO session expiry without tearing down the tunnel (requires an active connection)")
 }
 
 var loginCmd = &cobra.Command{
@@ -44,7 +51,7 @@ var loginCmd = &cobra.Command{
 			// nolint
 			ctx = context.WithValue(ctx, system.DeviceNameCtxKey, hostName)
 		}
-		username, err := user.Current()
+		username, err := profilemanager.InvokingUser()
 		if err != nil {
 			return fmt.Errorf("get current user: %v", err)
 		}
@@ -61,6 +68,16 @@ var loginCmd = &cobra.Command{
 			return err
 		}
 
+		if extendSessionFlag {
+			if providedSetupKey != "" {
+				return fmt.Errorf("--extend cannot be combined with a setup key; setup keys can only enrol new peers")
+			}
+			if err := doExtendSession(ctx, cmd, activeProf); err != nil {
+				return fmt.Errorf("extend session failed: %v", err)
+			}
+			return nil
+		}
+
 		// workaround to run without service
 		if util.FindFirstLogPath(logFiles) == "" {
 			if err := doForegroundLogin(ctx, cmd, providedSetupKey, activeProf); err != nil {
@@ -73,7 +90,7 @@ var loginCmd = &cobra.Command{
 			return fmt.Errorf("daemon login failed: %v", err)
 		}
 
-		cmd.Println("Logging successfully")
+		cmd.Println("Login successful")
 
 		return nil
 	},
@@ -101,7 +118,7 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 	loginRequest := proto.LoginRequest{
 		SetupKey:            providedSetupKey,
 		ManagementUrl:       managementURL,
-		IsUnixDesktopClient: isUnixRunningDesktop(),
+		IsUnixDesktopClient: util.HasGraphicalSession(),
 		Hostname:            hostName,
 		DnsLabels:           dnsLabelsReq,
 		ProfileName:         &handle,
@@ -126,10 +143,7 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 	err = WithBackOff(func() error {
 		var backOffErr error
 		loginResp, backOffErr = client.Login(ctx, &loginRequest)
-		if s, ok := gstatus.FromError(backOffErr); ok && (s.Code() == codes.InvalidArgument ||
-			s.Code() == codes.PermissionDenied ||
-			s.Code() == codes.NotFound ||
-			s.Code() == codes.Unimplemented) {
+		if terminalLoginError(backOffErr) {
 			loginErr = backOffErr
 			return nil
 		}
@@ -152,13 +166,73 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 	return nil
 }
 
+// doExtendSession drives the daemon's RequestExtendAuthSession /
+// WaitExtendAuthSession pair. The user is sent through a regular SSO flow
+// (browser + verification URL) and the resulting JWT is forwarded to the
+// management server's ExtendAuthSession RPC. The tunnel stays up
+// throughout — no Down/Up, no network-map resync.
+func doExtendSession(ctx context.Context, cmd *cobra.Command, activeProf *profilemanager.Profile) error {
+	conn, err := DialClientGRPCServer(ctx, daemonAddr)
+	if err != nil {
+		//nolint
+		return fmt.Errorf("failed to connect to daemon error: %v\n"+
+			"If the daemon is not running please run: "+
+			"\nnetbird service install \nnetbird service start\n", err)
+	}
+	defer conn.Close()
+
+	client := proto.NewDaemonServiceClient(conn)
+
+	// the CLI runs in the user's session, the daemon does not: tell it what we can see
+	req := &proto.RequestExtendAuthSessionRequest{HasGraphicalSession: util.HasGraphicalSession()}
+	// Pre-fill the IdP login hint from the resolved profile so the user
+	// doesn't have to retype their email. Best-effort: we still proceed
+	// without a hint if the lookup fails.
+	pm := profilemanager.NewProfileManager()
+	if profState, perr := pm.GetProfileState(activeProf.ID); perr == nil && profState.Email != "" {
+		req.Hint = &profState.Email
+	}
+
+	startResp, err := client.RequestExtendAuthSession(ctx, req)
+	if err != nil {
+		return fmt.Errorf("start extend session: %v", err)
+	}
+
+	uri := startResp.GetVerificationURIComplete()
+	if uri == "" {
+		uri = startResp.GetVerificationURI()
+	}
+	openURL(cmd, uri, startResp.GetUserCode(), noBrowser, showQR)
+
+	waitResp, err := client.WaitExtendAuthSession(ctx, &proto.WaitExtendAuthSessionRequest{
+		DeviceCode: startResp.GetDeviceCode(),
+		UserCode:   startResp.GetUserCode(),
+	})
+	if err != nil {
+		return fmt.Errorf("wait for extend session: %v", err)
+	}
+
+	if ts := waitResp.GetSessionExpiresAt(); ts.IsValid() && !ts.AsTime().IsZero() {
+		deadline := ts.AsTime().Local()
+		cmd.Printf("Session extended. New expiry: %s\n", deadline.Format("2006-01-02 15:04:05 MST"))
+	} else {
+		// Management reported the peer is not eligible (e.g. login
+		// expiration disabled on the account). Surface that fact
+		// instead of pretending the call succeeded.
+		cmd.Println("Session extension call completed, but the management server did not return a new deadline (peer may not be SSO-tracked or login expiration is disabled).")
+	}
+	return nil
+}
+
 func getActiveProfile(ctx context.Context, pm *profilemanager.ProfileManager, profileName string, username string) (*profilemanager.Profile, error) {
 	// switch profile if provided
 
 	if profileName != "" {
-		if err := switchProfileOnDaemon(ctx, pm, profileName, username); err != nil {
+		prof, err := switchProfileOnDaemon(ctx, pm, profileName, username)
+		if err != nil {
 			return nil, fmt.Errorf("switch profile: %v", err)
 		}
+		return prof, nil
 	}
 
 	activeProf, err := pm.GetActiveProfile()
@@ -172,20 +246,19 @@ func getActiveProfile(ctx context.Context, pm *profilemanager.ProfileManager, pr
 	return activeProf, nil
 }
 
-func switchProfileOnDaemon(ctx context.Context, pm *profilemanager.ProfileManager, handle string, username string) error {
+func switchProfileOnDaemon(ctx context.Context, pm *profilemanager.ProfileManager, handle string, username string) (*profilemanager.Profile, error) {
 	resolvedID, err := switchProfile(ctx, handle, username)
 	if err != nil {
-		return fmt.Errorf("switch profile on daemon: %v", err)
+		return nil, fmt.Errorf("switch profile on daemon: %v", err)
 	}
 
 	if err := pm.SwitchProfile(resolvedID); err != nil {
-		return fmt.Errorf("switch profile: %v", err)
+		return nil, fmt.Errorf("switch profile: %v", err)
 	}
 
 	conn, err := DialClientGRPCServer(ctx, daemonAddr)
 	if err != nil {
-		log.Errorf("failed to connect to service CLI interface %v", err)
-		return err
+		return nil, fmt.Errorf("connect to service CLI interface: %w", err)
 	}
 	defer conn.Close()
 
@@ -193,17 +266,17 @@ func switchProfileOnDaemon(ctx context.Context, pm *profilemanager.ProfileManage
 
 	status, err := client.Status(ctx, &proto.StatusRequest{})
 	if err != nil {
-		return fmt.Errorf("unable to get daemon status: %v", err)
+		return nil, fmt.Errorf("unable to get daemon status: %v", err)
 	}
 
 	if status.Status == string(internal.StatusConnected) {
 		if _, err := client.Down(ctx, &proto.DownRequest{}); err != nil {
 			log.Errorf("call service down method: %v", err)
-			return err
+			return nil, err
 		}
 	}
 
-	return nil
+	return &profilemanager.Profile{ID: resolvedID}, nil
 }
 
 // switchProfile asks the daemon to switch to the profile identified by
@@ -249,16 +322,47 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 
 	}
 
-	config, err := profilemanager.ReadConfig(configFilePath)
+	config, err := profilemanager.ReadConfigOrDefault(configFilePath)
 	if err != nil {
 		return fmt.Errorf("read config file %s: %v", configFilePath, err)
 	}
+	// Reading a config does not provision one: this login is about to dial
+	// management with the profile's identity, so mint the keys if the profile
+	// has none yet and put them on disk — a key that stayed in memory would
+	// come back different on the next run and register a second peer.
+	//
+	// Before the MDM overlay below, on purpose: the file must keep the
+	// profile's own values. The overlay is runtime-only and re-derived on
+	// every load, so persisting it would turn an enforced management URL or
+	// pre-shared key into one the user appears to own once the policy is
+	// withdrawn.
+	if generated, err := config.EnsureIdentity(); err != nil {
+		return fmt.Errorf("ensure profile identity: %v", err)
+	} else if generated {
+		if err := profilemanager.WriteOutConfig(configFilePath, config); err != nil {
+			return fmt.Errorf("write out config file %s: %v", configFilePath, err)
+		}
+	}
+
+	// CLI standalone login: profilemanager no longer auto-applies MDM,
+	// so layer in the OS-native policy here. Desktop builds construct
+	// a Loader with no fetcher — the build-tagged loadPlatform reads
+	// the registry/plist directly.
+	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
+
+	// Mirror runInForegroundMode: recover residual state (DNS, firewall,
+	// ssh config, legacy routing) from a previous unclean shutdown and
+	// enable advanced routing before dialing management.
+	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configFilePath).GetStatePath()); err != nil {
+		log.Warnf("failed to restore residual state: %v", err)
+	}
+	nbnet.Init()
 
 	err = foregroundLogin(ctx, cmd, config, setupKey, activeProf.ID)
 	if err != nil {
 		return fmt.Errorf("foreground login failed: %v", err)
 	}
-	cmd.Println("Logging successfully")
+	cmd.Println("Login successful")
 	return nil
 }
 
@@ -321,11 +425,44 @@ func foregroundGetTokenInfo(ctx context.Context, cmd *cobra.Command, config *pro
 		hint = profileState.Email
 	}
 
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isUnixRunningDesktop(), false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, util.HasGraphicalSession(), false, hint, false)
 	if err != nil {
 		return nil, err
 	}
 
+	tokenInfo, err := runInteractiveFlow(cmd, oAuthFlow)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenInfo.MatchesAccount(hint) {
+		return tokenInfo, nil
+	}
+
+	// The IdP answered from a session belonging to another account. Retrying is
+	// what makes this recoverable: on a peer already registered the server would
+	// reject the token, and on a fresh one it would silently register the peer
+	// under the wrong account and bind the profile to it.
+	cmd.Println("The login returned a different account than this profile uses. Asking to sign in again.")
+	retryFlow := auth.RetryFlowForAccount(oAuthFlow)
+	if retryFlow == nil {
+		return tokenInfo, nil
+	}
+
+	retryToken, err := runInteractiveFlow(cmd, retryFlow)
+	if err != nil {
+		return nil, err
+	}
+	if !retryToken.MatchesAccount(hint) {
+		log.Warnf("login still returned a different account after the prompt, continuing with it")
+	}
+
+	return retryToken, nil
+}
+
+// runInteractiveFlow requests the authorization info, shows the URL to the user
+// and blocks until the token comes back.
+func runInteractiveFlow(cmd *cobra.Command, oAuthFlow auth.OAuthFlow) (*auth.TokenInfo, error) {
 	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
 		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)
@@ -371,14 +508,6 @@ func openURL(cmd *cobra.Command, verificationURIComplete, userCode string, noBro
 	}
 }
 
-// isUnixRunningDesktop checks if a Linux OS is running desktop environment
-func isUnixRunningDesktop() bool {
-	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
-		return false
-	}
-	return os.Getenv("DESKTOP_SESSION") != "" || os.Getenv("XDG_CURRENT_DESKTOP") != ""
-}
-
 func setEnvAndFlags(cmd *cobra.Command) error {
 	SetFlagsFromEnvVars(rootCmd)
 
diff --git a/client/cmd/logout.go b/client/cmd/logout.go
index 1a5281acb..cf2a4e446 100644
--- a/client/cmd/logout.go
+++ b/client/cmd/logout.go
@@ -3,11 +3,11 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"os/user"
 	"time"
 
 	"github.com/spf13/cobra"
 
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
@@ -37,7 +37,7 @@ var logoutCmd = &cobra.Command{
 		if profileName != "" {
 			req.ProfileName = &profileName
 
-			currUser, err := user.Current()
+			currUser, err := profilemanager.InvokingUser()
 			if err != nil {
 				return fmt.Errorf("get current user: %v", err)
 			}
@@ -46,7 +46,7 @@ var logoutCmd = &cobra.Command{
 		}
 
 		if _, err := daemonClient.Logout(ctx, req); err != nil {
-			return fmt.Errorf("deregister: %v", err)
+			return daemonCallError("deregister", err)
 		}
 
 		cmd.Println("Deregistered successfully")
diff --git a/client/cmd/posture.go b/client/cmd/posture.go
new file mode 100644
index 000000000..b0870233d
--- /dev/null
+++ b/client/cmd/posture.go
@@ -0,0 +1,30 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/certproof"
+)
+
+var postureCmd = &cobra.Command{
+	Use:    "posture",
+	Short:  "Posture helpers invoked by the NetBird daemon",
+	Hidden: true,
+}
+
+var postureCertProofCmd = &cobra.Command{
+	Use:   "cert-proof",
+	Short: "Answer certificate posture challenges from the calling user's keychain",
+	Long: "Reads a certificate challenge set as JSON on stdin and writes the proofs as JSON on stdout.\n" +
+		"The daemon launches this in the console user's desktop session, because a login keychain\n" +
+		"cannot be reached from a root daemon. Not intended to be run by hand.",
+	Hidden:       true,
+	SilenceUsage: true,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		// Proofs travel on stdout, so every log line has to go elsewhere.
+		log.SetOutput(cmd.ErrOrStderr())
+		return certproof.RunHelper(cmd.Context(), cmd.InOrStdin(), cmd.OutOrStdout())
+	},
+}
diff --git a/client/cmd/profile.go b/client/cmd/profile.go
index 268034e70..2d6653537 100644
--- a/client/cmd/profile.go
+++ b/client/cmd/profile.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"os/user"
 	"strings"
 	"text/tabwriter"
 	"time"
@@ -97,7 +96,7 @@ func listProfilesFunc(cmd *cobra.Command, _ []string) error {
 	}
 	defer conn.Close()
 
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -138,7 +137,7 @@ func addProfileFunc(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -179,7 +178,7 @@ func renameProfileFunc(cmd *cobra.Command, args []string) error {
 	}
 	defer conn.Close()
 
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -233,7 +232,7 @@ func removeProfileFunc(cmd *cobra.Command, args []string) error {
 	}
 	defer conn.Close()
 
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -261,7 +260,7 @@ func selectProfileFunc(cmd *cobra.Command, args []string) error {
 	profileManager := profilemanager.NewProfileManager()
 	handle := args[0]
 
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
diff --git a/client/cmd/root.go b/client/cmd/root.go
index f1ef32717..51179f77c 100644
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -20,9 +20,12 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
 
+	"github.com/netbirdio/netbird/client/anonymize"
 	daddr "github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/localmetrics"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 )
 
@@ -31,6 +34,8 @@ const (
 	dnsResolverAddress       = "dns-resolver-address"
 	enableRosenpassFlag      = "enable-rosenpass"
 	rosenpassPermissiveFlag  = "rosenpass-permissive"
+	enableLocalMetricsFlag   = "enable-local-metrics"
+	localMetricsAddressFlag  = "local-metrics-address"
 	preSharedKeyFlag         = "preshared-key"
 	interfaceNameFlag        = "interface-name"
 	wireguardPortFlag        = "wireguard-port"
@@ -70,6 +75,7 @@ var (
 	autoConnectDisabled     bool
 	extraIFaceBlackList     []string
 	anonymizeFlag           bool
+	anonymizeLevelFlag      string
 	dnsRouteInterval        time.Duration
 	// lazyConnEnabled is the parse target for the deprecated --enable-lazy-connection
 	// flag. The flag is inert; the value is no longer read (use NB_LAZY_CONN instead).
@@ -79,6 +85,8 @@ var (
 	updateSettingsDisabled bool
 	captureEnabled         bool
 	networksDisabled       bool
+	localMetricsEnabled    bool
+	localMetricsAddr       string
 
 	rootCmd = &cobra.Command{
 		Use:          "netbird",
@@ -91,6 +99,7 @@ var (
 			// Don't resolve for service commands — they create the socket, not connect to it.
 			if !isServiceCmd(cmd) {
 				daemonAddr = daddr.ResolveUnixDaemonAddr(daemonAddr)
+				daemonAddr = daddr.ResolveDaemonAddr(daemonAddr)
 			}
 			return nil
 		},
@@ -143,10 +152,10 @@ func init() {
 
 	defaultDaemonAddr := "unix:///var/run/netbird.sock"
 	if runtime.GOOS == "windows" {
-		defaultDaemonAddr = "tcp://127.0.0.1:41731"
+		defaultDaemonAddr = daddr.WindowsPipeAddr
 	}
 
-	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp]://[path|host:port]")
+	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp|npipe]://[path|host:port|name]")
 	rootCmd.PersistentFlags().StringVarP(&managementURL, "management-url", "m", "", fmt.Sprintf("Management Service URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultManagementURL))
 	rootCmd.PersistentFlags().StringVar(&adminURL, "admin-url", "", fmt.Sprintf("Admin Panel URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultAdminURL))
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "l", "info", "sets NetBird log level")
@@ -156,7 +165,8 @@ func init() {
 	rootCmd.MarkFlagsMutuallyExclusive("setup-key", "setup-key-file")
 	rootCmd.PersistentFlags().StringVar(&preSharedKey, preSharedKeyFlag, "", "Sets WireGuard PreSharedKey property. If set, then only peers that have the same key can communicate.")
 	rootCmd.PersistentFlags().StringVarP(&hostName, "hostname", "n", "", "Sets a custom hostname for the device")
-	rootCmd.PersistentFlags().BoolVarP(&anonymizeFlag, "anonymize", "A", false, "anonymize IP addresses and non-netbird.io domains in logs and status output")
+	rootCmd.PersistentFlags().BoolVarP(&anonymizeFlag, "anonymize", "A", false, "anonymize public IP addresses, MAC addresses, and non-netbird.io domains in logs and status output; private, CGNAT, and link-local IP ranges are kept (see --anonymize-level strict)")
+	rootCmd.PersistentFlags().StringVar(&anonymizeLevelFlag, "anonymize-level", "", "anonymization level: \"default\" or \"strict\"; strict also anonymizes private, CGNAT, and link-local IP ranges, peer names, and WireGuard public keys. Setting this flag implies --anonymize")
 	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", profilemanager.DefaultConfigPath, "Overrides the default profile file location")
 
 	rootCmd.AddCommand(upCmd)
@@ -167,16 +177,16 @@ func init() {
 	rootCmd.AddCommand(versionCmd)
 	rootCmd.AddCommand(sshCmd)
 	rootCmd.AddCommand(networksCMD)
-	rootCmd.AddCommand(forwardingRulesCmd)
 	rootCmd.AddCommand(debugCmd)
 	rootCmd.AddCommand(profileCmd)
 	rootCmd.AddCommand(exposeCmd)
+	rootCmd.AddCommand(postureCmd)
+
+	postureCmd.AddCommand(postureCertProofCmd)
 
 	networksCMD.AddCommand(routesListCmd)
 	networksCMD.AddCommand(routesSelectCmd, routesDeselectCmd)
 
-	forwardingRulesCmd.AddCommand(forwardingRulesListCmd)
-
 	debugCmd.AddCommand(debugBundleCmd)
 	debugCmd.AddCommand(logCmd)
 	logCmd.AddCommand(logLevelCmd)
@@ -212,6 +222,8 @@ func init() {
 	upCmd.PersistentFlags().BoolVar(&rosenpassEnabled, enableRosenpassFlag, false, "[Experimental] Enable Rosenpass feature. If enabled, the connection will be post-quantum secured via Rosenpass.")
 	upCmd.PersistentFlags().BoolVar(&rosenpassPermissive, rosenpassPermissiveFlag, false, "[Experimental] Enable Rosenpass in permissive mode to allow this peer to accept WireGuard connections without requiring Rosenpass functionality from peers that do not have Rosenpass enabled.")
 	upCmd.PersistentFlags().BoolVar(&autoConnectDisabled, disableAutoConnectFlag, false, "Disables auto-connect feature. If enabled, then the client won't connect automatically when the service starts.")
+	upCmd.PersistentFlags().BoolVar(&localMetricsEnabled, enableLocalMetricsFlag, false, "Enables a local Prometheus /metrics endpoint exposing connection state (peers, latency, P2P vs relay).")
+	upCmd.PersistentFlags().StringVar(&localMetricsAddr, localMetricsAddressFlag, localmetrics.DefaultListenAddress, "Listen address of the local Prometheus /metrics endpoint.")
 	upCmd.PersistentFlags().BoolVar(&lazyConnEnabled, enableLazyConnectionFlag, false, "Deprecated: no longer used. Lazy connections are controlled by the server and the NB_LAZY_CONN environment variable.")
 	_ = upCmd.PersistentFlags().MarkDeprecated(enableLazyConnectionFlag, "no longer used; lazy connections are controlled by the server and the NB_LAZY_CONN environment variable")
 
@@ -269,12 +281,47 @@ func DialClientGRPCServer(ctx context.Context, addr string) (*grpc.ClientConn, e
 	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
 	defer cancel()
 
-	return grpc.DialContext(
-		ctx,
-		strings.TrimPrefix(addr, "tcp://"),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithBlock(),
-	)
+	target, opts := daddr.DialTarget(addr)
+	opts = append(opts, grpc.WithBlock())
+
+	return grpc.DialContext(ctx, target, opts...)
+}
+
+// terminalLoginError reports whether a Login failure is final, so the backoff
+// cycle stops and the caller is told what the daemon said instead of "login
+// backoff cycle failed" thirty seconds later. Retrying cannot change any of
+// these answers: the request is malformed, the caller is not allowed, the
+// target does not exist, a precondition on the daemon refuses it (the
+// update-settings kill switch, an MDM-managed field), or the method is not
+// implemented.
+//
+// Both `netbird up` and `netbird login` run Login through the backoff, and
+// they each carried their own copy of this list — which is how one of them
+// ended up retrying a refusal the other treated as final.
+func terminalLoginError(err error) bool {
+	// A successful Login reaches here with a nil error, and that is not a
+	// terminal failure. Handled explicitly rather than left to
+	// gstatus.FromError, which answers (nil, true) for a nil error and leans on
+	// Status.Code tolerating a nil receiver to come back as codes.OK.
+	if err == nil {
+		return false
+	}
+
+	s, ok := gstatus.FromError(err)
+	if !ok {
+		return false
+	}
+
+	switch s.Code() {
+	case codes.InvalidArgument,
+		codes.PermissionDenied,
+		codes.NotFound,
+		codes.FailedPrecondition,
+		codes.Unimplemented:
+		return true
+	default:
+		return false
+	}
 }
 
 // WithBackOff execute function in backoff cycle.
@@ -295,6 +342,19 @@ var CLIBackOffSettings = &backoff.ExponentialBackOff{
 	Clock:               backoff.SystemClock,
 }
 
+// effectiveAnonymize resolves the --anonymize and --anonymize-level flags:
+// setting a level implies anonymization, and an invalid level is rejected.
+func effectiveAnonymize() (bool, anonymize.Level, error) {
+	if anonymizeLevelFlag == "" {
+		return anonymizeFlag, anonymize.LevelDefault, nil
+	}
+	level := anonymize.ParseLevel(anonymizeLevelFlag)
+	if !strings.EqualFold(anonymizeLevelFlag, level.String()) {
+		return false, anonymize.LevelDefault, fmt.Errorf("invalid anonymize level %q: use %q or %q", anonymizeLevelFlag, anonymize.LevelDefault.String(), anonymize.LevelStrict.String())
+	}
+	return true, level, nil
+}
+
 func getSetupKey() (string, error) {
 	if setupKeyPath != "" && setupKey == "" {
 		return getSetupKeyFromFile(setupKeyPath)
diff --git a/client/cmd/service.go b/client/cmd/service.go
index 56d8a8726..2a558e6d5 100644
--- a/client/cmd/service.go
+++ b/client/cmd/service.go
@@ -5,7 +5,9 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"runtime"
+	"slices"
 	"strings"
 	"sync"
 
@@ -22,15 +24,50 @@ var serviceCmd = &cobra.Command{
 	Short: "Manage the NetBird daemon service",
 }
 
+const defaultJSONSocket = "unix:///var/run/netbird-http.sock"
+
+// forbiddenServiceEnvVars are the environment variables the service is never
+// registered with, keyed in upper case since these are Windows names. Each one
+// decides where the daemon resolves something it then uses with the privileges
+// of the account it runs under — LocalSystem on Windows, root elsewhere: the
+// executables it runs (PATH, PATHEXT, COMSPEC, SystemRoot, windir) or the
+// directory it writes temporary files in (TEMP, TMP). The daemon needs none of
+// them, and the utilities it shells out to are resolved by absolute path.
+var forbiddenServiceEnvVars = map[string]struct{}{
+	"PATH":       {},
+	"PATHEXT":    {},
+	"SYSTEMROOT": {},
+	"WINDIR":     {},
+	"COMSPEC":    {},
+	"TEMP":       {},
+	"TMP":        {},
+}
+
+// forbiddenServiceEnvPrefixes are the dynamic-loader families, refused whole
+// rather than by name: LD_PRELOAD, DYLD_INSERT_LIBRARIES and their siblings all
+// reach the loader of the process, the set differs per platform and libc, and
+// new members arrive with new OS releases. Listing them one by one is a list
+// that is wrong the moment it is written.
+var forbiddenServiceEnvPrefixes = []string{"LD_", "DYLD_"}
+
 var (
-	serviceName    string
-	serviceEnvVars []string
+	serviceName      string
+	serviceEnvVars   []string
+	jsonSocket       string
+	enableJSONSocket bool
 )
 
 type program struct {
-	ctx              context.Context
-	cancel           context.CancelFunc
-	serv             *grpc.Server
+	ctx      context.Context
+	cancel   context.CancelFunc
+	serv     *grpc.Server
+	jsonServ *http.Server
+	// jsonClient is the gateway's own connection to the daemon. It is held so
+	// shutting the gateway down also closes it: nothing else references it once
+	// the handlers are registered, so its transport goroutines would otherwise
+	// outlive the server.
+	jsonClient       *grpc.ClientConn
+	jsonServMu       sync.Mutex
 	serverInstance   *server.Server
 	serverInstanceMu sync.Mutex
 }
@@ -46,6 +83,8 @@ func init() {
 	serviceCmd.PersistentFlags().BoolVar(&updateSettingsDisabled, "disable-update-settings", false, "Disables update settings feature. If enabled, the client will not be able to change or edit any settings. To persist this setting, use: netbird service install --disable-update-settings")
 	serviceCmd.PersistentFlags().BoolVar(&captureEnabled, "enable-capture", false, "Enables packet capture via 'netbird debug capture'. To persist, use: netbird service install --enable-capture")
 	serviceCmd.PersistentFlags().BoolVar(&networksDisabled, "disable-networks", false, "Disables network selection. If enabled, the client will not allow listing, selecting, or deselecting networks. To persist, use: netbird service install --disable-networks")
+	serviceCmd.PersistentFlags().BoolVar(&enableJSONSocket, "enable-json-socket", false, "Enables the HTTP/JSON API socket served by grpc-gateway. To persist, use: netbird service install --enable-json-socket")
+	serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address [unix|tcp]://[path|host:port]. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")
 
 	rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")
 	serviceEnvDesc := `Sets extra environment variables for the service. ` +
@@ -113,8 +152,33 @@ func parseServiceEnvVars(envVars []string) (map[string]string, error) {
 			return nil, fmt.Errorf("empty environment variable key in: %s", env)
 		}
 
+		if isForbiddenServiceEnvVar(key) {
+			return nil, fmt.Errorf("environment variable %s cannot be set on the service: it decides where the service resolves the executables, libraries or temporary files it uses", key)
+		}
+
 		envMap[key] = value
 	}
 
 	return envMap, nil
 }
+
+// isForbiddenServiceEnvVar reports whether name is one the service must not be
+// registered with.
+//
+// The names are matched case-insensitively only on Windows, where they are the
+// same variable however they are spelled. Elsewhere the environment is
+// case-sensitive, so Path and PATH are two different variables and only the
+// exact spelling is the one the loader reads.
+func isForbiddenServiceEnvVar(name string) bool {
+	if runtime.GOOS == "windows" {
+		name = strings.ToUpper(name)
+	}
+
+	if _, forbidden := forbiddenServiceEnvVars[name]; forbidden {
+		return true
+	}
+
+	return slices.ContainsFunc(forbiddenServiceEnvPrefixes, func(prefix string) bool {
+		return strings.HasPrefix(name, prefix)
+	})
+}
diff --git a/client/cmd/service_controller.go b/client/cmd/service_controller.go
index 8de147946..e9a0e055f 100644
--- a/client/cmd/service_controller.go
+++ b/client/cmd/service_controller.go
@@ -5,9 +5,7 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"net"
-	"os"
-	"strings"
+	"runtime"
 	"time"
 
 	"github.com/kardianos/service"
@@ -16,69 +14,159 @@ import (
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
 
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/util"
 )
 
+func validateJSONSocketFlags() error {
+	if serviceCmd.PersistentFlags().Changed("json-socket") && !enableJSONSocket {
+		return fmt.Errorf("--json-socket requires --enable-json-socket to configure the daemon JSON gateway")
+	}
+	return nil
+}
+
+// daemonServerOptions installs the transport credentials that expose each
+// caller's kernel-authenticated identity to the handlers, which is what lets
+// the daemon require root/administrator for privileged operations.
+//
+// The handshake exchanges no bytes, so older CLI and UI binaries still
+// interoperate. Callers on a TCP socket carry no identity at all: the daemon
+// keeps serving them, and the privileged operations deny them, so a warning is
+// logged to make the loss of functionality visible.
+func daemonServerOptions(network string) []grpc.ServerOption {
+	if network == "tcp" {
+		log.Warnf("daemon is listening on TCP (%s): callers carry no verifiable identity over TCP, "+
+			"so privileged operations (SSH root login, SSH auth, enabling the SSH server, management URL changes, "+
+			"deregistration) will be denied, and the SSH JWT cache is neither filled nor served. "+
+			"Use a unix socket, or npipe:// on Windows", daemonAddr)
+		return nil
+	}
+
+	creds := ipcauth.NewTransportCredentials() //nolint:staticcheck
+	if creds == nil {                          //nolint:staticcheck // nil only on platforms without a peer-identity primitive
+		log.Warnf("daemon IPC has no peer-identity primitive on %s: privileged operations will be denied "+
+			"and the SSH JWT cache is neither filled nor served", runtime.GOOS)
+		return nil
+	}
+
+	return []grpc.ServerOption{grpc.Creds(creds)}
+}
+
 func (p *program) Start(svc service.Service) error {
 	// Start should not block. Do the actual work async.
 	log.Info("starting NetBird service") //nolint
 
+	if err := validateJSONSocketFlags(); err != nil {
+		return err
+	}
+
 	// Collect static system and platform information
 	system.UpdateStaticInfoAsync()
 
-	// in any case, even if configuration does not exists we run daemon to serve CLI gRPC API.
-	p.serv = grpc.NewServer()
-
-	split := strings.Split(daemonAddr, "://")
-	switch split[0] {
-	case "unix":
-		// cleanup failed close
-		stat, err := os.Stat(split[1])
-		if err == nil && !stat.IsDir() {
-			if err := os.Remove(split[1]); err != nil {
-				log.Debugf("remove socket file: %v", err)
-			}
-		}
-	case "tcp":
-	default:
-		return fmt.Errorf("unsupported daemon address protocol: %v", split[0])
+	// A daemon installed before named-pipe support has the loopback TCP address
+	// persisted. Move it to the named pipe so an upgraded daemon can identify
+	// its callers instead of silently serving an unauthenticated socket.
+	if migrated, ok := daemonaddr.MigrateLegacy(daemonAddr); ok {
+		log.Infof("daemon address %q predates named-pipe support, listening on %q so callers can be identified", daemonAddr, migrated)
+		daemonAddr = migrated
 	}
 
-	listen, err := net.Listen(split[0], split[1])
+	network, _, err := parseListenAddress(daemonAddr)
 	if err != nil {
-		return fmt.Errorf("listen daemon interface: %w", err)
+		return fmt.Errorf("parse daemon address: %w", err)
 	}
+
+	// in any case, even if configuration does not exists we run daemon to serve CLI gRPC API.
+	p.serv = grpc.NewServer(daemonServerOptions(network)...)
+
+	daemonListener, jsonListener, err := listenDaemonSockets()
+	if err != nil {
+		return err
+	}
+
 	go func() {
-		defer listen.Close()
-
-		if split[0] == "unix" {
-			if err := os.Chmod(split[1], 0666); err != nil {
-				log.Errorf("failed setting daemon permissions: %v", split[1])
-				return
-			}
-		}
-
-		serverInstance := server.New(p.ctx, util.FindFirstLogPath(logFiles), configPath, profilesDisabled, updateSettingsDisabled, captureEnabled, networksDisabled)
-		if err := serverInstance.Start(); err != nil {
-			log.Fatalf("failed to start daemon: %v", err)
-		}
-		proto.RegisterDaemonServiceServer(p.serv, serverInstance)
-
-		p.serverInstanceMu.Lock()
-		p.serverInstance = serverInstance
-		p.serverInstanceMu.Unlock()
-
-		log.Printf("started daemon server: %v", split[1])
-		if err := p.serv.Serve(listen); err != nil {
-			log.Errorf("failed to serve daemon requests: %v", err)
+		// Fatal here rather than inside serve, so serve's deferred listener
+		// closes run before the process exits.
+		if err := p.serve(daemonListener, jsonListener); err != nil {
+			log.Fatalf("failed to %v", err)
 		}
 	}()
 	return nil
 }
 
+// listenDaemonSockets opens the daemon control socket and, when it is enabled, the
+// JSON gateway socket. The control socket is closed again if the second one fails,
+// so a failed start leaves nothing listening. The returned JSON listener is nil
+// when the socket is disabled.
+func listenDaemonSockets() (*socketListener, *socketListener, error) {
+	daemonListener, err := listenOnAddress(daemonAddr)
+	if err != nil {
+		return nil, nil, fmt.Errorf("listen daemon interface: %w", err)
+	}
+
+	if !enableJSONSocket {
+		removeStaleUnixSocketForAddress(jsonSocket)
+		return daemonListener, nil, nil
+	}
+
+	jsonListener, err := listenOnAddress(jsonSocket)
+	if err != nil {
+		if cerr := daemonListener.Close(); cerr != nil {
+			log.Debugf("close daemon listener: %v", cerr)
+		}
+		return nil, nil, fmt.Errorf("listen daemon JSON interface: %w", err)
+	}
+
+	return daemonListener, jsonListener, nil
+}
+
+// serve brings up the daemon server on an already-open control socket and blocks
+// until it stops. jsonListener is nil when the JSON socket is disabled. A returned
+// error means the daemon cannot run at all and the caller is expected to exit; the
+// failures it recovers from on its own are logged here.
+func (p *program) serve(daemonListener, jsonListener *socketListener) error {
+	defer daemonListener.Close()
+	if jsonListener != nil {
+		defer jsonListener.Close()
+	}
+
+	// chmodUnixSocket is a no-op for a nil listener and for a non-unix one.
+	if err := daemonListener.chmodUnixSocket("daemon"); err != nil {
+		log.Error(err)
+		return nil
+	}
+	if err := jsonListener.chmodUnixSocket("daemon JSON"); err != nil {
+		log.Error(err)
+		return nil
+	}
+
+	serverInstance := server.New(p.ctx, util.FindFirstLogPath(logFiles), configPath, profilesDisabled, updateSettingsDisabled, captureEnabled, networksDisabled)
+	if err := serverInstance.Start(); err != nil {
+		return fmt.Errorf("start daemon: %w", err)
+	}
+	proto.RegisterDaemonServiceServer(p.serv, serverInstance)
+
+	p.serverInstanceMu.Lock()
+	p.serverInstance = serverInstance
+	p.serverInstanceMu.Unlock()
+
+	if jsonListener == nil {
+		log.Debug("daemon JSON socket disabled")
+	} else if err := p.startJSONGateway(jsonListener, daemonAddr); err != nil {
+		return fmt.Errorf("start daemon JSON server: %w", err)
+	}
+
+	log.Printf("started daemon server: %v", daemonListener.address)
+	if err := p.serv.Serve(daemonListener.Listener); err != nil {
+		log.Errorf("failed to serve daemon requests: %v", err)
+	}
+	return nil
+}
+
 func (p *program) Stop(srv service.Service) error {
 	p.serverInstanceMu.Lock()
 	if p.serverInstance != nil {
@@ -92,6 +180,25 @@ func (p *program) Stop(srv service.Service) error {
 
 	p.cancel()
 
+	p.jsonServMu.Lock()
+	jsonServ, jsonClient := p.jsonServ, p.jsonClient
+	p.jsonServMu.Unlock()
+	if jsonClient != nil {
+		if err := jsonClient.Close(); err != nil {
+			log.Debugf("close daemon JSON gateway client: %v", err)
+		}
+	}
+	if jsonServ != nil {
+		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 2*time.Second)
+		if err := jsonServ.Shutdown(shutdownCtx); err != nil {
+			log.Errorf("failed to stop daemon JSON server gracefully: %v", err)
+			if err := jsonServ.Close(); err != nil {
+				log.Errorf("failed to close daemon JSON server: %v", err)
+			}
+		}
+		shutdownCancel()
+	}
+
 	if p.serv != nil {
 		p.serv.Stop()
 	}
@@ -148,6 +255,9 @@ var runCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
+		if err := validateJSONSocketFlags(); err != nil {
+			return err
+		}
 
 		return s.Run()
 	},
@@ -162,6 +272,9 @@ var startCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
+		if err := validateJSONSocketFlags(); err != nil {
+			return err
+		}
 
 		if err := s.Start(); err != nil {
 			return fmt.Errorf("start service: %w", err)
@@ -198,6 +311,9 @@ var restartCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
+		if err := validateJSONSocketFlags(); err != nil {
+			return err
+		}
 
 		if err := s.Restart(); err != nil {
 			return fmt.Errorf("restart service: %w", err)
diff --git a/client/cmd/service_installer.go b/client/cmd/service_installer.go
index 2d45fa063..ae2dfb9fa 100644
--- a/client/cmd/service_installer.go
+++ b/client/cmd/service_installer.go
@@ -67,6 +67,10 @@ func buildServiceArguments() []string {
 		args = append(args, "--disable-networks")
 	}
 
+	if enableJSONSocket {
+		args = append(args, "--enable-json-socket", "--json-socket", jsonSocket)
+	}
+
 	return args
 }
 
@@ -106,6 +110,10 @@ func configurePlatformSpecificSettings(svcConfig *service.Config) error {
 
 // Create fully configured service config for install/reconfigure
 func createServiceConfigForInstall() (*service.Config, error) {
+	if err := validateJSONSocketFlags(); err != nil {
+		return nil, err
+	}
+
 	svcConfig, err := newSVCConfig()
 	if err != nil {
 		return nil, fmt.Errorf("create service config: %w", err)
diff --git a/client/cmd/service_json_gateway.go b/client/cmd/service_json_gateway.go
new file mode 100644
index 000000000..b6864f338
--- /dev/null
+++ b/client/cmd/service_json_gateway.go
@@ -0,0 +1,150 @@
+//go:build !ios && !android
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc"
+
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// jsonPeerIdentity is the context key under which the connecting HTTP client's
+// identity is stashed for the lifetime of its connection.
+type jsonPeerIdentity struct{}
+
+// jsonPeerIdentityValue pairs the identity with whether it could be read at
+// all, so an unreadable identity is forwarded as "unknown" rather than omitted.
+type jsonPeerIdentityValue struct {
+	id    ipcauth.Identity
+	known bool
+}
+
+// jsonConnContext reads the identity of the client connecting to the JSON
+// socket and stashes it on the connection's context. The gateway re-dials the
+// daemon in-process, so the daemon would otherwise see every JSON request as
+// coming from the daemon itself.
+func jsonConnContext(ctx context.Context, c net.Conn) context.Context {
+	value := jsonPeerIdentityValue{}
+	id, err := ipcauth.ConnIdentity(c)
+	if err != nil {
+		log.Warnf("json gateway: cannot read HTTP client identity, privileged operations will be denied for this connection: %v", err)
+	} else {
+		value.id = id
+		value.known = true
+	}
+	return context.WithValue(ctx, jsonPeerIdentity{}, value)
+}
+
+// forwardIdentity stamps the HTTP client's identity onto every call the gateway
+// makes to the daemon.
+//
+// It is an interceptor on the gateway's client connection rather than a
+// runtime.WithMetadata annotator because grpc-gateway skips annotators when no
+// request header maps to metadata, which an HTTP/1.0 request with no Host header
+// over a unix socket achieves. The daemon would then receive no marker, see its own
+// identity as the transport peer, and authorize the request as the daemon itself.
+// An interceptor runs for every RPC whatever the request looked like.
+func forwardIdentity(ctx context.Context) context.Context {
+	value, ok := ctx.Value(jsonPeerIdentity{}).(jsonPeerIdentityValue)
+	if !ok {
+		// No ConnContext ran for this request, so forward an unknown identity:
+		// the daemon must not mistake its own identity for the client's.
+		return ipcauth.WithForwardedIdentity(ctx, ipcauth.Identity{}, false)
+	}
+	return ipcauth.WithForwardedIdentity(ctx, value.id, value.known)
+}
+
+func forwardIdentityUnary(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
+	return invoker(forwardIdentity(ctx), method, req, reply, cc, opts...)
+}
+
+func forwardIdentityStream(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
+	return streamer(forwardIdentity(ctx), desc, cc, method, opts...)
+}
+
+// reservedHeaderWarning limits the dropped-header warning to the first occurrence.
+var reservedHeaderWarning sync.Once
+
+// jsonIncomingHeaderMatcher keeps an HTTP client from supplying the metadata the
+// gateway uses to forward its identity. grpc-gateway turns "Grpc-Metadata-<key>"
+// headers into gRPC metadata and joins them ahead of what its annotators add, so
+// without this filter a JSON client could send its own x-netbird-fwd-uid and the
+// daemon would authorize that instead of the client's real identity.
+func jsonIncomingHeaderMatcher(key string) (string, bool) {
+	mapped, ok := runtime.DefaultHeaderMatcher(key)
+	if !ok {
+		return "", false
+	}
+	if ipcauth.IsReservedForwardKey(mapped) {
+		// Warn once: any client can send these on every request, so warning each
+		// time hands it a way to fill the log. The rest are debug-level.
+		reservedHeaderWarning.Do(func() {
+			log.Warnf("json gateway: dropping reserved header %q from a request: only the gateway may set the caller's identity", key)
+		})
+		log.Debugf("json gateway: dropping reserved header %q", key)
+		return "", false
+	}
+	return mapped, true
+}
+
+func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint string) error {
+	if jsonListener.network == "tcp" {
+		log.Warnf("daemon JSON socket is listening on TCP (%s): callers carry no verifiable identity over TCP, "+
+			"so privileged operations will be denied for JSON clients", jsonListener.address)
+	}
+
+	mux := runtime.NewServeMux(runtime.WithIncomingHeaderMatcher(jsonIncomingHeaderMatcher))
+
+	// grpc.NewClient does not connect until the first request, so registering
+	// the handler here cannot block daemon startup.
+	target, opts := daemonaddr.DialTarget(daemonEndpoint)
+	opts = append(opts,
+		grpc.WithChainUnaryInterceptor(forwardIdentityUnary),
+		grpc.WithChainStreamInterceptor(forwardIdentityStream),
+	)
+	conn, err := grpc.NewClient(target, opts...)
+	if err != nil {
+		return fmt.Errorf("create daemon client for JSON gateway: %w", err)
+	}
+	if err := proto.RegisterDaemonServiceHandler(p.ctx, mux, conn); err != nil {
+		if cerr := conn.Close(); cerr != nil {
+			log.Debugf("close daemon client after failed JSON gateway registration: %v", cerr)
+		}
+		return err
+	}
+
+	jsonServer := &http.Server{
+		Handler:           mux,
+		ReadHeaderTimeout: 5 * time.Second,
+		BaseContext: func(net.Listener) context.Context {
+			return p.ctx
+		},
+		ConnContext: jsonConnContext,
+	}
+
+	p.jsonServMu.Lock()
+	p.jsonServ = jsonServer
+	p.jsonClient = conn
+	p.jsonServMu.Unlock()
+
+	go func() {
+		log.Printf("started daemon JSON server: %v", jsonListener.address)
+		if err := jsonServer.Serve(jsonListener.Listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Errorf("failed to serve daemon JSON requests: %v", err)
+		}
+	}()
+
+	return nil
+}
diff --git a/client/cmd/service_json_gateway_test.go b/client/cmd/service_json_gateway_test.go
new file mode 100644
index 000000000..dfeef1c46
--- /dev/null
+++ b/client/cmd/service_json_gateway_test.go
@@ -0,0 +1,261 @@
+//go:build !windows && !ios && !android
+
+package cmd
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// The JSON gateway runs inside the daemon and re-dials it locally, so every JSON
+// request reaches a handler with the daemon's own identity as the transport peer.
+// The gateway therefore forwards its HTTP client's identity as metadata, and the
+// daemon authorizes that instead of itself. These tests drive the real wiring
+// (jsonConnContext, forwardIdentity, jsonIncomingHeaderMatcher) and check the
+// identity a handler would end up authorizing.
+
+// daemonSideCtx is what a handler sees for a gateway-relayed call. The transport
+// peer must be this process's own identity: the gateway is the daemon, so the two
+// cannot differ, and hardcoding root here instead would describe a state that
+// never occurs.
+func daemonSideCtx(t *testing.T, md metadata.MD) context.Context {
+	t.Helper()
+	self, err := ipcauth.CurrentProcessIdentity()
+	if err != nil {
+		t.Skipf("cannot read this process's identity: %v", err)
+	}
+	ctx := peer.NewContext(context.Background(), &peer.Peer{
+		AuthInfo: ipcauth.AuthInfo{
+			CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+			Identity:       self,
+		},
+	})
+	return metadata.NewIncomingContext(ctx, md)
+}
+
+// gatewayMetadata reproduces what the daemon receives for a JSON request: the
+// mux annotates the context from the request's headers, then the interceptor on the
+// gateway's client connection stamps the caller's identity. The order matters,
+// since the interceptor must win over anything a header put there.
+func gatewayMetadata(t *testing.T, req *http.Request, ctx context.Context) metadata.MD {
+	t.Helper()
+	mux := runtime.NewServeMux(runtime.WithIncomingHeaderMatcher(jsonIncomingHeaderMatcher))
+	annotated, err := runtime.AnnotateContext(ctx, mux, req,
+		"/daemon.DaemonService/SetConfig",
+		runtime.WithHTTPPathPattern("/daemon.DaemonService/SetConfig"))
+	if err != nil {
+		t.Fatalf("annotate: %v", err)
+	}
+
+	md, ok := metadata.FromOutgoingContext(forwardIdentity(annotated))
+	if !ok {
+		t.Fatal("the interceptor produced no metadata")
+	}
+	return md
+}
+
+// clientCtx is the connection context jsonConnContext would have produced for an
+// HTTP client whose identity the gateway could read.
+func clientCtx(id ipcauth.Identity, known bool) context.Context {
+	return context.WithValue(context.Background(), jsonPeerIdentity{},
+		jsonPeerIdentityValue{id: id, known: known})
+}
+
+// An HTTP client must not be able to name its own identity. grpc-gateway turns
+// Grpc-Metadata-<key> headers into gRPC metadata, so without the header filter and
+// the interceptor overwriting the reserved keys, this request would authorize as
+// uid 0.
+func TestJSONGateway_ForgedIdentityHeaderIsDropped(t *testing.T) {
+	req, err := http.NewRequest(http.MethodPost, "http://localhost/daemon.DaemonService/SetConfig", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Grpc-Metadata-X-Netbird-Fwd-Uid", "0")
+	req.Header.Set("Grpc-Metadata-X-Netbird-Fwd-Gid", "0")
+	req.Header.Set("Grpc-Metadata-X-Netbird-Fwd", "1")
+	req.Header.Set("Grpc-Metadata-X-Netbird-Fwd-Sid", "S-1-5-18")
+
+	caller := ipcauth.Identity{UID: 31000, GID: 31000}
+	md := gatewayMetadata(t, req, clientCtx(caller, true))
+
+	id, ok := ipcauth.CallerIdentity(daemonSideCtx(t, md))
+	if !ok {
+		t.Fatal("the forwarded identity should be usable")
+	}
+	if id.IsPrivileged() {
+		t.Errorf("forged header was believed: authorized as %v", id)
+	}
+	if id.UID != caller.UID {
+		t.Errorf("authorized as uid %d, want the real client %d", id.UID, caller.UID)
+	}
+}
+
+// A request with no headers at all (HTTP/1.0 needs no Host, and a unix socket
+// yields no host:port) makes grpc-gateway produce no metadata whatsoever and skip
+// its annotators: "if len(pairs) == 0 { return ctx, nil, nil }" in
+// runtime/context.go. That is why the identity is stamped by an interceptor
+// instead. This is the case that previously reached the gate as the daemon itself.
+func TestJSONGateway_HeaderlessRequestIsStillMarkedForwarded(t *testing.T) {
+	req, err := http.NewRequest(http.MethodPost, "http://localhost/daemon.DaemonService/SetConfig", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header = http.Header{}
+	req.Host = ""
+
+	caller := ipcauth.Identity{UID: 31000, GID: 31000}
+	ctx := clientCtx(caller, true)
+
+	// Pin the skip path itself: if grpc-gateway ever produced a pair here, this
+	// test would still pass below while no longer covering what it was written for.
+	mux := runtime.NewServeMux(runtime.WithIncomingHeaderMatcher(jsonIncomingHeaderMatcher))
+	annotated, err := runtime.AnnotateContext(ctx, mux, req,
+		"/daemon.DaemonService/SetConfig",
+		runtime.WithHTTPPathPattern("/daemon.DaemonService/SetConfig"))
+	if err != nil {
+		t.Fatalf("annotate: %v", err)
+	}
+	if md, ok := metadata.FromOutgoingContext(annotated); ok {
+		t.Fatalf("grpc-gateway produced metadata %v for a headerless request; "+
+			"this test no longer covers the annotator-skip path", md)
+	}
+
+	md := gatewayMetadata(t, req, ctx)
+
+	id, ok := ipcauth.CallerIdentity(daemonSideCtx(t, md))
+	if !ok {
+		t.Fatal("the forwarded identity should be usable")
+	}
+	if id.UID != caller.UID || id.IsPrivileged() {
+		t.Errorf("authorized as %v, want the real client uid %d", id, caller.UID)
+	}
+}
+
+// When the gateway cannot read its client's identity (a TCP JSON socket, say) it
+// forwards the marker alone. The daemon must then report "unidentified" so the
+// privileged operations refuse, rather than falling back to the gateway's own
+// identity.
+func TestJSONGateway_UnreadableClientIdentityIsUnidentified(t *testing.T) {
+	req, err := http.NewRequest(http.MethodPost, "http://localhost/daemon.DaemonService/SetConfig", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	md := gatewayMetadata(t, req, clientCtx(ipcauth.Identity{}, false))
+
+	if id, ok := ipcauth.CallerIdentity(daemonSideCtx(t, md)); ok {
+		t.Errorf("a request with no client identity was authorized as %v", id)
+	}
+}
+
+// A request that never passed through jsonConnContext (no stashed identity) must
+// also come out unidentified rather than as the daemon.
+func TestJSONGateway_MissingConnContextIsUnidentified(t *testing.T) {
+	req, err := http.NewRequest(http.MethodPost, "http://localhost/daemon.DaemonService/SetConfig", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	md := gatewayMetadata(t, req, context.Background())
+
+	if id, ok := ipcauth.CallerIdentity(daemonSideCtx(t, md)); ok {
+		t.Errorf("a request with no connection context was authorized as %v", id)
+	}
+}
+
+// End to end over a real unix socket: the gateway reads the connecting client's
+// identity from the socket itself, so a client cannot present anything else.
+func TestJSONGateway_IdentityComesFromTheSocket(t *testing.T) {
+	mux := runtime.NewServeMux(runtime.WithIncomingHeaderMatcher(jsonIncomingHeaderMatcher))
+
+	type observed struct {
+		md metadata.MD
+	}
+	seen := make(chan observed, 1)
+
+	srv := &http.Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			ctx, err := runtime.AnnotateContext(r.Context(), mux, r,
+				"/daemon.DaemonService/SetConfig",
+				runtime.WithHTTPPathPattern("/daemon.DaemonService/SetConfig"))
+			if err != nil {
+				t.Errorf("annotate: %v", err)
+				return
+			}
+			md, _ := metadata.FromOutgoingContext(forwardIdentity(ctx))
+			seen <- observed{md: md}
+			w.WriteHeader(http.StatusOK)
+		}),
+		ReadHeaderTimeout: 5 * time.Second,
+		ConnContext:       jsonConnContext,
+	}
+
+	sock := filepath.Join(t.TempDir(), "http.sock")
+	ln, err := net.Listen("unix", sock)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := srv.Close(); err != nil {
+			t.Logf("close server: %v", err)
+		}
+	})
+	go func() {
+		if err := srv.Serve(ln); err != nil && err != http.ErrServerClosed {
+			t.Logf("serve: %v", err)
+		}
+	}()
+
+	conn, err := net.Dial("unix", sock)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := conn.Close(); err != nil {
+			t.Logf("close conn: %v", err)
+		}
+	})
+
+	// Forge the identity headers on the wire as well.
+	request := "POST /daemon.DaemonService/SetConfig HTTP/1.1\r\n" +
+		"Host: localhost\r\n" +
+		"Grpc-Metadata-X-Netbird-Fwd: 1\r\n" +
+		"Grpc-Metadata-X-Netbird-Fwd-Uid: 0\r\n" +
+		"Content-Length: 0\r\n\r\n"
+	if _, err := conn.Write([]byte(request)); err != nil {
+		t.Fatal(err)
+	}
+
+	select {
+	case got := <-seen:
+		self, err := ipcauth.CurrentProcessIdentity()
+		if err != nil {
+			t.Skipf("cannot read this process's identity: %v", err)
+		}
+		// The socket peer is this test process, so that is the identity the
+		// gateway must forward, not the uid 0 the request asked for.
+		if uids := got.md.Get("x-netbird-fwd-uid"); len(uids) != 1 {
+			t.Fatalf("x-netbird-fwd-uid = %v, want exactly the gateway's own value", uids)
+		}
+		id, ok := ipcauth.CallerIdentity(daemonSideCtx(t, got.md))
+		if !ok {
+			t.Fatal("the forwarded identity should be usable")
+		}
+		if id.UID != self.UID {
+			t.Errorf("authorized as uid %d, want the socket peer %d", id.UID, self.UID)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("the gateway never handled the request")
+	}
+}
diff --git a/client/cmd/service_json_socket_test.go b/client/cmd/service_json_socket_test.go
new file mode 100644
index 000000000..4b39794d7
--- /dev/null
+++ b/client/cmd/service_json_socket_test.go
@@ -0,0 +1,176 @@
+//go:build !ios && !android
+
+package cmd
+
+import (
+	"net"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func preserveJSONSocketTestState(t *testing.T) {
+	t.Helper()
+
+	origJSONSocket := jsonSocket
+	origEnableJSONSocket := enableJSONSocket
+	origChanged := map[string]bool{}
+	serviceCmd.PersistentFlags().VisitAll(func(flag *pflag.Flag) {
+		origChanged[flag.Name] = flag.Changed
+	})
+
+	t.Cleanup(func() {
+		jsonSocket = origJSONSocket
+		enableJSONSocket = origEnableJSONSocket
+		serviceCmd.PersistentFlags().VisitAll(func(flag *pflag.Flag) {
+			flag.Changed = origChanged[flag.Name]
+		})
+	})
+}
+
+func TestJSONSocketFlagsArePositiveEnableOnly(t *testing.T) {
+	assert.NotNil(t, serviceCmd.PersistentFlags().Lookup("enable-json-socket"))
+	assert.NotNil(t, serviceCmd.PersistentFlags().Lookup("json-socket"))
+	assert.Nil(t, serviceCmd.PersistentFlags().Lookup("disable-json-socket"))
+	assert.Equal(t, "false", serviceCmd.PersistentFlags().Lookup("enable-json-socket").DefValue)
+}
+
+func TestBuildServiceArgumentsDefaultDisablesJSONSocket(t *testing.T) {
+	preserveJSONSocketTestState(t)
+
+	enableJSONSocket = false
+	jsonSocket = "tcp://127.0.0.1:8080"
+
+	args := buildServiceArguments()
+
+	assert.NotContains(t, args, "--enable-json-socket")
+	assert.NotContains(t, args, "--json-socket")
+}
+
+func TestBuildServiceArgumentsIncludesJSONSocketWhenEnabled(t *testing.T) {
+	preserveJSONSocketTestState(t)
+
+	enableJSONSocket = true
+	jsonSocket = "tcp://127.0.0.1:8080"
+
+	args := buildServiceArguments()
+
+	enableIndex := indexOfArg(args, "--enable-json-socket")
+	jsonIndex := indexOfArg(args, "--json-socket")
+	require.NotEqual(t, -1, enableIndex)
+	require.NotEqual(t, -1, jsonIndex)
+	require.Less(t, enableIndex, jsonIndex)
+	require.Less(t, jsonIndex+1, len(args))
+	assert.Equal(t, "tcp://127.0.0.1:8080", args[jsonIndex+1])
+}
+
+func TestJSONSocketWithoutEnableValidation(t *testing.T) {
+	preserveJSONSocketTestState(t)
+
+	enableJSONSocket = false
+	require.NoError(t, serviceCmd.PersistentFlags().Set("json-socket", "tcp://127.0.0.1:8080"))
+
+	err := validateJSONSocketFlags()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "--enable-json-socket")
+}
+
+func TestJSONSocketWithEnableValidation(t *testing.T) {
+	preserveJSONSocketTestState(t)
+
+	require.NoError(t, serviceCmd.PersistentFlags().Set("enable-json-socket", "true"))
+	require.NoError(t, serviceCmd.PersistentFlags().Set("json-socket", "tcp://127.0.0.1:8080"))
+
+	assert.NoError(t, validateJSONSocketFlags())
+}
+
+func TestJSONSocketServiceParamsPersistEnableAndAddress(t *testing.T) {
+	preserveJSONSocketTestState(t)
+	serviceCmd.PersistentFlags().VisitAll(func(flag *pflag.Flag) {
+		flag.Changed = false
+	})
+
+	enableJSONSocket = true
+	jsonSocket = "tcp://127.0.0.1:8080"
+
+	params := currentServiceParams()
+	require.True(t, params.EnableJSONSocket)
+	require.Equal(t, "tcp://127.0.0.1:8080", params.JSONSocket)
+
+	enableJSONSocket = false
+	jsonSocket = defaultJSONSocket
+	applyServiceParams(testServiceEnvCommand(), params)
+
+	assert.True(t, enableJSONSocket)
+	assert.Equal(t, "tcp://127.0.0.1:8080", jsonSocket)
+}
+
+func TestRemoveStaleUnixSocketDoesNotRemoveRegularFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "netbird-http.sock")
+	require.NoError(t, os.WriteFile(path, []byte("not a socket"), 0600))
+
+	removeStaleUnixSocket(path)
+
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("not a socket"), data)
+}
+
+func TestRemoveStaleUnixSocketRemovesSocket(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("unix sockets are not available on Windows")
+	}
+
+	path := filepath.Join(t.TempDir(), "netbird-http.sock")
+	addr := &net.UnixAddr{Name: path, Net: "unix"}
+	listener, err := net.ListenUnix("unix", addr)
+	require.NoError(t, err)
+	listener.SetUnlinkOnClose(false)
+	require.NoError(t, listener.Close())
+
+	_, err = os.Lstat(path)
+	require.NoError(t, err, "test setup must leave a stale Unix socket path")
+
+	removeStaleUnixSocket(path)
+
+	_, err = os.Lstat(path)
+	assert.True(t, os.IsNotExist(err), "expected stale Unix socket to be removed, got %v", err)
+}
+
+func TestRemoveStaleUnixSocketDoesNotRemoveLiveSocket(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("unix sockets are not available on Windows")
+	}
+
+	path := filepath.Join(t.TempDir(), "netbird-http.sock")
+	listener, err := net.Listen("unix", path)
+	require.NoError(t, err)
+	defer listener.Close()
+
+	removeStaleUnixSocket(path)
+
+	_, err = os.Lstat(path)
+	assert.NoError(t, err, "expected live Unix socket to be preserved")
+}
+
+func testServiceEnvCommand() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.Flags().StringSlice("service-env", nil, "")
+	return cmd
+}
+
+func indexOfArg(args []string, arg string) int {
+	for i, candidate := range args {
+		if candidate == arg {
+			return i
+		}
+	}
+	return -1
+}
diff --git a/client/cmd/service_params.go b/client/cmd/service_params.go
index 192e0ac60..6e2dbec40 100644
--- a/client/cmd/service_params.go
+++ b/client/cmd/service_params.go
@@ -13,6 +13,8 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/netbirdio/netbird/client/configs"
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/elevate"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -23,6 +25,7 @@ const serviceParamsFile = "service.json"
 type serviceParams struct {
 	LogLevel              string            `json:"log_level"`
 	DaemonAddr            string            `json:"daemon_addr"`
+	JSONSocket            string            `json:"json_socket"`
 	ManagementURL         string            `json:"management_url,omitempty"`
 	ConfigPath            string            `json:"config_path,omitempty"`
 	LogFiles              []string          `json:"log_files,omitempty"`
@@ -30,6 +33,7 @@ type serviceParams struct {
 	DisableUpdateSettings bool              `json:"disable_update_settings,omitempty"`
 	EnableCapture         bool              `json:"enable_capture,omitempty"`
 	DisableNetworks       bool              `json:"disable_networks,omitempty"`
+	EnableJSONSocket      bool              `json:"enable_json_socket,omitempty"`
 	ServiceEnvVars        map[string]string `json:"service_env_vars,omitempty"`
 }
 
@@ -40,10 +44,33 @@ func serviceParamsPath() string {
 
 // loadServiceParams reads saved service parameters from disk.
 // Returns nil with no error if the file does not exist.
+//
+// The file is read by an elevated install and decides the arguments and the
+// environment of the service it then registers, so it is used only when its
+// ownership and permissions are the ones saveServiceParams leaves behind. That
+// restricted ACL is applied when the file is written, which is not necessarily
+// before it is first read, so this is checked rather than assumed. A file that
+// fails the check is treated as absent, and the install proceeds with its
+// defaults.
 func loadServiceParams() (*serviceParams, error) {
 	path := serviceParamsPath()
 
-	data, err := os.ReadFile(path)
+	// Resolve links first so the checks apply to the file that is actually read.
+	// Since the check covers every directory above it as well, nobody who fails
+	// it can swap the file between here and the read below.
+	resolved, err := filepath.EvalSymlinks(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil //nolint:nilnil
+		}
+		return nil, fmt.Errorf("resolve service params %s: %w", path, err)
+	}
+
+	if err := elevate.CheckOnlyOwnerWritable(resolved); err != nil {
+		return nil, fmt.Errorf("refusing to read service params from %s: %w", resolved, err)
+	}
+
+	data, err := os.ReadFile(resolved)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, nil //nolint:nilnil
@@ -75,6 +102,7 @@ func currentServiceParams() *serviceParams {
 	params := &serviceParams{
 		LogLevel:              logLevel,
 		DaemonAddr:            daemonAddr,
+		JSONSocket:            jsonSocket,
 		ManagementURL:         managementURL,
 		ConfigPath:            configPath,
 		LogFiles:              logFiles,
@@ -82,6 +110,7 @@ func currentServiceParams() *serviceParams {
 		DisableUpdateSettings: updateSettingsDisabled,
 		EnableCapture:         captureEnabled,
 		DisableNetworks:       networksDisabled,
+		EnableJSONSocket:      enableJSONSocket,
 	}
 
 	if len(serviceEnvVars) > 0 {
@@ -113,15 +142,29 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {
 		return
 	}
 
-	// For fields with non-empty defaults (log-level, daemon-addr), keep the
-	// != "" guard so that an older service.json missing the field doesn't
-	// clobber the default with an empty string.
+	// For fields with non-empty defaults, keep the != "" guard so that an older
+	// service.json missing the field doesn't clobber the default with an empty string.
 	if !rootCmd.PersistentFlags().Changed("log-level") && params.LogLevel != "" {
 		logLevel = params.LogLevel
 	}
 
 	if !rootCmd.PersistentFlags().Changed("daemon-addr") && params.DaemonAddr != "" {
 		daemonAddr = params.DaemonAddr
+		// An install that predates named-pipe support has the loopback TCP
+		// address saved. Callers carry no identity over TCP, so move it to the
+		// pipe instead of restoring a socket the daemon cannot authorize on.
+		if migrated, ok := daemonaddr.MigrateLegacy(daemonAddr); ok {
+			cmd.Printf("Moving the saved daemon address from %s to %s so the daemon can identify its callers\n", daemonAddr, migrated)
+			daemonAddr = migrated
+		}
+	}
+
+	if !serviceCmd.PersistentFlags().Changed("json-socket") && params.JSONSocket != "" {
+		jsonSocket = params.JSONSocket
+	}
+
+	if !serviceCmd.PersistentFlags().Changed("enable-json-socket") {
+		enableJSONSocket = params.EnableJSONSocket
 	}
 
 	// For optional fields where empty means "use default", always apply so
@@ -163,10 +206,16 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {
 // If --service-env was explicitly set to empty, all saved env vars are cleared.
 // If --service-env was not set, saved env vars are used entirely.
 func applyServiceEnvParams(cmd *cobra.Command, params *serviceParams) {
+	// A forbidden name explicitly passed on the command line is an error the
+	// operator is told about, but one restored from a file written by an older
+	// version is dropped: an install that refuses to run would leave the host
+	// without a daemon over a variable nobody is asking for any more.
+	saved := dropForbiddenServiceEnvVars(cmd, params.ServiceEnvVars)
+
 	if !cmd.Flags().Changed("service-env") {
-		if len(params.ServiceEnvVars) > 0 {
+		if len(saved) > 0 {
 			// No explicit env vars: rebuild serviceEnvVars from saved params.
-			serviceEnvVars = envMapToSlice(params.ServiceEnvVars)
+			serviceEnvVars = envMapToSlice(saved)
 		}
 		return
 	}
@@ -185,13 +234,13 @@ func applyServiceEnvParams(cmd *cobra.Command, params *serviceParams) {
 		return
 	}
 
-	if len(params.ServiceEnvVars) == 0 {
+	if len(saved) == 0 {
 		return
 	}
 
 	// Merge saved values underneath explicit ones.
-	merged := make(map[string]string, len(params.ServiceEnvVars)+len(explicit))
-	maps.Copy(merged, params.ServiceEnvVars)
+	merged := make(map[string]string, len(saved)+len(explicit))
+	maps.Copy(merged, saved)
 	maps.Copy(merged, explicit) // explicit wins on conflict
 	serviceEnvVars = envMapToSlice(merged)
 }
@@ -214,6 +263,20 @@ var resetParamsCmd = &cobra.Command{
 	},
 }
 
+// dropForbiddenServiceEnvVars returns the saved entries that may still be
+// registered on the service, reporting every one it leaves behind.
+func dropForbiddenServiceEnvVars(cmd *cobra.Command, saved map[string]string) map[string]string {
+	kept := make(map[string]string, len(saved))
+	for key, value := range saved {
+		if isForbiddenServiceEnvVar(key) {
+			cmd.PrintErrf("Warning: ignoring saved service environment variable %s: it decides where the service resolves the executables, libraries or temporary files it uses\n", key)
+			continue
+		}
+		kept[key] = value
+	}
+	return kept
+}
+
 // envMapToSlice converts a map of env vars to a KEY=VALUE slice.
 func envMapToSlice(m map[string]string) []string {
 	s := make([]string, 0, len(m))
diff --git a/client/cmd/service_params_test.go b/client/cmd/service_params_test.go
index f338c12f4..1f83374cb 100644
--- a/client/cmd/service_params_test.go
+++ b/client/cmd/service_params_test.go
@@ -9,6 +9,7 @@ import (
 	"go/token"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -41,6 +42,8 @@ func TestSaveAndLoadServiceParams(t *testing.T) {
 	params := &serviceParams{
 		LogLevel:              "debug",
 		DaemonAddr:            "unix:///var/run/netbird.sock",
+		JSONSocket:            "tcp://127.0.0.1:8080",
+		EnableJSONSocket:      true,
 		ManagementURL:         "https://my.server.com",
 		ConfigPath:            "/etc/netbird/config.json",
 		LogFiles:              []string{"/var/log/netbird/client.log", "console"},
@@ -63,6 +66,8 @@ func TestSaveAndLoadServiceParams(t *testing.T) {
 
 	assert.Equal(t, params.LogLevel, loaded.LogLevel)
 	assert.Equal(t, params.DaemonAddr, loaded.DaemonAddr)
+	assert.Equal(t, params.JSONSocket, loaded.JSONSocket)
+	assert.Equal(t, params.EnableJSONSocket, loaded.EnableJSONSocket)
 	assert.Equal(t, params.ManagementURL, loaded.ManagementURL)
 	assert.Equal(t, params.ConfigPath, loaded.ConfigPath)
 	assert.Equal(t, params.LogFiles, loaded.LogFiles)
@@ -101,6 +106,8 @@ func TestLoadServiceParams_InvalidJSON(t *testing.T) {
 func TestCurrentServiceParams(t *testing.T) {
 	origLogLevel := logLevel
 	origDaemonAddr := daemonAddr
+	origJSONSocket := jsonSocket
+	origEnableJSONSocket := enableJSONSocket
 	origManagementURL := managementURL
 	origConfigPath := configPath
 	origLogFiles := logFiles
@@ -110,6 +117,8 @@ func TestCurrentServiceParams(t *testing.T) {
 	t.Cleanup(func() {
 		logLevel = origLogLevel
 		daemonAddr = origDaemonAddr
+		jsonSocket = origJSONSocket
+		enableJSONSocket = origEnableJSONSocket
 		managementURL = origManagementURL
 		configPath = origConfigPath
 		logFiles = origLogFiles
@@ -120,6 +129,8 @@ func TestCurrentServiceParams(t *testing.T) {
 
 	logLevel = "trace"
 	daemonAddr = "tcp://127.0.0.1:9999"
+	jsonSocket = "tcp://127.0.0.1:8080"
+	enableJSONSocket = true
 	managementURL = "https://mgmt.example.com"
 	configPath = "/tmp/test-config.json"
 	logFiles = []string{"/tmp/test.log"}
@@ -131,6 +142,8 @@ func TestCurrentServiceParams(t *testing.T) {
 
 	assert.Equal(t, "trace", params.LogLevel)
 	assert.Equal(t, "tcp://127.0.0.1:9999", params.DaemonAddr)
+	assert.Equal(t, "tcp://127.0.0.1:8080", params.JSONSocket)
+	assert.True(t, params.EnableJSONSocket)
 	assert.Equal(t, "https://mgmt.example.com", params.ManagementURL)
 	assert.Equal(t, "/tmp/test-config.json", params.ConfigPath)
 	assert.Equal(t, []string{"/tmp/test.log"}, params.LogFiles)
@@ -142,6 +155,8 @@ func TestCurrentServiceParams(t *testing.T) {
 func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	origLogLevel := logLevel
 	origDaemonAddr := daemonAddr
+	origJSONSocket := jsonSocket
+	origEnableJSONSocket := enableJSONSocket
 	origManagementURL := managementURL
 	origConfigPath := configPath
 	origLogFiles := logFiles
@@ -151,6 +166,8 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	t.Cleanup(func() {
 		logLevel = origLogLevel
 		daemonAddr = origDaemonAddr
+		jsonSocket = origJSONSocket
+		enableJSONSocket = origEnableJSONSocket
 		managementURL = origManagementURL
 		configPath = origConfigPath
 		logFiles = origLogFiles
@@ -162,6 +179,8 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	// Reset all flags to defaults.
 	logLevel = "info"
 	daemonAddr = "unix:///var/run/netbird.sock"
+	jsonSocket = defaultJSONSocket
+	enableJSONSocket = false
 	managementURL = ""
 	configPath = "/etc/netbird/config.json"
 	logFiles = []string{"/var/log/netbird/client.log"}
@@ -184,6 +203,8 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	saved := &serviceParams{
 		LogLevel:              "debug",
 		DaemonAddr:            "tcp://127.0.0.1:5555",
+		JSONSocket:            "tcp://127.0.0.1:8080",
+		EnableJSONSocket:      true,
 		ManagementURL:         "https://saved.example.com",
 		ConfigPath:            "/saved/config.json",
 		LogFiles:              []string{"/saved/client.log"},
@@ -201,6 +222,8 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 
 	// All other fields were not Changed, so they should use saved values.
 	assert.Equal(t, "tcp://127.0.0.1:5555", daemonAddr)
+	assert.Equal(t, "tcp://127.0.0.1:8080", jsonSocket)
+	assert.True(t, enableJSONSocket)
 	assert.Equal(t, "https://saved.example.com", managementURL)
 	assert.Equal(t, "/saved/config.json", configPath)
 	assert.Equal(t, []string{"/saved/client.log"}, logFiles)
@@ -212,14 +235,17 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 func TestApplyServiceParams_BooleanRevertToFalse(t *testing.T) {
 	origProfilesDisabled := profilesDisabled
 	origUpdateSettingsDisabled := updateSettingsDisabled
+	origEnableJSONSocket := enableJSONSocket
 	t.Cleanup(func() {
 		profilesDisabled = origProfilesDisabled
 		updateSettingsDisabled = origUpdateSettingsDisabled
+		enableJSONSocket = origEnableJSONSocket
 	})
 
 	// Simulate current state where booleans are true (e.g. set by previous install).
 	profilesDisabled = true
 	updateSettingsDisabled = true
+	enableJSONSocket = true
 
 	// Reset Changed state so flags appear unset.
 	serviceCmd.PersistentFlags().VisitAll(func(f *pflag.Flag) {
@@ -238,6 +264,7 @@ func TestApplyServiceParams_BooleanRevertToFalse(t *testing.T) {
 
 	assert.False(t, profilesDisabled, "saved false should override current true")
 	assert.False(t, updateSettingsDisabled, "saved false should override current true")
+	assert.False(t, enableJSONSocket, "saved false should override current true")
 }
 
 func TestApplyServiceParams_ClearManagementURL(t *testing.T) {
@@ -327,6 +354,59 @@ func TestApplyServiceEnvParams_NotChanged(t *testing.T) {
 	assert.Equal(t, map[string]string{"FROM_SAVED": "val"}, result)
 }
 
+func TestParseServiceEnvVars_RejectsForbiddenNames(t *testing.T) {
+	for _, env := range []string{"PATH=C:\\somewhere", "LD_PRELOAD=/tmp/lib.so", "DYLD_FALLBACK_LIBRARY_PATH=/tmp"} {
+		_, err := parseServiceEnvVars([]string{"KEEP=me", env})
+		require.Errorf(t, err, "%s selects what the service resolves and must be refused", env)
+	}
+}
+
+func TestIsForbiddenServiceEnvVar(t *testing.T) {
+	// The loader families are matched by prefix, so a name nobody has heard of
+	// yet is refused too.
+	for _, name := range []string{
+		"PATH", "PATHEXT", "COMSPEC", "SYSTEMROOT", "WINDIR", "TEMP", "TMP",
+		"LD_PRELOAD", "LD_AUDIT", "DYLD_INSERT_LIBRARIES", "DYLD_FALLBACK_FRAMEWORK_PATH",
+	} {
+		assert.Truef(t, isForbiddenServiceEnvVar(name), "%s must be refused", name)
+	}
+
+	// The prefix must not swallow names that merely start with the same letters.
+	for _, name := range []string{"NB_LOG_LEVEL", "NB_WG_DEBUG", "HTTPS_PROXY", "LDAP_URL", "DYLDX"} {
+		assert.Falsef(t, isForbiddenServiceEnvVar(name), "%s has no reason to be refused", name)
+	}
+
+	// On Windows a variable is the same one however it is spelled; elsewhere
+	// Path and PATH are two variables and only the exact one is read.
+	if runtime.GOOS == "windows" {
+		assert.True(t, isForbiddenServiceEnvVar("Path"))
+		assert.True(t, isForbiddenServiceEnvVar("ld_preload"))
+	} else {
+		assert.False(t, isForbiddenServiceEnvVar("Path"))
+		assert.False(t, isForbiddenServiceEnvVar("ld_preload"))
+	}
+}
+
+func TestApplyServiceEnvParams_DropsForbiddenSavedNames(t *testing.T) {
+	origServiceEnvVars := serviceEnvVars
+	t.Cleanup(func() { serviceEnvVars = origServiceEnvVars })
+
+	serviceEnvVars = nil
+
+	cmd := &cobra.Command{}
+	cmd.Flags().StringSlice("service-env", nil, "")
+
+	saved := &serviceParams{
+		ServiceEnvVars: map[string]string{"PATH": "C:\\attacker", "NB_LOG_FORMAT": "json"},
+	}
+
+	applyServiceEnvParams(cmd, saved)
+
+	result, err := parseServiceEnvVars(serviceEnvVars)
+	require.NoError(t, err, "a saved PATH must be dropped rather than fail the install")
+	assert.Equal(t, map[string]string{"NB_LOG_FORMAT": "json"}, result)
+}
+
 func TestApplyServiceEnvParams_ExplicitEmptyClears(t *testing.T) {
 	origServiceEnvVars := serviceEnvVars
 	t.Cleanup(func() { serviceEnvVars = origServiceEnvVars })
@@ -530,6 +610,7 @@ func fieldToGlobalVar(field string) string {
 	m := map[string]string{
 		"LogLevel":              "logLevel",
 		"DaemonAddr":            "daemonAddr",
+		"JSONSocket":            "jsonSocket",
 		"ManagementURL":         "managementURL",
 		"ConfigPath":            "configPath",
 		"LogFiles":              "logFiles",
@@ -537,6 +618,7 @@ func fieldToGlobalVar(field string) string {
 		"DisableUpdateSettings": "updateSettingsDisabled",
 		"EnableCapture":         "captureEnabled",
 		"DisableNetworks":       "networksDisabled",
+		"EnableJSONSocket":      "enableJSONSocket",
 		"ServiceEnvVars":        "serviceEnvVars",
 	}
 	if v, ok := m[field]; ok {
diff --git a/client/cmd/service_params_trust_test.go b/client/cmd/service_params_trust_test.go
new file mode 100644
index 000000000..1cf564445
--- /dev/null
+++ b/client/cmd/service_params_trust_test.go
@@ -0,0 +1,57 @@
+//go:build !windows && !ios && !android
+
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/configs"
+)
+
+// The Windows equivalent of this is the ACL check in
+// elevate.CheckOnlyOwnerWritable, covered by that package's own tests; here the
+// point is that loadServiceParams asks the question at all.
+func TestLoadServiceParams_RefusesWorldWritableFile(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	original := configs.StateDir
+	t.Cleanup(func() { configs.StateDir = original })
+	configs.StateDir = tmpDir
+
+	path := filepath.Join(tmpDir, serviceParamsFile)
+	require.NoError(t, os.WriteFile(path, []byte(`{"log_level":"debug"}`), 0o666))
+	// WriteFile is subject to the umask, so set the bits that matter explicitly.
+	require.NoError(t, os.Chmod(path, 0o666))
+
+	params, err := loadServiceParams()
+	require.Error(t, err, "a service.json anyone can rewrite must not be trusted")
+	assert.Nil(t, params)
+
+	require.NoError(t, os.Chmod(path, 0o600))
+	params, err = loadServiceParams()
+	require.NoError(t, err)
+	require.NotNil(t, params)
+	assert.Equal(t, "debug", params.LogLevel)
+}
+
+func TestLoadServiceParams_RefusesWorldWritableDirectory(t *testing.T) {
+	tmpDir := t.TempDir()
+	stateDir := filepath.Join(tmpDir, "state")
+	require.NoError(t, os.Mkdir(stateDir, 0o777))
+	require.NoError(t, os.Chmod(stateDir, 0o777))
+
+	original := configs.StateDir
+	t.Cleanup(func() { configs.StateDir = original })
+	configs.StateDir = stateDir
+
+	require.NoError(t, os.WriteFile(filepath.Join(stateDir, serviceParamsFile), []byte(`{}`), 0o600))
+
+	params, err := loadServiceParams()
+	require.Error(t, err, "a service.json in a directory anyone can replace entries in must not be trusted")
+	assert.Nil(t, params)
+}
diff --git a/client/cmd/service_pipe_other.go b/client/cmd/service_pipe_other.go
new file mode 100644
index 000000000..c7cc72469
--- /dev/null
+++ b/client/cmd/service_pipe_other.go
@@ -0,0 +1,14 @@
+//go:build !windows
+
+package cmd
+
+import (
+	"fmt"
+	"net"
+)
+
+// listenNamedPipe is Windows-only: no other platform serves the daemon on a
+// named pipe.
+func listenNamedPipe(string) (net.Listener, string, error) {
+	return nil, "", fmt.Errorf("named pipes are only supported on Windows")
+}
diff --git a/client/cmd/service_pipe_windows.go b/client/cmd/service_pipe_windows.go
new file mode 100644
index 000000000..b6e860f51
--- /dev/null
+++ b/client/cmd/service_pipe_windows.go
@@ -0,0 +1,41 @@
+//go:build windows
+
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"net"
+
+	"github.com/Microsoft/go-winio"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// listenNamedPipe creates the daemon control pipe and reports the path it ended
+// up on. The security descriptor lets any local caller connect, as a Unix socket
+// at 0666 does, and the privileged operations are authorized separately from the
+// caller's token.
+//
+// The protected name comes first so that an unprivileged process cannot take the
+// name before the service does. Creating it requires being an administrator or
+// LocalSystem, so a daemon an ordinary user runs themselves, as in netstack mode,
+// falls back to the plain name; clients try both and check who serves them.
+func listenNamedPipe(name string) (net.Listener, string, error) {
+	var errs []error
+	for _, path := range daemonaddr.PipePaths(name) {
+		listener, err := winio.ListenPipe(path, &winio.PipeConfig{
+			SecurityDescriptor: ipcauth.DefaultPipeSDDL(),
+		})
+		if err != nil {
+			log.Debugf("not serving the daemon on %s: %v", path, err)
+			errs = append(errs, fmt.Errorf("%s: %w", path, err))
+			continue
+		}
+		return listener, path, nil
+	}
+
+	return nil, "", errors.Join(errs...)
+}
diff --git a/client/cmd/service_socket.go b/client/cmd/service_socket.go
new file mode 100644
index 000000000..bf3122f7c
--- /dev/null
+++ b/client/cmd/service_socket.go
@@ -0,0 +1,119 @@
+//go:build !ios && !android
+
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"strings"
+	"syscall"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+type socketListener struct {
+	net.Listener
+	network string
+	address string
+}
+
+func listenOnAddress(addr string) (*socketListener, error) {
+	network, address, err := parseListenAddress(addr)
+	if err != nil {
+		return nil, err
+	}
+
+	if network == "npipe" {
+		listener, path, err := listenNamedPipe(address) //nolint:staticcheck
+		if err != nil {                                 //nolint:staticcheck // always errors on non-Windows builds
+			return nil, err
+		}
+		return &socketListener{Listener: listener, network: network, address: path}, nil
+	}
+
+	if network == "unix" {
+		removeStaleUnixSocket(address)
+	}
+
+	listener, err := net.Listen(network, address)
+	if err != nil {
+		return nil, err
+	}
+
+	return &socketListener{Listener: listener, network: network, address: address}, nil
+}
+
+func parseListenAddress(addr string) (string, string, error) {
+	network, address, ok := strings.Cut(addr, "://")
+	if !ok || network == "" || address == "" {
+		return "", "", fmt.Errorf("address must be in [unix|tcp|npipe]://[path|host:port|name] format: %q", addr)
+	}
+
+	switch network {
+	case "unix", "tcp", "npipe":
+		return network, address, nil
+	default:
+		return "", "", fmt.Errorf("unsupported daemon address protocol: %v", network)
+	}
+}
+
+func removeStaleUnixSocket(path string) {
+	stat, err := os.Lstat(path)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			log.Debugf("stat socket file: %v", err)
+		}
+		return
+	}
+
+	if stat.Mode()&os.ModeSocket == 0 {
+		return
+	}
+
+	if !isStaleUnixSocket(path) {
+		return
+	}
+
+	if err := os.Remove(path); err != nil {
+		log.Debugf("remove socket file: %v", err)
+	}
+}
+
+func isStaleUnixSocket(path string) bool {
+	conn, err := net.DialTimeout("unix", path, 100*time.Millisecond)
+	if err == nil {
+		if closeErr := conn.Close(); closeErr != nil {
+			log.Debugf("close unix socket probe: %v", closeErr)
+		}
+		return false
+	}
+
+	if os.IsNotExist(err) || os.IsPermission(err) || os.IsTimeout(err) {
+		log.Debugf("not removing unix socket %s after probe error: %v", path, err)
+		return false
+	}
+
+	return errors.Is(err, syscall.ECONNREFUSED)
+}
+
+func removeStaleUnixSocketForAddress(addr string) {
+	network, address, err := parseListenAddress(addr)
+	if err != nil || network != "unix" {
+		return
+	}
+	removeStaleUnixSocket(address)
+}
+
+func (l *socketListener) chmodUnixSocket(description string) error {
+	if l == nil || l.network != "unix" {
+		return nil
+	}
+
+	if err := os.Chmod(l.address, 0666); err != nil {
+		return fmt.Errorf("failed setting %s permissions for %s: %w", description, l.address, err)
+	}
+	return nil
+}
diff --git a/client/cmd/status.go b/client/cmd/status.go
index 5a7559cf1..f2e5bcc66 100644
--- a/client/cmd/status.go
+++ b/client/cmd/status.go
@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/netip"
 	"strings"
+	"time"
 
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc/status"
@@ -115,8 +116,19 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 	// manager only knows the active profile ID, not its display name.
 	profName := getActiveProfileName(ctx)
 
+	var sessionExpiresAt time.Time
+	if ts := resp.GetSessionExpiresAt(); ts.IsValid() {
+		sessionExpiresAt = ts.AsTime().UTC()
+	}
+
+	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
+	if err != nil {
+		return err
+	}
+
 	var outputInformationHolder = nbstatus.ConvertToStatusOutputOverview(resp.GetFullStatus(), nbstatus.ConvertOptions{
-		Anonymize:            anonymizeFlag,
+		Anonymize:            anonymizeEnabled,
+		AnonymizeLevel:       anonymizeLevel,
 		DaemonVersion:        resp.GetDaemonVersion(),
 		DaemonStatus:         nbstatus.ParseDaemonStatus(status),
 		StatusFilter:         statusFilter,
@@ -125,6 +137,7 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 		IPsFilter:            ipsFilterMap,
 		ConnectionTypeFilter: connectionTypeFilter,
 		ProfileName:          profName,
+		SessionExpiresAt:     sessionExpiresAt,
 	})
 	var statusOutputString string
 	switch {
diff --git a/client/cmd/testutil_test.go b/client/cmd/testutil_test.go
index 205327ef5..46bf31837 100644
--- a/client/cmd/testutil_test.go
+++ b/client/cmd/testutil_test.go
@@ -6,9 +6,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
@@ -28,7 +28,6 @@ import (
 	mgmt "github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -124,9 +123,9 @@ func startManagement(t *testing.T, config *config.Config, testFile string) (*grp
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersmanager), config)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", manager.NewEphemeralManager(store, peersmanager), config, nil)
 
-	accountManager, err := mgmt.BuildManager(ctx, config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	accountManager, err := mgmt.BuildManager(ctx, config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/client/cmd/up.go b/client/cmd/up.go
index 8b3de3c66..e336ba257 100644
--- a/client/cmd/up.go
+++ b/client/cmd/up.go
@@ -2,10 +2,9 @@ package cmd
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"net"
 	"net/netip"
-	"os/user"
 	"runtime"
 	"strings"
 	"time"
@@ -21,18 +20,16 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
+	"github.com/netbirdio/netbird/shared/externalipmap"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/util"
 )
 
-const (
-	invalidInputType int = iota
-	ipInputType
-	interfaceInputType
-)
-
 const (
 	dnsLabelsFlag = "extra-dns-labels"
 
@@ -46,6 +43,8 @@ const (
 	profileNameDesc = "profile name to use for the login. If not specified, the last used profile will be used."
 )
 
+var errDaemonActiveProfileUnsupported = errors.New("daemon does not support active profile lookup")
+
 var (
 	foregroundMode     bool
 	dnsLabels          []string
@@ -101,7 +100,7 @@ func upFunc(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("failed initializing log %v", err)
 	}
 
-	err = validateNATExternalIPs(natExternalIPs)
+	err = externalipmap.Validate(natExternalIPs)
 	if err != nil {
 		return err
 	}
@@ -120,23 +119,25 @@ func upFunc(cmd *cobra.Command, args []string) error {
 
 	pm := profilemanager.NewProfileManager()
 
-	username, err := user.Current()
+	username, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %v", err)
 	}
 
+	var activeProf *profilemanager.Profile
 	var profileSwitched bool
 	// switch profile if provided
 	if profileName != "" {
-		if err := switchOrCreateProfile(cmd.Context(), pm, profileName, username.Username); err != nil {
+		activeProf, err = switchOrCreateProfile(cmd.Context(), pm, profileName, username.Username)
+		if err != nil {
 			return fmt.Errorf("switch profile: %v", err)
 		}
 		profileSwitched = true
-	}
-
-	activeProf, err := pm.GetActiveProfile()
-	if err != nil {
-		return fmt.Errorf("get active profile: %v", err)
+	} else {
+		activeProf, err = pm.GetActiveProfile()
+		if err != nil {
+			return fmt.Errorf("get active profile: %v", err)
+		}
 	}
 
 	if foregroundMode {
@@ -148,13 +149,15 @@ func upFunc(cmd *cobra.Command, args []string) error {
 // switchOrCreateProfile switches the active profile to the one identified by
 // handle, creating it first when it does not exist yet. This restores the
 // pre-0.73 behaviour where `netbird up --profile <name>` auto-creates a
-// missing profile instead of failing.
-func switchOrCreateProfile(ctx context.Context, pm *profilemanager.ProfileManager, handle, username string) error {
+// missing profile instead of failing. Returns the daemon-resolved profile so
+// callers act on it directly instead of re-reading the local state, which is
+// not updated under sudo.
+func switchOrCreateProfile(ctx context.Context, pm *profilemanager.ProfileManager, handle, username string) (*profilemanager.Profile, error) {
 	resolvedID, err := switchProfile(ctx, handle, username)
 	if err != nil {
 		st, ok := gstatus.FromError(err)
 		if !ok || st.Code() != codes.NotFound {
-			return err
+			return nil, err
 		}
 		// Don't fail immediately on a create error: a concurrent run may
 		// have created the profile between the NotFound above and this
@@ -163,16 +166,16 @@ func switchOrCreateProfile(ctx context.Context, pm *profilemanager.ProfileManage
 		_, createErr := createProfile(ctx, handle, username)
 		if resolvedID, err = switchProfile(ctx, handle, username); err != nil {
 			if createErr != nil {
-				return fmt.Errorf("create profile: %w", createErr)
+				return nil, fmt.Errorf("create profile: %w", createErr)
 			}
-			return err
+			return nil, err
 		}
 	}
 
 	if err := pm.SwitchProfile(resolvedID); err != nil {
-		return err
+		return nil, err
 	}
-	return nil
+	return &profilemanager.Profile{ID: resolvedID}, nil
 }
 
 // createProfile dials the daemon and creates a new profile with the given
@@ -226,9 +229,31 @@ func runInForegroundMode(ctx context.Context, cmd *cobra.Command, activeProf *pr
 	if err != nil {
 		return fmt.Errorf("get config file: %v", err)
 	}
+	// CLI foreground path runs without the daemon Server: layer in the
+	// active MDM policy explicitly so a forced ManagementURL / PSK /
+	// other managed key actually takes effect on this run.
+	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
 
 	_, _ = profilemanager.UpdateOldManagementURL(ctx, config, configFilePath)
 
+	// Restore residual state left by a previous run that did not shut down
+	// cleanly, mirroring what the daemon does before connecting: it recovers
+	// DNS config (a stale resolv.conf takeover can make the management
+	// hostname unresolvable), firewall rules, ssh config and legacy routing.
+	// Route cleanup itself happens at engine start; nbnet.Init() below lets
+	// the management dial bypass a leftover fwmark rule until then.
+	// Foreground mode is particularly exposed in containers: a crashed
+	// container restarts inside the same (pod) network namespace, so stale
+	// state survives while the process does not.
+	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configPath).GetStatePath()); err != nil {
+		log.Warnf("failed to restore residual state: %v", err)
+	}
+
+	// Enable advanced routing (as the daemon does on startup) so the
+	// management dial bypasses a leftover fwmark rule instead of being
+	// shunted into a stale routing table.
+	nbnet.Init()
+
 	err = foregroundLogin(ctx, cmd, config, providedSetupKey, activeProf.ID)
 	if err != nil {
 		return fmt.Errorf("foreground login failed: %v", err)
@@ -282,6 +307,30 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 		return fmt.Errorf("unable to get daemon status: %v", err)
 	}
 
+	// Under sudo the invoking user's local active-profile mirror is never
+	// written (the SwitchProfile write is a no-op), and plain root has no
+	// invoking user at all — so the mirror read into activeProf above is stale
+	// or defaulted and must not drive the daemon. With no --profile to make the
+	// choice explicit, take the profile the daemon already holds for this user
+	// instead: it stays on the user's current profile rather than silently
+	// switching to the mirror's default, and refuses when the daemon is on
+	// another user's profile.
+	if profileName == "" && !profilemanager.MirrorIsAuthoritative() {
+		u, err := profilemanager.InvokingUser()
+		if err != nil {
+			return fmt.Errorf("get current user: %v", err)
+		}
+		resolved, err := daemonActiveProfileForUser(ctx, client, u.Username)
+		switch {
+		case errors.Is(err, errDaemonActiveProfileUnsupported):
+			log.Warnf("keeping the locally resolved profile: %v", err)
+		case err != nil:
+			return err
+		default:
+			activeProf = resolved
+		}
+	}
+
 	if status.Status == string(internal.StatusConnected) {
 		if !profileSwitched {
 			cmd.Println("Already connected")
@@ -294,7 +343,7 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 		}
 	}
 
-	username, err := user.Current()
+	username, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %v", err)
 	}
@@ -302,10 +351,18 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 	// set the new config
 	req := setupSetConfigReq(customDNSAddressConverted, cmd, activeProf.ID.String(), username.Username)
 	if _, err := client.SetConfig(ctx, req); err != nil {
-		if st, ok := gstatus.FromError(err); ok && st.Code() == codes.Unavailable {
-			log.Warnf("setConfig method is not available in the daemon: %s", st.Message())
-		} else {
-			return fmt.Errorf("call service setConfig method: %v", err)
+		switch reason, refused := refusedSettingsUpdate(err); {
+		case refused:
+			// Failing here is the point: carrying on would connect while
+			// silently dropping the settings the caller asked for, since
+			// nothing further down the line applies them.
+			return fmt.Errorf("the daemon refused the settings update: %s", reason)
+		case gstatus.Code(err) == codes.Unavailable:
+			// The daemon cannot serve the method at all, which is what this
+			// code means; an older daemon without it lands here.
+			log.Warnf("the daemon did not apply the settings update: %s", gstatus.Convert(err).Message())
+		default:
+			return daemonCallError("call service setConfig method", err)
 		}
 	}
 
@@ -345,10 +402,7 @@ func doDaemonUp(ctx context.Context, cmd *cobra.Command, client proto.DaemonServ
 	err = WithBackOff(func() error {
 		var backOffErr error
 		loginResp, backOffErr = client.Login(ctx, loginRequest)
-		if s, ok := gstatus.FromError(backOffErr); ok && (s.Code() == codes.InvalidArgument ||
-			s.Code() == codes.PermissionDenied ||
-			s.Code() == codes.NotFound ||
-			s.Code() == codes.Unimplemented) {
+		if terminalLoginError(backOffErr) {
 			loginErr = backOffErr
 			return nil
 		}
@@ -359,7 +413,7 @@ func doDaemonUp(ctx context.Context, cmd *cobra.Command, client proto.DaemonServ
 	}
 
 	if loginErr != nil {
-		return fmt.Errorf("login failed: %v", loginErr)
+		return daemonCallError("login failed", loginErr)
 	}
 
 	if loginResp.NeedsSSOLogin {
@@ -372,32 +426,27 @@ func doDaemonUp(ctx context.Context, cmd *cobra.Command, client proto.DaemonServ
 		ProfileName: &profileID,
 		Username:    &username,
 	}); err != nil {
-		return fmt.Errorf("call service up method: %v", err)
+		return daemonCallError("call service up method", err)
 	}
 
 	return nil
 }
 
-func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, profileName, username string) *proto.SetConfigRequest {
-	var req proto.SetConfigRequest
-	req.ProfileName = profileName
-	req.Username = username
-
-	req.ManagementUrl = managementURL
-	req.AdminURL = adminURL
-	req.NatExternalIPs = natExternalIPs
-	req.CustomDNSAddress = customDNSAddressConverted
-	req.ExtraIFaceBlacklist = extraIFaceBlackList
-	req.DnsLabels = dnsLabelsValidated.ToPunycodeList()
-	req.CleanDNSLabels = dnsLabels != nil && len(dnsLabels) == 0
-	req.CleanNATExternalIPs = natExternalIPs != nil && len(natExternalIPs) == 0
-
-	if cmd.Flag(enableRosenpassFlag).Changed {
-		req.RosenpassEnabled = &rosenpassEnabled
-	}
-	if cmd.Flag(rosenpassPermissiveFlag).Changed {
-		req.RosenpassPermissive = &rosenpassPermissive
+// setBoolPtrIfChanged points dst at a copy of val when the named bool flag was
+// explicitly set on cmd. It collapses the repeated
+// "if cmd.Flag(x).Changed { field = &val }" pattern in the request builders into
+// a single call, keeping their cognitive complexity within bounds.
+func setBoolPtrIfChanged(cmd *cobra.Command, name string, dst **bool, val bool) {
+	if cmd.Flag(name).Changed {
+		dst2 := val
+		*dst = &dst2
 	}
+}
+
+// setSSHSetConfigFields copies the SSH server flags the user actually
+// passed into req, leaving the rest unset so the daemon keeps the
+// persisted values.
+func setSSHSetConfigFields(req *proto.SetConfigRequest, cmd *cobra.Command) {
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		req.ServerSSHAllowed = &serverSSHAllowed
 	}
@@ -420,6 +469,47 @@ func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, pro
 		sshJWTCacheTTL32 := int32(sshJWTCacheTTL)
 		req.SshJWTCacheTTL = &sshJWTCacheTTL32
 	}
+}
+
+// refusedSettingsUpdate reports whether err is the daemon refusing the settings
+// a request carried — the update-settings kill switch, or a field an MDM policy
+// manages — and returns the reason it gave.
+//
+// The distinction that matters is against codes.Unavailable, which means the
+// daemon cannot serve the call: that one is worth a warning, because an older
+// daemon without the method lands there and the rest of `netbird up` still
+// works. A refusal is not, because the settings would be silently dropped.
+func refusedSettingsUpdate(err error) (string, bool) {
+	st, ok := gstatus.FromError(err)
+	if !ok || st.Code() != codes.FailedPrecondition {
+		return "", false
+	}
+	return st.Message(), true
+}
+
+func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, profileName, username string) *proto.SetConfigRequest {
+	var req proto.SetConfigRequest
+	req.ProfileName = profileName
+	req.Username = username
+
+	req.ManagementUrl = managementURL
+	req.AdminURL = adminURL
+	req.NatExternalIPs = natExternalIPs
+	req.CustomDNSAddress = customDNSAddressConverted
+	req.ExtraIFaceBlacklist = extraIFaceBlackList
+	req.DnsLabels = dnsLabelsValidated.ToPunycodeList()
+	req.CleanDNSLabels = dnsLabels != nil && len(dnsLabels) == 0
+	req.CleanNATExternalIPs = natExternalIPs != nil && len(natExternalIPs) == 0
+
+	if cmd.Flag(enableRosenpassFlag).Changed {
+		req.RosenpassEnabled = &rosenpassEnabled
+	}
+	if cmd.Flag(rosenpassPermissiveFlag).Changed {
+		req.RosenpassPermissive = &rosenpassPermissive
+	}
+	setSSHSetConfigFields(&req, cmd)
+	setBoolPtrIfChanged(cmd, remoteJobsAllowedFlag, &req.RemoteJobsAllowed, remoteJobsAllowed)
+
 	if cmd.Flag(interfaceNameFlag).Changed {
 		if err := parseInterfaceName(interfaceName); err != nil {
 			log.Errorf("parse interface name: %v", err)
@@ -479,6 +569,13 @@ func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, pro
 		req.DisableIpv6 = &disableIPv6
 	}
 
+	if cmd.Flag(enableLocalMetricsFlag).Changed {
+		req.EnableLocalMetrics = &localMetricsEnabled
+	}
+	if cmd.Flag(localMetricsAddressFlag).Changed {
+		req.LocalMetricsAddress = &localMetricsAddr
+	}
+
 	return &req
 }
 
@@ -503,6 +600,7 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		ic.ServerSSHAllowed = &serverSSHAllowed
 	}
+	setBoolPtrIfChanged(cmd, remoteJobsAllowedFlag, &ic.RemoteJobsAllowed, remoteJobsAllowed)
 
 	if cmd.Flag(enableSSHRootFlag).Changed {
 		ic.EnableSSHRoot = &enableSSHRoot
@@ -596,9 +694,45 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 		ic.DisableIPv6 = &disableIPv6
 	}
 
+	if cmd.Flag(enableLocalMetricsFlag).Changed {
+		ic.LocalMetricsEnabled = &localMetricsEnabled
+	}
+
+	if cmd.Flag(localMetricsAddressFlag).Changed {
+		ic.LocalMetricsAddress = &localMetricsAddr
+	}
+
 	return &ic, nil
 }
 
+// setSSHLoginFields copies the SSH server flags the user actually passed
+// into req, leaving the rest unset so the daemon keeps the persisted
+// values.
+func setSSHLoginFields(req *proto.LoginRequest, cmd *cobra.Command) {
+	if cmd.Flag(serverSSHAllowedFlag).Changed {
+		req.ServerSSHAllowed = &serverSSHAllowed
+	}
+	if cmd.Flag(enableSSHRootFlag).Changed {
+		req.EnableSSHRoot = &enableSSHRoot
+	}
+	if cmd.Flag(enableSSHSFTPFlag).Changed {
+		req.EnableSSHSFTP = &enableSSHSFTP
+	}
+	if cmd.Flag(enableSSHLocalPortForwardFlag).Changed {
+		req.EnableSSHLocalPortForwarding = &enableSSHLocalPortForward
+	}
+	if cmd.Flag(enableSSHRemotePortForwardFlag).Changed {
+		req.EnableSSHRemotePortForwarding = &enableSSHRemotePortForward
+	}
+	if cmd.Flag(disableSSHAuthFlag).Changed {
+		req.DisableSSHAuth = &disableSSHAuth
+	}
+	if cmd.Flag(sshJWTCacheTTLFlag).Changed {
+		sshJWTCacheTTL32 := int32(sshJWTCacheTTL)
+		req.SshJWTCacheTTL = &sshJWTCacheTTL32
+	}
+}
+
 func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte, cmd *cobra.Command) (*proto.LoginRequest, error) {
 	loginRequest := proto.LoginRequest{
 		SetupKey:            providedSetupKey,
@@ -606,7 +740,7 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 		NatExternalIPs:      natExternalIPs,
 		CleanNATExternalIPs: natExternalIPs != nil && len(natExternalIPs) == 0,
 		CustomDNSAddress:    customDNSAddressConverted,
-		IsUnixDesktopClient: isUnixRunningDesktop(),
+		IsUnixDesktopClient: util.HasGraphicalSession(),
 		Hostname:            hostName,
 		ExtraIFaceBlacklist: extraIFaceBlackList,
 		DnsLabels:           dnsLabels,
@@ -625,39 +759,21 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 		loginRequest.RosenpassPermissive = &rosenpassPermissive
 	}
 
-	if cmd.Flag(serverSSHAllowedFlag).Changed {
-		loginRequest.ServerSSHAllowed = &serverSSHAllowed
-	}
-
-	if cmd.Flag(enableSSHRootFlag).Changed {
-		loginRequest.EnableSSHRoot = &enableSSHRoot
-	}
-
-	if cmd.Flag(enableSSHSFTPFlag).Changed {
-		loginRequest.EnableSSHSFTP = &enableSSHSFTP
-	}
-
-	if cmd.Flag(enableSSHLocalPortForwardFlag).Changed {
-		loginRequest.EnableSSHLocalPortForwarding = &enableSSHLocalPortForward
-	}
-
-	if cmd.Flag(enableSSHRemotePortForwardFlag).Changed {
-		loginRequest.EnableSSHRemotePortForwarding = &enableSSHRemotePortForward
-	}
-
-	if cmd.Flag(disableSSHAuthFlag).Changed {
-		loginRequest.DisableSSHAuth = &disableSSHAuth
-	}
-
-	if cmd.Flag(sshJWTCacheTTLFlag).Changed {
-		sshJWTCacheTTL32 := int32(sshJWTCacheTTL)
-		loginRequest.SshJWTCacheTTL = &sshJWTCacheTTL32
-	}
+	setSSHLoginFields(&loginRequest, cmd)
+	setBoolPtrIfChanged(cmd, remoteJobsAllowedFlag, &loginRequest.RemoteJobsAllowed, remoteJobsAllowed)
 
 	if cmd.Flag(disableAutoConnectFlag).Changed {
 		loginRequest.DisableAutoConnect = &autoConnectDisabled
 	}
 
+	if cmd.Flag(enableLocalMetricsFlag).Changed {
+		loginRequest.EnableLocalMetrics = &localMetricsEnabled
+	}
+
+	if cmd.Flag(localMetricsAddressFlag).Changed {
+		loginRequest.LocalMetricsAddress = &localMetricsAddr
+	}
+
 	if cmd.Flag(interfaceNameFlag).Changed {
 		if err := parseInterfaceName(interfaceName); err != nil {
 			return nil, err
@@ -714,36 +830,6 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 	return &loginRequest, nil
 }
 
-func validateNATExternalIPs(list []string) error {
-	for _, element := range list {
-		if element == "" {
-			return fmt.Errorf("empty string is not a valid input for %s", externalIPMapFlag)
-		}
-
-		subElements := strings.Split(element, "/")
-		if len(subElements) > 2 {
-			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"String\" or \"String/String\"", element, externalIPMapFlag)
-		}
-
-		if len(subElements) == 1 && !isValidIP(subElements[0]) {
-			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"IP\" or \"IP/IP\", or \"IP/Interface Name\"", element, externalIPMapFlag)
-		}
-
-		last := 0
-		for _, singleElement := range subElements {
-			inputType, err := validateElement(singleElement)
-			if err != nil {
-				return fmt.Errorf("%s is not a valid input for %s. it should be an IP string or a network name", singleElement, externalIPMapFlag)
-			}
-			if last == interfaceInputType && inputType == interfaceInputType {
-				return fmt.Errorf("%s is not a valid input for %s. it should not contain two interface names", element, externalIPMapFlag)
-			}
-			last = inputType
-		}
-	}
-	return nil
-}
-
 func parseInterfaceName(name string) error {
 	if runtime.GOOS != "darwin" {
 		return nil
@@ -756,39 +842,6 @@ func parseInterfaceName(name string) error {
 	return fmt.Errorf("invalid interface name %s. Please use the prefix utun followed by a number on MacOS. e.g., utun1 or utun199", name)
 }
 
-func validateElement(element string) (int, error) {
-	if isValidIP(element) {
-		return ipInputType, nil
-	}
-	validIface, err := isValidInterface(element)
-	if err != nil {
-		return invalidInputType, fmt.Errorf("unable to validate the network interface name, error: %s", err)
-	}
-
-	if validIface {
-		return interfaceInputType, nil
-	}
-
-	return interfaceInputType, fmt.Errorf("invalid IP or network interface name not found")
-}
-
-func isValidIP(ip string) bool {
-	return net.ParseIP(ip) != nil
-}
-
-func isValidInterface(name string) (bool, error) {
-	netInterfaces, err := net.Interfaces()
-	if err != nil {
-		return false, err
-	}
-	for _, iface := range netInterfaces {
-		if iface.Name == name {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
 func parseCustomDNSAddress(modified bool) ([]byte, error) {
 	var parsed []byte
 	if modified {
@@ -829,3 +882,31 @@ func isValidAddrPort(input string) bool {
 	_, err := netip.ParseAddrPort(input)
 	return err == nil
 }
+
+// daemonActiveProfileForUser returns the profile the daemon currently holds for
+// username, for the no --profile case where the local mirror is not
+// authoritative (sudo or plain root). It returns that profile when the daemon
+// owns it for this user or when the profile is unowned (empty username, as on a
+// fresh install), so the caller acts on the daemon's real state instead of the
+// stale mirror. It denies with a --profile hint when the daemon is on another
+// user's profile, when the lookup fails, or when the daemon reports no active
+// profile. Returns errDaemonActiveProfileUnsupported when the daemon predates
+// the RPC; the caller keeps the mirror-derived profile in that case.
+func daemonActiveProfileForUser(ctx context.Context, client proto.DaemonServiceClient, username string) (*profilemanager.Profile, error) {
+	active, err := client.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{})
+	if err != nil {
+		if st, ok := gstatus.FromError(err); ok && st.Code() == codes.Unimplemented {
+			return nil, fmt.Errorf("%w: %v", errDaemonActiveProfileUnsupported, err)
+		}
+		return nil, fmt.Errorf("pass --profile to choose the profile explicitly: the daemon's active profile could not be verified: %v", err)
+	}
+	if active.GetId() == "" {
+		return nil, fmt.Errorf("pass --profile to choose the profile explicitly: the daemon reported no active profile")
+	}
+	if active.GetUsername() != "" && active.GetUsername() != username {
+		return nil, fmt.Errorf(
+			"pass --profile to choose the profile explicitly: the daemon's active profile is %q (user %q) but this invocation runs for %q",
+			active.GetProfileName(), active.GetUsername(), username)
+	}
+	return &profilemanager.Profile{ID: profilemanager.ID(active.GetId())}, nil
+}
diff --git a/client/cmd/up_setconfig_refusal_test.go b/client/cmd/up_setconfig_refusal_test.go
new file mode 100644
index 000000000..fdf580102
--- /dev/null
+++ b/client/cmd/up_setconfig_refusal_test.go
@@ -0,0 +1,85 @@
+package cmd
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+)
+
+// A refused settings update has to fail `netbird up`, or a caller that asked
+// for a setting the daemon will not apply connects as if it had been applied.
+// The daemon being unable to serve the call is the case that stays a warning.
+func TestRefusedSettingsUpdate(t *testing.T) {
+	tests := []struct {
+		name        string
+		err         error
+		wantRefused bool
+	}{
+		{
+			name:        "the kill switch refused the change",
+			err:         gstatus.Errorf(codes.FailedPrecondition, "update settings are disabled, you cannot use this feature without update settings enabled"),
+			wantRefused: true,
+		},
+		{
+			name:        "an MDM policy manages the field",
+			err:         gstatus.Errorf(codes.FailedPrecondition, "fields managed by MDM policy: managementURL"),
+			wantRefused: true,
+		},
+		{
+			name:        "the daemon cannot serve the call",
+			err:         gstatus.Errorf(codes.Unavailable, "connection refused"),
+			wantRefused: false,
+		},
+		{
+			name:        "any other RPC failure",
+			err:         gstatus.Errorf(codes.Internal, "boom"),
+			wantRefused: false,
+		},
+		{
+			name:        "not a status error at all",
+			err:         errors.New("boom"),
+			wantRefused: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reason, refused := refusedSettingsUpdate(tt.err)
+			require.Equal(t, tt.wantRefused, refused)
+			if tt.wantRefused {
+				require.Equal(t, gstatus.Convert(tt.err).Message(), reason, "the daemon's reason must reach the caller")
+			}
+		})
+	}
+}
+
+// Both `netbird up` and `netbird login` drive Login through the backoff cycle,
+// and a final answer has to stop it: retrying a refusal only replaces the
+// daemon's reason with "login backoff cycle failed" thirty seconds later.
+func TestTerminalLoginError(t *testing.T) {
+	tests := []struct {
+		name         string
+		err          error
+		wantTerminal bool
+	}{
+		{name: "settings refused by the kill switch", err: gstatus.Errorf(codes.FailedPrecondition, "update settings are disabled"), wantTerminal: true},
+		{name: "field managed by MDM", err: gstatus.Errorf(codes.FailedPrecondition, "fields managed by MDM policy: managementURL"), wantTerminal: true},
+		{name: "caller not allowed", err: gstatus.Errorf(codes.PermissionDenied, "nope"), wantTerminal: true},
+		{name: "malformed request", err: gstatus.Errorf(codes.InvalidArgument, "nope"), wantTerminal: true},
+		{name: "profile not found", err: gstatus.Errorf(codes.NotFound, "nope"), wantTerminal: true},
+		{name: "method missing on an older daemon", err: gstatus.Errorf(codes.Unimplemented, "nope"), wantTerminal: true},
+		{name: "daemon unreachable, worth retrying", err: gstatus.Errorf(codes.Unavailable, "connection refused"), wantTerminal: false},
+		{name: "transient internal failure", err: gstatus.Errorf(codes.Internal, "boom"), wantTerminal: false},
+		{name: "not a status error", err: errors.New("boom"), wantTerminal: false},
+		{name: "no error at all, the login succeeded", err: nil, wantTerminal: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.wantTerminal, terminalLoginError(tt.err))
+		})
+	}
+}
diff --git a/client/cmd/up_test.go b/client/cmd/up_test.go
new file mode 100644
index 000000000..9b5f9fbea
--- /dev/null
+++ b/client/cmd/up_test.go
@@ -0,0 +1,88 @@
+package cmd
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+type fakeActiveProfileClient struct {
+	proto.DaemonServiceClient
+	resp *proto.GetActiveProfileResponse
+	err  error
+}
+
+func (f *fakeActiveProfileClient) GetActiveProfile(_ context.Context, _ *proto.GetActiveProfileRequest, _ ...grpc.CallOption) (*proto.GetActiveProfileResponse, error) {
+	return f.resp, f.err
+}
+
+func TestDaemonActiveProfileForUserReturnsOwnProfile(t *testing.T) {
+	client := &fakeActiveProfileClient{resp: &proto.GetActiveProfileResponse{Id: "default", ProfileName: "default", Username: "root"}}
+	prof, err := daemonActiveProfileForUser(context.Background(), client, "root")
+	require.NoError(t, err)
+	require.NotNil(t, prof)
+	assert.Equal(t, profilemanager.ID("default"), prof.ID)
+}
+
+func TestDaemonActiveProfileForUserReturnsUnownedProfile(t *testing.T) {
+	client := &fakeActiveProfileClient{resp: &proto.GetActiveProfileResponse{Id: "default", ProfileName: "default", Username: ""}}
+	prof, err := daemonActiveProfileForUser(context.Background(), client, "root")
+	require.NoError(t, err)
+	require.NotNil(t, prof)
+	assert.Equal(t, profilemanager.ID("default"), prof.ID)
+}
+
+func TestDaemonActiveProfileForUserKeepsDaemonProfileOverStaleMirror(t *testing.T) {
+	client := &fakeActiveProfileClient{resp: &proto.GetActiveProfileResponse{Id: "ab12", ProfileName: "work", Username: "misha"}}
+	prof, err := daemonActiveProfileForUser(context.Background(), client, "misha")
+	require.NoError(t, err)
+	require.NotNil(t, prof)
+	assert.Equal(t, profilemanager.ID("ab12"), prof.ID)
+}
+
+func TestDaemonActiveProfileForUserRejectsOtherUsersProfile(t *testing.T) {
+	client := &fakeActiveProfileClient{resp: &proto.GetActiveProfileResponse{Id: "ab12", ProfileName: "work", Username: "misha"}}
+	prof, err := daemonActiveProfileForUser(context.Background(), client, "root")
+	require.Error(t, err)
+	assert.Nil(t, prof)
+	assert.Contains(t, err.Error(), "--profile")
+}
+
+func TestDaemonActiveProfileForUserRejectsOtherUsersDefaultProfile(t *testing.T) {
+	client := &fakeActiveProfileClient{resp: &proto.GetActiveProfileResponse{Id: "default", ProfileName: "default", Username: "misha"}}
+	prof, err := daemonActiveProfileForUser(context.Background(), client, "root")
+	require.Error(t, err)
+	assert.Nil(t, prof)
+	assert.Contains(t, err.Error(), "--profile")
+}
+
+func TestDaemonActiveProfileForUserRejectsLookupError(t *testing.T) {
+	client := &fakeActiveProfileClient{err: gstatus.Error(codes.Internal, "boom")}
+	prof, err := daemonActiveProfileForUser(context.Background(), client, "root")
+	require.Error(t, err)
+	assert.Nil(t, prof)
+	assert.Contains(t, err.Error(), "--profile")
+}
+
+func TestDaemonActiveProfileForUserRejectsEmptyResponse(t *testing.T) {
+	client := &fakeActiveProfileClient{resp: &proto.GetActiveProfileResponse{}}
+	prof, err := daemonActiveProfileForUser(context.Background(), client, "root")
+	require.Error(t, err)
+	assert.Nil(t, prof)
+	assert.Contains(t, err.Error(), "--profile")
+}
+
+func TestDaemonActiveProfileForUserKeepsMirrorWhenDaemonWithoutRPC(t *testing.T) {
+	client := &fakeActiveProfileClient{err: gstatus.Error(codes.Unimplemented, "unknown method")}
+	prof, err := daemonActiveProfileForUser(context.Background(), client, "root")
+	require.ErrorIs(t, err, errDaemonActiveProfileUnsupported)
+	assert.Nil(t, prof)
+}
diff --git a/client/configs/configs.go b/client/configs/configs.go
index 8f9c3ba28..a1ecf0feb 100644
--- a/client/configs/configs.go
+++ b/client/configs/configs.go
@@ -6,6 +6,11 @@ import (
 	"runtime"
 )
 
+// UILogFile is the file name the desktop UI writes its log to. It is defined
+// here so the UI (writer), the daemon's RegisterUILog validation, and the debug
+// bundle collector all share one definition.
+const UILogFile = "gui-client.log"
+
 var StateDir string
 
 func init() {
diff --git a/client/embed/embed.go b/client/embed/embed.go
index d0d88b177..208e71817 100644
--- a/client/embed/embed.go
+++ b/client/embed/embed.go
@@ -21,7 +21,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	sshcommon "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/client/mdm"
+	nbssh "github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
@@ -53,6 +54,9 @@ type Client struct {
 	jwtToken   string
 	connect    *internal.ConnectClient
 	recorder   *peer.Status
+	// inMemoryState is set when no StatePath was given in netstack mode,
+	// where the client changes nothing on the host that needs restoring.
+	inMemoryState bool
 }
 
 // Options configures a new Client.
@@ -77,7 +81,8 @@ type Options struct {
 	NoUserspace bool
 	// ConfigPath is the path to the netbird config file. If empty, the config will be stored in memory and not persisted.
 	ConfigPath string
-	// StatePath is the path to the netbird state file
+	// StatePath is the path to the netbird state file. When empty in netstack
+	// mode, state is kept in memory; with NoUserspace the default path is used.
 	StatePath string
 	// DisableClientRoutes disables the client routes
 	DisableClientRoutes bool
@@ -85,12 +90,24 @@ type Options struct {
 	DisableIPv6 bool
 	// BlockInbound blocks all inbound connections from peers
 	BlockInbound bool
+	// EnableRosenpass enables the Rosenpass post-quantum key exchange.
+	EnableRosenpass bool
+	// RosenpassPermissive lets a Rosenpass-enabled peer still connect to peers
+	// that do not run Rosenpass (falling back to the plain WireGuard PSK).
+	RosenpassPermissive bool
 	// BlockLANAccess blocks the embedded peer from reaching the host's
 	// LAN (RFC 1918, link-local, loopback) when it's used as a routing
 	// peer. Mirrors profilemanager.ConfigInput.BlockLANAccess. Useful
 	// when the embedded client must never act as a stepping stone into
 	// the host's local network (e.g. the proxy's overlay peer).
 	BlockLANAccess bool
+	// LazyConnectionEnabled is a tri-state local override for lazy connections,
+	// mirroring the NB_LAZY_CONN env var. Nil defers to the management feature
+	// flag; a set value overrides it in both directions. A short-lived client
+	// that reaches only a few known peers can set this to false, so its peers
+	// connect eagerly and the first request does not wait for the connection to
+	// be established.
+	LazyConnectionEnabled *bool
 	// WireguardPort is the port for the tunnel interface. Use 0 for a random port.
 	WireguardPort *int
 	// MTU is the MTU for the tunnel interface.
@@ -101,6 +118,9 @@ type Options struct {
 	MTU *uint16
 	// DNSLabels defines additional DNS labels configured in the peer.
 	DNSLabels []string
+	// NATExternalIPs maps external IPs to internal IPs or interfaces for ICE
+	// candidates, same format as the agent's --external-ip-map flag.
+	NATExternalIPs []string
 	// Performance configures the tunnel's buffer pool cap and batch size.
 	Performance Performance
 }
@@ -180,7 +200,6 @@ func New(opts Options) (*Client, error) {
 	}
 
 	if opts.StatePath != "" {
-		// TODO: Disable state if path not provided
 		if err := os.Setenv("NB_DNS_STATE_FILE", opts.StatePath); err != nil {
 			return nil, fmt.Errorf("setenv: %w", err)
 		}
@@ -203,9 +222,12 @@ func New(opts Options) (*Client, error) {
 		DisableIPv6:         &opts.DisableIPv6,
 		BlockInbound:        &opts.BlockInbound,
 		BlockLANAccess:      &opts.BlockLANAccess,
+		RosenpassEnabled:    &opts.EnableRosenpass,
+		RosenpassPermissive: &opts.RosenpassPermissive,
 		WireguardPort:       opts.WireguardPort,
 		MTU:                 opts.MTU,
 		DNSLabels:           parsedLabels,
+		NATExternalIPs:      opts.NATExternalIPs,
 	}
 	if opts.ConfigPath != "" {
 		config, err = profilemanager.UpdateOrCreateConfig(input)
@@ -215,11 +237,24 @@ func New(opts Options) (*Client, error) {
 	if err != nil {
 		return nil, fmt.Errorf("create config: %w", err)
 	}
+	// Embedded path runs without the daemon Server: apply the active
+	// MDM policy explicitly so a forced ManagementURL / PSK / other
+	// managed key takes effect on this embedded engine instance.
+	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
 
 	if opts.PrivateKey != "" {
 		config.PrivateKey = opts.PrivateKey
 	}
 
+	if opts.LazyConnectionEnabled != nil {
+		// Runtime-only override, read back through lazyconn.ParseState; a set value
+		// wins over the management feature flag in both directions.
+		config.LazyConnection = "off"
+		if *opts.LazyConnectionEnabled {
+			config.LazyConnection = "on"
+		}
+	}
+
 	if opts.Performance.PreallocatedBuffersPerPool != nil {
 		wgdevice.SetPreallocatedBuffersPerPool(*opts.Performance.PreallocatedBuffersPerPool)
 	}
@@ -233,6 +268,9 @@ func New(opts Options) (*Client, error) {
 		jwtToken:   opts.JWTToken,
 		config:     config,
 		recorder:   peer.NewRecorder(config.ManagementURL.String()),
+		// Without a path the default would be the installed agent's state
+		// file, which this client must neither read nor overwrite.
+		inMemoryState: opts.StatePath == "" && !opts.NoUserspace,
 	}, nil
 }
 
@@ -264,7 +302,11 @@ func (c *Client) Start(startCtx context.Context) error {
 	if err, _ := authClient.Login(ctx, c.setupKey, c.jwtToken); err != nil {
 		return fmt.Errorf("login: %w", err)
 	}
-	client := internal.NewConnectClient(ctx, c.config, c.recorder)
+	var connectOpts []internal.ConnectClientOption
+	if c.inMemoryState {
+		connectOpts = append(connectOpts, internal.WithInMemoryState())
+	}
+	client := internal.NewConnectClient(ctx, c.config, c.recorder, connectOpts...)
 	client.SetSyncResponsePersistence(true)
 
 	// either startup error (permanent backoff err) or nil err (successful engine up)
@@ -470,7 +512,7 @@ func (c *Client) Status() (peer.FullStatus, error) {
 	if connect != nil {
 		engine := connect.Engine()
 		if engine != nil {
-			_ = engine.RunHealthProbes(false)
+			_ = engine.RunHealthProbes(context.Background(), false)
 		}
 	}
 
@@ -521,12 +563,7 @@ func (c *Client) VerifySSHHostKey(peerAddress string, key []byte) error {
 		return err
 	}
 
-	storedKey, found := engine.GetPeerSSHKey(peerAddress)
-	if !found {
-		return sshcommon.ErrPeerNotFound
-	}
-
-	return sshcommon.VerifyHostKey(storedKey, key, peerAddress)
+	return nbssh.PeerKeyLookup(engine.GetPeerSSHKey).VerifySSHHostKey(peerAddress, key)
 }
 
 // SetPerformance retunes a running Client. Only PreallocatedBuffersPerPool
diff --git a/client/embed/embed_test.go b/client/embed/embed_test.go
index a2f438975..a818af055 100644
--- a/client/embed/embed_test.go
+++ b/client/embed/embed_test.go
@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -21,7 +21,6 @@ import (
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -146,8 +145,8 @@ func startManagement(t *testing.T, signalAddr string) string {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(context.Background(), testStore)
-	networkMapController := controller.NewController(context.Background(), testStore, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(testStore, peersManager), cfg)
-	accountManager, err := mgmt.BuildManager(context.Background(), cfg, testStore, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(context.Background(), testStore, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", manager.NewEphemeralManager(testStore, peersManager), cfg, nil)
+	accountManager, err := mgmt.BuildManager(context.Background(), cfg, testStore, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	require.NoError(t, err)
 
 	secretsManager, err := nbgrpc.NewTimeBasedAuthSecretsManager(updateManager, cfg.TURNConfig, cfg.Relay, settingsMockManager, groupsManager)
diff --git a/client/firewall/allower_other.go b/client/firewall/allower_other.go
new file mode 100644
index 000000000..4d2ec9094
--- /dev/null
+++ b/client/firewall/allower_other.go
@@ -0,0 +1,11 @@
+//go:build android || (!linux && !windows)
+
+package firewall
+
+import "github.com/netbirdio/netbird/client/firewall/uspfilter"
+
+// interfaceAllower returns no allower: these platforms have no host firewall to
+// open for the interface.
+func interfaceAllower(IFaceMapper, uint16) uspfilter.InterfaceAllower {
+	return nil
+}
diff --git a/client/firewall/allower_windows.go b/client/firewall/allower_windows.go
new file mode 100644
index 000000000..b9efa18a4
--- /dev/null
+++ b/client/firewall/allower_windows.go
@@ -0,0 +1,10 @@
+//go:build windows
+
+package firewall
+
+import "github.com/netbirdio/netbird/client/firewall/uspfilter"
+
+// interfaceAllower returns the Windows netsh-based interface allower.
+func interfaceAllower(iface IFaceMapper, _ uint16) uspfilter.InterfaceAllower {
+	return uspfilter.NewWindowsInterfaceAllower(iface)
+}
diff --git a/client/firewall/create.go b/client/firewall/create.go
index 24f12bc6d..cb68a0d04 100644
--- a/client/firewall/create.go
+++ b/client/firewall/create.go
@@ -6,8 +6,6 @@ import (
 	"fmt"
 	"runtime"
 
-	log "github.com/sirupsen/logrus"
-
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/firewall/uspfilter"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
@@ -21,13 +19,11 @@ func NewFirewall(iface IFaceMapper, _ *statemanager.Manager, flowLogger nftypes.
 	}
 
 	// use userspace packet filtering firewall
-	fm, err := uspfilter.Create(iface, disableServerRoutes, flowLogger, mtu)
-	if err != nil {
-		return nil, err
-	}
-	err = fm.AllowNetbird()
-	if err != nil {
-		log.Warnf("failed to allow netbird interface traffic: %v", err)
-	}
-	return fm, nil
+	return uspfilter.Create(uspfilter.Config{
+		IFace:               iface,
+		DisableServerRoutes: disableServerRoutes,
+		FlowLogger:          flowLogger,
+		MTU:                 mtu,
+		InterfaceAllower:    interfaceAllower(iface, mtu),
+	})
 }
diff --git a/client/firewall/create_linux.go b/client/firewall/create_linux.go
index d916ebad4..d585e85d7 100644
--- a/client/firewall/create_linux.go
+++ b/client/firewall/create_linux.go
@@ -16,6 +16,7 @@ import (
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	nbnftables "github.com/netbirdio/netbird/client/firewall/nftables"
 	"github.com/netbirdio/netbird/client/firewall/uspfilter"
+	"github.com/netbirdio/netbird/client/iface/netstack"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 )
@@ -29,47 +30,107 @@ const (
 	NFTABLES
 )
 
-// SKIP_NFTABLES_ENV is the environment variable to skip nftables check
-const SKIP_NFTABLES_ENV = "NB_SKIP_NFTABLES_CHECK"
+// SkipNftablesEnv is the environment variable to skip nftables check
+const SkipNftablesEnv = "NB_SKIP_NFTABLES_CHECK"
+
+// errNoFirewallManager indicates no kernel firewall backend is present,
+// as opposed to a backend that exists but failed to create or initialize.
+var errNoFirewallManager = errors.New("no firewall manager found")
 
 // FWType is the type for the firewall type
 type FWType int
 
 func NewFirewall(iface IFaceMapper, stateManager *statemanager.Manager, flowLogger nftypes.FlowLogger, disableServerRoutes bool, mtu uint16) (firewall.Manager, error) {
-	// We run in userspace mode and force userspace firewall was requested. We don't attempt native firewall.
-	if iface.IsUserspaceBind() && forceUserspaceFirewall() {
-		log.Info("forcing userspace firewall")
-		return createUserspaceFirewall(iface, nil, disableServerRoutes, flowLogger, mtu)
+	// Userspace firewall without a native counterpart: routing is handled
+	// entirely in userspace. The interface is opened in the kernel's foreign
+	// filter chains via a table-less allower, except in netstack mode where no
+	// kernel interface exists.
+	if netstack.IsEnabled() || (iface.IsUserspaceBind() && forceUserspaceFirewall()) {
+		if netstack.IsEnabled() {
+			log.Info("netstack mode, using userspace firewall")
+		} else {
+			log.Info("forcing userspace firewall")
+		}
+		cfg := uspfilter.Config{
+			IFace:               iface,
+			DisableServerRoutes: disableServerRoutes,
+			FlowLogger:          flowLogger,
+			MTU:                 mtu,
+			InterfaceAllower:    interfaceAllower(iface, mtu),
+		}
+
+		return uspfilter.Create(cfg)
 	}
 
 	// Use native firewall for either kernel or userspace, the interface appears identical to netfilter
-	fm, err := createNativeFirewall(iface, stateManager, disableServerRoutes, mtu)
-
-	// Kernel cannot fall back to anything else, need to return error
-	if !iface.IsUserspaceBind() {
-		return fm, err
-	}
-
-	// Fall back to the userspace packet filter if native is unavailable
-	if err != nil {
-		log.Warnf("failed to create native firewall: %v. Proceeding with userspace", err)
-		return createUserspaceFirewall(iface, nil, disableServerRoutes, flowLogger, mtu)
-	}
-
-	// Native firewall handles packet filtering, but the userspace WireGuard bind
-	// needs a device filter for DNS interception hooks. Install a minimal
-	// hooks-only filter that passes all traffic through to the kernel firewall.
-	if err := iface.SetFilter(&uspfilter.HooksFilter{}); err != nil {
-		log.Warnf("failed to set hooks filter, DNS via memory hooks will not work: %v", err)
+	fm, err := createNativeFirewall(iface, stateManager, mtu)
+	switch {
+	case err == nil && !iface.IsUserspaceBind():
+		// Nothing to do, fall through
+	case err == nil && iface.IsUserspaceBind():
+		// Native firewall handles packet filtering, but the userspace WireGuard bind
+		// needs a device filter for DNS interception hooks. Install a minimal
+		// hooks-only filter that passes all traffic through to the kernel firewall.
+		if err := iface.SetFilter(&uspfilter.HooksFilter{}); err != nil {
+			log.Warnf("failed to set hooks filter, DNS via memory hooks will not work: %v", err)
+		}
+	case err != nil && !iface.IsUserspaceBind():
+		// Kernel cannot fall back to anything else, need to return error
+		return nil, err
+	case err != nil && iface.IsUserspaceBind():
+		// Fall back to the userspace packet filter if native is unavailable
+		logNativeFirewallUnavailable(err)
+		return uspfilter.Create(uspfilter.Config{
+			IFace:               iface,
+			DisableServerRoutes: disableServerRoutes,
+			FlowLogger:          flowLogger,
+			MTU:                 mtu,
+			InterfaceAllower:    interfaceAllower(iface, mtu),
+		})
 	}
 
 	return fm, nil
 }
 
-func createNativeFirewall(iface IFaceMapper, stateManager *statemanager.Manager, routes bool, mtu uint16) (firewall.Manager, error) {
+// interfaceAllower selects how the userspace firewall opens the interface in
+// foreign kernel chains: nftables when available (which also opens foreign nft
+// tables), else iptables (the legacy fallback, filter INPUT only), else nil.
+// firewalld trust is applied separately by the manager. Netstack has no kernel
+// interface to open.
+func interfaceAllower(iface IFaceMapper, mtu uint16) uspfilter.InterfaceAllower {
+	if netstack.IsEnabled() {
+		return nil
+	}
+
+	nftAllower, err := nbnftables.NewInterfaceAllower(iface, mtu)
+	if err == nil {
+		return nftAllower
+	}
+	log.Infof("no nftables interface allower: %v", err)
+
+	iptAllower, err := nbiptables.NewInterfaceAllower(iface)
+	if err == nil {
+		return iptAllower
+	}
+	log.Infof("no iptables interface allower: %v", err)
+
+	return nil
+}
+
+// logNativeFirewallUnavailable logs the fallback to userspace at info level
+// when no kernel firewall backend exists, and at warn level otherwise.
+func logNativeFirewallUnavailable(err error) {
+	if errors.Is(err, errNoFirewallManager) {
+		log.Infof("no native firewall backend available: %v. Proceeding with userspace", err)
+	} else {
+		log.Warnf("failed to create native firewall: %v. Proceeding with userspace", err)
+	}
+}
+
+func createNativeFirewall(iface IFaceMapper, stateManager *statemanager.Manager, mtu uint16) (firewall.Manager, error) {
 	fm, err := createFW(iface, mtu)
 	if err != nil {
-		return nil, fmt.Errorf("create firewall: %s", err)
+		return nil, fmt.Errorf("create firewall: %w", err)
 	}
 
 	if err = fm.Init(stateManager); err != nil {
@@ -88,29 +149,10 @@ func createFW(iface IFaceMapper, mtu uint16) (firewall.Manager, error) {
 		log.Info("creating an nftables firewall manager")
 		return nbnftables.Create(iface, mtu)
 	default:
-		log.Info("no firewall manager found, trying to use userspace packet filtering firewall")
-		return nil, errors.New("no firewall manager found")
+		return nil, errNoFirewallManager
 	}
 }
 
-func createUserspaceFirewall(iface IFaceMapper, fm firewall.Manager, disableServerRoutes bool, flowLogger nftypes.FlowLogger, mtu uint16) (firewall.Manager, error) {
-	var errUsp error
-	if fm != nil {
-		fm, errUsp = uspfilter.CreateWithNativeFirewall(iface, fm, disableServerRoutes, flowLogger, mtu)
-	} else {
-		fm, errUsp = uspfilter.Create(iface, disableServerRoutes, flowLogger, mtu)
-	}
-
-	if errUsp != nil {
-		return nil, fmt.Errorf("create userspace firewall: %s", errUsp)
-	}
-
-	if err := fm.AllowNetbird(); err != nil {
-		log.Errorf("failed to allow netbird interface traffic: %v", err)
-	}
-	return fm, nil
-}
-
 // check returns the firewall type based on common lib checks. It returns UNKNOWN if no firewall is found.
 func check() FWType {
 	useIPTABLES := false
@@ -132,35 +174,38 @@ func check() FWType {
 		}
 	}
 
-	nf := nftables.Conn{}
-	if chains, err := nf.ListChains(); err == nil && os.Getenv(SKIP_NFTABLES_ENV) != "true" {
-		if !useIPTABLES {
-			return NFTABLES
-		}
-
-		// search for chains where table is filter
-		// if we find one, we assume that nftables manager can be used with iptables
-		for _, chain := range chains {
-			if chain.Table.Name == "filter" {
+	// Honor the skip env before probing nftables at all.
+	if os.Getenv(SkipNftablesEnv) != "true" {
+		nf := nftables.Conn{}
+		if chains, err := nf.ListChains(); err == nil {
+			if !useIPTABLES {
 				return NFTABLES
 			}
-		}
 
-		// check tables for the following constraints:
-		// 1. there is no chain in nftables for the filter table and there is at least one chain in iptables, we assume that nftables manager can not be used
-		// 2. there is no tables or more than one table, we assume that nftables manager can be used
-		// 3. there is only one table and its name is filter, we assume that nftables manager can not be used, since there was no chain in it
-		// 4. if we find an error we log and continue with iptables check
-		nbTablesList, err := nf.ListTables()
-		switch {
-		case err == nil && len(iptablesChains) > 0:
-			return IPTABLES
-		case err == nil && len(nbTablesList) != 1:
-			return NFTABLES
-		case err == nil && len(nbTablesList) == 1 && nbTablesList[0].Name == "filter":
-			return IPTABLES
-		case err != nil:
-			log.Errorf("failed to list nftables tables on fw manager discovery: %s", err)
+			// search for chains where table is filter
+			// if we find one, we assume that nftables manager can be used with iptables
+			for _, chain := range chains {
+				if chain.Table.Name == "filter" {
+					return NFTABLES
+				}
+			}
+
+			// check tables for the following constraints:
+			// 1. there is no chain in nftables for the filter table and there is at least one chain in iptables, we assume that nftables manager can not be used
+			// 2. there is no tables or more than one table, we assume that nftables manager can be used
+			// 3. there is only one table and its name is filter, we assume that nftables manager can not be used, since there was no chain in it
+			// 4. if we find an error we log and continue with iptables check
+			nbTablesList, err := nf.ListTables()
+			switch {
+			case err == nil && len(iptablesChains) > 0:
+				return IPTABLES
+			case err == nil && len(nbTablesList) != 1:
+				return NFTABLES
+			case err == nil && len(nbTablesList) == 1 && nbTablesList[0].Name == "filter":
+				return IPTABLES
+			case err != nil:
+				log.Errorf("failed to list nftables tables on fw manager discovery: %s", err)
+			}
 		}
 	}
 
@@ -176,15 +221,21 @@ func isIptablesClientAvailable(client *iptables.IPTables) bool {
 	return err == nil
 }
 
+// forceUserspaceFirewall reports whether the userspace firewall is forced.
+// NB_FORCE_USERSPACE_ROUTER is an alias: forcing userspace routing implies the
+// userspace firewall, since the two are no longer separable.
 func forceUserspaceFirewall() bool {
-	val := os.Getenv(EnvForceUserspaceFirewall)
+	return envForceBool(EnvForceUserspaceFirewall) || envForceBool(uspfilter.EnvForceUserspaceRouter)
+}
+
+func envForceBool(name string) bool {
+	val := os.Getenv(name)
 	if val == "" {
 		return false
 	}
-
 	force, err := strconv.ParseBool(val)
 	if err != nil {
-		log.Warnf("failed to parse %s: %v", EnvForceUserspaceFirewall, err)
+		log.Warnf("failed to parse %s: %v", name, err)
 		return false
 	}
 	return force
diff --git a/client/firewall/firewalld/firewalld.go b/client/firewall/firewalld/firewalld.go
index 188ea61dd..38a4efdbc 100644
--- a/client/firewall/firewalld/firewalld.go
+++ b/client/firewall/firewalld/firewalld.go
@@ -2,8 +2,8 @@
 // its wg interface into firewalld's "trusted" zone. This is required because
 // firewalld's nftables chains are created with NFT_CHAIN_OWNER on recent
 // versions, which returns EPERM to any other process that tries to insert
-// rules into them. The workaround mirrors what Tailscale does: let firewalld
-// itself add the accept rules to its own chains by trusting the interface.
+// rules into them. Trusting the interface makes firewalld itself add the
+// accept rules to its own chains instead.
 package firewalld
 
 // TrustedZone is the firewalld zone name used for interfaces whose traffic
diff --git a/client/firewall/iptables/acl_linux.go b/client/firewall/iptables/acl_linux.go
deleted file mode 100644
index 4b4cebf9c..000000000
--- a/client/firewall/iptables/acl_linux.go
+++ /dev/null
@@ -1,560 +0,0 @@
-package iptables
-
-import (
-	"errors"
-	"fmt"
-	"maps"
-	"net"
-	"slices"
-
-	"github.com/coreos/go-iptables/iptables"
-	"github.com/google/uuid"
-	ipset "github.com/lrh3321/ipset-go"
-	log "github.com/sirupsen/logrus"
-
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/internal/statemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
-)
-
-const (
-	tableName = "filter"
-
-	// rules chains contains the effective ACL rules
-	chainNameInputRules = "NETBIRD-ACL-INPUT"
-
-	// mangleFwdKey is the entries map key for mangle FORWARD guard rules that prevent
-	// external DNAT from bypassing ACL rules.
-	mangleFwdKey = "MANGLE-FORWARD"
-)
-
-type aclEntries map[string][][]string
-
-type entry struct {
-	spec     []string
-	position int
-}
-
-type aclManager struct {
-	iptablesClient  *iptables.IPTables
-	wgIface         iFaceMapper
-	entries         aclEntries
-	optionalEntries map[string][]entry
-	ipsetStore      *ipsetStore
-	v6              bool
-
-	stateManager *statemanager.Manager
-}
-
-func newAclManager(iptablesClient *iptables.IPTables, wgIface iFaceMapper) (*aclManager, error) {
-	return &aclManager{
-		iptablesClient:  iptablesClient,
-		wgIface:         wgIface,
-		entries:         make(map[string][][]string),
-		optionalEntries: make(map[string][]entry),
-		ipsetStore:      newIpsetStore(),
-		v6:              iptablesClient.Proto() == iptables.ProtocolIPv6,
-	}, nil
-}
-
-func (m *aclManager) init(stateManager *statemanager.Manager) error {
-	m.stateManager = stateManager
-
-	m.seedInitialEntries()
-	m.seedInitialOptionalEntries()
-
-	if err := m.cleanChains(); err != nil {
-		return fmt.Errorf("clean chains: %w", err)
-	}
-
-	if err := m.createDefaultChains(); err != nil {
-		return fmt.Errorf("create default chains: %w", err)
-	}
-
-	m.updateState()
-
-	return nil
-}
-
-func (m *aclManager) AddPeerFiltering(
-	id []byte,
-	ip net.IP,
-	protocol firewall.Protocol,
-	sPort *firewall.Port,
-	dPort *firewall.Port,
-	action firewall.Action,
-	ipsetName string,
-) ([]firewall.Rule, error) {
-	chain := chainNameInputRules
-
-	ipsetName = transformIPsetName(ipsetName, sPort, dPort, action)
-	if m.v6 && ipsetName != "" {
-		ipsetName += "-v6"
-	}
-	proto := protoForFamily(protocol, m.v6)
-	specs := filterRuleSpecs(ip, proto, sPort, dPort, action, ipsetName)
-
-	mangleSpecs := slices.Clone(specs)
-	mangleSpecs = append(mangleSpecs,
-		"-i", m.wgIface.Name(),
-		"-m", "addrtype", "--dst-type", "LOCAL",
-		"-j", "MARK", "--set-xmark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected),
-	)
-
-	specs = append(specs, "-j", actionToStr(action))
-	if ipsetName != "" {
-		if ipList, ipsetExists := m.ipsetStore.ipset(ipsetName); ipsetExists {
-			if err := m.addToIPSet(ipsetName, ip); err != nil {
-				return nil, fmt.Errorf("add IP to ipset: %w", err)
-			}
-			// if ruleset already exists it means we already have the firewall rule
-			// so we need to update IPs in the ruleset and return new fw.Rule object for ACL manager.
-			ipList.addIP(ip.String())
-			return []firewall.Rule{&Rule{
-				ruleID:    uuid.New().String(),
-				ipsetName: ipsetName,
-				ip:        ip.String(),
-				chain:     chain,
-				specs:     specs,
-				v6:        m.v6,
-			}}, nil
-		}
-
-		if err := m.flushIPSet(ipsetName); err != nil {
-			if errors.Is(err, ipset.ErrSetNotExist) {
-				log.Debugf("flush ipset %s before use: %v", ipsetName, err)
-			} else {
-				log.Errorf("flush ipset %s before use: %v", ipsetName, err)
-			}
-		}
-		if err := m.createIPSet(ipsetName); err != nil {
-			return nil, fmt.Errorf("create ipset: %w", err)
-		}
-		if err := m.addToIPSet(ipsetName, ip); err != nil {
-			return nil, fmt.Errorf("add IP to ipset: %w", err)
-		}
-
-		ipList := newIpList(ip.String())
-		m.ipsetStore.addIpList(ipsetName, ipList)
-	}
-
-	ok, err := m.iptablesClient.Exists(tableFilter, chain, specs...)
-	if err != nil {
-		return nil, fmt.Errorf("failed to check rule: %w", err)
-	}
-	if ok {
-		return nil, fmt.Errorf("rule already exists")
-	}
-
-	// Insert DROP rules at the beginning, append ACCEPT rules at the end
-	if action == firewall.ActionDrop {
-		// Insert at the beginning of the chain (position 1)
-		err = m.iptablesClient.Insert(tableFilter, chain, 1, specs...)
-	} else {
-		err = m.iptablesClient.Append(tableFilter, chain, specs...)
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	if err := m.iptablesClient.Append(tableMangle, chainRTPRE, mangleSpecs...); err != nil {
-		log.Errorf("failed to add mangle rule: %v", err)
-		mangleSpecs = nil
-	}
-
-	rule := &Rule{
-		ruleID:      uuid.New().String(),
-		specs:       specs,
-		mangleSpecs: mangleSpecs,
-		ipsetName:   ipsetName,
-		ip:          ip.String(),
-		chain:       chain,
-		v6:          m.v6,
-	}
-
-	m.updateState()
-
-	return []firewall.Rule{rule}, nil
-}
-
-// DeletePeerRule from the firewall by rule definition
-func (m *aclManager) DeletePeerRule(rule firewall.Rule) error {
-	r, ok := rule.(*Rule)
-	if !ok {
-		return fmt.Errorf("invalid rule type")
-	}
-
-	shouldDestroyIpset := false
-	if ipsetList, ok := m.ipsetStore.ipset(r.ipsetName); ok {
-		// delete IP from ruleset IPs list and ipset
-		if _, ok := ipsetList.ips[r.ip]; ok {
-			ip := net.ParseIP(r.ip)
-			if ip == nil {
-				return fmt.Errorf("parse IP %s", r.ip)
-			}
-			if err := m.delFromIPSet(r.ipsetName, ip); err != nil {
-				return fmt.Errorf("delete ip from ipset: %w", err)
-			}
-			delete(ipsetList.ips, r.ip)
-		}
-
-		// if after delete, set still contains other IPs,
-		// no need to delete firewall rule and we should exit here
-		if len(ipsetList.ips) != 0 {
-			return nil
-		}
-
-		// we delete last IP from the set, that means we need to delete
-		// set itself and associated firewall rule too
-		m.ipsetStore.deleteIpset(r.ipsetName)
-		shouldDestroyIpset = true
-	}
-
-	if err := m.iptablesClient.Delete(tableName, r.chain, r.specs...); err != nil {
-		return fmt.Errorf("failed to delete rule: %s, %v: %w", r.chain, r.specs, err)
-	}
-
-	if r.mangleSpecs != nil {
-		if err := m.iptablesClient.Delete(tableMangle, chainRTPRE, r.mangleSpecs...); err != nil {
-			log.Errorf("failed to delete mangle rule: %v", err)
-		}
-	}
-
-	if shouldDestroyIpset {
-		if err := m.destroyIPSet(r.ipsetName); err != nil {
-			if errors.Is(err, ipset.ErrBusy) || errors.Is(err, ipset.ErrSetNotExist) {
-				log.Debugf("destroy empty ipset: %v", err)
-			} else {
-				log.Errorf("destroy empty ipset: %v", err)
-			}
-		}
-	}
-
-	m.updateState()
-
-	return nil
-}
-
-func (m *aclManager) Reset() error {
-	if err := m.cleanChains(); err != nil {
-		return fmt.Errorf("clean chains: %w", err)
-	}
-
-	m.updateState()
-
-	return nil
-}
-
-// todo write less destructive cleanup mechanism
-func (m *aclManager) cleanChains() error {
-	ok, err := m.iptablesClient.ChainExists(tableName, chainNameInputRules)
-	if err != nil {
-		log.Debugf("failed to list chains: %s", err)
-		return err
-	}
-	if ok {
-		for _, rule := range m.entries["INPUT"] {
-			err := m.iptablesClient.DeleteIfExists(tableName, "INPUT", rule...)
-			if err != nil {
-				log.Errorf("failed to delete rule: %v, %s", rule, err)
-			}
-		}
-
-		for _, rule := range m.entries["FORWARD"] {
-			err := m.iptablesClient.DeleteIfExists(tableName, "FORWARD", rule...)
-			if err != nil {
-				log.Errorf("failed to delete rule: %v, %s", rule, err)
-			}
-		}
-
-		err = m.iptablesClient.ClearAndDeleteChain(tableName, chainNameInputRules)
-		if err != nil {
-			log.Debugf("failed to clear and delete %s chain: %s", chainNameInputRules, err)
-			return err
-		}
-	}
-
-	ok, err = m.iptablesClient.ChainExists("mangle", "PREROUTING")
-	if err != nil {
-		return fmt.Errorf("list chains: %w", err)
-	}
-	if ok {
-		for _, rule := range m.entries["PREROUTING"] {
-			err := m.iptablesClient.DeleteIfExists("mangle", "PREROUTING", rule...)
-			if err != nil {
-				log.Errorf("failed to delete rule: %v, %s", rule, err)
-			}
-		}
-	}
-
-	for _, rule := range m.entries[mangleFwdKey] {
-		if err := m.iptablesClient.DeleteIfExists(tableMangle, chainFORWARD, rule...); err != nil {
-			log.Errorf("failed to delete mangle FORWARD guard rule: %v, %s", rule, err)
-		}
-	}
-
-	for _, ipsetName := range m.ipsetStore.ipsetNames() {
-		if err := m.flushIPSet(ipsetName); err != nil {
-			if errors.Is(err, ipset.ErrSetNotExist) {
-				log.Debugf("flush ipset %q during reset: %v", ipsetName, err)
-			} else {
-				log.Errorf("flush ipset %q during reset: %v", ipsetName, err)
-			}
-		}
-		if err := m.destroyIPSet(ipsetName); err != nil {
-			if errors.Is(err, ipset.ErrBusy) || errors.Is(err, ipset.ErrSetNotExist) {
-				log.Debugf("destroy ipset %q during reset: %v", ipsetName, err)
-			} else {
-				log.Errorf("destroy ipset %q during reset: %v", ipsetName, err)
-			}
-		}
-		m.ipsetStore.deleteIpset(ipsetName)
-	}
-
-	return nil
-}
-
-func (m *aclManager) createDefaultChains() error {
-	// chain netbird-acl-input-rules
-	if err := m.iptablesClient.NewChain(tableName, chainNameInputRules); err != nil {
-		log.Debugf("failed to create '%s' chain: %s", chainNameInputRules, err)
-		return err
-	}
-
-	for chainName, rules := range m.entries {
-		// mangle FORWARD guard rules are handled separately below
-		if chainName == mangleFwdKey {
-			continue
-		}
-		for _, rule := range rules {
-			if err := m.iptablesClient.InsertUnique(tableName, chainName, 1, rule...); err != nil {
-				log.Debugf("failed to create input chain jump rule: %s", err)
-				return err
-			}
-		}
-	}
-
-	for chainName, entries := range m.optionalEntries {
-		for _, entry := range entries {
-			if err := m.iptablesClient.InsertUnique(tableName, chainName, entry.position, entry.spec...); err != nil {
-				log.Errorf("failed to insert optional entry %v: %v", entry.spec, err)
-				continue
-			}
-			m.entries[chainName] = append(m.entries[chainName], entry.spec)
-		}
-	}
-	clear(m.optionalEntries)
-
-	// Insert mangle FORWARD guard rules to prevent external DNAT bypass.
-	for _, rule := range m.entries[mangleFwdKey] {
-		if err := m.iptablesClient.AppendUnique(tableMangle, chainFORWARD, rule...); err != nil {
-			log.Errorf("failed to add mangle FORWARD guard rule: %v", err)
-		}
-	}
-
-	return nil
-}
-
-// seedInitialEntries adds default rules to the entries map, rules are inserted on pos 1, hence the order is reversed.
-// We want to make sure our traffic is not dropped by existing rules.
-
-// The existing FORWARD rules/policies decide outbound traffic towards our interface.
-// In case the FORWARD policy is set to "drop", we add an established/related rule to allow return traffic for the inbound rule.
-func (m *aclManager) seedInitialEntries() {
-	established := getConntrackEstablished()
-
-	m.appendToEntries("INPUT", []string{"-i", m.wgIface.Name(), "-j", "DROP"})
-	m.appendToEntries("INPUT", []string{"-i", m.wgIface.Name(), "-j", chainNameInputRules})
-	m.appendToEntries("INPUT", append([]string{"-i", m.wgIface.Name()}, established...))
-
-	// Inbound is handled by our ACLs, the rest is dropped.
-	// For outbound we respect the FORWARD policy. However, we need to allow established/related traffic for inbound rules.
-	m.appendToEntries("FORWARD", []string{"-i", m.wgIface.Name(), "-j", "DROP"})
-
-	m.appendToEntries("FORWARD", []string{"-o", m.wgIface.Name(), "-j", chainRTFWDOUT})
-	m.appendToEntries("FORWARD", []string{"-i", m.wgIface.Name(), "-j", chainRTFWDIN})
-
-	// Mangle FORWARD guard: when external DNAT redirects traffic from the wg interface, it
-	// traverses FORWARD instead of INPUT, bypassing ACL rules. ACCEPT rules in filter FORWARD
-	// can be inserted above ours. Mangle runs before filter, so these guard rules enforce the
-	// ACL mark check where it cannot be overridden.
-	m.appendToEntries(mangleFwdKey, []string{
-		"-i", m.wgIface.Name(),
-		"-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED",
-		"-j", "ACCEPT",
-	})
-	m.appendToEntries(mangleFwdKey, []string{
-		"-i", m.wgIface.Name(),
-		"-m", "conntrack", "--ctstate", "DNAT",
-		"-m", "mark", "!", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected),
-		"-j", "DROP",
-	})
-}
-
-func (m *aclManager) seedInitialOptionalEntries() {
-	m.optionalEntries["FORWARD"] = []entry{
-		{
-			spec:     []string{"-m", "mark", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected), "-j", "ACCEPT"},
-			position: 2,
-		},
-	}
-}
-
-func (m *aclManager) appendToEntries(chainName string, spec []string) {
-	m.entries[chainName] = append(m.entries[chainName], spec)
-}
-
-func (m *aclManager) updateState() {
-	if m.stateManager == nil {
-		return
-	}
-
-	var currentState *ShutdownState
-	if existing := m.stateManager.GetState(currentState); existing != nil {
-		if existingState, ok := existing.(*ShutdownState); ok {
-			currentState = existingState
-		}
-	}
-	if currentState == nil {
-		currentState = &ShutdownState{}
-	}
-
-	currentState.Lock()
-	defer currentState.Unlock()
-
-	// Clone the maps so the persisted state holds a private snapshot. The
-	// live maps keep being mutated by subsequent rule operations while the
-	// state manager marshals the state from its periodic-save goroutine.
-	// Sharing them by reference races the two and aborts the process with a
-	// concurrent map iteration and write.
-	if m.v6 {
-		currentState.ACLEntries6 = maps.Clone(m.entries)
-		currentState.ACLIPsetStore6 = m.ipsetStore.clone()
-	} else {
-		currentState.ACLEntries = maps.Clone(m.entries)
-		currentState.ACLIPsetStore = m.ipsetStore.clone()
-	}
-
-	if err := m.stateManager.UpdateState(currentState); err != nil {
-		log.Errorf("failed to update state: %v", err)
-	}
-}
-
-// filterRuleSpecs returns the specs of a filtering rule
-// protoForFamily translates ICMP to ICMPv6 for ip6tables.
-// ip6tables requires "ipv6-icmp" (or "icmpv6") instead of "icmp".
-func protoForFamily(protocol firewall.Protocol, v6 bool) string {
-	if v6 && protocol == firewall.ProtocolICMP {
-		return "ipv6-icmp"
-	}
-	return string(protocol)
-}
-
-func filterRuleSpecs(ip net.IP, protocol string, sPort, dPort *firewall.Port, action firewall.Action, ipsetName string) (specs []string) {
-	// don't use IP matching if IP is 0.0.0.0
-	matchByIP := !ip.IsUnspecified()
-
-	if matchByIP {
-		if ipsetName != "" {
-			specs = append(specs, "-m", "set", "--match-set", ipsetName, "src")
-		} else {
-			specs = append(specs, "-s", ip.String())
-		}
-	}
-	if protocol != "all" {
-		specs = append(specs, "-p", protocol)
-	}
-	specs = append(specs, applyPort("--sport", sPort)...)
-	specs = append(specs, applyPort("--dport", dPort)...)
-	return specs
-}
-
-func actionToStr(action firewall.Action) string {
-	if action == firewall.ActionAccept {
-		return "ACCEPT"
-	}
-	return "DROP"
-}
-
-func transformIPsetName(ipsetName string, sPort, dPort *firewall.Port, action firewall.Action) string {
-	if ipsetName == "" {
-		return ""
-	}
-
-	actionSuffix := ""
-	if action == firewall.ActionDrop {
-		actionSuffix = "-drop"
-	}
-
-	switch {
-	case sPort != nil && dPort != nil:
-		return ipsetName + "-sport-dport" + actionSuffix
-	case sPort != nil:
-		return ipsetName + "-sport" + actionSuffix
-	case dPort != nil:
-		return ipsetName + "-dport" + actionSuffix
-	default:
-		return ipsetName + actionSuffix
-	}
-}
-
-func (m *aclManager) createIPSet(name string) error {
-	opts := ipset.CreateOptions{
-		Replace: true,
-	}
-	if m.v6 {
-		opts.Family = ipset.FamilyIPV6
-	}
-
-	if err := ipset.Create(name, ipset.TypeHashNet, opts); err != nil {
-		return fmt.Errorf("create ipset %s: %w", name, err)
-	}
-
-	log.Debugf("created ipset %s with type hash:net", name)
-	return nil
-}
-
-func (m *aclManager) addToIPSet(name string, ip net.IP) error {
-	cidr := uint8(32)
-	if ip.To4() == nil {
-		cidr = 128
-	}
-
-	entry := &ipset.Entry{
-		IP:      ip,
-		CIDR:    cidr,
-		Replace: true,
-	}
-
-	if err := ipset.Add(name, entry); err != nil {
-		return fmt.Errorf("add IP to ipset %s: %w", name, err)
-	}
-
-	return nil
-}
-
-func (m *aclManager) delFromIPSet(name string, ip net.IP) error {
-	cidr := uint8(32)
-	if ip.To4() == nil {
-		cidr = 128
-	}
-
-	entry := &ipset.Entry{
-		IP:   ip,
-		CIDR: cidr,
-	}
-
-	if err := ipset.Del(name, entry); err != nil {
-		return fmt.Errorf("delete IP from ipset %s: %w", name, err)
-	}
-
-	return nil
-}
-
-func (m *aclManager) flushIPSet(name string) error {
-	return ipset.Flush(name)
-}
-
-func (m *aclManager) destroyIPSet(name string) error {
-	return ipset.Destroy(name)
-}
diff --git a/client/firewall/iptables/chains_linux.go b/client/firewall/iptables/chains_linux.go
new file mode 100644
index 000000000..58bfa8c6a
--- /dev/null
+++ b/client/firewall/iptables/chains_linux.go
@@ -0,0 +1,346 @@
+//go:build !android
+
+package iptables
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	nbnet "github.com/netbirdio/netbird/client/net"
+)
+
+func (r *family) createContainers() error {
+	for _, chainInfo := range []struct {
+		chain string
+		table string
+	}{
+		{chainRTFwdIn, tableFilter},
+		{chainRTFwdOut, tableFilter},
+		{chainRTPre, tableMangle},
+		{chainRTNAT, tableNat},
+		{chainRTRdr, tableNat},
+		{chainRTMSSClamp, tableMangle},
+	} {
+		// Fallback: clear chains that survived an unclean shutdown.
+		if ok, _ := r.iptablesClient.ChainExists(chainInfo.table, chainInfo.chain); ok {
+			if err := r.iptablesClient.ClearAndDeleteChain(chainInfo.table, chainInfo.chain); err != nil {
+				log.Warnf("clear stale chain %s in %s: %v", chainInfo.chain, chainInfo.table, err)
+			}
+		}
+		if err := r.iptablesClient.NewChain(chainInfo.table, chainInfo.chain); err != nil {
+			return fmt.Errorf("create chain %s in table %s: %w", chainInfo.chain, chainInfo.table, err)
+		}
+	}
+
+	if err := r.insertEstablishedRule(chainRTFwdIn); err != nil {
+		return fmt.Errorf("insert established rule: %w", err)
+	}
+
+	if err := r.insertEstablishedRule(chainRTFwdOut); err != nil {
+		return fmt.Errorf("insert established rule: %w", err)
+	}
+
+	if err := r.addPostroutingRules(); err != nil {
+		return fmt.Errorf("add static nat rules: %w", err)
+	}
+
+	if err := r.addJumpRules(); err != nil {
+		return fmt.Errorf("add jump rules: %w", err)
+	}
+
+	if err := r.addMSSClampingRules(); err != nil {
+		log.Errorf("failed to add MSS clamping rules: %s", err)
+	}
+
+	return nil
+}
+
+func (r *family) addJumpRules() error {
+	// Jump to nat chain
+	natRule := jumpRuleSpec(chainRTNAT)
+	if err := r.iptablesClient.Insert(tableNat, chainPostrouting, 1, natRule...); err != nil {
+		return fmt.Errorf("add nat postrouting jump rule: %w", err)
+	}
+	r.rules[jumpNATPost] = natRule
+
+	// Jump to mangle prerouting chain
+	preRule := jumpRuleSpec(chainRTPre)
+	if err := r.iptablesClient.Insert(tableMangle, chainPrerouting, 1, preRule...); err != nil {
+		return fmt.Errorf("add mangle prerouting jump rule: %w", err)
+	}
+	r.rules[jumpManglePre] = preRule
+
+	// Jump to nat prerouting chain
+	rdrRule := jumpRuleSpec(chainRTRdr)
+	if err := r.iptablesClient.Insert(tableNat, chainPrerouting, 1, rdrRule...); err != nil {
+		return fmt.Errorf("add nat prerouting jump rule: %w", err)
+	}
+	r.rules[jumpNATPre] = rdrRule
+
+	return nil
+}
+
+func (r *family) setupDataPlaneMark() error {
+	var merr *multierror.Error
+	preRule := []string{
+		"-i", r.wgIface.Name(),
+		"-m", "conntrack", "--ctstate", "NEW",
+		"-j", "CONNMARK", "--set-mark", fmt.Sprintf("%#x", nbnet.DataPlaneMarkIn),
+	}
+
+	if err := r.iptablesClient.AppendUnique(tableMangle, chainPrerouting, preRule...); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("add mangle prerouting rule: %w", err))
+	} else {
+		r.rules[markManglePre] = preRule
+	}
+
+	postRule := []string{
+		"-o", r.wgIface.Name(),
+		"-m", "conntrack", "--ctstate", "NEW",
+		"-j", "CONNMARK", "--set-mark", fmt.Sprintf("%#x", nbnet.DataPlaneMarkOut),
+	}
+
+	if err := r.iptablesClient.AppendUnique(tableMangle, chainPostrouting, postRule...); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("add mangle postrouting rule: %w", err))
+	} else {
+		r.rules[markManglePost] = postRule
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// seedInitialEntries adds default rules to the entries map. Rules are
+// inserted at position 1, so the order here is reversed.
+//
+// Existing FORWARD policy decides outbound traffic towards our
+// interface. If FORWARD policy is "drop", we add an
+// established/related rule to allow return traffic for inbound rules.
+func (r *family) seedInitialEntries() {
+	established := getConntrackEstablished()
+
+	r.appendToEntries(chainInput, []string{"-i", r.wgIface.Name(), "-j", "DROP"})
+	r.appendToEntries(chainInput, []string{"-i", r.wgIface.Name(), "-j", chainACLInput})
+	r.appendToEntries(chainInput, append([]string{"-i", r.wgIface.Name()}, established...))
+
+	r.appendToEntries(chainForward, []string{"-i", r.wgIface.Name(), "-j", "DROP"})
+	r.appendToEntries(chainForward, []string{"-o", r.wgIface.Name(), "-j", chainRTFwdOut})
+	r.appendToEntries(chainForward, []string{"-i", r.wgIface.Name(), "-j", chainRTFwdIn})
+
+	// Mangle FORWARD guard: when external DNAT redirects traffic from
+	// the wg interface, it traverses FORWARD instead of INPUT,
+	// bypassing ACL rules. ACCEPT rules in filter FORWARD can be
+	// inserted above ours. Mangle runs before filter, so these guard
+	// rules enforce the ACL mark check where it cannot be overridden.
+	r.appendToEntries(mangleForwardKey, []string{
+		"-i", r.wgIface.Name(),
+		"-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED",
+		"-j", "ACCEPT",
+	})
+	r.appendToEntries(mangleForwardKey, []string{
+		"-i", r.wgIface.Name(),
+		"-m", "conntrack", "--ctstate", "DNAT",
+		"-m", "mark", "!", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected),
+		"-j", "DROP",
+	})
+}
+
+func (r *family) seedInitialOptionalEntries() {
+	r.optionalEntries[chainForward] = []entry{
+		{
+			spec:     []string{"-m", "mark", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected), "-j", "ACCEPT"},
+			position: 2,
+		},
+	}
+}
+
+func (r *family) appendToEntries(chain chainKey, spec ruleSpec) {
+	r.entries[chain] = append(r.entries[chain], spec)
+}
+
+func (r *family) createDefaultChains() error {
+	if err := r.iptablesClient.NewChain(tableFilter, chainACLInput); err != nil {
+		return fmt.Errorf("create %s chain: %w", chainACLInput, err)
+	}
+
+	for chain, rules := range r.entries {
+		// mangle FORWARD guard rules are handled separately below
+		if chain == mangleForwardKey {
+			continue
+		}
+		for _, rule := range rules {
+			if err := r.iptablesClient.InsertUnique(tableFilter, string(chain), 1, rule...); err != nil {
+				return fmt.Errorf("insert jump rule into %s: %w", chain, err)
+			}
+		}
+	}
+
+	for chain, entries := range r.optionalEntries {
+		for _, entry := range entries {
+			if err := r.iptablesClient.InsertUnique(tableFilter, string(chain), entry.position, entry.spec...); err != nil {
+				log.Errorf("failed to insert optional entry %v: %v", entry.spec, err)
+				continue
+			}
+			r.entries[chain] = append(r.entries[chain], entry.spec)
+		}
+	}
+	clear(r.optionalEntries)
+
+	// Insert mangle FORWARD guard rules to prevent external DNAT bypass.
+	for _, rule := range r.entries[mangleForwardKey] {
+		if err := r.iptablesClient.AppendUnique(tableMangle, chainForward, rule...); err != nil {
+			log.Errorf("failed to add mangle FORWARD guard rule: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func (r *family) cleanUpDefaultForwardRules() error {
+	var merr *multierror.Error
+
+	// cleanJumpRules removes the OUTPUT jump to NETBIRD-NAT-OUTPUT among
+	// the others, so the chain below deletes cleanly instead of failing
+	// with "device or resource busy".
+	if err := r.cleanJumpRules(); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("clean jump rules: %w", err))
+	}
+
+	for _, chainInfo := range []struct {
+		chain string
+		table string
+	}{
+		{chainRTFwdIn, tableFilter},
+		{chainRTFwdOut, tableFilter},
+		{chainRTPre, tableMangle},
+		{chainRTNAT, tableNat},
+		{chainRTRdr, tableNat},
+		{chainNATOutput, tableNat},
+		{chainRTMSSClamp, tableMangle},
+	} {
+		ok, err := r.iptablesClient.ChainExists(chainInfo.table, chainInfo.chain)
+		if err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("check chain %s in table %s: %w", chainInfo.chain, chainInfo.table, err))
+			continue
+		}
+		if ok {
+			if err := r.iptablesClient.ClearAndDeleteChain(chainInfo.table, chainInfo.chain); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("clear and delete chain %s in table %s: %w", chainInfo.chain, chainInfo.table, err))
+			}
+		}
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) cleanJumpRules() error {
+	// locations maps each jump rule to the built-in table and chain it
+	// was inserted into, plus the netbird chain it targets.
+	locations := map[firewall.RuleID]struct{ table, chain, target string }{
+		jumpNATPost:   {tableNat, chainPostrouting, chainRTNAT},
+		jumpManglePre: {tableMangle, chainPrerouting, chainRTPre},
+		jumpNATPre:    {tableNat, chainPrerouting, chainRTRdr},
+		jumpMSSClamp:  {tableMangle, chainForward, chainRTMSSClamp},
+		jumpNATOutput: {tableNat, chainOutput, chainNATOutput},
+	}
+
+	var merr *multierror.Error
+	for ruleID, loc := range locations {
+		rule, exists := r.rules[ruleID]
+		if !exists {
+			// Untracked (e.g. fresh start after an unclean shutdown with no
+			// restored state): if the target chain survived, remove the stale
+			// jump to it so the chain can be deleted.
+			ok, err := r.iptablesClient.ChainExists(loc.table, loc.target)
+			if err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("check chain %s in table %s: %w", loc.target, loc.table, err))
+				continue
+			}
+			if !ok {
+				continue
+			}
+			rule = jumpRuleSpec(loc.target)
+		}
+		if err := r.iptablesClient.DeleteIfExists(loc.table, loc.chain, rule...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("delete rule from chain %s in table %s: %w", loc.chain, loc.table, err))
+			continue
+		}
+		delete(r.rules, ruleID)
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// jumpRuleSpec builds the iptables rule spec that jumps to target. Create
+// and cleanup sites share it so the installed and deleted specs cannot drift.
+func jumpRuleSpec(target string) []string {
+	return []string{"-j", target}
+}
+
+func (r *family) cleanAclChains() error {
+	var merr *multierror.Error
+
+	if err := r.cleanInputAclChain(); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	for _, rule := range r.entries[mangleForwardKey] {
+		if err := r.iptablesClient.DeleteIfExists(tableMangle, chainForward, rule...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("delete mangle %s guard rule %v: %w", chainForward, rule, err))
+		}
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) cleanInputAclChain() error {
+	ok, err := r.iptablesClient.ChainExists(tableFilter, chainACLInput)
+	if err != nil {
+		return fmt.Errorf("check chain %s: %w", chainACLInput, err)
+	}
+	if !ok {
+		return nil
+	}
+
+	var merr *multierror.Error
+	for _, rule := range r.entries[chainInput] {
+		if err := r.iptablesClient.DeleteIfExists(tableFilter, chainInput, rule...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("delete %s rule %v: %w", chainInput, rule, err))
+		}
+	}
+
+	for _, rule := range r.entries[chainForward] {
+		if err := r.iptablesClient.DeleteIfExists(tableFilter, chainForward, rule...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("delete %s rule %v: %w", chainForward, rule, err))
+		}
+	}
+
+	if err := r.iptablesClient.ClearAndDeleteChain(tableFilter, chainACLInput); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("clear and delete %s chain: %w", chainACLInput, err))
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) cleanupDataPlaneMark() error {
+	var merr *multierror.Error
+	if preRule, exists := r.rules[markManglePre]; exists {
+		if err := r.iptablesClient.DeleteIfExists(tableMangle, chainPrerouting, preRule...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove mangle prerouting rule: %w", err))
+		} else {
+			delete(r.rules, markManglePre)
+		}
+	}
+
+	if postRule, exists := r.rules[markManglePost]; exists {
+		if err := r.iptablesClient.DeleteIfExists(tableMangle, chainPostrouting, postRule...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove mangle postrouting rule: %w", err))
+		} else {
+			delete(r.rules, markManglePost)
+		}
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
diff --git a/client/firewall/iptables/dnat_linux.go b/client/firewall/iptables/dnat_linux.go
new file mode 100644
index 000000000..f118c9dfe
--- /dev/null
+++ b/client/firewall/iptables/dnat_linux.go
@@ -0,0 +1,136 @@
+//go:build !android
+
+package iptables
+
+import (
+	"fmt"
+	"net/netip"
+	"strconv"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+)
+
+func (r *family) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
+	ruleID := firewall.RuleID(fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
+
+	if _, exists := r.rules[ruleID]; exists {
+		return nil
+	}
+
+	dnatRule := []string{
+		"-i", r.wgIface.Name(),
+		"-p", strings.ToLower(protoForFamily(protocol, r.v6)),
+		"--dport", strconv.Itoa(int(originalPort)),
+		"-d", localAddr.String(),
+		"-m", "addrtype", "--dst-type", "LOCAL",
+		"-j", "DNAT",
+		"--to-destination", ":" + strconv.Itoa(int(translatedPort)),
+	}
+
+	info := ruleInfo{
+		table: tableNat,
+		chain: chainRTRdr,
+		rule:  dnatRule,
+	}
+
+	if err := r.iptablesClient.Append(info.table, info.chain, info.rule...); err != nil {
+		return fmt.Errorf("add inbound DNAT rule: %w", err)
+	}
+	r.rules[ruleID] = info.rule
+
+	r.updateState()
+	return nil
+}
+
+// RemoveInboundDNAT removes an inbound DNAT rule.
+func (r *family) RemoveInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
+	ruleID := firewall.RuleID(fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
+
+	if dnatRule, exists := r.rules[ruleID]; exists {
+		if err := r.iptablesClient.Delete(tableNat, chainRTRdr, dnatRule...); err != nil {
+			return fmt.Errorf("delete inbound DNAT rule: %w", err)
+		}
+		delete(r.rules, ruleID)
+	}
+
+	r.updateState()
+	return nil
+}
+
+// ensureNATOutputChain lazily creates the OUTPUT NAT chain and jump rule on first use.
+func (r *family) ensureNATOutputChain() error {
+	if _, exists := r.rules[jumpNATOutput]; exists {
+		return nil
+	}
+
+	chainExists, err := r.iptablesClient.ChainExists(tableNat, chainNATOutput)
+	if err != nil {
+		return fmt.Errorf("check chain %s: %w", chainNATOutput, err)
+	}
+	if !chainExists {
+		if err := r.iptablesClient.NewChain(tableNat, chainNATOutput); err != nil {
+			return fmt.Errorf("create chain %s: %w", chainNATOutput, err)
+		}
+	}
+
+	jumpRule := jumpRuleSpec(chainNATOutput)
+	if err := r.iptablesClient.Insert(tableNat, chainOutput, 1, jumpRule...); err != nil {
+		if !chainExists {
+			if delErr := r.iptablesClient.ClearAndDeleteChain(tableNat, chainNATOutput); delErr != nil {
+				log.Warnf("failed to rollback chain %s: %v", chainNATOutput, delErr)
+			}
+		}
+		return fmt.Errorf("add OUTPUT jump rule: %w", err)
+	}
+	r.rules[jumpNATOutput] = jumpRule
+
+	r.updateState()
+	return nil
+}
+
+// AddOutputDNAT adds an OUTPUT chain DNAT rule for locally-generated traffic.
+func (r *family) AddOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
+	ruleID := firewall.RuleID(fmt.Sprintf("output-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
+
+	if _, exists := r.rules[ruleID]; exists {
+		return nil
+	}
+
+	if err := r.ensureNATOutputChain(); err != nil {
+		return err
+	}
+
+	dnatRule := []string{
+		"-p", strings.ToLower(protoForFamily(protocol, localAddr.Is6())),
+		"--dport", strconv.Itoa(int(originalPort)),
+		"-d", localAddr.String(),
+		"-j", "DNAT",
+		"--to-destination", ":" + strconv.Itoa(int(translatedPort)),
+	}
+
+	if err := r.iptablesClient.Append(tableNat, chainNATOutput, dnatRule...); err != nil {
+		return fmt.Errorf("add output DNAT rule: %w", err)
+	}
+	r.rules[ruleID] = dnatRule
+
+	r.updateState()
+	return nil
+}
+
+// RemoveOutputDNAT removes an OUTPUT chain DNAT rule.
+func (r *family) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
+	ruleID := firewall.RuleID(fmt.Sprintf("output-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
+
+	if dnatRule, exists := r.rules[ruleID]; exists {
+		if err := r.iptablesClient.Delete(tableNat, chainNATOutput, dnatRule...); err != nil {
+			return fmt.Errorf("delete output DNAT rule: %w", err)
+		}
+		delete(r.rules, ruleID)
+	}
+
+	r.updateState()
+	return nil
+}
diff --git a/client/firewall/iptables/family_linux.go b/client/firewall/iptables/family_linux.go
new file mode 100644
index 000000000..2ac860a0a
--- /dev/null
+++ b/client/firewall/iptables/family_linux.go
@@ -0,0 +1,256 @@
+//go:build !android
+
+package iptables
+
+import (
+	"fmt"
+	"maps"
+	"net/netip"
+
+	"github.com/coreos/go-iptables/iptables"
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	nbid "github.com/netbirdio/netbird/client/internal/acl/id"
+	"github.com/netbirdio/netbird/client/internal/routemanager/ipfwdstate"
+	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
+	"github.com/netbirdio/netbird/client/internal/statemanager"
+)
+
+// constants needed to manage and create iptable rules
+const (
+	tableFilter = "filter"
+	tableNat    = "nat"
+	tableMangle = "mangle"
+	tableRaw    = "raw"
+
+	// chainACLInput is the peer ACL chain that holds installed
+	// peer-filtering rules.
+	chainACLInput = "NETBIRD-ACL-INPUT"
+
+	// mangleForwardKey is the entries map key for mangle FORWARD guard
+	// rules that prevent external DNAT from bypassing ACL rules.
+	mangleForwardKey chainKey = "MANGLE-FORWARD"
+
+	chainInput       = "INPUT"
+	chainOutput      = "OUTPUT"
+	chainPostrouting = "POSTROUTING"
+	chainPrerouting  = "PREROUTING"
+	chainForward     = "FORWARD"
+	chainRTNAT       = "NETBIRD-RT-NAT"
+	chainRTFwdIn     = "NETBIRD-RT-FWD-IN"
+	chainRTFwdOut    = "NETBIRD-RT-FWD-OUT"
+	chainRTPre       = "NETBIRD-RT-PRE"
+	chainRTRdr       = "NETBIRD-RT-RDR"
+	chainNATOutput   = "NETBIRD-NAT-OUTPUT"
+	chainRTMSSClamp  = "NETBIRD-RT-MSSCLAMP"
+
+	jumpManglePre  = "jump-mangle-pre"
+	jumpNATPre     = "jump-nat-pre"
+	jumpNATPost    = "jump-nat-post"
+	jumpNATOutput  = "jump-nat-output"
+	jumpMSSClamp   = "jump-mss-clamp"
+	markManglePre  = "mark-mangle-pre"
+	markManglePost = "mark-mangle-post"
+	matchSet       = "--match-set"
+
+	// ipv4TCPHeaderSize is the minimum IPv4 (20) + TCP (20) header size for MSS calculation.
+	ipv4TCPHeaderSize = 40
+	// ipv6TCPHeaderSize is the minimum IPv6 (40) + TCP (20) header size for MSS calculation.
+	ipv6TCPHeaderSize = 60
+)
+
+type ruleInfo struct {
+	chain string
+	table string
+	rule  []string
+}
+
+type routeRules map[firewall.RuleID][]string
+
+// ruleSpec is a single iptables rule expressed as its argument list
+// (e.g. {"-i", "wg0", "-j", "DROP"}).
+type ruleSpec []string
+
+// chainKey identifies the chain a seeded entry belongs to. It holds
+// built-in chain names ("INPUT", "FORWARD", "PREROUTING") plus the
+// synthetic mangleForwardKey bucket for the mangle FORWARD guard rules.
+type chainKey string
+
+// aclEntries maps a chain to the rules seeded into it to jump into or
+// guard the netbird ACL chains.
+type aclEntries map[chainKey][]ruleSpec
+
+type entry struct {
+	spec     ruleSpec
+	position int
+}
+
+// ipsetCounter is the shared hash:net refcounter used by peer and
+// route ACLs alike. The ipset library does not support comments, so
+// the key is just the set name (string).
+type ipsetCounter = refcounter.Counter[string, []netip.Prefix, struct{}]
+
+// family holds the per-address-family iptables state. One instance
+// handles route ACLs, peer ACLs, NAT, DNAT, and MSS clamping for a
+// single family; the top-level Manager owns one for v4 and another
+// for v6.
+type family struct {
+	iptablesClient *iptables.IPTables
+	wgIface        iFaceMapper
+	v6             bool
+
+	// Peer ACL chain bookkeeping.
+	entries         aclEntries
+	optionalEntries map[chainKey][]entry
+
+	// filters holds peer + route filter rules keyed by content hash.
+	// AddFilterRule writes here; DeleteFilterRule looks up by id.
+	filters      map[nbid.RuleID]*Rule
+	ipsetCounter *ipsetCounter
+	// ipsetSupported records whether the kernel can create the hash:net
+	// sets the source matches rely on; probed once at init. When false,
+	// multi-source rules expand to one rule per source prefix.
+	ipsetSupported bool
+
+	// rules holds NAT, jump, and MSS-clamping rules (auxiliary
+	// plumbing that isn't a filter rule).
+	rules routeRules
+
+	// Routing / NAT.
+	legacyManagement bool
+	mtu              uint16
+	ipFwdState       *ipfwdstate.IPForwardingState
+
+	stateManager *statemanager.Manager
+}
+
+func newFamily(iptablesClient *iptables.IPTables, wgIface iFaceMapper, mtu uint16) (*family, error) {
+	r := &family{
+		iptablesClient:  iptablesClient,
+		wgIface:         wgIface,
+		v6:              iptablesClient.Proto() == iptables.ProtocolIPv6,
+		entries:         make(aclEntries),
+		optionalEntries: make(map[chainKey][]entry),
+		filters:         make(map[nbid.RuleID]*Rule),
+		rules:           make(routeRules),
+		mtu:             mtu,
+		ipFwdState:      ipfwdstate.NewIPForwardingState(wgIface.Name()),
+	}
+
+	r.ipsetCounter = refcounter.New(
+		func(name string, sources []netip.Prefix) (struct{}, error) {
+			return struct{}{}, r.createIpSet(name, sources)
+		},
+		func(name string, _ struct{}) error {
+			return r.deleteIpSet(name)
+		},
+	)
+
+	return r, nil
+}
+
+// init wires the family to the state manager and installs both the
+// route ACL containers and the peer ACL chain skeleton.
+func (r *family) init(stateManager *statemanager.Manager) error {
+	r.stateManager = stateManager
+
+	r.ipsetSupported = r.probeIPSetSupport()
+
+	if err := r.cleanUpDefaultForwardRules(); err != nil {
+		log.Errorf("failed to clean up rules from FORWARD chain: %s", err)
+	}
+
+	if err := r.createContainers(); err != nil {
+		return fmt.Errorf("create containers: %w", err)
+	}
+
+	if err := r.setupDataPlaneMark(); err != nil {
+		log.Errorf("failed to set up data plane mark: %v", err)
+	}
+
+	r.seedInitialEntries()
+	r.seedInitialOptionalEntries()
+
+	if err := r.cleanAclChains(); err != nil {
+		return fmt.Errorf("clean acl chains: %w", err)
+	}
+	if err := r.createDefaultChains(); err != nil {
+		return fmt.Errorf("create default chains: %w", err)
+	}
+
+	r.updateState()
+
+	return nil
+}
+
+// Reset tears down all firewall state owned by this family. ACL
+// chain cleanup runs before route-chain cleanup because the route
+// chains are still referenced by FORWARD jumps installed during
+// seedInitialEntries; deleting them first would trip EBUSY.
+func (r *family) Reset() error {
+	var merr *multierror.Error
+
+	if err := r.cleanAclChains(); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	if err := r.cleanUpDefaultForwardRules(); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	if err := r.ipsetCounter.Flush(); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	if err := r.cleanupDataPlaneMark(); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	clear(r.rules)
+	clear(r.filters)
+	r.updateState()
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) updateState() {
+	if r.stateManager == nil {
+		return
+	}
+
+	var currentState *ShutdownState
+	if existing := r.stateManager.GetState(currentState); existing != nil {
+		if existingState, ok := existing.(*ShutdownState); ok {
+			currentState = existingState
+		}
+	}
+	if currentState == nil {
+		currentState = &ShutdownState{}
+	}
+
+	currentState.Lock()
+	defer currentState.Unlock()
+
+	// Clone the rule maps so the persisted state holds a private snapshot.
+	// The live maps keep being mutated by subsequent rule operations while
+	// the state manager marshals the state from its periodic-save goroutine.
+	// Sharing the maps by reference races the two and aborts the process with
+	// a concurrent map iteration and write. The ipset counter guards itself
+	// during marshaling, so it can be shared directly.
+	if r.v6 {
+		currentState.RouteRules6 = maps.Clone(r.rules)
+		currentState.RouteIPsetCounter6 = r.ipsetCounter
+		currentState.ACLEntries6 = maps.Clone(r.entries)
+	} else {
+		currentState.RouteRules = maps.Clone(r.rules)
+		currentState.RouteIPsetCounter = r.ipsetCounter
+		currentState.ACLEntries = maps.Clone(r.entries)
+	}
+
+	if err := r.stateManager.UpdateState(currentState); err != nil {
+		log.Errorf("failed to update state: %v", err)
+	}
+}
diff --git a/client/firewall/iptables/filter_linux.go b/client/firewall/iptables/filter_linux.go
new file mode 100644
index 000000000..30cd81018
--- /dev/null
+++ b/client/firewall/iptables/filter_linux.go
@@ -0,0 +1,421 @@
+//go:build !android
+
+package iptables
+
+import (
+	"fmt"
+	"net/netip"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	nbid "github.com/netbirdio/netbird/client/internal/acl/id"
+	nbnet "github.com/netbirdio/netbird/client/net"
+)
+
+// AddFilterRule installs a packet-filtering rule. With destination
+// empty, the rule goes to the peer ACL input chain plus a paired
+// mangle PREROUTING rule for the redirect mark. With destination set
+// (prefix or named set), it goes to the route ACL forward chain.
+// Multi-source rules collapse to one iptables rule via the shared
+// hash:net ipset.
+func (r *family) AddFilterRule(
+	id []byte,
+	sources []netip.Prefix,
+	destination firewall.Network,
+	proto firewall.Protocol,
+	sPort *firewall.Port,
+	dPort *firewall.Port,
+	action firewall.Action,
+) (firewall.Rule, error) {
+	ruleID := nbid.GenerateRuleID(sources, destination, proto, sPort, dPort, action)
+	if existing, ok := r.filters[ruleID]; ok {
+		return existing, nil
+	}
+
+	rule, err := r.installFilterRules(ruleID, sources, destination, proto, sPort, dPort, action, r.ipsetSupported)
+	if err != nil {
+		return nil, err
+	}
+
+	r.filters[ruleID] = rule
+	r.updateState()
+	return rule, nil
+}
+
+// installFilterRules resolves the source matches and installs one
+// iptables rule per match. It is more than one rule only when useIPSet
+// is false and a multi-source rule has to be expanded per prefix.
+func (r *family) installFilterRules(
+	ruleID nbid.RuleID,
+	sources []netip.Prefix,
+	destination firewall.Network,
+	proto firewall.Protocol,
+	sPort *firewall.Port,
+	dPort *firewall.Port,
+	action firewall.Action,
+	useIPSet bool,
+) (*Rule, error) {
+	srcMatches, err := r.applySourceMatches(sources, useIPSet)
+	if err != nil {
+		return nil, fmt.Errorf("apply source match: %w", err)
+	}
+
+	rule, err := r.installFilterRule(ruleID, srcMatches, destination, proto, sPort, dPort, action)
+	if err != nil {
+		for _, srcMatch := range srcMatches {
+			r.dropSourceMatch(srcMatch)
+		}
+		return nil, err
+	}
+	return rule, nil
+}
+
+func (r *family) hasRule(id nbid.RuleID) bool {
+	_, ok := r.filters[id]
+	return ok
+}
+
+// DeleteFilterRule removes a previously installed filter rule. The
+// rule's stored chain/table identify where to delete from; source set
+// references are recovered from the spec via findSets and dropped
+// from the shared ipset counter.
+func (r *family) DeleteFilterRule(rule firewall.Rule) error {
+	ruleID := rule.ID()
+	pr, ok := r.filters[ruleID]
+	if !ok {
+		log.Debugf("filter rule %s not found", ruleID)
+		return nil
+	}
+
+	// DeleteIfExists keeps the deletes idempotent so a retry after a
+	// partial failure does not error on the parts already removed.
+	var merr *multierror.Error
+	for _, fs := range pr.allSpecs() {
+		if err := r.iptablesClient.DeleteIfExists(tableFilter, pr.chain, fs.specs...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("delete rule from %s: %w", pr.chain, err))
+		}
+		if fs.mangleSpecs != nil {
+			if err := r.iptablesClient.DeleteIfExists(tableMangle, chainRTPre, fs.mangleSpecs...); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("delete mangle rule: %w", err))
+			}
+		}
+	}
+	if merr != nil {
+		// Leave the rule tracked so the caller retries the remaining part.
+		return nberrors.FormatErrorOrNil(merr)
+	}
+
+	// The rule is gone from iptables, so untrack it regardless of how the
+	// refcount decrement goes, but surface decrement failures so callers
+	// see the ipset desync. Only the primary spec can reference sets: the
+	// per-prefix expansion never uses them.
+	delete(r.filters, ruleID)
+	r.updateState()
+	if err := r.decrementSetCounter(pr.specs); err != nil {
+		return fmt.Errorf("drop source set references: %w", err)
+	}
+	return nil
+}
+
+// findSets scans an iptables rule spec for "-m set --match-set <name>
+// <dir>" fragments and returns the named sets in occurrence order.
+// Used at delete time to drop ipsetCounter references.
+func findSets(rule []string) []string {
+	var sets []string
+	for i, arg := range rule {
+		if arg == "-m" && i+3 < len(rule) && rule[i+1] == "set" && rule[i+2] == matchSet {
+			sets = append(sets, rule[i+3])
+		}
+	}
+	return sets
+}
+
+// sourceNetwork classifies a source-prefix list into the firewall.Network
+// shape the rest of the spec-builder consumes: empty for match-any, a
+// single prefix inline, or an ipset for multiple sources.
+func sourceNetwork(sources []netip.Prefix) firewall.Network {
+	switch {
+	case len(sources) == 0:
+		return firewall.Network{}
+	case len(sources) == 1 && sources[0].Bits() == 0:
+		return firewall.Network{}
+	case len(sources) == 1:
+		return firewall.Network{Prefix: sources[0]}
+	default:
+		return firewall.Network{Set: firewall.NewPrefixSet(sources)}
+	}
+}
+
+// applySourceMatches returns one source match fragment per iptables
+// rule needed for the sources: normally a single fragment (a set match,
+// a direct -s match, or nil for match-any), and one -s fragment per
+// prefix when a multi-source rule cannot use ipset. Per-prefix rules
+// are the only form a kernel without the ipset modules can express.
+func (r *family) applySourceMatches(sources []netip.Prefix, useIPSet bool) ([][]string, error) {
+	network := sourceNetwork(sources)
+	if !network.IsSet() || useIPSet {
+		match, err := r.applySourceMatch(network, sources)
+		if err != nil {
+			return nil, err
+		}
+		return [][]string{match}, nil
+	}
+
+	matches := make([][]string, 0, len(sources))
+	for _, source := range sources {
+		matches = append(matches, []string{"-s", source.String()})
+	}
+	return matches, nil
+}
+
+// applySourceMatch returns the iptables match fragment for the rule's
+// source. For a Set it increments the shared ipset's refcount; for a
+// Prefix it emits a direct -s match; for the wildcard it returns nil.
+func (r *family) applySourceMatch(network firewall.Network, prefixes []netip.Prefix) ([]string, error) {
+	switch {
+	case network.IsSet():
+		if r.ipsetCounter == nil {
+			return nil, fmt.Errorf("multi-source peer rule requires shared ipset counter")
+		}
+		name := r.ipsetName(network.Set.HashedName())
+		if _, err := r.ipsetCounter.Increment(name, prefixes); err != nil {
+			return nil, fmt.Errorf("ipset increment %s: %w", name, err)
+		}
+		return []string{"-m", "set", matchSet, name, "src"}, nil
+	case network.IsPrefix():
+		return []string{"-s", network.Prefix.String()}, nil
+	default:
+		return nil, nil
+	}
+}
+
+// dropSourceMatch undoes whatever applySourceMatch reserved when
+// installing a rule fails. Safe to call when the spec is empty or holds
+// only inline matchers. Decrement errors are logged but not returned:
+// the install error is what the caller needs to see.
+func (r *family) dropSourceMatch(srcMatch []string) {
+	if r.ipsetCounter == nil {
+		return
+	}
+	for _, name := range findSets(srcMatch) {
+		if _, err := r.ipsetCounter.Decrement(name); err != nil {
+			log.Errorf("rollback ipset decrement %s: %v", name, err)
+		}
+	}
+}
+
+// decrementSetCounter drops ipset references owned by a raw rule spec
+// stored in r.rules (NAT / legacy route entries). It returns an error
+// aggregate so the caller surfaces decrement failures.
+func (r *family) decrementSetCounter(rule []string) error {
+	if r.ipsetCounter == nil {
+		return nil
+	}
+	var merr *multierror.Error
+	for _, name := range findSets(rule) {
+		if _, err := r.ipsetCounter.Decrement(name); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("decrement counter: %w", err))
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// installFilterRule assembles and writes the iptables filter-chain
+// rules for one filter rule, one per source match fragment. With
+// destination empty the rules land in the peer ACL input chain and each
+// gets a paired mangle PREROUTING rule for the redirect mark. With
+// destination set the rules land in the route ACL forward chain and
+// there is no mangle pairing.
+func (r *family) installFilterRule(
+	ruleID nbid.RuleID,
+	srcMatches [][]string,
+	destination firewall.Network,
+	protocol firewall.Protocol,
+	sPort, dPort *firewall.Port,
+	action firewall.Action,
+) (*Rule, error) {
+	isRoute := !destination.IsZero()
+
+	proto := protoForFamily(protocol, r.v6)
+
+	var destExp []string
+	if isRoute {
+		var err error
+		destExp, err = r.applyNetwork("-d", destination, nil)
+		if err != nil {
+			return nil, fmt.Errorf("apply network -d: %w", err)
+		}
+	}
+	matchSpecs := filterMatchSpecs(proto, sPort, dPort)
+
+	chain := chainACLInput
+	if isRoute {
+		chain = chainRTFwdIn
+	}
+
+	var installed []filterSpecs
+	for _, srcMatch := range srcMatches {
+		specs := slices.Clone(srcMatch)
+		specs = append(specs, destExp...)
+		specs = append(specs, matchSpecs...)
+
+		var mangleSpecs []string
+		if !isRoute {
+			mangleSpecs = slices.Clone(specs)
+			mangleSpecs = append(mangleSpecs,
+				"-i", r.wgIface.Name(),
+				"-m", "addrtype", "--dst-type", "LOCAL",
+				"-j", "MARK", "--set-xmark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected),
+			)
+		}
+
+		specs = append(specs, "-j", actionToStr(action))
+
+		if err := r.insertFilterRule(chain, action, specs); err != nil {
+			// Leave nothing half-installed: the caller sees an error, so a
+			// partial rule would silently keep matching without being tracked.
+			r.removeFilterSpecs(chain, installed)
+			r.dropSourceMatch(destExp)
+			return nil, fmt.Errorf("install filter rule on %s: %w", chain, err)
+		}
+
+		// The mangle redirect-mark rule is best effort: the filter rule itself
+		// is what enforces the ACL, so a mangle failure must not undo it. Drop
+		// the spec so teardown does not try to remove a rule that was not added.
+		if mangleSpecs != nil {
+			if err := r.iptablesClient.Append(tableMangle, chainRTPre, mangleSpecs...); err != nil {
+				log.Errorf("add mangle rule: %v", err)
+				mangleSpecs = nil
+			}
+		}
+
+		installed = append(installed, filterSpecs{specs: specs, mangleSpecs: mangleSpecs})
+	}
+
+	return &Rule{
+		id:          ruleID,
+		specs:       installed[0].specs,
+		mangleSpecs: installed[0].mangleSpecs,
+		extraRules:  installed[1:],
+		chain:       chain,
+		v6:          r.v6,
+	}, nil
+}
+
+// insertFilterRule writes one assembled rule spec into the given ACL
+// chain. Peer ACL drops are inserted at position 1 so they precede the
+// chain's catch-all; route ACL drops are inserted at position 2 to sit
+// immediately after the established/related accept rule.
+func (r *family) insertFilterRule(chain string, action firewall.Action, specs []string) error {
+	if action == firewall.ActionDrop {
+		pos := 1
+		if chain == chainRTFwdIn {
+			pos = 2
+		}
+		return r.iptablesClient.Insert(tableFilter, chain, pos, specs...)
+	}
+	return r.iptablesClient.Append(tableFilter, chain, specs...)
+}
+
+// removeFilterSpecs deletes the already-installed rules of a partially
+// applied filter rule.
+func (r *family) removeFilterSpecs(chain string, installed []filterSpecs) {
+	for _, fs := range installed {
+		if err := r.iptablesClient.DeleteIfExists(tableFilter, chain, fs.specs...); err != nil {
+			log.Debugf("delete partial filter rule: %v", err)
+		}
+		if fs.mangleSpecs != nil {
+			if err := r.iptablesClient.DeleteIfExists(tableMangle, chainRTPre, fs.mangleSpecs...); err != nil {
+				log.Debugf("delete partial mangle rule: %v", err)
+			}
+		}
+	}
+}
+
+// applyNetwork resolves a firewall.Network into the iptables match
+// fragment for the given direction flag (-s or -d). Set networks
+// increment the shared ipset refcount; prefixes emit a direct match;
+// an empty network returns no spec ("match any").
+func (r *family) applyNetwork(flag string, network firewall.Network, prefixes []netip.Prefix) ([]string, error) {
+	direction := "src"
+	if flag == "-d" {
+		direction = "dst"
+	}
+
+	if network.IsSet() {
+		// A destination set is populated later from DNS results, so unlike a
+		// source set it cannot be expanded into per-prefix rules. Without
+		// ipset such a rule is not expressible; report it instead of
+		// installing something broader than the policy allows.
+		if flag == "-d" && !r.ipsetSupported {
+			return nil, fmt.Errorf("destination set %s requires ipset (ip_set_hash_net and xt_set)", network.Set.HashedName())
+		}
+
+		name := r.ipsetName(network.Set.HashedName())
+		if _, err := r.ipsetCounter.Increment(name, prefixes); err != nil {
+			return nil, fmt.Errorf("create or get ipset: %w", err)
+		}
+
+		return []string{"-m", "set", matchSet, name, direction}, nil
+	}
+	if network.IsPrefix() {
+		return []string{flag, network.Prefix.String()}, nil
+	}
+
+	// nolint:nilnil
+	return nil, nil
+}
+
+// protoForFamily translates ICMP to ICMPv6 for ip6tables.
+// ip6tables requires "ipv6-icmp" (or "icmpv6") instead of "icmp".
+func protoForFamily(protocol firewall.Protocol, v6 bool) string {
+	if v6 && protocol == firewall.ProtocolICMP {
+		return "ipv6-icmp"
+	}
+	return string(protocol)
+}
+
+// filterMatchSpecs returns the proto/port match fragment for a
+// filtering rule. The source match (-s or -m set) is built by the
+// caller and prepended.
+func filterMatchSpecs(protocol string, sPort, dPort *firewall.Port) (specs []string) {
+	if protocol != "all" {
+		specs = append(specs, "-p", protocol)
+	}
+	specs = append(specs, applyPort("--sport", sPort)...)
+	specs = append(specs, applyPort("--dport", dPort)...)
+	return specs
+}
+
+func actionToStr(action firewall.Action) string {
+	if action == firewall.ActionAccept {
+		return "ACCEPT"
+	}
+	return "DROP"
+}
+
+func applyPort(flag string, port *firewall.Port) []string {
+	if port == nil {
+		return nil
+	}
+
+	if port.IsRange && len(port.Values) == 2 {
+		return []string{flag, fmt.Sprintf("%d:%d", port.Values[0], port.Values[1])}
+	}
+
+	if len(port.Values) > 1 {
+		portList := make([]string, len(port.Values))
+		for i, p := range port.Values {
+			portList[i] = strconv.Itoa(int(p))
+		}
+		return []string{"-m", "multiport", flag, strings.Join(portList, ",")}
+	}
+
+	return []string{flag, strconv.Itoa(int(port.Values[0]))}
+}
diff --git a/client/firewall/iptables/interface_allower_linux.go b/client/firewall/iptables/interface_allower_linux.go
new file mode 100644
index 000000000..40e9728e2
--- /dev/null
+++ b/client/firewall/iptables/interface_allower_linux.go
@@ -0,0 +1,93 @@
+package iptables
+
+import (
+	"fmt"
+
+	"github.com/coreos/go-iptables/iptables"
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+)
+
+// InterfaceAllower opens the NetBird interface on the iptables filter INPUT
+// chain so the host firewall doesn't drop traffic the userspace firewall
+// handles. It is the fallback used when nftables is unavailable (an
+// iptables-legacy host).
+//
+// It opens INPUT only: the userspace router never forwards in the kernel.
+// firewalld trust is handled by the uspfilter manager, not here.
+type InterfaceAllower struct {
+	ifaceName string
+	ipt4      *iptables.IPTables
+	// ipt6 is nil when the interface has no IPv6 overlay address.
+	ipt6 *iptables.IPTables
+}
+
+// NewInterfaceAllower builds an iptables allower for the interface. It returns
+// an error when iptables is unavailable, so the caller can fall back to
+// firewalld trust.
+func NewInterfaceAllower(wgIface iFaceMapper) (*InterfaceAllower, error) {
+	ipt4, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
+	if err != nil {
+		return nil, fmt.Errorf("iptables not available: %w", err)
+	}
+	if _, err := ipt4.ListChains(tableFilter); err != nil {
+		return nil, fmt.Errorf("iptables filter table not available: %w", err)
+	}
+
+	a := &InterfaceAllower{ifaceName: wgIface.Name(), ipt4: ipt4}
+
+	// Missing v6 must not break the v4 path: open v4 only and continue.
+	if wgIface.Address().HasIPv6() {
+		ipt6, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)
+		if err != nil {
+			log.Warnf("ip6tables not available, opening interface on v4 only: %v", err)
+		} else if _, err := ipt6.ListChains(tableFilter); err != nil {
+			log.Warnf("ip6tables filter table not available, opening interface on v4 only: %v", err)
+		} else {
+			a.ipt6 = ipt6
+		}
+	}
+
+	return a, nil
+}
+
+// Apply inserts the interface accept rule on the filter INPUT chain. It removes
+// any stale rule first so an unclean exit (e.g. SIGKILL, where Close never ran)
+// is recovered deterministically rather than accumulating duplicates.
+func (a *InterfaceAllower) Apply() error {
+	var merr *multierror.Error
+	for _, ipt := range a.clients() {
+		if err := ipt.DeleteIfExists(tableFilter, chainInput, a.inputRule()...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("clean stale interface accept rule: %w", err))
+		}
+		if err := ipt.Insert(tableFilter, chainInput, 1, a.inputRule()...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("add interface accept rule: %w", err))
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// Close removes the interface accept rule.
+func (a *InterfaceAllower) Close() error {
+	var merr *multierror.Error
+	for _, ipt := range a.clients() {
+		if err := ipt.DeleteIfExists(tableFilter, chainInput, a.inputRule()...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove interface accept rule: %w", err))
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (a *InterfaceAllower) inputRule() []string {
+	return []string{"-i", a.ifaceName, "-j", "ACCEPT"}
+}
+
+func (a *InterfaceAllower) clients() []*iptables.IPTables {
+	clients := []*iptables.IPTables{a.ipt4}
+	if a.ipt6 != nil {
+		clients = append(clients, a.ipt6)
+	}
+	return clients
+}
diff --git a/client/firewall/iptables/ipset_linux.go b/client/firewall/iptables/ipset_linux.go
new file mode 100644
index 000000000..2a3685af7
--- /dev/null
+++ b/client/firewall/iptables/ipset_linux.go
@@ -0,0 +1,131 @@
+//go:build !android
+
+package iptables
+
+import (
+	"fmt"
+	"net/netip"
+
+	"github.com/google/uuid"
+	"github.com/hashicorp/go-multierror"
+	"github.com/lrh3321/ipset-go"
+	log "github.com/sirupsen/logrus"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+)
+
+// probeIPSetSupport checks whether the kernel can create the ipset type
+// used for source and destination matches. On kernels lacking the
+// required ipset hash module, set creation fails (e.g. "invalid
+// argument"), which would otherwise fail every multi-source rule and
+// leave traffic the policy permits blocked by the catch-all drop. When
+// unsupported, multi-source rules fall back to one rule per prefix.
+func (r *family) probeIPSetSupport() bool {
+	// Use a unique name so concurrent processes don't collide and we only ever
+	// destroy the set we created ourselves. ipset names are limited to 31 chars,
+	// so use a short random suffix.
+	probeName := "nb-probe-" + uuid.New().String()[:8]
+
+	if err := r.createIPSet(probeName); err != nil {
+		log.Warnf("ipset is not available (failed to create probe set: %v); "+
+			"falling back to per-IP iptables ACL rules. Ensure the kernel provides "+
+			"the ipset hash:net module (ip_set_hash_net) for better performance with large rule sets", err)
+		return false
+	}
+
+	if err := r.destroyIPSet(probeName); err != nil {
+		log.Debugf("destroy ipset probe set %q: %v", probeName, err)
+	}
+
+	return true
+}
+
+func (r *family) createIpSet(setName string, sources []netip.Prefix) error {
+	if err := r.createIPSet(setName); err != nil {
+		return fmt.Errorf("create set %s: %w", setName, err)
+	}
+
+	for _, prefix := range sources {
+		if err := r.addPrefixToIPSet(setName, prefix); err != nil {
+			// The refcounter records nothing when this callback errors,
+			// so destroy the set or it leaks in the kernel. A partial
+			// source set would also fail-open for deny rules, so the
+			// rule must fail rather than install with a missing source.
+			if derr := r.destroyIPSet(setName); derr != nil {
+				log.Warnf("rollback ipset %s after add failure: %v", setName, derr)
+			}
+			return fmt.Errorf("add element to set %s: %w", setName, err)
+		}
+	}
+
+	return nil
+}
+
+func (r *family) deleteIpSet(setName string) error {
+	if err := r.destroyIPSet(setName); err != nil {
+		return fmt.Errorf("destroy set %s: %w", setName, err)
+	}
+
+	log.Debugf("deleted unused ipset %s", setName)
+	return nil
+}
+
+func (r *family) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
+	name := r.ipsetName(set.HashedName())
+	var merr *multierror.Error
+	for _, prefix := range prefixes {
+		if err := r.addPrefixToIPSet(name, prefix); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("add prefix to ipset: %w", err))
+		}
+	}
+	if merr == nil {
+		log.Debugf("updated set %s with prefixes %v", name, prefixes)
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) ipsetName(name string) string {
+	if r.v6 {
+		return name + "-v6"
+	}
+	return name
+}
+
+func (r *family) createIPSet(name string) error {
+	opts := ipset.CreateOptions{
+		Replace: true,
+	}
+	if r.v6 {
+		opts.Family = ipset.FamilyIPV6
+	}
+
+	if err := ipset.Create(name, ipset.TypeHashNet, opts); err != nil {
+		return fmt.Errorf("create ipset %s: %w", name, err)
+	}
+
+	log.Debugf("created ipset %s with type hash:net", name)
+	return nil
+}
+
+func (r *family) addPrefixToIPSet(name string, prefix netip.Prefix) error {
+	addr := prefix.Addr()
+	ip := addr.AsSlice()
+
+	entry := &ipset.Entry{
+		IP:      ip,
+		CIDR:    uint8(prefix.Bits()),
+		Replace: true,
+	}
+
+	if err := ipset.Add(name, entry); err != nil {
+		return fmt.Errorf("add prefix to ipset %s: %w", name, err)
+	}
+
+	return nil
+}
+
+func (r *family) destroyIPSet(name string) error {
+	return ipset.Destroy(name)
+}
diff --git a/client/firewall/iptables/manager_linux.go b/client/firewall/iptables/manager_linux.go
index 696537dd8..a566909c8 100644
--- a/client/firewall/iptables/manager_linux.go
+++ b/client/firewall/iptables/manager_linux.go
@@ -3,7 +3,6 @@ package iptables
 import (
 	"context"
 	"fmt"
-	"net"
 	"net/netip"
 	"sync"
 
@@ -18,25 +17,20 @@ import (
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 )
 
-type resetter interface {
-	Reset() error
-}
-
-// Manager of iptables firewall
+// Manager of iptables firewall. Per-family state (peer ACLs, route
+// ACLs, NAT, DNAT, MSS clamping) lives on family; Manager dispatches
+// by family and provides the public firewall.Manager surface.
 type Manager struct {
 	mutex sync.Mutex
 
 	wgIface iFaceMapper
 
-	ipv4Client   *iptables.IPTables
-	aclMgr       *aclManager
-	router       *router
-	rawSupported bool
+	ipv4Client *iptables.IPTables
+	family4    *family
 
 	// IPv6 counterparts, nil when no v6 overlay
 	ipv6Client *iptables.IPTables
-	aclMgr6    *aclManager
-	router6    *router
+	family6    *family
 }
 
 // iFaceMapper defines subset methods of interface required for manager
@@ -57,14 +51,9 @@ func Create(wgIface iFaceMapper, mtu uint16) (*Manager, error) {
 		ipv4Client: iptablesClient,
 	}
 
-	m.router, err = newRouter(iptablesClient, wgIface, mtu)
+	m.family4, err = newFamily(iptablesClient, wgIface, mtu)
 	if err != nil {
-		return nil, fmt.Errorf("create router: %w", err)
-	}
-
-	m.aclMgr, err = newAclManager(iptablesClient, wgIface)
-	if err != nil {
-		return nil, fmt.Errorf("create acl manager: %w", err)
+		return nil, fmt.Errorf("create family: %w", err)
 	}
 
 	if wgIface.Address().HasIPv6() {
@@ -81,21 +70,18 @@ func (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {
 	if err != nil {
 		return fmt.Errorf("init ip6tables: %w", err)
 	}
+
+	family6, err := newFamily(ip6Client, wgIface, mtu)
+	if err != nil {
+		return fmt.Errorf("create v6 family: %w", err)
+	}
+
+	// Share the same IP forwarding state with the v4 family, since the
+	// forwarding refcounter is per-family but shared between both families.
+	family6.ipFwdState = m.family4.ipFwdState
+
 	m.ipv6Client = ip6Client
-
-	m.router6, err = newRouter(ip6Client, wgIface, mtu)
-	if err != nil {
-		return fmt.Errorf("create v6 router: %w", err)
-	}
-
-	// Share the same IP forwarding state with the v4 router, since
-	// EnableIPForwarding controls both v4 and v6 sysctls.
-	m.router6.ipFwdState = m.router.ipFwdState
-
-	m.aclMgr6, err = newAclManager(ip6Client, wgIface)
-	if err != nil {
-		return fmt.Errorf("create v6 acl manager: %w", err)
-	}
+	m.family6 = family6
 
 	return nil
 }
@@ -109,7 +95,7 @@ func (m *Manager) Init(stateManager *statemanager.Manager) error {
 		InterfaceState: &InterfaceState{
 			NameStr:   m.wgIface.Name(),
 			WGAddress: m.wgIface.Address(),
-			MTU:       m.router.mtu,
+			MTU:       m.family4.mtu,
 		},
 	}
 	stateManager.RegisterState(state)
@@ -121,10 +107,6 @@ func (m *Manager) Init(stateManager *statemanager.Manager) error {
 		return err
 	}
 
-	if err := m.initNoTrackChain(); err != nil {
-		log.Warnf("raw table not available, notrack rules will be disabled: %v", err)
-	}
-
 	// Trust after all fatal init steps so a later failure doesn't leave the
 	// interface in firewalld's trusted zone without a corresponding Close.
 	if err := firewalld.TrustInterface(m.wgIface.Name()); err != nil {
@@ -141,31 +123,24 @@ func (m *Manager) Init(stateManager *statemanager.Manager) error {
 	return nil
 }
 
-// initChains initializes router and ACL chains for both address families,
-// rolling back on failure.
+// initChains initializes the per-family firewall state for both
+// address families, rolling back on failure.
 func (m *Manager) initChains(stateManager *statemanager.Manager) error {
 	type initStep struct {
 		name string
-		init func(*statemanager.Manager) error
-		mgr  resetter
+		r    *family
 	}
 
-	steps := []initStep{
-		{"router", m.router.init, m.router},
-		{"acl manager", m.aclMgr.init, m.aclMgr},
-	}
+	steps := []initStep{{"v4", m.family4}}
 	if m.hasIPv6() {
-		steps = append(steps,
-			initStep{"v6 router", m.router6.init, m.router6},
-			initStep{"v6 acl manager", m.aclMgr6.init, m.aclMgr6},
-		)
+		steps = append(steps, initStep{"v6", m.family6})
 	}
 
 	var initialized []initStep
 	for _, s := range steps {
-		if err := s.init(stateManager); err != nil {
+		if err := s.r.init(stateManager); err != nil {
 			for i := len(initialized) - 1; i >= 0; i-- {
-				if rerr := initialized[i].mgr.Reset(); rerr != nil {
+				if rerr := initialized[i].r.Reset(); rerr != nil {
 					log.Warnf("rollback %s: %v", initialized[i].name, rerr)
 				}
 			}
@@ -176,84 +151,50 @@ func (m *Manager) initChains(stateManager *statemanager.Manager) error {
 	return nil
 }
 
-// AddPeerFiltering adds a rule to the firewall
-//
-// Comment will be ignored because some system this feature is not supported
-func (m *Manager) AddPeerFiltering(
-	id []byte,
-	ip net.IP,
-	proto firewall.Protocol,
-	sPort *firewall.Port,
-	dPort *firewall.Port,
-	action firewall.Action,
-	ipsetName string,
-) ([]firewall.Rule, error) {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if ip.To4() != nil {
-		return m.aclMgr.AddPeerFiltering(id, ip, proto, sPort, dPort, action, ipsetName)
-	}
-	if !m.hasIPv6() {
-		return nil, fmt.Errorf("add peer filtering for %s: %w", ip, firewall.ErrIPv6NotInitialized)
-	}
-	return m.aclMgr6.AddPeerFiltering(id, ip, proto, sPort, dPort, action, ipsetName)
-}
-
-func (m *Manager) AddRouteFiltering(
+// AddFilterRule installs a packet-filtering rule. See firewall.Manager
+// docs for destination semantics. Sources are a single address family;
+// the rule is dispatched to the matching v4 / v6 backend.
+func (m *Manager) AddFilterRule(
 	id []byte,
 	sources []netip.Prefix,
 	destination firewall.Network,
 	proto firewall.Protocol,
-	sPort, dPort *firewall.Port,
+	sPort *firewall.Port,
+	dPort *firewall.Port,
 	action firewall.Action,
 ) (firewall.Rule, error) {
+	if len(sources) == 0 {
+		return nil, firewall.ErrNoSources
+	}
+
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
-	if isIPv6RouteRule(sources, destination) {
+	fam := m.family4
+	if isIPv6Rule(sources, destination) {
 		if !m.hasIPv6() {
-			return nil, fmt.Errorf("add route filtering: %w", firewall.ErrIPv6NotInitialized)
+			return nil, fmt.Errorf("add filtering: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.AddRouteFiltering(id, sources, destination, proto, sPort, dPort, action)
+		fam = m.family6
 	}
-
-	return m.router.AddRouteFiltering(id, sources, destination, proto, sPort, dPort, action)
+	return fam.AddFilterRule(id, sources, destination, proto, sPort, dPort, action)
 }
 
-func isIPv6RouteRule(sources []netip.Prefix, destination firewall.Network) bool {
-	if destination.IsPrefix() {
-		return destination.Prefix.Addr().Is6()
-	}
-	return len(sources) > 0 && sources[0].Addr().Is6()
-}
-
-// DeletePeerRule from the firewall by rule definition
-func (m *Manager) DeletePeerRule(rule firewall.Rule) error {
+// DeleteFilterRule removes a rule previously added via AddFilterRule.
+// The rule is looked up by id in each family's filter cache.
+func (m *Manager) DeleteFilterRule(rule firewall.Rule) error {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
-	if m.hasIPv6() && isIPv6IptRule(rule) {
-		return m.aclMgr6.DeletePeerRule(rule)
+	id := rule.ID()
+	if m.family4.hasRule(id) {
+		return m.family4.DeleteFilterRule(rule)
 	}
-	return m.aclMgr.DeletePeerRule(rule)
-}
-
-func isIPv6IptRule(rule firewall.Rule) bool {
-	r, ok := rule.(*Rule)
-	return ok && r.v6
-}
-
-// DeleteRouteRule deletes a routing rule.
-// Route rules are keyed by content hash. Check v4 first, try v6 if not found.
-func (m *Manager) DeleteRouteRule(rule firewall.Rule) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if m.hasIPv6() && !m.router.hasRule(rule.ID()) {
-		return m.router6.DeleteRouteRule(rule)
+	if m.hasIPv6() && m.family6.hasRule(id) {
+		return m.family6.DeleteFilterRule(rule)
 	}
-	return m.router.DeleteRouteRule(rule)
+	log.Debugf("filter rule %s not found in any family", id)
+	return nil
 }
 
 func (m *Manager) IsServerRouteSupported() bool {
@@ -272,10 +213,10 @@ func (m *Manager) AddNatRule(pair firewall.RouterPair) error {
 		if !m.hasIPv6() {
 			return fmt.Errorf("add NAT rule: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.AddNatRule(pair)
+		return m.family6.AddNatRule(pair)
 	}
 
-	if err := m.router.AddNatRule(pair); err != nil {
+	if err := m.family4.AddNatRule(pair); err != nil {
 		return err
 	}
 
@@ -284,7 +225,7 @@ func (m *Manager) AddNatRule(pair firewall.RouterPair) error {
 	// wildcard 0.0.0.0/0 destination where the client resolves DNS.
 	if m.hasIPv6() && pair.Dynamic {
 		v6Pair := firewall.ToV6NatPair(pair)
-		if err := m.router6.AddNatRule(v6Pair); err != nil {
+		if err := m.family6.AddNatRule(v6Pair); err != nil {
 			return fmt.Errorf("add v6 NAT rule: %w", err)
 		}
 	}
@@ -300,18 +241,18 @@ func (m *Manager) RemoveNatRule(pair firewall.RouterPair) error {
 		if !m.hasIPv6() {
 			return nil
 		}
-		return m.router6.RemoveNatRule(pair)
+		return m.family6.RemoveNatRule(pair)
 	}
 
 	var merr *multierror.Error
 
-	if err := m.router.RemoveNatRule(pair); err != nil {
+	if err := m.family4.RemoveNatRule(pair); err != nil {
 		merr = multierror.Append(merr, fmt.Errorf("remove v4 NAT rule: %w", err))
 	}
 
 	if m.hasIPv6() && pair.Dynamic {
 		v6Pair := firewall.ToV6NatPair(pair)
-		if err := m.router6.RemoveNatRule(v6Pair); err != nil {
+		if err := m.family6.RemoveNatRule(v6Pair); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("remove v6 NAT rule: %w", err))
 		}
 	}
@@ -320,11 +261,14 @@ func (m *Manager) RemoveNatRule(pair firewall.RouterPair) error {
 }
 
 func (m *Manager) SetLegacyManagement(isLegacy bool) error {
-	if err := firewall.SetLegacyManagement(m.router, isLegacy); err != nil {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+
+	if err := firewall.SetLegacyManagement(m.family4, isLegacy); err != nil {
 		return err
 	}
 	if m.hasIPv6() {
-		return firewall.SetLegacyManagement(m.router6, isLegacy)
+		return firewall.SetLegacyManagement(m.family6, isLegacy)
 	}
 	return nil
 }
@@ -336,24 +280,14 @@ func (m *Manager) Close(stateManager *statemanager.Manager) error {
 
 	var merr *multierror.Error
 
-	if err := m.cleanupNoTrackChain(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("cleanup notrack chain: %w", err))
-	}
-
 	if m.hasIPv6() {
-		if err := m.aclMgr6.Reset(); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("reset v6 acl manager: %w", err))
-		}
-		if err := m.router6.Reset(); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("reset v6 router: %w", err))
+		if err := m.family6.Reset(); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("reset v6 family: %w", err))
 		}
 	}
 
-	if err := m.aclMgr.Reset(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("reset acl manager: %w", err))
-	}
-	if err := m.router.Reset(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("reset router: %w", err))
+	if err := m.family4.Reset(); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("reset family: %w", err))
 	}
 
 	// Appending to merr intentionally blocks DeleteState below so ShutdownState
@@ -372,27 +306,6 @@ func (m *Manager) Close(stateManager *statemanager.Manager) error {
 	return nberrors.FormatErrorOrNil(merr)
 }
 
-// AllowNetbird allows netbird interface traffic.
-// This is called when USPFilter wraps the native firewall, adding blanket accept
-// rules so that packet filtering is handled in userspace instead of by netfilter.
-func (m *Manager) AllowNetbird() error {
-	var merr *multierror.Error
-	if _, err := m.AddPeerFiltering(nil, net.IP{0, 0, 0, 0}, firewall.ProtocolALL, nil, nil, firewall.ActionAccept, ""); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("allow netbird v4 interface traffic: %w", err))
-	}
-	if m.hasIPv6() {
-		if _, err := m.AddPeerFiltering(nil, net.IPv6zero, firewall.ProtocolALL, nil, nil, firewall.ActionAccept, ""); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("allow netbird v6 interface traffic: %w", err))
-		}
-	}
-
-	if err := firewalld.TrustInterface(m.wgIface.Name()); err != nil {
-		log.Warnf("failed to trust interface in firewalld: %v", err)
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
 // Flush doesn't need to be implemented for this manager
 func (m *Manager) Flush() error { return nil }
 
@@ -402,42 +315,12 @@ func (m *Manager) SetLogLevel(log.Level) {
 }
 
 func (m *Manager) EnableRouting() error {
-	if err := m.router.ipFwdState.RequestForwarding(); err != nil {
-		return fmt.Errorf("enable IP forwarding: %w", err)
-	}
-	return nil
+	// v6 only when the overlay actually has v6.
+	return m.family4.ipFwdState.RequestRouting(m.hasIPv6())
 }
 
 func (m *Manager) DisableRouting() error {
-	if err := m.router.ipFwdState.ReleaseForwarding(); err != nil {
-		return fmt.Errorf("disable IP forwarding: %w", err)
-	}
-	return nil
-}
-
-// AddDNATRule adds a DNAT rule
-func (m *Manager) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if rule.TranslatedAddress.Is6() {
-		if !m.hasIPv6() {
-			return nil, fmt.Errorf("add DNAT rule: %w", firewall.ErrIPv6NotInitialized)
-		}
-		return m.router6.AddDNATRule(rule)
-	}
-	return m.router.AddDNATRule(rule)
-}
-
-// DeleteDNATRule deletes a DNAT rule
-func (m *Manager) DeleteDNATRule(rule firewall.Rule) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if m.hasIPv6() && !m.router.hasRule(rule.ID()+dnatSuffix) {
-		return m.router6.DeleteDNATRule(rule)
-	}
-	return m.router.DeleteDNATRule(rule)
+	return m.family4.ipFwdState.ReleaseRouting()
 }
 
 // UpdateSet updates the set with the given prefixes
@@ -454,12 +337,12 @@ func (m *Manager) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
 		}
 	}
 
-	if err := m.router.UpdateSet(set, v4Prefixes); err != nil {
+	if err := m.family4.UpdateSet(set, v4Prefixes); err != nil {
 		return err
 	}
 
 	if m.hasIPv6() && len(v6Prefixes) > 0 {
-		if err := m.router6.UpdateSet(set, v6Prefixes); err != nil {
+		if err := m.family6.UpdateSet(set, v6Prefixes); err != nil {
 			return fmt.Errorf("update v6 set: %w", err)
 		}
 	}
@@ -476,9 +359,9 @@ func (m *Manager) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protoco
 		if !m.hasIPv6() {
 			return fmt.Errorf("add inbound DNAT: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.AddInboundDNAT(localAddr, protocol, originalPort, translatedPort)
+		return m.family6.AddInboundDNAT(localAddr, protocol, originalPort, translatedPort)
 	}
-	return m.router.AddInboundDNAT(localAddr, protocol, originalPort, translatedPort)
+	return m.family4.AddInboundDNAT(localAddr, protocol, originalPort, translatedPort)
 }
 
 // RemoveInboundDNAT removes an inbound DNAT rule.
@@ -490,9 +373,9 @@ func (m *Manager) RemoveInboundDNAT(localAddr netip.Addr, protocol firewall.Prot
 		if !m.hasIPv6() {
 			return fmt.Errorf("remove inbound DNAT: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.RemoveInboundDNAT(localAddr, protocol, originalPort, translatedPort)
+		return m.family6.RemoveInboundDNAT(localAddr, protocol, originalPort, translatedPort)
 	}
-	return m.router.RemoveInboundDNAT(localAddr, protocol, originalPort, translatedPort)
+	return m.family4.RemoveInboundDNAT(localAddr, protocol, originalPort, translatedPort)
 }
 
 // AddOutputDNAT adds an OUTPUT chain DNAT rule for locally-generated traffic.
@@ -504,9 +387,9 @@ func (m *Manager) AddOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol
 		if !m.hasIPv6() {
 			return fmt.Errorf("add output DNAT: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
+		return m.family6.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
 	}
-	return m.router.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
+	return m.family4.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
 }
 
 // RemoveOutputDNAT removes an OUTPUT chain DNAT rule.
@@ -518,139 +401,21 @@ func (m *Manager) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Proto
 		if !m.hasIPv6() {
 			return fmt.Errorf("remove output DNAT: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
+		return m.family6.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
 	}
-	return m.router.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
-}
-
-const (
-	chainNameRaw = "NETBIRD-RAW"
-	chainOUTPUT  = "OUTPUT"
-	tableRaw     = "raw"
-)
-
-// SetupEBPFProxyNoTrack creates notrack rules for eBPF proxy loopback traffic.
-// This prevents conntrack from tracking WireGuard proxy traffic on loopback, which
-// can interfere with MASQUERADE rules (e.g., from container runtimes like Podman/netavark).
-//
-// Traffic flows that need NOTRACK:
-//
-//  1. Egress: WireGuard -> fake endpoint (before eBPF rewrite)
-//     src=127.0.0.1:wgPort -> dst=127.0.0.1:fakePort
-//     Matched by: sport=wgPort
-//
-//  2. Egress: Proxy -> WireGuard (via raw socket)
-//     src=127.0.0.1:fakePort -> dst=127.0.0.1:wgPort
-//     Matched by: dport=wgPort
-//
-//  3. Ingress: Packets to WireGuard
-//     dst=127.0.0.1:wgPort
-//     Matched by: dport=wgPort
-//
-//  4. Ingress: Packets to proxy (after eBPF rewrite)
-//     dst=127.0.0.1:proxyPort
-//     Matched by: dport=proxyPort
-//
-// Rules are cleaned up when the firewall manager is closed.
-func (m *Manager) SetupEBPFProxyNoTrack(proxyPort, wgPort uint16) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if !m.rawSupported {
-		return fmt.Errorf("raw table not available")
-	}
-
-	wgPortStr := fmt.Sprintf("%d", wgPort)
-	proxyPortStr := fmt.Sprintf("%d", proxyPort)
-
-	// Egress rules: match outgoing loopback UDP packets
-	outputRuleSport := []string{"-o", "lo", "-s", "127.0.0.1", "-d", "127.0.0.1", "-p", "udp", "--sport", wgPortStr, "-j", "NOTRACK"}
-	if err := m.ipv4Client.AppendUnique(tableRaw, chainNameRaw, outputRuleSport...); err != nil {
-		return fmt.Errorf("add output sport notrack rule: %w", err)
-	}
-
-	outputRuleDport := []string{"-o", "lo", "-s", "127.0.0.1", "-d", "127.0.0.1", "-p", "udp", "--dport", wgPortStr, "-j", "NOTRACK"}
-	if err := m.ipv4Client.AppendUnique(tableRaw, chainNameRaw, outputRuleDport...); err != nil {
-		return fmt.Errorf("add output dport notrack rule: %w", err)
-	}
-
-	// Ingress rules: match incoming loopback UDP packets
-	preroutingRuleWg := []string{"-i", "lo", "-s", "127.0.0.1", "-d", "127.0.0.1", "-p", "udp", "--dport", wgPortStr, "-j", "NOTRACK"}
-	if err := m.ipv4Client.AppendUnique(tableRaw, chainNameRaw, preroutingRuleWg...); err != nil {
-		return fmt.Errorf("add prerouting wg notrack rule: %w", err)
-	}
-
-	preroutingRuleProxy := []string{"-i", "lo", "-s", "127.0.0.1", "-d", "127.0.0.1", "-p", "udp", "--dport", proxyPortStr, "-j", "NOTRACK"}
-	if err := m.ipv4Client.AppendUnique(tableRaw, chainNameRaw, preroutingRuleProxy...); err != nil {
-		return fmt.Errorf("add prerouting proxy notrack rule: %w", err)
-	}
-
-	log.Debugf("set up ebpf proxy notrack rules for ports %d,%d", proxyPort, wgPort)
-	return nil
-}
-
-func (m *Manager) initNoTrackChain() error {
-	if err := m.cleanupNoTrackChain(); err != nil {
-		log.Debugf("cleanup notrack chain: %v", err)
-	}
-
-	if err := m.ipv4Client.NewChain(tableRaw, chainNameRaw); err != nil {
-		return fmt.Errorf("create chain: %w", err)
-	}
-
-	jumpRule := []string{"-j", chainNameRaw}
-
-	if err := m.ipv4Client.InsertUnique(tableRaw, chainOUTPUT, 1, jumpRule...); err != nil {
-		if delErr := m.ipv4Client.DeleteChain(tableRaw, chainNameRaw); delErr != nil {
-			log.Debugf("delete orphan chain: %v", delErr)
-		}
-		return fmt.Errorf("add output jump rule: %w", err)
-	}
-
-	if err := m.ipv4Client.InsertUnique(tableRaw, chainPREROUTING, 1, jumpRule...); err != nil {
-		if delErr := m.ipv4Client.DeleteIfExists(tableRaw, chainOUTPUT, jumpRule...); delErr != nil {
-			log.Debugf("delete output jump rule: %v", delErr)
-		}
-		if delErr := m.ipv4Client.DeleteChain(tableRaw, chainNameRaw); delErr != nil {
-			log.Debugf("delete orphan chain: %v", delErr)
-		}
-		return fmt.Errorf("add prerouting jump rule: %w", err)
-	}
-
-	m.rawSupported = true
-	return nil
-}
-
-func (m *Manager) cleanupNoTrackChain() error {
-	exists, err := m.ipv4Client.ChainExists(tableRaw, chainNameRaw)
-	if err != nil {
-		if !m.rawSupported {
-			return nil
-		}
-		return fmt.Errorf("check chain exists: %w", err)
-	}
-	if !exists {
-		return nil
-	}
-
-	jumpRule := []string{"-j", chainNameRaw}
-
-	if err := m.ipv4Client.DeleteIfExists(tableRaw, chainOUTPUT, jumpRule...); err != nil {
-		return fmt.Errorf("remove output jump rule: %w", err)
-	}
-
-	if err := m.ipv4Client.DeleteIfExists(tableRaw, chainPREROUTING, jumpRule...); err != nil {
-		return fmt.Errorf("remove prerouting jump rule: %w", err)
-	}
-
-	if err := m.ipv4Client.ClearAndDeleteChain(tableRaw, chainNameRaw); err != nil {
-		return fmt.Errorf("clear and delete chain: %w", err)
-	}
-
-	m.rawSupported = false
-	return nil
+	return m.family4.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
 }
 
 func getConntrackEstablished() []string {
 	return []string{"-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"}
 }
+
+// isIPv6Rule reports whether the rule belongs to the IPv6 family, from
+// the destination prefix when set, otherwise from the (single-family)
+// sources.
+func isIPv6Rule(sources []netip.Prefix, destination firewall.Network) bool {
+	if destination.IsPrefix() {
+		return destination.Prefix.Addr().Is6()
+	}
+	return len(sources) > 0 && sources[0].Addr().Is6()
+}
diff --git a/client/firewall/iptables/manager_linux_test.go b/client/firewall/iptables/manager_linux_test.go
index 7b0989f6c..8435bf6a5 100644
--- a/client/firewall/iptables/manager_linux_test.go
+++ b/client/firewall/iptables/manager_linux_test.go
@@ -5,16 +5,19 @@ package iptables
 import (
 	"fmt"
 	"net/netip"
+	"slices"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/coreos/go-iptables/iptables"
+	"github.com/lrh3321/ipset-go"
 	"github.com/stretchr/testify/require"
 
 	fw "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 var ifaceMock = &iFaceMock{
@@ -67,47 +70,37 @@ func TestIptablesManager(t *testing.T) {
 		time.Sleep(time.Second)
 	}()
 
-	var rule2 []fw.Rule
+	var rule2 fw.Rule
 	t.Run("add second rule", func(t *testing.T) {
 		ip := netip.MustParseAddr("10.20.0.3")
 		port := &fw.Port{
 			IsRange: true,
 			Values:  []uint16{8043, 8046},
 		}
-		rule2, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", port, nil, fw.ActionAccept, "")
+		rule2, err = manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, "tcp", port, nil, fw.ActionAccept)
 		require.NoError(t, err, "failed to add rule")
 
-		for _, r := range rule2 {
-			rr := r.(*Rule)
-			checkRuleSpecs(t, ipv4Client, rr.chain, true, rr.specs...)
-		}
+		rr := rule2.(*Rule)
+		checkRuleSpecs(t, ipv4Client, rr.chain, true, rr.specs...)
 	})
 
 	t.Run("delete second rule", func(t *testing.T) {
-		for _, r := range rule2 {
-			err := manager.DeletePeerRule(r)
-			require.NoError(t, err, "failed to delete rule")
-		}
-
-		require.Empty(t, manager.aclMgr.ipsetStore.ipsets, "rulesets index after removed second rule must be empty")
+		require.NoError(t, manager.DeleteFilterRule(rule2), "failed to delete rule")
 	})
 
 	t.Run("reset check", func(t *testing.T) {
 		// add second rule
 		ip := netip.MustParseAddr("10.20.0.3")
 		port := &fw.Port{Values: []uint16{5353}}
-		_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "udp", nil, port, fw.ActionAccept, "")
+		_, err = manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, "udp", nil, port, fw.ActionAccept)
 		require.NoError(t, err, "failed to add rule")
 
 		err = manager.Close(nil)
 		require.NoError(t, err, "failed to reset")
 
-		ok, err := ipv4Client.ChainExists("filter", chainNameInputRules)
+		ok, err := ipv4Client.ChainExists("filter", chainACLInput)
 		require.NoError(t, err, "failed check chain exists")
-
-		if ok {
-			require.NoErrorf(t, err, "chain '%v' still exists after Close", chainNameInputRules)
-		}
+		require.Falsef(t, ok, "chain %q still exists after Close", chainACLInput)
 	})
 }
 
@@ -128,15 +121,13 @@ func TestIptablesManagerDenyRules(t *testing.T) {
 		ip := netip.MustParseAddr("10.20.0.3")
 		port := &fw.Port{Values: []uint16{22}}
 
-		rule, err := manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", nil, port, fw.ActionDrop, "deny-ssh")
+		rule, err := manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, "tcp", nil, port, fw.ActionDrop)
 		require.NoError(t, err, "failed to add deny rule")
-		require.NotEmpty(t, rule, "deny rule should not be empty")
+		require.NotNil(t, rule, "deny rule should not be nil")
 
 		// Verify the rule was added by checking iptables
-		for _, r := range rule {
-			rr := r.(*Rule)
-			checkRuleSpecs(t, ipv4Client, rr.chain, true, rr.specs...)
-		}
+		rr := rule.(*Rule)
+		checkRuleSpecs(t, ipv4Client, rr.chain, true, rr.specs...)
 	})
 
 	t.Run("deny rule precedence test", func(t *testing.T) {
@@ -144,36 +135,40 @@ func TestIptablesManagerDenyRules(t *testing.T) {
 		port := &fw.Port{Values: []uint16{80}}
 
 		// Add accept rule first
-		_, err := manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", nil, port, fw.ActionAccept, "accept-http")
+		_, err := manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, "tcp", nil, port, fw.ActionAccept)
 		require.NoError(t, err, "failed to add accept rule")
 
 		// Add deny rule second for same IP/port - this should take precedence
-		_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", nil, port, fw.ActionDrop, "deny-http")
+		_, err = manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, "tcp", nil, port, fw.ActionDrop)
 		require.NoError(t, err, "failed to add deny rule")
 
 		// Inspect the actual iptables rules to verify deny rule comes before accept rule
-		rules, err := ipv4Client.List("filter", chainNameInputRules)
+		rules, err := ipv4Client.List("filter", chainACLInput)
 		require.NoError(t, err, "failed to list iptables rules")
 
 		// Debug: print all rules
-		t.Logf("All iptables rules in chain %s:", chainNameInputRules)
+		t.Logf("All iptables rules in chain %s:", chainACLInput)
 		for i, rule := range rules {
 			t.Logf("  [%d] %s", i, rule)
 		}
 
+		// Single-source rules emit a direct `-s <ip>/32 ... --dport 80`
+		// match. Match on that shape instead of the legacy
+		// per-(action,port) ipset names ("deny-http"/"accept-http")
+		// that this test predates.
+		srcMatch := fmt.Sprintf("-s %s/32", ip)
 		var denyRuleIndex, acceptRuleIndex = -1, -1
 		for i, rule := range rules {
-			if strings.Contains(rule, "DROP") {
-				t.Logf("Found DROP rule at index %d: %s", i, rule)
-				if strings.Contains(rule, "deny-http") && strings.Contains(rule, "80") {
-					denyRuleIndex = i
-				}
+			if !strings.Contains(rule, srcMatch) || !strings.Contains(rule, "--dport 80") {
+				continue
 			}
-			if strings.Contains(rule, "ACCEPT") {
+			if strings.Contains(rule, "-j DROP") {
+				t.Logf("Found DROP rule at index %d: %s", i, rule)
+				denyRuleIndex = i
+			}
+			if strings.Contains(rule, "-j ACCEPT") {
 				t.Logf("Found ACCEPT rule at index %d: %s", i, rule)
-				if strings.Contains(rule, "accept-http") && strings.Contains(rule, "80") {
-					acceptRuleIndex = i
-				}
+				acceptRuleIndex = i
 			}
 		}
 
@@ -198,7 +193,6 @@ func TestIptablesManagerIPSet(t *testing.T) {
 		},
 	}
 
-	// just check on the local interface
 	manager, err := Create(mock, iface.DefaultMTU)
 	require.NoError(t, err)
 	require.NoError(t, manager.Init(nil))
@@ -212,27 +206,39 @@ func TestIptablesManagerIPSet(t *testing.T) {
 		time.Sleep(time.Second)
 	}()
 
-	var rule2 []fw.Rule
-	t.Run("add second rule", func(t *testing.T) {
+	var rule2 fw.Rule
+	t.Run("single source uses direct -s match (no ipset)", func(t *testing.T) {
 		ip := netip.MustParseAddr("10.20.0.3")
 		port := &fw.Port{
 			Values: []uint16{443},
 		}
-		rule2, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", port, nil, fw.ActionAccept, "default")
-		for _, r := range rule2 {
-			require.NoError(t, err, "failed to add rule")
-			require.Equal(t, r.(*Rule).ipsetName, "default-sport", "ipset name must be set")
-			require.Equal(t, r.(*Rule).ip, "10.20.0.3", "ipset IP must be set")
-		}
+		rule2, err = manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, "tcp", port, nil, fw.ActionAccept)
+		require.NoError(t, err, "failed to add rule")
+		require.NotNil(t, rule2)
+		require.Contains(t, rule2.(*Rule).specs, "-s",
+			"single-source rule should use direct -s match, not an ipset")
+		require.Empty(t, findSets(rule2.(*Rule).specs),
+			"single-source rule should not allocate a shared ipset")
 	})
 
-	t.Run("delete second rule", func(t *testing.T) {
-		for _, r := range rule2 {
-			err := manager.DeletePeerRule(r)
-			require.NoError(t, err, "failed to delete rule")
+	t.Run("delete single-source rule", func(t *testing.T) {
+		require.NoError(t, manager.DeleteFilterRule(rule2), "failed to delete rule")
+	})
 
-			require.Empty(t, manager.aclMgr.ipsetStore.ipsets, "rulesets index after removed second rule must be empty")
+	t.Run("multi-source uses shared ipset", func(t *testing.T) {
+		sources := []netip.Prefix{
+			netip.PrefixFrom(netip.MustParseAddr("10.20.0.3"), 32),
+			netip.PrefixFrom(netip.MustParseAddr("10.20.0.4"), 32),
+			netip.PrefixFrom(netip.MustParseAddr("10.20.0.5"), 32),
 		}
+		port := &fw.Port{Values: []uint16{8080}}
+		multi, err := manager.AddFilterRule(nil, sources, fw.Network{}, "tcp", nil, port, fw.ActionAccept)
+		require.NoError(t, err, "failed to add multi-source rule")
+		require.NotNil(t, multi, "multi-source rule must produce one iptables rule")
+		sets := findSets(multi.(*Rule).specs)
+		require.Len(t, sets, 1, "multi-source rule must reference exactly one ipset")
+
+		require.NoError(t, manager.DeleteFilterRule(multi))
 	})
 
 	t.Run("reset check", func(t *testing.T) {
@@ -241,9 +247,314 @@ func TestIptablesManagerIPSet(t *testing.T) {
 	})
 }
 
+// TestIptablesFilterIPSetFallback verifies that when the kernel lacks
+// ipset support, a multi-source rule falls back to one iptables rule
+// per source prefix instead of silently leaving the chain empty. See
+// discussion #6125.
+func TestIptablesFilterIPSetFallback(t *testing.T) {
+	ipv4Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
+	require.NoError(t, err)
+
+	manager, err := Create(ifaceMock, iface.DefaultMTU)
+	require.NoError(t, err)
+	require.NoError(t, manager.Init(nil))
+
+	defer func() {
+		require.NoError(t, manager.Close(nil))
+	}()
+
+	// Simulate a kernel without the ipset hash module.
+	manager.family4.ipsetSupported = false
+
+	sources := []netip.Prefix{
+		netip.MustParsePrefix("10.20.0.42/32"),
+		netip.MustParsePrefix("10.20.0.43/32"),
+	}
+	port := &fw.Port{Values: []uint16{22}}
+
+	rule, err := manager.AddFilterRule(nil, sources, fw.Network{}, "tcp", nil, port, fw.ActionAccept)
+	require.NoError(t, err, "AddFilterRule should succeed via fallback")
+
+	rr := rule.(*Rule)
+	all := rr.allSpecs()
+	require.Len(t, all, len(sources), "each source prefix needs its own rule")
+	for i, fs := range all {
+		joined := strings.Join(fs.specs, " ")
+		require.Contains(t, joined, "-s "+sources[i].String(), "fallback rule must match by source prefix")
+		require.NotContains(t, joined, matchSet, "fallback rule must not use ipset matching")
+
+		// The rule must actually be present in the ACL chain (not silently dropped).
+		checkRuleSpecs(t, ipv4Client, rr.chain, true, fs.specs...)
+
+		// Every expanded peer rule keeps its own redirect-mark pairing.
+		require.NotNil(t, fs.mangleSpecs, "peer rule must carry a mangle pairing")
+		checkTableRuleSpecs(t, ipv4Client, tableMangle, chainRTPre, true, fs.mangleSpecs...)
+	}
+
+	require.NoError(t, manager.DeleteFilterRule(rule), "failed to delete fallback rule")
+	for _, fs := range all {
+		checkRuleSpecs(t, ipv4Client, rr.chain, false, fs.specs...)
+		checkTableRuleSpecs(t, ipv4Client, tableMangle, chainRTPre, false, fs.mangleSpecs...)
+	}
+}
+
+// TestIptablesFilterDestinationSetRequiresIPSet documents that a dynamic
+// (domain) destination cannot be expressed without ipset: its prefixes are only
+// known after DNS resolution, so there is nothing to expand into per-prefix
+// rules. The call must report that rather than install a broader rule than the
+// policy allows.
+func TestIptablesFilterDestinationSetRequiresIPSet(t *testing.T) {
+	manager, err := Create(ifaceMock, iface.DefaultMTU)
+	require.NoError(t, err)
+	require.NoError(t, manager.Init(nil))
+
+	defer func() {
+		require.NoError(t, manager.Close(nil))
+	}()
+
+	manager.family4.ipsetSupported = false
+
+	destination := fw.Network{Set: fw.NewDomainSet(domain.List{"example.com"})}
+
+	_, err = manager.AddFilterRule(nil, []netip.Prefix{netip.MustParsePrefix("172.16.0.0/16")},
+		destination, fw.ProtocolALL, nil, nil, fw.ActionAccept)
+	require.Error(t, err, "a domain destination is not expressible without ipset")
+	require.ErrorContains(t, err, "requires ipset")
+}
+
+// TestIptablesNatRuleDropsSourceSetOnDestinationFailure covers a marking rule
+// whose source set is created but whose destination set is not: the source
+// reference has to go back, or the set it created stays in the kernel with a
+// count nothing will ever drop.
+func TestIptablesNatRuleDropsSourceSetOnDestinationFailure(t *testing.T) {
+	manager, err := Create(ifaceMock, iface.DefaultMTU)
+	require.NoError(t, err)
+	require.NoError(t, manager.Init(nil))
+
+	defer func() {
+		require.NoError(t, manager.Close(nil))
+	}()
+
+	sourceSet := fw.NewPrefixSet([]netip.Prefix{
+		netip.MustParsePrefix("100.0.0.0/16"),
+		netip.MustParsePrefix("10.10.0.0/16"),
+	})
+	destSet := fw.NewDomainSet(domain.List{"example.org"})
+
+	// Poison the destination set's name so its hash:net creation fails after
+	// the source set has already been created.
+	poisoned := manager.family4.ipsetName(destSet.HashedName())
+	require.NoError(t, ipset.Create(poisoned, ipset.TypeHashIP, ipset.CreateOptions{}))
+	t.Cleanup(func() {
+		if err := ipset.Destroy(poisoned); err != nil {
+			t.Logf("destroy poisoned set %s: %v", poisoned, err)
+		}
+	})
+
+	pair := fw.RouterPair{
+		ID:          "nat-source-set-test",
+		Source:      fw.Network{Set: sourceSet},
+		Destination: fw.Network{Set: destSet},
+		Masquerade:  true,
+		Dynamic:     true,
+	}
+
+	require.Error(t, manager.AddNatRule(pair), "the destination set must fail to be created")
+
+	_, ok := manager.family4.ipsetCounter.Get(manager.family4.ipsetName(sourceSet.HashedName()))
+	require.False(t, ok, "the source set reference must be released")
+}
+
+// TestIptablesNatRuleReAddKeepsSetReferences re-adds the same NAT rule the way
+// a repeated network-map update does. The marking rule's set references must not
+// grow, or RemoveNatRule can never drop the count to zero and the set stays in
+// the kernel for the rest of the process lifetime.
+func TestIptablesNatRuleReAddKeepsSetReferences(t *testing.T) {
+	manager, err := Create(ifaceMock, iface.DefaultMTU)
+	require.NoError(t, err)
+	require.NoError(t, manager.Init(nil))
+
+	defer func() {
+		require.NoError(t, manager.Close(nil))
+	}()
+
+	set := fw.NewDomainSet(domain.List{"example.com"})
+	pair := fw.RouterPair{
+		ID:          "nat-reference-test",
+		Source:      fw.Network{Prefix: netip.MustParsePrefix("100.0.0.0/16")},
+		Destination: fw.Network{Set: set},
+		Masquerade:  true,
+		Dynamic:     true,
+	}
+
+	require.NoError(t, manager.AddNatRule(pair), "add nat rule")
+	name := manager.family4.ipsetName(set.HashedName())
+	first, ok := manager.family4.ipsetCounter.Get(name)
+	require.True(t, ok, "the marking rule must hold a reference to its set")
+
+	require.NoError(t, manager.AddNatRule(pair), "re-add nat rule")
+	second, ok := manager.family4.ipsetCounter.Get(name)
+	require.True(t, ok, "the set must still be referenced")
+	require.Equal(t, first.Count, second.Count, "re-adding the same rule must not add references")
+
+	require.NoError(t, manager.RemoveNatRule(pair), "remove nat rule")
+	_, ok = manager.family4.ipsetCounter.Get(name)
+	require.False(t, ok, "removing the rule must drop the last reference")
+}
+
+// TestIptablesRouteFilterIPSetFallback covers the route ACL side of the
+// fallback: with a destination set, the expanded per-source rules land
+// in the route forward chain and are all removed on delete.
+func TestIptablesRouteFilterIPSetFallback(t *testing.T) {
+	ipv4Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
+	require.NoError(t, err)
+
+	manager, err := Create(ifaceMock, iface.DefaultMTU)
+	require.NoError(t, err)
+	require.NoError(t, manager.Init(nil))
+
+	defer func() {
+		require.NoError(t, manager.Close(nil))
+	}()
+
+	manager.family4.ipsetSupported = false
+
+	sources := []netip.Prefix{
+		netip.MustParsePrefix("172.16.0.0/16"),
+		netip.MustParsePrefix("192.168.0.0/16"),
+	}
+	destination := fw.Network{Prefix: netip.MustParsePrefix("10.0.0.0/8")}
+	port := &fw.Port{Values: []uint16{443}}
+
+	rule, err := manager.AddFilterRule(nil, sources, destination, "tcp", nil, port, fw.ActionAccept)
+	require.NoError(t, err, "route ACL must install without ipset")
+
+	rr := rule.(*Rule)
+	require.Equal(t, chainRTFwdIn, rr.chain, "route rule must land in the forward chain")
+
+	all := rr.allSpecs()
+	require.Len(t, all, len(sources), "each source prefix needs its own rule")
+	for i, fs := range all {
+		joined := strings.Join(fs.specs, " ")
+		require.Contains(t, joined, "-s "+sources[i].String(), "fallback rule must match by source prefix")
+		require.NotContains(t, joined, matchSet, "fallback rule must not use ipset matching")
+		require.Nil(t, fs.mangleSpecs, "route rules have no mangle pairing")
+
+		checkRuleSpecs(t, ipv4Client, rr.chain, true, fs.specs...)
+	}
+
+	require.NoError(t, manager.DeleteFilterRule(rule), "failed to delete fallback rule")
+	for _, fs := range all {
+		checkRuleSpecs(t, ipv4Client, rr.chain, false, fs.specs...)
+	}
+}
+
+// TestIptablesCloseRemovesAllState exercises a spread of rule kinds and then
+// asserts Close puts every table it touches back exactly as it found it. A
+// leaked chain, jump, or ipset survives the daemon and nothing can remove it
+// afterwards, since the tracking that knew about it is gone.
+func TestIptablesCloseRemovesAllState(t *testing.T) {
+	ipv4Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
+	require.NoError(t, err)
+
+	before := snapshotIptables(t, ipv4Client)
+
+	manager, err := Create(ifaceMock, iface.DefaultMTU)
+	require.NoError(t, err)
+	require.NoError(t, manager.Init(nil))
+
+	// A failed assertion below returns before the Close under test, which would
+	// leave this test's chains and sets in the kernel for the next one.
+	t.Cleanup(func() {
+		if err := manager.Close(nil); err != nil {
+			t.Logf("close after failure: %v", err)
+		}
+	})
+
+	sources := []netip.Prefix{
+		netip.MustParsePrefix("10.20.0.42/32"),
+		netip.MustParsePrefix("10.20.0.43/32"),
+	}
+
+	// A multi-source peer rule: shared ipset plus the mangle redirect pairing.
+	_, err = manager.AddFilterRule(nil, sources, fw.Network{}, "tcp",
+		nil, &fw.Port{Values: []uint16{22}}, fw.ActionAccept)
+	require.NoError(t, err, "add peer rule")
+
+	// A route rule with a dynamic destination: a second set, in the forward chain.
+	_, err = manager.AddFilterRule(nil, sources,
+		fw.Network{Set: fw.NewDomainSet(domain.List{"example.com"})},
+		fw.ProtocolALL, nil, nil, fw.ActionDrop)
+	require.NoError(t, err, "add route rule")
+
+	// NAT marking for a routed destination, both directions.
+	pair := fw.RouterPair{
+		ID:          "cleanup-test",
+		Source:      fw.Network{Prefix: netip.MustParsePrefix("100.0.0.0/16")},
+		Destination: fw.Network{Prefix: netip.MustParsePrefix("192.168.55.0/24")},
+		Masquerade:  true,
+	}
+	require.NoError(t, manager.AddNatRule(pair), "add nat rule")
+	require.NoError(t, manager.EnableRouting(), "enable routing")
+
+	require.NotEqual(t, before, snapshotIptables(t, ipv4Client), "the manager must have installed state")
+
+	// Everything above stays in place, so Close is what has to remove it.
+	require.NoError(t, manager.Close(nil), "close")
+
+	after := snapshotIptables(t, ipv4Client)
+	require.Equal(t, before.chains, after.chains, "Close must remove every chain it created")
+	require.Equal(t, before.rules, after.rules, "Close must remove every rule it created")
+	require.Equal(t, before.sets, after.sets, "Close must destroy every ipset it created")
+}
+
+// iptablesState is a snapshot of the tables the manager writes to, used to
+// compare the kernel before and after a manager lifetime.
+type iptablesState struct {
+	chains map[string][]string
+	rules  map[string][]string
+	sets   []string
+}
+
+func snapshotIptables(t *testing.T, client *iptables.IPTables) iptablesState {
+	t.Helper()
+
+	state := iptablesState{
+		chains: map[string][]string{},
+		rules:  map[string][]string{},
+	}
+
+	for _, table := range []string{tableFilter, tableNat, tableMangle, tableRaw} {
+		chains, err := client.ListChains(table)
+		require.NoErrorf(t, err, "list chains in %s", table)
+		slices.Sort(chains)
+		state.chains[table] = chains
+
+		for _, chain := range chains {
+			rules, err := client.List(table, chain)
+			require.NoErrorf(t, err, "list rules in %s/%s", table, chain)
+			state.rules[table+"/"+chain] = rules
+		}
+	}
+
+	sets, err := ipset.ListAll()
+	require.NoError(t, err, "list ipsets")
+	for _, set := range sets {
+		state.sets = append(state.sets, set.SetName)
+	}
+	slices.Sort(state.sets)
+
+	return state
+}
+
 func checkRuleSpecs(t *testing.T, ipv4Client *iptables.IPTables, chainName string, mustExists bool, rulespec ...string) {
 	t.Helper()
-	exists, err := ipv4Client.Exists("filter", chainName, rulespec...)
+	checkTableRuleSpecs(t, ipv4Client, tableFilter, chainName, mustExists, rulespec...)
+}
+
+func checkTableRuleSpecs(t *testing.T, ipv4Client *iptables.IPTables, table, chainName string, mustExists bool, rulespec ...string) {
+	t.Helper()
+	exists, err := ipv4Client.Exists(table, chainName, rulespec...)
 	require.NoError(t, err, "failed to check rule")
 	require.Falsef(t, !exists && mustExists, "rule '%v' does not exist", rulespec)
 	require.Falsef(t, exists && !mustExists, "rule '%v' exist", rulespec)
@@ -283,7 +594,7 @@ func TestIptablesCreatePerformance(t *testing.T) {
 			start := time.Now()
 			for i := 0; i < testMax; i++ {
 				port := &fw.Port{Values: []uint16{uint16(1000 + i)}}
-				_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", nil, port, fw.ActionAccept, "")
+				_, err = manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, "tcp", nil, port, fw.ActionAccept)
 
 				require.NoError(t, err, "failed to add rule")
 			}
diff --git a/client/firewall/iptables/router_linux.go b/client/firewall/iptables/router_linux.go
deleted file mode 100644
index 42d305f5c..000000000
--- a/client/firewall/iptables/router_linux.go
+++ /dev/null
@@ -1,1154 +0,0 @@
-//go:build !android
-
-package iptables
-
-import (
-	"fmt"
-	"maps"
-	"net/netip"
-	"strconv"
-	"strings"
-
-	"github.com/coreos/go-iptables/iptables"
-	"github.com/hashicorp/go-multierror"
-	ipset "github.com/lrh3321/ipset-go"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	nbid "github.com/netbirdio/netbird/client/internal/acl/id"
-	"github.com/netbirdio/netbird/client/internal/routemanager/ipfwdstate"
-	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
-	"github.com/netbirdio/netbird/client/internal/statemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
-)
-
-// constants needed to manage and create iptable rules
-const (
-	tableFilter = "filter"
-	tableNat    = "nat"
-	tableMangle = "mangle"
-
-	chainPOSTROUTING        = "POSTROUTING"
-	chainPREROUTING         = "PREROUTING"
-	chainFORWARD            = "FORWARD"
-	chainRTNAT              = "NETBIRD-RT-NAT"
-	chainRTFWDIN            = "NETBIRD-RT-FWD-IN"
-	chainRTFWDOUT           = "NETBIRD-RT-FWD-OUT"
-	chainRTPRE              = "NETBIRD-RT-PRE"
-	chainRTRDR              = "NETBIRD-RT-RDR"
-	chainNATOutput          = "NETBIRD-NAT-OUTPUT"
-	chainRTMSSCLAMP         = "NETBIRD-RT-MSSCLAMP"
-	routingFinalForwardJump = "ACCEPT"
-	routingFinalNatJump     = "MASQUERADE"
-
-	jumpManglePre  = "jump-mangle-pre"
-	jumpNatPre     = "jump-nat-pre"
-	jumpNatPost    = "jump-nat-post"
-	jumpNatOutput  = "jump-nat-output"
-	jumpMSSClamp   = "jump-mss-clamp"
-	markManglePre  = "mark-mangle-pre"
-	markManglePost = "mark-mangle-post"
-	matchSet       = "--match-set"
-
-	dnatSuffix = "_dnat"
-	snatSuffix = "_snat"
-	fwdSuffix  = "_fwd"
-
-	// ipv4TCPHeaderSize is the minimum IPv4 (20) + TCP (20) header size for MSS calculation.
-	ipv4TCPHeaderSize = 40
-	// ipv6TCPHeaderSize is the minimum IPv6 (40) + TCP (20) header size for MSS calculation.
-	ipv6TCPHeaderSize = 60
-)
-
-type ruleInfo struct {
-	chain string
-	table string
-	rule  []string
-}
-
-type routeFilteringRuleParams struct {
-	Source      firewall.Network
-	Destination firewall.Network
-	Proto       firewall.Protocol
-	SPort       *firewall.Port
-	DPort       *firewall.Port
-	Direction   firewall.RuleDirection
-	Action      firewall.Action
-}
-
-type routeRules map[string][]string
-
-// the ipset library currently does not support comments, so we use the name only (string)
-type ipsetCounter = refcounter.Counter[string, []netip.Prefix, struct{}]
-
-type router struct {
-	iptablesClient   *iptables.IPTables
-	rules            routeRules
-	ipsetCounter     *ipsetCounter
-	wgIface          iFaceMapper
-	legacyManagement bool
-	mtu              uint16
-	v6               bool
-
-	stateManager *statemanager.Manager
-	ipFwdState   *ipfwdstate.IPForwardingState
-}
-
-func newRouter(iptablesClient *iptables.IPTables, wgIface iFaceMapper, mtu uint16) (*router, error) {
-	r := &router{
-		iptablesClient: iptablesClient,
-		rules:          make(map[string][]string),
-		wgIface:        wgIface,
-		mtu:            mtu,
-		v6:             iptablesClient.Proto() == iptables.ProtocolIPv6,
-		ipFwdState:     ipfwdstate.NewIPForwardingState(),
-	}
-
-	r.ipsetCounter = refcounter.New(
-		func(name string, sources []netip.Prefix) (struct{}, error) {
-			return struct{}{}, r.createIpSet(name, sources)
-		},
-		func(name string, _ struct{}) error {
-			return r.deleteIpSet(name)
-		},
-	)
-
-	return r, nil
-}
-
-func (r *router) init(stateManager *statemanager.Manager) error {
-	r.stateManager = stateManager
-
-	if err := r.cleanUpDefaultForwardRules(); err != nil {
-		log.Errorf("failed to clean up rules from FORWARD chain: %s", err)
-	}
-
-	if err := r.createContainers(); err != nil {
-		return fmt.Errorf("create containers: %w", err)
-	}
-
-	if err := r.setupDataPlaneMark(); err != nil {
-		log.Errorf("failed to set up data plane mark: %v", err)
-	}
-
-	r.updateState()
-
-	return nil
-}
-
-func (r *router) AddRouteFiltering(
-	id []byte,
-	sources []netip.Prefix,
-	destination firewall.Network,
-	proto firewall.Protocol,
-	sPort *firewall.Port,
-	dPort *firewall.Port,
-	action firewall.Action,
-) (firewall.Rule, error) {
-	ruleKey := nbid.GenerateRouteRuleKey(sources, destination, proto, sPort, dPort, action)
-	if _, ok := r.rules[string(ruleKey)]; ok {
-		return ruleKey, nil
-	}
-
-	var source firewall.Network
-	if len(sources) > 1 {
-		source.Set = firewall.NewPrefixSet(sources)
-	} else if len(sources) > 0 {
-		source.Prefix = sources[0]
-	}
-
-	params := routeFilteringRuleParams{
-		Source:      source,
-		Destination: destination,
-		Proto:       proto,
-		SPort:       sPort,
-		DPort:       dPort,
-		Action:      action,
-	}
-
-	rule, err := r.genRouteRuleSpec(params, sources)
-	if err != nil {
-		return nil, fmt.Errorf("generate route rule spec: %w", err)
-	}
-
-	// Insert DROP rules at the beginning, append ACCEPT rules at the end
-	if action == firewall.ActionDrop {
-		// after the established rule
-		err = r.iptablesClient.Insert(tableFilter, chainRTFWDIN, 2, rule...)
-	} else {
-		err = r.iptablesClient.Append(tableFilter, chainRTFWDIN, rule...)
-	}
-
-	if err != nil {
-		return nil, fmt.Errorf("add route rule: %v", err)
-	}
-
-	r.rules[string(ruleKey)] = rule
-
-	r.updateState()
-
-	return ruleKey, nil
-}
-
-func (r *router) hasRule(id string) bool {
-	_, ok := r.rules[id]
-	return ok
-}
-
-func (r *router) DeleteRouteRule(rule firewall.Rule) error {
-	ruleKey := rule.ID()
-
-	if rule, exists := r.rules[ruleKey]; exists {
-		if err := r.iptablesClient.Delete(tableFilter, chainRTFWDIN, rule...); err != nil {
-			return fmt.Errorf("delete route rule: %v", err)
-		}
-		delete(r.rules, ruleKey)
-
-		if err := r.decrementSetCounter(rule); err != nil {
-			return fmt.Errorf("decrement ipset counter: %w", err)
-		}
-	} else {
-		log.Debugf("route rule %s not found", ruleKey)
-	}
-
-	r.updateState()
-
-	return nil
-}
-
-func (r *router) decrementSetCounter(rule []string) error {
-	sets := r.findSets(rule)
-	var merr *multierror.Error
-	for _, setName := range sets {
-		if _, err := r.ipsetCounter.Decrement(setName); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("decrement counter: %w", err))
-		}
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) findSets(rule []string) []string {
-	var sets []string
-	for i, arg := range rule {
-		if arg == "-m" && i+3 < len(rule) && rule[i+1] == "set" && rule[i+2] == matchSet {
-			sets = append(sets, rule[i+3])
-		}
-	}
-	return sets
-}
-
-func (r *router) createIpSet(setName string, sources []netip.Prefix) error {
-	if err := r.createIPSet(setName); err != nil {
-		return fmt.Errorf("create set %s: %w", setName, err)
-	}
-
-	for _, prefix := range sources {
-		if err := r.addPrefixToIPSet(setName, prefix); err != nil {
-			return fmt.Errorf("add element to set %s: %w", setName, err)
-		}
-	}
-
-	return nil
-}
-
-func (r *router) deleteIpSet(setName string) error {
-	if err := r.destroyIPSet(setName); err != nil {
-		return fmt.Errorf("destroy set %s: %w", setName, err)
-	}
-
-	log.Debugf("Deleted unused ipset %s", setName)
-	return nil
-}
-
-// AddNatRule inserts an iptables rule pair into the nat chain
-func (r *router) AddNatRule(pair firewall.RouterPair) error {
-	if r.legacyManagement {
-		log.Warnf("This peer is connected to a NetBird Management service with an older version. Allowing all traffic for %s", pair.Destination)
-		if err := r.addLegacyRouteRule(pair); err != nil {
-			return fmt.Errorf("add legacy routing rule: %w", err)
-		}
-	}
-
-	if !pair.Masquerade {
-		return nil
-	}
-
-	if err := r.addNatRule(pair); err != nil {
-		return fmt.Errorf("add nat rule: %w", err)
-	}
-
-	if err := r.addNatRule(firewall.GetInversePair(pair)); err != nil {
-		return fmt.Errorf("add inverse nat rule: %w", err)
-	}
-
-	r.updateState()
-
-	return nil
-}
-
-// RemoveNatRule removes an iptables rule pair from forwarding and nat chains
-func (r *router) RemoveNatRule(pair firewall.RouterPair) error {
-	if pair.Masquerade {
-		if err := r.removeNatRule(pair); err != nil {
-			return fmt.Errorf("remove nat rule: %w", err)
-		}
-
-		if err := r.removeNatRule(firewall.GetInversePair(pair)); err != nil {
-			return fmt.Errorf("remove inverse nat rule: %w", err)
-		}
-	}
-
-	if err := r.removeLegacyRouteRule(pair); err != nil {
-		return fmt.Errorf("remove legacy routing rule: %w", err)
-	}
-
-	r.updateState()
-
-	return nil
-}
-
-// addLegacyRouteRule adds a legacy routing rule for mgmt servers pre route acls
-func (r *router) addLegacyRouteRule(pair firewall.RouterPair) error {
-	ruleKey := firewall.GenKey(firewall.ForwardingFormat, pair)
-
-	if err := r.removeLegacyRouteRule(pair); err != nil {
-		return err
-	}
-
-	rule := []string{"-s", pair.Source.String(), "-d", pair.Destination.String(), "-j", routingFinalForwardJump}
-	if err := r.iptablesClient.Append(tableFilter, chainRTFWDIN, rule...); err != nil {
-		return fmt.Errorf("add legacy forwarding rule %s -> %s: %v", pair.Source, pair.Destination, err)
-	}
-
-	r.rules[ruleKey] = rule
-
-	return nil
-}
-
-func (r *router) removeLegacyRouteRule(pair firewall.RouterPair) error {
-	ruleKey := firewall.GenKey(firewall.ForwardingFormat, pair)
-
-	if rule, exists := r.rules[ruleKey]; exists {
-		if err := r.iptablesClient.DeleteIfExists(tableFilter, chainRTFWDIN, rule...); err != nil {
-			return fmt.Errorf("remove legacy forwarding rule %s -> %s: %v", pair.Source, pair.Destination, err)
-		}
-		delete(r.rules, ruleKey)
-
-		if err := r.decrementSetCounter(rule); err != nil {
-			return fmt.Errorf("decrement ipset counter: %w", err)
-		}
-	}
-
-	return nil
-}
-
-// GetLegacyManagement returns the current legacy management mode
-func (r *router) GetLegacyManagement() bool {
-	return r.legacyManagement
-}
-
-// SetLegacyManagement sets the route manager to use legacy management mode
-func (r *router) SetLegacyManagement(isLegacy bool) {
-	r.legacyManagement = isLegacy
-}
-
-// RemoveAllLegacyRouteRules removes all legacy routing rules for mgmt servers pre route acls
-func (r *router) RemoveAllLegacyRouteRules() error {
-	var merr *multierror.Error
-	for k, rule := range r.rules {
-		if !strings.HasPrefix(k, firewall.ForwardingFormatPrefix) {
-			continue
-		}
-		if err := r.iptablesClient.DeleteIfExists(tableFilter, chainRTFWDIN, rule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove legacy forwarding rule: %v", err))
-		} else {
-			delete(r.rules, k)
-		}
-	}
-
-	r.updateState()
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) Reset() error {
-	var merr *multierror.Error
-	if err := r.cleanUpDefaultForwardRules(); err != nil {
-		merr = multierror.Append(merr, err)
-	}
-
-	if err := r.ipsetCounter.Flush(); err != nil {
-		merr = multierror.Append(merr, err)
-	}
-
-	if err := r.cleanupDataPlaneMark(); err != nil {
-		merr = multierror.Append(merr, err)
-	}
-
-	r.rules = make(map[string][]string)
-	r.updateState()
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) cleanUpDefaultForwardRules() error {
-	if err := r.cleanJumpRules(); err != nil {
-		return fmt.Errorf("clean jump rules: %w", err)
-	}
-
-	log.Debug("flushing routing related tables")
-
-	// Remove jump rules from built-in chains before deleting custom chains,
-	// otherwise the chain deletion fails with "device or resource busy".
-	if ok, err := r.iptablesClient.ChainExists(tableNat, chainNATOutput); err != nil {
-		return fmt.Errorf("check chain %s: %w", chainNATOutput, err)
-	} else if ok {
-		jumpRule := []string{"-j", chainNATOutput}
-		if err := r.iptablesClient.Delete(tableNat, "OUTPUT", jumpRule...); err != nil {
-			log.Debugf("clean OUTPUT jump rule: %v", err)
-		}
-	}
-
-	for _, chainInfo := range []struct {
-		chain string
-		table string
-	}{
-		{chainRTFWDIN, tableFilter},
-		{chainRTFWDOUT, tableFilter},
-		{chainRTPRE, tableMangle},
-		{chainRTNAT, tableNat},
-		{chainRTRDR, tableNat},
-		{chainNATOutput, tableNat},
-		{chainRTMSSCLAMP, tableMangle},
-	} {
-		ok, err := r.iptablesClient.ChainExists(chainInfo.table, chainInfo.chain)
-		if err != nil {
-			return fmt.Errorf("check chain %s in table %s: %w", chainInfo.chain, chainInfo.table, err)
-		} else if ok {
-			if err = r.iptablesClient.ClearAndDeleteChain(chainInfo.table, chainInfo.chain); err != nil {
-				return fmt.Errorf("clear and delete chain %s in table %s: %w", chainInfo.chain, chainInfo.table, err)
-			}
-		}
-	}
-
-	return nil
-}
-
-func (r *router) createContainers() error {
-	for _, chainInfo := range []struct {
-		chain string
-		table string
-	}{
-		{chainRTFWDIN, tableFilter},
-		{chainRTFWDOUT, tableFilter},
-		{chainRTPRE, tableMangle},
-		{chainRTNAT, tableNat},
-		{chainRTRDR, tableNat},
-		{chainRTMSSCLAMP, tableMangle},
-	} {
-		// Fallback: clear chains that survived an unclean shutdown.
-		if ok, _ := r.iptablesClient.ChainExists(chainInfo.table, chainInfo.chain); ok {
-			if err := r.iptablesClient.ClearAndDeleteChain(chainInfo.table, chainInfo.chain); err != nil {
-				log.Warnf("clear stale chain %s in %s: %v", chainInfo.chain, chainInfo.table, err)
-			}
-		}
-		if err := r.iptablesClient.NewChain(chainInfo.table, chainInfo.chain); err != nil {
-			return fmt.Errorf("create chain %s in table %s: %w", chainInfo.chain, chainInfo.table, err)
-		}
-	}
-
-	if err := r.insertEstablishedRule(chainRTFWDIN); err != nil {
-		return fmt.Errorf("insert established rule: %w", err)
-	}
-
-	if err := r.insertEstablishedRule(chainRTFWDOUT); err != nil {
-		return fmt.Errorf("insert established rule: %w", err)
-	}
-
-	if err := r.addPostroutingRules(); err != nil {
-		return fmt.Errorf("add static nat rules: %w", err)
-	}
-
-	if err := r.addJumpRules(); err != nil {
-		return fmt.Errorf("add jump rules: %w", err)
-	}
-
-	if err := r.addMSSClampingRules(); err != nil {
-		log.Errorf("failed to add MSS clamping rules: %s", err)
-	}
-
-	return nil
-}
-
-// setupDataPlaneMark configures the fwmark for the data plane
-func (r *router) setupDataPlaneMark() error {
-	var merr *multierror.Error
-	preRule := []string{
-		"-i", r.wgIface.Name(),
-		"-m", "conntrack", "--ctstate", "NEW",
-		"-j", "CONNMARK", "--set-mark", fmt.Sprintf("%#x", nbnet.DataPlaneMarkIn),
-	}
-
-	if err := r.iptablesClient.AppendUnique(tableMangle, chainPREROUTING, preRule...); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("add mangle prerouting rule: %w", err))
-	} else {
-		r.rules[markManglePre] = preRule
-	}
-
-	postRule := []string{
-		"-o", r.wgIface.Name(),
-		"-m", "conntrack", "--ctstate", "NEW",
-		"-j", "CONNMARK", "--set-mark", fmt.Sprintf("%#x", nbnet.DataPlaneMarkOut),
-	}
-
-	if err := r.iptablesClient.AppendUnique(tableMangle, chainPOSTROUTING, postRule...); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("add mangle postrouting rule: %w", err))
-	} else {
-		r.rules[markManglePost] = postRule
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) cleanupDataPlaneMark() error {
-	var merr *multierror.Error
-	if preRule, exists := r.rules[markManglePre]; exists {
-		if err := r.iptablesClient.DeleteIfExists(tableMangle, chainPREROUTING, preRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove mangle prerouting rule: %w", err))
-		} else {
-			delete(r.rules, markManglePre)
-		}
-	}
-
-	if postRule, exists := r.rules[markManglePost]; exists {
-		if err := r.iptablesClient.DeleteIfExists(tableMangle, chainPOSTROUTING, postRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove mangle postrouting rule: %w", err))
-		} else {
-			delete(r.rules, markManglePost)
-		}
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) addPostroutingRules() error {
-	// First rule for outbound masquerade
-	rule1 := []string{
-		"-m", "mark", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkMasquerade),
-		"!", "-o", "lo",
-		"-j", routingFinalNatJump,
-	}
-	if err := r.iptablesClient.Append(tableNat, chainRTNAT, rule1...); err != nil {
-		return fmt.Errorf("add outbound masquerade rule: %v", err)
-	}
-	r.rules["static-nat-outbound"] = rule1
-
-	// Second rule for return traffic masquerade
-	rule2 := []string{
-		"-m", "mark", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkMasqueradeReturn),
-		"-o", r.wgIface.Name(),
-		"-j", routingFinalNatJump,
-	}
-	if err := r.iptablesClient.Append(tableNat, chainRTNAT, rule2...); err != nil {
-		return fmt.Errorf("add return masquerade rule: %v", err)
-	}
-	r.rules["static-nat-return"] = rule2
-
-	return nil
-}
-
-// addMSSClampingRules adds MSS clamping rules to prevent fragmentation for forwarded traffic.
-func (r *router) addMSSClampingRules() error {
-	overhead := uint16(ipv4TCPHeaderSize)
-	if r.v6 {
-		overhead = ipv6TCPHeaderSize
-	}
-	mss := r.mtu - overhead
-
-	// Add jump rule from FORWARD chain in mangle table to our custom chain
-	jumpRule := []string{
-		"-j", chainRTMSSCLAMP,
-	}
-	if err := r.iptablesClient.Insert(tableMangle, chainFORWARD, 1, jumpRule...); err != nil {
-		return fmt.Errorf("add jump to MSS clamp chain: %w", err)
-	}
-	r.rules[jumpMSSClamp] = jumpRule
-
-	ruleOut := []string{
-		"-o", r.wgIface.Name(),
-		"-p", "tcp",
-		"--tcp-flags", "SYN,RST", "SYN",
-		"-j", "TCPMSS",
-		"--set-mss", fmt.Sprintf("%d", mss),
-	}
-	if err := r.iptablesClient.Append(tableMangle, chainRTMSSCLAMP, ruleOut...); err != nil {
-		return fmt.Errorf("add outbound MSS clamp rule: %w", err)
-	}
-	r.rules["mss-clamp-out"] = ruleOut
-
-	return nil
-}
-
-func (r *router) insertEstablishedRule(chain string) error {
-	establishedRule := getConntrackEstablished()
-
-	err := r.iptablesClient.Insert(tableFilter, chain, 1, establishedRule...)
-	if err != nil {
-		return fmt.Errorf("failed to insert established rule: %v", err)
-	}
-
-	ruleKey := "established-" + chain
-	r.rules[ruleKey] = establishedRule
-
-	return nil
-}
-
-func (r *router) addJumpRules() error {
-	// Jump to nat chain
-	natRule := []string{"-j", chainRTNAT}
-	if err := r.iptablesClient.Insert(tableNat, chainPOSTROUTING, 1, natRule...); err != nil {
-		return fmt.Errorf("add nat postrouting jump rule: %v", err)
-	}
-	r.rules[jumpNatPost] = natRule
-
-	// Jump to mangle prerouting chain
-	preRule := []string{"-j", chainRTPRE}
-	if err := r.iptablesClient.Insert(tableMangle, chainPREROUTING, 1, preRule...); err != nil {
-		return fmt.Errorf("add mangle prerouting jump rule: %v", err)
-	}
-	r.rules[jumpManglePre] = preRule
-
-	// Jump to nat prerouting chain
-	rdrRule := []string{"-j", chainRTRDR}
-	if err := r.iptablesClient.Insert(tableNat, chainPREROUTING, 1, rdrRule...); err != nil {
-		return fmt.Errorf("add nat prerouting jump rule: %v", err)
-	}
-	r.rules[jumpNatPre] = rdrRule
-
-	return nil
-}
-
-func (r *router) cleanJumpRules() error {
-	for _, ruleKey := range []string{jumpNatPost, jumpManglePre, jumpNatPre, jumpMSSClamp} {
-		if rule, exists := r.rules[ruleKey]; exists {
-			var table, chain string
-			switch ruleKey {
-			case jumpNatPost:
-				table = tableNat
-				chain = chainPOSTROUTING
-			case jumpManglePre:
-				table = tableMangle
-				chain = chainPREROUTING
-			case jumpNatPre:
-				table = tableNat
-				chain = chainPREROUTING
-			case jumpMSSClamp:
-				table = tableMangle
-				chain = chainFORWARD
-			default:
-				return fmt.Errorf("unknown jump rule: %s", ruleKey)
-			}
-
-			if err := r.iptablesClient.DeleteIfExists(table, chain, rule...); err != nil {
-				return fmt.Errorf("delete rule from chain %s in table %s, err: %v", chain, table, err)
-			}
-			delete(r.rules, ruleKey)
-		}
-	}
-	return nil
-}
-
-func (r *router) addNatRule(pair firewall.RouterPair) error {
-	ruleKey := firewall.GenKey(firewall.NatFormat, pair)
-
-	if rule, exists := r.rules[ruleKey]; exists {
-		if err := r.iptablesClient.DeleteIfExists(tableMangle, chainRTPRE, rule...); err != nil {
-			return fmt.Errorf("error while removing existing marking rule for %s: %v", pair.Destination, err)
-		}
-		delete(r.rules, ruleKey)
-	}
-
-	markValue := nbnet.PreroutingFwmarkMasquerade
-	if pair.Inverse {
-		markValue = nbnet.PreroutingFwmarkMasqueradeReturn
-	}
-
-	rule := []string{"-i", r.wgIface.Name()}
-	if pair.Inverse {
-		rule = []string{"!", "-i", r.wgIface.Name()}
-	}
-
-	rule = append(rule,
-		"-m", "conntrack",
-		"--ctstate", "NEW",
-	)
-	sourceExp, err := r.applyNetwork("-s", pair.Source, nil)
-	if err != nil {
-		return fmt.Errorf("apply network -s: %w", err)
-	}
-	destExp, err := r.applyNetwork("-d", pair.Destination, nil)
-	if err != nil {
-		return fmt.Errorf("apply network -d: %w", err)
-	}
-
-	rule = append(rule, sourceExp...)
-	rule = append(rule, destExp...)
-	rule = append(rule,
-		"-j", "MARK", "--set-mark", fmt.Sprintf("%#x", markValue),
-	)
-
-	// Ensure nat rules come first, so the mark can be overwritten.
-	// Currently overwritten by the dst-type LOCAL rules for redirected traffic.
-	if err := r.iptablesClient.Insert(tableMangle, chainRTPRE, 1, rule...); err != nil {
-		// TODO: rollback ipset counter
-		return fmt.Errorf("error while adding marking rule for %s: %v", pair.Destination, err)
-	}
-
-	r.rules[ruleKey] = rule
-
-	r.updateState()
-	return nil
-}
-
-func (r *router) removeNatRule(pair firewall.RouterPair) error {
-	ruleKey := firewall.GenKey(firewall.NatFormat, pair)
-
-	if rule, exists := r.rules[ruleKey]; exists {
-		if err := r.iptablesClient.DeleteIfExists(tableMangle, chainRTPRE, rule...); err != nil {
-			return fmt.Errorf("error while removing marking rule for %s: %v", pair.Destination, err)
-		}
-		delete(r.rules, ruleKey)
-
-		if err := r.decrementSetCounter(rule); err != nil {
-			return fmt.Errorf("decrement ipset counter: %w", err)
-		}
-	} else {
-		log.Debugf("marking rule %s not found", ruleKey)
-	}
-
-	r.updateState()
-	return nil
-}
-
-func (r *router) updateState() {
-	if r.stateManager == nil {
-		return
-	}
-
-	var currentState *ShutdownState
-	if existing := r.stateManager.GetState(currentState); existing != nil {
-		if existingState, ok := existing.(*ShutdownState); ok {
-			currentState = existingState
-		}
-	}
-	if currentState == nil {
-		currentState = &ShutdownState{}
-	}
-
-	currentState.Lock()
-	defer currentState.Unlock()
-
-	// Clone the rule map so the persisted state holds a private snapshot. The
-	// live map keeps being mutated by subsequent rule operations while the
-	// state manager marshals the state from its periodic-save goroutine.
-	// Sharing it by reference races the two and aborts the process with a
-	// concurrent map iteration and write. The ipset counter guards itself
-	// during marshaling, so it can be shared directly.
-	if r.v6 {
-		currentState.RouteRules6 = maps.Clone(r.rules)
-		currentState.RouteIPsetCounter6 = r.ipsetCounter
-	} else {
-		currentState.RouteRules = maps.Clone(r.rules)
-		currentState.RouteIPsetCounter = r.ipsetCounter
-	}
-
-	if err := r.stateManager.UpdateState(currentState); err != nil {
-		log.Errorf("failed to update state: %v", err)
-	}
-}
-
-func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	if err := r.ipFwdState.RequestForwarding(); err != nil {
-		return nil, err
-	}
-
-	ruleKey := rule.ID()
-	if _, exists := r.rules[ruleKey+dnatSuffix]; exists {
-		return rule, nil
-	}
-
-	toDestination := rule.TranslatedAddress.String()
-	switch {
-	case len(rule.TranslatedPort.Values) == 0:
-		// no translated port, use original port
-	case len(rule.TranslatedPort.Values) == 1:
-		toDestination += fmt.Sprintf(":%d", rule.TranslatedPort.Values[0])
-	case rule.TranslatedPort.IsRange && len(rule.TranslatedPort.Values) == 2:
-		// need the "/originalport" suffix to avoid dnat port randomization
-		toDestination += fmt.Sprintf(":%d-%d/%d", rule.TranslatedPort.Values[0], rule.TranslatedPort.Values[1], rule.DestinationPort.Values[0])
-	default:
-		return nil, fmt.Errorf("invalid translated port: %v", rule.TranslatedPort)
-	}
-
-	proto := strings.ToLower(string(rule.Protocol))
-
-	rules := make(map[string]ruleInfo, 3)
-
-	// DNAT rule
-	dnatRule := []string{
-		"!", "-i", r.wgIface.Name(),
-		"-p", proto,
-		"-j", "DNAT",
-		"--to-destination", toDestination,
-	}
-	dnatRule = append(dnatRule, applyPort("--dport", &rule.DestinationPort)...)
-	rules[ruleKey+dnatSuffix] = ruleInfo{
-		table: tableNat,
-		chain: chainRTRDR,
-		rule:  dnatRule,
-	}
-
-	// SNAT rule
-	snatRule := []string{
-		"-o", r.wgIface.Name(),
-		"-p", proto,
-		"-d", rule.TranslatedAddress.String(),
-		"-j", "MASQUERADE",
-	}
-	snatRule = append(snatRule, applyPort("--dport", &rule.TranslatedPort)...)
-	rules[ruleKey+snatSuffix] = ruleInfo{
-		table: tableNat,
-		chain: chainRTNAT,
-		rule:  snatRule,
-	}
-
-	// Forward filtering rule, if fwd policy is DROP
-	forwardRule := []string{
-		"-o", r.wgIface.Name(),
-		"-p", proto,
-		"-d", rule.TranslatedAddress.String(),
-		"-j", "ACCEPT",
-	}
-	forwardRule = append(forwardRule, applyPort("--dport", &rule.TranslatedPort)...)
-	rules[ruleKey+fwdSuffix] = ruleInfo{
-		table: tableFilter,
-		chain: chainRTFWDOUT,
-		rule:  forwardRule,
-	}
-
-	for key, ruleInfo := range rules {
-		if err := r.iptablesClient.Append(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
-			if rollbackErr := r.rollbackRules(rules); rollbackErr != nil {
-				log.Errorf("rollback failed: %v", rollbackErr)
-			}
-			return nil, fmt.Errorf("add rule %s: %w", key, err)
-		}
-		r.rules[key] = ruleInfo.rule
-	}
-
-	r.updateState()
-	return rule, nil
-}
-
-func (r *router) rollbackRules(rules map[string]ruleInfo) error {
-	var merr *multierror.Error
-	for key, ruleInfo := range rules {
-		if err := r.iptablesClient.DeleteIfExists(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("rollback rule %s: %w", key, err))
-			// On rollback error, add to rules map for next cleanup
-			r.rules[key] = ruleInfo.rule
-		}
-	}
-	if merr != nil {
-		r.updateState()
-	}
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) DeleteDNATRule(rule firewall.Rule) error {
-	if err := r.ipFwdState.ReleaseForwarding(); err != nil {
-		log.Errorf("%v", err)
-	}
-
-	ruleKey := rule.ID()
-
-	var merr *multierror.Error
-	if dnatRule, exists := r.rules[ruleKey+dnatSuffix]; exists {
-		if err := r.iptablesClient.Delete(tableNat, chainRTRDR, dnatRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete DNAT rule: %w", err))
-		}
-		delete(r.rules, ruleKey+dnatSuffix)
-	}
-
-	if snatRule, exists := r.rules[ruleKey+snatSuffix]; exists {
-		if err := r.iptablesClient.Delete(tableNat, chainRTNAT, snatRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete SNAT rule: %w", err))
-		}
-		delete(r.rules, ruleKey+snatSuffix)
-	}
-
-	if fwdRule, exists := r.rules[ruleKey+fwdSuffix]; exists {
-		if err := r.iptablesClient.Delete(tableFilter, chainRTFWDOUT, fwdRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete forward rule: %w", err))
-		}
-		delete(r.rules, ruleKey+fwdSuffix)
-	}
-
-	r.updateState()
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) genRouteRuleSpec(params routeFilteringRuleParams, sources []netip.Prefix) ([]string, error) {
-	var rule []string
-
-	sourceExp, err := r.applyNetwork("-s", params.Source, sources)
-	if err != nil {
-		return nil, fmt.Errorf("apply network -s: %w", err)
-
-	}
-	destExp, err := r.applyNetwork("-d", params.Destination, nil)
-	if err != nil {
-		return nil, fmt.Errorf("apply network -d: %w", err)
-	}
-
-	rule = append(rule, sourceExp...)
-	rule = append(rule, destExp...)
-
-	if params.Proto != firewall.ProtocolALL {
-		rule = append(rule, "-p", strings.ToLower(protoForFamily(params.Proto, r.v6)))
-		rule = append(rule, applyPort("--sport", params.SPort)...)
-		rule = append(rule, applyPort("--dport", params.DPort)...)
-	}
-
-	rule = append(rule, "-j", actionToStr(params.Action))
-
-	return rule, nil
-}
-
-func (r *router) applyNetwork(flag string, network firewall.Network, prefixes []netip.Prefix) ([]string, error) {
-	direction := "src"
-	if flag == "-d" {
-		direction = "dst"
-	}
-
-	if network.IsSet() {
-		name := r.ipsetName(network.Set.HashedName())
-		if _, err := r.ipsetCounter.Increment(name, prefixes); err != nil {
-			return nil, fmt.Errorf("create or get ipset: %w", err)
-		}
-
-		return []string{"-m", "set", matchSet, name, direction}, nil
-	}
-	if network.IsPrefix() {
-		return []string{flag, network.Prefix.String()}, nil
-	}
-
-	// nolint:nilnil
-	return nil, nil
-}
-
-func (r *router) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
-	name := r.ipsetName(set.HashedName())
-	var merr *multierror.Error
-	for _, prefix := range prefixes {
-		if err := r.addPrefixToIPSet(name, prefix); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("add prefix to ipset: %w", err))
-		}
-	}
-	if merr == nil {
-		log.Debugf("updated set %s with prefixes %v", name, prefixes)
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-// AddInboundDNAT adds an inbound DNAT rule redirecting traffic from NetBird peers to local services.
-func (r *router) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
-	ruleID := fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort)
-
-	if _, exists := r.rules[ruleID]; exists {
-		return nil
-	}
-
-	dnatRule := []string{
-		"-i", r.wgIface.Name(),
-		"-p", strings.ToLower(protoForFamily(protocol, r.v6)),
-		"--dport", strconv.Itoa(int(originalPort)),
-		"-d", localAddr.String(),
-		"-m", "addrtype", "--dst-type", "LOCAL",
-		"-j", "DNAT",
-		"--to-destination", ":" + strconv.Itoa(int(translatedPort)),
-	}
-
-	ruleInfo := ruleInfo{
-		table: tableNat,
-		chain: chainRTRDR,
-		rule:  dnatRule,
-	}
-
-	if err := r.iptablesClient.Append(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
-		return fmt.Errorf("add inbound DNAT rule: %w", err)
-	}
-	r.rules[ruleID] = ruleInfo.rule
-
-	r.updateState()
-	return nil
-}
-
-// RemoveInboundDNAT removes an inbound DNAT rule.
-func (r *router) RemoveInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
-	ruleID := fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort)
-
-	if dnatRule, exists := r.rules[ruleID]; exists {
-		if err := r.iptablesClient.Delete(tableNat, chainRTRDR, dnatRule...); err != nil {
-			return fmt.Errorf("delete inbound DNAT rule: %w", err)
-		}
-		delete(r.rules, ruleID)
-	}
-
-	r.updateState()
-	return nil
-}
-
-// ensureNATOutputChain lazily creates the OUTPUT NAT chain and jump rule on first use.
-func (r *router) ensureNATOutputChain() error {
-	if _, exists := r.rules[jumpNatOutput]; exists {
-		return nil
-	}
-
-	chainExists, err := r.iptablesClient.ChainExists(tableNat, chainNATOutput)
-	if err != nil {
-		return fmt.Errorf("check chain %s: %w", chainNATOutput, err)
-	}
-	if !chainExists {
-		if err := r.iptablesClient.NewChain(tableNat, chainNATOutput); err != nil {
-			return fmt.Errorf("create chain %s: %w", chainNATOutput, err)
-		}
-	}
-
-	jumpRule := []string{"-j", chainNATOutput}
-	if err := r.iptablesClient.Insert(tableNat, "OUTPUT", 1, jumpRule...); err != nil {
-		if !chainExists {
-			if delErr := r.iptablesClient.ClearAndDeleteChain(tableNat, chainNATOutput); delErr != nil {
-				log.Warnf("failed to rollback chain %s: %v", chainNATOutput, delErr)
-			}
-		}
-		return fmt.Errorf("add OUTPUT jump rule: %w", err)
-	}
-	r.rules[jumpNatOutput] = jumpRule
-
-	r.updateState()
-	return nil
-}
-
-// AddOutputDNAT adds an OUTPUT chain DNAT rule for locally-generated traffic.
-func (r *router) AddOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
-	ruleID := fmt.Sprintf("output-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort)
-
-	if _, exists := r.rules[ruleID]; exists {
-		return nil
-	}
-
-	if err := r.ensureNATOutputChain(); err != nil {
-		return err
-	}
-
-	dnatRule := []string{
-		"-p", strings.ToLower(protoForFamily(protocol, localAddr.Is6())),
-		"--dport", strconv.Itoa(int(originalPort)),
-		"-d", localAddr.String(),
-		"-j", "DNAT",
-		"--to-destination", ":" + strconv.Itoa(int(translatedPort)),
-	}
-
-	if err := r.iptablesClient.Append(tableNat, chainNATOutput, dnatRule...); err != nil {
-		return fmt.Errorf("add output DNAT rule: %w", err)
-	}
-	r.rules[ruleID] = dnatRule
-
-	r.updateState()
-	return nil
-}
-
-// RemoveOutputDNAT removes an OUTPUT chain DNAT rule.
-func (r *router) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
-	ruleID := fmt.Sprintf("output-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort)
-
-	if dnatRule, exists := r.rules[ruleID]; exists {
-		if err := r.iptablesClient.Delete(tableNat, chainNATOutput, dnatRule...); err != nil {
-			return fmt.Errorf("delete output DNAT rule: %w", err)
-		}
-		delete(r.rules, ruleID)
-	}
-
-	r.updateState()
-	return nil
-}
-
-func applyPort(flag string, port *firewall.Port) []string {
-	if port == nil {
-		return nil
-	}
-
-	if port.IsRange && len(port.Values) == 2 {
-		return []string{flag, fmt.Sprintf("%d:%d", port.Values[0], port.Values[1])}
-	}
-
-	if len(port.Values) > 1 {
-		portList := make([]string, len(port.Values))
-		for i, p := range port.Values {
-			portList[i] = strconv.Itoa(int(p))
-		}
-		return []string{"-m", "multiport", flag, strings.Join(portList, ",")}
-	}
-
-	return []string{flag, strconv.Itoa(int(port.Values[0]))}
-}
-
-// ipsetName returns the ipset name, suffixed with "-v6" for the v6 router
-// to avoid collisions since ipsets are global in the kernel.
-func (r *router) ipsetName(name string) string {
-	if r.v6 {
-		return name + "-v6"
-	}
-	return name
-}
-
-func (r *router) createIPSet(name string) error {
-	opts := ipset.CreateOptions{
-		Replace: true,
-	}
-	if r.v6 {
-		opts.Family = ipset.FamilyIPV6
-	}
-
-	if err := ipset.Create(name, ipset.TypeHashNet, opts); err != nil {
-		return fmt.Errorf("create ipset %s: %w", name, err)
-	}
-
-	log.Debugf("created ipset %s with type hash:net", name)
-	return nil
-}
-
-func (r *router) addPrefixToIPSet(name string, prefix netip.Prefix) error {
-	addr := prefix.Addr()
-	ip := addr.AsSlice()
-
-	entry := &ipset.Entry{
-		IP:      ip,
-		CIDR:    uint8(prefix.Bits()),
-		Replace: true,
-	}
-
-	if err := ipset.Add(name, entry); err != nil {
-		return fmt.Errorf("add prefix to ipset %s: %w", name, err)
-	}
-
-	return nil
-}
-
-func (r *router) destroyIPSet(name string) error {
-	return ipset.Destroy(name)
-}
diff --git a/client/firewall/iptables/router_linux_test.go b/client/firewall/iptables/router_linux_test.go
index 9ca6b9f7e..6c4ae9425 100644
--- a/client/firewall/iptables/router_linux_test.go
+++ b/client/firewall/iptables/router_linux_test.go
@@ -31,7 +31,7 @@ func TestIptablesManager_RestoreOrCreateContainers(t *testing.T) {
 	iptablesClient, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
 	require.NoError(t, err, "failed to init iptables client")
 
-	manager, err := newRouter(iptablesClient, ifaceMock, iface.DefaultMTU)
+	manager, err := newFamily(iptablesClient, ifaceMock, iface.DefaultMTU)
 	require.NoError(t, err, "should return a valid iptables manager")
 	require.NoError(t, manager.init(nil))
 
@@ -52,12 +52,12 @@ func TestIptablesManager_RestoreOrCreateContainers(t *testing.T) {
 	// 11. MSS clamping rule for outbound traffic
 	require.Len(t, manager.rules, 11, "should have created rules map")
 
-	exists, err := manager.iptablesClient.Exists(tableNat, chainPOSTROUTING, "-j", chainRTNAT)
-	require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableNat, chainPOSTROUTING)
+	exists, err := manager.iptablesClient.Exists(tableNat, chainPostrouting, "-j", chainRTNAT)
+	require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableNat, chainPostrouting)
 	require.True(t, exists, "postrouting jump rule should exist")
 
-	exists, err = manager.iptablesClient.Exists(tableMangle, chainPREROUTING, "-j", chainRTPRE)
-	require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableMangle, chainPREROUTING)
+	exists, err = manager.iptablesClient.Exists(tableMangle, chainPrerouting, "-j", chainRTPre)
+	require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableMangle, chainPrerouting)
 	require.True(t, exists, "prerouting jump rule should exist")
 
 	pair := firewall.RouterPair{
@@ -84,7 +84,7 @@ func TestIptablesManager_AddNatRule(t *testing.T) {
 			iptablesClient, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
 			require.NoError(t, err, "failed to init iptables client")
 
-			manager, err := newRouter(iptablesClient, ifaceMock, iface.DefaultMTU)
+			manager, err := newFamily(iptablesClient, ifaceMock, iface.DefaultMTU)
 			require.NoError(t, err, "shouldn't return error")
 			require.NoError(t, manager.init(nil))
 
@@ -95,7 +95,7 @@ func TestIptablesManager_AddNatRule(t *testing.T) {
 			err = manager.AddNatRule(testCase.InputPair)
 			require.NoError(t, err, "marking rule should be inserted")
 
-			natRuleKey := firewall.GenKey(firewall.NatFormat, testCase.InputPair)
+			natRuleKey := testCase.InputPair.GenKey(firewall.NatFormat)
 			markingRule := []string{
 				"-i", ifaceMock.Name(),
 				"-m", "conntrack",
@@ -106,8 +106,8 @@ func TestIptablesManager_AddNatRule(t *testing.T) {
 				fmt.Sprintf("%#x", nbnet.PreroutingFwmarkMasquerade),
 			}
 
-			exists, err := iptablesClient.Exists(tableMangle, chainRTPRE, markingRule...)
-			require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableMangle, chainRTPRE)
+			exists, err := iptablesClient.Exists(tableMangle, chainRTPre, markingRule...)
+			require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableMangle, chainRTPre)
 			if testCase.InputPair.Masquerade {
 				require.True(t, exists, "marking rule should be created")
 				foundRule, found := manager.rules[natRuleKey]
@@ -121,7 +121,7 @@ func TestIptablesManager_AddNatRule(t *testing.T) {
 
 			// Check inverse rule
 			inversePair := firewall.GetInversePair(testCase.InputPair)
-			inverseRuleKey := firewall.GenKey(firewall.NatFormat, inversePair)
+			inverseRuleKey := inversePair.GenKey(firewall.NatFormat)
 			inverseMarkingRule := []string{
 				"!", "-i", ifaceMock.Name(),
 				"-m", "conntrack",
@@ -132,8 +132,8 @@ func TestIptablesManager_AddNatRule(t *testing.T) {
 				fmt.Sprintf("%#x", nbnet.PreroutingFwmarkMasqueradeReturn),
 			}
 
-			exists, err = iptablesClient.Exists(tableMangle, chainRTPRE, inverseMarkingRule...)
-			require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableMangle, chainRTPRE)
+			exists, err = iptablesClient.Exists(tableMangle, chainRTPre, inverseMarkingRule...)
+			require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableMangle, chainRTPre)
 			if testCase.InputPair.Masquerade {
 				require.True(t, exists, "inverse marking rule should be created")
 				foundRule, found := manager.rules[inverseRuleKey]
@@ -157,7 +157,7 @@ func TestIptablesManager_RemoveNatRule(t *testing.T) {
 		t.Run(testCase.Name, func(t *testing.T) {
 			iptablesClient, _ := iptables.NewWithProtocol(iptables.ProtocolIPv4)
 
-			manager, err := newRouter(iptablesClient, ifaceMock, iface.DefaultMTU)
+			manager, err := newFamily(iptablesClient, ifaceMock, iface.DefaultMTU)
 			require.NoError(t, err, "shouldn't return error")
 			require.NoError(t, manager.init(nil))
 			defer func() {
@@ -170,7 +170,7 @@ func TestIptablesManager_RemoveNatRule(t *testing.T) {
 			err = manager.RemoveNatRule(testCase.InputPair)
 			require.NoError(t, err, "shouldn't return error")
 
-			natRuleKey := firewall.GenKey(firewall.NatFormat, testCase.InputPair)
+			natRuleKey := testCase.InputPair.GenKey(firewall.NatFormat)
 			markingRule := []string{
 				"-i", ifaceMock.Name(),
 				"-m", "conntrack",
@@ -181,8 +181,8 @@ func TestIptablesManager_RemoveNatRule(t *testing.T) {
 				fmt.Sprintf("%#x", nbnet.PreroutingFwmarkMasquerade),
 			}
 
-			exists, err := iptablesClient.Exists(tableMangle, chainRTPRE, markingRule...)
-			require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableMangle, chainRTPRE)
+			exists, err := iptablesClient.Exists(tableMangle, chainRTPre, markingRule...)
+			require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableMangle, chainRTPre)
 			require.False(t, exists, "marking rule should not exist")
 
 			_, found := manager.rules[natRuleKey]
@@ -190,7 +190,7 @@ func TestIptablesManager_RemoveNatRule(t *testing.T) {
 
 			// Check inverse rule removal
 			inversePair := firewall.GetInversePair(testCase.InputPair)
-			inverseRuleKey := firewall.GenKey(firewall.NatFormat, inversePair)
+			inverseRuleKey := inversePair.GenKey(firewall.NatFormat)
 			inverseMarkingRule := []string{
 				"!", "-i", ifaceMock.Name(),
 				"-m", "conntrack",
@@ -201,8 +201,8 @@ func TestIptablesManager_RemoveNatRule(t *testing.T) {
 				fmt.Sprintf("%#x", nbnet.PreroutingFwmarkMasqueradeReturn),
 			}
 
-			exists, err = iptablesClient.Exists(tableMangle, chainRTPRE, inverseMarkingRule...)
-			require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableMangle, chainRTPRE)
+			exists, err = iptablesClient.Exists(tableMangle, chainRTPre, inverseMarkingRule...)
+			require.NoError(t, err, "should be able to query the iptables %s table and %s chain", tableMangle, chainRTPre)
 			require.False(t, exists, "inverse marking rule should not exist")
 
 			_, found = manager.rules[inverseRuleKey]
@@ -219,13 +219,13 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 	iptablesClient, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
 	require.NoError(t, err, "Failed to create iptables client")
 
-	r, err := newRouter(iptablesClient, ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err, "Failed to create router manager")
+	r, err := newFamily(iptablesClient, ifaceMock, iface.DefaultMTU)
+	require.NoError(t, err, "Failed to create family manager")
 	require.NoError(t, r.init(nil))
 
 	defer func() {
 		err := r.Reset()
-		require.NoError(t, err, "Failed to reset router")
+		require.NoError(t, err, "Failed to reset family")
 	}()
 
 	tests := []struct {
@@ -334,62 +334,30 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			ruleKey, err := r.AddRouteFiltering(nil, tt.sources, firewall.Network{Prefix: tt.destination}, tt.proto, tt.sPort, tt.dPort, tt.action)
-			require.NoError(t, err, "AddRouteFiltering failed")
+			ruleKey, err := r.AddFilterRule(nil, tt.sources, firewall.Network{Prefix: tt.destination}, tt.proto, tt.sPort, tt.dPort, tt.action)
+			require.NoError(t, err, "AddFilterRule failed")
 
-			// Check if the rule is in the internal map
-			rule, ok := r.rules[ruleKey.ID()]
-			assert.True(t, ok, "Rule not found in internal map")
+			stored, ok := r.filters[ruleKey.ID()]
+			require.True(t, ok, "rule not stored in filters")
+			t.Logf("Internal rule: %v", stored.specs)
 
-			// Log the internal rule
-			t.Logf("Internal rule: %v", rule)
-
-			// Check if the rule exists in iptables
-			exists, err := iptablesClient.Exists(tableFilter, chainRTFWDIN, rule...)
+			exists, err := iptablesClient.Exists(tableFilter, chainRTFwdIn, stored.specs...)
 			assert.NoError(t, err, "Failed to check rule existence")
 			assert.True(t, exists, "Rule not found in iptables")
 
-			var source firewall.Network
-			if len(tt.sources) > 1 {
-				source.Set = firewall.NewPrefixSet(tt.sources)
-			} else if len(tt.sources) > 0 {
-				source.Prefix = tt.sources[0]
-			}
-			// Verify rule content
-			params := routeFilteringRuleParams{
-				Source:      source,
-				Destination: firewall.Network{Prefix: tt.destination},
-				Proto:       tt.proto,
-				SPort:       tt.sPort,
-				DPort:       tt.dPort,
-				Action:      tt.action,
-			}
-
-			expectedRule, err := r.genRouteRuleSpec(params, nil)
-			require.NoError(t, err, "Failed to generate expected rule spec")
-
 			if tt.expectSet {
 				setName := firewall.NewPrefixSet(tt.sources).HashedName()
-				expectedRule, err = r.genRouteRuleSpec(params, nil)
-				require.NoError(t, err, "Failed to generate expected rule spec with set")
-
-				// Check if the set was created
 				_, exists := r.ipsetCounter.Get(setName)
 				assert.True(t, exists, "IPSet not created")
+				assert.NotEmpty(t, findSets(stored.specs), "Rule should reference an ipset")
 			}
 
-			assert.Equal(t, expectedRule, rule, "Rule content mismatch")
-
-			// Clean up
-			err = r.DeleteRouteRule(ruleKey)
-			require.NoError(t, err, "Failed to delete rule")
+			require.NoError(t, r.DeleteFilterRule(ruleKey), "Failed to delete rule")
 		})
 	}
 }
 
 func TestFindSetNameInRule(t *testing.T) {
-	r := &router{}
-
 	testCases := []struct {
 		name     string
 		rule     []string
@@ -430,7 +398,7 @@ func TestFindSetNameInRule(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			result := r.findSets(tc.rule)
+			result := findSets(tc.rule)
 
 			if len(result) != len(tc.expected) {
 				t.Errorf("Expected %d sets, got %d. Sets found: %v", len(tc.expected), len(result), result)
diff --git a/client/firewall/iptables/routing_linux.go b/client/firewall/iptables/routing_linux.go
new file mode 100644
index 000000000..c63be4e43
--- /dev/null
+++ b/client/firewall/iptables/routing_linux.go
@@ -0,0 +1,273 @@
+//go:build !android
+
+package iptables
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	nbnet "github.com/netbirdio/netbird/client/net"
+)
+
+func (r *family) AddNatRule(pair firewall.RouterPair) error {
+	if r.legacyManagement {
+		log.Warnf("This peer is connected to a NetBird Management service with an older version. Allowing all traffic for %s", pair.Destination)
+		if err := r.addLegacyRouteRule(pair); err != nil {
+			return fmt.Errorf("add legacy routing rule: %w", err)
+		}
+	}
+
+	if pair.Masquerade {
+		if err := r.addNatRule(pair); err != nil {
+			return fmt.Errorf("add nat rule: %w", err)
+		}
+
+		if err := r.addNatRule(firewall.GetInversePair(pair)); err != nil {
+			return fmt.Errorf("add inverse nat rule: %w", err)
+		}
+	}
+
+	r.updateState()
+
+	return nil
+}
+
+// RemoveNatRule removes an iptables rule pair from forwarding and nat chains
+func (r *family) RemoveNatRule(pair firewall.RouterPair) error {
+	if pair.Masquerade {
+		if err := r.removeNatRule(pair); err != nil {
+			return fmt.Errorf("remove nat rule: %w", err)
+		}
+
+		if err := r.removeNatRule(firewall.GetInversePair(pair)); err != nil {
+			return fmt.Errorf("remove inverse nat rule: %w", err)
+		}
+	}
+
+	if err := r.removeLegacyRouteRule(pair); err != nil {
+		return fmt.Errorf("remove legacy routing rule: %w", err)
+	}
+
+	r.updateState()
+
+	return nil
+}
+
+// addLegacyRouteRule adds a legacy routing rule for mgmt servers pre route acls
+func (r *family) addLegacyRouteRule(pair firewall.RouterPair) error {
+	ruleID := pair.GenKey(firewall.ForwardingFormat)
+
+	if err := r.removeLegacyRouteRule(pair); err != nil {
+		return err
+	}
+
+	rule := []string{"-s", pair.Source.String(), "-d", pair.Destination.String(), "-j", "ACCEPT"}
+	if err := r.iptablesClient.Append(tableFilter, chainRTFwdIn, rule...); err != nil {
+		return fmt.Errorf("add legacy forwarding rule %s -> %s: %w", pair.Source, pair.Destination, err)
+	}
+
+	r.rules[ruleID] = rule
+
+	return nil
+}
+
+func (r *family) removeLegacyRouteRule(pair firewall.RouterPair) error {
+	ruleID := pair.GenKey(firewall.ForwardingFormat)
+
+	if rule, exists := r.rules[ruleID]; exists {
+		if err := r.iptablesClient.DeleteIfExists(tableFilter, chainRTFwdIn, rule...); err != nil {
+			return fmt.Errorf("remove legacy forwarding rule %s -> %s: %w", pair.Source, pair.Destination, err)
+		}
+		delete(r.rules, ruleID)
+
+		if err := r.decrementSetCounter(rule); err != nil {
+			return fmt.Errorf("decrement ipset counter: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// GetLegacyManagement returns the current legacy management mode
+func (r *family) GetLegacyManagement() bool {
+	return r.legacyManagement
+}
+
+// SetLegacyManagement sets the route manager to use legacy management mode
+func (r *family) SetLegacyManagement(isLegacy bool) {
+	r.legacyManagement = isLegacy
+}
+
+// RemoveAllLegacyRouteRules removes all legacy routing rules for mgmt servers pre route acls
+func (r *family) RemoveAllLegacyRouteRules() error {
+	var merr *multierror.Error
+	for k, rule := range r.rules {
+		if !strings.HasPrefix(string(k), firewall.ForwardingFormatPrefix) {
+			continue
+		}
+		if err := r.iptablesClient.DeleteIfExists(tableFilter, chainRTFwdIn, rule...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove legacy forwarding rule: %w", err))
+		} else {
+			delete(r.rules, k)
+		}
+	}
+
+	r.updateState()
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) addPostroutingRules() error {
+	// First rule for outbound masquerade
+	rule1 := []string{
+		"-m", "mark", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkMasquerade),
+		"!", "-o", "lo",
+		"-j", "MASQUERADE",
+	}
+	if err := r.iptablesClient.Append(tableNat, chainRTNAT, rule1...); err != nil {
+		return fmt.Errorf("add outbound masquerade rule: %w", err)
+	}
+	r.rules["static-nat-outbound"] = rule1
+
+	// Second rule for return traffic masquerade
+	rule2 := []string{
+		"-m", "mark", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkMasqueradeReturn),
+		"-o", r.wgIface.Name(),
+		"-j", "MASQUERADE",
+	}
+	if err := r.iptablesClient.Append(tableNat, chainRTNAT, rule2...); err != nil {
+		return fmt.Errorf("add return masquerade rule: %w", err)
+	}
+	r.rules["static-nat-return"] = rule2
+
+	return nil
+}
+
+// addMSSClampingRules adds MSS clamping rules to prevent fragmentation for forwarded traffic.
+func (r *family) addMSSClampingRules() error {
+	overhead := uint16(ipv4TCPHeaderSize)
+	if r.v6 {
+		overhead = ipv6TCPHeaderSize
+	}
+	mss := r.mtu - overhead
+
+	// Add jump rule from FORWARD chain in mangle table to our custom chain
+	jumpRule := jumpRuleSpec(chainRTMSSClamp)
+	if err := r.iptablesClient.Insert(tableMangle, chainForward, 1, jumpRule...); err != nil {
+		return fmt.Errorf("add jump to MSS clamp chain: %w", err)
+	}
+	r.rules[jumpMSSClamp] = jumpRule
+
+	ruleOut := []string{
+		"-o", r.wgIface.Name(),
+		"-p", "tcp",
+		"--tcp-flags", "SYN,RST", "SYN",
+		"-j", "TCPMSS",
+		"--set-mss", fmt.Sprintf("%d", mss),
+	}
+	if err := r.iptablesClient.Append(tableMangle, chainRTMSSClamp, ruleOut...); err != nil {
+		return fmt.Errorf("add outbound MSS clamp rule: %w", err)
+	}
+	r.rules["mss-clamp-out"] = ruleOut
+
+	return nil
+}
+
+func (r *family) insertEstablishedRule(chain string) error {
+	establishedRule := getConntrackEstablished()
+
+	err := r.iptablesClient.Insert(tableFilter, chain, 1, establishedRule...)
+	if err != nil {
+		return fmt.Errorf("insert established rule: %w", err)
+	}
+
+	ruleID := firewall.RuleID("established-" + chain)
+	r.rules[ruleID] = establishedRule
+
+	return nil
+}
+
+func (r *family) addNatRule(pair firewall.RouterPair) (err error) {
+	ruleID := pair.GenKey(firewall.NatFormat)
+
+	if rule, exists := r.rules[ruleID]; exists {
+		if derr := r.iptablesClient.DeleteIfExists(tableMangle, chainRTPre, rule...); derr != nil {
+			return fmt.Errorf("remove existing marking rule for %s: %w", pair.Destination, derr)
+		}
+		delete(r.rules, ruleID)
+
+		// Drop the replaced spec's set references only once the new spec has
+		// taken its own, so a set both specs share is not destroyed and
+		// recreated, which would lose the prefixes UpdateSet put in it.
+		defer func() {
+			if derr := r.decrementSetCounter(rule); derr != nil && err == nil {
+				err = fmt.Errorf("decrement ipset counter: %w", derr)
+			}
+		}()
+	}
+
+	markValue := nbnet.PreroutingFwmarkMasquerade
+	if pair.Inverse {
+		markValue = nbnet.PreroutingFwmarkMasqueradeReturn
+	}
+
+	rule := []string{"-i", r.wgIface.Name()}
+	if pair.Inverse {
+		rule = []string{"!", "-i", r.wgIface.Name()}
+	}
+
+	rule = append(rule,
+		"-m", "conntrack",
+		"--ctstate", "NEW",
+	)
+	sourceExp, err := r.applyNetwork("-s", pair.Source, nil)
+	if err != nil {
+		return fmt.Errorf("apply network -s: %w", err)
+	}
+	destExp, err := r.applyNetwork("-d", pair.Destination, nil)
+	if err != nil {
+		r.dropSourceMatch(sourceExp)
+		return fmt.Errorf("apply network -d: %w", err)
+	}
+
+	rule = append(rule, sourceExp...)
+	rule = append(rule, destExp...)
+	rule = append(rule,
+		"-j", "MARK", "--set-mark", fmt.Sprintf("%#x", markValue),
+	)
+
+	// Ensure nat rules come first, so the mark can be overwritten.
+	// Currently overwritten by the dst-type LOCAL rules for redirected traffic.
+	if err := r.iptablesClient.Insert(tableMangle, chainRTPre, 1, rule...); err != nil {
+		r.dropSourceMatch(rule)
+		return fmt.Errorf("add marking rule for %s: %w", pair.Destination, err)
+	}
+
+	r.rules[ruleID] = rule
+
+	return nil
+}
+
+func (r *family) removeNatRule(pair firewall.RouterPair) error {
+	ruleID := pair.GenKey(firewall.NatFormat)
+
+	if rule, exists := r.rules[ruleID]; exists {
+		if err := r.iptablesClient.DeleteIfExists(tableMangle, chainRTPre, rule...); err != nil {
+			return fmt.Errorf("remove marking rule for %s: %w", pair.Destination, err)
+		}
+		delete(r.rules, ruleID)
+
+		if err := r.decrementSetCounter(rule); err != nil {
+			return fmt.Errorf("decrement ipset counter: %w", err)
+		}
+	} else {
+		log.Debugf("marking rule %s not found", ruleID)
+	}
+
+	return nil
+}
diff --git a/client/firewall/iptables/rule.go b/client/firewall/iptables/rule.go
index 4f4eab167..33bcbd1d2 100644
--- a/client/firewall/iptables/rule.go
+++ b/client/firewall/iptables/rule.go
@@ -1,18 +1,37 @@
 package iptables
 
-// Rule to handle management of rules
-type Rule struct {
-	ruleID    string
-	ipsetName string
+import "github.com/netbirdio/netbird/client/firewall/manager"
 
+// Rule to handle management of rules. Source set membership (when the
+// rule was built against a shared hash:net ipset) is encoded in specs;
+// DeleteFilterRule recovers it via findSets so the refcounter can drop
+// the right reference.
+type Rule struct {
+	id          manager.RuleID
 	specs       []string
 	mangleSpecs []string
-	ip          string
-	chain       string
-	v6          bool
+	// extraRules holds the rules beyond the first when the ipset
+	// fallback expands a multi-source rule into one rule per prefix.
+	extraRules []filterSpecs
+	chain      string
+	v6         bool
 }
 
-// GetRuleID returns the rule id
-func (r *Rule) ID() string {
-	return r.ruleID
+// filterSpecs is one installed iptables rule: its filter-table spec and
+// the paired mangle redirect-mark spec (nil for route rules or when the
+// mangle rule could not be added).
+type filterSpecs struct {
+	specs       []string
+	mangleSpecs []string
+}
+
+// allSpecs returns the spec pairs of every iptables rule backing this
+// Rule, the primary one first.
+func (r *Rule) allSpecs() []filterSpecs {
+	return append([]filterSpecs{{specs: r.specs, mangleSpecs: r.mangleSpecs}}, r.extraRules...)
+}
+
+// ID returns the rule id
+func (r *Rule) ID() manager.RuleID {
+	return r.id
 }
diff --git a/client/firewall/iptables/rulestore_linux.go b/client/firewall/iptables/rulestore_linux.go
deleted file mode 100644
index a6d36540e..000000000
--- a/client/firewall/iptables/rulestore_linux.go
+++ /dev/null
@@ -1,127 +0,0 @@
-package iptables
-
-import (
-	"encoding/json"
-	"maps"
-)
-
-type ipList struct {
-	ips map[string]struct{}
-}
-
-func newIpList(ip string) *ipList {
-	ips := make(map[string]struct{})
-	ips[ip] = struct{}{}
-
-	return &ipList{
-		ips: ips,
-	}
-}
-
-func (s *ipList) addIP(ip string) {
-	s.ips[ip] = struct{}{}
-}
-
-// clone returns a deep copy of the ipList with its own ips map.
-func (s *ipList) clone() *ipList {
-	if s == nil {
-		return nil
-	}
-	return &ipList{ips: maps.Clone(s.ips)}
-}
-
-// MarshalJSON implements json.Marshaler
-func (s *ipList) MarshalJSON() ([]byte, error) {
-	return json.Marshal(struct {
-		IPs map[string]struct{} `json:"ips"`
-	}{
-		IPs: s.ips,
-	})
-}
-
-// UnmarshalJSON implements json.Unmarshaler
-func (s *ipList) UnmarshalJSON(data []byte) error {
-	temp := struct {
-		IPs map[string]struct{} `json:"ips"`
-	}{}
-	if err := json.Unmarshal(data, &temp); err != nil {
-		return err
-	}
-	s.ips = temp.IPs
-
-	if temp.IPs == nil {
-		temp.IPs = make(map[string]struct{})
-	}
-
-	return nil
-}
-
-type ipsetStore struct {
-	ipsets map[string]*ipList
-}
-
-func newIpsetStore() *ipsetStore {
-	return &ipsetStore{
-		ipsets: make(map[string]*ipList),
-	}
-}
-
-// clone returns a deep copy of the ipsetStore with its own ipsets map and
-// independent ipList entries.
-func (s *ipsetStore) clone() *ipsetStore {
-	if s == nil {
-		return nil
-	}
-	cloned := &ipsetStore{ipsets: make(map[string]*ipList, len(s.ipsets))}
-	for name, list := range s.ipsets {
-		cloned.ipsets[name] = list.clone()
-	}
-	return cloned
-}
-
-func (s *ipsetStore) ipset(ipsetName string) (*ipList, bool) {
-	r, ok := s.ipsets[ipsetName]
-	return r, ok
-}
-
-func (s *ipsetStore) addIpList(ipsetName string, list *ipList) {
-	s.ipsets[ipsetName] = list
-}
-
-func (s *ipsetStore) deleteIpset(ipsetName string) {
-	delete(s.ipsets, ipsetName)
-}
-
-func (s *ipsetStore) ipsetNames() []string {
-	names := make([]string, 0, len(s.ipsets))
-	for name := range s.ipsets {
-		names = append(names, name)
-	}
-	return names
-}
-
-// MarshalJSON implements json.Marshaler
-func (s *ipsetStore) MarshalJSON() ([]byte, error) {
-	return json.Marshal(struct {
-		IPSets map[string]*ipList `json:"ipsets"`
-	}{
-		IPSets: s.ipsets,
-	})
-}
-
-// UnmarshalJSON implements json.Unmarshaler
-func (s *ipsetStore) UnmarshalJSON(data []byte) error {
-	temp := struct {
-		IPSets map[string]*ipList `json:"ipsets"`
-	}{}
-	if err := json.Unmarshal(data, &temp); err != nil {
-		return err
-	}
-	s.ipsets = temp.IPSets
-
-	if temp.IPSets == nil {
-		temp.IPSets = make(map[string]*ipList)
-	}
-
-	return nil
-}
diff --git a/client/firewall/iptables/state_linux.go b/client/firewall/iptables/state_linux.go
index f4be37d01..00bf1cebd 100644
--- a/client/firewall/iptables/state_linux.go
+++ b/client/firewall/iptables/state_linux.go
@@ -29,17 +29,13 @@ type ShutdownState struct {
 
 	InterfaceState *InterfaceState `json:"interface_state,omitempty"`
 
-	RouteRules        routeRules    `json:"route_rules,omitempty"`
-	RouteIPsetCounter *ipsetCounter `json:"route_ipset_counter,omitempty"`
-
-	ACLEntries    aclEntries  `json:"acl_entries,omitempty"`
-	ACLIPsetStore *ipsetStore `json:"acl_ipset_store,omitempty"`
-
-	// IPv6 counterparts
+	RouteRules         routeRules    `json:"route_rules,omitempty"`
 	RouteRules6        routeRules    `json:"route_rules_v6,omitempty"`
+	RouteIPsetCounter  *ipsetCounter `json:"route_ipset_counter,omitempty"`
 	RouteIPsetCounter6 *ipsetCounter `json:"route_ipset_counter_v6,omitempty"`
-	ACLEntries6        aclEntries    `json:"acl_entries_v6,omitempty"`
-	ACLIPsetStore6     *ipsetStore   `json:"acl_ipset_store_v6,omitempty"`
+
+	ACLEntries  aclEntries `json:"acl_entries,omitempty"`
+	ACLEntries6 aclEntries `json:"acl_entries_v6,omitempty"`
 }
 
 func (s *ShutdownState) Name() string {
@@ -57,17 +53,14 @@ func (s *ShutdownState) Cleanup() error {
 	}
 
 	if s.RouteRules != nil {
-		ipt.router.rules = s.RouteRules
+		ipt.family4.rules = s.RouteRules
 	}
 	if s.RouteIPsetCounter != nil {
-		ipt.router.ipsetCounter.LoadData(s.RouteIPsetCounter)
+		ipt.family4.ipsetCounter.LoadData(s.RouteIPsetCounter)
 	}
 
 	if s.ACLEntries != nil {
-		ipt.aclMgr.entries = s.ACLEntries
-	}
-	if s.ACLIPsetStore != nil {
-		ipt.aclMgr.ipsetStore = s.ACLIPsetStore
+		ipt.family4.entries = s.ACLEntries
 	}
 
 	// Clean up v6 state even if the current run has no IPv6.
@@ -79,16 +72,13 @@ func (s *ShutdownState) Cleanup() error {
 	}
 	if ipt.hasIPv6() {
 		if s.RouteRules6 != nil {
-			ipt.router6.rules = s.RouteRules6
+			ipt.family6.rules = s.RouteRules6
 		}
 		if s.RouteIPsetCounter6 != nil {
-			ipt.router6.ipsetCounter.LoadData(s.RouteIPsetCounter6)
+			ipt.family6.ipsetCounter.LoadData(s.RouteIPsetCounter6)
 		}
 		if s.ACLEntries6 != nil {
-			ipt.aclMgr6.entries = s.ACLEntries6
-		}
-		if s.ACLIPsetStore6 != nil {
-			ipt.aclMgr6.ipsetStore = s.ACLIPsetStore6
+			ipt.family6.entries = s.ACLEntries6
 		}
 	}
 
diff --git a/client/firewall/iptables/testhelpers_linux_test.go b/client/firewall/iptables/testhelpers_linux_test.go
new file mode 100644
index 000000000..fe44f7cc3
--- /dev/null
+++ b/client/firewall/iptables/testhelpers_linux_test.go
@@ -0,0 +1,27 @@
+//go:build privileged
+
+package iptables
+
+import (
+	"fmt"
+	"net"
+	"net/netip"
+)
+
+func pfx(ip net.IP) []netip.Prefix {
+	if ip == nil {
+		return []netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)}
+	}
+	if ip.IsUnspecified() {
+		if ip.To4() != nil {
+			return []netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)}
+		}
+		return []netip.Prefix{netip.PrefixFrom(netip.IPv6Unspecified(), 0)}
+	}
+	a, ok := netip.AddrFromSlice(ip)
+	if !ok {
+		panic(fmt.Sprintf("invalid IP length: %d", len(ip)))
+	}
+	a = a.Unmap()
+	return []netip.Prefix{netip.PrefixFrom(a, a.BitLen())}
+}
diff --git a/client/firewall/manager/firewall.go b/client/firewall/manager/firewall.go
index 149c6db83..f8de1e2b5 100644
--- a/client/firewall/manager/firewall.go
+++ b/client/firewall/manager/firewall.go
@@ -3,7 +3,6 @@ package manager
 import (
 	"errors"
 	"fmt"
-	"net"
 	"net/netip"
 	"sort"
 
@@ -16,6 +15,12 @@ import (
 // method but the IPv6 firewall components were not initialized.
 var ErrIPv6NotInitialized = errors.New("IPv6 firewall not initialized")
 
+// ErrNoSources is returned when AddFilterRule is called with an empty
+// source list. "Match any source" must be expressed explicitly with a
+// /0 prefix; an empty list is a caller error and is rejected rather
+// than silently widening the rule to every source.
+var ErrNoSources = errors.New("rule has no sources")
+
 const (
 	ForwardingFormatPrefix = "netbird-fwd-"
 	ForwardingFormat       = "netbird-fwd-%s-%t"
@@ -23,13 +28,18 @@ const (
 	NatFormat              = "netbird-nat-%s-%t"
 )
 
+// RuleID identifies a firewall rule. It is a typed string so the
+// compiler catches accidental mixing with arbitrary string keys. It is
+// only an identifier and does not implement Rule.
+type RuleID string
+
 // Rule abstraction should be implemented by each firewall manager
 //
 // Each firewall type for different OS can use different type
 // of the properties to hold data of the created rule
 type Rule interface {
 	// ID returns the rule id
-	ID() string
+	ID() RuleID
 }
 
 // RuleDirection is the traffic direction which a rule is applied
@@ -91,6 +101,13 @@ func (d Network) IsPrefix() bool {
 	return d.Prefix.IsValid()
 }
 
+// IsZero returns true if the network designates no destination, i.e. it
+// is the zero value. A zero Network is the peer-rule sentinel; a non-zero
+// one carries a prefix or set destination.
+func (d Network) IsZero() bool {
+	return !d.IsPrefix() && !d.IsSet()
+}
+
 // Manager is the high level abstraction of a firewall manager
 //
 // It declares methods which handle actions required by the
@@ -98,46 +115,42 @@ func (d Network) IsPrefix() bool {
 type Manager interface {
 	Init(stateManager *statemanager.Manager) error
 
-	// AllowNetbird allows netbird interface traffic
-	AllowNetbird() error
-
-	// AddPeerFiltering adds a rule to the firewall
+	// AddFilterRule adds a packet-filtering rule to the firewall.
 	//
-	// If comment argument is empty firewall manager should set
-	// rule ID as comment for the rule
+	// If destination is the zero Network, the rule applies to traffic
+	// inbound to this node, i.e. peer ACL semantics, installed in
+	// the kernel's input chain. If destination is set (prefix or
+	// set), the rule applies to forwarded traffic with that
+	// destination, route ACL semantics, installed in the forward
+	// chain.
 	//
-	// Note: Callers should call Flush() after adding rules to ensure
-	// they are applied to the kernel and rule handles are refreshed.
-	AddPeerFiltering(
+	// sources must be a single address family; the caller splits mixed
+	// families and calls once per family. "Match any source" must be
+	// expressed with an explicit /0 prefix; an empty sources list is
+	// rejected with ErrNoSources so a zeroed list can never widen a
+	// rule to every source.
+	//
+	// Note: callers should call Flush() after adding rules.
+	AddFilterRule(
 		id []byte,
-		ip net.IP,
+		sources []netip.Prefix,
+		destination Network,
 		proto Protocol,
 		sPort *Port,
 		dPort *Port,
 		action Action,
-		ipsetName string,
-	) ([]Rule, error)
+	) (Rule, error)
 
-	// DeletePeerRule from the firewall by rule definition
-	DeletePeerRule(rule Rule) error
+	// DeleteFilterRule removes a filtering rule previously added via
+	// AddFilterRule. The rule's own type identifies whether it lives
+	// in the peer (input) or route (forward) path.
+	DeleteFilterRule(rule Rule) error
 
 	// IsServerRouteSupported returns true if the firewall supports server side routing operations
 	IsServerRouteSupported() bool
 
 	IsStateful() bool
 
-	AddRouteFiltering(
-		id []byte,
-		sources []netip.Prefix,
-		destination Network,
-		proto Protocol,
-		sPort, dPort *Port,
-		action Action,
-	) (Rule, error)
-
-	// DeleteRouteRule deletes a routing rule
-	DeleteRouteRule(rule Rule) error
-
 	// AddNatRule inserts a routing NAT rule
 	AddNatRule(pair RouterPair) error
 
@@ -159,12 +172,6 @@ type Manager interface {
 
 	DisableRouting() error
 
-	// AddDNATRule adds outbound DNAT rule for forwarding external traffic to the NetBird network.
-	AddDNATRule(ForwardRule) (Rule, error)
-
-	// DeleteDNATRule deletes the outbound DNAT rule.
-	DeleteDNATRule(Rule) error
-
 	// UpdateSet updates the set with the given prefixes
 	UpdateSet(hash Set, prefixes []netip.Prefix) error
 
@@ -179,14 +186,11 @@ type Manager interface {
 
 	// RemoveOutputDNAT removes an OUTPUT chain DNAT rule.
 	RemoveOutputDNAT(localAddr netip.Addr, protocol Protocol, originalPort, translatedPort uint16) error
-
-	// SetupEBPFProxyNoTrack creates static notrack rules for eBPF proxy loopback traffic.
-	// This prevents conntrack from interfering with WireGuard proxy communication.
-	SetupEBPFProxyNoTrack(proxyPort, wgPort uint16) error
 }
 
-func GenKey(format string, pair RouterPair) string {
-	return fmt.Sprintf(format, pair.ID, pair.Inverse)
+// GenKey builds the rule id for this pair from the given format.
+func (p RouterPair) GenKey(format string) RuleID {
+	return RuleID(fmt.Sprintf(format, p.ID, p.Inverse))
 }
 
 // LegacyManager defines the interface for legacy management operations
@@ -242,6 +246,20 @@ func MergeIPRanges(prefixes []netip.Prefix) []netip.Prefix {
 	return merged
 }
 
+// UnmapPrefix normalizes a v4-mapped v6 prefix (::ffff:a.b.c.d) to its
+// plain v4 form, shifting the prefix length out of the 96-bit mapped
+// range. Other prefixes are returned unchanged. Keeping prefixes
+// unmapped ensures v4 rules match consistently and the match builders
+// read the correct address length.
+func UnmapPrefix(p netip.Prefix) netip.Prefix {
+	addr := p.Addr()
+	if !addr.Is4In6() {
+		return p
+	}
+	bits := max(p.Bits()-96, 0)
+	return netip.PrefixFrom(addr.Unmap(), bits)
+}
+
 // SortPrefixes sorts the given slice of netip.Prefix in place.
 // It sorts first by IP address, then by prefix length (most specific to least specific).
 func SortPrefixes(prefixes []netip.Prefix) {
diff --git a/client/firewall/manager/forward_rule.go b/client/firewall/manager/forward_rule.go
deleted file mode 100644
index 21a43520e..000000000
--- a/client/firewall/manager/forward_rule.go
+++ /dev/null
@@ -1,27 +0,0 @@
-package manager
-
-import (
-	"fmt"
-	"net/netip"
-)
-
-// ForwardRule todo figure out better place to this to avoid circular imports
-type ForwardRule struct {
-	Protocol          Protocol
-	DestinationPort   Port
-	TranslatedAddress netip.Addr
-	TranslatedPort    Port
-}
-
-func (r ForwardRule) ID() string {
-	id := fmt.Sprintf("%s;%s;%s;%s",
-		r.Protocol,
-		r.DestinationPort.String(),
-		r.TranslatedAddress.String(),
-		r.TranslatedPort.String())
-	return id
-}
-
-func (r ForwardRule) String() string {
-	return fmt.Sprintf("protocol: %s, destinationPort: %s, translatedAddress: %s, translatedPort: %s", r.Protocol, r.DestinationPort.String(), r.TranslatedAddress.String(), r.TranslatedPort.String())
-}
diff --git a/client/firewall/manager/set.go b/client/firewall/manager/set.go
index dda93bf47..fa55471ea 100644
--- a/client/firewall/manager/set.go
+++ b/client/firewall/manager/set.go
@@ -40,7 +40,7 @@ func (h Set) Comment() string {
 
 // NewPrefixSet generates a unique name for an ipset based on the given prefixes.
 func NewPrefixSet(prefixes []netip.Prefix) Set {
-	// sort for consistent naming
+	prefixes = slices.Clone(prefixes)
 	SortPrefixes(prefixes)
 
 	hash := sha256.New()
diff --git a/client/firewall/nftables/acl_linux.go b/client/firewall/nftables/acl_linux.go
deleted file mode 100644
index 9d2ea7264..000000000
--- a/client/firewall/nftables/acl_linux.go
+++ /dev/null
@@ -1,713 +0,0 @@
-package nftables
-
-import (
-	"bytes"
-	"fmt"
-	"net"
-	"slices"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/google/nftables"
-	"github.com/google/nftables/binaryutil"
-	"github.com/google/nftables/expr"
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
-
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	nbnet "github.com/netbirdio/netbird/client/net"
-)
-
-const (
-
-	// rules chains contains the effective ACL rules
-	chainNameInputRules = "netbird-acl-input-rules"
-
-	// filter chains contains the rules that jump to the rules chains
-	chainNameInputFilter       = "netbird-acl-input-filter"
-	chainNameForwardFilter     = "netbird-acl-forward-filter"
-	chainNameManglePrerouting  = "netbird-mangle-prerouting"
-	chainNameManglePostrouting = "netbird-mangle-postrouting"
-)
-
-const flushError = "flush: %w"
-
-type AclManager struct {
-	rConn              *nftables.Conn
-	sConn              *nftables.Conn
-	wgIface            iFaceMapper
-	routingFwChainName string
-	af                 addrFamily
-
-	workTable       *nftables.Table
-	chainInputRules *nftables.Chain
-	chainPrerouting *nftables.Chain
-
-	ipsetStore *ipsetStore
-	rules      map[string]*Rule
-}
-
-func newAclManager(table *nftables.Table, wgIface iFaceMapper, routingFwChainName string) (*AclManager, error) {
-	// sConn is used for creating sets and adding/removing elements from them
-	// it's differ then rConn (which does create new conn for each flush operation)
-	// and is permanent. Using same connection for both type of operations
-	// overloads netlink with high amount of rules ( > 10000)
-	sConn, err := nftables.New(nftables.AsLasting())
-	if err != nil {
-		return nil, fmt.Errorf("create nf conn: %w", err)
-	}
-
-	return &AclManager{
-		rConn:              &nftables.Conn{},
-		sConn:              sConn,
-		wgIface:            wgIface,
-		workTable:          table,
-		routingFwChainName: routingFwChainName,
-		af:                 familyForAddr(table.Family == nftables.TableFamilyIPv4),
-
-		ipsetStore: newIpsetStore(),
-		rules:      make(map[string]*Rule),
-	}, nil
-}
-
-func (m *AclManager) init(workTable *nftables.Table) error {
-	m.workTable = workTable
-	return m.createDefaultChains()
-}
-
-// AddPeerFiltering rule to the firewall
-//
-// If comment argument is empty firewall manager should set
-// rule ID as comment for the rule
-func (m *AclManager) AddPeerFiltering(
-	id []byte,
-	ip net.IP,
-	proto firewall.Protocol,
-	sPort *firewall.Port,
-	dPort *firewall.Port,
-	action firewall.Action,
-	ipsetName string,
-) ([]firewall.Rule, error) {
-	var ipset *nftables.Set
-	if ipsetName != "" {
-		var err error
-		ipset, err = m.addIpToSet(ipsetName, ip)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	newRules := make([]firewall.Rule, 0, 2)
-	ioRule, err := m.addIOFiltering(ip, proto, sPort, dPort, action, ipset)
-	if err != nil {
-		return nil, err
-	}
-
-	newRules = append(newRules, ioRule)
-	return newRules, nil
-}
-
-// DeletePeerRule from the firewall by rule definition
-func (m *AclManager) DeletePeerRule(rule firewall.Rule) error {
-	r, ok := rule.(*Rule)
-	if !ok {
-		return fmt.Errorf("invalid rule type")
-	}
-
-	if r.nftSet == nil {
-		if err := m.rConn.DelRule(r.nftRule); err != nil {
-			log.Errorf("failed to delete rule: %v", err)
-		}
-		if r.mangleRule != nil {
-			if err := m.rConn.DelRule(r.mangleRule); err != nil {
-				log.Errorf("failed to delete mangle rule: %v", err)
-			}
-		}
-		delete(m.rules, r.ID())
-		return m.rConn.Flush()
-	}
-
-	ips, ok := m.ipsetStore.ips(r.nftSet.Name)
-	if !ok {
-		if err := m.rConn.DelRule(r.nftRule); err != nil {
-			log.Errorf("failed to delete rule: %v", err)
-		}
-		if r.mangleRule != nil {
-			if err := m.rConn.DelRule(r.mangleRule); err != nil {
-				log.Errorf("failed to delete mangle rule: %v", err)
-			}
-		}
-		delete(m.rules, r.ID())
-		return m.rConn.Flush()
-	}
-
-	if _, ok := ips[r.ip.String()]; ok {
-		err := m.sConn.SetDeleteElements(r.nftSet, []nftables.SetElement{{Key: ipToBytes(r.ip, m.af)}})
-		if err != nil {
-			log.Errorf("delete elements for set %q: %v", r.nftSet.Name, err)
-		}
-		if err := m.sConn.Flush(); err != nil {
-			log.Debugf("flush error of set delete element, %s", r.nftSet.Name)
-			return err
-		}
-		m.ipsetStore.DeleteIpFromSet(r.nftSet.Name, r.ip)
-	}
-
-	// if after delete, set still contains other IPs,
-	// no need to delete firewall rule and we should exit here
-	if len(ips) > 0 {
-		return nil
-	}
-
-	if err := m.rConn.DelRule(r.nftRule); err != nil {
-		log.Errorf("failed to delete rule: %v", err)
-	}
-	if r.mangleRule != nil {
-		if err := m.rConn.DelRule(r.mangleRule); err != nil {
-			log.Errorf("failed to delete mangle rule: %v", err)
-		}
-	}
-
-	if err := m.rConn.Flush(); err != nil {
-		return err
-	}
-
-	delete(m.rules, r.ID())
-	m.ipsetStore.DeleteReferenceFromIpSet(r.nftSet.Name)
-
-	if m.ipsetStore.HasReferenceToSet(r.nftSet.Name) {
-		return nil
-	}
-
-	// we delete last IP from the set, that means we need to delete
-	// set itself and associated firewall rule too
-	m.rConn.FlushSet(r.nftSet)
-	m.rConn.DelSet(r.nftSet)
-	m.ipsetStore.deleteIpset(r.nftSet.Name)
-	return nil
-}
-
-// createDefaultAllowRules creates default allow rules for the input and output chains
-func (m *AclManager) createDefaultAllowRules() error {
-	expIn := []expr.Any{
-		&expr.Verdict{
-			Kind: expr.VerdictAccept,
-		},
-	}
-
-	_ = m.rConn.InsertRule(&nftables.Rule{
-		Table:    m.workTable,
-		Chain:    m.chainInputRules,
-		Position: 0,
-		Exprs:    expIn,
-	})
-
-	if err := m.rConn.Flush(); err != nil {
-		return fmt.Errorf(flushError, err)
-	}
-	return nil
-}
-
-// Flush rule/chain/set operations from the buffer
-//
-// Method also get all rules after flush and refreshes handle values in the rulesets
-func (m *AclManager) Flush() error {
-	if err := m.flushWithBackoff(); err != nil {
-		return err
-	}
-
-	if err := m.refreshRuleHandles(m.chainInputRules, false); err != nil {
-		log.Errorf("failed to refresh rule handles ipv4 input chain: %v", err)
-	}
-	if err := m.refreshRuleHandles(m.chainPrerouting, true); err != nil {
-		log.Errorf("failed to refresh rule handles prerouting chain: %v", err)
-	}
-
-	return nil
-}
-
-func (m *AclManager) addIOFiltering(
-	ip net.IP,
-	proto firewall.Protocol,
-	sPort *firewall.Port,
-	dPort *firewall.Port,
-	action firewall.Action,
-	ipset *nftables.Set,
-) (*Rule, error) {
-	ruleId := generatePeerRuleId(ip, proto, sPort, dPort, action, ipset)
-	if r, ok := m.rules[ruleId]; ok {
-		return &Rule{
-			nftRule:    r.nftRule,
-			mangleRule: r.mangleRule,
-			nftSet:     r.nftSet,
-			ruleID:     r.ruleID,
-			ip:         ip,
-		}, nil
-	}
-
-	var expressions []expr.Any
-
-	if proto != firewall.ProtocolALL {
-		expressions = append(expressions, &expr.Payload{
-			DestRegister: 1,
-			Base:         expr.PayloadBaseNetworkHeader,
-			Offset:       m.af.protoOffset,
-			Len:          uint32(1),
-		})
-
-		protoData, err := m.af.protoNum(proto)
-		if err != nil {
-			return nil, fmt.Errorf("convert protocol to number: %v", err)
-		}
-
-		expressions = append(expressions, &expr.Cmp{
-			Register: 1,
-			Op:       expr.CmpOpEq,
-			Data:     []byte{protoData},
-		})
-	}
-
-	rawIP := ipToBytes(ip, m.af)
-	// check if rawIP contains zeroed IPv4 0.0.0.0 value
-	// in that case not add IP match expression into the rule definition
-	if slices.ContainsFunc(rawIP, func(v byte) bool { return v != 0 }) {
-		expressions = append(expressions,
-			&expr.Payload{
-				DestRegister: 1,
-				Base:         expr.PayloadBaseNetworkHeader,
-				Offset:       m.af.srcAddrOffset,
-				Len:          m.af.addrLen,
-			},
-		)
-		// add individual IP for match if no ipset defined
-		if ipset == nil {
-			expressions = append(expressions,
-				&expr.Cmp{
-					Op:       expr.CmpOpEq,
-					Register: 1,
-					Data:     rawIP,
-				},
-			)
-		} else {
-			expressions = append(expressions,
-				&expr.Lookup{
-					SourceRegister: 1,
-					SetName:        ipset.Name,
-					SetID:          ipset.ID,
-				},
-			)
-		}
-	}
-
-	expressions = append(expressions, applyPort(sPort, true)...)
-	expressions = append(expressions, applyPort(dPort, false)...)
-
-	mainExpressions := slices.Clone(expressions)
-
-	switch action {
-	case firewall.ActionAccept:
-		mainExpressions = append(mainExpressions, &expr.Verdict{Kind: expr.VerdictAccept})
-	case firewall.ActionDrop:
-		mainExpressions = append(mainExpressions, &expr.Verdict{Kind: expr.VerdictDrop})
-	}
-
-	userData := []byte(ruleId)
-
-	chain := m.chainInputRules
-	rule := &nftables.Rule{
-		Table:    m.workTable,
-		Chain:    chain,
-		Exprs:    mainExpressions,
-		UserData: userData,
-	}
-
-	// Insert DROP rules at the beginning, append ACCEPT rules at the end
-	var nftRule *nftables.Rule
-	if action == firewall.ActionDrop {
-		nftRule = m.rConn.InsertRule(rule)
-	} else {
-		nftRule = m.rConn.AddRule(rule)
-	}
-
-	if err := m.rConn.Flush(); err != nil {
-		return nil, fmt.Errorf("flush input rule %s: %v", ruleId, err)
-	}
-
-	ruleStruct := &Rule{
-		nftRule: nftRule,
-		// best effort mangle rule
-		mangleRule: m.createPreroutingRule(expressions, userData),
-		nftSet:     ipset,
-		ruleID:     ruleId,
-		ip:         ip,
-	}
-	m.rules[ruleId] = ruleStruct
-	if ipset != nil {
-		m.ipsetStore.AddReferenceToIpset(ipset.Name)
-	}
-
-	return ruleStruct, nil
-}
-
-func (m *AclManager) createPreroutingRule(expressions []expr.Any, userData []byte) *nftables.Rule {
-	if m.chainPrerouting == nil {
-		log.Warn("prerouting chain is not created")
-		return nil
-	}
-
-	preroutingExprs := slices.Clone(expressions)
-
-	// interface
-	preroutingExprs = append([]expr.Any{
-		&expr.Meta{
-			Key:      expr.MetaKeyIIFNAME,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(m.wgIface.Name()),
-		},
-	}, preroutingExprs...)
-
-	// local destination and mark
-	preroutingExprs = append(preroutingExprs,
-		&expr.Fib{
-			Register:       1,
-			ResultADDRTYPE: true,
-			FlagDADDR:      true,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     binaryutil.NativeEndian.PutUint32(unix.RTN_LOCAL),
-		},
-
-		&expr.Immediate{
-			Register: 1,
-			Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkRedirected),
-		},
-		&expr.Meta{
-			Key:            expr.MetaKeyMARK,
-			Register:       1,
-			SourceRegister: true,
-		},
-	)
-
-	nfRule := m.rConn.AddRule(&nftables.Rule{
-		Table:    m.workTable,
-		Chain:    m.chainPrerouting,
-		Exprs:    preroutingExprs,
-		UserData: userData,
-	})
-
-	if err := m.rConn.Flush(); err != nil {
-		log.Errorf("failed to flush mangle rule %s: %v", string(userData), err)
-		return nil
-	}
-
-	return nfRule
-}
-
-func (m *AclManager) createDefaultChains() (err error) {
-	// chainNameInputRules
-	chain := m.createChain(chainNameInputRules)
-	err = m.rConn.Flush()
-	if err != nil {
-		log.Debugf("failed to create chain (%s): %s", chain.Name, err)
-		return fmt.Errorf(flushError, err)
-	}
-	m.chainInputRules = chain
-
-	// netbird-acl-input-filter
-	// type filter hook input priority filter; policy accept;
-	chain = m.createFilterChainWithHook(chainNameInputFilter, nftables.ChainHookInput)
-	m.addJumpRule(chain, m.chainInputRules.Name, expr.MetaKeyIIFNAME) // to netbird-acl-input-rules
-	m.addDropExpressions(chain, expr.MetaKeyIIFNAME)
-	err = m.rConn.Flush()
-	if err != nil {
-		log.Debugf("failed to create chain (%s): %s", chain.Name, err)
-		return err
-	}
-
-	// netbird-acl-forward-filter
-	chainFwFilter := m.createFilterChainWithHook(chainNameForwardFilter, nftables.ChainHookForward)
-	m.addJumpRulesToRtForward(chainFwFilter) // to netbird-rt-fwd
-	m.addDropExpressions(chainFwFilter, expr.MetaKeyIIFNAME)
-
-	err = m.rConn.Flush()
-	if err != nil {
-		log.Debugf("failed to create chain (%s): %s", chainNameForwardFilter, err)
-		return fmt.Errorf(flushError, err)
-	}
-
-	if err := m.allowRedirectedTraffic(chainFwFilter); err != nil {
-		log.Errorf("failed to allow redirected traffic: %s", err)
-	}
-
-	return nil
-}
-
-// Makes redirected traffic originally destined for the host itself (now subject to the forward filter)
-// go through the input filter as well. This will enable e.g. Docker services to keep working by accessing the
-// netbird peer IP.
-func (m *AclManager) allowRedirectedTraffic(chainFwFilter *nftables.Chain) error {
-	// Chain is created by route manager
-	// TODO: move creation to a common place
-	m.chainPrerouting = &nftables.Chain{
-		Name:     chainNameManglePrerouting,
-		Table:    m.workTable,
-		Type:     nftables.ChainTypeFilter,
-		Hooknum:  nftables.ChainHookPrerouting,
-		Priority: nftables.ChainPriorityMangle,
-	}
-
-	m.addFwmarkToForward(chainFwFilter)
-
-	if err := m.rConn.Flush(); err != nil {
-		return fmt.Errorf(flushError, err)
-	}
-
-	return nil
-}
-
-func (m *AclManager) addFwmarkToForward(chainFwFilter *nftables.Chain) {
-	m.rConn.InsertRule(&nftables.Rule{
-		Table: m.workTable,
-		Chain: chainFwFilter,
-		Exprs: []expr.Any{
-			&expr.Meta{
-				Key:      expr.MetaKeyMARK,
-				Register: 1,
-			},
-			&expr.Cmp{
-				Op:       expr.CmpOpEq,
-				Register: 1,
-				Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkRedirected),
-			},
-			&expr.Verdict{
-				Kind: expr.VerdictAccept,
-			},
-		},
-	})
-}
-
-func (m *AclManager) addJumpRulesToRtForward(chainFwFilter *nftables.Chain) {
-	expressions := []expr.Any{
-		&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(m.wgIface.Name()),
-		},
-		&expr.Verdict{
-			Kind:  expr.VerdictJump,
-			Chain: m.routingFwChainName,
-		},
-	}
-
-	_ = m.rConn.AddRule(&nftables.Rule{
-		Table: m.workTable,
-		Chain: chainFwFilter,
-		Exprs: expressions,
-	})
-}
-
-func (m *AclManager) createChain(name string) *nftables.Chain {
-	chain := &nftables.Chain{
-		Name:  name,
-		Table: m.workTable,
-	}
-
-	chain = m.rConn.AddChain(chain)
-
-	insertReturnTrafficRule(m.rConn, m.workTable, chain)
-
-	return chain
-}
-
-func (m *AclManager) createFilterChainWithHook(name string, hookNum *nftables.ChainHook) *nftables.Chain {
-	polAccept := nftables.ChainPolicyAccept
-	chain := &nftables.Chain{
-		Name:     name,
-		Table:    m.workTable,
-		Hooknum:  hookNum,
-		Priority: nftables.ChainPriorityFilter,
-		Type:     nftables.ChainTypeFilter,
-		Policy:   &polAccept,
-	}
-
-	return m.rConn.AddChain(chain)
-}
-
-func (m *AclManager) addDropExpressions(chain *nftables.Chain, ifaceKey expr.MetaKey) []expr.Any {
-	expressions := []expr.Any{
-		&expr.Meta{Key: ifaceKey, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(m.wgIface.Name()),
-		},
-		&expr.Verdict{Kind: expr.VerdictDrop},
-	}
-	_ = m.rConn.AddRule(&nftables.Rule{
-		Table: m.workTable,
-		Chain: chain,
-		Exprs: expressions,
-	})
-	return nil
-}
-
-func (m *AclManager) addJumpRule(chain *nftables.Chain, to string, ifaceKey expr.MetaKey) {
-	expressions := []expr.Any{
-		&expr.Meta{Key: ifaceKey, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(m.wgIface.Name()),
-		},
-		&expr.Verdict{
-			Kind:  expr.VerdictJump,
-			Chain: to,
-		},
-	}
-
-	_ = m.rConn.AddRule(&nftables.Rule{
-		Table: chain.Table,
-		Chain: chain,
-		Exprs: expressions,
-	})
-}
-
-func (m *AclManager) addIpToSet(ipsetName string, ip net.IP) (*nftables.Set, error) {
-	ipset, err := m.rConn.GetSetByName(m.workTable, ipsetName)
-	rawIP := ipToBytes(ip, m.af)
-	if err != nil {
-		if ipset, err = m.createSet(m.workTable, ipsetName); err != nil {
-			return nil, fmt.Errorf("get set name: %v", err)
-		}
-
-		m.ipsetStore.newIpset(ipset.Name)
-	}
-
-	if m.ipsetStore.IsIpInSet(ipset.Name, ip) {
-		return ipset, nil
-	}
-
-	if err := m.sConn.SetAddElements(ipset, []nftables.SetElement{{Key: rawIP}}); err != nil {
-		return nil, fmt.Errorf("add set element for the first time: %v", err)
-	}
-
-	m.ipsetStore.AddIpToSet(ipset.Name, ip)
-
-	if err := m.sConn.Flush(); err != nil {
-		return nil, fmt.Errorf("flush add elements: %v", err)
-	}
-
-	return ipset, nil
-}
-
-// createSet in given table by name
-func (m *AclManager) createSet(table *nftables.Table, name string) (*nftables.Set, error) {
-	ipset := &nftables.Set{
-		Name:    name,
-		Table:   table,
-		Dynamic: true,
-		KeyType: m.af.setKeyType,
-	}
-
-	if err := m.rConn.AddSet(ipset, nil); err != nil {
-		return nil, fmt.Errorf("create set: %v", err)
-	}
-
-	if err := m.rConn.Flush(); err != nil {
-		return nil, fmt.Errorf("flush created set: %v", err)
-	}
-
-	return ipset, nil
-}
-
-func (m *AclManager) flushWithBackoff() (err error) {
-	backoff := 4
-	backoffTime := 1000 * time.Millisecond
-	for i := 0; ; i++ {
-		err = m.rConn.Flush()
-		if err != nil {
-			log.Debugf("failed to flush nftables: %v", err)
-			if !strings.Contains(err.Error(), "busy") {
-				return
-			}
-			log.Error("failed to flush nftables, retrying...")
-			if i == backoff-1 {
-				return err
-			}
-			time.Sleep(backoffTime)
-			backoffTime *= 2
-			continue
-		}
-		break
-	}
-	return
-}
-
-func (m *AclManager) refreshRuleHandles(chain *nftables.Chain, mangle bool) error {
-	if m.workTable == nil || chain == nil {
-		return nil
-	}
-
-	list, err := m.rConn.GetRules(m.workTable, chain)
-	if err != nil {
-		return err
-	}
-
-	for _, rule := range list {
-		if len(rule.UserData) == 0 {
-			continue
-		}
-		split := bytes.Split(rule.UserData, []byte(" "))
-		r, ok := m.rules[string(split[0])]
-		if ok {
-			if mangle {
-				*r.mangleRule = *rule
-			} else {
-				*r.nftRule = *rule
-			}
-		}
-	}
-
-	return nil
-}
-
-func generatePeerRuleId(ip net.IP, proto firewall.Protocol, sPort *firewall.Port, dPort *firewall.Port, action firewall.Action, ipset *nftables.Set) string {
-	rulesetID := ":" + string(proto) + ":"
-	if sPort != nil {
-		rulesetID += sPort.String()
-	}
-	rulesetID += ":"
-	if dPort != nil {
-		rulesetID += dPort.String()
-	}
-	rulesetID += ":"
-	rulesetID += strconv.Itoa(int(action))
-	if ipset == nil {
-		return "ip:" + ip.String() + rulesetID
-	}
-	return "set:" + ipset.Name + rulesetID
-}
-
-func ifname(n string) []byte {
-	b := make([]byte, 16)
-	copy(b, n+"\x00")
-	return b
-}
-
-
-// ipToBytes converts net.IP to the correct byte length for the address family.
-func ipToBytes(ip net.IP, af addrFamily) []byte {
-	if af.addrLen == 4 {
-		return ip.To4()
-	}
-	return ip.To16()
-}
-
diff --git a/client/firewall/nftables/chains_linux.go b/client/firewall/nftables/chains_linux.go
new file mode 100644
index 000000000..71f0c60f2
--- /dev/null
+++ b/client/firewall/nftables/chains_linux.go
@@ -0,0 +1,880 @@
+//go:build !android
+
+package nftables
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/coreos/go-iptables/iptables"
+	"github.com/google/nftables"
+	"github.com/google/nftables/binaryutil"
+	"github.com/google/nftables/expr"
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/unix"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	"github.com/netbirdio/netbird/client/firewall/firewalld"
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	nbnet "github.com/netbirdio/netbird/client/net"
+)
+
+func (r *family) createContainers() error {
+	r.chains[chainNameRoutingFw] = r.conn.AddChain(&nftables.Chain{
+		Name:  chainNameRoutingFw,
+		Table: r.workTable,
+	})
+
+	prio := *nftables.ChainPriorityNATSource - 1
+	r.chains[chainNameRoutingNat] = r.conn.AddChain(&nftables.Chain{
+		Name:     chainNameRoutingNat,
+		Table:    r.workTable,
+		Hooknum:  nftables.ChainHookPostrouting,
+		Priority: &prio,
+		Type:     nftables.ChainTypeNAT,
+	})
+
+	r.chains[chainNameRoutingRdr] = r.conn.AddChain(&nftables.Chain{
+		Name:     chainNameRoutingRdr,
+		Table:    r.workTable,
+		Hooknum:  nftables.ChainHookPrerouting,
+		Priority: nftables.ChainPriorityNATDest,
+		Type:     nftables.ChainTypeNAT,
+	})
+
+	r.chains[chainNameManglePostrouting] = r.conn.AddChain(&nftables.Chain{
+		Name:     chainNameManglePostrouting,
+		Table:    r.workTable,
+		Hooknum:  nftables.ChainHookPostrouting,
+		Priority: nftables.ChainPriorityMangle,
+		Type:     nftables.ChainTypeFilter,
+	})
+
+	r.chains[chainNameManglePrerouting] = r.conn.AddChain(&nftables.Chain{
+		Name:     chainNameManglePrerouting,
+		Table:    r.workTable,
+		Hooknum:  nftables.ChainHookPrerouting,
+		Priority: nftables.ChainPriorityMangle,
+		Type:     nftables.ChainTypeFilter,
+	})
+
+	r.chains[chainNameMangleForward] = r.conn.AddChain(&nftables.Chain{
+		Name:     chainNameMangleForward,
+		Table:    r.workTable,
+		Hooknum:  nftables.ChainHookForward,
+		Priority: nftables.ChainPriorityMangle,
+		Type:     nftables.ChainTypeFilter,
+	})
+
+	insertReturnTrafficRule(r.conn, r.workTable, r.chains[chainNameRoutingFw])
+
+	r.addPostroutingRules()
+
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf("initialize tables: %v", err)
+	}
+
+	if err := r.addMSSClampingRules(); err != nil {
+		log.Errorf("failed to add MSS clamping rules: %s", err)
+	}
+
+	// Kernel routing opens both INPUT and FORWARD.
+	if err := r.openInterface(true); err != nil {
+		log.Errorf("failed to open interface in foreign chains: %s", err)
+	}
+
+	if err := firewalld.TrustInterface(r.wgIface.Name()); err != nil {
+		log.Warnf("failed to trust interface in firewalld: %v", err)
+	}
+
+	if err := r.refreshRulesMap(); err != nil {
+		log.Errorf("failed to refresh rules: %s", err)
+	}
+
+	return nil
+}
+
+// setupDataPlaneMark configures the fwmark for the data plane
+func (r *family) setupDataPlaneMark() error {
+	if r.chains[chainNameManglePrerouting] == nil || r.chains[chainNameManglePostrouting] == nil {
+		return errors.New("no mangle chains found")
+	}
+
+	ctNew := getCtNewExprs()
+	preExprs := []expr.Any{
+		&expr.Meta{
+			Key:      expr.MetaKeyIIFNAME,
+			Register: 1,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     ifname(r.wgIface.Name()),
+		},
+	}
+	preExprs = append(preExprs, ctNew...)
+	preExprs = append(preExprs,
+		&expr.Immediate{
+			Register: 1,
+			Data:     binaryutil.NativeEndian.PutUint32(nbnet.DataPlaneMarkIn),
+		},
+		&expr.Ct{
+			Key:            expr.CtKeyMARK,
+			Register:       1,
+			SourceRegister: true,
+		},
+	)
+
+	preNftRule := &nftables.Rule{
+		Table: r.workTable,
+		Chain: r.chains[chainNameManglePrerouting],
+		Exprs: preExprs,
+	}
+	r.conn.AddRule(preNftRule)
+
+	postExprs := []expr.Any{
+		&expr.Meta{
+			Key:      expr.MetaKeyOIFNAME,
+			Register: 1,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     ifname(r.wgIface.Name()),
+		},
+	}
+	postExprs = append(postExprs, ctNew...)
+	postExprs = append(postExprs,
+		&expr.Immediate{
+			Register: 1,
+			Data:     binaryutil.NativeEndian.PutUint32(nbnet.DataPlaneMarkOut),
+		},
+		&expr.Ct{
+			Key:            expr.CtKeyMARK,
+			Register:       1,
+			SourceRegister: true,
+		},
+	)
+
+	postNftRule := &nftables.Rule{
+		Table: r.workTable,
+		Chain: r.chains[chainNameManglePostrouting],
+		Exprs: postExprs,
+	}
+	r.conn.AddRule(postNftRule)
+
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf("flush: %w", err)
+	}
+
+	return nil
+}
+
+// openInterface adds passthrough accept rules for the NetBird interface to the
+// kernel's filter table and external chains so they don't drop our traffic.
+// includeForward also opens the FORWARD chains (kernel routing); when false only
+// INPUT is opened, which is all the userspace router needs since it never
+// forwards in the kernel.
+func (r *family) openInterface(includeForward bool) error {
+	var merr *multierror.Error
+
+	if err := r.acceptFilterTableRules(includeForward); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	if err := r.acceptExternalChainsRules(includeForward); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("add accept rules to external chains: %w", err))
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) acceptFilterTableRules(includeForward bool) error {
+	if r.filterTable == nil {
+		return nil
+	}
+
+	fw := "iptables"
+
+	defer func() {
+		log.Debugf("Used %s to add accept input/forward rules", fw)
+	}()
+
+	// Try iptables first and fallback to nftables if iptables is not available.
+	// Use the correct protocol (iptables vs ip6tables) for the address family.
+	ipt, err := iptables.NewWithProtocol(r.iptablesProto())
+	if err != nil {
+		log.Warnf("Will use nftables to manipulate the filter table because iptables is not available: %v", err)
+
+		fw = "nftables"
+		return r.acceptFilterRulesNftables(r.filterTable, includeForward)
+	}
+
+	if err := r.acceptFilterRulesIptables(ipt, includeForward); err != nil {
+		log.Warnf("iptables failed (table may be incompatible), falling back to nftables: %v", err)
+		fw = "nftables"
+		return r.acceptFilterRulesNftables(r.filterTable, includeForward)
+	}
+	return nil
+}
+
+func (r *family) acceptFilterRulesIptables(ipt *iptables.IPTables, includeForward bool) error {
+	var merr *multierror.Error
+
+	if includeForward {
+		for _, rule := range r.getAcceptForwardRules() {
+			if err := ipt.Insert("filter", chainNameForward, 1, rule...); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("add iptables forward rule: %v", err))
+			} else {
+				log.Debugf("added iptables forward rule: %v", rule)
+			}
+		}
+	}
+
+	inputRule := r.getAcceptInputRule()
+	if err := ipt.Insert("filter", chainNameInput, 1, inputRule...); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("add iptables input rule: %v", err))
+	} else {
+		log.Debugf("added iptables input rule: %v", inputRule)
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) getAcceptForwardRules() [][]string {
+	intf := r.wgIface.Name()
+	return [][]string{
+		{"-i", intf, "-j", "ACCEPT"},
+		{"-o", intf, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"},
+	}
+}
+
+func (r *family) getAcceptInputRule() []string {
+	return []string{"-i", r.wgIface.Name(), "-j", "ACCEPT"}
+}
+
+// acceptFilterRulesNftables adds accept rules to the ip filter table using nftables.
+// This is used when iptables is not available.
+func (r *family) acceptFilterRulesNftables(table *nftables.Table, includeForward bool) error {
+	intf := ifname(r.wgIface.Name())
+
+	if includeForward {
+		forwardChain := &nftables.Chain{
+			Name:     chainNameForward,
+			Table:    table,
+			Type:     nftables.ChainTypeFilter,
+			Hooknum:  nftables.ChainHookForward,
+			Priority: nftables.ChainPriorityFilter,
+		}
+		r.insertForwardAcceptRules(forwardChain, intf)
+	}
+
+	inputChain := &nftables.Chain{
+		Name:     chainNameInput,
+		Table:    table,
+		Type:     nftables.ChainTypeFilter,
+		Hooknum:  nftables.ChainHookInput,
+		Priority: nftables.ChainPriorityFilter,
+	}
+	r.insertInputAcceptRule(inputChain, intf)
+
+	return r.conn.Flush()
+}
+
+// acceptExternalChainsRules adds accept rules to external chains (non-netbird, non-iptables tables).
+// It dynamically finds chains at call time to handle chains that may have been created after startup.
+func (r *family) acceptExternalChainsRules(includeForward bool) error {
+	chains := r.findExternalChains()
+	if len(chains) == 0 {
+		return nil
+	}
+
+	intf := ifname(r.wgIface.Name())
+	for _, chain := range chains {
+		r.applyExternalChainAccept(chain, intf, includeForward)
+	}
+
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf("flush external chain rules: %w", err)
+	}
+	return nil
+}
+
+func (r *family) applyExternalChainAccept(chain *nftables.Chain, intf []byte, includeForward bool) {
+	if chain.Hooknum == nil {
+		log.Debugf("skipping external chain %s/%s: hooknum is nil", chain.Table.Name, chain.Name)
+		return
+	}
+
+	log.Debugf("adding accept rules to external %s chain: %s %s/%s",
+		hookName(chain.Hooknum), familyName(chain.Table.Family), chain.Table.Name, chain.Name)
+
+	switch *chain.Hooknum {
+	case *nftables.ChainHookForward:
+		if includeForward {
+			r.insertForwardAcceptRules(chain, intf)
+		}
+	case *nftables.ChainHookInput:
+		r.insertInputAcceptRule(chain, intf)
+	}
+}
+
+func (r *family) insertForwardAcceptRules(chain *nftables.Chain, intf []byte) {
+	existing, err := r.existingNetbirdRulesInChain(chain)
+	if err != nil {
+		log.Warnf("skip forward accept rules in %s/%s: %v", chain.Table.Name, chain.Name, err)
+		return
+	}
+	r.insertForwardIifRule(chain, intf, existing)
+	r.insertForwardOifEstablishedRule(chain, intf, existing)
+}
+
+func (r *family) insertForwardIifRule(chain *nftables.Chain, intf []byte, existing map[string]bool) {
+	if existing[userDataAcceptForwardRuleIif] {
+		return
+	}
+	r.conn.InsertRule(&nftables.Rule{
+		Table: chain.Table,
+		Chain: chain,
+		Exprs: []expr.Any{
+			&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
+			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: intf},
+			&expr.Counter{},
+			&expr.Verdict{Kind: expr.VerdictAccept},
+		},
+		UserData: []byte(userDataAcceptForwardRuleIif),
+	})
+}
+
+func (r *family) insertForwardOifEstablishedRule(chain *nftables.Chain, intf []byte, existing map[string]bool) {
+	if existing[userDataAcceptForwardRuleOif] {
+		return
+	}
+	exprs := []expr.Any{
+		&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
+		&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: intf},
+	}
+	r.conn.InsertRule(&nftables.Rule{
+		Table:    chain.Table,
+		Chain:    chain,
+		Exprs:    append(exprs, getEstablishedExprs(2)...),
+		UserData: []byte(userDataAcceptForwardRuleOif),
+	})
+}
+
+func (r *family) insertInputAcceptRule(chain *nftables.Chain, intf []byte) {
+	existing, err := r.existingNetbirdRulesInChain(chain)
+	if err != nil {
+		log.Warnf("skip input accept rule in %s/%s: %v", chain.Table.Name, chain.Name, err)
+		return
+	}
+	if existing[userDataAcceptInputRule] {
+		return
+	}
+	r.conn.InsertRule(&nftables.Rule{
+		Table: chain.Table,
+		Chain: chain,
+		Exprs: []expr.Any{
+			&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
+			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: intf},
+			&expr.Counter{},
+			&expr.Verdict{Kind: expr.VerdictAccept},
+		},
+		UserData: []byte(userDataAcceptInputRule),
+	})
+}
+
+// existingNetbirdRulesInChain returns the set of netbird-owned UserData tags present in a chain; callers must bail on error since InsertRule is additive.
+func (r *family) existingNetbirdRulesInChain(chain *nftables.Chain) (map[string]bool, error) {
+	rules, err := r.conn.GetRules(chain.Table, chain)
+	if err != nil {
+		return nil, fmt.Errorf("list rules: %w", err)
+	}
+	present := map[string]bool{}
+	for _, rule := range rules {
+		if !isNetbirdAcceptRuleTag(rule.UserData) {
+			continue
+		}
+		present[string(rule.UserData)] = true
+	}
+	return present, nil
+}
+
+func isNetbirdAcceptRuleTag(userData []byte) bool {
+	switch string(userData) {
+	case userDataAcceptForwardRuleIif,
+		userDataAcceptForwardRuleOif,
+		userDataAcceptInputRule:
+		return true
+	}
+	return false
+}
+
+func (r *family) removeAcceptFilterRules() error {
+	var merr *multierror.Error
+
+	if err := r.removeFilterTableRules(); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	if err := r.removeExternalChainsRules(); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove external chain rules: %w", err))
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) removeFilterTableRules() error {
+	if r.filterTable == nil {
+		return nil
+	}
+
+	ipt, err := iptables.NewWithProtocol(r.iptablesProto())
+	if err != nil {
+		log.Debugf("iptables not available, using nftables to remove filter rules: %v", err)
+		return r.removeAcceptRulesFromTable(r.filterTable)
+	}
+
+	if err := r.removeAcceptFilterRulesIptables(ipt); err != nil {
+		log.Debugf("iptables removal failed (table may be incompatible), falling back to nftables: %v", err)
+		return r.removeAcceptRulesFromTable(r.filterTable)
+	}
+	return nil
+}
+
+func (r *family) removeAcceptRulesFromTable(table *nftables.Table) error {
+	chains, err := r.conn.ListChainsOfTableFamily(table.Family)
+	if err != nil {
+		return fmt.Errorf("list chains: %v", err)
+	}
+
+	for _, chain := range chains {
+		if chain.Table.Name != table.Name {
+			continue
+		}
+
+		if chain.Name != chainNameForward && chain.Name != chainNameInput {
+			continue
+		}
+
+		if err := r.removeAcceptRulesFromChain(table, chain); err != nil {
+			return err
+		}
+	}
+
+	return r.conn.Flush()
+}
+
+func (r *family) removeAcceptRulesFromChain(table *nftables.Table, chain *nftables.Chain) error {
+	rules, err := r.conn.GetRules(table, chain)
+	if err != nil {
+		return fmt.Errorf("get rules from %s/%s: %v", table.Name, chain.Name, err)
+	}
+
+	for _, rule := range rules {
+		if bytes.Equal(rule.UserData, []byte(userDataAcceptForwardRuleIif)) ||
+			bytes.Equal(rule.UserData, []byte(userDataAcceptForwardRuleOif)) ||
+			bytes.Equal(rule.UserData, []byte(userDataAcceptInputRule)) {
+			if err := r.conn.DelRule(rule); err != nil {
+				return fmt.Errorf("delete rule from %s/%s: %v", table.Name, chain.Name, err)
+			}
+		}
+	}
+	return nil
+}
+
+// removeExternalChainsRules removes our accept rules from all external chains.
+// This is deterministic - it scans for chains at removal time rather than relying on saved state,
+// ensuring cleanup works even after a crash or if chains changed.
+func (r *family) removeExternalChainsRules() error {
+	chains := r.findExternalChains()
+	if len(chains) == 0 {
+		return nil
+	}
+
+	var merr *multierror.Error
+	for _, chain := range chains {
+		if err := r.removeAcceptRulesFromChain(chain.Table, chain); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove rules from external chain %s/%s: %w", chain.Table.Name, chain.Name, err))
+			continue
+		}
+		if err := r.conn.Flush(); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("flush external chain %s/%s: %w", chain.Table.Name, chain.Name, err))
+		}
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// findExternalChains scans for chains from non-netbird tables that have FORWARD or INPUT hooks.
+// This is used both at startup (to know where to add rules) and at cleanup (to ensure deterministic removal).
+func (r *family) findExternalChains() []*nftables.Chain {
+	var chains []*nftables.Chain
+
+	families := []nftables.TableFamily{r.af.tableFamily, nftables.TableFamilyINet}
+
+	for _, family := range families {
+		allChains, err := r.conn.ListChainsOfTableFamily(family)
+		if err != nil {
+			log.Debugf("list chains for family %d: %v", family, err)
+			continue
+		}
+
+		for _, chain := range allChains {
+			if r.isExternalChain(chain) {
+				chains = append(chains, chain)
+			}
+		}
+	}
+
+	return chains
+}
+
+func (r *family) isExternalChain(chain *nftables.Chain) bool {
+	if r.workTable != nil && chain.Table.Name == r.workTable.Name {
+		return false
+	}
+
+	// Skip firewalld-owned chains. Firewalld creates its chains with the
+	// NFT_CHAIN_OWNER flag, so inserting rules into them returns EPERM.
+	// We delegate acceptance to firewalld by trusting the interface instead.
+	if chain.Table.Name == firewalldTableName {
+		return false
+	}
+
+	// Skip iptables/ip6tables-managed tables (adding nft-native rules breaks iptables-save compat)
+	if (chain.Table.Family == nftables.TableFamilyIPv4 || chain.Table.Family == nftables.TableFamilyIPv6) && isIptablesTable(chain.Table.Name) {
+		return false
+	}
+
+	if chain.Type != nftables.ChainTypeFilter {
+		return false
+	}
+
+	if chain.Hooknum == nil {
+		return false
+	}
+
+	return *chain.Hooknum == *nftables.ChainHookForward || *chain.Hooknum == *nftables.ChainHookInput
+}
+
+func isIptablesTable(name string) bool {
+	switch name {
+	case tableNameFilter, tableNat, tableMangle, tableRaw, tableSecurity:
+		return true
+	}
+	return false
+}
+
+func (r *family) removeAcceptFilterRulesIptables(ipt *iptables.IPTables) error {
+	var merr *multierror.Error
+
+	for _, rule := range r.getAcceptForwardRules() {
+		if err := ipt.DeleteIfExists("filter", chainNameForward, rule...); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove iptables forward rule: %v", err))
+		}
+	}
+
+	inputRule := r.getAcceptInputRule()
+	if err := ipt.DeleteIfExists("filter", chainNameInput, inputRule...); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove iptables input rule: %v", err))
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// Flush rule/chain/set operations from the buffer
+//
+// Method also get all rules after flush and refreshes handle values in the rulesets
+func (r *family) Flush() error {
+	if err := r.flushWithBackoff(); err != nil {
+		return err
+	}
+
+	if err := r.refreshRuleHandles(r.chainInputRules, false); err != nil {
+		log.Errorf("failed to refresh rule handles ipv4 input chain: %v", err)
+	}
+	if err := r.refreshRuleHandles(r.chainPrerouting, true); err != nil {
+		log.Errorf("failed to refresh rule handles prerouting chain: %v", err)
+	}
+
+	return nil
+}
+
+// queuePreroutingRule builds the prerouting mangle rule that marks
+// redirected traffic and queues it on the connection without flushing,
+// so the caller can commit it in the same transaction as the rule it
+// pairs with. Returns nil when the prerouting chain is absent, in which
+// case nothing is queued.
+func (r *family) queuePreroutingRule(expressions []expr.Any, userData []byte) *nftables.Rule {
+	if r.chainPrerouting == nil {
+		log.Warn("prerouting chain is not created")
+		return nil
+	}
+
+	preroutingExprs := slices.Clone(expressions)
+
+	// interface
+	preroutingExprs = append([]expr.Any{
+		&expr.Meta{
+			Key:      expr.MetaKeyIIFNAME,
+			Register: 1,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     ifname(r.wgIface.Name()),
+		},
+	}, preroutingExprs...)
+
+	// local destination and mark
+	preroutingExprs = append(preroutingExprs,
+		&expr.Fib{
+			Register:       1,
+			ResultADDRTYPE: true,
+			FlagDADDR:      true,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     binaryutil.NativeEndian.PutUint32(unix.RTN_LOCAL),
+		},
+
+		&expr.Immediate{
+			Register: 1,
+			Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkRedirected),
+		},
+		&expr.Meta{
+			Key:            expr.MetaKeyMARK,
+			Register:       1,
+			SourceRegister: true,
+		},
+	)
+
+	return r.conn.AddRule(&nftables.Rule{
+		Table:    r.workTable,
+		Chain:    r.chainPrerouting,
+		Exprs:    preroutingExprs,
+		UserData: userData,
+	})
+}
+
+func (r *family) createDefaultChains() (err error) {
+	// chainNameInputRules
+	chain := r.createChain(chainNameInputRules)
+	err = r.conn.Flush()
+	if err != nil {
+		log.Debugf("failed to create chain (%s): %s", chain.Name, err)
+		return fmt.Errorf(flushError, err)
+	}
+	r.chainInputRules = chain
+
+	// netbird-acl-input-filter
+	// type filter hook input priority filter; policy accept;
+	chain = r.createFilterChainWithHook(chainNameInputFilter, nftables.ChainHookInput)
+	r.addJumpRule(chain, r.chainInputRules.Name, expr.MetaKeyIIFNAME) // to netbird-acl-input-rules
+	r.addDropExpressions(chain, expr.MetaKeyIIFNAME)
+	err = r.conn.Flush()
+	if err != nil {
+		log.Debugf("failed to create chain (%s): %s", chain.Name, err)
+		return err
+	}
+
+	// netbird-acl-forward-filter
+	chainFwFilter := r.createFilterChainWithHook(chainNameForwardFilter, nftables.ChainHookForward)
+	r.addJumpRulesToRtForward(chainFwFilter) // to netbird-rt-fwd
+	r.addDropExpressions(chainFwFilter, expr.MetaKeyIIFNAME)
+
+	err = r.conn.Flush()
+	if err != nil {
+		log.Debugf("failed to create chain (%s): %s", chainNameForwardFilter, err)
+		return fmt.Errorf(flushError, err)
+	}
+
+	if err := r.allowRedirectedTraffic(chainFwFilter); err != nil {
+		log.Errorf("failed to allow redirected traffic: %s", err)
+	}
+
+	return nil
+}
+
+// Makes redirected traffic originally destined for the host itself (now subject to the forward filter)
+// go through the input filter as well. This will enable e.g. Docker services to keep working by accessing the
+// netbird peer IP.
+func (r *family) allowRedirectedTraffic(chainFwFilter *nftables.Chain) error {
+	r.chainPrerouting = r.chains[chainNameManglePrerouting]
+
+	r.addFwmarkToForward(chainFwFilter)
+
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf(flushError, err)
+	}
+
+	return nil
+}
+
+func (r *family) addFwmarkToForward(chainFwFilter *nftables.Chain) {
+	r.conn.InsertRule(&nftables.Rule{
+		Table: r.workTable,
+		Chain: chainFwFilter,
+		Exprs: []expr.Any{
+			&expr.Meta{
+				Key:      expr.MetaKeyMARK,
+				Register: 1,
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkRedirected),
+			},
+			&expr.Verdict{
+				Kind: expr.VerdictAccept,
+			},
+		},
+	})
+}
+
+func (r *family) addJumpRulesToRtForward(chainFwFilter *nftables.Chain) {
+	expressions := []expr.Any{
+		&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     ifname(r.wgIface.Name()),
+		},
+		&expr.Verdict{
+			Kind:  expr.VerdictJump,
+			Chain: r.routingFwChainName,
+		},
+	}
+
+	_ = r.conn.AddRule(&nftables.Rule{
+		Table: r.workTable,
+		Chain: chainFwFilter,
+		Exprs: expressions,
+	})
+}
+
+func (r *family) createChain(name string) *nftables.Chain {
+	chain := &nftables.Chain{
+		Name:  name,
+		Table: r.workTable,
+	}
+
+	chain = r.conn.AddChain(chain)
+
+	insertReturnTrafficRule(r.conn, r.workTable, chain)
+
+	return chain
+}
+
+func (r *family) createFilterChainWithHook(name string, hookNum *nftables.ChainHook) *nftables.Chain {
+	polAccept := nftables.ChainPolicyAccept
+	chain := &nftables.Chain{
+		Name:     name,
+		Table:    r.workTable,
+		Hooknum:  hookNum,
+		Priority: nftables.ChainPriorityFilter,
+		Type:     nftables.ChainTypeFilter,
+		Policy:   &polAccept,
+	}
+
+	return r.conn.AddChain(chain)
+}
+
+func (r *family) addDropExpressions(chain *nftables.Chain, ifaceKey expr.MetaKey) []expr.Any {
+	expressions := []expr.Any{
+		&expr.Meta{Key: ifaceKey, Register: 1},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     ifname(r.wgIface.Name()),
+		},
+		&expr.Verdict{Kind: expr.VerdictDrop},
+	}
+	_ = r.conn.AddRule(&nftables.Rule{
+		Table: r.workTable,
+		Chain: chain,
+		Exprs: expressions,
+	})
+	return nil
+}
+
+func (r *family) addJumpRule(chain *nftables.Chain, to string, ifaceKey expr.MetaKey) {
+	expressions := []expr.Any{
+		&expr.Meta{Key: ifaceKey, Register: 1},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     ifname(r.wgIface.Name()),
+		},
+		&expr.Verdict{
+			Kind:  expr.VerdictJump,
+			Chain: to,
+		},
+	}
+
+	_ = r.conn.AddRule(&nftables.Rule{
+		Table: chain.Table,
+		Chain: chain,
+		Exprs: expressions,
+	})
+}
+
+func (r *family) flushWithBackoff() (err error) {
+	backoff := 4
+	backoffTime := 1000 * time.Millisecond
+	for i := 0; ; i++ {
+		err = r.conn.Flush()
+		if err != nil {
+			log.Debugf("failed to flush nftables: %v", err)
+			if !strings.Contains(err.Error(), "busy") {
+				return
+			}
+			log.Error("failed to flush nftables, retrying...")
+			if i == backoff-1 {
+				return err
+			}
+			time.Sleep(backoffTime)
+			backoffTime *= 2
+			continue
+		}
+		break
+	}
+	return
+}
+
+func (r *family) refreshRuleHandles(chain *nftables.Chain, mangle bool) error {
+	if r.workTable == nil || chain == nil {
+		return nil
+	}
+
+	list, err := r.conn.GetRules(r.workTable, chain)
+	if err != nil {
+		return err
+	}
+
+	for _, rule := range list {
+		if len(rule.UserData) == 0 {
+			continue
+		}
+		pr, ok := r.filters[firewall.RuleID(rule.UserData)]
+		if !ok {
+			continue
+		}
+		if mangle {
+			if pr.mangleRule != nil {
+				*pr.mangleRule = *rule
+			}
+		} else {
+			*pr.nftRule = *rule
+		}
+	}
+
+	return nil
+}
diff --git a/client/firewall/nftables/dnat_linux.go b/client/firewall/nftables/dnat_linux.go
new file mode 100644
index 000000000..c179d60cc
--- /dev/null
+++ b/client/firewall/nftables/dnat_linux.go
@@ -0,0 +1,252 @@
+//go:build !android
+
+package nftables
+
+import (
+	"fmt"
+	"net/netip"
+
+	"github.com/google/nftables"
+	"github.com/google/nftables/binaryutil"
+	"github.com/google/nftables/expr"
+	log "github.com/sirupsen/logrus"
+
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+)
+
+func (r *family) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
+	ruleID := firewall.RuleID(fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
+
+	if _, exists := r.rules[ruleID]; exists {
+		return nil
+	}
+
+	protoNum, err := r.af.protoNum(protocol)
+	if err != nil {
+		return fmt.Errorf("convert protocol to number: %w", err)
+	}
+
+	exprs := []expr.Any{
+		&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     ifname(r.wgIface.Name()),
+		},
+		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 2},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 2,
+			Data:     []byte{protoNum},
+		},
+		&expr.Payload{
+			DestRegister: 3,
+			Base:         expr.PayloadBaseTransportHeader,
+			Offset:       2,
+			Len:          2,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 3,
+			Data:     binaryutil.BigEndian.PutUint16(originalPort),
+		},
+	}
+
+	bits := 32
+	if localAddr.Is6() {
+		bits = 128
+	}
+	exprs = append(exprs, prefixMatchExprs(r.af, netip.PrefixFrom(localAddr, bits), false)...)
+
+	exprs = append(exprs,
+		&expr.Immediate{
+			Register: 1,
+			Data:     localAddr.AsSlice(),
+		},
+		&expr.Immediate{
+			Register: 2,
+			Data:     binaryutil.BigEndian.PutUint16(translatedPort),
+		},
+		&expr.NAT{
+			Type:        expr.NATTypeDestNAT,
+			Family:      uint32(r.af.tableFamily),
+			RegAddrMin:  1,
+			RegProtoMin: 2,
+			RegProtoMax: 0,
+		},
+	)
+
+	dnatRule := &nftables.Rule{
+		Table:    r.workTable,
+		Chain:    r.chains[chainNameRoutingRdr],
+		Exprs:    exprs,
+		UserData: []byte(ruleID),
+	}
+	r.conn.AddRule(dnatRule)
+
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf("add inbound DNAT rule: %w", err)
+	}
+
+	r.rules[ruleID] = dnatRule
+
+	return nil
+}
+
+// RemoveInboundDNAT removes an inbound DNAT rule.
+func (r *family) RemoveInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
+	if err := r.refreshRulesMap(); err != nil {
+		return fmt.Errorf(refreshRulesMapError, err)
+	}
+
+	ruleID := firewall.RuleID(fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
+
+	rule, exists := r.rules[ruleID]
+	if !exists {
+		return nil
+	}
+
+	if rule.Handle == 0 {
+		log.Warnf("inbound DNAT rule %s has no handle, removing stale entry", ruleID)
+		delete(r.rules, ruleID)
+		return nil
+	}
+
+	if err := r.conn.DelRule(rule); err != nil {
+		return fmt.Errorf("delete inbound DNAT rule %s: %w", ruleID, err)
+	}
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf("flush delete inbound DNAT rule: %w", err)
+	}
+	delete(r.rules, ruleID)
+
+	return nil
+}
+
+// ensureNATOutputChain lazily creates the OUTPUT NAT chain on first use.
+func (r *family) ensureNATOutputChain() error {
+	if _, exists := r.chains[chainNameNATOutput]; exists {
+		return nil
+	}
+
+	r.chains[chainNameNATOutput] = r.conn.AddChain(&nftables.Chain{
+		Name:     chainNameNATOutput,
+		Table:    r.workTable,
+		Hooknum:  nftables.ChainHookOutput,
+		Priority: nftables.ChainPriorityNATDest,
+		Type:     nftables.ChainTypeNAT,
+	})
+
+	if err := r.conn.Flush(); err != nil {
+		delete(r.chains, chainNameNATOutput)
+		return fmt.Errorf("create NAT output chain: %w", err)
+	}
+	return nil
+}
+
+// AddOutputDNAT adds an OUTPUT chain DNAT rule for locally-generated traffic.
+func (r *family) AddOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
+	ruleID := firewall.RuleID(fmt.Sprintf("output-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
+
+	if _, exists := r.rules[ruleID]; exists {
+		return nil
+	}
+
+	if err := r.ensureNATOutputChain(); err != nil {
+		return err
+	}
+
+	protoNum, err := r.af.protoNum(protocol)
+	if err != nil {
+		return fmt.Errorf("convert protocol to number: %w", err)
+	}
+
+	exprs := []expr.Any{
+		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     []byte{protoNum},
+		},
+		&expr.Payload{
+			DestRegister: 2,
+			Base:         expr.PayloadBaseTransportHeader,
+			Offset:       2,
+			Len:          2,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 2,
+			Data:     binaryutil.BigEndian.PutUint16(originalPort),
+		},
+	}
+
+	bits := 32
+	if localAddr.Is6() {
+		bits = 128
+	}
+	exprs = append(exprs, prefixMatchExprs(r.af, netip.PrefixFrom(localAddr, bits), false)...)
+
+	exprs = append(exprs,
+		&expr.Immediate{
+			Register: 1,
+			Data:     localAddr.AsSlice(),
+		},
+		&expr.Immediate{
+			Register: 2,
+			Data:     binaryutil.BigEndian.PutUint16(translatedPort),
+		},
+		&expr.NAT{
+			Type:        expr.NATTypeDestNAT,
+			Family:      uint32(r.af.tableFamily),
+			RegAddrMin:  1,
+			RegProtoMin: 2,
+		},
+	)
+
+	dnatRule := &nftables.Rule{
+		Table:    r.workTable,
+		Chain:    r.chains[chainNameNATOutput],
+		Exprs:    exprs,
+		UserData: []byte(ruleID),
+	}
+	r.conn.AddRule(dnatRule)
+
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf("add output DNAT rule: %w", err)
+	}
+
+	r.rules[ruleID] = dnatRule
+
+	return nil
+}
+
+// RemoveOutputDNAT removes an OUTPUT chain DNAT rule.
+func (r *family) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
+	if err := r.refreshRulesMap(); err != nil {
+		return fmt.Errorf(refreshRulesMapError, err)
+	}
+
+	ruleID := firewall.RuleID(fmt.Sprintf("output-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
+
+	rule, exists := r.rules[ruleID]
+	if !exists {
+		return nil
+	}
+
+	if rule.Handle == 0 {
+		log.Warnf("output DNAT rule %s has no handle, removing stale entry", ruleID)
+		delete(r.rules, ruleID)
+		return nil
+	}
+
+	if err := r.conn.DelRule(rule); err != nil {
+		return fmt.Errorf("delete output DNAT rule %s: %w", ruleID, err)
+	}
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf("flush delete output DNAT rule: %w", err)
+	}
+	delete(r.rules, ruleID)
+
+	return nil
+}
diff --git a/client/firewall/nftables/family_linux.go b/client/firewall/nftables/family_linux.go
new file mode 100644
index 000000000..4169c9d2d
--- /dev/null
+++ b/client/firewall/nftables/family_linux.go
@@ -0,0 +1,241 @@
+//go:build !android
+
+package nftables
+
+import (
+	"fmt"
+	"net/netip"
+
+	"github.com/coreos/go-iptables/iptables"
+	"github.com/google/nftables"
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	"github.com/netbirdio/netbird/client/firewall/firewalld"
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/internal/routemanager/ipfwdstate"
+	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
+)
+
+const (
+	tableNat      = "nat"
+	tableMangle   = "mangle"
+	tableRaw      = "raw"
+	tableSecurity = "security"
+
+	chainNameRoutingFw     = "netbird-rt-fwd"
+	chainNameRoutingNat    = "netbird-rt-postrouting"
+	chainNameRoutingRdr    = "netbird-rt-redirect"
+	chainNameNATOutput     = "netbird-nat-output"
+	chainNameForward       = "FORWARD"
+	chainNameMangleForward = "netbird-mangle-forward"
+
+	// Peer ACL chain names.
+	chainNameInputRules        = "netbird-acl-input-rules"
+	chainNameInputFilter       = "netbird-acl-input-filter"
+	chainNameForwardFilter     = "netbird-acl-forward-filter"
+	chainNameManglePrerouting  = "netbird-mangle-prerouting"
+	chainNameManglePostrouting = "netbird-mangle-postrouting"
+
+	flushError = "flush: %w"
+
+	firewalldTableName = "firewalld"
+
+	userDataAcceptForwardRuleIif = "frwacceptiif"
+	userDataAcceptForwardRuleOif = "frwacceptoif"
+	userDataAcceptInputRule      = "inputaccept"
+
+	// ipv4TCPHeaderSize is the minimum IPv4 (20) + TCP (20) header size for MSS calculation.
+	ipv4TCPHeaderSize = 40
+	// ipv6TCPHeaderSize is the minimum IPv6 (40) + TCP (20) header size for MSS calculation.
+	ipv6TCPHeaderSize = 60
+
+	// maxPrefixesSet 1638 prefixes start to fail, taking some margin
+	maxPrefixesSet       = 1500
+	refreshRulesMapError = "refresh rules map: %w"
+)
+
+var (
+	errFilterTableNotFound = fmt.Errorf("'filter' table not found")
+)
+
+type setInput struct {
+	set      firewall.Set
+	prefixes []netip.Prefix
+}
+
+// family holds the per-address-family nftables state. One instance
+// handles route ACLs, peer ACLs, NAT, DNAT, and MSS clamping for a
+// single family; the top-level Manager owns one for v4 and another
+// for v6. The name predates the peer-ACL absorption; it's effectively
+// the per-family backend now.
+type family struct {
+	conn        *nftables.Conn
+	workTable   *nftables.Table
+	filterTable *nftables.Table
+	chains      map[string]*nftables.Chain
+
+	// filters holds peer + route filter rules keyed by content hash.
+	// AddFilterRule writes here; DeleteFilterRule looks up by id.
+	filters map[firewall.RuleID]*Rule
+
+	// rules holds NAT, DNAT, and external accept rules (auxiliary
+	// plumbing that isn't a filter rule).
+	rules map[firewall.RuleID]*nftables.Rule
+
+	// Peer ACL chain handles.
+	chainInputRules    *nftables.Chain
+	chainPrerouting    *nftables.Chain
+	routingFwChainName string
+
+	ipsetCounter *refcounter.Counter[string, setInput, *nftables.Set]
+
+	af               addrFamily
+	wgIface          iFaceMapper
+	ipFwdState       *ipfwdstate.IPForwardingState
+	legacyManagement bool
+	mtu              uint16
+}
+
+func newFamily(workTable *nftables.Table, wgIface iFaceMapper, mtu uint16) *family {
+	r := &family{
+		conn:               &nftables.Conn{},
+		workTable:          workTable,
+		chains:             make(map[string]*nftables.Chain),
+		filters:            make(map[firewall.RuleID]*Rule),
+		rules:              make(map[firewall.RuleID]*nftables.Rule),
+		routingFwChainName: chainNameRoutingFw,
+		af:                 familyForAddr(workTable.Family == nftables.TableFamilyIPv4),
+		wgIface:            wgIface,
+		ipFwdState:         ipfwdstate.NewIPForwardingState(wgIface.Name()),
+		mtu:                mtu,
+	}
+
+	r.ipsetCounter = refcounter.New(
+		r.createIpSet,
+		r.deleteIpSet,
+	)
+
+	var err error
+	r.filterTable, err = r.loadFilterTable()
+	if err != nil {
+		log.Debugf("ip filter table not found: %v", err)
+	}
+
+	return r
+}
+
+func (r *family) init(workTable *nftables.Table) error {
+	r.workTable = workTable
+
+	if err := r.removeAcceptFilterRules(); err != nil {
+		log.Errorf("failed to clean up rules from filter table: %s", err)
+	}
+
+	if err := r.createContainers(); err != nil {
+		return fmt.Errorf("create containers: %w", err)
+	}
+
+	if err := r.setupDataPlaneMark(); err != nil {
+		log.Errorf("failed to set up data plane mark: %v", err)
+	}
+
+	if err := r.createDefaultChains(); err != nil {
+		return fmt.Errorf("create default acl chains: %w", err)
+	}
+
+	return nil
+}
+
+// Reset cleans existing nftables filter table rules from the system
+func (r *family) Reset() error {
+	// clear without deleting the ipsets, the nf table will be deleted by the caller
+	r.ipsetCounter.Clear()
+
+	var merr *multierror.Error
+
+	if err := r.removeAcceptFilterRules(); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove accept filter rules: %w", err))
+	}
+
+	if err := firewalld.UntrustInterface(r.wgIface.Name()); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) loadFilterTable() (*nftables.Table, error) {
+	tables, err := r.conn.ListTablesOfFamily(r.af.tableFamily)
+	if err != nil {
+		return nil, fmt.Errorf("list tables: %w", err)
+	}
+
+	for _, table := range tables {
+		if table.Name == "filter" {
+			return table, nil
+		}
+	}
+
+	return nil, errFilterTableNotFound
+}
+
+func hookName(hook *nftables.ChainHook) string {
+	if hook == nil {
+		return "unknown"
+	}
+	switch *hook {
+	case *nftables.ChainHookForward:
+		return chainNameForward
+	case *nftables.ChainHookInput:
+		return chainNameInput
+	default:
+		return fmt.Sprintf("hook(%d)", *hook)
+	}
+}
+
+func familyName(family nftables.TableFamily) string {
+	switch family {
+	case nftables.TableFamilyIPv4:
+		return "ip"
+	case nftables.TableFamilyIPv6:
+		return "ip6"
+	case nftables.TableFamilyINet:
+		return "inet"
+	default:
+		return fmt.Sprintf("family(%d)", family)
+	}
+}
+
+func (r *family) iptablesProto() iptables.Protocol {
+	if r.af.tableFamily == nftables.TableFamilyIPv6 {
+		return iptables.ProtocolIPv6
+	}
+	return iptables.ProtocolIPv4
+}
+
+func (r *family) refreshRulesMap() error {
+	var merr *multierror.Error
+	newRules := make(map[firewall.RuleID]*nftables.Rule)
+	for _, chain := range r.chains {
+		rules, err := r.conn.GetRules(chain.Table, chain)
+		if err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("list rules for chain %s: %w", chain.Name, err))
+			// preserve existing entries for this chain since we can't verify their state
+			for k, v := range r.rules {
+				if v.Chain != nil && v.Chain.Name == chain.Name {
+					newRules[k] = v
+				}
+			}
+			continue
+		}
+		for _, rule := range rules {
+			if len(rule.UserData) > 0 {
+				newRules[firewall.RuleID(rule.UserData)] = rule
+			}
+		}
+	}
+	r.rules = newRules
+	return nberrors.FormatErrorOrNil(merr)
+}
diff --git a/client/firewall/nftables/filter_linux.go b/client/firewall/nftables/filter_linux.go
new file mode 100644
index 000000000..bb3ac1dfe
--- /dev/null
+++ b/client/firewall/nftables/filter_linux.go
@@ -0,0 +1,535 @@
+//go:build !android
+
+package nftables
+
+import (
+	"fmt"
+	"net"
+	"net/netip"
+	"slices"
+
+	"github.com/google/nftables"
+	"github.com/google/nftables/binaryutil"
+	"github.com/google/nftables/expr"
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	nbid "github.com/netbirdio/netbird/client/internal/acl/id"
+)
+
+// AddFilterRule installs one nftables packet-filter rule. With
+// destination empty the rule goes to the peer ACL input chain plus a
+// paired prerouting mangle rule for the redirect mark. With
+// destination set (prefix or named set) it goes to the route ACL
+// forward chain. Multi-source rules collapse to one nftables rule
+// backed by the shared refcounted hash:net set.
+func (r *family) AddFilterRule(
+	id []byte,
+	sources []netip.Prefix,
+	destination firewall.Network,
+	proto firewall.Protocol,
+	sPort *firewall.Port,
+	dPort *firewall.Port,
+	action firewall.Action,
+) (firewall.Rule, error) {
+	isRoute := !destination.IsZero()
+
+	ruleID := nbid.GenerateRuleID(sources, destination, proto, sPort, dPort, action)
+	if existing, ok := r.filters[ruleID]; ok {
+		return existing, nil
+	}
+
+	srcExprs, err := r.applyNetwork(sourceNetwork(sources), sources, true)
+	if err != nil {
+		return nil, fmt.Errorf("apply source: %w", err)
+	}
+
+	var exprs []expr.Any
+	if isRoute {
+		exprs, err = r.buildRouteFilterExprs(srcExprs, destination, proto, sPort, dPort)
+	} else {
+		exprs, err = r.buildPeerFilterExprs(srcExprs, proto, sPort, dPort)
+	}
+	if err != nil {
+		r.dropNetworkMatch(srcExprs)
+		return nil, err
+	}
+
+	mainExprs := slices.Clone(exprs)
+	verdict := expr.VerdictAccept
+	if action == firewall.ActionDrop {
+		verdict = expr.VerdictDrop
+	}
+	mainExprs = append(mainExprs, &expr.Verdict{Kind: verdict})
+
+	chain := r.chainInputRules
+	if isRoute {
+		chain = r.chains[chainNameRoutingFw]
+	}
+
+	userData := []byte(ruleID)
+
+	// Build the paired prerouting mangle rule before flushing so both
+	// rules commit in one transaction. An anonymous port set binds to
+	// exactly one rule, so the mangle rule needs its own expression list
+	// with fresh sets, not a clone of the main rule's. Guard on the
+	// prerouting chain first: building the expressions queues the port
+	// set, so skipping the build when there is no chain to bind it to
+	// keeps an unbound set out of the connection batch.
+	var mangleRule *nftables.Rule
+	if !isRoute && r.chainPrerouting != nil {
+		mangleExprs, err := r.buildPeerFilterExprs(srcExprs, proto, sPort, dPort)
+		if err != nil {
+			r.dropNetworkMatch(exprs)
+			return nil, fmt.Errorf("build mangle rule: %w", err)
+		}
+		mangleRule = r.queuePreroutingRule(mangleExprs, userData)
+	}
+
+	nftRule := &nftables.Rule{
+		Table:    r.workTable,
+		Chain:    chain,
+		Exprs:    mainExprs,
+		UserData: userData,
+	}
+	if action == firewall.ActionDrop {
+		nftRule = r.conn.InsertRule(nftRule)
+	} else {
+		nftRule = r.conn.AddRule(nftRule)
+	}
+	if err := r.conn.Flush(); err != nil {
+		r.dropNetworkMatch(exprs)
+		return nil, fmt.Errorf(flushError, err)
+	}
+
+	rule := &Rule{
+		nftRule:    nftRule,
+		mangleRule: mangleRule,
+		sources:    sources,
+		id:         ruleID,
+	}
+	r.filters[ruleID] = rule
+
+	log.Debugf("added filter rule: sources=%v, destination=%v, proto=%v, sPort=%v, dPort=%v, action=%v",
+		sources, destination, proto, sPort, dPort, action)
+	return rule, nil
+}
+
+// buildPeerFilterExprs assembles the input-chain (peer ACL) match: the
+// IP-header protocol byte read via Payload, then source, then ports
+// (no counter), matching the historical peer shape so per-rule kernel
+// state is identical to pre-unification.
+func (r *family) buildPeerFilterExprs(
+	srcExprs []expr.Any,
+	proto firewall.Protocol,
+	sPort, dPort *firewall.Port,
+) ([]expr.Any, error) {
+	var exprs []expr.Any
+
+	if proto != firewall.ProtocolALL {
+		protoNum, err := r.af.protoNum(proto)
+		if err != nil {
+			return nil, fmt.Errorf("convert protocol to number: %w", err)
+		}
+		exprs = append(exprs,
+			&expr.Payload{
+				DestRegister: 1,
+				Base:         expr.PayloadBaseNetworkHeader,
+				Offset:       r.af.protoOffset,
+				Len:          1,
+			},
+			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{protoNum}},
+		)
+	}
+	exprs = append(exprs, srcExprs...)
+
+	portExprs, err := r.applyPorts(sPort, dPort)
+	if err != nil {
+		return nil, err
+	}
+	exprs = append(exprs, portExprs...)
+	return exprs, nil
+}
+
+// buildRouteFilterExprs assembles the forward-chain (route ACL) match:
+// source, then destination, then optional proto/ports, then a counter.
+func (r *family) buildRouteFilterExprs(
+	srcExprs []expr.Any,
+	destination firewall.Network,
+	proto firewall.Protocol,
+	sPort, dPort *firewall.Port,
+) ([]expr.Any, error) {
+	exprs := append([]expr.Any{}, srcExprs...)
+
+	destExprs, err := r.applyNetwork(destination, nil, false)
+	if err != nil {
+		return nil, fmt.Errorf("apply destination: %w", err)
+	}
+	exprs = append(exprs, destExprs...)
+
+	if proto != firewall.ProtocolALL {
+		protoNum, err := r.af.protoNum(proto)
+		if err != nil {
+			r.dropNetworkMatch(destExprs)
+			return nil, fmt.Errorf("convert protocol to number: %w", err)
+		}
+		exprs = append(exprs,
+			&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
+			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{protoNum}},
+		)
+
+		portExprs, err := r.applyPorts(sPort, dPort)
+		if err != nil {
+			r.dropNetworkMatch(destExprs)
+			return nil, err
+		}
+		exprs = append(exprs, portExprs...)
+	}
+
+	exprs = append(exprs, &expr.Counter{})
+	return exprs, nil
+}
+
+func (r *family) hasRule(id firewall.RuleID) bool {
+	_, ok := r.filters[id]
+	return ok
+}
+
+// DeleteFilterRule removes a previously installed filter rule. Source
+// set references are recovered from the stored rule's expressions via
+// findSets and dropped from the shared refcounter.
+func (r *family) DeleteFilterRule(rule firewall.Rule) error {
+	ruleID := rule.ID()
+	pr, ok := r.filters[ruleID]
+	if !ok {
+		log.Debugf("filter rule %s not found", ruleID)
+		return nil
+	}
+
+	// A freshly added rule carries no handle until it is read back from
+	// the kernel, and Flush only refreshes the peer chains. Pull live
+	// handles for this rule's chain before deciding it is stale so route
+	// rules (which Flush never refreshes) can actually be deleted. A
+	// refresh failure aborts the delete without touching tracking state,
+	// so the caller can retry while the rule may still exist in the kernel.
+	if pr.nftRule.Handle == 0 {
+		if err := r.refreshRuleHandles(pr.nftRule.Chain, false); err != nil {
+			return fmt.Errorf("refresh handles for chain %s: %w", pr.nftRule.Chain.Name, err)
+		}
+	}
+	// Refresh the mangle handle independently: the main rule's handle can
+	// be populated while the prerouting refresh during Flush failed, and
+	// gating the mangle refresh on the main handle would leak the mangle
+	// rule on delete.
+	if pr.mangleRule != nil && pr.mangleRule.Handle == 0 {
+		if err := r.refreshRuleHandles(r.chainPrerouting, true); err != nil {
+			return fmt.Errorf("refresh mangle handles: %w", err)
+		}
+	}
+
+	if pr.nftRule.Handle == 0 {
+		log.Warnf("filter rule %s has no handle, removing stale entry", ruleID)
+		// The paired mangle rule can still be in the kernel with a live
+		// handle. Dropping the tracking entry without removing it would
+		// leave a prerouting rule that nothing can find again.
+		if err := r.deleteMangleRule(pr, ruleID); err != nil {
+			return err
+		}
+		r.dropNetworkMatch(pr.nftRule.Exprs)
+		delete(r.filters, ruleID)
+		return nil
+	}
+
+	if err := r.conn.DelRule(pr.nftRule); err != nil {
+		log.Errorf("queue rule delete: %v", err)
+	}
+	r.queueMangleDelete(pr)
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf("flush delete %s: %w", ruleID, err)
+	}
+
+	r.dropNetworkMatch(pr.nftRule.Exprs)
+	delete(r.filters, ruleID)
+	return nil
+}
+
+// deleteMangleRule removes the prerouting rule paired with a filter rule on
+// its own, for the paths that drop the filter rule's tracking without queueing
+// a delete for it.
+func (r *family) deleteMangleRule(pr *Rule, ruleID firewall.RuleID) error {
+	if pr.mangleRule == nil || pr.mangleRule.Handle == 0 {
+		return nil
+	}
+
+	r.queueMangleDelete(pr)
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf("flush mangle delete %s: %w", ruleID, err)
+	}
+	return nil
+}
+
+// queueMangleDelete queues the delete of the rule's prerouting counterpart, if
+// it has one. The caller commits it.
+func (r *family) queueMangleDelete(pr *Rule) {
+	if pr.mangleRule == nil {
+		return
+	}
+	if err := r.conn.DelRule(pr.mangleRule); err != nil {
+		log.Errorf("queue mangle rule delete: %v", err)
+	}
+}
+
+func (r *family) decrementSetCounter(rule *nftables.Rule) error {
+	if r.ipsetCounter == nil {
+		return nil
+	}
+	sets := findSets(rule)
+
+	var merr *multierror.Error
+	for _, setName := range sets {
+		if _, err := r.ipsetCounter.Decrement(setName); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("decrement set counter: %w", err))
+		}
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// dropNetworkMatch undoes whatever the source/destination match
+// reserved. Safe to call when the spec is empty or holds only inline
+// matchers.
+func (r *family) dropNetworkMatch(exprs []expr.Any) {
+	if r.ipsetCounter == nil {
+		return
+	}
+	for _, e := range exprs {
+		lookup, ok := e.(*expr.Lookup)
+		if !ok {
+			continue
+		}
+		if _, err := r.ipsetCounter.Decrement(lookup.SetName); err != nil {
+			log.Errorf("rollback ipset decrement %s: %v", lookup.SetName, err)
+		}
+	}
+}
+
+func (r *family) applyNetwork(
+	network firewall.Network,
+	setPrefixes []netip.Prefix,
+	isSource bool,
+) ([]expr.Any, error) {
+	if network.IsSet() {
+		exprs, err := r.getIpSet(network.Set, setPrefixes, isSource)
+		if err != nil {
+			side := "destination"
+			if isSource {
+				side = "source"
+			}
+			return nil, fmt.Errorf("%s set: %w", side, err)
+		}
+		return exprs, nil
+	}
+
+	if network.IsPrefix() {
+		return prefixMatchExprs(r.af, network.Prefix, isSource), nil
+	}
+
+	return nil, nil
+}
+
+// applyPort builds the transport-header port match. A single value
+// compares directly, a range uses a range expression, and multiple
+// values go through an anonymous constant set: consecutive cmp
+// expressions AND together, so chained equality comparisons could
+// never match more than one port. The set is queued on the
+// connection and committed by the caller's flush together with the
+// rule that binds it.
+func (r *family) applyPort(port *firewall.Port, isSource bool) ([]expr.Any, error) {
+	if port == nil || len(port.Values) == 0 {
+		return nil, nil
+	}
+
+	// dst port
+	offset := uint32(2)
+	if isSource {
+		// src port
+		offset = 0
+	}
+
+	exprs := []expr.Any{
+		&expr.Payload{
+			DestRegister: 1,
+			Base:         expr.PayloadBaseTransportHeader,
+			Offset:       offset,
+			Len:          2,
+		},
+	}
+
+	switch {
+	case port.IsRange && len(port.Values) == 2:
+		exprs = append(exprs, &expr.Range{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			FromData: binaryutil.BigEndian.PutUint16(port.Values[0]),
+			ToData:   binaryutil.BigEndian.PutUint16(port.Values[1]),
+		})
+	case len(port.Values) == 1:
+		exprs = append(exprs, &expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     binaryutil.BigEndian.PutUint16(port.Values[0]),
+		})
+	default:
+		lookup, err := r.anonymousPortSet(port.Values)
+		if err != nil {
+			return nil, err
+		}
+		exprs = append(exprs, lookup)
+	}
+
+	return exprs, nil
+}
+
+// anonymousPortSet queues an anonymous constant set holding the given
+// ports on the connection and returns a lookup against it. The set is
+// committed by the caller's flush together with the rule that binds it.
+func (r *family) anonymousPortSet(values []uint16) (*expr.Lookup, error) {
+	set := &nftables.Set{
+		Anonymous: true,
+		Constant:  true,
+		Table:     r.workTable,
+		KeyType:   nftables.TypeInetService,
+	}
+	elements := make([]nftables.SetElement, 0, len(values))
+	for _, p := range values {
+		elements = append(elements, nftables.SetElement{Key: binaryutil.BigEndian.PutUint16(p)})
+	}
+	if err := r.conn.AddSet(set, elements); err != nil {
+		return nil, fmt.Errorf("add anonymous port set: %w", err)
+	}
+	return &expr.Lookup{
+		SourceRegister: 1,
+		SetID:          set.ID,
+		SetName:        set.Name,
+	}, nil
+}
+
+// applyPorts builds the source then destination port matches.
+func (r *family) applyPorts(sPort, dPort *firewall.Port) ([]expr.Any, error) {
+	sPortExprs, err := r.applyPort(sPort, true)
+	if err != nil {
+		return nil, fmt.Errorf("apply source port: %w", err)
+	}
+
+	dPortExprs, err := r.applyPort(dPort, false)
+	if err != nil {
+		return nil, fmt.Errorf("apply destination port: %w", err)
+	}
+
+	return append(sPortExprs, dPortExprs...), nil
+}
+
+// prefixMatchExprs is the family-aware match sequence for a CIDR
+// prefix. /0 returns nil; a host prefix (full bit length for the
+// family) skips the bitwise step since the mask is all-ones. Shared
+// between family and aclManager so both treat single prefixes
+// identically.
+func prefixMatchExprs(af addrFamily, prefix netip.Prefix, isSource bool) []expr.Any {
+	offset := af.dstAddrOffset
+	if isSource {
+		offset = af.srcAddrOffset
+	}
+
+	ones := prefix.Bits()
+	if ones == 0 {
+		return nil
+	}
+
+	payload := &expr.Payload{
+		DestRegister: 1,
+		Base:         expr.PayloadBaseNetworkHeader,
+		Offset:       offset,
+		Len:          af.addrLen,
+	}
+	cmp := &expr.Cmp{
+		Op:       expr.CmpOpEq,
+		Register: 1,
+		Data:     prefix.Masked().Addr().AsSlice(),
+	}
+
+	if ones == af.totalBits {
+		return []expr.Any{payload, cmp}
+	}
+
+	mask := net.CIDRMask(ones, af.totalBits)
+	xor := make([]byte, af.addrLen)
+	return []expr.Any{
+		payload,
+		&expr.Bitwise{
+			DestRegister:   1,
+			SourceRegister: 1,
+			Len:            af.addrLen,
+			Mask:           mask,
+			Xor:            xor,
+		},
+		cmp,
+	}
+}
+
+func getCtNewExprs() []expr.Any {
+	return []expr.Any{
+		&expr.Ct{
+			Key:      expr.CtKeySTATE,
+			Register: 1,
+		},
+		&expr.Bitwise{
+			SourceRegister: 1,
+			DestRegister:   1,
+			Len:            4,
+			Mask:           binaryutil.NativeEndian.PutUint32(expr.CtStateBitNEW),
+			Xor:            binaryutil.NativeEndian.PutUint32(0),
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpNeq,
+			Register: 1,
+			Data:     []byte{0, 0, 0, 0},
+		},
+	}
+}
+
+// sourceNetwork classifies a source-prefix list into the firewall.Network
+// shape the rest of the spec-builder consumes: empty for match-any, a
+// single prefix inline, or an ipset for multiple sources.
+func sourceNetwork(sources []netip.Prefix) firewall.Network {
+	switch {
+	case len(sources) == 0:
+		return firewall.Network{}
+	case len(sources) == 1 && sources[0].Bits() == 0:
+		return firewall.Network{}
+	case len(sources) == 1:
+		return firewall.Network{Prefix: sources[0]}
+	default:
+		return firewall.Network{Set: firewall.NewPrefixSet(sources)}
+	}
+}
+
+func ifname(n string) []byte {
+	b := make([]byte, 16)
+	copy(b, n+"\x00")
+	return b
+}
+
+// findSets scans an nftables rule's expressions for expr.Lookup and
+// returns the named sets in occurrence order. Used at delete time to
+// drop ipsetCounter references; peer and route ACLs go through it.
+func findSets(rule *nftables.Rule) []string {
+	var sets []string
+	for _, e := range rule.Exprs {
+		if lookup, ok := e.(*expr.Lookup); ok {
+			sets = append(sets, lookup.SetName)
+		}
+	}
+	return sets
+}
diff --git a/client/firewall/nftables/interface_allower_integration_linux_test.go b/client/firewall/nftables/interface_allower_integration_linux_test.go
new file mode 100644
index 000000000..4d4bc6187
--- /dev/null
+++ b/client/firewall/nftables/interface_allower_integration_linux_test.go
@@ -0,0 +1,90 @@
+//go:build privileged
+
+package nftables
+
+import (
+	"bytes"
+	"os"
+	"testing"
+
+	"github.com/google/nftables"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/iface"
+)
+
+// TestInterfaceAllowerInputOnly verifies the userspace-mode allower opens the
+// interface on the INPUT hook of foreign chains only (not FORWARD, since the
+// userspace router never forwards in the kernel), creates no netbird work
+// table, and removes its rules on Close.
+func TestInterfaceAllowerInputOnly(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("root required")
+	}
+
+	require.False(t, ipTableExists(t, getTableName()), "precondition: no stale netbird table")
+
+	conn := &nftables.Conn{}
+	extTable := conn.AddTable(&nftables.Table{Name: "nbtest_extchains", Family: nftables.TableFamilyINet})
+	inputChain := conn.AddChain(&nftables.Chain{
+		Name: "ext_input", Table: extTable,
+		Hooknum: nftables.ChainHookInput, Priority: nftables.ChainPriorityFilter, Type: nftables.ChainTypeFilter,
+	})
+	forwardChain := conn.AddChain(&nftables.Chain{
+		Name: "ext_forward", Table: extTable,
+		Hooknum: nftables.ChainHookForward, Priority: nftables.ChainPriorityFilter, Type: nftables.ChainTypeFilter,
+	})
+	require.NoError(t, conn.Flush(), "create external table and chains")
+	t.Cleanup(func() {
+		c := &nftables.Conn{}
+		c.DelTable(extTable)
+		_ = c.Flush()
+	})
+
+	allower, err := NewInterfaceAllower(ifaceMock, iface.DefaultMTU)
+	require.NoError(t, err, "create allower")
+	require.NoError(t, allower.Apply(), "apply")
+
+	require.True(t, chainHasUserData(t, extTable, inputChain, userDataAcceptInputRule),
+		"external INPUT chain should get the accept rule")
+	require.Len(t, listRules(t, extTable, forwardChain), 0,
+		"external FORWARD chain must not be opened in userspace mode")
+	require.False(t, ipTableExists(t, getTableName()),
+		"allower must not create a netbird work table")
+
+	require.NoError(t, allower.Close(), "close")
+	require.False(t, chainHasUserData(t, extTable, inputChain, userDataAcceptInputRule),
+		"accept rule should be removed on close")
+}
+
+func listRules(t *testing.T, table *nftables.Table, chain *nftables.Chain) []*nftables.Rule {
+	t.Helper()
+	c := &nftables.Conn{}
+	rules, err := c.GetRules(table, chain)
+	require.NoError(t, err)
+	return rules
+}
+
+func chainHasUserData(t *testing.T, table *nftables.Table, chain *nftables.Chain, ud string) bool {
+	for _, r := range listRules(t, table, chain) {
+		if bytes.Equal(r.UserData, []byte(ud)) {
+			return true
+		}
+	}
+	return false
+}
+
+func ipTableExists(t *testing.T, name string) bool {
+	t.Helper()
+	c := &nftables.Conn{}
+	for _, fam := range []nftables.TableFamily{nftables.TableFamilyIPv4, nftables.TableFamilyIPv6} {
+		tbls, err := c.ListTablesOfFamily(fam)
+		require.NoError(t, err)
+		for _, tb := range tbls {
+			if tb.Name == name {
+				return true
+			}
+		}
+	}
+	return false
+}
diff --git a/client/firewall/nftables/interface_allower_linux.go b/client/firewall/nftables/interface_allower_linux.go
new file mode 100644
index 000000000..e7232e2bf
--- /dev/null
+++ b/client/firewall/nftables/interface_allower_linux.go
@@ -0,0 +1,107 @@
+package nftables
+
+import (
+	"fmt"
+
+	"github.com/google/nftables"
+	"github.com/hashicorp/go-multierror"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+)
+
+// InterfaceAllower opens the NetBird interface in the kernel's filter table and
+// external chains and keeps them reconciled via a netlink monitor, so the host
+// firewall doesn't drop traffic the NetBird firewall handles. It is used by the
+// userspace firewall, where routing happens in the forwarder, so only INPUT is
+// opened (the userspace router never forwards in the kernel).
+//
+// It owns its own families/connection and never creates a netbird work table.
+// firewalld trust is handled by the caller, not here. Its operations are serial
+// (Apply before the monitor starts; reconciles run on the single monitor
+// goroutine; Close stops the monitor before removing), so it needs no locking.
+//
+// TODO: this opens nftables and the iptables-nft filter table (detected via
+// nft), but not a legacy-iptables ruleset running in parallel with nftables.
+// Such a host would keep its legacy filter chains closed for the interface.
+type InterfaceAllower struct {
+	family4    *family
+	family6    *family
+	extMonitor *externalChainMonitor
+}
+
+// NewInterfaceAllower builds an allower for the given interface. It returns an
+// error when nftables is unavailable (e.g. an iptables-legacy host), so the
+// caller can fall back to firewalld trust.
+func NewInterfaceAllower(wgIface iFaceMapper, mtu uint16) (*InterfaceAllower, error) {
+	tableName := getTableName()
+
+	family4 := newFamily(&nftables.Table{Name: tableName, Family: nftables.TableFamilyIPv4}, wgIface, mtu)
+
+	// Probe nftables availability before committing to this backend.
+	if _, err := family4.conn.ListChainsOfTableFamily(nftables.TableFamilyINet); err != nil {
+		return nil, fmt.Errorf("nftables not available: %w", err)
+	}
+
+	a := &InterfaceAllower{family4: family4}
+
+	if wgIface.Address().HasIPv6() {
+		a.family6 = newFamily(&nftables.Table{Name: tableName, Family: nftables.TableFamilyIPv6}, wgIface, mtu)
+	}
+
+	a.extMonitor = newExternalChainMonitor(a)
+	return a, nil
+}
+
+// Apply opens the interface (INPUT only) in the foreign filter chains and starts
+// reconciling them on nftables changes.
+func (a *InterfaceAllower) Apply() error {
+	var merr *multierror.Error
+	for _, f := range a.families() {
+		// Remove any stale accepts first so a prior unclean exit (e.g. SIGKILL,
+		// where Close never ran) is recovered deterministically rather than
+		// accumulating duplicate rules on the iptables filter table.
+		if err := f.removeAcceptFilterRules(); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("clean stale accept rules: %w", err))
+		}
+		if err := f.openInterface(false); err != nil {
+			merr = multierror.Append(merr, err)
+		}
+	}
+
+	a.extMonitor.start()
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// families returns the configured address families (v4, and v6 when present).
+func (a *InterfaceAllower) families() []*family {
+	families := []*family{a.family4}
+	if a.family6 != nil {
+		families = append(families, a.family6)
+	}
+	return families
+}
+
+// reconcileExternalChains re-applies the INPUT accepts to external chains. It
+// implements externalChainReconciler for the monitor.
+func (a *InterfaceAllower) reconcileExternalChains() error {
+	var merr *multierror.Error
+	for _, f := range a.families() {
+		if err := f.acceptExternalChainsRules(false); err != nil {
+			merr = multierror.Append(merr, err)
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// Close stops the monitor and removes the accept rules.
+func (a *InterfaceAllower) Close() error {
+	a.extMonitor.stop()
+
+	var merr *multierror.Error
+	for _, f := range a.families() {
+		if err := f.removeAcceptFilterRules(); err != nil {
+			merr = multierror.Append(merr, err)
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
diff --git a/client/firewall/nftables/ipset_linux.go b/client/firewall/nftables/ipset_linux.go
new file mode 100644
index 000000000..34783bbeb
--- /dev/null
+++ b/client/firewall/nftables/ipset_linux.go
@@ -0,0 +1,210 @@
+//go:build !android
+
+package nftables
+
+import (
+	"encoding/binary"
+	"fmt"
+	"net/netip"
+
+	"github.com/google/nftables"
+	"github.com/google/nftables/expr"
+	log "github.com/sirupsen/logrus"
+
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
+)
+
+func (r *family) getIpSet(set firewall.Set, prefixes []netip.Prefix, isSource bool) ([]expr.Any, error) {
+	ref, err := r.ipsetCounter.Increment(set.HashedName(), setInput{
+		set:      set,
+		prefixes: prefixes,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("create or get ipset: %w", err)
+	}
+
+	return r.getIpSetExprs(ref, isSource)
+}
+
+func (r *family) createIpSet(setName string, input setInput) (*nftables.Set, error) {
+	// overlapping prefixes will result in an error, so we need to merge them
+	prefixes := firewall.MergeIPRanges(input.prefixes)
+
+	nfset := &nftables.Set{
+		Name:    setName,
+		Comment: input.set.Comment(),
+		Table:   r.workTable,
+		// required for prefixes
+		Interval: true,
+		KeyType:  r.af.setKeyType,
+	}
+
+	elements := r.convertPrefixesToSet(prefixes)
+	nElements := len(elements)
+
+	maxElements := maxPrefixesSet * 2
+	initialElements := elements[:min(maxElements, nElements)]
+
+	if err := r.conn.AddSet(nfset, initialElements); err != nil {
+		return nil, fmt.Errorf("error adding set %s: %w", setName, err)
+	}
+	if err := r.conn.Flush(); err != nil {
+		return nil, fmt.Errorf("flush error: %w", err)
+	}
+	log.Debugf("Created new ipset: %s with %d initial prefixes (total prefixes %d)", setName, len(initialElements)/2, len(prefixes))
+
+	// The set is committed now. If a later batch fails, destroy it: the
+	// refcounter records nothing on a create-callback error, so it would
+	// otherwise leak, and a partial source set fails-open for deny rules.
+	if err := r.addRemainingElements(nfset, elements, maxElements); err != nil {
+		if derr := r.deleteIpSet(setName, nfset); derr != nil {
+			log.Warnf("rollback ipset %s after add failure: %v", setName, derr)
+		}
+		return nil, err
+	}
+
+	log.Infof("Created new ipset: %s with %d prefixes", setName, len(prefixes))
+	return nfset, nil
+}
+
+// addRemainingElements adds element batches beyond the initial one in
+// maxElements-sized chunks, flushing each. Called after the set has been
+// created with its first batch.
+func (r *family) addRemainingElements(nfset *nftables.Set, elements []nftables.SetElement, maxElements int) error {
+	nElements := len(elements)
+	for subStart := maxElements; subStart < nElements; subStart += maxElements {
+		subEnd := min(subStart+maxElements, nElements)
+		subElement := elements[subStart:subEnd]
+		nSubPrefixes := len(subElement) / 2
+		log.Tracef("Adding new prefixes (%d) in ipset: %s", nSubPrefixes, nfset.Name)
+		if err := r.conn.SetAddElements(nfset, subElement); err != nil {
+			return fmt.Errorf("error adding prefixes (%d) to set %s: %w", nSubPrefixes, nfset.Name, err)
+		}
+		if err := r.conn.Flush(); err != nil {
+			return fmt.Errorf("flush error: %w", err)
+		}
+		log.Debugf("Added new prefixes (%d) in ipset: %s", nSubPrefixes, nfset.Name)
+	}
+	return nil
+}
+
+func (r *family) convertPrefixesToSet(prefixes []netip.Prefix) []nftables.SetElement {
+	var elements []nftables.SetElement
+	for _, prefix := range prefixes {
+		// nftables needs half-open intervals [firstIP, lastIP) for prefixes
+		// e.g. 10.0.0.0/24 becomes [10.0.0.0, 10.0.1.0), 10.1.1.1/32 becomes [10.1.1.1, 10.1.1.2) etc
+		firstIP := prefix.Addr()
+
+		// For a /0 the last address is the broadcast and its Next() overflows
+		// to an invalid Addr with an empty key, so wrap to the zero address,
+		// which nftables reads as the open end of a full-range interval.
+		var lastKey []byte
+		if prefix.Bits() == 0 {
+			lastKey = make([]byte, r.af.addrLen)
+		} else {
+			lastKey = calculateLastIP(prefix).Next().AsSlice()
+		}
+
+		// the nft tool also adds a zero-address IntervalEnd element, see https://github.com/google/nftables/issues/247
+		// nftables.SetElement{Key: make([]byte, r.af.addrLen), IntervalEnd: true},
+		elements = append(elements,
+			nftables.SetElement{Key: firstIP.AsSlice()},
+			nftables.SetElement{Key: lastKey, IntervalEnd: true},
+		)
+	}
+	return elements
+}
+
+// calculateLastIP determines the last IP in a given prefix.
+func calculateLastIP(prefix netip.Prefix) netip.Addr {
+	masked := prefix.Masked()
+	if masked.Addr().Is4() {
+		hostMask := ^uint32(0) >> masked.Bits()
+		lastIP := uint32FromNetipAddr(masked.Addr()) | hostMask
+		return netip.AddrFrom4(uint32ToBytes(lastIP))
+	}
+
+	// IPv6: set host bits to all 1s
+	b := masked.Addr().As16()
+	bits := masked.Bits()
+	for i := bits; i < 128; i++ {
+		b[i/8] |= 1 << (7 - i%8)
+	}
+	return netip.AddrFrom16(b)
+}
+
+// Utility function to convert netip.Addr to uint32.
+func uint32FromNetipAddr(addr netip.Addr) uint32 {
+	b := addr.As4()
+	return binary.BigEndian.Uint32(b[:])
+}
+
+// Utility function to convert uint32 to a netip-compatible byte slice.
+func uint32ToBytes(ip uint32) [4]byte {
+	var b [4]byte
+	binary.BigEndian.PutUint32(b[:], ip)
+	return b
+}
+
+func (r *family) deleteIpSet(setName string, nfset *nftables.Set) error {
+	r.conn.DelSet(nfset)
+	if err := r.conn.Flush(); err != nil {
+		return fmt.Errorf(flushError, err)
+	}
+
+	log.Debugf("Deleted unused ipset %s", setName)
+	return nil
+}
+
+func (r *family) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
+	nfset, err := r.conn.GetSetByName(r.workTable, set.HashedName())
+	if err != nil {
+		return fmt.Errorf("get set %s: %w", set.HashedName(), err)
+	}
+
+	// Overlapping prefixes (e.g. duplicate resolved addresses) make the
+	// interval set reject the batch, so merge them as createIpSet does.
+	prefixes = firewall.MergeIPRanges(prefixes)
+	elements := r.convertPrefixesToSet(prefixes)
+
+	// Add in batches sized like createIpSet so a large update does not
+	// exceed the netlink message size limit.
+	maxElements := maxPrefixesSet * 2
+	for start := 0; start < len(elements); start += maxElements {
+		end := min(start+maxElements, len(elements))
+		if err := r.conn.SetAddElements(nfset, elements[start:end]); err != nil {
+			return fmt.Errorf("add elements to set %s: %w", set.HashedName(), err)
+		}
+		if err := r.conn.Flush(); err != nil {
+			return fmt.Errorf(flushError, err)
+		}
+	}
+
+	log.Debugf("updated set %s with %d prefixes", set.HashedName(), len(prefixes))
+
+	return nil
+}
+
+func (r *family) getIpSetExprs(ref refcounter.Ref[*nftables.Set], isSource bool) ([]expr.Any, error) {
+	// dst offset by default
+	offset := r.af.dstAddrOffset
+	if isSource {
+		// src offset
+		offset = r.af.srcAddrOffset
+	}
+
+	return []expr.Any{
+		&expr.Payload{
+			DestRegister: 1,
+			Base:         expr.PayloadBaseNetworkHeader,
+			Offset:       offset,
+			Len:          r.af.addrLen,
+		},
+		&expr.Lookup{
+			SourceRegister: 1,
+			SetName:        ref.Out.Name,
+			SetID:          ref.Out.ID,
+		},
+	}, nil
+}
diff --git a/client/firewall/nftables/ipset_linux_test.go b/client/firewall/nftables/ipset_linux_test.go
new file mode 100644
index 000000000..7ab2f6c3f
--- /dev/null
+++ b/client/firewall/nftables/ipset_linux_test.go
@@ -0,0 +1,36 @@
+package nftables
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestConvertPrefixesToSetWildcard verifies that a /0 prefix produces a
+// usable interval. The last address of a /0 is the broadcast, whose Next()
+// overflows to an invalid Addr with an empty key; the IntervalEnd must wrap
+// to the zero address instead so nftables sees a full-range interval.
+func TestConvertPrefixesToSetWildcard(t *testing.T) {
+	tests := []struct {
+		name   string
+		af     addrFamily
+		prefix string
+	}{
+		{"IPv4 /0", afIPv4, "0.0.0.0/0"},
+		{"IPv6 /0", afIPv6, "::/0"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &family{af: tt.af}
+			elements := r.convertPrefixesToSet([]netip.Prefix{netip.MustParsePrefix(tt.prefix)})
+
+			require.Len(t, elements, 2, "expected start and interval-end element")
+			assert.False(t, elements[0].IntervalEnd, "first element is the interval start")
+			assert.True(t, elements[1].IntervalEnd, "second element is the interval end")
+			assert.Len(t, elements[1].Key, int(tt.af.addrLen), "interval-end key must be a zero address, not empty")
+		})
+	}
+}
diff --git a/client/firewall/nftables/ipsetstore_linux.go b/client/firewall/nftables/ipsetstore_linux.go
deleted file mode 100644
index a6c2e9496..000000000
--- a/client/firewall/nftables/ipsetstore_linux.go
+++ /dev/null
@@ -1,85 +0,0 @@
-package nftables
-
-import (
-	"net"
-)
-
-type ipsetStore struct {
-	ipsetReference map[string]int
-	ipsets         map[string]map[string]struct{} // ipsetName -> list of ips
-}
-
-func newIpsetStore() *ipsetStore {
-	return &ipsetStore{
-		ipsetReference: make(map[string]int),
-		ipsets:         make(map[string]map[string]struct{}),
-	}
-}
-
-func (s *ipsetStore) ips(ipsetName string) (map[string]struct{}, bool) {
-	r, ok := s.ipsets[ipsetName]
-	return r, ok
-}
-
-func (s *ipsetStore) newIpset(ipsetName string) map[string]struct{} {
-	s.ipsetReference[ipsetName] = 0
-	ipList := make(map[string]struct{})
-	s.ipsets[ipsetName] = ipList
-	return ipList
-}
-
-func (s *ipsetStore) deleteIpset(ipsetName string) {
-	delete(s.ipsetReference, ipsetName)
-	delete(s.ipsets, ipsetName)
-}
-
-func (s *ipsetStore) DeleteIpFromSet(ipsetName string, ip net.IP) {
-	ipList, ok := s.ipsets[ipsetName]
-	if !ok {
-		return
-	}
-	delete(ipList, ip.String())
-}
-
-func (s *ipsetStore) AddIpToSet(ipsetName string, ip net.IP) {
-	ipList, ok := s.ipsets[ipsetName]
-	if !ok {
-		return
-	}
-	ipList[ip.String()] = struct{}{}
-}
-
-func (s *ipsetStore) IsIpInSet(ipsetName string, ip net.IP) bool {
-	ipList, ok := s.ipsets[ipsetName]
-	if !ok {
-		return false
-	}
-	_, ok = ipList[ip.String()]
-	return ok
-}
-
-func (s *ipsetStore) AddReferenceToIpset(ipsetName string) {
-	s.ipsetReference[ipsetName]++
-}
-
-func (s *ipsetStore) DeleteReferenceFromIpSet(ipsetName string) {
-	r, ok := s.ipsetReference[ipsetName]
-	if !ok {
-		return
-	}
-	if r == 0 {
-		return
-	}
-	s.ipsetReference[ipsetName]--
-}
-
-func (s *ipsetStore) HasReferenceToSet(ipsetName string) bool {
-	if _, ok := s.ipsetReference[ipsetName]; !ok {
-		return false
-	}
-	if s.ipsetReference[ipsetName] == 0 {
-		return false
-	}
-
-	return true
-}
diff --git a/client/firewall/nftables/legacy_rule_linux_test.go b/client/firewall/nftables/legacy_rule_linux_test.go
new file mode 100644
index 000000000..dc2f1c7a0
--- /dev/null
+++ b/client/firewall/nftables/legacy_rule_linux_test.go
@@ -0,0 +1,60 @@
+package nftables
+
+import (
+	"testing"
+
+	"github.com/google/nftables/expr"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildLegacyRouteRuleExpressions(t *testing.T) {
+	sourcePayload := &expr.Payload{}
+	sourceCmp := &expr.Cmp{}
+	destinationPayload := &expr.Payload{}
+	destinationCmp := &expr.Cmp{}
+	nilSourceDestination := &expr.Payload{}
+	nilDestinationSource := &expr.Cmp{}
+
+	tests := []struct {
+		name        string
+		source      []expr.Any
+		destination []expr.Any
+		matches     []expr.Any
+	}{
+		{
+			name:        "both non-empty",
+			source:      []expr.Any{sourcePayload, sourceCmp},
+			destination: []expr.Any{destinationPayload, destinationCmp},
+			matches:     []expr.Any{sourcePayload, sourceCmp, destinationPayload, destinationCmp},
+		},
+		{
+			name:        "nil source",
+			destination: []expr.Any{nilSourceDestination},
+			matches:     []expr.Any{nilSourceDestination},
+		},
+		{
+			name:    "nil destination",
+			source:  []expr.Any{nilDestinationSource},
+			matches: []expr.Any{nilDestinationSource},
+		},
+		{
+			name: "both nil",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := buildLegacyRouteRuleExpressions(tt.source, tt.destination)
+
+			require.Len(t, got, len(tt.matches)+2)
+			for i, match := range tt.matches {
+				require.Same(t, match, got[i])
+			}
+
+			require.IsType(t, &expr.Counter{}, got[len(tt.matches)])
+			verdict, ok := got[len(tt.matches)+1].(*expr.Verdict)
+			require.True(t, ok)
+			require.Equal(t, expr.VerdictAccept, verdict.Kind)
+		})
+	}
+}
diff --git a/client/firewall/nftables/manager_linux.go b/client/firewall/nftables/manager_linux.go
index fdc7c2f3c..75405e213 100644
--- a/client/firewall/nftables/manager_linux.go
+++ b/client/firewall/nftables/manager_linux.go
@@ -3,7 +3,6 @@ package nftables
 import (
 	"context"
 	"fmt"
-	"net"
 	"net/netip"
 	"os"
 	"sync"
@@ -13,10 +12,8 @@ import (
 	"github.com/google/nftables/expr"
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/client/firewall/firewalld"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
@@ -45,21 +42,17 @@ type iFaceMapper interface {
 	Address() wgaddr.Address
 }
 
-// Manager of iptables firewall
+// Manager of nftables firewall. Per-family state (peer ACLs, route
+// ACLs, NAT, DNAT, MSS clamping) lives on family; Manager dispatches
+// by family and provides the public firewall.Manager surface.
 type Manager struct {
 	mutex   sync.Mutex
 	rConn   *nftables.Conn
 	wgIface iFaceMapper
 
-	router     *router
-	aclManager *AclManager
-
-	// IPv6 counterparts, nil when no v6 overlay
-	router6     *router
-	aclManager6 *AclManager
-
-	notrackOutputChain     *nftables.Chain
-	notrackPreroutingChain *nftables.Chain
+	family4 *family
+	// IPv6 counterpart, nil when no v6 overlay.
+	family6 *family
 
 	extMonitor *externalChainMonitor
 }
@@ -74,21 +67,10 @@ func Create(wgIface iFaceMapper, mtu uint16) (*Manager, error) {
 	tableName := getTableName()
 	workTable := &nftables.Table{Name: tableName, Family: nftables.TableFamilyIPv4}
 
-	var err error
-	m.router, err = newRouter(workTable, wgIface, mtu)
-	if err != nil {
-		return nil, fmt.Errorf("create router: %w", err)
-	}
-
-	m.aclManager, err = newAclManager(workTable, wgIface, chainNameRoutingFw)
-	if err != nil {
-		return nil, fmt.Errorf("create acl manager: %w", err)
-	}
+	m.family4 = newFamily(workTable, wgIface, mtu)
 
 	if wgIface.Address().HasIPv6() {
-		if err := m.createIPv6Components(tableName, wgIface, mtu); err != nil {
-			return nil, fmt.Errorf("create IPv6 firewall: %w", err)
-		}
+		m.createIPv6Components(tableName, wgIface, mtu)
 	}
 
 	m.extMonitor = newExternalChainMonitor(m)
@@ -96,30 +78,19 @@ func Create(wgIface iFaceMapper, mtu uint16) (*Manager, error) {
 	return m, nil
 }
 
-func (m *Manager) createIPv6Components(tableName string, wgIface iFaceMapper, mtu uint16) error {
+func (m *Manager) createIPv6Components(tableName string, wgIface iFaceMapper, mtu uint16) {
 	workTable6 := &nftables.Table{Name: tableName, Family: nftables.TableFamilyIPv6}
 
-	var err error
-	m.router6, err = newRouter(workTable6, wgIface, mtu)
-	if err != nil {
-		return fmt.Errorf("create v6 router: %w", err)
-	}
+	m.family6 = newFamily(workTable6, wgIface, mtu)
 
-	// Share the same IP forwarding state with the v4 router, since
-	// EnableIPForwarding controls both v4 and v6 sysctls.
-	m.router6.ipFwdState = m.router.ipFwdState
-
-	m.aclManager6, err = newAclManager(workTable6, wgIface, chainNameRoutingFw)
-	if err != nil {
-		return fmt.Errorf("create v6 acl manager: %w", err)
-	}
-
-	return nil
+	// Share the per-family forwarding refcounter with the v4 family so a v4
+	// rule and a v6 rule against the same state machine cooperate cleanly.
+	m.family6.ipFwdState = m.family4.ipFwdState
 }
 
 // hasIPv6 reports whether the manager has IPv6 components initialized.
 func (m *Manager) hasIPv6() bool {
-	return m.router6 != nil
+	return m.family6 != nil
 }
 
 func (m *Manager) initIPv6() error {
@@ -128,12 +99,8 @@ func (m *Manager) initIPv6() error {
 		return fmt.Errorf("create v6 work table: %w", err)
 	}
 
-	if err := m.router6.init(workTable6); err != nil {
-		return fmt.Errorf("v6 router init: %w", err)
-	}
-
-	if err := m.aclManager6.init(workTable6); err != nil {
-		return fmt.Errorf("v6 acl manager init: %w", err)
+	if err := m.family6.init(workTable6); err != nil {
+		return fmt.Errorf("v6 family init: %w", err)
 	}
 
 	return nil
@@ -156,19 +123,20 @@ func (m *Manager) Init(stateManager *statemanager.Manager) error {
 
 // reconcileExternalChains re-applies passthrough accept rules to external
 // filter chains for both IPv4 and IPv6 routers. Called by the monitor when
-// tables or chains appear (e.g. after firewalld reloads).
+// tables or chains appear (e.g. after firewalld reloads). Kernel routing opens
+// both INPUT and FORWARD.
 func (m *Manager) reconcileExternalChains() error {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
 	var merr *multierror.Error
-	if m.router != nil {
-		if err := m.router.acceptExternalChainsRules(); err != nil {
+	if m.family4 != nil {
+		if err := m.family4.acceptExternalChainsRules(true); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("v4: %w", err))
 		}
 	}
 	if m.hasIPv6() {
-		if err := m.router6.acceptExternalChainsRules(); err != nil {
+		if err := m.family6.acceptExternalChainsRules(true); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("v6: %w", err))
 		}
 	}
@@ -187,12 +155,8 @@ func (m *Manager) initFirewall() (err error) {
 		}
 	}()
 
-	if err := m.router.init(workTable); err != nil {
-		return fmt.Errorf("router init: %w", err)
-	}
-
-	if err := m.aclManager.init(workTable); err != nil {
-		return fmt.Errorf("acl manager init: %w", err)
+	if err := m.family4.init(workTable); err != nil {
+		return fmt.Errorf("family init: %w", err)
 	}
 
 	if m.hasIPv6() {
@@ -202,10 +166,6 @@ func (m *Manager) initFirewall() (err error) {
 		}
 	}
 
-	if err := m.initNoTrackChains(workTable); err != nil {
-		log.Warnf("raw priority chains not available, notrack rules will be disabled: %v", err)
-	}
-
 	return nil
 }
 
@@ -220,7 +180,7 @@ func (m *Manager) persistState(stateManager *statemanager.Manager) {
 		InterfaceState: &InterfaceState{
 			NameStr:   m.wgIface.Name(),
 			WGAddress: m.wgIface.Address(),
-			MTU:       m.router.mtu,
+			MTU:       m.family4.mtu,
 		},
 	}); err != nil {
 		log.Errorf("failed to update state: %v", err)
@@ -235,12 +195,12 @@ func (m *Manager) persistState(stateManager *statemanager.Manager) {
 
 // rollbackInit performs best-effort cleanup of already-initialized state when Init fails partway through.
 func (m *Manager) rollbackInit() {
-	if err := m.router.Reset(); err != nil {
-		log.Warnf("rollback router: %v", err)
+	if err := m.family4.Reset(); err != nil {
+		log.Warnf("rollback family: %v", err)
 	}
 	if m.hasIPv6() {
-		if err := m.router6.Reset(); err != nil {
-			log.Warnf("rollback v6 router: %v", err)
+		if err := m.family6.Reset(); err != nil {
+			log.Warnf("rollback v6 family: %v", err)
 		}
 	}
 	if err := m.cleanupNetbirdTables(); err != nil {
@@ -251,118 +211,67 @@ func (m *Manager) rollbackInit() {
 	}
 }
 
-// AddPeerFiltering rule to the firewall
+// AddFilterRule installs a packet-filtering rule.
 //
-// If comment argument is empty firewall manager should set
-// rule ID as comment for the rule
-func (m *Manager) AddPeerFiltering(
-	id []byte,
-	ip net.IP,
-	proto firewall.Protocol,
-	sPort *firewall.Port,
-	dPort *firewall.Port,
-	action firewall.Action,
-	ipsetName string,
-) ([]firewall.Rule, error) {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if ip.To4() != nil {
-		return m.aclManager.AddPeerFiltering(id, ip, proto, sPort, dPort, action, ipsetName)
-	}
-
-	if !m.hasIPv6() {
-		return nil, fmt.Errorf("add peer filtering for %s: %w", ip, firewall.ErrIPv6NotInitialized)
-	}
-	return m.aclManager6.AddPeerFiltering(id, ip, proto, sPort, dPort, action, ipsetName)
-}
-
-func (m *Manager) AddRouteFiltering(
+// Destination semantics: zero Network → input chain (peer ACL);
+// set Network → forward chain (route ACL).
+//
+// Sources are a single address family; the rule is dispatched to the
+// matching per-family backend.
+func (m *Manager) AddFilterRule(
 	id []byte,
 	sources []netip.Prefix,
 	destination firewall.Network,
 	proto firewall.Protocol,
-	sPort, dPort *firewall.Port,
+	sPort *firewall.Port,
+	dPort *firewall.Port,
 	action firewall.Action,
 ) (firewall.Rule, error) {
+	if len(sources) == 0 {
+		return nil, firewall.ErrNoSources
+	}
+
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
-	if isIPv6RouteRule(sources, destination) {
+	fam := m.family4
+	if isIPv6Rule(sources, destination) {
 		if !m.hasIPv6() {
-			return nil, fmt.Errorf("add route filtering: %w", firewall.ErrIPv6NotInitialized)
+			return nil, fmt.Errorf("add filtering: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.AddRouteFiltering(id, sources, destination, proto, sPort, dPort, action)
+		fam = m.family6
 	}
-
-	return m.router.AddRouteFiltering(id, sources, destination, proto, sPort, dPort, action)
+	return fam.AddFilterRule(id, sources, destination, proto, sPort, dPort, action)
 }
 
-// DeletePeerRule from the firewall by rule definition
-func (m *Manager) DeletePeerRule(rule firewall.Rule) error {
+// DeleteFilterRule removes a filtering rule. The owning family is found
+// by id in the in-memory filter maps, which are the only tracking for
+// filter rules. family.DeleteFilterRule is idempotent when the id is
+// absent.
+func (m *Manager) DeleteFilterRule(rule firewall.Rule) error {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
-	if m.hasIPv6() && isIPv6Rule(rule) {
-		return m.aclManager6.DeletePeerRule(rule)
-	}
-	return m.aclManager.DeletePeerRule(rule)
-}
-
-func isIPv6Rule(rule firewall.Rule) bool {
-	r, ok := rule.(*Rule)
-	return ok && r.nftRule != nil && r.nftRule.Table != nil && r.nftRule.Table.Family == nftables.TableFamilyIPv6
-}
-
-// isIPv6RouteRule determines whether a route rule belongs to the v6 table.
-// For static routes, the destination prefix determines the family. For dynamic
-// routes (DomainSet), the sources determine the family since management
-// duplicates dynamic rules per family.
-func isIPv6RouteRule(sources []netip.Prefix, destination firewall.Network) bool {
-	if destination.IsPrefix() {
-		return destination.Prefix.Addr().Is6()
-	}
-	return len(sources) > 0 && sources[0].Addr().Is6()
-}
-
-// DeleteRouteRule deletes a routing rule. Route rules live in exactly one
-// router; the cached maps are normally authoritative, so the kernel is only
-// consulted when neither map knows about the rule.
-func (m *Manager) DeleteRouteRule(rule firewall.Rule) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	id := rule.ID()
-	r, err := m.routerForRuleID(id, (*router).hasRule)
+	fam, err := m.familyForRuleID(rule.ID(), (*family).hasRule)
 	if err != nil {
 		return err
 	}
-	return r.DeleteRouteRule(rule)
+	return fam.DeleteFilterRule(rule)
 }
 
-// routerForRuleID picks the router holding the rule with the given id, using
-// the supplied lookup. If the cached maps disagree (or both miss), it refreshes
-// from the kernel once and re-checks before falling back to the v4 router.
-func (m *Manager) routerForRuleID(id string, has func(*router, string) bool) (*router, error) {
-	if has(m.router, id) {
-		return m.router, nil
-	}
-	if m.hasIPv6() && has(m.router6, id) {
-		return m.router6, nil
+// familyForRuleID picks the family holding the rule with the given id, using
+// the supplied lookup, and falls back to the v4 family on a miss.
+func (m *Manager) familyForRuleID(id firewall.RuleID, has func(*family, firewall.RuleID) bool) (*family, error) {
+	if has(m.family4, id) {
+		return m.family4, nil
 	}
 	if !m.hasIPv6() {
-		return m.router, nil
+		return m.family4, nil
 	}
-	if err := m.router.refreshRulesMap(); err != nil {
-		return nil, fmt.Errorf("refresh v4 rules: %w", err)
+	if has(m.family6, id) {
+		return m.family6, nil
 	}
-	if err := m.router6.refreshRulesMap(); err != nil {
-		return nil, fmt.Errorf("refresh v6 rules: %w", err)
-	}
-	if has(m.router6, id) && !has(m.router, id) {
-		return m.router6, nil
-	}
-	return m.router, nil
+	return m.family4, nil
 }
 
 func (m *Manager) IsServerRouteSupported() bool {
@@ -381,10 +290,10 @@ func (m *Manager) AddNatRule(pair firewall.RouterPair) error {
 		if !m.hasIPv6() {
 			return fmt.Errorf("add NAT rule: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.AddNatRule(pair)
+		return m.family6.AddNatRule(pair)
 	}
 
-	if err := m.router.AddNatRule(pair); err != nil {
+	if err := m.family4.AddNatRule(pair); err != nil {
 		return err
 	}
 
@@ -396,7 +305,7 @@ func (m *Manager) AddNatRule(pair firewall.RouterPair) error {
 	// so the eventual cleanup still works.
 	if m.hasIPv6() && pair.Dynamic {
 		v6Pair := firewall.ToV6NatPair(pair)
-		if err := m.router6.AddNatRule(v6Pair); err != nil {
+		if err := m.family6.AddNatRule(v6Pair); err != nil {
 			return fmt.Errorf("add v6 NAT rule: %w", err)
 		}
 	}
@@ -412,18 +321,18 @@ func (m *Manager) RemoveNatRule(pair firewall.RouterPair) error {
 		if !m.hasIPv6() {
 			return nil
 		}
-		return m.router6.RemoveNatRule(pair)
+		return m.family6.RemoveNatRule(pair)
 	}
 
 	var merr *multierror.Error
 
-	if err := m.router.RemoveNatRule(pair); err != nil {
+	if err := m.family4.RemoveNatRule(pair); err != nil {
 		merr = multierror.Append(merr, fmt.Errorf("remove v4 NAT rule: %w", err))
 	}
 
 	if m.hasIPv6() && pair.Dynamic {
 		v6Pair := firewall.ToV6NatPair(pair)
-		if err := m.router6.RemoveNatRule(v6Pair); err != nil {
+		if err := m.family6.RemoveNatRule(v6Pair); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("remove v6 NAT rule: %w", err))
 		}
 	}
@@ -431,46 +340,13 @@ func (m *Manager) RemoveNatRule(pair firewall.RouterPair) error {
 	return nberrors.FormatErrorOrNil(merr)
 }
 
-// AllowNetbird allows netbird interface traffic.
-// This is called when USPFilter wraps the native firewall, adding blanket accept
-// rules so that packet filtering is handled in userspace instead of by netfilter.
-//
-// TODO: In USP mode this only adds ACCEPT to the netbird table's own chains,
-// which doesn't override DROP rules in external tables (e.g. firewalld).
-// Should add passthrough rules to external chains (like the native mode router's
-// addExternalChainsRules does) for both the netbird table family and inet tables.
-// The netbird table itself is fine (routing chains already exist there), but
-// non-netbird tables with INPUT/FORWARD hooks can still DROP our WG traffic.
-func (m *Manager) AllowNetbird() error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if err := m.aclManager.createDefaultAllowRules(); err != nil {
-		return fmt.Errorf("create default allow rules: %w", err)
-	}
-	if m.hasIPv6() {
-		if err := m.aclManager6.createDefaultAllowRules(); err != nil {
-			return fmt.Errorf("create v6 default allow rules: %w", err)
-		}
-	}
-	if err := m.rConn.Flush(); err != nil {
-		return fmt.Errorf("flush allow input netbird rules: %w", err)
-	}
-
-	if err := firewalld.TrustInterface(m.wgIface.Name()); err != nil {
-		log.Warnf("failed to trust interface in firewalld: %v", err)
-	}
-
-	return nil
-}
-
 // SetLegacyManagement sets the route manager to use legacy management
 func (m *Manager) SetLegacyManagement(isLegacy bool) error {
-	if err := firewall.SetLegacyManagement(m.router, isLegacy); err != nil {
+	if err := firewall.SetLegacyManagement(m.family4, isLegacy); err != nil {
 		return err
 	}
 	if m.hasIPv6() {
-		return firewall.SetLegacyManagement(m.router6, isLegacy)
+		return firewall.SetLegacyManagement(m.family6, isLegacy)
 	}
 	return nil
 }
@@ -484,13 +360,13 @@ func (m *Manager) Close(stateManager *statemanager.Manager) error {
 
 	var merr *multierror.Error
 
-	if err := m.router.Reset(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("reset router: %v", err))
+	if err := m.family4.Reset(); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("reset family: %w", err))
 	}
 
 	if m.hasIPv6() {
-		if err := m.router6.Reset(); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("reset v6 router: %v", err))
+		if err := m.family6.Reset(); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("reset v6 family: %w", err))
 		}
 	}
 
@@ -530,17 +406,12 @@ func (m *Manager) SetLogLevel(log.Level) {
 }
 
 func (m *Manager) EnableRouting() error {
-	if err := m.router.ipFwdState.RequestForwarding(); err != nil {
-		return fmt.Errorf("enable IP forwarding: %w", err)
-	}
-	return nil
+	// v6 only when the overlay actually has v6.
+	return m.family4.ipFwdState.RequestRouting(m.hasIPv6())
 }
 
 func (m *Manager) DisableRouting() error {
-	if err := m.router.ipFwdState.ReleaseForwarding(); err != nil {
-		return fmt.Errorf("disable IP forwarding: %w", err)
-	}
-	return nil
+	return m.family4.ipFwdState.ReleaseRouting()
 }
 
 // Flush rule/chain/set operations from the buffer
@@ -551,49 +422,19 @@ func (m *Manager) Flush() error {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
-	if err := m.aclManager.Flush(); err != nil {
+	if err := m.family4.Flush(); err != nil {
 		return err
 	}
 
 	if m.hasIPv6() {
-		if err := m.aclManager6.Flush(); err != nil {
-			return fmt.Errorf("flush v6 acl: %w", err)
+		if err := m.family6.Flush(); err != nil {
+			return fmt.Errorf("flush v6 family: %w", err)
 		}
 	}
 
-	if err := m.refreshNoTrackChains(); err != nil {
-		log.Errorf("failed to refresh notrack chains: %v", err)
-	}
-
 	return nil
 }
 
-// AddDNATRule adds a DNAT rule
-func (m *Manager) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if rule.TranslatedAddress.Is6() {
-		if !m.hasIPv6() {
-			return nil, fmt.Errorf("add DNAT rule: %w", firewall.ErrIPv6NotInitialized)
-		}
-		return m.router6.AddDNATRule(rule)
-	}
-	return m.router.AddDNATRule(rule)
-}
-
-// DeleteDNATRule deletes a DNAT rule
-func (m *Manager) DeleteDNATRule(rule firewall.Rule) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	r, err := m.routerForRuleID(rule.ID(), (*router).hasDNATRule)
-	if err != nil {
-		return err
-	}
-	return r.DeleteDNATRule(rule)
-}
-
 // UpdateSet updates the set with the given prefixes
 func (m *Manager) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
 	m.mutex.Lock()
@@ -608,12 +449,12 @@ func (m *Manager) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
 		}
 	}
 
-	if err := m.router.UpdateSet(set, v4Prefixes); err != nil {
+	if err := m.family4.UpdateSet(set, v4Prefixes); err != nil {
 		return err
 	}
 
 	if m.hasIPv6() && len(v6Prefixes) > 0 {
-		if err := m.router6.UpdateSet(set, v6Prefixes); err != nil {
+		if err := m.family6.UpdateSet(set, v6Prefixes); err != nil {
 			return fmt.Errorf("update v6 set: %w", err)
 		}
 	}
@@ -630,9 +471,9 @@ func (m *Manager) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protoco
 		if !m.hasIPv6() {
 			return fmt.Errorf("add inbound DNAT: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.AddInboundDNAT(localAddr, protocol, originalPort, translatedPort)
+		return m.family6.AddInboundDNAT(localAddr, protocol, originalPort, translatedPort)
 	}
-	return m.router.AddInboundDNAT(localAddr, protocol, originalPort, translatedPort)
+	return m.family4.AddInboundDNAT(localAddr, protocol, originalPort, translatedPort)
 }
 
 // RemoveInboundDNAT removes an inbound DNAT rule.
@@ -644,9 +485,9 @@ func (m *Manager) RemoveInboundDNAT(localAddr netip.Addr, protocol firewall.Prot
 		if !m.hasIPv6() {
 			return fmt.Errorf("remove inbound DNAT: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.RemoveInboundDNAT(localAddr, protocol, originalPort, translatedPort)
+		return m.family6.RemoveInboundDNAT(localAddr, protocol, originalPort, translatedPort)
 	}
-	return m.router.RemoveInboundDNAT(localAddr, protocol, originalPort, translatedPort)
+	return m.family4.RemoveInboundDNAT(localAddr, protocol, originalPort, translatedPort)
 }
 
 // AddOutputDNAT adds an OUTPUT chain DNAT rule for locally-generated traffic.
@@ -658,9 +499,9 @@ func (m *Manager) AddOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol
 		if !m.hasIPv6() {
 			return fmt.Errorf("add output DNAT: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
+		return m.family6.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
 	}
-	return m.router.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
+	return m.family4.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
 }
 
 // RemoveOutputDNAT removes an OUTPUT chain DNAT rule.
@@ -672,179 +513,9 @@ func (m *Manager) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Proto
 		if !m.hasIPv6() {
 			return fmt.Errorf("remove output DNAT: %w", firewall.ErrIPv6NotInitialized)
 		}
-		return m.router6.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
+		return m.family6.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
 	}
-	return m.router.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
-}
-
-const (
-	chainNameRawOutput     = "netbird-raw-out"
-	chainNameRawPrerouting = "netbird-raw-pre"
-)
-
-// SetupEBPFProxyNoTrack creates notrack rules for eBPF proxy loopback traffic.
-// This prevents conntrack from tracking WireGuard proxy traffic on loopback, which
-// can interfere with MASQUERADE rules (e.g., from container runtimes like Podman/netavark).
-//
-// Traffic flows that need NOTRACK:
-//
-//  1. Egress: WireGuard -> fake endpoint (before eBPF rewrite)
-//     src=127.0.0.1:wgPort -> dst=127.0.0.1:fakePort
-//     Matched by: sport=wgPort
-//
-//  2. Egress: Proxy -> WireGuard (via raw socket)
-//     src=127.0.0.1:fakePort -> dst=127.0.0.1:wgPort
-//     Matched by: dport=wgPort
-//
-//  3. Ingress: Packets to WireGuard
-//     dst=127.0.0.1:wgPort
-//     Matched by: dport=wgPort
-//
-//  4. Ingress: Packets to proxy (after eBPF rewrite)
-//     dst=127.0.0.1:proxyPort
-//     Matched by: dport=proxyPort
-//
-// Rules are cleaned up when the firewall manager is closed.
-func (m *Manager) SetupEBPFProxyNoTrack(proxyPort, wgPort uint16) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if m.notrackOutputChain == nil || m.notrackPreroutingChain == nil {
-		return fmt.Errorf("notrack chains not initialized")
-	}
-
-	proxyPortBytes := binaryutil.BigEndian.PutUint16(proxyPort)
-	wgPortBytes := binaryutil.BigEndian.PutUint16(wgPort)
-	loopback := []byte{127, 0, 0, 1}
-
-	// Egress rules: match outgoing loopback UDP packets
-	m.rConn.AddRule(&nftables.Rule{
-		Table: m.notrackOutputChain.Table,
-		Chain: m.notrackOutputChain,
-		Exprs: []expr.Any{
-			&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: ifname("lo")},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseNetworkHeader, Offset: 12, Len: 4}, // saddr
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: loopback},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseNetworkHeader, Offset: 16, Len: 4}, // daddr
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: loopback},
-			&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{unix.IPPROTO_UDP}},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseTransportHeader, Offset: 0, Len: 2},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: wgPortBytes}, // sport=wgPort
-			&expr.Counter{},
-			&expr.Notrack{},
-		},
-	})
-	m.rConn.AddRule(&nftables.Rule{
-		Table: m.notrackOutputChain.Table,
-		Chain: m.notrackOutputChain,
-		Exprs: []expr.Any{
-			&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: ifname("lo")},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseNetworkHeader, Offset: 12, Len: 4}, // saddr
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: loopback},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseNetworkHeader, Offset: 16, Len: 4}, // daddr
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: loopback},
-			&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{unix.IPPROTO_UDP}},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseTransportHeader, Offset: 2, Len: 2},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: wgPortBytes}, // dport=wgPort
-			&expr.Counter{},
-			&expr.Notrack{},
-		},
-	})
-
-	// Ingress rules: match incoming loopback UDP packets
-	m.rConn.AddRule(&nftables.Rule{
-		Table: m.notrackPreroutingChain.Table,
-		Chain: m.notrackPreroutingChain,
-		Exprs: []expr.Any{
-			&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: ifname("lo")},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseNetworkHeader, Offset: 12, Len: 4}, // saddr
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: loopback},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseNetworkHeader, Offset: 16, Len: 4}, // daddr
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: loopback},
-			&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{unix.IPPROTO_UDP}},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseTransportHeader, Offset: 2, Len: 2},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: wgPortBytes}, // dport=wgPort
-			&expr.Counter{},
-			&expr.Notrack{},
-		},
-	})
-	m.rConn.AddRule(&nftables.Rule{
-		Table: m.notrackPreroutingChain.Table,
-		Chain: m.notrackPreroutingChain,
-		Exprs: []expr.Any{
-			&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: ifname("lo")},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseNetworkHeader, Offset: 12, Len: 4}, // saddr
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: loopback},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseNetworkHeader, Offset: 16, Len: 4}, // daddr
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: loopback},
-			&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{unix.IPPROTO_UDP}},
-			&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseTransportHeader, Offset: 2, Len: 2},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: proxyPortBytes}, // dport=proxyPort
-			&expr.Counter{},
-			&expr.Notrack{},
-		},
-	})
-
-	if err := m.rConn.Flush(); err != nil {
-		return fmt.Errorf("flush notrack rules: %w", err)
-	}
-
-	log.Debugf("set up ebpf proxy notrack rules for ports %d,%d", proxyPort, wgPort)
-	return nil
-}
-
-func (m *Manager) initNoTrackChains(table *nftables.Table) error {
-	m.notrackOutputChain = m.rConn.AddChain(&nftables.Chain{
-		Name:     chainNameRawOutput,
-		Table:    table,
-		Type:     nftables.ChainTypeFilter,
-		Hooknum:  nftables.ChainHookOutput,
-		Priority: nftables.ChainPriorityRaw,
-	})
-
-	m.notrackPreroutingChain = m.rConn.AddChain(&nftables.Chain{
-		Name:     chainNameRawPrerouting,
-		Table:    table,
-		Type:     nftables.ChainTypeFilter,
-		Hooknum:  nftables.ChainHookPrerouting,
-		Priority: nftables.ChainPriorityRaw,
-	})
-
-	if err := m.rConn.Flush(); err != nil {
-		return fmt.Errorf("flush chain creation: %w", err)
-	}
-
-	return nil
-}
-
-func (m *Manager) refreshNoTrackChains() error {
-	chains, err := m.rConn.ListChainsOfTableFamily(nftables.TableFamilyIPv4)
-	if err != nil {
-		return fmt.Errorf("list chains: %w", err)
-	}
-
-	tableName := getTableName()
-	for _, c := range chains {
-		if c.Table.Name != tableName {
-			continue
-		}
-		switch c.Name {
-		case chainNameRawOutput:
-			m.notrackOutputChain = c
-		case chainNameRawPrerouting:
-			m.notrackPreroutingChain = c
-		}
-	}
-
-	return nil
+	return m.family4.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
 }
 
 func (m *Manager) createWorkTable() (*nftables.Table, error) {
@@ -903,3 +574,14 @@ func getEstablishedExprs(register uint32) []expr.Any {
 		},
 	}
 }
+
+// isIPv6Rule reports whether the rule belongs to the v6 table. For a
+// prefix destination the destination family decides; otherwise the
+// (single-family) sources do, since management duplicates rules per
+// family.
+func isIPv6Rule(sources []netip.Prefix, destination firewall.Network) bool {
+	if destination.IsPrefix() {
+		return destination.Prefix.Addr().Is6()
+	}
+	return len(sources) > 0 && sources[0].Addr().Is6()
+}
diff --git a/client/firewall/nftables/manager_linux_test.go b/client/firewall/nftables/manager_linux_test.go
index 4eb466281..4d6eec3c1 100644
--- a/client/firewall/nftables/manager_linux_test.go
+++ b/client/firewall/nftables/manager_linux_test.go
@@ -72,13 +72,13 @@ func TestNftablesManager(t *testing.T) {
 
 	testClient := &nftables.Conn{}
 
-	rule, err := manager.AddPeerFiltering(nil, ip.AsSlice(), fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{53}}, fw.ActionDrop, "")
+	rule, err := manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{53}}, fw.ActionDrop)
 	require.NoError(t, err, "failed to add rule")
 
 	err = manager.Flush()
 	require.NoError(t, err, "failed to flush")
 
-	rules, err := testClient.GetRules(manager.aclManager.workTable, manager.aclManager.chainInputRules)
+	rules, err := testClient.GetRules(manager.family4.workTable, manager.family4.chainInputRules)
 	require.NoError(t, err, "failed to get rules")
 
 	require.Len(t, rules, 2, "expected 2 rules")
@@ -149,15 +149,12 @@ func TestNftablesManager(t *testing.T) {
 	// Compare connection tracking rule at position 1 (pushed down by DROP rule insertion)
 	compareExprsIgnoringCounters(t, rules[1].Exprs, expectedExprs1)
 
-	for _, r := range rule {
-		err = manager.DeletePeerRule(r)
-		require.NoError(t, err, "failed to delete rule")
-	}
+	require.NoError(t, manager.DeleteFilterRule(rule), "failed to delete rule")
 
 	err = manager.Flush()
 	require.NoError(t, err, "failed to flush")
 
-	rules, err = testClient.GetRules(manager.aclManager.workTable, manager.aclManager.chainInputRules)
+	rules, err = testClient.GetRules(manager.family4.workTable, manager.family4.chainInputRules)
 	require.NoError(t, err, "failed to get rules")
 	// established rule remains
 	require.Len(t, rules, 1, "expected 1 rules after deletion")
@@ -182,47 +179,39 @@ func TestNftablesManagerRuleOrder(t *testing.T) {
 	testClient := &nftables.Conn{}
 
 	// Add accept rule first
-	_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept, "accept-http")
+	_, err = manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept)
 	require.NoError(t, err, "failed to add accept rule")
 
 	// Add deny rule second for the same traffic
-	_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionDrop, "deny-http")
+	_, err = manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionDrop)
 	require.NoError(t, err, "failed to add deny rule")
 
 	err = manager.Flush()
 	require.NoError(t, err, "failed to flush")
 
-	rules, err := testClient.GetRules(manager.aclManager.workTable, manager.aclManager.chainInputRules)
+	rules, err := testClient.GetRules(manager.family4.workTable, manager.family4.chainInputRules)
 	require.NoError(t, err, "failed to get rules")
 
 	t.Logf("Found %d rules in nftables chain", len(rules))
 
-	// Find the accept and deny rules and verify deny comes before accept
+	// Single-source rules emit a direct payload+cmp on the source IP
+	// (no set lookup). Match by source-IP + port + verdict instead of
+	// the legacy per-(action,port) set names ("deny-http"/"accept-http")
+	// that this test predates.
+	wantSrc := ip.AsSlice()
 	var acceptRuleIndex, denyRuleIndex = -1, -1
 	for i, rule := range rules {
-		hasAcceptHTTPSet := false
-		hasDenyHTTPSet := false
-		hasPort80 := false
+		var hasSrc, hasPort80 bool
 		var action string
-
 		for _, e := range rule.Exprs {
-			// Check for set lookup
-			if lookup, ok := e.(*expr.Lookup); ok {
-				switch lookup.SetName {
-				case "accept-http":
-					hasAcceptHTTPSet = true
-				case "deny-http":
-					hasDenyHTTPSet = true
+			if cmp, ok := e.(*expr.Cmp); ok && cmp.Op == expr.CmpOpEq {
+				if bytes.Equal(cmp.Data, wantSrc) {
+					hasSrc = true
 				}
-
-			}
-			// Check for port 80
-			if cmp, ok := e.(*expr.Cmp); ok {
-				if cmp.Op == expr.CmpOpEq && len(cmp.Data) == 2 && binary.BigEndian.Uint16(cmp.Data) == 80 {
+				if len(cmp.Data) == 2 && binary.BigEndian.Uint16(cmp.Data) == 80 {
 					hasPort80 = true
 				}
 			}
-			// Check for verdict
 			if verdict, ok := e.(*expr.Verdict); ok {
 				switch verdict.Kind {
 				case expr.VerdictAccept:
@@ -233,11 +222,15 @@ func TestNftablesManagerRuleOrder(t *testing.T) {
 			}
 		}
 
-		if hasAcceptHTTPSet && hasPort80 && action == "ACCEPT" {
-			t.Logf("Rule [%d]: accept-http set + Port 80 + ACCEPT", i)
+		if !hasSrc || !hasPort80 {
+			continue
+		}
+		switch action {
+		case "ACCEPT":
+			t.Logf("Rule [%d]: src=%s port=80 ACCEPT", i, ip)
 			acceptRuleIndex = i
-		} else if hasDenyHTTPSet && hasPort80 && action == "DROP" {
-			t.Logf("Rule [%d]: deny-http set + Port 80 + DROP", i)
+		case "DROP":
+			t.Logf("Rule [%d]: src=%s port=80 DROP", i, ip)
 			denyRuleIndex = i
 		}
 	}
@@ -281,7 +274,7 @@ func TestNFtablesCreatePerformance(t *testing.T) {
 			start := time.Now()
 			for i := 0; i < testMax; i++ {
 				port := &fw.Port{Values: []uint16{uint16(1000 + i)}}
-				_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", nil, port, fw.ActionAccept, "")
+				_, err = manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, "tcp", nil, port, fw.ActionAccept)
 				require.NoError(t, err, "failed to add rule")
 
 				if i%100 == 0 {
@@ -363,10 +356,10 @@ func TestNftablesManagerCompatibilityWithIptables(t *testing.T) {
 	})
 
 	ip := netip.MustParseAddr("100.96.0.1")
-	_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept, "")
+	_, err = manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept)
 	require.NoError(t, err, "failed to add peer filtering rule")
 
-	_, err = manager.AddRouteFiltering(
+	_, err = manager.AddFilterRule(
 		nil,
 		[]netip.Prefix{netip.MustParsePrefix("192.168.2.0/24")},
 		fw.Network{Prefix: netip.MustParsePrefix("10.1.0.0/24")},
@@ -385,18 +378,6 @@ func TestNftablesManagerCompatibilityWithIptables(t *testing.T) {
 	err = manager.AddNatRule(pair)
 	require.NoError(t, err, "failed to add NAT rule")
 
-	dnatRule, err := manager.AddDNATRule(fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{8080}},
-		TranslatedAddress: netip.MustParseAddr("100.96.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	})
-	require.NoError(t, err, "failed to add DNAT rule")
-
-	t.Cleanup(func() {
-		require.NoError(t, manager.DeleteDNATRule(dnatRule), "failed to delete DNAT rule")
-	})
-
 	stdout, stderr = runIptablesSave(t)
 	verifyIptablesOutput(t, stdout, stderr)
 }
@@ -439,10 +420,10 @@ func TestNftablesManagerIPv6CompatibilityWithIp6tables(t *testing.T) {
 	})
 
 	ip := netip.MustParseAddr("fd00::2")
-	_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept, "")
+	_, err = manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept)
 	require.NoError(t, err, "add v6 peer filtering rule")
 
-	_, err = manager.AddRouteFiltering(
+	_, err = manager.AddFilterRule(
 		nil,
 		[]netip.Prefix{netip.MustParsePrefix("fd00:1::/64")},
 		fw.Network{Prefix: netip.MustParsePrefix("2001:db8::/48")},
@@ -460,18 +441,6 @@ func TestNftablesManagerIPv6CompatibilityWithIp6tables(t *testing.T) {
 	})
 	require.NoError(t, err, "add v6 NAT rule")
 
-	dnatRule, err := manager.AddDNATRule(fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{8080}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	})
-	require.NoError(t, err, "add v6 DNAT rule")
-
-	t.Cleanup(func() {
-		require.NoError(t, manager.DeleteDNATRule(dnatRule), "delete v6 DNAT rule")
-	})
-
 	stdout, stderr := runIptablesSave(t)
 	verifyIptablesOutput(t, stdout, stderr)
 
@@ -552,7 +521,7 @@ func TestNftablesManagerCompatibilityWithIptablesFor6kPrefixes(t *testing.T) {
 			prefixes = append(prefixes, netip.PrefixFrom(addr, 24))
 		}
 	}
-	_, err = manager.AddRouteFiltering(
+	_, err = manager.AddFilterRule(
 		nil,
 		prefixes,
 		fw.Network{Prefix: netip.MustParsePrefix("10.2.0.0/24")},
@@ -567,7 +536,7 @@ func TestNftablesManagerCompatibilityWithIptablesFor6kPrefixes(t *testing.T) {
 	verifyIptablesOutput(t, stdout, stderr)
 }
 
-func TestNftablesManagerCompatibilityWithIptablesForEmptyPrefixes(t *testing.T) {
+func TestNftablesManagerCompatibilityWithIptablesForWildcardSource(t *testing.T) {
 	if check() != NFTABLES {
 		t.Skip("nftables not supported on this system")
 	}
@@ -593,9 +562,9 @@ func TestNftablesManagerCompatibilityWithIptablesForEmptyPrefixes(t *testing.T)
 		verifyIptablesOutput(t, stdout, stderr)
 	})
 
-	_, err = manager.AddRouteFiltering(
+	_, err = manager.AddFilterRule(
 		nil,
-		[]netip.Prefix{},
+		[]netip.Prefix{netip.MustParsePrefix("0.0.0.0/0")},
 		fw.Network{Prefix: netip.MustParsePrefix("10.2.0.0/24")},
 		fw.ProtocolTCP,
 		nil,
@@ -608,6 +577,73 @@ func TestNftablesManagerCompatibilityWithIptablesForEmptyPrefixes(t *testing.T)
 	verifyIptablesOutput(t, stdout, stderr)
 }
 
+func TestNftablesManagerMultiPortFilter(t *testing.T) {
+	if check() != NFTABLES {
+		t.Skip("nftables not supported on this system")
+	}
+
+	manager, err := Create(ifaceMock, iface.DefaultMTU)
+	require.NoError(t, err)
+	require.NoError(t, manager.Init(nil))
+
+	t.Cleanup(func() {
+		require.NoError(t, manager.Close(nil), "failed to reset manager state")
+	})
+
+	ip := netip.MustParseAddr("100.96.0.1")
+
+	rule, err := manager.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80, 443}}, fw.ActionAccept)
+	require.NoError(t, err, "failed to add multi-port rule")
+
+	testClient := &nftables.Conn{}
+	rules, err := testClient.GetRules(manager.family4.workTable, manager.family4.chainInputRules)
+	require.NoError(t, err, "failed to get rules")
+
+	var lookup *expr.Lookup
+	for _, kernelRule := range rules {
+		if string(kernelRule.UserData) != string(rule.ID()) {
+			continue
+		}
+		for _, e := range kernelRule.Exprs {
+			if l, ok := e.(*expr.Lookup); ok {
+				lookup = l
+			}
+		}
+	}
+	require.NotNil(t, lookup, "multi-port rule must match ports via a set lookup")
+
+	sets, err := testClient.GetSets(manager.family4.workTable)
+	require.NoError(t, err, "failed to get sets")
+
+	var portSet *nftables.Set
+	for _, s := range sets {
+		if s.Name == lookup.SetName {
+			portSet = s
+		}
+	}
+	require.NotNil(t, portSet, "anonymous port set not found in kernel")
+
+	portSet.Table = manager.family4.workTable
+	elements, err := testClient.GetSetElements(portSet)
+	require.NoError(t, err, "failed to get set elements")
+
+	ports := make(map[uint16]bool)
+	for _, e := range elements {
+		require.Len(t, e.Key, 2, "port set element key should be 2 bytes")
+		ports[binary.BigEndian.Uint16(e.Key)] = true
+	}
+	require.True(t, ports[80], "port set should contain port 80")
+	require.True(t, ports[443], "port set should contain port 443")
+
+	require.NoError(t, manager.DeleteFilterRule(rule), "failed to delete rule")
+
+	rules, err = testClient.GetRules(manager.family4.workTable, manager.family4.chainInputRules)
+	require.NoError(t, err, "failed to get rules after delete")
+	for _, kernelRule := range rules {
+		require.NotEqual(t, string(rule.ID()), string(kernelRule.UserData), "rule should be removed from kernel")
+	}
+}
+
 func compareExprsIgnoringCounters(t *testing.T, got, want []expr.Any) {
 	t.Helper()
 	require.Equal(t, len(got), len(want), "expression count mismatch")
diff --git a/client/firewall/nftables/router_linux.go b/client/firewall/nftables/router_linux.go
deleted file mode 100644
index 4214455a9..000000000
--- a/client/firewall/nftables/router_linux.go
+++ /dev/null
@@ -1,2244 +0,0 @@
-package nftables
-
-import (
-	"bytes"
-	"encoding/binary"
-	"errors"
-	"fmt"
-	"net"
-	"net/netip"
-	"strings"
-
-	"github.com/coreos/go-iptables/iptables"
-	"github.com/google/nftables"
-	"github.com/google/nftables/binaryutil"
-	"github.com/google/nftables/expr"
-	"github.com/google/nftables/xt"
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/client/firewall/firewalld"
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	nbid "github.com/netbirdio/netbird/client/internal/acl/id"
-	"github.com/netbirdio/netbird/client/internal/routemanager/ipfwdstate"
-	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
-	nbnet "github.com/netbirdio/netbird/client/net"
-)
-
-const (
-	tableNat      = "nat"
-	tableMangle   = "mangle"
-	tableRaw      = "raw"
-	tableSecurity = "security"
-
-	chainNameNatPrerouting = "PREROUTING"
-	chainNameRoutingFw     = "netbird-rt-fwd"
-	chainNameRoutingNat    = "netbird-rt-postrouting"
-	chainNameRoutingRdr    = "netbird-rt-redirect"
-	chainNameNATOutput     = "netbird-nat-output"
-	chainNameForward       = "FORWARD"
-	chainNameMangleForward = "netbird-mangle-forward"
-
-	firewalldTableName = "firewalld"
-
-	userDataAcceptForwardRuleIif = "frwacceptiif"
-	userDataAcceptForwardRuleOif = "frwacceptoif"
-	userDataAcceptInputRule      = "inputaccept"
-
-	dnatSuffix = "_dnat"
-	snatSuffix = "_snat"
-
-	// ipv4TCPHeaderSize is the minimum IPv4 (20) + TCP (20) header size for MSS calculation.
-	ipv4TCPHeaderSize = 40
-	// ipv6TCPHeaderSize is the minimum IPv6 (40) + TCP (20) header size for MSS calculation.
-	ipv6TCPHeaderSize = 60
-
-	// maxPrefixesSet 1638 prefixes start to fail, taking some margin
-	maxPrefixesSet       = 1500
-	refreshRulesMapError = "refresh rules map: %w"
-)
-
-var (
-	errFilterTableNotFound = fmt.Errorf("'filter' table not found")
-)
-
-type setInput struct {
-	set      firewall.Set
-	prefixes []netip.Prefix
-}
-
-type router struct {
-	conn        *nftables.Conn
-	workTable   *nftables.Table
-	filterTable *nftables.Table
-	chains      map[string]*nftables.Chain
-	// rules is useful to avoid duplicates and to get missing attributes that we don't have when adding new rules
-	rules        map[string]*nftables.Rule
-	ipsetCounter *refcounter.Counter[string, setInput, *nftables.Set]
-
-	af               addrFamily
-	wgIface          iFaceMapper
-	ipFwdState       *ipfwdstate.IPForwardingState
-	legacyManagement bool
-	mtu              uint16
-}
-
-func newRouter(workTable *nftables.Table, wgIface iFaceMapper, mtu uint16) (*router, error) {
-	r := &router{
-		conn:       &nftables.Conn{},
-		workTable:  workTable,
-		chains:     make(map[string]*nftables.Chain),
-		rules:      make(map[string]*nftables.Rule),
-		af:         familyForAddr(workTable.Family == nftables.TableFamilyIPv4),
-		wgIface:    wgIface,
-		ipFwdState: ipfwdstate.NewIPForwardingState(),
-		mtu:        mtu,
-	}
-
-	r.ipsetCounter = refcounter.New(
-		r.createIpSet,
-		r.deleteIpSet,
-	)
-
-	var err error
-	r.filterTable, err = r.loadFilterTable()
-	if err != nil {
-		log.Debugf("ip filter table not found: %v", err)
-	}
-
-	return r, nil
-}
-
-func (r *router) init(workTable *nftables.Table) error {
-	r.workTable = workTable
-
-	if err := r.removeAcceptFilterRules(); err != nil {
-		log.Errorf("failed to clean up rules from filter table: %s", err)
-	}
-
-	if err := r.createContainers(); err != nil {
-		return fmt.Errorf("create containers: %w", err)
-	}
-
-	if err := r.setupDataPlaneMark(); err != nil {
-		log.Errorf("failed to set up data plane mark: %v", err)
-	}
-
-	return nil
-}
-
-// Reset cleans existing nftables filter table rules from the system
-func (r *router) Reset() error {
-	// clear without deleting the ipsets, the nf table will be deleted by the caller
-	r.ipsetCounter.Clear()
-
-	var merr *multierror.Error
-
-	if err := r.removeAcceptFilterRules(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove accept filter rules: %w", err))
-	}
-
-	if err := firewalld.UntrustInterface(r.wgIface.Name()); err != nil {
-		merr = multierror.Append(merr, err)
-	}
-
-	if err := r.removeNatPreroutingRules(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove filter prerouting rules: %w", err))
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) removeNatPreroutingRules() error {
-	table := &nftables.Table{
-		Name:   tableNat,
-		Family: r.af.tableFamily,
-	}
-	chain := &nftables.Chain{
-		Name:     chainNameNatPrerouting,
-		Table:    table,
-		Hooknum:  nftables.ChainHookPrerouting,
-		Priority: nftables.ChainPriorityNATDest,
-		Type:     nftables.ChainTypeNAT,
-	}
-	rules, err := r.conn.GetRules(table, chain)
-	if err != nil {
-		return fmt.Errorf("get rules from nat table: %w", err)
-	}
-
-	var merr *multierror.Error
-
-	// Delete rules that have our UserData suffix
-	for _, rule := range rules {
-		if len(rule.UserData) == 0 || !strings.HasSuffix(string(rule.UserData), dnatSuffix) {
-			continue
-		}
-		if err := r.conn.DelRule(rule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete rule %s: %w", rule.UserData, err))
-		}
-	}
-
-	if err := r.conn.Flush(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf(flushError, err))
-	}
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) loadFilterTable() (*nftables.Table, error) {
-	tables, err := r.conn.ListTablesOfFamily(r.af.tableFamily)
-	if err != nil {
-		return nil, fmt.Errorf("list tables: %w", err)
-	}
-
-	for _, table := range tables {
-		if table.Name == "filter" {
-			return table, nil
-		}
-	}
-
-	return nil, errFilterTableNotFound
-}
-
-func hookName(hook *nftables.ChainHook) string {
-	if hook == nil {
-		return "unknown"
-	}
-	switch *hook {
-	case *nftables.ChainHookForward:
-		return chainNameForward
-	case *nftables.ChainHookInput:
-		return chainNameInput
-	default:
-		return fmt.Sprintf("hook(%d)", *hook)
-	}
-}
-
-func familyName(family nftables.TableFamily) string {
-	switch family {
-	case nftables.TableFamilyIPv4:
-		return "ip"
-	case nftables.TableFamilyIPv6:
-		return "ip6"
-	case nftables.TableFamilyINet:
-		return "inet"
-	default:
-		return fmt.Sprintf("family(%d)", family)
-	}
-}
-
-func (r *router) createContainers() error {
-	r.chains[chainNameRoutingFw] = r.conn.AddChain(&nftables.Chain{
-		Name:  chainNameRoutingFw,
-		Table: r.workTable,
-	})
-
-	prio := *nftables.ChainPriorityNATSource - 1
-	r.chains[chainNameRoutingNat] = r.conn.AddChain(&nftables.Chain{
-		Name:     chainNameRoutingNat,
-		Table:    r.workTable,
-		Hooknum:  nftables.ChainHookPostrouting,
-		Priority: &prio,
-		Type:     nftables.ChainTypeNAT,
-	})
-
-	r.chains[chainNameRoutingRdr] = r.conn.AddChain(&nftables.Chain{
-		Name:     chainNameRoutingRdr,
-		Table:    r.workTable,
-		Hooknum:  nftables.ChainHookPrerouting,
-		Priority: nftables.ChainPriorityNATDest,
-		Type:     nftables.ChainTypeNAT,
-	})
-
-	r.chains[chainNameManglePostrouting] = r.conn.AddChain(&nftables.Chain{
-		Name:     chainNameManglePostrouting,
-		Table:    r.workTable,
-		Hooknum:  nftables.ChainHookPostrouting,
-		Priority: nftables.ChainPriorityMangle,
-		Type:     nftables.ChainTypeFilter,
-	})
-
-	r.chains[chainNameManglePrerouting] = r.conn.AddChain(&nftables.Chain{
-		Name:     chainNameManglePrerouting,
-		Table:    r.workTable,
-		Hooknum:  nftables.ChainHookPrerouting,
-		Priority: nftables.ChainPriorityMangle,
-		Type:     nftables.ChainTypeFilter,
-	})
-
-	r.chains[chainNameMangleForward] = r.conn.AddChain(&nftables.Chain{
-		Name:     chainNameMangleForward,
-		Table:    r.workTable,
-		Hooknum:  nftables.ChainHookForward,
-		Priority: nftables.ChainPriorityMangle,
-		Type:     nftables.ChainTypeFilter,
-	})
-
-	insertReturnTrafficRule(r.conn, r.workTable, r.chains[chainNameRoutingFw])
-
-	r.addPostroutingRules()
-
-	if err := r.conn.Flush(); err != nil {
-		return fmt.Errorf("initialize tables: %v", err)
-	}
-
-	if err := r.addMSSClampingRules(); err != nil {
-		log.Errorf("failed to add MSS clamping rules: %s", err)
-	}
-
-	if err := r.acceptForwardRules(); err != nil {
-		log.Errorf("failed to add accept rules for the forward chain: %s", err)
-	}
-
-	if err := firewalld.TrustInterface(r.wgIface.Name()); err != nil {
-		log.Warnf("failed to trust interface in firewalld: %v", err)
-	}
-
-	if err := r.refreshRulesMap(); err != nil {
-		log.Errorf("failed to refresh rules: %s", err)
-	}
-
-	return nil
-}
-
-// setupDataPlaneMark configures the fwmark for the data plane
-func (r *router) setupDataPlaneMark() error {
-	if r.chains[chainNameManglePrerouting] == nil || r.chains[chainNameManglePostrouting] == nil {
-		return errors.New("no mangle chains found")
-	}
-
-	ctNew := getCtNewExprs()
-	preExprs := []expr.Any{
-		&expr.Meta{
-			Key:      expr.MetaKeyIIFNAME,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-	}
-	preExprs = append(preExprs, ctNew...)
-	preExprs = append(preExprs,
-		&expr.Immediate{
-			Register: 1,
-			Data:     binaryutil.NativeEndian.PutUint32(nbnet.DataPlaneMarkIn),
-		},
-		&expr.Ct{
-			Key:            expr.CtKeyMARK,
-			Register:       1,
-			SourceRegister: true,
-		},
-	)
-
-	preNftRule := &nftables.Rule{
-		Table: r.workTable,
-		Chain: r.chains[chainNameManglePrerouting],
-		Exprs: preExprs,
-	}
-	r.conn.AddRule(preNftRule)
-
-	postExprs := []expr.Any{
-		&expr.Meta{
-			Key:      expr.MetaKeyOIFNAME,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-	}
-	postExprs = append(postExprs, ctNew...)
-	postExprs = append(postExprs,
-		&expr.Immediate{
-			Register: 1,
-			Data:     binaryutil.NativeEndian.PutUint32(nbnet.DataPlaneMarkOut),
-		},
-		&expr.Ct{
-			Key:            expr.CtKeyMARK,
-			Register:       1,
-			SourceRegister: true,
-		},
-	)
-
-	postNftRule := &nftables.Rule{
-		Table: r.workTable,
-		Chain: r.chains[chainNameManglePostrouting],
-		Exprs: postExprs,
-	}
-	r.conn.AddRule(postNftRule)
-
-	if err := r.conn.Flush(); err != nil {
-		return fmt.Errorf("flush: %w", err)
-	}
-
-	return nil
-}
-
-// AddRouteFiltering appends a nftables rule to the routing chain
-func (r *router) AddRouteFiltering(
-	id []byte,
-	sources []netip.Prefix,
-	destination firewall.Network,
-	proto firewall.Protocol,
-	sPort *firewall.Port,
-	dPort *firewall.Port,
-	action firewall.Action,
-) (firewall.Rule, error) {
-
-	ruleKey := nbid.GenerateRouteRuleKey(sources, destination, proto, sPort, dPort, action)
-	if _, ok := r.rules[string(ruleKey)]; ok {
-		return ruleKey, nil
-	}
-
-	chain := r.chains[chainNameRoutingFw]
-	var exprs []expr.Any
-
-	var source firewall.Network
-	switch {
-	case len(sources) == 1 && sources[0].Bits() == 0:
-		// If it's 0.0.0.0/0, we don't need to add any source matching
-	case len(sources) == 1:
-		// If there's only one source, we can use it directly
-		source.Prefix = sources[0]
-	default:
-		// If there are multiple sources, use a set
-		source.Set = firewall.NewPrefixSet(sources)
-	}
-
-	sourceExp, err := r.applyNetwork(source, sources, true)
-	if err != nil {
-		return nil, fmt.Errorf("apply source: %w", err)
-	}
-	exprs = append(exprs, sourceExp...)
-
-	destExp, err := r.applyNetwork(destination, nil, false)
-	if err != nil {
-		return nil, fmt.Errorf("apply destination: %w", err)
-	}
-	exprs = append(exprs, destExp...)
-
-	// Handle protocol
-	if proto != firewall.ProtocolALL {
-		protoNum, err := r.af.protoNum(proto)
-		if err != nil {
-			return nil, fmt.Errorf("convert protocol to number: %w", err)
-		}
-		exprs = append(exprs, &expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1})
-		exprs = append(exprs, &expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     []byte{protoNum},
-		})
-
-		exprs = append(exprs, applyPort(sPort, true)...)
-		exprs = append(exprs, applyPort(dPort, false)...)
-	}
-
-	exprs = append(exprs, &expr.Counter{})
-
-	var verdict expr.VerdictKind
-	if action == firewall.ActionAccept {
-		verdict = expr.VerdictAccept
-	} else {
-		verdict = expr.VerdictDrop
-	}
-	exprs = append(exprs, &expr.Verdict{Kind: verdict})
-
-	rule := &nftables.Rule{
-		Table:    r.workTable,
-		Chain:    chain,
-		Exprs:    exprs,
-		UserData: []byte(ruleKey),
-	}
-
-	// Insert DROP rules at the beginning, append ACCEPT rules at the end
-	if action == firewall.ActionDrop {
-		// TODO: Insert after the established rule
-		rule = r.conn.InsertRule(rule)
-	} else {
-		rule = r.conn.AddRule(rule)
-	}
-
-	if err := r.conn.Flush(); err != nil {
-		return nil, fmt.Errorf(flushError, err)
-	}
-
-	r.rules[string(ruleKey)] = rule
-
-	log.Debugf("added route rule: sources=%v, destination=%v, proto=%v, sPort=%v, dPort=%v, action=%v", sources, destination, proto, sPort, dPort, action)
-
-	return ruleKey, nil
-}
-
-func (r *router) getIpSet(set firewall.Set, prefixes []netip.Prefix, isSource bool) ([]expr.Any, error) {
-	ref, err := r.ipsetCounter.Increment(set.HashedName(), setInput{
-		set:      set,
-		prefixes: prefixes,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("create or get ipset: %w", err)
-	}
-
-	return r.getIpSetExprs(ref, isSource)
-}
-
-func (r *router) iptablesProto() iptables.Protocol {
-	if r.af.tableFamily == nftables.TableFamilyIPv6 {
-		return iptables.ProtocolIPv6
-	}
-	return iptables.ProtocolIPv4
-}
-
-func (r *router) hasRule(id string) bool {
-	_, ok := r.rules[id]
-	return ok
-}
-
-func (r *router) hasDNATRule(id string) bool {
-	_, ok := r.rules[id+dnatSuffix]
-	return ok
-}
-
-func (r *router) DeleteRouteRule(rule firewall.Rule) error {
-	if err := r.refreshRulesMap(); err != nil {
-		return fmt.Errorf(refreshRulesMapError, err)
-	}
-
-	ruleKey := rule.ID()
-	nftRule, exists := r.rules[ruleKey]
-	if !exists {
-		log.Debugf("route rule %s not found", ruleKey)
-		return nil
-	}
-
-	if nftRule.Handle == 0 {
-		log.Warnf("route rule %s has no handle, removing stale entry", ruleKey)
-		if err := r.decrementSetCounter(nftRule); err != nil {
-			log.Warnf("decrement set counter for stale rule %s: %v", ruleKey, err)
-		}
-		delete(r.rules, ruleKey)
-		return nil
-	}
-
-	if err := r.deleteNftRule(nftRule, ruleKey); err != nil {
-		return fmt.Errorf("delete: %w", err)
-	}
-
-	if err := r.conn.Flush(); err != nil {
-		return fmt.Errorf(flushError, err)
-	}
-
-	if err := r.decrementSetCounter(nftRule); err != nil {
-		return fmt.Errorf("decrement set counter: %w", err)
-	}
-
-	return nil
-}
-
-func (r *router) createIpSet(setName string, input setInput) (*nftables.Set, error) {
-	// overlapping prefixes will result in an error, so we need to merge them
-	prefixes := firewall.MergeIPRanges(input.prefixes)
-
-	nfset := &nftables.Set{
-		Name:    setName,
-		Comment: input.set.Comment(),
-		Table:   r.workTable,
-		// required for prefixes
-		Interval: true,
-		KeyType:  r.af.setKeyType,
-	}
-
-	elements := r.convertPrefixesToSet(prefixes)
-	nElements := len(elements)
-
-	maxElements := maxPrefixesSet * 2
-	initialElements := elements[:min(maxElements, nElements)]
-
-	if err := r.conn.AddSet(nfset, initialElements); err != nil {
-		return nil, fmt.Errorf("error adding set %s: %w", setName, err)
-	}
-	if err := r.conn.Flush(); err != nil {
-		return nil, fmt.Errorf("flush error: %w", err)
-	}
-	log.Debugf("Created new ipset: %s with %d initial prefixes (total prefixes %d)", setName, len(initialElements)/2, len(prefixes))
-
-	var subEnd int
-	for subStart := maxElements; subStart < nElements; subStart += maxElements {
-		subEnd = min(subStart+maxElements, nElements)
-		subElement := elements[subStart:subEnd]
-		nSubPrefixes := len(subElement) / 2
-		log.Tracef("Adding new prefixes (%d) in ipset: %s", nSubPrefixes, setName)
-		if err := r.conn.SetAddElements(nfset, subElement); err != nil {
-			return nil, fmt.Errorf("error adding prefixes (%d) to set %s: %w", nSubPrefixes, setName, err)
-		}
-		if err := r.conn.Flush(); err != nil {
-			return nil, fmt.Errorf("flush error: %w", err)
-		}
-		log.Debugf("Added new prefixes (%d) in ipset: %s", nSubPrefixes, setName)
-	}
-
-	log.Infof("Created new ipset: %s with %d prefixes", setName, len(prefixes))
-	return nfset, nil
-}
-
-func (r *router) convertPrefixesToSet(prefixes []netip.Prefix) []nftables.SetElement {
-	var elements []nftables.SetElement
-	for _, prefix := range prefixes {
-		// nftables needs half-open intervals [firstIP, lastIP) for prefixes
-		// e.g. 10.0.0.0/24 becomes [10.0.0.0, 10.0.1.0), 10.1.1.1/32 becomes [10.1.1.1, 10.1.1.2) etc
-		firstIP := prefix.Addr()
-		lastIP := calculateLastIP(prefix).Next()
-
-		elements = append(elements,
-			// the nft tool also adds a zero-address IntervalEnd element, see https://github.com/google/nftables/issues/247
-			// nftables.SetElement{Key: make([]byte, r.af.addrLen), IntervalEnd: true},
-			nftables.SetElement{Key: firstIP.AsSlice()},
-			nftables.SetElement{Key: lastIP.AsSlice(), IntervalEnd: true},
-		)
-	}
-	return elements
-}
-
-// calculateLastIP determines the last IP in a given prefix.
-func calculateLastIP(prefix netip.Prefix) netip.Addr {
-	masked := prefix.Masked()
-	if masked.Addr().Is4() {
-		hostMask := ^uint32(0) >> masked.Bits()
-		lastIP := uint32FromNetipAddr(masked.Addr()) | hostMask
-		return netip.AddrFrom4(uint32ToBytes(lastIP))
-	}
-
-	// IPv6: set host bits to all 1s
-	b := masked.Addr().As16()
-	bits := masked.Bits()
-	for i := bits; i < 128; i++ {
-		b[i/8] |= 1 << (7 - i%8)
-	}
-	return netip.AddrFrom16(b)
-}
-
-// Utility function to convert netip.Addr to uint32.
-func uint32FromNetipAddr(addr netip.Addr) uint32 {
-	b := addr.As4()
-	return binary.BigEndian.Uint32(b[:])
-}
-
-// Utility function to convert uint32 to a netip-compatible byte slice.
-func uint32ToBytes(ip uint32) [4]byte {
-	var b [4]byte
-	binary.BigEndian.PutUint32(b[:], ip)
-	return b
-}
-
-func (r *router) deleteIpSet(setName string, nfset *nftables.Set) error {
-	r.conn.DelSet(nfset)
-	if err := r.conn.Flush(); err != nil {
-		return fmt.Errorf(flushError, err)
-	}
-
-	log.Debugf("Deleted unused ipset %s", setName)
-	return nil
-}
-
-func (r *router) decrementSetCounter(rule *nftables.Rule) error {
-	sets := r.findSets(rule)
-
-	var merr *multierror.Error
-	for _, setName := range sets {
-		if _, err := r.ipsetCounter.Decrement(setName); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("decrement set counter: %w", err))
-		}
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) findSets(rule *nftables.Rule) []string {
-	var sets []string
-	for _, e := range rule.Exprs {
-		if lookup, ok := e.(*expr.Lookup); ok {
-			sets = append(sets, lookup.SetName)
-		}
-	}
-	return sets
-}
-
-func (r *router) deleteNftRule(rule *nftables.Rule, ruleKey string) error {
-	if err := r.conn.DelRule(rule); err != nil {
-		return fmt.Errorf("delete rule %s: %w", ruleKey, err)
-	}
-	delete(r.rules, ruleKey)
-
-	log.Debugf("removed route rule %s", ruleKey)
-
-	return nil
-}
-
-// AddNatRule appends a nftables rule pair to the nat chain
-func (r *router) AddNatRule(pair firewall.RouterPair) error {
-	if err := r.refreshRulesMap(); err != nil {
-		return fmt.Errorf(refreshRulesMapError, err)
-	}
-
-	if r.legacyManagement {
-		log.Warnf("This peer is connected to a NetBird Management service with an older version. Allowing all traffic for %s", pair.Destination)
-		if err := r.addLegacyRouteRule(pair); err != nil {
-			return fmt.Errorf("add legacy routing rule: %w", err)
-		}
-	}
-
-	if pair.Masquerade {
-		if err := r.addNatRule(pair); err != nil {
-			return fmt.Errorf("add nat rule: %w", err)
-		}
-
-		if err := r.addNatRule(firewall.GetInversePair(pair)); err != nil {
-			return fmt.Errorf("add inverse nat rule: %w", err)
-		}
-	}
-
-	if err := r.conn.Flush(); err != nil {
-		r.rollbackRules(pair)
-		return fmt.Errorf("insert rules for %s: %w", pair.Destination, err)
-	}
-
-	return nil
-}
-
-// rollbackRules cleans up unflushed rules and their set counters after a flush failure.
-func (r *router) rollbackRules(pair firewall.RouterPair) {
-	keys := []string{
-		firewall.GenKey(firewall.ForwardingFormat, pair),
-		firewall.GenKey(firewall.PreroutingFormat, pair),
-		firewall.GenKey(firewall.PreroutingFormat, firewall.GetInversePair(pair)),
-	}
-	for _, key := range keys {
-		rule, ok := r.rules[key]
-		if !ok {
-			continue
-		}
-		if err := r.decrementSetCounter(rule); err != nil {
-			log.Warnf("rollback set counter for %s: %v", key, err)
-		}
-		delete(r.rules, key)
-	}
-}
-
-// addNatRule inserts a nftables rule to the conn client flush queue
-func (r *router) addNatRule(pair firewall.RouterPair) error {
-	sourceExp, err := r.applyNetwork(pair.Source, nil, true)
-	if err != nil {
-		return fmt.Errorf("apply source: %w", err)
-	}
-
-	destExp, err := r.applyNetwork(pair.Destination, nil, false)
-	if err != nil {
-		return fmt.Errorf("apply destination: %w", err)
-	}
-
-	op := expr.CmpOpEq
-	if pair.Inverse {
-		op = expr.CmpOpNeq
-	}
-
-	exprs := []expr.Any{
-		&expr.Meta{
-			Key:      expr.MetaKeyIIFNAME,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       op,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-	}
-	// We only care about NEW connections to mark them and later identify them in the postrouting chain for masquerading.
-	// Masquerading will take care of the conntrack state, which means we won't need to mark established connections.
-	exprs = append(exprs, getCtNewExprs()...)
-
-	exprs = append(exprs, sourceExp...)
-	exprs = append(exprs, destExp...)
-
-	var markValue uint32 = nbnet.PreroutingFwmarkMasquerade
-	if pair.Inverse {
-		markValue = nbnet.PreroutingFwmarkMasqueradeReturn
-	}
-
-	exprs = append(exprs,
-		&expr.Immediate{
-			Register: 1,
-			Data:     binaryutil.NativeEndian.PutUint32(markValue),
-		},
-		&expr.Meta{
-			Key:            expr.MetaKeyMARK,
-			SourceRegister: true,
-			Register:       1,
-		},
-	)
-
-	ruleKey := firewall.GenKey(firewall.PreroutingFormat, pair)
-
-	if _, exists := r.rules[ruleKey]; exists {
-		if err := r.removeNatRule(pair); err != nil {
-			return fmt.Errorf("remove prerouting rule: %w", err)
-		}
-	}
-
-	// Ensure nat rules come first, so the mark can be overwritten.
-	// Currently overwritten by the dst-type LOCAL rules for redirected traffic.
-	r.rules[ruleKey] = r.conn.InsertRule(&nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameManglePrerouting],
-		Exprs:    exprs,
-		UserData: []byte(ruleKey),
-	})
-
-	return nil
-}
-
-// addPostroutingRules adds the masquerade rules
-func (r *router) addPostroutingRules() {
-	// First masquerade rule for traffic coming in from WireGuard interface
-	exprs := []expr.Any{
-		// Match on the first fwmark
-		&expr.Meta{
-			Key:      expr.MetaKeyMARK,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkMasquerade),
-		},
-
-		// We need to exclude the loopback interface as this changes the ebpf proxy port
-		&expr.Meta{
-			Key:      expr.MetaKeyOIFNAME,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpNeq,
-			Register: 1,
-			Data:     ifname("lo"),
-		},
-		&expr.Counter{},
-		&expr.Masq{},
-	}
-
-	r.conn.AddRule(&nftables.Rule{
-		Table: r.workTable,
-		Chain: r.chains[chainNameRoutingNat],
-		Exprs: exprs,
-	})
-
-	// Second masquerade rule for traffic going out through WireGuard interface
-	exprs2 := []expr.Any{
-		// Match on the second fwmark
-		&expr.Meta{
-			Key:      expr.MetaKeyMARK,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkMasqueradeReturn),
-		},
-
-		// Match WireGuard interface
-		&expr.Meta{
-			Key:      expr.MetaKeyOIFNAME,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-		&expr.Counter{},
-		&expr.Masq{},
-	}
-
-	r.conn.AddRule(&nftables.Rule{
-		Table: r.workTable,
-		Chain: r.chains[chainNameRoutingNat],
-		Exprs: exprs2,
-	})
-}
-
-// addMSSClampingRules adds MSS clamping rules to prevent fragmentation for forwarded traffic.
-func (r *router) addMSSClampingRules() error {
-	overhead := uint16(ipv4TCPHeaderSize)
-	if r.af.tableFamily == nftables.TableFamilyIPv6 {
-		overhead = ipv6TCPHeaderSize
-	}
-	if r.mtu <= overhead {
-		log.Debugf("MTU %d too small for MSS clamping (overhead %d), skipping", r.mtu, overhead)
-		return nil
-	}
-	mss := r.mtu - overhead
-
-	exprsOut := []expr.Any{
-		&expr.Meta{
-			Key:      expr.MetaKeyOIFNAME,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-		&expr.Meta{
-			Key:      expr.MetaKeyL4PROTO,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     []byte{unix.IPPROTO_TCP},
-		},
-		&expr.Payload{
-			DestRegister: 1,
-			Base:         expr.PayloadBaseTransportHeader,
-			Offset:       13,
-			Len:          1,
-		},
-		&expr.Bitwise{
-			DestRegister:   1,
-			SourceRegister: 1,
-			Len:            1,
-			Mask:           []byte{0x02},
-			Xor:            []byte{0x00},
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpNeq,
-			Register: 1,
-			Data:     []byte{0x00},
-		},
-		&expr.Counter{},
-		&expr.Exthdr{
-			DestRegister: 1,
-			Type:         2,
-			Offset:       2,
-			Len:          2,
-			Op:           expr.ExthdrOpTcpopt,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpGt,
-			Register: 1,
-			Data:     binaryutil.BigEndian.PutUint16(uint16(mss)),
-		},
-		&expr.Immediate{
-			Register: 1,
-			Data:     binaryutil.BigEndian.PutUint16(uint16(mss)),
-		},
-		&expr.Exthdr{
-			SourceRegister: 1,
-			Type:           2,
-			Offset:         2,
-			Len:            2,
-			Op:             expr.ExthdrOpTcpopt,
-		},
-	}
-
-	r.conn.AddRule(&nftables.Rule{
-		Table: r.workTable,
-		Chain: r.chains[chainNameMangleForward],
-		Exprs: exprsOut,
-	})
-
-	return r.conn.Flush()
-}
-
-// addLegacyRouteRule adds a legacy routing rule for mgmt servers pre route acls
-func (r *router) addLegacyRouteRule(pair firewall.RouterPair) error {
-	sourceExp, err := r.applyNetwork(pair.Source, nil, true)
-	if err != nil {
-		return fmt.Errorf("apply source: %w", err)
-	}
-
-	destExp, err := r.applyNetwork(pair.Destination, nil, false)
-	if err != nil {
-		return fmt.Errorf("apply destination: %w", err)
-	}
-
-	exprs := []expr.Any{
-		&expr.Counter{},
-		&expr.Verdict{
-			Kind: expr.VerdictAccept,
-		},
-	}
-
-	exprs = append(exprs, sourceExp...)
-	exprs = append(exprs, destExp...)
-
-	ruleKey := firewall.GenKey(firewall.ForwardingFormat, pair)
-
-	if _, exists := r.rules[ruleKey]; exists {
-		if err := r.removeLegacyRouteRule(pair); err != nil {
-			return fmt.Errorf("remove legacy routing rule: %w", err)
-		}
-	}
-
-	r.rules[ruleKey] = r.conn.AddRule(&nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameRoutingFw],
-		Exprs:    exprs,
-		UserData: []byte(ruleKey),
-	})
-	return nil
-}
-
-// removeLegacyRouteRule removes a legacy routing rule for mgmt servers pre route acls
-func (r *router) removeLegacyRouteRule(pair firewall.RouterPair) error {
-	ruleKey := firewall.GenKey(firewall.ForwardingFormat, pair)
-
-	rule, exists := r.rules[ruleKey]
-	if !exists {
-		return nil
-	}
-
-	if rule.Handle == 0 {
-		log.Warnf("legacy forwarding rule %s has no handle, removing stale entry", ruleKey)
-		if err := r.decrementSetCounter(rule); err != nil {
-			log.Warnf("decrement set counter for stale rule %s: %v", ruleKey, err)
-		}
-		delete(r.rules, ruleKey)
-		return nil
-	}
-
-	if err := r.conn.DelRule(rule); err != nil {
-		return fmt.Errorf("remove legacy forwarding rule %s -> %s: %w", pair.Source, pair.Destination, err)
-	}
-
-	log.Debugf("removed legacy forwarding rule %s -> %s", pair.Source, pair.Destination)
-
-	delete(r.rules, ruleKey)
-
-	if err := r.decrementSetCounter(rule); err != nil {
-		return fmt.Errorf("decrement set counter: %w", err)
-	}
-
-	return nil
-}
-
-// GetLegacyManagement returns the route manager's legacy management mode
-func (r *router) GetLegacyManagement() bool {
-	return r.legacyManagement
-}
-
-// SetLegacyManagement sets the route manager to use legacy management mode
-func (r *router) SetLegacyManagement(isLegacy bool) {
-	r.legacyManagement = isLegacy
-}
-
-// RemoveAllLegacyRouteRules removes all legacy routing rules for mgmt servers pre route acls
-func (r *router) RemoveAllLegacyRouteRules() error {
-	if err := r.refreshRulesMap(); err != nil {
-		return fmt.Errorf(refreshRulesMapError, err)
-	}
-
-	var merr *multierror.Error
-	for k, rule := range r.rules {
-		if !strings.HasPrefix(k, firewall.ForwardingFormatPrefix) {
-			continue
-		}
-		if err := r.conn.DelRule(rule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove legacy forwarding rule: %v", err))
-		} else {
-			delete(r.rules, k)
-		}
-
-	}
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-// acceptForwardRules adds iif/oif rules in the filter table/forward chain to make sure
-// that our traffic is not dropped by existing rules there.
-// The existing FORWARD rules/policies decide outbound traffic towards our interface.
-// In case the FORWARD policy is set to "drop", we add an established/related rule to allow return traffic for the inbound rule.
-// This method also adds INPUT chain rules to allow traffic to the local interface.
-func (r *router) acceptForwardRules() error {
-	var merr *multierror.Error
-
-	if err := r.acceptFilterTableRules(); err != nil {
-		merr = multierror.Append(merr, err)
-	}
-
-	if err := r.acceptExternalChainsRules(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("add accept rules to external chains: %w", err))
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) acceptFilterTableRules() error {
-	if r.filterTable == nil {
-		return nil
-	}
-
-	fw := "iptables"
-
-	defer func() {
-		log.Debugf("Used %s to add accept forward and input rules", fw)
-	}()
-
-	// Try iptables first and fallback to nftables if iptables is not available.
-	// Use the correct protocol (iptables vs ip6tables) for the address family.
-	ipt, err := iptables.NewWithProtocol(r.iptablesProto())
-	if err != nil {
-		log.Warnf("Will use nftables to manipulate the filter table because iptables is not available: %v", err)
-
-		fw = "nftables"
-		return r.acceptFilterRulesNftables(r.filterTable)
-	}
-
-	if err := r.acceptFilterRulesIptables(ipt); err != nil {
-		log.Warnf("iptables failed (table may be incompatible), falling back to nftables: %v", err)
-		fw = "nftables"
-		return r.acceptFilterRulesNftables(r.filterTable)
-	}
-	return nil
-}
-
-func (r *router) acceptFilterRulesIptables(ipt *iptables.IPTables) error {
-	var merr *multierror.Error
-
-	for _, rule := range r.getAcceptForwardRules() {
-		if err := ipt.Insert("filter", chainNameForward, 1, rule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("add iptables forward rule: %v", err))
-		} else {
-			log.Debugf("added iptables forward rule: %v", rule)
-		}
-	}
-
-	inputRule := r.getAcceptInputRule()
-	if err := ipt.Insert("filter", chainNameInput, 1, inputRule...); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("add iptables input rule: %v", err))
-	} else {
-		log.Debugf("added iptables input rule: %v", inputRule)
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) getAcceptForwardRules() [][]string {
-	intf := r.wgIface.Name()
-	return [][]string{
-		{"-i", intf, "-j", "ACCEPT"},
-		{"-o", intf, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"},
-	}
-}
-
-func (r *router) getAcceptInputRule() []string {
-	return []string{"-i", r.wgIface.Name(), "-j", "ACCEPT"}
-}
-
-// acceptFilterRulesNftables adds accept rules to the ip filter table using nftables.
-// This is used when iptables is not available.
-func (r *router) acceptFilterRulesNftables(table *nftables.Table) error {
-	intf := ifname(r.wgIface.Name())
-
-	forwardChain := &nftables.Chain{
-		Name:     chainNameForward,
-		Table:    table,
-		Type:     nftables.ChainTypeFilter,
-		Hooknum:  nftables.ChainHookForward,
-		Priority: nftables.ChainPriorityFilter,
-	}
-	r.insertForwardAcceptRules(forwardChain, intf)
-
-	inputChain := &nftables.Chain{
-		Name:     chainNameInput,
-		Table:    table,
-		Type:     nftables.ChainTypeFilter,
-		Hooknum:  nftables.ChainHookInput,
-		Priority: nftables.ChainPriorityFilter,
-	}
-	r.insertInputAcceptRule(inputChain, intf)
-
-	return r.conn.Flush()
-}
-
-// acceptExternalChainsRules adds accept rules to external chains (non-netbird, non-iptables tables).
-// It dynamically finds chains at call time to handle chains that may have been created after startup.
-func (r *router) acceptExternalChainsRules() error {
-	chains := r.findExternalChains()
-	if len(chains) == 0 {
-		return nil
-	}
-
-	intf := ifname(r.wgIface.Name())
-	for _, chain := range chains {
-		r.applyExternalChainAccept(chain, intf)
-	}
-
-	if err := r.conn.Flush(); err != nil {
-		return fmt.Errorf("flush external chain rules: %w", err)
-	}
-	return nil
-}
-
-func (r *router) applyExternalChainAccept(chain *nftables.Chain, intf []byte) {
-	if chain.Hooknum == nil {
-		log.Debugf("skipping external chain %s/%s: hooknum is nil", chain.Table.Name, chain.Name)
-		return
-	}
-
-	log.Debugf("adding accept rules to external %s chain: %s %s/%s",
-		hookName(chain.Hooknum), familyName(chain.Table.Family), chain.Table.Name, chain.Name)
-
-	switch *chain.Hooknum {
-	case *nftables.ChainHookForward:
-		r.insertForwardAcceptRules(chain, intf)
-	case *nftables.ChainHookInput:
-		r.insertInputAcceptRule(chain, intf)
-	}
-}
-
-func (r *router) insertForwardAcceptRules(chain *nftables.Chain, intf []byte) {
-	existing, err := r.existingNetbirdRulesInChain(chain)
-	if err != nil {
-		log.Warnf("skip forward accept rules in %s/%s: %v", chain.Table.Name, chain.Name, err)
-		return
-	}
-	r.insertForwardIifRule(chain, intf, existing)
-	r.insertForwardOifEstablishedRule(chain, intf, existing)
-}
-
-func (r *router) insertForwardIifRule(chain *nftables.Chain, intf []byte, existing map[string]bool) {
-	if existing[userDataAcceptForwardRuleIif] {
-		return
-	}
-	r.conn.InsertRule(&nftables.Rule{
-		Table: chain.Table,
-		Chain: chain,
-		Exprs: []expr.Any{
-			&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: intf},
-			&expr.Counter{},
-			&expr.Verdict{Kind: expr.VerdictAccept},
-		},
-		UserData: []byte(userDataAcceptForwardRuleIif),
-	})
-}
-
-func (r *router) insertForwardOifEstablishedRule(chain *nftables.Chain, intf []byte, existing map[string]bool) {
-	if existing[userDataAcceptForwardRuleOif] {
-		return
-	}
-	exprs := []expr.Any{
-		&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
-		&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: intf},
-	}
-	r.conn.InsertRule(&nftables.Rule{
-		Table:    chain.Table,
-		Chain:    chain,
-		Exprs:    append(exprs, getEstablishedExprs(2)...),
-		UserData: []byte(userDataAcceptForwardRuleOif),
-	})
-}
-
-func (r *router) insertInputAcceptRule(chain *nftables.Chain, intf []byte) {
-	existing, err := r.existingNetbirdRulesInChain(chain)
-	if err != nil {
-		log.Warnf("skip input accept rule in %s/%s: %v", chain.Table.Name, chain.Name, err)
-		return
-	}
-	if existing[userDataAcceptInputRule] {
-		return
-	}
-	r.conn.InsertRule(&nftables.Rule{
-		Table: chain.Table,
-		Chain: chain,
-		Exprs: []expr.Any{
-			&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
-			&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: intf},
-			&expr.Counter{},
-			&expr.Verdict{Kind: expr.VerdictAccept},
-		},
-		UserData: []byte(userDataAcceptInputRule),
-	})
-}
-
-// existingNetbirdRulesInChain returns the set of netbird-owned UserData tags present in a chain; callers must bail on error since InsertRule is additive.
-func (r *router) existingNetbirdRulesInChain(chain *nftables.Chain) (map[string]bool, error) {
-	rules, err := r.conn.GetRules(chain.Table, chain)
-	if err != nil {
-		return nil, fmt.Errorf("list rules: %w", err)
-	}
-	present := map[string]bool{}
-	for _, rule := range rules {
-		if !isNetbirdAcceptRuleTag(rule.UserData) {
-			continue
-		}
-		present[string(rule.UserData)] = true
-	}
-	return present, nil
-}
-
-func isNetbirdAcceptRuleTag(userData []byte) bool {
-	switch string(userData) {
-	case userDataAcceptForwardRuleIif,
-		userDataAcceptForwardRuleOif,
-		userDataAcceptInputRule:
-		return true
-	}
-	return false
-}
-
-func (r *router) removeAcceptFilterRules() error {
-	var merr *multierror.Error
-
-	if err := r.removeFilterTableRules(); err != nil {
-		merr = multierror.Append(merr, err)
-	}
-
-	if err := r.removeExternalChainsRules(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove external chain rules: %w", err))
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) removeFilterTableRules() error {
-	if r.filterTable == nil {
-		return nil
-	}
-
-	ipt, err := iptables.NewWithProtocol(r.iptablesProto())
-	if err != nil {
-		log.Debugf("iptables not available, using nftables to remove filter rules: %v", err)
-		return r.removeAcceptRulesFromTable(r.filterTable)
-	}
-
-	if err := r.removeAcceptFilterRulesIptables(ipt); err != nil {
-		log.Debugf("iptables removal failed (table may be incompatible), falling back to nftables: %v", err)
-		return r.removeAcceptRulesFromTable(r.filterTable)
-	}
-	return nil
-}
-
-func (r *router) removeAcceptRulesFromTable(table *nftables.Table) error {
-	chains, err := r.conn.ListChainsOfTableFamily(table.Family)
-	if err != nil {
-		return fmt.Errorf("list chains: %v", err)
-	}
-
-	for _, chain := range chains {
-		if chain.Table.Name != table.Name {
-			continue
-		}
-
-		if chain.Name != chainNameForward && chain.Name != chainNameInput {
-			continue
-		}
-
-		if err := r.removeAcceptRulesFromChain(table, chain); err != nil {
-			return err
-		}
-	}
-
-	return r.conn.Flush()
-}
-
-func (r *router) removeAcceptRulesFromChain(table *nftables.Table, chain *nftables.Chain) error {
-	rules, err := r.conn.GetRules(table, chain)
-	if err != nil {
-		return fmt.Errorf("get rules from %s/%s: %v", table.Name, chain.Name, err)
-	}
-
-	for _, rule := range rules {
-		if bytes.Equal(rule.UserData, []byte(userDataAcceptForwardRuleIif)) ||
-			bytes.Equal(rule.UserData, []byte(userDataAcceptForwardRuleOif)) ||
-			bytes.Equal(rule.UserData, []byte(userDataAcceptInputRule)) {
-			if err := r.conn.DelRule(rule); err != nil {
-				return fmt.Errorf("delete rule from %s/%s: %v", table.Name, chain.Name, err)
-			}
-		}
-	}
-	return nil
-}
-
-// removeExternalChainsRules removes our accept rules from all external chains.
-// This is deterministic - it scans for chains at removal time rather than relying on saved state,
-// ensuring cleanup works even after a crash or if chains changed.
-func (r *router) removeExternalChainsRules() error {
-	chains := r.findExternalChains()
-	if len(chains) == 0 {
-		return nil
-	}
-
-	for _, chain := range chains {
-		if err := r.removeAcceptRulesFromChain(chain.Table, chain); err != nil {
-			log.Warnf("remove rules from external chain %s/%s: %v", chain.Table.Name, chain.Name, err)
-		}
-	}
-
-	return r.conn.Flush()
-}
-
-// findExternalChains scans for chains from non-netbird tables that have FORWARD or INPUT hooks.
-// This is used both at startup (to know where to add rules) and at cleanup (to ensure deterministic removal).
-func (r *router) findExternalChains() []*nftables.Chain {
-	var chains []*nftables.Chain
-
-	families := []nftables.TableFamily{r.af.tableFamily, nftables.TableFamilyINet}
-
-	for _, family := range families {
-		allChains, err := r.conn.ListChainsOfTableFamily(family)
-		if err != nil {
-			log.Debugf("list chains for family %d: %v", family, err)
-			continue
-		}
-
-		for _, chain := range allChains {
-			if r.isExternalChain(chain) {
-				chains = append(chains, chain)
-			}
-		}
-	}
-
-	return chains
-}
-
-func (r *router) isExternalChain(chain *nftables.Chain) bool {
-	if r.workTable != nil && chain.Table.Name == r.workTable.Name {
-		return false
-	}
-
-	// Skip firewalld-owned chains. Firewalld creates its chains with the
-	// NFT_CHAIN_OWNER flag, so inserting rules into them returns EPERM.
-	// We delegate acceptance to firewalld by trusting the interface instead.
-	if chain.Table.Name == firewalldTableName {
-		return false
-	}
-
-	// Skip iptables/ip6tables-managed tables (adding nft-native rules breaks iptables-save compat)
-	if (chain.Table.Family == nftables.TableFamilyIPv4 || chain.Table.Family == nftables.TableFamilyIPv6) && isIptablesTable(chain.Table.Name) {
-		return false
-	}
-
-	if chain.Type != nftables.ChainTypeFilter {
-		return false
-	}
-
-	if chain.Hooknum == nil {
-		return false
-	}
-
-	return *chain.Hooknum == *nftables.ChainHookForward || *chain.Hooknum == *nftables.ChainHookInput
-}
-
-func isIptablesTable(name string) bool {
-	switch name {
-	case tableNameFilter, tableNat, tableMangle, tableRaw, tableSecurity:
-		return true
-	}
-	return false
-}
-
-func (r *router) removeAcceptFilterRulesIptables(ipt *iptables.IPTables) error {
-	var merr *multierror.Error
-
-	for _, rule := range r.getAcceptForwardRules() {
-		if err := ipt.DeleteIfExists("filter", chainNameForward, rule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove iptables forward rule: %v", err))
-		}
-	}
-
-	inputRule := r.getAcceptInputRule()
-	if err := ipt.DeleteIfExists("filter", chainNameInput, inputRule...); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove iptables input rule: %v", err))
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-// RemoveNatRule removes the prerouting mark rule
-func (r *router) RemoveNatRule(pair firewall.RouterPair) error {
-	if err := r.refreshRulesMap(); err != nil {
-		return fmt.Errorf(refreshRulesMapError, err)
-	}
-
-	var merr *multierror.Error
-
-	if pair.Masquerade {
-		if err := r.removeNatRule(pair); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove prerouting rule: %w", err))
-		}
-
-		if err := r.removeNatRule(firewall.GetInversePair(pair)); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove inverse prerouting rule: %w", err))
-		}
-	}
-
-	if err := r.removeLegacyRouteRule(pair); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove legacy routing rule: %w", err))
-	}
-
-	// Set counters are decremented in the sub-methods above before flush. If flush fails,
-	// counters will be off until the next successful removal or refresh cycle.
-	if err := r.conn.Flush(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("flush remove nat rules %s: %w", pair.Destination, err))
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) removeNatRule(pair firewall.RouterPair) error {
-	ruleKey := firewall.GenKey(firewall.PreroutingFormat, pair)
-
-	rule, exists := r.rules[ruleKey]
-	if !exists {
-		log.Debugf("prerouting rule %s not found", ruleKey)
-		return nil
-	}
-
-	if rule.Handle == 0 {
-		log.Warnf("prerouting rule %s has no handle, removing stale entry", ruleKey)
-		if err := r.decrementSetCounter(rule); err != nil {
-			log.Warnf("decrement set counter for stale rule %s: %v", ruleKey, err)
-		}
-		delete(r.rules, ruleKey)
-		return nil
-	}
-
-	if err := r.conn.DelRule(rule); err != nil {
-		return fmt.Errorf("remove prerouting rule %s -> %s: %w", pair.Source, pair.Destination, err)
-	}
-
-	log.Debugf("removed prerouting rule %s -> %s", pair.Source, pair.Destination)
-
-	delete(r.rules, ruleKey)
-
-	if err := r.decrementSetCounter(rule); err != nil {
-		return fmt.Errorf("decrement set counter: %w", err)
-	}
-
-	return nil
-}
-
-// refreshRulesMap rebuilds the rule map from the kernel. This removes stale entries
-// (e.g. from failed flushes) and updates handles for all existing rules.
-func (r *router) refreshRulesMap() error {
-	var merr *multierror.Error
-	newRules := make(map[string]*nftables.Rule)
-	for _, chain := range r.chains {
-		rules, err := r.conn.GetRules(chain.Table, chain)
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("list rules for chain %s: %w", chain.Name, err))
-			// preserve existing entries for this chain since we can't verify their state
-			for k, v := range r.rules {
-				if v.Chain != nil && v.Chain.Name == chain.Name {
-					newRules[k] = v
-				}
-			}
-			continue
-		}
-		for _, rule := range rules {
-			if len(rule.UserData) > 0 {
-				newRules[string(rule.UserData)] = rule
-			}
-		}
-	}
-	r.rules = newRules
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	if err := r.ipFwdState.RequestForwarding(); err != nil {
-		return nil, err
-	}
-
-	ruleKey := rule.ID()
-	if _, exists := r.rules[ruleKey+dnatSuffix]; exists {
-		return rule, nil
-	}
-
-	protoNum, err := r.af.protoNum(rule.Protocol)
-	if err != nil {
-		return nil, fmt.Errorf("convert protocol to number: %w", err)
-	}
-
-	if err := r.addDnatRedirect(rule, protoNum, ruleKey); err != nil {
-		return nil, err
-	}
-
-	r.addDnatMasq(rule, protoNum, ruleKey)
-
-	// Unlike iptables, there's no point in adding "out" rules in the forward chain here as our policy is ACCEPT.
-	// To overcome DROP policies in other chains, we'd have to add rules to the chains there.
-	// We also cannot just add "oif <iface> accept" there and filter in our own table as we don't know what is supposed to be allowed.
-	// TODO: find chains with drop policies and add rules there
-
-	if err := r.conn.Flush(); err != nil {
-		return nil, fmt.Errorf("flush rules: %w", err)
-	}
-
-	return &rule, nil
-}
-
-func (r *router) addDnatRedirect(rule firewall.ForwardRule, protoNum uint8, ruleKey string) error {
-	dnatExprs := []expr.Any{
-		&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpNeq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     []byte{protoNum},
-		},
-		&expr.Payload{
-			DestRegister: 1,
-			Base:         expr.PayloadBaseTransportHeader,
-			Offset:       2,
-			Len:          2,
-		},
-	}
-	dnatExprs = append(dnatExprs, applyPort(&rule.DestinationPort, false)...)
-
-	// shifted translated port is not supported in nftables, so we hand this over to xtables
-	if rule.TranslatedPort.IsRange && len(rule.TranslatedPort.Values) == 2 {
-		if rule.TranslatedPort.Values[0] != rule.DestinationPort.Values[0] ||
-			rule.TranslatedPort.Values[1] != rule.DestinationPort.Values[1] {
-			return r.addXTablesRedirect(dnatExprs, ruleKey, rule)
-		}
-	}
-
-	additionalExprs, regProtoMin, regProtoMax, err := r.handleTranslatedPort(rule)
-	if err != nil {
-		return err
-	}
-	dnatExprs = append(dnatExprs, additionalExprs...)
-
-	dnatExprs = append(dnatExprs,
-		&expr.NAT{
-			Type:        expr.NATTypeDestNAT,
-			Family:      uint32(r.af.tableFamily),
-			RegAddrMin:  1,
-			RegProtoMin: regProtoMin,
-			RegProtoMax: regProtoMax,
-		},
-	)
-
-	dnatRule := &nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameRoutingRdr],
-		Exprs:    dnatExprs,
-		UserData: []byte(ruleKey + dnatSuffix),
-	}
-	r.conn.AddRule(dnatRule)
-	r.rules[ruleKey+dnatSuffix] = dnatRule
-
-	return nil
-}
-
-func (r *router) handleTranslatedPort(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	switch {
-	case rule.TranslatedPort.IsRange && len(rule.TranslatedPort.Values) == 2:
-		return r.handlePortRange(rule)
-	case len(rule.TranslatedPort.Values) == 0:
-		return r.handleAddressOnly(rule)
-	case len(rule.TranslatedPort.Values) == 1:
-		return r.handleSinglePort(rule)
-	default:
-		return nil, 0, 0, fmt.Errorf("invalid translated port: %v", rule.TranslatedPort)
-	}
-}
-
-func (r *router) handlePortRange(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	exprs := []expr.Any{
-		&expr.Immediate{
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-		&expr.Immediate{
-			Register: 2,
-			Data:     binaryutil.BigEndian.PutUint16(rule.TranslatedPort.Values[0]),
-		},
-		&expr.Immediate{
-			Register: 3,
-			Data:     binaryutil.BigEndian.PutUint16(rule.TranslatedPort.Values[1]),
-		},
-	}
-	return exprs, 2, 3, nil
-}
-
-func (r *router) handleAddressOnly(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	exprs := []expr.Any{
-		&expr.Immediate{
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-	}
-	return exprs, 0, 0, nil
-}
-
-func (r *router) handleSinglePort(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	exprs := []expr.Any{
-		&expr.Immediate{
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-		&expr.Immediate{
-			Register: 2,
-			Data:     binaryutil.BigEndian.PutUint16(rule.TranslatedPort.Values[0]),
-		},
-	}
-	return exprs, 2, 0, nil
-}
-
-func (r *router) addXTablesRedirect(dnatExprs []expr.Any, ruleKey string, rule firewall.ForwardRule) error {
-	dnatExprs = append(dnatExprs,
-		&expr.Counter{},
-		&expr.Target{
-			Name: "DNAT",
-			Rev:  2,
-			Info: &xt.NatRange2{
-				NatRange: xt.NatRange{
-					Flags:   uint(xt.NatRangeMapIPs | xt.NatRangeProtoSpecified | xt.NatRangeProtoOffset),
-					MinIP:   rule.TranslatedAddress.AsSlice(),
-					MaxIP:   rule.TranslatedAddress.AsSlice(),
-					MinPort: rule.TranslatedPort.Values[0],
-					MaxPort: rule.TranslatedPort.Values[1],
-				},
-				BasePort: rule.DestinationPort.Values[0],
-			},
-		},
-	)
-
-	natTable := &nftables.Table{
-		Name:   tableNat,
-		Family: r.af.tableFamily,
-	}
-	dnatRule := &nftables.Rule{
-		Table: natTable,
-		Chain: &nftables.Chain{
-			Name:     chainNameNatPrerouting,
-			Table:    natTable,
-			Type:     nftables.ChainTypeNAT,
-			Hooknum:  nftables.ChainHookPrerouting,
-			Priority: nftables.ChainPriorityNATDest,
-		},
-		Exprs:    dnatExprs,
-		UserData: []byte(ruleKey + dnatSuffix),
-	}
-	r.conn.AddRule(dnatRule)
-	r.rules[ruleKey+dnatSuffix] = dnatRule
-
-	return nil
-}
-
-func (r *router) addDnatMasq(rule firewall.ForwardRule, protoNum uint8, ruleKey string) {
-	masqExprs := []expr.Any{
-		&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     []byte{protoNum},
-		},
-		&expr.Payload{
-			DestRegister: 1,
-			Base:         expr.PayloadBaseNetworkHeader,
-			Offset:       r.af.dstAddrOffset,
-			Len:          r.af.addrLen,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-	}
-
-	masqExprs = append(masqExprs, applyPort(&rule.TranslatedPort, false)...)
-	masqExprs = append(masqExprs, &expr.Masq{})
-
-	masqRule := &nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameRoutingNat],
-		Exprs:    masqExprs,
-		UserData: []byte(ruleKey + snatSuffix),
-	}
-	r.conn.AddRule(masqRule)
-	r.rules[ruleKey+snatSuffix] = masqRule
-}
-
-func (r *router) DeleteDNATRule(rule firewall.Rule) error {
-	if err := r.ipFwdState.ReleaseForwarding(); err != nil {
-		log.Errorf("%v", err)
-	}
-
-	ruleKey := rule.ID()
-
-	if err := r.refreshRulesMap(); err != nil {
-		return fmt.Errorf(refreshRulesMapError, err)
-	}
-
-	var merr *multierror.Error
-	var needsFlush bool
-
-	if dnatRule, exists := r.rules[ruleKey+dnatSuffix]; exists {
-		if dnatRule.Handle == 0 {
-			log.Warnf("dnat rule %s has no handle, removing stale entry", ruleKey+dnatSuffix)
-			delete(r.rules, ruleKey+dnatSuffix)
-		} else if err := r.conn.DelRule(dnatRule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete dnat rule: %w", err))
-		} else {
-			needsFlush = true
-		}
-	}
-
-	if masqRule, exists := r.rules[ruleKey+snatSuffix]; exists {
-		if masqRule.Handle == 0 {
-			log.Warnf("snat rule %s has no handle, removing stale entry", ruleKey+snatSuffix)
-			delete(r.rules, ruleKey+snatSuffix)
-		} else if err := r.conn.DelRule(masqRule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete snat rule: %w", err))
-		} else {
-			needsFlush = true
-		}
-	}
-
-	if needsFlush {
-		if err := r.conn.Flush(); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf(flushError, err))
-		}
-	}
-
-	if merr == nil {
-		delete(r.rules, ruleKey+dnatSuffix)
-		delete(r.rules, ruleKey+snatSuffix)
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *router) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
-	nfset, err := r.conn.GetSetByName(r.workTable, set.HashedName())
-	if err != nil {
-		return fmt.Errorf("get set %s: %w", set.HashedName(), err)
-	}
-
-	elements := r.convertPrefixesToSet(prefixes)
-	if err := r.conn.SetAddElements(nfset, elements); err != nil {
-		return fmt.Errorf("add elements to set %s: %w", set.HashedName(), err)
-	}
-
-	if err := r.conn.Flush(); err != nil {
-		return fmt.Errorf(flushError, err)
-	}
-
-	log.Debugf("updated set %s with prefixes %v", set.HashedName(), prefixes)
-
-	return nil
-}
-
-// AddInboundDNAT adds an inbound DNAT rule redirecting traffic from NetBird peers to local services.
-func (r *router) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
-	ruleID := fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort)
-
-	if _, exists := r.rules[ruleID]; exists {
-		return nil
-	}
-
-	protoNum, err := r.af.protoNum(protocol)
-	if err != nil {
-		return fmt.Errorf("convert protocol to number: %w", err)
-	}
-
-	exprs := []expr.Any{
-		&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 2},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 2,
-			Data:     []byte{protoNum},
-		},
-		&expr.Payload{
-			DestRegister: 3,
-			Base:         expr.PayloadBaseTransportHeader,
-			Offset:       2,
-			Len:          2,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 3,
-			Data:     binaryutil.BigEndian.PutUint16(originalPort),
-		},
-	}
-
-	bits := 32
-	if localAddr.Is6() {
-		bits = 128
-	}
-	exprs = append(exprs, r.applyPrefix(netip.PrefixFrom(localAddr, bits), false)...)
-
-	exprs = append(exprs,
-		&expr.Immediate{
-			Register: 1,
-			Data:     localAddr.AsSlice(),
-		},
-		&expr.Immediate{
-			Register: 2,
-			Data:     binaryutil.BigEndian.PutUint16(translatedPort),
-		},
-		&expr.NAT{
-			Type:        expr.NATTypeDestNAT,
-			Family:      uint32(r.af.tableFamily),
-			RegAddrMin:  1,
-			RegProtoMin: 2,
-			RegProtoMax: 0,
-		},
-	)
-
-	dnatRule := &nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameRoutingRdr],
-		Exprs:    exprs,
-		UserData: []byte(ruleID),
-	}
-	r.conn.AddRule(dnatRule)
-
-	if err := r.conn.Flush(); err != nil {
-		return fmt.Errorf("add inbound DNAT rule: %w", err)
-	}
-
-	r.rules[ruleID] = dnatRule
-
-	return nil
-}
-
-// RemoveInboundDNAT removes an inbound DNAT rule.
-func (r *router) RemoveInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
-	if err := r.refreshRulesMap(); err != nil {
-		return fmt.Errorf(refreshRulesMapError, err)
-	}
-
-	ruleID := fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort)
-
-	rule, exists := r.rules[ruleID]
-	if !exists {
-		return nil
-	}
-
-	if rule.Handle == 0 {
-		log.Warnf("inbound DNAT rule %s has no handle, removing stale entry", ruleID)
-		delete(r.rules, ruleID)
-		return nil
-	}
-
-	if err := r.conn.DelRule(rule); err != nil {
-		return fmt.Errorf("delete inbound DNAT rule %s: %w", ruleID, err)
-	}
-	if err := r.conn.Flush(); err != nil {
-		return fmt.Errorf("flush delete inbound DNAT rule: %w", err)
-	}
-	delete(r.rules, ruleID)
-
-	return nil
-}
-
-// ensureNATOutputChain lazily creates the OUTPUT NAT chain on first use.
-func (r *router) ensureNATOutputChain() error {
-	if _, exists := r.chains[chainNameNATOutput]; exists {
-		return nil
-	}
-
-	r.chains[chainNameNATOutput] = r.conn.AddChain(&nftables.Chain{
-		Name:     chainNameNATOutput,
-		Table:    r.workTable,
-		Hooknum:  nftables.ChainHookOutput,
-		Priority: nftables.ChainPriorityNATDest,
-		Type:     nftables.ChainTypeNAT,
-	})
-
-	if err := r.conn.Flush(); err != nil {
-		delete(r.chains, chainNameNATOutput)
-		return fmt.Errorf("create NAT output chain: %w", err)
-	}
-	return nil
-}
-
-// AddOutputDNAT adds an OUTPUT chain DNAT rule for locally-generated traffic.
-func (r *router) AddOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
-	ruleID := fmt.Sprintf("output-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort)
-
-	if _, exists := r.rules[ruleID]; exists {
-		return nil
-	}
-
-	if err := r.ensureNATOutputChain(); err != nil {
-		return err
-	}
-
-	protoNum, err := r.af.protoNum(protocol)
-	if err != nil {
-		return fmt.Errorf("convert protocol to number: %w", err)
-	}
-
-	exprs := []expr.Any{
-		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     []byte{protoNum},
-		},
-		&expr.Payload{
-			DestRegister: 2,
-			Base:         expr.PayloadBaseTransportHeader,
-			Offset:       2,
-			Len:          2,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 2,
-			Data:     binaryutil.BigEndian.PutUint16(originalPort),
-		},
-	}
-
-	bits := 32
-	if localAddr.Is6() {
-		bits = 128
-	}
-	exprs = append(exprs, r.applyPrefix(netip.PrefixFrom(localAddr, bits), false)...)
-
-	exprs = append(exprs,
-		&expr.Immediate{
-			Register: 1,
-			Data:     localAddr.AsSlice(),
-		},
-		&expr.Immediate{
-			Register: 2,
-			Data:     binaryutil.BigEndian.PutUint16(translatedPort),
-		},
-		&expr.NAT{
-			Type:        expr.NATTypeDestNAT,
-			Family:      uint32(r.af.tableFamily),
-			RegAddrMin:  1,
-			RegProtoMin: 2,
-		},
-	)
-
-	dnatRule := &nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameNATOutput],
-		Exprs:    exprs,
-		UserData: []byte(ruleID),
-	}
-	r.conn.AddRule(dnatRule)
-
-	if err := r.conn.Flush(); err != nil {
-		return fmt.Errorf("add output DNAT rule: %w", err)
-	}
-
-	r.rules[ruleID] = dnatRule
-
-	return nil
-}
-
-// RemoveOutputDNAT removes an OUTPUT chain DNAT rule.
-func (r *router) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
-	if err := r.refreshRulesMap(); err != nil {
-		return fmt.Errorf(refreshRulesMapError, err)
-	}
-
-	ruleID := fmt.Sprintf("output-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort)
-
-	rule, exists := r.rules[ruleID]
-	if !exists {
-		return nil
-	}
-
-	if rule.Handle == 0 {
-		log.Warnf("output DNAT rule %s has no handle, removing stale entry", ruleID)
-		delete(r.rules, ruleID)
-		return nil
-	}
-
-	if err := r.conn.DelRule(rule); err != nil {
-		return fmt.Errorf("delete output DNAT rule %s: %w", ruleID, err)
-	}
-	if err := r.conn.Flush(); err != nil {
-		return fmt.Errorf("flush delete output DNAT rule: %w", err)
-	}
-	delete(r.rules, ruleID)
-
-	return nil
-}
-
-// applyNetwork generates nftables expressions for networks (CIDR) or sets
-func (r *router) applyNetwork(
-	network firewall.Network,
-	setPrefixes []netip.Prefix,
-	isSource bool,
-) ([]expr.Any, error) {
-	if network.IsSet() {
-		exprs, err := r.getIpSet(network.Set, setPrefixes, isSource)
-		if err != nil {
-			return nil, fmt.Errorf("source: %w", err)
-		}
-		return exprs, nil
-	}
-
-	if network.IsPrefix() {
-		return r.applyPrefix(network.Prefix, isSource), nil
-	}
-
-	return nil, nil
-}
-
-// applyPrefix generates nftables expressions for a CIDR prefix
-func (r *router) applyPrefix(prefix netip.Prefix, isSource bool) []expr.Any {
-	// dst offset by default
-	offset := r.af.dstAddrOffset
-	if isSource {
-		// src offset
-		offset = r.af.srcAddrOffset
-	}
-
-	ones := prefix.Bits()
-	// unspecified address (/0) doesn't need extra expressions
-	if ones == 0 {
-		return nil
-	}
-
-	mask := net.CIDRMask(ones, r.af.totalBits)
-	xor := make([]byte, r.af.addrLen)
-
-	return []expr.Any{
-		&expr.Payload{
-			DestRegister: 1,
-			Base:         expr.PayloadBaseNetworkHeader,
-			Offset:       offset,
-			Len:          r.af.addrLen,
-		},
-		&expr.Bitwise{
-			DestRegister:   1,
-			SourceRegister: 1,
-			Len:            r.af.addrLen,
-			Mask:           mask,
-			Xor:            xor,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     prefix.Masked().Addr().AsSlice(),
-		},
-	}
-}
-
-func applyPort(port *firewall.Port, isSource bool) []expr.Any {
-	if port == nil {
-		return nil
-	}
-
-	var exprs []expr.Any
-
-	offset := uint32(2) // Default offset for destination port
-	if isSource {
-		offset = 0 // Offset for source port
-	}
-
-	exprs = append(exprs, &expr.Payload{
-		DestRegister: 1,
-		Base:         expr.PayloadBaseTransportHeader,
-		Offset:       offset,
-		Len:          2,
-	})
-
-	if port.IsRange && len(port.Values) == 2 {
-		// Handle port range
-		exprs = append(exprs,
-			&expr.Range{
-				Op:       expr.CmpOpEq,
-				Register: 1,
-				FromData: binaryutil.BigEndian.PutUint16(port.Values[0]),
-				ToData:   binaryutil.BigEndian.PutUint16(port.Values[1]),
-			},
-		)
-	} else {
-		// Handle single port or multiple ports
-		for i, p := range port.Values {
-			if i > 0 {
-				// Add a bitwise OR operation between port checks
-				exprs = append(exprs, &expr.Bitwise{
-					SourceRegister: 1,
-					DestRegister:   1,
-					Len:            4,
-					Mask:           []byte{0x00, 0x00, 0xff, 0xff},
-					Xor:            []byte{0x00, 0x00, 0x00, 0x00},
-				})
-			}
-			exprs = append(exprs, &expr.Cmp{
-				Op:       expr.CmpOpEq,
-				Register: 1,
-				Data:     binaryutil.BigEndian.PutUint16(p),
-			})
-		}
-	}
-
-	return exprs
-}
-
-func getCtNewExprs() []expr.Any {
-	return []expr.Any{
-		&expr.Ct{
-			Key:      expr.CtKeySTATE,
-			Register: 1,
-		},
-		&expr.Bitwise{
-			SourceRegister: 1,
-			DestRegister:   1,
-			Len:            4,
-			Mask:           binaryutil.NativeEndian.PutUint32(expr.CtStateBitNEW),
-			Xor:            binaryutil.NativeEndian.PutUint32(0),
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpNeq,
-			Register: 1,
-			Data:     []byte{0, 0, 0, 0},
-		},
-	}
-}
-
-func (r *router) getIpSetExprs(ref refcounter.Ref[*nftables.Set], isSource bool) ([]expr.Any, error) {
-	// dst offset by default
-	offset := r.af.dstAddrOffset
-	if isSource {
-		// src offset
-		offset = r.af.srcAddrOffset
-	}
-
-	return []expr.Any{
-		&expr.Payload{
-			DestRegister: 1,
-			Base:         expr.PayloadBaseNetworkHeader,
-			Offset:       offset,
-			Len:          r.af.addrLen,
-		},
-		&expr.Lookup{
-			SourceRegister: 1,
-			SetName:        ref.Out.Name,
-			SetID:          ref.Out.ID,
-		},
-	}, nil
-}
diff --git a/client/firewall/nftables/router_linux_test.go b/client/firewall/nftables/router_linux_test.go
index 2fc664d51..49dbfc8f2 100644
--- a/client/firewall/nftables/router_linux_test.go
+++ b/client/firewall/nftables/router_linux_test.go
@@ -37,7 +37,7 @@ func TestNftablesManager_AddNatRule(t *testing.T) {
 
 	for _, testCase := range test.InsertRuleTestCases {
 		t.Run(testCase.Name, func(t *testing.T) {
-			// need fw manager to init both acl mgr and router for all chains to be present
+			// need fw manager to init both acl mgr and family for all chains to be present
 			manager, err := Create(ifaceMock, iface.DefaultMTU)
 			t.Cleanup(func() {
 				require.NoError(t, manager.Close(nil))
@@ -47,7 +47,7 @@ func TestNftablesManager_AddNatRule(t *testing.T) {
 
 			nftablesTestingClient := &nftables.Conn{}
 
-			rtr := manager.router
+			rtr := manager.family4
 			err = rtr.AddNatRule(testCase.InputPair)
 			require.NoError(t, err, "pair should be inserted")
 
@@ -90,9 +90,9 @@ func TestNftablesManager_AddNatRule(t *testing.T) {
 				}
 
 				// Build CIDR matching expressions
-				testRouter := &router{af: afIPv4}
-				sourceExp := testRouter.applyPrefix(testCase.InputPair.Source.Prefix, true)
-				destExp := testRouter.applyPrefix(testCase.InputPair.Destination.Prefix, false)
+				testRouter := &family{af: afIPv4}
+				sourceExp := prefixMatchExprs(testRouter.af, testCase.InputPair.Source.Prefix, true)
+				destExp := prefixMatchExprs(testRouter.af, testCase.InputPair.Destination.Prefix, false)
 
 				// Combine all expressions in the correct order
 				// nolint:gocritic
@@ -100,14 +100,14 @@ func TestNftablesManager_AddNatRule(t *testing.T) {
 				testingExpression = append(testingExpression, sourceExp...)
 				testingExpression = append(testingExpression, destExp...)
 
-				natRuleKey := firewall.GenKey(firewall.PreroutingFormat, testCase.InputPair)
+				natRuleKey := testCase.InputPair.GenKey(firewall.PreroutingFormat)
 				found := 0
 				for _, chain := range rtr.chains {
 					if chain.Name == chainNameManglePrerouting {
 						rules, err := nftablesTestingClient.GetRules(chain.Table, chain)
 						require.NoError(t, err, "should list rules for %s table and %s chain", chain.Table.Name, chain.Name)
 						for _, rule := range rules {
-							if len(rule.UserData) > 0 && string(rule.UserData) == natRuleKey {
+							if len(rule.UserData) > 0 && firewall.RuleID(rule.UserData) == natRuleKey {
 								// Compare expressions up to the mark setting expressions
 								require.ElementsMatchf(t, rule.Exprs[:len(testingExpression)], testingExpression, "prerouting nat rule elements should match")
 								found = 1
@@ -135,19 +135,19 @@ func TestNftablesManager_RemoveNatRule(t *testing.T) {
 			require.NoError(t, err)
 			require.NoError(t, manager.Init(nil))
 
-			rtr := manager.router
+			rtr := manager.family4
 
-			// First add the NAT rule using the router's method
+			// First add the NAT rule using the family's method
 			err = rtr.AddNatRule(testCase.InputPair)
 			require.NoError(t, err, "should add NAT rule")
 
 			// Verify the rule was added
-			natRuleKey := firewall.GenKey(firewall.PreroutingFormat, testCase.InputPair)
+			natRuleKey := testCase.InputPair.GenKey(firewall.PreroutingFormat)
 			found := false
 			rules, err := rtr.conn.GetRules(rtr.workTable, rtr.chains[chainNameManglePrerouting])
 			require.NoError(t, err, "should list rules")
 			for _, rule := range rules {
-				if len(rule.UserData) > 0 && string(rule.UserData) == natRuleKey {
+				if len(rule.UserData) > 0 && firewall.RuleID(rule.UserData) == natRuleKey {
 					found = true
 					break
 				}
@@ -163,7 +163,7 @@ func TestNftablesManager_RemoveNatRule(t *testing.T) {
 			rules, err = rtr.conn.GetRules(rtr.workTable, rtr.chains[chainNameManglePrerouting])
 			require.NoError(t, err, "should list rules after removal")
 			for _, rule := range rules {
-				if len(rule.UserData) > 0 && string(rule.UserData) == natRuleKey {
+				if len(rule.UserData) > 0 && firewall.RuleID(rule.UserData) == natRuleKey {
 					found = true
 					break
 				}
@@ -200,11 +200,10 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 
 	defer deleteWorkTable()
 
-	r, err := newRouter(workTable, ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err, "Failed to create router")
+	r := newFamily(workTable, ifaceMock, iface.DefaultMTU)
 	require.NoError(t, r.init(workTable))
 
-	defer func(r *router) {
+	defer func(r *family) {
 		require.NoError(t, r.Reset(), "Failed to reset rules")
 	}(r)
 
@@ -314,16 +313,16 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			ruleKey, err := r.AddRouteFiltering(nil, tt.sources, firewall.Network{Prefix: tt.destination}, tt.proto, tt.sPort, tt.dPort, tt.action)
-			require.NoError(t, err, "AddRouteFiltering failed")
+			ruleKey, err := r.AddFilterRule(nil, tt.sources, firewall.Network{Prefix: tt.destination}, tt.proto, tt.sPort, tt.dPort, tt.action)
+			require.NoError(t, err, "AddFilterRule failed")
 
 			t.Cleanup(func() {
-				require.NoError(t, r.DeleteRouteRule(ruleKey), "Failed to delete rule")
+				require.NoError(t, r.DeleteFilterRule(ruleKey), "Failed to delete rule")
 			})
 
-			// Check if the rule is in the internal map
-			rule, ok := r.rules[ruleKey.ID()]
-			assert.True(t, ok, "Rule not found in internal map")
+			stored, ok := r.filters[id.RuleID(ruleKey.ID())]
+			require.True(t, ok, "Rule not found in filters map")
+			rule := stored.nftRule
 
 			t.Log("Internal rule expressions:")
 			for i, expr := range rule.Exprs {
@@ -339,7 +338,7 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 
 			var nftRule *nftables.Rule
 			for _, rule := range rules {
-				if string(rule.UserData) == ruleKey.ID() {
+				if firewall.RuleID(rule.UserData) == ruleKey.ID() {
 					nftRule = rule
 					break
 				}
@@ -367,12 +366,11 @@ func TestNftablesCreateIpSet(t *testing.T) {
 
 	defer deleteWorkTable()
 
-	r, err := newRouter(workTable, ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err, "Failed to create router")
+	r := newFamily(workTable, ifaceMock, iface.DefaultMTU)
 	require.NoError(t, r.init(workTable))
 
 	defer func() {
-		require.NoError(t, r.Reset(), "Failed to reset router")
+		require.NoError(t, r.Reset(), "Failed to reset family")
 	}()
 
 	tests := []struct {
@@ -509,6 +507,58 @@ func TestNftablesCreateIpSet(t *testing.T) {
 	}
 }
 
+// TestNftablesUpdateSetMergesOverlapping verifies that UpdateSet merges
+// overlapping prefixes before adding them. An interval set rejects
+// overlapping elements, so without the merge a batch holding a /32 already
+// covered by a /24, or a duplicate address as DNS resolution can produce,
+// would fail.
+func TestNftablesUpdateSetMergesOverlapping(t *testing.T) {
+	if check() != NFTABLES {
+		t.Skip("nftables not supported on this system")
+	}
+
+	workTable, err := createWorkTable()
+	require.NoError(t, err, "create work table")
+	defer deleteWorkTable()
+
+	r := newFamily(workTable, ifaceMock, iface.DefaultMTU)
+	require.NoError(t, r.init(workTable))
+	defer func() {
+		require.NoError(t, r.Reset(), "reset family")
+	}()
+
+	initial := []netip.Prefix{netip.MustParsePrefix("10.0.0.0/24")}
+	set := firewall.NewPrefixSet(initial)
+
+	created, err := r.createIpSet(set.HashedName(), setInput{prefixes: initial})
+	require.NoError(t, err, "create ip set")
+	require.NotNil(t, created)
+
+	overlapping := []netip.Prefix{
+		netip.MustParsePrefix("192.168.1.0/24"),
+		netip.MustParsePrefix("192.168.1.1/32"),
+		netip.MustParsePrefix("192.168.1.1/32"),
+	}
+	require.NoError(t, r.UpdateSet(set, overlapping), "UpdateSet must merge overlapping prefixes")
+
+	fetchedSet, err := r.conn.GetSetByName(r.workTable, set.HashedName())
+	require.NoError(t, err, "fetch updated set")
+	elements, err := r.conn.GetSetElements(fetchedSet)
+	require.NoError(t, err, "get set elements")
+
+	starts := make(map[string]bool)
+	for _, elem := range elements {
+		if elem.IntervalEnd {
+			continue
+		}
+		starts[netip.AddrFrom4(*(*[4]byte)(elem.Key)).String()] = true
+	}
+	// The /32s are covered by the /24, so the update adds one interval and
+	// leaves the one created earlier in place.
+	assert.Equal(t, map[string]bool{"10.0.0.0": true, "192.168.1.0": true}, starts,
+		"merged set must hold the original and the merged interval")
+}
+
 func TestNftablesCreateIpSet_IPv6(t *testing.T) {
 	if check() != NFTABLES {
 		t.Skip("nftables not supported on this system")
@@ -518,11 +568,10 @@ func TestNftablesCreateIpSet_IPv6(t *testing.T) {
 	require.NoError(t, err, "Failed to create v6 work table")
 	defer deleteWorkTableIPv6()
 
-	r, err := newRouter(workTable, ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err, "Failed to create router")
+	r := newFamily(workTable, ifaceMock, iface.DefaultMTU)
 	require.NoError(t, r.init(workTable))
 	defer func() {
-		require.NoError(t, r.Reset(), "Failed to reset router")
+		require.NoError(t, r.Reset(), "Failed to reset family")
 	}()
 
 	tests := []struct {
@@ -748,6 +797,14 @@ func containsPort(exprs []expr.Any, port *firewall.Port, isSource bool) bool {
 					}
 				}
 			}
+		case *expr.Lookup:
+			// Multiple discrete ports compile to an anonymous set lookup
+			// rather than a chain of comparisons. The set's id and name are
+			// assigned dynamically, so matching the lookup is enough here;
+			// the set elements are verified separately.
+			if !port.IsRange && len(port.Values) > 1 {
+				portMatchFound = true
+			}
 		}
 		if payloadFound && portMatchFound {
 			return true
@@ -861,13 +918,12 @@ func TestRouter_RefreshRulesMap_RemovesStaleEntries(t *testing.T) {
 	require.NoError(t, err)
 	defer deleteWorkTable()
 
-	r, err := newRouter(workTable, ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err)
+	r := newFamily(workTable, ifaceMock, iface.DefaultMTU)
 	require.NoError(t, r.init(workTable))
 	defer func() { require.NoError(t, r.Reset()) }()
 
 	// Add a real rule to the kernel
-	ruleKey, err := r.AddRouteFiltering(
+	ruleKey, err := r.AddFilterRule(
 		nil,
 		[]netip.Prefix{netip.MustParsePrefix("192.168.1.0/24")},
 		firewall.Network{Prefix: netip.MustParsePrefix("10.0.0.0/24")},
@@ -878,11 +934,11 @@ func TestRouter_RefreshRulesMap_RemovesStaleEntries(t *testing.T) {
 	)
 	require.NoError(t, err)
 	t.Cleanup(func() {
-		require.NoError(t, r.DeleteRouteRule(ruleKey))
+		require.NoError(t, r.DeleteFilterRule(ruleKey))
 	})
 
 	// Inject a stale entry with Handle=0 (simulates store-before-flush failure)
-	staleKey := "stale-rule-that-does-not-exist"
+	staleKey := firewall.RuleID("stale-rule-that-does-not-exist")
 	r.rules[staleKey] = &nftables.Rule{
 		Table:    r.workTable,
 		Chain:    r.chains[chainNameRoutingFw],
@@ -902,6 +958,54 @@ func TestRouter_RefreshRulesMap_RemovesStaleEntries(t *testing.T) {
 	assert.NotZero(t, realRule.Handle, "real rule should have a valid handle")
 }
 
+// TestRouter_DeleteRouteRule_RemovesKernelRule verifies a route filter
+// rule is actually removed from the kernel on delete. The route chain is
+// not refreshed by Flush, so the stored rule carries a zero handle;
+// DeleteFilterRule must pull live handles itself before issuing the
+// delete or the kernel rule leaks. Regression test for that path.
+func TestRouter_DeleteRouteRule_RemovesKernelRule(t *testing.T) {
+	if check() != NFTABLES {
+		t.Skip("nftables not supported on this system")
+	}
+
+	workTable, err := createWorkTable()
+	require.NoError(t, err)
+	defer deleteWorkTable()
+
+	r := newFamily(workTable, ifaceMock, iface.DefaultMTU)
+	require.NoError(t, r.init(workTable))
+	defer func() { require.NoError(t, r.Reset()) }()
+
+	ruleKey, err := r.AddFilterRule(
+		nil,
+		[]netip.Prefix{netip.MustParsePrefix("192.168.1.0/24")},
+		firewall.Network{Prefix: netip.MustParsePrefix("10.0.0.0/24")},
+		firewall.ProtocolTCP,
+		nil,
+		&firewall.Port{Values: []uint16{80}},
+		firewall.ActionAccept,
+	)
+	require.NoError(t, err)
+
+	countKernelRules := func() int {
+		list, err := r.conn.GetRules(r.workTable, r.chains[chainNameRoutingFw])
+		require.NoError(t, err)
+		n := 0
+		for _, rule := range list {
+			if string(rule.UserData) == string(ruleKey.ID()) {
+				n++
+			}
+		}
+		return n
+	}
+
+	require.Equal(t, 1, countKernelRules(), "rule should be present in the kernel after add")
+
+	require.NoError(t, r.DeleteFilterRule(ruleKey))
+	assert.Equal(t, 0, countKernelRules(), "rule must be removed from the kernel after delete")
+	assert.NotContains(t, r.filters, ruleKey.ID(), "filters map entry should be cleared")
+}
+
 func TestRouter_DeleteRouteRule_StaleHandle(t *testing.T) {
 	if check() != NFTABLES {
 		t.Skip("nftables not supported on this system")
@@ -911,24 +1015,27 @@ func TestRouter_DeleteRouteRule_StaleHandle(t *testing.T) {
 	require.NoError(t, err)
 	defer deleteWorkTable()
 
-	r, err := newRouter(workTable, ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err)
+	r := newFamily(workTable, ifaceMock, iface.DefaultMTU)
 	require.NoError(t, r.init(workTable))
 	defer func() { require.NoError(t, r.Reset()) }()
 
 	// Inject a stale entry with Handle=0
-	staleKey := "stale-route-rule"
-	r.rules[staleKey] = &nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameRoutingFw],
-		Handle:   0,
-		UserData: []byte(staleKey),
+	staleKey := id.RuleID("stale-route-rule")
+	staleRule := &Rule{
+		nftRule: &nftables.Rule{
+			Table:    r.workTable,
+			Chain:    r.chains[chainNameRoutingFw],
+			Handle:   0,
+			UserData: []byte(staleKey),
+		},
+		id: staleKey,
 	}
+	r.filters[staleKey] = staleRule
 
-	// DeleteRouteRule should not return an error for stale handles
-	err = r.DeleteRouteRule(id.RuleID(staleKey))
+	// DeleteFilterRule should not return an error for stale handles
+	err = r.DeleteFilterRule(staleRule)
 	assert.NoError(t, err, "deleting a stale rule should not error")
-	assert.NotContains(t, r.rules, staleKey, "stale entry should be cleaned up")
+	assert.NotContains(t, r.filters, staleKey, "stale entry should be cleaned up")
 }
 
 func TestRouter_AddNatRule_WithStaleEntry(t *testing.T) {
@@ -950,7 +1057,7 @@ func TestRouter_AddNatRule_WithStaleEntry(t *testing.T) {
 		Masquerade:  true,
 	}
 
-	rtr := manager.router
+	rtr := manager.family4
 
 	// First add succeeds
 	err = rtr.AddNatRule(pair)
@@ -960,11 +1067,11 @@ func TestRouter_AddNatRule_WithStaleEntry(t *testing.T) {
 	})
 
 	// Corrupt the handle to simulate stale state
-	natRuleKey := firewall.GenKey(firewall.PreroutingFormat, pair)
+	natRuleKey := pair.GenKey(firewall.PreroutingFormat)
 	if rule, exists := rtr.rules[natRuleKey]; exists {
 		rule.Handle = 0
 	}
-	inverseKey := firewall.GenKey(firewall.PreroutingFormat, firewall.GetInversePair(pair))
+	inverseKey := firewall.GetInversePair(pair).GenKey(firewall.PreroutingFormat)
 	if rule, exists := rtr.rules[inverseKey]; exists {
 		rule.Handle = 0
 	}
@@ -979,7 +1086,7 @@ func TestRouter_AddNatRule_WithStaleEntry(t *testing.T) {
 
 	found := 0
 	for _, rule := range rules {
-		if len(rule.UserData) > 0 && string(rule.UserData) == natRuleKey {
+		if len(rule.UserData) > 0 && firewall.RuleID(rule.UserData) == natRuleKey {
 			found++
 		}
 	}
@@ -1010,7 +1117,7 @@ func TestCalculateLastIP(t *testing.T) {
 }
 
 func TestConvertPrefixesToSet_IPv6(t *testing.T) {
-	r := &router{af: afIPv6}
+	r := &family{af: afIPv6}
 	prefixes := []netip.Prefix{
 		netip.MustParsePrefix("fd00::/64"),
 		netip.MustParsePrefix("2001:db8::1/128"),
diff --git a/client/firewall/nftables/routing_linux.go b/client/firewall/nftables/routing_linux.go
new file mode 100644
index 000000000..e98471e8f
--- /dev/null
+++ b/client/firewall/nftables/routing_linux.go
@@ -0,0 +1,523 @@
+//go:build !android
+
+package nftables
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/google/nftables"
+	"github.com/google/nftables/binaryutil"
+	"github.com/google/nftables/expr"
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/unix"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	nbnet "github.com/netbirdio/netbird/client/net"
+)
+
+func (r *family) AddNatRule(pair firewall.RouterPair) error {
+	if err := r.refreshRulesMap(); err != nil {
+		return fmt.Errorf(refreshRulesMapError, err)
+	}
+
+	// Resolve every rule's match expressions before queueing any of them: a
+	// message buffered on the shared connection cannot be un-queued, so
+	// returning an error after queueing would leave the next caller's Flush
+	// to commit a rule nothing tracks.
+	var legacyExprs []expr.Any
+	if r.legacyManagement {
+		log.Warnf("This peer is connected to a NetBird Management service with an older version. Allowing all traffic for %s", pair.Destination)
+
+		var err error
+		legacyExprs, err = r.legacyRouteRuleExprs(pair)
+		if err != nil {
+			return fmt.Errorf("build legacy routing rule: %w", err)
+		}
+	}
+
+	inverse := firewall.GetInversePair(pair)
+	var natExprs, inverseExprs []expr.Any
+	if pair.Masquerade {
+		var err error
+		natExprs, err = r.natRuleExprs(pair)
+		if err != nil {
+			r.dropNetworkMatch(legacyExprs)
+			return fmt.Errorf("build nat rule: %w", err)
+		}
+
+		inverseExprs, err = r.natRuleExprs(inverse)
+		if err != nil {
+			r.dropNetworkMatch(legacyExprs)
+			r.dropNetworkMatch(natExprs)
+			return fmt.Errorf("build inverse nat rule: %w", err)
+		}
+	}
+
+	if legacyExprs != nil {
+		r.queueLegacyRouteRule(pair, legacyExprs)
+	}
+	if pair.Masquerade {
+		r.queueNatRule(pair, natExprs)
+		r.queueNatRule(inverse, inverseExprs)
+	}
+
+	if err := r.conn.Flush(); err != nil {
+		r.rollbackRules(pair)
+		return fmt.Errorf("insert rules for %s: %w", pair.Destination, err)
+	}
+
+	return nil
+}
+
+// rollbackRules cleans up unflushed rules and their set counters after a flush failure.
+func (r *family) rollbackRules(pair firewall.RouterPair) {
+	keys := []firewall.RuleID{
+		pair.GenKey(firewall.ForwardingFormat),
+		pair.GenKey(firewall.PreroutingFormat),
+		firewall.GetInversePair(pair).GenKey(firewall.PreroutingFormat),
+	}
+	for _, key := range keys {
+		rule, ok := r.rules[key]
+		if !ok {
+			continue
+		}
+		if err := r.decrementSetCounter(rule); err != nil {
+			log.Warnf("rollback set counter for %s: %v", key, err)
+		}
+		delete(r.rules, key)
+	}
+}
+
+// natRuleExprs resolves the match expressions of the pair's prerouting
+// marking rule. It reserves the ipset references the matches need but queues
+// nothing on the connection, so its error paths leave the connection clean.
+func (r *family) natRuleExprs(pair firewall.RouterPair) ([]expr.Any, error) {
+	sourceExp, err := r.applyNetwork(pair.Source, nil, true)
+	if err != nil {
+		return nil, fmt.Errorf("apply source: %w", err)
+	}
+
+	destExp, err := r.applyNetwork(pair.Destination, nil, false)
+	if err != nil {
+		r.dropNetworkMatch(sourceExp)
+		return nil, fmt.Errorf("apply destination: %w", err)
+	}
+
+	op := expr.CmpOpEq
+	if pair.Inverse {
+		op = expr.CmpOpNeq
+	}
+
+	exprs := []expr.Any{
+		&expr.Meta{
+			Key:      expr.MetaKeyIIFNAME,
+			Register: 1,
+		},
+		&expr.Cmp{
+			Op:       op,
+			Register: 1,
+			Data:     ifname(r.wgIface.Name()),
+		},
+	}
+	// We only care about NEW connections to mark them and later identify them in the postrouting chain for masquerading.
+	// Masquerading will take care of the conntrack state, which means we won't need to mark established connections.
+	exprs = append(exprs, getCtNewExprs()...)
+
+	exprs = append(exprs, sourceExp...)
+	exprs = append(exprs, destExp...)
+
+	markValue := nbnet.PreroutingFwmarkMasquerade
+	if pair.Inverse {
+		markValue = nbnet.PreroutingFwmarkMasqueradeReturn
+	}
+
+	exprs = append(exprs,
+		&expr.Immediate{
+			Register: 1,
+			Data:     binaryutil.NativeEndian.PutUint32(markValue),
+		},
+		&expr.Meta{
+			Key:            expr.MetaKeyMARK,
+			SourceRegister: true,
+			Register:       1,
+		},
+	)
+
+	return exprs, nil
+}
+
+// queueNatRule replaces any tracked rule for the pair and queues the new
+// prerouting marking rule on the connection. Failures are logged rather than
+// returned: the caller has already queued messages that only a Flush can
+// commit, so it must not return early.
+func (r *family) queueNatRule(pair firewall.RouterPair, exprs []expr.Any) {
+	ruleID := pair.GenKey(firewall.PreroutingFormat)
+
+	if _, exists := r.rules[ruleID]; exists {
+		if err := r.removeNatRule(pair); err != nil {
+			// The rule this replaces may still be in the kernel. Keep tracking
+			// it and skip the new one: overwriting the entry would leave the old
+			// rule installed with nothing that can find it again, while keeping
+			// it lets the next update retry the whole replacement.
+			log.Errorf("replace prerouting rule %s: %v", ruleID, err)
+			r.dropNetworkMatch(exprs)
+			return
+		}
+	}
+
+	// Ensure nat rules come first, so the mark can be overwritten.
+	// Currently overwritten by the dst-type LOCAL rules for redirected traffic.
+	r.rules[ruleID] = r.conn.InsertRule(&nftables.Rule{
+		Table:    r.workTable,
+		Chain:    r.chains[chainNameManglePrerouting],
+		Exprs:    exprs,
+		UserData: []byte(ruleID),
+	})
+}
+
+func (r *family) addPostroutingRules() {
+	// First masquerade rule for traffic coming in from WireGuard interface
+	exprs := []expr.Any{
+		// Match on the first fwmark
+		&expr.Meta{
+			Key:      expr.MetaKeyMARK,
+			Register: 1,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkMasquerade),
+		},
+
+		// We need to exclude the loopback interface as this changes the wg proxy port
+		&expr.Meta{
+			Key:      expr.MetaKeyOIFNAME,
+			Register: 1,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpNeq,
+			Register: 1,
+			Data:     ifname("lo"),
+		},
+		&expr.Counter{},
+		&expr.Masq{},
+	}
+
+	r.conn.AddRule(&nftables.Rule{
+		Table: r.workTable,
+		Chain: r.chains[chainNameRoutingNat],
+		Exprs: exprs,
+	})
+
+	// Second masquerade rule for traffic going out through WireGuard interface
+	exprs2 := []expr.Any{
+		// Match on the second fwmark
+		&expr.Meta{
+			Key:      expr.MetaKeyMARK,
+			Register: 1,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkMasqueradeReturn),
+		},
+
+		// Match WireGuard interface
+		&expr.Meta{
+			Key:      expr.MetaKeyOIFNAME,
+			Register: 1,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     ifname(r.wgIface.Name()),
+		},
+		&expr.Counter{},
+		&expr.Masq{},
+	}
+
+	r.conn.AddRule(&nftables.Rule{
+		Table: r.workTable,
+		Chain: r.chains[chainNameRoutingNat],
+		Exprs: exprs2,
+	})
+}
+
+// addMSSClampingRules adds MSS clamping rules to prevent fragmentation for forwarded traffic.
+func (r *family) addMSSClampingRules() error {
+	overhead := uint16(ipv4TCPHeaderSize)
+	if r.af.tableFamily == nftables.TableFamilyIPv6 {
+		overhead = ipv6TCPHeaderSize
+	}
+	if r.mtu <= overhead {
+		log.Debugf("MTU %d too small for MSS clamping (overhead %d), skipping", r.mtu, overhead)
+		return nil
+	}
+	mss := r.mtu - overhead
+
+	exprsOut := []expr.Any{
+		&expr.Meta{
+			Key:      expr.MetaKeyOIFNAME,
+			Register: 1,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     ifname(r.wgIface.Name()),
+		},
+		&expr.Meta{
+			Key:      expr.MetaKeyL4PROTO,
+			Register: 1,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     []byte{unix.IPPROTO_TCP},
+		},
+		&expr.Payload{
+			DestRegister: 1,
+			Base:         expr.PayloadBaseTransportHeader,
+			Offset:       13,
+			Len:          1,
+		},
+		&expr.Bitwise{
+			DestRegister:   1,
+			SourceRegister: 1,
+			Len:            1,
+			Mask:           []byte{0x02},
+			Xor:            []byte{0x00},
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpNeq,
+			Register: 1,
+			Data:     []byte{0x00},
+		},
+		&expr.Counter{},
+		&expr.Exthdr{
+			DestRegister: 1,
+			Type:         2,
+			Offset:       2,
+			Len:          2,
+			Op:           expr.ExthdrOpTcpopt,
+		},
+		&expr.Cmp{
+			Op:       expr.CmpOpGt,
+			Register: 1,
+			Data:     binaryutil.BigEndian.PutUint16(uint16(mss)),
+		},
+		&expr.Immediate{
+			Register: 1,
+			Data:     binaryutil.BigEndian.PutUint16(uint16(mss)),
+		},
+		&expr.Exthdr{
+			SourceRegister: 1,
+			Type:           2,
+			Offset:         2,
+			Len:            2,
+			Op:             expr.ExthdrOpTcpopt,
+		},
+	}
+
+	r.conn.AddRule(&nftables.Rule{
+		Table: r.workTable,
+		Chain: r.chains[chainNameMangleForward],
+		Exprs: exprsOut,
+	})
+
+	return r.conn.Flush()
+}
+
+func buildLegacyRouteRuleExpressions(sourceExp, destExp []expr.Any) []expr.Any {
+	exprs := make([]expr.Any, 0, len(sourceExp)+len(destExp)+2)
+	exprs = append(exprs, sourceExp...)
+	exprs = append(exprs, destExp...)
+	exprs = append(exprs,
+		&expr.Counter{},
+		&expr.Verdict{Kind: expr.VerdictAccept},
+	)
+	return exprs
+}
+
+// legacyRouteRuleExprs resolves the match expressions of the pair's legacy
+// forwarding rule, queueing nothing on the connection.
+func (r *family) legacyRouteRuleExprs(pair firewall.RouterPair) ([]expr.Any, error) {
+	sourceExp, err := r.applyNetwork(pair.Source, nil, true)
+	if err != nil {
+		return nil, fmt.Errorf("apply source: %w", err)
+	}
+
+	destExp, err := r.applyNetwork(pair.Destination, nil, false)
+	if err != nil {
+		r.dropNetworkMatch(sourceExp)
+		return nil, fmt.Errorf("apply destination: %w", err)
+	}
+
+	return buildLegacyRouteRuleExpressions(sourceExp, destExp), nil
+}
+
+// queueLegacyRouteRule replaces any tracked rule for the pair and queues the
+// new legacy forwarding rule. Failures are logged for the same reason as in
+// queueNatRule.
+func (r *family) queueLegacyRouteRule(pair firewall.RouterPair, exprs []expr.Any) {
+	ruleID := pair.GenKey(firewall.ForwardingFormat)
+
+	if _, exists := r.rules[ruleID]; exists {
+		if err := r.removeLegacyRouteRule(pair); err != nil {
+			// Keep the old rule tracked instead of losing it, as in queueNatRule.
+			log.Errorf("replace legacy forwarding rule %s: %v", ruleID, err)
+			r.dropNetworkMatch(exprs)
+			return
+		}
+	}
+
+	r.rules[ruleID] = r.conn.AddRule(&nftables.Rule{
+		Table:    r.workTable,
+		Chain:    r.chains[chainNameRoutingFw],
+		Exprs:    exprs,
+		UserData: []byte(ruleID),
+	})
+}
+
+// removeLegacyRouteRule removes a legacy routing rule for mgmt servers pre route acls
+func (r *family) removeLegacyRouteRule(pair firewall.RouterPair) error {
+	ruleID := pair.GenKey(firewall.ForwardingFormat)
+
+	rule, exists := r.rules[ruleID]
+	if !exists {
+		return nil
+	}
+
+	return r.deleteLegacyRuleEntry(ruleID, rule)
+}
+
+// deleteLegacyRuleEntry removes one legacy forwarding rule and drops its
+// ipset references. It also clears stale entries that never got a handle.
+func (r *family) deleteLegacyRuleEntry(ruleID firewall.RuleID, rule *nftables.Rule) error {
+	if rule.Handle == 0 {
+		log.Warnf("legacy forwarding rule %s has no handle, removing stale entry", ruleID)
+		if err := r.decrementSetCounter(rule); err != nil {
+			log.Warnf("decrement set counter for stale rule %s: %v", ruleID, err)
+		}
+		delete(r.rules, ruleID)
+		return nil
+	}
+
+	if err := r.conn.DelRule(rule); err != nil {
+		return fmt.Errorf("remove legacy forwarding rule %s: %w", ruleID, err)
+	}
+
+	delete(r.rules, ruleID)
+
+	if err := r.decrementSetCounter(rule); err != nil {
+		return fmt.Errorf("decrement set counter: %w", err)
+	}
+
+	return nil
+}
+
+// GetLegacyManagement returns the route manager's legacy management mode
+func (r *family) GetLegacyManagement() bool {
+	return r.legacyManagement
+}
+
+// SetLegacyManagement sets the route manager to use legacy management mode
+func (r *family) SetLegacyManagement(isLegacy bool) {
+	r.legacyManagement = isLegacy
+}
+
+// RemoveAllLegacyRouteRules removes all legacy routing rules for mgmt servers pre route acls
+func (r *family) RemoveAllLegacyRouteRules() error {
+	if err := r.refreshRulesMap(); err != nil {
+		return fmt.Errorf(refreshRulesMapError, err)
+	}
+
+	var merr *multierror.Error
+	var found bool
+	for k, rule := range r.rules {
+		if !strings.HasPrefix(string(k), firewall.ForwardingFormatPrefix) {
+			continue
+		}
+		found = true
+		if err := r.deleteLegacyRuleEntry(k, rule); err != nil {
+			merr = multierror.Append(merr, err)
+		}
+	}
+
+	// Commit the queued deletes here instead of leaving them for whichever
+	// caller flushes next: the tracking entries are already gone, so an
+	// uncommitted delete would leave a rule in the kernel that nothing can
+	// find again.
+	if found {
+		if err := r.conn.Flush(); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf(flushError, err))
+		}
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) RemoveNatRule(pair firewall.RouterPair) error {
+	if err := r.refreshRulesMap(); err != nil {
+		return fmt.Errorf(refreshRulesMapError, err)
+	}
+
+	var merr *multierror.Error
+
+	if pair.Masquerade {
+		if err := r.removeNatRule(pair); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove prerouting rule: %w", err))
+		}
+
+		if err := r.removeNatRule(firewall.GetInversePair(pair)); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove inverse prerouting rule: %w", err))
+		}
+	}
+
+	if err := r.removeLegacyRouteRule(pair); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove legacy routing rule: %w", err))
+	}
+
+	// Set counters are decremented in the sub-methods above before flush. If flush fails,
+	// counters will be off until the next successful removal or refresh cycle.
+	if err := r.conn.Flush(); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("flush remove nat rules %s: %w", pair.Destination, err))
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (r *family) removeNatRule(pair firewall.RouterPair) error {
+	ruleID := pair.GenKey(firewall.PreroutingFormat)
+
+	rule, exists := r.rules[ruleID]
+	if !exists {
+		log.Debugf("prerouting rule %s not found", ruleID)
+		return nil
+	}
+
+	if rule.Handle == 0 {
+		log.Warnf("prerouting rule %s has no handle, removing stale entry", ruleID)
+		if err := r.decrementSetCounter(rule); err != nil {
+			log.Warnf("decrement set counter for stale rule %s: %v", ruleID, err)
+		}
+		delete(r.rules, ruleID)
+		return nil
+	}
+
+	if err := r.conn.DelRule(rule); err != nil {
+		return fmt.Errorf("remove prerouting rule %s -> %s: %w", pair.Source, pair.Destination, err)
+	}
+
+	log.Debugf("removed prerouting rule %s -> %s", pair.Source, pair.Destination)
+
+	delete(r.rules, ruleID)
+
+	if err := r.decrementSetCounter(rule); err != nil {
+		return fmt.Errorf("decrement set counter: %w", err)
+	}
+
+	return nil
+}
diff --git a/client/firewall/nftables/rule_linux.go b/client/firewall/nftables/rule_linux.go
index a90b74e36..8f3c0aebc 100644
--- a/client/firewall/nftables/rule_linux.go
+++ b/client/firewall/nftables/rule_linux.go
@@ -1,21 +1,26 @@
 package nftables
 
 import (
-	"net"
+	"net/netip"
 
 	"github.com/google/nftables"
+
+	"github.com/netbirdio/netbird/client/firewall/manager"
 )
 
-// Rule to handle management of rules
+// Rule wraps an installed filter rule (peer or route). Source set
+// membership is encoded in the rule's expressions; DeleteFilterRule
+// recovers the set name via findSets so the refcounter can drop the
+// right reference. mangleRule is set only for peer rules.
 type Rule struct {
 	nftRule    *nftables.Rule
 	mangleRule *nftables.Rule
-	nftSet     *nftables.Set
-	ruleID     string
-	ip         net.IP
+	// sources is the canonical source list this rule was created for.
+	sources []netip.Prefix
+	id      manager.RuleID
 }
 
-// GetRuleID returns the rule id
-func (r *Rule) ID() string {
-	return r.ruleID
+// ID returns the rule id
+func (r *Rule) ID() manager.RuleID {
+	return r.id
 }
diff --git a/client/firewall/nftables/testhelpers_linux_test.go b/client/firewall/nftables/testhelpers_linux_test.go
new file mode 100644
index 000000000..72db3f7d2
--- /dev/null
+++ b/client/firewall/nftables/testhelpers_linux_test.go
@@ -0,0 +1,27 @@
+//go:build privileged
+
+package nftables
+
+import (
+	"fmt"
+	"net"
+	"net/netip"
+)
+
+func pfx(ip net.IP) []netip.Prefix {
+	if ip == nil {
+		return []netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)}
+	}
+	if ip.IsUnspecified() {
+		if ip.To4() != nil {
+			return []netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)}
+		}
+		return []netip.Prefix{netip.PrefixFrom(netip.IPv6Unspecified(), 0)}
+	}
+	a, ok := netip.AddrFromSlice(ip)
+	if !ok {
+		panic(fmt.Sprintf("invalid IP length: %d", len(ip)))
+	}
+	a = a.Unmap()
+	return []netip.Prefix{netip.PrefixFrom(a, a.BitLen())}
+}
diff --git a/client/firewall/uspfilter/allow_netbird.go b/client/firewall/uspfilter/allow_netbird.go
deleted file mode 100644
index b120cdf12..000000000
--- a/client/firewall/uspfilter/allow_netbird.go
+++ /dev/null
@@ -1,37 +0,0 @@
-//go:build !windows
-
-package uspfilter
-
-import (
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/firewall/firewalld"
-	"github.com/netbirdio/netbird/client/internal/statemanager"
-)
-
-// Close cleans up the firewall manager by removing all rules and closing trackers
-func (m *Manager) Close(stateManager *statemanager.Manager) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	m.resetState()
-
-	if m.nativeFirewall != nil {
-		return m.nativeFirewall.Close(stateManager)
-	}
-	if err := firewalld.UntrustInterface(m.wgIface.Name()); err != nil {
-		log.Warnf("failed to untrust interface in firewalld: %v", err)
-	}
-	return nil
-}
-
-// AllowNetbird allows netbird interface traffic
-func (m *Manager) AllowNetbird() error {
-	if m.nativeFirewall != nil {
-		return m.nativeFirewall.AllowNetbird()
-	}
-	if err := firewalld.TrustInterface(m.wgIface.Name()); err != nil {
-		log.Warnf("failed to trust interface in firewalld: %v", err)
-	}
-	return nil
-}
diff --git a/client/firewall/uspfilter/common/iface.go b/client/firewall/uspfilter/common/iface.go
deleted file mode 100644
index 9c06eb3f7..000000000
--- a/client/firewall/uspfilter/common/iface.go
+++ /dev/null
@@ -1,17 +0,0 @@
-package common
-
-import (
-	wgdevice "golang.zx2c4.com/wireguard/device"
-
-	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-// IFaceMapper defines subset methods of interface required for manager
-type IFaceMapper interface {
-	Name() string
-	SetFilter(device.PacketFilter) error
-	Address() wgaddr.Address
-	GetWGDevice() *wgdevice.Device
-	GetDevice() *device.FilteredDevice
-}
diff --git a/client/firewall/uspfilter/filter.go b/client/firewall/uspfilter/filter.go
index 91866dcab..0c73400f1 100644
--- a/client/firewall/uspfilter/filter.go
+++ b/client/firewall/uspfilter/filter.go
@@ -5,7 +5,6 @@ import (
 	"encoding/binary"
 	"errors"
 	"fmt"
-	"net"
 	"net/netip"
 	"os"
 	"slices"
@@ -20,14 +19,18 @@ import (
 	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
+	wgdevice "golang.zx2c4.com/wireguard/device"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
+	"github.com/netbirdio/netbird/client/firewall/firewalld"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/firewall/uspfilter/common"
 	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
 	"github.com/netbirdio/netbird/client/firewall/uspfilter/forwarder"
 	nblog "github.com/netbirdio/netbird/client/firewall/uspfilter/log"
+	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	nbid "github.com/netbirdio/netbird/client/internal/acl/id"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
@@ -58,7 +61,10 @@ const (
 	// EnvDisableMSSClamping disables TCP MSS clamping for forwarded traffic.
 	EnvDisableMSSClamping = "NB_DISABLE_MSS_CLAMPING"
 
-	// EnvForceUserspaceRouter forces userspace routing even if native routing is available.
+	// EnvForceUserspaceRouter is a deprecated alias for
+	// NB_FORCE_USERSPACE_FIREWALL: the userspace firewall always routes in
+	// userspace, so forcing one forces the other. Kept for backward
+	// compatibility.
 	EnvForceUserspaceRouter = "NB_FORCE_USERSPACE_ROUTER"
 
 	// EnvEnableLocalForwarding enables forwarding of local traffic to the native stack for internal (non-NetBird) interfaces.
@@ -70,14 +76,20 @@ const (
 	EnvEnableNetstackLocalForwarding = "NB_ENABLE_NETSTACK_LOCAL_FORWARDING"
 )
 
-var errNatNotSupported = errors.New("nat not supported with userspace firewall")
+// errNotSupported is returned by firewall operations that only make sense with
+// a kernel firewall (kernel NAT/DNAT, eBPF) and are not implemented in
+// userspace mode, where they should not be called.
+var errNotSupported = errors.New("not supported with userspace firewall")
 
-// RuleSet is a set of rules grouped by a string key
-type RuleSet map[string]PeerRule
+// peerRules is the canonical list-based storage for peer ACL rules.
+// Drop and accept rules live in separate slices; drop-before-accept
+// ordering comes from consulting the deny slice (and its index) before
+// the accept one.
+type peerRules []*PeerRule
 
-type RouteRules []*RouteRule
+type routeRules []*RouteRule
 
-func (r RouteRules) Sort() {
+func (r routeRules) Sort() {
 	slices.SortStableFunc(r, func(a, b *RouteRule) int {
 		// Deny rules come first
 		if a.action == firewall.ActionDrop && b.action != firewall.ActionDrop {
@@ -86,22 +98,74 @@ func (r RouteRules) Sort() {
 		if a.action != firewall.ActionDrop && b.action == firewall.ActionDrop {
 			return 1
 		}
-		return strings.Compare(a.id, b.id)
+		return strings.Compare(string(a.id), string(b.id))
 	})
 }
 
+// peerRuleSpec carries the parameters that define a peer filter rule,
+// threaded together through the build path so the builders take a single
+// argument instead of a long parameter list.
+type peerRuleSpec struct {
+	mgmtID  []byte
+	sources []netip.Prefix
+	ipLayer gopacket.LayerType
+	proto   firewall.Protocol
+	sPort   *firewall.Port
+	dPort   *firewall.Port
+	action  firewall.Action
+}
+
+// Iface is the network interface the userspace firewall attaches to: the
+// methods of the WireGuard device it actually uses.
+type Iface interface {
+	Name() string
+	Address() wgaddr.Address
+	SetFilter(device.PacketFilter) error
+	GetWGDevice() *wgdevice.Device
+}
+
+// InterfaceAllower opens the NetBird interface in the host firewall so it
+// doesn't drop traffic the userspace firewall handles, without taking over
+// packet filtering. Implementations (nftables, iptables, firewalld, the windows
+// netsh rule) are selected per platform and injected into Create; Apply runs at
+// creation and Close on teardown.
+type InterfaceAllower interface {
+	Apply() error
+	Close() error
+}
+
+// Config holds the dependencies and options for the userspace firewall.
+type Config struct {
+	// IFace is the overlay interface the filter attaches to.
+	IFace Iface
+	// InterfaceAllower opens the NetBird interface in foreign kernel filter
+	// chains so the kernel doesn't drop traffic the userspace firewall handles.
+	// Nil in netstack mode, on non-Linux platforms without a backend, or when
+	// neither nftables nor iptables is available. firewalld trust is applied by
+	// the manager regardless, since firewalld owns its own chains and we cannot
+	// insert into them.
+	InterfaceAllower InterfaceAllower
+	// DisableServerRoutes indicates whether server routes are disabled.
+	DisableServerRoutes bool
+	FlowLogger          nftypes.FlowLogger
+	MTU                 uint16
+}
+
 // Manager userspace firewall manager
 type Manager struct {
-	outgoingRules     map[netip.Addr]RuleSet
-	incomingDenyRules map[netip.Addr]RuleSet
-	incomingRules     map[netip.Addr]RuleSet
-	routeRules        RouteRules
-	routeRulesMap     map[nbid.RuleID]*RouteRule
-	decoders          sync.Pool
-	wgIface           common.IFaceMapper
-	nativeFirewall    firewall.Manager
+	decoders     sync.Pool
+	wgIface      Iface
+	ifaceAllower InterfaceAllower
+	mutex        sync.RWMutex
 
-	mutex sync.RWMutex
+	incomingDenyRules   peerRules
+	incomingAcceptRules peerRules
+	incomingDenyIndex   peerRuleIndex
+	incomingAcceptIndex peerRuleIndex
+	peerRulesMap        map[nbid.RuleID]*PeerRule
+
+	routeRules    routeRules
+	routeRulesMap map[nbid.RuleID]*RouteRule
 
 	// indicates whether server routes are disabled
 	disableServerRoutes bool
@@ -121,6 +185,7 @@ type Manager struct {
 	udpTracker     *conntrack.UDPTracker
 	icmpTracker    *conntrack.ICMPTracker
 	tcpTracker     *conntrack.TCPTracker
+	fragments      *fragmentTracker
 	forwarder      atomic.Pointer[forwarder.Forwarder]
 	pendingCapture atomic.Pointer[forwarder.PacketCapture]
 	logger         *nblog.Logger
@@ -183,22 +248,39 @@ func (d *decoder) decodePacket(data []byte) error {
 	}
 }
 
-// Create userspace firewall manager constructor
-func Create(iface common.IFaceMapper, disableServerRoutes bool, flowLogger nftypes.FlowLogger, mtu uint16) (*Manager, error) {
-	return create(iface, nil, disableServerRoutes, flowLogger, mtu)
-}
-
-func CreateWithNativeFirewall(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableServerRoutes bool, flowLogger nftypes.FlowLogger, mtu uint16) (*Manager, error) {
-	if nativeFirewall == nil {
-		return nil, errors.New("native firewall is nil")
+// decodeTransport decodes the transport header of a first fragment (which
+// gopacket leaves undecoded) into the decoder and appends its layer type to
+// decoded, so the ACL pipeline can evaluate it like a normal packet. It returns
+// false if the protocol is unsupported or the header is truncated.
+func (d *decoder) decodeTransport(proto layers.IPProtocol, payload []byte) bool {
+	var l4 gopacket.DecodingLayer
+	var layerType gopacket.LayerType
+	var minLen int
+	switch proto {
+	case layers.IPProtocolTCP:
+		l4, layerType, minLen = &d.tcp, layers.LayerTypeTCP, 20
+	case layers.IPProtocolUDP:
+		l4, layerType, minLen = &d.udp, layers.LayerTypeUDP, 8
+	case layers.IPProtocolICMPv4:
+		l4, layerType, minLen = &d.icmp4, layers.LayerTypeICMPv4, 8
+	case layers.IPProtocolICMPv6:
+		l4, layerType, minLen = &d.icmp6, layers.LayerTypeICMPv6, 8
+	default:
+		return false
 	}
 
-	mgr, err := create(iface, nativeFirewall, disableServerRoutes, flowLogger, mtu)
-	if err != nil {
-		return nil, err
+	// Reject a fragment too small to hold the full transport header before
+	// decoding: it can't be ACL-evaluated (tiny-fragment attack), and skipping
+	// the decode avoids gopacket allocating an error on the drop path.
+	if len(payload) < minLen {
+		return false
 	}
 
-	return mgr, nil
+	if err := l4.DecodeFromBytes(payload, gopacket.NilDecodeFeedback); err != nil {
+		return false
+	}
+	d.decoded = append(d.decoded, layerType)
+	return true
 }
 
 func parseCreateEnv() (bool, bool, bool) {
@@ -231,7 +313,7 @@ func parseCreateEnv() (bool, bool, bool) {
 	return disableConntrack, enableLocalForwarding, disableMSSClamping
 }
 
-func create(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableServerRoutes bool, flowLogger nftypes.FlowLogger, mtu uint16) (*Manager, error) {
+func Create(cfg Config) (_ *Manager, err error) {
 	disableConntrack, enableLocalForwarding, disableMSSClamping := parseCreateEnv()
 
 	m := &Manager{
@@ -254,62 +336,133 @@ func create(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableSe
 				return d
 			},
 		},
-		nativeFirewall:      nativeFirewall,
-		outgoingRules:       make(map[netip.Addr]RuleSet),
-		incomingDenyRules:   make(map[netip.Addr]RuleSet),
-		incomingRules:       make(map[netip.Addr]RuleSet),
-		wgIface:             iface,
+		wgIface:             cfg.IFace,
+		ifaceAllower:        cfg.InterfaceAllower,
 		localipmanager:      newLocalIPManager(),
-		disableServerRoutes: disableServerRoutes,
+		disableServerRoutes: cfg.DisableServerRoutes,
 		stateful:            !disableConntrack,
 		logger:              nblog.NewFromLogrus(log.StandardLogger()),
-		flowLogger:          flowLogger,
+		flowLogger:          cfg.FlowLogger,
 		netstack:            netstack.IsEnabled(),
 		localForwarding:     enableLocalForwarding,
+		peerRulesMap:        make(map[nbid.RuleID]*PeerRule),
 		routeRulesMap:       make(map[nbid.RuleID]*RouteRule),
 		dnatMappings:        make(map[netip.Addr]netip.Addr),
 		portDNATRules:       []portDNATRule{},
 		netstackServices:    make(map[serviceKey]struct{}),
-		mtu:                 mtu,
+		mtu:                 cfg.MTU,
 	}
 	m.routingEnabled.Store(false)
 
+	// Release the allower (and its monitor) if setup fails after it was wired in.
+	defer func() {
+		if err != nil {
+			m.closeAllowerOnError()
+		}
+	}()
+
 	if !disableMSSClamping {
-		m.mssClampEnabled = true
-		if mtu > ipv4TCPHeaderMinSize {
-			m.mssClampValueIPv4 = mtu - ipv4TCPHeaderMinSize
-		}
-		if mtu > ipv6TCPHeaderMinSize {
-			m.mssClampValueIPv6 = mtu - ipv6TCPHeaderMinSize
-		}
+		m.enableMSSClamping(cfg.MTU)
 	}
-	if err := m.localipmanager.UpdateLocalIPs(iface); err != nil {
+	if err := m.localipmanager.UpdateLocalIPs(cfg.IFace); err != nil {
 		return nil, fmt.Errorf("update local IPs: %w", err)
 	}
-	if disableConntrack {
-		log.Info("conntrack is disabled")
-	} else {
-		m.udpTracker = conntrack.NewUDPTracker(conntrack.DefaultUDPTimeout, m.logger, flowLogger)
-		m.icmpTracker = conntrack.NewICMPTracker(conntrack.DefaultICMPTimeout, m.logger, flowLogger)
-		m.tcpTracker = conntrack.NewTCPTracker(conntrack.DefaultTCPTimeout, m.logger, flowLogger)
-	}
+	m.fragments = newFragmentTracker(m.logger)
+	m.setupConntrack(disableConntrack)
 	if m.netstack && m.localForwarding {
 		if err := m.initForwarder(); err != nil {
 			log.Errorf("failed to initialize forwarder: %v", err)
 		}
 	}
-	if err := iface.SetFilter(m); err != nil {
+	if err := cfg.IFace.SetFilter(m); err != nil {
+		m.fragments.Close()
 		return nil, fmt.Errorf("set filter: %w", err)
 	}
+
+	m.openHostFirewall(cfg.IFace.Name())
+
 	return m, nil
 }
 
+// closeAllowerOnError releases the allower (and its monitor) when Create fails
+// after the allower was wired in.
+func (m *Manager) closeAllowerOnError() {
+	if m.ifaceAllower == nil {
+		return
+	}
+	if err := m.ifaceAllower.Close(); err != nil {
+		log.Warnf("close interface allower after failed firewall setup: %v", err)
+	}
+}
+
+// enableMSSClamping enables MSS clamping and computes the per-family clamp values.
+func (m *Manager) enableMSSClamping(mtu uint16) {
+	m.mssClampEnabled = true
+	if mtu > ipv4TCPHeaderMinSize {
+		m.mssClampValueIPv4 = mtu - ipv4TCPHeaderMinSize
+	}
+	if mtu > ipv6TCPHeaderMinSize {
+		m.mssClampValueIPv6 = mtu - ipv6TCPHeaderMinSize
+	}
+}
+
+// setupConntrack initializes the stateful trackers unless conntrack is disabled.
+func (m *Manager) setupConntrack(disabled bool) {
+	if disabled {
+		log.Info("conntrack is disabled")
+		return
+	}
+	m.udpTracker = conntrack.NewUDPTracker(conntrack.DefaultUDPTimeout, m.logger, m.flowLogger)
+	m.icmpTracker = conntrack.NewICMPTracker(conntrack.DefaultICMPTimeout, m.logger, m.flowLogger)
+	m.tcpTracker = conntrack.NewTCPTracker(conntrack.DefaultTCPTimeout, m.logger, m.flowLogger)
+}
+
+// openHostFirewall opens the NetBird interface in the kernel firewall so it
+// doesn't drop traffic the userspace firewall handles. Best-effort: failures
+// here shouldn't prevent the firewall from coming up.
+func (m *Manager) openHostFirewall(ifaceName string) {
+	if m.ifaceAllower != nil {
+		if err := m.ifaceAllower.Apply(); err != nil {
+			log.Errorf("failed to allow netbird interface traffic: %v", err)
+		}
+	}
+	// firewalld owns its own chains we can't insert into, so trust the interface
+	// there in addition to the allower. Netstack has no kernel interface.
+	if !m.netstack {
+		if err := firewalld.TrustInterface(ifaceName); err != nil {
+			log.Warnf("failed to trust interface in firewalld: %v", err)
+		}
+	}
+}
+
+// Close cleans up the firewall manager: removes rules, closes trackers, and
+// closes the interface allower.
+func (m *Manager) Close(*statemanager.Manager) error {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+
+	m.resetState()
+
+	var merr *multierror.Error
+	if m.ifaceAllower != nil {
+		if err := m.ifaceAllower.Close(); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("close interface allower: %w", err))
+		}
+	}
+	if !m.netstack {
+		if err := firewalld.UntrustInterface(m.wgIface.Name()); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("untrust interface in firewalld: %w", err))
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
 // blockInvalidRouted installs drop rules for traffic to the wg overlay that
 // arrives via the routing path. v4 and v6 are independent: a v6 install
 // failure leaves v4 protection in place (and vice versa) so the returned
 // slice always contains whatever was successfully installed, even on error.
 // Callers must persist the slice so DisableRouting can clean partial state.
-func (m *Manager) blockInvalidRouted(iface common.IFaceMapper) ([]firewall.Rule, error) {
+func (m *Manager) blockInvalidRouted(iface Iface) ([]firewall.Rule, error) {
 	wgPrefix := iface.Address().Network
 	log.Debugf("blocking invalid routed traffic for %s", wgPrefix)
 
@@ -320,7 +473,7 @@ func (m *Manager) blockInvalidRouted(iface common.IFaceMapper) ([]firewall.Rule,
 	}
 
 	var rules []firewall.Rule
-	v4Rule, err := m.addRouteFiltering(
+	v4Rule, err := m.addRouteRule(
 		nil,
 		sources,
 		firewall.Network{Prefix: wgPrefix},
@@ -336,7 +489,7 @@ func (m *Manager) blockInvalidRouted(iface common.IFaceMapper) ([]firewall.Rule,
 
 	if v6Net.IsValid() {
 		log.Debugf("blocking invalid routed traffic for %s", v6Net)
-		v6Rule, err := m.addRouteFiltering(
+		v6Rule, err := m.addRouteRule(
 			nil,
 			sources,
 			firewall.Network{Prefix: v6Net},
@@ -357,20 +510,14 @@ func (m *Manager) blockInvalidRouted(iface common.IFaceMapper) ([]firewall.Rule,
 }
 
 func (m *Manager) determineRouting() error {
-	var disableUspRouting, forceUserspaceRouter bool
-	var err error
+	var disableUspRouting bool
 	if val := os.Getenv(EnvDisableUserspaceRouting); val != "" {
+		var err error
 		disableUspRouting, err = strconv.ParseBool(val)
 		if err != nil {
 			log.Warnf("failed to parse %s: %v", EnvDisableUserspaceRouting, err)
 		}
 	}
-	if val := os.Getenv(EnvForceUserspaceRouter); val != "" {
-		forceUserspaceRouter, err = strconv.ParseBool(val)
-		if err != nil {
-			log.Warnf("failed to parse %s: %v", EnvForceUserspaceRouter, err)
-		}
-	}
 
 	switch {
 	case disableUspRouting:
@@ -385,26 +532,11 @@ func (m *Manager) determineRouting() error {
 
 		log.Info("server routes are disabled")
 
-	case forceUserspaceRouter:
-		m.routingEnabled.Store(true)
-		m.nativeRouter.Store(false)
-
-		log.Info("userspace routing is forced")
-
-	case !m.netstack && m.nativeFirewall != nil:
-		// if the OS supports routing natively, then we don't need to filter/route ourselves
-		// netstack mode won't support native routing as there is no interface
-
-		m.routingEnabled.Store(true)
-		m.nativeRouter.Store(true)
-
-		log.Info("native routing is enabled")
-
 	default:
 		m.routingEnabled.Store(true)
 		m.nativeRouter.Store(false)
 
-		log.Info("userspace routing enabled by default")
+		log.Info("userspace routing enabled")
 	}
 
 	if m.routingEnabled.Load() && !m.nativeRouter.Load() {
@@ -470,96 +602,118 @@ func (m *Manager) IsStateful() bool {
 	return m.stateful
 }
 
-func (m *Manager) AddNatRule(pair firewall.RouterPair) error {
-	if m.nativeRouter.Load() && m.nativeFirewall != nil {
-		return m.nativeFirewall.AddNatRule(pair)
-	}
-
+func (m *Manager) AddNatRule(firewall.RouterPair) error {
 	// userspace routed packets are always SNATed to the inbound direction
 	// TODO: implement outbound SNAT
 	return nil
 }
 
 // RemoveNatRule removes a routing firewall rule
-func (m *Manager) RemoveNatRule(pair firewall.RouterPair) error {
-	if m.nativeRouter.Load() && m.nativeFirewall != nil {
-		return m.nativeFirewall.RemoveNatRule(pair)
-	}
+func (m *Manager) RemoveNatRule(firewall.RouterPair) error {
 	return nil
 }
 
-// AddPeerFiltering rule to the firewall
-//
-// If comment argument is empty firewall manager should set
-// rule ID as comment for the rule
-func (m *Manager) AddPeerFiltering(
+// addPeerRule installs an input-chain rule that matches packets
+// by source only. Called from AddFilterRule when the caller doesn't
+// specify a destination. Sources are expected to share one address
+// family; the family selects the ipLayer so the ICMP variant matches
+// what the decoder produces.
+func (m *Manager) addPeerRule(
 	id []byte,
-	ip net.IP,
+	sources []netip.Prefix,
 	proto firewall.Protocol,
 	sPort *firewall.Port,
 	dPort *firewall.Port,
 	action firewall.Action,
-	_ string,
-) ([]firewall.Rule, error) {
-	// TODO: fix in upper layers
-	i, ok := netip.AddrFromSlice(ip)
-	if !ok {
-		return nil, fmt.Errorf("invalid IP: %s", ip)
-	}
-
-	i = i.Unmap()
-	r := PeerRule{
-		id:        uuid.New().String(),
-		mgmtId:    id,
-		ip:        i,
-		ipLayer:   layers.LayerTypeIPv6,
-		matchByIP: true,
-		drop:      action == firewall.ActionDrop,
-	}
-	if i.Is4() {
-		r.ipLayer = layers.LayerTypeIPv4
-	}
-
-	if s := r.ip.String(); s == "0.0.0.0" || s == "::" {
-		r.matchByIP = false
-	}
-
-	r.sPort = sPort
-	r.dPort = dPort
-
-	r.protoLayer = protoToLayer(proto, r.ipLayer)
-
-	m.mutex.Lock()
-	var targetMap map[netip.Addr]RuleSet
-	if r.drop {
-		targetMap = m.incomingDenyRules
-	} else {
-		targetMap = m.incomingRules
-	}
-
-	if _, ok := targetMap[r.ip]; !ok {
-		targetMap[r.ip] = make(RuleSet)
-	}
-	targetMap[r.ip][r.id] = r
-	m.mutex.Unlock()
-	return []firewall.Rule{&r}, nil
-}
-
-func (m *Manager) AddRouteFiltering(
-	id []byte,
-	sources []netip.Prefix,
-	destination firewall.Network,
-	proto firewall.Protocol,
-	sPort, dPort *firewall.Port,
-	action firewall.Action,
 ) (firewall.Rule, error) {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
-	return m.addRouteFiltering(id, sources, destination, proto, sPort, dPort, action)
+	// Sources are a single family; normalize v4-mapped prefixes to plain
+	// v4 and pick the matching IP layer. A /0 source matches any address
+	// of its own family only, mirroring the kernel backends.
+	normalized := make([]netip.Prefix, len(sources))
+	ipLayer := layers.LayerTypeIPv4
+	for i, p := range sources {
+		normalized[i] = firewall.UnmapPrefix(p)
+		if normalized[i].Addr().Is6() {
+			ipLayer = layers.LayerTypeIPv6
+		}
+	}
+	spec := peerRuleSpec{
+		mgmtID:  id,
+		sources: normalized,
+		ipLayer: ipLayer,
+		proto:   proto,
+		sPort:   sPort,
+		dPort:   dPort,
+		action:  action,
+	}
+	return m.addOnePeerRule(spec), nil
 }
 
-func (m *Manager) addRouteFiltering(
+// addOnePeerRule builds and registers a single-family peer rule, or
+// returns the existing rule when one with the same content key is
+// already installed. The caller must hold m.mutex. The content key is
+// the shared GenerateRuleID with an empty destination, so peer rules
+// dedup the same way route rules and the kernel backends do; it is
+// order-independent, so callers passing the same sources in any order
+// dedup to one rule.
+//
+// There is no refcount: a content key is installed once and deleted on
+// the first DeleteFilterRule for that key. The caller must therefore
+// key its own tracking by the returned rule id so add and delete stay
+// balanced per content key; the acl manager does this via
+// peerRulesPairs.
+func (m *Manager) addOnePeerRule(spec peerRuleSpec) *PeerRule {
+	ruleID := nbid.GenerateRuleID(spec.sources, firewall.Network{}, spec.proto, spec.sPort, spec.dPort, spec.action)
+	if existing, ok := m.peerRulesMap[ruleID]; ok {
+		return existing
+	}
+
+	rule := m.buildPeerRule(ruleID, spec)
+	m.registerPeerRule(rule)
+	return rule
+}
+
+func (m *Manager) buildPeerRule(ruleID nbid.RuleID, spec peerRuleSpec) *PeerRule {
+	r := &PeerRule{
+		id:      ruleID,
+		mgmtId:  spec.mgmtID,
+		sources: spec.sources,
+		action:  spec.action,
+		srcPort: spec.sPort,
+		dstPort: spec.dPort,
+	}
+	r.sourceAddrs = make(map[netip.Addr]struct{}, len(spec.sources))
+	for _, p := range spec.sources {
+		if p.Bits() == p.Addr().BitLen() {
+			r.sourceAddrs[p.Addr()] = struct{}{}
+		}
+	}
+	r.protoLayer = protoToLayer(spec.proto, spec.ipLayer)
+	return r
+}
+
+// registerPeerRule records a freshly built peer rule in the matching
+// slice, index, and dedup map. The caller must hold m.mutex.
+func (m *Manager) registerPeerRule(r *PeerRule) {
+	if r.action == firewall.ActionDrop {
+		m.incomingDenyRules = append(m.incomingDenyRules, r)
+		m.incomingDenyIndex.add(r)
+	} else {
+		m.incomingAcceptRules = append(m.incomingAcceptRules, r)
+		m.incomingAcceptIndex.add(r)
+	}
+	m.peerRulesMap[r.id] = r
+}
+
+// AddFilterRule is the unified entry point for both peer (input chain)
+// and route (forward chain) filtering rules. The destination
+// distinguishes the two semantics: a zero Network installs an
+// input-side rule that matches by source only; a set Network installs
+// a forward-side rule that also matches the destination.
+func (m *Manager) AddFilterRule(
 	id []byte,
 	sources []netip.Prefix,
 	destination firewall.Network,
@@ -567,19 +721,49 @@ func (m *Manager) addRouteFiltering(
 	sPort, dPort *firewall.Port,
 	action firewall.Action,
 ) (firewall.Rule, error) {
-	if m.nativeRouter.Load() && m.nativeFirewall != nil {
-		return m.nativeFirewall.AddRouteFiltering(id, sources, destination, proto, sPort, dPort, action)
+	if len(sources) == 0 {
+		return nil, firewall.ErrNoSources
 	}
 
-	ruleKey := nbid.GenerateRouteRuleKey(sources, destination, proto, sPort, dPort, action)
+	if destination.IsZero() {
+		return m.addPeerRule(id, sources, proto, sPort, dPort, action)
+	}
 
-	if existingRule, ok := m.routeRulesMap[ruleKey]; ok {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+	return m.addRouteRule(id, sources, destination, proto, sPort, dPort, action)
+}
+
+// DeleteFilterRule deletes a filtering rule. The rule's underlying type
+// is used to route to the correct internal path.
+func (m *Manager) DeleteFilterRule(rule firewall.Rule) error {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+
+	if r, ok := rule.(*PeerRule); ok {
+		return m.deletePeerRuleLocked(r)
+	}
+
+	// Anything else is a route rule (matched on the forward path).
+	return m.deleteRouteRule(rule)
+}
+
+func (m *Manager) addRouteRule(
+	id []byte,
+	sources []netip.Prefix,
+	destination firewall.Network,
+	proto firewall.Protocol,
+	sPort, dPort *firewall.Port,
+	action firewall.Action,
+) (firewall.Rule, error) {
+	ruleID := nbid.GenerateRuleID(sources, destination, proto, sPort, dPort, action)
+
+	if existingRule, ok := m.routeRulesMap[ruleID]; ok {
 		return existingRule, nil
 	}
 
 	rule := RouteRule{
-		// TODO: consolidate these IDs
-		id:         string(ruleKey),
+		id:         ruleID,
 		mgmtId:     id,
 		sources:    sources,
 		dstSet:     destination.Set,
@@ -594,78 +778,58 @@ func (m *Manager) addRouteFiltering(
 
 	m.routeRules = append(m.routeRules, &rule)
 	m.routeRules.Sort()
-	m.routeRulesMap[ruleKey] = &rule
+	m.routeRulesMap[ruleID] = &rule
 
 	return &rule, nil
 }
 
-func (m *Manager) DeleteRouteRule(rule firewall.Rule) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	return m.deleteRouteRule(rule)
-}
-
 func (m *Manager) deleteRouteRule(rule firewall.Rule) error {
-	if m.nativeRouter.Load() && m.nativeFirewall != nil {
-		return m.nativeFirewall.DeleteRouteRule(rule)
+	ruleID := rule.ID()
+	trimmed, _, ok := removeRuleByID(m.routeRules, ruleID)
+	if !ok {
+		return fmt.Errorf("route rule not found: %s", ruleID)
 	}
-
-	ruleKey := nbid.RuleID(rule.ID())
-	if _, ok := m.routeRulesMap[ruleKey]; !ok {
-		return fmt.Errorf("route rule not found: %s", ruleKey)
-	}
-
-	idx := slices.IndexFunc(m.routeRules, func(r *RouteRule) bool {
-		return r.id == string(ruleKey)
-	})
-	if idx < 0 {
-		return fmt.Errorf("route rule not found in slice: %s", ruleKey)
-	}
-
-	m.routeRules = slices.Delete(m.routeRules, idx, idx+1)
-	delete(m.routeRulesMap, ruleKey)
+	m.routeRules = trimmed
+	delete(m.routeRulesMap, ruleID)
 	return nil
 }
 
-// DeletePeerRule from the firewall by rule definition
-func (m *Manager) DeletePeerRule(rule firewall.Rule) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
+// deletePeerRuleLocked removes a peer rule from the matching slice,
+// index, and dedup map. The caller must hold m.mutex.
+func (m *Manager) deletePeerRuleLocked(r *PeerRule) error {
+	target, index := &m.incomingAcceptRules, &m.incomingAcceptIndex
+	if r.action == firewall.ActionDrop {
+		target, index = &m.incomingDenyRules, &m.incomingDenyIndex
+	}
 
-	r, ok := rule.(*PeerRule)
+	trimmed, stored, ok := removeRuleByID(*target, r.id)
 	if !ok {
-		return fmt.Errorf("delete rule: invalid rule type: %T", rule)
-	}
-
-	var sourceMap map[netip.Addr]RuleSet
-	if r.drop {
-		sourceMap = m.incomingDenyRules
-	} else {
-		sourceMap = m.incomingRules
-	}
-
-	if ruleset, ok := sourceMap[r.ip]; ok {
-		if _, exists := ruleset[r.id]; !exists {
-			return fmt.Errorf("delete rule: no rule with such id: %v", r.id)
-		}
-		delete(ruleset, r.id)
-		if len(ruleset) == 0 {
-			delete(sourceMap, r.ip)
-		}
-	} else {
 		return fmt.Errorf("delete rule: no rule with such id: %v", r.id)
 	}
-
+	*target = trimmed
+	index.remove(stored)
+	delete(m.peerRulesMap, r.id)
 	return nil
 }
 
-// SetLegacyManagement doesn't need to be implemented for this manager
-func (m *Manager) SetLegacyManagement(isLegacy bool) error {
-	if m.nativeFirewall == nil {
-		return nil
+// removeRuleByID removes the first rule whose id matches ruleID from
+// rules, preserving order. It returns the trimmed slice, the removed
+// rule, and whether a match was found.
+func removeRuleByID[S ~[]T, T firewall.Rule](rules S, ruleID firewall.RuleID) (S, T, bool) {
+	idx := slices.IndexFunc(rules, func(r T) bool { return r.ID() == ruleID })
+	var removed T
+	if idx < 0 {
+		return rules, removed, false
 	}
-	return m.nativeFirewall.SetLegacyManagement(isLegacy)
+	removed = rules[idx]
+	return slices.Delete(rules, idx, idx+1), removed, true
+}
+
+// SetLegacyManagement is a no-op for the userspace firewall: it only matters
+// when an old management server can't send route firewall rules, which the
+// userspace router doesn't rely on.
+func (m *Manager) SetLegacyManagement(bool) error {
+	return nil
 }
 
 // Flush doesn't need to be implemented for this manager
@@ -674,11 +838,14 @@ func (m *Manager) Flush() error { return nil }
 // resetState clears all firewall rules and closes connection trackers.
 // Must be called with m.mutex held.
 func (m *Manager) resetState() {
-	clear(m.outgoingRules)
-	clear(m.incomingDenyRules)
-	clear(m.incomingRules)
+	m.incomingDenyRules = m.incomingDenyRules[:0]
+	m.incomingAcceptRules = m.incomingAcceptRules[:0]
+	m.incomingDenyIndex.reset()
+	m.incomingAcceptIndex.reset()
+	clear(m.peerRulesMap)
 	clear(m.routeRulesMap)
 	m.routeRules = m.routeRules[:0]
+	m.blockRules = nil
 	m.udpHookOut.Store(nil)
 	m.tcpHookOut.Store(nil)
 
@@ -694,6 +861,10 @@ func (m *Manager) resetState() {
 		m.tcpTracker.Close()
 	}
 
+	if m.fragments != nil {
+		m.fragments.Close()
+	}
+
 	if fwder := m.forwarder.Load(); fwder != nil {
 		fwder.SetCapture(nil)
 		fwder.Stop()
@@ -708,21 +879,9 @@ func (m *Manager) resetState() {
 	}
 }
 
-// SetupEBPFProxyNoTrack creates notrack rules for eBPF proxy loopback traffic.
-func (m *Manager) SetupEBPFProxyNoTrack(proxyPort, wgPort uint16) error {
-	if m.nativeFirewall == nil {
-		return nil
-	}
-	return m.nativeFirewall.SetupEBPFProxyNoTrack(proxyPort, wgPort)
-}
-
 // UpdateSet updates the rule destinations associated with the given set
 // by merging the existing prefixes with the new ones, then deduplicating.
 func (m *Manager) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
-	if m.nativeRouter.Load() && m.nativeFirewall != nil {
-		return m.nativeFirewall.UpdateSet(set, prefixes)
-	}
-
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
@@ -820,11 +979,11 @@ func (m *Manager) extractIPs(d *decoder) (srcIP, dstIP netip.Addr) {
 	case layers.LayerTypeIPv4:
 		src, _ := netip.AddrFromSlice(d.ip4.SrcIP)
 		dst, _ := netip.AddrFromSlice(d.ip4.DstIP)
-		return src, dst
+		return src.Unmap(), dst.Unmap()
 	case layers.LayerTypeIPv6:
 		src, _ := netip.AddrFromSlice(d.ip6.SrcIP)
 		dst, _ := netip.AddrFromSlice(d.ip6.DstIP)
-		return src, dst
+		return src.Unmap(), dst.Unmap()
 	default:
 		return netip.Addr{}, netip.Addr{}
 	}
@@ -1046,19 +1205,20 @@ func (m *Manager) filterInbound(packetData []byte, size int) bool {
 		return true
 	}
 
-	// TODO: pass fragments of routed packets to forwarder
+	// gopacket does not decode the transport header of any IP fragment, so
+	// fragments take a dedicated path: the first fragment's header is decoded
+	// and ACL-evaluated here, and the remaining fragments inherit its verdict.
 	if fragment {
-		if m.logger.Enabled(nblog.LevelTrace) {
-			if d.decoded[0] == layers.LayerTypeIPv4 {
-				m.logger.Trace4("packet is a fragment: src=%v dst=%v id=%v flags=%v",
-					srcIP, dstIP, d.ip4.Id, d.ip4.Flags)
-			} else {
-				m.logger.Trace2("packet is an IPv6 fragment: src=%v dst=%v", srcIP, dstIP)
-			}
-		}
-		return false
+		return m.filterInboundFragment(d, srcIP, dstIP, size)
 	}
 
+	return m.filterInboundDecoded(d, srcIP, dstIP, packetData, size)
+}
+
+// filterInboundDecoded runs the ACL, DNAT and conntrack pipeline on a fully
+// decoded (non-fragment) inbound packet. It returns true if the packet should
+// be dropped.
+func (m *Manager) filterInboundDecoded(d *decoder, srcIP, dstIP netip.Addr, packetData []byte, size int) bool {
 	// TODO: optimize port DNAT by caching matched rules in conntrack
 	if translated := m.translateInboundPortDNAT(packetData, d, srcIP, dstIP); translated {
 		// Re-decode after port DNAT translation to update port information
@@ -1089,33 +1249,226 @@ func (m *Manager) filterInbound(packetData []byte, size int) bool {
 	return m.handleRoutedTraffic(d, srcIP, dstIP, packetData, size)
 }
 
+// fragmentMeta holds the reassembly identity and layout of an IP fragment,
+// extracted uniformly for IPv4 and IPv6.
+type fragmentMeta struct {
+	key fragmentKey
+	// offset is the fragment offset in 8-byte units (zero for the first
+	// fragment).
+	offset uint16
+	// moreFragments is the More Fragments bit. A first fragment with it unset is
+	// an IPv6 atomic fragment (a complete datagram, RFC 6946): it has no trailing
+	// fragments to inherit a verdict, so it must not be recorded.
+	moreFragments bool
+	proto         layers.IPProtocol
+	// l4payload is the fragmentable payload of this fragment. For the first
+	// fragment it starts with the transport header.
+	l4payload []byte
+	// headerEndOctets is the first fragment's payload length in 8-byte units:
+	// the smallest offset a trailing fragment may start at without overlapping
+	// the inspected transport header.
+	headerEndOctets uint16
+}
+
+// fragmentMetadata extracts the fragment identity and layout from a decoded IP
+// fragment. It returns false for fragments it can't interpret (e.g. an IPv6
+// fragment header shorter than 8 bytes), which are then dropped.
+func fragmentMetadata(d *decoder, srcIP, dstIP netip.Addr) (fragmentMeta, bool) {
+	switch d.decoded[0] {
+	case layers.LayerTypeIPv4:
+		payload := d.ip4.Payload
+		return fragmentMeta{
+			key:             fragmentKey{srcIP: srcIP, dstIP: dstIP, id: uint32(d.ip4.Id), proto: uint8(d.ip4.Protocol)},
+			offset:          d.ip4.FragOffset,
+			moreFragments:   d.ip4.Flags&layers.IPv4MoreFragments != 0,
+			proto:           d.ip4.Protocol,
+			l4payload:       payload,
+			headerEndOctets: octets(len(payload)),
+		}, true
+
+	case layers.LayerTypeIPv6:
+		// IPv6 fragment extension header: 8 bytes, followed by the fragmentable
+		// payload. Layout: next header (1), reserved (1), offset+flags (2), id (4).
+		payload := d.ip6.Payload
+		if len(payload) < 8 {
+			return fragmentMeta{}, false
+		}
+		nextHeader := layers.IPProtocol(payload[0])
+		offsetFlags := binary.BigEndian.Uint16(payload[2:4])
+		id := binary.BigEndian.Uint32(payload[4:8])
+		l4 := payload[8:]
+		return fragmentMeta{
+			key:             fragmentKey{srcIP: srcIP, dstIP: dstIP, id: id, proto: uint8(nextHeader)},
+			offset:          offsetFlags >> 3,
+			moreFragments:   offsetFlags&1 != 0,
+			proto:           nextHeader,
+			l4payload:       l4,
+			headerEndOctets: octets(len(l4)),
+		}, true
+
+	default:
+		return fragmentMeta{}, false
+	}
+}
+
+// octets rounds a byte length up to whole 8-byte units, the granularity of the
+// IP fragment offset field.
+func octets(nbytes int) uint16 {
+	return uint16((nbytes + 7) / 8)
+}
+
+// filterInboundFragment decides the fate of an IP fragment. gopacket stops
+// decoding at the network layer for every fragment, so the first fragment's
+// transport header is decoded and ACL-evaluated here and its verdict recorded;
+// the remaining (headerless) fragments inherit that verdict. Anything that
+// cannot be tied to an allowed, non-overlapping first fragment is dropped.
+func (m *Manager) filterInboundFragment(d *decoder, srcIP, dstIP netip.Addr, size int) bool {
+	meta, ok := fragmentMetadata(d, srcIP, dstIP)
+	if !ok {
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace2("dropping unsupported fragment: src=%v dst=%v", srcIP, dstIP)
+		}
+		return true
+	}
+
+	if meta.offset != 0 {
+		return m.filterTrailingFragment(meta, srcIP, dstIP)
+	}
+
+	// A new first fragment supersedes any recorded verdict for this datagram, so
+	// a re-sent or overlapping offset-zero fragment can't inherit the old one.
+	m.fragments.poison(meta.key)
+
+	// First fragment: decode its transport header so the ACL can evaluate it. A
+	// decode failure means the fragment is too small to hold the full transport
+	// header (RFC 1858 §3 tiny-fragment attack); it can't be evaluated, so drop it.
+	if !d.decodeTransport(meta.proto, meta.l4payload) {
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace3("dropping first fragment without full L4 header: src=%v dst=%v id=%v",
+				srcIP, dstIP, meta.key.id)
+		}
+		return true
+	}
+
+	return m.filterFirstFragment(d, meta, srcIP, dstIP, size)
+}
+
+// filterTrailingFragment applies a recorded first-fragment verdict to a
+// non-first fragment.
+func (m *Manager) filterTrailingFragment(meta fragmentMeta, srcIP, dstIP netip.Addr) bool {
+	switch m.fragments.verdict(meta.key, meta.offset) {
+	case fragmentAllow:
+		return false
+	case fragmentOverlap:
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace3("dropping overlapping fragment rewriting inspected header: src=%v dst=%v id=%v",
+				srcIP, dstIP, meta.key.id)
+		}
+		return true
+	default:
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace3("dropping fragment with no allowed first fragment: src=%v dst=%v id=%v",
+				srcIP, dstIP, meta.key.id)
+		}
+		return true
+	}
+}
+
+// filterFirstFragment runs the verdict part of the inbound pipeline on a first
+// fragment with its transport header decoded. It mirrors filterInboundDecoded
+// but skips DNAT (port rewriting on fragments is unsupported) and forwarder
+// injection (fragments are left to the stack to reassemble, not forwarded).
+// Allowed fragments have their verdict recorded so the datagram's trailing
+// fragments inherit it.
+func (m *Manager) filterFirstFragment(d *decoder, meta fragmentMeta, srcIP, dstIP netip.Addr, size int) bool {
+	if m.stateful && m.isValidTrackedConnection(d, srcIP, dstIP, size) {
+		m.recordFirstFragment(meta)
+		return false
+	}
+
+	if m.localipmanager.IsLocalIP(dstIP) {
+		ruleID, blocked := m.peerACLsBlock(srcIP, d, nil)
+		if blocked {
+			m.storeDropFlow("Dropping local first fragment (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+				d, srcIP, dstIP, ruleID, size)
+			return true
+		}
+		m.trackInbound(d, srcIP, dstIP, ruleID, size)
+		m.recordFirstFragment(meta)
+		return false
+	}
+
+	if !m.routingEnabled.Load() {
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace2("Dropping routed fragment (routing disabled): src=%s dst=%s", srcIP, dstIP)
+		}
+		return true
+	}
+	if m.nativeRouter.Load() {
+		m.trackInbound(d, srcIP, dstIP, nil, size)
+		m.recordFirstFragment(meta)
+		return false
+	}
+
+	// TODO: pass fragments of routed packets to the forwarder; until then
+	// allowed routed fragments go to the native stack.
+	srcPort, dstPort := getPortsFromPacket(d)
+	ruleID, pass := m.routeACLsPass(srcIP, dstIP, d.decoded[1], srcPort, dstPort)
+	if !pass {
+		m.storeDropFlow("Dropping routed first fragment (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+			d, srcIP, dstIP, ruleID, size)
+		return true
+	}
+
+	m.recordFirstFragment(meta)
+	return false
+}
+
+// recordFirstFragment caches an allowed first fragment's verdict for its
+// trailing fragments to inherit. Atomic fragments (no More Fragments bit) are
+// complete datagrams with no trailing fragments, so they are not cached and
+// cannot exhaust the verdict table.
+func (m *Manager) recordFirstFragment(meta fragmentMeta) {
+	if !meta.moreFragments {
+		return
+	}
+	m.fragments.recordAllowed(meta.key, meta.headerEndOctets)
+}
+
+// storeDropFlow logs and records a netflow drop event for an inbound packet
+// denied by the ACLs. msg is the trace format taking rule id, protocol, source
+// and destination.
+func (m *Manager) storeDropFlow(msg string, d *decoder, srcIP, dstIP netip.Addr, ruleID []byte, size int) {
+	pnum := getProtocolFromPacket(d)
+	srcPort, dstPort := getPortsFromPacket(d)
+
+	if m.logger.Enabled(nblog.LevelTrace) {
+		m.logger.Trace6(msg, ruleID, pnum, srcIP, srcPort, dstIP, dstPort)
+	}
+
+	m.flowLogger.StoreEvent(nftypes.EventFields{
+		FlowID:     uuid.New(),
+		Type:       nftypes.TypeDrop,
+		RuleID:     ruleID,
+		Direction:  nftypes.Ingress,
+		Protocol:   pnum,
+		SourceIP:   srcIP,
+		DestIP:     dstIP,
+		SourcePort: srcPort,
+		DestPort:   dstPort,
+		// TODO: icmp type/code
+		RxPackets: 1,
+		RxBytes:   uint64(size),
+	})
+}
+
 // handleLocalTraffic handles local traffic.
 // If it returns true, the packet should be dropped.
 func (m *Manager) handleLocalTraffic(d *decoder, srcIP, dstIP netip.Addr, packetData []byte, size int) bool {
 	ruleID, blocked := m.peerACLsBlock(srcIP, d, packetData)
 	if blocked {
-		pnum := getProtocolFromPacket(d)
-		srcPort, dstPort := getPortsFromPacket(d)
-
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace6("Dropping local packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-				ruleID, pnum, srcIP, srcPort, dstIP, dstPort)
-		}
-
-		m.flowLogger.StoreEvent(nftypes.EventFields{
-			FlowID:     uuid.New(),
-			Type:       nftypes.TypeDrop,
-			RuleID:     ruleID,
-			Direction:  nftypes.Ingress,
-			Protocol:   pnum,
-			SourceIP:   srcIP,
-			DestIP:     dstIP,
-			SourcePort: srcPort,
-			DestPort:   dstPort,
-			// TODO: icmp type/code
-			RxPackets: 1,
-			RxBytes:   uint64(size),
-		})
+		m.storeDropFlow("Dropping local packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+			d, srcIP, dstIP, ruleID, size)
 		return true
 	}
 
@@ -1168,27 +1521,8 @@ func (m *Manager) handleRoutedTraffic(d *decoder, srcIP, dstIP netip.Addr, packe
 
 	ruleID, pass := m.routeACLsPass(srcIP, dstIP, protoLayer, srcPort, dstPort)
 	if !pass {
-		proto := getProtocolFromPacket(d)
-
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace6("Dropping routed packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-				ruleID, proto, srcIP, srcPort, dstIP, dstPort)
-		}
-
-		m.flowLogger.StoreEvent(nftypes.EventFields{
-			FlowID:     uuid.New(),
-			Type:       nftypes.TypeDrop,
-			RuleID:     ruleID,
-			Direction:  nftypes.Ingress,
-			Protocol:   proto,
-			SourceIP:   srcIP,
-			DestIP:     dstIP,
-			SourcePort: srcPort,
-			DestPort:   dstPort,
-			// TODO: icmp type/code
-			RxPackets: 1,
-			RxBytes:   uint64(size),
-		})
+		m.storeDropFlow("Dropping routed packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+			d, srcIP, dstIP, ruleID, size)
 		return true
 	}
 
@@ -1404,20 +1738,12 @@ func (m *Manager) peerACLsBlock(srcIP netip.Addr, d *decoder, packetData []byte)
 		return nil, false
 	}
 
-	if mgmtId, filter, ok := validateRule(srcIP, packetData, m.incomingDenyRules[srcIP], d); ok {
+	if mgmtId, filter, ok := m.incomingDenyIndex.match(srcIP, d); ok {
 		return mgmtId, filter
 	}
-
-	if mgmtId, filter, ok := validateRule(srcIP, packetData, m.incomingRules[srcIP], d); ok {
+	if mgmtId, filter, ok := m.incomingAcceptIndex.match(srcIP, d); ok {
 		return mgmtId, filter
 	}
-	if mgmtId, filter, ok := validateRule(srcIP, packetData, m.incomingRules[netip.IPv4Unspecified()], d); ok {
-		return mgmtId, filter
-	}
-	if mgmtId, filter, ok := validateRule(srcIP, packetData, m.incomingRules[netip.IPv6Unspecified()], d); ok {
-		return mgmtId, filter
-	}
-
 	return nil, true
 }
 
@@ -1438,39 +1764,6 @@ func portsMatch(rulePort *firewall.Port, packetPort uint16) bool {
 	return false
 }
 
-func validateRule(ip netip.Addr, packetData []byte, rules map[string]PeerRule, d *decoder) ([]byte, bool, bool) {
-	payloadLayer := d.decoded[1]
-
-	for _, rule := range rules {
-		if rule.matchByIP && ip.Compare(rule.ip) != 0 {
-			continue
-		}
-
-		if rule.protoLayer == layerTypeAll {
-			return rule.mgmtId, rule.drop, true
-		}
-
-		if !protoLayerMatches(rule.protoLayer, payloadLayer) {
-			continue
-		}
-
-		switch payloadLayer {
-		case layers.LayerTypeTCP:
-			if portsMatch(rule.sPort, uint16(d.tcp.SrcPort)) && portsMatch(rule.dPort, uint16(d.tcp.DstPort)) {
-				return rule.mgmtId, rule.drop, true
-			}
-		case layers.LayerTypeUDP:
-			if portsMatch(rule.sPort, uint16(d.udp.SrcPort)) && portsMatch(rule.dPort, uint16(d.udp.DstPort)) {
-				return rule.mgmtId, rule.drop, true
-			}
-		case layers.LayerTypeICMPv4, layers.LayerTypeICMPv6:
-			return rule.mgmtId, rule.drop, true
-		}
-	}
-
-	return nil, false, false
-}
-
 // routeACLsPass returns true if the packet is allowed by the route ACLs
 func (m *Manager) routeACLsPass(srcIP, dstIP netip.Addr, protoLayer gopacket.LayerType, srcPort, dstPort uint16) ([]byte, bool) {
 	m.mutex.RLock()
@@ -1547,10 +1840,13 @@ func (m *Manager) EnableRouting() error {
 	}
 
 	rules, err := m.blockInvalidRouted(m.wgIface)
-	// Persist whatever was installed even on partial failure, so DisableRouting
-	// can clean it up later.
 	m.blockRules = rules
 	if err != nil {
+		// Roll back so forwarding can't stay active without the full set of
+		// block rules.
+		if derr := m.disableRouting(); derr != nil {
+			log.Warnf("roll back routing after block rule failure: %v", derr)
+		}
 		return fmt.Errorf("block invalid routed: %w", err)
 	}
 
@@ -1561,6 +1857,10 @@ func (m *Manager) DisableRouting() error {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
+	return m.disableRouting()
+}
+
+func (m *Manager) disableRouting() error {
 	fwder := m.forwarder.Load()
 	if fwder == nil {
 		return nil
diff --git a/client/firewall/uspfilter/filter_bench_test.go b/client/firewall/uspfilter/filter_bench_test.go
index 4dccb0f65..72f3417f2 100644
--- a/client/firewall/uspfilter/filter_bench_test.go
+++ b/client/firewall/uspfilter/filter_bench_test.go
@@ -94,7 +94,7 @@ func BenchmarkCoreFiltering(b *testing.B) {
 			stateful: false,
 			setupFunc: func(m *Manager) {
 				// Single rule allowing all traffic
-				_, err := m.AddPeerFiltering(nil, net.ParseIP("0.0.0.0"), fw.ProtocolALL, nil, nil, fw.ActionAccept, "")
+				_, err := m.AddFilterRule(nil, pfx(net.ParseIP("0.0.0.0")), fw.Network{}, fw.ProtocolALL, nil, nil, fw.ActionAccept)
 				require.NoError(b, err)
 			},
 			desc: "Baseline: Single 'allow all' rule without connection tracking",
@@ -114,15 +114,13 @@ func BenchmarkCoreFiltering(b *testing.B) {
 				// Add explicit rules matching return traffic pattern
 				for i := 0; i < 1000; i++ { // Simulate realistic ruleset size
 					ip := generateRandomIPs(1)[0]
-					_, err := m.AddPeerFiltering(
+					_, err := m.AddFilterRule(
 						nil,
-						ip,
+						pfx(ip), fw.Network{},
 						fw.ProtocolTCP,
 						&fw.Port{Values: []uint16{uint16(1024 + i)}},
 						&fw.Port{Values: []uint16{80}},
-						fw.ActionAccept,
-						"",
-					)
+						fw.ActionAccept)
 					require.NoError(b, err)
 				}
 			},
@@ -133,15 +131,13 @@ func BenchmarkCoreFiltering(b *testing.B) {
 			stateful: true,
 			setupFunc: func(m *Manager) {
 				// Add some basic rules but rely on state for established connections
-				_, err := m.AddPeerFiltering(
+				_, err := m.AddFilterRule(
 					nil,
-					net.ParseIP("0.0.0.0"),
+					pfx(net.ParseIP("0.0.0.0")), fw.Network{},
 					fw.ProtocolTCP,
 					nil,
 					nil,
-					fw.ActionDrop,
-					"",
-				)
+					fw.ActionDrop)
 				require.NoError(b, err)
 			},
 			desc: "Connection tracking with established connections",
@@ -168,9 +164,12 @@ func BenchmarkCoreFiltering(b *testing.B) {
 				}
 
 				// Create manager and basic setup
-				manager, _ := Create(&IFaceMock{
-					SetFilterFunc: func(device.PacketFilter) error { return nil },
-				}, false, flowLogger, iface.DefaultMTU)
+				manager, err := Create(Config{
+					IFace: &IFaceMock{
+						SetFilterFunc: func(device.PacketFilter) error { return nil },
+					},
+					FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+				require.NoError(b, err)
 				defer b.Cleanup(func() {
 					require.NoError(b, manager.Close(nil))
 				})
@@ -208,9 +207,12 @@ func BenchmarkStateScaling(b *testing.B) {
 
 	for _, count := range connCounts {
 		b.Run(fmt.Sprintf("conns_%d", count), func(b *testing.B) {
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+			require.NoError(b, err)
 			b.Cleanup(func() {
 				require.NoError(b, manager.Close(nil))
 			})
@@ -251,9 +253,12 @@ func BenchmarkEstablishmentOverhead(b *testing.B) {
 
 	for _, sc := range scenarios {
 		b.Run(sc.name, func(b *testing.B) {
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+			require.NoError(b, err)
 			b.Cleanup(func() {
 				require.NoError(b, manager.Close(nil))
 			})
@@ -409,9 +414,12 @@ func BenchmarkRoutedNetworkReturn(b *testing.B) {
 
 	for _, sc := range scenarios {
 		b.Run(sc.name, func(b *testing.B) {
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+			require.NoError(b, err)
 			b.Cleanup(func() {
 				require.NoError(b, manager.Close(nil))
 			})
@@ -536,9 +544,12 @@ func BenchmarkLongLivedConnections(b *testing.B) {
 				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
 			}
 
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+			require.NoError(b, err)
 			defer b.Cleanup(func() {
 				require.NoError(b, manager.Close(nil))
 			})
@@ -546,7 +557,7 @@ func BenchmarkLongLivedConnections(b *testing.B) {
 			// Setup initial state based on scenario
 			if sc.rules {
 				// Single rule to allow all return traffic from port 80
-				_, err := manager.AddPeerFiltering(nil, net.ParseIP("0.0.0.0"), fw.ProtocolTCP, &fw.Port{Values: []uint16{80}}, nil, fw.ActionAccept, "")
+				_, err := manager.AddFilterRule(nil, pfx(net.ParseIP("0.0.0.0")), fw.Network{}, fw.ProtocolTCP, &fw.Port{Values: []uint16{80}}, nil, fw.ActionAccept)
 				require.NoError(b, err)
 			}
 
@@ -619,9 +630,12 @@ func BenchmarkShortLivedConnections(b *testing.B) {
 				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
 			}
 
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+			require.NoError(b, err)
 			defer b.Cleanup(func() {
 				require.NoError(b, manager.Close(nil))
 			})
@@ -629,7 +643,7 @@ func BenchmarkShortLivedConnections(b *testing.B) {
 			// Setup initial state based on scenario
 			if sc.rules {
 				// Single rule to allow all return traffic from port 80
-				_, err := manager.AddPeerFiltering(nil, net.ParseIP("0.0.0.0"), fw.ProtocolTCP, &fw.Port{Values: []uint16{80}}, nil, fw.ActionAccept, "")
+				_, err := manager.AddFilterRule(nil, pfx(net.ParseIP("0.0.0.0")), fw.Network{}, fw.ProtocolTCP, &fw.Port{Values: []uint16{80}}, nil, fw.ActionAccept)
 				require.NoError(b, err)
 			}
 
@@ -730,16 +744,19 @@ func BenchmarkParallelLongLivedConnections(b *testing.B) {
 				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
 			}
 
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+			require.NoError(b, err)
 			defer b.Cleanup(func() {
 				require.NoError(b, manager.Close(nil))
 			})
 
 			// Setup initial state based on scenario
 			if sc.rules {
-				_, err := manager.AddPeerFiltering(nil, net.ParseIP("0.0.0.0"), fw.ProtocolTCP, &fw.Port{Values: []uint16{80}}, nil, fw.ActionAccept, "")
+				_, err := manager.AddFilterRule(nil, pfx(net.ParseIP("0.0.0.0")), fw.Network{}, fw.ProtocolTCP, &fw.Port{Values: []uint16{80}}, nil, fw.ActionAccept)
 				require.NoError(b, err)
 			}
 
@@ -810,15 +827,18 @@ func BenchmarkParallelShortLivedConnections(b *testing.B) {
 				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
 			}
 
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+			require.NoError(b, err)
 			defer b.Cleanup(func() {
 				require.NoError(b, manager.Close(nil))
 			})
 
 			if sc.rules {
-				_, err := manager.AddPeerFiltering(nil, net.ParseIP("0.0.0.0"), fw.ProtocolTCP, &fw.Port{Values: []uint16{80}}, nil, fw.ActionAccept, "")
+				_, err := manager.AddFilterRule(nil, pfx(net.ParseIP("0.0.0.0")), fw.Network{}, fw.ProtocolTCP, &fw.Port{Values: []uint16{80}}, nil, fw.ActionAccept)
 				require.NoError(b, err)
 			}
 
@@ -931,7 +951,7 @@ func BenchmarkRouteACLs(b *testing.B) {
 
 	for _, r := range rules {
 		dst := fw.Network{Prefix: r.dest}
-		_, err := manager.AddRouteFiltering(nil, r.sources, dst, r.proto, nil, r.port, fw.ActionAccept)
+		_, err := manager.AddFilterRule(nil, r.sources, dst, r.proto, nil, r.port, fw.ActionAccept)
 		if err != nil {
 			b.Fatal(err)
 		}
@@ -1014,9 +1034,11 @@ func BenchmarkMSSClamping(b *testing.B) {
 
 	for _, sc := range scenarios {
 		b.Run(sc.name, func(b *testing.B) {
-			manager, err := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 			require.NoError(b, err)
 			defer func() {
 				require.NoError(b, manager.Close(nil))
@@ -1079,9 +1101,11 @@ func BenchmarkMSSClampingOverhead(b *testing.B) {
 
 	for _, sc := range scenarios {
 		b.Run(sc.name, func(b *testing.B) {
-			manager, err := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 			require.NoError(b, err)
 			defer func() {
 				require.NoError(b, manager.Close(nil))
@@ -1134,9 +1158,11 @@ func BenchmarkMSSClampingMemory(b *testing.B) {
 
 	for _, sc := range scenarios {
 		b.Run(sc.name, func(b *testing.B) {
-			manager, err := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 			require.NoError(b, err)
 			defer func() {
 				require.NoError(b, manager.Close(nil))
diff --git a/client/firewall/uspfilter/filter_filter_test.go b/client/firewall/uspfilter/filter_filter_test.go
index a64c83138..57b59c9bc 100644
--- a/client/firewall/uspfilter/filter_filter_test.go
+++ b/client/firewall/uspfilter/filter_filter_test.go
@@ -5,7 +5,7 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/stretchr/testify/require"
@@ -32,7 +32,7 @@ func TestPeerACLFiltering(t *testing.T) {
 		},
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	require.NotNil(t, manager)
 
@@ -496,40 +496,32 @@ func TestPeerACLFiltering(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			if tc.ruleAction == fw.ActionDrop {
 				// add general accept rule for the same IP to test drop rule precedence
-				rules, err := manager.AddPeerFiltering(
+				rules, err := manager.AddFilterRule(
 					nil,
-					net.ParseIP(tc.ruleIP),
+					pfx(net.ParseIP(tc.ruleIP)), fw.Network{},
 					fw.ProtocolALL,
 					nil,
 					nil,
-					fw.ActionAccept,
-					"",
-				)
+					fw.ActionAccept)
 				require.NoError(t, err)
-				require.NotEmpty(t, rules)
+				require.NotNil(t, rules)
 				t.Cleanup(func() {
-					for _, rule := range rules {
-						require.NoError(t, manager.DeletePeerRule(rule))
-					}
+					require.NoError(t, manager.DeleteFilterRule(rules))
 				})
 			}
 
-			rules, err := manager.AddPeerFiltering(
+			rules, err := manager.AddFilterRule(
 				nil,
-				net.ParseIP(tc.ruleIP),
+				pfx(net.ParseIP(tc.ruleIP)), fw.Network{},
 				tc.ruleProto,
 				tc.ruleSrcPort,
 				tc.ruleDstPort,
-				tc.ruleAction,
-				"",
-			)
+				tc.ruleAction)
 			require.NoError(t, err)
-			require.NotEmpty(t, rules)
+			require.NotNil(t, rules)
 
 			t.Cleanup(func() {
-				for _, rule := range rules {
-					require.NoError(t, manager.DeletePeerRule(rule))
-				}
+				require.NoError(t, manager.DeleteFilterRule(rules))
 			})
 
 			packet := createTestPacket(t, tc.srcIP, tc.dstIP, tc.proto, tc.srcPort, tc.dstPort)
@@ -557,7 +549,7 @@ func TestPeerACLFilteringIPv6(t *testing.T) {
 		},
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, manager.Close(nil)) })
 
@@ -652,14 +644,24 @@ func TestPeerACLFilteringIPv6(t *testing.T) {
 			shouldBeBlocked: false,
 		},
 		{
-			name:            "IPv6: v4 wildcard ICMP rule matches ICMPv6 via protoLayerMatches",
+			name:            "IPv6: v4 wildcard ICMP rule does not match ICMPv6",
 			srcIP:           "fd00::1",
 			dstIP:           "fd00::100",
 			proto:           fw.ProtocolICMP,
 			ruleIP:          "0.0.0.0",
 			ruleProto:       fw.ProtocolICMP,
 			ruleAction:      fw.ActionAccept,
-			shouldBeBlocked: false,
+			shouldBeBlocked: true,
+		},
+		{
+			name:            "IPv4: v6 wildcard ICMP rule does not match ICMPv4",
+			srcIP:           "100.10.0.1",
+			dstIP:           "100.10.0.100",
+			proto:           fw.ProtocolICMP,
+			ruleIP:          "::",
+			ruleProto:       fw.ProtocolICMP,
+			ruleAction:      fw.ActionAccept,
+			shouldBeBlocked: true,
 		},
 	}
 
@@ -672,22 +674,18 @@ func TestPeerACLFilteringIPv6(t *testing.T) {
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			if tc.ruleAction == fw.ActionDrop {
-				rules, err := manager.AddPeerFiltering(nil, net.ParseIP(tc.ruleIP), fw.ProtocolALL, nil, nil, fw.ActionAccept, "")
+				rules, err := manager.AddFilterRule(nil, pfx(net.ParseIP(tc.ruleIP)), fw.Network{}, fw.ProtocolALL, nil, nil, fw.ActionAccept)
 				require.NoError(t, err)
 				t.Cleanup(func() {
-					for _, rule := range rules {
-						require.NoError(t, manager.DeletePeerRule(rule))
-					}
+					require.NoError(t, manager.DeleteFilterRule(rules))
 				})
 			}
 
-			rules, err := manager.AddPeerFiltering(nil, net.ParseIP(tc.ruleIP), tc.ruleProto, nil, tc.ruleDstPort, tc.ruleAction, "")
+			rules, err := manager.AddFilterRule(nil, pfx(net.ParseIP(tc.ruleIP)), fw.Network{}, tc.ruleProto, nil, tc.ruleDstPort, tc.ruleAction)
 			require.NoError(t, err)
-			require.NotEmpty(t, rules)
+			require.NotNil(t, rules)
 			t.Cleanup(func() {
-				for _, rule := range rules {
-					require.NoError(t, manager.DeletePeerRule(rule))
-				}
+				require.NoError(t, manager.DeleteFilterRule(rules))
 			})
 
 			packet := createTestPacket(t, tc.srcIP, tc.dstIP, tc.proto, tc.srcPort, tc.dstPort)
@@ -800,7 +798,7 @@ func setupRoutedManager(tb testing.TB, network string) *Manager {
 		},
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(tb, err)
 	require.NoError(tb, manager.EnableRouting())
 	require.NotNil(tb, manager)
@@ -1405,7 +1403,7 @@ func TestRouteACLFiltering(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			if tc.rule.action == fw.ActionDrop {
 				// add general accept rule to test drop rule
-				rule, err := manager.AddRouteFiltering(
+				rule, err := manager.AddFilterRule(
 					nil,
 					[]netip.Prefix{netip.MustParsePrefix("0.0.0.0/0")},
 					fw.Network{Prefix: netip.MustParsePrefix("0.0.0.0/0")},
@@ -1415,13 +1413,13 @@ func TestRouteACLFiltering(t *testing.T) {
 					fw.ActionAccept,
 				)
 				require.NoError(t, err)
-				require.NotNil(t, rule)
+				require.NotEmpty(t, rule)
 				t.Cleanup(func() {
-					require.NoError(t, manager.DeleteRouteRule(rule))
+					require.NoError(t, manager.DeleteFilterRule(rule))
 				})
 			}
 
-			rule, err := manager.AddRouteFiltering(
+			rule, err := manager.AddFilterRule(
 				nil,
 				tc.rule.sources,
 				tc.rule.dest,
@@ -1431,10 +1429,10 @@ func TestRouteACLFiltering(t *testing.T) {
 				tc.rule.action,
 			)
 			require.NoError(t, err)
-			require.NotNil(t, rule)
+			require.NotEmpty(t, rule)
 
 			t.Cleanup(func() {
-				require.NoError(t, manager.DeleteRouteRule(rule))
+				require.NoError(t, manager.DeleteFilterRule(rule))
 			})
 
 			srcIP := netip.MustParseAddr(tc.srcIP)
@@ -1602,9 +1600,9 @@ func TestRouteACLOrder(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			var rules []fw.Rule
+			var addedRules []fw.Rule
 			for _, r := range tc.rules {
-				rule, err := manager.AddRouteFiltering(
+				rule, err := manager.AddFilterRule(
 					nil,
 					r.sources,
 					r.dest,
@@ -1615,12 +1613,12 @@ func TestRouteACLOrder(t *testing.T) {
 				)
 				require.NoError(t, err)
 				require.NotNil(t, rule)
-				rules = append(rules, rule)
+				addedRules = append(addedRules, rule)
 			}
 
 			t.Cleanup(func() {
-				for _, rule := range rules {
-					require.NoError(t, manager.DeleteRouteRule(rule))
+				for _, rule := range addedRules {
+					require.NoError(t, manager.DeleteFilterRule(rule))
 				}
 			})
 
@@ -1646,7 +1644,7 @@ func TestRouteACLSet(t *testing.T) {
 		},
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		require.NoError(t, manager.Close(nil))
@@ -1655,7 +1653,7 @@ func TestRouteACLSet(t *testing.T) {
 	set := fw.NewDomainSet(domain.List{"example.org"})
 
 	// Add rule that uses the set (initially empty)
-	rule, err := manager.AddRouteFiltering(
+	rule, err := manager.AddFilterRule(
 		nil,
 		[]netip.Prefix{netip.MustParsePrefix("0.0.0.0/0")},
 		fw.Network{Set: set},
@@ -1689,7 +1687,7 @@ func TestRouteACLFilteringIPv6(t *testing.T) {
 	manager := setupRoutedManager(t, "10.10.0.100/16")
 
 	v6Dst := netip.MustParsePrefix("fd00:dead:beef::/48")
-	_, err := manager.AddRouteFiltering(
+	_, err := manager.AddFilterRule(
 		nil,
 		[]netip.Prefix{netip.MustParsePrefix("fd00::/16")},
 		fw.Network{Prefix: v6Dst},
@@ -1700,7 +1698,7 @@ func TestRouteACLFilteringIPv6(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	_, err = manager.AddRouteFiltering(
+	_, err = manager.AddFilterRule(
 		nil,
 		[]netip.Prefix{netip.MustParsePrefix("fd00::/16")},
 		fw.Network{Prefix: netip.MustParsePrefix("fd00:dead:beef:1::/64")},
diff --git a/client/firewall/uspfilter/filter_routeacl_test.go b/client/firewall/uspfilter/filter_routeacl_test.go
index 449554d8b..2a0980e83 100644
--- a/client/firewall/uspfilter/filter_routeacl_test.go
+++ b/client/firewall/uspfilter/filter_routeacl_test.go
@@ -4,7 +4,7 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/google/gopacket/layers"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -29,7 +29,7 @@ func TestAddRouteFilteringReturnsExistingRule(t *testing.T) {
 	destination := fw.Network{Prefix: netip.MustParsePrefix("192.168.1.0/24")}
 
 	// Add rule first time
-	rule1, err := manager.AddRouteFiltering(
+	rule1, err := manager.AddFilterRule(
 		[]byte("policy-1"),
 		sources,
 		destination,
@@ -42,7 +42,7 @@ func TestAddRouteFilteringReturnsExistingRule(t *testing.T) {
 	require.NotNil(t, rule1)
 
 	// Add the same rule again
-	rule2, err := manager.AddRouteFiltering(
+	rule2, err := manager.AddFilterRule(
 		[]byte("policy-1"),
 		sources,
 		destination,
@@ -74,7 +74,7 @@ func TestAddRouteFilteringDifferentRulesGetDifferentIDs(t *testing.T) {
 	sources := []netip.Prefix{netip.MustParsePrefix("100.64.1.0/24")}
 
 	// Add first rule
-	rule1, err := manager.AddRouteFiltering(
+	rule1, err := manager.AddFilterRule(
 		[]byte("policy-1"),
 		sources,
 		fw.Network{Prefix: netip.MustParsePrefix("192.168.1.0/24")},
@@ -86,7 +86,7 @@ func TestAddRouteFilteringDifferentRulesGetDifferentIDs(t *testing.T) {
 	require.NoError(t, err)
 
 	// Add different rule (different destination)
-	rule2, err := manager.AddRouteFiltering(
+	rule2, err := manager.AddFilterRule(
 		[]byte("policy-2"),
 		sources,
 		fw.Network{Prefix: netip.MustParsePrefix("192.168.2.0/24")}, // Different!
@@ -115,7 +115,7 @@ func TestRouteRuleUpdateDoesNotCauseGap(t *testing.T) {
 	sources := []netip.Prefix{netip.MustParsePrefix("100.64.1.0/24")}
 	destination := fw.Network{Prefix: netip.MustParsePrefix("192.168.1.0/24")}
 
-	rule1, err := manager.AddRouteFiltering(
+	rule1, err := manager.AddFilterRule(
 		[]byte("policy-1"),
 		sources,
 		destination,
@@ -132,7 +132,7 @@ func TestRouteRuleUpdateDoesNotCauseGap(t *testing.T) {
 	require.True(t, pass, "Traffic should pass with rule in place")
 
 	// Re-add same rule (simulates network map update)
-	rule2, err := manager.AddRouteFiltering(
+	rule2, err := manager.AddFilterRule(
 		[]byte("policy-1"),
 		sources,
 		destination,
@@ -147,7 +147,7 @@ func TestRouteRuleUpdateDoesNotCauseGap(t *testing.T) {
 	// won't delete rule1 during cleanup. If IDs differed, deleting rule1
 	// would remove the only matching rule and cause a traffic gap.
 	if rule1.ID() != rule2.ID() {
-		err = manager.DeleteRouteRule(rule1)
+		err = manager.DeleteFilterRule(rule1)
 		require.NoError(t, err)
 	}
 
@@ -156,6 +156,59 @@ func TestRouteRuleUpdateDoesNotCauseGap(t *testing.T) {
 		"Traffic should still pass after rule update - no gap should occur")
 }
 
+// TestBlockInvalidRoutedDualStack verifies that when the interface has an
+// IPv6 overlay address, blockInvalidRouted installs a block rule for both
+// the v4 and v6 WG prefixes and that routed traffic to the v6 prefix is
+// denied. The v4-only soft-skip path is covered by
+// TestBlockInvalidRoutedIdempotent, whose mock leaves IPv6Net invalid.
+func TestBlockInvalidRoutedDualStack(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	dev := mocks.NewMockDevice(ctrl)
+	dev.EXPECT().MTU().Return(1500, nil).AnyTimes()
+
+	wgNet := netip.MustParsePrefix("100.64.0.1/16")
+	wgNet6 := netip.MustParsePrefix("fd00:1234::1/64")
+
+	ifaceMock := &IFaceMock{
+		SetFilterFunc: func(device.PacketFilter) error { return nil },
+		AddressFunc: func() wgaddr.Address {
+			return wgaddr.Address{
+				IP:      wgNet.Addr(),
+				Network: wgNet,
+				IPv6:    wgNet6.Addr(),
+				IPv6Net: wgNet6,
+			}
+		},
+		GetDeviceFunc: func() *device.FilteredDevice {
+			return &device.FilteredDevice{Device: dev}
+		},
+		GetWGDeviceFunc: func() *wgdevice.Device {
+			return &wgdevice.Device{}
+		},
+	}
+
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, manager.Close(nil))
+	})
+
+	rules, err := manager.blockInvalidRouted(ifaceMock)
+	require.NoError(t, err)
+	require.Len(t, rules, 2, "dual-stack interface must produce a v4 and a v6 block rule")
+
+	manager.mutex.RLock()
+	ruleCount := len(manager.routeRules)
+	manager.mutex.RUnlock()
+	assert.Equal(t, 2, ruleCount, "should have one block rule per family")
+
+	// v6 routed traffic to the WG prefix must be denied.
+	srcIP := netip.MustParseAddr("2001:db8::1")
+	dstIP := netip.MustParseAddr("fd00:1234::50")
+	_, pass := manager.routeACLsPass(srcIP, dstIP, layers.LayerTypeTCP, 12345, 80)
+	assert.False(t, pass, "block rule should deny routed traffic to the v6 WG prefix")
+}
+
 // TestBlockInvalidRoutedIdempotent verifies that blockInvalidRouted creates
 // exactly one drop rule for the WireGuard network prefix, and calling it again
 // returns the same rule without duplicating.
@@ -182,7 +235,7 @@ func TestBlockInvalidRoutedIdempotent(t *testing.T) {
 		},
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		require.NoError(t, manager.Close(nil))
@@ -245,7 +298,7 @@ func TestBlockRuleNotAccumulatedOnRepeatedEnableRouting(t *testing.T) {
 		},
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		require.NoError(t, manager.Close(nil))
@@ -274,7 +327,7 @@ func TestRouteRuleCountStableAcrossUpdates(t *testing.T) {
 
 	// Simulate 5 network map updates with the same route rule
 	for i := 0; i < 5; i++ {
-		rule, err := manager.AddRouteFiltering(
+		rule, err := manager.AddFilterRule(
 			[]byte("policy-1"),
 			sources,
 			destination,
@@ -304,7 +357,7 @@ func TestDeleteRouteRuleAfterIdempotentAdd(t *testing.T) {
 	destination := fw.Network{Prefix: netip.MustParsePrefix("192.168.1.0/24")}
 
 	// Add same rule twice
-	rule1, err := manager.AddRouteFiltering(
+	rule1, err := manager.AddFilterRule(
 		[]byte("policy-1"),
 		sources,
 		destination,
@@ -315,7 +368,7 @@ func TestDeleteRouteRuleAfterIdempotentAdd(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	rule2, err := manager.AddRouteFiltering(
+	rule2, err := manager.AddFilterRule(
 		[]byte("policy-1"),
 		sources,
 		destination,
@@ -329,7 +382,7 @@ func TestDeleteRouteRuleAfterIdempotentAdd(t *testing.T) {
 	require.Equal(t, rule1.ID(), rule2.ID(), "Should return same rule ID")
 
 	// Delete using first reference
-	err = manager.DeleteRouteRule(rule1)
+	err = manager.DeleteFilterRule(rule1)
 	require.NoError(t, err)
 
 	// Verify traffic no longer passes
@@ -364,7 +417,7 @@ func setupTestManager(t *testing.T) *Manager {
 		},
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	require.NoError(t, manager.EnableRouting())
 
diff --git a/client/firewall/uspfilter/filter_test.go b/client/firewall/uspfilter/filter_test.go
index f19c4bb56..280ce9311 100644
--- a/client/firewall/uspfilter/filter_test.go
+++ b/client/firewall/uspfilter/filter_test.go
@@ -78,18 +78,19 @@ func TestManagerCreate(t *testing.T) {
 		SetFilterFunc: func(device.PacketFilter) error { return nil },
 	}
 
-	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	if err != nil {
 		t.Errorf("failed to create Manager: %v", err)
 		return
 	}
+	t.Cleanup(func() { require.NoError(t, m.Close(nil)) })
 
 	if m == nil {
 		t.Error("Manager is nil")
 	}
 }
 
-func TestManagerAddPeerFiltering(t *testing.T) {
+func TestManagerAddFilterRule(t *testing.T) {
 	isSetFilterCalled := false
 	ifaceMock := &IFaceMock{
 		SetFilterFunc: func(device.PacketFilter) error {
@@ -98,18 +99,19 @@ func TestManagerAddPeerFiltering(t *testing.T) {
 		},
 	}
 
-	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	if err != nil {
 		t.Errorf("failed to create Manager: %v", err)
 		return
 	}
+	t.Cleanup(func() { require.NoError(t, m.Close(nil)) })
 
 	ip := net.ParseIP("192.168.1.1")
 	proto := fw.ProtocolTCP
 	port := &fw.Port{Values: []uint16{80}}
 	action := fw.ActionDrop
 
-	rule, err := m.AddPeerFiltering(nil, ip, proto, nil, port, action, "")
+	rule, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
 	if err != nil {
 		t.Errorf("failed to add filtering: %v", err)
 		return
@@ -131,74 +133,47 @@ func TestManagerDeleteRule(t *testing.T) {
 		SetFilterFunc: func(device.PacketFilter) error { return nil },
 	}
 
-	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	if err != nil {
 		t.Errorf("failed to create Manager: %v", err)
 		return
 	}
+	t.Cleanup(func() { require.NoError(t, m.Close(nil)) })
 
 	ip := netip.MustParseAddr("192.168.1.1")
 	proto := fw.ProtocolTCP
 	port := &fw.Port{Values: []uint16{80}}
 	action := fw.ActionDrop
 
-	rule2, err := m.AddPeerFiltering(nil, ip.AsSlice(), proto, nil, port, action, "")
+	rule2, err := m.AddFilterRule(nil, pfx(ip.AsSlice()), fw.Network{}, proto, nil, port, action)
 	if err != nil {
 		t.Errorf("failed to add filtering: %v", err)
 		return
 	}
 
-	// Check rules exist in appropriate maps
-	for _, r := range rule2 {
-		peerRule, ok := r.(*PeerRule)
-		if !ok {
-			t.Errorf("rule should be a PeerRule")
-			continue
-		}
-		// Check if rule exists in deny or allow maps based on action
-		var found bool
-		if peerRule.drop {
-			_, found = m.incomingDenyRules[ip][r.ID()]
-		} else {
-			_, found = m.incomingRules[ip][r.ID()]
-		}
-		if !found {
-			t.Errorf("rule2 is not in the expected rules map")
+	peerRule, ok := rule2.(*PeerRule)
+	require.True(t, ok, "rule should be a peer rule")
+
+	inMap := func() bool {
+		if peerRule.action == fw.ActionDrop {
+			return findRuleByID(m.incomingDenyRules, ip, rule2.ID())
 		}
+		return findRuleByID(m.incomingAcceptRules, ip, rule2.ID())
 	}
 
-	for _, r := range rule2 {
-		err = m.DeletePeerRule(r)
-		if err != nil {
-			t.Errorf("failed to delete rule: %v", err)
-			return
-		}
-	}
+	require.True(t, inMap(), "rule2 should be in the expected rules list")
 
-	// Check rules are removed from appropriate maps
-	for _, r := range rule2 {
-		peerRule, ok := r.(*PeerRule)
-		if !ok {
-			t.Errorf("rule should be a PeerRule")
-			continue
-		}
-		// Check if rule is removed from deny or allow maps based on action
-		var found bool
-		if peerRule.drop {
-			_, found = m.incomingDenyRules[ip][r.ID()]
-		} else {
-			_, found = m.incomingRules[ip][r.ID()]
-		}
-		if found {
-			t.Errorf("rule2 should be removed from the rules map")
-		}
-	}
+	require.NoError(t, m.DeleteFilterRule(rule2), "failed to delete rule")
+
+	require.False(t, inMap(), "rule2 should be removed from the rules list")
 }
 
 func TestSetUDPPacketHook(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, nbiface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, manager.Close(nil)) })
 
@@ -220,9 +195,11 @@ func TestSetUDPPacketHook(t *testing.T) {
 }
 
 func TestSetTCPPacketHook(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, nbiface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, manager.Close(nil)) })
 
@@ -250,7 +227,7 @@ func TestPeerRuleLifecycleDenyRules(t *testing.T) {
 		SetFilterFunc: func(device.PacketFilter) error { return nil },
 	}
 
-	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, m.Close(nil))
@@ -260,36 +237,34 @@ func TestPeerRuleLifecycleDenyRules(t *testing.T) {
 	addr := netip.MustParseAddr("192.168.1.1")
 
 	// Add multiple deny rules for different ports
-	rule1, err := m.AddPeerFiltering(nil, ip, fw.ProtocolTCP, nil,
-		&fw.Port{Values: []uint16{22}}, fw.ActionDrop, "")
+	rule1, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{22}}, fw.ActionDrop)
 	require.NoError(t, err)
 
-	rule2, err := m.AddPeerFiltering(nil, ip, fw.ProtocolTCP, nil,
-		&fw.Port{Values: []uint16{80}}, fw.ActionDrop, "")
+	rule2, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionDrop)
 	require.NoError(t, err)
 
 	m.mutex.RLock()
-	denyCount := len(m.incomingDenyRules[addr])
+	denyCount := countRulesForAddr(m.incomingDenyRules, addr)
 	m.mutex.RUnlock()
 	require.Equal(t, 2, denyCount, "Should have exactly 2 deny rules")
 
 	// Delete the first deny rule
-	err = m.DeletePeerRule(rule1[0])
+	err = m.DeleteFilterRule(rule1)
 	require.NoError(t, err)
 
 	m.mutex.RLock()
-	denyCount = len(m.incomingDenyRules[addr])
+	denyCount = countRulesForAddr(m.incomingDenyRules, addr)
 	m.mutex.RUnlock()
 	require.Equal(t, 1, denyCount, "Should have 1 deny rule after deleting first")
 
 	// Delete the second deny rule
-	err = m.DeletePeerRule(rule2[0])
+	err = m.DeleteFilterRule(rule2)
 	require.NoError(t, err)
 
 	m.mutex.RLock()
-	_, exists := m.incomingDenyRules[addr]
+	exists := countRulesForAddr(m.incomingDenyRules, addr) > 0
 	m.mutex.RUnlock()
-	require.False(t, exists, "Deny rules IP entry should be cleaned up when empty")
+	require.False(t, exists, "Deny rules should be cleaned up when empty")
 }
 
 // TestPeerRuleAddAndDeleteDontLeak verifies that repeatedly adding and deleting
@@ -299,7 +274,7 @@ func TestPeerRuleAddAndDeleteDontLeak(t *testing.T) {
 		SetFilterFunc: func(device.PacketFilter) error { return nil },
 	}
 
-	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, m.Close(nil))
@@ -311,27 +286,21 @@ func TestPeerRuleAddAndDeleteDontLeak(t *testing.T) {
 	// Simulate 10 network map updates: add rule, delete old, add new
 	for i := 0; i < 10; i++ {
 		// Add a deny rule
-		rules, err := m.AddPeerFiltering(nil, ip, fw.ProtocolTCP, nil,
-			&fw.Port{Values: []uint16{22}}, fw.ActionDrop, "")
+		rules, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{22}}, fw.ActionDrop)
 		require.NoError(t, err)
 
 		// Add an allow rule
-		allowRules, err := m.AddPeerFiltering(nil, ip, fw.ProtocolTCP, nil,
-			&fw.Port{Values: []uint16{80}}, fw.ActionAccept, "")
+		allowRules, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept)
 		require.NoError(t, err)
 
 		// Delete them (simulating ACL manager cleanup)
-		for _, r := range rules {
-			require.NoError(t, m.DeletePeerRule(r))
-		}
-		for _, r := range allowRules {
-			require.NoError(t, m.DeletePeerRule(r))
-		}
+		require.NoError(t, m.DeleteFilterRule(rules))
+		require.NoError(t, m.DeleteFilterRule(allowRules))
 	}
 
 	m.mutex.RLock()
-	denyCount := len(m.incomingDenyRules[addr])
-	allowCount := len(m.incomingRules[addr])
+	denyCount := countRulesForAddr(m.incomingDenyRules, addr)
+	allowCount := countRulesForAddr(m.incomingAcceptRules, addr)
 	m.mutex.RUnlock()
 
 	require.Equal(t, 0, denyCount, "No deny rules should remain after cleanup")
@@ -345,7 +314,7 @@ func TestMixedAllowDenyRulesSameIP(t *testing.T) {
 		SetFilterFunc: func(device.PacketFilter) error { return nil },
 	}
 
-	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, m.Close(nil))
@@ -354,41 +323,39 @@ func TestMixedAllowDenyRulesSameIP(t *testing.T) {
 	ip := net.ParseIP("192.168.1.1")
 
 	// Add allow rule for port 80
-	allowRule, err := m.AddPeerFiltering(nil, ip, fw.ProtocolTCP, nil,
-		&fw.Port{Values: []uint16{80}}, fw.ActionAccept, "")
+	allowRule, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept)
 	require.NoError(t, err)
 
 	// Add deny rule for port 22
-	denyRule, err := m.AddPeerFiltering(nil, ip, fw.ProtocolTCP, nil,
-		&fw.Port{Values: []uint16{22}}, fw.ActionDrop, "")
+	denyRule, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{22}}, fw.ActionDrop)
 	require.NoError(t, err)
 
 	addr := netip.MustParseAddr("192.168.1.1")
 	m.mutex.RLock()
-	allowCount := len(m.incomingRules[addr])
-	denyCount := len(m.incomingDenyRules[addr])
+	allowCount := countRulesForAddr(m.incomingAcceptRules, addr)
+	denyCount := countRulesForAddr(m.incomingDenyRules, addr)
 	m.mutex.RUnlock()
 
 	require.Equal(t, 1, allowCount, "Should have 1 allow rule")
 	require.Equal(t, 1, denyCount, "Should have 1 deny rule")
 
 	// Delete allow rule should not affect deny rule
-	err = m.DeletePeerRule(allowRule[0])
+	err = m.DeleteFilterRule(allowRule)
 	require.NoError(t, err)
 
 	m.mutex.RLock()
-	denyCountAfter := len(m.incomingDenyRules[addr])
+	denyCountAfter := countRulesForAddr(m.incomingDenyRules, addr)
 	m.mutex.RUnlock()
 
 	require.Equal(t, 1, denyCountAfter, "Deny rule should still exist after deleting allow rule")
 
 	// Delete deny rule
-	err = m.DeletePeerRule(denyRule[0])
+	err = m.DeleteFilterRule(denyRule)
 	require.NoError(t, err)
 
 	m.mutex.RLock()
-	_, denyExists := m.incomingDenyRules[addr]
-	_, allowExists := m.incomingRules[addr]
+	denyExists := countRulesForAddr(m.incomingDenyRules, addr) > 0
+	allowExists := countRulesForAddr(m.incomingAcceptRules, addr) > 0
 	m.mutex.RUnlock()
 
 	require.False(t, denyExists, "Deny rules should be empty")
@@ -400,7 +367,7 @@ func TestManagerReset(t *testing.T) {
 		SetFilterFunc: func(device.PacketFilter) error { return nil },
 	}
 
-	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	if err != nil {
 		t.Errorf("failed to create Manager: %v", err)
 		return
@@ -411,7 +378,7 @@ func TestManagerReset(t *testing.T) {
 	port := &fw.Port{Values: []uint16{80}}
 	action := fw.ActionDrop
 
-	_, err = m.AddPeerFiltering(nil, ip, proto, nil, port, action, "")
+	_, err = m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
 	if err != nil {
 		t.Errorf("failed to add filtering: %v", err)
 		return
@@ -423,7 +390,7 @@ func TestManagerReset(t *testing.T) {
 		return
 	}
 
-	if len(m.outgoingRules) != 0 || len(m.incomingRules) != 0 || len(m.incomingDenyRules) != 0 {
+	if len(m.incomingAcceptRules) != 0 || len(m.incomingDenyRules) != 0 {
 		t.Errorf("rules are not empty")
 	}
 }
@@ -439,7 +406,7 @@ func TestNotMatchByIP(t *testing.T) {
 		},
 	}
 
-	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	if err != nil {
 		t.Errorf("failed to create Manager: %v", err)
 		return
@@ -449,7 +416,7 @@ func TestNotMatchByIP(t *testing.T) {
 	proto := fw.ProtocolUDP
 	action := fw.ActionAccept
 
-	_, err = m.AddPeerFiltering(nil, ip, proto, nil, nil, action, "")
+	_, err = m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, nil, action)
 	if err != nil {
 		t.Errorf("failed to add filtering: %v", err)
 		return
@@ -502,7 +469,7 @@ func TestRemovePacketHook(t *testing.T) {
 	}
 
 	// creating manager instance
-	manager, err := Create(iface, false, flowLogger, nbiface.DefaultMTU)
+	manager, err := Create(Config{IFace: iface, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	if err != nil {
 		t.Fatalf("Failed to create Manager: %s", err)
 	}
@@ -519,9 +486,11 @@ func TestRemovePacketHook(t *testing.T) {
 }
 
 func TestProcessOutgoingHooks(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, nbiface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 
 	manager.udpTracker.Close()
@@ -606,7 +575,7 @@ func TestUSPFilterCreatePerformance(t *testing.T) {
 			ifaceMock := &IFaceMock{
 				SetFilterFunc: func(device.PacketFilter) error { return nil },
 			}
-			manager, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+			manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 			require.NoError(t, err)
 			time.Sleep(time.Second)
 
@@ -621,7 +590,7 @@ func TestUSPFilterCreatePerformance(t *testing.T) {
 			start := time.Now()
 			for i := 0; i < testMax; i++ {
 				port := &fw.Port{Values: []uint16{uint16(1000 + i)}}
-				_, err = manager.AddPeerFiltering(nil, ip, "tcp", nil, port, fw.ActionAccept, "")
+				_, err = manager.AddFilterRule(nil, pfx(ip), fw.Network{}, "tcp", nil, port, fw.ActionAccept)
 
 				require.NoError(t, err, "failed to add rule")
 			}
@@ -631,9 +600,11 @@ func TestUSPFilterCreatePerformance(t *testing.T) {
 }
 
 func TestStatefulFirewall_UDPTracking(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, nbiface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 
 	manager.udpTracker.Close() // Close the existing tracker
@@ -845,7 +816,7 @@ func TestUpdateSetMerge(t *testing.T) {
 		SetFilterFunc: func(device.PacketFilter) error { return nil },
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		require.NoError(t, manager.Close(nil))
@@ -858,7 +829,7 @@ func TestUpdateSetMerge(t *testing.T) {
 		netip.MustParsePrefix("192.168.1.0/24"),
 	}
 
-	rule, err := manager.AddRouteFiltering(
+	rule, err := manager.AddFilterRule(
 		nil,
 		[]netip.Prefix{netip.MustParsePrefix("0.0.0.0/0")},
 		fw.Network{Set: set},
@@ -931,7 +902,7 @@ func TestUpdateSetDeduplication(t *testing.T) {
 		SetFilterFunc: func(device.PacketFilter) error { return nil },
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		require.NoError(t, manager.Close(nil))
@@ -939,7 +910,7 @@ func TestUpdateSetDeduplication(t *testing.T) {
 
 	set := fw.NewDomainSet(domain.List{"example.org"})
 
-	rule, err := manager.AddRouteFiltering(
+	rule, err := manager.AddFilterRule(
 		nil,
 		[]netip.Prefix{netip.MustParsePrefix("0.0.0.0/0")},
 		fw.Network{Set: set},
@@ -1051,7 +1022,7 @@ func TestMSSClamping(t *testing.T) {
 		},
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, 1280)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: 1280})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, manager.Close(nil))
@@ -1243,7 +1214,7 @@ func TestShouldForward(t *testing.T) {
 		return wgaddr.Address{IP: wgIP, Network: netip.PrefixFrom(wgIP, 24)}
 	}
 
-	manager, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	manager, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, manager.Close(nil))
@@ -1358,7 +1329,7 @@ func TestShouldForward(t *testing.T) {
 
 	// Re-create manager to pick up the new address with IPv6
 	require.NoError(t, manager.Close(nil))
-	manager, err = Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	manager, err = Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
 	require.NoError(t, err)
 
 	v6Cases := []struct {
diff --git a/client/firewall/uspfilter/forwarder/forwarder.go b/client/firewall/uspfilter/forwarder/forwarder.go
index 6291eb285..7308b38bd 100644
--- a/client/firewall/uspfilter/forwarder/forwarder.go
+++ b/client/firewall/uspfilter/forwarder/forwarder.go
@@ -5,11 +5,14 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
+	"os"
 	"runtime"
+	"strconv"
 	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	wgdevice "golang.zx2c4.com/wireguard/device"
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
@@ -20,9 +23,9 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
 
-	"github.com/netbirdio/netbird/client/firewall/uspfilter/common"
 	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
 	nblog "github.com/netbirdio/netbird/client/firewall/uspfilter/log"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 )
 
@@ -31,8 +34,19 @@ const (
 	defaultMaxInFlight   = 1024
 	iosReceiveWindow     = 16384
 	iosMaxInFlight       = 256
+
+	// envForceTCPRACK overrides the platform default for gVisor's RACK loss
+	// detection. Set to a truthy value to force RACK on, or a falsy value to
+	// force it off, on any platform.
+	envForceTCPRACK = "NB_FORCE_TCP_RACK"
 )
 
+// IFace provides the WireGuard device and overlay addresses the forwarder needs.
+type IFace interface {
+	GetWGDevice() *wgdevice.Device
+	Address() wgaddr.Address
+}
+
 type Forwarder struct {
 	logger     *nblog.Logger
 	flowLogger nftypes.FlowLogger
@@ -51,7 +65,7 @@ type Forwarder struct {
 	pingSemaphore      chan struct{}
 }
 
-func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.FlowLogger, netstack bool, mtu uint16) (*Forwarder, error) {
+func New(iface IFace, logger *nblog.Logger, flowLogger nftypes.FlowLogger, netstack bool, mtu uint16) (*Forwarder, error) {
 	s := stack.New(stack.Options{
 		NetworkProtocols: []stack.NetworkProtocolFactory{
 			ipv4.NewProtocol,
@@ -152,6 +166,8 @@ func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.Flow
 		maxInFlight = iosMaxInFlight
 	}
 
+	configureTCPRecovery(s)
+
 	tcpForwarder := tcp.NewForwarder(s, receiveWindow, maxInFlight, f.handleTCP)
 	s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
 
@@ -466,3 +482,31 @@ func probeRawICMP(network, addr string, logger *nblog.Logger) bool {
 	logger.Debug1("forwarder: raw %s socket access available", network)
 	return true
 }
+
+// configureTCPRecovery disables gVisor's RACK loss detection on Windows, where
+// it interacts poorly with the host and collapses throughput on routed TCP
+// connections (gVisor issue #9778). Other platforms keep the default. The
+// EnvForceTCPRACK environment variable overrides the platform default.
+func configureTCPRecovery(s *stack.Stack) {
+	disableRACK := runtime.GOOS == "windows"
+
+	if val := os.Getenv(envForceTCPRACK); val != "" {
+		force, err := strconv.ParseBool(val)
+		if err != nil {
+			log.Warnf("parse %s: %v", envForceTCPRACK, err)
+		} else {
+			disableRACK = !force
+		}
+	}
+
+	if !disableRACK {
+		return
+	}
+
+	opt := tcpip.TCPRecovery(0)
+	if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
+		log.Warnf("disable TCP RACK loss detection: %v", err)
+		return
+	}
+	log.Info("forwarder: TCP RACK loss detection disabled")
+}
diff --git a/client/firewall/uspfilter/fragment.go b/client/firewall/uspfilter/fragment.go
new file mode 100644
index 000000000..accc54365
--- /dev/null
+++ b/client/firewall/uspfilter/fragment.go
@@ -0,0 +1,204 @@
+package uspfilter
+
+import (
+	"context"
+	"net/netip"
+	"os"
+	"strconv"
+	"sync"
+	"time"
+
+	nblog "github.com/netbirdio/netbird/client/firewall/uspfilter/log"
+)
+
+const (
+	// defaultFragmentTimeout bounds how long a first-fragment verdict is kept
+	// while the remaining fragments arrive. It mirrors the Linux IP reassembly
+	// timeout (net.ipv4.ipfrag_time).
+	defaultFragmentTimeout = 30 * time.Second
+	// fragmentCleanupInterval is how often expired verdicts are purged.
+	fragmentCleanupInterval = 10 * time.Second
+	// defaultMaxFragmentEntries caps the number of concurrently tracked
+	// fragmented datagrams. The table stays bounded because each datagram is a
+	// single small entry regardless of how many fragments it is split into, and
+	// the 13-bit IPv4 fragment-offset field limits any datagram to 64 KiB.
+	defaultMaxFragmentEntries = 16384
+
+	// EnvFragmentMaxEntries overrides defaultMaxFragmentEntries.
+	EnvFragmentMaxEntries = "NB_FRAGMENT_MAX_ENTRIES"
+)
+
+// fragmentVerdict is the decision for a trailing (headerless) fragment.
+type fragmentVerdict int
+
+const (
+	// fragmentDeny drops the fragment: no allowed first fragment is on record.
+	fragmentDeny fragmentVerdict = iota
+	// fragmentAllow passes the fragment: it belongs to an allowed datagram and
+	// does not overlap the already-inspected transport header.
+	fragmentAllow
+	// fragmentOverlap drops the fragment and poisons its datagram: it overlaps
+	// the transport header the ACL inspected (RFC 1858 §4, RFC 3128; RFC 5722
+	// requires discarding the whole datagram on overlap for IPv6).
+	fragmentOverlap
+)
+
+// fragmentKey identifies a fragmented datagram. It matches the RFC 791 / RFC
+// 8200 reassembly key: source, destination, protocol and identification. The id
+// is 32-bit to hold both the IPv4 (16-bit) and IPv6 (32-bit) identification.
+type fragmentKey struct {
+	srcIP netip.Addr
+	dstIP netip.Addr
+	id    uint32
+	proto uint8
+}
+
+// fragmentEntry records the verdict of an allowed first fragment.
+type fragmentEntry struct {
+	// headerEndOctets is the offset, in 8-byte units, at which the first
+	// fragment's payload ended. A trailing fragment starting before this
+	// overlaps bytes the ACL already inspected and is rejected.
+	headerEndOctets uint16
+	// recordedAt is when the first fragment was accepted. The verdict expires a
+	// fixed timeout later and is not refreshed, mirroring the kernel reassembly
+	// timer so a trailing-fragment flood can't keep a datagram alive.
+	recordedAt time.Time
+}
+
+// fragmentTracker records the ACL verdict of a datagram's first fragment so the
+// remaining fragments, which carry no L4 header, can inherit the decision
+// without reassembling the datagram. Only allowed first fragments are stored;
+// anything that cannot be tied to an allowed, non-overlapping first fragment is
+// dropped (fail closed).
+type fragmentTracker struct {
+	logger  *nblog.Logger
+	mutex   sync.Mutex
+	entries map[fragmentKey]fragmentEntry
+	timeout time.Duration
+	// maxEntries caps the table; atCapacity dedups the capacity warning until
+	// the table drains below the cap again.
+	maxEntries    int
+	atCapacity    bool
+	cleanupTicker *time.Ticker
+	cancel        context.CancelFunc
+}
+
+func newFragmentTracker(logger *nblog.Logger) *fragmentTracker {
+	ctx, cancel := context.WithCancel(context.Background())
+	t := &fragmentTracker{
+		logger:        logger,
+		entries:       make(map[fragmentKey]fragmentEntry),
+		timeout:       defaultFragmentTimeout,
+		maxEntries:    fragmentMaxEntries(logger),
+		cleanupTicker: time.NewTicker(fragmentCleanupInterval),
+		cancel:        cancel,
+	}
+	go t.cleanupRoutine(ctx)
+	return t
+}
+
+func fragmentMaxEntries(logger *nblog.Logger) int {
+	v := os.Getenv(EnvFragmentMaxEntries)
+	if v == "" {
+		return defaultMaxFragmentEntries
+	}
+	n, err := strconv.Atoi(v)
+	if err != nil || n <= 0 {
+		logger.Warn2("invalid %s=%q, using default", EnvFragmentMaxEntries, v)
+		return defaultMaxFragmentEntries
+	}
+	return n
+}
+
+// recordAllowed stores the verdict of an allowed first fragment. headerEndOctets
+// is the first fragment's payload length in 8-byte units. When the table is full
+// the record is dropped, which fails closed: the datagram's trailing fragments
+// will be denied.
+func (t *fragmentTracker) recordAllowed(key fragmentKey, headerEndOctets uint16) {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	if t.entries == nil {
+		return
+	}
+	if _, ok := t.entries[key]; !ok && len(t.entries) >= t.maxEntries {
+		if !t.atCapacity {
+			t.atCapacity = true
+			t.logger.Warn2("fragment verdict table at capacity (%d/%d): trailing fragments of new datagrams will be dropped",
+				len(t.entries), t.maxEntries)
+		}
+		return
+	}
+	t.entries[key] = fragmentEntry{
+		headerEndOctets: headerEndOctets,
+		recordedAt:      time.Now(),
+	}
+}
+
+// poison drops any recorded verdict for a datagram, so its later fragments are
+// denied until a new allowed first fragment is recorded. Called on every
+// offset-zero fragment to defeat offset-zero overlap rewrites (RFC 3128).
+func (t *fragmentTracker) poison(key fragmentKey) {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+	delete(t.entries, key)
+}
+
+// verdict decides the fate of a trailing fragment at fragOffsetOctets (the IPv4
+// fragment offset, in 8-byte units). A fragment overlapping the inspected
+// header poisons the datagram: the entry is removed so all further fragments of
+// that datagram are denied too.
+func (t *fragmentTracker) verdict(key fragmentKey, fragOffsetOctets uint16) fragmentVerdict {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	entry, ok := t.entries[key]
+	if !ok {
+		return fragmentDeny
+	}
+	if time.Since(entry.recordedAt) > t.timeout {
+		delete(t.entries, key)
+		return fragmentDeny
+	}
+	if fragOffsetOctets < entry.headerEndOctets {
+		delete(t.entries, key)
+		return fragmentOverlap
+	}
+	return fragmentAllow
+}
+
+func (t *fragmentTracker) cleanupRoutine(ctx context.Context) {
+	defer t.cleanupTicker.Stop()
+	for {
+		select {
+		case <-t.cleanupTicker.C:
+			t.cleanup()
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+func (t *fragmentTracker) cleanup() {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	for key, entry := range t.entries {
+		if time.Since(entry.recordedAt) > t.timeout {
+			delete(t.entries, key)
+		}
+	}
+
+	if len(t.entries) < t.maxEntries {
+		t.atCapacity = false
+	}
+}
+
+// Close stops the cleanup routine and releases resources.
+func (t *fragmentTracker) Close() {
+	t.cancel()
+
+	t.mutex.Lock()
+	t.entries = nil
+	t.mutex.Unlock()
+}
diff --git a/client/firewall/uspfilter/fragment_bench_test.go b/client/firewall/uspfilter/fragment_bench_test.go
new file mode 100644
index 000000000..a9e6d2d13
--- /dev/null
+++ b/client/firewall/uspfilter/fragment_bench_test.go
@@ -0,0 +1,115 @@
+package uspfilter
+
+import (
+	"encoding/binary"
+	"testing"
+)
+
+// benchFilterInbound drives filterInbound over a fixed packet in a tight loop.
+// Packets are built once, outside the timed region, so the benchmark measures
+// only pipeline cost, which is what an attacker can amplify.
+func benchFilterInbound(b *testing.B, pkt []byte) {
+	b.Helper()
+	b.ReportAllocs()
+	b.SetBytes(int64(len(pkt)))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		m := benchManager
+		m.filterInbound(pkt, len(pkt))
+	}
+}
+
+// benchManager is a package-level manager reused across fragment benchmarks so
+// setup cost stays out of the timed region.
+var benchManager *Manager
+
+func setupBenchManager(b *testing.B) *Manager {
+	b.Helper()
+	m := newFragmentTestManager(b)
+	allowUDP(b, m, 8080)
+	// Disable conntrack so the allowed-first-fragment path measures transport
+	// decode + ACL every iteration instead of matching the connection tracked
+	// on the first iteration.
+	m.stateful = false
+	benchManager = m
+	return m
+}
+
+// BenchmarkInbound_NormalPacket is the baseline: a full, non-fragmented UDP
+// packet that passes the ACL. Fragment paths should stay comparable to this.
+func BenchmarkInbound_NormalPacket(b *testing.B) {
+	setupBenchManager(b)
+	pkt := normalUDPPacket(b, 8080, 32)
+	benchFilterInbound(b, pkt)
+}
+
+// BenchmarkInbound_FirstFragmentAllowed measures the first-fragment path:
+// transport decode + ACL evaluation + verdict record.
+func BenchmarkInbound_FirstFragmentAllowed(b *testing.B) {
+	setupBenchManager(b)
+	pkt := firstFragmentUDP(b, 0x2000, 8080, 32)
+	benchFilterInbound(b, pkt)
+}
+
+// BenchmarkInbound_TrailingFragmentAllowed measures the common trailing-fragment
+// path: a single map lookup after the first fragment is on record.
+func BenchmarkInbound_TrailingFragmentAllowed(b *testing.B) {
+	m := setupBenchManager(b)
+	first := firstFragmentUDP(b, 0x3000, 8080, 32)
+	m.filterInbound(first, len(first))
+	pkt := trailingFragment(b, 0x3000, 5, false, 24)
+	benchFilterInbound(b, pkt)
+}
+
+// BenchmarkInbound_TrailingFragmentNoFirst is the primary DoS vector: an
+// attacker floods trailing fragments with no first fragment on record. Each is
+// a map miss and must be cheap.
+func BenchmarkInbound_TrailingFragmentNoFirst(b *testing.B) {
+	setupBenchManager(b)
+	pkt := trailingFragment(b, 0x4000, 185, false, 40)
+	benchFilterInbound(b, pkt)
+}
+
+// BenchmarkInbound_TinyFirstFragment measures the tiny-fragment drop path: a
+// first fragment too small to decode a transport header.
+func BenchmarkInbound_TinyFirstFragment(b *testing.B) {
+	setupBenchManager(b)
+	pkt := trailingFragment(b, 0x5000, 0, true, 4)
+	benchFilterInbound(b, pkt)
+}
+
+// BenchmarkInbound_TrailingFragmentDistinctIDs is the worst case for the
+// verdict table: an attacker varies the datagram id on every packet so no first
+// fragment ever matches. Verdict lookups always miss and nothing is recorded,
+// so the table cannot grow. Each iteration rewrites the id field in place.
+func BenchmarkInbound_TrailingFragmentDistinctIDs(b *testing.B) {
+	setupBenchManager(b)
+	pkt := trailingFragment(b, 0x6000, 185, false, 40)
+	m := benchManager
+
+	b.ReportAllocs()
+	b.SetBytes(int64(len(pkt)))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		// IPv4 identification field is at bytes 4:6.
+		binary.BigEndian.PutUint16(pkt[4:6], uint16(i))
+		m.filterInbound(pkt, len(pkt))
+	}
+}
+
+// BenchmarkInbound_FirstFragmentDistinctIDs measures sustained first-fragment
+// pressure with distinct ids: transport decode + ACL + verdict insert until the
+// table caps, exercising the map growth and capacity guard.
+func BenchmarkInbound_FirstFragmentDistinctIDs(b *testing.B) {
+	setupBenchManager(b)
+	pkt := firstFragmentUDP(b, 0x7000, 8080, 32)
+	m := benchManager
+
+	b.ReportAllocs()
+	b.SetBytes(int64(len(pkt)))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		binary.BigEndian.PutUint16(pkt[4:6], uint16(i))
+		m.filterInbound(pkt, len(pkt))
+	}
+}
diff --git a/client/firewall/uspfilter/fragment_test.go b/client/firewall/uspfilter/fragment_test.go
new file mode 100644
index 000000000..8f99864be
--- /dev/null
+++ b/client/firewall/uspfilter/fragment_test.go
@@ -0,0 +1,554 @@
+package uspfilter
+
+import (
+	"encoding/binary"
+	"net"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+	"github.com/stretchr/testify/require"
+
+	fw "github.com/netbirdio/netbird/client/firewall/manager"
+	nbiface "github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/device"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+)
+
+const (
+	fragTestSrc   = "100.10.0.1"
+	fragTestDst   = "100.10.0.100"
+	fragTestSrcV6 = "fd00::1"
+	fragTestDstV6 = "fd00::100"
+)
+
+func newFragmentTestManager(tb testing.TB) *Manager {
+	tb.Helper()
+
+	ifaceMock := &IFaceMock{
+		SetFilterFunc: func(device.PacketFilter) error { return nil },
+		AddressFunc: func() wgaddr.Address {
+			return wgaddr.Address{
+				IP:      netip.MustParseAddr(fragTestDst),
+				Network: netip.MustParsePrefix("100.10.0.0/16"),
+				IPv6:    netip.MustParseAddr(fragTestDstV6),
+				IPv6Net: netip.MustParsePrefix("fd00::/64"),
+			}
+		},
+	}
+
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
+	require.NoError(tb, err)
+	require.NoError(tb, m.UpdateLocalIPs())
+	tb.Cleanup(func() { require.NoError(tb, m.Close(nil)) })
+	return m
+}
+
+// firstFragmentUDPTo builds the first fragment of a fragmented UDP datagram to
+// the given destination: it carries the full UDP header plus payloadLen bytes
+// of data, with the More Fragments flag set and offset zero.
+func firstFragmentUDPTo(tb testing.TB, dst string, id uint16, dstPort uint16, payloadLen int) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv4{
+		Version:  4,
+		TTL:      64,
+		Id:       id,
+		Protocol: layers.IPProtocolUDP,
+		SrcIP:    net.ParseIP(fragTestSrc),
+		DstIP:    net.ParseIP(dst),
+		Flags:    layers.IPv4MoreFragments,
+	}
+	udp := &layers.UDP{SrcPort: 40000, DstPort: layers.UDPPort(dstPort)}
+	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
+	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, payloadLen))))
+	return buf.Bytes()
+}
+
+func firstFragmentUDP(tb testing.TB, id uint16, dstPort uint16, payloadLen int) []byte {
+	tb.Helper()
+	return firstFragmentUDPTo(tb, fragTestDst, id, dstPort, payloadLen)
+}
+
+// firstFragmentTCP builds the first fragment of a fragmented TCP datagram: the
+// full 20-byte TCP header plus 12 bytes of data, with the More Fragments flag
+// set and offset zero.
+func firstFragmentTCP(tb testing.TB, id uint16, dstPort uint16) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv4{
+		Version:  4,
+		TTL:      64,
+		Id:       id,
+		Protocol: layers.IPProtocolTCP,
+		SrcIP:    net.ParseIP(fragTestSrc),
+		DstIP:    net.ParseIP(fragTestDst),
+		Flags:    layers.IPv4MoreFragments,
+	}
+	tcp := &layers.TCP{SrcPort: 40000, DstPort: layers.TCPPort(dstPort), SYN: true, Window: 64240}
+	require.NoError(tb, tcp.SetNetworkLayerForChecksum(ip))
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
+	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, tcp, gopacket.Payload(make([]byte, 12))))
+	return buf.Bytes()
+}
+
+// trailingFragmentTo builds a non-first fragment to the given destination: an
+// IPv4 header at the given fragment offset (in 8-byte units) carrying raw
+// payload and no L4 header.
+func trailingFragmentTo(tb testing.TB, dst string, proto layers.IPProtocol, id uint16, fragOffsetOctets uint16, moreFragments bool, payloadLen int) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv4{
+		Version:    4,
+		TTL:        64,
+		Id:         id,
+		Protocol:   proto,
+		SrcIP:      net.ParseIP(fragTestSrc),
+		DstIP:      net.ParseIP(dst),
+		FragOffset: fragOffsetOctets,
+	}
+	if moreFragments {
+		ip.Flags = layers.IPv4MoreFragments
+	}
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{FixLengths: true}
+	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, gopacket.Payload(make([]byte, payloadLen))))
+	return buf.Bytes()
+}
+
+func trailingFragment(tb testing.TB, id uint16, fragOffsetOctets uint16, moreFragments bool, payloadLen int) []byte {
+	tb.Helper()
+	return trailingFragmentTo(tb, fragTestDst, layers.IPProtocolUDP, id, fragOffsetOctets, moreFragments, payloadLen)
+}
+
+// outboundUDPPacket builds a complete outbound UDP packet from the local
+// address, used to establish conntrack state for reply-direction tests.
+func outboundUDPPacket(tb testing.TB, srcPort, dstPort uint16) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv4{
+		Version:  4,
+		TTL:      64,
+		Id:       1,
+		Protocol: layers.IPProtocolUDP,
+		SrcIP:    net.ParseIP(fragTestDst),
+		DstIP:    net.ParseIP(fragTestSrc),
+	}
+	udp := &layers.UDP{SrcPort: layers.UDPPort(srcPort), DstPort: layers.UDPPort(dstPort)}
+	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
+	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, 16))))
+	return buf.Bytes()
+}
+
+// normalUDPPacket builds a complete, non-fragmented UDP packet for baseline
+// comparisons against the fragment paths.
+func normalUDPPacket(tb testing.TB, dstPort uint16, payloadLen int) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv4{
+		Version:  4,
+		TTL:      64,
+		Id:       1,
+		Protocol: layers.IPProtocolUDP,
+		SrcIP:    net.ParseIP(fragTestSrc),
+		DstIP:    net.ParseIP(fragTestDst),
+	}
+	udp := &layers.UDP{SrcPort: 40000, DstPort: layers.UDPPort(dstPort)}
+	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
+	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, payloadLen))))
+	return buf.Bytes()
+}
+
+func allowUDP(tb testing.TB, m *Manager, dstPort uint16) {
+	tb.Helper()
+	_, err := m.AddFilterRule(nil, pfx(net.ParseIP(fragTestSrc)), fw.Network{}, fw.ProtocolUDP, nil,
+		&fw.Port{Values: []uint16{dstPort}}, fw.ActionAccept)
+	require.NoError(tb, err)
+}
+
+// TestFragment_TrailingWithoutFirstDropped is the core bypass repro: a trailing
+// fragment with no allowed first fragment on record must be dropped. Before the
+// fix, filterInbound returned false (allow) for any fragment.
+func TestFragment_TrailingWithoutFirstDropped(t *testing.T) {
+	m := newFragmentTestManager(t)
+
+	frag := trailingFragment(t, 0x1234, 185, false, 40)
+	require.True(t, m.filterInbound(frag, len(frag)),
+		"trailing fragment without an allowed first fragment must be dropped")
+}
+
+// TestFragment_AllowedFirstPassesTrailing verifies that once a first fragment
+// passes the ACL, its trailing fragments inherit the allow verdict.
+func TestFragment_AllowedFirstPassesTrailing(t *testing.T) {
+	m := newFragmentTestManager(t)
+	allowUDP(t, m, 8080)
+
+	// First fragment: UDP header (8) + 32 payload = 40 octets -> headerEnd = 5.
+	first := firstFragmentUDP(t, 0x2222, 8080, 32)
+	require.False(t, m.filterInbound(first, len(first)),
+		"allowed first fragment should pass and be recorded")
+
+	trailing := trailingFragment(t, 0x2222, 5, false, 24)
+	require.False(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of an allowed datagram should pass")
+}
+
+// TestFragment_DeniedFirstDropsTrailing verifies that a first fragment blocked
+// by the ACL leaves no verdict, so its trailing fragments are dropped.
+func TestFragment_DeniedFirstDropsTrailing(t *testing.T) {
+	m := newFragmentTestManager(t)
+	// No accept rule: local traffic defaults to deny.
+
+	first := firstFragmentUDP(t, 0x3333, 9999, 32)
+	require.True(t, m.filterInbound(first, len(first)),
+		"first fragment to a blocked port should be dropped by the ACL")
+
+	trailing := trailingFragment(t, 0x3333, 5, false, 24)
+	require.True(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of a denied datagram must be dropped")
+}
+
+// TestFragment_OverlappingHeaderDropped covers the RFC 1858 §4 / RFC 3128
+// overlapping-fragment rewrite: a trailing fragment starting inside the range
+// the ACL already inspected is dropped and poisons the datagram. TCP is used so
+// the overlap lands on real header bytes (the flags at byte 13).
+func TestFragment_OverlappingHeaderDropped(t *testing.T) {
+	m := newFragmentTestManager(t)
+	_, err := m.AddFilterRule(nil, pfx(net.ParseIP(fragTestSrc)), fw.Network{}, fw.ProtocolTCP, nil,
+		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept)
+	require.NoError(t, err)
+
+	// First fragment: TCP header (20) + 12 data = 32 bytes -> headerEnd = 4 octets.
+	first := firstFragmentTCP(t, 0x4444, 8080)
+	require.False(t, m.filterInbound(first, len(first)))
+
+	// Overlapping fragment at offset 1 (byte 8) falls inside the inspected TCP
+	// header, so it could rewrite the flags or port on reassembly.
+	overlap := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x4444, 1, true, 32)
+	require.True(t, m.filterInbound(overlap, len(overlap)),
+		"fragment overlapping the inspected header must be dropped")
+
+	// The datagram is now poisoned: a later, non-overlapping fragment is also
+	// dropped because the verdict was removed.
+	later := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x4444, 4, false, 24)
+	require.True(t, m.filterInbound(later, len(later)),
+		"fragments after an overlap must be dropped (datagram poisoned)")
+}
+
+// TestFragment_OffsetZeroOverlapPoisons covers the RFC 3128 offset-zero rewrite:
+// an allowed first fragment followed by a denied offset-zero fragment for the
+// same datagram must not leave the earlier allow verdict in place.
+func TestFragment_OffsetZeroOverlapPoisons(t *testing.T) {
+	m := newFragmentTestManager(t)
+	allowUDP(t, m, 8080)
+
+	allowed := firstFragmentUDP(t, 0x5A5A, 8080, 32)
+	require.False(t, m.filterInbound(allowed, len(allowed)),
+		"allowed first fragment should pass and be recorded")
+
+	// A second offset-zero fragment to a denied port supersedes the datagram's
+	// verdict; it is dropped and must not leave the allow in place.
+	denied := firstFragmentUDP(t, 0x5A5A, 9999, 32)
+	require.True(t, m.filterInbound(denied, len(denied)),
+		"denied offset-zero fragment must be dropped")
+
+	trailing := trailingFragment(t, 0x5A5A, 5, false, 24)
+	require.True(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment must be denied after the datagram was poisoned")
+}
+
+// TestFragment_TinyFirstDropped covers the tiny-fragment attack: a first
+// fragment too small to contain the full transport header can't be
+// ACL-evaluated and must be dropped.
+func TestFragment_TinyFirstDropped(t *testing.T) {
+	m := newFragmentTestManager(t)
+	allowUDP(t, m, 8080)
+
+	// IPv4 header + 4 raw bytes, MF set, offset 0: too small for the 8-byte UDP
+	// header, so it decodes to L3 only.
+	tiny := trailingFragment(t, 0x5555, 0, true, 4)
+	require.True(t, m.filterInbound(tiny, len(tiny)),
+		"tiny first fragment without a full L4 header must be dropped")
+}
+
+// TestFragment_TCPFirstFragment verifies the TCP arm of the transport decode: a
+// first fragment carrying the full 20-byte TCP header is ACL-evaluated and its
+// trailing fragments inherit the verdict.
+func TestFragment_TCPFirstFragment(t *testing.T) {
+	m := newFragmentTestManager(t)
+	_, err := m.AddFilterRule(nil, pfx(net.ParseIP(fragTestSrc)), fw.Network{}, fw.ProtocolTCP, nil,
+		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept)
+	require.NoError(t, err)
+
+	// TCP header (20) + 12 data = 32 bytes -> headerEnd = 4 octets.
+	first := firstFragmentTCP(t, 0x6666, 8080)
+	require.False(t, m.filterInbound(first, len(first)),
+		"allowed TCP first fragment should pass and be recorded")
+
+	trailing := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x6666, 4, false, 24)
+	require.False(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of an allowed TCP datagram should pass")
+}
+
+// TestFragment_TCPTinyFirstDropped verifies the TCP minimum header length: 12
+// bytes would satisfy a UDP header but falls short of the 20-byte TCP header.
+func TestFragment_TCPTinyFirstDropped(t *testing.T) {
+	m := newFragmentTestManager(t)
+	_, err := m.AddFilterRule(nil, pfx(net.ParseIP(fragTestSrc)), fw.Network{}, fw.ProtocolTCP, nil,
+		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept)
+	require.NoError(t, err)
+
+	tiny := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x7777, 0, true, 12)
+	require.True(t, m.filterInbound(tiny, len(tiny)),
+		"first fragment shorter than the TCP header must be dropped")
+}
+
+// TestFragment_ConntrackAllowsFirstFragment verifies the conntrack branch: reply
+// fragments of an outbound-established UDP flow pass without any inbound rule.
+func TestFragment_ConntrackAllowsFirstFragment(t *testing.T) {
+	m := newFragmentTestManager(t)
+
+	out := outboundUDPPacket(t, 12345, 40000)
+	require.False(t, m.filterOutbound(out, len(out)))
+
+	first := firstFragmentUDP(t, 0x8888, 12345, 32)
+	require.False(t, m.filterInbound(first, len(first)),
+		"reply first fragment should pass via conntrack")
+
+	trailing := trailingFragment(t, 0x8888, 5, false, 24)
+	require.False(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of a tracked flow should pass")
+}
+
+// TestFragment_RoutingDisabledDropsFragment verifies routed first fragments are
+// dropped when routing is disabled.
+func TestFragment_RoutingDisabledDropsFragment(t *testing.T) {
+	m := newFragmentTestManager(t)
+	m.routingEnabled.Store(false)
+
+	first := firstFragmentUDPTo(t, "198.51.100.10", 0x9999, 8080, 32)
+	require.True(t, m.filterInbound(first, len(first)),
+		"routed first fragment must be dropped when routing is disabled")
+}
+
+// TestFragment_RouteACL verifies the route-ACL branch: fragments to a non-local
+// destination follow the route rules, allowed datagrams pass their trailing
+// fragments and denied ones don't.
+func TestFragment_RouteACL(t *testing.T) {
+	m := newFragmentTestManager(t)
+	m.routingEnabled.Store(true)
+	m.nativeRouter.Store(false)
+
+	_, err := m.AddFilterRule(
+		[]byte("rt-1"),
+		[]netip.Prefix{netip.MustParsePrefix("100.10.0.0/16")},
+		fw.Network{Prefix: netip.MustParsePrefix("198.51.100.0/24")},
+		fw.ProtocolUDP,
+		nil,
+		&fw.Port{Values: []uint16{8080}},
+		fw.ActionAccept,
+	)
+	require.NoError(t, err)
+
+	first := firstFragmentUDPTo(t, "198.51.100.10", 0xAAAA, 8080, 32)
+	require.False(t, m.filterInbound(first, len(first)),
+		"route-ACL-allowed first fragment should pass")
+	trailing := trailingFragmentTo(t, "198.51.100.10", layers.IPProtocolUDP, 0xAAAA, 5, false, 24)
+	require.False(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of an allowed routed datagram should pass")
+
+	denied := firstFragmentUDPTo(t, "198.51.100.10", 0xBBBB, 9999, 32)
+	require.True(t, m.filterInbound(denied, len(denied)),
+		"route-ACL-denied first fragment must be dropped")
+	deniedTrailing := trailingFragmentTo(t, "198.51.100.10", layers.IPProtocolUDP, 0xBBBB, 5, false, 24)
+	require.True(t, m.filterInbound(deniedTrailing, len(deniedTrailing)),
+		"trailing fragment of a denied routed datagram must be dropped")
+}
+
+// TestFragment_ExpiredVerdictDropsTrailing verifies a verdict older than the
+// tracker timeout no longer admits trailing fragments.
+func TestFragment_ExpiredVerdictDropsTrailing(t *testing.T) {
+	m := newFragmentTestManager(t)
+	allowUDP(t, m, 8080)
+
+	first := firstFragmentUDP(t, 0xCCCC, 8080, 32)
+	require.False(t, m.filterInbound(first, len(first)))
+
+	m.fragments.mutex.Lock()
+	for key, entry := range m.fragments.entries {
+		entry.recordedAt = time.Now().Add(-defaultFragmentTimeout - time.Second)
+		m.fragments.entries[key] = entry
+	}
+	m.fragments.mutex.Unlock()
+
+	trailing := trailingFragment(t, 0xCCCC, 5, false, 24)
+	require.True(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment after verdict expiry must be dropped")
+}
+
+// TestFragment_CapacityFailsClosed verifies the table cap: at capacity, new
+// datagram verdicts are not recorded (their trailing fragments are dropped)
+// while already-recorded datagrams keep working.
+func TestFragment_CapacityFailsClosed(t *testing.T) {
+	m := newFragmentTestManager(t)
+	allowUDP(t, m, 8080)
+
+	m.fragments.mutex.Lock()
+	m.fragments.maxEntries = 1
+	m.fragments.mutex.Unlock()
+
+	first1 := firstFragmentUDP(t, 0x0101, 8080, 32)
+	require.False(t, m.filterInbound(first1, len(first1)))
+
+	first2 := firstFragmentUDP(t, 0x0202, 8080, 32)
+	require.False(t, m.filterInbound(first2, len(first2)),
+		"first fragment itself still passes at capacity")
+
+	trailing2 := trailingFragment(t, 0x0202, 5, false, 24)
+	require.True(t, m.filterInbound(trailing2, len(trailing2)),
+		"trailing fragment of an unrecorded datagram must be dropped at capacity")
+
+	trailing1 := trailingFragment(t, 0x0101, 5, false, 24)
+	require.False(t, m.filterInbound(trailing1, len(trailing1)),
+		"already-recorded datagram should keep passing at capacity")
+}
+
+// v6FragmentHeader builds the 8-byte IPv6 fragment extension header for the
+// given inner protocol, offset (8-byte units), More Fragments bit and id.
+func v6FragmentHeader(proto layers.IPProtocol, offsetOctets uint16, moreFragments bool, id uint32) []byte {
+	offsetFlags := offsetOctets << 3
+	if moreFragments {
+		offsetFlags |= 1
+	}
+	hdr := make([]byte, 8)
+	hdr[0] = uint8(proto)
+	binary.BigEndian.PutUint16(hdr[2:4], offsetFlags)
+	binary.BigEndian.PutUint32(hdr[4:8], id)
+	return hdr
+}
+
+func v6UDPHeader(dstPort uint16, dataLen int) []byte {
+	hdr := make([]byte, 8)
+	binary.BigEndian.PutUint16(hdr[0:2], 40000)
+	binary.BigEndian.PutUint16(hdr[2:4], dstPort)
+	binary.BigEndian.PutUint16(hdr[4:6], uint16(8+dataLen))
+	return hdr
+}
+
+// firstFragmentUDPv6 builds the first fragment of a fragmented IPv6 UDP
+// datagram: fragment header (offset 0, More Fragments set) + full UDP header +
+// data.
+func firstFragmentUDPv6(tb testing.TB, id uint32, dstPort uint16, dataLen int) []byte {
+	tb.Helper()
+	return fragmentUDPv6(tb, id, dstPort, dataLen, true)
+}
+
+// fragmentUDPv6 builds an offset-zero IPv6 UDP fragment. With moreFragments
+// false it is an atomic fragment (a complete datagram, RFC 6946).
+func fragmentUDPv6(tb testing.TB, id uint32, dstPort uint16, dataLen int, moreFragments bool) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv6{
+		Version:    6,
+		NextHeader: layers.IPProtocolIPv6Fragment,
+		HopLimit:   64,
+		SrcIP:      net.ParseIP(fragTestSrcV6),
+		DstIP:      net.ParseIP(fragTestDstV6),
+	}
+	payload := append(v6FragmentHeader(layers.IPProtocolUDP, 0, moreFragments, id), v6UDPHeader(dstPort, dataLen)...)
+	payload = append(payload, make([]byte, dataLen)...)
+
+	buf := gopacket.NewSerializeBuffer()
+	require.NoError(tb, gopacket.SerializeLayers(buf, gopacket.SerializeOptions{FixLengths: true}, ip, gopacket.Payload(payload)))
+	return buf.Bytes()
+}
+
+// trailingFragmentV6 builds a non-first IPv6 fragment: fragment header at the
+// given offset carrying raw data and no transport header.
+func trailingFragmentV6(tb testing.TB, id uint32, offsetOctets uint16, moreFragments bool, dataLen int) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv6{
+		Version:    6,
+		NextHeader: layers.IPProtocolIPv6Fragment,
+		HopLimit:   64,
+		SrcIP:      net.ParseIP(fragTestSrcV6),
+		DstIP:      net.ParseIP(fragTestDstV6),
+	}
+	payload := append(v6FragmentHeader(layers.IPProtocolUDP, offsetOctets, moreFragments, id), make([]byte, dataLen)...)
+
+	buf := gopacket.NewSerializeBuffer()
+	require.NoError(tb, gopacket.SerializeLayers(buf, gopacket.SerializeOptions{FixLengths: true}, ip, gopacket.Payload(payload)))
+	return buf.Bytes()
+}
+
+// TestFragmentV6_TrailingWithoutFirstDropped verifies the IPv6 bypass is closed:
+// a trailing fragment with no allowed first fragment is dropped.
+func TestFragmentV6_TrailingWithoutFirstDropped(t *testing.T) {
+	m := newFragmentTestManager(t)
+
+	frag := trailingFragmentV6(t, 0xAABBCCDD, 100, false, 40)
+	require.True(t, m.filterInbound(frag, len(frag)),
+		"IPv6 trailing fragment without an allowed first fragment must be dropped")
+}
+
+// TestFragmentV6_AllowedFirstPassesTrailing verifies IPv6 fragments are
+// evaluated like IPv4: an allowed first fragment lets its trailing fragments
+// through.
+func TestFragmentV6_AllowedFirstPassesTrailing(t *testing.T) {
+	m := newFragmentTestManager(t)
+	_, err := m.AddFilterRule(nil, pfx(net.ParseIP(fragTestSrcV6)), fw.Network{}, fw.ProtocolUDP, nil,
+		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept)
+	require.NoError(t, err)
+
+	// First fragment: UDP header (8) + 32 data = 40 octets -> headerEnd = 5.
+	first := firstFragmentUDPv6(t, 0xAABBCCDD, 8080, 32)
+	require.False(t, m.filterInbound(first, len(first)),
+		"allowed IPv6 first fragment should pass and be recorded")
+
+	trailing := trailingFragmentV6(t, 0xAABBCCDD, 5, false, 24)
+	require.False(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of an allowed IPv6 datagram should pass")
+}
+
+// TestFragmentV6_AtomicNotCached verifies an IPv6 atomic fragment (fragment
+// header with offset 0 and no More Fragments, a complete datagram per RFC 6946)
+// is evaluated but not recorded, so a flood of allowed atomic fragments can't
+// exhaust the verdict table.
+func TestFragmentV6_AtomicNotCached(t *testing.T) {
+	m := newFragmentTestManager(t)
+	_, err := m.AddFilterRule(nil, pfx(net.ParseIP(fragTestSrcV6)), fw.Network{}, fw.ProtocolUDP, nil,
+		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept)
+	require.NoError(t, err)
+
+	atomic := fragmentUDPv6(t, 0xA70301C, 8080, 16, false)
+	require.False(t, m.filterInbound(atomic, len(atomic)),
+		"allowed IPv6 atomic fragment should pass")
+
+	m.fragments.mutex.Lock()
+	n := len(m.fragments.entries)
+	m.fragments.mutex.Unlock()
+	require.Zero(t, n, "atomic fragment must not create a verdict entry")
+
+	// A genuine fragmented datagram (More Fragments set) is still recorded.
+	first := fragmentUDPv6(t, 0xBEEF, 8080, 32, true)
+	require.False(t, m.filterInbound(first, len(first)))
+	m.fragments.mutex.Lock()
+	n = len(m.fragments.entries)
+	m.fragments.mutex.Unlock()
+	require.Equal(t, 1, n, "genuine first fragment must record a verdict")
+}
diff --git a/client/firewall/uspfilter/allow_netbird_windows.go b/client/firewall/uspfilter/interface_allower_windows.go
similarity index 68%
rename from client/firewall/uspfilter/allow_netbird_windows.go
rename to client/firewall/uspfilter/interface_allower_windows.go
index 10a2b9116..4cd0fe969 100644
--- a/client/firewall/uspfilter/allow_netbird_windows.go
+++ b/client/firewall/uspfilter/interface_allower_windows.go
@@ -9,7 +9,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/client/internal/statemanager"
+	"github.com/netbirdio/netbird/client/internal/wincmd"
 )
 
 type action string
@@ -20,35 +20,20 @@ const (
 	firewallRuleName        = "Netbird"
 )
 
-// Close cleans up the firewall manager by removing all rules and closing trackers
-func (m *Manager) Close(*statemanager.Manager) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	m.resetState()
-
-	if !isWindowsFirewallReachable() {
-		return nil
-	}
-
-	var merr *multierror.Error
-	if isFirewallRuleActive(firewallRuleName) {
-		if err := manageFirewallRule(firewallRuleName, deleteRule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove windows firewall rule: %w", err))
-		}
-	}
-
-	if isFirewallRuleActive(firewallRuleName + "-v6") {
-		if err := manageFirewallRule(firewallRuleName+"-v6", deleteRule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove windows v6 firewall rule: %w", err))
-		}
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
+// WindowsInterfaceAllower opens the NetBird interface in the Windows firewall
+// via netsh advfirewall rules. It implements InterfaceAllower for the userspace
+// firewall on Windows.
+type WindowsInterfaceAllower struct {
+	iface Iface
 }
 
-// AllowNetbird allows netbird interface traffic
-func (m *Manager) AllowNetbird() error {
+// NewWindowsInterfaceAllower builds the Windows netsh-based interface allower.
+func NewWindowsInterfaceAllower(iface Iface) *WindowsInterfaceAllower {
+	return &WindowsInterfaceAllower{iface: iface}
+}
+
+// Apply adds inbound-allow netsh rules for the interface's addresses.
+func (a *WindowsInterfaceAllower) Apply() error {
 	if !isWindowsFirewallReachable() {
 		return nil
 	}
@@ -60,13 +45,13 @@ func (m *Manager) AllowNetbird() error {
 			"enable=yes",
 			"action=allow",
 			"profile=any",
-			"localip="+m.wgIface.Address().IP.String(),
+			"localip="+a.iface.Address().IP.String(),
 		); err != nil {
 			return err
 		}
 	}
 
-	if v6 := m.wgIface.Address().IPv6; v6.IsValid() && !isFirewallRuleActive(firewallRuleName+"-v6") {
+	if v6 := a.iface.Address().IPv6; v6.IsValid() && !isFirewallRuleActive(firewallRuleName+"-v6") {
 		if err := manageFirewallRule(firewallRuleName+"-v6",
 			addRule,
 			"dir=in",
@@ -82,13 +67,32 @@ func (m *Manager) AllowNetbird() error {
 	return nil
 }
 
-func manageFirewallRule(ruleName string, action action, extraArgs ...string) error {
+// Close removes the netsh rules added by Apply.
+func (a *WindowsInterfaceAllower) Close() error {
+	if !isWindowsFirewallReachable() {
+		return nil
+	}
 
+	var merr *multierror.Error
+	if isFirewallRuleActive(firewallRuleName) {
+		if err := manageFirewallRule(firewallRuleName, deleteRule); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove windows firewall rule: %w", err))
+		}
+	}
+	if isFirewallRuleActive(firewallRuleName + "-v6") {
+		if err := manageFirewallRule(firewallRuleName+"-v6", deleteRule); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove windows v6 firewall rule: %w", err))
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func manageFirewallRule(ruleName string, action action, extraArgs ...string) error {
 	args := []string{"advfirewall", "firewall", string(action), "rule", "name=" + ruleName}
 	if action == addRule {
 		args = append(args, extraArgs...)
 	}
-	netshCmd := GetSystem32Command("netsh")
+	netshCmd := wincmd.System32("netsh")
 	cmd := exec.Command(netshCmd, args...)
 	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
 	return cmd.Run()
@@ -97,7 +101,7 @@ func manageFirewallRule(ruleName string, action action, extraArgs ...string) err
 func isWindowsFirewallReachable() bool {
 	args := []string{"advfirewall", "show", "allprofiles", "state"}
 
-	netshCmd := GetSystem32Command("netsh")
+	netshCmd := wincmd.System32("netsh")
 
 	cmd := exec.Command(netshCmd, args...)
 	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
@@ -114,23 +118,10 @@ func isWindowsFirewallReachable() bool {
 func isFirewallRuleActive(ruleName string) bool {
 	args := []string{"advfirewall", "firewall", "show", "rule", "name=" + ruleName}
 
-	netshCmd := GetSystem32Command("netsh")
+	netshCmd := wincmd.System32("netsh")
 
 	cmd := exec.Command(netshCmd, args...)
 	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
 	_, err := cmd.Output()
 	return err == nil
 }
-
-// GetSystem32Command checks if a command can be found in the system path and returns it. In case it can't find it
-// in the path it will return the full path of a command assuming C:\windows\system32 as the base path.
-func GetSystem32Command(command string) string {
-	_, err := exec.LookPath(command)
-	if err == nil {
-		return command
-	}
-
-	log.Tracef("Command %s not found in PATH, using C:\\windows\\system32\\%s.exe path", command, command)
-
-	return "C:\\windows\\system32\\" + command + ".exe"
-}
diff --git a/client/firewall/uspfilter/localip.go b/client/firewall/uspfilter/localip.go
index b35be56c6..869832732 100644
--- a/client/firewall/uspfilter/localip.go
+++ b/client/firewall/uspfilter/localip.go
@@ -7,8 +7,6 @@ import (
 	"sync/atomic"
 
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/firewall/uspfilter/common"
 )
 
 // localIPSnapshot is an immutable snapshot of local IP addresses, swapped
@@ -60,7 +58,7 @@ func processInterface(iface net.Interface, ips map[netip.Addr]struct{}, addresse
 }
 
 // UpdateLocalIPs rebuilds the local IP snapshot and swaps it in atomically.
-func (m *localIPManager) UpdateLocalIPs(iface common.IFaceMapper) (err error) {
+func (m *localIPManager) UpdateLocalIPs(iface Iface) (err error) {
 	defer func() {
 		if r := recover(); r != nil {
 			err = fmt.Errorf("panic: %v", r)
diff --git a/client/firewall/uspfilter/nat.go b/client/firewall/uspfilter/nat.go
index 5d51c1538..49c26766a 100644
--- a/client/firewall/uspfilter/nat.go
+++ b/client/firewall/uspfilter/nat.go
@@ -486,22 +486,6 @@ func incrementalUpdate(oldChecksum uint16, oldBytes, newBytes []byte) uint16 {
 	return ^uint16(sum)
 }
 
-// AddDNATRule adds outbound DNAT rule for forwarding external traffic to NetBird network.
-func (m *Manager) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	if m.nativeFirewall == nil {
-		return nil, errNatNotSupported
-	}
-	return m.nativeFirewall.AddDNATRule(rule)
-}
-
-// DeleteDNATRule deletes outbound DNAT rule.
-func (m *Manager) DeleteDNATRule(rule firewall.Rule) error {
-	if m.nativeFirewall == nil {
-		return errNatNotSupported
-	}
-	return m.nativeFirewall.DeleteDNATRule(rule)
-}
-
 // addPortRedirection adds a port redirection rule.
 func (m *Manager) addPortRedirection(targetIP netip.Addr, protocol gopacket.LayerType, originalPort, translatedPort uint16) error {
 	m.portDNATMutex.Lock()
@@ -521,7 +505,6 @@ func (m *Manager) addPortRedirection(targetIP netip.Addr, protocol gopacket.Laye
 }
 
 // AddInboundDNAT adds an inbound DNAT rule redirecting traffic from NetBird peers to local services.
-// TODO: also delegate to nativeFirewall when available for kernel WG mode
 func (m *Manager) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
 	var layerType gopacket.LayerType
 	switch protocol {
@@ -567,20 +550,16 @@ func (m *Manager) RemoveInboundDNAT(localAddr netip.Addr, protocol firewall.Prot
 	return m.removePortRedirection(localAddr, layerType, originalPort, translatedPort)
 }
 
-// AddOutputDNAT delegates to the native firewall if available.
-func (m *Manager) AddOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
-	if m.nativeFirewall == nil {
-		return fmt.Errorf("output DNAT not supported without native firewall")
-	}
-	return m.nativeFirewall.AddOutputDNAT(localAddr, protocol, originalPort, translatedPort)
+// AddOutputDNAT is not supported by the userspace firewall: it backs kernel DNS
+// redirection, but userspace DNS is served in-process on the gVisor netstack, so
+// this should never be called.
+func (m *Manager) AddOutputDNAT(netip.Addr, firewall.Protocol, uint16, uint16) error {
+	return errNotSupported
 }
 
-// RemoveOutputDNAT delegates to the native firewall if available.
-func (m *Manager) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
-	if m.nativeFirewall == nil {
-		return nil
-	}
-	return m.nativeFirewall.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
+// RemoveOutputDNAT is a no-op for the userspace firewall (see AddOutputDNAT).
+func (m *Manager) RemoveOutputDNAT(netip.Addr, firewall.Protocol, uint16, uint16) error {
+	return nil
 }
 
 // translateInboundPortDNAT applies port-specific DNAT translation to inbound packets.
diff --git a/client/firewall/uspfilter/nat_bench_test.go b/client/firewall/uspfilter/nat_bench_test.go
index 1e15c8c0c..422c6b849 100644
--- a/client/firewall/uspfilter/nat_bench_test.go
+++ b/client/firewall/uspfilter/nat_bench_test.go
@@ -64,9 +64,11 @@ func BenchmarkDNATTranslation(b *testing.B) {
 
 	for _, sc := range scenarios {
 		b.Run(sc.name, func(b *testing.B) {
-			manager, err := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 			require.NoError(b, err)
 			defer func() {
 				require.NoError(b, manager.Close(nil))
@@ -124,9 +126,11 @@ func BenchmarkDNATTranslation(b *testing.B) {
 
 // BenchmarkDNATConcurrency tests DNAT performance under concurrent load
 func BenchmarkDNATConcurrency(b *testing.B) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(b, err)
 	defer func() {
 		require.NoError(b, manager.Close(nil))
@@ -196,9 +200,11 @@ func BenchmarkDNATScaling(b *testing.B) {
 
 	for _, count := range mappingCounts {
 		b.Run(fmt.Sprintf("mappings_%d", count), func(b *testing.B) {
-			manager, err := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 			require.NoError(b, err)
 			defer func() {
 				require.NoError(b, manager.Close(nil))
@@ -308,9 +314,11 @@ func BenchmarkChecksumUpdate(b *testing.B) {
 
 // BenchmarkDNATMemoryAllocations checks for memory allocations in DNAT operations
 func BenchmarkDNATMemoryAllocations(b *testing.B) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(b, err)
 	defer func() {
 		require.NoError(b, manager.Close(nil))
@@ -481,9 +489,11 @@ func BenchmarkPortDNAT(b *testing.B) {
 
 	for _, sc := range scenarios {
 		b.Run(sc.name, func(b *testing.B) {
-			manager, err := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			}, false, flowLogger, iface.DefaultMTU)
+			manager, err := Create(Config{
+				IFace: &IFaceMock{
+					SetFilterFunc: func(device.PacketFilter) error { return nil },
+				},
+				FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 			require.NoError(b, err)
 			defer func() {
 				require.NoError(b, manager.Close(nil))
diff --git a/client/firewall/uspfilter/nat_stateful_test.go b/client/firewall/uspfilter/nat_stateful_test.go
index 21c6da06e..5fa5da027 100644
--- a/client/firewall/uspfilter/nat_stateful_test.go
+++ b/client/firewall/uspfilter/nat_stateful_test.go
@@ -13,9 +13,11 @@ import (
 
 // TestPortDNATBasic tests basic port DNAT functionality
 func TestPortDNATBasic(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, manager.Close(nil))
@@ -49,9 +51,11 @@ func TestPortDNATBasic(t *testing.T) {
 
 // TestPortDNATMultipleRules tests multiple port DNAT rules
 func TestPortDNATMultipleRules(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, manager.Close(nil))
diff --git a/client/firewall/uspfilter/nat_test.go b/client/firewall/uspfilter/nat_test.go
index 4598c3901..5b5840383 100644
--- a/client/firewall/uspfilter/nat_test.go
+++ b/client/firewall/uspfilter/nat_test.go
@@ -15,9 +15,11 @@ import (
 
 // TestDNATTranslationCorrectness verifies DNAT translation works correctly
 func TestDNATTranslationCorrectness(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, manager.Close(nil))
@@ -104,9 +106,11 @@ func parsePacket(t testing.TB, packetData []byte) *decoder {
 
 // TestDNATMappingManagement tests adding/removing DNAT mappings
 func TestDNATMappingManagement(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, manager.Close(nil))
@@ -152,9 +156,11 @@ func TestDNATMappingManagement(t *testing.T) {
 }
 
 func TestInboundPortDNAT(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, manager.Close(nil))
@@ -202,9 +208,11 @@ func TestInboundPortDNAT(t *testing.T) {
 }
 
 func TestInboundPortDNATNegative(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	}, false, flowLogger, iface.DefaultMTU)
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+		},
+		FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, manager.Close(nil))
diff --git a/client/firewall/uspfilter/peer_acl_bench_test.go b/client/firewall/uspfilter/peer_acl_bench_test.go
new file mode 100644
index 000000000..bcb0ca5c2
--- /dev/null
+++ b/client/firewall/uspfilter/peer_acl_bench_test.go
@@ -0,0 +1,333 @@
+//go:build uspbench
+
+package uspfilter
+
+import (
+	"fmt"
+	"io"
+	"math/rand"
+	"net"
+	"net/netip"
+	"runtime"
+	"testing"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/require"
+
+	fw "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/device"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+)
+
+// BenchmarkPeerACLMatch measures the per-packet cost of the peer ACL
+// matcher (peerACLsBlock) across realistic shapes: M distinct policy
+// rules, each with K source peers in its set.
+//
+// With the reverse-source index, miss cost is independent of M and
+// hit cost grows only with the number of rules touching a single
+// srcIP, not with total rule count.
+func BenchmarkPeerACLMatch(b *testing.B) {
+	shapes := []struct{ M, K int }{
+		{1, 100}, {10, 100}, {50, 100}, {100, 100}, {100, 1000},
+	}
+	families := []struct {
+		name string
+		v6   bool
+	}{{"v4", false}, {"v6", true}}
+
+	for _, fam := range families {
+		for _, s := range shapes {
+			b.Run(fmt.Sprintf("%s/M=%d/K=%d/hit", fam.name, s.M, s.K), func(b *testing.B) {
+				runPeerACLBench(b, s.M, s.K, true, fam.v6)
+			})
+			b.Run(fmt.Sprintf("%s/M=%d/K=%d/miss", fam.name, s.M, s.K), func(b *testing.B) {
+				runPeerACLBench(b, s.M, s.K, false, fam.v6)
+			})
+		}
+	}
+}
+
+func runPeerACLBench(b *testing.B, m, k int, hit, v6 bool) {
+	log.SetOutput(io.Discard) // keep manager logs out of the benchmark output
+
+	// Miss packets are dropped, so they always traverse the full peer
+	// ACL matcher (every bucket) without short-circuiting and without
+	// touching conntrack. Disable conntrack for the miss case so it
+	// measures the matcher, not established-state lookups. The hit case
+	// keeps conntrack on: an accepted packet reaches trackInbound, which
+	// needs the trackers conntrack creates.
+	if !hit {
+		b.Setenv("NB_DISABLE_CONNTRACK", "1")
+	}
+
+	bits := 32
+	genPkt := generatePacket
+	addrs := uniqueAddrs
+	if v6 {
+		bits = 128
+		genPkt = generatePacket6
+		addrs = uniqueAddrs6
+	}
+
+	// dstIP must be a local IP so filterInbound takes the local-traffic
+	// path (handleLocalTraffic → peerACLsBlock) we are measuring; an
+	// address the manager doesn't own would be treated as routed and
+	// short-circuit before the peer matcher.
+	dstIP := addrs(1, 2)[0]
+	mockAddr := wgaddr.Address{IP: dstIP, Network: netip.PrefixFrom(dstIP, bits)}
+	if v6 {
+		// The local-IP manager needs a valid v4 address too; expose the v6
+		// dst as the interface's IPv6 so IsLocalIP recognizes it.
+		mockAddr = wgaddr.Address{
+			IP:      netip.MustParseAddr("100.64.0.1"),
+			Network: netip.MustParsePrefix("100.64.0.0/16"),
+			IPv6:    dstIP,
+			IPv6Net: netip.PrefixFrom(dstIP, bits),
+		}
+	}
+	manager, err := Create(Config{
+		IFace: &IFaceMock{
+			SetFilterFunc: func(device.PacketFilter) error { return nil },
+			AddressFunc:   func() wgaddr.Address { return mockAddr },
+		},
+		FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+	require.NoError(b, err)
+	b.Cleanup(func() { require.NoError(b, manager.Close(nil)) })
+
+	// Generate M policies × K source peers, all distinct.
+	all := addrs(m*k, 1)
+	for i := 0; i < m; i++ {
+		sources := make([]netip.Prefix, k)
+		for j, a := range all[i*k : (i+1)*k] {
+			sources[j] = netip.PrefixFrom(a, bits)
+		}
+		_, err := manager.AddFilterRule(
+			nil, sources, fw.Network{}, fw.ProtocolTCP, nil,
+			&fw.Port{Values: []uint16{uint16(80 + i)}},
+			fw.ActionAccept)
+		require.NoError(b, err)
+	}
+
+	// Hit: cycle through real sources, picking the matching policy's port.
+	// Miss: a source from a disjoint range, port 80 (matches no policy).
+	var pktFn func(i int) []byte
+	if hit {
+		pktFn = func(i int) []byte {
+			policy := i % m
+			src := all[policy*k+(i%k)]
+			return genPkt(b, src.AsSlice(), dstIP.AsSlice(),
+				uint16(1024+i%60000), uint16(80+policy), layers.IPProtocolTCP)
+		}
+	} else {
+		miss := addrs(4096, 99)
+		pktFn = func(i int) []byte {
+			return genPkt(b, miss[i%len(miss)].AsSlice(), dstIP.AsSlice(),
+				uint16(1024+i%60000), 80, layers.IPProtocolTCP)
+		}
+	}
+
+	// Pre-build a pool to avoid allocations dominating the measurement.
+	pool := make([][]byte, 1024)
+	for i := range pool {
+		pool[i] = pktFn(i)
+	}
+
+	// Confirm the matcher is actually exercised: a hit packet must be
+	// allowed and a miss packet dropped. Without this the benchmark
+	// could silently time the routed early-return instead.
+	require.Equal(b, !hit, manager.filterInbound(pool[0], 0),
+		"benchmark must reach the peer ACL matcher")
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		manager.filterInbound(pool[i%len(pool)], 0)
+	}
+}
+
+// BenchmarkPeerACLIndexMemory reports the resident memory cost of
+// the source-keyed index across realistic deployment shapes. Two
+// dimensions matter: (M, K), the number of policies × peers-per-policy,
+// and overlap, the fraction of peers shared between policies.
+//
+// The output uses ReportMetric("bytes/rule") so the cost can be
+// compared across shapes directly. Total bytes = bytes/rule * M.
+func BenchmarkPeerACLIndexMemory(b *testing.B) {
+	cases := []struct {
+		name        string
+		M, K        int
+		overlapFrac float64 // 0 = disjoint per-policy sources, 1 = all share the same pool
+	}{
+		{"M=10/K=100/disjoint", 10, 100, 0},
+		{"M=100/K=100/disjoint", 100, 100, 0},
+		{"M=100/K=1000/disjoint", 100, 1000, 0},
+		{"M=100/K=1000/overlap=0.5", 100, 1000, 0.5},
+		{"M=100/K=1000/overlap=1.0", 100, 1000, 1.0},
+		{"M=1000/K=100/overlap=1.0", 1000, 100, 1.0},
+	}
+
+	for _, c := range cases {
+		b.Run(c.name, func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				mgr, err := Create(Config{
+					IFace: &IFaceMock{
+						SetFilterFunc: func(device.PacketFilter) error { return nil },
+					},
+					FlowLogger: flowLogger, MTU: iface.DefaultMTU})
+				require.NoError(b, err)
+
+				populateIndexedRules(b, mgr, c.M, c.K, c.overlapFrac)
+
+				runtime.GC()
+				var ms runtime.MemStats
+				runtime.ReadMemStats(&ms)
+				before := ms.HeapAlloc
+
+				// Drop the manager's external roots so we can isolate
+				// the index cost. We hold the manager itself live; the
+				// index is what we measure on the second pass.
+				mgr.incomingAcceptIndex.reset()
+				mgr.incomingDenyIndex.reset()
+				mgr.incomingAcceptRules = mgr.incomingAcceptRules[:0]
+				mgr.incomingDenyRules = mgr.incomingDenyRules[:0]
+				runtime.GC()
+				runtime.ReadMemStats(&ms)
+				after := ms.HeapAlloc
+
+				delta := int64(before) - int64(after)
+				if delta < 0 {
+					delta = 0
+				}
+				b.ReportMetric(float64(delta)/float64(c.M), "bytes/rule")
+				b.ReportMetric(float64(delta), "bytes/total")
+
+				require.NoError(b, mgr.Close(nil))
+			}
+		})
+	}
+}
+
+func populateIndexedRules(b *testing.B, mgr *Manager, m, k int, overlapFrac float64) {
+	b.Helper()
+	pool := uniqueAddrs(k+m*k, 1) // big enough universe
+	sharedLen := int(float64(k) * overlapFrac)
+	if sharedLen > k {
+		sharedLen = k
+	}
+	shared := pool[:sharedLen]
+	uniquePool := pool[sharedLen:]
+
+	for i := 0; i < m; i++ {
+		sources := make([]netip.Prefix, 0, k)
+		for _, a := range shared {
+			sources = append(sources, netip.PrefixFrom(a, 32))
+		}
+		// each policy gets (k-sharedLen) addresses unique to it from the unique pool
+		unique := uniquePool[i*(k-sharedLen) : (i+1)*(k-sharedLen)]
+		for _, a := range unique {
+			sources = append(sources, netip.PrefixFrom(a, 32))
+		}
+		_, err := mgr.AddFilterRule(
+			nil, sources, fw.Network{}, fw.ProtocolTCP, nil,
+			&fw.Port{Values: []uint16{uint16(80 + i)}},
+			fw.ActionAccept)
+		require.NoError(b, err)
+	}
+}
+
+// uniqueAddrs returns n distinct addrs. Seeds 1, 2 are used for
+// policy sources / dst; seed 99 puts misses in 10/8.
+func uniqueAddrs(n int, seed int64) []netip.Addr {
+	out := make([]netip.Addr, 0, n)
+	seen := make(map[netip.Addr]struct{}, n)
+	r := rand.New(rand.NewSource(seed))
+	miss := seed == 99
+	for len(out) < n {
+		var b [4]byte
+		if miss {
+			b[0] = 10
+			b[1] = byte(r.Intn(256))
+		} else {
+			b[0] = 100
+			b[1] = byte(64 + r.Intn(63))
+		}
+		b[2] = byte(r.Intn(256))
+		b[3] = byte(1 + r.Intn(254))
+		a := netip.AddrFrom4(b)
+		if _, ok := seen[a]; ok {
+			continue
+		}
+		seen[a] = struct{}{}
+		out = append(out, a)
+	}
+	return out
+}
+
+// uniqueAddrs6 mirrors uniqueAddrs for IPv6: sources come from the ULA
+// range fd00::/8, the miss set (seed 99) from 2001:db8::/32 so it is
+// disjoint from any source.
+func uniqueAddrs6(n int, seed int64) []netip.Addr {
+	out := make([]netip.Addr, 0, n)
+	seen := make(map[netip.Addr]struct{}, n)
+	r := rand.New(rand.NewSource(seed))
+	miss := seed == 99
+	for len(out) < n {
+		var b [16]byte
+		if miss {
+			b[0], b[1], b[2], b[3] = 0x20, 0x01, 0x0d, 0xb8
+		} else {
+			b[0] = 0xfd
+		}
+		for x := 8; x < 16; x++ {
+			b[x] = byte(r.Intn(256))
+		}
+		a := netip.AddrFrom16(b)
+		if _, ok := seen[a]; ok {
+			continue
+		}
+		seen[a] = struct{}{}
+		out = append(out, a)
+	}
+	return out
+}
+
+// generatePacket6 builds an IPv6 TCP/UDP packet, mirroring
+// generatePacket for the v4 case.
+func generatePacket6(b *testing.B, srcIP, dstIP net.IP, srcPort, dstPort uint16, protocol layers.IPProtocol) []byte {
+	b.Helper()
+
+	ipv6 := &layers.IPv6{
+		Version:    6,
+		HopLimit:   64,
+		NextHeader: protocol,
+		SrcIP:      srcIP,
+		DstIP:      dstIP,
+	}
+
+	var transportLayer gopacket.SerializableLayer
+	switch protocol {
+	case layers.IPProtocolTCP:
+		tcp := &layers.TCP{
+			SrcPort: layers.TCPPort(srcPort),
+			DstPort: layers.TCPPort(dstPort),
+			SYN:     true,
+		}
+		require.NoError(b, tcp.SetNetworkLayerForChecksum(ipv6))
+		transportLayer = tcp
+	case layers.IPProtocolUDP:
+		udp := &layers.UDP{
+			SrcPort: layers.UDPPort(srcPort),
+			DstPort: layers.UDPPort(dstPort),
+		}
+		require.NoError(b, udp.SetNetworkLayerForChecksum(ipv6))
+		transportLayer = udp
+	}
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
+	require.NoError(b, gopacket.SerializeLayers(buf, opts, ipv6, transportLayer, gopacket.Payload("test")))
+	return buf.Bytes()
+}
diff --git a/client/firewall/uspfilter/peer_acl_dedup_test.go b/client/firewall/uspfilter/peer_acl_dedup_test.go
new file mode 100644
index 000000000..696766d80
--- /dev/null
+++ b/client/firewall/uspfilter/peer_acl_dedup_test.go
@@ -0,0 +1,150 @@
+package uspfilter
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	fw "github.com/netbirdio/netbird/client/firewall/manager"
+	nbiface "github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/device"
+)
+
+func newTestManager(t *testing.T) *Manager {
+	t.Helper()
+	ifaceMock := &IFaceMock{
+		SetFilterFunc: func(device.PacketFilter) error { return nil },
+	}
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
+	require.NoError(t, err, "create manager")
+	t.Cleanup(func() { require.NoError(t, m.Close(nil)) })
+	return m
+}
+
+// TestAddPeerFiltering_DeduplicatesIdenticalRules verifies that adding
+// the same peer rule twice does not create two backing rules. The acl
+// manager keys its own cache, but the firewall backend must be
+// idempotent on its own so a double-apply cannot leak rules, matching
+// the route path and the kernel backends.
+func TestAddPeerFiltering_DeduplicatesIdenticalRules(t *testing.T) {
+	m := newTestManager(t)
+
+	ip := net.ParseIP("192.168.1.1")
+	proto := fw.ProtocolTCP
+	port := &fw.Port{Values: []uint16{80}}
+	action := fw.ActionDrop
+
+	first, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
+	require.NoError(t, err, "first add")
+
+	second, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
+	require.NoError(t, err, "second add")
+
+	assert.Equal(t, first.ID(), second.ID(), "duplicate add should return the same rule id")
+	assert.Len(t, m.incomingDenyRules, 1, "duplicate add must not create a second backing rule")
+}
+
+// TestDeletePeerFiltering_NoRefcountSingleDeleteRemoves locks the
+// backend's owner accounting for the same-owner case: a content key
+// installed twice by the same owner registers one owner claim, so the
+// first DeleteFilterRule removes the rule. Owner counting only kicks
+// in for distinct management rule IDs (see the peer owner tests); the
+// acl manager keys its tracking per (policy, content) and deletes once
+// per key, so adds and deletes stay balanced.
+func TestDeletePeerFiltering_NoRefcountSingleDeleteRemoves(t *testing.T) {
+	m := newTestManager(t)
+
+	ip := net.ParseIP("192.168.1.1")
+	proto := fw.ProtocolTCP
+	port := &fw.Port{Values: []uint16{80}}
+	action := fw.ActionDrop
+
+	first, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
+	require.NoError(t, err, "first add")
+
+	second, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
+	require.NoError(t, err, "second add")
+	require.Equal(t, first.ID(), second.ID(), "dedup to one rule")
+	require.Len(t, m.incomingDenyRules, 1, "still one backing rule after duplicate add")
+
+	require.NoError(t, m.DeleteFilterRule(first), "delete once")
+	assert.Empty(t, m.incomingDenyRules, "single delete removes the backing rule (no refcount)")
+	assert.NotContains(t, m.peerRulesMap, first.ID(), "dedup map entry cleared")
+}
+
+// TestAddPeerFiltering_DeterministicID verifies the peer rule id is a
+// content hash, not a random UUID: identical inputs produce the same id
+// across independent managers. A random id breaks caller-side dedup.
+func TestAddPeerFiltering_DeterministicID(t *testing.T) {
+	ip := net.ParseIP("10.0.0.5")
+	proto := fw.ProtocolUDP
+	port := &fw.Port{Values: []uint16{53}}
+	action := fw.ActionAccept
+
+	m1 := newTestManager(t)
+	r1, err := m1.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
+	require.NoError(t, err)
+
+	m2 := newTestManager(t)
+	r2, err := m2.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
+	require.NoError(t, err)
+
+	assert.Equal(t, r1.ID(), r2.ID(), "same inputs must produce the same rule id")
+}
+
+// TestAddPeerFiltering_DistinctRulesNotDeduped verifies that rules
+// differing only by port are kept separate.
+func TestAddPeerFiltering_DistinctRulesNotDeduped(t *testing.T) {
+	m := newTestManager(t)
+
+	ip := net.ParseIP("192.168.1.1")
+	proto := fw.ProtocolTCP
+	action := fw.ActionAccept
+
+	r80, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, &fw.Port{Values: []uint16{80}}, action)
+	require.NoError(t, err)
+
+	r443, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, &fw.Port{Values: []uint16{443}}, action)
+	require.NoError(t, err)
+
+	assert.NotEqual(t, r80.ID(), r443.ID(), "different ports must produce different rule ids")
+	assert.Len(t, m.incomingAcceptRules, 2, "distinct rules must both be stored")
+}
+
+// TestAddPeerFiltering_SourceVsDestPortNotDeduped verifies that a rule
+// matching on source port and one matching on destination port for the
+// same selector do not collide: the port lands in a different slot, so
+// the content key must differ.
+func TestAddPeerFiltering_SourceVsDestPortNotDeduped(t *testing.T) {
+	m := newTestManager(t)
+
+	ip := net.ParseIP("192.168.1.1")
+	proto := fw.ProtocolTCP
+	port := &fw.Port{Values: []uint16{80}}
+	action := fw.ActionAccept
+
+	dPortRule, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
+	require.NoError(t, err)
+
+	sPortRule, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, port, nil, action)
+	require.NoError(t, err)
+
+	assert.NotEqual(t, dPortRule.ID(), sPortRule.ID(), "source-port and dest-port matches must produce different rule ids")
+}
+
+// TestAddFilterRule_EmptySourcesRejected verifies that an empty source
+// list is rejected rather than treated as "match any". "Match any" must
+// be an explicit /0, so a zeroed list can never silently widen a rule to
+// every source.
+func TestAddFilterRule_EmptySourcesRejected(t *testing.T) {
+	m := newTestManager(t)
+
+	proto := fw.ProtocolTCP
+	port := &fw.Port{Values: []uint16{80}}
+
+	_, err := m.AddFilterRule(nil, nil, fw.Network{}, proto, nil, port, fw.ActionAccept)
+	require.ErrorIs(t, err, fw.ErrNoSources, "empty sources must be rejected")
+	assert.Empty(t, m.incomingAcceptRules, "no rule should be stored for empty sources")
+}
diff --git a/client/firewall/uspfilter/peer_acl_ipv6_test.go b/client/firewall/uspfilter/peer_acl_ipv6_test.go
new file mode 100644
index 000000000..282b44ebb
--- /dev/null
+++ b/client/firewall/uspfilter/peer_acl_ipv6_test.go
@@ -0,0 +1,105 @@
+package uspfilter
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	fw "github.com/netbirdio/netbird/client/firewall/manager"
+	nbiface "github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/device"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+)
+
+func newV6TestManager(t *testing.T, localV6 string) *Manager {
+	t.Helper()
+	ifaceMock := &IFaceMock{
+		SetFilterFunc: func(device.PacketFilter) error { return nil },
+		AddressFunc: func() wgaddr.Address {
+			return wgaddr.Address{
+				IP:      netip.MustParseAddr("100.10.0.100"),
+				Network: netip.MustParsePrefix("100.10.0.0/16"),
+				IPv6:    netip.MustParseAddr(localV6),
+				IPv6Net: netip.MustParsePrefix("fd00::/64"),
+			}
+		},
+	}
+	m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: nbiface.DefaultMTU})
+	require.NoError(t, err, "create manager")
+	t.Cleanup(func() { require.NoError(t, m.Close(nil)) })
+	return m
+}
+
+func v6UDPPacket(t *testing.T, src, dst string, dstPort uint16) []byte {
+	t.Helper()
+	ip6 := &layers.IPv6{
+		Version:    6,
+		HopLimit:   64,
+		NextHeader: layers.IPProtocolUDP,
+		SrcIP:      net.ParseIP(src),
+		DstIP:      net.ParseIP(dst),
+	}
+	udp := &layers.UDP{SrcPort: 51334, DstPort: layers.UDPPort(dstPort)}
+	require.NoError(t, udp.SetNetworkLayerForChecksum(ip6))
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
+	require.NoError(t, gopacket.SerializeLayers(buf, opts, ip6, udp, gopacket.Payload("test")))
+	return buf.Bytes()
+}
+
+// TestPeerACL_IPv6HostRule verifies the source index resolves /128 v6
+// rules: a matching v6 source is accepted, a non-matching one is
+// denied by the default. This is the end-to-end proof that the index
+// is not v4-only.
+func TestPeerACL_IPv6HostRule(t *testing.T) {
+	m := newV6TestManager(t, "fd00::100")
+
+	src := net.ParseIP("fd00::1")
+	_, err := m.AddFilterRule(nil, pfx(src), fw.Network{}, fw.ProtocolUDP, nil, &fw.Port{Values: []uint16{53}}, fw.ActionAccept)
+	require.NoError(t, err, "add v6 accept rule")
+
+	require.False(t, m.filterInbound(v6UDPPacket(t, "fd00::1", "fd00::100", 53), 0),
+		"v6 packet from the allowed /128 source must be accepted")
+	require.True(t, m.filterInbound(v6UDPPacket(t, "fd00::2", "fd00::100", 53), 0),
+		"v6 packet from an unlisted source must be denied by default")
+}
+
+// TestPeerACL_IPv6IndexBuckets verifies that v6 sources land in the
+// right index bucket: a /128 in bySource keyed by its address, and
+// coarser prefixes (including ::/0) in the nonHost slice.
+func TestPeerACL_IPv6IndexBuckets(t *testing.T) {
+	m := newV6TestManager(t, "fd00::100")
+	port := &fw.Port{Values: []uint16{53}}
+
+	host := netip.MustParseAddr("fd00::1")
+	_, err := m.AddFilterRule(nil, []netip.Prefix{netip.PrefixFrom(host, 128)}, fw.Network{}, fw.ProtocolUDP, nil, port, fw.ActionAccept)
+	require.NoError(t, err)
+	assert.Contains(t, m.incomingAcceptIndex.bySource, host, "/128 v6 source must be indexed by address")
+
+	_, err = m.AddFilterRule(nil, []netip.Prefix{netip.MustParsePrefix("fd00:dead::/64")}, fw.Network{}, fw.ProtocolUDP, nil, port, fw.ActionAccept)
+	require.NoError(t, err)
+	require.Len(t, m.incomingAcceptIndex.nonHost, 1, "coarser v6 prefix must land in nonHost")
+
+	_, err = m.AddFilterRule(nil, []netip.Prefix{netip.MustParsePrefix("::/0")}, fw.Network{}, fw.ProtocolUDP, nil, port, fw.ActionAccept)
+	require.NoError(t, err)
+	require.Len(t, m.incomingAcceptIndex.nonHost, 2, "::/0 source must also land in nonHost")
+}
+
+// TestPeerACL_IPv4MappedSourceNormalized verifies a v4-mapped v6
+// source prefix is normalized to v4 so a plain v4 packet matches it.
+func TestPeerACL_IPv4MappedSourceNormalized(t *testing.T) {
+	m := newTestManager(t)
+
+	mapped := netip.MustParseAddr("::ffff:192.168.1.1")
+	_, err := m.AddFilterRule(nil, []netip.Prefix{netip.PrefixFrom(mapped, mapped.BitLen())}, fw.Network{}, fw.ProtocolUDP, nil, &fw.Port{Values: []uint16{53}}, fw.ActionAccept)
+	require.NoError(t, err)
+
+	v4 := netip.MustParseAddr("192.168.1.1")
+	assert.Contains(t, m.incomingAcceptIndex.bySource, v4, "v4-mapped v6 source must be indexed as plain v4")
+}
diff --git a/client/firewall/uspfilter/peer_family_scope_test.go b/client/firewall/uspfilter/peer_family_scope_test.go
new file mode 100644
index 000000000..1cf3498fb
--- /dev/null
+++ b/client/firewall/uspfilter/peer_family_scope_test.go
@@ -0,0 +1,104 @@
+package uspfilter
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	fw "github.com/netbirdio/netbird/client/firewall/manager"
+)
+
+// peerACLCheck decodes the packet and runs it through the peer ACLs,
+// returning the attributed management rule id and the drop verdict.
+func peerACLCheck(t *testing.T, m *Manager, packet []byte) ([]byte, bool) {
+	t.Helper()
+	d := m.decoders.Get().(*decoder)
+	defer m.decoders.Put(d)
+	require.NoError(t, d.decodePacket(packet))
+	src, _ := m.extractIPs(d)
+	return m.peerACLsBlock(src, d, packet)
+}
+
+// TestPeerACL_MultiValuePortMatchesEachListedPort guards the multi-value
+// port path: a rule listing several discrete destination ports must
+// match a packet to each listed port and drop one that is not listed.
+// Management currently splits a multi-port policy into one rule per port
+// (and the wire format carries a single port), so this list shape is not
+// emitted today; the test locks correct matching in case that changes.
+func TestPeerACL_MultiValuePortMatchesEachListedPort(t *testing.T) {
+	m := newTestManager(t)
+
+	src := net.ParseIP("192.168.1.1")
+	ports := &fw.Port{Values: []uint16{80, 443}}
+	_, err := m.AddFilterRule(nil, pfx(src), fw.Network{}, fw.ProtocolTCP, nil, ports, fw.ActionAccept)
+	require.NoError(t, err, "add multi-value port rule")
+
+	for _, p := range []uint16{80, 443} {
+		_, blocked := peerACLCheck(t, m, createTestPacket(t, "192.168.1.1", "10.0.0.2", fw.ProtocolTCP, 12345, p))
+		assert.False(t, blocked, "packet to listed port %d must match the rule", p)
+	}
+
+	_, blocked := peerACLCheck(t, m, createTestPacket(t, "192.168.1.1", "10.0.0.2", fw.ProtocolTCP, 12345, 8080))
+	assert.True(t, blocked, "packet to a port not in the list must not match the rule")
+}
+
+// TestPeerACL_MatchAnyIsFamilyScoped verifies that a /0 source matches
+// only packets of its own family: 0.0.0.0/0 must not match IPv6 packets
+// and ::/0 must not match IPv4 packets, matching kernel backend
+// semantics.
+func TestPeerACL_MatchAnyIsFamilyScoped(t *testing.T) {
+	m := newTestManager(t)
+
+	v4Packet := createTestPacket(t, "10.0.0.1", "10.0.0.2", fw.ProtocolUDP, 12345, 53)
+	v6Packet := v6UDPPacket(t, "fd00::1", "fd00::100", 53)
+
+	v4Any := []netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)}
+	rule, err := m.AddFilterRule(nil, v4Any, fw.Network{}, fw.ProtocolALL, nil, nil, fw.ActionAccept)
+	require.NoError(t, err, "add v4 /0 rule")
+
+	_, blocked := peerACLCheck(t, m, v4Packet)
+	assert.False(t, blocked, "0.0.0.0/0 must match IPv4 packets")
+	_, blocked = peerACLCheck(t, m, v6Packet)
+	assert.True(t, blocked, "0.0.0.0/0 must not match IPv6 packets")
+
+	require.NoError(t, m.DeleteFilterRule(rule))
+
+	v6Any := []netip.Prefix{netip.PrefixFrom(netip.IPv6Unspecified(), 0)}
+	_, err = m.AddFilterRule(nil, v6Any, fw.Network{}, fw.ProtocolALL, nil, nil, fw.ActionAccept)
+	require.NoError(t, err, "add v6 /0 rule")
+
+	_, blocked = peerACLCheck(t, m, v6Packet)
+	assert.False(t, blocked, "::/0 must match IPv6 packets")
+	_, blocked = peerACLCheck(t, m, v4Packet)
+	assert.True(t, blocked, "::/0 must not match IPv4 packets")
+}
+
+// TestRouteACL_MixedFamilyZeroSourcesStayFamilySafe verifies the route
+// path keeps per-prefix family matching when a single rule carries both
+// 0.0.0.0/0 and ::/0 sources, as blockInvalidRouted does.
+func TestRouteACL_MixedFamilyZeroSourcesStayFamilySafe(t *testing.T) {
+	m := newTestManager(t)
+
+	sources := []netip.Prefix{
+		netip.PrefixFrom(netip.IPv4Unspecified(), 0),
+		netip.PrefixFrom(netip.IPv6Unspecified(), 0),
+	}
+
+	_, err := m.AddFilterRule(nil, sources, fw.Network{Prefix: netip.MustParsePrefix("10.0.0.0/24")},
+		fw.ProtocolALL, nil, nil, fw.ActionAccept)
+	require.NoError(t, err)
+	_, err = m.AddFilterRule(nil, sources, fw.Network{Prefix: netip.MustParsePrefix("fd00:1::/64")},
+		fw.ProtocolALL, nil, nil, fw.ActionAccept)
+	require.NoError(t, err)
+
+	v4Src := netip.MustParseAddr("192.168.1.1")
+	v6Src := netip.MustParseAddr("fd00::1")
+
+	_, pass := m.routeACLsPass(v4Src, netip.MustParseAddr("10.0.0.5"), 255, 0, 0)
+	assert.True(t, pass, "v4 source must match the v4 destination rule via 0.0.0.0/0")
+	_, pass = m.routeACLsPass(v6Src, netip.MustParseAddr("fd00:1::5"), 255, 0, 0)
+	assert.True(t, pass, "v6 source must match the v6 destination rule via ::/0")
+}
diff --git a/client/firewall/uspfilter/peer_index.go b/client/firewall/uspfilter/peer_index.go
new file mode 100644
index 000000000..552ffd2d7
--- /dev/null
+++ b/client/firewall/uspfilter/peer_index.go
@@ -0,0 +1,140 @@
+package uspfilter
+
+import (
+	"net/netip"
+	"slices"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+)
+
+// peerRuleIndex is the source-side dispatcher consulted on the packet
+// hot path. It splits rules into two buckets by the shape of their
+// source list:
+//
+//   - bySource: every source is a host prefix (/32 for v4, /128 for
+//     v6). Keyed by the concrete source address, so a hit guarantees
+//     the source filter passes and the matcher goes straight to
+//     proto/port checks. This is the common case for peer ACLs.
+//   - nonHost: any source list with a prefix coarser than a host,
+//     including a /0 "match any". Walked linearly with a per-rule
+//     Contains() check. Expected small or empty for typical peer ACLs.
+//
+// Maintained incrementally by add/remove, never rebuilt.
+type peerRuleIndex struct {
+	bySource map[netip.Addr][]*PeerRule
+	nonHost  []*PeerRule
+}
+
+func (i *peerRuleIndex) add(r *PeerRule) {
+	if hasNonHostSource(r) {
+		i.nonHost = append(i.nonHost, r)
+		return
+	}
+	if i.bySource == nil {
+		i.bySource = make(map[netip.Addr][]*PeerRule)
+	}
+	for a := range r.sourceAddrs {
+		i.bySource[a] = append(i.bySource[a], r)
+	}
+}
+
+func (i *peerRuleIndex) remove(r *PeerRule) {
+	if hasNonHostSource(r) {
+		i.nonHost = slices.DeleteFunc(i.nonHost, eqRule(r))
+		return
+	}
+	if i.bySource == nil {
+		return
+	}
+	for a := range r.sourceAddrs {
+		entries := slices.DeleteFunc(i.bySource[a], eqRule(r))
+		if len(entries) == 0 {
+			delete(i.bySource, a)
+		} else {
+			i.bySource[a] = entries
+		}
+	}
+}
+
+func (i *peerRuleIndex) reset() {
+	i.bySource = nil
+	i.nonHost = i.nonHost[:0]
+}
+
+// match returns the first rule matching src and the decoded packet.
+// Host rules are found by direct map lookup; nonHost rules run a
+// per-rule source Contains() check. Containment is family-scoped, so
+// a /0 source matches every address of its own family only (0.0.0.0/0
+// never matches v6 sources and ::/0 never matches v4). Within either
+// bucket the matcher runs the proto/port filter.
+func (i *peerRuleIndex) match(src netip.Addr, d *decoder) ([]byte, bool, bool) {
+	payloadLayer := d.decoded[1]
+
+	for _, rule := range i.bySource[src] {
+		if id, drop, ok := matchProto(rule, d, payloadLayer); ok {
+			return id, drop, true
+		}
+	}
+	for _, rule := range i.nonHost {
+		if !prefixesContain(rule.sources, src) {
+			continue
+		}
+		if id, drop, ok := matchProto(rule, d, payloadLayer); ok {
+			return id, drop, true
+		}
+	}
+	return nil, false, false
+}
+
+func eqRule(target *PeerRule) func(*PeerRule) bool {
+	return func(p *PeerRule) bool { return p == target }
+}
+
+// hasNonHostSource reports whether the rule has any source prefix
+// that is not a single host address. Called only at add/remove time,
+// not on the packet path.
+func hasNonHostSource(r *PeerRule) bool {
+	for _, p := range r.sources {
+		if p.Bits() != p.Addr().BitLen() {
+			return true
+		}
+	}
+	return false
+}
+
+// matchProto applies the proto/port half of a rule against the
+// decoded packet. Source matching is the caller's responsibility.
+func matchProto(rule *PeerRule, d *decoder, payloadLayer gopacket.LayerType) ([]byte, bool, bool) {
+	drop := rule.action == firewall.ActionDrop
+	if rule.protoLayer == layerTypeAll {
+		return rule.mgmtId, drop, true
+	}
+	if !protoLayerMatches(rule.protoLayer, payloadLayer) {
+		return nil, false, false
+	}
+	switch payloadLayer {
+	case layers.LayerTypeTCP:
+		if portsMatch(rule.srcPort, uint16(d.tcp.SrcPort)) && portsMatch(rule.dstPort, uint16(d.tcp.DstPort)) {
+			return rule.mgmtId, drop, true
+		}
+	case layers.LayerTypeUDP:
+		if portsMatch(rule.srcPort, uint16(d.udp.SrcPort)) && portsMatch(rule.dstPort, uint16(d.udp.DstPort)) {
+			return rule.mgmtId, drop, true
+		}
+	case layers.LayerTypeICMPv4, layers.LayerTypeICMPv6:
+		return rule.mgmtId, drop, true
+	}
+	return nil, false, false
+}
+
+func prefixesContain(sources []netip.Prefix, src netip.Addr) bool {
+	for _, p := range sources {
+		if p.Contains(src) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/client/firewall/uspfilter/rule.go b/client/firewall/uspfilter/rule.go
index 08d68a78e..6d73b19ac 100644
--- a/client/firewall/uspfilter/rule.go
+++ b/client/firewall/uspfilter/rule.go
@@ -10,24 +10,43 @@ import (
 
 // PeerRule to handle management of rules
 type PeerRule struct {
-	id         string
-	mgmtId     []byte
-	ip         netip.Addr
-	ipLayer    gopacket.LayerType
-	matchByIP  bool
-	protoLayer gopacket.LayerType
-	sPort      *firewall.Port
-	dPort      *firewall.Port
-	drop bool
+	id     firewall.RuleID
+	mgmtId []byte
+	// sources is the canonical list of source prefixes this rule
+	// matches against.
+	sources []netip.Prefix
+	// sourceAddrs is a fast-path membership set for host-prefix
+	// sources (/32 v4, /128 v6). Populated alongside sources;
+	// consulted before falling back to prefix scan.
+	sourceAddrs map[netip.Addr]struct{}
+	protoLayer  gopacket.LayerType
+	srcPort     *firewall.Port
+	dstPort     *firewall.Port
+	action      firewall.Action
+}
+
+// matchesSource reports whether the given source address is covered
+// by this rule's source list. Prefix containment is family-scoped, so
+// a /0 source matches every address of its own family only.
+func (r *PeerRule) matchesSource(src netip.Addr) bool {
+	if _, ok := r.sourceAddrs[src]; ok {
+		return true
+	}
+	for _, p := range r.sources {
+		if p.Contains(src) {
+			return true
+		}
+	}
+	return false
 }
 
 // ID returns the rule id
-func (r *PeerRule) ID() string {
+func (r *PeerRule) ID() firewall.RuleID {
 	return r.id
 }
 
 type RouteRule struct {
-	id           string
+	id           firewall.RuleID
 	mgmtId       []byte
 	sources      []netip.Prefix
 	dstSet       firewall.Set
@@ -39,6 +58,6 @@ type RouteRule struct {
 }
 
 // ID returns the rule id
-func (r *RouteRule) ID() string {
+func (r *RouteRule) ID() firewall.RuleID {
 	return r.id
 }
diff --git a/client/firewall/uspfilter/testhelpers_test.go b/client/firewall/uspfilter/testhelpers_test.go
new file mode 100644
index 000000000..a0760f5ba
--- /dev/null
+++ b/client/firewall/uspfilter/testhelpers_test.go
@@ -0,0 +1,50 @@
+package uspfilter
+
+import (
+	"net"
+	"net/netip"
+
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+)
+
+// countRulesForAddr reports how many rules in the given slice match
+// the supplied source address.
+func countRulesForAddr(rules peerRules, src netip.Addr) int {
+	n := 0
+	for _, r := range rules {
+		if r.matchesSource(src) {
+			n++
+		}
+	}
+	return n
+}
+
+// findRuleByID returns true if the rules slice contains a rule with
+// the given id whose source set covers src.
+func findRuleByID(rules peerRules, src netip.Addr, id firewall.RuleID) bool {
+	for _, r := range rules {
+		if r.id == id && r.matchesSource(src) {
+			return true
+		}
+	}
+	return false
+}
+
+// pfx converts a single net.IP into the []netip.Prefix form
+// AddFilterRule expects. A nil or unspecified address becomes a /0
+// ("match any") prefix in the matching family; any other address
+// becomes its /32 (or /128) host prefix.
+func pfx(ip net.IP) []netip.Prefix {
+	if ip == nil {
+		return []netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)}
+	}
+	if ip.IsUnspecified() {
+		if ip.To4() != nil {
+			return []netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)}
+		}
+		return []netip.Prefix{netip.PrefixFrom(netip.IPv6Unspecified(), 0)}
+	}
+	a, _ := netip.AddrFromSlice(ip)
+	a = a.Unmap()
+	return []netip.Prefix{netip.PrefixFrom(a, a.BitLen())}
+}
diff --git a/client/firewall/uspfilter/tracer.go b/client/firewall/uspfilter/tracer.go
index 696489e95..3c081314c 100644
--- a/client/firewall/uspfilter/tracer.go
+++ b/client/firewall/uspfilter/tracer.go
@@ -285,6 +285,14 @@ func (m *Manager) TracePacket(packetData []byte, direction fw.RuleDirection) *Pa
 	trace.SourceIP = srcIP
 	trace.DestinationIP = dstIP
 
+	// A fragment or otherwise truncated packet has no transport layer.
+	// The inbound datapath drops these via isValidPacket; the tracer must
+	// guard explicitly since every downstream stage reads d.decoded[1].
+	if len(d.decoded) < 2 {
+		trace.AddResult(StageReceived, "Packet has no transport layer (fragment or unsupported protocol)", false)
+		return trace
+	}
+
 	// Determine protocol and ports
 	switch d.decoded[1] {
 	case layers.LayerTypeTCP:
diff --git a/client/firewall/uspfilter/tracer_test.go b/client/firewall/uspfilter/tracer_test.go
index 657f96fc0..27b5e3f9e 100644
--- a/client/firewall/uspfilter/tracer_test.go
+++ b/client/firewall/uspfilter/tracer_test.go
@@ -45,7 +45,7 @@ func TestTracePacket(t *testing.T) {
 			},
 		}
 
-		m, err := Create(ifaceMock, false, flowLogger, iface.DefaultMTU)
+		m, err := Create(Config{IFace: ifaceMock, FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 		require.NoError(t, err)
 
 		if !statefulMode {
@@ -97,7 +97,7 @@ func TestTracePacket(t *testing.T) {
 				proto := fw.ProtocolTCP
 				port := &fw.Port{Values: []uint16{80}}
 				action := fw.ActionAccept
-				_, err := m.AddPeerFiltering(nil, ip, proto, nil, port, action, "")
+				_, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
 				require.NoError(t, err)
 			},
 			packetBuilder: func() *PacketBuilder {
@@ -121,7 +121,7 @@ func TestTracePacket(t *testing.T) {
 				proto := fw.ProtocolTCP
 				port := &fw.Port{Values: []uint16{80}}
 				action := fw.ActionDrop
-				_, err := m.AddPeerFiltering(nil, ip, proto, nil, port, action, "")
+				_, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
 				require.NoError(t, err)
 			},
 			packetBuilder: func() *PacketBuilder {
@@ -150,7 +150,7 @@ func TestTracePacket(t *testing.T) {
 				proto := fw.ProtocolTCP
 				port := &fw.Port{Values: []uint16{80}}
 				action := fw.ActionAccept
-				_, err := m.AddPeerFiltering(nil, ip, proto, nil, port, action, "")
+				_, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
 				require.NoError(t, err)
 			},
 			packetBuilder: func() *PacketBuilder {
@@ -178,7 +178,7 @@ func TestTracePacket(t *testing.T) {
 				proto := fw.ProtocolTCP
 				port := &fw.Port{Values: []uint16{80}}
 				action := fw.ActionAccept
-				_, err := m.AddPeerFiltering(nil, ip, proto, nil, port, action, "")
+				_, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
 				require.NoError(t, err)
 			},
 			packetBuilder: func() *PacketBuilder {
@@ -205,7 +205,7 @@ func TestTracePacket(t *testing.T) {
 
 				src := netip.PrefixFrom(netip.AddrFrom4([4]byte{1, 1, 1, 1}), 32)
 				dst := netip.PrefixFrom(netip.AddrFrom4([4]byte{192, 168, 17, 2}), 32)
-				_, err := m.AddRouteFiltering(nil, []netip.Prefix{src}, fw.Network{Prefix: dst}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept)
+				_, err := m.AddFilterRule(nil, []netip.Prefix{src}, fw.Network{Prefix: dst}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept)
 				require.NoError(t, err)
 			},
 			packetBuilder: func() *PacketBuilder {
@@ -231,7 +231,7 @@ func TestTracePacket(t *testing.T) {
 
 				src := netip.PrefixFrom(netip.AddrFrom4([4]byte{1, 1, 1, 1}), 32)
 				dst := netip.PrefixFrom(netip.AddrFrom4([4]byte{192, 168, 17, 2}), 32)
-				_, err := m.AddRouteFiltering(nil, []netip.Prefix{src}, fw.Network{Prefix: dst}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionDrop)
+				_, err := m.AddFilterRule(nil, []netip.Prefix{src}, fw.Network{Prefix: dst}, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionDrop)
 				require.NoError(t, err)
 			},
 			packetBuilder: func() *PacketBuilder {
@@ -332,7 +332,7 @@ func TestTracePacket(t *testing.T) {
 				ip := net.ParseIP("1.1.1.1")
 				proto := fw.ProtocolICMP
 				action := fw.ActionAccept
-				_, err := m.AddPeerFiltering(nil, ip, proto, nil, nil, action, "")
+				_, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, nil, action)
 				require.NoError(t, err)
 			},
 			packetBuilder: func() *PacketBuilder {
@@ -355,7 +355,7 @@ func TestTracePacket(t *testing.T) {
 				ip := net.ParseIP("1.1.1.1")
 				proto := fw.ProtocolICMP
 				action := fw.ActionDrop
-				_, err := m.AddPeerFiltering(nil, ip, proto, nil, nil, action, "")
+				_, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, nil, action)
 				require.NoError(t, err)
 			},
 			packetBuilder: func() *PacketBuilder {
@@ -379,7 +379,7 @@ func TestTracePacket(t *testing.T) {
 				proto := fw.ProtocolUDP
 				port := &fw.Port{Values: []uint16{53}}
 				action := fw.ActionAccept
-				_, err := m.AddPeerFiltering(nil, ip, proto, nil, port, action, "")
+				_, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
 				require.NoError(t, err)
 			},
 			packetBuilder: func() *PacketBuilder {
@@ -423,7 +423,7 @@ func TestTracePacket(t *testing.T) {
 				proto := fw.ProtocolTCP
 				port := &fw.Port{Values: []uint16{80}}
 				action := fw.ActionDrop
-				_, err := m.AddPeerFiltering(nil, ip, proto, nil, port, action, "")
+				_, err := m.AddFilterRule(nil, pfx(ip), fw.Network{}, proto, nil, port, action)
 				require.NoError(t, err)
 			},
 			packetBuilder: func() *PacketBuilder {
diff --git a/client/grpc/dialer_generic.go b/client/grpc/dialer_generic.go
index 479575996..72b3538ba 100644
--- a/client/grpc/dialer_generic.go
+++ b/client/grpc/dialer_generic.go
@@ -6,38 +6,54 @@ import (
 	"context"
 	"fmt"
 	"net"
-	"os/user"
+	"os"
 	"runtime"
 
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
 
 	nbnet "github.com/netbirdio/netbird/client/net"
+	"github.com/netbirdio/netbird/client/netevents/sweep"
 )
 
+// Sweeper registers in-flight dials for the network change sweep.
+type Sweeper interface {
+	StartDial(ctx context.Context) *sweep.Dial
+}
+
 func WithCustomDialer(_ bool, _ string) grpc.DialOption {
+	return grpc.WithContextDialer(dialContext)
+}
+
+// WithSweeper dials like WithCustomDialer but registers connections and
+// dials with the sweeper. Append it after WithCustomDialer: gRPC applies
+// dial options in order, so the later context dialer wins.
+func WithSweeper(sweeper Sweeper) grpc.DialOption {
 	return grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
-		if runtime.GOOS == "linux" {
-			currentUser, err := user.Current()
-			if err != nil {
-				return nil, status.Errorf(codes.FailedPrecondition, "failed to get current user: %v", err)
-			}
+		dial := sweeper.StartDial(ctx)
+		defer dial.Release()
 
-			// the custom dialer requires root permissions which are not required for use cases run as non-root
-			if currentUser.Uid != "0" {
-				log.Debug("Not running as root, using standard dialer")
-				dialer := &net.Dialer{}
-				return dialer.DialContext(ctx, "tcp", addr)
-			}
-		}
-
-		conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)
+		conn, err := dialContext(dial.Ctx(), addr)
 		if err != nil {
-			return nil, fmt.Errorf("nbnet.NewDialer().DialContext: %w", err)
+			return nil, err
 		}
-		return conn, nil
+		return dial.WrapConn(conn)
 	})
 }
+
+func dialContext(ctx context.Context, addr string) (net.Conn, error) {
+	// The custom dialer requires root permissions which are not required for
+	// use cases run as non-root. The effective UID is read directly: a passwd
+	// lookup fails without cgo for a UID that has no entry, as on OpenShift.
+	if runtime.GOOS == "linux" && os.Geteuid() != 0 {
+		log.Debug("Not running as root, using standard dialer")
+		dialer := &net.Dialer{}
+		return dialer.DialContext(ctx, "tcp", addr)
+	}
+
+	conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return nil, fmt.Errorf("nbnet.NewDialer().DialContext: %w", err)
+	}
+	return conn, nil
+}
diff --git a/client/grpc/dialer_js.go b/client/grpc/dialer_js.go
index b89ec3c21..4ff4ceb20 100644
--- a/client/grpc/dialer_js.go
+++ b/client/grpc/dialer_js.go
@@ -1,13 +1,26 @@
 package grpc
 
 import (
+	"context"
+
 	"google.golang.org/grpc"
 
+	"github.com/netbirdio/netbird/client/netevents/sweep"
 	"github.com/netbirdio/netbird/util/wsproxy/client"
 )
 
+// Sweeper registers in-flight dials for the network change sweep.
+type Sweeper interface {
+	StartDial(ctx context.Context) *sweep.Dial
+}
+
 // WithCustomDialer returns a gRPC dial option that uses WebSocket transport for WASM/JS environments.
 // The component parameter specifies the WebSocket proxy component path (e.g., "/management", "/signal").
 func WithCustomDialer(tlsEnabled bool, component string) grpc.DialOption {
 	return client.WithWebSocketDialer(tlsEnabled, component)
 }
+
+// WithSweeper is a no-op on WASM/JS: there is no network change signal.
+func WithSweeper(_ Sweeper) grpc.DialOption {
+	return grpc.EmptyDialOption{}
+}
diff --git a/client/grpc/retry.go b/client/grpc/retry.go
new file mode 100644
index 000000000..0bb6037bf
--- /dev/null
+++ b/client/grpc/retry.go
@@ -0,0 +1,56 @@
+package grpc
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+)
+
+// ChangeWatcher exposes OS network availability transitions.
+type ChangeWatcher interface {
+	Changed() <-chan struct{}
+}
+
+// Retry mirrors backoff.Retry, but the sleep between attempts also wakes on
+// OS network availability transitions: an operation cut down by a network
+// change retries the moment the network settles instead of sleeping through
+// the recovery. A nil watcher never fires, leaving plain backoff.Retry
+// behavior.
+func Retry(ctx context.Context, operation backoff.Operation, bo backoff.BackOff, watcher ChangeWatcher) error {
+	bo.Reset()
+	for {
+		err := operation()
+		if err == nil {
+			return nil
+		}
+
+		var permanent *backoff.PermanentError
+		if errors.As(err, &permanent) {
+			return permanent.Err
+		}
+
+		next := bo.NextBackOff()
+		if next == backoff.Stop {
+			if cerr := ctx.Err(); cerr != nil {
+				return cerr
+			}
+			return err
+		}
+
+		var changed <-chan struct{}
+		if watcher != nil {
+			changed = watcher.Changed()
+		}
+		timer := time.NewTimer(next)
+		select {
+		case <-timer.C:
+		case <-changed:
+			timer.Stop()
+		case <-ctx.Done():
+			timer.Stop()
+			return ctx.Err()
+		}
+	}
+}
diff --git a/client/grpc/retry_test.go b/client/grpc/retry_test.go
new file mode 100644
index 000000000..266bb93e5
--- /dev/null
+++ b/client/grpc/retry_test.go
@@ -0,0 +1,91 @@
+package grpc
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/netevents/netstate"
+)
+
+func TestRetryWakesOnNetworkChange(t *testing.T) {
+	ns := netstate.New()
+	attempts := 0
+	operation := func() error {
+		attempts++
+		if attempts == 1 {
+			return errors.New("cut by network change")
+		}
+		return nil
+	}
+
+	go func() {
+		time.Sleep(20 * time.Millisecond)
+		ns.Set(false)
+	}()
+
+	start := time.Now()
+	err := Retry(context.Background(), operation, backoff.NewConstantBackOff(time.Minute), ns)
+
+	require.NoError(t, err)
+	assert.Equal(t, 2, attempts, "network change must cause one immediate retry")
+	assert.Less(t, time.Since(start), time.Second, "the transition must cut the minute-long sleep short")
+}
+
+func TestRetryPermanentError(t *testing.T) {
+	sentinel := errors.New("permission denied")
+	operation := func() error {
+		return backoff.Permanent(sentinel)
+	}
+
+	err := Retry(context.Background(), operation, backoff.NewConstantBackOff(time.Millisecond), nil)
+	assert.ErrorIs(t, err, sentinel, "permanent errors must stop retries")
+}
+
+func TestRetryNilNetState(t *testing.T) {
+	attempts := 0
+	operation := func() error {
+		attempts++
+		if attempts < 3 {
+			return errors.New("transient")
+		}
+		return nil
+	}
+
+	err := Retry(context.Background(), operation, backoff.NewConstantBackOff(time.Millisecond), nil)
+	require.NoError(t, err)
+	assert.Equal(t, 3, attempts, "nil network state must preserve timed retries")
+}
+
+func TestRetryStops(t *testing.T) {
+	failure := errors.New("still failing")
+	operation := func() error {
+		return failure
+	}
+
+	err := Retry(context.Background(), operation, &backoff.StopBackOff{}, nil)
+	assert.ErrorIs(t, err, failure, "stop backoff must return the operation error")
+}
+
+func TestRetryCtxCancelDuringSleep(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	operation := func() error {
+		return errors.New("failing")
+	}
+
+	go func() {
+		time.Sleep(20 * time.Millisecond)
+		cancel()
+	}()
+
+	start := time.Now()
+	err := Retry(ctx, operation, backoff.NewConstantBackOff(time.Minute), netstate.New())
+
+	assert.ErrorIs(t, err, context.Canceled, "context cancellation must stop the retry loop")
+	assert.Less(t, time.Since(start), time.Second, "context cancellation must interrupt backoff sleep")
+}
diff --git a/client/iface/bind/ice_bind.go b/client/iface/bind/ice_bind.go
index 156450c61..cd1ed12f1 100644
--- a/client/iface/bind/ice_bind.go
+++ b/client/iface/bind/ice_bind.go
@@ -22,6 +22,16 @@ import (
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
+const (
+	// wgMsgTypeHandshakeInitiation is the lowest WireGuard message type.
+	wgMsgTypeHandshakeInitiation uint32 = 1
+	// wgMsgTypeTransport is the highest WireGuard message type.
+	wgMsgTypeTransport uint32 = 4
+	// wgMinMsgSize is the smallest WireGuard message: transport data with an empty
+	// payload, which is what a keepalive is.
+	wgMinMsgSize = 32
+)
+
 type receiverCreator struct {
 	iceBind *ICEBind
 }
@@ -47,10 +57,13 @@ type ICEBind struct {
 	endpoints   map[netip.Addr]net.Conn
 	endpointsMu sync.Mutex
 	recvChan    chan recvMessage
-	// every time when Close() is called (i.e. BindUpdate()) we need to close exit from the receiveRelayed and create a
-	// new closed channel. With the closedChanMu we can safely close the channel and create a new one
+	// Close() (i.e. BindUpdate()) closes closedChan to release receiveRelayed,
+	// and the following Open() installs a fresh one. closedChanMu guards both
+	// closedChan and closed: readers only ever hold it long enough to copy the
+	// channel, never across a blocking receive, so Open cannot be starved by a
+	// parked receiver.
 	closedChan       chan struct{}
-	closedChanMu     sync.RWMutex // protect the closeChan recreation from reading from it.
+	closedChanMu     sync.RWMutex
 	closed           bool
 	activityRecorder *ActivityRecorder
 
@@ -82,24 +95,41 @@ func NewICEBind(transportNet transport.Net, address wgaddr.Address, mtu uint16)
 }
 
 func (s *ICEBind) Open(uport uint16) ([]wgConn.ReceiveFunc, uint16, error) {
-	s.closed = false
 	s.closedChanMu.Lock()
-	s.closedChan = make(chan struct{})
-	s.closedChanMu.Unlock()
+	defer s.closedChanMu.Unlock()
+
+	// Open the underlying bind before touching any state, so a failure leaves
+	// the current generation exactly as it was. Publishing the new generation
+	// first would strand it: StdNetBind rejects an Open while it is already
+	// open, and a Close arriving in that window would mark the bind closed
+	// while this call went on to install live sockets, after which every later
+	// Close returns early and never shuts them down.
 	fns, port, err := s.StdNetBind.Open(uport)
 	if err != nil {
 		return nil, 0, err
 	}
+
+	// Release whoever is parked on the outgoing generation before replacing it.
+	// An Open that follows an Open rather than a Close would otherwise leave
+	// them waiting on a channel no later Close can reach.
+	if !s.closed {
+		close(s.closedChan)
+	}
+	s.closed = false
+	s.closedChan = make(chan struct{})
+
 	fns = append(fns, s.receiveRelayed)
 	return fns, port, nil
 }
 
 func (s *ICEBind) Close() error {
+	s.closedChanMu.Lock()
+	defer s.closedChanMu.Unlock()
+
 	if s.closed {
 		return nil
 	}
 	s.closed = true
-
 	close(s.closedChan)
 
 	s.muUDPMux.Lock()
@@ -111,6 +141,15 @@ func (s *ICEBind) Close() error {
 	return s.StdNetBind.Close()
 }
 
+// currentClosedChan copies the channel that signals the current Open
+// generation is closing. Callers select on the copy so the lock is never held
+// across a blocking receive, which would otherwise stall the next Open.
+func (s *ICEBind) currentClosedChan() chan struct{} {
+	s.closedChanMu.RLock()
+	defer s.closedChanMu.RUnlock()
+	return s.closedChan
+}
+
 func (s *ICEBind) ActivityRecorder() *ActivityRecorder {
 	return s.activityRecorder
 }
@@ -140,8 +179,10 @@ func (b *ICEBind) RemoveEndpoint(fakeIP netip.Addr) {
 }
 
 func (b *ICEBind) ReceiveFromEndpoint(ctx context.Context, ep *Endpoint, buf []byte) {
+	closedChan := b.currentClosedChan()
+
 	select {
-	case <-b.closedChan:
+	case <-closedChan:
 		return
 	case <-ctx.Done():
 		return
@@ -216,8 +257,15 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 		for i := 0; i < numMsgs; i++ {
 			msg := &(*msgs)[i]
 
-			// todo: handle err
-			if ok, _ := s.filterOutStunMessages(msg.Buffers, msg.N, msg.Addr); ok {
+			if ok, err := s.filterOutStunMessages(msg.Buffers, msg.N, msg.Addr); ok {
+				if err != nil {
+					log.Debugf("failed to handle STUN packet from %s: %v", msg.Addr, err)
+				}
+				// WireGuard reuses sizes and eps across reads and only skips a slot
+				// whose size is below the minimum message size. Leaving a consumed
+				// slot untouched makes it process this buffer again under the
+				// previous packet's length and endpoint.
+				sizes[i] = 0
 				continue
 			}
 			sizes[i] = msg.N
@@ -271,11 +319,16 @@ func (s *ICEBind) createOrUpdateMux() {
 
 func (s *ICEBind) filterOutStunMessages(buffers [][]byte, n int, addr net.Addr) (bool, error) {
 	for i := range buffers {
-		if !stun.IsMessage(buffers[i]) {
+		if n > len(buffers[i]) {
+			continue
+		}
+		pkt := buffers[i][:n]
+
+		if isWireGuardMsg(pkt) || !stun.IsMessage(pkt) {
 			continue
 		}
 
-		msg, err := s.parseSTUNMessage(buffers[i][:n])
+		msg, err := s.parseSTUNMessage(pkt)
 		if err != nil {
 			buffers[i] = []byte{}
 			return true, err
@@ -311,11 +364,10 @@ func (s *ICEBind) parseSTUNMessage(raw []byte) (*stun.Message, error) {
 // receiveRelayed is a receive function that is used to receive packets from the relayed connection and forward to the
 // WireGuard. Critical part is do not block if the Closed() has been called.
 func (c *ICEBind) receiveRelayed(buffs [][]byte, sizes []int, eps []wgConn.Endpoint) (int, error) {
-	c.closedChanMu.RLock()
-	defer c.closedChanMu.RUnlock()
+	closedChan := c.currentClosedChan()
 
 	select {
-	case <-c.closedChan:
+	case <-closedChan:
 		return 0, net.ErrClosed
 	case msg, ok := <-c.recvChan:
 		if !ok {
@@ -347,18 +399,34 @@ func putMessages(msgs *[]ipv6.Message, msgsPool *sync.Pool) {
 	msgsPool.Put(msgs)
 }
 
-func isTransportPkg(buffers [][]byte, n int) bool {
-	// The first buffer should contain at least 4 bytes for type
-	if len(buffers[0]) < 4 {
-		return true
+// isWireGuardMsg reports whether the packet carries a WireGuard message header: a
+// little-endian uint32 message type in the range 1..4, which leaves the three bytes
+// after the type byte zero, in a packet long enough to hold any WireGuard message.
+//
+// A well formed STUN message cannot take that shape. Its length field sits in the two
+// bytes the type must leave zero, and for a message of at least wgMinMsgSize bytes that
+// field holds at least 12, so the two framings do not overlap. The test has to be this
+// tight because stun.IsMessage only looks at the magic cookie, which in a WireGuard
+// message overlaps the receiver index: a session whose index happens to equal the cookie
+// would otherwise have all of its inbound data misrouted to the STUN handler until the
+// next rekey.
+func isWireGuardMsg(pkt []byte) bool {
+	if len(pkt) < wgMinMsgSize {
+		return false
 	}
 
-	// WireGuard packet type is a little-endian uint32 at start
-	packetType := binary.LittleEndian.Uint32(buffers[0][:4])
+	msgType := binary.LittleEndian.Uint32(pkt[:4])
+	return msgType >= wgMsgTypeHandshakeInitiation && msgType <= wgMsgTypeTransport
+}
 
-	// Check if packetType matches known WireGuard message types
-	if packetType == 4 && n > 32 {
-		return true
+// isTransportPkg reports whether the packet is WireGuard transport data carrying a
+// payload, which is what counts as peer activity. A keepalive holds no payload and is
+// exactly wgMinMsgSize bytes.
+func isTransportPkg(buffers [][]byte, n int) bool {
+	if n < 4 || n > len(buffers[0]) {
+		return false
 	}
-	return false
+
+	msgType := binary.LittleEndian.Uint32(buffers[0][:4])
+	return msgType == wgMsgTypeTransport && n > wgMinMsgSize
 }
diff --git a/client/iface/bind/ice_bind_close_test.go b/client/iface/bind/ice_bind_close_test.go
new file mode 100644
index 000000000..829d27663
--- /dev/null
+++ b/client/iface/bind/ice_bind_close_test.go
@@ -0,0 +1,261 @@
+package bind
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	wgConn "golang.zx2c4.com/wireguard/conn"
+)
+
+// startReceivers runs every receive function the way wireguard-go's device
+// does: one goroutine per function, all tracked by a single WaitGroup. After
+// calling Bind.Close, closeBindLocked waits on exactly that WaitGroup while
+// holding device.net, so a receive function that never returns wedges the
+// device and every goroutine that needs the same lock.
+func startReceivers(fns []wgConn.ReceiveFunc) *sync.WaitGroup {
+	wg, _ := startReceiversEntered(fns)
+	return wg
+}
+
+// startReceiversEntered also returns a channel closed once every receive
+// function has been called at least once. A receive function that has been
+// entered is either inside its blocking receive or about to be, which is a
+// stronger signal to synchronise on than a bare sleep.
+func startReceiversEntered(fns []wgConn.ReceiveFunc) (*sync.WaitGroup, <-chan struct{}) {
+	var wg sync.WaitGroup
+	var entered sync.WaitGroup
+	wg.Add(len(fns))
+	entered.Add(len(fns))
+
+	for i := range fns {
+		go func(fn wgConn.ReceiveFunc) {
+			defer wg.Done()
+			buffs := [][]byte{make([]byte, 1500)}
+			sizes := make([]int, 1)
+			eps := make([]wgConn.Endpoint, 1)
+			first := true
+			for {
+				if first {
+					entered.Done()
+					first = false
+				}
+				if _, err := fn(buffs, sizes, eps); err != nil {
+					return
+				}
+			}
+		}(fns[i])
+	}
+
+	allEntered := make(chan struct{})
+	go func() {
+		entered.Wait()
+		close(allEntered)
+	}()
+	return &wg, allEntered
+}
+
+// closeBounded runs Close off the caller's goroutine so a regression that
+// wedges it fails the test instead of hanging teardown, and reports whether it
+// returned in time.
+func closeBounded(iceBind *ICEBind, timeout time.Duration) bool {
+	done := make(chan struct{})
+	go func() {
+		_ = iceBind.Close()
+		close(done)
+	}()
+	select {
+	case <-done:
+		return true
+	case <-time.After(timeout):
+		return false
+	}
+}
+
+// isClosed reports whether the bind's current generation channel is closed.
+func isClosed(iceBind *ICEBind) bool {
+	iceBind.closedChanMu.RLock()
+	ch := iceBind.closedChan
+	iceBind.closedChanMu.RUnlock()
+	select {
+	case <-ch:
+		return true
+	default:
+		return false
+	}
+}
+
+// receiversStopped reports whether every receive function returned before the
+// timeout, mirroring device.net.stopping.Wait() inside closeBindLocked.
+func receiversStopped(wg *sync.WaitGroup, timeout time.Duration) bool {
+	done := make(chan struct{})
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+	select {
+	case <-done:
+		return true
+	case <-time.After(timeout):
+		return false
+	}
+}
+
+// TestICEBindCloseReleasesReceivers covers the contract closeBindLocked relies
+// on: once Close returns, every receive function handed out by Open must stop.
+func TestICEBindCloseReleasesReceivers(t *testing.T) {
+	iceBind := setupICEBind(t)
+
+	fns, _, err := iceBind.Open(0)
+	require.NoError(t, err, "opening the bind must succeed")
+
+	wg := startReceivers(fns)
+	require.NoError(t, iceBind.Close())
+
+	require.True(t, receiversStopped(wg, 5*time.Second),
+		"every receive function must return once Close returns")
+}
+
+// TestICEBindOpenDoesNotBlockOnParkedReceiver reproduces the deadlock that
+// wedges interface creation.
+//
+// receiveRelayed used to hold closedChanMu for the whole of its blocking
+// select, so a parked receiver kept the read lock indefinitely. Open takes the
+// same mutex for writing to install a fresh closedChan, so it could never
+// acquire it while a receiver was parked. wireguard-go reaches Open from
+// Device.IpcSet and Device.Up with device.net held, so the stall takes the
+// device's lock with it and every other device goroutine queues behind it.
+//
+// Failing here means Open never returned.
+func TestICEBindOpenDoesNotBlockOnParkedReceiver(t *testing.T) {
+	iceBind := setupICEBind(t)
+
+	fns, _, err := iceBind.Open(0)
+	require.NoError(t, err, "the first Open must succeed")
+
+	wg, entered := startReceiversEntered(fns)
+	t.Cleanup(func() {
+		// Both bounded: a regression that wedges Close must surface as the
+		// assertion below, not as a hung teardown.
+		if !closeBounded(iceBind, 5*time.Second) {
+			t.Error("Close did not return during teardown; the bind lifecycle is wedged even though the assertion above passed")
+		}
+		if !receiversStopped(wg, 5*time.Second) {
+			t.Error("receive functions were still running after teardown Close, which is what closeBindLocked blocks on")
+		}
+	})
+
+	select {
+	case <-entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("receive functions never started")
+	}
+	// Entered is not yet parked, so still allow the blocking receive to be
+	// reached. Parking takes microseconds; this margin is six orders larger.
+	time.Sleep(500 * time.Millisecond)
+
+	reopened := make(chan struct{})
+	go func() {
+		// The error is irrelevant; StdNetBind rejects a second Open. What
+		// matters is that the call returns at all.
+		_, _, _ = iceBind.Open(0)
+		close(reopened)
+	}()
+
+	select {
+	case <-reopened:
+	case <-time.After(10 * time.Second):
+		t.Fatal("Open blocked while a receive function was parked; wireguard-go makes this call with device.net held, which is what stalls interface creation")
+	}
+}
+
+// TestICEBindConcurrentOpenClose exercises Open and Close from separate
+// goroutines, the way Device.IpcSet and Device.Up reach the bind, and is meant
+// to be run under -race.
+//
+// closed and closedChan must be updated together. When they were not, Close
+// could observe a stale closed and either skip close(closedChan) and
+// StdNetBind.Close entirely, leaving the receive functions running, or race a
+// second Close and close the same channel twice.
+//
+// Receive functions are deliberately not started here: this test is about the
+// shared state, and parking them would turn a race report into a hang.
+func TestICEBindConcurrentOpenClose(t *testing.T) {
+	iceBind := setupICEBind(t)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	// Release both loops together so the calls genuinely interleave rather
+	// than depending on goroutine start order.
+	start := make(chan struct{})
+
+	go func() {
+		defer wg.Done()
+		<-start
+		for i := 0; i < 200; i++ {
+			_, _, _ = iceBind.Open(0)
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		<-start
+		for i := 0; i < 200; i++ {
+			_ = iceBind.Close()
+		}
+	}()
+
+	close(start)
+	wg.Wait()
+	require.NoError(t, iceBind.Close())
+	require.True(t, isClosed(iceBind), "the final Close must leave the current generation channel closed")
+}
+
+// TestICEBindCloseReleasesReceiversUnderConcurrentClose runs full Open, receive,
+// Close cycles with a second Close and an Open racing the first Close. Any
+// iteration where the receive functions outlive Close, or where the surviving
+// generation channel is left open, is the state closeBindLocked deadlocks on.
+func TestICEBindCloseReleasesReceiversUnderConcurrentClose(t *testing.T) {
+	if testing.Short() {
+		t.Skip("stress test")
+	}
+
+	for i := 0; i < 200; i++ {
+		iceBind := setupICEBind(t)
+
+		fns, _, err := iceBind.Open(0)
+		require.NoError(t, err, "iteration %d: opening the bind must succeed", i)
+		wg := startReceivers(fns)
+
+		start := make(chan struct{})
+		var racers sync.WaitGroup
+		racers.Add(3)
+		for c := 0; c < 2; c++ {
+			go func() {
+				defer racers.Done()
+				<-start
+				_ = iceBind.Close()
+			}()
+		}
+		// An Open overlapping the Closes is what produces a generation whose
+		// channel outlives the flag saying the bind is closed.
+		go func() {
+			defer racers.Done()
+			<-start
+			_, _, _ = iceBind.Open(0)
+		}()
+		close(start)
+		racers.Wait()
+
+		// Settle on a closed bind whatever order the racers landed in.
+		_ = iceBind.Close()
+
+		if !receiversStopped(wg, 5*time.Second) {
+			t.Fatalf("iteration %d: receive functions still running after Close; closeBindLocked would block here on device.net.stopping.Wait", i)
+		}
+		if !isClosed(iceBind) {
+			t.Fatalf("iteration %d: Close returned with the current generation channel still open, so nothing will ever release its receivers", i)
+		}
+	}
+}
diff --git a/client/iface/bind/ice_bind_test.go b/client/iface/bind/ice_bind_test.go
index 0b8db7640..8dd82d7df 100644
--- a/client/iface/bind/ice_bind_test.go
+++ b/client/iface/bind/ice_bind_test.go
@@ -2,17 +2,22 @@ package bind
 
 import (
 	"fmt"
+	"io"
 	"net"
 	"net/netip"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
+	"github.com/pion/transport/v3"
 	"github.com/pion/transport/v3/stdnet"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/ipv4"
 	"golang.org/x/net/ipv6"
+	"golang.zx2c4.com/wireguard/device"
+	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
@@ -326,3 +331,86 @@ func listenUDP(t *testing.T, network, addr string) *net.UDPConn {
 	require.NoError(t, err)
 	return conn
 }
+
+type countingNet struct {
+	transport.Net
+	calls  atomic.Int64
+	ifaces []*transport.Interface
+	before func()
+}
+
+func (n *countingNet) Interfaces() ([]*transport.Interface, error) {
+	n.calls.Add(1)
+	if n.before != nil {
+		n.before()
+	}
+	return n.ifaces, nil
+}
+
+func TestICEBind_OpenDoesNotDiscoverInterfaces(t *testing.T) {
+	n := newCountingNet()
+	iceBind := NewICEBind(n, testAddress(), 1280)
+
+	for i := 0; i < 2; i++ {
+		_, port, err := iceBind.Open(0)
+		require.NoError(t, err)
+		require.NotZero(t, port, "the bind listens on a port")
+		assert.Equal(t, int64(0), n.calls.Load(), "opening the bind must not enumerate interfaces, attempt %d", i+1)
+		require.NoError(t, iceBind.Close())
+	}
+
+	_, _, err := iceBind.Open(0)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = iceBind.Close() })
+
+	mux, err := iceBind.GetICEMux()
+	require.NoError(t, err)
+	assert.NotEmpty(t, mux.SingleSocketUDPMux.GetListenAddresses(), "listen addresses come from the discovered interfaces")
+	assert.Equal(t, int64(1), n.calls.Load(), "interfaces are discovered when the listen addresses are asked for")
+}
+
+func TestICEBind_DeviceUpDoesNotWaitOnInterfaceDiscovery(t *testing.T) {
+	tunDev, _, err := netstack.CreateNetTUN([]netip.Addr{netip.MustParseAddr("100.64.0.1")}, nil, 1280)
+	require.NoError(t, err)
+
+	var dev *device.Device
+	n := newCountingNet()
+	n.before = func() {
+		_ = dev.IpcGetOperation(io.Discard)
+	}
+	iceBind := NewICEBind(n, testAddress(), 1280)
+	dev = device.NewDevice(tunDev, iceBind, device.NewLogger(device.LogLevelSilent, ""))
+
+	upDone := make(chan error, 1)
+	go func() {
+		upDone <- dev.Up()
+	}()
+
+	select {
+	case err := <-upDone:
+		require.NoError(t, err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("device Up did not return: interface discovery ran under the device lock and waited on the device itself")
+	}
+	t.Cleanup(dev.Close)
+
+	assert.Equal(t, int64(0), n.calls.Load(), "bringing the device up must not enumerate interfaces")
+
+	mux, err := iceBind.GetICEMux()
+	require.NoError(t, err)
+	assert.NotEmpty(t, mux.SingleSocketUDPMux.GetListenAddresses(), "discovery that talks to the device succeeds once the device is up")
+	assert.Equal(t, int64(1), n.calls.Load(), "interfaces are discovered outside the device lock")
+}
+
+func newCountingNet() *countingNet {
+	ifc := transport.NewInterface(net.Interface{Index: 1, MTU: 1500, Name: "eth0", Flags: net.FlagUp | net.FlagMulticast})
+	ifc.AddAddress(&net.IPNet{IP: net.IPv4(192, 168, 1, 10), Mask: net.CIDRMask(24, 32)})
+	return &countingNet{ifaces: []*transport.Interface{ifc}}
+}
+
+func testAddress() wgaddr.Address {
+	return wgaddr.Address{
+		IP:      netip.MustParseAddr("100.64.0.1"),
+		Network: netip.MustParsePrefix("100.64.0.0/10"),
+	}
+}
diff --git a/client/iface/bind/stun_filter_test.go b/client/iface/bind/stun_filter_test.go
new file mode 100644
index 000000000..0e118e0fd
--- /dev/null
+++ b/client/iface/bind/stun_filter_test.go
@@ -0,0 +1,215 @@
+//go:build !js
+
+package bind
+
+import (
+	"encoding/binary"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/pion/stun/v3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/ipv4"
+	wgConn "golang.zx2c4.com/wireguard/conn"
+)
+
+// magicCookieBytes is the STUN magic cookie as it appears on the wire. In a
+// WireGuard message the same offset holds the receiver (or sender) index, which is
+// a random uint32, so a session can draw exactly this value.
+var magicCookieBytes = []byte{0x21, 0x12, 0xA4, 0x42}
+
+const testBufSize = 1500
+
+// wgMsg builds a WireGuard message of the given type and size, with the index field
+// at bytes 4:8 set to index.
+func wgMsg(msgType uint32, size int, index []byte) []byte {
+	pkt := make([]byte, size)
+	binary.LittleEndian.PutUint32(pkt[:4], msgType)
+	copy(pkt[4:8], index)
+	return pkt
+}
+
+// intoBuffer copies pkt into a full-size receive buffer, the way the kernel read
+// does, so tests see the same buffer/length split as the hot path.
+func intoBuffer(pkt []byte) [][]byte {
+	buf := make([]byte, testBufSize)
+	copy(buf, pkt)
+	return [][]byte{buf}
+}
+
+func TestFilterOutStunMessages_PassesWireGuardWithCookieShapedIndex(t *testing.T) {
+	tests := []struct {
+		name    string
+		msgType uint32
+		size    int
+	}{
+		{"transport data", wgMsgTypeTransport, 128},
+		{"keepalive", wgMsgTypeTransport, wgMinMsgSize},
+		{"handshake initiation", wgMsgTypeHandshakeInitiation, 148},
+		{"handshake response", 2, 92},
+		{"cookie reply", 3, 64},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			pkt := wgMsg(tc.msgType, tc.size, magicCookieBytes)
+			require.True(t, stun.IsMessage(pkt), "precondition: pion sees this as STUN")
+
+			buffers := intoBuffer(pkt)
+			bind := &ICEBind{}
+
+			filtered, err := bind.filterOutStunMessages(buffers, tc.size, &net.UDPAddr{})
+			assert.NoError(t, err)
+			assert.False(t, filtered, "WireGuard message must be handed to WireGuard, not the STUN handler")
+			assert.Len(t, buffers[0], testBufSize, "buffer must be left intact for WireGuard")
+		})
+	}
+}
+
+func TestFilterOutStunMessages_FiltersRealSTUNMessage(t *testing.T) {
+	msg, err := stun.Build(stun.BindingRequest, stun.TransactionID, stun.Fingerprint)
+	require.NoError(t, err)
+
+	buffers := intoBuffer(msg.Raw)
+	bind := &ICEBind{}
+
+	filtered, err := bind.filterOutStunMessages(buffers, len(msg.Raw), &net.UDPAddr{})
+	assert.NoError(t, err)
+	assert.True(t, filtered, "STUN message must be consumed by the STUN handler")
+	assert.Empty(t, buffers[0], "consumed buffer must be emptied so WireGuard does not see it")
+}
+
+// TestIsWireGuardMsg_DisjointFromSTUN locks the invariant the filter relies on: a
+// well formed STUN message long enough to be a WireGuard message always has a
+// non-zero length field, so it cannot be mistaken for a WireGuard header.
+func TestIsWireGuardMsg_DisjointFromSTUN(t *testing.T) {
+	types := []stun.MessageType{
+		stun.BindingRequest,
+		stun.BindingSuccess,
+		stun.BindingError,
+		{Method: stun.MethodBinding, Class: stun.ClassIndication},
+	}
+
+	for _, msgType := range types {
+		// Long enough that the length guard is not what makes this pass.
+		msg, err := stun.Build(msgType, stun.TransactionID,
+			stun.NewUsername("remoteUfrag:localUfrag"), stun.Fingerprint)
+		require.NoError(t, err)
+		require.GreaterOrEqual(t, len(msg.Raw), wgMinMsgSize, "precondition: %s", msgType)
+		assert.False(t, isWireGuardMsg(msg.Raw),
+			"%s must not look like a WireGuard message", msgType)
+	}
+}
+
+func TestIsWireGuardMsg(t *testing.T) {
+	tests := []struct {
+		name string
+		pkt  []byte
+		want bool
+	}{
+		{"transport data", wgMsg(wgMsgTypeTransport, 128, nil), true},
+		{"handshake initiation", wgMsg(wgMsgTypeHandshakeInitiation, 148, nil), true},
+		{"unknown type 5", wgMsg(5, 128, nil), false},
+		{"type 0", wgMsg(0, 128, nil), false},
+		{"non-zero reserved byte", []byte{0x04, 0x00, 0x01, 0x00}, false},
+		{"too short", []byte{0x04, 0x00, 0x00}, false},
+		{"empty", nil, false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, isWireGuardMsg(tc.pkt), "wrong classification for %s", tc.name)
+		})
+	}
+}
+
+// TestFilterOutStunMessages_IgnoresBytesBeyondPacket guards against classifying on
+// buffer contents left over from an earlier, longer packet.
+func TestFilterOutStunMessages_IgnoresBytesBeyondPacket(t *testing.T) {
+	buf := make([]byte, testBufSize)
+	copy(buf[4:8], magicCookieBytes)
+	buffers := [][]byte{buf}
+	bind := &ICEBind{}
+
+	filtered, err := bind.filterOutStunMessages(buffers, 2, &net.UDPAddr{})
+	assert.NoError(t, err)
+	assert.False(t, filtered, "a 2 byte packet must not be classified from stale buffer bytes")
+}
+
+// TestReceiveFn_ClearsSizeOfConsumedPacket covers the accounting WireGuard relies
+// on: sizes is reused across reads, so a slot whose packet was consumed as STUN must
+// be reported as empty. Otherwise WireGuard reprocesses the same buffer under the
+// previous packet's length, which for a WireGuard-shaped packet means it is handled
+// twice.
+func TestReceiveFn_ClearsSizeOfConsumedPacket(t *testing.T) {
+	conn := listenUDP(t, "udp4", "127.0.0.1:0")
+	defer conn.Close()
+
+	recvFn := receiverCreator{setupICEBind(t)}.CreateReceiverFn(
+		ipv4.NewPacketConn(conn), conn, false, createMsgPool(),
+	)
+
+	msg, err := stun.Build(stun.BindingRequest, stun.TransactionID, stun.Fingerprint)
+	require.NoError(t, err)
+
+	sender := listenUDP(t, "udp4", "127.0.0.1:0")
+	defer sender.Close()
+	_, err = sender.WriteTo(msg.Raw, conn.LocalAddr())
+	require.NoError(t, err)
+
+	require.NoError(t, conn.SetReadDeadline(time.Now().Add(3*time.Second)))
+
+	bufs := [][]byte{make([]byte, 1500)}
+	// A leftover size from an earlier read, which is what makes the missing reset
+	// observable.
+	sizes := []int{148}
+	eps := make([]wgConn.Endpoint, 1)
+
+	n, err := recvFn(bufs, sizes, eps)
+	require.NoError(t, err)
+	require.Equal(t, 1, n)
+	assert.Zero(t, sizes[0], "consumed STUN packet must not leave a size behind for WireGuard")
+}
+
+func TestIsTransportPkg(t *testing.T) {
+	tests := []struct {
+		name string
+		pkt  []byte
+		n    int
+		want bool
+	}{
+		{"transport data with payload", wgMsg(wgMsgTypeTransport, 128, nil), 128, true},
+		{"keepalive", wgMsg(wgMsgTypeTransport, wgMinMsgSize, nil), wgMinMsgSize, false},
+		{"handshake initiation", wgMsg(wgMsgTypeHandshakeInitiation, 148, nil), 148, false},
+		{"stale type bytes beyond packet", wgMsg(wgMsgTypeTransport, 128, nil), 2, false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, isTransportPkg(intoBuffer(tc.pkt), tc.n),
+				"wrong activity classification for %s", tc.name)
+		})
+	}
+}
+
+// TestFilterOutStunMessages_ConsumesSTUNWithWireGuardShapedType covers the one STUN
+// encoding whose leading bytes collide with a WireGuard message type: method 0x080 as a
+// request encodes to 0x0200, so the type byte reads as a handshake response and the byte
+// after it is zero. Only the length check keeps such a message out of WireGuard's hands.
+// pion implements no method in that range, so this is a synthetic worst case rather than
+// traffic ICE produces.
+func TestFilterOutStunMessages_ConsumesSTUNWithWireGuardShapedType(t *testing.T) {
+	msg, err := stun.Build(stun.NewType(stun.Method(0x080), stun.ClassRequest), stun.TransactionID)
+	require.NoError(t, err)
+	require.Equal(t, []byte{0x02, 0x00, 0x00, 0x00}, msg.Raw[:4],
+		"precondition: the leading bytes read as a WireGuard message type")
+
+	buffers := intoBuffer(msg.Raw)
+	bind := &ICEBind{}
+
+	filtered, err := bind.filterOutStunMessages(buffers, len(msg.Raw), &net.UDPAddr{})
+	assert.NoError(t, err)
+	assert.True(t, filtered, "STUN message must be consumed despite its WireGuard-shaped type")
+}
diff --git a/client/iface/configurer/allowedips.go b/client/iface/configurer/allowedips.go
new file mode 100644
index 000000000..08a766ee0
--- /dev/null
+++ b/client/iface/configurer/allowedips.go
@@ -0,0 +1,201 @@
+//go:build (linux && !android) || freebsd
+
+package configurer
+
+import (
+	"net"
+	"net/netip"
+	"slices"
+	"sync"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// allowedIPStore mirrors the allowed IPs configured on each peer of a device.
+//
+// A configurer is the only writer of its device's peer set, so the mirror is authoritative
+// by construction. It spares the paths that have to rewrite one peer's allowed IPs a full
+// device dump just to recover prefixes the process already configured itself.
+//
+// An allowed IP belongs to exactly one peer: configuring a prefix on a peer takes it away
+// from whichever peer held it before, and the configurer leaves that handover to the device
+// rather than removing the prefix from the previous holder itself. The store tracks the
+// owner of each prefix and performs the same handover, so rewriting one peer's list never
+// takes a prefix back from the peer that owns it now.
+//
+// Its own lock guards the map alone, not the device write it accompanies. Consistency
+// between the two rests on the caller serializing every configurer call, which WGIface
+// does with its mutex; two unserialized writers would interleave a device write with the
+// record of a different one.
+//
+// An operator reconfiguring the device out of band, through `wg set` or the UAPI socket,
+// is the one way the mirror can still go stale. A peer missing from it falls back to the
+// device, which reseats that peer's prefixes and their ownership; a peer that is present
+// does not, so one recorded from empty while the device already held prefixes keeps only
+// what was recorded, and the next endpoint removal drops the rest.
+type allowedIPStore struct {
+	mu     sync.RWMutex
+	peers  map[wgtypes.Key][]netip.Prefix
+	owners map[netip.Prefix]wgtypes.Key
+}
+
+func newAllowedIPStore() *allowedIPStore {
+	return &allowedIPStore{
+		peers:  make(map[wgtypes.Key][]netip.Prefix),
+		owners: make(map[netip.Prefix]wgtypes.Key),
+	}
+}
+
+// get returns the prefixes recorded for a peer, and whether the peer is known at all.
+// The caller receives a copy and may retain or modify it freely.
+func (s *allowedIPStore) get(key wgtypes.Key) ([]netip.Prefix, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	prefixes, ok := s.peers[key]
+	if !ok {
+		return nil, false
+	}
+	return slices.Clone(prefixes), true
+}
+
+// set replaces the prefixes recorded for a peer.
+func (s *allowedIPStore) set(key wgtypes.Key, prefixes []netip.Prefix) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	k := key
+	s.releaseLocked(k)
+
+	normalized := normalizePrefixes(prefixes)
+	for _, prefix := range normalized {
+		s.claimLocked(k, prefix)
+	}
+	s.peers[k] = normalized
+}
+
+// add records prefixes on a peer without dropping the ones already there, matching the
+// union semantics of a peer update that does not replace its allowed IPs. It records the
+// peer if it is not known yet, so it belongs to the operations that create a peer on the
+// device rather than to the update-only ones.
+func (s *allowedIPStore) add(key wgtypes.Key, prefixes []netip.Prefix) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.mergeLocked(key, prefixes)
+}
+
+// addExisting is add for an update-only device operation. Such an operation is a silent
+// no-op when the peer is absent, so recording a peer here would leave the store claiming
+// prefixes the device never took, and the peer would then be recreated by the next endpoint
+// removal, stealing those allowed IPs from the peer that legitimately holds them.
+func (s *allowedIPStore) addExisting(key wgtypes.Key, prefixes []netip.Prefix) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	k := key
+	if _, ok := s.peers[k]; !ok {
+		return
+	}
+	s.mergeLocked(k, prefixes)
+}
+
+// ensure records a peer with no prefixes unless it is already known. A device operation
+// that is not update-only creates the peer when it is absent, so it has to be recorded even
+// when it configures nothing else; otherwise the peer exists on the device while the store
+// treats it as unknown, and a prefix later handed over to it is not accounted for.
+func (s *allowedIPStore) ensure(key wgtypes.Key) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	k := key
+	if _, ok := s.peers[k]; !ok {
+		s.peers[k] = nil
+	}
+}
+
+// forget drops every prefix recorded for a peer.
+func (s *allowedIPStore) forget(key wgtypes.Key) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	k := key
+	s.releaseLocked(k)
+	delete(s.peers, k)
+}
+
+// reset drops every peer, mirroring a device reconfiguration that replaces the peer set.
+func (s *allowedIPStore) reset() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.peers = make(map[wgtypes.Key][]netip.Prefix)
+	s.owners = make(map[netip.Prefix]wgtypes.Key)
+}
+
+// mergeLocked unions normalized prefixes into a peer and transfers their ownership.
+// The caller must hold s.mu for writing.
+func (s *allowedIPStore) mergeLocked(k wgtypes.Key, prefixes []netip.Prefix) {
+	merged := s.peers[k]
+	for _, prefix := range prefixes {
+		prefix = normalizePrefix(prefix)
+		s.claimLocked(k, prefix)
+		if !slices.Contains(merged, prefix) {
+			merged = append(merged, prefix)
+		}
+	}
+	s.peers[k] = merged
+}
+
+// claimLocked hands a prefix over to a peer, taking it from its previous owner the way the
+// device does when the same prefix is configured on a second peer.
+func (s *allowedIPStore) claimLocked(k wgtypes.Key, prefix netip.Prefix) {
+	if owner, ok := s.owners[prefix]; ok && owner != k {
+		s.peers[owner] = slices.DeleteFunc(s.peers[owner], func(p netip.Prefix) bool {
+			return p == prefix
+		})
+	}
+	s.owners[prefix] = k
+}
+
+// releaseLocked drops a peer's claim on every prefix it currently holds.
+func (s *allowedIPStore) releaseLocked(k wgtypes.Key) {
+	for _, prefix := range s.peers[k] {
+		if s.owners[prefix] == k {
+			delete(s.owners, prefix)
+		}
+	}
+}
+
+// ipNetsToPrefixes converts addresses read back from a device. Unmap keeps a v4-mapped v6
+// address comparable to the plain v4 prefix the configurer was given.
+func ipNetsToPrefixes(ipNets []net.IPNet) []netip.Prefix {
+	prefixes := make([]netip.Prefix, 0, len(ipNets))
+	for _, ipNet := range ipNets {
+		addr, ok := netip.AddrFromSlice(ipNet.IP)
+		if !ok {
+			continue
+		}
+
+		ones, maskBits := ipNet.Mask.Size()
+		// A device may report a v4 prefix as a v4-mapped address. Align the address form with
+		// the mask rather than unmapping on sight: a 32 bit mask always describes v4, while a
+		// 128 bit mask describes v4 only when it covers the mapped prefix, so a genuine v6
+		// prefix inside the mapped range stays v6 instead of being dropped as invalid.
+		if addr.Is4In6() {
+			switch {
+			case maskBits == 32:
+				addr = addr.Unmap()
+			case maskBits == 128 && ones >= 96:
+				addr, ones = addr.Unmap(), ones-96
+			}
+		}
+
+		prefix := netip.PrefixFrom(addr, ones)
+		if !prefix.IsValid() {
+			continue
+		}
+		prefixes = append(prefixes, prefix.Masked())
+	}
+	return prefixes
+}
diff --git a/client/iface/configurer/allowedips_test.go b/client/iface/configurer/allowedips_test.go
new file mode 100644
index 000000000..405609e29
--- /dev/null
+++ b/client/iface/configurer/allowedips_test.go
@@ -0,0 +1,192 @@
+//go:build (linux && !android) || freebsd
+
+package configurer
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// The store keys on the parsed key, so the tests use two distinct ones rather than names.
+var (
+	testPeer  = wgtypes.Key{1}
+	otherPeer = wgtypes.Key{2}
+)
+
+func TestAllowedIPStoreUnknownPeer(t *testing.T) {
+	s := newAllowedIPStore()
+
+	prefixes, ok := s.get(testPeer)
+	assert.False(t, ok, "an unconfigured peer must be reported as unknown, not as one without prefixes")
+	assert.Nil(t, prefixes, "an unknown peer has no prefixes")
+}
+
+func TestAllowedIPStoreAddUnions(t *testing.T) {
+	s := newAllowedIPStore()
+	overlay := netip.MustParsePrefix("100.64.0.1/32")
+	routed := netip.MustParsePrefix("10.20.0.0/16")
+
+	s.set(testPeer, []netip.Prefix{overlay})
+	// A peer update does not replace allowed IPs, and a repeated prefix must not be doubled.
+	s.add(testPeer, []netip.Prefix{overlay, routed})
+
+	prefixes, ok := s.get(testPeer)
+	require.True(t, ok, "peer must be known after set")
+	assert.Equal(t, []netip.Prefix{overlay, routed}, prefixes, "add must union rather than replace")
+}
+
+func TestAllowedIPStoreGetReturnsCopy(t *testing.T) {
+	s := newAllowedIPStore()
+	overlay := netip.MustParsePrefix("100.64.0.1/32")
+	s.set(testPeer, []netip.Prefix{overlay})
+
+	prefixes, ok := s.get(testPeer)
+	require.True(t, ok, "peer must be known after set")
+	prefixes[0] = netip.MustParsePrefix("0.0.0.0/0")
+
+	stored, _ := s.get(testPeer)
+	assert.Equal(t, []netip.Prefix{overlay}, stored, "a caller mutating the returned slice must not corrupt the store")
+}
+
+func TestAllowedIPStoreForgetAndReset(t *testing.T) {
+	s := newAllowedIPStore()
+	s.set(testPeer, []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")})
+	s.set(otherPeer, []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")})
+
+	s.forget(testPeer)
+	_, ok := s.get(testPeer)
+	assert.False(t, ok, "a forgotten peer must be unknown")
+	_, ok = s.get(otherPeer)
+	assert.True(t, ok, "forgetting one peer must not touch the others")
+
+	s.reset()
+	_, ok = s.get(otherPeer)
+	assert.False(t, ok, "reset must drop every peer")
+}
+
+func TestIPNetsToPrefixes(t *testing.T) {
+	tests := []struct {
+		name  string
+		ipNet net.IPNet
+		want  string
+	}{
+		{
+			name:  "v4",
+			ipNet: net.IPNet{IP: net.IP{10, 20, 0, 0}, Mask: net.CIDRMask(16, 32)},
+			want:  "10.20.0.0/16",
+		},
+		{
+			name:  "v4 mapped under a 128 bit mask",
+			ipNet: net.IPNet{IP: net.ParseIP("10.20.0.0"), Mask: net.CIDRMask(112, 128)},
+			want:  "10.20.0.0/16",
+		},
+		{
+			name:  "v6",
+			ipNet: net.IPNet{IP: net.ParseIP("fd00::"), Mask: net.CIDRMask(64, 128)},
+			want:  "fd00::/64",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := ipNetsToPrefixes([]net.IPNet{tc.ipNet})
+			require.Len(t, got, 1, "the address must be converted, not dropped")
+			assert.Equal(t, tc.want, got[0].String(), "converted prefix")
+		})
+	}
+}
+
+func TestIPNetsToPrefixesRoundTrip(t *testing.T) {
+	prefixes := []netip.Prefix{
+		netip.MustParsePrefix("100.64.0.1/32"),
+		netip.MustParsePrefix("10.20.0.0/16"),
+		netip.MustParsePrefix("fd00::/64"),
+	}
+
+	assert.Equal(t, prefixes, ipNetsToPrefixes(prefixesToIPNets(prefixes)),
+		"prefixes handed to a device must come back unchanged")
+}
+
+func TestAllowedIPStoreNormalizesMappedPrefixes(t *testing.T) {
+	s := newAllowedIPStore()
+	v4 := netip.MustParsePrefix("10.20.0.0/16")
+	mapped := netip.PrefixFrom(netip.AddrFrom16(v4.Addr().As16()), 112)
+
+	s.set(testPeer, []netip.Prefix{mapped})
+	// A v4 rule only matches a v4-mapped address once it has been unmapped, so the store must
+	// hold the plain form and recognise the two spellings as the same prefix.
+	s.add(testPeer, []netip.Prefix{v4})
+
+	prefixes, ok := s.get(testPeer)
+	require.True(t, ok, "peer must be known after set")
+	assert.Equal(t, []netip.Prefix{v4}, prefixes, "a mapped prefix must be stored unmapped and not duplicated")
+}
+
+func TestAllowedIPStoreAddExistingDoesNotCreate(t *testing.T) {
+	s := newAllowedIPStore()
+	routed := netip.MustParsePrefix("10.20.0.0/16")
+
+	// An update-only device operation on an absent peer is a silent no-op, so nothing may be
+	// recorded for a peer the store does not already know.
+	s.addExisting(testPeer, []netip.Prefix{routed})
+	_, ok := s.get(testPeer)
+	assert.False(t, ok, "addExisting must not record an unknown peer")
+
+	overlay := netip.MustParsePrefix("100.64.0.1/32")
+	s.set(testPeer, []netip.Prefix{overlay})
+	s.addExisting(testPeer, []netip.Prefix{routed})
+
+	prefixes, _ := s.get(testPeer)
+	assert.Equal(t, []netip.Prefix{overlay, routed}, prefixes, "addExisting must union onto a known peer")
+}
+
+func TestAllowedIPStoreHandsPrefixOverToTheNewOwner(t *testing.T) {
+	s := newAllowedIPStore()
+	routed := netip.MustParsePrefix("10.20.0.0/16")
+	other := otherPeer
+
+	s.set(testPeer, []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32"), routed})
+	s.set(other, []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")})
+
+	// The device takes an allowed IP away from its previous holder when it is configured on
+	// another peer, so the store must do the same rather than list it under both.
+	s.addExisting(other, []netip.Prefix{routed})
+
+	previous, _ := s.get(testPeer)
+	assert.NotContains(t, previous, routed, "the previous owner must lose the prefix")
+	current, _ := s.get(other)
+	assert.Contains(t, current, routed, "the new owner must hold the prefix")
+}
+
+func TestAllowedIPStoreForgetReleasesOwnership(t *testing.T) {
+	s := newAllowedIPStore()
+	routed := netip.MustParsePrefix("10.20.0.0/16")
+
+	s.set(testPeer, []netip.Prefix{routed})
+	s.forget(testPeer)
+	s.set(otherPeer, []netip.Prefix{routed})
+
+	// A forgotten peer must not be resurrected as a key in the peer map by a later claim.
+	_, ok := s.get(testPeer)
+	assert.False(t, ok, "the forgotten peer must stay unknown")
+	current, _ := s.get(otherPeer)
+	assert.Equal(t, []netip.Prefix{routed}, current, "the new owner must hold the prefix")
+}
+
+func TestIPNetsToPrefixesKeepsV6InTheMappedRange(t *testing.T) {
+	// ::ffff:0:0/64 reads as v4-mapped but is a genuine v6 prefix: unmapping it would leave a
+	// v4 address under a 64 bit mask, which is invalid, and the allowed IP would be dropped.
+	got := ipNetsToPrefixes([]net.IPNet{{
+		IP:   net.ParseIP("::ffff:0:0"),
+		Mask: net.CIDRMask(64, 128),
+	}})
+
+	require.Len(t, got, 1, "the prefix must be converted, not dropped")
+	assert.False(t, got[0].Addr().Is4(), "a v6 prefix in the mapped range must not become v4")
+	assert.Equal(t, 64, got[0].Bits(), "the prefix length must survive the conversion")
+}
diff --git a/client/iface/configurer/common.go b/client/iface/configurer/common.go
index 10162d703..02d2a7e6a 100644
--- a/client/iface/configurer/common.go
+++ b/client/iface/configurer/common.go
@@ -3,29 +3,48 @@ package configurer
 import (
 	"net"
 	"net/netip"
-
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
-// buildPresharedKeyConfig creates a wgtypes.Config for setting a preshared key on a peer.
-// This is a shared helper used by both kernel and userspace configurers.
-func buildPresharedKeyConfig(peerKey wgtypes.Key, psk wgtypes.Key, updateOnly bool) wgtypes.Config {
-	return wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{{
-			PublicKey:    peerKey,
-			PresharedKey: &psk,
-			UpdateOnly:   updateOnly,
-		}},
-	}
-}
-
+// prefixesToIPNets converts prefixes on their way to a device. It is the only place that
+// conversion happens, so it also normalizes: the device is then given the same form the
+// store records, and a v4-mapped prefix cannot reach net.IPNet, which prints such an
+// address as v4 while taking the length from its 16 byte mask and so turns
+// ::ffff:10.1.2.3/64 into 10.1.2.3/0 — an allowed IP matching every v4 address.
 func prefixesToIPNets(prefixes []netip.Prefix) []net.IPNet {
 	ipNets := make([]net.IPNet, len(prefixes))
 	for i, prefix := range prefixes {
+		normalized := normalizePrefix(prefix)
 		ipNets[i] = net.IPNet{
-			IP:   prefix.Addr().AsSlice(),                             // Convert netip.Addr to net.IP
-			Mask: net.CIDRMask(prefix.Bits(), prefix.Addr().BitLen()), // Create subnet mask
+			IP:   normalized.Addr().AsSlice(),
+			Mask: net.CIDRMask(normalized.Bits(), normalized.Addr().BitLen()),
 		}
 	}
 	return ipNets
 }
+
+// normalizePrefix puts a prefix into the form the store recognises it by. It clears the
+// host bits, which a device does on its own, so a caller passing 10.20.0.1/16 still matches
+// the 10.20.0.0/16 read back from the device; and it unmaps a v4-mapped prefix so that it
+// compares equal to, and marshals like, the plain v4 prefix for the same network.
+//
+// Masking comes first because it also decides the address family: only a prefix at least 96
+// bits long keeps the mapped marker through the mask, so a shorter prefix inside the mapped
+// range is a genuine v6 prefix and unmapping it would yield an invalid v4 prefix.
+func normalizePrefix(prefix netip.Prefix) netip.Prefix {
+	masked := prefix.Masked()
+
+	addr := masked.Addr()
+	if !addr.Is4In6() {
+		return masked
+	}
+	return netip.PrefixFrom(addr.Unmap(), masked.Bits()-96)
+}
+
+// normalizePrefixes returns a normalized copy without changing the caller's slice.
+func normalizePrefixes(prefixes []netip.Prefix) []netip.Prefix {
+	normalized := make([]netip.Prefix, len(prefixes))
+	for i, prefix := range prefixes {
+		normalized[i] = normalizePrefix(prefix)
+	}
+	return normalized
+}
diff --git a/client/iface/configurer/common_test.go b/client/iface/configurer/common_test.go
new file mode 100644
index 000000000..487c1a734
--- /dev/null
+++ b/client/iface/configurer/common_test.go
@@ -0,0 +1,81 @@
+package configurer
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizePrefix(t *testing.T) {
+	v4 := netip.MustParsePrefix("10.20.0.0/16")
+	v6 := netip.MustParsePrefix("fd00::/64")
+
+	assert.Equal(t, v4, normalizePrefix(v4), "a plain v4 prefix is unchanged")
+	assert.Equal(t, v6, normalizePrefix(v6), "a real v6 prefix is unchanged")
+	assert.Equal(t, v4, normalizePrefix(netip.PrefixFrom(netip.AddrFrom16(v4.Addr().As16()), 112)),
+		"a mapped prefix under a 128 bit mask becomes plain v4")
+	// A prefix shorter than /96 inside the mapped range is a genuine v6 prefix. Unmapping it
+	// would pair a v4 address with a v6 sized mask, which is invalid, and the store would then
+	// record a zero prefix that can never recreate the allowed IP.
+	for _, tc := range []string{"::ffff:0:0/64", "::ffff:1.2.3.4/80", "::ffff:1.2.3.4/95"} {
+		got := normalizePrefix(netip.MustParsePrefix(tc))
+		assert.True(t, got.IsValid(), "%s must normalize to a valid prefix", tc)
+		assert.False(t, got.Addr().Is4(), "%s must stay v6", tc)
+	}
+}
+
+func TestNormalizePrefixClearsHostBits(t *testing.T) {
+	// A device stores a prefix masked, so a caller passing host bits must still match what a
+	// device fallback seeded, otherwise that prefix could never be removed by value.
+	assert.Equal(t, netip.MustParsePrefix("10.20.0.0/16"),
+		normalizePrefix(netip.MustParsePrefix("10.20.0.1/16")), "host bits must be cleared")
+	assert.Equal(t, netip.MustParsePrefix("fd00::/64"),
+		normalizePrefix(netip.MustParsePrefix("fd00::1/64")), "host bits must be cleared for v6")
+}
+
+func TestPrefixesToIPNetsNormalizes(t *testing.T) {
+	// net.IPNet prints a v4-mapped address as v4 but takes the length from its 16 byte
+	// mask, so an unnormalized ::ffff:10.1.2.3/64 reaches a userspace device as 10.1.2.3/0,
+	// an allowed IP that matches every v4 address.
+	tests := []struct {
+		name  string
+		given string
+		want  string
+	}{
+		{name: "mapped below /96", given: "::ffff:10.1.2.3/64", want: "::/64"},
+		{name: "mapped at /112", given: "::ffff:10.1.2.3/112", want: "10.1.0.0/16"},
+		{name: "host bits are cleared", given: "10.20.0.1/16", want: "10.20.0.0/16"},
+		{name: "v6 is untouched", given: "fd00::1/64", want: "fd00::/64"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := prefixesToIPNets([]netip.Prefix{netip.MustParsePrefix(tc.given)})
+			require.Len(t, got, 1, "the prefix must be converted, not dropped")
+			assert.Equal(t, tc.want, got[0].String(), "what the device is given")
+			assert.NotEqual(t, 0, mustOnes(t, got[0]), "a device must never be given a zero length allowed IP")
+		})
+	}
+}
+
+func TestPrefixesToIPNetsAgreesWithTheStore(t *testing.T) {
+	for _, given := range []string{"::ffff:10.1.2.3/64", "::ffff:10.1.2.3/112", "10.20.0.1/16", "fd00::1/64"} {
+		prefix := netip.MustParsePrefix(given)
+
+		toDevice := prefixesToIPNets([]netip.Prefix{prefix})
+		recorded := normalizePrefix(prefix)
+
+		assert.Equal(t, recorded.String(), toDevice[0].String(),
+			"%s must reach the device in the form the store records", given)
+	}
+}
+
+func mustOnes(t *testing.T, ipNet net.IPNet) int {
+	t.Helper()
+
+	ones, _ := ipNet.Mask.Size()
+	return ones
+}
diff --git a/client/iface/configurer/kernel_unix.go b/client/iface/configurer/kernel_unix.go
index da69c2a35..afe1300d5 100644
--- a/client/iface/configurer/kernel_unix.go
+++ b/client/iface/configurer/kernel_unix.go
@@ -3,9 +3,12 @@
 package configurer
 
 import (
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
+	"slices"
+	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -15,19 +18,45 @@ import (
 	"github.com/netbirdio/netbird/monotime"
 )
 
-type KernelConfigurer struct {
-	deviceName string
-	statsCache *statsCache
+var errConfigurerClosed = errors.New("configurer closed")
+
+type wgClient interface {
+	Device(name string) (*wgtypes.Device, error)
+	ConfigureDevice(name string, cfg wgtypes.Config) error
+	Close() error
 }
 
+type KernelConfigurer struct {
+	deviceName  string
+	statsCache  *statsCache
+	allowedIPs  *allowedIPStore
+	newWgctrlFn func() (wgClient, error)
+
+	clientMu sync.Mutex
+	client   wgClient
+	closed   bool
+}
+
+// NewKernelConfigurer creates a configurer with an empty allowed IP mirror
+// and a statistics cache for the named kernel device.
 func NewKernelConfigurer(deviceName string) *KernelConfigurer {
+	return newKernelConfigurer(deviceName, func() (wgClient, error) {
+		return wgctrl.New()
+	})
+}
+
+func newKernelConfigurer(deviceName string, newWgctrlFn func() (wgClient, error)) *KernelConfigurer {
 	c := &KernelConfigurer{
-		deviceName: deviceName,
+		deviceName:  deviceName,
+		allowedIPs:  newAllowedIPStore(),
+		newWgctrlFn: newWgctrlFn,
 	}
 	c.statsCache = newStatsCache(statsCacheTTL, c.fetchStats)
 	return c
 }
 
+// ConfigureInterface sets the device key, port and firewall mark, replacing all peers.
+// The allowed IP mirror is reset only after the device accepts the configuration.
 func (c *KernelConfigurer) ConfigureInterface(privateKey string, port int) error {
 	log.Debugf("adding Wireguard private key")
 	key, err := wgtypes.ParseKey(privateKey)
@@ -46,6 +75,8 @@ func (c *KernelConfigurer) ConfigureInterface(privateKey string, port int) error
 	if err != nil {
 		return fmt.Errorf(`received error "%w" while configuring interface %s with port %d`, err, c.deviceName, port)
 	}
+
+	c.allowedIPs.reset()
 	return nil
 }
 
@@ -58,9 +89,20 @@ func (c *KernelConfigurer) SetPresharedKey(peerKey string, psk wgtypes.Key, upda
 	}
 
 	cfg := buildPresharedKeyConfig(parsedPeerKey, psk, updateOnly)
-	return c.configure(cfg)
+	if err := c.configure(cfg); err != nil {
+		return err
+	}
+
+	// Without updateOnly this creates the peer when it is absent, so the store has to
+	// know about it even though no allowed IP was configured.
+	if !updateOnly {
+		c.allowedIPs.ensure(parsedPeerKey)
+	}
+	return nil
 }
 
+// UpdatePeer creates or updates a peer, merging allowed IPs with its existing set.
+// Prefixes assigned to this peer are transferred from their previous owners.
 func (c *KernelConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
@@ -83,19 +125,23 @@ func (c *KernelConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix,
 	if err != nil {
 		return fmt.Errorf(`received error "%w" while updating peer on interface %s with settings: allowed ips %s, endpoint %s`, err, c.deviceName, allowedIps, endpoint.String())
 	}
+
+	c.allowedIPs.add(peerKeyParsed, allowedIps)
 	return nil
 }
 
+// RemoveEndpointAddress clears the endpoint of a peer while keeping it configured.
+// Neither the netlink API nor the userspace one can clear an endpoint in place, so the peer
+// is removed and re-added with the allowed IPs it already had.
 func (c *KernelConfigurer) RemoveEndpointAddress(peerKey string) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
 		return err
 	}
 
-	// Get the existing peer to preserve its allowed IPs
-	existingPeer, err := c.getPeer(c.deviceName, peerKey)
+	allowedIPs, err := c.peerAllowedIPs(peerKeyParsed)
 	if err != nil {
-		return fmt.Errorf("get peer: %w", err)
+		return err
 	}
 
 	removePeerCfg := wgtypes.PeerConfig{
@@ -104,26 +150,27 @@ func (c *KernelConfigurer) RemoveEndpointAddress(peerKey string) error {
 	}
 
 	if err := c.configure(wgtypes.Config{Peers: []wgtypes.PeerConfig{removePeerCfg}}); err != nil {
-		return fmt.Errorf(`error removing peer %s from interface %s: %w`, peerKey, c.deviceName, err)
+		return fmt.Errorf("remove peer %s from interface %s: %w", peerKey, c.deviceName, err)
 	}
 
-	//Re-add the peer without the endpoint but same AllowedIPs
 	reAddPeerCfg := wgtypes.PeerConfig{
 		PublicKey:         peerKeyParsed,
-		AllowedIPs:        existingPeer.AllowedIPs,
+		AllowedIPs:        prefixesToIPNets(allowedIPs),
 		ReplaceAllowedIPs: true,
 	}
 
 	if err := c.configure(wgtypes.Config{Peers: []wgtypes.PeerConfig{reAddPeerCfg}}); err != nil {
+		c.allowedIPs.forget(peerKeyParsed)
 		return fmt.Errorf(
-			`error re-adding peer %s to interface %s with allowed IPs %v: %w`,
-			peerKey, c.deviceName, existingPeer.AllowedIPs, err,
+			"re-add peer %s to interface %s with allowed IPs %v: %w",
+			peerKey, c.deviceName, allowedIPs, err,
 		)
 	}
 
 	return nil
 }
 
+// RemovePeer removes a peer and forgets its allowed IPs after a successful device write.
 func (c *KernelConfigurer) RemovePeer(peerKey string) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
@@ -142,15 +189,13 @@ func (c *KernelConfigurer) RemovePeer(peerKey string) error {
 	if err != nil {
 		return fmt.Errorf(`received error "%w" while removing peer %s from interface %s`, err, peerKey, c.deviceName)
 	}
+
+	c.allowedIPs.forget(peerKeyParsed)
 	return nil
 }
 
+// AddAllowedIP adds a prefix to an existing peer; an absent peer is a silent no-op.
 func (c *KernelConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
-	ipNet := net.IPNet{
-		IP:   allowedIP.Addr().AsSlice(),
-		Mask: net.CIDRMask(allowedIP.Bits(), allowedIP.Addr().BitLen()),
-	}
-
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
 		return err
@@ -159,7 +204,7 @@ func (c *KernelConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix)
 		PublicKey:         peerKeyParsed,
 		UpdateOnly:        true,
 		ReplaceAllowedIPs: false,
-		AllowedIPs:        []net.IPNet{ipNet},
+		AllowedIPs:        prefixesToIPNets([]netip.Prefix{allowedIP}),
 	}
 
 	config := wgtypes.Config{
@@ -169,69 +214,75 @@ func (c *KernelConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix)
 	if err != nil {
 		return fmt.Errorf(`received error "%w" while adding allowed Ip to peer on interface %s with settings: allowed ips %s`, err, c.deviceName, allowedIP)
 	}
+
+	c.allowedIPs.addExisting(peerKeyParsed, []netip.Prefix{allowedIP})
 	return nil
 }
 
+// RemoveAllowedIP removes a prefix while preserving the peer's other allowed IPs.
+// A prefix not assigned to the peer is a no-op.
 func (c *KernelConfigurer) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error {
-	ipNet := net.IPNet{
-		IP:   allowedIP.Addr().AsSlice(),
-		Mask: net.CIDRMask(allowedIP.Bits(), allowedIP.Addr().BitLen()),
-	}
-
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
 		return fmt.Errorf("parse peer key: %w", err)
 	}
 
-	existingPeer, err := c.getPeer(c.deviceName, peerKey)
+	currentAllowedIPs, err := c.peerAllowedIPs(peerKeyParsed)
 	if err != nil {
-		return fmt.Errorf("get peer: %w", err)
+		return err
 	}
 
-	newAllowedIPs := existingPeer.AllowedIPs
-
-	for i, existingAllowedIP := range existingPeer.AllowedIPs {
-		if existingAllowedIP.String() == ipNet.String() {
-			newAllowedIPs = append(existingPeer.AllowedIPs[:i], existingPeer.AllowedIPs[i+1:]...) //nolint:gocritic
-			break
-		}
+	idx := slices.Index(currentAllowedIPs, normalizePrefix(allowedIP))
+	if idx < 0 {
+		return nil
 	}
+	newAllowedIPs := slices.Delete(currentAllowedIPs, idx, idx+1)
 
 	peer := wgtypes.PeerConfig{
 		PublicKey:         peerKeyParsed,
 		UpdateOnly:        true,
 		ReplaceAllowedIPs: true,
-		AllowedIPs:        newAllowedIPs,
+		AllowedIPs:        prefixesToIPNets(newAllowedIPs),
 	}
 
 	config := wgtypes.Config{
 		Peers: []wgtypes.PeerConfig{peer},
 	}
-	err = c.configure(config)
-	if err != nil {
+	if err := c.configure(config); err != nil {
 		return fmt.Errorf("remove allowed IP %s on interface %s: %w", allowedIP, c.deviceName, err)
 	}
+
+	c.allowedIPs.set(peerKeyParsed, newAllowedIPs)
 	return nil
 }
 
-func (c *KernelConfigurer) getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
-	wg, err := wgctrl.New()
-	if err != nil {
-		return wgtypes.Peer{}, fmt.Errorf("wgctl: %w", err)
+// peerAllowedIPs returns the allowed IPs configured for a peer, reading them from the device
+// only for a peer the store has not seen. Dumping the device costs a netlink round trip
+// proportional to the whole network map, and this runs on every relay and ICE transition.
+func (c *KernelConfigurer) peerAllowedIPs(peerKey wgtypes.Key) ([]netip.Prefix, error) {
+	if prefixes, ok := c.allowedIPs.get(peerKey); ok {
+		return prefixes, nil
 	}
-	defer func() {
-		err = wg.Close()
-		if err != nil {
-			log.Errorf("Got error while closing wgctl: %v", err)
-		}
-	}()
 
-	wgDevice, err := wg.Device(ifaceName)
+	existingPeer, err := c.getPeer(peerKey)
 	if err != nil {
-		return wgtypes.Peer{}, fmt.Errorf("get device %s: %w", ifaceName, err)
+		return nil, fmt.Errorf("get peer: %w", err)
+	}
+
+	prefixes := ipNetsToPrefixes(existingPeer.AllowedIPs)
+	c.allowedIPs.set(peerKey, prefixes)
+	return prefixes, nil
+}
+
+// getPeer scans the device for one peer. wgtypes.Key is an array, so the comparison is a
+// plain equality: Key.String would base64 encode into a fresh allocation for every peer.
+func (c *KernelConfigurer) getPeer(peerPubKey wgtypes.Key) (wgtypes.Peer, error) {
+	wgDevice, err := c.device()
+	if err != nil {
+		return wgtypes.Peer{}, err
 	}
 	for _, peer := range wgDevice.Peers {
-		if peer.PublicKey.String() == peerPubKey {
+		if peer.PublicKey == peerPubKey {
 			return peer, nil
 		}
 	}
@@ -239,37 +290,73 @@ func (c *KernelConfigurer) getPeer(ifaceName, peerPubKey string) (wgtypes.Peer,
 }
 
 func (c *KernelConfigurer) configure(config wgtypes.Config) error {
-	wg, err := wgctrl.New()
+	c.clientMu.Lock()
+	defer c.clientMu.Unlock()
+
+	client, err := c.clientLocked()
 	if err != nil {
 		return err
 	}
-	defer func() {
-		if err := wg.Close(); err != nil {
-			log.Errorf("Failed to close wgctrl client: %v", err)
-		}
-	}()
-
-	return wg.ConfigureDevice(c.deviceName, config)
+	if err := client.ConfigureDevice(c.deviceName, config); err != nil {
+		c.discardLocked()
+		return err
+	}
+	return nil
 }
 
-func (c *KernelConfigurer) Close() {
+func (c *KernelConfigurer) device() (*wgtypes.Device, error) {
+	c.clientMu.Lock()
+	defer c.clientMu.Unlock()
+
+	client, err := c.clientLocked()
+	if err != nil {
+		return nil, err
+	}
+	wgDevice, err := client.Device(c.deviceName)
+	if err != nil {
+		c.discardLocked()
+		return nil, fmt.Errorf("get device %s: %w", c.deviceName, err)
+	}
+	return wgDevice, nil
 }
 
-func (c *KernelConfigurer) FullStats() (*Stats, error) {
-	wg, err := wgctrl.New()
+func (c *KernelConfigurer) clientLocked() (wgClient, error) {
+	if c.closed {
+		return nil, errConfigurerClosed
+	}
+	if c.client != nil {
+		return c.client, nil
+	}
+	client, err := c.newWgctrlFn()
 	if err != nil {
 		return nil, fmt.Errorf("wgctl: %w", err)
 	}
-	defer func() {
-		err = wg.Close()
-		if err != nil {
-			log.Errorf("Got error while closing wgctl: %v", err)
-		}
-	}()
+	c.client = client
+	return client, nil
+}
 
-	wgDevice, err := wg.Device(c.deviceName)
+func (c *KernelConfigurer) discardLocked() {
+	if c.client == nil {
+		return
+	}
+	if err := c.client.Close(); err != nil {
+		log.Warnf("failed to close wgctrl client: %v", err)
+	}
+	c.client = nil
+}
+
+func (c *KernelConfigurer) Close() {
+	c.clientMu.Lock()
+	defer c.clientMu.Unlock()
+
+	c.closed = true
+	c.discardLocked()
+}
+
+func (c *KernelConfigurer) FullStats() (*Stats, error) {
+	wgDevice, err := c.device()
 	if err != nil {
-		return nil, fmt.Errorf("get device %s: %w", c.deviceName, err)
+		return nil, err
 	}
 	fullStats := &Stats{
 		DeviceName: wgDevice.Name,
@@ -305,23 +392,12 @@ func (c *KernelConfigurer) LastActivities() map[string]monotime.Time {
 }
 
 func (c *KernelConfigurer) fetchStats() (map[string]WGStats, error) {
+	wgDevice, err := c.device()
+	if err != nil {
+		return nil, err
+	}
+
 	stats := make(map[string]WGStats)
-	wg, err := wgctrl.New()
-	if err != nil {
-		return nil, fmt.Errorf("wgctl: %w", err)
-	}
-	defer func() {
-		err = wg.Close()
-		if err != nil {
-			log.Errorf("Got error while closing wgctl: %v", err)
-		}
-	}()
-
-	wgDevice, err := wg.Device(c.deviceName)
-	if err != nil {
-		return nil, fmt.Errorf("get device %s: %w", c.deviceName, err)
-	}
-
 	for _, peer := range wgDevice.Peers {
 		stats[peer.PublicKey.String()] = WGStats{
 			LastHandshake: peer.LastHandshakeTime,
@@ -331,3 +407,13 @@ func (c *KernelConfigurer) fetchStats() (map[string]WGStats, error) {
 	}
 	return stats, nil
 }
+
+func buildPresharedKeyConfig(peerKey wgtypes.Key, psk wgtypes.Key, updateOnly bool) wgtypes.Config {
+	return wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{{
+			PublicKey:    peerKey,
+			PresharedKey: &psk,
+			UpdateOnly:   updateOnly,
+		}},
+	}
+}
diff --git a/client/iface/configurer/kernel_unix_test.go b/client/iface/configurer/kernel_unix_test.go
new file mode 100644
index 000000000..8daa15a25
--- /dev/null
+++ b/client/iface/configurer/kernel_unix_test.go
@@ -0,0 +1,167 @@
+//go:build (linux && !android) || freebsd
+
+package configurer
+
+import (
+	"errors"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+type fakeWGClient struct {
+	configureErr error
+	deviceErr    error
+	calls        int
+	closed       bool
+}
+
+type fakeWGClientFactory struct {
+	openErr error
+	clients []*fakeWGClient
+}
+
+func (f *fakeWGClient) Device(string) (*wgtypes.Device, error) {
+	f.calls++
+	if f.deviceErr != nil {
+		return nil, f.deviceErr
+	}
+	return &wgtypes.Device{}, nil
+}
+
+func (f *fakeWGClient) ConfigureDevice(string, wgtypes.Config) error {
+	f.calls++
+	return f.configureErr
+}
+
+func (f *fakeWGClient) Close() error {
+	f.closed = true
+	return nil
+}
+
+func (f *fakeWGClientFactory) open() (wgClient, error) {
+	if f.openErr != nil {
+		return nil, f.openErr
+	}
+	client := &fakeWGClient{}
+	f.clients = append(f.clients, client)
+	return client, nil
+}
+
+func TestKernelConfigurer_ReusesClientAcrossRequests(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+	peerKey := testPeerKey(t)
+
+	require.NoError(t, c.RemovePeer(peerKey))
+	require.NoError(t, c.RemovePeer(peerKey))
+	_, err := c.FullStats()
+	require.NoError(t, err)
+
+	require.Len(t, factory.clients, 1, "all requests should share one client")
+	assert.Equal(t, 3, factory.clients[0].calls, "every request should go through the shared client")
+	assert.False(t, factory.clients[0].closed, "a healthy client should stay open")
+}
+
+func TestKernelConfigurer_ReopensClientAfterFailedConfigure(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+	peerKey := testPeerKey(t)
+
+	require.NoError(t, c.RemovePeer(peerKey))
+	require.Len(t, factory.clients, 1)
+
+	factory.clients[0].configureErr = errors.New("netlink down")
+	require.Error(t, c.RemovePeer(peerKey))
+	assert.True(t, factory.clients[0].closed, "the failed client should be closed")
+	assert.Len(t, factory.clients, 1, "a failure must not open a client on its own")
+
+	require.NoError(t, c.RemovePeer(peerKey))
+	require.Len(t, factory.clients, 2, "the next request should open a fresh client")
+	assert.Equal(t, 1, factory.clients[1].calls, "the request should run on the fresh client")
+	assert.False(t, factory.clients[1].closed, "the fresh client should stay open")
+}
+
+func TestKernelConfigurer_ReopensClientAfterFailedDeviceQuery(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+
+	_, err := c.FullStats()
+	require.NoError(t, err)
+	require.Len(t, factory.clients, 1)
+
+	factory.clients[0].deviceErr = errors.New("netlink down")
+	_, err = c.FullStats()
+	require.Error(t, err)
+	assert.True(t, factory.clients[0].closed, "the failed client should be closed")
+
+	_, err = c.FullStats()
+	require.NoError(t, err)
+	assert.Len(t, factory.clients, 2, "the next request should open a fresh client")
+}
+
+func TestKernelConfigurer_RetriesOpenOnNextRequest(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+	peerKey := testPeerKey(t)
+
+	factory.openErr = errors.New("no netlink")
+	require.Error(t, c.RemovePeer(peerKey))
+	assert.Empty(t, factory.clients, "a failed open leaves no client behind")
+
+	factory.openErr = nil
+	require.NoError(t, c.RemovePeer(peerKey))
+	assert.Len(t, factory.clients, 1, "the next request should open the client")
+}
+
+func TestKernelConfigurer_CloseRejectsFurtherRequests(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+	peerKey := testPeerKey(t)
+
+	require.NoError(t, c.RemovePeer(peerKey))
+	require.Len(t, factory.clients, 1)
+
+	c.Close()
+	c.Close()
+	assert.True(t, factory.clients[0].closed, "Close should release the client")
+
+	require.ErrorIs(t, c.RemovePeer(peerKey), errConfigurerClosed)
+	_, err := c.FullStats()
+	require.ErrorIs(t, err, errConfigurerClosed)
+	assert.Len(t, factory.clients, 1, "a closed configurer must not open a client")
+}
+
+func TestKernelConfigurer_ConcurrentRequestsShareOneClient(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+	peerKey := testPeerKey(t)
+
+	const workers = 16
+	errs := make(chan error, workers)
+	var wg sync.WaitGroup
+	for range workers {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			errs <- c.RemovePeer(peerKey)
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		require.NoError(t, err)
+	}
+
+	require.Len(t, factory.clients, 1, "concurrent requests should share one client")
+	assert.Equal(t, workers, factory.clients[0].calls, "every request should reach the shared client")
+}
+
+func newFakeKernelConfigurer() (*KernelConfigurer, *fakeWGClientFactory) {
+	factory := &fakeWGClientFactory{}
+	return newKernelConfigurer("wt0", factory.open), factory
+}
+
+func testPeerKey(t *testing.T) string {
+	t.Helper()
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	return key.PublicKey().String()
+}
diff --git a/client/iface/configurer/usp.go b/client/iface/configurer/usp.go
index 0a25c55bc..1b0965f0d 100644
--- a/client/iface/configurer/usp.go
+++ b/client/iface/configurer/usp.go
@@ -1,18 +1,16 @@
 package configurer
 
 import (
-	"encoding/base64"
-	"encoding/hex"
 	"fmt"
+	"math"
 	"net"
 	"net/netip"
 	"os"
 	"runtime"
-	"strconv"
-	"strings"
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	wgconn "golang.zx2c4.com/wireguard/conn"
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
@@ -21,19 +19,6 @@ import (
 	"github.com/netbirdio/netbird/monotime"
 )
 
-const (
-	privateKey                 = "private_key"
-	ipcKeyLastHandshakeTimeSec = "last_handshake_time_sec"
-	ipcKeyTxBytes              = "tx_bytes"
-	ipcKeyRxBytes              = "rx_bytes"
-	allowedIP                  = "allowed_ip"
-	endpoint                   = "endpoint"
-	fwmark                     = "fwmark"
-	listenPort                 = "listen_port"
-	publicKey                  = "public_key"
-	presharedKey               = "preshared_key"
-)
-
 var ErrAllowedIPNotFound = fmt.Errorf("allowed IP not found")
 
 type WGUSPConfigurer struct {
@@ -45,17 +30,14 @@ type WGUSPConfigurer struct {
 	uapiListener net.Listener
 }
 
+// NewUSPConfigurer creates a userspace configurer and starts its UAPI listener.
 func NewUSPConfigurer(device *device.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
-	wgCfg := &WGUSPConfigurer{
-		device:           device,
-		deviceName:       deviceName,
-		activityRecorder: activityRecorder,
-	}
-	wgCfg.statsCache = newStatsCache(statsCacheTTL, wgCfg.fetchStats)
+	wgCfg := NewUSPConfigurerNoUAPI(device, deviceName, activityRecorder)
 	wgCfg.startUAPI()
 	return wgCfg
 }
 
+// NewUSPConfigurerNoUAPI creates a userspace configurer without a UAPI listener.
 func NewUSPConfigurerNoUAPI(device *device.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
 	wgCfg := &WGUSPConfigurer{
 		device:           device,
@@ -66,21 +48,28 @@ func NewUSPConfigurerNoUAPI(device *device.Device, deviceName string, activityRe
 	return wgCfg
 }
 
+// ConfigureInterface sets the device key, port and firewall mark, replacing all peers.
 func (c *WGUSPConfigurer) ConfigureInterface(privateKey string, port int) error {
 	log.Debugf("adding Wireguard private key")
 	key, err := wgtypes.ParseKey(privateKey)
 	if err != nil {
 		return err
 	}
-	fwmark := getFwmark()
-	config := wgtypes.Config{
-		PrivateKey:   &key,
-		ReplacePeers: true,
-		FirewallMark: &fwmark,
-		ListenPort:   &port,
+	if port < 0 || port > math.MaxUint16 {
+		return fmt.Errorf("invalid listen port %d", port)
 	}
 
-	return c.device.IpcSet(toWgUserspaceString(config))
+	if err := c.device.SetPrivateKey(device.NoisePrivateKey(key)); err != nil {
+		return fmt.Errorf("set private key: %w", err)
+	}
+	if err := c.device.SetListenPort(uint16(port)); err != nil {
+		return fmt.Errorf("set listen port %d: %w", port, err)
+	}
+	c.device.RemoveAllPeers()
+	if err := c.device.BindSetMark(uint32(getFwmark())); err != nil {
+		return fmt.Errorf("set fwmark: %w", err)
+	}
+	return nil
 }
 
 // SetPresharedKey sets the preshared key for a peer.
@@ -91,231 +80,178 @@ func (c *WGUSPConfigurer) SetPresharedKey(peerKey string, psk wgtypes.Key, updat
 		return err
 	}
 
-	cfg := buildPresharedKeyConfig(parsedPeerKey, psk, updateOnly)
-	return c.device.IpcSet(toWgUserspaceString(cfg))
+	presharedKey := device.NoisePresharedKey(psk)
+	return c.device.ConfigurePeer(device.NoisePublicKey(parsedPeerKey), device.PeerConfig{
+		PresharedKey: &presharedKey,
+		UpdateOnly:   updateOnly,
+	})
 }
 
+// UpdatePeer creates or updates a peer, merging allowed IPs with its existing set.
 func (c *WGUSPConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
 		return err
 	}
-	peer := wgtypes.PeerConfig{
-		PublicKey:         peerKeyParsed,
-		ReplaceAllowedIPs: false,
-		// don't replace allowed ips, wg will handle duplicated peer IP
-		AllowedIPs:                  prefixesToIPNets(allowedIps),
-		PersistentKeepaliveInterval: &keepAlive,
-		PresharedKey:                preSharedKey,
-		Endpoint:                    endpoint,
+
+	prefixes, err := validPrefixes(allowedIps)
+	if err != nil {
+		return err
 	}
 
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
+	cfg := device.PeerConfig{
+		PersistentKeepalive: &keepAlive,
+		AllowedIPs:          prefixes,
 	}
 
-	if ipcErr := c.device.IpcSet(toWgUserspaceString(config)); ipcErr != nil {
-		return ipcErr
+	var addrPort netip.AddrPort
+	if endpoint != nil {
+		addr, ok := netip.AddrFromSlice(endpoint.IP)
+		if !ok {
+			return fmt.Errorf("parse endpoint address %v", endpoint.IP)
+		}
+		addr = addr.Unmap()
+		addrPort = netip.AddrPortFrom(addr, uint16(endpoint.Port))
+		cfg.Endpoint = &bind.Endpoint{AddrPort: netip.AddrPortFrom(addr.WithZone(endpoint.Zone), addrPort.Port())}
+	}
+
+	if preSharedKey != nil {
+		psk := device.NoisePresharedKey(*preSharedKey)
+		cfg.PresharedKey = &psk
+	}
+
+	if err := c.device.ConfigurePeer(device.NoisePublicKey(peerKeyParsed), cfg); err != nil {
+		return fmt.Errorf("configure peer: %w", err)
 	}
 
 	if endpoint != nil {
-		addr, err := netip.ParseAddr(endpoint.IP.String())
-		if err != nil {
-			return fmt.Errorf("failed to parse endpoint address: %w", err)
-		}
-		addrPort := netip.AddrPortFrom(addr.Unmap(), uint16(endpoint.Port))
 		c.activityRecorder.UpsertAddress(peerKey, addrPort)
 	}
 	return nil
 }
 
+// RemoveEndpointAddress clears the endpoint of a peer while keeping it configured.
+// The session is reset and the keepalive is switched off until the next endpoint arrives.
 func (c *WGUSPConfigurer) RemoveEndpointAddress(peerKey string) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
 		return fmt.Errorf("parse peer key: %w", err)
 	}
 
-	ipcStr, err := c.device.IpcGet()
-	if err != nil {
-		return fmt.Errorf("get IPC config: %w", err)
+	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	if peer == nil {
+		return ErrPeerNotFound
 	}
 
-	// Parse current status to get allowed IPs for the peer
-	stats, err := parseStatus(c.deviceName, ipcStr)
-	if err != nil {
-		return fmt.Errorf("parse IPC config: %w", err)
-	}
+	peer.ClearEndpoint()
+	peer.ZeroAndFlushAll()
 
-	var allowedIPs []net.IPNet
-	found := false
-	for _, peer := range stats.Peers {
-		if peer.PublicKey == peerKey {
-			allowedIPs = peer.AllowedIPs
-			found = true
-			break
-		}
+	var noKeepAlive time.Duration
+	if err := c.device.ConfigurePeer(device.NoisePublicKey(peerKeyParsed), device.PeerConfig{
+		PersistentKeepalive: &noKeepAlive,
+		UpdateOnly:          true,
+	}); err != nil {
+		return fmt.Errorf("disable keepalive: %w", err)
 	}
-	if !found {
-		return fmt.Errorf("peer %s not found", peerKey)
-	}
-
-	// remove the peer from the WireGuard configuration
-	peer := wgtypes.PeerConfig{
-		PublicKey: peerKeyParsed,
-		Remove:    true,
-	}
-
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
-	}
-	if ipcErr := c.device.IpcSet(toWgUserspaceString(config)); ipcErr != nil {
-		return fmt.Errorf("failed to remove peer: %s", ipcErr)
-	}
-
-	// Build the peer config
-	peer = wgtypes.PeerConfig{
-		PublicKey:         peerKeyParsed,
-		ReplaceAllowedIPs: true,
-		AllowedIPs:        allowedIPs,
-	}
-
-	config = wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
-	}
-
-	if err := c.device.IpcSet(toWgUserspaceString(config)); err != nil {
-		return fmt.Errorf("remove endpoint address: %w", err)
-	}
-
 	return nil
 }
 
+// RemovePeer removes a peer and clears its activity record.
 func (c *WGUSPConfigurer) RemovePeer(peerKey string) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
 		return err
 	}
 
-	peer := wgtypes.PeerConfig{
-		PublicKey: peerKeyParsed,
-		Remove:    true,
-	}
-
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
-	}
-	ipcErr := c.device.IpcSet(toWgUserspaceString(config))
-
+	c.device.RemovePeer(device.NoisePublicKey(peerKeyParsed))
 	c.activityRecorder.Remove(peerKey)
-	return ipcErr
+	return nil
 }
 
+// AddAllowedIP adds a prefix to an existing peer; an absent peer is a silent no-op.
 func (c *WGUSPConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
-	ipNet := net.IPNet{
-		IP:   allowedIP.Addr().AsSlice(),
-		Mask: net.CIDRMask(allowedIP.Bits(), allowedIP.Addr().BitLen()),
-	}
-
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
 		return err
 	}
-	peer := wgtypes.PeerConfig{
-		PublicKey:         peerKeyParsed,
-		UpdateOnly:        true,
-		ReplaceAllowedIPs: false,
-		AllowedIPs:        []net.IPNet{ipNet},
+	if !allowedIP.IsValid() {
+		return fmt.Errorf("invalid allowed IP %v", allowedIP)
 	}
 
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
+	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	if peer == nil {
+		return nil
 	}
 
-	return c.device.IpcSet(toWgUserspaceString(config))
+	peer.AddAllowedIP(normalizePrefix(allowedIP))
+	return nil
 }
 
+// RemoveAllowedIP removes a prefix while preserving the peer's other allowed IPs.
+// It returns ErrAllowedIPNotFound if the prefix is not assigned to the peer.
 func (c *WGUSPConfigurer) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error {
-	ipc, err := c.device.IpcGet()
-	if err != nil {
-		return err
-	}
-
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
-		return err
+		return fmt.Errorf("parse peer key: %w", err)
 	}
-	hexKey := hex.EncodeToString(peerKeyParsed[:])
-
-	lines := strings.Split(ipc, "\n")
-
-	peer := wgtypes.PeerConfig{
-		PublicKey:         peerKeyParsed,
-		UpdateOnly:        true,
-		ReplaceAllowedIPs: true,
-		AllowedIPs:        []net.IPNet{},
-	}
-
-	foundPeer := false
-	removedAllowedIP := false
-	ip := allowedIP.String()
-
-	for _, line := range lines {
-		line = strings.TrimSpace(line)
-
-		// If we're within the details of the found peer and encounter another public key,
-		// this means we're starting another peer's details. So, reset the flag.
-		if strings.HasPrefix(line, "public_key=") && foundPeer {
-			foundPeer = false
-		}
-
-		// Identify the peer with the specific public key
-		if line == fmt.Sprintf("public_key=%s", hexKey) {
-			foundPeer = true
-		}
-
-		// If we're within the details of the found peer and find the specific allowed IP, skip this line
-		if foundPeer && line == "allowed_ip="+ip {
-			removedAllowedIP = true
-			continue
-		}
-
-		// Append the line to the output string
-		if foundPeer && strings.HasPrefix(line, "allowed_ip=") {
-			allowedIPStr := strings.TrimPrefix(line, "allowed_ip=")
-			_, ipNet, err := net.ParseCIDR(allowedIPStr)
-			if err != nil {
-				return err
-			}
-			peer.AllowedIPs = append(peer.AllowedIPs, *ipNet)
-		}
-	}
-
-	if !removedAllowedIP {
+	if !allowedIP.IsValid() {
 		return ErrAllowedIPNotFound
 	}
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
+
+	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	if peer == nil {
+		return ErrPeerNotFound
 	}
-	return c.device.IpcSet(toWgUserspaceString(config))
+
+	if !peer.RemoveAllowedIP(normalizePrefix(allowedIP)) {
+		return ErrAllowedIPNotFound
+	}
+	return nil
 }
 
 func (c *WGUSPConfigurer) FullStats() (*Stats, error) {
-	ipcStr, err := c.device.IpcGet()
-	if err != nil {
-		return nil, fmt.Errorf("IpcGet failed: %w", err)
+	peers := c.device.Peers()
+	stats := &Stats{
+		DeviceName: c.deviceName,
+		PublicKey:  wgtypes.Key(c.device.PublicKey()).String(),
+		ListenPort: int(c.device.ListenPort()),
+		FWMark:     int(c.device.FirewallMark()),
+		Peers:      make([]Peer, 0, len(peers)),
 	}
-
-	return parseStatus(c.deviceName, ipcStr)
+	for _, peer := range peers {
+		stats.Peers = append(stats.Peers, peerStats(peer))
+	}
+	return stats, nil
 }
 
 func (c *WGUSPConfigurer) LastActivities() map[string]monotime.Time {
 	return c.activityRecorder.GetLastActivities()
 }
 
+func (c *WGUSPConfigurer) GetStats() (map[string]WGStats, error) {
+	return c.statsCache.get()
+}
+
+func (c *WGUSPConfigurer) Close() {
+	if c.uapiListener != nil {
+		err := c.uapiListener.Close()
+		if err != nil {
+			log.Errorf("failed to close uapi listener: %v", err)
+		}
+	}
+
+	if runtime.GOOS == "linux" {
+		sockPath := "/var/run/wireguard/" + c.deviceName + ".sock"
+		if _, statErr := os.Stat(sockPath); statErr == nil {
+			_ = os.Remove(sockPath)
+		}
+	}
+}
+
 // startUAPI starts the UAPI listener for managing the WireGuard interface via external tool
-func (t *WGUSPConfigurer) startUAPI() {
+func (c *WGUSPConfigurer) startUAPI() {
 	var err error
-	t.uapiListener, err = openUAPI(t.deviceName)
+	c.uapiListener, err = openUAPI(c.deviceName)
 	if err != nil {
 		log.Errorf("failed to open uapi listener: %v", err)
 		return
@@ -329,315 +265,66 @@ func (t *WGUSPConfigurer) startUAPI() {
 				return
 			}
 			go func() {
-				t.device.IpcHandle(uapiConn)
+				c.device.IpcHandle(uapiConn)
 			}()
 		}
-	}(t.uapiListener)
+	}(c.uapiListener)
 }
 
-func (t *WGUSPConfigurer) Close() {
-	if t.uapiListener != nil {
-		err := t.uapiListener.Close()
-		if err != nil {
-			log.Errorf("failed to close uapi listener: %v", err)
+func (c *WGUSPConfigurer) fetchStats() (map[string]WGStats, error) {
+	peers := c.device.Peers()
+	stats := make(map[string]WGStats, len(peers))
+	for _, peer := range peers {
+		stats[wgtypes.Key(peer.PublicKey()).String()] = WGStats{
+			LastHandshake: peer.LastHandshake(),
+			TxBytes:       int64(peer.TxBytes()),
+			RxBytes:       int64(peer.RxBytes()),
 		}
 	}
-
-	if runtime.GOOS == "linux" {
-		sockPath := "/var/run/wireguard/" + t.deviceName + ".sock"
-		if _, statErr := os.Stat(sockPath); statErr == nil {
-			_ = os.Remove(sockPath)
-		}
-	}
-}
-
-func (t *WGUSPConfigurer) GetStats() (map[string]WGStats, error) {
-	return t.statsCache.get()
-}
-
-func (t *WGUSPConfigurer) fetchStats() (map[string]WGStats, error) {
-	ipc, err := t.device.IpcGet()
-	if err != nil {
-		return nil, fmt.Errorf("ipc get: %w", err)
-	}
-
-	return parseTransfers(ipc)
-}
-
-func parseTransfers(ipc string) (map[string]WGStats, error) {
-	stats := make(map[string]WGStats)
-	var (
-		currentKey   string
-		currentStats WGStats
-		hasPeer      bool
-	)
-	lines := strings.Split(ipc, "\n")
-	for _, line := range lines {
-		line = strings.TrimSpace(line)
-
-		// If we're within the details of the found peer and encounter another public key,
-		// this means we're starting another peer's details. So, stop.
-		if strings.HasPrefix(line, "public_key=") {
-			peerID := strings.TrimPrefix(line, "public_key=")
-			h, err := hex.DecodeString(peerID)
-			if err != nil {
-				return nil, fmt.Errorf("decode peerID: %w", err)
-			}
-			currentKey = base64.StdEncoding.EncodeToString(h)
-			currentStats = WGStats{} // Reset stats for the new peer
-			hasPeer = true
-			stats[currentKey] = currentStats
-			continue
-		}
-
-		if !hasPeer {
-			continue
-		}
-
-		key := strings.SplitN(line, "=", 2)
-		if len(key) != 2 {
-			continue
-		}
-		switch key[0] {
-		case ipcKeyLastHandshakeTimeSec:
-			hs, err := toLastHandshake(key[1])
-			if err != nil {
-				return nil, err
-			}
-			currentStats.LastHandshake = hs
-			stats[currentKey] = currentStats
-		case ipcKeyRxBytes:
-			rxBytes, err := toBytes(key[1])
-			if err != nil {
-				return nil, fmt.Errorf("parse rx_bytes: %w", err)
-			}
-			currentStats.RxBytes = rxBytes
-			stats[currentKey] = currentStats
-		case ipcKeyTxBytes:
-			TxBytes, err := toBytes(key[1])
-			if err != nil {
-				return nil, fmt.Errorf("parse tx_bytes: %w", err)
-			}
-			currentStats.TxBytes = TxBytes
-			stats[currentKey] = currentStats
-		}
-	}
-
 	return stats, nil
 }
 
-func toWgUserspaceString(wgCfg wgtypes.Config) string {
-	var sb strings.Builder
-	if wgCfg.PrivateKey != nil {
-		hexKey := hex.EncodeToString(wgCfg.PrivateKey[:])
-		sb.WriteString(fmt.Sprintf("private_key=%s\n", hexKey))
+func peerStats(peer *device.Peer) Peer {
+	stats := Peer{
+		PublicKey:     wgtypes.Key(peer.PublicKey()).String(),
+		AllowedIPs:    prefixesToIPNets(peer.AllowedIPs()),
+		TxBytes:       int64(peer.TxBytes()),
+		RxBytes:       int64(peer.RxBytes()),
+		LastHandshake: peer.LastHandshake(),
+		PresharedKey:  [32]byte(peer.PresharedKey()),
 	}
-
-	if wgCfg.ListenPort != nil {
-		sb.WriteString(fmt.Sprintf("listen_port=%d\n", *wgCfg.ListenPort))
+	if addrPort, ok := endpointAddrPort(peer.Endpoint()); ok {
+		stats.Endpoint = net.UDPAddr{IP: addrPort.Addr().AsSlice(), Port: int(addrPort.Port())}
 	}
-
-	if wgCfg.ReplacePeers {
-		sb.WriteString("replace_peers=true\n")
-	}
-
-	if wgCfg.FirewallMark != nil {
-		sb.WriteString(fmt.Sprintf("fwmark=%d\n", *wgCfg.FirewallMark))
-	}
-
-	for _, p := range wgCfg.Peers {
-		hexKey := hex.EncodeToString(p.PublicKey[:])
-		sb.WriteString(fmt.Sprintf("public_key=%s\n", hexKey))
-
-		if p.Remove {
-			sb.WriteString("remove=true\n")
-		}
-
-		if p.UpdateOnly {
-			sb.WriteString("update_only=true\n")
-		}
-
-		if p.PresharedKey != nil {
-			preSharedHexKey := hex.EncodeToString(p.PresharedKey[:])
-			sb.WriteString(fmt.Sprintf("preshared_key=%s\n", preSharedHexKey))
-		}
-
-		if p.Endpoint != nil {
-			sb.WriteString(fmt.Sprintf("endpoint=%s\n", p.Endpoint.String()))
-		}
-
-		if p.PersistentKeepaliveInterval != nil {
-			sb.WriteString(fmt.Sprintf("persistent_keepalive_interval=%d\n", int(p.PersistentKeepaliveInterval.Seconds())))
-		}
-
-		if p.ReplaceAllowedIPs {
-			sb.WriteString("replace_allowed_ips=true\n")
-		}
-
-		for _, aip := range p.AllowedIPs {
-			sb.WriteString(fmt.Sprintf("allowed_ip=%s\n", aip.String()))
-		}
-	}
-	return sb.String()
+	return stats
 }
 
-func toLastHandshake(stringVar string) (time.Time, error) {
-	sec, err := strconv.ParseInt(stringVar, 10, 64)
+func endpointAddrPort(endpoint wgconn.Endpoint) (netip.AddrPort, bool) {
+	if endpoint == nil {
+		return netip.AddrPort{}, false
+	}
+	if ep, ok := endpoint.(*bind.Endpoint); ok {
+		return ep.AddrPort, true
+	}
+	addrPort, err := netip.ParseAddrPort(endpoint.DstToString())
 	if err != nil {
-		return time.Time{}, fmt.Errorf("parse handshake sec: %w", err)
+		return netip.AddrPort{}, false
 	}
-
-	// If sec is 0 (Unix epoch), return zero time instead
-	// This indicates no handshake has occurred
-	if sec == 0 {
-		return time.Time{}, nil
-	}
-
-	return time.Unix(sec, 0), nil
+	return addrPort, true
 }
 
-func toBytes(s string) (int64, error) {
-	return strconv.ParseInt(s, 10, 64)
+func validPrefixes(prefixes []netip.Prefix) ([]netip.Prefix, error) {
+	for _, prefix := range prefixes {
+		if !prefix.IsValid() {
+			return nil, fmt.Errorf("invalid allowed IP %v", prefix)
+		}
+	}
+	return normalizePrefixes(prefixes), nil
 }
 
 func getFwmark() int {
 	if nbnet.AdvancedRouting() && runtime.GOOS == "linux" {
-		return nbnet.ControlPlaneMark
+		return int(nbnet.ControlPlaneMark)
 	}
 	return 0
 }
-
-func hexToWireguardKey(hexKey string) (wgtypes.Key, error) {
-	// Decode hex string to bytes
-	keyBytes, err := hex.DecodeString(hexKey)
-	if err != nil {
-		return wgtypes.Key{}, fmt.Errorf("failed to decode hex key: %w", err)
-	}
-
-	// Check if we have the right number of bytes (WireGuard keys are 32 bytes)
-	if len(keyBytes) != 32 {
-		return wgtypes.Key{}, fmt.Errorf("invalid key length: expected 32 bytes, got %d", len(keyBytes))
-	}
-
-	// Convert to wgtypes.Key
-	var key wgtypes.Key
-	copy(key[:], keyBytes)
-
-	return key, nil
-}
-
-func parseStatus(deviceName, ipcStr string) (*Stats, error) {
-	stats := &Stats{DeviceName: deviceName}
-	var currentPeer *Peer
-	for _, line := range strings.Split(strings.TrimSpace(ipcStr), "\n") {
-		if line == "" {
-			continue
-		}
-		parts := strings.SplitN(line, "=", 2)
-		if len(parts) != 2 {
-			continue
-		}
-		key := parts[0]
-		val := parts[1]
-
-		switch key {
-		case privateKey:
-			key, err := hexToWireguardKey(val)
-			if err != nil {
-				log.Errorf("failed to parse private key: %v", err)
-				continue
-			}
-			stats.PublicKey = key.PublicKey().String()
-		case publicKey:
-			// Save previous peer
-			if currentPeer != nil {
-				stats.Peers = append(stats.Peers, *currentPeer)
-			}
-			key, err := hexToWireguardKey(val)
-			if err != nil {
-				log.Errorf("failed to parse public key: %v", err)
-				continue
-			}
-			currentPeer = &Peer{
-				PublicKey: key.String(),
-			}
-		case listenPort:
-			if port, err := strconv.Atoi(val); err == nil {
-				stats.ListenPort = port
-			}
-		case fwmark:
-			if fwmark, err := strconv.Atoi(val); err == nil {
-				stats.FWMark = fwmark
-			}
-		case endpoint:
-			if currentPeer == nil {
-				continue
-			}
-
-			host, portStr, err := net.SplitHostPort(val)
-			if err != nil {
-				log.Errorf("failed to parse endpoint: %v", err)
-				continue
-			}
-			port, err := strconv.Atoi(portStr)
-			if err != nil {
-				log.Errorf("failed to parse endpoint port: %v", err)
-				continue
-			}
-			currentPeer.Endpoint = net.UDPAddr{
-				IP:   net.ParseIP(host),
-				Port: port,
-			}
-		case allowedIP:
-			if currentPeer == nil {
-				continue
-			}
-			_, ipnet, err := net.ParseCIDR(val)
-			if err == nil {
-				currentPeer.AllowedIPs = append(currentPeer.AllowedIPs, *ipnet)
-			}
-		case ipcKeyTxBytes:
-			if currentPeer == nil {
-				continue
-			}
-			rxBytes, err := toBytes(val)
-			if err != nil {
-				continue
-			}
-			currentPeer.TxBytes = rxBytes
-		case ipcKeyRxBytes:
-			if currentPeer == nil {
-				continue
-			}
-			rxBytes, err := toBytes(val)
-			if err != nil {
-				continue
-			}
-			currentPeer.RxBytes = rxBytes
-
-		case ipcKeyLastHandshakeTimeSec:
-			if currentPeer == nil {
-				continue
-			}
-
-			ts, err := toLastHandshake(val)
-			if err != nil {
-				continue
-			}
-			currentPeer.LastHandshake = ts
-		case presharedKey:
-			if currentPeer == nil {
-				continue
-			}
-			if val != "" && val != "0000000000000000000000000000000000000000000000000000000000000000" {
-				if pskKey, err := hexToWireguardKey(val); err == nil {
-					currentPeer.PresharedKey = [32]byte(pskKey)
-				}
-			}
-		}
-	}
-	if currentPeer != nil {
-		stats.Peers = append(stats.Peers, *currentPeer)
-	}
-	return stats, nil
-}
diff --git a/client/iface/configurer/usp_allowedips_test.go b/client/iface/configurer/usp_allowedips_test.go
new file mode 100644
index 000000000..effb360e9
--- /dev/null
+++ b/client/iface/configurer/usp_allowedips_test.go
@@ -0,0 +1,252 @@
+package configurer
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	wgconn "golang.zx2c4.com/wireguard/conn"
+	wgdevice "golang.zx2c4.com/wireguard/device"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/bind"
+)
+
+// newTestUSPConfigurer builds a configurer over a real wireguard-go device backed by an
+// in-memory TUN. The device stays down, so no socket is opened and no privileges are needed.
+func newTestUSPConfigurer(t *testing.T) *WGUSPConfigurer {
+	t.Helper()
+
+	dev := wgdevice.NewDevice(newIdleTUN(), wgconn.NewDefaultBind(), wgdevice.NewLogger(wgdevice.LogLevelSilent, ""))
+	t.Cleanup(dev.Close)
+
+	c := NewUSPConfigurerNoUAPI(dev, "wgtest0", bind.NewActivityRecorder())
+
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate device private key")
+	require.NoError(t, c.ConfigureInterface(key.String(), 0), "configure test device")
+
+	return c
+}
+
+// seedPeers adds count peers, each with a /32 overlay address, and returns their public keys.
+func seedPeers(t *testing.T, c *WGUSPConfigurer, count int) []string {
+	t.Helper()
+
+	keys := make([]string, 0, count)
+	for i := 0; i < count; i++ {
+		priv, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err, "generate peer private key")
+		pub := priv.PublicKey().String()
+
+		addr := netip.PrefixFrom(netip.AddrFrom4([4]byte{100, 64, byte(i >> 8), byte(i)}), 32)
+		require.NoError(t, c.UpdatePeer(pub, []netip.Prefix{addr}, 25*time.Second, nil, nil), "add peer")
+		keys = append(keys, pub)
+	}
+	return keys
+}
+
+func peerAllowedIPs(t *testing.T, c *WGUSPConfigurer, peerKey string) []string {
+	t.Helper()
+
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+
+	for _, p := range stats.Peers {
+		if p.PublicKey != peerKey {
+			continue
+		}
+		got := make([]string, 0, len(p.AllowedIPs))
+		for _, ipNet := range p.AllowedIPs {
+			got = append(got, ipNet.String())
+		}
+		return got
+	}
+	t.Fatalf("peer %s not found on device", peerKey)
+	return nil
+}
+
+// TestRemoveEndpointAddressPreservesRoutedAllowedIPs covers the prefixes the route manager
+// attaches to a routing peer through AddAllowedIP. Those are not known to the peer.Conn that
+// triggers the endpoint removal, so dropping them here would silently blackhole every route
+// behind that peer on each relay or ICE disconnect.
+func TestRemoveEndpointAddressPreservesRoutedAllowedIPs(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+	peerKey := seedPeers(t, c, 3)[1]
+
+	routed := []netip.Prefix{
+		netip.MustParsePrefix("10.20.0.0/16"),
+		netip.MustParsePrefix("192.168.7.0/24"),
+	}
+	for _, prefix := range routed {
+		require.NoError(t, c.AddAllowedIP(peerKey, prefix), "add routed prefix")
+	}
+
+	before := peerAllowedIPs(t, c, peerKey)
+	require.Len(t, before, 3, "peer should hold its overlay address plus both routed prefixes")
+
+	require.NoError(t, c.RemoveEndpointAddress(peerKey), "remove endpoint address")
+
+	assert.ElementsMatch(t, before, peerAllowedIPs(t, c, peerKey),
+		"allowed IPs must survive the endpoint removal unchanged")
+}
+
+// TestRemoveEndpointAddressDoesNotScaleWithPeerCount is the regression guard for the actual
+// defect: clearing one peer's endpoint used to dump and parse the whole device, so its cost
+// grew with the size of the network map. On a routing peer with thousands of peers that dump
+// runs on every relay and ICE transition, under the interface lock.
+func TestRemoveEndpointAddressDoesNotScaleWithPeerCount(t *testing.T) {
+	measure := func(peerCount int) float64 {
+		c := newTestUSPConfigurer(t)
+		peerKey := seedPeers(t, c, peerCount)[peerCount/2]
+
+		return testing.AllocsPerRun(5, func() {
+			require.NoError(t, c.RemoveEndpointAddress(peerKey), "remove endpoint address")
+		})
+	}
+
+	small := measure(64)
+	large := measure(1024)
+
+	assert.Less(t, large, small*2,
+		"clearing one endpoint allocated %.0f objects with 1024 peers against %.0f with 64: the cost still scales with the peer count",
+		large, small)
+}
+
+func TestRemoveAllowedIPKeepsTheOtherPrefixes(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+	peerKey := seedPeers(t, c, 3)[0]
+	routed := netip.MustParsePrefix("10.20.0.0/16")
+	require.NoError(t, c.AddAllowedIP(peerKey, routed), "add routed prefix")
+	require.NoError(t, c.AddAllowedIP(peerKey, netip.MustParsePrefix("192.168.7.0/24")), "add routed prefix")
+
+	require.NoError(t, c.RemoveAllowedIP(peerKey, routed), "remove routed prefix")
+
+	assert.ElementsMatch(t, []string{"100.64.0.0/32", "192.168.7.0/24"}, peerAllowedIPs(t, c, peerKey),
+		"only the removed prefix should be gone")
+
+	assert.ErrorIs(t, c.RemoveAllowedIP(peerKey, routed), ErrAllowedIPNotFound,
+		"removing a prefix that is no longer configured must be reported")
+}
+
+// TestAddAllowedIPOnAbsentPeerDoesNotResurrectIt covers the lazy connection window documented
+// in #6863: AddAllowedIP is update-only, a silent no-op when the peer is absent, and clearing
+// the endpoint of an absent peer must not create one either.
+func TestAddAllowedIPOnAbsentPeerDoesNotResurrectIt(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+	seedPeers(t, c, 2)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	absent := priv.PublicKey().String()
+
+	require.NoError(t, c.AddAllowedIP(absent, netip.MustParsePrefix("10.20.0.0/16")),
+		"update-only add on an absent peer is a silent no-op")
+
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+	require.Len(t, stats.Peers, 2, "the absent peer must not have been created by AddAllowedIP")
+
+	assert.ErrorIs(t, c.RemoveEndpointAddress(absent), ErrPeerNotFound,
+		"clearing the endpoint of a peer the device does not have must fail")
+
+	stats, err = c.FullStats()
+	require.NoError(t, err, "read device stats")
+	assert.Len(t, stats.Peers, 2, "no peer may be created while clearing an endpoint")
+}
+
+// TestRemoveEndpointAddressDoesNotStealAPrefixFromAnotherPeer covers WireGuard's rule that an
+// allowed IP belongs to exactly one peer: configuring a prefix on a peer takes it away from
+// whichever peer held it before. UpdatePeer relies on that rule rather than removing the prefix
+// from the previous holder itself, so a prefix handed over between peers must not come back.
+func TestRemoveEndpointAddressDoesNotStealAPrefixFromAnotherPeer(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+	keys := seedPeers(t, c, 2)
+	peerA, peerB := keys[0], keys[1]
+	routed := netip.MustParsePrefix("10.20.0.0/16")
+
+	require.NoError(t, c.AddAllowedIP(peerA, routed), "give the prefix to A")
+	require.Contains(t, peerAllowedIPs(t, c, peerA), routed.String(), "A must hold the prefix")
+
+	// The route moves to B. The device takes it away from A on its own.
+	require.NoError(t, c.AddAllowedIP(peerB, routed), "hand the prefix over to B")
+	require.Contains(t, peerAllowedIPs(t, c, peerB), routed.String(), "B must hold the prefix")
+	require.NotContains(t, peerAllowedIPs(t, c, peerA), routed.String(), "the device must have taken it from A")
+
+	require.NoError(t, c.RemoveEndpointAddress(peerA), "clear A's endpoint")
+
+	assert.NotContains(t, peerAllowedIPs(t, c, peerA), routed.String(),
+		"clearing A's endpoint must not take the prefix back from B")
+	assert.Contains(t, peerAllowedIPs(t, c, peerB), routed.String(),
+		"B must still hold the prefix")
+}
+
+// TestPresharedKeyCreatedPeerTakesPartInPrefixHandover covers a peer created by a preshared
+// key write rather than by a peer update. Rosenpass applies a peer's first key without
+// updateOnly, which creates the peer on the device, so a store that ignored that operation
+// would treat the peer as unknown and would not account for a prefix later handed over to it.
+func TestPresharedKeyCreatedPeerTakesPartInPrefixHandover(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+	peerA := seedPeers(t, c, 1)[0]
+	routed := netip.MustParsePrefix("10.20.0.0/16")
+	require.NoError(t, c.AddAllowedIP(peerA, routed), "give the prefix to A")
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerB := priv.PublicKey().String()
+
+	psk, err := wgtypes.GenerateKey()
+	require.NoError(t, err, "generate preshared key")
+	require.NoError(t, c.SetPresharedKey(peerB, psk, false), "a first key creates the peer")
+
+	require.NoError(t, c.AddAllowedIP(peerB, routed), "hand the prefix over to B")
+	require.Contains(t, peerAllowedIPs(t, c, peerB), routed.String(), "B must hold the prefix")
+
+	require.NoError(t, c.RemoveEndpointAddress(peerA), "clear A's endpoint")
+
+	assert.NotContains(t, peerAllowedIPs(t, c, peerA), routed.String(),
+		"clearing A's endpoint must not take the prefix back from B")
+	assert.Contains(t, peerAllowedIPs(t, c, peerB), routed.String(), "B must still hold the prefix")
+}
+
+// TestUpdatePeerDoesNotWidenAMappedPrefixOnTheDevice is the end to end form of the
+// conversion: a v4-mapped prefix must not reach the device as a zero length allowed IP,
+// which would route every v4 address to that peer.
+func TestUpdatePeerDoesNotWidenAMappedPrefixOnTheDevice(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerKey := priv.PublicKey().String()
+
+	mapped := netip.MustParsePrefix("::ffff:10.1.2.3/112")
+	require.NoError(t, c.UpdatePeer(peerKey, []netip.Prefix{mapped}, 25*time.Second, nil, nil), "add peer")
+
+	onDevice := peerAllowedIPs(t, c, peerKey)
+	assert.NotContains(t, onDevice, "0.0.0.0/0", "the device must not be given a catch-all allowed IP")
+	assert.Equal(t, []string{"10.1.0.0/16"}, onDevice, "the device holds the normalized prefix")
+}
+
+// TestUpdatePeerWithAnUnusableEndpointTouchesNothing pins the ordering: the endpoint is
+// parsed before the device is configured, so a failure cannot leave a half-configured peer
+// on the device.
+func TestUpdatePeerWithAnUnusableEndpointTouchesNothing(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+	seedPeers(t, c, 2)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerKey := priv.PublicKey().String()
+
+	// A three byte address has no textual form netip can parse back.
+	endpoint := &net.UDPAddr{IP: net.IP{1, 2, 3}, Port: 51820}
+	require.Error(t, c.UpdatePeer(peerKey, []netip.Prefix{netip.MustParsePrefix("10.30.0.0/16")},
+		25*time.Second, endpoint, nil), "an unusable endpoint must fail the update")
+
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+	assert.Len(t, stats.Peers, 2, "the peer must not have reached the device")
+}
diff --git a/client/iface/configurer/usp_test.go b/client/iface/configurer/usp_test.go
index e32491c54..48b5ad1f0 100644
--- a/client/iface/configurer/usp_test.go
+++ b/client/iface/configurer/usp_test.go
@@ -2,88 +2,222 @@ package configurer
 
 import (
 	"encoding/hex"
+	"net"
+	"net/netip"
+	"os"
+	"strings"
 	"testing"
+	"time"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	wgdevice "golang.zx2c4.com/wireguard/device"
+	"golang.zx2c4.com/wireguard/tun"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
-var ipcFixture = `
-private_key=e84b5a6d2717c1003a13b431570353dbaca9146cf150c5f8575680feba52027a
-listen_port=12912
-public_key=b85996fecc9c7f1fc6d2572a76eda11d59bcd20be8e543b15ce4bd85a8e75a33
-preshared_key=188515093e952f5f22e865cef3012e72f8b5f0b598ac0309d5dacce3b70fcf52
-allowed_ip=192.168.4.4/32
-endpoint=[abcd:23::33%2]:51820
-public_key=58402e695ba1772b1cc9309755f043251ea77fdcf10fbe63989ceb7e19321376
-tx_bytes=38333
-rx_bytes=2224
-allowed_ip=192.168.4.6/32
-persistent_keepalive_interval=111
-endpoint=182.122.22.19:3233
-public_key=662e14fd594556f522604703340351258903b64f35553763f19426ab2a515c58
-endpoint=5.152.198.39:51820
-allowed_ip=192.168.4.10/32
-allowed_ip=192.168.4.11/32
-tx_bytes=1212111
-rx_bytes=1929999999
-protocol_version=1
-errno=0
+// idleTUN never reports an up event, so the wireguard-go device stays down: no socket is
+// opened, no peer goroutine starts, and the configuration state is all the tests observe.
+type idleTUN struct {
+	events chan tun.Event
+	closed chan struct{}
+}
 
-`
+func newIdleTUN() *idleTUN {
+	return &idleTUN{events: make(chan tun.Event), closed: make(chan struct{})}
+}
 
-func Test_parseTransfers(t *testing.T) {
-	tests := []struct {
-		name    string
-		peerKey string
-		want    WGStats
-	}{
-		{
-			name:    "single",
-			peerKey: "b85996fecc9c7f1fc6d2572a76eda11d59bcd20be8e543b15ce4bd85a8e75a33",
-			want: WGStats{
-				TxBytes: 0,
-				RxBytes: 0,
-			},
-		},
-		{
-			name:    "multiple",
-			peerKey: "58402e695ba1772b1cc9309755f043251ea77fdcf10fbe63989ceb7e19321376",
-			want: WGStats{
-				TxBytes: 38333,
-				RxBytes: 2224,
-			},
-		},
-		{
-			name:    "lastpeer",
-			peerKey: "662e14fd594556f522604703340351258903b64f35553763f19426ab2a515c58",
-			want: WGStats{
-				TxBytes: 1212111,
-				RxBytes: 1929999999,
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			res, err := hex.DecodeString(tt.peerKey)
-			require.NoError(t, err)
+func (t *idleTUN) File() *os.File { return nil }
 
-			key, err := wgtypes.NewKey(res)
-			require.NoError(t, err)
+func (t *idleTUN) Read([][]byte, []int, int) (int, error) {
+	<-t.closed
+	return 0, os.ErrClosed
+}
 
-			stats, err := parseTransfers(ipcFixture)
-			if err != nil {
-				require.NoError(t, err)
-				return
-			}
+func (t *idleTUN) Write(bufs [][]byte, _ int) (int, error) { return len(bufs), nil }
 
-			stat, ok := stats[key.String()]
-			if !ok {
-				require.True(t, ok)
-				return
-			}
+func (t *idleTUN) MTU() (int, error) { return 1420, nil }
 
-			require.Equal(t, tt.want, stat)
-		})
+func (t *idleTUN) Name() (string, error) { return "idle", nil }
+
+func (t *idleTUN) Events() <-chan tun.Event { return t.events }
+
+func (t *idleTUN) Close() error {
+	close(t.closed)
+	close(t.events)
+	return nil
+}
+
+func (t *idleTUN) BatchSize() int { return 1 }
+
+func TestConfigureInterfaceAppliesKeyAndPortAndReplacesPeers(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+	seedPeers(t, c, 2)
+
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate device private key")
+	require.NoError(t, c.ConfigureInterface(key.String(), 51820), "reconfigure the interface")
+
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+	assert.Equal(t, key.PublicKey().String(), stats.PublicKey, "device public key")
+	assert.Equal(t, 51820, stats.ListenPort, "listen port")
+	assert.Empty(t, stats.Peers, "configuring the interface replaces every peer")
+}
+
+func TestConfigureInterfaceRejectsAnInvalidPort(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate device private key")
+	assert.Error(t, c.ConfigureInterface(key.String(), 70000), "a port above 65535 must be rejected")
+}
+
+func TestGetStatsIsKeyedByPeerKey(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+	keys := seedPeers(t, c, 3)
+
+	stats, err := c.GetStats()
+	require.NoError(t, err, "read stats")
+	require.Len(t, stats, 3, "one entry per peer")
+	for _, key := range keys {
+		entry, ok := stats[key]
+		require.True(t, ok, "peer %s must be reported", key)
+		assert.Zero(t, entry.TxBytes, "no traffic was sent")
+		assert.Zero(t, entry.RxBytes, "no traffic was received")
+		assert.True(t, entry.LastHandshake.IsZero(), "no handshake happened")
 	}
 }
+
+func TestFullStatsMatchesTheDeviceDump(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerKey := priv.PublicKey().String()
+	psk, err := wgtypes.GenerateKey()
+	require.NoError(t, err, "generate preshared key")
+	endpoint := &net.UDPAddr{IP: net.IPv4(192, 0, 2, 10), Port: 51820}
+	prefixes := []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32"), netip.MustParsePrefix("10.20.0.0/16")}
+	require.NoError(t, c.UpdatePeer(peerKey, prefixes, 25*time.Second, endpoint, &psk), "add peer")
+
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+	require.Len(t, stats.Peers, 1, "one peer on the device")
+	peer := stats.Peers[0]
+	assert.Equal(t, peerKey, peer.PublicKey, "peer key")
+	assert.Equal(t, "192.0.2.10:51820", peer.Endpoint.String(), "endpoint")
+	assert.Equal(t, [32]byte(psk), peer.PresharedKey, "preshared key")
+	assert.Equal(t, []string{"100.64.0.1/32", "10.20.0.0/16"}, ipNetStrings(peer.AllowedIPs), "allowed IPs")
+
+	block := uapiPeerBlock(t, c, peerKey)
+	assert.Contains(t, block, "endpoint=192.0.2.10:51820", "the dump must show the endpoint")
+	assert.Contains(t, block, "preshared_key="+hex.EncodeToString(psk[:]), "the dump must show the preshared key")
+	assert.Contains(t, block, "persistent_keepalive_interval=25", "the dump must show the keepalive")
+	assert.Contains(t, block, "allowed_ip=100.64.0.1/32", "the dump must show the first prefix")
+	assert.Contains(t, block, "allowed_ip=10.20.0.0/16", "the dump must show the second prefix")
+}
+
+func TestUpdatePeerKeepsTheEndpointZone(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerKey := priv.PublicKey().String()
+	// The idle device opens no socket, so the zone name does not have to exist on the host.
+	endpoint := &net.UDPAddr{IP: net.ParseIP("fe80::1"), Port: 51820, Zone: "eth0"}
+	prefixes := []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")}
+	require.NoError(t, c.UpdatePeer(peerKey, prefixes, 25*time.Second, endpoint, nil), "add peer")
+
+	assert.Contains(t, uapiPeerBlock(t, c, peerKey), "endpoint=[fe80::1%eth0]:51820",
+		"a link-local endpoint must keep its zone")
+}
+
+func TestRemoveEndpointAddressKeepsThePeerAndStopsTheKeepalive(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerKey := priv.PublicKey().String()
+	endpoint := &net.UDPAddr{IP: net.IPv4(192, 0, 2, 10), Port: 51820}
+	prefixes := []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")}
+	require.NoError(t, c.UpdatePeer(peerKey, prefixes, 25*time.Second, endpoint, nil), "add peer")
+	before := c.device.LookupPeer(wgdevice.NoisePublicKey(priv.PublicKey()))
+	require.NotNil(t, before, "the peer must be on the device")
+
+	require.NoError(t, c.RemoveEndpointAddress(peerKey), "remove endpoint address")
+
+	assert.Same(t, before, c.device.LookupPeer(wgdevice.NoisePublicKey(priv.PublicKey())),
+		"the peer object must survive the endpoint removal")
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+	require.Len(t, stats.Peers, 1, "the peer stays configured")
+	assert.Nil(t, stats.Peers[0].Endpoint.IP, "the endpoint must be gone")
+	assert.Equal(t, []string{"100.64.0.1/32"}, ipNetStrings(stats.Peers[0].AllowedIPs), "allowed IPs survive")
+	assert.Contains(t, uapiPeerBlock(t, c, peerKey), "persistent_keepalive_interval=0",
+		"an endpoint-less peer must not keep sending keepalives")
+
+	require.NoError(t, c.UpdatePeer(peerKey, prefixes, 25*time.Second, endpoint, nil), "restore the endpoint")
+	block := uapiPeerBlock(t, c, peerKey)
+	assert.Contains(t, block, "endpoint=192.0.2.10:51820", "the endpoint must be back")
+	assert.Contains(t, block, "persistent_keepalive_interval=25", "the keepalive must be back")
+}
+
+func TestUpdatePeerRejectsAnInvalidPrefix(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerKey := priv.PublicKey().String()
+
+	require.Error(t, c.UpdatePeer(peerKey, []netip.Prefix{{}}, 25*time.Second, nil, nil), "an invalid prefix must be rejected")
+
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+	assert.Empty(t, stats.Peers, "the peer must not have reached the device")
+}
+
+func TestRemoveAllowedIPOnAbsentPeerReportsThePeer(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+
+	assert.ErrorIs(t, c.RemoveAllowedIP(priv.PublicKey().String(), netip.MustParsePrefix("10.20.0.0/16")), ErrPeerNotFound,
+		"removing a prefix from a peer the device does not have must report the peer")
+}
+
+func ipNetStrings(ipNets []net.IPNet) []string {
+	out := make([]string, 0, len(ipNets))
+	for _, ipNet := range ipNets {
+		out = append(out, ipNet.String())
+	}
+	return out
+}
+
+// uapiPeerBlock reads the device back through the UAPI dump, so a typed write is checked
+// against an independent view of the device.
+func uapiPeerBlock(t *testing.T, c *WGUSPConfigurer, peerKey string) []string {
+	t.Helper()
+
+	parsed, err := wgtypes.ParseKey(peerKey)
+	require.NoError(t, err, "parse peer key")
+	wanted := "public_key=" + hex.EncodeToString(parsed[:])
+
+	dump, err := c.device.IpcGet()
+	require.NoError(t, err, "dump device")
+
+	var block []string
+	inBlock := false
+	for _, line := range strings.Split(strings.TrimSpace(dump), "\n") {
+		if strings.HasPrefix(line, "public_key=") {
+			inBlock = line == wanted
+			continue
+		}
+		if inBlock {
+			block = append(block, line)
+		}
+	}
+	require.NotEmpty(t, block, "peer %s must appear in the dump", peerKey)
+	return block
+}
diff --git a/client/iface/device/device_android.go b/client/iface/device/device_android.go
index cbe88c10c..0ed1299ae 100644
--- a/client/iface/device/device_android.go
+++ b/client/iface/device/device_android.go
@@ -63,7 +63,12 @@ func (t *WGTunDevice) Create(routes []string, dns string, searchDomains []string
 		searchDomainsToString = ""
 	}
 
-	fd, err := t.tunAdapter.ConfigureInterface(t.address.String(), t.address.IPv6String(), int(t.mtu), dns, searchDomainsToString, routesString)
+	ipv6Host := ""
+	if t.address.HasIPv6() {
+		ipv6Host = t.address.IPv6HostPrefix().String()
+	}
+
+	fd, err := t.tunAdapter.ConfigureInterface(t.address.HostPrefix().String(), ipv6Host, int(t.mtu), dns, searchDomainsToString, routesString)
 	if err != nil {
 		log.Errorf("failed to create Android interface: %s", err)
 		return nil, err
diff --git a/client/iface/device/device_filter_test.go b/client/iface/device/device_filter_test.go
index 0d86c9323..a75ef90f9 100644
--- a/client/iface/device/device_filter_test.go
+++ b/client/iface/device/device_filter_test.go
@@ -4,7 +4,7 @@ import (
 	"net"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 
diff --git a/client/iface/device/device_kernel_unix.go b/client/iface/device/device_kernel_unix.go
index 3c429fb96..ee965dd24 100644
--- a/client/iface/device/device_kernel_unix.go
+++ b/client/iface/device/device_kernel_unix.go
@@ -32,6 +32,7 @@ type TunKernelDevice struct {
 	link       *wgLink
 	udpMuxConn net.PacketConn
 	udpMux     *udpmux.UniversalUDPMuxDefault
+	configurer WGConfigurer
 }
 
 func NewKernelDevice(name string, address wgaddr.Address, wgPort int, key string, mtu uint16, transportNet transport.Net) *TunKernelDevice {
@@ -68,13 +69,18 @@ func (t *TunKernelDevice) Create() (WGConfigurer, error) {
 		return nil, fmt.Errorf("set mtu: %w", err)
 	}
 
-	configurer := configurer.NewKernelConfigurer(t.name)
+	cfg := configurer.NewKernelConfigurer(t.name)
 
-	if err := configurer.ConfigureInterface(t.key, t.wgPort); err != nil {
+	if err := cfg.ConfigureInterface(t.key, t.wgPort); err != nil {
+		cfg.Close()
 		return nil, fmt.Errorf("error configuring interface: %s", err)
 	}
 
-	return configurer, nil
+	if t.configurer != nil {
+		t.configurer.Close()
+	}
+	t.configurer = cfg
+	return cfg, nil
 }
 
 func (t *TunKernelDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
@@ -132,6 +138,10 @@ func (t *TunKernelDevice) Close() error {
 		closErr = err
 	}
 
+	if t.configurer != nil {
+		t.configurer.Close()
+	}
+
 	if t.udpMux != nil {
 		if err := t.udpMux.Close(); err != nil {
 			log.Debugf("failed to close udp mux: %s", err)
diff --git a/client/iface/iface.go b/client/iface/iface.go
index 247f421a2..f6006fa87 100644
--- a/client/iface/iface.go
+++ b/client/iface/iface.go
@@ -51,7 +51,6 @@ func ValidateMTU(mtu uint16) error {
 
 type wgProxyFactory interface {
 	GetProxy() wgproxy.Proxy
-	GetProxyPort() uint16
 	Free() error
 }
 
@@ -81,12 +80,6 @@ func (w *WGIface) GetProxy() wgproxy.Proxy {
 	return w.wgProxyFactory.GetProxy()
 }
 
-// GetProxyPort returns the proxy port used by the WireGuard proxy.
-// Returns 0 if no proxy port is used (e.g., for userspace WireGuard).
-func (w *WGIface) GetProxyPort() uint16 {
-	return w.wgProxyFactory.GetProxyPort()
-}
-
 // GetBind returns the EndpointManager userspace bind mode.
 func (w *WGIface) GetBind() device.EndpointManager {
 	w.mu.Lock()
diff --git a/client/iface/iface_close_test.go b/client/iface/iface_close_test.go
index 171e15d0a..ecbbf4866 100644
--- a/client/iface/iface_close_test.go
+++ b/client/iface/iface_close_test.go
@@ -12,6 +12,7 @@ import (
 	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/device"
+	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
@@ -34,14 +35,14 @@ func (f *fakeTunDevice) Create() (device.WGConfigurer, error) {
 func (f *fakeTunDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
 	return nil, errors.New("not implemented")
 }
-func (f *fakeTunDevice) UpdateAddr(wgaddr.Address) error      { return nil }
-func (f *fakeTunDevice) WgAddress() wgaddr.Address            { return wgaddr.Address{} }
-func (f *fakeTunDevice) MTU() uint16                          { return DefaultMTU }
-func (f *fakeTunDevice) DeviceName() string                   { return "nb-close-test" }
+func (f *fakeTunDevice) UpdateAddr(wgaddr.Address) error        { return nil }
+func (f *fakeTunDevice) WgAddress() wgaddr.Address              { return wgaddr.Address{} }
+func (f *fakeTunDevice) MTU() uint16                            { return DefaultMTU }
+func (f *fakeTunDevice) DeviceName() string                     { return "nb-close-test" }
 func (f *fakeTunDevice) FilteredDevice() *device.FilteredDevice { return nil }
-func (f *fakeTunDevice) Device() *wgdevice.Device             { return nil }
-func (f *fakeTunDevice) GetNet() *netstack.Net                { return nil }
-func (f *fakeTunDevice) GetICEBind() device.EndpointManager   { return nil }
+func (f *fakeTunDevice) Device() *wgdevice.Device               { return nil }
+func (f *fakeTunDevice) GetNet() *netstack.Net                  { return nil }
+func (f *fakeTunDevice) GetICEBind() device.EndpointManager     { return nil }
 
 func (f *fakeTunDevice) Close() error {
 	close(f.closeStarted)
@@ -52,7 +53,6 @@ func (f *fakeTunDevice) Close() error {
 type fakeProxyFactory struct{}
 
 func (fakeProxyFactory) GetProxy() wgproxy.Proxy { return nil }
-func (fakeProxyFactory) GetProxyPort() uint16    { return 0 }
 func (fakeProxyFactory) Free() error             { return nil }
 
 // TestWGIface_CloseReleasesMutexBeforeTunClose guards against a deadlock
@@ -63,6 +63,10 @@ func (fakeProxyFactory) Free() error             { return nil }
 // WGIface.GetDevice() which needs the same mutex. The fix is to drop
 // the lock before tun.Close() returns control.
 func TestWGIface_CloseReleasesMutexBeforeTunClose(t *testing.T) {
+	// Netstack mode skips the platform interface cleanup in Close, so only
+	// the mutex and tun close behavior is exercised.
+	t.Setenv(nbnetstack.EnvUseNetstackMode, "true")
+
 	tun := &fakeTunDevice{
 		closeStarted: make(chan struct{}),
 		unblockClose: make(chan struct{}),
@@ -106,7 +110,10 @@ func TestWGIface_CloseReleasesMutexBeforeTunClose(t *testing.T) {
 
 	close(tun.unblockClose)
 	select {
-	case <-closeDone:
+	case err := <-closeDone:
+		if err != nil {
+			t.Errorf("WGIface.Close() returned an error: %v", err)
+		}
 	case <-time.After(2 * time.Second):
 		t.Fatal("WGIface.Close() never returned after the tun was unblocked")
 	}
diff --git a/client/iface/iface_destroy_windows.go b/client/iface/iface_destroy_windows.go
index 0bfa4e211..54c0014c4 100644
--- a/client/iface/iface_destroy_windows.go
+++ b/client/iface/iface_destroy_windows.go
@@ -6,27 +6,14 @@ import (
 	"fmt"
 	"os/exec"
 
-	log "github.com/sirupsen/logrus"
+	"github.com/netbirdio/netbird/client/internal/wincmd"
 )
 
 func (w *WGIface) Destroy() error {
-	netshCmd := GetSystem32Command("netsh")
+	netshCmd := wincmd.System32("netsh")
 	out, err := exec.Command(netshCmd, "interface", "set", "interface", w.Name(), "admin=disable").CombinedOutput()
 	if err != nil {
 		return fmt.Errorf("failed to remove interface %s: %w - %s", w.Name(), err, out)
 	}
 	return nil
 }
-
-// GetSystem32Command checks if a command can be found in the system path and returns it. In case it can't find it
-// in the path it will return the full path of a command assuming C:\windows\system32 as the base path.
-func GetSystem32Command(command string) string {
-	_, err := exec.LookPath(command)
-	if err == nil {
-		return command
-	}
-
-	log.Tracef("Command %s not found in PATH, using C:\\windows\\system32\\%s.exe path", command, command)
-
-	return "C:\\windows\\system32\\" + command + ".exe"
-}
diff --git a/client/iface/iface_test.go b/client/iface/iface_test.go
index 8ff2bbb54..690a0f66f 100644
--- a/client/iface/iface_test.go
+++ b/client/iface/iface_test.go
@@ -40,14 +40,18 @@ func init() {
 	peerPubKey = peerPrivateKey.PublicKey().String()
 }
 
+// testIFaceBlackList mirrors the prefixes profilemanager.DefaultInterfaceBlacklist
+// carries for the overlay interface. These tests create their own utun device, and
+// stdnet's filter probes with wgctrl every interface it is not told to skip, which
+// on a userspace WireGuard platform reaches the UAPI socket of this same process.
+// Declared here rather than imported because profilemanager imports this package.
+var testIFaceBlackList = []string{"wt", "utun", "tun0"}
+
 func TestWGIface_UpdateAddr(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
 	addr := "100.64.0.1/8"
 	wgPort := 33100
-	newNet, err := stdnet.NewNet(context.Background(), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
@@ -127,10 +131,7 @@ func getIfaceAddrs(ifaceName string) ([]net.Addr, error) {
 func Test_CreateInterface(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+1)
 	wgIP := "10.99.99.1/32"
-	newNet, err := stdnet.NewNet(context.Background(), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
 		Address:      wgaddr.MustParseWGAddress(wgIP),
@@ -170,10 +171,7 @@ func Test_Close(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+2)
 	wgIP := "10.99.99.2/32"
 	wgPort := 33100
-	newNet, err := stdnet.NewNet(context.Background(), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
@@ -215,10 +213,7 @@ func TestRecreation(t *testing.T) {
 			ifaceName := fmt.Sprintf("utun%d", WgIntNumber+2)
 			wgIP := "10.99.99.2/32"
 			wgPort := 33100
-			newNet, err := stdnet.NewNet(context.Background(), nil)
-			if err != nil {
-				t.Fatal(err)
-			}
+			newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 			opts := WGIFaceOpts{
 				IFaceName:    ifaceName,
@@ -288,10 +283,7 @@ func Test_ConfigureInterface(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+3)
 	wgIP := "10.99.99.5/30"
 	wgPort := 33100
-	newNet, err := stdnet.NewNet(context.Background(), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
 		Address:      wgaddr.MustParseWGAddress(wgIP),
@@ -343,10 +335,7 @@ func Test_ConfigureInterface(t *testing.T) {
 func Test_UpdatePeer(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
 	wgIP := "10.99.99.9/30"
-	newNet, err := stdnet.NewNet(context.Background(), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
@@ -413,10 +402,7 @@ func Test_UpdatePeer(t *testing.T) {
 func Test_RemovePeer(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
 	wgIP := "10.99.99.13/30"
-	newNet, err := stdnet.NewNet(context.Background(), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
@@ -464,6 +450,8 @@ func Test_RemovePeer(t *testing.T) {
 }
 
 func Test_ConnectPeers(t *testing.T) {
+	t.Setenv("NB_DISABLE_EBPF_WG_PROXY", "true")
+
 	peer1ifaceName := fmt.Sprintf("utun%d", WgIntNumber+400)
 	peer1wgIP := netip.MustParsePrefix("10.99.99.17/30")
 	peer1Key, _ := wgtypes.GeneratePrivateKey()
@@ -475,10 +463,7 @@ func Test_ConnectPeers(t *testing.T) {
 	peer2wgPort := 33200
 
 	keepAlive := 1 * time.Second
-	newNet, err := stdnet.NewNet(context.Background(), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	guid := fmt.Sprintf("{%s}", uuid.New().String())
 	device.CustomWindowsGUIDString = strings.ToLower(guid)
@@ -505,12 +490,8 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	localIP, err := getLocalIP()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer1wgPort))
+	localIP1 := "127.0.0.1"
+	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP1, peer1wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -518,10 +499,7 @@ func Test_ConnectPeers(t *testing.T) {
 	guid = fmt.Sprintf("{%s}", uuid.New().String())
 	device.CustomWindowsGUIDString = strings.ToLower(guid)
 
-	newNet, err = stdnet.NewNet(context.Background(), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	newNet = stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	optsPeer2 := WGIFaceOpts{
 		IFaceName:    peer2ifaceName,
@@ -546,7 +524,8 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer2wgPort))
+	localIP2 := "127.0.0.1"
+	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP2, peer2wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -569,17 +548,20 @@ func Test_ConnectPeers(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	// todo: investigate why in some tests execution we need 30s
+	// On Linux with the kernel module both peers are kernel devices, elsewhere
+	// they run on wireguard-go. A tight busy-loop here would starve the
+	// wireguard-go goroutines that process the handshake, so poll on a ticker
+	// instead and yield the CPU between checks. WireGuard also only retries a
+	// lost handshake initiation every REKEY_TIMEOUT (5s), which is why the
+	// overall wait can occasionally stretch to tens of seconds. Each side sends
+	// its first initiation when its peer is configured, and the first one leaves
+	// before the other device knows the peer, so that one is always wasted.
 	timeout := 30 * time.Second
 	timeoutChannel := time.After(timeout)
+	ticker := time.NewTicker(500 * time.Millisecond)
+	defer ticker.Stop()
 
 	for {
-		select {
-		case <-timeoutChannel:
-			t.Fatalf("waiting for peer handshake timeout after %s", timeout.String())
-		default:
-		}
-
 		peer, gpErr := getPeer(peer1ifaceName, peer2Key.PublicKey().String())
 		if gpErr != nil {
 			t.Fatal(gpErr)
@@ -588,10 +570,29 @@ func Test_ConnectPeers(t *testing.T) {
 			t.Log("peers successfully handshake")
 			break
 		}
+
+		select {
+		case <-timeoutChannel:
+			// The counters tell whether initiations were sent at all, whether they
+			// arrived, and whether only one direction is working.
+			t.Fatalf("waiting for peer handshake timeout after %s\n%s\n%s", timeout.String(),
+				describePeer(peer1ifaceName, peer2Key.PublicKey().String()),
+				describePeer(peer2ifaceName, peer1Key.PublicKey().String()))
+		case <-ticker.C:
+		}
 	}
 
 }
 
+func describePeer(ifaceName, peerPubKey string) string {
+	peer, err := getPeer(ifaceName, peerPubKey)
+	if err != nil {
+		return fmt.Sprintf("%s: peer %s: %v", ifaceName, peerPubKey, err)
+	}
+	return fmt.Sprintf("%s: peer %s endpoint=%v tx=%d rx=%d last_handshake=%v",
+		ifaceName, peerPubKey, peer.Endpoint, peer.TransmitBytes, peer.ReceiveBytes, peer.LastHandshakeTime)
+}
+
 func getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
 	wg, err := wgctrl.New()
 	if err != nil {
@@ -615,28 +616,3 @@ func getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
 	}
 	return wgtypes.Peer{}, fmt.Errorf("peer not found")
 }
-
-func getLocalIP() (string, error) {
-	// Get all interfaces
-	addrs, err := net.InterfaceAddrs()
-	if err != nil {
-		return "", err
-	}
-
-	for _, addr := range addrs {
-		ipNet, ok := addr.(*net.IPNet)
-		if !ok {
-			continue
-		}
-		if ipNet.IP.IsLoopback() {
-			continue
-		}
-
-		if ipNet.IP.To4() == nil {
-			continue
-		}
-		return ipNet.IP.String(), nil
-	}
-
-	return "", fmt.Errorf("no local IP found")
-}
diff --git a/client/iface/mocks/filter.go b/client/iface/mocks/filter.go
index 5ae98039c..ff3dd0c8a 100644
--- a/client/iface/mocks/filter.go
+++ b/client/iface/mocks/filter.go
@@ -8,7 +8,7 @@ import (
 	"net/netip"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockPacketFilter is a mock of PacketFilter interface.
diff --git a/client/iface/mocks/tun.go b/client/iface/mocks/tun.go
index 677c82b0b..519ee6005 100644
--- a/client/iface/mocks/tun.go
+++ b/client/iface/mocks/tun.go
@@ -8,7 +8,7 @@ import (
 	os "os"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 	tun "golang.zx2c4.com/wireguard/tun"
 )
 
diff --git a/client/iface/netstack/env.go b/client/iface/netstack/env.go
index dd8cf29a3..b069301c1 100644
--- a/client/iface/netstack/env.go
+++ b/client/iface/netstack/env.go
@@ -3,14 +3,31 @@
 package netstack
 
 import (
-	"fmt"
+	"net"
 	"os"
 	"strconv"
 
 	log "github.com/sirupsen/logrus"
 )
 
-const EnvUseNetstackMode = "NB_USE_NETSTACK_MODE"
+const (
+	EnvUseNetstackMode = "NB_USE_NETSTACK_MODE"
+
+	// EnvSocks5ListenerPort overrides the port the SOCKS5 proxy listens on.
+	EnvSocks5ListenerPort = "NB_SOCKS5_LISTENER_PORT"
+
+	// EnvSocks5ListenerAddress overrides the host/IP the SOCKS5 proxy binds to.
+	// The proxy is a bridge for local host applications into the userspace
+	// WireGuard netstack, so it binds to loopback by default. Override this only
+	// when the proxy must be reachable from other hosts (e.g. a container
+	// gateway); doing so exposes an unauthenticated SOCKS5 proxy on that
+	// address.
+	EnvSocks5ListenerAddress = "NB_SOCKS5_LISTENER_ADDRESS"
+
+	// defaultSocks5Host is the loopback address the SOCKS5 proxy binds to unless
+	// overridden via EnvSocks5ListenerAddress.
+	defaultSocks5Host = "127.0.0.1"
+)
 
 // IsEnabled todo: move these function to cmd layer
 func IsEnabled() bool {
@@ -18,24 +35,40 @@ func IsEnabled() bool {
 }
 
 func ListenAddr() string {
-	sPort := os.Getenv("NB_SOCKS5_LISTENER_PORT")
+	return net.JoinHostPort(listenHost(), strconv.Itoa(listenPort()))
+}
+
+// listenHost returns the host/IP the SOCKS5 proxy binds to. It defaults to
+// loopback and only honors EnvSocks5ListenerAddress when it holds a valid IP.
+func listenHost() string {
+	addr := os.Getenv(EnvSocks5ListenerAddress)
+	if addr == "" {
+		return defaultSocks5Host
+	}
+	if net.ParseIP(addr) == nil {
+		log.Warnf("invalid socks5 listener address %q, falling back to default: %s", addr, defaultSocks5Host)
+		return defaultSocks5Host
+	}
+	return addr
+}
+
+// listenPort returns the port the SOCKS5 proxy binds to, defaulting to
+// DefaultSocks5Port when EnvSocks5ListenerPort is unset or invalid.
+func listenPort() int {
+	sPort := os.Getenv(EnvSocks5ListenerPort)
 	if sPort == "" {
-		return listenAddr(DefaultSocks5Port)
+		return DefaultSocks5Port
 	}
 
 	port, err := strconv.Atoi(sPort)
 	if err != nil {
 		log.Warnf("invalid socks5 listener port, unable to convert it to int, falling back to default: %d", DefaultSocks5Port)
-		return listenAddr(DefaultSocks5Port)
+		return DefaultSocks5Port
 	}
 	if port < 1 || port > 65535 {
 		log.Warnf("invalid socks5 listener port, it should be in the range 1-65535, falling back to default: %d", DefaultSocks5Port)
-		return listenAddr(DefaultSocks5Port)
+		return DefaultSocks5Port
 	}
 
-	return listenAddr(port)
-}
-
-func listenAddr(port int) string {
-	return fmt.Sprintf("0.0.0.0:%d", port)
+	return port
 }
diff --git a/client/iface/netstack/env_test.go b/client/iface/netstack/env_test.go
new file mode 100644
index 000000000..1083435a4
--- /dev/null
+++ b/client/iface/netstack/env_test.go
@@ -0,0 +1,63 @@
+//go:build !js
+
+package netstack
+
+import (
+	"net"
+	"strconv"
+	"testing"
+)
+
+func TestListenAddr_DefaultsToLoopback(t *testing.T) {
+	// No env overrides: must bind loopback, never all interfaces.
+	got := ListenAddr()
+	want := net.JoinHostPort("127.0.0.1", strconv.Itoa(DefaultSocks5Port))
+	if got != want {
+		t.Fatalf("ListenAddr() = %q, want %q", got, want)
+	}
+}
+
+func TestListenAddr_AddressOverride(t *testing.T) {
+	tests := []struct {
+		name string
+		env  string
+		want string
+	}{
+		{name: "valid override honored", env: "0.0.0.0", want: "0.0.0.0"},
+		{name: "valid specific ip honored", env: "10.0.0.5", want: "10.0.0.5"},
+		{name: "ipv6 loopback bracketed", env: "::1", want: "::1"},
+		{name: "invalid falls back to loopback", env: "not-an-ip", want: "127.0.0.1"},
+		{name: "empty falls back to loopback", env: "", want: "127.0.0.1"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(EnvSocks5ListenerAddress, tc.env)
+			want := net.JoinHostPort(tc.want, strconv.Itoa(DefaultSocks5Port))
+			if got := ListenAddr(); got != want {
+				t.Fatalf("ListenAddr() = %q, want %q", got, want)
+			}
+		})
+	}
+}
+
+func TestListenAddr_PortOverride(t *testing.T) {
+	tests := []struct {
+		name string
+		env  string
+		want int
+	}{
+		{name: "valid port honored", env: "1081", want: 1081},
+		{name: "non-numeric falls back", env: "abc", want: DefaultSocks5Port},
+		{name: "out of range falls back", env: "70000", want: DefaultSocks5Port},
+		{name: "zero falls back", env: "0", want: DefaultSocks5Port},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(EnvSocks5ListenerPort, tc.env)
+			want := net.JoinHostPort("127.0.0.1", strconv.Itoa(tc.want))
+			if got := ListenAddr(); got != want {
+				t.Fatalf("ListenAddr() = %q, want %q", got, want)
+			}
+		})
+	}
+}
diff --git a/client/iface/udpmux/mux.go b/client/iface/udpmux/mux.go
index c5d2de4a5..2f7287b53 100644
--- a/client/iface/udpmux/mux.go
+++ b/client/iface/udpmux/mux.go
@@ -47,6 +47,7 @@ type SingleSocketUDPMux struct {
 
 	// for UDP connection listen at unspecified address
 	localAddrsForUnspecified []net.Addr
+	unspecified              bool
 }
 
 const maxAddrSize = 512
@@ -157,6 +158,9 @@ func NewSingleSocketUDPMux(params Params) *SingleSocketUDPMux {
 	if params.Logger == nil {
 		params.Logger = getLogger()
 	}
+	if params.Net == nil {
+		params.Net = stdnet.NewNet(context.Background(), nil, nil)
+	}
 
 	mux := &SingleSocketUDPMux{
 		addressMap:       map[string][]*udpMuxedConn{},
@@ -165,6 +169,7 @@ func NewSingleSocketUDPMux(params Params) *SingleSocketUDPMux {
 		connsIPv6:        make(map[string]*udpMuxedConn),
 		candidateConnMap: make(map[string]*udpMuxedConn),
 		closedChan:       make(chan struct{}, 1),
+		unspecified:      isUnspecified(params.UDPConn.LocalAddr()),
 		pool: &sync.Pool{
 			New: func() interface{} {
 				// big enough buffer to fit both packet and address
@@ -173,7 +178,6 @@ func NewSingleSocketUDPMux(params Params) *SingleSocketUDPMux {
 		},
 	}
 
-	mux.updateLocalAddresses()
 	return mux
 }
 
@@ -199,13 +203,6 @@ func (m *SingleSocketUDPMux) updateLocalAddresses() {
 			m.params.Logger.Errorf("LocalAddr expected IPV4 or IPV6, got %T", m.params.UDPConn.LocalAddr())
 		}
 		if len(networks) > 0 {
-			if m.params.Net == nil {
-				var err error
-				if m.params.Net, err = stdnet.NewNet(context.Background(), nil); err != nil {
-					m.params.Logger.Errorf("failed to get create network: %v", err)
-				}
-			}
-
 			ips, err := localInterfaces(m.params.Net, m.params.InterfaceFilter, nil, networks, true)
 			if err == nil {
 				for _, ip := range ips {
@@ -244,10 +241,7 @@ func (m *SingleSocketUDPMux) GetListenAddresses() []net.Addr {
 // creates the connection if an existing one can't be found
 func (m *SingleSocketUDPMux) GetConn(ufrag string, addr net.Addr, candidateID string) (net.PacketConn, error) {
 	// don't check addr for mux using unspecified address
-	m.mu.Lock()
-	lenLocalAddrs := len(m.localAddrsForUnspecified)
-	m.mu.Unlock()
-	if lenLocalAddrs == 0 && m.params.UDPConn.LocalAddr().String() != addr.String() {
+	if !m.unspecified && m.params.UDPConn.LocalAddr().String() != addr.String() {
 		return nil, fmt.Errorf("invalid address %s", addr.String())
 	}
 
@@ -511,3 +505,8 @@ func getLogger() logging.LeveledLogger {
 	//fac.Writer = log.StandardLogger().Writer()
 	return fac.NewLogger("ice")
 }
+
+func isUnspecified(addr net.Addr) bool {
+	udpAddr, ok := addr.(*net.UDPAddr)
+	return ok && udpAddr.IP.IsUnspecified()
+}
diff --git a/client/iface/udpmux/mux_test.go b/client/iface/udpmux/mux_test.go
new file mode 100644
index 000000000..2e2770282
--- /dev/null
+++ b/client/iface/udpmux/mux_test.go
@@ -0,0 +1,99 @@
+package udpmux
+
+import (
+	"fmt"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/pion/transport/v3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type countingNet struct {
+	transport.Net
+	calls  atomic.Int64
+	ifaces []*transport.Interface
+}
+
+func (n *countingNet) Interfaces() ([]*transport.Interface, error) {
+	n.calls.Add(1)
+	return n.ifaces, nil
+}
+
+func TestNewSingleSocketUDPMux_DoesNotDiscoverInterfaces(t *testing.T) {
+	conn := listenUDP(t, net.IPv4zero)
+	n := &countingNet{ifaces: []*transport.Interface{testInterface("eth0", net.IPv4(192, 168, 1, 10))}}
+
+	mux := NewSingleSocketUDPMux(Params{UDPConn: conn, Net: n})
+	t.Cleanup(func() { _ = mux.Close() })
+
+	assert.Equal(t, int64(0), n.calls.Load(), "constructing the mux must not enumerate interfaces")
+
+	addrs := mux.GetListenAddresses()
+	assert.Equal(t, int64(1), n.calls.Load(), "listen addresses are discovered when they are asked for")
+
+	port := conn.LocalAddr().(*net.UDPAddr).Port
+	require.Len(t, addrs, 1, "one address per discovered interface IP")
+	assert.Equal(t, fmt.Sprintf("192.168.1.10:%d", port), addrs[0].String(), "the discovered IP is paired with the socket port")
+}
+
+func TestSingleSocketUDPMux_GetConnWithoutListenAddresses(t *testing.T) {
+	t.Run("unspecified socket accepts any address", func(t *testing.T) {
+		conn := listenUDP(t, net.IPv4zero)
+		n := &countingNet{}
+		mux := NewSingleSocketUDPMux(Params{UDPConn: conn, Net: n})
+		t.Cleanup(func() { _ = mux.Close() })
+
+		port := conn.LocalAddr().(*net.UDPAddr).Port
+		pc, err := mux.GetConn("ufrag", &net.UDPAddr{IP: net.IPv4(192, 168, 1, 10), Port: port}, "candidate")
+		require.NoError(t, err)
+		assert.NotNil(t, pc, "a connection is created for a local address of an unspecified socket")
+		assert.Equal(t, int64(0), n.calls.Load(), "GetConn must not depend on a prior discovery")
+	})
+
+	t.Run("specific socket rejects a foreign address", func(t *testing.T) {
+		conn := listenUDP(t, net.IPv4(127, 0, 0, 1))
+		mux := NewSingleSocketUDPMux(Params{UDPConn: conn})
+		t.Cleanup(func() { _ = mux.Close() })
+
+		_, err := mux.GetConn("ufrag", &net.UDPAddr{IP: net.IPv4(192, 168, 1, 10), Port: 1234}, "candidate")
+		assert.Error(t, err, "an address the socket is not bound to must be rejected")
+
+		pc, err := mux.GetConn("ufrag", conn.LocalAddr(), "candidate")
+		require.NoError(t, err)
+		assert.NotNil(t, pc, "the bound address is accepted")
+	})
+}
+
+func listenUDP(t *testing.T, ip net.IP) *net.UDPConn {
+	t.Helper()
+	conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: 0})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	return conn
+}
+
+func testInterface(name string, ip net.IP) *transport.Interface {
+	ifc := transport.NewInterface(net.Interface{Index: 1, MTU: 1500, Name: name, Flags: net.FlagUp | net.FlagMulticast})
+	ifc.AddAddress(&net.IPNet{IP: ip, Mask: net.CIDRMask(24, 32)})
+	return ifc
+}
+
+func TestSingleSocketUDPMux_ConcurrentListenAddressesWithDefaultNet(t *testing.T) {
+	conn := listenUDP(t, net.IPv4zero)
+	mux := NewSingleSocketUDPMux(Params{UDPConn: conn})
+	t.Cleanup(func() { _ = mux.Close() })
+
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			assert.NotEmpty(t, mux.GetListenAddresses(), "every caller gets at least the socket address")
+		}()
+	}
+	wg.Wait()
+}
diff --git a/client/iface/wgaddr/address.go b/client/iface/wgaddr/address.go
index 43d1ec9aa..148e724f4 100644
--- a/client/iface/wgaddr/address.go
+++ b/client/iface/wgaddr/address.go
@@ -59,6 +59,19 @@ func (addr Address) IPv6Prefix() netip.Prefix {
 	return netip.PrefixFrom(addr.IPv6, addr.IPv6Net.Bits())
 }
 
+// HostPrefix returns the v4 address as a single-host prefix.
+func (addr Address) HostPrefix() netip.Prefix {
+	return netip.PrefixFrom(addr.IP, addr.IP.BitLen())
+}
+
+// IPv6HostPrefix returns the v6 address as a single-host prefix, or an invalid prefix when no v6 overlay address is assigned.
+func (addr Address) IPv6HostPrefix() netip.Prefix {
+	if !addr.HasIPv6() {
+		return netip.Prefix{}
+	}
+	return netip.PrefixFrom(addr.IPv6, addr.IPv6.BitLen())
+}
+
 // SetIPv6FromCompact decodes a compact prefix (5 or 17 bytes) and sets the IPv6 fields.
 // Returns an error if the bytes are invalid. A nil or empty input is a no-op.
 //
diff --git a/client/iface/wgaddr/address_test.go b/client/iface/wgaddr/address_test.go
new file mode 100644
index 000000000..61478b24c
--- /dev/null
+++ b/client/iface/wgaddr/address_test.go
@@ -0,0 +1,24 @@
+package wgaddr
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAddress_HostPrefix(t *testing.T) {
+	addr := MustParseWGAddress("100.91.96.107/16")
+
+	assert.Equal(t, netip.MustParsePrefix("100.91.96.107/32"), addr.HostPrefix(), "v4 host prefix must be a single host")
+	assert.Equal(t, netip.MustParsePrefix("100.91.0.0/16"), addr.Network, "network must keep the overlay prefix length")
+	assert.False(t, addr.IPv6HostPrefix().IsValid(), "no v6 overlay means no v6 host prefix")
+}
+
+func TestAddress_IPv6HostPrefix(t *testing.T) {
+	addr := MustParseWGAddress("100.91.96.107/16")
+	addr.IPv6 = netip.MustParseAddr("fd00:1234::1")
+	addr.IPv6Net = netip.MustParsePrefix("fd00:1234::/64")
+
+	assert.Equal(t, netip.MustParsePrefix("fd00:1234::1/128"), addr.IPv6HostPrefix(), "v6 host prefix must be a single host")
+}
diff --git a/client/iface/wgproxy/bind/proxy.go b/client/iface/wgproxy/bind/proxy.go
index be690ed4f..fcaee15c7 100644
--- a/client/iface/wgproxy/bind/proxy.go
+++ b/client/iface/wgproxy/bind/proxy.go
@@ -53,15 +53,15 @@ func NewProxyBind(bind Bind, mtu uint16) *ProxyBind {
 	return p
 }
 
-// AddTurnConn adds a new connection to the bind.
+// AddRelayedConn adds a new connection to the bind.
 // endpoint is the NetBird address of the remote peer. The SetEndpoint return with the address what will be used in the
 // WireGuard configuration.
 //
 // Parameters:
 //   - ctx: Context is used for proxyToLocal to avoid unnecessary error messages
 //   - nbAddr: The NetBird UDP address of the remote peer, it required to generate fake address
-//   - remoteConn: The established TURN connection to the remote peer
-func (p *ProxyBind) AddTurnConn(ctx context.Context, nbAddr *net.UDPAddr, remoteConn net.Conn) error {
+//   - remoteConn: The established relayed connection to the remote peer
+func (p *ProxyBind) AddRelayedConn(ctx context.Context, nbAddr *net.UDPAddr, remoteConn net.Conn) error {
 	fakeNetIP, err := fakeAddress(nbAddr)
 	if err != nil {
 		return err
diff --git a/client/iface/wgproxy/ebpf/portlookup.go b/client/iface/wgproxy/ebpf/portlookup.go
deleted file mode 100644
index fce8f1507..000000000
--- a/client/iface/wgproxy/ebpf/portlookup.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package ebpf
-
-import (
-	"fmt"
-	"net"
-)
-
-var (
-	portRangeStart = 3128
-	portRangeEnd   = portRangeStart + 100
-)
-
-type portLookup struct {
-}
-
-func (pl portLookup) searchFreePort() (int, error) {
-	for i := portRangeStart; i <= portRangeEnd; i++ {
-		if pl.tryToBind(i) == nil {
-			return i, nil
-		}
-	}
-	return 0, fmt.Errorf("failed to bind free port for eBPF proxy")
-}
-
-func (pl portLookup) tryToBind(port int) error {
-	l, err := net.ListenPacket("udp", fmt.Sprintf(":%d", port))
-	if err != nil {
-		return err
-	}
-	_ = l.Close()
-	return nil
-}
diff --git a/client/iface/wgproxy/ebpf/portlookup_test.go b/client/iface/wgproxy/ebpf/portlookup_test.go
deleted file mode 100644
index a2e92fc79..000000000
--- a/client/iface/wgproxy/ebpf/portlookup_test.go
+++ /dev/null
@@ -1,45 +0,0 @@
-package ebpf
-
-import (
-	"fmt"
-	"net"
-	"testing"
-)
-
-func Test_portLookup_searchFreePort(t *testing.T) {
-	pl := portLookup{}
-	_, err := pl.searchFreePort()
-	if err != nil {
-		t.Fatal(err)
-	}
-}
-
-func Test_portLookup_on_allocated(t *testing.T) {
-	pl := portLookup{}
-
-	portRangeStart = 4128
-	portRangeEnd = portRangeStart + 100
-
-	allocatedPort, err := allocatePort(portRangeStart)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer allocatedPort.Close()
-
-	fp, err := pl.searchFreePort()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if fp != (portRangeStart + 1) {
-		t.Errorf("invalid free port, expected: %d, got: %d", portRangeStart+1, fp)
-	}
-}
-
-func allocatePort(port int) (net.PacketConn, error) {
-	c, err := net.ListenPacket("udp", fmt.Sprintf(":%d", port))
-	if err != nil {
-		return nil, err
-	}
-	return c, err
-}
diff --git a/client/iface/wgproxy/ebpf/proxy.go b/client/iface/wgproxy/ebpf/proxy.go
deleted file mode 100644
index 1b1a8ce1c..000000000
--- a/client/iface/wgproxy/ebpf/proxy.go
+++ /dev/null
@@ -1,243 +0,0 @@
-//go:build linux && !android
-
-package ebpf
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"sync"
-
-	"github.com/hashicorp/go-multierror"
-	"github.com/pion/transport/v3"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/client/iface/bufsize"
-	"github.com/netbirdio/netbird/client/iface/wgproxy/rawsocket"
-	"github.com/netbirdio/netbird/client/internal/ebpf"
-	ebpfMgr "github.com/netbirdio/netbird/client/internal/ebpf/manager"
-	nbnet "github.com/netbirdio/netbird/client/net"
-)
-
-const (
-	loopbackAddr = "127.0.0.1"
-)
-
-// WGEBPFProxy definition for proxy with EBPF support
-type WGEBPFProxy struct {
-	localWGListenPort int
-	proxyPort         int
-	mtu               uint16
-
-	ebpfManager   ebpfMgr.Manager
-	turnConnStore map[uint16]net.Conn
-	turnConnMutex sync.Mutex
-
-	lastUsedPort uint16
-	rawConnIPv4  net.PacketConn
-	rawConnIPv6  net.PacketConn
-	conn         transport.UDPConn
-
-	ctx       context.Context
-	ctxCancel context.CancelFunc
-}
-
-// NewWGEBPFProxy create new WGEBPFProxy instance
-func NewWGEBPFProxy(wgPort int, mtu uint16) *WGEBPFProxy {
-	log.Debugf("instantiate ebpf proxy")
-	wgProxy := &WGEBPFProxy{
-		localWGListenPort: wgPort,
-		mtu:               mtu,
-		ebpfManager:       ebpf.GetEbpfManagerInstance(),
-		turnConnStore:     make(map[uint16]net.Conn),
-	}
-	return wgProxy
-}
-
-// Listen load ebpf program and listen the proxy
-func (p *WGEBPFProxy) Listen() error {
-	pl := portLookup{}
-	proxyPort, err := pl.searchFreePort()
-	if err != nil {
-		return err
-	}
-	p.proxyPort = proxyPort
-
-	// Prepare IPv4 raw socket (required)
-	p.rawConnIPv4, err = rawsocket.PrepareSenderRawSocketIPv4()
-	if err != nil {
-		return err
-	}
-
-	// Prepare IPv6 raw socket (optional)
-	p.rawConnIPv6, err = rawsocket.PrepareSenderRawSocketIPv6()
-	if err != nil {
-		log.Warnf("failed to prepare IPv6 raw socket, continuing with IPv4 only: %v", err)
-	}
-
-	err = p.ebpfManager.LoadWgProxy(proxyPort, p.localWGListenPort)
-	if err != nil {
-		if closeErr := p.rawConnIPv4.Close(); closeErr != nil {
-			log.Warnf("failed to close IPv4 raw socket: %v", closeErr)
-		}
-		if p.rawConnIPv6 != nil {
-			if closeErr := p.rawConnIPv6.Close(); closeErr != nil {
-				log.Warnf("failed to close IPv6 raw socket: %v", closeErr)
-			}
-		}
-		return err
-	}
-
-	addr := net.UDPAddr{
-		Port: proxyPort,
-		IP:   net.ParseIP(loopbackAddr),
-	}
-
-	p.ctx, p.ctxCancel = context.WithCancel(context.Background())
-
-	conn, err := nbnet.ListenUDP("udp", &addr)
-	if err != nil {
-		if cErr := p.Free(); cErr != nil {
-			log.Errorf("Failed to close the wgproxy: %s", cErr)
-		}
-		return err
-	}
-	p.conn = conn
-
-	go p.proxyToRemote()
-	log.Infof("local wg proxy listening on: %d", proxyPort)
-	return nil
-}
-
-// AddTurnConn add new turn connection for the proxy
-func (p *WGEBPFProxy) AddTurnConn(turnConn net.Conn) (*net.UDPAddr, error) {
-	wgEndpointPort, err := p.storeTurnConn(turnConn)
-	if err != nil {
-		return nil, err
-	}
-
-	log.Infof("turn conn added to wg proxy store: %s, endpoint port: :%d", turnConn.RemoteAddr(), wgEndpointPort)
-
-	wgEndpoint := &net.UDPAddr{
-		IP:   net.ParseIP(loopbackAddr),
-		Port: int(wgEndpointPort),
-	}
-	return wgEndpoint, nil
-}
-
-// Free resources except the remoteConns will be keep open.
-func (p *WGEBPFProxy) Free() error {
-	log.Debugf("free up ebpf wg proxy")
-	if p.ctx != nil && p.ctx.Err() != nil {
-		//nolint
-		return nil
-	}
-
-	p.ctxCancel()
-
-	var result *multierror.Error
-	if p.conn != nil {
-		if err := p.conn.Close(); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-
-	if err := p.ebpfManager.FreeWGProxy(); err != nil {
-		result = multierror.Append(result, err)
-	}
-
-	if p.rawConnIPv4 != nil {
-		if err := p.rawConnIPv4.Close(); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-
-	if p.rawConnIPv6 != nil {
-		if err := p.rawConnIPv6.Close(); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-	return nberrors.FormatErrorOrNil(result)
-}
-
-// GetProxyPort returns the proxy listening port.
-func (p *WGEBPFProxy) GetProxyPort() uint16 {
-	return uint16(p.proxyPort)
-}
-
-// proxyToRemote read messages from local WireGuard interface and forward it to remote conn
-// From this go routine has only one instance.
-func (p *WGEBPFProxy) proxyToRemote() {
-	buf := make([]byte, p.mtu+bufsize.WGBufferOverhead)
-	for p.ctx.Err() == nil {
-		if err := p.readAndForwardPacket(buf); err != nil {
-			if p.ctx.Err() != nil {
-				return
-			}
-			log.Errorf("failed to proxy packet to remote conn: %s", err)
-		}
-	}
-}
-
-func (p *WGEBPFProxy) readAndForwardPacket(buf []byte) error {
-	n, addr, err := p.conn.ReadFromUDP(buf)
-	if err != nil {
-		return fmt.Errorf("failed to read UDP packet from WG: %w", err)
-	}
-
-	p.turnConnMutex.Lock()
-	conn, ok := p.turnConnStore[uint16(addr.Port)]
-	p.turnConnMutex.Unlock()
-	if !ok {
-		if p.ctx.Err() == nil {
-			log.Debugf("turn conn not found by port because conn already has been closed: %d", addr.Port)
-		}
-		return nil
-	}
-
-	if _, err := conn.Write(buf[:n]); err != nil {
-		return fmt.Errorf("failed to forward local WG packet (%d) to remote turn conn: %w", addr.Port, err)
-	}
-	return nil
-}
-
-func (p *WGEBPFProxy) storeTurnConn(turnConn net.Conn) (uint16, error) {
-	p.turnConnMutex.Lock()
-	defer p.turnConnMutex.Unlock()
-
-	np, err := p.nextFreePort()
-	if err != nil {
-		return np, err
-	}
-	p.turnConnStore[np] = turnConn
-	return np, nil
-}
-
-func (p *WGEBPFProxy) removeTurnConn(turnConnID uint16) {
-	p.turnConnMutex.Lock()
-	defer p.turnConnMutex.Unlock()
-
-	_, ok := p.turnConnStore[turnConnID]
-	if ok {
-		log.Debugf("remove turn conn from store by port: %d", turnConnID)
-	}
-	delete(p.turnConnStore, turnConnID)
-}
-
-func (p *WGEBPFProxy) nextFreePort() (uint16, error) {
-	if len(p.turnConnStore) == 65535 {
-		return 0, fmt.Errorf("reached maximum turn connection numbers")
-	}
-generatePort:
-	if p.lastUsedPort == 65535 {
-		p.lastUsedPort = 1
-	} else {
-		p.lastUsedPort++
-	}
-
-	if _, ok := p.turnConnStore[p.lastUsedPort]; ok {
-		goto generatePort
-	}
-	return p.lastUsedPort, nil
-}
diff --git a/client/iface/wgproxy/ebpf/proxy_test.go b/client/iface/wgproxy/ebpf/proxy_test.go
deleted file mode 100644
index 3ec4f0eba..000000000
--- a/client/iface/wgproxy/ebpf/proxy_test.go
+++ /dev/null
@@ -1,56 +0,0 @@
-//go:build linux && !android
-
-package ebpf
-
-import (
-	"testing"
-)
-
-func TestWGEBPFProxy_connStore(t *testing.T) {
-	wgProxy := NewWGEBPFProxy(1, 1280)
-
-	p, _ := wgProxy.storeTurnConn(nil)
-	if p != 1 {
-		t.Errorf("invalid initial port: %d", wgProxy.lastUsedPort)
-	}
-
-	numOfConns := 10
-	for i := 0; i < numOfConns; i++ {
-		p, _ = wgProxy.storeTurnConn(nil)
-	}
-	if p != uint16(numOfConns)+1 {
-		t.Errorf("invalid last used port: %d, expected: %d", p, numOfConns+1)
-	}
-	if len(wgProxy.turnConnStore) != numOfConns+1 {
-		t.Errorf("invalid store size: %d, expected: %d", len(wgProxy.turnConnStore), numOfConns+1)
-	}
-}
-
-func TestWGEBPFProxy_portCalculation_overflow(t *testing.T) {
-	wgProxy := NewWGEBPFProxy(1, 1280)
-
-	_, _ = wgProxy.storeTurnConn(nil)
-	wgProxy.lastUsedPort = 65535
-	p, _ := wgProxy.storeTurnConn(nil)
-
-	if len(wgProxy.turnConnStore) != 2 {
-		t.Errorf("invalid store size: %d, expected: %d", len(wgProxy.turnConnStore), 2)
-	}
-
-	if p != 2 {
-		t.Errorf("invalid last used port: %d, expected: %d", p, 2)
-	}
-}
-
-func TestWGEBPFProxy_portCalculation_maxConn(t *testing.T) {
-	wgProxy := NewWGEBPFProxy(1, 1280)
-
-	for i := 0; i < 65535; i++ {
-		_, _ = wgProxy.storeTurnConn(nil)
-	}
-
-	_, err := wgProxy.storeTurnConn(nil)
-	if err == nil {
-		t.Errorf("invalid turn conn store calculation")
-	}
-}
diff --git a/client/iface/wgproxy/factory_kernel.go b/client/iface/wgproxy/factory_kernel.go
index 7821df3de..0b2329b96 100644
--- a/client/iface/wgproxy/factory_kernel.go
+++ b/client/iface/wgproxy/factory_kernel.go
@@ -8,11 +8,13 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/iface/wgproxy/ebpf"
+	"github.com/netbirdio/netbird/client/iface/wgproxy/loopback"
 	udpProxy "github.com/netbirdio/netbird/client/iface/wgproxy/udp"
 )
 
 const (
+	envDisableKernelWGProxy = "NB_DISABLE_KERNEL_WG_PROXY"
+	// envDisableEBPFWGProxy is a deprecated alias for envDisableKernelWGProxy.
 	envDisableEBPFWGProxy = "NB_DISABLE_EBPF_WG_PROXY"
 )
 
@@ -20,7 +22,7 @@ type KernelFactory struct {
 	wgPort int
 	mtu    uint16
 
-	ebpfProxy *ebpf.WGEBPFProxy
+	loopbackProxy *loopback.Proxy
 }
 
 func NewKernelFactory(wgPort int, mtu uint16) *KernelFactory {
@@ -29,55 +31,56 @@ func NewKernelFactory(wgPort int, mtu uint16) *KernelFactory {
 		mtu:    mtu,
 	}
 
-	if isEBPFDisabled() {
+	if isKernelProxyDisabled() {
 		log.Infof("WireGuard Proxy Factory will produce UDP proxy")
-		log.Infof("eBPF WireGuard proxy is disabled via %s environment variable", envDisableEBPFWGProxy)
 		return f
 	}
 
-	ebpfProxy := ebpf.NewWGEBPFProxy(wgPort, mtu)
-	if err := ebpfProxy.Listen(); err != nil {
+	loopbackProxy := loopback.NewProxy(wgPort, mtu)
+	if err := loopbackProxy.Listen(); err != nil {
 		log.Infof("WireGuard Proxy Factory will produce UDP proxy")
-		log.Warnf("failed to initialize ebpf proxy, fallback to user space proxy: %s", err)
+		log.Warnf("failed to initialize loopback proxy, fallback to user space proxy: %s", err)
 		return f
 	}
-	log.Infof("WireGuard Proxy Factory will produce eBPF proxy")
-	f.ebpfProxy = ebpfProxy
+	log.Infof("WireGuard Proxy Factory will produce loopback proxy")
+	f.loopbackProxy = loopbackProxy
 	return f
 }
 
 func (w *KernelFactory) GetProxy() Proxy {
-	if w.ebpfProxy == nil {
+	if w.loopbackProxy == nil {
 		return udpProxy.NewWGUDPProxy(w.wgPort, w.mtu)
 	}
 
-	return ebpf.NewProxyWrapper(w.ebpfProxy)
-}
-
-// GetProxyPort returns the eBPF proxy port, or 0 if eBPF is not active.
-func (w *KernelFactory) GetProxyPort() uint16 {
-	if w.ebpfProxy == nil {
-		return 0
-	}
-	return w.ebpfProxy.GetProxyPort()
+	return loopback.NewProxyWrapper(w.loopbackProxy)
 }
 
 func (w *KernelFactory) Free() error {
-	if w.ebpfProxy == nil {
+	if w.loopbackProxy == nil {
 		return nil
 	}
-	return w.ebpfProxy.Free()
+	return w.loopbackProxy.Free()
 }
 
-func isEBPFDisabled() bool {
-	val := os.Getenv(envDisableEBPFWGProxy)
+func isKernelProxyDisabled() bool {
+	env := envDisableKernelWGProxy
+	val := os.Getenv(env)
+	if val == "" {
+		env = envDisableEBPFWGProxy
+		val = os.Getenv(env)
+	}
 	if val == "" {
 		return false
 	}
+
 	disabled, err := strconv.ParseBool(val)
 	if err != nil {
-		log.Warnf("failed to parse %s: %v", envDisableEBPFWGProxy, err)
+		log.Warnf("failed to parse %s: %v", env, err)
 		return false
 	}
+
+	if disabled {
+		log.Infof("kernel WireGuard proxy is disabled via %s", env)
+	}
 	return disabled
 }
diff --git a/client/iface/wgproxy/factory_usp.go b/client/iface/wgproxy/factory_usp.go
index bbd67e076..a1b1c34d7 100644
--- a/client/iface/wgproxy/factory_usp.go
+++ b/client/iface/wgproxy/factory_usp.go
@@ -24,11 +24,6 @@ func (w *USPFactory) GetProxy() Proxy {
 	return proxyBind.NewProxyBind(w.bind, w.mtu)
 }
 
-// GetProxyPort returns 0 as userspace WireGuard doesn't use a separate proxy port.
-func (w *USPFactory) GetProxyPort() uint16 {
-	return 0
-}
-
 func (w *USPFactory) Free() error {
 	return nil
 }
diff --git a/client/iface/wgproxy/loopback/addr.go b/client/iface/wgproxy/loopback/addr.go
new file mode 100644
index 000000000..52feee295
--- /dev/null
+++ b/client/iface/wgproxy/loopback/addr.go
@@ -0,0 +1,70 @@
+//go:build linux && !android
+
+package loopback
+
+import (
+	"fmt"
+	"net/netip"
+)
+
+// Peer endpoints live in the upper half of 127.0.0.0/8. Everything in that
+// range is delivered to the loopback device without any address or route being
+// configured, and staying out of 127.0.0.0/9 keeps well-known squatters such as
+// 127.0.0.53 (systemd-resolved) and 127.0.1.1 out of the way.
+const (
+	addrRangeBase   uint32 = 0x7f800000 // 127.128.0.0
+	addrRangeSize   uint32 = 1 << 23    // /9
+	addrRangePrefix        = "127.128.0.0/9"
+)
+
+// allocator hands out one loopback address per relayed connection. The address
+// is the peer's identity: WireGuard sends to it, and the proxy recovers which
+// peer a packet belongs to from the destination address.
+type allocator struct {
+	cursor uint32
+}
+
+// next returns the first free address at or after the cursor, wrapping once.
+// inUse reports whether an address is already handed out.
+func (a *allocator) next(inUse func(netip.Addr) bool) (netip.Addr, error) {
+	for i := uint32(0); i < addrRangeSize; i++ {
+		a.cursor = (a.cursor + 1) % addrRangeSize
+		addr := addrFromOffset(a.cursor)
+		if !addr.IsValid() {
+			continue
+		}
+		if inUse(addr) {
+			continue
+		}
+		return addr, nil
+	}
+	return netip.Addr{}, fmt.Errorf("no free endpoint address in %s", addrRangePrefix)
+}
+
+// addrFromOffset maps an offset in the range to an address, skipping the .0 and
+// .255 hosts. They are unremarkable on loopback, but tools and firewall rules
+// tend to treat them as network and broadcast addresses.
+func addrFromOffset(offset uint32) netip.Addr {
+	last := offset & 0xff
+	if last == 0 || last == 0xff {
+		return netip.Addr{}
+	}
+
+	v := addrRangeBase + offset
+	return netip.AddrFrom4([4]byte{
+		byte(v >> 24),
+		byte(v >> 16),
+		byte(v >> 8),
+		byte(v),
+	})
+}
+
+// inRange reports whether addr is one this proxy could have handed out.
+func inRange(addr netip.Addr) bool {
+	if !addr.Is4() {
+		return false
+	}
+	b := addr.As4()
+	v := uint32(b[0])<<24 | uint32(b[1])<<16 | uint32(b[2])<<8 | uint32(b[3])
+	return v >= addrRangeBase && v < addrRangeBase+addrRangeSize && b[3] != 0 && b[3] != 0xff
+}
diff --git a/client/iface/wgproxy/loopback/addr_test.go b/client/iface/wgproxy/loopback/addr_test.go
new file mode 100644
index 000000000..3755b7269
--- /dev/null
+++ b/client/iface/wgproxy/loopback/addr_test.go
@@ -0,0 +1,114 @@
+//go:build linux && !android
+
+package loopback
+
+import (
+	"net/netip"
+	"testing"
+)
+
+func TestAllocatorHandsOutDistinctAddresses(t *testing.T) {
+	var a allocator
+	taken := make(map[netip.Addr]bool)
+
+	for i := 0; i < 1000; i++ {
+		addr, err := a.next(func(candidate netip.Addr) bool { return taken[candidate] })
+		if err != nil {
+			t.Fatalf("allocate %d: %v", i, err)
+		}
+		if taken[addr] {
+			t.Fatalf("address %s handed out twice", addr)
+		}
+		if !inRange(addr) {
+			t.Fatalf("address %s outside %s", addr, addrRangePrefix)
+		}
+		taken[addr] = true
+	}
+}
+
+func TestAllocatorSkipsNetworkAndBroadcastHosts(t *testing.T) {
+	var a allocator
+	taken := make(map[netip.Addr]bool)
+
+	// enough allocations to walk past a .255/.0 boundary
+	for i := 0; i < 600; i++ {
+		addr, err := a.next(func(candidate netip.Addr) bool { return taken[candidate] })
+		if err != nil {
+			t.Fatalf("allocate %d: %v", i, err)
+		}
+		last := addr.As4()[3]
+		if last == 0 || last == 255 {
+			t.Fatalf("address %s ends in .%d", addr, last)
+		}
+		taken[addr] = true
+	}
+}
+
+func TestAllocatorReusesReleasedAddresses(t *testing.T) {
+	var a allocator
+	taken := make(map[netip.Addr]bool)
+	inUse := func(candidate netip.Addr) bool { return taken[candidate] }
+	alloc := func() netip.Addr {
+		t.Helper()
+		addr, err := a.next(inUse)
+		if err != nil {
+			t.Fatalf("allocate: %v", err)
+		}
+		taken[addr] = true
+		return addr
+	}
+
+	first := alloc()
+	second := alloc()
+	delete(taken, first)
+
+	// The cursor only moves forward, so a released address comes back after a
+	// wrap. Park the cursor near the end of the range instead of allocating
+	// 2^23 addresses: the next call takes the last usable address, and the one
+	// after that wraps past the skipped .255 and .0 hosts to the released one.
+	a.cursor = addrRangeSize - 3
+	last := alloc()
+	if want := netip.MustParseAddr("127.255.255.254"); last != want {
+		t.Fatalf("expected the last usable address %s before the wrap, got %s", want, last)
+	}
+
+	if reused := alloc(); reused != first {
+		t.Fatalf("expected the released address %s after the wrap, got %s", first, reused)
+	}
+
+	// second is still held, so the allocator must step over it.
+	if next := alloc(); next == second {
+		t.Fatalf("allocator handed out %s while it was still in use", second)
+	}
+}
+
+func TestInRange(t *testing.T) {
+	tests := []struct {
+		addr string
+		want bool
+	}{
+		{"127.128.0.1", true},
+		{"127.255.255.254", true},
+		{"127.128.0.0", false},     // network host, never handed out
+		{"127.128.5.255", false},   // broadcast host, never handed out
+		{"127.127.255.255", false}, // below the range, where 127.0.0.53 and friends live
+		{"127.0.0.1", false},
+		{"127.0.0.53", false},
+		{"127.0.1.1", false},
+		{"128.0.0.1", false},
+		{"10.0.0.1", false},
+	}
+
+	for _, tc := range tests {
+		addr := netip.MustParseAddr(tc.addr)
+		if got := inRange(addr); got != tc.want {
+			t.Errorf("inRange(%s) = %v, want %v", tc.addr, got, tc.want)
+		}
+	}
+}
+
+func TestInRangeIgnoresIPv6(t *testing.T) {
+	if inRange(netip.MustParseAddr("::1")) {
+		t.Error("inRange(::1) = true, want false")
+	}
+}
diff --git a/client/iface/wgproxy/loopback/proxy.go b/client/iface/wgproxy/loopback/proxy.go
new file mode 100644
index 000000000..f9364c766
--- /dev/null
+++ b/client/iface/wgproxy/loopback/proxy.go
@@ -0,0 +1,291 @@
+//go:build linux && !android
+
+package loopback
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/netip"
+	"sync"
+	"syscall"
+
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/net/ipv4"
+	"golang.org/x/sys/unix"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	"github.com/netbirdio/netbird/client/iface/bufsize"
+	"github.com/netbirdio/netbird/client/iface/wgproxy/rawsocket"
+)
+
+const (
+	loopbackDevice = "lo"
+
+	portRangeStart = 3128
+	portRangeEnd   = portRangeStart + 100
+)
+
+// Proxy forwards packets between relayed connections and a local kernel
+// WireGuard instance. Every relayed peer gets its own loopback address as its
+// WireGuard endpoint, so a single socket serves all of them: the destination
+// address of an incoming packet identifies the peer.
+type Proxy struct {
+	localWGListenPort int
+	mtu               uint16
+	proxyPort         int
+
+	conn        *net.UDPConn
+	packetConn  *ipv4.PacketConn
+	loIndex     int
+	rawConnIPv4 net.PacketConn
+	rawConnIPv6 net.PacketConn
+
+	relayedConnMutex sync.Mutex
+	relayedConnStore map[netip.Addr]net.Conn
+	addrs            allocator
+
+	ctx       context.Context
+	ctxCancel context.CancelFunc
+}
+
+// NewProxy creates a proxy for the WireGuard instance listening on wgPort.
+func NewProxy(wgPort int, mtu uint16) *Proxy {
+	log.Debugf("instantiate loopback wg proxy")
+	return &Proxy{
+		localWGListenPort: wgPort,
+		mtu:               mtu,
+		relayedConnStore:  make(map[netip.Addr]net.Conn),
+	}
+}
+
+// Listen opens the shared socket and starts forwarding WireGuard packets to the
+// relayed connections.
+func (p *Proxy) Listen() error {
+	rawConnIPv4, err := rawsocket.PrepareSenderRawSocketIPv4()
+	if err != nil {
+		return fmt.Errorf("prepare IPv4 raw socket: %w", err)
+	}
+	p.rawConnIPv4 = rawConnIPv4
+
+	p.rawConnIPv6, err = rawsocket.PrepareSenderRawSocketIPv6()
+	if err != nil {
+		log.Warnf("failed to prepare IPv6 raw socket, continuing with IPv4 only: %v", err)
+	}
+
+	loopback, err := net.InterfaceByName(loopbackDevice)
+	if err != nil {
+		if freeErr := p.Free(); freeErr != nil {
+			log.Errorf("failed to free the wgproxy: %s", freeErr)
+		}
+		return fmt.Errorf("look up %s: %w", loopbackDevice, err)
+	}
+	p.loIndex = loopback.Index
+
+	if err := p.listen(); err != nil {
+		if freeErr := p.Free(); freeErr != nil {
+			log.Errorf("failed to free the wgproxy: %s", freeErr)
+		}
+		return err
+	}
+
+	p.ctx, p.ctxCancel = context.WithCancel(context.Background())
+
+	go p.proxyToRemote()
+	log.Infof("local wg proxy listening on %s:%d", addrRangePrefix, p.proxyPort)
+	return nil
+}
+
+// listen binds the shared socket on the first free port of the range. The bind
+// has to be a wildcard one to receive every peer address in the range, so it is
+// restricted to the loopback device: without that the port would be reachable
+// on every interface.
+func (p *Proxy) listen() error {
+	var lastErr error
+	for port := portRangeStart; port <= portRangeEnd; port++ {
+		err := p.listenOn(port)
+		if err == nil {
+			p.proxyPort = port
+			return nil
+		}
+		lastErr = err
+	}
+	return fmt.Errorf("bind proxy port in range %d-%d: %w", portRangeStart, portRangeEnd, lastErr)
+}
+
+func (p *Proxy) listenOn(proxyPort int) error {
+	lc := net.ListenConfig{
+		Control: func(_, _ string, c syscall.RawConn) error {
+			var sockErr error
+			if err := c.Control(func(fd uintptr) {
+				if err := unix.SetsockoptString(int(fd), unix.SOL_SOCKET, unix.SO_BINDTODEVICE, loopbackDevice); err != nil {
+					sockErr = fmt.Errorf("bind to %s: %w", loopbackDevice, err)
+					return
+				}
+			}); err != nil {
+				return fmt.Errorf("control socket: %w", err)
+			}
+			return sockErr
+		},
+	}
+
+	conn, err := lc.ListenPacket(context.Background(), "udp4", fmt.Sprintf(":%d", proxyPort))
+	if err != nil {
+		return fmt.Errorf("listen on :%d: %w", proxyPort, err)
+	}
+
+	udpConn, ok := conn.(*net.UDPConn)
+	if !ok {
+		if closeErr := conn.Close(); closeErr != nil {
+			log.Errorf("failed to close proxy conn: %s", closeErr)
+		}
+		return fmt.Errorf("unexpected conn type %T", conn)
+	}
+
+	packetConn := ipv4.NewPacketConn(udpConn)
+	// the destination address carries the peer identity, the interface index is
+	// checked on receive as a second line of defense behind SO_BINDTODEVICE
+	if err := packetConn.SetControlMessage(ipv4.FlagDst|ipv4.FlagInterface, true); err != nil {
+		if closeErr := udpConn.Close(); closeErr != nil {
+			log.Errorf("failed to close proxy conn: %s", closeErr)
+		}
+		return fmt.Errorf("request destination address: %w", err)
+	}
+
+	p.conn = udpConn
+	p.packetConn = packetConn
+	return nil
+}
+
+// AddRelayedConn assigns an endpoint address to the relayed connection and
+// returns the address WireGuard should send to, along with the key the
+// connection is stored under.
+func (p *Proxy) AddRelayedConn(relayedConn net.Conn) (*net.UDPAddr, netip.Addr, error) {
+	addr, err := p.storeRelayedConn(relayedConn)
+	if err != nil {
+		return nil, netip.Addr{}, err
+	}
+
+	log.Infof("relayed conn added to wg proxy store: %s, endpoint address: %s", relayedConn.RemoteAddr(), addr)
+
+	return &net.UDPAddr{
+		IP:   addr.AsSlice(),
+		Port: p.proxyPort,
+	}, addr, nil
+}
+
+// Free releases the proxy resources. The relayed connections are left open.
+func (p *Proxy) Free() error {
+	log.Debugf("free up loopback wg proxy")
+	if p.ctx != nil && p.ctx.Err() != nil {
+		//nolint
+		return nil
+	}
+
+	if p.ctxCancel != nil {
+		p.ctxCancel()
+	}
+
+	var result *multierror.Error
+	if p.conn != nil {
+		if err := p.conn.Close(); err != nil {
+			result = multierror.Append(result, err)
+		}
+	}
+
+	if p.rawConnIPv4 != nil {
+		if err := p.rawConnIPv4.Close(); err != nil {
+			result = multierror.Append(result, err)
+		}
+	}
+
+	if p.rawConnIPv6 != nil {
+		if err := p.rawConnIPv6.Close(); err != nil {
+			result = multierror.Append(result, err)
+		}
+	}
+	return nberrors.FormatErrorOrNil(result)
+}
+
+// proxyToRemote reads packets from the local WireGuard instance and forwards
+// them to the relayed connection the destination address belongs to.
+func (p *Proxy) proxyToRemote() {
+	buf := make([]byte, p.mtu+bufsize.WGBufferOverhead)
+	for p.ctx.Err() == nil {
+		if err := p.readAndForwardPacket(buf); err != nil {
+			if p.ctx.Err() != nil {
+				return
+			}
+			log.Errorf("failed to proxy packet to remote conn: %s", err)
+		}
+	}
+}
+
+func (p *Proxy) readAndForwardPacket(buf []byte) error {
+	n, cm, _, err := p.packetConn.ReadFrom(buf)
+	if err != nil {
+		return fmt.Errorf("read UDP packet from WG: %w", err)
+	}
+
+	if cm == nil {
+		return fmt.Errorf("no control message on packet")
+	}
+
+	if cm.IfIndex != p.loIndex {
+		log.Tracef("dropping packet received on interface %d instead of %s", cm.IfIndex, loopbackDevice)
+		return nil
+	}
+
+	dst, ok := netip.AddrFromSlice(cm.Dst.To4())
+	if !ok || !inRange(dst) {
+		log.Tracef("dropping packet for unexpected destination %s", cm.Dst)
+		return nil
+	}
+
+	p.relayedConnMutex.Lock()
+	conn, ok := p.relayedConnStore[dst]
+	p.relayedConnMutex.Unlock()
+	if !ok {
+		if p.ctx.Err() == nil {
+			log.Debugf("relayed conn not found by address because conn already has been closed: %s", dst)
+		}
+		return nil
+	}
+
+	if _, err := conn.Write(buf[:n]); err != nil {
+		return fmt.Errorf("forward local WG packet (%s) to remote relayed conn: %w", dst, err)
+	}
+	return nil
+}
+
+func (p *Proxy) storeRelayedConn(relayedConn net.Conn) (netip.Addr, error) {
+	p.relayedConnMutex.Lock()
+	defer p.relayedConnMutex.Unlock()
+
+	addr, err := p.addrs.next(func(a netip.Addr) bool {
+		_, ok := p.relayedConnStore[a]
+		return ok
+	})
+	if err != nil {
+		return netip.Addr{}, err
+	}
+
+	p.relayedConnStore[addr] = relayedConn
+	return addr, nil
+}
+
+// removeRelayedConn releases an endpoint address. It only removes the entry
+// while it still belongs to relayedConn, so a late release cannot take an
+// address away from the peer it was handed to next.
+func (p *Proxy) removeRelayedConn(addr netip.Addr, relayedConn net.Conn) {
+	p.relayedConnMutex.Lock()
+	defer p.relayedConnMutex.Unlock()
+
+	if stored, ok := p.relayedConnStore[addr]; !ok || stored != relayedConn {
+		return
+	}
+
+	log.Debugf("remove relayed conn from store by address: %s", addr)
+	delete(p.relayedConnStore, addr)
+}
diff --git a/client/iface/wgproxy/loopback/proxy_privileged_test.go b/client/iface/wgproxy/loopback/proxy_privileged_test.go
new file mode 100644
index 000000000..6314fe2de
--- /dev/null
+++ b/client/iface/wgproxy/loopback/proxy_privileged_test.go
@@ -0,0 +1,196 @@
+//go:build linux && !android && privileged
+
+package loopback
+
+import (
+	"context"
+	"net"
+	"strconv"
+	"testing"
+	"time"
+)
+
+const testWGPort = 51862
+
+// relayEnd stands in for a relayed connection: the proxy writes what it read
+// from WireGuard into it, and the test reads it back out here.
+func relayEnd(t *testing.T) (proxySide net.Conn, testSide *net.UDPConn) {
+	t.Helper()
+
+	testSide, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.ParseIP("127.0.0.1")})
+	if err != nil {
+		t.Fatalf("relay listener: %v", err)
+	}
+	t.Cleanup(func() {
+		if err := testSide.Close(); err != nil {
+			t.Logf("close relay listener: %v", err)
+		}
+	})
+
+	proxySide, err = net.Dial("udp", testSide.LocalAddr().String())
+	if err != nil {
+		t.Fatalf("relay conn: %v", err)
+	}
+	t.Cleanup(func() {
+		if err := proxySide.Close(); err != nil {
+			t.Logf("close relay conn: %v", err)
+		}
+	})
+
+	return proxySide, testSide
+}
+
+// TestProxyDemuxesByDestinationAddress is the core of the design: one socket
+// serves every peer, and the destination address decides which relayed
+// connection a WireGuard packet belongs to.
+func TestProxyDemuxesByDestinationAddress(t *testing.T) {
+	proxy := NewProxy(testWGPort, 1280)
+	if err := proxy.Listen(); err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer func() {
+		if err := proxy.Free(); err != nil {
+			t.Errorf("free proxy: %v", err)
+		}
+	}()
+
+	const peers = 3
+	endpoints := make([]*net.UDPAddr, 0, peers)
+	readers := make([]*net.UDPConn, 0, peers)
+	for i := 0; i < peers; i++ {
+		proxySide, testSide := relayEnd(t)
+		endpoint, _, err := proxy.AddRelayedConn(proxySide)
+		if err != nil {
+			t.Fatalf("add relayed conn %d: %v", i, err)
+		}
+		if endpoint.Port != proxy.proxyPort {
+			t.Errorf("peer %d endpoint port = %d, want the shared proxy port %d", i, endpoint.Port, proxy.proxyPort)
+		}
+		endpoints = append(endpoints, endpoint)
+		readers = append(readers, testSide)
+	}
+
+	// every peer must have its own address, otherwise they are indistinguishable
+	seen := make(map[string]bool, peers)
+	for i, endpoint := range endpoints {
+		if seen[endpoint.IP.String()] {
+			t.Fatalf("peer %d reuses endpoint address %s", i, endpoint.IP)
+		}
+		seen[endpoint.IP.String()] = true
+	}
+
+	wgSock, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.ParseIP("127.0.0.1")})
+	if err != nil {
+		t.Fatalf("wg socket: %v", err)
+	}
+	defer func() {
+		if err := wgSock.Close(); err != nil {
+			t.Logf("close wg socket: %v", err)
+		}
+	}()
+
+	for i, endpoint := range endpoints {
+		payload := []byte{byte(i), 'p', 'k', 't'}
+		if _, err := wgSock.WriteTo(payload, endpoint); err != nil {
+			t.Fatalf("write to peer %d endpoint %s: %v", i, endpoint, err)
+		}
+
+		buf := make([]byte, 1500)
+		if err := readers[i].SetReadDeadline(time.Now().Add(2 * time.Second)); err != nil {
+			t.Fatalf("set read deadline: %v", err)
+		}
+		n, _, err := readers[i].ReadFrom(buf)
+		if err != nil {
+			t.Fatalf("peer %d did not receive its packet: %v", i, err)
+		}
+		if string(buf[:n]) != string(payload) {
+			t.Errorf("peer %d got %q, want %q", i, buf[:n], payload)
+		}
+
+		// no other peer may see it
+		for j, other := range readers {
+			if j == i {
+				continue
+			}
+			if err := other.SetReadDeadline(time.Now().Add(100 * time.Millisecond)); err != nil {
+				t.Fatalf("set read deadline: %v", err)
+			}
+			if _, _, err := other.ReadFrom(buf); err == nil {
+				t.Errorf("packet for peer %d also delivered to peer %d", i, j)
+			}
+		}
+	}
+}
+
+// TestProxyDropsPacketsOutsideTheRange guards the wildcard bind: anything that
+// is not addressed to a handed-out endpoint must not reach a relayed peer.
+func TestProxyDropsPacketsOutsideTheRange(t *testing.T) {
+	proxy := NewProxy(testWGPort+1, 1280)
+	if err := proxy.Listen(); err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer func() {
+		if err := proxy.Free(); err != nil {
+			t.Errorf("free proxy: %v", err)
+		}
+	}()
+
+	proxySide, testSide := relayEnd(t)
+	if _, _, err := proxy.AddRelayedConn(proxySide); err != nil {
+		t.Fatalf("add relayed conn: %v", err)
+	}
+
+	sender, err := net.Dial("udp", net.JoinHostPort("127.0.0.1", strconv.Itoa(proxy.proxyPort)))
+	if err != nil {
+		t.Fatalf("sender: %v", err)
+	}
+	defer func() {
+		if err := sender.Close(); err != nil {
+			t.Logf("close sender: %v", err)
+		}
+	}()
+
+	if _, err := sender.Write([]byte("stray")); err != nil {
+		t.Fatalf("write stray packet: %v", err)
+	}
+
+	buf := make([]byte, 1500)
+	if err := testSide.SetReadDeadline(time.Now().Add(500 * time.Millisecond)); err != nil {
+		t.Fatalf("set read deadline: %v", err)
+	}
+	if _, _, err := testSide.ReadFrom(buf); err == nil {
+		t.Error("packet addressed to 127.0.0.1 was forwarded to a relayed peer")
+	}
+}
+
+// A wrapper that is closed before it starts forwarding still has to give its
+// endpoint address back, otherwise the range leaks an address per attempt.
+func TestClosingBeforeWorkReleasesTheAddress(t *testing.T) {
+	proxy := NewProxy(testWGPort+2, 1280)
+	if err := proxy.Listen(); err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer func() {
+		if err := proxy.Free(); err != nil {
+			t.Errorf("free proxy: %v", err)
+		}
+	}()
+
+	proxySide, _ := relayEnd(t)
+	wrapper := NewProxyWrapper(proxy)
+	if err := wrapper.AddRelayedConn(context.Background(), nil, proxySide); err != nil {
+		t.Fatalf("add relayed conn: %v", err)
+	}
+
+	if got := len(proxy.relayedConnStore); got != 1 {
+		t.Fatalf("store holds %d entries after adding one conn, want 1", got)
+	}
+
+	if err := wrapper.CloseConn(); err != nil {
+		t.Fatalf("close conn: %v", err)
+	}
+
+	if got := len(proxy.relayedConnStore); got != 0 {
+		t.Errorf("store holds %d entries after close, want 0", got)
+	}
+}
diff --git a/client/iface/wgproxy/ebpf/wrapper.go b/client/iface/wgproxy/loopback/wrapper.go
similarity index 81%
rename from client/iface/wgproxy/ebpf/wrapper.go
rename to client/iface/wgproxy/loopback/wrapper.go
index a6156a661..a9cb1ab59 100644
--- a/client/iface/wgproxy/ebpf/wrapper.go
+++ b/client/iface/wgproxy/loopback/wrapper.go
@@ -1,6 +1,6 @@
 //go:build linux && !android
 
-package ebpf
+package loopback
 
 import (
 	"context"
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"net/netip"
 	"sync"
 
 	"github.com/google/gopacket"
@@ -95,13 +96,14 @@ func NewPacketHeaders(localWGListenPort int, endpoint *net.UDPAddr) (*PacketHead
 
 // ProxyWrapper help to keep the remoteConn instance for net.Conn.Close function call
 type ProxyWrapper struct {
-	wgeBPFProxy *WGEBPFProxy
+	proxy *Proxy
 
 	remoteConn net.Conn
 	ctx        context.Context
 	cancel     context.CancelFunc
 
 	wgRelayedEndpointAddr *net.UDPAddr
+	peerAddr              netip.Addr
 	headers               *PacketHeaders
 	headerCurrentUsed     *PacketHeaders
 	rawConn               net.PacketConn
@@ -113,36 +115,44 @@ type ProxyWrapper struct {
 	closeListener *listener.CloseListener
 }
 
-func NewProxyWrapper(proxy *WGEBPFProxy) *ProxyWrapper {
+func NewProxyWrapper(proxy *Proxy) *ProxyWrapper {
 	return &ProxyWrapper{
-		wgeBPFProxy:   proxy,
+		proxy:         proxy,
 		pausedCond:    sync.NewCond(&sync.Mutex{}),
 		closeListener: listener.NewCloseListener(),
 	}
 }
 
-func (p *ProxyWrapper) AddTurnConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
-	addr, err := p.wgeBPFProxy.AddTurnConn(remoteConn)
+func (p *ProxyWrapper) AddRelayedConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
+	addr, peerAddr, err := p.proxy.AddRelayedConn(remoteConn)
 	if err != nil {
-		return fmt.Errorf("add turn conn: %w", err)
+		return fmt.Errorf("add relayed conn: %w", err)
 	}
 
-	headers, err := NewPacketHeaders(p.wgeBPFProxy.localWGListenPort, addr)
+	// the endpoint address is otherwise only released by the forwarding
+	// goroutine, which never starts when the setup below fails
+	release := func() { p.proxy.removeRelayedConn(peerAddr, remoteConn) }
+
+	headers, err := NewPacketHeaders(p.proxy.localWGListenPort, addr)
 	if err != nil {
+		release()
 		return fmt.Errorf("create packet sender: %w", err)
 	}
 
 	// Check if required raw connection is available
-	if !headers.isIPv4 && p.wgeBPFProxy.rawConnIPv6 == nil {
+	if !headers.isIPv4 && p.proxy.rawConnIPv6 == nil {
+		release()
 		return errIPv6ConnNotAvailable
 	}
-	if headers.isIPv4 && p.wgeBPFProxy.rawConnIPv4 == nil {
+	if headers.isIPv4 && p.proxy.rawConnIPv4 == nil {
+		release()
 		return errIPv4ConnNotAvailable
 	}
 
 	p.remoteConn = remoteConn
 	p.ctx, p.cancel = context.WithCancel(ctx)
 	p.wgRelayedEndpointAddr = addr
+	p.peerAddr = peerAddr
 	p.headers = headers
 	p.rawConn = p.selectRawConn(headers)
 	return nil
@@ -193,18 +203,18 @@ func (p *ProxyWrapper) RedirectAs(endpoint *net.UDPAddr) {
 		return
 	}
 
-	header, err := NewPacketHeaders(p.wgeBPFProxy.localWGListenPort, endpoint)
+	header, err := NewPacketHeaders(p.proxy.localWGListenPort, endpoint)
 	if err != nil {
 		log.Errorf("failed to create packet headers: %s", err)
 		return
 	}
 
 	// Check if required raw connection is available
-	if !header.isIPv4 && p.wgeBPFProxy.rawConnIPv6 == nil {
+	if !header.isIPv4 && p.proxy.rawConnIPv6 == nil {
 		log.Error(errIPv6ConnNotAvailable)
 		return
 	}
-	if header.isIPv4 && p.wgeBPFProxy.rawConnIPv4 == nil {
+	if header.isIPv4 && p.proxy.rawConnIPv4 == nil {
 		log.Error(errIPv4ConnNotAvailable)
 		return
 	}
@@ -240,6 +250,10 @@ func (p *ProxyWrapper) CloseConn() error {
 
 	p.closeListener.SetCloseListener(nil)
 
+	// releases the endpoint address for a wrapper that was never started, and
+	// is a no-op once the forwarding goroutine has released it
+	p.proxy.removeRelayedConn(p.peerAddr, p.remoteConn)
+
 	p.pausedCond.L.Lock()
 	p.paused = false
 	p.pausedCond.Signal()
@@ -252,9 +266,9 @@ func (p *ProxyWrapper) CloseConn() error {
 }
 
 func (p *ProxyWrapper) proxyToLocal(ctx context.Context) {
-	defer p.wgeBPFProxy.removeTurnConn(uint16(p.wgRelayedEndpointAddr.Port))
+	defer p.proxy.removeRelayedConn(p.peerAddr, p.remoteConn)
 
-	buf := make([]byte, p.wgeBPFProxy.mtu+bufsize.WGBufferOverhead)
+	buf := make([]byte, p.proxy.mtu+bufsize.WGBufferOverhead)
 	for {
 		n, err := p.readFromRemote(ctx, buf)
 		if err != nil {
@@ -273,7 +287,7 @@ func (p *ProxyWrapper) proxyToLocal(ctx context.Context) {
 			if ctx.Err() != nil {
 				return
 			}
-			log.Errorf("failed to write out turn pkg to local conn: %v", err)
+			log.Errorf("failed to write out relayed pkg to local conn: %v", err)
 		}
 	}
 }
@@ -286,7 +300,7 @@ func (p *ProxyWrapper) readFromRemote(ctx context.Context, buf []byte) (int, err
 		}
 		p.closeListener.Notify()
 		if !errors.Is(err, io.EOF) {
-			log.Errorf("failed to read from turn conn (endpoint: :%d): %s", p.wgRelayedEndpointAddr.Port, err)
+			log.Errorf("failed to read from relayed conn (endpoint: %s): %s", p.wgRelayedEndpointAddr, err)
 		}
 		return 0, err
 	}
@@ -314,7 +328,7 @@ func (p *ProxyWrapper) sendPkg(data []byte, header *PacketHeaders) error {
 
 func (p *ProxyWrapper) selectRawConn(header *PacketHeaders) net.PacketConn {
 	if header.isIPv4 {
-		return p.wgeBPFProxy.rawConnIPv4
+		return p.proxy.rawConnIPv4
 	}
-	return p.wgeBPFProxy.rawConnIPv6
+	return p.proxy.rawConnIPv6
 }
diff --git a/client/iface/wgproxy/proxy.go b/client/iface/wgproxy/proxy.go
index 40346bc15..b0033bffa 100644
--- a/client/iface/wgproxy/proxy.go
+++ b/client/iface/wgproxy/proxy.go
@@ -7,7 +7,7 @@ import (
 
 // Proxy is a transfer layer between the relayed connection and the WireGuard
 type Proxy interface {
-	AddTurnConn(ctx context.Context, endpoint *net.UDPAddr, remoteConn net.Conn) error
+	AddRelayedConn(ctx context.Context, endpoint *net.UDPAddr, remoteConn net.Conn) error
 	EndpointAddr() *net.UDPAddr // EndpointAddr returns the address of the WireGuard peer endpoint
 	Work()                      // Work start or resume the proxy
 	Pause()                     // Pause to forward the packages from remote connection to WireGuard. The opposite way still works.
diff --git a/client/iface/wgproxy/proxy_linux_test.go b/client/iface/wgproxy/proxy_linux_test.go
index e34dd3b6b..88d4588a5 100644
--- a/client/iface/wgproxy/proxy_linux_test.go
+++ b/client/iface/wgproxy/proxy_linux_test.go
@@ -9,25 +9,25 @@ import (
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	bindproxy "github.com/netbirdio/netbird/client/iface/wgproxy/bind"
-	"github.com/netbirdio/netbird/client/iface/wgproxy/ebpf"
+	"github.com/netbirdio/netbird/client/iface/wgproxy/loopback"
 	"github.com/netbirdio/netbird/client/iface/wgproxy/udp"
 )
 
 func seedProxies() ([]proxyInstance, error) {
 	pl := make([]proxyInstance, 0)
 
-	ebpfProxy := ebpf.NewWGEBPFProxy(51831, 1280)
-	if err := ebpfProxy.Listen(); err != nil {
-		return nil, fmt.Errorf("failed to initialize ebpf proxy: %s", err)
+	loopbackProxy := loopback.NewProxy(51831, 1280)
+	if err := loopbackProxy.Listen(); err != nil {
+		return nil, fmt.Errorf("failed to initialize loopback proxy: %s", err)
 	}
 
-	pEbpf := proxyInstance{
-		name:    "ebpf kernel proxy",
-		proxy:   ebpf.NewProxyWrapper(ebpfProxy),
+	pLoopback := proxyInstance{
+		name:    "loopback kernel proxy",
+		proxy:   loopback.NewProxyWrapper(loopbackProxy),
 		wgPort:  51831,
-		closeFn: ebpfProxy.Free,
+		closeFn: loopbackProxy.Free,
 	}
-	pl = append(pl, pEbpf)
+	pl = append(pl, pLoopback)
 
 	pUDP := proxyInstance{
 		name:    "udp kernel proxy",
@@ -42,18 +42,18 @@ func seedProxies() ([]proxyInstance, error) {
 func seedProxyForProxyCloseByRemoteConn() ([]proxyInstance, error) {
 	pl := make([]proxyInstance, 0)
 
-	ebpfProxy := ebpf.NewWGEBPFProxy(51831, 1280)
-	if err := ebpfProxy.Listen(); err != nil {
-		return nil, fmt.Errorf("failed to initialize ebpf proxy: %s", err)
+	loopbackProxy := loopback.NewProxy(51831, 1280)
+	if err := loopbackProxy.Listen(); err != nil {
+		return nil, fmt.Errorf("failed to initialize loopback proxy: %s", err)
 	}
 
-	pEbpf := proxyInstance{
-		name:    "ebpf kernel proxy",
-		proxy:   ebpf.NewProxyWrapper(ebpfProxy),
+	pLoopback := proxyInstance{
+		name:    "loopback kernel proxy",
+		proxy:   loopback.NewProxyWrapper(loopbackProxy),
 		wgPort:  51831,
-		closeFn: ebpfProxy.Free,
+		closeFn: loopbackProxy.Free,
 	}
-	pl = append(pl, pEbpf)
+	pl = append(pl, pLoopback)
 
 	pUDP := proxyInstance{
 		name:    "udp kernel proxy",
diff --git a/client/iface/wgproxy/proxy_test.go b/client/iface/wgproxy/proxy_test.go
index 1aeab66b7..d86cdbe80 100644
--- a/client/iface/wgproxy/proxy_test.go
+++ b/client/iface/wgproxy/proxy_test.go
@@ -95,7 +95,7 @@ func TestProxyCloseByRemoteConn(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			addr, _ := net.ResolveUDPAddr("udp", "100.108.135.221:51892")
 			relayedConn := newMockConn()
-			err := tt.proxy.AddTurnConn(ctx, addr, relayedConn)
+			err := tt.proxy.AddRelayedConn(ctx, addr, relayedConn)
 			if err != nil {
 				t.Errorf("error: %v", err)
 			}
@@ -157,7 +157,7 @@ func redirectTraffic(t *testing.T, proxy Proxy, wgPort int, endPointAddr *net.UD
 		_ = relayedServer.Close()
 	}()
 
-	if err := proxy.AddTurnConn(context.Background(), endPointAddr, relayedConn); err != nil {
+	if err := proxy.AddRelayedConn(context.Background(), endPointAddr, relayedConn); err != nil {
 		t.Errorf("error: %v", err)
 	}
 	defer func() {
diff --git a/client/iface/wgproxy/rawsocket/rawsocket.go b/client/iface/wgproxy/rawsocket/rawsocket.go
index bc785b43a..37aaa160f 100644
--- a/client/iface/wgproxy/rawsocket/rawsocket.go
+++ b/client/iface/wgproxy/rawsocket/rawsocket.go
@@ -10,8 +10,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
-
-	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
 // PrepareSenderRawSocketIPv4 creates and configures a raw socket for sending IPv4 packets
@@ -60,14 +58,12 @@ func prepareSenderRawSocket(family int, isIPv4 bool) (net.PacketConn, error) {
 		return nil, fmt.Errorf("binding to lo interface failed: %w", err)
 	}
 
-	// Set the fwmark on the socket.
-	err = nbnet.SetSocketOpt(fd)
-	if err != nil {
-		if closeErr := syscall.Close(fd); closeErr != nil {
-			log.Warnf("failed to close raw socket fd: %v", closeErr)
-		}
-		return nil, fmt.Errorf("setting fwmark failed: %w", err)
-	}
+	// The socket is bound to lo and only ever sends to the local WireGuard
+	// instance, a destination the local routing table resolves without help, so
+	// it carries no fwmark. Staying unmarked also keeps these packets out of
+	// third-party NAT rules that match on marks: such a rule rewriting the
+	// source would make WireGuard adopt the rewritten address as the peer
+	// endpoint.
 
 	// Convert the file descriptor to a PacketConn.
 	file := os.NewFile(uintptr(fd), fmt.Sprintf("fd %d", fd))
diff --git a/client/iface/wgproxy/rawsocket/rawsocket_privileged_test.go b/client/iface/wgproxy/rawsocket/rawsocket_privileged_test.go
new file mode 100644
index 000000000..03748c6f9
--- /dev/null
+++ b/client/iface/wgproxy/rawsocket/rawsocket_privileged_test.go
@@ -0,0 +1,77 @@
+//go:build linux && !android && privileged
+
+package rawsocket
+
+import (
+	"net"
+	"syscall"
+	"testing"
+
+	"golang.org/x/sys/unix"
+
+	nbnet "github.com/netbirdio/netbird/client/net"
+)
+
+// The sender sockets must stay unmarked: a NAT rule matching on fwmark that
+// rewrites the source of an injected packet makes WireGuard adopt the rewritten
+// address as the peer endpoint.
+func TestSenderRawSocketsCarryNoFwmark(t *testing.T) {
+	// the mark is only ever applied when advanced routing is available, so
+	// without it the assertion below would hold for the wrong reason
+	nbnet.Init()
+	if !nbnet.AdvancedRouting() {
+		t.Skip("advanced routing unsupported, the sockets carry no mark either way")
+	}
+
+	tests := []struct {
+		name    string
+		prepare func() (net.PacketConn, error)
+		// the proxy treats the IPv6 socket as optional, so a host without IPv6
+		// is a reason to skip rather than to fail
+		optional bool
+	}{
+		{name: "IPv4", prepare: PrepareSenderRawSocketIPv4},
+		{name: "IPv6", prepare: PrepareSenderRawSocketIPv6, optional: true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			conn, err := tc.prepare()
+			if err != nil {
+				if tc.optional {
+					t.Skipf("prepare raw socket: %v", err)
+				}
+				t.Fatalf("prepare raw socket: %v", err)
+			}
+			defer func() {
+				if err := conn.Close(); err != nil {
+					t.Logf("close raw socket: %v", err)
+				}
+			}()
+
+			syscallConn, ok := conn.(syscall.Conn)
+			if !ok {
+				t.Fatalf("raw socket %T does not expose a syscall conn", conn)
+			}
+			raw, err := syscallConn.SyscallConn()
+			if err != nil {
+				t.Fatalf("syscall conn: %v", err)
+			}
+
+			var mark int
+			var markErr error
+			if err := raw.Control(func(fd uintptr) {
+				mark, markErr = unix.GetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK)
+			}); err != nil {
+				t.Fatalf("control: %v", err)
+			}
+			if markErr != nil {
+				t.Fatalf("get SO_MARK: %v", markErr)
+			}
+
+			if mark != 0 {
+				t.Errorf("SO_MARK = %#x, want 0", mark)
+			}
+		})
+	}
+}
diff --git a/client/iface/wgproxy/redirect_test.go b/client/iface/wgproxy/redirect_test.go
index 135970838..47f571f2b 100644
--- a/client/iface/wgproxy/redirect_test.go
+++ b/client/iface/wgproxy/redirect_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/netbirdio/netbird/client/iface/wgproxy/ebpf"
+	"github.com/netbirdio/netbird/client/iface/wgproxy/loopback"
 	"github.com/netbirdio/netbird/client/iface/wgproxy/udp"
 )
 
@@ -119,9 +119,9 @@ func testRedirectAs(t *testing.T, proxy Proxy, wgPort int, nbAddr, p2pEndpoint *
 	}
 	defer relayConn.Close()
 
-	// Add TURN connection to proxy
-	if err := proxy.AddTurnConn(ctx, nbAddr, relayConn); err != nil {
-		t.Fatalf("failed to add TURN connection: %v", err)
+	// Add relayed connection to proxy
+	if err := proxy.AddRelayedConn(ctx, nbAddr, relayConn); err != nil {
+		t.Fatalf("failed to add relayed connection: %v", err)
 	}
 	defer func() {
 		if err := proxy.CloseConn(); err != nil {
@@ -198,20 +198,20 @@ func testRedirectAs(t *testing.T, proxy Proxy, wgPort int, nbAddr, p2pEndpoint *
 	}
 }
 
-// TestRedirectAs_eBPF_IPv4 tests RedirectAs with eBPF proxy using IPv4 addresses
-func TestRedirectAs_eBPF_IPv4(t *testing.T) {
+// TestRedirectAs_Loopback_IPv4 tests RedirectAs with the loopback proxy using IPv4 addresses
+func TestRedirectAs_Loopback_IPv4(t *testing.T) {
 	wgPort := 51850
-	ebpfProxy := ebpf.NewWGEBPFProxy(wgPort, 1280)
-	if err := ebpfProxy.Listen(); err != nil {
-		t.Fatalf("failed to initialize ebpf proxy: %v", err)
+	loopbackProxy := loopback.NewProxy(wgPort, 1280)
+	if err := loopbackProxy.Listen(); err != nil {
+		t.Fatalf("failed to initialize loopback proxy: %v", err)
 	}
 	defer func() {
-		if err := ebpfProxy.Free(); err != nil {
-			t.Errorf("failed to free ebpf proxy: %v", err)
+		if err := loopbackProxy.Free(); err != nil {
+			t.Errorf("failed to free loopback proxy: %v", err)
 		}
 	}()
 
-	proxy := ebpf.NewProxyWrapper(ebpfProxy)
+	proxy := loopback.NewProxyWrapper(loopbackProxy)
 
 	// NetBird UDP address of the remote peer
 	nbAddr := &net.UDPAddr{
@@ -227,20 +227,20 @@ func TestRedirectAs_eBPF_IPv4(t *testing.T) {
 	testRedirectAs(t, proxy, wgPort, nbAddr, p2pEndpoint)
 }
 
-// TestRedirectAs_eBPF_IPv6 tests RedirectAs with eBPF proxy using IPv6 addresses
-func TestRedirectAs_eBPF_IPv6(t *testing.T) {
+// TestRedirectAs_Loopback_IPv6 tests RedirectAs with the loopback proxy using IPv6 addresses
+func TestRedirectAs_Loopback_IPv6(t *testing.T) {
 	wgPort := 51851
-	ebpfProxy := ebpf.NewWGEBPFProxy(wgPort, 1280)
-	if err := ebpfProxy.Listen(); err != nil {
-		t.Fatalf("failed to initialize ebpf proxy: %v", err)
+	loopbackProxy := loopback.NewProxy(wgPort, 1280)
+	if err := loopbackProxy.Listen(); err != nil {
+		t.Fatalf("failed to initialize loopback proxy: %v", err)
 	}
 	defer func() {
-		if err := ebpfProxy.Free(); err != nil {
-			t.Errorf("failed to free ebpf proxy: %v", err)
+		if err := loopbackProxy.Free(); err != nil {
+			t.Errorf("failed to free loopback proxy: %v", err)
 		}
 	}()
 
-	proxy := ebpf.NewProxyWrapper(ebpfProxy)
+	proxy := loopback.NewProxyWrapper(loopbackProxy)
 
 	// NetBird UDP address of the remote peer
 	nbAddr := &net.UDPAddr{
@@ -259,17 +259,17 @@ func TestRedirectAs_eBPF_IPv6(t *testing.T) {
 // TestRedirectAs_Multiple_Switches tests switching between multiple endpoints
 func TestRedirectAs_Multiple_Switches(t *testing.T) {
 	wgPort := 51856
-	ebpfProxy := ebpf.NewWGEBPFProxy(wgPort, 1280)
-	if err := ebpfProxy.Listen(); err != nil {
-		t.Fatalf("failed to initialize ebpf proxy: %v", err)
+	loopbackProxy := loopback.NewProxy(wgPort, 1280)
+	if err := loopbackProxy.Listen(); err != nil {
+		t.Fatalf("failed to initialize loopback proxy: %v", err)
 	}
 	defer func() {
-		if err := ebpfProxy.Free(); err != nil {
-			t.Errorf("failed to free ebpf proxy: %v", err)
+		if err := loopbackProxy.Free(); err != nil {
+			t.Errorf("failed to free loopback proxy: %v", err)
 		}
 	}()
 
-	proxy := ebpf.NewProxyWrapper(ebpfProxy)
+	proxy := loopback.NewProxyWrapper(loopbackProxy)
 
 	ctx := context.Background()
 
@@ -304,8 +304,8 @@ func TestRedirectAs_Multiple_Switches(t *testing.T) {
 		Port: 38746,
 	}
 
-	if err := proxy.AddTurnConn(ctx, nbAddr, relayConn); err != nil {
-		t.Fatalf("failed to add TURN connection: %v", err)
+	if err := proxy.AddRelayedConn(ctx, nbAddr, relayConn); err != nil {
+		t.Fatalf("failed to add relayed connection: %v", err)
 	}
 	defer func() {
 		if err := proxy.CloseConn(); err != nil {
diff --git a/client/iface/wgproxy/udp/proxy.go b/client/iface/wgproxy/udp/proxy.go
index 783843aba..a0895c8c7 100644
--- a/client/iface/wgproxy/udp/proxy.go
+++ b/client/iface/wgproxy/udp/proxy.go
@@ -51,12 +51,12 @@ func NewWGUDPProxy(wgPort int, mtu uint16) *WGUDPProxy {
 	return p
 }
 
-// AddTurnConn
+// AddRelayedConn dials the local WireGuard port and stores the relayed connection.
 // The provided Context must be non-nil. If the context expires before
 // the connection is complete, an error is returned. Once successfully
 // connected, any expiration of the context will not affect the
 // connection.
-func (p *WGUDPProxy) AddTurnConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
+func (p *WGUDPProxy) AddRelayedConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
 	dialer := net.Dialer{}
 	localConn, err := dialer.DialContext(ctx, "udp", fmt.Sprintf(":%d", p.localWGListenPort))
 	if err != nil {
diff --git a/client/installer.nsis b/client/installer.nsis
index 63bff1c5b..304d38864 100644
--- a/client/installer.nsis
+++ b/client/installer.nsis
@@ -2,11 +2,11 @@
 !define COMP_NAME "Netbird"
 !define WEB_SITE "Netbird.io"
 !define VERSION $%APPVER%
-!define COPYRIGHT "Netbird Authors, 2022"
+!define COPYRIGHT "Netbird Authors, 2022-2026"
 !define DESCRIPTION "Connect your devices into a secure WireGuard-based overlay network with SSO, MFA, and granular access controls."
 !define INSTALLER_NAME "netbird-installer.exe"
 !define MAIN_APP_EXE "Netbird"
-!define ICON "ui\\assets\\netbird.ico"
+!define ICON "ui\\build\\windows\\icon.ico"
 !define BANNER "ui\\build\\banner.bmp"
 !define LICENSE_DATA "..\\LICENSE"
 
@@ -22,8 +22,6 @@
 !define UI_REG_APP_PATH "Software\Microsoft\Windows\CurrentVersion\App Paths\${UI_APP_EXE}"
 !define UI_UNINSTALL_PATH "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UI_APP_NAME}"
 
-!define AUTOSTART_REG_KEY "Software\Microsoft\Windows\CurrentVersion\Run"
-
 !define NETBIRD_DATA_DIR "$COMMONPROGRAMDATA\Netbird"
 
 Unicode True
@@ -79,8 +77,6 @@ ShowInstDetails Show
 
 !insertmacro MUI_PAGE_DIRECTORY
 
-Page custom AutostartPage AutostartPageLeave
-
 !insertmacro MUI_PAGE_INSTFILES
 
 !insertmacro MUI_PAGE_FINISH
@@ -97,40 +93,12 @@ UninstPage custom un.DeleteDataPage un.DeleteDataPageLeave
 
 !insertmacro MUI_LANGUAGE "English"
 
-; Variables for autostart option
-Var AutostartCheckbox
-Var AutostartEnabled
-
 ; Variables for uninstall data deletion option
 Var DeleteDataCheckbox
 Var DeleteDataEnabled
 
 ######################################################################
 
-; Function to create the autostart options page
-Function AutostartPage
-  !insertmacro MUI_HEADER_TEXT "Startup Options" "Configure how ${APP_NAME} launches with Windows."
-
-  nsDialogs::Create 1018
-  Pop $0
-
-  ${If} $0 == error
-    Abort
-  ${EndIf}
-
-  ${NSD_CreateCheckbox} 0 20u 100% 10u "Start ${APP_NAME} UI automatically when Windows starts"
-  Pop $AutostartCheckbox
-  ${NSD_Check} $AutostartCheckbox
-  StrCpy $AutostartEnabled "1"
-
-  nsDialogs::Show
-FunctionEnd
-
-; Function to handle leaving the autostart page
-Function AutostartPageLeave
-  ${NSD_GetState} $AutostartCheckbox $AutostartEnabled
-FunctionEnd
-
 ; Function to create the uninstall data deletion page
 Function un.DeleteDataPage
   !insertmacro MUI_HEADER_TEXT "Uninstall Options" "Choose whether to delete ${APP_NAME} data."
@@ -201,8 +169,6 @@ Pop $0
 
 Function .onInit
 StrCpy $INSTDIR "${INSTALL_DIR}"
-; Default autostart to enabled so silent installs (/S) match the interactive default
-StrCpy $AutostartEnabled "1"
 
 ; Pre-0.70.1 installers ran without SetRegView, so their uninstall keys live
 ; in the 32-bit view. Fall back to it so upgrades still find them.
@@ -260,18 +226,6 @@ WriteRegStr ${REG_ROOT} "${UNINSTALL_PATH}"  "Publisher" "${COMP_NAME}"
 
 WriteRegStr ${REG_ROOT} "${UI_REG_APP_PATH}" "" "$INSTDIR\${UI_APP_EXE}"
 
-; Create autostart registry entry based on checkbox
-DetailPrint "Autostart enabled: $AutostartEnabled"
-${If} $AutostartEnabled == "1"
-    WriteRegStr HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}" '"$INSTDIR\${UI_APP_EXE}.exe"'
-    DetailPrint "Added autostart registry entry: $INSTDIR\${UI_APP_EXE}.exe"
-${Else}
-    DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
-    ; Legacy: pre-HKLM installs wrote to HKCU; clean that up too.
-    DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "${APP_NAME}"
-    DetailPrint "Autostart not enabled by user"
-${EndIf}
-
 EnVar::SetHKLM
 EnVar::AddValueEx "path" "$INSTDIR"
 
@@ -280,6 +234,43 @@ CreateShortCut "$SMPROGRAMS\${APP_NAME}.lnk" "$INSTDIR\${UI_APP_EXE}"
 CreateShortCut "$DESKTOP\${APP_NAME}.lnk" "$INSTDIR\${UI_APP_EXE}"
 SectionEnd
 
+# Install the Microsoft Edge WebView2 runtime if it isn't already present.
+# Macro adapted from Wails3's NSIS template (wails_tools.nsh): a registry
+# probe followed by a silent install of the embedded evergreen bootstrapper.
+# The MicrosoftEdgeWebview2Setup.exe payload is staged next to this script
+# by the sign-pipelines build step (`wails3 generate webview2bootstrapper`).
+!macro nb.webview2runtime
+    SetRegView 64
+    # Per-machine install marker — populated when the runtime ships with
+    # Edge or has been installed by an admin previously.
+    ReadRegStr $0 HKLM "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" "pv"
+    ${If} $0 != ""
+        Goto webview2_ok
+    ${EndIf}
+    # Per-user fallback for HKCU installs.
+    ReadRegStr $0 HKCU "Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" "pv"
+    ${If} $0 != ""
+        Goto webview2_ok
+    ${EndIf}
+
+    SetDetailsPrint both
+    DetailPrint "Installing: WebView2 Runtime"
+    SetDetailsPrint listonly
+
+    InitPluginsDir
+    CreateDirectory "$pluginsdir\webview2bootstrapper"
+    SetOutPath "$pluginsdir\webview2bootstrapper"
+    File "MicrosoftEdgeWebview2Setup.exe"
+    ExecWait '"$pluginsdir\webview2bootstrapper\MicrosoftEdgeWebview2Setup.exe" /silent /install'
+
+    SetDetailsPrint both
+    webview2_ok:
+!macroend
+
+Section -WebView2
+    !insertmacro nb.webview2runtime
+SectionEnd
+
 Section -Post
 ExecWait '"$INSTDIR\${MAIN_APP_EXE}" service install'
 ExecWait '"$INSTDIR\${MAIN_APP_EXE}" service start'
@@ -299,12 +290,6 @@ ExecWait '"$INSTDIR\${MAIN_APP_EXE}" service uninstall'
 DetailPrint "Terminating Netbird UI process..."
 ExecWait `taskkill /im ${UI_APP_EXE}.exe /f`
 
-; Remove autostart registry entry
-DetailPrint "Removing autostart registry entry if exists..."
-DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
-; Legacy: pre-HKLM installs wrote to HKCU; clean that up too.
-DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "${APP_NAME}"
-
 ; Handle data deletion based on checkbox
 DetailPrint "Checking if user requested data deletion..."
 ${If} $DeleteDataEnabled == "1"
@@ -326,9 +311,9 @@ DetailPrint "Deleting application files..."
 Delete "$INSTDIR\${UI_APP_EXE}"
 Delete "$INSTDIR\${MAIN_APP_EXE}"
 Delete "$INSTDIR\wintun.dll"
-!if ${ARCH} == "amd64"
+# Legacy: pre-Wails installs shipped opengl32.dll (Mesa3D for Fyne); remove
+# any leftover copy on uninstall so old upgrades don't leave it behind.
 Delete "$INSTDIR\opengl32.dll"
-!endif
 DetailPrint "Removing application directory..."
 RmDir /r "$INSTDIR"
 
diff --git a/client/internal/acl/dispatch_test.go b/client/internal/acl/dispatch_test.go
new file mode 100644
index 000000000..be82e414f
--- /dev/null
+++ b/client/internal/acl/dispatch_test.go
@@ -0,0 +1,190 @@
+package acl
+
+import (
+	"net/netip"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/client/firewall"
+	fwmgr "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/internal/acl/mocks"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// TestNetworkZeroPrefixIsRoute guards the route-vs-peer dispatch
+// invariant: the backends classify a rule as a peer rule purely by the
+// absence of a destination (neither prefix nor set). A default route
+// (0.0.0.0/0 or ::/0) is a valid prefix and must therefore classify as
+// a route, not collapse into the peer path.
+func TestNetworkZeroPrefixIsRoute(t *testing.T) {
+	for _, p := range []string{"0.0.0.0/0", "::/0", "10.0.0.0/8"} {
+		n := fwmgr.Network{Prefix: netip.MustParsePrefix(p)}
+		assert.True(t, n.IsPrefix(), "%s must report IsPrefix", p)
+		assert.True(t, n.IsPrefix() || n.IsSet(), "%s must classify as a route", p)
+	}
+
+	// A zero-value Network is the only peer-rule shape.
+	var empty fwmgr.Network
+	assert.False(t, empty.IsPrefix(), "zero Network must not be a prefix")
+	assert.False(t, empty.IsSet(), "zero Network must not be a set")
+}
+
+// TestDetermineDestinationAlwaysRoute verifies determineDestination
+// never yields an empty Network for a valid route rule: every branch
+// (static prefix, default route, dynamic with/without domains, with and
+// without a local resolver) produces a destination that classifies as a
+// route. If this regresses, a route rule would be dispatched down the
+// peer path, which matches on source only.
+func TestDetermineDestinationAlwaysRoute(t *testing.T) {
+	v4 := []netip.Prefix{netip.MustParsePrefix("10.0.0.0/24")}
+	v6 := []netip.Prefix{netip.MustParsePrefix("2001:db8::/48")}
+
+	cases := []struct {
+		name     string
+		rule     *mgmProto.RouteFirewallRule
+		resolver bool
+		sources  []netip.Prefix
+	}{
+		{"static prefix", &mgmProto.RouteFirewallRule{Destination: "192.168.0.0/16"}, false, v4},
+		{"static default route", &mgmProto.RouteFirewallRule{Destination: "0.0.0.0/0"}, false, v4},
+		{"dynamic with domains + resolver", &mgmProto.RouteFirewallRule{IsDynamic: true, Domains: []string{"example.com"}}, true, v4},
+		{"dynamic no domains + resolver (v4)", &mgmProto.RouteFirewallRule{IsDynamic: true}, true, v4},
+		{"dynamic no domains + resolver (v6)", &mgmProto.RouteFirewallRule{IsDynamic: true}, true, v6},
+		{"dynamic + no local resolver (v4)", &mgmProto.RouteFirewallRule{IsDynamic: true}, false, v4},
+		{"dynamic + no local resolver (v6)", &mgmProto.RouteFirewallRule{IsDynamic: true}, false, v6},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			dest, err := determineDestination(tc.rule, tc.resolver, tc.sources)
+			require.NoError(t, err)
+			assert.True(t, dest.IsPrefix() || dest.IsSet(),
+				"destination must classify as a route, got empty Network")
+		})
+	}
+}
+
+// countingFirewall wraps a real firewall.Manager and counts filter-rule
+// add/delete calls so a test can assert how many backing rules the acl
+// manager actually creates and tears down.
+type countingFirewall struct {
+	fwmgr.Manager
+	mu       sync.Mutex
+	addCalls int
+	dels     int
+	ruleIDs  map[fwmgr.RuleID]struct{}
+}
+
+// distinctRules returns the number of distinct backing rules the
+// backend produced. Because the backend dedups identical content,
+// repeated AddFilterRule calls for the same rule resolve to one id.
+func (f *countingFirewall) distinctRules() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.ruleIDs)
+}
+
+func (f *countingFirewall) AddFilterRule(id []byte, sources []netip.Prefix, destination fwmgr.Network, proto fwmgr.Protocol, sPort, dPort *fwmgr.Port, action fwmgr.Action) (fwmgr.Rule, error) {
+	rule, err := f.Manager.AddFilterRule(id, sources, destination, proto, sPort, dPort, action)
+	if err == nil {
+		f.mu.Lock()
+		f.addCalls++
+		if f.ruleIDs == nil {
+			f.ruleIDs = make(map[fwmgr.RuleID]struct{})
+		}
+		if rule != nil {
+			f.ruleIDs[rule.ID()] = struct{}{}
+		}
+		f.mu.Unlock()
+	}
+	return rule, err
+}
+
+func (f *countingFirewall) DeleteFilterRule(r fwmgr.Rule) error {
+	err := f.Manager.DeleteFilterRule(r)
+	if err == nil {
+		f.mu.Lock()
+		f.dels++
+		delete(f.ruleIDs, r.ID())
+		f.mu.Unlock()
+	}
+	return err
+}
+
+func newCountingACL(t *testing.T) (*DefaultManager, *countingFirewall, func()) {
+	t.Helper()
+	t.Setenv("NB_WG_KERNEL_DISABLED", "true")
+	t.Setenv(firewall.EnvForceUserspaceFirewall, "true")
+
+	ctrl := gomock.NewController(t)
+	ifaceMock := mocks.NewMockIFaceMapper(ctrl)
+	ifaceMock.EXPECT().IsUserspaceBind().Return(true).AnyTimes()
+	ifaceMock.EXPECT().SetFilter(gomock.Any())
+	network := netip.MustParsePrefix("172.0.0.1/32")
+	ifaceMock.EXPECT().Name().Return("lo").AnyTimes()
+	ifaceMock.EXPECT().Address().Return(wgaddr.Address{IP: network.Addr(), Network: network}).AnyTimes()
+	ifaceMock.EXPECT().GetWGDevice().Return(nil).AnyTimes()
+
+	realFW, err := firewall.NewFirewall(ifaceMock, nil, flowLogger, false, iface.DefaultMTU)
+	require.NoError(t, err)
+
+	fw := &countingFirewall{Manager: realFW}
+	cleanup := func() {
+		require.NoError(t, realFW.Close(nil))
+		ctrl.Finish()
+	}
+	return NewDefaultManager(fw), fw, cleanup
+}
+
+// TestDuplicateContentPoliciesShareOneRule verifies the dedup contract
+// the backends rely on: two policies that authorize an identical flow
+// (same selector and sources) collapse to a single backing firewall
+// rule, and that rule survives until BOTH policies are gone. This is
+// why the backend can dedup on add without refcounting on delete: the
+// acl manager's pair key matches the backend's content key, so add and
+// delete stay balanced per content key across full-state reapplies.
+func TestDuplicateContentPoliciesShareOneRule(t *testing.T) {
+	acl, fw, cleanup := newCountingACL(t)
+	defer cleanup()
+
+	ruleA := &mgmProto.FirewallRule{
+		PolicyID:  []byte("policy-A"),
+		PeerIP:    "10.0.0.1", //nolint:staticcheck
+		Direction: mgmProto.RuleDirection_IN,
+		Action:    mgmProto.RuleAction_ACCEPT,
+		Protocol:  mgmProto.RuleProtocol_TCP,
+		Port:      "443",
+	}
+	ruleB := &mgmProto.FirewallRule{
+		PolicyID:  []byte("policy-B"),
+		PeerIP:    "10.0.0.1", //nolint:staticcheck
+		Direction: mgmProto.RuleDirection_IN,
+		Action:    mgmProto.RuleAction_ACCEPT,
+		Protocol:  mgmProto.RuleProtocol_TCP,
+		Port:      "443",
+	}
+
+	// Both policies present: identical content collapses to one rule.
+	acl.ApplyFiltering(&mgmProto.NetworkMap{FirewallRules: []*mgmProto.FirewallRule{ruleA, ruleB}, FirewallRulesIsEmpty: false}, false)
+	assert.Equal(t, 1, fw.distinctRules(), "identical-content policies must produce one backing rule")
+	assert.Equal(t, 1, len(acl.peerRulesPairs), "one content key, one pair")
+
+	// Drop policy A only: the shared rule is still authorized by B, so
+	// nothing is deleted.
+	acl.ApplyFiltering(&mgmProto.NetworkMap{FirewallRules: []*mgmProto.FirewallRule{ruleB}, FirewallRulesIsEmpty: false}, false)
+	assert.Equal(t, 1, fw.distinctRules(), "no new backing rule on reapply")
+	assert.Equal(t, 0, fw.dels, "rule must survive while any policy still authorizes it")
+	assert.Equal(t, 1, len(acl.peerRulesPairs))
+
+	// Drop policy B too: now the content key has no authorizer and the
+	// single backing rule is removed exactly once.
+	acl.ApplyFiltering(&mgmProto.NetworkMap{FirewallRules: nil, FirewallRulesIsEmpty: true}, false)
+	assert.Equal(t, 1, fw.dels, "rule removed once when last policy is gone")
+	assert.Equal(t, 0, len(acl.peerRulesPairs))
+}
diff --git a/client/internal/acl/grouping_test.go b/client/internal/acl/grouping_test.go
new file mode 100644
index 000000000..d6cf29b59
--- /dev/null
+++ b/client/internal/acl/grouping_test.go
@@ -0,0 +1,318 @@
+package acl
+
+import (
+	"errors"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/client/firewall"
+	fwmgr "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/internal/acl/mocks"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/netiputil"
+)
+
+// TestGroupPeerRulesPolicyIDSeparates verifies that two FirewallRules
+// with identical selectors but different PolicyIDs do NOT get merged
+// into one group, so each policy's sources merge under its own
+// attribution id. (Identical-content groups may still dedup to one
+// backing rule at the backend; see TestDuplicateContentPoliciesShareOneRule.)
+func TestGroupPeerRulesPolicyIDSeparates(t *testing.T) {
+	rules := []*mgmProto.FirewallRule{
+		{
+			PolicyID:  []byte("policy-A"),
+			PeerIP:    "10.0.0.1",
+			Direction: mgmProto.RuleDirection_IN,
+			Action:    mgmProto.RuleAction_ACCEPT,
+			Protocol:  mgmProto.RuleProtocol_TCP,
+			Port:      "443",
+		},
+		{
+			PolicyID:  []byte("policy-B"),
+			PeerIP:    "10.0.0.1",
+			Direction: mgmProto.RuleDirection_IN,
+			Action:    mgmProto.RuleAction_ACCEPT,
+			Protocol:  mgmProto.RuleProtocol_TCP,
+			Port:      "443",
+		},
+	}
+
+	groups, denyErr, err := groupPeerRules(rules)
+	require.NoError(t, denyErr)
+	require.NoError(t, err)
+	require.Len(t, groups, 2, "rules with different PolicyIDs must produce separate groups")
+}
+
+// TestGroupPeerRulesFamilySeparates verifies that v4 and v6 rules
+// belonging to the same policy don't merge.
+func TestGroupPeerRulesFamilySeparates(t *testing.T) {
+	rules := []*mgmProto.FirewallRule{
+		{
+			PolicyID:  []byte("policy-A"),
+			PeerIP:    "10.0.0.1",
+			Direction: mgmProto.RuleDirection_IN,
+			Action:    mgmProto.RuleAction_ACCEPT,
+			Protocol:  mgmProto.RuleProtocol_TCP,
+			Port:      "443",
+		},
+		{
+			PolicyID:  []byte("policy-A"),
+			PeerIP:    "2001:db8::1",
+			Direction: mgmProto.RuleDirection_IN,
+			Action:    mgmProto.RuleAction_ACCEPT,
+			Protocol:  mgmProto.RuleProtocol_TCP,
+			Port:      "443",
+		},
+	}
+
+	groups, denyErr, err := groupPeerRules(rules)
+	require.NoError(t, denyErr)
+	require.NoError(t, err)
+	require.Len(t, groups, 2, "rules of different families must produce separate groups")
+
+	var sawV4, sawV6 bool
+	for _, g := range groups {
+		require.Len(t, g.sources, 1)
+		if g.sources[0].Addr().Is4() {
+			sawV4 = true
+		}
+		if g.sources[0].Addr().Is6() {
+			sawV6 = true
+		}
+	}
+	assert.True(t, sawV4 && sawV6)
+}
+
+// TestGroupPeerRulesSplitsMixedFamilySingleRule verifies that a single
+// FirewallRule carrying both v4 and v6 source prefixes is split into one
+// group per family. Each backend keys a rule to a single family, so a
+// group whose sources span families would mismatch the other family's
+// sources. mgmt normally emits one rule per family; this guards against
+// a mixed-family rule slipping through.
+func TestGroupPeerRulesSplitsMixedFamilySingleRule(t *testing.T) {
+	srcs := [][]byte{
+		netiputil.EncodeAddr(netip.MustParseAddr("10.0.0.1")),
+		netiputil.EncodeAddr(netip.MustParseAddr("2001:db8::1")),
+		netiputil.EncodeAddr(netip.MustParseAddr("10.0.0.2")),
+		netiputil.EncodeAddr(netip.MustParseAddr("2001:db8::2")),
+	}
+	rules := []*mgmProto.FirewallRule{
+		{
+			PolicyID:       []byte("policy-A"),
+			SourcePrefixes: srcs,
+			Direction:      mgmProto.RuleDirection_IN,
+			Action:         mgmProto.RuleAction_ACCEPT,
+			Protocol:       mgmProto.RuleProtocol_TCP,
+			Port:           "443",
+		},
+	}
+
+	groups, denyErr, err := groupPeerRules(rules)
+	require.NoError(t, denyErr)
+	require.NoError(t, err)
+	require.Len(t, groups, 2, "mixed-family sources in one rule must split into two groups")
+
+	for _, g := range groups {
+		require.Len(t, g.sources, 2)
+		v6 := prefixIsV6(g.sources[0])
+		for _, s := range g.sources {
+			assert.Equal(t, v6, prefixIsV6(s), "every source in a group must share one family")
+		}
+	}
+}
+
+// TestGroupPeerRulesMergesSameSelector verifies that rules sharing
+// every distinguishing field (policy, family, direction, action,
+// proto, port) collapse into a single multi-source group.
+func TestGroupPeerRulesMergesSameSelector(t *testing.T) {
+	mk := func(peerIP string) *mgmProto.FirewallRule {
+		return &mgmProto.FirewallRule{
+			PolicyID:  []byte("policy-A"),
+			PeerIP:    peerIP, //nolint:staticcheck
+			Direction: mgmProto.RuleDirection_IN,
+			Action:    mgmProto.RuleAction_ACCEPT,
+			Protocol:  mgmProto.RuleProtocol_TCP,
+			Port:      "443",
+		}
+	}
+	rules := []*mgmProto.FirewallRule{mk("10.0.0.1"), mk("10.0.0.2"), mk("10.0.0.3")}
+
+	groups, denyErr, err := groupPeerRules(rules)
+	require.NoError(t, denyErr)
+	require.NoError(t, err)
+	require.Len(t, groups, 1)
+	require.Len(t, groups[0].sources, 3)
+}
+
+// TestGroupPeerRulesPortSeparates verifies that PortInfo is part of the
+// selector key: rules differing only in port must not merge, and a
+// single port must not merge with a range. A regression dropping the
+// port from the key would collapse rules for different ports into one.
+func TestGroupPeerRulesPortSeparates(t *testing.T) {
+	mkPort := func(peerIP string, port uint32) *mgmProto.FirewallRule {
+		return &mgmProto.FirewallRule{
+			PolicyID:  []byte("policy-A"),
+			PeerIP:    peerIP, //nolint:staticcheck
+			Direction: mgmProto.RuleDirection_IN,
+			Action:    mgmProto.RuleAction_ACCEPT,
+			Protocol:  mgmProto.RuleProtocol_TCP,
+			PortInfo:  &mgmProto.PortInfo{PortSelection: &mgmProto.PortInfo_Port{Port: port}},
+		}
+	}
+
+	groups, denyErr, err := groupPeerRules([]*mgmProto.FirewallRule{
+		mkPort("10.0.0.1", 80), mkPort("10.0.0.2", 80), mkPort("10.0.0.3", 443),
+	})
+	require.NoError(t, denyErr)
+	require.NoError(t, err)
+	require.Len(t, groups, 2, "rules on different ports must not merge")
+
+	rangeRule := &mgmProto.FirewallRule{
+		PolicyID:  []byte("policy-A"),
+		PeerIP:    "10.0.0.4", //nolint:staticcheck
+		Direction: mgmProto.RuleDirection_IN,
+		Action:    mgmProto.RuleAction_ACCEPT,
+		Protocol:  mgmProto.RuleProtocol_TCP,
+		PortInfo:  &mgmProto.PortInfo{PortSelection: &mgmProto.PortInfo_Range_{Range: &mgmProto.PortInfo_Range{Start: 80, End: 90}}},
+	}
+	groups, denyErr, err = groupPeerRules([]*mgmProto.FirewallRule{mkPort("10.0.0.1", 80), rangeRule})
+	require.NoError(t, denyErr)
+	require.NoError(t, err)
+	require.Len(t, groups, 2, "a single port and a range must not merge")
+}
+
+// TestGroupPeerRulesUsesSourcePrefixesWhenPresent verifies that the
+// new sourcePrefixes wire field is consumed and produces a
+// multi-source group in one shot (no client-side merging needed).
+func TestGroupPeerRulesUsesSourcePrefixesWhenPresent(t *testing.T) {
+	srcs := [][]byte{
+		netiputil.EncodeAddr(netip.MustParseAddr("10.0.0.1")),
+		netiputil.EncodeAddr(netip.MustParseAddr("10.0.0.2")),
+		netiputil.EncodeAddr(netip.MustParseAddr("10.0.0.3")),
+	}
+	rules := []*mgmProto.FirewallRule{
+		{
+			PolicyID:       []byte("policy-A"),
+			SourcePrefixes: srcs,
+			Direction:      mgmProto.RuleDirection_IN,
+			Action:         mgmProto.RuleAction_ACCEPT,
+			Protocol:       mgmProto.RuleProtocol_TCP,
+			Port:           "443",
+		},
+	}
+
+	groups, denyErr, err := groupPeerRules(rules)
+	require.NoError(t, denyErr)
+	require.NoError(t, err)
+	require.Len(t, groups, 1)
+	require.Len(t, groups[0].sources, 3)
+}
+
+// TestGroupPeerRulesActionSeparates verifies the obvious: accept
+// and drop rules with the same selector don't merge.
+func TestGroupPeerRulesActionSeparates(t *testing.T) {
+	rules := []*mgmProto.FirewallRule{
+		{
+			PolicyID:  []byte("policy-A"),
+			PeerIP:    "10.0.0.1",
+			Direction: mgmProto.RuleDirection_IN,
+			Action:    mgmProto.RuleAction_ACCEPT,
+			Protocol:  mgmProto.RuleProtocol_TCP,
+			Port:      "443",
+		},
+		{
+			PolicyID:  []byte("policy-A"),
+			PeerIP:    "10.0.0.1",
+			Direction: mgmProto.RuleDirection_IN,
+			Action:    mgmProto.RuleAction_DROP,
+			Protocol:  mgmProto.RuleProtocol_TCP,
+			Port:      "443",
+		},
+	}
+
+	groups, denyErr, err := groupPeerRules(rules)
+	require.NoError(t, denyErr)
+	require.NoError(t, err)
+	require.Len(t, groups, 2)
+}
+
+// failingDeleteFirewall wraps a real firewall.Manager and forces the
+// next N DeleteFilterRule calls to fail. Used to verify that the acl
+// manager retains rules whose deletion was rejected by the backend,
+// so they get retried on the next ApplyFiltering pass instead of
+// becoming orphans.
+type failingDeleteFirewall struct {
+	fwmgr.Manager
+	failCount int
+}
+
+func (f *failingDeleteFirewall) DeleteFilterRule(r fwmgr.Rule) error {
+	if f.failCount > 0 {
+		f.failCount--
+		return errors.New("simulated delete failure")
+	}
+	return f.Manager.DeleteFilterRule(r)
+}
+
+// TestApplyFilteringRetainsRulesOnDeleteFailure verifies that a
+// transient DeleteFilterRule error doesn't make the acl manager
+// forget about a rule. The rule must remain in peerRulesPairs so the
+// next ApplyFiltering pass attempts the delete again.
+func TestApplyFilteringRetainsRulesOnDeleteFailure(t *testing.T) {
+	t.Setenv("NB_WG_KERNEL_DISABLED", "true")
+	t.Setenv(firewall.EnvForceUserspaceFirewall, "true")
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	ifaceMock := mocks.NewMockIFaceMapper(ctrl)
+	ifaceMock.EXPECT().IsUserspaceBind().Return(true).AnyTimes()
+	ifaceMock.EXPECT().SetFilter(gomock.Any())
+	network := netip.MustParsePrefix("172.0.0.1/32")
+	ifaceMock.EXPECT().Name().Return("lo").AnyTimes()
+	ifaceMock.EXPECT().Address().Return(wgaddr.Address{IP: network.Addr(), Network: network}).AnyTimes()
+	ifaceMock.EXPECT().GetWGDevice().Return(nil).AnyTimes()
+
+	realFW, err := firewall.NewFirewall(ifaceMock, nil, flowLogger, false, iface.DefaultMTU)
+	require.NoError(t, err)
+	defer func() { require.NoError(t, realFW.Close(nil)) }()
+
+	fw := &failingDeleteFirewall{Manager: realFW}
+	acl := NewDefaultManager(fw)
+
+	// First pass: install a rule.
+	netmap1 := &mgmProto.NetworkMap{
+		FirewallRules: []*mgmProto.FirewallRule{
+			{
+				PolicyID:  []byte("policy-A"),
+				PeerIP:    "10.0.0.1",
+				Direction: mgmProto.RuleDirection_IN,
+				Action:    mgmProto.RuleAction_DROP,
+				Protocol:  mgmProto.RuleProtocol_TCP,
+				Port:      "22",
+			},
+		},
+		FirewallRulesIsEmpty: false,
+	}
+	acl.ApplyFiltering(netmap1, false)
+	require.Equal(t, 1, len(acl.peerRulesPairs), "rule should be installed")
+
+	// Second pass: remove the rule from the map. The backend will
+	// fail the delete; the acl manager must retain the rule.
+	fw.failCount = 1
+	netmap2 := &mgmProto.NetworkMap{FirewallRules: nil, FirewallRulesIsEmpty: true}
+	acl.ApplyFiltering(netmap2, false)
+	require.Equal(t, 1, len(acl.peerRulesPairs),
+		"rule must be retained when DeleteFilterRule fails so it gets retried")
+
+	// Third pass: same map, backend no longer fails. The rule
+	// should now succeed in being removed.
+	acl.ApplyFiltering(netmap2, false)
+	require.Equal(t, 0, len(acl.peerRulesPairs), "retry should succeed")
+}
diff --git a/client/internal/acl/id/id.go b/client/internal/acl/id/id.go
index 23451453e..952403bbd 100644
--- a/client/internal/acl/id/id.go
+++ b/client/internal/acl/id/id.go
@@ -5,18 +5,18 @@ import (
 	"encoding/hex"
 	"fmt"
 	"net/netip"
+	"slices"
 	"strconv"
 
 	"github.com/netbirdio/netbird/client/firewall/manager"
 )
 
-type RuleID string
+// RuleID aliases manager.RuleID so existing nbid.RuleID references
+// keep working while the canonical type lives in the firewall package.
+type RuleID = manager.RuleID
 
-func (r RuleID) ID() string {
-	return string(r)
-}
-
-func GenerateRouteRuleKey(
+// GenerateRuleID returns a deterministic content hash identifying a filter rule.
+func GenerateRuleID(
 	sources []netip.Prefix,
 	destination manager.Network,
 	proto manager.Protocol,
@@ -24,6 +24,7 @@ func GenerateRouteRuleKey(
 	dPort *manager.Port,
 	action manager.Action,
 ) RuleID {
+	sources = slices.Clone(sources)
 	manager.SortPrefixes(sources)
 
 	h := sha256.New()
diff --git a/client/internal/acl/legacy_fallback_test.go b/client/internal/acl/legacy_fallback_test.go
new file mode 100644
index 000000000..00ca013f3
--- /dev/null
+++ b/client/internal/acl/legacy_fallback_test.go
@@ -0,0 +1,75 @@
+package acl
+
+import (
+	"net/netip"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/client/firewall"
+	fwmgr "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/internal/acl/mocks"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// sourcesRecordingFirewall wraps a real firewall.Manager and records
+// the source prefixes of every AddFilterRule call.
+type sourcesRecordingFirewall struct {
+	fwmgr.Manager
+	mu      sync.Mutex
+	sources [][]netip.Prefix
+}
+
+func (f *sourcesRecordingFirewall) AddFilterRule(id []byte, sources []netip.Prefix, destination fwmgr.Network, proto fwmgr.Protocol, sPort, dPort *fwmgr.Port, action fwmgr.Action) (fwmgr.Rule, error) {
+	f.mu.Lock()
+	f.sources = append(f.sources, sources)
+	f.mu.Unlock()
+	return f.Manager.AddFilterRule(id, sources, destination, proto, sPort, dPort, action)
+}
+
+// TestLegacyManagementFallbackUsesMatchAnySources verifies the
+// allow-all fallback for old management servers (empty FirewallRules
+// without the FirewallRulesIsEmpty flag) reaches the firewall as /0
+// match-any sources. The fallback rule carries PeerIP 0.0.0.0; if that
+// were converted to a host prefix (0.0.0.0/32) it would match nothing
+// and all peer traffic would be dropped.
+func TestLegacyManagementFallbackUsesMatchAnySources(t *testing.T) {
+	t.Setenv("NB_WG_KERNEL_DISABLED", "true")
+	t.Setenv(firewall.EnvForceUserspaceFirewall, "true")
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	ifaceMock := mocks.NewMockIFaceMapper(ctrl)
+	ifaceMock.EXPECT().IsUserspaceBind().Return(true).AnyTimes()
+	ifaceMock.EXPECT().SetFilter(gomock.Any())
+	network := netip.MustParsePrefix("172.0.0.1/32")
+	ifaceMock.EXPECT().Name().Return("lo").AnyTimes()
+	ifaceMock.EXPECT().Address().Return(wgaddr.Address{IP: network.Addr(), Network: network}).AnyTimes()
+	ifaceMock.EXPECT().GetWGDevice().Return(nil).AnyTimes()
+
+	realFW, err := firewall.NewFirewall(ifaceMock, nil, flowLogger, false, iface.DefaultMTU)
+	require.NoError(t, err)
+	defer func() { require.NoError(t, realFW.Close(nil)) }()
+
+	fw := &sourcesRecordingFirewall{Manager: realFW}
+	acl := NewDefaultManager(fw)
+
+	// Old management: no rules and no FirewallRulesIsEmpty flag.
+	acl.ApplyFiltering(&mgmProto.NetworkMap{FirewallRules: nil, FirewallRulesIsEmpty: false}, false)
+
+	fw.mu.Lock()
+	defer fw.mu.Unlock()
+	require.NotEmpty(t, fw.sources, "legacy fallback must install at least one allow-all rule")
+	for _, sources := range fw.sources {
+		require.NotEmpty(t, sources)
+		for _, p := range sources {
+			assert.Equal(t, 0, p.Bits(), "legacy fallback source %s must be a /0 match-any prefix", p)
+		}
+	}
+}
diff --git a/client/internal/acl/manager.go b/client/internal/acl/manager.go
index d9b179457..6c544b345 100644
--- a/client/internal/acl/manager.go
+++ b/client/internal/acl/manager.go
@@ -1,8 +1,6 @@
 package acl
 
 import (
-	"crypto/md5"
-	"encoding/hex"
 	"errors"
 	"fmt"
 	"net/netip"
@@ -24,6 +22,10 @@ import (
 
 var ErrSourceRangesEmpty = errors.New("sources range is empty")
 
+// ErrNoRuleReturned is returned when the firewall backend reports success
+// from AddFilterRule but yields no rule to track.
+var ErrNoRuleReturned = errors.New("backend returned no rule")
+
 // Manager is a ACL rules manager
 type Manager interface {
 	ApplyFiltering(networkMap *mgmProto.NetworkMap, dnsRouteFeatureFlag bool)
@@ -32,19 +34,48 @@ type Manager interface {
 // DefaultManager uses firewall manager to handle
 type DefaultManager struct {
 	firewall           firewall.Manager
-	ipsetCounter       int
 	peerRulesPairs     map[id.RuleID][]firewall.Rule
-	routeRules         map[id.RuleID]struct{}
+	routeRules         map[id.RuleID]firewall.Rule
 	previousConfigHash uint64
 	hasAppliedConfig   bool
 	mutex              sync.Mutex
 }
 
+// peerRuleGroup collapses a set of single-source FirewallRules sharing
+// the same selector into one multi-source rule to push to the backend.
+type peerRuleGroup struct {
+	direction mgmProto.RuleDirection
+	action    mgmProto.RuleAction
+	protocol  mgmProto.RuleProtocol
+	port      *mgmProto.PortInfo
+	// legacyPort is used only when PortInfo is empty (old management).
+	legacyPort string
+	policyID   []byte
+	sources    []netip.Prefix
+}
+
+// peerRuleKey is the comparable selector that decides which single-source
+// rules merge into one group. Rules with an equal key collapse into one
+// multi-source backend rule. PortInfo is flattened into its scalar fields
+// so the key compares by value; policyID keeps policies separate so two
+// policies authorizing different peers don't merge under one attribution.
+type peerRuleKey struct {
+	v6         bool
+	policyID   string
+	direction  mgmProto.RuleDirection
+	action     mgmProto.RuleAction
+	protocol   mgmProto.RuleProtocol
+	legacyPort string
+	port       uint16
+	rangeStart uint16
+	rangeEnd   uint16
+}
+
 func NewDefaultManager(fm firewall.Manager) *DefaultManager {
 	return &DefaultManager{
 		firewall:       fm,
 		peerRulesPairs: make(map[id.RuleID][]firewall.Rule),
-		routeRules:     make(map[id.RuleID]struct{}),
+		routeRules:     make(map[id.RuleID]firewall.Rule),
 	}
 }
 
@@ -88,11 +119,14 @@ func (d *DefaultManager) ApplyFiltering(networkMap *mgmProto.NetworkMap, dnsRout
 			time.Since(start), total)
 	}()
 
-	d.applyPeerACLs(networkMap)
+	peerErr := d.applyPeerACLs(networkMap)
+	if peerErr != nil {
+		log.Errorf("apply peer ACLs: %v", peerErr)
+	}
 
 	routeErr := d.applyRouteACLs(networkMap.RoutesFirewallRules, dnsRouteFeatureFlag)
 	if routeErr != nil {
-		log.Errorf("Failed to apply route ACLs: %v", routeErr)
+		log.Errorf("apply route ACLs: %v", routeErr)
 	}
 
 	flushErr := d.firewall.Flush()
@@ -104,7 +138,7 @@ func (d *DefaultManager) ApplyFiltering(networkMap *mgmProto.NetworkMap, dnsRout
 	// If applying or flushing failed, leave the previous hash untouched so the
 	// next (possibly identical) update is not skipped and gets a chance to
 	// reconcile the firewall state.
-	if err == nil && routeErr == nil && flushErr == nil {
+	if err == nil && peerErr == nil && routeErr == nil && flushErr == nil {
 		d.previousConfigHash = hash
 		d.hasAppliedConfig = true
 	} else {
@@ -116,11 +150,11 @@ func (d *DefaultManager) ApplyFiltering(networkMap *mgmProto.NetworkMap, dnsRout
 // firewall state, so an identical hash means an identical resulting ruleset.
 func (d *DefaultManager) firewallConfigHash(networkMap *mgmProto.NetworkMap, dnsRouteFeatureFlag bool) (uint64, error) {
 	return hashstructure.Hash(struct {
-		PeerRules            []*mgmProto.FirewallRule
-		PeerRulesIsEmpty     bool
-		RouteRules           []*mgmProto.RouteFirewallRule
-		RouteRulesIsEmpty    bool
-		DNSRouteFeatureFlag  bool
+		PeerRules           []*mgmProto.FirewallRule
+		PeerRulesIsEmpty    bool
+		RouteRules          []*mgmProto.RouteFirewallRule
+		RouteRulesIsEmpty   bool
+		DNSRouteFeatureFlag bool
 	}{
 		PeerRules:           networkMap.GetFirewallRules(),
 		PeerRulesIsEmpty:    networkMap.GetFirewallRulesIsEmpty(),
@@ -135,7 +169,7 @@ func (d *DefaultManager) firewallConfigHash(networkMap *mgmProto.NetworkMap, dns
 	})
 }
 
-func (d *DefaultManager) applyPeerACLs(networkMap *mgmProto.NetworkMap) {
+func (d *DefaultManager) applyPeerACLs(networkMap *mgmProto.NetworkMap) error {
 	rules := networkMap.FirewallRules
 
 	// if we got empty rules list but management not set networkMap.FirewallRulesIsEmpty flag
@@ -144,13 +178,13 @@ func (d *DefaultManager) applyPeerACLs(networkMap *mgmProto.NetworkMap) {
 		log.Warn("this peer is connected to a NetBird Management service with an older version. Allowing all traffic from connected peers")
 		rules = append(rules,
 			&mgmProto.FirewallRule{
-				PeerIP:    "0.0.0.0",
+				PeerIP:    "0.0.0.0", //nolint:staticcheck
 				Direction: mgmProto.RuleDirection_IN,
 				Action:    mgmProto.RuleAction_ACCEPT,
 				Protocol:  mgmProto.RuleProtocol_ALL,
 			},
 			&mgmProto.FirewallRule{
-				PeerIP:    "0.0.0.0",
+				PeerIP:    "0.0.0.0", //nolint:staticcheck
 				Direction: mgmProto.RuleDirection_OUT,
 				Action:    mgmProto.RuleAction_ACCEPT,
 				Protocol:  mgmProto.RuleProtocol_ALL,
@@ -158,59 +192,167 @@ func (d *DefaultManager) applyPeerACLs(networkMap *mgmProto.NetworkMap) {
 		)
 	}
 
-	newRulePairs := make(map[id.RuleID][]firewall.Rule)
-	ipsetByRuleSelectors := make(map[string]string)
+	// Group incoming single-source rules from management by their
+	// (direction, action, proto, port) selector and merge sources.
+	// One call to the firewall backend per merged rule.
+	// A deny we cannot decode would leave its traffic unblocked, so skip
+	// the whole pass and keep existing rules until the next sync.
+	groups, denyErr, err := groupPeerRules(rules)
+	if denyErr != nil {
+		return fmt.Errorf("decode deny rule sources: %w", denyErr)
+	}
 
-	// TODO: deny rules should be fatal: if a deny rule fails to apply, we must
-	// roll back all allow rules to avoid a fail-open where allowed traffic bypasses
-	// the missing deny. Currently we accumulate errors and continue.
+	newRulePairs := make(map[id.RuleID][]firewall.Rule)
 	var merr *multierror.Error
-	for _, r := range rules {
-		// if this rule is member of rule selection with more than DefaultIPsCountForSet
-		// it's IP address can be used in the ipset for firewall manager which supports it
-		selector := d.getRuleGroupingSelector(r)
-		ipsetName, ok := ipsetByRuleSelectors[selector]
-		if !ok {
-			d.ipsetCounter++
-			ipsetName = fmt.Sprintf("nb%07d", d.ipsetCounter)
-			ipsetByRuleSelectors[selector] = ipsetName
-		}
-		pairID, rulePair, err := d.protoRuleToFirewallRule(r, ipsetName)
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("apply firewall rule: %w", err))
+	if err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	// Apply denies first. A deny that fails to install is a security
+	// failure (fail-open), so if any deny errors we roll back the
+	// denies we already installed in this pass and bail out without
+	// installing any accept. Pre-existing rules stay untouched until
+	// the next successful pass clears them.
+	denies, accepts := splitDenyAccept(groups)
+	if err := d.installPeerGroups(denies, newRulePairs, true); err != nil {
+		return fmt.Errorf("install deny rules: %w", err)
+	}
+
+	if err := d.installPeerGroups(accepts, newRulePairs, false); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	// Tear down rules that disappeared from the networkmap. Any rule
+	// the backend refuses to delete stays in our tracking so it gets
+	// retried on the next ApplyFiltering. Otherwise a transient
+	// delete failure would leak the rule in the firewall until the
+	// process exits.
+	for pairID, rules := range d.peerRulesPairs {
+		if _, ok := newRulePairs[pairID]; ok {
 			continue
 		}
-		if len(rulePair) > 0 {
-			d.peerRulesPairs[pairID] = rulePair
-			newRulePairs[pairID] = rulePair
-		}
-	}
-
-	if merr != nil {
-		log.Errorf("failed to apply %d peer ACL rule(s): %v", merr.Len(), nberrors.FormatErrorOrNil(merr))
-	}
-
-	for pairID, rules := range d.peerRulesPairs {
-		if _, ok := newRulePairs[pairID]; !ok {
-			for _, rule := range rules {
-				if err := d.firewall.DeletePeerRule(rule); err != nil {
-					log.Errorf("failed to delete peer firewall rule: %v", err)
-					continue
-				}
+		var remaining []firewall.Rule
+		for _, rule := range rules {
+			if err := d.firewall.DeleteFilterRule(rule); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("delete peer rule, will retry: %w", err))
+				remaining = append(remaining, rule)
 			}
-			delete(d.peerRulesPairs, pairID)
+		}
+		if len(remaining) > 0 {
+			newRulePairs[pairID] = remaining
 		}
 	}
 	d.peerRulesPairs = newRulePairs
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// installPeerGroups applies each group and records the resulting rule
+// pairs in newRulePairs. With atomic set (deny rules), a single failure
+// rolls back every rule installed in this call and returns, leaving the
+// firewall exactly as before: denies are fail-closed and must be applied
+// all-or-nothing. With atomic unset (accept rules), failures are
+// accumulated and the remaining groups still install, so one malformed
+// allow cannot drop every other legitimate allow in the pass.
+func (d *DefaultManager) installPeerGroups(groups []*peerRuleGroup, newRulePairs map[id.RuleID][]firewall.Rule, atomic bool) error {
+	var freshlyInstalled []id.RuleID
+	var merr *multierror.Error
+	for _, g := range groups {
+		pairID, rulePair, err := d.applyPeerGroup(g)
+		if err != nil {
+			if atomic {
+				d.rollbackInstalled(freshlyInstalled)
+				return fmt.Errorf("apply firewall rule: %w", err)
+			}
+			merr = multierror.Append(merr, fmt.Errorf("apply firewall rule: %w", err))
+			continue
+		}
+		if len(rulePair) == 0 {
+			continue
+		}
+		if _, existed := d.peerRulesPairs[pairID]; !existed {
+			freshlyInstalled = append(freshlyInstalled, pairID)
+		}
+		d.peerRulesPairs[pairID] = rulePair
+		newRulePairs[pairID] = rulePair
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func (d *DefaultManager) rollbackInstalled(pairIDs []id.RuleID) {
+	var merr *multierror.Error
+	for _, pairID := range pairIDs {
+		// Keep any rule the backend refuses to delete tracked so it is
+		// retried on the next ApplyFiltering instead of leaking in the
+		// firewall with no tracking left to remove it.
+		var remaining []firewall.Rule
+		for _, rule := range d.peerRulesPairs[pairID] {
+			if err := d.firewall.DeleteFilterRule(rule); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("rule %s: %w", pairID, err))
+				remaining = append(remaining, rule)
+			}
+		}
+		if len(remaining) > 0 {
+			d.peerRulesPairs[pairID] = remaining
+		} else {
+			delete(d.peerRulesPairs, pairID)
+		}
+	}
+	if err := nberrors.FormatErrorOrNil(merr); err != nil {
+		log.Errorf("rollback peer rules: %v", err)
+	}
+}
+
+func (d *DefaultManager) applyPeerGroup(g *peerRuleGroup) (id.RuleID, []firewall.Rule, error) {
+	protocol, err := ConvertToFirewallProtocol(g.protocol)
+	if err != nil {
+		return "", nil, fmt.Errorf("skipping firewall rule: %w", err)
+	}
+	action, err := convertFirewallAction(g.action)
+	if err != nil {
+		return "", nil, fmt.Errorf("skipping firewall rule: %w", err)
+	}
+	port, err := resolveGroupPort(g)
+	if err != nil {
+		return "", nil, err
+	}
+
+	var fwRule firewall.Rule
+	switch g.direction {
+	case mgmProto.RuleDirection_IN:
+		fwRule, err = d.firewall.AddFilterRule(g.policyID, g.sources, firewall.Network{}, protocol, nil, port, action)
+	case mgmProto.RuleDirection_OUT:
+		if d.firewall.IsStateful() {
+			return "", nil, nil
+		}
+		if shouldSkipInvertedRule(protocol, port) {
+			return "", nil, nil
+		}
+		fwRule, err = d.firewall.AddFilterRule(g.policyID, g.sources, firewall.Network{}, protocol, port, nil, action)
+	default:
+		return "", nil, errors.New("invalid direction")
+	}
+
+	if err != nil {
+		return "", nil, fmt.Errorf("add firewall rule: %w", err)
+	}
+	if fwRule == nil {
+		return "", nil, fmt.Errorf("add firewall rule: %w", ErrNoRuleReturned)
+	}
+
+	// Derive the pair id from the backend rule, like the route path:
+	// the backend dedups identical content, so two policies authorizing
+	// the same flow resolve to the same id and a single backing rule.
+	return fwRule.ID(), []firewall.Rule{fwRule}, nil
 }
 
 func (d *DefaultManager) applyRouteACLs(rules []*mgmProto.RouteFirewallRule, dynamicResolver bool) error {
-	newRouteRules := make(map[id.RuleID]struct{}, len(rules))
+	newRouteRules := make(map[id.RuleID]firewall.Rule, len(rules))
 	var merr *multierror.Error
 
-	// Apply new rules - firewall manager will return existing rule ID if already present
+	// Apply new rules - firewall manager will return the existing rule if already present
 	for _, rule := range rules {
-		id, err := d.applyRouteACL(rule, dynamicResolver)
+		addedRule, err := d.applyRouteACL(rule, dynamicResolver)
 		if err != nil {
 			if errors.Is(err, ErrSourceRangesEmpty) {
 				log.Debugf("skipping empty sources rule with destination %s: %v", rule.Destination, err)
@@ -219,16 +361,18 @@ func (d *DefaultManager) applyRouteACLs(rules []*mgmProto.RouteFirewallRule, dyn
 			}
 			continue
 		}
-		newRouteRules[id] = struct{}{}
+		newRouteRules[addedRule.ID()] = addedRule
 	}
 
-	// Clean up old firewall rules
-	for id := range d.routeRules {
-		if _, exists := newRouteRules[id]; !exists {
-			if err := d.firewall.DeleteRouteRule(id); err != nil {
-				merr = multierror.Append(merr, fmt.Errorf("delete route rule: %w", err))
-			}
-			// implicitly deleted from the map
+	// Tear down old route rules; retain ones the backend refused so a
+	// transient failure doesn't leave orphaned rules in the firewall.
+	for ruleID, rule := range d.routeRules {
+		if _, exists := newRouteRules[ruleID]; exists {
+			continue
+		}
+		if err := d.firewall.DeleteFilterRule(rule); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("delete route rule, will retry: %w", err))
+			newRouteRules[ruleID] = rule
 		}
 	}
 
@@ -236,102 +380,202 @@ func (d *DefaultManager) applyRouteACLs(rules []*mgmProto.RouteFirewallRule, dyn
 	return nberrors.FormatErrorOrNil(merr)
 }
 
-func (d *DefaultManager) applyRouteACL(rule *mgmProto.RouteFirewallRule, dynamicResolver bool) (id.RuleID, error) {
+func (d *DefaultManager) applyRouteACL(rule *mgmProto.RouteFirewallRule, dynamicResolver bool) (firewall.Rule, error) {
 	if len(rule.SourceRanges) == 0 {
-		return "", ErrSourceRangesEmpty
+		return nil, ErrSourceRangesEmpty
 	}
 
 	var sources []netip.Prefix
 	for _, sourceRange := range rule.SourceRanges {
 		source, err := netip.ParsePrefix(sourceRange)
 		if err != nil {
-			return "", fmt.Errorf("parse source range: %w", err)
+			return nil, fmt.Errorf("parse source range: %w", err)
 		}
-		sources = append(sources, source)
+		sources = append(sources, firewall.UnmapPrefix(source))
 	}
 
 	destination, err := determineDestination(rule, dynamicResolver, sources)
 	if err != nil {
-		return "", fmt.Errorf("determine destination: %w", err)
+		return nil, fmt.Errorf("determine destination: %w", err)
 	}
 
-	protocol, err := convertToFirewallProtocol(rule.Protocol)
+	protocol, err := ConvertToFirewallProtocol(rule.Protocol)
 	if err != nil {
-		return "", fmt.Errorf("invalid protocol: %w", err)
+		return nil, fmt.Errorf("invalid protocol: %w", err)
 	}
 
 	action, err := convertFirewallAction(rule.Action)
 	if err != nil {
-		return "", fmt.Errorf("invalid action: %w", err)
+		return nil, fmt.Errorf("invalid action: %w", err)
 	}
 
 	dPorts := convertPortInfo(rule.PortInfo)
 
-	addedRule, err := d.firewall.AddRouteFiltering(rule.PolicyID, sources, destination, protocol, nil, dPorts, action)
+	addedRule, err := d.firewall.AddFilterRule(rule.PolicyID, sources, destination, protocol, nil, dPorts, action)
 	if err != nil {
-		return "", fmt.Errorf("add route rule: %w", err)
+		return nil, fmt.Errorf("add route rule: %w", err)
+	}
+	if addedRule == nil {
+		return nil, fmt.Errorf("add route rule: %w", ErrNoRuleReturned)
 	}
 
-	return id.RuleID(addedRule.ID()), nil
+	return addedRule, nil
 }
 
-func (d *DefaultManager) protoRuleToFirewallRule(
-	r *mgmProto.FirewallRule,
-	ipsetName string,
-) (id.RuleID, []firewall.Rule, error) {
-	ip, err := extractRuleIP(r)
-	if err != nil {
-		return "", nil, err
+// splitDenyAccept partitions groups by action so denies can be
+// applied before accepts. Order within each bucket is preserved.
+func splitDenyAccept(groups []*peerRuleGroup) (denies, accepts []*peerRuleGroup) {
+	for _, g := range groups {
+		if g.action == mgmProto.RuleAction_DROP {
+			denies = append(denies, g)
+		} else {
+			accepts = append(accepts, g)
+		}
+	}
+	return denies, accepts
+}
+
+// groupPeerRules merges single-source rules sharing a selector into
+// multi-source groups. It splits source-decode failures by action:
+// denyErr is non-nil when a deny rule could not be decoded, which is a
+// fail-open risk the caller must treat as fatal for the pass; err
+// carries the tolerable accept-rule failures the caller can log and
+// continue past.
+func groupPeerRules(rules []*mgmProto.FirewallRule) (groups []*peerRuleGroup, denyErr error, err error) {
+	var denyMerr, acceptMerr *multierror.Error
+	byKey := make(map[peerRuleKey]*peerRuleGroup)
+	order := make([]peerRuleKey, 0)
+
+	for _, r := range rules {
+		srcs, decErr := extractRuleSources(r)
+		if decErr != nil {
+			if r.Action == mgmProto.RuleAction_DROP {
+				denyMerr = multierror.Append(denyMerr, decErr)
+			} else {
+				acceptMerr = multierror.Append(acceptMerr, decErr)
+			}
+			continue
+		}
+		// A single FirewallRule normally carries one address family, but
+		// split by family defensively: each backend keys a rule to one
+		// family and would mismatch sources of the other, so a group's
+		// sources must never span families.
+		v4, v6 := splitPrefixesByFamily(srcs)
+		for _, sub := range []struct {
+			isV6    bool
+			sources []netip.Prefix
+		}{{false, v4}, {true, v6}} {
+			if len(sub.sources) == 0 {
+				continue
+			}
+			key := ruleGroupKey(r, sub.isV6)
+			g, ok := byKey[key]
+			if !ok {
+				g = &peerRuleGroup{
+					direction:  r.Direction,
+					action:     r.Action,
+					protocol:   r.Protocol,
+					port:       r.PortInfo,
+					legacyPort: r.Port,
+					policyID:   r.PolicyID,
+				}
+				byKey[key] = g
+				order = append(order, key)
+			}
+			g.sources = append(g.sources, sub.sources...)
+		}
 	}
 
-	protocol, err := convertToFirewallProtocol(r.Protocol)
-	if err != nil {
-		return "", nil, fmt.Errorf("skipping firewall rule: %s", err)
+	out := make([]*peerRuleGroup, 0, len(order))
+	for _, k := range order {
+		out = append(out, byKey[k])
+	}
+	return out, nberrors.FormatErrorOrNil(denyMerr), nberrors.FormatErrorOrNil(acceptMerr)
+}
+
+func prefixIsV6(p netip.Prefix) bool {
+	return p.Addr().Is6() && !p.Addr().Is4In6()
+}
+
+// splitPrefixesByFamily partitions prefixes into IPv4 and IPv6 groups.
+func splitPrefixesByFamily(prefixes []netip.Prefix) (v4, v6 []netip.Prefix) {
+	for _, p := range prefixes {
+		if prefixIsV6(p) {
+			v6 = append(v6, p)
+		} else {
+			v4 = append(v4, p)
+		}
+	}
+	return v4, v6
+}
+
+// ruleGroupKey builds the selector key for a rule. v6 must reflect the
+// rule's source family: mgmt emits one rule per family and mixing them
+// would break ICMP-variant selection in uspfilter.
+func ruleGroupKey(r *mgmProto.FirewallRule, v6 bool) peerRuleKey {
+	k := peerRuleKey{
+		v6:         v6,
+		policyID:   string(r.PolicyID),
+		direction:  r.Direction,
+		action:     r.Action,
+		protocol:   r.Protocol,
+		legacyPort: r.Port,
+	}
+	if pi := r.PortInfo; pi != nil {
+		k.port = uint16(pi.GetPort())
+		if rng := pi.GetRange(); rng != nil {
+			k.rangeStart = uint16(rng.GetStart())
+			k.rangeEnd = uint16(rng.GetEnd())
+		}
+	}
+	return k
+}
+
+// extractRuleSources returns all source prefixes the rule applies to.
+// New management populates sourcePrefixes; older management sets PeerIP.
+func extractRuleSources(r *mgmProto.FirewallRule) ([]netip.Prefix, error) {
+	if len(r.SourcePrefixes) > 0 {
+		out := make([]netip.Prefix, 0, len(r.SourcePrefixes))
+		for _, raw := range r.SourcePrefixes {
+			addr, err := netiputil.DecodeAddr(raw)
+			if err != nil {
+				return nil, fmt.Errorf("decode source prefix: %w", err)
+			}
+			out = append(out, netip.PrefixFrom(addr.Unmap(), addr.Unmap().BitLen()))
+		}
+		return out, nil
 	}
 
-	action, err := convertFirewallAction(r.Action)
+	peerIP := r.PeerIP //nolint:staticcheck // PeerIP is the legacy source field for old management servers
+	addr, err := netip.ParseAddr(peerIP)
 	if err != nil {
-		return "", nil, fmt.Errorf("skipping firewall rule: %s", err)
+		return nil, fmt.Errorf("parse peer IP %q: %w", peerIP, err)
 	}
+	addr = addr.Unmap()
+	// An unspecified PeerIP means "any peer" (legacy management
+	// allow-all fallback); only a /0 prefix matches any source in the
+	// backends, a full-length prefix would match nothing.
+	if addr.IsUnspecified() {
+		return []netip.Prefix{netip.PrefixFrom(addr, 0)}, nil
+	}
+	return []netip.Prefix{netip.PrefixFrom(addr, addr.BitLen())}, nil
+}
 
-	var port *firewall.Port
-	if !portInfoEmpty(r.PortInfo) {
-		port = convertPortInfo(r.PortInfo)
-	} else if r.Port != "" {
-		// old version of management, single port
-		value, err := strconv.Atoi(r.Port)
+func resolveGroupPort(g *peerRuleGroup) (*firewall.Port, error) {
+	if !portInfoEmpty(g.port) {
+		return convertPortInfo(g.port), nil
+	}
+	if g.legacyPort != "" {
+		value, err := strconv.ParseUint(g.legacyPort, 10, 16)
 		if err != nil {
-			return "", nil, fmt.Errorf("invalid port: %w", err)
+			return nil, fmt.Errorf("invalid port: %w", err)
 		}
-		port = &firewall.Port{
+		return &firewall.Port{
 			Values: []uint16{uint16(value)},
-		}
+		}, nil
 	}
-
-	ruleID := d.getPeerRuleID(ip, protocol, int(r.Direction), port, action)
-	if rulesPair, ok := d.peerRulesPairs[ruleID]; ok {
-		return ruleID, rulesPair, nil
-	}
-
-	var rules []firewall.Rule
-	switch r.Direction {
-	case mgmProto.RuleDirection_IN:
-		rules, err = d.addInRules(r.PolicyID, ip, protocol, port, action, ipsetName)
-	case mgmProto.RuleDirection_OUT:
-		if d.firewall.IsStateful() {
-			return "", nil, nil
-		}
-		// return traffic for outbound connections if firewall is stateless
-		rules, err = d.addOutRules(r.PolicyID, ip, protocol, port, action, ipsetName)
-	default:
-		return "", nil, fmt.Errorf("invalid direction, skipping firewall rule")
-	}
-
-	if err != nil {
-		return "", nil, err
-	}
-
-	return ruleID, rules, nil
+	// nolint:nilnil // a nil port legitimately means "no port restriction"
+	return nil, nil
 }
 
 func portInfoEmpty(portInfo *mgmProto.PortInfo) bool {
@@ -350,85 +594,9 @@ func portInfoEmpty(portInfo *mgmProto.PortInfo) bool {
 	}
 }
 
-func (d *DefaultManager) addInRules(
-	id []byte,
-	ip netip.Addr,
-	protocol firewall.Protocol,
-	port *firewall.Port,
-	action firewall.Action,
-	ipsetName string,
-) ([]firewall.Rule, error) {
-	rule, err := d.firewall.AddPeerFiltering(id, ip.AsSlice(), protocol, nil, port, action, ipsetName)
-	if err != nil {
-		return nil, fmt.Errorf("add firewall rule: %w", err)
-	}
-
-	return rule, nil
-}
-
-func (d *DefaultManager) addOutRules(
-	id []byte,
-	ip netip.Addr,
-	protocol firewall.Protocol,
-	port *firewall.Port,
-	action firewall.Action,
-	ipsetName string,
-) ([]firewall.Rule, error) {
-	if shouldSkipInvertedRule(protocol, port) {
-		return nil, nil
-	}
-
-	rule, err := d.firewall.AddPeerFiltering(id, ip.AsSlice(), protocol, port, nil, action, ipsetName)
-	if err != nil {
-		return nil, fmt.Errorf("add firewall rule: %w", err)
-	}
-
-	return rule, nil
-}
-
-// getPeerRuleID returns unique ID for the rule based on its parameters.
-func (d *DefaultManager) getPeerRuleID(
-	ip netip.Addr,
-	proto firewall.Protocol,
-	direction int,
-	port *firewall.Port,
-	action firewall.Action,
-) id.RuleID {
-	idStr := ip.String() + string(proto) + strconv.Itoa(direction) + strconv.Itoa(int(action))
-	if port != nil {
-		idStr += port.String()
-	}
-
-	return id.RuleID(hex.EncodeToString(md5.New().Sum([]byte(idStr))))
-}
-
-// getRuleGroupingSelector takes all rule properties except IP address to build selector
-func (d *DefaultManager) getRuleGroupingSelector(rule *mgmProto.FirewallRule) string {
-	return fmt.Sprintf("%v:%v:%v:%s:%v", strconv.Itoa(int(rule.Direction)), rule.Action, rule.Protocol, rule.Port, rule.PortInfo)
-}
-
-
-// extractRuleIP extracts the peer IP from a firewall rule.
-// If sourcePrefixes is populated (new management), decode the first entry and use its address.
-// Otherwise fall back to the deprecated PeerIP string field (old management).
-func extractRuleIP(r *mgmProto.FirewallRule) (netip.Addr, error) {
-	if len(r.SourcePrefixes) > 0 {
-		addr, err := netiputil.DecodeAddr(r.SourcePrefixes[0])
-		if err != nil {
-			return netip.Addr{}, fmt.Errorf("decode source prefix: %w", err)
-		}
-		return addr.Unmap(), nil
-	}
-
-	//nolint:staticcheck // PeerIP used for backward compatibility with old management
-	addr, err := netip.ParseAddr(r.PeerIP)
-	if err != nil {
-		return netip.Addr{}, fmt.Errorf("invalid IP address, skipping firewall rule")
-	}
-	return addr.Unmap(), nil
-}
-
-func convertToFirewallProtocol(protocol mgmProto.RuleProtocol) (firewall.Protocol, error) {
+// ConvertToFirewallProtocol maps a management rule protocol to the
+// firewall protocol type.
+func ConvertToFirewallProtocol(protocol mgmProto.RuleProtocol) (firewall.Protocol, error) {
 	switch protocol {
 	case mgmProto.RuleProtocol_TCP:
 		return firewall.ProtocolTCP, nil
diff --git a/client/internal/acl/manager_test.go b/client/internal/acl/manager_test.go
index 968654ae9..19bef9058 100644
--- a/client/internal/acl/manager_test.go
+++ b/client/internal/acl/manager_test.go
@@ -5,11 +5,12 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/client/firewall"
+	fwmanager "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/acl/mocks"
@@ -77,9 +78,9 @@ func TestDefaultManager(t *testing.T) {
 	})
 
 	t.Run("add extra rules", func(t *testing.T) {
-		existedPairs := map[string]struct{}{}
+		existedPairs := map[fwmanager.RuleID]struct{}{}
 		for id := range acl.peerRulesPairs {
-			existedPairs[id.ID()] = struct{}{}
+			existedPairs[id] = struct{}{}
 		}
 
 		// remove first rule
@@ -87,7 +88,7 @@ func TestDefaultManager(t *testing.T) {
 		networkMap.FirewallRules = append(
 			networkMap.FirewallRules,
 			&mgmProto.FirewallRule{
-				PeerIP:    "10.93.0.3",
+				PeerIP:    "10.93.0.3", //nolint:staticcheck
 				Direction: mgmProto.RuleDirection_IN,
 				Action:    mgmProto.RuleAction_DROP,
 				Protocol:  mgmProto.RuleProtocol_ICMP,
@@ -106,7 +107,7 @@ func TestDefaultManager(t *testing.T) {
 		// check that old rule was removed
 		previousCount := 0
 		for id := range acl.peerRulesPairs {
-			if _, ok := existedPairs[id.ID()]; ok {
+			if _, ok := existedPairs[id]; ok {
 				previousCount++
 			}
 		}
@@ -556,12 +557,12 @@ func TestApplyFilteringSkipsUnchangedConfig(t *testing.T) {
 
 func buildNetworkMap(peerRules, routeRules int) *mgmProto.NetworkMap {
 	nm := &mgmProto.NetworkMap{
-		FirewallRulesIsEmpty:      peerRules == 0,
+		FirewallRulesIsEmpty:       peerRules == 0,
 		RoutesFirewallRulesIsEmpty: routeRules == 0,
 	}
 	for i := range peerRules {
 		nm.FirewallRules = append(nm.FirewallRules, &mgmProto.FirewallRule{
-			PeerIP:    fmt.Sprintf("10.%d.%d.%d", i>>16&0xff, i>>8&0xff, i&0xff),
+			PeerIP:    fmt.Sprintf("10.%d.%d.%d", i>>16&0xff, i>>8&0xff, i&0xff), //nolint:staticcheck
 			Direction: mgmProto.RuleDirection_IN,
 			Action:    mgmProto.RuleAction_ACCEPT,
 			Protocol:  mgmProto.RuleProtocol_TCP,
diff --git a/client/internal/acl/mocks/iface_mapper.go b/client/internal/acl/mocks/iface_mapper.go
index 95d5a2c58..f8cca1c2d 100644
--- a/client/internal/acl/mocks/iface_mapper.go
+++ b/client/internal/acl/mocks/iface_mapper.go
@@ -7,7 +7,7 @@ package mocks
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 	wgdevice "golang.zx2c4.com/wireguard/device"
 
 	"github.com/netbirdio/netbird/client/iface/device"
diff --git a/client/internal/auth/account_match_test.go b/client/internal/auth/account_match_test.go
new file mode 100644
index 000000000..b879cf9ab
--- /dev/null
+++ b/client/internal/auth/account_match_test.go
@@ -0,0 +1,113 @@
+package auth
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTokenInfoMatchesAccount(t *testing.T) {
+	tests := []struct {
+		name  string
+		token TokenInfo
+		hint  string
+		match bool
+	}{
+		{
+			name:  "same account",
+			token: TokenInfo{EmailClaim: "user@example.com"},
+			hint:  "user@example.com",
+			match: true,
+		},
+		{
+			name:  "different account",
+			token: TokenInfo{EmailClaim: "other@example.com"},
+			hint:  "user@example.com",
+			match: false,
+		},
+		{
+			name:  "case differences are the same account",
+			token: TokenInfo{EmailClaim: "User@Example.com"},
+			hint:  "user@example.com",
+			match: true,
+		},
+		{
+			name:  "no hint leaves the choice to the IdP",
+			token: TokenInfo{EmailClaim: "other@example.com"},
+			hint:  "",
+			match: true,
+		},
+		{
+			name:  "token without an email claim is not judged",
+			token: TokenInfo{EmailClaim: ""},
+			hint:  "user@example.com",
+			match: true,
+		},
+		{
+			name:  "name fallback does not trigger matching",
+			token: TokenInfo{Email: "Some One"},
+			hint:  "user@example.com",
+			match: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.match, tc.token.MatchesAccount(tc.hint))
+		})
+	}
+}
+
+func TestParseEmailFromIDToken(t *testing.T) {
+	tests := []struct {
+		name          string
+		claims        map[string]interface{}
+		wantValue     string
+		wantFromEmail bool
+		wantErr       bool
+	}{
+		{
+			name:          "email claim",
+			claims:        map[string]interface{}{"email": "user@example.com", "name": "Some One"},
+			wantValue:     "user@example.com",
+			wantFromEmail: true,
+		},
+		{
+			name:      "name fallback",
+			claims:    map[string]interface{}{"name": "Some One"},
+			wantValue: "Some One",
+		},
+		{
+			name:    "neither claim present",
+			claims:  map[string]interface{}{"sub": "abc"},
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			value, fromEmailClaim, err := parseEmailFromIDToken(idTokenWithClaims(t, tc.claims))
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantValue, value)
+			assert.Equal(t, tc.wantFromEmail, fromEmailClaim)
+		})
+	}
+}
+
+func TestRetryFlowForAccountUnsupportedFlow(t *testing.T) {
+	assert.Nil(t, RetryFlowForAccount(&DeviceAuthorizationFlow{}))
+}
+
+func idTokenWithClaims(t *testing.T, claims map[string]interface{}) string {
+	t.Helper()
+	payload, err := json.Marshal(claims)
+	require.NoError(t, err)
+	return "header." + base64.RawURLEncoding.EncodeToString(payload) + ".signature"
+}
diff --git a/client/internal/auth/auth.go b/client/internal/auth/auth.go
index 850e0706d..7c156b5fd 100644
--- a/client/internal/auth/auth.go
+++ b/client/internal/auth/auth.go
@@ -3,6 +3,7 @@ package auth
 import (
 	"context"
 	"net/url"
+	"strings"
 	"sync"
 	"time"
 
@@ -21,6 +22,25 @@ import (
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
+// peerLoginExpiredMsg is the exact phrase the management server returns
+// when a previously SSO-enrolled peer's login has expired. Sourced from
+// shared/management/status/error.go (NewPeerLoginExpiredError). Matched
+// by substring so a future server-side rewording that keeps the phrase
+// still triggers the friendly fallback in Login().
+const peerLoginExpiredMsg = "peer login has expired"
+
+// errSetupKeyOnSSOExpiredPeer replaces the raw management error when the
+// user runs `netbird login -k <setup-key>` against a peer that was
+// originally enrolled via SSO. Wrapped in a PermissionDenied gRPC status
+// so callers' existing isPermissionDenied / isAuthError checks still
+// classify it correctly (early-exit from retry backoff, StatusNeedsLogin
+// in the server state machine).
+var errSetupKeyOnSSOExpiredPeer = status.Error(
+	codes.PermissionDenied,
+	"this peer was originally enrolled via SSO and its session has expired. "+
+		"Setup keys can only enrol new peers — run `netbird up` (interactive SSO) to re-login.",
+)
+
 // Auth manages authentication operations with the management server
 // It maintains a long-lived connection and automatically handles reconnection with backoff
 type Auth struct {
@@ -83,7 +103,7 @@ func (a *Auth) IsSSOSupported(ctx context.Context) (bool, error) {
 
 	err := a.withRetry(ctx, func(client *mgm.GrpcClient) error {
 		// Try PKCE flow first
-		_, err := a.getPKCEFlow(client)
+		_, err := a.getPKCEFlow(client, false)
 		if err == nil {
 			supportsSSO = true
 			return nil
@@ -116,28 +136,43 @@ func (a *Auth) IsSSOSupported(ctx context.Context) (bool, error) {
 	return supportsSSO, err
 }
 
-// GetOAuthFlow returns an OAuth flow (PKCE or Device) using the existing management connection
-// This avoids creating a new connection to the management server
-func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool) (OAuthFlow, error) {
+// GetOAuthFlow returns an OAuth flow (PKCE or Device) using the existing management connection.
+// This avoids creating a new connection to the management server.
+//
+// sessionExtend marks the flow as renewing an existing peer's session rather than
+// logging one in; the server needs it to rule out a silent authorization that the
+// IdP could answer from another account. See PKCEAuthorizationFlowRequest.
+func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool, sessionExtend bool, hint string) (OAuthFlow, error) {
 	var flow OAuthFlow
-	var err error
 
-	err = a.withRetry(ctx, func(client *mgm.GrpcClient) error {
+	err := a.withRetry(ctx, func(client *mgm.GrpcClient) error {
 		if forceDeviceAuth {
-			flow, err = a.getDeviceFlow(client)
-			return err
+			deviceFlow, err := a.getDeviceFlow(client)
+			if err != nil {
+				return err
+			}
+			deviceFlow.SetLoginHint(hint)
+			flow = deviceFlow
+			return nil
 		}
 
 		// Try PKCE flow first
-		flow, err = a.getPKCEFlow(client)
+		pkceFlow, err := a.getPKCEFlow(client, sessionExtend)
 		if err != nil {
 			// If PKCE not supported, try Device flow
 			if s, ok := status.FromError(err); ok && (s.Code() == codes.NotFound || s.Code() == codes.Unimplemented) {
-				flow, err = a.getDeviceFlow(client)
-				return err
+				deviceFlow, err := a.getDeviceFlow(client)
+				if err != nil {
+					return err
+				}
+				deviceFlow.SetLoginHint(hint)
+				flow = deviceFlow
+				return nil
 			}
 			return err
 		}
+		pkceFlow.SetLoginHint(hint)
+		flow = pkceFlow
 		return nil
 	})
 
@@ -184,6 +219,15 @@ func (a *Auth) Login(ctx context.Context, setupKey string, jwtToken string) (err
 			log.Debugf("peer registration required")
 			_, err = a.registerPeer(client, ctx, setupKey, jwtToken, pubSSHKey)
 			if err != nil {
+				// The peer pub-key is already on file with the management
+				// server (originally enrolled via SSO) and the session has
+				// expired. The setup-key path can only enrol new peers, so
+				// retrying with -k will keep failing. Replace the raw mgm
+				// message with an actionable hint that tells the user to
+				// re-authenticate via SSO instead.
+				if setupKey != "" && jwtToken == "" && isPeerLoginExpired(err) {
+					err = errSetupKeyOnSSOExpiredPeer
+				}
 				isAuthError = isPermissionDenied(err)
 				return err
 			}
@@ -200,8 +244,8 @@ func (a *Auth) Login(ctx context.Context, setupKey string, jwtToken string) (err
 }
 
 // getPKCEFlow retrieves PKCE authorization flow configuration and creates a flow instance
-func (a *Auth) getPKCEFlow(client *mgm.GrpcClient) (*PKCEAuthorizationFlow, error) {
-	protoFlow, err := client.GetPKCEAuthorizationFlow()
+func (a *Auth) getPKCEFlow(client *mgm.GrpcClient, sessionExtend bool) (*PKCEAuthorizationFlow, error) {
+	protoFlow, err := client.GetPKCEAuthorizationFlow(sessionExtend)
 	if err != nil {
 		if s, ok := status.FromError(err); ok && s.Code() == codes.NotFound {
 			log.Warnf("server couldn't find pkce flow, contact admin: %v", err)
@@ -322,11 +366,13 @@ func (a *Auth) setSystemInfoFlags(info *system.Info) {
 		a.config.BlockLANAccess,
 		a.config.BlockInbound,
 		a.config.DisableIPv6,
+		a.config.SyncMessageVersion,
 		a.config.EnableSSHRoot,
 		a.config.EnableSSHSFTP,
 		a.config.EnableSSHLocalPortForwarding,
 		a.config.EnableSSHRemotePortForwarding,
 		a.config.DisableSSHAuth,
+		a.config.RemoteJobsAllowed,
 	)
 }
 
@@ -473,3 +519,16 @@ func isLoginNeeded(err error) bool {
 func isRegistrationNeeded(err error) bool {
 	return isPermissionDenied(err)
 }
+
+// isPeerLoginExpired reports whether err is the management server's
+// "peer login has expired" PermissionDenied response. Used by Login to
+// detect the case where the caller passed a setup-key but the peer is
+// actually an SSO-enrolled record whose session needs refreshing — the
+// setup-key path cannot help there.
+func isPeerLoginExpired(err error) bool {
+	if !isPermissionDenied(err) {
+		return false
+	}
+	s, _ := status.FromError(err)
+	return strings.Contains(s.Message(), peerLoginExpiredMsg)
+}
diff --git a/client/internal/auth/auth_test.go b/client/internal/auth/auth_test.go
new file mode 100644
index 000000000..e393beccb
--- /dev/null
+++ b/client/internal/auth/auth_test.go
@@ -0,0 +1,80 @@
+package auth
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func TestIsPeerLoginExpired(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "nil",
+			err:  nil,
+			want: false,
+		},
+		{
+			name: "plain error (not a gRPC status)",
+			err:  errors.New("network read: connection reset"),
+			want: false,
+		},
+		{
+			name: "PermissionDenied with different message",
+			err:  status.Error(codes.PermissionDenied, "user is blocked"),
+			want: false,
+		},
+		{
+			name: "Unauthenticated with the expected phrase",
+			// Wrong status code — must still return false.
+			err:  status.Error(codes.Unauthenticated, "peer login has expired, please log in once more"),
+			want: false,
+		},
+		{
+			name: "exact server message",
+			err:  status.Error(codes.PermissionDenied, "peer login has expired, please log in once more"),
+			want: true,
+		},
+		{
+			name: "phrase as substring",
+			// Future-proofing: if mgm reworords but keeps the phrase,
+			// the friendly fallback must still kick in.
+			err:  status.Error(codes.PermissionDenied, "session refused: peer login has expired (account=foo)"),
+			want: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isPeerLoginExpired(tc.err); got != tc.want {
+				t.Fatalf("isPeerLoginExpired(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestErrSetupKeyOnSSOExpiredPeer(t *testing.T) {
+	// Sentinel must surface as PermissionDenied so the upstream
+	// isPermissionDenied / isAuthError checks classify it correctly
+	// (short-circuit retry backoff, set StatusNeedsLogin).
+	if !isPermissionDenied(errSetupKeyOnSSOExpiredPeer) {
+		t.Fatalf("errSetupKeyOnSSOExpiredPeer must be a PermissionDenied gRPC error")
+	}
+
+	// Message must actually mention SSO and `netbird up` so it is
+	// actionable for the end user. Loose substring checks keep the
+	// test resilient to copy edits.
+	s, _ := status.FromError(errSetupKeyOnSSOExpiredPeer)
+	msg := strings.ToLower(s.Message())
+	for _, want := range []string{"sso", "netbird up"} {
+		if !strings.Contains(msg, want) {
+			t.Errorf("sentinel message should contain %q, got %q", want, s.Message())
+		}
+	}
+}
diff --git a/client/internal/auth/device_flow.go b/client/internal/auth/device_flow.go
index e33765300..c2b8d34b8 100644
--- a/client/internal/auth/device_flow.go
+++ b/client/internal/auth/device_flow.go
@@ -259,12 +259,18 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 	ticker := time.NewTicker(interval)
 	defer ticker.Stop()
 
+	log.Infof("device flow: waiting for user authorization, polling token endpoint every %s, code expires in %s", interval, timeout)
+
+	start := time.Now()
+	polls := 0
+
 	for {
 		select {
 		case <-waitCtx.Done():
 			return TokenInfo{}, waitCtx.Err()
 		case <-ticker.C:
 
+			polls++
 			tokenResponse, err := d.requestToken(info)
 			if err != nil {
 				return TokenInfo{}, fmt.Errorf("parsing token response failed with error: %v", err)
@@ -272,10 +278,12 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 
 			if tokenResponse.Error != "" {
 				if tokenResponse.Error == "authorization_pending" {
+					log.Tracef("device flow: authorization still pending after poll %d", polls)
 					continue
 				} else if tokenResponse.Error == "slow_down" {
 					interval += (3 * time.Second)
 					ticker.Reset(interval)
+					log.Infof("device flow: IdP requested slow_down, polling interval increased to %s", interval)
 					continue
 				}
 
@@ -291,11 +299,25 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 				UseIDToken:   d.providerConfig.UseIDToken,
 			}
 
-			err = isValidAccessToken(tokenInfo.GetTokenToUse(), d.providerConfig.Audience)
+			err = validateTokenAudience(tokenInfo.GetTokenToUse(), d.providerConfig.Audience)
 			if err != nil {
 				return TokenInfo{}, fmt.Errorf("validate access token failed with error: %v", err)
 			}
 
+			// Same as the PKCE flow: the account the token belongs to is what
+			// callers store to send back as the login_hint. Without it a client
+			// driven through the device flow — Android TV and tvOS — never binds
+			// an account to its profile and every later login goes out blind.
+			if email, fromEmailClaim, err := parseEmailFromIDToken(tokenInfo.IDToken); err != nil {
+				log.Warnf("failed to parse email from ID token: %v", err)
+			} else {
+				tokenInfo.Email = email
+				if fromEmailClaim {
+					tokenInfo.EmailClaim = email
+				}
+			}
+
+			log.Infof("device flow: user authorization confirmed after %d polls in %s", polls, time.Since(start).Round(time.Second))
 			return tokenInfo, err
 		}
 	}
diff --git a/client/internal/auth/oauth.go b/client/internal/auth/oauth.go
index a50a2ce6f..54ecb5d86 100644
--- a/client/internal/auth/oauth.go
+++ b/client/internal/auth/oauth.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"runtime"
+	"strings"
 
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc/codes"
@@ -25,6 +26,14 @@ type HTTPClient interface {
 	Do(req *http.Request) (*http.Response, error)
 }
 
+// accountPromptForcer is implemented by the PKCE flow only. The device code
+// flow has no equivalent: RFC 8628 defines no prompt parameter, and the user
+// confirms the code on a page that shows which account signs in, so a silent
+// wrong-account answer is not the failure mode there.
+type accountPromptForcer interface {
+	ForceAccountPrompt()
+}
+
 // AuthFlowInfo holds information for the OAuth 2.0  authorization flow
 type AuthFlowInfo struct { //nolint:revive
 	DeviceCode              string `json:"device_code"`
@@ -49,6 +58,23 @@ type TokenInfo struct {
 	ExpiresIn    int    `json:"expires_in"`
 	UseIDToken   bool   `json:"-"`
 	Email        string `json:"-"`
+	EmailClaim   string `json:"-"`
+}
+
+// MatchesAccount reports whether the token belongs to the account a profile is
+// bound to. A hint the IdP could not have acted on — no hint stored, or a token
+// that carried no email claim — is reported as a match: the check exists to catch a
+// login answered from the wrong account, not to block one it cannot judge.
+//
+// The comparison is case-insensitive. Local-parts are case-sensitive per RFC
+// 5321, but no IdP in practice issues two accounts differing only in case, and
+// an IdP that echoes a differently-cased address would otherwise fail every
+// login.
+func (t TokenInfo) MatchesAccount(hint string) bool {
+	if hint == "" || t.EmailClaim == "" {
+		return true
+	}
+	return strings.EqualFold(t.EmailClaim, hint)
 }
 
 // GetTokenToUse returns either the access or id token based on UseIDToken field
@@ -63,19 +89,22 @@ func shouldUseDeviceFlow(force bool, isUnixDesktopClient bool) bool {
 	return force || (runtime.GOOS == "linux" || runtime.GOOS == "freebsd") && !isUnixDesktopClient
 }
 
-// NewOAuthFlow initializes and returns the appropriate OAuth flow based on the management configuration
+// NewOAuthFlow initializes and returns the appropriate OAuth flow based on the management configuration.
 //
 // It starts by initializing the PKCE.If this process fails, it resorts to the Device Code Flow,
 // and if that also fails, the authentication process is deemed unsuccessful
 //
-// On Linux distros without desktop environment support, it only tries to initialize the Device Code Flow
-// forceDeviceCodeFlow can be used to skip PKCE and go directly to Device Code Flow (e.g., for Android TV)
-func NewOAuthFlow(ctx context.Context, config *profilemanager.Config, isUnixDesktopClient bool, forceDeviceCodeFlow bool, hint string) (OAuthFlow, error) {
+// On Linux distros without desktop environment support, it only tries to initialize the Device Code Flow.
+// forceDeviceCodeFlow can be used to skip PKCE and go directly to Device Code Flow (e.g., for Android TV).
+//
+// sessionExtend marks the flow as renewing an existing peer's session rather than
+// logging one in. See PKCEAuthorizationFlowRequest for what the server makes of it.
+func NewOAuthFlow(ctx context.Context, config *profilemanager.Config, isUnixDesktopClient bool, forceDeviceCodeFlow bool, hint string, sessionExtend bool) (OAuthFlow, error) {
 	if shouldUseDeviceFlow(forceDeviceCodeFlow, isUnixDesktopClient) {
 		return authenticateWithDeviceCodeFlow(ctx, config, hint)
 	}
 
-	pkceFlow, err := authenticateWithPKCEFlow(ctx, config, hint)
+	pkceFlow, err := authenticateWithPKCEFlow(ctx, config, hint, sessionExtend)
 	if err != nil {
 		log.Debugf("failed to initialize pkce authentication with error: %v\n", err)
 		log.Debug("falling back to device code flow")
@@ -85,21 +114,19 @@ func NewOAuthFlow(ctx context.Context, config *profilemanager.Config, isUnixDesk
 }
 
 // authenticateWithPKCEFlow initializes the Proof Key for Code Exchange flow auth flow
-func authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {
+func authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config, hint string, sessionExtend bool) (OAuthFlow, error) {
 	authClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create auth client: %v", err)
 	}
 	defer authClient.Close()
 
-	pkceFlowInfo, err := authClient.getPKCEFlow(authClient.client)
+	pkceFlowInfo, err := authClient.getPKCEFlow(authClient.client, sessionExtend)
 	if err != nil {
 		return nil, fmt.Errorf("getting pkce authorization flow info failed with error: %v", err)
 	}
 
-	if hint != "" {
-		pkceFlowInfo.SetLoginHint(hint)
-	}
+	pkceFlowInfo.SetLoginHint(hint)
 
 	return pkceFlowInfo, nil
 }
@@ -127,9 +154,25 @@ func authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.
 		}
 	}
 
-	if hint != "" {
-		deviceFlowInfo.SetLoginHint(hint)
-	}
+	deviceFlowInfo.SetLoginHint(hint)
 
 	return deviceFlowInfo, nil
 }
+
+// RetryFlowForAccount returns a flow that asks the IdP to re-authenticate, for
+// a login answered with an account other than the one hinted. Returns nil when
+// the flow cannot ask — the caller then proceeds with the token it has.
+//
+// Proceeding rather than failing is deliberate. The hint is an email that may
+// simply have changed since it was stored, and refusing the login would lock a
+// user out of their own profile over a rename. The retry gives the account a
+// chance to be corrected; the server still rejects a token that does not own
+// the peer.
+func RetryFlowForAccount(flow OAuthFlow) OAuthFlow {
+	forcer, ok := flow.(accountPromptForcer)
+	if !ok {
+		return nil
+	}
+	forcer.ForceAccountPrompt()
+	return flow
+}
diff --git a/client/internal/auth/pending_flow.go b/client/internal/auth/pending_flow.go
new file mode 100644
index 000000000..daeb18bc2
--- /dev/null
+++ b/client/internal/auth/pending_flow.go
@@ -0,0 +1,89 @@
+package auth
+
+import (
+	"context"
+	"sync"
+	"time"
+)
+
+// PendingFlow stores an in-progress OAuth flow between the RPC that
+// initiates it (returns the verification URI to the UI) and the RPC
+// that waits for the user to complete it. The flow handle, the
+// device-code info, and the absolute expiry are kept together so the
+// waiting RPC can validate the device code and reuse the same flow.
+//
+// PendingFlow is safe for concurrent use; callers must not access the
+// stored fields directly.
+type PendingFlow struct {
+	mu         sync.Mutex
+	flow       OAuthFlow
+	info       AuthFlowInfo
+	expiresAt  time.Time
+	waitCancel context.CancelFunc
+}
+
+// NewPendingFlow returns an empty PendingFlow ready to be populated by Set.
+func NewPendingFlow() *PendingFlow {
+	return &PendingFlow{}
+}
+
+// Set stores the flow and its authorization info, computing the absolute
+// expiry from info.ExpiresIn (seconds, as returned by the IdP).
+func (p *PendingFlow) Set(flow OAuthFlow, info AuthFlowInfo) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.flow = flow
+	p.info = info
+	p.expiresAt = time.Now().Add(time.Duration(info.ExpiresIn) * time.Second)
+}
+
+// Get returns the stored flow, info, and whether a flow is currently
+// pending. Returns (nil, zero, false) after Clear or before Set.
+func (p *PendingFlow) Get() (OAuthFlow, AuthFlowInfo, bool) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.flow == nil {
+		return nil, AuthFlowInfo{}, false
+	}
+	return p.flow, p.info, true
+}
+
+// ExpiresAt returns the absolute expiry of the pending flow. Returns
+// the zero time when no flow is pending.
+func (p *PendingFlow) ExpiresAt() time.Time {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.expiresAt
+}
+
+// SetWaitCancel records the cancel function for the goroutine currently
+// blocked in WaitToken so a new RequestAuth can preempt it.
+func (p *PendingFlow) SetWaitCancel(cancel context.CancelFunc) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.waitCancel = cancel
+}
+
+// CancelWait invokes and clears the stored wait-cancel, if any. Safe to
+// call when no wait is in progress.
+func (p *PendingFlow) CancelWait() {
+	p.mu.Lock()
+	cancel := p.waitCancel
+	p.waitCancel = nil
+	p.mu.Unlock()
+	if cancel != nil {
+		cancel()
+	}
+}
+
+// Clear resets the pending flow to empty. Any stored wait-cancel is
+// dropped without being invoked — call CancelWait first if the waiting
+// goroutine must be stopped.
+func (p *PendingFlow) Clear() {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.flow = nil
+	p.info = AuthFlowInfo{}
+	p.expiresAt = time.Time{}
+	p.waitCancel = nil
+}
diff --git a/client/internal/auth/pkce_flow.go b/client/internal/auth/pkce_flow.go
index 84fa8a214..ebb0d4f1f 100644
--- a/client/internal/auth/pkce_flow.go
+++ b/client/internal/auth/pkce_flow.go
@@ -87,10 +87,11 @@ func validatePKCEConfig(config *PKCEAuthProviderConfig) error {
 // PKCEAuthorizationFlow implements the OAuthFlow interface for
 // the Authorization Code Flow with PKCE.
 type PKCEAuthorizationFlow struct {
-	providerConfig PKCEAuthProviderConfig
-	state          string
-	codeVerifier   string
-	oAuthConfig    *oauth2.Config
+	providerConfig     PKCEAuthProviderConfig
+	state              string
+	codeVerifier       string
+	oAuthConfig        *oauth2.Config
+	forceAccountPrompt bool
 }
 
 // NewPKCEAuthorizationFlow returns new PKCE authorization code flow.
@@ -153,11 +154,16 @@ func (p *PKCEAuthorizationFlow) RequestAuthInfo(ctx context.Context) (AuthFlowIn
 		oauth2.SetAuthURLParam("code_challenge", codeChallenge),
 		oauth2.SetAuthURLParam("audience", p.providerConfig.Audience),
 	}
+	forceAccountPrompt := p.forceAccountPrompt
+	p.forceAccountPrompt = false
+
 	if !p.providerConfig.DisablePromptLogin {
-		switch p.providerConfig.LoginFlag {
-		case common.LoginFlagPromptLogin:
+		switch {
+		case forceAccountPrompt:
 			params = append(params, oauth2.SetAuthURLParam("prompt", "login"))
-		case common.LoginFlagMaxAge0:
+		case p.providerConfig.LoginFlag == common.LoginFlagPromptLogin:
+			params = append(params, oauth2.SetAuthURLParam("prompt", "login"))
+		case p.providerConfig.LoginFlag == common.LoginFlagMaxAge0:
 			params = append(params, oauth2.SetAuthURLParam("max_age", "0"))
 		}
 	}
@@ -178,6 +184,20 @@ func (p *PKCEAuthorizationFlow) SetLoginHint(hint string) {
 	p.providerConfig.LoginHint = hint
 }
 
+// ForceAccountPrompt makes the next authorization request ask the IdP to
+// re-authenticate instead of answering from the session it already holds. Used
+// to retry a login that came back for an account other than the one hinted.
+//
+// The next RequestAuthInfo consumes the flag, so a flow that outlives its retry
+// goes back to the configured behaviour instead of re-authenticating forever.
+//
+// DisablePromptLogin still wins: it is set for IdPs that break on prompt=login,
+// where retrying with it would replace a wrong-account login with one that
+// cannot complete at all.
+func (p *PKCEAuthorizationFlow) ForceAccountPrompt() {
+	p.forceAccountPrompt = true
+}
+
 // WaitToken waits for the OAuth token in the PKCE Authorization Flow.
 // It starts an HTTP server to receive the OAuth token callback and waits for the token or an error.
 // Once the token is received, it is converted to TokenInfo and validated before returning.
@@ -188,6 +208,8 @@ func (p *PKCEAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowInfo
 	waitCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
+	log.Infof("pkce flow: waiting for authorization callback on %s, timeout %s", p.oAuthConfig.RedirectURL, timeout)
+
 	tokenChan := make(chan *oauth2.Token, 1)
 	errChan := make(chan error, 1)
 
@@ -221,6 +243,7 @@ func (p *PKCEAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowInfo
 func (p *PKCEAuthorizationFlow) startServer(server *http.Server, tokenChan chan<- *oauth2.Token, errChan chan<- error) {
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
+		log.Infof("pkce flow: received authorization callback from IdP")
 		cert := p.providerConfig.ClientCertPair
 		if cert != nil {
 			tr := &http.Transport{
@@ -271,11 +294,18 @@ func (p *PKCEAuthorizationFlow) handleRequest(req *http.Request) (*oauth2.Token,
 		return nil, fmt.Errorf("authentication failed: missing code")
 	}
 
-	return p.oAuthConfig.Exchange(
+	exchangeStart := time.Now()
+	token, err := p.oAuthConfig.Exchange(
 		req.Context(),
 		code,
 		oauth2.SetAuthURLParam("code_verifier", p.codeVerifier),
 	)
+	if err != nil {
+		return nil, err
+	}
+
+	log.Infof("pkce flow: authorization code exchanged for token in %s", time.Since(exchangeStart).Round(time.Millisecond))
+	return token, nil
 }
 
 func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo, error) {
@@ -296,48 +326,52 @@ func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo,
 		audience = p.providerConfig.ClientID
 	}
 
-	if err := isValidAccessToken(tokenInfo.GetTokenToUse(), audience); err != nil {
+	if err := validateTokenAudience(tokenInfo.GetTokenToUse(), audience); err != nil {
 		return TokenInfo{}, fmt.Errorf("authentication failed: invalid access token - %w", err)
 	}
 
-	email, err := parseEmailFromIDToken(tokenInfo.IDToken)
+	email, fromEmailClaim, err := parseEmailFromIDToken(tokenInfo.IDToken)
 	if err != nil {
 		log.Warnf("failed to parse email from ID token: %v", err)
 	} else {
 		tokenInfo.Email = email
+		if fromEmailClaim {
+			tokenInfo.EmailClaim = email
+		}
 	}
 
 	return tokenInfo, nil
 }
 
-func parseEmailFromIDToken(token string) (string, error) {
+// parseEmailFromIDToken extracts the email (or name) claim from an ID token
+// without verifying its signature. The value is best-effort: it prefills the
+// login hint and is displayed. Account matching (see MatchesAccount) only uses
+// it when it came from the email claim, which fromEmailClaim reports. It never
+// grants anything — the authoritative identity is established server-side from
+// the signature-verified token.
+func parseEmailFromIDToken(token string) (value string, fromEmailClaim bool, err error) {
 	parts := strings.Split(token, ".")
 	if len(parts) < 2 {
-		return "", fmt.Errorf("invalid token format")
+		return "", false, fmt.Errorf("invalid token format")
 	}
 
 	data, err := base64.RawURLEncoding.DecodeString(parts[1])
 	if err != nil {
-		return "", fmt.Errorf("failed to decode payload: %w", err)
+		return "", false, fmt.Errorf("failed to decode payload: %w", err)
 	}
 	var claims map[string]interface{}
 	if err := json.Unmarshal(data, &claims); err != nil {
-		return "", fmt.Errorf("json unmarshal error: %w", err)
+		return "", false, fmt.Errorf("json unmarshal error: %w", err)
 	}
 
-	var email string
-	if emailValue, ok := claims["email"].(string); ok {
-		email = emailValue
-	} else {
-		val, ok := claims["name"].(string)
-		if ok {
-			email = val
-		} else {
-			return "", fmt.Errorf("email or name field not found in token payload")
-		}
+	if email, ok := claims["email"].(string); ok {
+		return email, true, nil
+	}
+	if name, ok := claims["name"].(string); ok {
+		return name, false, nil
 	}
 
-	return email, nil
+	return "", false, fmt.Errorf("email or name field not found in token payload")
 }
 
 func createCodeChallenge(codeVerifier string) string {
diff --git a/client/internal/auth/pkce_flow_test.go b/client/internal/auth/pkce_flow_test.go
index c487c13df..ccbca10e9 100644
--- a/client/internal/auth/pkce_flow_test.go
+++ b/client/internal/auth/pkce_flow_test.go
@@ -76,6 +76,32 @@ func TestPromptLogin(t *testing.T) {
 	}
 }
 
+func TestForceAccountPromptAppliesOnlyToTheRetry(t *testing.T) {
+	config := PKCEAuthProviderConfig{
+		ClientID:              "test-client-id",
+		Audience:              "test-audience",
+		TokenEndpoint:         "https://test-token-endpoint.com/token",
+		Scope:                 "openid email profile",
+		AuthorizationEndpoint: "https://test-auth-endpoint.com/authorize",
+		RedirectURLs:          []string{"http://127.0.0.1:33992/"},
+		UseIDToken:            true,
+		LoginFlag:             mgm.LoginFlagNone,
+	}
+	pkce, err := NewPKCEAuthorizationFlow(config)
+	require.NoError(t, err)
+
+	pkce.ForceAccountPrompt()
+
+	retry, err := pkce.RequestAuthInfo(context.Background())
+	require.NoError(t, err)
+	require.Contains(t, retry.VerificationURIComplete, "prompt=login")
+
+	next, err := pkce.RequestAuthInfo(context.Background())
+	require.NoError(t, err)
+	require.NotContains(t, next.VerificationURIComplete, "prompt=login",
+		"the forced prompt outlived the retry it was armed for")
+}
+
 func TestIsPortInExcludedRange(t *testing.T) {
 	tests := []struct {
 		name            string
diff --git a/client/internal/auth/sessionwatch/event.go b/client/internal/auth/sessionwatch/event.go
new file mode 100644
index 000000000..3e55b26dd
--- /dev/null
+++ b/client/internal/auth/sessionwatch/event.go
@@ -0,0 +1,82 @@
+package sessionwatch
+
+import (
+	"strconv"
+	"time"
+)
+
+// internal event kinds are no longer exposed: the watcher drives the Sink
+// directly (NotifyStateChange on deadline change/clear, PublishEvent at
+// each warning lead). Tests use a mock Sink to observe what the watcher
+// emits.
+
+// Metadata keys attached by the daemon to session-warning SystemEvents.
+// The UI tray reads these to build a locale-aware notification without
+// relying on the daemon's locale-less UserMessage string, and to
+// disambiguate the T-WarningLead notification from the T-FinalWarningLead
+// fallback that auto-opens the SessionAboutToExpire dialog.
+const (
+	// MetaSessionWarning is set to "true" on both warning events (T-10 and
+	// T-2) so the UI can detect a session-warning SystemEvent without
+	// matching on the message text. Use MetaSessionFinal to distinguish
+	// the two.
+	MetaSessionWarning = "session_warning"
+	// MetaSessionFinal is set to "true" on the T-FinalWarningLead event
+	// only. Consumers that need to auto-open the SessionAboutToExpire
+	// dialog gate on this; T-WarningLead events leave the field unset.
+	MetaSessionFinal = "session_final_warning"
+	// MetaSessionExpiresAt carries the absolute UTC deadline encoded with
+	// FormatExpiresAt; consumers must decode with ParseExpiresAt so a
+	// future format change stays a single edit.
+	MetaSessionExpiresAt = "session_expires_at"
+	// MetaSessionLeadMinutes carries the lead in whole minutes (WarningLead
+	// for the T-10 event, FinalWarningLead for the T-2 event) so the UI
+	// can show "expires in ~N minutes" without hardcoding either constant.
+	MetaSessionLeadMinutes = "lead_minutes"
+	// MetaSessionDeadlineRejected is attached to the ERROR/AUTHENTICATION
+	// SystemEvent the daemon emits when it discards a deadline from the
+	// management server (pre-epoch, too far in the future, or past the
+	// clock-skew tolerance). The value is the rejection reason string.
+	// userMessage is left empty; the UI detects the event via this key
+	// and builds a localized notification — same pattern as the session
+	// warnings above.
+	MetaSessionDeadlineRejected = "session_deadline_rejected"
+)
+
+// expiresAtLayout is the wire format used for MetaSessionExpiresAt.
+// Producer and consumers both go through FormatExpiresAt/ParseExpiresAt
+// so this layout stays a single source of truth.
+const expiresAtLayout = time.RFC3339
+
+// FormatExpiresAt encodes a deadline for MetaSessionExpiresAt. Always
+// emits UTC so a consumer in another timezone reads the same wall-clock
+// deadline.
+func FormatExpiresAt(t time.Time) string {
+	return t.UTC().Format(expiresAtLayout)
+}
+
+// ParseExpiresAt decodes the MetaSessionExpiresAt value back to a UTC
+// time. Returns an error when the field is empty or malformed; the
+// caller decides whether to fall back (zero value) or propagate.
+func ParseExpiresAt(s string) (time.Time, error) {
+	t, err := time.Parse(expiresAtLayout, s)
+	if err != nil {
+		return time.Time{}, err
+	}
+	return t.UTC(), nil
+}
+
+// FormatLeadMinutes encodes a lead duration for MetaSessionLeadMinutes
+// as the integer count of whole minutes. Sub-minute residuals are
+// truncated — the field is informational ("expires in ~N minutes") and
+// fractional minutes don't change what the UI displays.
+func FormatLeadMinutes(d time.Duration) string {
+	return strconv.Itoa(int(d / time.Minute))
+}
+
+// ParseLeadMinutes decodes a MetaSessionLeadMinutes value. Returns 0
+// and the parse error for malformed input; consumers that prefer a
+// silent fallback can simply ignore the error.
+func ParseLeadMinutes(s string) (int, error) {
+	return strconv.Atoi(s)
+}
diff --git a/client/internal/auth/sessionwatch/watcher.go b/client/internal/auth/sessionwatch/watcher.go
new file mode 100644
index 000000000..f71689df1
--- /dev/null
+++ b/client/internal/auth/sessionwatch/watcher.go
@@ -0,0 +1,487 @@
+// Package sessionwatch tracks the SSO session expiry deadline that the
+// management server publishes via LoginResponse / SyncResponse and fires
+// two warning events at fixed lead times before expiry: an interactive
+// T-WarningLead notification and a dismiss-gated T-FinalWarningLead
+// fallback dialog.
+//
+// The deadline is an absolute wall-clock instant, so the watcher compares
+// it against the wall clock on a ticker rather than arming a relative
+// timer for it. A relative timer runs on the monotonic clock, which does
+// not advance while a device is suspended: it fires once that much awake
+// time has passed, which can be long after the deadline, and nothing
+// re-evaluates when the device wakes up. Polling makes every tick after a
+// resume (or after an NTP correction) see the real remaining time.
+//
+// The watcher is idempotent: Update may be called as often as the network
+// map snapshots arrive. Repeating the same deadline is a no-op; a new
+// deadline starts a fresh warning cycle.
+//
+// Warning firing is edge-detected. Each unique deadline value publishes
+// each warning at most once.
+package sessionwatch
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	cProto "github.com/netbirdio/netbird/client/proto"
+)
+
+const (
+	maxPastHorizon = 30 * 24 * time.Hour
+
+	// maxDeadlineHorizon caps how far in the future an accepted deadline
+	// can sit. A timestamp beyond this is almost certainly a protocol
+	// glitch, and silently tracking a 100-year deadline would hide the bug.
+	maxDeadlineHorizon = 10 * 365 * 24 * time.Hour
+
+	// defaultEvalInterval is how often the tracked deadline is compared
+	// against the wall clock. The leads are minutes, so a coarse tick costs
+	// nothing in accuracy and keeps the wakeup cheap on battery-powered
+	// devices.
+	defaultEvalInterval = 10 * time.Second
+
+	// WarningLead is how far before expiry the first (interactive)
+	// warning fires. Drives the T-10 OS notification with
+	// Extend/Dismiss actions.
+	WarningLead = 10 * time.Minute
+
+	// FinalWarningLead is how far before expiry the fallback final
+	// warning fires. Drives the auto-opened SessionAboutToExpire dialog,
+	// but only when the user has not dismissed the T-WarningLead warning
+	// for the same deadline. Must be strictly less than WarningLead.
+	FinalWarningLead = 2 * time.Minute
+)
+
+var (
+	// ErrDeadlineBeforeEpoch is returned by Update when the supplied
+	// deadline pre-dates 1970-01-01.
+	ErrDeadlineBeforeEpoch = errors.New("session deadline before unix epoch")
+
+	// ErrDeadlineTooFarFuture is returned by Update when the supplied
+	// deadline is more than maxDeadlineHorizon in the future.
+	ErrDeadlineTooFarFuture = errors.New("session deadline too far in the future")
+
+	// ErrDeadlineInPast is returned by Update when the supplied deadline
+	// is more than maxPastHorizon in the past.
+	ErrDeadlineInPast = errors.New("session deadline in the past")
+)
+
+// StatusRecorder is the side-effect surface the watcher drives on every
+// state transition. Production wires this to peer.Status (SetSessionExpiresAt
+// for deadline change/clear, PublishEvent for the two warnings); tests pass
+// a fake recorder so the same surface is observable without an engine.
+//
+// While the watcher runs, it owns the deadline propagated to the recorder:
+// every set, clear and sanity-check rejection routes the value through
+// SetSessionExpiresAt, so the SubscribeStatus snapshot the UI reads can
+// never drift from the watcher's timer state. (SetSessionExpiresAt fans
+// out its own state-change notification, so no separate notify is needed.)
+// The recorder is server-scoped and outlives this engine-scoped watcher;
+// Close deliberately leaves the recorder value in place so transient engine
+// restarts don't blank it — the client run loop clears it on real teardown.
+//
+// PublishEvent's signature mirrors peer.Status.PublishEvent: the watcher
+// composes the metadata internally so the wire format (MetaSession*) is
+// owned by sessionwatch, not the caller.
+type StatusRecorder interface {
+	SetSessionExpiresAt(deadline time.Time)
+	PublishEvent(
+		severity cProto.SystemEvent_Severity,
+		category cProto.SystemEvent_Category,
+		message string,
+		userMessage string,
+		metadata map[string]string,
+	)
+}
+
+// Watcher observes the latest session deadline and fires two warnings
+// before it expires: the interactive T-WarningLead notification, and the
+// fallback T-FinalWarningLead dialog (suppressed when the user dismissed
+// the first one for the same deadline). Safe for concurrent use.
+type Watcher struct {
+	lead         time.Duration
+	finalLead    time.Duration
+	interval     time.Duration
+	deadlineOnly bool // record the deadline, leave the warnings to the caller
+
+	mu           sync.Mutex
+	current      time.Time
+	firedAt      time.Time // deadline value the T-WarningLead warning last published for
+	finalFiredAt time.Time // deadline value the T-FinalWarningLead warning last published for
+	dismissedAt  time.Time // deadline value the user dismissed via Dismiss(); gates the final warning
+	announcedAt  time.Time // deadline value the recorder has been told about; gates publishing
+	closed       bool
+	recorder     StatusRecorder
+	nowFn        func() time.Time
+	stop         chan struct{} // closed to stop the evaluation loop; nil while it is not running
+	done         chan struct{} // closed by the loop on its way out
+	wake         chan struct{} // buffered nudge asking the loop to evaluate before its next tick
+}
+
+// New returns a watcher with the package defaults WarningLead and
+// FinalWarningLead. Pass nil for recorder to silence side effects (handy
+// in unit tests that exercise sanity checks without observing the publish
+// path).
+func New(recorder StatusRecorder) *Watcher {
+	return NewWithLeads(WarningLead, FinalWarningLead, recorder)
+}
+
+// NewWithLeads returns a watcher with custom lead times. Useful for tests.
+// final must be strictly less than lead; otherwise the final warning takes
+// over the whole warning window and the interactive notification never
+// shows. A zero final lead disables the final warning entirely (see
+// evaluate), leaving the interactive one as the only warning.
+func NewWithLeads(lead, final time.Duration, recorder StatusRecorder) *Watcher {
+	return &Watcher{
+		lead:      lead,
+		finalLead: final,
+		interval:  defaultEvalInterval,
+		recorder:  recorder,
+		nowFn:     time.Now,
+	}
+}
+
+// NewDeadlineOnly returns a watcher that validates and records deadlines
+// but publishes no warnings about them, and runs no evaluation loop to
+// decide. Used where the deadline is handed on to something that schedules
+// the warnings itself, such as the Android app.
+func NewDeadlineOnly(recorder StatusRecorder) *Watcher {
+	w := New(recorder)
+	w.deadlineOnly = true
+	return w
+}
+
+// Update sets the latest deadline. Pass the zero time to clear (e.g. when
+// a Sync push from the server omits the field because login expiration
+// was disabled).
+//
+// Same-value updates are no-ops. A different non-zero value resets the
+// "already fired" guards and starts a fresh warning cycle, evaluated
+// immediately so a deadline that already sits inside a warning window
+// warns without waiting for the next tick. A deadline already in the past
+// (within maxPastHorizon) is recorded as-is and warns nothing: the session
+// has expired and consumers render it that way.
+//
+// Returns one of the sentinel Err* values when the deadline fails the
+// sanity checks (pre-epoch, far future, or past beyond maxPastHorizon).
+// In every error case the watcher first clears its state so it stays
+// consistent with what the caller will push into its other sinks (e.g.
+// applySessionDeadline forces a zero deadline into the status recorder
+// after a non-nil error).
+func (w *Watcher) Update(deadline time.Time) error {
+	w.mu.Lock()
+	if w.closed {
+		w.mu.Unlock()
+		return nil
+	}
+
+	if deadline.IsZero() {
+		w.clearLocked()
+		return nil
+	}
+
+	now := w.nowFn()
+	switch {
+	case deadline.Before(time.Unix(0, 0)):
+		w.clearLocked()
+		return fmt.Errorf("%w: %v", ErrDeadlineBeforeEpoch, deadline)
+	case deadline.After(now.Add(maxDeadlineHorizon)):
+		w.clearLocked()
+		return fmt.Errorf("%w: %v", ErrDeadlineTooFarFuture, deadline)
+	case deadline.Before(now.Add(-maxPastHorizon)):
+		w.clearLocked()
+		return fmt.Errorf("%w: %v (now=%v)", ErrDeadlineInPast, deadline, now)
+	}
+
+	if deadline.Equal(w.current) {
+		w.mu.Unlock()
+		return nil
+	}
+
+	w.current = deadline
+	// Reset every per-deadline guard so a refreshed deadline starts a fresh
+	// warning cycle: both edge triggers and the user Dismiss decision
+	// (the user agreed to the old deadline expiring; a new deadline
+	// restarts the contract).
+	w.firedAt = time.Time{}
+	w.finalFiredAt = time.Time{}
+	w.dismissedAt = time.Time{}
+	w.announcedAt = time.Time{}
+
+	// Poll every accepted deadline, including one that reads as already
+	// expired: the clock may be running ahead of real time and get
+	// corrected later, and evaluate ignores a deadline that has genuinely
+	// passed anyway.
+	if !w.deadlineOnly {
+		w.startPollLocked()
+	}
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder != nil {
+		recorder.SetSessionExpiresAt(deadline)
+	}
+	log.Infof("auth session deadline set to: %s (in %s)", deadline.Format(time.RFC3339), time.Until(deadline).Round(time.Second))
+
+	// Open the gate only once the recorder knows the new deadline, so a
+	// warning that refers to it can never reach consumers before the state
+	// change itself. A tick landing in between finds the gate shut.
+	w.mu.Lock()
+	if w.closed || !w.current.Equal(deadline) {
+		w.mu.Unlock()
+		return nil
+	}
+	w.announcedAt = deadline
+	wake := w.wake
+	w.mu.Unlock()
+
+	// Hand the evaluation to the loop rather than running it here, so a
+	// deadline that already sits inside a warning window is published at
+	// once without this goroutine ever touching the recorder.
+	if wake != nil {
+		select {
+		case wake <- struct{}{}:
+		default:
+		}
+	}
+	return nil
+}
+
+// Deadline returns the most recently observed deadline. Zero when no
+// deadline is currently tracked.
+func (w *Watcher) Deadline() time.Time {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return w.current
+}
+
+// Dismiss records the user's "Dismiss" action against the current deadline
+// and suppresses the final warning for that deadline. Idempotent: repeated
+// calls are no-ops. A subsequent Update with a fresh deadline resets the
+// dismissal so the final-warning cycle starts over.
+//
+// No-op when the watcher holds no deadline or has been closed.
+func (w *Watcher) Dismiss() {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.closed || w.current.IsZero() {
+		return
+	}
+	if w.dismissedAt.Equal(w.current) {
+		return
+	}
+	w.dismissedAt = w.current
+	log.Infof("auth session final-warning dismissed for deadline %s", w.current.Format(time.RFC3339))
+}
+
+// Close stops the evaluation loop and waits for it to exit. Update calls
+// after Close are ignored. The recorder keeps its deadline: the watcher is
+// engine-scoped and closes on every engine restart (network change,
+// sleep/wake, stream errors) while the SSO deadline stays valid across
+// those, so clearing here would blank the UI's "expires in" row on every
+// transient reconnect. The client run loop clears the server-scoped
+// recorder when it exits for real (Down, profile switch, permanent login
+// failure).
+func (w *Watcher) Close() {
+	w.mu.Lock()
+	if w.closed {
+		// A concurrent Close is already tearing down. w.done outlives it,
+		// so this caller waits for the same loop rather than returning
+		// while a warning is still on its way to the recorder.
+		done := w.done
+		w.mu.Unlock()
+		if done != nil {
+			<-done
+		}
+		return
+	}
+	w.closed = true
+	w.current = time.Time{}
+	w.firedAt = time.Time{}
+	w.finalFiredAt = time.Time{}
+	w.dismissedAt = time.Time{}
+	w.announcedAt = time.Time{}
+	// Copy the channels out before releasing the lock: the loop takes w.mu
+	// on every tick, so waiting for it while holding the lock would
+	// deadlock. w.done stays on the receiver for the branch above.
+	stop, done := w.stop, w.done
+	w.stop, w.wake = nil, nil
+	w.mu.Unlock()
+
+	if stop == nil {
+		return
+	}
+	close(stop)
+	<-done
+}
+
+// clearLocked drops the tracked deadline and notifies the recorder so
+// downstream consumers (SubscribeStatus stream, UI) drop their anchor.
+// The caller must hold w.mu; this helper releases it before invoking
+// the recorder.
+func (w *Watcher) clearLocked() {
+	if w.current.IsZero() {
+		w.mu.Unlock()
+		return
+	}
+	w.current = time.Time{}
+	w.firedAt = time.Time{}
+	w.finalFiredAt = time.Time{}
+	w.dismissedAt = time.Time{}
+	w.announcedAt = time.Time{}
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder != nil {
+		recorder.SetSessionExpiresAt(time.Time{})
+	}
+	log.Infof("auth session deadline cleared")
+}
+
+// startPollLocked starts the evaluation loop unless it is already
+// running. The loop starts lazily on the first accepted deadline, so a
+// client whose server never publishes a session expiry never pays for a
+// ticker, and it runs until Close: the watcher is engine-scoped, and a
+// cleared deadline is normally followed by a fresh one on the next sync.
+// Caller must hold w.mu.
+func (w *Watcher) startPollLocked() {
+	if w.stop != nil {
+		return
+	}
+	stop := make(chan struct{})
+	done := make(chan struct{})
+	wake := make(chan struct{}, 1)
+	w.stop, w.done, w.wake = stop, done, wake
+	go w.poll(stop, done, wake, w.interval)
+}
+
+// poll re-evaluates the tracked deadline every interval, and as soon as a
+// new deadline is announced. It is the only caller of evaluate, so Close
+// waiting for it to exit is enough to know no warning is still on its way
+// to the recorder. Its channels and interval are passed in rather than
+// read off the receiver, so Close can clear them without racing it.
+func (w *Watcher) poll(stop <-chan struct{}, done chan<- struct{}, wake <-chan struct{}, interval time.Duration) {
+	defer close(done)
+
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-stop:
+			return
+		case <-wake:
+			w.evaluate()
+		case <-ticker.C:
+			w.evaluate()
+		}
+	}
+}
+
+// evaluate compares the tracked deadline against the wall clock and
+// publishes whichever warning the remaining time calls for. Inside the
+// final-warning window the interactive warning is stale, so the final one
+// is published in its place: a device that resumes there never saw the
+// T-WarningLead notification.
+func (w *Watcher) evaluate() {
+	w.mu.Lock()
+	if w.closed || w.deadlineOnly || w.current.IsZero() {
+		w.mu.Unlock()
+		return
+	}
+
+	deadline := w.current
+	if !w.announcedAt.Equal(deadline) {
+		// Update is still on its way to the recorder with this deadline.
+		w.mu.Unlock()
+		return
+	}
+	// Round(0) strips the monotonic reading so the comparison is wall
+	// clock on both sides, whether the deadline came off the wire or from
+	// a caller that derived it from time.Now.
+	remaining := deadline.Round(0).Sub(w.nowFn().Round(0))
+
+	switch {
+	case remaining <= 0:
+		// Already expired: the post-mortem SessionExpired flow owns it.
+		w.mu.Unlock()
+	case w.finalLead > 0 && remaining <= w.finalLead:
+		w.publishFinalLocked(deadline, remaining)
+	case remaining <= w.lead:
+		w.publishWarningLocked(deadline, remaining)
+	default:
+		w.mu.Unlock()
+	}
+}
+
+// publishWarningLocked emits the interactive T-WarningLead warning, at
+// most once per deadline value. Caller must hold w.mu; this helper
+// releases it.
+func (w *Watcher) publishWarningLocked(deadline time.Time, remaining time.Duration) {
+	if w.firedAt.Equal(deadline) {
+		w.mu.Unlock()
+		return
+	}
+	w.firedAt = deadline
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder == nil {
+		return
+	}
+	log.Infof("auth session expiry soon warning fired for deadline %s (in %s)",
+		deadline.Format(time.RFC3339), remaining.Round(time.Second))
+	publishWarning(recorder, deadline, false)
+}
+
+// publishFinalLocked emits the final warning, at most once per deadline
+// value and never once the user dismissed that deadline. It marks the
+// interactive warning as handled too: the final window is open, so a
+// "expires in WarningLead minutes" notification would be wrong. Caller
+// must hold w.mu; this helper releases it.
+func (w *Watcher) publishFinalLocked(deadline time.Time, remaining time.Duration) {
+	if w.finalFiredAt.Equal(deadline) || w.dismissedAt.Equal(deadline) {
+		w.mu.Unlock()
+		return
+	}
+	w.firedAt = deadline
+	w.finalFiredAt = deadline
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder == nil {
+		return
+	}
+	log.Infof("auth session final-warning fired for deadline %s (in %s)",
+		deadline.Format(time.RFC3339), remaining.Round(time.Second))
+	publishWarning(recorder, deadline, true)
+}
+
+// publishWarning composes the SystemEvent for a watcher-fired warning and
+// pushes it through the recorder. Severity is CRITICAL on both — bypassing
+// the user's Notifications toggle is deliberate: missing the warning
+// window forces the post-mortem SessionExpired flow (tunnel torn down,
+// lock icon, manual re-login), which is the UX we are trying to avoid.
+func publishWarning(recorder StatusRecorder, deadline time.Time, final bool) {
+	lead := WarningLead
+	message := "session expiry warning"
+	meta := map[string]string{
+		MetaSessionWarning:   "true",
+		MetaSessionExpiresAt: FormatExpiresAt(deadline),
+	}
+	if final {
+		lead = FinalWarningLead
+		message = "session expiry final warning"
+		meta[MetaSessionFinal] = "true"
+	}
+	meta[MetaSessionLeadMinutes] = FormatLeadMinutes(lead)
+
+	recorder.PublishEvent(
+		cProto.SystemEvent_CRITICAL,
+		cProto.SystemEvent_AUTHENTICATION,
+		message,
+		"",
+		meta,
+	)
+}
diff --git a/client/internal/auth/sessionwatch/watcher_test.go b/client/internal/auth/sessionwatch/watcher_test.go
new file mode 100644
index 000000000..f0cc3ed88
--- /dev/null
+++ b/client/internal/auth/sessionwatch/watcher_test.go
@@ -0,0 +1,919 @@
+package sessionwatch
+
+import (
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	cProto "github.com/netbirdio/netbird/client/proto"
+)
+
+// fakeRecorder satisfies StatusRecorder and records every call so tests
+// can observe what the watcher emits. SetSessionExpiresAt and PublishEvent
+// land in the same ordered events slice (with the Kind distinguishing
+// them) so tests that care about ordering still work. lastDeadline holds
+// the most recent value passed to SetSessionExpiresAt so tests can assert
+// the recorder ended up cleared/set as expected.
+type fakeRecorder struct {
+	mu           sync.Mutex
+	events       []event
+	lastDeadline time.Time
+	// setDelay stalls SetSessionExpiresAt, widening the window in which a
+	// concurrent evaluation could publish a warning out of order.
+	setDelay time.Duration
+}
+
+type eventKind int
+
+const (
+	stateChange eventKind = iota
+	publish
+)
+
+type event struct {
+	kind eventKind
+	// Set only for publish events.
+	severity cProto.SystemEvent_Severity
+	category cProto.SystemEvent_Category
+	message  string
+	meta     map[string]string
+}
+
+// SetSessionExpiresAt mirrors peer.Status: a same-value write is a no-op,
+// a real change records the new value and fans out a state-change (the
+// production recorder calls notifyStateChange internally). The baseline
+// is the zero time, so an initial clear before any deadline is set emits
+// nothing — matching the real recorder.
+func (r *fakeRecorder) SetSessionExpiresAt(deadline time.Time) {
+	r.mu.Lock()
+	delay := r.setDelay
+	r.mu.Unlock()
+	// Stall without the lock held, so a concurrent publish can still record.
+	time.Sleep(delay)
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.lastDeadline.Equal(deadline) {
+		return
+	}
+	r.lastDeadline = deadline
+	r.events = append(r.events, event{kind: stateChange})
+}
+
+func (r *fakeRecorder) deadline() time.Time {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.lastDeadline
+}
+
+func (r *fakeRecorder) PublishEvent(
+	severity cProto.SystemEvent_Severity,
+	category cProto.SystemEvent_Category,
+	message string,
+	_ string,
+	metadata map[string]string,
+) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.events = append(r.events, event{
+		kind:     publish,
+		severity: severity,
+		category: category,
+		message:  message,
+		meta:     metadata,
+	})
+}
+
+func (r *fakeRecorder) snapshot() []event {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	out := make([]event, len(r.events))
+	copy(out, r.events)
+	return out
+}
+
+func (e event) isFinalWarning() bool {
+	return e.kind == publish && e.meta[MetaSessionFinal] == "true"
+}
+
+func (e event) isWarning() bool {
+	return e.kind == publish && e.meta[MetaSessionWarning] == "true" && e.meta[MetaSessionFinal] != "true"
+}
+
+func countWhere(events []event, pred func(event) bool) int {
+	n := 0
+	for _, e := range events {
+		if pred(e) {
+			n++
+		}
+	}
+	return n
+}
+
+func waitForEvents(t *testing.T, r *fakeRecorder, want int) []event {
+	t.Helper()
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if got := r.snapshot(); len(got) >= want {
+			return got
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	got := r.snapshot()
+	t.Fatalf("timed out waiting for %d events, got %d: %+v", want, len(got), got)
+	return nil
+}
+
+// testInterval keeps the ticker-driven tests fast; the leads they use are
+// in the same millisecond scale.
+const testInterval = 2 * time.Millisecond
+
+// newWatcher builds a watcher with the final warning disabled (finalLead=0),
+// matching the lead-only behaviour the pre-final-warning tests assume.
+func newWatcher(lead time.Duration, r *fakeRecorder) *Watcher {
+	return newWatcherWithLeads(lead, 0, r)
+}
+
+// newWatcherWithLeads builds a watcher that evaluates on testInterval. The
+// interval is set before Update, so the evaluation loop does not exist yet
+// and the write cannot race it.
+func newWatcherWithLeads(lead, final time.Duration, r StatusRecorder) *Watcher {
+	w := NewWithLeads(lead, final, r)
+	w.interval = testInterval
+	return w
+}
+
+// fakeClock is the watcher's wall clock under test. Reads come from the
+// evaluation goroutine while the test writes, so both go through the mutex.
+type fakeClock struct {
+	mu sync.Mutex
+	t  time.Time
+}
+
+func newFakeClock(t time.Time) *fakeClock {
+	return &fakeClock{t: t}
+}
+
+func (c *fakeClock) now() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.t
+}
+
+// set jumps the clock, standing in for a resume from suspension or for an
+// NTP correction.
+func (c *fakeClock) set(t time.Time) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.t = t
+}
+
+// settle waits out a handful of evaluation ticks so a test can assert that
+// nothing was published.
+func settle() {
+	time.Sleep(20 * testInterval)
+}
+
+func TestUpdateZeroBeforeAnythingIsNoop(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	_ = w.Update(time.Time{})
+
+	if got := r.snapshot(); len(got) != 0 {
+		t.Fatalf("expected no events on initial zero, got %+v", got)
+	}
+}
+
+func TestUpdateNonZeroFiresStateChange(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(time.Hour)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 1)
+	if events[0].kind != stateChange {
+		t.Fatalf("expected stateChange, got %+v", events[0])
+	}
+	if !w.Deadline().Equal(d) {
+		t.Fatalf("deadline mismatch: %v vs %v", w.Deadline(), d)
+	}
+}
+
+func TestSameDeadlineIsNoop(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(time.Hour)
+	_ = w.Update(d)
+	_ = w.Update(d)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 1)
+	if len(events) != 1 {
+		t.Fatalf("expected exactly 1 event for repeated same deadline, got %d: %+v", len(events), events)
+	}
+}
+
+func TestWarningFiresOnceWithinLeadWindow(t *testing.T) {
+	r := &fakeRecorder{}
+	lead := 50 * time.Millisecond
+	w := newWatcher(lead, r)
+	defer w.Close()
+
+	// Deadline 80ms out — warning should fire after ~30ms.
+	d := time.Now().Add(80 * time.Millisecond)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 2)
+	if events[0].kind != stateChange {
+		t.Fatalf("event[0] should be stateChange, got %+v", events[0])
+	}
+	if !events[1].isWarning() {
+		t.Fatalf("event[1] should be a warning publish, got %+v", events[1])
+	}
+}
+
+func TestWarningFiresImmediatelyWhenAlreadyInsideWindow(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(time.Hour, r) // lead > delta => fire immediately
+	defer w.Close()
+
+	d := time.Now().Add(10 * time.Millisecond)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected immediate warning publish, got %+v", events[1])
+	}
+}
+
+func TestNewDeadlineCancelsPriorTimer(t *testing.T) {
+	r := &fakeRecorder{}
+	lead := 50 * time.Millisecond
+	w := newWatcher(lead, r)
+	defer w.Close()
+
+	first := time.Now().Add(80 * time.Millisecond) // would fire warning ~30ms in
+	_ = w.Update(first)
+
+	// Replace with a far-future deadline before the warning fires.
+	time.Sleep(5 * time.Millisecond)
+	second := time.Now().Add(time.Hour)
+	_ = w.Update(second)
+
+	// Wait past when first's warning would have fired.
+	time.Sleep(80 * time.Millisecond)
+
+	if n := countWhere(r.snapshot(), event.isWarning); n != 0 {
+		t.Fatalf("warning fired for cancelled deadline: %+v", r.snapshot())
+	}
+}
+
+func TestRefreshAfterFireArmsNewWarning(t *testing.T) {
+	r := &fakeRecorder{}
+	lead := 150 * time.Millisecond
+	w := newWatcher(lead, r)
+	defer w.Close()
+
+	// Warning fires ~20ms in; the deadline itself stays 150ms away so the
+	// replacement below lands well before it.
+	first := time.Now().Add(170 * time.Millisecond)
+	_ = w.Update(first)
+
+	// Wait for stateChange + warning of the first cycle.
+	waitForEvents(t, r, 2)
+
+	// Simulate a successful extend: brand new deadline.
+	second := time.Now().Add(60 * time.Millisecond)
+	_ = w.Update(second)
+
+	// 4 events total: stateChange, warning (first), stateChange, warning (second).
+	events := waitForEvents(t, r, 4)
+	if events[2].kind != stateChange {
+		t.Fatalf("event[2] should be stateChange for the new deadline, got %+v", events[2])
+	}
+	if !events[3].isWarning() {
+		t.Fatalf("event[3] should be a warning publish for the new deadline, got %+v", events[3])
+	}
+}
+
+func TestUpdateZeroAfterNonZeroClearsState(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(time.Hour, r)
+	defer w.Close()
+
+	d := time.Now().Add(2 * time.Hour)
+	_ = w.Update(d)
+	waitForEvents(t, r, 1)
+
+	_ = w.Update(time.Time{})
+
+	events := waitForEvents(t, r, 2)
+	if events[1].kind != stateChange {
+		t.Fatalf("expected stateChange on clear, got %+v", events[1])
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("Deadline should be zero after clear")
+	}
+}
+
+func TestUpdateRejectsBeforeEpoch(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	good := time.Now().Add(time.Hour)
+	if err := w.Update(good); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+
+	err := w.Update(time.Unix(-100, 0))
+	if !errors.Is(err, ErrDeadlineBeforeEpoch) {
+		t.Fatalf("want ErrDeadlineBeforeEpoch, got %v", err)
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("rejected pre-epoch update must clear deadline; got %v", w.Deadline())
+	}
+}
+
+func TestUpdateRejectsTooFarFuture(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	good := time.Now().Add(time.Hour)
+	if err := w.Update(good); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+
+	err := w.Update(time.Now().Add(50 * 365 * 24 * time.Hour))
+	if !errors.Is(err, ErrDeadlineTooFarFuture) {
+		t.Fatalf("want ErrDeadlineTooFarFuture, got %v", err)
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("rejected far-future update must clear deadline; got %v", w.Deadline())
+	}
+}
+
+func TestUpdateRecentPastRecordedAsExpired(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(-1 * time.Hour)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("recent-past Update should succeed, got %v", err)
+	}
+	if !w.Deadline().Equal(d) {
+		t.Fatalf("expected deadline to be recorded, got %v want %v", w.Deadline(), d)
+	}
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("recorder deadline = %v, want %v", got, d)
+	}
+
+	time.Sleep(80 * time.Millisecond)
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("no warning events may fire for an already-past deadline, got %+v", r.snapshot())
+	}
+}
+
+func TestUpdateAncientPastRejected(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	good := time.Now().Add(time.Hour)
+	if err := w.Update(good); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+	// Drain the stateChange from the seed.
+	waitForEvents(t, r, 1)
+
+	err := w.Update(time.Now().Add(-31 * 24 * time.Hour))
+	if !errors.Is(err, ErrDeadlineInPast) {
+		t.Fatalf("want ErrDeadlineInPast, got %v", err)
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("rejected ancient-past update must clear the deadline, got %v", w.Deadline())
+	}
+	events := waitForEvents(t, r, 2)
+	if events[1].kind != stateChange {
+		t.Fatalf("expected stateChange on clear, got %+v", events[1])
+	}
+}
+
+func TestCloseSilencesUpdates(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	w.Close()
+
+	if err := w.Update(time.Now().Add(time.Hour)); err != nil {
+		t.Fatalf("Update after Close: want nil, got %v", err)
+	}
+	if got := r.snapshot(); len(got) != 0 {
+		t.Fatalf("expected no events after Close, got %+v", got)
+	}
+}
+
+// TestCloseKeepsRecorderDeadline pins the reconnect-flap fix: the watcher
+// closes on every engine restart (network change, sleep/wake) while the
+// SSO deadline stays valid across those, so Close must leave the
+// server-scoped recorder's value in place. The client run loop clears the
+// recorder when it exits for real.
+func TestCloseKeepsRecorderDeadline(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(time.Hour, r)
+
+	d := time.Now().Add(2 * time.Hour)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("recorder deadline after Update = %v, want %v", got, d)
+	}
+
+	w.Close()
+
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("recorder deadline after Close = %v, want %v", got, d)
+	}
+}
+
+// TestCloseWithoutDeadlineLeavesRecorderUntouched guards the symmetric
+// case: closing a watcher that never held a deadline must not emit a
+// redundant clear (the recorder may legitimately hold a value written by
+// some other path; the watcher only owns what it set).
+func TestCloseWithoutDeadlineLeavesRecorderUntouched(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(time.Hour, r)
+
+	w.Close()
+
+	if got := r.snapshot(); len(got) != 0 {
+		t.Fatalf("expected no events from Close on an empty watcher, got %+v", got)
+	}
+}
+
+func TestFinalWarningFiresAfterRegularWarning(t *testing.T) {
+	r := &fakeRecorder{}
+	// Warning fires at deadline-80ms, final at deadline-30ms.
+	w := newWatcherWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(d)
+
+	// Expect stateChange + warning + final-warning.
+	events := waitForEvents(t, r, 3)
+
+	if countWhere(events, func(e event) bool { return e.kind == stateChange }) != 1 {
+		t.Fatalf("expected exactly 1 stateChange, got %+v", events)
+	}
+	if countWhere(events, event.isWarning) != 1 {
+		t.Fatalf("expected exactly 1 warning publish, got %+v", events)
+	}
+	if countWhere(events, event.isFinalWarning) != 1 {
+		t.Fatalf("expected exactly 1 final-warning publish, got %+v", events)
+	}
+
+	// Warning must precede final (same deadline, longer lead fires first).
+	var wIdx, fIdx int
+	for i, e := range events {
+		switch {
+		case e.isWarning():
+			wIdx = i
+		case e.isFinalWarning():
+			fIdx = i
+		}
+	}
+	if wIdx > fIdx {
+		t.Fatalf("warning must publish before final-warning, got order %+v", events)
+	}
+}
+
+func TestDismissSuppressesFinalWarning(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcherWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(d)
+
+	// Wait for the warning publish so we know we're inside the warning
+	// window, then dismiss before the final timer would fire.
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if countWhere(r.snapshot(), event.isWarning) >= 1 {
+			break
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+	if countWhere(r.snapshot(), event.isWarning) < 1 {
+		t.Fatalf("warning did not publish in time, events=%+v", r.snapshot())
+	}
+
+	w.Dismiss()
+
+	// Now wait past when the final would have fired.
+	time.Sleep(120 * time.Millisecond)
+
+	if n := countWhere(r.snapshot(), event.isFinalWarning); n != 0 {
+		t.Fatalf("final-warning published after Dismiss(), events=%+v", r.snapshot())
+	}
+}
+
+func TestDismissResetByNewDeadline(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcherWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	first := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(first)
+
+	// Dismiss against the first deadline.
+	w.Dismiss()
+
+	// Replace with a fresh deadline before the first's timers complete.
+	time.Sleep(10 * time.Millisecond)
+	second := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(second)
+
+	// The second cycle must publish a final-warning (the dismiss state
+	// did not carry over).
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if countWhere(r.snapshot(), event.isFinalWarning) >= 1 {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	if countWhere(r.snapshot(), event.isFinalWarning) < 1 {
+		t.Fatalf("final-warning did not publish on fresh deadline after Dismiss reset, events=%+v", r.snapshot())
+	}
+}
+
+func TestDismissBeforeUpdateIsNoop(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcherWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	// No deadline tracked yet; Dismiss must be a no-op (no panic, no state).
+	w.Dismiss()
+
+	d := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(d)
+
+	// Final warning should still publish — Dismiss only acts on the current
+	// deadline, and there was none at the time of the call.
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if countWhere(r.snapshot(), event.isFinalWarning) >= 1 {
+			return
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	t.Fatalf("final-warning did not publish after no-op pre-Update Dismiss, events=%+v", r.snapshot())
+}
+
+// The tests below drive the watcher's wall clock directly. The deadline sits
+// an hour out in real time and the fake clock jumps, standing in for a device
+// that was suspended and resumed somewhere inside — or past — the warning
+// windows. The evaluation loop is what reacts to the jump, so these exercise
+// the same path production takes on a resume.
+func newResumeWatcher(t *testing.T, r *fakeRecorder) (*Watcher, *fakeClock, time.Time) {
+	t.Helper()
+
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	start := time.Now()
+	clock := newFakeClock(start)
+	// Set before Update: the evaluation loop does not exist yet.
+	w.nowFn = clock.now
+	t.Cleanup(w.Close)
+
+	deadline := start.Add(time.Hour).Round(0)
+	if err := w.Update(deadline); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+	return w, clock, deadline
+}
+
+func TestResumeInsideWarningWindowWarns(t *testing.T) {
+	r := &fakeRecorder{}
+	_, clock, deadline := newResumeWatcher(t, r)
+
+	clock.set(deadline.Add(-5 * time.Minute))
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected the interactive warning after the resume, got %+v", events[1])
+	}
+	if n := countWhere(events, event.isFinalWarning); n != 0 {
+		t.Fatalf("final-warning must wait for its own window, got %d: %+v", n, events)
+	}
+}
+
+func TestResumeInsideFinalWindowSendsFinalWarningOnly(t *testing.T) {
+	r := &fakeRecorder{}
+	_, clock, deadline := newResumeWatcher(t, r)
+
+	clock.set(deadline.Add(-time.Minute))
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isFinalWarning() {
+		t.Fatalf("expected the final warning after the resume, got %+v", events[1])
+	}
+	settle()
+	if n := countWhere(r.snapshot(), event.isWarning); n != 0 {
+		t.Fatalf("the interactive warning is stale inside the final window, got %d: %+v", n, r.snapshot())
+	}
+}
+
+func TestResumePastDeadlinePublishesNothing(t *testing.T) {
+	r := &fakeRecorder{}
+	_, clock, deadline := newResumeWatcher(t, r)
+
+	clock.set(deadline.Add(time.Minute))
+
+	settle()
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("an expired session must not warn, got %d publishes: %+v", n, r.snapshot())
+	}
+}
+
+func TestWarningPublishesOncePerDeadline(t *testing.T) {
+	r := &fakeRecorder{}
+	_, clock, deadline := newResumeWatcher(t, r)
+
+	clock.set(deadline.Add(-5 * time.Minute))
+	waitForEvents(t, r, 2)
+
+	// Many ticks pass inside the same window.
+	settle()
+	if n := countWhere(r.snapshot(), event.isWarning); n != 1 {
+		t.Fatalf("expected exactly 1 warning publish across ticks, got %d: %+v", n, r.snapshot())
+	}
+}
+
+// TestWarningRecoversFromAClockRunningAhead covers the device that boots
+// before NTP has corrected it: the deadline looks long gone, nothing is
+// published, and the warning still arrives once the clock is fixed.
+func TestWarningRecoversFromAClockRunningAhead(t *testing.T) {
+	r := &fakeRecorder{}
+	_, clock, deadline := newResumeWatcher(t, r)
+
+	clock.set(deadline.Add(2 * time.Hour))
+	settle()
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("a deadline that looks expired must not warn, got %d publishes: %+v", n, r.snapshot())
+	}
+
+	clock.set(deadline.Add(-5 * time.Minute))
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected the warning once the clock was corrected, got %+v", events[1])
+	}
+}
+
+func TestResumeInsideFinalWindowRespectsDismiss(t *testing.T) {
+	r := &fakeRecorder{}
+	w, clock, deadline := newResumeWatcher(t, r)
+
+	// The user dismissed the warning for this deadline before the device
+	// was suspended; resuming inside the final window must not reopen it.
+	w.Dismiss()
+	clock.set(deadline.Add(-time.Minute))
+
+	settle()
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("a dismissed deadline must not warn on resume, got %d: %+v", n, r.snapshot())
+	}
+}
+
+func TestCloseStopsTheEvaluationLoop(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	start := time.Now()
+	clock := newFakeClock(start)
+	w.nowFn = clock.now
+
+	deadline := start.Add(time.Hour).Round(0)
+	if err := w.Update(deadline); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+	w.Close()
+
+	clock.set(deadline.Add(-5 * time.Minute))
+	settle()
+
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("a closed watcher must not publish, got %d: %+v", n, r.snapshot())
+	}
+}
+
+func TestDeadlineOnlyRecordsDeadlineWithoutWarnings(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewDeadlineOnly(r)
+	defer w.Close()
+
+	// With the default leads this deadline sits inside the final-warning
+	// window, so a watcher that warns at all would publish on the spot.
+	d := time.Now().Add(50 * time.Millisecond).Round(0)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("expected recorder deadline %v, got %v", d, got)
+	}
+
+	time.Sleep(100 * time.Millisecond)
+
+	events := r.snapshot()
+	if got := countWhere(events, func(e event) bool { return e.kind == publish }); got != 0 {
+		t.Fatalf("expected no publish in deadline-only mode, got %d: %+v", got, events)
+	}
+	w.mu.Lock()
+	polling := w.stop != nil
+	w.mu.Unlock()
+	if polling {
+		t.Fatal("expected no evaluation loop in deadline-only mode")
+	}
+}
+
+func TestDeadlineOnlyStillRejectsOutOfRangeDeadlines(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewDeadlineOnly(r)
+	defer w.Close()
+
+	if err := w.Update(time.Now().Add(time.Hour)); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	err := w.Update(time.Now().Add(-maxPastHorizon - time.Hour))
+	if !errors.Is(err, ErrDeadlineInPast) {
+		t.Fatalf("expected ErrDeadlineInPast, got %v", err)
+	}
+	if got := r.deadline(); !got.IsZero() {
+		t.Fatalf("expected recorder cleared after rejection, got %v", got)
+	}
+}
+
+// TestClockAheadAtUpdateStillWarnsOnceCorrected covers a client that connects
+// while its clock runs ahead of real time: the deadline reads as already
+// expired when it arrives, so nothing publishes, and the warning must still
+// come once NTP pulls the clock back.
+func TestClockAheadAtUpdateStillWarnsOnceCorrected(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	deadline := time.Now().Add(time.Hour).Round(0)
+	// Two hours past the deadline from the device's point of view, well
+	// inside maxPastHorizon, so Update accepts and records it.
+	clock := newFakeClock(deadline.Add(2 * time.Hour))
+	w.nowFn = clock.now
+	t.Cleanup(w.Close)
+
+	if err := w.Update(deadline); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	settle()
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("a deadline that reads as expired must not warn, got %d: %+v", n, r.snapshot())
+	}
+
+	clock.set(deadline.Add(-5 * time.Minute))
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected the warning once the clock was corrected, got %+v", events[1])
+	}
+}
+
+// TestWarningNeverPrecedesTheDeadlineStateChange pins the ordering Update
+// documents: consumers learn the new deadline before they see a warning that
+// refers to it. The deadline here already sits inside the warning window, and
+// the recorder stalls, so the evaluation loop gets many chances to publish
+// while Update is still announcing.
+func TestWarningNeverPrecedesTheDeadlineStateChange(t *testing.T) {
+	r := &fakeRecorder{setDelay: 50 * time.Millisecond}
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	deadline := time.Now().Add(time.Hour).Round(0)
+	clock := newFakeClock(deadline.Add(-5 * time.Minute))
+	w.nowFn = clock.now
+	t.Cleanup(w.Close)
+
+	if err := w.Update(deadline); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	events := waitForEvents(t, r, 2)
+	if events[0].kind != stateChange {
+		t.Fatalf("event[0] should be the deadline state change, got %+v", events)
+	}
+	if !events[1].isWarning() {
+		t.Fatalf("event[1] should be the warning, got %+v", events)
+	}
+}
+
+// TestUpdateWakesTheLoopWithoutWaitingForATick pins the hand-off: Update
+// publishes nothing itself, it nudges the evaluation loop, so a deadline that
+// already sits inside a warning window is warned about at once even though the
+// ticker here would not fire for an hour.
+func TestUpdateWakesTheLoopWithoutWaitingForATick(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	w.interval = time.Hour
+	t.Cleanup(w.Close)
+
+	d := time.Now().Add(5 * time.Minute).Round(0)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected the warning on the wake-up, got %+v", events[1])
+	}
+}
+
+// blockingRecorder holds a publish open until the test releases it, so the
+// evaluation loop can be parked mid-publish while Close is called.
+type blockingRecorder struct {
+	fakeRecorder
+	entered chan struct{}
+	release chan struct{}
+}
+
+func (r *blockingRecorder) PublishEvent(
+	severity cProto.SystemEvent_Severity,
+	category cProto.SystemEvent_Category,
+	message string,
+	userMessage string,
+	metadata map[string]string,
+) {
+	select {
+	case r.entered <- struct{}{}:
+	default:
+	}
+	<-r.release
+	r.fakeRecorder.PublishEvent(severity, category, message, userMessage, metadata)
+}
+
+// TestConcurrentCloseWaitsForTheLoop pins the contract for the caller that
+// loses the race: Close returns only once the loop is done, whichever of the
+// two calls got there first.
+func TestConcurrentCloseWaitsForTheLoop(t *testing.T) {
+	r := &blockingRecorder{entered: make(chan struct{}, 1), release: make(chan struct{})}
+	var releaseOnce sync.Once
+	release := func() { releaseOnce.Do(func() { close(r.release) }) }
+
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	w.interval = time.Hour
+	// Order matters: Close waits for the loop, which stays parked in the
+	// publish until the release, so a t.Fatal below would hang the cleanup
+	// instead of reporting the failure.
+	t.Cleanup(func() {
+		release()
+		w.Close()
+	})
+
+	d := time.Now().Add(5 * time.Minute).Round(0)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	// The loop is now parked inside the warning publish.
+	select {
+	case <-r.entered:
+	case <-time.After(2 * time.Second):
+		t.Fatal("the loop never reached the publish")
+	}
+
+	first := make(chan struct{})
+	second := make(chan struct{})
+	go func() { w.Close(); close(first) }()
+	go func() { w.Close(); close(second) }()
+
+	select {
+	case <-first:
+		t.Fatal("Close returned while the loop was still publishing")
+	case <-second:
+		t.Fatal("Close returned while the loop was still publishing")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	release()
+	for _, done := range []chan struct{}{first, second} {
+		select {
+		case <-done:
+		case <-time.After(2 * time.Second):
+			t.Fatal("Close did not return after the publish completed")
+		}
+	}
+}
diff --git a/client/internal/auth/util.go b/client/internal/auth/util.go
index 31c81d701..1800584a2 100644
--- a/client/internal/auth/util.go
+++ b/client/internal/auth/util.go
@@ -20,14 +20,26 @@ func randomBytesInHex(count int) (string, error) {
 	return hex.EncodeToString(buf), nil
 }
 
-// isValidAccessToken is a simple validation of the access token
-func isValidAccessToken(token string, audience string) error {
+// validateTokenAudience checks that the token is a well-formed JWT whose
+// audience claim matches the expected audience.
+//
+// It does NOT verify the token's cryptographic signature and therefore must not
+// be treated as an authenticity check. The token is obtained by the client
+// directly from the IdP token endpoint over TLS, and its signature is verified
+// server-side by the management server against the IdP's JWKS
+// (see shared/auth/jwt/validator.go). This function is only a client-side
+// sanity check that the returned token targets the expected audience.
+func validateTokenAudience(token string, audience string) error {
 	if token == "" {
 		return fmt.Errorf("token received is empty")
 	}
 
-	encodedClaims := strings.Split(token, ".")[1]
-	claimsString, err := base64.RawURLEncoding.DecodeString(encodedClaims)
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return fmt.Errorf("token is not a well-formed JWT")
+	}
+
+	claimsString, err := base64.RawURLEncoding.DecodeString(parts[1])
 	if err != nil {
 		return err
 	}
diff --git a/client/internal/auth/util_test.go b/client/internal/auth/util_test.go
new file mode 100644
index 000000000..7f225bb86
--- /dev/null
+++ b/client/internal/auth/util_test.go
@@ -0,0 +1,108 @@
+package auth
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"testing"
+)
+
+// makeJWT builds an unsigned JWT-shaped string (header.payload.signature) with
+// the given claims payload. The signature part is arbitrary because
+// validateTokenAudience intentionally does not verify it.
+func makeJWT(t *testing.T, claims map[string]interface{}) string {
+	t.Helper()
+	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"RS256","typ":"JWT"}`))
+	payloadBytes, err := json.Marshal(claims)
+	if err != nil {
+		t.Fatalf("marshal claims: %v", err)
+	}
+	payload := base64.RawURLEncoding.EncodeToString(payloadBytes)
+	return header + "." + payload + ".unverified-signature"
+}
+
+func TestValidateTokenAudience(t *testing.T) {
+	tests := []struct {
+		name     string
+		token    string
+		audience string
+		wantErr  bool
+	}{
+		{
+			name:     "empty token",
+			token:    "",
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "not a JWT - no dots",
+			token:    "notajwt",
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "not a JWT - two parts only",
+			token:    "header.payload",
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "matching string audience",
+			token:    makeJWT(t, map[string]interface{}{"aud": "netbird"}),
+			audience: "netbird",
+			wantErr:  false,
+		},
+		{
+			name:     "mismatching string audience",
+			token:    makeJWT(t, map[string]interface{}{"aud": "other"}),
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "matching audience in array",
+			token:    makeJWT(t, map[string]interface{}{"aud": []interface{}{"other", "netbird"}}),
+			audience: "netbird",
+			wantErr:  false,
+		},
+		{
+			name:     "mismatching audience array",
+			token:    makeJWT(t, map[string]interface{}{"aud": []interface{}{"a", "b"}}),
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "missing audience claim",
+			token:    makeJWT(t, map[string]interface{}{"sub": "user"}),
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "invalid base64 payload",
+			token:    "header.!!!not-base64!!!.sig",
+			audience: "netbird",
+			wantErr:  true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateTokenAudience(tc.token, tc.audience)
+			if tc.wantErr && err == nil {
+				t.Fatalf("expected error, got nil")
+			}
+			if !tc.wantErr && err != nil {
+				t.Fatalf("expected no error, got %v", err)
+			}
+		})
+	}
+}
+
+// TestValidateTokenAudienceNoPanic guards the regression where a non-empty
+// token without the JWT dot structure caused an index-out-of-range panic.
+func TestValidateTokenAudienceNoPanic(t *testing.T) {
+	inputs := []string{"a", ".", "a.", "aaaa", "no-dots-here"}
+	for _, in := range inputs {
+		if err := validateTokenAudience(in, "netbird"); err == nil {
+			t.Fatalf("expected error for malformed token %q, got nil", in)
+		}
+	}
+}
diff --git a/client/internal/certproof/collect.go b/client/internal/certproof/collect.go
new file mode 100644
index 000000000..310fd2b19
--- /dev/null
+++ b/client/internal/certproof/collect.go
@@ -0,0 +1,168 @@
+package certproof
+
+import (
+	"context"
+	"crypto"
+	"crypto/sha256"
+	"crypto/x509"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// Collect answers the certificate challenges in checks: for each challenge it picks a
+// stored certificate that chains to the challenge's CAs and signs the nonce with its
+// key. The same certificate is proven once even if several checks accept it.
+func Collect(ctx context.Context, store Store, checks []*proto.Checks, peerKey []byte) []certposture.Proof {
+	challenges := certificateChallenges(checks)
+	if len(challenges) == 0 {
+		logNoChallenges(checks)
+		return nil
+	}
+	return CollectChallenges(ctx, store, challenges, peerKey)
+}
+
+func logNoChallenges(checks []*proto.Checks) {
+	if len(checks) > 0 {
+		log.Debugf("certificate posture: %d posture checks received, none carries a certificate challenge", len(checks))
+	}
+}
+
+// CollectChallenges answers challenges already extracted from the posture checks, so a
+// caller that ships them across a process boundary reuses the same matching and signing.
+// Only nonces of the size management issues are signed, for a peer key of the size of
+// ours, so the keys behind the store never sign arbitrary caller-chosen data.
+func CollectChallenges(ctx context.Context, store Store, challenges []*proto.CertificateChallenge, peerKey []byte) []certposture.Proof {
+	if len(peerKey) != wgtypes.KeyLen {
+		log.Warnf("certificate posture: refusing to sign for a %d byte peer key", len(peerKey))
+		return nil
+	}
+	challenges = wellFormed(challenges)
+	if len(challenges) == 0 {
+		return nil
+	}
+	log.Debugf("certificate posture: answering %d certificate challenges from store %T", len(challenges), store)
+
+	candidates, err := store.Candidates(ctx)
+	if err != nil {
+		log.Warnf("failed loading certificates for posture checks: %v", err)
+		return nil
+	}
+	if len(candidates) == 0 {
+		log.Debug("certificate posture: certificate store holds no candidates, no proof will be sent")
+		return nil
+	}
+	log.Debugf("certificate posture: store holds %d candidate certificates", len(candidates))
+
+	now := time.Now()
+	proven := make(map[[sha256.Size]byte]struct{})
+	var proofs []certposture.Proof
+	for i, challenge := range challenges {
+		roots, err := certposture.ParseCAs(challenge.GetCaCertificates())
+		if err != nil {
+			log.Warnf("skipping certificate challenge with invalid CA certificates: %v", err)
+			continue
+		}
+		log.Debugf("certificate posture: challenge %d accepts %d CA certificates, nonce is %d bytes", i, len(challenge.GetCaCertificates()), len(challenge.GetNonce()))
+
+		matched := false
+		for _, candidate := range candidates {
+			if len(candidate.Chain) == 0 {
+				continue
+			}
+			leaf := candidate.Chain[0]
+			chain, err := certposture.VerifiedChain(leaf, candidate.issuers(), roots, now)
+			if err != nil {
+				log.Debugf("certificate posture: challenge %d rejected %q issued by %q: %v", i, leaf.Subject, leaf.Issuer, err)
+				continue
+			}
+			matched = true
+
+			// The same leaf can chain to different CAs for different challenges, and
+			// management checks each chain against each check's CAs, so a proof is
+			// deduplicated by its whole chain rather than by its leaf.
+			fingerprint := chainFingerprint(chain)
+			if _, done := proven[fingerprint]; done {
+				log.Debugf("certificate posture: challenge %d matched %q, already proven for an earlier challenge", i, leaf.Subject)
+				break
+			}
+			proof, err := prove(candidate.Signer, chain, challenge.GetNonce(), peerKey)
+			if err != nil {
+				log.Warnf("failed signing certificate proof for %s: %v", leaf.Subject, err)
+				continue
+			}
+			log.Debugf("certificate posture: challenge %d proven by %q with %s, signature %d bytes, chain of %d", i, leaf.Subject, proof.SigAlg, len(proof.Signature), len(proof.Chain))
+			proven[fingerprint] = struct{}{}
+			proofs = append(proofs, proof)
+			break
+		}
+		if !matched {
+			log.Debugf("certificate posture: challenge %d matched none of the %d candidates", i, len(candidates))
+		}
+	}
+	log.Debugf("certificate posture: %d challenges produced %d proofs", len(challenges), len(proofs))
+	return proofs
+}
+
+// HasChallenges reports whether any of checks asks for a certificate proof.
+func HasChallenges(checks []*proto.Checks) bool {
+	return len(certificateChallenges(checks)) > 0
+}
+
+func certificateChallenges(checks []*proto.Checks) []*proto.CertificateChallenge {
+	var challenges []*proto.CertificateChallenge
+	for _, check := range checks {
+		if challenge := check.GetCertificateChallenge(); challenge != nil {
+			challenges = append(challenges, challenge)
+		}
+	}
+	return wellFormed(challenges)
+}
+
+// wellFormed drops challenges whose nonce is not one management could have issued.
+func wellFormed(challenges []*proto.CertificateChallenge) []*proto.CertificateChallenge {
+	var kept []*proto.CertificateChallenge
+	for _, challenge := range challenges {
+		if len(challenge.GetNonce()) != certposture.NonceSize {
+			log.Debugf("certificate posture: skipping challenge with a %d byte nonce", len(challenge.GetNonce()))
+			continue
+		}
+		kept = append(kept, challenge)
+	}
+	return kept
+}
+
+func prove(signer crypto.Signer, chain []*x509.Certificate, nonce, peerKey []byte) (certposture.Proof, error) {
+	sigAlg, sig, err := certposture.Sign(signer, nonce, peerKey)
+	if err != nil {
+		return certposture.Proof{}, err
+	}
+	der := make([][]byte, 0, len(chain))
+	for _, cert := range chain {
+		der = append(der, cert.Raw)
+	}
+	return certposture.Proof{Nonce: nonce, Chain: der, SigAlg: sigAlg, Signature: sig}, nil
+}
+
+func chainFingerprint(chain []*x509.Certificate) [sha256.Size]byte {
+	ders := make([][]byte, 0, len(chain))
+	for _, cert := range chain {
+		ders = append(ders, cert.Raw)
+	}
+	return chainDERFingerprint(ders)
+}
+
+// chainDERFingerprint identifies a chain of DER certificates by the hashes of all of them,
+// in order.
+func chainDERFingerprint(chain [][]byte) [sha256.Size]byte {
+	buf := make([]byte, 0, len(chain)*sha256.Size)
+	for _, der := range chain {
+		certHash := sha256.Sum256(der)
+		buf = append(buf, certHash[:]...)
+	}
+	return sha256.Sum256(buf)
+}
diff --git a/client/internal/certproof/collect_darwin.go b/client/internal/certproof/collect_darwin.go
new file mode 100644
index 000000000..cc21563c1
--- /dev/null
+++ b/client/internal/certproof/collect_darwin.go
@@ -0,0 +1,137 @@
+//go:build !ios
+
+package certproof
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const helperTimeout = 30 * time.Second
+
+// userHelperBackoff holds off asking a user's keychain again after it proved nothing.
+var userHelperBackoff = newHelperBackoff()
+
+// CollectProofs answers the certificate challenges in checks from every store this Mac
+// can reach. The root daemon reads the System keychain itself, which is where MDM
+// installs device identities, and reaches the console user's login keychain only by
+// launching a helper into that user's session. A Mac sitting at the login window
+// therefore yields device proofs alone.
+func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte, cfg Config) []certposture.Proof {
+	challenges := certificateChallenges(checks)
+	if len(challenges) == 0 {
+		logNoChallenges(checks)
+		return nil
+	}
+
+	// A helper already runs inside the user's session, so it reads its own keychain
+	// directly and must never launch another one.
+	if os.Geteuid() != 0 {
+		return CollectChallenges(ctx, DefaultStore(), challenges, peerKey)
+	}
+
+	proofs := CollectChallenges(ctx, DefaultStore(), challenges, peerKey)
+	if cfg.OwnerUnknown {
+		return proofs
+	}
+
+	userProofs, err := collectAsConsoleUser(ctx, cfg.ProfileOwner, challenges, peerKey)
+	if err != nil {
+		log.Debugf("certificate posture: console user keychain unavailable: %v", err)
+	}
+	return mergeProofs(proofs, userProofs)
+}
+
+// UserContext identifies the user whose keychain a collection would include: the console
+// user when it owns the active profile, or empty when no user keychain would be asked. A
+// change means a collection made earlier no longer reflects what this Mac can prove.
+func UserContext(cfg Config) string {
+	if os.Geteuid() != 0 || cfg.OwnerUnknown {
+		return ""
+	}
+	user, ok := currentConsoleUser()
+	if !ok || !user.isOwner(cfg.ProfileOwner) {
+		return ""
+	}
+	return strconv.FormatUint(uint64(user.UID), 10) + ":" + user.Name
+}
+
+// collectAsConsoleUser runs the helper inside the desktop session of the logged-in
+// user. Dropping to their uid is not enough: keychain access is an XPC call to a
+// per-session securityd, so the helper has to enter their Mach bootstrap namespace,
+// which is what launchctl asuser does.
+func collectAsConsoleUser(ctx context.Context, owner string, challenges []*proto.CertificateChallenge, peerKey []byte) ([]certposture.Proof, error) {
+	user, ok := currentConsoleUser()
+	if !ok {
+		return nil, nil
+	}
+	if !user.isOwner(owner) {
+		log.Debugf("certificate posture: console user %s does not own the active profile, no user keychain is asked", user.Name)
+		return nil, nil
+	}
+
+	uid := strconv.FormatUint(uint64(user.UID), 10)
+	backoffKey := helperBackoffKey(uid, challenges)
+	if !userHelperBackoff.allow(backoffKey, time.Now()) {
+		log.Debugf("certificate posture: the keychain of uid %s proved nothing recently, not asking again yet", uid)
+		return nil, nil
+	}
+
+	binary, err := os.Executable()
+	if err != nil {
+		return nil, fmt.Errorf("resolve own binary: %w", err)
+	}
+
+	parent := ctx
+	ctx, cancel := context.WithTimeout(ctx, helperTimeout)
+	defer cancel()
+
+	// Absolute paths, because the daemon's PATH is configurable through the service
+	// environment, and sudo selects the user by uid so the name never has to round-trip.
+	cmd := exec.CommandContext(ctx, "/bin/launchctl", "asuser", uid, "/usr/bin/sudo", "-u", "#"+uid, "-H", "--", binary, "posture", "cert-proof")
+	killHelperGroupOnCancel(cmd)
+
+	log.Debugf("certificate posture: asking the desktop session of uid %s to answer %d challenges", uid, len(challenges))
+	proofs, err := runHelperCmd(cmd, helperRequest(challenges, peerKey))
+	// A run that completed, or ran into the timeout waiting on a prompt nobody answered,
+	// tells whether the keychain proves anything. A launch or output failure, or a run the
+	// caller cut short, says nothing about it and must not hold off the next one.
+	timedOut := errors.Is(ctx.Err(), context.DeadlineExceeded) && parent.Err() == nil
+	if err == nil || timedOut {
+		userHelperBackoff.record(backoffKey, err == nil && len(proofs) > 0, time.Now())
+	}
+	if err != nil {
+		return nil, fmt.Errorf("run helper as uid %s: %w", uid, err)
+	}
+	log.Debugf("certificate posture: desktop session of uid %s returned %d proofs", uid, len(proofs))
+	return proofs, nil
+}
+
+// helperStore is the store the helper reads: the user's login keychain alone. The
+// session's search list also holds the System keychain, which the daemon reads itself,
+// and using a System keychain key from the user's session would ask for an
+// administrator's approval.
+func helperStore() Store {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		log.Debugf("certificate posture: no home directory, searching the default keychain list: %v", err)
+		return newKeychainStore()
+	}
+	login := filepath.Join(home, "Library", "Keychains", "login.keychain-db")
+	if _, err := os.Stat(login); err != nil {
+		// Keychains created before macOS 10.12 keep the old file name.
+		login = filepath.Join(home, "Library", "Keychains", "login.keychain")
+	}
+	return newKeychainStore(login)
+}
diff --git a/client/internal/certproof/collect_js.go b/client/internal/certproof/collect_js.go
new file mode 100644
index 000000000..fd7c4c690
--- /dev/null
+++ b/client/internal/certproof/collect_js.go
@@ -0,0 +1,31 @@
+//go:build js
+
+package certproof
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// CollectProofs proves nothing in a browser: it has no TPM, certificate store or file
+// store to sign with, so the stores stay out of the WebAssembly build.
+func CollectProofs(context.Context, []*proto.Checks, []byte, Config) []certposture.Proof {
+	return nil
+}
+
+// UserContext identifies the user whose certificates a collection would include. A
+// browser has no per-user store, so it never changes.
+func UserContext(Config) string {
+	return ""
+}
+
+// DefaultStore is empty in a browser.
+func DefaultStore() Store {
+	return Stores{}
+}
+
+func helperStore() Store {
+	return DefaultStore()
+}
diff --git a/client/internal/certproof/collect_other.go b/client/internal/certproof/collect_other.go
new file mode 100644
index 000000000..785d3db65
--- /dev/null
+++ b/client/internal/certproof/collect_other.go
@@ -0,0 +1,31 @@
+//go:build ((!darwin && !windows) || ios) && !js
+
+package certproof
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// CollectProofs answers the certificate challenges in checks from the PEM directory cfg
+// names, joined by its PKCS#11 token when it names one. Only macOS and Windows keep
+// per-user certificates out of reach of a privileged daemon, so every other platform
+// reads its store in the daemon itself.
+func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte, cfg Config) []certposture.Proof {
+	return Collect(ctx, storeWithToken(cfg), checks, peerKey)
+}
+
+// UserContext identifies the user whose certificates a collection would include. These
+// platforms have no per-user store, so it never changes.
+func UserContext(Config) string {
+	return ""
+}
+
+// helperStore is the store the helper reads. Nothing launches a helper on these
+// platforms, so it is the store the daemon reads, configured from the same environment,
+// which lets an administrator check a setup by running the helper by hand.
+func helperStore() Store {
+	return storeWithToken(Config{PKCS11: PKCS11FromEnv()})
+}
diff --git a/client/internal/certproof/collect_test.go b/client/internal/certproof/collect_test.go
new file mode 100644
index 000000000..aa033dea5
--- /dev/null
+++ b/client/internal/certproof/collect_test.go
@@ -0,0 +1,258 @@
+package certproof
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/x509"
+	"math/big"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+var peerKey = []byte("peer-public-key-aaaaaaaaaaaaaaaa")
+
+func TestCollect_ProvesOneMatchingCertificatePerChallenge(t *testing.T) {
+	corpCA := certtest.NewCA(t, "corp-root")
+	otherCA := certtest.NewCA(t, "other-root")
+	unrelatedCA := certtest.NewCA(t, "unrelated-root")
+
+	dir := storeDir(t)
+	deviceKey := certtest.ECDSAKey(t)
+	device := corpCA.Issue(t, deviceKey, "device")
+	writeFile(t, dir, "device.pem", certtest.CertPEM(device)+certtest.KeyPEM(t, deviceKey))
+
+	otherKey := certtest.RSAKey(t)
+	writeFile(t, dir, "other.crt", certtest.CertPEM(otherCA.Issue(t, otherKey, "other")))
+	writeFile(t, dir, "other.key", certtest.KeyPEM(t, otherKey))
+
+	writeFile(t, dir, "keyless.crt", certtest.CertPEM(corpCA.Issue(t, certtest.ECDSAKey(t), "keyless")))
+	writeFile(t, dir, "notes.txt", "ignored")
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	nonce := challenger.Nonce(peerKey, time.Now())
+	challenge := func(cas ...string) *proto.Checks {
+		return &proto.Checks{CertificateChallenge: &proto.CertificateChallenge{Nonce: nonce, CaCertificates: cas}}
+	}
+	checks := []*proto.Checks{
+		{Files: []string{"/usr/bin/agent"}},
+		challenge(corpCA.PEM),
+		challenge(corpCA.PEM),
+		challenge(otherCA.PEM),
+		challenge(unrelatedCA.PEM),
+		challenge("not a pem"),
+	}
+
+	proofs := Collect(context.Background(), newFileStore(dir), checks, peerKey)
+
+	require.Len(t, proofs, 2)
+	var subjects []string
+	for _, p := range proofs {
+		chain, err := challenger.Verify(p, peerKey, time.Now())
+		require.NoError(t, err)
+		subjects = append(subjects, chain[0].Subject.CommonName)
+	}
+	assert.ElementsMatch(t, []string{"device", "other"}, subjects)
+}
+
+func TestCollect_NothingToProve(t *testing.T) {
+	dir := storeDir(t)
+	key := certtest.ECDSAKey(t)
+	ca := certtest.NewCA(t, "root")
+	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
+
+	tests := []struct {
+		name   string
+		store  Store
+		checks []*proto.Checks
+	}{
+		{"no checks", newFileStore(dir), nil},
+		{"files only", newFileStore(dir), []*proto.Checks{{Files: []string{"/bin/x"}}}},
+		{"challenge without nonce", newFileStore(dir), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{CaCertificates: []string{ca.PEM}}}}},
+		{"missing store dir", newFileStore(filepath.Join(dir, "missing")), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: make([]byte, certposture.NonceSize), CaCertificates: []string{ca.PEM}}}}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Nil(t, Collect(context.Background(), tt.store, tt.checks, peerKey))
+		})
+	}
+}
+
+func TestFileStore_ChainWithIntermediate(t *testing.T) {
+	root := certtest.NewCA(t, "root")
+	intermediate := certtest.NewIntermediate(t, root, "intermediate")
+	key := certtest.ECDSAKey(t)
+	leaf := intermediate.Issue(t, key, "device")
+
+	dir := storeDir(t)
+	writeFile(t, dir, "device.pem", certtest.CertPEM(leaf)+certtest.CertPEM(intermediate.Cert)+certtest.KeyPEM(t, key))
+
+	candidates, err := newFileStore(dir).Candidates(context.Background())
+	require.NoError(t, err)
+	require.Len(t, candidates, 1)
+	require.Len(t, candidates[0].Chain, 2)
+
+	roots, err := certposture.ParseCAs([]string{root.PEM})
+	require.NoError(t, err)
+	assert.NoError(t, certposture.VerifyChain(candidates[0].Chain, roots, time.Now()))
+}
+
+// storeDir is a PEM directory the store accepts: t.TempDir follows the umask, which
+// leaves the directory group-writable on systems with a user-private group umask.
+func storeDir(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(dir, 0o700))
+	return dir
+}
+
+func writeFile(t *testing.T, dir, name, content string) {
+	t.Helper()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte(content), 0o600))
+}
+
+func TestCollectChallenges_RefusesMalformedInput(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	dir := storeDir(t)
+	key := certtest.ECDSAKey(t)
+	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
+	store := newFileStore(dir)
+	nonce := certposture.NewChallenger([]byte("secret")).Nonce(peerKey, time.Now())
+
+	tests := []struct {
+		name    string
+		nonce   []byte
+		peerKey []byte
+		want    int
+	}{
+		{"issued nonce and peer key are signed", nonce, peerKey, 1},
+		{"short nonce is not signed", nonce[:8], peerKey, 0},
+		{"oversized nonce is not signed", append(append([]byte{}, nonce...), 0), peerKey, 0},
+		{"short peer key is not signed", nonce, peerKey[:16], 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			challenges := []*proto.CertificateChallenge{{Nonce: tt.nonce, CaCertificates: []string{ca.PEM}}}
+			assert.Len(t, CollectChallenges(context.Background(), store, challenges, tt.peerKey), tt.want,
+				"the device key signs only what management could have issued")
+		})
+	}
+}
+
+func TestFileStore_SkipsKeyOfAnotherCertificate(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	dir := storeDir(t)
+
+	// A stale key next to a renewed certificate, sorted before the good pair, must not
+	// produce a proof that management rejects and stop the search there.
+	writeFile(t, dir, "a-renewed.crt", certtest.CertPEM(ca.Issue(t, certtest.ECDSAKey(t), "renewed")))
+	writeFile(t, dir, "a-renewed.key", certtest.KeyPEM(t, certtest.ECDSAKey(t)))
+	goodKey := certtest.ECDSAKey(t)
+	good := ca.Issue(t, goodKey, "good")
+	writeFile(t, dir, "b-good.pem", certtest.CertPEM(good)+certtest.KeyPEM(t, goodKey))
+
+	candidates, err := newFileStore(dir).Candidates(context.Background())
+	require.NoError(t, err)
+	require.Len(t, candidates, 1, "only the certificate whose key matches is a candidate")
+	assert.True(t, good.Equal(candidates[0].Chain[0]), "the matching pair is kept")
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	now := time.Now()
+	nonce := challenger.Nonce(peerKey, now)
+	proofs := CollectChallenges(context.Background(), newFileStore(dir), []*proto.CertificateChallenge{{Nonce: nonce, CaCertificates: []string{ca.PEM}}}, peerKey)
+	require.Len(t, proofs, 1)
+	_, err = challenger.Verify(proofs[0], peerKey, now)
+	assert.NoError(t, err, "the proof sent is one management accepts")
+}
+
+// staticStore hands out fixed candidates, for scenarios no on-disk layout can express.
+type staticStore []Candidate
+
+func (s staticStore) Candidates(context.Context) ([]Candidate, error) { return s, nil }
+
+func TestCollectChallenges_RoutesAroundExpiredCopyOfRenewedIntermediate(t *testing.T) {
+	root := certtest.NewCA(t, "root")
+	intermediate := certtest.NewIntermediate(t, root, "issuing-ca")
+
+	// Renewing a CA with the same key pair leaves two certificates with the same
+	// subject and key in the store. The expired one sorts first here.
+	expiredTmpl := *intermediate.Cert
+	expiredTmpl.SerialNumber = big.NewInt(1)
+	expiredTmpl.NotBefore = time.Now().Add(-72 * time.Hour)
+	expiredTmpl.NotAfter = time.Now().Add(-48 * time.Hour)
+	der, err := x509.CreateCertificate(rand.Reader, &expiredTmpl, root.Cert, intermediate.Key.Public(), root.Key)
+	require.NoError(t, err)
+	expired, err := x509.ParseCertificate(der)
+	require.NoError(t, err)
+
+	key := certtest.ECDSAKey(t)
+	leaf := intermediate.Issue(t, key, "device")
+	pool := []*x509.Certificate{expired, intermediate.Cert}
+
+	chain := buildChain(leaf, pool)
+	require.Len(t, chain, 2)
+	require.True(t, expired.Equal(chain[1]), "precondition: the first-match chain runs through the expired copy")
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	now := time.Now()
+	nonce := challenger.Nonce(peerKey, now)
+	store := staticStore{{Chain: chain, Signer: key, Intermediates: pool}}
+
+	proofs := CollectChallenges(context.Background(), store, []*proto.CertificateChallenge{{Nonce: nonce, CaCertificates: []string{root.PEM}}}, peerKey)
+
+	require.Len(t, proofs, 1, "a valid path through the renewed intermediate exists, so the challenge is answered")
+	verified, err := challenger.Verify(proofs[0], peerKey, now)
+	require.NoError(t, err)
+	assert.True(t, intermediate.Cert.Equal(verified[1]), "the proof carries the valid intermediate, not the expired copy")
+	assert.True(t, certposture.ChainMatchesCAs(certposture.EncodeChainPEM(verified), []string{root.PEM}, now),
+		"management's own check accepts the chain the proof carries")
+}
+
+func TestCollectChallenges_ProvesALeafOncePerDistinctChain(t *testing.T) {
+	rootA := certtest.NewCA(t, "root-a")
+	rootB := certtest.NewCA(t, "root-b")
+	issuer := certtest.NewIntermediate(t, rootA, "issuing-ca")
+
+	// The same issuing CA cross-signed by a second root: one leaf, two valid paths.
+	crossTmpl := *issuer.Cert
+	crossTmpl.SerialNumber = big.NewInt(2)
+	der, err := x509.CreateCertificate(rand.Reader, &crossTmpl, rootB.Cert, issuer.Key.Public(), rootB.Key)
+	require.NoError(t, err)
+	cross, err := x509.ParseCertificate(der)
+	require.NoError(t, err)
+
+	key := certtest.ECDSAKey(t)
+	leaf := issuer.Issue(t, key, "device")
+	pool := []*x509.Certificate{issuer.Cert, cross}
+	store := staticStore{{Chain: buildChain(leaf, pool), Signer: key, Intermediates: pool}}
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	now := time.Now()
+	nonce := challenger.Nonce(peerKey, now)
+	challenges := []*proto.CertificateChallenge{
+		{Nonce: nonce, CaCertificates: []string{rootA.PEM}},
+		{Nonce: nonce, CaCertificates: []string{rootB.PEM}},
+		{Nonce: nonce, CaCertificates: []string{rootA.PEM}},
+	}
+
+	proofs := CollectChallenges(context.Background(), store, challenges, peerKey)
+
+	require.Len(t, proofs, 2, "one proof per distinct chain, the repeated root-a challenge reuses the first")
+	for _, root := range []*certtest.CA{rootA, rootB} {
+		matched := false
+		for _, p := range proofs {
+			chain, err := challenger.Verify(p, peerKey, now)
+			require.NoError(t, err)
+			matched = matched || certposture.ChainMatchesCAs(certposture.EncodeChainPEM(chain), []string{root.PEM}, now)
+		}
+		assert.True(t, matched, "management can match a chain for the check that trusts %s", root.Cert.Subject.CommonName)
+	}
+}
diff --git a/client/internal/certproof/collect_windows.go b/client/internal/certproof/collect_windows.go
new file mode 100644
index 000000000..3b21ec147
--- /dev/null
+++ b/client/internal/certproof/collect_windows.go
@@ -0,0 +1,108 @@
+package certproof
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"syscall"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const helperTimeout = 30 * time.Second
+
+// CollectProofs answers the certificate challenges in checks from every store this
+// machine can reach. The service reads the local machine store itself, where AD and
+// Intune enrol device certificates, and reaches the signed-in user's store by launching
+// a helper with that session's token. A machine at the sign-in screen therefore proves
+// device certificates alone.
+func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte, cfg Config) []certposture.Proof {
+	challenges := certificateChallenges(checks)
+	if len(challenges) == 0 {
+		logNoChallenges(checks)
+		return nil
+	}
+
+	proofs := CollectChallenges(ctx, DefaultStore(), challenges, peerKey)
+
+	// The helper already runs as the signed-in user, and an ordinary process has no
+	// right to a session token, so only the service goes looking for one.
+	if !runningAsLocalSystem() || cfg.OwnerUnknown {
+		return proofs
+	}
+
+	userProofs, err := collectAsDesktopUser(ctx, cfg.ProfileOwner, challenges, peerKey)
+	if err != nil {
+		log.Debugf("certificate posture: user certificate store unavailable: %v", err)
+	}
+	return mergeProofs(proofs, userProofs)
+}
+
+// UserContext identifies the session whose store a collection would include: a session
+// of the profile owner, or empty when no user store would be asked. A change means a
+// collection made earlier no longer reflects what this machine can prove.
+func UserContext(cfg Config) string {
+	if !runningAsLocalSystem() || cfg.OwnerUnknown {
+		return ""
+	}
+	user, ok := currentDesktopUser(cfg.ProfileOwner)
+	if !ok {
+		return ""
+	}
+	defer user.Close()
+	return fmt.Sprintf("%d:%s", user.Session, user.Name)
+}
+
+// helperStore is the store the helper reads. It runs as the signed-in user, so it wants
+// that user's store rather than the machine store the service already read.
+func helperStore() Store {
+	return newUserStore()
+}
+
+// collectAsDesktopUser runs the helper inside the interactive session of the signed-in
+// user. Unlike a keychain on macOS, a Windows service can assume a user identity
+// directly, so the session token goes straight into the child process.
+func collectAsDesktopUser(ctx context.Context, owner string, challenges []*proto.CertificateChallenge, peerKey []byte) ([]certposture.Proof, error) {
+	user, ok := currentDesktopUser(owner)
+	if !ok {
+		return nil, nil
+	}
+	defer user.Close()
+
+	binary, err := os.Executable()
+	if err != nil {
+		return nil, fmt.Errorf("resolve own binary: %w", err)
+	}
+
+	// The user's own environment, not the service's: the service environment may carry
+	// secrets such as a setup key that the signed-in user must not be able to read.
+	env, err := user.Token.Environ(false)
+	if err != nil {
+		return nil, fmt.Errorf("build environment of %s: %w", user.Name, err)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, helperTimeout)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, binary, "posture", "cert-proof")
+	cmd.Env = env
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Token:         syscall.Token(user.Token),
+		HideWindow:    true,
+		CreationFlags: windows.CREATE_NO_WINDOW,
+	}
+
+	log.Debugf("certificate posture: asking session %d to answer %d challenges", user.Session, len(challenges))
+	proofs, err := runHelperCmd(cmd, helperRequest(challenges, peerKey))
+	if err != nil {
+		return nil, fmt.Errorf("run helper in session %d: %w", user.Session, err)
+	}
+	log.Debugf("certificate posture: session %d returned %d proofs", user.Session, len(proofs))
+	return proofs, nil
+}
diff --git a/client/internal/certproof/collector.go b/client/internal/certproof/collector.go
new file mode 100644
index 000000000..2931f4b00
--- /dev/null
+++ b/client/internal/certproof/collector.go
@@ -0,0 +1,189 @@
+package certproof
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const (
+	collectTimeout = 45 * time.Second
+
+	// lostAfter is how many deadlines an abandoned collection is waited for before a new
+	// one may start beside it. A store that is merely slow finishes well within that and
+	// releases its slot; only one wedged for good is worked around.
+	lostAfter = 10
+
+	// maxInFlight bounds how many abandoned collections may pile up. A store that never
+	// answers would otherwise leak a goroutine on every collection for the life of the
+	// daemon.
+	maxInFlight = 2
+)
+
+// collectSlots tracks the collections running in the process. Collectors share one by
+// default: a collection abandoned in a token, TPM or keychain call keeps running after
+// the engine that started it has stopped, and the next engine must account for it.
+type collectSlots struct {
+	mu   sync.Mutex
+	next uint64
+	// running holds the start time of each collection still running, by slot id.
+	running map[uint64]time.Time
+}
+
+var processSlots collectSlots
+
+// Collector runs CollectProofs with a deadline and, in the normal case, one collection
+// at a time in the process. Token, TPM and keychain calls cannot be interrupted, and on
+// Linux there is not even a process to kill, so a collection that overruns is abandoned
+// rather than awaited. A single wedged call would then refuse every later collection for
+// the life of the daemon, so once an abandoned collection has been running for lostAfter
+// deadlines another may start beside it, up to maxInFlight. The zero value is ready to
+// use.
+type Collector struct {
+	// slots overrides the process-wide slots when set.
+	slots *collectSlots
+	// timeout overrides collectTimeout when set.
+	timeout time.Duration
+	// now overrides the clock when set.
+	now func() time.Time
+}
+
+// Collect answers the certificate challenges in checks, returning no proofs when there
+// are no challenges, when previous collections still hold the slots, or when this one
+// does not finish in time. Missing proofs fail the certificate check on management.
+func (c *Collector) Collect(ctx context.Context, checks []*proto.Checks, peerKey []byte, cfg Config) []certposture.Proof {
+	return c.collect(ctx, checks, func(ctx context.Context) []certposture.Proof {
+		return CollectProofs(ctx, checks, peerKey, cfg)
+	})
+}
+
+func (c *Collector) collect(ctx context.Context, checks []*proto.Checks, run func(context.Context) []certposture.Proof) []certposture.Proof {
+	if len(certificateChallenges(checks)) == 0 {
+		return nil
+	}
+	slots := c.slotsInUse()
+	slot, ok := slots.start(c.clock(), time.Duration(lostAfter)*c.deadline())
+	if !ok {
+		return nil
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, c.deadline())
+	defer cancel()
+
+	done := make(chan []certposture.Proof, 1)
+	go func() {
+		// The slot is freed before the result is delivered, so a caller that starts the
+		// next collection right after this one returned is not turned away.
+		proofs := run(ctx)
+		slots.finish(slot)
+		done <- proofs
+	}()
+
+	select {
+	case proofs := <-done:
+		return proofs
+	case <-ctx.Done():
+		log.Warnf("certificate posture: proof collection did not finish within %s, sending no proofs", c.deadline())
+		return nil
+	}
+}
+
+// Stuck reports whether lost collections hold every slot. No collection starts again
+// until one of them returns, which for a store that never answers means a restart.
+func (c *Collector) Stuck() bool {
+	return c.slotsInUse().allLost(c.clock(), time.Duration(lostAfter)*c.deadline())
+}
+
+func (c *Collector) slotsInUse() *collectSlots {
+	if c.slots != nil {
+		return c.slots
+	}
+	return &processSlots
+}
+
+func (c *Collector) clock() time.Time {
+	if c.now != nil {
+		return c.now()
+	}
+	return time.Now()
+}
+
+func (c *Collector) deadline() time.Duration {
+	if c.timeout > 0 {
+		return c.timeout
+	}
+	return collectTimeout
+}
+
+// start claims a slot at now, reporting its id and whether the caller may collect. A
+// collection that has held a slot for lost is taken to be wedged.
+func (s *collectSlots) start(now time.Time, lost time.Duration) (uint64, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if len(s.running) > 0 {
+		oldest := s.oldest()
+		switch {
+		case len(s.running) >= maxInFlight:
+			log.Warnf("certificate posture: %d proof collections are wedged, sending no proofs", len(s.running))
+			return 0, false
+		case now.Sub(oldest) < lost:
+			log.Warnf("certificate posture: previous proof collection is still running, sending no proofs")
+			return 0, false
+		default:
+			log.Warnf("certificate posture: a proof collection has been stuck since %s, starting another", oldest.Format(time.RFC3339))
+		}
+	}
+	if s.running == nil {
+		s.running = make(map[uint64]time.Time, maxInFlight)
+	}
+	s.next++
+	s.running[s.next] = now
+	return s.next, true
+}
+
+// finish releases the slot with the given id.
+func (s *collectSlots) finish(slot uint64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.running, slot)
+}
+
+// allLost reports whether every slot is held by a collection that has run for lost.
+func (s *collectSlots) allLost(now time.Time, lost time.Duration) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if len(s.running) < maxInFlight {
+		return false
+	}
+	for _, started := range s.running {
+		if now.Sub(started) < lost {
+			return false
+		}
+	}
+	return true
+}
+
+// idle reports whether no collection is running.
+func (s *collectSlots) idle() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.running) == 0
+}
+
+// oldest returns the start time of the longest-running collection. The caller holds mu
+// and has checked that one is running.
+func (s *collectSlots) oldest() time.Time {
+	var oldest time.Time
+	for _, started := range s.running {
+		if oldest.IsZero() || started.Before(oldest) {
+			oldest = started
+		}
+	}
+	return oldest
+}
diff --git a/client/internal/certproof/collector_test.go b/client/internal/certproof/collector_test.go
new file mode 100644
index 000000000..a28c47da2
--- /dev/null
+++ b/client/internal/certproof/collector_test.go
@@ -0,0 +1,207 @@
+package certproof
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+var challengeChecks = []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{
+	Nonce: certposture.NewChallenger([]byte("secret")).Nonce(peerKey, time.Now()),
+}}}
+
+func TestCollector_SkipsChecksWithoutChallenges(t *testing.T) {
+	var c Collector
+	called := false
+
+	proofs := c.collect(context.Background(), []*proto.Checks{{Files: []string{"/bin/agent"}}}, func(context.Context) []certposture.Proof {
+		called = true
+		return nil
+	})
+
+	assert.Nil(t, proofs)
+	assert.False(t, called, "no store is touched when no check carries a challenge")
+}
+
+func TestCollector_ReturnsProofs(t *testing.T) {
+	var c Collector
+	want := []certposture.Proof{{Nonce: []byte("nonce")}}
+
+	proofs := c.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof { return want })
+
+	assert.Equal(t, want, proofs, "a collection that finishes in time is returned as is")
+}
+
+func TestCollector_AbandonsStuckCollection(t *testing.T) {
+	c := Collector{timeout: 50 * time.Millisecond, slots: &collectSlots{}}
+	release := make(chan struct{})
+	finished := make(chan struct{})
+
+	// A token or keychain call that ignores its context and blocks well past the deadline.
+	stuck := func(context.Context) []certposture.Proof {
+		defer close(finished)
+		<-release
+		return []certposture.Proof{{Nonce: []byte("late")}}
+	}
+
+	start := time.Now()
+	proofs := c.collect(context.Background(), challengeChecks, stuck)
+	assert.Nil(t, proofs, "an overrunning collection yields no proofs")
+	assert.Less(t, time.Since(start), time.Second, "the caller is released at the deadline, not when the call returns")
+
+	called := false
+	proofs = c.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof {
+		called = true
+		return nil
+	})
+	assert.Nil(t, proofs)
+	assert.False(t, called, "no second collection starts while the first is still running")
+
+	close(release)
+	<-finished
+	require.Eventually(t, func() bool { return c.slots.idle() }, time.Second, 5*time.Millisecond, "the collector frees up once the stuck call returns")
+
+	want := []certposture.Proof{{Nonce: []byte("nonce")}}
+	assert.Equal(t, want, c.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof { return want }),
+		"collection works again after the stuck call returned")
+}
+
+func TestCollector_CancelsContextAtDeadline(t *testing.T) {
+	c := Collector{timeout: 20 * time.Millisecond, slots: &collectSlots{}}
+	cancelled := make(chan struct{})
+
+	c.collect(context.Background(), challengeChecks, func(ctx context.Context) []certposture.Proof {
+		<-ctx.Done()
+		close(cancelled)
+		return nil
+	})
+
+	select {
+	case <-cancelled:
+	case <-time.After(time.Second):
+		t.Fatal("a collection that honours its context, like the helper process, must see it cancelled")
+	}
+}
+
+// TestCollector_SingleFlightAcrossCollectors: each engine has its own Collector, and a
+// collection stuck in a token call outlives the engine that started it, so the next
+// engine's Collector must not start another one until it has finished.
+func TestCollector_SingleFlightAcrossCollectors(t *testing.T) {
+	shared := &collectSlots{}
+	first := Collector{timeout: 20 * time.Millisecond, slots: shared}
+	second := Collector{timeout: time.Second, slots: shared}
+
+	release := make(chan struct{})
+	stuck := func(context.Context) []certposture.Proof {
+		<-release
+		return nil
+	}
+	assert.Nil(t, first.collect(context.Background(), challengeChecks, stuck), "the first collection is abandoned at its deadline")
+
+	called := false
+	proofs := second.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof {
+		called = true
+		return []certposture.Proof{{}}
+	})
+	assert.Nil(t, proofs, "no proofs while the abandoned collection still runs")
+	assert.False(t, called, "a second collection does not start on top of the abandoned one")
+
+	close(release)
+	require.Eventually(t, func() bool { return shared.idle() }, time.Second, 5*time.Millisecond)
+	assert.Len(t, second.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof { return []certposture.Proof{{}} }), 1,
+		"collections resume once the abandoned one finished")
+}
+
+// TestCollector_ZeroValuesShareTheProcessFlag: the zero value uses the process-wide flag.
+func TestCollector_ZeroValuesShareTheProcessFlag(t *testing.T) {
+	var a, b Collector
+	assert.Same(t, a.slotsInUse(), b.slotsInUse(), "separate Collectors share the process slots")
+}
+
+// TestCollector_LostCollectionDoesNotBlockForever: a store call that never answers, such
+// as a wedged token on Linux where there is no process to kill, must not refuse every
+// later collection. Once it has run for lostAfter deadlines another starts beside it,
+// and no more than maxInFlight ever run.
+func TestCollector_LostCollectionDoesNotBlockForever(t *testing.T) {
+	now := time.Now()
+	slots := &collectSlots{}
+	c := Collector{timeout: 10 * time.Millisecond, slots: slots, now: func() time.Time { return now }}
+
+	release := make(chan struct{})
+	defer close(release)
+	var started atomic.Int32
+	wedged := func(context.Context) []certposture.Proof {
+		started.Add(1)
+		<-release
+		return nil
+	}
+
+	c.collect(context.Background(), challengeChecks, wedged)
+	waitStarted(t, &started, 1)
+	c.collect(context.Background(), challengeChecks, wedged)
+	assert.Equal(t, int32(1), started.Load(), "a second collection is refused while the first may still finish")
+	assert.False(t, c.Stuck(), "one slow collection is not stuck yet")
+
+	now = now.Add(time.Duration(lostAfter) * c.deadline())
+	c.collect(context.Background(), challengeChecks, wedged)
+	waitStarted(t, &started, 2)
+	assert.False(t, c.Stuck(), "the second collection may still return, so the collector is not stuck yet")
+
+	now = now.Add(time.Duration(lostAfter) * c.deadline())
+	c.collect(context.Background(), challengeChecks, wedged)
+	assert.Equal(t, int32(2), started.Load(), "no more than maxInFlight collections run")
+	assert.True(t, c.Stuck(), "with every slot held by a lost collection the collector reports itself stuck")
+}
+
+// TestCollector_LostWindowFollowsTheOldestRunningCollection: A wedges, B starts beside it
+// once A counts as lost, then A returns. B is recent, so a third collection must wait for
+// B to be lost in its own right rather than inherit A's start time.
+func TestCollector_LostWindowFollowsTheOldestRunningCollection(t *testing.T) {
+	now := time.Now()
+	slots := &collectSlots{}
+	c := Collector{timeout: 10 * time.Millisecond, slots: slots, now: func() time.Time { return now }}
+	lost := time.Duration(lostAfter) * c.deadline()
+
+	releaseA := make(chan struct{})
+	releaseB := make(chan struct{})
+	defer close(releaseB)
+	var started atomic.Int32
+	blockOn := func(release chan struct{}) func(context.Context) []certposture.Proof {
+		return func(context.Context) []certposture.Proof {
+			started.Add(1)
+			<-release
+			return nil
+		}
+	}
+
+	c.collect(context.Background(), challengeChecks, blockOn(releaseA))
+	waitStarted(t, &started, 1)
+	now = now.Add(lost)
+	c.collect(context.Background(), challengeChecks, blockOn(releaseB))
+	waitStarted(t, &started, 2)
+
+	close(releaseA)
+	require.Eventually(t, func() bool {
+		slots.mu.Lock()
+		defer slots.mu.Unlock()
+		return len(slots.running) == 1
+	}, time.Second, 5*time.Millisecond, "A frees its slot once it returns")
+
+	c.collect(context.Background(), challengeChecks, blockOn(make(chan struct{})))
+	assert.Equal(t, int32(2), started.Load(), "a third collection waits while B is recent")
+}
+
+// waitStarted waits for the collections the test launched to have started. collect may
+// return at its deadline before the goroutine running the store call was scheduled.
+func waitStarted(t *testing.T, started *atomic.Int32, n int32) {
+	t.Helper()
+	require.Eventually(t, func() bool { return started.Load() == n }, time.Second, time.Millisecond,
+		"%d collections should have started", n)
+}
diff --git a/client/internal/certproof/consoleuser_darwin.go b/client/internal/certproof/consoleuser_darwin.go
new file mode 100644
index 000000000..1045bc014
--- /dev/null
+++ b/client/internal/certproof/consoleuser_darwin.go
@@ -0,0 +1,123 @@
+//go:build !ios
+
+package certproof
+
+import (
+	"bytes"
+	"fmt"
+	"strconv"
+	"sync"
+
+	"github.com/ebitengine/purego"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	systemConfigurationFramework = "/System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration"
+
+	encodingUTF8       = 0x08000100
+	consoleNameBufSize = 256
+)
+
+var (
+	consoleOnce sync.Once
+	consoleErr  error
+
+	scDynamicStoreCopyConsoleUser func(store uintptr, uid, gid *uint32) uintptr
+	cfStringGetCString            func(str uintptr, buffer *byte, size int, encoding uint32) bool
+)
+
+// ConsoleUser is the account whose desktop session owns the display. Its login keychain
+// is the only user keychain a NetBird daemon can reach, and only while it is logged in.
+type ConsoleUser struct {
+	Name string
+	UID  uint32
+	GID  uint32
+}
+
+// currentConsoleUser reports the user sitting at the desktop. The second return value is
+// false when nobody is: at the login window macOS either reports no console user at all
+// or attributes the session to root, and neither has a login keychain to offer.
+func currentConsoleUser() (ConsoleUser, bool) {
+	if err := loadConsoleUser(); err != nil {
+		log.Debugf("console user lookup unavailable: %v", err)
+		return ConsoleUser{}, false
+	}
+
+	var uid, gid uint32
+	name := scDynamicStoreCopyConsoleUser(0, &uid, &gid)
+	if name == 0 {
+		log.Debug("no console user is logged in, no login keychain is reachable")
+		return ConsoleUser{}, false
+	}
+	defer release(name)
+
+	user := ConsoleUser{Name: cfString(name), UID: uid, GID: gid}
+	if !user.hasDesktop() {
+		log.Debugf("console session belongs to %q uid=%d, which is not a desktop login, no login keychain is reachable", user.Name, user.UID)
+		return ConsoleUser{}, false
+	}
+	return user, true
+}
+
+// hasDesktop reports whether the console session is a real user desktop. The login
+// window runs as root and some macOS releases name it "loginwindow" instead.
+func (u ConsoleUser) hasDesktop() bool {
+	switch u.Name {
+	case "", "root", "loginwindow":
+		return false
+	}
+	return u.UID != 0
+}
+
+// isOwner reports whether the console user is owner, the account of the active profile,
+// which is recorded as a short user name or, for an account without one, a numeric uid.
+// With no owner the console user counts, as macOS has a single console user.
+func (u ConsoleUser) isOwner(owner string) bool {
+	return owner == "" || owner == u.Name || owner == strconv.FormatUint(uint64(u.UID), 10)
+}
+
+func cfString(str uintptr) string {
+	buf := make([]byte, consoleNameBufSize)
+	if !cfStringGetCString(str, &buf[0], len(buf), encodingUTF8) {
+		return ""
+	}
+	if end := bytes.IndexByte(buf, 0); end >= 0 {
+		return string(buf[:end])
+	}
+	return string(buf)
+}
+
+// loadConsoleUser resolves the console user symbols. It loads the keychain bindings
+// first because CFRelease is resolved there and released strings depend on it.
+func loadConsoleUser() error {
+	if err := loadKeychain(); err != nil {
+		return err
+	}
+	consoleOnce.Do(func() { consoleErr = resolveConsoleUser() })
+	return consoleErr
+}
+
+func resolveConsoleUser() error {
+	systemConfiguration, err := purego.Dlopen(systemConfigurationFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", systemConfigurationFramework, err)
+	}
+	coreFoundation, err := purego.Dlopen(coreFoundationFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", coreFoundationFramework, err)
+	}
+
+	symbol, err := purego.Dlsym(systemConfiguration, "SCDynamicStoreCopyConsoleUser")
+	if err != nil {
+		return fmt.Errorf("resolve SCDynamicStoreCopyConsoleUser: %w", err)
+	}
+	purego.RegisterFunc(&scDynamicStoreCopyConsoleUser, symbol)
+
+	symbol, err = purego.Dlsym(coreFoundation, "CFStringGetCString")
+	if err != nil {
+		return fmt.Errorf("resolve CFStringGetCString: %w", err)
+	}
+	purego.RegisterFunc(&cfStringGetCString, symbol)
+	return nil
+}
diff --git a/client/internal/certproof/consoleuser_darwin_test.go b/client/internal/certproof/consoleuser_darwin_test.go
new file mode 100644
index 000000000..051cc4ab0
--- /dev/null
+++ b/client/internal/certproof/consoleuser_darwin_test.go
@@ -0,0 +1,51 @@
+//go:build !ios
+
+package certproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestConsoleUser_OnlyADesktopSessionCanBeValidated(t *testing.T) {
+	tests := []struct {
+		name    string
+		user    ConsoleUser
+		desktop bool
+	}{
+		{"logged in user", ConsoleUser{Name: "maycon", UID: 501, GID: 20}, true},
+		{"login window as root", ConsoleUser{Name: "root", UID: 0}, false},
+		{"login window by name", ConsoleUser{Name: "loginwindow", UID: 0}, false},
+		{"named user still at uid 0", ConsoleUser{Name: "admin", UID: 0}, false},
+		{"no console user", ConsoleUser{}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.desktop, tt.user.hasDesktop(), "only a real desktop session offers a login keychain")
+		})
+	}
+}
+
+// currentConsoleUser runs against the real SystemConfiguration framework. A machine with
+// a desktop open must report a non-root user; a headless runner must report none.
+func TestCurrentConsoleUser_AgreesWithItself(t *testing.T) {
+	user, ok := currentConsoleUser()
+	if !ok {
+		t.Log("no console user, running headless")
+		return
+	}
+	assert.NotEmpty(t, user.Name, "a console user must have a name")
+	assert.NotZero(t, user.UID, "a desktop session never belongs to uid 0")
+	assert.True(t, user.hasDesktop(), "a reported console user must be a desktop session")
+}
+
+func TestConsoleUser_IsOwner(t *testing.T) {
+	user := ConsoleUser{Name: "maycon", UID: 501, GID: 20}
+
+	assert.True(t, user.isOwner(""), "a profile without owner accepts the single console user")
+	assert.True(t, user.isOwner("maycon"), "the owner by short name")
+	assert.True(t, user.isOwner("501"), "the owner recorded as a numeric uid")
+	assert.False(t, user.isOwner("viktor"), "another account's profile must not read this user's keychain")
+	assert.False(t, user.isOwner("502"), "another uid is another account")
+}
diff --git a/client/internal/certproof/desktopuser_windows.go b/client/internal/certproof/desktopuser_windows.go
new file mode 100644
index 000000000..0a9d63b36
--- /dev/null
+++ b/client/internal/certproof/desktopuser_windows.go
@@ -0,0 +1,182 @@
+package certproof
+
+import (
+	"fmt"
+	"strings"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+const (
+	noActiveSession = 0xFFFFFFFF
+	servicesSession = 0
+
+	// wtsCurrentServer is WTS_CURRENT_SERVER_HANDLE, which x/sys/windows does not export.
+	wtsCurrentServer = windows.Handle(0)
+)
+
+// DesktopUser is an interactive session and the account signed into it. The user's
+// certificate store is readable only from a process running as that account, because
+// its private keys are protected against the user profile rather than the machine.
+type DesktopUser struct {
+	Session uint32
+	Name    string
+	Token   windows.Token
+}
+
+// Close releases the session token.
+func (u DesktopUser) Close() {
+	if err := u.Token.Close(); err != nil {
+		log.Debugf("failed closing desktop session token: %v", err)
+	}
+}
+
+// currentDesktopUser returns a token for the session whose certificate store should be
+// asked: a session of owner, the account the active profile belongs to, with the
+// physical console preferred over remote sessions. With no owner only the console user
+// counts. Picking any signed-in user instead would let whoever else is logged in to a
+// terminal server or VDI host decide the result. The second return is false when no
+// such session exists, and only machine certificates can then be proven.
+//
+// Obtaining the token needs SE_TCB_NAME, which the LocalSystem service has and an
+// ordinary process does not.
+func currentDesktopUser(owner string) (DesktopUser, bool) {
+	console := windows.WTSGetActiveConsoleSessionId()
+	if owner == "" {
+		return consoleUser(console)
+	}
+
+	sessions, err := userSessions(console)
+	if err != nil {
+		log.Debugf("cannot enumerate terminal sessions: %v", err)
+		return DesktopUser{}, false
+	}
+	var found DesktopUser
+	var ok bool
+	for _, session := range sessions {
+		user, signedIn := desktopUser(session)
+		if !signedIn {
+			continue
+		}
+		switch {
+		case !sameAccountName(user.Name, owner):
+			user.Close()
+		case !ok:
+			found, ok = user, true
+		case strings.EqualFold(user.Name, found.Name):
+			// Another session of the same account; the first one in preference order wins.
+			user.Close()
+		default:
+			// An owner recorded without a domain matches accounts of several domains here.
+			// Picking one would let another domain's user answer for the owner.
+			log.Debugf("certificate posture: profile owner %s matches both %s and %s, no user certificate store is used", owner, found.Name, user.Name)
+			user.Close()
+			found.Close()
+			return DesktopUser{}, false
+		}
+	}
+	if !ok {
+		log.Debugf("certificate posture: profile owner %s has no signed-in session, no user certificate store is reachable", owner)
+	}
+	return found, ok
+}
+
+func consoleUser(console uint32) (DesktopUser, bool) {
+	if console == noActiveSession || console == servicesSession {
+		log.Debug("no console session, no user certificate store is reachable")
+		return DesktopUser{}, false
+	}
+	user, ok := desktopUser(console)
+	if !ok {
+		log.Debugf("console session %d has nobody signed in, no user certificate store is reachable", console)
+	}
+	return user, ok
+}
+
+// sameAccountName compares DOMAIN\account names case-insensitively, as Windows does, and an
+// owner given without a domain against the account part alone. The session side comes from
+// the session token's own SID, which Windows resolves from its cache of signed-in users.
+// Resolving the owner name to a SID instead would ask the domain controller, which on a
+// laptop that cannot reach it yet blocks for tens of seconds, past the collection deadline.
+func sameAccountName(sessionName, owner string) bool {
+	if strings.EqualFold(sessionName, owner) {
+		return true
+	}
+	if strings.Contains(owner, `\`) {
+		return false
+	}
+	_, account, found := strings.Cut(sessionName, `\`)
+	return found && strings.EqualFold(account, owner)
+}
+
+func desktopUser(session uint32) (DesktopUser, bool) {
+	var token windows.Token
+	if err := windows.WTSQueryUserToken(session, &token); err != nil {
+		log.Debugf("no user token for session %d: %v", session, err)
+		return DesktopUser{}, false
+	}
+
+	name, err := tokenAccount(token)
+	if err != nil {
+		log.Debugf("session %d token has no readable account: %v", session, err)
+		if closeErr := token.Close(); closeErr != nil {
+			log.Debugf("failed closing session token: %v", closeErr)
+		}
+		return DesktopUser{}, false
+	}
+	return DesktopUser{Session: session, Name: name, Token: token}, true
+}
+
+func tokenAccount(token windows.Token) (string, error) {
+	user, err := token.GetTokenUser()
+	if err != nil {
+		return "", fmt.Errorf("read token user: %w", err)
+	}
+	account, domain, _, err := user.User.Sid.LookupAccount("")
+	if err != nil {
+		return "", fmt.Errorf("look up account: %w", err)
+	}
+	if domain == "" {
+		return account, nil
+	}
+	return domain + `\` + account, nil
+}
+
+// userSessions lists the sessions a user can be signed in to, console first, then
+// active remote sessions, then disconnected ones, whose user is still signed in. Session
+// 0 is skipped: it hosts services and never belongs to an interactive user.
+func userSessions(console uint32) ([]uint32, error) {
+	var info *windows.WTS_SESSION_INFO
+	var count uint32
+	if err := windows.WTSEnumerateSessions(wtsCurrentServer, 0, 1, &info, &count); err != nil {
+		return nil, fmt.Errorf("enumerate sessions: %w", err)
+	}
+	defer windows.WTSFreeMemory(uintptr(unsafe.Pointer(info)))
+
+	var sessions []uint32
+	if console != noActiveSession && console != servicesSession {
+		sessions = append(sessions, console)
+	}
+	for _, state := range []uint32{windows.WTSActive, windows.WTSDisconnected} {
+		for _, session := range unsafe.Slice(info, count) {
+			if session.SessionID == servicesSession || session.SessionID == console || session.State != state {
+				continue
+			}
+			sessions = append(sessions, session.SessionID)
+		}
+	}
+	return sessions, nil
+}
+
+// runningAsLocalSystem reports whether this process is the service. The helper runs as
+// the signed-in user and must read its own store rather than launching another helper.
+func runningAsLocalSystem() bool {
+	user, err := windows.GetCurrentProcessToken().GetTokenUser()
+	if err != nil {
+		log.Debugf("failed reading own token user: %v", err)
+		return false
+	}
+	return user.User.Sid.IsWellKnown(windows.WinLocalSystemSid)
+}
diff --git a/client/internal/certproof/desktopuser_windows_test.go b/client/internal/certproof/desktopuser_windows_test.go
new file mode 100644
index 000000000..c3c4022e5
--- /dev/null
+++ b/client/internal/certproof/desktopuser_windows_test.go
@@ -0,0 +1,61 @@
+package certproof
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSameAccountName(t *testing.T) {
+	tests := []struct {
+		session, owner string
+		want           bool
+	}{
+		{`CORP\alice`, `CORP\alice`, true},
+		{`CORP\alice`, `corp\ALICE`, true},
+		{`CORP\alice`, `alice`, true},
+		{`CORP\alice`, `OTHER\alice`, false},
+		{`CORP\alice`, `bob`, false},
+		{`alice`, `alice`, true},
+		{`CORP\alice`, `CORP\alic`, false},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, sameAccountName(tt.session, tt.owner), "session %q, owner %q", tt.session, tt.owner)
+	}
+}
+
+// currentDesktopUser against the real session manager: an owner no session belongs to
+// must never yield a session, whoever else is signed in.
+func TestCurrentDesktopUser_UnknownOwnerHasNoSession(t *testing.T) {
+	user, ok := currentDesktopUser(`NO-SUCH-DOMAIN\no-such-user-netbird`)
+	if ok {
+		user.Close()
+	}
+	assert.False(t, ok, "a profile owner without a session must not borrow another user's store")
+}
+
+// TestCurrentDesktopUser_FindsTheOwnersSession runs against a real machine as LocalSystem,
+// with NB_TEST_DESKTOP_OWNER naming an account that is signed in. That account's session
+// must be found, and only that account's.
+func TestCurrentDesktopUser_FindsTheOwnersSession(t *testing.T) {
+	owner := os.Getenv("NB_TEST_DESKTOP_OWNER")
+	if owner == "" {
+		t.Skip("set NB_TEST_DESKTOP_OWNER to a signed-in account and run as LocalSystem")
+	}
+	user, ok := currentDesktopUser(owner)
+	require.True(t, ok, "the signed-in owner %s must have a session", owner)
+	defer user.Close()
+	t.Logf("owner %s resolved to session %d as %s", owner, user.Session, user.Name)
+	assert.True(t, sameAccountName(user.Name, owner), "the session found belongs to %s, not %s", owner, user.Name)
+	assert.NotZero(t, user.Session, "session 0 hosts services and never belongs to the owner")
+
+	console, consoleOK := currentDesktopUser("")
+	if consoleOK {
+		defer console.Close()
+		t.Logf("without an owner the console user counts: session %d as %s", console.Session, console.Name)
+	} else {
+		t.Log("without an owner nobody counts: no user at the console")
+	}
+}
diff --git a/client/internal/certproof/doc.go b/client/internal/certproof/doc.go
new file mode 100644
index 000000000..c8dc62f0c
--- /dev/null
+++ b/client/internal/certproof/doc.go
@@ -0,0 +1,26 @@
+// Package certproof answers certificate posture challenges: it finds the certificates a
+// peer holds a private key for and signs the challenge nonce, bound to the peer's
+// WireGuard key, with that key. Management verifies the signature and the chain against
+// the CAs of the check, so only a holder of the key passes and a proof made for one peer
+// cannot be replayed by another. Keys in the OS stores, the TPM and a PKCS#11 token are
+// used through the platform, which signs; a plain PEM key file is the exception, parsed
+// and used in the daemon's memory.
+//
+// Machine stores are read by the daemon itself: the Windows LocalMachine store, the macOS
+// System keychain, and on Linux a directory of PEM files, TSS2 key files the TPM signs
+// with, and a PKCS#11 token. On Linux the directory and the token URI come from the
+// daemon's environment (NB_CERT_STORE_DIR, NB_CERT_PKCS11_URI), as does the token PIN
+// (NB_TPM_PIN); none of them is read from the profile config.
+//
+// User stores cannot be read by a privileged daemon, so it starts this binary as
+// "netbird posture cert-proof" inside the user's session and receives only signatures
+// and chains on its stdout. On macOS uid is not what unlocks a login keychain, the
+// session's bootstrap namespace is, which is why the helper enters it through launchctl
+// asuser. On Windows a service opening CURRENT_USER silently reads its own empty hive, so
+// the helper runs with the session's token instead. Its output is untrusted: sizes are
+// capped and only proofs for requested nonces are kept.
+//
+// A user proof shows that some process in that user's session could use a key whose
+// certificate chains to the CA. It does not show which binary signed, or that the key is
+// hardware-bound; device stores are the stronger signal.
+package certproof
diff --git a/client/internal/certproof/helper.go b/client/internal/certproof/helper.go
new file mode 100644
index 000000000..81a72ac70
--- /dev/null
+++ b/client/internal/certproof/helper.go
@@ -0,0 +1,66 @@
+package certproof
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// HelperRequest is the work the daemon hands to a helper running in a user session. The
+// peer key binds every signature to this machine, so a proof cannot be replayed onto
+// another peer.
+type HelperRequest struct {
+	PeerKey    []byte            `json:"peerKey"`
+	Challenges []HelperChallenge `json:"challenges"`
+}
+
+// HelperChallenge is one certificate challenge in the form the helper needs.
+type HelperChallenge struct {
+	Nonce          []byte   `json:"nonce"`
+	CACertificates []string `json:"caCertificates"`
+}
+
+// HelperResponse carries the proofs the helper produced from its own keychain.
+type HelperResponse struct {
+	Proofs []certposture.Proof `json:"proofs"`
+}
+
+// RunHelper answers the challenges on in from the store of the user running this
+// process and writes the proofs to out. It is the child half of the console user
+// lookup: the daemon cannot read a login keychain, so it launches this in the user's
+// session instead. Only the signature crosses back, never the private key.
+func RunHelper(ctx context.Context, in io.Reader, out io.Writer) error {
+	return runHelper(ctx, helperStore(), in, out)
+}
+
+func runHelper(ctx context.Context, store Store, in io.Reader, out io.Writer) error {
+	var req HelperRequest
+	if err := json.NewDecoder(in).Decode(&req); err != nil {
+		return fmt.Errorf("decode helper request: %w", err)
+	}
+
+	challenges := make([]*proto.CertificateChallenge, 0, len(req.Challenges))
+	for _, challenge := range req.Challenges {
+		challenges = append(challenges, &proto.CertificateChallenge{
+			Nonce:          challenge.Nonce,
+			CaCertificates: challenge.CACertificates,
+		})
+	}
+
+	var proofs []certposture.Proof
+	if len(challenges) > 0 {
+		proofs = CollectChallenges(ctx, store, challenges, req.PeerKey)
+	}
+	log.Debugf("certificate posture helper: answering %d challenges with %d proofs", len(challenges), len(proofs))
+
+	if err := json.NewEncoder(out).Encode(HelperResponse{Proofs: proofs}); err != nil {
+		return fmt.Errorf("encode helper response: %w", err)
+	}
+	return nil
+}
diff --git a/client/internal/certproof/helper_backoff.go b/client/internal/certproof/helper_backoff.go
new file mode 100644
index 000000000..3372b026b
--- /dev/null
+++ b/client/internal/certproof/helper_backoff.go
@@ -0,0 +1,78 @@
+package certproof
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// helperQuietPeriod is how long a user whose helper proved nothing is not asked again
+// for the same CAs. On macOS each helper run may show a keychain prompt, so retrying on
+// every collection would put up a new one each time the user ignored or denied the last.
+const helperQuietPeriod = time.Hour
+
+// helperBackoff remembers, per user and set of CAs asked about, until when the helper
+// is not launched again because its last run proved nothing.
+type helperBackoff struct {
+	mu    sync.Mutex
+	until map[string]time.Time
+}
+
+func newHelperBackoff() *helperBackoff {
+	return &helperBackoff{until: map[string]time.Time{}}
+}
+
+// allow reports whether the helper may be launched for key now.
+func (b *helperBackoff) allow(key string, now time.Time) bool {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return !now.Before(b.until[key])
+}
+
+// record stores the outcome of a helper run for key: one that proved something clears
+// the back-off, one that proved nothing starts it. Expired entries are dropped, so the
+// map holds only users currently held off.
+func (b *helperBackoff) record(key string, proven bool, now time.Time) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	for other, until := range b.until {
+		if !now.Before(until) {
+			delete(b.until, other)
+		}
+	}
+	if proven {
+		delete(b.until, key)
+		return
+	}
+	b.until[key] = now.Add(helperQuietPeriod)
+}
+
+// helperBackoffKey identifies a user and the set of CAs the challenges accept, in any
+// order, leaving out the nonces, which rotate without changing what the user is asked to
+// prove.
+func helperBackoffKey(user string, challenges []*proto.CertificateChallenge) string {
+	sets := make([]string, 0, len(challenges))
+	for _, challenge := range challenges {
+		cas := make([]string, 0, len(challenge.GetCaCertificates()))
+		for _, ca := range challenge.GetCaCertificates() {
+			sum := sha256.Sum256([]byte(ca))
+			cas = append(cas, hex.EncodeToString(sum[:]))
+		}
+		slices.Sort(cas)
+		sets = append(sets, strings.Join(cas, ","))
+	}
+	slices.Sort(sets)
+
+	h := sha256.New()
+	h.Write([]byte(user))
+	for _, set := range sets {
+		h.Write([]byte{0})
+		h.Write([]byte(set))
+	}
+	return hex.EncodeToString(h.Sum(nil))
+}
diff --git a/client/internal/certproof/helper_backoff_test.go b/client/internal/certproof/helper_backoff_test.go
new file mode 100644
index 000000000..0d3cafea1
--- /dev/null
+++ b/client/internal/certproof/helper_backoff_test.go
@@ -0,0 +1,69 @@
+package certproof
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// TestHelperBackoff: a user whose helper proved nothing, for one ignoring or denying a
+// keychain prompt, is not asked again for the same CAs within the quiet period, while a
+// success or other CAs are asked at once.
+func TestHelperBackoff(t *testing.T) {
+	now := time.Now()
+	b := newHelperBackoff()
+	key := helperBackoffKey("501", []*proto.CertificateChallenge{{CaCertificates: []string{"ca-a"}}})
+
+	assert.True(t, b.allow(key, now), "a user never asked is asked")
+
+	b.record(key, false, now)
+	assert.False(t, b.allow(key, now.Add(helperQuietPeriod-time.Second)), "no new prompt within the quiet period")
+	assert.True(t, b.allow(key, now.Add(helperQuietPeriod)), "asked again once the quiet period passed")
+
+	other := helperBackoffKey("501", []*proto.CertificateChallenge{{CaCertificates: []string{"ca-b"}}})
+	assert.True(t, b.allow(other, now), "a check for other CAs is asked at once")
+	assert.True(t, b.allow(helperBackoffKey("502", []*proto.CertificateChallenge{{CaCertificates: []string{"ca-a"}}}), now), "another user is asked at once")
+
+	b.record(key, true, now)
+	assert.True(t, b.allow(key, now), "a run that proved something clears the quiet period")
+}
+
+// TestHelperBackoffKey_IgnoresNonces: nonces rotate every window without changing what
+// the user is asked to prove, so they do not reset the quiet period.
+func TestHelperBackoffKey_IgnoresNonces(t *testing.T) {
+	a := helperBackoffKey("501", []*proto.CertificateChallenge{{Nonce: []byte("one"), CaCertificates: []string{"ca"}}})
+	b := helperBackoffKey("501", []*proto.CertificateChallenge{{Nonce: []byte("two"), CaCertificates: []string{"ca"}}})
+	assert.Equal(t, a, b, "the key does not depend on the nonce")
+}
+
+// TestHelperBackoffKey_IgnoresOrder: the same CAs, listed in another order or with the
+// challenges reordered, are the same question to the user.
+func TestHelperBackoffKey_IgnoresOrder(t *testing.T) {
+	a := helperBackoffKey("501", []*proto.CertificateChallenge{
+		{CaCertificates: []string{"ca-1", "ca-2"}},
+		{CaCertificates: []string{"ca-3"}},
+	})
+	b := helperBackoffKey("501", []*proto.CertificateChallenge{
+		{CaCertificates: []string{"ca-3"}},
+		{CaCertificates: []string{"ca-2", "ca-1"}},
+	})
+	assert.Equal(t, a, b, "the key does not depend on the order of CAs or challenges")
+
+	c := helperBackoffKey("501", []*proto.CertificateChallenge{{CaCertificates: []string{"ca-1", "ca-2", "ca-3"}}})
+	assert.NotEqual(t, a, c, "the same CAs grouped into other challenges are another question")
+}
+
+// TestHelperBackoff_PrunesExpired: entries whose quiet period passed are dropped when the
+// next outcome is recorded, so the map does not grow with every user and CA set seen.
+func TestHelperBackoff_PrunesExpired(t *testing.T) {
+	now := time.Now()
+	b := newHelperBackoff()
+	b.record("old", false, now)
+	b.record("new", false, now.Add(helperQuietPeriod))
+
+	assert.NotContains(t, b.until, "old", "an expired entry is pruned")
+	assert.Contains(t, b.until, "new", "a current entry is kept")
+}
diff --git a/client/internal/certproof/helper_kill_other.go b/client/internal/certproof/helper_kill_other.go
new file mode 100644
index 000000000..2ececb27e
--- /dev/null
+++ b/client/internal/certproof/helper_kill_other.go
@@ -0,0 +1,10 @@
+//go:build !unix && !windows
+
+package certproof
+
+import "os/exec"
+
+// startHelper starts cmd.
+func startHelper(cmd *exec.Cmd) (func(), error) {
+	return func() {}, cmd.Start()
+}
diff --git a/client/internal/certproof/helper_kill_unix.go b/client/internal/certproof/helper_kill_unix.go
new file mode 100644
index 000000000..e434d4962
--- /dev/null
+++ b/client/internal/certproof/helper_kill_unix.go
@@ -0,0 +1,35 @@
+//go:build unix
+
+package certproof
+
+import (
+	"errors"
+	"os/exec"
+	"syscall"
+)
+
+// killHelperGroupOnCancel puts cmd in a process group of its own and kills the whole
+// group when cmd's context ends. The helper may run below launchers such as launchctl
+// and sudo, which do not pass a kill on, and it keeps the output pipes open, so killing
+// only the direct child would leave the helper running and Wait blocked until the
+// helper exits on its own, for one waiting on a keychain prompt nobody answers.
+func killHelperGroupOnCancel(cmd *exec.Cmd) {
+	if cmd.SysProcAttr == nil {
+		cmd.SysProcAttr = &syscall.SysProcAttr{}
+	}
+	cmd.SysProcAttr.Setpgid = true
+	cmd.Cancel = func() error {
+		err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		if errors.Is(err, syscall.ESRCH) {
+			return nil
+		}
+		return err
+	}
+	cmd.WaitDelay = helperWaitDelay
+}
+
+// startHelper starts cmd. Killing the helper with everything below it is arranged by
+// killHelperGroupOnCancel where the helper runs under a launcher.
+func startHelper(cmd *exec.Cmd) (func(), error) {
+	return func() {}, cmd.Start()
+}
diff --git a/client/internal/certproof/helper_kill_windows.go b/client/internal/certproof/helper_kill_windows.go
new file mode 100644
index 000000000..1e143c132
--- /dev/null
+++ b/client/internal/certproof/helper_kill_windows.go
@@ -0,0 +1,77 @@
+//go:build windows
+
+package certproof
+
+import (
+	"fmt"
+	"os/exec"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+// startHelper starts cmd inside a job object that is terminated when cmd's context ends
+// and closed, killing whatever is left in it, once the helper has been awaited. Killing
+// only the helper on Windows leaves its descendants running, and one that holds the
+// output pipe would block Wait until it exits, so WaitDelay bounds that wait as well.
+func startHelper(cmd *exec.Cmd) (func(), error) {
+	job, err := newKillOnCloseJob()
+	if err != nil {
+		return nil, err
+	}
+	closeJob := func() {
+		if err := windows.CloseHandle(job); err != nil {
+			log.Debugf("failed to close certificate proof helper job: %v", err)
+		}
+	}
+
+	cmd.Cancel = func() error {
+		return windows.TerminateJobObject(job, 1)
+	}
+	cmd.WaitDelay = helperWaitDelay
+	if err := cmd.Start(); err != nil {
+		closeJob()
+		return nil, err
+	}
+
+	// A helper outside the job is still killed directly and bounded by WaitDelay; only
+	// its descendants would outlive it.
+	if err := assignToJob(job, cmd.Process.Pid); err != nil {
+		log.Debugf("failed to put certificate proof helper %d in its job: %v", cmd.Process.Pid, err)
+		cmd.Cancel = func() error { return cmd.Process.Kill() }
+	}
+	return closeJob, nil
+}
+
+// newKillOnCloseJob creates a job object whose processes are killed when its last handle
+// is closed.
+func newKillOnCloseJob() (windows.Handle, error) {
+	job, err := windows.CreateJobObject(nil, nil)
+	if err != nil {
+		return 0, fmt.Errorf("create job object: %w", err)
+	}
+	info := windows.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{
+		BasicLimitInformation: windows.JOBOBJECT_BASIC_LIMIT_INFORMATION{
+			LimitFlags: windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
+		},
+	}
+	if _, err := windows.SetInformationJobObject(job, windows.JobObjectExtendedLimitInformation,
+		uintptr(unsafe.Pointer(&info)), uint32(unsafe.Sizeof(info))); err != nil {
+		_ = windows.CloseHandle(job)
+		return 0, fmt.Errorf("set job object limits: %w", err)
+	}
+	return job, nil
+}
+
+// assignToJob puts the process pid into job.
+func assignToJob(job windows.Handle, pid int) error {
+	process, err := windows.OpenProcess(windows.PROCESS_SET_QUOTA|windows.PROCESS_TERMINATE, false, uint32(pid))
+	if err != nil {
+		return fmt.Errorf("open process: %w", err)
+	}
+	defer func() {
+		_ = windows.CloseHandle(process)
+	}()
+	return windows.AssignProcessToJobObject(job, process)
+}
diff --git a/client/internal/certproof/helper_kill_windows_test.go b/client/internal/certproof/helper_kill_windows_test.go
new file mode 100644
index 000000000..4778d253b
--- /dev/null
+++ b/client/internal/certproof/helper_kill_windows_test.go
@@ -0,0 +1,29 @@
+//go:build windows
+
+package certproof
+
+import (
+	"context"
+	"os/exec"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRunHelperCmd_KillsHelperTree: the helper's child holds stdout and runs for a minute,
+// like a helper stuck below a launcher. Killing only the helper would leave Wait blocked
+// on the child's pipe until WaitDelay gives up; terminating the job ends both at once.
+func TestRunHelperCmd_KillsHelperTree(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "cmd.exe", "/c", "ping -n 60 127.0.0.1")
+
+	start := time.Now()
+	_, err := runHelperCmd(cmd, HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}})
+
+	require.Error(t, err)
+	assert.Less(t, time.Since(start), helperWaitDelay, "the whole tree is killed at the timeout, not left for WaitDelay")
+}
diff --git a/client/internal/certproof/helper_run.go b/client/internal/certproof/helper_run.go
new file mode 100644
index 000000000..52c9db775
--- /dev/null
+++ b/client/internal/certproof/helper_run.go
@@ -0,0 +1,126 @@
+package certproof
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+const (
+	maxHelperStdout = 1 << 20
+	maxHelperStderr = 4 << 10
+
+	// helperWaitDelay bounds how long a helper's output is awaited after it was killed.
+	helperWaitDelay = 2 * time.Second
+)
+
+var errHelperOutputTooLarge = errors.New("helper output exceeds the size limit")
+
+// runHelperCmd feeds req to the helper process cmd and returns the proofs it answered.
+// The helper runs as an unprivileged user who can control its output, so both streams
+// are capped and only proofs for a nonce req asked about are kept, one per challenge.
+func runHelperCmd(cmd *exec.Cmd, req HelperRequest) ([]certposture.Proof, error) {
+	payload, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("encode helper request: %w", err)
+	}
+
+	stdout := &cappedBuffer{limit: maxHelperStdout}
+	stderr := &cappedBuffer{limit: maxHelperStderr}
+	cmd.Stdin = bytes.NewReader(payload)
+	cmd.Stdout = stdout
+	cmd.Stderr = stderr
+
+	release, err := startHelper(cmd)
+	if err != nil {
+		return nil, fmt.Errorf("start helper: %w", err)
+	}
+	defer release()
+	if err := cmd.Wait(); err != nil {
+		return nil, fmt.Errorf("%w: %s", err, strings.TrimSpace(stderr.String()))
+	}
+	logHelperStderr(stderr.String())
+	if stdout.truncated {
+		return nil, errHelperOutputTooLarge
+	}
+
+	var resp HelperResponse
+	if err := json.Unmarshal(stdout.Bytes(), &resp); err != nil {
+		return nil, fmt.Errorf("decode helper response: %w", err)
+	}
+	return requestedProofs(req, resp.Proofs), nil
+}
+
+// logHelperStderr records what a helper that succeeded wrote to stderr, such as a user
+// certificate it could not sign with, which is otherwise only visible in the user's
+// session. Each line is quoted because the helper's user controls its content.
+func logHelperStderr(stderr string) {
+	for _, line := range strings.Split(strings.TrimSpace(stderr), "\n") {
+		if line = strings.TrimSpace(line); line != "" {
+			log.Debugf("certificate posture helper: %q", line)
+		}
+	}
+}
+
+// requestedProofs keeps the proofs whose nonce belongs to one of req's challenges, at
+// most as many as req has challenges.
+func requestedProofs(req HelperRequest, proofs []certposture.Proof) []certposture.Proof {
+	var kept []certposture.Proof
+	for _, proof := range proofs {
+		if len(kept) == len(req.Challenges) {
+			break
+		}
+		if !req.asked(proof.Nonce) {
+			log.Debugf("certificate posture: dropping helper proof for a nonce that was not requested")
+			continue
+		}
+		kept = append(kept, proof)
+	}
+	return kept
+}
+
+func (r HelperRequest) asked(nonce []byte) bool {
+	for _, challenge := range r.Challenges {
+		if len(challenge.Nonce) > 0 && bytes.Equal(challenge.Nonce, nonce) {
+			return true
+		}
+	}
+	return false
+}
+
+// cappedBuffer keeps the first limit bytes written to it and discards the rest, so a
+// misbehaving child cannot grow the parent's memory without bound. The buffer is a
+// named field rather than embedded: an embedded bytes.Buffer would promote ReadFrom,
+// which io.Copy prefers over Write, bypassing the cap.
+type cappedBuffer struct {
+	buf       bytes.Buffer
+	limit     int
+	truncated bool
+}
+
+func (b *cappedBuffer) Write(p []byte) (int, error) {
+	if room := b.limit - b.buf.Len(); room < len(p) {
+		b.truncated = true
+		if room > 0 {
+			b.buf.Write(p[:room])
+		}
+		return len(p), nil
+	}
+	return b.buf.Write(p)
+}
+
+func (b *cappedBuffer) Bytes() []byte {
+	return b.buf.Bytes()
+}
+
+func (b *cappedBuffer) String() string {
+	return b.buf.String()
+}
diff --git a/client/internal/certproof/helper_run_test.go b/client/internal/certproof/helper_run_test.go
new file mode 100644
index 000000000..ea1246e93
--- /dev/null
+++ b/client/internal/certproof/helper_run_test.go
@@ -0,0 +1,119 @@
+//go:build !windows && !js
+
+package certproof
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// fakeHelper is a child process that drains its stdin and then prints script's output,
+// standing in for a helper running in a user session the daemon cannot trust.
+func fakeHelper(t *testing.T, script string) *exec.Cmd {
+	t.Helper()
+	return exec.Command("/bin/sh", "-c", "cat >/dev/null; "+script)
+}
+
+func printJSON(t *testing.T, v any) string {
+	t.Helper()
+	out, err := json.Marshal(v)
+	require.NoError(t, err)
+	return fmt.Sprintf("printf '%%s' '%s'", out)
+}
+
+func TestRunHelperCmd_KeepsOnlyRequestedProofs(t *testing.T) {
+	req := HelperRequest{PeerKey: peerKey, Challenges: []HelperChallenge{{Nonce: []byte("asked")}}}
+	resp := HelperResponse{Proofs: []certposture.Proof{
+		{Nonce: []byte("injected"), Signature: []byte("x")},
+		{Nonce: []byte("asked"), Signature: []byte("first")},
+		{Nonce: []byte("asked"), Signature: []byte("second")},
+	}}
+
+	proofs, err := runHelperCmd(fakeHelper(t, printJSON(t, resp)), req)
+
+	require.NoError(t, err)
+	require.Len(t, proofs, 1, "a helper may not return more proofs than challenges or proofs for nonces it was not asked about")
+	assert.Equal(t, []byte("first"), proofs[0].Signature, "the first proof for the requested nonce is kept")
+}
+
+func TestRunHelperCmd_RejectsOversizedOutput(t *testing.T) {
+	req := HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}}
+	script := fmt.Sprintf("head -c %d /dev/zero", maxHelperStdout+1)
+
+	_, err := runHelperCmd(fakeHelper(t, script), req)
+
+	assert.ErrorIs(t, err, errHelperOutputTooLarge)
+}
+
+func TestRunHelperCmd_CapsStderrInError(t *testing.T) {
+	req := HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}}
+	script := fmt.Sprintf("head -c %d /dev/zero | tr '\\0' 'a' >&2; exit 3", 10*maxHelperStderr)
+
+	_, err := runHelperCmd(fakeHelper(t, script), req)
+
+	require.Error(t, err)
+	assert.LessOrEqual(t, len(err.Error()), maxHelperStderr+100, "a chatty helper must not blow up the daemon's error or log line")
+	assert.True(t, strings.Contains(err.Error(), "exit status 3"), "the exit status is kept: %v", err)
+}
+
+// TestRunHelperCmd_LogsStderrOfSuccessfulHelper covers a helper that answers but warns,
+// for one about a certificate it could not sign with: the warning reaches the daemon's
+// log, quoted so a helper cannot forge log lines with embedded newlines.
+func TestRunHelperCmd_LogsStderrOfSuccessfulHelper(t *testing.T) {
+	var logged bytes.Buffer
+	log.SetOutput(&logged)
+	level := log.GetLevel()
+	log.SetLevel(log.DebugLevel)
+	t.Cleanup(func() {
+		log.SetOutput(os.Stderr)
+		log.SetLevel(level)
+	})
+
+	req := HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}}
+	script := "printf 'failed signing certificate proof for CN=user\\nforged line\\n' >&2; " + printJSON(t, HelperResponse{})
+
+	_, err := runHelperCmd(fakeHelper(t, script), req)
+
+	require.NoError(t, err)
+	assert.Contains(t, logged.String(), "failed signing certificate proof for CN=user", "the helper's warning reaches the daemon log")
+	assert.NotContains(t, logged.String(), "\nforged line", "helper output cannot start a log line of its own")
+}
+
+// TestRunHelperCmd_KillsHelperBelowLauncher stands in for launchctl and sudo starting the
+// helper: the direct child spawns a grandchild that holds stdout and never exits, like a
+// helper waiting on a keychain prompt. The timeout must end both, not wait for the
+// grandchild.
+func TestRunHelperCmd_KillsHelperBelowLauncher(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "/bin/sh", "-c", "sleep 30 & cat >/dev/null; wait")
+	killHelperGroupOnCancel(cmd)
+
+	start := time.Now()
+	_, err := runHelperCmd(cmd, HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}})
+
+	require.Error(t, err)
+	assert.Less(t, time.Since(start), 5*time.Second, "the helper is killed at the timeout, not awaited until it exits")
+}
+
+func TestRunHelperCmd_RejectsGarbage(t *testing.T) {
+	req := HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}}
+
+	_, err := runHelperCmd(fakeHelper(t, "printf 'not json'"), req)
+
+	assert.ErrorContains(t, err, "decode helper response")
+}
diff --git a/client/internal/certproof/helper_spawn.go b/client/internal/certproof/helper_spawn.go
new file mode 100644
index 000000000..54ed265ec
--- /dev/null
+++ b/client/internal/certproof/helper_spawn.go
@@ -0,0 +1,18 @@
+//go:build (darwin && !ios) || windows
+
+package certproof
+
+import (
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func helperRequest(challenges []*proto.CertificateChallenge, peerKey []byte) HelperRequest {
+	req := HelperRequest{PeerKey: peerKey, Challenges: make([]HelperChallenge, 0, len(challenges))}
+	for _, challenge := range challenges {
+		req.Challenges = append(req.Challenges, HelperChallenge{
+			Nonce:          challenge.GetNonce(),
+			CACertificates: challenge.GetCaCertificates(),
+		})
+	}
+	return req
+}
diff --git a/client/internal/certproof/helper_spawn_test.go b/client/internal/certproof/helper_spawn_test.go
new file mode 100644
index 000000000..74a792a49
--- /dev/null
+++ b/client/internal/certproof/helper_spawn_test.go
@@ -0,0 +1,29 @@
+//go:build (darwin && !ios) || windows
+
+package certproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestHelperRequest_CarriesEveryChallenge(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	challenges := []*proto.CertificateChallenge{
+		{Nonce: []byte("first"), CaCertificates: []string{ca.PEM}},
+		{Nonce: []byte("second")},
+	}
+
+	req := helperRequest(challenges, peerKey)
+
+	require.Len(t, req.Challenges, 2, "every challenge must reach the helper")
+	assert.Equal(t, peerKey, req.PeerKey, "the peer key binds the signature to this machine")
+	assert.Equal(t, []byte("first"), req.Challenges[0].Nonce, "the nonce must survive unchanged")
+	assert.Equal(t, []string{ca.PEM}, req.Challenges[0].CACertificates, "the accepted CAs must survive unchanged")
+	assert.Empty(t, req.Challenges[1].CACertificates, "a challenge without CAs stays without CAs")
+}
diff --git a/client/internal/certproof/helper_test.go b/client/internal/certproof/helper_test.go
new file mode 100644
index 000000000..61fcc8532
--- /dev/null
+++ b/client/internal/certproof/helper_test.go
@@ -0,0 +1,66 @@
+package certproof
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+// TestRunHelper_AnswersAChallengeFromItsStore runs the helper's request and response
+// handling in-process: the proof it writes verifies as the daemon will verify it. The
+// process boundary itself is covered by the runHelperCmd tests.
+func TestRunHelper_AnswersAChallengeFromItsStore(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	dir := storeDir(t)
+	key := certtest.ECDSAKey(t)
+	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	nonce := challenger.Nonce(peerKey, time.Now())
+	request, err := json.Marshal(HelperRequest{
+		PeerKey:    peerKey,
+		Challenges: []HelperChallenge{{Nonce: nonce, CACertificates: []string{ca.PEM}}},
+	})
+	require.NoError(t, err, "request must encode")
+
+	var stdout bytes.Buffer
+	require.NoError(t, runHelper(context.Background(), newFileStore(dir), bytes.NewReader(request), &stdout))
+
+	var resp HelperResponse
+	require.NoError(t, json.Unmarshal(stdout.Bytes(), &resp), "helper must emit decodable JSON")
+	require.Len(t, resp.Proofs, 1, "the matching certificate should produce one proof")
+
+	// Verify exactly as management does, so the proof is proven to survive the encode,
+	// the process boundary and the decode intact.
+	chain, err := challenger.Verify(resp.Proofs[0], peerKey, time.Now())
+	require.NoError(t, err, "the decoded proof must verify against the issued nonce")
+	assert.Equal(t, "device", chain[0].Subject.CommonName, "the proven leaf should be the device certificate")
+}
+
+func TestRunHelper_NoChallengesYieldsEmptyResponse(t *testing.T) {
+	request, err := json.Marshal(HelperRequest{PeerKey: peerKey})
+	require.NoError(t, err)
+
+	var stdout bytes.Buffer
+	require.NoError(t, runHelper(context.Background(), newFileStore(storeDir(t)), bytes.NewReader(request), &stdout))
+
+	var resp HelperResponse
+	require.NoError(t, json.Unmarshal(stdout.Bytes(), &resp), "an empty request must still emit valid JSON")
+	assert.Empty(t, resp.Proofs, "no challenges should produce no proofs")
+}
+
+func TestRunHelper_RejectsMalformedRequest(t *testing.T) {
+	var stdout bytes.Buffer
+	err := runHelper(context.Background(), newFileStore(storeDir(t)), bytes.NewReader([]byte("not json")), &stdout)
+
+	require.Error(t, err, "a malformed request must fail rather than emit an empty proof set")
+	assert.Empty(t, stdout.String(), "nothing should be written to stdout on a decode failure")
+}
diff --git a/client/internal/certproof/keychain_darwin.go b/client/internal/certproof/keychain_darwin.go
new file mode 100644
index 000000000..5b1426997
--- /dev/null
+++ b/client/internal/certproof/keychain_darwin.go
@@ -0,0 +1,490 @@
+//go:build !ios
+
+package certproof
+
+import (
+	"bytes"
+	"context"
+	"crypto"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"sync"
+	"unsafe"
+
+	"github.com/ebitengine/purego"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	securityFramework       = "/System/Library/Frameworks/Security.framework/Security"
+	coreFoundationFramework = "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation"
+
+	errSecItemNotFound          = -25300
+	errSecInteractionNotAllowed = -25308
+)
+
+// errKeyNeedsApproval reports a key whose access list does not include netbird, so using
+// it needs the user's approval, which a daemon has no UI to ask for.
+var errKeyNeedsApproval = errors.New("the key's access control requires user approval for netbird; " +
+	"import the identity with netbird allowed (security import <identity.p12> -k <keychain> " +
+	"-T /Applications/NetBird.app/Contents/MacOS/netbird), " +
+	"or set AllowAllAppsAccess in the MDM certificate payload, which allows every application")
+
+var (
+	keychainOnce sync.Once
+	keychainErr  error
+
+	secItemCopyMatching        func(query uintptr, result *uintptr) int32
+	secIdentityCopyCertificate func(identity uintptr, cert *uintptr) int32
+	secIdentityCopyPrivateKey  func(identity uintptr, key *uintptr) int32
+	secCertificateCopyData     func(cert uintptr) uintptr
+	secKeyCreateSignature      func(key, algorithm, data uintptr, err *uintptr) uintptr
+
+	secKeychainOpen           func(path *byte, keychain *uintptr) int32
+	secKeychainCopySearchList func(searchList *uintptr) int32
+	secKeychainGetPath        func(keychain uintptr, pathLength *uint32, path *byte) int32
+	cfArrayCreate             func(alloc uintptr, values *uintptr, count int, callBacks uintptr) uintptr
+
+	cfDictionaryCreate     func(alloc uintptr, keys, values *uintptr, count int, keyCallBacks, valueCallBacks uintptr) uintptr
+	cfArrayGetCount        func(array uintptr) int
+	cfArrayGetValueAtIndex func(array uintptr, index int) uintptr
+	cfDataCreate           func(alloc uintptr, data *byte, length int) uintptr
+	cfDataGetLength        func(data uintptr) int
+	cfDataGetBytePtr       func(data uintptr) unsafe.Pointer
+	cfErrorGetCode         func(err uintptr) int
+	cfRelease              func(ref uintptr)
+
+	kSecClass, kSecClassIdentity, kSecClassCertificate, kSecMatchLimit, kSecMatchLimitAll, kSecReturnRef  uintptr
+	kSecMatchSearchList                                                                                   uintptr
+	kSecKeyAlgorithmECDSASHA256, kSecKeyAlgorithmECDSASHA384, kSecKeyAlgorithmRSAPSSSHA256                uintptr
+	kCFBooleanTrue, kCFTypeDictionaryKeyCallBacks, kCFTypeDictionaryValueCallBacks, kCFTypeArrayCallBacks uintptr
+)
+
+// systemKeychain is where MDM installs device identities.
+const systemKeychain = "/Library/Keychains/System.keychain"
+
+// DefaultStore is the System keychain for the root daemon, so it never touches a user's
+// keychain, whose keys would ask for approval in a session the daemon has no UI in. Run
+// by an ordinary user, it is that user's keychain search list.
+func DefaultStore() Store {
+	if os.Geteuid() == 0 {
+		return newKeychainStore(systemKeychain)
+	}
+	return newKeychainStore()
+}
+
+// keychainStore yields the identities of a set of keychains, or of the process's keychain
+// search list when none is named, reached through purego so the client keeps building
+// with CGO_ENABLED=0.
+type keychainStore struct {
+	keychains []string
+}
+
+// newKeychainStore returns a store that searches the keychain files at paths, or the
+// process's keychain search list when no path is given.
+func newKeychainStore(paths ...string) *keychainStore {
+	return &keychainStore{keychains: paths}
+}
+
+func (s *keychainStore) Candidates(_ context.Context) ([]Candidate, error) {
+	if err := loadKeychain(); err != nil {
+		return nil, err
+	}
+	searchList, done, err := searchListOf(s.keychains)
+	if err != nil {
+		return nil, err
+	}
+	defer done()
+
+	var leaves []*x509.Certificate
+	err = eachIdentity(searchList, func(_ uintptr, der []byte) (bool, error) {
+		cert, err := x509.ParseCertificate(der)
+		if err != nil {
+			log.Warnf("skipping keychain identity: %v", err)
+			return false, nil
+		}
+		log.Debugf("keychain identity: subject=%q issuer=%q serial=%s expires=%s", cert.Subject, cert.Issuer, cert.SerialNumber, cert.NotAfter)
+		leaves = append(leaves, cert)
+		return false, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	// The certificate query runs even without identities: it separates a keychain that is
+	// readable but holds no identity from one the process cannot read at all.
+	pool, err := keychainCertificates(searchList)
+	if err != nil {
+		return nil, err
+	}
+	if len(leaves) == 0 {
+		log.Debugf("keychain search list holds no identities usable for certificate posture, but %d readable certificates: an identity needs its private key in the same keychain", len(pool))
+		return nil, nil
+	}
+	log.Debugf("keychain search list holds %d identities and %d certificates for chain building", len(leaves), len(pool))
+
+	candidates := make([]Candidate, 0, len(leaves))
+	for _, leaf := range leaves {
+		chain := buildChain(leaf, pool)
+		log.Debugf("keychain candidate %q issued by %q built a chain of %d certificates", leaf.Subject, leaf.Issuer, len(chain))
+		if len(chain) == 1 && leaf.CheckSignatureFrom(leaf) != nil {
+			log.Debugf("keychain candidate %q has no issuer in the keychain, its proof carries the leaf alone and only verifies if the challenge supplies %q", leaf.Subject, leaf.Issuer)
+		}
+		candidates = append(candidates, Candidate{Chain: chain, Signer: &keychainSigner{leaf: leaf, keychains: s.keychains}, Intermediates: pool})
+	}
+	return candidates, nil
+}
+
+// keychainSigner holds only the certificate; the identity is looked up again at signing
+// time so no keychain references outlive a call.
+type keychainSigner struct {
+	leaf      *x509.Certificate
+	keychains []string
+}
+
+func (s *keychainSigner) Public() crypto.PublicKey {
+	return s.leaf.PublicKey
+}
+
+func (s *keychainSigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	scheme, err := schemeFor(s.leaf.PublicKey, opts)
+	if err != nil {
+		return nil, err
+	}
+	log.Debugf("signing certificate posture challenge with keychain key of %q", s.leaf.Subject)
+
+	searchList, done, err := searchListOf(s.keychains)
+	if err != nil {
+		return nil, err
+	}
+	defer done()
+
+	algorithm := keychainAlgorithm(scheme)
+	var signature []byte
+	var attempts signAttempts
+	err = eachIdentity(searchList, func(identity uintptr, der []byte) (bool, error) {
+		if !bytes.Equal(der, s.leaf.Raw) {
+			return false, nil
+		}
+		// The same certificate can sit in the keychain with more than one key, of which
+		// only one may be usable, so a failure moves on to the next match.
+		var ok bool
+		signature, ok = attempts.try(func() ([]byte, error) { return signWithIdentity(identity, algorithm, digest) })
+		return ok, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	if signature == nil {
+		if err := attempts.err(); err != nil {
+			return nil, err
+		}
+		return nil, errors.New("certificate is no longer in the keychain")
+	}
+	log.Debugf("keychain signed certificate posture challenge for %q, %d bytes", s.leaf.Subject, len(signature))
+	return signature, nil
+}
+
+func keychainAlgorithm(scheme sigScheme) uintptr {
+	switch scheme {
+	case schemeECDSASHA384:
+		return kSecKeyAlgorithmECDSASHA384
+	case schemeRSAPSSSHA256:
+		return kSecKeyAlgorithmRSAPSSSHA256
+	default:
+		return kSecKeyAlgorithmECDSASHA256
+	}
+}
+
+func signWithIdentity(identity, algorithm uintptr, digest []byte) ([]byte, error) {
+	var key uintptr
+	if status := secIdentityCopyPrivateKey(identity, &key); status != 0 {
+		return nil, fmt.Errorf("SecIdentityCopyPrivateKey: %d", status)
+	}
+	defer release(key)
+
+	data := cfDataCreate(0, &digest[0], len(digest))
+	if data == 0 {
+		return nil, errors.New("CFDataCreate returned NULL")
+	}
+	defer release(data)
+
+	var cfErr uintptr
+	signature := secKeyCreateSignature(key, algorithm, data, &cfErr)
+	if signature == 0 {
+		if cfErr == 0 {
+			return nil, errors.New("SecKeyCreateSignature failed without a CFError")
+		}
+		defer release(cfErr)
+		code := cfErrorGetCode(cfErr)
+		if code == errSecInteractionNotAllowed {
+			return nil, fmt.Errorf("SecKeyCreateSignature: CFError %d: %w", code, errKeyNeedsApproval)
+		}
+		return nil, fmt.Errorf("SecKeyCreateSignature: CFError %d", code)
+	}
+	defer release(signature)
+	return dataBytes(signature), nil
+}
+
+// searchListOf opens the keychain files at paths as a CFArray for kSecMatchSearchList,
+// or yields 0, the process's own search list, when paths is empty. The caller calls done
+// once it no longer uses the list.
+func searchListOf(paths []string) (searchList uintptr, done func(), err error) {
+	if len(paths) == 0 {
+		return 0, func() {}, nil
+	}
+	list, err := openSearchList(paths)
+	if err != nil {
+		return 0, nil, err
+	}
+	return list, func() { release(list) }, nil
+}
+
+// openSearchList opens the keychain files at paths, at least one, as a CFArray. The
+// caller releases the array.
+func openSearchList(paths []string) (uintptr, error) {
+	refs := make([]uintptr, 0, len(paths))
+	defer func() {
+		for _, ref := range refs {
+			release(ref)
+		}
+	}()
+	for _, path := range paths {
+		cpath := append([]byte(path), 0)
+		var keychain uintptr
+		if status := secKeychainOpen(&cpath[0], &keychain); status != 0 {
+			return 0, fmt.Errorf("SecKeychainOpen %s: %d", path, status)
+		}
+		refs = append(refs, keychain)
+	}
+	// The array retains the keychains, so the references opened here are released.
+	list := cfArrayCreate(0, &refs[0], len(refs), kCFTypeArrayCallBacks)
+	if list == 0 {
+		return 0, errors.New("CFArrayCreate returned NULL")
+	}
+	return list, nil
+}
+
+// eachIdentity calls fn with every identity in searchList, or in the process's search
+// list when it is 0, and its certificate. An identity whose certificate cannot be read is
+// skipped rather than ending the walk.
+func eachIdentity(searchList uintptr, fn func(identity uintptr, der []byte) (bool, error)) error {
+	return eachMatching(searchList, kSecClassIdentity, "identity", func(identity uintptr) (bool, error) {
+		var cert uintptr
+		if status := secIdentityCopyCertificate(identity, &cert); status != 0 {
+			log.Debugf("skipping keychain identity: SecIdentityCopyCertificate: %d", status)
+			return false, nil
+		}
+		der := certificateDER(cert)
+		release(cert)
+		if der == nil {
+			log.Debug("skipping keychain identity whose certificate has no DER data")
+			return false, nil
+		}
+		return fn(identity, der)
+	})
+}
+
+func keychainCertificates(searchList uintptr) ([]*x509.Certificate, error) {
+	var certs []*x509.Certificate
+	var unparsable int
+	err := eachMatching(searchList, kSecClassCertificate, "certificate", func(item uintptr) (bool, error) {
+		if cert, err := x509.ParseCertificate(certificateDER(item)); err == nil {
+			certs = append(certs, cert)
+			return false, nil
+		}
+		unparsable++
+		return false, nil
+	})
+	log.Debugf("keychain holds %d parsable certificates, %d unparsable", len(certs), unparsable)
+	return certs, err
+}
+
+func eachMatching(searchList, class uintptr, name string, fn func(item uintptr) (bool, error)) error {
+	keys := []uintptr{kSecClass, kSecMatchLimit, kSecReturnRef}
+	values := []uintptr{class, kSecMatchLimitAll, kCFBooleanTrue}
+	if searchList != 0 {
+		keys = append(keys, kSecMatchSearchList)
+		values = append(values, searchList)
+	}
+	query := cfDictionaryCreate(0, &keys[0], &values[0], len(keys), kCFTypeDictionaryKeyCallBacks, kCFTypeDictionaryValueCallBacks)
+	defer release(query)
+
+	var items uintptr
+	switch status := secItemCopyMatching(query, &items); status {
+	case 0:
+	case errSecItemNotFound:
+		log.Debugf("keychain %s query returned errSecItemNotFound (%d): the search list holds no item of this class", name, errSecItemNotFound)
+		return nil
+	default:
+		log.Debugf("keychain %s query returned OSStatus %d", name, status)
+		return fmt.Errorf("SecItemCopyMatching: %d", status)
+	}
+	defer release(items)
+
+	n := cfArrayGetCount(items)
+	log.Debugf("keychain %s query returned %d items", name, n)
+	for i := 0; i < n; i++ {
+		if stop, err := fn(cfArrayGetValueAtIndex(items, i)); stop || err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// certificateDER returns the DER form of cert, or nil when SecCertificateCopyData
+// returns NULL, which it does for an object that is not a valid certificate.
+func certificateDER(cert uintptr) []byte {
+	data := secCertificateCopyData(cert)
+	if data == 0 {
+		return nil
+	}
+	defer release(data)
+	return dataBytes(data)
+}
+
+func dataBytes(data uintptr) []byte {
+	n := cfDataGetLength(data)
+	if n <= 0 {
+		return nil
+	}
+	return bytes.Clone(unsafe.Slice((*byte)(cfDataGetBytePtr(data)), n))
+}
+
+// release drops a CoreFoundation reference. CFRelease crashes the process on NULL, and
+// several Security calls return NULL on failure, so every release goes through here.
+func release(ref uintptr) {
+	if ref != 0 {
+		cfRelease(ref)
+	}
+}
+
+func loadKeychain() error {
+	keychainOnce.Do(func() {
+		if keychainErr = resolveKeychain(); keychainErr != nil {
+			log.Debugf("macOS keychain unavailable for certificate posture: %v", keychainErr)
+			return
+		}
+		log.Debugf("macOS Security framework loaded for certificate posture, running as uid=%d euid=%d", os.Getuid(), os.Geteuid())
+		logSearchList()
+	})
+	return keychainErr
+}
+
+// logSearchList reports the keychains the process searches. The root daemon sees the
+// System keychain and System Roots, never a user's login keychain.
+func logSearchList() {
+	if secKeychainCopySearchList == nil || secKeychainGetPath == nil {
+		log.Debug("keychain search list diagnostics unavailable on this macOS version")
+		return
+	}
+
+	var list uintptr
+	if status := secKeychainCopySearchList(&list); status != 0 {
+		log.Debugf("SecKeychainCopySearchList returned OSStatus %d", status)
+		return
+	}
+	defer release(list)
+
+	n := cfArrayGetCount(list)
+	log.Debugf("keychain search list contains %d keychains", n)
+	for i := 0; i < n; i++ {
+		log.Debugf("keychain search list[%d]: %s", i, keychainPath(cfArrayGetValueAtIndex(list, i)))
+	}
+}
+
+func keychainPath(keychain uintptr) string {
+	path := make([]byte, 1024)
+	length := uint32(len(path))
+	if status := secKeychainGetPath(keychain, &length, &path[0]); status != 0 {
+		return fmt.Sprintf("<SecKeychainGetPath: %d>", status)
+	}
+	return string(path[:length])
+}
+
+func resolveKeychain() error {
+	security, err := purego.Dlopen(securityFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", securityFramework, err)
+	}
+	coreFoundation, err := purego.Dlopen(coreFoundationFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", coreFoundationFramework, err)
+	}
+
+	for _, fn := range []struct {
+		ptr  any
+		lib  uintptr
+		name string
+	}{
+		{&secItemCopyMatching, security, "SecItemCopyMatching"},
+		{&secIdentityCopyCertificate, security, "SecIdentityCopyCertificate"},
+		{&secIdentityCopyPrivateKey, security, "SecIdentityCopyPrivateKey"},
+		{&secCertificateCopyData, security, "SecCertificateCopyData"},
+		{&secKeyCreateSignature, security, "SecKeyCreateSignature"},
+		{&secKeychainOpen, security, "SecKeychainOpen"},
+		{&cfArrayCreate, coreFoundation, "CFArrayCreate"},
+		{&cfDictionaryCreate, coreFoundation, "CFDictionaryCreate"},
+		{&cfArrayGetCount, coreFoundation, "CFArrayGetCount"},
+		{&cfArrayGetValueAtIndex, coreFoundation, "CFArrayGetValueAtIndex"},
+		{&cfDataCreate, coreFoundation, "CFDataCreate"},
+		{&cfDataGetLength, coreFoundation, "CFDataGetLength"},
+		{&cfDataGetBytePtr, coreFoundation, "CFDataGetBytePtr"},
+		{&cfErrorGetCode, coreFoundation, "CFErrorGetCode"},
+		{&cfRelease, coreFoundation, "CFRelease"},
+	} {
+		symbol, err := purego.Dlsym(fn.lib, fn.name)
+		if err != nil {
+			return fmt.Errorf("resolve %s: %w", fn.name, err)
+		}
+		purego.RegisterFunc(fn.ptr, symbol)
+	}
+
+	for _, global := range []struct {
+		ptr   *uintptr
+		lib   uintptr
+		name  string
+		deref bool
+	}{
+		{&kSecClass, security, "kSecClass", true},
+		{&kSecClassIdentity, security, "kSecClassIdentity", true},
+		{&kSecClassCertificate, security, "kSecClassCertificate", true},
+		{&kSecMatchLimit, security, "kSecMatchLimit", true},
+		{&kSecMatchLimitAll, security, "kSecMatchLimitAll", true},
+		{&kSecReturnRef, security, "kSecReturnRef", true},
+		{&kSecMatchSearchList, security, "kSecMatchSearchList", true},
+		{&kSecKeyAlgorithmECDSASHA256, security, "kSecKeyAlgorithmECDSASignatureDigestX962SHA256", true},
+		{&kSecKeyAlgorithmECDSASHA384, security, "kSecKeyAlgorithmECDSASignatureDigestX962SHA384", true},
+		{&kSecKeyAlgorithmRSAPSSSHA256, security, "kSecKeyAlgorithmRSASignatureDigestPSSSHA256", true},
+		{&kCFBooleanTrue, coreFoundation, "kCFBooleanTrue", true},
+		{&kCFTypeDictionaryKeyCallBacks, coreFoundation, "kCFTypeDictionaryKeyCallBacks", false},
+		{&kCFTypeDictionaryValueCallBacks, coreFoundation, "kCFTypeDictionaryValueCallBacks", false},
+		{&kCFTypeArrayCallBacks, coreFoundation, "kCFTypeArrayCallBacks", false},
+	} {
+		addr, err := purego.Dlsym(global.lib, global.name)
+		if err != nil {
+			return fmt.Errorf("resolve %s: %w", global.name, err)
+		}
+		if global.deref {
+			addr = **(**uintptr)(unsafe.Pointer(&addr))
+		}
+		*global.ptr = addr
+	}
+
+	resolveOptional(security, "SecKeychainCopySearchList", &secKeychainCopySearchList)
+	resolveOptional(security, "SecKeychainGetPath", &secKeychainGetPath)
+	return nil
+}
+
+// resolveOptional binds a diagnostic-only symbol, leaving it nil when the framework no
+// longer exports it so keychain lookups keep working without it.
+func resolveOptional(lib uintptr, name string, ptr any) {
+	symbol, err := purego.Dlsym(lib, name)
+	if err != nil {
+		log.Debugf("keychain diagnostics: %s unavailable: %v", name, err)
+		return
+	}
+	purego.RegisterFunc(ptr, symbol)
+}
diff --git a/client/internal/certproof/keystore.go b/client/internal/certproof/keystore.go
new file mode 100644
index 000000000..7ce676b4c
--- /dev/null
+++ b/client/internal/certproof/keystore.go
@@ -0,0 +1,77 @@
+package certproof
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/asn1"
+	"errors"
+	"fmt"
+	"math/big"
+	"slices"
+)
+
+var errUnsupportedScheme = errors.New("unsupported signature scheme for OS keystore")
+
+type sigScheme int
+
+const (
+	schemeECDSASHA256 sigScheme = iota + 1
+	schemeECDSASHA384
+	schemeRSAPSSSHA256
+)
+
+// schemeFor maps a crypto.Signer request onto the schemes the OS keystores perform.
+func schemeFor(pub crypto.PublicKey, opts crypto.SignerOpts) (sigScheme, error) {
+	switch pub.(type) {
+	case *ecdsa.PublicKey:
+		switch opts.HashFunc() {
+		case crypto.SHA256:
+			return schemeECDSASHA256, nil
+		case crypto.SHA384:
+			return schemeECDSASHA384, nil
+		}
+	case *rsa.PublicKey:
+		if pss, ok := opts.(*rsa.PSSOptions); ok && pss.Hash == crypto.SHA256 {
+			return schemeRSAPSSSHA256, nil
+		}
+	}
+	return 0, fmt.Errorf("%w: %T with %v", errUnsupportedScheme, pub, opts.HashFunc())
+}
+
+// buildChain extends leaf with the issuers found in pool up to a self-signed certificate.
+func buildChain(leaf *x509.Certificate, pool []*x509.Certificate) []*x509.Certificate {
+	chain := []*x509.Certificate{leaf}
+	current := leaf
+	for current.CheckSignatureFrom(current) != nil {
+		issuer := issuerIn(current, pool, chain)
+		if issuer == nil {
+			break
+		}
+		chain = append(chain, issuer)
+		current = issuer
+	}
+	return chain
+}
+
+func issuerIn(cert *x509.Certificate, pool, seen []*x509.Certificate) *x509.Certificate {
+	for _, candidate := range pool {
+		if slices.ContainsFunc(seen, candidate.Equal) {
+			continue
+		}
+		if cert.CheckSignatureFrom(candidate) == nil {
+			return candidate
+		}
+	}
+	return nil
+}
+
+// ecdsaSignatureASN1 converts the fixed-width r||s form emitted by CNG into the DER form Go verifies.
+func ecdsaSignatureASN1(raw []byte) ([]byte, error) {
+	if len(raw) == 0 || len(raw)%2 != 0 {
+		return nil, errors.New("malformed raw ECDSA signature")
+	}
+	half := len(raw) / 2
+	return asn1.Marshal(struct{ R, S *big.Int }{new(big.Int).SetBytes(raw[:half]), new(big.Int).SetBytes(raw[half:])})
+}
diff --git a/client/internal/certproof/keystore_test.go b/client/internal/certproof/keystore_test.go
new file mode 100644
index 000000000..7d028c4fb
--- /dev/null
+++ b/client/internal/certproof/keystore_test.go
@@ -0,0 +1,91 @@
+package certproof
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+func TestBuildChain_FollowsIssuersThroughThePool(t *testing.T) {
+	root := certtest.NewCA(t, "root")
+	intermediate := certtest.NewIntermediate(t, root, "intermediate")
+	unrelated := certtest.NewCA(t, "unrelated")
+	leaf := intermediate.Issue(t, certtest.ECDSAKey(t), "device")
+	pool := []*x509.Certificate{unrelated.Cert, root.Cert, leaf, intermediate.Cert}
+
+	chain := buildChain(leaf, pool)
+
+	require.Equal(t, []*x509.Certificate{leaf, intermediate.Cert, root.Cert}, chain)
+	roots, err := certposture.ParseCAs([]string{root.PEM})
+	require.NoError(t, err)
+	assert.NoError(t, certposture.VerifyChain(chain, roots, time.Now()))
+}
+
+func TestBuildChain_StopsWhereThePoolEnds(t *testing.T) {
+	root := certtest.NewCA(t, "root")
+	intermediate := certtest.NewIntermediate(t, root, "intermediate")
+	leaf := intermediate.Issue(t, certtest.ECDSAKey(t), "device")
+
+	assert.Equal(t, []*x509.Certificate{leaf}, buildChain(leaf, nil))
+	assert.Equal(t, []*x509.Certificate{leaf, intermediate.Cert}, buildChain(leaf, []*x509.Certificate{intermediate.Cert}))
+}
+
+func TestSchemeFor(t *testing.T) {
+	ecKey := certtest.ECDSAKey(t)
+	rsaKey := certtest.RSAKey(t)
+	pss := &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: crypto.SHA256}
+
+	tests := []struct {
+		name string
+		pub  crypto.PublicKey
+		opts crypto.SignerOpts
+		want sigScheme
+	}{
+		{"ecdsa sha256", ecKey.Public(), crypto.SHA256, schemeECDSASHA256},
+		{"ecdsa sha384", ecKey.Public(), crypto.SHA384, schemeECDSASHA384},
+		{"rsa pss sha256", rsaKey.Public(), pss, schemeRSAPSSSHA256},
+		{"rsa pkcs1v15", rsaKey.Public(), crypto.SHA256, 0},
+		{"ecdsa sha512", ecKey.Public(), crypto.SHA512, 0},
+		{"rsa pss sha384", rsaKey.Public(), &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: crypto.SHA384}, 0},
+		{"ed25519", certtest.Ed25519Key(t).Public(), crypto.Hash(0), 0},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := schemeFor(tc.pub, tc.opts)
+			if tc.want == 0 {
+				assert.ErrorIs(t, err, errUnsupportedScheme)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestECDSASignatureASN1(t *testing.T) {
+	key := certtest.ECDSAKey(t).(*ecdsa.PrivateKey)
+	digest := sha256.Sum256([]byte("nonce"))
+	r, s, err := ecdsa.Sign(rand.Reader, key, digest[:])
+	require.NoError(t, err)
+	raw := append(r.FillBytes(make([]byte, 32)), s.FillBytes(make([]byte, 32))...)
+
+	der, err := ecdsaSignatureASN1(raw)
+	require.NoError(t, err)
+	assert.True(t, ecdsa.VerifyASN1(&key.PublicKey, digest[:], der))
+
+	_, err = ecdsaSignatureASN1(raw[:63])
+	assert.Error(t, err, "an odd length cannot split into r and s")
+	_, err = ecdsaSignatureASN1(nil)
+	assert.Error(t, err, "an empty signature is malformed")
+}
diff --git a/client/internal/certproof/merge.go b/client/internal/certproof/merge.go
new file mode 100644
index 000000000..d539ce927
--- /dev/null
+++ b/client/internal/certproof/merge.go
@@ -0,0 +1,50 @@
+package certproof
+
+import (
+	"crypto/sha256"
+	"crypto/x509"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// mergeProofs appends the user session proofs to the device proofs, dropping one whose
+// chain the device already proved. Management checks each chain against each check's CAs,
+// so the same leaf proven through another chain is kept.
+func mergeProofs(device, user []certposture.Proof) []certposture.Proof {
+	if len(user) == 0 {
+		return device
+	}
+
+	seen := make(map[[sha256.Size]byte]struct{}, len(device)+len(user))
+	for _, proof := range device {
+		if len(proof.Chain) > 0 {
+			seen[chainDERFingerprint(proof.Chain)] = struct{}{}
+		}
+	}
+
+	merged := device
+	for _, proof := range user {
+		if len(proof.Chain) == 0 {
+			continue
+		}
+		fingerprint := chainDERFingerprint(proof.Chain)
+		if _, done := seen[fingerprint]; done {
+			continue
+		}
+		seen[fingerprint] = struct{}{}
+		merged = append(merged, proof)
+		logUserProof(proof)
+	}
+	return merged
+}
+
+func logUserProof(proof certposture.Proof) {
+	leaf, err := x509.ParseCertificate(proof.Chain[0])
+	if err != nil {
+		log.Debugf("certificate posture: user proof carries an unparsable leaf: %v", err)
+		return
+	}
+	log.Debugf("certificate posture: signed-in user proved %q issued by %q", leaf.Subject, leaf.Issuer)
+}
diff --git a/client/internal/certproof/merge_test.go b/client/internal/certproof/merge_test.go
new file mode 100644
index 000000000..7db2dd421
--- /dev/null
+++ b/client/internal/certproof/merge_test.go
@@ -0,0 +1,54 @@
+package certproof
+
+import (
+	"crypto/sha256"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+func TestMergeProofs_ProvesACertificateHeldByBothStoresOnce(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	shared := ca.Issue(t, certtest.ECDSAKey(t), "shared")
+	userOnly := ca.Issue(t, certtest.ECDSAKey(t), "user-only")
+
+	device := []certposture.Proof{{Chain: [][]byte{shared.Raw}}}
+	user := []certposture.Proof{{Chain: [][]byte{shared.Raw}}, {Chain: [][]byte{userOnly.Raw}}, {}}
+
+	merged := mergeProofs(device, user)
+
+	require.Len(t, merged, 2, "the shared leaf is proven once and the empty chain is dropped")
+	assert.Equal(t, shared.Raw, merged[0].Chain[0], "the device proof keeps its place")
+	assert.Equal(t, userOnly.Raw, merged[1].Chain[0], "the user-only certificate is appended")
+}
+
+func TestMergeProofs_KeepsDeviceProofsWhenNoUserSession(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	device := []certposture.Proof{{Chain: [][]byte{ca.Issue(t, certtest.ECDSAKey(t), "device").Raw}}}
+
+	merged := mergeProofs(device, nil)
+
+	require.Len(t, merged, 1, "a machine with nobody signed in still sends its device proof")
+	assert.Equal(t, sha256.Sum256(device[0].Chain[0]), sha256.Sum256(merged[0].Chain[0]), "the device proof is unchanged")
+}
+
+func TestMergeProofs_KeepsAnotherChainOfTheSameLeaf(t *testing.T) {
+	root := certtest.NewCA(t, "corp-root")
+	interA := root.Issue(t, certtest.ECDSAKey(t), "inter-a")
+	interB := root.Issue(t, certtest.ECDSAKey(t), "inter-b")
+	leaf := root.Issue(t, certtest.ECDSAKey(t), "leaf")
+
+	// Management checks each chain against each check's CAs, so the same leaf proven
+	// through another chain is a different proof, not a duplicate.
+	device := []certposture.Proof{{Chain: [][]byte{leaf.Raw, interA.Raw}}}
+	user := []certposture.Proof{{Chain: [][]byte{leaf.Raw, interB.Raw}}, {Chain: [][]byte{leaf.Raw, interA.Raw}}}
+
+	merged := mergeProofs(device, user)
+
+	require.Len(t, merged, 2, "the chain only the user store holds is kept, the one both hold is not repeated")
+	assert.Equal(t, interB.Raw, merged[1].Chain[1], "the user's chain through the other intermediate is appended")
+}
diff --git a/client/internal/certproof/pinlatch.go b/client/internal/certproof/pinlatch.go
new file mode 100644
index 000000000..79e396b11
--- /dev/null
+++ b/client/internal/certproof/pinlatch.go
@@ -0,0 +1,54 @@
+package certproof
+
+import (
+	"crypto/sha256"
+	"encoding/binary"
+	"errors"
+	"sync"
+)
+
+// errPINRejectedBefore is returned instead of logging in with a PIN the token already
+// refused: every failed login counts towards the token's lockout, which for a TPM is
+// shared with everything else on the machine, and proofs are collected on every sync.
+var errPINRejectedBefore = errors.New("PKCS#11 token rejected this PIN before, not trying it again")
+
+// errPINNeedsToken refuses a PIN that names no token to log in to.
+var errPINNeedsToken = errors.New("a PKCS#11 PIN needs the token named in NB_CERT_PKCS11_URI, as token=<label>")
+
+// rejectedPINs outlives a single store, since a store is built for each collection.
+var rejectedPINs = &pinLatch{keys: map[[sha256.Size]byte]struct{}{}}
+
+// pinLoginMu serializes logging in to a PKCS#11 token with a PIN, from checking the latch
+// to recording a rejection.
+var pinLoginMu sync.Mutex
+
+// pinLatch remembers PINs a token rejected. Keys are hashes, so the PIN itself is not
+// kept in memory any longer than the store that read it.
+type pinLatch struct {
+	mu   sync.Mutex
+	keys map[[sha256.Size]byte]struct{}
+}
+
+func (l *pinLatch) has(key [sha256.Size]byte) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	_, ok := l.keys[key]
+	return ok
+}
+
+func (l *pinLatch) add(key [sha256.Size]byte) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.keys[key] = struct{}{}
+}
+
+// rejectedPINKey identifies a PIN for one token of one module, so a PIN another token
+// rejected is still tried on the token it belongs to.
+func rejectedPINKey(module, token string, pin []byte) [sha256.Size]byte {
+	var buf []byte
+	for _, part := range [][]byte{[]byte(module), []byte(token), pin} {
+		buf = binary.BigEndian.AppendUint64(buf, uint64(len(part)))
+		buf = append(buf, part...)
+	}
+	return sha256.Sum256(buf)
+}
diff --git a/client/internal/certproof/pinlatch_test.go b/client/internal/certproof/pinlatch_test.go
new file mode 100644
index 000000000..bf3fa2b31
--- /dev/null
+++ b/client/internal/certproof/pinlatch_test.go
@@ -0,0 +1,29 @@
+package certproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRejectedPINKey_ScopesToModuleTokenAndPIN(t *testing.T) {
+	base := rejectedPINKey("/lib/a.so", "netbird", []byte("1234"))
+
+	assert.Equal(t, base, rejectedPINKey("/lib/a.so", "netbird", []byte("1234")), "the same PIN on the same token is the same key")
+	assert.NotEqual(t, base, rejectedPINKey("/lib/a.so", "netbird", []byte("4321")), "a corrected PIN must be tried")
+	assert.NotEqual(t, base, rejectedPINKey("/lib/a.so", "piv", []byte("1234")), "a PIN rejected by one token is still tried on another")
+	assert.NotEqual(t, base, rejectedPINKey("/lib/b.so", "netbird", []byte("1234")), "a PIN rejected through one module is still tried through another")
+	assert.NotEqual(t, rejectedPINKey("ab", "", []byte("1")), rejectedPINKey("a", "b", []byte("1")),
+		"field boundaries are part of the key, so shifted fields do not collide")
+}
+
+func TestPINLatch_RemembersRejectedKeys(t *testing.T) {
+	latch := &pinLatch{keys: map[[32]byte]struct{}{}}
+	rejected := rejectedPINKey("/lib/a.so", "netbird", []byte("0000"))
+	other := rejectedPINKey("/lib/a.so", "netbird", []byte("1234"))
+
+	assert.False(t, latch.has(rejected), "nothing is rejected before a login fails")
+	latch.add(rejected)
+	assert.True(t, latch.has(rejected), "a rejected PIN is not tried again")
+	assert.False(t, latch.has(other), "other PINs are unaffected")
+}
diff --git a/client/internal/certproof/pkcs11store.go b/client/internal/certproof/pkcs11store.go
new file mode 100644
index 000000000..381f55799
--- /dev/null
+++ b/client/internal/certproof/pkcs11store.go
@@ -0,0 +1,342 @@
+package certproof
+
+import (
+	"context"
+	"crypto"
+	"crypto/sha256"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/pkcs11"
+)
+
+const (
+	// PINEnv carries the user PIN of the PKCS#11 token. It is read from the daemon's
+	// environment only, so the PIN never lands in the profile config or on a command line.
+	PINEnv = "NB_TPM_PIN"
+	// PKCS11URIEnv carries the RFC 7512 URI of the token. Like the PIN it lives in the
+	// daemon's environment rather than the profile config, since it may carry pin-value.
+	PKCS11URIEnv = "NB_CERT_PKCS11_URI"
+)
+
+// PKCS11Config names the token whose certificates the store yields. URI is an RFC 7512
+// PKCS#11 URI, or empty for the first token the p11-kit proxy exposes. PIN is the user
+// PIN, and takes precedence over a pin-value or pin-source the URI carries.
+type PKCS11Config struct {
+	URI string
+	PIN string
+}
+
+// PKCS11FromEnv returns the token named by NB_CERT_PKCS11_URI with the PIN set in
+// NB_TPM_PIN, either empty when unset.
+func PKCS11FromEnv() PKCS11Config {
+	return PKCS11Config{URI: os.Getenv(PKCS11URIEnv), PIN: os.Getenv(PINEnv)}
+}
+
+// pkcs11Store yields the identities of a PKCS#11 token, which is how tpm2-pkcs11 exposes
+// TPM-held keys on Linux. Certificates on the token are paired with keys by CKA_ID, the
+// convention tpm2_ptool addcert and pkcs11-tool follow; certificate files in the PEM
+// directory by public key. Every signature happens on the token.
+type pkcs11Store struct {
+	uri     *pkcs11.URI
+	pin     string
+	certDir string
+}
+
+// newPKCS11Store parses cfg.URI, standing in the bare defaults when it is empty. Files in
+// certDir without a key of their own are paired with the token's keys by public key.
+//
+// A PIN is only accepted together with a token label: without one the PIN would go to
+// whichever token the module lists first, which on a machine with a smartcard plugged
+// in may be the card, and every wrong PIN counts towards that card's lockout.
+func newPKCS11Store(cfg PKCS11Config, certDir string) (*pkcs11Store, error) {
+	store := &pkcs11Store{uri: &pkcs11.URI{}, pin: cfg.PIN, certDir: certDir}
+	if cfg.URI != "" {
+		parsed, err := pkcs11.ParseURI(cfg.URI)
+		if err != nil {
+			return nil, err
+		}
+		store.uri = parsed
+	}
+	if (cfg.PIN != "" || store.uri.HasPIN()) && store.uri.Token == "" {
+		return nil, errPINNeedsToken
+	}
+	return store, nil
+}
+
+func (s *pkcs11Store) Candidates(_ context.Context) ([]Candidate, error) {
+	session, err := s.open()
+	if err != nil {
+		return nil, err
+	}
+	defer session.Close()
+
+	certs, err := tokenCertificates(session)
+	if err != nil {
+		return nil, err
+	}
+	fileChains, fileIntermediates, err := s.fileChains()
+	if err != nil {
+		return nil, err
+	}
+	log.Debugf("%s holds %d certificates, %d certificate files without a key wait for its keys", s, len(certs), len(fileChains))
+
+	pool := make([]*x509.Certificate, 0, len(certs))
+	for _, cert := range certs {
+		pool = append(pool, cert.cert)
+	}
+	for _, chain := range fileChains {
+		pool = append(pool, chain...)
+	}
+	pool = append(pool, fileIntermediates...)
+
+	var candidates []Candidate
+	for _, cert := range certs {
+		if _, err := privateKey(session, cert.id); err != nil {
+			log.Debugf("%s certificate %q has no usable private key: %v", s, cert.cert.Subject, err)
+			continue
+		}
+		candidates = append(candidates, s.candidate(cert.cert, cert.id, pool))
+	}
+	if len(fileChains) == 0 {
+		return candidates, nil
+	}
+
+	// A token that cannot list its public keys still answers for the certificates it
+	// holds, so the identities found above are kept.
+	keys, err := tokenPublicKeys(session)
+	if err != nil {
+		log.Warnf("%s: cannot read its public keys, certificate files are not paired with them: %v", s, err)
+		return candidates, nil
+	}
+	for _, chain := range fileChains {
+		leaf := chain[0]
+		id, ok := keys.idFor(leaf.PublicKey)
+		if !ok {
+			log.Debugf("%s holds no key for certificate %q from %s", s, leaf.Subject, s.certDir)
+			continue
+		}
+		candidates = append(candidates, s.candidate(leaf, id, pool))
+	}
+	return candidates, nil
+}
+
+func (s *pkcs11Store) candidate(leaf *x509.Certificate, id []byte, pool []*x509.Certificate) Candidate {
+	chain := buildChain(leaf, pool)
+	log.Debugf("%s candidate %q issued by %q built a chain of %d certificates", s, leaf.Subject, leaf.Issuer, len(chain))
+	return Candidate{Chain: chain, Signer: &pkcs11Signer{store: s, leaf: leaf, id: id}, Intermediates: pool}
+}
+
+// fileChains reads the certificate files in the PEM directory that carry no key of their
+// own; the file store answers for the ones that do. The certificates of a file that does
+// carry a key are returned too, since they can complete the chain of a token certificate.
+func (s *pkcs11Store) fileChains() (chains [][]*x509.Certificate, intermediates []*x509.Certificate, err error) {
+	if s.certDir == "" {
+		return nil, nil, nil
+	}
+	paths, err := certFiles(s.certDir)
+	if err != nil {
+		return nil, nil, err
+	}
+	for _, path := range paths {
+		chain, signer, err := loadPEM(path)
+		if err != nil {
+			continue
+		}
+		if signer != nil {
+			intermediates = append(intermediates, chain...)
+			continue
+		}
+		chains = append(chains, chain)
+	}
+	return chains, intermediates, nil
+}
+
+func (s *pkcs11Store) String() string {
+	if s.uri.Token == "" {
+		return "PKCS#11 token"
+	}
+	return fmt.Sprintf("PKCS#11 token %q", s.uri.Token)
+}
+
+func (s *pkcs11Store) open() (*pkcs11.Session, error) {
+	module, err := pkcs11.Load(s.uri.Module())
+	if err != nil {
+		return nil, err
+	}
+	pin, err := s.userPIN()
+	if err != nil {
+		return nil, err
+	}
+	if pin == nil {
+		return module.OpenSession(s.uri.Token, nil)
+	}
+
+	// The check, the login and recording a rejection happen under one lock, so two
+	// collections running at once cannot both send a PIN the token is about to refuse.
+	pinLoginMu.Lock()
+	defer pinLoginMu.Unlock()
+	key := rejectedPINKey(s.uri.Module(), s.uri.Token, pin)
+	if rejectedPINs.has(key) {
+		return nil, errPINRejectedBefore
+	}
+	session, err := module.OpenSession(s.uri.Token, pin)
+	if pkcs11.PINRejected(err) {
+		rejectedPINs.add(key)
+		return nil, fmt.Errorf("%s rejected the PIN, not retrying it until the daemon restarts: %w", s, err)
+	}
+	return session, err
+}
+
+func (s *pkcs11Store) userPIN() ([]byte, error) {
+	if s.pin != "" {
+		return []byte(s.pin), nil
+	}
+	return s.uri.PIN()
+}
+
+type tokenKey struct {
+	id     []byte
+	public crypto.PublicKey
+}
+
+type tokenKeys []tokenKey
+
+func tokenPublicKeys(session *pkcs11.Session) (tokenKeys, error) {
+	objects, err := session.FindObjects(pkcs11.Attribute{Type: pkcs11.AttrClass, Value: pkcs11.ULong(pkcs11.ClassPublicKey)})
+	if err != nil {
+		return nil, err
+	}
+	keys := make(tokenKeys, 0, len(objects))
+	for _, object := range objects {
+		id, err := session.Attribute(object, pkcs11.AttrID)
+		if err != nil {
+			log.Debugf("skipping public key on PKCS#11 token: %v", err)
+			continue
+		}
+		public, err := session.PublicKey(object)
+		if err != nil {
+			log.Debugf("skipping public key on PKCS#11 token: %v", err)
+			continue
+		}
+		keys = append(keys, tokenKey{id: id, public: public})
+	}
+	return keys, nil
+}
+
+// idFor finds the token key whose public half is pub, so a certificate kept outside the
+// token is still signed for by the key inside it.
+func (k tokenKeys) idFor(pub crypto.PublicKey) ([]byte, bool) {
+	for _, key := range k {
+		equaler, ok := key.public.(interface{ Equal(crypto.PublicKey) bool })
+		if ok && len(key.id) > 0 && equaler.Equal(pub) {
+			return key.id, true
+		}
+	}
+	return nil, false
+}
+
+type tokenCertificate struct {
+	cert *x509.Certificate
+	id   []byte
+}
+
+func tokenCertificates(session *pkcs11.Session) ([]tokenCertificate, error) {
+	objects, err := session.FindObjects(
+		pkcs11.Attribute{Type: pkcs11.AttrClass, Value: pkcs11.ULong(pkcs11.ClassCertificate)},
+		pkcs11.Attribute{Type: pkcs11.AttrCertificateType, Value: pkcs11.ULong(pkcs11.CertificateX509)},
+	)
+	if err != nil {
+		return nil, err
+	}
+	certs := make([]tokenCertificate, 0, len(objects))
+	for _, object := range objects {
+		der, err := session.Attribute(object, pkcs11.AttrValue)
+		if err != nil {
+			return nil, err
+		}
+		cert, err := x509.ParseCertificate(der)
+		if err != nil {
+			log.Warnf("skipping unparsable certificate on PKCS#11 token: %v", err)
+			continue
+		}
+		id, err := session.Attribute(object, pkcs11.AttrID)
+		if err != nil {
+			return nil, err
+		}
+		certs = append(certs, tokenCertificate{cert: cert, id: id})
+	}
+	return certs, nil
+}
+
+var errNoPrivateKey = errors.New("no private key shares the certificate's CKA_ID")
+
+func privateKey(session *pkcs11.Session, id []byte) (pkcs11.Object, error) {
+	if len(id) == 0 {
+		return 0, errNoPrivateKey
+	}
+	keys, err := session.FindObjects(
+		pkcs11.Attribute{Type: pkcs11.AttrClass, Value: pkcs11.ULong(pkcs11.ClassPrivateKey)},
+		pkcs11.Attribute{Type: pkcs11.AttrID, Value: id},
+	)
+	if err != nil {
+		return 0, err
+	}
+	if len(keys) == 0 {
+		return 0, errNoPrivateKey
+	}
+	return keys[0], nil
+}
+
+// pkcs11Signer holds only the certificate and its CKA_ID; the key is looked up in a fresh
+// session at signing time so no token handle outlives a call.
+type pkcs11Signer struct {
+	store *pkcs11Store
+	leaf  *x509.Certificate
+	id    []byte
+}
+
+func (s *pkcs11Signer) Public() crypto.PublicKey {
+	return s.leaf.PublicKey
+}
+
+func (s *pkcs11Signer) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	scheme, err := schemeFor(s.leaf.PublicKey, opts)
+	if err != nil {
+		return nil, err
+	}
+	session, err := s.store.open()
+	if err != nil {
+		return nil, err
+	}
+	defer session.Close()
+
+	key, err := privateKey(session, s.id)
+	if err != nil {
+		return nil, err
+	}
+	signature, err := session.Sign(pkcs11Mechanism(scheme), key, digest)
+	if err != nil {
+		return nil, err
+	}
+	if scheme == schemeRSAPSSSHA256 {
+		return signature, nil
+	}
+	return ecdsaSignatureASN1(signature)
+}
+
+// pkcs11Mechanism maps a signature scheme onto the token mechanism that consumes a digest.
+func pkcs11Mechanism(scheme sigScheme) pkcs11.Mechanism {
+	if scheme == schemeRSAPSSSHA256 {
+		return pkcs11.Mechanism{
+			Type: pkcs11.MechRSAPKCSPSS,
+			PSS:  &pkcs11.PSSParams{Hash: pkcs11.MechSHA256, MGF: pkcs11.MGF1SHA256, SaltLen: sha256.Size},
+		}
+	}
+	return pkcs11.Mechanism{Type: pkcs11.MechECDSA}
+}
diff --git a/client/internal/certproof/pkcs11store_test.go b/client/internal/certproof/pkcs11store_test.go
new file mode 100644
index 000000000..746b54918
--- /dev/null
+++ b/client/internal/certproof/pkcs11store_test.go
@@ -0,0 +1,407 @@
+package certproof
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/asn1"
+	"errors"
+	"math/big"
+	"os"
+	"runtime"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/pkcs11"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const (
+	testPKCS11URIEnv = "NB_TEST_PKCS11_URI"
+	// testPKCS11DisposableEnv marks the token as disposable, allowing tests that spend
+	// attempts of its PIN lockout counter.
+	testPKCS11DisposableEnv = "NB_TEST_PKCS11_DISPOSABLE"
+)
+
+type failingStore struct{}
+
+func (failingStore) Candidates(context.Context) ([]Candidate, error) {
+	return nil, errors.New("token unplugged")
+}
+
+func TestStores_KeepsFileCertificatesWhenTokenFails(t *testing.T) {
+	ca := certtest.NewCA(t, "corp")
+	key := certtest.ECDSAKey(t)
+	dir := storeDir(t)
+	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
+
+	candidates, err := Stores{failingStore{}, newFileStore(dir)}.Candidates(context.Background())
+	require.NoError(t, err)
+	assert.Len(t, candidates, 1, "the directory's certificate must survive a failing token")
+}
+
+// TestCollect_PKCS11TokenEndToEnd needs an initialised token with a user PIN, named by
+// NB_TEST_PKCS11_URI. With SoftHSM:
+//
+//	softhsm2-util --init-token --free --label netbird --pin 1234 --so-pin 1234
+//	NB_TEST_PKCS11_URI='pkcs11:token=netbird?module-path=/usr/lib/softhsm/libsofthsm2.so&pin-value=1234' \
+//	  go test -tags pkcs11 ./client/internal/certproof/ -run PKCS11 -v
+//
+// It imports a key and its certificate as token objects, then proves the certificate
+// through the store the way the daemon would. Every run adds one more identity to the token.
+func TestCollect_PKCS11TokenEndToEnd(t *testing.T) {
+	store, uri := pkcs11TestStore(t, "")
+
+	keys := map[string]crypto.Signer{"ecdsa": certtest.ECDSAKey(t), "rsa": certtest.RSAKey(t)}
+	for name, key := range keys {
+		t.Run(name, func(t *testing.T) {
+			ca := certtest.NewCA(t, "corp-"+name)
+			leaf := ca.Issue(t, key, "device-"+name)
+			importIdentity(t, uri, key, leaf)
+
+			challenger := certposture.NewChallenger([]byte("secret"))
+			now := time.Now()
+			nonce := challenger.Nonce(peerKey, now)
+			checks := []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: nonce, CaCertificates: []string{ca.PEM}}}}
+
+			proofs := Collect(context.Background(), store, checks, peerKey)
+			require.Len(t, proofs, 1, "the token-held key must prove exactly this run's certificate")
+			chain, err := challenger.Verify(proofs[0], peerKey, now)
+			require.NoError(t, err)
+			assert.True(t, leaf.Equal(chain[0]), "proof must carry the imported certificate")
+		})
+	}
+}
+
+// Attribute types the import needs and the store does not.
+const (
+	attrPrivate         = 0x2
+	attrIssuer          = 0x81
+	attrSerialNumber    = 0x82
+	attrSensitive       = 0x103
+	attrSign            = 0x108
+	attrVerify          = 0x10a
+	attrPrivateExponent = 0x123
+	attrPrime1          = 0x124
+	attrPrime2          = 0x125
+	attrExponent1       = 0x126
+	attrExponent2       = 0x127
+	attrCoefficient     = 0x128
+)
+
+var (
+	ckTrue  = []byte{1}
+	ckFalse = []byte{0}
+	// The P-256 named curve OID in DER, which is what CKA_EC_PARAMS carries.
+	oidP256 = []byte{0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07}
+)
+
+// importIdentity stores key and leaf on the token the way tpm2_ptool import and addcert
+// do: private and public key objects plus the certificate, all under one CKA_ID.
+func importIdentity(t *testing.T, uri string, key crypto.Signer, leaf *x509.Certificate) {
+	t.Helper()
+	id := importKey(t, uri, key, leaf.Subject.CommonName)
+	importCertificate(t, uri, leaf, id)
+}
+
+func importKey(t *testing.T, uri string, key crypto.Signer, label string) []byte {
+	t.Helper()
+	session := readWriteSession(t, uri)
+	defer session.Close()
+
+	id := make([]byte, 8)
+	_, err := rand.Read(id)
+	require.NoError(t, err)
+
+	private := []pkcs11.Attribute{
+		attr(pkcs11.AttrClass, pkcs11.ULong(pkcs11.ClassPrivateKey)),
+		attr(pkcs11.AttrToken, ckTrue),
+		attr(attrPrivate, ckTrue),
+		attr(attrSensitive, ckTrue),
+		attr(attrSign, ckTrue),
+		attr(pkcs11.AttrLabel, []byte(label)),
+		attr(pkcs11.AttrID, id),
+	}
+	_, err = session.CreateObject(append(private, privateKeyAttributes(t, key)...)...)
+	require.NoError(t, err, "import private key")
+
+	public := []pkcs11.Attribute{
+		attr(pkcs11.AttrClass, pkcs11.ULong(pkcs11.ClassPublicKey)),
+		attr(pkcs11.AttrToken, ckTrue),
+		attr(attrPrivate, ckFalse),
+		attr(attrVerify, ckTrue),
+		attr(pkcs11.AttrLabel, []byte(label)),
+		attr(pkcs11.AttrID, id),
+	}
+	_, err = session.CreateObject(append(public, publicKeyAttributes(t, key)...)...)
+	require.NoError(t, err, "import public key")
+	return id
+}
+
+func importCertificate(t *testing.T, uri string, leaf *x509.Certificate, id []byte) {
+	t.Helper()
+	session := readWriteSession(t, uri)
+	defer session.Close()
+
+	serial, err := asn1.Marshal(leaf.SerialNumber)
+	require.NoError(t, err)
+	_, err = session.CreateObject(
+		attr(pkcs11.AttrClass, pkcs11.ULong(pkcs11.ClassCertificate)),
+		attr(pkcs11.AttrCertificateType, pkcs11.ULong(pkcs11.CertificateX509)),
+		attr(pkcs11.AttrToken, ckTrue),
+		attr(attrPrivate, ckFalse),
+		attr(pkcs11.AttrLabel, []byte(leaf.Subject.CommonName)),
+		attr(pkcs11.AttrID, id),
+		attr(pkcs11.AttrSubject, leaf.RawSubject),
+		attr(attrIssuer, leaf.RawIssuer),
+		attr(attrSerialNumber, serial),
+		attr(pkcs11.AttrValue, leaf.Raw),
+	)
+	require.NoError(t, err, "import certificate")
+}
+
+func readWriteSession(t *testing.T, uri string) *pkcs11.Session {
+	t.Helper()
+	parsed, err := pkcs11.ParseURI(uri)
+	require.NoError(t, err)
+	module, err := pkcs11.Load(parsed.Module())
+	require.NoError(t, err)
+	pin, err := parsed.PIN()
+	require.NoError(t, err)
+	session, err := module.OpenReadWriteSession(parsed.Token, pin)
+	require.NoError(t, err)
+	return session
+}
+
+func privateKeyAttributes(t *testing.T, key crypto.Signer) []pkcs11.Attribute {
+	t.Helper()
+	switch k := key.(type) {
+	case *ecdsa.PrivateKey:
+		return []pkcs11.Attribute{
+			attr(pkcs11.AttrKeyType, pkcs11.ULong(pkcs11.KeyEC)),
+			attr(pkcs11.AttrECParams, oidP256),
+			attr(pkcs11.AttrValue, ecPrivateScalar(t, k)),
+		}
+	case *rsa.PrivateKey:
+		k.Precompute()
+		return []pkcs11.Attribute{
+			attr(pkcs11.AttrKeyType, pkcs11.ULong(pkcs11.KeyRSA)),
+			attr(pkcs11.AttrModulus, k.N.Bytes()),
+			attr(pkcs11.AttrPublicExponent, big.NewInt(int64(k.E)).Bytes()),
+			attr(attrPrivateExponent, k.D.Bytes()),
+			attr(attrPrime1, k.Primes[0].Bytes()),
+			attr(attrPrime2, k.Primes[1].Bytes()),
+			attr(attrExponent1, k.Precomputed.Dp.Bytes()),
+			attr(attrExponent2, k.Precomputed.Dq.Bytes()),
+			attr(attrCoefficient, k.Precomputed.Qinv.Bytes()),
+		}
+	}
+	t.Fatalf("unsupported key %T", key)
+	return nil
+}
+
+// publicKeyAttributes describes the CKO_PUBLIC_KEY object tokens keep next to a private
+// key, which is what the store reads to pair a certificate file with its key.
+func publicKeyAttributes(t *testing.T, key crypto.Signer) []pkcs11.Attribute {
+	t.Helper()
+	switch k := key.(type) {
+	case *ecdsa.PrivateKey:
+		point := append([]byte{4}, k.X.FillBytes(make([]byte, 32))...)
+		point = append(point, k.Y.FillBytes(make([]byte, 32))...)
+		wrapped, err := asn1.Marshal(point)
+		require.NoError(t, err)
+		return []pkcs11.Attribute{
+			attr(pkcs11.AttrKeyType, pkcs11.ULong(pkcs11.KeyEC)),
+			attr(pkcs11.AttrECParams, oidP256),
+			attr(pkcs11.AttrECPoint, wrapped),
+		}
+	case *rsa.PrivateKey:
+		return []pkcs11.Attribute{
+			attr(pkcs11.AttrKeyType, pkcs11.ULong(pkcs11.KeyRSA)),
+			attr(pkcs11.AttrModulus, k.N.Bytes()),
+			attr(pkcs11.AttrPublicExponent, big.NewInt(int64(k.E)).Bytes()),
+		}
+	}
+	t.Fatalf("unsupported key %T", key)
+	return nil
+}
+
+func attr(typ uint, value []byte) pkcs11.Attribute {
+	return pkcs11.Attribute{Type: typ, Value: value}
+}
+
+// pkcs11TestStore builds the store for the token NB_TEST_PKCS11_URI names, skipping when
+// no token is configured or this build lacks PKCS#11 support.
+func pkcs11TestStore(t *testing.T, certDir string) (*pkcs11Store, string) {
+	t.Helper()
+	uri := os.Getenv(testPKCS11URIEnv)
+	if uri == "" {
+		t.Skipf("set %s to a PKCS#11 URI with a PIN to run", testPKCS11URIEnv)
+	}
+	store, err := newPKCS11Store(PKCS11Config{URI: uri}, certDir)
+	require.NoError(t, err)
+	if _, err := pkcs11.Load(store.uri.Module()); errors.Is(err, pkcs11.ErrUnsupported) {
+		t.Skip(err)
+	}
+	return store, uri
+}
+
+// TestCollect_PKCS11KeyWithFileCertificate covers the split layout: the key lives on the
+// token, the certificate is a PEM file in the directory, and the two are paired by public
+// key because nothing on the token carries the certificate's CKA_ID.
+func TestCollect_PKCS11KeyWithFileCertificate(t *testing.T) {
+	dir := storeDir(t)
+	store, uri := pkcs11TestStore(t, dir)
+
+	keys := map[string]crypto.Signer{"ecdsa": certtest.ECDSAKey(t), "rsa": certtest.RSAKey(t)}
+	for name, key := range keys {
+		t.Run(name, func(t *testing.T) {
+			ca := certtest.NewCA(t, "corp-file-"+name)
+			leaf := ca.Issue(t, key, "device-file-"+name)
+			importKey(t, uri, key, "device-file-"+name)
+			writeFile(t, dir, "device-"+name+".pem", certtest.CertPEM(leaf))
+
+			challenger := certposture.NewChallenger([]byte("secret"))
+			now := time.Now()
+			nonce := challenger.Nonce(peerKey, now)
+			checks := []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: nonce, CaCertificates: []string{ca.PEM}}}}
+
+			proofs := Collect(context.Background(), store, checks, peerKey)
+			require.Len(t, proofs, 1, "the token key must prove the certificate kept on disk")
+			chain, err := challenger.Verify(proofs[0], peerKey, now)
+			require.NoError(t, err)
+			assert.True(t, leaf.Equal(chain[0]), "proof must carry the certificate from the directory")
+		})
+	}
+}
+
+func TestPKCS11Store_FileChains(t *testing.T) {
+	ca := certtest.NewCA(t, "corp")
+	dir := storeDir(t)
+	// Only certificate files without a key of their own belong to the token; the file
+	// store answers for the others, and non-certificate files are ignored.
+	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, certtest.ECDSAKey(t), "device")))
+	writeFile(t, dir, "ca.crt", ca.PEM)
+	keyed := certtest.ECDSAKey(t)
+	writeFile(t, dir, "inline.pem", certtest.CertPEM(ca.Issue(t, keyed, "inline"))+certtest.KeyPEM(t, keyed))
+	writeFile(t, dir, "sibling.crt", certtest.CertPEM(ca.Issue(t, keyed, "sibling")))
+	writeFile(t, dir, "sibling.key", certtest.KeyPEM(t, keyed))
+	writeFile(t, dir, "notes.txt", "not a certificate")
+
+	// An intermediate that only a keyed file carries still has to reach the pool a token
+	// certificate's chain is built from.
+	root := certtest.NewCA(t, "corp-root")
+	intermediateCA := certtest.NewIntermediate(t, root, "corp-intermediate")
+	chained := certtest.ECDSAKey(t)
+	writeFile(t, dir, "chained.pem", certtest.CertPEM(intermediateCA.Issue(t, chained, "chained"))+certtest.CertPEM(intermediateCA.Cert)+certtest.KeyPEM(t, chained))
+
+	chains, extra, err := (&pkcs11Store{uri: &pkcs11.URI{}, certDir: dir}).fileChains()
+	require.NoError(t, err)
+	require.NotEmpty(t, extra, "the keyed file's certificates are offered for chain building")
+	tokenLeaf := intermediateCA.Issue(t, certtest.ECDSAKey(t), "token-leaf")
+	chain := buildChain(tokenLeaf, extra)
+	require.Len(t, chain, 2, "a token certificate is completed through the intermediate only the keyed file holds")
+	assert.True(t, intermediateCA.Cert.Equal(chain[1]), "the second certificate is that intermediate")
+	var subjects []string
+	for _, chain := range chains {
+		subjects = append(subjects, chain[0].Subject.CommonName)
+	}
+	assert.ElementsMatch(t, []string{"device", "corp"}, subjects, "only key-less certificate files are left to the token")
+
+	chains, extra, err = (&pkcs11Store{uri: &pkcs11.URI{}}).fileChains()
+	require.NoError(t, err)
+	assert.Empty(t, chains, "no directory configured means no file certificates")
+	assert.Empty(t, extra, "and no extra intermediates")
+}
+
+func TestNewPKCS11Store_PIN(t *testing.T) {
+	tests := []struct {
+		name       string
+		cfg        PKCS11Config
+		wantPIN    []byte
+		wantModule string
+	}{
+		{"pin with a token label opens that token through p11-kit", PKCS11Config{URI: "pkcs11:token=netbird", PIN: "1234"}, []byte("1234"), pkcs11.DefaultModule},
+		{"pin field wins over pin-value", PKCS11Config{URI: "pkcs11:token=netbird?module-path=" + absModule("x.so") + "&pin-value=0000", PIN: "1234"}, []byte("1234"), absModule("x.so")},
+		{"uri pin-value stands in for a missing field", PKCS11Config{URI: "pkcs11:token=netbird?pin-value=0000"}, []byte("0000"), pkcs11.DefaultModule},
+		{"no pin at all means no login", PKCS11Config{URI: "pkcs11:token=netbird"}, nil, pkcs11.DefaultModule},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store, err := newPKCS11Store(tt.cfg, "")
+			require.NoError(t, err)
+			pin, err := store.userPIN()
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantPIN, pin, "PIN, nil meaning no login")
+			assert.Equal(t, tt.wantModule, store.uri.Module(), "module to load")
+		})
+	}
+
+	_, err := newPKCS11Store(PKCS11Config{URI: "not-a-pkcs11-uri", PIN: "1234"}, "")
+	assert.Error(t, err, "a malformed URI must not be silently replaced by the defaults")
+
+	for name, cfg := range map[string]PKCS11Config{
+		"env pin without uri":      {PIN: "1234"},
+		"env pin, uri lacks token": {URI: "pkcs11:?module-path=" + absModule("x.so"), PIN: "1234"},
+		"inline pin-value only":    {URI: "pkcs11:?pin-value=0000"},
+		"pin-source only":          {URI: "pkcs11:?pin-source=file:/etc/netbird/pkcs11.pin"},
+	} {
+		_, err := newPKCS11Store(cfg, "")
+		assert.ErrorIs(t, err, errPINNeedsToken, "%s: a PIN must not go to whichever token is listed first", name)
+	}
+}
+
+// TestPKCS11Store_WrongPINIsTriedOnce logs in to the real token with a wrong PIN: the
+// token refuses it, and the next collection refuses to send the same PIN again rather
+// than spending another attempt of the token's lockout counter. The one attempt it does
+// spend counts against a real token's lockout, so it runs only on a token marked
+// disposable through NB_TEST_PKCS11_DISPOSABLE.
+func TestPKCS11Store_WrongPINIsTriedOnce(t *testing.T) {
+	disposable, _ := strconv.ParseBool(os.Getenv(testPKCS11DisposableEnv))
+	if !disposable {
+		t.Skipf("set %s=1 to spend a wrong-PIN attempt on the token", testPKCS11DisposableEnv)
+	}
+	_, uri := pkcs11TestStore(t, "")
+
+	wrongPIN := "wrong-pin-" + t.Name()
+	store, err := newPKCS11Store(PKCS11Config{URI: uri, PIN: wrongPIN}, "")
+	require.NoError(t, err)
+
+	_, err = store.Candidates(context.Background())
+	require.Error(t, err)
+	assert.True(t, pkcs11.PINRejected(err), "the token itself rejects the PIN: %v", err)
+
+	_, err = store.Candidates(context.Background())
+	assert.ErrorIs(t, err, errPINRejectedBefore, "the rejected PIN is not sent to the token again")
+
+	good, err := newPKCS11Store(PKCS11Config{URI: uri}, "")
+	require.NoError(t, err)
+	_, err = good.Candidates(context.Background())
+	assert.NoError(t, err, "the correct PIN for the same token is unaffected")
+}
+
+// absModule is an absolute module path on the platform the test runs on, as module-path
+// must be absolute.
+func absModule(name string) string {
+	if runtime.GOOS == "windows" {
+		return `C:\lib\` + name
+	}
+	return "/lib/" + name
+}
+
+// ecPrivateScalar returns the raw private scalar the token stores in CKA_VALUE.
+func ecPrivateScalar(t *testing.T, k *ecdsa.PrivateKey) []byte {
+	t.Helper()
+	raw, err := k.Bytes()
+	require.NoError(t, err)
+	return raw
+}
diff --git a/client/internal/certproof/signattempts.go b/client/internal/certproof/signattempts.go
new file mode 100644
index 000000000..b056991bf
--- /dev/null
+++ b/client/internal/certproof/signattempts.go
@@ -0,0 +1,24 @@
+package certproof
+
+import "errors"
+
+// signAttempts tracks the identities tried to sign with, for a certificate that can match
+// more than one of them.
+type signAttempts struct {
+	errs []error
+}
+
+// try runs sign and reports its signature and whether it succeeded. A failure is kept.
+func (a *signAttempts) try(sign func() ([]byte, error)) ([]byte, bool) {
+	signature, err := sign()
+	if err != nil {
+		a.errs = append(a.errs, err)
+		return nil, false
+	}
+	return signature, true
+}
+
+// err joins the failures of the attempts, nil when there were none.
+func (a *signAttempts) err() error {
+	return errors.Join(a.errs...)
+}
diff --git a/client/internal/certproof/signattempts_test.go b/client/internal/certproof/signattempts_test.go
new file mode 100644
index 000000000..f5a2fef4f
--- /dev/null
+++ b/client/internal/certproof/signattempts_test.go
@@ -0,0 +1,41 @@
+package certproof
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var errNeedsApprovalForTest = errors.New("key needs approval")
+
+// TestSignAttempts_FallsThroughToTheNextIdentity: a certificate can sit in a keychain with
+// more than one key, of which only some can sign. A failure moves on, and an identity that
+// signs ends the search without reporting the earlier failure.
+func TestSignAttempts_FallsThroughToTheNextIdentity(t *testing.T) {
+	var attempts signAttempts
+
+	signature, ok := attempts.try(func() ([]byte, error) { return nil, errNeedsApprovalForTest })
+	assert.False(t, ok, "a failing identity does not end the search")
+	assert.Nil(t, signature)
+
+	signature, ok = attempts.try(func() ([]byte, error) { return []byte("sig"), nil })
+	require.True(t, ok, "the next identity signs")
+	assert.Equal(t, []byte("sig"), signature)
+}
+
+// TestSignAttempts_KeepsEveryFailure: when no identity signs, the approval a user has to
+// give must not be hidden behind the failure of a later identity.
+func TestSignAttempts_KeepsEveryFailure(t *testing.T) {
+	var attempts signAttempts
+	assert.NoError(t, attempts.err(), "no attempts, no error")
+
+	attempts.try(func() ([]byte, error) { return nil, errNeedsApprovalForTest })
+	attempts.try(func() ([]byte, error) { return nil, errors.New("key is gone") })
+
+	err := attempts.err()
+	require.Error(t, err)
+	assert.ErrorIs(t, err, errNeedsApprovalForTest, "the earlier approval error survives the later failure")
+	assert.ErrorContains(t, err, "key is gone")
+}
diff --git a/client/internal/certproof/store.go b/client/internal/certproof/store.go
new file mode 100644
index 000000000..85ab7cda7
--- /dev/null
+++ b/client/internal/certproof/store.go
@@ -0,0 +1,266 @@
+package certproof
+
+import (
+	"context"
+	"crypto"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	StoreDirEnv     = "NB_CERT_STORE_DIR"
+	defaultStoreDir = "/etc/netbird/certs"
+
+	// maxStoreFileSize bounds a certificate or key file of the PEM directory. A chain with
+	// its key is a few kilobytes.
+	maxStoreFileSize = 1 << 20
+)
+
+// errKeyMismatch rejects a key that does not belong to the certificate it sits with: it
+// would sign a proof management can only reject, in place of a usable later candidate.
+var (
+	errKeyMismatch  = errors.New("private key does not match the certificate")
+	errNoSiblingKey = errors.New("no key file next to the certificate")
+)
+
+// Candidate is a certificate chain the peer can sign for. Signer never exposes the key.
+// Chain is leaf first. Intermediates holds every other certificate the store has, so a
+// path to a challenge's CAs can be found even where Chain followed a different issuer,
+// such as an expired copy of a renewed intermediate.
+type Candidate struct {
+	Chain         []*x509.Certificate
+	Signer        crypto.Signer
+	Intermediates []*x509.Certificate
+}
+
+// issuers is every certificate other than the leaf that a path may run through.
+func (c Candidate) issuers() []*x509.Certificate {
+	return append(slices.Clip(c.Chain[1:]), c.Intermediates...)
+}
+
+// Store yields the certificates a peer may prove possession of. fileStore is the PEM
+// directory implementation; OS keystores (CNG, Keychain, PKCS#11) slot in here.
+type Store interface {
+	Candidates(ctx context.Context) ([]Candidate, error)
+}
+
+// Config selects where the daemon looks for certificates. PKCS11 names a token whose keys
+// sign for certificates on the token or in the PEM directory, which NB_CERT_STORE_DIR
+// names on Linux, /etc/netbird/certs by default.
+//
+// ProfileOwner is the OS account the active profile belongs to. On macOS and Windows only
+// that account's certificate store is consulted for user certificates, so on a machine
+// with several people signed in the result does not depend on who else is logged in.
+// Empty means the profile has no owner, and only the user at the physical console counts.
+// OwnerUnknown means the owner could not be determined, and no user store is consulted:
+// guessing would let whoever sits at the console answer for the profile.
+type Config struct {
+	PKCS11       PKCS11Config
+	ProfileOwner string
+	OwnerUnknown bool
+}
+
+// fileStore reads PEM files from a directory. A file holds the chain (leaf first) and
+// either its private key or a sibling "<name>.key" file holds it. The key is a plain
+// PKCS#8, EC or RSA key, or a TSS2 key the TPM signs with.
+type fileStore struct {
+	dir string
+}
+
+func newFileStore(dir string) *fileStore {
+	return &fileStore{dir: dir}
+}
+
+func StoreDir() string {
+	if dir := os.Getenv(StoreDirEnv); dir != "" {
+		return dir
+	}
+	return defaultStoreDir
+}
+
+func (s *fileStore) Candidates(_ context.Context) ([]Candidate, error) {
+	paths, err := certFiles(s.dir)
+	if err != nil {
+		return nil, err
+	}
+
+	var candidates []Candidate
+	for _, path := range paths {
+		chain, signer, err := loadPEM(path)
+		if err != nil {
+			log.Warnf("skipping certificate %s: %v", path, err)
+			continue
+		}
+		if signer == nil {
+			log.Debugf("certificate %s has no key file, only a token can sign for it", path)
+			continue
+		}
+		candidates = append(candidates, Candidate{Chain: chain, Signer: signer})
+	}
+	return candidates, nil
+}
+
+// certFiles lists the certificate files in dir, none when the directory does not exist.
+// The directory is checked before it is listed, so one that others can write to is
+// refused before its entries are read.
+func certFiles(dir string) ([]string, error) {
+	err := checkStoreDir(dir)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("refusing certificate store: %w", err)
+	}
+	entries, err := os.ReadDir(dir)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("read certificate store %s: %w", dir, err)
+	}
+	var paths []string
+	for _, entry := range entries {
+		if !entry.IsDir() && isCertFile(entry.Name()) {
+			paths = append(paths, filepath.Join(dir, entry.Name()))
+		}
+	}
+	return paths, nil
+}
+
+// loadPEM reads a certificate file and its private key, held in the file itself or in
+// the sibling "<name>.key" file. The signer is nil when neither holds a key.
+func loadPEM(path string) ([]*x509.Certificate, crypto.Signer, error) {
+	data, err := readStoreFile(path)
+	if err != nil {
+		return nil, nil, err
+	}
+	chain, signer, err := parsePEM(data)
+	if err != nil {
+		return nil, nil, err
+	}
+	if len(chain) == 0 {
+		return nil, nil, errors.New("no certificate")
+	}
+	if signer == nil {
+		signer, err = siblingKey(path)
+		switch {
+		case errors.Is(err, errNoSiblingKey):
+			// A certificate with no key of its own: the token store pairs it later.
+			return chain, nil, nil
+		case err != nil:
+			return nil, nil, err
+		}
+	}
+	if !samePublicKey(signer.Public(), chain[0].PublicKey) {
+		return nil, nil, errKeyMismatch
+	}
+	return chain, signer, nil
+}
+
+// siblingKey reads the private key from the "<name>.key" file next to a certificate
+// file, reporting errNoSiblingKey when there is none.
+func siblingKey(path string) (crypto.Signer, error) {
+	keyData, err := readStoreFile(strings.TrimSuffix(path, filepath.Ext(path)) + ".key")
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, errNoSiblingKey
+	}
+	if err != nil {
+		return nil, fmt.Errorf("read key file: %w", err)
+	}
+	_, signer, err := parsePEM(keyData)
+	if err != nil {
+		return nil, err
+	}
+	if signer == nil {
+		return nil, errors.New("no private key in key file")
+	}
+	return signer, nil
+}
+
+func samePublicKey(a, b crypto.PublicKey) bool {
+	equaler, ok := a.(interface{ Equal(crypto.PublicKey) bool })
+	return ok && equaler.Equal(b)
+}
+
+func parsePEM(data []byte) ([]*x509.Certificate, crypto.Signer, error) {
+	var chain []*x509.Certificate
+	var signer crypto.Signer
+	for {
+		var block *pem.Block
+		block, data = pem.Decode(data)
+		if block == nil {
+			return chain, signer, nil
+		}
+		switch block.Type {
+		case "CERTIFICATE":
+			cert, err := x509.ParseCertificate(block.Bytes)
+			if err != nil {
+				return nil, nil, fmt.Errorf("parse certificate: %w", err)
+			}
+			chain = append(chain, cert)
+		case "PRIVATE KEY", "EC PRIVATE KEY", "RSA PRIVATE KEY", tss2KeyPEMType:
+			key, err := parsePrivateKey(block)
+			if err != nil {
+				return nil, nil, err
+			}
+			signer = key
+		}
+	}
+}
+
+func parsePrivateKey(block *pem.Block) (crypto.Signer, error) {
+	var key any
+	var err error
+	switch block.Type {
+	case tss2KeyPEMType:
+		return parseTSS2Key(block.Bytes)
+	case "EC PRIVATE KEY":
+		key, err = x509.ParseECPrivateKey(block.Bytes)
+	case "RSA PRIVATE KEY":
+		key, err = x509.ParsePKCS1PrivateKey(block.Bytes)
+	default:
+		key, err = x509.ParsePKCS8PrivateKey(block.Bytes)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("parse private key: %w", err)
+	}
+	signer, ok := key.(crypto.Signer)
+	if !ok {
+		return nil, errors.New("private key cannot sign")
+	}
+	return signer, nil
+}
+
+func isCertFile(name string) bool {
+	switch strings.ToLower(filepath.Ext(name)) {
+	case ".pem", ".crt", ".cer":
+		return true
+	}
+	return false
+}
+
+// Stores queries several stores and carries on when one fails, so a broken token cannot
+// hide the certificates a directory holds. A failure is logged instead of returned
+// because Collect treats a store error as "no proofs at all".
+type Stores []Store
+
+func (s Stores) Candidates(ctx context.Context) ([]Candidate, error) {
+	var all []Candidate
+	for _, store := range s {
+		candidates, err := store.Candidates(ctx)
+		if err != nil {
+			log.Warnf("certificate store %T unavailable: %v", store, err)
+			continue
+		}
+		all = append(all, candidates...)
+	}
+	return all, nil
+}
diff --git a/client/internal/certproof/store_other.go b/client/internal/certproof/store_other.go
new file mode 100644
index 000000000..eeecf3c39
--- /dev/null
+++ b/client/internal/certproof/store_other.go
@@ -0,0 +1,39 @@
+//go:build ((!darwin && !windows) || ios) && !js
+
+package certproof
+
+import (
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/pkcs11"
+)
+
+var unsupportedTokenOnce sync.Once
+
+// DefaultStore is the PEM directory named by NB_CERT_STORE_DIR, or /etc/netbird/certs.
+func DefaultStore() Store {
+	return newFileStore(StoreDir())
+}
+
+// storeWithToken reads the PEM directory cfg names, joined by the PKCS#11 token when cfg
+// names one. The token pairs the directory's key-less certificates with its own keys.
+func storeWithToken(cfg Config) Store {
+	files := newFileStore(StoreDir())
+	if cfg.PKCS11.URI == "" && cfg.PKCS11.PIN == "" {
+		return files
+	}
+	if !pkcs11.Supported() {
+		unsupportedTokenOnce.Do(func() {
+			log.Warnf("ignoring the configured PKCS#11 token: %v", pkcs11.ErrUnsupported)
+		})
+		return files
+	}
+	token, err := newPKCS11Store(cfg.PKCS11, StoreDir())
+	if err != nil {
+		log.Warnf("ignoring PKCS#11 URI: %v", err)
+		return files
+	}
+	return Stores{files, token}
+}
diff --git a/client/internal/certproof/store_other_test.go b/client/internal/certproof/store_other_test.go
new file mode 100644
index 000000000..68b4df2a6
--- /dev/null
+++ b/client/internal/certproof/store_other_test.go
@@ -0,0 +1,44 @@
+//go:build ((!darwin && !windows) || ios) && !js
+
+package certproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/pkcs11"
+)
+
+func TestStoreWithToken(t *testing.T) {
+	dir := storeDir(t)
+	t.Setenv(StoreDirEnv, dir)
+
+	files, ok := storeWithToken(Config{}).(*fileStore)
+	require.True(t, ok, "no token configured reads the PEM directory alone")
+	assert.Equal(t, dir, files.dir, "the directory comes from NB_CERT_STORE_DIR")
+
+	assert.IsType(t, &fileStore{}, storeWithToken(Config{PKCS11: PKCS11Config{URI: "not-a-pkcs11-uri"}}), "an invalid URI must not hide the PEM directory")
+	assert.IsType(t, &fileStore{}, storeWithToken(Config{PKCS11: PKCS11Config{PIN: "1234"}}), "a PIN naming no token is refused and leaves the PEM directory")
+
+	configured := map[string]PKCS11Config{
+		"env pin with token uri": {URI: "pkcs11:token=netbird", PIN: "1234"},
+		"uri alone":              {URI: "pkcs11:token=netbird?pin-value=1234"},
+	}
+	if !pkcs11.Supported() {
+		for name, cfg := range configured {
+			assert.IsType(t, &fileStore{}, storeWithToken(Config{PKCS11: cfg}),
+				"%s: a build without PKCS#11 support reads the PEM directory alone", name)
+		}
+		return
+	}
+	for name, cfg := range configured {
+		store, ok := storeWithToken(Config{PKCS11: cfg}).(Stores)
+		require.True(t, ok, "%s joins the token to the PEM directory", name)
+		require.Len(t, store, 2, name)
+		token, ok := store[1].(*pkcs11Store)
+		require.True(t, ok, name)
+		assert.Equal(t, dir, token.certDir, "%s: the token pairs certificates from the same directory", name)
+	}
+}
diff --git a/client/internal/certproof/store_tpm_test.go b/client/internal/certproof/store_tpm_test.go
new file mode 100644
index 000000000..cce570891
--- /dev/null
+++ b/client/internal/certproof/store_tpm_test.go
@@ -0,0 +1,96 @@
+package certproof
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/pem"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/google/go-tpm/legacy/tpm2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/tpm"
+	"github.com/netbirdio/netbird/client/internal/tpm/tpmtest"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestFileStore_TPMKeyFile(t *testing.T) {
+	ca := certtest.NewCA(t, "corp")
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	leaf := ca.Issue(t, key, "device")
+
+	dir := storeDir(t)
+	writeFile(t, dir, "device.pem", certtest.CertPEM(leaf))
+	writeFile(t, dir, "device.key", tpmtest.KeyPEM(t, &key.PublicKey))
+
+	// A key that needs a password can never be used silently, so its certificate is skipped.
+	locked := certtest.ECDSAKey(t)
+	writeFile(t, dir, "locked.pem", certtest.CertPEM(ca.Issue(t, locked, "locked")))
+	writeFile(t, dir, "locked.key", tpmtest.KeyPEM(t, locked.Public().(*ecdsa.PublicKey), tpmtest.WithAuth()))
+
+	candidates, err := newFileStore(dir).Candidates(context.Background())
+	require.NoError(t, err)
+	require.Len(t, candidates, 1, "only the key without an authorization value is usable")
+	assert.True(t, leaf.Equal(candidates[0].Chain[0]), "candidate must carry the device certificate")
+	assert.True(t, key.PublicKey.Equal(candidates[0].Signer.Public()), "signer must report the certificate's key")
+}
+
+// TestCollect_TPMKeyEndToEnd runs against the TPM named by NB_TPM_DEVICE, for example a
+// swtpm started with:
+//
+//	swtpm socket --tpm2 --server type=unixio,path=/tmp/swtpm.sock \
+//	  --ctrl type=unixio,path=/tmp/swtpm.ctrl --flags not-need-init,startup-clear
+//
+// It creates a key the way tpm2-openssl does, under a transient ECC primary in the owner
+// hierarchy, and proves the certificate for it through the regular file store.
+func TestCollect_TPMKeyEndToEnd(t *testing.T) {
+	if os.Getenv(tpm.DeviceEnv) == "" {
+		t.Skipf("set %s to a TPM device or swtpm socket to run", tpm.DeviceEnv)
+	}
+	public, private := createTPMKey(t)
+	keyPEM := tpmtest.EncodePEM(t, public, private)
+	block, _ := pem.Decode([]byte(keyPEM))
+	require.NotNil(t, block)
+	signer, err := tpm.ParseKey(block.Bytes)
+	require.NoError(t, err)
+
+	ca := certtest.NewCA(t, "corp")
+	leaf := ca.Issue(t, signer, "device")
+	dir := storeDir(t)
+	writeFile(t, dir, "device.pem", certtest.CertPEM(leaf))
+	writeFile(t, dir, "device.key", keyPEM)
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	now := time.Now()
+	nonce := challenger.Nonce(peerKey, now)
+	checks := []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: nonce, CaCertificates: []string{ca.PEM}}}}
+
+	proofs := Collect(context.Background(), newFileStore(dir), checks, peerKey)
+	require.Len(t, proofs, 1, "the TPM-held key must prove the certificate")
+	chain, err := challenger.Verify(proofs[0], peerKey, now)
+	require.NoError(t, err)
+	assert.True(t, leaf.Equal(chain[0]), "proof must carry the device certificate")
+}
+
+func createTPMKey(t *testing.T) (public, private []byte) {
+	t.Helper()
+	rwc, err := tpm.Open()
+	require.NoError(t, err)
+	defer func() { _ = rwc.Close() }()
+
+	parent, _, err := tpm2.CreatePrimary(rwc, tpm2.HandleOwner, tpm2.PCRSelection{}, "", "", tpmtest.ECCSRKTemplate)
+	require.NoError(t, err)
+	defer func() { _ = tpm2.FlushContext(rwc, parent) }()
+
+	private, public, _, _, _, err = tpm2.CreateKey(rwc, parent, tpm2.PCRSelection{}, "", "", tpmtest.SigningTemplate())
+	require.NoError(t, err)
+	return public, private
+}
diff --git a/client/internal/certproof/store_tss2.go b/client/internal/certproof/store_tss2.go
new file mode 100644
index 000000000..d8a0d0714
--- /dev/null
+++ b/client/internal/certproof/store_tss2.go
@@ -0,0 +1,17 @@
+//go:build !js
+
+package certproof
+
+import (
+	"crypto"
+
+	"github.com/netbirdio/netbird/client/internal/tpm"
+)
+
+// tss2KeyPEMType is the PEM block type of a TPM 2.0 key file.
+const tss2KeyPEMType = tpm.KeyPEMType
+
+// parseTSS2Key returns a signer for a TPM-held key file that signs inside the TPM.
+func parseTSS2Key(der []byte) (crypto.Signer, error) {
+	return tpm.ParseKey(der)
+}
diff --git a/client/internal/certproof/store_tss2_js.go b/client/internal/certproof/store_tss2_js.go
new file mode 100644
index 000000000..b143c9071
--- /dev/null
+++ b/client/internal/certproof/store_tss2_js.go
@@ -0,0 +1,16 @@
+//go:build js
+
+package certproof
+
+import (
+	"crypto"
+	"errors"
+)
+
+// tss2KeyPEMType is the PEM block type of a TPM 2.0 key file. A browser has no TPM, so
+// the TPM library stays out of the WebAssembly build and such a key is refused.
+const tss2KeyPEMType = "TSS2 PRIVATE KEY"
+
+func parseTSS2Key([]byte) (crypto.Signer, error) {
+	return nil, errors.New("TPM keys are not supported in this build")
+}
diff --git a/client/internal/certproof/storefile_other.go b/client/internal/certproof/storefile_other.go
new file mode 100644
index 000000000..0dc5da99c
--- /dev/null
+++ b/client/internal/certproof/storefile_other.go
@@ -0,0 +1,34 @@
+//go:build !unix
+
+package certproof
+
+import (
+	"fmt"
+	"io"
+	"os"
+)
+
+// readStoreFile reads a certificate or key file of the PEM directory, up to the size
+// limit. Ownership is checked on Unix only; elsewhere the PEM directory is not the store
+// the daemon reads by default.
+func readStoreFile(path string) ([]byte, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = f.Close() }()
+
+	data, err := io.ReadAll(io.LimitReader(f, maxStoreFileSize+1))
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	if len(data) > maxStoreFileSize {
+		return nil, fmt.Errorf("%s is over the %d byte limit", path, maxStoreFileSize)
+	}
+	return data, nil
+}
+
+// checkStoreDir accepts any directory where the PEM directory is not a default store.
+func checkStoreDir(string) error {
+	return nil
+}
diff --git a/client/internal/certproof/storefile_unix.go b/client/internal/certproof/storefile_unix.go
new file mode 100644
index 000000000..181bf9314
--- /dev/null
+++ b/client/internal/certproof/storefile_unix.go
@@ -0,0 +1,101 @@
+//go:build unix
+
+package certproof
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"syscall"
+)
+
+// readStoreFile reads a certificate or key file of the PEM directory as the daemon may
+// trust it: the path must not be a symlink and must be a regular file that only root or
+// this process's own user can write. Otherwise a user able to place or redirect a file
+// could make the daemon sign with a key of their choosing, or with a root-only key kept
+// elsewhere on the machine. The file is checked through the descriptor it is read from,
+// so it cannot be swapped between the check and the read.
+func readStoreFile(path string) ([]byte, error) {
+	// O_NONBLOCK keeps a FIFO planted in the directory from blocking the open; the
+	// regular-file check below then refuses it.
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = f.Close() }()
+
+	info, err := f.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("stat %s: %w", path, err)
+	}
+	if !info.Mode().IsRegular() {
+		return nil, fmt.Errorf("%s is not a regular file", path)
+	}
+	if err := checkTrustedOwner(info); err != nil {
+		return nil, fmt.Errorf("%s: %w", path, err)
+	}
+	if info.Size() > maxStoreFileSize {
+		return nil, fmt.Errorf("%s is %d bytes, over the %d byte limit", path, info.Size(), maxStoreFileSize)
+	}
+	data, err := io.ReadAll(io.LimitReader(f, maxStoreFileSize+1))
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	if len(data) > maxStoreFileSize {
+		return nil, fmt.Errorf("%s grew past the %d byte limit while being read", path, maxStoreFileSize)
+	}
+	return data, nil
+}
+
+// checkStoreDir refuses a PEM directory that someone other than root or this process's
+// user could add files to or rename files in. The configured path may be a symlink, as
+// distributions place certificate directories behind them, but only one root or this
+// process's user owns: otherwise whoever owns the link could point it at any directory.
+func checkStoreDir(dir string) error {
+	link, err := os.Lstat(dir)
+	if err != nil {
+		return err
+	}
+	if link.Mode()&os.ModeSymlink != 0 {
+		if err := checkTrustedUID(link); err != nil {
+			return fmt.Errorf("symlink %s: %w", dir, err)
+		}
+	}
+	info, err := os.Stat(dir)
+	if err != nil {
+		return err
+	}
+	if !info.IsDir() {
+		return fmt.Errorf("%s is not a directory", dir)
+	}
+	if err := checkTrustedOwner(info); err != nil {
+		return fmt.Errorf("%s: %w", dir, err)
+	}
+	return nil
+}
+
+// checkTrustedOwner requires info to belong to root or to this process's user and to be
+// writable by nobody else. Group write is refused even for root's group, which ordinary
+// users may be members of. An owner that cannot be read is refused.
+func checkTrustedOwner(info os.FileInfo) error {
+	if err := checkTrustedUID(info); err != nil {
+		return err
+	}
+	if perm := info.Mode().Perm(); perm&0o022 != 0 {
+		return fmt.Errorf("writable by group or other users (mode %#o)", perm)
+	}
+	return nil
+}
+
+// checkTrustedUID requires info to belong to root or to this process's user.
+func checkTrustedUID(info os.FileInfo) error {
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return errors.New("owner cannot be determined")
+	}
+	if st.Uid != 0 && int(st.Uid) != os.Geteuid() {
+		return fmt.Errorf("owned by uid %d, not by root", st.Uid)
+	}
+	return nil
+}
diff --git a/client/internal/certproof/storefile_unix_test.go b/client/internal/certproof/storefile_unix_test.go
new file mode 100644
index 000000000..9932388b6
--- /dev/null
+++ b/client/internal/certproof/storefile_unix_test.go
@@ -0,0 +1,136 @@
+//go:build unix
+
+package certproof
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+// devicePair writes a certificate and its key as separate files into dir.
+func devicePair(t *testing.T, dir string) {
+	t.Helper()
+	ca := certtest.NewCA(t, "corp-root")
+	key := certtest.ECDSAKey(t)
+	writeFile(t, dir, "device.crt", certtest.CertPEM(ca.Issue(t, key, "device")))
+	writeFile(t, dir, "device.key", certtest.KeyPEM(t, key))
+}
+
+func candidates(t *testing.T, dir string) ([]Candidate, error) {
+	t.Helper()
+	return newFileStore(dir).Candidates(context.Background())
+}
+
+func TestFileStore_AcceptsAPrivatePair(t *testing.T) {
+	dir := storeDir(t)
+	devicePair(t, dir)
+
+	got, err := candidates(t, dir)
+	require.NoError(t, err)
+	assert.Len(t, got, 1, "a certificate and key only their owner can write are used")
+}
+
+func TestFileStore_RefusesASymlinkedKey(t *testing.T) {
+	dir := storeDir(t)
+	devicePair(t, dir)
+
+	// The real key moves elsewhere and the directory only links to it, as a user able
+	// to write the directory would do to point the daemon at a key it should not use.
+	elsewhere := filepath.Join(storeDir(t), "other.key")
+	require.NoError(t, os.Rename(filepath.Join(dir, "device.key"), elsewhere))
+	require.NoError(t, os.Symlink(elsewhere, filepath.Join(dir, "device.key")))
+
+	got, err := candidates(t, dir)
+	require.NoError(t, err)
+	assert.Empty(t, got, "a key reached through a symlink is never used")
+}
+
+func TestFileStore_RefusesASymlinkedCertificateFile(t *testing.T) {
+	dir := storeDir(t)
+	other := storeDir(t)
+	devicePair(t, other)
+	require.NoError(t, os.Symlink(filepath.Join(other, "device.crt"), filepath.Join(dir, "device.crt")))
+	require.NoError(t, os.Symlink(filepath.Join(other, "device.key"), filepath.Join(dir, "device.key")))
+
+	got, err := candidates(t, dir)
+	require.NoError(t, err)
+	assert.Empty(t, got, "a certificate file that is a symlink is skipped")
+}
+
+func TestFileStore_RefusesFilesOthersCanWrite(t *testing.T) {
+	for name, mode := range map[string]os.FileMode{"world-writable": 0o602, "group-writable": 0o620} {
+		t.Run(name, func(t *testing.T) {
+			dir := storeDir(t)
+			devicePair(t, dir)
+			require.NoError(t, os.Chmod(filepath.Join(dir, "device.key"), mode))
+
+			got, err := candidates(t, dir)
+			require.NoError(t, err)
+			assert.Empty(t, got, "a key %s may have been replaced by someone else, even when the group is root's", name)
+		})
+	}
+}
+
+func TestFileStore_RefusesADirectoryOthersCanWrite(t *testing.T) {
+	dir := storeDir(t)
+	devicePair(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o777))
+
+	_, err := candidates(t, dir)
+	assert.ErrorContains(t, err, "refusing certificate store", "files in a directory anyone can write are not trusted")
+}
+
+func TestFileStore_SkipsAFIFOWithoutBlocking(t *testing.T) {
+	dir := storeDir(t)
+	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "trap.pem"), 0o600))
+	devicePair(t, dir)
+
+	got, err := candidates(t, dir)
+	require.NoError(t, err)
+	assert.Len(t, got, 1, "a FIFO is skipped and the real pair still loads")
+}
+
+func TestReadStoreFile_RefusesOversizedFiles(t *testing.T) {
+	dir := storeDir(t)
+	path := filepath.Join(dir, "huge.pem")
+	require.NoError(t, os.WriteFile(path, make([]byte, maxStoreFileSize+1), 0o600))
+
+	_, err := readStoreFile(path)
+	assert.ErrorContains(t, err, "limit")
+}
+
+func TestFileStore_AcceptsASymlinkedDirectoryItsOwnerControls(t *testing.T) {
+	target := storeDir(t)
+	devicePair(t, target)
+	link := filepath.Join(storeDir(t), "certs")
+	require.NoError(t, os.Symlink(target, link))
+
+	// The link belongs to this process's user, as one root creates belongs to root.
+	got, err := candidates(t, link)
+	require.NoError(t, err)
+	assert.Len(t, got, 1, "a certificate directory behind a symlink the owner controls is read")
+}
+
+func TestFileStore_ChecksTheDirectoryBeforeListingIt(t *testing.T) {
+	dir := storeDir(t)
+	devicePair(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o777))
+
+	paths, err := certFiles(dir)
+	assert.ErrorContains(t, err, "refusing certificate store")
+	assert.Nil(t, paths, "nothing in a directory anyone can write to is listed")
+}
+
+func TestFileStore_MissingDirectoryIsEmpty(t *testing.T) {
+	paths, err := certFiles(filepath.Join(storeDir(t), "missing"))
+	assert.NoError(t, err, "a store directory that does not exist yet is not an error")
+	assert.Empty(t, paths)
+}
diff --git a/client/internal/certproof/systemstore_windows.go b/client/internal/certproof/systemstore_windows.go
new file mode 100644
index 000000000..908899107
--- /dev/null
+++ b/client/internal/certproof/systemstore_windows.go
@@ -0,0 +1,270 @@
+package certproof
+
+import (
+	"bytes"
+	"context"
+	"crypto"
+	"crypto/sha256"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+	"slices"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+const (
+	personalStore     = "MY"
+	intermediateStore = "CA"
+
+	cryptAcquireSilentFlag          = 0x00000040
+	cryptAcquirePreferNCryptKeyFlag = 0x00020000
+	certNCryptKeySpec               = 0xFFFFFFFF
+	atKeyExchange                   = 1
+	atSignature                     = 2
+	bcryptPadPSS                    = 0x00000008
+)
+
+// errLegacyKey reports a private key CNG cannot open: it lives in a legacy CryptoAPI
+// provider, which only offers PKCS#1 v1.5 and no RSA-PSS or ECDSA.
+var errLegacyKey = errors.New("private key is held by a legacy CryptoAPI provider, which certificate posture cannot sign with")
+
+var (
+	crypt32 = windows.NewLazySystemDLL("crypt32.dll")
+	ncrypt  = windows.NewLazySystemDLL("ncrypt.dll")
+
+	procCryptAcquireCertificatePrivateKey = crypt32.NewProc("CryptAcquireCertificatePrivateKey")
+	procNCryptSignHash                    = ncrypt.NewProc("NCryptSignHash")
+	procNCryptFreeObject                  = ncrypt.NewProc("NCryptFreeObject")
+)
+
+type bcryptPSSPaddingInfo struct {
+	algID *uint16
+	salt  uint32
+}
+
+// DefaultStore is the local machine's personal certificate store, where device
+// certificates enrolled through AD or Intune are kept.
+func DefaultStore() Store {
+	return newSystemStore()
+}
+
+// systemStore yields the identities of a personal certificate store, completing their
+// chains from the matching intermediate CA store. Keys are used through CNG and never
+// exported.
+//
+// The location decides whose certificates these are. The local machine store is the one
+// a service reads; the current user store lives in the signed-in user's registry hive
+// with keys protected against their profile, so it is only readable while running as
+// that user.
+type systemStore struct {
+	location uint32
+}
+
+// newSystemStore reads the local machine store, which is what the daemon uses.
+func newSystemStore() *systemStore {
+	return &systemStore{location: windows.CERT_SYSTEM_STORE_LOCAL_MACHINE}
+}
+
+// newUserStore reads the calling user's personal store. It is only useful in a process
+// already running as that user, which is what the posture helper is.
+func newUserStore() *systemStore {
+	return &systemStore{location: windows.CERT_SYSTEM_STORE_CURRENT_USER}
+}
+
+func (s *systemStore) Candidates(_ context.Context) ([]Candidate, error) {
+	leaves, err := storeCertificates(s.location, personalStore)
+	if err != nil {
+		return nil, err
+	}
+	intermediates, err := storeCertificates(s.location, intermediateStore)
+	if err != nil {
+		return nil, err
+	}
+	log.Debugf("certificate store %s holds %d personal certificates and %d intermediates", s, len(leaves), len(intermediates))
+	if len(leaves) == 0 {
+		return nil, nil
+	}
+
+	pool := slices.Concat(intermediates, leaves)
+	candidates := make([]Candidate, 0, len(leaves))
+	for _, leaf := range leaves {
+		chain := buildChain(leaf, pool)
+		log.Debugf("certificate store %s candidate %q issued by %q built a chain of %d certificates", s, leaf.Subject, leaf.Issuer, len(chain))
+		candidates = append(candidates, Candidate{Chain: chain, Signer: &systemStoreSigner{leaf: leaf, location: s.location}, Intermediates: pool})
+	}
+	return candidates, nil
+}
+
+// String names the store location the way the Windows documentation does.
+func (s *systemStore) String() string {
+	if s.location == windows.CERT_SYSTEM_STORE_CURRENT_USER {
+		return "CurrentUser"
+	}
+	return "LocalMachine"
+}
+
+// systemStoreSigner holds only the certificate; the store entry and its key are acquired
+// at signing time so no handles outlive a call.
+type systemStoreSigner struct {
+	leaf     *x509.Certificate
+	location uint32
+}
+
+func (s *systemStoreSigner) Public() crypto.PublicKey {
+	return s.leaf.PublicKey
+}
+
+func (s *systemStoreSigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	scheme, err := schemeFor(s.leaf.PublicKey, opts)
+	if err != nil {
+		return nil, err
+	}
+	store, err := openStore(s.location, personalStore)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = windows.CertCloseStore(store, 0) }()
+
+	var signature []byte
+	err = eachCertificate(store, func(ctx *windows.CertContext) (bool, error) {
+		if !bytes.Equal(encodedCert(ctx), s.leaf.Raw) {
+			return false, nil
+		}
+		signature, err = signWithContext(ctx, scheme, digest)
+		return true, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	if signature == nil {
+		return nil, errors.New("certificate is no longer in the personal store")
+	}
+	return signature, nil
+}
+
+func signWithContext(ctx *windows.CertContext, scheme sigScheme, digest []byte) ([]byte, error) {
+	var key uintptr
+	var keySpec uint32
+	var callerFree int32
+	ok, _, err := procCryptAcquireCertificatePrivateKey.Call(uintptr(unsafe.Pointer(ctx)), cryptAcquireSilentFlag|cryptAcquirePreferNCryptKeyFlag, 0,
+		uintptr(unsafe.Pointer(&key)), uintptr(unsafe.Pointer(&keySpec)), uintptr(unsafe.Pointer(&callerFree)))
+	if ok == 0 {
+		return nil, fmt.Errorf("acquire private key: %w", err)
+	}
+	if keySpec != certNCryptKeySpec {
+		if callerFree != 0 {
+			_ = windows.CryptReleaseContext(windows.Handle(key), 0)
+		}
+		return nil, legacyKeyError(keySpec)
+	}
+	if callerFree != 0 {
+		defer func() { _, _, _ = procNCryptFreeObject.Call(key) }()
+	}
+
+	var padding unsafe.Pointer
+	var flags uintptr
+	if scheme == schemeRSAPSSSHA256 {
+		algID, _ := windows.UTF16PtrFromString("SHA256")
+		info := bcryptPSSPaddingInfo{algID: algID, salt: sha256.Size}
+		padding, flags = unsafe.Pointer(&info), bcryptPadPSS
+	}
+	size, err := ncryptSignHash(key, padding, digest, nil, flags)
+	if err != nil {
+		return nil, err
+	}
+	signature := make([]byte, size)
+	if size, err = ncryptSignHash(key, padding, digest, signature, flags); err != nil {
+		return nil, err
+	}
+	signature = signature[:size]
+	if scheme == schemeRSAPSSSHA256 {
+		return signature, nil
+	}
+	return ecdsaSignatureASN1(signature)
+}
+
+// legacyKeyError describes a key acquired through CryptoAPI rather than CNG, naming its
+// key spec and the remedy, since the certificate otherwise looks usable in the store.
+func legacyKeyError(keySpec uint32) error {
+	spec := fmt.Sprintf("key spec %d", keySpec)
+	switch keySpec {
+	case atKeyExchange:
+		spec = "AT_KEYEXCHANGE"
+	case atSignature:
+		spec = "AT_SIGNATURE"
+	}
+	return fmt.Errorf("%w (%s); re-enrol it with a certificate template whose provider is a CNG key storage provider", errLegacyKey, spec)
+}
+
+func ncryptSignHash(key uintptr, padding unsafe.Pointer, digest, signature []byte, flags uintptr) (uint32, error) {
+	var result uint32
+	var signaturePtr uintptr
+	if len(signature) > 0 {
+		signaturePtr = uintptr(unsafe.Pointer(&signature[0]))
+	}
+	status, _, _ := procNCryptSignHash.Call(key, uintptr(padding), uintptr(unsafe.Pointer(&digest[0])), uintptr(len(digest)),
+		signaturePtr, uintptr(len(signature)), uintptr(unsafe.Pointer(&result)), flags)
+	if uint32(status) != 0 {
+		return 0, fmt.Errorf("NCryptSignHash: 0x%08x", uint32(status))
+	}
+	return result, nil
+}
+
+func storeCertificates(location uint32, name string) ([]*x509.Certificate, error) {
+	store, err := openStore(location, name)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = windows.CertCloseStore(store, 0) }()
+
+	var certs []*x509.Certificate
+	err = eachCertificate(store, func(ctx *windows.CertContext) (bool, error) {
+		cert, err := x509.ParseCertificate(bytes.Clone(encodedCert(ctx)))
+		if err != nil {
+			log.Warnf("skipping certificate in %s store: %v", name, err)
+			return false, nil
+		}
+		certs = append(certs, cert)
+		return false, nil
+	})
+	return certs, err
+}
+
+func openStore(location uint32, name string) (windows.Handle, error) {
+	namePtr, err := windows.UTF16PtrFromString(name)
+	if err != nil {
+		return 0, err
+	}
+	flags := location | uint32(windows.CERT_STORE_READONLY_FLAG|windows.CERT_STORE_OPEN_EXISTING_FLAG)
+	store, err := windows.CertOpenStore(windows.CERT_STORE_PROV_SYSTEM, 0, 0, flags, uintptr(unsafe.Pointer(namePtr)))
+	if err != nil {
+		return 0, fmt.Errorf("open %s certificate store: %w", name, err)
+	}
+	return store, nil
+}
+
+func eachCertificate(store windows.Handle, fn func(*windows.CertContext) (bool, error)) error {
+	var ctx *windows.CertContext
+	for {
+		next, err := windows.CertEnumCertificatesInStore(store, ctx)
+		if next == nil {
+			if errors.Is(err, windows.Errno(windows.CRYPT_E_NOT_FOUND)) || errors.Is(err, windows.ERROR_NO_MORE_FILES) {
+				return nil
+			}
+			return fmt.Errorf("enumerate certificates: %w", err)
+		}
+		ctx = next
+		if stop, err := fn(ctx); stop || err != nil {
+			_ = windows.CertFreeCertificateContext(ctx)
+			return err
+		}
+	}
+}
+
+func encodedCert(ctx *windows.CertContext) []byte {
+	return unsafe.Slice(ctx.EncodedCert, ctx.Length)
+}
diff --git a/client/internal/certproof/systemstore_windows_test.go b/client/internal/certproof/systemstore_windows_test.go
new file mode 100644
index 000000000..fda23c2ef
--- /dev/null
+++ b/client/internal/certproof/systemstore_windows_test.go
@@ -0,0 +1,16 @@
+package certproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLegacyKeyError_NamesTheKeySpecAndTheRemedy(t *testing.T) {
+	for spec, want := range map[uint32]string{atKeyExchange: "AT_KEYEXCHANGE", atSignature: "AT_SIGNATURE", 7: "key spec 7"} {
+		err := legacyKeyError(spec)
+		assert.ErrorIs(t, err, errLegacyKey, "callers can tell a legacy key from other failures")
+		assert.ErrorContains(t, err, want, "the key spec found is named")
+		assert.ErrorContains(t, err, "key storage provider", "the error says how to fix the enrolment")
+	}
+}
diff --git a/client/internal/conn_mgr.go b/client/internal/conn_mgr.go
index a82a4ca8b..8b01eabcf 100644
--- a/client/internal/conn_mgr.go
+++ b/client/internal/conn_mgr.go
@@ -2,6 +2,7 @@ package internal
 
 import (
 	"context"
+	"maps"
 	"os"
 	"strconv"
 	"sync"
@@ -14,6 +15,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/route"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
 // lazyForce is the resolved local decision for lazy connections, layered above the
@@ -34,94 +36,97 @@ const (
 // - Handling connection establishment based on peer signaling
 //
 // The implementation is not thread-safe; it is protected by engine.syncMsgMux.
+// The only exception is ActivatePeer, which is safe for concurrent use so the
+// DNS warm-up path can call it without contending on the engine mutex.
 type ConnMgr struct {
-	peerStore        *peerstore.Store
-	statusRecorder   *peer.Status
-	iface            lazyconn.WGIface
-	force            lazyForce
-	rosenpassEnabled bool
+	peerStore      *peerstore.Store
+	statusRecorder *peer.Status
+	iface          lazyconn.WGIface
+	force          lazyForce
+	// remoteLazyEnabled caches the account-wide lazy feature flag from management.
+	// It is the default for peers that do not carry a per-peer lazy hint.
+	remoteLazyEnabled bool
 
 	lazyConnMgr *manager.Manager
+	// lazyConnMgrMu guards the lazyConnMgr pointer for readers outside the
+	// engine loop (ActivatePeer). Writers hold it in addition to
+	// engine.syncMsgMux; all other reads stay under engine.syncMsgMux only.
+	lazyConnMgrMu sync.RWMutex
+
+	// reconcileRoutedIPs re-applies a peer's routed allowed IPs after its lazy wake endpoint is
+	// (re)armed (Mode A at arm time). Injected by the engine; nil disables the reconcile.
+	reconcileRoutedIPs func(peerKey string) error
+
+	// appliedExcludeList is the exclude set last handed to the lazy manager, kept so an
+	// unchanged set on the next sync skips the O(n) reconciliation.
+	appliedExcludeList map[string]bool
 
 	wg            sync.WaitGroup
 	lazyCtx       context.Context
 	lazyCtxCancel context.CancelFunc
 }
 
+// SetRoutedIPsReconciler injects the callback used to re-apply a peer's routed allowed IPs when
+// its lazy wake endpoint is (re)armed. Must be called before the lazy manager starts.
+func (e *ConnMgr) SetRoutedIPsReconciler(fn func(peerKey string) error) {
+	e.reconcileRoutedIPs = fn
+}
+
 func NewConnMgr(engineConfig *EngineConfig, statusRecorder *peer.Status, peerStore *peerstore.Store, iface lazyconn.WGIface) *ConnMgr {
 	e := &ConnMgr{
-		peerStore:        peerStore,
-		statusRecorder:   statusRecorder,
-		iface:            iface,
-		force:            resolveLazyForce(engineConfig.LazyConnection),
-		rosenpassEnabled: engineConfig.RosenpassEnabled,
+		peerStore:      peerStore,
+		statusRecorder: statusRecorder,
+		iface:          iface,
+		force:          resolveLazyForce(engineConfig.LazyConnection),
 	}
 	return e
 }
 
-// Start initializes the connection manager. It starts the lazy connection manager when a
-// local override forces it on; with no local override it waits for the management feature flag.
+// Start initializes the connection manager. The lazy connection manager always runs so that
+// per-peer lazy defaults (e.g. proxy peers) work even when the account flag is off; the
+// account flag and the local override decide the default lazy state per peer (see
+// PeerLazyDefault). Rosenpass peers stay lazy-capable too: their connections just never idle
+// on their own, since rosenpass rekey traffic keeps them active.
 func (e *ConnMgr) Start(ctx context.Context) {
 	if e.lazyConnMgr != nil {
 		log.Errorf("lazy connection manager is already started")
 		return
 	}
 
-	switch e.force {
-	case lazyForceOff:
-		log.Infof("lazy connection manager is disabled by local override (%s or MDM policy)", lazyconn.EnvLazyConn)
-		e.statusRecorder.UpdateLazyConnection(false)
-		return
-	case lazyForceNone:
-		log.Infof("lazy connection manager is managed by the management feature flag")
-		e.statusRecorder.UpdateLazyConnection(false)
-		return
-	}
-
-	if e.rosenpassEnabled {
-		log.Warnf("rosenpass connection manager is enabled, lazy connection manager will not be started")
-		e.statusRecorder.UpdateLazyConnection(false)
-		return
-	}
-
 	e.initLazyManager(ctx)
-	e.statusRecorder.UpdateLazyConnection(true)
+	e.statusRecorder.UpdateLazyConnection(e.PeerLazyDefault(mgmProto.LazyState_LazyStateDefault))
 }
 
-// UpdatedRemoteFeatureFlag is called when the remote feature flag is updated.
-// If enabled, it initializes the lazy connection manager and start it. Do not need to call Start() again.
-// If disabled, then it closes the lazy connection manager and open the connections to all peers.
-func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) error {
-	// a local override (NB_LAZY_CONN or local config) takes precedence over management
-	if e.force != lazyForceNone {
-		return nil
+// UpdatedRemoteFeatureFlag caches the account-wide lazy feature flag. The manager itself is
+// not started or stopped here; the per-sync exclude-list reconciliation moves normal peers
+// between the lazy and always-active sets when the flag flips.
+func (e *ConnMgr) UpdatedRemoteFeatureFlag(_ context.Context, enabled bool) error {
+	e.remoteLazyEnabled = enabled
+	if e.isStartedWithLazyMgr() {
+		e.statusRecorder.UpdateLazyConnection(e.PeerLazyDefault(mgmProto.LazyState_LazyStateDefault))
+	}
+	return nil
+}
+
+// PeerLazyDefault reports whether a peer should be lazy. The local override
+// (NB_LAZY_CONN/MDM) wins over everything; without a local override the
+// management per-peer state applies (LazyStateLazy/Eager force the decision),
+// and LazyStateDefault follows the account-wide flag.
+func (e *ConnMgr) PeerLazyDefault(state mgmProto.LazyState) bool {
+	switch e.force {
+	case lazyForceOn:
+		return true
+	case lazyForceOff:
+		return false
 	}
 
-	if enabled {
-		// if the lazy connection manager is already started, do not start it again
-		if e.lazyConnMgr != nil {
-			return nil
-		}
-
-		if e.rosenpassEnabled {
-			log.Infof("rosenpass connection manager is enabled, lazy connection manager will not be started")
-			e.statusRecorder.UpdateLazyConnection(false)
-			return nil
-		}
-
-		log.Warnf("lazy connection manager is enabled by management feature flag")
-		e.initLazyManager(ctx)
-		e.statusRecorder.UpdateLazyConnection(true)
-		return e.addPeersToLazyConnManager()
-	} else {
-		if e.lazyConnMgr == nil {
-			e.statusRecorder.UpdateLazyConnection(false)
-			return nil
-		}
-		log.Infof("lazy connection manager is disabled by management feature flag")
-		e.closeManager(ctx)
-		e.statusRecorder.UpdateLazyConnection(false)
-		return nil
+	switch state {
+	case mgmProto.LazyState_LazyStateLazy:
+		return true
+	case mgmProto.LazyState_LazyStateEager:
+		return false
+	default:
+		return e.remoteLazyEnabled
 	}
 }
 
@@ -141,6 +146,13 @@ func (e *ConnMgr) SetExcludeList(ctx context.Context, peerIDs map[string]bool) {
 		return
 	}
 
+	// The exclude set is recomputed every sync but rarely changes; skip the O(n)
+	// store lookups and reconciliation when it matches what was already applied.
+	if maps.Equal(peerIDs, e.appliedExcludeList) {
+		return
+	}
+	e.appliedExcludeList = maps.Clone(peerIDs)
+
 	excludedPeers := make([]lazyconn.PeerConfig, 0, len(peerIDs))
 
 	for peerID := range peerIDs {
@@ -176,12 +188,16 @@ func (e *ConnMgr) SetExcludeList(ctx context.Context, peerIDs map[string]bool) {
 	}
 }
 
-func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Conn) (exists bool) {
+// AddPeerConn registers a peer connection. permanent requests an always-active connection
+// (the peer belongs to the exclude set: a forwarder, or a peer that is not lazy by policy).
+// Non-permanent peers are handed to the lazy manager. The subsequent SetExcludeList call
+// reconciles membership for existing peers across flag flips.
+func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Conn, permanent bool) (exists bool) {
 	if success := e.peerStore.AddPeerConn(peerKey, conn); !success {
 		return true
 	}
 
-	if !e.isStartedWithLazyMgr() {
+	if !e.isStartedWithLazyMgr() || permanent {
 		if err := conn.Open(ctx); err != nil {
 			conn.Log.Errorf("failed to open connection: %v", err)
 		}
@@ -238,12 +254,20 @@ func (e *ConnMgr) RemovePeerConn(peerKey string) {
 	conn.Log.Infof("removed peer from lazy conn manager")
 }
 
+// ActivatePeer wakes an idle lazy connection. Unlike the rest of ConnMgr it is
+// safe for concurrent use: the lazy manager pointer is read under lazyConnMgrMu
+// and the manager itself is internally synchronized, so callers outside the
+// engine loop (DNS warm-up) do not need engine.syncMsgMux.
 func (e *ConnMgr) ActivatePeer(ctx context.Context, conn *peer.Conn) {
-	if !e.isStartedWithLazyMgr() {
+	e.lazyConnMgrMu.RLock()
+	lazyConnMgr := e.lazyConnMgr
+	started := lazyConnMgr != nil && e.lazyCtxCancel != nil
+	e.lazyConnMgrMu.RUnlock()
+	if !started {
 		return
 	}
 
-	if found := e.lazyConnMgr.ActivatePeer(conn.GetKey()); found {
+	if found := lazyConnMgr.ActivatePeer(conn.GetKey()); found {
 		if err := conn.Open(ctx); err != nil {
 			conn.Log.Errorf("failed to open connection: %v", err)
 		}
@@ -268,16 +292,26 @@ func (e *ConnMgr) Close() {
 
 	e.lazyCtxCancel()
 	e.wg.Wait()
+
+	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = nil
+	e.lazyConnMgrMu.Unlock()
+
+	e.appliedExcludeList = nil
 }
 
 func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
 	cfg := manager.Config{
 		InactivityThreshold: inactivityThresholdEnv(),
+		ReconcileAllowedIPs: e.reconcileRoutedIPs,
 	}
-	e.lazyConnMgr = manager.NewManager(cfg, engineCtx, e.peerStore, e.iface)
 
+	e.lazyConnMgrMu.Lock()
+	e.lazyConnMgr = manager.NewManager(cfg, engineCtx, e.peerStore, e.iface)
 	e.lazyCtx, e.lazyCtxCancel = context.WithCancel(engineCtx)
+	e.lazyConnMgrMu.Unlock()
+
+	e.appliedExcludeList = nil
 
 	e.wg.Add(1)
 	go func() {
@@ -286,43 +320,6 @@ func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
 	}()
 }
 
-func (e *ConnMgr) addPeersToLazyConnManager() error {
-	peers := e.peerStore.PeersPubKey()
-	lazyPeerCfgs := make([]lazyconn.PeerConfig, 0, len(peers))
-	for _, peerID := range peers {
-		var peerConn *peer.Conn
-		var exists bool
-		if peerConn, exists = e.peerStore.PeerConn(peerID); !exists {
-			log.Warnf("failed to find peer conn for peerID: %s", peerID)
-			continue
-		}
-
-		lazyPeerCfg := lazyconn.PeerConfig{
-			PublicKey:  peerID,
-			AllowedIPs: peerConn.WgConfig().AllowedIps,
-			PeerConnID: peerConn.ConnID(),
-			Log:        peerConn.Log,
-		}
-		lazyPeerCfgs = append(lazyPeerCfgs, lazyPeerCfg)
-	}
-
-	return e.lazyConnMgr.AddActivePeers(lazyPeerCfgs)
-}
-
-func (e *ConnMgr) closeManager(ctx context.Context) {
-	if e.lazyConnMgr == nil {
-		return
-	}
-
-	e.lazyCtxCancel()
-	e.wg.Wait()
-	e.lazyConnMgr = nil
-
-	for _, peerID := range e.peerStore.PeersPubKey() {
-		e.peerStore.PeerConnOpen(ctx, peerID)
-	}
-}
-
 func (e *ConnMgr) isStartedWithLazyMgr() bool {
 	return e.lazyConnMgr != nil && e.lazyCtxCancel != nil
 }
@@ -352,11 +349,20 @@ func inactivityThresholdEnv() *time.Duration {
 		return nil
 	}
 
-	parsedMinutes, err := strconv.Atoi(envValue)
-	if err != nil || parsedMinutes <= 0 {
-		return nil
+	// Documented format: a Go duration such as "30m" or "1h".
+	if d, err := time.ParseDuration(envValue); err == nil {
+		if d <= 0 {
+			return nil
+		}
+		return &d
 	}
 
-	d := time.Duration(parsedMinutes) * time.Minute
-	return &d
+	// Backwards compatibility: a bare integer used to be interpreted as minutes.
+	if parsedMinutes, err := strconv.Atoi(envValue); err == nil && parsedMinutes > 0 {
+		d := time.Duration(parsedMinutes) * time.Minute
+		return &d
+	}
+
+	log.Warnf("invalid %s value %q: expected a Go duration such as 30m or 1h", lazyconn.EnvInactivityThreshold, envValue)
+	return nil
 }
diff --git a/client/internal/conn_mgr_test.go b/client/internal/conn_mgr_test.go
index 5e2c53e35..e3723b5ff 100644
--- a/client/internal/conn_mgr_test.go
+++ b/client/internal/conn_mgr_test.go
@@ -1,10 +1,22 @@
 package internal
 
 import (
+	"context"
+	"net"
+	"net/netip"
 	"os"
+	"sync"
 	"testing"
+	"time"
 
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/peerstore"
+	"github.com/netbirdio/netbird/monotime"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
 func TestResolveLazyForce(t *testing.T) {
@@ -38,3 +50,180 @@ func TestResolveLazyForce(t *testing.T) {
 		})
 	}
 }
+
+type mockLazyWGIface struct{}
+
+func (mockLazyWGIface) RemovePeer(string) error { return nil }
+func (mockLazyWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
+	return nil
+}
+func (mockLazyWGIface) IsUserspaceBind() bool                    { return false }
+func (mockLazyWGIface) Address() wgaddr.Address                  { return wgaddr.Address{} }
+func (mockLazyWGIface) LastActivities() map[string]monotime.Time { return nil }
+func (mockLazyWGIface) MTU() uint16                              { return 1280 }
+
+// TestConnMgr_ActivatePeerConcurrentWithLifecycle exercises ActivatePeer from
+// non-engine goroutines (the DNS warm-up path) racing the manager lifecycle,
+// which stays on the engine loop. Run with -race: it fails if ActivatePeer
+// still requires engine.syncMsgMux for safety.
+func TestConnMgr_ActivatePeerConcurrentWithLifecycle(t *testing.T) {
+	t.Setenv(lazyconn.EnvLazyConn, "on")
+
+	status := peer.NewRecorder("https://mgm")
+	store := peerstore.NewConnStore()
+	connMgr := NewConnMgr(&EngineConfig{}, status, store, mockLazyWGIface{})
+
+	conn := newTestPeerConn(t, "peerA")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	connMgr.Start(ctx)
+
+	done := make(chan struct{})
+	var wg sync.WaitGroup
+	for range 4 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				select {
+				case <-done:
+					return
+				default:
+					connMgr.ActivatePeer(ctx, conn)
+				}
+			}
+		}()
+	}
+
+	// Let the activators spin against the started manager, then tear it down
+	// underneath them and let them spin against the stopped manager.
+	time.Sleep(100 * time.Millisecond)
+	connMgr.Close()
+	time.Sleep(50 * time.Millisecond)
+
+	close(done)
+	wg.Wait()
+}
+
+func TestInactivityThresholdEnv(t *testing.T) {
+	tests := []struct {
+		name string
+		val  string
+		want *time.Duration
+	}{
+		{name: "unset", val: "", want: nil},
+		{name: "go duration minutes", val: "30m", want: durPtr(30 * time.Minute)},
+		{name: "go duration hours", val: "1h", want: durPtr(time.Hour)},
+		{name: "go duration seconds", val: "90s", want: durPtr(90 * time.Second)},
+		{name: "bare integer is minutes (backwards compat)", val: "5", want: durPtr(5 * time.Minute)},
+		{name: "zero duration", val: "0s", want: nil},
+		{name: "zero integer", val: "0", want: nil},
+		{name: "negative duration", val: "-5m", want: nil},
+		{name: "garbage", val: "abc", want: nil},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(lazyconn.EnvInactivityThreshold, tc.val)
+			got := inactivityThresholdEnv()
+			switch {
+			case tc.want == nil && got != nil:
+				t.Fatalf("want nil, got %v", *got)
+			case tc.want != nil && got == nil:
+				t.Fatalf("want %v, got nil", *tc.want)
+			case tc.want != nil && *got != *tc.want:
+				t.Fatalf("want %v, got %v", *tc.want, *got)
+			}
+		})
+	}
+}
+
+func TestPeerLazyDefault(t *testing.T) {
+	tests := []struct {
+		name          string
+		force         lazyForce
+		remoteEnabled bool
+		state         mgmProto.LazyState
+		want          bool
+	}{
+		{name: "force on wins over eager state", force: lazyForceOn, state: mgmProto.LazyState_LazyStateEager, want: true},
+		{name: "force off wins over lazy state", force: lazyForceOff, remoteEnabled: true, state: mgmProto.LazyState_LazyStateLazy, want: false},
+		{name: "none, default, account off -> active", force: lazyForceNone, state: mgmProto.LazyState_LazyStateDefault, want: false},
+		{name: "none, default, account on -> lazy", force: lazyForceNone, remoteEnabled: true, state: mgmProto.LazyState_LazyStateDefault, want: true},
+		{name: "none, lazy state, account off -> lazy", force: lazyForceNone, state: mgmProto.LazyState_LazyStateLazy, want: true},
+		{name: "none, eager state, account on -> active", force: lazyForceNone, remoteEnabled: true, state: mgmProto.LazyState_LazyStateEager, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			e := &ConnMgr{force: tt.force, remoteLazyEnabled: tt.remoteEnabled}
+			if got := e.PeerLazyDefault(tt.state); got != tt.want {
+				t.Fatalf("PeerLazyDefault(%v) = %v, want %v", tt.state, got, tt.want)
+			}
+		})
+	}
+}
+
+func durPtr(d time.Duration) *time.Duration { return &d }
+
+// TestToExcludedLazyPeers covers the per-peer lazy classification (proxy vs
+// normal, across the force/account-flag matrix). Forwarder-target exclusion is
+// covered by TestToExcludedLazyPeers_ForwardTarget.
+func TestToExcludedLazyPeers(t *testing.T) {
+	const (
+		normalKey = "normal"
+		lazyKey   = "lazy-state"
+		eagerKey  = "eager-state"
+	)
+
+	peers := []*mgmProto.RemotePeerConfig{
+		{WgPubKey: normalKey, AllowedIps: []string{"100.64.0.1/32"}},
+		{WgPubKey: lazyKey, AllowedIps: []string{"100.64.0.2/32"}, LazyState: mgmProto.LazyState_LazyStateLazy},
+		{WgPubKey: eagerKey, AllowedIps: []string{"100.64.0.3/32"}, LazyState: mgmProto.LazyState_LazyStateEager},
+	}
+
+	tests := []struct {
+		name          string
+		force         lazyForce
+		remoteEnabled bool
+		want          map[string]bool
+	}{
+		{
+			name:  "account off: lazy-state peer lazy, normal + eager active",
+			force: lazyForceNone, remoteEnabled: false,
+			want: map[string]bool{normalKey: true, eagerKey: true},
+		},
+		{
+			name:  "account on: only eager-state peer active",
+			force: lazyForceNone, remoteEnabled: true,
+			want: map[string]bool{eagerKey: true},
+		},
+		{
+			name:  "force off: everything active",
+			force: lazyForceOff, remoteEnabled: true,
+			want: map[string]bool{normalKey: true, lazyKey: true, eagerKey: true},
+		},
+		{
+			name:  "force on: nothing active",
+			force: lazyForceOn, remoteEnabled: false,
+			want: map[string]bool{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			e := &Engine{connMgr: &ConnMgr{force: tt.force, remoteLazyEnabled: tt.remoteEnabled}}
+			got := e.toExcludedLazyPeers(peers)
+
+			if len(got) != len(tt.want) {
+				t.Fatalf("toExcludedLazyPeers() = %v, want %v", got, tt.want)
+			}
+			for k := range tt.want {
+				if !got[k] {
+					t.Fatalf("expected peer %s excluded, got %v", k, got)
+				}
+			}
+		})
+	}
+}
diff --git a/client/internal/connect.go b/client/internal/connect.go
index 93467b09a..7173f6875 100644
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -26,6 +26,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
+	"github.com/netbirdio/netbird/client/internal/certproof"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/listener"
@@ -34,9 +35,11 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
+	"github.com/netbirdio/netbird/client/internal/tunnelnotifier"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/internal/updater/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
+	"github.com/netbirdio/netbird/client/netevents"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ssh"
 	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
@@ -69,18 +72,55 @@ type ConnectClient struct {
 	updateManager *updater.Manager
 
 	persistSyncResponse bool
+	// inMemoryState keeps the state manager off disk, for clients that change
+	// nothing on the host that a later run would have to restore.
+	inMemoryState bool
+
+	// netMgr gates every reconnection loop on OS-reported network
+	// availability and sweeps connections on network change.
+	netMgr *netevents.Manager
+
+	profileOwner        string
+	profileOwnerUnknown bool
+}
+
+// ConnectClientOption configures optional ConnectClient behavior.
+type ConnectClientOption func(*ConnectClient)
+
+// WithInMemoryState keeps client state in memory instead of the default state
+// file, so the client neither reads nor writes another installation's state.
+func WithInMemoryState() ConnectClientOption {
+	return func(c *ConnectClient) { c.inMemoryState = true }
+}
+
+// WithNetEvents injects the OS network event handling.
+func WithNetEvents(events *netevents.Manager) ConnectClientOption {
+	return func(c *ConnectClient) { c.netMgr = events }
+}
+
+// WithProfileOwner names the OS account the active profile belongs to, whose own
+// certificate store answers user certificate posture checks.
+func WithProfileOwner(username string) ConnectClientOption {
+	return func(c *ConnectClient) { c.profileOwner = username }
+}
+
+// WithUnknownProfileOwner records that the active profile's owner could not be
+// determined, so no user's certificate store answers certificate posture checks.
+func WithUnknownProfileOwner() ConnectClientOption {
+	return func(c *ConnectClient) { c.profileOwnerUnknown = true }
 }
 
 func NewConnectClient(
 	ctx context.Context,
 	config *profilemanager.Config,
 	statusRecorder *peer.Status,
+	opts ...ConnectClientOption,
 ) *ConnectClient {
 	// Derive the run context here so Stop owns the cancel that unblocks the run
 	// loop. runCancel is set once at construction, so Stop can call it without
 	// racing the run loop's startup. Callers therefore need not cancel before Stop.
 	runCtx, runCancel := context.WithCancel(ctx)
-	return &ConnectClient{
+	c := &ConnectClient{
 		ctx:            runCtx,
 		runCancel:      runCancel,
 		runExited:      make(chan struct{}),
@@ -88,6 +128,10 @@ func NewConnectClient(
 		statusRecorder: statusRecorder,
 		engineMutex:    sync.Mutex{},
 	}
+	for _, opt := range opts {
+		opt(c)
+	}
+	return c
 }
 
 func (c *ConnectClient) SetUpdateManager(um *updater.Manager) {
@@ -112,11 +156,14 @@ func (c *ConnectClient) RunOnAndroid(
 	stateFilePath string,
 	cacheDir string,
 ) error {
+	notifier := tunnelnotifier.New(networkChangeListener, nil)
+	defer notifier.Close()
+
 	// in case of non Android os these variables will be nil
 	mobileDependency := MobileDependency{
 		TunAdapter:            tunAdapter,
 		IFaceDiscover:         iFaceDiscover,
-		NetworkChangeListener: networkChangeListener,
+		NetworkChangeListener: notifier,
 		HostDNSAddresses:      dnsAddresses,
 		DnsReadyListener:      dnsReadyListener,
 		StateFilePath:         stateFilePath,
@@ -136,10 +183,13 @@ func (c *ConnectClient) RunOniOS(
 	// Set GC percent to 5% to reduce memory usage as iOS only allows 50MB of memory for the extension.
 	debug.SetGCPercent(5)
 
+	notifier := tunnelnotifier.New(networkChangeListener, dnsManager)
+	defer notifier.Close()
+
 	mobileDependency := MobileDependency{
 		FileDescriptor:        fileDescriptor,
-		NetworkChangeListener: networkChangeListener,
-		DnsManager:            dnsManager,
+		NetworkChangeListener: notifier,
+		DnsManager:            notifier,
 		StateFilePath:         stateFilePath,
 		TempDir:               cacheDir,
 	}
@@ -217,7 +267,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 	wrapErr := state.Wrap
 	myPrivateKey, err := wgtypes.ParseKey(c.config.PrivateKey)
 	if err != nil {
-		log.Errorf("failed parsing Wireguard key %s: [%s]", c.config.PrivateKey, err.Error())
+		log.Errorf("failed parsing Wireguard key: %s", err)
 		return wrapErr(err)
 	}
 
@@ -231,8 +281,15 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		return err
 	}
 
+	// path stays alongside the manager because the engine derives StateDir
+	// from it; an in-memory client leaves it empty.
 	var path string
-	if runtime.GOOS == "ios" || runtime.GOOS == "android" {
+	var stateManager *statemanager.Manager
+	switch {
+	case c.inMemoryState:
+		log.Debugf("client state is kept in memory")
+		stateManager = statemanager.NewInMemory()
+	case runtime.GOOS == "ios" || runtime.GOOS == "android":
 		// On mobile, use the provided state file path directly
 		if !fileExists(mobileDependency.StateFilePath) {
 			if err := createFile(mobileDependency.StateFilePath); err != nil {
@@ -241,11 +298,12 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			}
 		}
 		path = mobileDependency.StateFilePath
-	} else {
+		stateManager = statemanager.New(path)
+	default:
 		sm := profilemanager.NewServiceManager("")
 		path = sm.GetStatePath()
+		stateManager = statemanager.New(path)
 	}
-	stateManager := statemanager.New(path)
 	stateManager.RegisterState(&sshconfig.ShutdownState{})
 
 	if c.updateManager != nil {
@@ -257,13 +315,27 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		log.Errorf("failed to clean up temporary installer file: %v", err)
 	}
 
-	defer c.statusRecorder.ClientStop()
+	defer func() {
+		c.statusRecorder.SetSessionExpiresAt(time.Time{})
+		c.statusRecorder.ClientStop()
+	}()
 	operation := func() error {
 		// if context cancelled we not start new backoff cycle
 		if c.ctx.Err() != nil {
 			return nil
 		}
 
+		if c.updateManager != nil {
+			c.updateManager.ResetMode()
+		}
+
+		// suspend connection attempts while the OS reports no usable network
+		if waited, err := c.netMgr.Wait(c.ctx); err != nil {
+			return nil
+		} else if waited {
+			backOff.Reset()
+		}
+
 		state.Set(StatusConnecting)
 
 		engineCtx, cancel := context.WithCancel(c.ctx)
@@ -275,8 +347,18 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()
 
 		log.Debugf("connecting to the Management service %s", c.config.ManagementURL.Host)
-		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled)
+		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled,
+			mgm.WithNetEvents(c.netMgr))
 		if err != nil {
+			// On daemon shutdown / Down() the parent context is cancelled
+			// and the dial fails with "context canceled". Wrapping that
+			// into state would leave the snapshot stuck at Connecting+err
+			// until the backoff loop wakes up — instead let the operation
+			// return cleanly so the deferred state.Set(StatusIdle) takes
+			// effect on the next iteration.
+			if c.ctx.Err() != nil {
+				return nil
+			}
 			return wrapErr(gstatus.Errorf(codes.FailedPrecondition, "failed connecting to Management Service : %s", err))
 		}
 		mgmNotifier := statusRecorderToMgmConnStateNotifier(c.statusRecorder)
@@ -341,7 +423,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()
 
 		// with the global Netbird config in hand connect (just a connection, no stream yet) Signal
-		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey)
+		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey, c.netMgr)
 		if err != nil {
 			log.Error(err)
 			return wrapErr(err)
@@ -371,13 +453,16 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return wrapErr(err)
 		}
 		engineConfig.TempDir = mobileDependency.TempDir
+		engineConfig.CertStore.ProfileOwner = c.profileOwner
+		engineConfig.CertStore.OwnerUnknown = c.profileOwnerUnknown
 		// Leave StateDir empty when there is no state path so a disk-backed
 		// syncstore falls back to os.TempDir() instead of filepath.Dir("") == ".".
 		if path != "" {
 			engineConfig.StateDir = filepath.Dir(path)
 		}
 
-		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU)
+		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU,
+			relayClient.WithNetEvents(c.netMgr))
 		c.statusRecorder.SetRelayMgr(relayManager)
 		if len(relayURLs) > 0 {
 			if token != nil {
@@ -405,6 +490,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			UpdateManager:  c.updateManager,
 			ClientMetrics:  c.clientMetrics,
 			MetricsCtx:     c.ctx,
+			NetMgr:         c.netMgr,
 		}, mobileDependency)
 		engine.SetSyncResponsePersistence(c.persistSyncResponse)
 		c.engine = engine
@@ -415,6 +501,10 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return wrapErr(err)
 		}
 
+		// Seed the session-expiry deadline from the LoginResponse. Subsequent
+		// changes flow in through SyncResponse and are applied in handleSync.
+		engine.ApplySessionDeadline(loginResp.GetSessionExpiresAt())
+
 		log.Infof("Netbird engine started, the IP is: %s", peerConfig.GetAddress())
 		state.Set(StatusConnected)
 
@@ -451,8 +541,22 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 	}
 
 	c.statusRecorder.ClientStart()
+	// Wrap the backoff with c.ctx so Down()/actCancel propagates into the
+	// inter-attempt sleep — otherwise a 15s MaxInterval can keep the retry
+	// loop alive long after the caller asked to give up, leaving the
+	// status stream stuck at Connecting.
 	err = backoff.Retry(operation, backoff.WithContext(backOff, c.ctx))
 	if err != nil {
+		// Once the client context is cancelled backoff.WithContext surfaces the
+		// bare context error, and any attempt torn down mid-flight reports the
+		// same. That cancellation is the caller asking us to stop (Stop, Down or
+		// an engine restart), so exit cleanly instead of handing back a failure
+		// the caller would have to distinguish from a real one.
+		if c.ctx.Err() != nil && errors.Is(err, context.Canceled) {
+			log.Info("exiting client retry loop, context cancelled")
+			return nil
+		}
+
 		log.Debugf("exiting client retry loop due to unrecoverable error: %s", err)
 		if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.PermissionDenied) {
 			state.Set(StatusNeedsLogin)
@@ -587,6 +691,7 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 		RosenpassEnabled:              config.RosenpassEnabled,
 		RosenpassPermissive:           config.RosenpassPermissive,
 		ServerSSHAllowed:              util.ReturnBoolWithDefaultTrue(config.ServerSSHAllowed),
+		RemoteJobsAllowed:             util.ReturnBoolWithDefaultFalse(config.RemoteJobsAllowed),
 		EnableSSHRoot:                 config.EnableSSHRoot,
 		EnableSSHSFTP:                 config.EnableSSHSFTP,
 		EnableSSHLocalPortForwarding:  config.EnableSSHLocalPortForwarding,
@@ -601,9 +706,12 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 		BlockLANAccess:      config.BlockLANAccess,
 		BlockInbound:        config.BlockInbound,
 		DisableIPv6:         config.DisableIPv6,
+		SyncMessageVersion:  config.SyncMessageVersion,
 
 		LazyConnection: lazyconn.ParseState(config.LazyConnection),
 
+		CertStore: certStoreConfig(config),
+
 		MTU:     selectMTU(config.MTU, peerConfig.Mtu),
 		LogPath: logPath,
 
@@ -630,6 +738,22 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 	return engineConf, nil
 }
 
+// certStoreConfig reads where certificate posture finds certificates from the daemon's
+// environment, NB_CERT_STORE_DIR and NB_CERT_PKCS11_URI with NB_TPM_PIN. The profile
+// config fields that once held them are ignored, and a value left there is reported
+// once, so a setup relying on it does not silently stop proving.
+func certStoreConfig(config *profilemanager.Config) certproof.Config {
+	if config.CertStoreDir != "" || config.CertPKCS11URI != "" {
+		legacyCertConfigOnce.Do(func() {
+			log.Warnf("certificate posture: CertStoreDir and CertPKCS11URI in the profile config are ignored, set %s and %s in the daemon's environment instead",
+				certproof.StoreDirEnv, certproof.PKCS11URIEnv)
+		})
+	}
+	return certproof.Config{PKCS11: certproof.PKCS11FromEnv()}
+}
+
+var legacyCertConfigOnce sync.Once
+
 func selectMTU(localMTU uint16, peerMTU int32) uint16 {
 	var finalMTU uint16 = iface.DefaultMTU
 	if localMTU > 0 {
@@ -645,7 +769,7 @@ func selectMTU(localMTU uint16, peerMTU int32) uint16 {
 }
 
 // connectToSignal creates Signal Service client and established a connection
-func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key) (*signal.GrpcClient, error) {
+func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key, netMgr *netevents.Manager) (*signal.GrpcClient, error) {
 	var sigTLSEnabled bool
 	if wtConfig.Signal.Protocol == mgmProto.HostConfig_HTTPS {
 		sigTLSEnabled = true
@@ -653,7 +777,8 @@ func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourP
 		sigTLSEnabled = false
 	}
 
-	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled)
+	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled,
+		signal.WithNetEvents(netMgr))
 	if err != nil {
 		log.Errorf("error while connecting to the Signal Exchange Service %s: %s", wtConfig.Signal.Uri, err)
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "failed connecting to Signal Service : %s", err)
@@ -676,11 +801,13 @@ func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte,
 		config.BlockLANAccess,
 		config.BlockInbound,
 		config.DisableIPv6,
+		config.SyncMessageVersion,
 		config.EnableSSHRoot,
 		config.EnableSSHSFTP,
 		config.EnableSSHLocalPortForwarding,
 		config.EnableSSHRemotePortForwarding,
 		config.DisableSSHAuth,
+		config.RemoteJobsAllowed,
 	)
 	return client.Login(sysInfo, pubSSHKey, config.DNSLabels)
 }
diff --git a/client/internal/connect_certstore_test.go b/client/internal/connect_certstore_test.go
new file mode 100644
index 000000000..a20fbd809
--- /dev/null
+++ b/client/internal/connect_certstore_test.go
@@ -0,0 +1,26 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/client/internal/certproof"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// TestCertStoreConfig_ReadsEnvironmentNotProfile: the token URI may carry the PIN, so it
+// and the store directory come from the daemon's environment, and values left in the
+// profile config from an older version are ignored.
+func TestCertStoreConfig_ReadsEnvironmentNotProfile(t *testing.T) {
+	t.Setenv(certproof.PKCS11URIEnv, "pkcs11:token=env")
+	t.Setenv(certproof.PINEnv, "1234")
+
+	cfg := certStoreConfig(&profilemanager.Config{
+		CertStoreDir:  "/from/profile",
+		CertPKCS11URI: "pkcs11:token=profile?pin-value=9999",
+	})
+
+	assert.Equal(t, "pkcs11:token=env", cfg.PKCS11.URI, "the URI comes from the environment")
+	assert.Equal(t, "1234", cfg.PKCS11.PIN, "the PIN comes from the environment")
+}
diff --git a/client/internal/connect_test.go b/client/internal/connect_test.go
index c317c88d8..3212e6abf 100644
--- a/client/internal/connect_test.go
+++ b/client/internal/connect_test.go
@@ -5,65 +5,78 @@ import (
 	"testing"
 )
 
-func Test_freePort(t *testing.T) {
-	tests := []struct {
-		name        string
-		port        int
-		want        int
-		shouldMatch bool
-	}{
-		{
-			name:        "when port is 0 use random port",
-			port:        0,
-			want:        0,
-			shouldMatch: false,
-		},
-		{
-			name:        "provided and available",
-			port:        51821,
-			want:        51821,
-			shouldMatch: true,
-		},
-		{
-			name:        "provided and not available",
-			port:        51830,
-			want:        51830,
-			shouldMatch: false,
-		},
-	}
-	c1, err := net.ListenUDP("udp", &net.UDPAddr{Port: 0})
+// probeFreePort asks the OS for a free UDP port and immediately releases it.
+// The returned number is only a hint: nothing stops another process from
+// grabbing the same port before the caller gets a chance to bind it.
+//
+// A hardcoded port number is not an option here: any fixed number can fall
+// inside the ephemeral range and be held by an unrelated process on the test
+// runner.
+func probeFreePort(t *testing.T) int {
+	t.Helper()
+
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{Port: 0})
 	if err != nil {
-		t.Errorf("freePort error = %v", err)
+		t.Fatalf("failed to bind probe port: %v", err)
 	}
-	defer func(c1 *net.UDPConn) {
-		_ = c1.Close()
-	}(c1)
-
-	if tests[1].port == c1.LocalAddr().(*net.UDPAddr).Port {
-		tests[1].port++
-		tests[1].want++
-	}
-
-	tests[2].port = c1.LocalAddr().(*net.UDPAddr).Port
-	tests[2].want = c1.LocalAddr().(*net.UDPAddr).Port
-
-	for _, tt := range tests {
-
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := freePort(tt.port)
-
-			if err != nil {
-				t.Errorf("got an error while getting free port: %v", err)
-			}
-
-			if tt.shouldMatch && got != tt.want {
-				t.Errorf("got a different port %v, want %v", got, tt.want)
-			}
-
-			if !tt.shouldMatch && got == tt.want {
-				t.Errorf("got the same port %v, want a different port", tt.want)
-			}
-		})
-
+	port := conn.LocalAddr().(*net.UDPAddr).Port
+	if err := conn.Close(); err != nil {
+		t.Fatalf("failed to close probe port: %v", err)
 	}
+	return port
+}
+
+func Test_freePort(t *testing.T) {
+	t.Run("when port is 0 use random port", func(t *testing.T) {
+		got, err := freePort(0)
+		if err != nil {
+			t.Fatalf("got an error while getting free port: %v", err)
+		}
+		if got == 0 {
+			t.Errorf("got port 0, want a non-zero random port")
+		}
+	})
+
+	t.Run("provided and available", func(t *testing.T) {
+		const maxAttempts = 5
+
+		// The probed port is released before freePort binds it, so an
+		// unrelated process on the test runner can grab it in between,
+		// making freePort fall back to a different port. Retry with a
+		// freshly probed port instead of failing on a lost race.
+		for attempt := 1; attempt <= maxAttempts; attempt++ {
+			candidate := probeFreePort(t)
+
+			got, err := freePort(candidate)
+			if err != nil {
+				t.Fatalf("got an error while getting free port: %v", err)
+			}
+
+			if got == candidate {
+				return
+			}
+			t.Logf("attempt %d: freePort returned %d instead of the requested %d, retrying", attempt, got, candidate)
+		}
+
+		t.Fatalf("freePort did not return the requested free port after %d attempts", maxAttempts)
+	})
+
+	t.Run("provided and not available", func(t *testing.T) {
+		busy, err := net.ListenUDP("udp", &net.UDPAddr{Port: 0})
+		if err != nil {
+			t.Fatalf("failed to bind busy port: %v", err)
+		}
+		t.Cleanup(func() {
+			_ = busy.Close()
+		})
+		busyPort := busy.LocalAddr().(*net.UDPAddr).Port
+
+		got, err := freePort(busyPort)
+		if err != nil {
+			t.Fatalf("got an error while getting free port: %v", err)
+		}
+		if got == busyPort {
+			t.Errorf("got the same port %v, want a different port", busyPort)
+		}
+	})
 }
diff --git a/client/internal/daemonaddr/grpc.go b/client/internal/daemonaddr/grpc.go
new file mode 100644
index 000000000..5f0cc10cc
--- /dev/null
+++ b/client/internal/daemonaddr/grpc.go
@@ -0,0 +1,42 @@
+package daemonaddr
+
+import (
+	"os"
+	"strconv"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// EnvMaxRecvMsgSize overrides the default gRPC max receive message size for
+	// connections to the daemon. Value is in bytes.
+	EnvMaxRecvMsgSize = "NB_DAEMON_GRPC_MAX_MSG_SIZE"
+
+	// defaultMaxRecvMsgSize is the max gRPC receive message size used for daemon
+	// connections when EnvMaxRecvMsgSize is unset or invalid. It overrides the
+	// gRPC library default of 4 MB, which a detailed status already exceeds on a
+	// network of a few thousand peers.
+	defaultMaxRecvMsgSize = 1024 * 1024 * 16
+)
+
+// MaxRecvMsgSize returns the max gRPC receive message size for daemon connections
+// from the environment, or defaultMaxRecvMsgSize (16 MB) if unset or invalid.
+func MaxRecvMsgSize() int {
+	val := os.Getenv(EnvMaxRecvMsgSize)
+	if val == "" {
+		return defaultMaxRecvMsgSize
+	}
+
+	size, err := strconv.Atoi(val)
+	if err != nil {
+		log.Warnf("invalid %s value %q, using default: %v", EnvMaxRecvMsgSize, val, err)
+		return defaultMaxRecvMsgSize
+	}
+
+	if size <= 0 {
+		log.Warnf("invalid %s value %d, must be positive, using default", EnvMaxRecvMsgSize, size)
+		return defaultMaxRecvMsgSize
+	}
+
+	return size
+}
diff --git a/client/internal/daemonaddr/grpc_test.go b/client/internal/daemonaddr/grpc_test.go
new file mode 100644
index 000000000..7c4909a42
--- /dev/null
+++ b/client/internal/daemonaddr/grpc_test.go
@@ -0,0 +1,112 @@
+package daemonaddr
+
+import (
+	"context"
+	"net"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+func TestMaxRecvMsgSize(t *testing.T) {
+	tests := []struct {
+		name     string
+		envValue string
+		expected int
+	}{
+		{name: "unset returns default", envValue: "", expected: defaultMaxRecvMsgSize},
+		{name: "non-numeric returns default", envValue: "abc", expected: defaultMaxRecvMsgSize},
+		{name: "negative returns default", envValue: "-1", expected: defaultMaxRecvMsgSize},
+		{name: "zero returns default", envValue: "0", expected: defaultMaxRecvMsgSize},
+		{name: "valid value is used", envValue: "33554432", expected: 33554432},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// Set first so the previous value is restored on cleanup, then unset to
+			// exercise the absent case.
+			t.Setenv(EnvMaxRecvMsgSize, tc.envValue)
+			if tc.envValue == "" {
+				require.NoError(t, os.Unsetenv(EnvMaxRecvMsgSize), "unset the override")
+			}
+
+			assert.Equal(t, tc.expected, MaxRecvMsgSize(), "max receive message size")
+		})
+	}
+}
+
+// bigStatusServer answers Status with a response larger than gRPC's 4 MB default
+// receive limit, which is what a detailed status on a large network looks like.
+type bigStatusServer struct {
+	proto.UnimplementedDaemonServiceServer
+	payload string
+}
+
+func (s *bigStatusServer) Status(context.Context, *proto.StatusRequest) (*proto.StatusResponse, error) {
+	return &proto.StatusResponse{Status: s.payload}, nil
+}
+
+func startBigStatusServer(t *testing.T, payload string) string {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err, "listen on loopback")
+
+	srv := grpc.NewServer()
+	proto.RegisterDaemonServiceServer(srv, &bigStatusServer{payload: payload})
+	go func() {
+		_ = srv.Serve(listener)
+	}()
+	t.Cleanup(srv.Stop)
+
+	return "tcp://" + listener.Addr().String()
+}
+
+func TestDialTargetAcceptsAStatusOverTheGrpcDefault(t *testing.T) {
+	payload := strings.Repeat("x", 5*1024*1024)
+	addr := startBigStatusServer(t, payload)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	target, opts := DialTarget(addr)
+	conn, err := grpc.NewClient(target, opts...)
+	require.NoError(t, err, "dial the daemon")
+	t.Cleanup(func() { _ = conn.Close() })
+
+	resp, err := proto.NewDaemonServiceClient(conn).Status(ctx, &proto.StatusRequest{})
+	require.NoError(t, err, "a detailed status must not be rejected for its size")
+	assert.Len(t, resp.GetStatus(), len(payload), "the whole response must arrive")
+}
+
+// TestDialTargetRaisesTheDefaultLimit is the negative control: the same response
+// over a connection carrying gRPC's own defaults is refused, which is the failure
+// reported by `netbird status -d` on a large deployment.
+func TestDialTargetRaisesTheDefaultLimit(t *testing.T) {
+	payload := strings.Repeat("x", 5*1024*1024)
+	addr := startBigStatusServer(t, payload)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	conn, err := grpc.NewClient(
+		strings.TrimPrefix(addr, "tcp://"),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	require.NoError(t, err, "dial with the library defaults")
+	t.Cleanup(func() { _ = conn.Close() })
+
+	_, err = proto.NewDaemonServiceClient(conn).Status(ctx, &proto.StatusRequest{})
+	require.Error(t, err, "the library default must reject this response")
+	assert.Equal(t, codes.ResourceExhausted, status.Code(err), "gRPC rejects an oversized message")
+}
diff --git a/client/internal/daemonaddr/identity.go b/client/internal/daemonaddr/identity.go
new file mode 100644
index 000000000..b6af515b7
--- /dev/null
+++ b/client/internal/daemonaddr/identity.go
@@ -0,0 +1,17 @@
+package daemonaddr
+
+import "strings"
+
+// CarriesIdentity reports whether the control channel at addr conveys the
+// connecting process's identity to the daemon. A Unix socket carries peer
+// credentials and a named pipe carries the client's token. Nothing else does, TCP
+// included, and there the daemon can authorize a privileged operation for nobody
+// at all: see ResolveDaemonAddr, which says as much to anyone still reaching the
+// Windows daemon on the address it served before it had a pipe.
+//
+// A client uses this to tell whether becoming privileged would get it anywhere.
+// It answers from the scheme and nothing else, so an address it does not
+// recognise counts as carrying no identity.
+func CarriesIdentity(addr string) bool {
+	return strings.HasPrefix(addr, "unix://") || strings.HasPrefix(addr, pipeScheme)
+}
diff --git a/client/internal/daemonaddr/identity_test.go b/client/internal/daemonaddr/identity_test.go
new file mode 100644
index 000000000..2808b5017
--- /dev/null
+++ b/client/internal/daemonaddr/identity_test.go
@@ -0,0 +1,29 @@
+package daemonaddr
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCarriesIdentity(t *testing.T) {
+	tests := []struct {
+		addr string
+		want bool
+	}{
+		{"unix:///var/run/netbird.sock", true},
+		{"unix:///var/run/netbird/default.sock", true},
+		{"npipe://netbird", true},
+		{`npipe://\\.\pipe\ProtectedPrefix\Administrators\netbird`, true},
+		{"tcp://127.0.0.1:41731", false},
+		{"tcp://localhost:41731", false},
+		{"", false},
+		{"/var/run/netbird.sock", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.addr, func(t *testing.T) {
+			assert.Equal(t, tt.want, CarriesIdentity(tt.addr), "address %q", tt.addr)
+		})
+	}
+}
diff --git a/client/internal/daemonaddr/owner.go b/client/internal/daemonaddr/owner.go
new file mode 100644
index 000000000..c476f9ae6
--- /dev/null
+++ b/client/internal/daemonaddr/owner.go
@@ -0,0 +1,15 @@
+package daemonaddr
+
+// DaemonRunsAsSelf reports whether the daemon listening at addr runs as this very
+// user. That is what makes an unprivileged daemon authorize this process for the
+// changes it otherwise restricts to root or an administrator, so a client can tell
+// up front whether those controls are usable instead of letting a save fail.
+//
+// It is answered from the ownership of the socket or pipe the daemon created, so it
+// costs no round trip and needs no cooperation from the daemon. Ownership that
+// cannot be read is reported as false, including for a TCP address, so a caller
+// reading this as "the daemon would allow it" fails closed. The daemon remains the
+// only thing that authorizes anything: this only decides what a client offers.
+func DaemonRunsAsSelf(addr string) bool {
+	return daemonRunsAsSelf(addr)
+}
diff --git a/client/internal/daemonaddr/owner_unix.go b/client/internal/daemonaddr/owner_unix.go
new file mode 100644
index 000000000..493e6528d
--- /dev/null
+++ b/client/internal/daemonaddr/owner_unix.go
@@ -0,0 +1,40 @@
+//go:build !windows
+
+package daemonaddr
+
+import (
+	"os"
+	"strings"
+	"syscall"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// daemonRunsAsSelf compares the owner of the daemon's Unix socket with this
+// process's uid. Root is not treated specially here: a root caller is privileged
+// on its own merits, and a root-owned socket says nothing about the caller.
+func daemonRunsAsSelf(addr string) bool {
+	path, ok := strings.CutPrefix(addr, "unix://")
+	if !ok {
+		return false
+	}
+
+	info, err := os.Stat(path)
+	if err != nil {
+		log.Debugf("stat daemon socket %s: %v", path, err)
+		return false
+	}
+
+	// Only a socket says anything about a daemon. A directory or a leftover
+	// regular file at that path is not one, and reading it as "the daemon runs as
+	// us" would offer controls the daemon then refuses.
+	if info.Mode()&os.ModeSocket == 0 {
+		return false
+	}
+
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return false
+	}
+	return stat.Uid == uint32(os.Getuid())
+}
diff --git a/client/internal/daemonaddr/owner_unix_test.go b/client/internal/daemonaddr/owner_unix_test.go
new file mode 100644
index 000000000..363c7d95d
--- /dev/null
+++ b/client/internal/daemonaddr/owner_unix_test.go
@@ -0,0 +1,62 @@
+//go:build !windows
+
+package daemonaddr
+
+import (
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// A socket this user created means the daemon runs as this user, which is the
+// rootless case where the daemon delegates its authority to its own identity.
+func TestDaemonRunsAsSelf_OwnSocket(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "netbird.sock")
+	ln, err := net.Listen("unix", path)
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() {
+		if err := ln.Close(); err != nil {
+			t.Logf("close listener: %v", err)
+		}
+	})
+
+	if !DaemonRunsAsSelf("unix://" + path) {
+		t.Error("a socket owned by this user must count as the daemon running as us")
+	}
+}
+
+// Everything that is not a readable socket of ours has to answer false, because
+// the caller reads a true as "the daemon would authorize me".
+func TestDaemonRunsAsSelf_FailsClosed(t *testing.T) {
+	dir := t.TempDir()
+
+	// A socket owned by another user, which is what a root-run daemon looks like
+	// to an unprivileged client. Only assertable when we are not root ourselves.
+	rootOwned := "unix:///var/run/netbird.sock"
+	if _, err := os.Stat("/var/run/netbird.sock"); err == nil && os.Getuid() != 0 {
+		if DaemonRunsAsSelf(rootOwned) {
+			t.Error("a socket owned by another user must not count as ours")
+		}
+	}
+
+	for name, addr := range map[string]string{
+		"missing socket":  "unix://" + filepath.Join(dir, "absent.sock"),
+		"tcp address":     "tcp://127.0.0.1:41731",
+		"named pipe":      "npipe://netbird",
+		"empty":           "",
+		"no scheme":       filepath.Join(dir, "absent.sock"),
+		"directory":       "unix://" + dir,
+		"unknown scheme":  "http://localhost:8080",
+		"scheme only":     "unix://",
+		"relative socket": "unix://netbird.sock",
+	} {
+		t.Run(name, func(t *testing.T) {
+			if DaemonRunsAsSelf(addr) {
+				t.Errorf("%q must not count as a daemon running as us", addr)
+			}
+		})
+	}
+}
diff --git a/client/internal/daemonaddr/owner_windows.go b/client/internal/daemonaddr/owner_windows.go
new file mode 100644
index 000000000..1cd2bba15
--- /dev/null
+++ b/client/internal/daemonaddr/owner_windows.go
@@ -0,0 +1,42 @@
+//go:build windows
+
+package daemonaddr
+
+import (
+	"context"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// daemonRunsAsSelf reads the owner of the daemon's pipe. A daemon running as the
+// service account owns its pipe as LocalSystem, and an elevated one as
+// BUILTIN\Administrators, so only a daemon the user started themselves matches.
+func daemonRunsAsSelf(addr string) bool {
+	name, ok := strings.CutPrefix(addr, pipeScheme)
+	if !ok {
+		return false
+	}
+
+	for _, path := range PipePaths(name) {
+		// Bounded: this runs on the UI's path for deciding which controls to
+		// offer, so a pipe that does not answer promptly must not stall it. A
+		// timeout leaves the caller unprivileged, which only disables controls.
+		ctx, cancel := context.WithTimeout(context.Background(), probeTimeout)
+		conn, err := dialPipe(ctx, path)
+		cancel()
+		if err != nil {
+			continue
+		}
+
+		owned := ipcauth.PipeOwnedBySelf(conn)
+		if cerr := conn.Close(); cerr != nil {
+			log.Debugf("close daemon pipe %s after ownership check: %v", path, cerr)
+		}
+		return owned
+	}
+
+	return false
+}
diff --git a/client/internal/daemonaddr/pipe.go b/client/internal/daemonaddr/pipe.go
new file mode 100644
index 000000000..bf1c8fdd0
--- /dev/null
+++ b/client/internal/daemonaddr/pipe.go
@@ -0,0 +1,106 @@
+package daemonaddr
+
+import (
+	"context"
+	"net"
+	"runtime"
+	"strings"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+const (
+	// WindowsPipeAddr is the default daemon address on Windows. A named pipe
+	// carries the connecting process's token, which loopback TCP does not, so
+	// it is the only Windows transport on which the daemon can tell who is
+	// calling it.
+	WindowsPipeAddr = "npipe://netbird"
+
+	// legacyWindowsAddr is the loopback-TCP address the Windows daemon used
+	// before named-pipe support.
+	legacyWindowsAddr = "tcp://127.0.0.1:41731"
+
+	pipeScheme = "npipe://"
+
+	// protectedPrefix is the NPFS namespace in which only LocalSystem and
+	// members of BUILTIN\Administrators may create a pipe. A daemon running as
+	// the service account creates its pipe there so that an unprivileged process
+	// cannot pre-create the name, which would keep the daemon from starting and
+	// leave callers talking to the squatter. Opening such a pipe needs no
+	// privilege, so unprivileged clients still reach the daemon.
+	protectedPrefix = `ProtectedPrefix\Administrators\`
+)
+
+// DialTarget returns the gRPC dial target and transport options for a daemon
+// address. The npipe scheme needs a context dialer because gRPC has no
+// named-pipe resolver; unix and tcp are handled by gRPC itself.
+func DialTarget(addr string) (string, []grpc.DialOption) {
+	opts := []grpc.DialOption{
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(MaxRecvMsgSize())),
+	}
+
+	if name, ok := strings.CutPrefix(addr, pipeScheme); ok {
+		paths := PipePaths(name)
+		opts = append(opts, grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) {
+			return dialPipePaths(ctx, paths)
+		}))
+		return "passthrough:///netbird-daemon-pipe", opts
+	}
+
+	return strings.TrimPrefix(addr, "tcp://"), opts
+}
+
+// PipePath maps an npipe address name ("netbird", from "npipe://netbird") to a
+// Windows named-pipe path (\\.\pipe\netbird). A fully qualified path is left as
+// is.
+func PipePath(name string) string {
+	if strings.HasPrefix(name, `\\`) {
+		return name
+	}
+	return `\\.\pipe\` + name
+}
+
+// PipePaths returns the paths a daemon control pipe may live at for an npipe
+// address name, in the order both sides must try them: the protected name first,
+// then the plain one.
+//
+// The daemon serves the first it can create, which is the protected name when it
+// runs as the service account and the plain one when it runs as an ordinary user,
+// as it does in netstack mode. Clients therefore have to try both, and because a
+// client cannot tell from the name alone who created the pipe, the plain name is
+// only usable once the server's identity has been checked: see
+// verifyPipeServer.
+//
+// A fully qualified path is what the operator asked for and is used as is.
+func PipePaths(name string) []string {
+	if strings.HasPrefix(name, `\\`) {
+		return []string{name}
+	}
+	return []string{PipePath(protectedPrefix + name), PipePath(name)}
+}
+
+// IsProtectedPipePath reports whether a pipe path is in the namespace only an
+// administrator or LocalSystem can create in, which is what lets a client trust
+// such a pipe from its name alone.
+func IsProtectedPipePath(path string) bool {
+	return strings.HasPrefix(path, `\\.\pipe\`+protectedPrefix)
+}
+
+// MigrateLegacy upgrades the pre-named-pipe Windows daemon address to the named
+// pipe, reporting whether it rewrote the address. Existing installs persist the
+// daemon address, so without this an upgraded daemon would keep listening on
+// loopback TCP, where callers carry no identity and privileged operations would
+// have to be refused for everyone. Only the exact legacy default is rewritten:
+// a deliberately chosen custom address is left alone.
+func MigrateLegacy(addr string) (string, bool) {
+	return migrateLegacyForOS(runtime.GOOS, addr)
+}
+
+func migrateLegacyForOS(goos, addr string) (string, bool) {
+	if goos == "windows" && addr == legacyWindowsAddr {
+		return WindowsPipeAddr, true
+	}
+	return addr, false
+}
diff --git a/client/internal/daemonaddr/pipe_other.go b/client/internal/daemonaddr/pipe_other.go
new file mode 100644
index 000000000..04e8e7331
--- /dev/null
+++ b/client/internal/daemonaddr/pipe_other.go
@@ -0,0 +1,15 @@
+//go:build !windows
+
+package daemonaddr
+
+import (
+	"context"
+	"fmt"
+	"net"
+)
+
+// dialPipePaths is Windows-only: no other platform serves the daemon on a named
+// pipe.
+func dialPipePaths(context.Context, []string) (net.Conn, error) {
+	return nil, fmt.Errorf("named pipes are only supported on Windows")
+}
diff --git a/client/internal/daemonaddr/pipe_test.go b/client/internal/daemonaddr/pipe_test.go
new file mode 100644
index 000000000..b9dfd90f1
--- /dev/null
+++ b/client/internal/daemonaddr/pipe_test.go
@@ -0,0 +1,30 @@
+package daemonaddr
+
+import (
+	"slices"
+	"testing"
+)
+
+// The protected name must be tried before the plain one on both sides: it is the
+// one an unprivileged process cannot create, so preferring it is what keeps a
+// squatter from owning the name the service daemon would otherwise use.
+func TestPipePaths_PrefersTheProtectedName(t *testing.T) {
+	got := PipePaths("netbird")
+	want := []string{
+		`\\.\pipe\ProtectedPrefix\Administrators\netbird`,
+		`\\.\pipe\netbird`,
+	}
+	if !slices.Equal(got, want) {
+		t.Errorf("PipePaths = %q, want %q", got, want)
+	}
+}
+
+// An operator who passes a full path chose exactly one pipe, so neither side may
+// look anywhere else.
+func TestPipePaths_QualifiedPathIsUsedAsIs(t *testing.T) {
+	path := `\\.\pipe\custom-netbird`
+	got := PipePaths(path)
+	if !slices.Equal(got, []string{path}) {
+		t.Errorf("PipePaths = %q, want just %q", got, path)
+	}
+}
diff --git a/client/internal/daemonaddr/pipe_windows.go b/client/internal/daemonaddr/pipe_windows.go
new file mode 100644
index 000000000..3cd10a6c3
--- /dev/null
+++ b/client/internal/daemonaddr/pipe_windows.go
@@ -0,0 +1,59 @@
+//go:build windows
+
+package daemonaddr
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+
+	"github.com/Microsoft/go-winio"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// dialPipePaths connects to the first path that answers with a pipe server this
+// client may trust, and returns the last error when none does.
+func dialPipePaths(ctx context.Context, paths []string) (net.Conn, error) {
+	var lastErr error
+	for _, path := range paths {
+		conn, err := dialPipe(ctx, path)
+		if err != nil {
+			log.Debugf("dial daemon pipe %s: %v", path, err)
+			lastErr = err
+			continue
+		}
+
+		// A pipe in the protected namespace could only have been created by an
+		// administrator or LocalSystem, so its name is the guarantee. Any other
+		// name has to be checked, because any local user can create one.
+		if !IsProtectedPipePath(path) {
+			if err := ipcauth.PipeServerTrusted(conn); err != nil {
+				if closeErr := conn.Close(); closeErr != nil {
+					log.Debugf("close untrusted pipe %s: %v", path, closeErr)
+				}
+				lastErr = fmt.Errorf("%s: %w", path, err)
+				continue
+			}
+		}
+
+		return conn, nil
+	}
+
+	if lastErr == nil {
+		lastErr = errors.New("no daemon pipe to connect to")
+	}
+	return nil, lastErr
+}
+
+// dialPipe connects to the daemon control pipe at SECURITY_IDENTIFICATION.
+// winio's plain DialPipe connects at SECURITY_ANONYMOUS, under which the daemon
+// cannot read the caller's token at all. Identification lets the daemon read the
+// caller's SID and groups without granting it the ability to act as the caller.
+func dialPipe(ctx context.Context, path string) (net.Conn, error) {
+	access := uint32(windows.GENERIC_READ | windows.GENERIC_WRITE)
+	return winio.DialPipeAccessImpLevel(ctx, path, access, winio.PipeImpLevelIdentification)
+}
diff --git a/client/internal/daemonaddr/resolve_pipe_other.go b/client/internal/daemonaddr/resolve_pipe_other.go
new file mode 100644
index 000000000..1aede8453
--- /dev/null
+++ b/client/internal/daemonaddr/resolve_pipe_other.go
@@ -0,0 +1,9 @@
+//go:build !windows
+
+package daemonaddr
+
+// ResolveDaemonAddr is a no-op off Windows, where there is no named-pipe
+// default to fall back from.
+func ResolveDaemonAddr(addr string) string {
+	return addr
+}
diff --git a/client/internal/daemonaddr/resolve_pipe_windows.go b/client/internal/daemonaddr/resolve_pipe_windows.go
new file mode 100644
index 000000000..d12ddb15d
--- /dev/null
+++ b/client/internal/daemonaddr/resolve_pipe_windows.go
@@ -0,0 +1,82 @@
+//go:build windows
+
+package daemonaddr
+
+import (
+	"net"
+	"strings"
+	"time"
+
+	"github.com/Microsoft/go-winio"
+	log "github.com/sirupsen/logrus"
+)
+
+// probeTimeout bounds each transport probe. Both are local, so a daemon that is
+// listening answers immediately and one that is not fails immediately.
+const probeTimeout = 300 * time.Millisecond
+
+// ResolveDaemonAddr keeps a client on the named pipe and never silently moves it
+// off. When the pipe does not answer it checks the legacy loopback TCP address, so
+// a client meeting a daemon that has not restarted since the upgrade can say what
+// is wrong, but it does not connect there.
+//
+// Using that address automatically would be a downgrade the user never asked for:
+// any local process can bind 127.0.0.1 while the daemon is not listening, and the
+// transport carries no caller identity, so a client that accepted whatever answered
+// would hand a setup key, a pre-shared key or an SSO prompt to a local impostor. An
+// operator who needs the legacy address during the upgrade window can still pass
+// --daemon-addr explicitly, which is a deliberate choice and still refuses the
+// privileged operations.
+//
+// Only the pipe address is resolved. A custom address is left alone, though passing
+// --daemon-addr npipe://netbird explicitly is indistinguishable from the default
+// here, so it is treated the same way.
+func ResolveDaemonAddr(addr string) string {
+	if addr != WindowsPipeAddr {
+		return addr
+	}
+
+	for _, path := range PipePaths("netbird") {
+		if pipeAvailable(path) {
+			return addr
+		}
+	}
+
+	if tcpAvailable(legacyWindowsAddr) {
+		log.Warnf("the daemon is not serving %s, but something is listening on the legacy %s. "+
+			"Restart the NetBird service so it serves the pipe. That address is not used automatically: "+
+			"any local user can bind it and it carries no caller identity, so pass --daemon-addr %s "+
+			"explicitly if you accept that",
+			WindowsPipeAddr, legacyWindowsAddr, legacyWindowsAddr)
+	}
+
+	return addr
+}
+
+func pipeAvailable(path string) bool {
+	timeout := probeTimeout
+	conn, err := winio.DialPipe(path, &timeout)
+	if err != nil {
+		return false
+	}
+	if err := conn.Close(); err != nil {
+		log.Debugf("close daemon pipe probe: %v", err)
+	}
+	return true
+}
+
+func tcpAvailable(addr string) bool {
+	host := addr
+	if _, after, ok := strings.Cut(addr, "://"); ok {
+		host = after
+	}
+
+	conn, err := net.DialTimeout("tcp", host, probeTimeout)
+	if err != nil {
+		return false
+	}
+	if err := conn.Close(); err != nil {
+		log.Debugf("close daemon TCP probe: %v", err)
+	}
+	return true
+}
diff --git a/client/internal/debug/debug.go b/client/internal/debug/debug.go
index 5700b05de..95419b0e9 100644
--- a/client/internal/debug/debug.go
+++ b/client/internal/debug/debug.go
@@ -34,9 +34,8 @@ import (
 	"github.com/netbirdio/netbird/shared/netiputil"
 )
 
-const readmeContent = `Netbird debug bundle
-This debug bundle contains the following files.
-If the --anonymize flag is set, the files are anonymized to protect sensitive information.
+const readmeContent = `This debug bundle contains the following files.
+If anonymization is enabled (--anonymize / --anonymize-level), the files are anonymized to protect sensitive information.
 
 status.txt: Anonymized status information of the NetBird client.
 client.log: Most recent, anonymized client log file of the NetBird client.
@@ -52,6 +51,7 @@ nftables.txt: Anonymized nftables rules with packet counters across all families
 sysctls.txt: Forwarding, reverse-path filter, source-validation, and conntrack accounting sysctl values that the NetBird client may read or modify, if --system-info flag was provided (Linux only).
 resolv.conf: DNS resolver configuration from /etc/resolv.conf (Unix systems only), if --system-info flag was provided.
 scutil_dns.txt: DNS configuration from scutil --dns (macOS only), if --system-info flag was provided.
+dns_windows.txt: Anonymized NRPT rules and policy table in effect, DNS client policy, and per-interface and per-adapter DNS configuration (Windows only), if --system-info flag was provided.
 resolved_domains.txt: Anonymized resolved domain IP addresses from the status recorder.
 config.txt: Anonymized configuration information of the NetBird client.
 network_map.json: Anonymized sync response containing peer configurations, routes, DNS settings, and firewall rules.
@@ -70,21 +70,34 @@ capture.pcap: Packet capture in pcap format. Only present when capture was runni
 
 
 Anonymization Process
-The files in this bundle have been anonymized to protect sensitive information. Here's how the anonymization was applied:
+The files in this bundle have been anonymized to protect sensitive information. The level applied to this bundle is recorded at the top of this file. Here's how the anonymization was applied:
 
 IP Addresses
 
-IPv4 addresses are replaced with addresses starting from 198.51.100.0
-IPv6 addresses are replaced with addresses starting from 100::
+Default level:
+- Public IPv4 addresses are replaced with addresses starting from 198.51.100.0
+- Public IPv6 addresses are replaced with addresses starting from 2001:db8:ffff::
+- IPv6 unique local addresses (fc00::/7) are anonymized as well: their random global ID uniquely identifies the network.
+- IP addresses from internal IPv4 ranges and well-known addresses are not anonymized (e.g. 8.8.8.8, 100.64.0.0/10, addresses starting with 192.168., 172.16., 10., 169.254., fe80::).
+
+Strict level (--anonymize-level strict), in addition to the default level:
+- Private (RFC 1918), CGNAT (100.64.0.0/10), and link-local (169.254.0.0/16, fe80::/10) addresses are anonymized too.
+- Internal IPv4 addresses are replaced with addresses starting from 198.18.0.0 and internal IPv6 addresses with addresses starting from 2001:db8:1::, so internal addresses remain distinguishable from public ones.
+- Addresses are mapped in order of first appearance: subnet structure, allocation scheme, and gateway conventions are not preserved. Prefix lengths of networks are preserved.
+- Peer names in front of NetBird domains are replaced with numbered placeholders (e.g. peer-1.netbird.cloud), and subdomain labels of other domains with host-N placeholders.
+- WireGuard public keys are replaced with consistent placeholder keys.
 
-IP addresses from non public ranges and well known addresses are not anonymized (e.g. 8.8.8.8, 100.64.0.0/10, addresses starting with 192.168., 172.16., 10., etc.).
 Reoccuring IP addresses are replaced with the same anonymized address.
 
 Note: The anonymized IP addresses in the status file do not match those in the log and routes files. However, the anonymized IP addresses are consistent within the status file and across the routes and log files.
 
+MAC Addresses
+MAC addresses are replaced at every anonymization level with consistent placeholders counting up from 02:00:00:00:00:01. Broadcast, multicast, and all-zero addresses are kept. At the default level a preserved IPv6 link-local address may still embed a MAC address (EUI-64); the strict level anonymizes those addresses.
+
 Domains
 All domain names (except for the netbird domains) are replaced with randomly generated strings ending in ".domain". Anonymized domains are consistent across all files in the bundle.
 Reoccuring domain names are replaced with the same anonymized domain.
+At the strict level, the peer name labels in front of netbird domains are anonymized as well.
 
 Sync Response
 The network_map.json file contains the following anonymized information:
@@ -225,6 +238,13 @@ scutil_dns.txt (macOS only):
 - Shows DNS configuration for all network interfaces
 - Includes search domains, nameservers, and DNS resolver settings
 - All IP addresses and domain names are anonymized
+
+dns_windows.txt (Windows only):
+- Lists the NRPT rules of both policy stores, the local one and the group policy one, marking the rules the client created
+- Follows them with the policy table the resolver has loaded, which differs from the rules while a change has not been picked up yet
+- Includes the DNS client group policy, the global TCP/IP and Dnscache parameters, and the DNS values of every interface that has any
+- Ends with the resolver configuration in effect per adapter, from GetAdaptersAddresses
+- All IP addresses and domain names are anonymized
 `
 
 const (
@@ -232,6 +252,12 @@ const (
 	errorLogFile  = "netbird.err"
 	stdoutLogFile = "netbird.out"
 
+	// Rotated-log glob prefixes (base log name without extension) passed to
+	// addRotatedLogFiles. The daemon's own log and the GUI log live in the same
+	// dir, so the prefixes must be disjoint to keep their rotated siblings apart.
+	clientLogPrefix = "client"
+	uiLogPrefix     = "gui-client"
+
 	darwinErrorLogPath  = "/var/log/netbird.out.log"
 	darwinStdoutLogPath = "/var/log/netbird.err.log"
 )
@@ -241,6 +267,20 @@ type MetricsExporter interface {
 	Export(w io.Writer) error
 }
 
+// LogOpener opens a log file for inclusion in the bundle. It exists so that log
+// files whose path was supplied by an IPC caller can be opened under a check
+// the daemon defines, instead of being opened with the daemon's privileges
+// unconditionally.
+type LogOpener func(path string) (*os.File, error)
+
+func openLogFile(path string) (*os.File, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("open %s: %w", path, err)
+	}
+	return f, nil
+}
+
 type BundleGenerator struct {
 	anonymizer *anonymize.Anonymizer
 
@@ -249,6 +289,8 @@ type BundleGenerator struct {
 	statusRecorder *peer.Status
 	syncResponse   *mgmProto.SyncResponse
 	logPath        string
+	uiLogPath      string
+	uiLogOpener    LogOpener
 	tempDir        string
 	statePath      string
 	cpuProfile     []byte
@@ -259,6 +301,7 @@ type BundleGenerator struct {
 	cliVersion     string
 
 	anonymize         bool
+	anonymizeLevel    anonymize.Level
 	includeSystemInfo bool
 	logFileCount      uint32
 
@@ -266,7 +309,10 @@ type BundleGenerator struct {
 }
 
 type BundleConfig struct {
-	Anonymize         bool
+	Anonymize bool
+	// AnonymizeLevel selects how much the anonymizer redacts.
+	// anonymize.LevelStrict implies Anonymize.
+	AnonymizeLevel    anonymize.Level
 	IncludeSystemInfo bool
 	LogFileCount      uint32
 }
@@ -276,14 +322,21 @@ type GeneratorDependencies struct {
 	StatusRecorder *peer.Status
 	SyncResponse   *mgmProto.SyncResponse
 	LogPath        string
-	TempDir        string // Directory for temporary bundle zip files. If empty, os.TempDir() is used.
-	StatePath      string // Path to the state file. If empty, the ServiceManager default path is used.
-	CPUProfile     []byte
-	CapturePath    string
-	RefreshStatus  func()
-	ClientMetrics  MetricsExporter
-	DaemonVersion  string
-	CliVersion     string
+	UILogPath      string // Absolute path to the desktop UI's gui-client.log, reported via RegisterUILog. Empty if no UI registered one.
+	// UILogOpener opens the UI log and its rotated siblings. The path comes from
+	// a local IPC caller, so the daemon must not open it with plain os.Open: the
+	// opener is where the caller's right to that file is enforced. Defaults to
+	// os.Open, which is only correct where the path is not caller-supplied
+	// (mobile).
+	UILogOpener   LogOpener
+	TempDir       string // Directory for temporary bundle zip files. If empty, os.TempDir() is used.
+	StatePath     string // Path to the state file. If empty, the ServiceManager default path is used.
+	CPUProfile    []byte
+	CapturePath   string
+	RefreshStatus func()
+	ClientMetrics MetricsExporter
+	DaemonVersion string
+	CliVersion    string
 }
 
 func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGenerator {
@@ -293,13 +346,23 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		logFileCount = 1
 	}
 
+	uiLogOpener := deps.UILogOpener
+	if uiLogOpener == nil {
+		uiLogOpener = openLogFile
+	}
+
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+	anonymizer.SetLevel(cfg.AnonymizeLevel)
+
 	return &BundleGenerator{
-		anonymizer: anonymize.NewAnonymizer(anonymize.DefaultAddresses()),
+		anonymizer: anonymizer,
 
 		internalConfig: deps.InternalConfig,
 		statusRecorder: deps.StatusRecorder,
 		syncResponse:   deps.SyncResponse,
 		logPath:        deps.LogPath,
+		uiLogPath:      deps.UILogPath,
+		uiLogOpener:    uiLogOpener,
 		tempDir:        deps.TempDir,
 		statePath:      deps.StatePath,
 		cpuProfile:     deps.CPUProfile,
@@ -309,15 +372,45 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		daemonVersion:  deps.DaemonVersion,
 		cliVersion:     deps.CliVersion,
 
-		anonymize:         cfg.Anonymize,
+		anonymize:         cfg.Anonymize || cfg.AnonymizeLevel >= anonymize.LevelStrict,
+		anonymizeLevel:    cfg.AnonymizeLevel,
 		includeSystemInfo: cfg.IncludeSystemInfo,
 		logFileCount:      logFileCount,
 	}
 }
 
+// bundleFilePattern names the bundle zips Generate creates in tempDir; the
+// asterisk is filled in by os.CreateTemp.
+const bundleFilePattern = "netbird.debug.*.zip"
+
+const exportedBundlePrefix = "netbird.debug-file."
+
+const exportedBundleMaxAge = 24 * time.Hour
+
+// RemoveStaleBundles deletes bundle zips that an interrupted generation or
+// upload left behind in dir. Only files older than maxAge go, so a bundle that
+// another caller is still writing or uploading in the same directory survives.
+// Exported bundles are kept for exportedBundleMaxAge instead.
+func RemoveStaleBundles(dir string, maxAge time.Duration) {
+	removeStaleFiles(dir, bundleFilePattern, maxAge)
+	removeStaleFiles(dir, exportedBundlePrefix+"*.zip", exportedBundleMaxAge)
+}
+
+// ExportBundle renames a generated bundle out of the RemoveStaleBundles pattern
+// and returns the new path. The caller owns the file from then on; an export
+// abandoned for longer than exportedBundleMaxAge is removed by RemoveStaleBundles.
+func ExportBundle(path string) (string, error) {
+	base := strings.TrimPrefix(filepath.Base(path), strings.SplitN(bundleFilePattern, "*", 2)[0])
+	exported := filepath.Join(filepath.Dir(path), exportedBundlePrefix+base)
+	if err := os.Rename(path, exported); err != nil {
+		return "", fmt.Errorf("export debug bundle: %w", err)
+	}
+	return exported, nil
+}
+
 // Generate creates a debug bundle and returns the location.
 func (g *BundleGenerator) Generate() (resp string, err error) {
-	bundlePath, err := os.CreateTemp(g.tempDir, "netbird.debug.*.zip")
+	bundlePath, err := os.CreateTemp(g.tempDir, bundleFilePattern)
 	if err != nil {
 		return "", fmt.Errorf("create zip file: %w", err)
 	}
@@ -411,6 +504,10 @@ func (g *BundleGenerator) createArchive() error {
 		log.Errorf("failed to add logs to debug bundle: %v", err)
 	}
 
+	if err := g.addUILog(); err != nil {
+		log.Errorf("failed to add UI log to debug bundle: %v", err)
+	}
+
 	if err := g.addUpdateLogs(); err != nil {
 		log.Errorf("failed to add updater logs: %v", err)
 	}
@@ -445,7 +542,13 @@ func (g *BundleGenerator) addSystemInfo() {
 }
 
 func (g *BundleGenerator) addReadme() error {
-	readmeReader := strings.NewReader(readmeContent)
+	level := "none (anonymization disabled)"
+	if g.anonymize {
+		level = g.anonymizeLevel.String()
+	}
+	header := fmt.Sprintf("Netbird debug bundle\nAnonymization level applied to this bundle: %s\n", level)
+
+	readmeReader := strings.NewReader(header + readmeContent)
 	if err := g.addFileToZip(readmeReader, "README.txt"); err != nil {
 		return fmt.Errorf("add README file to zip: %w", err)
 	}
@@ -466,11 +569,11 @@ func (g *BundleGenerator) addStatus() error {
 
 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
-		protoFullStatus.Events = g.statusRecorder.GetEventHistory()
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
-			Anonymize:     g.anonymize,
-			ProfileName:   profName,
-			DaemonVersion: g.daemonVersion,
+			Anonymize:      g.anonymize,
+			AnonymizeLevel: g.anonymizeLevel,
+			ProfileName:    profName,
+			DaemonVersion:  g.daemonVersion,
 		})
 		overview.CliVersion = g.cliVersion
 		statusOutput := overview.FullDetailSummary()
@@ -544,7 +647,7 @@ const (
 	jsonKeyServiceEnv    = "service_env_vars"
 )
 
-var sensitiveEnvSubstrings = []string{"key", "token", "secret", "password", "credential"}
+var sensitiveEnvSubstrings = []string{"key", "token", "secret", "password", "credential", "pin", "pkcs11"}
 
 // addServiceParams reads the service.json file and adds a sanitized version to the bundle.
 // Non-NB_ env vars and vars with sensitive names are masked. Other NB_ values are anonymized.
@@ -623,7 +726,7 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	configContent.WriteString("NetBird Client Configuration:\n\n")
 
 	if key, err := wgtypes.ParseKey(g.internalConfig.PrivateKey); err == nil {
-		configContent.WriteString(fmt.Sprintf("PublicKey: %s\n", key.PublicKey().String()))
+		configContent.WriteString(fmt.Sprintf("PublicKey: %s\n", g.anonymizer.AnonymizeWGKey(key.PublicKey().String())))
 	}
 	configContent.WriteString(fmt.Sprintf("WgIface: %s\n", g.internalConfig.WgIface))
 	configContent.WriteString(fmt.Sprintf("WgPort: %d\n", g.internalConfig.WgPort))
@@ -637,6 +740,9 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	if g.internalConfig.ServerSSHAllowed != nil {
 		configContent.WriteString(fmt.Sprintf("ServerSSHAllowed: %v\n", *g.internalConfig.ServerSSHAllowed))
 	}
+	if g.internalConfig.RemoteJobsAllowed != nil {
+		configContent.WriteString(fmt.Sprintf("RemoteJobsAllowed: %v\n", *g.internalConfig.RemoteJobsAllowed))
+	}
 	if g.internalConfig.EnableSSHRoot != nil {
 		configContent.WriteString(fmt.Sprintf("EnableSSHRoot: %v\n", *g.internalConfig.EnableSSHRoot))
 	}
@@ -663,6 +769,9 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	configContent.WriteString(fmt.Sprintf("BlockLANAccess: %v\n", g.internalConfig.BlockLANAccess))
 	configContent.WriteString(fmt.Sprintf("BlockInbound: %v\n", g.internalConfig.BlockInbound))
 	configContent.WriteString(fmt.Sprintf("DisableIPv6: %v\n", g.internalConfig.DisableIPv6))
+	configContent.WriteString(fmt.Sprintf("LocalMetricsEnabled: %v\n", g.internalConfig.LocalMetricsEnabled))
+	configContent.WriteString(fmt.Sprintf("LocalMetricsAddress: %s\n", g.internalConfig.LocalMetricsAddress))
+	configContent.WriteString(fmt.Sprintf("SyncMessageVersion: %v\n", g.internalConfig.SyncMessageVersion))
 
 	if g.internalConfig.DisableNotifications != nil {
 		configContent.WriteString(fmt.Sprintf("DisableNotifications: %v\n", *g.internalConfig.DisableNotifications))
@@ -912,6 +1021,11 @@ func (g *BundleGenerator) addUpdateLogs() error {
 		}
 
 		baseName := filepath.Base(logFile)
+		data, err = g.anonymizeBytes(data)
+		if err != nil {
+			log.Warnf("skipping update log file %s: %v", baseName, err)
+			continue
+		}
 		if err := g.addFileToZip(bytes.NewReader(data), filepath.Join("update-logs", baseName)); err != nil {
 			return fmt.Errorf("add update log file %s to zip: %w", baseName, err)
 		}
@@ -939,6 +1053,13 @@ func (g *BundleGenerator) addCorruptedStateFiles() error {
 		}
 
 		fileName := filepath.Base(match)
+		// Corrupted state files usually fail structured JSON anonymization,
+		// so run them through the string anonymizer instead.
+		data, err = g.anonymizeBytes(data)
+		if err != nil {
+			log.Warnf("skipping corrupted state file %s: %v", fileName, err)
+			continue
+		}
 		if err := g.addFileToZip(bytes.NewReader(data), "corrupted_states/"+fileName); err != nil {
 			log.Warnf("Failed to add corrupted state file %s to zip: %v", fileName, err)
 			continue
@@ -950,6 +1071,27 @@ func (g *BundleGenerator) addCorruptedStateFiles() error {
 	return nil
 }
 
+// anonymizeBytes runs raw file content through the string anonymizer line by
+// line when anonymization is enabled. It errors instead of returning partial
+// content, so a caller never adds an unanonymized fallback to the bundle.
+func (g *BundleGenerator) anonymizeBytes(data []byte) ([]byte, error) {
+	if !g.anonymize {
+		return data, nil
+	}
+
+	var buf bytes.Buffer
+	scanner := bufio.NewScanner(bytes.NewReader(data))
+	scanner.Buffer(make([]byte, 1024*1024), 1024*1024)
+	for scanner.Scan() {
+		buf.WriteString(g.anonymizer.AnonymizeString(scanner.Text()))
+		buf.WriteByte('\n')
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("anonymize content: %w", err)
+	}
+	return buf.Bytes(), nil
+}
+
 func (g *BundleGenerator) addMetrics() error {
 	if g.clientMetrics == nil {
 		log.Debugf("skipping metrics in debug bundle: no metrics collector")
@@ -982,11 +1124,11 @@ func (g *BundleGenerator) addLogfile() error {
 
 	logDir := filepath.Dir(g.logPath)
 
-	if err := g.addSingleLogfile(g.logPath, clientLogFile); err != nil {
+	if err := g.addSingleLogfile(openLogFile, g.logPath, clientLogFile); err != nil {
 		return fmt.Errorf("add client log file to zip: %w", err)
 	}
 
-	g.addRotatedLogFiles(logDir)
+	g.addRotatedLogFiles(openLogFile, logDir, clientLogPrefix)
 
 	stdErrLogPath := filepath.Join(logDir, errorLogFile)
 	stdoutLogPath := filepath.Join(logDir, stdoutLogFile)
@@ -995,20 +1137,39 @@ func (g *BundleGenerator) addLogfile() error {
 		stdoutLogPath = darwinStdoutLogPath
 	}
 
-	if err := g.addSingleLogfile(stdErrLogPath, errorLogFile); err != nil {
+	if err := g.addSingleLogfile(openLogFile, stdErrLogPath, errorLogFile); err != nil {
 		log.Warnf("Failed to add %s to zip: %v", errorLogFile, err)
 	}
 
-	if err := g.addSingleLogfile(stdoutLogPath, stdoutLogFile); err != nil {
+	if err := g.addSingleLogfile(openLogFile, stdoutLogPath, stdoutLogFile); err != nil {
 		log.Warnf("Failed to add %s to zip: %v", stdoutLogFile, err)
 	}
 
 	return nil
 }
 
+// addUILog adds the desktop UI's gui-client.log (and its rotated siblings) to
+// the bundle. The path is reported by the UI via RegisterUILog; empty when no
+// UI registered one (e.g. headless / server). Missing file is non-fatal — the
+// UI only writes it while the daemon is in debug, so it's often absent.
+func (g *BundleGenerator) addUILog() error {
+	if g.uiLogPath == "" {
+		log.Debugf("no UI log path registered, skipping in debug bundle")
+		return nil
+	}
+
+	if err := g.addSingleLogfile(g.uiLogOpener, g.uiLogPath, configs.UILogFile); err != nil {
+		return fmt.Errorf("add UI log file to zip: %w", err)
+	}
+
+	g.addRotatedLogFiles(g.uiLogOpener, filepath.Dir(g.uiLogPath), uiLogPrefix)
+
+	return nil
+}
+
 // addSingleLogfile adds a single log file to the archive
-func (g *BundleGenerator) addSingleLogfile(logPath, targetName string) error {
-	logFile, err := os.Open(logPath)
+func (g *BundleGenerator) addSingleLogfile(open LogOpener, logPath, targetName string) error {
+	logFile, err := open(logPath)
 	if err != nil {
 		return fmt.Errorf("open log file %s: %w", targetName, err)
 	}
@@ -1033,8 +1194,8 @@ func (g *BundleGenerator) addSingleLogfile(logPath, targetName string) error {
 }
 
 // addSingleLogFileGz adds a single gzipped log file to the archive
-func (g *BundleGenerator) addSingleLogFileGz(logPath, targetName string) error {
-	f, err := os.Open(logPath)
+func (g *BundleGenerator) addSingleLogFileGz(open LogOpener, logPath, targetName string) error {
+	f, err := open(logPath)
 	if err != nil {
 		return fmt.Errorf("open gz log file %s: %w", targetName, err)
 	}
@@ -1078,14 +1239,16 @@ func (g *BundleGenerator) addSingleLogFileGz(logPath, targetName string) error {
 	return nil
 }
 
-// addRotatedLogFiles adds rotated log files to the bundle based on logFileCount
-func (g *BundleGenerator) addRotatedLogFiles(logDir string) {
+// addRotatedLogFiles adds rotated log files to the bundle based on logFileCount.
+// prefix is the base log name without extension (e.g. "client", "gui-client");
+// the glob matches both files rotated by us and by logrotate on linux.
+func (g *BundleGenerator) addRotatedLogFiles(open LogOpener, logDir, prefix string) {
 	if g.logFileCount == 0 {
 		return
 	}
 
-	// This regex will match both logs rotated by us and logrotate on linux
-	pattern := filepath.Join(logDir, "client*.log.*")
+	// This pattern matches both logs rotated by us and logrotate on linux
+	pattern := filepath.Join(logDir, prefix+"*.log.*")
 	files, err := filepath.Glob(pattern)
 	if err != nil {
 		log.Warnf("failed to glob rotated logs: %v", err)
@@ -1119,9 +1282,9 @@ func (g *BundleGenerator) addRotatedLogFiles(logDir string) {
 	for i := 0; i < maxFiles; i++ {
 		name := filepath.Base(files[i])
 		if strings.HasSuffix(name, ".gz") {
-			err = g.addSingleLogFileGz(files[i], name)
+			err = g.addSingleLogFileGz(open, files[i], name)
 		} else {
-			err = g.addSingleLogfile(files[i], name)
+			err = g.addSingleLogfile(open, files[i], name)
 		}
 		if err != nil {
 			log.Warnf("failed to add rotated log %s: %v", name, err)
@@ -1401,6 +1564,7 @@ func anonymizeRemotePeer(peer *mgmProto.RemotePeerConfig, anonymizer *anonymize.
 	}
 
 	peer.Fqdn = anonymizer.AnonymizeDomain(peer.Fqdn)
+	peer.WgPubKey = anonymizer.AnonymizeWGKey(peer.WgPubKey)
 
 	anonymizeSSHConfig(peer.SshConfig)
 }
@@ -1590,3 +1754,26 @@ func anonymizeSlice(v []any, anonymizer *anonymize.Anonymizer) []any {
 	}
 	return v
 }
+
+func removeStaleFiles(dir, pattern string, maxAge time.Duration) {
+	matches, err := filepath.Glob(filepath.Join(dir, pattern))
+	if err != nil {
+		log.Debugf("glob stale debug bundles in %s: %v", dir, err)
+		return
+	}
+
+	cutoff := time.Now().Add(-maxAge)
+	for _, path := range matches {
+		info, err := os.Stat(path)
+		if err != nil || info.ModTime().After(cutoff) {
+			continue
+		}
+		if err := os.Remove(path); err != nil {
+			if !errors.Is(err, fs.ErrNotExist) {
+				log.Warnf("remove stale debug bundle %s: %v", path, err)
+			}
+			continue
+		}
+		log.Infof("removed stale debug bundle %s", path)
+	}
+}
diff --git a/client/internal/debug/debug_ios.go b/client/internal/debug/debug_ios.go
index a07c23dbd..001d64241 100644
--- a/client/internal/debug/debug_ios.go
+++ b/client/internal/debug/debug_ios.go
@@ -27,7 +27,7 @@ func (g *BundleGenerator) addPlatformLog() error {
 	}
 
 	swiftLogPath := filepath.Join(filepath.Dir(g.logPath), swiftLogFile)
-	if err := g.addSingleLogfile(swiftLogPath, swiftLogFile); err != nil {
+	if err := g.addSingleLogfile(openLogFile, swiftLogPath, swiftLogFile); err != nil {
 		// The Swift log is best-effort: the app may not have written it yet.
 		log.Warnf("failed to add %s to debug bundle: %v", swiftLogFile, err)
 	}
diff --git a/client/internal/debug/debug_linux.go b/client/internal/debug/debug_linux.go
index 40d864eda..a36c0c0e7 100644
--- a/client/internal/debug/debug_linux.go
+++ b/client/internal/debug/debug_linux.go
@@ -844,6 +844,10 @@ func collectSysctls() string {
 		[]string{"net.ipv4.conf.all.src_valid_mark", "net.ipv4.conf.default.src_valid_mark"},
 		listInterfaceSysctls("ipv4", "src_valid_mark")...,
 	))
+	writeSysctlGroup(&builder, "accept_ra", append(
+		[]string{"net.ipv6.conf.all.accept_ra", "net.ipv6.conf.default.accept_ra"},
+		listInterfaceSysctls("ipv6", "accept_ra")...,
+	))
 	writeSysctlGroup(&builder, "conntrack", []string{
 		"net.netfilter.nf_conntrack_acct",
 		"net.netfilter.nf_conntrack_tcp_loose",
diff --git a/client/internal/debug/debug_logfiles_test.go b/client/internal/debug/debug_logfiles_test.go
index f6473f979..31420711f 100644
--- a/client/internal/debug/debug_logfiles_test.go
+++ b/client/internal/debug/debug_logfiles_test.go
@@ -40,6 +40,25 @@ func TestAddRotatedLogFiles_PicksUpAllVariants(t *testing.T) {
 	require.NotContains(t, names, "other.log", "unrelated files should not be in bundle")
 }
 
+// TestAddRotatedLogFiles_GUIPrefix asserts the prefix parameter scopes the glob
+// to the GUI log: gui-client.log.* rotated siblings are picked up and the
+// daemon's own client.log.* are not (and vice versa, covered above). This is
+// the load-bearing check for the gui-client.log bundle collection — the old
+// "client*.log.*" glob would have missed gui-client rotations.
+func TestAddRotatedLogFiles_GUIPrefix(t *testing.T) {
+	dir := t.TempDir()
+
+	writeFile(t, filepath.Join(dir, "gui-client.log.1"), "gui rotated\n")
+	writeGzFile(t, filepath.Join(dir, "gui-client.log.2.gz"), "gui rotated gz\n")
+	writeFile(t, filepath.Join(dir, "client.log.1"), "daemon rotated\n")
+
+	names := runAddRotatedLogFilesPrefix(t, dir, "gui-client", 10)
+
+	require.Contains(t, names, "gui-client.log.1", "gui-client rotated file should be in bundle")
+	require.Contains(t, names, "gui-client.log.2.gz", "gui-client gz rotated file should be in bundle")
+	require.NotContains(t, names, "client.log.1", "daemon rotated file must not match the gui-client prefix")
+}
+
 // TestAddRotatedLogFiles_RespectsLogFileCount asserts that only the newest
 // logFileCount rotated files are bundled, ordered by mtime.
 func TestAddRotatedLogFiles_RespectsLogFileCount(t *testing.T) {
@@ -67,6 +86,10 @@ func TestAddRotatedLogFiles_RespectsLogFileCount(t *testing.T) {
 // runAddRotatedLogFiles calls addRotatedLogFiles against a fresh in-memory
 // zip writer and returns the set of entry names that ended up in the archive.
 func runAddRotatedLogFiles(t *testing.T, dir string, logFileCount uint32) map[string]struct{} {
+	return runAddRotatedLogFilesPrefix(t, dir, "client", logFileCount)
+}
+
+func runAddRotatedLogFilesPrefix(t *testing.T, dir, prefix string, logFileCount uint32) map[string]struct{} {
 	t.Helper()
 
 	var buf bytes.Buffer
@@ -74,7 +97,7 @@ func runAddRotatedLogFiles(t *testing.T, dir string, logFileCount uint32) map[st
 		archive:      zip.NewWriter(&buf),
 		logFileCount: logFileCount,
 	}
-	g.addRotatedLogFiles(dir)
+	g.addRotatedLogFiles(openLogFile, dir, prefix)
 	require.NoError(t, g.archive.Close())
 
 	zr, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))
diff --git a/client/internal/debug/debug_nonunix.go b/client/internal/debug/debug_nonunix.go
index 18d017050..adc9b9649 100644
--- a/client/internal/debug/debug_nonunix.go
+++ b/client/internal/debug/debug_nonunix.go
@@ -1,4 +1,4 @@
-//go:build !unix
+//go:build !unix && !windows
 
 package debug
 
diff --git a/client/internal/debug/debug_test.go b/client/internal/debug/debug_test.go
index 8286f6852..a9cda5a46 100644
--- a/client/internal/debug/debug_test.go
+++ b/client/internal/debug/debug_test.go
@@ -4,6 +4,7 @@ import (
 	"archive/zip"
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"net"
 	"net/netip"
 	"net/url"
@@ -457,6 +458,9 @@ func TestIsSensitiveEnvVar(t *testing.T) {
 		{"NB_CLIENT_SECRET", true},
 		{"NB_PASSWORD", true},
 		{"NB_CREDENTIAL", true},
+		// The token PIN, and the token URI, which may carry the PIN as pin-value.
+		{"NB_TPM_PIN", true},
+		{"NB_CERT_PKCS11_URI", true},
 		{"NB_LOG_LEVEL", false},
 		{"NB_MANAGEMENT_URL", false},
 		{"NB_HOSTNAME", false},
@@ -839,12 +843,16 @@ COMMIT`
 // the excluded set with a justification.
 func TestAddConfig_AllFieldsCovered(t *testing.T) {
 	excluded := map[string]string{
-		"PrivateKey":        "sensitive: WireGuard private key",
-		"PreSharedKey":      "sensitive: WireGuard pre-shared key",
-		"SSHKey":            "sensitive: SSH private key",
-		"ClientCertKeyPair": "non-config: parsed cert pair, not serialized",
-		"Name":              "non-config: profile name is not needed for debug purposes",
-		"policy":            "non-config: in-memory MDM policy snapshot, surfaced via Config.Policy() / GetConfigResponse.MDMManagedFields",
+		"PrivateKey":           "sensitive: WireGuard private key",
+		"PreSharedKey":         "sensitive: WireGuard pre-shared key",
+		"SSHKey":               "sensitive: SSH private key",
+		"ClientCertKeyPair":    "non-config: parsed cert pair, not serialized",
+		"Name":                 "non-config: profile name is not needed for debug purposes",
+		"policy":               "non-config: in-memory MDM policy snapshot, surfaced via Config.Policy() / GetConfigResponse.MDMManagedFields",
+		"probing":              "non-config: marks a throwaway copy built to be diffed against; never set on a config anyone runs with",
+		"DebugBundleUploadURL": "sensitive: MDM-provided upload URL may carry credentials or query tokens; kept out of the shared bundle",
+		"CertPKCS11URI":        "deprecated and ignored; sensitive: the URI may carry the token PIN as pin-value",
+		"CertStoreDir":         "deprecated and ignored: the directory comes from NB_CERT_STORE_DIR",
 	}
 
 	mURL, _ := url.Parse("https://api.example.com:443")
@@ -864,6 +872,7 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		RosenpassEnabled:              true,
 		RosenpassPermissive:           true,
 		ServerSSHAllowed:              &bTrue,
+		RemoteJobsAllowed:             &bTrue,
 		EnableSSHRoot:                 &bTrue,
 		EnableSSHSFTP:                 &bTrue,
 		EnableSSHLocalPortForwarding:  &bTrue,
@@ -886,7 +895,11 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		ClientCertPath:                "/tmp/cert",
 		ClientCertKeyPath:             "/tmp/key",
 		LazyConnection:                "on",
+		DebugBundleUploadURL:          "https://upload.example.test/bundle?token=secret",
+		CertPKCS11URI:                 "pkcs11:token=netbird?pin-value=pin-secret",
 		MTU:                           1280,
+		DisableIPv6:                   true,
+		SyncMessageVersion:            func(v int) *int { return &v }(1),
 	}
 
 	for _, anonymize := range []bool{false, true} {
@@ -901,6 +914,17 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 			g.addCommonConfigFields(&sb)
 			rendered := sb.String() + renderAddConfigSpecific(g)
 
+			// DebugBundleUploadURL is an MDM-provided value that can carry
+			// credentials or signed query tokens. It is deliberately excluded
+			// above; assert it never reaches the rendered bundle — neither the
+			// field name nor the token — in either anonymize mode.
+			assert.NotContains(t, rendered, "DebugBundleUploadURL:", "MDM upload URL field must not be serialized into the debug bundle")
+			assert.NotContains(t, rendered, "token=secret", "MDM upload URL value must not leak into the debug bundle")
+
+			// A leftover CertPKCS11URI may carry the token PIN as pin-value.
+			assert.NotContains(t, rendered, "CertPKCS11URI", "PKCS#11 URI field must not be serialized into the debug bundle")
+			assert.NotContains(t, rendered, "pin-secret", "PKCS#11 PIN must not leak into the debug bundle")
+
 			val := reflect.ValueOf(cfg).Elem()
 			typ := val.Type()
 			var missing []string
@@ -957,3 +981,52 @@ func renderAddConfigSpecific(g *BundleGenerator) string {
 func newAnonymizerForTest() *anonymize.Anonymizer {
 	return anonymize.NewAnonymizer(anonymize.DefaultAddresses())
 }
+
+func TestRemoveStaleBundles(t *testing.T) {
+	dir := t.TempDir()
+	stale := filepath.Join(dir, "netbird.debug.111.zip")
+	fresh := filepath.Join(dir, "netbird.debug.222.zip")
+	other := filepath.Join(dir, "netbird.debug.333.txt")
+	owned := filepath.Join(dir, "netbird.debug.444.zip")
+	abandoned := filepath.Join(dir, "netbird.debug.555.zip")
+	for _, p := range []string{stale, fresh, other, owned, abandoned} {
+		require.NoError(t, os.WriteFile(p, []byte("x"), 0o600))
+	}
+	exported, err := ExportBundle(owned)
+	require.NoError(t, err)
+	exportedAbandoned, err := ExportBundle(abandoned)
+	require.NoError(t, err)
+	old := time.Now().Add(-2 * time.Hour)
+	for _, p := range []string{stale, other, exported} {
+		require.NoError(t, os.Chtimes(p, old, old))
+	}
+	ancient := time.Now().Add(-exportedBundleMaxAge - time.Hour)
+	require.NoError(t, os.Chtimes(exportedAbandoned, ancient, ancient))
+
+	RemoveStaleBundles(dir, time.Hour)
+
+	assert.NoFileExists(t, stale, "bundle older than maxAge should be removed")
+	assert.FileExists(t, fresh, "bundle younger than maxAge must survive, it may still be uploading")
+	assert.FileExists(t, other, "files outside the bundle pattern must not be touched")
+	assert.NoFileExists(t, owned)
+	assert.FileExists(t, exported, "exported bundle is caller-owned and must survive maxAge")
+	assert.NoFileExists(t, exportedAbandoned, "exported bundle older than exportedBundleMaxAge is abandoned")
+}
+
+func TestBundleIncludesNetworkMap(t *testing.T) {
+	for _, anonymize := range []bool{false, true} {
+		t.Run(fmt.Sprintf("anonymize=%t", anonymize), func(t *testing.T) {
+			g := NewBundleGenerator(GeneratorDependencies{
+				SyncResponse: &mgmProto.SyncResponse{NetworkMap: &mgmProto.NetworkMap{Serial: 1}},
+			}, BundleConfig{Anonymize: anonymize})
+
+			require.Contains(t, bundleEntries(t, g), "network_map.json")
+		})
+	}
+}
+
+func TestBundleOmitsNetworkMapWithoutSyncResponse(t *testing.T) {
+	g := NewBundleGenerator(GeneratorDependencies{}, BundleConfig{})
+
+	require.NotContains(t, bundleEntries(t, g), "network_map.json")
+}
diff --git a/client/internal/debug/debug_windows.go b/client/internal/debug/debug_windows.go
new file mode 100644
index 000000000..e88940fd3
--- /dev/null
+++ b/client/internal/debug/debug_windows.go
@@ -0,0 +1,443 @@
+//go:build windows
+
+package debug
+
+import (
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"net/netip"
+	"strings"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+	"golang.org/x/sys/windows/registry"
+
+	nbdns "github.com/netbirdio/netbird/client/internal/dns"
+)
+
+const dnsInfoFileName = "dns_windows.txt"
+
+const (
+	gpoDNSClientRoot = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient`
+	tcpipParamsPath  = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters`
+	dnscacheParams   = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters`
+)
+
+// interfaceDNSValues are the per-interface values that decide how a name is
+// resolved and registered. Everything the DNS host manager writes is in here,
+// so a bundle shows both what we set and what it replaced.
+var interfaceDNSValues = []string{
+	"NameServer",
+	"DhcpNameServer",
+	"Domain",
+	"DhcpDomain",
+	"SearchList",
+	"RegistrationEnabled",
+	"DisableDynamicUpdate",
+	"MaxNumberOfAddressesToRegister",
+	"EnableDHCP",
+}
+
+// addDNSInfo collects and adds DNS configuration information to the archive
+func (g *BundleGenerator) addDNSInfo() error {
+	if err := g.addFileToZip(strings.NewReader(g.collectDNSInfo()), dnsInfoFileName); err != nil {
+		return fmt.Errorf("add DNS info to zip: %w", err)
+	}
+
+	return nil
+}
+
+// collectDNSInfo renders the report. Everything below it reaches the platform
+// through COM and through lazily resolved procedures, which panic when a
+// procedure is missing rather than returning an error, and a debug bundle is not
+// allowed to take the daemon down. The panic is contained here, and whatever was
+// collected before it is kept and reported with it.
+func (g *BundleGenerator) collectDNSInfo() (content string) {
+	var sb strings.Builder
+
+	defer func() {
+		if r := recover(); r != nil {
+			log.Errorf("collecting Windows DNS configuration panicked: %v", r)
+			fmt.Fprintf(&sb, "\nerror: collection stopped: %v\n", r)
+		}
+		content = sb.String()
+	}()
+
+	sb.WriteString("Windows DNS configuration\n")
+	sb.WriteString("=========================\n")
+
+	adapters, adaptersErr := adapterAddresses()
+
+	g.writeNRPTRules(&sb, "NRPT rules, local policy store", nbdns.DNSPolicyConfigRoot)
+	g.writeNRPTRules(&sb, "NRPT rules, group policy store", nbdns.GPODNSPolicyConfigRoot)
+	g.writeEffectiveNRPTPolicies(&sb)
+	g.writeRegistryKey(&sb, "DNS client group policy", gpoDNSClientRoot)
+	g.writeRegistryKey(&sb, "Global TCP/IP parameters", tcpipParamsPath)
+	g.writeRegistryKey(&sb, "Dnscache parameters", dnscacheParams)
+	g.writeInterfaceDNS(&sb, "Per-interface DNS, IPv4", nbdns.InterfaceConfigPath, adapterNames(adapters))
+	g.writeInterfaceDNS(&sb, "Per-interface DNS, IPv6", nbdns.InterfaceConfigPathV6, adapterNames(adapters))
+	g.writeAdapterDNS(&sb, adapters, adaptersErr)
+
+	return sb.String()
+}
+
+// writeNRPTRules lists every rule in a policy store, ours and any other
+// product's, since a foreign rule for the same namespace decides resolution
+// just as ours does. Rules the client wrote are marked.
+func (g *BundleGenerator) writeNRPTRules(sb *strings.Builder, title, root string) {
+	writeSection(sb, title, root)
+
+	names, err := subKeyNames(root)
+	if err != nil {
+		fmt.Fprintf(sb, "error: %v\n", err)
+		return
+	}
+
+	if len(names) == 0 {
+		sb.WriteString("no rules\n")
+		return
+	}
+
+	for _, name := range names {
+		owner := ""
+		if strings.HasPrefix(strings.ToLower(name), strings.ToLower(nbdns.NRPTKeyPrefix)) {
+			owner = "  (netbird)"
+		}
+		fmt.Fprintf(sb, "%s%s\n", name, owner)
+		g.writeValues(sb, root+`\`+name, nil, "  ")
+	}
+}
+
+// writeEffectiveNRPTPolicies reports the table the resolver answers from, which
+// the registry cannot show: a rule is written before it is loaded, and it keeps
+// being enforced after its key is gone until the resolver reloads its policy.
+func (g *BundleGenerator) writeEffectiveNRPTPolicies(sb *strings.Builder) {
+	writeSection(sb, "NRPT policy table in effect", nrptPolicyClass+"."+nrptPolicyMethod+" in "+nrptPolicyNamespace)
+
+	entries, err := effectiveNRPTPolicies()
+	if err != nil {
+		fmt.Fprintf(sb, "error: %v\n", err)
+		return
+	}
+
+	if len(entries) == 0 {
+		sb.WriteString("no policies\n")
+		return
+	}
+
+	for _, entry := range entries {
+		fmt.Fprintf(sb, "%s\n", g.anonymizeValue("Namespace", entry.namespace))
+		for _, value := range entry.values {
+			fmt.Fprintf(sb, "  %s: %s\n", value.name, g.anonymizeValue(value.name, value.value))
+		}
+	}
+}
+
+// writeInterfaceDNS reports the DNS values of every interface that has any, so
+// the netbird interface can be compared against the physical ones. The registry
+// keys the values by GUID, so each is named from the adapter list; a GUID with
+// no adapter is a leftover key of an interface that no longer exists.
+func (g *BundleGenerator) writeInterfaceDNS(sb *strings.Builder, title, root string, names map[string]string) {
+	writeSection(sb, title, root)
+
+	guids, err := subKeyNames(root)
+	if err != nil {
+		fmt.Fprintf(sb, "error: %v\n", err)
+		return
+	}
+
+	var reported int
+	for _, guid := range guids {
+		var iface strings.Builder
+		g.writeValues(&iface, root+`\`+guid, interfaceDNSValues, "  ")
+		if iface.Len() == 0 {
+			continue
+		}
+
+		name, ok := names[strings.ToLower(guid)]
+		if !ok {
+			name = "no adapter with this GUID"
+		}
+
+		reported++
+		fmt.Fprintf(sb, "%s (%s)\n%s", guid, name, iface.String())
+	}
+
+	if reported == 0 {
+		sb.WriteString("no interface holds DNS values\n")
+	}
+}
+
+// writeRegistryKey reports the values of a single key, without its subkeys.
+func (g *BundleGenerator) writeRegistryKey(sb *strings.Builder, title, path string) {
+	writeSection(sb, title, path)
+
+	var values strings.Builder
+	g.writeValues(&values, path, nil, "")
+	if values.Len() == 0 {
+		sb.WriteString("no values\n")
+		return
+	}
+
+	sb.WriteString(values.String())
+}
+
+// writeValues renders the values of a key. A nil names list reports every
+// value, otherwise only those named and present.
+func (g *BundleGenerator) writeValues(sb *strings.Builder, path string, names []string, indent string) {
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.QUERY_VALUE)
+	switch {
+	case errors.Is(err, registry.ErrNotExist), errors.Is(err, windows.ERROR_PATH_NOT_FOUND):
+		// an absent key is the normal state for the GPO store and for
+		// interfaces without DNS settings
+		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", path)
+		return
+	case err != nil:
+		fmt.Fprintf(sb, "%serror: open HKEY_LOCAL_MACHINE\\%s: %v\n", indent, path, err)
+		return
+	}
+	defer closeKey(k)
+
+	if names == nil {
+		names, err = k.ReadValueNames(-1)
+		if err != nil {
+			fmt.Fprintf(sb, "%serror: read value names: %v\n", indent, err)
+			return
+		}
+	}
+
+	for _, name := range names {
+		value, err := readRegistryValue(k, name)
+		switch {
+		case errors.Is(err, registry.ErrNotExist):
+			// the caller asks for a fixed set of values, most of which a
+			// given interface does not carry
+			continue
+		case err != nil:
+			// report rather than omit: a value that is there but cannot be
+			// read reads as unset otherwise
+			fmt.Fprintf(sb, "%s%s: error: %v\n", indent, name, err)
+			continue
+		}
+
+		fmt.Fprintf(sb, "%s%s: %s\n", indent, name, g.anonymizeValue(name, value))
+	}
+}
+
+// anonymizeValue redacts a registry value according to what its name says it
+// holds. Domains and addresses are handled per entry rather than by the string
+// pass: the pass only replaces domains something else in the bundle already
+// seeded, and its address regex would eat the digit labels of a reverse zone.
+func (g *BundleGenerator) anonymizeValue(name, value string) string {
+	if !g.anonymize || value == "" {
+		return value
+	}
+
+	switch {
+	case holdsDomains(name):
+		return joinValueEntries(splitValueEntries(value), g.anonymizeDomain)
+	case holdsAddresses(name):
+		return joinValueEntries(splitValueEntries(value), g.anonymizer.AnonymizeIPString)
+	default:
+		return g.anonymizer.AnonymizeString(value)
+	}
+}
+
+// holdsDomains reports whether a value name holds domains: the domain list of
+// an NRPT rule (Name) or of the policy table (Namespace), a search list, the
+// DNS suffix values of the TCP/IP and policy keys, which all end in "Domain"
+// (Domain, DhcpDomain, NV Domain, ICSDomain), and a proxy host name.
+func holdsDomains(name string) bool {
+	lower := strings.ToLower(name)
+	return lower == "name" || lower == "namespace" || lower == "searchlist" ||
+		strings.HasSuffix(lower, "domain") || strings.HasSuffix(lower, "proxyname")
+}
+
+// holdsAddresses reports whether a value name holds DNS server addresses
+// (NameServer, DhcpNameServer, GenericDNSServers, NameServers).
+func holdsAddresses(name string) bool {
+	lower := strings.ToLower(name)
+	return strings.Contains(lower, "nameserver") || strings.Contains(lower, "dnsserver")
+}
+
+// adapterNames maps adapter GUIDs, as the registry keys the interfaces, to the
+// names an operator sees.
+func adapterNames(adapters []*windows.IpAdapterAddresses) map[string]string {
+	names := make(map[string]string, len(adapters))
+	for _, adapter := range adapters {
+		guid := windows.BytePtrToString(adapter.AdapterName)
+		names[strings.ToLower(guid)] = windows.UTF16PtrToString(adapter.FriendlyName)
+	}
+	return names
+}
+
+// writeAdapterDNS reports the resolver configuration in effect per adapter,
+// which is what the resolver uses for a name no NRPT rule matches.
+func (g *BundleGenerator) writeAdapterDNS(sb *strings.Builder, adapters []*windows.IpAdapterAddresses, err error) {
+	writeSection(sb, "Adapter DNS configuration", "GetAdaptersAddresses")
+
+	if err != nil {
+		fmt.Fprintf(sb, "error: %v\n", err)
+		return
+	}
+
+	for _, adapter := range adapters {
+		name := windows.UTF16PtrToString(adapter.FriendlyName)
+		suffix := g.anonymizeDomain(windows.UTF16PtrToString(adapter.DnsSuffix))
+
+		fmt.Fprintf(sb, "%s (index %d, oper status %d)\n", name, adapter.IfIndex, adapter.OperStatus)
+		fmt.Fprintf(sb, "  DNS suffix: %s\n", suffix)
+
+		var servers []string
+		for server := adapter.FirstDnsServerAddress; server != nil; server = server.Next {
+			addr, ok := netip.AddrFromSlice(server.Address.IP())
+			if !ok {
+				continue
+			}
+
+			addr = addr.Unmap()
+			if g.anonymize {
+				addr = g.anonymizer.AnonymizeIP(addr)
+			}
+			servers = append(servers, addr.String())
+		}
+
+		fmt.Fprintf(sb, "  DNS servers: %s\n", strings.Join(servers, ", "))
+	}
+}
+
+// anonymizeDomain anonymizes a single domain, keeping the leading dot an NRPT
+// match domain carries.
+func (g *BundleGenerator) anonymizeDomain(entry string) string {
+	if !g.anonymize {
+		return entry
+	}
+
+	domain, dot := strings.CutPrefix(entry, ".")
+	if domain == "" {
+		return entry
+	}
+
+	anonymized := g.anonymizer.AnonymizeDomain(domain)
+	if dot {
+		anonymized = "." + anonymized
+	}
+	return anonymized
+}
+
+// splitValueEntries splits a registry value that holds a list. The separator
+// differs per value: a REG_MULTI_SZ arrives joined with ", ", a SearchList is
+// comma separated and a NameServer may use commas or spaces.
+func splitValueEntries(value string) []string {
+	return strings.FieldsFunc(value, func(r rune) bool {
+		return r == ',' || r == ';' || r == ' ' || r == '\t'
+	})
+}
+
+func joinValueEntries(entries []string, anonymize func(string) string) string {
+	for i, entry := range entries {
+		entries[i] = anonymize(entry)
+	}
+	return strings.Join(entries, ", ")
+}
+
+func writeSection(sb *strings.Builder, title, source string) {
+	fmt.Fprintf(sb, "\n%s\n%s\n%s\n", title, strings.Repeat("-", len(title)), source)
+}
+
+func subKeyNames(root string) ([]string, error) {
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, root, registry.ENUMERATE_SUB_KEYS)
+	if err != nil {
+		return nil, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", root, err)
+	}
+	defer closeKey(k)
+
+	names, err := k.ReadSubKeyNames(-1)
+	if err != nil {
+		return nil, fmt.Errorf("read subkey names: %w", err)
+	}
+
+	return names, nil
+}
+
+// readRegistryValue renders a value as text regardless of its type, so an
+// unexpected type in a policy key still shows up instead of being dropped.
+func readRegistryValue(k registry.Key, name string) (string, error) {
+	_, valueType, err := k.GetValue(name, nil)
+	if err != nil {
+		return "", fmt.Errorf("get value %s: %w", name, err)
+	}
+
+	switch valueType {
+	case registry.SZ, registry.EXPAND_SZ:
+		value, _, err := k.GetStringValue(name)
+		if err != nil {
+			return "", fmt.Errorf("get string value %s: %w", name, err)
+		}
+		return value, nil
+	case registry.MULTI_SZ:
+		values, _, err := k.GetStringsValue(name)
+		if err != nil {
+			return "", fmt.Errorf("get strings value %s: %w", name, err)
+		}
+		return strings.Join(values, ", "), nil
+	case registry.DWORD, registry.QWORD:
+		value, _, err := k.GetIntegerValue(name)
+		if err != nil {
+			return "", fmt.Errorf("get integer value %s: %w", name, err)
+		}
+		return fmt.Sprintf("%d (0x%x)", value, value), nil
+	case registry.BINARY:
+		value, _, err := k.GetBinaryValue(name)
+		if err != nil {
+			return "", fmt.Errorf("get binary value %s: %w", name, err)
+		}
+		return hex.EncodeToString(value), nil
+	default:
+		return fmt.Sprintf("<unhandled registry type %d>", valueType), nil
+	}
+}
+
+// adapterAddresses returns the adapter list including DNS servers. The call
+// reports the size it needs, so grow the buffer and retry until it fits.
+func adapterAddresses() (adapters []*windows.IpAdapterAddresses, err error) {
+	// GetAdaptersAddresses is resolved on first use and panics when it is
+	// missing, so this reports it as an error and leaves the rest of the
+	// report intact.
+	defer func() {
+		if r := recover(); r != nil {
+			adapters, err = nil, fmt.Errorf("GetAdaptersAddresses: %v", r)
+		}
+	}()
+
+	const flags = windows.GAA_FLAG_SKIP_ANYCAST | windows.GAA_FLAG_SKIP_MULTICAST
+
+	size := uint32(15000)
+	for range 3 {
+		buf := make([]byte, size)
+		first := (*windows.IpAdapterAddresses)(unsafe.Pointer(&buf[0]))
+
+		err := windows.GetAdaptersAddresses(windows.AF_UNSPEC, flags, 0, first, &size)
+		if errors.Is(err, windows.ERROR_BUFFER_OVERFLOW) {
+			continue
+		}
+		if err != nil {
+			return nil, fmt.Errorf("GetAdaptersAddresses: %w", err)
+		}
+
+		for adapter := first; adapter != nil; adapter = adapter.Next {
+			adapters = append(adapters, adapter)
+		}
+		return adapters, nil
+	}
+
+	return nil, fmt.Errorf("GetAdaptersAddresses: buffer kept growing")
+}
+
+func closeKey(k registry.Key) {
+	if err := k.Close(); err != nil {
+		log.Debugf("close registry key: %v", err)
+	}
+}
diff --git a/client/internal/debug/debug_windows_test.go b/client/internal/debug/debug_windows_test.go
new file mode 100644
index 000000000..47df3f6f9
--- /dev/null
+++ b/client/internal/debug/debug_windows_test.go
@@ -0,0 +1,146 @@
+//go:build windows
+
+package debug
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/anonymize"
+)
+
+func newDNSValueGenerator(level anonymize.Level) *BundleGenerator {
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+	anonymizer.SetLevel(level)
+
+	return &BundleGenerator{
+		anonymize:      true,
+		anonymizeLevel: level,
+		anonymizer:     anonymizer,
+	}
+}
+
+// TestAnonymizeValueByName covers the value kinds of the DNS registry keys. The
+// names decide the treatment, because the string pass alone replaces only
+// domains another part of the bundle already seeded.
+func TestAnonymizeValueByName(t *testing.T) {
+	tests := []struct {
+		name      string
+		valueName string
+		value     string
+		assert    func(t *testing.T, got string)
+	}{
+		{
+			name:      "NRPT match domains keep the leading dot",
+			valueName: "Name",
+			value:     ".internal.example.com, .corp.example.org",
+			assert: func(t *testing.T, got string) {
+				t.Helper()
+				for _, entry := range strings.Split(got, ", ") {
+					assert.True(t, strings.HasPrefix(entry, "."), "entry %q should keep its leading dot", entry)
+					assert.NotContains(t, entry, "example", "entry %q should not keep the original domain", entry)
+				}
+			},
+		},
+		{
+			name:      "any value name ending in Domain is treated as a domain",
+			valueName: "ICSDomain",
+			value:     "mshome.net",
+			assert: func(t *testing.T, got string) {
+				t.Helper()
+				assert.NotContains(t, got, "mshome", "should anonymize a domain suffix value")
+			},
+		},
+		{
+			name:      "search list is a comma separated domain list",
+			valueName: "SearchList",
+			value:     "corp.example.com,branch.example.com",
+			assert: func(t *testing.T, got string) {
+				t.Helper()
+				assert.NotContains(t, got, "example", "should anonymize every search domain")
+				assert.Len(t, strings.Split(got, ", "), 2, "should keep both search domains")
+			},
+		},
+		{
+			name:      "name servers are anonymized as addresses",
+			valueName: "DhcpNameServer",
+			value:     "203.0.113.10 8.8.8.8",
+			assert: func(t *testing.T, got string) {
+				t.Helper()
+				assert.NotContains(t, got, "203.0.113.10", "should anonymize a public resolver address")
+				// well-known resolvers stay readable at every level
+				assert.Contains(t, got, "8.8.8.8", "should keep a well-known resolver address")
+			},
+		},
+		{
+			name:      "opaque values are left to the string pass",
+			valueName: "DataBasePath",
+			value:     `%SystemRoot%\System32\drivers\etc`,
+			assert: func(t *testing.T, got string) {
+				t.Helper()
+				assert.Equal(t, `%SystemRoot%\System32\drivers\etc`, got, "should not alter a path")
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			g := newDNSValueGenerator(anonymize.LevelDefault)
+			tc.assert(t, g.anonymizeValue(tc.valueName, tc.value))
+		})
+	}
+}
+
+// TestParseNRPTPolicyTable parses the MOF text of the policy table out
+// parameters, as the provider on a client with one NRPT rule renders it.
+func TestParseNRPTPolicyTable(t *testing.T) {
+	const text = `[abstract]
+class __PARAMETERS
+{
+	[Out, EmbeddedInstance("DnsClientPolicyConfiguration"): ToSubClass, ID(2): DisableOverride ToInstance] DnsClientPolicyConfiguration cmdletOutput[] = {
+instance of DnsClientPolicyConfiguration
+{
+	DirectAccessProxyType = "NoProxy";
+	DirectAccessQueryIPsecRequired = FALSE;
+	NameEncoding = "Utf8WithoutMapping";
+	Namespace = ".0.100.in-addr.arpa";
+}, 
+instance of DnsClientPolicyConfiguration
+{
+	DirectAccessProxyType = "NoProxy";
+	NameEncoding = "Utf8WithoutMapping";
+	NameServers = {"100.0.255.254", "100.0.255.253"};
+	Namespace = ".nb.internal";
+}};
+	[in] boolean Effective;
+	[out] uint32 ReturnValue = 0;
+};
+`
+
+	entries := parseNRPTPolicyTable(text)
+	require.Len(t, entries, 2, "should parse both embedded instances")
+
+	assert.Equal(t, ".0.100.in-addr.arpa", entries[0].namespace, "should read the namespace of the first instance")
+	assert.Equal(t, ".nb.internal", entries[1].namespace, "should read the namespace of the second instance")
+
+	assert.Equal(t, []registryValue{
+		{name: "DirectAccessProxyType", value: "NoProxy"},
+		{name: "DirectAccessQueryIPsecRequired", value: "FALSE"},
+		{name: "NameEncoding", value: "Utf8WithoutMapping"},
+	}, entries[0].values, "should keep the remaining values in order")
+
+	assert.Contains(t, entries[1].values, registryValue{name: "NameServers", value: "100.0.255.254, 100.0.255.253"},
+		"should flatten a MOF array")
+
+	for _, value := range entries[1].values {
+		assert.NotContains(t, value.name, "ReturnValue", "should not read the class level parameters as values")
+	}
+}
+
+func TestParseNRPTPolicyTableEmpty(t *testing.T) {
+	assert.Empty(t, parseNRPTPolicyTable(""), "should parse no entries from empty text")
+	assert.Empty(t, parseNRPTPolicyTable("class __PARAMETERS\n{\n};\n"), "should parse no entries from a table with no instances")
+}
diff --git a/client/internal/debug/nrpt_windows.go b/client/internal/debug/nrpt_windows.go
new file mode 100644
index 000000000..6b6e0e29a
--- /dev/null
+++ b/client/internal/debug/nrpt_windows.go
@@ -0,0 +1,317 @@
+//go:build windows
+
+package debug
+
+import (
+	"errors"
+	"fmt"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/go-ole/go-ole"
+	"github.com/go-ole/go-ole/oleutil"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// The NRPT policy table is reachable through the CIM class that backs
+	// Get-DnsClientNrptPolicy. Unlike the rules in the registry, the table is
+	// what the resolver currently has loaded, which is the only way to tell an
+	// applied rule from one that is merely written, in either direction.
+	nrptPolicyNamespace = `root\Microsoft\Windows\DNS`
+	nrptPolicyClass     = "PS_DnsClientNrptPolicy"
+	nrptPolicyMethod    = "Get"
+
+	// The class has no instances, so the table comes from the out parameters
+	// of a static method call, rendered as MOF text: the embedded instances
+	// arrive as a safe array of objects, which cannot be read back through the
+	// COM bindings, and the text form carries all of them.
+	nrptPolicyInstanceKeyword = "instance of DnsClientPolicyConfiguration"
+
+	nrptPolicyTimeout = 15 * time.Second
+)
+
+// COM initialization results that leave the calling thread usable: S_FALSE for
+// a thread this process already initialized, RPC_E_CHANGED_MODE for one that
+// belongs to another apartment.
+const (
+	sFalse          = 0x00000001
+	rpcEChangedMode = 0x80010106
+)
+
+// nrptQueryInFlight admits one read of the policy table at a time. A provider
+// that stops answering keeps its goroutine and the OS thread that goroutine
+// pinned, so a later bundle reports that instead of pinning another one.
+var nrptQueryInFlight = make(chan struct{}, 1)
+
+// nrptPolicyEntry is one namespace of the effective policy table, holding the
+// values of an embedded DnsClientPolicyConfiguration instance in the order the
+// provider reported them.
+type nrptPolicyEntry struct {
+	namespace string
+	values    []registryValue
+}
+
+// registryValue is a name and its rendered value, shared by the registry and
+// policy table readers so both anonymize by value name the same way.
+type registryValue struct {
+	name  string
+	value string
+}
+
+// effectiveNRPTPolicies reads the effective NRPT table. The call is bounded
+// because a WMI provider can block indefinitely and a debug bundle must not.
+func effectiveNRPTPolicies() ([]nrptPolicyEntry, error) {
+	type result struct {
+		text string
+		err  error
+	}
+
+	select {
+	case nrptQueryInFlight <- struct{}{}:
+	default:
+		return nil, errors.New("an earlier read of the policy table has not returned")
+	}
+
+	done := make(chan result, 1)
+	go func() {
+		// the slot is released here rather than by the caller, so a read that
+		// outlives the timeout holds it until the provider answers
+		defer func() { <-nrptQueryInFlight }()
+
+		text, err := nrptPolicyTableText()
+		done <- result{text: text, err: err}
+	}()
+
+	select {
+	case res := <-done:
+		if res.err != nil {
+			return nil, res.err
+		}
+		return parseNRPTPolicyTable(res.text), nil
+	case <-time.After(nrptPolicyTimeout):
+		return nil, errors.New("read of the policy table timed out")
+	}
+}
+
+// nrptPolicyTableText calls the policy table method and returns the MOF text of
+// its out parameters.
+func nrptPolicyTableText() (text string, err error) {
+	// COM is per thread, and the collection is short lived, so the thread is
+	// pinned for the duration rather than initialized for the process.
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	defer func() {
+		// The COM call chain is dynamically typed, so a provider that answers
+		// with an unexpected shape must not take the daemon down with it.
+		if r := recover(); r != nil {
+			err = fmt.Errorf("read NRPT policy table: %v", r)
+		}
+	}()
+
+	owns, err := coInitialize()
+	if err != nil {
+		return "", err
+	}
+	if owns {
+		defer ole.CoUninitialize()
+	}
+
+	locator, err := oleutil.CreateObject("WbemScripting.SWbemLocator")
+	if err != nil {
+		return "", fmt.Errorf("create WMI locator: %w", err)
+	}
+	defer locator.Release()
+
+	dispatch, err := locator.QueryInterface(ole.IID_IDispatch)
+	if err != nil {
+		return "", fmt.Errorf("query WMI locator interface: %w", err)
+	}
+	defer dispatch.Release()
+
+	service, err := dispatchCall(dispatch, "ConnectServer", nil, nrptPolicyNamespace)
+	if err != nil {
+		return "", fmt.Errorf("connect to %s: %w", nrptPolicyNamespace, err)
+	}
+	defer service.Release()
+
+	inParams, err := spawnMethodInParams(service)
+	if err != nil {
+		return "", err
+	}
+	defer inParams.Release()
+
+	// The effective table is the merge of the local and the group policy
+	// store, which is what the resolver answers from.
+	if _, err := oleutil.PutProperty(inParams, "Effective", true); err != nil {
+		return "", fmt.Errorf("set Effective parameter: %w", err)
+	}
+
+	outParams, err := dispatchCall(service, "ExecMethod", nrptPolicyClass, nrptPolicyMethod, inParams)
+	if err != nil {
+		return "", fmt.Errorf("call %s.%s: %w", nrptPolicyClass, nrptPolicyMethod, err)
+	}
+	defer outParams.Release()
+
+	textVariant, err := oleutil.CallMethod(outParams, "GetObjectText_")
+	if err != nil {
+		return "", fmt.Errorf("render policy table: %w", err)
+	}
+	defer func() {
+		if err := textVariant.Clear(); err != nil {
+			log.Debugf("clear policy table variant: %v", err)
+		}
+	}()
+
+	return textVariant.ToString(), nil
+}
+
+// spawnMethodInParams builds the in parameters instance the method needs. The
+// provider rejects the call without one, even when every parameter is optional.
+func spawnMethodInParams(service *ole.IDispatch) (*ole.IDispatch, error) {
+	class, err := dispatchCall(service, "Get", nrptPolicyClass)
+	if err != nil {
+		return nil, fmt.Errorf("get class %s: %w", nrptPolicyClass, err)
+	}
+	defer class.Release()
+
+	methods, err := dispatchProperty(class, "Methods_")
+	if err != nil {
+		return nil, fmt.Errorf("get class methods: %w", err)
+	}
+	defer methods.Release()
+
+	method, err := dispatchCall(methods, "Item", nrptPolicyMethod)
+	if err != nil {
+		return nil, fmt.Errorf("get method %s: %w", nrptPolicyMethod, err)
+	}
+	defer method.Release()
+
+	params, err := dispatchProperty(method, "InParameters")
+	if err != nil {
+		return nil, fmt.Errorf("get method parameters: %w", err)
+	}
+	defer params.Release()
+
+	inParams, err := dispatchCall(params, "SpawnInstance_")
+	if err != nil {
+		return nil, fmt.Errorf("spawn parameter instance: %w", err)
+	}
+
+	return inParams, nil
+}
+
+// parseNRPTPolicyTable pulls the embedded instances out of the MOF text. Each
+// instance is a namespace of the table, with one name and value per line.
+func parseNRPTPolicyTable(text string) []nrptPolicyEntry {
+	var entries []nrptPolicyEntry
+	var current *nrptPolicyEntry
+
+	for _, line := range strings.Split(text, "\n") {
+		line = strings.TrimSpace(strings.TrimSuffix(strings.TrimSpace(line), ";"))
+
+		switch {
+		case strings.HasPrefix(line, nrptPolicyInstanceKeyword):
+			entries = append(entries, nrptPolicyEntry{})
+			current = &entries[len(entries)-1]
+			continue
+		case strings.HasPrefix(line, "}"):
+			// closes an instance, and the array with the last one, so the
+			// class level parameters that follow are not read as values
+			current = nil
+			continue
+		case current == nil, line == "{":
+			continue
+		}
+
+		name, value, ok := strings.Cut(line, " = ")
+		if !ok {
+			continue
+		}
+
+		value = unquoteMOFValue(value)
+		if name == "Namespace" {
+			current.namespace = value
+			continue
+		}
+
+		current.values = append(current.values, registryValue{name: name, value: value})
+	}
+
+	return entries
+}
+
+// unquoteMOFValue renders a MOF scalar or array as plain text: "a" becomes a,
+// and {"a", "b"} becomes a, b.
+func unquoteMOFValue(value string) string {
+	value = strings.TrimSpace(value)
+
+	if inner, ok := strings.CutPrefix(value, "{"); ok {
+		value = strings.TrimSuffix(inner, "}")
+
+		entries := strings.Split(value, ",")
+		for i, entry := range entries {
+			entries[i] = strings.Trim(strings.TrimSpace(entry), `"`)
+		}
+		return strings.Join(entries, ", ")
+	}
+
+	return strings.Trim(value, `"`)
+}
+
+// coInitialize prepares the calling thread for COM and reports whether this
+// call owns the initialization, which decides whether it may be balanced with
+// CoUninitialize. S_FALSE took a reference on a thread this process had already
+// initialized and so has to be released, while RPC_E_CHANGED_MODE took none:
+// the thread belongs to another apartment, which is usable but is not ours to
+// uninitialize.
+func coInitialize() (bool, error) {
+	err := ole.CoInitializeEx(0, ole.COINIT_MULTITHREADED)
+	if err == nil {
+		return true, nil
+	}
+
+	var oleErr *ole.OleError
+	if errors.As(err, &oleErr) {
+		switch oleErr.Code() {
+		case sFalse:
+			return true, nil
+		case rpcEChangedMode:
+			return false, nil
+		}
+	}
+
+	return false, fmt.Errorf("initialize COM: %w", err)
+}
+
+// dispatchCall calls a COM method that returns an object.
+func dispatchCall(dispatch *ole.IDispatch, method string, params ...any) (*ole.IDispatch, error) {
+	variant, err := oleutil.CallMethod(dispatch, method, params...)
+	if err != nil {
+		return nil, err
+	}
+
+	object := variant.ToIDispatch()
+	if object == nil {
+		return nil, fmt.Errorf("%s returned no object", method)
+	}
+
+	return object, nil
+}
+
+// dispatchProperty reads a COM property that holds an object.
+func dispatchProperty(dispatch *ole.IDispatch, property string) (*ole.IDispatch, error) {
+	variant, err := oleutil.GetProperty(dispatch, property)
+	if err != nil {
+		return nil, err
+	}
+
+	object := variant.ToIDispatch()
+	if object == nil {
+		return nil, fmt.Errorf("property %s holds no object", property)
+	}
+
+	return object, nil
+}
diff --git a/client/internal/debug/uilog_test.go b/client/internal/debug/uilog_test.go
new file mode 100644
index 000000000..103e98c6f
--- /dev/null
+++ b/client/internal/debug/uilog_test.go
@@ -0,0 +1,64 @@
+package debug
+
+import (
+	"archive/zip"
+	"bytes"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/configs"
+)
+
+// bundleEntries generates a bundle with the given generator and returns the
+// set of entry names in the resulting archive.
+func bundleEntries(t *testing.T, g *BundleGenerator) map[string]struct{} {
+	t.Helper()
+
+	path, err := g.Generate()
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = os.Remove(path) })
+
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	zr, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
+	require.NoError(t, err)
+
+	names := make(map[string]struct{}, len(zr.File))
+	for _, f := range zr.File {
+		names[f.Name] = struct{}{}
+	}
+	return names
+}
+
+func TestBundleIncludesUILogWhenOpenerAllows(t *testing.T) {
+	path := filepath.Join(t.TempDir(), configs.UILogFile)
+	require.NoError(t, os.WriteFile(path, []byte("gui log"), 0600))
+
+	g := NewBundleGenerator(GeneratorDependencies{
+		UILogPath:   path,
+		UILogOpener: openLogFile,
+	}, BundleConfig{})
+
+	require.Contains(t, bundleEntries(t, g), configs.UILogFile)
+}
+
+// A UILogOpener that refuses (as the ownership check does for a foreign file)
+// keeps the UI log out of the bundle without failing bundle generation.
+func TestBundleExcludesUILogWhenOpenerRefuses(t *testing.T) {
+	path := filepath.Join(t.TempDir(), configs.UILogFile)
+	require.NoError(t, os.WriteFile(path, []byte("secret"), 0600))
+
+	g := NewBundleGenerator(GeneratorDependencies{
+		UILogPath: path,
+		UILogOpener: func(string) (*os.File, error) {
+			return nil, fmt.Errorf("not owned by the caller")
+		},
+	}, BundleConfig{})
+
+	require.NotContains(t, bundleEntries(t, g), configs.UILogFile)
+}
diff --git a/client/internal/debug/upload.go b/client/internal/debug/upload.go
index cdf52409d..88fde6d6f 100644
--- a/client/internal/debug/upload.go
+++ b/client/internal/debug/upload.go
@@ -3,10 +3,12 @@ package debug
 import (
 	"context"
 	"crypto/sha256"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
+	neturl "net/url"
 	"os"
 
 	"github.com/netbirdio/netbird/upload-server/types"
@@ -14,20 +16,80 @@ import (
 
 const maxBundleUploadSize = 50 * 1024 * 1024
 
-func UploadDebugBundle(ctx context.Context, url, managementURL, filePath string) (key string, err error) {
-	response, err := getUploadURL(ctx, url, managementURL)
+// requireHTTPS refuses any URL the daemon would fetch or upload to that is not
+// https. The daemon runs as root and the bundle carries its logs and state, so a
+// plaintext hop is a place to intercept the bundle or the presigned redirect.
+// The server-side gate already enforces this for the desktop path; this also
+// covers the mobile and job-runner callers that reach this package directly.
+// Skipped when the caller opted into an insecure upload (self-hosted server).
+func requireHTTPS(what, rawURL string) error {
+	parsed, err := neturl.Parse(rawURL)
+	if err != nil {
+		return fmt.Errorf("parse %s: %w", what, err)
+	}
+	if parsed.Scheme != "https" {
+		return fmt.Errorf("%s must use https, got scheme %q", what, parsed.Scheme)
+	}
+	return nil
+}
+
+// uploadClient returns the HTTP client for the upload requests. The default
+// client verifies TLS and refuses a redirect that would downgrade to a non-https
+// hop, so a bundle can never leave over http after an https start. The insecure
+// variant accepts http and untrusted certificates, and is only reachable for a
+// privileged caller that passed --upload-bundle-insecure (see
+// requirePrivilegeForUploadURL).
+func uploadClient(insecure bool) *http.Client {
+	if !insecure {
+		return &http.Client{CheckRedirect: rejectInsecureRedirect}
+	}
+	return &http.Client{
+		Transport: &http.Transport{
+			//nolint:gosec // opt-in, privileged, self-hosted upload servers
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true, MinVersion: tls.VersionTLS12},
+		},
+	}
+}
+
+// rejectInsecureRedirect refuses a redirect to a non-https target and keeps the
+// standard library's 10-hop limit that a custom CheckRedirect would otherwise
+// disable.
+func rejectInsecureRedirect(req *http.Request, via []*http.Request) error {
+	if req.URL.Scheme != "https" {
+		return fmt.Errorf("refusing redirect to non-https URL %s", req.URL.Redacted())
+	}
+	if len(via) >= 10 {
+		return fmt.Errorf("stopped after 10 redirects")
+	}
+	return nil
+}
+
+func UploadDebugBundle(ctx context.Context, url, managementURL, filePath string, insecure bool) (key string, err error) {
+	if !insecure {
+		if err := requireHTTPS("upload service URL", url); err != nil {
+			return "", err
+		}
+	}
+
+	response, err := getUploadURL(ctx, url, managementURL, insecure)
 	if err != nil {
 		return "", err
 	}
 
-	err = upload(ctx, filePath, response)
+	if !insecure {
+		if err := requireHTTPS("upload URL from service", response.URL); err != nil {
+			return "", err
+		}
+	}
+
+	err = upload(ctx, filePath, response, insecure)
 	if err != nil {
 		return "", err
 	}
 	return response.Key, nil
 }
 
-func upload(ctx context.Context, filePath string, response *types.GetURLResponse) error {
+func upload(ctx context.Context, filePath string, response *types.GetURLResponse, insecure bool) error {
 	fileData, err := os.Open(filePath)
 	if err != nil {
 		return fmt.Errorf("open file: %w", err)
@@ -52,7 +114,7 @@ func upload(ctx context.Context, filePath string, response *types.GetURLResponse
 	req.ContentLength = stat.Size()
 	req.Header.Set("Content-Type", "application/octet-stream")
 
-	putResp, err := http.DefaultClient.Do(req)
+	putResp, err := uploadClient(insecure).Do(req)
 	if err != nil {
 		return fmt.Errorf("upload failed: %v", err)
 	}
@@ -65,16 +127,23 @@ func upload(ctx context.Context, filePath string, response *types.GetURLResponse
 	return nil
 }
 
-func getUploadURL(ctx context.Context, url string, managementURL string) (*types.GetURLResponse, error) {
-	id := getURLHash(managementURL)
-	getReq, err := http.NewRequestWithContext(ctx, "GET", url+"?id="+id, nil)
+func getUploadURL(ctx context.Context, serviceURL string, managementURL string, insecure bool) (*types.GetURLResponse, error) {
+	parsed, err := neturl.Parse(serviceURL)
+	if err != nil {
+		return nil, fmt.Errorf("parse upload service URL: %w", err)
+	}
+	q := parsed.Query()
+	q.Set("id", getURLHash(managementURL))
+	parsed.RawQuery = q.Encode()
+
+	getReq, err := http.NewRequestWithContext(ctx, "GET", parsed.String(), nil)
 	if err != nil {
 		return nil, fmt.Errorf("create GET request: %w", err)
 	}
 
 	getReq.Header.Set(types.ClientHeader, types.ClientHeaderValue)
 
-	resp, err := http.DefaultClient.Do(getReq)
+	resp, err := uploadClient(insecure).Do(getReq)
 	if err != nil {
 		return nil, fmt.Errorf("get presigned URL: %w", err)
 	}
diff --git a/client/internal/debug/upload_test.go b/client/internal/debug/upload_test.go
index f224b8d3f..f3927cb81 100644
--- a/client/internal/debug/upload_test.go
+++ b/client/internal/debug/upload_test.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net"
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
@@ -43,7 +44,7 @@ func TestUpload(t *testing.T) {
 	fileContent := []byte("test file content")
 	err := os.WriteFile(file, fileContent, 0640)
 	require.NoError(t, err)
-	key, err := UploadDebugBundle(context.Background(), testURL+types.GetURLPath, testURL, file)
+	key, err := UploadDebugBundle(context.Background(), testURL+types.GetURLPath, testURL, file, true)
 	require.NoError(t, err)
 	id := getURLHash(testURL)
 	require.Contains(t, key, id+"/")
@@ -79,3 +80,47 @@ func waitForServer(t *testing.T, addr string) {
 	}
 	t.Fatalf("server did not start listening on %s in time", addr)
 }
+
+func TestRequireHTTPS(t *testing.T) {
+	require.NoError(t, requireHTTPS("upload URL", "https://upload.example/path"))
+	require.Error(t, requireHTTPS("upload URL", "http://upload.example/path"))
+	require.Error(t, requireHTTPS("upload URL", "ftp://upload.example/path"))
+	require.Error(t, requireHTTPS("upload URL", "://malformed"))
+}
+
+func TestRejectInsecureRedirect(t *testing.T) {
+	httpsReq, err := http.NewRequest(http.MethodGet, "https://a.example/", nil)
+	require.NoError(t, err)
+	require.NoError(t, rejectInsecureRedirect(httpsReq, nil), "https redirect target must be allowed")
+
+	httpReq, err := http.NewRequest(http.MethodGet, "http://a.example/", nil)
+	require.NoError(t, err)
+	require.Error(t, rejectInsecureRedirect(httpReq, nil), "http redirect target must be refused")
+
+	require.Error(t, rejectInsecureRedirect(httpsReq, make([]*http.Request, 10)), "the 10-redirect limit must be enforced")
+}
+
+// The secure client refuses to follow an https response that redirects to http,
+// so a bundle can't be downgraded onto plaintext mid-flight.
+func TestUploadClientRefusesHTTPSToHTTPRedirect(t *testing.T) {
+	plain := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	t.Cleanup(plain.Close)
+
+	secure := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, plain.URL, http.StatusFound)
+	}))
+	t.Cleanup(secure.Close)
+
+	client := uploadClient(false)
+	// Trust the test server's cert without disabling verification globally.
+	client.Transport = secure.Client().Transport
+
+	resp, err := client.Get(secure.URL)
+	if resp != nil {
+		_ = resp.Body.Close()
+	}
+	require.Error(t, err, "redirect from https to http must be refused")
+	require.Contains(t, err.Error(), "non-https")
+}
diff --git a/client/internal/debug/wgshow.go b/client/internal/debug/wgshow.go
index 1e8a8a6cc..ee24902e6 100644
--- a/client/internal/debug/wgshow.go
+++ b/client/internal/debug/wgshow.go
@@ -35,14 +35,14 @@ func (g *BundleGenerator) toWGShowFormat(s *configurer.Stats) string {
 	var sb strings.Builder
 
 	sb.WriteString(fmt.Sprintf("interface: %s\n", s.DeviceName))
-	sb.WriteString(fmt.Sprintf("  public key: %s\n", s.PublicKey))
+	sb.WriteString(fmt.Sprintf("  public key: %s\n", g.anonymizer.AnonymizeWGKey(s.PublicKey)))
 	sb.WriteString(fmt.Sprintf("  listen port: %d\n", s.ListenPort))
 	if s.FWMark != 0 {
 		sb.WriteString(fmt.Sprintf("  fwmark: %#x\n", s.FWMark))
 	}
 
 	for _, peer := range s.Peers {
-		sb.WriteString(fmt.Sprintf("\npeer: %s\n", peer.PublicKey))
+		sb.WriteString(fmt.Sprintf("\npeer: %s\n", g.anonymizer.AnonymizeWGKey(peer.PublicKey)))
 		if peer.Endpoint.IP != nil {
 			if g.anonymize {
 				anonEndpoint := g.anonymizer.AnonymizeUDPAddr(peer.Endpoint)
@@ -54,7 +54,11 @@ func (g *BundleGenerator) toWGShowFormat(s *configurer.Stats) string {
 		if len(peer.AllowedIPs) > 0 {
 			var ipStrings []string
 			for _, ipnet := range peer.AllowedIPs {
-				ipStrings = append(ipStrings, ipnet.String())
+				ipStr := ipnet.String()
+				if g.anonymize {
+					ipStr = g.anonymizer.AnonymizeIPString(ipStr)
+				}
+				ipStrings = append(ipStrings, ipStr)
 			}
 			sb.WriteString(fmt.Sprintf("  allowed ips: %s\n", strings.Join(ipStrings, ", ")))
 		}
diff --git a/client/internal/dns/host_darwin.go b/client/internal/dns/host_darwin.go
index 0f4eb6bf8..81029752e 100644
--- a/client/internal/dns/host_darwin.go
+++ b/client/internal/dns/host_darwin.go
@@ -267,18 +267,38 @@ func (s *systemConfigurator) getSystemDNSSettings() (SystemDNSSettings, error) {
 		return SystemDNSSettings{}, fmt.Errorf("sending the command: %w", err)
 	}
 
-	var dnsSettings SystemDNSSettings
+	dnsSettings, serverAddresses, err := parseSystemDNSSettings(b)
+	if err != nil {
+		return dnsSettings, err
+	}
+
+	s.mu.Lock()
+	s.origNameservers = serverAddresses
+	s.mu.Unlock()
+
+	return dnsSettings, nil
+}
+
+// parseSystemDNSSettings parses the output of `scutil show State:/Network/Service/<id>/DNS`.
+// Lines that don't match the expected "index : value" shape are skipped: hosts with unusual
+// network services (e.g. orphaned hardware ports) can produce entries without a value.
+func parseSystemDNSSettings(out []byte) (SystemDNSSettings, []netip.Addr, error) {
+	// port is not exposed by scutil, default to 53
+	dnsSettings := SystemDNSSettings{ServerPort: DefaultPort}
 	var serverAddresses []netip.Addr
 	inSearchDomainsArray := false
 	inServerAddressesArray := false
 
-	scanner := bufio.NewScanner(bytes.NewReader(b))
+	scanner := bufio.NewScanner(bytes.NewReader(out))
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
 		switch {
 		case strings.HasPrefix(line, "DomainName :"):
-			domainName := strings.TrimSpace(strings.Split(line, ":")[1])
-			dnsSettings.Domains = append(dnsSettings.Domains, domainName)
+			domainName := strings.TrimSpace(strings.TrimPrefix(line, "DomainName :"))
+			if domainName != "" {
+				dnsSettings.Domains = append(dnsSettings.Domains, domainName)
+			}
+			continue
 		case line == "SearchDomains : <array> {":
 			inSearchDomainsArray = true
 			continue
@@ -288,36 +308,45 @@ func (s *systemConfigurator) getSystemDNSSettings() (SystemDNSSettings, error) {
 		case line == "}":
 			inSearchDomainsArray = false
 			inServerAddressesArray = false
+			continue
+		}
+
+		if !inSearchDomainsArray && !inServerAddressesArray {
+			continue
+		}
+
+		parts := strings.SplitN(line, " : ", 2)
+		if len(parts) != 2 {
+			log.Debugf("skipping unexpected scutil DNS line %q", line)
+			continue
+		}
+		value := strings.TrimSpace(parts[1])
+		if value == "" {
+			continue
 		}
 
 		if inSearchDomainsArray {
-			searchDomain := strings.Split(line, " : ")[1]
-			dnsSettings.Domains = append(dnsSettings.Domains, searchDomain)
-		} else if inServerAddressesArray {
-			address := strings.Split(line, " : ")[1]
-			if ip, err := netip.ParseAddr(address); err == nil && !ip.IsUnspecified() {
-				ip = ip.Unmap()
-				serverAddresses = append(serverAddresses, ip)
-				// Prefer the first IPv4 server as ServerIP since our DNS listener is IPv4.
-				if !dnsSettings.ServerIP.IsValid() && ip.Is4() {
-					dnsSettings.ServerIP = ip
-				}
-			}
+			dnsSettings.Domains = append(dnsSettings.Domains, value)
+			continue
+		}
+
+		ip, err := netip.ParseAddr(value)
+		if err != nil || ip.IsUnspecified() {
+			continue
+		}
+		ip = ip.Unmap()
+		serverAddresses = append(serverAddresses, ip)
+		// Prefer the first IPv4 server as ServerIP since our DNS listener is IPv4.
+		if !dnsSettings.ServerIP.IsValid() && ip.Is4() {
+			dnsSettings.ServerIP = ip
 		}
 	}
 
 	if err := scanner.Err(); err != nil {
-		return dnsSettings, err
+		return dnsSettings, serverAddresses, err
 	}
 
-	// default to 53 port
-	dnsSettings.ServerPort = DefaultPort
-
-	s.mu.Lock()
-	s.origNameservers = serverAddresses
-	s.mu.Unlock()
-
-	return dnsSettings, nil
+	return dnsSettings, serverAddresses, nil
 }
 
 func (s *systemConfigurator) getOriginalNameservers() []netip.Addr {
@@ -435,11 +464,15 @@ func (s *systemConfigurator) getPrimaryService() (string, string, error) {
 	router := ""
 	for scanner.Scan() {
 		text := scanner.Text()
+		parts := strings.SplitN(text, ":", 2)
+		if len(parts) != 2 {
+			continue
+		}
 		if strings.Contains(text, "PrimaryService") {
-			primaryService = strings.TrimSpace(strings.Split(text, ":")[1])
+			primaryService = strings.TrimSpace(parts[1])
 		}
 		if strings.Contains(text, "Router") {
-			router = strings.TrimSpace(strings.Split(text, ":")[1])
+			router = strings.TrimSpace(parts[1])
 		}
 	}
 	if err := scanner.Err(); err != nil && err != io.EOF {
diff --git a/client/internal/dns/host_darwin_test.go b/client/internal/dns/host_darwin_test.go
index 94d020c39..bee691c71 100644
--- a/client/internal/dns/host_darwin_test.go
+++ b/client/internal/dns/host_darwin_test.go
@@ -328,6 +328,120 @@ func removeTestDNSKey(key string) error {
 	return err
 }
 
+func TestParseSystemDNSSettings(t *testing.T) {
+	tests := []struct {
+		name            string
+		output          string
+		expectedDomains []string
+		expectedServers []netip.Addr
+		expectedIP      netip.Addr
+	}{
+		{
+			name: "well_formed",
+			output: `<dictionary> {
+  DomainName : example.com
+  SearchDomains : <array> {
+    0 : example.com
+    1 : corp.example.com
+  }
+  ServerAddresses : <array> {
+    0 : 192.168.1.1
+    1 : fd00::53
+  }
+}
+`,
+			expectedDomains: []string{"example.com", "example.com", "corp.example.com"},
+			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1"), netip.MustParseAddr("fd00::53")},
+			expectedIP:      netip.MustParseAddr("192.168.1.1"),
+		},
+		{
+			// entries without a value after the separator used to panic with
+			// "index out of range [1] with length 1"
+			name: "malformed_array_entries_skipped",
+			output: `<dictionary> {
+  SearchDomains : <array> {
+    0 :
+    (null)
+
+    1 : corp.example.com
+  }
+  ServerAddresses : <array> {
+    0 :
+    1 : 192.168.1.1
+  }
+}
+`,
+			expectedDomains: []string{"corp.example.com"},
+			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
+			expectedIP:      netip.MustParseAddr("192.168.1.1"),
+		},
+		{
+			name: "domain_name_without_value_skipped",
+			output: `<dictionary> {
+  DomainName :
+  ServerAddresses : <array> {
+    0 : 192.168.1.1
+  }
+}
+`,
+			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
+			expectedIP:      netip.MustParseAddr("192.168.1.1"),
+		},
+		{
+			name: "ipv6_first_prefers_ipv4_server_ip",
+			output: `<dictionary> {
+  ServerAddresses : <array> {
+    0 : fd00::53
+    1 : 192.168.1.1
+  }
+}
+`,
+			expectedServers: []netip.Addr{netip.MustParseAddr("fd00::53"), netip.MustParseAddr("192.168.1.1")},
+			expectedIP:      netip.MustParseAddr("192.168.1.1"),
+		},
+		{
+			name: "invalid_and_unspecified_addresses_skipped",
+			output: `<dictionary> {
+  ServerAddresses : <array> {
+    0 : (null)
+    1 : 0.0.0.0
+    2 : 192.168.1.1
+  }
+}
+`,
+			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
+			expectedIP:      netip.MustParseAddr("192.168.1.1"),
+		},
+		{
+			name: "v4_mapped_address_unmapped",
+			output: `<dictionary> {
+  ServerAddresses : <array> {
+    0 : ::ffff:192.168.1.1
+  }
+}
+`,
+			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
+			expectedIP:      netip.MustParseAddr("192.168.1.1"),
+		},
+		{
+			name:   "empty_output",
+			output: "",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			settings, servers, err := parseSystemDNSSettings([]byte(tc.output))
+			require.NoError(t, err, "parsing should not fail")
+
+			assert.Equal(t, tc.expectedDomains, settings.Domains, "domains should match")
+			assert.Equal(t, tc.expectedServers, servers, "server addresses should match")
+			assert.Equal(t, tc.expectedIP, settings.ServerIP, "server IP should match")
+			assert.Equal(t, DefaultPort, settings.ServerPort, "server port should default to 53")
+		})
+	}
+}
+
 func TestGetOriginalNameservers(t *testing.T) {
 	configurator := &systemConfigurator{
 		createdKeys: make(map[string]struct{}),
diff --git a/client/internal/dns/host_windows.go b/client/internal/dns/host_windows.go
index 4f6ece532..6462d0c37 100644
--- a/client/internal/dns/host_windows.go
+++ b/client/internal/dns/host_windows.go
@@ -6,8 +6,10 @@ import (
 	"fmt"
 	"io"
 	"net/netip"
+	"os"
 	"os/exec"
 	"slices"
+	"strconv"
 	"strings"
 	"syscall"
 	"time"
@@ -31,10 +33,52 @@ var (
 	dnsFlushResolverCacheFn = dnsapi.NewProc("DnsFlushResolverCache")
 )
 
+// Registry locations of the host DNS configuration this package programs,
+// exported so a diagnostic reader reports the same locations that are written.
 const (
-	dnsPolicyConfigMatchPath    = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match`
-	gpoDnsPolicyRoot            = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
-	gpoDnsPolicyConfigMatchPath = gpoDnsPolicyRoot + `\NetBird-Match`
+	// NRPTKeyPrefix starts the name of every NRPT rule key this client creates:
+	// the match rules, the catch-all, and the .local exemption. Cleanup
+	// enumerates by this prefix, so a new kind of rule is removed by existing
+	// code as long as its key starts here.
+	NRPTKeyPrefix = "NetBird-"
+
+	// nrptMatchKeyName names the match-domain rules. Older versions used
+	// different layouts under the same name: a single unsuffixed key, then one
+	// key per domain, now one key per batch of domains.
+	nrptMatchKeyName = NRPTKeyPrefix + "Match"
+
+	// DNSPolicyConfigRoot holds the NRPT rules of the local policy store.
+	DNSPolicyConfigRoot = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig`
+
+	// GPODNSPolicyConfigRoot holds the NRPT rules of the group policy store,
+	// which takes precedence over the local one when it is present.
+	GPODNSPolicyConfigRoot = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
+
+	// InterfaceConfigPath and InterfaceConfigPathV6 hold the per-interface DNS
+	// settings, keyed by interface GUID, in separate hives per address family.
+	InterfaceConfigPath   = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
+	InterfaceConfigPathV6 = `SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces`
+)
+
+const (
+	dnsPolicyConfigMatchPath    = DNSPolicyConfigRoot + `\` + nrptMatchKeyName
+	gpoDnsPolicyConfigMatchPath = GPODNSPolicyConfigRoot + `\` + nrptMatchKeyName
+
+	dnsPolicyConfigExemptLocalPath    = DNSPolicyConfigRoot + `\` + NRPTKeyPrefix + `ExemptLocal`
+	gpoDnsPolicyConfigExemptLocalPath = GPODNSPolicyConfigRoot + `\` + NRPTKeyPrefix + `ExemptLocal`
+
+	nrptCatchAllNamespace = "."
+	// nrptLocalNamespace is reserved for multicast DNS by RFC 6762: a unicast
+	// resolver must not answer for it. The catch-all rule would hand it to us
+	// anyway, so it gets an exemption rule of its own.
+	nrptLocalNamespace = ".local"
+
+	// envLegacyDNSResolution restores the pre-catch-all behaviour: the adapter's
+	// NameServer alone, leaving the OS free to query other adapters' resolvers in
+	// parallel. An escape hatch for setups that depend on a resolver of theirs
+	// still being reachable while connected, at the cost of the leak and of the
+	// race the catch-all rule exists to close.
+	envLegacyDNSResolution = "NB_USE_LEGACY_DNS_RESOLUTION"
 
 	dnsPolicyConfigVersionKey           = "Version"
 	dnsPolicyConfigVersionValue         = 2
@@ -45,8 +89,6 @@ const (
 
 	nrptMaxDomainsPerRule = 50
 
-	interfaceConfigPath           = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
-	interfaceConfigPathV6         = `SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces`
 	interfaceConfigNameServerKey  = "NameServer"
 	interfaceConfigDhcpNameSrvKey = "DhcpNameServer"
 	interfaceConfigSearchListKey  = "SearchList"
@@ -73,7 +115,6 @@ type registryConfigurator struct {
 	guid            string
 	routingAll      bool
 	gpo             bool
-	nrptEntryCount  int
 	origNameservers []netip.Addr
 }
 
@@ -83,19 +124,9 @@ func newHostManager(wgInterface WGIface) (*registryConfigurator, error) {
 		return nil, err
 	}
 
-	var useGPO bool
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, gpoDnsPolicyRoot, registry.QUERY_VALUE)
-	if err != nil {
-		log.Debugf("failed to open GPO DNS policy root: %v", err)
-	} else {
-		closer(k)
-		useGPO = true
-		log.Infof("detected GPO DNS policy configuration, using policy store")
-	}
-
 	configurator := &registryConfigurator{
 		guid: guid,
-		gpo:  useGPO,
+		gpo:  useGPOPolicyStore(),
 	}
 
 	origNameservers, err := configurator.captureOriginalNameservers()
@@ -123,7 +154,7 @@ func (r *registryConfigurator) captureOriginalNameservers() ([]netip.Addr, error
 	seen := make(map[netip.Addr]struct{})
 	var out []netip.Addr
 	var merr *multierror.Error
-	for _, root := range []string{interfaceConfigPath, interfaceConfigPathV6} {
+	for _, root := range []string{InterfaceConfigPath, InterfaceConfigPathV6} {
 		addrs, err := r.captureFromTcpipRoot(root)
 		if err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("%s: %w", root, err))
@@ -276,6 +307,13 @@ func (r *registryConfigurator) disableWINSForInterface() error {
 }
 
 func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager *statemanager.Manager) error {
+	// Clear every rule the previous apply installed before installing any new
+	// one, including a leftover catch-all: removal is unconditional so a rule
+	// from an earlier run cannot survive into a config that no longer wants it.
+	if err := r.removeDNSMatchPolicies(); err != nil {
+		log.Errorf("cleanup old dns match policies: %s", err)
+	}
+
 	if config.RouteAll {
 		if err := r.addDNSSetupForAll(config.ServerIP); err != nil {
 			return fmt.Errorf("add dns setup: %w", err)
@@ -301,19 +339,28 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 		matchDomains = append(matchDomains, "."+strings.TrimSuffix(dConf.Domain, "."))
 	}
 
-	if err := r.removeDNSMatchPolicies(); err != nil {
-		log.Errorf("cleanup old dns match policies: %s", err)
+	// The root namespace is a match domain like any other: it just happens to
+	// match every name. Without it the adapter's NameServer only adds one more
+	// resolver to the set Windows queries in parallel, keeping whichever answer
+	// comes back first — which leaks every query to the local network and lets a
+	// resolver other than ours answer for a name we are authoritative for.
+	if config.RouteAll {
+		if parseBoolEnv(envLegacyDNSResolution) {
+			log.Infof("%s is set, leaving DNS resolution shared with the other adapters' resolvers instead of forcing it through %s", envLegacyDNSResolution, config.ServerIP)
+		} else {
+			matchDomains = append(matchDomains, nrptCatchAllNamespace)
+			log.Infof("routing every namespace through %s: DNS resolution is now exclusive to NetBird", config.ServerIP)
+
+			if err := r.addDNSExemptLocalPolicy(); err != nil {
+				return fmt.Errorf("add dns exempt policy: %w", err)
+			}
+		}
 	}
 
 	if len(matchDomains) != 0 {
-		count, err := r.addDNSMatchPolicy(matchDomains, config.ServerIP)
-		// Update count even on error to ensure cleanup covers partially created rules
-		r.nrptEntryCount = count
-		if err != nil {
+		if err := r.addDNSMatchPolicy(matchDomains, config.ServerIP); err != nil {
 			return fmt.Errorf("add dns match policy: %w", err)
 		}
-	} else {
-		r.nrptEntryCount = 0
 	}
 
 	r.updateState(stateManager)
@@ -329,9 +376,8 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 
 func (r *registryConfigurator) updateState(stateManager *statemanager.Manager) {
 	if err := stateManager.UpdateState(&ShutdownState{
-		Guid:           r.guid,
-		GPO:            r.gpo,
-		NRPTEntryCount: r.nrptEntryCount,
+		Guid: r.guid,
+		GPO:  r.gpo,
 	}); err != nil {
 		log.Errorf("failed to update shutdown state: %s", err)
 	}
@@ -346,7 +392,7 @@ func (r *registryConfigurator) addDNSSetupForAll(ip netip.Addr) error {
 	return nil
 }
 
-func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) (int, error) {
+func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) error {
 	// if the gpo key is present, we need to put our DNS settings there, otherwise our config might be ignored
 	// see https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/8cc31cb9-20cb-4140-9e85-3e08703b4745
 
@@ -363,19 +409,17 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, ruleIndex)
 
 		if err := r.configureDNSPolicy(localPath, batchDomains, ip); err != nil {
-			return ruleIndex, fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
+			return fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
 		}
 
-		// Increment immediately so the caller's cleanup path knows about this rule
-		ruleIndex++
-
 		if r.gpo {
 			if err := r.configureDNSPolicy(gpoPath, batchDomains, ip); err != nil {
-				return ruleIndex, fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex-1, err)
+				return fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex, err)
 			}
 		}
 
-		log.Debugf("added NRPT rule %d with %d domains", ruleIndex-1, len(batchDomains))
+		log.Debugf("added NRPT rule %d with %d domains", ruleIndex, len(batchDomains))
+		ruleIndex++
 	}
 
 	if r.gpo {
@@ -385,9 +429,45 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 	}
 
 	log.Infof("added %d NRPT rules for %d domains", ruleIndex, len(domains))
-	return ruleIndex, nil
+	return nil
 }
 
+// addDNSExemptLocalPolicy carves .local back out of the catch-all. RFC 6762
+// reserves it for multicast DNS, so forwarding those names to a unicast
+// upstream answers NXDOMAIN for hosts that do exist - printers, NAS boxes, and
+// anything else announcing itself on the link - and the answer is authoritative
+// enough that Windows stops looking. A rule naming the namespace with no
+// servers hands it back to the DNS client untouched. A more specific rule still
+// wins, so a match domain under .local keeps going through us.
+func (r *registryConfigurator) addDNSExemptLocalPolicy() error {
+	var noServers netip.Addr
+
+	if err := r.configureDNSPolicy(dnsPolicyConfigExemptLocalPath, []string{nrptLocalNamespace}, noServers); err != nil {
+		return fmt.Errorf("configure exempt policy for %s: %w", nrptLocalNamespace, err)
+	}
+
+	if r.gpo {
+		if err := r.configureDNSPolicy(gpoDnsPolicyConfigExemptLocalPath, []string{nrptLocalNamespace}, noServers); err != nil {
+			return fmt.Errorf("configure gpo exempt policy for %s: %w", nrptLocalNamespace, err)
+		}
+		if err := refreshGroupPolicy(); err != nil {
+			log.Warnf("failed to refresh group policy: %v", err)
+		}
+	}
+
+	log.Infof("added NRPT exemption for %s, leaving it to the OS resolver", nrptLocalNamespace)
+	return nil
+}
+
+// configureDNSPolicy writes one NRPT rule. An invalid ip writes an exemption
+// rule: the namespace with an empty server list, which tells the DNS client to
+// resolve those names the way it would without any rule at all.
+//
+// The empty string is the whole difference, and it has to be written: dropping
+// the value and clearing ConfigOptions instead produces a rule Windows treats
+// as a no-op, keeps out of Get-DnsClientNrptPolicy -Effective, and ignores in
+// favour of the catch-all. 0x8 says the server list is the meaningful part of
+// the rule, and an empty list then means "no server, resolve normally".
 func (r *registryConfigurator) configureDNSPolicy(policyPath string, domains []string, ip netip.Addr) error {
 	if err := removeRegistryKeyFromDNSPolicyConfig(policyPath); err != nil {
 		return fmt.Errorf("remove existing dns policy: %w", err)
@@ -407,7 +487,11 @@ func (r *registryConfigurator) configureDNSPolicy(policyPath string, domains []s
 		return fmt.Errorf("set %s: %w", dnsPolicyConfigNameKey, err)
 	}
 
-	if err := regKey.SetStringValue(dnsPolicyConfigGenericDNSServersKey, ip.String()); err != nil {
+	var servers string
+	if ip.IsValid() {
+		servers = ip.String()
+	}
+	if err := regKey.SetStringValue(dnsPolicyConfigGenericDNSServersKey, servers); err != nil {
 		return fmt.Errorf("set %s: %w", dnsPolicyConfigGenericDNSServersKey, err)
 	}
 
@@ -450,7 +534,7 @@ func (r *registryConfigurator) flushDNSCache() {
 
 	ret, _, err := dnsFlushResolverCacheFn.Call()
 	if ret == 0 {
-		if err != nil && !errors.Is(err, syscall.Errno(0)) {
+		if !errors.Is(err, syscall.Errno(0)) {
 			log.Errorf("DnsFlushResolverCache failed: %v", err)
 			return
 		}
@@ -482,21 +566,29 @@ func (r *registryConfigurator) setInterfaceRegistryKeyStringValue(key, value str
 	return nil
 }
 
+// deleteInterfaceRegistryKeyProperty removes a value from the interface key.
+// A value that is already gone, or an interface key that is, is not an error:
+// the caller asked for the value not to be there, and a cleanup that runs twice
+// has to reach its later steps on the second run as well.
 func (r *registryConfigurator) deleteInterfaceRegistryKeyProperty(propertyKey string) error {
 	regKey, err := r.getInterfaceRegistryKey()
-	if err != nil {
+	switch {
+	case errors.Is(err, registry.ErrNotExist), errors.Is(err, syscall.ERROR_PATH_NOT_FOUND):
+		log.Debugf("interface key of %s does not exist, nothing to delete %s from", r.guid, propertyKey)
+		return nil
+	case err != nil:
 		return fmt.Errorf("get interface registry key: %w", err)
 	}
 	defer closer(regKey)
 
-	if err := regKey.DeleteValue(propertyKey); err != nil {
+	if err := regKey.DeleteValue(propertyKey); err != nil && !errors.Is(err, registry.ErrNotExist) {
 		return fmt.Errorf("delete registry key %s: %w", propertyKey, err)
 	}
 	return nil
 }
 
 func (r *registryConfigurator) getInterfaceRegistryKey() (registry.Key, error) {
-	regKeyPath := interfaceConfigPath + "\\" + r.guid
+	regKeyPath := InterfaceConfigPath + "\\" + r.guid
 	regKey, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.SET_VALUE)
 	if err != nil {
 		return regKey, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", regKeyPath, err)
@@ -505,8 +597,11 @@ func (r *registryConfigurator) getInterfaceRegistryKey() (registry.Key, error) {
 }
 
 func (r *registryConfigurator) restoreHostDNS() error {
+	// Propagated, unlike in applyDNSConfig: there we are about to write fresh
+	// rules over whatever survived, here we are leaving, and a rule left behind
+	// keeps sending every query to an address that is about to disappear.
 	if err := r.removeDNSMatchPolicies(); err != nil {
-		log.Errorf("remove dns match policies: %s", err)
+		return fmt.Errorf("remove dns match policies: %w", err)
 	}
 
 	if err := r.deleteInterfaceRegistryKeyProperty(interfaceConfigSearchListKey); err != nil {
@@ -515,31 +610,36 @@ func (r *registryConfigurator) restoreHostDNS() error {
 
 	go r.flushDNSCache()
 
-	return nil
+	// Last, and only on the way out, once no rule of ours is left: during a
+	// session the store is where the rules of this run live, and emptying it
+	// mid-session would have the next rule recreate it anyway. Propagated so a
+	// failure keeps the shutdown state for the next run to retry, rather than
+	// leaving the store to hold up every rule change from here on.
+	return removeEmptyGPOPolicyStore()
 }
 
+// removeDNSMatchPolicies deletes every NRPT rule this client may have created,
+// from the local and the GPO policy store. The rules are found by enumerating
+// the registry, the only authoritative record of what was written. Cleanup must
+// not depend on a rule count: the in-memory one is scoped to a single
+// registryConfigurator and the persisted one is deleted on every clean
+// disconnect, and a rule left behind keeps resolving names over an interface
+// that is gone, until reboot discards the volatile key.
 func (r *registryConfigurator) removeDNSMatchPolicies() error {
 	var merr *multierror.Error
 
-	// Try to remove the base entries (for backward compatibility)
-	if err := removeRegistryKeyFromDNSPolicyConfig(dnsPolicyConfigMatchPath); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove local base entry: %w", err))
-	}
-
-	if err := removeRegistryKeyFromDNSPolicyConfig(gpoDnsPolicyConfigMatchPath); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove GPO base entry: %w", err))
-	}
-
-	for i := 0; i < r.nrptEntryCount; i++ {
-		localPath := fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i)
-		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, i)
-
-		if err := removeRegistryKeyFromDNSPolicyConfig(localPath); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove local entry %d: %w", i, err))
+	for _, root := range []string{DNSPolicyConfigRoot, GPODNSPolicyConfigRoot} {
+		names, err := listNRPTRuleKeys(root)
+		if err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("list rule keys under %s: %w", root, err))
+			continue
 		}
 
-		if err := removeRegistryKeyFromDNSPolicyConfig(gpoPath); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove GPO entry %d: %w", i, err))
+		for _, name := range names {
+			path := root + `\` + name
+			if err := removeRegistryKeyFromDNSPolicyConfig(path); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("remove entry %s: %w", path, err))
+			}
 		}
 	}
 
@@ -554,11 +654,119 @@ func (r *registryConfigurator) restoreUncleanShutdownDNS() error {
 	return r.restoreHostDNS()
 }
 
+// useGPOPolicyStore reports whether NRPT rules have to go into the group policy
+// store, and clears an empty one out of the way first.
+//
+// The order is the point. A store left empty by an earlier run would otherwise
+// decide this run too, sending its rules somewhere the resolver only reads when
+// the policy engine next applies DNS client policy. Removing it before the
+// choice is made leaves the local store authoritative for the whole session,
+// including the first one after an upgrade.
+func useGPOPolicyStore() bool {
+	if err := removeEmptyGPOPolicyStore(); err != nil {
+		// Nothing to retry against here: the worst case is the run going
+		// through the group policy store, which is where it would have gone
+		// before this check existed.
+		log.Warnf("%v", err)
+	}
+
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, GPODNSPolicyConfigRoot, registry.QUERY_VALUE)
+	if err != nil {
+		log.Debugf("failed to open GPO DNS policy root: %v", err)
+		return false
+	}
+	closer(k)
+
+	log.Infof("detected GPO DNS policy configuration, using policy store")
+	return true
+}
+
+// removeEmptyGPOPolicyStore deletes the group policy DnsPolicyConfig key once
+// nothing is left in it. The key survives the deletion of the last rule it
+// held, and the client treats its presence as "group policy configures the
+// NRPT", so an empty one left behind keeps every later run writing rules there.
+// Rules in that store reach the resolver only when the policy engine next
+// applies DNS client policy, and a rule this client writes belongs to no GPO,
+// so nothing schedules that application: both adding and removing a rule are
+// held up by a minute or more, and for a removal that is a catch-all rule
+// resolving every name over an interface that no longer exists. With the store
+// absent the local one is authoritative and a change applies at once.
+//
+// A store that still holds rules, values or subkeys of somebody else's is left
+// alone.
+func removeEmptyGPOPolicyStore() error {
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, GPODNSPolicyConfigRoot, registry.QUERY_VALUE)
+	switch {
+	case errors.Is(err, registry.ErrNotExist), errors.Is(err, syscall.ERROR_PATH_NOT_FOUND):
+		return nil
+	case err != nil:
+		return fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", GPODNSPolicyConfigRoot, err)
+	}
+
+	info, err := k.Stat()
+	closer(k)
+	if err != nil {
+		return fmt.Errorf("stat HKEY_LOCAL_MACHINE\\%s: %w", GPODNSPolicyConfigRoot, err)
+	}
+
+	if info.SubKeyCount != 0 || info.ValueCount != 0 {
+		return nil
+	}
+
+	if err := registry.DeleteKey(registry.LOCAL_MACHINE, GPODNSPolicyConfigRoot); err != nil {
+		return fmt.Errorf("delete empty HKEY_LOCAL_MACHINE\\%s: %w", GPODNSPolicyConfigRoot, err)
+	}
+
+	log.Infof("removed the empty GPO DNS policy store, leaving the local one authoritative")
+	return nil
+}
+
+// listNRPTRuleKeys returns the names of our NRPT rule keys under a policy store
+// root. An absent root holds nothing to clean up, which is the normal state of
+// the GPO store on a machine without DNS Client policy.
+func listNRPTRuleKeys(root string) ([]string, error) {
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, root, registry.ENUMERATE_SUB_KEYS)
+	switch {
+	case errors.Is(err, registry.ErrNotExist), errors.Is(err, syscall.ERROR_PATH_NOT_FOUND):
+		// the GPO store is absent on a machine without DNS client policy
+		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", root)
+		return nil, nil
+	case err != nil:
+		// any other failure has to reach the caller: reporting no rules would
+		// report a successful cleanup while leaving the rules in place
+		return nil, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", root, err)
+	}
+	defer closer(k)
+
+	names, err := k.ReadSubKeyNames(-1)
+	if err != nil {
+		return nil, fmt.Errorf("read subkey names: %w", err)
+	}
+
+	var ruleKeys []string
+	for _, name := range names {
+		// registry key names are case insensitive
+		if strings.HasPrefix(strings.ToLower(name), strings.ToLower(NRPTKeyPrefix)) {
+			ruleKeys = append(ruleKeys, name)
+		}
+	}
+
+	return ruleKeys, nil
+}
+
 func removeRegistryKeyFromDNSPolicyConfig(regKeyPath string) error {
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.QUERY_VALUE)
-	if err != nil {
-		log.Debugf("failed to open HKEY_LOCAL_MACHINE\\%s: %v", regKeyPath, err)
+	switch {
+	case errors.Is(err, registry.ErrNotExist), errors.Is(err, syscall.ERROR_PATH_NOT_FOUND):
+		// nothing to remove, which is the normal case for a rule this config
+		// never installed
+		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", regKeyPath)
 		return nil
+	case err != nil:
+		// anything else has to reach the caller: reporting success here would
+		// leave the rule in force while claiming it was removed, which is how a
+		// stale rule outlives the interface it points at
+		return fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", regKeyPath, err)
 	}
 
 	closer(k)
@@ -585,7 +793,7 @@ func refreshGroupPolicy() error {
 	)
 
 	if ret == 0 {
-		if err != nil && !errors.Is(err, syscall.Errno(0)) {
+		if !errors.Is(err, syscall.Errno(0)) {
 			return fmt.Errorf("RefreshPolicyEx failed: %w", err)
 		}
 		return fmt.Errorf("RefreshPolicyEx failed")
@@ -594,6 +802,20 @@ func refreshGroupPolicy() error {
 	return nil
 }
 
+func parseBoolEnv(key string) bool {
+	val := os.Getenv(key)
+	if val == "" {
+		return false
+	}
+
+	parsed, err := strconv.ParseBool(val)
+	if err != nil {
+		log.Warnf("failed to parse %s=%q: %v", key, val, err)
+		return false
+	}
+	return parsed
+}
+
 func closer(closer io.Closer) {
 	if err := closer.Close(); err != nil {
 		log.Errorf("failed to close: %s", err)
diff --git a/client/internal/dns/host_windows_test.go b/client/internal/dns/host_windows_test.go
index 3cd2b1bd5..353f6adbc 100644
--- a/client/internal/dns/host_windows_test.go
+++ b/client/internal/dns/host_windows_test.go
@@ -8,6 +8,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/sys/windows/registry"
+
+	"github.com/netbirdio/netbird/client/internal/winregistry"
 )
 
 // TestNRPTEntriesCleanupOnConfigChange tests that old NRPT entries are properly cleaned up
@@ -25,7 +27,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
+	interfacePath := InterfaceConfigPath + `\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -56,7 +58,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify 3 NRPT rules exist
-	assert.Equal(t, 3, cfg.nrptEntryCount, "Should create 3 NRPT rules for 125 domains")
+	assert.Equal(t, 3, countNRPTRuleKeys(t), "Should create 3 NRPT rules for 125 domains")
 	for i := 0; i < 3; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -81,7 +83,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify first 2 NRPT rules exist
-	assert.Equal(t, 2, cfg.nrptEntryCount, "Should create 2 NRPT rules for 75 domains")
+	assert.Equal(t, 2, countNRPTRuleKeys(t), "Should create 2 NRPT rules for 75 domains")
 	for i := 0; i < 2; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -94,6 +96,145 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	assert.False(t, exists, "NRPT rule 2 should NOT exist after reducing to 75 domains")
 }
 
+// TestNRPTCatchAllRule verifies that RouteAll adds the root namespace to the
+// match rule instead of a rule of its own, that .local is carved back out with
+// an empty server list, and that both go away when RouteAll is cleared or the
+// host DNS is restored.
+func TestNRPTCatchAllRule(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping registry integration test in short mode")
+	}
+
+	defer cleanupRegistryKeys(t)
+	cleanupRegistryKeys(t)
+
+	testIP := netip.MustParseAddr("100.64.0.1")
+	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
+	interfacePath := InterfaceConfigPath + `\` + testGUID
+	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
+	require.NoError(t, err, "Should create test interface registry key")
+	require.NoError(t, testKey.Close(), "close test interface registry key")
+	defer func() {
+		assert.NoError(t, registry.DeleteKey(registry.LOCAL_MACHINE, interfacePath), "delete test interface registry key")
+	}()
+
+	cfg := &registryConfigurator{guid: testGUID}
+
+	matchOnly := HostDNSConfig{
+		ServerIP: testIP,
+		Domains:  []DomainConfig{{Domain: "example.com", MatchOnly: true}},
+	}
+	primary := HostDNSConfig{
+		ServerIP: testIP,
+		RouteAll: true,
+		Domains:  []DomainConfig{{Domain: "example.com", MatchOnly: true}},
+	}
+	firstRule := fmt.Sprintf("%s-0", dnsPolicyConfigMatchPath)
+
+	// The root namespace is not a rule of its own: it rides in the match rule,
+	// which is the point of it not being a special case.
+	require.NoError(t, cfg.applyDNSConfig(matchOnly, nil))
+	names := ruleNamespaces(t, firstRule)
+	assert.Contains(t, names, ".example.com")
+	assert.NotContains(t, names, nrptCatchAllNamespace, "a match-only config must not claim every namespace")
+
+	require.NoError(t, cfg.applyDNSConfig(primary, nil))
+	names = ruleNamespaces(t, firstRule)
+	assert.Contains(t, names, ".example.com")
+	assert.Contains(t, names, nrptCatchAllNamespace, "RouteAll should add the root namespace to the match rule")
+
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, firstRule, registry.QUERY_VALUE)
+	require.NoError(t, err)
+	servers, _, err := k.GetStringValue(dnsPolicyConfigGenericDNSServersKey)
+	require.NoError(t, err)
+	assert.Equal(t, testIP.String(), servers, "every namespace in the rule resolves through our resolver")
+	require.NoError(t, k.Close(), "close match rule key")
+
+	// .local is carved back out: RFC 6762 reserves it for mDNS, so it needs a
+	// rule of its own — it is the one rule with a different server list.
+	ek, err := registry.OpenKey(registry.LOCAL_MACHINE, dnsPolicyConfigExemptLocalPath, registry.QUERY_VALUE)
+	require.NoError(t, err, "exemption rule should exist once the root namespace is claimed")
+
+	exemptNames, _, err := ek.GetStringsValue(dnsPolicyConfigNameKey)
+	require.NoError(t, err)
+	assert.Equal(t, []string{nrptLocalNamespace}, exemptNames, "the exemption should name only the mDNS namespace")
+
+	exemptServers, _, err := ek.GetStringValue(dnsPolicyConfigGenericDNSServersKey)
+	require.NoError(t, err, "the value has to be present, empty: without it Windows drops the rule")
+	assert.Empty(t, exemptServers, "an exemption rule lists no servers")
+
+	exemptOpts, _, err := ek.GetIntegerValue(dnsPolicyConfigConfigOptionsKey)
+	require.NoError(t, err)
+	assert.EqualValues(t, dnsPolicyConfigConfigOptionsValue, exemptOpts, "same options as a normal rule; the empty server list is what makes it an exemption")
+	require.NoError(t, ek.Close(), "close exemption rule key")
+
+	require.NoError(t, cfg.applyDNSConfig(matchOnly, nil))
+	names = ruleNamespaces(t, firstRule)
+	assert.NotContains(t, names, nrptCatchAllNamespace, "clearing RouteAll should drop the root namespace")
+
+	exists, err := registryKeyExists(dnsPolicyConfigExemptLocalPath)
+	require.NoError(t, err)
+	assert.False(t, exists, "exemption rule should go with the namespace it carves out of")
+
+	require.NoError(t, cfg.applyDNSConfig(primary, nil))
+	require.NoError(t, cfg.restoreHostDNS())
+	exists, err = registryKeyExists(firstRule)
+	require.NoError(t, err)
+	assert.False(t, exists, "restore should leave no rule behind")
+}
+
+// ruleNamespaces returns the namespaces an NRPT rule key claims.
+func ruleNamespaces(t *testing.T, path string) []string {
+	t.Helper()
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.QUERY_VALUE)
+	require.NoError(t, err, "rule key %s should exist", path)
+	defer k.Close()
+
+	names, _, err := k.GetStringsValue(dnsPolicyConfigNameKey)
+	require.NoError(t, err)
+	return names
+}
+
+// TestNRPTCatchAllRuleLegacyEnv verifies that NB_USE_LEGACY_DNS_RESOLUTION
+// leaves the root namespace unclaimed, so no rule is written for a RouteAll
+// config that carries no match domains.
+func TestNRPTCatchAllRuleLegacyEnv(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping registry integration test in short mode")
+	}
+
+	defer cleanupRegistryKeys(t)
+	cleanupRegistryKeys(t)
+
+	t.Setenv(envLegacyDNSResolution, "true")
+
+	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
+	interfacePath := InterfaceConfigPath + `\` + testGUID
+	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
+	require.NoError(t, err, "Should create test interface registry key")
+	require.NoError(t, testKey.Close(), "close test interface registry key")
+	defer func() {
+		assert.NoError(t, registry.DeleteKey(registry.LOCAL_MACHINE, interfacePath), "delete test interface registry key")
+	}()
+
+	cfg := &registryConfigurator{guid: testGUID}
+	config := HostDNSConfig{
+		ServerIP: netip.MustParseAddr("100.64.0.1"),
+		RouteAll: true,
+	}
+
+	require.NoError(t, cfg.applyDNSConfig(config, nil))
+
+	// RouteAll with no match domains and the switch set leaves nothing to write.
+	exists, err := registryKeyExists(fmt.Sprintf("%s-0", dnsPolicyConfigMatchPath))
+	require.NoError(t, err)
+	assert.False(t, exists, "no rule should be written when the legacy env var is set")
+
+	exists, err = registryKeyExists(dnsPolicyConfigExemptLocalPath)
+	require.NoError(t, err)
+	assert.False(t, exists, "no exemption without a claimed root namespace")
+}
+
 func registryKeyExists(path string) (bool, error) {
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.QUERY_VALUE)
 	if err != nil {
@@ -106,9 +247,65 @@ func registryKeyExists(path string) (bool, error) {
 	return true, nil
 }
 
+// TestNRPTCleanupWithoutRuleCount verifies that rules written by a previous run
+// are removed by a configurator that has no record of how many there are: an
+// unclean exit loses the in-memory count and a clean disconnect deletes the
+// persisted one, so cleanup cannot depend on either.
+func TestNRPTCleanupWithoutRuleCount(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping registry integration test in short mode")
+	}
+
+	defer cleanupRegistryKeys(t)
+	cleanupRegistryKeys(t)
+
+	testIP := netip.MustParseAddr("100.64.0.1")
+
+	// 75 domains produce two indexed rules, as the current layout does
+	domains := make([]string, 75)
+	for i := range domains {
+		domains[i] = fmt.Sprintf(".domain%d.com", i+1)
+	}
+
+	previousRun := &registryConfigurator{}
+	require.NoError(t, previousRun.addDNSMatchPolicy(domains, testIP))
+
+	// the unsuffixed key an older version would have written
+	require.NoError(t, previousRun.configureDNSPolicy(dnsPolicyConfigMatchPath, []string{".legacy.example.com"}, testIP))
+
+	// a policy owned by someone else, which cleanup must not touch
+	foreignPath := DNSPolicyConfigRoot + `\DnsPolicyConfigTestForeign`
+	foreignKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, foreignPath, registry.SET_VALUE)
+	require.NoError(t, err, "Should create foreign policy key")
+	foreignKey.Close()
+	defer func() {
+		_ = registry.DeleteKey(registry.LOCAL_MACHINE, foreignPath)
+	}()
+
+	require.Equal(t, 3, countNRPTRuleKeys(t), "Should have two indexed rules and the legacy one")
+
+	// a configurator that never applied a DNS config, as one built after a
+	// restart or from a shutdown state without a count is
+	freshRun := &registryConfigurator{}
+	require.NoError(t, freshRun.removeDNSMatchPolicies())
+
+	assert.Equal(t, 0, countNRPTRuleKeys(t), "Should remove every rule left by the previous run")
+
+	exists, err := registryKeyExists(foreignPath)
+	require.NoError(t, err)
+	assert.True(t, exists, "Should not remove a policy that is not ours")
+}
+
+func countNRPTRuleKeys(t *testing.T) int {
+	t.Helper()
+
+	names, err := listNRPTRuleKeys(DNSPolicyConfigRoot)
+	require.NoError(t, err, "Should list NRPT rule keys")
+	return len(names)
+}
+
 func cleanupRegistryKeys(*testing.T) {
-	// Clean up more entries to account for batching tests with many domains
-	cfg := &registryConfigurator{nrptEntryCount: 20}
+	cfg := &registryConfigurator{}
 	_ = cfg.removeDNSMatchPolicies()
 }
 
@@ -125,7 +322,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
+	interfacePath := InterfaceConfigPath + `\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -193,7 +390,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 			require.NoError(t, err)
 
 			// Verify that exactly expectedRuleCount rules were created
-			assert.Equal(t, tc.expectedRuleCount, cfg.nrptEntryCount,
+			assert.Equal(t, tc.expectedRuleCount, countNRPTRuleKeys(t),
 				"Should create %d NRPT rules for %d domains", tc.expectedRuleCount, tc.domainCount)
 
 			// Verify all expected rules exist
@@ -210,3 +407,130 @@ func TestNRPTDomainBatching(t *testing.T) {
 		})
 	}
 }
+
+// TestRemoveEmptyGPOPolicyStore verifies that cleanup takes the GPO policy
+// store itself with it once our rules are gone, since the store existing keeps
+// the local one from being applied, and that a store with somebody else's rule
+// in it is left alone.
+func TestRemoveEmptyGPOPolicyStore(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping registry integration test in short mode")
+	}
+
+	t.Cleanup(func() { cleanupRegistryKeys(t) })
+	cleanupRegistryKeys(t)
+
+	testIP := netip.MustParseAddr("100.64.0.1")
+	cfg := &registryConfigurator{gpo: true}
+
+	// a store holding a rule of ours is kept, because the rule is still applied
+	require.NoError(t, cfg.addDNSMatchPolicy([]string{".example.com"}, testIP))
+	exists, err := registryKeyExists(gpoDnsPolicyConfigMatchPath + "-0")
+	require.NoError(t, err)
+	require.True(t, exists, "Should write the rule to the GPO policy store")
+
+	require.NoError(t, removeEmptyGPOPolicyStore())
+	exists, err = registryKeyExists(GPODNSPolicyConfigRoot)
+	require.NoError(t, err)
+	assert.True(t, exists, "Should keep a policy store that still holds a rule")
+
+	// once the rules are gone the store goes with them
+	require.NoError(t, cfg.removeDNSMatchPolicies())
+	require.NoError(t, removeEmptyGPOPolicyStore())
+
+	exists, err = registryKeyExists(GPODNSPolicyConfigRoot)
+	require.NoError(t, err)
+	assert.False(t, exists, "Should remove the GPO policy store once it is empty")
+
+	// A store is not ours to remove while somebody else has a rule in it. The
+	// rule is written volatile like our own: the rules above created the parent
+	// chain volatile, and Windows refuses a stable subkey under a volatile
+	// parent.
+	foreignRule := GPODNSPolicyConfigRoot + `\{2A3B4C5D-6E7F-4041-8283-84858687888A}`
+	foreignKey, _, err := winregistry.CreateVolatileKey(registry.LOCAL_MACHINE, foreignRule, registry.SET_VALUE)
+	require.NoError(t, err, "Should create a foreign GPO rule")
+	foreignKey.Close()
+	t.Cleanup(func() {
+		_ = registry.DeleteKey(registry.LOCAL_MACHINE, foreignRule)
+		_ = registry.DeleteKey(registry.LOCAL_MACHINE, GPODNSPolicyConfigRoot)
+	})
+
+	require.NoError(t, cfg.removeDNSMatchPolicies())
+	require.NoError(t, removeEmptyGPOPolicyStore())
+
+	exists, err = registryKeyExists(foreignRule)
+	require.NoError(t, err)
+	assert.True(t, exists, "Should not remove a foreign rule")
+	exists, err = registryKeyExists(GPODNSPolicyConfigRoot)
+	require.NoError(t, err)
+	assert.True(t, exists, "Should keep a policy store that still holds a foreign rule")
+}
+
+// TestDeleteInterfaceRegistryKeyPropertyTwice verifies that removing a value
+// that is already gone, or one on an interface key that is, reports success.
+// Teardown runs again after a failed cleanup, and the steps that follow this
+// one have to be reached on that second run.
+func TestDeleteInterfaceRegistryKeyPropertyTwice(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping registry integration test in short mode")
+	}
+
+	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
+	interfacePath := InterfaceConfigPath + `\` + testGUID
+	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
+	require.NoError(t, err, "Should create test interface registry key")
+	testKey.Close()
+	t.Cleanup(func() {
+		_ = registry.DeleteKey(registry.LOCAL_MACHINE, interfacePath)
+	})
+
+	cfg := &registryConfigurator{guid: testGUID}
+
+	require.NoError(t, cfg.setInterfaceRegistryKeyStringValue(interfaceConfigSearchListKey, "example.com"))
+	require.NoError(t, cfg.deleteInterfaceRegistryKeyProperty(interfaceConfigSearchListKey))
+	assert.NoError(t, cfg.deleteInterfaceRegistryKeyProperty(interfaceConfigSearchListKey),
+		"Should report success for a value that is already gone")
+
+	// and with the interface key itself gone, as it is once the adapter is
+	require.NoError(t, registry.DeleteKey(registry.LOCAL_MACHINE, interfacePath))
+	assert.NoError(t, cfg.deleteInterfaceRegistryKeyProperty(interfaceConfigSearchListKey),
+		"Should report success when the interface key does not exist")
+}
+
+// TestUseGPOPolicyStoreClearsEmptyStore verifies that the store is cleared
+// before it is consulted, so an empty one left by an earlier run does not send
+// this run's rules to the group policy store. A store somebody else has a rule
+// in still decides where the rules go.
+func TestUseGPOPolicyStoreClearsEmptyStore(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping registry integration test in short mode")
+	}
+
+	t.Cleanup(func() { cleanupRegistryKeys(t) })
+	cleanupRegistryKeys(t)
+
+	// the leftover an earlier run used to keep, which the client read as
+	// "group policy configures the NRPT" for every run after it
+	emptyStore, _, err := winregistry.CreateVolatileKey(registry.LOCAL_MACHINE, GPODNSPolicyConfigRoot, registry.SET_VALUE)
+	require.NoError(t, err, "Should create the GPO policy store")
+	emptyStore.Close()
+
+	assert.False(t, useGPOPolicyStore(), "An empty store should not decide where the rules go")
+	exists, err := registryKeyExists(GPODNSPolicyConfigRoot)
+	require.NoError(t, err)
+	assert.False(t, exists, "Should clear the empty store before consulting it")
+
+	foreignRule := GPODNSPolicyConfigRoot + `\{2A3B4C5D-6E7F-4041-8283-84858687888A}`
+	foreignKey, _, err := winregistry.CreateVolatileKey(registry.LOCAL_MACHINE, foreignRule, registry.SET_VALUE)
+	require.NoError(t, err, "Should create a foreign GPO rule")
+	foreignKey.Close()
+	t.Cleanup(func() {
+		_ = registry.DeleteKey(registry.LOCAL_MACHINE, foreignRule)
+		_ = registry.DeleteKey(registry.LOCAL_MACHINE, GPODNSPolicyConfigRoot)
+	})
+
+	assert.True(t, useGPOPolicyStore(), "A store holding a rule should decide where the rules go")
+	exists, err = registryKeyExists(GPODNSPolicyConfigRoot)
+	require.NoError(t, err)
+	assert.True(t, exists, "Should keep a store that holds a rule")
+}
diff --git a/client/internal/dns/interface_index.go b/client/internal/dns/interface_index.go
new file mode 100644
index 000000000..9e7dca080
--- /dev/null
+++ b/client/internal/dns/interface_index.go
@@ -0,0 +1,15 @@
+package dns
+
+import (
+	"fmt"
+	"net"
+)
+
+func getInterfaceIndex(interfaceName string) (int, error) {
+	iface, err := net.InterfaceByName(interfaceName)
+	if err != nil {
+		return 0, fmt.Errorf("lookup interface %q: %w", interfaceName, err)
+	}
+
+	return iface.Index, nil
+}
diff --git a/client/internal/dns/interface_index_test.go b/client/internal/dns/interface_index_test.go
new file mode 100644
index 000000000..9b146398a
--- /dev/null
+++ b/client/internal/dns/interface_index_test.go
@@ -0,0 +1,35 @@
+package dns
+
+import (
+	"net"
+	"testing"
+)
+
+func TestGetInterfaceIndexExisting(t *testing.T) {
+	interfaces, err := net.Interfaces()
+	if err != nil {
+		t.Fatalf("list network interfaces: %v", err)
+	}
+	if len(interfaces) == 0 {
+		t.Fatal("expected at least one network interface")
+	}
+
+	iface := interfaces[0]
+	index, err := getInterfaceIndex(iface.Name)
+	if err != nil {
+		t.Fatalf("look up existing interface %q: %v", iface.Name, err)
+	}
+	if index != iface.Index {
+		t.Fatalf("expected interface index %d, got %d", iface.Index, index)
+	}
+}
+
+func TestGetInterfaceIndexMissing(t *testing.T) {
+	index, err := getInterfaceIndex("netbird-interface-that-does-not-exist")
+	if index != 0 {
+		t.Fatalf("expected missing interface index to be 0, got %d", index)
+	}
+	if err == nil {
+		t.Fatal("expected missing interface lookup to return an error")
+	}
+}
diff --git a/client/internal/dns/local/local.go b/client/internal/dns/local/local.go
index d0268186c..fef35fd41 100644
--- a/client/internal/dns/local/local.go
+++ b/client/internal/dns/local/local.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
+	"os"
 	"slices"
 	"strings"
 	"sync"
@@ -36,7 +37,43 @@ type resolver interface {
 // record is left alone (it points at something outside our mesh, e.g.
 // a non-peer upstream).
 type PeerConnectivity interface {
-	IsConnectedByIP(ip string) (known, connected bool)
+	IsConnectedByIP(ip netip.Addr) (known, connected bool)
+}
+
+// PeerActivator wakes lazy-connection peers on demand. The local resolver calls
+// it with the tunnel IPs an answer points at, so a peer that is idle (lazily
+// disconnected) starts connecting at DNS-resolution time rather than racing the
+// client's first request packet. nil disables warm-up.
+type PeerActivator interface {
+	// ActivatePeersByIP triggers wake-up for the peer(s) owning addrs and blocks
+	// until one is connected or ctx (a short per-query budget) expires. It is a
+	// fast no-op for unknown or already-connected addresses.
+	ActivatePeersByIP(ctx context.Context, addrs []netip.Addr)
+}
+
+const (
+	defaultLazyWarmupTimeout = 2 * time.Second
+	envLazyWarmupTimeout     = "NB_DNS_LAZY_WARMUP_TIMEOUT"
+)
+
+// lazyWarmupTimeoutFromEnv returns the per-query budget for waking a
+// lazy-connection peer a DNS answer points at. Tunable via
+// NB_DNS_LAZY_WARMUP_TIMEOUT (a Go duration). Parsed once at construction time.
+func lazyWarmupTimeoutFromEnv() time.Duration {
+	v := os.Getenv(envLazyWarmupTimeout)
+	if v == "" {
+		return defaultLazyWarmupTimeout
+	}
+	d, err := time.ParseDuration(v)
+	if err != nil {
+		log.Warnf("invalid %s value %q, using default %s: %v", envLazyWarmupTimeout, v, defaultLazyWarmupTimeout, err)
+		return defaultLazyWarmupTimeout
+	}
+	if d <= 0 {
+		log.Warnf("non-positive %s value %q, using default %s", envLazyWarmupTimeout, v, defaultLazyWarmupTimeout)
+		return defaultLazyWarmupTimeout
+	}
+	return d
 }
 
 type Resolver struct {
@@ -51,6 +88,12 @@ type Resolver struct {
 	// filter and preserves the legacy "return whatever is registered"
 	// behaviour for callers that never wire a status source.
 	peerConn PeerConnectivity
+	// peerActivator, when non-nil, is called at resolution time to warm the
+	// lazy connection to the peer(s) an answer points at. nil disables warm-up.
+	peerActivator PeerActivator
+	// warmupTimeout is the per-query budget for the lazy-connection warm-up
+	// wait, resolved from the environment once at construction time.
+	warmupTimeout time.Duration
 
 	ctx    context.Context
 	cancel context.CancelFunc
@@ -59,11 +102,12 @@ type Resolver struct {
 func NewResolver() *Resolver {
 	ctx, cancel := context.WithCancel(context.Background())
 	return &Resolver{
-		records: make(map[dns.Question][]dns.RR),
-		domains: make(map[domain.Domain]struct{}),
-		zones:   make(map[domain.Domain]bool),
-		ctx:     ctx,
-		cancel:  cancel,
+		records:       make(map[dns.Question][]dns.RR),
+		domains:       make(map[domain.Domain]struct{}),
+		zones:         make(map[domain.Domain]bool),
+		warmupTimeout: lazyWarmupTimeoutFromEnv(),
+		ctx:           ctx,
+		cancel:        cancel,
 	}
 }
 
@@ -76,6 +120,14 @@ func (d *Resolver) SetPeerConnectivity(p PeerConnectivity) {
 	d.peerConn = p
 }
 
+// SetPeerActivator wires the DNS-time lazy-connection warm-up. Pass nil to
+// disable. Safe to call multiple times; the latest value wins.
+func (d *Resolver) SetPeerActivator(a PeerActivator) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	d.peerActivator = a
+}
+
 func (d *Resolver) MatchSubdomains() bool {
 	return true
 }
@@ -122,6 +174,9 @@ func (d *Resolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 	replyMessage.RecursionAvailable = true
 
 	result := d.lookupRecords(logger, question)
+	// Warm before filtering: activation flips a lazily-idle target to connected,
+	// which then lets it survive the disconnected-peer filter below.
+	d.warmLazyPeers(question, result.records)
 	result.records = d.filterDisconnectedPeerAnswers(logger, question, result.records)
 	replyMessage.Authoritative = !result.hasExternalData
 	replyMessage.Answer = result.records
@@ -495,8 +550,8 @@ func (d *Resolver) filterDisconnectedPeerAnswers(logger *log.Entry, question dns
 	kept := make([]dns.RR, 0, len(records))
 	var dropped int
 	for _, rr := range records {
-		ip := extractRecordIP(rr)
-		if ip == "" {
+		ip, ok := extractRecordAddr(rr)
+		if !ok {
 			kept = append(kept, rr)
 			continue
 		}
@@ -518,22 +573,57 @@ func (d *Resolver) filterDisconnectedPeerAnswers(logger *log.Entry, question dns
 	return kept
 }
 
-// extractRecordIP returns the dotted-decimal / colon-hex IP carried by
-// an A or AAAA record, or "" for any other record type.
-func extractRecordIP(rr dns.RR) string {
+// warmLazyPeers triggers lazy-connection wake-up for the peers a resolved
+// answer points at and waits briefly for one to connect, so the caller's first
+// request doesn't race the connection establishment. Warm-up is scoped to
+// match-only (non-authoritative) zones — the synthesized private-service zones
+// and user-created zones whose records point at specific peers. The account's
+// peer zone is authoritative, so plain peer-name lookups never trigger warm-up;
+// otherwise resolving any peer's name would wake its idle connection, defeating
+// laziness mesh-wide. No-op when no activator is wired (lazy connections
+// disabled) or the answer carries no peer IPs.
+func (d *Resolver) warmLazyPeers(question dns.Question, records []dns.RR) {
+	if len(records) < 2 {
+		return
+	}
+	d.mu.RLock()
+	activator := d.peerActivator
+	var nonAuth, found bool
+	if activator != nil {
+		nonAuth, found = d.findZone(question.Name)
+	}
+	d.mu.RUnlock()
+	if activator == nil || !found || !nonAuth {
+		return
+	}
+
+	var addrs []netip.Addr
+	for _, rr := range records {
+		if addr, ok := extractRecordAddr(rr); ok {
+			addrs = append(addrs, addr)
+		}
+	}
+	if len(addrs) == 0 {
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(d.ctx, d.warmupTimeout)
+	defer cancel()
+	activator.ActivatePeersByIP(ctx, addrs)
+}
+
+// extractRecordAddr returns the IP address carried by an A or AAAA record.
+// ok is false for any other record type or a record with no address.
+func extractRecordAddr(rr dns.RR) (netip.Addr, bool) {
 	switch r := rr.(type) {
 	case *dns.A:
-		if r.A == nil {
-			return ""
-		}
-		return r.A.String()
+		addr, ok := netip.AddrFromSlice(r.A)
+		return addr.Unmap(), ok
 	case *dns.AAAA:
-		if r.AAAA == nil {
-			return ""
-		}
-		return r.AAAA.String()
+		addr, ok := netip.AddrFromSlice(r.AAAA)
+		return addr.Unmap(), ok
 	}
-	return ""
+	return netip.Addr{}, false
 }
 
 // Update replaces all zones and their records
diff --git a/client/internal/dns/local/local_test.go b/client/internal/dns/local/local_test.go
index 9b7dac231..89e896c0a 100644
--- a/client/internal/dns/local/local_test.go
+++ b/client/internal/dns/local/local_test.go
@@ -37,8 +37,8 @@ type mockPeerConnectivity struct {
 	byIP map[string]struct{ known, connected bool }
 }
 
-func (m mockPeerConnectivity) IsConnectedByIP(ip string) (known, connected bool) {
-	v, ok := m.byIP[ip]
+func (m mockPeerConnectivity) IsConnectedByIP(ip netip.Addr) (known, connected bool) {
+	v, ok := m.byIP[ip.String()]
 	if !ok {
 		return false, false
 	}
diff --git a/client/internal/dns/local/warmup_test.go b/client/internal/dns/local/warmup_test.go
new file mode 100644
index 000000000..0e77aa963
--- /dev/null
+++ b/client/internal/dns/local/warmup_test.go
@@ -0,0 +1,204 @@
+package local
+
+import (
+	"context"
+	"net"
+	"net/netip"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/dns/test"
+	nbdns "github.com/netbirdio/netbird/dns"
+)
+
+// recordingActivator records the addresses it was asked to warm and returns
+// immediately, so ServeDNS is not blocked by the test.
+type recordingActivator struct {
+	mu     sync.Mutex
+	called bool
+	addrs  []netip.Addr
+}
+
+func (r *recordingActivator) ActivatePeersByIP(_ context.Context, addrs []netip.Addr) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.called = true
+	r.addrs = append(r.addrs, addrs...)
+}
+
+func serveA(t *testing.T, resolver *Resolver, name string) *dns.Msg {
+	t.Helper()
+	var resp *dns.Msg
+	w := &test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}
+	resolver.ServeDNS(w, new(dns.Msg).SetQuestion(name, dns.TypeA))
+	return resp
+}
+
+// serviceZone registers rec in a match-only (non-authoritative) zone, the shape
+// the synthesized private-service zones arrive in.
+func serviceZone(t *testing.T, resolver *Resolver, zone string, records ...nbdns.SimpleRecord) {
+	t.Helper()
+	resolver.Update([]nbdns.CustomZone{{
+		Domain:           zone,
+		Records:          records,
+		NonAuthoritative: true,
+	}})
+}
+
+func TestLocalResolver_WarmsLazyPeerOnResolve(t *testing.T) {
+	// Warm-up fires only for multi-record answers (the HA / round-robin shape of
+	// the synthesized private-service zones), so register two peer targets.
+	const name = "svc.proxy.netbird.cloud."
+	recs := []nbdns.SimpleRecord{
+		{Name: name, Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"},
+		{Name: name, Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.8"},
+	}
+	resolver := NewResolver()
+	serviceZone(t, resolver, "proxy.netbird.cloud", recs...)
+
+	act := &recordingActivator{}
+	resolver.SetPeerActivator(act)
+
+	resp := serveA(t, resolver, name)
+	require.NotNil(t, resp, "resolver must answer")
+	require.NotEmpty(t, resp.Answer, "answer must carry the A records")
+
+	act.mu.Lock()
+	defer act.mu.Unlock()
+	assert.True(t, act.called, "activator must be invoked for a multi-record service-zone answer")
+	assert.Contains(t, act.addrs, netip.MustParseAddr("100.64.0.7"), "activator must receive the first peer IP")
+	assert.Contains(t, act.addrs, netip.MustParseAddr("100.64.0.8"), "activator must receive the second peer IP")
+}
+
+func TestLocalResolver_NoWarmupForSingleRecord(t *testing.T) {
+	// A single-record answer does not trigger warm-up; the resolver only warms
+	// multi-record answers.
+	rec := nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"}
+	resolver := NewResolver()
+	serviceZone(t, resolver, "proxy.netbird.cloud", rec)
+
+	act := &recordingActivator{}
+	resolver.SetPeerActivator(act)
+
+	resp := serveA(t, resolver, rec.Name)
+	require.NotNil(t, resp, "resolver must answer")
+	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
+
+	act.mu.Lock()
+	defer act.mu.Unlock()
+	assert.False(t, act.called, "activator must not be invoked for a single-record answer")
+}
+
+func TestLocalResolver_NoActivatorNoWarmup(t *testing.T) {
+	// With no activator wired the resolver behaves exactly as before.
+	rec := nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"}
+	resolver := NewResolver()
+	serviceZone(t, resolver, "proxy.netbird.cloud", rec)
+
+	resp := serveA(t, resolver, rec.Name)
+	require.NotNil(t, resp, "resolver must still answer without an activator")
+	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
+}
+
+func TestLocalResolver_NoWarmupForMissingRecord(t *testing.T) {
+	// A query that resolves to nothing must not invoke the activator (no IPs).
+	resolver := NewResolver()
+	serviceZone(t, resolver, "proxy.netbird.cloud",
+		nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"})
+
+	act := &recordingActivator{}
+	resolver.SetPeerActivator(act)
+
+	serveA(t, resolver, "absent.proxy.netbird.cloud.")
+
+	act.mu.Lock()
+	defer act.mu.Unlock()
+	assert.False(t, act.called, "activator must not be invoked when there is no answer")
+}
+
+func TestLocalResolver_NoWarmupInAuthoritativeZone(t *testing.T) {
+	// The account's peer zone is authoritative; resolving a peer's name there
+	// must not wake its lazy connection — warm-up is scoped to match-only
+	// (non-authoritative) zones such as the synthesized private-service zones.
+	// Use a multi-record answer so the authoritative-zone scoping is the only
+	// reason warm-up is skipped, not the single-record guard.
+	const name = "peer.netbird.cloud."
+	recs := []nbdns.SimpleRecord{
+		{Name: name, Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.9"},
+		{Name: name, Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.10"},
+	}
+	resolver := NewResolver()
+	resolver.Update([]nbdns.CustomZone{{
+		Domain:  "netbird.cloud",
+		Records: recs,
+	}})
+
+	act := &recordingActivator{}
+	resolver.SetPeerActivator(act)
+
+	resp := serveA(t, resolver, name)
+	require.NotNil(t, resp, "resolver must answer")
+	require.NotEmpty(t, resp.Answer, "answer must carry the A records")
+
+	act.mu.Lock()
+	defer act.mu.Unlock()
+	assert.False(t, act.called, "activator must not be invoked for authoritative-zone answers")
+}
+
+func TestLazyWarmupTimeoutFromEnv(t *testing.T) {
+	tests := []struct {
+		name   string
+		value  string
+		envSet bool
+		want   time.Duration
+	}{
+		{name: "unset uses default", want: defaultLazyWarmupTimeout},
+		{name: "valid overrides", value: "5s", envSet: true, want: 5 * time.Second},
+		{name: "invalid falls back", value: "not-a-duration", envSet: true, want: defaultLazyWarmupTimeout},
+		{name: "negative falls back", value: "-1s", envSet: true, want: defaultLazyWarmupTimeout},
+		{name: "zero falls back", value: "0s", envSet: true, want: defaultLazyWarmupTimeout},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.envSet {
+				t.Setenv(envLazyWarmupTimeout, tt.value)
+			}
+			assert.Equal(t, tt.want, lazyWarmupTimeoutFromEnv())
+			assert.Equal(t, tt.want, NewResolver().warmupTimeout, "constructor must resolve the timeout once")
+		})
+	}
+}
+
+func TestExtractRecordAddr(t *testing.T) {
+	t.Run("A record yields unmapped v4", func(t *testing.T) {
+		// net.ParseIP returns the 16-byte v4-in-v6 form, the same shape
+		// miekg/dns stores after parsing an A record; the extracted address
+		// must compare equal to a plain v4 netip.Addr.
+		addr, ok := extractRecordAddr(&dns.A{A: net.ParseIP("100.64.0.7")})
+		require.True(t, ok)
+		assert.True(t, addr.Is4())
+		assert.Equal(t, netip.MustParseAddr("100.64.0.7"), addr)
+	})
+
+	t.Run("AAAA record yields v6", func(t *testing.T) {
+		addr, ok := extractRecordAddr(&dns.AAAA{AAAA: net.ParseIP("fd00::1")})
+		require.True(t, ok)
+		assert.Equal(t, netip.MustParseAddr("fd00::1"), addr)
+	})
+
+	t.Run("A record without address", func(t *testing.T) {
+		_, ok := extractRecordAddr(&dns.A{})
+		assert.False(t, ok)
+	})
+
+	t.Run("non-address record", func(t *testing.T) {
+		_, ok := extractRecordAddr(&dns.CNAME{Target: "target.netbird.cloud."})
+		assert.False(t, ok)
+	})
+}
diff --git a/client/internal/dns/mgmt/mgmt_refresh_test.go b/client/internal/dns/mgmt/mgmt_refresh_test.go
index 64a5342e2..0e3e6ab36 100644
--- a/client/internal/dns/mgmt/mgmt_refresh_test.go
+++ b/client/internal/dns/mgmt/mgmt_refresh_test.go
@@ -224,6 +224,7 @@ func TestResolver_StaleTriggersAsyncRefresh(t *testing.T) {
 }
 
 func TestResolver_ConcurrentStaleHitsCollapseRefresh(t *testing.T) {
+	semaphore := make(chan struct{})
 	r := NewResolver()
 	chain := newFakeChain()
 	chain.setAnswer("mgmt.example.com.", dns.TypeA, "10.0.0.2")
@@ -239,7 +240,7 @@ func TestResolver_ConcurrentStaleHitsCollapseRefresh(t *testing.T) {
 				break
 			}
 		}
-		time.Sleep(50 * time.Millisecond) // hold inflight long enough to collide
+		<-semaphore // block the call to force request collision
 	}
 
 	r.SetChainResolver(chain, 50)
@@ -255,17 +256,17 @@ func TestResolver_ConcurrentStaleHitsCollapseRefresh(t *testing.T) {
 
 	var wg sync.WaitGroup
 	for i := 0; i < 50; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
+		wg.Go(func() {
 			queryA(t, r, "mgmt.example.com.")
-		}()
+		})
 	}
+
+	assert.Eventually(t, func() bool { return inflight.Load() >= 1 }, 2*time.Second, 100*time.Millisecond)
+
+	close(semaphore)
 	wg.Wait()
 
-	waitFor(t, 2*time.Second, func() bool {
-		return inflight.Load() == 0
-	})
+	assert.Eventually(t, func() bool { return inflight.Load() == 0 }, 2*time.Second, 100*time.Millisecond)
 
 	calls := chain.callCount("mgmt.example.com.", dns.TypeA)
 	assert.LessOrEqual(t, calls, 2, "singleflight must collapse concurrent refreshes (got %d)", calls)
diff --git a/client/internal/dns/mock_server.go b/client/internal/dns/mock_server.go
index 31fedd9e5..b19862c2f 100644
--- a/client/internal/dns/mock_server.go
+++ b/client/internal/dns/mock_server.go
@@ -8,6 +8,7 @@ import (
 	"github.com/miekg/dns"
 
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
+	"github.com/netbirdio/netbird/client/internal/dns/local"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -92,6 +93,11 @@ func (m *MockServer) SetFirewall(Firewall) {
 	// Mock implementation - no-op
 }
 
+// SetPeerActivator mock implementation of SetPeerActivator from Server interface
+func (m *MockServer) SetPeerActivator(local.PeerActivator) {
+	// Mock implementation - no-op
+}
+
 // BeginBatch mock implementation of BeginBatch from Server interface
 func (m *MockServer) BeginBatch() {
 	// Mock implementation - no-op
diff --git a/client/internal/dns/notifier.go b/client/internal/dns/notifier.go
index 35cb6ff82..79d924a78 100644
--- a/client/internal/dns/notifier.go
+++ b/client/internal/dns/notifier.go
@@ -51,7 +51,5 @@ func (n *notifier) notify() {
 		return
 	}
 
-	go func(l listener.NetworkChangeListener) {
-		l.OnNetworkChanged("")
-	}(n.listener)
+	n.listener.OnNetworkChanged("")
 }
diff --git a/client/internal/dns/response_writer_test.go b/client/internal/dns/response_writer_test.go
index 857964406..bc8416029 100644
--- a/client/internal/dns/response_writer_test.go
+++ b/client/internal/dns/response_writer_test.go
@@ -4,7 +4,7 @@ import (
 	"net"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/miekg/dns"
diff --git a/client/internal/dns/server.go b/client/internal/dns/server.go
index 7556c66cc..3af912792 100644
--- a/client/internal/dns/server.go
+++ b/client/internal/dns/server.go
@@ -82,6 +82,7 @@ type Server interface {
 	PopulateManagementDomain(mgmtURL *url.URL) error
 	SetRouteSources(selected, active func() route.HAMap)
 	SetFirewall(Firewall)
+	SetPeerActivator(local.PeerActivator)
 }
 
 type nsGroupsByDomain struct {
@@ -251,7 +252,7 @@ func NewDefaultServerPermanentUpstream(
 	ds.hostsDNSHolder.set(hostsDnsList)
 	ds.permanent = true
 	ds.currentConfig = dnsConfigToHostDNSConfig(config, ds.service.RuntimeIP(), ds.service.RuntimePort())
-	ds.searchDomainNotifier = newNotifier(ds.SearchDomains())
+	ds.searchDomainNotifier = newNotifier(ds.searchDomains())
 	ds.searchDomainNotifier.setListener(listener)
 	setServerDns(ds)
 	return ds
@@ -491,6 +492,13 @@ func (s *DefaultServer) SetFirewall(fw Firewall) {
 	}
 }
 
+// SetPeerActivator wires the DNS-time lazy-connection warm-up on the local
+// resolver. Injected after the connection manager exists (it does not at
+// DNS-server construction time). Pass nil to disable.
+func (s *DefaultServer) SetPeerActivator(a local.PeerActivator) {
+	s.localResolver.SetPeerActivator(a)
+}
+
 // Stop stops the server
 func (s *DefaultServer) Stop() {
 	s.ctxCancel()
@@ -594,6 +602,12 @@ func (s *DefaultServer) UpdateDNSServer(serial uint64, update nbdns.Config) erro
 }
 
 func (s *DefaultServer) SearchDomains() []string {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	return s.searchDomains()
+}
+
+func (s *DefaultServer) searchDomains() []string {
 	var searchDomains []string
 
 	for _, dConf := range s.currentConfig.Domains {
@@ -678,7 +692,7 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 	}()
 
 	if s.searchDomainNotifier != nil {
-		s.searchDomainNotifier.onNewSearchDomains(s.SearchDomains())
+		s.searchDomainNotifier.onNewSearchDomains(s.searchDomains())
 	}
 
 	s.updateNSGroupStates(update.NameServerGroups)
@@ -1435,11 +1449,11 @@ type localPeerConnectivity struct {
 
 // IsConnectedByIP looks the IP up in the peerstore and surfaces both
 // the known and connected bits. Used by Resolver.filterDisconnectedPeerAnswers.
-func (l localPeerConnectivity) IsConnectedByIP(ip string) (known, connected bool) {
+func (l localPeerConnectivity) IsConnectedByIP(ip netip.Addr) (known, connected bool) {
 	if l.status == nil {
 		return false, false
 	}
-	state, ok := l.status.PeerStateByIP(ip)
+	state, ok := l.status.PeerStateByIP(ip.String())
 	if !ok {
 		return false, false
 	}
diff --git a/client/internal/dns/server_privileged_test.go b/client/internal/dns/server_privileged_test.go
index a03aea169..b135c3661 100644
--- a/client/internal/dns/server_privileged_test.go
+++ b/client/internal/dns/server_privileged_test.go
@@ -9,9 +9,9 @@ import (
 	"os"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface"
@@ -24,6 +24,10 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 )
 
+// testIFaceBlackList mirrors the overlay prefixes profilemanager.DefaultInterfaceBlacklist
+// carries. Declared here rather than imported because profilemanager imports this package.
+var testIFaceBlackList = []string{"wt", "utun", "tun0"}
+
 func TestUpdateDNSServer(t *testing.T) {
 
 	nameServers := []nbdns.NameServer{
@@ -243,10 +247,7 @@ func TestUpdateDNSServer(t *testing.T) {
 	for n, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
 			privKey, _ := wgtypes.GenerateKey()
-			newNet, err := stdnet.NewNet(context.Background(), nil)
-			if err != nil {
-				t.Fatal(err)
-			}
+			newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 			opts := iface.WGIFaceOpts{
 				IFaceName:    fmt.Sprintf("utun230%d", n),
@@ -348,11 +349,7 @@ func TestDNSFakeResolverHandleUpdates(t *testing.T) {
 	defer t.Setenv("NB_WG_KERNEL_DISABLED", ov)
 
 	t.Setenv("NB_WG_KERNEL_DISABLED", "true")
-	newNet, err := stdnet.NewNet(context.Background(), []string{"utun2301"})
-	if err != nil {
-		t.Errorf("create stdnet: %v", err)
-		return
-	}
+	newNet := stdnet.NewNet(context.Background(), []string{"utun2301"}, nil)
 
 	privKey, _ := wgtypes.GeneratePrivateKey()
 	opts := iface.WGIFaceOpts{
diff --git a/client/internal/dns/server_test.go b/client/internal/dns/server_test.go
index 96e55a354..777594272 100644
--- a/client/internal/dns/server_test.go
+++ b/client/internal/dns/server_test.go
@@ -394,11 +394,7 @@ func createWgInterfaceWithBind(t *testing.T) (*iface.WGIface, error) {
 	defer t.Setenv("NB_WG_KERNEL_DISABLED", ov)
 
 	t.Setenv("NB_WG_KERNEL_DISABLED", "true")
-	newNet, err := stdnet.NewNet(context.Background(), []string{"utun2301"})
-	if err != nil {
-		t.Fatalf("create stdnet: %v", err)
-		return nil, err
-	}
+	newNet := stdnet.NewNet(context.Background(), []string{"utun2301"}, nil)
 
 	privKey, _ := wgtypes.GeneratePrivateKey()
 
@@ -423,7 +419,7 @@ func createWgInterfaceWithBind(t *testing.T) (*iface.WGIface, error) {
 		return nil, err
 	}
 
-	pf, err := uspfilter.Create(wgIface, false, flowLogger, iface.DefaultMTU)
+	pf, err := uspfilter.Create(uspfilter.Config{IFace: wgIface, FlowLogger: flowLogger, MTU: iface.DefaultMTU})
 	if err != nil {
 		t.Fatalf("failed to create uspfilter: %v", err)
 		return nil, err
diff --git a/client/internal/dns/service_listener.go b/client/internal/dns/service_listener.go
index 9c0e52af8..d65a727b1 100644
--- a/client/internal/dns/service_listener.go
+++ b/client/internal/dns/service_listener.go
@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/netip"
 	"runtime"
+	"slices"
 	"strconv"
 	"sync"
 	"time"
@@ -17,17 +18,20 @@ import (
 	nberrors "github.com/netbirdio/netbird/client/errors"
 
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/internal/ebpf"
-	ebpfMgr "github.com/netbirdio/netbird/client/internal/ebpf/manager"
 )
 
 const (
 	customPort = 5053
+	// randomPortAttempts bounds the search for a port free on both protocols.
+	randomPortAttempts = 5
 )
 
 var (
 	defaultIP = netip.MustParseAddr("127.0.0.1")
 	customIP  = netip.MustParseAddr("127.0.0.153")
+
+	// dnatProtocols are the protocols the port 53 redirect covers.
+	dnatProtocols = []firewall.Protocol{firewall.ProtocolUDP, firewall.ProtocolTCP}
 )
 
 type serviceViaListener struct {
@@ -40,9 +44,20 @@ type serviceViaListener struct {
 	listenPort        uint16
 	listenerIsRunning bool
 	listenerFlagLock  sync.Mutex
-	ebpfService       ebpfMgr.Manager
 	firewall          Firewall
-	tcpDNATConfigured bool
+	// dnatRules holds the port 53 redirects that are installed and not yet
+	// removed, so a removal that fails can be retried.
+	dnatRules []dnatRule
+}
+
+// dnatRule is a port 53 redirect as it was installed. The target is kept with
+// the rule because the listener can come back on a different address or port,
+// and a retried removal has to name the address and port the rule was added
+// with, not the ones in use now.
+type dnatRule struct {
+	protocol firewall.Protocol
+	ip       netip.Addr
+	port     uint16
 }
 
 func newServiceViaListener(wgIface WGIface, customAddr *netip.AddrPort, fw Firewall) *serviceViaListener {
@@ -112,34 +127,93 @@ func (s *serviceViaListener) Listen() error {
 		}
 	}()
 
-	// When eBPF redirects UDP port 53 to our listen port, TCP still needs
-	// a DNAT rule because eBPF only handles UDP.
-	if s.ebpfService != nil && s.firewall != nil && s.listenPort != DefaultPort {
-		if err := s.firewall.AddOutputDNAT(s.listenIP, firewall.ProtocolTCP, DefaultPort, s.listenPort); err != nil {
-			log.Warnf("failed to add DNS TCP DNAT rule, TCP DNS on port 53 will not work: %v", err)
-		} else {
-			s.tcpDNATConfigured = true
-			log.Infof("added DNS TCP DNAT rule: %s:%d -> %s:%d", s.listenIP, DefaultPort, s.listenIP, s.listenPort)
-		}
+	if s.listenPort != DefaultPort {
+		s.setupDNAT()
 	}
 
 	return nil
 }
 
+// setupDNAT redirects port 53 to the port the DNS server actually listens on.
+// Both protocols must be redirected or none: RuntimePort reports port 53 only
+// while the full redirect is in place, so a half-configured redirect would
+// advertise a resolver that answers over one protocol.
+func (s *serviceViaListener) setupDNAT() {
+	if s.firewall == nil {
+		log.Errorf("no firewall manager available to redirect DNS port %d to %d, "+
+			"clients pointed at %s will not reach the resolver", DefaultPort, s.listenPort, s.listenIP)
+		return
+	}
+
+	// Clear whatever an earlier removal left behind first. Those rules can point
+	// at an address or port this listener no longer uses, and they are matched
+	// before anything added now, so adding a redirect on top of one would keep
+	// sending port 53 traffic to the previous listener while reporting the
+	// redirect as complete. The rules stay recorded for a later attempt.
+	if err := s.removeDNAT(); err != nil {
+		log.Errorf("failed to remove stale DNS DNAT rules, leaving port %d redirected to the previous listener: %v",
+			DefaultPort, err)
+		return
+	}
+
+	for _, proto := range dnatProtocols {
+		if err := s.firewall.AddOutputDNAT(s.listenIP, proto, DefaultPort, s.listenPort); err != nil {
+			log.Errorf("failed to add DNS %s DNAT rule, DNS on port %d will not work: %v",
+				proto, DefaultPort, err)
+			if err := s.removeDNAT(); err != nil {
+				log.Warnf("failed to roll back DNS DNAT rules, retrying on stop: %v", err)
+			}
+			return
+		}
+		s.dnatRules = append(s.dnatRules, dnatRule{protocol: proto, ip: s.listenIP, port: s.listenPort})
+	}
+
+	log.Infof("added DNS DNAT rules: %s:%d -> %s:%d (UDP + TCP)", s.listenIP, DefaultPort, s.listenIP, s.listenPort)
+}
+
+// removeDNAT removes every installed port 53 redirect. A rule whose removal
+// fails stays recorded so a later setup or Stop retries it, rather than leaving
+// port 53 pointing at a resolver that is no longer listening.
+func (s *serviceViaListener) removeDNAT() error {
+	if s.firewall == nil {
+		return nil
+	}
+
+	var merr *multierror.Error
+	var remaining []dnatRule
+	for _, rule := range s.dnatRules {
+		if err := s.firewall.RemoveOutputDNAT(rule.ip, rule.protocol, DefaultPort, rule.port); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove DNS %s DNAT rule for %s:%d: %w",
+				rule.protocol, rule.ip, rule.port, err))
+			remaining = append(remaining, rule)
+		}
+	}
+	s.dnatRules = remaining
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
 func (s *serviceViaListener) Stop() error {
 	s.listenerFlagLock.Lock()
 	defer s.listenerFlagLock.Unlock()
 
+	var merr *multierror.Error
+
+	// Redirects are removed even when the listener is already stopped, so that
+	// a removal which failed earlier is retried instead of leaving port 53
+	// pointing at a resolver that no longer listens.
+	if err := s.removeDNAT(); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
 	if !s.listenerIsRunning {
-		return nil
+		return nberrors.FormatErrorOrNil(merr)
 	}
 	s.listenerIsRunning = false
 
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	var merr *multierror.Error
-
 	if err := s.server.ShutdownContext(ctx); err != nil {
 		merr = multierror.Append(merr, fmt.Errorf("stop DNS UDP server: %w", err))
 	}
@@ -148,19 +222,6 @@ func (s *serviceViaListener) Stop() error {
 		merr = multierror.Append(merr, fmt.Errorf("stop DNS TCP server: %w", err))
 	}
 
-	if s.tcpDNATConfigured && s.firewall != nil {
-		if err := s.firewall.RemoveOutputDNAT(s.listenIP, firewall.ProtocolTCP, DefaultPort, s.listenPort); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove DNS TCP DNAT rule: %w", err))
-		}
-		s.tcpDNATConfigured = false
-	}
-
-	if s.ebpfService != nil {
-		if err := s.ebpfService.FreeDNSFwd(); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("stop traffic forwarder: %w", err))
-		}
-	}
-
 	return nberrors.FormatErrorOrNil(merr)
 }
 
@@ -177,11 +238,23 @@ func (s *serviceViaListener) RuntimePort() int {
 	s.listenerFlagLock.Lock()
 	defer s.listenerFlagLock.Unlock()
 
-	if s.ebpfService != nil {
+	if s.redirectInstalled() {
 		return DefaultPort
-	} else {
-		return int(s.listenPort)
 	}
+	return int(s.listenPort)
+}
+
+// redirectInstalled reports whether every protocol is redirected from port 53
+// to the address and port the listener currently serves. Rules left over from
+// an earlier listener do not count.
+func (s *serviceViaListener) redirectInstalled() bool {
+	for _, proto := range dnatProtocols {
+		current := dnatRule{protocol: proto, ip: s.listenIP, port: s.listenPort}
+		if !slices.Contains(s.dnatRules, current) {
+			return false
+		}
+	}
+	return true
 }
 
 func (s *serviceViaListener) RuntimeIP() netip.Addr {
@@ -190,30 +263,29 @@ func (s *serviceViaListener) RuntimeIP() netip.Addr {
 
 // evalListenAddress figures out the listen address for the DNS server.
 // IPv4-only: all peers have a v4 overlay address, and DNS config points to v4.
-// First checks port 53 on WG interface or lo, then tries eBPF on a random port,
-// then falls back to port 5053.
+// Prefers port 53 on the overlay interface or lo, so no redirect is needed at
+// all; when it is taken it falls back to port 5053 and then to a random free
+// port, both of which need the port 53 redirect set up by setupDNAT.
 func (s *serviceViaListener) evalListenAddress() (netip.Addr, uint16, error) {
 	if s.customAddr != nil {
 		return s.customAddr.Addr(), s.customAddr.Port(), nil
 	}
 
-	ip, ok := s.testFreePort(DefaultPort)
-	if ok {
+	if ip, ok := s.testFreePort(DefaultPort); ok {
 		return ip, DefaultPort, nil
 	}
 
-	ebpfSrv, port, ok := s.tryToUseeBPF()
-	if ok {
-		s.ebpfService = ebpfSrv
-		return s.wgInterface.Address().IP, port, nil
-	}
-
-	ip, ok = s.testFreePort(customPort)
-	if ok {
+	if ip, ok := s.testFreePort(customPort); ok {
 		return ip, customPort, nil
 	}
 
-	return netip.Addr{}, 0, fmt.Errorf("failed to find a free port for DNS server")
+	ip := s.wgInterface.Address().IP
+	port, err := s.randomFreePort(ip)
+	if err != nil {
+		return netip.Addr{}, 0, fmt.Errorf("find a free port for DNS server: %w", err)
+	}
+
+	return ip, port, nil
 }
 
 func (s *serviceViaListener) testFreePort(port int) (netip.Addr, bool) {
@@ -260,50 +332,25 @@ func (s *serviceViaListener) tryToBind(ip netip.Addr, port int) bool {
 	return true
 }
 
-// tryToUseeBPF decides whether to apply eBPF program to capture DNS traffic on port 53.
-// This is needed because on some operating systems if we start a DNS server not on a default port 53,
-// the domain name  resolution won't work. So, in case we are running on Linux and picked a free
-// port we should fall back to the eBPF solution that will capture traffic on port 53 and forward
-// it to a local DNS server running on the chosen port.
-func (s *serviceViaListener) tryToUseeBPF() (ebpfMgr.Manager, uint16, bool) {
-	if runtime.GOOS != "linux" {
-		return nil, 0, false
+// randomFreePort returns a port that is free on ip for both UDP and TCP, since
+// the DNS server binds both. The probe listeners are closed again, so the port
+// is only likely, not guaranteed, to still be free when the server binds it.
+func (s *serviceViaListener) randomFreePort(ip netip.Addr) (uint16, error) {
+	for range randomPortAttempts {
+		probeListener, err := net.ListenUDP("udp4", &net.UDPAddr{})
+		if err != nil {
+			return 0, fmt.Errorf("bind random port: %w", err)
+		}
+
+		port := uint16(probeListener.LocalAddr().(*net.UDPAddr).Port)
+		if err := probeListener.Close(); err != nil {
+			return 0, fmt.Errorf("free up probed port: %w", err)
+		}
+
+		if s.tryToBind(ip, int(port)) {
+			return port, nil
+		}
 	}
 
-	port, err := s.generateFreePort() //nolint:staticcheck,unused
-	if err != nil {
-		log.Warnf("failed to generate a free port for eBPF DNS forwarder server: %s", err)
-		return nil, 0, false
-	}
-
-	ebpfSrv := ebpf.GetEbpfManagerInstance()
-	err = ebpfSrv.LoadDNSFwd(s.wgInterface.Address().IP, int(port))
-	if err != nil {
-		log.Warnf("failed to load DNS forwarder eBPF program, error: %s", err)
-		return nil, 0, false
-	}
-
-	return ebpfSrv, port, true
-}
-
-func (s *serviceViaListener) generateFreePort() (uint16, error) {
-	ok := s.tryToBind(s.wgInterface.Address().IP, customPort)
-	if ok {
-		return customPort, nil
-	}
-
-	udpAddr := net.UDPAddrFromAddrPort(netip.MustParseAddrPort("0.0.0.0:0"))
-	probeListener, err := net.ListenUDP("udp", udpAddr)
-	if err != nil {
-		log.Debugf("failed to bind random port for DNS: %s", err)
-		return 0, err
-	}
-
-	addrPort := netip.MustParseAddrPort(probeListener.LocalAddr().String()) // might panic if address is incorrect
-	err = probeListener.Close()
-	if err != nil {
-		log.Debugf("failed to free up DNS port: %s", err)
-		return 0, err
-	}
-	return addrPort.Port(), nil
+	return 0, fmt.Errorf("no port free for UDP and TCP on %s after %d attempts", ip, randomPortAttempts)
 }
diff --git a/client/internal/dns/service_listener_test.go b/client/internal/dns/service_listener_test.go
index 90ef71d19..b158a79fd 100644
--- a/client/internal/dns/service_listener_test.go
+++ b/client/internal/dns/service_listener_test.go
@@ -1,6 +1,7 @@
 package dns
 
 import (
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -10,6 +11,8 @@ import (
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 )
 
 func TestServiceViaListener_TCPAndUDP(t *testing.T) {
@@ -84,3 +87,133 @@ func TestServiceViaListener_TCPAndUDP(t *testing.T) {
 	require.NotEmpty(t, tcpResp.Answer)
 	assert.Contains(t, tcpResp.Answer[0].String(), "192.0.2.1", "TCP response should contain expected IP")
 }
+
+type dnatCall struct {
+	rule  dnatRule
+	added bool
+}
+
+// fakeFirewall records DNAT calls and fails the ones named in addErrs/removeErrs.
+type fakeFirewall struct {
+	calls      []dnatCall
+	addErrs    map[firewall.Protocol]error
+	removeErrs map[firewall.Protocol]error
+}
+
+func (f *fakeFirewall) AddOutputDNAT(ip netip.Addr, protocol firewall.Protocol, _, translatedPort uint16) error {
+	if err := f.addErrs[protocol]; err != nil {
+		return err
+	}
+	f.calls = append(f.calls, dnatCall{rule: dnatRule{protocol: protocol, ip: ip, port: translatedPort}, added: true})
+	return nil
+}
+
+func (f *fakeFirewall) RemoveOutputDNAT(ip netip.Addr, protocol firewall.Protocol, _, translatedPort uint16) error {
+	if err := f.removeErrs[protocol]; err != nil {
+		return err
+	}
+	f.calls = append(f.calls, dnatCall{rule: dnatRule{protocol: protocol, ip: ip, port: translatedPort}})
+	return nil
+}
+
+func newDNATTestService(fw Firewall) *serviceViaListener {
+	return &serviceViaListener{
+		listenIP:   netip.MustParseAddr("100.64.0.1"),
+		listenPort: customPort,
+		firewall:   fw,
+	}
+}
+
+func TestSetupDNAT_BothProtocols(t *testing.T) {
+	svc := newDNATTestService(&fakeFirewall{})
+
+	svc.setupDNAT()
+
+	assert.Len(t, svc.dnatRules, len(dnatProtocols))
+	assert.Equal(t, DefaultPort, svc.RuntimePort(), "port 53 is advertised once both redirects are installed")
+}
+
+func TestSetupDNAT_RollsBackPartialRedirect(t *testing.T) {
+	fw := &fakeFirewall{addErrs: map[firewall.Protocol]error{firewall.ProtocolTCP: errors.New("nftables busy")}}
+	svc := newDNATTestService(fw)
+
+	svc.setupDNAT()
+
+	assert.Empty(t, svc.dnatRules, "the UDP redirect installed before the failure must be rolled back")
+	assert.Equal(t, int(svc.listenPort), svc.RuntimePort(), "an incomplete redirect must not advertise port 53")
+	udp := dnatRule{protocol: firewall.ProtocolUDP, ip: svc.listenIP, port: svc.listenPort}
+	assert.Contains(t, fw.calls, dnatCall{rule: udp}, "UDP removal should have been attempted")
+}
+
+// A rollback that fails must keep the rule recorded, so port 53 is not left
+// redirected to a resolver that no longer listens.
+func TestStop_RetriesFailedDNATRemoval(t *testing.T) {
+	fw := &fakeFirewall{
+		addErrs:    map[firewall.Protocol]error{firewall.ProtocolTCP: errors.New("nftables busy")},
+		removeErrs: map[firewall.Protocol]error{firewall.ProtocolUDP: errors.New("nftables busy")},
+	}
+	svc := newDNATTestService(fw)
+
+	svc.setupDNAT()
+	udp := dnatRule{protocol: firewall.ProtocolUDP, ip: svc.listenIP, port: svc.listenPort}
+	require.Equal(t, []dnatRule{udp}, svc.dnatRules, "a failed rollback keeps the rule for a later retry")
+
+	require.Error(t, svc.Stop(), "the failing removal should be reported")
+	require.Equal(t, []dnatRule{udp}, svc.dnatRules)
+
+	delete(fw.removeErrs, firewall.ProtocolUDP)
+	require.NoError(t, svc.Stop(), "a later stop retries the removal")
+	assert.Empty(t, svc.dnatRules)
+}
+
+// A stale rule that cannot be removed is matched before anything added now, so
+// no new redirect may be installed on top of it and port 53 must not be
+// advertised as reaching this listener.
+func TestSetupDNAT_AbortsWhileStaleRuleRemains(t *testing.T) {
+	fw := &fakeFirewall{removeErrs: map[firewall.Protocol]error{firewall.ProtocolUDP: errors.New("nftables busy")}}
+	svc := newDNATTestService(fw)
+	stalePort := svc.listenPort
+
+	svc.setupDNAT()
+	require.Error(t, svc.Stop())
+	staleUDP := dnatRule{protocol: firewall.ProtocolUDP, ip: svc.listenIP, port: stalePort}
+	require.Equal(t, []dnatRule{staleUDP}, svc.dnatRules)
+
+	svc.listenPort = stalePort + 1
+	fw.calls = nil
+
+	svc.setupDNAT()
+
+	assert.Equal(t, []dnatRule{staleUDP}, svc.dnatRules, "the stale rule stays recorded for a later attempt")
+	for _, call := range fw.calls {
+		assert.False(t, call.added, "no redirect may be installed while a stale one is still in place")
+	}
+	assert.Equal(t, int(svc.listenPort), svc.RuntimePort(), "port 53 must not be advertised")
+}
+
+// A rule left behind by a failed removal must be removed with the address and
+// port it was installed with, even when the listener has since moved to another
+// port, and it must not count towards the redirect the new listener advertises.
+func TestSetupDNAT_ClearsStaleRuleAfterPortChange(t *testing.T) {
+	fw := &fakeFirewall{removeErrs: map[firewall.Protocol]error{firewall.ProtocolUDP: errors.New("nftables busy")}}
+	svc := newDNATTestService(fw)
+	stalePort := svc.listenPort
+
+	svc.setupDNAT()
+	require.Error(t, svc.Stop())
+	staleUDP := dnatRule{protocol: firewall.ProtocolUDP, ip: svc.listenIP, port: stalePort}
+	require.Equal(t, []dnatRule{staleUDP}, svc.dnatRules)
+
+	delete(fw.removeErrs, firewall.ProtocolUDP)
+	svc.listenPort = stalePort + 1
+	fw.calls = nil
+
+	svc.setupDNAT()
+
+	assert.Contains(t, fw.calls, dnatCall{rule: staleUDP}, "the stale rule must be removed with its original port")
+	assert.Len(t, svc.dnatRules, len(dnatProtocols))
+	assert.Equal(t, DefaultPort, svc.RuntimePort(), "the new listener is fully redirected")
+	for _, rule := range svc.dnatRules {
+		assert.Equal(t, svc.listenPort, rule.port, "only rules for the current listener remain")
+	}
+}
diff --git a/client/internal/dns/unclean_shutdown_windows.go b/client/internal/dns/unclean_shutdown_windows.go
index 24a9eca50..ab0b2cc63 100644
--- a/client/internal/dns/unclean_shutdown_windows.go
+++ b/client/internal/dns/unclean_shutdown_windows.go
@@ -5,9 +5,8 @@ import (
 )
 
 type ShutdownState struct {
-	Guid           string
-	GPO            bool
-	NRPTEntryCount int
+	Guid string
+	GPO  bool
 }
 
 func (s *ShutdownState) Name() string {
@@ -16,9 +15,8 @@ func (s *ShutdownState) Name() string {
 
 func (s *ShutdownState) Cleanup() error {
 	manager := &registryConfigurator{
-		guid:           s.Guid,
-		gpo:            s.GPO,
-		nrptEntryCount: s.NRPTEntryCount,
+		guid: s.Guid,
+		gpo:  s.GPO,
 	}
 
 	if err := manager.restoreUncleanShutdownDNS(); err != nil {
diff --git a/client/internal/dns/upstream_ios.go b/client/internal/dns/upstream_ios.go
index b989bf0f9..793d87fca 100644
--- a/client/internal/dns/upstream_ios.go
+++ b/client/internal/dns/upstream_ios.go
@@ -130,8 +130,3 @@ func GetClientPrivate(iface privateClientIface, upstreamIP netip.Addr, dialTimeo
 	}
 	return client, nil
 }
-
-func getInterfaceIndex(interfaceName string) (int, error) {
-	iface, err := net.InterfaceByName(interfaceName)
-	return iface.Index, err
-}
diff --git a/client/internal/dns_peer_activator.go b/client/internal/dns_peer_activator.go
new file mode 100644
index 000000000..c283d6251
--- /dev/null
+++ b/client/internal/dns_peer_activator.go
@@ -0,0 +1,76 @@
+package internal
+
+import (
+	"context"
+	"net/netip"
+	"time"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/peerstore"
+)
+
+const dnsActivationPollInterval = 50 * time.Millisecond
+
+// dnsPeerActivator wakes lazy-connection peers from the DNS resolution path. It
+// implements dns/local.PeerActivator. DNS queries run on their own goroutines,
+// so it only touches state that is safe for concurrent use — ConnMgr.ActivatePeer,
+// peerstore.Store and peer.Status — and never takes the engine's syncMsgMux,
+// keeping DNS resolution from contending with network-map processing.
+type dnsPeerActivator struct {
+	connMgr   *ConnMgr
+	peerStore *peerstore.Store
+	status    *peer.Status
+	// ctx is the engine's long-lived context. The connection dial is tied to it
+	// (not the per-query DNS wait budget) so a handshake that outlasts the wait
+	// still completes in the background rather than being cancelled at the deadline.
+	ctx context.Context
+}
+
+// ActivatePeersByIP triggers wake-up for the peer(s) owning addrs and waits
+// until one is connected or ctx (the per-query DNS wait budget) expires.
+// Activation itself is tied to the engine's long-lived context so the dial
+// survives a wait that times out. Unknown or already-connected addresses are
+// skipped, so the steady-state (warm) path adds no latency.
+func (a *dnsPeerActivator) ActivatePeersByIP(ctx context.Context, addrs []netip.Addr) {
+	if a == nil || a.connMgr == nil {
+		return
+	}
+
+	var pending []string
+	for _, addr := range addrs {
+		ip := addr.String()
+		st, ok := a.status.PeerStateByIP(ip)
+		if !ok || st.ConnStatus == peer.StatusConnected {
+			continue
+		}
+		conn, ok := a.peerStore.PeerConn(st.PubKey)
+		if !ok {
+			continue
+		}
+		a.connMgr.ActivatePeer(a.ctx, conn)
+		pending = append(pending, ip)
+	}
+
+	if len(pending) == 0 {
+		return
+	}
+	a.waitConnected(ctx, pending)
+}
+
+// waitConnected blocks until any of ips reports a connected peer or ctx expires.
+func (a *dnsPeerActivator) waitConnected(ctx context.Context, ips []string) {
+	ticker := time.NewTicker(dnsActivationPollInterval)
+	defer ticker.Stop()
+	for {
+		for _, ip := range ips {
+			if st, ok := a.status.PeerStateByIP(ip); ok && st.ConnStatus == peer.StatusConnected {
+				return
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+	}
+}
diff --git a/client/internal/dns_peer_activator_test.go b/client/internal/dns_peer_activator_test.go
new file mode 100644
index 000000000..8c3b75e59
--- /dev/null
+++ b/client/internal/dns_peer_activator_test.go
@@ -0,0 +1,129 @@
+package internal
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/peerstore"
+)
+
+func newTestPeerConn(t *testing.T, key string) *peer.Conn {
+	t.Helper()
+	conn, err := peer.NewConn(peer.ConnConfig{
+		Key:      key,
+		LocalKey: "local",
+		WgConfig: peer.WgConfig{
+			AllowedIps: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
+		},
+	}, peer.ServiceDependencies{})
+	require.NoError(t, err)
+	return conn
+}
+
+func newTestDNSPeerActivator(t *testing.T) (*dnsPeerActivator, *peer.Status, *peerstore.Store) {
+	t.Helper()
+	status := peer.NewRecorder("https://mgm")
+	store := peerstore.NewConnStore()
+	// ConnMgr without Start: the lazy manager is nil, so ActivatePeer is a
+	// no-op — these tests exercise the activator's skip/wait logic.
+	connMgr := NewConnMgr(&EngineConfig{}, status, store, nil)
+	return &dnsPeerActivator{
+		connMgr:   connMgr,
+		peerStore: store,
+		status:    status,
+		ctx:       context.Background(),
+	}, status, store
+}
+
+func TestDNSPeerActivator_NilSafe(t *testing.T) {
+	var a *dnsPeerActivator
+	a.ActivatePeersByIP(context.Background(), []netip.Addr{netip.MustParseAddr("100.64.0.1")})
+}
+
+// TestDNSPeerActivator_SkipsUnknownAndConnectedPeers verifies the steady-state
+// (warm) path adds no latency: already-connected and unknown addresses never
+// enter the wait loop.
+func TestDNSPeerActivator_SkipsUnknownAndConnectedPeers(t *testing.T) {
+	a, status, store := newTestDNSPeerActivator(t)
+
+	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", "fd00::1"))
+	require.NoError(t, status.UpdatePeerState(peer.State{PubKey: "peerA", ConnStatus: peer.StatusConnected}))
+	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	start := time.Now()
+	a.ActivatePeersByIP(ctx, []netip.Addr{
+		netip.MustParseAddr("100.64.0.1"),  // known, connected -> skipped
+		netip.MustParseAddr("fd00::1"),     // known via IPv6, connected -> skipped
+		netip.MustParseAddr("100.64.0.99"), // unknown -> skipped
+	})
+	require.Less(t, time.Since(start), time.Second, "no pending peer must mean no wait")
+}
+
+// TestDNSPeerActivator_WaitsForPendingPeerToConnect verifies the wait loop
+// returns as soon as a pending peer reports connected, well before the
+// per-query budget expires.
+func TestDNSPeerActivator_WaitsForPendingPeerToConnect(t *testing.T) {
+	a, status, store := newTestDNSPeerActivator(t)
+
+	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
+	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
+
+	go func() {
+		time.Sleep(150 * time.Millisecond)
+		_ = status.UpdatePeerState(peer.State{PubKey: "peerA", ConnStatus: peer.StatusConnected})
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	start := time.Now()
+	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
+	elapsed := time.Since(start)
+
+	require.GreaterOrEqual(t, elapsed, 100*time.Millisecond, "must wait for the pending peer")
+	require.Less(t, elapsed, 5*time.Second, "must return on connect, not at the deadline")
+}
+
+// TestDNSPeerActivator_ReturnsAtBudgetWhenPeerStaysIdle verifies a peer that
+// never connects releases the DNS response at the per-query budget instead of
+// blocking it indefinitely.
+func TestDNSPeerActivator_ReturnsAtBudgetWhenPeerStaysIdle(t *testing.T) {
+	a, status, store := newTestDNSPeerActivator(t)
+
+	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
+	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 300*time.Millisecond)
+	defer cancel()
+
+	start := time.Now()
+	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
+	elapsed := time.Since(start)
+
+	require.GreaterOrEqual(t, elapsed, 250*time.Millisecond, "must wait out the budget for a pending peer")
+	require.Less(t, elapsed, 5*time.Second, "must not block past the budget")
+}
+
+// TestDNSPeerActivator_NoWaitWithoutPeerConn verifies a known-but-idle peer
+// with no connection object in the store is not waited on: there is nothing to
+// activate, so waiting could only ever time out.
+func TestDNSPeerActivator_NoWaitWithoutPeerConn(t *testing.T) {
+	a, status, _ := newTestDNSPeerActivator(t)
+
+	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	start := time.Now()
+	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
+	require.Less(t, time.Since(start), time.Second, "peer without a conn must not be waited on")
+}
diff --git a/client/internal/dns_test.go b/client/internal/dns_test.go
index e15cc8fb7..031431efe 100644
--- a/client/internal/dns_test.go
+++ b/client/internal/dns_test.go
@@ -8,7 +8,9 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	nbdns "github.com/netbirdio/netbird/dns"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
 func TestCreatePTRRecord_IPv4(t *testing.T) {
@@ -136,3 +138,88 @@ func TestAddReverseZone_IPv6(t *testing.T) {
 	assert.Len(t, reverseZone.Records, 1)
 	assert.Equal(t, int(dns.TypePTR), reverseZone.Records[0].Type)
 }
+
+// TestToDNSConfig_ZoneFlagsPreserved pins the per-zone NonAuthoritative flag
+// through the legacy DNSConfig path. A non-authoritative zone is match-only:
+// the local resolver falls through to the upstream for an in-zone name it does
+// not define. The built-in peer zone is the authoritative one and must stay
+// that way, so the flag has to travel per zone rather than be derived.
+func TestToDNSConfig_ZoneFlagsPreserved(t *testing.T) {
+	config := toDNSConfig(&mgmProto.DNSConfig{
+		ServiceEnable: true,
+		CustomZones: []*mgmProto.CustomZone{
+			{
+				Domain: "netbird.cloud.",
+				Records: []*mgmProto.SimpleRecord{
+					{Name: "peer1.netbird.cloud.", Type: int64(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.1"},
+				},
+			},
+			{
+				Domain:               "corp.internal.",
+				NonAuthoritative:     true,
+				SearchDomainDisabled: true,
+				Records: []*mgmProto.SimpleRecord{
+					{Name: "db.corp.internal.", Type: int64(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.10.0.5"},
+				},
+			},
+		},
+	}, wgaddr.Address{
+		IP:      netip.MustParseAddr("100.64.0.1"),
+		Network: netip.MustParsePrefix("100.64.0.0/16"),
+	})
+
+	zones := make(map[string]nbdns.CustomZone, len(config.CustomZones))
+	for _, zone := range config.CustomZones {
+		zones[zone.Domain] = zone
+	}
+
+	peerZone, ok := zones["netbird.cloud."]
+	require.True(t, ok, "peer zone must survive")
+	assert.False(t, peerZone.NonAuthoritative, "the built-in peer zone owns the account domain and stays authoritative")
+
+	accountZone, ok := zones["corp.internal."]
+	require.True(t, ok, "account zone must survive")
+	assert.True(t, accountZone.NonAuthoritative, "an account zone stays match-only, else undefined in-zone names get black-holed")
+	assert.True(t, accountZone.SearchDomainDisabled)
+}
+
+// TestToDNSConfig_SingleZoneForcedAuthoritative pins the compatibility clause
+// in toDNSConfig: a config carrying exactly one zone is treated as
+// authoritative no matter what the server said, because servers that predate
+// the NonAuthoritative field send only the peer FQDN zone.
+//
+// The clause can only ever downgrade an explicit true to false, so a server
+// that legitimately sends a single non-authoritative zone — an account whose
+// only zone is a custom one, with no peer records to build the built-in zone
+// from — gets that zone's whole apex black-holed on the client. Real accounts
+// always carry the peer zone alongside, which is why this is latent. Narrowing
+// it needs a way to tell "unset" from "false" on the wire, or the account
+// domain passed down here; until then this test states the contract so a
+// change to it is deliberate.
+func TestToDNSConfig_SingleZoneForcedAuthoritative(t *testing.T) {
+	config := toDNSConfig(&mgmProto.DNSConfig{
+		ServiceEnable: true,
+		CustomZones: []*mgmProto.CustomZone{
+			{
+				Domain:           "corp.internal.",
+				NonAuthoritative: true,
+				Records: []*mgmProto.SimpleRecord{
+					{Name: "db.corp.internal.", Type: int64(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.10.0.5"},
+				},
+			},
+		},
+	}, wgaddr.Address{
+		IP:      netip.MustParseAddr("100.64.0.1"),
+		Network: netip.MustParsePrefix("100.64.0.0/16"),
+	})
+
+	require.NotEmpty(t, config.CustomZones)
+	assert.Equal(t, "corp.internal.", config.CustomZones[0].Domain)
+	assert.False(t, config.CustomZones[0].NonAuthoritative,
+		"a lone zone is forced authoritative for pre-NonAuthoritative servers")
+
+	// The reverse zone the config gains afterwards must not feed back into the
+	// decision: the compat gate counts the zones the server sent.
+	require.Len(t, config.CustomZones, 2, "a reverse zone is appended for the overlay prefix")
+	assert.Equal(t, "64.100.in-addr.arpa.", config.CustomZones[1].Domain)
+}
diff --git a/client/internal/dnsfwd/forwarder.go b/client/internal/dnsfwd/forwarder.go
index b7e5a10e3..e3cb597be 100644
--- a/client/internal/dnsfwd/forwarder.go
+++ b/client/internal/dnsfwd/forwarder.go
@@ -54,12 +54,20 @@ type DNSForwarder struct {
 	ttl            uint32
 	statusRecorder *peer.Status
 
-	dnsServer *dns.Server
-	mux       *dns.ServeMux
-	tcpServer *dns.Server
-	tcpMux    *dns.ServeMux
+	mux    *dns.ServeMux
+	tcpMux *dns.ServeMux
 
-	mutex      sync.RWMutex
+	mutex sync.RWMutex
+	// closed records that Close has run, so a Listen still in flight does not
+	// go on to serve sockets nobody will shut down.
+	closed bool
+	// The sockets are kept alongside the servers because closing them is the
+	// only stop that always works: a server whose ActivateAndServe has not run
+	// yet refuses to shut down, and would otherwise start serving afterwards.
+	udpConn    net.PacketConn
+	tcpLn      net.Listener
+	dnsServer  *dns.Server
+	tcpServer  *dns.Server
 	fwdEntries []*ForwarderEntry
 	firewall   firewaller
 	resolver   resolver
@@ -106,7 +114,7 @@ func (f *DNSForwarder) Listen(entries []*ForwarderEntry) error {
 	mux := dns.NewServeMux()
 	f.mux = mux
 	mux.HandleFunc(".", f.handleDNSQueryUDP)
-	f.dnsServer = &dns.Server{
+	dnsServer := &dns.Server{
 		PacketConn: udpLn,
 		Handler:    mux,
 	}
@@ -114,22 +122,32 @@ func (f *DNSForwarder) Listen(entries []*ForwarderEntry) error {
 	tcpMux := dns.NewServeMux()
 	f.tcpMux = tcpMux
 	tcpMux.HandleFunc(".", f.handleDNSQueryTCP)
-	f.tcpServer = &dns.Server{
+	tcpServer := &dns.Server{
 		Listener: tcpLn,
 		Handler:  tcpMux,
 	}
 
-	f.UpdateDomains(entries)
+	if !f.publish(udpLn, tcpLn, dnsServer, tcpServer, entries) {
+		log.Infof("DNS forwarder on %s was closed before it started serving", addrDesc)
+		if err := udpLn.Close(); err != nil {
+			log.Debugf("close UDP listener of a closed forwarder: %v", err)
+		}
+		if err := tcpLn.Close(); err != nil {
+			log.Debugf("close TCP listener of a closed forwarder: %v", err)
+		}
+		return nil
+	}
+	log.Debugf("DNS forwarder serving %d domains", len(entries))
 
 	errCh := make(chan error, 2)
 
 	go func() {
 		log.Infof("DNS UDP listener running on %s", addrDesc)
-		errCh <- f.dnsServer.ActivateAndServe()
+		errCh <- dnsServer.ActivateAndServe()
 	}()
 	go func() {
 		log.Infof("DNS TCP listener running on %s", addrDesc)
-		errCh <- f.tcpServer.ActivateAndServe()
+		errCh <- tcpServer.ActivateAndServe()
 	}()
 
 	return <-errCh
@@ -151,6 +169,46 @@ func (f *DNSForwarder) createTCPListener(netstackNet *netstack.Net) (net.Listene
 	return net.ListenTCP("tcp", net.TCPAddrFromAddrPort(f.listenAddress))
 }
 
+// publish hands the sockets, servers and entries to the forwarder so Close can
+// reach them and Domains can report them, and says whether serving may begin.
+// Listen runs on its own goroutine, so a Close can arrive before it gets this
+// far; false means the caller must close what it created instead of serving on
+// it.
+//
+// The entries go in under the same lock rather than afterwards. Anything that
+// reads them in between would otherwise see a forwarder that is listening and
+// serves no domain, which for a caller rebuilding one means it comes back
+// refusing every routed query.
+func (f *DNSForwarder) publish(
+	udpConn net.PacketConn,
+	tcpLn net.Listener,
+	dnsServer, tcpServer *dns.Server,
+	entries []*ForwarderEntry,
+) bool {
+	f.mutex.Lock()
+	defer f.mutex.Unlock()
+
+	if f.closed {
+		return false
+	}
+
+	f.udpConn = udpConn
+	f.tcpLn = tcpLn
+	f.dnsServer = dnsServer
+	f.tcpServer = tcpServer
+	f.fwdEntries = entries
+	return true
+}
+
+// Domains returns the entries currently being served. The slice is replaced
+// wholesale by UpdateDomains rather than mutated, so the caller may read it but
+// must not write to it.
+func (f *DNSForwarder) Domains() []*ForwarderEntry {
+	f.mutex.RLock()
+	defer f.mutex.RUnlock()
+	return f.fwdEntries
+}
+
 func (f *DNSForwarder) UpdateDomains(entries []*ForwarderEntry) {
 	f.mutex.Lock()
 	defer f.mutex.Unlock()
@@ -189,19 +247,45 @@ func (f *DNSForwarder) removeStaleCacheEntries(oldEntries, newEntries []*Forward
 }
 
 func (f *DNSForwarder) Close(ctx context.Context) error {
+	// Marked closed under the lock so a Listen that has not published its
+	// servers yet gives up instead of racing this shutdown. The shutdowns
+	// themselves block, so they run outside it.
+	f.mutex.Lock()
+	f.closed = true
+	dnsServer, tcpServer := f.dnsServer, f.tcpServer
+	udpConn, tcpLn := f.udpConn, f.tcpLn
+	f.mutex.Unlock()
+
 	var result *multierror.Error
 
-	if f.dnsServer != nil {
-		if err := f.dnsServer.ShutdownContext(ctx); err != nil {
+	if dnsServer != nil {
+		if err := shutdownServer(ctx, dnsServer); err != nil {
 			result = multierror.Append(result, fmt.Errorf("UDP shutdown: %w", err))
 		}
 	}
-	if f.tcpServer != nil {
-		if err := f.tcpServer.ShutdownContext(ctx); err != nil {
+	if tcpServer != nil {
+		if err := shutdownServer(ctx, tcpServer); err != nil {
 			result = multierror.Append(result, fmt.Errorf("TCP shutdown: %w", err))
 		}
 	}
 
+	// The sockets are closed even when the shutdowns above reported nothing to
+	// do. A server that has been published but has not reached
+	// ActivateAndServe refuses to shut down, and closing what it was about to
+	// serve on is what stops it: the alternative is a listener still answering
+	// on an interface that has gone away. A shutdown that did run has already
+	// closed these, so the second close is expected to fail.
+	if udpConn != nil {
+		if err := udpConn.Close(); err != nil {
+			log.Debugf("close UDP socket of the DNS forwarder: %v", err)
+		}
+	}
+	if tcpLn != nil {
+		if err := tcpLn.Close(); err != nil {
+			log.Debugf("close TCP socket of the DNS forwarder: %v", err)
+		}
+	}
+
 	return nberrors.FormatErrorOrNil(result)
 }
 
@@ -514,3 +598,16 @@ func attachEDE(resp *dns.Msg, code uint16, text string) {
 	}
 	opt.Option = append(opt.Option, &dns.EDNS0_EDE{InfoCode: code, ExtraText: text})
 }
+
+// shutdownServer shuts a server down gracefully, treating "never started" as
+// success. A server that was published but has not reached ActivateAndServe
+// has nothing to wind down, and the caller closes its socket regardless, which
+// is what actually stops it. dns exports no sentinel for this, so the message
+// is all there is to match on.
+func shutdownServer(ctx context.Context, server *dns.Server) error {
+	err := server.ShutdownContext(ctx)
+	if err == nil || strings.Contains(err.Error(), "server not started") {
+		return nil
+	}
+	return err
+}
diff --git a/client/internal/dnsfwd/forwarder_test.go b/client/internal/dnsfwd/forwarder_test.go
index c69a9166e..a64ba80e7 100644
--- a/client/internal/dnsfwd/forwarder_test.go
+++ b/client/internal/dnsfwd/forwarder_test.go
@@ -1238,3 +1238,55 @@ func TestDNSForwarder_EmptyQuery(t *testing.T) {
 
 	assert.Nil(t, mockWriter.GetLastResponse(), "Should not write response for empty query")
 }
+
+// TestDNSForwarder_ClosedBeforeItServes covers Listen reaching the point of
+// serving after the forwarder has already been closed. Listen runs on its own
+// goroutine, so it can get there late, and a socket it starts serving then is
+// one nothing will ever close: on Android it keeps answering on an interface
+// that has been replaced. The close is sequenced first here rather than raced,
+// which pins the same state deterministically.
+func TestDNSForwarder_ClosedBeforeItServes(t *testing.T) {
+	f := NewDNSForwarder(netip.MustParseAddrPort("127.0.0.1:0"), 60, nil, nil, nil)
+
+	require.NoError(t, f.Close(context.Background()), "closing a forwarder that never started")
+
+	done := make(chan error, 1)
+	go func() { done <- f.Listen(nil) }()
+
+	select {
+	case err := <-done:
+		assert.NoError(t, err, "a closed forwarder should give up quietly, not serve")
+	case <-time.After(5 * time.Second):
+		t.Fatal("Listen went on to serve after the forwarder was closed")
+	}
+}
+
+// TestDNSForwarder_CloseStopsUnactivatedServers covers the window between
+// Listen publishing its servers and reaching ActivateAndServe. A server that
+// has not been activated refuses to shut down, so Close has to close the
+// sockets itself or they are left serving.
+func TestDNSForwarder_CloseStopsUnactivatedServers(t *testing.T) {
+	f := NewDNSForwarder(netip.MustParseAddrPort("127.0.0.1:0"), 60, nil, nil, nil)
+
+	udpConn, err := f.createUDPListener(nil)
+	require.NoError(t, err, "create UDP listener")
+	tcpLn, err := f.createTCPListener(nil)
+	require.NoError(t, err, "create TCP listener")
+
+	// Published but deliberately never activated, which is the state Listen is
+	// in for the moment before it starts serving.
+	require.True(t, f.publish(udpConn, tcpLn, &dns.Server{PacketConn: udpConn}, &dns.Server{Listener: tcpLn}, nil),
+		"publishing to an open forwarder")
+
+	tcpAddr := tcpLn.Addr().String()
+	require.NoError(t, f.Close(context.Background()), "close should report no error for servers it could not shut down")
+
+	_, err = tcpLn.Accept()
+	assert.Error(t, err, "the TCP socket should be closed after Close")
+
+	conn, err := net.DialTimeout("tcp", tcpAddr, time.Second)
+	if err == nil {
+		_ = conn.Close()
+		t.Fatal("the forwarder is still accepting connections after Close")
+	}
+}
diff --git a/client/internal/dnsfwd/manager.go b/client/internal/dnsfwd/manager.go
index c4c16cd3f..1c62e908d 100644
--- a/client/internal/dnsfwd/manager.go
+++ b/client/internal/dnsfwd/manager.go
@@ -3,7 +3,6 @@ package dnsfwd
 import (
 	"context"
 	"fmt"
-	"net"
 	"net/netip"
 	"os"
 	"strconv"
@@ -101,7 +100,7 @@ func (m *Manager) Start(fwdEntries []*ForwarderEntry) error {
 	m.dnsForwarder = NewDNSForwarder(listenAddress, dnsTTL, m.firewall, m.statusRecorder, m.wgIface)
 
 	go func() {
-		if err := m.dnsForwarder.Listen(fwdEntries); err != nil {
+		if err := m.dnsForwarder.Listen(fwdEntries); err != nil { //nolint:staticcheck
 			// todo handle close error if it is exists
 			log.Errorf("failed to start DNS forwarder, err: %v", err)
 		}
@@ -118,6 +117,16 @@ func (m *Manager) UpdateDomains(entries []*ForwarderEntry) {
 	m.dnsForwarder.UpdateDomains(entries)
 }
 
+// Domains returns the entries currently being served, or nil when the
+// forwarder is not running.
+func (m *Manager) Domains() []*ForwarderEntry {
+	if m.dnsForwarder == nil {
+		return nil
+	}
+
+	return m.dnsForwarder.Domains()
+}
+
 func (m *Manager) Stop(ctx context.Context) error {
 	if m.dnsForwarder == nil {
 		return nil
@@ -160,12 +169,13 @@ func (m *Manager) allowDNSFirewall() error {
 		return nil
 	}
 
-	dnsRules, err := m.firewall.AddPeerFiltering(nil, net.IP{0, 0, 0, 0}, firewall.ProtocolUDP, nil, dport, firewall.ActionAccept, "")
+	anyV4 := []netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)}
+	dnsRule, err := m.firewall.AddFilterRule(nil, anyV4, firewall.Network{}, firewall.ProtocolUDP, nil, dport, firewall.ActionAccept)
 	if err != nil {
 		return fmt.Errorf("add udp firewall rule: %w", err)
 	}
 
-	tcpRules, err := m.firewall.AddPeerFiltering(nil, net.IP{0, 0, 0, 0}, firewall.ProtocolTCP, nil, dport, firewall.ActionAccept, "")
+	tcpRule, err := m.firewall.AddFilterRule(nil, anyV4, firewall.Network{}, firewall.ProtocolTCP, nil, dport, firewall.ActionAccept)
 	if err != nil {
 		return fmt.Errorf("add tcp firewall rule: %w", err)
 	}
@@ -174,8 +184,12 @@ func (m *Manager) allowDNSFirewall() error {
 		return fmt.Errorf("flush: %w", err)
 	}
 
-	m.fwRules = dnsRules
-	m.tcpRules = tcpRules
+	if dnsRule != nil {
+		m.fwRules = []firewall.Rule{dnsRule}
+	}
+	if tcpRule != nil {
+		m.tcpRules = []firewall.Rule{tcpRule}
+	}
 
 	m.registerNetstackServices()
 
@@ -209,12 +223,12 @@ func (m *Manager) unregisterNetstackServices() {
 func (m *Manager) dropDNSFirewall() error {
 	var mErr *multierror.Error
 	for _, rule := range m.fwRules {
-		if err := m.firewall.DeletePeerRule(rule); err != nil {
+		if err := m.firewall.DeleteFilterRule(rule); err != nil {
 			mErr = multierror.Append(mErr, fmt.Errorf("failed to delete DNS router rules, err: %v", err))
 		}
 	}
 	for _, rule := range m.tcpRules {
-		if err := m.firewall.DeletePeerRule(rule); err != nil {
+		if err := m.firewall.DeleteFilterRule(rule); err != nil {
 			mErr = multierror.Append(mErr, fmt.Errorf("failed to delete DNS router rules, err: %v", err))
 		}
 	}
diff --git a/client/internal/ebpf/ebpf/bpf_bpfeb.go b/client/internal/ebpf/ebpf/bpf_bpfeb.go
deleted file mode 100644
index 04b19883b..000000000
--- a/client/internal/ebpf/ebpf/bpf_bpfeb.go
+++ /dev/null
@@ -1,128 +0,0 @@
-// Code generated by bpf2go; DO NOT EDIT.
-//go:build arm64be || armbe || mips || mips64 || mips64p32 || ppc64 || s390 || s390x || sparc || sparc64
-
-package ebpf
-
-import (
-	"bytes"
-	_ "embed"
-	"fmt"
-	"io"
-
-	"github.com/cilium/ebpf"
-)
-
-// loadBpf returns the embedded CollectionSpec for bpf.
-func loadBpf() (*ebpf.CollectionSpec, error) {
-	reader := bytes.NewReader(_BpfBytes)
-	spec, err := ebpf.LoadCollectionSpecFromReader(reader)
-	if err != nil {
-		return nil, fmt.Errorf("can't load bpf: %w", err)
-	}
-
-	return spec, err
-}
-
-// loadBpfObjects loads bpf and converts it into a struct.
-//
-// The following types are suitable as obj argument:
-//
-//	*bpfObjects
-//	*bpfPrograms
-//	*bpfMaps
-//
-// See ebpf.CollectionSpec.LoadAndAssign documentation for details.
-func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error {
-	spec, err := loadBpf()
-	if err != nil {
-		return err
-	}
-
-	return spec.LoadAndAssign(obj, opts)
-}
-
-// bpfSpecs contains maps and programs before they are loaded into the kernel.
-//
-// It can be passed ebpf.CollectionSpec.Assign.
-type bpfSpecs struct {
-	bpfProgramSpecs
-	bpfMapSpecs
-}
-
-// bpfSpecs contains programs before they are loaded into the kernel.
-//
-// It can be passed ebpf.CollectionSpec.Assign.
-type bpfProgramSpecs struct {
-	NbXdpProg *ebpf.ProgramSpec `ebpf:"nb_xdp_prog"`
-}
-
-// bpfMapSpecs contains maps before they are loaded into the kernel.
-//
-// It can be passed ebpf.CollectionSpec.Assign.
-type bpfMapSpecs struct {
-	NbFeatures           *ebpf.MapSpec `ebpf:"nb_features"`
-	NbMapDnsIp           *ebpf.MapSpec `ebpf:"nb_map_dns_ip"`
-	NbMapDnsPort         *ebpf.MapSpec `ebpf:"nb_map_dns_port"`
-	NbWgProxySettingsMap *ebpf.MapSpec `ebpf:"nb_wg_proxy_settings_map"`
-}
-
-// bpfObjects contains all objects after they have been loaded into the kernel.
-//
-// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
-type bpfObjects struct {
-	bpfPrograms
-	bpfMaps
-}
-
-func (o *bpfObjects) Close() error {
-	return _BpfClose(
-		&o.bpfPrograms,
-		&o.bpfMaps,
-	)
-}
-
-// bpfMaps contains all maps after they have been loaded into the kernel.
-//
-// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
-type bpfMaps struct {
-	NbFeatures           *ebpf.Map `ebpf:"nb_features"`
-	NbMapDnsIp           *ebpf.Map `ebpf:"nb_map_dns_ip"`
-	NbMapDnsPort         *ebpf.Map `ebpf:"nb_map_dns_port"`
-	NbWgProxySettingsMap *ebpf.Map `ebpf:"nb_wg_proxy_settings_map"`
-}
-
-func (m *bpfMaps) Close() error {
-	return _BpfClose(
-		m.NbFeatures,
-		m.NbMapDnsIp,
-		m.NbMapDnsPort,
-		m.NbWgProxySettingsMap,
-	)
-}
-
-// bpfPrograms contains all programs after they have been loaded into the kernel.
-//
-// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
-type bpfPrograms struct {
-	NbXdpProg *ebpf.Program `ebpf:"nb_xdp_prog"`
-}
-
-func (p *bpfPrograms) Close() error {
-	return _BpfClose(
-		p.NbXdpProg,
-	)
-}
-
-func _BpfClose(closers ...io.Closer) error {
-	for _, closer := range closers {
-		if err := closer.Close(); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// Do not access this directly.
-//
-//go:embed bpf_bpfeb.o
-var _BpfBytes []byte
diff --git a/client/internal/ebpf/ebpf/bpf_bpfeb.o b/client/internal/ebpf/ebpf/bpf_bpfeb.o
deleted file mode 100644
index 6e9cda44a..000000000
Binary files a/client/internal/ebpf/ebpf/bpf_bpfeb.o and /dev/null differ
diff --git a/client/internal/ebpf/ebpf/bpf_bpfel.go b/client/internal/ebpf/ebpf/bpf_bpfel.go
deleted file mode 100644
index 03b494aa2..000000000
--- a/client/internal/ebpf/ebpf/bpf_bpfel.go
+++ /dev/null
@@ -1,128 +0,0 @@
-// Code generated by bpf2go; DO NOT EDIT.
-//go:build 386 || amd64 || amd64p32 || arm || arm64 || loong64 || mips64le || mips64p32le || mipsle || ppc64le || riscv64
-
-package ebpf
-
-import (
-	"bytes"
-	_ "embed"
-	"fmt"
-	"io"
-
-	"github.com/cilium/ebpf"
-)
-
-// loadBpf returns the embedded CollectionSpec for bpf.
-func loadBpf() (*ebpf.CollectionSpec, error) {
-	reader := bytes.NewReader(_BpfBytes)
-	spec, err := ebpf.LoadCollectionSpecFromReader(reader)
-	if err != nil {
-		return nil, fmt.Errorf("can't load bpf: %w", err)
-	}
-
-	return spec, err
-}
-
-// loadBpfObjects loads bpf and converts it into a struct.
-//
-// The following types are suitable as obj argument:
-//
-//	*bpfObjects
-//	*bpfPrograms
-//	*bpfMaps
-//
-// See ebpf.CollectionSpec.LoadAndAssign documentation for details.
-func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error {
-	spec, err := loadBpf()
-	if err != nil {
-		return err
-	}
-
-	return spec.LoadAndAssign(obj, opts)
-}
-
-// bpfSpecs contains maps and programs before they are loaded into the kernel.
-//
-// It can be passed ebpf.CollectionSpec.Assign.
-type bpfSpecs struct {
-	bpfProgramSpecs
-	bpfMapSpecs
-}
-
-// bpfSpecs contains programs before they are loaded into the kernel.
-//
-// It can be passed ebpf.CollectionSpec.Assign.
-type bpfProgramSpecs struct {
-	NbXdpProg *ebpf.ProgramSpec `ebpf:"nb_xdp_prog"`
-}
-
-// bpfMapSpecs contains maps before they are loaded into the kernel.
-//
-// It can be passed ebpf.CollectionSpec.Assign.
-type bpfMapSpecs struct {
-	NbFeatures           *ebpf.MapSpec `ebpf:"nb_features"`
-	NbMapDnsIp           *ebpf.MapSpec `ebpf:"nb_map_dns_ip"`
-	NbMapDnsPort         *ebpf.MapSpec `ebpf:"nb_map_dns_port"`
-	NbWgProxySettingsMap *ebpf.MapSpec `ebpf:"nb_wg_proxy_settings_map"`
-}
-
-// bpfObjects contains all objects after they have been loaded into the kernel.
-//
-// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
-type bpfObjects struct {
-	bpfPrograms
-	bpfMaps
-}
-
-func (o *bpfObjects) Close() error {
-	return _BpfClose(
-		&o.bpfPrograms,
-		&o.bpfMaps,
-	)
-}
-
-// bpfMaps contains all maps after they have been loaded into the kernel.
-//
-// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
-type bpfMaps struct {
-	NbFeatures           *ebpf.Map `ebpf:"nb_features"`
-	NbMapDnsIp           *ebpf.Map `ebpf:"nb_map_dns_ip"`
-	NbMapDnsPort         *ebpf.Map `ebpf:"nb_map_dns_port"`
-	NbWgProxySettingsMap *ebpf.Map `ebpf:"nb_wg_proxy_settings_map"`
-}
-
-func (m *bpfMaps) Close() error {
-	return _BpfClose(
-		m.NbFeatures,
-		m.NbMapDnsIp,
-		m.NbMapDnsPort,
-		m.NbWgProxySettingsMap,
-	)
-}
-
-// bpfPrograms contains all programs after they have been loaded into the kernel.
-//
-// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
-type bpfPrograms struct {
-	NbXdpProg *ebpf.Program `ebpf:"nb_xdp_prog"`
-}
-
-func (p *bpfPrograms) Close() error {
-	return _BpfClose(
-		p.NbXdpProg,
-	)
-}
-
-func _BpfClose(closers ...io.Closer) error {
-	for _, closer := range closers {
-		if err := closer.Close(); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// Do not access this directly.
-//
-//go:embed bpf_bpfel.o
-var _BpfBytes []byte
diff --git a/client/internal/ebpf/ebpf/bpf_bpfel.o b/client/internal/ebpf/ebpf/bpf_bpfel.o
deleted file mode 100644
index 6338f4774..000000000
Binary files a/client/internal/ebpf/ebpf/bpf_bpfel.o and /dev/null differ
diff --git a/client/internal/ebpf/ebpf/dns_fwd_linux.go b/client/internal/ebpf/ebpf/dns_fwd_linux.go
deleted file mode 100644
index 1e7774573..000000000
--- a/client/internal/ebpf/ebpf/dns_fwd_linux.go
+++ /dev/null
@@ -1,52 +0,0 @@
-package ebpf
-
-import (
-	"encoding/binary"
-	"fmt"
-	"net/netip"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	mapKeyDNSIP   uint32 = 0
-	mapKeyDNSPort uint32 = 1
-)
-
-func (tf *GeneralManager) LoadDNSFwd(ip netip.Addr, dnsPort int) error {
-	log.Debugf("load eBPF DNS forwarder, watching addr: %s:53, redirect to port: %d", ip, dnsPort)
-	tf.lock.Lock()
-	defer tf.lock.Unlock()
-
-	err := tf.loadXdp()
-	if err != nil {
-		return err
-	}
-
-	if !ip.Is4() {
-		return fmt.Errorf("eBPF DNS forwarder only supports IPv4, got %s", ip)
-	}
-	ip4 := ip.As4()
-	err = tf.bpfObjs.NbMapDnsIp.Put(mapKeyDNSIP, binary.BigEndian.Uint32(ip4[:]))
-	if err != nil {
-		return err
-	}
-
-	err = tf.bpfObjs.NbMapDnsPort.Put(mapKeyDNSPort, uint16(dnsPort))
-	if err != nil {
-		return err
-	}
-
-	tf.setFeatureFlag(featureFlagDnsForwarder)
-	err = tf.bpfObjs.NbFeatures.Put(mapKeyFeatures, tf.featureFlags)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func (tf *GeneralManager) FreeDNSFwd() error {
-	log.Debugf("free ebpf DNS forwarder")
-	return tf.unsetFeatureFlag(featureFlagDnsForwarder)
-}
-
diff --git a/client/internal/ebpf/ebpf/manager_linux.go b/client/internal/ebpf/ebpf/manager_linux.go
deleted file mode 100644
index 7520a6387..000000000
--- a/client/internal/ebpf/ebpf/manager_linux.go
+++ /dev/null
@@ -1,116 +0,0 @@
-package ebpf
-
-import (
-	_ "embed"
-	"net"
-	"sync"
-
-	"github.com/cilium/ebpf/link"
-	"github.com/cilium/ebpf/rlimit"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/ebpf/manager"
-)
-
-const (
-	mapKeyFeatures uint32 = 0
-
-	featureFlagWGProxy      = 0b00000001
-	featureFlagDnsForwarder = 0b00000010
-)
-
-var (
-	singleton     manager.Manager
-	singletonLock = &sync.Mutex{}
-)
-
-// required packages libbpf-dev, libc6-dev-i386-amd64-cross
-
-// GeneralManager is used to load multiple eBPF programs with a custom check (if then) done in prog.c
-// The manager simply adds a feature (byte) of each program to a map that is shared between the userspace and kernel.
-// When packet arrives, the C code checks for each feature (if it is set) and executes each enabled program (e.g., dns_fwd.c and wg_proxy.c).
-//
-//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang-14 bpf src/prog.c -- -I /usr/x86_64-linux-gnu/include
-type GeneralManager struct {
-	lock         sync.Mutex
-	link         link.Link
-	featureFlags uint16
-	bpfObjs      bpfObjects
-}
-
-// GetEbpfManagerInstance return a static eBpf Manager instance
-func GetEbpfManagerInstance() manager.Manager {
-	singletonLock.Lock()
-	defer singletonLock.Unlock()
-	if singleton != nil {
-		return singleton
-	}
-	singleton = &GeneralManager{}
-	return singleton
-}
-
-func (tf *GeneralManager) setFeatureFlag(feature uint16) {
-	tf.featureFlags |= feature
-}
-
-func (tf *GeneralManager) loadXdp() error {
-	if tf.link != nil {
-		return nil
-	}
-	// it required for Docker
-	err := rlimit.RemoveMemlock()
-	if err != nil {
-		return err
-	}
-
-	iFace, err := net.InterfaceByName("lo")
-	if err != nil {
-		return err
-	}
-
-	// load pre-compiled programs into the kernel.
-	err = loadBpfObjects(&tf.bpfObjs, nil)
-	if err != nil {
-		return err
-	}
-
-	tf.link, err = link.AttachXDP(link.XDPOptions{
-		Program:   tf.bpfObjs.NbXdpProg,
-		Interface: iFace.Index,
-	})
-
-	if err != nil {
-		_ = tf.bpfObjs.Close()
-		tf.link = nil
-		return err
-	}
-	return nil
-}
-
-func (tf *GeneralManager) unsetFeatureFlag(feature uint16) error {
-	tf.lock.Lock()
-	defer tf.lock.Unlock()
-	tf.featureFlags &^= feature
-
-	if tf.link == nil {
-		return nil
-	}
-
-	if tf.featureFlags == 0 {
-		return tf.close()
-	}
-
-	return tf.bpfObjs.NbFeatures.Put(mapKeyFeatures, tf.featureFlags)
-}
-
-func (tf *GeneralManager) close() error {
-	log.Debugf("detach ebpf program ")
-	err := tf.bpfObjs.Close()
-	if err != nil {
-		log.Warnf("failed to close eBpf objects: %s", err)
-	}
-
-	err = tf.link.Close()
-	tf.link = nil
-	return err
-}
diff --git a/client/internal/ebpf/ebpf/manager_linux_test.go b/client/internal/ebpf/ebpf/manager_linux_test.go
deleted file mode 100644
index 5664a4565..000000000
--- a/client/internal/ebpf/ebpf/manager_linux_test.go
+++ /dev/null
@@ -1,40 +0,0 @@
-package ebpf
-
-import (
-	"testing"
-)
-
-func TestManager_setFeatureFlag(t *testing.T) {
-	mgr := GeneralManager{}
-	mgr.setFeatureFlag(featureFlagWGProxy)
-	if mgr.featureFlags != 1 {
-		t.Errorf("invalid feature state")
-	}
-
-	mgr.setFeatureFlag(featureFlagDnsForwarder)
-	if mgr.featureFlags != 3 {
-		t.Errorf("invalid feature state")
-	}
-}
-
-func TestManager_unsetFeatureFlag(t *testing.T) {
-	mgr := GeneralManager{}
-	mgr.setFeatureFlag(featureFlagWGProxy)
-	mgr.setFeatureFlag(featureFlagDnsForwarder)
-
-	err := mgr.unsetFeatureFlag(featureFlagWGProxy)
-	if err != nil {
-		t.Errorf("unexpected error: %s", err)
-	}
-	if mgr.featureFlags != 2 {
-		t.Errorf("invalid feature state, expected: %d, got: %d", 2, mgr.featureFlags)
-	}
-
-	err = mgr.unsetFeatureFlag(featureFlagDnsForwarder)
-	if err != nil {
-		t.Errorf("unexpected error: %s", err)
-	}
-	if mgr.featureFlags != 0 {
-		t.Errorf("invalid feature state, expected: %d, got: %d", 0, mgr.featureFlags)
-	}
-}
diff --git a/client/internal/ebpf/ebpf/src/dns_fwd.c b/client/internal/ebpf/ebpf/src/dns_fwd.c
deleted file mode 100644
index 5f3fbcc32..000000000
--- a/client/internal/ebpf/ebpf/src/dns_fwd.c
+++ /dev/null
@@ -1,64 +0,0 @@
-const __u32 map_key_dns_ip = 0;
-const __u32 map_key_dns_port = 1;
-
-struct bpf_map_def SEC("maps") nb_map_dns_ip = {
-	.type = BPF_MAP_TYPE_ARRAY,
-	.key_size = sizeof(__u32),
-	.value_size = sizeof(__u32),
-	.max_entries = 10,
-};
-
-struct bpf_map_def SEC("maps") nb_map_dns_port = {
-	.type = BPF_MAP_TYPE_ARRAY,
-	.key_size = sizeof(__u32),
-	.value_size = sizeof(__u16),
-	.max_entries = 10,
-};
-
-__be32 dns_ip = 0;
-__be16 dns_port = 0;
-
-// 13568 is 53 in big endian
-__be16 GENERAL_DNS_PORT = 13568;
-
-bool read_settings() {
-    __u16 *port_value;
-    __u32 *ip_value;
-
-    // read dns ip
-    ip_value = bpf_map_lookup_elem(&nb_map_dns_ip, &map_key_dns_ip);
-    if(!ip_value) {
-        return false;
-    }
-    dns_ip = htonl(*ip_value);
-
-    // read dns port
-    port_value = bpf_map_lookup_elem(&nb_map_dns_port, &map_key_dns_port);
-    if (!port_value) {
-        return false;
-    }
-    dns_port = htons(*port_value);
-    return true;
-}
-
-int xdp_dns_fwd(struct iphdr  *ip, struct udphdr *udp) {
-    if (dns_port == 0) {
-        if(!read_settings()){
-            return XDP_PASS;
-        }
-        // bpf_printk("dns port: %d", ntohs(dns_port));
-        // bpf_printk("dns ip: %d", ntohl(dns_ip));
-    }
-
-    if (udp->dest == GENERAL_DNS_PORT && ip->daddr == dns_ip) {
-        udp->dest = dns_port;
-        return XDP_PASS;
-    }
-
-    if (udp->source == dns_port && ip->saddr == dns_ip) {
-        udp->source = GENERAL_DNS_PORT;
-        return XDP_PASS;
-    }
-
-    return XDP_PASS;
-}
diff --git a/client/internal/ebpf/ebpf/src/prog.c b/client/internal/ebpf/ebpf/src/prog.c
deleted file mode 100644
index f32103f28..000000000
--- a/client/internal/ebpf/ebpf/src/prog.c
+++ /dev/null
@@ -1,60 +0,0 @@
-#include <stdbool.h>
-#include <linux/if_ether.h> // ETH_P_IP
-#include <linux/udp.h>
-#include <linux/ip.h>
-#include <netinet/in.h>
-#include <linux/bpf.h>
-#include <bpf/bpf_helpers.h>
-#include "dns_fwd.c"
-#include "wg_proxy.c"
-
-const __u16 flag_feature_wg_proxy = 0b01;
-const __u16 flag_feature_dns_fwd = 0b10;
-
-const __u32 map_key_features = 0;
-struct bpf_map_def SEC("maps") nb_features = {
-	.type = BPF_MAP_TYPE_ARRAY,
-	.key_size = sizeof(__u32),
-	.value_size = sizeof(__u16),
-	.max_entries = 10,
-};
-
-SEC("xdp")
-int nb_xdp_prog(struct xdp_md *ctx) {
-    __u16 *features;
-    features = bpf_map_lookup_elem(&nb_features, &map_key_features);
-    if (!features) {
-        return XDP_PASS;
-    }
-
-    void *data     = (void *)(long)ctx->data;
-    void *data_end = (void *)(long)ctx->data_end;
-    struct ethhdr *eth = data;
-    struct iphdr  *ip  = (data + sizeof(struct ethhdr));
-    struct udphdr *udp = (data + sizeof(struct ethhdr) + sizeof(struct iphdr));
-
-    // return early if not enough data
-    if (data + sizeof(struct ethhdr) + sizeof(struct iphdr) + sizeof(struct udphdr) > data_end){
-        return XDP_PASS;
-    }
-
-    // skip non IPv4 packages
-    if (eth->h_proto != htons(ETH_P_IP)) {
-       return XDP_PASS;
-    }
-
-    // skip non UPD packages
-    if (ip->protocol != IPPROTO_UDP) {
-       return XDP_PASS;
-    }
-
-    if (*features & flag_feature_dns_fwd) {
-        xdp_dns_fwd(ip, udp);
-    }
-
-    if (*features & flag_feature_wg_proxy) {
-        xdp_wg_proxy(ip, udp);
-    }
-    return XDP_PASS;
-}
-char _license[] SEC("license") = "GPL";
diff --git a/client/internal/ebpf/ebpf/src/readme.md b/client/internal/ebpf/ebpf/src/readme.md
deleted file mode 100644
index 0ab393dd4..000000000
--- a/client/internal/ebpf/ebpf/src/readme.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# DNS forwarder
-
-The agent attach the XDP program to the lo device. We can not use fake address in eBPF because the
-traffic does not appear in the eBPF program. The program capture the traffic on wg_ip:53 and 
-overwrite in it the destination port to 5053.
-
-# Debug
-
-The CONFIG_BPF_EVENTS kernel module is required for bpf_printk.
-Apply this code to use bpf_printk
-```
-#define bpf_printk(fmt, ...)                                                   \
-  ({                                                                           \
-    char ____fmt[] = fmt;                                                      \
-    bpf_trace_printk(____fmt, sizeof(____fmt), ##__VA_ARGS__);                 \
-  })
-```
diff --git a/client/internal/ebpf/ebpf/src/wg_proxy.c b/client/internal/ebpf/ebpf/src/wg_proxy.c
deleted file mode 100644
index 88fea65cf..000000000
--- a/client/internal/ebpf/ebpf/src/wg_proxy.c
+++ /dev/null
@@ -1,54 +0,0 @@
-const __u32 map_key_proxy_port = 0;
-const __u32 map_key_wg_port = 1;
-
-struct bpf_map_def SEC("maps") nb_wg_proxy_settings_map = {
-	.type = BPF_MAP_TYPE_ARRAY,
-	.key_size = sizeof(__u32),
-	.value_size = sizeof(__u16),
-	.max_entries = 10,
-};
-
-__u16 proxy_port = 0;
-__u16 wg_port = 0;
-
-bool read_port_settings() {
-    __u16 *value;
-    value = bpf_map_lookup_elem(&nb_wg_proxy_settings_map, &map_key_proxy_port);
-    if (!value) {
-        return false;
-    }
-
-    proxy_port = *value;
-
-    value = bpf_map_lookup_elem(&nb_wg_proxy_settings_map, &map_key_wg_port);
-    if (!value) {
-        return false;
-    }
-    wg_port = htons(*value);
-
-    return true;
-}
-
-int xdp_wg_proxy(struct iphdr  *ip, struct udphdr *udp) {
-    if (proxy_port == 0 || wg_port == 0) {
-        if (!read_port_settings()){
-            return XDP_PASS;
-        }
-        // bpf_printk("proxy port: %d, wg port: %d", proxy_port, wg_port);
-    }
-
-    // 2130706433 = 127.0.0.1
-    if (ip->daddr != htonl(2130706433)) {
-        return XDP_PASS;
-    }
-
-    if (udp->source != wg_port){
-        return XDP_PASS;
-    }
-
-    __be16 new_src_port = udp->dest;
-    __be16 new_dst_port = htons(proxy_port);
-    udp->dest = new_dst_port;
-    udp->source = new_src_port;
-	return XDP_PASS;
-}
diff --git a/client/internal/ebpf/ebpf/wg_proxy_linux.go b/client/internal/ebpf/ebpf/wg_proxy_linux.go
deleted file mode 100644
index 4e0df7329..000000000
--- a/client/internal/ebpf/ebpf/wg_proxy_linux.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package ebpf
-
-import log "github.com/sirupsen/logrus"
-
-const (
-	mapKeyProxyPort uint32 = 0
-	mapKeyWgPort    uint32 = 1
-)
-
-func (tf *GeneralManager) LoadWgProxy(proxyPort, wgPort int) error {
-	log.Debugf("load ebpf WG proxy")
-	tf.lock.Lock()
-	defer tf.lock.Unlock()
-
-	err := tf.loadXdp()
-	if err != nil {
-		return err
-	}
-
-	err = tf.bpfObjs.NbWgProxySettingsMap.Put(mapKeyProxyPort, uint16(proxyPort))
-	if err != nil {
-		return err
-	}
-
-	err = tf.bpfObjs.NbWgProxySettingsMap.Put(mapKeyWgPort, uint16(wgPort))
-	if err != nil {
-		return err
-	}
-
-	tf.setFeatureFlag(featureFlagWGProxy)
-	err = tf.bpfObjs.NbFeatures.Put(mapKeyFeatures, tf.featureFlags)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func (tf *GeneralManager) FreeWGProxy() error {
-	log.Debugf("free ebpf WG proxy")
-	return tf.unsetFeatureFlag(featureFlagWGProxy)
-}
diff --git a/client/internal/ebpf/instantiater_linux.go b/client/internal/ebpf/instantiater_linux.go
deleted file mode 100644
index 20d8145b4..000000000
--- a/client/internal/ebpf/instantiater_linux.go
+++ /dev/null
@@ -1,15 +0,0 @@
-//go:build !android
-
-package ebpf
-
-import (
-	"github.com/netbirdio/netbird/client/internal/ebpf/ebpf"
-	"github.com/netbirdio/netbird/client/internal/ebpf/manager"
-)
-
-// GetEbpfManagerInstance is a wrapper function. This encapsulation is required because if the code import the internal
-// ebpf package the Go compiler will include the object files. But it is not supported on Android. It can cause instant
-// panic on older Android version.
-func GetEbpfManagerInstance() manager.Manager {
-	return ebpf.GetEbpfManagerInstance()
-}
diff --git a/client/internal/ebpf/instantiater_nonlinux.go b/client/internal/ebpf/instantiater_nonlinux.go
deleted file mode 100644
index b7c38733a..000000000
--- a/client/internal/ebpf/instantiater_nonlinux.go
+++ /dev/null
@@ -1,10 +0,0 @@
-//go:build !linux || android
-
-package ebpf
-
-import "github.com/netbirdio/netbird/client/internal/ebpf/manager"
-
-// GetEbpfManagerInstance return error because ebpf is not supported on all os
-func GetEbpfManagerInstance() manager.Manager {
-	panic("unsupported os")
-}
diff --git a/client/internal/ebpf/manager/manager.go b/client/internal/ebpf/manager/manager.go
deleted file mode 100644
index 25a767090..000000000
--- a/client/internal/ebpf/manager/manager.go
+++ /dev/null
@@ -1,11 +0,0 @@
-package manager
-
-import "net/netip"
-
-// Manager is used to load multiple eBPF programs. E.g., current DNS programs and WireGuard proxy
-type Manager interface {
-	LoadDNSFwd(ip netip.Addr, dnsPort int) error
-	FreeDNSFwd() error
-	LoadWgProxy(proxyPort, wgPort int) error
-	FreeWGProxy() error
-}
diff --git a/client/internal/elevate/elevate.go b/client/internal/elevate/elevate.go
new file mode 100644
index 000000000..aa5a5da78
--- /dev/null
+++ b/client/internal/elevate/elevate.go
@@ -0,0 +1,74 @@
+// Package elevate re-runs this very executable under the operating system's own
+// privilege-elevation mechanism and waits for it to finish.
+//
+// It exists so that a change the daemon restricts to root/administrator can be
+// authorized from the GUI, by the user, at the moment they ask for it: Windows
+// shows the UAC consent dialog, macOS the system authentication dialog, and
+// Linux/FreeBSD the session's polkit agent. The credentials, where any are
+// asked for, are collected by the operating system and never pass through
+// NetBird.
+//
+// What the elevated process then does is the caller's business: it is the same
+// binary, in a one-shot mode, and it is authorized by the daemon exactly like
+// any other privileged caller, from the identity the kernel reports on the
+// control channel. Nothing here grants privilege, and the daemon gains no new
+// way to be talked into something: elevation only changes who is calling it.
+package elevate
+
+import (
+	"context"
+	"errors"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// AppliedMarker is what the elevated process prints on standard output once it has
+// done what it was run for.
+//
+// macOS's AuthorizationExecuteWithPrivileges reports no exit status and does not
+// say which process it started, so there this line is the only evidence that the
+// change was applied. The other platforms have an exit code and ignore it.
+const AppliedMarker = "netbird-elevated: applied"
+
+var (
+	// ErrDeclined reports that the user dismissed the prompt or did not
+	// authenticate. Nothing happened and nothing is wrong: a caller undoes its
+	// optimistic update and stays quiet.
+	ErrDeclined = errors.New("authorization declined")
+
+	// ErrUnavailable reports that this host has no elevation mechanism we can
+	// drive: no polkit on a Unix desktop, or an executable we decline to run as
+	// root. A caller falls back to telling the user which command to run.
+	ErrUnavailable = errors.New("no privilege elevation mechanism available")
+)
+
+// Run runs this executable with args under the platform's elevation mechanism
+// and waits for it to exit. A non-zero exit is returned as an error, so the
+// caller can treat a completed Run as the operation having succeeded.
+//
+// The args are the caller's own command line, so they cross no privilege
+// boundary: only a user who has just authenticated as an administrator can get
+// them run at all.
+func Run(ctx context.Context, args ...string) error {
+	self, err := trustedSelf()
+	if err != nil {
+		return err
+	}
+	return run(ctx, self, args)
+}
+
+// Available reports whether Run has a mechanism to use on this host, so a caller
+// can offer the prompt only when there is one and otherwise fall back to
+// guidance the user can act on. It answers from what is installed, not from what
+// the user is allowed to do: an administrator's password may still be required
+// and may still not be given, which is ErrDeclined from Run.
+func Available() bool {
+	if _, err := trustedSelf(); err != nil {
+		// Worth a line: this is also what a build run from a group-writable
+		// directory hits, and there is nothing in the UI to say why the offer is
+		// missing.
+		log.Debugf("not offering privilege elevation: %v", err)
+		return false
+	}
+	return mechanismAvailable()
+}
diff --git a/client/internal/elevate/output.go b/client/internal/elevate/output.go
new file mode 100644
index 000000000..6e1646bd3
--- /dev/null
+++ b/client/internal/elevate/output.go
@@ -0,0 +1,18 @@
+package elevate
+
+import "strings"
+
+// noOutput stands in for a process that said nothing, so that a report of what it
+// said still reads as a sentence.
+const noOutput = "no output"
+
+func firstLine(s string) string {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return noOutput
+	}
+	if i := strings.IndexByte(s, '\n'); i >= 0 {
+		return s[:i]
+	}
+	return s
+}
diff --git a/client/internal/elevate/output_test.go b/client/internal/elevate/output_test.go
new file mode 100644
index 000000000..3faacf53a
--- /dev/null
+++ b/client/internal/elevate/output_test.go
@@ -0,0 +1,21 @@
+package elevate
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFirstLine(t *testing.T) {
+	tests := []struct{ in, want string }{
+		{in: "", want: noOutput},
+		{in: "  \n ", want: noOutput},
+		{in: "one line", want: "one line"},
+		{in: "first\nsecond", want: "first"},
+		{in: "\nsecond\n", want: "second"},
+	}
+
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, firstLine(tt.in), "input %q", tt.in)
+	}
+}
diff --git a/client/internal/elevate/run_darwin.go b/client/internal/elevate/run_darwin.go
new file mode 100644
index 000000000..6b0e4fc0d
--- /dev/null
+++ b/client/internal/elevate/run_darwin.go
@@ -0,0 +1,359 @@
+package elevate
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"runtime"
+	"strings"
+	"sync"
+	"syscall"
+	"unsafe"
+
+	"github.com/ebitengine/purego"
+	log "github.com/sirupsen/logrus"
+)
+
+// Authorization Services, reached through purego rather than cgo so the released
+// binaries keep building with CGO_ENABLED=0.
+//
+// The prompt belongs to this process, which is what makes it carry the
+// application's name and our own explanation. Going through osascript instead puts
+// the very same trampoline behind a dialog attributed to osascript, and means
+// handing a shell a command line to re-parse.
+//
+// # On AuthorizationExecuteWithPrivileges
+//
+// It is deprecated, and Apple's guidance (Quinn, "BSD Privilege Escalation on
+// macOS", developer.apple.com/forums/thread/708765) is "while it still works, it's
+// been deprecated for many years. Do not use it in a widely distributed product."
+// It is used here anyway, knowingly, because the alternatives Apple offers are for
+// *obtaining* ongoing privileges — an installer package, SMAppService, SMJobBless —
+// and NetBird already has what they would install: a launchd daemon running as
+// root. What is missing is only a way for an unprivileged client to ask it to act.
+//
+// The way to that without a deprecated call is to authorize the client instead of
+// elevating one: the app takes the right with AuthorizationCreate, passes the
+// AuthorizationExternalForm to the daemon, and the daemon checks it with
+// AuthorizationCopyRights before acting — none of which is deprecated. It is the
+// better design and it is where this should end up. It also means the daemon
+// accepting an authorization over its control socket, which is a new way to be
+// asked for privileged work and wants reviewing as such, so it is deliberately not
+// bundled in with the rest of this.
+//
+// Until then, three things keep the deprecation from being a trap. Every symbol is
+// resolved with an error rather than a panic, so a macOS that has dropped this
+// function leaves the app offering the user a command instead of crashing on the
+// way to a prompt. A failure to run the tool is reported as ErrUnavailable, so the
+// fallback is the same one an agent-less Linux session gets. And the whole path
+// runs under guard, which turns a panic out of the FFI layer into that same
+// fallback.
+//
+// The trampoline passes on the environment it was given, so what it starts as root
+// must be an executable this user's peers cannot influence: that is what
+// trustedSelf refuses, and what signing the binary settles for the loader.
+
+const (
+	securityFramework = "/System/Library/Frameworks/Security.framework/Security"
+	libSystem         = "/usr/lib/libSystem.B.dylib"
+
+	// trampoline is what the framework hands the tool to. Present on every macOS,
+	// and worth confirming before offering a prompt rather than mid-prompt.
+	trampoline = "/usr/libexec/security_authtrampoline"
+)
+
+// rightExecute is the right an administrator holds, and what
+// AuthorizationExecuteWithPrivileges requires of us.
+const rightExecute = "system.privilege.admin"
+
+// promptKey is kAuthorizationEnvironmentPrompt, which puts a sentence of ours above
+// the system's in the dialog. It is about the change rather than the mechanism.
+const (
+	promptKey  = "prompt"
+	promptText = "NetBird needs to change a setting that grants SSH access to this computer."
+)
+
+// OSStatus values from SecBase.h that mean something to us; anything else is
+// reported as it comes.
+const (
+	errAuthorizationSuccess               = 0
+	errAuthorizationDenied                = -60005
+	errAuthorizationCanceled              = -60006
+	errAuthorizationInteractionNotAllowed = -60007
+	errAuthorizationToolExecuteFailure    = -60031
+	errAuthorizationToolEnvironmentError  = -60032
+)
+
+// AuthorizationFlags from Authorization.h.
+const (
+	flagDefaults           = 0
+	flagInteractionAllowed = 1 << 0
+	flagExtendRights       = 1 << 1
+	flagDestroyRights      = 1 << 3
+	flagPreAuthorize       = 1 << 4
+)
+
+// authorizationItem mirrors AuthorizationItem: a name, and a value the name gives
+// meaning to. 32 bytes on both amd64 and arm64.
+type authorizationItem struct {
+	name        *byte
+	valueLength uintptr
+	value       unsafe.Pointer
+	// flags is reserved by the API and always zero. Declared because the layout
+	// is the contract: without it the struct is 24 bytes where C reads 32.
+	flags uint32 //nolint:unused // part of the C layout
+}
+
+// authorizationItemSet mirrors AuthorizationItemSet, which serves as both an
+// AuthorizationRights and an AuthorizationEnvironment.
+type authorizationItemSet struct {
+	count uint32
+	items *authorizationItem
+}
+
+var (
+	authorizationCreate                func(rights, environment *authorizationItemSet, flags uint32, authorization *uintptr) int32
+	authorizationExecuteWithPrivileges func(authorization uintptr, pathToTool string, options uint32, arguments *uintptr, communicationsPipe *uintptr) int32
+	authorizationFree                  func(authorization uintptr, flags uint32) int32
+	fileno                             func(stream uintptr) int32
+	fclose                             func(stream uintptr) int32
+
+	loadOnce sync.Once
+	loadErr  error
+)
+
+// load resolves the functions once. A framework that cannot be opened, or a symbol
+// that is no longer there, leaves the host without a mechanism rather than taking
+// the process down with it: see the note on deprecation above.
+func load() error {
+	loadOnce.Do(func() { loadErr = guard("loading Security.framework", resolve) })
+	return loadErr
+}
+
+// guard turns a panic out of the FFI layer into an error, so an API that has
+// changed under us costs the user a prompt rather than the window they were
+// clicking in. purego panics on a signature it cannot map, and this is the one
+// place in the client that calls a deprecated system function.
+//
+// It catches Go panics, which is what purego raises. A fault inside the framework
+// itself is not a panic and not recoverable; the layout the tests pin down is what
+// stands between us and that.
+func guard(what string, fn func() error) (err error) {
+	defer func() {
+		r := recover()
+		if r == nil {
+			return
+		}
+		log.Errorf("%s panicked: %v", what, r)
+		err = fmt.Errorf("%w: %s: %v", ErrUnavailable, what, r)
+	}()
+	return fn()
+}
+
+func resolve() error {
+	security, err := purego.Dlopen(securityFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", securityFramework, err)
+	}
+	system, err := purego.Dlopen(libSystem, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", libSystem, err)
+	}
+
+	// purego.RegisterLibFunc panics on a symbol it cannot find, which is not how a
+	// deprecated function's disappearance should reach the user.
+	for _, fn := range []struct {
+		ptr    any
+		handle uintptr
+		name   string
+	}{
+		{&authorizationCreate, security, "AuthorizationCreate"},
+		{&authorizationExecuteWithPrivileges, security, "AuthorizationExecuteWithPrivileges"},
+		{&authorizationFree, security, "AuthorizationFree"},
+		{&fileno, system, "fileno"},
+		{&fclose, system, "fclose"},
+	} {
+		symbol, err := purego.Dlsym(fn.handle, fn.name)
+		if err != nil {
+			return fmt.Errorf("resolve %s: %w", fn.name, err)
+		}
+		if symbol == 0 {
+			return fmt.Errorf("resolve %s: not present on this system", fn.name)
+		}
+		purego.RegisterFunc(fn.ptr, symbol)
+	}
+	return nil
+}
+
+// run asks the system to run self as root: first for the right, which is what puts
+// up the authentication dialog and collects the password or takes the Touch ID,
+// then for the tool. The credentials go to the system's authorization trampoline
+// and never to us.
+//
+// The context bounds only our own waiting; the dialog belongs to the system and
+// closes when the user answers it.
+func run(ctx context.Context, self string, args []string) error {
+	if err := load(); err != nil {
+		return fmt.Errorf("%w: %v", ErrUnavailable, err)
+	}
+
+	return guard("asking for privileges", func() error {
+		authorization, err := authorize()
+		if err != nil {
+			return err
+		}
+		defer authorizationFree(authorization, flagDestroyRights)
+
+		return execute(ctx, authorization, self, args)
+	})
+}
+
+func mechanismAvailable() bool {
+	if err := load(); err != nil {
+		return false
+	}
+	info, err := os.Stat(trampoline)
+	return err == nil && !info.IsDir()
+}
+
+// authorize obtains the right, prompting for it. A dismissed dialog comes back as
+// errAuthorizationCanceled and a password given up on as errAuthorizationDenied;
+// both are the user's answer rather than a failure.
+func authorize() (uintptr, error) {
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, rightExecute)})
+	environment := itemSet(&pinner, promptItem(&pinner))
+
+	var authorization uintptr
+	status := authorizationCreate(rights, environment,
+		flagDefaults|flagInteractionAllowed|flagPreAuthorize|flagExtendRights, &authorization)
+
+	switch status {
+	case errAuthorizationSuccess:
+		return authorization, nil
+	case errAuthorizationCanceled, errAuthorizationDenied:
+		return 0, ErrDeclined
+	case errAuthorizationInteractionNotAllowed:
+		// Nowhere to put a dialog, so there is nobody to ask: a launch daemon, or
+		// a session with no window server.
+		return 0, fmt.Errorf("%w: this session cannot show an authorization prompt", ErrUnavailable)
+	default:
+		return 0, fmt.Errorf("request %s: OSStatus %d", rightExecute, status)
+	}
+}
+
+// execute runs the tool with the right in hand and waits for it by reading the pipe
+// it is given until the tool closes it.
+//
+// AuthorizationExecuteWithPrivileges reports no exit status and does not say what
+// process it started, which is why the one-shot says so itself: what it prints is
+// the only evidence that the change was applied.
+func execute(ctx context.Context, authorization uintptr, self string, args []string) error {
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	argv := make([]uintptr, 0, len(args)+1)
+	for _, arg := range args {
+		argv = append(argv, uintptr(unsafe.Pointer(cString(&pinner, arg))))
+	}
+	argv = append(argv, 0)
+	pinner.Pin(&argv[0])
+
+	var pipe uintptr
+	status := authorizationExecuteWithPrivileges(authorization, self, flagDefaults, &argv[0], &pipe)
+	switch status {
+	case errAuthorizationSuccess:
+	case errAuthorizationCanceled:
+		return ErrDeclined
+	case errAuthorizationToolExecuteFailure, errAuthorizationToolEnvironmentError:
+		// The right was granted and the tool still did not start. Nothing the user
+		// can do about it from here, so point them at the command instead.
+		return fmt.Errorf("%w: the system would not run %s elevated (OSStatus %d)", ErrUnavailable, self, status)
+	default:
+		return fmt.Errorf("run %s elevated: OSStatus %d", self, status)
+	}
+
+	out, err := readPipe(ctx, pipe)
+	if err != nil {
+		return err
+	}
+	return checkApplied(out)
+}
+
+// checkApplied reads the one-shot's report, which stands in for the exit status
+// there is no way to ask for here. A run that said nothing did not apply the
+// change, whatever else went on.
+func checkApplied(out string) error {
+	if !strings.Contains(out, AppliedMarker) {
+		return fmt.Errorf("elevated netbird did not report the change as applied: %s", firstLine(out))
+	}
+	return nil
+}
+
+// readPipe drains the tool's output, which ends when the tool exits and is
+// therefore also how we wait for it.
+func readPipe(ctx context.Context, pipe uintptr) (string, error) {
+	if pipe == 0 {
+		return "", nil
+	}
+	defer fclose(pipe)
+
+	fd := int(fileno(pipe))
+	if fd < 0 {
+		return "", nil
+	}
+
+	var out strings.Builder
+	buf := make([]byte, 4096)
+	for {
+		if err := ctx.Err(); err != nil {
+			return out.String(), err
+		}
+		n, err := syscall.Read(fd, buf)
+		if n > 0 {
+			out.Write(buf[:n])
+		}
+		switch {
+		case errors.Is(err, syscall.EINTR):
+			// A signal landed mid-read, which says nothing about the tool.
+			continue
+		case err != nil:
+			log.Debugf("read the elevated process's output: %v", err)
+			return out.String(), nil
+		case n <= 0:
+			// End of file: the tool closed the pipe, which is how it exiting
+			// reaches us.
+			return out.String(), nil
+		}
+	}
+}
+
+// itemSet builds an AuthorizationItemSet over items, pinned for the call.
+func itemSet(pinner *runtime.Pinner, items ...authorizationItem) *authorizationItemSet {
+	pinner.Pin(&items[0])
+	set := &authorizationItemSet{count: uint32(len(items)), items: &items[0]}
+	pinner.Pin(set)
+	return set
+}
+
+// promptItem is the environment entry carrying our sentence for the dialog.
+func promptItem(pinner *runtime.Pinner) authorizationItem {
+	value := []byte(promptText)
+	pinner.Pin(&value[0])
+	return authorizationItem{
+		name:        cString(pinner, promptKey),
+		valueLength: uintptr(len(value)),
+		value:       unsafe.Pointer(&value[0]),
+	}
+}
+
+// cString returns a NUL-terminated copy of s, pinned so the C side may hold it for
+// the duration of the call.
+func cString(pinner *runtime.Pinner, s string) *byte {
+	b := append([]byte(s), 0)
+	pinner.Pin(&b[0])
+	return &b[0]
+}
diff --git a/client/internal/elevate/run_darwin_test.go b/client/internal/elevate/run_darwin_test.go
new file mode 100644
index 000000000..f6c58c8cb
--- /dev/null
+++ b/client/internal/elevate/run_darwin_test.go
@@ -0,0 +1,111 @@
+package elevate
+
+import (
+	"errors"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The framework has to load and the symbols have to resolve, or nothing else here
+// means anything.
+func TestSecurityFrameworkLoads(t *testing.T) {
+	require.NoError(t, load(), "Security.framework must open")
+
+	for name, fn := range map[string]any{
+		"AuthorizationCreate":                authorizationCreate,
+		"AuthorizationExecuteWithPrivileges": authorizationExecuteWithPrivileges,
+		"AuthorizationFree":                  authorizationFree,
+		"fileno":                             fileno,
+		"fclose":                             fclose,
+	} {
+		assert.NotNil(t, fn, "%s must resolve", name)
+	}
+}
+
+// A request with no interaction allowed exercises the whole call — the rights and
+// environment structs, and the OSStatus that comes back — without a dialog anybody
+// has to answer. What the system decides is its business; that it decides at all is
+// what this asserts.
+func TestAuthorizationCreateWithoutInteraction(t *testing.T) {
+	if err := load(); err != nil {
+		t.Skipf("Security.framework did not open: %v", err)
+	}
+
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, rightExecute)})
+	environment := itemSet(&pinner, promptItem(&pinner))
+	require.EqualValues(t, 1, rights.count, "the rights struct layout must match the C one")
+
+	var authorization uintptr
+	status := authorizationCreate(rights, environment, flagDefaults|flagExtendRights, &authorization)
+
+	switch status {
+	case errAuthorizationSuccess:
+		// Credentials were already cached for this session.
+		authorizationFree(authorization, flagDestroyRights)
+	case errAuthorizationDenied, errAuthorizationInteractionNotAllowed:
+		// The expected answers when nobody may be asked.
+	default:
+		require.Failf(t, "unknown OSStatus", "AuthorizationCreate returned %d, want a status we recognise", status)
+	}
+}
+
+// Asking with a right nobody has must not be mistaken for a declined prompt: the
+// caller would report nothing at all.
+func TestAuthorizeUnknownRightIsNotDeclined(t *testing.T) {
+	if err := load(); err != nil {
+		t.Skipf("Security.framework did not open: %v", err)
+	}
+
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, "io.netbird.right.that.does.not.exist")})
+
+	var authorization uintptr
+	status := authorizationCreate(rights, nil, flagDefaults|flagExtendRights, &authorization)
+	if status == errAuthorizationSuccess {
+		authorizationFree(authorization, flagDestroyRights)
+	}
+	assert.NotEqual(t, int32(errAuthorizationSuccess), status, "a right that does not exist must not be granted")
+}
+
+func TestMechanismAvailable(t *testing.T) {
+	assert.True(t, mechanismAvailable(), "the trampoline exists on every macOS")
+}
+
+// The one-shot's report is what stands in for an exit status here, so a run that
+// says nothing must not read as success.
+func TestCheckApplied(t *testing.T) {
+	require.NoError(t, checkApplied(AppliedMarker+"\n"), "the report the one-shot prints")
+	require.NoError(t, checkApplied("some warning\n"+AppliedMarker+"\n"), "the report after other output")
+
+	assert.Error(t, checkApplied(""), "a run that printed nothing did not apply the change")
+	assert.Error(t, checkApplied("dyld: library not loaded\n"), "output that is not the report")
+}
+
+// A panic out of the FFI layer has to reach the caller as "no mechanism", which is
+// the outcome that offers the user the command instead of taking the window down.
+func TestGuardTurnsAPanicIntoUnavailable(t *testing.T) {
+	err := guard("pretending to call something", func() error {
+		panic("purego: signature it cannot map")
+	})
+
+	require.ErrorIs(t, err, ErrUnavailable, "a panic must read as a missing mechanism")
+	assert.Contains(t, err.Error(), "pretending to call something", "what panicked")
+}
+
+// guard wraps every darwin path, so what a caller switches on has to survive it.
+func TestGuardPassesErrorsThrough(t *testing.T) {
+	sentinel := errors.New("the call itself failed")
+	assert.ErrorIs(t, guard("calling", func() error { return sentinel }), sentinel,
+		"the error it was given")
+	assert.ErrorIs(t, guard("calling", func() error { return ErrDeclined }), ErrDeclined,
+		"a declined prompt stays declined")
+	assert.NoError(t, guard("calling", func() error { return nil }), "a call that worked")
+}
diff --git a/client/internal/elevate/run_unix.go b/client/internal/elevate/run_unix.go
new file mode 100644
index 000000000..b2de09a49
--- /dev/null
+++ b/client/internal/elevate/run_unix.go
@@ -0,0 +1,117 @@
+//go:build linux
+
+package elevate
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+// pkexec exit codes that are about the authorization rather than about the program
+// we asked it to run. The manual page reserves both.
+const (
+	// exitDismissed is returned when the user dismissed the authentication
+	// dialog.
+	exitDismissed = 126
+	// exitNotAuthorized is returned when the authorization was not obtained. That
+	// covers the user saying no as well as pkexec having had nobody to ask: see
+	// noAgentMarkers.
+	exitNotAuthorized = 127
+)
+
+// exitNotAuthorized covers three different endings that only pkexec's own words
+// tell apart, so they are matched here. Read with LC_ALL=C so the words are the
+// ones written below.
+//
+// refusedMarker is a refusal: the user said no, gave up on the password, or holds
+// an account that may not elevate at all.
+const refusedMarker = "Not authorized"
+
+// noAgentMarkers say pkexec had no way to ask: no agent registered for the
+// session, and no controlling terminal for the textual agent it falls back to.
+var noAgentMarkers = []string{"authentication agent", "controlling terminal"}
+
+// run asks polkit to run self as root. pkexec hands the request to the session's
+// polkit agent, which is what prompts and what collects any password; we see only
+// its verdict.
+//
+// The environment is otherwise deliberately not passed through: pkexec clears it
+// bar a small allowlist, and the one-shot needs nothing from it.
+func run(ctx context.Context, self string, args []string) error {
+	pkexec, err := exec.LookPath("pkexec")
+	if err != nil {
+		return fmt.Errorf("%w: pkexec is not installed", ErrUnavailable)
+	}
+
+	cmd := exec.CommandContext(ctx, pkexec, append([]string{self}, args...)...)
+	// C locale so pkexec's own diagnostics are the ones noAgentMarkers knows.
+	cmd.Env = append(os.Environ(), "LC_ALL=C")
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	// The one-shot reports itself on stdout for macOS's sake, where there is no
+	// exit status to read. Here there is one, so that line is noise.
+	cmd.Stdout = io.Discard
+
+	err = cmd.Run()
+	if err == nil {
+		return nil
+	}
+
+	var exitErr *exec.ExitError
+	if !errors.As(err, &exitErr) {
+		return fmt.Errorf("run pkexec: %w", err)
+	}
+
+	// Matched against everything pkexec said, reported as one line: a complaint
+	// that is not the first thing printed still has to be recognised, and reading
+	// it as a refusal would swallow it.
+	full := stderr.String()
+	out := firstLine(full)
+
+	switch exitErr.ExitCode() {
+	case exitDismissed:
+		return ErrDeclined
+	case exitNotAuthorized:
+		return notAuthorized(full, out)
+	default:
+		return fmt.Errorf("elevated netbird exited with %d: %s", exitErr.ExitCode(), out)
+	}
+}
+
+// notAuthorized sorts out the three endings pkexec reports as exitNotAuthorized.
+//
+// It also returns that code when the authorization succeeded and it then could
+// not run the program, so a refusal has to be recognised rather than assumed:
+// reading every one of these as "the user said no" would revert the control in
+// silence on a host where elevation is broken.
+func notAuthorized(full, out string) error {
+	switch {
+	case hasAny(full, noAgentMarkers):
+		return fmt.Errorf("%w: polkit had no way to ask: %s", ErrUnavailable, out)
+	case out == noOutput, strings.Contains(full, refusedMarker):
+		// The user said no, which needs no message; that an account barred from
+		// elevating altogether lands here too is why the reason is kept.
+		return fmt.Errorf("%w: %s", ErrDeclined, out)
+	default:
+		return fmt.Errorf("pkexec could not run elevated netbird: %s", out)
+	}
+}
+
+func hasAny(s string, markers []string) bool {
+	for _, marker := range markers {
+		if strings.Contains(s, marker) {
+			return true
+		}
+	}
+	return false
+}
+
+func mechanismAvailable() bool {
+	_, err := exec.LookPath("pkexec")
+	return err == nil
+}
diff --git a/client/internal/elevate/run_unix_test.go b/client/internal/elevate/run_unix_test.go
new file mode 100644
index 000000000..c868f9a74
--- /dev/null
+++ b/client/internal/elevate/run_unix_test.go
@@ -0,0 +1,110 @@
+//go:build linux
+
+package elevate
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakePkexec puts a pkexec on PATH that exits with the given code, so the
+// mapping from polkit's exit codes onto our errors can be exercised without a
+// polkit agent.
+func fakePkexec(t *testing.T, exitCode int, stderr string) {
+	t.Helper()
+
+	dir := t.TempDir()
+	script := fmt.Sprintf("#!/bin/sh\necho %s >&2\nexit %d\n", shellQuote(stderr), exitCode)
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pkexec"), []byte(script), 0o700), "write the fake pkexec")
+	t.Setenv("PATH", dir)
+}
+
+func shellQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+}
+
+func TestRunMapsPkexecExitCodes(t *testing.T) {
+	tests := []struct {
+		name     string
+		exitCode int
+		stderr   string
+		wantErr  error
+	}{
+		{name: "applied", exitCode: 0},
+		{
+			name:     "dialog dismissed",
+			exitCode: exitDismissed,
+			stderr:   "Error executing command as another user: Request dismissed",
+			wantErr:  ErrDeclined,
+		},
+		{
+			// What a graphical agent reports for a cancelled prompt. Not a
+			// failure: the user was asked and answered.
+			name:     "prompt cancelled",
+			exitCode: exitNotAuthorized,
+			stderr:   "Error executing command as another user: Not authorized",
+			wantErr:  ErrDeclined,
+		},
+		{
+			// The same status, but pkexec never got to ask anybody.
+			name:     "no agent and no terminal to fall back on",
+			exitCode: exitNotAuthorized,
+			stderr:   "Error creating textual authentication agent: Error opening current controlling terminal for the process (`/dev/tty'): No such device or address",
+			wantErr:  ErrUnavailable,
+		},
+		{
+			// And the same status again once the authorization succeeded and
+			// pkexec could not run what it had been authorized to run. Reading
+			// that as a refusal would revert the control in silence on a host
+			// where elevation is broken.
+			name:     "authorized but not runnable",
+			exitCode: exitNotAuthorized,
+			stderr:   "Error executing command as another user: No such file or directory",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fakePkexec(t, tt.exitCode, tt.stderr)
+
+			err := run(context.Background(), "/nonexistent/netbird-ui", []string{"--flag"})
+			switch {
+			case tt.wantErr != nil:
+				require.ErrorIs(t, err, tt.wantErr, "exit %d said %q", tt.exitCode, tt.stderr)
+			case tt.exitCode == 0:
+				require.NoError(t, err, "a pkexec that exited cleanly applied the change")
+			default:
+				require.Error(t, err, "exit %d said %q", tt.exitCode, tt.stderr)
+				assert.NotErrorIs(t, err, ErrDeclined, "not the user's answer")
+				assert.NotErrorIs(t, err, ErrUnavailable, "not a missing mechanism")
+			}
+		})
+	}
+}
+
+// An exit code that is not polkit's is the one-shot's own failure, and has to
+// stay distinguishable from a declined prompt: the caller reports it.
+func TestRunReportsOneShotFailure(t *testing.T) {
+	fakePkexec(t, 3, "the one-shot said no")
+
+	err := run(context.Background(), "/nonexistent/netbird-ui", nil)
+
+	require.Error(t, err, "a one-shot that failed is not a prompt that was answered")
+	assert.NotErrorIs(t, err, ErrDeclined, "not the user's answer")
+	assert.NotErrorIs(t, err, ErrUnavailable, "not a missing mechanism")
+}
+
+func TestRunWithoutPkexecIsUnavailable(t *testing.T) {
+	t.Setenv("PATH", t.TempDir())
+
+	err := run(context.Background(), "/nonexistent/netbird-ui", nil)
+	require.ErrorIs(t, err, ErrUnavailable, "no pkexec means no mechanism")
+	assert.False(t, mechanismAvailable(), "mechanismAvailable without pkexec on PATH")
+}
diff --git a/client/internal/elevate/run_unsupported.go b/client/internal/elevate/run_unsupported.go
new file mode 100644
index 000000000..d1daf3184
--- /dev/null
+++ b/client/internal/elevate/run_unsupported.go
@@ -0,0 +1,19 @@
+//go:build !windows && !darwin && !linux
+
+package elevate
+
+import "context"
+
+// run reports that this platform has no elevation prompt to drive.
+//
+// The desktop app is the only caller and is not built for any of these: mobile
+// and WASM have no local user to ask, and the FreeBSD client ships without a UI.
+// pkexec would be the mechanism there, and run_unix.go is what to widen if that
+// changes.
+func run(context.Context, string, []string) error {
+	return ErrUnavailable
+}
+
+func mechanismAvailable() bool {
+	return false
+}
diff --git a/client/internal/elevate/run_windows.go b/client/internal/elevate/run_windows.go
new file mode 100644
index 000000000..eef4c23ce
--- /dev/null
+++ b/client/internal/elevate/run_windows.go
@@ -0,0 +1,187 @@
+package elevate
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"runtime"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+const (
+	// seeMaskNoCloseProcess keeps the started process's handle open in
+	// hProcess so we can wait for it.
+	seeMaskNoCloseProcess = 0x00000040
+	// seeMaskNoAsync makes ShellExecuteExW finish its work before returning,
+	// which it must when the calling thread does not pump messages.
+	seeMaskNoAsync = 0x00000100
+	// seeMaskFlagNoUI suppresses the shell's own error dialogs; the UAC consent
+	// dialog is not one of them and still appears.
+	seeMaskFlagNoUI = 0x00000400
+
+	// swHide: the one-shot has no window to show.
+	swHide = 0
+)
+
+// shellExecuteInfoW mirrors SHELLEXECUTEINFOW. The field order and Go's own
+// padding match the C layout on both 386 and amd64.
+type shellExecuteInfoW struct {
+	cbSize         uint32
+	fMask          uint32
+	hwnd           windows.HWND
+	lpVerb         *uint16
+	lpFile         *uint16
+	lpParameters   *uint16
+	lpDirectory    *uint16
+	nShow          int32
+	hInstApp       windows.Handle
+	lpIDList       uintptr
+	lpClass        *uint16
+	hkeyClass      windows.Handle
+	dwHotKey       uint32
+	hIconOrMonitor windows.Handle
+	hProcess       windows.Handle
+}
+
+var (
+	shell32            = windows.NewLazySystemDLL("shell32.dll")
+	procShellExecuteEx = shell32.NewProc("ShellExecuteExW")
+)
+
+// run starts self elevated with the "runas" verb, which is what raises the UAC
+// consent dialog, and waits for it to finish. Windows decides whether consent is
+// enough or an administrator's credentials are needed, and collects them itself.
+func run(ctx context.Context, self string, args []string) error {
+	verb, err := windows.UTF16PtrFromString("runas")
+	if err != nil {
+		return fmt.Errorf("encode verb: %w", err)
+	}
+	file, err := windows.UTF16PtrFromString(self)
+	if err != nil {
+		return fmt.Errorf("encode %s: %w", self, err)
+	}
+	params, err := windows.UTF16PtrFromString(windows.ComposeCommandLine(args))
+	if err != nil {
+		return fmt.Errorf("encode arguments: %w", err)
+	}
+
+	info := shellExecuteInfoW{
+		fMask:        seeMaskNoCloseProcess | seeMaskNoAsync | seeMaskFlagNoUI,
+		hwnd:         ownerWindow(),
+		lpVerb:       verb,
+		lpFile:       file,
+		lpParameters: params,
+		nShow:        swHide,
+	}
+	info.cbSize = uint32(unsafe.Sizeof(info))
+
+	process, err := shellExecute(&info)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := windows.CloseHandle(process); err != nil {
+			log.Debugf("close elevated process handle: %v", err)
+		}
+	}()
+
+	return waitForProcess(ctx, process)
+}
+
+// shellExecute performs the call itself. ShellExecuteExW wants COM initialised on
+// the calling thread, so the goroutine is pinned to one for the duration and COM
+// is set up on it; an "already initialised, different mode" answer is fine,
+// because then somebody else has done it for us.
+func shellExecute(info *shellExecuteInfoW) (windows.Handle, error) {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	switch err := windows.CoInitializeEx(0, windows.COINIT_APARTMENTTHREADED); {
+	case err == nil, isHResult(err, windows.S_FALSE):
+		// Ours, or already initialised in the same mode: either way this call
+		// counts and has to be balanced.
+		defer windows.CoUninitialize()
+	case isHResult(err, windows.RPC_E_CHANGED_MODE):
+		// The thread is already in the other apartment model. ShellExecuteExW
+		// works there too, and there is nothing of ours to balance.
+	default:
+		return 0, fmt.Errorf("initialise COM: %w", err)
+	}
+
+	ret, _, lastErr := procShellExecuteEx.Call(uintptr(unsafe.Pointer(info)))
+	if ret != 0 {
+		return info.hProcess, nil
+	}
+
+	if errors.Is(lastErr, windows.ERROR_CANCELLED) {
+		return 0, ErrDeclined
+	}
+	return 0, fmt.Errorf("run elevated: %w", lastErr)
+}
+
+// ownerWindow returns this process's foreground window, and 0 when the window in
+// front belongs to somebody else or cannot be attributed. ShellExecuteExW takes it
+// as the parent for the UI it raises, which is what keeps the consent dialog in
+// front of the window the user was just clicking in instead of behind it. It is
+// also what a remote-desktop session needs to place the dialog at all when the
+// secure desktop is switched off.
+func ownerWindow() windows.HWND {
+	hwnd := windows.GetForegroundWindow()
+	if hwnd == 0 {
+		return 0
+	}
+
+	var pid uint32
+	if _, err := windows.GetWindowThreadProcessId(hwnd, &pid); err != nil {
+		log.Debugf("cannot attribute the foreground window, raising the prompt without an owner: %v", err)
+		return 0
+	}
+	if pid != windows.GetCurrentProcessId() {
+		return 0
+	}
+	return hwnd
+}
+
+// isHResult reports whether err carries the given HRESULT. CoInitializeEx
+// returns its HRESULT as an Errno, so the comparison is on the raw value.
+func isHResult(err error, hresult windows.Handle) bool {
+	var errno windows.Errno
+	return errors.As(err, &errno) && uintptr(errno) == uintptr(hresult)
+}
+
+func waitForProcess(ctx context.Context, process windows.Handle) error {
+	// The wait is interruptible so a cancelled context stops us waiting on a
+	// consent dialog nobody is going to answer. The elevated process is not
+	// ours to kill, and it either applies the change or does not.
+	for {
+		event, err := windows.WaitForSingleObject(process, 250)
+		if err != nil {
+			return fmt.Errorf("wait for the elevated process: %w", err)
+		}
+		if event == uint32(windows.WAIT_OBJECT_0) {
+			break
+		}
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+	}
+
+	var code uint32
+	if err := windows.GetExitCodeProcess(process, &code); err != nil {
+		return fmt.Errorf("read the elevated process's exit code: %w", err)
+	}
+	if code != 0 {
+		return fmt.Errorf("elevated netbird exited with %d", code)
+	}
+	return nil
+}
+
+// mechanismAvailable is true on Windows: UAC prompts for consent when the user
+// is an administrator and for an administrator's credentials when they are not,
+// so there is always something to ask.
+func mechanismAvailable() bool {
+	return true
+}
diff --git a/client/internal/elevate/trusted.go b/client/internal/elevate/trusted.go
new file mode 100644
index 000000000..98e05fde5
--- /dev/null
+++ b/client/internal/elevate/trusted.go
@@ -0,0 +1,51 @@
+package elevate
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// CheckOnlyOwnerWritable reports an error unless path, and every directory
+// leading to it, is owned by an account that can already act with the privileges
+// the caller holds, and is writable by nobody else.
+//
+// Exported for callers outside elevation that read a file while privileged and
+// then act on what it says: the same question this package asks of an
+// executable, asked of a configuration file.
+func CheckOnlyOwnerWritable(path string) error {
+	return checkOnlyOwnerWritable(path)
+}
+
+// trustedSelf returns the path of this executable, provided it is one we are
+// willing to have run as root.
+//
+// The check is what keeps elevation from becoming a way to launder someone
+// else's code into a root process: the user consents to NetBird being elevated,
+// having been shown NetBird's name, so what runs must be the file NetBird was
+// installed as and not something a third party could have swapped for it. An
+// executable only its owner can write is that; anything wider is refused, and
+// the caller falls back to showing the command instead.
+//
+// The owner writing to their own executable is not part of that threat: code
+// running as the user can already prompt them for anything, and could just as
+// well ask them to run the command by hand. What matters is that no *other*
+// unprivileged account can reach it.
+func trustedSelf() (string, error) {
+	exe, err := os.Executable()
+	if err != nil {
+		return "", fmt.Errorf("locate this executable: %w", err)
+	}
+
+	// Resolve symlinks so the checks below apply to the file that would actually
+	// be executed, not to a link somebody else may control.
+	resolved, err := filepath.EvalSymlinks(exe)
+	if err != nil {
+		return "", fmt.Errorf("resolve %s: %w", exe, err)
+	}
+
+	if err := checkOnlyOwnerWritable(resolved); err != nil {
+		return "", fmt.Errorf("%w: %s cannot be trusted to run as root: %w", ErrUnavailable, resolved, err)
+	}
+	return resolved, nil
+}
diff --git a/client/internal/elevate/trusted_group_darwin.go b/client/internal/elevate/trusted_group_darwin.go
new file mode 100644
index 000000000..a4b387ec4
--- /dev/null
+++ b/client/internal/elevate/trusted_group_darwin.go
@@ -0,0 +1,10 @@
+package elevate
+
+// adminWriteGIDs are the groups whose write access to an executable does not
+// widen who could authorize elevating it.
+//
+// macOS installs applications as root:admin, mode 0775, /Applications included,
+// so requiring owner-only write would reject every normal install. Group admin
+// (gid 80) is exactly the set of accounts that can answer the authentication
+// dialog, so its write access grants nothing the prompt would not.
+var adminWriteGIDs = []uint32{0, 80}
diff --git a/client/internal/elevate/trusted_group_unix.go b/client/internal/elevate/trusted_group_unix.go
new file mode 100644
index 000000000..7aa336423
--- /dev/null
+++ b/client/internal/elevate/trusted_group_unix.go
@@ -0,0 +1,9 @@
+//go:build !windows && !darwin
+
+package elevate
+
+// adminWriteGIDs are the groups whose write access to an executable does not
+// widen who could authorize elevating it. Only root's own group qualifies here:
+// a distribution installs into root-owned directories, and there is no
+// system-wide administrators group that both writes them and answers polkit.
+var adminWriteGIDs = []uint32{0}
diff --git a/client/internal/elevate/trusted_unix.go b/client/internal/elevate/trusted_unix.go
new file mode 100644
index 000000000..f9d1a1b7e
--- /dev/null
+++ b/client/internal/elevate/trusted_unix.go
@@ -0,0 +1,119 @@
+//go:build !windows
+
+package elevate
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"syscall"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/getent"
+)
+
+// checkOnlyOwnerWritable reports an error unless path, and every directory leading
+// to it, is owned by either root or this user and writable by nobody who could not
+// already act as its owner. A writable directory is as good as a writable file,
+// since anything in it can be replaced, so the whole chain is checked.
+func checkOnlyOwnerWritable(path string) error {
+	self := uint32(os.Getuid())
+
+	for dir := path; ; dir = filepath.Dir(dir) {
+		info, err := os.Lstat(dir)
+		if err != nil {
+			return fmt.Errorf("stat %s: %w", dir, err)
+		}
+
+		stat, ok := info.Sys().(*syscall.Stat_t)
+		if !ok {
+			return errors.New("file ownership is unavailable on this platform")
+		}
+		if stat.Uid != 0 && stat.Uid != self {
+			return fmt.Errorf("%s is owned by uid %d, neither root nor this user", dir, stat.Uid)
+		}
+
+		if err := checkWriteBits(dir, info, stat.Uid, stat.Gid); err != nil {
+			return err
+		}
+
+		if parent := filepath.Dir(dir); parent == dir {
+			return nil
+		}
+	}
+}
+
+func checkWriteBits(path string, info os.FileInfo, uid, gid uint32) error {
+	// On a directory the sticky bit stands in for the write bits: whoever may
+	// write there still cannot replace an entry they do not own, which is the
+	// only thing that would matter to us. /tmp is the usual example.
+	sticky := info.IsDir() && info.Mode()&os.ModeSticky != 0
+
+	return writeBitsAllow(path, info.Mode().Perm(), sticky, groupWriteAllowed(uid, gid))
+}
+
+// writeBitsAllow decides on the permission bits alone, given whether the group's
+// write access has been vouched for.
+func writeBitsAllow(path string, perm os.FileMode, sticky, groupAllowed bool) error {
+	if sticky {
+		return nil
+	}
+	if perm&0o020 != 0 && !groupAllowed {
+		return fmt.Errorf("%s is writable by a group with members other than its owner (%v)", path, perm)
+	}
+	if perm&0o002 != 0 {
+		return fmt.Errorf("%s is world-writable (%v)", path, perm)
+	}
+	return nil
+}
+
+// groupWriteAllowed reports whether a group's write access to a file owned by uid
+// puts it in reach of anyone who could not already act as that owner.
+//
+// Two ways it does not. A group in adminWriteGIDs holds the accounts that can
+// answer the elevation prompt anyway. And a user private group is how Debian,
+// Ubuntu and Fedora ship: their umask of 002 makes a home directory and
+// everything built in it group-writable, so refusing that would refuse every
+// build not installed from a package.
+func groupWriteAllowed(uid, gid uint32) bool {
+	if slices.Contains(adminWriteGIDs, gid) {
+		return true
+	}
+
+	group, err := getent.LookupGroupID(strconv.FormatUint(uint64(gid), 10))
+	if err != nil {
+		log.Debugf("cannot look up group %d, treating it as shared: %v", gid, err)
+		return false
+	}
+	owner, err := getent.LookupUserID(strconv.FormatUint(uint64(uid), 10))
+	if err != nil {
+		log.Debugf("cannot look up uid %d, treating its group as shared: %v", uid, err)
+		return false
+	}
+
+	if group.Name != owner.Username {
+		return false
+	}
+	return !groupHasOtherMembers(group.Name, owner.Username)
+}
+
+// groupHasOtherMembers reports whether the group lists a member besides owner.
+//
+// Sharing the owner's name is what a user private group is recognised by, and it
+// says nothing about who is in it: a group that has since gained a member is
+// still named that way, and that member can write whatever the group can. So the
+// membership is read rather than assumed. A group whose members cannot be
+// listed, because no source on this host describes it, is treated as shared:
+// the name alone cannot vouch for who writes through it.
+func groupHasOtherMembers(name, owner string) bool {
+	members, err := getent.GroupMembers(name)
+	if err != nil {
+		log.Debugf("cannot list the members of group %q, treating it as shared: %v", name, err)
+		return true
+	}
+	return slices.ContainsFunc(members, func(member string) bool { return member != owner })
+}
diff --git a/client/internal/elevate/trusted_unix_test.go b/client/internal/elevate/trusted_unix_test.go
new file mode 100644
index 000000000..7c0c5a966
--- /dev/null
+++ b/client/internal/elevate/trusted_unix_test.go
@@ -0,0 +1,148 @@
+//go:build !windows
+
+package elevate
+
+import (
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// ownerOnlyDir is t.TempDir() with the write bits tightened. testing creates its
+// numbered directory with 0777 minus the umask, so under the common 002 umask it
+// is group-writable and would fail the check under test on its own.
+func ownerOnlyDir(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(dir, 0o755), "tighten the temporary directory")
+	return dir
+}
+
+// writeExecutable creates a plain executable file, the shape trustedSelf checks.
+func writeExecutable(t *testing.T, dir string) string {
+	t.Helper()
+	path := filepath.Join(dir, "netbird-ui")
+	require.NoError(t, os.WriteFile(path, []byte("#!/bin/sh\n"), 0o755), "write the executable")
+	require.NoError(t, os.Chmod(path, 0o755), "set the executable's mode")
+	return path
+}
+
+func TestCheckOnlyOwnerWritableAcceptsOwnerOnly(t *testing.T) {
+	err := checkOnlyOwnerWritable(writeExecutable(t, ownerOnlyDir(t)))
+	assert.NoError(t, err, "an owner-only writable executable is trustworthy")
+}
+
+func TestCheckOnlyOwnerWritableRejectsWorldWritableFile(t *testing.T) {
+	path := writeExecutable(t, ownerOnlyDir(t))
+	require.NoError(t, os.Chmod(path, 0o777), "make the executable world-writable")
+
+	assert.Error(t, checkOnlyOwnerWritable(path), "a world-writable executable must be refused")
+}
+
+// The permission policy on its own, without a filesystem to arrange: whether the
+// group has been vouched for is the only thing that makes group write acceptable.
+func TestWriteBitsAllow(t *testing.T) {
+	tests := []struct {
+		name         string
+		perm         os.FileMode
+		sticky       bool
+		groupAllowed bool
+		wantErr      bool
+	}{
+		{name: "owner only", perm: 0o755},
+		{name: "group write in a private group", perm: 0o775, groupAllowed: true},
+		{name: "group write in a shared group", perm: 0o775, wantErr: true},
+		{name: "world write", perm: 0o777, groupAllowed: true, wantErr: true},
+		{name: "world write on a sticky directory", perm: 0o777, sticky: true},
+		{name: "group write on a sticky directory", perm: 0o775, sticky: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := writeBitsAllow("/path", tt.perm, tt.sticky, tt.groupAllowed)
+			if tt.wantErr {
+				assert.Error(t, err, "perm %v, sticky %v, group allowed %v", tt.perm, tt.sticky, tt.groupAllowed)
+				return
+			}
+			assert.NoError(t, err, "perm %v, sticky %v, group allowed %v", tt.perm, tt.sticky, tt.groupAllowed)
+		})
+	}
+}
+
+// A build under a home directory on a distribution with a 002 umask, which is what
+// a locally built or tarball-installed binary looks like. Its group has no members
+// but its owner, so it is as good as owner-only.
+//
+// Whether this host is such a distribution is read from the environment rather than
+// from groupWriteAllowed: asking the function under test whether to run would let
+// it skip its own coverage away if it regressed to refusing everything.
+func TestCheckOnlyOwnerWritableAcceptsOwnPrivateGroup(t *testing.T) {
+	requirePrivatePrimaryGroup(t)
+
+	dir := ownerOnlyDir(t)
+	path := writeExecutable(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o775), "make the directory group-writable")
+	require.NoError(t, os.Chmod(path, 0o775), "make the executable group-writable")
+
+	err := checkOnlyOwnerWritable(path)
+	assert.NoError(t, err, "group write in the owner's own private group reaches nobody else")
+}
+
+// A group whose membership no source can answer for is treated as shared: the
+// private-group allowance must not stand on a name nobody can vouch for. The
+// membership listing itself lives in the getent package and is tested there.
+func TestGroupHasOtherMembersRejectsAnUnknownGroup(t *testing.T) {
+	assert.True(t, groupHasOtherMembers("nonexistent_group_xyzzy_12345", "vma"),
+		"a group no source describes")
+}
+
+// A writable directory is as good as a writable file: whoever can write the
+// directory can put a different binary at the same path.
+func TestCheckOnlyOwnerWritableRejectsWritableDirectory(t *testing.T) {
+	dir := filepath.Join(ownerOnlyDir(t), "bin")
+	require.NoError(t, os.Mkdir(dir, 0o755), "create the directory")
+	path := writeExecutable(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o777), "make the directory world-writable")
+
+	assert.Error(t, checkOnlyOwnerWritable(path), "an executable in a world-writable directory must be refused")
+}
+
+// A sticky world-writable directory is exempt: the sticky bit is what stops one
+// user replacing another's entries. /tmp is why this matters.
+func TestCheckOnlyOwnerWritableAcceptsStickyDirectory(t *testing.T) {
+	dir := filepath.Join(ownerOnlyDir(t), "sticky")
+	require.NoError(t, os.Mkdir(dir, 0o755), "create the directory")
+	path := writeExecutable(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o777|os.ModeSticky), "make the directory sticky and world-writable")
+
+	err := checkOnlyOwnerWritable(path)
+	assert.NoError(t, err, "the sticky bit stops another user replacing the executable")
+}
+
+func TestCheckOnlyOwnerWritableRejectsMissingFile(t *testing.T) {
+	err := checkOnlyOwnerWritable(filepath.Join(ownerOnlyDir(t), "absent"))
+	assert.Error(t, err, "an executable that is not there must be refused")
+}
+
+// requirePrivatePrimaryGroup skips unless this user's primary group is their own,
+// which is what the user-private-group allowance is about.
+func requirePrivatePrimaryGroup(t *testing.T) {
+	t.Helper()
+
+	self, err := user.Current()
+	require.NoError(t, err, "look up the test user")
+	group, err := user.LookupGroupId(strconv.Itoa(os.Getgid()))
+	require.NoError(t, err, "look up the test user's primary group")
+
+	if group.Name != self.Username {
+		t.Skipf("the test user's primary group is %q, not their own, so there is nothing to assert here", group.Name)
+	}
+	if groupHasOtherMembers(group.Name, self.Username) {
+		t.Skipf("group %q has other members, so it is not a private group", group.Name)
+	}
+}
diff --git a/client/internal/elevate/trusted_windows.go b/client/internal/elevate/trusted_windows.go
new file mode 100644
index 000000000..8fb05fd88
--- /dev/null
+++ b/client/internal/elevate/trusted_windows.go
@@ -0,0 +1,215 @@
+package elevate
+
+import (
+	"errors"
+	"fmt"
+	"path/filepath"
+	"slices"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+const (
+	// fileDeleteChild is FILE_DELETE_CHILD, which x/sys does not define: the
+	// right to delete an entry of a directory without holding DELETE on it.
+	fileDeleteChild = 0x00000040
+
+	// accessAllowedCallbackACEType is an allow ACE with a condition appended to
+	// the ACCESS_ALLOWED_ACE layout, so its trustee is still at SidStart.
+	accessAllowedCallbackACEType = 0x9
+
+	// The allow ACE types that carry object GUIDs ahead of the trustee, so the
+	// SID is not at SidStart. They occur on directory-service objects rather
+	// than files, and are refused rather than skipped: see aceTrustee.
+	accessAllowedObjectACEType         = 0x5
+	accessAllowedCallbackObjectACEType = 0xB
+)
+
+// fileWriteAccess are the rights that let a trustee rewrite or replace a file,
+// or take it over and then do so.
+const fileWriteAccess = windows.FILE_WRITE_DATA | windows.FILE_APPEND_DATA |
+	windows.DELETE | windows.WRITE_DAC | windows.WRITE_OWNER |
+	windows.GENERIC_WRITE | windows.GENERIC_ALL
+
+// dirWriteAccess are the rights over a directory that let a trustee replace an
+// entry somebody else owns. Creating a new entry is not one of them, which is
+// what the Unix sticky bit says in one bit: the root of every volume grants
+// BUILTIN\Users the right to add directories under it, and that reaches nothing
+// already there.
+const dirWriteAccess = fileDeleteChild | windows.DELETE |
+	windows.WRITE_DAC | windows.WRITE_OWNER | windows.GENERIC_ALL
+
+// trustedInstallerSID owns much of what Windows itself installs. x/sys has no
+// well-known constant for it.
+const trustedInstallerSID = "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464"
+
+// checkOnlyOwnerWritable reports an error unless path, and every directory
+// leading to it, is owned by an account that can elevate (or by this user) and
+// grants write access to nobody else. A writable directory is as good as a
+// writable file, since an entry in it can be replaced, so the whole chain is
+// checked.
+func checkOnlyOwnerWritable(path string) error {
+	owners, err := trustedOwners()
+	if err != nil {
+		return err
+	}
+	writers, err := trustedWriters(owners)
+	if err != nil {
+		return err
+	}
+
+	writeAccess := windows.ACCESS_MASK(fileWriteAccess)
+	for target := path; ; target = filepath.Dir(target) {
+		if err := checkSecurity(target, writeAccess, owners, writers); err != nil {
+			return err
+		}
+		if parent := filepath.Dir(target); parent == target {
+			return nil
+		}
+		writeAccess = dirWriteAccess
+	}
+}
+
+// trustedOwners are the accounts we accept as the owner of the executable and of
+// the directories above it: the ones that can already answer the UAC prompt,
+// plus this user, whose own executable is theirs to write. Code running as the
+// user could prompt them for anything anyway; what matters is that no *other*
+// unprivileged account can reach it.
+func trustedOwners() ([]*windows.SID, error) {
+	self, err := currentUserSID()
+	if err != nil {
+		return nil, err
+	}
+
+	owners := []*windows.SID{self}
+	for _, wellKnown := range []windows.WELL_KNOWN_SID_TYPE{
+		windows.WinLocalSystemSid,
+		windows.WinBuiltinAdministratorsSid,
+	} {
+		sid, err := windows.CreateWellKnownSid(wellKnown)
+		if err != nil {
+			return nil, fmt.Errorf("build well-known SID %d: %w", wellKnown, err)
+		}
+		owners = append(owners, sid)
+	}
+
+	installer, err := windows.StringToSid(trustedInstallerSID)
+	if err != nil {
+		return nil, fmt.Errorf("parse TrustedInstaller SID: %w", err)
+	}
+	return append(owners, installer), nil
+}
+
+// trustedWriters are the trustees whose write access does not widen who could
+// decide what runs behind the prompt. The owners, and CREATOR OWNER, which
+// resolves to the object's owner and is therefore already vetted.
+func trustedWriters(owners []*windows.SID) ([]*windows.SID, error) {
+	creatorOwner, err := windows.CreateWellKnownSid(windows.WinCreatorOwnerSid)
+	if err != nil {
+		return nil, fmt.Errorf("build the CREATOR OWNER SID: %w", err)
+	}
+	return append(slices.Clone(owners), creatorOwner), nil
+}
+
+func checkSecurity(path string, writeAccess windows.ACCESS_MASK, owners, writers []*windows.SID) error {
+	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
+		windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
+	if err != nil {
+		return fmt.Errorf("read security descriptor of %s: %w", path, err)
+	}
+
+	owner, _, err := sd.Owner()
+	if err != nil {
+		return fmt.Errorf("read owner of %s: %w", path, err)
+	}
+	if !containsSID(owners, owner) {
+		return fmt.Errorf("%s is owned by %s, which is neither this user nor an account that can elevate", path, owner)
+	}
+
+	dacl, _, err := sd.DACL()
+	if err != nil {
+		return fmt.Errorf("read DACL of %s: %w", path, err)
+	}
+	// A NULL DACL grants everyone everything; only an absent security
+	// descriptor would have got us here without one, and neither is trustworthy.
+	if dacl == nil {
+		return fmt.Errorf("%s has no DACL, so it grants write access to everyone", path)
+	}
+
+	return checkDACL(path, dacl, writeAccess, writers)
+}
+
+// checkDACL refuses an ACL that grants write access to a trustee outside
+// writers.
+//
+// An allowlist, because the trustees that must not have it cannot be listed: an
+// ACE naming an ordinary user account hands that account the same power as one
+// naming Everyone, and only the accounts that may hold it are knowable.
+func checkDACL(path string, dacl *windows.ACL, writeAccess windows.ACCESS_MASK, writers []*windows.SID) error {
+	for i := uint32(0); i < uint32(dacl.AceCount); i++ {
+		var ace *windows.ACCESS_ALLOWED_ACE
+		if err := windows.GetAce(dacl, i, &ace); err != nil {
+			return fmt.Errorf("read ACE %d of %s: %w", i, path, err)
+		}
+		// An inherit-only ACE says what children of this object get, not what
+		// this object grants.
+		if ace.Header.AceFlags&windows.INHERIT_ONLY_ACE != 0 {
+			continue
+		}
+		if ace.Mask&writeAccess == 0 {
+			continue
+		}
+		// Only an allow ACE grants anything; a deny ACE narrows what one gave.
+		if !isAllowACE(ace.Header.AceType) {
+			continue
+		}
+
+		trustee, err := aceTrustee(ace)
+		if err != nil {
+			return fmt.Errorf("read the trustee of ACE %d of %s: %w", i, path, err)
+		}
+		if !containsSID(writers, trustee) {
+			return fmt.Errorf("%s grants write access to %s", path, trustee)
+		}
+	}
+	return nil
+}
+
+// isAllowACE reports whether an ACE type grants rights, rather than denying,
+// auditing or labelling them.
+func isAllowACE(aceType uint8) bool {
+	switch aceType {
+	case windows.ACCESS_ALLOWED_ACE_TYPE, accessAllowedCallbackACEType,
+		accessAllowedObjectACEType, accessAllowedCallbackObjectACEType:
+		return true
+	default:
+		return false
+	}
+}
+
+// aceTrustee returns who an allow ACE grants its rights to. An ACE whose trustee
+// cannot be located is an error rather than something to skip past: being unable
+// to read who is being given write access is a refusal.
+func aceTrustee(ace *windows.ACCESS_ALLOWED_ACE) (*windows.SID, error) {
+	switch ace.Header.AceType {
+	case windows.ACCESS_ALLOWED_ACE_TYPE, accessAllowedCallbackACEType:
+		//nolint:gosec // SidStart is the first uint32 of the variable-length SID that follows the ACE header.
+		return (*windows.SID)(unsafe.Pointer(&ace.SidStart)), nil
+	default:
+		return nil, errors.New("an object-type allow ACE does not carry its trustee where we can read it")
+	}
+}
+
+func containsSID(sids []*windows.SID, sid *windows.SID) bool {
+	return slices.ContainsFunc(sids, sid.Equals)
+}
+
+func currentUserSID() (*windows.SID, error) {
+	token := windows.GetCurrentProcessToken()
+	user, err := token.GetTokenUser()
+	if err != nil {
+		return nil, fmt.Errorf("read this process's user: %w", err)
+	}
+	return user.User.Sid, nil
+}
diff --git a/client/internal/elevate/trusted_windows_test.go b/client/internal/elevate/trusted_windows_test.go
new file mode 100644
index 000000000..946e7b7c8
--- /dev/null
+++ b/client/internal/elevate/trusted_windows_test.go
@@ -0,0 +1,126 @@
+package elevate
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+// A file the test user created under their own profile, which is what a per-user
+// install looks like. The whole chain up to the volume root is walked, so this is
+// also what says the walk does not refuse an ordinary Windows installation: the
+// root of every volume grants BUILTIN\Users rights that are not ours to worry
+// about.
+func TestCheckOnlyOwnerWritableAcceptsOwnFile(t *testing.T) {
+	err := checkOnlyOwnerWritable(writeExecutable(t))
+	assert.NoError(t, err, "a file the test user owns, under directories only administrators can write")
+}
+
+// Write access held by an account that cannot answer the UAC prompt means that
+// account decides what runs behind it, whoever the ACE names. The trustees that
+// must not have it cannot be listed, so the check names the ones that may.
+func TestCheckOnlyOwnerWritableRejectsUntrustedWriters(t *testing.T) {
+	tests := []struct {
+		name      string
+		wellKnown windows.WELL_KNOWN_SID_TYPE
+	}{
+		{name: "everyone", wellKnown: windows.WinWorldSid},
+		{name: "authenticated users", wellKnown: windows.WinAuthenticatedUserSid},
+		{name: "builtin users", wellKnown: windows.WinBuiltinUsersSid},
+		// A service account, which no denylist of the obvious groups would name
+		// and which cannot elevate any more than Everyone can.
+		{name: "local service", wellKnown: windows.WinLocalServiceSid},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := writeExecutable(t)
+			grantWrite(t, path, tt.wellKnown)
+
+			assert.Error(t, checkOnlyOwnerWritable(path),
+				"write access for %s must be refused", tt.name)
+		})
+	}
+}
+
+// The masks are the policy: on a file any write reaches its contents, while on a
+// directory only deleting or taking over an entry reaches something already
+// there. Adding an entry does not, which is why the walk survives a volume root.
+func TestWriteAccessMasks(t *testing.T) {
+	assert.NotZero(t, fileWriteAccess&windows.FILE_WRITE_DATA, "writing a file's data reaches its contents")
+	assert.NotZero(t, fileWriteAccess&windows.FILE_APPEND_DATA, "appending to a file reaches its contents")
+
+	assert.Zero(t, dirWriteAccess&windows.FILE_WRITE_DATA, "adding a file to a directory replaces nothing")
+	assert.Zero(t, dirWriteAccess&windows.FILE_APPEND_DATA, "adding a subdirectory replaces nothing")
+	assert.NotZero(t, dirWriteAccess&fileDeleteChild, "deleting an entry replaces it")
+	assert.NotZero(t, dirWriteAccess&windows.DELETE, "deleting the directory takes its entries with it")
+}
+
+func TestIsAllowACE(t *testing.T) {
+	tests := []struct {
+		name    string
+		aceType uint8
+		want    bool
+	}{
+		{name: "allowed", aceType: windows.ACCESS_ALLOWED_ACE_TYPE, want: true},
+		{name: "allowed callback", aceType: accessAllowedCallbackACEType, want: true},
+		{name: "allowed object", aceType: accessAllowedObjectACEType, want: true},
+		{name: "allowed callback object", aceType: accessAllowedCallbackObjectACEType, want: true},
+		{name: "denied", aceType: windows.ACCESS_DENIED_ACE_TYPE},
+		// SYSTEM_AUDIT_ACE_TYPE, which x/sys does not define: an ACE that records
+		// access rather than granting it.
+		{name: "audit", aceType: 0x2},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isAllowACE(tt.aceType), "ACE type %#x", tt.aceType)
+		})
+	}
+}
+
+// writeExecutable creates a plain file under the test's own directory, the shape
+// trustedSelf checks.
+func writeExecutable(t *testing.T) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "netbird-ui.exe")
+	require.NoError(t, os.WriteFile(path, []byte("MZ"), 0o755), "write the executable")
+	return path
+}
+
+// grantWrite replaces the file's DACL with one that grants a well-known trustee
+// everything, keeping the test user's own access so the file stays deletable.
+func grantWrite(t *testing.T, path string, wellKnown windows.WELL_KNOWN_SID_TYPE) {
+	t.Helper()
+
+	trustee, err := windows.CreateWellKnownSid(wellKnown)
+	require.NoError(t, err, "build the trustee SID")
+	self, err := currentUserSID()
+	require.NoError(t, err, "read the test user's SID")
+
+	acl, err := windows.ACLFromEntries([]windows.EXPLICIT_ACCESS{
+		fullControl(self, windows.TRUSTEE_IS_USER),
+		fullControl(trustee, windows.TRUSTEE_IS_WELL_KNOWN_GROUP),
+	}, nil)
+	require.NoError(t, err, "build the ACL")
+
+	require.NoError(t, windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
+		windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
+		nil, nil, acl, nil), "set the DACL")
+}
+
+func fullControl(sid *windows.SID, trusteeType uint32) windows.EXPLICIT_ACCESS {
+	return windows.EXPLICIT_ACCESS{
+		AccessPermissions: windows.GENERIC_ALL,
+		AccessMode:        windows.GRANT_ACCESS,
+		Trustee: windows.TRUSTEE{
+			TrusteeForm:  windows.TRUSTEE_IS_SID,
+			TrusteeType:  windows.TRUSTEE_TYPE(trusteeType),
+			TrusteeValue: windows.TrusteeValueFromSID(sid),
+		},
+	}
+}
diff --git a/client/internal/engine.go b/client/internal/engine.go
index db679b8c2..5f5b57eaf 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -14,15 +14,18 @@ import (
 	"sort"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/pion/ice/v4"
 	"github.com/pion/stun/v3"
 	log "github.com/sirupsen/logrus"
+	wgdevice "golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
+	"github.com/netbirdio/netbird/client/anonymize"
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/firewall"
 	"github.com/netbirdio/netbird/client/firewall/firewalld"
@@ -34,12 +37,12 @@ import (
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/acl"
+	"github.com/netbirdio/netbird/client/internal/certproof"
 	"github.com/netbirdio/netbird/client/internal/debug"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
 	"github.com/netbirdio/netbird/client/internal/dnsfwd"
 	"github.com/netbirdio/netbird/client/internal/expose"
-	"github.com/netbirdio/netbird/client/internal/ingressgw"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/metrics"
 	"github.com/netbirdio/netbird/client/internal/netflow"
@@ -55,16 +58,21 @@ import (
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/routemanager"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
+	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/client/internal/syncstore"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/jobexec"
+	"github.com/netbirdio/netbird/client/netevents"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/system"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/route"
 	mgm "github.com/netbirdio/netbird/shared/management/client"
 	"github.com/netbirdio/netbird/shared/management/domain"
+	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
+	nbnetworkmap "github.com/netbirdio/netbird/shared/management/networkmap"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+	types "github.com/netbirdio/netbird/shared/management/types"
 	"github.com/netbirdio/netbird/shared/netiputil"
 	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
@@ -89,6 +97,13 @@ const (
 	// exec, os.Stat); without this bound a single stuck call freezes handleSync, and
 	// thus syncMsgMux, for as long as the call hangs (observed multi-minute freezes).
 	systemInfoTimeout = 15 * time.Second
+
+	// dnsForwarderStopTimeout bounds how long stopping the DNS forwarder waits
+	// for the queries still in flight. One waiting on an unresponsive upstream
+	// would otherwise hold the stop for the whole upstream timeout, and the
+	// stop runs with syncMsgMux held. The sockets are closed either way, so
+	// giving up costs a query that was already failing.
+	dnsForwarderStopTimeout = 2 * time.Second
 )
 
 var ErrResetConnection = fmt.Errorf("reset connection")
@@ -132,6 +147,7 @@ type EngineConfig struct {
 	RosenpassPermissive bool
 
 	ServerSSHAllowed              bool
+	RemoteJobsAllowed             bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -147,6 +163,7 @@ type EngineConfig struct {
 	BlockLANAccess      bool
 	BlockInbound        bool
 	DisableIPv6         bool
+	SyncMessageVersion  *int
 
 	// LazyConnection is the MDM-sourced lazy-connection override; StateUnset defers to
 	// the env var and management feature flag.
@@ -154,6 +171,8 @@ type EngineConfig struct {
 
 	MTU uint16
 
+	CertStore certproof.Config
+
 	// for debug bundle generation
 	ProfileConfig *profilemanager.Config
 
@@ -176,6 +195,9 @@ type EngineServices struct {
 	UpdateManager  *updater.Manager
 	ClientMetrics  *metrics.ClientMetrics
 	MetricsCtx     context.Context
+	// NetMgr gates the reconnection loops on OS-reported network
+	// availability; nil disables gating.
+	NetMgr *netevents.Manager
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -199,6 +221,10 @@ type Engine struct {
 	config    *EngineConfig
 	mobileDep MobileDependency
 
+	// netMgr gates the peer reconnection guards on OS-reported network
+	// availability; nil disables gating.
+	netMgr *netevents.Manager
+
 	// STUNs is a list of STUN servers used by ICE
 	STUNs []*stun.URI
 	// TURNs is a list of STUN servers used by ICE
@@ -215,16 +241,26 @@ type Engine struct {
 
 	wgInterface WGIface
 
+	// wgDevice is a lock-free handle on the WireGuard device behind
+	// wgInterface. Reaching the device through wgInterface requires
+	// syncMsgMux, which handleSync holds while it adds and removes peers;
+	// SetPerformance must stay reachable exactly when that work is stuck.
+	wgDevice atomic.Pointer[wgdevice.Device]
+
 	udpMux *udpmux.UniversalUDPMuxDefault
 
+	// wgDetector is shared by every ICE agent through the ICE config.
+	wgDetector *stdnet.WGDetector
+
 	// networkSerial is the latest CurrentSerial (state ID) of the network sent by the Management service
 	networkSerial uint64
 
-	// forwardingRules holds the ingress forward rules applied for the current target.
-	// Wholesale sections (incl. forward rules) run only on the first pass of a target;
-	// it is stashed here so the final, peer-converged pass can build the lazy-connection
-	// exclude list without recomputing them on every bounded peer pass.
-	forwardingRules []firewallManager.ForwardRule
+	// latestComponents is the most-recent NetworkMapComponents decoded from
+	// a NetworkMapEnvelope (capability=3 peers only). Held alongside the
+	// NetworkMap that Calculate() produced from it so future incremental
+	// updates have a base to apply changes against. nil for legacy-format
+	// peers. Guarded by syncMsgMux.
+	latestComponents *types.NetworkMapComponents
 
 	networkMonitor *networkmonitor.NetworkMonitor
 
@@ -232,16 +268,35 @@ type Engine struct {
 
 	statusRecorder *peer.Status
 
-	firewall          firewallManager.Manager
-	routeManager      routemanager.Manager
-	acl               acl.Manager
-	dnsForwardMgr     *dnsfwd.Manager
-	ingressGatewayMgr *ingressgw.Manager
+	firewall      firewallManager.Manager
+	routeManager  routemanager.Manager
+	acl           acl.Manager
+	dnsForwardMgr *dnsfwd.Manager
 
 	dnsServer dns.Server
 
-	// checks are the client-applied posture checks that need to be evaluated on the client
-	checks []*mgmProto.Checks
+	// checks are the client-applied posture checks that need to be evaluated on the client.
+	// Writers hold syncMsgMux and checksMu; readers hold either, see appliedChecks.
+	checks   []*mgmProto.Checks
+	checksMu sync.RWMutex
+	// pendingChecks are the newest received checks whose meta sync failed; the posture
+	// watcher retries them. Both are guarded by syncMsgMux, and
+	// hasPendingChecks lets the watcher skip the lock when nothing is pending.
+	pendingChecks    []*mgmProto.Checks
+	hasPendingChecks atomic.Bool
+	// infoTimeout overrides systemInfoTimeout when set.
+	infoTimeout time.Duration
+
+	// certProofs answers the certificate challenges in checks within a bounded time, and
+	// certState remembers what it last proved.
+	certProofs certproof.Collector
+	certState  certPostureState
+	// certWake wakes the posture watcher, which owns proof collection; certSendMu orders
+	// the meta syncs that carry proofs.
+	certWake   chan struct{}
+	certSendMu sync.Mutex
+
+	infoSource system.InfoSource
 
 	relayManager       *relayClient.Manager
 	stateManager       *statemanager.Manager
@@ -280,6 +335,20 @@ type Engine struct {
 	jobExecutorWG sync.WaitGroup
 
 	exposeManager *expose.Manager
+
+	sessionWatcher sessionDeadlineWatcher
+}
+
+// sessionDeadlineWatcher is the engine-facing surface of the SSO session
+// expiry watcher. The concrete implementation (sessionwatch.Watcher) is wired
+// in via newSessionWatcher, which is build-tagged so the js/wasm build links a
+// no-op stub instead of pulling the full sessionwatch package (and its timer
+// machinery) into the binary — the wasm client never runs the engine's
+// session-warning flow.
+type sessionDeadlineWatcher interface {
+	Update(deadline time.Time) error
+	Dismiss()
+	Close()
 }
 
 // Peer is an instance of the Connection Peer
@@ -292,6 +361,10 @@ type localIpUpdater interface {
 	UpdateLocalIPs() error
 }
 
+// overlayRebind rebuilds one subsystem's sockets on the current interface. The
+// error it returns names its own subsystem, since the caller can only log it.
+type overlayRebind func() error
+
 // NewEngine creates a new Connection Engine with probes attached
 func NewEngine(
 	clientCtx context.Context,
@@ -314,9 +387,11 @@ func NewEngine(
 		mgmClient:          services.MgmClient,
 		relayManager:       services.RelayManager,
 		peerStore:          peerstore.NewConnStore(),
+		wgDetector:         stdnet.NewWGDetector(config.WgIfaceName),
 		syncMsgMux:         &sync.Mutex{},
 		config:             config,
 		mobileDep:          mobileDep,
+		netMgr:             services.NetMgr,
 		STUNs:              []*stun.URI{},
 		TURNs:              []*stun.URI{},
 		networkSerial:      0,
@@ -324,6 +399,7 @@ func NewEngine(
 		stateManager:       services.StateManager,
 		portForwardManager: portforward.NewManager(),
 		checks:             services.Checks,
+		certWake:           make(chan struct{}, 1),
 		probeStunTurn:      relay.NewStunTurnProbe(relay.DefaultCacheTTL),
 		jobExecutor:        jobexec.NewExecutor(),
 		clientMetrics:      services.ClientMetrics,
@@ -331,6 +407,17 @@ func NewEngine(
 		updateManager:      services.UpdateManager,
 		syncStoreDir:       config.StateDir,
 	}
+	// sessionWatcher keeps the SubscribeStatus consumers in sync with the
+	// session expiry deadline. Deadline-change ticks come for free via
+	// Status.SetSessionExpiresAt; the watcher exists to push a wake-up at
+	// T-WarningLead and T-FinalWarningLead so the UI repaints the remaining
+	// time / warning state even when nothing else changed, and to publish
+	// two SystemEvents (the warning composition lives in sessionwatch so
+	// the wire format stays owned by one package):
+	//   - T-WarningLead   → interactive "Extend now / Dismiss" notification
+	//   - T-FinalWarningLead → auto-opened SessionAboutToExpire dialog,
+	//     suppressed when the user dismissed the earlier warning
+	engine.sessionWatcher = newSessionWatcher(engine.statusRecorder)
 
 	log.Infof("I am: %s", config.WgPrivateKey.PublicKey().String())
 	return engine
@@ -386,19 +473,16 @@ func (e *Engine) stopLocked() {
 
 	e.cleanupSSHConfig()
 
-	if e.ingressGatewayMgr != nil {
-		if err := e.ingressGatewayMgr.Close(); err != nil {
-			log.Warnf("failed to cleanup forward rules: %v", err)
-		}
-		e.ingressGatewayMgr = nil
-	}
-
 	if e.srWatcher != nil {
 		e.srWatcher.Close()
 	}
 
+	if e.sessionWatcher != nil {
+		e.sessionWatcher.Close()
+	}
+
 	if e.updateManager != nil {
-		e.updateManager.SetDownloadOnly()
+		e.updateManager.ResetMode()
 	}
 
 	log.Info("cleaning up status recorder states")
@@ -528,7 +612,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		} else {
 			log.Infof("running rosenpass in strict mode")
 		}
-		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName)
+		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName, publicKey)
 		if err != nil {
 			return fmt.Errorf("create rosenpass manager: %w", err)
 		}
@@ -538,12 +622,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	}
 	e.stateManager.Start()
 
-	initialRoutes, dnsConfig, dnsFeatureFlag, err := e.readInitialSettings()
-	if err != nil {
-		return fmt.Errorf("read initial settings: %w", err)
-	}
-
-	dnsServer, err := e.newDnsServer(dnsConfig)
+	dnsServer, err := e.newDnsServer()
 	if err != nil {
 		return fmt.Errorf("create dns server: %w", err)
 	}
@@ -561,10 +640,8 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		WGInterface:         e.wgInterface,
 		StatusRecorder:      e.statusRecorder,
 		RelayManager:        e.relayManager,
-		InitialRoutes:       initialRoutes,
 		StateManager:        e.stateManager,
 		DNSServer:           dnsServer,
-		DNSFeatureFlag:      dnsFeatureFlag,
 		PeerStore:           e.peerStore,
 		DisableClientRoutes: e.config.DisableClientRoutes,
 		DisableServerRoutes: e.config.DisableServerRoutes,
@@ -600,10 +677,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		log.Errorf("failed to pull up wgInterface [%s]: %s", e.wgInterface.Name(), err.Error())
 		return fmt.Errorf("up wg interface: %w", err)
 	}
-
-	// Set up notrack rules immediately after proxy is listening to prevent
-	// conntrack entries from being created before the rules are in place
-	e.setupWGProxyNoTrack()
+	e.wgDevice.Store(e.wgInterface.GetWGDevice())
 
 	// Start after interface is up since port may have been resolved from 0 or changed if occupied
 	e.shutdownWg.Add(1)
@@ -612,6 +686,12 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		e.portForwardManager.Start(e.ctx, uint16(e.config.WgPort))
 	}()
 
+	e.shutdownWg.Add(1)
+	go func(ctx context.Context) {
+		defer e.shutdownWg.Done()
+		e.watchCertificatePosture(ctx)
+	}(e.ctx)
+
 	// Set the WireGuard interface for rosenpass after interface is up
 	if e.rpManager != nil {
 		e.rpManager.SetInterface(e.wgInterface)
@@ -629,8 +709,24 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	iceCfg := e.createICEConfig()
 
 	e.connMgr = NewConnMgr(e.config, e.statusRecorder, e.peerStore, wgIface)
+	e.connMgr.SetRoutedIPsReconciler(func(peerKey string) error {
+		if e.routeManager == nil {
+			return nil
+		}
+		return e.routeManager.ReconcilePeerAllowedIPs(peerKey)
+	})
 	e.connMgr.Start(e.ctx)
 
+	// Wire DNS-time lazy-connection warm-up now that the connection manager
+	// exists (it does not at DNS-server construction time). A DNS answer that
+	// points at an idle peer then wakes it before the client's first request.
+	e.dnsServer.SetPeerActivator(&dnsPeerActivator{
+		connMgr:   e.connMgr,
+		peerStore: e.peerStore,
+		status:    e.statusRecorder,
+		ctx:       e.ctx,
+	})
+
 	e.srWatcher = guard.NewSRWatcher(e.signal, e.relayManager, e.mobileDep.IFaceDiscover, iceCfg)
 	e.srWatcher.Start(peer.IsForceRelayed())
 
@@ -691,6 +787,11 @@ func (e *Engine) initFirewall() error {
 		return fmt.Errorf("set firewall: %w", err)
 	}
 
+	// TODO: the firewall backends dedup filter rules by content, so a
+	// management route ACL with identical content would collapse onto the
+	// untracked drop rules installed here, and a later management delete
+	// could remove them. Needs backend refcounting or per-consumer key
+	// namespacing.
 	if e.config.BlockLANAccess {
 		e.blockLanAccess()
 	}
@@ -703,14 +804,14 @@ func (e *Engine) initFirewall() error {
 	port := firewallManager.Port{Values: []uint16{uint16(rosenpassPort)}}
 
 	// IPv4-only: rosenpass peers connect via AllowedIps[0] which is always v4.
-	if _, err := e.firewall.AddPeerFiltering(
+	if _, err := e.firewall.AddFilterRule(
 		nil,
-		net.IP{0, 0, 0, 0},
+		[]netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)},
+		firewallManager.Network{},
 		firewallManager.ProtocolUDP,
 		nil,
 		&port,
 		firewallManager.ActionAccept,
-		"",
 	); err != nil {
 		log.Errorf("failed to allow rosenpass interface traffic: %v", err)
 		return nil
@@ -721,23 +822,6 @@ func (e *Engine) initFirewall() error {
 	return nil
 }
 
-// setupWGProxyNoTrack configures connection tracking exclusion for WireGuard proxy traffic.
-// This prevents conntrack/MASQUERADE from affecting loopback traffic between WireGuard and the eBPF proxy.
-func (e *Engine) setupWGProxyNoTrack() {
-	if e.firewall == nil {
-		return
-	}
-
-	proxyPort := e.wgInterface.GetProxyPort()
-	if proxyPort == 0 {
-		return
-	}
-
-	if err := e.firewall.SetupEBPFProxyNoTrack(proxyPort, uint16(e.config.WgPort)); err != nil {
-		log.Warnf("failed to setup ebpf proxy notrack: %v", err)
-	}
-}
-
 func (e *Engine) blockLanAccess() {
 	if e.config.BlockInbound {
 		// no need to set up extra deny rules if inbound is already blocked in general
@@ -760,7 +844,7 @@ func (e *Engine) blockLanAccess() {
 		if network.Addr().Is6() {
 			source = v6
 		}
-		if _, err := e.firewall.AddRouteFiltering(
+		if _, err := e.firewall.AddFilterRule(
 			nil,
 			[]netip.Prefix{source},
 			firewallManager.Network{Prefix: network},
@@ -920,11 +1004,13 @@ func (e *Engine) handleAutoUpdateVersion(autoUpdateSettings *mgmProto.AutoUpdate
 	}
 
 	if autoUpdateSettings == nil {
+		log.Infof("no auto-update settings received, defaulting to download-only")
+		e.updateManager.SetDownloadOnly()
 		return
 	}
 
 	if autoUpdateSettings.Version == disableAutoUpdate {
-		log.Infof("auto-update is disabled")
+		log.Infof("auto-update is disabled, switching to download-only")
 		e.updateManager.SetDownloadOnly()
 		return
 	}
@@ -955,8 +1041,14 @@ func (e *Engine) applySyncPass(update *mgmProto.SyncResponse, firstPass bool) (b
 		return false, e.ctx.Err()
 	}
 
-	if update.NetworkMap != nil && update.NetworkMap.PeerConfig != nil {
-		e.handleAutoUpdateVersion(update.NetworkMap.PeerConfig.AutoUpdate)
+	e.ApplySessionDeadline(update.GetSessionExpiresAt())
+
+	// Envelope sync responses carry PeerConfig at the top level; legacy
+	// NetworkMap syncs carry it under NetworkMap.PeerConfig.
+	if pc := update.GetPeerConfig(); pc != nil {
+		e.handleAutoUpdateVersion(pc.GetAutoUpdate())
+	} else if nm := update.GetNetworkMap(); nm != nil && nm.GetPeerConfig() != nil {
+		e.handleAutoUpdateVersion(nm.GetPeerConfig().GetAutoUpdate())
 	}
 
 	done := e.phase("netbird_config")
@@ -966,12 +1058,51 @@ func (e *Engine) applySyncPass(update *mgmProto.SyncResponse, firstPass bool) (b
 		return false, err
 	}
 
+	// Decode the network map from either the components envelope or the
+	// legacy proto.NetworkMap before the posture-check gating below, so the
+	// "is there a network map" decision covers both wire shapes.
+	var (
+		nm         *mgmProto.NetworkMap
+		components *types.NetworkMapComponents
+	)
+	if version := update.GetVersion(); version == int32(sharedgrpc.ComponentNetworkMap) {
+		// Components-format peer: decode the envelope back to typed
+		// components, run Calculate() locally, and convert to the wire
+		// NetworkMap shape the rest of the engine consumes. Components are
+		// retained so future incremental updates can apply deltas instead
+		// of doing a full reconstruction.
+		envelope := update.GetNetworkMapEnvelope()
+		if envelope == nil {
+			return false, fmt.Errorf("received a SyncReponse indicating use of components network map, but components are missing")
+		}
+
+		localKey := e.config.WgPrivateKey.PublicKey().String()
+		dnsName := ""
+		if pc := update.GetPeerConfig(); pc != nil {
+			// PeerConfig.Fqdn = "<dns_label>.<dns_domain>" — extract the
+			// shared domain by stripping the peer's own label prefix. Falls
+			// back to empty if the FQDN doesn't have the expected shape.
+			dnsName = extractDNSDomainFromFQDN(pc.GetFqdn())
+		}
+		// With the firewall disabled there is no ACL manager to program, so
+		// RoutesFirewallRules would be built and then dropped. On a peer that
+		// routes many network resources that is the single most expensive
+		// step of the sync.
+		result, err := nbnetworkmap.EnvelopeToNetworkMap(e.ctx, envelope, localKey, dnsName, e.config.DisableFirewall)
+		if err != nil {
+			return false, fmt.Errorf("decode network map envelope: %w", err)
+		}
+		nm = result.NetworkMap
+		components = result.Components
+	} else {
+		nm = update.GetNetworkMap()
+	}
+
 	// Posture checks are bound to the network map presence:
 	//   NetworkMap != nil, checks present -> apply the received checks
 	//   NetworkMap != nil, checks nil     -> posture checks were removed, clear them
 	//   NetworkMap == nil                 -> config-only update (e.g. relay token rotation),
 	//                                        leave the previously applied checks untouched
-	nm := update.GetNetworkMap()
 	if nm == nil {
 		return false, nil
 	}
@@ -983,6 +1114,14 @@ func (e *Engine) applySyncPass(update *mgmProto.SyncResponse, firstPass bool) (b
 		return false, err
 	}
 
+	// Only retain the components view when the server sent the envelope
+	// path. A legacy proto.NetworkMap means components == nil; writing it
+	// here would clobber a previously-cached snapshot, breaking the
+	// incremental-delta base on a future envelope sync.
+	if components != nil {
+		e.latestComponents = components
+	}
+
 	// only apply new changes and ignore old ones
 	more, err := e.updateNetworkMap(nm, maxPeersPerSyncPass, firstPass)
 	if err != nil {
@@ -994,6 +1133,19 @@ func (e *Engine) applySyncPass(update *mgmProto.SyncResponse, firstPass bool) (b
 	return more, nil
 }
 
+// extractDNSDomainFromFQDN returns the trailing dotted domain part of the
+// receiving peer's FQDN — the same value the management server fills as
+// dnsName when it builds the legacy NetworkMap. "peer42.netbird.cloud" →
+// "netbird.cloud". An empty string is returned for unrecognized formats.
+func extractDNSDomainFromFQDN(fqdn string) string {
+	for i := 0; i < len(fqdn); i++ {
+		if fqdn[i] == '.' && i+1 < len(fqdn) {
+			return fqdn[i+1:]
+		}
+	}
+	return ""
+}
+
 // updateNetbirdConfig applies the management-provided NetBird configuration:
 // STUN/TURN and relay servers, flow logging and DNS settings. A nil config is a no-op,
 // which is the case for sync updates carrying only a network map.
@@ -1129,24 +1281,54 @@ func toFlowLoggerConfig(config *mgmProto.FlowConfig) (*nftypes.FlowConfig, error
 func (e *Engine) updateChecksIfNew(checks []*mgmProto.Checks) error {
 	// if checks are equal, we skip the update
 	if isChecksEqual(e.checks, checks) {
+		e.clearPendingChecks()
 		return nil
 	}
-	e.checks = checks
-
-	info, ok := system.GetInfoWithChecksTimeout(e.ctx, systemInfoTimeout, checks, e.overlayAddresses()...)
-	if !ok {
-		// Gathering timed out; skip the meta sync this cycle rather than blocking the
-		// sync loop (and syncMsgMux) on a stuck system call. A later sync will retry.
-		return nil
-	}
-	e.applyInfoFlags(info)
-
-	if err := e.mgmClient.SyncMeta(info); err != nil {
-		return fmt.Errorf("could not sync meta: error %s", err)
+	if err := e.syncChecksMeta(checks); err != nil {
+		// The newest checks become the pending ones whatever failed, so the watcher
+		// never retries a set they superseded.
+		e.pendingChecks = checks
+		e.hasPendingChecks.Store(true)
+		if errors.Is(err, errSystemInfoTimeout) {
+			return nil
+		}
+		return err
 	}
+	e.setAppliedChecks(checks)
+	e.clearPendingChecks()
 	return nil
 }
 
+// appliedChecks returns the posture checks in effect, for callers that do not hold
+// syncMsgMux. The slice is replaced, never modified, so it may be read after return.
+func (e *Engine) appliedChecks() []*mgmProto.Checks {
+	e.checksMu.RLock()
+	defer e.checksMu.RUnlock()
+	return e.checks
+}
+
+// setAppliedChecks replaces the posture checks in effect. The caller holds syncMsgMux.
+func (e *Engine) setAppliedChecks(checks []*mgmProto.Checks) {
+	e.checksMu.Lock()
+	e.checks = checks
+	e.checksMu.Unlock()
+	e.wakeCertificatePosture()
+}
+
+// clearPendingChecks drops checks whose meta sync was still owed. The caller holds
+// syncMsgMux.
+func (e *Engine) clearPendingChecks() {
+	e.pendingChecks = nil
+	e.hasPendingChecks.Store(false)
+}
+
+func (e *Engine) infoGatherTimeout() time.Duration {
+	if e.infoTimeout > 0 {
+		return e.infoTimeout
+	}
+	return systemInfoTimeout
+}
+
 // applyInfoFlags sets the engine's config-derived feature flags on the gathered system info.
 func (e *Engine) applyInfoFlags(info *system.Info) {
 	info.SetFlags(
@@ -1160,14 +1342,40 @@ func (e *Engine) applyInfoFlags(info *system.Info) {
 		e.config.BlockLANAccess,
 		e.config.BlockInbound,
 		e.config.DisableIPv6,
+		e.config.SyncMessageVersion,
 		e.config.EnableSSHRoot,
 		e.config.EnableSSHSFTP,
 		e.config.EnableSSHLocalPortForwarding,
 		e.config.EnableSSHRemotePortForwarding,
 		e.config.DisableSSHAuth,
+		&e.config.RemoteJobsAllowed,
 	)
 }
 
+func (e *Engine) currentSystemInfo(ctx context.Context) *system.Info {
+	info := e.infoSource.Current(ctx, e.overlayAddresses()...)
+	e.applyInfoFlags(info)
+	e.attachCertificateProofs(info, e.appliedChecks())
+	return info
+}
+
+// syncInfoFunc returns the info callback for the management sync stream. The
+// first connect sends the info refreshed right before it instead of gathering
+// again; every reconnect gathers a fresh one. The stream retry loop calls the
+// callback sequentially, so the handoff needs no synchronization.
+func (e *Engine) syncInfoFunc(refreshed *system.Info) func(ctx context.Context) *system.Info {
+	return func(ctx context.Context) *system.Info {
+		if refreshed == nil {
+			return e.currentSystemInfo(ctx)
+		}
+		info := refreshed
+		refreshed = nil
+		e.applyInfoFlags(info)
+		e.attachCertificateProofs(info, e.appliedChecks())
+		return info
+	}
+}
+
 // overlayAddresses returns our own WireGuard overlay address (v4 and v6) so it
 // can be excluded from the reported network addresses; the interface coming and
 // going otherwise churns the peer meta on the management server.
@@ -1250,6 +1458,13 @@ func (e *Engine) receiveJobEvents() {
 				ID:     msg.ID,
 				Status: mgmProto.JobStatus_failed,
 			}
+			// Remote jobs are an explicit opt-in. When not enabled on this
+			// peer, every job is refused before any work is done.
+			if !e.config.RemoteJobsAllowed {
+				log.Warnf("refusing remote job: remote jobs are not enabled on this peer (enable with --allow-remote-jobs)")
+				resp.Reason = []byte("remote jobs are not enabled on this peer")
+				return &resp
+			}
 			switch params := msg.WorkloadParameters.(type) {
 			case *mgmProto.JobRequest_Bundle:
 				bundleResult, err := e.handleBundle(params.Bundle)
@@ -1279,7 +1494,25 @@ func (e *Engine) receiveJobEvents() {
 }
 
 func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobResponse_Bundle, error) {
-	log.Infof("handle remote debug bundle request: %s", params.String())
+	// The upload URL can carry a host, credentials, or query tokens, so it is
+	// kept out of the info-level line; the full parameters stay available at
+	// debug level for troubleshooting.
+	log.Infof("handle remote debug bundle request: anonymize=%v anonymize_level=%q log_file_count=%d bundle_for=%v bundle_for_time=%d",
+		params.GetAnonymize(), params.GetAnonymizeLevel(), params.GetLogFileCount(), params.GetBundleFor(), params.GetBundleForTime())
+	log.Debugf("remote debug bundle request parameters: %s", params.String())
+
+	// Resolve the upload destination: an MDM override, when set, takes
+	// precedence over the management-supplied URL. Both are validated the same
+	// way; an empty result falls back to the default upload server downstream.
+	uploadURL := params.GetUploadUrl()
+	if override := e.config.ProfileConfig.DebugBundleUploadURL; override != "" {
+		log.Infof("using MDM debug bundle upload URL override instead of the management-supplied value")
+		uploadURL = override
+	}
+	if err := validateBundleUploadURL(uploadURL); err != nil {
+		return nil, err
+	}
+
 	syncResponse, err := e.GetLatestSyncResponse()
 	if err != nil {
 		log.Warnf("get latest sync response: %v", err)
@@ -1294,19 +1527,20 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 		ClientMetrics:  e.clientMetrics,
 		DaemonVersion:  version.NetbirdVersion(),
 		RefreshStatus: func() {
-			e.RunHealthProbes(true)
+			e.RunHealthProbes(e.ctx, true)
 		},
 	}
 
 	bundleJobParams := debug.BundleConfig{
 		Anonymize:         params.Anonymize,
+		AnonymizeLevel:    anonymize.ParseLevel(params.AnonymizeLevel),
 		IncludeSystemInfo: true,
 		LogFileCount:      uint32(params.LogFileCount),
 	}
 
 	waitFor := time.Duration(params.BundleForTime) * time.Minute
 
-	uploadKey, err := e.jobExecutor.BundleJob(e.ctx, bundleDeps, bundleJobParams, waitFor, e.config.ProfileConfig.ManagementURL.String())
+	uploadKey, err := e.jobExecutor.BundleJob(e.ctx, bundleDeps, bundleJobParams, waitFor, e.config.ProfileConfig.ManagementURL.String(), uploadURL)
 	if err != nil {
 		return nil, err
 	}
@@ -1319,17 +1553,25 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 	return response, nil
 }
 
+// validateBundleUploadURL sanity-checks a management-supplied upload URL for a
+// remote debug bundle job. It delegates to profilemanager.ValidateBundleUploadURL
+// so the executor and the MDM policy override share one definition of the rule
+// (empty accepted; otherwise a well-formed https URL with a host) and cannot
+// drift. The host is deliberately left unconstrained pending a decision on
+// management-directed uploads.
+func validateBundleUploadURL(raw string) error {
+	return profilemanager.ValidateBundleUploadURL(raw)
+}
+
 // receiveManagementEvents connects to the Management Service event stream to receive updates from the management service
 // E.g. when a new peer has been registered and we are allowed to connect to it.
 func (e *Engine) receiveManagementEvents() {
 	e.shutdownWg.Add(1)
 	go func() {
 		defer e.shutdownWg.Done()
-		info, ok := system.GetInfoWithChecksTimeout(e.ctx, systemInfoTimeout, e.checks, e.overlayAddresses()...)
+		info, ok := e.infoSource.Refresh(e.ctx, e.infoGatherTimeout(), e.appliedChecks(), e.overlayAddresses()...)
 		if !ok {
-			// Gathering timed out; connect the stream with base info so management
-			// connectivity still comes up rather than blocking here.
-			info = system.GetInfo(e.ctx)
+			log.Warnf("posture checks not refreshed before the sync connect, sending the previous results")
 		}
 		e.applyInfoFlags(info)
 
@@ -1350,7 +1592,7 @@ func (e *Engine) receiveManagementEvents() {
 			manager.run(e.ctx)
 		}()
 
-		err := e.mgmClient.Sync(e.ctx, info, manager.SetTarget)
+		err := e.mgmClient.Sync(e.ctx, e.syncInfoFunc(info), manager.SetTarget)
 		if err != nil {
 			// happens if management is unavailable for a long time.
 			// We want to cancel the operation of the whole client
@@ -1419,11 +1661,10 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap, maxBatch int,
 		return false, nil
 	}
 
-	// Wholesale sections (firewall/ACL, DNS, routes, forward rules) are applied
-	// up-front and only once per target: they are cheap, local, idempotent and must
-	// be in place before peers come up (fail-closed). On the bounded re-runs that only
-	// drain the remaining peer batches they are skipped — the applied forward rules are
-	// reused from e.forwardingRules for the lazy-exclude finalize.
+	// Wholesale sections (firewall/ACL, DNS, routes) are applied up-front and only
+	// once per target: they are cheap, local, idempotent and must be in place before
+	// peers come up (fail-closed). On the bounded re-runs that only drain the
+	// remaining peer batches they are skipped.
 	if firstPass {
 		e.applyWholesale(networkMap, serial)
 	}
@@ -1486,7 +1727,7 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap, maxBatch int,
 	// ExcludePeer has replace-semantics — a partial set mid-convergence would be wrong.
 	if !needMore {
 		doneLazy := e.phase("lazy_exclude")
-		excludedLazyPeers := e.toExcludedLazyPeers(e.forwardingRules, remotePeers)
+		excludedLazyPeers := e.toExcludedLazyPeers(remotePeers)
 		e.connMgr.SetExcludeList(e.ctx, excludedLazyPeers)
 		doneLazy()
 	}
@@ -1496,14 +1737,16 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap, maxBatch int,
 	return needMore, nil
 }
 
-// applyWholesale applies the cheap, local, idempotent map sections — lazy feature
-// flag, firewall/legacy management, DNS, routes, ACL filtering, DNS forwarder and
-// ingress forward rules — that must be in place before peers come up. It runs once
-// per target (first pass only); the resulting forward rules are stashed in
-// e.forwardingRules for the lazy-exclude finalize on the peer-converged pass.
+// applyWholesale applies the cheap, local, idempotent map sections (lazy feature
+// flag, firewall/legacy management, DNS, routes, ACL filtering, DNS forwarder) that
+// must be in place before peers come up. It runs once per target, on the first pass.
 func (e *Engine) applyWholesale(networkMap *mgmProto.NetworkMap, serial uint64) {
-	if err := e.connMgr.UpdatedRemoteFeatureFlag(e.ctx, networkMap.GetPeerConfig().GetLazyConnectionEnabled()); err != nil {
-		log.Errorf("failed to update lazy connection feature flag: %v", err)
+	// Only update the flag when the sync carries a peer config; a nil peer config
+	// (e.g. a partial update) must not reset the cached flag to false.
+	if peerConfig := networkMap.GetPeerConfig(); peerConfig != nil {
+		if err := e.connMgr.UpdatedRemoteFeatureFlag(e.ctx, peerConfig.GetLazyConnectionEnabled()); err != nil {
+			log.Errorf("failed to update lazy connection feature flag: %v", err)
+		}
 	}
 
 	if e.firewall != nil {
@@ -1567,14 +1810,6 @@ func (e *Engine) applyWholesale(networkMap *mgmProto.NetworkMap, serial uint64)
 	e.updateDNSForwarder(dnsRouteFeatureFlag, fwdEntries)
 	done()
 
-	// Ingress forward rules
-	done = e.phase("forward_rules")
-	forwardingRules, err := e.updateForwardRules(networkMap.GetForwardingRules())
-	if err != nil {
-		log.Errorf("failed to update forward rules, err: %v", err)
-	}
-	done()
-	e.forwardingRules = forwardingRules
 }
 
 func toDNSFeatureFlag(networkMap *mgmProto.NetworkMap) bool {
@@ -1773,7 +2008,8 @@ func (e *Engine) addNewPeers(peersUpdate []*mgmProto.RemotePeerConfig, maxBatch
 	return false, nil
 }
 
-// addNewPeer add peer if connection doesn't exist
+// addNewPeer add peer if connection doesn't exist. A peer that is not lazy by
+// policy gets an always-active connection instead.
 func (e *Engine) addNewPeer(peerConfig *mgmProto.RemotePeerConfig) error {
 	peerKey := peerConfig.GetWgPubKey()
 	peerIPs := make([]netip.Prefix, 0, len(peerConfig.GetAllowedIps()))
@@ -1808,7 +2044,8 @@ func (e *Engine) addNewPeer(peerConfig *mgmProto.RemotePeerConfig) error {
 		log.Warnf("error adding peer %s to status recorder, got error: %v", peerKey, err)
 	}
 
-	if exists := e.connMgr.AddPeerConn(e.ctx, peerKey, conn); exists {
+	permanent := !e.connMgr.PeerLazyDefault(peerConfig.GetLazyState())
+	if exists := e.connMgr.AddPeerConn(e.ctx, peerKey, conn, permanent); exists {
 		conn.Close(false)
 		return fmt.Errorf("peer already exists: %s", peerKey)
 	}
@@ -1842,6 +2079,7 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 			PermissiveMode: e.config.RosenpassPermissive,
 		},
 		ICEConfig: e.createICEConfig(),
+		NetMgr:    e.netMgr,
 	}
 
 	serviceDependencies := peer.ServiceDependencies{
@@ -2008,6 +2246,10 @@ func (e *Engine) close() {
 	log.Debugf("removing Netbird interface %s", e.config.WgIfaceName)
 
 	if e.wgInterface != nil {
+		// Drop the handle before the close starts: a retune that loads it
+		// afterwards would touch a device on its way out and report success
+		// for an engine that is already gone.
+		e.wgDevice.Store(nil)
 		if err := e.wgInterface.Close(); err != nil {
 			log.Errorf("failed closing Netbird interface %s %v", e.config.WgIfaceName, err)
 		}
@@ -2045,46 +2287,8 @@ func (e *Engine) close() {
 	}
 }
 
-func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, error) {
-	if runtime.GOOS != "android" {
-		// nolint:nilnil
-		return nil, nil, false, nil
-	}
-
-	info := system.GetInfo(e.ctx)
-	info.SetFlags(
-		e.config.RosenpassEnabled,
-		e.config.RosenpassPermissive,
-		&e.config.ServerSSHAllowed,
-		e.config.DisableClientRoutes,
-		e.config.DisableServerRoutes,
-		e.config.DisableDNS,
-		e.config.DisableFirewall,
-		e.config.BlockLANAccess,
-		e.config.BlockInbound,
-		e.config.DisableIPv6,
-		e.config.EnableSSHRoot,
-		e.config.EnableSSHSFTP,
-		e.config.EnableSSHLocalPortForwarding,
-		e.config.EnableSSHRemotePortForwarding,
-		e.config.DisableSSHAuth,
-	)
-
-	netMap, err := e.mgmClient.GetNetworkMap(info)
-	if err != nil {
-		return nil, nil, false, err
-	}
-	routes := toRoutes(netMap.GetRoutes())
-	dnsCfg := toDNSConfig(netMap.GetDNSConfig(), e.wgInterface.Address())
-	dnsFeatureFlag := toDNSFeatureFlag(netMap)
-	return routes, &dnsCfg, dnsFeatureFlag, nil
-}
-
 func (e *Engine) newWgIface() (*iface.WGIface, error) {
-	transportNet, err := e.newStdNet()
-	if err != nil {
-		log.Errorf("failed to create pion's stdnet: %s", err)
-	}
+	transportNet := e.newStdNet()
 
 	opts := iface.WGIFaceOpts{
 		IFaceName:    e.config.WgIfaceName,
@@ -2114,7 +2318,7 @@ func (e *Engine) newWgIface() (*iface.WGIface, error) {
 func (e *Engine) wgInterfaceCreate() (err error) {
 	switch runtime.GOOS {
 	case "android":
-		err = e.wgInterface.CreateOnAndroid(e.routeManager.InitialRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
+		err = e.wgInterface.CreateOnAndroid(e.routeManager.CurrentRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
 	case "ios":
 		e.mobileDep.NetworkChangeListener.SetInterfaceIP(e.config.WgAddr.String())
 		if e.config.WgAddr.HasIPv6() {
@@ -2127,7 +2331,7 @@ func (e *Engine) wgInterfaceCreate() (err error) {
 	return err
 }
 
-func (e *Engine) newDnsServer(dnsConfig *nbdns.Config) (dns.Server, error) {
+func (e *Engine) newDnsServer() (dns.Server, error) {
 	// due to tests where we are using a mocked version of the DNS server
 	if e.dnsServer != nil {
 		return e.dnsServer, nil
@@ -2139,7 +2343,7 @@ func (e *Engine) newDnsServer(dnsConfig *nbdns.Config) (dns.Server, error) {
 			e.ctx,
 			e.wgInterface,
 			e.mobileDep.HostDNSAddresses,
-			*dnsConfig,
+			nbdns.Config{},
 			e.mobileDep.NetworkChangeListener,
 			e.statusRecorder,
 			e.config.DisableDNS,
@@ -2202,15 +2406,16 @@ type Performance struct {
 }
 
 // SetPerformance applies the given tuning to this engine's live Device.
+//
+// It deliberately does not take syncMsgMux. Raising the buffer pool cap is the
+// recovery path for a device whose pool is exhausted, and an exhausted pool
+// blocks peer removal inside handleSync, which holds syncMsgMux for as long as
+// it stays blocked. Taking the lock here would make the retune unreachable in
+// the one situation that needs it.
 func (e *Engine) SetPerformance(t Performance) error {
-	e.syncMsgMux.Lock()
-	defer e.syncMsgMux.Unlock()
-	if e.wgInterface == nil {
-		return fmt.Errorf("wg interface not initialized")
-	}
-	dev := e.wgInterface.GetWGDevice()
+	dev := e.wgDevice.Load()
 	if dev == nil {
-		return fmt.Errorf("wg device not initialized")
+		return errors.New("wg device not initialized")
 	}
 	if t.PreallocatedBuffersPerPool != nil {
 		dev.SetPreallocatedBuffersPerPool(*t.PreallocatedBuffersPerPool)
@@ -2255,7 +2460,20 @@ func (e *Engine) getRosenpassAddr() string {
 
 // RunHealthProbes executes health checks for Signal, Management, Relay, and WireGuard services
 // and updates the status recorder with the latest states.
-func (e *Engine) RunHealthProbes(waitForResult bool) bool {
+//
+// ctx scopes the (potentially slow) STUN/TURN probing: a caller that gives up —
+// e.g. a Status RPC whose client disconnected — cancels its ctx and the probe
+// returns instead of running to its per-component timeout. The engine's own
+// lifetime ctx still applies independently, so an engine shutdown aborts the
+// probe even if the caller's ctx is context.Background().
+func (e *Engine) RunHealthProbes(ctx context.Context, waitForResult bool) bool {
+	// Tie the caller's ctx to the engine lifetime: either cancelling aborts
+	// the probe below.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	stop := context.AfterFunc(e.ctx, cancel)
+	defer stop()
+
 	e.syncMsgMux.Lock()
 
 	signalHealthy := e.signal.IsHealthy()
@@ -2278,9 +2496,9 @@ func (e *Engine) RunHealthProbes(waitForResult bool) bool {
 	if runtime.GOOS != "js" {
 		var results []relay.ProbeResult
 		if waitForResult {
-			results = e.probeStunTurn.ProbeAllWaitResult(e.ctx, stuns, turns)
+			results = e.probeStunTurn.ProbeAllWaitResult(ctx, stuns, turns)
 		} else {
-			results = e.probeStunTurn.ProbeAll(e.ctx, stuns, turns)
+			results = e.probeStunTurn.ProbeAll(ctx, stuns, turns)
 		}
 		e.statusRecorder.UpdateRelayStates(results)
 
@@ -2418,7 +2636,72 @@ func (e *Engine) RenewTun(fd int) error {
 		return fmt.Errorf("wireguard interface not initialized")
 	}
 
-	return wgInterface.RenewTun(fd)
+	if err := wgInterface.RenewTun(fd); err != nil {
+		return err
+	}
+
+	e.rebindOverlayListeners()
+	return nil
+}
+
+// rebindOverlayListeners gives the servers that listen on an overlay address
+// sockets on the interface as it is now.
+//
+// A socket belongs to the interface generation it was created on. Renewing the
+// TUN builds a new interface and moves the overlay addresses to it, which
+// leaves the old sockets in LISTEN with the uspfilter still logging packets
+// arriving for them, while every accept fails with EINVAL for the life of the
+// socket: from the outside the server looks alive and answers nothing. On
+// Android this happens during a normal startup, where the first TUN is
+// established before the routes are known and replaced once they arrive.
+//
+// Rebinding costs whatever those sockets were carrying, which the renewal has
+// already broken. Errors are logged rather than returned: the renewal itself
+// succeeded, and failing it would hand the caller a working interface and an
+// error.
+func (e *Engine) rebindOverlayListeners() {
+	e.syncMsgMux.Lock()
+	defer e.syncMsgMux.Unlock()
+
+	for _, rebind := range e.overlayRebinds() {
+		if err := rebind(); err != nil {
+			log.Errorf("after TUN renewal: %v", err)
+		}
+	}
+}
+
+// overlayRebinds is every subsystem of this engine that holds sockets bound to
+// an overlay address, and how to rebuild each one's.
+//
+// A subsystem that starts listening on an overlay address belongs in this list.
+// Leaving it out costs nothing that review would notice and produces a listener
+// that stays in LISTEN, is logged as receiving packets, and refuses every
+// connection for the life of the process.
+func (e *Engine) overlayRebinds() []overlayRebind {
+	return []overlayRebind{
+		e.restartSSHListeners,
+		e.restartDNSForwarder,
+	}
+}
+
+// restartDNSForwarder rebuilds the DNS forwarder serving the same domains.
+// No-op when it is not running. See Engine.rebindOverlayListeners.
+func (e *Engine) restartDNSForwarder() error {
+	if e.dnsForwardMgr == nil {
+		return nil
+	}
+	// Read from the forwarder before it goes away, so the replacement serves
+	// the domains in force now rather than a copy kept somewhere else.
+	entries := e.dnsForwardMgr.Domains()
+	e.stopDNSForwarder()
+	// Both halves log their own failures, so the only thing left to report is
+	// the outcome: a start that failed left the manager nil, and the forwarder
+	// is now down rather than merely rebound.
+	e.startDNSForwarder(entries)
+	if e.dnsForwardMgr == nil {
+		return errors.New("rebind DNS forwarder: it did not come back up")
+	}
+	return nil
 }
 
 // updateDNSForwarder start or stop the DNS forwarder based on the domains and the feature flag
@@ -2464,7 +2747,14 @@ func (e *Engine) stopDNSForwarder() {
 		return
 	}
 
-	if err := e.dnsForwardMgr.Stop(context.Background()); err != nil {
+	// Bounded because the shutdown waits for queries still in flight, and one
+	// waiting on an unresponsive upstream holds it for as long as that lookup
+	// is allowed to take. This runs with syncMsgMux held, so that wait is one
+	// the whole engine spends.
+	ctx, cancel := context.WithTimeout(context.Background(), dnsForwarderStopTimeout)
+	defer cancel()
+
+	if err := e.dnsForwardMgr.Stop(ctx); err != nil {
 		log.Errorf("failed to stop DNS forward: %v", err)
 	}
 
@@ -2532,7 +2822,7 @@ func (e *Engine) SetCapture(pc device.PacketCapture) error {
 	}
 
 	afc := capture.NewAFPacketCapture(intf.Name(), sess)
-	if err := afc.Start(); err != nil {
+	if err := afc.Start(); err != nil { //nolint:staticcheck // always errors on non-Linux builds
 		return fmt.Errorf("start AF_PACKET capture on %s: %w", intf.Name(), err)
 	}
 	e.afpacketCapture = afc
@@ -2553,89 +2843,16 @@ func (e *Engine) setForwarderCapture(pc device.PacketCapture) {
 	}
 }
 
-func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) ([]firewallManager.ForwardRule, error) {
-	if e.firewall == nil {
-		log.Warn("firewall is disabled, not updating forwarding rules")
-		return nil, nil
-	}
-
-	if len(rules) == 0 {
-		if e.ingressGatewayMgr == nil {
-			return nil, nil
-		}
-
-		err := e.ingressGatewayMgr.Close()
-		e.ingressGatewayMgr = nil
-		e.statusRecorder.SetIngressGwMgr(nil)
-		return nil, err
-	}
-
-	if e.ingressGatewayMgr == nil {
-		mgr := ingressgw.NewManager(e.firewall)
-		e.ingressGatewayMgr = mgr
-		e.statusRecorder.SetIngressGwMgr(mgr)
-	}
-
-	var merr *multierror.Error
-	forwardingRules := make([]firewallManager.ForwardRule, 0, len(rules))
-	for _, rule := range rules {
-		proto, err := convertToFirewallProtocol(rule.GetProtocol())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("failed to convert protocol '%s': %w", rule.GetProtocol(), err))
-			continue
-		}
-
-		dstPortInfo, err := convertPortInfo(rule.GetDestinationPort())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("invalid destination port '%v': %w", rule.GetDestinationPort(), err))
-			continue
-		}
-
-		translateIP, err := convertToIP(rule.GetTranslatedAddress())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("failed to convert translated address '%s': %w", rule.GetTranslatedAddress(), err))
-			continue
-		}
-
-		translatePort, err := convertPortInfo(rule.GetTranslatedPort())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("invalid translate port '%v': %w", rule.GetTranslatedPort(), err))
-			continue
-		}
-
-		forwardRule := firewallManager.ForwardRule{
-			Protocol:          proto,
-			DestinationPort:   *dstPortInfo,
-			TranslatedAddress: translateIP,
-			TranslatedPort:    *translatePort,
-		}
-
-		forwardingRules = append(forwardingRules, forwardRule)
-	}
-
-	log.Infof("updating forwarding rules: %d", len(forwardingRules))
-	if err := e.ingressGatewayMgr.Update(forwardingRules); err != nil {
-		log.Errorf("failed to update forwarding rules: %v", err)
-	}
-
-	return forwardingRules, nberrors.FormatErrorOrNil(merr)
-}
-
-func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers []*mgmProto.RemotePeerConfig) map[string]bool {
+// toExcludedLazyPeers returns the peers that must have an always-active
+// connection: those that are not lazy by policy (the per-peer lazy state or the
+// account flag, subject to the local override).
+func (e *Engine) toExcludedLazyPeers(peers []*mgmProto.RemotePeerConfig) map[string]bool {
 	excludedPeers := make(map[string]bool)
-	for _, r := range rules {
-		ip := r.TranslatedAddress
-		for _, p := range peers {
-			for _, allowedIP := range p.GetAllowedIps() {
-				if allowedIP != ip.String() {
-					continue
-				}
-				log.Infof("exclude forwarder peer from lazy connection: %s", p.GetWgPubKey())
-				excludedPeers[p.GetWgPubKey()] = true
-			}
+	for _, p := range peers {
+		if !e.connMgr.PeerLazyDefault(p.GetLazyState()) {
+			excludedPeers[p.GetWgPubKey()] = true
 		}
 	}
-
 	return excludedPeers
 }
 
@@ -2648,6 +2865,11 @@ func isChecksEqual(checks1, checks2 []*mgmProto.Checks) bool {
 			sortedFiles := slices.Clone(check.Files)
 			sort.Strings(sortedFiles)
 			normalized[i] = strings.Join(sortedFiles, "|")
+			if challenge := check.GetCertificateChallenge(); challenge != nil {
+				sortedCAs := slices.Clone(challenge.GetCaCertificates())
+				sort.Strings(sortedCAs)
+				normalized[i] += fmt.Sprintf("#%x|%s", challenge.GetNonce(), strings.Join(sortedCAs, "|"))
+			}
 		}
 
 		sort.Strings(normalized)
diff --git a/client/internal/engine_authsession.go b/client/internal/engine_authsession.go
new file mode 100644
index 000000000..624487484
--- /dev/null
+++ b/client/internal/engine_authsession.go
@@ -0,0 +1,108 @@
+package internal
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	cProto "github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/system"
+)
+
+// ApplySessionDeadline propagates the absolute SSO session deadline carried on
+// LoginResponse / SyncResponse to both the watcher (for the edge-triggered
+// warning) and the status recorder (for the SubscribeStatus / Status RPC
+// snapshot the UI consumes).
+//
+// The wire field is 3-state:
+//   - nil                        → snapshot carries no info; keep the
+//     previously-anchored deadline (no-op)
+//   - explicit zero (s=0, n=0)   → peer is not SSO-registered or expiry is
+//     disabled; clear both sinks
+//   - valid timestamp            → new deadline; arm watcher, expose on
+//     status recorder
+//
+// Deadline sanity-checks live in sessionwatch.Watcher.Update. Any rejected
+// value is treated as a clear on both sinks: the alternative — leaving the
+// previously-known deadline in place — risks the UI confidently displaying
+// a stale "expires in X" while the server has actually invalidated it.
+func (e *Engine) ApplySessionDeadline(ts *timestamppb.Timestamp) {
+	if ts == nil {
+		return
+	}
+	var deadline time.Time
+	// Explicit zero (seconds=0 AND nanos=0) is the sentinel for "disabled".
+	// Everything else flows through Watcher.Update, whose sanity-checks
+	// reject out-of-range / pre-epoch / far-future / too-stale values and
+	// clear on rejection.
+	if ts.GetSeconds() != 0 || ts.GetNanos() != 0 {
+		deadline = ts.AsTime().UTC()
+	}
+	if e.sessionWatcher == nil {
+		return
+	}
+	// Watcher.Update owns the propagation to the status recorder (the
+	// SubscribeStatus / Status snapshot the UI reads): a set writes the
+	// deadline, a clear or a sanity-check rejection writes the zero value.
+	// Keeping a single writer is what stops the recorder from drifting out
+	// of sync with the warning timers.
+	if err := e.sessionWatcher.Update(deadline); err != nil {
+		log.Errorf("auth session deadline rejected: %v, clearing", err)
+		e.statusRecorder.PublishEvent(
+			cProto.SystemEvent_ERROR,
+			cProto.SystemEvent_AUTHENTICATION,
+			"session deadline rejected",
+			"",
+			map[string]string{sessionwatch.MetaSessionDeadlineRejected: err.Error()},
+		)
+	}
+}
+
+// DismissSessionWarning records the user's "Dismiss" click on the
+// T-WarningLead interactive notification and suppresses the upcoming
+// T-FinalWarningLead fallback for the current deadline. No-op when the
+// watcher is not running or holds no deadline.
+func (e *Engine) DismissSessionWarning() {
+	if e.sessionWatcher == nil {
+		return
+	}
+	e.sessionWatcher.Dismiss()
+}
+
+// ExtendAuthSession asks the management server to refresh the SSO session
+// expiry deadline using the supplied JWT, then mirrors the new deadline into
+// the daemon's state. The tunnel is untouched; no resync, no reconnect.
+//
+// Returns the new absolute UTC deadline (or zero time when the server
+// reports the peer is not eligible for extension).
+func (e *Engine) ExtendAuthSession(ctx context.Context, jwtToken string) (time.Time, error) {
+	if jwtToken == "" {
+		return time.Time{}, errors.New("jwt token is required")
+	}
+	if e.mgmClient == nil {
+		return time.Time{}, errors.New("management client is not initialised")
+	}
+
+	info, err := system.GetInfoWithChecks(ctx, e.appliedChecks())
+	if err != nil {
+		log.Warnf("failed to collect system info for session extend: %v", err)
+		info = system.GetInfo(ctx)
+	}
+
+	resp, err := e.mgmClient.ExtendAuthSession(info, jwtToken)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("extend auth session on management: %w", err)
+	}
+
+	e.ApplySessionDeadline(resp.GetSessionExpiresAt())
+
+	if resp.GetSessionExpiresAt().IsValid() {
+		return resp.GetSessionExpiresAt().AsTime().UTC(), nil
+	}
+	return time.Time{}, nil
+}
diff --git a/client/internal/engine_bundle_test.go b/client/internal/engine_bundle_test.go
new file mode 100644
index 000000000..20b40a8a6
--- /dev/null
+++ b/client/internal/engine_bundle_test.go
@@ -0,0 +1,36 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestValidateBundleUploadURL covers the sanity check applied to a
+// management-supplied upload URL before a remote debug bundle is generated.
+func TestValidateBundleUploadURL(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		raw     string
+		wantErr bool
+	}{
+		{name: "empty falls back to default", raw: ""},
+		{name: "https with host", raw: "https://upload.debug.netbird.io/upload"},
+		{name: "https self-hosted host", raw: "https://upload.example.com"},
+		{name: "plaintext rejected", raw: "http://upload.example.com", wantErr: true},
+		{name: "missing host rejected", raw: "https:///upload", wantErr: true},
+		{name: "port-only authority rejected", raw: "https://:443", wantErr: true},
+		{name: "non-url scheme rejected", raw: "ftp://upload.example.com", wantErr: true},
+		{name: "garbage rejected", raw: "://not a url", wantErr: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateBundleUploadURL(tc.raw)
+			if tc.wantErr {
+				require.Error(t, err, "an invalid upload URL must be rejected")
+				return
+			}
+			assert.NoError(t, err, "a valid or empty upload URL must be accepted")
+		})
+	}
+}
diff --git a/client/internal/engine_certposture.go b/client/internal/engine_certposture.go
new file mode 100644
index 000000000..5aacb72d1
--- /dev/null
+++ b/client/internal/engine_certposture.go
@@ -0,0 +1,386 @@
+package internal
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/certproof"
+	cProto "github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/system"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const (
+	// certContextPollInterval is how often the engine checks whether the user who can
+	// answer certificate challenges has changed, such as a login after an autostart.
+	certContextPollInterval = time.Minute
+	// certRetryInterval is how long after a collection that proved nothing it is tried
+	// again with the same user, for stores that come up late: a keychain unlocked after
+	// login, or a TPM resource manager started after the daemon.
+	certRetryInterval = 5 * time.Minute
+)
+
+// undeliveredContext never matches a real user context, so a collection whose meta sync
+// failed is seen as stale on the next poll.
+const undeliveredContext = "\x00undelivered"
+
+// errSystemInfoTimeout reports that gathering the system info for a meta sync timed out,
+// so the sync was skipped rather than holding syncMsgMux on a stuck system call.
+var errSystemInfoTimeout = errors.New("system info gathering timed out")
+
+// certPostureState remembers what the last certificate proof collection saw, so the
+// engine can collect again when it went stale and tell the user when proofs go missing.
+//
+// Collection runs only on the posture watcher, never on the sync path, because a token,
+// a TPM or a user's keychain prompt can take long; the sync path attaches the proofs the
+// last collection cached. delivered identifies the chains management last received, so
+// a collection that proves the same chains is not sent again: every meta sync makes
+// management recompute and push network maps to the peer and its neighbours.
+type certPostureState struct {
+	mu          sync.Mutex
+	attempted   bool
+	attemptedAt time.Time
+	userContext string
+	proven      bool
+	delivered   string
+	hasDelivery bool
+	cached      []certposture.Proof
+	cachedFor   string
+	// stuck is whether the collector was last seen with every slot held by a lost
+	// collection.
+	stuck bool
+}
+
+// record stores the outcome of a collection for the challenges identified by
+// challengesKey and reports whether it changed from proven to unproven or back. The first
+// collection only counts as a change when it proved nothing.
+func (s *certPostureState) record(challengesKey, userContext string, proofs []certposture.Proof, now time.Time) (changed bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	proven := len(proofs) > 0
+	changed = (s.attempted && s.proven != proven) || (!s.attempted && !proven)
+	s.attempted = true
+	s.attemptedAt = now
+	s.userContext = userContext
+	s.proven = proven
+	s.cached = proofs
+	s.cachedFor = challengesKey
+	return changed
+}
+
+// undelivered marks the last collection as not having reached management, so the next
+// poll collects and sends again instead of treating it as current.
+func (s *certPostureState) undelivered() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.attempted {
+		s.userContext = undeliveredContext
+	}
+	s.hasDelivery = false
+}
+
+// markDelivered records the chains of proofs as the ones management holds.
+func (s *certPostureState) markDelivered(proofs []certposture.Proof) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.delivered = provenChainsKey(proofs)
+	s.hasDelivery = true
+}
+
+// sameAsDelivered reports whether proofs prove exactly the chains management already
+// holds. Nonces and signatures are left out: they differ on every signing while the
+// result management stores, the verified chains, stays the same.
+func (s *certPostureState) sameAsDelivered(proofs []certposture.Proof) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.hasDelivery && s.delivered == provenChainsKey(proofs)
+}
+
+// needsCollection reports whether the cached proofs no longer reflect what the device
+// can prove for the challenges identified by challengesKey: they answer other
+// challenges, the user who can answer has changed, or nothing was proven and the retry
+// interval has passed.
+func (s *certPostureState) needsCollection(challengesKey, userContext string, now time.Time) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	switch {
+	case !s.attempted || s.cachedFor != challengesKey:
+		return true
+	case userContext != s.userContext:
+		return true
+	default:
+		return !s.proven && now.Sub(s.attemptedAt) >= certRetryInterval
+	}
+}
+
+// setStuck records whether the collector is stuck and reports whether it just became so.
+func (s *certPostureState) setStuck(stuck bool) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	became := stuck && !s.stuck
+	s.stuck = stuck
+	return became
+}
+
+// cachedProofs returns the cached proofs management still accepts for the challenges in
+// checks: those whose nonce is current, or from an adjacent window, for one of them. Proofs
+// signed for the previous nonce bridge the time until the watcher has signed the new one.
+func (s *certPostureState) cachedProofs(checks []*mgmProto.Checks) []certposture.Proof {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	var nonces [][]byte
+	for _, check := range checks {
+		if challenge := check.GetCertificateChallenge(); challenge != nil {
+			nonces = append(nonces, challenge.GetNonce())
+		}
+	}
+	var accepted []certposture.Proof
+	for _, proof := range s.cached {
+		if slices.ContainsFunc(nonces, func(nonce []byte) bool {
+			return certposture.NonceAcceptedAlongside(proof.Nonce, nonce)
+		}) {
+			accepted = append(accepted, proof)
+		}
+	}
+	return accepted
+}
+
+// provenChainsKey identifies the set of chains in proofs, independent of their order.
+func provenChainsKey(proofs []certposture.Proof) string {
+	keys := make([]string, 0, len(proofs))
+	for _, proof := range proofs {
+		h := sha256.New()
+		for _, cert := range proof.Chain {
+			writeLengthPrefixed(h, cert)
+		}
+		keys = append(keys, hex.EncodeToString(h.Sum(nil)))
+	}
+	slices.Sort(keys)
+	return strings.Join(keys, ",")
+}
+
+// challengesKey identifies the certificate challenges in checks: their nonces and CAs.
+func challengesKey(checks []*mgmProto.Checks) string {
+	h := sha256.New()
+	for _, check := range checks {
+		challenge := check.GetCertificateChallenge()
+		if challenge == nil {
+			continue
+		}
+		writeLengthPrefixed(h, challenge.GetNonce())
+		for _, ca := range challenge.GetCaCertificates() {
+			writeLengthPrefixed(h, []byte(ca))
+		}
+		writeLengthPrefixed(h, nil)
+	}
+	return hex.EncodeToString(h.Sum(nil))
+}
+
+func writeLengthPrefixed(h interface{ Write([]byte) (int, error) }, data []byte) {
+	var size [8]byte
+	binary.BigEndian.PutUint64(size[:], uint64(len(data)))
+	_, _ = h.Write(size[:])
+	_, _ = h.Write(data)
+}
+
+// attachCertificateProofs attaches the cached proofs management accepts for the
+// challenges in checks, without collecting: the caller is on the sync path. The info is
+// about to be sent on the sync stream, which resends it on every reconnect, so its proofs
+// count as delivered. The watcher is woken to collect when the cache is out of date.
+func (e *Engine) attachCertificateProofs(info *system.Info, checks []*mgmProto.Checks) {
+	if !certproof.HasChallenges(checks) {
+		info.CertificateProofs = nil
+		return
+	}
+	info.CertificateProofs = e.certState.cachedProofs(checks)
+	e.certState.markDelivered(info.CertificateProofs)
+	e.wakeCertificatePosture()
+}
+
+// wakeCertificatePosture asks the posture watcher to check its proofs now rather than at
+// its next tick. It never blocks.
+func (e *Engine) wakeCertificatePosture() {
+	if e.certWake == nil {
+		return
+	}
+	select {
+	case e.certWake <- struct{}{}:
+	default:
+	}
+}
+
+// publishCertificatePostureEvent tells the user when the device stops proving any
+// certificate, which management treats as failing every certificate posture check, and
+// when it proves one again. Without it the loss of access would have no visible cause.
+func (e *Engine) publishCertificatePostureEvent(proven bool) {
+	if e.statusRecorder == nil {
+		return
+	}
+	if proven {
+		e.statusRecorder.PublishEvent(cProto.SystemEvent_INFO, cProto.SystemEvent_SYSTEM,
+			"certificate posture: a certificate is proven again",
+			"A certificate required by your organization's device policy is available again.", nil)
+		return
+	}
+	e.statusRecorder.PublishEvent(cProto.SystemEvent_WARNING, cProto.SystemEvent_SYSTEM,
+		"certificate posture: no certificate could be proven",
+		"NetBird could not use a certificate required by your organization's device policy. "+
+			"Access to some resources may be blocked until one is available.", nil)
+}
+
+// publishCertificateStoreStuckEvent tells the user that reading the certificate store
+// stopped answering. Collection resumes only once a stuck call returns, which a store
+// that hangs for good never does short of a restart.
+func (e *Engine) publishCertificateStoreStuckEvent() {
+	if e.statusRecorder == nil {
+		return
+	}
+	e.statusRecorder.PublishEvent(cProto.SystemEvent_WARNING, cProto.SystemEvent_SYSTEM,
+		"certificate posture: the certificate store stopped responding",
+		"NetBird cannot read the certificates required by your organization's device policy because "+
+			"the certificate store stopped responding. If this persists, restart the NetBird service.", nil)
+}
+
+// watchCertificatePosture owns certificate proof collection until ctx is done. It
+// collects when woken by new checks or a sync, and on every tick when the cached proofs
+// went stale, such as after a login following an autostart.
+func (e *Engine) watchCertificatePosture(ctx context.Context) {
+	ticker := time.NewTicker(certContextPollInterval)
+	defer ticker.Stop()
+	for {
+		// A pending update that times out again stays pending; the applied checks'
+		// proofs are still refreshed so a lost certificate is reported meanwhile.
+		if err := e.retryPendingChecks(); err != nil && !errors.Is(err, errSystemInfoTimeout) {
+			log.Warnf("failed to sync posture checks that timed out before: %v", err)
+		}
+		if err := e.refreshCertificateProofs(); err != nil && !errors.Is(err, errSystemInfoTimeout) {
+			log.Warnf("failed to refresh certificate posture proofs: %v", err)
+		}
+
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		case <-e.certWake:
+		}
+	}
+}
+
+// retryPendingChecks sends the meta sync for checks whose earlier sync timed out
+// gathering the system info, and applies them once it succeeds. Without it they would
+// wait for the next network map that changes the checks.
+func (e *Engine) retryPendingChecks() error {
+	if !e.hasPendingChecks.Load() {
+		return nil
+	}
+
+	e.syncMsgMux.Lock()
+	defer e.syncMsgMux.Unlock()
+	if e.stopping() || !e.hasPendingChecks.Load() {
+		return nil
+	}
+	checks := e.pendingChecks
+	log.Debugf("posture checks: retrying the meta sync that timed out")
+	if err := e.syncChecksMeta(checks); err != nil {
+		return err
+	}
+	e.setAppliedChecks(checks)
+	e.clearPendingChecks()
+	return nil
+}
+
+// refreshCertificateProofs collects the proofs for the applied checks when the cached
+// ones are out of date, and sends them to management when they prove other chains than
+// it holds. It holds no engine lock while collecting.
+func (e *Engine) refreshCertificateProofs() error {
+	checks := e.appliedChecks()
+	if e.stopping() || !certproof.HasChallenges(checks) {
+		return nil
+	}
+	key := challengesKey(checks)
+	userContext := certproof.UserContext(e.config.CertStore)
+	if !e.certState.needsCollection(key, userContext, time.Now()) {
+		return nil
+	}
+
+	log.Debugf("certificate posture: collecting proofs")
+	peerKey := e.config.WgPrivateKey.PublicKey()
+	proofs := e.certProofs.Collect(e.ctx, checks, peerKey[:], e.config.CertStore)
+	// A collection cut short by the engine stopping proved nothing about the device, and
+	// must not be reported to the user as a lost certificate.
+	if e.stopping() {
+		return nil
+	}
+	if e.certState.record(key, userContext, proofs, time.Now()) {
+		e.publishCertificatePostureEvent(len(proofs) > 0)
+	}
+	if e.certState.setStuck(e.certProofs.Stuck()) {
+		e.publishCertificateStoreStuckEvent()
+	}
+
+	if e.certState.sameAsDelivered(proofs) {
+		log.Debugf("certificate posture: proofs unchanged since the last meta sync, not sending")
+		return nil
+	}
+	info, ok := e.infoSource.Refresh(e.ctx, e.infoGatherTimeout(), checks, e.overlayAddresses()...)
+	if !ok {
+		e.certState.undelivered()
+		return errSystemInfoTimeout
+	}
+	e.applyInfoFlags(info)
+	return e.sendMetaWithProofs(info, checks)
+}
+
+// stopping reports whether the engine is shutting down.
+func (e *Engine) stopping() bool {
+	select {
+	case <-e.ctx.Done():
+		return true
+	default:
+		return false
+	}
+}
+
+// syncChecksMeta gathers the system info that checks evaluate and sends it to management
+// with the cached certificate proofs. The caller holds syncMsgMux.
+func (e *Engine) syncChecksMeta(checks []*mgmProto.Checks) error {
+	info, ok := e.infoSource.Refresh(e.ctx, e.infoGatherTimeout(), checks, e.overlayAddresses()...)
+	if !ok {
+		// Gathering timed out; skip the meta sync this cycle rather than blocking the
+		// sync loop (and syncMsgMux) on a stuck system call. The posture watcher retries.
+		e.certState.undelivered()
+		return errSystemInfoTimeout
+	}
+	e.applyInfoFlags(info)
+	return e.sendMetaWithProofs(info, checks)
+}
+
+// sendMetaWithProofs sends info to management with the cached proofs for checks. Sends
+// are serialized and read the cache under that lock, so a send from the sync path cannot
+// overwrite newer proofs the watcher sent in the meantime.
+func (e *Engine) sendMetaWithProofs(info *system.Info, checks []*mgmProto.Checks) error {
+	e.certSendMu.Lock()
+	defer e.certSendMu.Unlock()
+
+	info.CertificateProofs = e.certState.cachedProofs(checks)
+	if err := e.mgmClient.SyncMeta(info); err != nil {
+		e.certState.undelivered()
+		return fmt.Errorf("sync meta: %w", err)
+	}
+	e.certState.markDelivered(info.CertificateProofs)
+	return nil
+}
diff --git a/client/internal/engine_certposture_test.go b/client/internal/engine_certposture_test.go
new file mode 100644
index 000000000..a66ab2107
--- /dev/null
+++ b/client/internal/engine_certposture_test.go
@@ -0,0 +1,224 @@
+//go:build !windows && !darwin
+
+package internal
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/internal/certproof"
+	"github.com/netbirdio/netbird/client/internal/peer"
+	cProto "github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/system"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	mgmt "github.com/netbirdio/netbird/shared/management/client"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestCertPostureState_Record(t *testing.T) {
+	now := time.Now()
+	one := []certposture.Proof{{}}
+
+	var proven certPostureState
+	assert.False(t, proven.record("k", "", one, now), "a first collection that proves something is not news")
+
+	var unproven certPostureState
+	assert.True(t, unproven.record("k", "", nil, now), "a first collection that proves nothing is reported")
+	assert.False(t, unproven.record("k", "", nil, now), "the same outcome again is not reported twice")
+	assert.True(t, unproven.record("k", "", one, now), "proving again is reported")
+	assert.True(t, unproven.record("k", "", nil, now), "losing the proof again is reported")
+}
+
+// TestCertPostureState_ReportsStuckOnce: a store that stopped answering is reported to
+// the user once when it wedges the collector, not on every collection that follows, and
+// again if it wedges anew after recovering.
+func TestCertPostureState_ReportsStuckOnce(t *testing.T) {
+	var s certPostureState
+	assert.True(t, s.setStuck(true), "becoming stuck is reported")
+	assert.False(t, s.setStuck(true), "staying stuck is not reported again")
+	assert.False(t, s.setStuck(false), "recovering is not a stuck report")
+	assert.True(t, s.setStuck(true), "getting stuck again is reported again")
+}
+
+func TestCertPostureState_NeedsCollection(t *testing.T) {
+	now := time.Now()
+	one := []certposture.Proof{{}}
+	var s certPostureState
+
+	assert.True(t, s.needsCollection("k", "", now), "nothing collected yet")
+
+	s.record("k", "501:alice", one, now)
+	assert.False(t, s.needsCollection("k", "501:alice", now.Add(time.Hour)), "a proven collection for the same challenges and user stays fresh")
+	assert.True(t, s.needsCollection("other", "501:alice", now), "new challenges, such as a rotated nonce, are answered again")
+	assert.True(t, s.needsCollection("k", "", now), "the user logging out changes what can be proven")
+	assert.True(t, s.needsCollection("k", "502:bob", now), "another owner session changes what can be proven")
+
+	s.record("k", "", nil, now)
+	assert.False(t, s.needsCollection("k", "", now.Add(certRetryInterval-time.Second)), "an unproven collection is not retried before the interval")
+	assert.True(t, s.needsCollection("k", "", now.Add(certRetryInterval)), "an unproven collection is retried once the interval passed")
+
+	s.record("k", "501:alice", one, now)
+	s.undelivered()
+	assert.True(t, s.needsCollection("k", "501:alice", now), "a proof management never received is collected and sent again")
+}
+
+// TestCertPostureState_CachedProofsAcrossNonceRotation: management rotates the nonce every
+// window and accepts the previous one, so a cached proof keeps being attached across one
+// rotation, while the watcher signs the new nonce, and not across two.
+func TestCertPostureState_CachedProofsAcrossNonceRotation(t *testing.T) {
+	challenger := certposture.NewChallenger([]byte("secret"))
+	peerKey := []byte("peer-public-key-aaaaaaaaaaaaaaaa")
+	now := time.Now()
+	checksAt := func(at time.Time) []*mgmProto.Checks {
+		return []*mgmProto.Checks{{CertificateChallenge: &mgmProto.CertificateChallenge{Nonce: challenger.Nonce(peerKey, at)}}}
+	}
+
+	var s certPostureState
+	current := checksAt(now)
+	s.record(challengesKey(current), "", []certposture.Proof{{Nonce: current[0].CertificateChallenge.Nonce}}, now)
+
+	assert.Len(t, s.cachedProofs(current), 1, "the proof for the current nonce is attached")
+	assert.Len(t, s.cachedProofs(checksAt(now.Add(certposture.Window))), 1, "after one rotation the proof is still accepted and attached")
+	assert.Empty(t, s.cachedProofs(checksAt(now.Add(2*certposture.Window))), "after two rotations management would reject it")
+	assert.Empty(t, s.cachedProofs([]*mgmProto.Checks{{Files: []string{"/bin/agent"}}}), "no challenge, no proof")
+}
+
+// newCertPostureEngine is an engine whose certificate store is a real PEM directory and
+// whose management client records the proofs of every meta sync.
+func newCertPostureEngine(t *testing.T, recorder *peer.Status, syncMeta func(*system.Info) error) (*Engine, string, *certtest.CA) {
+	t.Helper()
+	// The store refuses a group-writable directory, which t.TempDir yields under a
+	// user-private-group umask.
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(dir, 0o700))
+	t.Setenv(certproof.StoreDirEnv, dir)
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+
+	e := &Engine{
+		ctx:            context.Background(),
+		syncMsgMux:     &sync.Mutex{},
+		config:         &EngineConfig{WgPrivateKey: key},
+		statusRecorder: recorder,
+		mgmClient:      &mgmt.MockClient{SyncMetaFunc: syncMeta},
+	}
+	ca := certtest.NewCA(t, "corp-root")
+	peerKey := key.PublicKey()
+	nonce := certposture.NewChallenger([]byte("secret")).Nonce(peerKey[:], time.Now())
+	e.checks = []*mgmProto.Checks{{CertificateChallenge: &mgmProto.CertificateChallenge{Nonce: nonce, CaCertificates: []string{ca.PEM}}}}
+	return e, dir, ca
+}
+
+func writeDeviceCert(t *testing.T, dir string, ca *certtest.CA) string {
+	t.Helper()
+	deviceKey := certtest.ECDSAKey(t)
+	pem := certtest.CertPEM(ca.Issue(t, deviceKey, "device")) + certtest.KeyPEM(t, deviceKey)
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "device.pem"), []byte(pem), 0o600))
+	return pem
+}
+
+// TestEngine_AttachCertificateProofsNeverCollects: the sync path only attaches what the
+// watcher collected, so a certificate that appears in the store is not proven on the sync
+// path until the watcher ran.
+func TestEngine_AttachCertificateProofsNeverCollects(t *testing.T) {
+	e, dir, ca := newCertPostureEngine(t, nil, func(*system.Info) error { return nil })
+	writeDeviceCert(t, dir, ca)
+
+	info := &system.Info{}
+	e.attachCertificateProofs(info, e.checks)
+	assert.Empty(t, info.CertificateProofs, "the sync path does not collect")
+
+	require.NoError(t, e.refreshCertificateProofs())
+	e.attachCertificateProofs(info, e.checks)
+	assert.Len(t, info.CertificateProofs, 1, "the sync path attaches what the watcher collected")
+}
+
+// TestEngine_RefreshReportsLostAndRegainedProofs: a device that cannot prove its
+// certificate gets one warning, and one notice when it can again.
+func TestEngine_RefreshReportsLostAndRegainedProofs(t *testing.T) {
+	recorder := peer.NewRecorder("")
+	e, dir, ca := newCertPostureEngine(t, recorder, func(*system.Info) error { return nil })
+	warnings := func() int {
+		n := 0
+		for _, ev := range recorder.GetEventHistory() {
+			if ev.Severity == cProto.SystemEvent_WARNING && ev.Category == cProto.SystemEvent_SYSTEM {
+				n++
+			}
+		}
+		return n
+	}
+	expire := func() { e.certState.attemptedAt = time.Now().Add(-certRetryInterval) }
+
+	require.NoError(t, e.refreshCertificateProofs())
+	assert.Equal(t, 1, warnings(), "the user is told the device proves no certificate")
+
+	expire()
+	require.NoError(t, e.refreshCertificateProofs())
+	assert.Equal(t, 1, warnings(), "an unchanged outcome is not reported again")
+
+	writeDeviceCert(t, dir, ca)
+	expire()
+	require.NoError(t, e.refreshCertificateProofs())
+	events := recorder.GetEventHistory()
+	require.NotEmpty(t, events)
+	assert.Equal(t, cProto.SystemEvent_INFO, events[len(events)-1].Severity, "regaining the proof is reported as good news")
+}
+
+// TestEngine_RefreshSendsOnlyChangedProofs: every meta sync makes management recompute
+// and push network maps, so a collection that proves the same chains as before must not
+// send, while a new certificate or a failed delivery must.
+func TestEngine_RefreshSendsOnlyChangedProofs(t *testing.T) {
+	var sent [][]certposture.Proof
+	failSync := false
+	e, dir, ca := newCertPostureEngine(t, nil, func(info *system.Info) error {
+		if failSync {
+			return errors.New("management unavailable")
+		}
+		sent = append(sent, info.CertificateProofs)
+		return nil
+	})
+	// expire makes the last collection due for the unproven retry.
+	expire := func() { e.certState.attemptedAt = time.Now().Add(-certRetryInterval) }
+	// switchUser makes the last collection stale as if another user signed in.
+	switchUser := func() { e.certState.userContext = "someone else" }
+
+	require.NoError(t, e.refreshCertificateProofs())
+	require.Len(t, sent, 1, "the first collection is sent")
+	assert.Empty(t, sent[0], "nothing to prove yet")
+
+	expire()
+	require.NoError(t, e.refreshCertificateProofs())
+	assert.Len(t, sent, 1, "still proving nothing is not sent again")
+
+	pem := writeDeviceCert(t, dir, ca)
+	expire()
+	require.NoError(t, e.refreshCertificateProofs())
+	require.Len(t, sent, 2, "a newly proven certificate is sent")
+	assert.Len(t, sent[1], 1, "the new proof is attached")
+
+	switchUser()
+	require.NoError(t, e.refreshCertificateProofs())
+	assert.Len(t, sent, 2, "the same chain proven again, with a fresh signature, is not sent")
+
+	failSync = true
+	require.NoError(t, os.Remove(filepath.Join(dir, "device.pem")))
+	switchUser()
+	require.Error(t, e.refreshCertificateProofs())
+	failSync = false
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "device.pem"), []byte(pem), 0o600))
+
+	// Management missed the empty proof set, so it still holds the chain the device proves
+	// again now; after a failed delivery the state is unknown, and it is sent regardless.
+	require.NoError(t, e.refreshCertificateProofs())
+	assert.Len(t, sent, 3, "after a failed delivery the next collection is sent")
+}
diff --git a/client/internal/engine_generic.go b/client/internal/engine_generic.go
index 34a75e45b..e293f1636 100644
--- a/client/internal/engine_generic.go
+++ b/client/internal/engine_generic.go
@@ -15,5 +15,6 @@ func (e *Engine) createICEConfig() icemaker.Config {
 		UDPMux:               e.udpMux.SingleSocketUDPMux,
 		UDPMuxSrflx:          e.udpMux,
 		NATExternalIPs:       e.parseNATExternalIPMappings(),
+		WGDetector:           e.wgDetector,
 	}
 }
diff --git a/client/internal/engine_js.go b/client/internal/engine_js.go
index dce3c57fb..0243b7b37 100644
--- a/client/internal/engine_js.go
+++ b/client/internal/engine_js.go
@@ -13,6 +13,7 @@ func (e *Engine) createICEConfig() icemaker.Config {
 		InterfaceBlackList:   e.config.IFaceBlackList,
 		DisableIPv6Discovery: e.config.DisableIPv6Discovery,
 		NATExternalIPs:       e.parseNATExternalIPMappings(),
+		WGDetector:           e.wgDetector,
 	}
 	return cfg
 }
diff --git a/client/internal/engine_privileged_test.go b/client/internal/engine_privileged_test.go
index 4a6bb2eac..b8a015f8c 100644
--- a/client/internal/engine_privileged_test.go
+++ b/client/internal/engine_privileged_test.go
@@ -12,12 +12,12 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/keepalive"
@@ -27,6 +27,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	nbssh "github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/client/system"
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -41,7 +42,6 @@ import (
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -81,6 +81,7 @@ func TestEngine_SSH(t *testing.T) {
 			WgAddr:           wgaddr.MustParseWGAddress("100.64.0.1/24"),
 			WgPrivateKey:     key,
 			WgPort:           33100,
+			IFaceBlackList:   profilemanager.DefaultInterfaceBlacklist,
 			ServerSSHAllowed: true,
 			MTU:              iface.DefaultMTU,
 			SSHKey:           sshKey,
@@ -193,7 +194,7 @@ func TestEngine_Sync(t *testing.T) {
 	// feed updates to Engine via mocked Management client
 	updates := make(chan *mgmtProto.SyncResponse)
 	defer close(updates)
-	syncFunc := func(ctx context.Context, info *system.Info, msgHandler func(msg *mgmtProto.SyncResponse) error) error {
+	syncFunc := func(ctx context.Context, _ func(context.Context) *system.Info, msgHandler func(msg *mgmtProto.SyncResponse) error) error {
 		for msg := range updates {
 			err := msgHandler(msg)
 			if err != nil {
@@ -204,11 +205,12 @@ func TestEngine_Sync(t *testing.T) {
 	}
 	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
 	engine := NewEngine(ctx, cancel, &EngineConfig{
-		WgIfaceName:  "utun103",
-		WgAddr:       wgaddr.MustParseWGAddress("100.64.0.1/24"),
-		WgPrivateKey: key,
-		WgPort:       33100,
-		MTU:          iface.DefaultMTU,
+		WgIfaceName:    "utun103",
+		WgAddr:         wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgPrivateKey:   key,
+		WgPort:         33100,
+		IFaceBlackList: profilemanager.DefaultInterfaceBlacklist,
+		MTU:            iface.DefaultMTU,
 	}, EngineServices{
 		SignalClient:   &signal.MockClient{},
 		MgmClient:      &mgmt.MockClient{SyncFunc: syncFunc},
@@ -412,11 +414,12 @@ func createEngine(ctx context.Context, cancel context.CancelFunc, setupKey strin
 
 	wgPort := 33100 + i
 	conf := &EngineConfig{
-		WgIfaceName:  ifaceName,
-		WgAddr:       wgaddr.MustParseWGAddress(resp.PeerConfig.Address),
-		WgPrivateKey: key,
-		WgPort:       wgPort,
-		MTU:          iface.DefaultMTU,
+		WgIfaceName:    ifaceName,
+		WgAddr:         wgaddr.MustParseWGAddress(resp.PeerConfig.Address),
+		WgPrivateKey:   key,
+		WgPort:         wgPort,
+		IFaceBlackList: profilemanager.DefaultInterfaceBlacklist,
+		MTU:            iface.DefaultMTU,
 	}
 
 	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
@@ -519,8 +522,8 @@ func startManagement(t *testing.T, dataDir, testFile string) (*grpc.Server, stri
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
-	networkMapController := controller.NewController(context.Background(), store, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config)
-	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(context.Background(), store, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", manager.NewEphemeralManager(store, peersManager), config, nil)
+	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, "", err
 	}
diff --git a/client/internal/engine_session_deadline_test.go b/client/internal/engine_session_deadline_test.go
new file mode 100644
index 000000000..5a67f103a
--- /dev/null
+++ b/client/internal/engine_session_deadline_test.go
@@ -0,0 +1,88 @@
+package internal
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// TestApplySessionDeadline_ThreeState pins down the 3-state semantics of the
+// wire field carried on LoginResponse / SyncResponse:
+//
+//   - nil pointer            → no info; previously-anchored deadline survives
+//   - explicit zero value    → "expiry disabled" sentinel; both sinks cleared
+//   - valid future timestamp → new deadline propagated to both sinks
+func TestApplySessionDeadline_ThreeState(t *testing.T) {
+	newEngine := func() *Engine {
+		recorder := peer.NewRecorder("")
+		return &Engine{
+			statusRecorder: recorder,
+			sessionWatcher: sessionwatch.New(recorder),
+		}
+	}
+
+	t.Run("valid timestamp sets deadline on both sinks", func(t *testing.T) {
+		e := newEngine()
+		deadline := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+
+		e.ApplySessionDeadline(timestamppb.New(deadline))
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(deadline),
+			"status recorder should hold the new deadline")
+	})
+
+	t.Run("nil is a no-op and preserves previous deadline", func(t *testing.T) {
+		e := newEngine()
+		seeded := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+		e.ApplySessionDeadline(timestamppb.New(seeded))
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded))
+
+		e.ApplySessionDeadline(nil)
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded),
+			"nil snapshot must not disturb the existing deadline")
+	})
+
+	t.Run("explicit zero clears a previously-anchored deadline", func(t *testing.T) {
+		e := newEngine()
+		seeded := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+		e.ApplySessionDeadline(timestamppb.New(seeded))
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded))
+
+		// Explicit zero Timestamp{} (seconds=0, nanos=0) is the
+		// "expiry disabled / not SSO" sentinel.
+		e.ApplySessionDeadline(&timestamppb.Timestamp{})
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().IsZero(),
+			"explicit zero sentinel must clear the deadline")
+	})
+
+	t.Run("invalid timestamp clears the deadline", func(t *testing.T) {
+		e := newEngine()
+		seeded := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+		e.ApplySessionDeadline(timestamppb.New(seeded))
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded))
+
+		// Out-of-range nanos → IsValid()==false; same-meaning as the
+		// disabled sentinel for downstream sinks.
+		e.ApplySessionDeadline(&timestamppb.Timestamp{Seconds: 1, Nanos: -1})
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().IsZero(),
+			"invalid timestamp must clear the deadline")
+	})
+
+	t.Run("recently expired timestamp stays visible as expired", func(t *testing.T) {
+		e := newEngine()
+		expired := time.Now().Add(-5 * time.Minute).UTC().Truncate(time.Second)
+
+		e.ApplySessionDeadline(timestamppb.New(expired))
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(expired),
+			"recently-expired deadline must stay on the recorder so consumers render it as expired")
+	})
+}
diff --git a/client/internal/engine_sessionwatch.go b/client/internal/engine_sessionwatch.go
new file mode 100644
index 000000000..05b46a465
--- /dev/null
+++ b/client/internal/engine_sessionwatch.go
@@ -0,0 +1,18 @@
+//go:build !js && !android
+
+package internal
+
+import (
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// newSessionWatcher returns the real SSO session expiry watcher. The js/wasm
+// build gets a no-op stub from engine_sessionwatch_js.go so the sessionwatch
+// package (and its timer machinery) never links into the wasm binary; the
+// android build gets a deadline-only watcher from
+// engine_sessionwatch_android.go because the app schedules the warnings
+// itself.
+func newSessionWatcher(recorder *peer.Status) sessionDeadlineWatcher {
+	return sessionwatch.New(recorder)
+}
diff --git a/client/internal/engine_sessionwatch_android.go b/client/internal/engine_sessionwatch_android.go
new file mode 100644
index 000000000..8317f9165
--- /dev/null
+++ b/client/internal/engine_sessionwatch_android.go
@@ -0,0 +1,12 @@
+//go:build android
+
+package internal
+
+import (
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+func newSessionWatcher(recorder *peer.Status) sessionDeadlineWatcher {
+	return sessionwatch.NewDeadlineOnly(recorder)
+}
diff --git a/client/internal/engine_sessionwatch_js.go b/client/internal/engine_sessionwatch_js.go
new file mode 100644
index 000000000..50e148ab9
--- /dev/null
+++ b/client/internal/engine_sessionwatch_js.go
@@ -0,0 +1,44 @@
+//go:build js
+
+package internal
+
+import (
+	"time"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// noopSessionWatcher is the js/wasm stand-in for sessionwatch.Watcher. The
+// wasm client never runs the engine's session-warning flow (the interactive
+// T-WarningLead notification and the T-FinalWarningLead fallback dialog live
+// in the desktop UI), so linking the full sessionwatch package (timers, event
+// composition) would only bloat the binary.
+//
+// It still mirrors the deadline into the status recorder so the SubscribeStatus
+// / Status snapshot the UI consumes stays correct — only the timer-driven
+// warnings are dropped.
+type noopSessionWatcher struct {
+	recorder *peer.Status
+}
+
+func newSessionWatcher(recorder *peer.Status) sessionDeadlineWatcher {
+	return noopSessionWatcher{recorder: recorder}
+}
+
+// Update mirrors the real watcher's recorder propagation without the timers or
+// sanity-check sentinels: a valid deadline is exposed on the status snapshot,
+// the zero time clears it.
+func (w noopSessionWatcher) Update(deadline time.Time) error {
+	if w.recorder != nil {
+		w.recorder.SetSessionExpiresAt(deadline)
+	}
+	return nil
+}
+
+func (noopSessionWatcher) Dismiss() {
+	// No-op: only suppresses the timer-driven final-warning, which this stub never arms.
+}
+
+func (noopSessionWatcher) Close() {
+	// No-op: no timers to stop and no state to unwind; the recorder is cleared via Update(zero).
+}
diff --git a/client/internal/engine_ssh.go b/client/internal/engine_ssh.go
index 53d2c1122..60bdfd806 100644
--- a/client/internal/engine_ssh.go
+++ b/client/internal/engine_ssh.go
@@ -24,6 +24,8 @@ type sshServer interface {
 	Stop() error
 	GetStatus() (bool, []sshserver.SessionInfo)
 	UpdateSSHAuth(config *sshauth.Config)
+	JWTConfig() *sshserver.JWTConfig
+	AuthConfig() *sshauth.Config
 }
 
 func (e *Engine) setupSSHPortRedirection() error {
@@ -77,7 +79,7 @@ func (e *Engine) updateSSH(sshConf *mgmProto.SSHConfig) error {
 
 	if e.config.DisableSSHAuth != nil && *e.config.DisableSSHAuth {
 		log.Info("starting SSH server without JWT authentication (authentication disabled by config)")
-		return e.startSSHServer(nil)
+		return e.startSSHServer(nil, nil)
 	}
 
 	if protoJWT := sshConf.GetJwtConfig(); protoJWT != nil {
@@ -95,7 +97,7 @@ func (e *Engine) updateSSH(sshConf *mgmProto.SSHConfig) error {
 			MaxTokenAge:  protoJWT.GetMaxTokenAge(),
 		}
 
-		return e.startSSHServer(jwtConfig)
+		return e.startSSHServer(jwtConfig, nil)
 	}
 
 	return errors.New("SSH server requires valid JWT configuration")
@@ -231,8 +233,33 @@ func (e *Engine) cleanupSSHConfig() {
 	}
 }
 
-// startSSHServer initializes and starts the SSH server with proper configuration.
-func (e *Engine) startSSHServer(jwtConfig *sshserver.JWTConfig) error {
+// restartSSHListeners rebuilds the SSH server so it listens on new sockets, on
+// the same terms it was started with. No-op when it is not running. See
+// Engine.rebindOverlayListeners for why this is needed.
+func (e *Engine) restartSSHListeners() error {
+	if e.sshServer == nil {
+		return nil
+	}
+	// Read from the server before it goes away. A rebuilt one starts with an
+	// empty authorizer, which fails closed, so without carrying the
+	// authorization over every JWT login is refused until the next network map
+	// happens to bring one.
+	jwtConfig, authConfig := e.sshServer.JWTConfig(), e.sshServer.AuthConfig()
+	if err := e.stopSSHServer(); err != nil {
+		return fmt.Errorf("rebind SSH listeners: %w", err)
+	}
+	if err := e.startSSHServer(jwtConfig, authConfig); err != nil {
+		return fmt.Errorf("rebind SSH listeners: %w", err)
+	}
+	return nil
+}
+
+// startSSHServer initializes and starts the SSH server with proper
+// configuration. authConfig is the fine-grained authorization to open with, and
+// is applied before the server accepts anything: a server that starts listening
+// with an empty authorizer refuses the logins that arrive in the meantime.
+// Nil leaves it as management has not sent one yet.
+func (e *Engine) startSSHServer(jwtConfig *sshserver.JWTConfig, authConfig *sshauth.Config) error {
 	if e.wgInterface == nil {
 		return errors.New("wg interface not initialized")
 	}
@@ -240,6 +267,7 @@ func (e *Engine) startSSHServer(jwtConfig *sshserver.JWTConfig) error {
 	serverConfig := &sshserver.Config{
 		HostKeyPEM: e.config.SSHKey,
 		JWT:        jwtConfig,
+		Auth:       authConfig,
 	}
 	server := sshserver.New(serverConfig)
 
diff --git a/client/internal/engine_stdnet.go b/client/internal/engine_stdnet.go
index 1ebb5779c..d6e2b1aa4 100644
--- a/client/internal/engine_stdnet.go
+++ b/client/internal/engine_stdnet.go
@@ -6,6 +6,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
-func (e *Engine) newStdNet() (*stdnet.Net, error) {
-	return stdnet.NewNet(e.clientCtx, e.config.IFaceBlackList)
+func (e *Engine) newStdNet() *stdnet.Net {
+	return stdnet.NewNet(e.clientCtx, e.config.IFaceBlackList, e.wgDetector)
 }
diff --git a/client/internal/engine_stdnet_android.go b/client/internal/engine_stdnet_android.go
index de3c80bcf..7ef996203 100644
--- a/client/internal/engine_stdnet_android.go
+++ b/client/internal/engine_stdnet_android.go
@@ -2,6 +2,6 @@ package internal
 
 import "github.com/netbirdio/netbird/client/internal/stdnet"
 
-func (e *Engine) newStdNet() (*stdnet.Net, error) {
-	return stdnet.NewNetWithDiscover(e.clientCtx, e.mobileDep.IFaceDiscover, e.config.IFaceBlackList)
+func (e *Engine) newStdNet() *stdnet.Net {
+	return stdnet.NewNetWithDiscover(e.clientCtx, e.mobileDep.IFaceDiscover, e.config.IFaceBlackList, e.wgDetector)
 }
diff --git a/client/internal/engine_test.go b/client/internal/engine_test.go
index 5208ed9fc..78ba4a8f7 100644
--- a/client/internal/engine_test.go
+++ b/client/internal/engine_test.go
@@ -2,6 +2,7 @@ package internal
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -31,6 +32,7 @@ import (
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/routemanager"
+	"github.com/netbirdio/netbird/client/system"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/monotime"
 	"github.com/netbirdio/netbird/route"
@@ -63,7 +65,6 @@ type MockWGIface struct {
 	GetStatsFunc               func() (map[string]configurer.WGStats, error)
 	GetInterfaceGUIDStringFunc func() (string, error)
 	GetProxyFunc               func() wgproxy.Proxy
-	GetProxyPortFunc           func() uint16
 	GetNetFunc                 func() *netstack.Net
 	LastActivitiesFunc         func() map[string]monotime.Time
 }
@@ -160,13 +161,6 @@ func (m *MockWGIface) GetProxy() wgproxy.Proxy {
 	return m.GetProxyFunc()
 }
 
-func (m *MockWGIface) GetProxyPort() uint16 {
-	if m.GetProxyPortFunc != nil {
-		return m.GetProxyPortFunc()
-	}
-	return 0
-}
-
 func (m *MockWGIface) GetNet() *netstack.Net {
 	return m.GetNetFunc()
 }
@@ -253,6 +247,223 @@ func TestEngine_SSHServerConsistency(t *testing.T) {
 	})
 }
 
+func TestEngine_FirstSyncInfoCarriesLoginChecks(t *testing.T) {
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+
+	exe, err := os.Executable()
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(CtxInitState(context.Background()))
+	defer cancel()
+
+	infos := make(chan *system.Info, 1)
+	mgmClient := &mgmt.MockClient{
+		SyncFunc: func(ctx context.Context, getInfo func(context.Context) *system.Info, _ func(*mgmtProto.SyncResponse) error) error {
+			infos <- getInfo(ctx)
+			return nil
+		},
+	}
+
+	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
+	engine := NewEngine(ctx, cancel, &EngineConfig{
+		WgIfaceName:  "utun104",
+		WgAddr:       wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgPrivateKey: key,
+		WgPort:       33100,
+		MTU:          iface.DefaultMTU,
+	}, EngineServices{
+		SignalClient:   &signal.MockClient{},
+		MgmClient:      mgmClient,
+		RelayManager:   relayMgr,
+		StatusRecorder: peer.NewRecorder("https://mgm"),
+		Checks:         []*mgmtProto.Checks{{Files: []string{exe}}},
+	}, MobileDependency{})
+
+	engine.receiveManagementEvents()
+
+	select {
+	case info := <-infos:
+		require.Len(t, info.Files, 1)
+		assert.Equal(t, exe, info.Files[0].Path)
+		assert.True(t, info.Files[0].Exist)
+	case <-time.After(20 * time.Second):
+		t.Fatal("timeout waiting for the first sync info")
+	}
+	engine.shutdownWg.Wait()
+}
+
+func TestEngine_SyncInfoFuncReusesRefreshedInfoOnce(t *testing.T) {
+	engine := &Engine{config: &EngineConfig{}}
+
+	refreshed := &system.Info{Hostname: "from-refresh"}
+	getInfo := engine.syncInfoFunc(refreshed)
+
+	first := getInfo(context.Background())
+	assert.Same(t, refreshed, first, "the first connect should send the refreshed info instead of gathering again")
+
+	second := getInfo(context.Background())
+	assert.NotSame(t, refreshed, second, "the reconnect should gather a fresh info")
+	assert.NotEqual(t, "from-refresh", second.Hostname, "the fresh info should not carry the refreshed hostname")
+}
+
+func TestEngine_SyncInfoFuncGathersWhenRefreshFailed(t *testing.T) {
+	engine := &Engine{config: &EngineConfig{}}
+
+	info := engine.syncInfoFunc(nil)(context.Background())
+	require.NotNil(t, info, "a failed refresh should fall back to gathering the info")
+	assert.NotEmpty(t, info.Hostname, "the gathered info should carry the hostname")
+}
+
+func TestEngine_UpdateChecksIfNewRetriesAfterFailedSyncMeta(t *testing.T) {
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+
+	exe, err := os.Executable()
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(CtxInitState(context.Background()))
+	defer cancel()
+
+	syncMetaCalls := 0
+	mgmClient := &mgmt.MockClient{
+		SyncMetaFunc: func(*system.Info) error {
+			syncMetaCalls++
+			if syncMetaCalls == 1 {
+				return errors.New("management unavailable")
+			}
+			return nil
+		},
+	}
+
+	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
+	engine := NewEngine(ctx, cancel, &EngineConfig{
+		WgIfaceName:  "utun105",
+		WgAddr:       wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgPrivateKey: key,
+		WgPort:       33100,
+		MTU:          iface.DefaultMTU,
+	}, EngineServices{
+		SignalClient:   &signal.MockClient{},
+		MgmClient:      mgmClient,
+		RelayManager:   relayMgr,
+		StatusRecorder: peer.NewRecorder("https://mgm"),
+	}, MobileDependency{})
+
+	checks := []*mgmtProto.Checks{{Files: []string{exe}}}
+
+	require.Error(t, engine.updateChecksIfNew(checks))
+	require.NoError(t, engine.updateChecksIfNew(checks))
+	require.NoError(t, engine.updateChecksIfNew(checks))
+
+	assert.Equal(t, 2, syncMetaCalls)
+}
+
+// TestEngine_FailedUpdateReplacesOlderPendingChecks: checks A time out and stay pending,
+// then checks B fail to sync for another reason. B must replace A as pending, or the
+// watcher would later apply the superseded A.
+func TestEngine_FailedUpdateReplacesOlderPendingChecks(t *testing.T) {
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	ctx, cancel := context.WithCancel(CtxInitState(context.Background()))
+	defer cancel()
+
+	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
+	engine := NewEngine(ctx, cancel, &EngineConfig{
+		WgIfaceName:  "utun107",
+		WgAddr:       wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgPrivateKey: key,
+		WgPort:       33102,
+		MTU:          iface.DefaultMTU,
+	}, EngineServices{
+		SignalClient:   &signal.MockClient{},
+		MgmClient:      &mgmt.MockClient{SyncMetaFunc: func(*system.Info) error { return errors.New("management unavailable") }},
+		RelayManager:   relayMgr,
+		StatusRecorder: peer.NewRecorder("https://mgm"),
+	}, MobileDependency{})
+
+	checksA := []*mgmtProto.Checks{{Files: []string{"/checks/a"}}}
+	checksB := []*mgmtProto.Checks{{Files: []string{"/checks/b"}}}
+
+	engine.infoTimeout = time.Nanosecond
+	require.NoError(t, engine.updateChecksIfNew(checksA))
+	require.Equal(t, checksA, engine.pendingChecks, "precondition: the timed-out checks are pending")
+
+	// Let the abandoned gathering finish so B gets as far as the meta sync.
+	engine.infoTimeout = 0
+	require.Eventually(t, func() bool {
+		_, ok := engine.infoSource.Refresh(ctx, 10*time.Second, nil)
+		return ok
+	}, 10*time.Second, 10*time.Millisecond)
+
+	require.Error(t, engine.updateChecksIfNew(checksB), "the meta sync of B fails")
+	assert.Equal(t, checksB, engine.pendingChecks, "the newest checks replace the older pending ones")
+}
+
+// TestEngine_PendingChecksRetriedAfterInfoTimeout covers a check update whose system info
+// gathering times out: the update is kept pending rather than dropped, and the posture
+// watcher's retry sends it and applies the checks, without waiting for management to
+// send different checks.
+func TestEngine_PendingChecksRetriedAfterInfoTimeout(t *testing.T) {
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+
+	exe, err := os.Executable()
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(CtxInitState(context.Background()))
+	defer cancel()
+
+	var synced []*system.Info
+	mgmClient := &mgmt.MockClient{
+		SyncMetaFunc: func(info *system.Info) error {
+			synced = append(synced, info)
+			return nil
+		},
+	}
+
+	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
+	engine := NewEngine(ctx, cancel, &EngineConfig{
+		WgIfaceName:  "utun106",
+		WgAddr:       wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgPrivateKey: key,
+		WgPort:       33101,
+		MTU:          iface.DefaultMTU,
+	}, EngineServices{
+		SignalClient:   &signal.MockClient{},
+		MgmClient:      mgmClient,
+		RelayManager:   relayMgr,
+		StatusRecorder: peer.NewRecorder("https://mgm"),
+	}, MobileDependency{})
+
+	checks := []*mgmtProto.Checks{{Files: []string{exe}}}
+
+	// Gathering cannot finish within a nanosecond, so the sync times out.
+	engine.infoTimeout = time.Nanosecond
+	require.NoError(t, engine.updateChecksIfNew(checks), "a timed-out gathering is not an error")
+	assert.Empty(t, synced, "nothing is sent when gathering timed out")
+	assert.Nil(t, engine.checks, "timed-out checks are not applied")
+	require.True(t, engine.hasPendingChecks.Load(), "timed-out checks are kept pending")
+
+	// The timed-out gathering keeps running in the background, and no new one starts
+	// until it exits, so the retry may time out again before it goes through.
+	engine.infoTimeout = 0
+	var retryErr error
+	require.Eventually(t, func() bool {
+		retryErr = engine.retryPendingChecks()
+		return retryErr == nil || !errors.Is(retryErr, errSystemInfoTimeout)
+	}, 10*time.Second, 10*time.Millisecond, "the pending checks are sent once the earlier gathering exits")
+	require.NoError(t, retryErr)
+	require.Len(t, synced, 1, "the retry sends the meta sync")
+	assert.Len(t, synced[0].Files, 1, "the retry evaluates the pending checks")
+	assert.Equal(t, checks, engine.checks, "the retried checks are applied")
+	assert.False(t, engine.hasPendingChecks.Load(), "nothing is pending after the retry")
+
+	require.NoError(t, engine.retryPendingChecks())
+	require.NoError(t, engine.updateChecksIfNew(checks))
+	assert.Len(t, synced, 1, "applied checks are not sent again")
+}
+
 func TestEngine_UpdateNetworkMap(t *testing.T) {
 	// test setup
 	key, err := wgtypes.GeneratePrivateKey()
@@ -279,7 +490,8 @@ func TestEngine_UpdateNetworkMap(t *testing.T) {
 	}, MobileDependency{})
 
 	wgIface := &MockWGIface{
-		NameFunc: func() string { return "utun102" },
+		NameFunc:            func() string { return "utun102" },
+		IsUserspaceBindFunc: func() bool { return true },
 		RemovePeerFunc: func(peerKey string) error {
 			return nil
 		},
@@ -622,10 +834,7 @@ func TestEngine_UpdateNetworkMapWithRoutes(t *testing.T) {
 				StatusRecorder: peer.NewRecorder("https://mgm"),
 			}, MobileDependency{})
 			engine.ctx = ctx
-			newNet, err := stdnet.NewNet(context.Background(), nil)
-			if err != nil {
-				t.Fatal(err)
-			}
+			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist, nil)
 
 			opts := iface.WGIFaceOpts{
 				IFaceName:    wgIfaceName,
@@ -830,10 +1039,7 @@ func TestEngine_UpdateNetworkMapWithDNSUpdate(t *testing.T) {
 			}, MobileDependency{})
 			engine.ctx = ctx
 
-			newNet, err := stdnet.NewNet(context.Background(), nil)
-			if err != nil {
-				t.Fatal(err)
-			}
+			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist, nil)
 			opts := iface.WGIFaceOpts{
 				IFaceName:    wgIfaceName,
 				Address:      wgaddr.MustParseWGAddress(wgAddr),
@@ -1119,6 +1325,32 @@ func Test_CheckFilesEqual(t *testing.T) {
 			},
 			expectedBool: true,
 		},
+		{
+			name: "Same files with rotated certificate challenge nonce should return false",
+			inputChecks1: []*mgmtProto.Checks{
+				{
+					Files:                []string{"testfile1"},
+					CertificateChallenge: &mgmtProto.CertificateChallenge{Nonce: []byte{1}, CaCertificates: []string{"ca-a"}},
+				},
+			},
+			inputChecks2: []*mgmtProto.Checks{
+				{
+					Files:                []string{"testfile1"},
+					CertificateChallenge: &mgmtProto.CertificateChallenge{Nonce: []byte{2}, CaCertificates: []string{"ca-a"}},
+				},
+			},
+			expectedBool: false,
+		},
+		{
+			name: "Same certificate challenge with CA certificates in different order should return true",
+			inputChecks1: []*mgmtProto.Checks{
+				{CertificateChallenge: &mgmtProto.CertificateChallenge{Nonce: []byte{1}, CaCertificates: []string{"ca-a", "ca-b"}}},
+			},
+			inputChecks2: []*mgmtProto.Checks{
+				{CertificateChallenge: &mgmtProto.CertificateChallenge{Nonce: []byte{1}, CaCertificates: []string{"ca-b", "ca-a"}}},
+			},
+			expectedBool: true,
+		},
 	}
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
@@ -1433,3 +1665,21 @@ func TestOverlayAddrsFromAllowedIPs(t *testing.T) {
 		})
 	}
 }
+
+func TestEngine_SyncResponsePersistence(t *testing.T) {
+	e := &Engine{}
+
+	_, err := e.GetLatestSyncResponse()
+	require.Error(t, err, "persistence is disabled by default")
+
+	e.SetSyncResponsePersistence(true)
+	e.persistSyncResponse(&mgmtProto.SyncResponse{NetworkMap: &mgmtProto.NetworkMap{Serial: 7}})
+
+	got, err := e.GetLatestSyncResponse()
+	require.NoError(t, err)
+	assert.Equal(t, uint64(7), got.GetNetworkMap().GetSerial())
+
+	e.SetSyncResponsePersistence(false)
+	_, err = e.GetLatestSyncResponse()
+	require.Error(t, err)
+}
diff --git a/client/internal/engine_tunsettings.go b/client/internal/engine_tunsettings.go
new file mode 100644
index 000000000..34a59671a
--- /dev/null
+++ b/client/internal/engine_tunsettings.go
@@ -0,0 +1,20 @@
+package internal
+
+func (e *Engine) TunSettings() ([]string, []string) {
+	e.syncMsgMux.Lock()
+	routeManager := e.routeManager
+	dnsServer := e.dnsServer
+	e.syncMsgMux.Unlock()
+
+	var routes []string
+	if routeManager != nil {
+		routes = routeManager.CurrentRouteRange()
+	}
+
+	var searchDomains []string
+	if dnsServer != nil {
+		searchDomains = dnsServer.SearchDomains()
+	}
+
+	return routes, searchDomains
+}
diff --git a/client/internal/getent/cgo_unix.go b/client/internal/getent/cgo_unix.go
new file mode 100644
index 000000000..2853aafff
--- /dev/null
+++ b/client/internal/getent/cgo_unix.go
@@ -0,0 +1,36 @@
+//go:build cgo && !osusergo && !windows
+
+package getent
+
+import "os/user"
+
+// Built with cgo, os/user resolves through libc (getpwnam_r and friends),
+// which goes through the host's NSS stack natively. Whatever it fails to
+// find, the getent command would not find either, so there is nothing to
+// fall back to.
+
+// LookupUser looks up a user by name.
+func LookupUser(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// LookupUserID looks up a user by UID.
+func LookupUserID(uid string) (*user.User, error) {
+	return user.LookupId(uid)
+}
+
+// CurrentUser returns the user this process runs as.
+func CurrentUser() (*user.User, error) {
+	return user.Current()
+}
+
+// LookupGroupID looks up a group by GID.
+func LookupGroupID(gid string) (*user.Group, error) {
+	return user.LookupGroupId(gid)
+}
+
+// GroupIDs returns the IDs of the groups the user is a member of; libc's
+// getgrouplist handles NSS groups natively.
+func GroupIDs(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}
diff --git a/client/internal/getent/getent.go b/client/internal/getent/getent.go
new file mode 100644
index 000000000..9cfebe64b
--- /dev/null
+++ b/client/internal/getent/getent.go
@@ -0,0 +1,6 @@
+// Package getent resolves users and groups through the host's NSS stack.
+// Built without cgo, os/user reads /etc/passwd and /etc/group alone and misses
+// anything LDAP, SSSD or winbind provide; the getent and id commands resolve
+// through NSS whatever the build. The lookups here try the standard library
+// first, which needs no subprocess, and fall back to those commands.
+package getent
diff --git a/client/ssh/server/getent_test.go b/client/internal/getent/getent_test.go
similarity index 53%
rename from client/ssh/server/getent_test.go
rename to client/internal/getent/getent_test.go
index 5eac2fdbe..8176eba36 100644
--- a/client/ssh/server/getent_test.go
+++ b/client/internal/getent/getent_test.go
@@ -1,4 +1,4 @@
-package server
+package getent
 
 import (
 	"os/user"
@@ -10,38 +10,48 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestLookupWithGetent_CurrentUser(t *testing.T) {
+func TestLookupUser_CurrentUser(t *testing.T) {
 	// The current user should always be resolvable on any platform
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	u, err := lookupWithGetent(current.Username)
+	u, err := LookupUser(current.Username)
 	require.NoError(t, err)
 	assert.Equal(t, current.Username, u.Username)
 	assert.Equal(t, current.Uid, u.Uid)
 	assert.Equal(t, current.Gid, u.Gid)
 }
 
-func TestLookupWithGetent_NonexistentUser(t *testing.T) {
-	_, err := lookupWithGetent("nonexistent_user_xyzzy_12345")
+func TestLookupUser_NonexistentUser(t *testing.T) {
+	_, err := LookupUser("nonexistent_user_xyzzy_12345")
 	require.Error(t, err, "should fail for nonexistent user")
 }
 
-func TestCurrentUserWithGetent(t *testing.T) {
+func TestLookupUserID_CurrentUser(t *testing.T) {
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	u, err := LookupUserID(current.Uid)
+	require.NoError(t, err)
+	assert.Equal(t, current.Username, u.Username)
+	assert.Equal(t, current.Uid, u.Uid)
+}
+
+func TestCurrentUser(t *testing.T) {
 	stdUser, err := user.Current()
 	require.NoError(t, err)
 
-	u, err := currentUserWithGetent()
+	u, err := CurrentUser()
 	require.NoError(t, err)
 	assert.Equal(t, stdUser.Uid, u.Uid)
 	assert.Equal(t, stdUser.Username, u.Username)
 }
 
-func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
+func TestGroupIDs_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	groups, err := groupIdsWithFallback(current)
+	groups, err := GroupIDs(current)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "current user should have at least one group")
 
@@ -53,32 +63,30 @@ func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
 	}
 }
 
-func TestGetShellFromGetent_CurrentUser(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		// Windows stub always returns empty, which is correct
-		shell := getShellFromGetent("1000")
-		assert.Empty(t, shell, "Windows stub should return empty")
-		return
-	}
-
+func TestUserShell_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	// getent may not be available on all systems (e.g., macOS without Homebrew getent)
-	shell := getShellFromGetent(current.Uid)
+	// getent may not be available on all systems (e.g., macOS without
+	// Homebrew getent), and Windows has no login shells at all.
+	shell, err := UserShell(current.Uid)
+	if err != nil {
+		t.Logf("UserShell failed, getent may not be available: %v", err)
+		return
+	}
 	if shell == "" {
-		t.Log("getShellFromGetent returned empty, getent may not be available")
+		t.Log("UserShell returned empty, the user has no shell set")
 		return
 	}
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 }
 
-func TestLookupWithGetent_RootUser(t *testing.T) {
+func TestLookupUser_RootUser(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("no root user on Windows")
 	}
 
-	u, err := lookupWithGetent("root")
+	u, err := LookupUser("root")
 	if err != nil {
 		t.Skip("root user not available on this system")
 	}
@@ -86,25 +94,25 @@ func TestLookupWithGetent_RootUser(t *testing.T) {
 }
 
 // TestIntegration_FullLookupChain exercises the complete user lookup chain
-// against the real system, testing that all wrappers (lookupWithGetent,
-// currentUserWithGetent, groupIdsWithFallback, getShellFromGetent) produce
-// consistent and correct results when composed together.
+// against the real system, testing that all wrappers (LookupUser,
+// CurrentUser, GroupIDs, UserShell) produce consistent and correct results
+// when composed together.
 func TestIntegration_FullLookupChain(t *testing.T) {
-	// Step 1: currentUserWithGetent must resolve the running user.
-	current, err := currentUserWithGetent()
-	require.NoError(t, err, "currentUserWithGetent must resolve the running user")
+	// Step 1: CurrentUser must resolve the running user.
+	current, err := CurrentUser()
+	require.NoError(t, err, "CurrentUser must resolve the running user")
 	require.NotEmpty(t, current.Uid)
 	require.NotEmpty(t, current.Username)
 
-	// Step 2: lookupWithGetent by the same username must return matching identity.
-	byName, err := lookupWithGetent(current.Username)
+	// Step 2: LookupUser by the same username must return matching identity.
+	byName, err := LookupUser(current.Username)
 	require.NoError(t, err)
 	assert.Equal(t, current.Uid, byName.Uid, "lookup by name should return same UID")
 	assert.Equal(t, current.Gid, byName.Gid, "lookup by name should return same GID")
 	assert.Equal(t, current.HomeDir, byName.HomeDir, "lookup by name should return same home")
 
-	// Step 3: groupIdsWithFallback must return at least the primary GID.
-	groups, err := groupIdsWithFallback(current)
+	// Step 3: GroupIDs must return at least the primary GID.
+	groups, err := GroupIDs(current)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "user must have at least one group")
 
@@ -119,29 +127,20 @@ func TestIntegration_FullLookupChain(t *testing.T) {
 		}
 	}
 	assert.True(t, foundPrimary, "primary GID %s should appear in supplementary groups", current.Gid)
-
-	// Step 4: getShellFromGetent should either return a valid shell path or empty
-	// (empty is OK when getent is not available, e.g. macOS without Homebrew getent).
-	if runtime.GOOS != "windows" {
-		shell := getShellFromGetent(current.Uid)
-		if shell != "" {
-			assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
-		}
-	}
 }
 
 // TestIntegration_LookupAndGroupsConsistency verifies that a user resolved via
-// lookupWithGetent can have their groups resolved via groupIdsWithFallback,
-// testing the handoff between the two functions as used by the SSH server.
+// LookupUser can have their groups resolved via GroupIDs, testing the handoff
+// between the two functions as used by the SSH server.
 func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
 	// Simulate the SSH server flow: lookup user, then get their groups.
-	resolved, err := lookupWithGetent(current.Username)
+	resolved, err := LookupUser(current.Username)
 	require.NoError(t, err)
 
-	groups, err := groupIdsWithFallback(resolved)
+	groups, err := GroupIDs(resolved)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "resolved user must have groups")
 
@@ -154,19 +153,3 @@ func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
 		}
 	}
 }
-
-// TestIntegration_ShellLookupChain tests the full shell resolution chain
-// (getShellFromPasswd -> getShellFromGetent -> $SHELL -> default) on Unix.
-func TestIntegration_ShellLookupChain(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("Unix shell lookup not applicable on Windows")
-	}
-
-	current, err := user.Current()
-	require.NoError(t, err)
-
-	// getUserShell is the top-level function used by the SSH server.
-	shell := getUserShell(current.Uid)
-	require.NotEmpty(t, shell, "getUserShell must always return a shell")
-	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
-}
diff --git a/client/internal/getent/nocgo_unix.go b/client/internal/getent/nocgo_unix.go
new file mode 100644
index 000000000..94d8ea6a9
--- /dev/null
+++ b/client/internal/getent/nocgo_unix.go
@@ -0,0 +1,110 @@
+//go:build (!cgo || osusergo) && !windows
+
+package getent
+
+import (
+	"os"
+	"os/user"
+	"strconv"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// Without cgo, os/user only reads /etc/passwd and /etc/group and misses
+// NSS-provided users and groups; the getent and id commands go through the
+// host's NSS stack.
+
+// LookupUser looks up a user by name, falling back to getent if os/user fails.
+func LookupUser(username string) (*user.User, error) {
+	u, err := user.Lookup(username)
+	if err == nil {
+		return u, nil
+	}
+
+	stdErr := err
+	log.Debugf("os/user.Lookup(%q) failed, trying getent: %v", username, err)
+
+	u, _, getentErr := passwdLookup(username)
+	if getentErr != nil {
+		log.Debugf("getent fallback for %q also failed: %v", username, getentErr)
+		return nil, stdErr
+	}
+	return u, nil
+}
+
+// LookupUserID looks up a user by UID, falling back to getent if os/user fails.
+func LookupUserID(uid string) (*user.User, error) {
+	u, err := user.LookupId(uid)
+	if err == nil {
+		return u, nil
+	}
+
+	stdErr := err
+	log.Debugf("os/user.LookupId(%q) failed, trying getent: %v", uid, err)
+
+	u, _, getentErr := passwdLookup(uid)
+	if getentErr != nil {
+		log.Debugf("getent fallback for uid %s also failed: %v", uid, getentErr)
+		return nil, stdErr
+	}
+	return u, nil
+}
+
+// CurrentUser returns the user this process runs as, falling back to getent
+// if os/user fails.
+func CurrentUser() (*user.User, error) {
+	u, err := user.Current()
+	if err == nil {
+		return u, nil
+	}
+
+	stdErr := err
+	uid := strconv.Itoa(os.Getuid())
+	log.Debugf("os/user.Current() failed, trying getent with UID %s: %v", uid, err)
+
+	u, _, getentErr := passwdLookup(uid)
+	if getentErr != nil {
+		return nil, stdErr
+	}
+	return u, nil
+}
+
+// LookupGroupID looks up a group by GID, falling back to getent if os/user
+// fails.
+func LookupGroupID(gid string) (*user.Group, error) {
+	g, err := user.LookupGroupId(gid)
+	if err == nil {
+		return g, nil
+	}
+
+	stdErr := err
+	log.Debugf("os/user.LookupGroupId(%q) failed, trying getent: %v", gid, err)
+
+	g, _, getentErr := groupLookup(gid)
+	if getentErr != nil {
+		log.Debugf("getent fallback for gid %s also failed: %v", gid, getentErr)
+		return nil, stdErr
+	}
+	return g, nil
+}
+
+// GroupIDs returns the IDs of the groups the user is a member of.
+// NOTE: unlike the lookups above, which try the standard library first, this
+// intentionally tries `id -G` first because without cgo, user.GroupIds only
+// reads /etc/group and silently returns incomplete results for NSS users
+// (no error, just missing groups). The id command goes through NSS and
+// returns the full set.
+func GroupIDs(u *user.User) ([]string, error) {
+	ids, err := idGroups(u.Username)
+	if err == nil {
+		return ids, nil
+	}
+
+	log.Debugf("id -G %q failed, falling back to user.GroupIds(): %v", u.Username, err)
+
+	ids, stdErr := u.GroupIds()
+	if stdErr != nil {
+		return nil, stdErr
+	}
+	return ids, nil
+}
diff --git a/client/internal/getent/unix.go b/client/internal/getent/unix.go
new file mode 100644
index 000000000..7d29810f5
--- /dev/null
+++ b/client/internal/getent/unix.go
@@ -0,0 +1,224 @@
+//go:build !windows
+
+package getent
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"runtime"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const commandTimeout = 5 * time.Second
+
+// groupFile lists which accounts are in which group, for hosts where the
+// getent command is not available (macOS ships without it).
+const groupFile = "/etc/group"
+
+// UserShell returns the login shell getent reports for the user with this UID.
+// It reaches shells that /etc/passwd does not list, because getent resolves
+// through the host's NSS stack.
+func UserShell(uid string) (string, error) {
+	_, shell, err := passwdLookup(uid)
+	if err != nil {
+		return "", err
+	}
+	return shell, nil
+}
+
+// GroupMembers returns the names of the group's members: from getent, which
+// resolves through NSS, or from /etc/group where getent is not available. A
+// group neither source describes is an error; an empty member list is not,
+// since accounts with the group as their primary one are not listed in it.
+func GroupMembers(name string) ([]string, error) {
+	_, members, err := groupLookup(name)
+	if err == nil {
+		return members, nil
+	}
+	log.Debugf("getent cannot list group %q, reading %s: %v", name, groupFile, err)
+	return groupMembersFromFile(groupFile, name)
+}
+
+// passwdLookup executes `getent passwd <query>`, where query is a username or
+// UID, and returns the user and login shell.
+func passwdLookup(query string) (*user.User, string, error) {
+	out, err := run("passwd", query)
+	if err != nil {
+		return nil, "", err
+	}
+	return parsePasswd(string(out))
+}
+
+// groupLookup executes `getent group <query>`, where query is a group name or
+// GID, and returns the group and its member names.
+func groupLookup(query string) (*user.Group, []string, error) {
+	out, err := run("group", query)
+	if err != nil {
+		return nil, nil, err
+	}
+	return parseGroup(string(out))
+}
+
+// run executes `getent <database> <key>` with a timeout.
+func run(database, key string) ([]byte, error) {
+	if !validateInput(key) {
+		return nil, fmt.Errorf("invalid getent input: %q", key)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "getent", database, key).Output()
+	if err != nil {
+		return nil, fmt.Errorf("getent %s %s: %w", database, key, err)
+	}
+	return out, nil
+}
+
+// parsePasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell"
+func parsePasswd(output string) (*user.User, string, error) {
+	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
+	if len(fields) < 6 {
+		return nil, "", fmt.Errorf("unexpected getent output (need 6+ fields): %q", output)
+	}
+
+	if fields[0] == "" || fields[2] == "" || fields[3] == "" {
+		return nil, "", fmt.Errorf("missing required fields in getent output: %q", output)
+	}
+
+	var shell string
+	if len(fields) >= 7 {
+		shell = fields[6]
+	}
+
+	return &user.User{
+		Username: fields[0],
+		Uid:      fields[2],
+		Gid:      fields[3],
+		Name:     fields[4],
+		HomeDir:  fields[5],
+	}, shell, nil
+}
+
+// parseGroup parses getent group output: "name:x:gid:member,member"
+func parseGroup(output string) (*user.Group, []string, error) {
+	fields := strings.SplitN(strings.TrimSpace(output), ":", 4)
+	if len(fields) < 3 {
+		return nil, nil, fmt.Errorf("unexpected getent output (need 3+ fields): %q", output)
+	}
+
+	if fields[0] == "" || fields[2] == "" {
+		return nil, nil, fmt.Errorf("missing required fields in getent output: %q", output)
+	}
+
+	var members []string
+	if len(fields) >= 4 {
+		members = splitMembers(fields[3])
+	}
+	return &user.Group{Name: fields[0], Gid: fields[2]}, members, nil
+}
+
+func splitMembers(list string) []string {
+	var members []string
+	for member := range strings.SplitSeq(list, ",") {
+		if member != "" {
+			members = append(members, member)
+		}
+	}
+	return members
+}
+
+// groupMembersFromFile finds the group's member list in a file of /etc/group's
+// format. A group the file does not describe, because it comes from LDAP or
+// another NSS source, is an error rather than an empty list.
+func groupMembersFromFile(path, name string) ([]string, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("open %s: %w", path, err)
+	}
+	defer func() {
+		if err := file.Close(); err != nil {
+			log.Debugf("close %s: %v", path, err)
+		}
+	}()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		// name:password:gid:member,member
+		fields := strings.Split(scanner.Text(), ":")
+		if len(fields) < 4 || fields[0] != name {
+			continue
+		}
+		return splitMembers(fields[3]), nil
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	return nil, fmt.Errorf("%s does not describe group %q", path, name)
+}
+
+// validateInput checks that the input is safe to pass to getent or id.
+// Allows POSIX usernames, numeric IDs, and common NSS extensions
+// (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is
+// rejected so the input can never be parsed as a command-line flag.
+func validateInput(input string) bool {
+	maxLen := 32
+	if runtime.GOOS == "linux" {
+		maxLen = 256
+	}
+
+	if len(input) == 0 || len(input) > maxLen {
+		return false
+	}
+
+	if input[0] == '-' {
+		return false
+	}
+
+	for _, r := range input {
+		if isAllowedChar(r) {
+			continue
+		}
+		return false
+	}
+	return true
+}
+
+func isAllowedChar(r rune) bool {
+	if r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' {
+		return true
+	}
+	switch r {
+	case '.', '_', '-', '@', '+', '$':
+		return true
+	}
+	return false
+}
+
+// idGroups runs `id -G <username>` and returns the space-separated group IDs.
+func idGroups(username string) ([]string, error) {
+	if !validateInput(username) {
+		return nil, fmt.Errorf("invalid username for id command: %q", username)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "id", "-G", username).Output()
+	if err != nil {
+		return nil, fmt.Errorf("id -G %s: %w", username, err)
+	}
+
+	trimmed := strings.TrimSpace(string(out))
+	if trimmed == "" {
+		return nil, fmt.Errorf("id -G %s: empty output", username)
+	}
+	return strings.Fields(trimmed), nil
+}
diff --git a/client/ssh/server/getent_unix_test.go b/client/internal/getent/unix_test.go
similarity index 62%
rename from client/ssh/server/getent_unix_test.go
rename to client/internal/getent/unix_test.go
index e44563b79..5ab100ce5 100644
--- a/client/ssh/server/getent_unix_test.go
+++ b/client/internal/getent/unix_test.go
@@ -1,10 +1,12 @@
 //go:build !windows
 
-package server
+package getent
 
 import (
+	"os"
 	"os/exec"
 	"os/user"
+	"path/filepath"
 	"runtime"
 	"strconv"
 	"testing"
@@ -13,7 +15,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestParseGetentPasswd(t *testing.T) {
+func TestParsePasswd(t *testing.T) {
 	tests := []struct {
 		name        string
 		input       string
@@ -128,7 +130,7 @@ func TestParseGetentPasswd(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			u, shell, err := parseGetentPasswd(tt.input)
+			u, shell, err := parsePasswd(tt.input)
 			if tt.wantErr {
 				require.Error(t, err)
 				if tt.errContains != "" {
@@ -147,7 +149,120 @@ func TestParseGetentPasswd(t *testing.T) {
 	}
 }
 
-func TestValidateGetentInput(t *testing.T) {
+func TestParseGroup(t *testing.T) {
+	tests := []struct {
+		name        string
+		input       string
+		wantGroup   *user.Group
+		wantMembers []string
+		wantErr     bool
+	}{
+		{
+			name:      "no members",
+			input:     "vma:x:1000:\n",
+			wantGroup: &user.Group{Name: "vma", Gid: "1000"},
+		},
+		{
+			name:        "one member",
+			input:       "sudo:x:27:alice",
+			wantGroup:   &user.Group{Name: "sudo", Gid: "27"},
+			wantMembers: []string{"alice"},
+		},
+		{
+			name:        "several members",
+			input:       "docker:x:998:alice,bob\n",
+			wantGroup:   &user.Group{Name: "docker", Gid: "998"},
+			wantMembers: []string{"alice", "bob"},
+		},
+		{
+			name:    "too few fields",
+			input:   "bad:x",
+			wantErr: true,
+		},
+		{
+			name:    "empty group name",
+			input:   ":x:1000:alice",
+			wantErr: true,
+		},
+		{
+			name:    "empty GID",
+			input:   "vma:x::alice",
+			wantErr: true,
+		},
+		{
+			name:    "empty input",
+			input:   "",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			g, members, err := parseGroup(tt.input)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantGroup.Name, g.Name, "group name")
+			assert.Equal(t, tt.wantGroup.Gid, g.Gid, "GID")
+			assert.Equal(t, tt.wantMembers, members, "members")
+		})
+	}
+}
+
+func TestGroupMembersFromFile(t *testing.T) {
+	tests := []struct {
+		name  string
+		entry string
+		want  []string
+	}{
+		{name: "no members", entry: "vma:x:1000:"},
+		{name: "only the owner", entry: "vma:x:1000:vma", want: []string{"vma"}},
+		{name: "two members", entry: "vma:x:1000:vma,bob", want: []string{"vma", "bob"}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "group")
+			body := "root:x:0:\n" + tt.entry + "\nsudo:x:27:vma\n"
+			require.NoError(t, os.WriteFile(path, []byte(body), 0o644), "write the group file")
+
+			members, err := groupMembersFromFile(path, "vma")
+			require.NoError(t, err, "entry %q", tt.entry)
+			assert.Equal(t, tt.want, members, "entry %q", tt.entry)
+		})
+	}
+}
+
+// A group the file does not describe, because it comes from LDAP or another
+// NSS source, is an error rather than an empty member list: the caller must
+// be able to tell "no members" from "no answer".
+func TestGroupMembersFromFileUnknownGroup(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "group")
+	require.NoError(t, os.WriteFile(path, []byte("root:x:0:\n"), 0o644), "write the group file")
+
+	_, err := groupMembersFromFile(path, "vma")
+	assert.Error(t, err, "a group the file does not describe")
+
+	_, err = groupMembersFromFile(filepath.Join(t.TempDir(), "absent"), "vma")
+	assert.Error(t, err, "no group file at all")
+}
+
+// GroupMembers on the root group, which every Unix has, whichever source
+// answers for it.
+func TestGroupMembers_RootGroup(t *testing.T) {
+	rootGroup := "root"
+	switch runtime.GOOS {
+	case "darwin", "dragonfly", "freebsd", "netbsd", "openbsd":
+		rootGroup = "wheel"
+	}
+
+	_, err := GroupMembers(rootGroup)
+	assert.NoError(t, err, "the %s group must be describable", rootGroup)
+}
+
+func TestValidateInput(t *testing.T) {
 	tests := []struct {
 		name  string
 		input string
@@ -157,6 +272,9 @@ func TestValidateGetentInput(t *testing.T) {
 		{"numeric UID", "1001", true},
 		{"dots and underscores", "alice.bob_test", true},
 		{"hyphen", "alice-bob", true},
+		{"leading hyphen rejected", "-i", false},
+		{"leading double hyphen rejected", "--no-idn", false},
+		{"lone hyphen rejected", "-", false},
 		{"kerberos principal", "user@REALM", true},
 		{"samba machine account", "MACHINE$", true},
 		{"NIS compat", "+user", true},
@@ -177,7 +295,7 @@ func TestValidateGetentInput(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, validateGetentInput(tt.input))
+			assert.Equal(t, tt.want, validateInput(tt.input))
 		})
 	}
 }
@@ -190,12 +308,12 @@ func makeLongString(n int) string {
 	return string(b)
 }
 
-func TestRunGetent_RootUser(t *testing.T) {
+func TestPasswdLookup_RootUser(t *testing.T) {
 	if _, err := exec.LookPath("getent"); err != nil {
 		t.Skip("getent not available on this system")
 	}
 
-	u, shell, err := runGetent("root")
+	u, shell, err := passwdLookup("root")
 	require.NoError(t, err)
 	assert.Equal(t, "root", u.Username)
 	assert.Equal(t, "0", u.Uid)
@@ -203,44 +321,55 @@ func TestRunGetent_RootUser(t *testing.T) {
 	assert.NotEmpty(t, shell, "root should have a shell")
 }
 
-func TestRunGetent_ByUID(t *testing.T) {
+func TestPasswdLookup_ByUID(t *testing.T) {
 	if _, err := exec.LookPath("getent"); err != nil {
 		t.Skip("getent not available on this system")
 	}
 
-	u, _, err := runGetent("0")
+	u, _, err := passwdLookup("0")
 	require.NoError(t, err)
 	assert.Equal(t, "root", u.Username)
 	assert.Equal(t, "0", u.Uid)
 }
 
-func TestRunGetent_NonexistentUser(t *testing.T) {
+func TestPasswdLookup_NonexistentUser(t *testing.T) {
 	if _, err := exec.LookPath("getent"); err != nil {
 		t.Skip("getent not available on this system")
 	}
 
-	_, _, err := runGetent("nonexistent_user_xyzzy_12345")
+	_, _, err := passwdLookup("nonexistent_user_xyzzy_12345")
 	assert.Error(t, err)
 }
 
-func TestRunGetent_InvalidInput(t *testing.T) {
-	_, _, err := runGetent("")
+func TestPasswdLookup_InvalidInput(t *testing.T) {
+	_, _, err := passwdLookup("")
 	assert.Error(t, err)
 
-	_, _, err = runGetent("user\x00name")
+	_, _, err = passwdLookup("user\x00name")
 	assert.Error(t, err)
 }
 
-func TestRunGetent_NotAvailable(t *testing.T) {
+func TestPasswdLookup_NotAvailable(t *testing.T) {
 	if _, err := exec.LookPath("getent"); err == nil {
 		t.Skip("getent is available, can't test missing case")
 	}
 
-	_, _, err := runGetent("root")
+	_, _, err := passwdLookup("root")
 	assert.Error(t, err, "should fail when getent is not installed")
 }
 
-func TestRunIdGroups_CurrentUser(t *testing.T) {
+func TestGroupLookup_RootGroup(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	g, _, err := groupLookup("0")
+	require.NoError(t, err)
+	assert.Equal(t, "0", g.Gid, "GID 0 resolves to the root group")
+	assert.NotEmpty(t, g.Name, "the root group has a name")
+}
+
+func TestIdGroups_CurrentUser(t *testing.T) {
 	if _, err := exec.LookPath("id"); err != nil {
 		t.Skip("id not available on this system")
 	}
@@ -248,7 +377,7 @@ func TestRunIdGroups_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	groups, err := runIdGroups(current.Username)
+	groups, err := idGroups(current.Username)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "current user should have at least one group")
 
@@ -258,20 +387,20 @@ func TestRunIdGroups_CurrentUser(t *testing.T) {
 	}
 }
 
-func TestRunIdGroups_NonexistentUser(t *testing.T) {
+func TestIdGroups_NonexistentUser(t *testing.T) {
 	if _, err := exec.LookPath("id"); err != nil {
 		t.Skip("id not available on this system")
 	}
 
-	_, err := runIdGroups("nonexistent_user_xyzzy_12345")
+	_, err := idGroups("nonexistent_user_xyzzy_12345")
 	assert.Error(t, err)
 }
 
-func TestRunIdGroups_InvalidInput(t *testing.T) {
-	_, err := runIdGroups("")
+func TestIdGroups_InvalidInput(t *testing.T) {
+	_, err := idGroups("")
 	assert.Error(t, err)
 
-	_, err = runIdGroups("user\x00name")
+	_, err = idGroups("user\x00name")
 	assert.Error(t, err)
 }
 
@@ -283,7 +412,7 @@ func TestGetentResultsMatchStdlib(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	getentUser, _, err := runGetent(current.Username)
+	getentUser, _, err := passwdLookup(current.Username)
 	require.NoError(t, err)
 
 	assert.Equal(t, current.Username, getentUser.Username, "username should match")
@@ -300,7 +429,7 @@ func TestGetentResultsMatchStdlib_ByUID(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	getentUser, _, err := runGetent(current.Uid)
+	getentUser, _, err := passwdLookup(current.Uid)
 	require.NoError(t, err)
 
 	assert.Equal(t, current.Username, getentUser.Username, "username should match when looked up by UID")
@@ -320,12 +449,12 @@ func TestIdGroupsMatchStdlib(t *testing.T) {
 		t.Skip("os/user.GroupIds() not working, likely CGO_ENABLED=0")
 	}
 
-	idGroups, err := runIdGroups(current.Username)
+	idGroupIDs, err := idGroups(current.Username)
 	require.NoError(t, err)
 
 	// Deduplicate both lists: id -G can return duplicates (e.g., root in Docker)
 	// and ElementsMatch treats duplicates as distinct.
-	assert.ElementsMatch(t, uniqueStrings(stdGroups), uniqueStrings(idGroups), "id -G should return same groups as os/user")
+	assert.ElementsMatch(t, uniqueStrings(stdGroups), uniqueStrings(idGroupIDs), "id -G should return same groups as os/user")
 }
 
 func uniqueStrings(ss []string) []string {
@@ -340,71 +469,3 @@ func uniqueStrings(ss []string) []string {
 	}
 	return out
 }
-
-// TestGetShellFromPasswd_CurrentUser verifies that getShellFromPasswd correctly
-// reads the current user's shell from /etc/passwd by comparing it against what
-// getent reports (which goes through NSS).
-func TestGetShellFromPasswd_CurrentUser(t *testing.T) {
-	current, err := user.Current()
-	require.NoError(t, err)
-
-	shell := getShellFromPasswd(current.Uid)
-	if shell == "" {
-		t.Skip("current user not found in /etc/passwd (may be an NSS-only user)")
-	}
-
-	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
-
-	if _, err := exec.LookPath("getent"); err == nil {
-		_, getentShell, getentErr := runGetent(current.Uid)
-		if getentErr == nil && getentShell != "" {
-			assert.Equal(t, getentShell, shell, "shell from /etc/passwd should match getent")
-		}
-	}
-}
-
-// TestGetShellFromPasswd_RootUser verifies that getShellFromPasswd can read
-// root's shell from /etc/passwd. Root is guaranteed to be in /etc/passwd on
-// any standard Unix system.
-func TestGetShellFromPasswd_RootUser(t *testing.T) {
-	shell := getShellFromPasswd("0")
-	require.NotEmpty(t, shell, "root (UID 0) must be in /etc/passwd")
-	assert.True(t, shell[0] == '/', "root shell should be an absolute path, got %q", shell)
-}
-
-// TestGetShellFromPasswd_NonexistentUID verifies that getShellFromPasswd
-// returns empty for a UID that doesn't exist in /etc/passwd.
-func TestGetShellFromPasswd_NonexistentUID(t *testing.T) {
-	shell := getShellFromPasswd("4294967294")
-	assert.Empty(t, shell, "nonexistent UID should return empty shell")
-}
-
-// TestGetShellFromPasswd_MatchesGetentForKnownUsers reads /etc/passwd directly
-// and cross-validates every entry against getent to ensure parseGetentPasswd
-// and getShellFromPasswd agree on shell values.
-func TestGetShellFromPasswd_MatchesGetentForKnownUsers(t *testing.T) {
-	if _, err := exec.LookPath("getent"); err != nil {
-		t.Skip("getent not available")
-	}
-
-	// Pick a few well-known system UIDs that are virtually always in /etc/passwd.
-	uids := []string{"0"} // root
-
-	current, err := user.Current()
-	require.NoError(t, err)
-	uids = append(uids, current.Uid)
-
-	for _, uid := range uids {
-		passwdShell := getShellFromPasswd(uid)
-		if passwdShell == "" {
-			continue
-		}
-
-		_, getentShell, err := runGetent(uid)
-		if err != nil {
-			continue
-		}
-
-		assert.Equal(t, getentShell, passwdShell, "shell mismatch for UID %s", uid)
-	}
-}
diff --git a/client/internal/getent/windows.go b/client/internal/getent/windows.go
new file mode 100644
index 000000000..61881d162
--- /dev/null
+++ b/client/internal/getent/windows.go
@@ -0,0 +1,36 @@
+//go:build windows
+
+package getent
+
+import (
+	"errors"
+	"os/user"
+)
+
+// Windows does not use NSS or getent; os/user resolves accounts there
+// without cgo, so everything delegates to it.
+
+// LookupUser looks up a user by name.
+func LookupUser(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// LookupUserID looks up a user by UID.
+func LookupUserID(uid string) (*user.User, error) {
+	return user.LookupId(uid)
+}
+
+// CurrentUser returns the user this process runs as.
+func CurrentUser() (*user.User, error) {
+	return user.Current()
+}
+
+// GroupIDs returns the IDs of the groups the user is a member of.
+func GroupIDs(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}
+
+// UserShell is unanswerable on Windows, which has no login-shell database.
+func UserShell(string) (string, error) {
+	return "", errors.ErrUnsupported
+}
diff --git a/client/internal/iface_common.go b/client/internal/iface_common.go
index 8ffa0b102..d772a3a03 100644
--- a/client/internal/iface_common.go
+++ b/client/internal/iface_common.go
@@ -28,7 +28,6 @@ type wgIfaceBase interface {
 	Up() (*udpmux.UniversalUDPMuxDefault, error)
 	UpdateAddr(newAddr wgaddr.Address) error
 	GetProxy() wgproxy.Proxy
-	GetProxyPort() uint16
 	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	RemoveEndpointAddress(key string) error
 	RemovePeer(peerKey string) error
diff --git a/client/internal/ingressgw/manager.go b/client/internal/ingressgw/manager.go
deleted file mode 100644
index b8952e5c0..000000000
--- a/client/internal/ingressgw/manager.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package ingressgw
-
-import (
-	"fmt"
-	"sync"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-)
-
-type DNATFirewall interface {
-	AddDNATRule(fwdRule firewall.ForwardRule) (firewall.Rule, error)
-	DeleteDNATRule(rule firewall.Rule) error
-}
-
-type RulePair struct {
-	firewall.ForwardRule
-	firewall.Rule
-}
-
-type Manager struct {
-	dnatFirewall DNATFirewall
-
-	rules   map[string]RulePair // keys is the ID of the ForwardRule
-	rulesMu sync.Mutex
-}
-
-func NewManager(dnatFirewall DNATFirewall) *Manager {
-	return &Manager{
-		dnatFirewall: dnatFirewall,
-		rules:        make(map[string]RulePair),
-	}
-}
-
-func (h *Manager) Update(forwardRules []firewall.ForwardRule) error {
-	h.rulesMu.Lock()
-	defer h.rulesMu.Unlock()
-
-	var mErr *multierror.Error
-
-	toDelete := make(map[string]RulePair, len(h.rules))
-	for id, r := range h.rules {
-		toDelete[id] = r
-	}
-
-	// Process new/updated rules
-	for _, fwdRule := range forwardRules {
-		id := fwdRule.ID()
-		if _, ok := h.rules[id]; ok {
-			delete(toDelete, id)
-			continue
-		}
-
-		rule, err := h.dnatFirewall.AddDNATRule(fwdRule)
-		if err != nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("add forward rule '%s': %v", fwdRule.String(), err))
-			continue
-		}
-		log.Infof("forward rule has been added '%s'", fwdRule)
-		h.rules[id] = RulePair{
-			ForwardRule: fwdRule,
-			Rule:        rule,
-		}
-	}
-
-	// Remove deleted rules
-	for id, rulePair := range toDelete {
-		if err := h.dnatFirewall.DeleteDNATRule(rulePair.Rule); err != nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("failed to delete forward rule '%s': %v", rulePair.ForwardRule.String(), err))
-		}
-		log.Infof("forward rule has been deleted '%s'", rulePair.ForwardRule)
-		delete(h.rules, id)
-	}
-
-	return nberrors.FormatErrorOrNil(mErr)
-}
-
-func (h *Manager) Close() error {
-	h.rulesMu.Lock()
-	defer h.rulesMu.Unlock()
-
-	log.Infof("clean up all (%d) forward rules", len(h.rules))
-	var mErr *multierror.Error
-	for _, rule := range h.rules {
-		if err := h.dnatFirewall.DeleteDNATRule(rule.Rule); err != nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("failed to delete forward rule '%s': %v", rule, err))
-		}
-	}
-
-	h.rules = make(map[string]RulePair)
-	return nberrors.FormatErrorOrNil(mErr)
-}
-
-func (h *Manager) Rules() []firewall.ForwardRule {
-	h.rulesMu.Lock()
-	defer h.rulesMu.Unlock()
-
-	rules := make([]firewall.ForwardRule, 0, len(h.rules))
-	for _, rulePair := range h.rules {
-		rules = append(rules, rulePair.ForwardRule)
-	}
-
-	return rules
-}
diff --git a/client/internal/ingressgw/manager_test.go b/client/internal/ingressgw/manager_test.go
deleted file mode 100644
index 591ea0dd8..000000000
--- a/client/internal/ingressgw/manager_test.go
+++ /dev/null
@@ -1,281 +0,0 @@
-package ingressgw
-
-import (
-	"fmt"
-	"net/netip"
-	"testing"
-
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-)
-
-var (
-	_ firewall.Rule = (*MocFwRule)(nil)
-	_ DNATFirewall  = &MockDNATFirewall{}
-)
-
-type MocFwRule struct {
-	id string
-}
-
-func (m *MocFwRule) ID() string {
-	return string(m.id)
-}
-
-type MockDNATFirewall struct {
-	throwError bool
-}
-
-func (m *MockDNATFirewall) AddDNATRule(fwdRule firewall.ForwardRule) (firewall.Rule, error) {
-	if m.throwError {
-		return nil, fmt.Errorf("moc error")
-	}
-
-	fwRule := &MocFwRule{
-		id: fwdRule.ID(),
-	}
-	return fwRule, nil
-}
-
-func (m *MockDNATFirewall) DeleteDNATRule(rule firewall.Rule) error {
-	if m.throwError {
-		return fmt.Errorf("moc error")
-	}
-	return nil
-}
-
-func (m *MockDNATFirewall) forceToThrowErrors() {
-	m.throwError = true
-}
-
-func TestManager_AddRule(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-
-	updates := []firewall.ForwardRule{
-		{
-			Protocol:          firewall.ProtocolTCP,
-			DestinationPort:   *port,
-			TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-			TranslatedPort:    *port,
-		},
-		{
-			Protocol:          firewall.ProtocolUDP,
-			DestinationPort:   *port,
-			TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-			TranslatedPort:    *port,
-		}}
-
-	if err := mgr.Update(updates); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != len(updates) {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_UpdateRule(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	ruleUDP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolUDP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.2"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleUDP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 1 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-
-	if rules[0].TranslatedAddress.String() != ruleUDP.TranslatedAddress.String() {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-
-	if rules[0].TranslatedPort.String() != ruleUDP.TranslatedPort.String() {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-
-	if rules[0].DestinationPort.String() != ruleUDP.DestinationPort.String() {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-
-	if rules[0].Protocol != ruleUDP.Protocol {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-}
-
-func TestManager_ExtendRules(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	ruleUDP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolUDP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.2"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP, ruleUDP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 2 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_UnderlingError(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	ruleUDP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolUDP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.2"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	fw.forceToThrowErrors()
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP, ruleUDP}); err == nil {
-		t.Errorf("expected error")
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 1 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_Cleanup(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 0 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_DeleteBrokenRule(t *testing.T) {
-	fw := &MockDNATFirewall{}
-
-	// force to throw errors when Add DNAT Rule
-	fw.forceToThrowErrors()
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err == nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 0 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-
-	// simulate that to remove a broken rule
-	if err := mgr.Update([]firewall.ForwardRule{}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Close(); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-}
-
-func TestManager_Close(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Close(); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 0 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
diff --git a/client/internal/ipcauth/creds_stub.go b/client/internal/ipcauth/creds_stub.go
new file mode 100644
index 000000000..154948716
--- /dev/null
+++ b/client/internal/ipcauth/creds_stub.go
@@ -0,0 +1,31 @@
+//go:build !linux && !darwin && !freebsd && !windows
+
+package ipcauth
+
+import (
+	"errors"
+	"net"
+
+	"google.golang.org/grpc/credentials"
+)
+
+// errUnsupported is returned on platforms with no local peer-identity
+// primitive, so consumers fail closed instead of guessing an identity.
+var errUnsupported = errors.New("peer identity is not available on this platform")
+
+// NewTransportCredentials returns nil: without a peer-identity primitive the
+// daemon cannot authenticate local callers, and the caller must treat that as
+// "authorization cannot be enforced".
+func NewTransportCredentials() credentials.TransportCredentials {
+	return nil
+}
+
+// PeerIdentity always fails on this platform.
+func PeerIdentity(net.Conn) (Identity, error) {
+	return Identity{}, errUnsupported
+}
+
+// ConnIdentity always fails on this platform.
+func ConnIdentity(net.Conn) (Identity, error) {
+	return Identity{}, errUnsupported
+}
diff --git a/client/internal/ipcauth/creds_unix.go b/client/internal/ipcauth/creds_unix.go
new file mode 100644
index 000000000..688fe4623
--- /dev/null
+++ b/client/internal/ipcauth/creds_unix.go
@@ -0,0 +1,56 @@
+//go:build linux || darwin || freebsd
+
+package ipcauth
+
+import (
+	"context"
+	"net"
+
+	"google.golang.org/grpc/credentials"
+)
+
+// NewTransportCredentials returns gRPC transport credentials that expose the
+// caller's kernel-authenticated identity via IdentityFromContext. It returns
+// nil on platforms that have no peer-identity primitive, which the caller must
+// treat as "authorization cannot be enforced".
+//
+// The handshake exchanges no bytes on the wire, so a client dialing with
+// insecure credentials interoperates with a server using these. That keeps
+// older CLI and UI binaries working against an upgraded daemon.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return unixCreds{}
+}
+
+// ConnIdentity extracts the caller's identity from an accepted local IPC
+// connection. It is shared by the gRPC transport credentials and by the JSON
+// gateway, which reads the identity of its own HTTP clients.
+func ConnIdentity(conn net.Conn) (Identity, error) {
+	return PeerIdentity(conn)
+}
+
+type unixCreds struct{}
+
+func (unixCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, AuthInfo{}, nil
+}
+
+// ServerHandshake extracts the peer identity and fails closed when it cannot
+// be read, so a connection whose caller is unknown never reaches a handler.
+func (unixCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	id, err := ConnIdentity(conn)
+	if err != nil {
+		return nil, nil, err
+	}
+	return conn, AuthInfo{
+		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+		Identity:       id,
+	}, nil
+}
+
+func (unixCreds) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: AuthInfo{}.AuthType()}
+}
+
+func (unixCreds) Clone() credentials.TransportCredentials { return unixCreds{} }
+
+func (unixCreds) OverrideServerName(string) error { return nil }
diff --git a/client/internal/ipcauth/creds_windows.go b/client/internal/ipcauth/creds_windows.go
new file mode 100644
index 000000000..37f902c52
--- /dev/null
+++ b/client/internal/ipcauth/creds_windows.go
@@ -0,0 +1,194 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"runtime"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+	"google.golang.org/grpc/credentials"
+)
+
+var (
+	modadvapi32                    = windows.NewLazySystemDLL("advapi32.dll")
+	procImpersonateNamedPipeClient = modadvapi32.NewProc("ImpersonateNamedPipeClient")
+)
+
+// DefaultPipeSDDL is the security descriptor for the daemon control pipe.
+//
+//	D:P          protected DACL, no inheritance
+//	(A;;GA;;;SY) allow GENERIC_ALL to LocalSystem (the daemon's service account)
+//	(A;;GA;;;WD) allow GENERIC_ALL to Everyone
+//
+// Any local caller may connect, as with a Unix socket at 0666; what a caller may
+// actually do is decided from its token, not from the DACL. Remote callers are not
+// a concern here: winio.ListenPipe creates the pipe with
+// FILE_PIPE_REJECT_REMOTE_CLIENTS, so NPFS rejects connections from other machines
+// before the descriptor is consulted.
+//
+// A deny ACE on the NETWORK SID would not add anything and would break callers:
+// that SID is present in any network-logon token, which includes OpenSSH and WinRM
+// sessions, so it denies administrators driving the CLI over SSH and denies the
+// daemon itself when started from such a session.
+func DefaultPipeSDDL() string {
+	return "D:P(A;;GA;;;SY)(A;;GA;;;WD)"
+}
+
+// NewTransportCredentials returns gRPC transport credentials that derive the
+// caller's identity from the named-pipe client token.
+//
+// The client must connect at SECURITY_IDENTIFICATION for the daemon to be able
+// to read its token, which is what DialNamedPipe does.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return winpipeCreds{}
+}
+
+// ConnIdentity extracts the caller's identity from an accepted named-pipe
+// connection by impersonating the pipe client and reading its token. It is
+// shared by the gRPC transport credentials and by the JSON gateway, which
+// reads the identity of its own HTTP clients.
+func ConnIdentity(conn net.Conn) (Identity, error) {
+	// go-winio's pipe connection embeds *win32File, which exposes Fd().
+	fdConn, ok := conn.(interface{ Fd() uintptr })
+	if !ok {
+		return Identity{}, fmt.Errorf("connection %T does not expose a pipe handle", conn)
+	}
+	return pipeClientIdentity(windows.Handle(fdConn.Fd()))
+}
+
+type winpipeCreds struct{}
+
+func (winpipeCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, AuthInfo{}, nil
+}
+
+// ServerHandshake extracts the connecting client's identity and fails closed
+// when the handle or token cannot be read, so a connection whose caller is
+// unknown never reaches a handler.
+func (winpipeCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	id, err := ConnIdentity(conn)
+	if err != nil {
+		return nil, nil, err
+	}
+	return conn, AuthInfo{
+		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+		Identity:       id,
+	}, nil
+}
+
+func (winpipeCreds) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: AuthInfo{}.AuthType()}
+}
+
+func (winpipeCreds) Clone() credentials.TransportCredentials { return winpipeCreds{} }
+
+func (winpipeCreds) OverrideServerName(string) error { return nil }
+
+// pipeClientIdentity reads the connecting client's user SID, usable group
+// SIDs, and elevation state by impersonating the pipe client on this thread
+// and reading the resulting impersonation token.
+func pipeClientIdentity(handle windows.Handle) (id Identity, err error) {
+	// Impersonation is per-thread, so the goroutine must stay on this thread
+	// until RevertToSelf, otherwise an unrelated goroutine could inherit the
+	// impersonated context.
+	runtime.LockOSThread()
+
+	// The thread only goes back to the runtime's pool once it is provably no
+	// longer impersonating the client. If the revert fails, leaving it locked
+	// makes Go terminate it when this goroutine exits, which costs one thread
+	// and keeps a thread running as the client from ever being reused.
+	clean := false
+	defer func() {
+		if clean {
+			runtime.UnlockOSThread()
+		}
+	}()
+
+	if err = impersonateNamedPipeClient(handle); err != nil {
+		clean = true
+		return Identity{}, fmt.Errorf("impersonate named pipe client: %w", err)
+	}
+	defer func() {
+		// Surface the revert failure only when nothing else failed: leaving
+		// the thread impersonated is worse than the original error.
+		revErr := windows.RevertToSelf()
+		if revErr != nil {
+			if err == nil {
+				err = fmt.Errorf("revert impersonation: %w", revErr)
+			}
+			return
+		}
+		clean = true
+	}()
+
+	// openAsSelf=true opens the token with the daemon's own process context
+	// rather than the impersonated client's, so the open cannot fail because
+	// the client lacks access to its own token.
+	var token windows.Token
+	if err = windows.OpenThreadToken(windows.CurrentThread(), windows.TOKEN_QUERY, true, &token); err != nil {
+		return Identity{}, fmt.Errorf("open thread token: %w", err)
+	}
+	defer func() {
+		if cerr := token.Close(); cerr != nil {
+			log.Debugf("close client token: %v", cerr)
+		}
+	}()
+
+	return identityFromToken(token)
+}
+
+// identityFromToken reads the user SID, usable group SIDs and elevation state
+// out of a Windows token.
+func identityFromToken(token windows.Token) (Identity, error) {
+	user, err := token.GetTokenUser()
+	if err != nil {
+		return Identity{}, fmt.Errorf("read token user: %w", err)
+	}
+
+	groups, err := tokenGroupSIDs(token)
+	if err != nil {
+		return Identity{}, err
+	}
+
+	return Identity{
+		SID:      user.User.Sid.String(),
+		Groups:   groups,
+		Elevated: token.IsElevated(),
+	}, nil
+}
+
+// tokenGroupSIDs returns the SIDs of the groups the token can actually
+// exercise. Groups that are disabled or marked deny-only are skipped: a
+// UAC-filtered administrator carries BUILTIN\Administrators as deny-only, and
+// treating that as membership would hand every admin account privilege it
+// cannot currently use.
+func tokenGroupSIDs(token windows.Token) ([]string, error) {
+	tg, err := token.GetTokenGroups()
+	if err != nil {
+		return nil, fmt.Errorf("read token groups: %w", err)
+	}
+
+	var sids []string
+	for _, g := range tg.AllGroups() {
+		if g.Attributes&windows.SE_GROUP_ENABLED == 0 {
+			continue
+		}
+		if g.Attributes&windows.SE_GROUP_USE_FOR_DENY_ONLY != 0 {
+			continue
+		}
+		sids = append(sids, g.Sid.String())
+	}
+	return sids, nil
+}
+
+func impersonateNamedPipeClient(h windows.Handle) error {
+	r, _, e := procImpersonateNamedPipeClient.Call(uintptr(h))
+	if r == 0 {
+		return e
+	}
+	return nil
+}
diff --git a/client/internal/ipcauth/forward.go b/client/internal/ipcauth/forward.go
new file mode 100644
index 000000000..57749528c
--- /dev/null
+++ b/client/internal/ipcauth/forward.go
@@ -0,0 +1,272 @@
+package ipcauth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+
+	"google.golang.org/grpc/metadata"
+)
+
+// Metadata keys the local JSON gateway uses to forward the identity of its own
+// HTTP client to the daemon. The gateway runs inside the daemon process and
+// re-dials the daemon over the control socket, so without forwarding every
+// JSON request would appear to come from the daemon itself.
+const (
+	// mdFwd marks a request as forwarded by the JSON gateway. It is always
+	// set, even when the gateway could not read its client's identity, so the
+	// daemon can tell "no identity available" apart from "not forwarded".
+	mdFwd         = "x-netbird-fwd"
+	mdFwdUID      = "x-netbird-fwd-uid"      // Unix user ID
+	mdFwdGID      = "x-netbird-fwd-gid"      // Unix primary group ID
+	mdFwdSID      = "x-netbird-fwd-sid"      // Windows user SID
+	mdFwdGroup    = "x-netbird-fwd-group"    // Windows group SID, repeated
+	mdFwdElevated = "x-netbird-fwd-elevated" // Windows, "1" when elevated
+
+	// mdFwdProof proves the forwarded identity was stamped by this process. The
+	// gateway runs inside the daemon, so a secret held in memory is available to
+	// the only legitimate producer and to nothing else.
+	mdFwdProof = "x-netbird-fwd-proof"
+)
+
+// forwardKeys is every metadata key the gateway sets. An HTTP client must never
+// be able to supply one itself: see IsReservedForwardKey.
+var forwardKeys = []string{mdFwd, mdFwdUID, mdFwdGID, mdFwdSID, mdFwdGroup, mdFwdElevated, mdFwdProof}
+
+// forwardProof authenticates the gateway's forwarding metadata. It is generated
+// once per daemon process and never leaves it: it is not written to disk, not
+// logged, and not sent anywhere except over the daemon's own control socket to
+// itself.
+//
+// Without it, trusting a forwarded identity rests on every layer in front of it
+// stripping incoming forwarding keys, and on each key's value shape being
+// distinguishable from an injected one. A single injected group SID or an
+// injected "elevated" flag has the same shape as a legitimate one, so no
+// cardinality rule can catch it. Requiring the proof means metadata that did not
+// come from this process is refused whatever it contains.
+var forwardProof = mustForwardProof()
+
+func mustForwardProof() string {
+	var buf [32]byte
+	if _, err := rand.Read(buf[:]); err != nil {
+		// Continuing would leave the forwarded path authenticated by a
+		// predictable value, which is worse than not starting.
+		panic(fmt.Sprintf("generate identity forwarding proof: %v", err))
+	}
+	return hex.EncodeToString(buf[:])
+}
+
+// IsReservedForwardKey reports whether a gRPC metadata key belongs to the
+// gateway's identity forwarding, and therefore must be dropped when it arrives
+// from outside.
+//
+// grpc-gateway maps "Grpc-Metadata-<key>" request headers into gRPC metadata and
+// joins them ahead of the values its own annotators add. Without dropping these,
+// an HTTP client could hand the daemon "x-netbird-fwd-uid: 0" and be believed,
+// because the daemon trusts forwarded metadata when the transport peer is the
+// (privileged) gateway.
+func IsReservedForwardKey(key string) bool {
+	key = strings.ToLower(key)
+	return slices.Contains(forwardKeys, key)
+}
+
+// ForwardIdentityMetadata encodes an HTTP client's identity for the JSON
+// gateway to forward to the daemon. When known is false only the marker is
+// set, which makes the daemon treat the caller as unidentified rather than as
+// the daemon itself.
+func ForwardIdentityMetadata(id Identity, known bool) metadata.MD {
+	md := metadata.MD{}
+	md.Set(mdFwd, "1")
+	md.Set(mdFwdProof, forwardProof)
+	if !known {
+		return md
+	}
+
+	if id.IsWindows() {
+		md.Set(mdFwdSID, id.SID)
+		if len(id.Groups) > 0 {
+			md.Set(mdFwdGroup, id.Groups...)
+		}
+		if id.Elevated {
+			md.Set(mdFwdElevated, "1")
+		}
+		return md
+	}
+
+	md.Set(mdFwdUID, strconv.FormatUint(uint64(id.UID), 10))
+	md.Set(mdFwdGID, strconv.FormatUint(uint64(id.GID), 10))
+	return md
+}
+
+// CallerIdentity returns the identity to authorize a request against. For a
+// direct connection that is the transport peer's kernel identity. For a
+// request relayed by the local JSON gateway it is the identity the gateway
+// forwarded, since the transport peer is then the daemon itself.
+//
+// A forwarded identity is only honoured when the transport peer is the daemon's
+// own identity and the metadata carries this process's forwarding proof, so
+// forged forwarding metadata gains a caller nothing. A forwarded request that
+// carries no identity is reported as unidentified, never as the daemon.
+//
+// The second return value is false when no identity could be established, and
+// callers MUST fail closed in that case.
+func CallerIdentity(ctx context.Context) (Identity, bool) {
+	id, ok := IdentityFromContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+
+	// A forwarding key that arrives more than once did not come from the gateway
+	// alone, so nothing about the request can be trusted to describe its caller.
+	// Refusing outright matters because the alternative reading, "not forwarded",
+	// would authorize the request as the transport peer, which on the gateway's
+	// connection is the daemon itself.
+	if duplicatedForwardKey(ctx) {
+		return Identity{}, false
+	}
+
+	forwarded := isForwarded(ctx)
+
+	// Our own process on the other end of the socket is the JSON gateway, the only
+	// thing that dials the daemon from inside it. Such a call must carry a
+	// forwarded identity; without one there is no caller to authorize, and
+	// treating it as the daemon would authorize whatever reached the JSON socket.
+	// Only Linux reports the peer PID, so this is a belt on top of the gateway's
+	// interceptor rather than the sole guarantee.
+	if id.PID != 0 && int(id.PID) == selfPID && !forwarded {
+		return Identity{}, false
+	}
+
+	// Only the gateway's own connection may speak for someone else. Being
+	// privileged is not enough and not the point: the gateway runs inside the
+	// daemon, so it dials as the daemon's identity whatever user that is, which
+	// also covers a rootless container.
+	if !forwarded || !IsDaemonSelf(id) {
+		return id, true
+	}
+
+	// Speaking for someone else additionally requires the proof only this process
+	// holds. Refusing is the only safe reading: the transport peer here is the
+	// daemon itself, so falling back to it would authorize the request as the
+	// daemon. This is also what makes the forwarded values trustworthy once
+	// accepted, so they need no shape checks of their own.
+	if !authenticForward(ctx) {
+		return Identity{}, false
+	}
+
+	return forwardedIdentity(ctx)
+}
+
+// duplicatedForwardKey reports whether any forwarding key carries more than one
+// value. The gateway's interceptor sets each key exactly once and replaces what
+// was already there, so a repeat means a second source supplied it.
+func duplicatedForwardKey(ctx context.Context) bool {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return false
+	}
+	for _, key := range forwardKeys {
+		// Group SIDs are legitimately repeated; the rest identify the caller.
+		if key == mdFwdGroup {
+			continue
+		}
+		if len(md.Get(key)) > 1 {
+			return true
+		}
+	}
+	return false
+}
+
+// authenticForward reports whether the request carries this process's forwarding
+// proof, which only the in-process JSON gateway can supply.
+func authenticForward(ctx context.Context) bool {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return false
+	}
+	got := mdSingle(md, mdFwdProof)
+	return subtle.ConstantTimeCompare([]byte(got), []byte(forwardProof)) == 1
+}
+
+// isForwarded reports whether the request carries the JSON gateway marker.
+func isForwarded(ctx context.Context) bool {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return false
+	}
+	return mdSingle(md, mdFwd) != ""
+}
+
+// forwardedIdentity decodes the identity the JSON gateway attached.
+func forwardedIdentity(ctx context.Context) (Identity, bool) {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+
+	if sid := mdSingle(md, mdFwdSID); sid != "" {
+		return Identity{
+			SID: sid,
+			// Repeated by design, one value per group, and only reachable once
+			// the forwarding proof has been verified.
+			Groups:   md.Get(mdFwdGroup),
+			Elevated: mdSingle(md, mdFwdElevated) == "1",
+		}, true
+	}
+
+	uid, err := strconv.ParseUint(mdSingle(md, mdFwdUID), 10, 32)
+	if err != nil {
+		return Identity{}, false
+	}
+
+	id := Identity{UID: uint32(uid)}
+	if gid, err := strconv.ParseUint(mdSingle(md, mdFwdGID), 10, 32); err == nil {
+		id.GID = uint32(gid)
+	}
+	return id, true
+}
+
+// mdSingle returns the value of a forwarded key only when exactly one was
+// supplied. The gateway's interceptor sets each key exactly once, so more than one
+// value means something else also supplied it, and the whole identity is treated as
+// unknown rather than picking a winner. Defence in depth behind the gateway's
+// header filter.
+func mdSingle(md metadata.MD, key string) string {
+	if v := md.Get(key); len(v) == 1 {
+		return v[0]
+	}
+	return ""
+}
+
+// WithForwardedIdentity stamps id onto a context's outgoing metadata for the JSON
+// gateway's call to the daemon, replacing any forwarding keys already present so
+// values supplied from outside cannot survive alongside it.
+//
+// This is deliberately not done with runtime.WithMetadata: grpc-gateway skips its
+// annotators entirely when no request header maps to metadata ("if len(pairs) == 0
+// { return ctx, nil, nil }", runtime/context.go), which an HTTP/1.0 request with no
+// Host header over a unix socket achieves. The daemon would then see an unmarked
+// call whose transport peer is the daemon's own identity, and authorize it as the
+// daemon. A client interceptor runs for every RPC regardless of headers.
+func WithForwardedIdentity(ctx context.Context, id Identity, known bool) context.Context {
+	md, ok := metadata.FromOutgoingContext(ctx)
+	if !ok {
+		md = metadata.MD{}
+	} else {
+		md = md.Copy()
+	}
+
+	for _, key := range forwardKeys {
+		delete(md, key)
+	}
+	for key, values := range ForwardIdentityMetadata(id, known) {
+		md[key] = values
+	}
+
+	return metadata.NewOutgoingContext(ctx, md)
+}
diff --git a/client/internal/ipcauth/forward_test.go b/client/internal/ipcauth/forward_test.go
new file mode 100644
index 000000000..d80c293be
--- /dev/null
+++ b/client/internal/ipcauth/forward_test.go
@@ -0,0 +1,214 @@
+package ipcauth
+
+import (
+	"context"
+	"testing"
+
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+)
+
+// transportCtx builds a request context as the daemon's transport credentials
+// would: the identity of whoever opened the socket, plus whatever metadata the
+// request carried.
+func transportCtx(id Identity, md metadata.MD) context.Context {
+	ctx := peer.NewContext(context.Background(), &peer.Peer{
+		AuthInfo: AuthInfo{
+			CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+			Identity:       id,
+		},
+	})
+	if md != nil {
+		ctx = metadata.NewIncomingContext(ctx, md)
+	}
+	return ctx
+}
+
+var (
+	root       = Identity{UID: 0}
+	unprivUser = Identity{UID: 1000, GID: 1000}
+)
+
+// asDaemon pins which identity counts as this process for the duration of a test.
+// Without it the test binary's own uid decides, which silently changes what
+// "the gateway" means.
+func asDaemon(t *testing.T, id Identity) {
+	t.Helper()
+	prevID, prevKnown, prevDelegate := selfIdentity, selfKnown, selfMayDelegate
+	t.Cleanup(func() { selfIdentity, selfKnown, selfMayDelegate = prevID, prevKnown, prevDelegate })
+	selfIdentity, selfKnown = id, true
+	selfMayDelegate = mayDelegate(id)
+}
+
+func TestCallerIdentity_DirectConnections(t *testing.T) {
+	t.Run("no transport credentials is not an identity", func(t *testing.T) {
+		if _, ok := CallerIdentity(context.Background()); ok {
+			t.Fatal("a caller with no credentials must not be identified")
+		}
+	})
+
+	t.Run("a direct caller is its transport identity", func(t *testing.T) {
+		id, ok := CallerIdentity(transportCtx(unprivUser, nil))
+		if !ok || id.UID != 1000 {
+			t.Fatalf("got %v ok=%t, want uid 1000", id, ok)
+		}
+	})
+
+	// The whole point of honouring forwarded metadata only from a privileged
+	// transport peer: an unprivileged caller can set any metadata it likes on its
+	// own connection to the daemon socket.
+	t.Run("an unprivileged caller cannot forge an identity", func(t *testing.T) {
+		asDaemon(t, root)
+		forged := metadata.Pairs(mdFwd, "1", mdFwdUID, "0", mdFwdGID, "0")
+		id, ok := CallerIdentity(transportCtx(unprivUser, forged))
+		if !ok {
+			t.Fatal("caller should still be identified, as itself")
+		}
+		if id.IsPrivileged() || id.UID != 1000 {
+			t.Fatalf("forged metadata was believed: got %v", id)
+		}
+	})
+}
+
+func TestCallerIdentity_GatewayForwarding(t *testing.T) {
+	t.Run("the gateway's client identity is used, not the gateway's own", func(t *testing.T) {
+		asDaemon(t, root)
+		md := ForwardIdentityMetadata(unprivUser, true)
+		id, ok := CallerIdentity(transportCtx(root, md))
+		if !ok {
+			t.Fatal("forwarded identity should be usable")
+		}
+		if id.IsPrivileged() || id.UID != 1000 {
+			t.Fatalf("got %v, want the forwarded uid 1000 and not privileged", id)
+		}
+	})
+
+	t.Run("a privileged gateway client stays privileged", func(t *testing.T) {
+		asDaemon(t, root)
+		md := ForwardIdentityMetadata(root, true)
+		id, ok := CallerIdentity(transportCtx(root, md))
+		if !ok || !id.IsPrivileged() {
+			t.Fatalf("got %v ok=%t, want a privileged identity", id, ok)
+		}
+	})
+
+	// A JSON socket the gateway cannot read peer credentials from (a TCP socket,
+	// say) must not make every request look like the daemon itself.
+	t.Run("an unreadable client identity is unknown, not the daemon", func(t *testing.T) {
+		asDaemon(t, root)
+		md := ForwardIdentityMetadata(Identity{}, false)
+		if _, ok := CallerIdentity(transportCtx(root, md)); ok {
+			t.Fatal("a forwarded request with no identity must not be identified")
+		}
+	})
+
+	// grpc-gateway turns Grpc-Metadata-<key> headers into gRPC metadata and joins
+	// them ahead of its annotators' values. If an HTTP client's header survived
+	// that, this is the shape the daemon would see: the attacker's uid 0 first,
+	// the real uid second. The gateway filters those headers out, and reading a
+	// duplicated key as unknown makes the daemon safe even if it did not.
+	t.Run("a duplicated key from an injected header is not believed", func(t *testing.T) {
+		asDaemon(t, root)
+		md := metadata.MD{}
+		md.Append(mdFwd, "1")
+		md.Append(mdFwdUID, "0")    // injected by the HTTP client
+		md.Append(mdFwdUID, "1000") // appended by the gateway's annotator
+		if id, ok := CallerIdentity(transportCtx(root, md)); ok {
+			t.Fatalf("injected uid was accepted: got %v", id)
+		}
+	})
+
+	t.Run("a duplicated marker is not believed either", func(t *testing.T) {
+		asDaemon(t, root)
+		md := metadata.MD{}
+		md.Append(mdFwd, "1")
+		md.Append(mdFwd, "1")
+		md.Append(mdFwdUID, "1000")
+		// A repeated marker must not be read as "not forwarded": that would
+		// authorize the request as the transport peer, which on the gateway's
+		// connection is the daemon itself.
+		if id, ok := CallerIdentity(transportCtx(root, md)); ok {
+			t.Fatalf("a duplicated marker was believed: got %v", id)
+		}
+	})
+
+	// The layers in front of this (the gateway's header matcher, and its
+	// interceptor replacing every forwarding key) are what keep outside metadata
+	// from arriving at all. The proof is what the daemon can check for itself, and
+	// it is the only defence that works for a value whose legitimate shape is
+	// indistinguishable from an injected one: a lone group SID, or "elevated".
+	t.Run("forwarding metadata without this process's proof is refused", func(t *testing.T) {
+		asDaemon(t, root)
+		for name, md := range map[string]metadata.MD{
+			"no proof":    metadata.Pairs(mdFwd, "1", mdFwdUID, "0"),
+			"wrong proof": metadata.Pairs(mdFwd, "1", mdFwdUID, "0", mdFwdProof, "deadbeef"),
+			"windows identity without a proof": metadata.Pairs(mdFwd, "1",
+				mdFwdSID, "S-1-5-21-1-2-3-1001", mdFwdGroup, sidAdministrators, mdFwdElevated, "1"),
+		} {
+			t.Run(name, func(t *testing.T) {
+				if id, ok := CallerIdentity(transportCtx(root, md)); ok {
+					t.Fatalf("unstamped forwarding metadata was believed: got %v", id)
+				}
+			})
+		}
+	})
+
+	// A caller that reaches the gateway cannot see the proof, so it cannot append
+	// a group of its own to a genuine forwarded identity: doing so would have to
+	// go through the interceptor, which replaces the whole set.
+	t.Run("a group appended to a stamped identity does not survive the interceptor", func(t *testing.T) {
+		asDaemon(t, root)
+		injected := metadata.MD{}
+		injected.Append(mdFwdGroup, sidAdministrators)
+
+		ctx := WithForwardedIdentity(metadata.NewOutgoingContext(context.Background(), injected),
+			Identity{SID: "S-1-5-21-1-2-3-1001"}, true)
+		out, ok := metadata.FromOutgoingContext(ctx)
+		if !ok {
+			t.Fatal("no outgoing metadata")
+		}
+		if groups := out.Get(mdFwdGroup); len(groups) != 0 {
+			t.Fatalf("injected group survived: %v", groups)
+		}
+	})
+}
+
+func TestIsReservedForwardKey(t *testing.T) {
+	for _, key := range forwardKeys {
+		if !IsReservedForwardKey(key) {
+			t.Errorf("%q must be reserved", key)
+		}
+	}
+
+	// grpc-gateway canonicalises header names, so the check has to be
+	// case-insensitive.
+	if !IsReservedForwardKey("X-Netbird-Fwd-Uid") {
+		t.Error("the check must be case-insensitive")
+	}
+
+	for _, key := range []string{"authorization", "x-netbird", "x-netbird-fwd-uid-extra", ""} {
+		if IsReservedForwardKey(key) {
+			t.Errorf("%q must not be reserved", key)
+		}
+	}
+}
+
+func TestForwardIdentityMetadata_AlwaysMarksForwarded(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		id    Identity
+		known bool
+	}{
+		{"known unix identity", unprivUser, true},
+		{"unknown identity", Identity{}, false},
+		{"windows identity", Identity{SID: "S-1-5-21-1-2-3-1001", Elevated: true}, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			md := ForwardIdentityMetadata(tc.id, tc.known)
+			if got := md.Get(mdFwd); len(got) != 1 || got[0] != "1" {
+				t.Fatalf("marker = %v, want exactly one \"1\"", got)
+			}
+		})
+	}
+}
diff --git a/client/internal/ipcauth/identity.go b/client/internal/ipcauth/identity.go
new file mode 100644
index 000000000..255585821
--- /dev/null
+++ b/client/internal/ipcauth/identity.go
@@ -0,0 +1,140 @@
+// Package ipcauth provides the kernel-authenticated identity of a local IPC
+// (gRPC) caller and the transport credentials that surface it into the gRPC
+// context, so the daemon can authorize individual RPCs by caller identity.
+//
+// On Unix the identity is read from the kernel via SO_PEERCRED (Linux) or
+// LOCAL_PEERCRED (Darwin/FreeBSD). On Windows it is derived from the
+// named-pipe client token. Platforms without a peer-identity primitive get no
+// credentials, and every consumer must fail closed when no identity is
+// available.
+package ipcauth
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
+)
+
+// Well-known Windows SIDs. Only LocalSystem and BUILTIN\Administrators identify a
+// privileged principal; the service accounts are shared by unrelated services.
+const (
+	sidLocalSystem    = "S-1-5-18"     // NT AUTHORITY\SYSTEM
+	sidLocalService   = "S-1-5-19"     // NT AUTHORITY\LOCAL SERVICE
+	sidNetworkService = "S-1-5-20"     // NT AUTHORITY\NETWORK SERVICE
+	sidAdministrators = "S-1-5-32-544" // BUILTIN\Administrators
+)
+
+// Identity is the kernel-authenticated identity of a local IPC caller. The
+// zero value is not a valid identity: consumers must only use one obtained
+// with a true ok/nil error return.
+type Identity struct {
+	// UID and GID are the caller's Unix user ID and primary group ID. Both are
+	// zero on Windows, where SID is authoritative instead.
+	UID uint32
+	GID uint32
+
+	// SID is the caller's Windows security identifier, empty on Unix.
+	SID string
+
+	// Groups holds the caller's Windows group SIDs, captured from the client
+	// token at handshake time. Only groups that are enabled and not
+	// deny-only are captured, so a group listed here is one the caller can
+	// actually exercise. Empty on Unix.
+	Groups []string
+
+	// Elevated reports whether the Windows client token is elevated (running
+	// as administrator, or an administrator with UAC turned off). Always false
+	// on Unix, where privilege is uid 0.
+	Elevated bool
+
+	// PID is the caller's process ID where the platform reports it (Linux's
+	// SO_PEERCRED), and 0 where it does not. It identifies the daemon's own
+	// process dialling itself, which is what the JSON gateway does, and is never
+	// used to grant anything.
+	PID int32
+}
+
+// IsWindows reports whether this identity is a Windows principal (SID-based)
+// rather than a Unix uid/gid principal.
+func (i Identity) IsWindows() bool {
+	return i.SID != ""
+}
+
+// IsPrivileged reports whether the caller is the platform's administrative
+// principal, which is what the daemon requires for changes that cross the
+// user-to-root boundary.
+//
+// On Windows the decision comes from the caller's token rather than from
+// account names or group RIDs: an elevated token, the LocalSystem SID, or a
+// token with BUILTIN\Administrators enabled. LocalService and NetworkService
+// are not privileged by SID. A UAC-filtered administrator has that group marked deny-only, and
+// deny-only groups are dropped when the identity is captured, so such a
+// caller is correctly reported as unprivileged. Domain group memberships
+// (Domain Admins and friends) are deliberately not consulted: they say
+// nothing about what this token may do on this machine.
+func (i Identity) IsPrivileged() bool {
+	if !i.IsWindows() {
+		return i.UID == 0
+	}
+
+	if i.Elevated {
+		return true
+	}
+
+	if i.SID == sidLocalSystem {
+		return true
+	}
+
+	return slices.Contains(i.Groups, sidAdministrators)
+}
+
+// SameUser reports whether two identities are the same local principal. Only
+// the account is compared: the group set and the elevation flag describe what a
+// token may do, not who it belongs to. A SID on either side decides the
+// comparison, so a Windows principal never matches a Unix one on the UID both
+// happen to leave at zero. The zero Identity carries uid 0, so callers must
+// establish that both identities are real before the answer means anything.
+func (i Identity) SameUser(other Identity) bool {
+	if i.SID != "" || other.SID != "" {
+		return i.SID == other.SID
+	}
+	return i.UID == other.UID
+}
+
+// String renders the identity for audit logs and denial messages.
+func (i Identity) String() string {
+	if i.IsWindows() {
+		return fmt.Sprintf("sid=%s elevated=%t", i.SID, i.Elevated)
+	}
+	return fmt.Sprintf("uid=%d gid=%d", i.UID, i.GID)
+}
+
+// AuthInfo carries the peer Identity as a gRPC credentials.AuthInfo so
+// handlers can retrieve it from the request context via IdentityFromContext.
+type AuthInfo struct {
+	credentials.CommonAuthInfo
+	Identity Identity
+}
+
+// AuthType identifies the authentication scheme.
+func (AuthInfo) AuthType() string { return "netbird-ipc-peercred" }
+
+// IdentityFromContext extracts the caller's kernel-authenticated identity from
+// the gRPC peer context. The second return value is false when no IPC
+// transport credentials were negotiated, which happens on a TCP daemon socket
+// and on platforms without a peer-identity primitive. Callers MUST fail closed
+// in that case.
+func IdentityFromContext(ctx context.Context) (Identity, bool) {
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+	info, ok := p.AuthInfo.(AuthInfo)
+	if !ok {
+		return Identity{}, false
+	}
+	return info.Identity, true
+}
diff --git a/client/internal/ipcauth/identity_test.go b/client/internal/ipcauth/identity_test.go
new file mode 100644
index 000000000..57be1b94e
--- /dev/null
+++ b/client/internal/ipcauth/identity_test.go
@@ -0,0 +1,121 @@
+package ipcauth
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIdentitySameUser(t *testing.T) {
+	tests := []struct {
+		name string
+		a    Identity
+		b    Identity
+		want bool
+	}{
+		{
+			name: "same uid",
+			a:    Identity{UID: 1000, GID: 1000},
+			b:    Identity{UID: 1000, GID: 1000},
+			want: true,
+		},
+		{
+			name: "same uid, different gid and pid still the same user",
+			a:    Identity{UID: 1000, GID: 1000, PID: 11},
+			b:    Identity{UID: 1000, GID: 27, PID: 22},
+			want: true,
+		},
+		{
+			name: "different uid",
+			a:    Identity{UID: 1000},
+			b:    Identity{UID: 1001},
+			want: false,
+		},
+		{
+			name: "same sid",
+			a:    Identity{SID: "S-1-5-21-1-2-3-1001"},
+			b:    Identity{SID: "S-1-5-21-1-2-3-1001"},
+			want: true,
+		},
+		{
+			name: "same sid, elevation and groups differ",
+			a:    Identity{SID: "S-1-5-21-1-2-3-1001", Elevated: true, Groups: []string{sidAdministrators}},
+			b:    Identity{SID: "S-1-5-21-1-2-3-1001"},
+			want: true,
+		},
+		{
+			name: "different sid",
+			a:    Identity{SID: "S-1-5-21-1-2-3-1001"},
+			b:    Identity{SID: "S-1-5-21-1-2-3-1002"},
+			want: false,
+		},
+		{
+			name: "a windows principal is never a unix one",
+			a:    Identity{SID: "S-1-5-18"},
+			b:    Identity{UID: 0},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.a.SameUser(tt.b))
+			assert.Equal(t, tt.want, tt.b.SameUser(tt.a), "SameUser must be symmetric")
+		})
+	}
+}
+
+func TestIdentityIsPrivileged(t *testing.T) {
+	tests := []struct {
+		name string
+		id   Identity
+		want bool
+	}{
+		{
+			name: "Root",
+			id:   Identity{UID: 0, GID: 0},
+			want: true,
+		},
+		{
+			name: "Non-root",
+			id:   Identity{UID: 1000, GID: 1000},
+			want: false,
+		},
+		{
+			name: "Local system windows",
+			id:   Identity{SID: sidLocalSystem},
+			want: true,
+		},
+		{
+			name: "Windows elevated",
+			id:   Identity{SID: "S-1-5-21-1927267129-3959769253-3036563910-1001", Elevated: true},
+			want: true,
+		},
+		{
+			name: "Admin group windows",
+			id:   Identity{SID: "S-1-5-21-1927267129-3959769253-3036563910-1001", Groups: []string{sidAdministrators}},
+			want: true,
+		},
+		{
+			name: "Regular user windows",
+			id:   Identity{SID: "S-1-5-21-1927267129-3959769253-3036563910-1001"},
+			want: false,
+		},
+		{
+			name: "Network service windows",
+			id:   Identity{SID: sidNetworkService},
+			want: false,
+		},
+		{
+			name: "Local service windows",
+			id:   Identity{SID: sidLocalService},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.id.IsPrivileged())
+		})
+	}
+}
diff --git a/client/internal/ipcauth/ownedfile.go b/client/internal/ipcauth/ownedfile.go
new file mode 100644
index 000000000..be7bf4864
--- /dev/null
+++ b/client/internal/ipcauth/ownedfile.go
@@ -0,0 +1,63 @@
+package ipcauth
+
+import (
+	"fmt"
+	"os"
+)
+
+// OpenOwnedFile opens path for reading on behalf of the IPC caller identified by
+// id, and fails unless the opened file is a regular file that id owns.
+//
+// It exists for the paths a local caller hands to the daemon over the IPC. The
+// daemon runs as root, so opening such a path unchecked lets any local user read
+// any file through it. Ownership is the invariant that keeps the daemon from
+// reading, with its own privileges, a file the caller could not read itself: a
+// symlink or hard link planted at the path resolves to a file someone else owns
+// and is refused.
+//
+// The check is made against the open descriptor rather than the path, so
+// swapping the path between the check and the read cannot change the answer.
+//
+// A privileged caller is exempt: it can read the file directly, so refusing it
+// here would protect nothing. The regular-file requirement still applies to
+// everyone, since a fifo or device planted at the path is never a log file.
+func OpenOwnedFile(id Identity, path string) (*os.File, error) {
+	f, err := openForRead(path)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := checkOwnership(id, f); err != nil {
+		if cerr := f.Close(); cerr != nil {
+			return nil, fmt.Errorf("%w (close: %v)", err, cerr)
+		}
+		return nil, err
+	}
+
+	return f, nil
+}
+
+func checkOwnership(id Identity, f *os.File) error {
+	info, err := f.Stat()
+	if err != nil {
+		return fmt.Errorf("stat %s: %w", f.Name(), err)
+	}
+
+	if !info.Mode().IsRegular() {
+		return fmt.Errorf("%s is not a regular file", f.Name())
+	}
+
+	if IsPrivilegedCaller(id) {
+		return nil
+	}
+
+	owned, err := fileOwnedBy(id, f)
+	if err != nil {
+		return fmt.Errorf("read owner of %s: %w", f.Name(), err)
+	}
+	if !owned {
+		return fmt.Errorf("%s is not owned by the caller (%s)", f.Name(), id)
+	}
+
+	return nil
+}
diff --git a/client/internal/ipcauth/ownedfile_test.go b/client/internal/ipcauth/ownedfile_test.go
new file mode 100644
index 000000000..b8178ad45
--- /dev/null
+++ b/client/internal/ipcauth/ownedfile_test.go
@@ -0,0 +1,64 @@
+package ipcauth
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// otherIdentity is an unprivileged caller that owns nothing the test creates.
+func otherIdentity(t *testing.T) Identity {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		return Identity{SID: "S-1-5-21-1-2-3-1001"}
+	}
+	return Identity{UID: uint32(os.Geteuid() + 1), GID: uint32(os.Getegid() + 1)}
+}
+
+func TestOpenOwnedFileReadsFileOwnedByCaller(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "gui-client.log")
+	require.NoError(t, os.WriteFile(path, []byte("hello"), 0600))
+
+	id, err := CurrentProcessIdentity()
+	require.NoError(t, err)
+
+	f, err := OpenOwnedFile(id, path)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = f.Close() })
+
+	content, err := io.ReadAll(f)
+	require.NoError(t, err)
+	require.Equal(t, "hello", string(content))
+}
+
+func TestOpenOwnedFileRefusesFileOwnedByAnother(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "gui-client.log")
+	require.NoError(t, os.WriteFile(path, []byte("secret"), 0600))
+
+	_, err := OpenOwnedFile(otherIdentity(t), path)
+	require.ErrorContains(t, err, "not owned by the caller")
+}
+
+func TestOpenOwnedFileRefusesNonRegularFile(t *testing.T) {
+	dir := t.TempDir()
+
+	// The caller owns the directory, so this is the regular-file requirement
+	// talking, not the ownership check.
+	id, err := CurrentProcessIdentity()
+	require.NoError(t, err)
+
+	_, err = OpenOwnedFile(id, dir)
+	require.ErrorContains(t, err, "not a regular file")
+}
+
+func TestOpenOwnedFileRefusesMissingFile(t *testing.T) {
+	id, err := CurrentProcessIdentity()
+	require.NoError(t, err)
+
+	_, err = OpenOwnedFile(id, filepath.Join(t.TempDir(), "absent.log"))
+	require.Error(t, err)
+}
diff --git a/client/internal/ipcauth/ownedfile_unix.go b/client/internal/ipcauth/ownedfile_unix.go
new file mode 100644
index 000000000..4a6afcea7
--- /dev/null
+++ b/client/internal/ipcauth/ownedfile_unix.go
@@ -0,0 +1,35 @@
+//go:build !windows
+
+package ipcauth
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+)
+
+// openForRead opens a caller-supplied path without following a symlink at its
+// final component and without blocking: a fifo planted at the path would
+// otherwise stall the open until a writer appears, and the daemon holds a lock
+// while it collects the file.
+func openForRead(path string) (*os.File, error) {
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, fmt.Errorf("open %s: %w", path, err)
+	}
+	return f, nil
+}
+
+func fileOwnedBy(id Identity, f *os.File) (bool, error) {
+	info, err := f.Stat()
+	if err != nil {
+		return false, err
+	}
+
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return false, fmt.Errorf("no owner information in %T", info.Sys())
+	}
+
+	return stat.Uid == id.UID, nil
+}
diff --git a/client/internal/ipcauth/ownedfile_unix_test.go b/client/internal/ipcauth/ownedfile_unix_test.go
new file mode 100644
index 000000000..9e7831991
--- /dev/null
+++ b/client/internal/ipcauth/ownedfile_unix_test.go
@@ -0,0 +1,57 @@
+//go:build !windows
+
+package ipcauth
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// A symlink is the shape the arbitrary-read attempt takes: the caller owns the
+// link, the file it points at belongs to someone else.
+func TestOpenOwnedFileRefusesSymlink(t *testing.T) {
+	dir := t.TempDir()
+	target := filepath.Join(dir, "target.log")
+	require.NoError(t, os.WriteFile(target, []byte("secret"), 0600))
+
+	link := filepath.Join(dir, "gui-client.log")
+	require.NoError(t, os.Symlink(target, link))
+
+	id, err := CurrentProcessIdentity()
+	require.NoError(t, err)
+
+	_, err = OpenOwnedFile(id, link)
+	// O_NOFOLLOW on a symlink reports ELOOP on Linux/Darwin and EMLINK on FreeBSD.
+	if !errors.Is(err, syscall.ELOOP) && !errors.Is(err, syscall.EMLINK) {
+		t.Fatalf("symlink open: got %v, want ELOOP or EMLINK", err)
+	}
+}
+
+// A fifo would block the open until a writer showed up, stalling the daemon
+// while it holds its lock.
+func TestOpenOwnedFileRefusesFifoWithoutBlocking(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "gui-client.log")
+	require.NoError(t, syscall.Mkfifo(path, 0600))
+
+	id, err := CurrentProcessIdentity()
+	require.NoError(t, err)
+
+	done := make(chan error, 1)
+	go func() {
+		_, err := OpenOwnedFile(id, path)
+		done <- err
+	}()
+
+	select {
+	case err := <-done:
+		require.ErrorContains(t, err, "not a regular file")
+	case <-time.After(5 * time.Second):
+		t.Fatal("opening a fifo blocked")
+	}
+}
diff --git a/client/internal/ipcauth/ownedfile_windows.go b/client/internal/ipcauth/ownedfile_windows.go
new file mode 100644
index 000000000..19acaec4d
--- /dev/null
+++ b/client/internal/ipcauth/ownedfile_windows.go
@@ -0,0 +1,59 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/sys/windows"
+)
+
+// openForRead opens a caller-supplied path without following a reparse point at
+// it. FILE_FLAG_OPEN_REPARSE_POINT is the Windows analogue of O_NOFOLLOW: it
+// opens a symlink/junction itself rather than its target, so the regular-file
+// check in checkOwnership refuses a link the caller planted to redirect the
+// read. FILE_FLAG_BACKUP_SEMANTICS lets a directory open too (as os.Open does),
+// so a directory planted at the path is refused as non-regular rather than
+// erroring here. The share mode matches os.Open so a log being written stays
+// openable.
+func openForRead(path string) (*os.File, error) {
+	p, err := windows.UTF16PtrFromString(path)
+	if err != nil {
+		return nil, fmt.Errorf("convert path %s: %w", path, err)
+	}
+
+	handle, err := windows.CreateFile(
+		p,
+		windows.GENERIC_READ,
+		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+		nil,
+		windows.OPEN_EXISTING,
+		windows.FILE_FLAG_OPEN_REPARSE_POINT|windows.FILE_FLAG_BACKUP_SEMANTICS,
+		0,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("open %s: %w", path, err)
+	}
+
+	return os.NewFile(uintptr(handle), path), nil
+}
+
+// fileOwnedBy compares the file's owner SID with the caller's. Files an elevated
+// process creates are owned by BUILTIN\Administrators rather than by the user,
+// but such a caller is privileged and never reaches this check.
+func fileOwnedBy(id Identity, f *os.File) (bool, error) {
+	// x/sys/windows GetSecurityInfo frees the OS buffer itself and returns a
+	// Go-heap copy, so there is nothing to LocalFree here.
+	sd, err := windows.GetSecurityInfo(windows.Handle(f.Fd()), windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION)
+	if err != nil {
+		return false, fmt.Errorf("read security info: %w", err)
+	}
+
+	owner, _, err := sd.Owner()
+	if err != nil {
+		return false, fmt.Errorf("read owner: %w", err)
+	}
+
+	return id.SID != "" && owner.String() == id.SID, nil
+}
diff --git a/client/internal/ipcauth/ownedfile_windows_test.go b/client/internal/ipcauth/ownedfile_windows_test.go
new file mode 100644
index 000000000..ab68fdf39
--- /dev/null
+++ b/client/internal/ipcauth/ownedfile_windows_test.go
@@ -0,0 +1,78 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+// fileOwnerSID reads the owner SID of path the same way OpenOwnedFile does, so
+// the test can construct an Identity that matches (or deliberately does not).
+func fileOwnerSID(t *testing.T, path string) string {
+	t.Helper()
+	f, err := os.Open(path)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = f.Close() })
+
+	sd, err := windows.GetSecurityInfo(windows.Handle(f.Fd()), windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION)
+	require.NoError(t, err)
+	owner, _, err := sd.Owner()
+	require.NoError(t, err)
+	return owner.String()
+}
+
+// The allow branch of fileOwnedBy is the SID-equality path the legitimate GUI
+// flow depends on. Running elevated, a created file is owned by
+// BUILTIN\Administrators; an Identity carrying that SID with Elevated=false and
+// no groups is unprivileged by IsPrivileged (which reads the token, not the
+// SID's RID), so this exercises the real GetSecurityInfo equality rather than
+// the privileged-caller shortcut.
+func TestOpenOwnedFileWindowsOwnerMatchAllows(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "gui-client.log")
+	require.NoError(t, os.WriteFile(path, []byte("hello"), 0600))
+
+	ownerSID := fileOwnerSID(t, path)
+	id := Identity{SID: ownerSID}
+	require.False(t, id.IsPrivileged(), "identity built from the owner SID must be unprivileged for this to test the match path")
+
+	f, err := OpenOwnedFile(id, path)
+	require.NoError(t, err)
+	_ = f.Close()
+}
+
+func TestOpenOwnedFileWindowsOwnerMismatchRefuses(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "gui-client.log")
+	require.NoError(t, os.WriteFile(path, []byte("secret"), 0600))
+
+	other := Identity{SID: "S-1-5-21-9-9-9-9999"}
+	require.False(t, other.IsPrivileged())
+
+	_, err := OpenOwnedFile(other, path)
+	require.ErrorContains(t, err, "not owned by the caller")
+}
+
+// FILE_FLAG_OPEN_REPARSE_POINT must make OpenOwnedFile refuse a symlink the same
+// way O_NOFOLLOW does on Unix, so a planted link can't redirect the read to
+// another file. Creating a symlink needs a privilege the runner may lack, so the
+// test skips rather than fails when it can't.
+func TestOpenOwnedFileWindowsRefusesSymlink(t *testing.T) {
+	dir := t.TempDir()
+	target := filepath.Join(dir, "target.log")
+	require.NoError(t, os.WriteFile(target, []byte("secret"), 0600))
+
+	link := filepath.Join(dir, "gui-client.log")
+	if err := os.Symlink(target, link); err != nil {
+		t.Skipf("cannot create symlink (privilege not held?): %v", err)
+	}
+
+	id, err := CurrentProcessIdentity()
+	require.NoError(t, err)
+
+	_, err = OpenOwnedFile(id, link)
+	require.Error(t, err, "a symlink must be refused")
+}
diff --git a/client/internal/ipcauth/peercred_bsd.go b/client/internal/ipcauth/peercred_bsd.go
new file mode 100644
index 000000000..6d9c5247f
--- /dev/null
+++ b/client/internal/ipcauth/peercred_bsd.go
@@ -0,0 +1,43 @@
+//go:build darwin || freebsd
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// PeerIdentity reads the kernel-authenticated identity of the process on the
+// other end of a Unix socket via LOCAL_PEERCRED. The xucred is recorded by the
+// kernel at connect() time and carries the peer's uid and its group list, of
+// which the first entry is the primary group.
+func PeerIdentity(conn net.Conn) (Identity, error) {
+	uc, ok := conn.(*net.UnixConn)
+	if !ok {
+		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", conn)
+	}
+
+	raw, err := uc.SyscallConn()
+	if err != nil {
+		return Identity{}, fmt.Errorf("raw conn: %w", err)
+	}
+
+	var cred *unix.Xucred
+	var credErr error
+	if err := raw.Control(func(fd uintptr) {
+		cred, credErr = unix.GetsockoptXucred(int(fd), unix.SOL_LOCAL, unix.LOCAL_PEERCRED)
+	}); err != nil {
+		return Identity{}, fmt.Errorf("control raw conn: %w", err)
+	}
+	if credErr != nil {
+		return Identity{}, fmt.Errorf("read LOCAL_PEERCRED: %w", credErr)
+	}
+
+	id := Identity{UID: cred.Uid}
+	if cred.Ngroups > 0 {
+		id.GID = cred.Groups[0]
+	}
+	return id, nil
+}
diff --git a/client/internal/ipcauth/peercred_linux.go b/client/internal/ipcauth/peercred_linux.go
new file mode 100644
index 000000000..417cc1e00
--- /dev/null
+++ b/client/internal/ipcauth/peercred_linux.go
@@ -0,0 +1,39 @@
+//go:build linux
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// PeerIdentity reads the kernel-authenticated identity of the process on the
+// other end of a Unix socket via SO_PEERCRED. The credentials are recorded by
+// the kernel at connect() time and cannot be changed for the life of the
+// connection, so they are not spoofable by the caller.
+func PeerIdentity(conn net.Conn) (Identity, error) {
+	uc, ok := conn.(*net.UnixConn)
+	if !ok {
+		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", conn)
+	}
+
+	raw, err := uc.SyscallConn()
+	if err != nil {
+		return Identity{}, fmt.Errorf("raw conn: %w", err)
+	}
+
+	var cred *unix.Ucred
+	var credErr error
+	if err := raw.Control(func(fd uintptr) {
+		cred, credErr = unix.GetsockoptUcred(int(fd), unix.SOL_SOCKET, unix.SO_PEERCRED)
+	}); err != nil {
+		return Identity{}, fmt.Errorf("control raw conn: %w", err)
+	}
+	if credErr != nil {
+		return Identity{}, fmt.Errorf("read SO_PEERCRED: %w", credErr)
+	}
+
+	return Identity{UID: cred.Uid, GID: cred.Gid, PID: cred.Pid}, nil
+}
diff --git a/client/internal/ipcauth/pipeserver_windows.go b/client/internal/ipcauth/pipeserver_windows.go
new file mode 100644
index 000000000..7ba59d574
--- /dev/null
+++ b/client/internal/ipcauth/pipeserver_windows.go
@@ -0,0 +1,87 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+// PipeServerTrusted reports an error unless the pipe behind conn was created by a
+// principal this client may hand secrets to. Clients call it for a pipe whose name
+// carries no guarantee of its own, which is any name outside the
+// ProtectedPrefix\Administrators namespace: that namespace already restricts
+// creation to administrators and LocalSystem, while a plain name can be created by
+// any local user before the daemon gets there.
+//
+// The decision is made from the pipe object's owner, not from the serving process,
+// because a client cannot open a process running as another user at all, and the
+// legitimate case is precisely an unprivileged client talking to a privileged
+// daemon. Trusted owners are the service accounts, BUILTIN\Administrators, and
+// this client's own user, the last of which is the daemon a user runs themselves
+// as in netstack mode. A pipe owned by anyone else gets no setup key, pre-shared
+// key or SSO prompt out of this client.
+func PipeServerTrusted(conn net.Conn) error {
+	// go-winio's pipe connection embeds *win32File, which exposes Fd().
+	fdConn, ok := conn.(interface{ Fd() uintptr })
+	if !ok {
+		return fmt.Errorf("connection %T does not expose a pipe handle", conn)
+	}
+
+	owner, err := pipeOwnerSID(windows.Handle(fdConn.Fd()))
+	if err != nil {
+		return err
+	}
+
+	if !trustedPipeOwner(owner) {
+		return fmt.Errorf("pipe owned by %s, which is neither an administrator nor this user", owner)
+	}
+	return nil
+}
+
+// PipeOwnedBySelf reports whether the pipe behind conn was created by this very
+// user, which is how a client recognises a daemon running as itself. Ownership it
+// cannot read is reported as false.
+func PipeOwnedBySelf(conn net.Conn) bool {
+	fdConn, ok := conn.(interface{ Fd() uintptr })
+	if !ok {
+		return false
+	}
+
+	owner, err := pipeOwnerSID(windows.Handle(fdConn.Fd()))
+	if err != nil {
+		log.Debugf("read daemon pipe owner: %v", err)
+		return false
+	}
+	return selfKnown && selfIdentity.SID != "" && owner == selfIdentity.SID
+}
+
+// pipeOwnerSID reads the owner of the pipe object a client is connected to. The
+// handle was opened with GENERIC_READ, which includes READ_CONTROL, so no extra
+// access is needed.
+func pipeOwnerSID(handle windows.Handle) (string, error) {
+	sd, err := windows.GetSecurityInfo(handle, windows.SE_KERNEL_OBJECT, windows.OWNER_SECURITY_INFORMATION)
+	if err != nil {
+		return "", fmt.Errorf("read pipe security info: %w", err)
+	}
+
+	owner, _, err := sd.Owner()
+	if err != nil {
+		return "", fmt.Errorf("read pipe owner: %w", err)
+	}
+	return owner.String(), nil
+}
+
+// trustedPipeOwner reports whether a pipe's owner is a principal a client may
+// speak to. An elevated process's objects are owned by BUILTIN\Administrators by
+// default, an unelevated one's by the user, which is why both forms appear here.
+func trustedPipeOwner(owner string) bool {
+	switch owner {
+	case sidLocalSystem, sidLocalService, sidNetworkService, sidAdministrators:
+		return true
+	}
+	return selfKnown && selfIdentity.SID != "" && owner == selfIdentity.SID
+}
diff --git a/client/internal/ipcauth/privileged.go b/client/internal/ipcauth/privileged.go
new file mode 100644
index 000000000..54c66a5d2
--- /dev/null
+++ b/client/internal/ipcauth/privileged.go
@@ -0,0 +1,149 @@
+package ipcauth
+
+import (
+	"os"
+	"runtime"
+)
+
+// Fields of the ErrorInfo detail the daemon attaches to a PermissionDenied it
+// raises for an operation that requires root/administrator. Clients match on
+// Reason and Domain rather than on the message text, and render the summary and
+// command themselves so the user gets guidance instead of a gRPC error dump.
+const (
+	// ErrorReasonPrivilegeRequired identifies the detail.
+	ErrorReasonPrivilegeRequired = "PRIVILEGE_REQUIRED"
+	// ErrorDomain scopes the reason to the NetBird daemon.
+	ErrorDomain = "daemon.netbird.io"
+	// ErrorMetaSummary is the one-sentence explanation of what was refused.
+	ErrorMetaSummary = "summary"
+	// ErrorMetaCommand is the command that performs the same operation with the
+	// privileges it needs, ready to copy and run.
+	ErrorMetaCommand = "command"
+)
+
+// The identity of the process evaluating callers, captured once because it cannot
+// change. selfKnown is false when it could not be read, in which case nothing is
+// ever treated as this process. selfMayDelegate additionally requires this
+// process to be unprivileged: see IsPrivilegedCaller.
+var (
+	selfIdentity    Identity
+	selfKnown       bool
+	selfMayDelegate bool
+	// selfPID is this process's PID, used to recognise the daemon dialling itself.
+	selfPID = os.Getpid()
+)
+
+func init() {
+	id, err := CurrentProcessIdentity()
+	if err != nil {
+		return
+	}
+	selfIdentity, selfKnown = id, true
+	// Only an unprivileged daemon delegates its authority to its own identity.
+	// When it is root or LocalSystem, sharing its identity does not mean sharing
+	// its power: on Windows a filtered and a full token carry the same SID, so
+	// matching there would let a non-elevated shell of an administrator account
+	// act as an administrator, which is the boundary the token check exists to
+	// keep.
+	selfMayDelegate = mayDelegate(id)
+}
+
+// mayDelegate reports whether a daemon running as id may extend its authority to
+// callers sharing its identity. The shared service accounts are excluded: their
+// SID is held by unrelated services, so matching on it would grant them the
+// daemon's authority.
+func mayDelegate(id Identity) bool {
+	return !id.IsPrivileged() && id.SID != sidLocalService && id.SID != sidNetworkService
+}
+
+// IsDaemonSelf reports whether an identity is this very process. The JSON gateway
+// runs inside the daemon and re-dials it locally, so this is what distinguishes
+// the gateway from any other caller, whatever user the daemon runs as.
+func IsDaemonSelf(id Identity) bool {
+	if !selfKnown || id.IsWindows() != selfIdentity.IsWindows() {
+		return false
+	}
+	if id.IsWindows() {
+		return id.SID != "" && id.SID == selfIdentity.SID
+	}
+	return id.UID == selfIdentity.UID
+}
+
+// IsPrivilegedCaller reports whether an identity may make the changes the daemon
+// restricts to the platform administrator. This is the daemon's own rule and
+// cannot be evaluated by a client, which does not know what the daemon runs as.
+//
+// Beyond root/administrator it accepts a caller running as the daemon's own
+// identity when the daemon is itself unprivileged. That keeps a rootless container
+// working, where there is no uid 0 at all, and a Windows daemon in netstack mode,
+// which needs no administrator rights. In those setups a caller sharing the
+// daemon's identity can already rewrite the config files it reads and replace the
+// binary it runs, so refusing it a config change would protect nothing; and an
+// unprivileged daemon cannot hand out a root shell in the first place.
+func IsPrivilegedCaller(id Identity) bool {
+	if id.IsPrivileged() {
+		return true
+	}
+	return selfMayDelegate && IsDaemonSelf(id)
+}
+
+// SelfDelegatesTo returns the identity this process delegates its authority to,
+// and whether it delegates at all. Only an unprivileged daemon does: see
+// IsPrivilegedCaller. It exists so a refusal can name who may actually perform the
+// operation, because on such a host root is neither required nor necessarily
+// available.
+func SelfDelegatesTo() (Identity, bool) {
+	if !selfKnown || !selfMayDelegate {
+		return Identity{}, false
+	}
+	return selfIdentity, true
+}
+
+// The values PrivilegedActorKey returns.
+const (
+	ActorKeyAdministrator = "administrator"
+	ActorKeyRoot          = "root"
+)
+
+// PrivilegedActor names the principal a privileged operation requires, for use
+// in messages shown to the user.
+func PrivilegedActor() string {
+	if runtime.GOOS == "windows" {
+		return "administrator privileges"
+	}
+	return "root"
+}
+
+// PrivilegedActorKey identifies that principal without wording it, for a client
+// that writes its own message in the user's language. The words PrivilegedActor
+// returns are English, and a translated sentence cannot borrow them.
+func PrivilegedActorKey() string {
+	if runtime.GOOS == "windows" {
+		return ActorKeyAdministrator
+	}
+	return ActorKeyRoot
+}
+
+// ElevatedCommand renders a command so that running it grants the privileges the
+// operation needs. Windows has no in-line equivalent of sudo, so the command is
+// returned unchanged and the user is expected to run it from an elevated
+// terminal.
+func ElevatedCommand(command string) string {
+	if runtime.GOOS == "windows" {
+		return command
+	}
+	return "sudo " + command
+}
+
+// UpCommand renders an elevated `netbird up` with the given flags, preceded by a
+// `down`. The down is what makes the command work on a connected client: `netbird
+// up` prints "Already connected" and returns without applying any config flag, so
+// on its own the command would appear to do nothing. It is a no-op, exit 0, when
+// the client is not connected.
+//
+// ";" rather than "&&" so the line can be pasted into any of the shells a user
+// might have: PowerShell 5.1, still the default on Windows Server, rejects "&&"
+// as a syntax error.
+func UpCommand(flags string) string {
+	return ElevatedCommand("netbird down") + "; " + ElevatedCommand("netbird up "+flags)
+}
diff --git a/client/internal/ipcauth/privileged_test.go b/client/internal/ipcauth/privileged_test.go
new file mode 100644
index 000000000..a6bbcf44b
--- /dev/null
+++ b/client/internal/ipcauth/privileged_test.go
@@ -0,0 +1,159 @@
+package ipcauth
+
+import "testing"
+
+// The self rule is the one place privilege is granted to something other than the
+// platform administrator, so its two guards matter: it must apply only when the
+// daemon is itself unprivileged, and only to a caller with the daemon's identity.
+func TestIsPrivilegedCaller_SelfRule(t *testing.T) {
+	tests := []struct {
+		name string
+		// self stands in for the process the daemon runs as.
+		self      Identity
+		selfKnown bool
+		caller    Identity
+		want      bool
+	}{
+		{
+			name:      "root is privileged whatever the daemon runs as",
+			self:      Identity{UID: 1000},
+			selfKnown: true,
+			caller:    Identity{UID: 0},
+			want:      true,
+		},
+		{
+			name:      "an unprivileged daemon delegates to its own user (rootless container)",
+			self:      Identity{UID: 1000},
+			selfKnown: true,
+			caller:    Identity{UID: 1000},
+			want:      true,
+		},
+		{
+			name:      "an unprivileged daemon delegates to nobody else",
+			self:      Identity{UID: 1000},
+			selfKnown: true,
+			caller:    Identity{UID: 1001},
+			want:      false,
+		},
+		{
+			// The daemon is root on a normal install, so sharing its identity is
+			// already covered by being root; nothing else may match.
+			name:      "a root daemon delegates to nobody",
+			self:      Identity{UID: 0},
+			selfKnown: true,
+			caller:    Identity{UID: 1000},
+			want:      false,
+		},
+		{
+			// Windows netstack mode: the daemon needs no administrator rights.
+			name:      "an unprivileged windows daemon delegates to its own SID",
+			self:      Identity{SID: "S-1-5-21-1-2-3-1001"},
+			selfKnown: true,
+			caller:    Identity{SID: "S-1-5-21-1-2-3-1001"},
+			want:      true,
+		},
+		{
+			name:      "an unprivileged windows daemon delegates to no other SID",
+			self:      Identity{SID: "S-1-5-21-1-2-3-1001"},
+			selfKnown: true,
+			caller:    Identity{SID: "S-1-5-21-1-2-3-1002"},
+			want:      false,
+		},
+		{
+			// The UAC boundary: a filtered and a full token of the same account
+			// carry the same SID but not the same power, so an elevated daemon must
+			// never delegate to its own SID.
+			name:      "an elevated windows daemon does not delegate to its own SID",
+			self:      Identity{SID: "S-1-5-21-1-2-3-500", Elevated: true},
+			selfKnown: true,
+			caller:    Identity{SID: "S-1-5-21-1-2-3-500"},
+			want:      false,
+		},
+		{
+			name:      "LocalSystem is privileged on its own merits, not by delegation",
+			self:      Identity{SID: sidLocalSystem},
+			selfKnown: true,
+			caller:    Identity{SID: sidLocalSystem},
+			want:      true, // LocalSystem is privileged on its own merits
+		},
+		{
+			name:      "identities of different kinds never match",
+			self:      Identity{UID: 1000},
+			selfKnown: true,
+			caller:    Identity{SID: "S-1-5-21-1-2-3-1001"},
+			want:      false,
+		},
+		{
+			name:      "an unknown self identity delegates to nobody",
+			self:      Identity{},
+			selfKnown: false,
+			caller:    Identity{UID: 1000},
+			want:      false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			prevID, prevKnown, prevDelegate := selfIdentity, selfKnown, selfMayDelegate
+			t.Cleanup(func() { selfIdentity, selfKnown, selfMayDelegate = prevID, prevKnown, prevDelegate })
+
+			selfIdentity, selfKnown = tt.self, tt.selfKnown
+			selfMayDelegate = tt.selfKnown && mayDelegate(tt.self)
+
+			if got := IsPrivilegedCaller(tt.caller); got != tt.want {
+				t.Fatalf("IsPrivilegedCaller(%v) with daemon %v = %t, want %t",
+					tt.caller, tt.self, got, tt.want)
+			}
+		})
+	}
+}
+
+// The real process must never accidentally delegate: a test binary running as a
+// normal user is unprivileged, so it may match itself, but nothing else.
+func TestIsPrivilegedCaller_ThisProcess(t *testing.T) {
+	id, err := CurrentProcessIdentity()
+	if err != nil {
+		t.Skipf("cannot read this process's identity: %v", err)
+	}
+
+	// This process is always allowed to act as itself: either it is privileged, or
+	// it is unprivileged and therefore delegates to its own identity.
+	if !IsPrivilegedCaller(id) {
+		t.Errorf("this process %v was refused its own identity", id)
+	}
+
+	// A caller that is neither root nor this process must be refused, whatever
+	// this process happens to be.
+	other := Identity{UID: id.UID + 1}
+	if id.IsWindows() {
+		other = Identity{SID: id.SID + "9"}
+	}
+	if IsPrivilegedCaller(other) {
+		t.Errorf("an unrelated identity %v was treated as privileged", other)
+	}
+}
+
+// The shared service accounts are held by unrelated services, so a daemon running
+// as one of them must not extend its authority to every process with that SID.
+func TestMayDelegate(t *testing.T) {
+	tests := []struct {
+		name string
+		self Identity
+		want bool
+	}{
+		{name: "unprivileged unix user", self: Identity{UID: 1000}, want: true},
+		{name: "root", self: Identity{UID: 0}, want: false},
+		{name: "unprivileged windows user", self: Identity{SID: "S-1-5-21-1-2-3-1001"}, want: true},
+		{name: "elevated windows user", self: Identity{SID: "S-1-5-21-1-2-3-1001", Elevated: true}, want: false},
+		{name: "local system", self: Identity{SID: sidLocalSystem}, want: false},
+		{name: "local service", self: Identity{SID: sidLocalService}, want: false},
+		{name: "network service", self: Identity{SID: sidNetworkService}, want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := mayDelegate(tt.self); got != tt.want {
+				t.Errorf("mayDelegate(%+v) = %v, want %v", tt.self, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/client/internal/ipcauth/self_unix.go b/client/internal/ipcauth/self_unix.go
new file mode 100644
index 000000000..1b86c4fc0
--- /dev/null
+++ b/client/internal/ipcauth/self_unix.go
@@ -0,0 +1,17 @@
+//go:build !windows
+
+package ipcauth
+
+import "os"
+
+// CurrentProcessIdentity returns this process's identity as the daemon would
+// see it if this process connected to the local IPC. It lets a client (the UI)
+// decide up front whether a privileged operation can succeed, without a
+// round-trip and without duplicating the rules: the answer comes from the same
+// Identity.IsPrivileged the daemon applies.
+func CurrentProcessIdentity() (Identity, error) {
+	return Identity{
+		UID: uint32(os.Geteuid()),
+		GID: uint32(os.Getegid()),
+	}, nil
+}
diff --git a/client/internal/ipcauth/self_windows.go b/client/internal/ipcauth/self_windows.go
new file mode 100644
index 000000000..5474cc101
--- /dev/null
+++ b/client/internal/ipcauth/self_windows.go
@@ -0,0 +1,35 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"fmt"
+
+	"golang.org/x/sys/windows"
+)
+
+// CurrentProcessIdentity returns this process's identity as the daemon would see
+// it if this process connected to the local IPC. It lets a client (the UI)
+// decide up front whether a privileged operation can succeed, without a
+// round-trip and without duplicating the rules: the answer comes from the same
+// Identity.IsPrivileged the daemon applies to the token it reads off the pipe.
+func CurrentProcessIdentity() (Identity, error) {
+	// A pseudo-token, so it must not be closed.
+	token := windows.GetCurrentProcessToken()
+
+	user, err := token.GetTokenUser()
+	if err != nil {
+		return Identity{}, fmt.Errorf("read token user: %w", err)
+	}
+
+	groups, err := tokenGroupSIDs(token)
+	if err != nil {
+		return Identity{}, err
+	}
+
+	return Identity{
+		SID:      user.User.Sid.String(),
+		Groups:   groups,
+		Elevated: token.IsElevated(),
+	}, nil
+}
diff --git a/client/internal/lazyconn/manager/manager.go b/client/internal/lazyconn/manager/manager.go
index 3868e37e8..b7424bb2f 100644
--- a/client/internal/lazyconn/manager/manager.go
+++ b/client/internal/lazyconn/manager/manager.go
@@ -29,6 +29,11 @@ type managedPeer struct {
 
 type Config struct {
 	InactivityThreshold *time.Duration
+	// ReconcileAllowedIPs re-applies a peer's routed allowed IPs after its wake endpoint is
+	// armed. The activity listener creates the wake peer with the overlay /32 only; without the
+	// routed prefixes WireGuard would not steer subnet-bound traffic to the wake endpoint, so an
+	// idle routing peer could never be woken by that traffic. Optional; nil disables the reconcile.
+	ReconcileAllowedIPs func(peerKey string) error
 }
 
 // Manager manages lazy connections
@@ -56,6 +61,9 @@ type Manager struct {
 	peerToHAGroups map[string][]route.HAUniqueID // peer ID -> HA groups they belong to
 	haGroupToPeers map[route.HAUniqueID][]string // HA group -> peer IDs in the group
 	routesMu       sync.RWMutex
+
+	// reconcileAllowedIPs re-applies a peer's routed allowed IPs after its wake endpoint is armed.
+	reconcileAllowedIPs func(peerKey string) error
 }
 
 // NewManager creates a new lazy connection manager
@@ -73,6 +81,7 @@ func NewManager(config Config, engineCtx context.Context, peerStore *peerstore.S
 		activityManager:      activity.NewManager(wgIface),
 		peerToHAGroups:       make(map[string][]route.HAUniqueID),
 		haGroupToPeers:       make(map[route.HAUniqueID][]string),
+		reconcileAllowedIPs:  config.ReconcileAllowedIPs,
 	}
 
 	if wgIface.IsUserspaceBind() {
@@ -201,7 +210,7 @@ func (m *Manager) AddPeer(peerCfg lazyconn.PeerConfig) (bool, error) {
 		return false, nil
 	}
 
-	if err := m.activityManager.MonitorPeerActivity(peerCfg); err != nil {
+	if err := m.armActivityListener(peerCfg); err != nil {
 		return false, err
 	}
 
@@ -288,7 +297,7 @@ func (m *Manager) DeactivatePeer(peerID peerid.ConnID) {
 
 	m.inactivityManager.RemovePeer(mp.peerCfg.PublicKey)
 
-	if err := m.activityManager.MonitorPeerActivity(*mp.peerCfg); err != nil {
+	if err := m.armActivityListener(*mp.peerCfg); err != nil {
 		mp.peerCfg.Log.Errorf("failed to create activity monitor: %v", err)
 		return
 	}
@@ -465,6 +474,31 @@ func (m *Manager) close() {
 }
 
 // shouldDeferIdleForHA checks if peer should stay connected due to HA group requirements
+// armRoutedAllowedIPs re-applies the peer's routed allowed IPs onto its freshly armed wake
+// endpoint. The activity listener creates the wake peer with the overlay /32 only, so without
+// this the routed prefixes would be missing and traffic to a routed subnet could not wake the
+// idle routing peer. It is a no-op when no reconciler is configured.
+// armActivityListener (re)arms the peer's wake endpoint via the activity manager and then
+// re-applies its routed allowed IPs, so traffic to a routed subnet can wake an idle routing
+// peer. The routed prefixes must be re-applied after the wake endpoint exists because the
+// listener creates it with the overlay /32 only.
+func (m *Manager) armActivityListener(peerCfg lazyconn.PeerConfig) error {
+	if err := m.activityManager.MonitorPeerActivity(peerCfg); err != nil {
+		return err
+	}
+	m.armRoutedAllowedIPs(&peerCfg)
+	return nil
+}
+
+func (m *Manager) armRoutedAllowedIPs(peerCfg *lazyconn.PeerConfig) {
+	if m.reconcileAllowedIPs == nil {
+		return
+	}
+	if err := m.reconcileAllowedIPs(peerCfg.PublicKey); err != nil {
+		peerCfg.Log.Errorf("failed to reconcile routed allowed IPs on wake endpoint: %v", err)
+	}
+}
+
 func (m *Manager) shouldDeferIdleForHA(inactivePeers map[string]struct{}, peerID string) bool {
 	m.routesMu.RLock()
 	defer m.routesMu.RUnlock()
@@ -577,7 +611,7 @@ func (m *Manager) onPeerInactivityTimedOut(peerIDs map[string]struct{}) {
 
 		mp.peerCfg.Log.Infof("start activity monitor")
 
-		if err := m.activityManager.MonitorPeerActivity(*mp.peerCfg); err != nil {
+		if err := m.armActivityListener(*mp.peerCfg); err != nil {
 			mp.peerCfg.Log.Errorf("failed to create activity monitor: %v", err)
 			continue
 		}
diff --git a/client/internal/localmetrics/localmetrics.go b/client/internal/localmetrics/localmetrics.go
new file mode 100644
index 000000000..f829fa132
--- /dev/null
+++ b/client/internal/localmetrics/localmetrics.go
@@ -0,0 +1,274 @@
+// Package localmetrics exposes client connection state as a local
+// Prometheus /metrics endpoint.
+package localmetrics
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"net/netip"
+	"sync"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	dto "github.com/prometheus/client_model/go"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// DefaultListenAddress is used when local metrics are enabled without an explicit address.
+const DefaultListenAddress = "127.0.0.1:9191"
+
+const (
+	shutdownTimeout   = 3 * time.Second
+	readHeaderTimeout = 5 * time.Second
+	readTimeout       = 10 * time.Second
+	writeTimeout      = 30 * time.Second
+	idleTimeout       = time.Minute
+)
+
+// statusSource provides the connection state snapshots the collector reads on scrape.
+type statusSource interface {
+	GetPeerStates() []peer.State
+	GetManagementState() peer.ManagementState
+	GetSignalState() peer.SignalState
+}
+
+// GathererProvider returns the current client metrics gatherer, or nil when
+// no engine is running. It is called on every scrape.
+type GathererProvider func() prometheus.Gatherer
+
+// Manager runs the local /metrics HTTP endpoint according to the active
+// client configuration. Reconcile is safe to call on every config change.
+type Manager struct {
+	status        statusSource
+	clientMetrics GathererProvider
+
+	mu   sync.Mutex
+	srv  *http.Server
+	addr string
+}
+
+// NewManager creates a manager that serves metrics from status and
+// clientMetrics and shuts down when ctx is canceled.
+func NewManager(ctx context.Context, status statusSource, clientMetrics GathererProvider) *Manager {
+	m := &Manager{status: status, clientMetrics: clientMetrics}
+	go func() {
+		<-ctx.Done()
+		m.Stop()
+	}()
+	return m
+}
+
+// Reconcile starts, stops, or restarts the metrics endpoint to match the
+// desired state. An empty addr falls back to DefaultListenAddress.
+func (m *Manager) Reconcile(enabled bool, addr string) {
+	if addr == "" {
+		addr = DefaultListenAddress
+	}
+	warnIfNotLoopback(addr)
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if !enabled {
+		m.stop()
+		return
+	}
+	if m.srv != nil && m.addr == addr {
+		return
+	}
+	m.stop()
+
+	registry := prometheus.NewRegistry()
+	registry.MustRegister(newCollector(m.status))
+
+	gatherers := prometheus.Gatherers{registry, prometheus.GathererFunc(func() ([]*dto.MetricFamily, error) {
+		if m.clientMetrics == nil {
+			return nil, nil
+		}
+		g := m.clientMetrics()
+		if g == nil {
+			return nil, nil
+		}
+		return g.Gather()
+	})}
+
+	mux := http.NewServeMux()
+	mux.Handle("/metrics", promhttp.HandlerFor(gatherers, promhttp.HandlerOpts{}))
+
+	srv := &http.Server{
+		Addr:              addr,
+		Handler:           mux,
+		ReadHeaderTimeout: readHeaderTimeout,
+		ReadTimeout:       readTimeout,
+		WriteTimeout:      writeTimeout,
+		IdleTimeout:       idleTimeout,
+	}
+	m.srv = srv
+	m.addr = addr
+
+	log.Infof("serving local metrics on http://%s/metrics", addr)
+	go func() {
+		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Errorf("failed to serve local metrics on %s: %v", addr, err)
+			m.clear(srv)
+		}
+	}()
+}
+
+// clear drops the reference to srv so a later Reconcile with the same
+// address restarts it. A newer server may already have replaced it, in
+// which case the reference must stay.
+func (m *Manager) clear(srv *http.Server) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if m.srv != srv {
+		return
+	}
+	m.srv = nil
+	m.addr = ""
+}
+
+// Stop shuts down the metrics endpoint if it is running.
+func (m *Manager) Stop() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.stop()
+}
+
+// stop shuts down the running server. Callers must hold m.mu.
+func (m *Manager) stop() {
+	if m.srv == nil {
+		return
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
+	defer cancel()
+	if err := m.srv.Shutdown(ctx); err != nil {
+		log.Debugf("failed to shut down local metrics server: %v", err)
+	}
+	m.srv = nil
+	m.addr = ""
+}
+
+// collector converts status recorder snapshots into Prometheus metrics at scrape time.
+type collector struct {
+	status statusSource
+
+	managementConnected *prometheus.Desc
+	signalConnected     *prometheus.Desc
+	peersTotal          *prometheus.Desc
+	peersConnected      *prometheus.Desc
+	peerLatency         *prometheus.Desc
+}
+
+func newCollector(status statusSource) *collector {
+	return &collector{
+		status: status,
+		managementConnected: prometheus.NewDesc(
+			"netbird_management_connected",
+			"Whether the client is connected to the management service (1 connected, 0 disconnected).",
+			nil, nil,
+		),
+		signalConnected: prometheus.NewDesc(
+			"netbird_signal_connected",
+			"Whether the client is connected to the signal service (1 connected, 0 disconnected).",
+			nil, nil,
+		),
+		peersTotal: prometheus.NewDesc(
+			"netbird_peers",
+			"Number of peers known to this client.",
+			nil, nil,
+		),
+		peersConnected: prometheus.NewDesc(
+			"netbird_peers_connected",
+			"Number of connected peers by connection type.",
+			[]string{"connection_type"}, nil,
+		),
+		peerLatency: prometheus.NewDesc(
+			"netbird_peer_latency_seconds",
+			"Round-trip latency per directly connected peer; relayed connections have no latency measurement.",
+			[]string{"peer"}, nil,
+		),
+	}
+}
+
+// Describe implements prometheus.Collector.
+func (c *collector) Describe(ch chan<- *prometheus.Desc) {
+	ch <- c.managementConnected
+	ch <- c.signalConnected
+	ch <- c.peersTotal
+	ch <- c.peersConnected
+	ch <- c.peerLatency
+}
+
+// Collect implements prometheus.Collector.
+func (c *collector) Collect(ch chan<- prometheus.Metric) {
+	ch <- prometheus.MustNewConstMetric(c.managementConnected, prometheus.GaugeValue, boolToFloat(c.status.GetManagementState().Connected))
+	ch <- prometheus.MustNewConstMetric(c.signalConnected, prometheus.GaugeValue, boolToFloat(c.status.GetSignalState().Connected))
+
+	peers := c.status.GetPeerStates()
+	ch <- prometheus.MustNewConstMetric(c.peersTotal, prometheus.GaugeValue, float64(len(peers)))
+
+	var p2p, relayed float64
+	for _, p := range peers {
+		if p.ConnStatus != peer.StatusConnected {
+			continue
+		}
+		if p.Relayed {
+			relayed++
+			continue
+		}
+		p2p++
+
+		if latency := p.Latency.Seconds(); latency > 0 {
+			ch <- prometheus.MustNewConstMetric(c.peerLatency, prometheus.GaugeValue, latency, p.FQDN)
+		}
+	}
+	ch <- prometheus.MustNewConstMetric(c.peersConnected, prometheus.GaugeValue, p2p, "p2p")
+	ch <- prometheus.MustNewConstMetric(c.peersConnected, prometheus.GaugeValue, relayed, "relay")
+}
+
+func boolToFloat(b bool) float64 {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+// IsLoopback reports whether addr binds the endpoint to the local host only.
+// An empty address means DefaultListenAddress. It fails closed: an address
+// that cannot be confirmed loopback, including an unparseable one, is not.
+func IsLoopback(addr string) bool {
+	if addr == "" {
+		addr = DefaultListenAddress
+	}
+
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return false
+	}
+	if host == "localhost" {
+		return true
+	}
+
+	ip, err := netip.ParseAddr(host)
+	if err != nil {
+		return false
+	}
+	return ip.Unmap().IsLoopback()
+}
+
+// warnIfNotLoopback logs a warning when the listen address cannot be
+// confirmed to be local-only, since the endpoint exposes peer and
+// connectivity details without authentication.
+func warnIfNotLoopback(addr string) {
+	if IsLoopback(addr) {
+		return
+	}
+	log.Warnf("local metrics endpoint listens on non-loopback address %s and is reachable from the network without authentication", addr)
+}
diff --git a/client/internal/localmetrics/localmetrics_test.go b/client/internal/localmetrics/localmetrics_test.go
new file mode 100644
index 000000000..727137077
--- /dev/null
+++ b/client/internal/localmetrics/localmetrics_test.go
@@ -0,0 +1,151 @@
+package localmetrics
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+type stubStatus struct {
+	peers      []peer.State
+	management peer.ManagementState
+	signal     peer.SignalState
+}
+
+func (s *stubStatus) GetPeerStates() []peer.State              { return s.peers }
+func (s *stubStatus) GetManagementState() peer.ManagementState { return s.management }
+func (s *stubStatus) GetSignalState() peer.SignalState         { return s.signal }
+
+func testStatus() *stubStatus {
+	return &stubStatus{
+		management: peer.ManagementState{Connected: true},
+		signal:     peer.SignalState{Connected: true},
+		peers: []peer.State{
+			{FQDN: "peer-a.netbird.cloud", IP: "100.90.0.1", ConnStatus: peer.StatusConnected, Relayed: false, Latency: 12 * time.Millisecond},
+			{FQDN: "peer-b.netbird.cloud", IP: "100.90.0.2", ConnStatus: peer.StatusConnected, Relayed: false, Latency: 36 * time.Millisecond},
+			{FQDN: "peer-c.netbird.cloud", IP: "100.90.0.3", ConnStatus: peer.StatusConnected, Relayed: true},
+			{FQDN: "peer-d.netbird.cloud", IP: "100.90.0.4", ConnStatus: peer.StatusIdle},
+		},
+	}
+}
+
+func TestCollector(t *testing.T) {
+	c := newCollector(testStatus())
+
+	expected := `
+# HELP netbird_management_connected Whether the client is connected to the management service (1 connected, 0 disconnected).
+# TYPE netbird_management_connected gauge
+netbird_management_connected 1
+# HELP netbird_peer_latency_seconds Round-trip latency per directly connected peer; relayed connections have no latency measurement.
+# TYPE netbird_peer_latency_seconds gauge
+netbird_peer_latency_seconds{peer="peer-a.netbird.cloud"} 0.012
+netbird_peer_latency_seconds{peer="peer-b.netbird.cloud"} 0.036
+# HELP netbird_peers Number of peers known to this client.
+# TYPE netbird_peers gauge
+netbird_peers 4
+# HELP netbird_peers_connected Number of connected peers by connection type.
+# TYPE netbird_peers_connected gauge
+netbird_peers_connected{connection_type="p2p"} 2
+netbird_peers_connected{connection_type="relay"} 1
+# HELP netbird_signal_connected Whether the client is connected to the signal service (1 connected, 0 disconnected).
+# TYPE netbird_signal_connected gauge
+netbird_signal_connected 1
+`
+	require.NoError(t, testutil.CollectAndCompare(c, strings.NewReader(expected)))
+}
+
+func TestServe(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err, "must find a free port")
+	addr := ln.Addr().String()
+	require.NoError(t, ln.Close())
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	m := NewManager(ctx, testStatus(), nil)
+	m.Reconcile(true, addr)
+
+	var body string
+	require.Eventually(t, func() bool {
+		resp, err := http.Get(fmt.Sprintf("http://%s/metrics", addr))
+		if err != nil {
+			return false
+		}
+		defer resp.Body.Close()
+		data, err := io.ReadAll(resp.Body)
+		if err != nil || resp.StatusCode != http.StatusOK {
+			return false
+		}
+		body = string(data)
+		return true
+	}, 2*time.Second, 50*time.Millisecond, "metrics endpoint should come up")
+
+	assert.Contains(t, body, "netbird_peers 4")
+	assert.Contains(t, body, `netbird_peers_connected{connection_type="relay"} 1`)
+	assert.Contains(t, body, `netbird_peer_latency_seconds{peer="peer-a.netbird.cloud"} 0.012`)
+}
+
+// A server that never came up must not be remembered, otherwise reconciling the
+// same address again is a no-op and the endpoint never recovers.
+func TestReconcileForgetsAFailedServer(t *testing.T) {
+	blocker, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err, "must find a free port")
+	t.Cleanup(func() { _ = blocker.Close() })
+	addr := blocker.Addr().String()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	m := NewManager(ctx, testStatus(), nil)
+	m.Reconcile(true, addr)
+
+	require.Eventually(t, func() bool {
+		m.mu.Lock()
+		defer m.mu.Unlock()
+		return m.srv == nil && m.addr == ""
+	}, 2*time.Second, 20*time.Millisecond, "the failed server should be dropped")
+
+	require.NoError(t, blocker.Close())
+	m.Reconcile(true, addr)
+
+	require.Eventually(t, func() bool {
+		resp, err := http.Get(fmt.Sprintf("http://%s/metrics", addr))
+		if err != nil {
+			return false
+		}
+		defer resp.Body.Close()
+		return resp.StatusCode == http.StatusOK
+	}, 2*time.Second, 50*time.Millisecond, "reconciling the same address should retry the bind")
+}
+
+func TestIsLoopback(t *testing.T) {
+	tests := map[string]bool{
+		"":                        true,
+		"127.0.0.1:9191":          true,
+		"127.9.9.9:9191":          true,
+		"[::1]:9191":              true,
+		"[::ffff:127.0.0.1]:9191": true,
+		"localhost:9191":          true,
+		"0.0.0.0:9191":            false,
+		"[::]:9191":               false,
+		"192.168.1.10:9191":       false,
+		"not-an-address":          false,
+		"example.com:9191":        false,
+	}
+
+	for addr, want := range tests {
+		t.Run(addr, func(t *testing.T) {
+			assert.Equal(t, want, IsLoopback(addr), "loopback verdict for %q", addr)
+		})
+	}
+}
diff --git a/client/internal/message_convert.go b/client/internal/message_convert.go
deleted file mode 100644
index 97da32c06..000000000
--- a/client/internal/message_convert.go
+++ /dev/null
@@ -1,58 +0,0 @@
-package internal
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"net/netip"
-
-	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
-	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-)
-
-func convertToFirewallProtocol(protocol mgmProto.RuleProtocol) (firewallManager.Protocol, error) {
-	switch protocol {
-	case mgmProto.RuleProtocol_TCP:
-		return firewallManager.ProtocolTCP, nil
-	case mgmProto.RuleProtocol_UDP:
-		return firewallManager.ProtocolUDP, nil
-	case mgmProto.RuleProtocol_ICMP:
-		return firewallManager.ProtocolICMP, nil
-	case mgmProto.RuleProtocol_ALL:
-		return firewallManager.ProtocolALL, nil
-	default:
-		return "", fmt.Errorf("invalid protocol type: %s", protocol.String())
-	}
-}
-
-func convertPortInfo(portInfo *mgmProto.PortInfo) (*firewallManager.Port, error) {
-	if portInfo == nil {
-		return nil, errors.New("portInfo cannot be nil")
-	}
-
-	if portInfo.GetPort() != 0 {
-		return firewallManager.NewPort(int(portInfo.GetPort()))
-	}
-
-	if portInfo.GetRange() != nil {
-		return firewallManager.NewPort(int(portInfo.GetRange().Start), int(portInfo.GetRange().End))
-	}
-
-	return nil, fmt.Errorf("invalid portInfo: %v", portInfo)
-}
-
-func convertToIP(rawIP []byte) (netip.Addr, error) {
-	if rawIP == nil {
-		return netip.Addr{}, errors.New("input bytes cannot be nil")
-	}
-
-	if len(rawIP) != net.IPv4len && len(rawIP) != net.IPv6len {
-		return netip.Addr{}, fmt.Errorf("invalid IP length: %d", len(rawIP))
-	}
-
-	if len(rawIP) == net.IPv4len {
-		return netip.AddrFrom4([4]byte(rawIP)), nil
-	}
-
-	return netip.AddrFrom16([16]byte(rawIP)), nil
-}
diff --git a/client/internal/metrics/connection_type.go b/client/internal/metrics/connection_type.go
index a3406a6b8..d393e5112 100644
--- a/client/internal/metrics/connection_type.go
+++ b/client/internal/metrics/connection_type.go
@@ -4,11 +4,17 @@ package metrics
 type ConnectionType string
 
 const (
-	// ConnectionTypeICE represents a direct peer-to-peer connection using ICE
-	ConnectionTypeICE ConnectionType = "ice"
+	// ConnectionTypeICEP2P represents a direct peer-to-peer connection using ICE
+	ConnectionTypeICEP2P ConnectionType = "ice_p2p"
+
+	// ConnectionTypeICETurn represents an ICE connection through a TURN server
+	ConnectionTypeICETurn ConnectionType = "ice_turn"
 
 	// ConnectionTypeRelay represents a relayed connection
 	ConnectionTypeRelay ConnectionType = "relay"
+
+	// ConnectionTypeUnknown represents a connection with no active transport. It is not pushed.
+	ConnectionTypeUnknown ConnectionType = "unknown"
 )
 
 // String returns the string representation of the connection type
diff --git a/client/internal/metrics/influxdb.go b/client/internal/metrics/influxdb.go
index 4ba14bf44..717544f6a 100644
--- a/client/internal/metrics/influxdb.go
+++ b/client/internal/metrics/influxdb.go
@@ -45,30 +45,13 @@ func (m *influxDBMetrics) RecordConnectionStages(
 	isReconnection bool,
 	timestamps ConnectionStageTimestamps,
 ) {
-	var signalingReceivedToConnection, connectionToWgHandshake, totalDuration float64
-
-	if !timestamps.SignalingReceived.IsZero() && !timestamps.ConnectionReady.IsZero() {
-		signalingReceivedToConnection = timestamps.ConnectionReady.Sub(timestamps.SignalingReceived).Seconds()
-	}
-
-	if !timestamps.ConnectionReady.IsZero() && !timestamps.WgHandshakeSuccess.IsZero() {
-		connectionToWgHandshake = timestamps.WgHandshakeSuccess.Sub(timestamps.ConnectionReady).Seconds()
-	}
-
-	if !timestamps.SignalingReceived.IsZero() && !timestamps.WgHandshakeSuccess.IsZero() {
-		totalDuration = timestamps.WgHandshakeSuccess.Sub(timestamps.SignalingReceived).Seconds()
-	}
-
-	attemptType := "initial"
-	if isReconnection {
-		attemptType = "reconnection"
-	}
+	signalingReceivedToConnection, connectionToWgHandshake, totalDuration := timestamps.Durations()
 
 	connTypeStr := connectionType.String()
 	tags := fmt.Sprintf("deployment_type=%s,connection_type=%s,attempt_type=%s,version=%s,os=%s,arch=%s,peer_id=%s,connection_pair_id=%s",
 		agentInfo.DeploymentType.String(),
 		connTypeStr,
-		attemptType,
+		attemptType(isReconnection),
 		agentInfo.Version,
 		agentInfo.OS,
 		agentInfo.Arch,
@@ -94,7 +77,7 @@ func (m *influxDBMetrics) RecordConnectionStages(
 	m.trimLocked()
 
 	log.Tracef("peer connection metrics [%s, %s, %s]: signalingReceived→connection: %.3fs, connection→wg_handshake: %.3fs, total: %.3fs",
-		agentInfo.DeploymentType.String(), connTypeStr, attemptType, signalingReceivedToConnection, connectionToWgHandshake, totalDuration)
+		agentInfo.DeploymentType.String(), connTypeStr, attemptType(isReconnection), signalingReceivedToConnection, connectionToWgHandshake, totalDuration)
 }
 
 func (m *influxDBMetrics) RecordSyncDuration(_ context.Context, agentInfo AgentInfo, duration time.Duration) {
diff --git a/client/internal/metrics/influxdb_test.go b/client/internal/metrics/influxdb_test.go
index b964e31a3..6a226fe2f 100644
--- a/client/internal/metrics/influxdb_test.go
+++ b/client/internal/metrics/influxdb_test.go
@@ -28,7 +28,7 @@ func TestInfluxDBMetrics_RecordAndExport(t *testing.T) {
 		WgHandshakeSuccess: time.Now().Add(-1 * time.Second),
 	}
 
-	m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICE, false, ts)
+	m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICEP2P, false, ts)
 
 	var buf bytes.Buffer
 	err := m.Export(&buf)
@@ -60,7 +60,7 @@ func TestInfluxDBMetrics_ExportDeterministicFieldOrder(t *testing.T) {
 
 	// Record multiple times and verify consistent field order
 	for i := 0; i < 10; i++ {
-		m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICE, false, ts)
+		m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICEP2P, false, ts)
 	}
 
 	var buf bytes.Buffer
diff --git a/client/internal/metrics/infra/README.md b/client/internal/metrics/infra/README.md
index 7941a30cf..7c23e42bd 100644
--- a/client/internal/metrics/infra/README.md
+++ b/client/internal/metrics/infra/README.md
@@ -32,13 +32,24 @@ Clients do not talk to InfluxDB directly. An ingest server sits between clients
 ```text
 Client ──POST──▶ Ingest Server (:8087) ──▶ InfluxDB (internal)
                   │
+                  ├─ Checks the X-Peer-ID header format
                   ├─ Validates line protocol
                   ├─ Allowlists measurements, fields, and tags
                   ├─ Rejects out-of-bound values
                   └─ Serves remote config at /config
 ```
 
-- **No secret/token-based client auth** — the ingest server holds the InfluxDB token server-side. Clients must send a hashed peer ID via `X-Peer-ID` header.
+- **Intentionally unauthenticated** — the endpoint receives obfuscated telemetry from
+  the peers of both cloud and self-hosted deployments. For a self-hosted peer there is
+  no shared trust anchor with this server, so there is nothing to authenticate against.
+- **`X-Peer-ID` is a correlation tag, not a credential** — it carries the obfuscated
+  peer identifier so samples from one peer can be grouped. The server only checks that
+  the header is well-formed (16 hex chars); a malformed value is rejected with
+  `400 Bad Request`, not `401`. Any well-formed value is accepted by design, and the
+  header must not be relied on for access control. The header itself is not forwarded
+  to InfluxDB — the stored `peer_id` tag comes from the request body and is constrained
+  only by the tag allowlist and the maximum tag value length.
+- **The InfluxDB token stays server-side** — clients never hold a write credential.
 - **InfluxDB is not exposed** — only accessible within the docker network
 - Source: `ingest/main.go`
 
@@ -56,14 +67,33 @@ Measurement: `netbird_peer_connection`
 
 Tags:
 - `deployment_type`: "cloud" | "selfhosted" | "unknown"
-- `connection_type`: "ice" | "relay"
+- `connection_type`: "ice_p2p" | "ice_turn" | "relay" (see below)
 - `attempt_type`: "initial" | "reconnection"
 - `version`: NetBird version string
 - `os`: Operating system (linux, darwin, windows, android, ios, etc.)
 - `arch`: CPU architecture (amd64, arm64, etc.)
+- `peer_id`: obfuscated peer identifier (truncated SHA-256 of the WireGuard public key)
+- `connection_pair_id`: deterministic identifier for the peer pair, identical on both sides
 
 **Note:** `SignalingReceived` is set when the first offer or answer arrives from the remote peer (in both initial and reconnection paths). It excludes the potentially unbounded wait for the remote peer to come online.
 
+#### `connection_type` values
+
+Derived from the connection priority (`conntype.ConnPriority`) by `metricsConnType` in `client/internal/peer/conn.go`:
+
+| Value | Priority | Traffic is |
+|-------|----------|------------|
+| `ice_p2p` | `ICEP2P` | direct peer-to-peer |
+| `ice_turn` | `ICETurn` | relayed, through a TURN server |
+| `relay` | `Relay` | relayed, through a NetBird relay |
+| `unknown` | `None` or unrecognised | no active transport — **the sample is not pushed** |
+
+**Direct traffic is `ice_p2p` only.** `ice_turn` is relayed despite being negotiated by ICE, matching `Conn.isRelayed`.
+
+`None` means no transport is active: not established yet, or reset after a relay drop or a peer-state reset. Such a sample cannot be attributed to a transport, so `recordConnectionMetrics` drops it instead of pushing it — `unknown` therefore never appears in the bucket. Connection counts are counts of connections whose transport was known at sampling time.
+
+**Samples recorded before 0.77 used a single `ice` value** which covered `ICEP2P`, `ICETurn` *and* `None`, so historical `ice` samples overstate direct connections by an unknown amount and must not be compared with `ice_p2p`.
+
 ### Sync Duration
 
 Measurement: `netbird_sync`
@@ -176,7 +206,7 @@ docker compose up -d
 ```
 
 This starts:
-- **Ingest server** on http://localhost:8087 — accepts client metrics (requires `X-Peer-ID` header, no secret/token auth)
+- **Ingest server** on http://localhost:8087 — accepts client metrics (unauthenticated by design; expects a well-formed `X-Peer-ID` correlation tag)
 - **InfluxDB** — internal only, not exposed to host
 - **Grafana** on http://localhost:3001
 
diff --git a/client/internal/metrics/infra/ingest/main.go b/client/internal/metrics/infra/ingest/main.go
index 91405b85f..a9fb25178 100644
--- a/client/internal/metrics/infra/ingest/main.go
+++ b/client/internal/metrics/infra/ingest/main.go
@@ -22,6 +22,11 @@ const (
 	maxDurationSeconds = 86400.0          // reject any duration field > 24 hours
 	peerIDLength       = 16               // truncated SHA-256: 8 bytes = 16 hex chars
 	maxTagValueLength  = 64               // reject tag values longer than this
+	readTimeout        = 30 * time.Second // must fit reading a compressed body up to maxBodySize
+	writeTimeout       = 60 * time.Second // must exceed the upstream client timeout below
+	idleTimeout        = 120 * time.Second
+	readHeaderTimeout  = 10 * time.Second
+	maxHeaderBytes     = 1 << 20 // 1 MB
 )
 
 type measurementSpec struct {
@@ -124,8 +129,17 @@ func main() {
 		fmt.Fprint(w, "ok") //nolint:errcheck
 	})
 
+	srv := &http.Server{
+		Addr:              listenAddr,
+		ReadTimeout:       readTimeout,
+		ReadHeaderTimeout: readHeaderTimeout,
+		WriteTimeout:      writeTimeout,
+		IdleTimeout:       idleTimeout,
+		MaxHeaderBytes:    maxHeaderBytes,
+	}
+
 	log.Printf("ingest server listening on %s, forwarding to %s", listenAddr, influxURL)
-	if err := http.ListenAndServe(listenAddr, nil); err != nil { //nolint:gosec
+	if err := srv.ListenAndServe(); err != nil {
 		log.Fatal(err)
 	}
 }
@@ -137,8 +151,8 @@ func handleIngest(client *http.Client, influxURL, influxToken string) http.Handl
 			return
 		}
 
-		if err := validateAuth(r); err != nil {
-			http.Error(w, err.Error(), http.StatusUnauthorized)
+		if err := validatePeerIDFormat(r); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
 			return
 		}
 
@@ -187,8 +201,13 @@ func forwardToInflux(w http.ResponseWriter, r *http.Request, client *http.Client
 	io.Copy(w, resp.Body) //nolint:errcheck
 }
 
-// validateAuth checks that the X-Peer-ID header contains a valid hashed peer ID.
-func validateAuth(r *http.Request) error {
+// validatePeerIDFormat checks the shape of the X-Peer-ID header. The header is a
+// correlation tag, not a credential: this endpoint is intentionally
+// unauthenticated so that peers of self-hosted deployments, for which no shared
+// trust anchor exists, can report obfuscated telemetry. The header is not forwarded
+// to InfluxDB, so this check does not bound the stored peer_id tag; it only rejects
+// a malformed header as a bad request rather than an auth failure.
+func validatePeerIDFormat(r *http.Request) error {
 	peerID := r.Header.Get("X-Peer-ID")
 	if peerID == "" {
 		return fmt.Errorf("missing X-Peer-ID header")
diff --git a/client/internal/metrics/infra/ingest/main_test.go b/client/internal/metrics/infra/ingest/main_test.go
index 96287813e..526f127cb 100644
--- a/client/internal/metrics/infra/ingest/main_test.go
+++ b/client/internal/metrics/infra/ingest/main_test.go
@@ -94,7 +94,7 @@ func TestValidateLineProtocol_RejectsOnBadLine(t *testing.T) {
 	require.Error(t, err)
 }
 
-func TestValidateAuth(t *testing.T) {
+func TestValidatePeerIDFormat(t *testing.T) {
 	tests := []struct {
 		name    string
 		peerID  string
@@ -113,7 +113,7 @@ func TestValidateAuth(t *testing.T) {
 			if tt.peerID != "" {
 				r.Header.Set("X-Peer-ID", tt.peerID)
 			}
-			err := validateAuth(r)
+			err := validatePeerIDFormat(r)
 			if tt.wantErr {
 				require.Error(t, err)
 			} else {
diff --git a/client/internal/metrics/metrics.go b/client/internal/metrics/metrics.go
index cfe477107..5edf1d9c7 100644
--- a/client/internal/metrics/metrics.go
+++ b/client/internal/metrics/metrics.go
@@ -89,6 +89,21 @@ type ConnectionStageTimestamps struct {
 	WgHandshakeSuccess time.Time
 }
 
+// Durations returns the stage durations in seconds. A duration is zero when
+// either of its timestamps is missing.
+func (c ConnectionStageTimestamps) Durations() (signalingToConnection, connectionToWgHandshake, total float64) {
+	if !c.SignalingReceived.IsZero() && !c.ConnectionReady.IsZero() {
+		signalingToConnection = c.ConnectionReady.Sub(c.SignalingReceived).Seconds()
+	}
+	if !c.ConnectionReady.IsZero() && !c.WgHandshakeSuccess.IsZero() {
+		connectionToWgHandshake = c.WgHandshakeSuccess.Sub(c.ConnectionReady).Seconds()
+	}
+	if !c.SignalingReceived.IsZero() && !c.WgHandshakeSuccess.IsZero() {
+		total = c.WgHandshakeSuccess.Sub(c.SignalingReceived).Seconds()
+	}
+	return signalingToConnection, connectionToWgHandshake, total
+}
+
 // String returns a human-readable representation of the connection stage timestamps
 func (c ConnectionStageTimestamps) String() string {
 	return fmt.Sprintf("ConnectionStageTimestamps{SignalingReceived=%v, ConnectionReady=%v, WgHandshakeSuccess=%v}",
@@ -279,3 +294,11 @@ func (c *ClientMetrics) stopPushLocked() {
 	c.wg.Wait()
 	c.push.Store(nil)
 }
+
+// attemptType returns the metric label for an initial vs reconnection attempt.
+func attemptType(isReconnection bool) string {
+	if isReconnection {
+		return "reconnection"
+	}
+	return "initial"
+}
diff --git a/client/internal/metrics/metrics_default.go b/client/internal/metrics/metrics_default.go
index 927ab51d1..3798adab6 100644
--- a/client/internal/metrics/metrics_default.go
+++ b/client/internal/metrics/metrics_default.go
@@ -2,10 +2,24 @@
 
 package metrics
 
+import "github.com/prometheus/client_golang/prometheus"
+
 // NewClientMetrics creates a new ClientMetrics instance
 func NewClientMetrics(agentInfo AgentInfo) *ClientMetrics {
 	return &ClientMetrics{
-		impl:      newInfluxDBMetrics(),
+		impl:      newPrometheusMetrics(newInfluxDBMetrics()),
 		agentInfo: agentInfo,
 	}
 }
+
+// PrometheusGatherer returns the registry with the mirrored Prometheus
+// metrics, or nil when unavailable.
+func (c *ClientMetrics) PrometheusGatherer() prometheus.Gatherer {
+	if c == nil {
+		return nil
+	}
+	if pm, ok := c.impl.(*prometheusMetrics); ok {
+		return pm.Gatherer()
+	}
+	return nil
+}
diff --git a/client/internal/metrics/prometheus.go b/client/internal/metrics/prometheus.go
new file mode 100644
index 000000000..7f5020ea9
--- /dev/null
+++ b/client/internal/metrics/prometheus.go
@@ -0,0 +1,119 @@
+//go:build !js
+
+package metrics
+
+import (
+	"context"
+	"io"
+	"strconv"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// prometheusMetrics mirrors recorded client metrics into a Prometheus
+// registry for the local /metrics endpoint, then delegates to the wrapped
+// implementation. Export and Reset pass through untouched: Prometheus
+// metrics are cumulative and pull-based.
+type prometheusMetrics struct {
+	next     metricsImplementation
+	registry *prometheus.Registry
+
+	connectionStages  *prometheus.HistogramVec
+	syncDuration      prometheus.Histogram
+	syncPhaseDuration *prometheus.HistogramVec
+	loginDuration     *prometheus.HistogramVec
+}
+
+func newPrometheusMetrics(next metricsImplementation) *prometheusMetrics {
+	connectionBuckets := []float64{.05, .1, .25, .5, 1, 2.5, 5, 10, 30, 60}
+
+	m := &prometheusMetrics{
+		next:     next,
+		registry: prometheus.NewRegistry(),
+		connectionStages: prometheus.NewHistogramVec(prometheus.HistogramOpts{
+			Name:    "netbird_peer_connection_stage_duration_seconds",
+			Help:    "Duration of peer connection establishment stages.",
+			Buckets: connectionBuckets,
+		}, []string{"stage", "connection_type", "attempt_type"}),
+		syncDuration: prometheus.NewHistogram(prometheus.HistogramOpts{
+			Name:    "netbird_sync_duration_seconds",
+			Help:    "Duration of management sync message processing.",
+			Buckets: prometheus.DefBuckets,
+		}),
+		syncPhaseDuration: prometheus.NewHistogramVec(prometheus.HistogramOpts{
+			Name:    "netbird_sync_phase_duration_seconds",
+			Help:    "Duration of individual sync processing phases.",
+			Buckets: prometheus.DefBuckets,
+		}, []string{"phase"}),
+		loginDuration: prometheus.NewHistogramVec(prometheus.HistogramOpts{
+			Name:    "netbird_login_duration_seconds",
+			Help:    "Duration of logins to the management service.",
+			Buckets: prometheus.DefBuckets,
+		}, []string{"success"}),
+	}
+
+	m.registry.MustRegister(m.connectionStages, m.syncDuration, m.syncPhaseDuration, m.loginDuration)
+	return m
+}
+
+// Gatherer returns the registry holding the mirrored metrics.
+func (m *prometheusMetrics) Gatherer() prometheus.Gatherer {
+	return m.registry
+}
+
+// RecordConnectionStages implements metricsImplementation.
+func (m *prometheusMetrics) RecordConnectionStages(
+	ctx context.Context,
+	agentInfo AgentInfo,
+	connectionPairID string,
+	connectionType ConnectionType,
+	isReconnection bool,
+	timestamps ConnectionStageTimestamps,
+) {
+	attempt := attemptType(isReconnection)
+	connType := connectionType.String()
+
+	signalingToConnection, connectionToWgHandshake, total := timestamps.Durations()
+	if signalingToConnection > 0 {
+		m.connectionStages.WithLabelValues("signaling_to_connection", connType, attempt).Observe(signalingToConnection)
+	}
+	if connectionToWgHandshake > 0 {
+		m.connectionStages.WithLabelValues("connection_to_wg_handshake", connType, attempt).Observe(connectionToWgHandshake)
+	}
+	if total > 0 {
+		m.connectionStages.WithLabelValues("total", connType, attempt).Observe(total)
+	}
+
+	m.next.RecordConnectionStages(ctx, agentInfo, connectionPairID, connectionType, isReconnection, timestamps)
+}
+
+// RecordSyncDuration implements metricsImplementation.
+func (m *prometheusMetrics) RecordSyncDuration(ctx context.Context, agentInfo AgentInfo, duration time.Duration) {
+	m.syncDuration.Observe(duration.Seconds())
+	m.next.RecordSyncDuration(ctx, agentInfo, duration)
+}
+
+// RecordSyncPhase implements metricsImplementation.
+func (m *prometheusMetrics) RecordSyncPhase(ctx context.Context, agentInfo AgentInfo, phase string, duration time.Duration) {
+	m.syncPhaseDuration.WithLabelValues(phase).Observe(duration.Seconds())
+	m.next.RecordSyncPhase(ctx, agentInfo, phase, duration)
+}
+
+// RecordLoginDuration implements metricsImplementation.
+func (m *prometheusMetrics) RecordLoginDuration(ctx context.Context, agentInfo AgentInfo, duration time.Duration, success bool) {
+	m.loginDuration.WithLabelValues(strconv.FormatBool(success)).Observe(duration.Seconds())
+	m.next.RecordLoginDuration(ctx, agentInfo, duration, success)
+}
+
+// Export implements metricsImplementation by delegating to the wrapped
+// implementation; Prometheus metrics are pulled via the registry instead.
+func (m *prometheusMetrics) Export(w io.Writer) error {
+	return m.next.Export(w)
+}
+
+// Reset implements metricsImplementation by delegating to the wrapped
+// implementation; Prometheus metrics must not be cleared on push.
+func (m *prometheusMetrics) Reset() {
+	m.next.Reset()
+}
diff --git a/client/internal/mobile_dependency.go b/client/internal/mobile_dependency.go
index 310d61a25..0234432b1 100644
--- a/client/internal/mobile_dependency.go
+++ b/client/internal/mobile_dependency.go
@@ -11,12 +11,14 @@ import (
 
 // MobileDependency collect all dependencies for mobile platform
 type MobileDependency struct {
-	// Android only
-	TunAdapter            device.TunAdapter
-	IFaceDiscover         stdnet.ExternalIFaceDiscover
+	// Android and iOS
 	NetworkChangeListener listener.NetworkChangeListener
-	HostDNSAddresses      []netip.AddrPort
-	DnsReadyListener      dns.ReadyListener
+
+	// Android only
+	TunAdapter       device.TunAdapter
+	IFaceDiscover    stdnet.ExternalIFaceDiscover
+	HostDNSAddresses []netip.AddrPort
+	DnsReadyListener dns.ReadyListener
 
 	//	iOS only
 	DnsManager     dns.IosDnsManager
diff --git a/client/internal/netflow/logger/logger.go b/client/internal/netflow/logger/logger.go
index 8f8e68784..deb38bc4d 100644
--- a/client/internal/netflow/logger/logger.go
+++ b/client/internal/netflow/logger/logger.go
@@ -27,7 +27,7 @@ type Logger struct {
 	wgIfaceNetV6       netip.Prefix
 	dnsCollection      atomic.Bool
 	exitNodeCollection atomic.Bool
-	Store              types.Store
+	Store              types.AggregatingStore
 }
 
 func New(statusRecorder *peer.Status, wgIfaceIPNet, wgIfaceIPNetV6 netip.Prefix) *Logger {
@@ -35,7 +35,7 @@ func New(statusRecorder *peer.Status, wgIfaceIPNet, wgIfaceIPNetV6 netip.Prefix)
 		statusRecorder: statusRecorder,
 		wgIfaceNet:     wgIfaceIPNet,
 		wgIfaceNetV6:   wgIfaceIPNetV6,
-		Store:          store.NewMemoryStore(),
+		Store:          store.NewAggregatingMemoryStore(),
 	}
 }
 
@@ -125,6 +125,10 @@ func (l *Logger) stop() {
 	l.mux.Unlock()
 }
 
+func (l *Logger) ResetAggregationWindow() types.FlowEventAggregator {
+	return l.Store.ResetAggregationWindow()
+}
+
 func (l *Logger) GetEvents() []*types.Event {
 	return l.Store.GetEvents()
 }
diff --git a/client/internal/netflow/manager.go b/client/internal/netflow/manager.go
index eff083dbf..43d61b771 100644
--- a/client/internal/netflow/manager.go
+++ b/client/internal/netflow/manager.go
@@ -9,12 +9,14 @@ import (
 	"sync"
 	"time"
 
+	"github.com/cenkalti/backoff/v4"
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/netbirdio/netbird/client/internal/netflow/conntrack"
 	"github.com/netbirdio/netbird/client/internal/netflow/logger"
+	"github.com/netbirdio/netbird/client/internal/netflow/store"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/flow/client"
@@ -23,14 +25,16 @@ import (
 
 // Manager handles netflow tracking and logging
 type Manager struct {
-	mux            sync.Mutex
-	shutdownWg     sync.WaitGroup
-	logger         nftypes.FlowLogger
-	flowConfig     *nftypes.FlowConfig
-	conntrack      nftypes.ConnTracker
-	receiverClient *client.GRPCClient
-	publicKey      []byte
-	cancel         context.CancelFunc
+	mux               sync.Mutex
+	shutdownWg        sync.WaitGroup
+	logger            nftypes.FlowLogger
+	flowConfig        *nftypes.FlowConfig
+	conntrack         nftypes.ConnTracker
+	receiverClient    *client.GRPCClient
+	eventsWithoutAcks nftypes.Store
+	publicKey         []byte
+	cancel            context.CancelFunc
+	retryInterval     time.Duration
 }
 
 // NewManager creates a new netflow manager
@@ -48,9 +52,11 @@ func NewManager(iface nftypes.IFaceMapper, publicKey []byte, statusRecorder *pee
 	}
 
 	return &Manager{
-		logger:    flowLogger,
-		conntrack: ct,
-		publicKey: publicKey,
+		logger:            flowLogger,
+		conntrack:         ct,
+		publicKey:         publicKey,
+		retryInterval:     time.Second,
+		eventsWithoutAcks: store.NewMemoryStore(),
 	}
 }
 
@@ -66,6 +72,7 @@ func (m *Manager) needsNewClient(previous *nftypes.FlowConfig) bool {
 }
 
 // enableFlow starts components for flow tracking
+// must be called under m.mux lock
 func (m *Manager) enableFlow(previous *nftypes.FlowConfig) error {
 	// first make sender ready so events don't pile up
 	if m.needsNewClient(previous) {
@@ -85,6 +92,7 @@ func (m *Manager) enableFlow(previous *nftypes.FlowConfig) error {
 	return nil
 }
 
+// must be called under m.mux lock
 func (m *Manager) resetClient() error {
 	if m.receiverClient != nil {
 		if err := m.receiverClient.Close(); err != nil {
@@ -107,14 +115,19 @@ func (m *Manager) resetClient() error {
 	ctx, cancel := context.WithCancel(context.Background())
 	m.cancel = cancel
 
-	m.shutdownWg.Add(2)
+	m.shutdownWg.Add(3)
+	flowConfigInterval := m.flowConfig.Interval
 	go func() {
 		defer m.shutdownWg.Done()
-		m.receiveACKs(ctx, flowClient)
+		m.receiveACKs(ctx, flowClient, flowConfigInterval)
 	}()
 	go func() {
 		defer m.shutdownWg.Done()
-		m.startSender(ctx)
+		m.startSender(ctx, flowConfigInterval)
+	}()
+	go func() {
+		defer m.shutdownWg.Done()
+		m.startRetries(ctx, flowConfigInterval)
 	}()
 
 	return nil
@@ -198,8 +211,8 @@ func (m *Manager) GetLogger() nftypes.FlowLogger {
 	return m.logger
 }
 
-func (m *Manager) startSender(ctx context.Context) {
-	ticker := time.NewTicker(m.flowConfig.Interval)
+func (m *Manager) startSender(ctx context.Context, flowConfigInterval time.Duration) {
+	ticker := time.NewTicker(flowConfigInterval)
 	defer ticker.Stop()
 
 	for {
@@ -207,27 +220,29 @@ func (m *Manager) startSender(ctx context.Context) {
 		case <-ctx.Done():
 			return
 		case <-ticker.C:
-			events := m.logger.GetEvents()
+			collectedEvents := m.logger.ResetAggregationWindow()
+			events := collectedEvents.GetAggregatedEvents()
 			for _, event := range events {
+				m.eventsWithoutAcks.StoreEvent(event)
 				if err := m.send(event); err != nil {
 					log.Errorf("failed to send flow event to server: %v", err)
-					continue
+				} else {
+					log.Tracef("sent flow event: %s", event.ID)
 				}
-				log.Tracef("sent flow event: %s", event.ID)
 			}
 		}
 	}
 }
 
-func (m *Manager) receiveACKs(ctx context.Context, client *client.GRPCClient) {
-	err := client.Receive(ctx, m.flowConfig.Interval, func(ack *proto.FlowEventAck) error {
+func (m *Manager) receiveACKs(ctx context.Context, client *client.GRPCClient, flowConfigInterval time.Duration) {
+	err := client.Receive(ctx, flowConfigInterval, func(ack *proto.FlowEventAck) error {
 		id, err := uuid.FromBytes(ack.EventId)
 		if err != nil {
 			log.Warnf("failed to convert ack event id to uuid: %v", err)
 			return nil
 		}
 		log.Tracef("received flow event ack: %s", id)
-		m.logger.DeleteEvents([]uuid.UUID{id})
+		m.eventsWithoutAcks.DeleteEvents([]uuid.UUID{id})
 		return nil
 	})
 
@@ -236,6 +251,51 @@ func (m *Manager) receiveACKs(ctx context.Context, client *client.GRPCClient) {
 	}
 }
 
+// We effectively never drop events (see MaxInterval), which makes eventsWithoutAcks unbounded.
+// We may want to limit the max size of the store, and start dropping oldest events when the threshold is reached.
+func (m *Manager) startRetries(ctx context.Context, flowConfigInterval time.Duration) {
+	timer := time.NewTimer(m.retryInterval)
+	retryBackoff := backoff.WithContext(&backoff.ExponentialBackOff{
+		InitialInterval:     1 * time.Second,
+		RandomizationFactor: 0.5,
+		Multiplier:          1.7,
+		MaxInterval:         flowConfigInterval / 2,
+		MaxElapsedTime:      3 * 30 * 24 * time.Hour, // 3 months
+		Stop:                backoff.Stop,
+		Clock:               backoff.SystemClock,
+	}, ctx)
+	defer timer.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-timer.C:
+			resetBackoff := true
+			for _, e := range m.eventsWithoutAcks.GetEvents() {
+				if e.Timestamp.Add(time.Second).After(time.Now()) {
+					// grace period on retries to avoid early retries
+					// do not retry if the event is less than 1 sec old
+					continue
+				}
+				if err := m.send(e); err != nil {
+					if nextBackoff := retryBackoff.NextBackOff(); nextBackoff != backoff.Stop {
+						timer = time.NewTimer(nextBackoff)
+						resetBackoff = false
+					} else {
+						resetBackoff = true // we exhausted retries, reset retry loop
+					}
+					break
+				}
+			}
+			if resetBackoff { // use regular retry interval in absence of network errors
+				retryBackoff.Reset()
+				timer = time.NewTimer(m.retryInterval)
+			}
+		}
+	}
+}
+
 func (m *Manager) send(event *nftypes.Event) error {
 	m.mux.Lock()
 	client := m.receiverClient
@@ -250,9 +310,11 @@ func (m *Manager) send(event *nftypes.Event) error {
 
 func toProtoEvent(publicKey []byte, event *nftypes.Event) *proto.FlowEvent {
 	protoEvent := &proto.FlowEvent{
-		EventId:   event.ID[:],
-		Timestamp: timestamppb.New(event.Timestamp),
-		PublicKey: publicKey,
+		EventId:     event.ID[:],
+		Timestamp:   timestamppb.New(event.Timestamp),
+		PublicKey:   publicKey,
+		WindowStart: timestamppb.New(event.WindowStart),
+		WindowEnd:   timestamppb.New(event.WindowEnd),
 		FlowFields: &proto.FlowFields{
 			FlowId:           event.FlowID[:],
 			RuleId:           event.RuleID,
@@ -267,6 +329,9 @@ func toProtoEvent(publicKey []byte, event *nftypes.Event) *proto.FlowEvent {
 			TxBytes:          event.TxBytes,
 			SourceResourceId: event.SourceResourceID,
 			DestResourceId:   event.DestResourceID,
+			NumOfStarts:      event.NumOfStarts,
+			NumOfEnds:        event.NumOfEnds,
+			NumOfDrops:       event.NumOfDrops,
 		},
 	}
 
diff --git a/client/internal/netflow/manager_integration_test.go b/client/internal/netflow/manager_integration_test.go
new file mode 100644
index 000000000..9029bdda2
--- /dev/null
+++ b/client/internal/netflow/manager_integration_test.go
@@ -0,0 +1,291 @@
+package netflow
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/internal/netflow/types"
+	"github.com/netbirdio/netbird/flow/proto"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"google.golang.org/grpc"
+)
+
+type testServer struct {
+	proto.UnimplementedFlowServiceServer
+	events         chan *proto.FlowEvent
+	acks           chan *proto.FlowEventAck
+	grpcSrv        *grpc.Server
+	addr           string
+	handlerDone    chan struct{} // signaled each time Events() exits
+	handlerStarted chan struct{} // signaled each time Events() begins
+}
+
+func newTestServer(t *testing.T) *testServer {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	s := &testServer{
+		events:         make(chan *proto.FlowEvent, 100),
+		acks:           make(chan *proto.FlowEventAck, 100),
+		grpcSrv:        grpc.NewServer(),
+		addr:           listener.Addr().String(),
+		handlerDone:    make(chan struct{}, 10),
+		handlerStarted: make(chan struct{}, 10),
+	}
+
+	proto.RegisterFlowServiceServer(s.grpcSrv, s)
+
+	go func() {
+		if err := s.grpcSrv.Serve(listener); err != nil && !errors.Is(err, grpc.ErrServerStopped) {
+			t.Logf("server error: %v", err)
+		}
+	}()
+
+	t.Cleanup(func() {
+		s.grpcSrv.Stop()
+	})
+
+	return s
+}
+
+func (s *testServer) Events(stream proto.FlowService_EventsServer) error {
+	defer func() {
+		select {
+		case s.handlerDone <- struct{}{}:
+		default:
+		}
+	}()
+
+	err := stream.Send(&proto.FlowEventAck{IsInitiator: true})
+	if err != nil {
+		return err
+	}
+
+	select {
+	case s.handlerStarted <- struct{}{}:
+	default:
+	}
+
+	ctx, cancel := context.WithCancel(stream.Context())
+	defer cancel()
+
+	go func() {
+		defer cancel()
+		for {
+			event, err := stream.Recv()
+			if err != nil {
+				return
+			}
+
+			if !event.IsInitiator {
+				select {
+				case s.events <- event:
+				case <-ctx.Done():
+					return
+				}
+			}
+		}
+	}()
+
+	for {
+		select {
+		case ack := <-s.acks:
+			if err := stream.Send(ack); err != nil {
+				return err
+			}
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+}
+
+func TestSendEventReceiveAck(t *testing.T) {
+	_, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	t.Cleanup(cancel)
+
+	server := newTestServer(t)
+	manager := createManager(t, server.addr, 60*time.Second) // set high to prevent retries in this test
+	defer manager.Close()
+
+	assert.Eventually(t, func() bool {
+		select {
+		case <-server.handlerStarted:
+			return true
+		default:
+			return false
+		}
+	}, 3*time.Second, 100*time.Millisecond)
+
+	event1 := types.EventFields{
+		FlowID:    uuid.New(),
+		Type:      types.TypeStart,
+		Direction: types.Ingress,
+		DestIP:    ipAddr("172.16.1.2"),
+		DestPort:  2345,
+		Protocol:  6,
+	}
+	manager.logger.StoreEvent(event1)
+	event2 := types.EventFields{
+		FlowID:    uuid.New(),
+		Type:      types.TypeStart,
+		Direction: types.Ingress,
+		DestIP:    ipAddr("172.16.1.1"),
+		DestPort:  1234,
+		Protocol:  6,
+	}
+	manager.logger.StoreEvent(event2)
+
+	// verify the server received logged events
+	serverSideEvents := make([]*proto.FlowEvent, 0)
+	assert.Eventually(t, func() bool {
+		select {
+		case event := <-server.events:
+			serverSideEvents = append(serverSideEvents, event)
+			if len(serverSideEvents) == 2 {
+				return true
+			}
+		default:
+			if len(serverSideEvents) == 2 {
+				return true
+			}
+		}
+		return false
+	}, 5*time.Second, 100*time.Millisecond)
+
+	serverSideFlowIds := make([]uuid.UUID, 0, 2)
+	slices.Values(serverSideEvents)(func(e *proto.FlowEvent) bool {
+		id, err := uuid.FromBytes(e.FlowFields.FlowId)
+		assert.NoError(t, err)
+		serverSideFlowIds = append(serverSideFlowIds, id)
+		return true
+	})
+	assert.ElementsMatch(t, []uuid.UUID{event1.FlowID, event2.FlowID}, serverSideFlowIds)
+
+	// verify the manager tracks un-acked events
+	unackedEvents := manager.eventsWithoutAcks.GetEvents()
+	assert.Len(t, unackedEvents, 2)
+	flowIds := make([]uuid.UUID, 0)
+	slices.Values(unackedEvents)(func(e *types.Event) bool {
+		flowIds = append(flowIds, e.FlowID)
+		return true
+	})
+	assert.ElementsMatch(t, flowIds, []uuid.UUID{event1.FlowID, event2.FlowID})
+}
+
+// verify handling of retries:
+//   - unacked events are retried
+//   - when acks arrive, events are removed from the un-acked event tracker
+func TestRetryEvents(t *testing.T) {
+	_, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	t.Cleanup(cancel)
+
+	server := newTestServer(t)
+	manager := createManager(t, server.addr, time.Second) // set low to start retries sooner
+	defer manager.Close()
+
+	assert.Eventually(t, func() bool {
+		select {
+		case <-server.handlerStarted:
+			return true
+		default:
+			return false
+		}
+	}, 3*time.Second, 100*time.Millisecond)
+
+	event1 := types.EventFields{
+		FlowID:    uuid.New(),
+		Type:      types.TypeStart,
+		Direction: types.Ingress,
+		DestIP:    ipAddr("172.16.1.2"),
+		DestPort:  2345,
+		Protocol:  6,
+	}
+	manager.logger.StoreEvent(event1)
+	event2 := types.EventFields{
+		FlowID:    uuid.New(),
+		Type:      types.TypeStart,
+		Direction: types.Ingress,
+		DestIP:    ipAddr("172.16.1.1"),
+		DestPort:  1234,
+		Protocol:  6,
+	}
+	manager.logger.StoreEvent(event2)
+
+	// verify the server received retries of logged events
+	serverSideEvents := make([]*proto.FlowEvent, 0)
+	func() {
+		c := time.After(2500 * time.Millisecond)
+		for {
+			select {
+			case event := <-server.events:
+				serverSideEvents = append(serverSideEvents, event)
+			case <-c:
+				return
+			}
+		}
+	}()
+	assert.True(t, len(serverSideEvents) > 2) // must see retries
+
+	uniqueServerSideEvents := make(map[uuid.UUID]*proto.FlowEvent)
+	slices.Values(serverSideEvents)(func(e *proto.FlowEvent) bool {
+		id, err := uuid.FromBytes(e.FlowFields.FlowId)
+		assert.NoError(t, err)
+		uniqueServerSideEvents[id] = e
+		return true
+	})
+	assert.Contains(t, uniqueServerSideEvents, event1.FlowID)
+	assert.Contains(t, uniqueServerSideEvents, event2.FlowID)
+
+	// ack events
+	server.acks <- &proto.FlowEventAck{EventId: uniqueServerSideEvents[event1.FlowID].EventId}
+	server.acks <- &proto.FlowEventAck{EventId: uniqueServerSideEvents[event2.FlowID].EventId}
+
+	assert.EventuallyWithT(t, func(c *assert.CollectT) {
+		unackedEvents := manager.eventsWithoutAcks.GetEvents()
+		assert.Empty(c, unackedEvents)
+
+	}, 3*time.Second, 100*time.Millisecond)
+}
+
+func createManager(t *testing.T, serverAddr string, retryInterval time.Duration) *Manager {
+	t.Helper()
+
+	mockIFace := &mockIFaceMapper{
+		address: wgaddr.Address{
+			Network: netip.MustParsePrefix("192.168.1.1/32"),
+		},
+		isUserspaceBind: true,
+	}
+
+	publicKey := []byte("test-public-key")
+	manager := NewManager(mockIFace, publicKey, nil)
+	manager.retryInterval = retryInterval
+
+	initialConfig := &types.FlowConfig{
+		Enabled:        true,
+		URL:            fmt.Sprintf("http://%s", serverAddr),
+		TokenPayload:   "initial-payload",
+		TokenSignature: "initial-signature",
+		Interval:       500 * time.Millisecond,
+	}
+
+	err := manager.Update(initialConfig)
+	require.NoError(t, err)
+
+	return manager
+}
+
+func ipAddr(a string) netip.Addr {
+	addr, _ := netip.ParseAddr(a)
+	return addr
+}
diff --git a/client/internal/netflow/store/event_aggregation_test.go b/client/internal/netflow/store/event_aggregation_test.go
new file mode 100644
index 000000000..8abe0d162
--- /dev/null
+++ b/client/internal/netflow/store/event_aggregation_test.go
@@ -0,0 +1,365 @@
+package store
+
+import (
+	"math/rand"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/netbirdio/netbird/client/internal/netflow/types"
+	"github.com/stretchr/testify/assert"
+)
+
+var random = rand.New(rand.NewSource(time.Now().UnixNano()))
+
+func TestFlowAggregation(t *testing.T) {
+	var protocols = []types.Protocol{types.ICMP, types.ICMPv6, types.TCP, types.UDP}
+	var tests = []struct {
+		description string
+		addresses   [][]netip.Addr
+		dstPort     uint16
+		eventTypes  []types.Type
+	}{
+		{
+			description: "start and stop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart, types.TypeEnd},
+		},
+		{
+			description: "start and drop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart, types.TypeDrop},
+		},
+		{
+			description: "start only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart},
+		},
+		{
+			description: "drop only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeDrop},
+		}}
+
+	for _, protocol := range protocols {
+		for _, tt := range tests {
+			t.Run(tt.description+" "+protocol.String(), func(t *testing.T) {
+				store := NewAggregatingMemoryStore()
+				store.WindowEnd = time.Now().Add(5 * time.Second)
+
+				allExpected := make([]*types.Event, 0)
+
+				for _, srcAndDst := range tt.addresses {
+					inEvents, expected := generateEvents(srcAndDst[0], srcAndDst[1], tt.dstPort, tt.eventTypes, protocol, types.Ingress, 0, store.WindowStart, store.WindowEnd)
+					for _, e := range inEvents {
+						store.StoreEvent(e)
+					}
+					allExpected = append(allExpected, expected)
+				}
+
+				events := store.GetAggregatedEvents()
+				assert.ElementsMatch(t, events, allExpected)
+			})
+		}
+	}
+}
+
+func TestIcmpEventAggregation(t *testing.T) {
+	var protocols = []types.Protocol{types.ICMP, types.ICMPv6}
+	var icmpTypes = []uint8{1, 2, 3}
+
+	var tests = []struct {
+		description string
+		addresses   [][]netip.Addr
+		eventTypes  []types.Type
+	}{
+		{
+			description: "start and stop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
+			eventTypes:  []types.Type{types.TypeStart, types.TypeEnd},
+		},
+		{
+			description: "start and drop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
+			eventTypes:  []types.Type{types.TypeStart, types.TypeDrop},
+		},
+		{
+			description: "start only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
+			eventTypes:  []types.Type{types.TypeStart},
+		},
+		{
+			description: "drop only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
+			eventTypes:  []types.Type{types.TypeDrop},
+		}}
+
+	for _, protocol := range protocols {
+		for _, tt := range tests {
+			t.Run(tt.description+" "+protocol.String(), func(t *testing.T) {
+				store := NewAggregatingMemoryStore()
+				store.WindowEnd = time.Now().Add(5 * time.Second)
+
+				allExpected := make([]*types.Event, 0)
+				for _, icmpType := range icmpTypes {
+					events, expected := generateEvents(tt.addresses[0][0], tt.addresses[0][1], 0, tt.eventTypes, protocol, types.Ingress, icmpType, store.WindowStart, store.WindowEnd)
+					for _, e := range events {
+						store.StoreEvent(e)
+					}
+					allExpected = append(allExpected, expected)
+				}
+				aggregatedEvents := store.GetAggregatedEvents()
+				assert.Len(t, aggregatedEvents, len(allExpected))
+				assert.ElementsMatch(t, aggregatedEvents, allExpected)
+			})
+		}
+	}
+}
+
+func TestFlowAggregationOfUnknownProtocols(t *testing.T) {
+	var tests = []struct {
+		description string
+		addresses   [][]netip.Addr
+		dstPort     uint16
+		eventTypes  []types.Type
+	}{
+		{
+			description: "start and stop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart, types.TypeEnd},
+		},
+		{
+			description: "start and drop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart, types.TypeDrop},
+		},
+		{
+			description: "start only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart},
+		},
+		{
+			description: "drop only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeDrop},
+		}}
+
+	for _, tt := range tests {
+		t.Run(tt.description+" "+types.ProtocolUnknown.String(), func(t *testing.T) {
+			store := NewAggregatingMemoryStore()
+			store.WindowEnd = time.Now().Add(5 * time.Second)
+
+			allExpected := make([]*types.Event, 0)
+
+			for _, srcAndDst := range tt.addresses {
+				inEvents, expected := generateEventsForUnknownProtocol(srcAndDst[0], srcAndDst[1], tt.dstPort, tt.eventTypes, types.ProtocolUnknown, types.Ingress, store.WindowStart, store.WindowEnd)
+				for _, e := range inEvents {
+					store.StoreEvent(e)
+				}
+				allExpected = append(allExpected, expected...)
+			}
+
+			events := store.GetAggregatedEvents()
+			assert.ElementsMatch(t, events, allExpected)
+		})
+	}
+}
+
+func TestResetAggregationWindow(t *testing.T) {
+	now := time.Now()
+	nowFunc := func() time.Time { return now }
+	store := NewAggregatingMemoryStoreWithTimeFunc(nowFunc)
+	store.StoreEvent(&types.Event{
+		ID:        uuid.New(),
+		Timestamp: time.Now(),
+		EventFields: types.EventFields{
+			FlowID:           uuid.New(),
+			Type:             types.TypeStart,
+			Protocol:         types.TCP,
+			RuleID:           []byte("rule-id-1"),
+			Direction:        types.Ingress,
+			SourceIP:         netip.MustParseAddr("1.1.1.1"),
+			SourcePort:       1234,
+			DestIP:           netip.MustParseAddr("2.2.2.2"),
+			DestPort:         5678,
+			SourceResourceID: []byte("source-resource-id"),
+			DestResourceID:   []byte("dest-resource-id"),
+			RxPackets:        random.Uint64(),
+			TxPackets:        random.Uint64(),
+			RxBytes:          random.Uint64(),
+			TxBytes:          random.Uint64(),
+		},
+	})
+
+	now = now.Add(1 * time.Second)
+	reset := store.ResetAggregationWindow()
+	previousEvents, ok := reset.(*AggregatingMemory)
+	assert.True(t, ok)
+	assert.NotEqual(t, previousEvents.WindowStart, store.WindowStart)
+	assert.Equal(t, previousEvents.WindowEnd, store.WindowStart)
+	assert.NotEmpty(t, previousEvents.events)
+	assert.Empty(t, store.events)
+}
+
+func generateEvents(srcIp, dstIp netip.Addr, dstPort uint16, eventTypes []types.Type, protocol types.Protocol,
+	direction types.Direction, icmpType uint8, windowStart, windowEnd time.Time) ([]*types.Event, *types.Event) {
+	var rxPackets, txPackets, rxBytes, txBytes uint64
+	inEvents := make([]*types.Event, 0)
+	ts := time.Now()
+	flowId := uuid.New()
+	srcPort := uint16(random.Uint32() >> 16)
+
+	for idx, eventType := range eventTypes {
+		e := &types.Event{
+			ID:        uuid.New(),
+			Timestamp: ts.Add(time.Duration(idx) * time.Second),
+			EventFields: types.EventFields{
+				FlowID:           flowId,
+				Type:             eventType,
+				Protocol:         protocol,
+				RuleID:           []byte("rule-id-1"),
+				Direction:        direction,
+				SourceIP:         srcIp,
+				SourcePort:       srcPort,
+				DestIP:           dstIp,
+				DestPort:         dstPort,
+				SourceResourceID: []byte("source-resource-id"),
+				DestResourceID:   []byte("dest-resource-id"),
+				RxPackets:        random.Uint64(),
+				TxPackets:        random.Uint64(),
+				RxBytes:          random.Uint64(),
+				TxBytes:          random.Uint64(),
+			}}
+		rxBytes += e.RxBytes
+		txBytes += e.TxBytes
+		rxPackets += e.RxPackets
+		txPackets += e.TxPackets
+		inEvents = append(inEvents, e)
+		if protocol == types.ICMP || protocol == types.ICMPv6 {
+			e.ICMPType = icmpType
+		}
+	}
+
+	var start, end, drop uint64
+	for _, eventType := range eventTypes {
+		switch eventType {
+		case types.TypeStart:
+			start += 1
+		case types.TypeDrop:
+			drop += 1
+		case types.TypeEnd:
+			end += 1
+		}
+	}
+	aggregatedEvent := &types.Event{
+		ID:          inEvents[0].ID,
+		Timestamp:   inEvents[0].Timestamp,
+		WindowStart: windowStart,
+		WindowEnd:   windowEnd,
+		EventFields: types.EventFields{
+			FlowID:           flowId,
+			Type:             types.TypeUnknown,
+			Protocol:         inEvents[0].Protocol,
+			RuleID:           []byte("rule-id-1"),
+			Direction:        inEvents[0].Direction,
+			SourceIP:         srcIp,
+			SourcePort:       srcPort,
+			DestIP:           dstIp,
+			DestPort:         dstPort,
+			SourceResourceID: []byte("source-resource-id"),
+			DestResourceID:   []byte("dest-resource-id"),
+			RxPackets:        rxPackets,
+			TxPackets:        txPackets,
+			RxBytes:          rxBytes,
+			TxBytes:          txBytes,
+			NumOfStarts:      start,
+			NumOfEnds:        end,
+			NumOfDrops:       drop,
+		}}
+	if protocol == types.ICMP || protocol == types.ICMPv6 {
+		aggregatedEvent.ICMPType = icmpType
+	}
+
+	return inEvents, aggregatedEvent
+}
+
+func generateEventsForUnknownProtocol(srcIp, dstIp netip.Addr, dstPort uint16, eventTypes []types.Type, protocol types.Protocol,
+	direction types.Direction, windowStart, windowEnd time.Time) ([]*types.Event, []*types.Event) {
+	inEvents := make([]*types.Event, 0)
+	expectedEvents := make([]*types.Event, 0)
+
+	ts := time.Now()
+	flowId := uuid.New()
+	srcPort := uint16(random.Uint32() >> 16)
+
+	for idx, eventType := range eventTypes {
+		e := &types.Event{
+			ID:        uuid.New(),
+			Timestamp: ts.Add(time.Duration(idx) * time.Second),
+			EventFields: types.EventFields{
+				FlowID:           flowId,
+				Type:             eventType,
+				Protocol:         protocol,
+				RuleID:           []byte("rule-id-1"),
+				Direction:        direction,
+				SourceIP:         srcIp,
+				SourcePort:       srcPort,
+				DestIP:           dstIp,
+				DestPort:         dstPort,
+				SourceResourceID: []byte("source-resource-id"),
+				DestResourceID:   []byte("dest-resource-id"),
+				RxPackets:        random.Uint64(),
+				TxPackets:        random.Uint64(),
+				RxBytes:          random.Uint64(),
+				TxBytes:          random.Uint64(),
+			}}
+		inEvents = append(inEvents, e)
+
+		var start, end, drop uint64
+		switch eventType {
+		case types.TypeStart:
+			start = 1
+		case types.TypeDrop:
+			drop = 1
+		case types.TypeEnd:
+			end = 1
+		}
+
+		expectedEvents = append(expectedEvents, &types.Event{
+			ID:          e.ID,
+			Timestamp:   e.Timestamp,
+			WindowStart: windowStart,
+			WindowEnd:   windowEnd,
+			EventFields: types.EventFields{
+				FlowID:           flowId,
+				Type:             types.TypeUnknown,
+				Protocol:         e.Protocol,
+				RuleID:           []byte("rule-id-1"),
+				Direction:        e.Direction,
+				SourceIP:         srcIp,
+				SourcePort:       srcPort,
+				DestIP:           dstIp,
+				DestPort:         dstPort,
+				SourceResourceID: []byte("source-resource-id"),
+				DestResourceID:   []byte("dest-resource-id"),
+				RxPackets:        e.RxPackets,
+				TxPackets:        e.TxPackets,
+				RxBytes:          e.RxBytes,
+				TxBytes:          e.TxBytes,
+				NumOfStarts:      start,
+				NumOfEnds:        end,
+				NumOfDrops:       drop,
+			}})
+	}
+
+	return inEvents, expectedEvents
+}
diff --git a/client/internal/netflow/store/memory.go b/client/internal/netflow/store/memory.go
index a44505e96..dfe764032 100644
--- a/client/internal/netflow/store/memory.go
+++ b/client/internal/netflow/store/memory.go
@@ -1,10 +1,15 @@
 package store
 
 import (
+	"maps"
+	"math/rand"
+	v2 "math/rand/v2"
+	"net/netip"
+	"slices"
 	"sync"
+	"time"
 
 	"github.com/google/uuid"
-
 	"github.com/netbirdio/netbird/client/internal/netflow/types"
 )
 
@@ -19,6 +24,14 @@ type Memory struct {
 	events map[uuid.UUID]*types.Event
 }
 
+type AggregatingMemory struct {
+	Memory
+	WindowStart time.Time
+	WindowEnd   time.Time
+	rnd         *v2.PCG
+	nowFunc     func() time.Time
+}
+
 func (m *Memory) StoreEvent(event *types.Event) {
 	m.mux.Lock()
 	defer m.mux.Unlock()
@@ -48,3 +61,104 @@ func (m *Memory) DeleteEvents(ids []uuid.UUID) {
 		delete(m.events, id)
 	}
 }
+
+func NewAggregatingMemoryStore() *AggregatingMemory {
+	return NewAggregatingMemoryStoreWithTimeFunc(defaultNowFunc)
+}
+
+// used in tests when deterministic (less random) time intervals are required
+func NewAggregatingMemoryStoreWithTimeFunc(nowFunc func() time.Time) *AggregatingMemory {
+	return &AggregatingMemory{WindowStart: nowFunc(), Memory: Memory{events: make(map[uuid.UUID]*types.Event)}, nowFunc: nowFunc, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
+}
+
+func (am *AggregatingMemory) ResetAggregationWindow() types.FlowEventAggregator {
+	am.mux.Lock()
+	defer am.mux.Unlock()
+
+	now := am.nowFunc()
+	toret := AggregatingMemory{WindowStart: am.WindowStart, WindowEnd: now, Memory: Memory{events: am.events}, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
+
+	am.events = make(map[uuid.UUID]*types.Event)
+	am.WindowStart = now
+
+	return &toret
+}
+
+type aggregationKey struct {
+	srcAddr   netip.Addr
+	destAddr  netip.Addr
+	destPort  uint16
+	direction int
+	protocol  uint8
+	icmpType  uint8
+	unique    uint64 // used to prevent aggregation on non icmp/udp/tcp events
+}
+
+func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event {
+	am.mux.Lock()
+	defer am.mux.Unlock()
+
+	aggregated := make(map[aggregationKey]*types.Event)
+	for _, v := range am.events {
+		lookupKey := aggregationKey{srcAddr: v.SourceIP, destAddr: v.DestIP, destPort: v.DestPort, direction: int(v.Direction), protocol: uint8(v.Protocol), icmpType: v.ICMPType}
+		if _, ok := aggregated[lookupKey]; !ok {
+			event := v.Clone()
+
+			switch event.Type {
+			case types.TypeStart:
+				event.NumOfStarts += 1
+			case types.TypeDrop:
+				event.NumOfDrops += 1
+			case types.TypeEnd:
+				event.NumOfEnds += 1
+			}
+			event.Type = types.TypeUnknown
+
+			// Please note that ICMPCode field isn't propagated by the manager (see flow/proto/flow.pb.go, FlowFields struct)
+			// so the field value in an icmp event in the "aggregated" doesn't matter
+
+			event.WindowStart = am.WindowStart
+			event.WindowEnd = am.WindowEnd
+
+			if event.Protocol != types.ICMP && event.Protocol != types.ICMPv6 && event.Protocol != types.UDP && event.Protocol != types.TCP {
+				lookupKey.unique = am.rnd.Uint64() // to make the lookup key unique so we don't aggregate on it
+			}
+
+			aggregated[lookupKey] = event
+			continue
+		}
+
+		aggregatedEvent := aggregated[lookupKey]
+		if aggregatedEvent.Protocol != types.ICMP && aggregatedEvent.Protocol != types.ICMPv6 && aggregatedEvent.Protocol != types.UDP && aggregatedEvent.Protocol != types.TCP {
+			continue // we don't aggregate this type of events; shouldn't ever get here
+		}
+
+		// track the number of connections, duration?, open and close events?
+		aggregatedEvent.RxBytes += v.RxBytes
+		aggregatedEvent.RxPackets += v.RxPackets
+		aggregatedEvent.TxBytes += v.TxBytes
+		aggregatedEvent.TxPackets += v.TxPackets
+		switch v.Type {
+		case types.TypeStart:
+			aggregatedEvent.NumOfStarts += 1
+		case types.TypeDrop:
+			aggregatedEvent.NumOfDrops += 1
+		case types.TypeEnd:
+			aggregatedEvent.NumOfEnds += 1
+		}
+		if aggregatedEvent.Timestamp.Compare(v.Timestamp) > 0 {
+			aggregatedEvent.Timestamp = v.Timestamp
+			aggregatedEvent.ID = v.ID
+			aggregatedEvent.SourcePort = v.SourcePort
+		}
+		if len(aggregatedEvent.RuleID) == 0 && len(v.RuleID) != 0 {
+			aggregatedEvent.RuleID = slices.Clone(v.RuleID)
+		}
+	}
+
+	return slices.Collect(maps.Values(aggregated)) // could return an iterator instead here
+}
+
+func defaultNowFunc() time.Time {
+	return time.Now()
+}
diff --git a/client/internal/netflow/types/types.go b/client/internal/netflow/types/types.go
index 3f7d0d0ad..ccb2da66b 100644
--- a/client/internal/netflow/types/types.go
+++ b/client/internal/netflow/types/types.go
@@ -2,6 +2,7 @@ package types
 
 import (
 	"net/netip"
+	"slices"
 	"strconv"
 	"time"
 
@@ -69,8 +70,10 @@ const (
 )
 
 type Event struct {
-	ID        uuid.UUID
-	Timestamp time.Time
+	ID          uuid.UUID
+	Timestamp   time.Time
+	WindowStart time.Time
+	WindowEnd   time.Time
 	EventFields
 }
 
@@ -92,6 +95,17 @@ type EventFields struct {
 	TxPackets        uint64
 	RxBytes          uint64
 	TxBytes          uint64
+	NumOfStarts      uint64
+	NumOfEnds        uint64
+	NumOfDrops       uint64
+}
+
+func (e *Event) Clone() *Event {
+	toret := *e
+	toret.RuleID = slices.Clone(e.RuleID)
+	toret.SourceResourceID = slices.Clone(e.SourceResourceID)
+	toret.DestResourceID = slices.Clone(e.DestResourceID)
+	return &toret
 }
 
 type FlowConfig struct {
@@ -114,13 +128,15 @@ type FlowManager interface {
 	GetLogger() FlowLogger
 }
 
+type FlowEventAggregator interface {
+	ResetAggregationWindow() FlowEventAggregator
+	GetAggregatedEvents() []*Event
+}
+
 type FlowLogger interface {
+	ResetAggregationWindow() FlowEventAggregator
 	// StoreEvent stores a flow event
 	StoreEvent(flowEvent EventFields)
-	// GetEvents returns all stored events
-	GetEvents() []*Event
-	// DeleteEvents deletes events from the store
-	DeleteEvents([]uuid.UUID)
 	// Close closes the logger
 	Close()
 	// Enable enables the flow logger receiver
@@ -140,6 +156,11 @@ type Store interface {
 	Close()
 }
 
+type AggregatingStore interface {
+	FlowEventAggregator
+	Store
+}
+
 // ConnTracker defines the interface for connection tracking functionality
 type ConnTracker interface {
 	// Start begins tracking connections by listening for conntrack events.
diff --git a/client/internal/networkmonitor/check_change_linux.go b/client/internal/networkmonitor/check_change_linux.go
index efd8b5884..4fbff4448 100644
--- a/client/internal/networkmonitor/check_change_linux.go
+++ b/client/internal/networkmonitor/check_change_linux.go
@@ -6,6 +6,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net"
 	"syscall"
 
 	log "github.com/sirupsen/logrus"
@@ -35,7 +36,7 @@ func checkChange(ctx context.Context, nexthopv4, nexthopv6 systemops.Nexthop) er
 		// handle route changes
 		case route := <-routeChan:
 			// default route and main table
-			if route.Dst != nil || route.Table != syscall.RT_TABLE_MAIN {
+			if !isDefaultRoute(route.Dst) || route.Table != syscall.RT_TABLE_MAIN {
 				continue
 			}
 			switch route.Type {
@@ -52,3 +53,13 @@ func checkChange(ctx context.Context, nexthopv4, nexthopv6 systemops.Nexthop) er
 		}
 	}
 }
+
+// isDefaultRoute reports whether dst is a default route. netlink v1.3 reports
+// the default as 0.0.0.0/0 or ::/0, older versions as a nil Dst.
+func isDefaultRoute(dst *net.IPNet) bool {
+	if dst == nil {
+		return true
+	}
+	ones, _ := dst.Mask.Size()
+	return ones == 0
+}
diff --git a/client/internal/networkmonitor/check_change_linux_test.go b/client/internal/networkmonitor/check_change_linux_test.go
new file mode 100644
index 000000000..13e1c9e6d
--- /dev/null
+++ b/client/internal/networkmonitor/check_change_linux_test.go
@@ -0,0 +1,43 @@
+//go:build !android
+
+package networkmonitor
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsDefaultRoute(t *testing.T) {
+	mustCIDR := func(s string) *net.IPNet {
+		t.Helper()
+		_, n, err := net.ParseCIDR(s)
+		if err != nil {
+			t.Fatalf("parse %s: %v", s, err)
+		}
+		return n
+	}
+
+	tests := []struct {
+		name string
+		dst  *net.IPNet
+		want bool
+	}{
+		// netlink before v1.3 left Dst nil for the default route.
+		{name: "nil dst", dst: nil, want: true},
+		// netlink v1.3 reports the default route with an explicit zero-length prefix.
+		{name: "v4 default", dst: mustCIDR("0.0.0.0/0"), want: true},
+		{name: "v6 default", dst: mustCIDR("::/0"), want: true},
+		// The exit node split routes and ordinary prefixes are not defaults.
+		{name: "v4 split half", dst: mustCIDR("0.0.0.0/1"), want: false},
+		{name: "v4 subnet", dst: mustCIDR("10.0.0.0/8"), want: false},
+		{name: "v4 host", dst: mustCIDR("1.1.1.1/32"), want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isDefaultRoute(tt.dst), "default route detection")
+		})
+	}
+}
diff --git a/client/internal/peer/conn.go b/client/internal/peer/conn.go
index fb468696f..b8a32b0cb 100644
--- a/client/internal/peer/conn.go
+++ b/client/internal/peer/conn.go
@@ -26,10 +26,16 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
+	"github.com/netbirdio/netbird/client/netevents"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
 
+// wgTimeoutEscalationThreshold is the number of consecutive WireGuard
+// handshake timeouts after which the rosenpass state for the peer is
+// considered desynced and gets reset.
+const wgTimeoutEscalationThreshold = 3
+
 // MetricsRecorder is an interface for recording peer connection metrics
 type MetricsRecorder interface {
 	RecordConnectionStages(
@@ -88,6 +94,10 @@ type ConnConfig struct {
 
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config
+
+	// NetMgr gates the reconnection guard on OS-reported network
+	// availability; nil disables gating.
+	NetMgr *netevents.Manager
 }
 
 type Conn struct {
@@ -118,13 +128,17 @@ type Conn struct {
 	wgWatcher       *WGWatcher
 	wgWatcherWg     sync.WaitGroup
 	wgWatcherCancel context.CancelFunc
+	// wgTimeouts counts consecutive WireGuard handshake timeouts without a
+	// successful handshake in between. Guarded by mu.
+	wgTimeouts int
 
 	// used to store the remote Rosenpass key for Relayed connection in case of connection update from ice
 	rosenpassRemoteKey []byte
 
-	wgProxyICE   wgproxy.Proxy
-	wgProxyRelay wgproxy.Proxy
-	handshaker   *Handshaker
+	wgProxyICE     wgproxy.Proxy
+	wgProxyRelay   wgproxy.Proxy
+	relayedConnRef *relayClient.Conn
+	handshaker     *Handshaker
 
 	guard *guard.Guard
 	wg    sync.WaitGroup
@@ -195,7 +209,6 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 		statusICE:          worker.NewAtomicStatus(),
 		dumpState:          dumpState,
 		endpointUpdater:    NewEndpointUpdater(connLog, config.WgConfig, isController(config)),
-		wgWatcher:          NewWGWatcher(connLog, config.WgConfig.WgInterface, config.Key, dumpState),
 		metricsRecorder:    services.MetricsRecorder,
 	}
 
@@ -247,7 +260,7 @@ func (conn *Conn) open(engineCtx context.Context, firstPacket []byte) error {
 		conn.handshaker.AddICEListener(conn.workerICE.OnNewOffer)
 	}
 
-	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher)
+	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher, conn.config.NetMgr)
 
 	conn.wg.Add(1)
 	go func() {
@@ -300,6 +313,8 @@ func (conn *Conn) Close(signalToRemote bool) {
 
 	if conn.wgWatcherCancel != nil {
 		conn.wgWatcherCancel()
+		conn.wgWatcher = nil
+		conn.wgWatcherCancel = nil
 	}
 	conn.workerRelay.CloseConn()
 	if conn.workerICE != nil {
@@ -326,7 +341,7 @@ func (conn *Conn) Close(signalToRemote bool) {
 		conn.Log.Errorf("failed to remove wg endpoint: %v", err)
 	}
 
-	if conn.evalStatus() == StatusConnected && conn.onDisconnected != nil {
+	if conn.onDisconnected != nil {
 		conn.onDisconnected(conn.config.WgConfig.RemoteKey)
 	}
 
@@ -431,7 +446,7 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 		conn.dumpState.NewLocalProxy()
 		wgProxy, err = conn.newProxy(iceConnInfo.RemoteConn)
 		if err != nil {
-			conn.Log.Errorf("failed to add turn net.Conn to local proxy: %v", err)
+			conn.Log.Errorf("failed to add relayed net.Conn to local proxy: %v", err)
 			return
 		}
 		ep = wgProxy.EndpointAddr()
@@ -546,7 +561,7 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
-	if conn.ctx.Err() != nil {
+	if conn.ctx.Err() != nil || rci.relayedConn.Context().Err() != nil {
 		if err := rci.relayedConn.Close(); err != nil {
 			conn.Log.Warnf("failed to close unnecessary relayed connection: %v", err)
 		}
@@ -561,7 +576,9 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 		conn.Log.Errorf("failed to add relayed net.Conn to local proxy: %v", err)
 		return
 	}
-	wgProxy.SetDisconnectListener(conn.onRelayDisconnected)
+	wgProxy.SetDisconnectListener(func() {
+		conn.onRelayDisconnected(rci.relayedConn)
+	})
 
 	conn.dumpState.NewLocalProxy()
 
@@ -569,7 +586,7 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 
 	if conn.isICEActive() {
 		conn.Log.Debugf("do not switch to relay because current priority is: %s", conn.currentConnPriority.String())
-		conn.setRelayedProxy(wgProxy)
+		conn.setRelayedProxy(wgProxy, rci.relayedConn)
 		conn.statusRelay.SetConnected()
 		conn.updateRelayStatus(rci.relayedConn.RemoteAddr().String(), rci.rosenpassPubKey, time.Now())
 		return
@@ -600,15 +617,26 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 	conn.rosenpassRemoteKey = rci.rosenpassPubKey
 	conn.currentConnPriority = conntype.Relay
 	conn.statusRelay.SetConnected()
-	conn.setRelayedProxy(wgProxy)
+	conn.setRelayedProxy(wgProxy, rci.relayedConn)
 	conn.updateRelayStatus(rci.relayedConn.RemoteAddr().String(), rci.rosenpassPubKey, updateTime)
 	conn.Log.Infof("start to communicate with peer via relay")
 	conn.doOnConnected(rci.rosenpassPubKey, rci.rosenpassAddr, updateTime)
 }
 
-func (conn *Conn) onRelayDisconnected() {
+// onRelayDisconnected reports the teardown of a relayed connection. relayedConn
+// names the connection the signal belongs to, so a signal that arrives after
+// its connection was replaced is ignored instead of tearing down its successor.
+// A nil relayedConn means the caller does not track generations and the current
+// connection is always torn down.
+func (conn *Conn) onRelayDisconnected(relayedConn *relayClient.Conn) {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
+
+	if relayedConn != nil && conn.relayedConnRef != relayedConn {
+		conn.Log.Debugf("ignoring relay disconnect of a superseded connection")
+		return
+	}
+
 	conn.handleRelayDisconnectedLocked()
 }
 
@@ -632,6 +660,7 @@ func (conn *Conn) handleRelayDisconnectedLocked() {
 		_ = conn.wgProxyRelay.CloseConn()
 		conn.wgProxyRelay = nil
 	}
+	conn.relayedConnRef = nil
 
 	changed := conn.statusRelay.Get() != worker.StatusDisconnected
 	if changed {
@@ -663,11 +692,12 @@ func (conn *Conn) onGuardEvent() {
 	}
 }
 
-func (conn *Conn) onWGDisconnected() {
+func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
-	if conn.ctx.Err() != nil {
+	// watcherCtx guards against a stale watcher tearing down a connection that already superseded it.
+	if conn.ctx.Err() != nil || watcherCtx.Err() != nil {
 		return
 	}
 
@@ -683,6 +713,29 @@ func (conn *Conn) onWGDisconnected() {
 	default:
 		conn.Log.Debugf("No active connection to close on WG timeout")
 	}
+
+	conn.escalateWGTimeoutLocked()
+}
+
+// escalateWGTimeoutLocked resets the peer's rosenpass state after repeated
+// handshake timeouts. With rosenpass enabled, persistent timeouts mean the
+// preshared keys have desynced; the renewal exchange runs over the dead
+// tunnel and cannot resync them. Reporting the peer disconnected drops its
+// rosenpass state, so the next connection configuration programs the
+// rendezvous key and the tunnel can bootstrap again. Callers must hold mu.
+func (conn *Conn) escalateWGTimeoutLocked() {
+	if conn.config.RosenpassConfig.PubKey == nil {
+		return
+	}
+
+	conn.wgTimeouts++
+	if conn.wgTimeouts < wgTimeoutEscalationThreshold || conn.onDisconnected == nil {
+		return
+	}
+	conn.wgTimeouts = 0
+
+	conn.Log.Warnf("%d consecutive WireGuard handshake timeouts, resetting rosenpass state for peer", wgTimeoutEscalationThreshold)
+	conn.onDisconnected(conn.config.WgConfig.RemoteKey)
 }
 
 func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []byte, updateTime time.Time) {
@@ -775,7 +828,8 @@ func (conn *Conn) evalStatus() ConnStatus {
 //
 // The result is a tri-state:
 //   - ConnStatusConnected:          all available transports are up
-//   - ConnStatusPartiallyConnected: relay is up but ICE is still pending/reconnecting
+//   - ConnStatusPartiallyConnected: one transport carries the traffic and the other does
+//     not: relay up with ICE down, or ICE up with the shared relay transport down
 //   - ConnStatusDisconnected:       no working transport
 func (conn *Conn) isConnectedOnAllWay() (status guard.ConnStatus) {
 	defer func() {
@@ -792,35 +846,50 @@ func (conn *Conn) isConnectedOnAllWay() (status guard.ConnStatus) {
 	}
 
 	return evalConnStatus(connStatusInputs{
-		forceRelay:          IsForceRelayed(),
-		peerUsesRelay:       conn.workerRelay.IsRelayConnectionSupportedWithPeer(),
-		relayConnected:      conn.statusRelay.Get() == worker.StatusConnected,
-		remoteSupportsICE:   conn.handshaker.RemoteICESupported(),
-		iceWorkerCreated:    iceWorkerCreated,
-		iceStatusConnecting: conn.statusICE.Get() != worker.StatusDisconnected,
-		iceInProgress:       iceInProgress,
+		forceRelay:              IsForceRelayed(),
+		peerUsesRelay:           conn.workerRelay.IsRelayConnectionSupportedWithPeer(),
+		relayConnected:          conn.statusRelay.Get() == worker.StatusConnected,
+		relayTransportConnected: conn.workerRelay.IsTransportConnected(),
+		remoteSupportsICE:       conn.handshaker.RemoteICESupported(),
+		iceWorkerCreated:        iceWorkerCreated,
+		iceStatusConnected:      conn.statusICE.Get() == worker.StatusConnected,
+		iceInProgress:           iceInProgress,
 	})
 }
 
+// enableWgWatcherIfNeeded starts a fresh watcher instance per connection attempt, so its
+// lifecycle stays bound to conn.mu and enable/disable can't race an old goroutine's shutdown.
+// Caller must hold conn.mu.
 func (conn *Conn) enableWgWatcherIfNeeded(enabledTime time.Time) {
-	if !conn.wgWatcher.PrepareInitialHandshake() {
+	if conn.wgWatcher != nil {
 		return
 	}
 
+	watcher := NewWGWatcher(conn.Log, conn.config.WgConfig.WgInterface, conn.config.Key, conn.dumpState)
+	watcher.PrepareInitialHandshake()
+
 	wgWatcherCtx, wgWatcherCancel := context.WithCancel(conn.ctx)
+	conn.wgWatcher = watcher
 	conn.wgWatcherCancel = wgWatcherCancel
+
 	conn.wgWatcherWg.Add(1)
 	go func() {
 		defer conn.wgWatcherWg.Done()
-		conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, enabledTime, conn.onWGDisconnected, conn.onWGHandshakeSuccess)
+		onDisconnected := func() { conn.onWGDisconnected(wgWatcherCtx) }
+		watcher.EnableWgWatcher(wgWatcherCtx, enabledTime, onDisconnected, conn.onWGHandshakeSuccess, conn.onWGCheckSuccess)
 	}()
 }
 
+// disableWgWatcherIfNeeded cancels and drops the watcher once no transport is active. It never
+// waits for the goroutine: the timeout path reentrantly calls back here under conn.mu, so
+// blocking would deadlock. Caller must hold conn.mu.
 func (conn *Conn) disableWgWatcherIfNeeded() {
-	if conn.currentConnPriority == conntype.None && conn.wgWatcherCancel != nil {
-		conn.wgWatcherCancel()
-		conn.wgWatcherCancel = nil
+	if conn.currentConnPriority != conntype.None || conn.wgWatcher == nil {
+		return
 	}
+	conn.wgWatcherCancel()
+	conn.wgWatcher = nil
+	conn.wgWatcherCancel = nil
 }
 
 func (conn *Conn) newProxy(remoteConn net.Conn) (wgproxy.Proxy, error) {
@@ -831,9 +900,8 @@ func (conn *Conn) newProxy(remoteConn net.Conn) (wgproxy.Proxy, error) {
 	}
 
 	wgProxy := conn.config.WgConfig.WgInterface.GetProxy()
-	if err := wgProxy.AddTurnConn(conn.ctx, udpAddr, remoteConn); err != nil {
-		conn.Log.Errorf("failed to add turn net.Conn to local proxy: %v", err)
-		return nil, err
+	if err := wgProxy.AddRelayedConn(conn.ctx, udpAddr, remoteConn); err != nil {
+		return nil, fmt.Errorf("add relayed conn to proxy: %w", err)
 	}
 	return wgProxy, nil
 }
@@ -843,7 +911,9 @@ func (conn *Conn) resetEndpoint() {
 		return
 	}
 	conn.Log.Infof("reset wg endpoint")
-	conn.wgWatcher.Reset()
+	if conn.wgWatcher != nil {
+		conn.wgWatcher.Reset()
+	}
 	if err := conn.endpointUpdater.RemoveEndpointAddress(); err != nil {
 		conn.Log.Warnf("failed to remove endpoint address before update: %v", err)
 	}
@@ -877,13 +947,14 @@ func (conn *Conn) logTraceConnState() {
 	}
 }
 
-func (conn *Conn) setRelayedProxy(proxy wgproxy.Proxy) {
+func (conn *Conn) setRelayedProxy(proxy wgproxy.Proxy, relayedConn *relayClient.Conn) {
 	if conn.wgProxyRelay != nil {
 		if err := conn.wgProxyRelay.CloseConn(); err != nil {
 			conn.Log.Warnf("failed to close deprecated wg proxy conn: %v", err)
 		}
 	}
 	conn.wgProxyRelay = proxy
+	conn.relayedConnRef = relayedConn
 }
 
 // onWGHandshakeSuccess is called when the first WireGuard handshake is detected
@@ -892,6 +963,15 @@ func (conn *Conn) onWGHandshakeSuccess(when time.Time) {
 	conn.recordConnectionMetrics()
 }
 
+// onWGCheckSuccess is called for every watcher check that observed a fresh
+// handshake, including handshakes of connections that were already up when
+// the watcher started.
+func (conn *Conn) onWGCheckSuccess() {
+	conn.mu.Lock()
+	conn.wgTimeouts = 0
+	conn.mu.Unlock()
+}
+
 // recordConnectionMetrics records connection stage timestamps as metrics
 func (conn *Conn) recordConnectionMetrics() {
 	if conn.metricsRecorder == nil {
@@ -903,12 +983,9 @@ func (conn *Conn) recordConnectionMetrics() {
 	priority := conn.currentConnPriority
 	conn.mu.Unlock()
 
-	var connType metrics.ConnectionType
-	switch priority {
-	case conntype.Relay:
-		connType = metrics.ConnectionTypeRelay
-	default:
-		connType = metrics.ConnectionTypeICE
+	connType := metricsConnType(priority)
+	if connType == metrics.ConnectionTypeUnknown {
+		return
 	}
 
 	// Record metrics with timestamps - duration calculation happens in metrics package
@@ -985,19 +1062,21 @@ func evalConnStatus(in connStatusInputs) guard.ConnStatus {
 		return boolToConnStatus(relayUsedAndUp)
 	}
 
-	// ICE counts as "up" when the status is anything other than Disconnected, OR
-	// when a negotiation is currently in progress (so we don't spam offers while one is in flight).
-	iceUp := in.iceStatusConnecting || in.iceInProgress
+	// ICE counts as "running" when either connected or attempting to connect.
+	iceRunning := in.iceStatusConnected || in.iceInProgress
 
 	// Relay side is acceptable if the peer doesn't rely on relay, or relay is connected.
 	relayOK := !in.peerUsesRelay || in.relayConnected
 
 	switch {
-	case iceUp && relayOK:
+	case iceRunning && relayOK:
 		return guard.ConnStatusConnected
 	case relayUsedAndUp:
 		// Relay is up but ICE is down — partially connected.
 		return guard.ConnStatusPartiallyConnected
+	case in.iceStatusConnected && !in.relayTransportConnected:
+		// ICE is up and the shared relay transport is down — offers cannot restore it.
+		return guard.ConnStatusPartiallyConnected
 	default:
 		return guard.ConnStatusDisconnected
 	}
@@ -1009,3 +1088,16 @@ func boolToConnStatus(connected bool) guard.ConnStatus {
 	}
 	return guard.ConnStatusDisconnected
 }
+
+func metricsConnType(priority conntype.ConnPriority) metrics.ConnectionType {
+	switch priority {
+	case conntype.Relay:
+		return metrics.ConnectionTypeRelay
+	case conntype.ICETurn:
+		return metrics.ConnectionTypeICETurn
+	case conntype.ICEP2P:
+		return metrics.ConnectionTypeICEP2P
+	default:
+		return metrics.ConnectionTypeUnknown
+	}
+}
diff --git a/client/internal/peer/conn_status.go b/client/internal/peer/conn_status.go
index d6ad37b70..acf271534 100644
--- a/client/internal/peer/conn_status.go
+++ b/client/internal/peer/conn_status.go
@@ -17,13 +17,14 @@ const (
 // tri-state connection classification. Extracted so the decision logic can be unit-tested
 // without constructing full Worker/Handshaker objects.
 type connStatusInputs struct {
-	forceRelay          bool // NB_FORCE_RELAY or JS/WASM
-	peerUsesRelay       bool // remote peer advertises relay support AND local has relay
-	relayConnected      bool // statusRelay reports Connected (independent of whether peer uses relay)
-	remoteSupportsICE   bool // remote peer sent ICE credentials
-	iceWorkerCreated    bool // local WorkerICE exists (false in force-relay mode)
-	iceStatusConnecting bool // statusICE is anything other than Disconnected
-	iceInProgress       bool // a negotiation is currently in flight
+	forceRelay              bool // NB_FORCE_RELAY or JS/WASM
+	peerUsesRelay           bool // remote peer advertises relay support AND local has relay
+	relayConnected          bool // statusRelay reports Connected (independent of whether peer uses relay)
+	relayTransportConnected bool // the relay transport shared by all peers on that server is up
+	remoteSupportsICE       bool // remote peer sent ICE credentials
+	iceWorkerCreated        bool // local WorkerICE exists (false in force-relay mode)
+	iceStatusConnected      bool // statusICE reports Connected
+	iceInProgress           bool // a negotiation is currently in flight
 }
 
 // ConnStatus describe the status of a peer's connection
diff --git a/client/internal/peer/conn_status_eval_test.go b/client/internal/peer/conn_status_eval_test.go
index 66393cafe..a239196dc 100644
--- a/client/internal/peer/conn_status_eval_test.go
+++ b/client/internal/peer/conn_status_eval_test.go
@@ -30,6 +30,21 @@ func TestEvalConnStatus_ForceRelay(t *testing.T) {
 			},
 			want: guard.ConnStatusDisconnected,
 		},
+		{
+			name: "force relay, relay up but the shared transport reports down",
+			in: connStatusInputs{
+				forceRelay:              true,
+				peerUsesRelay:           true,
+				relayConnected:          true,
+				relayTransportConnected: false,
+				// The ICE inputs are set so that the force-relay return is the only branch
+				// that can produce Connected here: without it the peer would fall through to
+				// relayUsedAndUp and report PartiallyConnected.
+				remoteSupportsICE: true,
+				iceWorkerCreated:  true,
+			},
+			want: guard.ConnStatusConnected,
+		},
 		{
 			name: "force relay, peer does NOT use relay - disconnected forever",
 			in: connStatusInputs{
@@ -123,24 +138,28 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = true
 				in.relayConnected = true
-				in.iceStatusConnecting = true
+				in.relayTransportConnected = true
+				in.iceStatusConnected = true
 			},
 			want: guard.ConnStatusConnected,
 		},
 		{
-			name: "ICE connected, peer does NOT use relay",
+			name: "ICE connected, peer does NOT use relay, shared transport down",
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
 				in.relayConnected = false
-				in.iceStatusConnecting = true
+				in.relayTransportConnected = false
+				in.iceStatusConnected = true
 			},
+			// A peer that does not rely on relay is unaffected by the shared transport:
+			// relayOK is true, so the first arm matches before the transport is considered.
 			want: guard.ConnStatusConnected,
 		},
 		{
 			name: "ICE InProgress only, peer does NOT use relay",
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
-				in.iceStatusConnecting = false
+				in.iceStatusConnected = false
 				in.iceInProgress = true
 			},
 			want: guard.ConnStatusConnected,
@@ -150,7 +169,8 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = true
 				in.relayConnected = true
-				in.iceStatusConnecting = false
+				in.relayTransportConnected = true
+				in.iceStatusConnected = false
 				in.iceInProgress = false
 			},
 			want: guard.ConnStatusPartiallyConnected,
@@ -160,21 +180,60 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
 				in.relayConnected = false
-				in.iceStatusConnecting = false
+				in.iceStatusConnected = false
 				in.iceInProgress = false
 			},
 			want: guard.ConnStatusDisconnected,
 		},
 		{
-			name: "ICE up, peer uses relay but relay down -> partial (relay required, ICE ignored)",
+			name: "ICE connected, relay down for this peer but the shared transport is up -> disconnected",
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = true
 				in.relayConnected = false
-				in.iceStatusConnecting = true
+				in.relayTransportConnected = true
+				in.iceStatusConnected = true
+			},
+			// The transport is fine, so the peer itself is unreachable over relay: it may have
+			// moved to another server, and only an offer carries its new relay address.
+			want: guard.ConnStatusDisconnected,
+		},
+		{
+			name: "ICE connected, the shared relay transport is down -> partial",
+			mutator: func(in *connStatusInputs) {
+				in.peerUsesRelay = true
+				in.relayConnected = false
+				in.relayTransportConnected = false
+				in.iceStatusConnected = true
+			},
+			// ICE carries the traffic and the relay transport is restored by the relay client's
+			// own guard, not by offers, so this must not trigger the aggressive retry.
+			want: guard.ConnStatusPartiallyConnected,
+		},
+		{
+			name: "ICE only negotiating while the shared relay transport is down -> disconnected",
+			mutator: func(in *connStatusInputs) {
+				in.peerUsesRelay = true
+				in.relayConnected = false
+				in.relayTransportConnected = false
+				in.iceStatusConnected = false
+				in.iceInProgress = true
+			},
+			// A negotiation in flight is not a working transport, so this peer has no path at
+			// all and must keep the aggressive retry. Calling it partially connected spends the
+			// ICE retry budget and parks the guard on the hourly ticker, and nothing wakes it
+			// when the negotiation then fails: onICEStateDisconnected is only reached once ICE
+			// has reached Connected (worker_ice.go onConnectionStateChange).
+			want: guard.ConnStatusDisconnected,
+		},
+		{
+			name: "ICE down and the shared relay transport is down -> disconnected",
+			mutator: func(in *connStatusInputs) {
+				in.peerUsesRelay = true
+				in.relayConnected = false
+				in.relayTransportConnected = false
+				in.iceStatusConnected = false
+				in.iceInProgress = false
 			},
-			// relayOK = false (peer uses relay but it's down), iceUp = true
-			// first switch arm fails (relayOK false), relayUsedAndUp = false (relay down),
-			// falls into default: Disconnected.
 			want: guard.ConnStatusDisconnected,
 		},
 		{
@@ -182,7 +241,7 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
 				in.relayConnected = true // not actually used since peer doesn't rely on it
-				in.iceStatusConnecting = false
+				in.iceStatusConnected = false
 				in.iceInProgress = false
 			},
 			want: guard.ConnStatusDisconnected,
diff --git a/client/internal/peer/conn_test.go b/client/internal/peer/conn_test.go
index 59216b647..b481c95ed 100644
--- a/client/internal/peer/conn_test.go
+++ b/client/internal/peer/conn_test.go
@@ -3,16 +3,26 @@ package peer
 import (
 	"context"
 	"fmt"
+	"net"
+	"net/netip"
 	"os"
 	"testing"
 	"time"
 
+	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/configurer"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgproxy"
+	"github.com/netbirdio/netbird/client/internal/metrics"
+	"github.com/netbirdio/netbird/client/internal/peer/conntype"
 	"github.com/netbirdio/netbird/client/internal/peer/dispatcher"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	"github.com/netbirdio/netbird/client/internal/peer/ice"
+	"github.com/netbirdio/netbird/client/internal/peer/worker"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/util"
 )
@@ -39,7 +49,7 @@ func TestNewConn_interfaceFilter(t *testing.T) {
 	ignore := []string{iface.WgInterfaceDefault, "tun0", "zt", "ZeroTier", "utun", "wg", "ts",
 		"Tailscale", "tailscale"}
 
-	filter := stdnet.InterfaceFilter(ignore)
+	filter := stdnet.InterfaceFilter(ignore, nil)
 
 	for _, s := range ignore {
 		assert.Equal(t, filter(s), false)
@@ -304,3 +314,150 @@ func TestConn_presharedKey_RosenpassManaged(t *testing.T) {
 		t.Fatalf("expected non-nil presharedKey before Rosenpass manages PSK")
 	}
 }
+
+func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
+	cfg := ConnConfig{
+		Key:      "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
+		LocalKey: "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
+		WgConfig: WgConfig{RemoteKey: "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU="},
+	}
+	if rosenpassEnabled {
+		cfg.RosenpassConfig = RosenpassConfig{PubKey: []byte("dummykey")}
+	}
+
+	conn := &Conn{
+		ctx:           context.Background(),
+		config:        cfg,
+		Log:           log.WithField("peer", cfg.Key),
+		metricsStages: &MetricsStages{},
+	}
+	conn.SetOnDisconnected(func(remotePeer string) {
+		*disconnected = append(*disconnected, remotePeer)
+	})
+	return conn
+}
+
+// TestConn_onWGDisconnected_EscalatesToRosenpassReset: repeated handshake
+// timeouts with rosenpass enabled mean the preshared keys have desynced. The
+// renewal exchange runs over the dead tunnel and cannot resync them, so after
+// wgTimeoutEscalationThreshold consecutive timeouts the conn must report the
+// peer disconnected, dropping its rosenpass state so the next configuration
+// programs the rendezvous key.
+func TestConn_onWGDisconnected_EscalatesToRosenpassReset(t *testing.T) {
+	var disconnected []string
+	conn := newWGTimeoutTestConn(true, &disconnected)
+
+	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
+		conn.onWGDisconnected(conn.ctx)
+	}
+	assert.Empty(t, disconnected, "escalation must not fire below the threshold")
+
+	conn.onWGDisconnected(conn.ctx)
+	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
+		"reaching the threshold must report the peer disconnected once")
+
+	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
+		conn.onWGDisconnected(conn.ctx)
+	}
+	assert.Len(t, disconnected, 1, "escalation must restart counting after firing")
+
+	conn.onWGDisconnected(conn.ctx)
+	assert.Len(t, disconnected, 2, "continued timeouts must escalate again")
+}
+
+// TestConn_onWGDisconnected_CheckSuccessResetsEscalation: a successful
+// handshake between timeouts means the tunnel recovered; the counter must
+// start over.
+func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
+	var disconnected []string
+	conn := newWGTimeoutTestConn(true, &disconnected)
+
+	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
+		conn.onWGDisconnected(conn.ctx)
+	}
+	conn.onWGCheckSuccess()
+
+	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
+		conn.onWGDisconnected(conn.ctx)
+	}
+	assert.Empty(t, disconnected, "handshake success must reset the timeout count")
+}
+
+// TestConn_onWGDisconnected_NoEscalationWithoutRosenpass: without rosenpass
+// there is no per-peer key state to reset; repeated timeouts must not report
+// disconnects.
+func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
+	var disconnected []string
+	conn := newWGTimeoutTestConn(false, &disconnected)
+
+	for i := 0; i < wgTimeoutEscalationThreshold*3; i++ {
+		conn.onWGDisconnected(conn.ctx)
+	}
+	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
+}
+
+func TestMetricsConnType(t *testing.T) {
+	tests := []struct {
+		name     string
+		priority conntype.ConnPriority
+		expected metrics.ConnectionType
+	}{
+		{"relay", conntype.Relay, metrics.ConnectionTypeRelay},
+		{"ice over turn is relayed, not p2p", conntype.ICETurn, metrics.ConnectionTypeICETurn},
+		{"direct p2p", conntype.ICEP2P, metrics.ConnectionTypeICEP2P},
+		{"unset priority is unknown, not p2p", conntype.None, metrics.ConnectionTypeUnknown},
+		{"unrecognised priority is unknown", conntype.ConnPriority(99), metrics.ConnectionTypeUnknown},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, metricsConnType(tc.priority))
+		})
+	}
+}
+
+func TestMetricsConnType_RelayedMatchesIsRelayed(t *testing.T) {
+	for _, priority := range []conntype.ConnPriority{conntype.None, conntype.Relay, conntype.ICETurn, conntype.ICEP2P} {
+		conn := &Conn{currentConnPriority: priority}
+		tag := metricsConnType(priority)
+		relayedTag := tag == metrics.ConnectionTypeRelay || tag == metrics.ConnectionTypeICETurn
+		assert.Equal(t, conn.isRelayed(), relayedTag,
+			"priority %s: isRelayed and the %q metric tag must agree", priority, tag)
+	}
+}
+
+type stubWGIface struct{}
+
+func (s *stubWGIface) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
+	return nil
+}
+func (s *stubWGIface) RemovePeer(peerKey string) error { return nil }
+func (s *stubWGIface) GetStats() (map[string]configurer.WGStats, error) {
+	return map[string]configurer.WGStats{}, nil
+}
+func (s *stubWGIface) GetProxy() wgproxy.Proxy                { return nil }
+func (s *stubWGIface) Address() wgaddr.Address                { return wgaddr.Address{} }
+func (s *stubWGIface) RemoveEndpointAddress(key string) error { return nil }
+
+func TestConn_Close_CallsOnDisconnected(t *testing.T) {
+	var disconnected []string
+	conn := newWGTimeoutTestConn(true, &disconnected)
+	conn.endpointUpdater = NewEndpointUpdater(conn.Log, conn.config.WgConfig, false)
+	conn.config.WgConfig.WgInterface = &stubWGIface{}
+	conn.endpointUpdater.wgConfig.WgInterface = &stubWGIface{}
+	conn.workerRelay = &WorkerRelay{}
+	ctx, cancel := context.WithCancel(context.Background())
+	conn.ctx = ctx
+	conn.ctxCancel = cancel
+	conn.opened = true
+	conn.statusICE = worker.NewAtomicStatus()
+	conn.statusRelay = worker.NewAtomicStatus()
+	conn.statusRecorder = NewRecorder("https://mgm")
+
+	// The connection is closed while in a disconnected or connecting state
+	// (e.g. peer dropped, ICE failed, or management disconnect).
+	conn.Close(false)
+
+	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
+		"Close must notify onDisconnected so Rosenpass cleans up its peer worker")
+}
diff --git a/client/internal/peer/guard/guard.go b/client/internal/peer/guard/guard.go
index 2e5efbcc5..15028d91c 100644
--- a/client/internal/peer/guard/guard.go
+++ b/client/internal/peer/guard/guard.go
@@ -14,7 +14,8 @@ type ConnStatus int
 const (
 	// ConnStatusDisconnected means neither ICE nor Relay is connected.
 	ConnStatusDisconnected ConnStatus = iota
-	// ConnStatusPartiallyConnected means Relay is connected but ICE is not.
+	// ConnStatusPartiallyConnected means one transport is usable and the other is not:
+	// relay connected with ICE down, or ICE connected with the shared relay transport down.
 	ConnStatusPartiallyConnected
 	// ConnStatusConnected means all required connections are established.
 	ConnStatusConnected
@@ -22,6 +23,12 @@ const (
 
 type connStatusFunc func() ConnStatus
 
+// NetworkWatcher is the availability view the guard gates reconnects on.
+type NetworkWatcher interface {
+	IsOnline() bool
+	Changed() <-chan struct{}
+}
+
 // Guard is responsible for the reconnection logic.
 // It will trigger to send an offer to the peer then has connection issues.
 // Watch these events:
@@ -31,20 +38,26 @@ type connStatusFunc func() ConnStatus
 // - Relayed connection disconnected
 // - ICE candidate changes
 type Guard struct {
-	log                     *log.Entry
-	isConnectedOnAllWay     connStatusFunc
-	timeout                 time.Duration
-	srWatcher               *SRWatcher
+	log                 *log.Entry
+	isConnectedOnAllWay connStatusFunc
+	timeout             time.Duration
+	srWatcher           *SRWatcher
+	// netWatcher gates reconnect attempts on OS-reported network availability;
+	// nil disables gating.
+	netWatcher              NetworkWatcher
 	relayedConnDisconnected chan struct{}
 	iCEConnDisconnected     chan struct{}
 }
 
-func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher) *Guard {
+// NewGuard creates a reconnection guard for a peer connection. A nil netWatcher
+// disables network availability gating.
+func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher, netWatcher NetworkWatcher) *Guard {
 	return &Guard{
 		log:                     log,
 		isConnectedOnAllWay:     isConnectedFn,
 		timeout:                 timeout,
 		srWatcher:               srWatcher,
+		netWatcher:              netWatcher,
 		relayedConnDisconnected: make(chan struct{}, 1),
 		iCEConnDisconnected:     make(chan struct{}, 1),
 	}
@@ -75,8 +88,9 @@ func (g *Guard) SetICEConnDisconnected() {
 //   - Connected: no action, the peer is fully reachable.
 //   - Disconnected (neither ICE nor Relay): retries aggressively with exponential backoff (800ms doubling
 //     up to timeout), never gives up. This ensures rapid recovery when the peer has no connectivity at all.
-//   - PartiallyConnected (Relay up, ICE not): retries up to 3 times with exponential backoff, then switches
-//     to one attempt per hour. This limits signaling traffic when relay already provides connectivity.
+//   - PartiallyConnected (one transport usable, the other not): retries up to 3 times
+//     with exponential backoff, then switches to one attempt per hour. This limits
+//     signaling traffic while the peer still has a working path.
 //
 // External events (relay/ICE disconnect, signal/relay reconnect, candidate changes) reset the retry
 // counter and backoff ticker, giving ICE a fresh chance after network conditions change.
@@ -85,16 +99,30 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 	defer g.srWatcher.RemoveListener(srReconnectedChan)
 
 	ticker := g.initialTicker(ctx)
-	defer ticker.Stop()
+	defer func() {
+		// If backoff.Ticker.send is blocked, context.Done will not close the Ticker goroutine.
+		// We have to explicitly call Stop, even if we use backoff.WithContext.
+		ticker.Stop()
+	}()
 
 	tickerChannel := ticker.C
 
 	iceState := &iceRetryState{log: g.log}
 	defer iceState.reset()
 
+	var netChanged <-chan struct{}
+	if g.netWatcher != nil {
+		netChanged = g.netWatcher.Changed()
+	}
+
 	for {
 		select {
 		case <-tickerChannel:
+			// skip attempts while the OS reports no usable network; the
+			// netChanged case below resumes the loop once it returns
+			if g.netWatcher != nil && !g.netWatcher.IsOnline() {
+				continue
+			}
 			switch g.isConnectedOnAllWay() {
 			case ConnStatusConnected:
 				// all good, nothing to do
@@ -131,6 +159,23 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 			tickerChannel = ticker.C
 			iceState.reset()
 
+		case <-netChanged:
+			// Re-arm for the next transition before acting on this one.
+			netChanged = g.netWatcher.Changed()
+			if !g.netWatcher.IsOnline() {
+				continue
+			}
+			// Ticks skipped while offline drove the backoff towards its
+			// maximum without ever attempting, and left the ICE budget
+			// frozen — possibly in hourly mode. Recover on our own so the
+			// peer does not depend on a signal or relay event that never
+			// comes when both stayed up across the outage.
+			g.log.Debugf("network is back, reset reconnection ticker")
+			ticker.Stop()
+			ticker = g.newReconnectTicker(ctx)
+			tickerChannel = ticker.C
+			iceState.reset()
+
 		case <-ctx.Done():
 			g.log.Debugf("context is done, stop reconnect loop")
 			return
diff --git a/client/internal/peer/guard/guard_leak_test.go b/client/internal/peer/guard/guard_leak_test.go
new file mode 100644
index 000000000..3d82ec591
--- /dev/null
+++ b/client/internal/peer/guard/guard_leak_test.go
@@ -0,0 +1,92 @@
+package guard
+
+import (
+	"context"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/peer/ice"
+)
+
+func newTestGuard(status connStatusFunc) *Guard {
+	srw := NewSRWatcher(nil, nil, nil, ice.Config{})
+	return NewGuard(log.WithField("test", "guard"), status, 50*time.Millisecond, srw, nil)
+}
+
+// countBackoffTickerGoroutines returns how many goroutines are currently sitting
+// in backoff/v4.(*Ticker).run (a ticker goroutine that has not exited).
+func countBackoffTickerGoroutines() int {
+	buf := make([]byte, 1<<25) // 32MB
+	n := runtime.Stack(buf, true)
+	return strings.Count(string(buf[:n]), "backoff/v4.(*Ticker).run")
+}
+
+// TestGuard_ReconnectTicker_NoGoroutineLeakOnShutdown reproduces a observed
+// leak: after a shutdown burst, ticker run/send goroutines stay parked
+// forever even though every reconnect loop has exited.
+func TestGuard_ReconnectTicker_NoGoroutineLeakOnShutdown(t *testing.T) {
+	before := countBackoffTickerGoroutines()
+
+	const peers = 6000
+	cancels := make([]context.CancelFunc, 0, peers)
+	var wg sync.WaitGroup
+
+	// A status check slower than the tick cadence. This models the real
+	// isConnectedOnAllWay/callback doing work: while the loop is busy in the
+	// handler, the ticker fires the next tick and parks in send(), because
+	// send() never selects on ctx.
+	slowStatus := func() ConnStatus {
+		time.Sleep(70 * time.Millisecond)
+		return ConnStatusConnected
+	}
+
+	for range peers {
+		g := newTestGuard(slowStatus)
+		ctx, cancel := context.WithCancel(context.Background())
+		cancels = append(cancels, cancel)
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			g.Start(ctx, func() {})
+		}()
+		// Force the live ticker to be a newReconnectTicker.
+		g.SetRelayedConnDisconnected()
+	}
+
+	// Let the replacement tickers get past their 800ms initial interval, so
+	// many are parked in send() waiting on the (slow) consumer when we tear
+	// everything down.
+	time.Sleep(1500 * time.Millisecond)
+
+	// Shutdown burst: cancel every peer at once, like engine teardown.
+	for _, c := range cancels {
+		c()
+	}
+
+	// Every reconnect loop must return
+	waitCh := make(chan struct{})
+	go func() { wg.Wait(); close(waitCh) }()
+	select {
+	case <-waitCh:
+	case <-time.After(30 * time.Second):
+		t.Fatal("not all reconnect loops returned after ctx cancel")
+	}
+
+	// Give any correctly-stopped ticker goroutines time to unwind.
+	for range 50 {
+		runtime.Gosched()
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	leaked := countBackoffTickerGoroutines() - before
+	t.Logf("backoff Ticker.run goroutines still parked after teardown of %d peers: %d", peers, leaked)
+	if leaked > 0 {
+		t.Errorf("LEAK: %d backoff ticker goroutines parked after all reconnect loops exited "+
+			"(defer ticker.Stop() stops the initial ticker, not the live replacement)", leaked)
+	}
+}
diff --git a/client/internal/peer/guard/guard_netstate_test.go b/client/internal/peer/guard/guard_netstate_test.go
new file mode 100644
index 000000000..44999cae1
--- /dev/null
+++ b/client/internal/peer/guard/guard_netstate_test.go
@@ -0,0 +1,107 @@
+package guard
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/peer/ice"
+	"github.com/netbirdio/netbird/client/netevents/netstate"
+)
+
+// newTestGuardWithNetState builds a guard with a realistic MaxInterval: the
+// backoff must be able to grow well past the outage, as it does in production
+// where the timeout is seconds to minutes.
+func newTestGuardWithNetState(status connStatusFunc, netState *netstate.State) *Guard {
+	srw := NewSRWatcher(nil, nil, nil, ice.Config{})
+	return NewGuard(log.WithField("test", "guard"), status, 30*time.Second, srw, netState)
+}
+
+// TestGuard_RecoversAfterOfflineToOnline covers a peer that stays disconnected
+// across a network outage while neither signal nor relay reports an event —
+// both stayed up, as on a short airplane mode toggle over Wi-Fi.
+//
+// Every tick taken while offline is skipped, but it still advances the
+// exponential backoff, so by the time the network returns the next tick can be
+// tens of seconds away. Without an explicit reaction to the transition the
+// peer waits out that interval for a recovery that could start immediately.
+func TestGuard_RecoversAfterOfflineToOnline(t *testing.T) {
+	netState := netstate.New()
+
+	var attempts atomic.Int32
+	g := newTestGuardWithNetState(func() ConnStatus { return ConnStatusDisconnected }, netState)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	// Start from the reconnect ticker (800ms initial interval), the state a
+	// peer is in after it loses its connection.
+	go g.Start(ctx, func() { attempts.Add(1) })
+	g.SetRelayedConnDisconnected()
+
+	// Let the backoff climb: 0.8s, 1.6s, 3.2s, 6.4s ... every tick is skipped
+	// while offline, but each one doubles the wait for the next.
+	netState.Set(false)
+	time.Sleep(8 * time.Second)
+
+	offlineAttempts := attempts.Load()
+	if offlineAttempts != 0 {
+		t.Fatalf("callback ran %d times while offline, want 0", offlineAttempts)
+	}
+
+	netState.Set(true)
+
+	// The next organic tick is now several seconds out, so anything within
+	// this window can only come from reacting to the transition itself.
+	pollCtx, stopPolling := context.WithTimeout(ctx, 2*time.Second)
+	defer stopPolling()
+
+	select {
+	case <-pollCtx.Done():
+		t.Fatal("peer was not retried within 2s of the network coming back, " +
+			"with neither a signal nor a relay event to fall back on")
+	case <-pollUntil(pollCtx, func() bool { return attempts.Load() > 0 }):
+	}
+}
+
+// TestGuard_OfflineTransitionDoesNotRetry checks the other direction: going
+// offline must not itself trigger an attempt.
+func TestGuard_OfflineTransitionDoesNotRetry(t *testing.T) {
+	netState := netstate.New()
+
+	var attempts atomic.Int32
+	g := newTestGuardWithNetState(func() ConnStatus { return ConnStatusDisconnected }, netState)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go g.Start(ctx, func() { attempts.Add(1) })
+
+	netState.Set(false)
+	time.Sleep(5 * time.Second)
+
+	if got := attempts.Load(); got != 0 {
+		t.Fatalf("callback ran %d times after going offline, want 0", got)
+	}
+}
+
+// pollUntil closes the returned channel once cond holds. It gives up when ctx
+// is done, so the polling goroutine never outlives the test that started it.
+func pollUntil(ctx context.Context, cond func() bool) <-chan struct{} {
+	done := make(chan struct{})
+	go func() {
+		for {
+			if cond() {
+				close(done)
+				return
+			}
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(10 * time.Millisecond):
+			}
+		}
+	}()
+	return done
+}
diff --git a/client/internal/peer/guard/sr_watcher.go b/client/internal/peer/guard/sr_watcher.go
index 0befd7438..8eac1a858 100644
--- a/client/internal/peer/guard/sr_watcher.go
+++ b/client/internal/peer/guard/sr_watcher.go
@@ -54,8 +54,8 @@ func (w *SRWatcher) Start(disableICEMonitor bool) {
 		iceMonitor := NewICEMonitor(w.iFaceDiscover, w.iceConfig, GetICEMonitorPeriod())
 		go iceMonitor.Start(ctx, w.onICEChanged)
 	}
-	w.signalClient.SetOnReconnectedListener(w.onReconnected)
-	w.relayManager.SetOnReconnectedListener(w.onReconnected)
+	w.signalClient.SetOnReconnectedListener(w.onSignalReconnected)
+	w.relayManager.SetOnReconnectedListener(w.onRelayReconnected)
 
 }
 
@@ -96,7 +96,15 @@ func (w *SRWatcher) onICEChanged() {
 	w.notify()
 }
 
-func (w *SRWatcher) onReconnected() {
+func (w *SRWatcher) onSignalReconnected() {
+	w.onReconnected("Signal")
+}
+
+func (w *SRWatcher) onRelayReconnected() {
+	w.onReconnected("Relay")
+}
+
+func (w *SRWatcher) onReconnected(server string) {
 	if !w.signalClient.Ready() {
 		return
 	}
@@ -104,7 +112,7 @@ func (w *SRWatcher) onReconnected() {
 		return
 	}
 
-	log.Infof("reconnected to Signal or Relay server")
+	log.Infof("Signal and Relay ready (triggered by %s), resetting peer reconnection backoff", server)
 	w.notify()
 }
 
diff --git a/client/internal/peer/handshaker.go b/client/internal/peer/handshaker.go
index 56e82e6e3..654e32158 100644
--- a/client/internal/peer/handshaker.go
+++ b/client/internal/peer/handshaker.go
@@ -81,14 +81,19 @@ type Handshaker struct {
 
 func NewHandshaker(log *log.Entry, config ConnConfig, signaler *Signaler, ice *WorkerICE, relay *WorkerRelay, metricsStages *MetricsStages) *Handshaker {
 	h := &Handshaker{
-		log:            log,
-		config:         config,
-		signaler:       signaler,
-		ice:            ice,
-		relay:          relay,
-		metricsStages:  metricsStages,
-		remoteOffersCh: make(chan OfferAnswer),
-		remoteAnswerCh: make(chan OfferAnswer),
+		log:           log,
+		config:        config,
+		signaler:      signaler,
+		ice:           ice,
+		relay:         relay,
+		metricsStages: metricsStages,
+		// Buffered by one so an offer or answer that arrives between Open launching
+		// the Listen goroutine and it reaching its receive is held rather than
+		// dropped. A peer activated by an incoming signal receives the remote's
+		// message in that window; an unbuffered channel skips it as "receiver not
+		// ready", and the connection cannot proceed until the remote re-sends.
+		remoteOffersCh: make(chan OfferAnswer, 1),
+		remoteAnswerCh: make(chan OfferAnswer, 1),
 	}
 	// assume remote supports ICE until we learn otherwise from received offers
 	h.remoteICESupported.Store(ice != nil)
@@ -111,7 +116,7 @@ func (h *Handshaker) Listen(ctx context.Context) {
 	for {
 		select {
 		case remoteOfferAnswer := <-h.remoteOffersCh:
-			h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+			h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t, relay server: %s, relay IP: %s", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials(), remoteOfferAnswer.RelaySrvAddress, remoteOfferAnswer.RelaySrvIP)
 
 			// Record signaling received for reconnection attempts
 			if h.metricsStages != nil {
@@ -133,7 +138,7 @@ func (h *Handshaker) Listen(ctx context.Context) {
 				continue
 			}
 		case remoteOfferAnswer := <-h.remoteAnswerCh:
-			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t, relay server: %s, relay IP: %s", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials(), remoteOfferAnswer.RelaySrvAddress, remoteOfferAnswer.RelaySrvIP)
 
 			// Record signaling received for reconnection attempts
 			if h.metricsStages != nil {
@@ -162,29 +167,38 @@ func (h *Handshaker) SendOffer() error {
 	return h.sendOffer()
 }
 
-// OnRemoteOffer handles an offer from the remote peer and returns true if the message was accepted, false otherwise
-// doesn't block, discards the message if connection wasn't ready
+// OnRemoteOffer hands an offer to Listen without blocking, keeping only the most
+// recent one if several arrive before Listen reads them.
 func (h *Handshaker) OnRemoteOffer(offer OfferAnswer) {
-	select {
-	case h.remoteOffersCh <- offer:
-		return
-	default:
-		h.log.Warnf("skipping remote offer message because receiver not ready")
-		// connection might not be ready yet to receive so we ignore the message
-		return
-	}
+	enqueueLatest(h.remoteOffersCh, offer)
 }
 
-// OnRemoteAnswer handles an offer from the remote peer and returns true if the message was accepted, false otherwise
-// doesn't block, discards the message if connection wasn't ready
+// OnRemoteAnswer hands an answer to Listen without blocking, keeping only the most
+// recent one if several arrive before Listen reads them.
 func (h *Handshaker) OnRemoteAnswer(answer OfferAnswer) {
+	enqueueLatest(h.remoteAnswerCh, answer)
+}
+
+// enqueueLatest delivers msg on a one-slot channel without blocking. When the slot
+// already holds an unread message the older one is discarded in favor of msg, so a
+// message arriving before Listen starts reading is held rather than dropped, and
+// the newest wins if several arrive first. Safe because there is a single producer
+// (the engine loop): after draining the stale value the send always has room.
+func enqueueLatest(ch chan OfferAnswer, msg OfferAnswer) {
 	select {
-	case h.remoteAnswerCh <- answer:
+	case ch <- msg:
 		return
 	default:
-		// connection might not be ready yet to receive so we ignore the message
-		h.log.Warnf("skipping remote answer message because receiver not ready")
-		return
+	}
+
+	select {
+	case <-ch:
+	default:
+	}
+
+	select {
+	case ch <- msg:
+	default:
 	}
 }
 
@@ -195,14 +209,14 @@ func (h *Handshaker) sendOffer() error {
 	}
 
 	offer := h.buildOfferAnswer()
-	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
+	h.log.Debugf("sending offer with serial: %s, relay server: %s, relay IP: %s", offer.SessionIDString(), offer.RelaySrvAddress, offer.RelaySrvIP)
 
 	return h.signaler.SignalOffer(offer, h.config.Key)
 }
 
 func (h *Handshaker) sendAnswer() error {
 	answer := h.buildOfferAnswer()
-	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
+	h.log.Debugf("sending answer with serial: %s, relay server: %s, relay IP: %s", answer.SessionIDString(), answer.RelaySrvAddress, answer.RelaySrvIP)
 
 	return h.signaler.SignalAnswer(answer, h.config.Key)
 }
diff --git a/client/internal/peer/handshaker_test.go b/client/internal/peer/handshaker_test.go
new file mode 100644
index 000000000..5e203d78b
--- /dev/null
+++ b/client/internal/peer/handshaker_test.go
@@ -0,0 +1,63 @@
+package peer
+
+import (
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+)
+
+func newTestHandshaker(t *testing.T) *Handshaker {
+	t.Helper()
+	// The tests exercise the answer path, whose Listen branch dispatches to the
+	// relay listener without sending an answer, so no signaler/ICE/relay is needed.
+	return NewHandshaker(log.WithField("test", t.Name()), ConnConfig{}, nil, nil, nil, nil)
+}
+
+// TestHandshakerHoldsSignalArrivingBeforeListen covers the case where a peer is
+// activated by an incoming signal: the remote's offer/answer arrives in the same
+// step that opens the connection, before the Listen loop starts reading. The
+// message must be held rather than dropped, or the connection cannot proceed until
+// the remote re-sends. This is the path taken when an eager peer connects to a
+// lazily-managed one.
+func TestHandshakerHoldsSignalArrivingBeforeListen(t *testing.T) {
+	h := newTestHandshaker(t)
+
+	processed := make(chan *OfferAnswer, 4)
+	h.AddRelayListener(func(o *OfferAnswer) { processed <- o })
+
+	// Delivered before Listen is reading, as when the peer is woken by the remote's
+	// signal and the message is delivered right after Open.
+	h.OnRemoteAnswer(OfferAnswer{WgListenPort: 51820})
+
+	go h.Listen(t.Context())
+
+	select {
+	case <-processed:
+	case <-time.After(2 * time.Second):
+		assert.Fail(t, "remote-answer dispatch: signal delivered before Listen was ready was dropped")
+	}
+}
+
+// TestHandshakerKeepsLatestSignalBeforeListen covers several signals arriving
+// before Listen reads: the newest must win (matching the latest-offer contract),
+// rather than the first being kept and later ones discarded.
+func TestHandshakerKeepsLatestSignalBeforeListen(t *testing.T) {
+	h := newTestHandshaker(t)
+
+	processed := make(chan *OfferAnswer, 4)
+	h.AddRelayListener(func(o *OfferAnswer) { processed <- o })
+
+	h.OnRemoteAnswer(OfferAnswer{WgListenPort: 1111})
+	h.OnRemoteAnswer(OfferAnswer{WgListenPort: 2222})
+
+	go h.Listen(t.Context())
+
+	select {
+	case got := <-processed:
+		assert.Equal(t, 2222, got.WgListenPort, "remote-answer dispatch: the latest queued signal should be processed")
+	case <-time.After(2 * time.Second):
+		assert.Fail(t, "remote-answer dispatch: queued signal was dropped")
+	}
+}
diff --git a/client/internal/peer/ice/agent.go b/client/internal/peer/ice/agent.go
index c74b46d10..a919cded5 100644
--- a/client/internal/peer/ice/agent.go
+++ b/client/internal/peer/ice/agent.go
@@ -39,10 +39,7 @@ func NewAgent(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, c
 	iceFailedTimeout := iceFailedTimeout()
 	iceRelayAcceptanceMinWait := iceRelayAcceptanceMinWait()
 
-	transportNet, err := newStdNet(ctx, iFaceDiscover, config.InterfaceBlackList)
-	if err != nil {
-		log.Errorf("failed to create pion's stdnet: %s", err)
-	}
+	transportNet := newStdNet(ctx, iFaceDiscover, config.InterfaceBlackList, config.WGDetector)
 
 	fac := logging.NewDefaultLoggerFactory()
 
@@ -53,7 +50,7 @@ func NewAgent(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, c
 		NetworkTypes:           []ice.NetworkType{ice.NetworkTypeUDP4, ice.NetworkTypeUDP6},
 		Urls:                   config.StunTurn.Load(),
 		CandidateTypes:         candidateTypes,
-		InterfaceFilter:        stdnet.InterfaceFilter(config.InterfaceBlackList),
+		InterfaceFilter:        stdnet.InterfaceFilter(config.InterfaceBlackList, config.WGDetector),
 		UDPMux:                 config.UDPMux,
 		UDPMuxSrflx:            config.UDPMuxSrflx,
 		NAT1To1IPs:             config.NATExternalIPs,
diff --git a/client/internal/peer/ice/config.go b/client/internal/peer/ice/config.go
index dd5d67403..9d6b19925 100644
--- a/client/internal/peer/ice/config.go
+++ b/client/internal/peer/ice/config.go
@@ -2,6 +2,8 @@ package ice
 
 import (
 	"github.com/pion/ice/v4"
+
+	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
 type Config struct {
@@ -17,4 +19,8 @@ type Config struct {
 	UDPMuxSrflx ice.UniversalUDPMux
 
 	NATExternalIPs []string
+
+	// WGDetector is shared by every agent so that the WireGuard check the interface
+	// filter performs is not repeated for each of them.
+	WGDetector *stdnet.WGDetector
 }
diff --git a/client/internal/peer/ice/stdnet.go b/client/internal/peer/ice/stdnet.go
index 685ed0363..fbbe4f388 100644
--- a/client/internal/peer/ice/stdnet.go
+++ b/client/internal/peer/ice/stdnet.go
@@ -8,6 +8,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
-func newStdNet(ctx context.Context, _ stdnet.ExternalIFaceDiscover, ifaceBlacklist []string) (*stdnet.Net, error) {
-	return stdnet.NewNet(ctx, ifaceBlacklist)
+func newStdNet(ctx context.Context, _ stdnet.ExternalIFaceDiscover, ifaceBlacklist []string, detector *stdnet.WGDetector) *stdnet.Net {
+	return stdnet.NewNet(ctx, ifaceBlacklist, detector)
 }
diff --git a/client/internal/peer/ice/stdnet_android.go b/client/internal/peer/ice/stdnet_android.go
index 5033ec1b9..72f0c329e 100644
--- a/client/internal/peer/ice/stdnet_android.go
+++ b/client/internal/peer/ice/stdnet_android.go
@@ -6,6 +6,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
-func newStdNet(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, ifaceBlacklist []string) (*stdnet.Net, error) {
-	return stdnet.NewNetWithDiscover(ctx, iFaceDiscover, ifaceBlacklist)
+func newStdNet(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, ifaceBlacklist []string, detector *stdnet.WGDetector) *stdnet.Net {
+	return stdnet.NewNetWithDiscover(ctx, iFaceDiscover, ifaceBlacklist, detector)
 }
diff --git a/client/internal/peer/listener.go b/client/internal/peer/listener.go
index c601fe534..2bb7fcf32 100644
--- a/client/internal/peer/listener.go
+++ b/client/internal/peer/listener.go
@@ -1,11 +1,40 @@
 package peer
 
+// ClientState identifies the client connection state delivered via
+// Listener.OnStateChanged.
+type ClientState int
+
+// Client states. The numeric values cross the gomobile boundary (the mobile
+// bindings re-export them as integer constants), so they are a wire format:
+// append new states at the end, never reorder or insert.
+const (
+	ClientStateDisconnected ClientState = iota
+	ClientStateConnected
+	ClientStateConnecting
+	ClientStateDisconnecting
+	// ClientStateNoNetwork is an overlay state: it is never stored as the
+	// last notification, only derived from ClientStateConnecting while the
+	// OS reports no usable network (see notifier.effectiveState).
+	ClientStateNoNetwork
+)
+
 // Listener is a callback type about the NetBird network connection state
 type Listener interface {
+	// OnStateChanged reports every client state transition. New states are
+	// delivered only through this callback; the per-state callbacks below
+	// are kept for compatibility and will be removed once all consumers
+	// have migrated.
+	OnStateChanged(state ClientState)
+
+	// Deprecated: consume OnStateChanged instead.
 	OnConnected()
+	// Deprecated: consume OnStateChanged instead.
 	OnDisconnected()
+	// Deprecated: consume OnStateChanged instead.
 	OnConnecting()
+	// Deprecated: consume OnStateChanged instead.
 	OnDisconnecting()
+
 	OnAddressChanged(string, string)
 	OnPeersListChanged(int)
 }
diff --git a/client/internal/peer/notifier.go b/client/internal/peer/notifier.go
index 8d1954fe5..564098bd4 100644
--- a/client/internal/peer/notifier.go
+++ b/client/internal/peer/notifier.go
@@ -4,32 +4,66 @@ import (
 	"sync"
 )
 
-const (
-	stateDisconnected = iota
-	stateConnected
-	stateConnecting
-	stateDisconnecting
-)
-
 type notifier struct {
+	// publishLock orders state publication: it is held across computing the
+	// effective state and handing it to the listener, so a transition cannot
+	// overtake a newer one and leave the listener on a stale state.
+	publishLock        sync.Mutex
 	serverStateLock    sync.Mutex
 	listenersLock      sync.Mutex
 	listener           Listener
+	peerListWake       chan struct{}
+	peerListStop       chan struct{}
 	currentClientState bool
-	lastNotification   int
+	lastNotification   ClientState
 	lastNumberOfPeers  int
 	lastFqdnAddress    string
 	lastIPAddress      string
+	networkAvailable   bool
 }
 
 func newNotifier() *notifier {
-	return &notifier{}
+	return &notifier{
+		networkAvailable: true,
+	}
+}
+
+// effectiveState maps the computed state to what listeners should see:
+// while the OS reports no usable network, "Connecting" would be a lie —
+// connection attempts are suspended — so it is reported as NoNetwork.
+// Caller must hold serverStateLock.
+func (n *notifier) effectiveState(state ClientState) ClientState {
+	if !n.networkAvailable && state == ClientStateConnecting {
+		return ClientStateNoNetwork
+	}
+	return state
+}
+
+// setNetworkAvailable records the OS network availability and re-notifies
+// the listener when the flag flips the effective state (Connecting <->
+// NoNetwork).
+func (n *notifier) setNetworkAvailable(available bool) {
+	n.publishLock.Lock()
+	defer n.publishLock.Unlock()
+
+	n.serverStateLock.Lock()
+	if n.networkAvailable == available {
+		n.serverStateLock.Unlock()
+		return
+	}
+	previous := n.effectiveState(n.lastNotification)
+	n.networkAvailable = available
+	current := n.effectiveState(n.lastNotification)
+	n.serverStateLock.Unlock()
+
+	if previous != current {
+		n.notify(current)
+	}
 }
 
 func (n *notifier) setListener(listener Listener) {
 	n.serverStateLock.Lock()
-	lastNotification := n.lastNotification
-	numOfPeers := n.lastNumberOfPeers
+	lastNotification := n.effectiveState(n.lastNotification)
 	fqdnAddress := n.lastFqdnAddress
 	address := n.lastIPAddress
 	n.serverStateLock.Unlock()
@@ -37,21 +71,26 @@ func (n *notifier) setListener(listener Listener) {
 	n.listenersLock.Lock()
 	defer n.listenersLock.Unlock()
 
+	n.stopPeerListDelivererLocked()
 	n.listener = listener
 
 	listener.OnAddressChanged(fqdnAddress, address)
 	notifyListener(listener, lastNotification)
-	// run on go routine to avoid on Java layer to call go functions on same thread
-	go listener.OnPeersListChanged(numOfPeers)
+	n.startPeerListDelivererLocked(listener)
+	n.wakePeerListDelivererLocked()
 }
 
 func (n *notifier) removeListener() {
 	n.listenersLock.Lock()
 	defer n.listenersLock.Unlock()
+	n.stopPeerListDelivererLocked()
 	n.listener = nil
 }
 
 func (n *notifier) updateServerStates(mgmState bool, signalState bool) {
+	n.publishLock.Lock()
+	defer n.publishLock.Unlock()
+
 	n.serverStateLock.Lock()
 	calculatedState := n.calculateState(mgmState, signalState)
 
@@ -61,43 +100,54 @@ func (n *notifier) updateServerStates(mgmState bool, signalState bool) {
 	}
 
 	n.lastNotification = calculatedState
+	effective := n.effectiveState(calculatedState)
 	n.serverStateLock.Unlock()
 
-	n.notify(calculatedState)
+	n.notify(effective)
 }
 
 func (n *notifier) clientStart() {
+	n.publishLock.Lock()
+	defer n.publishLock.Unlock()
+
 	n.serverStateLock.Lock()
 	n.currentClientState = true
-	n.lastNotification = stateConnecting
+	n.lastNotification = ClientStateConnecting
+	effective := n.effectiveState(ClientStateConnecting)
 	n.serverStateLock.Unlock()
 
-	n.notify(stateConnecting)
+	n.notify(effective)
 }
 
 func (n *notifier) clientStop() {
+	n.publishLock.Lock()
+	defer n.publishLock.Unlock()
+
 	n.serverStateLock.Lock()
 	n.currentClientState = false
-	n.lastNotification = stateDisconnected
+	n.lastNotification = ClientStateDisconnected
 	n.serverStateLock.Unlock()
 
-	n.notify(stateDisconnected)
+	n.notify(ClientStateDisconnected)
 }
 
 func (n *notifier) clientTearDown() {
+	n.publishLock.Lock()
+	defer n.publishLock.Unlock()
+
 	n.serverStateLock.Lock()
 	n.currentClientState = false
-	n.lastNotification = stateDisconnecting
+	n.lastNotification = ClientStateDisconnecting
 	n.serverStateLock.Unlock()
 
-	n.notify(stateDisconnecting)
+	n.notify(ClientStateDisconnecting)
 }
 
-func (n *notifier) isServerStateChanged(newState int) bool {
+func (n *notifier) isServerStateChanged(newState ClientState) bool {
 	return n.lastNotification != newState
 }
 
-func (n *notifier) notify(state int) {
+func (n *notifier) notify(state ClientState) {
 	n.listenersLock.Lock()
 	listener := n.listener
 	n.listenersLock.Unlock()
@@ -109,20 +159,20 @@ func (n *notifier) notify(state int) {
 	notifyListener(listener, state)
 }
 
-func (n *notifier) calculateState(managementConn, signalConn bool) int {
+func (n *notifier) calculateState(managementConn, signalConn bool) ClientState {
 	if managementConn && signalConn {
-		return stateConnected
+		return ClientStateConnected
 	}
 
 	if !managementConn && !signalConn && !n.currentClientState {
-		return stateDisconnected
+		return ClientStateDisconnected
 	}
 
-	if n.lastNotification == stateDisconnecting {
-		return stateDisconnecting
+	if n.lastNotification == ClientStateDisconnecting {
+		return ClientStateDisconnecting
 	}
 
-	return stateConnecting
+	return ClientStateConnecting
 }
 
 func (n *notifier) peerListChanged(numOfPeers int) {
@@ -131,15 +181,56 @@ func (n *notifier) peerListChanged(numOfPeers int) {
 	n.serverStateLock.Unlock()
 
 	n.listenersLock.Lock()
-	listener := n.listener
-	n.listenersLock.Unlock()
+	defer n.listenersLock.Unlock()
+	n.wakePeerListDelivererLocked()
+}
 
-	if listener == nil {
+func (n *notifier) startPeerListDelivererLocked(listener Listener) {
+	wake := make(chan struct{}, 1)
+	stop := make(chan struct{})
+	n.peerListWake = wake
+	n.peerListStop = stop
+	go n.deliverPeerListChanges(listener, wake, stop)
+}
+
+func (n *notifier) stopPeerListDelivererLocked() {
+	if n.peerListStop == nil {
 		return
 	}
+	close(n.peerListStop)
+	n.peerListStop = nil
+	n.peerListWake = nil
+}
 
-	// run on go routine to avoid on Java layer to call go functions on same thread
-	go listener.OnPeersListChanged(numOfPeers)
+func (n *notifier) wakePeerListDelivererLocked() {
+	if n.peerListWake == nil {
+		return
+	}
+	select {
+	case n.peerListWake <- struct{}{}:
+	default:
+	}
+}
+
+func (n *notifier) deliverPeerListChanges(listener Listener, wake <-chan struct{}, stop <-chan struct{}) {
+	for {
+		select {
+		case <-stop:
+			return
+		case <-wake:
+		}
+		select {
+		case <-stop:
+			return
+		default:
+		}
+
+		n.serverStateLock.Lock()
+		numOfPeers := n.lastNumberOfPeers
+		n.serverStateLock.Unlock()
+
+		listener.OnPeersListChanged(numOfPeers)
+	}
 }
 
 func (n *notifier) localAddressChanged(fqdn, address string) {
@@ -159,15 +250,19 @@ func (n *notifier) localAddressChanged(fqdn, address string) {
 	listener.OnAddressChanged(fqdn, address)
 }
 
-func notifyListener(l Listener, state int) {
+func notifyListener(l Listener, state ClientState) {
+	// legacy per-state callbacks; NoNetwork is delivered only via
+	// OnStateChanged below
 	switch state {
-	case stateDisconnected:
+	case ClientStateDisconnected:
 		l.OnDisconnected()
-	case stateConnected:
+	case ClientStateConnected:
 		l.OnConnected()
-	case stateConnecting:
+	case ClientStateConnecting:
 		l.OnConnecting()
-	case stateDisconnecting:
+	case ClientStateDisconnecting:
 		l.OnDisconnecting()
 	}
+
+	l.OnStateChanged(state)
 }
diff --git a/client/internal/peer/notifier_concurrent_test.go b/client/internal/peer/notifier_concurrent_test.go
new file mode 100644
index 000000000..fcaaaad3b
--- /dev/null
+++ b/client/internal/peer/notifier_concurrent_test.go
@@ -0,0 +1,108 @@
+package peer
+
+import (
+	"sync"
+	"testing"
+	"time"
+)
+
+type recordingListener struct {
+	mu      sync.Mutex
+	states  []ClientState
+	onState func(ClientState)
+}
+
+func (l *recordingListener) OnStateChanged(state ClientState) {
+	l.mu.Lock()
+	l.states = append(l.states, state)
+	hook := l.onState
+	l.mu.Unlock()
+
+	if hook != nil {
+		hook(state)
+	}
+}
+
+func (l *recordingListener) last() (ClientState, bool) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if len(l.states) == 0 {
+		return 0, false
+	}
+	return l.states[len(l.states)-1], true
+}
+
+func (l *recordingListener) snapshot() []ClientState {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return append([]ClientState(nil), l.states...)
+}
+
+func (l *recordingListener) OnConnected()                    {}
+func (l *recordingListener) OnDisconnected()                 {}
+func (l *recordingListener) OnConnecting()                   {}
+func (l *recordingListener) OnDisconnecting()                {}
+func (l *recordingListener) OnAddressChanged(string, string) {}
+func (l *recordingListener) OnPeersListChanged(int)          {}
+
+// TestNotifier_ConcurrentAvailabilityFlipOrdersPublication holds the first
+// transition inside the listener callback and flips availability again from
+// another goroutine while it is parked. The second flip must not publish
+// ahead of the one in flight, otherwise the listener ends up on a state the
+// notifier already superseded.
+func TestNotifier_ConcurrentAvailabilityFlipOrdersPublication(t *testing.T) {
+	n := newNotifier()
+	n.currentClientState = true
+	n.lastNotification = ClientStateConnecting
+
+	entered := make(chan struct{})
+	release := make(chan struct{})
+
+	l := &recordingListener{}
+	l.onState = func(state ClientState) {
+		if state != ClientStateNoNetwork {
+			return
+		}
+		l.mu.Lock()
+		l.onState = nil
+		l.mu.Unlock()
+		close(entered)
+		<-release
+	}
+	n.listener = l
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		n.setNetworkAvailable(false)
+	}()
+
+	<-entered
+
+	flipped := make(chan struct{})
+	go func() {
+		defer close(flipped)
+		n.setNetworkAvailable(true)
+	}()
+
+	select {
+	case <-flipped:
+		t.Fatal("the online transition published while the offline one was " +
+			"still in flight; publication is not serialized")
+	case <-time.After(200 * time.Millisecond):
+	}
+
+	close(release)
+	<-flipped
+	wg.Wait()
+
+	got, ok := l.last()
+	if !ok {
+		t.Fatal("listener never observed a state")
+	}
+	if got != ClientStateConnecting {
+		t.Fatalf("listener holds %v after the network came back, want Connecting; sequence: %v",
+			got, l.snapshot())
+	}
+}
diff --git a/client/internal/peer/notifier_test.go b/client/internal/peer/notifier_test.go
index 0b7722b0c..f81866214 100644
--- a/client/internal/peer/notifier_test.go
+++ b/client/internal/peer/notifier_test.go
@@ -2,33 +2,38 @@ package peer
 
 import (
 	"sync"
+	"sync/atomic"
 	"testing"
+	"time"
 )
 
 type mocListener struct {
-	lastState int
+	lastState ClientState
 	wg        sync.WaitGroup
 	peersWg   sync.WaitGroup
 	peers     int
 }
 
 func (l *mocListener) OnConnected() {
-	l.lastState = stateConnected
+	l.lastState = ClientStateConnected
 	l.wg.Done()
 }
 func (l *mocListener) OnDisconnected() {
-	l.lastState = stateDisconnected
+	l.lastState = ClientStateDisconnected
 	l.wg.Done()
 }
 func (l *mocListener) OnConnecting() {
-	l.lastState = stateConnecting
+	l.lastState = ClientStateConnecting
 	l.wg.Done()
 }
 func (l *mocListener) OnDisconnecting() {
-	l.lastState = stateDisconnecting
+	l.lastState = ClientStateDisconnecting
 	l.wg.Done()
 }
 
+func (l *mocListener) OnStateChanged(state ClientState) {
+
+}
 func (l *mocListener) OnAddressChanged(host, addr string) {
 
 }
@@ -57,15 +62,15 @@ func Test_notifier_serverState(t *testing.T) {
 
 	type scenario struct {
 		name        string
-		expected    int
+		expected    ClientState
 		mgmState    bool
 		signalState bool
 	}
 	scenarios := []scenario{
-		{"connected", stateConnected, true, true},
-		{"mgm down", stateConnecting, false, true},
-		{"signal down", stateConnecting, true, false},
-		{"disconnected", stateDisconnected, false, false},
+		{"connected", ClientStateConnected, true, true},
+		{"mgm down", ClientStateConnecting, false, true},
+		{"signal down", ClientStateConnecting, true, false},
+		{"disconnected", ClientStateDisconnected, false, false},
 	}
 
 	for _, tt := range scenarios {
@@ -85,7 +90,7 @@ func Test_notifier_SetListener(t *testing.T) {
 	listener.setPeersWaiter()
 
 	n := newNotifier()
-	n.lastNotification = stateConnecting
+	n.lastNotification = ClientStateConnecting
 	n.setListener(listener)
 	listener.wait()
 	listener.waitPeers()
@@ -99,7 +104,7 @@ func Test_notifier_RemoveListener(t *testing.T) {
 	listener.setWaiter()
 	listener.setPeersWaiter()
 	n := newNotifier()
-	n.lastNotification = stateConnecting
+	n.lastNotification = ClientStateConnecting
 	n.setListener(listener)
 	// setListener replays cached state on a goroutine; wait for both the state
 	// and peers callbacks to finish so we don't race on listener.peers.
@@ -112,3 +117,156 @@ func Test_notifier_RemoveListener(t *testing.T) {
 		t.Errorf("invalid state: %d", listener.peers)
 	}
 }
+
+type coalescingListener struct {
+	final       int
+	calls       atomic.Int32
+	inFlight    atomic.Int32
+	maxInFlight atomic.Int32
+	last        atomic.Int32
+	done        chan struct{}
+	entered     chan struct{}
+	release     chan struct{}
+	once        sync.Once
+}
+
+func (l *coalescingListener) OnStateChanged(ClientState)      {}
+func (l *coalescingListener) OnConnected()                    {}
+func (l *coalescingListener) OnDisconnected()                 {}
+func (l *coalescingListener) OnConnecting()                   {}
+func (l *coalescingListener) OnDisconnecting()                {}
+func (l *coalescingListener) OnAddressChanged(string, string) {}
+
+func (l *coalescingListener) OnPeersListChanged(size int) {
+	current := l.inFlight.Add(1)
+	for {
+		seen := l.maxInFlight.Load()
+		if current <= seen || l.maxInFlight.CompareAndSwap(seen, current) {
+			break
+		}
+	}
+	if l.calls.Add(1) == 1 && l.entered != nil {
+		close(l.entered)
+	}
+	if l.release != nil {
+		<-l.release
+	}
+	time.Sleep(time.Millisecond)
+	l.last.Store(int32(size))
+	l.inFlight.Add(-1)
+	if size == l.final {
+		l.once.Do(func() { close(l.done) })
+	}
+}
+
+func Test_notifier_PeerListChangedCoalesces(t *testing.T) {
+	const events = 1000
+	listener := &coalescingListener{final: events, done: make(chan struct{})}
+	n := newNotifier()
+	n.setListener(listener)
+
+	for i := 1; i <= events; i++ {
+		n.peerListChanged(i)
+	}
+
+	select {
+	case <-listener.done:
+	case <-time.After(5 * time.Second):
+		t.Fatalf("last peer count not delivered, last seen: %d", listener.last.Load())
+	}
+
+	if got := listener.maxInFlight.Load(); got != 1 {
+		t.Errorf("concurrent deliveries: %d, expected 1", got)
+	}
+	if got := listener.calls.Load(); got >= events {
+		t.Errorf("deliveries not coalesced: %d calls for %d events", got, events)
+	}
+}
+
+func Test_notifier_SetListenerStopsPreviousDeliverer(t *testing.T) {
+	old := &coalescingListener{final: -1}
+	replacement := &coalescingListener{final: 7, done: make(chan struct{})}
+	n := newNotifier()
+	n.setListener(old)
+	oldStop := n.peerListStop
+
+	n.peerListChanged(7)
+	n.setListener(replacement)
+
+	select {
+	case <-oldStop:
+	default:
+		t.Fatal("old deliverer not stopped on listener replacement")
+	}
+	waitFor(t, replacement.done, "replacement listener not notified")
+}
+
+func Test_notifier_RemoveListenerStopsDeliverer(t *testing.T) {
+	n := newNotifier()
+	n.setListener(&coalescingListener{final: -1})
+	stop := n.peerListStop
+
+	n.removeListener()
+
+	select {
+	case <-stop:
+	default:
+		t.Fatal("deliverer not stopped on listener removal")
+	}
+}
+
+func Test_notifier_DelivererExitsAfterInFlightCallback(t *testing.T) {
+	listener := &coalescingListener{
+		final:   -1,
+		entered: make(chan struct{}),
+		release: make(chan struct{}),
+	}
+	n := newNotifier()
+	wake := make(chan struct{}, 1)
+	stop := make(chan struct{})
+	exited := make(chan struct{})
+	go func() {
+		n.deliverPeerListChanges(listener, wake, stop)
+		close(exited)
+	}()
+
+	wake <- struct{}{}
+	waitFor(t, listener.entered, "listener not called")
+
+	n.peerListChanged(7)
+	wake <- struct{}{}
+	close(stop)
+	close(listener.release)
+
+	waitFor(t, exited, "deliverer did not exit after stop")
+	if got := listener.calls.Load(); got != 1 {
+		t.Errorf("deliverer ran %d callbacks after stop, expected only the in-flight one", got)
+	}
+	if got := listener.last.Load(); got == 7 {
+		t.Errorf("deliverer delivered the peer count queued after stop")
+	}
+}
+
+func Test_notifier_DelivererPrefersStopOverPendingWake(t *testing.T) {
+	listener := &coalescingListener{final: -1}
+	n := newNotifier()
+	wake := make(chan struct{}, 1)
+	stop := make(chan struct{})
+
+	wake <- struct{}{}
+	close(stop)
+	n.deliverPeerListChanges(listener, wake, stop)
+
+	if got := listener.calls.Load(); got != 0 {
+		t.Errorf("deliverer ran %d callbacks with stop closed, expected 0", got)
+	}
+}
+
+func waitFor(t *testing.T, ch <-chan struct{}, msg string) {
+	t.Helper()
+	select {
+	case <-ch:
+	case <-time.After(5 * time.Second):
+		t.Fatal(msg)
+	}
+}
diff --git a/client/internal/peer/status.go b/client/internal/peer/status.go
index e48ac333c..b695e3b22 100644
--- a/client/internal/peer/status.go
+++ b/client/internal/peer/status.go
@@ -7,6 +7,7 @@ import (
 	"net/netip"
 	"slices"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/google/uuid"
@@ -17,9 +18,7 @@ import (
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/ingressgw"
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/route"
@@ -29,6 +28,11 @@ import (
 
 const eventQueueSize = 10
 
+// routerLatencyNotifyThreshold is the latency or noise change that notifies the route
+// watchers subscribed to a peer. Latency is resampled continuously, so without
+// a threshold every sample would wake every watcher of every routing peer.
+const routerLatencyNotifyThreshold = 5 * time.Millisecond
+
 type ResolvedDomainInfo struct {
 	Prefixes     []netip.Prefix
 	ParentDomain domain.Domain
@@ -42,11 +46,21 @@ type EventListener interface {
 	OnEvent(event *proto.SystemEvent)
 }
 
+// LatencySample is a peer's smoothed round trip time together with the
+// uncertainty of that estimate, which is what the jitter of the path leaves
+// behind after smoothing. Comparing two peers is only meaningful when their
+// difference is larger than this.
+type LatencySample struct {
+	Latency time.Duration
+	Noise   time.Duration
+}
+
 // RouterState status for router peers. This contains relevant fields for route manager
 type RouterState struct {
-	Status  ConnStatus
-	Relayed bool
-	Latency time.Duration
+	Status       ConnStatus
+	Relayed      bool
+	Latency      time.Duration
+	LatencyNoise time.Duration
 }
 
 // State contains the latest state of a peer
@@ -68,9 +82,11 @@ type State struct {
 	BytesTx                    int64
 	BytesRx                    int64
 	Latency                    time.Duration
-	RosenpassEnabled           bool
-	SSHHostKey                 []byte
-	routes                     map[string]struct{}
+	// LatencyNoise is the uncertainty of Latency on a jittery path
+	LatencyNoise     time.Duration
+	RosenpassEnabled bool
+	SSHHostKey       []byte
+	routes           map[string]struct{}
 }
 
 // AddRoute add a single route to routes map
@@ -104,6 +120,13 @@ func (s *State) GetRoutes() map[string]struct{} {
 	return maps.Clone(s.routes)
 }
 
+// clearLatency drops the latency estimate, which is only measured over a direct
+// connection and says nothing about the path once that connection is gone.
+func (s *State) clearLatency() {
+	s.Latency = 0
+	s.LatencyNoise = 0
+}
+
 // LocalPeerState contains the latest state of the local peer
 type LocalPeerState struct {
 	IP              string
@@ -160,16 +183,29 @@ type FullStatus struct {
 	RosenpassState        RosenpassState
 	Relays                []relay.ProbeResult
 	NSGroupStates         []NSGroupState
-	NumOfForwardingRules  int
 	LazyConnectionEnabled bool
 	Events                []*proto.SystemEvent
 }
 
+// routerSnapshot is a router-state map stamped with a sequence number taken
+// under the status lock. Snapshots are built under the lock but delivered
+// outside it, so two dispatchers can race on the way to a subscriber; the
+// stamp lets delivery drop the older snapshot instead of letting it overwrite
+// a newer one.
+type routerSnapshot struct {
+	seq    uint64
+	states map[string]RouterState
+}
+
 type StatusChangeSubscription struct {
 	peerID     string
 	id         string
 	eventsChan chan map[string]RouterState
 	ctx        context.Context
+
+	// sendMu serializes deliveries and guards lastSeq
+	sendMu  sync.Mutex
+	lastSeq uint64
 }
 
 func newStatusChangeSubscription(ctx context.Context, peerID string) *StatusChangeSubscription {
@@ -186,28 +222,73 @@ func (s *StatusChangeSubscription) Events() chan map[string]RouterState {
 	return s.eventsChan
 }
 
+// deliver forwards a snapshot to the subscriber, dropping it when a newer one
+// has already been delivered. A blocking deliver waits for buffer space, since
+// peer state transitions must not be lost. A non-blocking one gives up when the
+// subscriber is backlogged or another delivery is in flight; it is meant for
+// latency refreshes, which are superseded by the next sample anyway and are
+// also re-read from the recorder on the route watchers' periodic re-evaluation.
+// Only a snapshot that reached the subscriber supersedes older ones.
+func (s *StatusChangeSubscription) deliver(snapshot *routerSnapshot, block bool) {
+	if block {
+		s.sendMu.Lock()
+	} else if !s.sendMu.TryLock() {
+		return
+	}
+	defer s.sendMu.Unlock()
+
+	if snapshot.seq <= s.lastSeq {
+		return
+	}
+
+	if block {
+		select {
+		case s.eventsChan <- snapshot.states:
+			s.lastSeq = snapshot.seq
+		case <-s.ctx.Done():
+		}
+		return
+	}
+
+	select {
+	case s.eventsChan <- snapshot.states:
+		s.lastSeq = snapshot.seq
+	default:
+	}
+}
+
 // Status holds a state of peers, signal, management connections and relays.
 // mux is an RWMutex so hot read paths (notably PeerStateByIP, called for
 // every private-service request) don't contend against each other.
 // Pure read methods take RLock; anything that mutates state takes Lock.
 type Status struct {
-	mux                   sync.RWMutex
-	muxRelays             sync.RWMutex
-	peers                 map[string]State
-	ipToKey               map[string]string
-	changeNotify          map[string]map[string]*StatusChangeSubscription // map[peerID]map[subscriptionID]*StatusChangeSubscription
-	signalState           bool
-	signalError           error
-	managementState       bool
-	managementError       error
-	relayStates           []relay.ProbeResult
-	localPeer             LocalPeerState
-	offlinePeers          []State
-	mgmAddress            string
-	signalAddress         string
-	notifier              *notifier
-	rosenpassEnabled      bool
-	rosenpassPermissive   bool
+	mux              sync.RWMutex
+	muxRelays        sync.RWMutex
+	peers            map[string]State
+	ipToKey          map[string]string
+	activeRoutePeers map[route.HAUniqueID]string
+	changeNotify     map[string]map[string]*StatusChangeSubscription // map[peerID]map[subscriptionID]*StatusChangeSubscription
+	// routerSeq stamps router-state snapshots, see routerSnapshot
+	routerSeq           uint64
+	signalState         bool
+	signalError         error
+	managementState     bool
+	managementError     error
+	relayStates         []relay.ProbeResult
+	localPeer           LocalPeerState
+	offlinePeers        []State
+	mgmAddress          string
+	signalAddress       string
+	notifier            *notifier
+	rosenpassEnabled    bool
+	rosenpassPermissive bool
+	// sessionExpiresAt is the absolute UTC instant at which the peer's SSO
+	// session expires. Zero when the peer is not SSO-tracked or login
+	// expiration is disabled. Populated from management LoginResponse /
+	// SyncResponse and exposed via the daemon's Status / SubscribeStatus RPC
+	// so the UI can show remaining time without itself talking to mgm.
+	sessionExpiresAt time.Time
+
 	nsGroupStates         []NSGroupState
 	resolvedDomainsStates map[domain.Domain]ResolvedDomainInfo
 	lazyConnectionEnabled bool
@@ -223,7 +304,20 @@ type Status struct {
 	eventStreams map[string]chan *proto.SystemEvent
 	eventQueue   *EventQueue
 
-	ingressGwMgr *ingressgw.Manager
+	// stateChangeStreams fan-out connection-state changes (connected /
+	// disconnected / connecting / address change / peers list change) to
+	// every active SubscribeStatus gRPC stream. Each subscriber gets a
+	// buffered chan; the notifier non-blockingly pings them so a slow
+	// consumer can never stall the daemon.
+	stateChangeMux     sync.Mutex
+	stateChangeStreams map[string]chan struct{}
+
+	// networksRevision bumps whenever the routed-networks set or their
+	// selected state changes (driven by the route manager). Surfaced in the
+	// status snapshot so the UI can fingerprint on it and re-fetch
+	// ListNetworks only on a real change. Atomic so the snapshot builder can
+	// read it without taking mux.
+	networksRevision atomic.Uint64
 
 	routeIDLookup routeIDLookup
 	wgIface       WGIfaceStatus
@@ -234,9 +328,11 @@ func NewRecorder(mgmAddress string) *Status {
 	return &Status{
 		peers:                 make(map[string]State),
 		ipToKey:               make(map[string]string),
+		activeRoutePeers:      make(map[route.HAUniqueID]string),
 		changeNotify:          make(map[string]map[string]*StatusChangeSubscription),
 		eventStreams:          make(map[string]chan *proto.SystemEvent),
 		eventQueue:            NewEventQueue(eventQueueSize),
+		stateChangeStreams:    make(map[string]chan struct{}),
 		offlinePeers:          make([]State, 0),
 		notifier:              newNotifier(),
 		mgmAddress:            mgmAddress,
@@ -250,12 +346,6 @@ func (d *Status) SetRelayMgr(manager *relayClient.Manager) {
 	d.relayMgr = manager
 }
 
-func (d *Status) SetIngressGwMgr(ingressGwMgr *ingressgw.Manager) {
-	d.mux.Lock()
-	defer d.mux.Unlock()
-	d.ingressGwMgr = ingressGwMgr
-}
-
 // ReplaceOfflinePeers replaces
 func (d *Status) ReplaceOfflinePeers(replacement []State) {
 	d.mux.Lock()
@@ -306,18 +396,6 @@ func (d *Status) GetPeer(peerPubKey string) (State, error) {
 	return state, nil
 }
 
-func (d *Status) PeerByIP(ip string) (string, bool) {
-	d.mux.RLock()
-	defer d.mux.RUnlock()
-
-	for _, state := range d.peers {
-		if state.IP == ip {
-			return state.FQDN, true
-		}
-	}
-	return "", false
-}
-
 // PeerStateByIP returns the full peer State for the given tunnel IP.
 // Matches against either the IPv4 (State.IP) or IPv6 (State.IPv6) tunnel
 // address so dual-stack peers are reachable on either family. Only
@@ -383,6 +461,7 @@ func (d *Status) UpdatePeerState(receivedState State) error {
 		peerState.RemoteIceCandidateEndpoint = receivedState.RemoteIceCandidateEndpoint
 		peerState.RelayServerAddress = receivedState.RelayServerAddress
 		peerState.RosenpassEnabled = receivedState.RosenpassEnabled
+		peerState.clearLatency()
 	}
 
 	d.peers[receivedState.PubKey] = peerState
@@ -399,8 +478,9 @@ func (d *Status) UpdatePeerState(receivedState State) error {
 		d.notifier.peerListChanged(numPeers)
 	}
 	if notifyRouter {
-		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
+		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot, true)
 	}
+	d.notifyStateChange()
 	return nil
 }
 
@@ -426,6 +506,7 @@ func (d *Status) AddPeerStateRoute(peer string, route string, resourceId route.R
 
 	// todo: consider to make sense of this notification or not
 	d.notifier.peerListChanged(numPeers)
+	d.notifyStateChange()
 	return nil
 }
 
@@ -451,9 +532,28 @@ func (d *Status) RemovePeerStateRoute(peer string, route string) error {
 
 	// todo: consider to make sense of this notification or not
 	d.notifier.peerListChanged(numPeers)
+	d.notifyStateChange()
 	return nil
 }
 
+func (d *Status) AddActiveRoutePeer(haID route.HAUniqueID, peer string) {
+	d.mux.Lock()
+	defer d.mux.Unlock()
+	d.activeRoutePeers[haID] = peer
+}
+
+func (d *Status) RemoveActiveRoutePeer(haID route.HAUniqueID) {
+	d.mux.Lock()
+	defer d.mux.Unlock()
+	delete(d.activeRoutePeers, haID)
+}
+
+func (d *Status) GetActiveRoutePeers() map[route.HAUniqueID]string {
+	d.mux.RLock()
+	defer d.mux.RUnlock()
+	return maps.Clone(d.activeRoutePeers)
+}
+
 // CheckRoutes checks if the source and destination addresses are within the same route
 // and returns the resource ID of the route that contains the addresses
 func (d *Status) CheckRoutes(ip netip.Addr) ([]byte, bool) {
@@ -498,8 +598,9 @@ func (d *Status) UpdatePeerICEState(receivedState State) error {
 		d.notifier.peerListChanged(numPeers)
 	}
 	if notifyRouter {
-		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
+		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot, true)
 	}
+	d.notifyStateChange()
 	return nil
 }
 
@@ -534,8 +635,9 @@ func (d *Status) UpdatePeerRelayedState(receivedState State) error {
 		d.notifier.peerListChanged(numPeers)
 	}
 	if notifyRouter {
-		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
+		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot, true)
 	}
+	d.notifyStateChange()
 	return nil
 }
 
@@ -569,8 +671,9 @@ func (d *Status) UpdatePeerRelayedStateToDisconnected(receivedState State) error
 		d.notifier.peerListChanged(numPeers)
 	}
 	if notifyRouter {
-		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
+		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot, true)
 	}
+	d.notifyStateChange()
 	return nil
 }
 
@@ -593,6 +696,7 @@ func (d *Status) UpdatePeerICEStateToDisconnected(receivedState State) error {
 	peerState.RemoteIceCandidateType = receivedState.RemoteIceCandidateType
 	peerState.LocalIceCandidateEndpoint = receivedState.LocalIceCandidateEndpoint
 	peerState.RemoteIceCandidateEndpoint = receivedState.RemoteIceCandidateEndpoint
+	peerState.clearLatency()
 
 	d.peers[receivedState.PubKey] = peerState
 
@@ -607,8 +711,9 @@ func (d *Status) UpdatePeerICEStateToDisconnected(receivedState State) error {
 		d.notifier.peerListChanged(numPeers)
 	}
 	if notifyRouter {
-		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
+		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot, true)
 	}
+	d.notifyStateChange()
 	return nil
 }
 
@@ -686,7 +791,7 @@ func (d *Status) FinishPeerListModifications() {
 	// snapshot per-peer router state to deliver after the lock is released
 	type routerDispatch struct {
 		peerID   string
-		snapshot map[string]RouterState
+		snapshot *routerSnapshot
 	}
 	dispatches := make([]routerDispatch, 0, len(d.peers))
 	for key := range d.peers {
@@ -700,8 +805,9 @@ func (d *Status) FinishPeerListModifications() {
 
 	d.notifier.peerListChanged(numPeers)
 	for _, rd := range dispatches {
-		d.dispatchRouterPeers(rd.peerID, rd.snapshot)
+		d.dispatchRouterPeers(rd.peerID, rd.snapshot, true)
 	}
+	d.notifyStateChange()
 }
 
 func (d *Status) SubscribeToPeerStateChanges(ctx context.Context, peerID string) *StatusChangeSubscription {
@@ -760,6 +866,36 @@ func (d *Status) UpdateLocalPeerState(localPeerState LocalPeerState) {
 	d.mux.Unlock()
 
 	d.notifier.localAddressChanged(fqdn, ip)
+	d.notifyStateChange()
+}
+
+// SetSessionExpiresAt records the absolute UTC instant at which the peer's
+// SSO session is set to expire. Pass the zero value to clear (e.g. when the
+// management server stops publishing a deadline because login expiration was
+// disabled or the peer is not SSO-tracked). Same-value updates are no-ops;
+// real changes fan out via notifyStateChange so SubscribeStatus consumers
+// pick up the new deadline on their next read.
+func (d *Status) SetSessionExpiresAt(deadline time.Time) {
+	d.mux.Lock()
+	if d.sessionExpiresAt.Equal(deadline) {
+		d.mux.Unlock()
+		return
+	}
+	d.sessionExpiresAt = deadline
+	d.mux.Unlock()
+	d.notifyStateChange()
+}
+
+// GetSessionExpiresAt returns the most recently recorded SSO session deadline,
+// or the zero value when no deadline is tracked. A deadline in the past is
+// returned as-is: it means the session has expired, and consumers (tray row,
+// CLI status) render it as "expired" rather than hiding it — masking it as
+// "none" would blank the UI at the exact moment it should say the session
+// ended.
+func (d *Status) GetSessionExpiresAt() time.Time {
+	d.mux.RLock()
+	defer d.mux.RUnlock()
+	return d.sessionExpiresAt
 }
 
 // AddLocalPeerStateRoute adds a route to the local peer state
@@ -828,11 +964,19 @@ func (d *Status) CleanLocalPeerState() {
 	d.mux.Unlock()
 
 	d.notifier.localAddressChanged(fqdn, ip)
+	d.notifyStateChange()
 }
 
 // MarkManagementDisconnected sets ManagementState to disconnected
 func (d *Status) MarkManagementDisconnected(err error) {
 	d.mux.Lock()
+	// Health checks re-mark the same state on every probe; skip the fan-out
+	// when nothing actually changed so we don't flood SubscribeStatus
+	// consumers with identical snapshots.
+	if !d.managementState && errors.Is(d.managementError, err) {
+		d.mux.Unlock()
+		return
+	}
 	d.managementState = false
 	d.managementError = err
 	mgm := d.managementState
@@ -840,11 +984,16 @@ func (d *Status) MarkManagementDisconnected(err error) {
 	d.mux.Unlock()
 
 	d.notifier.updateServerStates(mgm, sig)
+	d.notifyStateChange()
 }
 
 // MarkManagementConnected sets ManagementState to connected
 func (d *Status) MarkManagementConnected() {
 	d.mux.Lock()
+	if d.managementState && d.managementError == nil {
+		d.mux.Unlock()
+		return
+	}
 	d.managementState = true
 	d.managementError = nil
 	mgm := d.managementState
@@ -852,6 +1001,7 @@ func (d *Status) MarkManagementConnected() {
 	d.mux.Unlock()
 
 	d.notifier.updateServerStates(mgm, sig)
+	d.notifyStateChange()
 }
 
 // UpdateSignalAddress update the address of the signal server
@@ -885,6 +1035,10 @@ func (d *Status) UpdateLazyConnection(enabled bool) {
 // MarkSignalDisconnected sets SignalState to disconnected
 func (d *Status) MarkSignalDisconnected(err error) {
 	d.mux.Lock()
+	if !d.signalState && errors.Is(d.signalError, err) {
+		d.mux.Unlock()
+		return
+	}
 	d.signalState = false
 	d.signalError = err
 	mgm := d.managementState
@@ -892,11 +1046,16 @@ func (d *Status) MarkSignalDisconnected(err error) {
 	d.mux.Unlock()
 
 	d.notifier.updateServerStates(mgm, sig)
+	d.notifyStateChange()
 }
 
 // MarkSignalConnected sets SignalState to connected
 func (d *Status) MarkSignalConnected() {
 	d.mux.Lock()
+	if d.signalState && d.signalError == nil {
+		d.mux.Unlock()
+		return
+	}
 	d.signalState = true
 	d.signalError = nil
 	mgm := d.managementState
@@ -904,6 +1063,7 @@ func (d *Status) MarkSignalConnected() {
 	d.mux.Unlock()
 
 	d.notifier.updateServerStates(mgm, sig)
+	d.notifyStateChange()
 }
 
 func (d *Status) UpdateRelayStates(relayResults []relay.ProbeResult) {
@@ -974,22 +1134,42 @@ func (d *Status) GetManagementState() ManagementState {
 	}
 }
 
-func (d *Status) UpdateLatency(pubKey string, latency time.Duration) error {
-	if latency <= 0 {
+func (d *Status) UpdateLatency(pubKey string, sample LatencySample) error {
+	if sample.Latency <= 0 {
 		return nil
 	}
 
 	d.mux.Lock()
-	defer d.mux.Unlock()
 	peerState, ok := d.peers[pubKey]
 	if !ok {
+		d.mux.Unlock()
 		return errors.New("peer doesn't exist")
 	}
-	peerState.Latency = latency
+
+	previous, previousNoise := peerState.Latency, peerState.LatencyNoise
+	peerState.Latency = sample.Latency
+	peerState.LatencyNoise = sample.Noise
 	d.peers[pubKey] = peerState
+
+	// the noise sets the switch margin, so it counts on its own
+	notifyRouter := absDuration(sample.Latency-previous) >= routerLatencyNotifyThreshold ||
+		absDuration(sample.Noise-previousNoise) >= routerLatencyNotifyThreshold
+	routerSnapshot := d.snapshotRouterPeersLocked(pubKey, notifyRouter)
+
+	d.mux.Unlock()
+
+	d.dispatchRouterPeers(pubKey, routerSnapshot, false)
+
 	return nil
 }
 
+func absDuration(d time.Duration) time.Duration {
+	if d < 0 {
+		return -d
+	}
+	return d
+}
+
 // IsLoginRequired determines if a peer's login has expired.
 func (d *Status) IsLoginRequired() bool {
 	d.mux.RLock()
@@ -1057,16 +1237,6 @@ func (d *Status) GetRelayStates() []relay.ProbeResult {
 	return relayStates
 }
 
-func (d *Status) ForwardingRules() []firewall.ForwardRule {
-	d.mux.RLock()
-	defer d.mux.RUnlock()
-	if d.ingressGwMgr == nil {
-		return nil
-	}
-
-	return d.ingressGwMgr.Rules()
-}
-
 func (d *Status) GetDNSStates() []NSGroupState {
 	d.mux.RLock()
 	defer d.mux.RUnlock()
@@ -1081,6 +1251,18 @@ func (d *Status) GetResolvedDomainsStates() map[domain.Domain]ResolvedDomainInfo
 	return maps.Clone(d.resolvedDomainsStates)
 }
 
+// GetPeerStates returns a snapshot of all known peer states, including offline peers.
+func (d *Status) GetPeerStates() []State {
+	d.mux.RLock()
+	defer d.mux.RUnlock()
+
+	states := make([]State, 0, d.numOfPeers())
+	for _, state := range d.peers {
+		states = append(states, state)
+	}
+	return append(states, d.offlinePeers...)
+}
+
 // GetFullStatus gets full status
 func (d *Status) GetFullStatus() FullStatus {
 	fullStatus := FullStatus{
@@ -1089,7 +1271,6 @@ func (d *Status) GetFullStatus() FullStatus {
 		Relays:                d.GetRelayStates(),
 		RosenpassState:        d.GetRosenpassState(),
 		NSGroupStates:         d.GetDNSStates(),
-		NumOfForwardingRules:  len(d.ForwardingRules()),
 		LazyConnectionEnabled: d.GetLazyConnection(),
 	}
 
@@ -1110,16 +1291,25 @@ func (d *Status) GetFullStatus() FullStatus {
 // ClientStart will notify all listeners about the new service state
 func (d *Status) ClientStart() {
 	d.notifier.clientStart()
+	d.notifyStateChange()
 }
 
 // ClientStop will notify all listeners about the new service state
 func (d *Status) ClientStop() {
 	d.notifier.clientStop()
+	d.notifyStateChange()
 }
 
 // ClientTeardown will notify all listeners about the service is under teardown
 func (d *Status) ClientTeardown() {
 	d.notifier.clientTearDown()
+	d.notifyStateChange()
+}
+
+// SetNetworkAvailable records the OS-reported network availability; while
+// unavailable, listeners see NoNetwork instead of Connecting.
+func (d *Status) SetNetworkAvailable(available bool) {
+	d.notifier.setNetworkAvailable(available)
 }
 
 // SetConnectionListener set a listener to the notifier
@@ -1136,7 +1326,7 @@ func (d *Status) RemoveConnectionListener() {
 // Caller MUST hold d.mux. Returns nil when there are no subscribers for peerID
 // or when notify is false. The snapshot is consumed later by dispatchRouterPeers
 // outside the lock so the channel send cannot stall any d.mux holder.
-func (d *Status) snapshotRouterPeersLocked(peerID string, notify bool) map[string]RouterState {
+func (d *Status) snapshotRouterPeersLocked(peerID string, notify bool) *routerSnapshot {
 	if !notify {
 		return nil
 	}
@@ -1151,22 +1341,29 @@ func (d *Status) snapshotRouterPeersLocked(peerID string, notify bool) map[strin
 			continue
 		}
 		routerPeers[pid] = RouterState{
-			Status:  s.ConnStatus,
-			Relayed: s.Relayed,
-			Latency: s.Latency,
+			Status:       s.ConnStatus,
+			Relayed:      s.Relayed,
+			Latency:      s.Latency,
+			LatencyNoise: s.LatencyNoise,
 		}
 	}
-	return routerPeers
+
+	d.routerSeq++
+
+	return &routerSnapshot{seq: d.routerSeq, states: routerPeers}
 }
 
 // dispatchRouterPeers delivers a previously snapshotted router-state map to
 // the peer's subscribers. Caller MUST NOT hold d.mux. The method takes a
 // fresh, short read of d.changeNotify under the lock to grab subscriber
 // channels, then sends outside the lock so a slow consumer cannot block other
-// d.mux holders. The send itself stays blocking (only short-circuited by the
-// subscriber's context) so peer state transitions are not silently dropped.
-func (d *Status) dispatchRouterPeers(peerID string, routerPeers map[string]RouterState) {
-	if routerPeers == nil {
+// d.mux holders. With block set, the send waits for buffer space (only
+// short-circuited by the subscriber's context) so peer state transitions are
+// not silently dropped; without it, a backlogged subscriber loses the snapshot
+// instead of stalling the caller. Out-of-order deliveries are dropped either
+// way, see StatusChangeSubscription.deliver.
+func (d *Status) dispatchRouterPeers(peerID string, snapshot *routerSnapshot, block bool) {
+	if snapshot == nil {
 		return
 	}
 
@@ -1181,10 +1378,7 @@ func (d *Status) dispatchRouterPeers(peerID string, routerPeers map[string]Route
 	d.mux.Unlock()
 
 	for _, sub := range subs {
-		select {
-		case sub.eventsChan <- routerPeers:
-		case <-sub.ctx.Done():
-		}
+		sub.deliver(snapshot, block)
 	}
 }
 
@@ -1261,6 +1455,79 @@ func (d *Status) GetEventHistory() []*proto.SystemEvent {
 	return d.eventQueue.GetAll()
 }
 
+// SubscribeToStateChanges hands back a channel that receives a tick on
+// every connection-state change (connected / disconnected / connecting /
+// address change / peers-list change). The channel is buffered to one
+// pending tick so a coalesced burst still wakes the consumer exactly
+// once. Pass the returned id to UnsubscribeFromStateChanges to detach.
+func (d *Status) SubscribeToStateChanges() (string, <-chan struct{}) {
+	d.stateChangeMux.Lock()
+	defer d.stateChangeMux.Unlock()
+
+	id := uuid.New().String()
+	ch := make(chan struct{}, 1)
+	d.stateChangeStreams[id] = ch
+	return id, ch
+}
+
+// UnsubscribeFromStateChanges releases a SubscribeToStateChanges channel
+// and closes it so any consumer goroutine selecting on the channel
+// unblocks cleanly.
+func (d *Status) UnsubscribeFromStateChanges(id string) {
+	d.stateChangeMux.Lock()
+	defer d.stateChangeMux.Unlock()
+
+	if ch, ok := d.stateChangeStreams[id]; ok {
+		close(ch)
+		delete(d.stateChangeStreams, id)
+	}
+}
+
+// notifyStateChange wakes every SubscribeToStateChanges subscriber. Drops
+// the tick if a subscriber's buffer is full — by definition the consumer
+// is already going to fetch the latest snapshot, so multiple pending ticks
+// would be redundant.
+func (d *Status) notifyStateChange() {
+	d.stateChangeMux.Lock()
+	defer d.stateChangeMux.Unlock()
+
+	for _, ch := range d.stateChangeStreams {
+		select {
+		case ch <- struct{}{}:
+		default:
+		}
+	}
+}
+
+// NotifyStateChange is the public wake-the-subscribers entry point used by
+// callers that mutate state outside the peer recorder — most importantly
+// the connect-state machine, which writes StatusNeedsLogin into the
+// shared contextState (client/internal/state.go) without touching any
+// recorder field. Without this push the SubscribeStatus stream stays on
+// the previous snapshot until an unrelated peer/management/signal
+// change happens to fire notifyStateChange, leaving the UI's status
+// out of sync with the daemon.
+func (d *Status) NotifyStateChange() {
+	d.notifyStateChange()
+}
+
+// BumpNetworksRevision increments the routed-networks revision and wakes every
+// SubscribeStatus subscriber. The route manager calls it when a network map
+// changes the available routes or when a selection is applied — the peer
+// status itself only records actively-routed (chosen) networks, so without
+// this bump a candidate route appearing/disappearing would never reach the UI.
+func (d *Status) BumpNetworksRevision() {
+	d.networksRevision.Add(1)
+	d.notifyStateChange()
+}
+
+// GetNetworksRevision returns the current routed-networks revision, surfaced in
+// the status snapshot so the UI can detect route/selection changes (see
+// BumpNetworksRevision).
+func (d *Status) GetNetworksRevision() uint64 {
+	return d.networksRevision.Load()
+}
+
 func (d *Status) SetWgIface(wgInterface WGIfaceStatus) {
 	d.mux.Lock()
 	defer d.mux.Unlock()
@@ -1379,7 +1646,6 @@ func (fs FullStatus) ToProto() *proto.FullStatus {
 	pbFullStatus.LocalPeerState.WgPort = int32(fs.LocalPeerState.WgPort)
 	pbFullStatus.LocalPeerState.RosenpassPermissive = fs.RosenpassState.Permissive
 	pbFullStatus.LocalPeerState.RosenpassEnabled = fs.RosenpassState.Enabled
-	pbFullStatus.NumberOfForwardingRules = int32(fs.NumOfForwardingRules)
 	pbFullStatus.LazyConnectionEnabled = fs.LazyConnectionEnabled
 
 	pbFullStatus.LocalPeerState.Networks = maps.Keys(fs.LocalPeerState.Routes)
diff --git a/client/internal/peer/status_test.go b/client/internal/peer/status_test.go
index 17ed47cd3..2d910ccf5 100644
--- a/client/internal/peer/status_test.go
+++ b/client/internal/peer/status_test.go
@@ -9,6 +9,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/route"
 )
 
 func TestAddPeer(t *testing.T) {
@@ -42,6 +44,184 @@ func TestGetPeer(t *testing.T) {
 	assert.Error(t, err, "should return error when peer doesn't exist")
 }
 
+func TestUpdateLatencyNotifiesRouteWatchers(t *testing.T) {
+	key := "abc"
+	status := NewRecorder("https://mgm")
+	require.NoError(t, status.AddPeer(key, "abc.netbird", "100.108.254.1", ""))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	sub := status.SubscribeToPeerStateChanges(ctx, key)
+
+	require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 40 * time.Millisecond}))
+	select {
+	case states := <-sub.Events():
+		assert.Equal(t, 40*time.Millisecond, states[key].Latency, "the notified state should carry the new latency")
+	default:
+		t.Fatal("expected a router state notification for the first latency sample")
+	}
+
+	// below routerLatencyNotifyThreshold: recorded, but not worth waking the watchers
+	require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 42 * time.Millisecond}))
+	select {
+	case <-sub.Events():
+		t.Fatal("a latency change below the threshold should not notify")
+	default:
+	}
+
+	peerState, err := status.GetPeer(key)
+	require.NoError(t, err)
+	assert.Equal(t, 42*time.Millisecond, peerState.Latency, "the latency should be recorded even without a notification")
+
+	require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 100 * time.Millisecond}))
+	select {
+	case states := <-sub.Events():
+		assert.Equal(t, 100*time.Millisecond, states[key].Latency, "a significant latency change should notify")
+	default:
+		t.Fatal("expected a router state notification for a significant latency change")
+	}
+
+	// the noise feeds the switch margin, so a large change in it matters on its
+	// own even when the latency stays put
+	require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 100 * time.Millisecond, Noise: 20 * time.Millisecond}))
+	select {
+	case states := <-sub.Events():
+		assert.Equal(t, 20*time.Millisecond, states[key].LatencyNoise, "a significant noise change should notify")
+	default:
+		t.Fatal("expected a router state notification for a significant noise change")
+	}
+
+	require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 100 * time.Millisecond, Noise: 21 * time.Millisecond}))
+	select {
+	case <-sub.Events():
+		t.Fatal("a noise change below the threshold should not notify")
+	default:
+	}
+}
+
+// TestSubscriptionDeliverOrdering covers the sequence stamping: snapshots are
+// built under the status lock but delivered outside it, so a dispatcher that
+// is descheduled between the two can deliver an outdated snapshot after a
+// newer one. The older snapshot must be dropped, not delivered.
+func TestSubscriptionDeliverOrdering(t *testing.T) {
+	sub := newStatusChangeSubscription(context.Background(), "peer")
+
+	newer := &routerSnapshot{seq: 2, states: map[string]RouterState{"peer": {Status: StatusConnecting}}}
+	older := &routerSnapshot{seq: 1, states: map[string]RouterState{"peer": {Status: StatusConnected}}}
+
+	sub.deliver(newer, true)
+	sub.deliver(older, true)
+
+	select {
+	case states := <-sub.Events():
+		assert.Equal(t, StatusConnecting, states["peer"].Status, "the newer snapshot should be delivered")
+	default:
+		t.Fatal("expected the newer snapshot to be delivered")
+	}
+
+	select {
+	case <-sub.Events():
+		t.Fatal("the outdated snapshot must be dropped, not delivered after the newer one")
+	default:
+	}
+}
+
+// TestSubscriptionDeliverNonBlocking covers the latency dispatch path: a
+// backlogged subscriber must not block the sender, and the dropped snapshot is
+// recovered from the recorder by the route watchers' periodic re-evaluation.
+func TestSubscriptionDeliverNonBlocking(t *testing.T) {
+	sub := newStatusChangeSubscription(context.Background(), "peer")
+
+	// fill the subscription buffer with no consumer draining it
+	seq := uint64(1)
+	for {
+		before := len(sub.eventsChan)
+		sub.deliver(&routerSnapshot{seq: seq, states: map[string]RouterState{}}, false)
+		seq++
+		if len(sub.eventsChan) == before {
+			break
+		}
+	}
+
+	done := make(chan struct{})
+	go func() {
+		sub.deliver(&routerSnapshot{seq: seq, states: map[string]RouterState{}}, false)
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("a non-blocking deliver must return with the buffer full")
+	}
+}
+
+// A snapshot the subscriber never received must not count as delivered: a
+// state transition dispatched just before it, but delivered just after, would
+// otherwise be dropped as outdated and never reach the subscriber.
+func TestSubscriptionDroppedDeliveryDoesNotSupersede(t *testing.T) {
+	sub := newStatusChangeSubscription(context.Background(), "peer")
+
+	for seq := uint64(1); seq <= uint64(cap(sub.eventsChan)); seq++ {
+		sub.deliver(&routerSnapshot{seq: seq, states: map[string]RouterState{}}, false)
+	}
+	require.Len(t, sub.eventsChan, cap(sub.eventsChan), "the buffer must be full")
+
+	// a latency refresh stamped after the transition wins the race to the
+	// subscriber and is dropped on the full buffer
+	transition := &routerSnapshot{seq: 100, states: map[string]RouterState{"peer": {Status: StatusConnecting}}}
+	latency := &routerSnapshot{seq: 101, states: map[string]RouterState{"peer": {Status: StatusConnected}}}
+	sub.deliver(latency, false)
+
+	for range cap(sub.eventsChan) {
+		<-sub.eventsChan
+	}
+	sub.deliver(transition, true)
+
+	select {
+	case states := <-sub.Events():
+		assert.Equal(t, StatusConnecting, states["peer"].Status, "the transition must be delivered")
+	default:
+		t.Fatal("a transition must not be dropped because a later snapshot was dropped")
+	}
+}
+
+// Latency is only measured over a direct connection. Once it is gone the last
+// sample describes a path the traffic no longer takes, and must not be compared
+// against other routing peers as if it were current.
+func TestLatencyClearedWithDirectConnection(t *testing.T) {
+	const key = "abc"
+
+	newStatus := func(t *testing.T) *Status {
+		t.Helper()
+		status := NewRecorder("https://mgm")
+		require.NoError(t, status.AddPeer(key, "peer-a.netbird.local", "10.10.10.10", ""))
+		require.NoError(t, status.UpdatePeerICEState(State{PubKey: key, ConnStatus: StatusConnected}))
+		require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 20 * time.Millisecond, Noise: time.Millisecond}))
+		return status
+	}
+
+	assertCleared := func(t *testing.T, status *Status) {
+		t.Helper()
+		state, err := status.GetPeer(key)
+		require.NoError(t, err)
+		assert.Zero(t, state.Latency, "the latency of the lost direct path must be cleared")
+		assert.Zero(t, state.LatencyNoise, "the noise of the lost direct path must be cleared")
+	}
+
+	t.Run("ice disconnected, relayed", func(t *testing.T) {
+		status := newStatus(t)
+		require.NoError(t, status.UpdatePeerICEStateToDisconnected(State{PubKey: key, ConnStatus: StatusConnected, Relayed: true}))
+		assertCleared(t, status)
+	})
+
+	t.Run("connection closed", func(t *testing.T) {
+		status := newStatus(t)
+		require.NoError(t, status.UpdatePeerState(State{PubKey: key, ConnStatus: StatusIdle}))
+		assertCleared(t, status)
+	})
+}
+
 func TestUpdatePeerState(t *testing.T) {
 	key := "abc"
 	ip := "10.10.10.10"
@@ -129,6 +309,28 @@ func TestStatus_PeerStateByIP_RemovedPeer(t *testing.T) {
 	req.False(ok, "removed peer must not resolve by IPv6 tunnel address")
 }
 
+// TestStatus_GetPeerStates_IncludesOfflinePeers keeps the snapshot in line with
+// GetFullStatus: offline peers are known peers, so a consumer counting peers
+// must see the same total the status command reports.
+func TestStatus_GetPeerStates_IncludesOfflinePeers(t *testing.T) {
+	status := NewRecorder("https://mgm")
+	req := require.New(t)
+
+	req.NoError(status.AddPeer("pk-online", "online.netbird", "100.64.0.10", "fd00::1"))
+	status.ReplaceOfflinePeers([]State{
+		{PubKey: "pk-offline", FQDN: "offline.netbird", IP: "100.64.0.20", ConnStatus: StatusIdle},
+	})
+
+	states := status.GetPeerStates()
+	req.Len(states, 2, "snapshot must carry both the online and the offline peer")
+
+	keys := make([]string, 0, len(states))
+	for _, s := range states {
+		keys = append(keys, s.PubKey)
+	}
+	req.ElementsMatch([]string{"pk-online", "pk-offline"}, keys, "snapshot must carry both peers")
+}
+
 func TestStatus_UpdatePeerFQDN(t *testing.T) {
 	key := "abc"
 	fqdn := "peer-a.netbird.local"
@@ -314,3 +516,60 @@ func TestGetFullStatus(t *testing.T) {
 	assert.Equal(t, signalState, fullStatus.SignalState, "signal status should be equal")
 	assert.ElementsMatch(t, []State{peerState1, peerState2}, fullStatus.Peers, "peers states should match")
 }
+
+// notified reports whether a state-change tick is pending on ch, draining it.
+func notified(ch <-chan struct{}) bool {
+	select {
+	case <-ch:
+		return true
+	default:
+		return false
+	}
+}
+
+func TestMarkServerStateDoesNotNotifyWhenUnchanged(t *testing.T) {
+	status := NewRecorder("https://mgm")
+	_, ch := status.SubscribeToStateChanges()
+
+	// First transition is a real change and must notify.
+	status.MarkManagementConnected()
+	require.True(t, notified(ch), "first connect should notify")
+
+	// Re-marking the same state must not notify again.
+	status.MarkManagementConnected()
+	assert.False(t, notified(ch), "redundant connect should not notify")
+
+	// Same for signal.
+	status.MarkSignalConnected()
+	require.True(t, notified(ch), "first signal connect should notify")
+	status.MarkSignalConnected()
+	assert.False(t, notified(ch), "redundant signal connect should not notify")
+
+	// A genuine change (disconnect with an error) notifies again.
+	err := errors.New("boom")
+	status.MarkManagementDisconnected(err)
+	require.True(t, notified(ch), "disconnect should notify")
+	status.MarkManagementDisconnected(err)
+	assert.False(t, notified(ch), "redundant disconnect should not notify")
+}
+
+func TestActiveRoutePeers(t *testing.T) {
+	status := NewRecorder("https://mgm")
+	netA := route.HAUniqueID("net-a-10.0.0.0/24")
+	netB := route.HAUniqueID("net-b-10.0.0.0/24")
+
+	status.AddActiveRoutePeer(netA, "peerA")
+	status.AddActiveRoutePeer(netB, "peerB")
+
+	active := status.GetActiveRoutePeers()
+	assert.Equal(t, "peerA", active[netA])
+	assert.Equal(t, "peerB", active[netB])
+
+	status.RemoveActiveRoutePeer(netA)
+	delete(active, netB)
+
+	active = status.GetActiveRoutePeers()
+	_, ok := active[netA]
+	assert.False(t, ok)
+	assert.Equal(t, "peerB", active[netB])
+}
diff --git a/client/internal/peer/wg_watcher.go b/client/internal/peer/wg_watcher.go
index 4fc883d17..39e3d3264 100644
--- a/client/internal/peer/wg_watcher.go
+++ b/client/internal/peer/wg_watcher.go
@@ -3,7 +3,6 @@ package peer
 import (
 	"context"
 	"fmt"
-	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -24,14 +23,14 @@ type WGInterfaceStater interface {
 	GetStats() (map[string]configurer.WGStats, error)
 }
 
+// WGWatcher is single-shot: one instance per connection attempt, run once, then discarded.
+// Lifecycle is owned by Conn under conn.mu, so it keeps no "enabled" state to go stale.
 type WGWatcher struct {
 	log           *log.Entry
 	wgIfaceStater WGInterfaceStater
 	peerKey       string
 	stateDump     *stateDump
 
-	enabled   bool
-	muEnabled sync.Mutex
 	// initialHandshake is not thread-safe; never call PrepareInitialHandshake and EnableWgWatcher concurrently.
 	initialHandshake time.Time
 
@@ -48,36 +47,23 @@ func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey strin
 	}
 }
 
-// PrepareInitialHandshake reserves the watcher and reads the peer's current WireGuard
-// handshake time. It must be called before the peer is (re)configured on the WireGuard
-// interface, so the captured baseline reflects the state prior to this connection attempt
-// instead of racing with that configuration. Returns ok=false if the watcher is already
-// running, in which case EnableWgWatcher must not be called.
-func (w *WGWatcher) PrepareInitialHandshake() (ok bool) {
-	w.muEnabled.Lock()
-	if w.enabled {
-		w.muEnabled.Unlock()
-		return false
-	}
-
+// PrepareInitialHandshake reads the peer's current WireGuard handshake time. It must be
+// called before the peer is (re)configured on the WireGuard interface, so the captured
+// baseline reflects the state prior to this connection attempt instead of racing with
+// that configuration.
+func (w *WGWatcher) PrepareInitialHandshake() {
 	w.log.Debugf("enable WireGuard watcher")
-	w.enabled = true
-	w.muEnabled.Unlock()
-
 	handshake, _ := w.wgState()
 	w.initialHandshake = handshake
-	return true
 }
 
 // EnableWgWatcher runs the WireGuard watcher loop using the handshake baseline captured by
 // PrepareInitialHandshake. The watcher runs until ctx is cancelled. Caller is responsible
-// for context lifecycle management.
-func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time)) {
-	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, enabledTime, w.initialHandshake)
-
-	w.muEnabled.Lock()
-	w.enabled = false
-	w.muEnabled.Unlock()
+// for context lifecycle management. onHandshakeSuccessFn is called only for the first
+// handshake observed by this run, onCheckSuccessFn for every check that observed a fresh
+// handshake, including the first.
+func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func()) {
+	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, onCheckSuccessFn, enabledTime, w.initialHandshake)
 }
 
 // Reset signals the watcher that the WireGuard peer has been reset and a new
@@ -90,7 +76,7 @@ func (w *WGWatcher) Reset() {
 }
 
 // wgStateCheck help to check the state of the WireGuard handshake and relay connection
-func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), enabledTime time.Time, initialHandshake time.Time) {
+func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func(), enabledTime time.Time, initialHandshake time.Time) {
 	w.log.Infof("WireGuard watcher started")
 
 	timer := time.NewTimer(wgHandshakeOvertime)
@@ -103,6 +89,7 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 		case <-timer.C:
 			handshake, ok := w.handshakeCheck(lastHandshake)
 			if !ok {
+				// early ctx cancel check return
 				if ctx.Err() != nil {
 					return
 				}
@@ -117,6 +104,10 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 				}
 			}
 
+			if onCheckSuccessFn != nil && ctx.Err() == nil {
+				onCheckSuccessFn()
+			}
+
 			lastHandshake = *handshake
 
 			resetTime := time.Until(handshake.Add(checkPeriod))
@@ -147,9 +138,9 @@ func (w *WGWatcher) handshakeCheck(lastHandshake time.Time) (*time.Time, bool) {
 
 	w.log.Tracef("previous handshake, handshake: %v, %v", lastHandshake, handshake)
 
-	// the current know handshake did not change
+	// the current known handshake did not change
 	if handshake.Equal(lastHandshake) {
-		w.log.Warnf("WireGuard handshake timed out: %v", handshake)
+		w.log.Warnf("WireGuard handshake not updated: %v", handshake)
 		return nil, false
 	}
 
diff --git a/client/internal/peer/wg_watcher_test.go b/client/internal/peer/wg_watcher_test.go
index 634d7974f..6a5a9acfe 100644
--- a/client/internal/peer/wg_watcher_test.go
+++ b/client/internal/peer/wg_watcher_test.go
@@ -7,7 +7,6 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
 )
@@ -24,6 +23,72 @@ func (m *MocWgIface) disconnect() {
 	m.stop = true
 }
 
+type mockHandshakeStats struct {
+	mu        sync.Mutex
+	handshake time.Time
+}
+
+func (m *mockHandshakeStats) GetStats() (map[string]configurer.WGStats, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return map[string]configurer.WGStats{"": {LastHandshake: m.handshake}}, nil
+}
+
+func (m *mockHandshakeStats) advance() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.handshake = time.Now()
+}
+
+// TestWGWatcher_CheckSuccessCallback: onCheckSuccessFn must fire for a fresh
+// handshake even when the watcher started with an existing handshake baseline,
+// the case where onHandshakeSuccessFn stays silent.
+func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
+	// checkPeriod bounds how stale a handshake may be before the watcher treats it
+	// as a suspended-machine timeout. The first check fires after wgHandshakeOvertime,
+	// so keep checkPeriod well above any scheduling jitter to avoid a false timeout
+	// converting the expected success into a disconnect on a loaded runner.
+	checkPeriod = 1 * time.Minute
+	wgHandshakeOvertime = 1 * time.Second
+
+	mlog := log.WithField("peer", "tet")
+	// Use an old baseline so advance() yields a strictly newer handshake even on
+	// platforms with coarse clock resolution (Windows), where two time.Now() calls
+	// microseconds apart can return the same instant and read as a timed-out handshake.
+	stats := &mockHandshakeStats{handshake: time.Now().Add(-time.Hour)}
+	watcher := NewWGWatcher(mlog, stats, "", newStateDump("peer", mlog, &Status{}))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	watcher.PrepareInitialHandshake()
+
+	firstHandshake := make(chan struct{}, 1)
+	checkSuccess := make(chan struct{}, 1)
+	go watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
+		firstHandshake <- struct{}{}
+	}, func() {
+		select {
+		case checkSuccess <- struct{}{}:
+		default:
+		}
+	})
+
+	stats.advance()
+
+	select {
+	case <-checkSuccess:
+	case <-time.After(10 * time.Second):
+		t.Errorf("timeout waiting for check success callback")
+	}
+
+	select {
+	case <-firstHandshake:
+		t.Errorf("first-handshake callback must not fire for a non-zero baseline")
+	default:
+	}
+}
+
 func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	checkPeriod = 5 * time.Second
 	wgHandshakeOvertime = 1 * time.Second
@@ -35,8 +100,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	ok := watcher.PrepareInitialHandshake()
-	require.True(t, ok, "watcher should not be enabled yet")
+	watcher.PrepareInitialHandshake()
 
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
@@ -44,7 +108,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 		onDisconnected <- struct{}{}
 	}, func(when time.Time) {
 		mlog.Infof("onHandshakeSuccess: %v", when)
-	})
+	}, nil)
 
 	// wait for initial reading
 	time.Sleep(2 * time.Second)
@@ -66,14 +130,13 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
-	ok := watcher.PrepareInitialHandshake()
-	require.True(t, ok, "watcher should not be enabled yet")
+	watcher.PrepareInitialHandshake()
 
 	wg := &sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {})
+		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {}, nil)
 	}()
 	cancel()
 
@@ -83,13 +146,12 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	ctx, cancel = context.WithCancel(context.Background())
 	defer cancel()
 
-	ok = watcher.PrepareInitialHandshake()
-	require.True(t, ok, "watcher should be re-enabled after the previous run stopped")
+	watcher.PrepareInitialHandshake()
 
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
 		onDisconnected <- struct{}{}
-	}, func(when time.Time) {})
+	}, func(when time.Time) {}, nil)
 
 	time.Sleep(2 * time.Second)
 	mocWgIface.disconnect()
diff --git a/client/internal/peer/worker_ice.go b/client/internal/peer/worker_ice.go
index b1aa3e0f9..257164bbd 100644
--- a/client/internal/peer/worker_ice.go
+++ b/client/internal/peer/worker_ice.go
@@ -3,6 +3,7 @@ package peer
 import (
 	"context"
 	"fmt"
+	"math"
 	"net"
 	"strconv"
 	"sync"
@@ -20,6 +21,26 @@ import (
 	"github.com/netbirdio/netbird/route"
 )
 
+const (
+	// latencySampleInterval is how often the round trip time of the selected
+	// candidate pair is read. The ICE agent refreshes it on every consent
+	// binding request, so sampling is cheap and needs no extra traffic.
+	latencySampleInterval = 4 * time.Second
+
+	// latencyEWMAAlpha is the weight of a new sample in the exponentially
+	// weighted moving average. At latencySampleInterval this yields a time
+	// constant of roughly 27 seconds: a sustained change is reflected within
+	// tens of seconds, while the residual movement on a jittery path stays
+	// below the switch margin that route selection applies, so noise alone
+	// cannot move a route. Raising it widens that residual movement.
+	latencyEWMAAlpha = 0.15
+)
+
+// latencySmoothedNoiseFactor converts the spread of the raw samples into the
+// spread of the smoothed value: for an exponentially weighted moving average
+// with weight a, the variance of the output is a/(2-a) of the input variance.
+var latencySmoothedNoiseFactor = math.Sqrt(latencyEWMAAlpha / (2 - latencyEWMAAlpha))
+
 type ICEConnInfo struct {
 	RemoteConn                 net.Conn
 	RosenpassPubKey            []byte
@@ -64,6 +85,9 @@ type WorkerICE struct {
 
 	// portForwardAttempted tracks if we've already tried port forwarding this session
 	portForwardAttempted bool
+
+	// dialFunc, when non-nil, replaces agentDial in connect(). Only for tests.
+	dialFunc func(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (net.Conn, error)
 }
 
 func NewWorkerICE(ctx context.Context, log *log.Entry, config ConnConfig, conn *Conn, signaler *Signaler, ifaceDiscover stdnet.ExternalIFaceDiscover, statusRecorder *Status, hasRelayOnLocally bool) (*WorkerICE, error) {
@@ -118,12 +142,9 @@ func (w *WorkerICE) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 			}
 		}
 
-		sessionID, err := NewICESessionID()
-		if err != nil {
-			w.log.Errorf("failed to create new session ID: %s", err)
-		}
-		w.sessionID = sessionID
-		w.agent = nil
+		// Keep the ID already advertised to the remote. Answers do not get a
+		// reply, so changing it here makes the next offer restart both sides.
+		w.abandonNegotiation()
 	}
 
 	var preferredCandidateTypes []ice.CandidateType
@@ -137,7 +158,7 @@ func (w *WorkerICE) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 		w.log.Debugf("recreate ICE agent: %s / %s", w.sessionID, *remoteOfferAnswer.SessionID)
 	}
 	dialerCtx, dialerCancel := context.WithCancel(w.ctx)
-	agent, err := w.reCreateAgent(dialerCancel, preferredCandidateTypes)
+	agent, sampleNow, err := w.reCreateAgent(dialerCancel, preferredCandidateTypes)
 	if err != nil {
 		w.log.Errorf("failed to recreate ICE Agent: %s", err)
 		return
@@ -151,7 +172,9 @@ func (w *WorkerICE) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 		w.remoteSessionID = ""
 	}
 
-	go w.connect(dialerCtx, agent, remoteOfferAnswer)
+	// Capture the cancel func at spawn time: connect reads it from the argument
+	// instead of the field, which a newer OnNewOffer may already have replaced.
+	go w.connect(dialerCtx, dialerCancel, agent, sampleNow, remoteOfferAnswer)
 }
 
 // OnRemoteCandidate Handles ICE connection Candidate provided by the remote peer.
@@ -200,41 +223,48 @@ func (w *WorkerICE) Close() {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
-	if w.agent == nil {
-		return
+	if w.agent != nil || w.agentConnecting {
+		w.renewSessionID()
 	}
-
-	w.agentDialerCancel()
-	if err := w.agent.Close(); err != nil {
-		w.log.Warnf("failed to close ICE agent: %s", err)
+	if w.agent != nil {
+		w.agentDialerCancel()
+		if err := w.agent.Close(); err != nil {
+			w.log.Warnf("failed to close ICE agent: %s", err)
+		}
 	}
-
-	w.agent = nil
+	// Unconditional: a dial goroutine racing this Close skips its own cleanup
+	// (closeAgent finds a nil agent), so the flags must be dropped here too or
+	// the reconnection guard reads the stale state as Connected forever.
+	w.abandonNegotiation()
 }
 
-func (w *WorkerICE) reCreateAgent(dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, error) {
+// reCreateAgent creates a new ICE agent with its callbacks registered. The
+// returned channel wakes that agent's latency sampler when its selected
+// candidate pair changes.
+func (w *WorkerICE) reCreateAgent(dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, chan struct{}, error) {
 	w.portForwardAttempted = false
 
 	agent, err := icemaker.NewAgent(w.ctx, w.iFaceDiscover, w.config.ICEConfig, candidates, w.localUfrag, w.localPwd)
 	if err != nil {
-		return nil, fmt.Errorf("create agent: %w", err)
+		return nil, nil, fmt.Errorf("create agent: %w", err)
 	}
 
 	if err := agent.OnCandidate(w.onICECandidate); err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
 	if err := agent.OnConnectionStateChange(w.onConnectionStateChange(agent, dialerCancel)); err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
-	if err := agent.OnSelectedCandidatePairChange(func(c1, c2 ice.Candidate) {
-		w.onICESelectedCandidatePair(agent, c1, c2)
-	}); err != nil {
-		return nil, err
+	// one channel per agent, so the sampler of a replaced agent cannot take a
+	// wakeup meant for the new one
+	sampleNow := make(chan struct{}, 1)
+	if err := agent.OnSelectedCandidatePairChange(w.onICESelectedCandidatePair(sampleNow)); err != nil {
+		return nil, nil, err
 	}
 
-	return agent, nil
+	return agent, sampleNow, nil
 }
 
 func (w *WorkerICE) SessionID() ICESessionID {
@@ -247,31 +277,52 @@ func (w *WorkerICE) SessionID() ICESessionID {
 // will block until connection succeeded
 // but it won't release if ICE Agent went into Disconnected or Failed state,
 // so we have to cancel it with the provided context once agent detected a broken connection
-func (w *WorkerICE) connect(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) {
+func (w *WorkerICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agent *icemaker.ThreadSafeAgent, sampleNow <-chan struct{}, remoteOfferAnswer *OfferAnswer) {
 	w.log.Debugf("gather candidates")
 	if err := agent.GatherCandidates(); err != nil {
 		w.log.Warnf("failed to gather candidates: %s", err)
-		w.closeAgent(agent, w.agentDialerCancel)
+		w.closeAgent(agent, dialerCancel)
 		return
 	}
 
-	w.log.Debugf("turn agent dial")
-	remoteConn, err := w.turnAgentDial(ctx, agent, remoteOfferAnswer)
+	w.log.Debugf("agent dial")
+	dial := func(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (net.Conn, error) {
+		return w.agentDial(ctx, agent, remoteOfferAnswer)
+	}
+	if w.dialFunc != nil {
+		dial = w.dialFunc
+	}
+	remoteConn, err := dial(ctx, agent, remoteOfferAnswer)
 	if err != nil {
 		w.log.Debugf("failed to dial the remote peer: %s", err)
-		w.closeAgent(agent, w.agentDialerCancel)
+		w.closeAgent(agent, dialerCancel)
 		return
 	}
 	w.log.Debugf("agent dial succeeded")
 
+	// A newer negotiation may have replaced our agent while agentDial was
+	// blocked. Drop the dead connection before running pair retrieval, port
+	// punching or candidate work against a closed agent. The commit-point
+	// check below still guards a replacement arriving after this point.
+	w.muxAgent.Lock()
+	stale := w.agent != agent
+	w.muxAgent.Unlock()
+	if stale {
+		if err := remoteConn.Close(); err != nil {
+			w.log.Warnf("failed to close stale ICE connection: %s", err)
+		}
+		w.log.Warnf("discarding connection from a stale ICE negotiation")
+		return
+	}
+
 	pair, err := agent.GetSelectedCandidatePair()
 	if err != nil {
-		w.closeAgent(agent, w.agentDialerCancel)
+		w.closeAgent(agent, dialerCancel)
 		return
 	}
 	if pair == nil {
 		w.log.Warnf("selected candidate pair is nil, cannot proceed")
-		w.closeAgent(agent, w.agentDialerCancel)
+		w.closeAgent(agent, dialerCancel)
 		return
 	}
 
@@ -301,11 +352,30 @@ func (w *WorkerICE) connect(ctx context.Context, agent *icemaker.ThreadSafeAgent
 
 	w.log.Infof("connection succeeded with offer session: %s", remoteOfferAnswer.SessionIDString())
 	w.muxAgent.Lock()
+	// Authoritative ownership guard: a negotiation that lost w.agent to a newer
+	// one between the post-dial check and the commit must not clear agentConnecting,
+	// record lastSuccess or report the connection, so the state commit has to be
+	// atomic with the check.
+	if w.agent != agent {
+		w.muxAgent.Unlock()
+		if err := remoteConn.Close(); err != nil {
+			w.log.Warnf("failed to close stale ICE connection: %s", err)
+		}
+		w.log.Warnf("discarding connection from a stale ICE negotiation")
+		return
+	}
 	w.agentConnecting = false
 	w.lastSuccess = time.Now()
 	w.muxAgent.Unlock()
 
+	// ctx is the agent's dialer context, so sampling stops when the agent is closed
+	go w.sampleLatency(ctx, agent, sampleNow)
+
 	// todo: the potential problem is a race between the onConnectionStateChange
+	// and the delivery below: after this unlock, a newer offer can replace
+	// w.agent before onICEConnectionIsReady runs, delivering this (now stale)
+	// connection. The newer negotiation overwrites it with its own delivery,
+	// so the window only ever downgrades an endpoint transiently.
 	w.conn.onICEConnectionIsReady(selectedPriority(pair), ci)
 }
 
@@ -321,20 +391,39 @@ func (w *WorkerICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.C
 	sessionChanged := w.remoteSessionChanged
 	w.remoteSessionChanged = false
 
+	// Only the owner of the current session may reset its state: a stale dial
+	// goroutine waking after a newer attempt must not clobber it.
 	if w.agent == agent {
-		// consider to remove from here and move to the OnNewOffer
-		sessionID, err := NewICESessionID()
-		if err != nil {
-			w.log.Errorf("failed to create new session ID: %s", err)
-		}
-		w.sessionID = sessionID
-		w.agent = nil
-		w.agentConnecting = false
-		w.remoteSessionID = ""
+		w.renewSessionID()
+		w.abandonNegotiation()
 	}
 	return sessionChanged
 }
 
+// renewSessionID starts a new local session, so the remote treats our next offer
+// or answer as a restart. Caller holds muxAgent.
+func (w *WorkerICE) renewSessionID() {
+	sessionID, err := NewICESessionID()
+	if err != nil {
+		w.log.Errorf("failed to create new session ID: %s", err)
+		return
+	}
+	w.sessionID = sessionID
+}
+
+// abandonNegotiation drops all recorded ICE session state so the worker treats the
+// next offer as a fresh start instead of a duplicate of a dead negotiation. The
+// agent and agentConnecting flags must change together: leaving one stale wedges
+// the reconnection guard into reporting Connected forever. It neither cancels an
+// in-flight dial nor closes an agent — callers dispose of those themselves first,
+// so a stale goroutine can never cancel another session's dial through this path.
+// Caller must hold muxAgent.
+func (w *WorkerICE) abandonNegotiation() {
+	w.agent = nil
+	w.agentConnecting = false
+	w.remoteSessionID = ""
+}
+
 func (w *WorkerICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 	// wait local endpoint configuration
 	time.Sleep(time.Second)
@@ -389,6 +478,17 @@ func (w *WorkerICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
 		return
 	}
 
+	// A forwarded candidate only makes sense for an IPv4 mapping, which
+	// translates a port on the gateway's address. An IPv6 pinhole translates
+	// nothing: it unblocks the address ICE already gathers as a host candidate,
+	// so there is no second address to advertise. Injecting one here would also
+	// paste an IPv6 address onto whichever server-reflexive candidate arrived
+	// first, which is usually IPv4.
+	if mapping.ExternalIP != nil && mapping.ExternalIP.To4() == nil {
+		w.log.Debugf("skipping port-forwarded candidate: %s mapping is IPv6-only", mapping.NATType)
+		return
+	}
+
 	w.muxAgent.Lock()
 	if w.portForwardAttempted {
 		w.muxAgent.Unlock()
@@ -460,21 +560,63 @@ func (w *WorkerICE) createForwardedCandidate(srflxCandidate ice.Candidate, mappi
 	return candidate, nil
 }
 
-func (w *WorkerICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
-	w.log.Debugf("selected candidate pair [local <-> remote] -> [%s <-> %s], peer %s", c1.String(), c2.String(),
-		w.config.Key)
+func (w *WorkerICE) onICESelectedCandidatePair(sampleNow chan<- struct{}) func(c1, c2 ice.Candidate) {
+	return func(c1, c2 ice.Candidate) {
+		w.log.Debugf("selected candidate pair [local <-> remote] -> [%s <-> %s], peer %s", c1.String(), c2.String(),
+			w.config.Key)
 
+		// refresh the recorded latency right away: it still describes the previous
+		// path, and route selection may run before the next sampling tick
+		select {
+		case sampleNow <- struct{}{}:
+		default:
+		}
+	}
+}
+
+// sampleLatency records the smoothed round trip time of the agent's selected
+// candidate pair until the agent is closed. Route selection compares the
+// recorded latencies of high availability peers, so it has to keep following
+// the path instead of freezing at the value observed when the pair was chosen.
+func (w *WorkerICE) sampleLatency(ctx context.Context, agent *icemaker.ThreadSafeAgent, sampleNow <-chan struct{}) {
+	var sampler latencySampler
+
+	ticker := time.NewTicker(latencySampleInterval)
+	defer ticker.Stop()
+
+	for {
+		w.updateLatency(ctx, agent, &sampler)
+
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		case <-sampleNow:
+		}
+	}
+}
+
+func (w *WorkerICE) updateLatency(ctx context.Context, agent *icemaker.ThreadSafeAgent, sampler *latencySampler) {
 	pairStat, ok := agent.GetSelectedCandidatePairStats()
 	if !ok {
-		w.log.Warnf("failed to get selected candidate pair stats")
+		w.log.Debugf("failed to get selected candidate pair stats")
 		return
 	}
 
-	duration := time.Duration(pairStat.CurrentRoundTripTime * float64(time.Second))
-	if err := w.statusRecorder.UpdateLatency(w.config.Key, duration); err != nil {
-		w.log.Debugf("failed to update latency for peer: %s", err)
+	sample := sampler.observe(pairStat)
+	if sample.Latency <= 0 {
 		return
 	}
+
+	// the agent may have been closed while sampling, and its connection's
+	// latency cleared: a late sample must not bring the stale value back
+	if ctx.Err() != nil {
+		return
+	}
+
+	if err := w.statusRecorder.UpdateLatency(w.config.Key, sample); err != nil {
+		w.log.Debugf("failed to update latency for peer: %s", err)
+	}
 }
 
 func (w *WorkerICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
@@ -517,8 +659,8 @@ func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dia
 			w.logSuccessfulPaths(agent)
 			return
 		case ice.ConnectionStateFailed, ice.ConnectionStateDisconnected, ice.ConnectionStateClosed:
-			// ice.ConnectionStateClosed happens when we recreate the agent. For the P2P to TURN switch important to
-			// notify the conn.onICEStateDisconnected changes to update the current used priority
+			// ice.ConnectionStateClosed happens when we recreate the agent. The P2P to relay switch requires
+			// notifying conn.onICEStateDisconnected so it can update the currently used priority.
 
 			sessionChanged := w.closeAgent(agent, dialerCancel)
 
@@ -532,7 +674,7 @@ func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dia
 	}
 }
 
-func (w *WorkerICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
+func (w *WorkerICE) agentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
 	if isController(w.config) {
 		return agent.Dial(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
 	} else {
@@ -540,6 +682,59 @@ func (w *WorkerICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSaf
 	}
 }
 
+// latencySampler smooths the round trip time samples of a single ICE agent and
+// tracks how much they scatter, so consumers can tell a real difference between
+// two paths from the noise of a jittery one.
+type latencySampler struct {
+	smoothed  time.Duration
+	deviation time.Duration
+	localID   string
+	remoteID  string
+}
+
+// observe folds a candidate pair stat into the moving average and returns the
+// smoothed latency with the uncertainty of that estimate. A different candidate
+// pair starts over: the path changed, so the previous samples describe a route
+// that no longer carries the traffic.
+func (s *latencySampler) observe(stat ice.CandidatePairStats) LatencySample {
+	rtt := time.Duration(stat.CurrentRoundTripTime * float64(time.Second))
+	if rtt <= 0 {
+		return LatencySample{}
+	}
+
+	if s.smoothed <= 0 || s.localID != stat.LocalCandidateID || s.remoteID != stat.RemoteCandidateID {
+		s.localID = stat.LocalCandidateID
+		s.remoteID = stat.RemoteCandidateID
+		s.smoothed = rtt
+		// A fresh path is described by a single raw sample, which is exactly
+		// when the estimate deserves the least trust: a lucky outlier reported
+		// with no uncertainty could move a route on its own. Seed the deviation
+		// at half the observed value so the reported noise stays conservative
+		// until real samples accumulate, and keep a larger deviation carried
+		// over from the previous path, since the link's jitter usually outlives
+		// a candidate pair change.
+		if seed := rtt / 2; s.deviation < seed {
+			s.deviation = seed
+		}
+		return s.sample()
+	}
+
+	// mean absolute deviation of the samples around the average, the same
+	// estimator TCP keeps next to its smoothed round trip time
+	delta := absDuration(rtt - s.smoothed)
+	s.deviation = time.Duration(latencyEWMAAlpha*float64(delta) + (1-latencyEWMAAlpha)*float64(s.deviation))
+	s.smoothed = time.Duration(latencyEWMAAlpha*float64(rtt) + (1-latencyEWMAAlpha)*float64(s.smoothed))
+
+	return s.sample()
+}
+
+func (s *latencySampler) sample() LatencySample {
+	return LatencySample{
+		Latency: s.smoothed,
+		Noise:   time.Duration(latencySmoothedNoiseFactor * float64(s.deviation)),
+	}
+}
+
 func shouldAddExtraCandidate(candidate ice.Candidate) bool {
 	if candidate.Type() != ice.CandidateTypeServerReflexive {
 		return false
diff --git a/client/internal/peer/worker_ice_close_test.go b/client/internal/peer/worker_ice_close_test.go
new file mode 100644
index 000000000..834a4dd6d
--- /dev/null
+++ b/client/internal/peer/worker_ice_close_test.go
@@ -0,0 +1,257 @@
+package peer
+
+import (
+	"context"
+	"net"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
+	signal "github.com/netbirdio/netbird/shared/signal/client"
+	sProto "github.com/netbirdio/netbird/shared/signal/proto"
+)
+
+// stubSignalClient satisfies signal.Client as a no-op so the candidate
+// goroutine spawned by a real GatherCandidates never dereferences a nil
+// signaler in tests.
+type stubSignalClient struct{}
+
+func (stubSignalClient) Close() error                                               { return nil }
+func (stubSignalClient) StreamConnected() bool                                      { return false }
+func (stubSignalClient) GetStatus() signal.Status                                   { return signal.StreamDisconnected }
+func (stubSignalClient) Receive(context.Context, func(*sProto.Message) error) error { return nil }
+func (stubSignalClient) Ready() bool                                                { return false }
+func (stubSignalClient) IsHealthy() bool                                            { return false }
+func (stubSignalClient) WaitStreamConnected(context.Context)                        {}
+func (stubSignalClient) SendToStream(*sProto.EncryptedMessage) error                { return nil }
+func (stubSignalClient) Send(*sProto.Message) error                                 { return nil }
+func (stubSignalClient) SetOnReconnectedListener(func())                            {}
+
+// newTestWorkerICE builds a worker with real pion plumbing and no-op signaling.
+func newTestWorkerICE(t *testing.T) *WorkerICE {
+	t.Helper()
+
+	config := connConf
+	stunTurn := &icemaker.StunTurn{}
+	stunTurn.Store(nil)
+	config.ICEConfig.StunTurn = stunTurn
+
+	w, err := NewWorkerICE(context.Background(), log.WithField("test", t.Name()), config, nil,
+		NewSignaler(stubSignalClient{}, wgtypes.Key{}), nil, nil, false)
+	require.NoError(t, err, "worker setup must succeed")
+	return w
+}
+
+// TestWorkerICE_CloseDuringDial_ClearsConnectingFlag drives the teardown race
+// through the real dial goroutine instead of simulating its cleanup.
+//
+// The real-world sequence this models:
+//  1. OnNewOffer starts a negotiation: agent set, agentConnecting = true,
+//     go connect()
+//  2. The network dies and connect() stays blocked inside GatherCandidates/Dial
+//  3. A WG handshake timeout calls Close(): the agent is released and the dial
+//     context cancelled, but agentConnecting is not reset
+//  4. The real goroutine wakes with an error and runs its own cleanup
+//     (closeAgent), where `w.agent == agent` is now false, so the flag reset
+//     is skipped
+//
+// There is no remote responder, so Dial can never succeed: whatever point the
+// goroutine is at, closing first forces it down the error path. Before the fix
+// the flag stays true forever and the deadline below expires.
+func TestWorkerICE_CloseDuringDial_ClearsConnectingFlag(t *testing.T) {
+	w := newTestWorkerICE(t)
+
+	sid := ICESessionID("test-session-id")
+	w.OnNewOffer(&OfferAnswer{
+		IceCredentials: IceCredentials{
+			UFrag: "testufrag",
+			Pwd:   "testpwdtestpwdtestpwd12",
+		},
+		SessionID: &sid,
+	})
+	require.True(t, w.InProgress(), "OnNewOffer must mark the negotiation as in progress")
+
+	// Teardown wins the race while connect() is still running.
+	w.Close()
+
+	// Close drops the flags synchronously, so the assertion below does not
+	// converge on the goroutine: the deadline only absorbs the dial goroutine
+	// waking up in the background, proving nothing re-wedges it afterwards.
+	require.Eventually(t, func() bool {
+		return !w.InProgress()
+	}, 10*time.Second, 50*time.Millisecond,
+		"Close must leave the negotiation idle even while the dial goroutine is still winding down")
+
+	// abandonNegotiation owns these three fields together; the worker is idle
+	// only when all of them are dropped.
+	w.muxAgent.Lock()
+	defer w.muxAgent.Unlock()
+	assert.Nil(t, w.agent, "no agent may survive the teardown")
+	assert.False(t, w.agentConnecting, "the connecting flag must match the nil agent")
+	assert.Empty(t, w.remoteSessionID, "a dead session's remote ID must not linger")
+}
+
+// TestWorkerICE_CloseClearsResidualConnectingState covers Close on a worker whose
+// agent is already gone but whose flag is stuck on true, e.g. after an aborted
+// recreate in OnNewOffer or after a first Close raced a dial goroutine.
+func TestWorkerICE_CloseClearsResidualConnectingState(t *testing.T) {
+	w := newTestWorkerICE(t)
+
+	w.muxAgent.Lock()
+	w.agentConnecting = true
+	w.muxAgent.Unlock()
+
+	w.Close()
+
+	assert.False(t, w.InProgress(), "Close must drop residual connecting state even without a live agent")
+
+	w.muxAgent.Lock()
+	defer w.muxAgent.Unlock()
+	assert.Nil(t, w.agent)
+	assert.False(t, w.agentConnecting)
+	assert.Empty(t, w.remoteSessionID)
+}
+
+// TestWorkerICE_StaleCloseAgentKeepsCurrentSession pins the ownership guard in
+// closeAgent: a late-waking dial goroutine from an older session must not reset
+// the state of a newer negotiation that reused the worker. The newer session
+// must survive wholesale - agent, flag and remote session identity alike.
+func TestWorkerICE_StaleCloseAgentKeepsCurrentSession(t *testing.T) {
+	w := newTestWorkerICE(t)
+	t.Cleanup(w.Close)
+
+	sidA := ICESessionID("session-a")
+	w.OnNewOffer(&OfferAnswer{
+		IceCredentials: IceCredentials{UFrag: "ufragaaaa", Pwd: "pwdpwdpwdpwdpwdpwdpwdp1"},
+		SessionID:      &sidA,
+	})
+	w.muxAgent.Lock()
+	oldAgent := w.agent
+	oldCancel := w.agentDialerCancel
+	w.muxAgent.Unlock()
+	require.NotNil(t, oldAgent, "OnNewOffer must have created an ICE agent")
+
+	w.Close()
+
+	sidB := ICESessionID("session-b")
+	w.OnNewOffer(&OfferAnswer{
+		IceCredentials: IceCredentials{UFrag: "ufragbbbb", Pwd: "pwdpwdpwdpwdpwdpwdpwdp2"},
+		SessionID:      &sidB,
+	})
+	require.True(t, w.InProgress(), "the second negotiation must be in flight")
+
+	w.muxAgent.Lock()
+	newAgent := w.agent
+	w.muxAgent.Unlock()
+
+	// The old dial goroutine finally wakes and cleans up its captured agent.
+	w.closeAgent(oldAgent, oldCancel)
+
+	w.muxAgent.Lock()
+	defer w.muxAgent.Unlock()
+	assert.Same(t, newAgent, w.agent, "the current agent must be untouched by the stale cleanup")
+	assert.True(t, w.agentConnecting, "the current negotiation must stay in flight")
+	// Read live under the lock: a snapshot captured before the stale cleanup
+	// would pass even if the cleanup wiped current state.
+	assert.Equal(t, sidB, w.remoteSessionID, "the remote session identity must be preserved")
+}
+
+// closeTrackConn records Close calls so a test can assert that a discarded
+// connection was actually released.
+type closeTrackConn struct {
+	net.Conn
+	closed atomic.Bool
+}
+
+func (c *closeTrackConn) Close() error {
+	c.closed.Store(true)
+	return c.Conn.Close()
+}
+
+// TestWorkerICE_StaleDialSuccessKeepsNewerNegotiation pins the ownership guard
+// in connect()'s success path: a dial that came back after a newer negotiation
+// replaced the agent must discard its connection and leave the newer session's
+// state - agent, agentConnecting, remoteSessionID, lastSuccess - intact.
+//
+// The dial hook holds session A's goroutine open until session B is installed,
+// then returns a live connection, mimicking the vendored pion dial which hands
+// out a live *ice.Conn when a pair is selected without checking afterwards
+// whether the agent was replaced meanwhile. Releasing A's dial therefore
+// exercises the stale-success commit path deterministically instead of racing
+// real ICE.
+func TestWorkerICE_StaleDialSuccessKeepsNewerNegotiation(t *testing.T) {
+	w := newTestWorkerICE(t)
+	t.Cleanup(w.Close)
+
+	dialStarted := make(chan struct{})
+	releaseDial := make(chan struct{})
+	staleConn := &closeTrackConn{}
+
+	var calls atomic.Int32
+	w.dialFunc = func(ctx context.Context, _ *icemaker.ThreadSafeAgent, _ *OfferAnswer) (net.Conn, error) {
+		if calls.Add(1) == 1 {
+			// Session A: hold the goroutine open until session B is installed,
+			// then return a live connection, mimicking the vendored pion dial
+			// which hands out a live *ice.Conn once a pair is selected without
+			// re-checking whether the agent was replaced meanwhile. Releasing
+			// the dial therefore exercises the stale-success commit path
+			// deterministically instead of racing real ICE.
+			close(dialStarted)
+			<-releaseDial
+			client, _ := net.Pipe()
+			staleConn.Conn = client
+			return staleConn, nil
+		}
+		// A newer negotiation parks on its dialer context, cancelled by the
+		// t.Cleanup Close at test end.
+		<-ctx.Done()
+		return nil, ctx.Err()
+	}
+
+	sidA := ICESessionID("session-a")
+	w.OnNewOffer(&OfferAnswer{
+		IceCredentials: IceCredentials{UFrag: "ufragaaaa", Pwd: "pwdpwdpwdpwdpwdpwdpwdp1"},
+		SessionID:      &sidA,
+	})
+	require.True(t, w.InProgress(), "session A must be in flight")
+
+	// Session A's goroutine is now parked in the dial hook.
+	<-dialStarted
+
+	sidB := ICESessionID("session-b")
+	w.OnNewOffer(&OfferAnswer{
+		IceCredentials: IceCredentials{UFrag: "ufragbbbb", Pwd: "pwdpwdpwdpwdpwdpwdpwdp2"},
+		SessionID:      &sidB,
+	})
+
+	w.muxAgent.Lock()
+	agentB := w.agent
+	w.lastSuccess = time.Time{}
+	w.muxAgent.Unlock()
+	require.NotNil(t, agentB, "session B must have created an ICE agent")
+	require.True(t, w.InProgress(), "session B must be in flight")
+
+	// Release session A's dial: it must be recognized as stale and discarded.
+	close(releaseDial)
+	require.Eventually(t, func() bool {
+		return staleConn.closed.Load()
+	}, 10*time.Second, 10*time.Millisecond,
+		"the stale connection must be closed by the ownership guard")
+
+	w.muxAgent.Lock()
+	defer w.muxAgent.Unlock()
+	assert.Same(t, agentB, w.agent, "session A must not uninstall session B's agent")
+	assert.True(t, w.agentConnecting, "session A must not clear session B's connecting flag")
+	assert.Equal(t, sidB, w.remoteSessionID, "session A must not clear session B's remote session identity")
+	assert.True(t, w.lastSuccess.IsZero(), "session A must not record a success for session B")
+	// The commit block guards agentConnecting, lastSuccess and
+	// onICEConnectionIsReady together, so the state assertions above imply the
+	// callback never ran for session A; the nil conn would have panicked the
+	// stale goroutine on any invocation.
+}
diff --git a/client/internal/peer/worker_ice_session_test.go b/client/internal/peer/worker_ice_session_test.go
new file mode 100644
index 000000000..4858e0bc3
--- /dev/null
+++ b/client/internal/peer/worker_ice_session_test.go
@@ -0,0 +1,375 @@
+package peer
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
+)
+
+func TestWorkerICE_RemoteRestartPreservesAdvertisedSession(t *testing.T) {
+	w := newTestWorkerICE(t)
+	t.Cleanup(w.Close)
+	w.dialFunc = parkDial
+	advertised := w.SessionID()
+	remoteSession := ICESessionID("remote-first")
+	offer := OfferAnswer{
+		IceCredentials: IceCredentials{UFrag: "remoteufrag", Pwd: "remote-password-long-enough"},
+		SessionID:      &remoteSession,
+	}
+	w.OnNewOffer(&offer)
+	require.True(t, w.InProgress(), "the first remote session must start ICE")
+	w.muxAgent.Lock()
+	firstAgent := w.agent
+	w.muxAgent.Unlock()
+
+	// The same callback handles answers. A changed remote ID must not create
+	// an unannounced local ID that makes the remote restart on our next offer.
+	secondSession := ICESessionID("remote-restarted")
+	answer := offer
+	answer.SessionID = &secondSession
+	w.OnNewOffer(&answer)
+	assert.Equal(t, advertised, w.SessionID(), "following a remote restart must keep our advertised ID")
+	w.muxAgent.Lock()
+	secondAgent := w.agent
+	w.muxAgent.Unlock()
+	assert.NotSame(t, firstAgent, secondAgent, "the changed remote session must still rebuild ICE")
+
+	w.OnNewOffer(&answer)
+	w.muxAgent.Lock()
+	defer w.muxAgent.Unlock()
+	assert.Same(t, secondAgent, w.agent, "a repeated answer must keep the replacement agent")
+}
+
+func TestWorkerICE_LocalCloseChangesAdvertisedSession(t *testing.T) {
+	w := newTestWorkerICE(t)
+	dialStarted := make(chan struct{})
+	dialDone := make(chan struct{})
+	w.dialFunc = func(ctx context.Context, _ *icemaker.ThreadSafeAgent, _ *OfferAnswer) (net.Conn, error) {
+		close(dialStarted)
+		defer close(dialDone)
+		<-ctx.Done()
+		return nil, ctx.Err()
+	}
+	session := ICESessionID("remote-session")
+	w.OnNewOffer(&OfferAnswer{
+		IceCredentials: IceCredentials{UFrag: "remoteufrag", Pwd: "remote-password-long-enough"},
+		SessionID:      &session,
+	})
+	<-dialStarted
+	advertised := w.SessionID()
+	w.Close()
+	assert.NotEqual(t, advertised, w.SessionID(), "a local teardown must tell the remote to restart")
+	closedSession := w.SessionID()
+
+	// The abandoned dial goroutine cleans up after Close returned.
+	<-dialDone
+	assert.Never(t, func() bool { return w.SessionID() != closedSession }, 200*time.Millisecond, 10*time.Millisecond,
+		"the late cleanup of a closed negotiation must not restart again")
+	w.Close()
+	assert.Equal(t, closedSession, w.SessionID(), "closing an idle worker must not restart again")
+}
+
+// parkDial stands in for the ICE dial. It never connects and returns once the
+// negotiation is abandoned, so a test decides when a negotiation fails.
+func parkDial(ctx context.Context, _ *icemaker.ThreadSafeAgent, _ *OfferAnswer) (net.Conn, error) {
+	<-ctx.Done()
+	return nil, ctx.Err()
+}
+
+func newTestSessionID(t *testing.T) ICESessionID {
+	t.Helper()
+	sid, err := NewICESessionID()
+	require.NoError(t, err)
+	return sid
+}
+
+// handshakeSide is one end of a simulated signaling exchange.
+type handshakeSide interface {
+	// message builds the offer or answer the side would send now.
+	message() OfferAnswer
+	// receive hands a remote offer or answer to the side's ICE logic.
+	receive(msg OfferAnswer)
+	// teardowns counts negotiations the side tore down to follow a remote restart.
+	teardowns() int
+	// failAgent ends the side's current negotiation as an ICE failure does.
+	failAgent()
+}
+
+// workerSide drives a real WorkerICE.
+type workerSide struct {
+	t        *testing.T
+	w        *WorkerICE
+	replaced int
+}
+
+func newWorkerSide(t *testing.T) *workerSide {
+	t.Helper()
+	w := newTestWorkerICE(t)
+	w.dialFunc = parkDial
+	t.Cleanup(w.Close)
+	return &workerSide{t: t, w: w}
+}
+
+func (s *workerSide) message() OfferAnswer {
+	sid := s.w.SessionID()
+	ufrag, pwd := s.w.GetLocalUserCredentials()
+	return OfferAnswer{IceCredentials: IceCredentials{UFrag: ufrag, Pwd: pwd}, SessionID: &sid}
+}
+
+func (s *workerSide) receive(msg OfferAnswer) {
+	before := s.agent()
+	s.w.OnNewOffer(&msg)
+	if after := s.agent(); before != nil && after != before {
+		s.replaced++
+	}
+}
+
+func (s *workerSide) teardowns() int { return s.replaced }
+
+func (s *workerSide) agent() *icemaker.ThreadSafeAgent {
+	s.w.muxAgent.Lock()
+	defer s.w.muxAgent.Unlock()
+	return s.w.agent
+}
+
+// failAgent runs the cleanup the dial goroutine or the Failed state callback
+// performs when the current negotiation dies.
+func (s *workerSide) failAgent() {
+	s.t.Helper()
+	s.w.muxAgent.Lock()
+	agent, cancel := s.w.agent, s.w.agentDialerCancel
+	s.w.muxAgent.Unlock()
+	require.NotNil(s.t, agent, "failing requires a running negotiation")
+	s.w.closeAgent(agent, cancel)
+}
+
+// legacySide models a remote peer running a release from before this change:
+// when it follows a remote restart it also picks a new session ID of its own,
+// which it announces only with its next offer or answer.
+type legacySide struct {
+	t         *testing.T
+	sessionID ICESessionID
+	remoteID  ICESessionID
+	hasAgent  bool
+	replaced  int
+}
+
+func newLegacySide(t *testing.T) *legacySide {
+	return &legacySide{t: t, sessionID: newTestSessionID(t)}
+}
+
+func (s *legacySide) message() OfferAnswer {
+	sid := s.sessionID
+	return OfferAnswer{
+		IceCredentials: IceCredentials{UFrag: "legacyufrag", Pwd: "legacy-password-long-enough"},
+		SessionID:      &sid,
+	}
+}
+
+func (s *legacySide) receive(msg OfferAnswer) {
+	if msg.SessionID == nil {
+		s.hasAgent = true
+		return
+	}
+	if s.hasAgent {
+		if *msg.SessionID == s.remoteID {
+			return
+		}
+		s.replaced++
+		s.sessionID = newTestSessionID(s.t)
+	}
+	s.hasAgent = true
+	s.remoteID = *msg.SessionID
+}
+
+func (s *legacySide) teardowns() int { return s.replaced }
+
+func (s *legacySide) failAgent() {
+	s.hasAgent = false
+	s.remoteID = ""
+	s.sessionID = newTestSessionID(s.t)
+}
+
+// exchange runs one guard-driven round in the order Handshaker.Listen uses: the
+// answerer handles the offer and answers with the session ID it holds
+// afterwards, and the offerer handles the answer without replying.
+func exchange(offerer, answerer handshakeSide) {
+	answerer.receive(offerer.message())
+	offerer.receive(answerer.message())
+}
+
+// offerPattern decides which side's guard sends the offer in a round.
+type offerPattern struct {
+	name   string
+	picker func(round int, local, remote handshakeSide) (offerer, answerer handshakeSide)
+}
+
+var offerPatterns = []offerPattern{
+	{
+		// A routing peer whose relay is down keeps offering on its own.
+		name: "local peer offers",
+		picker: func(_ int, local, remote handshakeSide) (handshakeSide, handshakeSide) {
+			return local, remote
+		},
+	},
+	{
+		name: "both peers offer",
+		picker: func(round int, local, remote handshakeSide) (handshakeSide, handshakeSide) {
+			if round%2 == 0 {
+				return local, remote
+			}
+			return remote, local
+		},
+	},
+}
+
+// assertSettles runs guard rounds and requires the pair to stop restarting
+// each other: at most maxTeardowns in total, and none once half the rounds ran.
+func assertSettles(t *testing.T, pattern offerPattern, local, remote handshakeSide, maxTeardowns int) {
+	t.Helper()
+	const rounds = 10
+
+	total := func() int { return local.teardowns() + remote.teardowns() }
+	start := total()
+	var halfway int
+	for round := range rounds {
+		if round == rounds/2 {
+			halfway = total()
+		}
+		offerer, answerer := pattern.picker(round, local, remote)
+		exchange(offerer, answerer)
+	}
+
+	assert.LessOrEqual(t, total()-start, maxTeardowns, "the peers must not keep restarting each other")
+	assert.Equal(t, halfway, total(), "the negotiation must be stable in the later rounds")
+}
+
+// establish runs the first offer and answer, so both sides negotiate.
+func establish(t *testing.T, local, remote handshakeSide) {
+	t.Helper()
+	exchange(local, remote)
+	require.Zero(t, local.teardowns()+remote.teardowns(), "the first exchange must not restart anything")
+}
+
+func TestICESession_SettlesAfterAgentFailure(t *testing.T) {
+	sides := []struct {
+		name   string
+		remote func(t *testing.T) handshakeSide
+	}{
+		{name: "current remote", remote: func(t *testing.T) handshakeSide { return newWorkerSide(t) }},
+		{name: "legacy remote", remote: func(t *testing.T) handshakeSide { return newLegacySide(t) }},
+	}
+	failures := []struct {
+		name string
+		fail func(local, remote handshakeSide)
+	}{
+		{name: "remote agent fails", fail: func(_, remote handshakeSide) { remote.failAgent() }},
+		{name: "local agent fails", fail: func(local, _ handshakeSide) { local.failAgent() }},
+		{name: "both agents fail", fail: func(local, remote handshakeSide) {
+			local.failAgent()
+			remote.failAgent()
+		}},
+	}
+
+	for _, side := range sides {
+		for _, failure := range failures {
+			for _, pattern := range offerPatterns {
+				t.Run(fmt.Sprintf("%s/%s/%s", side.name, failure.name, pattern.name), func(t *testing.T) {
+					local := newWorkerSide(t)
+					remote := side.remote(t)
+					establish(t, local, remote)
+
+					failure.fail(local, remote)
+					assertSettles(t, pattern, local, remote, 2)
+				})
+			}
+		}
+	}
+}
+
+// TestICESession_LocalCloseRestartsRemote covers an explicit teardown, as on a
+// WireGuard handshake timeout. The remote must start over as well, or it keeps
+// answering from the negotiation this side just abandoned.
+func TestICESession_LocalCloseRestartsRemote(t *testing.T) {
+	for _, pattern := range offerPatterns {
+		t.Run(pattern.name, func(t *testing.T) {
+			local := newWorkerSide(t)
+			remote := newWorkerSide(t)
+			establish(t, local, remote)
+
+			local.w.Close()
+			assertSettles(t, pattern, local, remote, 1)
+			assert.Equal(t, 1, remote.teardowns(), "the remote must restart its negotiation exactly once")
+		})
+	}
+}
+
+func TestICESession_DuplicateMessagesKeepNegotiation(t *testing.T) {
+	local := newWorkerSide(t)
+	remote := newWorkerSide(t)
+
+	offer := local.message()
+	remote.receive(offer)
+	answer := remote.message()
+	local.receive(answer)
+
+	// Signaling may deliver the same message again, and a peer answers every
+	// offer, including repeats of one it already handled.
+	remote.receive(offer)
+	local.receive(answer)
+	local.receive(remote.message())
+
+	assert.Zero(t, local.teardowns(), "a repeated answer must not restart the negotiation")
+	assert.Zero(t, remote.teardowns(), "a repeated offer must not restart the negotiation")
+}
+
+// TestICESession_RemoteWithoutSessionIDKeepsNegotiation covers remote peers
+// too old to send session IDs: once negotiating, their messages cannot tell a
+// restart from a repeat, so they must not tear anything down.
+func TestICESession_RemoteWithoutSessionIDKeepsNegotiation(t *testing.T) {
+	local := newWorkerSide(t)
+	unversioned := OfferAnswer{IceCredentials: IceCredentials{UFrag: "oldufrag", Pwd: "old-password-long-enough"}}
+
+	local.receive(unversioned)
+	require.NotNil(t, local.agent(), "a message without a session ID must still start ICE")
+	advertised := local.w.SessionID()
+
+	for range 3 {
+		local.receive(unversioned)
+	}
+	assert.Zero(t, local.teardowns(), "messages without a session ID must not restart the negotiation")
+	assert.Equal(t, advertised, local.w.SessionID(), "the advertised session must not change")
+}
+
+// TestWorkerICE_StaleCleanupKeepsAdvertisedSession covers the cleanup of a
+// replaced negotiation finishing late, from its dial goroutine or its Closed
+// state callback. It must neither pick a new session ID, an unannounced local
+// restart, nor disturb the negotiation that replaced it.
+func TestWorkerICE_StaleCleanupKeepsAdvertisedSession(t *testing.T) {
+	local := newWorkerSide(t)
+	remote := newWorkerSide(t)
+	establish(t, local, remote)
+
+	local.w.muxAgent.Lock()
+	oldAgent, oldCancel := local.w.agent, local.w.agentDialerCancel
+	local.w.muxAgent.Unlock()
+
+	remote.failAgent()
+	exchange(local, remote)
+	require.Equal(t, 1, local.teardowns(), "the local side must follow the remote restart")
+	advertised := local.w.SessionID()
+	current := local.agent()
+
+	local.w.closeAgent(oldAgent, oldCancel)
+
+	assert.Equal(t, advertised, local.w.SessionID(), "a stale cleanup must not change the advertised session")
+	assert.Same(t, current, local.agent(), "a stale cleanup must keep the current negotiation")
+	assertSettles(t, offerPatterns[1], local, remote, 0)
+}
diff --git a/client/internal/peer/worker_ice_test.go b/client/internal/peer/worker_ice_test.go
new file mode 100644
index 000000000..3089841c2
--- /dev/null
+++ b/client/internal/peer/worker_ice_test.go
@@ -0,0 +1,168 @@
+package peer
+
+import (
+	"testing"
+	"time"
+
+	"github.com/pion/ice/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func pairStat(local, remote string, rtt time.Duration) ice.CandidatePairStats {
+	return ice.CandidatePairStats{
+		LocalCandidateID:     local,
+		RemoteCandidateID:    remote,
+		CurrentRoundTripTime: rtt.Seconds(),
+	}
+}
+
+func TestLatencySamplerObserve(t *testing.T) {
+	t.Run("first sample is taken as is", func(t *testing.T) {
+		var s latencySampler
+
+		got := s.observe(pairStat("local", "remote", 40*time.Millisecond))
+		assert.Equal(t, 40*time.Millisecond, got.Latency, "the first sample has nothing to average with")
+	})
+
+	t.Run("zero round trip time is not recorded", func(t *testing.T) {
+		var s latencySampler
+
+		require.Zero(t, s.observe(pairStat("local", "remote", 0)).Latency, "a pair without an RTT sample yields no latency")
+
+		// the first real sample still seeds the average
+		assert.Equal(t, 20*time.Millisecond, s.observe(pairStat("local", "remote", 20*time.Millisecond)).Latency)
+	})
+
+	t.Run("single spike is damped", func(t *testing.T) {
+		var s latencySampler
+
+		s.observe(pairStat("local", "remote", 20*time.Millisecond))
+		spiked := s.observe(pairStat("local", "remote", 220*time.Millisecond)).Latency
+
+		// a single sample only contributes its weight of the 200ms delta
+		assert.Equal(t, 50*time.Millisecond, spiked, "a single spike must not be reported in full")
+
+		// and it decays again once the path is back to normal
+		for range 10 {
+			s.observe(pairStat("local", "remote", 20*time.Millisecond))
+		}
+		assert.Less(t, s.observe(pairStat("local", "remote", 20*time.Millisecond)).Latency, 30*time.Millisecond,
+			"the average should return towards the steady state")
+	})
+
+	t.Run("sustained change is followed", func(t *testing.T) {
+		var s latencySampler
+
+		s.observe(pairStat("local", "remote", 20*time.Millisecond))
+
+		// the route selection switch margin, see routemanager/client
+		const switchMargin = 20 * time.Millisecond
+
+		// at a 4s sample interval, 3 samples are about 12 seconds
+		var latency time.Duration
+		for range 3 {
+			latency = s.observe(pairStat("local", "remote", 80*time.Millisecond)).Latency
+		}
+		assert.Greater(t, latency-20*time.Millisecond, switchMargin,
+			"a sustained 60ms degradation must clear the switch margin within seconds")
+
+		// and 10 more samples, about 40 seconds in total, get most of the way there
+		for range 10 {
+			latency = s.observe(pairStat("local", "remote", 80*time.Millisecond)).Latency
+		}
+		assert.Greater(t, latency, 70*time.Millisecond, "a sustained degradation must be tracked within tens of seconds")
+	})
+
+	// Smoothing narrows the scatter of a jittery path but leaves a residue, and
+	// that residue is what route selection has to compare its margins against.
+	// The reported noise has to describe it, so it has to grow with the jitter
+	// and cover the movement of the smoothed value.
+	t.Run("reported noise reflects the jitter of the path", func(t *testing.T) {
+		// 100ms +/- 40ms, the same shape the netem jitter test uses
+		jittery := []int{
+			104, 138, 61, 96, 141, 72, 118, 65, 133, 88,
+			59, 127, 92, 136, 68, 111, 143, 74, 99, 121,
+		}
+		steady := []int{
+			100, 101, 99, 100, 102, 99, 100, 101, 100, 99, 101, 100, 99, 100, 101, 100, 99, 101, 100, 100,
+			101, 99, 100, 102, 99, 100, 101, 100, 99, 101, 100, 99, 100, 101, 100, 99, 101, 100, 100, 101,
+		}
+
+		spreadAndNoise := func(raw []int) (spread, noise time.Duration) {
+			var s latencySampler
+			var minSmoothed, maxSmoothed time.Duration
+
+			for i, ms := range raw {
+				got := s.observe(pairStat("local", "remote", time.Duration(ms)*time.Millisecond))
+				noise = got.Noise
+
+				// skip the warmup, the first sample is taken as is
+				if i < 5 {
+					continue
+				}
+				if minSmoothed == 0 || got.Latency < minSmoothed {
+					minSmoothed = got.Latency
+				}
+				if got.Latency > maxSmoothed {
+					maxSmoothed = got.Latency
+				}
+			}
+
+			return maxSmoothed - minSmoothed, noise
+		}
+
+		jitterySpread, jitteryNoise := spreadAndNoise(jittery)
+		steadySpread, steadyNoise := spreadAndNoise(steady)
+
+		assert.Greater(t, jitteryNoise, steadyNoise, "a jittery path must report more noise than a steady one")
+		assert.Less(t, steadyNoise, time.Millisecond, "a steady path must report almost no noise, so the fixed margins decide")
+
+		// the noise is a deviation, so a few of them have to cover the movement
+		// of the smoothed value, which is what the switch margin relies on
+		assert.Greater(t, 4*jitteryNoise, jitterySpread,
+			"reported noise %v must account for the smoothed spread %v", jitteryNoise, jitterySpread)
+		assert.Greater(t, 4*steadyNoise+time.Millisecond, steadySpread,
+			"reported noise %v must account for the smoothed spread %v", steadyNoise, steadySpread)
+	})
+
+	t.Run("new candidate pair discards the previous average", func(t *testing.T) {
+		var s latencySampler
+
+		s.observe(pairStat("local", "remote", 200*time.Millisecond))
+		got := s.observe(pairStat("local2", "remote2", 20*time.Millisecond)).Latency
+
+		assert.Equal(t, 20*time.Millisecond, got, "samples of the previous path must not be carried over")
+	})
+
+	// A single raw sample is when the estimate deserves the least trust: with
+	// zero reported noise, a lucky outlier could clear the switch margins and
+	// move a route on its own.
+	t.Run("a fresh path reports conservative noise", func(t *testing.T) {
+		var s latencySampler
+
+		first := s.observe(pairStat("local", "remote", 100*time.Millisecond))
+		assert.Greater(t, first.Noise, 10*time.Millisecond, "a single-sample estimate must not be reported as noise-free")
+
+		// steady samples shrink the uncertainty again
+		var got LatencySample
+		for range 40 {
+			got = s.observe(pairStat("local", "remote", 100*time.Millisecond))
+		}
+		assert.Less(t, got.Noise, 2*time.Millisecond, "steady samples should earn the estimate its trust back")
+	})
+
+	t.Run("a pair change keeps the larger deviation of a jittery link", func(t *testing.T) {
+		var s latencySampler
+
+		// build up a deviation well above the reseed floor of the new path
+		for _, ms := range []int{100, 180, 60, 170, 50, 190, 70, 160} {
+			s.observe(pairStat("local", "remote", time.Duration(ms)*time.Millisecond))
+		}
+		before := s.deviation
+		require.Greater(t, before, 25*time.Millisecond, "the jittery path should have accumulated deviation")
+
+		s.observe(pairStat("local2", "remote2", 50*time.Millisecond))
+		assert.GreaterOrEqual(t, s.deviation, before, "a pair change must not shrink the known jitter of the link")
+	})
+}
diff --git a/client/internal/peer/worker_relay.go b/client/internal/peer/worker_relay.go
index 0402992c9..694207847 100644
--- a/client/internal/peer/worker_relay.go
+++ b/client/internal/peer/worker_relay.go
@@ -3,7 +3,6 @@ package peer
 import (
 	"context"
 	"errors"
-	"net"
 	"net/netip"
 	"sync"
 	"sync/atomic"
@@ -14,7 +13,7 @@ import (
 )
 
 type RelayConnInfo struct {
-	relayedConn     net.Conn
+	relayedConn     *relayClient.Conn
 	rosenpassPubKey []byte
 	rosenpassAddr   string
 }
@@ -27,7 +26,7 @@ type WorkerRelay struct {
 	conn         *Conn
 	relayManager *relayClient.Manager
 
-	relayedConn net.Conn
+	relayedConn *relayClient.Conn
 	relayLock   sync.Mutex
 
 	relaySupportedOnRemotePeer atomic.Bool
@@ -80,12 +79,7 @@ func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.relayedConn = relayedConn
 	w.relayLock.Unlock()
 
-	err = w.relayManager.AddCloseListener(srv, w.onRelayClientDisconnected)
-	if err != nil {
-		log.Errorf("failed to add close listener: %s", err)
-		_ = relayedConn.Close()
-		return
-	}
+	go w.watchRelayedConn(relayedConn)
 
 	w.log.Debugf("peer conn opened via Relay: %s", srv)
 	go w.conn.onRelayConnectionIsReady(RelayConnInfo{
@@ -107,14 +101,21 @@ func (w *WorkerRelay) RelayIsSupportedLocally() bool {
 	return w.relayManager.HasRelayAddress()
 }
 
+func (w *WorkerRelay) IsTransportConnected() bool {
+	return w.relayManager.Ready()
+}
+
 func (w *WorkerRelay) CloseConn() {
 	w.relayLock.Lock()
-	defer w.relayLock.Unlock()
-	if w.relayedConn == nil {
+	conn := w.relayedConn
+	w.relayedConn = nil
+	w.relayLock.Unlock()
+
+	if conn == nil {
 		return
 	}
 
-	if err := w.relayedConn.Close(); err != nil {
+	if err := conn.Close(); err != nil {
 		w.log.Warnf("failed to close relay connection: %v", err)
 	}
 }
@@ -133,6 +134,8 @@ func (w *WorkerRelay) preferredRelayServer(myRelayAddress, remoteRelayAddress st
 	return remoteRelayAddress
 }
 
-func (w *WorkerRelay) onRelayClientDisconnected() {
-	go w.conn.onRelayDisconnected()
+func (w *WorkerRelay) watchRelayedConn(relayedConn *relayClient.Conn) {
+	<-relayedConn.Context().Done()
+
+	w.conn.onRelayDisconnected(relayedConn)
 }
diff --git a/client/internal/pkcs11/driver_linux.go b/client/internal/pkcs11/driver_linux.go
new file mode 100644
index 000000000..54a3863cb
--- /dev/null
+++ b/client/internal/pkcs11/driver_linux.go
@@ -0,0 +1,413 @@
+//go:build pkcs11 && linux && !android && (amd64 || arm64)
+
+package pkcs11
+
+import (
+	"errors"
+	"fmt"
+	"runtime"
+	"strings"
+	"unsafe"
+
+	"github.com/ebitengine/purego"
+	log "github.com/sirupsen/logrus"
+)
+
+// ulong is CK_ULONG, an unsigned long, which is pointer-sized on the 64-bit Linux ABIs
+// this file builds for. The struct layouts below assume that width and natural alignment.
+type ulong = uintptr
+
+const (
+	unavailableInformation = ^ulong(0)
+
+	flagOSLockingOK   = 0x2
+	flagRWSession     = 0x2
+	flagSerialSession = 0x4
+	userTypeUser      = 0x1
+
+	findBatch = 32
+
+	// Upper bounds on sizes a module reports, so a buggy module cannot make the daemon
+	// allocate without limit. Certificates and keys are far smaller; an RSA-16384
+	// signature is 2 KiB.
+	maxAttributeLen = 1 << 20
+	maxSignatureLen = 1 << 16
+	maxFoundObjects = 1 << 16
+)
+
+type version struct {
+	major byte
+	minor byte
+}
+
+type attribute struct {
+	typ   ulong
+	value unsafe.Pointer
+	len   ulong
+}
+
+type mechanism struct {
+	typ       ulong
+	parameter unsafe.Pointer
+	len       ulong
+}
+
+type pssParams struct {
+	hashAlg ulong
+	mgf     ulong
+	saltLen ulong
+}
+
+type tokenInfo struct {
+	label          [32]byte
+	manufacturerID [32]byte
+	model          [16]byte
+	serialNumber   [16]byte
+	flags          ulong
+	counters       [10]ulong
+	hardware       version
+	firmware       version
+	utcTime        [16]byte
+}
+
+type initializeArgs struct {
+	createMutex  uintptr
+	destroyMutex uintptr
+	lockMutex    uintptr
+	unlockMutex  uintptr
+	flags        ulong
+	reserved     unsafe.Pointer
+}
+
+// functionList mirrors CK_FUNCTION_LIST: a CK_VERSION padded to pointer alignment, then
+// the PKCS#11 v2.40 entry points in specification order.
+type functionList struct {
+	version version
+	_       [6]byte
+	fn      [68]uintptr
+}
+
+const (
+	fnInitialize        = 0
+	fnGetSlotList       = 4
+	fnGetTokenInfo      = 6
+	fnOpenSession       = 12
+	fnCloseSession      = 13
+	fnLogin             = 18
+	fnLogout            = 19
+	fnCreateObject      = 20
+	fnGetAttributeValue = 24
+	fnFindObjectsInit   = 26
+	fnFindObjects       = 27
+	fnFindObjectsFinal  = 28
+	fnSignInit          = 42
+	fnSign              = 43
+)
+
+// checkFunctionListVersion refuses a module whose function list is older than the layout
+// functionList mirrors, which would otherwise be read past its end.
+func checkFunctionListVersion(v version) error {
+	if v.major < 2 {
+		return fmt.Errorf("PKCS#11 function list version %d.%d is older than 2.0", v.major, v.minor)
+	}
+	return nil
+}
+
+// module holds the entry points of one loaded library, bound straight from its
+// CK_FUNCTION_LIST.
+type module struct {
+	cInitialize        func(args *initializeArgs) ulong
+	cGetSlotList       func(tokenPresent byte, slots *ulong, count *ulong) ulong
+	cGetTokenInfo      func(slot ulong, info *tokenInfo) ulong
+	cOpenSession       func(slot ulong, flags ulong, application unsafe.Pointer, notify uintptr, session *ulong) ulong
+	cCloseSession      func(session ulong) ulong
+	cLogin             func(session ulong, userType ulong, pin *byte, pinLen ulong) ulong
+	cLogout            func(session ulong) ulong
+	cCreateObject      func(session ulong, template *attribute, count ulong, object *ulong) ulong
+	cGetAttributeValue func(session ulong, object ulong, template *attribute, count ulong) ulong
+	cFindObjectsInit   func(session ulong, template *attribute, count ulong) ulong
+	cFindObjects       func(session ulong, objects *ulong, max ulong, count *ulong) ulong
+	cFindObjectsFinal  func(session ulong) ulong
+	cSignInit          func(session ulong, mech *mechanism, key ulong) ulong
+	cSign              func(session ulong, data *byte, dataLen ulong, signature *byte, signatureLen *ulong) ulong
+}
+
+// Supported reports whether this build can load PKCS#11 modules.
+func Supported() bool {
+	return true
+}
+
+func load(path string) (_ driver, err error) {
+	lib, err := purego.Dlopen(path, purego.RTLD_NOW|purego.RTLD_LOCAL)
+	if err != nil {
+		return nil, fmt.Errorf("open PKCS#11 module %s: %w", path, err)
+	}
+	// A module that loads but cannot be used is not cached, so each later attempt opens
+	// it again; close it here or every attempt keeps another reference to the library.
+	defer func() {
+		if err != nil {
+			if closeErr := purego.Dlclose(lib); closeErr != nil {
+				log.Debugf("failed closing PKCS#11 module %s: %v", path, closeErr)
+			}
+		}
+	}()
+	symbol, err := purego.Dlsym(lib, "C_GetFunctionList")
+	if err != nil {
+		return nil, fmt.Errorf("%s is not a PKCS#11 module: %w", path, err)
+	}
+	var getFunctionList func(list **functionList) ulong
+	purego.RegisterFunc(&getFunctionList, symbol)
+	var list *functionList
+	if rv := getFunctionList(&list); rv != rvOK || list == nil {
+		return nil, Error{Op: "C_GetFunctionList", Code: uint(rv)}
+	}
+
+	if err := checkFunctionListVersion(list.version); err != nil {
+		return nil, fmt.Errorf("%s: %w", path, err)
+	}
+
+	m := &module{}
+	for _, entry := range []struct {
+		fn    any
+		index int
+	}{
+		{&m.cInitialize, fnInitialize},
+		{&m.cGetSlotList, fnGetSlotList},
+		{&m.cGetTokenInfo, fnGetTokenInfo},
+		{&m.cOpenSession, fnOpenSession},
+		{&m.cCloseSession, fnCloseSession},
+		{&m.cLogin, fnLogin},
+		{&m.cLogout, fnLogout},
+		{&m.cCreateObject, fnCreateObject},
+		{&m.cGetAttributeValue, fnGetAttributeValue},
+		{&m.cFindObjectsInit, fnFindObjectsInit},
+		{&m.cFindObjects, fnFindObjects},
+		{&m.cFindObjectsFinal, fnFindObjectsFinal},
+		{&m.cSignInit, fnSignInit},
+		{&m.cSign, fnSign},
+	} {
+		if list.fn[entry.index] == 0 {
+			return nil, fmt.Errorf("%s lacks PKCS#11 entry point %d", path, entry.index)
+		}
+		purego.RegisterFunc(entry.fn, list.fn[entry.index])
+	}
+
+	args := &initializeArgs{flags: flagOSLockingOK}
+	if rv := m.cInitialize(args); rv != rvOK && rv != rvAlreadyInitialized {
+		return nil, Error{Op: "C_Initialize", Code: uint(rv)}
+	}
+	return m, nil
+}
+
+// slotListAttempts bounds how often the slot list is asked for again after it grew between
+// the size query and the read.
+const slotListAttempts = 3
+
+// slotList returns the slots with a token present. A token plugged in between the size
+// query and the read makes the module answer CKR_BUFFER_TOO_SMALL, in which case the list
+// is asked for again.
+func (m *module) slotList() ([]ulong, error) {
+	for range slotListAttempts {
+		var count ulong
+		if rv := m.cGetSlotList(1, nil, &count); rv != rvOK {
+			return nil, Error{Op: "C_GetSlotList", Code: uint(rv)}
+		}
+		if count == 0 {
+			return nil, nil
+		}
+		slots := make([]ulong, count)
+		rv := m.cGetSlotList(1, &slots[0], &count)
+		if rv == rvBufferTooSmall {
+			continue
+		}
+		if rv != rvOK {
+			return nil, Error{Op: "C_GetSlotList", Code: uint(rv)}
+		}
+		return slots[:count], nil
+	}
+	return nil, Error{Op: "C_GetSlotList", Code: rvBufferTooSmall}
+}
+
+func (m *module) tokens() ([]Token, error) {
+	slots, err := m.slotList()
+	if err != nil {
+		return nil, err
+	}
+
+	tokens := make([]Token, 0, len(slots))
+	for _, slot := range slots {
+		var info tokenInfo
+		if rv := m.cGetTokenInfo(slot, &info); rv != rvOK {
+			continue
+		}
+		tokens = append(tokens, Token{Slot: uint(slot), Label: strings.TrimRight(string(info.label[:]), " \x00")})
+	}
+	return tokens, nil
+}
+
+func (m *module) openSession(slot uint, readWrite bool) (uint, error) {
+	flags := ulong(flagSerialSession)
+	if readWrite {
+		flags |= flagRWSession
+	}
+	var session ulong
+	if rv := m.cOpenSession(ulong(slot), flags, nil, 0, &session); rv != rvOK {
+		return 0, Error{Op: "C_OpenSession", Code: uint(rv)}
+	}
+	return uint(session), nil
+}
+
+func (m *module) closeSession(session uint) {
+	m.cCloseSession(ulong(session))
+}
+
+func (m *module) login(session uint, pin []byte) error {
+	var pinPtr *byte
+	if len(pin) > 0 {
+		pinPtr = &pin[0]
+	}
+	rv := m.cLogin(ulong(session), userTypeUser, pinPtr, ulong(len(pin)))
+	runtime.KeepAlive(pin)
+	if rv != rvOK {
+		return Error{Op: "C_Login", Code: uint(rv)}
+	}
+	return nil
+}
+
+func (m *module) logout(session uint) {
+	m.cLogout(ulong(session))
+}
+
+func (m *module) findObjects(session uint, template []Attribute) ([]Object, error) {
+	var pinner runtime.Pinner
+	attrs := toAttributes(template, &pinner)
+	rv := m.cFindObjectsInit(ulong(session), first(attrs), ulong(len(attrs)))
+	pinner.Unpin()
+	if rv != rvOK {
+		return nil, Error{Op: "C_FindObjectsInit", Code: uint(rv)}
+	}
+	defer m.cFindObjectsFinal(ulong(session))
+
+	var objects []Object
+	for {
+		var batch [findBatch]ulong
+		var count ulong
+		if rv := m.cFindObjects(ulong(session), &batch[0], findBatch, &count); rv != rvOK {
+			return nil, Error{Op: "C_FindObjects", Code: uint(rv)}
+		}
+		if count > findBatch {
+			return nil, fmt.Errorf("C_FindObjects reported %d handles for a batch of %d", count, findBatch)
+		}
+		// Only an empty batch ends the search: a module may return fewer handles than
+		// asked for before it has returned them all.
+		if count == 0 {
+			return objects, nil
+		}
+		for _, handle := range batch[:count] {
+			objects = append(objects, Object(handle))
+		}
+		if len(objects) > maxFoundObjects {
+			return nil, fmt.Errorf("C_FindObjects returned more than %d objects", maxFoundObjects)
+		}
+	}
+}
+
+func (m *module) attribute(session uint, obj Object, typ uint) ([]byte, error) {
+	attr := attribute{typ: ulong(typ)}
+	if rv := m.cGetAttributeValue(ulong(session), ulong(obj), &attr, 1); rv != rvOK {
+		return nil, Error{Op: "C_GetAttributeValue", Code: uint(rv)}
+	}
+	if attr.len == unavailableInformation {
+		return nil, fmt.Errorf("attribute 0x%x is unavailable", typ)
+	}
+	if attr.len == 0 {
+		return nil, nil
+	}
+	if attr.len > maxAttributeLen {
+		return nil, fmt.Errorf("attribute 0x%x reports %d bytes, over the %d byte limit", typ, attr.len, maxAttributeLen)
+	}
+	value := make([]byte, attr.len)
+	var pinner runtime.Pinner
+	pinner.Pin(&value[0])
+	attr.value = unsafe.Pointer(&value[0])
+	rv := m.cGetAttributeValue(ulong(session), ulong(obj), &attr, 1)
+	pinner.Unpin()
+	if rv != rvOK {
+		return nil, Error{Op: "C_GetAttributeValue", Code: uint(rv)}
+	}
+	if attr.len > ulong(len(value)) {
+		return nil, fmt.Errorf("attribute 0x%x grew from %d to %d bytes between calls", typ, len(value), attr.len)
+	}
+	return value[:attr.len], nil
+}
+
+func (m *module) sign(session uint, mech Mechanism, key Object, data []byte) ([]byte, error) {
+	if len(data) == 0 {
+		return nil, errors.New("nothing to sign")
+	}
+	native := mechanism{typ: ulong(mech.Type)}
+	var pinner runtime.Pinner
+	if mech.PSS != nil {
+		params := &pssParams{hashAlg: ulong(mech.PSS.Hash), mgf: ulong(mech.PSS.MGF), saltLen: ulong(mech.PSS.SaltLen)}
+		pinner.Pin(params)
+		native.parameter = unsafe.Pointer(params)
+		native.len = ulong(unsafe.Sizeof(*params))
+	}
+	rv := m.cSignInit(ulong(session), &native, ulong(key))
+	pinner.Unpin()
+	if rv != rvOK {
+		return nil, Error{Op: "C_SignInit", Code: uint(rv)}
+	}
+
+	var size ulong
+	if rv := m.cSign(ulong(session), &data[0], ulong(len(data)), nil, &size); rv != rvOK {
+		return nil, Error{Op: "C_Sign", Code: uint(rv)}
+	}
+	if size == 0 || size > maxSignatureLen {
+		return nil, fmt.Errorf("C_Sign reports a %d byte signature", size)
+	}
+	signature := make([]byte, size)
+	rv = m.cSign(ulong(session), &data[0], ulong(len(data)), &signature[0], &size)
+	runtime.KeepAlive(data)
+	if rv != rvOK {
+		return nil, Error{Op: "C_Sign", Code: uint(rv)}
+	}
+	if size > ulong(len(signature)) {
+		return nil, fmt.Errorf("C_Sign wrote %d bytes into a %d byte buffer", size, len(signature))
+	}
+	return signature[:size], nil
+}
+
+func (m *module) createObject(session uint, template []Attribute) (Object, error) {
+	var pinner runtime.Pinner
+	attrs := toAttributes(template, &pinner)
+	var object ulong
+	rv := m.cCreateObject(ulong(session), first(attrs), ulong(len(attrs)), &object)
+	pinner.Unpin()
+	if rv != rvOK {
+		return 0, Error{Op: "C_CreateObject", Code: uint(rv)}
+	}
+	return Object(object), nil
+}
+
+// toAttributes builds the C template for template. The values stay Go memory referenced
+// from Go memory passed to C, so each is pinned; the caller unpins after the call.
+func toAttributes(template []Attribute, pinner *runtime.Pinner) []attribute {
+	attrs := make([]attribute, len(template))
+	for i, a := range template {
+		attrs[i].typ = ulong(a.Type)
+		if len(a.Value) > 0 {
+			pinner.Pin(&a.Value[0])
+			attrs[i].value = unsafe.Pointer(&a.Value[0])
+			attrs[i].len = ulong(len(a.Value))
+		}
+	}
+	return attrs
+}
+
+func first(attrs []attribute) *attribute {
+	if len(attrs) == 0 {
+		return nil
+	}
+	return &attrs[0]
+}
diff --git a/client/internal/pkcs11/driver_linux_test.go b/client/internal/pkcs11/driver_linux_test.go
new file mode 100644
index 000000000..2362ee18f
--- /dev/null
+++ b/client/internal/pkcs11/driver_linux_test.go
@@ -0,0 +1,188 @@
+//go:build pkcs11 && linux && !android && (amd64 || arm64)
+
+package pkcs11
+
+import (
+	"crypto/x509"
+	"os"
+	"testing"
+	"unsafe"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStructLayoutsMatchTheCABI(t *testing.T) {
+	assert.Equal(t, uintptr(24), unsafe.Sizeof(attribute{}), "CK_ATTRIBUTE")
+	assert.Equal(t, uintptr(24), unsafe.Sizeof(mechanism{}), "CK_MECHANISM")
+	assert.Equal(t, uintptr(24), unsafe.Sizeof(pssParams{}), "CK_RSA_PKCS_PSS_PARAMS")
+	assert.Equal(t, uintptr(208), unsafe.Sizeof(tokenInfo{}), "CK_TOKEN_INFO")
+	assert.Equal(t, uintptr(48), unsafe.Sizeof(initializeArgs{}), "CK_C_INITIALIZE_ARGS")
+	assert.Equal(t, uintptr(8), unsafe.Offsetof(functionList{}.fn), "entry points follow the padded CK_VERSION")
+	assert.Equal(t, uintptr(8+68*8), unsafe.Sizeof(functionList{}), "CK_FUNCTION_LIST v2.40")
+}
+
+// TestTrustModule_ListsSystemCertificates drives a real module through the binding:
+// p11-kit's trust module exposes the system CA store as certificate objects with no login.
+func TestTrustModule_ListsSystemCertificates(t *testing.T) {
+	module := loadFirst(t,
+		"/usr/lib/pkcs11/p11-kit-trust.so",
+		"/usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so",
+		"/usr/lib/aarch64-linux-gnu/pkcs11/p11-kit-trust.so",
+		"/usr/lib64/pkcs11/p11-kit-trust.so",
+	)
+
+	tokens, err := module.Tokens()
+	require.NoError(t, err)
+	require.NotEmpty(t, tokens, "the trust module must present at least one token")
+
+	parsed := 0
+	for _, token := range tokens {
+		session, err := module.OpenSession(token.Label, nil)
+		require.NoError(t, err, token.Label)
+		objects, err := session.FindObjects(
+			Attribute{Type: AttrClass, Value: ULong(ClassCertificate)},
+			Attribute{Type: AttrCertificateType, Value: ULong(CertificateX509)},
+		)
+		require.NoError(t, err, token.Label)
+		for _, object := range objects {
+			der, err := session.Attribute(object, AttrValue)
+			require.NoError(t, err)
+			_, err = x509.ParseCertificate(der)
+			require.NoError(t, err, "CKA_VALUE must be a DER certificate")
+			parsed++
+		}
+		session.Close()
+	}
+	assert.Positive(t, parsed, "system trust anchors must be readable through the binding")
+}
+
+func loadFirst(t *testing.T, paths ...string) *Module {
+	t.Helper()
+	for _, path := range paths {
+		if _, err := os.Stat(path); err != nil {
+			continue
+		}
+		module, err := Load(path)
+		require.NoError(t, err, path)
+		return module
+	}
+	t.Skip("p11-kit trust module not installed")
+	return nil
+}
+
+// TestSlotList_RetriesWhenTheListGrows: a token plugged in between the size query and the
+// fill makes the module answer CKR_BUFFER_TOO_SMALL; the list has to be asked for again.
+func TestSlotList_RetriesWhenTheListGrows(t *testing.T) {
+	calls := 0
+	m := &module{cGetSlotList: func(_ byte, slots *ulong, count *ulong) ulong {
+		calls++
+		switch {
+		case slots == nil && calls == 1:
+			*count = 1
+		case slots != nil && calls == 2:
+			*count = 2
+			return rvBufferTooSmall
+		case slots == nil:
+			*count = 2
+		default:
+			*count = 2
+			backing := unsafe.Slice(slots, 2)
+			backing[0], backing[1] = 7, 9
+		}
+		return rvOK
+	}}
+
+	slots, err := m.slotList()
+
+	require.NoError(t, err)
+	assert.Equal(t, []ulong{7, 9}, slots, "the list is read again at its new size")
+}
+
+func TestSlotList_GivesUpOnAListThatKeepsGrowing(t *testing.T) {
+	m := &module{cGetSlotList: func(_ byte, slots *ulong, count *ulong) ulong {
+		if slots == nil {
+			*count = 1
+			return rvOK
+		}
+		return rvBufferTooSmall
+	}}
+
+	_, err := m.slotList()
+
+	assert.Error(t, err, "a module that never settles on a size is an error, not a loop")
+}
+
+func TestCheckFunctionListVersion(t *testing.T) {
+	assert.NoError(t, checkFunctionListVersion(version{major: 2, minor: 40}))
+	assert.NoError(t, checkFunctionListVersion(version{major: 3, minor: 0}))
+	assert.Error(t, checkFunctionListVersion(version{major: 1, minor: 0}), "a pre-2.0 list has no entry points to index")
+	assert.Error(t, checkFunctionListVersion(version{}), "an empty version is not a function list")
+}
+
+// fakeFindModule answers C_FindObjects from batches, a handle per entry, and reports how
+// the search was torn down.
+func fakeFindModule(batches [][]ulong, finalized *int) *module {
+	next := 0
+	return &module{
+		cFindObjectsInit:  func(ulong, *attribute, ulong) ulong { return rvOK },
+		cFindObjectsFinal: func(ulong) ulong { *finalized++; return rvOK },
+		cFindObjects: func(_ ulong, objects *ulong, max ulong, count *ulong) ulong {
+			if next >= len(batches) {
+				*count = 0
+				return rvOK
+			}
+			batch := batches[next]
+			next++
+			copy(unsafe.Slice(objects, max), batch)
+			*count = ulong(len(batch))
+			return rvOK
+		},
+	}
+}
+
+var findTemplate = []Attribute{{Type: AttrClass, Value: ULong(ClassPrivateKey)}}
+
+// TestFindObjects_ReadsPastAShortBatch: PKCS#11 ends a search with an empty batch, not with
+// one shorter than asked for, so a module that hands out its handles in small batches must
+// still have all of them returned.
+func TestFindObjects_ReadsPastAShortBatch(t *testing.T) {
+	finalized := 0
+	m := fakeFindModule([][]ulong{{1, 2}, {3}, {4, 5, 6}}, &finalized)
+
+	objects, err := m.findObjects(1, findTemplate)
+
+	require.NoError(t, err)
+	assert.Equal(t, []Object{1, 2, 3, 4, 5, 6}, objects, "every batch is read until the module returns an empty one")
+	assert.Equal(t, 1, finalized, "the search is finished once")
+}
+
+func TestFindObjects_StopsAtAnEmptyBatch(t *testing.T) {
+	finalized := 0
+	m := fakeFindModule(nil, &finalized)
+
+	objects, err := m.findObjects(1, findTemplate)
+
+	require.NoError(t, err)
+	assert.Empty(t, objects, "a search that finds nothing returns nothing")
+	assert.Equal(t, 1, finalized)
+}
+
+// TestFindObjects_BoundsAModuleThatNeverEnds: a module that keeps returning handles must
+// not make the daemon allocate without limit.
+func TestFindObjects_BoundsAModuleThatNeverEnds(t *testing.T) {
+	finalized := 0
+	endless := &module{
+		cFindObjectsInit:  func(ulong, *attribute, ulong) ulong { return rvOK },
+		cFindObjectsFinal: func(ulong) ulong { finalized++; return rvOK },
+		cFindObjects: func(_ ulong, _ *ulong, _ ulong, count *ulong) ulong {
+			*count = findBatch
+			return rvOK
+		},
+	}
+
+	_, err := endless.findObjects(1, findTemplate)
+
+	assert.Error(t, err, "an endless search is cut off")
+	assert.Equal(t, 1, finalized, "and still finished")
+}
diff --git a/client/internal/pkcs11/driver_stub.go b/client/internal/pkcs11/driver_stub.go
new file mode 100644
index 000000000..35d4d9333
--- /dev/null
+++ b/client/internal/pkcs11/driver_stub.go
@@ -0,0 +1,12 @@
+//go:build !(pkcs11 && linux && !android && (amd64 || arm64))
+
+package pkcs11
+
+// Supported reports whether this build can load PKCS#11 modules.
+func Supported() bool {
+	return false
+}
+
+func load(string) (driver, error) {
+	return nil, ErrUnsupported
+}
diff --git a/client/internal/pkcs11/pinrejected_test.go b/client/internal/pkcs11/pinrejected_test.go
new file mode 100644
index 000000000..6bbfbcae5
--- /dev/null
+++ b/client/internal/pkcs11/pinrejected_test.go
@@ -0,0 +1,19 @@
+package pkcs11
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPINRejected(t *testing.T) {
+	for _, code := range []uint{rvPINIncorrect, rvPINInvalid, rvPINLenRange, rvPINExpired, rvPINLocked} {
+		err := fmt.Errorf("open session: %w", Error{Op: "C_Login", Code: code})
+		assert.True(t, PINRejected(err), "CKR 0x%x refuses the PIN, also when wrapped", code)
+	}
+	assert.False(t, PINRejected(Error{Op: "C_Login", Code: 0x30}), "a device error says nothing about the PIN")
+	assert.False(t, PINRejected(errors.New("CKR_PIN_INCORRECT")), "only a PKCS#11 return value counts")
+	assert.False(t, PINRejected(nil))
+}
diff --git a/client/internal/pkcs11/pkcs11.go b/client/internal/pkcs11/pkcs11.go
new file mode 100644
index 000000000..4a34848d9
--- /dev/null
+++ b/client/internal/pkcs11/pkcs11.go
@@ -0,0 +1,329 @@
+// Package pkcs11 is a minimal PKCS#11 client. It loads a module at runtime without cgo,
+// opens a token session, lists objects and signs with keys the token holds. It exists so
+// certificates whose keys live in a TPM behind tpm2-pkcs11 can be proven; whatever a
+// certificate store does not need is left out.
+package pkcs11
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"sync"
+)
+
+// Object classes, attribute types, mechanisms and generators from PKCS#11 v2.40.
+const (
+	ClassCertificate = 0x1
+	ClassPublicKey   = 0x2
+	ClassPrivateKey  = 0x3
+
+	CertificateX509 = 0x0
+
+	AttrClass           = 0x0
+	AttrToken           = 0x1
+	AttrLabel           = 0x3
+	AttrValue           = 0x11
+	AttrCertificateType = 0x80
+	AttrKeyType         = 0x100
+	AttrSubject         = 0x101
+	AttrID              = 0x102
+	AttrModulus         = 0x120
+	AttrPublicExponent  = 0x122
+	AttrECParams        = 0x180
+	AttrECPoint         = 0x181
+
+	KeyRSA = 0x0
+	KeyEC  = 0x3
+
+	MechRSAPKCSPSS = 0xd
+	MechSHA256     = 0x250
+	MechSHA384     = 0x260
+	MechECDSA      = 0x1041
+
+	MGF1SHA256 = 0x2
+	MGF1SHA384 = 0x3
+
+	rvOK                  = 0x0
+	rvPINIncorrect        = 0xa0
+	rvPINInvalid          = 0xa1
+	rvPINLenRange         = 0xa2
+	rvPINExpired          = 0xa3
+	rvPINLocked           = 0xa4
+	rvUserAlreadyLoggedIn = 0x100
+	rvBufferTooSmall      = 0x150
+	rvAlreadyInitialized  = 0x191
+)
+
+var ErrUnsupported = errors.New("PKCS#11 modules need a build with the pkcs11 tag on linux/amd64 or linux/arm64")
+
+// Error is a PKCS#11 return value other than CKR_OK.
+type Error struct {
+	Op   string
+	Code uint
+}
+
+func (e Error) Error() string {
+	if name, ok := returnValueNames[e.Code]; ok {
+		return fmt.Sprintf("%s: %s", e.Op, name)
+	}
+	return fmt.Sprintf("%s: CKR 0x%x", e.Op, e.Code)
+}
+
+// PINRejected reports whether err is the token refusing the user PIN. Retrying the same
+// PIN cannot succeed, and each attempt counts towards the token's lockout.
+func PINRejected(err error) bool {
+	var e Error
+	if !errors.As(err, &e) {
+		return false
+	}
+	switch e.Code {
+	case rvPINIncorrect, rvPINInvalid, rvPINLenRange, rvPINExpired, rvPINLocked:
+		return true
+	}
+	return false
+}
+
+func isCode(err error, code uint) bool {
+	var e Error
+	return errors.As(err, &e) && e.Code == code
+}
+
+var returnValueNames = map[uint]string{
+	0x2:   "CKR_HOST_MEMORY",
+	0x3:   "CKR_SLOT_ID_INVALID",
+	0x5:   "CKR_GENERAL_ERROR",
+	0x7:   "CKR_ARGUMENTS_BAD",
+	0x12:  "CKR_ATTRIBUTE_TYPE_INVALID",
+	0x13:  "CKR_ATTRIBUTE_VALUE_INVALID",
+	0x30:  "CKR_DEVICE_ERROR",
+	0x54:  "CKR_FUNCTION_NOT_SUPPORTED",
+	0x68:  "CKR_KEY_FUNCTION_NOT_PERMITTED",
+	0x70:  "CKR_MECHANISM_INVALID",
+	0x71:  "CKR_MECHANISM_PARAM_INVALID",
+	0x82:  "CKR_OBJECT_HANDLE_INVALID",
+	0xa0:  "CKR_PIN_INCORRECT",
+	0xa1:  "CKR_PIN_INVALID",
+	0xa2:  "CKR_PIN_LEN_RANGE",
+	0xa3:  "CKR_PIN_EXPIRED",
+	0xa4:  "CKR_PIN_LOCKED",
+	0xb3:  "CKR_SESSION_HANDLE_INVALID",
+	0xd0:  "CKR_TEMPLATE_INCOMPLETE",
+	0xd1:  "CKR_TEMPLATE_INCONSISTENT",
+	0xe0:  "CKR_TOKEN_NOT_PRESENT",
+	0x101: "CKR_USER_NOT_LOGGED_IN",
+	0x150: "CKR_BUFFER_TOO_SMALL",
+	0x190: "CKR_CRYPTOKI_NOT_INITIALIZED",
+}
+
+// Attribute is one entry of a PKCS#11 template. Integer-valued attributes such as the
+// object class are encoded with ULong.
+type Attribute struct {
+	Type  uint
+	Value []byte
+}
+
+// Mechanism selects a signing algorithm. PSS carries the parameters CKM_RSA_PKCS_PSS needs.
+type Mechanism struct {
+	Type uint
+	PSS  *PSSParams
+}
+
+type PSSParams struct {
+	Hash    uint
+	MGF     uint
+	SaltLen uint
+}
+
+// Object is a handle the token issued for one of its objects.
+type Object uint
+
+// Token is a slot with a token present.
+type Token struct {
+	Slot  uint
+	Label string
+}
+
+// Module is a loaded and initialised PKCS#11 library. A module is loaded once per path
+// and never finalised: tokens such as tpm2-pkcs11 do real work in C_Initialize, and the
+// process exit releases everything anyway.
+type Module struct {
+	d driver
+
+	// loginMu guards logins, the number of open sessions relying on the user login of
+	// each slot, and serializes logging in so a PIN is never sent twice at once.
+	loginMu sync.Mutex
+	logins  map[uint]int
+}
+
+var (
+	modulesMu sync.Mutex
+	modules   = map[string]*Module{}
+)
+
+// Load opens the shared library at path and initialises it, or returns the module already
+// loaded from that path.
+func Load(path string) (*Module, error) {
+	modulesMu.Lock()
+	defer modulesMu.Unlock()
+	if m, ok := modules[path]; ok {
+		return m, nil
+	}
+	d, err := load(path)
+	if err != nil {
+		return nil, err
+	}
+	m := &Module{d: d}
+	modules[path] = m
+	return m, nil
+}
+
+func (m *Module) Tokens() ([]Token, error) {
+	return m.d.tokens()
+}
+
+// OpenSession opens a read-only session with the token carrying label, or with the first
+// token when label is empty, and logs in as the user when pin is not nil. An empty,
+// non-nil pin still logs in.
+func (m *Module) OpenSession(label string, pin []byte) (*Session, error) {
+	return m.openSession(label, pin, false)
+}
+
+// OpenReadWriteSession is OpenSession for callers that create objects on the token.
+func (m *Module) OpenReadWriteSession(label string, pin []byte) (*Session, error) {
+	return m.openSession(label, pin, true)
+}
+
+func (m *Module) openSession(label string, pin []byte, readWrite bool) (*Session, error) {
+	token, err := m.token(label)
+	if err != nil {
+		return nil, err
+	}
+	handle, err := m.d.openSession(token.Slot, readWrite)
+	if err != nil {
+		return nil, err
+	}
+	s := &Session{d: m.d, handle: handle}
+	if pin == nil {
+		return s, nil
+	}
+	if err := m.acquireLogin(token.Slot, handle, pin); err != nil {
+		s.Close()
+		return nil, err
+	}
+	s.module, s.slot = m, token.Slot
+	return s, nil
+}
+
+// acquireLogin makes sure the user is logged in to the token in slot and counts the
+// session as one relying on it. PKCS#11 login state belongs to the application, not to
+// a session: every session with the token shares it, and logging out from any of them
+// ends it for all. So the PIN is sent only when no session holds the login yet, and the
+// last session to close logs out.
+func (m *Module) acquireLogin(slot, handle uint, pin []byte) error {
+	m.loginMu.Lock()
+	defer m.loginMu.Unlock()
+	if m.logins[slot] > 0 {
+		m.logins[slot]++
+		return nil
+	}
+	if err := m.d.login(handle, pin); err != nil && !isCode(err, rvUserAlreadyLoggedIn) {
+		return err
+	}
+	if m.logins == nil {
+		m.logins = make(map[uint]int)
+	}
+	m.logins[slot] = 1
+	return nil
+}
+
+// releaseLogin ends the session's share of the login, logging out when it is the last.
+func (m *Module) releaseLogin(slot, handle uint) {
+	m.loginMu.Lock()
+	defer m.loginMu.Unlock()
+	m.logins[slot]--
+	if m.logins[slot] > 0 {
+		return
+	}
+	delete(m.logins, slot)
+	m.d.logout(handle)
+}
+
+func (m *Module) token(label string) (Token, error) {
+	tokens, err := m.Tokens()
+	if err != nil {
+		return Token{}, err
+	}
+	for _, token := range tokens {
+		if label == "" || token.Label == label {
+			return token, nil
+		}
+	}
+	if label == "" {
+		return Token{}, errors.New("no token present")
+	}
+	return Token{}, fmt.Errorf("no token labelled %q among %d tokens", label, len(tokens))
+}
+
+// Session is an open session with one token. Close releases the session's share of the
+// login, logging out when no other session relies on it.
+type Session struct {
+	d      driver
+	handle uint
+	// module is set when the session relies on the token's login.
+	module *Module
+	slot   uint
+}
+
+func (s *Session) Close() {
+	if s.module != nil {
+		s.module.releaseLogin(s.slot, s.handle)
+	}
+	s.d.closeSession(s.handle)
+}
+
+// FindObjects returns the handles of every object matching all attributes of template.
+func (s *Session) FindObjects(template ...Attribute) ([]Object, error) {
+	return s.d.findObjects(s.handle, template)
+}
+
+// Attribute reads one attribute of an object.
+func (s *Session) Attribute(obj Object, typ uint) ([]byte, error) {
+	return s.d.attribute(s.handle, obj, typ)
+}
+
+// Sign signs data, normally a digest, with the token-held key in a single operation.
+func (s *Session) Sign(mech Mechanism, key Object, data []byte) ([]byte, error) {
+	return s.d.sign(s.handle, mech, key, data)
+}
+
+// CreateObject stores a new object described by template on the token.
+func (s *Session) CreateObject(template ...Attribute) (Object, error) {
+	return s.d.createObject(s.handle, template)
+}
+
+type driver interface {
+	tokens() ([]Token, error)
+	openSession(slot uint, readWrite bool) (uint, error)
+	closeSession(session uint)
+	login(session uint, pin []byte) error
+	logout(session uint)
+	findObjects(session uint, template []Attribute) ([]Object, error)
+	attribute(session uint, obj Object, typ uint) ([]byte, error)
+	sign(session uint, mech Mechanism, key Object, data []byte) ([]byte, error)
+	createObject(session uint, template []Attribute) (Object, error)
+}
+
+// ulongSize is the width of CK_ULONG on the 64-bit platforms the driver builds for.
+const ulongSize = 8
+
+// ULong encodes an integer attribute value the way the module reads a CK_ULONG.
+func ULong(v uint) []byte {
+	return binary.NativeEndian.AppendUint64(nil, uint64(v))
+}
+
+func ulongValue(b []byte) (uint, error) {
+	if len(b) != ulongSize {
+		return 0, fmt.Errorf("CK_ULONG value has %d bytes", len(b))
+	}
+	return uint(binary.NativeEndian.Uint64(b)), nil
+}
diff --git a/client/internal/pkcs11/publickey.go b/client/internal/pkcs11/publickey.go
new file mode 100644
index 000000000..aac78524a
--- /dev/null
+++ b/client/internal/pkcs11/publickey.go
@@ -0,0 +1,99 @@
+package pkcs11
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"encoding/asn1"
+	"errors"
+	"fmt"
+	"math"
+	"math/big"
+)
+
+var curvesByOID = map[string]elliptic.Curve{
+	"1.2.840.10045.3.1.7": elliptic.P256(),
+	"1.3.132.0.34":        elliptic.P384(),
+	"1.3.132.0.35":        elliptic.P521(),
+}
+
+// PublicKey reads a CKO_PUBLIC_KEY object as a Go public key. RSA and EC keys are
+// supported, the two kinds a certificate posture proof can be signed with.
+func (s *Session) PublicKey(obj Object) (crypto.PublicKey, error) {
+	raw, err := s.Attribute(obj, AttrKeyType)
+	if err != nil {
+		return nil, err
+	}
+	keyType, err := ulongValue(raw)
+	if err != nil {
+		return nil, fmt.Errorf("CKA_KEY_TYPE: %w", err)
+	}
+	switch keyType {
+	case KeyRSA:
+		modulus, exponent, err := s.attributes(obj, AttrModulus, AttrPublicExponent)
+		if err != nil {
+			return nil, err
+		}
+		return rsaPublicKey(modulus, exponent)
+	case KeyEC:
+		params, point, err := s.attributes(obj, AttrECParams, AttrECPoint)
+		if err != nil {
+			return nil, err
+		}
+		return ecPublicKey(params, point)
+	}
+	return nil, fmt.Errorf("unsupported key type 0x%x", keyType)
+}
+
+func (s *Session) attributes(obj Object, first, second uint) ([]byte, []byte, error) {
+	a, err := s.Attribute(obj, first)
+	if err != nil {
+		return nil, nil, err
+	}
+	b, err := s.Attribute(obj, second)
+	if err != nil {
+		return nil, nil, err
+	}
+	return a, b, nil
+}
+
+func rsaPublicKey(modulus, exponent []byte) (*rsa.PublicKey, error) {
+	e := new(big.Int).SetBytes(exponent)
+	if e.Sign() <= 0 || e.Cmp(big.NewInt(math.MaxInt32)) > 0 {
+		return nil, errors.New("CKA_PUBLIC_EXPONENT is out of range")
+	}
+	return &rsa.PublicKey{N: new(big.Int).SetBytes(modulus), E: int(e.Int64())}, nil
+}
+
+// ecPublicKey decodes CKA_EC_PARAMS, the named curve OID, and CKA_EC_POINT, the
+// uncompressed point wrapped in a DER OCTET STRING, which some modules hand out bare.
+func ecPublicKey(params, point []byte) (*ecdsa.PublicKey, error) {
+	var oid asn1.ObjectIdentifier
+	if rest, err := asn1.Unmarshal(params, &oid); err != nil {
+		return nil, fmt.Errorf("CKA_EC_PARAMS: %w", err)
+	} else if len(rest) != 0 {
+		return nil, errors.New("CKA_EC_PARAMS has trailing data")
+	}
+	curve, ok := curvesByOID[oid.String()]
+	if !ok {
+		return nil, fmt.Errorf("unsupported curve %s", oid)
+	}
+	size := (curve.Params().BitSize + 7) / 8
+	raw := point
+	if len(raw) != 1+2*size {
+		if rest, err := asn1.Unmarshal(point, &raw); err != nil {
+			return nil, fmt.Errorf("CKA_EC_POINT: %w", err)
+		} else if len(rest) != 0 {
+			return nil, errors.New("CKA_EC_POINT has trailing data")
+		}
+	}
+	if len(raw) != 1+2*size || raw[0] != 4 {
+		return nil, errors.New("CKA_EC_POINT is not an uncompressed point")
+	}
+	key, err := ecdsa.ParseUncompressedPublicKey(curve, raw)
+	if err != nil {
+		return nil, fmt.Errorf("CKA_EC_POINT: %w", err)
+	}
+	return key, nil
+}
diff --git a/client/internal/pkcs11/publickey_test.go b/client/internal/pkcs11/publickey_test.go
new file mode 100644
index 000000000..70c1c9a15
--- /dev/null
+++ b/client/internal/pkcs11/publickey_test.go
@@ -0,0 +1,103 @@
+package pkcs11
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/asn1"
+	"math"
+	"math/big"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestECPublicKey(t *testing.T) {
+	curves := []struct {
+		name  string
+		curve elliptic.Curve
+		oid   asn1.ObjectIdentifier
+	}{
+		{"P-256", elliptic.P256(), asn1.ObjectIdentifier{1, 2, 840, 10045, 3, 1, 7}},
+		{"P-384", elliptic.P384(), asn1.ObjectIdentifier{1, 3, 132, 0, 34}},
+		// The wrapped P-521 point is 133 bytes, which needs the long form of the DER length.
+		{"P-521", elliptic.P521(), asn1.ObjectIdentifier{1, 3, 132, 0, 35}},
+	}
+	for _, tt := range curves {
+		t.Run(tt.name, func(t *testing.T) {
+			key, err := ecdsa.GenerateKey(tt.curve, rand.Reader)
+			require.NoError(t, err)
+			params, err := asn1.Marshal(tt.oid)
+			require.NoError(t, err)
+			point := uncompressedPoint(key)
+			wrapped, err := asn1.Marshal(point)
+			require.NoError(t, err)
+
+			// PKCS#11 wraps the point in an OCTET STRING, but some modules return it bare.
+			for form, encoded := range map[string][]byte{"DER octet string": wrapped, "bare point": point} {
+				pub, err := ecPublicKey(params, encoded)
+				require.NoError(t, err, form)
+				assert.True(t, key.PublicKey.Equal(pub), "%s must decode to the generated key", form)
+			}
+		})
+	}
+}
+
+func TestECPublicKey_Rejections(t *testing.T) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	p256, err := asn1.Marshal(asn1.ObjectIdentifier{1, 2, 840, 10045, 3, 1, 7})
+	require.NoError(t, err)
+	brainpool, err := asn1.Marshal(asn1.ObjectIdentifier{1, 3, 36, 3, 3, 2, 8, 1, 1, 7})
+	require.NoError(t, err)
+	point := uncompressedPoint(key)
+
+	_, err = ecPublicKey(brainpool, point)
+	assert.Error(t, err, "curves the proof cannot use must be rejected")
+	_, err = ecPublicKey(p256, point[:len(point)-1])
+	assert.Error(t, err, "a truncated point must be rejected")
+	_, err = ecPublicKey([]byte("junk"), point)
+	assert.Error(t, err, "malformed parameters must be rejected")
+
+	wrapped, err := asn1.Marshal(point)
+	require.NoError(t, err)
+	_, err = ecPublicKey(append(append([]byte{}, p256...), 0), point)
+	assert.Error(t, err, "bytes after the curve parameters must be rejected")
+	_, err = ecPublicKey(p256, append(append([]byte{}, wrapped...), 0))
+	assert.Error(t, err, "bytes after the wrapped point must be rejected")
+}
+
+func TestRSAPublicKey(t *testing.T) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	pub, err := rsaPublicKey(key.N.Bytes(), big.NewInt(int64(key.E)).Bytes())
+	require.NoError(t, err)
+	assert.True(t, key.PublicKey.Equal(pub), "modulus and exponent must decode to the generated key")
+
+	_, err = rsaPublicKey(key.N.Bytes(), nil)
+	assert.Error(t, err, "a missing exponent must be rejected")
+	_, err = rsaPublicKey(key.N.Bytes(), big.NewInt(math.MaxInt32).Bytes())
+	assert.NoError(t, err, "the largest exponent an int holds is accepted")
+	_, err = rsaPublicKey(key.N.Bytes(), big.NewInt(math.MaxInt32+1).Bytes())
+	assert.Error(t, err, "an exponent past int32 must be rejected")
+	_, err = rsaPublicKey(key.N.Bytes(), []byte{0})
+	assert.Error(t, err, "a zero exponent must be rejected")
+}
+
+func TestULongRoundTrip(t *testing.T) {
+	v, err := ulongValue(ULong(ClassPrivateKey))
+	require.NoError(t, err)
+	assert.Equal(t, uint(ClassPrivateKey), v)
+
+	_, err = ulongValue([]byte{1, 2, 3})
+	assert.Error(t, err, "a value of the wrong width must be rejected")
+}
+
+func uncompressedPoint(key *ecdsa.PrivateKey) []byte {
+	size := (key.Curve.Params().BitSize + 7) / 8
+	point := append([]byte{4}, key.X.FillBytes(make([]byte, size))...)
+	return append(point, key.Y.FillBytes(make([]byte, size))...)
+}
diff --git a/client/internal/pkcs11/session_test.go b/client/internal/pkcs11/session_test.go
new file mode 100644
index 000000000..eacc5e15f
--- /dev/null
+++ b/client/internal/pkcs11/session_test.go
@@ -0,0 +1,72 @@
+package pkcs11
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeDriver stands in for a loaded module and records the calls a session makes.
+type fakeDriver struct {
+	loginErr error
+	logins   int
+	logouts  int
+	closes   int
+}
+
+func (f *fakeDriver) tokens() ([]Token, error)             { return []Token{{Slot: 1, Label: "netbird"}}, nil }
+func (f *fakeDriver) openSession(uint, bool) (uint, error) { return 7, nil }
+func (f *fakeDriver) closeSession(uint)                    { f.closes++ }
+func (f *fakeDriver) login(uint, []byte) error             { f.logins++; return f.loginErr }
+func (f *fakeDriver) logout(uint)                          { f.logouts++ }
+func (f *fakeDriver) findObjects(uint, []Attribute) ([]Object, error) {
+	return nil, nil
+}
+func (f *fakeDriver) attribute(uint, Object, uint) ([]byte, error) { return nil, nil }
+func (f *fakeDriver) sign(uint, Mechanism, Object, []byte) ([]byte, error) {
+	return nil, nil
+}
+func (f *fakeDriver) createObject(uint, []Attribute) (Object, error) { return 0, nil }
+
+func TestOpenSession_LogsOutOnlyALoginItOwns(t *testing.T) {
+	t.Run("own login is logged out on close", func(t *testing.T) {
+		d := &fakeDriver{}
+		s, err := (&Module{d: d}).OpenSession("netbird", []byte("1234"))
+		require.NoError(t, err)
+		s.Close()
+		assert.Equal(t, 1, d.logouts, "the session that logged in logs out again")
+	})
+
+	t.Run("a login shared by sessions ends with the last one", func(t *testing.T) {
+		d := &fakeDriver{}
+		m := &Module{d: d}
+		first, err := m.OpenSession("netbird", []byte("1234"))
+		require.NoError(t, err)
+		second, err := m.OpenSession("netbird", []byte("1234"))
+		require.NoError(t, err)
+		assert.Equal(t, 1, d.logins, "the second session reuses the login instead of sending the PIN again")
+
+		first.Close()
+		assert.Zero(t, d.logouts, "logging out now would end the login the second session still uses")
+		second.Close()
+		assert.Equal(t, 1, d.logouts, "the last session to close logs out")
+		assert.Equal(t, 2, d.closes, "both sessions are closed")
+	})
+
+	t.Run("an existing login is taken over", func(t *testing.T) {
+		d := &fakeDriver{loginErr: Error{Op: "C_Login", Code: rvUserAlreadyLoggedIn}}
+		s, err := (&Module{d: d}).OpenSession("netbird", []byte("1234"))
+		require.NoError(t, err, "an existing login is good enough to use the token")
+		s.Close()
+		assert.Equal(t, 1, d.logouts, "no session of this client holds the login any more, so it ends")
+	})
+
+	t.Run("rejected pin closes the session", func(t *testing.T) {
+		d := &fakeDriver{loginErr: Error{Op: "C_Login", Code: rvPINIncorrect}}
+		_, err := (&Module{d: d}).OpenSession("netbird", []byte("0000"))
+		assert.True(t, PINRejected(err), "the PIN error reaches the caller")
+		assert.Zero(t, d.logouts, "nothing to log out after a failed login")
+		assert.Equal(t, 1, d.closes, "the session opened for the login is closed")
+	})
+}
diff --git a/client/internal/pkcs11/uri.go b/client/internal/pkcs11/uri.go
new file mode 100644
index 000000000..fb5dc2765
--- /dev/null
+++ b/client/internal/pkcs11/uri.go
@@ -0,0 +1,184 @@
+package pkcs11
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// DefaultModule is p11-kit's proxy, which exposes every module the system has registered,
+// tpm2-pkcs11 included, so a URI without module-path works on a stock p11-kit setup.
+const DefaultModule = "p11-kit-proxy.so"
+
+// URI is the subset of an RFC 7512 PKCS#11 URI this client understands: the token label,
+// the module to load and where the user PIN comes from.
+type URI struct {
+	Token      string
+	ModulePath string
+	pinValue   *string
+	pinSource  string
+}
+
+// ParseURI parses raw following RFC 7512 section 2.3. A path attribute other than token
+// is refused rather than ignored: the path narrows which token is used, and ignoring a
+// constraint such as serial would widen the match to whichever token is listed first,
+// where the RFC calls for no match at all. Duplicate attributes are refused, a
+// module-path must be absolute and a module-name must be a bare name. Unknown query
+// attributes are ignored, as the RFC asks.
+func ParseURI(raw string) (*URI, error) {
+	rest, ok := cutPrefixFold(raw, "pkcs11:")
+	if !ok {
+		return nil, errors.New("PKCS#11 URI does not start with the pkcs11 scheme")
+	}
+	path, query, _ := strings.Cut(rest, "?")
+
+	u := &URI{}
+	if err := eachAttribute(path, ";", u.setPathAttribute); err != nil {
+		return nil, err
+	}
+	if err := eachAttribute(query, "&", u.setQueryAttribute); err != nil {
+		return nil, err
+	}
+	// RFC 7512 section 2.4: a URI with both pin-value and pin-source should be refused.
+	if u.pinValue != nil && u.pinSource != "" {
+		return nil, errors.New("PKCS#11 URI carries both pin-value and pin-source")
+	}
+	return u, nil
+}
+
+func (u *URI) setPathAttribute(name, value string) error {
+	if name != "token" {
+		return fmt.Errorf("PKCS#11 URI path attribute %q is not supported, only token selects a token", name)
+	}
+	u.Token = value
+	return nil
+}
+
+func (u *URI) setQueryAttribute(name, value string) error {
+	switch name {
+	case "module-path":
+		if !filepath.IsAbs(value) {
+			return fmt.Errorf("PKCS#11 URI module-path %q must be absolute", value)
+		}
+		u.ModulePath = value
+	case "module-name":
+		if value == "" || strings.ContainsAny(value, `/\`) || strings.Contains(value, "..") {
+			return fmt.Errorf("PKCS#11 URI module-name %q must be a module name, not a path", value)
+		}
+		u.ModulePath = "lib" + value + ".so"
+	case "pin-value":
+		u.pinValue = &value
+	case "pin-source":
+		path, err := pinSourcePath(value)
+		if err != nil {
+			return err
+		}
+		u.pinSource = path
+	}
+	return nil
+}
+
+// pinSourcePath turns a pin-source value into the file to read. A plain path is used as
+// it is; a file URI must name a local absolute path, with no host or localhost (RFC 8089
+// section 2), so a PIN is never read from somewhere the URI only appears to point to.
+func pinSourcePath(value string) (string, error) {
+	if value == "" {
+		return "", errors.New("PKCS#11 URI pin-source is empty")
+	}
+	rest, isFile := cutPrefixFold(value, "file:")
+	if !isFile {
+		return value, nil
+	}
+	authorityAndPath, hasAuthority := strings.CutPrefix(rest, "//")
+	if !hasAuthority {
+		if !isAbsolutePath(rest) {
+			return "", fmt.Errorf("PKCS#11 URI pin-source %q must be an absolute path", value)
+		}
+		return rest, nil
+	}
+	if isAbsolutePath(authorityAndPath) {
+		return authorityAndPath, nil
+	}
+	host, path, _ := strings.Cut(authorityAndPath, "/")
+	if host != "" && !strings.EqualFold(host, "localhost") {
+		return "", fmt.Errorf("PKCS#11 URI pin-source host %q is not the local machine", host)
+	}
+	if path == "" {
+		return "", fmt.Errorf("PKCS#11 URI pin-source %q names no file", value)
+	}
+	return "/" + path, nil
+}
+
+// isAbsolutePath reports whether p is absolute in a file URI. A path starting with a slash
+// is absolute there on every platform, including Windows, where filepath.IsAbs wants a
+// drive letter.
+func isAbsolutePath(p string) bool {
+	return strings.HasPrefix(p, "/") || filepath.IsAbs(p)
+}
+
+// cutPrefixFold is strings.CutPrefix with the prefix matched without regard to case.
+func cutPrefixFold(s, prefix string) (string, bool) {
+	if len(s) < len(prefix) || !strings.EqualFold(s[:len(prefix)], prefix) {
+		return s, false
+	}
+	return s[len(prefix):], true
+}
+
+// Module is the library to load, DefaultModule when the URI names none.
+func (u *URI) Module() string {
+	if u.ModulePath == "" {
+		return DefaultModule
+	}
+	return u.ModulePath
+}
+
+// HasPIN reports whether the URI carries a PIN, inline or as a pin-source.
+func (u *URI) HasPIN() bool {
+	return u.pinValue != nil || u.pinSource != ""
+}
+
+// PIN returns the user PIN, or nil when the URI carries none and no login should happen.
+// A pin-source names a file whose single line is the PIN.
+func (u *URI) PIN() ([]byte, error) {
+	if u.pinValue != nil {
+		return []byte(*u.pinValue), nil
+	}
+	if u.pinSource == "" {
+		return nil, nil
+	}
+	pin, err := os.ReadFile(u.pinSource)
+	if err != nil {
+		return nil, fmt.Errorf("read PIN: %w", err)
+	}
+	return []byte(strings.TrimRight(string(pin), "\r\n")), nil
+}
+
+// eachAttribute splits list on sep and calls fn for every name=value pair, refusing a
+// name that appears twice.
+func eachAttribute(list, sep string, fn func(name, value string) error) error {
+	if list == "" {
+		return nil
+	}
+	seen := make(map[string]struct{})
+	for _, pair := range strings.Split(list, sep) {
+		name, value, ok := strings.Cut(pair, "=")
+		if !ok {
+			return fmt.Errorf("PKCS#11 URI attribute %q has no value", pair)
+		}
+		if _, dup := seen[name]; dup {
+			return fmt.Errorf("PKCS#11 URI attribute %s appears more than once", name)
+		}
+		seen[name] = struct{}{}
+		value, err := url.PathUnescape(value)
+		if err != nil {
+			return fmt.Errorf("PKCS#11 URI attribute %s: %w", name, err)
+		}
+		if err := fn(name, value); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/client/internal/pkcs11/uri_test.go b/client/internal/pkcs11/uri_test.go
new file mode 100644
index 000000000..09aede6a7
--- /dev/null
+++ b/client/internal/pkcs11/uri_test.go
@@ -0,0 +1,175 @@
+package pkcs11
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseURI(t *testing.T) {
+	tests := []struct {
+		name       string
+		raw        string
+		wantToken  string
+		wantModule string
+		wantPIN    []byte
+	}{
+		{
+			name:       "token with module path and pin value",
+			raw:        "pkcs11:token=netbird?module-path=" + absModule("libtpm2_pkcs11.so") + "&pin-value=1234",
+			wantToken:  "netbird",
+			wantModule: absModule("libtpm2_pkcs11.so"),
+			wantPIN:    []byte("1234"),
+		},
+		{
+			name:       "module name becomes a library file",
+			raw:        "pkcs11:token=netbird?module-name=tpm2_pkcs11",
+			wantToken:  "netbird",
+			wantModule: "libtpm2_pkcs11.so",
+		},
+		{
+			name:       "percent encoding, unknown query attributes are ignored",
+			raw:        "pkcs11:token=my%20token?max-sessions=1&vendor-flag=on",
+			wantToken:  "my token",
+			wantModule: DefaultModule,
+		},
+		{
+			name:       "bare scheme uses the p11-kit proxy and no login",
+			raw:        "pkcs11:",
+			wantModule: DefaultModule,
+		},
+		{
+			name:       "empty pin value still logs in",
+			raw:        "pkcs11:?pin-value=",
+			wantModule: DefaultModule,
+			wantPIN:    []byte{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			uri, err := ParseURI(tt.raw)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantToken, uri.Token, "token label")
+			assert.Equal(t, tt.wantModule, uri.Module(), "module to load")
+			pin, err := uri.PIN()
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantPIN, pin, "PIN, nil meaning no login")
+		})
+	}
+}
+
+func TestParseURI_Rejections(t *testing.T) {
+	tests := map[string]string{
+		"no scheme":            "pkcs11",
+		"other scheme":         "https://example.com",
+		"attribute no value":   "pkcs11:token",
+		"bad percent encoding": "pkcs11:token=%zz",
+		// RFC 7512 2.3: an unrecognized path attribute matches nothing. Ignoring it
+		// instead would let the token listed first answer for the one serial names.
+		"unsupported serial":       "pkcs11:token=netbird;serial=1234",
+		"unsupported model":        "pkcs11:model=SoftHSM%20v2;token=netbird",
+		"object selector":          "pkcs11:token=netbird;object=device",
+		"vendor path attribute":    "pkcs11:token=netbird;vendor-slot=2",
+		"duplicate token":          "pkcs11:token=a;token=b",
+		"duplicate module-path":    "pkcs11:token=a?module-path=" + absModule("a.so") + "&module-path=" + absModule("b.so"),
+		"duplicate pin-value":      "pkcs11:token=a?pin-value=1&pin-value=2",
+		"relative module-path":     "pkcs11:token=a?module-path=lib/x.so",
+		"bare module-path":         "pkcs11:token=a?module-path=libtpm2_pkcs11.so",
+		"module-name with path":    "pkcs11:token=a?module-name=../../tmp/evil",
+		"module-name with slash":   "pkcs11:token=a?module-name=tmp/evil",
+		"module-name with dotdot":  "pkcs11:token=a?module-name=..",
+		"empty module-name":        "pkcs11:token=a?module-name=",
+		"pin-value and pin-source": "pkcs11:token=a?pin-value=1&pin-source=file:/etc/pin",
+		// Without a value the URI would silently mean "no PIN" and skip the login.
+		"empty pin-source":    "pkcs11:token=a?pin-source=",
+		"remote pin-source":   "pkcs11:token=a?pin-source=file://example.com/etc/pin",
+		"relative pin-source": "pkcs11:token=a?pin-source=file:pin",
+	}
+	for name, raw := range tests {
+		_, err := ParseURI(raw)
+		assert.Error(t, err, "%s: %s must be refused", name, raw)
+	}
+}
+
+// TestParseURI_SchemeIsCaseInsensitive: RFC 3986 section 3.1 makes schemes case-insensitive.
+func TestParseURI_SchemeIsCaseInsensitive(t *testing.T) {
+	for _, raw := range []string{"PKCS11:token=netbird", "Pkcs11:token=netbird"} {
+		uri, err := ParseURI(raw)
+		require.NoError(t, err, raw)
+		assert.Equal(t, "netbird", uri.Token, raw)
+	}
+}
+
+func TestURI_PINFromLocalhostFileURI(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("file URIs with a host name are written differently on Windows")
+	}
+	path := filepath.Join(t.TempDir(), "pin")
+	require.NoError(t, os.WriteFile(path, []byte("secret\n"), 0o600))
+
+	for _, host := range []string{"localhost", "LocalHost"} {
+		uri, err := ParseURI("pkcs11:token=netbird?pin-source=file://" + host + path)
+		require.NoError(t, err, host)
+		pin, err := uri.PIN()
+		require.NoError(t, err, host)
+		assert.Equal(t, []byte("secret"), pin, "RFC 8089 names the local machine as localhost")
+	}
+}
+
+func TestURI_PINFromFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "pin")
+	require.NoError(t, os.WriteFile(path, []byte("secret\n"), 0o600))
+
+	for _, source := range []string{path, "file:" + path, "file://" + path} {
+		uri, err := ParseURI("pkcs11:token=netbird?pin-source=" + source)
+		require.NoError(t, err)
+		pin, err := uri.PIN()
+		require.NoError(t, err)
+		assert.Equal(t, []byte("secret"), pin, "PIN from %s must drop the trailing newline", source)
+	}
+
+	uri, err := ParseURI("pkcs11:?pin-source=" + filepath.Join(t.TempDir(), "missing"))
+	require.NoError(t, err)
+	_, err = uri.PIN()
+	assert.Error(t, err, "a missing PIN file must fail loudly instead of logging in without a PIN")
+}
+
+// absModule is an absolute module path on the platform the test runs on, as module-path
+// must be absolute.
+func absModule(name string) string {
+	if runtime.GOOS == "windows" {
+		return `C:\lib\` + name
+	}
+	return "/lib/" + name
+}
+
+// TestPinSourcePath covers how a pin-source value becomes a file path, without touching the
+// file system, so the same cases run on every platform. A path starting with a slash is
+// absolute in a file URI everywhere, including Windows, where filepath.IsAbs would refuse it.
+func TestPinSourcePath(t *testing.T) {
+	tests := []struct {
+		value string
+		want  string
+	}{
+		{"/etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+		{"file:/etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+		{"file:///etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+		{"FILE:///etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+		{"file://localhost/etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+		{"file://LocalHost/etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+	}
+	for _, tt := range tests {
+		got, err := pinSourcePath(tt.value)
+		require.NoError(t, err, tt.value)
+		assert.Equal(t, tt.want, got, tt.value)
+	}
+
+	for _, value := range []string{"", "file:pin", "file://example.com/etc/pin", "file://localhost", "file://localhost/"} {
+		_, err := pinSourcePath(value)
+		assert.Error(t, err, "%q must be refused", value)
+	}
+}
diff --git a/client/internal/portforward/manager.go b/client/internal/portforward/manager.go
index b0680160c..7d5a4cb9e 100644
--- a/client/internal/portforward/manager.go
+++ b/client/internal/portforward/manager.go
@@ -10,10 +10,8 @@ import (
 	"sync"
 	"time"
 
-	"github.com/libp2p/go-nat"
+	"github.com/netbirdio/go-nat"
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/portforward/pcp"
 )
 
 const (
@@ -168,6 +166,11 @@ func (m *Manager) setup(ctx context.Context) (nat.NAT, *Mapping, error) {
 	if err != nil {
 		return nil, nil, fmt.Errorf("create port mapping: %w", err)
 	}
+
+	// Only meaningful once a mapping has been attempted: that is what opens the
+	// pinhole and records its outcome.
+	logIPv6Pinhole(gateway)
+
 	return gateway, mapping, nil
 }
 
@@ -265,7 +268,9 @@ func (m *Manager) checkHealthAndRecreate(ctx context.Context, gateway nat.NAT) b
 		return false
 	}
 
-	pcpNAT, ok := gateway.(*pcp.NAT)
+	// Assert on the interface, not on a concrete type: a dual-stack gateway is
+	// a wrapper around the IPv4 NAT, so a type assertion misses it.
+	checker, ok := gateway.(nat.HealthChecker)
 	if !ok {
 		return false
 	}
@@ -273,7 +278,7 @@ func (m *Manager) checkHealthAndRecreate(ctx context.Context, gateway nat.NAT) b
 	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
 
-	epoch, serverRestarted, err := pcpNAT.CheckServerHealth(ctx)
+	epoch, serverRestarted, err := checker.CheckServerHealth(ctx)
 	if err != nil {
 		log.Debugf("PCP health check failed: %v", err)
 		return false
@@ -340,3 +345,18 @@ func (m *Manager) startTearDown(ctx context.Context) {
 func isPermanentLeaseRequired(err error) bool {
 	return err != nil && upnpErrPermanentLeaseOnly.MatchString(err.Error())
 }
+
+// logIPv6Pinhole reports the outcome of the IPv6 pinhole. Pinholes are best
+// effort and never fail a mapping on their own, so this is the only way to see
+// whether one was actually opened.
+func logIPv6Pinhole(gateway nat.NAT) {
+	reporter, ok := gateway.(nat.IPv6PinholeReporter)
+	if !ok {
+		return
+	}
+	if err := reporter.IPv6PinholeError(); err != nil {
+		log.Warnf("IPv6 pinhole: %v", err)
+		return
+	}
+	log.Infof("IPv6 pinhole open")
+}
diff --git a/client/internal/portforward/pcp/client.go b/client/internal/portforward/pcp/client.go
deleted file mode 100644
index f6d243ef9..000000000
--- a/client/internal/portforward/pcp/client.go
+++ /dev/null
@@ -1,408 +0,0 @@
-package pcp
-
-import (
-	"context"
-	"crypto/rand"
-	"errors"
-	"fmt"
-	"net"
-	"net/netip"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	defaultTimeout     = 3 * time.Second
-	responseBufferSize = 128
-
-	// RFC 6887 Section 8.1.1 retry timing
-	initialRetryDelay = 3 * time.Second
-	maxRetryDelay     = 1024 * time.Second
-	maxRetries        = 4 // 3s + 6s + 12s + 24s = 45s total worst case
-)
-
-// Client is a PCP protocol client.
-// All methods are safe for concurrent use.
-type Client struct {
-	gateway netip.Addr
-	timeout time.Duration
-
-	mu sync.Mutex
-	// localIP caches the resolved local IP address.
-	localIP netip.Addr
-	// lastEpoch is the last observed server epoch value.
-	lastEpoch uint32
-	// epochTime tracks when lastEpoch was received for state loss detection.
-	epochTime time.Time
-	// externalIP caches the external IP from the last successful MAP response.
-	externalIP netip.Addr
-	// epochStateLost is set when epoch indicates server restart.
-	epochStateLost bool
-}
-
-// NewClient creates a new PCP client for the gateway at the given IP.
-func NewClient(gateway net.IP) *Client {
-	addr, ok := netip.AddrFromSlice(gateway)
-	if !ok {
-		log.Debugf("invalid gateway IP: %v", gateway)
-	}
-	return &Client{
-		gateway: addr.Unmap(),
-		timeout: defaultTimeout,
-	}
-}
-
-// NewClientWithTimeout creates a new PCP client with a custom timeout.
-func NewClientWithTimeout(gateway net.IP, timeout time.Duration) *Client {
-	addr, ok := netip.AddrFromSlice(gateway)
-	if !ok {
-		log.Debugf("invalid gateway IP: %v", gateway)
-	}
-	return &Client{
-		gateway: addr.Unmap(),
-		timeout: timeout,
-	}
-}
-
-// SetLocalIP sets the local IP address to use in PCP requests.
-func (c *Client) SetLocalIP(ip net.IP) {
-	addr, ok := netip.AddrFromSlice(ip)
-	if !ok {
-		log.Debugf("invalid local IP: %v", ip)
-	}
-	c.mu.Lock()
-	c.localIP = addr.Unmap()
-	c.mu.Unlock()
-}
-
-// Gateway returns the gateway IP address.
-func (c *Client) Gateway() net.IP {
-	return c.gateway.AsSlice()
-}
-
-// Announce sends a PCP ANNOUNCE request to discover PCP support.
-// Returns the server's epoch time on success.
-func (c *Client) Announce(ctx context.Context) (epoch uint32, err error) {
-	localIP, err := c.getLocalIP()
-	if err != nil {
-		return 0, fmt.Errorf("get local IP: %w", err)
-	}
-
-	req := buildAnnounceRequest(localIP)
-	resp, err := c.sendRequest(ctx, req)
-	if err != nil {
-		return 0, fmt.Errorf("send announce: %w", err)
-	}
-
-	parsed, err := parseResponse(resp)
-	if err != nil {
-		return 0, fmt.Errorf("parse announce response: %w", err)
-	}
-
-	if parsed.ResultCode != ResultSuccess {
-		return 0, fmt.Errorf("PCP ANNOUNCE failed: %s", ResultCodeString(parsed.ResultCode))
-	}
-
-	c.mu.Lock()
-	if c.updateEpochLocked(parsed.Epoch) {
-		log.Warnf("PCP server epoch indicates state loss - mappings may need refresh")
-	}
-	c.mu.Unlock()
-	return parsed.Epoch, nil
-}
-
-// AddPortMapping requests a port mapping from the PCP server.
-func (c *Client) AddPortMapping(ctx context.Context, protocol string, internalPort int, lifetime time.Duration) (*MapResponse, error) {
-	return c.addPortMappingWithHint(ctx, protocol, internalPort, internalPort, netip.Addr{}, lifetime)
-}
-
-// AddPortMappingWithHint requests a port mapping with suggested external port and IP.
-// Use lifetime <= 0 to delete a mapping.
-func (c *Client) AddPortMappingWithHint(ctx context.Context, protocol string, internalPort, suggestedExtPort int, suggestedExtIP net.IP, lifetime time.Duration) (*MapResponse, error) {
-	var extIP netip.Addr
-	if suggestedExtIP != nil {
-		var ok bool
-		extIP, ok = netip.AddrFromSlice(suggestedExtIP)
-		if !ok {
-			log.Debugf("invalid suggested external IP: %v", suggestedExtIP)
-		}
-		extIP = extIP.Unmap()
-	}
-	return c.addPortMappingWithHint(ctx, protocol, internalPort, suggestedExtPort, extIP, lifetime)
-}
-
-func (c *Client) addPortMappingWithHint(ctx context.Context, protocol string, internalPort, suggestedExtPort int, suggestedExtIP netip.Addr, lifetime time.Duration) (*MapResponse, error) {
-	localIP, err := c.getLocalIP()
-	if err != nil {
-		return nil, fmt.Errorf("get local IP: %w", err)
-	}
-
-	proto, err := protocolNumber(protocol)
-	if err != nil {
-		return nil, fmt.Errorf("parse protocol: %w", err)
-	}
-
-	var nonce [12]byte
-	if _, err := rand.Read(nonce[:]); err != nil {
-		return nil, fmt.Errorf("generate nonce: %w", err)
-	}
-
-	// Convert lifetime to seconds. Lifetime 0 means delete, so only apply
-	// default for positive durations that round to 0 seconds.
-	var lifetimeSec uint32
-	if lifetime > 0 {
-		lifetimeSec = uint32(lifetime.Seconds())
-		if lifetimeSec == 0 {
-			lifetimeSec = DefaultLifetime
-		}
-	}
-
-	req := buildMapRequest(localIP, nonce, proto, uint16(internalPort), uint16(suggestedExtPort), suggestedExtIP, lifetimeSec)
-
-	resp, err := c.sendRequest(ctx, req)
-	if err != nil {
-		return nil, fmt.Errorf("send map request: %w", err)
-	}
-
-	mapResp, err := parseMapResponse(resp)
-	if err != nil {
-		return nil, fmt.Errorf("parse map response: %w", err)
-	}
-
-	if mapResp.Nonce != nonce {
-		return nil, fmt.Errorf("nonce mismatch in response")
-	}
-
-	if mapResp.Protocol != proto {
-		return nil, fmt.Errorf("protocol mismatch: requested %d, got %d", proto, mapResp.Protocol)
-	}
-	if mapResp.InternalPort != uint16(internalPort) {
-		return nil, fmt.Errorf("internal port mismatch: requested %d, got %d", internalPort, mapResp.InternalPort)
-	}
-
-	if mapResp.ResultCode != ResultSuccess {
-		return nil, &Error{
-			Code:    mapResp.ResultCode,
-			Message: ResultCodeString(mapResp.ResultCode),
-		}
-	}
-
-	c.mu.Lock()
-	if c.updateEpochLocked(mapResp.Epoch) {
-		log.Warnf("PCP server epoch indicates state loss - mappings may need refresh")
-	}
-	c.cacheExternalIPLocked(mapResp.ExternalIP)
-	c.mu.Unlock()
-	return mapResp, nil
-}
-
-// DeletePortMapping removes a port mapping by requesting zero lifetime.
-func (c *Client) DeletePortMapping(ctx context.Context, protocol string, internalPort int) error {
-	if _, err := c.addPortMappingWithHint(ctx, protocol, internalPort, 0, netip.Addr{}, 0); err != nil {
-		var pcpErr *Error
-		if errors.As(err, &pcpErr) && pcpErr.Code == ResultNotAuthorized {
-			return nil
-		}
-		return fmt.Errorf("delete mapping: %w", err)
-	}
-	return nil
-}
-
-// GetExternalAddress returns the external IP address.
-// First checks for a cached value from previous MAP responses.
-// If not cached, creates a short-lived mapping to discover the external IP.
-func (c *Client) GetExternalAddress(ctx context.Context) (net.IP, error) {
-	c.mu.Lock()
-	if c.externalIP.IsValid() {
-		ip := c.externalIP.AsSlice()
-		c.mu.Unlock()
-		return ip, nil
-	}
-	c.mu.Unlock()
-
-	// Use an ephemeral port in the dynamic range (49152-65535).
-	// Port 0 is not valid with UDP/TCP protocols per RFC 6887.
-	ephemeralPort := 49152 + int(uint16(time.Now().UnixNano()))%(65535-49152)
-
-	// Use minimal lifetime (1 second) for discovery.
-	resp, err := c.AddPortMapping(ctx, "udp", ephemeralPort, time.Second)
-	if err != nil {
-		return nil, fmt.Errorf("create temporary mapping: %w", err)
-	}
-
-	if err := c.DeletePortMapping(ctx, "udp", ephemeralPort); err != nil {
-		log.Debugf("cleanup temporary PCP mapping: %v", err)
-	}
-
-	return resp.ExternalIP.AsSlice(), nil
-}
-
-// LastEpoch returns the last observed server epoch value.
-// A decrease in epoch indicates the server may have restarted and mappings may be lost.
-func (c *Client) LastEpoch() uint32 {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.lastEpoch
-}
-
-// EpochStateLost returns true if epoch state loss was detected and clears the flag.
-func (c *Client) EpochStateLost() bool {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	lost := c.epochStateLost
-	c.epochStateLost = false
-	return lost
-}
-
-// updateEpoch updates the epoch tracking and detects potential state loss.
-// Returns true if state loss was detected (server likely restarted).
-// Caller must hold c.mu.
-func (c *Client) updateEpochLocked(newEpoch uint32) bool {
-	now := time.Now()
-	stateLost := false
-
-	// RFC 6887 Section 8.5: Detect invalid epoch indicating server state loss.
-	// client_delta = time since last response
-	// server_delta = epoch change since last response
-	// Invalid if: client_delta+2 < server_delta - server_delta/16
-	//         OR: server_delta+2 < client_delta - client_delta/16
-	// The +2 handles quantization, /16 (6.25%) handles clock drift.
-	if !c.epochTime.IsZero() && c.lastEpoch > 0 {
-		clientDelta := uint32(now.Sub(c.epochTime).Seconds())
-		serverDelta := newEpoch - c.lastEpoch
-
-		// Check for epoch going backwards or jumping unexpectedly.
-		// Subtraction is safe: serverDelta/16 is always <= serverDelta.
-		if clientDelta+2 < serverDelta-(serverDelta/16) ||
-			serverDelta+2 < clientDelta-(clientDelta/16) {
-			stateLost = true
-			c.epochStateLost = true
-		}
-	}
-
-	c.lastEpoch = newEpoch
-	c.epochTime = now
-	return stateLost
-}
-
-// cacheExternalIP stores the external IP from a successful MAP response.
-// Caller must hold c.mu.
-func (c *Client) cacheExternalIPLocked(ip netip.Addr) {
-	if ip.IsValid() && !ip.IsUnspecified() {
-		c.externalIP = ip
-	}
-}
-
-// sendRequest sends a PCP request with retries per RFC 6887 Section 8.1.1.
-func (c *Client) sendRequest(ctx context.Context, req []byte) ([]byte, error) {
-	addr := &net.UDPAddr{IP: c.gateway.AsSlice(), Port: Port}
-
-	var lastErr error
-	delay := initialRetryDelay
-
-	for range maxRetries {
-		resp, err := c.sendOnce(ctx, addr, req)
-		if err == nil {
-			return resp, nil
-		}
-		lastErr = err
-
-		if ctx.Err() != nil {
-			return nil, ctx.Err()
-		}
-
-		// RFC 6887 Section 8.1.1: RT = (1 + RAND) * MIN(2 * RTprev, MRT)
-		// RAND is random between -0.1 and +0.1
-		select {
-		case <-ctx.Done():
-			return nil, ctx.Err()
-		case <-time.After(retryDelayWithJitter(delay)):
-		}
-		delay = min(delay*2, maxRetryDelay)
-	}
-
-	return nil, fmt.Errorf("PCP request failed after %d retries: %w", maxRetries, lastErr)
-}
-
-// retryDelayWithJitter applies RFC 6887 jitter: multiply by (1 + RAND) where RAND is [-0.1, +0.1].
-func retryDelayWithJitter(d time.Duration) time.Duration {
-	var b [1]byte
-	_, _ = rand.Read(b[:])
-	// Convert byte to range [-0.1, +0.1]: (b/255 * 0.2) - 0.1
-	jitter := (float64(b[0])/255.0)*0.2 - 0.1
-	return time.Duration(float64(d) * (1 + jitter))
-}
-
-func (c *Client) sendOnce(ctx context.Context, addr *net.UDPAddr, req []byte) ([]byte, error) {
-	// Use ListenUDP instead of DialUDP to validate response source address per RFC 6887 §8.3.
-	conn, err := net.ListenUDP("udp", nil)
-	if err != nil {
-		return nil, fmt.Errorf("listen: %w", err)
-	}
-	defer func() {
-		if err := conn.Close(); err != nil {
-			log.Debugf("close UDP connection: %v", err)
-		}
-	}()
-
-	timeout := c.timeout
-	if deadline, ok := ctx.Deadline(); ok {
-		if remaining := time.Until(deadline); remaining < timeout {
-			timeout = remaining
-		}
-	}
-
-	if err := conn.SetDeadline(time.Now().Add(timeout)); err != nil {
-		return nil, fmt.Errorf("set deadline: %w", err)
-	}
-
-	if _, err := conn.WriteToUDP(req, addr); err != nil {
-		return nil, fmt.Errorf("write: %w", err)
-	}
-
-	resp := make([]byte, responseBufferSize)
-	n, from, err := conn.ReadFromUDP(resp)
-	if err != nil {
-		return nil, fmt.Errorf("read: %w", err)
-	}
-
-	// RFC 6887 §8.3: Validate response came from expected PCP server.
-	if !from.IP.Equal(addr.IP) {
-		return nil, fmt.Errorf("response from unexpected source %s (expected %s)", from.IP, addr.IP)
-	}
-
-	return resp[:n], nil
-}
-
-func (c *Client) getLocalIP() (netip.Addr, error) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if !c.localIP.IsValid() {
-		return netip.Addr{}, fmt.Errorf("local IP not set for gateway %s", c.gateway)
-	}
-	return c.localIP, nil
-}
-
-func protocolNumber(protocol string) (uint8, error) {
-	switch protocol {
-	case "udp", "UDP":
-		return ProtoUDP, nil
-	case "tcp", "TCP":
-		return ProtoTCP, nil
-	default:
-		return 0, fmt.Errorf("unsupported protocol: %s", protocol)
-	}
-}
-
-// Error represents a PCP error response.
-type Error struct {
-	Code    uint8
-	Message string
-}
-
-func (e *Error) Error() string {
-	return fmt.Sprintf("PCP error: %s (%d)", e.Message, e.Code)
-}
diff --git a/client/internal/portforward/pcp/client_test.go b/client/internal/portforward/pcp/client_test.go
deleted file mode 100644
index 79f44a426..000000000
--- a/client/internal/portforward/pcp/client_test.go
+++ /dev/null
@@ -1,187 +0,0 @@
-package pcp
-
-import (
-	"context"
-	"net"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestAddrConversion(t *testing.T) {
-	tests := []struct {
-		name string
-		addr netip.Addr
-	}{
-		{"IPv4", netip.MustParseAddr("192.168.1.100")},
-		{"IPv4 loopback", netip.MustParseAddr("127.0.0.1")},
-		{"IPv6", netip.MustParseAddr("2001:db8::1")},
-		{"IPv6 loopback", netip.MustParseAddr("::1")},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			b16 := addrTo16(tt.addr)
-
-			recovered := addrFrom16(b16)
-			assert.Equal(t, tt.addr, recovered, "address should round-trip")
-		})
-	}
-}
-
-func TestBuildAnnounceRequest(t *testing.T) {
-	clientIP := netip.MustParseAddr("192.168.1.100")
-	req := buildAnnounceRequest(clientIP)
-
-	require.Len(t, req, headerSize)
-	assert.Equal(t, byte(Version), req[0], "version")
-	assert.Equal(t, byte(OpAnnounce), req[1], "opcode")
-
-	// Check client IP is properly encoded as IPv4-mapped IPv6
-	assert.Equal(t, byte(0xff), req[18], "IPv4-mapped prefix byte 10")
-	assert.Equal(t, byte(0xff), req[19], "IPv4-mapped prefix byte 11")
-	assert.Equal(t, byte(192), req[20], "IP octet 1")
-	assert.Equal(t, byte(168), req[21], "IP octet 2")
-	assert.Equal(t, byte(1), req[22], "IP octet 3")
-	assert.Equal(t, byte(100), req[23], "IP octet 4")
-}
-
-func TestBuildMapRequest(t *testing.T) {
-	clientIP := netip.MustParseAddr("192.168.1.100")
-	nonce := [12]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12}
-	req := buildMapRequest(clientIP, nonce, ProtoUDP, 51820, 51820, netip.Addr{}, 3600)
-
-	require.Len(t, req, mapRequestSize)
-	assert.Equal(t, byte(Version), req[0], "version")
-	assert.Equal(t, byte(OpMap), req[1], "opcode")
-
-	// Lifetime at bytes 4-7
-	assert.Equal(t, uint32(3600), (uint32(req[4])<<24)|(uint32(req[5])<<16)|(uint32(req[6])<<8)|uint32(req[7]), "lifetime")
-
-	// Nonce at bytes 24-35
-	assert.Equal(t, nonce[:], req[24:36], "nonce")
-
-	// Protocol at byte 36
-	assert.Equal(t, byte(ProtoUDP), req[36], "protocol")
-
-	// Internal port at bytes 40-41
-	assert.Equal(t, uint16(51820), (uint16(req[40])<<8)|uint16(req[41]), "internal port")
-
-	// External port at bytes 42-43
-	assert.Equal(t, uint16(51820), (uint16(req[42])<<8)|uint16(req[43]), "external port")
-}
-
-func TestParseResponse(t *testing.T) {
-	// Construct a valid ANNOUNCE response
-	resp := make([]byte, headerSize)
-	resp[0] = Version
-	resp[1] = OpAnnounce | OpReply
-	// Result code = 0 (success)
-	// Lifetime = 0
-	// Epoch = 12345
-	resp[8] = 0
-	resp[9] = 0
-	resp[10] = 0x30
-	resp[11] = 0x39
-
-	parsed, err := parseResponse(resp)
-	require.NoError(t, err)
-	assert.Equal(t, uint8(Version), parsed.Version)
-	assert.Equal(t, uint8(OpAnnounce|OpReply), parsed.Opcode)
-	assert.Equal(t, uint8(ResultSuccess), parsed.ResultCode)
-	assert.Equal(t, uint32(12345), parsed.Epoch)
-}
-
-func TestParseResponseErrors(t *testing.T) {
-	t.Run("too short", func(t *testing.T) {
-		_, err := parseResponse([]byte{1, 2, 3})
-		assert.Error(t, err)
-	})
-
-	t.Run("wrong version", func(t *testing.T) {
-		resp := make([]byte, headerSize)
-		resp[0] = 1 // Wrong version
-		resp[1] = OpReply
-		_, err := parseResponse(resp)
-		assert.Error(t, err)
-	})
-
-	t.Run("missing reply bit", func(t *testing.T) {
-		resp := make([]byte, headerSize)
-		resp[0] = Version
-		resp[1] = OpAnnounce // Missing OpReply bit
-		_, err := parseResponse(resp)
-		assert.Error(t, err)
-	})
-}
-
-func TestResultCodeString(t *testing.T) {
-	assert.Equal(t, "SUCCESS", ResultCodeString(ResultSuccess))
-	assert.Equal(t, "NOT_AUTHORIZED", ResultCodeString(ResultNotAuthorized))
-	assert.Equal(t, "ADDRESS_MISMATCH", ResultCodeString(ResultAddressMismatch))
-	assert.Contains(t, ResultCodeString(255), "UNKNOWN")
-}
-
-func TestProtocolNumber(t *testing.T) {
-	proto, err := protocolNumber("udp")
-	require.NoError(t, err)
-	assert.Equal(t, uint8(ProtoUDP), proto)
-
-	proto, err = protocolNumber("tcp")
-	require.NoError(t, err)
-	assert.Equal(t, uint8(ProtoTCP), proto)
-
-	proto, err = protocolNumber("UDP")
-	require.NoError(t, err)
-	assert.Equal(t, uint8(ProtoUDP), proto)
-
-	_, err = protocolNumber("icmp")
-	assert.Error(t, err)
-}
-
-func TestClientCreation(t *testing.T) {
-	gateway := netip.MustParseAddr("192.168.1.1").AsSlice()
-
-	client := NewClient(gateway)
-	assert.Equal(t, net.IP(gateway), client.Gateway())
-	assert.Equal(t, defaultTimeout, client.timeout)
-
-	clientWithTimeout := NewClientWithTimeout(gateway, 5*time.Second)
-	assert.Equal(t, 5*time.Second, clientWithTimeout.timeout)
-}
-
-func TestNATType(t *testing.T) {
-	n := NewNAT(netip.MustParseAddr("192.168.1.1").AsSlice(), netip.MustParseAddr("192.168.1.100").AsSlice())
-	assert.Equal(t, "PCP", n.Type())
-}
-
-// Integration test - skipped unless PCP_TEST_GATEWAY env is set
-func TestClientIntegration(t *testing.T) {
-	t.Skip("Integration test - run manually with PCP_TEST_GATEWAY=<gateway-ip>")
-
-	gateway := netip.MustParseAddr("10.0.1.1").AsSlice()   // Change to your test gateway
-	localIP := netip.MustParseAddr("10.0.1.100").AsSlice() // Change to your local IP
-
-	client := NewClient(gateway)
-	client.SetLocalIP(localIP)
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Test ANNOUNCE
-	epoch, err := client.Announce(ctx)
-	require.NoError(t, err)
-	t.Logf("Server epoch: %d", epoch)
-
-	// Test MAP
-	resp, err := client.AddPortMapping(ctx, "udp", 51820, 1*time.Hour)
-	require.NoError(t, err)
-	t.Logf("Mapping: internal=%d external=%d externalIP=%s",
-		resp.InternalPort, resp.ExternalPort, resp.ExternalIP)
-
-	// Cleanup
-	err = client.DeletePortMapping(ctx, "udp", 51820)
-	require.NoError(t, err)
-}
diff --git a/client/internal/portforward/pcp/nat.go b/client/internal/portforward/pcp/nat.go
deleted file mode 100644
index 0e635b6c8..000000000
--- a/client/internal/portforward/pcp/nat.go
+++ /dev/null
@@ -1,222 +0,0 @@
-package pcp
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/netip"
-	"runtime"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/libp2p/go-nat"
-	"github.com/libp2p/go-netroute"
-)
-
-var _ nat.NAT = (*NAT)(nil)
-
-// NAT implements the go-nat NAT interface using PCP.
-// Supports dual-stack (IPv4 and IPv6) when available.
-// All methods are safe for concurrent use.
-//
-// TODO: IPv6 pinholes use the local IPv6 address. If the address changes
-// (e.g., due to SLAAC rotation or network change), the pinhole becomes stale
-// and needs to be recreated with the new address.
-type NAT struct {
-	client *Client
-
-	mu sync.RWMutex
-	// client6 is the IPv6 PCP client, nil if IPv6 is unavailable.
-	client6 *Client
-	// localIP6 caches the local IPv6 address used for PCP requests.
-	localIP6 netip.Addr
-}
-
-// NewNAT creates a new NAT instance backed by PCP.
-func NewNAT(gateway, localIP net.IP) *NAT {
-	client := NewClient(gateway)
-	client.SetLocalIP(localIP)
-	return &NAT{
-		client: client,
-	}
-}
-
-// Type returns "PCP" as the NAT type.
-func (n *NAT) Type() string {
-	return "PCP"
-}
-
-// GetDeviceAddress returns the gateway IP address.
-func (n *NAT) GetDeviceAddress() (net.IP, error) {
-	return n.client.Gateway(), nil
-}
-
-// GetExternalAddress returns the external IP address.
-func (n *NAT) GetExternalAddress() (net.IP, error) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	return n.client.GetExternalAddress(ctx)
-}
-
-// GetInternalAddress returns the local IP address used to communicate with the gateway.
-func (n *NAT) GetInternalAddress() (net.IP, error) {
-	addr, err := n.client.getLocalIP()
-	if err != nil {
-		return nil, err
-	}
-	return addr.AsSlice(), nil
-}
-
-// AddPortMapping creates a port mapping on both IPv4 and IPv6 (if available).
-func (n *NAT) AddPortMapping(ctx context.Context, protocol string, internalPort int, _ string, timeout time.Duration) (int, error) {
-	resp, err := n.client.AddPortMapping(ctx, protocol, internalPort, timeout)
-	if err != nil {
-		return 0, fmt.Errorf("add mapping: %w", err)
-	}
-
-	n.mu.RLock()
-	client6 := n.client6
-	localIP6 := n.localIP6
-	n.mu.RUnlock()
-
-	if client6 == nil {
-		return int(resp.ExternalPort), nil
-	}
-
-	if _, err := client6.AddPortMapping(ctx, protocol, internalPort, timeout); err != nil {
-		log.Warnf("IPv6 PCP mapping failed (continuing with IPv4): %v", err)
-		return int(resp.ExternalPort), nil
-	}
-
-	log.Infof("created IPv6 PCP pinhole: %s:%d", localIP6, internalPort)
-	return int(resp.ExternalPort), nil
-}
-
-// DeletePortMapping removes a port mapping from both IPv4 and IPv6.
-func (n *NAT) DeletePortMapping(ctx context.Context, protocol string, internalPort int) error {
-	err := n.client.DeletePortMapping(ctx, protocol, internalPort)
-
-	n.mu.RLock()
-	client6 := n.client6
-	n.mu.RUnlock()
-
-	if client6 != nil {
-		if err6 := client6.DeletePortMapping(ctx, protocol, internalPort); err6 != nil {
-			log.Warnf("IPv6 PCP delete mapping failed: %v", err6)
-		}
-	}
-
-	if err != nil {
-		return fmt.Errorf("delete mapping: %w", err)
-	}
-	return nil
-}
-
-// CheckServerHealth sends an ANNOUNCE to verify the server is still responsive.
-// Returns the current epoch and whether the server may have restarted (epoch state loss detected).
-func (n *NAT) CheckServerHealth(ctx context.Context) (epoch uint32, serverRestarted bool, err error) {
-	epoch, err = n.client.Announce(ctx)
-	if err != nil {
-		return 0, false, fmt.Errorf("announce: %w", err)
-	}
-	return epoch, n.client.EpochStateLost(), nil
-}
-
-// DiscoverPCP attempts to discover a PCP-capable gateway.
-// Returns a NAT interface if PCP is supported, or an error otherwise.
-// Discovers both IPv4 and IPv6 gateways when available.
-func DiscoverPCP(ctx context.Context) (nat.NAT, error) {
-	gateway, localIP, err := getDefaultGateway()
-	if err != nil {
-		return nil, fmt.Errorf("get default gateway: %w", err)
-	}
-
-	client := NewClient(gateway)
-	client.SetLocalIP(localIP)
-	if _, err := client.Announce(ctx); err != nil {
-		return nil, fmt.Errorf("PCP announce: %w", err)
-	}
-
-	result := &NAT{client: client}
-	discoverIPv6(ctx, result)
-
-	return result, nil
-}
-
-func discoverIPv6(ctx context.Context, result *NAT) {
-	gateway6, localIP6, err := getDefaultGateway6()
-	if err != nil {
-		log.Debugf("IPv6 gateway discovery failed: %v", err)
-		return
-	}
-
-	client6 := NewClient(gateway6)
-	client6.SetLocalIP(localIP6)
-	if _, err := client6.Announce(ctx); err != nil {
-		log.Debugf("PCP IPv6 announce failed: %v", err)
-		return
-	}
-
-	addr, ok := netip.AddrFromSlice(localIP6)
-	if !ok {
-		log.Debugf("invalid IPv6 local IP: %v", localIP6)
-		return
-	}
-	result.mu.Lock()
-	result.client6 = client6
-	result.localIP6 = addr
-	result.mu.Unlock()
-	log.Debugf("PCP IPv6 gateway discovered: %s (local: %s)", gateway6, localIP6)
-}
-
-// getDefaultGateway returns the default IPv4 gateway and local IP using the system routing table.
-func getDefaultGateway() (gateway net.IP, localIP net.IP, err error) {
-	router, err := netroute.New()
-	if err != nil {
-		return nil, nil, err
-	}
-
-	dst := net.IPv4zero
-	if runtime.GOOS == "linux" || runtime.GOOS == "android" {
-		// go-netroute v0.4.0 rejects unspecified destinations client-side on Linux/Android.
-		// TODO: on android/ios, use platform APIs (ConnectivityManager.getLinkProperties /
-		// NWPathMonitor) when netlink-based lookup is restricted or unavailable.
-		dst = net.IPv4(0, 0, 0, 1)
-	}
-	_, gateway, localIP, err = router.Route(dst)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	if gateway == nil {
-		return nil, nil, nat.ErrNoNATFound
-	}
-
-	return gateway, localIP, nil
-}
-
-// getDefaultGateway6 returns the default IPv6 gateway IP address using the system routing table.
-func getDefaultGateway6() (gateway net.IP, localIP net.IP, err error) {
-	router, err := netroute.New()
-	if err != nil {
-		return nil, nil, err
-	}
-
-	dst := net.IPv6zero
-	if runtime.GOOS == "linux" || runtime.GOOS == "android" {
-		// ::2
-		dst = net.IP{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}
-	}
-	_, gateway, localIP, err = router.Route(dst)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	if gateway == nil {
-		return nil, nil, nat.ErrNoNATFound
-	}
-
-	return gateway, localIP, nil
-}
diff --git a/client/internal/portforward/pcp/protocol.go b/client/internal/portforward/pcp/protocol.go
deleted file mode 100644
index d81c50c8c..000000000
--- a/client/internal/portforward/pcp/protocol.go
+++ /dev/null
@@ -1,225 +0,0 @@
-// Package pcp implements the Port Control Protocol (RFC 6887).
-//
-// # Implemented Features
-//
-//   - ANNOUNCE opcode: Discovers PCP server support
-//   - MAP opcode: Creates/deletes port mappings (IPv4 NAT) and firewall pinholes (IPv6)
-//   - Dual-stack: Simultaneous IPv4 and IPv6 support via separate clients
-//   - Nonce validation: Prevents response spoofing
-//   - Epoch tracking: Detects server restarts per Section 8.5
-//   - RFC-compliant retry timing: 3s initial, exponential backoff to 1024s max (Section 8.1.1)
-//
-// # Not Implemented
-//
-//   - PEER opcode: For outbound peer connections (not needed for inbound NAT traversal)
-//   - THIRD_PARTY option: For managing mappings on behalf of other devices
-//   - PREFER_FAILURE option: Requires exact external port or fail (IPv4 NAT only, not needed for IPv6 pinholing)
-//   - FILTER option: To restrict remote peer addresses
-//
-// These optional features are omitted because the primary use case is simple
-// port forwarding for WireGuard, which only requires MAP with default behavior.
-package pcp
-
-import (
-	"encoding/binary"
-	"fmt"
-	"net/netip"
-)
-
-const (
-	// Version is the PCP protocol version (RFC 6887).
-	Version = 2
-
-	// Port is the standard PCP server port.
-	Port = 5351
-
-	// DefaultLifetime is the default requested mapping lifetime in seconds.
-	DefaultLifetime = 7200 // 2 hours
-
-	// Header sizes
-	headerSize     = 24
-	mapPayloadSize = 36
-	mapRequestSize = headerSize + mapPayloadSize // 60 bytes
-)
-
-// Opcodes
-const (
-	OpAnnounce = 0
-	OpMap      = 1
-	OpPeer     = 2
-	OpReply    = 0x80 // OR'd with opcode in responses
-)
-
-// Protocol numbers for MAP requests
-const (
-	ProtoUDP = 17
-	ProtoTCP = 6
-)
-
-// Result codes (RFC 6887 Section 7.4)
-const (
-	ResultSuccess              = 0
-	ResultUnsuppVersion        = 1
-	ResultNotAuthorized        = 2
-	ResultMalformedRequest     = 3
-	ResultUnsuppOpcode         = 4
-	ResultUnsuppOption         = 5
-	ResultMalformedOption      = 6
-	ResultNetworkFailure       = 7
-	ResultNoResources          = 8
-	ResultUnsuppProtocol       = 9
-	ResultUserExQuota          = 10
-	ResultCannotProvideExt     = 11
-	ResultAddressMismatch      = 12
-	ResultExcessiveRemotePeers = 13
-)
-
-// ResultCodeString returns a human-readable string for a result code.
-func ResultCodeString(code uint8) string {
-	switch code {
-	case ResultSuccess:
-		return "SUCCESS"
-	case ResultUnsuppVersion:
-		return "UNSUPP_VERSION"
-	case ResultNotAuthorized:
-		return "NOT_AUTHORIZED"
-	case ResultMalformedRequest:
-		return "MALFORMED_REQUEST"
-	case ResultUnsuppOpcode:
-		return "UNSUPP_OPCODE"
-	case ResultUnsuppOption:
-		return "UNSUPP_OPTION"
-	case ResultMalformedOption:
-		return "MALFORMED_OPTION"
-	case ResultNetworkFailure:
-		return "NETWORK_FAILURE"
-	case ResultNoResources:
-		return "NO_RESOURCES"
-	case ResultUnsuppProtocol:
-		return "UNSUPP_PROTOCOL"
-	case ResultUserExQuota:
-		return "USER_EX_QUOTA"
-	case ResultCannotProvideExt:
-		return "CANNOT_PROVIDE_EXTERNAL"
-	case ResultAddressMismatch:
-		return "ADDRESS_MISMATCH"
-	case ResultExcessiveRemotePeers:
-		return "EXCESSIVE_REMOTE_PEERS"
-	default:
-		return fmt.Sprintf("UNKNOWN(%d)", code)
-	}
-}
-
-// Response represents a parsed PCP response header.
-type Response struct {
-	Version    uint8
-	Opcode     uint8
-	ResultCode uint8
-	Lifetime   uint32
-	Epoch      uint32
-}
-
-// MapResponse contains the full response to a MAP request.
-type MapResponse struct {
-	Response
-	Nonce        [12]byte
-	Protocol     uint8
-	InternalPort uint16
-	ExternalPort uint16
-	ExternalIP   netip.Addr
-}
-
-// addrTo16 converts an address to its 16-byte IPv4-mapped IPv6 representation.
-func addrTo16(addr netip.Addr) [16]byte {
-	if addr.Is4() {
-		return netip.AddrFrom4(addr.As4()).As16()
-	}
-	return addr.As16()
-}
-
-// addrFrom16 extracts an address from a 16-byte representation, unmapping IPv4.
-func addrFrom16(b [16]byte) netip.Addr {
-	return netip.AddrFrom16(b).Unmap()
-}
-
-// buildAnnounceRequest creates a PCP ANNOUNCE request packet.
-func buildAnnounceRequest(clientIP netip.Addr) []byte {
-	req := make([]byte, headerSize)
-	req[0] = Version
-	req[1] = OpAnnounce
-	mapped := addrTo16(clientIP)
-	copy(req[8:24], mapped[:])
-	return req
-}
-
-// buildMapRequest creates a PCP MAP request packet.
-func buildMapRequest(clientIP netip.Addr, nonce [12]byte, protocol uint8, internalPort, suggestedExtPort uint16, suggestedExtIP netip.Addr, lifetime uint32) []byte {
-	req := make([]byte, mapRequestSize)
-
-	// Header
-	req[0] = Version
-	req[1] = OpMap
-	binary.BigEndian.PutUint32(req[4:8], lifetime)
-	mapped := addrTo16(clientIP)
-	copy(req[8:24], mapped[:])
-
-	// MAP payload
-	copy(req[24:36], nonce[:])
-	req[36] = protocol
-	binary.BigEndian.PutUint16(req[40:42], internalPort)
-	binary.BigEndian.PutUint16(req[42:44], suggestedExtPort)
-	if suggestedExtIP.IsValid() {
-		extMapped := addrTo16(suggestedExtIP)
-		copy(req[44:60], extMapped[:])
-	}
-
-	return req
-}
-
-// parseResponse parses the common PCP response header.
-func parseResponse(data []byte) (*Response, error) {
-	if len(data) < headerSize {
-		return nil, fmt.Errorf("response too short: %d bytes", len(data))
-	}
-
-	resp := &Response{
-		Version:    data[0],
-		Opcode:     data[1],
-		ResultCode: data[3], // Byte 2 is reserved, byte 3 is result code (RFC 6887 §7.2)
-		Lifetime:   binary.BigEndian.Uint32(data[4:8]),
-		Epoch:      binary.BigEndian.Uint32(data[8:12]),
-	}
-
-	if resp.Version != Version {
-		return nil, fmt.Errorf("unsupported PCP version: %d", resp.Version)
-	}
-
-	if resp.Opcode&OpReply == 0 {
-		return nil, fmt.Errorf("response missing reply bit: opcode=0x%02x", resp.Opcode)
-	}
-
-	return resp, nil
-}
-
-// parseMapResponse parses a complete MAP response.
-func parseMapResponse(data []byte) (*MapResponse, error) {
-	if len(data) < mapRequestSize {
-		return nil, fmt.Errorf("MAP response too short: %d bytes", len(data))
-	}
-
-	resp, err := parseResponse(data)
-	if err != nil {
-		return nil, fmt.Errorf("parse header: %w", err)
-	}
-
-	mapResp := &MapResponse{
-		Response:     *resp,
-		Protocol:     data[36],
-		InternalPort: binary.BigEndian.Uint16(data[40:42]),
-		ExternalPort: binary.BigEndian.Uint16(data[42:44]),
-		ExternalIP:   addrFrom16([16]byte(data[44:60])),
-	}
-	copy(mapResp.Nonce[:], data[24:36])
-
-	return mapResp, nil
-}
diff --git a/client/internal/portforward/pinhole_test.go b/client/internal/portforward/pinhole_test.go
new file mode 100644
index 000000000..46b07a9e7
--- /dev/null
+++ b/client/internal/portforward/pinhole_test.go
@@ -0,0 +1,116 @@
+//go:build !js
+
+package portforward
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/netbirdio/go-nat"
+	log "github.com/sirupsen/logrus"
+	"github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// mockPinholeNAT is a gateway that also reports an IPv6 pinhole outcome, the
+// shape a dual-stack gateway has.
+type mockPinholeNAT struct {
+	*mockNAT
+	pinholeErr error
+}
+
+func (m *mockPinholeNAT) IPv6PinholeError() error {
+	return m.pinholeErr
+}
+
+func TestSetupLogsPinholeOutcome(t *testing.T) {
+	pinholeErr := errors.New("pcp ipv6: NOT_AUTHORIZED")
+
+	tests := []struct {
+		name       string
+		pinholeErr error
+		mappingErr error
+		wantLevel  log.Level
+		wantText   string
+	}{
+		{
+			name:      "an open pinhole is reported",
+			wantLevel: log.InfoLevel,
+			wantText:  "IPv6 pinhole open",
+		},
+		{
+			name: "a failed pinhole is reported without failing the mapping",
+			// The IPv4 mapping is what the caller asked for, so the pinhole
+			// failure surfaces only in the log.
+			pinholeErr: pinholeErr,
+			wantLevel:  log.WarnLevel,
+			wantText:   pinholeErr.Error(),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gateway := &mockPinholeNAT{mockNAT: newMockNAT(), pinholeErr: tt.pinholeErr}
+			hook := stubGatewayDiscovery(t, gateway)
+
+			m := NewManager()
+			m.wgPort = 51820
+
+			_, mapping, err := m.setup(context.Background())
+
+			require.NoError(t, err)
+			require.NotNil(t, mapping)
+
+			entry := findEntry(hook, tt.wantText)
+			require.NotNil(t, entry, "no log entry mentioning %q", tt.wantText)
+			assert.Equal(t, tt.wantLevel, entry.Level)
+		})
+	}
+
+	t.Run("a failed mapping reports no pinhole outcome", func(t *testing.T) {
+		// Nothing opened the pinhole, so whatever it currently reports says
+		// nothing about this attempt.
+		gateway := &mockPinholeNAT{mockNAT: newMockNAT()}
+		gateway.addMappingErr = errors.New("gateway refused")
+		hook := stubGatewayDiscovery(t, gateway)
+
+		m := NewManager()
+		m.wgPort = 51820
+
+		_, _, err := m.setup(context.Background())
+
+		require.Error(t, err)
+		assert.Nil(t, findEntry(hook, "IPv6 pinhole"))
+	})
+}
+
+// stubGatewayDiscovery makes discovery return gateway and captures log output.
+func stubGatewayDiscovery(t *testing.T, gateway nat.NAT) *test.Hook {
+	t.Helper()
+
+	orig := discoverGateway
+	discoverGateway = func(context.Context) (nat.NAT, error) { return gateway, nil }
+	t.Cleanup(func() { discoverGateway = orig })
+
+	hook := test.NewGlobal()
+	origLevel := log.GetLevel()
+	log.SetLevel(log.DebugLevel)
+	t.Cleanup(func() {
+		hook.Reset()
+		log.SetLevel(origLevel)
+	})
+
+	return hook
+}
+
+func findEntry(hook *test.Hook, substr string) *log.Entry {
+	for _, entry := range hook.AllEntries() {
+		if strings.Contains(entry.Message, substr) {
+			return entry
+		}
+	}
+	return nil
+}
diff --git a/client/internal/portforward/state.go b/client/internal/portforward/state.go
index b1315cdc0..a21368e58 100644
--- a/client/internal/portforward/state.go
+++ b/client/internal/portforward/state.go
@@ -4,27 +4,94 @@ package portforward
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"time"
 
-	"github.com/libp2p/go-nat"
+	"github.com/netbirdio/go-nat"
+	"github.com/netbirdio/go-nat/pcp"
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/portforward/pcp"
 )
 
 // discoverGateway is the function used for NAT gateway discovery.
 // It can be replaced in tests to avoid real network operations.
-// Tries PCP first, then falls back to NAT-PMP/UPnP.
 var discoverGateway = defaultDiscoverGateway
 
-func defaultDiscoverGateway(ctx context.Context) (nat.NAT, error) {
-	pcpGateway, err := pcp.DiscoverPCP(ctx)
-	if err == nil {
-		return pcpGateway, nil
-	}
-	log.Debugf("PCP discovery failed: %v, trying NAT-PMP/UPnP", err)
+// pinholeDiscoveryTimeout is the slice of the discovery budget held back for
+// the IPv6 pinhole probe.
+//
+// Sizing it is coarser than it looks: PCP retransmits on a 3s socket timeout
+// and a 3s first backoff, so a second attempt needs about 9s. Anything from
+// roughly 1s to 8s therefore buys exactly one attempt, and this only sets how
+// long that attempt waits. A PCP server sits on the local link and answers in
+// milliseconds, so 3s is margin rather than need, and the rest is left to
+// gateway discovery, whose multicast SSDP search alone takes 5s. A probe lost
+// to a dropped packet is retried by the next discovery round.
+//
+// It is a variable so tests can shorten it.
+var pinholeDiscoveryTimeout = 3 * time.Second
 
-	return nat.DiscoverGateway(ctx)
+// Discovery entry points, as variables so tests can drive the fallback without
+// touching the network.
+var (
+	discoverNATGateway = nat.DiscoverGateway
+
+	discoverPCPPinhole = func(ctx context.Context) (nat.NAT, error) {
+		pinhole, err := pcp.DiscoverPCP(ctx)
+		if err != nil {
+			return nil, err
+		}
+		return pinhole, nil
+	}
+)
+
+// defaultDiscoverGateway finds a gateway that can make the WireGuard port
+// reachable. DiscoverGateway prefers PCP for IPv4, races UPnP and NAT-PMP
+// behind it, and attaches an IPv6 pinhole independently of which IPv4 protocol
+// wins.
+//
+// It reports no gateway on a network offering only IPv6, having no IPv4 mapping
+// to attach a pinhole to. Such a network still needs one: there is no
+// translation to traverse, but the router drops inbound IPv6 until something
+// opens it. Fall back to PCP alone, which yields a gateway holding just the
+// pinhole.
+func defaultDiscoverGateway(ctx context.Context) (nat.NAT, error) {
+	gatewayCtx, cancel := reserveForPinhole(ctx)
+	defer cancel()
+
+	gateway, err := discoverNATGateway(gatewayCtx)
+	if err == nil {
+		return gateway, nil
+	}
+	if !errors.Is(err, nat.ErrNoNATFound) {
+		return nil, err
+	}
+
+	pinhole, pinholeErr := discoverPCPPinhole(ctx)
+	if pinholeErr != nil {
+		log.Debugf("no IPv6 pinhole after %v: %v", err, pinholeErr)
+		return nil, err
+	}
+
+	log.Infof("no IPv4 gateway, continuing with an IPv6 pinhole only")
+	return pinhole, nil
+}
+
+// reserveForPinhole shortens ctx so that a pinhole probe still has time to run
+// afterwards. Finding nothing takes gateway discovery everything it is given,
+// so on the unshortened context the probe would start already expired. A budget
+// too small to divide is left to gateway discovery, which is the likelier win.
+func reserveForPinhole(ctx context.Context) (context.Context, context.CancelFunc) {
+	deadline, ok := ctx.Deadline()
+	if !ok {
+		return context.WithCancel(ctx)
+	}
+
+	remaining := time.Until(deadline)
+	if remaining <= pinholeDiscoveryTimeout {
+		return context.WithCancel(ctx)
+	}
+	return context.WithTimeout(ctx, remaining-pinholeDiscoveryTimeout)
 }
 
 // State is persisted only for crash recovery cleanup
diff --git a/client/internal/portforward/state_test.go b/client/internal/portforward/state_test.go
new file mode 100644
index 000000000..8a584eecb
--- /dev/null
+++ b/client/internal/portforward/state_test.go
@@ -0,0 +1,140 @@
+//go:build !js
+
+package portforward
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/netbirdio/go-nat"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// stubDiscovery replaces both discovery entry points for the duration of a
+// test. gatewayDelay simulates gateway discovery spending everything it is
+// given before reporting that it found nothing.
+func stubDiscovery(t *testing.T, gateway nat.NAT, gatewayErr error, gatewayDelay time.Duration, pinhole nat.NAT, pinholeErr error) {
+	t.Helper()
+
+	origGateway, origPinhole := discoverNATGateway, discoverPCPPinhole
+	discoverNATGateway = func(ctx context.Context) (nat.NAT, error) {
+		if gatewayDelay > 0 {
+			select {
+			case <-time.After(gatewayDelay):
+			case <-ctx.Done():
+			}
+		}
+		return gateway, gatewayErr
+	}
+	discoverPCPPinhole = func(ctx context.Context) (nat.NAT, error) {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		return pinhole, pinholeErr
+	}
+
+	t.Cleanup(func() { discoverNATGateway, discoverPCPPinhole = origGateway, origPinhole })
+}
+
+func TestDefaultDiscoverGateway(t *testing.T) {
+	ipv4Gateway := &mockNAT{natType: "PCP+PCPv6"}
+	ipv6Pinhole := &mockNAT{natType: "PCP"}
+	otherErr := errors.New("routing table unavailable")
+
+	t.Run("an IPv4 gateway is used as is", func(t *testing.T) {
+		stubDiscovery(t, ipv4Gateway, nil, 0, ipv6Pinhole, nil)
+
+		got, err := defaultDiscoverGateway(context.Background())
+
+		require.NoError(t, err)
+		assert.Same(t, ipv4Gateway, got)
+	})
+
+	t.Run("no IPv4 gateway still opens an IPv6 pinhole", func(t *testing.T) {
+		stubDiscovery(t, nil, nat.ErrNoNATFound, 0, ipv6Pinhole, nil)
+
+		got, err := defaultDiscoverGateway(context.Background())
+
+		require.NoError(t, err)
+		assert.Same(t, ipv6Pinhole, got)
+	})
+
+	t.Run("no gateway and no pinhole reports the original failure", func(t *testing.T) {
+		stubDiscovery(t, nil, nat.ErrNoNATFound, 0, nil, errors.New("no IPv6 route"))
+
+		got, err := defaultDiscoverGateway(context.Background())
+
+		assert.Nil(t, got)
+		assert.ErrorIs(t, err, nat.ErrNoNATFound, "the pinhole failure must not mask why no gateway was found")
+	})
+
+	t.Run("a failure other than no-gateway is reported as is", func(t *testing.T) {
+		stubDiscovery(t, nil, otherErr, 0, ipv6Pinhole, nil)
+
+		got, err := defaultDiscoverGateway(context.Background())
+
+		assert.Nil(t, got)
+		assert.ErrorIs(t, err, otherErr)
+	})
+
+	t.Run("the pinhole survives gateway discovery using its whole budget", func(t *testing.T) {
+		// On one shared context the probe would start already expired, which is
+		// how this failed against a real gateway.
+		reserve := 50 * time.Millisecond
+		origReserve := pinholeDiscoveryTimeout
+		pinholeDiscoveryTimeout = reserve
+		t.Cleanup(func() { pinholeDiscoveryTimeout = origReserve })
+
+		budget := 4 * reserve
+		ctx, cancel := context.WithTimeout(context.Background(), budget)
+		defer cancel()
+
+		stubDiscovery(t, nil, nat.ErrNoNATFound, budget, ipv6Pinhole, nil)
+
+		got, err := defaultDiscoverGateway(ctx)
+
+		require.NoError(t, err)
+		assert.Same(t, ipv6Pinhole, got)
+	})
+}
+
+func TestReserveForPinhole(t *testing.T) {
+	origReserve := pinholeDiscoveryTimeout
+	pinholeDiscoveryTimeout = time.Second
+	t.Cleanup(func() { pinholeDiscoveryTimeout = origReserve })
+
+	t.Run("a budget is divided", func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+
+		gatewayCtx, cancelGateway := reserveForPinhole(ctx)
+		defer cancelGateway()
+
+		deadline, ok := gatewayCtx.Deadline()
+		require.True(t, ok)
+		assert.InDelta(t, 9*time.Second, time.Until(deadline), float64(500*time.Millisecond))
+	})
+
+	t.Run("a budget too small to divide is left whole", func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond)
+		defer cancel()
+
+		gatewayCtx, cancelGateway := reserveForPinhole(ctx)
+		defer cancelGateway()
+
+		deadline, ok := gatewayCtx.Deadline()
+		require.True(t, ok)
+		assert.InDelta(t, 500*time.Millisecond, time.Until(deadline), float64(100*time.Millisecond))
+	})
+
+	t.Run("no deadline stays unbounded", func(t *testing.T) {
+		gatewayCtx, cancelGateway := reserveForPinhole(context.Background())
+		defer cancelGateway()
+
+		_, ok := gatewayCtx.Deadline()
+		assert.False(t, ok)
+	})
+}
diff --git a/client/internal/profilemanager/active_state_test.go b/client/internal/profilemanager/active_state_test.go
new file mode 100644
index 000000000..3b7fcd29c
--- /dev/null
+++ b/client/internal/profilemanager/active_state_test.go
@@ -0,0 +1,76 @@
+package profilemanager
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Regression test: a concurrent Get and Set of the ActiveProfileState will
+// fail on Windows since the write is a temp file renamed over an open file.
+// Windows will refuse to replace a file another handle holds open by default.
+func TestActiveProfileState_ReadsDoNotBreakAConcurrentWrite(t *testing.T) {
+	withTempConfigDir(t, func(configDir string) {
+		withPatchedGlobals(t, configDir, func() {
+			sm := &ServiceManager{}
+			require.NoError(t, sm.CreateDefaultProfile())
+			require.NoError(t, sm.SetActiveProfileStateToDefault())
+
+			const switched = ID("0123456789abcdef0123456789abcdef")
+			const rounds = 50
+
+			var wg sync.WaitGroup
+			errs := make(chan error, 128)
+
+			for i := 0; i < 8; i++ {
+				wg.Add(1)
+				go func() {
+					defer wg.Done()
+					for r := 0; r < rounds; r++ {
+						state, err := sm.GetActiveProfileState()
+						if err != nil {
+							errs <- fmt.Errorf("read: %w", err)
+							return
+						}
+						if state.ID != defaultProfileName && state.ID != switched {
+							errs <- fmt.Errorf("read: active profile is %q, which no writer wrote", state.ID)
+							return
+						}
+					}
+				}()
+			}
+
+			for i := 0; i < 2; i++ {
+				wg.Add(1)
+				go func() {
+					defer wg.Done()
+					for r := 0; r < rounds; r++ {
+						id := switched
+						if r%2 == 0 {
+							id = defaultProfileName
+						}
+						if err := sm.SetActiveProfileState(&ActiveProfileState{ID: id, Username: "testuser"}); err != nil {
+							errs <- fmt.Errorf("switch: %w", err)
+							return
+						}
+					}
+				}()
+			}
+
+			wg.Wait()
+			close(errs)
+
+			for err := range errs {
+				assert.NoError(t, err, "a switch and a read of the active profile state must not collide")
+			}
+
+			state, err := sm.GetActiveProfileState()
+			require.NoError(t, err)
+			assert.Contains(t, []ID{defaultProfileName, switched}, state.ID,
+				"the file holds whichever switch landed last, not a mix of the two")
+		})
+	})
+}
diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go
index ed2f21999..3d378a9e6 100644
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -10,7 +10,6 @@ import (
 	"os"
 	"os/user"
 	"path/filepath"
-	"reflect"
 	"runtime"
 	"slices"
 	"strings"
@@ -58,10 +57,6 @@ var DefaultInterfaceBlacklist = []string{
 	"Tailscale", "tailscale", "docker", "veth", "br-", "lo",
 }
 
-// loadMDMPolicy is the package-level indirection used by apply() to read the
-// active MDM policy. Tests override this to inject a fake policy.
-var loadMDMPolicy = mdm.LoadPolicy
-
 // ConfigInput carries configuration changes to the client
 type ConfigInput struct {
 	ManagementURL                 string
@@ -70,6 +65,7 @@ type ConfigInput struct {
 	StateFilePath                 string
 	PreSharedKey                  *string
 	ServerSSHAllowed              *bool
+	RemoteJobsAllowed             *bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -96,12 +92,16 @@ type ConfigInput struct {
 	BlockLANAccess      *bool
 	BlockInbound        *bool
 	DisableIPv6         *bool
+	SyncMessageVersion  *int
 
 	DisableNotifications *bool
 
 	DNSLabels domain.List
 
 	MTU *uint16
+
+	LocalMetricsEnabled *bool
+	LocalMetricsAddress *string
 }
 
 // Config Configuration type
@@ -123,6 +123,7 @@ type Config struct {
 	RosenpassEnabled              bool
 	RosenpassPermissive           bool
 	ServerSSHAllowed              *bool
+	RemoteJobsAllowed             *bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -137,11 +138,17 @@ type Config struct {
 	BlockLANAccess      bool
 	BlockInbound        bool
 	DisableIPv6         bool
+	SyncMessageVersion  *int
 
 	DisableNotifications *bool
 
 	DNSLabels domain.List
 
+	// LocalMetricsEnabled enables the local Prometheus /metrics endpoint.
+	LocalMetricsEnabled bool
+	// LocalMetricsAddress is the listen address of the local /metrics endpoint.
+	LocalMetricsAddress string
+
 	// SSHKey is a private SSH key in a PEM format
 	SSHKey string
 
@@ -178,20 +185,53 @@ type Config struct {
 
 	ClientCertKeyPair *tls.Certificate `json:"-"`
 
+	// CertStoreDir is no longer read: certificate posture takes the directory from
+	// NB_CERT_STORE_DIR in the daemon's environment. The field is kept only to report a
+	// value left from an earlier version.
+	CertStoreDir string `json:",omitempty"`
+
+	// CertPKCS11URI is no longer read, as the URI may carry the token PIN: certificate
+	// posture takes it from NB_CERT_PKCS11_URI in the daemon's environment. The field is
+	// kept only to report a value left from an earlier version.
+	CertPKCS11URI string `json:",omitempty"`
+
 	// LazyConnection is the MDM-managed lazy-connection override ("on"/"off"/"").
 	// Runtime-only: re-derived from MDM policy on each load, never persisted.
 	LazyConnection string `json:"-"`
 
+	// DebugBundleUploadURL is the MDM-managed debug-bundle upload URL override.
+	// When set, it takes precedence over the management-supplied upload URL for
+	// remote debug bundle jobs. Runtime-only: re-derived from MDM policy on each
+	// load, never persisted.
+	DebugBundleUploadURL string `json:"-"`
+
 	MTU uint16
 
-	// policy is the MDM policy that produced the currently-set values for
-	// any MDM-enforced fields. Set by applyMDMPolicy at the tail of apply()
-	// and reset on every apply() invocation. Never persisted to disk.
-	// Callers query enforcement state via Policy() and the mdm.Policy API
-	// (HasKey, ManagedKeys, IsEmpty).
+	// probing marks a config that exists only to be compared against and then
+	// thrown away, so apply() can skip the work that feeds no verdict.
+	// Unexported, so it never reaches the JSON.
+	probing bool
+
+	// policy is the MDM policy that produced the currently-set values
+	// for any MDM-enforced fields. Set by ApplyMDMPolicy on every
+	// invocation. Never persisted to disk. Callers query enforcement
+	// state via Policy() and the mdm.Policy API (HasKey, ManagedKeys,
+	// IsEmpty).
 	policy *mdm.Policy `json:"-"`
 }
 
+// ApplyMDMPolicy overlays the supplied MDM Policy on top of the current
+// Config values and records it as Policy(). The overlay is not reversible:
+// an empty Policy only clears the enforcement metadata, so resolve the base
+// Config again (from disk or JSON) before applying a changed policy, the way
+// the lifecycle owners do on every load.
+func (config *Config) ApplyMDMPolicy(policy *mdm.Policy) {
+	if config == nil {
+		return
+	}
+	config.applyMDMPolicy(policy)
+}
+
 // Policy returns the MDM policy applied to this Config. Returns a non-nil
 // empty Policy when MDM enforcement is inactive; callers can always invoke
 // HasKey / ManagedKeys / IsEmpty without a nil check.
@@ -215,6 +255,12 @@ func getConfigDir() (string, error) {
 	}
 
 	configDir := filepath.Join(base, "netbird")
+	// Under sudo this is the invoking user's directory and strictly read-only:
+	// anything root creates in it would be root-owned and break the user's own
+	// runs. Reads of a missing directory fall through to defaults.
+	if sudoActive() {
+		return configDir, nil
+	}
 	if err := os.MkdirAll(configDir, 0o755); err != nil {
 		return "", err
 	}
@@ -222,6 +268,16 @@ func getConfigDir() (string, error) {
 }
 
 func baseConfigDir() (string, error) {
+	if u, ok := sudoInvokingUser(); ok {
+		return userBaseConfigDir(u)
+	}
+	// Fail closed instead of falling through to root's own config directory:
+	// reading root's active-profile and email state for what is actually the
+	// invoking user's invocation is the very confusion this resolution exists
+	// to prevent.
+	if sudoActive() {
+		return "", fmt.Errorf("resolve sudo invoking user %q: refusing to fall back to root's config directory", os.Getenv(envSudoUser))
+	}
 	if runtime.GOOS == "darwin" {
 		if u, err := user.Current(); err == nil && u.HomeDir != "" {
 			return filepath.Join(u.HomeDir, "Library", "Application Support"), nil
@@ -258,13 +314,103 @@ func fileExists(path string) (bool, error) {
 	return false, err
 }
 
-// createNewConfig creates a new config generating a new Wireguard key and saving to file
-func createNewConfig(input ConfigInput) (*Config, error) {
-	config := &Config{
+// newConfigSkeleton returns the field values a brand-new profile config starts
+// from, before apply() fills in the rest. Shared with the dry-run baseline so
+// the two cannot disagree about what "a new config" means.
+func newConfigSkeleton() *Config {
+	return &Config{
 		// defaults to false only for new (post 0.26) configurations
 		ServerSSHAllowed: util.False(),
-		WgPort:           iface.DefaultWgPort,
+		// Remote jobs are an explicit opt-in and default off, including for
+		// legacy configs (a nil value materializes to false at connect time).
+		RemoteJobsAllowed: util.False(),
+		WgPort:            iface.DefaultWgPort,
 	}
+}
+
+// resolveUnsetDefaults is the single place where an optional field that carries
+// no value gets one, and the only place that states what each of those defaults
+// is. apply() runs it before it compares anything, and that ordering is the
+// point: with the values named, every comparison below it diffs values instead
+// of presence.
+//
+// Presence-based comparison is what broke `netbird up` for a client configured
+// through the environment. These fields mean "the effective default" when they
+// hold nothing — every consumer already reads a nil as the value resolved here,
+// the SSH toggles in engine_ssh.go and the network monitor in
+// createEngineConfig — so naming them changes nothing about what runs. But
+// while they stayed nil, an input restating the default read as a change, and
+// since the CLI sends every flag whose value came from an environment variable
+// on each `netbird up`, a client with NB_ENABLE_SSH_ROOT=false restated it
+// every time and the update-settings gate refused it.
+//
+// Filling a field in is not a settings change, so a caller measuring change
+// must not read the returned bool as one: see WouldChange, which runs a pass
+// for this and discards its verdict.
+//
+// ServerSSHAllowed is the one field whose default depends on the config's age.
+// A brand-new profile gets false from newConfigSkeleton, which runs before
+// this, so what is resolved here is only the legacy case: a config written by a
+// version that had no such field keeps SSH on, for backwards compatibility.
+func (config *Config) resolveUnsetDefaults() (updated bool) {
+	// Fields that default to false on every platform.
+	for _, field := range []**bool{
+		&config.EnableSSHRoot,
+		&config.EnableSSHSFTP,
+		&config.EnableSSHLocalPortForwarding,
+		&config.EnableSSHRemotePortForwarding,
+		&config.DisableSSHAuth,
+		// Remote jobs are an explicit opt-in: unlike SSH, a pre-existing config
+		// with no value defaults to disabled rather than being turned on.
+		&config.RemoteJobsAllowed,
+	} {
+		if *field == nil {
+			*field = util.False()
+			updated = true
+		}
+	}
+
+	if config.DisableNotifications == nil {
+		log.Infof("setting notifications to disabled by default")
+		config.DisableNotifications = util.True()
+		updated = true
+	}
+
+	if config.SSHJWTCacheTTL == nil {
+		// A zero TTL disables the JWT cache, which is what no value meant.
+		config.SSHJWTCacheTTL = new(int)
+		updated = true
+	}
+
+	if config.NetworkMonitor == nil {
+		// network monitoring is on by default on windows and darwin clients
+		enabled := runtime.GOOS == "windows" || runtime.GOOS == "darwin"
+		config.NetworkMonitor = &enabled
+		updated = true
+	}
+
+	if config.ServerSSHAllowed == nil {
+		if runtime.GOOS == "android" {
+			// default to disabled SSH on Android for security
+			log.Infof("setting SSH server to false by default on Android")
+			config.ServerSSHAllowed = util.False()
+		} else {
+			// enables SSH for configs from old versions to preserve backwards compatibility
+			log.Infof("falling back to enabled SSH server for pre-existing configuration")
+			config.ServerSSHAllowed = util.True()
+		}
+		updated = true
+	}
+
+	return updated
+}
+
+// createNewConfig resolves a new config in memory, with no identity: whoever
+// needs the peer's keys calls EnsureIdentity and persists the result, so a read
+// that lands on a missing file cannot hand back a config carrying keys that
+// nothing will ever write down.
+func createNewConfig(input ConfigInput) (*Config, error) {
+	config := newConfigSkeleton()
 
 	if _, err := config.apply(input); err != nil {
 		return nil, err
@@ -273,6 +419,52 @@ func createNewConfig(input ConfigInput) (*Config, error) {
 	return config, nil
 }
 
+// createProvisionedConfig is createNewConfig plus the peer's identity, for the
+// callers that go on to persist the config or to connect with it.
+func createProvisionedConfig(input ConfigInput) (*Config, error) {
+	config, err := createNewConfig(input)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err := config.EnsureIdentity(); err != nil {
+		return nil, err
+	}
+
+	return config, nil
+}
+
+// EnsureIdentity generates the keys that identify this peer if the config does
+// not carry them yet, reporting whether it had to generate any.
+//
+// It is deliberately not part of apply(). Everything apply() fills in is a
+// default it can recompute on the next read, but a generated key is not: it
+// has to be persisted, or the peer comes back with a different WireGuard
+// identity and re-registers. Having apply() generate keys is what forced every
+// read of a config to write it back — so identity provisioning is its own step
+// now, and the callers that perform it write the result out explicitly.
+func (config *Config) EnsureIdentity() (bool, error) {
+	generated := false
+
+	if config.PrivateKey == "" {
+		log.Infof("generated new Wireguard key")
+		config.PrivateKey = generateKey()
+		generated = true
+	}
+
+	if config.SSHKey == "" {
+		log.Infof("generated new SSH key")
+		pem, err := ssh.GeneratePrivateKey(ssh.ED25519)
+		if err != nil {
+			return generated, err
+		}
+		config.SSHKey = string(pem)
+		generated = true
+	}
+
+	return generated, nil
+}
+
 func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 	if config.Name != "" {
 		sanitized, err := sanitizeDisplayName(config.Name)
@@ -284,6 +476,13 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 			updated = true
 		}
 	}
+
+	// Every optional field gets its value here, before anything below compares
+	// one. See resolveUnsetDefaults for why that ordering is the point.
+	if config.resolveUnsetDefaults() {
+		updated = true
+	}
+
 	if config.ManagementURL == nil {
 		log.Infof("using default Management URL %s", DefaultManagementURL)
 		config.ManagementURL, err = parseURL("Management URL", DefaultManagementURL)
@@ -291,20 +490,21 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 			return false, err
 		}
 	}
-	if input.ManagementURL != "" && input.ManagementURL != config.ManagementURL.String() {
-		log.Infof("new Management URL provided, updated to %#v (old value %#v)",
-			input.ManagementURL, config.ManagementURL.String())
+	// The comparison is on the endpoint the URL addresses, not on its
+	// spelling: the same endpoint can be written several ways (an implicit
+	// :443, a trailing slash, a different host case), and treating an
+	// equivalent URL as new would rewrite the config and report a settings
+	// change where the configuration does not actually change.
+	if input.ManagementURL != "" {
 		URL, err := parseURL("Management URL", input.ManagementURL)
 		if err != nil {
 			return false, err
 		}
-		config.ManagementURL = URL
-		updated = true
-	} else if config.ManagementURL == nil {
-		log.Infof("using default Management URL %s", DefaultManagementURL)
-		config.ManagementURL, err = parseURL("Management URL", DefaultManagementURL)
-		if err != nil {
-			return false, err
+		if !SameServiceURL(URL, config.ManagementURL) {
+			log.Infof("new Management URL provided, updated to %#v (old value %#v)",
+				URL.String(), config.ManagementURL.String())
+			config.ManagementURL = URL
+			updated = true
 		}
 	}
 
@@ -315,31 +515,20 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 			return false, err
 		}
 	}
-	if input.AdminURL != "" && input.AdminURL != config.AdminURL.String() {
-		log.Infof("new Admin Panel URL provided, updated to %#v (old value %#v)",
-			input.AdminURL, config.AdminURL.String())
+	// The admin panel is opened, not dialed, so unlike the Management URL its
+	// path is part of what identifies it: a panel served under /netbird is not
+	// the one served at the root.
+	if input.AdminURL != "" {
 		newURL, err := parseURL("Admin Panel URL", input.AdminURL)
 		if err != nil {
 			return updated, err
 		}
-		config.AdminURL = newURL
-		updated = true
-	}
-
-	if config.PrivateKey == "" {
-		log.Infof("generated new Wireguard key")
-		config.PrivateKey = generateKey()
-		updated = true
-	}
-
-	if config.SSHKey == "" {
-		log.Infof("generated new SSH key")
-		pem, err := ssh.GeneratePrivateKey(ssh.ED25519)
-		if err != nil {
-			return false, err
+		if !SameServiceURLIncludingPath(newURL, config.AdminURL) {
+			log.Infof("new Admin Panel URL provided, updated to %#v (old value %#v)",
+				newURL.String(), config.AdminURL.String())
+			config.AdminURL = newURL
+			updated = true
 		}
-		config.SSHKey = string(pem)
-		updated = true
 	}
 
 	if input.WireguardPort != nil && *input.WireguardPort != config.WgPort {
@@ -360,7 +549,14 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.NATExternalIPs != nil && !reflect.DeepEqual(config.NATExternalIPs, input.NATExternalIPs) {
+	// slices.Equal, not reflect.DeepEqual, and for the same reason the DNS
+	// labels below use it: DeepEqual calls a nil slice and an empty one
+	// different, while both mean "no NAT mappings". A profile stores the
+	// absent list as JSON null and reads it back nil, and `netbird up` sends
+	// CleanNATExternalIPs — an empty list — whenever NB_EXTERNAL_IP_MAP is set
+	// to nothing, so the two met on every start and the gate read a no-op as a
+	// settings change.
+	if input.NATExternalIPs != nil && !slices.Equal(config.NATExternalIPs, input.NATExternalIPs) {
 		log.Infof("updating NAT External IP [ %s ] (old value: [ %s ])",
 			strings.Join(input.NATExternalIPs, " "),
 			strings.Join(config.NATExternalIPs, " "))
@@ -386,19 +582,22 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.NetworkMonitor != nil && (config.NetworkMonitor == nil || *input.NetworkMonitor != *config.NetworkMonitor) {
-		log.Infof("switching Network Monitor to %t", *input.NetworkMonitor)
-		config.NetworkMonitor = input.NetworkMonitor
+	if input.LocalMetricsEnabled != nil && *input.LocalMetricsEnabled != config.LocalMetricsEnabled {
+		log.Infof("switching local metrics to %t", *input.LocalMetricsEnabled)
+		config.LocalMetricsEnabled = *input.LocalMetricsEnabled
 		updated = true
 	}
 
-	if config.NetworkMonitor == nil {
-		// enable network monitoring by default on windows and darwin clients
-		if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
-			enabled := true
-			config.NetworkMonitor = &enabled
-			updated = true
-		}
+	if input.LocalMetricsAddress != nil && *input.LocalMetricsAddress != config.LocalMetricsAddress {
+		log.Infof("switching local metrics address to %s", *input.LocalMetricsAddress)
+		config.LocalMetricsAddress = *input.LocalMetricsAddress
+		updated = true
+	}
+
+	if input.NetworkMonitor != nil && *input.NetworkMonitor != *config.NetworkMonitor {
+		log.Infof("switching Network Monitor to %t", *input.NetworkMonitor)
+		config.NetworkMonitor = input.NetworkMonitor
+		updated = true
 	}
 
 	if input.CustomDNSAddress != nil && string(input.CustomDNSAddress) != config.CustomDNSAddress {
@@ -433,7 +632,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.ServerSSHAllowed != nil && (config.ServerSSHAllowed == nil || *input.ServerSSHAllowed != *config.ServerSSHAllowed) {
+	if input.ServerSSHAllowed != nil && *input.ServerSSHAllowed != *config.ServerSSHAllowed {
 		if *input.ServerSSHAllowed {
 			log.Infof("enabling SSH server")
 		} else {
@@ -441,20 +640,19 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		}
 		config.ServerSSHAllowed = input.ServerSSHAllowed
 		updated = true
-	} else if config.ServerSSHAllowed == nil {
-		if runtime.GOOS == "android" {
-			// default to disabled SSH on Android for security
-			log.Infof("setting SSH server to false by default on Android")
-			config.ServerSSHAllowed = util.False()
+	}
+
+	if input.RemoteJobsAllowed != nil && *input.RemoteJobsAllowed != *config.RemoteJobsAllowed {
+		if *input.RemoteJobsAllowed {
+			log.Infof("enabling remote jobs")
 		} else {
-			// enables SSH for configs from old versions to preserve backwards compatibility
-			log.Infof("falling back to enabled SSH server for pre-existing configuration")
-			config.ServerSSHAllowed = util.True()
+			log.Infof("disabling remote jobs")
 		}
+		config.RemoteJobsAllowed = input.RemoteJobsAllowed
 		updated = true
 	}
 
-	if input.EnableSSHRoot != nil && (config.EnableSSHRoot == nil || *input.EnableSSHRoot != *config.EnableSSHRoot) {
+	if input.EnableSSHRoot != nil && *input.EnableSSHRoot != *config.EnableSSHRoot {
 		if *input.EnableSSHRoot {
 			log.Infof("enabling SSH root login")
 		} else {
@@ -464,7 +662,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHSFTP != nil && (config.EnableSSHSFTP == nil || *input.EnableSSHSFTP != *config.EnableSSHSFTP) {
+	if input.EnableSSHSFTP != nil && *input.EnableSSHSFTP != *config.EnableSSHSFTP {
 		if *input.EnableSSHSFTP {
 			log.Infof("enabling SSH SFTP subsystem")
 		} else {
@@ -474,7 +672,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHLocalPortForwarding != nil && (config.EnableSSHLocalPortForwarding == nil || *input.EnableSSHLocalPortForwarding != *config.EnableSSHLocalPortForwarding) {
+	if input.EnableSSHLocalPortForwarding != nil && *input.EnableSSHLocalPortForwarding != *config.EnableSSHLocalPortForwarding {
 		if *input.EnableSSHLocalPortForwarding {
 			log.Infof("enabling SSH local port forwarding")
 		} else {
@@ -484,7 +682,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHRemotePortForwarding != nil && (config.EnableSSHRemotePortForwarding == nil || *input.EnableSSHRemotePortForwarding != *config.EnableSSHRemotePortForwarding) {
+	if input.EnableSSHRemotePortForwarding != nil && *input.EnableSSHRemotePortForwarding != *config.EnableSSHRemotePortForwarding {
 		if *input.EnableSSHRemotePortForwarding {
 			log.Infof("enabling SSH remote port forwarding")
 		} else {
@@ -494,7 +692,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.DisableSSHAuth != nil && (config.DisableSSHAuth == nil || *input.DisableSSHAuth != *config.DisableSSHAuth) {
+	if input.DisableSSHAuth != nil && *input.DisableSSHAuth != *config.DisableSSHAuth {
 		if *input.DisableSSHAuth {
 			log.Infof("disabling SSH authentication")
 		} else {
@@ -504,7 +702,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.SSHJWTCacheTTL != nil && (config.SSHJWTCacheTTL == nil || *input.SSHJWTCacheTTL != *config.SSHJWTCacheTTL) {
+	if input.SSHJWTCacheTTL != nil && *input.SSHJWTCacheTTL != *config.SSHJWTCacheTTL {
 		log.Infof("updating SSH JWT cache TTL to %d seconds", *input.SSHJWTCacheTTL)
 		config.SSHJWTCacheTTL = input.SSHJWTCacheTTL
 		updated = true
@@ -587,7 +785,16 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.DisableNotifications != nil && (config.DisableNotifications == nil || *input.DisableNotifications != *config.DisableNotifications) {
+	// Assigning the pointer, not writing through it: a config that carries no
+	// version yet would otherwise be a nil dereference, and a panic inside a
+	// request handler is not a way to fail.
+	if input.SyncMessageVersion != nil && (config.SyncMessageVersion == nil || *input.SyncMessageVersion != *config.SyncMessageVersion) {
+		log.Infof("setting SyncMessageVersion to %v", *input.SyncMessageVersion)
+		config.SyncMessageVersion = input.SyncMessageVersion
+		updated = true
+	}
+
+	if input.DisableNotifications != nil && *input.DisableNotifications != *config.DisableNotifications {
 		if *input.DisableNotifications {
 			log.Infof("disabling notifications")
 		} else {
@@ -597,24 +804,24 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if config.DisableNotifications == nil {
-		disabled := true
-		config.DisableNotifications = &disabled
-		log.Infof("setting notifications to disabled by default")
-		updated = true
-	}
-
-	if input.ClientCertKeyPath != "" {
+	// Compared, not just assigned: restating the path a config already holds
+	// changes nothing, and reporting it as an update makes a caller that
+	// re-sends its own configuration look like one asking to change it.
+	if input.ClientCertKeyPath != "" && input.ClientCertKeyPath != config.ClientCertKeyPath {
 		config.ClientCertKeyPath = input.ClientCertKeyPath
 		updated = true
 	}
 
-	if input.ClientCertPath != "" {
+	if input.ClientCertPath != "" && input.ClientCertPath != config.ClientCertPath {
 		config.ClientCertPath = input.ClientCertPath
 		updated = true
 	}
 
-	if config.ClientCertPath != "" && config.ClientCertKeyPath != "" {
+	// Not on a probe: the loaded pair feeds the connection, never the
+	// comparison, and this would otherwise run on every gated SetConfig and
+	// Login — twice per request — including those that are refused or change
+	// nothing, logging an error per request when the files are missing.
+	if !config.probing && config.ClientCertPath != "" && config.ClientCertKeyPath != "" {
 		cert, err := tls.LoadX509KeyPair(config.ClientCertPath, config.ClientCertKeyPath)
 		if err != nil {
 			log.Error("Failed to load mTLS cert/key pair: ", err)
@@ -642,9 +849,11 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	// MDM is the last override layer: any key present in the policy
-	// supersedes defaults, on-disk config, env vars and CLI input.
-	config.applyMDMPolicy(loadMDMPolicy())
+	// Initialise the MDM overlay to "no enforcement" so Config.Policy()
+	// never returns a stale or nil policy on a freshly applied Config.
+	// Lifecycle owners that want to enforce a real MDM policy invoke
+	// Config.ApplyMDMPolicy(loader.Load()) after this returns.
+	config.applyMDMPolicy(mdm.NewPolicy(nil))
 
 	return updated, nil
 }
@@ -657,6 +866,14 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 // for the key, so per-field rejection of user writes still applies).
 func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 	config.policy = policy
+
+	// DebugBundleUploadURL is a runtime-only override re-derived from MDM on
+	// every apply. Resolve it unconditionally (before the IsEmpty early return)
+	// so a policy that drops the key, becomes empty, or carries an invalid
+	// value can never leave a previously-enforced upload target active on a
+	// reused Config instance.
+	config.DebugBundleUploadURL = mdmDebugBundleUploadURL(policy)
+
 	if policy.IsEmpty() {
 		return
 	}
@@ -704,12 +921,19 @@ func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 	}
 
 	applyBool(mdm.KeyAllowServerSSH, func(v bool) { bv := v; config.ServerSSHAllowed = &bv })
+	applyBool(mdm.KeyRemoteJobsAllowed, func(v bool) { bv := v; config.RemoteJobsAllowed = &bv })
 	applyBool(mdm.KeyDisableClientRoutes, func(v bool) { config.DisableClientRoutes = v })
 	applyBool(mdm.KeyDisableServerRoutes, func(v bool) { config.DisableServerRoutes = v })
 	applyBool(mdm.KeyBlockInbound, func(v bool) { config.BlockInbound = v })
 	applyBool(mdm.KeyDisableAutoConnect, func(v bool) { config.DisableAutoConnect = v })
 	applyBool(mdm.KeyRosenpassEnabled, func(v bool) { config.RosenpassEnabled = v })
 	applyBool(mdm.KeyRosenpassPermissive, func(v bool) { config.RosenpassPermissive = v })
+	applyBool(mdm.KeyEnableLocalMetrics, func(v bool) { config.LocalMetricsEnabled = v })
+
+	if v, ok := policy.GetString(mdm.KeyLocalMetricsAddress); ok {
+		config.LocalMetricsAddress = v
+		logApplied(mdm.KeyLocalMetricsAddress, v)
+	}
 
 	if v, ok := policy.GetInt(mdm.KeyWireguardPort); ok {
 		// REG_DWORD is 32-bit; UDP port range is 1-65535. Clamp at the
@@ -731,6 +955,52 @@ func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 		config.LazyConnection = state
 		logApplied(mdm.KeyLazyConnection, state)
 	}
+
+}
+
+// ValidateBundleUploadURL sanity-checks a debug-bundle upload URL. An empty
+// value is accepted — the executor falls back to the default upload service. A
+// non-empty value must be a well-formed https URL with a host; a malformed
+// value or a plaintext scheme is rejected. It deliberately does not constrain
+// which host may receive the bundle. This is the single source of truth for the
+// rule, shared by the remote-job executor (client/internal) and the MDM policy
+// override below so the two validation paths cannot drift.
+func ValidateBundleUploadURL(raw string) error {
+	if raw == "" {
+		return nil
+	}
+	parsed, err := url.Parse(raw)
+	if err != nil {
+		return fmt.Errorf("parse upload URL: %w", err)
+	}
+	// Hostname(), not Host: an authority like ":443" is non-empty but has no
+	// host, and would fail the actual upload.
+	if parsed.Scheme != "https" || parsed.Hostname() == "" {
+		return fmt.Errorf("upload URL must be an https URL with a host")
+	}
+	return nil
+}
+
+// mdmDebugBundleUploadURL resolves the MDM-enforced debug-bundle upload URL
+// override from the policy, returning the empty string when the policy does
+// not carry a valid KeyBundleUploadURL. An absent or invalid value fails
+// closed to "" so it falls back to the management-supplied or default upload
+// target rather than a previously-enforced one. The URL is never logged: it
+// can embed credentials or signed query tokens (KeyBundleUploadURL is in
+// mdm.SecretKeys).
+func mdmDebugBundleUploadURL(policy *mdm.Policy) string {
+	v, ok := policy.GetString(mdm.KeyBundleUploadURL)
+	if !ok || v == "" {
+		return ""
+	}
+	// Must be a well-formed https URL with a host, matching the client's
+	// remote-job upload-URL validation (shared validator, single source of truth).
+	if err := ValidateBundleUploadURL(v); err != nil {
+		log.Warnf("MDM debug bundle upload URL is invalid (must be an https URL with a host); ignoring the override")
+		return ""
+	}
+	log.Infof("MDM override %s = ********** (secret)", mdm.KeyBundleUploadURL)
+	return v
 }
 
 // parseURL parses and validates the URL for the named service. The URL
@@ -738,6 +1008,56 @@ func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 // appended for https or ":80" for http. The serviceName parameter is
 // used to contextualise error messages. On success returns the parsed
 // *url.URL; on failure returns a non-nil error.
+// ParseServiceURL normalises a service URL exactly as the config layer does when
+// it stores one, so callers comparing a requested URL against a stored one do not
+// have to reimplement the scheme validation and default-port handling.
+func ParseServiceURL(serviceName, serviceURL string) (*url.URL, error) {
+	return parseURL(serviceName, serviceURL)
+}
+
+// SameServiceURL reports whether two service URLs address the same endpoint:
+// same scheme, same host compared case-insensitively as DNS names are, and
+// same effective port, where an absent port means the scheme's default.
+//
+// This is the one comparison every caller deciding "did this URL change?" must
+// use. A string comparison answers a different question: "https://host",
+// "https://host/" and "https://HOST:443" are one endpoint written three ways,
+// and reading them as three values makes a client that restates its own
+// management URL look like a client asking to be repointed. A nil operand
+// matches only another nil one.
+//
+// The path plays no part: a management URL is dialed, and only its host and
+// port are. util.SameServiceURL is this comparison plus the path, which is
+// what SameServiceURLIncludingPath needs and delegates to.
+func SameServiceURL(a, b *url.URL) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+
+	return strings.EqualFold(a.Scheme, b.Scheme) &&
+		strings.EqualFold(a.Hostname(), b.Hostname()) &&
+		util.ServiceURLPort(a) == util.ServiceURLPort(b)
+}
+
+// SameServiceURLIncludingPath is SameServiceURL plus everything a URL carries
+// past its endpoint: path, query, fragment and userinfo.
+//
+// Use it for a URL that gets opened rather than dialed. The admin panel can
+// live under a path, so two URLs with the same endpoint and different paths are
+// two different panels — where for a URL the client dials over gRPC only the
+// endpoint is ever used. Equivalent spellings still compare equal: a missing
+// path and "/" are the same root, and so is a trailing slash on any path.
+func SameServiceURLIncludingPath(a, b *url.URL) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+
+	return util.SameServiceURL(a, b) &&
+		a.RawQuery == b.RawQuery &&
+		a.Fragment == b.Fragment &&
+		a.User.String() == b.User.String()
+}
+
 func parseURL(serviceName, serviceURL string) (*url.URL, error) {
 	parsedMgmtURL, err := url.ParseRequestURI(serviceURL)
 	if err != nil {
@@ -782,6 +1102,84 @@ func isPreSharedKeyHidden(preSharedKey *string) bool {
 	return false
 }
 
+// WouldChange reports whether applying input would modify any field the
+// config persists, leaving the receiver untouched. It is the dry-run half of
+// UpdateConfig and reuses the very same diff logic (Config.apply), so a
+// caller asking "is this a settings change?" cannot drift from what an
+// actual update would do, nor go stale when a new field is added.
+//
+// A redacted pre-shared key is collapsed to "unset" exactly as
+// UpdateOrCreateConfig does, so a UI that round-trips the mask is not read as
+// a request for a new key.
+//
+// A nil receiver means the profile holds no config yet, so the baseline is the
+// config the daemon would create for it: input values matching those defaults
+// change nothing, anything else does.
+func (config *Config) WouldChange(input ConfigInput) (bool, error) {
+	probe := config.clone()
+	if probe == nil {
+		baseline, err := newDryRunBaseline(input.ConfigPath)
+		if err != nil {
+			return true, fmt.Errorf("build default config baseline: %w", err)
+		}
+		probe = baseline
+	}
+	probe.probing = true
+
+	// Normalize before measuring. apply() reports two different things through
+	// one bool: an input that changed a value, and a field it had to fill in
+	// because the config carried none. Only the first is a settings change, so
+	// the filling-in gets a pass of its own whose verdict is discarded, and the
+	// pass that answers the caller runs against a config with nothing left to
+	// fill in.
+	//
+	// Readers already hand out normalized configs — readConfig applies an empty
+	// input for this very reason — so this is normally a no-op. But a gate that
+	// refuses a request must not depend on where its caller got the config
+	// from, and it must not start reading "this profile predates a field" as
+	// "the caller asked for a change" the day someone adds one.
+	if _, err := probe.apply(ConfigInput{ConfigPath: input.ConfigPath}); err != nil {
+		return true, fmt.Errorf("normalize the config to diff against: %w", err)
+	}
+
+	if isPreSharedKeyHidden(input.PreSharedKey) {
+		input.PreSharedKey = nil
+	}
+
+	return probe.apply(input)
+}
+
+// newDryRunBaseline builds the config a brand-new profile would start from, for
+// a dry run to compare an input against. It is createNewConfig without the
+// identity: this config exists only to be compared against and thrown away, and
+// no ConfigInput field maps to either key.
+func newDryRunBaseline(configPath string) (*Config, error) {
+	baseline := newConfigSkeleton()
+
+	if _, err := baseline.apply(ConfigInput{ConfigPath: configPath}); err != nil {
+		return nil, err
+	}
+
+	return baseline, nil
+}
+
+// clone returns a copy of the config that apply can be run against without the
+// original observing the writes, or nil for a nil receiver. Only what apply
+// mutates in place needs detaching, which is the slices it replaces or appends
+// to: every pointer field it touches is reassigned rather than written through,
+// and ClientCertKeyPair is only overwritten.
+func (config *Config) clone() *Config {
+	if config == nil {
+		return nil
+	}
+
+	probe := *config
+	probe.IFaceBlackList = slices.Clone(config.IFaceBlackList)
+	probe.NATExternalIPs = slices.Clone(config.NATExternalIPs)
+	probe.DNSLabels = slices.Clone(config.DNSLabels)
+	return &probe
+}
+
 // UpdateConfig update existing configuration according to input configuration and return with the configuration
 func UpdateConfig(input ConfigInput) (*Config, error) {
 	configExists, err := fileExists(input.ConfigPath)
@@ -792,6 +1190,14 @@ func UpdateConfig(input ConfigInput) (*Config, error) {
 		return nil, fmt.Errorf("config file %s does not exist", input.ConfigPath)
 	}
 
+	// A UI that round-trips the mask GetConfig hands it back is asking to keep
+	// the stored key, not to set the mask as the new one. UpdateOrCreateConfig
+	// and DirectUpdateOrCreateConfig already collapse it; this one did not, so
+	// the same round-trip through SetConfig replaced the key with asterisks.
+	if isPreSharedKeyHidden(input.PreSharedKey) {
+		input.PreSharedKey = nil
+	}
+
 	return update(input)
 }
 
@@ -803,7 +1209,7 @@ func UpdateOrCreateConfig(input ConfigInput) (*Config, error) {
 	}
 	if !configExists {
 		log.Infof("generating new config %s", input.ConfigPath)
-		cfg, err := createNewConfig(input)
+		cfg, err := createProvisionedConfig(input)
 		if err != nil {
 			return nil, err
 		}
@@ -828,12 +1234,20 @@ func update(input ConfigInput) (*Config, error) {
 		return nil, err
 	}
 
+	// A write path is a provisioning point: a stored profile can legitimately
+	// carry no identity (a mobile logout clears the keys in place), and the
+	// next config write is what has to mint a new one. Reads leave that alone.
+	identityGenerated, err := config.EnsureIdentity()
+	if err != nil {
+		return nil, err
+	}
+
 	updated, err := config.apply(input)
 	if err != nil {
 		return nil, err
 	}
 
-	if updated {
+	if updated || identityGenerated {
 		if err := util.WriteJson(context.Background(), input.ConfigPath, config); err != nil {
 			return nil, err
 		}
@@ -842,8 +1256,8 @@ func update(input ConfigInput) (*Config, error) {
 	return config, nil
 }
 
-// GetConfig read config file and return with Config and if it was created. Errors out if it does not exist
-func GetConfig(configPath string) (*Config, error) {
+// GetExistingConfig reads and returns the config if it exists on disk. Fails otherwise.
+func GetExistingConfig(configPath string) (*Config, error) {
 	return readConfig(configPath, false)
 }
 
@@ -926,17 +1340,27 @@ func UpdateOldManagementURL(ctx context.Context, config *Config, configPath stri
 	return newConfig, nil
 }
 
-// CreateInMemoryConfig generate a new config but do not write out it to the store
+// CreateInMemoryConfig generate a new config but do not write out it to the store.
+// It carries an identity: callers connect with what they get back.
 func CreateInMemoryConfig(input ConfigInput) (*Config, error) {
-	return createNewConfig(input)
+	return createProvisionedConfig(input)
 }
 
-// ReadConfig read config file and return with Config. If it is not exists create a new with default values
-func ReadConfig(configPath string) (*Config, error) {
+// ReadConfigOrDefault reads the profile config at configPath, or resolves the
+// default config in memory when the file does not exist. It never writes, and
+// never mints an identity — EnsureIdentity is where that happens, so the
+// caller that provisions is also the one that persists.
+func ReadConfigOrDefault(configPath string) (*Config, error) {
 	return readConfig(configPath, true)
 }
 
-// ReadConfig read config file and return with Config. If it is not exists create a new with default values
+// readConfig reads the profile config at configPath. createIfMissing resolves a
+// default config in memory when the file is absent, rather than erroring.
+//
+// Reads are pure. This used to write the config back whenever apply() had to
+// fill in a default the file was missing, which quietly made every reader a
+// writer: a gate deciding whether to refuse a request, a UI listing profiles,
+// a mobile getter reading a single preference.
 func readConfig(configPath string, createIfMissing bool) (*Config, error) {
 	configExists, err := fileExists(configPath)
 	if err != nil {
@@ -954,12 +1378,8 @@ func readConfig(configPath string, createIfMissing bool) (*Config, error) {
 			return nil, err
 		}
 		// initialize through apply() without changes
-		if changed, err := config.apply(ConfigInput{}); err != nil {
+		if _, err := config.apply(ConfigInput{}); err != nil {
 			return nil, err
-		} else if changed {
-			if err = WriteOutConfig(configPath, config); err != nil {
-				return nil, err
-			}
 		}
 
 		return config, nil
@@ -967,13 +1387,7 @@ func readConfig(configPath string, createIfMissing bool) (*Config, error) {
 		return nil, fmt.Errorf("config file %s does not exist", configPath)
 	}
 
-	cfg, err := createNewConfig(ConfigInput{ConfigPath: configPath})
-	if err != nil {
-		return nil, err
-	}
-
-	err = WriteOutConfig(configPath, cfg)
-	return cfg, err
+	return createNewConfig(ConfigInput{ConfigPath: configPath})
 }
 
 // WriteOutConfig write put the prepared config to the given path
@@ -996,7 +1410,7 @@ func DirectUpdateOrCreateConfig(input ConfigInput) (*Config, error) {
 	}
 	if !configExists {
 		log.Infof("generating new config %s", input.ConfigPath)
-		cfg, err := createNewConfig(input)
+		cfg, err := createProvisionedConfig(input)
 		if err != nil {
 			return nil, err
 		}
@@ -1023,12 +1437,18 @@ func directUpdate(input ConfigInput) (*Config, error) {
 		return nil, err
 	}
 
+	// Same provisioning point as update(); see the note there.
+	identityGenerated, err := config.EnsureIdentity()
+	if err != nil {
+		return nil, err
+	}
+
 	updated, err := config.apply(input)
 	if err != nil {
 		return nil, err
 	}
 
-	if updated {
+	if updated || identityGenerated {
 		if err := util.DirectWriteJson(context.Background(), input.ConfigPath, config); err != nil {
 			return nil, err
 		}
@@ -1050,7 +1470,16 @@ func ConfigToJSON(config *Config) (string, error) {
 
 // ConfigFromJSON deserializes a JSON string to a Config struct.
 // This is useful for restoring config from alternative storage mechanisms.
-// After unmarshaling, defaults are applied to ensure the config is fully initialized.
+// After unmarshaling, defaults are applied to ensure the config is fully
+// initialized.
+//
+// The peer identity is deliberately none of its business, in either direction.
+// It does not generate one: a read cannot hand back keys that nothing will
+// write down (see ReadConfigOrDefault). Nor does it refuse a document that
+// carries none, because a config legitimately has no identity between a logout
+// and the next login — mobile logout clears both keys in place — and this is
+// also the deserializer the iOS SDK copies a config through. Whoever goes on
+// to connect is where an absent identity has to be answered.
 func ConfigFromJSON(jsonStr string) (*Config, error) {
 	config := &Config{}
 	err := json.Unmarshal([]byte(jsonStr), config)
diff --git a/client/internal/profilemanager/config_json_test.go b/client/internal/profilemanager/config_json_test.go
new file mode 100644
index 000000000..9a6d820c4
--- /dev/null
+++ b/client/internal/profilemanager/config_json_test.go
@@ -0,0 +1,44 @@
+package profilemanager
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// The serialized form is how the tvOS SDK stores a profile and how the iOS SDK
+// copies one in memory, so it must round-trip whatever a profile legitimately
+// holds — including no identity at all, which is the state mobile logout leaves
+// behind when it clears both keys in place. Refusing that document here broke
+// logout, profile switching and the login that follows them.
+func TestConfigFromJSONRoundTripsALoggedOutProfile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "exported.json")
+	stored, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
+	require.NoError(t, err)
+	require.NotEmpty(t, stored.PrivateKey, "a provisioned config is the fixture this test starts from")
+	require.NotEmpty(t, stored.SSHKey)
+
+	exported, err := ConfigToJSON(stored)
+	require.NoError(t, err)
+
+	restored, err := ConfigFromJSON(exported)
+	require.NoError(t, err, "a config exported after a login must load")
+	require.Equal(t, stored.PrivateKey, restored.PrivateKey, "the restored peer is not the stored one")
+	require.Equal(t, stored.SSHKey, restored.SSHKey)
+
+	// What mobile logout leaves on disk.
+	loggedOut := stored.clone()
+	loggedOut.PrivateKey = ""
+	loggedOut.SSHKey = ""
+
+	document, err := ConfigToJSON(loggedOut)
+	require.NoError(t, err)
+
+	reloaded, err := ConfigFromJSON(document)
+	require.NoError(t, err, "a logged-out profile must still load")
+	require.Empty(t, reloaded.PrivateKey, "loading must not mint a key nothing will write down")
+	require.Empty(t, reloaded.SSHKey)
+	require.Equal(t, stored.ManagementURL.String(), reloaded.ManagementURL.String(),
+		"the rest of the profile survives the logout")
+}
diff --git a/client/internal/profilemanager/config_mdm.go b/client/internal/profilemanager/config_mdm.go
new file mode 100644
index 000000000..25b9f18f7
--- /dev/null
+++ b/client/internal/profilemanager/config_mdm.go
@@ -0,0 +1,52 @@
+package profilemanager
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+// ErrMDMManagedFields marks a config change rejected because it diverges from
+// MDM-enforced values.
+var ErrMDMManagedFields = errors.New("fields managed by MDM cannot be modified")
+
+// MDMConflicts returns the names of MDM-managed keys whose requested value in
+// the ConfigInput differs from the policy-enforced value; a field set to the
+// enforced value is a no-op echo, not a conflict.
+func MDMConflicts(input ConfigInput, policy *mdm.Policy) []string {
+	pskGot := input.PreSharedKey
+	if isPreSharedKeyHidden(pskGot) {
+		pskGot = nil
+	}
+	var port *int64
+	if input.WireguardPort != nil {
+		v := int64(*input.WireguardPort)
+		port = &v
+	}
+	return mdm.ResolveConflicts(policy, []mdm.ConflictCheck{
+		mdm.ConflictURL(mdm.KeyManagementURL, input.ManagementURL),
+		mdm.ConflictStringPtr(mdm.KeyPreSharedKey, pskGot),
+		mdm.ConflictBool(mdm.KeyRosenpassEnabled, input.RosenpassEnabled),
+		mdm.ConflictBool(mdm.KeyRosenpassPermissive, input.RosenpassPermissive),
+		mdm.ConflictBool(mdm.KeyDisableAutoConnect, input.DisableAutoConnect),
+		mdm.ConflictBool(mdm.KeyAllowServerSSH, input.ServerSSHAllowed),
+		mdm.ConflictBool(mdm.KeyRemoteJobsAllowed, input.RemoteJobsAllowed),
+		mdm.ConflictBool(mdm.KeyDisableClientRoutes, input.DisableClientRoutes),
+		mdm.ConflictBool(mdm.KeyDisableServerRoutes, input.DisableServerRoutes),
+		mdm.ConflictBool(mdm.KeyBlockInbound, input.BlockInbound),
+		mdm.ConflictInt64(mdm.KeyWireguardPort, port),
+		mdm.ConflictBool(mdm.KeyEnableLocalMetrics, input.LocalMetricsEnabled),
+		mdm.ConflictStringPtr(mdm.KeyLocalMetricsAddress, input.LocalMetricsAddress),
+	})
+}
+
+// CheckMDMConflicts returns an ErrMDMManagedFields-wrapped error naming the
+// conflicting keys, or nil when the input does not fight the policy.
+func CheckMDMConflicts(input ConfigInput, policy *mdm.Policy) error {
+	conflicts := MDMConflicts(input, policy)
+	if len(conflicts) == 0 {
+		return nil
+	}
+	return fmt.Errorf("%w: %v", ErrMDMManagedFields, conflicts)
+}
diff --git a/client/internal/profilemanager/config_mdm_test.go b/client/internal/profilemanager/config_mdm_test.go
index c6a688ab2..716b7a553 100644
--- a/client/internal/profilemanager/config_mdm_test.go
+++ b/client/internal/profilemanager/config_mdm_test.go
@@ -10,24 +10,58 @@ import (
 	"github.com/netbirdio/netbird/client/mdm"
 )
 
-// withMDMPolicy temporarily overrides the package-level loadMDMPolicy hook so
-// apply() observes the supplied Policy. The original loader is restored at
-// test cleanup.
-func withMDMPolicy(t *testing.T, policy *mdm.Policy) {
+// fakeFetcher implements mdm.PolicyFetcher returning a pre-set policy
+// map. Test helper used to construct a Loader without touching the OS
+// or any package-level state.
+type fakeFetcher struct{ values map[string]any }
+
+func (f *fakeFetcher) Fetch() map[string]any { return f.values }
+
+// loaderFor builds an mdm.Loader whose loadPlatform returns the
+// supplied Policy's underlying values.
+func loaderFor(policy *mdm.Policy) *mdm.Loader {
+	if policy == nil || policy.IsEmpty() {
+		return mdm.NewLoader(&fakeFetcher{values: nil})
+	}
+	values := make(map[string]any)
+	for _, k := range policy.ManagedKeys() {
+		if v, ok := policy.GetString(k); ok {
+			values[k] = v
+			continue
+		}
+		if v, ok := policy.GetInt(k); ok {
+			values[k] = v
+			continue
+		}
+		if v, ok := policy.GetBool(k); ok {
+			values[k] = v
+			continue
+		}
+		if v, ok := policy.GetStringSlice(k); ok {
+			values[k] = v
+		}
+	}
+	return mdm.NewLoader(&fakeFetcher{values: values})
+}
+
+// configWithMDM is the test convenience that builds a Config via
+// UpdateOrCreateConfig and overlays the supplied MDM policy on top —
+// mirrors the production pattern (Server.getConfig / Client.applyMDMOverlay)
+// where the Loader lives outside Config and the apply step is driven
+// by the lifecycle owner.
+func configWithMDM(t *testing.T, input ConfigInput, policy *mdm.Policy) *Config {
 	t.Helper()
-	prev := loadMDMPolicy
-	loadMDMPolicy = func() *mdm.Policy { return policy }
-	t.Cleanup(func() { loadMDMPolicy = prev })
+	cfg, err := UpdateOrCreateConfig(input)
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+	cfg.ApplyMDMPolicy(loaderFor(policy).Load())
+	return cfg
 }
 
 func TestApply_MDMEmpty_NoEnforcement(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
+	cfg := configWithMDM(t, ConfigInput{
 		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
+	}, mdm.NewPolicy(nil))
 
 	assert.True(t, cfg.Policy().IsEmpty(), "no MDM source ⇒ empty Policy")
 	assert.False(t, cfg.Policy().HasKey(mdm.KeyManagementURL))
@@ -39,18 +73,15 @@ func TestApply_MDMEmpty_NoEnforcement(t *testing.T) {
 
 func TestApply_MDMOnly_OverridesDefaults(t *testing.T) {
 	const mdmURL = "https://corp.mdm.example.com:443"
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL:       mdmURL,
 		mdm.KeyDisableClientRoutes: true,
 		mdm.KeyBlockInbound:        true,
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	assert.Equal(t, mdmURL, cfg.ManagementURL.String())
 	assert.True(t, cfg.DisableClientRoutes)
 	assert.True(t, cfg.BlockInbound)
@@ -65,16 +96,12 @@ func TestApply_MDMBeatsCLIInput(t *testing.T) {
 	const mdmURL = "https://mdm.example.com:443"
 	const cliURL = "https://cli.example.com:443"
 
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
-		mdm.KeyManagementURL: mdmURL,
-	}))
-
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
+	cfg := configWithMDM(t, ConfigInput{
 		ConfigPath:    filepath.Join(t.TempDir(), "config.json"),
 		ManagementURL: cliURL,
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
+	}, mdm.NewPolicy(map[string]any{
+		mdm.KeyManagementURL: mdmURL,
+	}))
 
 	// MDM wins over CLI-supplied management URL.
 	assert.Equal(t, mdmURL, cfg.ManagementURL.String())
@@ -82,16 +109,12 @@ func TestApply_MDMBeatsCLIInput(t *testing.T) {
 }
 
 func TestApply_MDMInvalidURL_KeepsPreviousValue(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "not-a-url",
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	// Invalid MDM URL is logged and skipped: default URL stays in place
 	// to keep the client functional.
 	assert.Equal(t, DefaultManagementURL, cfg.ManagementURL.String())
@@ -106,30 +129,49 @@ func TestApply_MDMBoolKeysOverrideOnDiskValue(t *testing.T) {
 	tmp := filepath.Join(t.TempDir(), "config.json")
 
 	// Seed without MDM.
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-	_, err := UpdateOrCreateConfig(ConfigInput{
+	configWithMDM(t, ConfigInput{
 		ConfigPath:          tmp,
 		DisableClientRoutes: boolPtr(false),
 		RosenpassEnabled:    boolPtr(false),
-	})
-	require.NoError(t, err)
+	}, mdm.NewPolicy(nil))
 
 	// Now enable MDM enforcement for these keys.
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: tmp,
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyDisableClientRoutes: true,
 		mdm.KeyRosenpassEnabled:    true,
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: tmp})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	assert.True(t, cfg.DisableClientRoutes, "MDM override should flip on-disk false to true")
 	assert.True(t, cfg.RosenpassEnabled)
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyDisableClientRoutes))
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyRosenpassEnabled))
 }
 
+func TestApply_MDMLocalMetrics(t *testing.T) {
+	tmp := filepath.Join(t.TempDir(), "config.json")
+
+	// Seed without MDM.
+	configWithMDM(t, ConfigInput{
+		ConfigPath:          tmp,
+		LocalMetricsEnabled: boolPtr(false),
+	}, mdm.NewPolicy(nil))
+
+	// Now enable MDM enforcement for these keys.
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: tmp,
+	}, mdm.NewPolicy(map[string]any{
+		mdm.KeyEnableLocalMetrics:  true,
+		mdm.KeyLocalMetricsAddress: "127.0.0.1:9292",
+	}))
+
+	assert.True(t, cfg.LocalMetricsEnabled, "MDM override should flip on-disk false to true")
+	assert.Equal(t, "127.0.0.1:9292", cfg.LocalMetricsAddress)
+	assert.True(t, cfg.Policy().HasKey(mdm.KeyEnableLocalMetrics))
+	assert.True(t, cfg.Policy().HasKey(mdm.KeyLocalMetricsAddress))
+}
+
 func TestApply_MDMLazyConnection(t *testing.T) {
 	cases := []struct {
 		name string
@@ -145,16 +187,12 @@ func TestApply_MDMLazyConnection(t *testing.T) {
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+			cfg := configWithMDM(t, ConfigInput{
+				ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+			}, mdm.NewPolicy(map[string]any{
 				mdm.KeyLazyConnection: c.raw,
 			}))
 
-			cfg, err := UpdateOrCreateConfig(ConfigInput{
-				ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-			})
-			require.NoError(t, err)
-			require.NotNil(t, cfg)
-
 			assert.Equal(t, c.want, cfg.LazyConnection)
 			assert.True(t, cfg.Policy().HasKey(mdm.KeyLazyConnection))
 		})
@@ -162,22 +200,83 @@ func TestApply_MDMLazyConnection(t *testing.T) {
 }
 
 func TestApply_MDMPreSharedKeyRedactionSentinelRejected(t *testing.T) {
-	const maskSentinel = "**********"
+	const maskSentinel = mdm.PreSharedKeyRedactedSentinel
 
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyPreSharedKey: maskSentinel,
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	// Mask sentinel must not be persisted as the actual PSK.
 	assert.NotEqual(t, maskSentinel, cfg.PreSharedKey)
 	// Key still marked managed so user writes are still rejected.
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyPreSharedKey))
 }
 
+func TestMDMConflicts_PreSharedKey(t *testing.T) {
+	policy := mdm.NewPolicy(map[string]any{
+		mdm.KeyPreSharedKey: "mdm-enforced-psk",
+	})
+	empty := ""
+	sentinel := mdm.PreSharedKeyRedactedSentinel
+	same := "mdm-enforced-psk"
+	other := "user-psk"
+
+	tests := []struct {
+		name string
+		psk  *string
+		want []string
+	}{
+		{name: "unset", psk: nil, want: nil},
+		{name: "explicit empty", psk: &empty, want: []string{mdm.KeyPreSharedKey}},
+		{name: "sentinel echo", psk: &sentinel, want: nil},
+		{name: "same value", psk: &same, want: nil},
+		{name: "divergent", psk: &other, want: []string{mdm.KeyPreSharedKey}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, MDMConflicts(ConfigInput{PreSharedKey: tc.psk}, policy))
+		})
+	}
+}
+
+func TestMDMConflicts_RemoteJobsAndLocalMetrics(t *testing.T) {
+	policy := mdm.NewPolicy(map[string]any{
+		mdm.KeyRemoteJobsAllowed:   false,
+		mdm.KeyEnableLocalMetrics:  true,
+		mdm.KeyLocalMetricsAddress: "127.0.0.1:9999",
+	})
+	sameAddr := "127.0.0.1:9999"
+	otherAddr := "0.0.0.0:9999"
+	emptyAddr := ""
+
+	tests := []struct {
+		name  string
+		input ConfigInput
+		want  []string
+	}{
+		{name: "unset", input: ConfigInput{}, want: nil},
+		{name: "echo", input: ConfigInput{
+			RemoteJobsAllowed:   boolPtr(false),
+			LocalMetricsEnabled: boolPtr(true),
+			LocalMetricsAddress: &sameAddr,
+		}, want: nil},
+		{name: "remote jobs divergent", input: ConfigInput{RemoteJobsAllowed: boolPtr(true)}, want: []string{mdm.KeyRemoteJobsAllowed}},
+		{name: "metrics disabled", input: ConfigInput{LocalMetricsEnabled: boolPtr(false)}, want: []string{mdm.KeyEnableLocalMetrics}},
+		{name: "metrics address divergent", input: ConfigInput{LocalMetricsAddress: &otherAddr}, want: []string{mdm.KeyLocalMetricsAddress}},
+		{name: "metrics address explicit empty", input: ConfigInput{LocalMetricsAddress: &emptyAddr}, want: []string{mdm.KeyLocalMetricsAddress}},
+		{name: "all divergent", input: ConfigInput{
+			RemoteJobsAllowed:   boolPtr(true),
+			LocalMetricsEnabled: boolPtr(false),
+			LocalMetricsAddress: &otherAddr,
+		}, want: []string{mdm.KeyRemoteJobsAllowed, mdm.KeyEnableLocalMetrics, mdm.KeyLocalMetricsAddress}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, MDMConflicts(tc.input, policy))
+		})
+	}
+}
+
 func boolPtr(b bool) *bool { return &b }
diff --git a/client/internal/profilemanager/config_optional_fields_test.go b/client/internal/profilemanager/config_optional_fields_test.go
new file mode 100644
index 000000000..9b74e2217
--- /dev/null
+++ b/client/internal/profilemanager/config_optional_fields_test.go
@@ -0,0 +1,131 @@
+package profilemanager
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// optionalBoolFields lists the *bool fields of Config by name, derived from the
+// type so a field added later is covered without touching these tests.
+func optionalBoolFields() []string {
+	pointerToBool := reflect.TypeOf((*bool)(nil))
+
+	var fields []string
+	configType := reflect.TypeOf(Config{})
+	for i := range configType.NumField() {
+		field := configType.Field(i)
+		if field.Type == pointerToBool && field.Tag.Get("json") != "-" {
+			fields = append(fields, field.Name)
+		}
+	}
+	return fields
+}
+
+func requireNoUnsetOptionalBool(t *testing.T, config *Config, context string) {
+	t.Helper()
+
+	value := reflect.ValueOf(*config)
+	for _, name := range optionalBoolFields() {
+		require.False(t, value.FieldByName(name).IsNil(),
+			"%s left %s unset, so its readers have to invent a default and a diff of it compares presence instead of value", context, name)
+	}
+}
+
+// An optional bool must not be tristate. While one can be nil, true or false,
+// every reader has to invent the meaning of nil, and — the reason this test
+// exists — a diff of the config ends up comparing presence rather than value:
+// that is what made the update-settings gate refuse `netbird up` for a client
+// restating its own defaults. apply() is where a config becomes complete, so
+// the invariant belongs to it: no *bool may come out of apply() unset.
+func TestApplyLeavesNoOptionalBoolUnset(t *testing.T) {
+	require.NotEmpty(t, optionalBoolFields(), "the invariant is only meaningful while Config has optional bools")
+
+	t.Run("a config built from scratch", func(t *testing.T) {
+		config := newConfigSkeleton()
+		_, err := config.apply(ConfigInput{})
+		require.NoError(t, err)
+
+		requireNoUnsetOptionalBool(t, config, "apply on a new config")
+	})
+
+	t.Run("a config file that predates every optional field", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "legacy.json")
+		require.NoError(t, os.WriteFile(path, []byte(`{"WgIface":"wt0"}`), 0o600))
+
+		config, err := GetExistingConfig(path)
+		require.NoError(t, err)
+
+		requireNoUnsetOptionalBool(t, config, "a read of a legacy config")
+	})
+
+	t.Run("a config file that stores them as null", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "null.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path})
+		require.NoError(t, err)
+		unsetOnDisk(t, path, optionalBoolFields()...)
+
+		config, err := GetExistingConfig(path)
+		require.NoError(t, err)
+
+		requireNoUnsetOptionalBool(t, config, "a read of a config storing nulls")
+	})
+}
+
+// The same invariant on disk: what a write leaves in the file is what the next
+// client to read it starts from, so no write may store a null.
+func TestNoWriteStoresAnUnsetOptionalBool(t *testing.T) {
+	requireNoNullOnDisk := func(t *testing.T, path string, context string) {
+		t.Helper()
+
+		raw, err := os.ReadFile(path)
+		require.NoError(t, err)
+
+		var stored map[string]json.RawMessage
+		require.NoError(t, json.Unmarshal(raw, &stored))
+
+		for _, name := range optionalBoolFields() {
+			value, present := stored[name]
+			require.True(t, present, "%s did not store %s at all", context, name)
+			require.NotEqual(t, "null", string(value), "%s stored %s as null", context, name)
+		}
+	}
+
+	t.Run("UpdateOrCreateConfig", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "created.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
+		require.NoError(t, err)
+
+		requireNoNullOnDisk(t, path, "UpdateOrCreateConfig")
+	})
+
+	t.Run("UpdateConfig over a config storing nulls", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "stored.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path})
+		require.NoError(t, err)
+		unsetOnDisk(t, path, optionalBoolFields()...)
+
+		_, err = UpdateConfig(ConfigInput{ConfigPath: path, ManagementURL: "https://mgmt.example.com"})
+		require.NoError(t, err)
+
+		requireNoNullOnDisk(t, path, "UpdateConfig")
+	})
+
+	// Renaming used to copy the file back through a bare Unmarshal, which
+	// preserved the nulls a pre-fix client had written.
+	t.Run("RenameProfile", func(t *testing.T) {
+		withTestSM(t, func(sm *ServiceManager, username string) {
+			created, err := sm.AddProfile("work", username)
+			require.NoError(t, err)
+			unsetOnDisk(t, created.Path, optionalBoolFields()...)
+
+			require.NoError(t, sm.RenameProfile(created.ID, username, "office"))
+
+			requireNoNullOnDisk(t, created.Path, "RenameProfile")
+		})
+	})
+}
diff --git a/client/internal/profilemanager/config_probe_test.go b/client/internal/profilemanager/config_probe_test.go
new file mode 100644
index 000000000..35a179a84
--- /dev/null
+++ b/client/internal/profilemanager/config_probe_test.go
@@ -0,0 +1,96 @@
+package profilemanager
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// writeCertPair writes a throwaway certificate and key, so apply() has
+// something real to load rather than a missing file it would only log about.
+func writeCertPair(t *testing.T) (certPath, keyPath string) {
+	t.Helper()
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	template := x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "probe-test"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+	}
+	der, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
+	require.NoError(t, err)
+
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	require.NoError(t, err)
+
+	dir := t.TempDir()
+	certPath = filepath.Join(dir, "client.crt")
+	keyPath = filepath.Join(dir, "client.key")
+	require.NoError(t, os.WriteFile(certPath, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0o600))
+	require.NoError(t, os.WriteFile(keyPath, pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}), 0o600))
+	return certPath, keyPath
+}
+
+// The dry run behind the update-settings gate must not read the mTLS pair off
+// disk. The loaded pair feeds the connection, never the comparison, and the
+// gate runs it on every SetConfig and Login — twice per request — including the
+// ones it refuses.
+func TestProbeDoesNotLoadTheCertificatePair(t *testing.T) {
+	certPath, keyPath := writeCertPair(t)
+
+	t.Run("a real apply loads it", func(t *testing.T) {
+		config := newConfigSkeleton()
+		config.ClientCertPath, config.ClientCertKeyPath = certPath, keyPath
+
+		_, err := config.apply(ConfigInput{})
+		require.NoError(t, err)
+		require.NotNil(t, config.ClientCertKeyPair, "the connection would have no client certificate")
+	})
+
+	t.Run("a probe does not", func(t *testing.T) {
+		config := newConfigSkeleton()
+		config.ClientCertPath, config.ClientCertKeyPath = certPath, keyPath
+		config.probing = true
+
+		_, err := config.apply(ConfigInput{})
+		require.NoError(t, err)
+		require.Nil(t, config.ClientCertKeyPair, "the dry run read the certificate off disk")
+	})
+
+	// And the verdict is the same either way, which is the only thing the gate
+	// asks of the probe.
+	t.Run("the verdict is unaffected", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "mtls.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{
+			ConfigPath:        path,
+			ManagementURL:     DefaultManagementURL,
+			ClientCertPath:    certPath,
+			ClientCertKeyPath: keyPath,
+		})
+		require.NoError(t, err)
+
+		stored, err := GetExistingConfig(path)
+		require.NoError(t, err)
+
+		changed, err := stored.WouldChange(ConfigInput{ClientCertPath: certPath, ClientCertKeyPath: keyPath})
+		require.NoError(t, err)
+		require.False(t, changed, "restating the stored certificate paths is not a change")
+
+		changed, err = stored.WouldChange(ConfigInput{ClientCertPath: filepath.Join(t.TempDir(), "other.crt")})
+		require.NoError(t, err)
+		require.True(t, changed, "a different certificate path is a change")
+	})
+}
diff --git a/client/internal/profilemanager/config_test.go b/client/internal/profilemanager/config_test.go
index 736ff3412..a461aa71f 100644
--- a/client/internal/profilemanager/config_test.go
+++ b/client/internal/profilemanager/config_test.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/internal/routemanager/dynamic"
+	"github.com/netbirdio/netbird/client/mdm"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -195,7 +196,7 @@ func TestWireguardPortZeroExplicit(t *testing.T) {
 	assert.Equal(t, 0, config.WgPort, "WgPort should be 0 when explicitly set by user")
 
 	// Verify it persists
-	readConfig, err := GetConfig(configPath)
+	readConfig, err := GetExistingConfig(configPath)
 	require.NoError(t, err)
 	assert.Equal(t, 0, readConfig.WgPort, "WgPort should remain 0 after reading from file")
 }
@@ -271,6 +272,83 @@ func TestUpdateConfigServerSSHAllowedNotSet(t *testing.T) {
 	}
 }
 
+func TestUpdateConfigRemoteJobsAllowed(t *testing.T) {
+	// Unlike SSH (which defaults on for legacy configs), remote jobs are an
+	// explicit opt-in: a pre-existing config with no value materializes to off.
+	t.Run("legacy config defaults off", func(t *testing.T) {
+		configPath := filepath.Join(t.TempDir(), "config.json")
+		require.NoError(t, os.WriteFile(configPath, []byte("{}"), 0600))
+
+		config, err := UpdateConfig(ConfigInput{ConfigPath: configPath})
+		require.NoError(t, err)
+		require.NotNil(t, config.RemoteJobsAllowed, "RemoteJobsAllowed should be materialized")
+		assert.False(t, *config.RemoteJobsAllowed, "remote jobs must default off")
+	})
+
+	for _, tt := range []struct {
+		name  string
+		input *bool
+		want  bool
+	}{
+		{"enable", util.True(), true},
+		{"disable", util.False(), false},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			configPath := filepath.Join(t.TempDir(), "config.json")
+			require.NoError(t, os.WriteFile(configPath, []byte("{}"), 0600))
+
+			config, err := UpdateConfig(ConfigInput{ConfigPath: configPath, RemoteJobsAllowed: tt.input})
+			require.NoError(t, err)
+			require.NotNil(t, config.RemoteJobsAllowed)
+			assert.Equal(t, tt.want, *config.RemoteJobsAllowed)
+		})
+	}
+}
+
+func TestApplyMDMPolicyRemoteJobs(t *testing.T) {
+	t.Run("enables remote jobs and sets the upload URL override", func(t *testing.T) {
+		cfg := &Config{}
+		cfg.applyMDMPolicy(mdm.NewPolicy(map[string]any{
+			mdm.KeyRemoteJobsAllowed: true,
+			mdm.KeyBundleUploadURL:   "https://upload.example.com",
+		}))
+		require.NotNil(t, cfg.RemoteJobsAllowed)
+		assert.True(t, *cfg.RemoteJobsAllowed, "MDM allowRemoteJobs must enable the flag")
+		assert.Equal(t, "https://upload.example.com", cfg.DebugBundleUploadURL, "MDM upload URL override must be applied")
+	})
+
+	t.Run("a non-https upload URL is rejected", func(t *testing.T) {
+		cfg := &Config{}
+		cfg.applyMDMPolicy(mdm.NewPolicy(map[string]any{
+			mdm.KeyBundleUploadURL: "http://insecure.example.com",
+		}))
+		assert.Empty(t, cfg.DebugBundleUploadURL, "a non-https upload URL must be skipped")
+	})
+
+	t.Run("dropping the key clears a previously-applied override", func(t *testing.T) {
+		cfg := &Config{DebugBundleUploadURL: "https://old.example.com"}
+		// A replacement policy that no longer carries the key must not leave
+		// the old upload target directing bundles.
+		cfg.applyMDMPolicy(mdm.NewPolicy(map[string]any{mdm.KeyRemoteJobsAllowed: true}))
+		assert.Empty(t, cfg.DebugBundleUploadURL, "the stale upload URL override must be cleared")
+	})
+
+	t.Run("an empty replacement policy clears a previously-applied override", func(t *testing.T) {
+		cfg := &Config{DebugBundleUploadURL: "https://old.example.com"}
+		// A policy that becomes empty entirely hits the IsEmpty early return;
+		// the override must still be cleared rather than surviving on the
+		// reused Config instance.
+		cfg.applyMDMPolicy(mdm.NewPolicy(map[string]any{}))
+		assert.Empty(t, cfg.DebugBundleUploadURL, "the stale upload URL override must be cleared when the policy empties")
+	})
+
+	t.Run("an invalid upload URL clears a previously-applied override (fail closed)", func(t *testing.T) {
+		cfg := &Config{DebugBundleUploadURL: "https://old.example.com"}
+		cfg.applyMDMPolicy(mdm.NewPolicy(map[string]any{mdm.KeyBundleUploadURL: "not-a-url"}))
+		assert.Empty(t, cfg.DebugBundleUploadURL, "an invalid override must fail closed, not keep the stale target")
+	})
+}
+
 func TestUpdateOldManagementURL(t *testing.T) {
 	origProber := newMgmProber
 	newMgmProber = func(_ context.Context, _ string, _ wgtypes.Key, _ bool) (mgmProber, error) {
diff --git a/client/internal/profilemanager/config_would_change_test.go b/client/internal/profilemanager/config_would_change_test.go
new file mode 100644
index 000000000..6b140030f
--- /dev/null
+++ b/client/internal/profilemanager/config_would_change_test.go
@@ -0,0 +1,529 @@
+package profilemanager
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/shared/management/domain"
+)
+
+func seededConfig(t *testing.T) *Config {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "seeded.json")
+	cfg, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: "https://api.netbird.io:443",
+		PreSharedKey:  strPointer("stored-key"),
+	})
+	require.NoError(t, err)
+	return cfg
+}
+
+func strPointer(s string) *string { return &s }
+
+func intPtr(i int) *int { return &i }
+
+func TestWouldChange(t *testing.T) {
+	tests := []struct {
+		name  string
+		input ConfigInput
+		want  bool
+	}{
+		{name: "empty input", input: ConfigInput{}, want: false},
+		{name: "same management URL", input: ConfigInput{ManagementURL: "https://api.netbird.io:443"}, want: false},
+		{name: "management URL without its default port", input: ConfigInput{ManagementURL: "https://api.netbird.io"}, want: false},
+		{name: "different management URL", input: ConfigInput{ManagementURL: "https://other.example:443"}, want: true},
+		{name: "same pre-shared key", input: ConfigInput{PreSharedKey: strPointer("stored-key")}, want: false},
+		{name: "redacted pre-shared key", input: ConfigInput{PreSharedKey: strPointer("**********")}, want: false},
+		{name: "different pre-shared key", input: ConfigInput{PreSharedKey: strPointer("other-key")}, want: true},
+		{name: "new interface blacklist entry", input: ConfigInput{ExtraIFaceBlackList: []string{"nb-probe0"}}, want: true},
+		{name: "blacklist entry already present", input: ConfigInput{ExtraIFaceBlackList: []string{"lo"}}, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := seededConfig(t)
+
+			changed, err := cfg.WouldChange(tt.input)
+			require.NoError(t, err)
+			require.Equal(t, tt.want, changed)
+		})
+	}
+}
+
+// The dry run must not be observable on the config it is run against: it
+// decides whether a write is allowed, it does not perform one.
+func TestWouldChangeLeavesTheConfigAlone(t *testing.T) {
+	cfg := seededConfig(t)
+	blacklist := len(cfg.IFaceBlackList)
+
+	changed, err := cfg.WouldChange(ConfigInput{
+		ManagementURL:       "https://other.example:443",
+		PreSharedKey:        strPointer("other-key"),
+		ExtraIFaceBlackList: []string{"nb-probe0"},
+		DNSLabels:           domain.FromPunycodeList([]string{"probe"}),
+		NATExternalIPs:      []string{"1.2.3.4"},
+	})
+	require.NoError(t, err)
+	require.True(t, changed)
+
+	require.Equal(t, "https://api.netbird.io:443", cfg.ManagementURL.String())
+	require.Equal(t, "stored-key", cfg.PreSharedKey)
+	require.Len(t, cfg.IFaceBlackList, blacklist)
+	require.Empty(t, cfg.DNSLabels)
+	require.Empty(t, cfg.NATExternalIPs)
+}
+
+// A nil config means the profile holds nothing yet, so the baseline is what
+// the daemon would create for it.
+func TestWouldChangeWithoutAStoredConfig(t *testing.T) {
+	var cfg *Config
+
+	changed, err := cfg.WouldChange(ConfigInput{})
+	require.NoError(t, err)
+	require.False(t, changed, "a request carrying nothing cannot change anything")
+
+	changed, err = cfg.WouldChange(ConfigInput{ManagementURL: DefaultManagementURL})
+	require.NoError(t, err)
+	require.False(t, changed, "the default management URL is what would be written anyway")
+
+	changed, err = cfg.WouldChange(ConfigInput{ManagementURL: "https://other.example:443"})
+	require.NoError(t, err)
+	require.True(t, changed)
+}
+
+func TestWouldChangeReportsAnInvalidInput(t *testing.T) {
+	cfg := seededConfig(t)
+
+	_, err := cfg.WouldChange(ConfigInput{ManagementURL: "not-a-url"})
+	require.Error(t, err)
+}
+
+// Reads must not write. A config file missing a field apply() fills in (MTU,
+// here) is what used to trigger the write-back.
+func TestReadsDoNotWriteTheConfigBack(t *testing.T) {
+	denormalized := []byte(`{"WgIface":"wt0"}`)
+
+	for name, read := range map[string]func(string) (*Config, error){
+		"GetExistingConfig":   GetExistingConfig,
+		"ReadConfigOrDefault": ReadConfigOrDefault,
+	} {
+		t.Run(name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "profile.json")
+			require.NoError(t, os.WriteFile(path, denormalized, 0o600))
+
+			cfg, err := read(path)
+			require.NoError(t, err)
+			require.Equal(t, uint16(iface.DefaultMTU), cfg.MTU, "the returned config is still normalized in memory")
+			require.Empty(t, cfg.PrivateKey, "a read must not mint an identity either")
+
+			after, err := os.ReadFile(path)
+			require.NoError(t, err)
+			require.Equal(t, string(denormalized), string(after), "%s rewrote the config file", name)
+		})
+	}
+}
+
+// ReadConfigOrDefault resolves a default config for a profile that has no file
+// yet, and that must not create the file either.
+func TestReadConfigDoesNotCreateTheFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "absent.json")
+
+	cfg, err := ReadConfigOrDefault(path)
+	require.NoError(t, err)
+	require.Equal(t, DefaultManagementURL, cfg.ManagementURL.String())
+
+	_, err = os.Stat(path)
+	require.True(t, os.IsNotExist(err), "ReadConfigOrDefault created the config file")
+}
+
+// The identity is the one thing a read cannot recompute, so it is provisioned
+// on request and its caller persists it.
+func TestEnsureIdentity(t *testing.T) {
+	cfg := newConfigSkeleton()
+
+	generated, err := cfg.EnsureIdentity()
+	require.NoError(t, err)
+	require.True(t, generated)
+	require.NotEmpty(t, cfg.PrivateKey)
+	require.NotEmpty(t, cfg.SSHKey)
+
+	key := cfg.PrivateKey
+	generated, err = cfg.EnsureIdentity()
+	require.NoError(t, err)
+	require.False(t, generated, "a config that already has an identity keeps it")
+	require.Equal(t, key, cfg.PrivateKey)
+}
+
+// One endpoint written several ways is one endpoint. A gate that compared
+// spellings refused a client restating its own management URL with a trailing
+// slash, which is a normal way to write it.
+func TestSameServiceURL(t *testing.T) {
+	tests := []struct {
+		a, b string
+		want bool
+	}{
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com:443", want: true},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com/", want: true},
+		{a: "https://mgmt.example.com/", b: "https://mgmt.example.com:443/", want: true},
+		{a: "https://MGMT.example.com", b: "https://mgmt.example.com", want: true},
+		{a: "http://mgmt.example.com", b: "http://mgmt.example.com:80", want: true},
+		{a: "https://mgmt.example.com", b: "http://mgmt.example.com", want: false},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com:8443", want: false},
+		{a: "https://mgmt.example.com", b: "https://other.example.com", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.a+" vs "+tt.b, func(t *testing.T) {
+			a, err := ParseServiceURL("a", tt.a)
+			require.NoError(t, err)
+			b, err := ParseServiceURL("b", tt.b)
+			require.NoError(t, err)
+
+			require.Equal(t, tt.want, SameServiceURL(a, b))
+			require.Equal(t, tt.want, SameServiceURL(b, a), "the comparison must be symmetric")
+		})
+	}
+}
+
+// The same spellings, through the dry run the update-settings gate uses.
+func TestWouldChangeIgnoresURLSpelling(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "seeded.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: "https://mgmt.example.com",
+	})
+	require.NoError(t, err)
+
+	cfg, err := GetExistingConfig(path)
+	require.NoError(t, err)
+
+	for _, spelling := range []string{
+		"https://mgmt.example.com",
+		"https://mgmt.example.com/",
+		"https://mgmt.example.com:443",
+		"https://mgmt.example.com:443/",
+		"https://MGMT.example.com",
+	} {
+		changed, err := cfg.WouldChange(ConfigInput{ManagementURL: spelling})
+		require.NoError(t, err)
+		require.False(t, changed, "%q is the stored endpoint written differently", spelling)
+	}
+
+	changed, err := cfg.WouldChange(ConfigInput{ManagementURL: "https://mgmt.example.com:8443"})
+	require.NoError(t, err)
+	require.True(t, changed, "a different port is a different endpoint")
+}
+
+// The dry-run baseline exists to be compared against and discarded, so it must
+// not mint keys — the CLI's login backoff loop would otherwise log a fresh
+// "generated new Wireguard key" on every attempt.
+func TestDryRunBaselineDoesNotGenerateKeys(t *testing.T) {
+	baseline, err := newDryRunBaseline(filepath.Join(t.TempDir(), "absent.json"))
+	require.NoError(t, err)
+
+	require.Empty(t, baseline.PrivateKey, "generated a WireGuard key for a throwaway config")
+	require.Empty(t, baseline.SSHKey, "generated an SSH key for a throwaway config")
+
+	// Everything the comparison actually looks at is still the default config.
+	require.Equal(t, DefaultManagementURL, baseline.ManagementURL.String())
+	require.Equal(t, uint16(iface.DefaultMTU), baseline.MTU)
+	require.Equal(t, iface.DefaultWgPort, baseline.WgPort)
+}
+
+// A stored profile can carry no identity — a mobile logout clears the keys in
+// place — so the next config write has to mint one, which is what keeps the
+// following login from dialing management with an empty key.
+func TestUpdateConfigProvisionsAMissingIdentity(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "logged-out.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: "https://api.netbird.io:443",
+	})
+	require.NoError(t, err)
+
+	// Stand in for the logout, which zeroes the keys and writes the config out.
+	loggedOut, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	loggedOut.PrivateKey = ""
+	loggedOut.SSHKey = ""
+	require.NoError(t, WriteOutConfig(path, loggedOut))
+
+	cfg, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path})
+	require.NoError(t, err)
+	require.NotEmpty(t, cfg.PrivateKey, "the write path did not provision an identity")
+	require.NotEmpty(t, cfg.SSHKey)
+
+	persisted, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	require.Equal(t, cfg.PrivateKey, persisted.PrivateKey, "the provisioned identity was not persisted")
+}
+
+// A config that carries no sync message version must not make the dry run
+// panic: the gate runs inside a request handler, where failing closed is the
+// worst acceptable outcome.
+func TestWouldChangeWithoutAStoredSyncMessageVersion(t *testing.T) {
+	cfg := seededConfig(t)
+	require.Nil(t, cfg.SyncMessageVersion, "the fixture is only useful while the field starts out unset")
+
+	version := 2
+	changed, err := cfg.WouldChange(ConfigInput{SyncMessageVersion: &version})
+	require.NoError(t, err)
+	require.True(t, changed)
+	require.Nil(t, cfg.SyncMessageVersion, "the dry run set the version on the stored config")
+}
+
+// Restating the certificate paths a config already holds is not a change, for
+// the same reason restating any other value is not.
+func TestWouldChangeIgnoresRestatedCertificatePaths(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "mtls.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:        path,
+		ManagementURL:     "https://api.netbird.io:443",
+		ClientCertPath:    "/etc/netbird/client.crt",
+		ClientCertKeyPath: "/etc/netbird/client.key",
+	})
+	require.NoError(t, err)
+
+	cfg, err := GetExistingConfig(path)
+	require.NoError(t, err)
+
+	changed, err := cfg.WouldChange(ConfigInput{
+		ClientCertPath:    "/etc/netbird/client.crt",
+		ClientCertKeyPath: "/etc/netbird/client.key",
+	})
+	require.NoError(t, err)
+	require.False(t, changed, "the stored certificate paths were restated")
+
+	changed, err = cfg.WouldChange(ConfigInput{ClientCertPath: "/etc/netbird/other.crt"})
+	require.NoError(t, err)
+	require.True(t, changed, "a different certificate path is a change")
+}
+
+// A read that lands on a missing file must not hand back keys: nothing would
+// write them down, so the caller would connect with an identity that changes on
+// the next run and registers a second peer.
+func TestReadConfigOrDefaultCarriesNoIdentity(t *testing.T) {
+	cfg, err := ReadConfigOrDefault(filepath.Join(t.TempDir(), "absent.json"))
+	require.NoError(t, err)
+
+	require.Empty(t, cfg.PrivateKey, "a read minted a WireGuard key")
+	require.Empty(t, cfg.SSHKey, "a read minted an SSH key")
+
+	// So the caller's own EnsureIdentity is the one that reports the work, and
+	// therefore the one that triggers the write.
+	generated, err := cfg.EnsureIdentity()
+	require.NoError(t, err)
+	require.True(t, generated, "the provisioning caller could not tell it had to persist the identity")
+}
+
+// CreateInMemoryConfig is the opposite contract: its callers connect with what
+// they get back, so it does carry an identity.
+func TestCreateInMemoryConfigCarriesAnIdentity(t *testing.T) {
+	cfg, err := CreateInMemoryConfig(ConfigInput{ManagementURL: "https://api.netbird.io:443"})
+	require.NoError(t, err)
+
+	require.NotEmpty(t, cfg.PrivateKey)
+	require.NotEmpty(t, cfg.SSHKey)
+}
+
+// The admin panel is opened, not dialed, so its path identifies it. Comparing
+// it as a bare endpoint left a custom panel URL unable to change.
+func TestAdminURLPathIsPartOfTheIdentity(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "panel.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath: path,
+		AdminURL:   "https://app.example.com/netbird",
+	})
+	require.NoError(t, err)
+
+	cfg, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	require.Equal(t, "https://app.example.com:443/netbird", cfg.AdminURL.String())
+
+	// Equivalent spellings of the same panel are still not a change.
+	for _, same := range []string{
+		"https://app.example.com/netbird",
+		"https://app.example.com:443/netbird",
+		"https://app.example.com/netbird/",
+		"https://APP.example.com/netbird",
+	} {
+		changed, err := cfg.WouldChange(ConfigInput{AdminURL: same})
+		require.NoError(t, err)
+		require.False(t, changed, "%q is the stored panel written differently", same)
+	}
+
+	// A different path is a different panel, and it must be persisted.
+	changed, err := cfg.WouldChange(ConfigInput{AdminURL: "https://app.example.com/other"})
+	require.NoError(t, err)
+	require.True(t, changed, "a different panel path is a change")
+
+	updated, err := UpdateConfig(ConfigInput{ConfigPath: path, AdminURL: "https://app.example.com/other"})
+	require.NoError(t, err)
+	require.Equal(t, "https://app.example.com:443/other", updated.AdminURL.String(), "the new panel path was not persisted")
+}
+
+// unsetOnDisk rewrites the stored config so the named fields carry a JSON null,
+// which is how a profile written before apply() resolved them looks on disk.
+// It synthesizes that state: no write produces it any more.
+func unsetOnDisk(t *testing.T, path string, fields ...string) {
+	t.Helper()
+
+	raw, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	var stored map[string]json.RawMessage
+	require.NoError(t, json.Unmarshal(raw, &stored))
+
+	for _, field := range fields {
+		_, present := stored[field]
+		require.True(t, present, "%s is not a field of the stored config", field)
+		stored[field] = json.RawMessage("null")
+	}
+
+	rewritten, err := json.Marshal(stored)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(path, rewritten, 0600))
+}
+
+// Seven fields mean "the effective default" when they hold no value, and every
+// profile written before apply() resolved them holds them as null. Restating
+// that default is asking for no change — and the CLI restates it on every
+// `netbird up`, because a flag set through an environment variable is a flag
+// pflag reports as Changed. Judging those restatements as changes made the
+// update-settings gate refuse `netbird up` outright for a client configured
+// through the environment, which is the shape of a Kubernetes deployment.
+//
+// A login now writes those fields set, so the fixture puts the null state back
+// on disk with unsetOnDisk instead of getting it from a login.
+func TestWouldChangeIgnoresRestatedDefaultsOfUnsetFields(t *testing.T) {
+	networkMonitorDefault := runtime.GOOS == "windows" || runtime.GOOS == "darwin"
+
+	tests := []struct {
+		field       string
+		theDefault  ConfigInput
+		theOtherWay ConfigInput
+	}{
+		{"EnableSSHRoot",
+			ConfigInput{EnableSSHRoot: boolPtr(false)}, ConfigInput{EnableSSHRoot: boolPtr(true)}},
+		{"EnableSSHSFTP",
+			ConfigInput{EnableSSHSFTP: boolPtr(false)}, ConfigInput{EnableSSHSFTP: boolPtr(true)}},
+		{"EnableSSHLocalPortForwarding",
+			ConfigInput{EnableSSHLocalPortForwarding: boolPtr(false)}, ConfigInput{EnableSSHLocalPortForwarding: boolPtr(true)}},
+		{"EnableSSHRemotePortForwarding",
+			ConfigInput{EnableSSHRemotePortForwarding: boolPtr(false)}, ConfigInput{EnableSSHRemotePortForwarding: boolPtr(true)}},
+		{"DisableSSHAuth",
+			ConfigInput{DisableSSHAuth: boolPtr(false)}, ConfigInput{DisableSSHAuth: boolPtr(true)}},
+		{"SSHJWTCacheTTL",
+			ConfigInput{SSHJWTCacheTTL: intPtr(0)}, ConfigInput{SSHJWTCacheTTL: intPtr(300)}},
+		{"NetworkMonitor",
+			ConfigInput{NetworkMonitor: boolPtr(networkMonitorDefault)}, ConfigInput{NetworkMonitor: boolPtr(!networkMonitorDefault)}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.field, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "unset.json")
+			_, err := UpdateOrCreateConfig(ConfigInput{
+				ConfigPath:    path,
+				ManagementURL: "https://api.netbird.io:443",
+			})
+			require.NoError(t, err)
+			unsetOnDisk(t, path, tt.field)
+
+			cfg, err := GetExistingConfig(path)
+			require.NoError(t, err)
+
+			changed, err := cfg.WouldChange(tt.theDefault)
+			require.NoError(t, err)
+			require.False(t, changed, "restating the default of an unset %s was judged a change", tt.field)
+
+			// The gate still has to refuse a request that does ask for something.
+			changed, err = cfg.WouldChange(tt.theOtherWay)
+			require.NoError(t, err)
+			require.True(t, changed, "asking for a non-default %s is a change", tt.field)
+		})
+	}
+}
+
+// The verdict must not depend on where the caller got the config from. Readers
+// normalize what they hand out, but apply() signals "I filled in a default"
+// through the same bool as "the input changed something", so a config that
+// never passed through a read would otherwise report a change for an input
+// that asks for nothing.
+func TestWouldChangeNormalizesBeforeMeasuring(t *testing.T) {
+	rawConfig := func(t *testing.T) *Config {
+		t.Helper()
+
+		cfg := &Config{WgIface: iface.WgInterfaceDefault}
+		require.Nil(t, cfg.ServerSSHAllowed, "the fixture is only useful while the config is not normalized")
+		require.Nil(t, cfg.EnableSSHRoot)
+		require.Empty(t, cfg.IFaceBlackList)
+		return cfg
+	}
+
+	changed, err := rawConfig(t).WouldChange(ConfigInput{})
+	require.NoError(t, err)
+	require.False(t, changed, "an input carrying nothing cannot change anything")
+
+	changed, err = rawConfig(t).WouldChange(ConfigInput{EnableSSHRoot: boolPtr(false)})
+	require.NoError(t, err)
+	require.False(t, changed, "the default of a field the config never held is not a change")
+
+	changed, err = rawConfig(t).WouldChange(ConfigInput{EnableSSHRoot: boolPtr(true)})
+	require.NoError(t, err)
+	require.True(t, changed, "a non-default value is still a change")
+}
+
+// A zero-padded port addresses the same port. The normalization itself belongs
+// to util.ServiceURLPort and is tested there; this asserts that the comparison
+// this package hands its callers inherits it.
+func TestServiceURLPortIsNormalizedNumerically(t *testing.T) {
+	padded, err := ParseServiceURL("padded", "https://mgmt.example.com:0443")
+	require.NoError(t, err)
+	plain, err := ParseServiceURL("plain", "https://mgmt.example.com:443")
+	require.NoError(t, err)
+
+	require.True(t, SameServiceURL(padded, plain))
+}
+
+// A list the profile does not have and a list the request empties are the same
+// thing: no NAT mappings, no DNS labels. The profile stores an absent list as
+// JSON null and reads it back as a nil slice, while `netbird up` sends the
+// emptied list — CleanNATExternalIPs / CleanDNSLabels — whenever the matching
+// environment variable is set to nothing, which a deployment template does by
+// default. Judging nil and empty as different made the gate refuse that start,
+// which is the very deadlock this branch exists to remove, on another field.
+func TestWouldChangeIgnoresAnEmptiedListThatWasAlreadyAbsent(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "lists.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
+	require.NoError(t, err)
+
+	stored, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	require.Nil(t, stored.NATExternalIPs, "the fixture is only useful while the stored list is absent")
+	require.Nil(t, stored.DNSLabels)
+
+	changed, err := stored.WouldChange(ConfigInput{NATExternalIPs: make([]string, 0)})
+	require.NoError(t, err)
+	require.False(t, changed, "emptying a NAT list the profile never had is not a change")
+
+	changed, err = stored.WouldChange(ConfigInput{DNSLabels: domain.List{}})
+	require.NoError(t, err)
+	require.False(t, changed, "emptying a DNS label list the profile never had is not a change")
+
+	// A list that does hold something still moves when the request empties it.
+	withEntries, err := UpdateConfig(ConfigInput{ConfigPath: path, NATExternalIPs: []string{"1.2.3.4"}})
+	require.NoError(t, err)
+	require.Equal(t, []string{"1.2.3.4"}, withEntries.NATExternalIPs)
+
+	changed, err = withEntries.WouldChange(ConfigInput{NATExternalIPs: make([]string, 0)})
+	require.NoError(t, err)
+	require.True(t, changed, "clearing a NAT list that had an entry is a change")
+}
diff --git a/client/internal/profilemanager/invoking_user.go b/client/internal/profilemanager/invoking_user.go
new file mode 100644
index 000000000..7ba612ffb
--- /dev/null
+++ b/client/internal/profilemanager/invoking_user.go
@@ -0,0 +1,121 @@
+package profilemanager
+
+import (
+	"fmt"
+	"os"
+	"os/user"
+	"path/filepath"
+	"runtime"
+	"strconv"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const envSudoUser = "SUDO_USER"
+
+var (
+	currentUser = user.Current
+	getegid     = os.Getegid
+	geteuid     = os.Geteuid
+	lookupUser  = user.Lookup
+)
+
+// InvokingUser returns the user a CLI invocation acts for. Under sudo that is
+// the user who ran sudo, not root: privileged flags force commands through
+// sudo, and resolving profiles as root would silently switch the daemon to
+// root's (default) profile instead of the invoking user's. An unmapped positive
+// process UID uses its numeric kernel identity; root, sudo lookup failures, and
+// unavailable platform identities still fail closed. Privilege decisions stay
+// on the kernel credentials of the daemon connection, which SUDO_USER (a plain
+// environment variable) can never influence; a forged value only selects a
+// profile root could select anyway.
+func InvokingUser() (*user.User, error) {
+	if u, ok := sudoInvokingUser(); ok {
+		return u, nil
+	}
+	// Fail closed instead of falling through to root: every caller feeds this
+	// username into profile-path resolution, so a lookup failure would resolve
+	// (and create) a root-owned profile namespace and switch the daemon onto it
+	// behind the invoking user's back.
+	if sudoActive() {
+		return nil, fmt.Errorf("resolve sudo invoking user %q: refusing to fall back to root", os.Getenv(envSudoUser))
+	}
+	u, err := currentUser()
+	if err == nil {
+		return u, nil
+	}
+
+	uid := geteuid()
+	if uid <= 0 {
+		return nil, err
+	}
+
+	log.Debugf("current user lookup for UID %d: %v; using numeric UID", uid, err)
+	uidString := strconv.Itoa(uid)
+	return &user.User{
+		Username: uidString,
+		Uid:      uidString,
+		Gid:      strconv.Itoa(getegid()),
+	}, nil
+}
+
+// IsPlainRoot reports that the process runs as root with no usable sudo
+// context: there is no invoking user to act for, so per-user resolution falls
+// back to root's own (empty) state. Callers use it to refuse ambiguous
+// operations instead of silently acting on the wrong profile.
+func IsPlainRoot() bool {
+	if geteuid() != 0 {
+		return false
+	}
+	_, ok := sudoInvokingUser()
+	return !ok
+}
+
+// MirrorIsAuthoritative reports whether the invoking user's local
+// active-profile mirror can be trusted as the profile selector. It cannot under
+// sudo (writes to it are skipped, so it goes stale) or as plain root (there is
+// no invoking user, so it falls back to root's own default). Callers use it to
+// decide whether to read the profile from the mirror or from the daemon.
+func MirrorIsAuthoritative() bool {
+	return !sudoActive() && !IsPlainRoot()
+}
+
+// sudoInvokingUser resolves SUDO_USER when the process runs as root under
+// sudo. Returns false whenever the sudo context is absent or unusable, in
+// which case callers fall back to the process user.
+func sudoInvokingUser() (*user.User, bool) {
+	if !sudoActive() {
+		return nil, false
+	}
+	name := os.Getenv(envSudoUser)
+	u, err := lookupUser(name)
+	if err != nil {
+		log.Warnf("sudo invoking user %q lookup: %v", name, err)
+		return nil, false
+	}
+	return u, true
+}
+
+// sudoActive reports a sudo context from the environment alone: write-skip
+// decisions key off it so a transient user lookup failure can never flip a
+// run from read-only to writing root-owned files into the user's directory.
+func sudoActive() bool {
+	if geteuid() != 0 {
+		return false
+	}
+	name := os.Getenv(envSudoUser)
+	return name != "" && name != "root"
+}
+
+// userBaseConfigDir mirrors os.UserConfigDir for a user other than the process
+// owner. Environment overrides (XDG_CONFIG_HOME) cannot be honoured here: under
+// sudo the environment is root's, not the invoking user's.
+func userBaseConfigDir(u *user.User) (string, error) {
+	if u.HomeDir == "" {
+		return "", fmt.Errorf("user %s has no home directory", u.Username)
+	}
+	if runtime.GOOS == "darwin" {
+		return filepath.Join(u.HomeDir, "Library", "Application Support"), nil
+	}
+	return filepath.Join(u.HomeDir, ".config"), nil
+}
diff --git a/client/internal/profilemanager/invoking_user_test.go b/client/internal/profilemanager/invoking_user_test.go
new file mode 100644
index 000000000..159d2616b
--- /dev/null
+++ b/client/internal/profilemanager/invoking_user_test.go
@@ -0,0 +1,298 @@
+package profilemanager
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"os/user"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestInvokingUserFallsBackToProcessUser(t *testing.T) {
+	t.Setenv(envSudoUser, "")
+
+	got, err := InvokingUser()
+	require.NoError(t, err)
+
+	current, err := user.Current()
+	require.NoError(t, err)
+	assert.Equal(t, current.Username, got.Username, "invoking user should match the process user without sudo")
+}
+
+func TestInvokingUserFailsClosedWithoutPositiveUID(t *testing.T) {
+	for _, uid := range []int{0, -1} {
+		t.Run(fmt.Sprintf("UID%d", uid), func(t *testing.T) {
+			t.Setenv(envSudoUser, "")
+			lookupErr := errors.New("current user unavailable")
+			fakeUnmappedUser(t, uid, 0, lookupErr)
+
+			got, err := InvokingUser()
+			require.ErrorIs(t, err, lookupErr)
+			assert.Nil(t, got, "root or unavailable UID must not become a synthetic identity")
+		})
+	}
+}
+
+func TestProfileFilePathUsesNumericIdentityForUnmappedNonRoot(t *testing.T) {
+	t.Setenv(envSudoUser, "")
+	fakeUnmappedUser(t, 1001230000, 0, errors.New("user: unknown userid 1001230000"))
+
+	profilesRoot := t.TempDir()
+	origDir := DefaultConfigPathDir
+	origOverride := ConfigDirOverride
+	DefaultConfigPathDir = profilesRoot
+	ConfigDirOverride = ""
+	t.Cleanup(func() {
+		DefaultConfigPathDir = origDir
+		ConfigDirOverride = origOverride
+	})
+
+	profileID := ID("0123456789abcdef0123456789abcdef")
+	got, err := (&Profile{ID: profileID}).FilePath()
+	require.NoError(t, err)
+	assert.Equal(t,
+		filepath.Join(profilesRoot, "1001230000", profileID.String()+".json"),
+		got,
+		"profile path should use the numeric UID namespace",
+	)
+
+	entries, err := os.ReadDir(profilesRoot)
+	require.NoError(t, err)
+	require.Len(t, entries, 1, "only the numeric UID directory should be created")
+	assert.Equal(t, "1001230000", entries[0].Name(), "profile namespace should be numeric")
+	assert.True(t, entries[0].IsDir(), "profile namespace should be a directory")
+}
+
+func TestSudoInvokingUserInactiveWithoutSudoContext(t *testing.T) {
+	t.Setenv(envSudoUser, "")
+	_, ok := sudoInvokingUser()
+	assert.False(t, ok)
+}
+
+func TestSudoInvokingUserIgnoresRoot(t *testing.T) {
+	t.Setenv(envSudoUser, "root")
+	origEuid := geteuid
+	geteuid = func() int { return 0 }
+	t.Cleanup(func() { geteuid = origEuid })
+
+	_, ok := sudoInvokingUser()
+	assert.False(t, ok, "sudo from a root shell must not redirect anything")
+	assert.False(t, sudoActive())
+	assert.True(t, IsPlainRoot())
+}
+
+func TestSudoInvokingUserResolvesInvokingUser(t *testing.T) {
+	fakeSudo(t, filepath.Join("/home", "misha"))
+
+	u, ok := sudoInvokingUser()
+	require.True(t, ok)
+	assert.Equal(t, "misha", u.Username)
+
+	got, err := InvokingUser()
+	require.NoError(t, err)
+	assert.Equal(t, "misha", got.Username)
+
+	assert.False(t, IsPlainRoot())
+}
+
+func TestInvokingUserFailsClosedWhenSudoLookupFails(t *testing.T) {
+	fakeSudo(t, filepath.Join("/home", "misha"))
+	lookupUser = func(string) (*user.User, error) { return nil, errors.New("nss unavailable") }
+
+	origCurrentUser := currentUser
+	currentUser = func() (*user.User, error) {
+		t.Fatal("currentUser must not be called after a sudo lookup failure")
+		return nil, errors.New("currentUser called unexpectedly")
+	}
+	t.Cleanup(func() { currentUser = origCurrentUser })
+
+	got, err := InvokingUser()
+	require.Error(t, err)
+	assert.Nil(t, got, "must not resolve to the root process user")
+}
+
+func TestProfileFilePathFailsClosedWhenSudoLookupFails(t *testing.T) {
+	profilesRoot := t.TempDir()
+	fakeSudo(t, filepath.Join("/home", "misha"))
+	lookupUser = func(string) (*user.User, error) { return nil, errors.New("nss unavailable") }
+
+	origDir := DefaultConfigPathDir
+	DefaultConfigPathDir = profilesRoot
+	t.Cleanup(func() { DefaultConfigPathDir = origDir })
+
+	p := &Profile{ID: "0123456789abcdef0123456789abcdef"}
+	_, err := p.FilePath()
+	require.Error(t, err)
+	assertNoEntries(t, profilesRoot)
+}
+
+func TestSudoActiveSurvivesLookupFailure(t *testing.T) {
+	fakeSudo(t, filepath.Join("/home", "misha"))
+	lookupUser = func(string) (*user.User, error) { return nil, errors.New("nss unavailable") }
+
+	_, ok := sudoInvokingUser()
+	assert.False(t, ok)
+	assert.True(t, sudoActive())
+	assert.True(t, IsPlainRoot())
+}
+
+func TestGetConfigDirUnderSudoIsReadOnly(t *testing.T) {
+	home := t.TempDir()
+	fakeSudo(t, home)
+
+	base, err := baseConfigDir()
+	require.NoError(t, err)
+	if runtime.GOOS == "darwin" {
+		assert.Equal(t, filepath.Join(home, "Library", "Application Support"), base)
+	} else {
+		assert.Equal(t, filepath.Join(home, ".config"), base)
+	}
+
+	dir, err := getConfigDir()
+	require.NoError(t, err)
+	assert.Equal(t, filepath.Join(base, "netbird"), dir)
+	assert.NoDirExists(t, dir)
+}
+
+func TestBaseConfigDirFailsClosedWhenSudoLookupFails(t *testing.T) {
+	fakeSudo(t, filepath.Join("/home", "misha"))
+	lookupUser = func(string) (*user.User, error) { return nil, errors.New("nss unavailable") }
+
+	_, err := baseConfigDir()
+	require.Error(t, err)
+
+	_, err = getConfigDir()
+	require.Error(t, err)
+}
+
+func TestSwitchProfileSkipsStateWriteUnderSudo(t *testing.T) {
+	home := t.TempDir()
+	fakeSudo(t, home)
+
+	pm := NewProfileManager()
+	require.NoError(t, pm.SwitchProfile(defaultProfileName))
+	assertNoEntries(t, home)
+}
+
+func TestSetProfileStateSkipsWriteUnderSudo(t *testing.T) {
+	home := t.TempDir()
+	fakeSudo(t, home)
+
+	pm := NewProfileManager()
+	require.NoError(t, pm.SetProfileState(defaultProfileName, &ProfileState{Email: "misha@example.com"}))
+	assertNoEntries(t, home)
+}
+
+func TestRemoveProfileStateSkipsRemoveUnderSudo(t *testing.T) {
+	home := t.TempDir()
+	stateDir := filepath.Join(home, ".config", "netbird")
+	if runtime.GOOS == "darwin" {
+		stateDir = filepath.Join(home, "Library", "Application Support", "netbird")
+	}
+	require.NoError(t, os.MkdirAll(stateDir, 0o700))
+	stateFile := filepath.Join(stateDir, "default.state.json")
+	require.NoError(t, os.WriteFile(stateFile, []byte(`{"email":"misha@example.com"}`), 0o600))
+
+	fakeSudo(t, home)
+	pm := NewProfileManager()
+	require.NoError(t, pm.RemoveProfileState("default"))
+	assert.FileExists(t, stateFile)
+}
+
+func TestUserBaseConfigDir(t *testing.T) {
+	u := &user.User{Username: "misha", HomeDir: filepath.Join("/home", "misha")}
+	dir, err := userBaseConfigDir(u)
+	require.NoError(t, err)
+	if runtime.GOOS == "darwin" {
+		assert.Equal(t, filepath.Join(u.HomeDir, "Library", "Application Support"), dir)
+	} else {
+		assert.Equal(t, filepath.Join(u.HomeDir, ".config"), dir)
+	}
+
+	_, err = userBaseConfigDir(&user.User{Username: "nohome"})
+	require.Error(t, err)
+}
+
+func TestIsPlainRoot(t *testing.T) {
+	t.Setenv(envSudoUser, "")
+	origEuid := geteuid
+	t.Cleanup(func() { geteuid = origEuid })
+
+	geteuid = func() int { return 1000 }
+	assert.False(t, IsPlainRoot())
+
+	geteuid = func() int { return 0 }
+	assert.True(t, IsPlainRoot())
+}
+
+func TestMirrorIsAuthoritative(t *testing.T) {
+	t.Setenv(envSudoUser, "")
+	origEuid := geteuid
+	t.Cleanup(func() { geteuid = origEuid })
+
+	geteuid = func() int { return 1000 }
+	assert.True(t, MirrorIsAuthoritative(), "a normal user's own mirror is authoritative")
+
+	geteuid = func() int { return 0 }
+	assert.False(t, MirrorIsAuthoritative(), "plain root has no authoritative mirror")
+}
+
+func TestMirrorIsAuthoritativeFalseUnderSudo(t *testing.T) {
+	fakeSudo(t, filepath.Join("/home", "misha"))
+	assert.False(t, MirrorIsAuthoritative(), "the sudo mirror is frozen, so it is not authoritative")
+}
+
+func fakeSudo(t *testing.T, home string) {
+	t.Helper()
+	t.Setenv(envSudoUser, "misha")
+
+	origEuid := geteuid
+	origLookup := lookupUser
+	origOverride := ConfigDirOverride
+	geteuid = func() int { return 0 }
+	lookupUser = func(name string) (*user.User, error) {
+		return &user.User{Username: name, Uid: "1234", Gid: "1234", HomeDir: home}, nil
+	}
+	ConfigDirOverride = ""
+	t.Cleanup(func() {
+		geteuid = origEuid
+		lookupUser = origLookup
+		ConfigDirOverride = origOverride
+	})
+}
+
+func fakeUnmappedUser(t *testing.T, uid, gid int, lookupErr error) {
+	t.Helper()
+
+	origCurrentUser := currentUser
+	origEuid := geteuid
+	origEgid := getegid
+	currentUser = func() (*user.User, error) { return nil, lookupErr }
+	geteuid = func() int { return uid }
+	getegid = func() int { return gid }
+	t.Cleanup(func() {
+		currentUser = origCurrentUser
+		geteuid = origEuid
+		getegid = origEgid
+	})
+}
+
+func assertNoEntries(t *testing.T, root string) {
+	t.Helper()
+	err := filepath.WalkDir(root, func(path string, _ fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if path != root {
+			t.Errorf("unexpected entry created under %s: %s", root, path)
+		}
+		return nil
+	})
+	require.NoError(t, err)
+}
diff --git a/client/internal/profilemanager/prefs.go b/client/internal/profilemanager/prefs.go
new file mode 100644
index 000000000..5613b0be3
--- /dev/null
+++ b/client/internal/profilemanager/prefs.go
@@ -0,0 +1,130 @@
+package profilemanager
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/netbirdio/netbird/util"
+)
+
+const prefsFileSuffix = ".prefs.json"
+
+var prefsMu sync.Mutex
+
+// Prefs is a namespaced per-profile preference store backed by a single JSON
+// file next to the profile config; it is deleted together with the profile.
+type Prefs struct {
+	path string
+}
+
+// ProfilePrefs returns the preference store of the profile identified by id.
+func (s *ServiceManager) ProfilePrefs(id ID, username string) (*Prefs, error) {
+	if !IsValidProfileFilenameStem(id) {
+		return nil, fmt.Errorf("invalid profile ID: %q", id)
+	}
+	if id == defaultProfileName {
+		return &Prefs{path: filepath.Join(filepath.Dir(DefaultConfigPath), id.String()+prefsFileSuffix)}, nil
+	}
+	configDir, err := s.getConfigDir(username)
+	if err != nil {
+		return nil, fmt.Errorf("get config directory for user %s: %w", username, err)
+	}
+	return &Prefs{path: filepath.Join(configDir, id.String()+prefsFileSuffix)}, nil
+}
+
+// Get unmarshals the namespace section into v and reports whether it exists.
+func (p *Prefs) Get(namespace string, v any) (bool, error) {
+	if namespace == "" {
+		return false, fmt.Errorf("empty prefs namespace")
+	}
+
+	prefsMu.Lock()
+	defer prefsMu.Unlock()
+
+	sections, err := readPrefsFile(p.path)
+	if err != nil {
+		return false, err
+	}
+	raw, ok := sections[namespace]
+	if !ok {
+		return false, nil
+	}
+	if err := json.Unmarshal(raw, v); err != nil {
+		return false, fmt.Errorf("decode prefs namespace %q: %w", namespace, err)
+	}
+	return true, nil
+}
+
+// Put stores v as the namespace section, replacing any previous value.
+func (p *Prefs) Put(namespace string, v any) error {
+	if namespace == "" {
+		return fmt.Errorf("empty prefs namespace")
+	}
+	raw, err := json.Marshal(v)
+	if err != nil {
+		return fmt.Errorf("encode prefs namespace %q: %w", namespace, err)
+	}
+
+	prefsMu.Lock()
+	defer prefsMu.Unlock()
+
+	sections, err := readPrefsFile(p.path)
+	if err != nil {
+		return err
+	}
+	sections[namespace] = raw
+	return writePrefsFile(p.path, sections)
+}
+
+// Remove deletes the namespace section; a missing one is not an error.
+func (p *Prefs) Remove(namespace string) error {
+	if namespace == "" {
+		return fmt.Errorf("empty prefs namespace")
+	}
+
+	prefsMu.Lock()
+	defer prefsMu.Unlock()
+
+	sections, err := readPrefsFile(p.path)
+	if err != nil {
+		return err
+	}
+	if _, ok := sections[namespace]; !ok {
+		return nil
+	}
+	delete(sections, namespace)
+	return writePrefsFile(p.path, sections)
+}
+
+func removePrefsFile(path string) error {
+	prefsMu.Lock()
+	defer prefsMu.Unlock()
+	return os.Remove(path)
+}
+
+func readPrefsFile(path string) (map[string]json.RawMessage, error) {
+	data, err := os.ReadFile(path)
+	if os.IsNotExist(err) {
+		return map[string]json.RawMessage{}, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("read prefs: %w", err)
+	}
+
+	sections := map[string]json.RawMessage{}
+	if err := json.Unmarshal(data, &sections); err != nil {
+		return nil, fmt.Errorf("decode prefs: %w", err)
+	}
+	return sections, nil
+}
+
+func writePrefsFile(path string, sections map[string]json.RawMessage) error {
+	if err := util.WriteJsonWithRestrictedPermission(context.Background(), path, sections); err != nil {
+		return fmt.Errorf("write prefs: %w", err)
+	}
+	return nil
+}
diff --git a/client/internal/profilemanager/prefs_test.go b/client/internal/profilemanager/prefs_test.go
new file mode 100644
index 000000000..692ade70f
--- /dev/null
+++ b/client/internal/profilemanager/prefs_test.go
@@ -0,0 +1,138 @@
+package profilemanager
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type testPrefsSection struct {
+	Mode uint8  `json:"mode"`
+	Dest string `json:"dest"`
+}
+
+func TestProfilePrefs_RoundTrip(t *testing.T) {
+	withTestSM(t, func(sm *ServiceManager, username string) {
+		created, err := sm.AddProfile("work", username)
+		require.NoError(t, err)
+
+		prefs, err := sm.ProfilePrefs(created.ID, username)
+		require.NoError(t, err)
+
+		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 2, Dest: "/tmp/x"}))
+		require.NoError(t, prefs.Put("other", map[string]int{"n": 1}))
+
+		var got testPrefsSection
+		found, err := prefs.Get("filedrop", &got)
+		require.NoError(t, err)
+		assert.True(t, found)
+		assert.Equal(t, testPrefsSection{Mode: 2, Dest: "/tmp/x"}, got)
+
+		var other map[string]int
+		found, err = prefs.Get("other", &other)
+		require.NoError(t, err)
+		assert.True(t, found)
+		assert.Equal(t, map[string]int{"n": 1}, other)
+	})
+}
+
+func TestProfilePrefs_GetMissingNamespace(t *testing.T) {
+	withTestSM(t, func(sm *ServiceManager, username string) {
+		created, err := sm.AddProfile("work", username)
+		require.NoError(t, err)
+
+		prefs, err := sm.ProfilePrefs(created.ID, username)
+		require.NoError(t, err)
+
+		var got testPrefsSection
+		found, err := prefs.Get("filedrop", &got)
+		require.NoError(t, err)
+		assert.False(t, found)
+	})
+}
+
+func TestProfilePrefs_RemoveNamespace(t *testing.T) {
+	withTestSM(t, func(sm *ServiceManager, username string) {
+		created, err := sm.AddProfile("work", username)
+		require.NoError(t, err)
+
+		prefs, err := sm.ProfilePrefs(created.ID, username)
+		require.NoError(t, err)
+
+		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 1}))
+		require.NoError(t, prefs.Put("other", map[string]int{"n": 1}))
+		require.NoError(t, prefs.Remove("filedrop"))
+		require.NoError(t, prefs.Remove("missing"))
+
+		var got testPrefsSection
+		found, err := prefs.Get("filedrop", &got)
+		require.NoError(t, err)
+		assert.False(t, found)
+
+		var other map[string]int
+		found, err = prefs.Get("other", &other)
+		require.NoError(t, err)
+		assert.True(t, found)
+		assert.Equal(t, map[string]int{"n": 1}, other)
+	})
+}
+
+func TestProfilePrefs_RejectsInvalidID(t *testing.T) {
+	withTestSM(t, func(sm *ServiceManager, username string) {
+		_, err := sm.ProfilePrefs("../escape", username)
+		assert.Error(t, err)
+	})
+}
+
+func TestProfilePrefs_RejectsEmptyNamespace(t *testing.T) {
+	withTestSM(t, func(sm *ServiceManager, username string) {
+		created, err := sm.AddProfile("work", username)
+		require.NoError(t, err)
+
+		prefs, err := sm.ProfilePrefs(created.ID, username)
+		require.NoError(t, err)
+
+		_, err = prefs.Get("", &testPrefsSection{})
+		assert.Error(t, err)
+		assert.Error(t, prefs.Put("", testPrefsSection{}))
+		assert.Error(t, prefs.Remove(""))
+	})
+}
+
+func TestProfilePrefs_DefaultProfile(t *testing.T) {
+	withTestSM(t, func(sm *ServiceManager, username string) {
+		prefs, err := sm.ProfilePrefs(defaultProfileName, username)
+		require.NoError(t, err)
+
+		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 1}))
+
+		expected := filepath.Join(filepath.Dir(DefaultConfigPath), "default"+prefsFileSuffix)
+		_, err = os.Stat(expected)
+		require.NoError(t, err)
+	})
+}
+
+func TestRemoveProfile_DeletesPrefsFile(t *testing.T) {
+	withTestSM(t, func(sm *ServiceManager, username string) {
+		created, err := sm.AddProfile("work", username)
+		require.NoError(t, err)
+
+		prefs, err := sm.ProfilePrefs(created.ID, username)
+		require.NoError(t, err)
+		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 2}))
+
+		configDir, err := sm.getConfigDir(username)
+		require.NoError(t, err)
+		prefsPath := filepath.Join(configDir, created.ID.String()+prefsFileSuffix)
+		_, err = os.Stat(prefsPath)
+		require.NoError(t, err)
+
+		require.NoError(t, sm.RemoveProfile(created.ID, username))
+		_, err = os.Stat(prefsPath)
+		assert.True(t, errors.Is(err, os.ErrNotExist), "prefs file should be removed")
+	})
+}
diff --git a/client/internal/profilemanager/profilemanager.go b/client/internal/profilemanager/profilemanager.go
index e25d493d5..d2ed92bc5 100644
--- a/client/internal/profilemanager/profilemanager.go
+++ b/client/internal/profilemanager/profilemanager.go
@@ -3,7 +3,6 @@ package profilemanager
 import (
 	"fmt"
 	"os"
-	"os/user"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -54,7 +53,7 @@ func (p *Profile) FilePath() (string, error) {
 		return "", fmt.Errorf("invalid profile ID: %q", id)
 	}
 
-	username, err := user.Current()
+	username, err := InvokingUser()
 	if err != nil {
 		return "", fmt.Errorf("failed to get current user: %w", err)
 	}
@@ -130,7 +129,7 @@ func (pm *ProfileManager) getActiveProfileState() ID {
 	if err != nil {
 		if !os.IsNotExist(err) {
 			log.Warnf("failed to read active profile state: %v", err)
-		} else {
+		} else if !sudoActive() {
 			if err := pm.setActiveProfileState(defaultProfileName); err != nil {
 				log.Warnf("failed to set default profile state: %v", err)
 			}
@@ -148,6 +147,13 @@ func (pm *ProfileManager) getActiveProfileState() ID {
 }
 
 func (pm *ProfileManager) setActiveProfileState(id ID) error {
+	// The invoking user's state is read-only under sudo — a root-owned file in
+	// the user's directory would break their own runs. The daemon still records
+	// the switch on its side; only the user-local bookkeeping is skipped.
+	if sudoActive() {
+		log.Infof("running under sudo: not persisting active profile %q for user %s", id, os.Getenv(envSudoUser))
+		return nil
+	}
 
 	configDir, err := getConfigDir()
 	if err != nil {
diff --git a/client/internal/profilemanager/service.go b/client/internal/profilemanager/service.go
index 5ddd11b04..e58f421fd 100644
--- a/client/internal/profilemanager/service.go
+++ b/client/internal/profilemanager/service.go
@@ -11,6 +11,7 @@ import (
 	"runtime"
 	"sort"
 	"strings"
+	"syscall"
 
 	log "github.com/sirupsen/logrus"
 
@@ -312,7 +313,11 @@ func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, err
 	}
 
 	profPath := filepath.Join(configDir, id.String()+".json")
-	cfg, err := createNewConfig(ConfigInput{ConfigPath: profPath})
+	// Provisioned, not bare: this config goes straight to disk, and a profile
+	// file with no identity is one whose first reader has to mint the keys and
+	// remember to write them back. Before identity generation moved out of
+	// apply() into EnsureIdentity, createNewConfig produced them here too.
+	cfg, err := createProvisionedConfig(ConfigInput{ConfigPath: profPath})
 	if err != nil {
 		return nil, fmt.Errorf("failed to create new config: %w", err)
 	}
@@ -329,6 +334,19 @@ func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, err
 	}, nil
 }
 
+// RenameProfile changes a profile's display name. It rewrites the whole
+// profile file, not just the name: the config is read through the normalizing
+// reader, so apply()'s resolved values — the optional booleans, the interface
+// blacklist, the DNS route interval — are persisted along with the new name.
+//
+// That is deliberate. A write that skipped apply() is what left profiles on
+// disk carrying null where a value was meant, and made a diff of the config
+// compare presence instead of value. Two consequences worth knowing: the
+// platform-dependent defaults resolved here are the renaming host's
+// (ServerSSHAllowed and the network monitor differ per OS), and a profile
+// whose stored name does not survive sanitizeDisplayName now fails to rename
+// rather than being rewritten — though apply() rejects such a profile on every
+// other read too, so it was already unusable.
 func (s *ServiceManager) RenameProfile(id ID, username string, newName string) error {
 	displayName, err := sanitizeDisplayName(newName)
 	if err != nil {
@@ -355,17 +373,17 @@ func (s *ServiceManager) RenameProfile(id ID, username string, newName string) e
 		return ErrProfileNotFound
 	}
 
-	data, err := os.ReadFile(target.Path)
+	// Through the reader, not a bare Unmarshal: this was the one write that
+	// skipped apply(), so it copied back whatever the file held — including an
+	// optional field left unset, which every other write resolves to its
+	// default. Renaming a profile is a poor place to leave that behind.
+	cfg, err := GetExistingConfig(target.Path)
 	if err != nil {
-		return err
-	}
-	var cfg Config
-	if err := json.Unmarshal(data, &cfg); err != nil {
-		return err
+		return fmt.Errorf("read profile config: %w", err)
 	}
 	cfg.Name = displayName
 
-	if err := util.WriteJson(context.Background(), target.Path, cfg); err != nil {
+	if err := WriteOutConfig(target.Path, cfg); err != nil {
 		return fmt.Errorf("failed to write profile name: %w", err)
 	}
 	return nil
@@ -419,6 +437,11 @@ func (s *ServiceManager) RemoveProfile(id ID, username string) error {
 		log.Warnf("failed to remove profile state file %s: %v", stateFile, err)
 	}
 
+	prefsFile := filepath.Join(filepath.Dir(target.Path), id.String()+prefsFileSuffix)
+	if err := removePrefsFile(prefsFile); err != nil && !os.IsNotExist(err) {
+		log.Warnf("failed to remove profile prefs file %s: %v", prefsFile, err)
+	}
+
 	return nil
 }
 
@@ -439,7 +462,11 @@ func (s *ServiceManager) GetStatePath() string {
 
 	activeProf, err := s.GetActiveProfileState()
 	if err != nil {
-		log.Warnf("failed to get active profile state: %v", err)
+		if errors.Is(err, syscall.ENOSYS) {
+			log.Debugf("active profile state unavailable on this platform: %v", err)
+		} else {
+			log.Warnf("failed to get active profile state: %v", err)
+		}
 		return defaultStatePath
 	}
 
diff --git a/client/internal/profilemanager/service_test.go b/client/internal/profilemanager/service_test.go
index 5e051b15d..d26ce746a 100644
--- a/client/internal/profilemanager/service_test.go
+++ b/client/internal/profilemanager/service_test.go
@@ -228,3 +228,27 @@ func TestRemoveProfile_DeletesStateFile(t *testing.T) {
 		assert.True(t, errors.Is(err, os.ErrNotExist), "state file should be removed")
 	})
 }
+
+// A profile file is written here and read back by whoever connects with it, so
+// it has to carry the peer's identity. While AddProfile used the bare
+// constructor, it wrote a config with no keys: the first reader had to mint
+// them, and the paths that read without writing — a gate deciding whether to
+// refuse a request, the mobile SDKs loading a stored profile — got a config
+// that cannot connect.
+func TestAddProfileWritesAnIdentity(t *testing.T) {
+	withTestSM(t, func(sm *ServiceManager, username string) {
+		created, err := sm.AddProfile("work", username)
+		require.NoError(t, err)
+
+		stored, err := GetExistingConfig(created.Path)
+		require.NoError(t, err)
+
+		require.NotEmpty(t, stored.PrivateKey, "the profile was written without a WireGuard key")
+		require.NotEmpty(t, stored.SSHKey, "the profile was written without an SSH key")
+
+		// And the identity is the one on disk, not one minted per read.
+		reread, err := GetExistingConfig(created.Path)
+		require.NoError(t, err)
+		require.Equal(t, stored.PrivateKey, reread.PrivateKey)
+	})
+}
diff --git a/client/internal/profilemanager/state.go b/client/internal/profilemanager/state.go
index 1bf3318af..81e6c085f 100644
--- a/client/internal/profilemanager/state.go
+++ b/client/internal/profilemanager/state.go
@@ -4,8 +4,11 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"os"
 	"path/filepath"
 
+	log "github.com/sirupsen/logrus"
+
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -44,12 +47,44 @@ func (pm *ProfileManager) GetProfileState(id ID) (*ProfileState, error) {
 	return &state, nil
 }
 
-func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
+// SetProfileState writes the state file of the profile identified by id. Prefer
+// it over SetActiveProfileState whenever the caller knows which profile the data
+// belongs to: an SSO login spans seconds of user interaction, and the active
+// profile can change during it, which would file the account email under
+// whichever profile happened to be active when the flow returned.
+func (pm *ProfileManager) SetProfileState(id ID, state *ProfileState) error {
 	configDir, err := getConfigDir()
 	if err != nil {
 		return fmt.Errorf("get config directory: %w", err)
 	}
 
+	if id == "" {
+		return fmt.Errorf("empty profile ID")
+	}
+	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
+		return fmt.Errorf("invalid profile ID: %q", id)
+	}
+
+	// The invoking user's state is read-only under sudo. The file only carries
+	// the account email for the login hint and display, so skipping the write
+	// costs at most one extra account prompt later — a root-owned file in the
+	// user's directory would cost every later update instead.
+	if sudoActive() {
+		log.Debugf("running under sudo: not persisting profile state for user %s", os.Getenv(envSudoUser))
+		return nil
+	}
+
+	stateFile := filepath.Join(configDir, id.String()+".state.json")
+	if err := util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state); err != nil {
+		return fmt.Errorf("write profile state: %w", err)
+	}
+
+	return nil
+}
+
+// SetActiveProfileState writes the state file of whichever profile is active at
+// call time. Use SetProfileState when the target profile is known.
+func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 	activeProf, err := pm.GetActiveProfile()
 	if err != nil {
 		if errors.Is(err, ErrNoActiveProfile) {
@@ -58,15 +93,29 @@ func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 		return fmt.Errorf("get active profile: %w", err)
 	}
 
-	id := activeProf.ID
-	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
-		return fmt.Errorf("invalid active profile ID: %q", id)
+	return pm.SetProfileState(activeProf.ID, state)
+}
+
+// RemoveProfileState deletes the per-profile state file (which holds the
+// account email used for the SSO login hint and the UI display). Called after
+// profile removal; logout keeps the file so the next login can pass the email
+// as the login_hint. The state file only stores the email, so deleting it is
+// equivalent to clearing it; the next SSO login recreates it. A missing file
+// is not an error.
+func (pm *ProfileManager) RemoveProfileState(profileName string) error {
+	if sudoActive() {
+		log.Debugf("running under sudo: not removing profile state for user %s", os.Getenv(envSudoUser))
+		return nil
 	}
 
-	stateFile := filepath.Join(configDir, id.String()+".state.json")
-	err = util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state)
+	configDir, err := getConfigDir()
 	if err != nil {
-		return fmt.Errorf("write profile state: %w", err)
+		return fmt.Errorf("get config directory: %w", err)
+	}
+
+	stateFile := filepath.Join(configDir, profileName+".state.json")
+	if err := os.Remove(stateFile); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove profile state: %w", err)
 	}
 
 	return nil
diff --git a/client/internal/relay/relay.go b/client/internal/relay/relay.go
index 051717608..e39eed39a 100644
--- a/client/internal/relay/relay.go
+++ b/client/internal/relay/relay.go
@@ -201,11 +201,7 @@ func (p *StunTurnProbe) probeSTUN(ctx context.Context, uri *stun.URI) (addr stri
 		}
 	}()
 
-	net, err := stdnet.NewNet(ctx, nil)
-	if err != nil {
-		probeErr = fmt.Errorf("new net: %w", err)
-		return
-	}
+	net := stdnet.NewNet(ctx, nil, nil)
 
 	client, err := stun.DialURI(uri, &stun.DialConfig{
 		Net: net,
@@ -290,11 +286,7 @@ func (p *StunTurnProbe) probeTURN(ctx context.Context, uri *stun.URI) (addr stri
 		}
 	}()
 
-	net, err := stdnet.NewNet(ctx, nil)
-	if err != nil {
-		probeErr = fmt.Errorf("new net: %w", err)
-		return
-	}
+	net := stdnet.NewNet(ctx, nil, nil)
 	cfg := &turn.ClientConfig{
 		STUNServerAddr: turnServerAddr,
 		TURNServerAddr: turnServerAddr,
diff --git a/client/internal/rosenpass/manager.go b/client/internal/rosenpass/manager.go
index 903753753..21dd751df 100644
--- a/client/internal/rosenpass/manager.go
+++ b/client/internal/rosenpass/manager.go
@@ -39,6 +39,7 @@ type rpServer interface {
 
 type Manager struct {
 	ifaceName    string
+	localWgKey   wgtypes.Key
 	spk          []byte
 	ssk          []byte
 	rpKeyHash    string
@@ -51,8 +52,9 @@ type Manager struct {
 	wgIface      PresharedKeySetter
 }
 
-// NewManager creates a new Rosenpass manager
-func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string) (*Manager, error) {
+// NewManager creates a new Rosenpass manager. localWgKey is the local
+// WireGuard public key, used to derive the per-peer rendezvous key.
+func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtypes.Key) (*Manager, error) {
 	public, secret, err := rp.GenerateKeyPair()
 	if err != nil {
 		return nil, err
@@ -62,6 +64,7 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string) (*Manager, error)
 	log.Tracef("generated new rosenpass key pair with public key %s", rpKeyHash)
 	return &Manager{
 		ifaceName:    wgIfaceName,
+		localWgKey:   localWgKey,
 		rpKeyHash:    rpKeyHash,
 		spk:          public,
 		ssk:          secret,
@@ -73,7 +76,7 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string) (*Manager, error)
 		// nil receiver in addPeer -> m.rpWgHandler.AddPeer. generateConfig will
 		// replace it with a fresh handler on each Run() to clear stale peer
 		// state from previous engine sessions.
-		rpWgHandler: NewNetbirdHandler(),
+		rpWgHandler: NewNetbirdHandler((*[32]byte)(preSharedKey), localWgKey),
 		lock:        sync.Mutex{},
 	}, nil
 }
@@ -161,7 +164,7 @@ func (m *Manager) generateConfig() (rp.Config, error) {
 	cfg.Peers = []rp.PeerConfig{}
 
 	m.lock.Lock()
-	m.rpWgHandler = NewNetbirdHandler()
+	m.rpWgHandler = NewNetbirdHandler(m.preSharedKey, m.localWgKey)
 	if m.wgIface != nil {
 		m.rpWgHandler.SetInterface(m.wgIface)
 	}
diff --git a/client/internal/rosenpass/manager_test.go b/client/internal/rosenpass/manager_test.go
index d74960d0d..69e18ac88 100644
--- a/client/internal/rosenpass/manager_test.go
+++ b/client/internal/rosenpass/manager_test.go
@@ -85,7 +85,7 @@ func newTestManager(spkFirstByte byte, mock *mockServer) *Manager {
 		ssk:         make([]byte, 32),
 		rpKeyHash:   "test-hash",
 		rpPeerIDs:   make(map[string]*rp.PeerID),
-		rpWgHandler: NewNetbirdHandler(),
+		rpWgHandler: NewNetbirdHandler(nil, wgtypes.Key{0x01}),
 		server:      mock,
 	}
 }
@@ -255,7 +255,7 @@ func TestAddPeer_NilServer_ReturnsErrorNoCrash(t *testing.T) {
 // issue #4341 cannot occur in the window between NewManager and Run().
 func TestNewManager_PreInitializesHandler(t *testing.T) {
 	psk := wgtypes.Key{}
-	m, err := NewManager(&psk, "wt0")
+	m, err := NewManager(&psk, "wt0", wgtypes.Key{0x01})
 	require.NoError(t, err)
 	require.NotNil(t, m.rpWgHandler, "rpWgHandler must be initialized in NewManager")
 }
@@ -329,10 +329,10 @@ func TestIsPresharedKeyInitialized_AddedButNotHandshaken_ReturnsFalse(t *testing
 	require.False(t, m.IsPresharedKeyInitialized(wgKey))
 }
 
-// --- NetbirdHandler.outputKey ----------------------------------------------
+// --- NetbirdHandler.applyKey ----------------------------------------------
 
-func TestHandler_OutputKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
-	h := NewNetbirdHandler()
+func TestHandler_ApplyKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -348,8 +348,8 @@ func TestHandler_OutputKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
 	require.Equal(t, wgKey.String(), iface.calls[0].peerKey)
 }
 
-func TestHandler_OutputKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
-	h := NewNetbirdHandler()
+func TestHandler_ApplyKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -364,8 +364,8 @@ func TestHandler_OutputKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
 	require.True(t, iface.calls[1].updateOnly, "subsequent rotations must use updateOnly=true")
 }
 
-func TestHandler_OutputKey_NilInterface_NoCrashNoCall(t *testing.T) {
-	h := NewNetbirdHandler()
+func TestHandler_ApplyKey_NilInterface_NoCrashNoCall(t *testing.T) {
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	// no SetInterface — iface remains nil
 	pid := rp.PeerID{0x03}
 	h.AddPeer(pid, "wt0", rp.Key(wgtypes.Key{}))
@@ -374,8 +374,8 @@ func TestHandler_OutputKey_NilInterface_NoCrashNoCall(t *testing.T) {
 	h.HandshakeCompleted(pid, rp.Key{})
 }
 
-func TestHandler_OutputKey_UnknownPeer_NoCall(t *testing.T) {
-	h := NewNetbirdHandler()
+func TestHandler_ApplyKey_UnknownPeer_NoCall(t *testing.T) {
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -384,7 +384,7 @@ func TestHandler_OutputKey_UnknownPeer_NoCall(t *testing.T) {
 }
 
 func TestHandler_RemovePeer_ClearsInitializedState(t *testing.T) {
-	h := NewNetbirdHandler()
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -398,7 +398,7 @@ func TestHandler_RemovePeer_ClearsInitializedState(t *testing.T) {
 }
 
 func TestHandler_SetInterfaceAfterAddPeer_StillReceivesKey(t *testing.T) {
-	h := NewNetbirdHandler()
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	pid := rp.PeerID{0x05}
 	wgKey := wgtypes.Key{0xEE}
 	h.AddPeer(pid, "wt0", rp.Key(wgKey))
diff --git a/client/internal/rosenpass/netbird_handler.go b/client/internal/rosenpass/netbird_handler.go
index 9de2409ef..672650ca7 100644
--- a/client/internal/rosenpass/netbird_handler.go
+++ b/client/internal/rosenpass/netbird_handler.go
@@ -18,19 +18,34 @@ type PresharedKeySetter interface {
 type wireGuardPeer struct {
 	Interface string
 	PublicKey rp.Key
+	// initialized is true once a completed exchange has set a
+	// Rosenpass-managed PSK for this peer.
+	initialized bool
+	// chainKey is the key output by the last completed exchange, advanced by
+	// one ratchet step on expiry. Nil until the first exchange completes and
+	// after the peer has fallen back to the rendezvous key.
+	chainKey *wgtypes.Key
+	// expiries counts failed renewals since the last completed exchange.
+	expiries int
 }
 
 type NetbirdHandler struct {
-	mu               sync.Mutex
-	iface            PresharedKeySetter
-	peers            map[rp.PeerID]wireGuardPeer
-	initializedPeers map[rp.PeerID]bool
+	mu    sync.Mutex
+	iface PresharedKeySetter
+	// preSharedKey is the account-level preshared key, used as the rendezvous
+	// key when set. Nil means the deterministic seed key is used instead.
+	preSharedKey *[32]byte
+	// localWgKey is the local WireGuard public key, one of the two inputs to
+	// the deterministic seed key.
+	localWgKey wgtypes.Key
+	peers      map[rp.PeerID]*wireGuardPeer
 }
 
-func NewNetbirdHandler() *NetbirdHandler {
+func NewNetbirdHandler(preSharedKey *[32]byte, localWgKey wgtypes.Key) *NetbirdHandler {
 	return &NetbirdHandler{
-		peers:            map[rp.PeerID]wireGuardPeer{},
-		initializedPeers: map[rp.PeerID]bool{},
+		preSharedKey: preSharedKey,
+		localWgKey:   localWgKey,
+		peers:        map[rp.PeerID]*wireGuardPeer{},
 	}
 }
 
@@ -42,10 +57,16 @@ func (h *NetbirdHandler) SetInterface(iface PresharedKeySetter) {
 	h.iface = iface
 }
 
+// AddPeer registers a peer with the handler. Re-adding a known peer (every
+// reconnection does) keeps its key recovery state.
 func (h *NetbirdHandler) AddPeer(pid rp.PeerID, intf string, pk rp.Key) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	h.peers[pid] = wireGuardPeer{
+	if existing, ok := h.peers[pid]; ok && existing.PublicKey == pk {
+		existing.Interface = intf
+		return
+	}
+	h.peers[pid] = &wireGuardPeer{
 		Interface: intf,
 		PublicKey: pk,
 	}
@@ -55,7 +76,6 @@ func (h *NetbirdHandler) RemovePeer(pid rp.PeerID) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	delete(h.peers, pid)
-	delete(h.initializedPeers, pid)
 }
 
 // IsPeerInitialized returns true if Rosenpass has completed a handshake
@@ -63,50 +83,120 @@ func (h *NetbirdHandler) RemovePeer(pid rp.PeerID) {
 func (h *NetbirdHandler) IsPeerInitialized(pid rp.PeerID) bool {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	return h.initializedPeers[pid]
+	peer, ok := h.peers[pid]
+	return ok && peer.initialized
 }
 
+// HandshakeCompleted programs the freshly exchanged output key and resets the
+// peer's key recovery state.
 func (h *NetbirdHandler) HandshakeCompleted(pid rp.PeerID, key rp.Key) {
-	h.outputKey(rp.KeyOutputReasonStale, pid, key)
-}
+	psk := wgtypes.Key(key)
 
-func (h *NetbirdHandler) HandshakeExpired(pid rp.PeerID) {
-	key, _ := rp.GeneratePresharedKey()
-	h.outputKey(rp.KeyOutputReasonStale, pid, key)
-}
-
-func (h *NetbirdHandler) outputKey(_ rp.KeyOutputReason, pid rp.PeerID, psk rp.Key) {
 	h.mu.Lock()
-	iface := h.iface
-	wg, ok := h.peers[pid]
-	isInitialized := h.initializedPeers[pid]
-	h.mu.Unlock()
+	defer h.mu.Unlock()
 
-	if iface == nil {
-		log.Warn("rosenpass: interface not set, cannot update preshared key")
+	peer, ok := h.peers[pid]
+	if !ok {
 		return
 	}
+	if peer.expiries > 0 {
+		log.Infof("rosenpass exchange completed for peer %s after %d expired renewals", wgtypes.Key(peer.PublicKey), peer.expiries)
+	}
+	// chainKey tracks the shared exchange output regardless of the local write
+	// outcome, so both ends still converge on the next expiry.
+	peer.chainKey = &psk
+	peer.expiries = 0
+	if !h.applyKeyLocked(pid, psk, peer.initialized) {
+		return
+	}
+	peer.initialized = true
+}
 
+// HandshakeExpired replaces the expired key. The renewal exchange runs over
+// the tunnel keyed by the PSK itself, so the replacement must be derivable on
+// both ends without communication: the first expiry ratchets the last shared
+// key forward, repeated expiries (and expiries without a completed exchange)
+// fall back to the rendezvous key and drop the peer out of the initialized
+// state so connection reconfigurations reprogram the rendezvous key as well.
+func (h *NetbirdHandler) HandshakeExpired(pid rp.PeerID) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	peer, ok := h.peers[pid]
 	if !ok {
 		return
 	}
 
-	peerKey := wgtypes.Key(wg.PublicKey).String()
-	pskKey := wgtypes.Key(psk)
+	peer.expiries++
 
-	// Use updateOnly=true for later rotations (peer already has Rosenpass PSK)
-	// Use updateOnly=false for first rotation (peer has original/empty PSK)
-	if err := iface.SetPresharedKey(peerKey, pskKey, isInitialized); err != nil {
+	var psk wgtypes.Key
+	if peer.chainKey != nil && peer.expiries == 1 {
+		log.Infof("rosenpass key for peer %s expired without renewal, advancing to ratcheted key", wgtypes.Key(peer.PublicKey))
+		psk = RatchetKey(*peer.chainKey)
+		peer.chainKey = &psk
+	} else {
+		rendezvous, err := h.rendezvousKey(peer)
+		if err != nil {
+			// Fail closed: without a rendezvous key the expired key must
+			// still be rotated out, even if the replacement is unusable.
+			log.Errorf("failed to derive rendezvous key, replacing expired key with a random one: %v", err)
+			h.applyRandomKeyLocked(pid)
+			return
+		}
+		log.Warnf("rosenpass key for peer %s expired %d times without renewal, falling back to the rendezvous key", wgtypes.Key(peer.PublicKey), peer.expiries)
+		psk = rendezvous
+		peer.chainKey = nil
+		peer.initialized = false
+	}
+
+	h.applyKeyLocked(pid, psk, true)
+}
+
+// rendezvousKey returns the key both ends converge on without communication:
+// the account-level preshared key when configured, the deterministic seed key
+// otherwise. It mirrors the key that peer connections program when Rosenpass
+// does not manage the peer yet.
+func (h *NetbirdHandler) rendezvousKey(peer *wireGuardPeer) (wgtypes.Key, error) {
+	if h.preSharedKey != nil {
+		return *h.preSharedKey, nil
+	}
+
+	seed, err := DeterministicSeedKey(h.localWgKey.String(), wgtypes.Key(peer.PublicKey).String())
+	if err != nil {
+		return wgtypes.Key{}, err
+	}
+	return *seed, nil
+}
+
+// applyKeyLocked writes the preshared key for the peer to the WireGuard
+// interface and reports whether the write succeeded. Callers must hold h.mu
+// for the whole state-mutation-plus-write so that a concurrent completion and
+// expiry cannot reorder their writes relative to the in-memory chain key.
+func (h *NetbirdHandler) applyKeyLocked(pid rp.PeerID, psk wgtypes.Key, updateOnly bool) bool {
+	peer, ok := h.peers[pid]
+	if !ok {
+		return false
+	}
+
+	if h.iface == nil {
+		log.Warn("rosenpass: interface not set, cannot update preshared key")
+		return false
+	}
+
+	peerKey := wgtypes.Key(peer.PublicKey).String()
+	if err := h.iface.SetPresharedKey(peerKey, psk, updateOnly); err != nil {
 		log.Errorf("Failed to apply rosenpass key: %v", err)
+		return false
+	}
+
+	return true
+}
+
+func (h *NetbirdHandler) applyRandomKeyLocked(pid rp.PeerID) {
+	key, err := rp.GeneratePresharedKey()
+	if err != nil {
+		log.Errorf("failed to generate random preshared key: %v", err)
 		return
 	}
-
-	// Mark peer as isInitialized after the successful first rotation
-	if !isInitialized {
-		h.mu.Lock()
-		if _, exists := h.peers[pid]; exists {
-			h.initializedPeers[pid] = true
-		}
-		h.mu.Unlock()
-	}
+	h.applyKeyLocked(pid, wgtypes.Key(key), true)
 }
diff --git a/client/internal/rosenpass/netbird_handler_test.go b/client/internal/rosenpass/netbird_handler_test.go
new file mode 100644
index 000000000..9d91ba93b
--- /dev/null
+++ b/client/internal/rosenpass/netbird_handler_test.go
@@ -0,0 +1,250 @@
+package rosenpass
+
+import (
+	"testing"
+
+	rp "cunicu.li/go-rosenpass"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// handlerTestLink wires two NetbirdHandlers as the two ends of a single
+// tunnel: handler A manages the rosenpass peer B and vice versa, the way two
+// NetBird clients see each other.
+type handlerTestLink struct {
+	handlerA, handlerB *NetbirdHandler
+	ifaceA, ifaceB     *mockIface
+	pidA, pidB         rp.PeerID
+	wgKeyA, wgKeyB     wgtypes.Key
+}
+
+func newHandlerTestLink(t *testing.T, preSharedKey *[32]byte) *handlerTestLink {
+	t.Helper()
+
+	link := &handlerTestLink{
+		ifaceA: &mockIface{},
+		ifaceB: &mockIface{},
+	}
+	link.pidA[0] = 0xaa
+	link.pidB[0] = 0xbb
+	link.wgKeyA[31] = 1
+	link.wgKeyB[31] = 2
+
+	link.handlerA = NewNetbirdHandler(preSharedKey, link.wgKeyA)
+	link.handlerB = NewNetbirdHandler(preSharedKey, link.wgKeyB)
+
+	link.handlerA.SetInterface(link.ifaceA)
+	link.handlerB.SetInterface(link.ifaceB)
+
+	link.handlerA.AddPeer(link.pidB, "wt0", rp.Key(link.wgKeyB))
+	link.handlerB.AddPeer(link.pidA, "wt0", rp.Key(link.wgKeyA))
+
+	return link
+}
+
+// complete simulates a completed rosenpass exchange: both ends derive the
+// same output key.
+func (l *handlerTestLink) complete(osk rp.Key) {
+	l.handlerA.HandshakeCompleted(l.pidB, osk)
+	l.handlerB.HandshakeCompleted(l.pidA, osk)
+}
+
+// expire simulates a failed key renewal on both ends.
+func (l *handlerTestLink) expire() {
+	l.handlerA.HandshakeExpired(l.pidB)
+	l.handlerB.HandshakeExpired(l.pidA)
+}
+
+func lastPSK(t *testing.T, m *mockIface) wgtypes.Key {
+	t.Helper()
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	require.NotEmpty(t, m.calls, "expected at least one SetPresharedKey call")
+	return m.calls[len(m.calls)-1].psk
+}
+
+func TestHandshakeCompleted_SetsKeyAndInitializes(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	require.Equal(t, wgtypes.Key(osk), lastPSK(t, link.ifaceA), "completed exchange must program the osk")
+	require.False(t, link.ifaceA.calls[0].updateOnly, "first rotation must not be update-only")
+	require.True(t, link.handlerA.IsPeerInitialized(link.pidB), "peer must be initialized after first completed exchange")
+
+	link.complete(osk)
+	require.True(t, link.ifaceA.calls[1].updateOnly, "later rotations must be update-only")
+}
+
+// TestHandshakeExpired_BothSidesConverge encodes the core recovery invariant:
+// rosenpass renewals run over the tunnel that the PSK itself keys, so when a
+// renewal fails on both ends, both ends must fall back to the same key or the
+// tunnel can never handshake again.
+func TestHandshakeExpired_BothSidesConverge(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	keyA := lastPSK(t, link.ifaceA)
+	keyB := lastPSK(t, link.ifaceB)
+	require.NotEqual(t, wgtypes.Key(osk), keyA, "expired key must be rotated out")
+	require.Equal(t, keyA, keyB, "both ends must converge on the same key after expiry")
+
+	link.expire()
+	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
+		"both ends must still converge after repeated expiries")
+}
+
+// TestHandshakeExpired_ExpiryWithoutCompletionConverges covers the bootstrap
+// case: the initial exchange never completed (the tunnel ran on the rendezvous
+// key), so an expiry must not replace the working key with an unrecoverable
+// one on either end.
+func TestHandshakeExpired_ExpiryWithoutCompletionConverges(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	link.expire()
+	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
+		"both ends must converge when the exchange never completed")
+}
+
+// TestHandshakeExpired_RepeatedExpiryClearsInitialized: once renewals keep
+// failing, the peer must drop out of the initialized state so the next
+// connection reconfiguration reprograms the rendezvous key instead of
+// preserving a poisoned rosenpass-managed key.
+func TestHandshakeExpired_RepeatedExpiryClearsInitialized(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	link.expire()
+
+	require.False(t, link.handlerA.IsPeerInitialized(link.pidB),
+		"repeated expiries must clear the initialized state")
+	require.False(t, link.handlerB.IsPeerInitialized(link.pidA),
+		"repeated expiries must clear the initialized state")
+}
+
+// TestHandshakeCompleted_AfterExpiryRecovers: a completed exchange after a
+// desync must fully reset the recovery state.
+func TestHandshakeCompleted_AfterExpiryRecovers(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk1, osk2 rp.Key
+	osk1[0] = 1
+	osk2[0] = 2
+
+	link.complete(osk1)
+	link.expire()
+	link.expire()
+
+	link.complete(osk2)
+	require.Equal(t, wgtypes.Key(osk2), lastPSK(t, link.ifaceA), "new exchange must program the fresh osk")
+	require.True(t, link.handlerA.IsPeerInitialized(link.pidB), "peer must be initialized again after recovery")
+
+	link.expire()
+	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
+		"recovered link must converge again on the next expiry")
+	require.NotEqual(t, wgtypes.Key(osk2), lastPSK(t, link.ifaceA), "expired key must be rotated out")
+}
+
+// TestHandshakeExpired_FirstExpiryRatchetsLastKey: the first expiry must
+// derive the replacement from the last shared key, so an attacker who only
+// blocks the renewal exchange gains nothing over the previous key.
+func TestHandshakeExpired_FirstExpiryRatchetsLastKey(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	require.Equal(t, RatchetKey(wgtypes.Key(osk)), lastPSK(t, link.ifaceA),
+		"first expiry must program the ratcheted key")
+	require.True(t, link.handlerA.IsPeerInitialized(link.pidB),
+		"ratchet step must keep the peer initialized so reconfigurations preserve the key")
+}
+
+// TestHandshakeExpired_RepeatedExpiryFallsBackToSeed: once the ratchet key
+// also fails, both ends must land on the same key that peer connections
+// program for uninitialized peers, so a reconnect completes the recovery.
+func TestHandshakeExpired_RepeatedExpiryFallsBackToSeed(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	link.expire()
+
+	seed, err := DeterministicSeedKey(link.wgKeyA.String(), link.wgKeyB.String())
+	require.NoError(t, err)
+	require.Equal(t, *seed, lastPSK(t, link.ifaceA), "repeated expiry must fall back to the seed key")
+	require.Equal(t, *seed, lastPSK(t, link.ifaceB), "repeated expiry must fall back to the seed key")
+}
+
+// TestHandshakeExpired_ConfiguredPSKUsedAsRendezvous: with an account-level
+// preshared key configured, the fallback must be that key, matching what peer
+// connections program for uninitialized peers.
+func TestHandshakeExpired_ConfiguredPSKUsedAsRendezvous(t *testing.T) {
+	psk := &[32]byte{0x77}
+	link := newHandlerTestLink(t, psk)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	link.expire()
+
+	require.Equal(t, wgtypes.Key(*psk), lastPSK(t, link.ifaceA),
+		"fallback must be the configured preshared key")
+	require.Equal(t, wgtypes.Key(*psk), lastPSK(t, link.ifaceB),
+		"fallback must be the configured preshared key on both ends")
+}
+
+// TestHandshakeExpired_ExpiryWritesAreUpdateOnly: expiry replacements must
+// never create a WireGuard peer that connection management has removed.
+func TestHandshakeExpired_ExpiryWritesAreUpdateOnly(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	link.expire()
+
+	for _, call := range link.ifaceA.calls[1:] {
+		require.True(t, call.updateOnly, "expiry writes must be update-only")
+	}
+}
+
+// TestAddPeer_ReAddKeepsRecoveryState: reconnections re-add the peer on every
+// OnConnected; that must not reset the expiry chain state.
+func TestAddPeer_ReAddKeepsRecoveryState(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+	link.expire()
+
+	link.handlerA.AddPeer(link.pidB, "wt0", rp.Key(link.wgKeyB))
+	require.True(t, link.handlerA.IsPeerInitialized(link.pidB),
+		"re-adding a known peer must keep its state")
+
+	link.expire()
+	seed, err := DeterministicSeedKey(link.wgKeyA.String(), link.wgKeyB.String())
+	require.NoError(t, err)
+	require.Equal(t, *seed, lastPSK(t, link.ifaceA),
+		"second expiry after re-add must continue to the seed fallback")
+}
diff --git a/client/internal/rosenpass/seed.go b/client/internal/rosenpass/seed.go
index 83aba1e0e..052c11ed4 100644
--- a/client/internal/rosenpass/seed.go
+++ b/client/internal/rosenpass/seed.go
@@ -1,11 +1,28 @@
 package rosenpass
 
 import (
+	"crypto/sha256"
 	"fmt"
 
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
+// ratchetLabel domain-separates the expiry ratchet from other uses of the
+// rosenpass output key.
+const ratchetLabel = "netbird-rosenpass-expiry-ratchet"
+
+// RatchetKey derives the successor preshared key from the previous Rosenpass
+// output key. When a key expires without a completed renewal, both peers
+// advance their last shared key by one ratchet step: the expired key is
+// rotated out while both ends still converge on an identical, non-public
+// replacement without communicating.
+func RatchetKey(prev wgtypes.Key) wgtypes.Key {
+	input := make([]byte, 0, len(ratchetLabel)+len(prev))
+	input = append(input, ratchetLabel...)
+	input = append(input, prev[:]...)
+	return sha256.Sum256(input)
+}
+
 // DeterministicSeedKey derives a 32-byte WireGuard preshared key from a pair
 // of peer public keys. Both peers, given the same key pair, produce the same
 // output regardless of which side runs the function: the inputs are ordered
diff --git a/client/internal/routemanager/client/client.go b/client/internal/routemanager/client/client.go
index c691c54f8..66c2ed491 100644
--- a/client/internal/routemanager/client/client.go
+++ b/client/internal/routemanager/client/client.go
@@ -3,8 +3,10 @@ package client
 import (
 	"context"
 	"fmt"
+	"math"
 	"net/netip"
 	"reflect"
+	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -26,6 +28,54 @@ const (
 	handlerTypeStatic
 )
 
+const (
+	// latencySwitchMinGain is the absolute latency improvement an alternative
+	// routing peer must show before an otherwise equivalent current peer is
+	// replaced. An absolute margin alone would be meaningless on slow paths,
+	// hence latencySwitchGainPercent on top.
+	latencySwitchMinGain = 20 * time.Millisecond
+
+	// latencySwitchGainPercent is the relative latency improvement required in
+	// addition to latencySwitchMinGain. A relative margin alone would churn on
+	// fast paths, where a few milliseconds are a large fraction of the latency.
+	latencySwitchGainPercent = 20
+
+	// latencyNoiseSigmas is how many standard deviations of the measurement
+	// noise a latency gain has to exceed. Smoothing narrows the scatter of a
+	// jittery path but does not remove it, so on such a path two equivalent
+	// peers keep producing differences of tens of milliseconds. Requiring the
+	// gain to stand out from that scatter is what separates a peer that is
+	// really closer from one that only looks closer right now.
+	latencyNoiseSigmas = 4
+
+	// latencySwitchMinDwell is how long a routing peer is kept before latency
+	// can move the choice again. Changes in connection status, metric or relay
+	// state ignore it so failover is never delayed.
+	latencySwitchMinDwell = 30 * time.Second
+
+	// routeReevalInterval is how often routes are re-evaluated without an
+	// incoming peer state change. A switch deferred by latencySwitchMinDwell,
+	// or a latency that drifts in steps too small to notify, would otherwise
+	// wait for an unrelated event to be reconsidered.
+	routeReevalInterval = latencySwitchMinDwell
+
+	// unknownLatency ranks peers without a latency sample below any peer with a
+	// real measurement, without excluding them from selection. It doubles as the
+	// upper bound for samples, so a pathological value cannot dominate, and sits
+	// well above any usable path so that slow paths keep their order.
+	unknownLatency = 10 * time.Second
+
+	// unmeasuredLatencyHold is how long a current routing peer without a
+	// latency sample is kept against a measured one. A direct connection is
+	// sampled within seconds, so a peer still unsampled after this is ranked
+	// at unknownLatency rather than held indefinitely.
+	unmeasuredLatencyHold = 30 * time.Second
+
+	// holdReportInterval is how long a routing peer held back by a switch rule
+	// is reported at debug level only, after being reported at info level once.
+	holdReportInterval = 10 * time.Minute
+)
+
 type reason int
 
 const (
@@ -36,10 +86,138 @@ const (
 	reasonHA
 )
 
+// switchReason describes why a routing peer replaced the current one.
+type switchReason string
+
+const (
+	switchReasonNone         switchReason = ""
+	switchReasonUnavailable  switchReason = "current routing peer unavailable"
+	switchReasonConnected    switchReason = "connected peer preferred over idle"
+	switchReasonMetric       switchReason = "lower route metric"
+	switchReasonDirect       switchReason = "direct connection preferred over relayed"
+	switchReasonLatency      switchReason = "lower latency"
+	switchReasonRouteChanged switchReason = "route assigned to a different routing peer"
+)
+
+// holdKind is the rule that keeps the current routing peer over a better one.
+type holdKind int
+
+const (
+	holdLatencyMargin holdKind = iota
+	holdLatencyDwell
+	holdLatencyUnmeasured
+	holdRelayedDelay
+)
+
 type routerPeerStatus struct {
 	status  peer.ConnStatus
 	relayed bool
 	latency time.Duration
+	// noise is the uncertainty of latency, see peer.LatencySample
+	noise time.Duration
+}
+
+func (s routerPeerStatus) isDirect() bool {
+	return s.status == peer.StatusConnected && !s.relayed
+}
+
+// routeCandidate is a route considered for selection, together with the
+// selection criteria derived from the state of its routing peer.
+type routeCandidate struct {
+	id        route.ID
+	peer      string
+	metric    int
+	connected bool
+	relayed   bool
+	latency   time.Duration
+	noise     time.Duration
+	// measured is false while the peer has no latency sample, as right after a
+	// direct connection comes up: latency then holds unknownLatency
+	measured bool
+}
+
+func newRouteCandidate(r *route.Route, status routerPeerStatus) routeCandidate {
+	latency := status.latency
+	if latency <= 0 || latency > unknownLatency {
+		latency = unknownLatency
+	}
+
+	return routeCandidate{
+		id:        r.ID,
+		peer:      r.Peer,
+		metric:    r.Metric,
+		connected: status.status == peer.StatusConnected,
+		relayed:   status.relayed,
+		latency:   latency,
+		noise:     status.noise,
+		measured:  status.latency > 0,
+	}
+}
+
+// tierCompare orders c against o on the categorical criteria: connection status,
+// then route metric, then direct versus relayed. It returns a positive number
+// when c outranks o, a negative one when o outranks c, and zero when the two are
+// equivalent. Latency is excluded on purpose: it is the tie-break applied by
+// betterThan and the only criterion the switch margins in shouldSwitchRoute
+// apply to.
+func (c routeCandidate) tierCompare(o routeCandidate) int {
+	if c.connected != o.connected {
+		if c.connected {
+			return 1
+		}
+		return -1
+	}
+	if c.metric != o.metric {
+		return o.metric - c.metric
+	}
+	if c.relayed != o.relayed {
+		if c.relayed {
+			return -1
+		}
+		return 1
+	}
+
+	return 0
+}
+
+func (c routeCandidate) isDirect() bool {
+	return c.connected && !c.relayed
+}
+
+func (c routeCandidate) tierBetterThan(o routeCandidate) bool {
+	return c.tierCompare(o) > 0
+}
+
+// winsOnlyOnRelay reports whether c outranks o solely by being direct while o
+// is relayed, with connection status and metric equal.
+func (c routeCandidate) winsOnlyOnRelay(o routeCandidate) bool {
+	return c.connected == o.connected && c.metric == o.metric && o.relayed && !c.relayed
+}
+
+// switchReasonOver names the criterion on which c replaces the current o.
+func (c routeCandidate) switchReasonOver(o routeCandidate) switchReason {
+	switch {
+	case c.connected != o.connected:
+		return switchReasonConnected
+	case c.metric != o.metric:
+		return switchReasonMetric
+	case c.relayed != o.relayed:
+		return switchReasonDirect
+	default:
+		return switchReasonLatency
+	}
+}
+
+func (c routeCandidate) betterThan(o routeCandidate) bool {
+	if tier := c.tierCompare(o); tier != 0 {
+		return tier > 0
+	}
+
+	return c.latency < o.latency
+}
+
+func (c routeCandidate) String() string {
+	return fmt.Sprintf("connected: %t, metric: %d, relayed: %t, latency: %v +/- %v", c.connected, c.metric, c.relayed, c.latency, c.noise)
 }
 
 type RoutesUpdate struct {
@@ -63,24 +241,93 @@ type WatcherConfig struct {
 	StatusRecorder   *peer.Status
 	Route            *route.Route
 	Handler          RouteHandler
+	// ReconcileAllowedIPs re-applies the routed allowed IPs tracked for a
+	// routing peer onto the interface. Optional.
+	ReconcileAllowedIPs func(peerKey string) error
 }
 
 // Watcher watches route and peer changes and updates allowed IPs accordingly.
 // Once stopped, it cannot be reused.
 // The methods are not thread-safe and should be synchronized externally.
 type Watcher struct {
-	ctx                 context.Context
-	cancel              context.CancelFunc
-	statusRecorder      *peer.Status
-	wgInterface         iface.WGIface
-	routes              map[route.ID]*route.Route
-	routeUpdate         chan RoutesUpdate
-	peerStateUpdate     chan map[string]peer.RouterState
+	ctx            context.Context
+	cancel         context.CancelFunc
+	statusRecorder *peer.Status
+	wgInterface    iface.WGIface
+	routes         map[route.ID]*route.Route
+	routeUpdate    chan RoutesUpdate
+	// peerStateUpdate holds at most one pending routing peer state notification,
+	// see watchPeerStatusChanges
+	peerStateUpdate     chan struct{}
 	routePeersNotifiers map[string]chan struct{} // map of peer key to channel for peer state changes
 	currentChosen       *route.Route
 	currentChosenStatus *routerPeerStatus
-	handler             RouteHandler
-	updateSerial        uint64
+	// lastSwitch is when currentChosen was last replaced by a latency-driven
+	// switch, used to enforce latencySwitchMinDwell. Categorical switches
+	// (failover, metric, relay state) leave it untouched: the dwell exists to
+	// stop latency ping-pong, and arming it on a failover would delay the
+	// return to a recovered better peer.
+	lastSwitch time.Time
+	// latencySwitch marks the evaluation's switch decision as latency-driven;
+	// set by shouldSwitchRoute, consumed when the switch is applied
+	latencySwitch bool
+	// switchReason describes why the evaluation replaced the current routing
+	// peer; set by getBestRouteFromStatuses, consumed when the switch is applied
+	switchReason switchReason
+	// relayedSwitch is how long a current routing peer that dropped from direct
+	// to relayed is kept over an otherwise equivalent direct one. The zero value
+	// switches at once.
+	relayedSwitch relayedSwitchPolicy
+	// trackedCurrent, trackedPeer and trackedDirect are the current route, its
+	// routing peer and whether that peer was connected directly as of the
+	// previous evaluation, used to tell a peer that dropped to relay while
+	// carrying the route from one that was never direct
+	trackedCurrent route.ID
+	trackedPeer    string
+	trackedDirect  bool
+	// degradedSince is when the relayedSwitch delay of the current relayed
+	// routing peer started: its drop from direct, or the first direct contender
+	// if it was never direct. Zero while it is direct or uncontended.
+	degradedSince time.Time
+	// unmeasuredRoute and unmeasuredSince track since when the current route's
+	// peer has had no latency sample, bounding the hold in shouldSwitchRoute
+	unmeasuredRoute route.ID
+	unmeasuredSince time.Time
+	// neverDirect marks a degradedSince started by a direct contender rather
+	// than by a drop from direct, which the "never" policy does not cover
+	neverDirect bool
+	// relayedHold fires when a switch held back by the relayed delay or the
+	// unmeasured latency hold becomes due, so it is applied on time rather than
+	// on the next periodic re-evaluation
+	relayedHold *time.Timer
+	// heldCandidate and heldKind identify the alternative last held back by the
+	// switch rules and the rule holding it, and heldReported is when that was
+	// reported at info level. Routes are re-evaluated on every latency change,
+	// so a hold is reported once per episode instead of on every evaluation.
+	heldCandidate route.ID
+	heldKind      holdKind
+	heldReported  time.Time
+	// reportedUnassigned tracks that the current no-routing-peer episode has
+	// been reported, so the periodic re-evaluation does not repeat it
+	reportedUnassigned bool
+	// done is closed when the Start loop exits, so Stop can wait for it before
+	// removing the routes the loop might still be updating
+	done chan struct{}
+	// lifecycleMu orders Start against Stop: Start runs in its own goroutine
+	// and may begin after Stop, or never, so Stop only waits for done when the
+	// loop has actually started
+	lifecycleMu  sync.Mutex
+	started      bool
+	stopped      bool
+	handler      RouteHandler
+	updateSerial uint64
+	// reconcileAllowedIPs re-applies a routing peer's routed allowed IPs when
+	// it connects while keeping the route, see keepChosenRoute. May be nil.
+	reconcileAllowedIPs func(peerKey string) error
+}
+
+func newPeerStateUpdate() chan struct{} {
+	return make(chan struct{}, 1)
 }
 
 func NewWatcher(config WatcherConfig) *Watcher {
@@ -94,9 +341,12 @@ func NewWatcher(config WatcherConfig) *Watcher {
 		routes:              make(map[route.ID]*route.Route),
 		routePeersNotifiers: make(map[string]chan struct{}),
 		routeUpdate:         make(chan RoutesUpdate),
-		peerStateUpdate:     make(chan map[string]peer.RouterState),
+		peerStateUpdate:     newPeerStateUpdate(),
+		done:                make(chan struct{}),
 		handler:             config.Handler,
 		currentChosenStatus: nil,
+		relayedSwitch:       relayedSwitch(),
+		reconcileAllowedIPs: config.ReconcileAllowedIPs,
 	}
 	return client
 }
@@ -113,23 +363,7 @@ func (w *Watcher) getRouterPeerStatuses() map[route.ID]routerPeerStatus {
 			status:  peerStatus.ConnStatus,
 			relayed: peerStatus.Relayed,
 			latency: peerStatus.Latency,
-		}
-	}
-	return routePeerStatuses
-}
-
-func (w *Watcher) convertRouterPeerStatuses(states map[string]peer.RouterState) map[route.ID]routerPeerStatus {
-	routePeerStatuses := make(map[route.ID]routerPeerStatus)
-	for _, r := range w.routes {
-		peerStatus, ok := states[r.Peer]
-		if !ok {
-			log.Warnf("couldn't fetch peer state: %v", r.Peer)
-			continue
-		}
-		routePeerStatuses[r.ID] = routerPeerStatus{
-			status:  peerStatus.Status,
-			relayed: peerStatus.Relayed,
-			latency: peerStatus.Latency,
+			noise:   peerStatus.LatencyNoise,
 		}
 	}
 	return routePeerStatuses
@@ -139,122 +373,345 @@ func (w *Watcher) convertRouterPeerStatuses(states map[string]peer.RouterState)
 // within a Watcher, taking into account peer connection status, route metrics, and
 // preference for non-relayed and direct connections.
 //
-// It follows these prioritization rules:
+// Candidates are ranked by the categorical criteria first, in this order:
 // * Connection status: Both connected and idle peers are considered, but connected peers always take precedence.
-// * Idle peer penalty: Idle peers receive a significant score penalty to ensure any connected peer is preferred.
 // * Metric: Routes with lower metrics (better) are prioritized.
 // * Non-relayed: Routes without relays are preferred.
-// * Latency: Routes with lower latency are prioritized.
-// * Allowed IPs: Idle peers can still receive allowed IPs to enable lazy connection triggering.
-// * we compare the current score + 10ms to the chosen score to avoid flapping between routes
-// * Stability: In case of equal scores, the currently active route (if any) is maintained.
+// Peers that are equal on all of them are then ranked by latency, lowest first.
+//
+// Idle peers can still receive allowed IPs to enable lazy connection triggering.
+// Connecting peers are skipped: they have no endpoint to assign allowed IPs to.
+//
+// Replacing the current route is subject to shouldSwitchRoute, so latency alone
+// only moves the route when the gain is worth the interruption. In case of a
+// tie, the currently active route (if any) is maintained.
 //
 // It returns the ID of the selected optimal route.
 func (w *Watcher) getBestRouteFromStatuses(routePeerStatuses map[route.ID]routerPeerStatus) (route.ID, routerPeerStatus) {
-	var chosen route.ID
-	chosenScore := float64(0)
-	currScore := float64(0)
-
 	var currID route.ID
 	if w.currentChosen != nil {
 		currID = w.currentChosen.ID
 	}
 
-	var chosenStatus routerPeerStatus
+	var best, current routeCandidate
+	var haveBest, haveCurrent bool
 
 	for _, r := range w.routes {
-		tempScore := float64(0)
 		peerStatus, found := routePeerStatuses[r.ID]
-		// connecting status equals disconnected: no wireguard endpoint to assign allowed IPs to
+		// connecting status equals disconnected: no endpoint to assign allowed IPs to
 		if !found || peerStatus.status == peer.StatusConnecting {
 			continue
 		}
 
-		if r.Metric < route.MaxMetric {
-			metricDiff := route.MaxMetric - r.Metric
-			tempScore = float64(metricDiff) * 10
-		}
-
-		// in some temporal cases, latency can be 0, so we set it to 999ms to not block but try to avoid this route
-		latency := 999 * time.Millisecond
-		if peerStatus.latency != 0 {
-			latency = peerStatus.latency
-		} else if !peerStatus.relayed && peerStatus.status != peer.StatusIdle {
-			log.Tracef("peer %s has 0 latency: [%v]", r.Peer, w.handler)
-		}
-
-		// avoid negative tempScore on the higher latency calculation
-		if latency > 1*time.Second {
-			latency = 999 * time.Millisecond
-		}
-
-		// higher latency is worse score
-		tempScore += 1 - latency.Seconds()
-
-		// apply significant penalty for idle peers to ensure connected peers always take precedence
-		if peerStatus.status == peer.StatusConnected {
-			tempScore += 100_000
-		}
-
-		if !peerStatus.relayed {
-			tempScore++
-		}
-
-		if tempScore > chosenScore || (tempScore == chosenScore && chosen == "") {
-			chosen = r.ID
-			chosenStatus = peerStatus
-			chosenScore = tempScore
-		}
-
-		if chosen == "" && currID == "" {
-			chosen = r.ID
-			chosenStatus = peerStatus
-			chosenScore = tempScore
-		}
-
+		candidate := newRouteCandidate(r, peerStatus)
 		if r.ID == currID {
-			currScore = tempScore
+			current, haveCurrent = candidate, true
+		}
+		if !haveBest || candidate.betterThan(best) {
+			best, haveBest = candidate, true
 		}
 	}
 
-	chosenID := chosen
-	if chosen == "" {
-		chosenID = "<none>"
-	}
-	currentID := currID
-	if currID == "" {
-		currentID = "<none>"
+	// Candidates that tie must not displace the current peer: the routes are
+	// held in a map, so the winner of a tie would otherwise depend on iteration
+	// order and change from one evaluation to the next.
+	if haveCurrent && !best.betterThan(current) {
+		best = current
 	}
 
-	log.Debugf("chosen route: %s, chosen score: %f, current route: %s, current score: %f", chosenID, chosenScore, currentID, currScore)
+	w.trackRelayed(current, haveCurrent)
+	w.trackUnmeasured(current, haveCurrent)
+	w.trackContender(current, best, haveCurrent && haveBest)
+
+	if !haveBest {
+		w.reportUnassigned()
+		w.heldCandidate = ""
+
+		return "", routerPeerStatus{}
+	}
+	w.reportedUnassigned = false
+
+	if haveCurrent && current.id != best.id {
+		if log.IsLevelEnabled(log.DebugLevel) {
+			log.Debugf("best routing peer for [%v] is %s (%s), current is %s (%s)",
+				w.handler, best.peer, best, current.peer, current)
+		}
+
+		if !w.shouldSwitchRoute(current, best) {
+			return current.id, routePeerStatuses[current.id]
+		}
+	}
 
 	switch {
-	case chosen == "":
-		var peers []string
-		for _, r := range w.routes {
-			peers = append(peers, r.Peer)
-		}
-
-		log.Infof("network [%v] has not been assigned a routing peer as no peers from the list %s are currently available", w.handler, peers)
-	case chosen != currID:
-		// we compare the current score + 10ms to the chosen score to avoid flapping between routes
-		if currScore != 0 && currScore+0.01 > chosenScore {
-			log.Debugf("keeping current routing peer %s for [%v]: the score difference with latency is less than 0.01(10ms): current: %f, new: %f",
-				w.currentChosen.Peer, w.handler, currScore, chosenScore)
-			return currID, chosenStatus
-		}
-		var p string
-		if rt := w.routes[chosen]; rt != nil {
-			p = rt.Peer
-		}
-		log.Infof("New chosen route is %s with peer %s with score %f for network [%v]", chosen, p, chosenScore, w.handler)
+	case haveCurrent && current.id == best.id:
+	case haveCurrent:
+		w.switchReason = best.switchReasonOver(current)
+		log.Warnf("switching routing peer for network [%v] from %s to %s: %s (%s)",
+			w.handler, current.peer, best.peer, w.switchReason, best)
+	case w.currentChosen != nil:
+		w.switchReason = switchReasonUnavailable
+		log.Warnf("switching routing peer for network [%v] from %s to %s: %s (%s)",
+			w.handler, w.currentChosen.Peer, best.peer, w.switchReason, best)
+	default:
+		log.Infof("new chosen route is %s with peer %s for network [%v]: %s",
+			best.id, best.peer, w.handler, best)
 	}
 
-	return chosen, chosenStatus
+	return best.id, routePeerStatuses[best.id]
 }
 
-func (w *Watcher) watchPeerStatusChanges(ctx context.Context, peerKey string, peerStateUpdate chan map[string]peer.RouterState, closer chan struct{}) {
-	subscription := w.statusRecorder.SubscribeToPeerStateChanges(ctx, peerKey)
+// reportUnassigned reports that no routing peer is available for the network,
+// once per episode: the periodic re-evaluation would otherwise repeat it for as
+// long as the routing peers stay unavailable.
+func (w *Watcher) reportUnassigned() {
+	if w.reportedUnassigned {
+		return
+	}
+	w.reportedUnassigned = true
+
+	var peers []string
+	for _, r := range w.routes {
+		peers = append(peers, r.Peer)
+	}
+	log.Infof("network [%v] has not been assigned a routing peer as no peers from the list %s are currently available", w.handler, peers)
+}
+
+// trackRelayed records when the current routing peer dropped from a direct to a
+// relayed connection while carrying the route, which starts the relayedSwitch
+// delay at once. A peer that was never direct starts it later, when a direct
+// peer first contends for the route, see relayedSwitchDue.
+func (w *Watcher) trackRelayed(current routeCandidate, haveCurrent bool) {
+	if !haveCurrent {
+		w.trackedCurrent, w.trackedPeer, w.trackedDirect, w.degradedSince = "", "", false, time.Time{}
+		return
+	}
+
+	switch {
+	case current.id != w.trackedCurrent, current.peer != w.trackedPeer, !current.relayed:
+		w.degradedSince = time.Time{}
+	case w.trackedDirect:
+		w.degradedSince, w.neverDirect = time.Now(), false
+		// a new degradation, reported as such even if an earlier one held
+		// back the same candidate
+		w.heldCandidate = ""
+	}
+	w.trackedCurrent, w.trackedPeer, w.trackedDirect = current.id, current.peer, current.isDirect()
+}
+
+// shouldSwitchRoute reports whether the current routing peer should be replaced
+// by the candidate, which outranks it.
+//
+// A candidate that wins on a categorical criterion (it is connected while the
+// current peer is not, has a better metric, or is direct while the current peer
+// is relayed) takes over immediately. The exception is a current peer that only
+// just dropped from direct to relayed, see relayedSwitchDue.
+//
+// A candidate that only has lower latency has to beat the current peer by the
+// switch margin, and the current peer has to have been in place for
+// latencySwitchMinDwell. Every switch interrupts the traffic using the route, so
+// a gain that is marginal, or that the measurement noise of the two paths can
+// account for on its own, is not worth acting on.
+//
+// An approved latency-driven switch sets w.latencySwitch, which arms the dwell
+// time once the switch is applied.
+func (w *Watcher) shouldSwitchRoute(current, candidate routeCandidate) bool {
+	if candidate.winsOnlyOnRelay(current) {
+		return w.relayedSwitchDue(current, candidate)
+	}
+	if candidate.tierBetterThan(current) {
+		return true
+	}
+
+	// Without a sample on both sides there is no gain to weigh. A direct
+	// connection reports no latency until its first sample, so comparing it as
+	// unknownLatency would move the route away from a peer that just recovered.
+	// The hold is bounded so a peer that never gets a sample does not keep the
+	// route for good.
+	if w.unmeasuredHoldActive(current, candidate) {
+		if level := w.holdLevel(candidate, holdLatencyUnmeasured); log.IsLevelEnabled(level) {
+			log.StandardLogger().Logf(level,
+				"keeping routing peer %s for [%v] over %s: latency not measured on both peers yet (%s)",
+				current.peer, w.handler, candidate.peer, candidate)
+		}
+		return false
+	}
+
+	gain := current.latency - candidate.latency
+	if margin := switchMargin(current, candidate); gain < margin {
+		if level := w.holdLevel(candidate, holdLatencyMargin); log.IsLevelEnabled(level) {
+			log.StandardLogger().Logf(level,
+				"keeping routing peer %s for [%v] over %s: latency gain %v on %v is below the %v switch margin (%s)",
+				current.peer, w.handler, candidate.peer, gain, current.latency, margin, candidate)
+		}
+		return false
+	}
+
+	if dwelled := time.Since(w.lastSwitch); dwelled < latencySwitchMinDwell {
+		if level := w.holdLevel(candidate, holdLatencyDwell); log.IsLevelEnabled(level) {
+			log.StandardLogger().Logf(level,
+				"keeping routing peer %s for [%v] over %s: chosen %v ago, below the %v minimum dwell time",
+				current.peer, w.handler, candidate.peer, dwelled.Round(time.Second), latencySwitchMinDwell)
+		}
+		return false
+	}
+
+	w.latencySwitch = true
+
+	return true
+}
+
+// trackContender restarts the relayed delay of a peer that was never direct
+// once no direct contender is left. That delay runs from the first contender,
+// so keeping it would let a later contender take over without waiting. The
+// delay of a peer that dropped from direct keeps running from the drop.
+func (w *Watcher) trackContender(current, best routeCandidate, have bool) {
+	if !w.neverDirect || w.degradedSince.IsZero() {
+		return
+	}
+	if have && best.winsOnlyOnRelay(current) {
+		return
+	}
+	w.degradedSince = time.Time{}
+}
+
+// trackUnmeasured records since when the current route's peer has had no
+// latency sample, and forgets it once the peer is measured or the route moves.
+func (w *Watcher) trackUnmeasured(current routeCandidate, haveCurrent bool) {
+	if !haveCurrent || current.measured || current.id != w.unmeasuredRoute {
+		w.unmeasuredRoute, w.unmeasuredSince = "", time.Time{}
+	}
+	if haveCurrent && !current.measured && w.unmeasuredSince.IsZero() {
+		w.unmeasuredRoute, w.unmeasuredSince = current.id, time.Now()
+	}
+}
+
+// unmeasuredHoldActive reports whether a latency comparison must wait because
+// a side has no sample: always for an unsampled candidate, and for an unsampled
+// current peer until unmeasuredLatencyHold runs out. A pending hold arms
+// relayedHold so the switch is reconsidered when it runs out.
+func (w *Watcher) unmeasuredHoldActive(current, candidate routeCandidate) bool {
+	if !candidate.measured {
+		return true
+	}
+	if current.measured {
+		return false
+	}
+
+	remaining := unmeasuredLatencyHold - time.Since(w.unmeasuredSince)
+	if remaining <= 0 {
+		return false
+	}
+	w.armRelayedHold(remaining)
+
+	return true
+}
+
+// relayedSwitchDue reports whether a relayed current routing peer should give
+// way to a candidate that is better only by being direct.
+//
+// A relayed peer is kept for the relayedSwitch delay: the relay still carries
+// the traffic, and staying keeps every flow through this routing peer alive.
+// For a peer that dropped from direct to relayed the delay runs from the drop,
+// since a direct connection that dropped often recovers within seconds. For a
+// peer that was never direct, as when the peers of a group come up over relay
+// before their direct connections, it runs from the first evaluation that
+// finds a direct contender: the current peer usually turns direct within
+// seconds too. A switch that is not due yet arms relayedHold so it is applied
+// as soon as it becomes due.
+func (w *Watcher) relayedSwitchDue(current, candidate routeCandidate) bool {
+	if w.degradedSince.IsZero() {
+		w.degradedSince, w.neverDirect = time.Now(), true
+	}
+
+	policy := w.relayedSwitch
+	// "never" keeps a peer whose direct connection dropped; one that was never
+	// direct still moves after the default delay instead of staying relayed
+	if policy.never && w.neverDirect {
+		policy = relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}
+	}
+	if !policy.never {
+		remaining := policy.delay - time.Since(w.degradedSince)
+		if remaining <= 0 {
+			return true
+		}
+		w.armRelayedHold(remaining)
+	}
+
+	if level := w.holdLevel(candidate, holdRelayedDelay); log.IsLevelEnabled(level) {
+		log.StandardLogger().Logf(level,
+			"keeping relayed routing peer %s for [%v] over direct %s: held for %v, switch delay %s",
+			current.peer, w.handler, candidate.peer, time.Since(w.degradedSince).Round(time.Second), policy)
+	}
+
+	return false
+}
+
+func (w *Watcher) armRelayedHold(d time.Duration) {
+	if w.relayedHold == nil {
+		w.relayedHold = time.NewTimer(d)
+		return
+	}
+	w.relayedHold.Reset(d)
+}
+
+// relayedHoldC is the channel of relayedHold, nil while it was never armed so
+// that selecting on it blocks.
+func (w *Watcher) relayedHoldC() <-chan time.Time {
+	if w.relayedHold == nil {
+		return nil
+	}
+	return w.relayedHold.C
+}
+
+// holdLevel is the level to report a decision to keep the current routing peer
+// at. The first evaluation that holds a given candidate back under a given rule
+// is reported at info level, because that is what someone wondering why a route
+// did not move needs to see. The repeats stay at debug level for
+// holdReportInterval, including when two near-equal peers keep trading places.
+func (w *Watcher) holdLevel(candidate routeCandidate, kind holdKind) log.Level {
+	if w.heldCandidate == candidate.id && w.heldKind == kind && time.Since(w.heldReported) < holdReportInterval {
+		return log.DebugLevel
+	}
+
+	w.heldCandidate, w.heldKind, w.heldReported = candidate.id, kind, time.Now()
+
+	return log.InfoLevel
+}
+
+// switchMargin is how much lower the candidate's latency has to be before the
+// route moves: at least latencySwitchMinGain, at least latencySwitchGainPercent
+// of the current latency so the margin scales with slow paths, and more than the
+// combined measurement noise of the two paths. The noise term is what keeps a
+// jittery path from moving the route on its own; it vanishes on a stable path,
+// where the fixed margins decide.
+func switchMargin(current, candidate routeCandidate) time.Duration {
+	margin := latencySwitchMinGain
+
+	if relative := current.latency * latencySwitchGainPercent / 100; relative > margin {
+		margin = relative
+	}
+
+	// the two paths vary independently, so their noise adds in quadrature
+	noise := time.Duration(latencyNoiseSigmas * math.Hypot(float64(current.noise), float64(candidate.noise)))
+	if noise > margin {
+		margin = noise
+	}
+
+	return margin
+}
+
+// watchPeerStatusChanges forwards the state changes of a routing peer to the
+// watcher as a notification to re-evaluate. The watcher reads the current peer
+// states when it gets to it, so a notification still pending covers any number
+// of later changes, and the forwarder never waits for a busy watcher: that
+// would stop it draining the subscription and in turn block the peer's updates.
+func (w *Watcher) watchPeerStatusChanges(ctx context.Context, peerKey string, peerStateUpdate chan<- struct{}, closer chan struct{}) {
+	// the subscription gets its own context so a delivery blocked on it is
+	// released as soon as this forwarder exits, not only when the watcher stops
+	subCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	subscription := w.statusRecorder.SubscribeToPeerStateChanges(subCtx, peerKey)
 	defer w.statusRecorder.UnsubscribePeerStateChanges(subscription)
 
 	for {
@@ -263,14 +720,11 @@ func (w *Watcher) watchPeerStatusChanges(ctx context.Context, peerKey string, pe
 			return
 		case <-closer:
 			return
-		case routerStates := <-subscription.Events():
+		case <-subscription.Events():
 			select {
-			case peerStateUpdate <- routerStates:
+			case peerStateUpdate <- struct{}{}:
 				log.Debugf("triggered route state update for Peer: %s", peerKey)
-			case <-ctx.Done():
-				return
-			case <-closer:
-				return
+			default:
 			}
 		}
 	}
@@ -294,6 +748,7 @@ func (w *Watcher) addAllowedIPs(route *route.Route) error {
 		return fmt.Errorf("add allowed IPs for peer %s: %w", route.Peer, err)
 	}
 
+	w.statusRecorder.AddActiveRoutePeer(route.GetHAUniqueID(), route.Peer)
 	if err := w.statusRecorder.AddPeerStateRoute(route.Peer, w.handler.String(), route.GetResourceID()); err != nil {
 		log.Warnf("Failed to update peer state: %v", err)
 	}
@@ -303,6 +758,7 @@ func (w *Watcher) addAllowedIPs(route *route.Route) error {
 }
 
 func (w *Watcher) removeAllowedIPs(route *route.Route, rsn reason) error {
+	w.statusRecorder.RemoveActiveRoutePeer(route.GetHAUniqueID())
 	if err := w.statusRecorder.RemovePeerStateRoute(route.Peer, w.handler.String()); err != nil {
 		log.Warnf("Failed to update peer state: %v", err)
 	}
@@ -316,25 +772,52 @@ func (w *Watcher) removeAllowedIPs(route *route.Route, rsn reason) error {
 	return nil
 }
 
-// shouldSkipRecalculation checks if we can skip route recalculation for the same route without status changes
-func (w *Watcher) shouldSkipRecalculation(newChosenID route.ID, newStatus routerPeerStatus) bool {
-	if w.currentChosen == nil {
+// keepChosenRoute reports whether the evaluation keeps the current route, with
+// the same definition, on the same routing peer. A status change of that peer
+// is recorded without removing and re-adding its allowed IPs, which would leave
+// the prefix without an owner in between. When the peer connects, its routed
+// allowed IPs are re-applied instead: a peer recreated by a peer update comes
+// back with its overlay addresses only.
+func (w *Watcher) keepChosenRoute(newChosenID route.ID, newStatus routerPeerStatus) bool {
+	if w.currentChosen == nil || w.currentChosen.ID != newChosenID {
 		return false
 	}
 
-	isSameRoute := w.currentChosen.ID == newChosenID && w.currentChosen.Equal(w.routes[newChosenID])
-	if !isSameRoute {
+	newChosenRoute := w.routes[newChosenID]
+	if !w.currentChosen.Equal(newChosenRoute) {
 		return false
 	}
 
-	if w.currentChosenStatus != nil {
-		return w.currentChosenStatus.status == newStatus.status
+	if w.currentChosenStatus == nil || w.currentChosenStatus.status == newStatus.status {
+		return true
 	}
 
+	// a failed reconcile leaves the previous status recorded, so the next
+	// evaluation sees the change again and retries
+	if newStatus.status == peer.StatusConnected && !w.reconcileRoutedAllowedIPs(newChosenRoute.Peer) {
+		return true
+	}
+
+	w.currentChosen = newChosenRoute
+	w.currentChosenStatus = &newStatus
+
+	return true
+}
+
+func (w *Watcher) reconcileRoutedAllowedIPs(peerKey string) bool {
+	if w.reconcileAllowedIPs == nil {
+		return true
+	}
+	if err := w.reconcileAllowedIPs(peerKey); err != nil {
+		log.Warnf("failed to reconcile routed allowed IPs of routing peer %s for [%v], will retry: %v", peerKey, w.handler, err)
+		return false
+	}
 	return true
 }
 
 func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]routerPeerStatus) error {
+	w.latencySwitch = false
+	w.switchReason = switchReasonNone
 	newChosenID, newStatus := w.getBestRouteFromStatuses(routerPeerStatuses)
 
 	// If no route is chosen, remove the route from the peer
@@ -346,6 +829,9 @@ func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]
 		if err := w.removeAllowedIPs(w.currentChosen, rsn); err != nil {
 			return fmt.Errorf("remove obsolete: %w", err)
 		}
+		if rsn == reasonPeerUpdate {
+			w.routingPeerLostEvent(w.currentChosen)
+		}
 
 		w.currentChosen = nil
 		w.currentChosenStatus = nil
@@ -353,11 +839,21 @@ func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]
 		return nil
 	}
 
-	// If we can skip recalculation for the same route without changes, do nothing
-	if w.shouldSkipRecalculation(newChosenID, newStatus) {
+	if w.keepChosenRoute(newChosenID, newStatus) {
 		return nil
 	}
 
+	previous := w.currentChosen
+	newChosenRoute := w.routes[newChosenID]
+	// a route update can hand the same route to a different routing peer
+	peerReplaced := previous != nil && previous.ID == newChosenID && previous.Peer != newChosenRoute.Peer
+	switched := previous == nil || previous.ID != newChosenID || peerReplaced
+	if peerReplaced {
+		w.switchReason = switchReasonRouteChanged
+		log.Warnf("switching routing peer for network [%v] from %s to %s: %s",
+			w.handler, previous.Peer, newChosenRoute.Peer, w.switchReason)
+	}
+
 	// If the chosen route was assigned to a different peer, remove the allowed IPs first
 	if isNew := w.currentChosen == nil; !isNew {
 		if err := w.removeAllowedIPs(w.currentChosen, reasonHA); err != nil {
@@ -365,7 +861,6 @@ func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]
 		}
 	}
 
-	newChosenRoute := w.routes[newChosenID]
 	if err := w.addAllowedIPs(newChosenRoute); err != nil {
 		return fmt.Errorf("add new: %w", err)
 	}
@@ -375,20 +870,86 @@ func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]
 
 	w.currentChosen = newChosenRoute
 	w.currentChosenStatus = &newStatus
+	if !switched {
+		return nil
+	}
+
+	// start tracking the new routing peer from the state it was chosen in, so a
+	// drop to relay seen by the next evaluation counts as a degradation
+	w.trackedCurrent, w.trackedPeer = newChosenID, newChosenRoute.Peer
+	w.trackedDirect, w.degradedSince = newStatus.isDirect(), time.Time{}
+	if w.latencySwitch {
+		w.lastSwitch = time.Now()
+	}
+	if previous != nil {
+		w.routingPeerSwitchEvent(previous, newChosenRoute)
+	}
 
 	return nil
 }
 
-func (w *Watcher) connectEvent(route *route.Route) {
-	var defaultRoute bool
-	for _, r := range w.routes {
-		if r.Network.Bits() == 0 {
-			defaultRoute = true
-			break
-		}
+// routingPeerSwitchEvent publishes a replaced routing peer as a system event,
+// so it shows in the status output and debug bundles whatever the log level.
+// Moving a masqueraded route resets the connections that used it. For default
+// routes this adds the reason to the events of disconnectEvent and
+// connectEvent, and carries no user message so it is not shown as a
+// notification a second time.
+func (w *Watcher) routingPeerSwitchEvent(previous, next *route.Route) {
+	if w.statusRecorder == nil {
+		return
 	}
 
-	if !defaultRoute {
+	reason := w.switchReason
+	if reason == switchReasonNone {
+		reason = switchReasonUnavailable
+	}
+
+	w.statusRecorder.PublishEvent(
+		proto.SystemEvent_WARNING,
+		proto.SystemEvent_NETWORK,
+		"Routing peer changed",
+		"",
+		map[string]string{
+			"network":       w.handler.String(),
+			"id":            string(next.NetID),
+			"previous_peer": previous.Peer,
+			"peer":          next.Peer,
+			"reason":        string(reason),
+		},
+	)
+}
+
+// routingPeerLostEvent publishes the loss of the last available routing peer of
+// a network as a system event. Default routes are left to disconnectEvent.
+func (w *Watcher) routingPeerLostEvent(previous *route.Route) {
+	if w.statusRecorder == nil || w.hasDefaultRoute() {
+		return
+	}
+
+	w.statusRecorder.PublishEvent(
+		proto.SystemEvent_WARNING,
+		proto.SystemEvent_NETWORK,
+		"No routing peer available",
+		"",
+		map[string]string{
+			"network":       w.handler.String(),
+			"id":            string(previous.NetID),
+			"previous_peer": previous.Peer,
+		},
+	)
+}
+
+func (w *Watcher) hasDefaultRoute() bool {
+	for _, r := range w.routes {
+		if r.Network.Bits() == 0 {
+			return true
+		}
+	}
+	return false
+}
+
+func (w *Watcher) connectEvent(route *route.Route) {
+	if !w.hasDefaultRoute() {
 		return
 	}
 
@@ -409,15 +970,7 @@ func (w *Watcher) connectEvent(route *route.Route) {
 }
 
 func (w *Watcher) disconnectEvent(route *route.Route, rsn reason) {
-	var defaultRoute bool
-	for _, r := range w.routes {
-		if r.Network.Bits() == 0 {
-			defaultRoute = true
-			break
-		}
-	}
-
-	if !defaultRoute {
+	if !w.hasDefaultRoute() {
 		return
 	}
 
@@ -503,13 +1056,41 @@ func (w *Watcher) classifyUpdate(update RoutesUpdate) bool {
 // Start is the main point of reacting on client network routing events.
 // All the processing related to the client network should be done here. Thread-safe.
 func (w *Watcher) Start() {
+	w.lifecycleMu.Lock()
+	if w.stopped || w.started {
+		w.lifecycleMu.Unlock()
+		return
+	}
+	w.started = true
+	w.lifecycleMu.Unlock()
+
+	defer close(w.done)
+
+	reeval := time.NewTicker(routeReevalInterval)
+	defer reeval.Stop()
+	defer func() {
+		if w.relayedHold != nil {
+			w.relayedHold.Stop()
+		}
+	}()
+
 	for {
 		select {
 		case <-w.ctx.Done():
 			return
-		case routersStates := <-w.peerStateUpdate:
-			routerPeerStatuses := w.convertRouterPeerStatuses(routersStates)
-			if err := w.recalculateRoutes(reasonPeerUpdate, routerPeerStatuses); err != nil {
+		case <-reeval.C:
+			if err := w.recalculateRoutes(reasonPeerUpdate, w.getRouterPeerStatuses()); err != nil {
+				log.Errorf("Failed to re-evaluate routes for network [%v]: %v", w.handler, err)
+			}
+		case <-w.relayedHoldC():
+			if err := w.recalculateRoutes(reasonPeerUpdate, w.getRouterPeerStatuses()); err != nil {
+				log.Errorf("Failed to re-evaluate routes for network [%v]: %v", w.handler, err)
+			}
+		case <-w.peerStateUpdate:
+			// The notification only says that a routing peer changed. The states it
+			// carries can be older than ones already applied, since every routing
+			// peer has its own subscription, so the current states are read instead.
+			if err := w.recalculateRoutes(reasonPeerUpdate, w.getRouterPeerStatuses()); err != nil {
 				log.Errorf("Failed to recalculate routes for network [%v]: %v", w.handler, err)
 			}
 		case update := <-w.routeUpdate:
@@ -548,7 +1129,22 @@ func (w *Watcher) handleRouteUpdate(update RoutesUpdate) {
 func (w *Watcher) Stop() {
 	log.Debugf("Stopping watcher for network [%v]", w.handler)
 
+	w.lifecycleMu.Lock()
+	if w.stopped {
+		w.lifecycleMu.Unlock()
+		return
+	}
+	w.stopped = true
+	started := w.started
+	w.lifecycleMu.Unlock()
+
 	w.cancel()
+	// wait for the Start loop to exit: it may be inside a recalculation, and
+	// cleaning up concurrently would race on currentChosen and could leave the
+	// allowed IPs of a route chosen after this point behind
+	if started {
+		<-w.done
+	}
 
 	if w.currentChosen == nil {
 		return
diff --git a/client/internal/routemanager/client/client_bench_test.go b/client/internal/routemanager/client/client_bench_test.go
index 668aec427..b788015db 100644
--- a/client/internal/routemanager/client/client_bench_test.go
+++ b/client/internal/routemanager/client/client_bench_test.go
@@ -23,6 +23,12 @@ var benchmarkTiers = []benchmarkTier{
 	{"Small", 100, 50, 4},
 	{"Medium", 1000, 200, 16},
 	{"Large", 5000, 500, 32},
+	// the tiers below are deliberately past anything realistic: a watcher holds
+	// the routes of a single network, while these give one watcher every route
+	// in the account at once
+	{"ManyPeers", 20000, 500, 32},
+	{"ManyRoutes", 1000, 5000, 16},
+	{"ManyBoth", 20000, 5000, 32},
 }
 
 type mockRouteHandler struct {
@@ -136,7 +142,7 @@ func BenchmarkRecalculateRoutes(b *testing.B) {
 				routes:              routes,
 				routePeersNotifiers: make(map[string]chan struct{}),
 				routeUpdate:         make(chan RoutesUpdate),
-				peerStateUpdate:     make(chan map[string]peer.RouterState),
+				peerStateUpdate:     newPeerStateUpdate(),
 				handler:             &mockRouteHandler{network: "benchmark"},
 				currentChosenStatus: nil,
 			}
diff --git a/client/internal/routemanager/client/client_test.go b/client/internal/routemanager/client/client_test.go
index 850f6691f..641383e90 100644
--- a/client/internal/routemanager/client/client_test.go
+++ b/client/internal/routemanager/client/client_test.go
@@ -1,11 +1,18 @@
 package client
 
 import (
+	"context"
+	"errors"
 	"fmt"
 	"net/netip"
+	"sync"
 	"testing"
 	"time"
 
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/routemanager/common"
 	"github.com/netbirdio/netbird/client/internal/routemanager/static"
@@ -316,6 +323,145 @@ func TestGetBestrouteFromStatuses(t *testing.T) {
 			currentRoute:    "route1",
 			expectedRouteID: "route2",
 		},
+		{
+			// 40ms gain clears latencySwitchMinGain but not the 20% of 300ms
+			name: "latency gain below the relative margin should not change the route",
+			statuses: map[route.ID]routerPeerStatus{
+				"route1": {
+					status:  peer.StatusConnected,
+					latency: 300 * time.Millisecond,
+				},
+				"route2": {
+					status:  peer.StatusConnected,
+					latency: 260 * time.Millisecond,
+				},
+			},
+			existingRoutes: map[route.ID]*route.Route{
+				"route1": {
+					ID:     "route1",
+					Metric: route.MaxMetric,
+					Peer:   "peer1",
+				},
+				"route2": {
+					ID:     "route2",
+					Metric: route.MaxMetric,
+					Peer:   "peer2",
+				},
+			},
+			currentRoute:    "route1",
+			expectedRouteID: "route1",
+		},
+		{
+			name: "latency gain above both margins should change the route",
+			statuses: map[route.ID]routerPeerStatus{
+				"route1": {
+					status:  peer.StatusConnected,
+					latency: 300 * time.Millisecond,
+				},
+				"route2": {
+					status:  peer.StatusConnected,
+					latency: 200 * time.Millisecond,
+				},
+			},
+			existingRoutes: map[route.ID]*route.Route{
+				"route1": {
+					ID:     "route1",
+					Metric: route.MaxMetric,
+					Peer:   "peer1",
+				},
+				"route2": {
+					ID:     "route2",
+					Metric: route.MaxMetric,
+					Peer:   "peer2",
+				},
+			},
+			currentRoute:    "route1",
+			expectedRouteID: "route2",
+		},
+		{
+			// 7ms gain is 58% of the current latency but below latencySwitchMinGain
+			name: "latency gain below the absolute margin should not change the route",
+			statuses: map[route.ID]routerPeerStatus{
+				"route1": {
+					status:  peer.StatusConnected,
+					latency: 12 * time.Millisecond,
+				},
+				"route2": {
+					status:  peer.StatusConnected,
+					latency: 5 * time.Millisecond,
+				},
+			},
+			existingRoutes: map[route.ID]*route.Route{
+				"route1": {
+					ID:     "route1",
+					Metric: route.MaxMetric,
+					Peer:   "peer1",
+				},
+				"route2": {
+					ID:     "route2",
+					Metric: route.MaxMetric,
+					Peer:   "peer2",
+				},
+			},
+			currentRoute:    "route1",
+			expectedRouteID: "route1",
+		},
+		{
+			name: "current relayed peer should be replaced by a direct peer with worse latency",
+			statuses: map[route.ID]routerPeerStatus{
+				"route1": {
+					status:  peer.StatusConnected,
+					relayed: true,
+					latency: 10 * time.Millisecond,
+				},
+				"route2": {
+					status:  peer.StatusConnected,
+					relayed: false,
+					latency: 200 * time.Millisecond,
+				},
+			},
+			existingRoutes: map[route.ID]*route.Route{
+				"route1": {
+					ID:     "route1",
+					Metric: route.MaxMetric,
+					Peer:   "peer1",
+				},
+				"route2": {
+					ID:     "route2",
+					Metric: route.MaxMetric,
+					Peer:   "peer2",
+				},
+			},
+			currentRoute:    "route1",
+			expectedRouteID: "route2",
+		},
+		{
+			name: "better metric should replace the current peer with better latency",
+			statuses: map[route.ID]routerPeerStatus{
+				"route1": {
+					status:  peer.StatusConnected,
+					latency: 10 * time.Millisecond,
+				},
+				"route2": {
+					status:  peer.StatusConnected,
+					latency: 300 * time.Millisecond,
+				},
+			},
+			existingRoutes: map[route.ID]*route.Route{
+				"route1": {
+					ID:     "route1",
+					Metric: route.MaxMetric,
+					Peer:   "peer1",
+				},
+				"route2": {
+					ID:     "route2",
+					Metric: 5000,
+					Peer:   "peer2",
+				},
+			},
+			currentRoute:    "route1",
+			expectedRouteID: "route2",
+		},
 		{
 			name: "current chosen route doesn't exist anymore",
 			statuses: map[route.ID]routerPeerStatus{
@@ -828,3 +974,591 @@ func TestGetBestrouteFromStatuses(t *testing.T) {
 		})
 	}
 }
+
+// newTestWatcher builds a watcher over two routes of equal metric, with route1
+// as the currently chosen one.
+func newTestWatcher(t *testing.T, lastSwitch time.Time) *Watcher {
+	t.Helper()
+
+	routes := map[route.ID]*route.Route{
+		"route1": {ID: "route1", Metric: route.MaxMetric, Peer: "peer1"},
+		"route2": {ID: "route2", Metric: route.MaxMetric, Peer: "peer2"},
+	}
+
+	params := common.HandlerParams{
+		Route: &route.Route{Network: netip.MustParsePrefix("192.168.0.0/24")},
+	}
+
+	return &Watcher{
+		handler:       static.NewRoute(params),
+		routes:        routes,
+		currentChosen: routes["route1"],
+		lastSwitch:    lastSwitch,
+	}
+}
+
+func TestLatencySwitchDwellTime(t *testing.T) {
+	// a gain large enough to clear both switch margins
+	statuses := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 100 * time.Millisecond},
+	}
+
+	t.Run("latency switch is held during the dwell time", func(t *testing.T) {
+		w := newTestWatcher(t, time.Now())
+
+		chosen, _ := w.getBestRouteFromStatuses(statuses)
+		assert.Equal(t, route.ID("route1"), chosen, "route should be kept while the dwell time has not elapsed")
+	})
+
+	t.Run("latency switch is allowed after the dwell time", func(t *testing.T) {
+		w := newTestWatcher(t, time.Now().Add(-latencySwitchMinDwell-time.Second))
+
+		chosen, _ := w.getBestRouteFromStatuses(statuses)
+		assert.Equal(t, route.ID("route2"), chosen, "route should switch once the dwell time has elapsed")
+	})
+
+	t.Run("categorical improvement ignores the dwell time", func(t *testing.T) {
+		w := newTestWatcher(t, time.Now())
+
+		// route1 is no longer connected, so the dwell time must not delay failover
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusIdle, latency: 10 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+		})
+		assert.Equal(t, route.ID("route2"), chosen, "failover must not be delayed by the dwell time")
+	})
+}
+
+// TestLatencySwitchNoiseMargin covers the noise aware margin: on a jittery path
+// the smoothed latencies of two equivalent peers keep drifting apart by tens of
+// milliseconds, and that difference must not move the route even though it
+// clears the fixed margins.
+// Measurements on slow paths must keep their order: a peer measured at 1.2s is
+// better than one at 2.5s, and a peer without a sample still ranks below both.
+func TestSlowPathLatenciesKeepTheirOrder(t *testing.T) {
+	w := newTestWatcher(t, time.Time{})
+
+	chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 2500 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 1200 * time.Millisecond},
+	})
+	assert.Equal(t, route.ID("route2"), chosen, "a 1.3s gain on a 2.5s path must move the route")
+
+	unsampled := newRouteCandidate(w.routes["route1"], routerPeerStatus{status: peer.StatusConnected})
+	slow := newRouteCandidate(w.routes["route2"], routerPeerStatus{status: peer.StatusConnected, latency: 5 * time.Second})
+	assert.True(t, slow.betterThan(unsampled), "a measured peer must rank above one without a sample")
+}
+
+func TestLatencySwitchNoiseMargin(t *testing.T) {
+	t.Run("a gain within the measurement noise does not switch", func(t *testing.T) {
+		w := newTestWatcher(t, time.Time{})
+
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 120 * time.Millisecond, noise: 12 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 80 * time.Millisecond, noise: 12 * time.Millisecond},
+		})
+		assert.Equal(t, route.ID("route1"), chosen, "a 40ms gain between two paths jittering by 12ms is not a real difference")
+	})
+
+	t.Run("a gain beyond the measurement noise switches", func(t *testing.T) {
+		w := newTestWatcher(t, time.Time{})
+
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 300 * time.Millisecond, noise: 12 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 80 * time.Millisecond, noise: 12 * time.Millisecond},
+		})
+		assert.Equal(t, route.ID("route2"), chosen, "a 220ms gain stands out from 12ms of jitter")
+	})
+
+	// the held candidate is tracked so the decision is reported once per episode
+	// rather than on every re-evaluation
+	t.Run("holding a candidate back is tracked as one episode", func(t *testing.T) {
+		w := newTestWatcher(t, time.Time{})
+
+		within := map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 120 * time.Millisecond, noise: 12 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 80 * time.Millisecond, noise: 12 * time.Millisecond},
+		}
+
+		w.getBestRouteFromStatuses(within)
+		assert.Equal(t, route.ID("route2"), w.heldCandidate, "the held candidate should be recorded on the first hold")
+
+		w.getBestRouteFromStatuses(within)
+		assert.Equal(t, route.ID("route2"), w.heldCandidate, "a repeated hold of the same candidate stays the same episode")
+
+		// the smoothed latencies of two near-equal peers keep crossing: route2
+		// falling behind for a moment must not start a new episode
+		w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 80 * time.Millisecond, noise: 12 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 120 * time.Millisecond, noise: 12 * time.Millisecond},
+		})
+		held := routeCandidate{id: "route2"}
+		assert.Equal(t, log.DebugLevel, w.holdLevel(held, holdLatencyMargin), "holding route2 back again after a crossing is a repeat")
+
+		// a hold reported long ago is worth reporting again
+		w.heldReported = w.heldReported.Add(-holdReportInterval - time.Second)
+		assert.Equal(t, log.InfoLevel, w.holdLevel(held, holdLatencyMargin), "a hold is reported again once the report interval passed")
+	})
+
+	t.Run("a stable path is decided by the fixed margins", func(t *testing.T) {
+		w := newTestWatcher(t, time.Time{})
+
+		// the same 40ms gain as the first case, on paths that barely vary
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 120 * time.Millisecond, noise: 300 * time.Microsecond},
+			"route2": {status: peer.StatusConnected, latency: 80 * time.Millisecond, noise: 300 * time.Microsecond},
+		})
+		assert.Equal(t, route.ID("route2"), chosen, "without jitter a 40ms gain on a 120ms path is a real improvement")
+	})
+}
+
+// recordingHandler records the allowed IPs calls a watcher makes.
+type recordingHandler struct {
+	added   []string
+	removed int
+}
+
+func (h *recordingHandler) String() string                 { return "recording" }
+func (h *recordingHandler) AddRoute(context.Context) error { return nil }
+func (h *recordingHandler) RemoveRoute() error             { return nil }
+func (h *recordingHandler) AddAllowedIPs(peerKey string) error {
+	h.added = append(h.added, peerKey)
+	return nil
+}
+
+func (h *recordingHandler) RemoveAllowedIPs() error {
+	h.removed++
+	return nil
+}
+
+func newRecalcWatcher(t *testing.T) (*Watcher, *recordingHandler) {
+	t.Helper()
+
+	handler := &recordingHandler{}
+	routes := map[route.ID]*route.Route{
+		"route1": {ID: "route1", Metric: route.MaxMetric, Peer: "peer1"},
+		"route2": {ID: "route2", Metric: route.MaxMetric, Peer: "peer2"},
+	}
+
+	return &Watcher{
+		statusRecorder: peer.NewRecorder("https://mgm"),
+		routes:         routes,
+		handler:        handler,
+	}, handler
+}
+
+// TestRecalculateRoutesAssignsIdlePeer covers the lazy connection path: an idle
+// routing peer has no established connection yet, but must still receive the
+// allowed IPs so that traffic for the route can trigger the connection.
+func TestRecalculateRoutesAssignsIdlePeer(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	err := w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusIdle},
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, []string{"peer1"}, handler.added, "an idle routing peer should still get the allowed IPs")
+	require.NotNil(t, w.currentChosen, "an idle peer should be chosen when it is the only candidate")
+	assert.Equal(t, route.ID("route1"), w.currentChosen.ID)
+}
+
+func TestRecalculateRoutesDwellTime(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	// route2 has no status yet, so route1 is the only candidate
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+	require.True(t, w.lastSwitch.IsZero(), "the initial assignment is not latency-driven and must not arm the dwell time")
+
+	betterRoute2 := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 100 * time.Millisecond},
+	}
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, betterRoute2))
+	assert.Equal(t, []string{"peer1", "peer2"}, handler.added, "a latency switch with no recent switch should be allowed")
+	assert.Equal(t, 1, handler.removed)
+	require.False(t, w.lastSwitch.IsZero(), "a latency-driven switch must arm the dwell time")
+
+	// the peers trade places: switching back is again latency-only, but now
+	// inside the dwell window
+	betterRoute1 := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 100 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+	}
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, betterRoute1))
+	assert.Equal(t, []string{"peer1", "peer2"}, handler.added, "the route should be held during the dwell time")
+
+	w.lastSwitch = w.lastSwitch.Add(-latencySwitchMinDwell - time.Second)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, betterRoute1))
+	assert.Equal(t, []string{"peer1", "peer2", "peer1"}, handler.added, "the route should switch once the dwell time elapsed")
+	assert.Equal(t, 2, handler.removed)
+
+	// the switch re-armed the dwell time, which must not delay failover
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting, latency: 100 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+	}))
+	assert.Equal(t, []string{"peer1", "peer2", "peer1", "peer2"}, handler.added, "losing the routing peer must fail over regardless of the dwell time")
+	assert.Equal(t, 3, handler.removed)
+}
+
+// TestFailoverDoesNotArmDwellTime covers the recovery path: a failover to a
+// worse peer must not start the dwell time, or traffic would be stuck on the
+// worse path for the full dwell after the better peer comes back.
+func TestFailoverDoesNotArmDwellTime(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 200 * time.Millisecond},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+
+	// peer1 blips into connecting: unguarded failover to the worse peer2
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting, latency: 20 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 200 * time.Millisecond},
+	}))
+	require.Equal(t, []string{"peer1", "peer2"}, handler.added, "failover to the remaining peer should happen")
+	require.True(t, w.lastSwitch.IsZero(), "a failover must not arm the dwell time")
+
+	// peer1 recovers seconds later: the return is latency-only but must not be
+	// held back by a dwell the failover would have armed
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 200 * time.Millisecond},
+	}))
+	assert.Equal(t, []string{"peer1", "peer2", "peer1"}, handler.added, "the recovered better peer should take the route back immediately")
+}
+
+// blockingHandler records the allowed IPs calls in order and blocks the first
+// AddAllowedIPs until released, to hold a recalculation in flight.
+type blockingHandler struct {
+	mu      sync.Mutex
+	calls   []string
+	entered chan struct{}
+	release chan struct{}
+	once    sync.Once
+}
+
+func (h *blockingHandler) String() string                 { return "blocking" }
+func (h *blockingHandler) AddRoute(context.Context) error { return nil }
+func (h *blockingHandler) RemoveRoute() error             { return nil }
+
+func (h *blockingHandler) AddAllowedIPs(peerKey string) error {
+	h.once.Do(func() {
+		close(h.entered)
+		<-h.release
+	})
+	h.record("add " + peerKey)
+	return nil
+}
+
+func (h *blockingHandler) RemoveAllowedIPs() error {
+	h.record("remove")
+	return nil
+}
+
+func (h *blockingHandler) record(call string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	h.calls = append(h.calls, call)
+}
+
+// TestStopWaitsForStart covers the shutdown ordering: Stop must not clean up
+// while the Start loop is still inside a recalculation, or it would remove the
+// allowed IPs before the recalculation adds them and leave them behind.
+func TestStopWaitsForStart(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+	handler := &blockingHandler{entered: make(chan struct{}), release: make(chan struct{})}
+	w.handler = handler
+
+	require.NoError(t, w.statusRecorder.AddPeer("peer1", "peer1.netbird.cloud", "100.64.0.1", ""))
+	require.NoError(t, w.statusRecorder.UpdatePeerState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnected}))
+
+	w.ctx, w.cancel = context.WithCancel(context.Background())
+	w.done = make(chan struct{})
+	w.peerStateUpdate = make(chan struct{})
+	go w.Start()
+
+	// the unbuffered send returns once the loop took the notification, so the
+	// loop is running and about to recalculate
+	w.peerStateUpdate <- struct{}{}
+	select {
+	case <-handler.entered:
+	case <-time.After(2 * time.Second):
+		t.Fatal("the notification should start a recalculation")
+	}
+
+	finished := make(chan struct{})
+	go func() {
+		w.Stop()
+		close(finished)
+	}()
+
+	select {
+	case <-finished:
+		t.Fatal("Stop must wait for the recalculation in flight")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	close(handler.release)
+	select {
+	case <-finished:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Stop should return once the Start loop has exited")
+	}
+
+	handler.mu.Lock()
+	defer handler.mu.Unlock()
+	assert.Equal(t, []string{"add peer1", "remove"}, handler.calls, "Stop must clean up after the recalculation, not before it")
+}
+
+// A notification carries no peer states: every routing peer has its own
+// subscription and forwarder feeding the same channel, so a snapshot could
+// arrive after a newer one. The watcher acts on the states in the recorder as
+// of when it handles the notification.
+func TestPeerStateNotificationUsesRecordedStates(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	recorder := w.statusRecorder
+	for _, key := range []string{"peer1", "peer2"} {
+		require.NoError(t, recorder.AddPeer(key, key+".netbird.cloud", "100.64.0.1", ""))
+	}
+	require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnected}))
+	require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer2", ConnStatus: peer.StatusConnecting}))
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, w.getRouterPeerStatuses()))
+	require.Equal(t, []string{"peer1"}, handler.added)
+
+	w.ctx, w.cancel = context.WithCancel(context.Background())
+	w.done = make(chan struct{})
+	w.peerStateUpdate = make(chan struct{})
+	go w.Start()
+
+	require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnecting}))
+	require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer2", ConnStatus: peer.StatusConnected}))
+	w.peerStateUpdate <- struct{}{}
+	w.Stop()
+
+	assert.Equal(t, []string{"peer1", "peer2"}, handler.added, "the notification must move the route according to the recorded states")
+}
+
+// While the watcher is busy, for instance inside a recalculation, the peer state
+// forwarder must keep draining its subscription. Otherwise the subscription
+// buffer fills up and the peer's next state update blocks its caller, the
+// peer's connection handling, until the watcher is free again.
+func TestPeerStateForwarderDoesNotBlockWhileWatcherIsBusy(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+	w.peerStateUpdate = newPeerStateUpdate()
+
+	recorder := w.statusRecorder
+	require.NoError(t, recorder.AddPeer("peer1", "peer1.netbird.cloud", "100.64.0.1", ""))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	closer := make(chan struct{})
+	go w.watchPeerStatusChanges(ctx, "peer1", w.peerStateUpdate, closer)
+
+	// wait for the forwarder's subscription to exist, so the updates below reach it
+	require.Eventually(t, func() bool {
+		require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnected}))
+		require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnecting}))
+		select {
+		case <-w.peerStateUpdate:
+			return true
+		case <-time.After(50 * time.Millisecond):
+			return false
+		}
+	}, 2*time.Second, 10*time.Millisecond, "the forwarder must pass on a notification")
+
+	// nobody reads peerStateUpdate: the watcher is busy
+	updated := make(chan struct{})
+	go func() {
+		defer close(updated)
+		for i := 0; i < 50; i++ {
+			status := peer.StatusConnected
+			if i%2 == 1 {
+				status = peer.StatusConnecting
+			}
+			if err := recorder.UpdatePeerICEState(peer.State{PubKey: "peer1", ConnStatus: status}); err != nil {
+				t.Errorf("update peer state: %v", err)
+				return
+			}
+		}
+	}()
+
+	select {
+	case <-updated:
+	case <-time.After(2 * time.Second):
+		t.Fatal("peer state updates must not block while the watcher is busy")
+	}
+}
+
+// TestStopWithoutStart covers a watcher whose Start goroutine never ran, or ran
+// only after Stop: Stop must return instead of waiting for a loop that does not
+// exist, and a late Start must not begin working on a stopped watcher.
+func TestStopWithoutStart(t *testing.T) {
+	w := NewWatcher(WatcherConfig{
+		Context:        context.Background(),
+		StatusRecorder: peer.NewRecorder("https://mgm"),
+		Handler:        &recordingHandler{},
+	})
+
+	finished := make(chan struct{})
+	go func() {
+		w.Stop()
+		close(finished)
+	}()
+
+	select {
+	case <-finished:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Stop must return when Start was never called")
+	}
+
+	started := make(chan struct{})
+	go func() {
+		w.Start()
+		close(started)
+	}()
+
+	select {
+	case <-started:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Start after Stop must return immediately")
+	}
+}
+
+// TestUnassignedNetworkReportedOncePerEpisode covers the no-routing-peer log:
+// the periodic re-evaluation hits the same branch every tick, so the episode
+// must be reported once, and again only after a route was assigned in between.
+func TestUnassignedNetworkReportedOncePerEpisode(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+
+	unassigned := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting},
+	}
+	assigned := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 10 * time.Millisecond},
+	}
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, unassigned))
+	assert.True(t, w.reportedUnassigned, "the first unassigned evaluation should be reported")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, unassigned))
+	assert.True(t, w.reportedUnassigned, "repeats stay within the same episode")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, assigned))
+	assert.False(t, w.reportedUnassigned, "an assigned route ends the episode")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, unassigned))
+	assert.True(t, w.reportedUnassigned, "losing the route again starts a new episode")
+}
+
+// TestLatencyJitterDoesNotSwitchRoute walks two equivalent peers through jitter
+// around the same mean. Neither peer is genuinely better, so the route must not
+// move at any point.
+func TestLatencyJitterDoesNotSwitchRoute(t *testing.T) {
+	w := newTestWatcher(t, time.Time{})
+
+	jitter := []int{-6, 3, -4, 8, -2, 5, -7, 1, 6, -3}
+	for i, offsetMs := range jitter {
+		offset := time.Duration(offsetMs) * time.Millisecond
+		statuses := map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 20*time.Millisecond + offset},
+			"route2": {status: peer.StatusConnected, latency: 20*time.Millisecond - offset},
+		}
+
+		chosen, _ := w.getBestRouteFromStatuses(statuses)
+		require.Equal(t, route.ID("route1"), chosen, "route changed on jitter at sample %d", i)
+	}
+}
+
+// A routing peer that keeps the route while only its connection status changes,
+// as when an idle peer is woken by traffic, must keep its allowed IPs in place:
+// removing and re-adding them leaves the prefix without an owner in between.
+func TestRecalculateRoutesStatusChangeKeepsAllowedIPs(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusIdle},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+	}))
+	assert.Equal(t, []string{"peer1"}, handler.added, "a status change must not re-add the allowed IPs")
+	assert.Equal(t, 0, handler.removed, "a status change must not remove the allowed IPs")
+	require.NotNil(t, w.currentChosenStatus)
+	assert.Equal(t, peer.StatusConnected, w.currentChosenStatus.status, "the new status must be recorded")
+}
+
+// A routing peer recreated by a peer update comes back idle with its overlay
+// addresses only. When it connects while keeping the route, its routed allowed
+// IPs must be re-applied, since nothing else puts them back on the new peer.
+func TestRecalculateRoutesReconcilesAllowedIPsOnConnect(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+	var reconciled []string
+	w.reconcileAllowedIPs = func(peerKey string) error {
+		reconciled = append(reconciled, peerKey)
+		return nil
+	}
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+	require.Empty(t, reconciled, "a fresh assignment adds the allowed IPs itself")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusIdle},
+	}))
+	assert.Empty(t, reconciled, "going idle must not reconcile")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+	}))
+	assert.Equal(t, []string{"peer1"}, reconciled, "connecting while keeping the route must reconcile its allowed IPs")
+	assert.Equal(t, []string{"peer1"}, handler.added, "the reconcile must not go through the refcounted add")
+	assert.Equal(t, 0, handler.removed, "the allowed IPs must not be removed")
+}
+
+// A failed reconcile must be retried: the new status is only recorded once the
+// routed allowed IPs are back, so the next evaluation tries again.
+func TestRecalculateRoutesRetriesFailedReconcile(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+	calls := 0
+	w.reconcileAllowedIPs = func(string) error {
+		calls++
+		if calls == 1 {
+			return errors.New("add allowed IP: transient failure")
+		}
+		return nil
+	}
+
+	connected := map[route.ID]routerPeerStatus{"route1": {status: peer.StatusConnected}}
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, connected))
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusIdle},
+	}))
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, connected))
+	require.Equal(t, 1, calls, "connecting must reconcile")
+	assert.Equal(t, peer.StatusIdle, w.currentChosenStatus.status, "a failed reconcile must not record the new status")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, connected))
+	assert.Equal(t, 2, calls, "the next evaluation must retry the reconcile")
+	assert.Equal(t, peer.StatusConnected, w.currentChosenStatus.status, "a successful reconcile records the status")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, connected))
+	assert.Equal(t, 2, calls, "nothing to retry once the reconcile succeeded")
+}
diff --git a/client/internal/routemanager/client/env.go b/client/internal/routemanager/client/env.go
new file mode 100644
index 000000000..6a7c08a1f
--- /dev/null
+++ b/client/internal/routemanager/client/env.go
@@ -0,0 +1,78 @@
+package client
+
+import (
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// envRelayedSwitchDelay sets how long a routing peer that dropped from a
+	// direct to a relayed connection while carrying the route is kept before the
+	// route moves to an equivalent peer with a direct connection. A routing peer
+	// that was never direct is kept for the same delay from when a direct peer
+	// first contends for the route. Takes a duration ("30s", "0" to switch at
+	// once) or "never" to only leave a peer that dropped from direct when it
+	// disconnects; a peer that was never direct then uses the default delay.
+	envRelayedSwitchDelay = "NB_HA_RELAYED_SWITCH_DELAY"
+
+	relayedSwitchDelayNever = "never"
+
+	// defaultRelayedSwitchDelay covers the common case of a direct connection
+	// that drops to relay and recovers within seconds. Moving the route
+	// resets every masqueraded flow using it, staying on the relay does not.
+	defaultRelayedSwitchDelay = 30 * time.Second
+)
+
+// relayedSwitchPolicy is the resolved envRelayedSwitchDelay setting.
+type relayedSwitchPolicy struct {
+	delay time.Duration
+	// never keeps a connected relayed routing peer regardless of delay
+	never bool
+}
+
+func (p relayedSwitchPolicy) String() string {
+	if p.never {
+		return relayedSwitchDelayNever
+	}
+	return p.delay.String()
+}
+
+var (
+	relayedSwitchOnce     sync.Once
+	resolvedRelayedSwitch relayedSwitchPolicy
+)
+
+// relayedSwitch returns the process-wide relayed switch policy, read from the
+// environment on first use.
+func relayedSwitch() relayedSwitchPolicy {
+	relayedSwitchOnce.Do(func() {
+		resolvedRelayedSwitch = parseRelayedSwitchPolicy(os.Getenv(envRelayedSwitchDelay))
+		log.Infof("routing peer relayed switch delay: %s", resolvedRelayedSwitch)
+	})
+	return resolvedRelayedSwitch
+}
+
+func parseRelayedSwitchPolicy(raw string) relayedSwitchPolicy {
+	def := relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}
+
+	val := strings.TrimSpace(raw)
+	if val == "" {
+		return def
+	}
+	if strings.EqualFold(val, relayedSwitchDelayNever) {
+		return relayedSwitchPolicy{never: true}
+	}
+
+	delay, err := time.ParseDuration(val)
+	if err != nil || delay < 0 {
+		log.Warnf("invalid %s value %q, using the default of %s: want a duration or %q",
+			envRelayedSwitchDelay, raw, def, relayedSwitchDelayNever)
+		return def
+	}
+
+	return relayedSwitchPolicy{delay: delay}
+}
diff --git a/client/internal/routemanager/client/relayed_switch_test.go b/client/internal/routemanager/client/relayed_switch_test.go
new file mode 100644
index 000000000..f70dfff50
--- /dev/null
+++ b/client/internal/routemanager/client/relayed_switch_test.go
@@ -0,0 +1,504 @@
+package client
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/route"
+)
+
+func TestParseRelayedSwitchPolicy(t *testing.T) {
+	testCases := []struct {
+		raw  string
+		want relayedSwitchPolicy
+	}{
+		{raw: "", want: relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}},
+		{raw: "  ", want: relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}},
+		{raw: "0", want: relayedSwitchPolicy{}},
+		{raw: "10s", want: relayedSwitchPolicy{delay: 10 * time.Second}},
+		{raw: " 2m ", want: relayedSwitchPolicy{delay: 2 * time.Minute}},
+		{raw: "never", want: relayedSwitchPolicy{never: true}},
+		{raw: "NEVER", want: relayedSwitchPolicy{never: true}},
+		// unrecognised values keep the default rather than guessing
+		{raw: "-5s", want: relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}},
+		{raw: "soon", want: relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}},
+		{raw: "30", want: relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.raw, func(t *testing.T) {
+			assert.Equal(t, tc.want, parseRelayedSwitchPolicy(tc.raw), "policy parsed from %q", tc.raw)
+		})
+	}
+}
+
+// newRelayedTestWatcher is a watcher over two equal-metric routes, currently on
+// route1, for the given policy.
+func newRelayedTestWatcher(t *testing.T, policy relayedSwitchPolicy) *Watcher {
+	t.Helper()
+
+	w := newTestWatcher(t, time.Time{})
+	w.relayedSwitch = policy
+	t.Cleanup(func() {
+		if w.relayedHold != nil {
+			w.relayedHold.Stop()
+		}
+	})
+	return w
+}
+
+// degrade walks the current routing peer route1 from direct to relayed, the way
+// it is seen when a direct connection carrying the route drops to relay.
+func degrade(t *testing.T, w *Watcher) {
+	t.Helper()
+
+	chosen, _ := w.getBestRouteFromStatuses(currentDirect)
+	require.Equal(t, route.ID("route1"), chosen, "route1 must carry the route while direct")
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	require.Equal(t, route.ID("route1"), chosen, "a routing peer that just dropped to relay must be kept")
+	require.False(t, w.degradedSince.IsZero(), "the drop to relay must be recorded")
+}
+
+var (
+	// route1 is relayed, route2 is an equivalent peer with a direct connection
+	currentRelayed = map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true, latency: 50 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+	}
+	currentDirect = map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 50 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+	}
+)
+
+func TestDegradedRoutingPeerIsKeptDuringDelay(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	degrade(t, w)
+	require.NotNil(t, w.relayedHold, "the pending switch must arm a timer so it is applied when due")
+
+	// the direct connection comes back within the delay: nothing moved, and the
+	// degraded period ends
+	chosen, _ := w.getBestRouteFromStatuses(currentDirect)
+	assert.Equal(t, route.ID("route1"), chosen, "the recovered routing peer must stay chosen")
+	assert.True(t, w.degradedSince.IsZero(), "the degraded period must end once the peer is direct again")
+}
+
+func TestDegradedRoutingPeerIsReplacedAfterDelay(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	degrade(t, w)
+	w.degradedSince = w.degradedSince.Add(-31 * time.Second)
+
+	chosen, _ := w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route2"), chosen, "a routing peer relayed for longer than the delay must give way to a direct one")
+	assert.Equal(t, switchReasonDirect, w.switchReason, "the switch reason must name the relayed connection")
+}
+
+// A routing peer that was relayed when it was chosen is held for the delay when
+// an equivalent direct peer shows up, from that moment on: it usually turns
+// direct within seconds, and moving the route resets its masqueraded flows.
+func TestRelayedRoutingPeerIsKeptDuringDelay(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	// route1 was chosen while relayed and route2 was still connecting
+	chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnecting},
+	})
+	require.Equal(t, route.ID("route1"), chosen)
+	require.True(t, w.degradedSince.IsZero(), "the delay must not run before a direct peer contends")
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route1"), chosen, "a relayed peer must be kept when a direct one shows up")
+	assert.False(t, w.degradedSince.IsZero(), "the direct contender must start the delay")
+	assert.NotNil(t, w.relayedHold, "the pending switch must arm a timer so it is applied when due")
+
+	w.degradedSince = w.degradedSince.Add(-31 * time.Second)
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route2"), chosen, "a peer still relayed after the delay must give way to a direct one")
+	assert.Equal(t, switchReasonDirect, w.switchReason, "the switch reason must name the relayed connection")
+}
+
+// The peers of an HA group woken from idle come up over relay first and turn
+// direct one after the other. The route must stay on the peer it was on when
+// the other one turns direct first and the current one follows within the
+// delay, including before the current peer's first latency sample.
+func TestIdleRoutingPeersWokenOverRelayKeepRoute(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	steps := []struct {
+		name     string
+		statuses map[route.ID]routerPeerStatus
+	}{
+		{"both idle", map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusIdle},
+			"route2": {status: peer.StatusIdle},
+		}},
+		{"both relayed", map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, relayed: true},
+			"route2": {status: peer.StatusConnected, relayed: true},
+		}},
+		{"other direct first", map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, relayed: true},
+			"route2": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+		}},
+		{"current direct, not sampled", map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected},
+			"route2": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+		}},
+		{"current direct, sampled", map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 38 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+		}},
+	}
+
+	for _, step := range steps {
+		chosen, _ := w.getBestRouteFromStatuses(step.statuses)
+		require.Equal(t, route.ID("route1"), chosen, "step %q must keep the route on route1", step.name)
+	}
+	assert.True(t, w.degradedSince.IsZero(), "the delay must end once the current peer is direct")
+}
+
+// A routing peer that drops to relay again, after recovering from an earlier
+// drop, is a new degradation and must be reported at info level again.
+func TestRepeatedDegradationIsReportedAgain(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	degrade(t, w)
+	require.Equal(t, route.ID("route2"), w.heldCandidate, "the first drop must be reported")
+
+	// the first report is well within the report interval
+	w.heldReported = w.heldReported.Add(-time.Minute)
+	firstReport := w.heldReported
+
+	degrade(t, w)
+	assert.True(t, w.heldReported.After(firstReport), "a new drop to relay must be reported, not treated as a repeat")
+}
+
+func TestDegradedRoutingPeerNeverPolicy(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+
+	degrade(t, w)
+	w.degradedSince = w.degradedSince.Add(-time.Hour)
+
+	chosen, _ := w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route1"), chosen, "with never, a degraded routing peer is kept while connected")
+	assert.Nil(t, w.relayedHold, "with never there is nothing to schedule")
+}
+
+func TestDegradedRoutingPeerZeroDelaySwitchesAtOnce(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{})
+
+	chosen, _ := w.getBestRouteFromStatuses(currentDirect)
+	require.Equal(t, route.ID("route1"), chosen)
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route2"), chosen, "a zero delay must keep the immediate switch to a direct peer")
+}
+
+// The delay only covers a candidate that is better solely by being direct. A
+// better metric or a lost routing peer must move the route at once.
+func TestRelayedDelayDoesNotHoldOtherSwitches(t *testing.T) {
+	t.Run("better metric", func(t *testing.T) {
+		w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+		degrade(t, w)
+		w.routes["route2"].Metric = route.MaxMetric - 1
+
+		chosen, _ := w.getBestRouteFromStatuses(currentRelayed)
+		assert.Equal(t, route.ID("route2"), chosen, "a better metric must win over a degraded peer immediately")
+		assert.Equal(t, switchReasonMetric, w.switchReason)
+	})
+
+	t.Run("current peer disconnected", func(t *testing.T) {
+		w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+		degrade(t, w)
+
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnecting, relayed: true},
+			"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+		})
+		assert.Equal(t, route.ID("route2"), chosen, "a routing peer that is gone must be replaced regardless of the delay")
+		assert.Equal(t, switchReasonUnavailable, w.switchReason)
+	})
+
+	t.Run("both relayed", func(t *testing.T) {
+		w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, relayed: true},
+			"route2": {status: peer.StatusConnected, relayed: true},
+		})
+		assert.Equal(t, route.ID("route1"), chosen, "equally relayed peers are a tie and the current one stays")
+		assert.Nil(t, w.relayedHold, "a tie must not schedule a switch")
+	})
+}
+
+// TestRelayedHoldTimerAppliesSwitch drives the Start loop: once the delay has
+// passed, the held switch must be applied without waiting for a peer update or
+// the periodic re-evaluation.
+func TestRelayedHoldTimerAppliesSwitch(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+	w.relayedSwitch = relayedSwitchPolicy{delay: 50 * time.Millisecond}
+
+	recorder := w.statusRecorder
+	for _, key := range []string{"peer1", "peer2"} {
+		require.NoError(t, recorder.AddPeer(key, key+".netbird.cloud", "100.64.0.1", ""))
+	}
+	require.NoError(t, recorder.UpdatePeerState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnected, Relayed: true}))
+	require.NoError(t, recorder.UpdatePeerState(peer.State{PubKey: "peer2", ConnStatus: peer.StatusConnected}))
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+
+	// route1 drops to relay while route2 is direct: held for the delay
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnected},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added, "the switch must be held while the delay runs")
+
+	w.ctx, w.cancel = context.WithCancel(context.Background())
+	w.done = make(chan struct{})
+	go w.Start()
+	t.Cleanup(w.Stop)
+
+	// the loop owns the watcher state now, so observe the switch through the
+	// event it publishes rather than reading its fields
+	require.Eventually(t, func() bool {
+		for _, e := range recorder.GetEventHistory() {
+			if e.Message == "Routing peer changed" && e.Metadata["peer"] == "peer2" {
+				return true
+			}
+		}
+		return false
+	}, 2*time.Second, 10*time.Millisecond, "the held switch must be applied once the delay passed")
+}
+
+// A route update can keep a route's ID and hand it to a different routing peer.
+// That is a switch like any other: it is reported, and the new peer is tracked
+// from its own state rather than inheriting the previous peer's.
+func TestRouteReassignedToDifferentPeerIsASwitch(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+
+	reassigned := *w.routes["route1"]
+	reassigned.Peer = "peer3"
+	w.routes["route1"] = &reassigned
+
+	require.NoError(t, w.recalculateRoutes(reasonRouteUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+	}))
+	assert.Equal(t, []string{"peer1", "peer3"}, handler.added, "the allowed IPs must move to the new routing peer")
+	assert.Equal(t, "peer3", w.trackedPeer, "the new routing peer must be tracked")
+	assert.False(t, w.trackedDirect, "the new routing peer is tracked from its own state")
+
+	events := w.statusRecorder.GetEventHistory()
+	require.Len(t, events, 1, "the reassignment must publish a switch event")
+	assert.Equal(t, "Routing peer changed", events[0].Message)
+	assert.Equal(t, "peer1", events[0].Metadata["previous_peer"])
+	assert.Equal(t, "peer3", events[0].Metadata["peer"])
+	assert.Equal(t, string(switchReasonRouteChanged), events[0].Metadata["reason"])
+}
+
+// Exit nodes report their own connect and disconnect events, but those carry
+// no reason: the switch event is published for default routes too.
+func TestDefaultRouteSwitchPublishesEvent(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+	for _, r := range w.routes {
+		r.Network = netip.MustParsePrefix("0.0.0.0/0")
+	}
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+	}))
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting},
+		"route2": {status: peer.StatusConnected},
+	}))
+
+	var switchEvents []*proto.SystemEvent
+	for _, e := range w.statusRecorder.GetEventHistory() {
+		if e.Message == "Routing peer changed" {
+			switchEvents = append(switchEvents, e)
+		}
+	}
+	require.Len(t, switchEvents, 1, "an exit node switch must publish a switch event")
+	assert.Equal(t, string(switchReasonUnavailable), switchEvents[0].Metadata["reason"])
+	assert.Empty(t, switchEvents[0].UserMessage, "the switch event must not notify the user a second time")
+}
+
+func TestRoutingPeerSwitchPublishesEvent(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+	}))
+	assert.Empty(t, w.statusRecorder.GetEventHistory(), "the initial assignment is not a switch")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting},
+		"route2": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+	}))
+
+	events := w.statusRecorder.GetEventHistory()
+	require.Len(t, events, 1, "a switch must publish exactly one event")
+	assert.Equal(t, proto.SystemEvent_WARNING, events[0].Severity)
+	assert.Equal(t, "Routing peer changed", events[0].Message)
+	assert.Equal(t, map[string]string{
+		"network":       "recording",
+		"id":            "",
+		"previous_peer": "peer1",
+		"peer":          "peer2",
+		"reason":        string(switchReasonUnavailable),
+	}, events[0].Metadata, "the event must name both peers and the reason")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting},
+		"route2": {status: peer.StatusConnecting},
+	}))
+
+	events = w.statusRecorder.GetEventHistory()
+	require.Len(t, events, 2, "losing the last routing peer must publish an event")
+	assert.Equal(t, "No routing peer available", events[1].Message)
+	assert.Equal(t, "peer2", events[1].Metadata["previous_peer"])
+}
+
+// The statuses below follow the status recorder: a drop to relay clears the
+// latency, and a recovered direct connection reports no latency until the new
+// ICE agent's first sample lands.
+var (
+	flapDirect = map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 50 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+	}
+	flapRelayed = map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+	}
+	flapRecoveredUnsampled = map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+		"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+	}
+)
+
+// A routing peer whose direct connection drops to relay and comes back within
+// the delay must keep the route, including the window between the recovery and
+// the first latency sample of the new connection.
+func TestRecoveredRoutingPeerWithoutLatencySampleIsKept(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	chosen, _ := w.getBestRouteFromStatuses(flapDirect)
+	require.Equal(t, route.ID("route1"), chosen)
+
+	chosen, _ = w.getBestRouteFromStatuses(flapRelayed)
+	require.Equal(t, route.ID("route1"), chosen, "a routing peer that just dropped to relay must be kept")
+
+	chosen, _ = w.getBestRouteFromStatuses(flapRecoveredUnsampled)
+	assert.Equal(t, route.ID("route1"), chosen, "a recovered routing peer must not lose the route before its latency is sampled")
+}
+
+// A routing peer that keeps dropping to relay for less than the delay, and
+// staying direct for less than the delay in between, must keep the route on
+// every cycle: each drop is a new degradation with its own delay.
+func TestFlappingRoutingPeerIsKept(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	chosen, _ := w.getBestRouteFromStatuses(flapDirect)
+	require.Equal(t, route.ID("route1"), chosen)
+
+	for cycle := 0; cycle < 3; cycle++ {
+		chosen, _ = w.getBestRouteFromStatuses(flapRelayed)
+		require.Equal(t, route.ID("route1"), chosen, "cycle %d: drop to relay", cycle)
+
+		// relayed for 25s, still within the delay
+		w.degradedSince = w.degradedSince.Add(-25 * time.Second)
+		chosen, _ = w.getBestRouteFromStatuses(flapRelayed)
+		require.Equal(t, route.ID("route1"), chosen, "cycle %d: relayed within the delay", cycle)
+
+		chosen, _ = w.getBestRouteFromStatuses(flapRecoveredUnsampled)
+		require.Equal(t, route.ID("route1"), chosen, "cycle %d: recovered, latency not sampled yet", cycle)
+
+		chosen, _ = w.getBestRouteFromStatuses(flapDirect)
+		require.Equal(t, route.ID("route1"), chosen, "cycle %d: recovered and sampled", cycle)
+	}
+}
+
+// "never" only keeps a routing peer that dropped from direct. A peer that was
+// never direct must still move to a direct one after the default delay, so the
+// route is not left on a relay for good.
+func TestNeverPolicyDoesNotPinNeverDirectPeer(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+
+	chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnecting},
+	})
+	require.Equal(t, route.ID("route1"), chosen)
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	require.Equal(t, route.ID("route1"), chosen, "a never-direct peer must be held for the default delay")
+	require.NotNil(t, w.relayedHold, "the default delay must arm the timer")
+
+	w.degradedSince = w.degradedSince.Add(-defaultRelayedSwitchDelay - time.Second)
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route2"), chosen, "with never, a never-direct peer must still give way after the default delay")
+}
+
+// A current peer that never gets a latency sample must not keep the route
+// forever against a measured peer: once the hold runs out it is ranked as
+// unknown latency again.
+func TestUnmeasuredRoutingPeerHoldIsBounded(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	chosen, _ := w.getBestRouteFromStatuses(flapRecoveredUnsampled)
+	require.Equal(t, route.ID("route1"), chosen, "an unsampled current peer must be held at first")
+	require.False(t, w.unmeasuredSince.IsZero(), "the hold must record when it started")
+
+	w.unmeasuredSince = w.unmeasuredSince.Add(-unmeasuredLatencyHold - time.Second)
+	chosen, _ = w.getBestRouteFromStatuses(flapRecoveredUnsampled)
+	assert.Equal(t, route.ID("route2"), chosen, "a peer still unsampled after the hold must give way to a measured one")
+	assert.Equal(t, switchReasonLatency, w.switchReason)
+}
+
+// The delay of a peer that was never direct runs from the first direct
+// contender. When that contender goes away the delay must start over, so a
+// later contender is held for the full delay instead of taking over at once.
+func TestNeverDirectDelayRestartsWhenContenderGoes(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	relayedAlone := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnecting},
+	}
+	chosen, _ := w.getBestRouteFromStatuses(relayedAlone)
+	require.Equal(t, route.ID("route1"), chosen)
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	require.Equal(t, route.ID("route1"), chosen, "the first direct contender must be held")
+	require.False(t, w.degradedSince.IsZero())
+
+	// the first contender was seen longer ago than the delay
+	w.degradedSince = w.degradedSince.Add(-31 * time.Second)
+
+	chosen, _ = w.getBestRouteFromStatuses(relayedAlone)
+	require.Equal(t, route.ID("route1"), chosen)
+	assert.True(t, w.degradedSince.IsZero(), "the delay must start over once no direct contender is left")
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route1"), chosen, "a new direct contender must be held for the full delay")
+}
diff --git a/client/internal/routemanager/dnsinterceptor/handler.go b/client/internal/routemanager/dnsinterceptor/handler.go
index b784cc274..d20f4b944 100644
--- a/client/internal/routemanager/dnsinterceptor/handler.go
+++ b/client/internal/routemanager/dnsinterceptor/handler.go
@@ -95,7 +95,7 @@ func (d *DnsInterceptor) RemoveRoute() error {
 
 			// AllowedIPs should use real IPs
 			if d.currentPeerKey != "" {
-				if _, err := d.allowedIPsRefcounter.Decrement(prefix); err != nil {
+				if _, err := d.allowedIPsRefcounter.Decrement(prefix, d.currentPeerKey); err != nil {
 					merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %s: %v", prefix, err))
 				}
 			}
@@ -172,7 +172,7 @@ func (d *DnsInterceptor) removeAllowedIP(realPrefix netip.Prefix) error {
 	}
 
 	// AllowedIPs use real IPs
-	if _, err := d.allowedIPsRefcounter.Decrement(realPrefix); err != nil {
+	if _, err := d.allowedIPsRefcounter.Decrement(realPrefix, d.currentPeerKey); err != nil {
 		return fmt.Errorf("remove allowed IP %s: %v", realPrefix, err)
 	}
 
@@ -205,7 +205,7 @@ func (d *DnsInterceptor) RemoveAllowedIPs() error {
 	for _, prefixes := range d.interceptedDomains {
 		for _, prefix := range prefixes {
 			// AllowedIPs use real IPs
-			if _, err := d.allowedIPsRefcounter.Decrement(prefix); err != nil {
+			if _, err := d.allowedIPsRefcounter.Decrement(prefix, d.currentPeerKey); err != nil {
 				merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %s: %v", prefix, err))
 			}
 		}
@@ -479,7 +479,7 @@ func (d *DnsInterceptor) removeDNATMappings(realPrefixes []netip.Prefix, logger
 
 // internalDnatFw checks if the firewall supports internal DNAT
 func (d *DnsInterceptor) internalDnatFw() (internalDNATer, bool) {
-	if d.firewall == nil || runtime.GOOS != "android" {
+	if d.firewall == nil || d.fakeIPManager == nil || runtime.GOOS != "android" {
 		return nil, false
 	}
 	fw, ok := d.firewall.(internalDNATer)
diff --git a/client/internal/routemanager/dynamic/route.go b/client/internal/routemanager/dynamic/route.go
index f0efd7b22..bb3b1c59c 100644
--- a/client/internal/routemanager/dynamic/route.go
+++ b/client/internal/routemanager/dynamic/route.go
@@ -135,7 +135,7 @@ func (r *Route) RemoveAllowedIPs() error {
 	var merr *multierror.Error
 	for _, domainPrefixes := range r.dynamicDomains {
 		for _, prefix := range domainPrefixes {
-			if _, err := r.allowedIPsRefcounter.Decrement(prefix); err != nil {
+			if _, err := r.allowedIPsRefcounter.Decrement(prefix, r.currentPeerKey); err != nil {
 				merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %s: %w", prefix, err))
 			}
 		}
@@ -185,7 +185,7 @@ func (r *Route) startResolver(ctx context.Context) {
 }
 
 func (r *Route) update(ctx context.Context) error {
-	resolved, err := r.resolveDomains()
+	resolved, err := r.resolveDomains(ctx)
 	if err != nil {
 		if len(resolved) == 0 {
 			return fmt.Errorf("resolve domains: %w", err)
@@ -199,9 +199,9 @@ func (r *Route) update(ctx context.Context) error {
 	return nil
 }
 
-func (r *Route) resolveDomains() (domainMap, error) {
+func (r *Route) resolveDomains(ctx context.Context) (domainMap, error) {
 	results := make(chan resolveResult)
-	go r.resolve(results)
+	go r.resolve(ctx, results)
 
 	resolved := domainMap{}
 	var merr *multierror.Error
@@ -217,7 +217,7 @@ func (r *Route) resolveDomains() (domainMap, error) {
 	return resolved, nberrors.FormatErrorOrNil(merr)
 }
 
-func (r *Route) resolve(results chan resolveResult) {
+func (r *Route) resolve(ctx context.Context, results chan resolveResult) {
 	var wg sync.WaitGroup
 
 	for _, d := range r.route.Domains {
@@ -225,10 +225,10 @@ func (r *Route) resolve(results chan resolveResult) {
 		go func(domain domain.Domain) {
 			defer wg.Done()
 
-			ips, err := r.getIPsFromResolver(domain)
+			ips, err := r.getIPsFromResolver(ctx, domain)
 			if err != nil {
 				log.Tracef("Failed to resolve domain %s with private resolver: %v", domain.SafeString(), err)
-				ips, err = net.LookupIP(domain.PunycodeString())
+				ips, err = lookupHostIPs(ctx, domain)
 				if err != nil {
 					results <- resolveResult{domain: domain, err: fmt.Errorf("resolve d %s: %w", domain.SafeString(), err)}
 					return
@@ -320,7 +320,7 @@ func (r *Route) removeRoutes(prefixes []netip.Prefix) ([]netip.Prefix, error) {
 			merr = multierror.Append(merr, fmt.Errorf("remove dynamic route for IP %s: %w", prefix, err))
 		}
 		if r.currentPeerKey != "" {
-			if _, err := r.allowedIPsRefcounter.Decrement(prefix); err != nil {
+			if _, err := r.allowedIPsRefcounter.Decrement(prefix, r.currentPeerKey); err != nil {
 				merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %s: %w", prefix, err))
 			}
 		}
@@ -364,6 +364,20 @@ func determinePrefixChanges(oldPrefixes, newPrefixes []netip.Prefix) (toAdd, toR
 	return
 }
 
+// lookupHostIPs resolves d via the system resolver, honoring ctx cancellation.
+func lookupHostIPs(ctx context.Context, d domain.Domain) ([]net.IP, error) {
+	addrs, err := net.DefaultResolver.LookupIPAddr(ctx, d.PunycodeString())
+	if err != nil {
+		return nil, err
+	}
+
+	ips := make([]net.IP, 0, len(addrs))
+	for _, addr := range addrs {
+		ips = append(ips, addr.IP)
+	}
+	return ips, nil
+}
+
 func combinePrefixes(oldPrefixes, removedPrefixes, addedPrefixes []netip.Prefix) []netip.Prefix {
 	prefixSet := make(map[netip.Prefix]struct{})
 	for _, prefix := range oldPrefixes {
diff --git a/client/internal/routemanager/dynamic/route_generic.go b/client/internal/routemanager/dynamic/route_generic.go
index 56fd63fba..8bc2dd3df 100644
--- a/client/internal/routemanager/dynamic/route_generic.go
+++ b/client/internal/routemanager/dynamic/route_generic.go
@@ -3,11 +3,12 @@
 package dynamic
 
 import (
+	"context"
 	"net"
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
-func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
-	return net.LookupIP(domain.PunycodeString())
+func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
+	return lookupHostIPs(ctx, domain)
 }
diff --git a/client/internal/routemanager/dynamic/route_ios.go b/client/internal/routemanager/dynamic/route_ios.go
index 1ae281d56..6a3d262b8 100644
--- a/client/internal/routemanager/dynamic/route_ios.go
+++ b/client/internal/routemanager/dynamic/route_ios.go
@@ -3,6 +3,7 @@
 package dynamic
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"time"
@@ -16,7 +17,7 @@ import (
 
 const dialTimeout = 10 * time.Second
 
-func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
+func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
 	privateClient, err := nbdns.GetClientPrivate(r.wgInterface, r.resolverAddr.Addr(), dialTimeout)
 	if err != nil {
 		return nil, fmt.Errorf("error while creating private client: %s", err)
@@ -32,7 +33,7 @@ func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
 		msg := new(dns.Msg)
 		msg.SetQuestion(fqdn, qtype)
 
-		response, _, err := nbdns.ExchangeWithFallback(nil, privateClient, msg, r.resolverAddr.String())
+		response, _, err := nbdns.ExchangeWithFallback(ctx, privateClient, msg, r.resolverAddr.String())
 		if err != nil {
 			if queryErr == nil {
 				queryErr = fmt.Errorf("DNS query for %s (type %d) after %s: %w", domain.SafeString(), qtype, time.Since(startTime), err)
diff --git a/client/internal/routemanager/exit_node_selection_test.go b/client/internal/routemanager/exit_node_selection_test.go
new file mode 100644
index 000000000..28dd0a640
--- /dev/null
+++ b/client/internal/routemanager/exit_node_selection_test.go
@@ -0,0 +1,191 @@
+package routemanager
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/routeselector"
+	"github.com/netbirdio/netbird/route"
+)
+
+func newExitNodeTestManager() *DefaultManager {
+	return &DefaultManager{routeSelector: routeselector.NewRouteSelector()}
+}
+
+func exitRoute(netID, peer string, skipAutoApply bool) *route.Route {
+	return &route.Route{
+		NetID:         route.NetID(netID),
+		Network:       netip.MustParsePrefix("0.0.0.0/0"),
+		Peer:          peer,
+		SkipAutoApply: skipAutoApply,
+	}
+}
+
+func TestPickPreferredExitNode(t *testing.T) {
+	tests := []struct {
+		name string
+		info exitNodeInfo
+		want route.NetID
+	}{
+		{
+			name: "persisted user selection wins over management",
+			info: exitNodeInfo{
+				allIDs:               []route.NetID{"a", "b", "c"},
+				userSelected:         []route.NetID{"b"},
+				selectedByManagement: []route.NetID{"a"},
+			},
+			want: "b",
+		},
+		{
+			name: "multiple user-selected self-heal to deterministic min",
+			info: exitNodeInfo{
+				allIDs:       []route.NetID{"a", "b", "c"},
+				userSelected: []route.NetID{"c", "a"},
+			},
+			want: "a",
+		},
+		{
+			name: "explicit opt-out keeps none",
+			info: exitNodeInfo{
+				allIDs:         []route.NetID{"a", "b"},
+				userDeselected: []route.NetID{"a", "b"},
+			},
+			want: "",
+		},
+		{
+			name: "fresh defaults to management auto-apply pick",
+			info: exitNodeInfo{
+				allIDs:               []route.NetID{"a", "b", "c"},
+				selectedByManagement: []route.NetID{"b"},
+			},
+			want: "b",
+		},
+		{
+			name: "no user pick and no management auto-apply selects none",
+			info: exitNodeInfo{
+				allIDs: []route.NetID{"c", "a", "b"},
+			},
+			want: "",
+		},
+		{
+			name: "user-deselect does not block a management auto-apply sibling",
+			info: exitNodeInfo{
+				allIDs:               []route.NetID{"a", "b"},
+				userDeselected:       []route.NetID{"a"},
+				selectedByManagement: []route.NetID{"b"},
+			},
+			want: "b",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, pickPreferredExitNode(tt.info), "preferred exit node")
+		})
+	}
+}
+
+func TestEnforceSingleExitNode(t *testing.T) {
+	m := newExitNodeTestManager()
+	all := []route.NetID{"a", "b", "c"}
+
+	m.enforceSingleExitNode("b", all)
+	assert.False(t, m.routeSelector.IsSelected("a"), "a should be deselected")
+	assert.True(t, m.routeSelector.IsSelected("b"), "b should be the only selected exit node")
+	assert.False(t, m.routeSelector.IsSelected("c"), "c should be deselected")
+
+	// Switching the preferred node moves the single selection.
+	m.enforceSingleExitNode("c", all)
+	assert.False(t, m.routeSelector.IsSelected("a"), "a stays deselected")
+	assert.False(t, m.routeSelector.IsSelected("b"), "b should now be deselected")
+	assert.True(t, m.routeSelector.IsSelected("c"), "c should now be selected")
+
+	// Empty preferred turns every exit node off.
+	m.enforceSingleExitNode("", all)
+	for _, id := range all {
+		assert.False(t, m.routeSelector.IsSelected(id), "no exit node should be selected")
+	}
+}
+
+func TestEnforceSingleExitNode_RespectsDeselectAll(t *testing.T) {
+	m := newExitNodeTestManager()
+	m.routeSelector.DeselectAllRoutes()
+
+	m.enforceSingleExitNode("b", []route.NetID{"a", "b"})
+
+	assert.True(t, m.routeSelector.IsDeselectAll(), "global deselect-all must stay in effect")
+	assert.False(t, m.routeSelector.IsSelected("b"), "no exit node should be forced on while deselect-all is set")
+}
+
+func TestUpdateRouteSelectorFromManagement_FreshSelectsOne(t *testing.T) {
+	m := newExitNodeTestManager()
+	routes := route.HAMap{
+		"exitA|0.0.0.0/0":    {exitRoute("exitA", "p1", false)},
+		"exitB|0.0.0.0/0":    {exitRoute("exitB", "p2", false)},
+		"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p3"}},
+		"exitC|0.0.0.0/0":    {exitRoute("exitC", "p4", false)},
+	}
+
+	m.updateRouteSelectorFromManagement(routes)
+
+	// Exactly one exit node (the deterministic first) is selected.
+	assert.True(t, m.routeSelector.IsSelected("exitA"), "exitA is the deterministic default")
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "exitB must not also be selected")
+	assert.False(t, m.routeSelector.IsSelected("exitC"), "exitC must not also be selected")
+	// Non-exit routes are left at their default-on state.
+	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit route selection is untouched")
+}
+
+func TestUpdateRouteSelectorFromManagement_HonorsPersistedPick(t *testing.T) {
+	m := newExitNodeTestManager()
+	routes := route.HAMap{
+		"exitA|0.0.0.0/0": {exitRoute("exitA", "p1", false)},
+		"exitB|0.0.0.0/0": {exitRoute("exitB", "p2", false)},
+	}
+	all := []route.NetID{"exitA", "exitB"}
+
+	// Simulate the state the runtime select path leaves behind: exactly one
+	// exit node explicitly selected, its sibling deselected.
+	require.NoError(t, m.routeSelector.SelectRoutes([]route.NetID{"exitB"}, true, all))
+	require.NoError(t, m.routeSelector.DeselectRoutes([]route.NetID{"exitA"}, all))
+
+	m.updateRouteSelectorFromManagement(routes)
+
+	assert.True(t, m.routeSelector.IsSelected("exitB"), "persisted pick must stay selected")
+	assert.False(t, m.routeSelector.IsSelected("exitA"), "the other exit node stays deselected")
+}
+
+func TestUpdateRouteSelectorFromManagement_OptOutKeepsNone(t *testing.T) {
+	m := newExitNodeTestManager()
+	routes := route.HAMap{
+		"exitA|0.0.0.0/0": {exitRoute("exitA", "p1", false)},
+		"exitB|0.0.0.0/0": {exitRoute("exitB", "p2", false)},
+	}
+	all := []route.NetID{"exitA", "exitB"}
+
+	// User deselected exit nodes and selected none.
+	require.NoError(t, m.routeSelector.DeselectRoutes(all, all))
+
+	m.updateRouteSelectorFromManagement(routes)
+
+	assert.False(t, m.routeSelector.IsSelected("exitA"), "opt-out keeps exitA off")
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "opt-out keeps exitB off")
+}
+
+func TestUpdateRouteSelectorFromManagement_NoAutoApplySelectsNone(t *testing.T) {
+	m := newExitNodeTestManager()
+	// SkipAutoApply=true: management offers the exit nodes but doesn't request
+	// auto-activation, so none should be selected until the user picks one.
+	routes := route.HAMap{
+		"exitA|0.0.0.0/0": {exitRoute("exitA", "p1", true)},
+		"exitB|0.0.0.0/0": {exitRoute("exitB", "p2", true)},
+	}
+
+	m.updateRouteSelectorFromManagement(routes)
+
+	assert.False(t, m.routeSelector.IsSelected("exitA"), "no auto-apply keeps exitA off")
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "no auto-apply keeps exitB off")
+}
diff --git a/client/internal/routemanager/ipfwdstate/ipfwdstate.go b/client/internal/routemanager/ipfwdstate/ipfwdstate.go
index 2be1c2ae7..22f7bd07a 100644
--- a/client/internal/routemanager/ipfwdstate/ipfwdstate.go
+++ b/client/internal/routemanager/ipfwdstate/ipfwdstate.go
@@ -2,54 +2,157 @@ package ipfwdstate
 
 import (
 	"fmt"
+	"sync"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/internal/routemanager/systemops"
 )
 
-// IPForwardingState is a struct that keeps track of the IP forwarding state.
-// todo: read initial state of the IP forwarding from the system and reset the state based on it.
-// todo: separate v4/v6 forwarding state, since the sysctls are independent
-// (net.ipv4.ip_forward vs net.ipv6.conf.all.forwarding). Currently the nftables
-// manager shares one instance between both routers, which works only because
-// EnableIPForwarding enables both sysctls in a single call.
+// IPForwardingState tracks v4 and v6 IP-forwarding sysctl enables with
+// independent refcounts so a v4-only routing setup doesn't flip v6 sysctls.
 type IPForwardingState struct {
-	enabledCounter int
+	mu sync.Mutex
+
+	v4Count int
+	v6Count int
+
+	// routingV4/routingV6 track whether the routing path currently holds a
+	// reference, so repeated EnableRouting calls (one per network-map update)
+	// hold at most one reference per family.
+	routingV4 bool
+	routingV6 bool
+
+	wgIfaceName string
+	v6Saved     map[string]int
 }
 
-func NewIPForwardingState() *IPForwardingState {
-	return &IPForwardingState{}
+// NewIPForwardingState returns a state tracker for the IP-forwarding sysctls.
+// wgIfaceName is excluded from the per-interface accept_ra handling.
+func NewIPForwardingState(wgIfaceName string) *IPForwardingState {
+	return &IPForwardingState{wgIfaceName: wgIfaceName}
 }
 
-func (f *IPForwardingState) RequestForwarding() error {
-	if f.enabledCounter != 0 {
-		f.enabledCounter++
+// Counts returns the current v4 and v6 refcounts. Intended for diagnostics
+// and tests.
+func (f *IPForwardingState) Counts() (v4, v6 int) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.v4Count, f.v6Count
+}
+
+// RequestRouting takes the forwarding references for the routing path. It is
+// idempotent: while routing already holds a reference, further calls don't
+// increment the refcounts, and a v4-only request releases a previously held v6
+// reference. A v6 sysctl failure is logged and not returned so it can't take
+// down v4 routing (the sysctl may be unwritable, e.g. read-only /proc/sys or
+// IPv6 disabled on the kernel command line); v6 is retried on the next call.
+func (f *IPForwardingState) RequestRouting(v6 bool) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
+	if !f.routingV4 {
+		if err := f.requestV4(); err != nil {
+			return err
+		}
+		f.routingV4 = true
+	}
+
+	if !v6 {
+		if !f.routingV6 {
+			return nil
+		}
+		f.routingV6 = false
+		return f.releaseV6()
+	}
+
+	if f.routingV6 {
 		return nil
 	}
-
-	if err := systemops.EnableIPForwarding(); err != nil {
-		return fmt.Errorf("failed to enable IP forwarding with sysctl: %w", err)
+	if err := f.requestV6(); err != nil {
+		log.Warnf("enable IPv6 forwarding for routing: %v", err)
+		return nil
 	}
-	f.enabledCounter = 1
-	log.Info("IP forwarding enabled")
-
+	f.routingV6 = true
 	return nil
 }
 
-func (f *IPForwardingState) ReleaseForwarding() error {
-	if f.enabledCounter == 0 {
-		return nil
+// ReleaseRouting releases the references RequestRouting holds. Calls without a
+// held reference are no-ops.
+func (f *IPForwardingState) ReleaseRouting() error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
+	if f.routingV4 {
+		f.routingV4 = false
+		f.releaseV4()
 	}
-
-	if f.enabledCounter > 1 {
-		f.enabledCounter--
-		return nil
+	if f.routingV6 {
+		f.routingV6 = false
+		return f.releaseV6()
 	}
+	return nil
+}
 
-	// if failed to disable IP forwarding we anyway decrement the counter
-	f.enabledCounter = 0
+func (f *IPForwardingState) requestV4() error {
+	if f.v4Count == 0 {
+		if err := systemops.EnableV4IPForwarding(); err != nil {
+			return fmt.Errorf("enable IPv4 forwarding: %w", err)
+		}
+		log.Info("IPv4 forwarding enabled")
+	}
+	f.v4Count++
+	return nil
+}
 
-	// todo call systemops.DisableIPForwarding()
+func (f *IPForwardingState) releaseV4() {
+	if f.v4Count > 0 {
+		f.v4Count--
+	}
+}
+
+func (f *IPForwardingState) requestV6() error {
+	if f.v6Count == 0 {
+		saved, err := systemops.EnableV6IPForwarding(f.wgIfaceName)
+		if err != nil {
+			if rerr := systemops.DisableV6IPForwarding(saved); rerr != nil {
+				log.Warnf("rollback partial v6 sysctls: %v", rerr)
+			}
+			return fmt.Errorf("enable IPv6 forwarding: %w", err)
+		}
+		// A failed restore on a previous release keeps its saved values; those
+		// are the true originals, so keep them over what this enable captured.
+		if f.v6Saved == nil {
+			f.v6Saved = saved
+		} else {
+			for k, v := range saved {
+				if _, ok := f.v6Saved[k]; !ok {
+					f.v6Saved[k] = v
+				}
+			}
+		}
+		log.Info("IPv6 forwarding enabled")
+	}
+	f.v6Count++
+	return nil
+}
+
+func (f *IPForwardingState) releaseV6() error {
+	if f.v6Count == 0 {
+		return nil
+	}
+	f.v6Count--
+	if f.v6Count > 0 {
+		return nil
+	}
+
+	// Keep the saved values on failure so a later release or enable/release
+	// cycle can still restore them; re-restoring an already-restored key is a
+	// no-op since the sysctl already holds the desired value.
+	if err := systemops.DisableV6IPForwarding(f.v6Saved); err != nil {
+		return fmt.Errorf("disable IPv6 forwarding: %w", err)
+	}
+	f.v6Saved = nil
+	log.Info("IPv6 forwarding disabled")
 	return nil
 }
diff --git a/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go b/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go
new file mode 100644
index 000000000..75209965c
--- /dev/null
+++ b/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go
@@ -0,0 +1,31 @@
+//go:build privileged
+
+package ipfwdstate
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRequestRoutingV6ToV4Transition verifies that a v4-only routing request
+// releases a previously held routing-owned v6 reference.
+func TestRequestRoutingV6ToV4Transition(t *testing.T) {
+	f := NewIPForwardingState("wt-fwd-test")
+
+	require.NoError(t, f.RequestRouting(true), "request routing with v6")
+	v4, v6 := f.Counts()
+	assert.Equal(t, 1, v4, "v4 reference held")
+	assert.Equal(t, 1, v6, "v6 reference held")
+
+	require.NoError(t, f.RequestRouting(false), "request routing v4-only")
+	v4, v6 = f.Counts()
+	assert.Equal(t, 1, v4, "v4 reference kept")
+	assert.Equal(t, 0, v6, "routing-owned v6 reference released")
+
+	require.NoError(t, f.ReleaseRouting(), "release routing")
+	v4, v6 = f.Counts()
+	assert.Equal(t, 0, v4, "all v4 references released")
+	assert.Equal(t, 0, v6, "all v6 references released")
+}
diff --git a/client/internal/routemanager/manager.go b/client/internal/routemanager/manager.go
index 22458d575..7d699fbb4 100644
--- a/client/internal/routemanager/manager.go
+++ b/client/internal/routemanager/manager.go
@@ -9,12 +9,13 @@ import (
 	"net/url"
 	"runtime"
 	"slices"
+	"sort"
 	"strings"
 	"sync"
 	"sync/atomic"
+	"syscall"
 	"time"
 
-	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
@@ -51,15 +52,20 @@ type Manager interface {
 	UpdateRoutes(updateSerial uint64, serverRoutes map[route.ID]*route.Route, clientRoutes route.HAMap, useNewDNSRoute bool) error
 	ClassifyRoutes(newRoutes []*route.Route) (map[route.ID]*route.Route, route.HAMap)
 	TriggerSelection(route.HAMap)
+	SelectRoutes(ids []route.NetID, appendRoute bool) error
+	DeselectRoutes(ids []route.NetID) error
+	SelectAllRoutes()
+	DeselectAllRoutes()
 	GetRouteSelector() *routeselector.RouteSelector
 	GetClientRoutes() route.HAMap
 	GetSelectedClientRoutes() route.HAMap
 	GetActiveClientRoutes() route.HAMap
 	GetClientRoutesWithNetID() map[route.NetID][]*route.Route
 	SetRouteChangeListener(listener listener.NetworkChangeListener)
-	InitialRouteRange() []string
+	CurrentRouteRange() []string
 	SetFirewall(firewall.Manager) error
 	SetDNSForwarderPort(port uint16)
+	ReconcilePeerAllowedIPs(peerKey string) error
 	Stop(stateManager *statemanager.Manager)
 }
 
@@ -70,10 +76,8 @@ type ManagerConfig struct {
 	WGInterface         iface.WGIface
 	StatusRecorder      *peer.Status
 	RelayManager        *relayClient.Manager
-	InitialRoutes       []*route.Route
 	StateManager        *statemanager.Manager
 	DNSServer           dns.Server
-	DNSFeatureFlag      bool
 	PeerStore           *peerstore.Store
 	DisableClientRoutes bool
 	DisableServerRoutes bool
@@ -143,45 +147,12 @@ func NewManager(config ManagerConfig) *DefaultManager {
 	useNoop := netstack.IsEnabled() || config.DisableClientRoutes
 	dm.setupRefCounters(useNoop)
 
-	// don't proceed with client routes if it is disabled
-	if config.DisableClientRoutes {
-		return dm
-	}
-
-	if runtime.GOOS == "android" {
-		dm.setupAndroidRoutes(config)
-	}
 	return dm
 }
-func (m *DefaultManager) setupAndroidRoutes(config ManagerConfig) {
-	cr := m.initialClientRoutes(config.InitialRoutes)
 
-	routesForComparison := slices.Clone(cr)
-
-	if config.DNSFeatureFlag {
-		m.fakeIPManager = fakeip.NewManager()
-
-		v4ID := uuid.NewString()
-		fakeIPRoute := &route.Route{
-			ID:          route.ID(v4ID),
-			Network:     m.fakeIPManager.GetFakeIPBlock(),
-			NetID:       route.NetID(v4ID),
-			Peer:        m.pubKey,
-			NetworkType: route.IPv4Network,
-		}
-		v6ID := uuid.NewString()
-		fakeIPv6Route := &route.Route{
-			ID:          route.ID(v6ID),
-			Network:     m.fakeIPManager.GetFakeIPv6Block(),
-			NetID:       route.NetID(v6ID),
-			Peer:        m.pubKey,
-			NetworkType: route.IPv6Network,
-		}
-		cr = append(cr, fakeIPRoute, fakeIPv6Route)
-		m.notifier.SetFakeIPRoutes([]*route.Route{fakeIPRoute, fakeIPv6Route})
-	}
-
-	m.notifier.SetInitialClientRoutes(cr, routesForComparison)
+func (m *DefaultManager) enableFakeIPRoutes() {
+	m.fakeIPManager = fakeip.NewManager()
+	m.notifier.NotifyRouteChange()
 }
 
 func (m *DefaultManager) setupRefCounters(useNoop bool) {
@@ -214,7 +185,7 @@ func (m *DefaultManager) setupRefCounters(useNoop bool) {
 		)
 	}
 
-	m.allowedIPsRefCounter = refcounter.New(
+	m.allowedIPsRefCounter = refcounter.NewAllowedIPs(
 		func(prefix netip.Prefix, peerKey string) (string, error) {
 			// save peerKey to use it in the remove function
 			return peerKey, m.wgInterface.AddAllowedIP(peerKey, prefix)
@@ -231,6 +202,30 @@ func (m *DefaultManager) setupRefCounters(useNoop bool) {
 	)
 }
 
+// ReconcilePeerAllowedIPs re-applies every routed allowed IP currently tracked for the peer
+// onto the WireGuard device. The allowed-IP refcounter only calls its AddFunc (which pushes to
+// the device) on a prefix's 0->1 transition, so a peer whose device entry was rebuilt without a
+// matching refcounter change — e.g. a lazy connection cycling through idle->wake, which recreates
+// the WireGuard peer with the overlay /32 only — ends up missing routed prefixes the refcounter
+// still considers installed, and nothing retries. Calling this when the peer's WireGuard entry is
+// (re)created restores convergence. It is add-only and idempotent: AddAllowedIP is update-only, so
+// prefixes are re-added to an existing peer and an absent peer is left untouched.
+func (m *DefaultManager) ReconcilePeerAllowedIPs(peerKey string) error {
+	if m.allowedIPsRefCounter == nil {
+		return nil
+	}
+
+	return m.allowedIPsRefCounter.ReapplyMatching(
+		func(out string) bool { return out == peerKey },
+		func(prefix netip.Prefix) error {
+			if err := m.wgInterface.AddAllowedIP(peerKey, prefix); err != nil {
+				return fmt.Errorf("add allowed IP %s for peer %s: %w", prefix, peerKey, err)
+			}
+			return nil
+		},
+	)
+}
+
 // Init sets up the routing
 func (m *DefaultManager) Init() error {
 	m.routeSelector = m.initSelector()
@@ -264,7 +259,11 @@ func (m *DefaultManager) initSelector() *routeselector.RouteSelector {
 
 	// restore selector state if it exists
 	if err := m.stateManager.LoadState(state); err != nil {
-		log.Warnf("failed to load state: %v", err)
+		if errors.Is(err, syscall.ENOSYS) {
+			log.Debugf("route selector state unavailable on this platform: %v", err)
+		} else {
+			log.Warnf("failed to load state: %v", err)
+		}
 		return routeselector.NewRouteSelector()
 	}
 
@@ -430,6 +429,9 @@ func (m *DefaultManager) UpdateRoutes(
 
 	var merr *multierror.Error
 	if !m.disableClientRoutes {
+		if runtime.GOOS == "android" && useNewDNSRoute && m.fakeIPManager == nil {
+			m.enableFakeIPRoutes()
+		}
 
 		// Update route selector based on management server's isSelected status
 		m.updateRouteSelectorFromManagement(clientRoutes)
@@ -442,6 +444,11 @@ func (m *DefaultManager) UpdateRoutes(
 
 		m.updateClientNetworks(updateSerial, filteredClientRoutes)
 		m.notifier.OnNewRoutes(filteredClientRoutes)
+		// A new network map can add or drop route/exit-node candidates without
+		// touching any peer's chosen-route state, so the peer status alone
+		// wouldn't notify SubscribeStatus subscribers. Bump the revision so the
+		// UI re-fetches ListNetworks.
+		m.statusRecorder.BumpNetworksRevision()
 	}
 	m.clientRoutes = clientRoutes
 
@@ -461,9 +468,18 @@ func (m *DefaultManager) SetRouteChangeListener(listener listener.NetworkChangeL
 	m.notifier.SetListener(listener)
 }
 
-// InitialRouteRange return the list of initial routes. It used by mobile systems
-func (m *DefaultManager) InitialRouteRange() []string {
-	return m.notifier.GetInitialRouteRanges()
+// CurrentRouteRange returns the current TUN route list. It is used by mobile systems
+func (m *DefaultManager) CurrentRouteRange() []string {
+	m.mux.Lock()
+	defer m.mux.Unlock()
+
+	nets := m.overlayNetworks()
+	if !m.disableClientRoutes {
+		nets = append(nets, m.clientRouteRange()...)
+	}
+
+	sort.Strings(nets)
+	return slices.Compact(nets)
 }
 
 // GetRouteSelector returns the route selector
@@ -562,12 +578,13 @@ func (m *DefaultManager) TriggerSelection(networks route.HAMap) {
 		}
 
 		config := client.WatcherConfig{
-			Context:          m.ctx,
-			DNSRouteInterval: m.dnsRouteInterval,
-			WGInterface:      m.wgInterface,
-			StatusRecorder:   m.statusRecorder,
-			Route:            routes[0],
-			Handler:          handler,
+			Context:             m.ctx,
+			DNSRouteInterval:    m.dnsRouteInterval,
+			WGInterface:         m.wgInterface,
+			StatusRecorder:      m.statusRecorder,
+			Route:               routes[0],
+			Handler:             handler,
+			ReconcileAllowedIPs: m.ReconcilePeerAllowedIPs,
 		}
 		clientNetworkWatcher := client.NewWatcher(config)
 		m.clientNetworks[id] = clientNetworkWatcher
@@ -582,6 +599,10 @@ func (m *DefaultManager) TriggerSelection(networks route.HAMap) {
 	if err := m.stateManager.UpdateState((*SelectorState)(m.routeSelector)); err != nil {
 		log.Errorf("failed to update state: %v", err)
 	}
+
+	// A selection change flips Network.selected without altering the candidate
+	// set, so bump the revision to push the new state to the UI.
+	m.statusRecorder.BumpNetworksRevision()
 }
 
 // stopObsoleteClients stops the client network watcher for the networks that are not in the new list
@@ -608,12 +629,13 @@ func (m *DefaultManager) updateClientNetworks(updateSerial uint64, networks rout
 			}
 
 			config := client.WatcherConfig{
-				Context:          m.ctx,
-				DNSRouteInterval: m.dnsRouteInterval,
-				WGInterface:      m.wgInterface,
-				StatusRecorder:   m.statusRecorder,
-				Route:            routes[0],
-				Handler:          handler,
+				Context:             m.ctx,
+				DNSRouteInterval:    m.dnsRouteInterval,
+				WGInterface:         m.wgInterface,
+				StatusRecorder:      m.statusRecorder,
+				Route:               routes[0],
+				Handler:             handler,
+				ReconcileAllowedIPs: m.ReconcilePeerAllowedIPs,
 			}
 			clientNetworkWatcher = client.NewWatcher(config)
 			m.clientNetworks[id] = clientNetworkWatcher
@@ -657,16 +679,6 @@ func (m *DefaultManager) ClassifyRoutes(newRoutes []*route.Route) (map[route.ID]
 	return newServerRoutesMap, newClientRoutesIDMap
 }
 
-func (m *DefaultManager) initialClientRoutes(initialRoutes []*route.Route) []*route.Route {
-	_, crMap := m.ClassifyRoutes(initialRoutes)
-	rs := make([]*route.Route, 0, len(crMap))
-	for _, routes := range crMap {
-		rs = append(rs, routes...)
-	}
-
-	return rs
-}
-
 func isRouteSupported(route *route.Route) bool {
 	if netstack.IsEnabled() || !nbnet.CustomRoutingDisabled() || route.IsDynamic() {
 		return true
@@ -701,7 +713,13 @@ func resolveURLsToIPs(urls []string) []net.IP {
 	return ips
 }
 
-// updateRouteSelectorFromManagement updates the route selector based on the isSelected status from the management server
+// updateRouteSelectorFromManagement reconciles exit-node selection on every
+// network map: it keeps at most one exit node selected — the user's persisted
+// pick, else whatever management marks for auto-apply (SkipAutoApply=false),
+// else none. We never auto-activate an exit node the map doesn't request; it
+// stays off until the user picks it. Exit nodes are mutually exclusive, but the
+// RouteSelector stores routes with default-on semantics, so without this every
+// available exit node would report selected at once.
 func (m *DefaultManager) updateRouteSelectorFromManagement(clientRoutes route.HAMap) {
 	m.mirrorV6ExitPairSelections(clientRoutes)
 
@@ -712,13 +730,14 @@ func (m *DefaultManager) updateRouteSelectorFromManagement(clientRoutes route.HA
 		return
 	}
 
-	exitNodeInfo := m.collectExitNodeInfo(clientRoutes)
-	if len(exitNodeInfo.allIDs) == 0 {
+	info := m.collectExitNodeInfo(clientRoutes)
+	if len(info.allIDs) == 0 {
 		return
 	}
 
-	m.updateExitNodeSelections(exitNodeInfo)
-	m.logExitNodeUpdate(exitNodeInfo)
+	preferred := pickPreferredExitNode(info)
+	m.enforceSingleExitNode(preferred, info.allIDs)
+	m.logExitNodeUpdate(info, preferred)
 }
 
 // mirrorV6ExitPairSelections keeps every synthesized "-v6" exit route's selection
@@ -746,15 +765,22 @@ type exitNodeInfo struct {
 	userDeselected       []route.NetID
 }
 
+// collectExitNodeInfo categorises the available exit nodes by their persisted
+// selection state. It keys on the base (v4) NetID and skips the synthesized
+// "-v6" partner, which inherits its base's selection through the RouteSelector
+// — counting it separately would double-count the pair.
 func (m *DefaultManager) collectExitNodeInfo(clientRoutes route.HAMap) exitNodeInfo {
 	var info exitNodeInfo
 
 	for haID, routes := range clientRoutes {
-		if !m.isExitNodeRoute(routes) {
+		if !isExitNodeRoutes(routes) {
 			continue
 		}
 
 		netID := haID.NetID()
+		if strings.HasSuffix(string(netID), route.V6ExitSuffix) {
+			continue
+		}
 		info.allIDs = append(info.allIDs, netID)
 
 		if m.routeSelector.HasUserSelectionForRoute(netID) {
@@ -767,13 +793,6 @@ func (m *DefaultManager) collectExitNodeInfo(clientRoutes route.HAMap) exitNodeI
 	return info
 }
 
-func (m *DefaultManager) isExitNodeRoute(routes []*route.Route) bool {
-	if len(routes) == 0 {
-		return false
-	}
-	return route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network)
-}
-
 func (m *DefaultManager) categorizeUserSelection(netID route.NetID, info *exitNodeInfo) {
 	if m.routeSelector.IsSelected(netID) {
 		info.userSelected = append(info.userSelected, netID)
@@ -791,45 +810,88 @@ func (m *DefaultManager) checkManagementSelection(routes []*route.Route, netID r
 	}
 }
 
-func (m *DefaultManager) updateExitNodeSelections(info exitNodeInfo) {
-	routesToDeselect := m.getRoutesToDeselect(info.allIDs)
-	m.deselectExitNodes(routesToDeselect)
-	m.selectExitNodesByManagement(info.selectedByManagement, info.allIDs)
+// pickPreferredExitNode chooses the single exit node to keep selected. In order:
+//   - a persisted user selection wins (deterministic if several survive from
+//     legacy state, so the set self-heals down to one);
+//   - otherwise activate only what management marks for auto-apply
+//     (SkipAutoApply=false); the lexicographically first if it marks several.
+//
+// Returns "" when neither holds — we never force an arbitrary exit node on. A
+// route the map doesn't auto-apply stays off until the user selects it.
+// info.userDeselected is informational only: an explicit deselect simply keeps
+// that route out of both lists above, so it can't be picked.
+func pickPreferredExitNode(info exitNodeInfo) route.NetID {
+	if len(info.userSelected) > 0 {
+		return minNetID(info.userSelected)
+	}
+	if len(info.selectedByManagement) > 0 {
+		return minNetID(info.selectedByManagement)
+	}
+	return ""
 }
 
-func (m *DefaultManager) getRoutesToDeselect(allIDs []route.NetID) []route.NetID {
-	var routesToDeselect []route.NetID
-	for _, netID := range allIDs {
-		if !m.routeSelector.HasUserSelectionForRoute(netID) {
-			routesToDeselect = append(routesToDeselect, netID)
+// enforceSingleExitNode makes preferred the only selected exit node: every other
+// available exit node is deselected and preferred (if any) is selected, without
+// disturbing non-exit route selections. The whole reconciliation runs under a
+// single RouteSelector lock (SetExclusiveExitNode) so a concurrent deselect-all
+// cannot interleave and get undone; a global deselect-all is left untouched so
+// the user's "all off" stays in effect.
+func (m *DefaultManager) enforceSingleExitNode(preferred route.NetID, allIDs []route.NetID) {
+	m.routeSelector.SetExclusiveExitNode(preferred, allIDs)
+}
+
+func (m *DefaultManager) logExitNodeUpdate(info exitNodeInfo, preferred route.NetID) {
+	log.Debugf("Exit node selection: %d available, preferred=%q (%d user-selected, %d user-deselected, %d management-selected)",
+		len(info.allIDs), preferred, len(info.userSelected), len(info.userDeselected), len(info.selectedByManagement))
+}
+
+// overlayNetworks returns the v4 and v6 overlay networks of the WireGuard interface, each only when it is set.
+func (m *DefaultManager) overlayNetworks() []string {
+	if m.wgInterface == nil {
+		return nil
+	}
+
+	addr := m.wgInterface.Address()
+	var nets []string
+	if addr.Network.IsValid() {
+		nets = append(nets, addr.Network.String())
+	}
+	if addr.IPv6Net.IsValid() {
+		nets = append(nets, addr.IPv6Net.String())
+	}
+	return nets
+}
+
+// clientRouteRange returns the static client route networks of the selected exit nodes together with the fake IP blocks.
+func (m *DefaultManager) clientRouteRange() []string {
+	filtered := m.routeSelector.FilterSelectedExitNodes(m.clientRoutes)
+	var nets []string
+	for _, routes := range filtered {
+		for _, r := range routes {
+			if r.IsDynamic() {
+				continue
+			}
+			nets = append(nets, r.NetString())
 		}
 	}
-	return routesToDeselect
+
+	if m.fakeIPManager != nil {
+		nets = append(nets, m.fakeIPManager.GetFakeIPBlock().String(), m.fakeIPManager.GetFakeIPv6Block().String())
+	}
+	return nets
 }
 
-func (m *DefaultManager) deselectExitNodes(routesToDeselect []route.NetID) {
-	if len(routesToDeselect) == 0 {
-		return
+// minNetID returns the lexicographically smallest NetID, for a deterministic
+// default pick that stays stable across restarts.
+func minNetID(ids []route.NetID) route.NetID {
+	if len(ids) == 0 {
+		return ""
 	}
-
-	err := m.routeSelector.DeselectRoutes(routesToDeselect, routesToDeselect)
-	if err != nil {
-		log.Warnf("Failed to deselect exit nodes: %v", err)
+	best := ids[0]
+	for _, id := range ids[1:] {
+		if id < best {
+			best = id
+		}
 	}
-}
-
-func (m *DefaultManager) selectExitNodesByManagement(selectedByManagement []route.NetID, allIDs []route.NetID) {
-	if len(selectedByManagement) == 0 {
-		return
-	}
-
-	err := m.routeSelector.SelectRoutes(selectedByManagement, true, allIDs)
-	if err != nil {
-		log.Warnf("Failed to select exit nodes: %v", err)
-	}
-}
-
-func (m *DefaultManager) logExitNodeUpdate(info exitNodeInfo) {
-	log.Debugf("Updated route selector: %d exit nodes available, %d selected by management, %d user-selected, %d user-deselected",
-		len(info.allIDs), len(info.selectedByManagement), len(info.userSelected), len(info.userDeselected))
+	return best
 }
diff --git a/client/internal/routemanager/manager_test.go b/client/internal/routemanager/manager_test.go
index 18b44820a..766ea1c61 100644
--- a/client/internal/routemanager/manager_test.go
+++ b/client/internal/routemanager/manager_test.go
@@ -8,6 +8,7 @@ import (
 	"net/netip"
 	"testing"
 
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
@@ -406,10 +407,7 @@ func TestManagerUpdateRoutes(t *testing.T) {
 	for n, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
 			peerPrivateKey, _ := wgtypes.GeneratePrivateKey()
-			newNet, err := stdnet.NewNet(context.Background(), nil)
-			if err != nil {
-				t.Fatal(err)
-			}
+			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist, nil)
 			opts := iface.WGIFaceOpts{
 				IFaceName:    fmt.Sprintf("utun43%d", n),
 				Address:      wgaddr.MustParseWGAddress("100.65.65.2/24"),
diff --git a/client/internal/routemanager/mock.go b/client/internal/routemanager/mock.go
index 937314995..2a8398b95 100644
--- a/client/internal/routemanager/mock.go
+++ b/client/internal/routemanager/mock.go
@@ -16,6 +16,8 @@ type MockManager struct {
 	ClassifyRoutesFunc           func(routes []*route.Route) (map[route.ID]*route.Route, route.HAMap)
 	UpdateRoutesFunc             func(updateSerial uint64, serverRoutes map[route.ID]*route.Route, clientRoutes route.HAMap, useNewDNSRoute bool) error
 	TriggerSelectionFunc         func(haMap route.HAMap)
+	SelectRoutesFunc             func(ids []route.NetID, appendRoute bool) error
+	DeselectRoutesFunc           func(ids []route.NetID) error
 	GetRouteSelectorFunc         func() *routeselector.RouteSelector
 	GetClientRoutesFunc          func() route.HAMap
 	GetSelectedClientRoutesFunc  func() route.HAMap
@@ -28,8 +30,8 @@ func (m *MockManager) Init() error {
 	return nil
 }
 
-// InitialRouteRange mock implementation of InitialRouteRange from Manager interface
-func (m *MockManager) InitialRouteRange() []string {
+// CurrentRouteRange mock implementation of CurrentRouteRange from Manager interface
+func (m *MockManager) CurrentRouteRange() []string {
 	return nil
 }
 
@@ -55,6 +57,30 @@ func (m *MockManager) TriggerSelection(networks route.HAMap) {
 	}
 }
 
+// SelectRoutes mock implementation of SelectRoutes from Manager interface
+func (m *MockManager) SelectRoutes(ids []route.NetID, appendRoute bool) error {
+	if m.SelectRoutesFunc != nil {
+		return m.SelectRoutesFunc(ids, appendRoute)
+	}
+	return nil
+}
+
+// DeselectRoutes mock implementation of DeselectRoutes from Manager interface
+func (m *MockManager) DeselectRoutes(ids []route.NetID) error {
+	if m.DeselectRoutesFunc != nil {
+		return m.DeselectRoutesFunc(ids)
+	}
+	return nil
+}
+
+// SelectAllRoutes mock implementation of SelectAllRoutes from Manager interface
+func (m *MockManager) SelectAllRoutes() {
+}
+
+// DeselectAllRoutes mock implementation of DeselectAllRoutes from Manager interface
+func (m *MockManager) DeselectAllRoutes() {
+}
+
 // GetRouteSelector mock implementation of GetRouteSelector from Manager interface
 func (m *MockManager) GetRouteSelector() *routeselector.RouteSelector {
 	if m.GetRouteSelectorFunc != nil {
@@ -112,6 +138,11 @@ func (m *MockManager) SetFirewall(firewall.Manager) error {
 func (m *MockManager) SetDNSForwarderPort(port uint16) {
 }
 
+// ReconcilePeerAllowedIPs mock implementation of ReconcilePeerAllowedIPs from Manager interface
+func (m *MockManager) ReconcilePeerAllowedIPs(peerKey string) error {
+	return nil
+}
+
 // Stop mock implementation of Stop from Manager interface
 func (m *MockManager) Stop(stateManager *statemanager.Manager) {
 	if m.StopFunc != nil {
diff --git a/client/internal/routemanager/notifier/notifier_android.go b/client/internal/routemanager/notifier/notifier_android.go
index 49300dbb2..24cbb94db 100644
--- a/client/internal/routemanager/notifier/notifier_android.go
+++ b/client/internal/routemanager/notifier/notifier_android.go
@@ -4,9 +4,6 @@ package notifier
 
 import (
 	"net/netip"
-	"slices"
-	"sort"
-	"strings"
 	"sync"
 
 	"github.com/netbirdio/netbird/client/internal/listener"
@@ -14,12 +11,15 @@ import (
 )
 
 type Notifier struct {
-	initialRoutes []*route.Route
-	currentRoutes []*route.Route
-	fakeIPRoutes  []*route.Route
+	mu sync.Mutex
 
-	listener    listener.NetworkChangeListener
-	listenerMux sync.Mutex
+	// currentRoutes is the last announced route set. It exists only to
+	// suppress noise: without it every network map sync would trigger the
+	// Java side, even when the routes did not change. The actual TUN route
+	// state is owned by the route manager and pulled from there.
+	currentRoutes []*route.Route
+
+	listener listener.NetworkChangeListener
 }
 
 func NewNotifier() *Notifier {
@@ -27,20 +27,15 @@ func NewNotifier() *Notifier {
 }
 
 func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
-	n.listenerMux.Lock()
-	defer n.listenerMux.Unlock()
+	n.mu.Lock()
+	defer n.mu.Unlock()
 	n.listener = listener
 }
 
-// SetInitialClientRoutes stores the initial route sets for TUN configuration.
-func (n *Notifier) SetInitialClientRoutes(initialRoutes []*route.Route, routesForComparison []*route.Route) {
-	n.initialRoutes = filterStatic(initialRoutes)
-	n.currentRoutes = filterStatic(routesForComparison)
-}
-
-// SetFakeIPRoutes stores the fake IP routes to be included in every TUN rebuild.
-func (n *Notifier) SetFakeIPRoutes(routes []*route.Route) {
-	n.fakeIPRoutes = routes
+func (n *Notifier) NotifyRouteChange() {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	n.notifyLocked()
 }
 
 func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
@@ -54,70 +49,25 @@ func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
 		}
 	}
 
-	if !n.hasRouteDiff(n.currentRoutes, newRoutes) {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	if !hasRouteDiff(n.currentRoutes, newRoutes) {
 		return
 	}
 
 	n.currentRoutes = newRoutes
-	n.notify()
+	n.notifyLocked()
 }
 
 func (n *Notifier) OnNewPrefixes([]netip.Prefix) {
 	// Not used on Android
 }
 
-func (n *Notifier) notify() {
-	n.listenerMux.Lock()
-	defer n.listenerMux.Unlock()
+func (n *Notifier) notifyLocked() {
 	if n.listener == nil {
 		return
 	}
-
-	allRoutes := slices.Clone(n.currentRoutes)
-	allRoutes = append(allRoutes, n.fakeIPRoutes...)
-
-	routeStrings := n.routesToStrings(allRoutes)
-	sort.Strings(routeStrings)
-	go func(l listener.NetworkChangeListener) {
-		l.OnNetworkChanged(strings.Join(routeStrings, ","))
-	}(n.listener)
-}
-
-func filterStatic(routes []*route.Route) []*route.Route {
-	out := make([]*route.Route, 0, len(routes))
-	for _, r := range routes {
-		if !r.IsDynamic() {
-			out = append(out, r)
-		}
-	}
-	return out
-}
-
-func (n *Notifier) routesToStrings(routes []*route.Route) []string {
-	nets := make([]string, 0, len(routes))
-	for _, r := range routes {
-		nets = append(nets, r.NetString())
-	}
-	return nets
-}
-
-func (n *Notifier) hasRouteDiff(a []*route.Route, b []*route.Route) bool {
-	slices.SortFunc(a, func(x, y *route.Route) int {
-		return strings.Compare(x.NetString(), y.NetString())
-	})
-	slices.SortFunc(b, func(x, y *route.Route) int {
-		return strings.Compare(x.NetString(), y.NetString())
-	})
-
-	return !slices.EqualFunc(a, b, func(x, y *route.Route) bool {
-		return x.NetString() == y.NetString()
-	})
-}
-
-func (n *Notifier) GetInitialRouteRanges() []string {
-	initialStrings := n.routesToStrings(n.initialRoutes)
-	sort.Strings(initialStrings)
-	return initialStrings
+	n.listener.OnNetworkChanged("")
 }
 
 func (n *Notifier) Close() {
diff --git a/client/internal/routemanager/notifier/notifier_ios.go b/client/internal/routemanager/notifier/notifier_ios.go
index d0888f3a1..d663dd471 100644
--- a/client/internal/routemanager/notifier/notifier_ios.go
+++ b/client/internal/routemanager/notifier/notifier_ios.go
@@ -3,7 +3,6 @@
 package notifier
 
 import (
-	"container/list"
 	"net/netip"
 	"slices"
 	"sort"
@@ -16,20 +15,12 @@ import (
 
 type Notifier struct {
 	mu              sync.Mutex
-	cond            *sync.Cond
 	currentPrefixes []string
 	listener        listener.NetworkChangeListener
-	queue           *list.List
-	closed          bool
 }
 
 func NewNotifier() *Notifier {
-	n := &Notifier{
-		queue: list.New(),
-	}
-	n.cond = sync.NewCond(&n.mu)
-	go n.deliverLoop()
-	return n
+	return &Notifier{}
 }
 
 func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
@@ -38,11 +29,7 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	n.listener = listener
 }
 
-func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
-	// iOS doesn't care about initial routes
-}
-
-func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
+func (n *Notifier) NotifyRouteChange() {
 	// Not used on iOS
 }
 
@@ -59,44 +46,19 @@ func (n *Notifier) OnNewPrefixes(prefixes []netip.Prefix) {
 	sort.Strings(newNets)
 
 	n.mu.Lock()
+	defer n.mu.Unlock()
 	if slices.Equal(n.currentPrefixes, newNets) {
-		n.mu.Unlock()
 		return
 	}
 	n.currentPrefixes = newNets
-	routes := strings.Join(n.currentPrefixes, ",")
-	n.queue.PushBack(routes)
-	n.cond.Signal()
-	n.mu.Unlock()
+	if n.listener != nil {
+		n.listener.OnNetworkChanged(strings.Join(n.currentPrefixes, ","))
+	}
 }
 
 func (n *Notifier) Close() {
-	n.mu.Lock()
-	n.closed = true
-	n.cond.Signal()
-	n.mu.Unlock()
 }
 
 func (n *Notifier) GetInitialRouteRanges() []string {
 	return nil
 }
-
-func (n *Notifier) deliverLoop() {
-	for {
-		n.mu.Lock()
-		for n.queue.Len() == 0 && !n.closed {
-			n.cond.Wait()
-		}
-		if n.closed && n.queue.Len() == 0 {
-			n.mu.Unlock()
-			return
-		}
-		routes := n.queue.Remove(n.queue.Front()).(string)
-		l := n.listener
-		n.mu.Unlock()
-
-		if l != nil {
-			l.OnNetworkChanged(routes)
-		}
-	}
-}
diff --git a/client/internal/routemanager/notifier/notifier_other.go b/client/internal/routemanager/notifier/notifier_other.go
index 71b1096c2..fe48e07b3 100644
--- a/client/internal/routemanager/notifier/notifier_other.go
+++ b/client/internal/routemanager/notifier/notifier_other.go
@@ -19,11 +19,7 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	// Not used on non-mobile platforms
 }
 
-func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
-	// Not used on non-mobile platforms
-}
-
-func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
+func (n *Notifier) NotifyRouteChange() {
 	// Not used on non-mobile platforms
 }
 
@@ -35,10 +31,6 @@ func (n *Notifier) OnNewPrefixes(prefixes []netip.Prefix) {
 	// Not used on non-mobile platforms
 }
 
-func (n *Notifier) GetInitialRouteRanges() []string {
-	return []string{}
-}
-
 func (n *Notifier) Close() {
 	// unused
 }
diff --git a/client/internal/routemanager/notifier/route_diff.go b/client/internal/routemanager/notifier/route_diff.go
new file mode 100644
index 000000000..52abddf36
--- /dev/null
+++ b/client/internal/routemanager/notifier/route_diff.go
@@ -0,0 +1,27 @@
+package notifier
+
+import (
+	"slices"
+	"sort"
+
+	"github.com/netbirdio/netbird/route"
+)
+
+// routePrefixes returns the distinct prefixes a route set covers, sorted.
+// Duplicates are dropped deliberately: an HA group hands us one route per
+// peer serving the same prefix, and the platform is given the prefix, not the
+// candidates. Counting them would report a change every time a peer joins or
+// leaves a group, and on Android each report renews the TUN.
+func routePrefixes(routes []*route.Route) []string {
+	nets := make([]string, 0, len(routes))
+	for _, r := range routes {
+		nets = append(nets, r.NetString())
+	}
+	sort.Strings(nets)
+	return slices.Compact(nets)
+}
+
+// hasRouteDiff reports whether the prefixes the two route sets cover differ.
+func hasRouteDiff(a []*route.Route, b []*route.Route) bool {
+	return !slices.Equal(routePrefixes(a), routePrefixes(b))
+}
diff --git a/client/internal/routemanager/notifier/route_diff_test.go b/client/internal/routemanager/notifier/route_diff_test.go
new file mode 100644
index 000000000..80df69d9d
--- /dev/null
+++ b/client/internal/routemanager/notifier/route_diff_test.go
@@ -0,0 +1,88 @@
+package notifier
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/route"
+)
+
+func routeFor(id route.ID, prefix string) *route.Route {
+	return &route.Route{
+		ID:      id,
+		NetID:   "net",
+		Network: netip.MustParsePrefix(prefix),
+	}
+}
+
+// TestHasRouteDiff_IgnoresHACandidateCount is the reason the comparison
+// deduplicates. Every notification renews the TUN, and a renewed TUN
+// invalidates the sockets the embedded servers are listening on, so a peer
+// joining or leaving an HA group must not count as a route change when the
+// prefixes the TUN carries are identical.
+func TestHasRouteDiff_IgnoresHACandidateCount(t *testing.T) {
+	onePeer := []*route.Route{routeFor("a", "10.0.0.0/24")}
+	twoPeers := []*route.Route{
+		routeFor("a", "10.0.0.0/24"),
+		routeFor("b", "10.0.0.0/24"),
+	}
+
+	assert.False(t, hasRouteDiff(onePeer, twoPeers),
+		"a second peer serving the same prefix is not a route change")
+	assert.False(t, hasRouteDiff(twoPeers, onePeer),
+		"losing one of two peers serving the same prefix is not a route change")
+}
+
+func TestHasRouteDiff_ReportsRealChanges(t *testing.T) {
+	tests := []struct {
+		name string
+		a    []*route.Route
+		b    []*route.Route
+		want bool
+	}{
+		{
+			name: "added prefix",
+			a:    []*route.Route{routeFor("a", "10.0.0.0/24")},
+			b:    []*route.Route{routeFor("a", "10.0.0.0/24"), routeFor("b", "10.0.1.0/24")},
+			want: true,
+		},
+		{
+			name: "removed prefix",
+			a:    []*route.Route{routeFor("a", "10.0.0.0/24"), routeFor("b", "10.0.1.0/24")},
+			b:    []*route.Route{routeFor("a", "10.0.0.0/24")},
+			want: true,
+		},
+		{
+			name: "replaced prefix",
+			a:    []*route.Route{routeFor("a", "10.0.0.0/24")},
+			b:    []*route.Route{routeFor("a", "10.0.1.0/24")},
+			want: true,
+		},
+		{
+			name: "same prefix, different order",
+			a:    []*route.Route{routeFor("a", "10.0.1.0/24"), routeFor("b", "10.0.0.0/24")},
+			b:    []*route.Route{routeFor("b", "10.0.0.0/24"), routeFor("a", "10.0.1.0/24")},
+			want: false,
+		},
+		{
+			name: "all routes gone",
+			a:    []*route.Route{routeFor("a", "10.0.0.0/24")},
+			b:    nil,
+			want: true,
+		},
+		{
+			name: "both empty",
+			a:    nil,
+			b:    nil,
+			want: false,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, hasRouteDiff(tc.a, tc.b),
+				"route diff for %s", tc.name)
+		})
+	}
+}
diff --git a/client/internal/routemanager/reconcile_test.go b/client/internal/routemanager/reconcile_test.go
new file mode 100644
index 000000000..bc9693229
--- /dev/null
+++ b/client/internal/routemanager/reconcile_test.go
@@ -0,0 +1,91 @@
+//go:build !windows
+
+package routemanager
+
+import (
+	"net"
+	"net/netip"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/tun/netstack"
+
+	"github.com/netbirdio/netbird/client/iface/device"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
+)
+
+// reconcileWGMock is a minimal iface.WGIface that records AddAllowedIP calls and reports the
+// configured address; every other method is an inert stub because the tests exercise none of them.
+type reconcileWGMock struct {
+	mu   sync.Mutex
+	adds map[string][]netip.Prefix
+	addr wgaddr.Address
+}
+
+func (m *reconcileWGMock) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.adds == nil {
+		m.adds = map[string][]netip.Prefix{}
+	}
+	m.adds[peerKey] = append(m.adds[peerKey], allowedIP)
+	return nil
+}
+
+func (m *reconcileWGMock) added(peerKey string) []netip.Prefix {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.adds[peerKey]
+}
+
+func (m *reconcileWGMock) RemoveAllowedIP(string, netip.Prefix) error { return nil }
+func (m *reconcileWGMock) Name() string                               { return "utun-test" }
+func (m *reconcileWGMock) Address() wgaddr.Address                    { return m.addr }
+func (m *reconcileWGMock) ToInterface() *net.Interface                { return nil }
+func (m *reconcileWGMock) IsUserspaceBind() bool                      { return false }
+func (m *reconcileWGMock) GetFilter() device.PacketFilter             { return nil }
+func (m *reconcileWGMock) GetDevice() *device.FilteredDevice          { return nil }
+func (m *reconcileWGMock) GetNet() *netstack.Net                      { return nil }
+
+// TestReconcilePeerAllowedIPs verifies the declarative reconcile re-applies every routed prefix
+// tracked for the peer (self-heal, independent of refcount level) and stays scoped to that peer.
+func TestReconcilePeerAllowedIPs(t *testing.T) {
+	wg := &reconcileWGMock{}
+	m := &DefaultManager{wgInterface: wg}
+	m.allowedIPsRefCounter = refcounter.NewAllowedIPs(
+		func(_ netip.Prefix, peerKey string) (string, error) { return peerKey, nil },
+		func(netip.Prefix, string) error { return nil },
+	)
+
+	peerA1 := netip.MustParsePrefix("10.0.0.0/24")
+	peerA2 := netip.MustParsePrefix("10.1.0.0/24")
+	peerB1 := netip.MustParsePrefix("10.2.0.0/24")
+
+	for prefix, peer := range map[netip.Prefix]string{peerA1: "peerA", peerA2: "peerA", peerB1: "peerB"} {
+		_, err := m.allowedIPsRefCounter.Increment(prefix, peer)
+		require.NoError(t, err)
+	}
+	// Extra reference: reconcile must still re-apply the prefix even though its refcount never
+	// hit 0 again (the exact case the plain incremental path skips).
+	_, err := m.allowedIPsRefCounter.Increment(peerA1, "peerA")
+	require.NoError(t, err)
+
+	require.NoError(t, m.ReconcilePeerAllowedIPs("peerA"))
+
+	assert.ElementsMatch(t, []netip.Prefix{peerA1, peerA2}, wg.added("peerA"),
+		"reconcile must re-apply all routed prefixes of the peer")
+	assert.Empty(t, wg.added("peerB"), "reconcile must not touch another peer's prefixes")
+}
+
+// TestReconcilePeerAllowedIPsNoCounter verifies reconcile is a safe no-op before the refcounter is
+// set up.
+func TestReconcilePeerAllowedIPsNoCounter(t *testing.T) {
+	wg := &reconcileWGMock{}
+	m := &DefaultManager{wgInterface: wg}
+
+	require.NoError(t, m.ReconcilePeerAllowedIPs("peerA"))
+	assert.Empty(t, wg.added("peerA"))
+}
diff --git a/client/internal/routemanager/refcounter/allowedips.go b/client/internal/routemanager/refcounter/allowedips.go
new file mode 100644
index 000000000..6d682e8a9
--- /dev/null
+++ b/client/internal/routemanager/refcounter/allowedips.go
@@ -0,0 +1,206 @@
+package refcounter
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+	"sort"
+	"sync"
+
+	"github.com/hashicorp/go-multierror"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+)
+
+// allowedIPsEntry holds the per-peer reference counts for a single prefix and which peer is
+// currently installed in WireGuard. WireGuard allows a prefix on exactly one peer, so at most
+// one peer is active at a time even when several peers reference the prefix.
+type allowedIPsEntry struct {
+	// peers maps a peerKey to the number of references holding the prefix for that peer.
+	peers map[string]int
+	// active is the peerKey currently installed in WireGuard for this prefix ("" if none).
+	active string
+	// total is the sum of all per-peer reference counts (kept in sync with peers).
+	total int
+}
+
+// AllowedIPsRefCounter is a peer-aware reference counter for WireGuard AllowedIPs.
+//
+// The generic Counter keys only by prefix and remembers a single Out value set by the first
+// caller, which it never changes. That is wrong for AllowedIPs: two independent watchers (or
+// multiple resolved domains) can reference the same prefix through different peers, and when the
+// peer currently installed in WireGuard releases its last reference the prefix must be handed over
+// to a surviving peer instead of being left pointing at the released one.
+//
+// It calls add/remove (which program WireGuard) only on the transitions that matter:
+//   - add on the first reference for a prefix, or when swapping the active peer;
+//   - remove on the last reference for a prefix, or on the old peer during a swap.
+type AllowedIPsRefCounter struct {
+	mu      sync.Mutex
+	entries map[netip.Prefix]*allowedIPsEntry
+	add     AddFunc[netip.Prefix, string, string]
+	remove  RemoveFunc[netip.Prefix, string]
+}
+
+// NewAllowedIPs creates a new peer-aware AllowedIPs reference counter.
+// add programs a prefix on a peer in WireGuard and returns the peerKey to store as the active peer.
+// remove unprograms the prefix from the given peer.
+func NewAllowedIPs(add AddFunc[netip.Prefix, string, string], remove RemoveFunc[netip.Prefix, string]) *AllowedIPsRefCounter {
+	return &AllowedIPsRefCounter{
+		entries: map[netip.Prefix]*allowedIPsEntry{},
+		add:     add,
+		remove:  remove,
+	}
+}
+
+// Increment adds a reference to prefix for peerKey. WireGuard is programmed only for the first
+// reference to a prefix; while a different peer is already installed the prefix is left with it
+// (first peer wins, HA at the WireGuard layer is not possible) and only the reference count is kept.
+func (rm *AllowedIPsRefCounter) Increment(prefix netip.Prefix, peerKey string) (Ref[string], error) {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+
+	e, ok := rm.entries[prefix]
+	if !ok {
+		e = &allowedIPsEntry{peers: map[string]int{}}
+		rm.entries[prefix] = e
+	}
+
+	logCallerF("Increasing allowed IP ref count for prefix %v peer %s [peer %d -> %d, total %d -> %d, active %q]",
+		prefix, peerKey, e.peers[peerKey], e.peers[peerKey]+1, e.total, e.total+1, e.active)
+
+	// Program WireGuard only when nothing is installed yet for this prefix.
+	if e.active == "" {
+		out, err := rm.add(prefix, peerKey)
+		if errors.Is(err, ErrIgnore) {
+			if e.total == 0 {
+				delete(rm.entries, prefix)
+			}
+			return Ref[string]{Count: e.total, Out: e.active}, nil
+		}
+		if err != nil {
+			if e.total == 0 {
+				delete(rm.entries, prefix)
+			}
+			return Ref[string]{}, fmt.Errorf("failed to add allowed IP %v for peer %s: %w", prefix, peerKey, err)
+		}
+		e.active = out
+	}
+
+	e.peers[peerKey]++
+	e.total++
+
+	return Ref[string]{Count: e.total, Out: e.active}, nil
+}
+
+// Decrement removes a reference to prefix for peerKey. When the peer currently installed in
+// WireGuard releases its last reference, the prefix is swapped to a surviving peer if one exists,
+// otherwise it is removed from WireGuard.
+func (rm *AllowedIPsRefCounter) Decrement(prefix netip.Prefix, peerKey string) (Ref[string], error) {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+
+	e, ok := rm.entries[prefix]
+	if !ok {
+		logCallerF("No allowed IP reference found for prefix %v", prefix)
+		return Ref[string]{}, nil
+	}
+
+	if e.peers[peerKey] > 0 {
+		logCallerF("Decreasing allowed IP ref count for prefix %v peer %s [peer %d -> %d, total %d -> %d, active %q]",
+			prefix, peerKey, e.peers[peerKey], e.peers[peerKey]-1, e.total, e.total-1, e.active)
+		e.peers[peerKey]--
+		e.total--
+		if e.peers[peerKey] == 0 {
+			delete(e.peers, peerKey)
+		}
+	} else {
+		logCallerF("No allowed IP reference found for prefix %v peer %s", prefix, peerKey)
+	}
+
+	// If the peer currently installed in WireGuard still holds references, nothing to reprogram.
+	// Keying the check on the active peer (not the one just released) makes this self-healing:
+	// a prior swap whose remove/add failed leaves e.active pointing at a peer with no references,
+	// and this retries the hand-off on the next Decrement instead of getting stuck.
+	if e.active != "" && e.peers[e.active] > 0 {
+		return Ref[string]{Count: e.total, Out: e.active}, nil
+	}
+
+	// Detach the stale/gone active peer from WireGuard before reprogramming.
+	if e.active != "" {
+		if err := rm.remove(prefix, e.active); err != nil {
+			return Ref[string]{Count: e.total, Out: e.active}, fmt.Errorf("remove allowed IP %v for peer %s: %w", prefix, e.active, err)
+		}
+		e.active = ""
+	}
+
+	// Hand the prefix over to a surviving peer, or drop the entry when none remain.
+	if survivor, ok := pickSurvivor(e.peers); ok {
+		out, err := rm.add(prefix, survivor)
+		if err != nil {
+			return Ref[string]{Count: e.total, Out: ""}, fmt.Errorf("swap allowed IP %v to peer %s: %w", prefix, survivor, err)
+		}
+		e.active = out
+		return Ref[string]{Count: e.total, Out: e.active}, nil
+	}
+
+	delete(rm.entries, prefix)
+	return Ref[string]{Count: 0, Out: ""}, nil
+}
+
+// Flush removes all prefixes from WireGuard and clears the counter.
+func (rm *AllowedIPsRefCounter) Flush() error {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+
+	var merr *multierror.Error
+	for prefix, e := range rm.entries {
+		if e.active == "" {
+			continue
+		}
+		logCallerF("Flushing allowed IP for prefix %v peer %s", prefix, e.active)
+		if err := rm.remove(prefix, e.active); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %v for peer %s: %w", prefix, e.active, err))
+		}
+	}
+
+	clear(rm.entries)
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// ReapplyMatching calls apply for every prefix whose currently installed (active) peer satisfies
+// pred, holding the lock for the whole pass. It is used to re-push allowed IPs onto a peer whose
+// WireGuard entry was rebuilt (e.g. a lazy connection cycling idle->wake) without a matching
+// refcounter change, which would otherwise leave the prefix installed in the counter but missing
+// on the device. Only the active peer is considered — a prefix that lost its installed peer to a
+// failed swap is skipped here and reconciled by the next Increment/Decrement.
+func (rm *AllowedIPsRefCounter) ReapplyMatching(pred func(out string) bool, apply func(key netip.Prefix) error) error {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+
+	var merr *multierror.Error
+	for prefix, e := range rm.entries {
+		if e.active != "" && pred(e.active) {
+			if err := apply(prefix); err != nil {
+				merr = multierror.Append(merr, err)
+			}
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// pickSurvivor deterministically selects a peer still referencing the prefix. WireGuard cannot do
+// multipath for a single prefix, so any surviving peer is a valid winner; the choice is made stable
+// (lowest peerKey) for predictable behavior and testability.
+func pickSurvivor(peers map[string]int) (string, bool) {
+	if len(peers) == 0 {
+		return "", false
+	}
+	keys := make([]string, 0, len(peers))
+	for k := range peers {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys[0], true
+}
diff --git a/client/internal/routemanager/refcounter/allowedips_test.go b/client/internal/routemanager/refcounter/allowedips_test.go
new file mode 100644
index 000000000..835142083
--- /dev/null
+++ b/client/internal/routemanager/refcounter/allowedips_test.go
@@ -0,0 +1,241 @@
+package refcounter
+
+import (
+	"errors"
+	"net/netip"
+	"testing"
+)
+
+// fakeWG models WireGuard's cryptokey routing: a prefix can be installed on exactly one peer.
+// failAdd/failRemove make the next add/remove fail once, to exercise the self-healing error paths.
+type fakeWG struct {
+	installed  map[netip.Prefix]string
+	adds       int
+	removes    int
+	failAdd    bool
+	failRemove bool
+}
+
+func newFakeWG() *fakeWG {
+	return &fakeWG{installed: map[netip.Prefix]string{}}
+}
+
+func (f *fakeWG) counter() *AllowedIPsRefCounter {
+	return NewAllowedIPs(
+		func(prefix netip.Prefix, peerKey string) (string, error) {
+			if f.failAdd {
+				f.failAdd = false
+				return "", errors.New("add failed")
+			}
+			f.adds++
+			f.installed[prefix] = peerKey
+			return peerKey, nil
+		},
+		func(prefix netip.Prefix, peerKey string) error {
+			if f.failRemove {
+				f.failRemove = false
+				return errors.New("remove failed")
+			}
+			f.removes++
+			// only clear if this peer is the one installed, mirroring wg semantics
+			if f.installed[prefix] == peerKey {
+				delete(f.installed, prefix)
+			}
+			return nil
+		},
+	)
+}
+
+func mustPrefix(t *testing.T, s string) netip.Prefix {
+	t.Helper()
+	p, err := netip.ParsePrefix(s)
+	if err != nil {
+		t.Fatalf("parse prefix %q: %v", s, err)
+	}
+	return p
+}
+
+func mustIncrement(t *testing.T, c *AllowedIPsRefCounter, p netip.Prefix, peer string) Ref[string] {
+	t.Helper()
+	ref, err := c.Increment(p, peer)
+	if err != nil {
+		t.Fatalf("Increment(%v, %s): %v", p, peer, err)
+	}
+	return ref
+}
+
+func mustDecrement(t *testing.T, c *AllowedIPsRefCounter, p netip.Prefix, peer string) Ref[string] {
+	t.Helper()
+	ref, err := c.Decrement(p, peer)
+	if err != nil {
+		t.Fatalf("Decrement(%v, %s): %v", p, peer, err)
+	}
+	return ref
+}
+
+// TestAllowedIPs_SwapOnActivePeerRemoval reproduces the reported bug: two networks with the same
+// prefix routed by different peers. Removing the network whose peer is installed must hand the
+// prefix over to the surviving peer instead of leaving it on the removed one.
+func TestAllowedIPs_SwapOnActivePeerRemoval(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	mustIncrement(t, c, p, "peerA")
+	mustIncrement(t, c, p, "peerB")
+	// First peer wins while both are present.
+	if got := f.installed[p]; got != "peerA" {
+		t.Fatalf("expected peerA installed, got %q", got)
+	}
+
+	// Remove the active peer's network -> must swap to peerB.
+	mustDecrement(t, c, p, "peerA")
+	if got := f.installed[p]; got != "peerB" {
+		t.Fatalf("BUG: prefix stuck on removed peer, want peerB got %q", got)
+	}
+
+	// Remove the last one -> prefix gone.
+	mustDecrement(t, c, p, "peerB")
+	if _, ok := f.installed[p]; ok {
+		t.Fatalf("expected prefix removed, still installed on %q", f.installed[p])
+	}
+}
+
+// TestAllowedIPs_RemoveNonActivePeer removing a non-installed peer must not touch WireGuard.
+func TestAllowedIPs_RemoveNonActivePeer(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	mustIncrement(t, c, p, "peerA")
+	mustIncrement(t, c, p, "peerB")
+	removesBefore := f.removes
+
+	mustDecrement(t, c, p, "peerB")
+	if f.installed[p] != "peerA" {
+		t.Fatalf("active peer must stay peerA, got %q", f.installed[p])
+	}
+	if f.removes != removesBefore {
+		t.Fatalf("removing a non-active peer must not call wg remove")
+	}
+}
+
+// TestAllowedIPs_SamePeerMultipleRefs two references via the same peer must keep the prefix until
+// the last reference is released (the reason the per-peer count must be an int, not a set).
+func TestAllowedIPs_SamePeerMultipleRefs(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	mustIncrement(t, c, p, "peerA")
+	mustIncrement(t, c, p, "peerA")
+	if f.adds != 1 {
+		t.Fatalf("expected a single wg add for the same peer, got %d", f.adds)
+	}
+
+	mustDecrement(t, c, p, "peerA")
+	if f.installed[p] != "peerA" {
+		t.Fatalf("prefix must stay while a reference remains, got %q", f.installed[p])
+	}
+	if f.removes != 0 {
+		t.Fatalf("no wg remove expected while a reference remains, got %d", f.removes)
+	}
+
+	mustDecrement(t, c, p, "peerA")
+	if _, ok := f.installed[p]; ok {
+		t.Fatalf("prefix must be removed after last reference")
+	}
+}
+
+// TestAllowedIPs_RefCountAndActive checks the Ref returned to callers (used for the HA-disabled log).
+func TestAllowedIPs_RefCountAndActive(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	ref := mustIncrement(t, c, p, "peerA")
+	if ref.Count != 1 || ref.Out != "peerA" {
+		t.Fatalf("want {1, peerA}, got {%d, %q}", ref.Count, ref.Out)
+	}
+	ref = mustIncrement(t, c, p, "peerB")
+	if ref.Count != 2 || ref.Out != "peerA" {
+		t.Fatalf("want {2, peerA}, got {%d, %q}", ref.Count, ref.Out)
+	}
+}
+
+// TestAllowedIPs_Flush removes everything installed and clears the counter.
+func TestAllowedIPs_Flush(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p1 := mustPrefix(t, "10.44.8.0/24")
+	p2 := mustPrefix(t, "10.44.9.0/24")
+
+	mustIncrement(t, c, p1, "peerA")
+	mustIncrement(t, c, p2, "peerB")
+
+	if err := c.Flush(); err != nil {
+		t.Fatal(err)
+	}
+	if len(f.installed) != 0 {
+		t.Fatalf("expected all prefixes removed, got %v", f.installed)
+	}
+	// After flush, a fresh increment must add again.
+	mustIncrement(t, c, p1, "peerC")
+	if f.installed[p1] != "peerC" {
+		t.Fatalf("counter not reset after flush")
+	}
+}
+
+// TestAllowedIPs_SelfHealAfterSwapAddError ensures a failed add during a swap does not permanently
+// strand the prefix: the next Decrement (or Increment) must retry and install a surviving peer.
+func TestAllowedIPs_SelfHealAfterSwapAddError(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	mustIncrement(t, c, p, "peerA")
+	mustIncrement(t, c, p, "peerB")
+	mustIncrement(t, c, p, "peerC")
+
+	// Removing the active peerA triggers a swap to a survivor; make the add fail once.
+	f.failAdd = true
+	if _, err := c.Decrement(p, "peerA"); err == nil {
+		t.Fatalf("expected error from failed swap add")
+	}
+	if _, ok := f.installed[p]; ok {
+		t.Fatalf("nothing should be installed after a failed swap add, got %q", f.installed[p])
+	}
+
+	// A later Decrement of a non-active survivor must retry the hand-off (self-heal), not stay stuck.
+	ref := mustDecrement(t, c, p, "peerC")
+	if got := f.installed[p]; got == "" {
+		t.Fatalf("self-heal failed: prefix left unrouted after add recovered")
+	}
+	if ref.Out == "" {
+		t.Fatalf("expected an active peer after self-heal, got empty")
+	}
+}
+
+// TestAllowedIPs_SelfHealAfterRemoveError ensures a failed remove during a swap is retried instead
+// of leaving e.active stuck on a peer that no longer holds references.
+func TestAllowedIPs_SelfHealAfterRemoveError(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	mustIncrement(t, c, p, "peerA")
+	mustIncrement(t, c, p, "peerB")
+
+	// Releasing active peerA must detach it (remove) then add peerB; fail the remove once.
+	f.failRemove = true
+	if _, err := c.Decrement(p, "peerA"); err == nil {
+		t.Fatalf("expected error from failed remove")
+	}
+
+	// Next Decrement of the non-active survivor retries: removes stale peerA, installs peerB.
+	mustDecrement(t, c, p, "peerB")
+	// peerB had only one ref, so after retry the prefix is fully released.
+	if _, ok := f.installed[p]; ok {
+		t.Fatalf("expected prefix released after self-heal, still on %q", f.installed[p])
+	}
+}
diff --git a/client/internal/routemanager/refcounter/refcounter.go b/client/internal/routemanager/refcounter/refcounter.go
index 27a724f50..917120275 100644
--- a/client/internal/routemanager/refcounter/refcounter.go
+++ b/client/internal/routemanager/refcounter/refcounter.go
@@ -94,6 +94,26 @@ func (rm *Counter[Key, I, O]) Get(key Key) (Ref[O], bool) {
 	return ref, ok
 }
 
+// ReapplyMatching calls apply for every key whose stored Out satisfies pred, holding the
+// counter lock for the whole pass. Running apply under the lock keeps it atomic with respect
+// to Increment/Decrement: a prefix dropped to zero is removed from the map (and had its
+// RemoveFunc called) before this pass observes it, so a stale key can never be re-applied.
+// pred and apply are invoked under the lock, so they must not call back into the counter.
+func (rm *Counter[Key, I, O]) ReapplyMatching(pred func(out O) bool, apply func(key Key) error) error {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+
+	var merr *multierror.Error
+	for key, ref := range rm.refCountMap {
+		if pred(ref.Out) {
+			if err := apply(key); err != nil {
+				merr = multierror.Append(merr, err)
+			}
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
 // Increment increments the reference count for the given key.
 // If this is the first reference to the key, the AddFunc is called.
 func (rm *Counter[Key, I, O]) Increment(key Key, in I) (Ref[O], error) {
diff --git a/client/internal/routemanager/refcounter/refcounter_test.go b/client/internal/routemanager/refcounter/refcounter_test.go
new file mode 100644
index 000000000..79a99c388
--- /dev/null
+++ b/client/internal/routemanager/refcounter/refcounter_test.go
@@ -0,0 +1,47 @@
+package refcounter
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestReapplyMatching verifies ReapplyMatching invokes apply for exactly the keys whose stored
+// Out satisfies the predicate (no duplicates for multiply-referenced keys) — the primitive
+// ReconcilePeerAllowedIPs relies on to re-apply a single peer's routed prefixes.
+func TestReapplyMatching(t *testing.T) {
+	rc := New[netip.Prefix, string, string](
+		func(_ netip.Prefix, peerKey string) (string, error) { return peerKey, nil },
+		func(netip.Prefix, string) error { return nil },
+	)
+
+	peerA1 := netip.MustParsePrefix("10.0.0.0/24")
+	peerA2 := netip.MustParsePrefix("10.1.0.0/24")
+	peerB1 := netip.MustParsePrefix("10.2.0.0/24")
+
+	for prefix, peer := range map[netip.Prefix]string{peerA1: "peerA", peerA2: "peerA", peerB1: "peerB"} {
+		_, err := rc.Increment(prefix, peer)
+		require.NoError(t, err)
+	}
+	// a second reference must not make the key applied twice
+	_, err := rc.Increment(peerA1, "peerA")
+	require.NoError(t, err)
+
+	var applied []netip.Prefix
+	err = rc.ReapplyMatching(
+		func(out string) bool { return out == "peerA" },
+		func(key netip.Prefix) error { applied = append(applied, key); return nil },
+	)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []netip.Prefix{peerA1, peerA2}, applied)
+
+	var none []netip.Prefix
+	err = rc.ReapplyMatching(
+		func(out string) bool { return out == "missing" },
+		func(key netip.Prefix) error { none = append(none, key); return nil },
+	)
+	require.NoError(t, err)
+	assert.Empty(t, none)
+}
diff --git a/client/internal/routemanager/refcounter/types.go b/client/internal/routemanager/refcounter/types.go
index aadac3e25..7da0e17e3 100644
--- a/client/internal/routemanager/refcounter/types.go
+++ b/client/internal/routemanager/refcounter/types.go
@@ -5,5 +5,7 @@ import "net/netip"
 // RouteRefCounter is a Counter for Route, it doesn't take any input on Increment and doesn't use any output on Decrement
 type RouteRefCounter = Counter[netip.Prefix, struct{}, struct{}]
 
-// AllowedIPsRefCounter is a Counter for AllowedIPs, it takes a peer key on Increment and passes it back to Decrement
-type AllowedIPsRefCounter = Counter[netip.Prefix, string, string]
+// AllowedIPsRefCounter tracks WireGuard AllowedIPs per prefix. Unlike the generic Counter it is peer-aware:
+// a prefix can be claimed by several peers at once and WireGuard allows a given prefix on exactly one peer,
+// so the counter records the per-peer reference count and swaps the installed peer when the active one is released.
+// See allowedips.go.
diff --git a/client/internal/routemanager/route_range_test.go b/client/internal/routemanager/route_range_test.go
new file mode 100644
index 000000000..b51b5747a
--- /dev/null
+++ b/client/internal/routemanager/route_range_test.go
@@ -0,0 +1,95 @@
+//go:build !windows
+
+package routemanager
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/internal/routeselector"
+	"github.com/netbirdio/netbird/route"
+)
+
+func TestCurrentRouteRange_OverlayNetworkWithClientRoutesDisabled(t *testing.T) {
+	m := &DefaultManager{
+		wgInterface:         &reconcileWGMock{addr: wgaddr.MustParseWGAddress("100.91.96.107/16")},
+		disableClientRoutes: true,
+	}
+
+	assert.Equal(t, []string{"100.91.0.0/16"}, m.CurrentRouteRange(), "overlay network must be routed even when client routes are disabled")
+}
+
+func TestCurrentRouteRange_OverlayNetworksAndClientRoutes(t *testing.T) {
+	addr := wgaddr.MustParseWGAddress("100.91.96.107/16")
+	addr.IPv6 = netip.MustParseAddr("fd00:1234::1")
+	addr.IPv6Net = netip.MustParsePrefix("fd00:1234::/64")
+
+	static := &route.Route{ID: "static", NetID: "lan", Network: netip.MustParsePrefix("192.168.50.0/24"), NetworkType: route.IPv4Network}
+	dynamic := &route.Route{ID: "dynamic", NetID: "dyn", NetworkType: route.DomainNetwork}
+
+	m := &DefaultManager{
+		wgInterface:   &reconcileWGMock{addr: addr},
+		routeSelector: routeselector.NewRouteSelector(),
+		clientRoutes: route.HAMap{
+			static.GetHAUniqueID():  {static},
+			dynamic.GetHAUniqueID(): {dynamic},
+		},
+	}
+
+	assert.Equal(t, []string{"100.91.0.0/16", "192.168.50.0/24", "fd00:1234::/64"}, m.CurrentRouteRange(), "overlay networks and static client routes must be listed, dynamic routes skipped")
+}
+
+func TestCurrentRouteRange_NoInterfaceAddress(t *testing.T) {
+	m := &DefaultManager{
+		wgInterface:         &reconcileWGMock{},
+		disableClientRoutes: true,
+	}
+
+	assert.Empty(t, m.CurrentRouteRange(), "an unset interface address must not produce a route entry")
+}
+
+func TestCurrentRouteRange_IPv6WithoutIPv4Network(t *testing.T) {
+	addr := wgaddr.Address{
+		IPv6:    netip.MustParseAddr("fd00:1234::1"),
+		IPv6Net: netip.MustParsePrefix("fd00:1234::/64"),
+	}
+	m := &DefaultManager{
+		wgInterface:         &reconcileWGMock{addr: addr},
+		disableClientRoutes: true,
+	}
+
+	assert.Equal(t, []string{"fd00:1234::/64"}, m.CurrentRouteRange(), "a v6 overlay network must not depend on a v4 network being set")
+}
+
+func TestCurrentRouteRange_IPv6AddressWithoutNetwork(t *testing.T) {
+	addr := wgaddr.MustParseWGAddress("100.91.96.107/16")
+	addr.IPv6 = netip.MustParseAddr("fd00:1234::1")
+
+	m := &DefaultManager{
+		wgInterface:         &reconcileWGMock{addr: addr},
+		disableClientRoutes: true,
+	}
+
+	assert.Equal(t, []string{"100.91.0.0/16"}, m.CurrentRouteRange(), "a v6 address without a network must not produce a route entry")
+}
+
+func TestCurrentRouteRange_DeduplicatesPrefixes(t *testing.T) {
+	// Two HA peers serve the same prefix, and a client route announces the overlay network itself.
+	haPeerA := &route.Route{ID: "ha-a", NetID: "lan", Peer: "peer-a", Network: netip.MustParsePrefix("192.168.50.0/24"), NetworkType: route.IPv4Network}
+	haPeerB := &route.Route{ID: "ha-b", NetID: "lan", Peer: "peer-b", Network: netip.MustParsePrefix("192.168.50.0/24"), NetworkType: route.IPv4Network}
+	overlay := &route.Route{ID: "overlay", NetID: "overlay", Network: netip.MustParsePrefix("100.91.0.0/16"), NetworkType: route.IPv4Network}
+
+	m := &DefaultManager{
+		wgInterface:   &reconcileWGMock{addr: wgaddr.MustParseWGAddress("100.91.96.107/16")},
+		routeSelector: routeselector.NewRouteSelector(),
+		clientRoutes: route.HAMap{
+			haPeerA.GetHAUniqueID(): {haPeerA, haPeerB},
+			overlay.GetHAUniqueID(): {overlay},
+		},
+	}
+
+	assert.Equal(t, []string{"100.91.0.0/16", "192.168.50.0/24"}, m.CurrentRouteRange(), "every prefix must be listed once regardless of how many routes carry it")
+}
diff --git a/client/internal/routemanager/selection.go b/client/internal/routemanager/selection.go
new file mode 100644
index 000000000..b81d51b67
--- /dev/null
+++ b/client/internal/routemanager/selection.go
@@ -0,0 +1,145 @@
+package routemanager
+
+import (
+	"fmt"
+	"slices"
+
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	"github.com/netbirdio/netbird/route"
+)
+
+// SelectRoutes selects the routes with the given network IDs and applies the
+// new selection. V4/v6 exit-node pairs are expanded automatically. Exit nodes
+// are mutually exclusive: if the selection activates an exit node, every other
+// available exit node is deselected so two can't be active at once. With
+// appendRoute=false the previous selection is replaced instead of extended.
+// A partial failure (e.g. an unknown ID mixed with valid ones) still applies
+// the valid IDs to the routing table; the unknown ones are reported in the
+// returned error.
+func (m *DefaultManager) SelectRoutes(ids []route.NetID, appendRoute bool) error {
+	err := m.selectRoutes(ids, appendRoute)
+	// Apply regardless of err: selectRoutes already selects the valid part of a
+	// partial request, and skipping this on error would leave those routes
+	// selected in the selector but never installed in the routing table.
+	m.TriggerSelection(m.GetClientRoutes())
+	return err
+}
+
+// DeselectRoutes removes the routes with the given network IDs from the
+// selection and applies the change. V4/v6 exit-node pairs are expanded
+// automatically. A partial failure (e.g. an unknown ID mixed with valid ones)
+// still applies the valid IDs to the routing table; the unknown ones are
+// reported in the returned error.
+func (m *DefaultManager) DeselectRoutes(ids []route.NetID) error {
+	err := m.deselectRoutes(ids)
+	// Apply regardless of err: deselectRoutes already deselects the valid part
+	// of a partial request, and skipping this on error would leave those routes
+	// installed in the routing table despite being marked deselected.
+	m.TriggerSelection(m.GetClientRoutes())
+	return err
+}
+
+func (m *DefaultManager) deselectRoutes(ids []route.NetID) error {
+	routesMap := m.GetClientRoutesWithNetID()
+	routes := route.ExpandV6ExitPairs(slices.Clone(ids), routesMap)
+
+	log.Debugf("deselecting routes with ids: %v", routes)
+
+	if err := m.routeSelector.DeselectRoutes(routes, maps.Keys(routesMap)); err != nil {
+		return fmt.Errorf("deselect routes: %w", err)
+	}
+
+	return nil
+}
+
+// SelectAllRoutes selects every available route and applies the selection.
+// Exit nodes stay mutually exclusive: at most one remains active.
+func (m *DefaultManager) SelectAllRoutes() {
+	m.selectAllRoutes()
+	m.TriggerSelection(m.GetClientRoutes())
+}
+
+func (m *DefaultManager) selectAllRoutes() {
+	m.routeSelector.SelectAllRoutes()
+
+	// Select-all wipes every explicit selection, so exit nodes fall back to
+	// management's auto-apply flags — which may mark several at once.
+	// Reconcile immediately so at most one exit node stays active instead of
+	// waiting for the next network map to enforce it.
+	m.mux.Lock()
+	defer m.mux.Unlock()
+	m.updateRouteSelectorFromManagement(m.clientRoutes)
+}
+
+// DeselectAllRoutes deselects every route and applies the change.
+func (m *DefaultManager) DeselectAllRoutes() {
+	m.routeSelector.DeselectAllRoutes()
+	m.TriggerSelection(m.GetClientRoutes())
+}
+
+func (m *DefaultManager) selectRoutes(ids []route.NetID, appendRoute bool) error {
+	routesMap := m.GetClientRoutesWithNetID()
+	routes := route.ExpandV6ExitPairs(slices.Clone(ids), routesMap)
+	allIDs := maps.Keys(routesMap)
+
+	log.Debugf("selecting routes with ids: %v", routes)
+
+	// A partial failure (e.g. an unknown ID in the request) still selects the
+	// valid routes, so exclusivity below must run regardless of the error.
+	var merr *multierror.Error
+	if err := m.routeSelector.SelectRoutes(routes, appendRoute, allIDs); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("select routes: %w", err))
+	}
+
+	// Exit nodes are mutually exclusive: if this selection activates an
+	// exit node, deselect every other available exit node so two can't be
+	// selected at once. Non-exit route selections are left untouched.
+	if requestActivatesExitNode(routes, routesMap) {
+		if others := otherExitNodeIDs(routesMap, routes); len(others) > 0 {
+			if err := m.routeSelector.DeselectRoutes(others, allIDs); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("deselect sibling exit nodes: %w", err))
+			}
+		}
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func isExitNodeRoutes(routes []*route.Route) bool {
+	return len(routes) > 0 && (route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network))
+}
+
+// requestActivatesExitNode reports whether any requested NetID maps to an exit
+// node (default route) in the current route table.
+func requestActivatesExitNode(requested []route.NetID, routesMap map[route.NetID][]*route.Route) bool {
+	for _, id := range requested {
+		if isExitNodeRoutes(routesMap[id]) {
+			return true
+		}
+	}
+	return false
+}
+
+// otherExitNodeIDs returns every available exit-node NetID that is not in the
+// requested set — the siblings to deselect so a single exit node stays active.
+func otherExitNodeIDs(routesMap map[route.NetID][]*route.Route, requested []route.NetID) []route.NetID {
+	keep := make(map[route.NetID]struct{}, len(requested))
+	for _, id := range requested {
+		keep[id] = struct{}{}
+	}
+	var others []route.NetID
+	for id, routes := range routesMap {
+		if !isExitNodeRoutes(routes) {
+			continue
+		}
+		if _, ok := keep[id]; ok {
+			continue
+		}
+		others = append(others, id)
+	}
+	return others
+}
diff --git a/client/internal/routemanager/selection_test.go b/client/internal/routemanager/selection_test.go
new file mode 100644
index 000000000..4ef9ddb88
--- /dev/null
+++ b/client/internal/routemanager/selection_test.go
@@ -0,0 +1,203 @@
+package routemanager
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/exp/maps"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/routemanager/client"
+	"github.com/netbirdio/netbird/client/internal/routemanager/notifier"
+	"github.com/netbirdio/netbird/client/internal/routeselector"
+	"github.com/netbirdio/netbird/route"
+)
+
+func v6ExitRoute(netID, peer string) *route.Route {
+	return &route.Route{
+		NetID:   route.NetID(netID),
+		Network: netip.MustParsePrefix("::/0"),
+		Peer:    peer,
+	}
+}
+
+func newSelectionTestManager() *DefaultManager {
+	return &DefaultManager{
+		routeSelector: routeselector.NewRouteSelector(),
+		clientRoutes: route.HAMap{
+			"exitA|0.0.0.0/0":    {exitRoute("exitA", "p1", true)},
+			"exitA-v6|::/0":      {v6ExitRoute("exitA-v6", "p1")},
+			"exitB|0.0.0.0/0":    {exitRoute("exitB", "p2", true)},
+			"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p3"}},
+		},
+	}
+}
+
+func TestSelectRoutes_ExitNodeExclusivity(t *testing.T) {
+	m := newSelectionTestManager()
+
+	// Selecting an exit node selects its v6 pair and deselects the sibling.
+	require.NoError(t, m.selectRoutes([]route.NetID{"exitA"}, true))
+	assert.True(t, m.routeSelector.IsSelected("exitA"), "exitA should be selected")
+	assert.True(t, m.routeSelector.IsSelected("exitA-v6"), "the v6 pair follows its v4 base")
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "the sibling exit node must be deselected")
+
+	// Switching to the sibling deselects the previous exit node and its v6 pair.
+	require.NoError(t, m.selectRoutes([]route.NetID{"exitB"}, true))
+	assert.True(t, m.routeSelector.IsSelected("exitB"), "exitB should now be selected")
+	assert.False(t, m.routeSelector.IsSelected("exitA"), "the previous exit node must be deselected")
+	assert.False(t, m.routeSelector.IsSelected("exitA-v6"), "the previous exit node's v6 pair must be deselected")
+	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit route selection is untouched")
+
+	// Selecting a non-exit route leaves the active exit node alone.
+	require.NoError(t, m.selectRoutes([]route.NetID{"lan"}, true))
+	assert.True(t, m.routeSelector.IsSelected("exitB"), "selecting a non-exit route keeps the exit node")
+
+	// Deselecting the active exit node turns every exit node off.
+	require.NoError(t, m.deselectRoutes([]route.NetID{"exitB"}))
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "exitB should be deselected")
+	assert.False(t, m.routeSelector.IsSelected("exitA"), "exitA stays deselected")
+	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit route selection is untouched")
+}
+
+func TestSelectRoutes_PartialErrorStillEnforcesExclusivity(t *testing.T) {
+	// The unknown ID must be reported, but the valid exit node in the same
+	// request is still selected — so its sibling must still be deselected.
+	// Both orderings are covered: processing must continue past the invalid
+	// ID wherever it sits in the request.
+	requests := map[string][]route.NetID{
+		"invalid id first": {"missing", "exitB"},
+		"invalid id last":  {"exitB", "missing"},
+	}
+
+	for name, ids := range requests {
+		t.Run(name, func(t *testing.T) {
+			m := newSelectionTestManager()
+
+			require.NoError(t, m.selectRoutes([]route.NetID{"exitA"}, true))
+
+			err := m.selectRoutes(ids, true)
+			assert.Error(t, err, "unknown id must be reported")
+			assert.True(t, m.routeSelector.IsSelected("exitB"), "valid exit node from the request is selected")
+			assert.False(t, m.routeSelector.IsSelected("exitA"), "sibling exit node must be deselected despite the error")
+			assert.False(t, m.routeSelector.IsSelected("exitA-v6"), "sibling's v6 pair must be deselected too")
+		})
+	}
+}
+
+func TestSelectAllRoutes_KeepsSingleExitNode(t *testing.T) {
+	// Both exit nodes are marked for auto-apply by management
+	// (SkipAutoApply=false), the state where select-all could turn on two at
+	// once without the immediate reconciliation.
+	m := &DefaultManager{
+		routeSelector: routeselector.NewRouteSelector(),
+		clientRoutes: route.HAMap{
+			"exitA|0.0.0.0/0":    {exitRoute("exitA", "p1", false)},
+			"exitB|0.0.0.0/0":    {exitRoute("exitB", "p2", false)},
+			"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p3"}},
+		},
+	}
+
+	require.NoError(t, m.selectRoutes([]route.NetID{"exitB"}, true))
+
+	m.selectAllRoutes()
+
+	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit routes are all selected")
+	assert.True(t, m.routeSelector.IsSelected("exitA"), "the deterministic management pick stays active")
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "select-all must not leave a second exit node active")
+}
+
+func TestSelectRoutes_UnknownRoute(t *testing.T) {
+	m := newSelectionTestManager()
+
+	assert.Error(t, m.selectRoutes([]route.NetID{"missing"}, true), "selecting an unavailable route must fail")
+	assert.Error(t, m.deselectRoutes([]route.NetID{"missing"}), "deselecting an unavailable route must fail")
+}
+
+// newPartialFailureTestManager exercises the real install/remove path without
+// touching the system: the noop refcounter absorbs the route changes, and every
+// route already has a watcher, so none is started.
+func newPartialFailureTestManager() *DefaultManager {
+	ctx := context.Background()
+
+	m := &DefaultManager{
+		ctx: ctx,
+		clientRoutes: route.HAMap{
+			"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p1"}},
+			"other|10.1.2.0/24":  {{NetID: "other", Network: netip.MustParsePrefix("10.1.2.0/24"), Peer: "p2"}},
+		},
+		routeSelector:  routeselector.NewRouteSelector(),
+		notifier:       notifier.NewNotifier(),
+		statusRecorder: peer.NewRecorder("https://mgm"),
+		activeRoutes:   make(map[route.HAUniqueID]client.RouteHandler),
+		clientNetworks: map[route.HAUniqueID]*client.Watcher{
+			"lan|192.168.1.0/24": client.NewWatcher(client.WatcherConfig{Context: ctx}),
+			"other|10.1.2.0/24":  client.NewWatcher(client.WatcherConfig{Context: ctx}),
+		},
+	}
+	m.setupRefCounters(true)
+	return m
+}
+
+// Regression for the reported symptom: a partial failure returned before
+// TriggerSelection ran, so the valid route was marked selected while never
+// reaching the routing table (activeRoutes/ip route).
+func TestSelectRoutes_PartialFailureStillInstallsValidRoute(t *testing.T) {
+	m := newPartialFailureTestManager()
+
+	err := m.SelectRoutes([]route.NetID{"missing", "lan"}, false)
+
+	assert.Error(t, err, "the unknown id must still be reported")
+	assert.Contains(t, m.activeRoutes, route.HAUniqueID("lan|192.168.1.0/24"), "the valid route must be installed despite the error")
+	assert.NotContains(t, m.activeRoutes, route.HAUniqueID("other|10.1.2.0/24"), "the deselected route must not be installed")
+}
+
+// Mirror of the case above: a partial failure must remove the valid route from
+// the routing table, not just mark it deselected in the selector.
+func TestDeselectRoutes_PartialFailureStillRemovesValidRoute(t *testing.T) {
+	m := newPartialFailureTestManager()
+
+	require.NoError(t, m.SelectRoutes([]route.NetID{"lan", "other"}, false))
+	require.Contains(t, m.activeRoutes, route.HAUniqueID("lan|192.168.1.0/24"))
+	require.Contains(t, m.activeRoutes, route.HAUniqueID("other|10.1.2.0/24"))
+
+	err := m.DeselectRoutes([]route.NetID{"missing", "other"})
+
+	assert.Error(t, err, "the unknown id must still be reported")
+	assert.NotContains(t, m.activeRoutes, route.HAUniqueID("other|10.1.2.0/24"), "the deselected route must be removed")
+	assert.Contains(t, m.activeRoutes, route.HAUniqueID("lan|192.168.1.0/24"), "the untouched route stays installed")
+}
+
+// The selection now runs on every request, including one where no ID is known
+// and the selector stays untouched. Nothing may be torn down or reinstalled on
+// that path.
+func TestSelectRoutes_TotalFailureLeavesInstalledRoutesAlone(t *testing.T) {
+	m := newPartialFailureTestManager()
+
+	require.NoError(t, m.SelectRoutes([]route.NetID{"lan", "other"}, false))
+	installed := maps.Keys(m.activeRoutes)
+
+	err := m.SelectRoutes([]route.NetID{"missing"}, false)
+
+	assert.Error(t, err, "the unknown id must still be reported")
+	assert.ElementsMatch(t, installed, maps.Keys(m.activeRoutes), "a fully invalid request must not disturb the routing table")
+}
+
+func TestExitNodeSelectionHelpers(t *testing.T) {
+	routesMap := map[route.NetID][]*route.Route{
+		"exitA": {{Network: netip.MustParsePrefix("0.0.0.0/0")}},
+		"exitB": {{Network: netip.MustParsePrefix("::/0")}},
+		"lan":   {{Network: netip.MustParsePrefix("192.168.0.0/16")}},
+	}
+
+	assert.True(t, requestActivatesExitNode([]route.NetID{"exitA"}, routesMap), "v4 default route is an exit node")
+	assert.True(t, requestActivatesExitNode([]route.NetID{"exitB"}, routesMap), "v6 default route is an exit node")
+	assert.False(t, requestActivatesExitNode([]route.NetID{"lan"}, routesMap), "lan route is not an exit node")
+	assert.False(t, requestActivatesExitNode([]route.NetID{"missing"}, routesMap), "unknown id is not an exit node")
+
+	others := otherExitNodeIDs(routesMap, []route.NetID{"exitB"})
+	assert.ElementsMatch(t, []route.NetID{"exitA"}, others, "only the other exit node is a sibling; the lan route is ignored")
+}
diff --git a/client/internal/routemanager/server/server.go b/client/internal/routemanager/server/server.go
index f569c0cac..38d7f0db4 100644
--- a/client/internal/routemanager/server/server.go
+++ b/client/internal/routemanager/server/server.go
@@ -135,6 +135,14 @@ func (r *Router) CleanUp() {
 		}
 	}
 
+	// Give back the routing reference taken in UpdateRoutes, after the routes
+	// are gone as above. Without this the sysctls enabling it changed (IPv6
+	// forwarding and the accept_ra values that keep RA handling alive next to
+	// it) stay applied once the client stops.
+	if err := r.firewall.DisableRouting(); err != nil {
+		log.Errorf("Failed to disable routing: %v", err)
+	}
+
 	r.statusRecorder.CleanLocalPeerStateRoutes()
 }
 
diff --git a/client/internal/routemanager/server/server_test.go b/client/internal/routemanager/server/server_test.go
new file mode 100644
index 000000000..1b42115e2
--- /dev/null
+++ b/client/internal/routemanager/server/server_test.go
@@ -0,0 +1,66 @@
+package server
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/route"
+)
+
+// routingFirewall records the routing lifecycle calls the router makes. The
+// embedded interface covers the methods this test never reaches.
+type routingFirewall struct {
+	firewall.Manager
+
+	removed  []firewall.RouterPair
+	enabled  int
+	disabled int
+}
+
+func (f *routingFirewall) RemoveNatRule(pair firewall.RouterPair) error {
+	f.removed = append(f.removed, pair)
+	return nil
+}
+
+func (f *routingFirewall) EnableRouting() error {
+	f.enabled++
+	return nil
+}
+
+func (f *routingFirewall) DisableRouting() error {
+	f.disabled++
+	return nil
+}
+
+// TestRouterCleanUpReleasesRouting covers the shutdown path: the router holds a
+// routing reference for as long as it serves routes, and CleanUp has to give it
+// back. Without that the sysctls the reference enabled (IPv6 forwarding and the
+// accept_ra values that keep RA handling working alongside it) stay applied
+// after the client stops, leaving the host configured as a router.
+func TestRouterCleanUpReleasesRouting(t *testing.T) {
+	fw := &routingFirewall{}
+	r := &Router{
+		ctx:            context.Background(),
+		firewall:       fw,
+		statusRecorder: peer.NewRecorder("https://mgm"),
+		routes: map[route.ID]*route.Route{
+			"route-1": {
+				ID:          "route-1",
+				Network:     netip.MustParsePrefix("192.168.55.0/24"),
+				NetworkType: route.IPv4Network,
+				Masquerade:  true,
+			},
+		},
+	}
+
+	r.CleanUp()
+
+	require.Len(t, fw.removed, 1, "the route's NAT rule must be removed")
+	assert.Equal(t, 1, fw.disabled, "CleanUp must release the routing reference")
+}
diff --git a/client/internal/routemanager/static/route.go b/client/internal/routemanager/static/route.go
index d480fdf00..8ba03d090 100644
--- a/client/internal/routemanager/static/route.go
+++ b/client/internal/routemanager/static/route.go
@@ -15,6 +15,11 @@ type Route struct {
 	route                *route.Route
 	routeRefCounter      *refcounter.RouteRefCounter
 	allowedIPsRefcounter *refcounter.AllowedIPsRefCounter
+	// currentPeerKey is the routing peer this watcher currently has the prefix installed on
+	// (the HA winner elected by the watcher). It can differ from route.Peer and change on
+	// failover, so it is recorded on AddAllowedIPs and used on RemoveAllowedIPs to decrement
+	// the exact peer that was incremented.
+	currentPeerKey string
 }
 
 func NewRoute(params common.HandlerParams) *Route {
@@ -52,12 +57,15 @@ func (r *Route) AddAllowedIPs(peerKey string) error {
 			ref.Out,
 		)
 	}
+	r.currentPeerKey = peerKey
 	return nil
 }
 
 func (r *Route) RemoveAllowedIPs() error {
-	if _, err := r.allowedIPsRefcounter.Decrement(r.route.Network); err != nil {
-		return err
+	var err error
+	if _, decErr := r.allowedIPsRefcounter.Decrement(r.route.Network, r.currentPeerKey); decErr != nil {
+		err = fmt.Errorf("remove allowed IP %s: %w", r.route.Network, decErr)
 	}
-	return nil
+	r.currentPeerKey = ""
+	return err
 }
diff --git a/client/internal/routemanager/sysctl/sysctl_linux.go b/client/internal/routemanager/sysctl/sysctl_linux.go
index f96a57f37..bb131c691 100644
--- a/client/internal/routemanager/sysctl/sysctl_linux.go
+++ b/client/internal/routemanager/sysctl/sysctl_linux.go
@@ -20,6 +20,8 @@ const (
 	rpFilterPath          = "net.ipv4.conf.all.rp_filter"
 	rpFilterInterfacePath = "net.ipv4.conf.%s.rp_filter"
 	srcValidMarkPath      = "net.ipv4.conf.all.src_valid_mark"
+	percentEscape         = "%25"
+	dotEscape             = "%2E"
 )
 
 type iface interface {
@@ -56,7 +58,7 @@ func Setup(wgIface iface) (map[string]int, error) {
 			continue
 		}
 
-		i := fmt.Sprintf(rpFilterInterfacePath, intf.Name)
+		i := fmt.Sprintf(rpFilterInterfacePath, EscapeInterfaceName(intf.Name))
 		oldVal, err := Set(i, 2, true)
 		if err != nil {
 			result = multierror.Append(result, err)
@@ -68,9 +70,20 @@ func Setup(wgIface iface) (map[string]int, error) {
 	return keys, nberrors.FormatErrorOrNil(result)
 }
 
+// EscapeInterfaceName escapes '%' and '.' in an interface name (e.g. VLANs
+// like eth0.100) so the name survives the dot-to-slash conversion in Set.
+func EscapeInterfaceName(name string) string {
+	safe := strings.ReplaceAll(name, "%", percentEscape)
+	return strings.ReplaceAll(safe, ".", dotEscape)
+}
+
 // Set sets a sysctl configuration, if onlyIfOne is true it will only set the new value if it's set to 1
 func Set(key string, desiredValue int, onlyIfOne bool) (int, error) {
-	path := fmt.Sprintf("/proc/sys/%s", strings.ReplaceAll(key, ".", "/"))
+	path := strings.ReplaceAll(key, ".", "/")
+	// Unescape interface dots and percent signs
+	path = strings.ReplaceAll(path, dotEscape, ".")
+	path = strings.ReplaceAll(path, percentEscape, "%")
+	path = fmt.Sprintf("/proc/sys/%s", path)
 	currentValue, err := os.ReadFile(path)
 	if err != nil {
 		return -1, fmt.Errorf("read sysctl %s: %w", key, err)
diff --git a/client/internal/routemanager/systemops/routeselection_windows_test.go b/client/internal/routemanager/systemops/routeselection_windows_test.go
new file mode 100644
index 000000000..108338dd9
--- /dev/null
+++ b/client/internal/routemanager/systemops/routeselection_windows_test.go
@@ -0,0 +1,82 @@
+//go:build windows
+
+package systemops
+
+import (
+	"math"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSortRouteCandidates(t *testing.T) {
+	tests := []struct {
+		name       string
+		candidates []candidateRoute
+		wantOrder  []uint32
+	}{
+		{
+			name: "longest prefix wins over metrics",
+			candidates: []candidateRoute{
+				{interfaceIndex: 1, prefixLength: 0, routeMetric: 0, interfaceMetric: 5},
+				{interfaceIndex: 2, prefixLength: 24, routeMetric: 100, interfaceMetric: 50},
+			},
+			wantOrder: []uint32{2, 1},
+		},
+		{
+			// Windows ranks equal-length prefixes by route metric + interface metric,
+			// so a higher route metric on a low metric interface can still win.
+			name: "combined metric beats route metric alone",
+			candidates: []candidateRoute{
+				{interfaceIndex: 8, prefixLength: 0, routeMetric: 0, interfaceMetric: 100},
+				{interfaceIndex: 5, prefixLength: 0, routeMetric: 10, interfaceMetric: 5},
+			},
+			wantOrder: []uint32{5, 8},
+		},
+		{
+			name: "lower combined metric wins",
+			candidates: []candidateRoute{
+				{interfaceIndex: 5, prefixLength: 0, routeMetric: 300, interfaceMetric: 5},
+				{interfaceIndex: 8, prefixLength: 0, routeMetric: 0, interfaceMetric: 100},
+			},
+			wantOrder: []uint32{8, 5},
+		},
+		{
+			name: "equal combined metric falls back to route metric",
+			candidates: []candidateRoute{
+				{interfaceIndex: 1, prefixLength: 0, routeMetric: 20, interfaceMetric: 10},
+				{interfaceIndex: 2, prefixLength: 0, routeMetric: 5, interfaceMetric: 25},
+			},
+			wantOrder: []uint32{2, 1},
+		},
+		{
+			// The metrics are uint32 on the Windows side, so the sum must not wrap.
+			name: "combined metric beyond the uint32 range",
+			candidates: []candidateRoute{
+				{interfaceIndex: 1, prefixLength: 0, routeMetric: math.MaxUint32, interfaceMetric: 5},
+				{interfaceIndex: 2, prefixLength: 0, routeMetric: math.MaxUint32 - 10, interfaceMetric: 5},
+			},
+			wantOrder: []uint32{2, 1},
+		},
+		{
+			name: "unknown interface metric ranks on route metric only",
+			candidates: []candidateRoute{
+				{interfaceIndex: 1, prefixLength: 0, routeMetric: 30, interfaceMetric: -1},
+				{interfaceIndex: 2, prefixLength: 0, routeMetric: 5, interfaceMetric: 10},
+			},
+			wantOrder: []uint32{2, 1},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sortRouteCandidates(tt.candidates)
+
+			got := make([]uint32, 0, len(tt.candidates))
+			for _, c := range tt.candidates {
+				got = append(got, c.interfaceIndex)
+			}
+			assert.Equal(t, tt.wantOrder, got)
+		})
+	}
+}
diff --git a/client/internal/routemanager/systemops/systemops_android.go b/client/internal/routemanager/systemops/systemops_android.go
index 7cb8dae93..97b4ed8ec 100644
--- a/client/internal/routemanager/systemops/systemops_android.go
+++ b/client/internal/routemanager/systemops/systemops_android.go
@@ -32,8 +32,17 @@ func (r *SysOps) removeFromRouteTable(netip.Prefix, Nexthop) error {
 	return nil
 }
 
-func EnableIPForwarding() error {
-	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
+func EnableV4IPForwarding() error {
+	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
+	return nil
+}
+
+func EnableV6IPForwarding(string) (map[string]int, error) {
+	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
+	return map[string]int{}, nil
+}
+
+func DisableV6IPForwarding(map[string]int) error {
 	return nil
 }
 
diff --git a/client/internal/routemanager/systemops/systemops_generic_test.go b/client/internal/routemanager/systemops/systemops_generic_test.go
index c4f739c30..f117ff751 100644
--- a/client/internal/routemanager/systemops/systemops_generic_test.go
+++ b/client/internal/routemanager/systemops/systemops_generic_test.go
@@ -15,6 +15,7 @@ import (
 	"syscall"
 	"testing"
 
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -436,8 +437,7 @@ func createWGInterface(t *testing.T, interfaceName, ipAddressCIDR string, listen
 	peerPrivateKey, err := wgtypes.GeneratePrivateKey()
 	require.NoError(t, err)
 
-	newNet, err := stdnet.NewNet(context.Background(), nil)
-	require.NoError(t, err)
+	newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist, nil)
 
 	opts := iface.WGIFaceOpts{
 		IFaceName:    interfaceName,
diff --git a/client/internal/routemanager/systemops/systemops_ios.go b/client/internal/routemanager/systemops/systemops_ios.go
index 99a363371..0cccd4962 100644
--- a/client/internal/routemanager/systemops/systemops_ios.go
+++ b/client/internal/routemanager/systemops/systemops_ios.go
@@ -58,8 +58,17 @@ func (r *SysOps) removeFromRouteTable(netip.Prefix, Nexthop) error {
 	return nil
 }
 
-func EnableIPForwarding() error {
-	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
+func EnableV4IPForwarding() error {
+	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
+	return nil
+}
+
+func EnableV6IPForwarding(string) (map[string]int, error) {
+	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
+	return map[string]int{}, nil
+}
+
+func DisableV6IPForwarding(map[string]int) error {
 	return nil
 }
 
diff --git a/client/internal/routemanager/systemops/systemops_linux.go b/client/internal/routemanager/systemops/systemops_linux.go
index 8c6b7d9a9..7d608d886 100644
--- a/client/internal/routemanager/systemops/systemops_linux.go
+++ b/client/internal/routemanager/systemops/systemops_linux.go
@@ -763,13 +763,10 @@ func flushRoutes(tableID, family int) error {
 	return nberrors.FormatErrorOrNil(result)
 }
 
-func EnableIPForwarding() error {
+func EnableV4IPForwarding() error {
 	if _, err := sysctl.Set(ipv4ForwardingPath, 1, false); err != nil {
 		return err
 	}
-	if _, err := sysctl.Set(ipv6ForwardingPath, 1, false); err != nil {
-		log.Warnf("failed to enable IPv6 forwarding: %v", err)
-	}
 	return nil
 }
 
diff --git a/client/internal/routemanager/systemops/systemops_nonlinux.go b/client/internal/routemanager/systemops/systemops_nonlinux.go
index 016a62ebd..837ac0cd2 100644
--- a/client/internal/routemanager/systemops/systemops_nonlinux.go
+++ b/client/internal/routemanager/systemops/systemops_nonlinux.go
@@ -43,8 +43,17 @@ func (r *SysOps) RemoveVPNRoute(prefix netip.Prefix, intf *net.Interface) error
 	return r.genericRemoveVPNRoute(prefix, intf)
 }
 
-func EnableIPForwarding() error {
-	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
+func EnableV4IPForwarding() error {
+	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
+	return nil
+}
+
+func EnableV6IPForwarding(string) (map[string]int, error) {
+	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
+	return map[string]int{}, nil
+}
+
+func DisableV6IPForwarding(map[string]int) error {
 	return nil
 }
 
diff --git a/client/internal/routemanager/systemops/systemops_windows.go b/client/internal/routemanager/systemops/systemops_windows.go
index 7bce6af80..47d556cf6 100644
--- a/client/internal/routemanager/systemops/systemops_windows.go
+++ b/client/internal/routemanager/systemops/systemops_windows.go
@@ -882,26 +882,40 @@ func getInterfaceMetric(interfaceIndex uint32, family int16) int {
 	return int(ipInterfaceRow.Metric)
 }
 
-// sortRouteCandidates sorts route candidates by priority: prefix length -> route metric -> interface metric
+// sortRouteCandidates sorts route candidates by priority: prefix length -> combined metric -> route metric.
+// Windows prefers the longest matching prefix and, among prefixes of the same length, the lowest metric, see
+// https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-tcpip-interfaces-interface-routes-route-metric
 func sortRouteCandidates(candidates []candidateRoute) {
 	sort.Slice(candidates, func(i, j int) bool {
 		if candidates[i].prefixLength != candidates[j].prefixLength {
 			return candidates[i].prefixLength > candidates[j].prefixLength
 		}
-		if candidates[i].routeMetric != candidates[j].routeMetric {
-			return candidates[i].routeMetric < candidates[j].routeMetric
+		mi, mj := combinedMetric(candidates[i]), combinedMetric(candidates[j])
+		if mi != mj {
+			return mi < mj
 		}
-		return candidates[i].interfaceMetric < candidates[j].interfaceMetric
+		return candidates[i].routeMetric < candidates[j].routeMetric
 	})
 }
 
+// combinedMetric returns the effective metric Windows uses to rank routes with an equal prefix length:
+// the sum of the route metric and the metric of the interface the route is on, see
+// https://learn.microsoft.com/en-us/windows-server/networking/technologies/network-subsystem/net-sub-interface-metric
+// An unknown interface metric contributes nothing.
+func combinedMetric(candidate candidateRoute) uint64 {
+	if candidate.interfaceMetric < 0 {
+		return uint64(candidate.routeMetric)
+	}
+	return uint64(candidate.routeMetric) + uint64(candidate.interfaceMetric)
+}
+
 // GetBestInterface finds the best interface for reaching a destination,
 // excluding the VPN interface to avoid routing loops.
 //
 // Route selection priority:
 // 1. Longest prefix match (most specific route)
-// 2. Lowest route metric
-// 3. Lowest interface metric
+// 2. Lowest combined metric (route metric + interface metric)
+// 3. Lowest route metric.
 func GetBestInterface(dest netip.Addr, vpnIntf string) (*net.Interface, error) {
 	var skipInterfaceIndex int
 	if vpnIntf != "" {
@@ -925,7 +939,6 @@ func GetBestInterface(dest netip.Addr, vpnIntf string) (*net.Interface, error) {
 		return nil, fmt.Errorf("no route to %s", dest)
 	}
 
-	// Sort routes: prefix length -> route metric -> interface metric
 	sortRouteCandidates(candidates)
 
 	for _, candidate := range candidates {
diff --git a/client/internal/routemanager/systemops/v6forwarding_linux.go b/client/internal/routemanager/systemops/v6forwarding_linux.go
new file mode 100644
index 000000000..c1e0d4588
--- /dev/null
+++ b/client/internal/routemanager/systemops/v6forwarding_linux.go
@@ -0,0 +1,92 @@
+//go:build !android
+
+package systemops
+
+import (
+	"fmt"
+	"net"
+	"os"
+
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	"github.com/netbirdio/netbird/client/internal/routemanager/sysctl"
+)
+
+const (
+	// 1 (default) accepts RAs only while forwarding is off; 2 keeps RA
+	// acceptance on regardless, so RA-installed host defaults survive our
+	// v6 forwarding flip.
+	acceptRAInterfacePath  = "net.ipv6.conf.%s.accept_ra"
+	acceptRADefaultPath    = "net.ipv6.conf.default.accept_ra"
+	acceptRAProcPathFormat = "/proc/sys/net/ipv6/conf/%s/accept_ra"
+)
+
+// EnableV6IPForwarding bumps accept_ra=2 on host v6 interfaces before flipping
+// forwarding=1, so RA-installed host defaults survive. Returns the prior values
+// of sysctls we actually changed; entries already at the target are omitted.
+func EnableV6IPForwarding(wgIfaceName string) (map[string]int, error) {
+	saved := map[string]int{}
+	bumpAcceptRA(saved, wgIfaceName)
+
+	oldVal, err := sysctl.Set(ipv6ForwardingPath, 1, false)
+	if err != nil {
+		return saved, err
+	}
+	if oldVal != 1 {
+		saved[ipv6ForwardingPath] = oldVal
+	}
+	return saved, nil
+}
+
+// DisableV6IPForwarding restores what EnableV6IPForwarding captured.
+func DisableV6IPForwarding(saved map[string]int) error {
+	var result *multierror.Error
+	for key, value := range saved {
+		if _, err := sysctl.Set(key, value, false); err != nil {
+			result = multierror.Append(result, fmt.Errorf("restore %s: %w", key, err))
+		}
+	}
+	return nberrors.FormatErrorOrNil(result)
+}
+
+func bumpAcceptRA(saved map[string]int, wgIfaceName string) {
+	// Also bump conf.default so interfaces created while forwarding is on
+	// (hotplug, new Wi-Fi/dock) inherit accept_ra=2 and keep accepting RAs.
+	bumpAcceptRAKey(saved, acceptRADefaultPath)
+
+	interfaces, err := net.Interfaces()
+	if err != nil {
+		log.Warnf("list interfaces for accept_ra: %v", err)
+		return
+	}
+	for _, intf := range interfaces {
+		if intf.Name == "lo" || intf.Name == wgIfaceName {
+			continue
+		}
+		bumpAcceptRAForInterface(saved, intf.Name)
+	}
+}
+
+func bumpAcceptRAForInterface(saved map[string]int, name string) {
+	// Build procfs path from name, not the dotted key: VLAN names like eth0.100.
+	if _, err := os.Stat(fmt.Sprintf(acceptRAProcPathFormat, name)); err != nil {
+		return
+	}
+	bumpAcceptRAKey(saved, fmt.Sprintf(acceptRAInterfacePath, sysctl.EscapeInterfaceName(name)))
+}
+
+func bumpAcceptRAKey(saved map[string]int, key string) {
+	// onlyIfOne=true: leave admin overrides (0, 2) alone.
+	oldVal, err := sysctl.Set(key, 2, true)
+	if err != nil {
+		log.Warnf("bump %s: %v", key, err)
+		return
+	}
+	// With onlyIfOne, a write only happened when the old value was 1; values
+	// left untouched (0, 2) must not be recorded for restore.
+	if oldVal == 1 {
+		saved[key] = oldVal
+	}
+}
diff --git a/client/internal/routemanager/systemops/v6route_linux_test.go b/client/internal/routemanager/systemops/v6route_linux_test.go
index 449d4cbd2..d8c0012d1 100644
--- a/client/internal/routemanager/systemops/v6route_linux_test.go
+++ b/client/internal/routemanager/systemops/v6route_linux_test.go
@@ -5,6 +5,7 @@ package systemops
 import (
 	"errors"
 	"net"
+	"net/netip"
 	"syscall"
 	"testing"
 
@@ -29,6 +30,7 @@ func ensureIPv6DefaultRoute(t *testing.T) {
 	}
 	if err := netlink.RouteAdd(route); err != nil {
 		if errors.Is(err, syscall.EEXIST) {
+			requireUsableIPv6Nexthop(t)
 			return
 		}
 		t.Skipf("install IPv6 fallback default route: %v", err)
@@ -38,4 +40,36 @@ func ensureIPv6DefaultRoute(t *testing.T) {
 			t.Logf("delete IPv6 fallback default route: %v", err)
 		}
 	})
+
+	requireUsableIPv6Nexthop(t)
+}
+
+// requireUsableIPv6Nexthop skips the test unless the resolved IPv6 default
+// nexthop can actually carry a route. Installing the default route succeeding
+// does not imply the kernel accepts it as a nexthop for a concrete prefix.
+func requireUsableIPv6Nexthop(t *testing.T) {
+	t.Helper()
+
+	nexthop, err := GetNextHop(netip.IPv6Unspecified())
+	if err != nil {
+		t.Skipf("resolve IPv6 default nexthop: %v", err)
+	}
+
+	probe := &netlink.Route{
+		Scope:  netlink.SCOPE_UNIVERSE,
+		Table:  syscall.RT_TABLE_MAIN,
+		Family: netlink.FAMILY_V6,
+		Dst:    &net.IPNet{IP: net.ParseIP("100::64"), Mask: net.CIDRMask(128, 128)},
+	}
+	require.NoError(t, addNextHop(nexthop, probe), "build IPv6 probe route")
+
+	switch err := netlink.RouteAdd(probe); {
+	case err == nil:
+		if err := netlink.RouteDel(probe); err != nil && !errors.Is(err, syscall.ESRCH) {
+			t.Logf("delete IPv6 probe route: %v", err)
+		}
+	case errors.Is(err, syscall.EEXIST):
+	default:
+		t.Skipf("IPv6 nexthop %s unusable for route installation: %v", nexthop, err)
+	}
 }
diff --git a/client/internal/routeselector/routeselector.go b/client/internal/routeselector/routeselector.go
index 232baf746..8a64ad316 100644
--- a/client/internal/routeselector/routeselector.go
+++ b/client/internal/routeselector/routeselector.go
@@ -32,6 +32,22 @@ func (rs *RouteSelector) SelectRoutes(routes []route.NetID, appendRoute bool, al
 	rs.mu.Lock()
 	defer rs.mu.Unlock()
 
+	// Validate before mutating: a non-append selection wipes the current selection
+	// first, so a request of only unavailable routes would deselect everything and
+	// put nothing back. An empty request means deselect all, so it still goes through.
+	var err *multierror.Error
+	available := make([]route.NetID, 0, len(routes))
+	for _, r := range routes {
+		if !slices.Contains(allRoutes, r) {
+			err = multierror.Append(err, fmt.Errorf("route '%s' is not available", r))
+			continue
+		}
+		available = append(available, r)
+	}
+	if len(available) == 0 && err != nil {
+		return errors.FormatErrorOrNil(err)
+	}
+
 	if !appendRoute || rs.deselectAll {
 		if rs.deselectedRoutes == nil {
 			rs.deselectedRoutes = map[route.NetID]struct{}{}
@@ -46,14 +62,9 @@ func (rs *RouteSelector) SelectRoutes(routes []route.NetID, appendRoute bool, al
 		}
 	}
 
-	var err *multierror.Error
-	for _, route := range routes {
-		if !slices.Contains(allRoutes, route) {
-			err = multierror.Append(err, fmt.Errorf("route '%s' is not available", route))
-			continue
-		}
-		delete(rs.deselectedRoutes, route)
-		rs.selectedRoutes[route] = struct{}{}
+	for _, r := range available {
+		delete(rs.deselectedRoutes, r)
+		rs.selectedRoutes[r] = struct{}{}
 	}
 
 	rs.deselectAll = false
@@ -115,7 +126,38 @@ func (rs *RouteSelector) DeselectAllRoutes() {
 	clear(rs.selectedRoutes)
 }
 
-// IsDeselectAll reports whether the user has explicitly deselected all routes.
+// SetExclusiveExitNode atomically makes preferred the only selected exit node
+// among exitIDs: every other ID in exitIDs is deselected and preferred (when
+// non-empty) is selected, all under a single lock. Holding the lock across the
+// whole reconciliation prevents a concurrent DeselectAllRoutes from interleaving
+// between the deselect and select steps and being silently undone. A global
+// deselect-all is left untouched so the user's "all off" stays in effect;
+// non-exit routes are never referenced, so their selection is preserved.
+func (rs *RouteSelector) SetExclusiveExitNode(preferred route.NetID, exitIDs []route.NetID) {
+	rs.mu.Lock()
+	defer rs.mu.Unlock()
+
+	if rs.deselectAll {
+		return
+	}
+
+	for _, id := range exitIDs {
+		if id == preferred {
+			continue
+		}
+		rs.deselectedRoutes[id] = struct{}{}
+		delete(rs.selectedRoutes, id)
+	}
+
+	if preferred != "" {
+		delete(rs.deselectedRoutes, preferred)
+		rs.selectedRoutes[preferred] = struct{}{}
+	}
+}
+
+// IsDeselectAll reports whether the global "deselect all" flag is set, i.e. the
+// user explicitly disabled every route. Callers enforcing per-route invariants
+// (e.g. single exit node) should leave the selection untouched when it is.
 func (rs *RouteSelector) IsDeselectAll() bool {
 	rs.mu.RLock()
 	defer rs.mu.RUnlock()
diff --git a/client/internal/routeselector/routeselector_test.go b/client/internal/routeselector/routeselector_test.go
index c9d6acb4d..f26d022e9 100644
--- a/client/internal/routeselector/routeselector_test.go
+++ b/client/internal/routeselector/routeselector_test.go
@@ -859,3 +859,98 @@ func TestRouteSelector_ComplexScenarios(t *testing.T) {
 		})
 	}
 }
+
+// TestRouteSelector_EnableExitNodeKeepsOtherRoutes is a regression test for the
+// tray exit-node toggle disabling every non-exit routed network. The tray used
+// to Select an exit node with append=false, which the RouteSelector treats as
+// "drop the whole current selection" (default-on semantics) — so enabling an
+// exit node also turned off every LAN/route the user had on. The fix sends
+// append=true and lets the daemon's SelectNetworks handler deselect only the
+// sibling exit nodes. This test models that handler sequence against the
+// selector: SelectRoutes(exit, append=true) followed by DeselectRoutes(other
+// exit nodes) must leave non-exit routes untouched.
+func TestRouteSelector_EnableExitNodeKeepsOtherRoutes(t *testing.T) {
+	rs := routeselector.NewRouteSelector()
+	all := []route.NetID{"exitA", "exitB", "lan1", "lan2"}
+
+	// User has two LAN routes on (default-on: nothing deselected => all selected).
+	require.True(t, rs.IsSelected("lan1"))
+	require.True(t, rs.IsSelected("lan2"))
+
+	// Tray enables exitA: SelectNetworks handler does SelectRoutes(append=true)
+	// then deselects sibling exit nodes (exitB), never the LAN routes.
+	require.NoError(t, rs.SelectRoutes([]route.NetID{"exitA"}, true, all))
+	require.NoError(t, rs.DeselectRoutes([]route.NetID{"exitB"}, all))
+
+	assert.True(t, rs.IsSelected("exitA"), "selected exit node stays on")
+	assert.False(t, rs.IsSelected("exitB"), "sibling exit node is deselected")
+	assert.True(t, rs.IsSelected("lan1"), "non-exit route must stay selected")
+	assert.True(t, rs.IsSelected("lan2"), "non-exit route must stay selected")
+}
+
+// A non-append selection clears the current selection before applying the requested
+// one, so an all-unavailable request used to leave nothing selected while returning
+// an error. Requests with at least one available route are unaffected.
+func TestRouteSelector_SelectRoutes_AllUnavailableKeepsSelection(t *testing.T) {
+	allRoutes := []route.NetID{"route1", "route2", "route3"}
+
+	rs := routeselector.NewRouteSelector()
+	require.NoError(t, rs.SelectRoutes([]route.NetID{"route1"}, false, allRoutes))
+
+	err := rs.SelectRoutes([]route.NetID{"Route1", "route4"}, false, allRoutes)
+
+	assert.Error(t, err, "an unavailable route ID must still be reported")
+	assert.True(t, rs.IsSelected("route1"), "the previous selection must survive a fully invalid request")
+	for _, id := range []route.NetID{"route2", "route3"} {
+		assert.False(t, rs.IsSelected(id), "no other route may become selected")
+	}
+}
+
+// Boundary of the check above: an empty request is the caller deselecting everything,
+// not a failed lookup, so it must keep working.
+func TestRouteSelector_SelectRoutes_EmptyRequestStillDeselectsAll(t *testing.T) {
+	allRoutes := []route.NetID{"route1", "route2", "route3"}
+
+	rs := routeselector.NewRouteSelector()
+	require.NoError(t, rs.SelectRoutes([]route.NetID{"route1"}, false, allRoutes))
+
+	require.NoError(t, rs.SelectRoutes(nil, false, allRoutes))
+
+	for _, id := range allRoutes {
+		assert.False(t, rs.IsSelected(id), "an empty selection request must deselect everything")
+	}
+}
+
+// Mobile clients always call SelectRoutes with append=true. On that path an
+// all-unavailable request was never destructive to begin with (append skips the
+// wipe regardless of the guard above), but the behavior has no coverage yet.
+func TestRouteSelector_SelectRoutes_AppendAllUnavailableKeepsSelection(t *testing.T) {
+	allRoutes := []route.NetID{"route1", "route2", "route3"}
+
+	rs := routeselector.NewRouteSelector()
+	require.NoError(t, rs.SelectRoutes([]route.NetID{"route1"}, false, allRoutes))
+
+	err := rs.SelectRoutes([]route.NetID{"missing"}, true, allRoutes)
+
+	assert.Error(t, err, "an unavailable route ID must still be reported")
+	assert.True(t, rs.IsSelected("route1"), "the previous selection must survive a fully invalid request")
+	for _, id := range []route.NetID{"route2", "route3"} {
+		assert.False(t, rs.IsSelected(id), "no other route may become selected")
+	}
+}
+
+// The early return for an all-unavailable request must not clear deselectAll,
+// or a typo'd network ID would silently drop the "nothing selected, including
+// future networks" policy.
+func TestRouteSelector_SelectRoutes_AllUnavailableAfterDeselectAllKeepsPolicy(t *testing.T) {
+	allRoutes := []route.NetID{"route1", "route2"}
+
+	rs := routeselector.NewRouteSelector()
+	rs.DeselectAllRoutes()
+
+	err := rs.SelectRoutes([]route.NetID{"missing"}, false, allRoutes)
+
+	assert.Error(t, err, "an unavailable route ID must still be reported")
+	assert.True(t, rs.IsDeselectAll(), "deselect-all policy must survive a fully invalid request")
+	assert.False(t, rs.IsSelected("route3"), "deselect-all must still cover networks not present in allRoutes yet")
+}
diff --git a/client/internal/sleep/service.go b/client/internal/sleep/service.go
index 196a33f52..93691c4c7 100644
--- a/client/internal/sleep/service.go
+++ b/client/internal/sleep/service.go
@@ -18,8 +18,8 @@ type Service struct {
 }
 
 func New() (*Service, error) {
-	d, err := NewDetector()
-	if err != nil {
+	d, err := NewDetector() //nolint:staticcheck
+	if err != nil {         //nolint:staticcheck // always errors on platforms without a sleep detector
 		return nil, err
 	}
 
diff --git a/client/internal/state.go b/client/internal/state.go
index 041cb73f8..0adfa26e4 100644
--- a/client/internal/state.go
+++ b/client/internal/state.go
@@ -33,17 +33,34 @@ func CtxGetState(ctx context.Context) *contextState {
 }
 
 type contextState struct {
-	err    error
-	status StatusType
-	mutex  sync.Mutex
+	err      error
+	status   StatusType
+	mutex    sync.Mutex
+	onChange func()
+}
+
+// SetOnChange installs a callback fired after every successful Set. Used by
+// the daemon to wire the status recorder's notifyStateChange so any
+// state.Set in the connect/login paths pushes a fresh snapshot to
+// SubscribeStatus subscribers without each callsite having to opt in.
+// The callback runs outside the contextState mutex to avoid a lock-order
+// dependency with the recorder's stateChangeMux.
+func (c *contextState) SetOnChange(fn func()) {
+	c.mutex.Lock()
+	c.onChange = fn
+	c.mutex.Unlock()
 }
 
 func (c *contextState) Set(update StatusType) {
 	c.mutex.Lock()
-	defer c.mutex.Unlock()
-
 	c.status = update
 	c.err = nil
+	cb := c.onChange
+	c.mutex.Unlock()
+
+	if cb != nil {
+		cb()
+	}
 }
 
 func (c *contextState) Status() (StatusType, error) {
@@ -57,6 +74,17 @@ func (c *contextState) Status() (StatusType, error) {
 	return c.status, nil
 }
 
+// CurrentStatus returns the last status set via Set, ignoring any wrapped
+// error. Use when the status is needed for reporting purposes (e.g. the
+// status snapshot stream) and a transient wrapped error from a retry loop
+// shouldn't blank out the underlying status.
+func (c *contextState) CurrentStatus() StatusType {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	return c.status
+}
+
 func (c *contextState) Wrap(err error) error {
 	c.mutex.Lock()
 	defer c.mutex.Unlock()
diff --git a/client/internal/statemanager/manager.go b/client/internal/statemanager/manager.go
index 566905985..413c910f0 100644
--- a/client/internal/statemanager/manager.go
+++ b/client/internal/statemanager/manager.go
@@ -3,10 +3,7 @@ package statemanager
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
-	"io/fs"
-	"os"
 	"reflect"
 	"sync"
 	"time"
@@ -16,7 +13,6 @@ import (
 	"golang.org/x/exp/maps"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/util"
 )
 
 const (
@@ -55,7 +51,7 @@ type Manager struct {
 	cancel context.CancelFunc
 	done   chan struct{}
 
-	filePath string
+	store store
 	// holds the states that are registered with the manager and that are to be persisted
 	states map[string]State
 	// holds the state names that have been updated and need to be persisted with the next save
@@ -64,10 +60,20 @@ type Manager struct {
 	stateTypes map[string]reflect.Type
 }
 
-// New creates a new Manager instance
+// New creates a Manager that persists its states to filePath.
 func New(filePath string) *Manager {
+	return newManager(&fileStore{path: filePath})
+}
+
+// NewInMemory creates a Manager that persists nothing, for a client that
+// changes nothing on the host and so has no state a later run must restore.
+func NewInMemory() *Manager {
+	return newManager(memoryStore{})
+}
+
+func newManager(s store) *Manager {
 	return &Manager{
-		filePath:   filePath,
+		store:      s,
 		states:     make(map[string]State),
 		dirty:      make(map[string]struct{}),
 		stateTypes: make(map[string]reflect.Type),
@@ -273,7 +279,7 @@ func (m *Manager) PersistState(ctx context.Context) error {
 	done := make(chan error, 1)
 	start := time.Now()
 	go func() {
-		done <- util.WriteBytesWithRestrictedPermission(ctx, m.filePath, bs)
+		done <- m.store.save(ctx, bs)
 	}()
 
 	select {
@@ -292,40 +298,9 @@ func (m *Manager) PersistState(ctx context.Context) error {
 	return nil
 }
 
-// loadStateFile reads and unmarshals the state file into a map of raw JSON messages
+// loadStateFile returns the states an earlier run persisted.
 func (m *Manager) loadStateFile(deleteCorrupt bool) (map[string]json.RawMessage, error) {
-	data, err := os.ReadFile(m.filePath)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			log.Debugf("state file %s does not exist", m.filePath)
-			return nil, nil // nolint:nilnil
-		}
-		return nil, fmt.Errorf("read state file: %w", err)
-	}
-
-	var rawStates map[string]json.RawMessage
-	if err := json.Unmarshal(data, &rawStates); err != nil {
-		m.handleCorruptedState(deleteCorrupt)
-		return nil, fmt.Errorf("unmarshal states: %w", err)
-	}
-
-	return rawStates, nil
-}
-
-// handleCorruptedState creates a backup of a corrupted state file by moving it
-func (m *Manager) handleCorruptedState(deleteCorrupt bool) {
-	if !deleteCorrupt {
-		return
-	}
-	log.Warn("State file appears to be corrupted, attempting to back it up")
-
-	backupPath := fmt.Sprintf("%s.corrupted.%d", m.filePath, time.Now().UnixNano())
-	if err := os.Rename(m.filePath, backupPath); err != nil {
-		log.Errorf("Failed to backup corrupted state file: %v", err)
-		return
-	}
-
-	log.Infof("Created backup of corrupted state file at: %s", backupPath)
+	return m.store.load(deleteCorrupt)
 }
 
 // loadSingleRawState unmarshals a raw state into a concrete state object
diff --git a/client/internal/statemanager/manager_test.go b/client/internal/statemanager/manager_test.go
new file mode 100644
index 000000000..52b9ac585
--- /dev/null
+++ b/client/internal/statemanager/manager_test.go
@@ -0,0 +1,65 @@
+package statemanager
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type testState struct {
+	Value string `json:"value"`
+}
+
+func (s *testState) Name() string { return "test_state" }
+
+func TestInMemoryManagerNeverTouchesDisk(t *testing.T) {
+	// Run from an empty directory, so a write to a relative or empty path
+	// would leave a file behind here.
+	dir := t.TempDir()
+	t.Chdir(dir)
+
+	m := NewInMemory()
+	m.RegisterState(&testState{})
+	require.NoError(t, m.UpdateState(&testState{Value: "kept"}))
+	require.NoError(t, m.PersistState(context.Background()), "persisting in memory must succeed")
+
+	entries, err := os.ReadDir(dir)
+	require.NoError(t, err)
+	assert.Empty(t, entries, "an in-memory manager must not write a state file")
+
+	assert.Equal(t, &testState{Value: "kept"}, m.GetState(&testState{}), "the state must still be held in memory")
+	assert.NoError(t, m.LoadState(&testState{}), "loading with nothing on disk must succeed")
+
+	names, err := m.GetSavedStateNames()
+	require.NoError(t, err)
+	assert.Empty(t, names, "an in-memory manager has no saved states")
+}
+
+// An empty path is a misconfiguration rather than a request for memory: the
+// in-memory manager has its own constructor, so a path that resolved to
+// nothing must surface instead of silently discarding every write.
+func TestManagerWithoutAPathFailsToPersist(t *testing.T) {
+	m := New("")
+	m.RegisterState(&testState{})
+	require.NoError(t, m.UpdateState(&testState{Value: "kept"}))
+
+	assert.Error(t, m.PersistState(context.Background()),
+		"an empty path must report that it cannot persist, not quietly drop the state")
+}
+
+func TestManagerPersistsToItsFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
+
+	m := New(path)
+	m.RegisterState(&testState{})
+	require.NoError(t, m.UpdateState(&testState{Value: "kept"}))
+	require.NoError(t, m.PersistState(context.Background()))
+
+	names, err := New(path).GetSavedStateNames()
+	require.NoError(t, err)
+	assert.Equal(t, []string{"test_state"}, names, "a manager with a path must write its state there")
+}
diff --git a/client/internal/statemanager/store.go b/client/internal/statemanager/store.go
new file mode 100644
index 000000000..fffa38396
--- /dev/null
+++ b/client/internal/statemanager/store.go
@@ -0,0 +1,91 @@
+package statemanager
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/util"
+)
+
+// store is where a Manager keeps its states between runs.
+type store interface {
+	// load returns the states persisted by an earlier run, or an empty map
+	// when there are none. deleteCorrupt asks the store to move a state it
+	// cannot parse out of the way.
+	load(deleteCorrupt bool) (map[string]json.RawMessage, error)
+	// save replaces the persisted states with data.
+	save(ctx context.Context, data []byte) error
+}
+
+// fileStore persists states to a file, which is what an installed agent needs:
+// it changes routing, DNS and firewall rules on the host, and a later run has
+// to know what to put back.
+type fileStore struct {
+	path string
+}
+
+// memoryStore keeps nothing. An embedded client in netstack mode changes
+// nothing on the host, so there is no state a later run has to restore, and
+// writing one would mean reading and overwriting another installation's file.
+type memoryStore struct{}
+
+func (f *fileStore) load(deleteCorrupt bool) (map[string]json.RawMessage, error) {
+	data, err := os.ReadFile(f.path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			log.Debugf("state file %s does not exist", f.path)
+			return nil, nil //nolint:nilnil // no file is not a failure, there is simply nothing to load
+		}
+		return nil, fmt.Errorf("read state file: %w", err)
+	}
+
+	var rawStates map[string]json.RawMessage
+	if err := json.Unmarshal(data, &rawStates); err != nil {
+		if len(bytes.TrimSpace(data)) == 0 {
+			log.Warnf("state file %s is empty (%d bytes)", f.path, len(data))
+		} else {
+			log.Warnf("state file %s has malformed content (%d bytes)", f.path, len(data))
+		}
+		f.handleCorrupted(deleteCorrupt)
+		return nil, fmt.Errorf("unmarshal states: %w", err)
+	}
+
+	return rawStates, nil
+}
+
+func (f *fileStore) save(ctx context.Context, data []byte) error {
+	return util.WriteBytesWithRestrictedPermission(ctx, f.path, data)
+}
+
+// handleCorrupted moves a state file that cannot be parsed aside, so the next
+// run starts from nothing rather than failing on the same content forever.
+func (f *fileStore) handleCorrupted(deleteCorrupt bool) {
+	if !deleteCorrupt {
+		return
+	}
+	log.Warn("State file appears to be corrupted, attempting to back it up")
+
+	backupPath := fmt.Sprintf("%s.corrupted.%d", f.path, time.Now().UnixNano())
+	if err := os.Rename(f.path, backupPath); err != nil {
+		log.Errorf("Failed to backup corrupted state file: %v", err)
+		return
+	}
+
+	log.Infof("Created backup of corrupted state file at: %s", backupPath)
+}
+
+func (memoryStore) load(bool) (map[string]json.RawMessage, error) {
+	return map[string]json.RawMessage{}, nil
+}
+
+func (memoryStore) save(context.Context, []byte) error {
+	return nil
+}
diff --git a/client/internal/stdnet/filter.go b/client/internal/stdnet/filter.go
index e45714001..07025ff1e 100644
--- a/client/internal/stdnet/filter.go
+++ b/client/internal/stdnet/filter.go
@@ -3,17 +3,13 @@ package stdnet
 import (
 	"runtime"
 	"strings"
-
-	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl"
 )
 
 // InterfaceFilter is a function passed to ICE Agent to filter out not allowed interfaces
-// to avoid building tunnel over them.
-func InterfaceFilter(disallowList []string) func(string) bool {
-
+// to avoid building tunnel over them. A nil detector probes the interface on every call,
+// which is what the callers that build one filter for their whole lifetime want.
+func InterfaceFilter(disallowList []string, detector *WGDetector) func(string) bool {
 	return func(iFace string) bool {
-
 		if strings.HasPrefix(iFace, "lo") {
 			// hardcoded loopback check to support already installed agents
 			return false
@@ -24,17 +20,8 @@ func InterfaceFilter(disallowList []string) func(string) bool {
 				return false
 			}
 		}
-		// look for unlisted WireGuard interfaces
-		wg, err := wgctrl.New()
-		if err != nil {
-			log.Debugf("trying to create a wgctrl client failed with: %v", err)
-			return true
-		}
-		defer func() {
-			_ = wg.Close()
-		}()
 
-		_, err = wg.Device(iFace)
-		return err != nil
+		// look for unlisted WireGuard interfaces
+		return !detector.IsWireGuard(iFace)
 	}
 }
diff --git a/client/internal/stdnet/stdnet.go b/client/internal/stdnet/stdnet.go
index 381886ac6..32f030612 100644
--- a/client/internal/stdnet/stdnet.go
+++ b/client/internal/stdnet/stdnet.go
@@ -45,12 +45,12 @@ type Net struct {
 }
 
 // NewNetWithDiscover creates a new StdNet instance.
-func NewNetWithDiscover(ctx context.Context, iFaceDiscover ExternalIFaceDiscover, disallowList []string) (*Net, error) {
+func NewNetWithDiscover(ctx context.Context, iFaceDiscover ExternalIFaceDiscover, disallowList []string, detector *WGDetector) *Net {
 	if ctx == nil {
 		ctx = context.Background()
 	}
 	n := &Net{
-		interfaceFilter: InterfaceFilter(disallowList),
+		interfaceFilter: InterfaceFilter(disallowList, detector),
 		ctx:             ctx,
 	}
 	// current ExternalIFaceDiscover implement in android-client https://github.dev/netbirdio/android-client
@@ -60,20 +60,19 @@ func NewNetWithDiscover(ctx context.Context, iFaceDiscover ExternalIFaceDiscover
 	} else {
 		n.iFaceDiscover = newMobileIFaceDiscover(iFaceDiscover)
 	}
-	return n, n.UpdateInterfaces()
+	return n
 }
 
 // NewNet creates a new StdNet instance.
-func NewNet(ctx context.Context, disallowList []string) (*Net, error) {
+func NewNet(ctx context.Context, disallowList []string, detector *WGDetector) *Net {
 	if ctx == nil {
 		ctx = context.Background()
 	}
-	n := &Net{
+	return &Net{
 		iFaceDiscover:   pionDiscover{},
-		interfaceFilter: InterfaceFilter(disallowList),
+		interfaceFilter: InterfaceFilter(disallowList, detector),
 		ctx:             ctx,
 	}
-	return n, n.UpdateInterfaces()
 }
 
 // resolveAddr performs DNS resolution with context support and timeout.
@@ -122,45 +121,18 @@ func (n *Net) resolveAddr(network, address string) (netip.AddrPort, error) {
 	return netip.AddrPortFrom(addrs[0], uint16(port)), nil
 }
 
-// UpdateInterfaces updates the internal list of network interfaces
-// and associated addresses filtering them by name.
-// The interfaces are discovered by an external iFaceDiscover function or by a default discoverer if the external one
-// wasn't specified.
-func (n *Net) UpdateInterfaces() (err error) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-
-	return n.updateInterfaces()
-}
-
-func (n *Net) updateInterfaces() (err error) {
-	allIfaces, err := n.iFaceDiscover.iFaces()
-	if err != nil {
-		return err
-	}
-
-	n.interfaces = n.filterInterfaces(allIfaces)
-
-	n.lastUpdate = time.Now()
-
-	return nil
-}
-
 // Interfaces returns a slice of interfaces which are available on the
 // system
 func (n *Net) Interfaces() ([]*transport.Interface, error) {
 	n.mu.Lock()
 	defer n.mu.Unlock()
 
-	if time.Since(n.lastUpdate) < updateInterval {
-		return slices.Clone(n.interfaces), nil
+	iFaces, err := n.freshInterfacesLocked()
+	if err != nil {
+		return nil, err
 	}
 
-	if err := n.updateInterfaces(); err != nil {
-		return nil, fmt.Errorf("update interfaces: %w", err)
-	}
-
-	return slices.Clone(n.interfaces), nil
+	return slices.Clone(iFaces), nil
 }
 
 // InterfaceByIndex returns the interface specified by index.
@@ -171,7 +143,13 @@ func (n *Net) Interfaces() ([]*transport.Interface, error) {
 func (n *Net) InterfaceByIndex(index int) (*transport.Interface, error) {
 	n.mu.Lock()
 	defer n.mu.Unlock()
-	for _, ifc := range n.interfaces {
+
+	iFaces, err := n.freshInterfacesLocked()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, ifc := range iFaces {
 		if ifc.Index == index {
 			return ifc, nil
 		}
@@ -184,7 +162,13 @@ func (n *Net) InterfaceByIndex(index int) (*transport.Interface, error) {
 func (n *Net) InterfaceByName(name string) (*transport.Interface, error) {
 	n.mu.Lock()
 	defer n.mu.Unlock()
-	for _, ifc := range n.interfaces {
+
+	iFaces, err := n.freshInterfacesLocked()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, ifc := range iFaces {
 		if ifc.Name == name {
 			return ifc, nil
 		}
@@ -193,6 +177,31 @@ func (n *Net) InterfaceByName(name string) (*transport.Interface, error) {
 	return nil, fmt.Errorf("%w: %s", transport.ErrInterfaceNotFound, name)
 }
 
+func (n *Net) freshInterfacesLocked() ([]*transport.Interface, error) {
+	if time.Since(n.lastUpdate) < updateInterval {
+		return n.interfaces, nil
+	}
+
+	if err := n.updateInterfacesLocked(); err != nil {
+		return nil, fmt.Errorf("update interfaces: %w", err)
+	}
+
+	return n.interfaces, nil
+}
+
+func (n *Net) updateInterfacesLocked() error {
+	allIFaces, err := n.iFaceDiscover.iFaces()
+	if err != nil {
+		return err
+	}
+
+	n.interfaces = n.filterInterfaces(allIFaces)
+
+	n.lastUpdate = time.Now()
+
+	return nil
+}
+
 func (n *Net) filterInterfaces(interfaces []*transport.Interface) []*transport.Interface {
 	if n.interfaceFilter == nil {
 		return interfaces
diff --git a/client/internal/stdnet/stdnet_test.go b/client/internal/stdnet/stdnet_test.go
new file mode 100644
index 000000000..2b16a50c0
--- /dev/null
+++ b/client/internal/stdnet/stdnet_test.go
@@ -0,0 +1,136 @@
+package stdnet
+
+import (
+	"context"
+	"errors"
+	"net"
+	"testing"
+
+	"github.com/pion/transport/v3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type countingDiscover struct {
+	calls int
+	list  []*transport.Interface
+	err   error
+}
+
+func (d *countingDiscover) iFaces() ([]*transport.Interface, error) {
+	d.calls++
+	if d.err != nil {
+		return nil, d.err
+	}
+	return d.list, nil
+}
+
+func newTestNet(t *testing.T, d iFaceDiscover) *Net {
+	t.Helper()
+	return &Net{
+		iFaceDiscover: d,
+		ctx:           context.Background(),
+	}
+}
+
+func testIFace(index int, name string) *transport.Interface {
+	return transport.NewInterface(net.Interface{Index: index, Name: name})
+}
+
+func TestNet_InterfacesDiscoversLazilyAndCaches(t *testing.T) {
+	d := &countingDiscover{list: []*transport.Interface{testIFace(1, "eth0")}}
+	n := newTestNet(t, d)
+
+	require.Zero(t, d.calls, "construction must not discover interfaces")
+
+	iFaces, err := n.Interfaces()
+	require.NoError(t, err)
+	require.Len(t, iFaces, 1)
+	assert.Equal(t, 1, d.calls)
+
+	_, err = n.Interfaces()
+	require.NoError(t, err)
+	assert.Equal(t, 1, d.calls)
+}
+
+func TestNewNet_DoesNotDiscoverAtConstruction(t *testing.T) {
+	n := NewNet(context.Background(), nil, nil)
+	require.NotNil(t, n)
+	assert.True(t, n.lastUpdate.IsZero(), "constructor must leave the cache cold")
+}
+
+func TestNewNetWithDiscover_DoesNotDiscoverAtConstruction(t *testing.T) {
+	n := NewNetWithDiscover(context.Background(), nil, nil, nil)
+	require.NotNil(t, n)
+	assert.True(t, n.lastUpdate.IsZero(), "constructor must leave the cache cold")
+}
+
+func TestNet_InterfacesRetryAfterDiscoveryFailure(t *testing.T) {
+	discoverErr := errors.New("discover failed")
+	d := &countingDiscover{err: discoverErr}
+	n := newTestNet(t, d)
+
+	_, err := n.Interfaces()
+	require.ErrorIs(t, err, discoverErr)
+
+	d.err = nil
+	d.list = []*transport.Interface{testIFace(1, "eth0")}
+
+	iFaces, err := n.Interfaces()
+	require.NoError(t, err)
+	require.Len(t, iFaces, 1)
+	assert.Equal(t, 2, d.calls)
+}
+
+func TestNet_InterfaceByNameRefreshes(t *testing.T) {
+	d := &countingDiscover{list: []*transport.Interface{testIFace(3, "eth0")}}
+	n := newTestNet(t, d)
+
+	ifc, err := n.InterfaceByName("eth0")
+	require.NoError(t, err)
+	assert.Equal(t, "eth0", ifc.Name)
+	assert.Equal(t, 1, d.calls)
+
+	_, err = n.InterfaceByName("nope")
+	require.ErrorIs(t, err, transport.ErrInterfaceNotFound)
+}
+
+func TestNet_InterfaceByIndexRefreshes(t *testing.T) {
+	d := &countingDiscover{list: []*transport.Interface{testIFace(3, "eth0")}}
+	n := newTestNet(t, d)
+
+	ifc, err := n.InterfaceByIndex(3)
+	require.NoError(t, err)
+	assert.Equal(t, "eth0", ifc.Name)
+	assert.Equal(t, 1, d.calls)
+
+	_, err = n.InterfaceByIndex(99)
+	require.ErrorIs(t, err, transport.ErrInterfaceNotFound)
+}
+
+func TestNet_InterfaceLookupPropagatesDiscoveryError(t *testing.T) {
+	discoverErr := errors.New("discover failed")
+	n := newTestNet(t, &countingDiscover{err: discoverErr})
+
+	_, err := n.InterfaceByName("eth0")
+	require.ErrorIs(t, err, discoverErr)
+
+	_, err = n.InterfaceByIndex(1)
+	require.ErrorIs(t, err, discoverErr)
+}
+
+func TestNet_InterfacesReturnsCopy(t *testing.T) {
+	d := &countingDiscover{list: []*transport.Interface{testIFace(1, "eth0")}}
+	n := newTestNet(t, d)
+
+	iFaces, err := n.Interfaces()
+	require.NoError(t, err)
+	require.Len(t, iFaces, 1)
+
+	iFaces[0] = testIFace(2, "tampered")
+
+	iFaces, err = n.Interfaces()
+	require.NoError(t, err)
+	require.Len(t, iFaces, 1)
+	assert.Equal(t, "eth0", iFaces[0].Name)
+}
diff --git a/client/internal/stdnet/wgdetector.go b/client/internal/stdnet/wgdetector.go
new file mode 100644
index 000000000..8ed290190
--- /dev/null
+++ b/client/internal/stdnet/wgdetector.go
@@ -0,0 +1,130 @@
+package stdnet
+
+import (
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/singleflight"
+	"golang.zx2c4.com/wireguard/wgctrl"
+)
+
+// wgDetectorTTL bounds how long a cached answer is trusted. An interface rarely
+// becomes, or stops being, a WireGuard device, and the window only has to be short
+// enough that ICE does not keep gathering candidates on one that just appeared.
+const wgDetectorTTL = 1 * time.Second
+
+type wgDetectorEntry struct {
+	isWireGuard bool
+	expireAt    time.Time
+}
+
+// WGDetector answers whether an interface is a WireGuard device, remembering the
+// answer for a short while.
+//
+// The question is asked once per interface for every ICE agent, and an agent is
+// created per peer connection attempt, so on a large network the uncached form runs
+// constantly. Answering it means opening a wgctrl client, which builds both a kernel
+// and a userspace client and resolves the netlink family, and then a round trip that
+// usually just reports the device does not exist.
+//
+// A detector is safe for concurrent use and is meant to be shared by every agent.
+type WGDetector struct {
+	ttl time.Duration
+	// probe is replaced in tests; it is the call this type exists to avoid repeating.
+	probe func(string) bool
+
+	ownIface string
+
+	mu    sync.RWMutex
+	cache map[string]wgDetectorEntry
+
+	sf singleflight.Group
+}
+
+// NewWGDetector returns a detector with the default time to live.
+func NewWGDetector(ownIface string) *WGDetector {
+	return &WGDetector{
+		ttl:      wgDetectorTTL,
+		probe:    probeWireGuard,
+		ownIface: ownIface,
+		cache:    make(map[string]wgDetectorEntry),
+	}
+}
+
+// IsWireGuard reports whether the named interface is a WireGuard device. An interface
+// it cannot ask about is reported as not being one, which leaves it available to ICE
+// exactly as an uncached probe would.
+func (d *WGDetector) IsWireGuard(iFace string) bool {
+	if d == nil {
+		return probeWireGuard(iFace)
+	}
+
+	if d.isOwnInterface(iFace) {
+		return true
+	}
+
+	if isWireGuard, ok := d.cached(iFace); ok {
+		return isWireGuard
+	}
+
+	result, _, _ := d.sf.Do(iFace, func() (interface{}, error) {
+		// A caller that saw the entry expire may get here after another caller already
+		// refreshed it and left the singleflight group.
+		if isWireGuard, ok := d.cached(iFace); ok {
+			return isWireGuard, nil
+		}
+
+		isWireGuard := d.probe(iFace)
+
+		d.store(iFace, isWireGuard)
+
+		return isWireGuard, nil
+	})
+	return result.(bool)
+}
+
+func (d *WGDetector) cached(iFace string) (isWireGuard, ok bool) {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	entry, found := d.cache[iFace]
+	if !found || !time.Now().Before(entry.expireAt) {
+		return false, false
+	}
+	return entry.isWireGuard, true
+}
+
+// store records an answer and drops the expired ones, so names of interfaces that came
+// and went, such as container veths, do not pile up for the life of the engine.
+func (d *WGDetector) store(iFace string, isWireGuard bool) {
+	now := time.Now()
+
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	for name, entry := range d.cache {
+		if !now.Before(entry.expireAt) {
+			delete(d.cache, name)
+		}
+	}
+	d.cache[iFace] = wgDetectorEntry{isWireGuard: isWireGuard, expireAt: now.Add(d.ttl)}
+}
+
+func (d *WGDetector) isOwnInterface(iFace string) bool {
+	return d.ownIface != "" && iFace == d.ownIface
+}
+
+func probeWireGuard(iFace string) bool {
+	wg, err := wgctrl.New()
+	if err != nil {
+		log.Debugf("trying to create a wgctrl client failed with: %v", err)
+		return false
+	}
+	defer func() {
+		_ = wg.Close()
+	}()
+
+	_, err = wg.Device(iFace)
+	return err == nil
+}
diff --git a/client/internal/stdnet/wgdetector_test.go b/client/internal/stdnet/wgdetector_test.go
new file mode 100644
index 000000000..28cf85f6a
--- /dev/null
+++ b/client/internal/stdnet/wgdetector_test.go
@@ -0,0 +1,188 @@
+package stdnet
+
+import (
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newCountingDetector returns a detector whose probe records how often it ran, so a test
+// can assert on the thing this type exists for rather than on its return value alone.
+func newCountingDetector(t *testing.T, ttl time.Duration, answer bool) (*WGDetector, *atomic.Int64) {
+	t.Helper()
+
+	var calls atomic.Int64
+	d := &WGDetector{
+		ttl:   ttl,
+		cache: make(map[string]wgDetectorEntry),
+		probe: func(string) bool {
+			calls.Add(1)
+			return answer
+		},
+	}
+	return d, &calls
+}
+
+func TestWGDetectorAsksOncePerInterfaceWithinTheTTL(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Minute, true)
+
+	for i := 0; i < 20; i++ {
+		assert.True(t, d.IsWireGuard("wt0"), "cached answer must not change")
+	}
+	assert.Equal(t, int64(1), calls.Load(), "the interface must be probed once within the TTL")
+
+	d.IsWireGuard("eth0")
+	assert.Equal(t, int64(2), calls.Load(), "a different interface is a different question and is probed on its own")
+}
+
+func TestWGDetectorReprobesAfterTheTTL(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Millisecond, true)
+
+	require.True(t, d.IsWireGuard("wt0"), "first answer")
+	require.Equal(t, int64(1), calls.Load(), "first call probes")
+
+	time.Sleep(5 * time.Millisecond)
+
+	require.True(t, d.IsWireGuard("wt0"), "answer after expiry")
+	assert.Equal(t, int64(2), calls.Load(), "an expired entry must be probed again")
+}
+
+func TestWGDetectorCollapsesConcurrentProbes(t *testing.T) {
+	var calls atomic.Int64
+	release := make(chan struct{})
+	d := &WGDetector{
+		ttl:   time.Minute,
+		cache: make(map[string]wgDetectorEntry),
+		probe: func(string) bool {
+			calls.Add(1)
+			<-release
+			return true
+		},
+	}
+
+	var wg sync.WaitGroup
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			d.IsWireGuard("wt0")
+		}()
+	}
+
+	// The sleep only lets the callers pile up on the blocked probe so the collapse is
+	// exercised. The count does not depend on it: a caller that arrives after the probe
+	// finished finds the fresh entry, either before or inside the singleflight group.
+	time.Sleep(20 * time.Millisecond)
+	close(release)
+	wg.Wait()
+
+	assert.Equal(t, int64(1), calls.Load(), "concurrent callers must share one probe")
+}
+
+func TestWGDetectorNilProbesEveryTime(t *testing.T) {
+	var d *WGDetector
+	// A nil detector keeps the uncached behaviour, which is what the callers that build one
+	// filter for their whole lifetime rely on. It must not panic.
+	assert.NotPanics(t, func() { d.IsWireGuard("definitely-not-an-interface-0") },
+		"a nil detector must fall back to probing")
+}
+
+func TestInterfaceFilter(t *testing.T) {
+	wgDetector, calls := newCountingDetector(t, time.Minute, true)
+	plainDetector, _ := newCountingDetector(t, time.Minute, false)
+
+	t.Run("loopback is rejected without probing", func(t *testing.T) {
+		filter := InterfaceFilter(nil, wgDetector)
+		assert.False(t, filter("lo"), "loopback must never be offered to ICE")
+		assert.Equal(t, int64(0), calls.Load(), "a name settled by prefix must not reach the probe")
+	})
+
+	t.Run("a disallowed interface is rejected without probing", func(t *testing.T) {
+		if runtime.GOOS == "ios" {
+			t.Skip("the disallow list is not applied on iOS")
+		}
+		filter := InterfaceFilter([]string{"wt"}, wgDetector)
+		assert.False(t, filter("wt0"), "a blacklisted interface must be rejected")
+		assert.Equal(t, int64(0), calls.Load(), "a name settled by the disallow list must not reach the probe")
+	})
+
+	t.Run("an unlisted WireGuard interface is rejected", func(t *testing.T) {
+		filter := InterfaceFilter(nil, wgDetector)
+		assert.False(t, filter("somewg0"), "a WireGuard interface must not be used to build a tunnel")
+	})
+
+	t.Run("an ordinary interface is allowed", func(t *testing.T) {
+		filter := InterfaceFilter(nil, plainDetector)
+		assert.True(t, filter("eth0"), "a plain interface must remain available to ICE")
+	})
+}
+
+func TestInterfaceFilterSharesOneProbeAcrossFilters(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Minute, false)
+
+	// Every ICE agent builds its own filter, twice, and each one is asked about every
+	// interface. Sharing the detector is what keeps that from repeating the probe.
+	for i := 0; i < 10; i++ {
+		filter := InterfaceFilter(nil, d)
+		require.True(t, filter("eth0"), "a plain interface stays allowed")
+		require.True(t, filter("eth1"), "a plain interface stays allowed")
+	}
+
+	assert.Equal(t, int64(2), calls.Load(), "one probe per interface, not per filter")
+}
+
+func TestWGDetectorDropsExpiredEntries(t *testing.T) {
+	d, _ := newCountingDetector(t, time.Millisecond, false)
+
+	for _, name := range []string{"veth1", "veth2", "veth3"} {
+		d.IsWireGuard(name)
+	}
+	time.Sleep(5 * time.Millisecond)
+	d.IsWireGuard("eth0")
+
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+	assert.Len(t, d.cache, 1, "expired entries of vanished interfaces must be dropped")
+	assert.Contains(t, d.cache, "eth0", "the fresh answer must be kept")
+}
+
+func TestWGDetectorOwnInterfaceIsWireGuardWithoutProbing(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Minute, false)
+	d.ownIface = "NetBird"
+
+	assert.True(t, d.IsWireGuard("NetBird"), "the agent's own interface is a WireGuard device")
+	assert.Equal(t, int64(0), calls.Load(), "the own interface must never reach the probe")
+
+	assert.False(t, d.IsWireGuard("NetBird2"), "only the exact own name is answered without probing")
+	assert.Equal(t, int64(1), calls.Load(), "a different interface is probed")
+}
+
+func TestWGDetectorWithoutOwnInterfaceProbesEmptyName(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Minute, false)
+
+	assert.False(t, d.IsWireGuard(""), "an unnamed interface is not mistaken for the own one")
+	assert.Equal(t, int64(1), calls.Load(), "with no own interface set every name is probed")
+}
+
+func TestInterfaceFilterRejectsOwnInterfaceRegardlessOfDisallowList(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Minute, false)
+	d.ownIface = "NetBird"
+	filter := InterfaceFilter([]string{"wt"}, d)
+
+	assert.False(t, filter("NetBird"), "the own interface is rejected even when the disallow list does not cover it")
+	assert.Equal(t, int64(0), calls.Load(), "the own interface is not probed")
+
+	assert.True(t, filter("eth0"), "an ordinary interface stays available")
+	assert.Equal(t, int64(1), calls.Load(), "an ordinary interface is still probed")
+}
+
+func TestNewWGDetectorKeepsTheOwnInterface(t *testing.T) {
+	d := NewWGDetector("NetbirdWT")
+
+	assert.True(t, d.IsWireGuard("NetbirdWT"), "the constructor records the own interface")
+}
diff --git a/client/internal/tpm/open_linux.go b/client/internal/tpm/open_linux.go
new file mode 100644
index 000000000..b6356112a
--- /dev/null
+++ b/client/internal/tpm/open_linux.go
@@ -0,0 +1,29 @@
+package tpm
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/google/go-tpm/tpmutil"
+)
+
+// The kernel resource manager multiplexes clients and flushes what they leave behind,
+// so it is tried before the raw device.
+var devicePaths = []string{"/dev/tpmrm0", "/dev/tpm0"}
+
+func open() (io.ReadWriteCloser, error) {
+	if path := os.Getenv(DeviceEnv); path != "" {
+		return tpmutil.OpenTPM(path)
+	}
+	var errs error
+	for _, path := range devicePaths {
+		rwc, err := tpmutil.OpenTPM(path)
+		if err == nil {
+			return rwc, nil
+		}
+		errs = errors.Join(errs, err)
+	}
+	return nil, fmt.Errorf("open TPM: %w", errs)
+}
diff --git a/client/internal/tpm/open_other.go b/client/internal/tpm/open_other.go
new file mode 100644
index 000000000..58bc38db9
--- /dev/null
+++ b/client/internal/tpm/open_other.go
@@ -0,0 +1,9 @@
+//go:build !linux
+
+package tpm
+
+import "io"
+
+func open() (io.ReadWriteCloser, error) {
+	return nil, ErrUnsupported
+}
diff --git a/client/internal/tpm/signer.go b/client/internal/tpm/signer.go
new file mode 100644
index 000000000..a6574bec7
--- /dev/null
+++ b/client/internal/tpm/signer.go
@@ -0,0 +1,163 @@
+package tpm
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"encoding/asn1"
+	"errors"
+	"fmt"
+	"io"
+	"math/big"
+
+	legacy "github.com/google/go-tpm/legacy/tpm2"
+	"github.com/google/go-tpm/tpmutil"
+)
+
+// KeyPEMType is the PEM block type of a TPM 2.0 key file as defined by
+// draft-bottomley-tpm2-keys and written by tpm2-openssl and tpm2-tss-engine.
+const KeyPEMType = "TSS2 PRIVATE KEY"
+
+var ErrKeyNeedsAuth = errors.New("TPM key requires an authorization value")
+
+// eccSRKTemplate is the TCG reference ECC-P256 storage root key. A key whose parent is
+// a hierarchy rather than a persistent handle was wrapped by the primary this template
+// derives, and tpm2-openssl and tpm2-tss-engine derive the same one, so the TPM
+// reproduces the identical parent from the hierarchy seed without anything being stored.
+var eccSRKTemplate = legacy.Public{
+	Type:       legacy.AlgECC,
+	NameAlg:    legacy.AlgSHA256,
+	Attributes: legacy.FlagStorageDefault | legacy.FlagNoDA,
+	ECCParameters: &legacy.ECCParams{
+		Symmetric: &legacy.SymScheme{Alg: legacy.AlgAES, KeyBits: 128, Mode: legacy.AlgCFB},
+		Sign:      &legacy.SigScheme{Alg: legacy.AlgNull},
+		CurveID:   legacy.CurveNISTP256,
+	},
+}
+
+// ParseKey reads a TSS2 key file and returns a signer that produces every signature
+// inside the TPM; only the digest goes in and only the signature comes out. Keys guarded
+// by an authorization value are rejected, since nothing can supply it without prompting.
+func ParseKey(der []byte) (crypto.Signer, error) {
+	key, err := parseTSS2(der)
+	if err != nil {
+		return nil, err
+	}
+	if !key.EmptyAuth {
+		return nil, ErrKeyNeedsAuth
+	}
+
+	public, err := legacy.DecodePublic(key.PublicKey[2:])
+	if err != nil {
+		return nil, fmt.Errorf("decode TSS2 public area: %w", err)
+	}
+	pub, err := public.Key()
+	if err != nil {
+		return nil, fmt.Errorf("decode TSS2 public key: %w", err)
+	}
+	return &keySigner{key: key, public: pub}, nil
+}
+
+type keySigner struct {
+	key    *tss2Key
+	public crypto.PublicKey
+}
+
+func (s *keySigner) Public() crypto.PublicKey {
+	return s.public
+}
+
+// Sign loads the key under its parent, signs, and releases both handles. The TPM is
+// opened per signature so no handle outlives the call, which matters on a device whose
+// transient object slots are few and shared with everything else on the host.
+func (s *keySigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	rwc, err := Open()
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rwc.Close() }()
+
+	parent := tpmutil.Handle(s.key.Parent)
+	if !persistentHandle(s.key.Parent) {
+		parent, _, err = legacy.CreatePrimary(rwc, parent, legacy.PCRSelection{}, "", "", eccSRKTemplate)
+		if err != nil {
+			return nil, fmt.Errorf("create TPM primary: %w", err)
+		}
+		defer func() { _ = legacy.FlushContext(rwc, parent) }()
+	}
+
+	public, private := s.key.blobs()
+	handle, _, err := legacy.Load(rwc, parent, "", public, private)
+	if err != nil {
+		return nil, fmt.Errorf("load TPM key: %w", err)
+	}
+	defer func() { _ = legacy.FlushContext(rwc, handle) }()
+
+	switch pub := s.public.(type) {
+	case *ecdsa.PublicKey:
+		return signECDSA(rwc, handle, digest, pub.Curve)
+	case *rsa.PublicKey:
+		return signRSA(rwc, handle, digest, opts)
+	default:
+		return nil, fmt.Errorf("unsupported TPM key type %T", s.public)
+	}
+}
+
+// signECDSA returns the signature as the ASN.1 sequence crypto.Signer is defined to
+// return; the TPM hands back the two integers on their own.
+func signECDSA(rw io.ReadWriter, handle tpmutil.Handle, digest []byte, curve elliptic.Curve) ([]byte, error) {
+	hash, err := eccHash(curve)
+	if err != nil {
+		return nil, err
+	}
+	sig, err := legacy.Sign(rw, handle, "", digest, nil, &legacy.SigScheme{Alg: legacy.AlgECDSA, Hash: hash})
+	if err != nil {
+		return nil, fmt.Errorf("TPM ECDSA signature: %w", err)
+	}
+	if sig.ECC == nil {
+		return nil, fmt.Errorf("TPM returned a %v signature for an ECDSA key", sig.Alg)
+	}
+	return asn1.Marshal(struct{ R, S *big.Int }{sig.ECC.R, sig.ECC.S})
+}
+
+func signRSA(rw io.ReadWriter, handle tpmutil.Handle, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	hash, err := legacy.HashToAlgorithm(opts.HashFunc())
+	if err != nil {
+		return nil, fmt.Errorf("TPM hash algorithm: %w", err)
+	}
+
+	scheme := &legacy.SigScheme{Alg: legacy.AlgRSASSA, Hash: hash}
+	if pss, ok := opts.(*rsa.PSSOptions); ok {
+		// The TPM chooses the salt length itself, the digest length on most chips, so
+		// only a request for that length is taken. PSSSaltLengthAuto asks for the
+		// largest salt the key allows and is refused. Verify with PSSSaltLengthAuto.
+		if pss.SaltLength != rsa.PSSSaltLengthEqualsHash &&
+			pss.SaltLength != len(digest) {
+			return nil, fmt.Errorf("TPM cannot produce a PSS signature with salt length %d", pss.SaltLength)
+		}
+		scheme.Alg = legacy.AlgRSAPSS
+	}
+
+	sig, err := legacy.Sign(rw, handle, "", digest, nil, scheme)
+	if err != nil {
+		return nil, fmt.Errorf("TPM RSA signature: %w", err)
+	}
+	if sig.RSA == nil {
+		return nil, fmt.Errorf("TPM returned a %v signature for an RSA key", sig.Alg)
+	}
+	return sig.RSA.Signature, nil
+}
+
+func eccHash(curve elliptic.Curve) (legacy.Algorithm, error) {
+	switch curve {
+	case elliptic.P256():
+		return legacy.AlgSHA256, nil
+	case elliptic.P384():
+		return legacy.AlgSHA384, nil
+	case elliptic.P521():
+		return legacy.AlgSHA512, nil
+	default:
+		return 0, fmt.Errorf("unsupported curve %s", curve.Params().Name)
+	}
+}
diff --git a/client/internal/tpm/signer_test.go b/client/internal/tpm/signer_test.go
new file mode 100644
index 000000000..d923223ac
--- /dev/null
+++ b/client/internal/tpm/signer_test.go
@@ -0,0 +1,73 @@
+package tpm
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"encoding/pem"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/tpm/tpmtest"
+)
+
+func TestParseKey_ReportsPublicKeyWithoutTouchingTPM(t *testing.T) {
+	key := newP256Key(t)
+
+	signer, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey)))
+	require.NoError(t, err)
+	assert.True(t, key.PublicKey.Equal(signer.Public()), "signer must expose the key the TPM holds")
+}
+
+func TestParseKey_RejectsKeyWithAuthorization(t *testing.T) {
+	key := newP256Key(t)
+	_, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey, tpmtest.WithAuth())))
+	assert.ErrorIs(t, err, ErrKeyNeedsAuth)
+}
+
+func TestParseKey_RejectsMalformedKey(t *testing.T) {
+	_, err := ParseKey([]byte("not a TSS2 key"))
+	assert.Error(t, err)
+}
+
+func TestSign_FailsWhenTPMIsUnreachable(t *testing.T) {
+	t.Setenv(DeviceEnv, filepath.Join(t.TempDir(), "missing"))
+	signer, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &newP256Key(t).PublicKey)))
+	require.NoError(t, err)
+
+	digest := sha256.Sum256([]byte("challenge"))
+	_, err = signer.Sign(rand.Reader, digest[:], crypto.SHA256)
+	assert.Error(t, err, "signing must not fall back to software when the TPM is missing")
+}
+
+// TestSignRSA_RefusesSaltLengthsTheTPMDoesNotChoose checks the salt-length gate, which
+// runs before the TPM is touched: the TPM picks the salt itself, so a request for the
+// maximum salt (PSSSaltLengthAuto) or any other explicit length is refused.
+func TestSignRSA_RefusesSaltLengthsTheTPMDoesNotChoose(t *testing.T) {
+	digest := sha256.Sum256([]byte("challenge"))
+	for _, salt := range []int{rsa.PSSSaltLengthAuto, 20, 222} {
+		_, err := signRSA(nil, 0, digest[:], &rsa.PSSOptions{SaltLength: salt, Hash: crypto.SHA256})
+		assert.ErrorContains(t, err, "salt length", "salt length %d must be refused", salt)
+	}
+}
+
+func newP256Key(t *testing.T) *ecdsa.PrivateKey {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	return key
+}
+
+func decodePEM(t *testing.T, pemData string) []byte {
+	t.Helper()
+	block, _ := pem.Decode([]byte(pemData))
+	require.NotNil(t, block)
+	require.Equal(t, KeyPEMType, block.Type)
+	return block.Bytes
+}
diff --git a/client/internal/tpm/tpm.go b/client/internal/tpm/tpm.go
new file mode 100644
index 000000000..ca519caa9
--- /dev/null
+++ b/client/internal/tpm/tpm.go
@@ -0,0 +1,19 @@
+// Package tpm is the client's one door to the platform TPM 2.0. It opens the device
+// and turns TPM-held key files into signers; every operation opens the TPM, runs and
+// closes it, so no handle outlives a call.
+package tpm
+
+import (
+	"errors"
+	"io"
+)
+
+// DeviceEnv overrides the TPM device path, which also lets tests point at a swtpm socket.
+const DeviceEnv = "NB_TPM_DEVICE"
+
+var ErrUnsupported = errors.New("TPM is not supported on this platform")
+
+// Open connects to the platform TPM 2.0. The caller closes it after one operation.
+func Open() (io.ReadWriteCloser, error) {
+	return open()
+}
diff --git a/client/internal/tpm/tpmtest/tpmtest.go b/client/internal/tpm/tpmtest/tpmtest.go
new file mode 100644
index 000000000..5d6b7ac2a
--- /dev/null
+++ b/client/internal/tpm/tpmtest/tpmtest.go
@@ -0,0 +1,121 @@
+// Package tpmtest builds TSS2 key files for tests, with or without a TPM behind them.
+package tpmtest
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"encoding/asn1"
+	"encoding/pem"
+	"testing"
+
+	"github.com/google/go-tpm/legacy/tpm2"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	p256Bytes = 32
+
+	// KeyPEMType is the PEM block type of a TPM 2.0 key file.
+	KeyPEMType = "TSS2 PRIVATE KEY"
+)
+
+// oidLoadableKey is the key type of draft-bottomley-tpm2-keys that a parent wraps.
+var oidLoadableKey = asn1.ObjectIdentifier{2, 23, 133, 10, 1, 3}
+
+// tss2KeyDER is the ASN.1 container, written out independently of the parser under test
+// so that an encoder bug and a decoder bug cannot cancel out. Policy, secret and auth
+// policy are left out entirely: they are optional, and a key that carries them is
+// refused anyway.
+type tss2KeyDER struct {
+	Type       asn1.ObjectIdentifier
+	EmptyAuth  bool `asn1:"optional,explicit,tag:0"`
+	Parent     int64
+	PublicKey  []byte
+	PrivateKey []byte
+}
+
+// Option adjusts a key before it is encoded.
+type Option func(*tss2KeyDER)
+
+// WithParent names the handle the key is wrapped by, instead of the owner hierarchy.
+func WithParent(handle int64) Option {
+	return func(k *tss2KeyDER) { k.Parent = handle }
+}
+
+// WithAuth marks the key as guarded by an authorization value, which this client refuses
+// because nothing can supply one without prompting.
+func WithAuth() Option {
+	return func(k *tss2KeyDER) { k.EmptyAuth = false }
+}
+
+// SigningTemplate is the public area of an unrestricted P-256 signing key with no fixed
+// scheme, the shape tpm2-openssl creates certificate keys in.
+func SigningTemplate() tpm2.Public {
+	return tpm2.Public{
+		Type:          tpm2.AlgECC,
+		NameAlg:       tpm2.AlgSHA256,
+		Attributes:    tpm2.FlagSign | tpm2.FlagFixedTPM | tpm2.FlagFixedParent | tpm2.FlagSensitiveDataOrigin | tpm2.FlagUserWithAuth | tpm2.FlagNoDA,
+		ECCParameters: &tpm2.ECCParams{CurveID: tpm2.CurveNISTP256},
+	}
+}
+
+// KeyPEM encodes pub as a TSS2 PRIVATE KEY over a placeholder private blob: it parses
+// and reports pub, but no TPM can load it.
+func KeyPEM(t *testing.T, pub *ecdsa.PublicKey, opts ...Option) string {
+	t.Helper()
+	require.Equal(t, elliptic.P256(), pub.Curve, "fixture keys must be P-256")
+	area := SigningTemplate()
+	// The uncompressed encoding is 0x04 followed by the two coordinates, which is
+	// what the TPM wants them as.
+	point, err := pub.Bytes()
+	require.NoError(t, err)
+	require.Len(t, point, 1+2*p256Bytes)
+	area.ECCParameters.Point = tpm2.ECPoint{
+		XRaw: point[1 : 1+p256Bytes],
+		YRaw: point[1+p256Bytes:],
+	}
+	encoded, encErr := area.Encode()
+	require.NoError(t, encErr)
+	return EncodePEM(t, encoded, []byte("placeholder"), opts...)
+}
+
+// EncodePEM wraps the public and private blobs TPM2_Create returned into a TSS2 PRIVATE
+// KEY, giving each the TPM2B length prefix the format carries them with.
+func EncodePEM(t *testing.T, public, private []byte, opts ...Option) string {
+	t.Helper()
+
+	key := tss2KeyDER{
+		Type:       oidLoadableKey,
+		EmptyAuth:  true,
+		Parent:     int64(tpm2.HandleOwner),
+		PublicKey:  prefixTPM2B(public),
+		PrivateKey: prefixTPM2B(private),
+	}
+	for _, opt := range opts {
+		opt(&key)
+	}
+
+	der, err := asn1.Marshal(key)
+	require.NoError(t, err)
+	return string(pem.EncodeToMemory(&pem.Block{Type: KeyPEMType, Bytes: der}))
+}
+
+func prefixTPM2B(b []byte) []byte {
+	out := make([]byte, 0, len(b)+2)
+	out = append(out, byte(len(b)>>8), byte(len(b)))
+	return append(out, b...)
+}
+
+// ECCSRKTemplate is the TCG reference ECC-P256 storage root key, the parent a key under
+// a hierarchy is wrapped by. Tests that create a key in a real TPM have to use the same
+// template the signer re-derives it with.
+var ECCSRKTemplate = tpm2.Public{
+	Type:       tpm2.AlgECC,
+	NameAlg:    tpm2.AlgSHA256,
+	Attributes: tpm2.FlagStorageDefault | tpm2.FlagNoDA,
+	ECCParameters: &tpm2.ECCParams{
+		Symmetric: &tpm2.SymScheme{Alg: tpm2.AlgAES, KeyBits: 128, Mode: tpm2.AlgCFB},
+		Sign:      &tpm2.SigScheme{Alg: tpm2.AlgNull},
+		CurveID:   tpm2.CurveNISTP256,
+	},
+}
diff --git a/client/internal/tpm/tss2.go b/client/internal/tpm/tss2.go
new file mode 100644
index 000000000..b227fde32
--- /dev/null
+++ b/client/internal/tpm/tss2.go
@@ -0,0 +1,133 @@
+package tpm
+
+import (
+	"encoding/asn1"
+	"errors"
+	"fmt"
+	"math"
+
+	legacy "github.com/google/go-tpm/legacy/tpm2"
+)
+
+// oidLoadableKey marks a key wrapped by a parent inside the TPM, which is the only kind
+// enrollment tooling writes for a signing key and the only kind that can be loaded under
+// an SRK. The sealed and importable variants carry different material and are refused.
+var oidLoadableKey = asn1.ObjectIdentifier{2, 23, 133, 10, 1, 3}
+
+var (
+	errNotLoadable  = errors.New("TSS2 key is not a loadable key")
+	errKeyHasPolicy = errors.New("TSS2 key carries a policy, which is not supported")
+	errKeyHasSecret = errors.New("TSS2 key carries a secret, which is not supported")
+	errBadParent    = errors.New("TSS2 key names a parent that is neither persistent nor a hierarchy")
+	errBadBlob      = errors.New("TSS2 key blob is malformed")
+)
+
+// tss2KeyASN1 is the ASN.1 container of draft-bottomley-tpm2-keys, the format
+// tpm2-openssl, tpm2-tss-engine and tpm2_encodeobject write. PublicKey and PrivateKey
+// hold TPM2B structures, so each is its own two-byte length followed by that many bytes.
+//
+// EmptyAuth is decoded raw: OpenSSL-based tools write BOOLEAN TRUE as 0x01, which BER
+// allows but encoding/asn1 rejects, as it accepts only the DER form 0xff. Parent is an
+// int64 so a persistent handle such as 0x81000001 still fits on 32-bit platforms.
+type tss2KeyASN1 struct {
+	Type       asn1.ObjectIdentifier
+	EmptyAuth  asn1.RawValue   `asn1:"optional,explicit,tag:0"`
+	Policy     []asn1.RawValue `asn1:"optional,explicit,tag:1"`
+	Secret     []byte          `asn1:"optional,explicit,tag:2"`
+	AuthPolicy []asn1.RawValue `asn1:"optional,explicit,tag:3"`
+	Parent     int64
+	PublicKey  []byte
+	PrivateKey []byte
+}
+
+// tss2Key is a decoded key file the client can ask the TPM to load.
+type tss2Key struct {
+	EmptyAuth  bool
+	Parent     uint32
+	PublicKey  []byte
+	PrivateKey []byte
+}
+
+// parseTSS2 decodes a TSS2 key file and rejects everything this client cannot honour,
+// so a key that parses here is one the TPM can be asked to load.
+func parseTSS2(der []byte) (*tss2Key, error) {
+	raw := new(tss2KeyASN1)
+	rest, err := asn1.Unmarshal(der, raw)
+	if err != nil {
+		return nil, fmt.Errorf("parse TSS2 key: %w", err)
+	}
+	if len(rest) > 0 {
+		return nil, fmt.Errorf("parse TSS2 key: %d trailing bytes", len(rest))
+	}
+	emptyAuth, err := berBoolean(raw.EmptyAuth)
+	if err != nil {
+		return nil, fmt.Errorf("parse TSS2 key emptyAuth: %w", err)
+	}
+
+	switch {
+	case !raw.Type.Equal(oidLoadableKey):
+		return nil, fmt.Errorf("%w: %s", errNotLoadable, raw.Type)
+	case len(raw.Policy) > 0 || len(raw.AuthPolicy) > 0:
+		return nil, errKeyHasPolicy
+	case len(raw.Secret) > 0:
+		return nil, errKeyHasSecret
+	case raw.Parent < 0 || raw.Parent > math.MaxUint32 || !validParent(uint32(raw.Parent)):
+		return nil, fmt.Errorf("%w: %d", errBadParent, raw.Parent)
+	case !validTPM2B(raw.PublicKey) || !validTPM2B(raw.PrivateKey):
+		return nil, errBadBlob
+	}
+	return &tss2Key{
+		EmptyAuth:  emptyAuth,
+		Parent:     uint32(raw.Parent),
+		PublicKey:  raw.PublicKey,
+		PrivateKey: raw.PrivateKey,
+	}, nil
+}
+
+// berBoolean decodes an optional BOOLEAN, absent meaning false. Any non-zero content
+// byte is true, as BER (X.690 section 8.2.2) allows and OpenSSL writes.
+func berBoolean(v asn1.RawValue) (bool, error) {
+	if len(v.FullBytes) == 0 {
+		return false, nil
+	}
+	// The field is explicitly tagged, so v is the [0] wrapper and the BOOLEAN is inside it.
+	if v.Class == asn1.ClassContextSpecific && v.IsCompound {
+		var inner asn1.RawValue
+		rest, err := asn1.Unmarshal(v.Bytes, &inner)
+		if err != nil || len(rest) > 0 {
+			return false, errors.New("malformed explicit tag")
+		}
+		v = inner
+	}
+	if v.Class != asn1.ClassUniversal || v.Tag != asn1.TagBoolean || v.IsCompound || len(v.Bytes) != 1 {
+		return false, errors.New("not a BOOLEAN")
+	}
+	return v.Bytes[0] != 0, nil
+}
+
+// blobs returns the public and private areas with their TPM2B length prefix removed,
+// which is the form the load command takes them in.
+func (k *tss2Key) blobs() (public, private []byte) {
+	return k.PublicKey[2:], k.PrivateKey[2:]
+}
+
+// validParent accepts a persistent handle, under which the key was wrapped directly, or
+// one of the four hierarchies, under which the key is wrapped by a primary the TPM
+// re-derives from the hierarchy seed.
+func validParent(parent uint32) bool {
+	return persistentHandle(parent) ||
+		parent == uint32(legacy.HandleOwner) ||
+		parent == uint32(legacy.HandleNull) ||
+		parent == uint32(legacy.HandleEndorsement) ||
+		parent == uint32(legacy.HandlePlatform)
+}
+
+func persistentHandle(h uint32) bool {
+	return h>>24 == uint32(legacy.HandleTypePersistent)
+}
+
+// validTPM2B reports whether b is a TPM2B structure: a two-byte big-endian length
+// followed by exactly that many bytes.
+func validTPM2B(b []byte) bool {
+	return len(b) >= 2 && len(b)-2 == int(b[0])<<8+int(b[1])
+}
diff --git a/client/internal/tpm/tss2_test.go b/client/internal/tpm/tss2_test.go
new file mode 100644
index 000000000..27dfbba8b
--- /dev/null
+++ b/client/internal/tpm/tss2_test.go
@@ -0,0 +1,78 @@
+package tpm
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/asn1"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/tpm/tpmtest"
+)
+
+// derEmptyAuthTrue is the explicit [0] tag around a DER BOOLEAN TRUE, as encoding/asn1
+// writes emptyAuth; OpenSSL writes the same element with 0x01 as the content byte.
+var (
+	derEmptyAuthTrue     = []byte{0xa0, 0x03, 0x01, 0x01, 0xff}
+	opensslEmptyAuthTrue = []byte{0xa0, 0x03, 0x01, 0x01, 0x01}
+)
+
+func p256(t *testing.T) *ecdsa.PrivateKey {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	return key
+}
+
+func TestParseKey_AcceptsOpenSSLBoolean(t *testing.T) {
+	key := p256(t)
+	der := decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey))
+	require.Equal(t, 1, bytes.Count(der, derEmptyAuthTrue), "fixture carries one DER emptyAuth TRUE")
+
+	// The same key as tpm2-openssl and tpm2-tss-engine write it: identical apart from
+	// the BOOLEAN content byte.
+	openssl := bytes.Replace(der, derEmptyAuthTrue, opensslEmptyAuthTrue, 1)
+
+	signer, err := ParseKey(openssl)
+	require.NoError(t, err, "BER allows any non-zero byte for TRUE, and OpenSSL writes 0x01")
+	assert.True(t, key.PublicKey.Equal(signer.Public()), "the key is the same either way")
+}
+
+func TestParseKey_AcceptsPersistentParent(t *testing.T) {
+	key := p256(t)
+	// 0x81000001 overflows a 32-bit int, the width the parent used to be decoded into.
+	der := decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey, tpmtest.WithParent(0x81000001)))
+
+	parsed, err := parseTSS2(der)
+	require.NoError(t, err)
+	assert.Equal(t, uint32(0x81000001), parsed.Parent, "persistent parent handle")
+	assert.True(t, persistentHandle(parsed.Parent), "the key is loaded under the persistent parent directly")
+}
+
+func TestParseKey_RejectsParentOutOfRange(t *testing.T) {
+	key := p256(t)
+	for _, parent := range []int64{-1, 0x1_0000_0000, 0x02000000} {
+		_, err := parseTSS2(decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey, tpmtest.WithParent(parent))))
+		assert.ErrorIs(t, err, errBadParent, "parent %#x is neither persistent nor a hierarchy", parent)
+	}
+}
+
+func TestBERBoolean(t *testing.T) {
+	absent, err := berBoolean(asn1.RawValue{})
+	require.NoError(t, err)
+	assert.False(t, absent, "an absent emptyAuth means the key needs authorization")
+
+	for content, want := range map[byte]bool{0x00: false, 0x01: true, 0xff: true} {
+		v := asn1.RawValue{Class: asn1.ClassUniversal, Tag: asn1.TagBoolean, Bytes: []byte{content}, FullBytes: []byte{0x01, 0x01, content}}
+		got, err := berBoolean(v)
+		require.NoError(t, err)
+		assert.Equal(t, want, got, "content byte %#x", content)
+	}
+
+	_, err = berBoolean(asn1.RawValue{Class: asn1.ClassUniversal, Tag: asn1.TagInteger, Bytes: []byte{1}, FullBytes: []byte{0x02, 0x01, 0x01}})
+	assert.Error(t, err, "an INTEGER is not a BOOLEAN")
+}
diff --git a/client/internal/tunnelnotifier/notifier.go b/client/internal/tunnelnotifier/notifier.go
new file mode 100644
index 000000000..b62923a6e
--- /dev/null
+++ b/client/internal/tunnelnotifier/notifier.go
@@ -0,0 +1,124 @@
+package tunnelnotifier
+
+import (
+	"container/list"
+	"sync"
+
+	"github.com/netbirdio/netbird/client/internal/dns"
+	"github.com/netbirdio/netbird/client/internal/listener"
+)
+
+type eventKind int
+
+const (
+	eventRoutes eventKind = iota
+	eventIfaceIP
+	eventIfaceIPv6
+	eventDNS
+)
+
+var (
+	_ listener.NetworkChangeListener = (*Notifier)(nil)
+	_ dns.IosDnsManager              = (*Notifier)(nil)
+)
+
+type event struct {
+	kind    eventKind
+	payload string
+}
+
+type Notifier struct {
+	mu     sync.Mutex
+	cond   *sync.Cond
+	queue  *list.List
+	closed bool
+	done   chan struct{}
+
+	listener   listener.NetworkChangeListener
+	dnsManager dns.IosDnsManager
+}
+
+func New(l listener.NetworkChangeListener, dm dns.IosDnsManager) *Notifier {
+	n := &Notifier{
+		queue:      list.New(),
+		done:       make(chan struct{}),
+		listener:   l,
+		dnsManager: dm,
+	}
+	n.cond = sync.NewCond(&n.mu)
+	go n.deliverLoop()
+	return n
+}
+
+func (n *Notifier) OnNetworkChanged(routes string) {
+	n.enqueue(event{kind: eventRoutes, payload: routes})
+}
+
+func (n *Notifier) SetInterfaceIP(ip string) {
+	n.enqueue(event{kind: eventIfaceIP, payload: ip})
+}
+
+func (n *Notifier) SetInterfaceIPv6(ip string) {
+	n.enqueue(event{kind: eventIfaceIPv6, payload: ip})
+}
+
+func (n *Notifier) ApplyDns(config string) {
+	n.enqueue(event{kind: eventDNS, payload: config})
+}
+
+// Close stops accepting new events and blocks until the delivery loop has
+// drained all queued events and exited.
+func (n *Notifier) Close() {
+	n.mu.Lock()
+	n.closed = true
+	n.cond.Signal()
+	n.mu.Unlock()
+	<-n.done
+}
+
+func (n *Notifier) enqueue(ev event) {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	if n.closed {
+		return
+	}
+	n.queue.PushBack(ev)
+	n.cond.Signal()
+}
+
+func (n *Notifier) deliverLoop() {
+	defer close(n.done)
+	for {
+		n.mu.Lock()
+		for n.queue.Len() == 0 && !n.closed {
+			n.cond.Wait()
+		}
+		if n.closed && n.queue.Len() == 0 {
+			n.mu.Unlock()
+			return
+		}
+		ev := n.queue.Remove(n.queue.Front()).(event)
+		l := n.listener
+		dm := n.dnsManager
+		n.mu.Unlock()
+
+		switch ev.kind {
+		case eventRoutes:
+			if l != nil {
+				l.OnNetworkChanged(ev.payload)
+			}
+		case eventIfaceIP:
+			if l != nil {
+				l.SetInterfaceIP(ev.payload)
+			}
+		case eventIfaceIPv6:
+			if l != nil {
+				l.SetInterfaceIPv6(ev.payload)
+			}
+		case eventDNS:
+			if dm != nil {
+				dm.ApplyDns(ev.payload)
+			}
+		}
+	}
+}
diff --git a/client/internal/tunnelnotifier/notifier_test.go b/client/internal/tunnelnotifier/notifier_test.go
new file mode 100644
index 000000000..ffbcdc15c
--- /dev/null
+++ b/client/internal/tunnelnotifier/notifier_test.go
@@ -0,0 +1,192 @@
+package tunnelnotifier
+
+import (
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type call struct {
+	kind    string
+	payload string
+}
+
+type recorder struct {
+	mu       sync.Mutex
+	calls    []call
+	inFlight atomic.Int32
+	overlap  atomic.Bool
+	delay    time.Duration
+}
+
+func (r *recorder) record(kind, payload string) {
+	if r.inFlight.Add(1) != 1 {
+		r.overlap.Store(true)
+	}
+	if r.delay > 0 {
+		time.Sleep(r.delay)
+	}
+	r.mu.Lock()
+	r.calls = append(r.calls, call{kind: kind, payload: payload})
+	r.mu.Unlock()
+	r.inFlight.Add(-1)
+}
+
+func (r *recorder) count() int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return len(r.calls)
+}
+
+func (r *recorder) snapshot() []call {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	out := make([]call, len(r.calls))
+	copy(out, r.calls)
+	return out
+}
+
+type fakeListener struct {
+	rec *recorder
+}
+
+func (f *fakeListener) OnNetworkChanged(routes string) {
+	f.rec.record("routes", routes)
+}
+
+func (f *fakeListener) SetInterfaceIP(ip string) {
+	f.rec.record("ip", ip)
+}
+
+func (f *fakeListener) SetInterfaceIPv6(ip string) {
+	f.rec.record("ipv6", ip)
+}
+
+type fakeDNSManager struct {
+	rec *recorder
+}
+
+func (f *fakeDNSManager) ApplyDns(config string) {
+	f.rec.record("dns", config)
+}
+
+func TestFIFOOrder(t *testing.T) {
+	rec := &recorder{}
+	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
+	defer n.Close()
+
+	n.SetInterfaceIP("10.0.0.1")
+	n.SetInterfaceIPv6("fd00::1")
+	n.ApplyDns(`{"domains":[]}`)
+	n.OnNetworkChanged("10.0.0.0/8,192.168.0.0/16")
+	n.ApplyDns(`{"domains":["example.com"]}`)
+
+	require.Eventually(t, func() bool { return rec.count() == 5 }, time.Second, time.Millisecond)
+
+	expected := []call{
+		{kind: "ip", payload: "10.0.0.1"},
+		{kind: "ipv6", payload: "fd00::1"},
+		{kind: "dns", payload: `{"domains":[]}`},
+		{kind: "routes", payload: "10.0.0.0/8,192.168.0.0/16"},
+		{kind: "dns", payload: `{"domains":["example.com"]}`},
+	}
+	assert.Equal(t, expected, rec.snapshot())
+}
+
+func TestNoOverlappingCalls(t *testing.T) {
+	rec := &recorder{delay: 100 * time.Microsecond}
+	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
+	defer n.Close()
+
+	const producers = 8
+	const perProducer = 25
+
+	var wg sync.WaitGroup
+	for i := 0; i < producers; i++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			for j := 0; j < perProducer; j++ {
+				payload := fmt.Sprintf("%d-%d", id, j)
+				switch j % 4 {
+				case 0:
+					n.OnNetworkChanged(payload)
+				case 1:
+					n.SetInterfaceIP(payload)
+				case 2:
+					n.SetInterfaceIPv6(payload)
+				case 3:
+					n.ApplyDns(payload)
+				}
+			}
+		}(i)
+	}
+	wg.Wait()
+
+	require.Eventually(t, func() bool { return rec.count() == producers*perProducer }, 5*time.Second, time.Millisecond)
+	assert.False(t, rec.overlap.Load())
+}
+
+func TestDNSAndRoutesInterleaved(t *testing.T) {
+	rec := &recorder{delay: 100 * time.Microsecond}
+	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
+	defer n.Close()
+
+	const events = 50
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < events; i++ {
+			n.ApplyDns(fmt.Sprintf("dns-%d", i))
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		for i := 0; i < events; i++ {
+			n.OnNetworkChanged(fmt.Sprintf("routes-%d", i))
+		}
+	}()
+	wg.Wait()
+
+	require.Eventually(t, func() bool { return rec.count() == 2*events }, 5*time.Second, time.Millisecond)
+	assert.False(t, rec.overlap.Load())
+
+	var dnsSeen, routesSeen int
+	for _, c := range rec.snapshot() {
+		switch c.kind {
+		case "dns":
+			assert.Equal(t, fmt.Sprintf("dns-%d", dnsSeen), c.payload)
+			dnsSeen++
+		case "routes":
+			assert.Equal(t, fmt.Sprintf("routes-%d", routesSeen), c.payload)
+			routesSeen++
+		}
+	}
+	assert.Equal(t, events, dnsSeen)
+	assert.Equal(t, events, routesSeen)
+}
+
+func TestCloseDrainsQueue(t *testing.T) {
+	rec := &recorder{delay: time.Millisecond}
+	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
+
+	const events = 20
+	for i := 0; i < events; i++ {
+		n.OnNetworkChanged(fmt.Sprintf("routes-%d", i))
+	}
+	n.Close()
+
+	require.Equal(t, events, rec.count(), "Close must not return before all queued events are delivered")
+
+	n.OnNetworkChanged("after-close")
+	n.ApplyDns("after-close")
+	time.Sleep(50 * time.Millisecond)
+	assert.Equal(t, events, rec.count())
+}
diff --git a/client/internal/updater/installer/doc.go b/client/internal/updater/installer/doc.go
index 0a60454bb..aff0f24f7 100644
--- a/client/internal/updater/installer/doc.go
+++ b/client/internal/updater/installer/doc.go
@@ -37,23 +37,32 @@
 // Updater Process (Setup):
 //
 //  1. Receives parameters from service via command-line arguments
-//  2. Runs installer with appropriate silent/quiet flags:
+//  2. Terminates the UI so the installer does not have to replace a locked image
+//     file, which would otherwise leave the install needing a reboot
+//  3. Runs installer with appropriate silent/quiet flags:
 //     - Windows EXE: installer.exe /S
-//     - Windows MSI: msiexec.exe /i installer.msi /quiet /qn /l*v msi.log
+//     - Windows MSI: msiexec.exe /i installer.msi /qn /norestart REBOOT=ReallySuppress /l*v msi.log
 //     - macOS PKG: installer -pkg installer.pkg -target /
 //     - macOS Homebrew: brew upgrade netbirdio/tap/netbird
-//  3. Installer terminates daemon and UI processes
-//  4. Installer replaces binaries with new version
-//  5. Updater waits for installer to complete
-//  6. Updater restarts daemon:
+//  4. Installer terminates the daemon
+//  5. Installer replaces binaries with new version
+//  6. Updater waits for installer to complete. On Windows, MSI exit codes 3010
+//     (ERROR_SUCCESS_REBOOT_REQUIRED) and 1641 (ERROR_SUCCESS_REBOOT_INITIATED)
+//     are a pending-reboot outcome, not a failure: the install succeeded, but
+//     some files are only replaced on the next restart (the reboot itself is
+//     suppressed via /norestart and REBOOT=ReallySuppress), and the flow
+//     continues as on success
+//  7. Updater restarts daemon:
 //     - Windows: netbird.exe service start
 //     - macOS/Linux: netbird service start
-//  7. Updater restarts UI:
-//     - Windows: Launches netbird-ui.exe as active console user using CreateProcessAsUser
+//  8. Updater restarts UI:
+//     - Windows: Launches netbird-ui.exe using CreateProcessAsUser in every
+//     session it was terminated in, falling back to the active console session
 //     - macOS: Uses launchctl asuser to launch NetBird.app for console user
 //     - Linux: Not implemented (UI typically auto-starts)
-//  8. Updater writes result.json with success/error status
-//  9. Updater process exits
+//  9. Updater writes result.json with success/error status (a pending reboot is
+//     recorded as success)
+//  10. Updater process exits
 //
 // # Result Communication
 //
@@ -100,6 +109,10 @@
 //   - Does NOT remove result.json (cleaned by ResultHandler after read)
 //   - Does NOT remove msi.log (kept for debugging)
 //
+// On Windows the updater copy is often still locked when the daemon it restarted
+// runs cleanup, so removing it is retried briefly and otherwise left in place for
+// the next update to overwrite rather than reported as a failure.
+//
 // # Dry-Run Mode
 //
 // Dry-run mode allows testing the update process without actually installing:
diff --git a/client/internal/updater/installer/installer_cleanup_windows_test.go b/client/internal/updater/installer/installer_cleanup_windows_test.go
new file mode 100644
index 000000000..aab16dc93
--- /dev/null
+++ b/client/internal/updater/installer/installer_cleanup_windows_test.go
@@ -0,0 +1,67 @@
+package installer
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/windows"
+)
+
+// lockFile opens path without FILE_SHARE_DELETE, so os.Remove fails the way it does
+// while the updater process still holds its own image.
+func lockFile(t *testing.T, path string) windows.Handle {
+	t.Helper()
+
+	p, err := windows.UTF16PtrFromString(path)
+	if err != nil {
+		t.Fatalf("convert path: %v", err)
+	}
+
+	handle, err := windows.CreateFile(p, windows.GENERIC_READ, windows.FILE_SHARE_READ, nil, windows.OPEN_EXISTING, windows.FILE_ATTRIBUTE_NORMAL, 0)
+	if err != nil {
+		t.Fatalf("lock %s: %v", path, err)
+	}
+	return handle
+}
+
+// releaseAfter closes the handle once the delay has passed, standing in for the
+// updater process finally exiting.
+func releaseAfter(t *testing.T, handle windows.Handle, delay time.Duration) {
+	t.Helper()
+
+	released := make(chan struct{})
+	t.Cleanup(func() { <-released })
+
+	go func() {
+		defer close(released)
+		time.Sleep(delay)
+		if err := windows.CloseHandle(handle); err != nil {
+			t.Errorf("close handle: %v", err)
+		}
+	}()
+}
+
+// TestCleanUpInstallerFilesLockedUpdater covers the post-update cleanup race: the
+// daemon cleans up at startup while the updater that restarted it is still exiting,
+// so the updater image is locked and Windows refuses the delete. Cleanup must wait
+// the lock out instead of reporting a failure and leaving the binary behind.
+func TestCleanUpInstallerFilesLockedUpdater(t *testing.T) {
+	tempDir := t.TempDir()
+	path := filepath.Join(tempDir, updaterBinary)
+	if err := os.WriteFile(path, []byte("x"), 0o600); err != nil {
+		t.Fatalf("write updater: %v", err)
+	}
+
+	releaseAfter(t, lockFile(t, path), 300*time.Millisecond)
+
+	u := NewWithDir(tempDir)
+	if err := u.CleanUpInstallerFiles(); err != nil {
+		t.Fatalf("cleanup must tolerate a still-locked updater: %v", err)
+	}
+
+	if _, err := os.Stat(path); !os.IsNotExist(err) {
+		t.Errorf("updater binary still present (stat err: %v)", err)
+	}
+}
diff --git a/client/internal/updater/installer/installer_common.go b/client/internal/updater/installer/installer_common.go
index 8e44bee82..f917424b8 100644
--- a/client/internal/updater/installer/installer_common.go
+++ b/client/internal/updater/installer/installer_common.go
@@ -42,6 +42,9 @@ func NewWithDir(tempDir string) *Installer {
 // This will run by the original service process
 func (u *Installer) RunInstallation(ctx context.Context, targetVersion string) (err error) {
 	resultHandler := NewResultHandler(u.tempDir)
+	if err := resultHandler.ClearStaleResult(); err != nil {
+		log.Warnf("clear stale installer result: %v", err)
+	}
 
 	defer func() {
 		if err != nil {
@@ -149,8 +152,8 @@ func (u *Installer) CleanUpInstallerFiles() error {
 
 	var merr *multierror.Error
 
-	if err := os.Remove(filepath.Join(u.tempDir, updaterBinary)); err != nil && !os.IsNotExist(err) {
-		merr = multierror.Append(merr, fmt.Errorf("failed to remove updater binary: %w", err))
+	if err := removeUpdaterBinary(filepath.Join(u.tempDir, updaterBinary)); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove updater binary: %w", err))
 	}
 
 	entries, err := os.ReadDir(u.tempDir)
@@ -164,10 +167,16 @@ func (u *Installer) CleanUpInstallerFiles() error {
 		}
 
 		name := entry.Name()
+		// The updater copy is handled above; on Windows its name also matches the
+		// extension sweep, which would report the same file twice.
+		if strings.EqualFold(name, updaterBinary) {
+			continue
+		}
+
 		for _, ext := range binaryExtensions {
 			if strings.HasSuffix(strings.ToLower(name), strings.ToLower(ext)) {
 				if err := os.Remove(filepath.Join(u.tempDir, name)); err != nil {
-					merr = multierror.Append(merr, fmt.Errorf("failed to remove %s: %w", name, err))
+					merr = multierror.Append(merr, fmt.Errorf("remove %s: %w", name, err))
 				}
 				break
 			}
diff --git a/client/internal/updater/installer/installer_common_test.go b/client/internal/updater/installer/installer_common_test.go
new file mode 100644
index 000000000..c1556c828
--- /dev/null
+++ b/client/internal/updater/installer/installer_common_test.go
@@ -0,0 +1,52 @@
+//go:build windows || darwin
+
+package installer
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestCleanUpInstallerFiles checks that cleanup removes the updater copy and the
+// downloaded installer while leaving the logs and the result file for the daemon.
+func TestCleanUpInstallerFiles(t *testing.T) {
+	tempDir := t.TempDir()
+
+	installers := make([]string, 0, len(binaryExtensions))
+	for _, ext := range binaryExtensions {
+		installers = append(installers, "netbird_installer."+ext)
+	}
+
+	kept := []string{"installer.log", "result.json"}
+
+	for _, name := range append(append([]string{updaterBinary}, installers...), kept...) {
+		if err := os.WriteFile(filepath.Join(tempDir, name), []byte("x"), 0o600); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+
+	u := NewWithDir(tempDir)
+	if err := u.CleanUpInstallerFiles(); err != nil {
+		t.Fatalf("CleanUpInstallerFiles: %v", err)
+	}
+
+	for _, name := range append([]string{updaterBinary}, installers...) {
+		if _, err := os.Stat(filepath.Join(tempDir, name)); !os.IsNotExist(err) {
+			t.Errorf("%s was not removed (stat err: %v)", name, err)
+		}
+	}
+
+	for _, name := range kept {
+		if _, err := os.Stat(filepath.Join(tempDir, name)); err != nil {
+			t.Errorf("%s should have been kept: %v", name, err)
+		}
+	}
+}
+
+func TestCleanUpInstallerFilesMissingTempDir(t *testing.T) {
+	u := NewWithDir(filepath.Join(t.TempDir(), "does-not-exist"))
+	if err := u.CleanUpInstallerFiles(); err != nil {
+		t.Errorf("a missing temp dir is not a cleanup failure, got: %v", err)
+	}
+}
diff --git a/client/internal/updater/installer/installer_run_darwin.go b/client/internal/updater/installer/installer_run_darwin.go
index 248a404aa..5650bc769 100644
--- a/client/internal/updater/installer/installer_run_darwin.go
+++ b/client/internal/updater/installer/installer_run_darwin.go
@@ -98,47 +98,44 @@ func (u *Installer) startDaemon(daemonFolder string) error {
 func (u *Installer) startUIAsUser() error {
 	log.Infof("starting netbird-ui: %s", uiBinary)
 
-	// Get the current console user
-	cmd := exec.Command("stat", "-f", "%Su", "/dev/console")
-	output, err := cmd.Output()
+	username, err := consoleUser()
 	if err != nil {
-		return fmt.Errorf("failed to get console user: %w", err)
+		return err
 	}
 
-	username := strings.TrimSpace(string(output))
-	if username == "" || username == "root" {
-		return fmt.Errorf("no active user session found")
-	}
-
-	log.Infof("starting UI for user: %s", username)
-
-	// Get user's UID
 	userInfo, err := user.Lookup(username)
 	if err != nil {
-		return fmt.Errorf("failed to lookup user %s: %w", username, err)
+		return fmt.Errorf("lookup user %s: %w", username, err)
 	}
 
-	// Start the UI process as the console user using launchctl
-	// This ensures the app runs in the user's context with proper GUI access
-	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "open", "-a", uiBinary)
+	log.Infof("starting UI for user: %s (uid %s)", username, userInfo.Uid)
+
+	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "sudo", "-u", username, "-H", "open", "-a", uiBinary)
 	log.Infof("launchCmd: %s", launchCmd.String())
-	// Set the user's home directory for proper macOS app behavior
-	launchCmd.Env = append(os.Environ(), "HOME="+userInfo.HomeDir)
-	log.Infof("set HOME environment variable: %s", userInfo.HomeDir)
 
-	if err := launchCmd.Start(); err != nil {
-		return fmt.Errorf("failed to start UI process: %w", err)
-	}
-
-	// Release the process so it can run independently
-	if err := launchCmd.Process.Release(); err != nil {
-		log.Warnf("failed to release UI process: %v", err)
+	if err := launchCmd.Run(); err != nil {
+		return fmt.Errorf("run UI launch: %w", err)
 	}
 
 	log.Infof("netbird-ui started successfully for user %s", username)
 	return nil
 }
 
+func consoleUser() (string, error) {
+	output, err := exec.Command("stat", "-f", "%Su", "/dev/console").Output()
+	if err != nil {
+		return "", fmt.Errorf("get console user: %w", err)
+	}
+
+	username := strings.TrimSpace(string(output))
+	switch username {
+	case "", "root", "loginwindow", "_mbsetupuser":
+		return "", fmt.Errorf("no active GUI user session, console user: %q", username)
+	}
+
+	return username, nil
+}
+
 func (u *Installer) installPkgFile(ctx context.Context, path string) error {
 	log.Infof("installing pkg file: %s", path)
 
diff --git a/client/internal/updater/installer/installer_run_windows.go b/client/internal/updater/installer/installer_run_windows.go
index 70c7e32cf..b2ecf3299 100644
--- a/client/internal/updater/installer/installer_run_windows.go
+++ b/client/internal/updater/installer/installer_run_windows.go
@@ -2,6 +2,7 @@ package installer
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -22,6 +23,12 @@ const (
 
 	msiLogFile = "msi.log"
 
+	// ERROR_SUCCESS_REBOOT_REQUIRED and ERROR_SUCCESS_REBOOT_INITIATED
+	msiRebootRequired  = 3010
+	msiRebootInitiated = 1641
+
+	processExitWait = 10 * time.Second
+
 	msiDownloadURL = "https://github.com/netbirdio/netbird/releases/download/v%version/netbird_installer_%version_windows_%arch.msi"
 	exeDownloadURL = "https://github.com/netbirdio/netbird/releases/download/v%version/netbird_installer_%version_windows_%arch.exe"
 )
@@ -38,6 +45,8 @@ var (
 func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string, daemonFolder string) (resultErr error) {
 	resultHandler := NewResultHandler(u.tempDir)
 
+	var uiSessions []uint32
+
 	// Always ensure daemon and UI are restarted after setup
 	defer func() {
 		log.Infof("starting daemon back")
@@ -46,7 +55,7 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 		}
 
 		log.Infof("starting UI back")
-		if err := u.startUIAsUser(daemonFolder); err != nil {
+		if err := u.startUI(daemonFolder, uiSessions); err != nil {
 			log.Errorf("failed to start UI: %v", err)
 		}
 
@@ -75,6 +84,14 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 		return
 	}
 
+	// The UI holds an open handle on its own image. Left running, Restart Manager
+	// cannot shut it down (msiexec runs as LocalSystem here, the UI as the
+	// interactive user), so the MSI falls back to replacing the file on reboot and
+	// marks the install as restart-required. The deferred close-application action
+	// in the package runs too late to prevent that, it happens after
+	// InstallValidate has already registered the file as in use.
+	uiSessions = killUI()
+
 	var cmd *exec.Cmd
 	switch installerType {
 	case TypeExe:
@@ -84,7 +101,9 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 		installerDir := filepath.Dir(installerFile)
 		logPath := filepath.Join(installerDir, msiLogFile)
 		log.Infof("run msi installer: %s", installerFile)
-		cmd = exec.CommandContext(ctx, "msiexec.exe", "/i", filepath.Base(installerFile), "/quiet", "/qn", "/l*v", logPath)
+		// REBOOT=ReallySuppress: a silent install has no way to ask, so without it
+		// msiexec reboots the machine on its own if it decides one is needed.
+		cmd = exec.CommandContext(ctx, "msiexec.exe", "/i", filepath.Base(installerFile), "/qn", "/norestart", "REBOOT=ReallySuppress", "/l*v", logPath)
 	}
 
 	cmd.Dir = filepath.Dir(installerFile)
@@ -95,9 +114,13 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 	}
 
 	log.Infof("installer started with PID %d", cmd.Process.Pid)
-	if resultErr = cmd.Wait(); resultErr != nil {
-		log.Errorf("installer process finished with error: %v", resultErr)
-		return
+	if err := cmd.Wait(); err != nil {
+		if !isRebootPending(err) {
+			resultErr = err
+			log.Errorf("installer process finished with error: %v", err)
+			return
+		}
+		log.Warnf("installer completed but reported a pending reboot, some files will be replaced on the next restart")
 	}
 
 	return nil
@@ -117,16 +140,142 @@ func (u *Installer) startDaemon(daemonFolder string) error {
 	return nil
 }
 
-func (u *Installer) startUIAsUser(daemonFolder string) error {
+func (u *Installer) startUI(daemonFolder string, sessionIDs []uint32) error {
 	uiPath := filepath.Join(daemonFolder, uiName)
 	log.Infof("starting netbird-ui: %s", uiPath)
 
-	// Get the active console session ID
-	sessionID := windows.WTSGetActiveConsoleSessionId()
-	if sessionID == 0xFFFFFFFF {
-		return fmt.Errorf("no active user session found")
+	if len(sessionIDs) == 0 {
+		sessionID := windows.WTSGetActiveConsoleSessionId()
+		if sessionID == 0xFFFFFFFF {
+			return fmt.Errorf("no active user session found")
+		}
+		sessionIDs = []uint32{sessionID}
 	}
 
+	var errs []error
+	for _, sessionID := range sessionIDs {
+		if err := startUIInSession(uiPath, sessionID); err != nil {
+			errs = append(errs, fmt.Errorf("session %d: %w", sessionID, err))
+			continue
+		}
+		log.Infof("netbird-ui started successfully in session %d", sessionID)
+	}
+	return errors.Join(errs...)
+}
+
+// isRebootPending reports whether the installer exit code means it succeeded but
+// left work for the next restart. The reboot itself is suppressed, so this is not
+// a failure.
+func isRebootPending(err error) bool {
+	var exitErr *exec.ExitError
+	if !errors.As(err, &exitErr) {
+		return false
+	}
+
+	switch exitErr.ExitCode() {
+	case msiRebootRequired, msiRebootInitiated:
+		return true
+	default:
+		return false
+	}
+}
+
+// killUI terminates any running netbird-ui process and returns the IDs of the
+// interactive sessions the terminated processes belonged to. Setup starts the
+// UI again in those sessions once the installer is done.
+func killUI() []uint32 {
+	pids, err := processIDsByName(uiName)
+	if err != nil {
+		log.Warnf("failed to look up %s processes: %v", uiName, err)
+		return nil
+	}
+
+	sessions := make(map[uint32]struct{})
+	for _, pid := range pids {
+		var sessionID uint32
+		if err := windows.ProcessIdToSessionId(pid, &sessionID); err != nil {
+			log.Warnf("failed to look up session of %s (PID %d): %v", uiName, pid, err)
+		}
+
+		if err := terminateProcess(pid); err != nil {
+			log.Warnf("failed to terminate %s (PID %d): %v", uiName, pid, err)
+			continue
+		}
+		log.Infof("terminated %s (PID %d) in session %d", uiName, pid, sessionID)
+
+		if sessionID != 0 {
+			sessions[sessionID] = struct{}{}
+		}
+	}
+
+	sessionIDs := make([]uint32, 0, len(sessions))
+	for sessionID := range sessions {
+		sessionIDs = append(sessionIDs, sessionID)
+	}
+	return sessionIDs
+}
+
+func processIDsByName(name string) ([]uint32, error) {
+	snapshot, err := windows.CreateToolhelp32Snapshot(windows.TH32CS_SNAPPROCESS, 0)
+	if err != nil {
+		return nil, fmt.Errorf("create process snapshot: %w", err)
+	}
+	defer func() {
+		if err := windows.CloseHandle(snapshot); err != nil {
+			log.Warnf("failed to close process snapshot: %v", err)
+		}
+	}()
+
+	var entry windows.ProcessEntry32
+	entry.Size = uint32(unsafe.Sizeof(entry))
+
+	var pids []uint32
+	for err = windows.Process32First(snapshot, &entry); err == nil; err = windows.Process32Next(snapshot, &entry) {
+		if strings.EqualFold(windows.UTF16ToString(entry.ExeFile[:]), name) {
+			pids = append(pids, entry.ProcessID)
+		}
+	}
+	if !errors.Is(err, windows.ERROR_NO_MORE_FILES) {
+		return nil, fmt.Errorf("enumerate processes: %w", err)
+	}
+
+	return pids, nil
+}
+
+func terminateProcess(pid uint32) error {
+	handle, err := windows.OpenProcess(windows.PROCESS_TERMINATE|windows.SYNCHRONIZE, false, pid)
+	if err != nil {
+		// The process may have exited between enumeration and now.
+		if errors.Is(err, windows.ERROR_INVALID_PARAMETER) {
+			return nil
+		}
+		return fmt.Errorf("open process: %w", err)
+	}
+	defer func() {
+		if err := windows.CloseHandle(handle); err != nil {
+			log.Warnf("failed to close process handle: %v", err)
+		}
+	}()
+
+	if err := windows.TerminateProcess(handle, 0); err != nil {
+		return fmt.Errorf("terminate process: %w", err)
+	}
+
+	// Wait for the handle to signal so the image file is released before the
+	// installer tries to overwrite it. A timeout is reported through the returned
+	// event, not through err, which stays nil unless the wait itself failed.
+	event, err := windows.WaitForSingleObject(handle, uint32(processExitWait.Milliseconds()))
+	if err != nil {
+		return fmt.Errorf("wait for process exit: %w", err)
+	}
+	if event != windows.WAIT_OBJECT_0 {
+		return fmt.Errorf("wait for process exit: unexpected wait result %#x", event)
+	}
+
+	return nil
+}
+
+func startUIInSession(uiPath string, sessionID uint32) error {
 	// Get the user token for that session
 	var userToken windows.Token
 	err := windows.WTSQueryUserToken(sessionID, &userToken)
@@ -158,6 +307,16 @@ func (u *Installer) startUIAsUser(daemonFolder string) error {
 		}
 	}()
 
+	var env *uint16
+	if err := windows.CreateEnvironmentBlock(&env, primaryToken, false); err != nil {
+		return fmt.Errorf("create environment block: %w", err)
+	}
+	defer func() {
+		if err := windows.DestroyEnvironmentBlock(env); err != nil {
+			log.Warnf("failed to destroy environment block: %v", err)
+		}
+	}()
+
 	// Prepare startup info
 	var si windows.StartupInfo
 	si.Cb = uint32(unsafe.Sizeof(si))
@@ -180,7 +339,7 @@ func (u *Installer) startUIAsUser(daemonFolder string) error {
 		nil,
 		false,
 		creationFlags,
-		nil,
+		env,
 		nil,
 		&si,
 		&pi,
@@ -197,7 +356,6 @@ func (u *Installer) startUIAsUser(daemonFolder string) error {
 		log.Warnf("failed to close thread handle: %v", err)
 	}
 
-	log.Infof("netbird-ui started successfully in session %d", sessionID)
 	return nil
 }
 
diff --git a/client/internal/updater/installer/installer_run_windows_test.go b/client/internal/updater/installer/installer_run_windows_test.go
new file mode 100644
index 000000000..6a4540610
--- /dev/null
+++ b/client/internal/updater/installer/installer_run_windows_test.go
@@ -0,0 +1,108 @@
+package installer
+
+import (
+	"errors"
+	"os/exec"
+	"slices"
+	"strconv"
+	"testing"
+)
+
+// exitErrorWithCode returns a real *exec.ExitError carrying the given exit code.
+func exitErrorWithCode(t *testing.T, code int) error {
+	t.Helper()
+
+	err := exec.Command("cmd.exe", "/c", "exit "+strconv.Itoa(code)).Run()
+	if err == nil {
+		t.Fatalf("expected a non-zero exit for code %d", code)
+	}
+	return err
+}
+
+func TestIsRebootPending(t *testing.T) {
+	tests := []struct {
+		name string
+		code int
+		want bool
+	}{
+		{name: "reboot required", code: msiRebootRequired, want: true},
+		{name: "reboot initiated", code: msiRebootInitiated, want: true},
+		{name: "generic failure", code: 1603, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isRebootPending(exitErrorWithCode(t, tt.code)); got != tt.want {
+				t.Errorf("isRebootPending(exit %d) = %v, want %v", tt.code, got, tt.want)
+			}
+		})
+	}
+}
+
+// TestProcessIDsByNameAndTerminate spawns a long-running system process, finds it
+// by name and terminates it, covering the path the updater uses to release the UI
+// image file before the installer replaces it.
+func TestProcessIDsByNameAndTerminate(t *testing.T) {
+	cmd := exec.Command("ping.exe", "-n", "60", "127.0.0.1")
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("start ping: %v", err)
+	}
+
+	pid := uint32(cmd.Process.Pid)
+	killed := false
+	t.Cleanup(func() {
+		if !killed {
+			_ = cmd.Process.Kill()
+		}
+		_ = cmd.Wait()
+	})
+
+	// Name matching must be case-insensitive: the snapshot reports PING.EXE.
+	pids, err := processIDsByName("ping.exe")
+	if err != nil {
+		t.Fatalf("processIDsByName: %v", err)
+	}
+
+	if !slices.Contains(pids, pid) {
+		t.Fatalf("PID %d not among the ping.exe processes found: %v", pid, pids)
+	}
+
+	if err := terminateProcess(pid); err != nil {
+		t.Fatalf("terminateProcess: %v", err)
+	}
+	killed = true
+
+	// terminateProcess only returns once the handle has signalled, so the process
+	// is already gone and Wait must not block. It exits with the code passed to
+	// TerminateProcess, which is 0, so Wait reports no error.
+	if err := cmd.Wait(); err != nil {
+		t.Fatalf("wait for terminated ping: %v", err)
+	}
+	if !cmd.ProcessState.Exited() {
+		t.Error("process did not exit after terminateProcess")
+	}
+
+	remaining, err := processIDsByName("ping.exe")
+	if err != nil {
+		t.Fatalf("processIDsByName after terminate: %v", err)
+	}
+	if slices.Contains(remaining, pid) {
+		t.Errorf("PID %d still listed after terminateProcess", pid)
+	}
+}
+
+func TestProcessIDsByNameNoMatch(t *testing.T) {
+	pids, err := processIDsByName("netbird-nonexistent-process.exe")
+	if err != nil {
+		t.Fatalf("processIDsByName: %v", err)
+	}
+	if len(pids) != 0 {
+		t.Errorf("expected no matches, got %v", pids)
+	}
+}
+
+func TestIsRebootPendingNonExitError(t *testing.T) {
+	if isRebootPending(errors.New("start installer: file not found")) {
+		t.Error("a non-exit error must not be treated as a pending reboot")
+	}
+}
diff --git a/client/internal/updater/installer/remove_updater_darwin.go b/client/internal/updater/installer/remove_updater_darwin.go
new file mode 100644
index 000000000..4d4a0be60
--- /dev/null
+++ b/client/internal/updater/installer/remove_updater_darwin.go
@@ -0,0 +1,12 @@
+package installer
+
+import "os"
+
+// removeUpdaterBinary deletes the updater copy left in the temp dir. On darwin a
+// running binary can be unlinked, so no retry is needed.
+func removeUpdaterBinary(path string) error {
+	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}
diff --git a/client/internal/updater/installer/remove_updater_windows.go b/client/internal/updater/installer/remove_updater_windows.go
new file mode 100644
index 000000000..0e23b1644
--- /dev/null
+++ b/client/internal/updater/installer/remove_updater_windows.go
@@ -0,0 +1,45 @@
+package installer
+
+import (
+	"errors"
+	"os"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+const (
+	// The updater is the process that restarted the daemon, so when the daemon
+	// cleans up at startup the updater is often still exiting and Windows refuses
+	// to delete its locked image. These bound how long cleanup waits for it.
+	updaterRemoveAttempts = 5
+	updaterRemoveDelay    = 200 * time.Millisecond
+)
+
+// removeUpdaterBinary deletes the updater copy left in the temp dir, retrying
+// while the still-exiting updater process holds its image. A binary that stays
+// locked for the whole window is left in place and reported at info level: the
+// next update overwrites it, so it is not worth failing cleanup over.
+func removeUpdaterBinary(path string) error {
+	for attempt := 0; attempt < updaterRemoveAttempts; attempt++ {
+		if attempt > 0 {
+			time.Sleep(updaterRemoveDelay)
+		}
+
+		err := os.Remove(path)
+		if err == nil || os.IsNotExist(err) {
+			return nil
+		}
+		if !isFileLocked(err) {
+			return err
+		}
+	}
+
+	log.Infof("updater binary %s is still locked, leaving it for the next update to overwrite", path)
+	return nil
+}
+
+func isFileLocked(err error) bool {
+	return errors.Is(err, windows.ERROR_ACCESS_DENIED) || errors.Is(err, windows.ERROR_SHARING_VIOLATION)
+}
diff --git a/client/internal/updater/installer/remove_updater_windows_test.go b/client/internal/updater/installer/remove_updater_windows_test.go
new file mode 100644
index 000000000..09910d034
--- /dev/null
+++ b/client/internal/updater/installer/remove_updater_windows_test.go
@@ -0,0 +1,59 @@
+package installer
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/windows"
+)
+
+func TestRemoveUpdaterBinaryRetriesWhileLocked(t *testing.T) {
+	path := filepath.Join(t.TempDir(), updaterBinary)
+	if err := os.WriteFile(path, []byte("x"), 0o600); err != nil {
+		t.Fatalf("write updater: %v", err)
+	}
+
+	releaseAfter(t, lockFile(t, path), updaterRemoveDelay+50*time.Millisecond)
+
+	if err := removeUpdaterBinary(path); err != nil {
+		t.Fatalf("removeUpdaterBinary: %v", err)
+	}
+
+	if _, err := os.Stat(path); !os.IsNotExist(err) {
+		t.Errorf("updater binary still present (stat err: %v)", err)
+	}
+}
+
+// TestRemoveUpdaterBinaryStaysLocked covers an updater that never releases its
+// image within the retry window. Cleanup gives up quietly and leaves the file
+// behind rather than reporting a failure.
+func TestRemoveUpdaterBinaryStaysLocked(t *testing.T) {
+	path := filepath.Join(t.TempDir(), updaterBinary)
+	if err := os.WriteFile(path, []byte("x"), 0o600); err != nil {
+		t.Fatalf("write updater: %v", err)
+	}
+
+	handle := lockFile(t, path)
+	t.Cleanup(func() {
+		if err := windows.CloseHandle(handle); err != nil {
+			t.Errorf("close handle: %v", err)
+		}
+	})
+
+	if err := removeUpdaterBinary(path); err != nil {
+		t.Fatalf("a permanently locked updater is not a cleanup failure, got: %v", err)
+	}
+
+	if _, err := os.Stat(path); err != nil {
+		t.Errorf("locked updater binary should be left in place, stat: %v", err)
+	}
+}
+
+func TestRemoveUpdaterBinaryMissingFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), updaterBinary)
+	if err := removeUpdaterBinary(path); err != nil {
+		t.Errorf("a missing updater binary is not a failure, got: %v", err)
+	}
+}
diff --git a/client/internal/updater/installer/result.go b/client/internal/updater/installer/result.go
index 526c3eb53..55a0d8ac8 100644
--- a/client/internal/updater/installer/result.go
+++ b/client/internal/updater/installer/result.go
@@ -54,6 +54,12 @@ func (rh *ResultHandler) GetErrorResultReason() string {
 	return ""
 }
 
+// ClearStaleResult removes a result file left over from a previous installation
+// attempt so result watchers cannot read an outdated outcome for the current attempt.
+func (rh *ResultHandler) ClearStaleResult() error {
+	return rh.cleanup()
+}
+
 func (rh *ResultHandler) WriteSuccess() error {
 	result := Result{
 		Success:    true,
diff --git a/client/internal/updater/manager.go b/client/internal/updater/manager.go
index 7fc300739..c730713d3 100644
--- a/client/internal/updater/manager.go
+++ b/client/internal/updater/manager.go
@@ -21,8 +21,16 @@ const (
 	latestVersion = "latest"
 )
 
+const (
+	modeUndecided updateMode = iota
+	modeDownloadOnly
+	modeManaged
+)
+
 var errNoUpdateState = errors.New("no update state found")
 
+type updateMode int
+
 type UpdateState struct {
 	PreUpdateVersion string
 	TargetVersion    string
@@ -36,8 +44,9 @@ type Manager struct {
 	statusRecorder *peer.Status
 	stateManager   *statemanager.Manager
 
-	downloadOnly bool // true when no enforcement from management; notifies UI to download latest
-	forceUpdate  bool // true when management sets AlwaysUpdate; skips UI interaction and installs directly
+	mode        updateMode
+	modeGen     uint64
+	forceUpdate bool // true when management sets AlwaysUpdate; skips UI interaction and installs directly
 
 	lastTrigger    time.Time
 	mgmUpdateChan  chan struct{}
@@ -54,7 +63,7 @@ type Manager struct {
 	pendingVersion *v.Version
 
 	// updateMutex protects update, expectedVersion, updateToLatestVersion,
-	// downloadOnly, forceUpdate, pendingVersion, and lastTrigger fields
+	// mode, modeGen, forceUpdate, pendingVersion, and lastTrigger fields
 	updateMutex sync.Mutex
 
 	// installMutex and installing guard against concurrent installation attempts
@@ -76,7 +85,6 @@ func NewManager(statusRecorder *peer.Status, stateManager *statemanager.Manager)
 		updateChannel:       make(chan struct{}, 1),
 		currentVersion:      version.NetbirdVersion(),
 		update:              version.NewUpdate("nb/client"),
-		downloadOnly:        true,
 		autoUpdateSupported: isAutoUpdateSupported,
 	}
 
@@ -151,11 +159,7 @@ func (m *Manager) Start(ctx context.Context) {
 
 func (m *Manager) SetDownloadOnly() {
 	m.updateMutex.Lock()
-	m.downloadOnly = true
-	m.forceUpdate = false
-	m.expectedVersion = nil
-	m.updateToLatestVersion = false
-	m.lastTrigger = time.Time{}
+	m.setModeLocked(modeDownloadOnly)
 	m.updateMutex.Unlock()
 
 	select {
@@ -169,6 +173,7 @@ func (m *Manager) SetVersion(expectedVersion string, forceUpdate bool) {
 
 	if !m.autoUpdateSupported() {
 		log.Warnf("auto-update not supported on this platform")
+		m.SetDownloadOnly()
 		return
 	}
 
@@ -177,30 +182,32 @@ func (m *Manager) SetVersion(expectedVersion string, forceUpdate bool) {
 
 	if expectedVersion == "" {
 		log.Errorf("empty expected version provided")
-		m.expectedVersion = nil
-		m.updateToLatestVersion = false
-		m.downloadOnly = true
+		m.setModeLocked(modeDownloadOnly)
 		return
 	}
 
-	if expectedVersion == latestVersion {
-		m.updateToLatestVersion = true
-		m.expectedVersion = nil
-	} else {
-		expectedSemVer, err := v.NewVersion(expectedVersion)
+	var expectedSemVer *v.Version
+	if expectedVersion != latestVersion {
+		parsed, err := v.NewVersion(expectedVersion)
 		if err != nil {
-			log.Errorf("error parsing version: %v", err)
+			log.Errorf("error parsing version, switching to download-only: %v", err)
+			m.setModeLocked(modeDownloadOnly)
+			select {
+			case m.mgmUpdateChan <- struct{}{}:
+			default:
+			}
 			return
 		}
-		if m.expectedVersion != nil && m.expectedVersion.Equal(expectedSemVer) {
-			return
-		}
-		m.expectedVersion = expectedSemVer
-		m.updateToLatestVersion = false
+		expectedSemVer = parsed
 	}
 
-	m.lastTrigger = time.Time{}
-	m.downloadOnly = false
+	if m.sameDirectiveLocked(expectedSemVer, forceUpdate) {
+		return
+	}
+
+	m.setModeLocked(modeManaged)
+	m.expectedVersion = expectedSemVer
+	m.updateToLatestVersion = expectedSemVer == nil
 	m.forceUpdate = forceUpdate
 
 	select {
@@ -209,6 +216,13 @@ func (m *Manager) SetVersion(expectedVersion string, forceUpdate bool) {
 	}
 }
 
+func (m *Manager) ResetMode() {
+	m.updateMutex.Lock()
+	defer m.updateMutex.Unlock()
+
+	m.setModeLocked(modeUndecided)
+}
+
 // Install triggers the installation of the pending version. It is called when the user clicks the install button in the UI.
 func (m *Manager) Install(ctx context.Context) error {
 	if !m.autoUpdateSupported() {
@@ -255,12 +269,17 @@ func (m *Manager) NotifyUI() {
 		m.updateMutex.Unlock()
 		return
 	}
-	downloadOnly := m.downloadOnly
+	mode := m.mode
+	gen := m.modeGen
 	pendingVersion := m.pendingVersion
 	latestVersion := m.update.LatestVersion()
 	m.updateMutex.Unlock()
 
-	if downloadOnly {
+	if mode == modeUndecided {
+		return
+	}
+
+	if mode == modeDownloadOnly {
 		if latestVersion == nil {
 			return
 		}
@@ -268,6 +287,9 @@ func (m *Manager) NotifyUI() {
 		if err != nil || currentVersion.GreaterThanOrEqual(latestVersion) {
 			return
 		}
+		if m.modeChanged(gen) {
+			return
+		}
 		m.statusRecorder.PublishEvent(
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
@@ -278,7 +300,7 @@ func (m *Manager) NotifyUI() {
 		return
 	}
 
-	if pendingVersion != nil {
+	if pendingVersion != nil && !m.modeChanged(gen) {
 		m.statusRecorder.PublishEvent(
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
@@ -343,13 +365,18 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 		return
 	}
 
-	downloadOnly := m.downloadOnly
+	mode := m.mode
+	gen := m.modeGen
 	forceUpdate := m.forceUpdate
 	curLatestVersion := m.update.LatestVersion()
 
 	switch {
+	case mode == modeUndecided:
+		log.Tracef("auto-update mode not decided yet")
+		m.updateMutex.Unlock()
+		return
 	// Download-only mode or resolve "latest" to actual version
-	case downloadOnly, m.updateToLatestVersion:
+	case mode == modeDownloadOnly, m.updateToLatestVersion:
 		if curLatestVersion == nil {
 			log.Tracef("latest version not fetched yet")
 			m.updateMutex.Unlock()
@@ -374,12 +401,17 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 	m.lastTrigger = time.Now()
 	log.Infof("new version available: %s", updateVersion)
 
-	if !downloadOnly && !forceUpdate {
+	if mode == modeManaged && !forceUpdate {
 		m.pendingVersion = updateVersion
 	}
 	m.updateMutex.Unlock()
 
-	if downloadOnly {
+	if m.modeChanged(gen) {
+		log.Debugf("auto-update mode changed while checking %s, discarding", updateVersion)
+		return
+	}
+
+	if mode == modeDownloadOnly {
 		m.statusRecorder.PublishEvent(
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
@@ -406,6 +438,33 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 	)
 }
 
+func (m *Manager) modeChanged(gen uint64) bool {
+	m.updateMutex.Lock()
+	defer m.updateMutex.Unlock()
+
+	return m.modeGen != gen
+}
+
+func (m *Manager) sameDirectiveLocked(expectedVersion *v.Version, forceUpdate bool) bool {
+	if m.mode != modeManaged || m.forceUpdate != forceUpdate {
+		return false
+	}
+	if expectedVersion == nil {
+		return m.updateToLatestVersion
+	}
+	return m.expectedVersion != nil && m.expectedVersion.Equal(expectedVersion)
+}
+
+func (m *Manager) setModeLocked(mode updateMode) {
+	m.mode = mode
+	m.modeGen++
+	m.forceUpdate = false
+	m.expectedVersion = nil
+	m.updateToLatestVersion = false
+	m.pendingVersion = nil
+	m.lastTrigger = time.Time{}
+}
+
 func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error {
 	m.statusRecorder.PublishEvent(
 		cProto.SystemEvent_CRITICAL,
@@ -435,7 +494,7 @@ func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error
 	}
 
 	inst := installer.New()
-	if err := inst.RunInstallation(ctx, pendingVersion.String()); err != nil {
+	if err := inst.RunInstallation(ctx, pendingVersion.String()); err != nil { //nolint:staticcheck // always errors on platforms without an installer
 		log.Errorf("error triggering update: %v", err)
 		m.statusRecorder.PublishEvent(
 			cProto.SystemEvent_ERROR,
diff --git a/client/internal/updater/manager_linux_test.go b/client/internal/updater/manager_linux_test.go
index b05dd7e7d..4501ddde7 100644
--- a/client/internal/updater/manager_linux_test.go
+++ b/client/internal/updater/manager_linux_test.go
@@ -16,7 +16,7 @@ import (
 )
 
 // On Linux, only Mode 1 (downloadOnly) is supported.
-// SetVersion is a no-op because auto-update installation is not supported.
+// SetVersion falls back to download-only because auto-update installation is not supported.
 
 func Test_LatestVersion_Linux(t *testing.T) {
 	testMatrix := []struct {
@@ -70,7 +70,7 @@ func Test_LatestVersion_Linux(t *testing.T) {
 			t.Errorf("%s: Initial version mismatch, expected %v, got %v", c.name, c.initialLatestVersion.String(), ver)
 		}
 
-		mockUpdate.latestVersion = c.latestVersion
+		mockUpdate.setLatestVersion(c.latestVersion)
 		mockUpdate.onUpdate()
 
 		ver, enforced = waitForUpdateEvent(sub, 500*time.Millisecond)
@@ -89,22 +89,24 @@ func Test_LatestVersion_Linux(t *testing.T) {
 	}
 }
 
-func Test_SetVersion_NoOp_Linux(t *testing.T) {
-	// On Linux, SetVersion should be a no-op — no events fired
-	tmpFile := path.Join(t.TempDir(), "update-test-noop.json")
+func Test_SetVersion_FallsBackToDownloadOnly_Linux(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-fallback.json")
 	recorder := peer.NewRecorder("")
 	sub := recorder.SubscribeToEvents()
 	defer recorder.UnsubscribeFromEvents(sub)
 
 	m := NewManager(recorder, statemanager.New(tmpFile))
-	m.update = &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.1"))}
+	m.update = &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.5"))}
 	m.currentVersion = "1.0.0"
 	m.Start(context.Background())
 	m.SetVersion("1.0.1", false)
 
-	ver, _ := waitForUpdateEvent(sub, 500*time.Millisecond)
-	if ver != "" {
-		t.Errorf("SetVersion should be a no-op on Linux, but got event with version %s", ver)
+	ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.5" {
+		t.Fatalf("expected download-only event for fetched 1.0.5, got %q", ver)
+	}
+	if enforced {
+		t.Error("Linux fallback must never have enforced metadata")
 	}
 
 	m.Stop()
diff --git a/client/internal/updater/manager_mode_test.go b/client/internal/updater/manager_mode_test.go
new file mode 100644
index 000000000..aa238f94c
--- /dev/null
+++ b/client/internal/updater/manager_mode_test.go
@@ -0,0 +1,217 @@
+package updater
+
+import (
+	"context"
+	"path"
+	"testing"
+	"time"
+
+	v "github.com/hashicorp/go-version"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/statemanager"
+)
+
+func Test_UndecidedMode_SuppressesNotification(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-undecided.json")
+	recorder := peer.NewRecorder("")
+	sub := recorder.SubscribeToEvents()
+	defer recorder.UnsubscribeFromEvents(sub)
+
+	mockUpdate := &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.1"))}
+	m := NewManager(recorder, statemanager.New(tmpFile))
+	m.update = mockUpdate
+	m.currentVersion = "1.0.0"
+	m.Start(context.Background())
+	defer m.Stop()
+
+	mockUpdate.onUpdate()
+	if ver, _ := waitForUpdateEvent(sub, 300*time.Millisecond); ver != "" {
+		t.Fatalf("undecided mode must not publish, got %q", ver)
+	}
+
+	m.NotifyUI()
+	if ver, _ := waitForUpdateEvent(sub, 300*time.Millisecond); ver != "" {
+		t.Fatalf("NotifyUI in undecided mode must not publish, got %q", ver)
+	}
+
+	m.SetDownloadOnly()
+	ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.1" {
+		t.Fatalf("expected download-only event for 1.0.1, got %q", ver)
+	}
+	if enforced {
+		t.Error("download-only event must not carry enforced metadata")
+	}
+}
+
+func Test_ResetMode_ReturnsToUndecided(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-reset.json")
+	recorder := peer.NewRecorder("")
+	sub := recorder.SubscribeToEvents()
+	defer recorder.UnsubscribeFromEvents(sub)
+
+	mockUpdate := &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.1"))}
+	m := NewManager(recorder, statemanager.New(tmpFile))
+	m.update = mockUpdate
+	m.currentVersion = "1.0.0"
+	m.autoUpdateSupported = func() bool { return true }
+	m.Start(context.Background())
+	defer m.Stop()
+
+	m.SetVersion("1.0.1", false)
+	ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.1" || !enforced {
+		t.Fatalf("expected enforced event for 1.0.1, got %q enforced=%v", ver, enforced)
+	}
+
+	m.ResetMode()
+
+	mockUpdate.onUpdate()
+	if ver, _ := waitForUpdateEvent(sub, 300*time.Millisecond); ver != "" {
+		t.Fatalf("reset mode must not publish on fetch, got %q", ver)
+	}
+
+	m.NotifyUI()
+	if ver, _ := waitForUpdateEvent(sub, 300*time.Millisecond); ver != "" {
+		t.Fatalf("NotifyUI after reset must not publish, got %q", ver)
+	}
+
+	if err := m.Install(context.Background()); err == nil {
+		t.Fatal("Install after reset must fail without a pending version")
+	}
+
+	m.SetVersion("1.0.1", false)
+	ver, enforced = waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.1" || !enforced {
+		t.Fatalf("expected enforced event again after reset, got %q enforced=%v", ver, enforced)
+	}
+}
+
+func Test_SetDownloadOnly_ClearsPendingVersion(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-pending.json")
+	recorder := peer.NewRecorder("")
+	sub := recorder.SubscribeToEvents()
+	defer recorder.UnsubscribeFromEvents(sub)
+
+	m := NewManager(recorder, statemanager.New(tmpFile))
+	m.update = &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.1"))}
+	m.currentVersion = "1.0.0"
+	m.autoUpdateSupported = func() bool { return true }
+	m.Start(context.Background())
+	defer m.Stop()
+
+	m.SetVersion("1.0.1", false)
+	if ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond); ver != "1.0.1" || !enforced {
+		t.Fatalf("expected enforced event for 1.0.1, got %q enforced=%v", ver, enforced)
+	}
+
+	m.SetDownloadOnly()
+	if ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond); ver != "1.0.1" || enforced {
+		t.Fatalf("expected download-only event for 1.0.1, got %q enforced=%v", ver, enforced)
+	}
+
+	if err := m.Install(context.Background()); err == nil {
+		t.Fatal("Install in download-only mode must not install the staged managed version")
+	}
+}
+
+func Test_ResetMode_SilencesStaleForceDirective(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-force-reset.json")
+	recorder := peer.NewRecorder("")
+	sub := recorder.SubscribeToEvents()
+	defer recorder.UnsubscribeFromEvents(sub)
+
+	mockUpdate := &versionUpdateMock{}
+	m := NewManager(recorder, statemanager.New(tmpFile))
+	m.update = mockUpdate
+	m.currentVersion = "1.0.0"
+	m.autoUpdateSupported = func() bool { return true }
+	m.Start(context.Background())
+	defer m.Stop()
+
+	// Management enforces "latest" before the fetcher has reported any version,
+	// so nothing can be installed while the engine is still up.
+	m.SetVersion(latestVersion, true)
+	if event := waitForAnyEvent(sub, 300*time.Millisecond); event != nil {
+		t.Fatalf("no event expected before the latest version is known, got %v", event)
+	}
+
+	// The engine stop resets the mode. A release published afterwards must not
+	// trigger the stale forced install or any notification.
+	m.ResetMode()
+	mockUpdate.setLatestVersion(v.Must(v.NewSemver("1.0.1")))
+	mockUpdate.onUpdate()
+	if event := waitForAnyEvent(sub, 300*time.Millisecond); event != nil {
+		t.Fatalf("stale force directive must stay silent after reset, got %v", event)
+	}
+
+	m.SetVersion("1.0.1", false)
+	ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.1" || !enforced {
+		t.Fatalf("expected enforced event after a fresh directive, got %q enforced=%v", ver, enforced)
+	}
+}
+
+func Test_SetVersion_MalformedFallsBackToDownloadOnly(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-malformed.json")
+	recorder := peer.NewRecorder("")
+	sub := recorder.SubscribeToEvents()
+	defer recorder.UnsubscribeFromEvents(sub)
+
+	m := NewManager(recorder, statemanager.New(tmpFile))
+	m.update = &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.1"))}
+	m.currentVersion = "1.0.0"
+	m.autoUpdateSupported = func() bool { return true }
+	m.Start(context.Background())
+	defer m.Stop()
+
+	m.SetVersion("not-a-version", false)
+	ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.1" {
+		t.Fatalf("expected download-only event for 1.0.1 after malformed version, got %q", ver)
+	}
+	if enforced {
+		t.Error("malformed version fallback must not carry enforced metadata")
+	}
+}
+
+func Test_SetVersion_ForceChangeAppliesWithSameVersion(t *testing.T) {
+	m := NewManager(peer.NewRecorder(""), statemanager.New(path.Join(t.TempDir(), "update-test-force-change.json")))
+	m.update = &versionUpdateMock{}
+	m.autoUpdateSupported = func() bool { return true }
+
+	m.SetVersion("1.0.1", false)
+	m.SetVersion("1.0.1", true)
+
+	m.updateMutex.Lock()
+	defer m.updateMutex.Unlock()
+	if !m.forceUpdate {
+		t.Fatal("enabling force update without a version change must take effect")
+	}
+	if m.expectedVersion == nil || m.expectedVersion.String() != "1.0.1" {
+		t.Fatalf("expected version 1.0.1 to stay set, got %v", m.expectedVersion)
+	}
+}
+
+func Test_SetVersion_RepeatedDirectiveKeepsMode(t *testing.T) {
+	m := NewManager(peer.NewRecorder(""), statemanager.New(path.Join(t.TempDir(), "update-test-repeat.json")))
+	m.update = &versionUpdateMock{}
+	m.autoUpdateSupported = func() bool { return true }
+
+	for _, expected := range []string{"1.0.1", latestVersion} {
+		m.SetVersion(expected, false)
+		m.updateMutex.Lock()
+		gen := m.modeGen
+		m.updateMutex.Unlock()
+
+		m.SetVersion(expected, false)
+		m.updateMutex.Lock()
+		repeatedGen := m.modeGen
+		m.updateMutex.Unlock()
+
+		if repeatedGen != gen {
+			t.Errorf("repeating the %q directive must not reset the mode", expected)
+		}
+	}
+}
diff --git a/client/internal/updater/manager_test.go b/client/internal/updater/manager_test.go
index 107dca2b3..939c09814 100644
--- a/client/internal/updater/manager_test.go
+++ b/client/internal/updater/manager_test.go
@@ -66,7 +66,7 @@ func Test_LatestVersion(t *testing.T) {
 			t.Errorf("%s: Initial update version mismatch, expected %v, got %v", c.name, c.initialLatestVersion.String(), ver)
 		}
 
-		mockUpdate.latestVersion = c.latestVersion
+		mockUpdate.setLatestVersion(c.latestVersion)
 		mockUpdate.onUpdate()
 
 		ver, _ = waitForUpdateEvent(sub, 500*time.Millisecond)
diff --git a/client/internal/updater/manager_test_helpers_test.go b/client/internal/updater/manager_test_helpers_test.go
index c7faee1f4..430b31ec1 100644
--- a/client/internal/updater/manager_test_helpers_test.go
+++ b/client/internal/updater/manager_test_helpers_test.go
@@ -2,21 +2,24 @@ package updater
 
 import (
 	"strconv"
+	"sync"
 	"time"
 
 	v "github.com/hashicorp/go-version"
 
 	"github.com/netbirdio/netbird/client/internal/peer"
+	cProto "github.com/netbirdio/netbird/client/proto"
 )
 
 type versionUpdateMock struct {
 	latestVersion *v.Version
 	onUpdate      func()
+	mu            sync.Mutex
 }
 
-func (m versionUpdateMock) StopWatch() {}
+func (m *versionUpdateMock) StopWatch() {}
 
-func (m versionUpdateMock) SetDaemonVersion(newVersion string) bool {
+func (m *versionUpdateMock) SetDaemonVersion(newVersion string) bool {
 	return false
 }
 
@@ -24,11 +27,19 @@ func (m *versionUpdateMock) SetOnUpdateListener(updateFn func()) {
 	m.onUpdate = updateFn
 }
 
-func (m versionUpdateMock) LatestVersion() *v.Version {
+func (m *versionUpdateMock) LatestVersion() *v.Version {
+	m.mu.Lock()
+	defer m.mu.Unlock()
 	return m.latestVersion
 }
 
-func (m versionUpdateMock) StartFetcher() {}
+func (m *versionUpdateMock) StartFetcher() {}
+
+func (m *versionUpdateMock) setLatestVersion(version *v.Version) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.latestVersion = version
+}
 
 // waitForUpdateEvent waits for a new_version_available event, returns the version string or "" on timeout.
 func waitForUpdateEvent(sub *peer.EventSubscription, timeout time.Duration) (version string, enforced bool) {
@@ -54,3 +65,20 @@ func waitForUpdateEvent(sub *peer.EventSubscription, timeout time.Duration) (ver
 		}
 	}
 }
+
+// waitForAnyEvent returns the first published event of any kind, or nil on timeout.
+// Unlike waitForUpdateEvent it also catches the install-progress events, so a test
+// can assert that a forced install never started.
+func waitForAnyEvent(sub *peer.EventSubscription, timeout time.Duration) *cProto.SystemEvent {
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+	select {
+	case event, ok := <-sub.Events():
+		if !ok {
+			return nil
+		}
+		return event
+	case <-timer.C:
+		return nil
+	}
+}
diff --git a/client/internal/wincmd/system32_windows.go b/client/internal/wincmd/system32_windows.go
new file mode 100644
index 000000000..36aa258b5
--- /dev/null
+++ b/client/internal/wincmd/system32_windows.go
@@ -0,0 +1,30 @@
+// Package wincmd locates the Windows utilities the client shells out to.
+package wincmd
+
+import (
+	"path/filepath"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+// defaultSystem32Dir is where the system directory is on every supported
+// install, used only when the API that reports it fails.
+const defaultSystem32Dir = `C:\Windows\System32`
+
+// System32 returns the full path of a Windows utility under the system
+// directory.
+//
+// PATH is deliberately not consulted. The daemon runs as LocalSystem with an
+// environment of its own, so whoever can place an entry in that PATH chooses
+// which binary runs with those privileges. The system directory is read from
+// the API rather than from %SystemRoot% for the same reason.
+func System32(command string) string {
+	sysDir, err := windows.GetSystemDirectory()
+	if err != nil {
+		log.Warnf("Failed to locate the Windows system directory, falling back to %s: %v", defaultSystem32Dir, err)
+		sysDir = defaultSystem32Dir
+	}
+
+	return filepath.Join(sysDir, command+".exe")
+}
diff --git a/client/internal/wincmd/system32_windows_test.go b/client/internal/wincmd/system32_windows_test.go
new file mode 100644
index 000000000..0d31d7ee7
--- /dev/null
+++ b/client/internal/wincmd/system32_windows_test.go
@@ -0,0 +1,31 @@
+package wincmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSystem32IgnoresPATH(t *testing.T) {
+	// A directory holding something that would win a PATH lookup, in front of
+	// everything else: the daemon runs as LocalSystem, so a PATH entry must not
+	// be able to decide what it executes.
+	planted := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(planted, "netsh.exe"), []byte("not really netsh"), 0o600))
+	t.Setenv("PATH", planted+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	got := System32("netsh")
+
+	assert.True(t, filepath.IsAbs(got), "the path must be absolute, got %q", got)
+	assert.NotContains(t, got, planted, "a PATH entry must not be consulted")
+	assert.True(t, strings.EqualFold(filepath.Base(got), "netsh.exe"), "unexpected file name in %q", got)
+
+	// The system directory is what Windows reports it to be, not %SystemRoot%,
+	// which the same caller could have set alongside PATH.
+	t.Setenv("SystemRoot", planted)
+	assert.Equal(t, got, System32("netsh"), "%SystemRoot% must not move the lookup")
+}
diff --git a/client/ios/NetBirdSDK/client.go b/client/ios/NetBirdSDK/client.go
index 359a83556..457ae3a7d 100644
--- a/client/ios/NetBirdSDK/client.go
+++ b/client/ios/NetBirdSDK/client.go
@@ -4,17 +4,19 @@ package NetBirdSDK
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/netip"
 	"os"
 	"sort"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"
 
+	nbAnonymize "github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/debug"
@@ -22,6 +24,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/netevents"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -29,10 +32,14 @@ import (
 	types "github.com/netbirdio/netbird/upload-server/types"
 )
 
-// ConnectionListener export internal Listener for mobile
-type ConnectionListener interface {
-	peer.Listener
-}
+// AnonymizeLevelDefault and AnonymizeLevelStrict are the accepted
+// anonymizeLevel values for DebugBundle.
+const (
+	AnonymizeLevelDefault = nbAnonymize.LevelDefaultString
+	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
+)
+
+var errClientAlreadyRunning = errors.New("client is already running")
 
 // RouteListener export internal RouteListener for mobile
 type NetworkChangeListener interface {
@@ -71,25 +78,41 @@ type Client struct {
 	cacheDir              string
 	logFilePath           string
 	recorder              *peer.Status
-	ctxCancel             context.CancelFunc
-	ctxCancelLock         *sync.Mutex
 	deviceName            string
 	osName                string
 	osVersion             string
 	networkChangeListener listener.NetworkChangeListener
 	onHostDnsFn           func([]string)
 	dnsManager            dns.IosDnsManager
-	loginComplete         bool
-	// preloadedConfig holds config loaded from JSON (used on tvOS where file writes are blocked)
-	preloadedConfig *profilemanager.Config
+	loginComplete         atomic.Bool
+	// netMgr outlives engine restarts: it mirrors the OS connectivity, not
+	// the engine lifecycle. Run injects its state and sweeper into each new
+	// ConnectClient.
+	netMgr              *netevents.Manager
+	preloadedConfigJSON atomic.Pointer[string]
 
+	// mdmSource holds the per-Client MDM policy source and its change
+	// detector as one unit. Set by SetMDMPolicyFetcher (called from the
+	// Swift side at extension init). Each Run passes the loader to the
+	// resolved Config so applyMDMPolicy picks up the active overlay. Nil
+	// means "MDM enforcement off for this Client".
+	mdmSource atomic.Pointer[mdmSource]
+
+	// stateMu guards the run lifecycle as one unit: the cancel installed by
+	// the current run, the channel it closes on exit, and the state it
+	// published. One run at a time: startRun refuses a second Run while the
+	// previous one has not exited, and the platform serializes Stop before
+	// Start, so no generation tracking is needed.
 	stateMu       sync.RWMutex
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
+	runDone       chan struct{}
+	ctxCancel     context.CancelFunc
 }
 
 // NewClient instantiate a new Client
 func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osVersion string, osName string, networkChangeListener NetworkChangeListener, dnsManager DnsManager) *Client {
+	recorder := peer.NewRecorder("")
 	return &Client{
 		cfgFile:               cfgFile,
 		stateFile:             stateFile,
@@ -98,80 +121,95 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 		deviceName:            deviceName,
 		osName:                osName,
 		osVersion:             osVersion,
-		recorder:              peer.NewRecorder(""),
-		ctxCancelLock:         &sync.Mutex{},
+		recorder:              recorder,
 		networkChangeListener: networkChangeListener,
 		dnsManager:            dnsManager,
+		netMgr:                netevents.NewManager(recorder),
 	}
 }
 
-// SetConfigFromJSON loads config from a JSON string into memory.
-// This is used on tvOS where file writes to App Group containers are blocked.
-// When set, IsLoginRequired() and Run() will use this preloaded config instead of reading from file.
+// SetConfigFromJSON stores the JSON config that later loads resolve instead of the config file (tvOS).
 func (c *Client) SetConfigFromJSON(jsonStr string) error {
-	cfg, err := profilemanager.ConfigFromJSON(jsonStr)
-	if err != nil {
+	// Parsed only to reject an unreadable document early; the JSON itself is
+	// what is stored, and every load re-parses it. A document carrying no peer
+	// identity is readable and accepted: that is a logged-out profile, and the
+	// login that follows provisions the keys.
+	if _, err := profilemanager.ConfigFromJSON(jsonStr); err != nil {
 		log.Errorf("SetConfigFromJSON: failed to parse config JSON: %v", err)
 		return err
 	}
-	c.preloadedConfig = cfg
+	c.preloadedConfigJSON.Store(&jsonStr)
 	log.Infof("SetConfigFromJSON: config loaded successfully from JSON")
 	return nil
 }
 
+func (c *Client) loadConfig(input profilemanager.ConfigInput) (*profilemanager.Config, error) {
+	var cfg *profilemanager.Config
+	var err error
+	if preloaded := c.preloadedConfigJSON.Load(); preloaded != nil {
+		cfg, err = profilemanager.ConfigFromJSON(*preloaded)
+	} else {
+		cfg, err = profilemanager.DirectUpdateOrCreateConfig(input)
+	}
+	if err != nil {
+		return nil, err
+	}
+	c.applyMDMOverlay(cfg)
+	return cfg, nil
+}
+
 // Run start the internal client. It is a blocker function
 func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	exportEnvList(envList)
 	log.Infof("Starting NetBird client")
 	log.Debugf("Tunnel uses interface: %s", interfaceName)
 
-	var cfg *profilemanager.Config
-	var err error
-
-	// Use preloaded config if available (tvOS where file writes are blocked)
-	if c.preloadedConfig != nil {
-		log.Infof("Run: using preloaded config from memory")
-		cfg = c.preloadedConfig
-	} else {
-		log.Infof("Run: loading config from file")
-		// Use DirectUpdateOrCreateConfig to avoid atomic file operations (temp file + rename)
-		// which are blocked by the tvOS sandbox in App Group containers
-		cfg, err = profilemanager.DirectUpdateOrCreateConfig(profilemanager.ConfigInput{
-			ConfigPath:    c.cfgFile,
-			StateFilePath: c.stateFile,
-		})
-		if err != nil {
-			return err
-		}
+	cfg, err := c.loadConfig(profilemanager.ConfigInput{
+		ConfigPath:    c.cfgFile,
+		StateFilePath: c.stateFile,
+	})
+	if err != nil {
+		return err
 	}
 	c.recorder.UpdateManagementAddress(cfg.ManagementURL.String())
 	c.recorder.UpdateRosenpass(cfg.RosenpassEnabled, cfg.RosenpassPermissive)
 
-	var ctx context.Context
 	//nolint
 	ctxWithValues := context.WithValue(context.Background(), system.DeviceNameCtxKey, c.deviceName)
 	//nolint
 	ctxWithValues = context.WithValue(ctxWithValues, system.OsNameCtxKey, c.osName)
 	//nolint
 	ctxWithValues = context.WithValue(ctxWithValues, system.OsVersionCtxKey, c.osVersion)
-	c.ctxCancelLock.Lock()
-	ctx, c.ctxCancel = context.WithCancel(ctxWithValues)
-	defer c.ctxCancel()
-	c.ctxCancelLock.Unlock()
+	runCtx, runCancel := context.WithCancel(ctxWithValues)
+	defer runCancel()
 
-	auth := NewAuthWithConfig(ctx, cfg)
-	err = auth.LoginSync()
+	done, err := c.startRun(runCancel)
 	if err != nil {
 		return err
 	}
+	defer c.finishRun(done)
+	ctx := runCtx
 
-	log.Infof("Auth successful")
+	// No login pre-flight here. The engine's own loginToManagement (connect.go) performs
+	// the authoritative Login immediately before the first Sync, so a LoginSync() call at
+	// this point only duplicated it — costing two extra Login RPCs (IsLoginRequired +
+	// Login) on every engine start, since IsLoginRequired is itself a full Login RPC.
+	//
+	// Auth failures still reach the caller through the engine path: loginToManagement
+	// returns PermissionDenied, which marks the shared status recorder
+	// (MarkManagementDisconnected) and fires ClientStop → onDisconnected, where
+	// IsLoginRequiredCached() reports login-required. The error is also returned out of Run().
+	//
+	// A pre-flight was also actively harmful when the server is unreachable: its 2-minute
+	// backoff blocked the start and then reported "login required" for what was really a
+	// timeout. The engine instead keeps retrying and recovers when the server returns.
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	c.onHostDnsFn = func([]string) {}
 	cfg.WgIface = interfaceName
 
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
+		internal.WithNetEvents(c.netMgr))
 	c.setState(cfg, connectClient)
 	// Persist the latest sync response so DebugBundle can include the network
 	// map. On iOS this is backed by disk to keep it out of the constrained
@@ -180,40 +218,79 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	return connectClient.RunOniOS(fd, c.networkChangeListener, c.dnsManager, c.stateFile, c.cacheDir, c.logFilePath)
 }
 
-// Stop the internal client and free the resources
+// SetNetworkAvailable feeds OS-reported network availability into the client
+// (e.g. from NWPathMonitor). While unavailable, the internal reconnect loops
+// suspend their attempts and the connection listener reports NoNetwork
+// instead of Connecting; when availability returns, the loops resume
+// immediately with a fresh backoff. Losing the last network also sweeps the
+// registered connections, so the client does not keep reporting Connected
+// over stale sockets with no network at all.
+func (c *Client) SetNetworkAvailable(available bool) {
+	c.netMgr.SetNetworkAvailable(available)
+}
+
+// NotifyNetworkChange marks the management, signal and relay connections
+// stale after the OS switched networks and schedules a sweep that cuts
+// whatever has not redialed on the new network by then. The engine and the
+// TUN device stay untouched.
+func (c *Client) NotifyNetworkChange() {
+	c.netMgr.NotifyNetworkChange()
+}
+
+// Stop cancels the running client and waits for the run loop to exit, so a
+// caller that restarts immediately cannot race the outgoing teardown.
 func (c *Client) Stop() {
-	c.ctxCancelLock.Lock()
-	defer c.ctxCancelLock.Unlock()
-	if c.ctxCancel == nil {
+	done := c.cancelRun()
+	if done == nil {
 		return
 	}
 
-	c.ctxCancel()
-	c.setState(nil, nil)
+	select {
+	case <-done:
+	case <-time.After(stopRunWaitTimeout):
+		log.Warnf("Stop: timed out waiting for the run loop to exit")
+	}
+}
+
+// StopWithoutWait cancels the running client without waiting for the run loop.
+// Use it where the caller is on a deadline the wait could overrun, such as
+// NEPacketTunnelProvider.stopTunnel, which iOS gives only a few seconds
+// before it kills the extension.
+func (c *Client) StopWithoutWait() {
+	c.cancelRun()
+}
+
+func (c *Client) cancelRun() chan struct{} {
+	c.stateMu.RLock()
+	done := c.runDone
+	cancel := c.ctxCancel
+	c.stateMu.RUnlock()
+
+	if cancel != nil {
+		cancel()
+	}
+
+	return done
 }
 
 // DebugBundle generates a debug bundle, uploads it and returns the upload key.
 // It works with or without a running engine: when the engine is up it reuses
 // the live config, sync response and client metrics; otherwise it loads the
-// config from disk (or the preloaded tvOS config).
-func (c *Client) DebugBundle(anonymize bool) (string, error) {
+// config from disk (or the preloaded tvOS config). anonymizeLevel is "default"
+// or "strict"; strict also anonymizes internal IP ranges, peer names, and
+// WireGuard public keys, and implies anonymize.
+func (c *Client) DebugBundle(anonymize bool, anonymizeLevel string) (string, error) {
 	cfg, cc := c.stateSnapshot()
 
 	// If the engine hasn't been started, load config so we can reach management.
 	if cfg == nil {
-		if c.preloadedConfig != nil {
-			cfg = c.preloadedConfig
-		} else {
-			var err error
-			// Use DirectUpdateOrCreateConfig to avoid atomic file operations
-			// (temp file + rename) blocked by the tvOS sandbox.
-			cfg, err = profilemanager.DirectUpdateOrCreateConfig(profilemanager.ConfigInput{
-				ConfigPath:    c.cfgFile,
-				StateFilePath: c.stateFile,
-			})
-			if err != nil {
-				return "", fmt.Errorf("load config: %w", err)
-			}
+		var err error
+		cfg, err = c.loadConfig(profilemanager.ConfigInput{
+			ConfigPath:    c.cfgFile,
+			StateFilePath: c.stateFile,
+		})
+		if err != nil {
+			return "", fmt.Errorf("load config: %w", err)
 		}
 	}
 
@@ -233,6 +310,9 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
+			deps.RefreshStatus = func() {
+				e.RunHealthProbes(context.Background(), true)
+			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}
@@ -243,6 +323,7 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 		deps,
 		debug.BundleConfig{
 			Anonymize:         anonymize,
+			AnonymizeLevel:    nbAnonymize.ParseLevel(anonymizeLevel),
 			IncludeSystemInfo: true,
 		},
 	)
@@ -260,7 +341,7 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 	uploadCtx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 	defer cancel()
 
-	key, err := debug.UploadDebugBundle(uploadCtx, types.DefaultBundleURL, cfg.ManagementURL.String(), path)
+	key, err := debug.UploadDebugBundle(uploadCtx, types.DefaultBundleURL, cfg.ManagementURL.String(), path, false)
 	if err != nil {
 		return "", fmt.Errorf("upload debug bundle: %w", err)
 	}
@@ -312,7 +393,11 @@ func (c *Client) GetStatusDetails() *StatusDetails {
 
 // SetConnectionListener set the network connection listener
 func (c *Client) SetConnectionListener(listener ConnectionListener) {
-	c.recorder.SetConnectionListener(listener)
+	if listener == nil {
+		c.recorder.RemoveConnectionListener()
+		return
+	}
+	c.recorder.SetConnectionListener(connectionListenerAdapter{listener})
 }
 
 // RemoveConnectionListener remove connection listener
@@ -331,40 +416,18 @@ func (c *Client) IsLoginRequiredCached() bool {
 }
 
 func (c *Client) IsLoginRequired() bool {
-	var ctx context.Context
 	//nolint
 	ctxWithValues := context.WithValue(context.Background(), system.DeviceNameCtxKey, c.deviceName)
 	//nolint
 	ctxWithValues = context.WithValue(ctxWithValues, system.OsNameCtxKey, c.osName)
 	//nolint
 	ctxWithValues = context.WithValue(ctxWithValues, system.OsVersionCtxKey, c.osVersion)
-	c.ctxCancelLock.Lock()
-	defer c.ctxCancelLock.Unlock()
-	ctx, c.ctxCancel = context.WithCancel(ctxWithValues)
+	ctx, cancel := context.WithCancel(ctxWithValues)
+	defer cancel()
 
-	var cfg *profilemanager.Config
-	var err error
-
-	// Use preloaded config if available (tvOS where file writes are blocked)
-	if c.preloadedConfig != nil {
-		log.Infof("IsLoginRequired: using preloaded config from memory")
-		cfg = c.preloadedConfig
-	} else {
-		log.Infof("IsLoginRequired: loading config from file")
-		// Use DirectUpdateOrCreateConfig to avoid atomic file operations (temp file + rename)
-		// which are blocked by the tvOS sandbox in App Group containers
-		cfg, err = profilemanager.DirectUpdateOrCreateConfig(profilemanager.ConfigInput{
-			ConfigPath: c.cfgFile,
-		})
-		if err != nil {
-			log.Errorf("IsLoginRequired: failed to load config: %v", err)
-			// If we can't load config, assume login is required
-			return true
-		}
-	}
-
-	if cfg == nil {
-		log.Errorf("IsLoginRequired: config is nil")
+	cfg, err := c.loadConfig(profilemanager.ConfigInput{ConfigPath: c.cfgFile})
+	if err != nil {
+		log.Errorf("IsLoginRequired: failed to load config: %v", err)
 		return true
 	}
 
@@ -388,17 +451,22 @@ func (c *Client) IsLoginRequired() bool {
 // loginForMobileAuthTimeout is the timeout for requesting auth info from the server
 const loginForMobileAuthTimeout = 30 * time.Second
 
+const stopRunWaitTimeout = 20 * time.Second
+
 func (c *Client) LoginForMobile() string {
-	var ctx context.Context
 	//nolint
 	ctxWithValues := context.WithValue(context.Background(), system.DeviceNameCtxKey, c.deviceName)
 	//nolint
 	ctxWithValues = context.WithValue(ctxWithValues, system.OsNameCtxKey, c.osName)
 	//nolint
 	ctxWithValues = context.WithValue(ctxWithValues, system.OsVersionCtxKey, c.osVersion)
-	c.ctxCancelLock.Lock()
-	defer c.ctxCancelLock.Unlock()
-	ctx, c.ctxCancel = context.WithCancel(ctxWithValues)
+	ctx, cancel := context.WithCancel(ctxWithValues)
+	loginDone := false
+	defer func() {
+		if !loginDone {
+			cancel()
+		}
+	}()
 
 	// Use DirectUpdateOrCreateConfig to avoid atomic file operations (temp file + rename)
 	// which are blocked by the tvOS sandbox in App Group containers
@@ -409,8 +477,9 @@ func (c *Client) LoginForMobile() string {
 		log.Errorf("LoginForMobile: failed to load config: %v", err)
 		return fmt.Sprintf("failed to load config: %v", err)
 	}
+	c.applyMDMOverlay(cfg)
 
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, cfg, false, false, "")
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, cfg, false, false, "", false)
 	if err != nil {
 		return err.Error()
 	}
@@ -425,7 +494,9 @@ func (c *Client) LoginForMobile() string {
 	}
 
 	// This could cause a potential race condition with loading the extension which need to be handled on swift side
+	loginDone = true
 	go func() {
+		defer cancel()
 		tokenInfo, err := oAuthFlow.WaitToken(ctx, flowInfo)
 		if err != nil {
 			log.Errorf("LoginForMobile: WaitToken failed: %v", err)
@@ -442,18 +513,18 @@ func (c *Client) LoginForMobile() string {
 			log.Errorf("LoginForMobile: Login failed: %v", err)
 			return
 		}
-		c.loginComplete = true
+		c.loginComplete.Store(true)
 	}()
 
 	return flowInfo.VerificationURIComplete
 }
 
 func (c *Client) IsLoginComplete() bool {
-	return c.loginComplete
+	return c.loginComplete.Load()
 }
 
 func (c *Client) ClearLoginComplete() {
-	c.loginComplete = false
+	c.loginComplete.Store(false)
 }
 
 func (c *Client) GetRoutesSelectionDetails() (*RoutesSelectionDetails, error) {
@@ -634,23 +705,18 @@ func (c *Client) SelectRoute(id string) error {
 	}
 
 	routeManager := engine.GetRouteManager()
-	routeSelector := routeManager.GetRouteSelector()
 	if id == "All" {
 		log.Debugf("select all routes")
-		routeSelector.SelectAllRoutes()
-	} else {
-		log.Debugf("select route with id: %s", id)
-		routes := toNetIDs([]string{id})
-		routesMap := routeManager.GetClientRoutesWithNetID()
-		routes = route.ExpandV6ExitPairs(routes, routesMap)
-		if err := routeSelector.SelectRoutes(routes, true, maps.Keys(routesMap)); err != nil {
-			log.Debugf("error when selecting routes: %s", err)
-			return fmt.Errorf("select routes: %w", err)
-		}
+		routeManager.SelectAllRoutes()
+		return nil
 	}
-	routeManager.TriggerSelection(routeManager.GetClientRoutes())
-	return nil
 
+	log.Debugf("select route with id: %s", id)
+	if err := routeManager.SelectRoutes(toNetIDs([]string{id}), true); err != nil {
+		log.Debugf("error when selecting routes: %s", err)
+		return err
+	}
+	return nil
 }
 
 func (c *Client) DeselectRoute(id string) error {
@@ -664,31 +730,50 @@ func (c *Client) DeselectRoute(id string) error {
 	}
 
 	routeManager := engine.GetRouteManager()
-	routeSelector := routeManager.GetRouteSelector()
 	if id == "All" {
 		log.Debugf("deselect all routes")
-		routeSelector.DeselectAllRoutes()
-	} else {
-		log.Debugf("deselect route with id: %s", id)
-		routes := toNetIDs([]string{id})
-		routesMap := routeManager.GetClientRoutesWithNetID()
-		routes = route.ExpandV6ExitPairs(routes, routesMap)
-		if err := routeSelector.DeselectRoutes(routes, maps.Keys(routesMap)); err != nil {
-			log.Debugf("error when deselecting routes: %s", err)
-			return fmt.Errorf("deselect routes: %w", err)
-		}
+		routeManager.DeselectAllRoutes()
+		return nil
+	}
+
+	log.Debugf("deselect route with id: %s", id)
+	if err := routeManager.DeselectRoutes(toNetIDs([]string{id})); err != nil {
+		log.Debugf("error when deselecting routes: %s", err)
+		return err
 	}
-	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 	return nil
 }
 
-// setState stores the running engine state so DebugBundle can reuse the live
-// config and ConnectClient. It is cleared on Stop.
-func (c *Client) setState(cfg *profilemanager.Config, cc *internal.ConnectClient) {
+func (c *Client) startRun(cancel context.CancelFunc) (chan struct{}, error) {
 	c.stateMu.Lock()
 	defer c.stateMu.Unlock()
+
+	if c.runDone != nil {
+		return nil, errClientAlreadyRunning
+	}
+
+	done := make(chan struct{})
+	c.runDone = done
+	c.ctxCancel = cancel
+	return done, nil
+}
+
+func (c *Client) finishRun(done chan struct{}) {
+	c.stateMu.Lock()
+	c.connectClient = nil
+	c.config = nil
+	c.runDone = nil
+	c.ctxCancel = nil
+	c.stateMu.Unlock()
+
+	close(done)
+}
+
+func (c *Client) setState(cfg *profilemanager.Config, cc *internal.ConnectClient) {
+	c.stateMu.Lock()
 	c.config = cfg
 	c.connectClient = cc
+	c.stateMu.Unlock()
 }
 
 // stateSnapshot returns the current config and ConnectClient under the lock.
diff --git a/client/ios/NetBirdSDK/connection_listener.go b/client/ios/NetBirdSDK/connection_listener.go
new file mode 100644
index 000000000..d792537ba
--- /dev/null
+++ b/client/ios/NetBirdSDK/connection_listener.go
@@ -0,0 +1,43 @@
+//go:build ios
+
+package NetBirdSDK
+
+import (
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// Client state values, re-exported as basic constants so gomobile emits them
+// into the generated bindings. They mirror peer.ClientState*: append-only,
+// never reorder.
+const (
+	ClientStateDisconnected  = int(peer.ClientStateDisconnected)
+	ClientStateConnected     = int(peer.ClientStateConnected)
+	ClientStateConnecting    = int(peer.ClientStateConnecting)
+	ClientStateDisconnecting = int(peer.ClientStateDisconnecting)
+	ClientStateNoNetwork     = int(peer.ClientStateNoNetwork)
+)
+
+// ConnectionListener export internal Listener for mobile.
+//
+// It intentionally lacks OnStateChanged for now: adding a method to a gomobile
+// interface breaks every Swift implementation, so the iOS app keeps building
+// against the legacy per-state callbacks. A follow-up will extend it together
+// with the app.
+type ConnectionListener interface {
+	OnConnected()
+	OnDisconnected()
+	OnConnecting()
+	OnDisconnecting()
+	OnAddressChanged(string, string)
+	OnPeersListChanged(int)
+}
+
+// connectionListenerAdapter adapts the gomobile-facing ConnectionListener to
+// peer.Listener.
+type connectionListenerAdapter struct {
+	ConnectionListener
+}
+
+// OnStateChanged is dropped on iOS until the app adopts the state callback;
+// the legacy per-state callbacks continue to fire.
+func (a connectionListenerAdapter) OnStateChanged(peer.ClientState) {}
diff --git a/client/ios/NetBirdSDK/login.go b/client/ios/NetBirdSDK/login.go
index 432133999..b182e82b6 100644
--- a/client/ios/NetBirdSDK/login.go
+++ b/client/ios/NetBirdSDK/login.go
@@ -11,6 +11,8 @@ import (
 
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/mobile"
 	"github.com/netbirdio/netbird/client/system"
 )
 
@@ -38,19 +40,46 @@ type Auth struct {
 	ctx     context.Context
 	cancel  context.CancelFunc
 	config  *profilemanager.Config
+	base    *profilemanager.Config
+	policy  *mdm.Policy
 	cfgPath string
 }
 
-// NewAuth instantiate Auth struct and validate the management URL
-func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
-	inputCfg := profilemanager.ConfigInput{
-		ManagementURL: mgmURL,
+// NewAuth instantiate Auth struct and validate the management URL.
+// Auth is constructed under the active MDM policy: the policy is overlaid on
+// the resolved config so the login runs against the enforced values, while
+// the persisted config keeps the caller-supplied ones; a caller-supplied
+// management URL is ignored while MDM manages that key. A nil fetcher
+// disables MDM enforcement.
+func NewAuth(cfgPath string, mgmURL string, fetcher PolicyFetcher) (*Auth, error) {
+	policy := loaderFor(fetcher).Load()
+	inputCfg := profilemanager.ConfigInput{ConfigPath: cfgPath}
+	if _, managed := policy.GetString(mdm.KeyManagementURL); !managed {
+		inputCfg.ManagementURL = mgmURL
 	}
 
-	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
+	// Load the existing config when a config file is already present so an
+	// interactive re-login reuses the peer's persisted WireGuard private key
+	// (and thus its identity) instead of generating a fresh one. Generating a
+	// new key registers a brand-new peer on the management server on every
+	// re-auth (named after the fallback hostname). Only fall back to a fresh
+	// in-memory config for the first-time login when no config file exists yet.
+	// DirectUpdateOrCreateConfig uses non-atomic writes so it also works inside
+	// the tvOS App Group sandbox where atomic temp-file+rename is blocked.
+	var cfg *profilemanager.Config
+	var err error
+	if cfgPath != "" {
+		cfg, err = profilemanager.DirectUpdateOrCreateConfig(inputCfg)
+	} else {
+		cfg, err = profilemanager.CreateInMemoryConfig(inputCfg)
+	}
 	if err != nil {
 		return nil, err
 	}
+	a := &Auth{policy: policy, cfgPath: cfgPath}
+	if err := a.setBaseConfig(cfg); err != nil {
+		return nil, err
+	}
 
 	// Use a cancellable context so Stop() can abort an in-progress interactive
 	// login. The PKCE flow's WaitToken blocks (and keeps its loopback HTTP server
@@ -60,14 +89,8 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	// process (decoupled from the network extension), so without this the server
 	// lingers after the user dismisses the browser and the next connect stalls
 	// trying to bind the same port.
-	ctx, cancel := context.WithCancel(context.Background())
-
-	return &Auth{
-		ctx:     ctx,
-		cancel:  cancel,
-		config:  cfg,
-		cfgPath: cfgPath,
-	}, nil
+	a.ctx, a.cancel = context.WithCancel(context.Background())
+	return a, nil
 }
 
 // NewAuthWithConfig instantiate Auth based on existing config
@@ -90,9 +113,7 @@ func (a *Auth) Stop() {
 	}
 }
 
-// SaveConfigIfSSOSupported test the connectivity with the management server by retrieving the server device flow info.
-// If it returns a flow info than save the configuration and return true. If it gets a codes.NotFound, it means that SSO
-// is not supported and returns false without saving the configuration. For other errors return false.
+// SaveConfigIfSSOSupported reports whether the management server supports SSO; the config is already persisted by NewAuth.
 func (a *Auth) SaveConfigIfSSOSupported(listener SSOListener) {
 	if listener == nil {
 		log.Errorf("SaveConfigIfSSOSupported: listener is nil")
@@ -120,17 +141,10 @@ func (a *Auth) saveConfigIfSSOSupported() (bool, error) {
 		return false, fmt.Errorf("failed to check SSO support: %v", err)
 	}
 
-	if !supportsSSO {
-		return false, nil
-	}
-
-	// Use DirectWriteOutConfig to avoid atomic file operations (temp file + rename)
-	// which are blocked by the tvOS sandbox in App Group containers
-	err = profilemanager.DirectWriteOutConfig(a.cfgPath, a.config)
-	return true, err
+	return supportsSSO, nil
 }
 
-// LoginWithSetupKeyAndSaveConfig test the connectivity with the management server with the setup key.
+// LoginWithSetupKeyAndSaveConfig registers the peer with the setup key; the config is already persisted by NewAuth.
 func (a *Auth) LoginWithSetupKeyAndSaveConfig(resultListener ErrListener, setupKey string, deviceName string) {
 	if resultListener == nil {
 		log.Errorf("LoginWithSetupKeyAndSaveConfig: resultListener is nil")
@@ -159,10 +173,7 @@ func (a *Auth) loginWithSetupKeyAndSaveConfig(setupKey string, deviceName string
 	if err != nil {
 		return fmt.Errorf("login failed: %v", err)
 	}
-
-	// Use DirectWriteOutConfig to avoid atomic file operations (temp file + rename)
-	// which are blocked by the tvOS sandbox in App Group containers
-	return profilemanager.DirectWriteOutConfig(a.cfgPath, a.config)
+	return nil
 }
 
 // LoginSync performs a synchronous login check without UI interaction
@@ -207,17 +218,36 @@ func (a *Auth) Login(resultListener ErrListener, urlOpener URLOpener, forceDevic
 // LoginWithDeviceName performs interactive login with device authentication support
 // The deviceName parameter allows specifying a custom device name (required for tvOS)
 func (a *Auth) LoginWithDeviceName(resultListener ErrListener, urlOpener URLOpener, forceDeviceAuth bool, deviceName string) {
+	a.startLogin(resultListener, urlOpener, forceDeviceAuth, deviceName, false)
+}
+
+// LoginInteractive performs the same interactive login as LoginWithDeviceName but skips the
+// IsLoginRequired() pre-flight and goes straight to the browser / device-code flow.
+//
+// IsLoginRequired() is itself a full Login RPC against the management server, so when the
+// caller has ALREADY established that login is required it is a pure duplicate. On iOS the
+// main app decides to show the browser based on its own isLoginRequired() check and then
+// calls straight into this method, so re-asking the server would add another Login RPC to
+// every interactive login.
+//
+// Use LoginWithDeviceName when the auth state is unknown and a silent (browser-less) login
+// must still be possible; use this when the browser is going to be shown regardless.
+func (a *Auth) LoginInteractive(resultListener ErrListener, urlOpener URLOpener, forceDeviceAuth bool, deviceName string) {
+	a.startLogin(resultListener, urlOpener, forceDeviceAuth, deviceName, true)
+}
+
+func (a *Auth) startLogin(resultListener ErrListener, urlOpener URLOpener, forceDeviceAuth bool, deviceName string, skipLoginCheck bool) {
 	if resultListener == nil {
-		log.Errorf("LoginWithDeviceName: resultListener is nil")
+		log.Errorf("startLogin: resultListener is nil")
 		return
 	}
 	if urlOpener == nil {
-		log.Errorf("LoginWithDeviceName: urlOpener is nil")
+		log.Errorf("startLogin: urlOpener is nil")
 		resultListener.OnError(fmt.Errorf("urlOpener is nil"))
 		return
 	}
 	go func() {
-		err := a.login(urlOpener, forceDeviceAuth, deviceName)
+		err := a.login(urlOpener, forceDeviceAuth, deviceName, skipLoginCheck)
 		if err != nil {
 			resultListener.OnError(err)
 		} else {
@@ -226,7 +256,7 @@ func (a *Auth) LoginWithDeviceName(resultListener ErrListener, urlOpener URLOpen
 	}()
 }
 
-func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName string) error {
+func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName string, skipLoginCheck bool) error {
 	// Create context with device name if provided
 	ctx := a.ctx
 	if deviceName != "" {
@@ -240,19 +270,24 @@ func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName strin
 	}
 	defer authClient.Close()
 
-	// check if we need to generate JWT token
-	needsLogin, err := authClient.IsLoginRequired(ctx)
-	if err != nil {
-		return fmt.Errorf("failed to check login requirement: %v", err)
+	// check if we need to generate JWT token (skipped when the caller already knows)
+	needsLogin := true
+	if !skipLoginCheck {
+		needsLogin, err = authClient.IsLoginRequired(ctx)
+		if err != nil {
+			return fmt.Errorf("failed to check login requirement: %v", err)
+		}
 	}
 
 	jwtToken := ""
+	email := ""
 	if needsLogin {
 		tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, forceDeviceAuth)
 		if err != nil {
 			return fmt.Errorf("interactive sso login failed: %v", err)
 		}
 		jwtToken = tokenInfo.GetTokenToUse()
+		email = tokenInfo.Email
 	}
 
 	err, isAuthError := authClient.Login(ctx, "", jwtToken)
@@ -264,16 +299,11 @@ func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName strin
 		return fmt.Errorf("login failed: %v", err)
 	}
 
-	// Save the config before notifying success to ensure persistence completes
-	// before the callback potentially triggers teardown on the Swift side.
-	// Note: This differs from Android which doesn't save config after login.
-	// On iOS/tvOS, we save here because:
-	// 1. The config may have been modified during login (e.g., new tokens)
-	// 2. On tvOS, the Network Extension context may be the only place with
-	//    write permissions to the App Group container
-	if a.cfgPath != "" {
-		if err := profilemanager.DirectWriteOutConfig(a.cfgPath, a.config); err != nil {
-			log.Warnf("failed to save config after login: %v", err)
+	// Stored after Login, not before: a rejected token must not leave a hint
+	// pointing at an account that cannot be used.
+	if email != "" && a.cfgPath != "" {
+		if err := mobile.WriteProfileEmail(a.cfgPath, email); err != nil {
+			log.Warnf("failed to store profile account email: %v", err)
 		}
 	}
 
@@ -283,10 +313,24 @@ func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName strin
 	return nil
 }
 
+// profileLoginHint returns the stored account email for the profile at cfgPath,
+// so a re-login targets the account the profile already belongs to instead of
+// whatever session the shared browser cookie jar happens to hold.
+//
+// An empty hint is deliberate, not a fallback: a fresh profile leaves the
+// choice to the IdP. Switching accounts is done by switching or removing
+// profiles, not by logging out — logout keeps the email.
+func profileLoginHint(cfgPath string) string {
+	if cfgPath == "" {
+		return ""
+	}
+	return mobile.ReadProfileEmail(cfgPath)
+}
+
 const authInfoRequestTimeout = 30 * time.Second
 
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, forceDeviceAuth bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth)
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, false, profileLoginHint(a.cfgPath))
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
@@ -313,23 +357,73 @@ func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener
 	return &tokenInfo, nil
 }
 
-// GetConfigJSON returns the current config as a JSON string.
-// This can be used by the caller to persist the config via alternative storage
-// mechanisms (e.g., UserDefaults on tvOS where file writes are blocked).
+// GetConfigJSON returns the config without the MDM overlay as JSON, for persisting it outside the config file (tvOS).
 func (a *Auth) GetConfigJSON() (string, error) {
-	if a.config == nil {
+	cfg := a.base
+	if cfg == nil {
+		cfg = a.config
+	}
+	if cfg == nil {
 		return "", fmt.Errorf("no config available")
 	}
-	return profilemanager.ConfigToJSON(a.config)
+	return profilemanager.ConfigToJSON(cfg)
 }
 
-// SetConfigFromJSON loads config from a JSON string.
-// This can be used to restore config from alternative storage mechanisms.
+// SetConfigFromJSON replaces the config from JSON; the MDM overlay is applied on top for the login.
 func (a *Auth) SetConfigFromJSON(jsonStr string) error {
 	cfg, err := profilemanager.ConfigFromJSON(jsonStr)
 	if err != nil {
 		return err
 	}
-	a.config = cfg
+	return a.setBaseConfig(cfg)
+}
+
+func (a *Auth) setBaseConfig(base *profilemanager.Config) error {
+	// A logged-out profile carries no keys: the mobile logout clears them in
+	// place so the next login registers a new peer instead of resurrecting the
+	// old one. This is that login, and auth.NewAuth parses the WireGuard key
+	// before the SSO flow even starts, so an absent identity fails the login on
+	// key size rather than asking the user to sign in.
+	//
+	// Minted on the base config, which is the one GetConfigJSON hands back for
+	// the caller to store — the overlaid copy below is runtime-only.
+	generated, err := base.EnsureIdentity()
+	if err != nil {
+		return fmt.Errorf("ensure profile identity: %w", err)
+	}
+	if generated {
+		if a.cfgPath != "" {
+			// Non-atomic, like NewAuth's own write: the tvOS App Group sandbox
+			// blocks the temp-file-and-rename an atomic write needs.
+			if err := profilemanager.DirectWriteOutConfig(a.cfgPath, base); err != nil {
+				return fmt.Errorf("write out profile config: %w", err)
+			}
+		} else {
+			// No file to write to — this is the tvOS path, where the profile
+			// lives in the caller's own store. It persists the new identity by
+			// calling GetConfigJSON once the login completes; until then the
+			// keys exist only here, and a login that never completes leaves
+			// nothing behind.
+			log.Infof("provisioned a peer identity for a config with no file on disk")
+		}
+	}
+
+	overlaid, err := copyConfig(base)
+	if err != nil {
+		return err
+	}
+	if a.policy != nil {
+		overlaid.ApplyMDMPolicy(a.policy)
+	}
+	a.base = base
+	a.config = overlaid
 	return nil
 }
+
+func copyConfig(cfg *profilemanager.Config) (*profilemanager.Config, error) {
+	raw, err := profilemanager.ConfigToJSON(cfg)
+	if err != nil {
+		return nil, err
+	}
+	return profilemanager.ConfigFromJSON(raw)
+}
diff --git a/client/ios/NetBirdSDK/mdm.go b/client/ios/NetBirdSDK/mdm.go
new file mode 100644
index 000000000..93a31916c
--- /dev/null
+++ b/client/ios/NetBirdSDK/mdm.go
@@ -0,0 +1,66 @@
+//go:build ios
+
+package NetBirdSDK
+
+import (
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+// PolicyFetcher is implemented by the native layer to return the current
+// managed configuration as a JSON-encoded object string; "" means no MDM
+// source is present.
+type PolicyFetcher interface {
+	FetchJSON() string
+}
+
+type mdmSource struct {
+	loader   *mdm.Loader
+	detector *mdm.ChangeDetector
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this Client; passing nil disables MDM enforcement.
+func (c *Client) SetMDMPolicyFetcher(p PolicyFetcher) {
+	loader := loaderFor(p)
+	c.mdmSource.Store(&mdmSource{loader: loader, detector: mdm.NewChangeDetector(loader)})
+}
+
+// HasMDMPolicyChanged re-reads the managed configuration and reports whether
+// it changed since the last observation; call it from the native OS-change
+// notification and restart the engine only on true.
+func (c *Client) HasMDMPolicyChanged() bool {
+	src := c.mdmSource.Load()
+	if src == nil {
+		return false
+	}
+	return src.detector.Changed()
+}
+
+// GetRestrictionsJSON returns the UI enforcement snapshot derived from the
+// active MDM policy, in the JSON shape shared with the desktop frontend.
+func (c *Client) GetRestrictionsJSON() (string, error) {
+	return mdm.BuildRestrictions(c.mdmLoader().Load()).JSON()
+}
+
+func (c *Client) applyMDMOverlay(cfg *profilemanager.Config) {
+	loader := c.mdmLoader()
+	if cfg == nil || loader == nil {
+		return
+	}
+	cfg.ApplyMDMPolicy(loader.Load())
+}
+
+func (c *Client) mdmLoader() *mdm.Loader {
+	if src := c.mdmSource.Load(); src != nil {
+		return src.loader
+	}
+	return nil
+}
+
+func loaderFor(p PolicyFetcher) *mdm.Loader {
+	if p == nil {
+		return mdm.NewJSONLoader(nil)
+	}
+	return mdm.NewJSONLoader(p.FetchJSON)
+}
diff --git a/client/ios/NetBirdSDK/preferences.go b/client/ios/NetBirdSDK/preferences.go
index ed49ccddb..642f9e160 100644
--- a/client/ios/NetBirdSDK/preferences.go
+++ b/client/ios/NetBirdSDK/preferences.go
@@ -3,12 +3,16 @@
 package NetBirdSDK
 
 import (
+	"sync/atomic"
+
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 )
 
 // Preferences export a subset of the internal config for gomobile
 type Preferences struct {
 	configInput profilemanager.ConfigInput
+	mdmLoader   atomic.Pointer[mdm.Loader]
 }
 
 // NewPreferences create new Preferences instance
@@ -17,20 +21,39 @@ func NewPreferences(configPath string, stateFilePath string) *Preferences {
 		ConfigPath:    configPath,
 		StateFilePath: stateFilePath,
 	}
-	return &Preferences{ci}
+	return &Preferences{configInput: ci}
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this Preferences instance; passing nil disables MDM enforcement.
+func (p *Preferences) SetMDMPolicyFetcher(f PolicyFetcher) {
+	p.mdmLoader.Store(loaderFor(f))
+}
+
+// GetRestrictionsJSON returns the UI enforcement snapshot derived from the
+// active MDM policy, in the JSON shape shared with the desktop frontend.
+func (p *Preferences) GetRestrictionsJSON() (string, error) {
+	return mdm.BuildRestrictions(p.policy()).JSON()
+}
+
+func (p *Preferences) policy() *mdm.Policy {
+	return p.mdmLoader.Load().Load()
 }
 
 // GetManagementURL read url from config file
 func (p *Preferences) GetManagementURL() (string, error) {
+	if v, ok := p.policy().GetString(mdm.KeyManagementURL); ok {
+		return mdm.CanonicalURL(v), nil
+	}
 	if p.configInput.ManagementURL != "" {
 		return p.configInput.ManagementURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
-	return cfg.ManagementURL.String(), err
+	return cfg.ManagementURL.String(), nil
 }
 
 // SetManagementURL store the given url and wait for commit
@@ -44,7 +67,7 @@ func (p *Preferences) GetAdminURL() (string, error) {
 		return p.configInput.AdminURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -56,17 +79,21 @@ func (p *Preferences) SetAdminURL(url string) {
 	p.configInput.AdminURL = url
 }
 
-// GetPreSharedKey read preshared key from config file
-func (p *Preferences) GetPreSharedKey() (string, error) {
+// HasPreSharedKey reports whether a pre-shared key is staged, persisted, or
+// enforced by MDM; the key itself is never handed to the native layer.
+func (p *Preferences) HasPreSharedKey() (bool, error) {
+	if _, ok := p.policy().GetString(mdm.KeyPreSharedKey); ok {
+		return true, nil
+	}
 	if p.configInput.PreSharedKey != nil {
-		return *p.configInput.PreSharedKey, nil
+		return *p.configInput.PreSharedKey != "", nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
-		return "", err
+		return false, err
 	}
-	return cfg.PreSharedKey, err
+	return cfg.PreSharedKey != "", nil
 }
 
 // SetPreSharedKey store the given key and wait for commit
@@ -81,11 +108,14 @@ func (p *Preferences) SetRosenpassEnabled(enabled bool) {
 
 // GetRosenpassEnabled read rosenpass enabled from config file
 func (p *Preferences) GetRosenpassEnabled() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyRosenpassEnabled); ok {
+		return v, nil
+	}
 	if p.configInput.RosenpassEnabled != nil {
 		return *p.configInput.RosenpassEnabled, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -99,11 +129,14 @@ func (p *Preferences) SetRosenpassPermissive(permissive bool) {
 
 // GetRosenpassPermissive read rosenpass permissive from config file
 func (p *Preferences) GetRosenpassPermissive() (bool, error) {
+	if v, ok := p.policy().GetBool(mdm.KeyRosenpassPermissive); ok {
+		return v, nil
+	}
 	if p.configInput.RosenpassPermissive != nil {
 		return *p.configInput.RosenpassPermissive, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -116,7 +149,7 @@ func (p *Preferences) GetDisableIPv6() (bool, error) {
 		return *p.configInput.DisableIPv6, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -128,8 +161,34 @@ func (p *Preferences) SetDisableIPv6(disable bool) {
 	p.configInput.DisableIPv6 = &disable
 }
 
+// GetRemoteJobsAllowed reads the remote jobs opt-in from config file
+func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
+	policy := p.policy()
+	if !policy.HasKey(mdm.KeyRemoteJobsAllowed) && p.configInput.RemoteJobsAllowed != nil {
+		return *p.configInput.RemoteJobsAllowed, nil
+	}
+
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
+	if err != nil {
+		return false, err
+	}
+	cfg.ApplyMDMPolicy(policy)
+	if cfg.RemoteJobsAllowed == nil {
+		return false, nil
+	}
+	return *cfg.RemoteJobsAllowed, nil
+}
+
+// SetRemoteJobsAllowed stores the given value and waits for commit
+func (p *Preferences) SetRemoteJobsAllowed(allowed bool) {
+	p.configInput.RemoteJobsAllowed = &allowed
+}
+
 // Commit write out the changes into config file
 func (p *Preferences) Commit() error {
+	if err := profilemanager.CheckMDMConflicts(p.configInput, p.policy()); err != nil {
+		return err
+	}
 	// Use DirectUpdateOrCreateConfig to avoid atomic file operations (temp file + rename)
 	// which are blocked by the tvOS sandbox in App Group containers
 	_, err := profilemanager.DirectUpdateOrCreateConfig(p.configInput)
diff --git a/client/ios/NetBirdSDK/preferences_test.go b/client/ios/NetBirdSDK/preferences_test.go
index 5f75e7c9a..2382e123c 100644
--- a/client/ios/NetBirdSDK/preferences_test.go
+++ b/client/ios/NetBirdSDK/preferences_test.go
@@ -31,14 +31,13 @@ func TestPreferences_DefaultValues(t *testing.T) {
 		t.Errorf("invalid default management url: %s", defaultVar)
 	}
 
-	var preSharedKey string
-	preSharedKey, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read default preshared key: %s", err)
+		t.Fatalf("failed to read default preshared key presence: %s", err)
 	}
 
-	if preSharedKey != "" {
-		t.Errorf("invalid preshared key: %s", preSharedKey)
+	if hasPSK {
+		t.Errorf("unexpected preshared key presence on fresh config")
 	}
 }
 
@@ -69,13 +68,13 @@ func TestPreferences_ReadUncommitedValues(t *testing.T) {
 	}
 
 	p.SetPreSharedKey(exampleString)
-	resp, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read preshared key: %s", err)
+		t.Fatalf("failed to read preshared key presence: %s", err)
 	}
 
-	if resp != exampleString {
-		t.Errorf("unexpected preshared key: %s", resp)
+	if !hasPSK {
+		t.Errorf("expected preshared key presence after staging one")
 	}
 }
 
@@ -114,12 +113,12 @@ func TestPreferences_Commit(t *testing.T) {
 		t.Errorf("unexpected management url: %s", resp)
 	}
 
-	resp, err = p.GetPreSharedKey()
+	hasPSK, err := p.HasPreSharedKey()
 	if err != nil {
-		t.Fatalf("failed to read preshared key: %s", err)
+		t.Fatalf("failed to read preshared key presence: %s", err)
 	}
 
-	if resp != examplePresharedKey {
-		t.Errorf("unexpected preshared key: %s", resp)
+	if !hasPSK {
+		t.Errorf("expected preshared key presence after commit")
 	}
 }
diff --git a/client/ios/NetBirdSDK/profile_manager.go b/client/ios/NetBirdSDK/profile_manager.go
new file mode 100644
index 000000000..df962e227
--- /dev/null
+++ b/client/ios/NetBirdSDK/profile_manager.go
@@ -0,0 +1,144 @@
+//go:build ios
+
+package NetBirdSDK
+
+import (
+	"github.com/netbirdio/netbird/client/mobile"
+)
+
+const (
+	// iOS uses a single user context per app.
+	iosUsername = "ios"
+)
+
+// Profile represents a profile for gomobile.
+type Profile struct {
+	ID       string
+	Name     string
+	Email    string
+	IsActive bool
+}
+
+// ProfileArray wraps profiles for gomobile compatibility (gomobile cannot
+// bind Go slices directly).
+type ProfileArray struct {
+	items []*Profile
+}
+
+// Length returns the number of profiles.
+func (p *ProfileArray) Length() int {
+	return len(p.items)
+}
+
+// Get returns the profile at index i, or nil if out of range.
+func (p *ProfileArray) Get(i int) *Profile {
+	if i < 0 || i >= len(p.items) {
+		return nil
+	}
+	return p.items[i]
+}
+
+// ProfileManager adapts the shared mobile profile manager (client/mobile) to
+// gomobile-friendly types. See that package for the on-disk layout and
+// semantics.
+type ProfileManager struct {
+	impl *mobile.ProfileManager
+}
+
+// NewProfileManager creates a new profile manager for iOS. configDir is the
+// App Group shared container path that both the app and the network extension
+// can reach.
+func NewProfileManager(configDir string) *ProfileManager {
+	return &ProfileManager{impl: mobile.NewProfileManager(configDir, iosUsername)}
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher on
+// this ProfileManager; passing nil disables MDM enforcement.
+func (pm *ProfileManager) SetMDMPolicyFetcher(f PolicyFetcher) {
+	pm.impl.SetMDMLoader(loaderFor(f))
+}
+
+// ListProfiles returns all available profiles, including the default profile,
+// with their active status set.
+func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
+	profiles, err := pm.impl.ListProfiles()
+	if err != nil {
+		return nil, err
+	}
+
+	items := make([]*Profile, 0, len(profiles))
+	for i := range profiles {
+		items = append(items, fromMobileProfile(&profiles[i]))
+	}
+	return &ProfileArray{items: items}, nil
+}
+
+// GetActiveProfile returns the currently active profile.
+func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
+	p, err := pm.impl.GetActiveProfile()
+	if err != nil {
+		return nil, err
+	}
+	return fromMobileProfile(p), nil
+}
+
+// SwitchProfile records the given profile ID as the active profile. The caller
+// must stop the VPN tunnel before switching.
+func (pm *ProfileManager) SwitchProfile(id string) error {
+	return pm.impl.SwitchProfile(id)
+}
+
+// AddProfile creates a new profile with the given display name and a
+// generated ID. It returns the created profile so the caller learns the ID.
+func (pm *ProfileManager) AddProfile(displayName string) (*Profile, error) {
+	p, err := pm.impl.AddProfile(displayName)
+	if err != nil {
+		return nil, err
+	}
+	return fromMobileProfile(p), nil
+}
+
+// RenameProfile changes the display name of the profile identified by id. The
+// on-disk filename (the ID) is left unchanged.
+func (pm *ProfileManager) RenameProfile(id string, newName string) error {
+	return pm.impl.RenameProfile(id, newName)
+}
+
+// LogoutProfile clears authentication data for a profile, forcing a re-login.
+// The management URL and other settings are preserved.
+func (pm *ProfileManager) LogoutProfile(id string) error {
+	return pm.impl.LogoutProfile(id)
+}
+
+// RemoveProfile deletes a profile. The default profile and the active profile
+// cannot be removed.
+func (pm *ProfileManager) RemoveProfile(id string) error {
+	return pm.impl.RemoveProfile(id)
+}
+
+// GetConfigPath returns the config file path for the given profile ID. Swift
+// should call this instead of constructing paths itself.
+func (pm *ProfileManager) GetConfigPath(id string) (string, error) {
+	return pm.impl.GetConfigPath(id)
+}
+
+// GetStateFilePath returns the state file path for the given profile ID.
+func (pm *ProfileManager) GetStateFilePath(id string) (string, error) {
+	return pm.impl.GetStateFilePath(id)
+}
+
+// GetActiveConfigPath returns the config file path for the currently active
+// profile.
+func (pm *ProfileManager) GetActiveConfigPath() (string, error) {
+	return pm.impl.GetActiveConfigPath()
+}
+
+// GetActiveStateFilePath returns the state file path for the currently active
+// profile.
+func (pm *ProfileManager) GetActiveStateFilePath() (string, error) {
+	return pm.impl.GetActiveStateFilePath()
+}
+
+func fromMobileProfile(p *mobile.Profile) *Profile {
+	return &Profile{ID: p.ID, Name: p.Name, Email: p.Email, IsActive: p.IsActive}
+}
diff --git a/client/ios/NetBirdSDK/version.go b/client/ios/NetBirdSDK/version.go
new file mode 100644
index 000000000..606ad18e2
--- /dev/null
+++ b/client/ios/NetBirdSDK/version.go
@@ -0,0 +1,12 @@
+//go:build ios
+
+package NetBirdSDK
+
+import "github.com/netbirdio/netbird/version"
+
+// GoClientVersion returns the NetBird Go client version that was baked into
+// the framework at compile time via
+// -ldflags "-X github.com/netbirdio/netbird/version.version=<version>".
+func GoClientVersion() string {
+	return version.NetbirdVersion()
+}
diff --git a/client/jobexec/executor.go b/client/jobexec/executor.go
index e29cc8840..7c730f757 100644
--- a/client/jobexec/executor.go
+++ b/client/jobexec/executor.go
@@ -28,7 +28,11 @@ func NewExecutor() *Executor {
 	return &Executor{}
 }
 
-func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.GeneratorDependencies, params debug.BundleConfig, waitForDuration time.Duration, mgmURL string) (string, error) {
+func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.GeneratorDependencies, params debug.BundleConfig, waitForDuration time.Duration, mgmURL, uploadURL string) (string, error) {
+	if uploadURL == "" {
+		uploadURL = types.DefaultBundleURL
+	}
+
 	if waitForDuration > MaxBundleWaitTime {
 		log.Warnf("bundle wait time %v exceeds maximum %v, capping to maximum", waitForDuration, MaxBundleWaitTime)
 		waitForDuration = MaxBundleWaitTime
@@ -54,7 +58,7 @@ func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.
 		}
 	}()
 
-	key, err := debug.UploadDebugBundle(ctx, types.DefaultBundleURL, mgmURL, path)
+	key, err := debug.UploadDebugBundle(ctx, uploadURL, mgmURL, path, false)
 	if err != nil {
 		log.Errorf("failed to upload debug bundle: %v", err)
 		return "", fmt.Errorf("upload debug bundle: %w", err)
diff --git a/client/link/README.md b/client/link/README.md
new file mode 100644
index 000000000..ffd08c7ad
--- /dev/null
+++ b/client/link/README.md
@@ -0,0 +1,225 @@
+# nblink
+
+`nblink` forwards local ports into a NetBird network from an unprivileged
+process. It runs the client in userspace mode, so there is no TUN device to
+create and no elevated privileges to grant. That lets it run on managed
+machines and in rootless containers where the normal agent cannot.
+
+Overlay names on the upstream side are resolved inside the tunnel, so
+`/etc/resolv.conf` is never touched.
+
+## Install
+
+Download the archive for your platform, extract it, and run the binary. There
+is no installer and no service to register.
+
+## Use
+
+A forward is one self-describing argument, and the flag repeats:
+
+```sh
+nblink --forward 'http://8080=https://grafana.internal'
+```
+
+The scheme on the left selects the listener type. The right side is the
+upstream reached over the network. Giving only a port binds loopback, so the
+example above listens on `127.0.0.1:8080`.
+
+Without a setup key, `nblink` opens a browser to log in and prints the URL so
+it also works over SSH.
+
+```sh
+# several forwards from one session
+nblink --forward 'http://8080=https://grafana.internal' \
+       --forward 'http://9090=https://prometheus.internal'
+
+# non-interactive
+nblink --forward 'http://8080=https://grafana.internal' --setup-key "$NB_SETUP_KEY"
+
+# check the configuration without touching the network
+nblink --forward 'http://8080=https://grafana.internal' --check
+```
+
+Port `0` asks the operating system for a free port. The address actually bound
+is printed at startup.
+
+## Container
+
+Every flag has a matching `NB_`-prefixed environment variable, which is how the
+image is configured. `NB_FORWARD` takes a comma separated list.
+
+```sh
+docker run --rm -p 127.0.0.1:8080:8080 \
+  --mount type=bind,src="$(pwd)/nb_setup_key",dst=/run/secrets/nb_setup_key,readonly \
+  -e NB_SETUP_KEY=file:/run/secrets/nb_setup_key \
+  -e NB_FORWARD='http://0.0.0.0:8080=https://grafana.internal' \
+  -e NB_ALLOW_PUBLIC_BIND=true \
+  netbirdio/nblink
+```
+
+The key file has to exist before the run and be readable by the container
+user, which is UID 65532 in group 0. A bind mount keeps the host file's owner
+and mode, so a root-owned key written with the usual `chmod 600` is not
+readable and the run fails on startup with `permission denied`. Either give the
+file to that UID (`chown 65532`) or keep it mode `640` in group 0
+(`chgrp 0`). If the source path does not exist, `--mount` refuses to start the
+container; the older `-v` form creates a directory there instead, which the read
+then reports as a directory.
+
+The image needs no `--privileged`, no `--cap-add NET_ADMIN`, no
+`--device /dev/net/tun` and no host networking.
+
+Inside a container the listener has to bind `0.0.0.0`, because a published
+port arrives on the container's own interface rather than its loopback. That
+still requires `NB_ALLOW_PUBLIC_BIND`, so exposing a forward is always
+something the operator wrote down. Publish it on the host's loopback as above:
+a bare `-p 8080:8080` publishes on every host interface, which hands the
+peer's identity to anyone on the network who can reach the port.
+
+A public listener accepts requests addressed to `localhost` or to an IP
+address. Any name other machines use to reach it, such as a DNS name or a
+Kubernetes Service name, has to be listed with `--allowed-host`
+(`NB_ALLOWED_HOST`). See [Limits](#limits) for why.
+
+The image keeps its state in memory, so it runs on a read-only root filesystem
+and each start registers a new peer. To keep one identity across restarts, set
+`NB_STATE_DIR=/var/lib/nblink` and mount a volume there:
+
+```sh
+docker run --rm --read-only -p 127.0.0.1:8080:8080 \
+  -v nblink-state:/var/lib/nblink -e NB_STATE_DIR=/var/lib/nblink \
+  ...
+```
+
+Without a state directory, use an ephemeral setup key so the peers left behind
+by earlier starts are removed once they go offline, rather than piling up.
+
+A kept identity is not yet a kept login. Without a setup key every start runs
+the browser flow, even when the peer's session is still valid, because the
+token is resolved before the stored profile is opened. Give a restart that has
+to be unattended a setup key.
+
+## Kubernetes and OpenShift
+
+The image fits OpenShift's `restricted-v2` SCC and the Kubernetes `restricted`
+Pod Security Standard as it is:
+
+- It runs as any UID. OpenShift assigns one from the namespace range and adds
+  group 0, and everything the process writes is owned by group 0.
+- It needs no capabilities, no privilege escalation, no TUN device and no host
+  networking, so `capabilities: {drop: [ALL]}` and
+  `allowPrivilegeEscalation: false` hold.
+- With state in memory it needs no writable path, so
+  `readOnlyRootFilesystem: true` holds.
+
+The simplest shape is a sidecar. The application in the same pod reaches the
+forward on `localhost`, so the listener stays on loopback and needs neither
+`NB_ALLOW_PUBLIC_BIND` nor a Service:
+
+```yaml
+containers:
+  - name: nblink
+    image: netbirdio/nblink
+    env:
+      - name: NB_FORWARD
+        value: http://8080=https://grafana.internal
+      - name: NB_SETUP_KEY
+        value: file:/run/secrets/nblink/setup-key
+    volumeMounts:
+      - name: nblink-key
+        mountPath: /run/secrets/nblink
+        readOnly: true
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      capabilities: {drop: [ALL]}
+      seccompProfile: {type: RuntimeDefault}
+volumes:
+  - name: nblink-key
+    secret:
+      secretName: nblink-setup-key
+      defaultMode: 0440
+```
+
+A Secret volume is owned by the pod's `fsGroup`, which OpenShift sets for
+every pod, so mode `0440` is readable by the container and by nothing else.
+
+To keep the identity across pod restarts, mount a persistent volume at
+`/var/lib/nblink` and set `NB_STATE_DIR` to it. `fsGroup` makes the volume
+writable by the arbitrary UID. A `Deployment` with more than one replica
+cannot share one state directory: every replica is its own peer, so give
+each one its own volume through a `StatefulSet`, or keep state in memory with
+an ephemeral setup key.
+
+Serving a forward to other pods through a Service needs `NB_ALLOW_PUBLIC_BIND`
+and every name callers use in `NB_ALLOWED_HOST`, for example
+`grafana-link,grafana-link.monitoring.svc,grafana-link.monitoring.svc.cluster.local`.
+Each caller acts under the forwarder peer's identity, so restrict who can
+reach the Service with a `NetworkPolicy`. Do not expose it through a Route or
+an Ingress.
+
+## Configuration
+
+| Flag | Environment | Default | Purpose |
+| --- | --- | --- | --- |
+| `--forward` | `NB_FORWARD` | | Forward spec, repeatable. Comma separated in the environment. |
+| `--setup-key` | `NB_SETUP_KEY` | | Non-interactive login. Accepts a `file:` prefix. |
+| `--management-url` | `NB_MANAGEMENT_URL` | NetBird cloud | Management server. |
+| `--hostname` | `NB_HOSTNAME` | host name | Peer name in the network. |
+| `--state-dir` | `NB_STATE_DIR` | memory | Where identity and state persist. |
+| `--log-level` | `NB_LOG_LEVEL` | `info` | Log level. |
+| `--allow-public-bind` | `NB_ALLOW_PUBLIC_BIND` | `false` | Required before binding a non-loopback address. |
+| `--allowed-host` | `NB_ALLOWED_HOST` | | Extra name a listener accepts in `Host`, repeatable. Comma separated in the environment. |
+| `--no-browser` | `NB_NO_BROWSER` | `false` | Print the login URL instead of opening a browser. |
+| `--check` | `NB_CHECK` | `false` | Validate, print the effective forwards, exit. |
+
+A secret given as `file:/path` is read from that file, so a container can mount
+it instead of exposing it in the process environment.
+
+## Limits
+
+`nblink` only dials out. It refuses inbound connections and does not reach the
+host's own network, so the peer cannot become a route into the machine it runs
+on.
+
+A loopback forward answers only requests whose `Host` names the loopback
+interface or a name listed with `--allowed-host`, and refuses any request a
+browser marks as belonging to another page, through either a cross-origin
+`Origin` or a cross-site `Sec-Fetch-Site`. A page the user visits can point its
+own hostname at `127.0.0.1` or embed the address directly, and without those
+checks the browser could reach the upstream through this listener under the
+peer's identity. Ordinary callers send neither header and are unaffected.
+
+A public forward applies the same checks, and also accepts any IP address in
+`Host`, since a page cannot rebind an address. The `Host` check matters there
+too: a container port published on the host's loopback is reached by a
+rebound page with a matching `Origin`, and its unlisted name is the only thing
+that gives it away.
+
+A name listed with `--allowed-host` is trusted rather than merely permitted,
+and the list applies to every forward in the process, loopback ones included.
+`Host` is the one signal a rebound page cannot forge, and listing a name gives
+that up for it: a page served on that name can resolve it to the listener and
+send a matching `Host` and `Origin`, which the browser then marks same-origin.
+List only names you control, and prefer a fully qualified one, since a
+single-label name can be answered by anything on the local network.
+
+A forward on `0.0.0.0` listens on IPv4 only, and one on `::` on IPv6 only.
+
+`nblink` does not ask the local router for a port mapping through UPnP,
+NAT-PMP or PCP, since an unprivileged forwarder should not reconfigure the
+network it runs on. Connections are still established through hole punching
+or the relay. Set `NB_DISABLE_NAT_MAPPER=false` to allow it.
+
+A browser too old to send `Sec-Fetch-Site`, which browsers have sent since
+2020, can still reach a loopback forward with an embedded no-cors GET.
+
+Userspace mode carries TCP, UDP and ping only. It cannot act as an exit node or
+a routing peer and does not take over system DNS. Ports below 1024 need
+privileges the process usually does not have, though some container runtimes
+lower that boundary.
+
+This build forwards HTTP. The `tcp`, `udp` and `socks5` schemes are reserved by
+the grammar and rejected with a message saying so, so adding them later needs
+no change to how a forward is written.
diff --git a/client/link/auth.go b/client/link/auth.go
new file mode 100644
index 000000000..91aa0a426
--- /dev/null
+++ b/client/link/auth.go
@@ -0,0 +1,101 @@
+package link
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/auth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/util"
+)
+
+// credentials carries exactly one proof of identity to the embedded client.
+type credentials struct {
+	setupKey string
+	jwtToken string
+}
+
+// resolveCredentials returns a setup key when one was supplied, and otherwise
+// drives the interactive login flow.
+//
+// The embedded client accepts a setup key or an already-issued token, so the
+// browser flow is run here and only its result is handed over.
+func resolveCredentials(ctx context.Context, cfg *Config) (credentials, error) {
+	if cfg.SetupKey != "" {
+		log.Info("authenticating with the configured setup key")
+		return credentials{setupKey: cfg.SetupKey}, nil
+	}
+
+	log.Info("no setup key configured, starting interactive login")
+	token, err := interactiveLogin(ctx, cfg)
+	if err != nil {
+		return credentials{}, err
+	}
+	return credentials{jwtToken: token}, nil
+}
+
+// interactiveLogin runs the standard browser login and returns the token to
+// authenticate the peer with.
+func interactiveLogin(ctx context.Context, cfg *Config) (string, error) {
+	// The flow only needs somewhere to read the management URL from and a key
+	// to talk to it with. The peer identity the client ends up using is
+	// created separately, so this config is deliberately not persisted.
+	flowConfig, err := profilemanager.CreateInMemoryConfig(profilemanager.ConfigInput{
+		ManagementURL: cfg.ManagementURL,
+	})
+	if err != nil {
+		return "", fmt.Errorf("prepare login: %w", err)
+	}
+
+	flow, err := auth.NewOAuthFlow(ctx, flowConfig, util.HasGraphicalSession(), false, "", false)
+	if err != nil {
+		return "", fmt.Errorf("start login: %w", err)
+	}
+
+	info, err := flow.RequestAuthInfo(ctx)
+	if err != nil {
+		return "", fmt.Errorf("request login: %w", err)
+	}
+
+	promptLogin(os.Stderr, util.OpenBrowser, info, cfg.NoBrowser)
+
+	token, err := flow.WaitToken(ctx, info)
+	if err != nil {
+		return "", fmt.Errorf("wait for login: %w", err)
+	}
+
+	return token.GetTokenToUse(), nil
+}
+
+// promptLogin writes the verification URL to out, which the caller points at
+// stderr so stdout stays clean for piping, and opens a browser unless asked not
+// to. The URL is always printed so the flow still works over SSH where no
+// browser can open.
+func promptLogin(out io.Writer, openBrowser func(string) error, info auth.AuthFlowInfo, noBrowser bool) {
+	uri := info.VerificationURIComplete
+	if uri == "" {
+		uri = info.VerificationURI
+	}
+
+	var b strings.Builder
+	fmt.Fprintf(&b, "\nOpen this URL to log in:\n\n    %s\n", uri)
+	if info.UserCode != "" && !strings.Contains(uri, info.UserCode) {
+		fmt.Fprintf(&b, "\n    and enter the code %s\n", info.UserCode)
+	}
+	b.WriteString("\n")
+	if _, err := io.WriteString(out, b.String()); err != nil {
+		log.Warnf("print login URL: %v", err)
+	}
+
+	if noBrowser {
+		return
+	}
+	if err := openBrowser(uri); err != nil {
+		log.Debugf("could not open a browser: %v", err)
+	}
+}
diff --git a/client/link/auth_test.go b/client/link/auth_test.go
new file mode 100644
index 000000000..69920a96c
--- /dev/null
+++ b/client/link/auth_test.go
@@ -0,0 +1,70 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/auth"
+)
+
+// browserSpy records the URLs a login prompt tried to open.
+type browserSpy struct {
+	opened []string
+	err    error
+}
+
+func (b *browserSpy) open(uri string) error {
+	b.opened = append(b.opened, uri)
+	return b.err
+}
+
+func TestPromptLoginPrintsURLAndOpensBrowser(t *testing.T) {
+	var out strings.Builder
+	browser := &browserSpy{}
+	info := auth.AuthFlowInfo{VerificationURIComplete: "https://login.example/device?code=ABCD-EFGH", UserCode: "ABCD-EFGH"}
+
+	promptLogin(&out, browser.open, info, false)
+
+	assert.Contains(t, out.String(), info.VerificationURIComplete, "the URL must be printed")
+	assert.NotContains(t, out.String(), "enter the code", "a code already in the URL must not be repeated")
+	assert.Equal(t, []string{info.VerificationURIComplete}, browser.opened, "the browser must be opened on the same URL")
+}
+
+func TestPromptLoginNoBrowserStillPrintsURL(t *testing.T) {
+	var out strings.Builder
+	browser := &browserSpy{}
+	info := auth.AuthFlowInfo{VerificationURI: "https://login.example/device", UserCode: "WXYZ-1234"}
+
+	promptLogin(&out, browser.open, info, true)
+
+	assert.Contains(t, out.String(), "https://login.example/device", "the URL must be printed even without a browser")
+	assert.Contains(t, out.String(), "enter the code WXYZ-1234", "a code missing from the URL must be printed")
+	assert.Empty(t, browser.opened, "--no-browser must not open a browser")
+}
+
+func TestPromptLoginSurvivesBrowserFailure(t *testing.T) {
+	var out strings.Builder
+	browser := &browserSpy{err: errors.New("no display")}
+	info := auth.AuthFlowInfo{VerificationURIComplete: "https://login.example/authorize"}
+
+	promptLogin(&out, browser.open, info, false)
+
+	assert.Contains(t, out.String(), "https://login.example/authorize",
+		"the URL must be printed so the login still works where no browser opens")
+}
+
+func TestResolveCredentialsUsesSetupKeyWithoutLogin(t *testing.T) {
+	// An unroutable management URL: a login attempt would fail, so success
+	// proves the setup key path never starts one.
+	cfg := &Config{SetupKey: "11111111-2222-3333-4444-555555555555", ManagementURL: "https://management.invalid"}
+
+	creds, err := resolveCredentials(context.Background(), cfg)
+	require.NoError(t, err)
+	assert.Equal(t, cfg.SetupKey, creds.setupKey, "the configured key must be used")
+	assert.Empty(t, creds.jwtToken, "exactly one proof of identity must be handed over")
+}
diff --git a/client/link/cmd/nblink/main.go b/client/link/cmd/nblink/main.go
new file mode 100644
index 000000000..6ee580c7b
--- /dev/null
+++ b/client/link/cmd/nblink/main.go
@@ -0,0 +1,69 @@
+// Command nblink forwards local listeners into a NetBird network from an
+// unprivileged process.
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/spf13/cobra"
+
+	"github.com/netbirdio/netbird/client/link"
+	"github.com/netbirdio/netbird/util"
+	"github.com/netbirdio/netbird/version"
+)
+
+func main() {
+	if err := rootCmd().Execute(); err != nil {
+		fmt.Fprintf(os.Stderr, "nblink: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func rootCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "nblink",
+		Short: "Forward local ports into a NetBird network",
+		Long: "nblink runs a NetBird peer in userspace and forwards local listeners\n" +
+			"into the network. It needs no TUN device and no elevated privileges,\n" +
+			"so it runs on managed machines and in rootless containers.\n\n" +
+			"Every flag can also be set through an NB_-prefixed environment variable\n" +
+			"of the same name, which is how the container image is configured.",
+		Example: "  nblink --forward 'http://8080=https://grafana.internal'\n" +
+			"  nblink --forward 'http://127.0.0.1:8080=https://grafana.internal' --setup-key file:/run/secrets/key",
+		Version: version.NetbirdVersion(),
+		// A stray positional argument is a mistake, most often a forward spec
+		// that lost its --forward, and must not start the forwarder anyway.
+		Args: cobra.NoArgs,
+		// main prints the error, so cobra must not print it a second time.
+		SilenceUsage:  true,
+		SilenceErrors: true,
+	}
+
+	raw := link.BindFlags(cmd)
+
+	cmd.RunE = func(cmd *cobra.Command, _ []string) error {
+		if err := link.SetFlagsFromEnvVars(cmd); err != nil {
+			return err
+		}
+
+		cfg, err := raw.Resolve()
+		if err != nil {
+			return err
+		}
+
+		if err := util.InitLog(cfg.LogLevel, util.LogConsole); err != nil {
+			return fmt.Errorf("init log: %w", err)
+		}
+
+		ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+		defer stop()
+
+		return link.Run(ctx, cfg)
+	}
+
+	return cmd
+}
diff --git a/client/link/cmd/nblink/main_test.go b/client/link/cmd/nblink/main_test.go
new file mode 100644
index 000000000..46bd158e6
--- /dev/null
+++ b/client/link/cmd/nblink/main_test.go
@@ -0,0 +1,80 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/version"
+)
+
+// TestMain clears the ambient NB_ environment before any test runs.
+//
+// Every flag reads an NB_-prefixed variable, so a developer who has nblink
+// configured in their own shell would otherwise hand these commands a
+// configuration the test never asked for: an inherited NB_FORWARD alone makes
+// the missing-forward case resolve successfully and the test fail. Clearing
+// here rather than in execute keeps t.Setenv working for the tests that do
+// want a variable set.
+func TestMain(m *testing.M) {
+	for _, entry := range os.Environ() {
+		name, _, _ := strings.Cut(entry, "=")
+		if strings.HasPrefix(name, "NB_") {
+			if err := os.Unsetenv(name); err != nil {
+				fmt.Fprintf(os.Stderr, "unset %s: %v\n", name, err)
+				os.Exit(1)
+			}
+		}
+	}
+	os.Exit(m.Run())
+}
+
+func execute(t *testing.T, args ...string) (string, error) {
+	t.Helper()
+	cmd := rootCmd()
+	var out strings.Builder
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	cmd.SetArgs(args)
+	err := cmd.Execute()
+	return out.String(), err
+}
+
+// A forward spec that lost its --forward is the usual stray argument, and it
+// must not start a forwarder with whatever else was configured.
+func TestRejectsPositionalArguments(t *testing.T) {
+	_, err := execute(t, "--check", "--forward", "http://8080=https://grafana.internal", "http://9090=https://prometheus.internal")
+	require.Error(t, err, "a positional argument must be refused")
+	assert.Contains(t, err.Error(), "unknown command", "the error must point at the stray argument")
+}
+
+func TestRejectsInvalidEnvironmentValue(t *testing.T) {
+	t.Setenv("NB_ALLOW_PUBLIC_BIND", "maybe")
+	_, err := execute(t, "--check", "--forward", "http://8080=https://grafana.internal")
+	require.Error(t, err, "an unparseable environment value must stop the start")
+	assert.Contains(t, err.Error(), "NB_ALLOW_PUBLIC_BIND", "the error must name the variable")
+}
+
+func TestEnvironmentConfiguresAFullCheck(t *testing.T) {
+	t.Setenv("NB_FORWARD", "http://8080=https://grafana.internal,http://0.0.0.0:9090=https://prometheus.internal")
+	t.Setenv("NB_ALLOW_PUBLIC_BIND", "true")
+	t.Setenv("NB_CHECK", "true")
+	_, err := execute(t)
+	assert.NoError(t, err, "a complete environment configuration must pass the check without flags")
+}
+
+func TestRequiresAForward(t *testing.T) {
+	_, err := execute(t, "--check")
+	require.Error(t, err, "a run with no forward must be refused")
+	assert.Contains(t, err.Error(), "NB_FORWARD", "the error must name the environment variable too")
+}
+
+func TestPrintsVersion(t *testing.T) {
+	out, err := execute(t, "--version")
+	require.NoError(t, err)
+	assert.Contains(t, out, version.NetbirdVersion(), "--version must print the build version")
+}
diff --git a/client/link/config.go b/client/link/config.go
new file mode 100644
index 000000000..1f86965f7
--- /dev/null
+++ b/client/link/config.go
@@ -0,0 +1,245 @@
+package link
+
+import (
+	"fmt"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// envPrefix matches the prefix the agent uses, so an operator who already sets
+// NB_SETUP_KEY or NB_MANAGEMENT_URL for the agent can reuse them here.
+const envPrefix = "NB_"
+
+// fileScheme marks a flag value that holds a path to read the real value from,
+// so a container can pass a secret as a mounted file instead of an environment
+// variable visible to anything that can read the process environment.
+const fileScheme = "file:"
+
+// hostnamePattern matches a DNS name per RFC 1123 section 2.1: dot-separated
+// labels of letters, digits and inner hyphens.
+var hostnamePattern = regexp.MustCompile(`^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$`)
+
+// Config is the resolved runtime configuration.
+type Config struct {
+	Forwards        []Forward
+	AllowedHosts    []string
+	SetupKey        string
+	ManagementURL   string
+	Hostname        string
+	StateDir        string
+	LogLevel        string
+	AllowPublicBind bool
+	NoBrowser       bool
+	Check           bool
+}
+
+// rawConfig holds flag values before parsing and validation.
+type rawConfig struct {
+	forwards        []string
+	allowedHosts    []string
+	setupKey        string
+	managementURL   string
+	hostname        string
+	stateDir        string
+	logLevel        string
+	allowPublicBind bool
+	noBrowser       bool
+	check           bool
+}
+
+// Resolve validates the raw flag values and produces a runtime configuration.
+// It reports every problem it can rather than stopping at the first, so an
+// operator fixing a container environment sees the whole list in one run.
+func (r *rawConfig) Resolve() (*Config, error) {
+	cfg := &Config{
+		ManagementURL:   r.managementURL,
+		Hostname:        r.hostname,
+		StateDir:        r.stateDir,
+		LogLevel:        r.logLevel,
+		AllowPublicBind: r.allowPublicBind,
+		NoBrowser:       r.noBrowser,
+		Check:           r.check,
+	}
+
+	setupKey, err := resolveSecret(r.setupKey)
+	if err != nil {
+		return nil, fmt.Errorf("setup key: %w", err)
+	}
+	cfg.SetupKey = setupKey
+
+	if len(r.forwards) == 0 {
+		return nil, fmt.Errorf("at least one --forward is required (env %s)", FlagNameToEnvVar("forward"))
+	}
+
+	var problems []string
+	cfg.AllowedHosts, problems = parseAllowedHosts(r.allowedHosts)
+
+	seen := make(map[string]string, len(r.forwards))
+	for _, spec := range r.forwards {
+		fwd, err := ParseForward(spec)
+		if err != nil {
+			problems = append(problems, err.Error())
+			continue
+		}
+		// Port 0 means the OS assigns one, so several such forwards do not
+		// collide even though they share a spec.
+		if prev, dup := seen[fwd.Listen]; dup && !strings.HasSuffix(fwd.Listen, ":0") {
+			problems = append(problems, fmt.Sprintf("forward %q: %s is already bound by %q", spec, fwd.Listen, prev))
+			continue
+		}
+		if !cfg.AllowPublicBind && !isLoopback(fwd.Listen) {
+			problems = append(problems, fmt.Sprintf(
+				"forward %q: %s is not loopback, pass --allow-public-bind (env %s) to expose it",
+				spec, fwd.Listen, FlagNameToEnvVar("allow-public-bind")))
+			continue
+		}
+		seen[fwd.Listen] = spec
+		fwd.AllowedHosts = cfg.AllowedHosts
+		cfg.Forwards = append(cfg.Forwards, fwd)
+	}
+
+	if len(problems) > 0 {
+		return nil, fmt.Errorf("invalid configuration:\n  %s", strings.Join(problems, "\n  "))
+	}
+
+	return cfg, nil
+}
+
+// ConfigPath returns where the peer identity is persisted, or an empty string
+// when the client should keep it in memory only.
+func (c *Config) ConfigPath() string {
+	if c.StateDir == "" {
+		return ""
+	}
+	return filepath.Join(c.StateDir, "config.json")
+}
+
+// StatePath returns where runtime state is persisted, or an empty string when
+// no state directory was configured.
+func (c *Config) StatePath() string {
+	if c.StateDir == "" {
+		return ""
+	}
+	return filepath.Join(c.StateDir, "state.json")
+}
+
+// BindFlags registers nblink's flags on cmd and returns the backing values.
+// Every flag gains an NB_-prefixed environment variable of the same name, so
+// the container configuration cannot drift from the command line.
+func BindFlags(cmd *cobra.Command) *rawConfig {
+	raw := &rawConfig{}
+	f := cmd.PersistentFlags()
+
+	f.StringSliceVar(&raw.forwards, "forward", nil,
+		"forward spec scheme://[host:]port=upstream, repeatable (env: comma separated)")
+	f.StringSliceVar(&raw.allowedHosts, "allowed-host", nil,
+		"extra name a listener may be reached under, repeatable (env: comma separated)")
+	f.StringVar(&raw.setupKey, "setup-key", "",
+		"setup key for non-interactive login, accepts a file: prefix")
+	f.StringVar(&raw.managementURL, "management-url", profilemanager.DefaultManagementURL,
+		"management server URL")
+	f.StringVar(&raw.hostname, "hostname", "", "peer name in the network")
+	f.StringVar(&raw.stateDir, "state-dir", "",
+		"directory for config and state, kept in memory when empty")
+	f.StringVar(&raw.logLevel, "log-level", "info", "log level")
+	f.BoolVar(&raw.allowPublicBind, "allow-public-bind", false,
+		"permit forwards that bind an address other than loopback")
+	f.BoolVar(&raw.noBrowser, "no-browser", false,
+		"print the login URL instead of opening a browser")
+	f.BoolVar(&raw.check, "check", false,
+		"validate configuration, print the effective forwards and exit")
+
+	return raw
+}
+
+// SetFlagsFromEnvVars fills unset flags from NB_-prefixed environment
+// variables derived from each flag name, so --management-url reads
+// NB_MANAGEMENT_URL. A flag given on the command line wins.
+//
+// A value that does not parse is an error rather than a warning, so a
+// container cannot start with a configuration other than the one it was given.
+func SetFlagsFromEnvVars(cmd *cobra.Command) error {
+	flags := cmd.PersistentFlags()
+	var err error
+	flags.VisitAll(func(f *pflag.Flag) {
+		if err != nil || f.Changed {
+			return
+		}
+		env := FlagNameToEnvVar(f.Name)
+		value, ok := os.LookupEnv(env)
+		if !ok {
+			return
+		}
+		if setErr := flags.Set(f.Name, value); setErr != nil {
+			err = fmt.Errorf("%s: %w", env, setErr)
+		}
+	})
+	return err
+}
+
+// FlagNameToEnvVar converts a flag name to its environment variable, so
+// allow-public-bind becomes NB_ALLOW_PUBLIC_BIND.
+func FlagNameToEnvVar(name string) string {
+	return envPrefix + strings.ToUpper(strings.ReplaceAll(name, "-", "_"))
+}
+
+// parseAllowedHosts normalizes the names given with --allowed-host and reports
+// every entry that is not a plain hostname.
+func parseAllowedHosts(raw []string) ([]string, []string) {
+	var hosts, problems []string
+	for _, entry := range raw {
+		name := normalizeHostname(entry)
+		if _, err := netip.ParseAddr(name); err == nil {
+			problems = append(problems, fmt.Sprintf(
+				"allowed host %q: addresses are already accepted on a public listener, list names only", entry))
+			continue
+		}
+		if !hostnamePattern.MatchString(name) {
+			problems = append(problems, fmt.Sprintf(
+				"allowed host %q: must be a hostname, without scheme, port or wildcard", entry))
+			continue
+		}
+		hosts = append(hosts, name)
+	}
+	return hosts, problems
+}
+
+// normalizeHostname lowercases a name and drops a trailing root dot, so the
+// spellings a client may send compare equal.
+func normalizeHostname(name string) string {
+	return strings.TrimSuffix(strings.ToLower(strings.TrimSpace(name)), ".")
+}
+
+// resolveSecret reads a value that may carry a file: prefix naming the file
+// that holds it. Whitespace around the file contents is trimmed so a trailing
+// newline from the usual tooling does not become part of the secret.
+func resolveSecret(value string) (string, error) {
+	path, ok := strings.CutPrefix(value, fileScheme)
+	if !ok {
+		return value, nil
+	}
+	if path == "" {
+		return "", fmt.Errorf("%s prefix with no path", fileScheme)
+	}
+
+	content, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read %s: %w", path, err)
+	}
+
+	// An empty file would otherwise look like no secret at all, silently
+	// turning a non-interactive start into a login that waits for a browser.
+	secret := strings.TrimSpace(string(content))
+	if secret == "" {
+		return "", fmt.Errorf("%s is empty", path)
+	}
+	return secret, nil
+}
diff --git a/client/link/config_test.go b/client/link/config_test.go
new file mode 100644
index 000000000..72b238873
--- /dev/null
+++ b/client/link/config_test.go
@@ -0,0 +1,219 @@
+package link
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newTestCommand wires the flags the same way the binary does, so the tests
+// exercise the real flag and environment plumbing.
+func newTestCommand() (*cobra.Command, *rawConfig) {
+	cmd := &cobra.Command{Use: "nblink"}
+	return cmd, BindFlags(cmd)
+}
+
+func TestFlagNameToEnvVar(t *testing.T) {
+	assert.Equal(t, "NB_FORWARD", FlagNameToEnvVar("forward"))
+	assert.Equal(t, "NB_ALLOW_PUBLIC_BIND", FlagNameToEnvVar("allow-public-bind"))
+	assert.Equal(t, "NB_MANAGEMENT_URL", FlagNameToEnvVar("management-url"))
+}
+
+func TestSetFlagsFromEnvVars(t *testing.T) {
+	cmd, raw := newTestCommand()
+	t.Setenv("NB_FORWARD", "http://8080=https://a.internal,http://8081=https://b.internal")
+	t.Setenv("NB_MANAGEMENT_URL", "https://mgmt.example:443")
+
+	require.NoError(t, SetFlagsFromEnvVars(cmd))
+
+	assert.Equal(t, []string{"http://8080=https://a.internal", "http://8081=https://b.internal"},
+		raw.forwards, "NB_FORWARD should split on commas into repeated forwards")
+	assert.Equal(t, "https://mgmt.example:443", raw.managementURL)
+}
+
+// A value given on the command line must win over the environment, otherwise a
+// container's baked-in defaults could not be overridden at run time.
+func TestFlagBeatsEnvVar(t *testing.T) {
+	cmd, raw := newTestCommand()
+	require.NoError(t, cmd.PersistentFlags().Set("log-level", "debug"))
+	t.Setenv("NB_LOG_LEVEL", "error")
+
+	require.NoError(t, SetFlagsFromEnvVars(cmd))
+
+	assert.Equal(t, "debug", raw.logLevel, "an explicit flag should not be overwritten by the environment")
+}
+
+// A container must not start with a configuration other than the one it was
+// given, so an unparseable value stops startup instead of leaving the default.
+func TestSetFlagsFromEnvVarsRejectsInvalidValue(t *testing.T) {
+	cmd, raw := newTestCommand()
+	t.Setenv("NB_ALLOW_PUBLIC_BIND", "yes-please")
+
+	err := SetFlagsFromEnvVars(cmd)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "NB_ALLOW_PUBLIC_BIND", "the error should name the variable at fault")
+	assert.False(t, raw.allowPublicBind, "the default must not be silently kept in effect")
+}
+
+func TestResolveRequiresForward(t *testing.T) {
+	_, raw := newTestCommand()
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "at least one --forward")
+}
+
+func TestResolveGatesPublicBind(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://0.0.0.0:8080=https://grafana.internal"}
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "allow-public-bind",
+		"binding a public address should require the explicit opt-in")
+}
+
+func TestResolveAllowsPublicBindWhenOptedIn(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://0.0.0.0:8080=https://grafana.internal"}
+	raw.allowPublicBind = true
+
+	cfg, err := raw.Resolve()
+
+	require.NoError(t, err)
+	require.Len(t, cfg.Forwards, 1)
+	assert.Equal(t, "0.0.0.0:8080", cfg.Forwards[0].Listen)
+}
+
+func TestResolveRejectsDuplicateListener(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{
+		"http://8080=https://a.internal",
+		"http://127.0.0.1:8080=https://b.internal",
+	}
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "already bound",
+		"two forwards on one address should be caught before binding")
+}
+
+// Every bad spec should be reported together, so fixing a container
+// environment does not take one deploy per mistake.
+func TestResolveReportsEveryProblem(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{
+		"http://70000=https://a.internal",
+		"gopher://8081=https://b.internal",
+	}
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "out of range")
+	assert.Contains(t, err.Error(), "unknown scheme")
+}
+
+func TestResolveAllowedHosts(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://0.0.0.0:8080=https://a.internal", "http://8081=https://b.internal"}
+	raw.allowPublicBind = true
+	raw.allowedHosts = []string{"NBLink.LAN.", "svc.ns.svc.cluster.local"}
+
+	cfg, err := raw.Resolve()
+
+	require.NoError(t, err)
+	assert.Equal(t, []string{"nblink.lan", "svc.ns.svc.cluster.local"}, cfg.AllowedHosts,
+		"allowed hosts must be stored in the form they are compared in")
+	for _, f := range cfg.Forwards {
+		assert.Equal(t, cfg.AllowedHosts, f.AllowedHosts, "every forward must carry the allowed hosts")
+	}
+}
+
+func TestResolveRejectsMalformedAllowedHosts(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://8080=https://a.internal"}
+	raw.allowedHosts = []string{"http://nblink.lan", "nblink.lan:8080", "*.lan", "10.0.0.5", ""}
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	for _, entry := range []string{`"http://nblink.lan"`, `"nblink.lan:8080"`, `"*.lan"`, `""`} {
+		assert.Contains(t, err.Error(), entry, "every malformed entry must be reported")
+	}
+	assert.Contains(t, err.Error(), "addresses are already accepted", "an address must be explained, not just refused")
+}
+
+func TestResolveSetupKeyFromFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "key")
+	// The trailing newline mirrors what a mounted secret usually contains.
+	require.NoError(t, os.WriteFile(path, []byte("A1B2C3D4-SETUP-KEY\n"), 0o600))
+
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://8080=https://a.internal"}
+	raw.setupKey = "file:" + path
+
+	cfg, err := raw.Resolve()
+
+	require.NoError(t, err)
+	assert.Equal(t, "A1B2C3D4-SETUP-KEY", cfg.SetupKey, "a mounted secret should be trimmed")
+}
+
+// Each port-0 forward gets its own OS-assigned port, so sharing the spec is
+// not a collision.
+func TestResolveAllowsSeveralEphemeralPorts(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{
+		"http://0=https://a.internal",
+		"http://0=https://b.internal",
+	}
+
+	cfg, err := raw.Resolve()
+
+	require.NoError(t, err)
+	assert.Len(t, cfg.Forwards, 2, "two ephemeral forwards should both be kept")
+}
+
+func TestResolveSetupKeyFileEmpty(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "key")
+	require.NoError(t, os.WriteFile(path, []byte("   \n"), 0o600))
+
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://8080=https://a.internal"}
+	raw.setupKey = "file:" + path
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "is empty",
+		"an empty secret should fail rather than fall back to interactive login")
+}
+
+func TestResolveSetupKeyFileMissing(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://8080=https://a.internal"}
+	raw.setupKey = "file:" + filepath.Join(t.TempDir(), "absent")
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "setup key")
+}
+
+func TestStatePathsFollowStateDir(t *testing.T) {
+	cfg := &Config{}
+	assert.Empty(t, cfg.ConfigPath(), "an unset state dir should keep identity in memory")
+	assert.Empty(t, cfg.StatePath())
+
+	cfg.StateDir = "/var/lib/nblink"
+	assert.Equal(t, filepath.Join("/var/lib/nblink", "config.json"), cfg.ConfigPath())
+	assert.Equal(t, filepath.Join("/var/lib/nblink", "state.json"), cfg.StatePath())
+}
diff --git a/client/link/forward.go b/client/link/forward.go
new file mode 100644
index 000000000..25d272931
--- /dev/null
+++ b/client/link/forward.go
@@ -0,0 +1,217 @@
+// Package link implements nblink, an unprivileged forwarder that exposes local
+// listeners and carries their traffic into the NetBird overlay.
+//
+// The process runs the embedded client in netstack mode, so it needs no TUN
+// device and no elevated privileges. Overlay names on the upstream side are
+// resolved inside the tunnel rather than through the host resolver.
+package link
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// defaultBindHost is used when a forward spec gives a port but no bind address.
+// Binding loopback by default keeps the overlay unreachable from the rest of
+// the network until the operator opts in.
+const defaultBindHost = "127.0.0.1"
+
+// ProtoHTTP forwards HTTP requests to an upstream URL over the overlay.
+const ProtoHTTP = "http"
+
+// supportedProtos lists the forward schemes this build accepts. Specs naming a
+// known but unimplemented scheme are rejected with a clearer message than an
+// unknown one would produce.
+var (
+	supportedProtos = map[string]bool{ProtoHTTP: true}
+	plannedProtos   = map[string]bool{"tcp": true, "udp": true, "socks5": true}
+
+	// schemePrefix matches a URL scheme at the start of a string, per RFC 3986
+	// section 3.1.
+	schemePrefix = regexp.MustCompile(`^[a-zA-Z][a-zA-Z0-9+.\-]*://`)
+
+	// urlPassword matches the password half of a URL's userinfo. Errors quote
+	// the spec the operator typed, which would otherwise echo a password back
+	// to the terminal and into whatever captured it.
+	//
+	// The password runs to the last '@' of the authority, which is where
+	// net/url ends the userinfo, so a password containing an '@' is covered
+	// whole. The username ends at the first ':', as net/url splits it.
+	urlPassword = regexp.MustCompile(`(//[^/:\s]*):[^/\s]*@`)
+)
+
+// Forward is one local listener and the overlay address it carries traffic to.
+type Forward struct {
+	// Proto is the listener type, taken from the scheme on the left of the spec.
+	Proto string
+	// Listen is the local bind address as host:port.
+	Listen string
+	// Upstream is the target reached over the overlay.
+	Upstream *url.URL
+	// Spec is the original text, used in logs and errors so the operator sees
+	// what they typed rather than a normalized form.
+	Spec string
+	// AllowedHosts are names, beyond loopback names and addresses, that the
+	// listener accepts in the Host header.
+	AllowedHosts []string
+}
+
+// String returns the forward in the spec form the operator wrote.
+func (f Forward) String() string {
+	return fmt.Sprintf("%s://%s=%s", f.Proto, f.Listen, f.Upstream)
+}
+
+// ParseForward parses a forward spec of the form scheme://[host:]port=upstream.
+//
+// The scheme on the left selects the listener type, the right side is the
+// overlay target. A spec that gives only a port binds loopback.
+func ParseForward(spec string) (Forward, error) {
+	spec = strings.TrimSpace(spec)
+	if spec == "" {
+		return Forward{}, fmt.Errorf("empty forward spec")
+	}
+
+	schemeEnd := strings.Index(spec, "://")
+	if schemeEnd < 0 {
+		return Forward{}, fmt.Errorf("forward %q: missing scheme, want scheme://[host:]port=upstream", redactSpec(spec))
+	}
+	proto := strings.ToLower(spec[:schemeEnd])
+
+	// The left side cannot contain '=', so the first one always separates the
+	// listener from the upstream even when the upstream carries a query string.
+	sep := strings.Index(spec, "=")
+	if sep < 0 || sep < schemeEnd {
+		return Forward{}, fmt.Errorf("forward %q: missing '=' between listener and upstream", redactSpec(spec))
+	}
+
+	if !supportedProtos[proto] {
+		if plannedProtos[proto] {
+			return Forward{}, fmt.Errorf("forward %q: %s forwarding is not supported yet, this build handles %s", redactSpec(spec), proto, ProtoHTTP)
+		}
+		return Forward{}, fmt.Errorf("forward %q: unknown scheme %q", redactSpec(spec), proto)
+	}
+
+	listen, err := parseListen(spec[schemeEnd+len("://") : sep])
+	if err != nil {
+		return Forward{}, fmt.Errorf("forward %q: %w", redactSpec(spec), err)
+	}
+
+	upstream, err := parseUpstream(spec[sep+1:])
+	if err != nil {
+		return Forward{}, fmt.Errorf("forward %q: %w", redactSpec(spec), err)
+	}
+
+	return Forward{Proto: proto, Listen: listen, Upstream: upstream, Spec: spec}, nil
+}
+
+// redactSpec replaces any password inside a forward spec, so an error may
+// still name the spec it refers to.
+func redactSpec(spec string) string {
+	return urlPassword.ReplaceAllString(spec, "$1:xxxxx@")
+}
+
+// parseListen normalizes the listener side of a spec to host:port, defaulting
+// the host to loopback when only a port is given.
+func parseListen(raw string) (string, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return "", fmt.Errorf("missing listen address")
+	}
+
+	host, port := defaultBindHost, raw
+	if strings.Contains(raw, ":") {
+		h, p, err := net.SplitHostPort(raw)
+		if err != nil {
+			return "", fmt.Errorf("parse listen address %q: %w", raw, err)
+		}
+		if h != "" {
+			host = h
+		}
+		port = p
+	}
+
+	// Only literal addresses are accepted. A name would be resolved once by
+	// the loopback check and again by the bind, and an answer that changed in
+	// between would put a listener on a public address without the opt-in. A
+	// zone suffix stays allowed: it is part of the literal, resolved the same
+	// way at both points, and link-local addresses cannot be bound without it.
+	if strings.EqualFold(host, "localhost") {
+		host = defaultBindHost
+	}
+	if _, err := netip.ParseAddr(host); err != nil {
+		return "", fmt.Errorf("listen host %q must be an IP address or localhost", host)
+	}
+
+	n, err := strconv.Atoi(port)
+	if err != nil {
+		return "", fmt.Errorf("listen port %q is not a number", port)
+	}
+	// Port 0 asks the OS for a free port. The bound address is printed at
+	// startup, so the operator still learns where to point a client.
+	if n < 0 || n > 65535 {
+		return "", fmt.Errorf("listen port %d out of range 0-65535", n)
+	}
+
+	return net.JoinHostPort(host, port), nil
+}
+
+// parseUpstream validates the overlay target of an HTTP forward. The host is
+// resolved later, inside the tunnel, so only the shape is checked here.
+func parseUpstream(raw string) (*url.URL, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return nil, fmt.Errorf("missing upstream")
+	}
+	// Only a leading scheme counts. A "://" inside a path or query, as in a
+	// redirect parameter, belongs to the target rather than to this URL.
+	if !schemePrefix.MatchString(raw) {
+		raw = "https://" + raw
+	}
+
+	u, err := url.Parse(raw)
+	if err != nil {
+		// url.Error carries the whole URL, password included, so only the
+		// reason inside it is reported alongside the redacted form.
+		var parseErr *url.Error
+		if errors.As(err, &parseErr) {
+			err = parseErr.Err
+		}
+		return nil, fmt.Errorf("parse upstream %q: %w", redactSpec(raw), err)
+	}
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return nil, fmt.Errorf("upstream scheme %q must be http or https", u.Scheme)
+	}
+	if u.Hostname() == "" {
+		return nil, fmt.Errorf("upstream %q has no host", redactSpec(raw))
+	}
+	// Credentials in the upstream would reach the logs and the --check output,
+	// and the forwarder does not use them to authenticate anything.
+	if u.User != nil {
+		return nil, fmt.Errorf("upstream %q must not carry credentials", u.Redacted())
+	}
+
+	return u, nil
+}
+
+// isLoopback reports whether addr binds only the loopback interface. The host
+// is always a literal address, because parseListen rejects names, so this
+// decides the same address the bind will use.
+func isLoopback(addr string) bool {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return false
+	}
+	ip, err := netip.ParseAddr(host)
+	if err != nil {
+		return false
+	}
+	// Unmap first, so a v4-mapped form such as ::ffff:127.0.0.1 is recognised
+	// as the loopback address it is.
+	return ip.Unmap().IsLoopback()
+}
diff --git a/client/link/forward_http.go b/client/link/forward_http.go
new file mode 100644
index 000000000..463de5134
--- /dev/null
+++ b/client/link/forward_http.go
@@ -0,0 +1,422 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/netip"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// dialTimeout bounds connection establishment only. Request and response
+	// bodies stream without a deadline so long downloads are not cut off.
+	dialTimeout = 30 * time.Second
+
+	// readHeaderTimeout bounds how long a caller may take to send request
+	// headers.
+	readHeaderTimeout = 10 * time.Second
+
+	// fetchSiteHeader is the browser's own account of how a request was
+	// initiated. It is the only one of the three guard signals that a no-cors
+	// GET carries.
+	fetchSiteHeader = "Sec-Fetch-Site"
+
+	// defaultHTTPPort fills in the port an origin leaves implicit.
+	defaultHTTPPort = "80"
+
+	idleConnTimeout       = 90 * time.Second
+	tlsHandshakeTimeout   = 10 * time.Second
+	expectContinueTimeout = time.Second
+	maxIdleConns          = 100
+
+	// maxHeaderBytes caps the request headers a caller may send.
+	maxHeaderBytes = 32 << 10
+
+	// maxLoggedPath caps how much of a caller-supplied path reaches the log.
+	maxLoggedPath = 128
+)
+
+// bodyIdleTimeout bounds how long a request body may stall without delivering
+// more bytes. It is a variable so tests can shorten it.
+var bodyIdleTimeout = 30 * time.Second
+
+// foreignFetchSites are the Sec-Fetch-Site values a browser sends when a page
+// other than this listener's own initiated the request. A page on another port
+// is same-site here, because a bare address or localhost is its own site, yet
+// it is a different application with no more claim on this listener than any
+// other page has.
+var foreignFetchSites = map[string]bool{"cross-site": true, "same-site": true}
+
+// DialFunc establishes a connection inside the overlay. The embedded client
+// supplies the real implementation; tests supply their own.
+type DialFunc func(ctx context.Context, network, addr string) (net.Conn, error)
+
+// httpForwarder serves one local HTTP listener and proxies what it accepts to
+// an upstream reached over the overlay.
+type httpForwarder struct {
+	forward  Forward
+	server   *http.Server
+	listener net.Listener
+}
+
+// idleTimeoutBody applies a fresh read deadline before every read, so a
+// transfer that keeps progressing runs as long as it needs while a stalled one
+// is cut off.
+type idleTimeoutBody struct {
+	io.ReadCloser
+	controller *http.ResponseController
+	idle       time.Duration
+}
+
+// newHTTPForwarder binds the local listener and prepares the reverse proxy.
+// Binding happens here rather than in Serve so a port clash is reported before
+// any forward is announced as ready.
+func newHTTPForwarder(fwd Forward, dial DialFunc) (*httpForwarder, error) {
+	listener, err := net.Listen(listenNetwork(fwd.Listen), fwd.Listen)
+	if err != nil {
+		return nil, fmt.Errorf("listen on %s: %w", fwd.Listen, bindHint(fwd.Listen, err))
+	}
+
+	upstream := fwd.Upstream
+	proxy := &httputil.ReverseProxy{
+		Rewrite: func(r *httputil.ProxyRequest) {
+			r.SetURL(upstream)
+			// The upstream decides routing and TLS verification from Host, and
+			// it must see its own name rather than the local bind address.
+			r.Out.Host = upstream.Host
+		},
+		Transport: &http.Transport{
+			DialContext:       boundedDial(dial),
+			ForceAttemptHTTP2: true,
+			MaxIdleConns:      maxIdleConns,
+			// Without this the per-host default of two applies and MaxIdleConns
+			// never binds, so concurrent requests re-dial the overlay instead
+			// of reusing a connection.
+			MaxIdleConnsPerHost:   maxIdleConns,
+			IdleConnTimeout:       idleConnTimeout,
+			TLSHandshakeTimeout:   tlsHandshakeTimeout,
+			ExpectContinueTimeout: expectContinueTimeout,
+		},
+		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
+			if errors.Is(err, context.Canceled) {
+				return
+			}
+			log.Debugf("%s %s %s: %v", fwd.Listen, r.Method, truncatePath(r.URL.Path), err)
+			// No upstream answered, so the connection is closed rather than
+			// kept for a next request. What is left of the body is still
+			// drained afterwards, bounded by the deadline armed in
+			// withBodyIdleTimeout.
+			rejectRequest(w, "upstream unreachable over the overlay", http.StatusBadGateway)
+		},
+	}
+
+	return &httpForwarder{
+		forward:  fwd,
+		listener: listener,
+		server: &http.Server{
+			Handler: withBodyIdleTimeout(guardRebinding(proxy, isLoopback(fwd.Listen), fwd.AllowedHosts)),
+			// Bound how long a caller may take to send headers, so a slow
+			// sender cannot hold a connection and its goroutine open
+			// indefinitely. Neither deadline limits body streaming, so large
+			// uploads and downloads still run as long as they need.
+			ReadHeaderTimeout: readHeaderTimeout,
+			IdleTimeout:       idleConnTimeout,
+			// Go's default allows about a megabyte of headers per connection,
+			// which a caller on a published port can spend freely.
+			MaxHeaderBytes: maxHeaderBytes,
+		},
+	}, nil
+}
+
+// Addr returns the address actually bound, which differs from the spec when
+// the operator asked for port 0.
+func (f *httpForwarder) Addr() string {
+	return f.listener.Addr().String()
+}
+
+// Serve runs until the forwarder is closed.
+func (f *httpForwarder) Serve() error {
+	if err := f.server.Serve(f.listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		return fmt.Errorf("serve %s: %w", f.forward.Listen, err)
+	}
+	return nil
+}
+
+// Close stops the listener and waits for in-flight requests to finish, up to
+// the deadline carried by ctx.
+//
+// Shutdown only closes listeners the server has taken over in Serve, so the
+// raw listener is closed here as well. Otherwise a forwarder that was built
+// but never served, which happens when a later bind in the same set fails,
+// would hold its socket until the process exits.
+func (f *httpForwarder) Close(ctx context.Context) error {
+	shutdownErr := f.server.Shutdown(ctx)
+	if err := f.listener.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
+		return err
+	}
+	return shutdownErr
+}
+
+func (b *idleTimeoutBody) Read(p []byte) (int, error) {
+	if err := b.setDeadline(time.Now().Add(b.idle)); err != nil {
+		return 0, err
+	}
+
+	n, err := b.ReadCloser.Read(p)
+	if errors.Is(err, io.EOF) {
+		// The body arrived in full, so its deadline has to go with it. The
+		// server keeps reading the connection while the handler streams its
+		// reply, and a deadline left over from the body would cut that reply
+		// off partway through.
+		//
+		// Only EOF clears it. On any other error the caller stalled or the
+		// connection broke, and the deadline is what stops the server from
+		// blocking forever as it drains what was never sent.
+		b.clearDeadline()
+	}
+	return n, err
+}
+
+func (b *idleTimeoutBody) setDeadline(t time.Time) error {
+	// A connection that cannot carry a deadline, which the controller reports
+	// as unsupported, still reads normally rather than failing the request.
+	if err := b.controller.SetReadDeadline(t); err != nil && !errors.Is(err, http.ErrNotSupported) {
+		return err
+	}
+	return nil
+}
+
+// clearDeadline removes any read deadline. A failure here cannot be acted on
+// and must not mask the error the caller is already returning.
+func (b *idleTimeoutBody) clearDeadline() {
+	if err := b.setDeadline(time.Time{}); err != nil {
+		log.Debugf("clear read deadline: %v", err)
+	}
+}
+
+// listenNetwork pins the address family to the literal the operator wrote.
+// Plain "tcp" turns 0.0.0.0 into a dual-stack wildcard that also accepts IPv6,
+// which exposes more than the spec asked for. A "6" network binds IPv6 only.
+func listenNetwork(addr string) string {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return "tcp"
+	}
+	ip, err := netip.ParseAddr(host)
+	if err != nil {
+		return "tcp"
+	}
+	if ip.Is4() {
+		return "tcp4"
+	}
+	return "tcp6"
+}
+
+// boundedDial applies dialTimeout to connection establishment without
+// constraining the lifetime of the connection it returns.
+func boundedDial(dial DialFunc) DialFunc {
+	return func(ctx context.Context, network, addr string) (net.Conn, error) {
+		ctx, cancel := context.WithTimeout(ctx, dialTimeout)
+		defer cancel()
+
+		start := time.Now()
+		conn, err := dial(ctx, network, addr)
+		if err != nil {
+			log.Debugf("dial %s over the overlay failed after %s: %v",
+				addr, time.Since(start).Truncate(time.Millisecond), err)
+			return nil, err
+		}
+		log.Debugf("dial %s over the overlay took %s, remote %s",
+			addr, time.Since(start).Truncate(time.Millisecond), conn.RemoteAddr())
+		return conn, nil
+	}
+}
+
+// bindHint adds the likely cause when a bind fails for a reason an operator
+// can act on. The privileged-port boundary is detected from the error rather
+// than assumed from the port number, because containers often lower it to zero.
+func bindHint(addr string, err error) error {
+	if errors.Is(err, os.ErrPermission) {
+		return fmt.Errorf("%w (nblink runs unprivileged, so %s likely needs a port above 1023)", err, addr)
+	}
+	return err
+}
+
+// withBodyIdleTimeout cuts off a caller that sends request headers and then
+// stops sending the body.
+//
+// ReadHeaderTimeout covers only the headers, and IdleTimeout applies between
+// requests rather than during one, so without this a caller could hold a
+// connection and its handler open indefinitely. A total ReadTimeout would
+// close that gap but would also break legitimate long uploads, so the deadline
+// is refreshed on every read that makes progress instead.
+func withBodyIdleTimeout(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Body != nil && r.Body != http.NoBody {
+			b := &idleTimeoutBody{
+				ReadCloser: r.Body,
+				controller: http.NewResponseController(w),
+				idle:       bodyIdleTimeout,
+			}
+			// Armed before the handler runs rather than on the first read,
+			// because it is the only bound on the drain the server performs
+			// after the handler returns. That drain reads the connection
+			// directly and no response header suppresses it, so a handler
+			// that never touches the body would otherwise leave the
+			// connection and its goroutine held until the caller goes away.
+			//
+			// Replacing r.Body also hides it from net/http's own type-based
+			// checks, which short-circuit that drain for a body it recognises,
+			// so this deadline stands in for those too.
+			if err := b.setDeadline(time.Now().Add(b.idle)); err != nil {
+				log.Debugf("arm request body deadline: %v", err)
+			}
+			r.Body = b
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// guardRebinding rejects requests that a browser issued on behalf of some
+// other site, and requests that reached a loopback listener under a name that
+// is not its own.
+//
+// A loopback forwarder is reachable from any page the user visits. A site can
+// point its own hostname at 127.0.0.1, and it can also embed the loopback
+// address directly in an img, script or iframe URL. Either way the browser
+// sends the request, and this listener would otherwise proxy it into the
+// network under the peer's identity.
+//
+// Three signals separate those from a local caller. Host carries the
+// attacker's name in the rebinding variant. Origin is present on any
+// cross-origin fetch. Sec-Fetch-Site covers what the first two miss: the
+// browser states how the request was initiated, including on the no-cors GETs
+// that carry no Origin at all. Non-browser callers send none of the latter
+// two and are unaffected.
+//
+// A browser too old to send Sec-Fetch-Site can still reach a loopback forward
+// with an embedded no-cors GET. Browsers have sent it since 2020, so this
+// residual needs a deliberately outdated one.
+//
+// The Host check holds on a publicly bound listener too, which is how a
+// container port published to the host is reached. There a rebound page sends
+// its own name with a matching Origin, so Host is the only signal left. Other
+// machines reach a public listener by address, which is accepted; any name
+// they use instead has to be listed with --allowed-host.
+func guardRebinding(next http.Handler, loopbackOnly bool, allowedHosts []string) http.Handler {
+	allowed := make(map[string]bool, len(allowedHosts))
+	for _, h := range allowedHosts {
+		allowed[normalizeHostname(h)] = true
+	}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !isAllowedHost(hostnameOf(r.Host), loopbackOnly, allowed) {
+			rejectRequest(w, "unexpected Host for this listener, list it with --allowed-host", http.StatusMisdirectedRequest)
+			return
+		}
+		if !isLocalCaller(r) {
+			rejectRequest(w, "cross-origin request refused", http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// rejectRequest answers a request the forwarder will not proxy and closes the
+// connection.
+//
+// Closing stops the connection being reused; it does not stop the server
+// draining what is left of the request body. That drain runs from
+// finishRequest whatever the response said, and it reads the original body
+// rather than the handler's wrapper, so the only thing bounding it is the
+// deadline withBodyIdleTimeout arms on the connection before the handler
+// chain runs. Without that deadline a caller that stopped sending holds the
+// connection and its goroutine even though the answer already went out.
+func rejectRequest(w http.ResponseWriter, msg string, code int) {
+	w.Header().Set("Connection", "close")
+	http.Error(w, msg, code)
+}
+
+// isLocalCaller reports whether a request may be proxied, from what the
+// browser says about where it came from.
+func isLocalCaller(r *http.Request) bool {
+	if foreignFetchSites[strings.ToLower(r.Header.Get(fetchSiteHeader))] {
+		return false
+	}
+
+	// Only a browser sets Origin, and a legitimate one for this listener is
+	// same-origin. Anything else is a cross-site caller.
+	origin := r.Header.Get("Origin")
+	return origin == "" || isSameOrigin(origin, r.Host)
+}
+
+// hostnameOf strips any port from a Host header value.
+func hostnameOf(host string) string {
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		return h
+	}
+	return host
+}
+
+// isAllowedHost reports whether a request may arrive under host. Loopback
+// names always may and listed names always may. A public listener also
+// accepts any address, since a page cannot rebind an address it does not
+// control.
+func isAllowedHost(host string, loopbackOnly bool, allowed map[string]bool) bool {
+	if isLocalName(host) || allowed[normalizeHostname(host)] {
+		return true
+	}
+	if loopbackOnly {
+		return false
+	}
+	_, err := netip.ParseAddr(strings.Trim(host, "[]"))
+	return err == nil
+}
+
+// isLocalName reports whether host names this machine's loopback interface.
+func isLocalName(host string) bool {
+	if strings.EqualFold(host, "localhost") {
+		return true
+	}
+	ip, err := netip.ParseAddr(strings.Trim(host, "[]"))
+	return err == nil && ip.Unmap().IsLoopback()
+}
+
+// isSameOrigin reports whether an Origin header names this listener. Scheme,
+// host and port all have to match: the forwarder serves plaintext HTTP, and a
+// page on another loopback port is a different origin like any other.
+func isSameOrigin(origin, host string) bool {
+	u, err := url.Parse(origin)
+	if err != nil || u.Scheme != "http" {
+		return false
+	}
+	return normalizeAuthority(u.Host) == normalizeAuthority(host)
+}
+
+// normalizeAuthority reduces an authority to a comparable host:port, so two
+// spellings of one origin match.
+func normalizeAuthority(authority string) string {
+	host, port, err := net.SplitHostPort(authority)
+	if err != nil {
+		host, port = authority, defaultHTTPPort
+	}
+	return strings.ToLower(strings.Trim(host, "[]")) + ":" + port
+}
+
+// truncatePath shortens a caller-supplied path so a log line cannot be made
+// arbitrarily long by the request that produced it.
+func truncatePath(path string) string {
+	if len(path) <= maxLoggedPath {
+		return path
+	}
+	return path[:maxLoggedPath] + "..."
+}
diff --git a/client/link/forward_http_test.go b/client/link/forward_http_test.go
new file mode 100644
index 000000000..1518a565a
--- /dev/null
+++ b/client/link/forward_http_test.go
@@ -0,0 +1,563 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// errDialNotExpected marks a test that must never reach the overlay, so a dial
+// that does happen fails the test rather than passing silently.
+var errDialNotExpected = errors.New("dial not expected in this test")
+
+func refuseDial(context.Context, string, string) (net.Conn, error) {
+	return nil, errDialNotExpected
+}
+
+// overlayDialer stands in for the embedded client. It records what the
+// forwarder asked to reach and then connects to a local test server, which
+// lets the whole proxy path be exercised without a live network.
+type overlayDialer struct {
+	target string
+	calls  atomic.Int64
+	asked  atomic.Value
+}
+
+func (d *overlayDialer) dial(ctx context.Context, network, addr string) (net.Conn, error) {
+	d.calls.Add(1)
+	d.asked.Store(addr)
+	var dialer net.Dialer
+	return dialer.DialContext(ctx, network, d.target)
+}
+
+func (d *overlayDialer) lastAsked() string {
+	v, _ := d.asked.Load().(string)
+	return v
+}
+
+// startForwarder wires a forwarder in front of upstream and returns its local
+// base URL.
+func startForwarder(t *testing.T, upstream *httptest.Server) (string, *overlayDialer) {
+	t.Helper()
+
+	upstreamURL, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+
+	// The spec names a hostname that does not resolve on this machine, proving
+	// the forwarder hands resolution to the dialer instead of the host.
+	fwd, err := ParseForward("http://127.0.0.1:0=http://grafana.internal")
+	require.NoError(t, err)
+
+	dialer := &overlayDialer{target: upstreamURL.Host}
+	f, err := newHTTPForwarder(fwd, dialer.dial)
+	require.NoError(t, err)
+
+	go func() { _ = f.Serve() }()
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = f.Close(ctx)
+	})
+
+	return "http://" + f.Addr(), dialer
+}
+
+func TestForwarderProxiesThroughOverlayDialer(t *testing.T) {
+	var gotHost, gotPath string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotHost, gotPath = r.Host, r.URL.RequestURI()
+		_, _ = io.WriteString(w, "reached upstream")
+	}))
+	defer upstream.Close()
+
+	base, dialer := startForwarder(t, upstream)
+
+	resp, err := http.Get(base + "/dashboard?orgId=1")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, "reached upstream", string(body))
+	assert.Equal(t, "/dashboard?orgId=1", gotPath, "path and query should be forwarded unchanged")
+	assert.Equal(t, "grafana.internal", gotHost,
+		"upstream must see its own Host, not the local bind address")
+	assert.Equal(t, int64(1), dialer.calls.Load(), "the overlay dialer should carry the request")
+	assert.Equal(t, "grafana.internal:80", dialer.lastAsked(),
+		"the overlay dialer should be asked for the upstream name, so it resolves in the tunnel")
+}
+
+func TestForwarderForwardsRequestBodyAndMethod(t *testing.T) {
+	var gotMethod, gotBody string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		b, _ := io.ReadAll(r.Body)
+		gotBody = string(b)
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	resp, err := http.Post(base+"/api", "application/json", strings.NewReader(`{"k":"v"}`))
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusCreated, resp.StatusCode)
+	assert.Equal(t, http.MethodPost, gotMethod)
+	assert.Equal(t, `{"k":"v"}`, gotBody, "request bodies should reach the upstream intact")
+}
+
+// A forward whose upstream cannot be reached must answer 502 rather than hang
+// or leak the dial error to the caller.
+func TestForwarderReportsUnreachableUpstream(t *testing.T) {
+	fwd, err := ParseForward("http://127.0.0.1:0=http://grafana.internal")
+	require.NoError(t, err)
+
+	refuse := func(context.Context, string, string) (net.Conn, error) {
+		return nil, &net.OpError{Op: "dial", Err: net.UnknownNetworkError("no route in overlay")}
+	}
+	f, err := newHTTPForwarder(fwd, refuse)
+	require.NoError(t, err)
+	go func() { _ = f.Serve() }()
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = f.Close(ctx)
+	})
+
+	resp, err := http.Get("http://" + f.Addr())
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusBadGateway, resp.StatusCode)
+}
+
+// Binding must fail at construction so a port clash surfaces before any
+// forward is announced as ready.
+func TestNewHTTPForwarderReportsBindConflict(t *testing.T) {
+	busy, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer busy.Close()
+
+	fwd, err := ParseForward("http://" + busy.Addr().String() + "=https://grafana.internal")
+	require.NoError(t, err)
+
+	_, err = newHTTPForwarder(fwd, refuseDial)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "listen on")
+}
+
+// A forwarder that was built but never served still owns its socket. The
+// bind-all-then-serve path closes earlier forwarders when a later bind fails,
+// so Close has to release the port even though Serve never ran.
+func TestCloseReleasesAnUnservedListener(t *testing.T) {
+	fwd, err := ParseForward("http://127.0.0.1:0=https://grafana.internal")
+	require.NoError(t, err)
+
+	f, err := newHTTPForwarder(fwd, refuseDial)
+	require.NoError(t, err)
+	addr := f.Addr()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	require.NoError(t, f.Close(ctx))
+
+	// The port is free again only if the listener was actually closed.
+	reclaimed, err := net.Listen("tcp", addr)
+	require.NoError(t, err, "Close should have released the listener")
+	require.NoError(t, reclaimed.Close())
+}
+
+// A caller that sends headers and then stalls its body must be cut off.
+// ReadHeaderTimeout does not cover the body and IdleTimeout applies only
+// between requests, so without the idle read deadline this connection would be
+// held open indefinitely.
+func TestStalledRequestBodyIsCutOff(t *testing.T) {
+	previous := bodyIdleTimeout
+	bodyIdleTimeout = 150 * time.Millisecond
+	t.Cleanup(func() { bodyIdleTimeout = previous })
+
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	conn, err := net.Dial("tcp", strings.TrimPrefix(base, "http://"))
+	require.NoError(t, err)
+	defer conn.Close()
+
+	// Announce a body, send one byte of it, then go quiet.
+	_, err = conn.Write([]byte("POST / HTTP/1.1\r\nHost: localhost\r\nContent-Length: 1000\r\n\r\nx"))
+	require.NoError(t, err)
+
+	require.NoError(t, conn.SetReadDeadline(time.Now().Add(10*time.Second)))
+	_, err = io.ReadAll(conn)
+
+	// The server closes the connection rather than waiting on the rest of the
+	// body, so the read ends well before the generous deadline above.
+	require.NoError(t, err, "the connection should be closed by the server, not time out in the test")
+}
+
+func TestRedactSpec(t *testing.T) {
+	assert.Equal(t, "http://8080=https://user:xxxxx@a.internal",
+		redactSpec("http://8080=https://user:hunter2@a.internal"),
+		"a password must not survive into an error message")
+	assert.Equal(t, "http://8080=https://a.internal",
+		redactSpec("http://8080=https://a.internal"),
+		"a spec without credentials should be unchanged")
+}
+
+// The error that rejects a credential-bearing upstream quotes the spec, which
+// must not carry the password back to the terminal.
+func TestParseForwardDoesNotEchoPassword(t *testing.T) {
+	_, err := ParseForward("http://8080=https://user:hunter2@a.internal")
+
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "hunter2", "the password must not appear anywhere in the error")
+	assert.Contains(t, err.Error(), "must not carry credentials")
+}
+
+// A POST whose body is fully delivered must still receive its whole response,
+// even when the upstream takes longer to answer than the body idle timeout.
+// The deadline that guards the body must not outlive it.
+func TestCompletedUploadGetsFullResponse(t *testing.T) {
+	previous := bodyIdleTimeout
+	bodyIdleTimeout = 200 * time.Millisecond
+	t.Cleanup(func() { bodyIdleTimeout = previous })
+
+	payload := strings.Repeat("y", 4096)
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+		time.Sleep(600 * time.Millisecond)
+		_, _ = io.WriteString(w, payload)
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	resp, err := http.Post(base+"/upload", "text/plain", strings.NewReader(strings.Repeat("x", 2048)))
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err, "the response must not be cut off once the body was fully read")
+	assert.Equal(t, len(payload), len(body), "the whole response body should arrive")
+}
+
+// A page that points its own hostname at this loopback listener must not be
+// able to reach the upstream through it.
+func TestLoopbackForwarderRejectsForeignHost(t *testing.T) {
+	var reached bool
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	req, err := http.NewRequest(http.MethodGet, base, nil)
+	require.NoError(t, err)
+	req.Host = "attacker.example"
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusMisdirectedRequest, resp.StatusCode)
+	assert.False(t, reached, "the upstream must not be reached under a foreign Host")
+}
+
+func TestLoopbackForwarderRejectsCrossOrigin(t *testing.T) {
+	var reached bool
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	req, err := http.NewRequest(http.MethodGet, base, nil)
+	require.NoError(t, err)
+	req.Header.Set("Origin", "https://attacker.example")
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+	assert.False(t, reached, "the upstream must not be reached from a cross-site page")
+}
+
+// The ordinary local callers must keep working: no Origin at all, and a
+// same-origin browser request.
+func TestLoopbackForwarderAllowsLocalCallers(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, "ok")
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	for _, origin := range []string{"", "http://" + strings.TrimPrefix(base, "http://")} {
+		req, err := http.NewRequest(http.MethodGet, base, nil)
+		require.NoError(t, err)
+		if origin != "" {
+			req.Header.Set("Origin", origin)
+		}
+
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
+		body, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+		_ = resp.Body.Close()
+
+		assert.Equal(t, http.StatusOK, resp.StatusCode, "origin %q should be allowed", origin)
+		assert.Equal(t, "ok", string(body))
+	}
+}
+
+// A malformed upstream fails in the URL parser rather than in the credential
+// check, so both error layers have to be redacted.
+func TestParseForwardRedactsMalformedUpstream(t *testing.T) {
+	for _, spec := range []string{
+		"http://8080=https://user:hunter2@a.internal:bad",
+		"http://8080=https://user:hunter2@a.internal/%zz",
+	} {
+		_, err := ParseForward(spec)
+		require.Error(t, err)
+		assert.NotContains(t, err.Error(), "hunter2",
+			"a password must not survive a parse failure either")
+	}
+}
+
+// An embedded <img> or <script> aimed straight at the loopback address carries
+// a loopback Host and no Origin, so Sec-Fetch-Site is the only signal that the
+// request came from a page.
+func TestLoopbackForwarderRejectsCrossSiteFetch(t *testing.T) {
+	for _, site := range []string{"cross-site", "same-site", "Cross-Site"} {
+		var reached bool
+		upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			reached = true
+		}))
+
+		base, _ := startForwarder(t, upstream)
+
+		req, err := http.NewRequest(http.MethodGet, base, nil)
+		require.NoError(t, err)
+		req.Header.Set("Sec-Fetch-Site", site)
+
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
+		_ = resp.Body.Close()
+		upstream.Close()
+
+		assert.Equal(t, http.StatusForbidden, resp.StatusCode, "Sec-Fetch-Site %q should be refused", site)
+		assert.False(t, reached, "the upstream must not be reached from a %s page", site)
+	}
+}
+
+// A browser reaches the listener legitimately when the user navigated to it or
+// when the page it serves calls back into it.
+func TestLoopbackForwarderAllowsFirstPartyFetch(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, "ok")
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	for _, site := range []string{"none", "same-origin"} {
+		req, err := http.NewRequest(http.MethodGet, base, nil)
+		require.NoError(t, err)
+		req.Header.Set("Sec-Fetch-Site", site)
+
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
+		_ = resp.Body.Close()
+
+		assert.Equal(t, http.StatusOK, resp.StatusCode, "Sec-Fetch-Site %q should be allowed", site)
+	}
+}
+
+// A page served from another loopback port is a different origin, however
+// local it is.
+func TestLoopbackForwarderRejectsAnotherLocalPort(t *testing.T) {
+	var reached bool
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	req, err := http.NewRequest(http.MethodGet, base, nil)
+	require.NoError(t, err)
+	req.Header.Set("Origin", "http://localhost:3000")
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+	assert.False(t, reached, "a page on another local port must not reach the upstream")
+}
+
+// A rejected request is never read, so the deadline that bounds an accepted
+// upload never arms for it. Closing the connection is what stops the server
+// from draining a body the caller stopped sending.
+func TestRejectedRequestClosesTheConnection(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	body, writer := io.Pipe()
+	t.Cleanup(func() { _ = writer.Close() })
+
+	req, err := http.NewRequest(http.MethodPost, base, body)
+	require.NoError(t, err)
+	req.Host = "attacker.example"
+
+	// The request is answered on another goroutine, so a server that waits on
+	// the stalled body fails the test by timing out rather than hanging it.
+	type rejection struct {
+		status     int
+		closesConn bool
+	}
+	done := make(chan rejection, 1)
+	go func() {
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return
+		}
+		defer resp.Body.Close()
+		done <- rejection{status: resp.StatusCode, closesConn: resp.Close}
+	}()
+
+	select {
+	case got := <-done:
+		assert.Equal(t, http.StatusMisdirectedRequest, got.status)
+		assert.True(t, got.closesConn, "the server must close a connection it rejected rather than drain the body")
+	case <-time.After(5 * time.Second):
+		t.Fatal("the rejected request was not answered while its body stalled")
+	}
+}
+
+// net/url ends the userinfo at the last '@', so a password containing one must
+// be redacted whole rather than up to its first '@'.
+func TestRedactSpecCoversPasswordWithAtSign(t *testing.T) {
+	redacted := redactSpec("http://8080=https://user:pa@ss@a.internal/%zz")
+
+	assert.Equal(t, "http://8080=https://user:xxxxx@a.internal/%zz", redacted)
+	assert.NotContains(t, redacted, "ss@a.internal", "no part of the password may survive")
+}
+
+func TestParseForwardRedactsPasswordWithAtSign(t *testing.T) {
+	_, err := ParseForward("http://8080=https://user:pa@ss@a.internal/%zz")
+
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "ss@", "no part of the password may reach the error")
+}
+
+// stalledBodyProbe sends a request whose declared body is only partly
+// delivered and then stops, as a caller holding a connection open would. It
+// returns the status line, or an empty string when nothing came back inside
+// wait.
+//
+// It speaks raw HTTP rather than using the client, because the shape that
+// matters is an explicit Content-Length the sender never satisfies: a body
+// handed to http.Client is sent chunked, which exercises a different path in
+// the server's post-handler drain.
+func stalledBodyProbe(t *testing.T, addr, host string, wait time.Duration) (status string, released bool) {
+	t.Helper()
+
+	conn, err := net.Dial("tcp", addr)
+	require.NoError(t, err, "connect to the forwarder")
+	t.Cleanup(func() { _ = conn.Close() })
+
+	req := fmt.Sprintf("POST / HTTP/1.1\r\nHost: %s\r\nContent-Length: 100\r\n\r\n0123456789", host)
+	_, err = conn.Write([]byte(req))
+	require.NoError(t, err, "send the partial request")
+
+	require.NoError(t, conn.SetReadDeadline(time.Now().Add(wait)))
+	buf := make([]byte, 1024)
+	n, err := conn.Read(buf)
+	if err != nil {
+		return "", false
+	}
+	status = strings.SplitN(string(buf[:n]), "\r\n", 2)[0]
+
+	// Read on until the connection ends. The answer going out is not the same
+	// thing as the connection being let go: the server drains the rest of the
+	// body afterwards, and that drain is where a stalled caller actually holds
+	// a descriptor and a goroutine. A timeout here means it is still held.
+	for {
+		if _, err := conn.Read(buf); err != nil {
+			var timeout net.Error
+			return status, !(errors.As(err, &timeout) && timeout.Timeout())
+		}
+	}
+}
+
+// A caller that declares a body and then stops sending must still be answered,
+// on every path that does not read it. The server drains an unread body before
+// reusing the connection, and that drain has no deadline of its own: whatever
+// the forwarder leaves on the connection is what bounds it.
+//
+// Without this, a few thousand such connections exhaust the forwarder's file
+// descriptors while each one holds a goroutine parked in that drain.
+func TestStalledRequestBodyIsAnsweredOnEveryPath(t *testing.T) {
+	// The dial target refuses, so a request that passes the guard reaches the
+	// proxy's error handler instead of an upstream.
+	// Shortened so the test observes the bound rather than waiting out the
+	// production one.
+	previous := bodyIdleTimeout
+	bodyIdleTimeout = time.Second
+	t.Cleanup(func() { bodyIdleTimeout = previous })
+
+	base := serveForward(t, "http://127.0.0.1:0=http://grafana.internal", "127.0.0.1:1")
+	addr := strings.TrimPrefix(base, "http://")
+
+	cases := []struct {
+		name string
+		host string
+		want string
+	}{
+		{
+			name: "the guard rejects it",
+			host: "attacker.example",
+			want: "HTTP/1.1 421 Misdirected Request",
+		},
+		{
+			name: "the overlay dial fails",
+			host: "127.0.0.1",
+			want: "HTTP/1.1 502 Bad Gateway",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, released := stalledBodyProbe(t, addr, tc.host, 8*time.Second)
+			assert.Equal(t, tc.want, got,
+				"the caller must be answered rather than left waiting out a drain with no deadline")
+			assert.True(t, released,
+				"the connection must be let go as well as answered, or a stalled caller still holds it")
+		})
+	}
+}
diff --git a/client/link/forward_http_upstream_test.go b/client/link/forward_http_upstream_test.go
new file mode 100644
index 000000000..c240a7826
--- /dev/null
+++ b/client/link/forward_http_upstream_test.go
@@ -0,0 +1,286 @@
+package link
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// serveForward starts a forwarder for spec in front of target and returns its
+// local base URL.
+func serveForward(t *testing.T, spec, target string) string {
+	t.Helper()
+
+	fwd, err := ParseForward(spec)
+	require.NoError(t, err)
+	dialer := &overlayDialer{target: target}
+	f, err := newHTTPForwarder(fwd, dialer.dial)
+	require.NoError(t, err)
+
+	go func() { _ = f.Serve() }()
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = f.Close(ctx)
+	})
+	return "http://" + f.Addr()
+}
+
+func TestForwarderVerifiesUpstreamCertificate(t *testing.T) {
+	var reached atomic.Bool
+	upstream := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached.Store(true)
+		_, _ = io.WriteString(w, "should not be served")
+	}))
+	defer upstream.Close()
+
+	// The test server's certificate is signed by a CA no trust store holds, so
+	// a forwarder that verifies its upstream must refuse it.
+	u, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+	base := serveForward(t, "http://127.0.0.1:0=https://grafana.internal", u.Host)
+
+	resp, err := http.Get(base + "/")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusBadGateway, resp.StatusCode, "an untrusted upstream certificate must fail the request")
+	assert.Contains(t, string(body), "upstream unreachable over the overlay", "the 502 must be the forwarder's own answer")
+	assert.False(t, reached.Load(), "no request may reach an upstream whose certificate was not verified")
+}
+
+func TestForwarderJoinsUpstreamBasePath(t *testing.T) {
+	var gotURI string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotURI = r.URL.RequestURI()
+	}))
+	defer upstream.Close()
+
+	u, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+	base := serveForward(t, "http://127.0.0.1:0=http://grafana.internal/api", u.Host)
+
+	resp, err := http.Get(base + "/v1/query?q=up")
+	require.NoError(t, err)
+	_ = resp.Body.Close()
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, "/api/v1/query?q=up", gotURI, "the upstream's path must prefix the request path")
+}
+
+// An LLM reply streamed as server-sent events must reach the caller event by
+// event. A forwarder that buffered the body would hold the first event until
+// the upstream finished, which here never happens until the test has read it.
+func TestForwarderStreamsEventsAsTheyArrive(t *testing.T) {
+	release := make(chan struct{})
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = io.WriteString(w, "data: first\n\n")
+		w.(http.Flusher).Flush()
+		<-release
+		_, _ = io.WriteString(w, "data: second\n\n")
+	}))
+	defer upstream.Close()
+	defer close(release)
+
+	u, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+	base := serveForward(t, "http://127.0.0.1:0=http://llm.internal", u.Host)
+
+	resp, err := http.Get(base + "/v1/chat/completions")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	firstLine := make(chan string, 1)
+	go func(body io.Reader) {
+		line, _ := bufio.NewReader(body).ReadString('\n')
+		firstLine <- line
+	}(resp.Body)
+
+	select {
+	case line := <-firstLine:
+		assert.Equal(t, "data: first\n", line, "the first event must arrive before the stream ends")
+	case <-time.After(5 * time.Second):
+		t.Fatal("the first event was buffered instead of streamed")
+	}
+}
+
+func TestForwarderServesConcurrentRequests(t *testing.T) {
+	var served atomic.Int64
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		served.Add(1)
+		_, _ = io.WriteString(w, r.URL.Query().Get("n"))
+	}))
+	defer upstream.Close()
+
+	u, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+	base := serveForward(t, "http://127.0.0.1:0=http://grafana.internal", u.Host)
+
+	const callers = 32
+	var wg sync.WaitGroup
+	errs := make(chan error, callers)
+	for i := range callers {
+		wg.Add(1)
+		go func(n int) {
+			defer wg.Done()
+			resp, err := http.Get(fmt.Sprintf("%s/?n=%d", base, n))
+			if err != nil {
+				errs <- err
+				return
+			}
+			defer resp.Body.Close()
+			body, err := io.ReadAll(resp.Body)
+			if err != nil {
+				errs <- err
+				return
+			}
+			if got := string(body); got != fmt.Sprint(n) {
+				errs <- fmt.Errorf("caller %d got the answer for %q", n, got)
+			}
+		}(i)
+	}
+	wg.Wait()
+	close(errs)
+
+	for err := range errs {
+		assert.NoError(t, err, "every concurrent caller must get its own answer")
+	}
+	assert.Equal(t, int64(callers), served.Load(), "every request must reach the upstream once")
+}
+
+// A container port published to the host is a public listener, and a page
+// that rebinds its own name to that port sends a matching Origin and
+// Sec-Fetch-Site. Host is the only signal that tells it apart, so a public
+// listener accepts addresses and listed names only.
+func TestGuardOnPublicListener(t *testing.T) {
+	next := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+	allowed := []string{"nblink.lan"}
+
+	cases := []struct {
+		name         string
+		loopbackOnly bool
+		host         string
+		headers      map[string]string
+		want         int
+	}{
+		{name: "public listener under a listed name", host: "nblink.lan:8080", want: http.StatusOK},
+		{name: "public listener under a listed name, other spelling", host: "NBLINK.LAN.:8080", want: http.StatusOK},
+		{name: "public listener under its LAN address", host: "192.168.1.20:8080", want: http.StatusOK},
+		{name: "public listener under an IPv6 address", host: "[fd00::20]:8080", want: http.StatusOK},
+		{name: "public listener under localhost", host: "localhost:8080", want: http.StatusOK},
+		{name: "public listener under an unlisted name", host: "printer.lan:8080", want: http.StatusMisdirectedRequest},
+		{
+			name: "public listener, rebound page", host: "attacker.example:8080",
+			headers: map[string]string{"Origin": "http://attacker.example:8080", fetchSiteHeader: "same-origin"},
+			want:    http.StatusMisdirectedRequest,
+		},
+		{name: "loopback listener under a listed name", loopbackOnly: true, host: "nblink.lan:8080", want: http.StatusOK},
+		{name: "loopback listener under a LAN address", loopbackOnly: true, host: "192.168.1.20:8080", want: http.StatusMisdirectedRequest},
+		{
+			name: "public listener, cross-origin fetch", host: "nblink.lan:8080",
+			headers: map[string]string{"Origin": "https://attacker.example"}, want: http.StatusForbidden,
+		},
+		{
+			name: "public listener, cross-site no-cors GET", host: "nblink.lan:8080",
+			headers: map[string]string{fetchSiteHeader: "cross-site"}, want: http.StatusForbidden,
+		},
+		{
+			name: "public listener, same-origin page", host: "nblink.lan:8080",
+			headers: map[string]string{"Origin": "http://nblink.lan:8080"}, want: http.StatusOK,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "http://"+tc.host+"/", nil)
+			for k, v := range tc.headers {
+				req.Header.Set(k, v)
+			}
+			rec := httptest.NewRecorder()
+			guardRebinding(next, tc.loopbackOnly, allowed).ServeHTTP(rec, req)
+			assert.Equal(t, tc.want, rec.Code, "%s must be answered %d", tc.name, tc.want)
+		})
+	}
+}
+
+func TestListenNetwork(t *testing.T) {
+	cases := map[string]string{
+		"0.0.0.0:8080":      "tcp4",
+		"127.0.0.1:8080":    "tcp4",
+		"[::]:8080":         "tcp6",
+		"[::1]:8080":        "tcp6",
+		"[fe80::1%en0]:808": "tcp6",
+	}
+	for addr, want := range cases {
+		assert.Equal(t, want, listenNetwork(addr), "%s must bind %s only", addr, want)
+	}
+}
+
+// 0.0.0.0 asks for every IPv4 interface. Go's plain "tcp" would also accept
+// IPv6, which the operator did not write.
+func TestIPv4WildcardDoesNotListenOnIPv6(t *testing.T) {
+	probe, err := net.Listen("tcp6", "[::1]:0")
+	if err != nil {
+		t.Skip("no IPv6 loopback on this host")
+	}
+	_ = probe.Close()
+
+	fwd, err := ParseForward("http://0.0.0.0:0=http://grafana.internal")
+	require.NoError(t, err)
+	f, err := newHTTPForwarder(fwd, refuseDial)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = f.Close(context.Background()) })
+
+	_, port, err := net.SplitHostPort(f.Addr())
+	require.NoError(t, err)
+	assert.Equal(t, "0.0.0.0:"+port, f.Addr(), "the listener must report the IPv4 wildcard it was asked for")
+
+	conn, err := net.DialTimeout("tcp6", net.JoinHostPort("::1", port), time.Second)
+	if err == nil {
+		_ = conn.Close()
+	}
+	assert.Error(t, err, "an IPv4 wildcard must not accept IPv6 connections")
+}
+
+func TestBindHint(t *testing.T) {
+	denied := &net.OpError{Op: "listen", Err: os.NewSyscallError("bind", syscall.EACCES)}
+	err := bindHint("0.0.0.0:80", denied)
+	assert.ErrorIs(t, err, os.ErrPermission, "the hint must keep the original error")
+	assert.Contains(t, err.Error(), "needs a port above 1023", "a permission error must suggest an unprivileged port")
+
+	inUse := errors.New("address already in use")
+	assert.Equal(t, inUse, bindHint("127.0.0.1:8080", inUse), "other errors must pass through unchanged")
+}
+
+func TestForwardStringRoundTrips(t *testing.T) {
+	fwd, err := ParseForward("http://8080=https://grafana.internal/d")
+	require.NoError(t, err)
+	assert.Equal(t, "http://127.0.0.1:8080=https://grafana.internal/d", fwd.String(),
+		"String must print the normalized spec")
+
+	again, err := ParseForward(fwd.String())
+	require.NoError(t, err)
+	assert.Equal(t, fwd.Listen, again.Listen, "the printed spec must parse back to the same listener")
+	assert.Equal(t, fwd.Upstream.String(), again.Upstream.String(), "and to the same upstream")
+	assert.False(t, strings.Contains(fwd.String(), "  "), "the spec must not carry stray whitespace")
+}
diff --git a/client/link/forward_test.go b/client/link/forward_test.go
new file mode 100644
index 000000000..fd1697b6d
--- /dev/null
+++ b/client/link/forward_test.go
@@ -0,0 +1,170 @@
+package link
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseForward(t *testing.T) {
+	tests := []struct {
+		name         string
+		spec         string
+		wantListen   string
+		wantUpstream string
+	}{
+		{
+			name:         "full listen address",
+			spec:         "http://127.0.0.1:8080=https://grafana.internal",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "bare port defaults to loopback",
+			spec:         "http://8080=https://grafana.internal",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "empty host defaults to loopback",
+			spec:         "http://:8080=https://grafana.internal",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "upstream without scheme assumes https",
+			spec:         "http://8080=grafana.internal",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "plain http upstream is preserved",
+			spec:         "http://8080=http://grafana.internal:3000",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "http://grafana.internal:3000",
+		},
+		{
+			name:         "upstream query string survives the separator split",
+			spec:         "http://8080=https://grafana.internal/d?orgId=1",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal/d?orgId=1",
+		},
+		{
+			name:         "explicit public bind is parsed, gating happens later",
+			spec:         "http://0.0.0.0:8080=https://grafana.internal",
+			wantListen:   "0.0.0.0:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "ipv6 listen address",
+			spec:         "http://[::1]:8080=https://grafana.internal",
+			wantListen:   "[::1]:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "port zero asks the OS for a free port",
+			spec:         "http://0=https://grafana.internal",
+			wantListen:   "127.0.0.1:0",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "localhost normalizes to a literal address",
+			spec:         "http://localhost:8080=https://grafana.internal",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			// A zone is part of the literal and is resolved the same way at
+			// the check and at the bind, and link-local cannot be bound
+			// without it.
+			name:         "zone scoped ipv6 listen address",
+			spec:         "http://[fe80::1%eth0]:8080=https://grafana.internal",
+			wantListen:   "[fe80::1%eth0]:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "a scheme inside the query is not mistaken for the upstream scheme",
+			spec:         "http://8080=grafana.internal/login?next=https://grafana.internal/d",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal/login?next=https://grafana.internal/d",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := ParseForward(tc.spec)
+			require.NoError(t, err)
+			assert.Equal(t, ProtoHTTP, got.Proto, "scheme should select the HTTP forwarder")
+			assert.Equal(t, tc.wantListen, got.Listen, "listen address should be normalized")
+			assert.Equal(t, tc.wantUpstream, got.Upstream.String(), "upstream should round-trip")
+		})
+	}
+}
+
+func TestParseForwardErrors(t *testing.T) {
+	tests := []struct {
+		name    string
+		spec    string
+		wantMsg string
+	}{
+		{name: "empty", spec: "", wantMsg: "empty forward spec"},
+		{name: "no scheme", spec: "8080=grafana.internal", wantMsg: "missing scheme"},
+		{name: "no separator", spec: "http://8080", wantMsg: "missing '='"},
+		{name: "unknown scheme", spec: "gopher://8080=grafana.internal", wantMsg: "unknown scheme"},
+		{name: "port out of range", spec: "http://70000=grafana.internal", wantMsg: "out of range"},
+		{name: "port not a number", spec: "http://http=grafana.internal", wantMsg: "not a number"},
+		{name: "missing upstream", spec: "http://8080=", wantMsg: "missing upstream"},
+		{name: "bad upstream scheme", spec: "http://8080=ftp://grafana.internal", wantMsg: "must be http or https"},
+		{name: "listen host is a name", spec: "http://grafana.internal:8080=https://a.internal", wantMsg: "must be an IP address or localhost"},
+		{name: "upstream carries credentials", spec: "http://8080=https://user:pass@grafana.internal", wantMsg: "must not carry credentials"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := ParseForward(tc.spec)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tc.wantMsg, "error should name the actual problem")
+		})
+	}
+}
+
+// Schemes the grammar reserves for later must fail with a message that says so,
+// rather than looking like a typo.
+func TestParseForwardPlannedSchemes(t *testing.T) {
+	for _, proto := range []string{"tcp", "udp", "socks5"} {
+		t.Run(proto, func(t *testing.T) {
+			_, err := ParseForward(proto + "://5432=db.internal:5432")
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), "not supported yet",
+				"a reserved scheme should report that it is unimplemented")
+		})
+	}
+}
+
+func TestIsLoopback(t *testing.T) {
+	tests := []struct {
+		addr string
+		want bool
+	}{
+		{"127.0.0.1:8080", true},
+		{"127.0.0.53:8080", true},
+		{"[::1]:8080", true},
+		{"0.0.0.0:8080", false},
+		{"192.168.1.10:8080", false},
+		{"[::]:8080", false},
+		{"not-an-address", false},
+		// A v4-mapped form is still the loopback address.
+		{"[::ffff:127.0.0.1]:8080", true},
+		// Link-local is not loopback, so it stays behind the opt-in.
+		{"[fe80::1%eth0]:8080", false},
+		// Names never reach this check, because parseListen rejects them.
+		{"localhost:8080", false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.addr, func(t *testing.T) {
+			assert.Equal(t, tc.want, isLoopback(tc.addr))
+		})
+	}
+}
diff --git a/client/link/link.go b/client/link/link.go
new file mode 100644
index 000000000..0856b5a53
--- /dev/null
+++ b/client/link/link.go
@@ -0,0 +1,253 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	embed "github.com/netbirdio/netbird/client/embed"
+)
+
+const (
+	// startTimeout bounds the wait for the overlay session to come up.
+	startTimeout = 90 * time.Second
+	// shutdownTimeout bounds draining in-flight requests and closing the session.
+	shutdownTimeout = 10 * time.Second
+
+	// natMapperEnv is the embedded client's switch for UPnP, NAT-PMP and PCP
+	// port mapping on the local router.
+	natMapperEnv = "NB_DISABLE_NAT_MAPPER"
+)
+
+// Run starts the overlay session, serves every configured forward, and blocks
+// until the process is signalled or a forward fails.
+func Run(ctx context.Context, cfg *Config) error {
+	if cfg.Check {
+		return printEffectiveConfig(os.Stdout, cfg)
+	}
+
+	creds, err := resolveCredentials(ctx, cfg)
+	if err != nil {
+		return interruptedOr(ctx, err)
+	}
+
+	if err := disableNATMapperUnlessSet(); err != nil {
+		return err
+	}
+
+	client, err := embed.New(embed.Options{
+		DeviceName:    cfg.Hostname,
+		SetupKey:      creds.setupKey,
+		JWTToken:      creds.jwtToken,
+		ManagementURL: cfg.ManagementURL,
+		ConfigPath:    cfg.ConfigPath(),
+		StatePath:     cfg.StatePath(),
+		LogLevel:      cfg.LogLevel,
+		// nblink only dials out. Refusing inbound connections and host network
+		// access keeps the peer from becoming a route into the machine it runs on.
+		BlockInbound:   true,
+		BlockLANAccess: true,
+	})
+	if err != nil {
+		return fmt.Errorf("create client: %w", err)
+	}
+
+	log.Infof("connecting to %s", cfg.ManagementURL)
+	if err := startSession(ctx, client.Start, func() { stopClient(client) }); err != nil {
+		return interruptedOr(ctx, err)
+	}
+	logSession(client)
+
+	forwards, err := startForwards(cfg, client.DialContext)
+	if err != nil {
+		stopClient(client)
+		return err
+	}
+
+	err = waitForShutdown(ctx, forwards)
+
+	shutdownCtx, cancelShutdown := context.WithTimeout(context.Background(), shutdownTimeout)
+	defer cancelShutdown()
+	closeForwards(shutdownCtx, forwards)
+	stopClient(client)
+
+	return err
+}
+
+// disableNATMapperUnlessSet keeps the embedded client from asking the local
+// router for a port mapping. An unprivileged forwarder should not change the
+// network it runs on, and ICE and the relay connect without it. An operator
+// who sets the variable keeps their choice.
+func disableNATMapperUnlessSet() error {
+	// An operator keeps their choice only when the value is one the consumer
+	// can read. Empty and unparseable values reach the consumer as false,
+	// which would enable the mapper rather than leave the default in place.
+	if val := os.Getenv(natMapperEnv); val != "" {
+		if _, err := strconv.ParseBool(val); err == nil {
+			return nil
+		}
+		log.Warnf("failed to parse %s=%q, disabling the NAT mapper", natMapperEnv, val)
+	}
+	if err := os.Setenv(natMapperEnv, "true"); err != nil {
+		return fmt.Errorf("set %s: %w", natMapperEnv, err)
+	}
+	return nil
+}
+
+// startSession runs start under startTimeout and returns as soon as ctx ends,
+// even if start has not.
+//
+// The management dial inside the embedded client does not observe
+// cancellation, so waiting for start to return would hold a signal during
+// startup until the dial times out. A start that completes after the caller
+// gave up is stopped in the background instead of left running.
+func startSession(ctx context.Context, start func(context.Context) error, stop func()) error {
+	startCtx, cancel := context.WithTimeout(ctx, startTimeout)
+	done := make(chan error, 1)
+	go func() {
+		defer cancel()
+		done <- start(startCtx)
+	}()
+
+	select {
+	case err := <-done:
+		if err != nil {
+			return fmt.Errorf("start client: %w", err)
+		}
+		return nil
+	case <-ctx.Done():
+		go func() {
+			if err := <-done; err == nil {
+				stop()
+			}
+		}()
+		return ctx.Err()
+	}
+}
+
+// interruptedOr reports a signal during startup or login as a clean shutdown
+// rather than a failure, and passes any other error through.
+func interruptedOr(ctx context.Context, err error) error {
+	select {
+	case <-ctx.Done():
+		log.Infof("interrupted before the session was up, shutting down")
+		return nil
+	default:
+		return err
+	}
+}
+
+// startForwards binds every forward before serving any of them, so a clash on
+// the last one does not leave the earlier ones running.
+func startForwards(cfg *Config, dial DialFunc) ([]*httpForwarder, error) {
+	forwards := make([]*httpForwarder, 0, len(cfg.Forwards))
+	for _, fwd := range cfg.Forwards {
+		f, err := newHTTPForwarder(fwd, dial)
+		if err != nil {
+			closeForwards(context.Background(), forwards)
+			return nil, err
+		}
+		forwards = append(forwards, f)
+	}
+
+	for _, f := range forwards {
+		log.Infof("forwarding http://%s to %s over the overlay", f.Addr(), f.forward.Upstream)
+	}
+	return forwards, nil
+}
+
+// waitForShutdown blocks until a signal arrives, the context ends, or a
+// forward stops serving.
+func waitForShutdown(ctx context.Context, forwards []*httpForwarder) error {
+	serveErr := make(chan error, len(forwards))
+	for _, f := range forwards {
+		go func(f *httpForwarder) {
+			if err := f.Serve(); err != nil {
+				serveErr <- err
+			}
+		}(f)
+	}
+
+	stop := make(chan os.Signal, 1)
+	signal.Notify(stop, syscall.SIGINT, syscall.SIGTERM)
+	defer signal.Stop(stop)
+
+	select {
+	case err := <-serveErr:
+		return err
+	case sig := <-stop:
+		log.Infof("received %s, shutting down", sig)
+		return nil
+	case <-ctx.Done():
+		// The caller's context also ends on a signal, and select picks either
+		// ready case, so this path reports the shutdown too.
+		log.Infof("shutting down")
+		return nil
+	}
+}
+
+func closeForwards(ctx context.Context, forwards []*httpForwarder) {
+	for _, f := range forwards {
+		if err := f.Close(ctx); err != nil && !errors.Is(err, context.Canceled) {
+			log.Warnf("close forward %s: %v", f.forward.Listen, err)
+		}
+	}
+}
+
+func stopClient(client *embed.Client) {
+	ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
+	defer cancel()
+	if err := client.Stop(ctx); err != nil && !errors.Is(err, embed.ErrClientNotStarted) {
+		log.Warnf("stop client: %v", err)
+	}
+}
+
+// logSession reports control-plane state once the session is up, so a failure
+// to reach an upstream later can be told apart from a session that never
+// connected. The peer name and address stay at debug level, where the rest of
+// the client keeps identifying details.
+func logSession(client *embed.Client) {
+	status, err := client.Status()
+	if err != nil {
+		log.Infof("connected (status unavailable: %v)", err)
+		return
+	}
+	log.Infof("connected, management %t, signal %t, %d peers",
+		status.ManagementState.Connected, status.SignalState.Connected, len(status.Peers))
+	log.Debugf("peer %s has address %s", status.LocalPeerState.FQDN, status.LocalPeerState.IP)
+}
+
+// printEffectiveConfig writes the parsed forwards and exits without touching
+// the network, so a container configuration can be checked before deploying it.
+func printEffectiveConfig(out io.Writer, cfg *Config) error {
+	var b strings.Builder
+	fmt.Fprintf(&b, "management-url: %s\n", cfg.ManagementURL)
+	fmt.Fprintf(&b, "state-dir: %s\n", orDefault(cfg.StateDir, "(memory)"))
+	fmt.Fprintf(&b, "hostname: %s\n", orDefault(cfg.Hostname, "(host default)"))
+	fmt.Fprintf(&b, "setup-key: %t\n", cfg.SetupKey != "")
+	fmt.Fprintf(&b, "allowed-hosts: %s\n", orDefault(strings.Join(cfg.AllowedHosts, ","), "(none)"))
+	fmt.Fprintf(&b, "forwards: %d\n", len(cfg.Forwards))
+	for _, f := range cfg.Forwards {
+		fmt.Fprintf(&b, "  %s -> %s\n", f.Listen, f.Upstream)
+	}
+	if _, err := io.WriteString(out, b.String()); err != nil {
+		return fmt.Errorf("write configuration: %w", err)
+	}
+	return nil
+}
+
+func orDefault(value, fallback string) string {
+	if value == "" {
+		return fallback
+	}
+	return value
+}
diff --git a/client/link/link_test.go b/client/link/link_test.go
new file mode 100644
index 000000000..374e27adc
--- /dev/null
+++ b/client/link/link_test.go
@@ -0,0 +1,440 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// freePort asks the OS for a port and releases it, so the caller can name that
+// port in a spec and still be the one that binds it.
+func freePort(t *testing.T) string {
+	t.Helper()
+
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	_, port, err := net.SplitHostPort(l.Addr().String())
+	require.NoError(t, err)
+	require.NoError(t, l.Close())
+	return port
+}
+
+// mustParse builds a Forward from a spec, failing the test if the spec is bad.
+func mustParse(t *testing.T, spec string) Forward {
+	t.Helper()
+
+	fwd, err := ParseForward(spec)
+	require.NoError(t, err, "spec %q must parse", spec)
+	return fwd
+}
+
+// One session serves every forward it was given, which is the whole point of
+// the flag repeating: a user logs in once and reaches several services.
+func TestStartForwardsServesEveryForward(t *testing.T) {
+	first := mustParse(t, "http://127.0.0.1:0=https://a.internal")
+	second := mustParse(t, "http://127.0.0.1:0=https://b.internal")
+
+	forwards, err := startForwards(&Config{Forwards: []Forward{first, second}}, refuseDial)
+	require.NoError(t, err)
+	t.Cleanup(func() { closeForwards(context.Background(), forwards) })
+
+	require.Len(t, forwards, 2, "both forwards should be bound")
+	for _, f := range forwards {
+		go func() { _ = f.Serve() }()
+	}
+
+	// Each listener answers on its own address. The dialer refuses, so a 502
+	// is the proof the request reached that forwarder and was routed onward,
+	// rather than the port belonging to something else.
+	for _, f := range forwards {
+		resp, rerr := http.Get("http://" + f.Addr())
+		require.NoError(t, rerr, "forward on %s must accept a request", f.Addr())
+		_, _ = io.Copy(io.Discard, resp.Body)
+		_ = resp.Body.Close()
+		assert.Equal(t, http.StatusBadGateway, resp.StatusCode,
+			"a forward whose dialer refuses should answer 502, not fail to serve")
+	}
+}
+
+// Ports are bound before any forward is announced, so a clash on the last spec
+// must not leave the earlier ones holding their sockets. The observable is the
+// port: it has to be free again once startForwards has returned the error.
+func TestStartForwardsReleasesEarlierPortsOnFailure(t *testing.T) {
+	firstPort := freePort(t)
+	clashPort := freePort(t)
+
+	// Something else already holds the second forward's port.
+	blocker, err := net.Listen("tcp", "127.0.0.1:"+clashPort)
+	require.NoError(t, err)
+	defer func() { _ = blocker.Close() }()
+
+	forwards, err := startForwards(&Config{Forwards: []Forward{
+		mustParse(t, "http://127.0.0.1:"+firstPort+"=https://a.internal"),
+		mustParse(t, "http://127.0.0.1:"+clashPort+"=https://b.internal"),
+	}}, refuseDial)
+
+	require.Error(t, err, "a clash on the second forward must fail the whole set")
+	assert.Nil(t, forwards, "no forwarder should be returned alongside the error")
+	assert.Contains(t, err.Error(), clashPort, "the error should name the port that clashed")
+
+	// The first forward's port is free again, which it would not be if its
+	// listener had been left open.
+	reclaimed, err := net.Listen("tcp", "127.0.0.1:"+firstPort)
+	require.NoError(t, err, "the first forward's port must be released when a later bind fails")
+	_ = reclaimed.Close()
+}
+
+// closeForwards releases every listener it is given, so a shutdown does not
+// depend on the process exiting.
+func TestCloseForwardsReleasesEveryPort(t *testing.T) {
+	port := freePort(t)
+
+	forwards, err := startForwards(&Config{Forwards: []Forward{
+		mustParse(t, "http://127.0.0.1:"+port+"=https://a.internal"),
+	}}, refuseDial)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	closeForwards(ctx, forwards)
+
+	reclaimed, err := net.Listen("tcp", "127.0.0.1:"+port)
+	require.NoError(t, err, "the port must be free once the forward is closed")
+	_ = reclaimed.Close()
+}
+
+// captureStdout runs fn with os.Stdout redirected and returns what was written.
+func captureStdout(t *testing.T, fn func()) string {
+	t.Helper()
+
+	r, w, err := os.Pipe()
+	require.NoError(t, err)
+
+	original := os.Stdout
+	os.Stdout = w
+	done := make(chan string, 1)
+	go func() {
+		var sb strings.Builder
+		_, _ = io.Copy(&sb, r)
+		done <- sb.String()
+	}()
+
+	fn()
+
+	os.Stdout = original
+	require.NoError(t, w.Close())
+	out := <-done
+	_ = r.Close()
+	return out
+}
+
+// --check is what an operator runs to validate a container's configuration
+// before deploying it, so it has to report the forwards it would serve and
+// return without touching the network.
+func TestCheckReportsTheEffectiveForwards(t *testing.T) {
+	cfg := &Config{
+		Check:         true,
+		ManagementURL: "https://mgmt.example:443",
+		Hostname:      "nblink-1",
+		Forwards: []Forward{
+			mustParse(t, "http://8080=https://grafana.internal"),
+			mustParse(t, "http://127.0.0.1:9090=https://prometheus.internal"),
+		},
+	}
+
+	var err error
+	out := captureStdout(t, func() { err = Run(context.Background(), cfg) })
+
+	require.NoError(t, err, "--check must succeed on a valid configuration")
+	assert.Contains(t, out, "https://mgmt.example:443")
+	assert.Contains(t, out, "nblink-1")
+	assert.Contains(t, out, "forwards: 2")
+	assert.Contains(t, out, "127.0.0.1:8080 -> https://grafana.internal",
+		"the listen address must be reported as resolved, not as it was typed")
+	assert.Contains(t, out, "127.0.0.1:9090 -> https://prometheus.internal")
+	assert.Contains(t, out, "state-dir: (memory)", "an unset state dir must be named, not left blank")
+}
+
+// --check reports only whether a setup key is configured. Printing the key
+// itself would put a credential on the terminal and into whatever captured it,
+// which is the one thing this output must never do.
+func TestCheckDoesNotPrintTheSetupKey(t *testing.T) {
+	cfg := &Config{
+		Check:         true,
+		ManagementURL: "https://mgmt.example:443",
+		SetupKey:      "EEE7B5B1-1F8C-4C9A-9E2D-0123456789AB",
+		Forwards:      []Forward{mustParse(t, "http://8080=https://grafana.internal")},
+	}
+
+	var err error
+	out := captureStdout(t, func() { err = Run(context.Background(), cfg) })
+
+	require.NoError(t, err)
+	assert.NotContains(t, out, cfg.SetupKey, "the setup key must never be printed")
+	assert.Contains(t, out, "setup-key: true", "its presence should still be reported")
+}
+
+// namedDialer routes each overlay name to its own local server, so a test can
+// tell which upstream a request actually reached.
+type namedDialer struct {
+	mu      sync.Mutex
+	targets map[string]string
+	asked   []string
+}
+
+func (d *namedDialer) dial(ctx context.Context, network, addr string) (net.Conn, error) {
+	d.mu.Lock()
+	d.asked = append(d.asked, addr)
+	target, ok := d.targets[addr]
+	d.mu.Unlock()
+	if !ok {
+		return nil, fmt.Errorf("no route to %s", addr)
+	}
+	var dialer net.Dialer
+	return dialer.DialContext(ctx, network, target)
+}
+
+func namedUpstream(t *testing.T, name string) string {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, name)
+	}))
+	t.Cleanup(srv.Close)
+	u, err := url.Parse(srv.URL)
+	require.NoError(t, err)
+	return u.Host
+}
+
+// Every forward shares the one overlay dialer and asks it for its own
+// upstream, so two specs reach two different services rather than the same one.
+func TestStartForwardsRouteEachToItsOwnUpstream(t *testing.T) {
+	dialer := &namedDialer{targets: map[string]string{
+		"grafana.internal:80":    namedUpstream(t, "grafana"),
+		"prometheus.internal:80": namedUpstream(t, "prometheus"),
+	}}
+
+	cfg := &Config{}
+	for _, spec := range []string{
+		"http://127.0.0.1:0=http://grafana.internal",
+		"http://127.0.0.1:0=http://prometheus.internal",
+	} {
+		fwd, err := ParseForward(spec)
+		require.NoError(t, err)
+		cfg.Forwards = append(cfg.Forwards, fwd)
+	}
+
+	forwards, err := startForwards(cfg, dialer.dial)
+	require.NoError(t, err)
+	require.Len(t, forwards, 2, "every configured forward must be started")
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		closeForwards(ctx, forwards)
+	})
+	for _, f := range forwards {
+		go func(f *httpForwarder) { _ = f.Serve() }(f)
+	}
+	require.NotEqual(t, forwards[0].Addr(), forwards[1].Addr(), "each forward must bind its own port")
+
+	for i, want := range []string{"grafana", "prometheus"} {
+		resp, err := http.Get("http://" + forwards[i].Addr() + "/")
+		require.NoError(t, err)
+		body, err := io.ReadAll(resp.Body)
+		_ = resp.Body.Close()
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, resp.StatusCode, "forward %d must be served", i)
+		assert.Equal(t, want, string(body), "forward %d must reach its own upstream", i)
+	}
+
+	dialer.mu.Lock()
+	defer dialer.mu.Unlock()
+	assert.ElementsMatch(t, []string{"grafana.internal:80", "prometheus.internal:80"}, dialer.asked,
+		"both forwards must share the one overlay dialer, each asking for its own name")
+}
+
+func TestPrintEffectiveConfig(t *testing.T) {
+	const key = "11111111-2222-3333-4444-555555555555"
+	cfg := &Config{ManagementURL: "https://management.invalid", SetupKey: key}
+	for _, spec := range []string{
+		"http://8080=https://grafana.internal",
+		"http://127.0.0.1:0=http://prometheus.internal:9090/api",
+	} {
+		fwd, err := ParseForward(spec)
+		require.NoError(t, err)
+		cfg.Forwards = append(cfg.Forwards, fwd)
+	}
+
+	var out strings.Builder
+	require.NoError(t, printEffectiveConfig(&out, cfg))
+
+	assert.Equal(t, "management-url: https://management.invalid\n"+
+		"state-dir: (memory)\n"+
+		"hostname: (host default)\n"+
+		"setup-key: true\n"+
+		"allowed-hosts: (none)\n"+
+		"forwards: 2\n"+
+		"  127.0.0.1:8080 -> https://grafana.internal\n"+
+		"  127.0.0.1:0 -> http://prometheus.internal:9090/api\n",
+		out.String(), "the check must print the effective configuration")
+	assert.NotContains(t, out.String(), key, "the check must report a key is set, never the key")
+}
+
+// The embedded client's management dial ignores cancellation, so a start that
+// does the same must not hold a signal until it gives up on its own.
+func TestStartSessionReturnsWhenInterrupted(t *testing.T) {
+	release := make(chan error)
+	start := func(context.Context) error { return <-release }
+	var stopped atomic.Bool
+
+	ctx, cancel := context.WithCancel(context.Background())
+	result := make(chan error, 1)
+	go func() { result <- startSession(ctx, start, func() { stopped.Store(true) }) }()
+
+	cancel()
+	select {
+	case err := <-result:
+		assert.ErrorIs(t, err, context.Canceled, "an interrupted start must report the cancellation")
+	case <-time.After(2 * time.Second):
+		t.Fatal("startSession waited for a start that ignores cancellation")
+	}
+
+	// The start completes after the caller gave up. Its session must not be
+	// left running.
+	release <- nil
+	assert.Eventually(t, stopped.Load, 2*time.Second, 10*time.Millisecond,
+		"a session that came up after the interrupt must be stopped")
+}
+
+func TestStartSessionReportsStartFailure(t *testing.T) {
+	failure := errors.New("login: permission denied")
+	err := startSession(context.Background(), func(context.Context) error { return failure }, func() {
+		t.Error("a session that never started must not be stopped")
+	})
+	assert.ErrorIs(t, err, failure, "the start error must be returned")
+	assert.Contains(t, err.Error(), "start client", "the error must say which step failed")
+}
+
+func TestStartSessionBoundsTheStart(t *testing.T) {
+	var deadline time.Time
+	err := startSession(context.Background(), func(ctx context.Context) error {
+		deadline, _ = ctx.Deadline()
+		return nil
+	}, func() {})
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().Add(startTimeout), deadline, 5*time.Second,
+		"the start must run under startTimeout")
+}
+
+func TestInterruptedOr(t *testing.T) {
+	failure := errors.New("wait for login: context canceled")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	assert.Equal(t, failure, interruptedOr(ctx, failure), "an error while running must be returned")
+	cancel()
+	assert.NoError(t, interruptedOr(ctx, failure), "an error caused by a signal must be a clean exit")
+}
+
+func TestWaitForShutdownReturnsWhenAForwardStops(t *testing.T) {
+	fwd, err := ParseForward("http://127.0.0.1:0=http://grafana.internal")
+	require.NoError(t, err)
+	f, err := newHTTPForwarder(fwd, refuseDial)
+	require.NoError(t, err)
+
+	// Closing the raw listener under a serving forwarder is how a forward
+	// dies on its own, and the process must not keep running without it.
+	result := make(chan error, 1)
+	go func() { result <- waitForShutdown(context.Background(), []*httpForwarder{f}) }()
+	time.Sleep(100 * time.Millisecond)
+	require.NoError(t, f.listener.Close())
+
+	select {
+	case err := <-result:
+		assert.Error(t, err, "a forward that stopped serving must end the run with an error")
+	case <-time.After(5 * time.Second):
+		t.Fatal("waitForShutdown kept running after its only forward stopped")
+	}
+	_ = f.Close(context.Background())
+}
+
+func TestWaitForShutdownReturnsWhenContextEnds(t *testing.T) {
+	fwd, err := ParseForward("http://127.0.0.1:0=http://grafana.internal")
+	require.NoError(t, err)
+	f, err := newHTTPForwarder(fwd, refuseDial)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = f.Close(context.Background()) })
+
+	ctx, cancel := context.WithCancel(context.Background())
+	result := make(chan error, 1)
+	go func() { result <- waitForShutdown(ctx, []*httpForwarder{f}) }()
+	cancel()
+
+	select {
+	case err := <-result:
+		assert.NoError(t, err, "a cancelled context is a clean shutdown")
+	case <-time.After(5 * time.Second):
+		t.Fatal("waitForShutdown ignored the cancelled context")
+	}
+}
+
+func TestDisableNATMapperUnlessSet(t *testing.T) {
+	t.Setenv(natMapperEnv, "")
+	require.NoError(t, os.Unsetenv(natMapperEnv))
+	require.NoError(t, disableNATMapperUnlessSet())
+	assert.Equal(t, "true", os.Getenv(natMapperEnv), "an unset mapper switch must be turned off")
+
+	t.Setenv(natMapperEnv, "false")
+	require.NoError(t, disableNATMapperUnlessSet())
+	assert.Equal(t, "false", os.Getenv(natMapperEnv), "an operator's explicit choice must be kept")
+}
+
+// The consumer parses this variable with strconv.ParseBool and reads anything
+// it cannot parse as false, which enables the mapper. A value that would not
+// survive that parse must not count as an operator's choice, or an orchestrator
+// passing the name through empty turns the mapper on.
+func TestDisableNATMapperIgnoresAValueTheConsumerCannotRead(t *testing.T) {
+	for _, value := range []string{"", "yes", "on", "0.5"} {
+		t.Run("value "+strconv.Quote(value), func(t *testing.T) {
+			t.Setenv(natMapperEnv, value)
+			require.NoError(t, disableNATMapperUnlessSet())
+			assert.Equal(t, "true", os.Getenv(natMapperEnv),
+				"%q does not parse as a bool, so the mapper must stay off", value)
+		})
+	}
+
+	// Everything ParseBool does accept is a real choice and is left alone.
+	for _, value := range []string{"0", "f", "FALSE", "1", "t", "True"} {
+		t.Run("value "+strconv.Quote(value), func(t *testing.T) {
+			t.Setenv(natMapperEnv, value)
+			require.NoError(t, disableNATMapperUnlessSet())
+			assert.Equal(t, value, os.Getenv(natMapperEnv), "a parseable value is the operator's choice")
+		})
+	}
+}
+
+func TestRunCheckReturnsWithoutConnecting(t *testing.T) {
+	fwd, err := ParseForward("http://127.0.0.1:0=https://grafana.internal")
+	require.NoError(t, err)
+	// An unroutable management URL and no setup key: a run that tried to log
+	// in would block on the browser flow or fail to connect, not return nil.
+	cfg := &Config{ManagementURL: "https://management.invalid", Check: true, Forwards: []Forward{fwd}}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	assert.NoError(t, Run(ctx, cfg), "a check must return before any network access")
+	assert.NoError(t, ctx.Err(), "a check must return immediately")
+}
diff --git a/client/mdm/canonical_loaders.go b/client/mdm/canonical_loaders.go
index b20a823fb..64a8093c3 100644
--- a/client/mdm/canonical_loaders.go
+++ b/client/mdm/canonical_loaders.go
@@ -15,19 +15,25 @@ var allKeys = []string{
 	KeyDisableUpdateSettings,
 	KeyDisableProfiles,
 	KeyDisableNetworks,
+	KeyDisableAdvancedView,
 	KeyDisableClientRoutes,
 	KeyDisableServerRoutes,
 	KeyBlockInbound,
 	KeyDisableMetricsCollection,
 	KeyAllowServerSSH,
 	KeyDisableAutoConnect,
+	KeyDisableAutostart,
 	KeyPreSharedKey,
 	KeyRosenpassEnabled,
 	KeyRosenpassPermissive,
 	KeyWireguardPort,
+	KeyEnableLocalMetrics,
+	KeyLocalMetricsAddress,
 	KeySplitTunnelMode,
 	KeySplitTunnelApps,
 	KeyLazyConnection,
+	KeyRemoteJobsAllowed,
+	KeyBundleUploadURL,
 }
 
 // canonicalKey maps the lowercase form of a managed-config value name to
diff --git a/client/mdm/canonical_loaders_test.go b/client/mdm/canonical_loaders_test.go
new file mode 100644
index 000000000..330a15c47
--- /dev/null
+++ b/client/mdm/canonical_loaders_test.go
@@ -0,0 +1,52 @@
+//go:build windows || darwin
+
+package mdm
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"slices"
+	"strconv"
+	"testing"
+)
+
+// TestAllKeysCoversEveryPolicyKey guards against the drift that adding a Key*
+// constant without listing it in allKeys causes: the desktop loaders resolve
+// value names through canonicalKey, so an unlisted key is silently discarded as
+// unknown. policy.go is parsed rather than hand-mirrored so the test cannot go
+// stale in the same way.
+func TestAllKeysCoversEveryPolicyKey(t *testing.T) {
+	file, err := parser.ParseFile(token.NewFileSet(), "policy.go", nil, 0)
+	if err != nil {
+		t.Fatalf("parse policy.go: %v", err)
+	}
+
+	for _, decl := range file.Decls {
+		gen, ok := decl.(*ast.GenDecl)
+		if !ok || gen.Tok != token.CONST {
+			continue
+		}
+		for _, spec := range gen.Specs {
+			value, ok := spec.(*ast.ValueSpec)
+			if !ok || len(value.Names) != 1 || len(value.Values) != 1 {
+				continue
+			}
+			name := value.Names[0].Name
+			if len(name) < 4 || name[:3] != "Key" {
+				continue
+			}
+			lit, ok := value.Values[0].(*ast.BasicLit)
+			if !ok || lit.Kind != token.STRING {
+				continue
+			}
+			key, err := strconv.Unquote(lit.Value)
+			if err != nil {
+				t.Fatalf("unquote %s: %v", name, err)
+			}
+			if !slices.Contains(allKeys, key) {
+				t.Errorf("%s (%q) is missing from allKeys, so the desktop loaders discard it as unknown", name, key)
+			}
+		}
+	}
+}
diff --git a/client/mdm/changedetector.go b/client/mdm/changedetector.go
new file mode 100644
index 000000000..5c21ae355
--- /dev/null
+++ b/client/mdm/changedetector.go
@@ -0,0 +1,34 @@
+package mdm
+
+import "sync"
+
+// ChangeDetector tracks the last observed policy of a Loader so an
+// OS-notification-driven caller can ask whether the managed configuration
+// actually changed before restarting anything.
+type ChangeDetector struct {
+	mu     sync.Mutex
+	loader *Loader
+	prev   *Policy
+}
+
+// NewChangeDetector constructs a ChangeDetector seeded with the loader's
+// current policy, so only a later change reports as changed.
+func NewChangeDetector(loader *Loader) *ChangeDetector {
+	return &ChangeDetector{
+		loader: loader,
+		prev:   loader.Load(),
+	}
+}
+
+// Changed re-reads the policy, logs the per-key diff, and reports whether it
+// diverged from the last observation; the new snapshot becomes the baseline.
+func (d *ChangeDetector) Changed() bool {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	curr := d.loader.Load()
+	if !policyChanged(d.prev, curr) {
+		return false
+	}
+	d.prev = curr
+	return true
+}
diff --git a/client/mdm/conflicts.go b/client/mdm/conflicts.go
new file mode 100644
index 000000000..160212afb
--- /dev/null
+++ b/client/mdm/conflicts.go
@@ -0,0 +1,116 @@
+package mdm
+
+import (
+	"net/url"
+
+	"github.com/netbirdio/netbird/util"
+)
+
+// PreSharedKeyRedactedSentinel is the redaction mask returned in place of a
+// real pre-shared key; an incoming value equal to it is a round-trip echo,
+// never an override.
+const PreSharedKeyRedactedSentinel = "**********"
+
+// ConflictCheck is a value-aware comparison between a single requested field
+// and the corresponding MDM-enforced value.
+type ConflictCheck struct {
+	Key   string
+	Check func(*Policy) bool
+}
+
+// ConflictBool builds a ConflictCheck for a boolean MDM key.
+func ConflictBool(key string, p *bool) ConflictCheck {
+	return ConflictCheck{
+		Key: key,
+		Check: func(pol *Policy) bool {
+			if p == nil {
+				return true
+			}
+			want, ok := pol.GetBool(key)
+			return ok && want == *p
+		},
+	}
+}
+
+// ConflictStringPtr builds a ConflictCheck for an optional string MDM key,
+// where an explicit empty value is still a request to change the setting. A
+// nil p means "field not set" (no override requested).
+func ConflictStringPtr(key string, p *string) ConflictCheck {
+	return ConflictCheck{
+		Key: key,
+		Check: func(pol *Policy) bool {
+			if p == nil {
+				return true
+			}
+			want, ok := pol.GetString(key)
+			return ok && want == *p
+		},
+	}
+}
+
+// ConflictURL builds a ConflictCheck for a URL-typed MDM key. The two sides are
+// compared as the endpoints they address, not as strings: see
+// util.SameServiceURL.
+func ConflictURL(key, got string) ConflictCheck {
+	return ConflictCheck{
+		Key: key,
+		Check: func(pol *Policy) bool {
+			if got == "" {
+				return true
+			}
+			want, ok := pol.GetString(key)
+			return ok && util.SameServiceURLStrings(want, got)
+		},
+	}
+}
+
+// ConflictInt64 builds a ConflictCheck for an integer MDM key.
+func ConflictInt64(key string, p *int64) ConflictCheck {
+	return ConflictCheck{
+		Key: key,
+		Check: func(pol *Policy) bool {
+			if p == nil {
+				return true
+			}
+			want, ok := pol.GetInt(key)
+			return ok && want == *p
+		},
+	}
+}
+
+// ResolveConflicts returns the names of keys whose requested value diverges
+// from the policy-enforced value; keys the policy does not manage are skipped,
+// a managed key without a Check counts as a conflict.
+func ResolveConflicts(policy *Policy, checks []ConflictCheck) []string {
+	if policy.IsEmpty() {
+		return nil
+	}
+	var conflicts []string
+	for _, c := range checks {
+		if !policy.HasKey(c.Key) {
+			continue
+		}
+		if c.Check == nil || !c.Check(policy) {
+			conflicts = append(conflicts, c.Key)
+		}
+	}
+	return conflicts
+}
+
+// CanonicalURL normalizes a service URL by appending the scheme default port
+// when none is present; unparseable input is returned unchanged.
+func CanonicalURL(s string) string {
+	u, err := url.ParseRequestURI(s)
+	if err != nil {
+		return s
+	}
+	if u.Port() == "" {
+		switch u.Scheme {
+		case "https":
+			u.Host += ":443"
+		case "http":
+			u.Host += ":80"
+		}
+	}
+	return u.String()
+}
diff --git a/client/mdm/conflicts_test.go b/client/mdm/conflicts_test.go
new file mode 100644
index 000000000..d145ec103
--- /dev/null
+++ b/client/mdm/conflicts_test.go
@@ -0,0 +1,40 @@
+package mdm
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The same spellings, through the conflict check that decides whether a request
+// is refused. An enforced URL restated in another spelling addresses the very
+// server the policy names, so it must not be reported as a conflict.
+func TestConflictURLComparesEndpoints(t *testing.T) {
+	policy := NewPolicy(map[string]any{KeyManagementURL: "https://mgmt.example.com"})
+	require.True(t, policy.HasKey(KeyManagementURL))
+
+	for _, restated := range []string{
+		"https://mgmt.example.com",
+		"https://mgmt.example.com:443",
+		"https://mgmt.example.com/",
+		"https://MGMT.example.com",
+		"https://mgmt.example.com:0443",
+	} {
+		conflicts := ResolveConflicts(policy, []ConflictCheck{ConflictURL(KeyManagementURL, restated)})
+		assert.Empty(t, conflicts, "%q is the enforced endpoint written differently", restated)
+	}
+
+	for _, diverging := range []string{
+		"https://other.example.com",
+		"http://mgmt.example.com",
+		"https://mgmt.example.com:8443",
+		"https://mgmt.example.com/other",
+	} {
+		conflicts := ResolveConflicts(policy, []ConflictCheck{ConflictURL(KeyManagementURL, diverging)})
+		assert.Equal(t, []string{KeyManagementURL}, conflicts, "%q addresses another endpoint", diverging)
+	}
+
+	// An unset field is not a request to change anything.
+	assert.Empty(t, ResolveConflicts(policy, []ConflictCheck{ConflictURL(KeyManagementURL, "")}))
+}
diff --git a/client/mdm/jsonloader.go b/client/mdm/jsonloader.go
new file mode 100644
index 000000000..7139b0e4f
--- /dev/null
+++ b/client/mdm/jsonloader.go
@@ -0,0 +1,34 @@
+package mdm
+
+import (
+	"encoding/json"
+
+	log "github.com/sirupsen/logrus"
+)
+
+type jsonPolicyFetcher struct {
+	fetch func() string
+}
+
+// NewJSONLoader constructs a Loader whose policy source is a JSON-encoded
+// object string, as produced by the mobile native layers; a nil fetch
+// disables MDM enforcement.
+func NewJSONLoader(fetch func() string) *Loader {
+	if fetch == nil {
+		return NewLoader(nil)
+	}
+	return NewLoader(&jsonPolicyFetcher{fetch: fetch})
+}
+
+func (f *jsonPolicyFetcher) Fetch() map[string]any {
+	raw := f.fetch()
+	if raw == "" {
+		return nil
+	}
+	var out map[string]any
+	if err := json.Unmarshal([]byte(raw), &out); err != nil {
+		log.Warnf("MDM mobile fetcher: invalid JSON payload from native: %v", err)
+		return nil
+	}
+	return out
+}
diff --git a/client/mdm/policy.go b/client/mdm/policy.go
index 67b126101..638fa0d80 100644
--- a/client/mdm/policy.go
+++ b/client/mdm/policy.go
@@ -20,20 +20,35 @@ import (
 // names (lowerCamelCase) so the daemon can map a Policy key directly to a
 // configuration field.
 const (
-	KeyManagementURL            = "managementURL"
-	KeyDisableUpdateSettings    = "disableUpdateSettings"
-	KeyDisableProfiles          = "disableProfiles"
-	KeyDisableNetworks          = "disableNetworks"
+	KeyManagementURL         = "managementURL"
+	KeyDisableUpdateSettings = "disableUpdateSettings"
+	KeyDisableProfiles       = "disableProfiles"
+	KeyDisableNetworks       = "disableNetworks"
+	// KeyDisableAdvancedView gates the advanced-view section in the
+	// upcoming UI revision. UI-only: NOT stored on Config, not
+	// applied by applyMDMPolicy, not rejectable via SetConfig. The
+	// daemon surfaces it through GetFeatures (tristate: present
+	// true / present false / absent) and the same key appears in
+	// GetConfigResponse.mDMManagedFields when set.
+	KeyDisableAdvancedView      = "disableAdvancedView"
 	KeyDisableClientRoutes      = "disableClientRoutes"
 	KeyDisableServerRoutes      = "disableServerRoutes"
 	KeyBlockInbound             = "blockInbound"
 	KeyDisableMetricsCollection = "disableMetricsCollection"
 	KeyAllowServerSSH           = "allowServerSSH"
 	KeyDisableAutoConnect       = "disableAutoConnect"
-	KeyPreSharedKey             = "preSharedKey"
-	KeyRosenpassEnabled         = "rosenpassEnabled"
-	KeyRosenpassPermissive      = "rosenpassPermissive"
-	KeyWireguardPort            = "wireguardPort"
+	// KeyDisableAutostart suppresses the GUI's fresh-install
+	// launch-on-login default and marks the Settings toggle as
+	// MDM-managed. UI-only: NOT stored on Config and not applied by
+	// applyMDMPolicy; the GUI reads it directly and it appears in
+	// GetConfigResponse.mDMManagedFields when set.
+	KeyDisableAutostart    = "disableAutostart"
+	KeyPreSharedKey        = "preSharedKey"
+	KeyRosenpassEnabled    = "rosenpassEnabled"
+	KeyRosenpassPermissive = "rosenpassPermissive"
+	KeyWireguardPort       = "wireguardPort"
+	KeyEnableLocalMetrics  = "enableLocalMetrics"
+	KeyLocalMetricsAddress = "localMetricsAddress"
 
 	// Split tunnel is modeled as a single conceptual policy with two
 	// registry/plist values. KeySplitTunnelMode is the discriminator
@@ -47,6 +62,17 @@ const (
 	// the management feature flag. Read as a bool (native bool, or on/off,
 	// true/false, 1/0, yes/no); absent = defer to management.
 	KeyLazyConnection = "lazyConnection"
+
+	// KeyRemoteJobsAllowed opts the peer into management-requested remote jobs
+	// (e.g. debug bundles). Read as a bool; absent = defer to the local config
+	// (which defaults to disabled). Stored on Config as RemoteJobsAllowed.
+	KeyRemoteJobsAllowed = "allowRemoteJobs"
+
+	// KeyBundleUploadURL overrides the debug-bundle upload service URL for
+	// remote jobs, taking precedence over the management-supplied value. Read
+	// as a string; must be an https URL with a host. Absent = defer to the
+	// management-supplied URL (or the default upload server).
+	KeyBundleUploadURL = "debugBundleUploadURL"
 )
 
 // Split-tunnel mode literals (KeySplitTunnelMode values).
@@ -58,6 +84,8 @@ const (
 // SecretKeys lists keys whose values must be redacted in logs.
 var SecretKeys = map[string]struct{}{
 	KeyPreSharedKey: {},
+	// The upload URL can embed credentials or signed query tokens.
+	KeyBundleUploadURL: {},
 }
 
 // boolStringLiterals enumerates the textual boolean encodings the
@@ -91,16 +119,46 @@ func NewPolicy(values map[string]any) *Policy {
 	return &Policy{values: values}
 }
 
-// LoadPolicy reads the platform-native MDM configuration. Returns an
-// empty (but non-nil) Policy when no source is present, the source is
-// empty, or the platform is unsupported.
+// PolicyFetcher supplies the managed configuration to a Loader. Mobile
+// platforms (Android / iOS) implement it to push the OS-managed values
+// into the Go runtime. On every platform a non-nil fetcher takes
+// precedence over the native source, which is the test seam for the
+// registry / plist loaders; a nil fetcher leaves the native source in
+// charge, or disables MDM enforcement where there is none.
+type PolicyFetcher interface {
+	Fetch() map[string]any
+}
+
+// Loader is the DI-friendly entry point for reading the active MDM
+// policy. Construct one at the daemon's lifecycle owner (Server on
+// desktop, gomobile-exposed bridge on mobile) and pass it to anything
+// that needs to read MDM state (the reload ticker, profilemanager's
+// Config). Each callsite has the Loader handed in instead of looking
+// up package-level state.
+type Loader struct {
+	fetcher PolicyFetcher
+}
+
+// NewLoader constructs a Loader. A non-nil fetcher takes precedence over
+// the platform-native source; production desktop callers pass nil so the
+// registry / plist stays authoritative.
+func NewLoader(f PolicyFetcher) *Loader {
+	return &Loader{fetcher: f}
+}
+
+// Load reads the platform-native MDM configuration and returns a
+// Policy. Returns an empty (but non-nil) Policy when no source is
+// present, the source is empty, or the platform is unsupported.
 //
 // Diagnostic logging differentiates the three states:
 //   - source absent / unsupported platform: trace log only
 //   - source present, zero keys:             info "MDM enrolled (no managed keys)"
 //   - source present, N keys:                info "MDM enrolled with N managed keys: [...]"
-func LoadPolicy() *Policy {
-	values, err := loadPlatformPolicy()
+func (l *Loader) Load() *Policy {
+	if l == nil {
+		return &Policy{values: map[string]any{}}
+	}
+	values, err := l.loadPlatform()
 	if err != nil {
 		log.Tracef("MDM policy load: %v", err)
 		return &Policy{values: map[string]any{}}
@@ -177,6 +235,8 @@ func (p *Policy) GetBool(key string) (bool, bool) {
 		return t != 0, true
 	case int64:
 		return t != 0, true
+	case float64:
+		return t != 0, true
 	}
 	return false, false
 }
@@ -242,7 +302,7 @@ func (p *Policy) GetStringSlice(key string) ([]string, bool) {
 }
 
 // sortedKeys returns the keys of m as a deterministic, lexicographically
-// sorted slice. Used internally by Policy.ManagedKeys and LoadPolicy's
+// sorted slice. Used internally by Policy.ManagedKeys and Loader.Load's
 // diagnostic log line so callers see a stable key order across runs
 // regardless of Go's randomised map iteration.
 func sortedKeys(m map[string]any) []string {
diff --git a/client/mdm/policy_darwin.go b/client/mdm/policy_darwin.go
index 57aa1168c..4159f5b7e 100644
--- a/client/mdm/policy_darwin.go
+++ b/client/mdm/policy_darwin.go
@@ -25,8 +25,9 @@ import (
 // writable plist, as a defense against tampered installs.
 const policyPlistPath = "/Library/Managed Preferences/io.netbird.client.plist"
 
-// loadPlatformPolicy reads the MDM-managed configuration from the macOS
-// managed-preferences plist at policyPlistPath. Returns:
+// loadPlatform reads the MDM-managed configuration from the macOS
+// managed-preferences plist at policyPlistPath, unless a fetcher was
+// injected, in which case its values are returned instead. Returns:
 //   - (nil, nil)  when the plist is absent (device not MDM-enrolled for
 //     NetBird, or admin has not yet pushed a payload)
 //   - (map, nil)  with N entries when N managed values are present
@@ -39,13 +40,19 @@ const policyPlistPath = "/Library/Managed Preferences/io.netbird.client.plist"
 // skipped so a stray entry in the payload does not block startup.
 // Native plist value types map naturally onto the Policy accessor
 // expectations (GetString / GetBool / GetInt / GetStringSlice).
-func loadPlatformPolicy() (map[string]any, error) {
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	// Honour the injected fetcher when present so tests (and any
+	// future non-macOS MDM channel) can short-circuit the plist read
+	// with a scripted policy.
+	if l != nil && l.fetcher != nil {
+		return l.fetcher.Fetch(), nil
+	}
 	f, err := os.Open(policyPlistPath)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
 			// Not enrolled for NetBird. Caller treats nil as
 			// "no MDM source present".
-			//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
+			//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see Loader.Load.
 			return nil, nil
 		}
 		return nil, fmt.Errorf("open %s: %w", policyPlistPath, err)
diff --git a/client/mdm/policy_mobile.go b/client/mdm/policy_mobile.go
index ec25d4bb1..2e25a2bb5 100644
--- a/client/mdm/policy_mobile.go
+++ b/client/mdm/policy_mobile.go
@@ -2,13 +2,14 @@
 
 package mdm
 
-// loadPlatformPolicy is unused on mobile: the native layer (Swift on iOS,
-// Kotlin/Java on Android) reads the OS managed-config store and pushes the
-// resulting dictionary in-process via a gomobile entry point that lands in
-// Phase 5 / Phase 6. The stub keeps the package compilable for mobile
-// builds and returns (nil, nil) — the platform-absent sentinel that
-// LoadPolicy in policy.go treats as "no MDM source present".
-func loadPlatformPolicy() (map[string]any, error) {
-	//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
-	return nil, nil
+// loadPlatform reads the OS-managed configuration via the native
+// PolicyFetcher injected at Loader construction. Returns
+// (nil, nil) — the platform-absent sentinel that Loader.Load treats as
+// "no MDM source present" — when no fetcher was provided.
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	if l == nil || l.fetcher == nil {
+		//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see Loader.Load.
+		return nil, nil
+	}
+	return l.fetcher.Fetch(), nil
 }
diff --git a/client/mdm/policy_other.go b/client/mdm/policy_other.go
index f4263afa2..5d0b17cfd 100644
--- a/client/mdm/policy_other.go
+++ b/client/mdm/policy_other.go
@@ -2,13 +2,17 @@
 
 package mdm
 
-// loadPlatformPolicy returns no policy on platforms without an MDM channel
-// (Linux, FreeBSD). MDM enforcement is off and the client behaves as if
-// the feature did not exist. Returns (nil, nil) — the platform-absent
-// sentinel the caller (LoadPolicy in policy.go) treats as "no MDM
-// source present"; an error here would just translate to the same
-// outcome with an extra log line.
-func loadPlatformPolicy() (map[string]any, error) {
-	//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
+// loadPlatform reads the MDM policy on platforms without a native MDM
+// channel (Linux, FreeBSD). When no fetcher was injected the policy is
+// (nil, nil) — the platform-absent sentinel that Loader.Load treats as
+// "MDM enforcement disabled". A non-nil fetcher takes precedence: it
+// is the test-seam used by unit tests to inject a scripted policy
+// without touching the OS, and the same hook supports any future
+// non-mobile OS that grows an out-of-band MDM channel.
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	if l != nil && l.fetcher != nil {
+		return l.fetcher.Fetch(), nil
+	}
+	//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see Loader.Load.
 	return nil, nil
 }
diff --git a/client/mdm/policy_test.go b/client/mdm/policy_test.go
index 6cbe69776..ea467f861 100644
--- a/client/mdm/policy_test.go
+++ b/client/mdm/policy_test.go
@@ -1,6 +1,7 @@
 package mdm
 
 import (
+	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -95,7 +96,8 @@ func TestPolicy_GetBool(t *testing.T) {
 		{"int64 nonzero", int64(2), true, true},
 		{"int64 zero", int64(0), false, true},
 		{"string garbage", "maybe", false, false},
-		{"float unsupported", 1.0, false, false},
+		{"float nonzero", 1.0, true, true},
+		{"float zero", 0.0, false, true},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -155,10 +157,29 @@ func TestPolicy_GetStringSlice(t *testing.T) {
 	})
 }
 
-func TestLoadPolicy_PlatformStubReturnsEmpty(t *testing.T) {
-	// loadPlatformPolicy is a stub on every OS for Phase 1. LoadPolicy must
-	// degrade gracefully and never return nil.
-	p := LoadPolicy()
+// encoding/json decodes every JSON number into float64, so the mobile
+// loaders never see int.
+func TestJSONLoader_BoolFromNumber(t *testing.T) {
+	p := NewJSONLoader(func() string { return `{"blockInbound":1,"disableProfiles":0}` }).Load()
+
+	got, ok := p.GetBool(KeyBlockInbound)
+	assert.True(t, ok)
+	assert.True(t, got)
+
+	got, ok = p.GetBool(KeyDisableProfiles)
+	assert.True(t, ok)
+	assert.False(t, got)
+}
+
+func TestLoader_NilFetcherReturnsEmpty(t *testing.T) {
+	// Loader.Load with no fetcher (desktop construction) must degrade
+	// gracefully and never return nil; on linux loadPlatform is a stub
+	// returning (nil, nil), and Load is expected to translate that
+	// into a non-nil empty Policy.
+	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
+		t.Skip("a nil fetcher reads the OS-managed policy on this platform")
+	}
+	p := NewLoader(nil).Load()
 	require.NotNil(t, p)
 	assert.True(t, p.IsEmpty())
 	assert.Empty(t, p.ManagedKeys())
diff --git a/client/mdm/policy_windows.go b/client/mdm/policy_windows.go
index 0c2629f98..9363db436 100644
--- a/client/mdm/policy_windows.go
+++ b/client/mdm/policy_windows.go
@@ -61,8 +61,9 @@ func readRegistryValue(k registry.Key, name, canonical string, out map[string]an
 	}
 }
 
-// loadPlatformPolicy reads the MDM-managed configuration from the
-// Windows registry under HKLM\Software\Policies\NetBird. Returns:
+// loadPlatform reads the MDM-managed configuration from the Windows
+// registry under HKLM\Software\Policies\NetBird, unless a fetcher was
+// injected, in which case its values are returned instead. Returns:
 //   - (nil, nil)  when the key is absent (device not MDM-enrolled for NetBird)
 //   - (map, nil)  with N entries when N managed values are set (N may be 0)
 //   - (nil, err)  on open / enumerate registry errors
@@ -70,12 +71,18 @@ func readRegistryValue(k registry.Key, name, canonical string, out map[string]an
 // Per-value type coercion + skip-on-error is delegated to
 // readRegistryValue. Unknown value names are logged and skipped so a
 // malformed deployment does not block startup.
-func loadPlatformPolicy() (map[string]any, error) {
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	// Honour the injected fetcher when present so tests (and any
+	// future non-Windows MDM channel) can short-circuit the registry
+	// read with a scripted policy.
+	if l != nil && l.fetcher != nil {
+		return l.fetcher.Fetch(), nil
+	}
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, policyRegistryPath, registry.QUERY_VALUE)
 	if err != nil {
 		if errors.Is(err, registry.ErrNotExist) {
 			// Not enrolled. Caller treats nil as "no MDM source present".
-			//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
+			//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see Loader.Load.
 			return nil, nil
 		}
 		return nil, fmt.Errorf("open %s: %w", policyRegistryPath, err)
diff --git a/client/mdm/restrictions.go b/client/mdm/restrictions.go
new file mode 100644
index 000000000..200756b78
--- /dev/null
+++ b/client/mdm/restrictions.go
@@ -0,0 +1,91 @@
+package mdm
+
+import "encoding/json"
+
+// Fields carries the per-key MDM enforcement state for a UI: value-typed
+// fields hold the enforced value (nil pointer = not managed), boolean
+// fields report that the key is managed.
+type Fields struct {
+	ManagementURL            string `json:"managementURL"`
+	PreSharedKey             bool   `json:"preSharedKey"`
+	WireguardPort            bool   `json:"wireguardPort"`
+	RosenpassEnabled         bool   `json:"rosenpassEnabled"`
+	RosenpassPermissive      bool   `json:"rosenpassPermissive"`
+	DisableClientRoutes      bool   `json:"disableClientRoutes"`
+	DisableServerRoutes      bool   `json:"disableServerRoutes"`
+	AllowServerSSH           *bool  `json:"allowServerSSH"`
+	DisableAutoConnect       bool   `json:"disableAutoConnect"`
+	DisableAutostart         bool   `json:"disableAutostart"`
+	BlockInbound             bool   `json:"blockInbound"`
+	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
+	SplitTunnelMode          bool   `json:"splitTunnelMode"`
+	SplitTunnelApps          bool   `json:"splitTunnelApps"`
+	RemoteJobsAllowed        bool   `json:"allowRemoteJobs"`
+	DisableAdvancedView      *bool  `json:"disableAdvancedView"`
+}
+
+// Features carries the feature gates a UI must honor.
+type Features struct {
+	DisableProfiles       bool `json:"disableProfiles"`
+	DisableNetworks       bool `json:"disableNetworks"`
+	DisableUpdateSettings bool `json:"disableUpdateSettings"`
+}
+
+// Restrictions is the UI-facing enforcement snapshot; the JSON shape is
+// shared by the desktop frontend and the mobile bridges.
+type Restrictions struct {
+	MDM      Fields   `json:"mdm"`
+	Features Features `json:"features"`
+}
+
+// BuildRestrictions derives the UI enforcement snapshot from the active
+// policy.
+func BuildRestrictions(policy *Policy) Restrictions {
+	var r Restrictions
+	if policy.IsEmpty() {
+		return r
+	}
+
+	if v, ok := policy.GetString(KeyManagementURL); ok {
+		r.MDM.ManagementURL = CanonicalURL(v)
+	}
+	r.MDM.PreSharedKey = policy.HasKey(KeyPreSharedKey)
+	r.MDM.WireguardPort = policy.HasKey(KeyWireguardPort)
+	r.MDM.RosenpassEnabled = policy.HasKey(KeyRosenpassEnabled)
+	r.MDM.RosenpassPermissive = policy.HasKey(KeyRosenpassPermissive)
+	r.MDM.DisableClientRoutes = policy.HasKey(KeyDisableClientRoutes)
+	r.MDM.DisableServerRoutes = policy.HasKey(KeyDisableServerRoutes)
+	r.MDM.DisableAutoConnect = policy.HasKey(KeyDisableAutoConnect)
+	r.MDM.DisableAutostart = policy.HasKey(KeyDisableAutostart)
+	r.MDM.BlockInbound = policy.HasKey(KeyBlockInbound)
+	r.MDM.DisableMetricsCollection = policy.HasKey(KeyDisableMetricsCollection)
+	r.MDM.SplitTunnelMode = policy.HasKey(KeySplitTunnelMode)
+	r.MDM.SplitTunnelApps = policy.HasKey(KeySplitTunnelApps)
+	r.MDM.RemoteJobsAllowed = policy.HasKey(KeyRemoteJobsAllowed)
+	if v, ok := policy.GetBool(KeyAllowServerSSH); ok {
+		r.MDM.AllowServerSSH = &v
+	}
+	if v, ok := policy.GetBool(KeyDisableAdvancedView); ok {
+		r.MDM.DisableAdvancedView = &v
+	}
+
+	if v, ok := policy.GetBool(KeyDisableProfiles); ok {
+		r.Features.DisableProfiles = v
+	}
+	if v, ok := policy.GetBool(KeyDisableNetworks); ok {
+		r.Features.DisableNetworks = v
+	}
+	if v, ok := policy.GetBool(KeyDisableUpdateSettings); ok {
+		r.Features.DisableUpdateSettings = v
+	}
+	return r
+}
+
+// JSON renders the snapshot in the shared UI JSON shape.
+func (r Restrictions) JSON() (string, error) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
diff --git a/client/mdm/ticker.go b/client/mdm/ticker.go
index abd6ae233..be8fdcce7 100644
--- a/client/mdm/ticker.go
+++ b/client/mdm/ticker.go
@@ -15,33 +15,33 @@ import (
 // instead, hence anticipating the ticker mechanism entirely.
 const DefaultReloadInterval = 1 * time.Minute
 
-// policyLoader is the indirection through which the ticker reads the
-// OS-native policy, both for the initial observation and on every tick.
-// Production points it at LoadPolicy; tests in this package override it to
-// feed a scripted sequence of policies without touching the real OS store.
-var policyLoader = LoadPolicy
-
-// Ticker periodically re-reads the OS-native MDM policy via LoadPolicy and
-// invokes the onChange callback (supplied to Run) whenever the observed
-// Policy diverges from the last observation (added / removed / changed
-// keys). Launch with Run from a goroutine; cancel the supplied context
-// to stop.
+// Ticker periodically re-reads the OS-native MDM policy via the
+// injected Loader and invokes the onChange callback (supplied to Run)
+// whenever the observed Policy diverges from the last observation
+// (added / removed / changed keys). Launch with Run from a goroutine;
+// cancel the supplied context to stop.
 type Ticker struct {
 	interval time.Duration
+	loader   *Loader
 	prev     *Policy
 }
 
 // NewTicker constructs a Ticker that will re-read the OS-native policy
-// every reloadInterval once Run is called.
-// The initial snapshot is populated by calling policyLoader at
+// every reloadInterval once Run is called. The Loader is injected so
+// the ticker doesn't depend on any package-level state — production
+// passes the daemon-owned Loader, tests pass a fake Loader (built with
+// a fake PolicyFetcher).
+//
+// The initial snapshot is populated by calling loader.Load() at
 // construction time so the first tick only fires
 // onChange when the policy actually changed since boot — without
 // this baseline the first tick would report every currently-managed
 // key as "added" and trigger a spurious engine restart.
-func NewTicker(reloadInterval time.Duration) *Ticker {
+func NewTicker(reloadInterval time.Duration, loader *Loader) *Ticker {
 	return &Ticker{
 		interval: reloadInterval,
-		prev:     policyLoader(),
+		loader:   loader,
+		prev:     loader.Load(),
 	}
 }
 
@@ -58,13 +58,10 @@ func (t *Ticker) Run(ctx context.Context, onChange func(prev, curr *Policy) erro
 			log.Info("MDM policy reload ticker stopped")
 			return
 		case <-tk.C:
-			curr := policyLoader()
-			if policiesEqual(t.prev, curr) {
+			curr := t.loader.Load()
+			if !policyChanged(t.prev, curr) {
 				continue
 			}
-			added, removed, changed := diffPolicies(t.prev, curr)
-			log.Infof("MDM policy changed: added=%v removed=%v changed=%v",
-				added, removed, changed)
 			prev := t.prev
 			if err := onChange(prev, curr); err != nil {
 				log.Errorf("MDM policy change handler failed (retrying in 1 minute): %v", err)
@@ -127,3 +124,12 @@ func mapOf(p *Policy) map[string]any {
 	}
 	return out
 }
+
+func policyChanged(prev, curr *Policy) bool {
+	if policiesEqual(prev, curr) {
+		return false
+	}
+	added, removed, changed := diffPolicies(prev, curr)
+	log.Infof("MDM policy changed: added=%v removed=%v changed=%v", added, removed, changed)
+	return true
+}
diff --git a/client/mdm/ticker_test.go b/client/mdm/ticker_test.go
index 17f3cfc2f..29e48e728 100644
--- a/client/mdm/ticker_test.go
+++ b/client/mdm/ticker_test.go
@@ -13,28 +13,40 @@ import (
 // testReloadInterval for speeding up the ticker cadence under `go test`
 const testReloadInterval = 1 * time.Second
 
-// withPolicyLoader overrides the package-level policyLoader for the duration
-// of the test so the ticker observes a scripted policy instead of the real
-// OS-native store. The original loader is restored on cleanup.
-func withPolicyLoader(t *testing.T, fn func() *Policy) {
-	t.Helper()
-	prev := policyLoader
-	policyLoader = fn
-	t.Cleanup(func() { policyLoader = prev })
+// fakePolicyFetcher implements PolicyFetcher returning a scripted
+// policy map. Goroutine-safe so the test can mutate the script while
+// the ticker is observing it.
+type fakePolicyFetcher struct {
+	mu     sync.Mutex
+	values map[string]any
+}
+
+func (f *fakePolicyFetcher) Fetch() map[string]any {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.values == nil {
+		return nil
+	}
+	out := make(map[string]any, len(f.values))
+	for k, v := range f.values {
+		out[k] = v
+	}
+	return out
+}
+
+func (f *fakePolicyFetcher) set(values map[string]any) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.values = values
 }
 
 func TestTicker_FiresOnChangeWithDelta(t *testing.T) {
-	var mu sync.Mutex
-	current := NewPolicy(nil) // initial observation: empty (no enforcement)
-	withPolicyLoader(t, func() *Policy {
-		mu.Lock()
-		defer mu.Unlock()
-		return current
-	})
+	fetcher := &fakePolicyFetcher{} // initial observation: empty (no enforcement)
+	loader := NewLoader(fetcher)
 
 	type change struct{ prev, curr *Policy }
 	changes := make(chan change, 1)
-	tk := NewTicker(testReloadInterval)
+	tk := NewTicker(testReloadInterval, loader)
 	require.Equal(t, testReloadInterval, tk.interval)
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -49,15 +61,13 @@ func TestTicker_FiresOnChangeWithDelta(t *testing.T) {
 		})
 		close(done)
 	}()
-	// Stop Run and wait for it to exit before returning, so the policyLoader
-	// restore in t.Cleanup can't race the ticker goroutine still reading it.
+	// Stop Run and wait for it to exit before returning, so the test
+	// goroutine doesn't race the still-running ticker.
 	defer func() { cancel(); <-done }()
 
-	// Flip the OS-observed policy from empty to one managed key. The next
-	// tick must detect the diff and invoke onChange.
-	mu.Lock()
-	current = NewPolicy(map[string]any{KeyManagementURL: "https://mdm.example.com:443"})
-	mu.Unlock()
+	// Flip the OS-observed policy from empty to one managed key. The
+	// next tick must detect the diff and invoke onChange.
+	fetcher.set(map[string]any{KeyManagementURL: "https://mdm.example.com:443"})
 
 	select {
 	case c := <-changes:
@@ -69,12 +79,11 @@ func TestTicker_FiresOnChangeWithDelta(t *testing.T) {
 }
 
 func TestTicker_NoCallbackWhenPolicyUnchanged(t *testing.T) {
-	withPolicyLoader(t, func() *Policy {
-		return NewPolicy(map[string]any{KeyBlockInbound: true})
-	})
+	fetcher := &fakePolicyFetcher{values: map[string]any{KeyBlockInbound: true}}
+	loader := NewLoader(fetcher)
 
 	fired := make(chan struct{}, 1)
-	tk := NewTicker(testReloadInterval)
+	tk := NewTicker(testReloadInterval, loader)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan struct{})
@@ -90,8 +99,8 @@ func TestTicker_NoCallbackWhenPolicyUnchanged(t *testing.T) {
 	}()
 	defer func() { cancel(); <-done }()
 
-	// Over ~2 ticks at the 1s test cadence the policy never changes, so the
-	// diff guard must suppress the callback entirely.
+	// Over ~2 ticks at the 1s test cadence the policy never changes,
+	// so the diff guard must suppress the callback entirely.
 	select {
 	case <-fired:
 		t.Fatal("onChange fired despite an unchanged policy")
diff --git a/client/mobile/profile_lifecycle_test.go b/client/mobile/profile_lifecycle_test.go
new file mode 100644
index 000000000..9612f550d
--- /dev/null
+++ b/client/mobile/profile_lifecycle_test.go
@@ -0,0 +1,97 @@
+package mobile
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// loadAsTheMobileSDKsDo replays what the iOS SDK does with a stored profile:
+// read the config, serialize it, and load it back. Client.SetConfigFromJSON
+// stores that document for tvOS, Auth.SetConfigFromJSON authenticates with it,
+// and copyConfig round-trips a Config through the same pair to take an
+// in-memory copy before applying the MDM overlay.
+func loadAsTheMobileSDKsDo(t *testing.T, configPath string) *profilemanager.Config {
+	t.Helper()
+
+	stored, err := profilemanager.GetExistingConfig(configPath)
+	require.NoError(t, err, "read the stored profile")
+
+	document, err := profilemanager.ConfigToJSON(stored)
+	require.NoError(t, err, "serialize the stored profile")
+
+	reloaded, err := profilemanager.ConfigFromJSON(document)
+	require.NoError(t, err, "load the profile back")
+	return reloaded
+}
+
+// A profile survives the whole round its user puts it through: created, logged
+// out, loaded again, and switched away from and back.
+//
+// Logout is the step that makes this worth asserting. It clears the peer's
+// keys in place so the next login registers a new peer rather than bringing
+// the old one back, which leaves a profile that legitimately carries no
+// identity — and both mobile SDKs go on loading that profile through the
+// serialized form. A load that refused it, or a creation that never wrote an
+// identity in the first place, breaks logout and profile switching on iOS and
+// Android without any of it being visible from the desktop client.
+func TestProfileSurvivesLogoutAndReload(t *testing.T) {
+	pm := newTestProfileManager(t)
+
+	created, err := pm.AddProfile("work")
+	require.NoError(t, err)
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+
+	// Created: the profile carries the identity it will connect with.
+	require.NotEmpty(t, privateKeyOf(t, pm, created.ID), "a new profile was written with no identity")
+
+	configPath, err := pm.GetConfigPath(created.ID)
+	require.NoError(t, err)
+
+	before := loadAsTheMobileSDKsDo(t, configPath)
+	require.NotEmpty(t, before.PrivateKey)
+	managementURL := before.ManagementURL.String()
+
+	// Logged out: the identity is gone, on purpose.
+	require.NoError(t, pm.LogoutProfile(created.ID))
+	require.Empty(t, privateKeyOf(t, pm, created.ID), "logout left the peer's key behind")
+
+	// Loaded again: the profile is still readable, and loading it neither
+	// fails nor mints a key that nothing would write down.
+	after := loadAsTheMobileSDKsDo(t, configPath)
+	assert.Empty(t, after.PrivateKey, "loading a logged-out profile minted a key nothing will persist")
+	assert.Empty(t, after.SSHKey, "loading a logged-out profile minted an SSH key")
+	assert.Equal(t, managementURL, after.ManagementURL.String(), "the rest of the profile did not survive the logout")
+
+	// Switched away from and back: still the same profile, still loadable.
+	require.NoError(t, pm.SwitchProfile(created.ID))
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+	require.NoError(t, pm.SwitchProfile(created.ID))
+
+	active, err := pm.GetActiveProfile()
+	require.NoError(t, err)
+	assert.Equal(t, created.ID, active.ID, "the profile switched to is not the active one")
+
+	assert.Equal(t, managementURL, loadAsTheMobileSDKsDo(t, configPath).ManagementURL.String(),
+		"the profile did not survive the round of switches")
+}
+
+// The profile the SDKs fall back to gets the same treatment, since it is the
+// one a mobile client without an explicit profile runs on.
+func TestDefaultProfileSurvivesLogoutAndReload(t *testing.T) {
+	pm := newTestProfileManager(t)
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+
+	configPath, err := pm.GetConfigPath(profilemanager.DefaultProfileName)
+	require.NoError(t, err)
+	require.NotEmpty(t, loadAsTheMobileSDKsDo(t, configPath).PrivateKey)
+
+	require.NoError(t, pm.LogoutProfile(profilemanager.DefaultProfileName))
+
+	reloaded := loadAsTheMobileSDKsDo(t, configPath)
+	assert.Empty(t, reloaded.PrivateKey, "loading the logged-out default profile minted a key")
+	assert.NotNil(t, reloaded.ManagementURL, "the profile lost its management URL")
+}
diff --git a/client/mobile/profile_manager.go b/client/mobile/profile_manager.go
new file mode 100644
index 000000000..ad79d80c0
--- /dev/null
+++ b/client/mobile/profile_manager.go
@@ -0,0 +1,339 @@
+// Package mobile holds the profile manager implementation shared by the
+// Android and iOS gomobile bindings. The platform packages (client/android,
+// client/ios/NetBirdSDK) only adapt this API to gomobile-friendly types.
+package mobile
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+const (
+	// Config filename of the default profile, stored at the configDir root.
+	// Both platforms use netbird.cfg (matching the desktop netbird.cfg rather
+	// than default.json); the app-side path constants must match.
+	defaultConfigFilename = "netbird.cfg"
+	// Subdirectory of configDir holding non-default profiles.
+	profilesSubdir = "profiles"
+)
+
+// ErrProfilesDisabled marks a profile mutation rejected by MDM policy.
+var ErrProfilesDisabled = errors.New("profile management is disabled by MDM policy")
+
+/*
+
+<configDir>/                                    ← app-writable config root
+├── netbird.cfg                                 ← Default profile config
+├── netbird.account.json                        ← Default profile account email (see profile_state.go)
+├── state.json                                  ← Default profile state
+├── active_profile.json                         ← Active profile tracker (JSON with ID + Username)
+└── profiles/                                   ← Subdirectory for non-default profiles
+    ├── 4c5f5c8198c3989cffb5b5394f5a7ae0.json              ← Profile config (filename = ID)
+    ├── 4c5f5c8198c3989cffb5b5394f5a7ae0.state.json        ← Profile state
+    ├── 4c5f5c8198c3989cffb5b5394f5a7ae0.account.json      ← Profile account email
+    └── 4c5f5c8198c3989cffb5b5394f5a7ae0.prefs.json        ← Profile preferences
+*/
+
+// Profile is the platform-independent profile view handed to the bindings.
+type Profile struct {
+	ID   string
+	Name string
+	// Email is the account this profile last logged in with, "" if it never
+	// completed an SSO login. Kept across logouts; cleared when the profile is
+	// removed. See profile_state.go.
+	Email    string
+	IsActive bool
+}
+
+// ProfileManager manages profiles for the mobile platforms. It wraps the
+// internal profilemanager.ServiceManager with mobile-specific path handling.
+// All profile identity is ID-based; the human-readable name lives inside the
+// profile config's Name field.
+type ProfileManager struct {
+	configDir  string
+	username   string
+	serviceMgr *profilemanager.ServiceManager
+	mdmLoader  *mdm.Loader
+}
+
+// NewProfileManager creates a profile manager rooted at configDir, the
+// app-writable directory that every process of the app can reach. username is
+// the platform's fixed single-user context (a non-empty username is required
+// by ServiceManager for non-default profiles).
+func NewProfileManager(configDir, username string) *ProfileManager {
+	// The default profile is stored in the root configDir, not under profiles/.
+	defaultConfigPath := filepath.Join(configDir, defaultConfigFilename)
+
+	// Point the package globals at the app-provided directory, overriding the
+	// desktop defaults set in profilemanager's init().
+	profilemanager.DefaultConfigPathDir = configDir
+	profilemanager.DefaultConfigPath = defaultConfigPath
+	profilemanager.ActiveProfileStatePath = filepath.Join(configDir, "active_profile.json")
+
+	// Non-default profiles live in the profiles/ subdirectory. Passing it
+	// explicitly avoids touching the global config-dir override.
+	profilesDir := filepath.Join(configDir, profilesSubdir)
+	serviceMgr := profilemanager.NewServiceManagerWithProfilesDir(defaultConfigPath, profilesDir)
+
+	return &ProfileManager{
+		configDir:  configDir,
+		username:   username,
+		serviceMgr: serviceMgr,
+	}
+}
+
+// ListProfiles returns all available profiles, including the default profile,
+// with their active status set.
+func (pm *ProfileManager) ListProfiles() ([]Profile, error) {
+	internalProfiles, err := pm.serviceMgr.ListProfiles(pm.username)
+	if err != nil {
+		return nil, fmt.Errorf("list profiles: %w", err)
+	}
+
+	profiles := make([]Profile, 0, len(internalProfiles))
+	for _, p := range internalProfiles {
+		profiles = append(profiles, Profile{
+			ID:       p.ID.String(),
+			Name:     p.Name,
+			Email:    pm.profileEmail(p.ID.String()),
+			IsActive: p.IsActive,
+		})
+	}
+
+	return profiles, nil
+}
+
+// GetActiveProfile returns the currently active profile, resolving its ID to
+// the full profile so callers get the real display name.
+func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
+	activeState, err := pm.serviceMgr.GetActiveProfileState()
+	if err != nil {
+		return nil, fmt.Errorf("get active profile: %w", err)
+	}
+
+	prof, err := pm.serviceMgr.ResolveProfile(activeState.ID.String(), pm.username)
+	if err != nil {
+		return nil, fmt.Errorf("resolve active profile %q: %w", activeState.ID, err)
+	}
+	return &Profile{
+		ID:       prof.ID.String(),
+		Name:     prof.Name,
+		Email:    pm.profileEmail(prof.ID.String()),
+		IsActive: true,
+	}, nil
+}
+
+// SwitchProfile records the given profile ID as the active profile. The caller
+// must stop the VPN tunnel before switching.
+func (pm *ProfileManager) SwitchProfile(id string) error {
+	if err := pm.checkProfilesAllowed(); err != nil {
+		return err
+	}
+	if err := pm.serviceMgr.SetActiveProfileState(&profilemanager.ActiveProfileState{
+		ID:       profilemanager.ID(id),
+		Username: pm.username,
+	}); err != nil {
+		return fmt.Errorf("switch profile: %w", err)
+	}
+
+	log.Infof("switched to profile: %s", id)
+	return nil
+}
+
+// AddProfile creates a new profile with the given display name and a
+// generated ID. It returns the created profile so the caller learns the ID.
+func (pm *ProfileManager) AddProfile(displayName string) (*Profile, error) {
+	if err := pm.checkProfilesAllowed(); err != nil {
+		return nil, err
+	}
+	profile, err := pm.serviceMgr.AddProfile(displayName, pm.username)
+	if err != nil {
+		return nil, fmt.Errorf("add profile: %w", err)
+	}
+
+	log.Infof("created new profile: %s", profile.ID)
+	return &Profile{ID: profile.ID.String(), Name: profile.Name, IsActive: false}, nil
+}
+
+// RenameProfile changes the display name of the profile identified by id. The
+// on-disk filename (the ID) is left unchanged.
+func (pm *ProfileManager) RenameProfile(id string, newName string) error {
+	if err := pm.checkProfilesAllowed(); err != nil {
+		return err
+	}
+	if err := pm.serviceMgr.RenameProfile(profilemanager.ID(id), pm.username, newName); err != nil {
+		return fmt.Errorf("rename profile: %w", err)
+	}
+
+	log.Infof("renamed profile %s to %q", id, newName)
+	return nil
+}
+
+// LogoutProfile clears authentication data for a profile by removing its
+// private key and SSH key from the config, forcing a re-login. The management
+// URL and other settings are preserved.
+func (pm *ProfileManager) LogoutProfile(id string) error {
+	if err := pm.checkProfileLogoutAllowed(id); err != nil {
+		return err
+	}
+	configPath, err := pm.getProfileConfigPath(id)
+	if err != nil {
+		return err
+	}
+
+	if _, err := os.Stat(configPath); os.IsNotExist(err) {
+		return fmt.Errorf("profile %q does not exist", id)
+	}
+
+	// The existing-file reader, not the generating one: the check above is not
+	// atomic with this read, so a profile removed in between would otherwise be
+	// resolved from the defaults here and recreated by the write below.
+	config, err := profilemanager.GetExistingConfig(configPath)
+	if err != nil {
+		return fmt.Errorf("read profile config: %w", err)
+	}
+
+	config.PrivateKey = ""
+	config.SSHKey = ""
+
+	if err := profilemanager.WriteOutConfig(configPath, config); err != nil {
+		return fmt.Errorf("save config: %w", err)
+	}
+
+	// The stored account email is kept on purpose, matching the desktop and CLI
+	// logout semantics: the next login passes it as the login_hint so the IdP
+	// preselects the account. Removing the profile is what deletes it.
+	log.Infof("logged out from profile: %s", id)
+	return nil
+}
+
+// RemoveProfile deletes a profile. The default profile and the active profile
+// cannot be removed.
+func (pm *ProfileManager) RemoveProfile(id string) error {
+	if err := pm.checkProfilesAllowed(); err != nil {
+		return err
+	}
+	configPath, err := pm.getProfileConfigPath(id)
+	if err != nil {
+		return err
+	}
+
+	if err := pm.serviceMgr.RemoveProfile(profilemanager.ID(id), pm.username); err != nil {
+		return fmt.Errorf("remove profile: %w", err)
+	}
+
+	// The account file is this package's, not the ServiceManager's, so it must
+	// go here. The default profile has a fixed filename, so a recreated one
+	// would otherwise inherit the deleted profile's email as its login_hint.
+	// Not fatal: the profile itself is gone.
+	if err := removeProfileEmail(configPath); err != nil {
+		log.Warnf("failed to remove stored account email for profile %s: %v", id, err)
+	}
+
+	log.Infof("removed profile: %s", id)
+	return nil
+}
+
+// ProfilePrefs returns the namespaced per-profile preference store of the
+// profile identified by id.
+func (pm *ProfileManager) ProfilePrefs(id string) (*profilemanager.Prefs, error) {
+	prefs, err := pm.serviceMgr.ProfilePrefs(profilemanager.ID(id), pm.username)
+	if err != nil {
+		return nil, fmt.Errorf("resolve profile prefs: %w", err)
+	}
+	return prefs, nil
+}
+
+// GetConfigPath returns the config file path for the given profile ID. The
+// platform code should call this instead of constructing paths itself.
+func (pm *ProfileManager) GetConfigPath(id string) (string, error) {
+	return pm.getProfileConfigPath(id)
+}
+
+// GetStateFilePath returns the state file path for the given profile ID.
+func (pm *ProfileManager) GetStateFilePath(id string) (string, error) {
+	if id == "" || id == profilemanager.DefaultProfileName {
+		return filepath.Join(pm.configDir, "state.json"), nil
+	}
+
+	if !profilemanager.IsValidProfileFilenameStem(profilemanager.ID(id)) {
+		return "", fmt.Errorf("id %q is not valid", id)
+	}
+
+	profilesDir := filepath.Join(pm.configDir, profilesSubdir)
+	return filepath.Join(profilesDir, id+".state.json"), nil
+}
+
+// GetActiveConfigPath returns the config file path for the currently active
+// profile.
+func (pm *ProfileManager) GetActiveConfigPath() (string, error) {
+	activeProfile, err := pm.GetActiveProfile()
+	if err != nil {
+		return "", fmt.Errorf("get active profile: %w", err)
+	}
+	return pm.GetConfigPath(activeProfile.ID)
+}
+
+// GetActiveStateFilePath returns the state file path for the currently active
+// profile.
+func (pm *ProfileManager) GetActiveStateFilePath() (string, error) {
+	activeProfile, err := pm.GetActiveProfile()
+	if err != nil {
+		return "", fmt.Errorf("get active profile: %w", err)
+	}
+	return pm.GetStateFilePath(activeProfile.ID)
+}
+
+// SetMDMLoader registers the MDM policy source consulted before profile
+// mutations; a nil loader disables enforcement.
+func (pm *ProfileManager) SetMDMLoader(loader *mdm.Loader) {
+	pm.mdmLoader = loader
+}
+
+func (pm *ProfileManager) checkProfilesAllowed() error {
+	if v, ok := pm.mdmLoader.Load().GetBool(mdm.KeyDisableProfiles); ok && v {
+		return ErrProfilesDisabled
+	}
+	return nil
+}
+
+func (pm *ProfileManager) checkProfileLogoutAllowed(id string) error {
+	active, err := pm.serviceMgr.GetActiveProfileState()
+	if err == nil && active.ID.String() == id {
+		return nil
+	}
+	return pm.checkProfilesAllowed()
+}
+
+// profileEmail returns the account email recorded for a profile. Display-only,
+// so an unresolvable path degrades to "" rather than an error.
+func (pm *ProfileManager) profileEmail(id string) string {
+	configPath, err := pm.getProfileConfigPath(id)
+	if err != nil {
+		return ""
+	}
+	return ReadProfileEmail(configPath)
+}
+
+// getProfileConfigPath returns the config file path for a profile ID. The
+// default profile uses netbird.cfg in the root configDir; other profiles use
+// <id>.json in the profiles/ subdirectory.
+func (pm *ProfileManager) getProfileConfigPath(id string) (string, error) {
+	if !profilemanager.IsValidProfileFilenameStem(profilemanager.ID(id)) {
+		return "", fmt.Errorf("id %q is not valid", id)
+	}
+
+	if id == profilemanager.DefaultProfileName {
+		return filepath.Join(pm.configDir, defaultConfigFilename), nil
+	}
+
+	profilesDir := filepath.Join(pm.configDir, profilesSubdir)
+	return filepath.Join(profilesDir, id+".json"), nil
+}
diff --git a/client/mobile/profile_manager_mdm_test.go b/client/mobile/profile_manager_mdm_test.go
new file mode 100644
index 000000000..305becac3
--- /dev/null
+++ b/client/mobile/profile_manager_mdm_test.go
@@ -0,0 +1,83 @@
+package mobile
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+type fakeFetcher struct{ values map[string]any }
+
+func (f *fakeFetcher) Fetch() map[string]any { return f.values }
+
+func newTestProfileManager(t *testing.T) *ProfileManager {
+	t.Helper()
+	origDir := profilemanager.DefaultConfigPathDir
+	origPath := profilemanager.DefaultConfigPath
+	origActive := profilemanager.ActiveProfileStatePath
+	t.Cleanup(func() {
+		profilemanager.DefaultConfigPathDir = origDir
+		profilemanager.DefaultConfigPath = origPath
+		profilemanager.ActiveProfileStatePath = origActive
+	})
+
+	configDir := t.TempDir()
+	pm := NewProfileManager(configDir, "mobile")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath: filepath.Join(configDir, defaultConfigFilename),
+	})
+	require.NoError(t, err)
+	return pm
+}
+
+func privateKeyOf(t *testing.T, pm *ProfileManager, id string) string {
+	t.Helper()
+	path, err := pm.getProfileConfigPath(id)
+	require.NoError(t, err)
+	raw, err := os.ReadFile(path)
+	require.NoError(t, err)
+	var cfg struct{ PrivateKey string }
+	require.NoError(t, json.Unmarshal(raw, &cfg))
+	return cfg.PrivateKey
+}
+
+func TestLogoutProfile_DisableProfiles(t *testing.T) {
+	pm := newTestProfileManager(t)
+	other, err := pm.AddProfile("work")
+	require.NoError(t, err)
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+	require.NotEmpty(t, privateKeyOf(t, pm, profilemanager.DefaultProfileName))
+	require.NotEmpty(t, privateKeyOf(t, pm, other.ID))
+
+	pm.SetMDMLoader(mdm.NewLoader(&fakeFetcher{values: map[string]any{
+		mdm.KeyDisableProfiles: true,
+	}}))
+
+	err = pm.LogoutProfile(other.ID)
+	assert.ErrorIs(t, err, ErrProfilesDisabled)
+	assert.NotEmpty(t, privateKeyOf(t, pm, other.ID))
+
+	require.NoError(t, pm.LogoutProfile(profilemanager.DefaultProfileName))
+	assert.Empty(t, privateKeyOf(t, pm, profilemanager.DefaultProfileName))
+}
+
+func TestLogoutProfile_ProfilesAllowed(t *testing.T) {
+	pm := newTestProfileManager(t)
+	other, err := pm.AddProfile("work")
+	require.NoError(t, err)
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+
+	pm.SetMDMLoader(mdm.NewLoader(&fakeFetcher{values: map[string]any{
+		mdm.KeyDisableProfiles: false,
+	}}))
+
+	require.NoError(t, pm.LogoutProfile(other.ID))
+	assert.Empty(t, privateKeyOf(t, pm, other.ID))
+}
diff --git a/client/mobile/profile_state.go b/client/mobile/profile_state.go
new file mode 100644
index 000000000..ad05801f8
--- /dev/null
+++ b/client/mobile/profile_state.go
@@ -0,0 +1,110 @@
+package mobile
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/util"
+)
+
+const (
+	// profileAccountSuffix names the file holding the profile's account email.
+	// Deliberately not ".state.json", which desktop uses for the same data:
+	// there the email and the engine's state manager live in different
+	// directories, but on mobile both resolve under configDir, so sharing the
+	// name would have the two overwrite each other — the state manager rewrites
+	// the whole file from its own keys (see statemanager.Manager.PersistState),
+	// and this package's writer does the same in reverse.
+	profileAccountSuffix = ".account.json"
+)
+
+// profileAccountPathFor derives the account file path from a profile's config
+// path: netbird.cfg -> netbird.account.json, <id>.json -> <id>.account.json.
+//
+// Deriving from the config path rather than resolving the active profile keeps
+// the write on the profile the login actually ran for: login flows run in a
+// goroutine, so the active profile can change under a flow already in flight.
+func profileAccountPathFor(configPath string) (string, error) {
+	if configPath == "" {
+		return "", fmt.Errorf("empty config path")
+	}
+
+	base := filepath.Base(configPath)
+	stem := strings.TrimSuffix(base, filepath.Ext(base))
+	if stem == "" || stem == "." {
+		return "", fmt.Errorf("config path %q has no filename stem", configPath)
+	}
+
+	return filepath.Join(filepath.Dir(configPath), stem+profileAccountSuffix), nil
+}
+
+// ReadProfileEmail returns the account email stored for the profile whose
+// config lives at configPath. A missing or unreadable file yields "", which
+// leaves the account choice to the IdP.
+func ReadProfileEmail(configPath string) string {
+	accountPath, err := profileAccountPathFor(configPath)
+	if err != nil {
+		log.Debugf("no profile account path for login hint: %v", err)
+		return ""
+	}
+
+	var state profilemanager.ProfileState
+	if _, err := util.ReadJson(accountPath, &state); err != nil {
+		if !os.IsNotExist(err) {
+			log.Debugf("failed to read profile account for login hint: %v", err)
+		}
+		return ""
+	}
+
+	return state.Email
+}
+
+// WriteProfileEmail records the account email for the profile whose config
+// lives at configPath, so later logins can pass it as an OIDC login_hint. An
+// empty email is ignored rather than blanking what is already stored.
+func WriteProfileEmail(configPath string, email string) error {
+	if email == "" {
+		return nil
+	}
+
+	accountPath, err := profileAccountPathFor(configPath)
+	if err != nil {
+		return fmt.Errorf("resolve profile account path: %w", err)
+	}
+
+	// DirectWriteJson, not the atomic writers: those create a temp file and
+	// rename it over the target, which the tvOS App Group sandbox blocks. It is
+	// the same reason the config next to this file goes through
+	// DirectWriteOutConfig. The file is rewritten whole from one key, so losing
+	// atomicity costs nothing beyond a torn write on a crash mid-write, which
+	// reads back as "no email" and is recovered by the next login.
+	state := profilemanager.ProfileState{Email: email}
+	if err := util.DirectWriteJson(context.Background(), accountPath, state); err != nil {
+		return fmt.Errorf("write profile account: %w", err)
+	}
+
+	return nil
+}
+
+// removeProfileEmail drops the stored account email. Called on profile removal,
+// not on logout: a logged-out profile keeps its email so the next login passes
+// it as the login_hint, matching the desktop and CLI semantics. Mirrors the
+// desktop UI's RemoveProfileState call.
+func removeProfileEmail(configPath string) error {
+	accountPath, err := profileAccountPathFor(configPath)
+	if err != nil {
+		return fmt.Errorf("resolve profile account path: %w", err)
+	}
+
+	if err := os.Remove(accountPath); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove profile account: %w", err)
+	}
+
+	return nil
+}
diff --git a/client/mobile/profile_state_test.go b/client/mobile/profile_state_test.go
new file mode 100644
index 000000000..99cba15de
--- /dev/null
+++ b/client/mobile/profile_state_test.go
@@ -0,0 +1,161 @@
+package mobile
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestProfileAccountPathFor(t *testing.T) {
+	tests := []struct {
+		name       string
+		configPath string
+		want       string
+		wantErr    bool
+	}{
+		{
+			name:       "default profile",
+			configPath: "/data/netbird/files/netbird.cfg",
+			want:       filepath.FromSlash("/data/netbird/files/netbird.account.json"),
+		},
+		{
+			name:       "id profile",
+			configPath: "/data/netbird/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.json",
+			want:       filepath.FromSlash("/data/netbird/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.account.json"),
+		},
+		{
+			name:       "legacy name-keyed profile is handled the same way",
+			configPath: "/data/netbird/files/profiles/work.json",
+			want:       filepath.FromSlash("/data/netbird/files/profiles/work.account.json"),
+		},
+		{
+			name:       "empty path is rejected",
+			configPath: "",
+			wantErr:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := profileAccountPathFor(tt.configPath)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("expected an error, got path %q", got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tt.want {
+				t.Errorf("got %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestProfileAccountPathForDefaultDoesNotCollide(t *testing.T) {
+	root := "/data/netbird/files"
+
+	defaultAccount, err := profileAccountPathFor(filepath.Join(root, defaultConfigFilename))
+	if err != nil {
+		t.Fatalf("default profile: %v", err)
+	}
+
+	idAccount, err := profileAccountPathFor(filepath.Join(root, profilesSubdir, "abc123.json"))
+	if err != nil {
+		t.Fatalf("id profile: %v", err)
+	}
+
+	if defaultAccount == idAccount {
+		t.Fatalf("default and id profile share an account file: %q", defaultAccount)
+	}
+}
+
+// The account file must never land on the engine state file: on mobile both
+// resolve under configDir, and the state manager rewrites the whole file from
+// its own keys, so sharing a path would have the two overwrite each other. The
+// expected names here mirror ProfileManager.GetStateFilePath.
+func TestProfileAccountPathAvoidsEngineStateFile(t *testing.T) {
+	root := "/data/netbird/files"
+
+	cases := []struct {
+		configPath  string
+		engineState string
+	}{
+		{
+			configPath:  filepath.Join(root, defaultConfigFilename),
+			engineState: filepath.Join(root, "state.json"),
+		},
+		{
+			configPath:  filepath.Join(root, profilesSubdir, "abc123.json"),
+			engineState: filepath.Join(root, profilesSubdir, "abc123.state.json"),
+		},
+	}
+
+	for _, c := range cases {
+		account, err := profileAccountPathFor(c.configPath)
+		if err != nil {
+			t.Fatalf("%s: %v", c.configPath, err)
+		}
+		if account == c.engineState {
+			t.Errorf("account file collides with the engine state file: %q", account)
+		}
+	}
+}
+
+func TestWriteThenReadProfileEmail(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
+	if err := ensureDirFor(t, configPath); err != nil {
+		t.Fatalf("prepare dir: %v", err)
+	}
+
+	if got := ReadProfileEmail(configPath); got != "" {
+		t.Errorf("expected no email before a login, got %q", got)
+	}
+
+	const email = "user@example.com"
+	if err := WriteProfileEmail(configPath, email); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	if got := ReadProfileEmail(configPath); got != email {
+		t.Errorf("got %q, want %q", got, email)
+	}
+
+	if err := removeProfileEmail(configPath); err != nil {
+		t.Fatalf("remove: %v", err)
+	}
+	if got := ReadProfileEmail(configPath); got != "" {
+		t.Errorf("expected no email after removal, got %q", got)
+	}
+
+	// Removal may run on a never-logged-in profile, so a second remove must pass.
+	if err := removeProfileEmail(configPath); err != nil {
+		t.Fatalf("second remove should be a no-op: %v", err)
+	}
+}
+
+func TestWriteProfileEmailIgnoresEmpty(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
+	if err := ensureDirFor(t, configPath); err != nil {
+		t.Fatalf("prepare dir: %v", err)
+	}
+
+	const email = "user@example.com"
+	if err := WriteProfileEmail(configPath, email); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	if err := WriteProfileEmail(configPath, ""); err != nil {
+		t.Fatalf("write empty: %v", err)
+	}
+
+	if got := ReadProfileEmail(configPath); got != email {
+		t.Errorf("empty write clobbered the stored email: got %q, want %q", got, email)
+	}
+}
+
+func ensureDirFor(t *testing.T, path string) error {
+	t.Helper()
+	return os.MkdirAll(filepath.Dir(path), 0o700)
+}
diff --git a/client/net/fwmark.go b/client/net/fwmark.go
new file mode 100644
index 000000000..b526feee4
--- /dev/null
+++ b/client/net/fwmark.go
@@ -0,0 +1,110 @@
+package net
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// envFwmarkBase overrides the base of the fwmark range. Container network
+	// plugins, CNIs and other VPNs claim bits of the mark space for themselves,
+	// and a rule of theirs matching one of our bits acts on our traffic, so
+	// hosts running such software may need to move the range out of the way.
+	envFwmarkBase = "NB_FWMARK_BASE"
+
+	// defaultFwmarkBase is the base of the fwmark range used when the
+	// environment does not override it.
+	defaultFwmarkBase uint32 = 0x1BD00
+
+	// fwmarkOffsetMask is the part of a mark that identifies the individual mark
+	// within the range, so the base occupies everything above it.
+	fwmarkOffsetMask uint32 = 0xFF
+)
+
+// Offsets of the individual marks within the range.
+const (
+	offsetControlPlane     uint32 = 0x00
+	offsetDataPlaneIn      uint32 = 0x10
+	offsetDataPlaneOut     uint32 = 0x11
+	offsetRedirected       uint32 = 0x20
+	offsetMasquerade       uint32 = 0x21
+	offsetMasqueradeReturn uint32 = 0x22
+	offsetDataPlaneLower   uint32 = 0x10
+	offsetDataPlaneUpper   uint32 = fwmarkOffsetMask
+)
+
+var (
+	fwmarkBase = loadFwmarkBase()
+
+	// ControlPlaneMark is the fwmark value used to mark packets that should not be routed through the NetBird interface to
+	// avoid routing loops.
+	// This includes all control plane traffic (mgmt, signal, flows), relay, ICE/stun/turn and everything that is emitted by the wireguard socket.
+	// It doesn't collide with the other marks, as the others are used for data plane traffic only.
+	ControlPlaneMark = fwmarkBase | offsetControlPlane
+
+	// DataPlaneMarkLower is the lowest value for the data plane range
+	DataPlaneMarkLower = fwmarkBase | offsetDataPlaneLower
+	// DataPlaneMarkUpper is the highest value for the data plane range
+	DataPlaneMarkUpper = fwmarkBase | offsetDataPlaneUpper
+
+	// DataPlaneMarkIn is the mark for inbound data plane traffic.
+	DataPlaneMarkIn = fwmarkBase | offsetDataPlaneIn
+
+	// DataPlaneMarkOut is the mark for outbound data plane traffic.
+	DataPlaneMarkOut = fwmarkBase | offsetDataPlaneOut
+
+	// PreroutingFwmarkRedirected is applied to packets that were redirected (input -> forward, e.g. by Docker or Podman) for special handling.
+	PreroutingFwmarkRedirected = fwmarkBase | offsetRedirected
+
+	// PreroutingFwmarkMasquerade is applied to packets that arrive from the NetBird interface and should be masqueraded.
+	PreroutingFwmarkMasquerade = fwmarkBase | offsetMasquerade
+
+	// PreroutingFwmarkMasqueradeReturn is applied to packets that will leave through the NetBird interface and should be masqueraded.
+	PreroutingFwmarkMasqueradeReturn = fwmarkBase | offsetMasqueradeReturn
+)
+
+// IsDataPlaneMark determines if a fwmark is in the data plane range.
+func IsDataPlaneMark(fwmark uint32) bool {
+	return fwmark >= DataPlaneMarkLower && fwmark <= DataPlaneMarkUpper
+}
+
+func loadFwmarkBase() uint32 {
+	val := os.Getenv(envFwmarkBase)
+	if val == "" {
+		return defaultFwmarkBase
+	}
+
+	base, err := parseFwmarkBase(val)
+	if err != nil {
+		log.Warnf("failed to parse %s=%q, using the default range: %v", envFwmarkBase, val, err)
+		return defaultFwmarkBase
+	}
+
+	log.Infof("using fwmark range %#x-%#x from %s", base, base|fwmarkOffsetMask, envFwmarkBase)
+	return base
+}
+
+// parseFwmarkBase reads a mark range base. The low byte of a mark identifies the
+// individual mark within the range, so a base has to leave it free.
+func parseFwmarkBase(val string) (uint32, error) {
+	val = strings.TrimSpace(val)
+
+	base, err := strconv.ParseUint(val, 0, 32)
+	if err != nil {
+		return 0, fmt.Errorf("not a 32 bit number: %w", err)
+	}
+
+	if base == 0 {
+		return 0, fmt.Errorf("base must not be zero")
+	}
+
+	if uint32(base)&fwmarkOffsetMask != 0 {
+		return 0, fmt.Errorf("base %#x must leave the low byte free", base)
+	}
+
+	return uint32(base), nil
+}
diff --git a/client/net/fwmark_test.go b/client/net/fwmark_test.go
new file mode 100644
index 000000000..2dbebec2a
--- /dev/null
+++ b/client/net/fwmark_test.go
@@ -0,0 +1,111 @@
+package net
+
+import (
+	"testing"
+)
+
+func TestParseFwmarkBase(t *testing.T) {
+	tests := []struct {
+		name    string
+		val     string
+		want    uint32
+		wantErr bool
+	}{
+		{name: "hex", val: "0x5A000", want: 0x5A000},
+		{name: "hex upper case", val: "0X5A000", want: 0x5A000},
+		{name: "decimal", val: "65536", want: 65536},
+		{name: "octal", val: "0o400", want: 0o400},
+		{name: "surrounding space", val: "  0x5A000 ", want: 0x5A000},
+		{name: "highest usable base", val: "0xFFFFFF00", want: 0xFFFFFF00},
+		{name: "low byte in use", val: "0x1BD01", wantErr: true},
+		{name: "zero", val: "0", wantErr: true},
+		{name: "not a number", val: "wireguard", wantErr: true},
+		{name: "wider than 32 bit", val: "0x1FFFFFFFF", wantErr: true},
+		{name: "negative", val: "-0x100", wantErr: true},
+		{name: "empty", val: "", wantErr: true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := parseFwmarkBase(tc.val)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("parseFwmarkBase(%q) = %#x, want an error", tc.val, got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("parseFwmarkBase(%q): %v", tc.val, err)
+			}
+			if got != tc.want {
+				t.Errorf("parseFwmarkBase(%q) = %#x, want %#x", tc.val, got, tc.want)
+			}
+		})
+	}
+}
+
+// The marks have to stay inside the range the base defines, otherwise a host
+// that moved the range to dodge a collision would still emit the old values.
+func TestMarksStayWithinTheRange(t *testing.T) {
+	lower, upper := fwmarkBase, fwmarkBase|fwmarkOffsetMask
+
+	marks := map[string]uint32{
+		"ControlPlaneMark":                 ControlPlaneMark,
+		"DataPlaneMarkLower":               DataPlaneMarkLower,
+		"DataPlaneMarkUpper":               DataPlaneMarkUpper,
+		"DataPlaneMarkIn":                  DataPlaneMarkIn,
+		"DataPlaneMarkOut":                 DataPlaneMarkOut,
+		"PreroutingFwmarkRedirected":       PreroutingFwmarkRedirected,
+		"PreroutingFwmarkMasquerade":       PreroutingFwmarkMasquerade,
+		"PreroutingFwmarkMasqueradeReturn": PreroutingFwmarkMasqueradeReturn,
+	}
+
+	for name, mark := range marks {
+		if mark < lower || mark > upper {
+			t.Errorf("%s = %#x, outside the range %#x-%#x", name, mark, lower, upper)
+		}
+	}
+
+	// the control plane mark must stay out of the data plane range, the netflow
+	// conntrack path tells them apart by it
+	if IsDataPlaneMark(ControlPlaneMark) {
+		t.Errorf("ControlPlaneMark %#x is inside the data plane range", ControlPlaneMark)
+	}
+	for name, mark := range map[string]uint32{
+		"DataPlaneMarkIn":                  DataPlaneMarkIn,
+		"DataPlaneMarkOut":                 DataPlaneMarkOut,
+		"PreroutingFwmarkRedirected":       PreroutingFwmarkRedirected,
+		"PreroutingFwmarkMasquerade":       PreroutingFwmarkMasquerade,
+		"PreroutingFwmarkMasqueradeReturn": PreroutingFwmarkMasqueradeReturn,
+	} {
+		if !IsDataPlaneMark(mark) {
+			t.Errorf("%s = %#x is outside the data plane range %#x-%#x", name, mark, DataPlaneMarkLower, DataPlaneMarkUpper)
+		}
+	}
+}
+
+func TestDefaultMarksAreUnchanged(t *testing.T) {
+	tests := map[string]struct {
+		got  uint32
+		want uint32
+	}{
+		"ControlPlaneMark":                 {ControlPlaneMark, 0x1BD00},
+		"DataPlaneMarkLower":               {DataPlaneMarkLower, 0x1BD10},
+		"DataPlaneMarkUpper":               {DataPlaneMarkUpper, 0x1BDFF},
+		"DataPlaneMarkIn":                  {DataPlaneMarkIn, 0x1BD10},
+		"DataPlaneMarkOut":                 {DataPlaneMarkOut, 0x1BD11},
+		"PreroutingFwmarkRedirected":       {PreroutingFwmarkRedirected, 0x1BD20},
+		"PreroutingFwmarkMasquerade":       {PreroutingFwmarkMasquerade, 0x1BD21},
+		"PreroutingFwmarkMasqueradeReturn": {PreroutingFwmarkMasqueradeReturn, 0x1BD22},
+	}
+
+	if fwmarkBase != defaultFwmarkBase {
+		t.Skipf("%s is set, the defaults do not apply", envFwmarkBase)
+	}
+
+	for name, tc := range tests {
+		if tc.got != tc.want {
+			t.Errorf("%s = %#x, want %#x", name, tc.got, tc.want)
+		}
+	}
+}
diff --git a/client/net/net.go b/client/net/net.go
index a97de9d59..77fba36d1 100644
--- a/client/net/net.go
+++ b/client/net/net.go
@@ -7,41 +7,6 @@ import (
 	"net/netip"
 )
 
-const (
-	// ControlPlaneMark is the fwmark value used to mark packets that should not be routed through the NetBird interface to
-	// avoid routing loops.
-	// This includes all control plane traffic (mgmt, signal, flows), relay, ICE/stun/turn and everything that is emitted by the wireguard socket.
-	// It doesn't collide with the other marks, as the others are used for data plane traffic only.
-	ControlPlaneMark = 0x1BD00
-
-	// Data plane marks (0x1BD10 - 0x1BDFF)
-
-	// DataPlaneMarkLower is the lowest value for the data plane range
-	DataPlaneMarkLower = 0x1BD10
-	// DataPlaneMarkUpper is the highest value for the data plane range
-	DataPlaneMarkUpper = 0x1BDFF
-
-	// DataPlaneMarkIn is the mark for inbound data plane traffic.
-	DataPlaneMarkIn = 0x1BD10
-
-	// DataPlaneMarkOut is the mark for outbound data plane traffic.
-	DataPlaneMarkOut = 0x1BD11
-
-	// PreroutingFwmarkRedirected is applied to packets that are were redirected (input -> forward, e.g. by Docker or Podman) for special handling.
-	PreroutingFwmarkRedirected = 0x1BD20
-
-	// PreroutingFwmarkMasquerade is applied to packets that arrive from the NetBird interface and should be masqueraded.
-	PreroutingFwmarkMasquerade = 0x1BD21
-
-	// PreroutingFwmarkMasqueradeReturn is applied to packets that will leave through the NetBird interface and should be masqueraded.
-	PreroutingFwmarkMasqueradeReturn = 0x1BD22
-)
-
-// IsDataPlaneMark determines if a fwmark is in the data plane range (0x1BD10-0x1BDFF)
-func IsDataPlaneMark(fwmark uint32) bool {
-	return fwmark >= DataPlaneMarkLower && fwmark <= DataPlaneMarkUpper
-}
-
 func GetLastIPFromNetwork(network netip.Prefix, fromEnd int) (netip.Addr, error) {
 	var endIP net.IP
 	addr := network.Addr().AsSlice()
diff --git a/client/net/net_linux.go b/client/net/net_linux.go
index 9e7d13702..8ed8a1944 100644
--- a/client/net/net_linux.go
+++ b/client/net/net_linux.go
@@ -21,15 +21,6 @@ func SetSocketMark(conn syscall.Conn) error {
 	return setRawSocketMark(sysconn)
 }
 
-// SetSocketOpt sets the SO_MARK option on the given file descriptor
-func SetSocketOpt(fd int) error {
-	if !AdvancedRouting() {
-		return nil
-	}
-
-	return setSocketOptInt(fd)
-}
-
 func setRawSocketMark(conn syscall.RawConn) error {
 	var setErr error
 
@@ -51,5 +42,5 @@ func setRawSocketMark(conn syscall.RawConn) error {
 }
 
 func setSocketOptInt(fd int) error {
-	return syscall.SetsockoptInt(fd, syscall.SOL_SOCKET, syscall.SO_MARK, ControlPlaneMark)
+	return syscall.SetsockoptInt(fd, syscall.SOL_SOCKET, syscall.SO_MARK, int(ControlPlaneMark))
 }
diff --git a/client/netbird.wxs b/client/netbird.wxs
index 6f18b63b5..156b4ff27 100644
--- a/client/netbird.wxs
+++ b/client/netbird.wxs
@@ -13,9 +13,6 @@
 
 		<MajorUpgrade AllowSameVersionUpgrades='yes' DowngradeErrorMessage="A newer version of [ProductName] is already installed. Setup will now exit."/>
 
-		<!-- Autostart: enabled by default, disable with AUTOSTART=0 on the msiexec command line -->
-		<Property Id="AUTOSTART" Value="1" />
-
 		<StandardDirectory Id="ProgramFiles64Folder">
 			<Directory Id="NetbirdInstallDir" Name="Netbird">
 				<Component Id="NetbirdFiles" Guid="db3165de-cc6e-4922-8396-9d892950e23e" Bitness="always64">
@@ -32,9 +29,6 @@
 					</File>
 					<File ProcessorArchitecture="$(var.ProcessorArchitecture)" Source=".\dist\netbird_windows_$(var.ArchSuffix)\wintun.dll" />
 					<File Id="NetbirdToastIcon" Name="netbird.png" Source=".\client\ui\assets\netbird.png" />
-					<?if $(var.ArchSuffix) = "amd64" ?>
-					<File ProcessorArchitecture="$(var.ProcessorArchitecture)" Source=".\dist\netbird_windows_$(var.ArchSuffix)\opengl32.dll" />
-					<?endif ?>
 
 					<ServiceInstall
                                      Id="NetBirdService"
@@ -62,33 +56,69 @@
 			<Component Id="NetbirdAumidRegistry" Guid="*">
 				<RegistryKey Root="HKCU" Key="Software\Classes\AppUserModelId\NetBird" ForceDeleteOnUninstall="yes">
 					<RegistryValue Name="InstalledByMSI" Type="integer" Value="1" KeyPath="yes" />
+					<!-- Pre-seed the CLSID the Wails notifications service reads on
+					     first startup (notifications_windows.go:getGUID looks for
+					     the CustomActivator value under this key). Without this
+					     the service generates a fresh per-install UUID, which
+					     diverges from the ToastActivatorCLSID set on the Start
+					     Menu / Desktop shortcuts above and the COM activator
+					     never fires when a toast is clicked. -->
+					<RegistryValue Name="CustomActivator" Type="string" Value="{0E1B4DE7-E148-432B-9814-544F941826EC}" />
 				</RegistryKey>
 			</Component>
 		</StandardDirectory>
 
-		<StandardDirectory Id="CommonAppDataFolder">
-			<Directory Id="NetbirdAutoStartDir" Name="Netbird">
-				<Component Id="NetbirdAutoStart" Guid="b199eaca-b0dd-4032-af19-679cfad48eb3" Bitness="always64" Condition='AUTOSTART = "1"'>
-					<RegistryValue Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\Run"
-						Name="Netbird" Value="&quot;[NetbirdInstallDir]netbird-ui.exe&quot;"
-						Type="string" KeyPath="yes" />
-				</Component>
-			</Directory>
-		</StandardDirectory>
-
 		<ComponentGroup Id="NetbirdFilesComponent">
 			<ComponentRef Id="NetbirdFiles" />
 			<ComponentRef Id="NetbirdAumidRegistry" />
-			<ComponentRef Id="NetbirdAutoStart" />
 		</ComponentGroup>
 
 		<util:CloseApplication Id="CloseNetBird" CloseMessage="no" Target="netbird.exe" RebootPrompt="no" />
 		<util:CloseApplication Id="CloseNetBirdUI" CloseMessage="no" Target="netbird-ui.exe" RebootPrompt="no" TerminateProcess="0" />
 
+		<!-- Kill the UI before InstallValidate, otherwise its Restart Manager
+		     check sees netbird-ui.exe in use and schedules the replacement for
+		     the next reboot (3010). Keep it immediate and before InstallValidate.
+		     CloseNetBirdUI above stays as a deferred LocalSystem fallback for UIs
+		     in other sessions that this action cannot terminate. -->
+		<SetProperty Id="WixQuietExecCmdLine" Value="&quot;[System64Folder]taskkill.exe&quot; /F /IM netbird-ui.exe" Before="KillNetBirdUI" Sequence="execute" />
+		<CustomAction Id="KillNetBirdUI" BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)" DllEntry="WixQuietExec" Execute="immediate" Return="ignore" />
 
+		<!-- WebView2 evergreen runtime detection.
+		     Probe both the per-machine and per-user EdgeUpdate keys; if either
+		     reports a non-empty `pv` value the runtime is already installed
+		     and we skip the bootstrapper. -->
+		<Property Id="WEBVIEW2_VERSION_HKLM">
+			<RegistrySearch Id="WV2HKLM" Root="HKLM"
+				Key="SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"
+				Name="pv" Type="raw" Bitness="always64" />
+		</Property>
+		<Property Id="WEBVIEW2_VERSION_HKCU">
+			<RegistrySearch Id="WV2HKCU" Root="HKCU"
+				Key="Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"
+				Name="pv" Type="raw" />
+		</Property>
+
+		<!-- Embed the bootstrapper payload. Path is relative to the WiX
+		     working directory; sign-pipelines stages it next to client/
+		     via `wails3 generate webview2bootstrapper`. -->
+		<Binary Id="WebView2Bootstrapper" SourceFile=".\client\MicrosoftEdgeWebview2Setup.exe" />
+
+		<CustomAction Id="InstallWebView2"
+			BinaryRef="WebView2Bootstrapper"
+			ExeCommand="/silent /install"
+			Execute="deferred"
+			Impersonate="no"
+			Return="check" />
+
+		<InstallExecuteSequence>
+			<Custom Action="KillNetBirdUI" Before="InstallValidate" />
+			<Custom Action="InstallWebView2" Before="InstallFinalize"
+				Condition="NOT WEBVIEW2_VERSION_HKLM AND NOT WEBVIEW2_VERSION_HKCU AND NOT REMOVE" />
+		</InstallExecuteSequence>
 
 		<!-- Icons -->
-		<Icon Id="NetbirdIcon" SourceFile=".\client\ui\assets\netbird.ico" />
+		<Icon Id="NetbirdIcon" SourceFile=".\client\ui\build\windows\icon.ico" />
 		<Property Id="ARPPRODUCTICON" Value="NetbirdIcon" />
 
 	</Package>
diff --git a/client/netevents/netevents.go b/client/netevents/netevents.go
new file mode 100644
index 000000000..474cbfa22
--- /dev/null
+++ b/client/netevents/netevents.go
@@ -0,0 +1,173 @@
+// Package netevents owns the OS network event handling shared by the mobile
+// bindings: availability changes park or wake the reconnection loops and drive
+// the NoNetwork listener state, and both losing the last network and switching
+// networks sweep the stale connections so their owners redial immediately.
+package netevents
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/netevents/netstate"
+	"github.com/netbirdio/netbird/client/netevents/sweep"
+)
+
+// Recorder receives the availability changes for listener state reporting.
+type Recorder interface {
+	SetNetworkAvailable(available bool)
+}
+
+// Manager ties the network availability state, the connection sweeper and the
+// status recorder together; it outlives engine restarts. A nil *Manager is
+// the valid no-events value for consumers: the read methods report
+// always-online and never sweep. Only the event sources hold a real Manager,
+// so the write methods do not tolerate a nil receiver.
+type Manager struct {
+	// mu serializes availability transitions: the IsOnline check and the
+	// state update must be atomic, or a racing offline flip can skip the sweep
+	// and leave netState and the recorder disagreeing.
+	mu       sync.Mutex
+	netState *netstate.State
+	sweeper  *sweep.Sweeper
+	recorder Recorder
+}
+
+// NewManager creates a Manager reporting into recorder, starting online.
+func NewManager(recorder Recorder) *Manager {
+	return &Manager{
+		netState: netstate.New(),
+		sweeper:  sweep.New(),
+		recorder: recorder,
+	}
+}
+
+// SetNetworkAvailable records OS-reported network availability. While
+// unavailable, the reconnection loops suspend their attempts and the
+// connection listener reports NoNetwork instead of Connecting; when
+// availability returns, the loops resume immediately with a fresh backoff.
+// Losing the last network also sweeps the registered connections: nothing can
+// redial while offline, so the stale sockets would otherwise stay silently
+// "connected" until their own timeouts and the client would keep reporting
+// Connected with no network at all.
+//
+// Panics on a nil receiver: only the mobile bindings that own a Manager
+// report availability.
+func (m *Manager) SetNetworkAvailable(available bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if !available && m.netState.IsOnline() {
+		m.sweeper.MarkNetworkChange()
+	}
+	m.netState.Set(available)
+	m.recorder.SetNetworkAvailable(available)
+}
+
+// NotifyNetworkChange marks the management, signal and relay connections
+// stale after the OS switched networks and schedules a sweep that cuts
+// whatever has not redialed on the new network by then. The engine and the
+// TUN device stay untouched.
+//
+// Panics on a nil receiver: only the mobile bindings that own a Manager
+// report network changes.
+func (m *Manager) NotifyNetworkChange() {
+	m.sweeper.MarkNetworkChange()
+	log.Infof("network change: connections marked stale")
+}
+
+// IsOnline reports whether the OS reports at least one usable network.
+func (m *Manager) IsOnline() bool {
+	if m == nil {
+		return true
+	}
+	return m.netState.IsOnline()
+}
+
+// Changed returns a channel closed on the next availability transition.
+func (m *Manager) Changed() <-chan struct{} {
+	if m == nil {
+		return nil
+	}
+	return m.netState.Changed()
+}
+
+// Wait blocks while the network is offline; see netstate.State.Wait.
+func (m *Manager) Wait(ctx context.Context) (bool, error) {
+	if m == nil {
+		return false, nil
+	}
+	return m.netState.Wait(ctx)
+}
+
+// WaitSettled waits until an online verdict holds for a full settleWindow, or
+// while offline until the budget runs out. Returns false when ctx is
+// cancelled. The settle window exists because a disconnect often precedes the
+// OS offline flag by a few milliseconds, so a fresh online verdict cannot be
+// trusted immediately. A nil Manager has no events to watch: it degrades to a
+// fixed budget-long sleep.
+func (m *Manager) WaitSettled(ctx context.Context, budget, settleWindow time.Duration) bool {
+	if m == nil {
+		select {
+		case <-time.After(budget):
+			return true
+		case <-ctx.Done():
+			return false
+		}
+	}
+
+	budgetTimer := time.NewTimer(budget)
+	defer budgetTimer.Stop()
+
+	settle := time.NewTimer(settleWindow)
+	defer settle.Stop()
+
+	for {
+		// Channel first, flag second: a flip in between still fires the channel.
+		changedCh := m.netState.Changed()
+		if m.netState.IsOnline() {
+			select {
+			case <-settle.C:
+				return true
+			case <-changedCh:
+			case <-ctx.Done():
+				return false
+			}
+		} else {
+			select {
+			case <-budgetTimer.C:
+				return true
+			case <-changedCh:
+			case <-ctx.Done():
+				return false
+			}
+		}
+		if !settle.Stop() {
+			select {
+			case <-settle.C:
+			default:
+			}
+		}
+		settle.Reset(settleWindow)
+	}
+}
+
+// StartDial registers an in-flight dial with the sweeper; see sweep.Sweeper.StartDial.
+func (m *Manager) StartDial(ctx context.Context) *sweep.Dial {
+	if m == nil {
+		return (*sweep.Sweeper)(nil).StartDial(ctx)
+	}
+	return m.sweeper.StartDial(ctx)
+}
+
+// QuickRetryBackoff wraps bo for a quick retry after a network change; see
+// sweep.Sweeper.QuickRetryBackoff.
+func (m *Manager) QuickRetryBackoff(ctx context.Context, bo backoff.BackOff) backoff.BackOff {
+	if m == nil {
+		return bo
+	}
+	return m.sweeper.QuickRetryBackoff(ctx, bo, m.netState)
+}
diff --git a/client/netevents/netevents_test.go b/client/netevents/netevents_test.go
new file mode 100644
index 000000000..a62ddc270
--- /dev/null
+++ b/client/netevents/netevents_test.go
@@ -0,0 +1,34 @@
+package netevents
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type recorderStub struct{}
+
+func (recorderStub) SetNetworkAvailable(bool) {}
+
+func TestWaitSettledAfterOutage(t *testing.T) {
+	const budget = 1500 * time.Millisecond
+	const settleWindow = 200 * time.Millisecond
+	const outage = 2 * settleWindow
+
+	m := NewManager(recorderStub{})
+	m.SetNetworkAvailable(false)
+
+	start := time.Now()
+	go func() {
+		time.Sleep(outage)
+		m.SetNetworkAvailable(true)
+	}()
+
+	ok := m.WaitSettled(context.Background(), budget, settleWindow)
+	elapsed := time.Since(start)
+
+	assert.True(t, ok, "recovered network must let the caller proceed")
+	assert.GreaterOrEqual(t, elapsed, outage+settleWindow, "an online verdict must hold a full settle window before it is trusted")
+}
diff --git a/client/netevents/netstate/netstate.go b/client/netevents/netstate/netstate.go
new file mode 100644
index 000000000..0d7a1268b
--- /dev/null
+++ b/client/netevents/netstate/netstate.go
@@ -0,0 +1,110 @@
+// Package netstate tracks OS-reported network availability for the client.
+//
+// A State instance is owned by the platform integration (e.g. the Android or
+// iOS bindings, fed from ConnectivityManager callbacks or NWPathMonitor) and
+// is injected into the connection retry loops (management, signal, relay,
+// peer guards and the top-level connect loop), which consult it to avoid
+// burning CPU and battery on reconnect attempts while the device has no
+// network at all (e.g. airplane mode), and to reset their backoff as soon as
+// the network returns.
+//
+// Consumers hold a *State that may be nil — every non-mobile platform leaves
+// it unset. The read methods are safe on a nil receiver: they report online
+// and never block, so consumers behave as if this package did not exist.
+package netstate
+
+import (
+	"context"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// State holds the OS-reported network availability. The zero value is not
+// usable; create instances with New.
+type State struct {
+	mu      sync.Mutex
+	online  bool
+	changed chan struct{}
+}
+
+// New creates a State that starts online. Platforms without network tracking
+// pass a nil *State instead: the read methods treat nil as always online and
+// never block, so consumers need no nil guards.
+func New() *State {
+	return &State{
+		online:  true,
+		changed: make(chan struct{}),
+	}
+}
+
+// Set records whether the OS reports any usable network. Transitions wake up
+// all Wait callers immediately. Unlike the read methods, Set is not nil-safe:
+// it is only for the platform owner that created the State with New.
+func (s *State) Set(online bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.online == online {
+		return
+	}
+	s.online = online
+	close(s.changed)
+	s.changed = make(chan struct{})
+	log.Infof("OS network availability changed: online=%t", online)
+}
+
+// IsOnline reports whether the OS reports at least one usable network. On a
+// nil receiver — no State injected — it reports online.
+func (s *State) IsOnline() bool {
+	if s == nil {
+		return true
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.online
+}
+
+// Changed returns a channel closed on the next availability transition, for
+// callers that already own a select loop and cannot block in Wait. Re-read it
+// after every fire: each transition installs a fresh channel. On a nil
+// receiver — no State injected — it returns nil, which blocks forever in a
+// select, so the caller simply never observes a transition.
+func (s *State) Changed() <-chan struct{} {
+	if s == nil {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.changed
+}
+
+// Wait blocks while the network is offline. It reports whether it had to
+// wait, so callers can reset their backoff after an outage. It returns early
+// with the context error when ctx is done. On a nil receiver — no State
+// injected — it returns immediately.
+func (s *State) Wait(ctx context.Context) (bool, error) {
+	if s == nil {
+		return false, nil
+	}
+	waited := false
+	for {
+		s.mu.Lock()
+		if s.online {
+			s.mu.Unlock()
+			return waited, nil
+		}
+		ch := s.changed
+		s.mu.Unlock()
+
+		if !waited {
+			waited = true
+			log.Debugf("network is offline, pausing connection attempts")
+		}
+
+		select {
+		case <-ctx.Done():
+			return waited, ctx.Err()
+		case <-ch:
+		}
+	}
+}
diff --git a/client/netevents/netstate/netstate_test.go b/client/netevents/netstate/netstate_test.go
new file mode 100644
index 000000000..ea7015761
--- /dev/null
+++ b/client/netevents/netstate/netstate_test.go
@@ -0,0 +1,170 @@
+package netstate
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewStateIsOnline(t *testing.T) {
+	assert.True(t, New().IsOnline(), "a fresh State should start online")
+}
+
+func TestSetTogglesOnlineState(t *testing.T) {
+	s := New()
+
+	s.Set(false)
+	assert.False(t, s.IsOnline(), "state should be offline after Set(false)")
+
+	s.Set(true)
+	assert.True(t, s.IsOnline(), "state should be online after Set(true)")
+}
+
+func TestWaitReturnsImmediatelyWhenOnline(t *testing.T) {
+	s := New()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+
+	waited, err := s.Wait(ctx)
+	require.NoError(t, err)
+	assert.False(t, waited, "Wait should not block when the network is online")
+}
+
+func TestWaitBlocksUntilOnline(t *testing.T) {
+	s := New()
+	s.Set(false)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	result := make(chan bool, 1)
+	go func() {
+		waited, err := s.Wait(ctx)
+		if err != nil {
+			result <- false
+			return
+		}
+		result <- waited
+	}()
+
+	// Verify Wait is actually blocking while offline
+	select {
+	case <-result:
+		t.Fatal("Wait should block while the network is offline")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	s.Set(true)
+
+	select {
+	case waited := <-result:
+		assert.True(t, waited, "Wait should report that it had to wait for the network")
+	case <-time.After(2 * time.Second):
+		t.Fatal("Wait should return promptly after the network becomes available")
+	}
+}
+
+func TestWaitReturnsOnContextCancel(t *testing.T) {
+	s := New()
+	s.Set(false)
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	result := make(chan error, 1)
+	go func() {
+		_, err := s.Wait(ctx)
+		result <- err
+	}()
+
+	cancel()
+
+	select {
+	case err := <-result:
+		assert.ErrorIs(t, err, context.Canceled)
+	case <-time.After(2 * time.Second):
+		t.Fatal("Wait should return promptly after context cancellation")
+	}
+}
+
+func TestWaitWakesAllWaiters(t *testing.T) {
+	s := New()
+	s.Set(false)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	const waiters = 10
+	var wg sync.WaitGroup
+	results := make(chan bool, waiters)
+	for i := 0; i < waiters; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			waited, err := s.Wait(ctx)
+			if err != nil {
+				results <- false
+				return
+			}
+			results <- waited
+		}()
+	}
+
+	time.Sleep(100 * time.Millisecond)
+	s.Set(true)
+	wg.Wait()
+
+	close(results)
+	count := 0
+	for waited := range results {
+		assert.True(t, waited, "every waiter should report that it waited")
+		count++
+	}
+	assert.Equal(t, waiters, count, "all waiters should have returned")
+}
+
+func TestNilStateReadsAreNoops(t *testing.T) {
+	var s *State
+
+	assert.True(t, s.IsOnline(), "nil State should report online")
+
+	waited, err := s.Wait(context.Background())
+	require.NoError(t, err)
+	assert.False(t, waited, "nil State's Wait should not block")
+}
+
+func TestConcurrentSetAndWait(t *testing.T) {
+	s := New()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var wg sync.WaitGroup
+	for i := 0; i < 4; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for j := 0; j < 100; j++ {
+				s.Set(j%2 == 0)
+				s.IsOnline()
+			}
+		}()
+	}
+	for i := 0; i < 4; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for j := 0; j < 100; j++ {
+				if _, err := s.Wait(ctx); err != nil {
+					return
+				}
+			}
+		}()
+	}
+
+	wg.Wait()
+}
diff --git a/client/netevents/sweep/quick_retry.go b/client/netevents/sweep/quick_retry.go
new file mode 100644
index 000000000..1e174b20a
--- /dev/null
+++ b/client/netevents/sweep/quick_retry.go
@@ -0,0 +1,39 @@
+package sweep
+
+import (
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+
+	"github.com/netbirdio/netbird/client/netevents/netstate"
+)
+
+const quickRetryDelay = 200 * time.Millisecond
+
+type quickRetryBackoff struct {
+	backoff.BackOff
+	sweeper  *Sweeper
+	netState *netstate.State
+	used     bool
+}
+
+func newQuickRetryBackoff(bo backoff.BackOff, sweeper *Sweeper, netState *netstate.State) *quickRetryBackoff {
+	return &quickRetryBackoff{
+		BackOff:  bo,
+		sweeper:  sweeper,
+		netState: netState,
+	}
+}
+
+func (b *quickRetryBackoff) NextBackOff() time.Duration {
+	if !b.used && b.sweeper.markedRecently() && b.netState.IsOnline() {
+		b.used = true
+		return quickRetryDelay
+	}
+	return b.BackOff.NextBackOff()
+}
+
+func (b *quickRetryBackoff) Reset() {
+	b.used = false
+	b.BackOff.Reset()
+}
diff --git a/client/netevents/sweep/quick_retry_test.go b/client/netevents/sweep/quick_retry_test.go
new file mode 100644
index 000000000..3dadd951c
--- /dev/null
+++ b/client/netevents/sweep/quick_retry_test.go
@@ -0,0 +1,58 @@
+package sweep
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestQuickRetryAfterRecentMark(t *testing.T) {
+	sweeper := New()
+	sweeper.MarkNetworkChange()
+
+	slow := backoff.NewConstantBackOff(5 * time.Second)
+	bo := sweeper.QuickRetryBackoff(context.Background(), slow, nil)
+
+	assert.Equal(t, quickRetryDelay, bo.NextBackOff(), "first retry after a mark must be quick")
+	assert.Equal(t, 5*time.Second, bo.NextBackOff(), "second retry must fall back to the wrapped backoff")
+
+	bo.Reset()
+	assert.Equal(t, quickRetryDelay, bo.NextBackOff(), "reset must re-arm the quick retry")
+}
+
+func TestQuickRetryWithoutMarkKeepsSpread(t *testing.T) {
+	sweeper := New()
+
+	slow := backoff.NewConstantBackOff(5 * time.Second)
+	bo := sweeper.QuickRetryBackoff(context.Background(), slow, nil)
+
+	assert.Equal(t, 5*time.Second, bo.NextBackOff(), "without a mark the wrapped backoff decides")
+
+	sweeper.mu.Lock()
+	sweeper.lastMark = time.Now().Add(-recentMarkWindow)
+	sweeper.mu.Unlock()
+	assert.Equal(t, 5*time.Second, bo.NextBackOff(), "a stale mark must not trigger the quick retry")
+}
+
+func TestQuickRetryNilSweeperPassthrough(t *testing.T) {
+	var sweeper *Sweeper
+
+	slow := backoff.NewConstantBackOff(5 * time.Second)
+	bo := sweeper.QuickRetryBackoff(context.Background(), slow, nil)
+
+	assert.Equal(t, backoff.BackOff(slow), bo, "nil sweeper must return the backoff unchanged")
+}
+
+func TestQuickRetryHonorsContext(t *testing.T) {
+	sweeper := New()
+	sweeper.MarkNetworkChange()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	bo := sweeper.QuickRetryBackoff(ctx, backoff.NewConstantBackOff(time.Millisecond), nil)
+
+	assert.Equal(t, backoff.Stop, bo.NextBackOff(), "cancelled context must stop the retry loop")
+}
diff --git a/client/netevents/sweep/sweep.go b/client/netevents/sweep/sweep.go
new file mode 100644
index 000000000..52dce92be
--- /dev/null
+++ b/client/netevents/sweep/sweep.go
@@ -0,0 +1,267 @@
+// Package sweep cuts network-bound activity when the OS switches networks:
+// a sweep closes the registered connections and aborts the in-flight dials, so
+// their owners redial immediately instead of waiting for the old sockets to
+// time out.
+//
+// A nil *Sweeper disables everything: all methods are nil-safe no-ops.
+package sweep
+
+import (
+	"context"
+	"errors"
+	"net"
+	"sync"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/netevents/netstate"
+)
+
+// DefaultSweepDelay absorbs network flapping while the OS settles on a
+// default network before the stale registrations are cut.
+const DefaultSweepDelay = 500 * time.Millisecond
+
+const recentMarkWindow = 3 * time.Second
+
+// Config customizes a Sweeper. The zero value applies the defaults.
+type Config struct {
+	// SweepDelay overrides DefaultSweepDelay when positive.
+	SweepDelay time.Duration
+}
+
+// ErrSwept reports that a dial finished after a network change swept its
+// registration. The connection is already closed; the caller must treat it
+// as a failed dial and redial on the new network.
+var ErrSwept = errors.New("sweep: connection swept by network change")
+
+// sweepID identifies one registration in a sweeper. Connections and dials
+// draw from the same counter, so an id is unique across both registries.
+type sweepID uint64
+
+type connEntry struct {
+	conn net.Conn
+	gen  uint64
+}
+
+// Dial tracks one dial from start to connection registration. It hands the
+// dialed connection to the sweeper atomically, so a sweep can never fall
+// between the dial finishing and the connection being registered.
+type Dial struct {
+	sweeper *Sweeper
+	ctx     context.Context
+	cancel  context.CancelFunc
+	id      sweepID
+	done    bool // set by a sweep, WrapConn or Release; guarded by sweeper.mu
+	gen     uint64
+}
+
+// Ctx returns the dial's context. A sweep cancels it, so a dial started on the
+// old network aborts instead of waiting out its handshake timeout.
+func (d *Dial) Ctx() context.Context {
+	return d.ctx
+}
+
+// Release ends the dial's registration and cancels its context. It is
+// idempotent and safe after WrapConn, so callers can defer it.
+func (d *Dial) Release() {
+	s := d.sweeper
+	if s == nil {
+		return
+	}
+
+	s.mu.Lock()
+	d.done = true
+	delete(s.dials, d.id)
+	s.mu.Unlock()
+
+	d.cancel()
+}
+
+// sweptConn deregisters itself from the sweeper when closed.
+type sweptConn struct {
+	net.Conn
+	sweeper *Sweeper
+	id      sweepID
+}
+
+func (c *sweptConn) Close() error {
+	c.sweeper.deregister(c.id)
+	return c.Conn.Close()
+}
+
+// Sweeper registers live connections and in-flight dials so the
+// network-change sweep can cut everything registered before the change.
+type Sweeper struct {
+	mu         sync.Mutex
+	conns      map[sweepID]connEntry
+	dials      map[sweepID]*Dial
+	nextID     sweepID
+	gen        uint64
+	timer      *time.Timer
+	sweepDelay time.Duration
+	lastMark   time.Time
+}
+
+// New creates an empty sweeper with the default configuration.
+func New() *Sweeper {
+	return NewWithConfig(Config{})
+}
+
+// NewWithConfig creates an empty sweeper customized by cfg.
+func NewWithConfig(cfg Config) *Sweeper {
+	delay := cfg.SweepDelay
+	if delay <= 0 {
+		delay = DefaultSweepDelay
+	}
+	return &Sweeper{
+		conns:      make(map[sweepID]connEntry),
+		dials:      make(map[sweepID]*Dial),
+		sweepDelay: delay,
+	}
+}
+
+// StartDial registers an in-flight dial. Dial with Ctx, hand the result to
+// WrapConn, and Release the dial when the attempt is over, typically deferred.
+func (s *Sweeper) StartDial(ctx context.Context) *Dial {
+	if s == nil {
+		return &Dial{ctx: ctx}
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	d := &Dial{sweeper: s, ctx: ctx, cancel: cancel}
+
+	s.mu.Lock()
+	d.id = s.nextID
+	s.nextID++
+	d.gen = s.gen
+	s.dials[d.id] = d
+	s.mu.Unlock()
+
+	return d
+}
+
+// WrapConn hands conn over to the sweeper. If a sweep ran since StartDial,
+// the connection belongs to the old network: it is closed and ErrSwept is
+// returned. Otherwise conn is registered against the next sweep and returned
+// wrapped, deregistering itself on Close. Call it once, before Release.
+func (d *Dial) WrapConn(conn net.Conn) (net.Conn, error) {
+	s := d.sweeper
+	if s == nil {
+		return conn, nil
+	}
+
+	s.mu.Lock()
+	if d.done {
+		s.mu.Unlock()
+		if err := conn.Close(); err != nil {
+			log.Debugf("swept dial close error: %v", err)
+		}
+		return nil, ErrSwept
+	}
+	d.done = true
+	delete(s.dials, d.id)
+	id := s.nextID
+	s.nextID++
+	// The conn inherits the dial's generation: the socket was bound to the
+	// network that was default when the dial started, not when it finished.
+	s.conns[id] = connEntry{conn: conn, gen: d.gen}
+	s.mu.Unlock()
+
+	return &sweptConn{Conn: conn, sweeper: s, id: id}, nil
+}
+
+// MarkNetworkChange records that the OS switched networks: everything
+// registered so far becomes stale, and a sweep is (re)scheduled after the
+// configured delay to cut whatever is still stale by then. Owners that
+// redialed in the meantime hold fresh-generation registrations and survive,
+// so no cancellation is needed around the sweep.
+func (s *Sweeper) MarkNetworkChange() {
+	if s == nil {
+		return
+	}
+
+	s.mu.Lock()
+	s.gen++
+	cutoff := s.gen
+	s.lastMark = time.Now()
+	if s.timer != nil {
+		s.timer.Stop()
+	}
+	s.timer = time.AfterFunc(s.sweepDelay, func() {
+		n := s.sweep(cutoff)
+		log.Infof("network change sweep: closed %d stale connections", n)
+	})
+	s.mu.Unlock()
+}
+
+// QuickRetryBackoff wraps bo so that after each Reset the first retry comes
+// quickly when the disconnect followed a recent network change and the
+// network is online. Any other failure keeps bo's spread, so the clients of
+// a restarted server still scatter their reconnects. A nil sweeper returns
+// bo unchanged.
+func (s *Sweeper) QuickRetryBackoff(ctx context.Context, bo backoff.BackOff, netState *netstate.State) backoff.BackOff {
+	if s == nil {
+		return bo
+	}
+	return backoff.WithContext(newQuickRetryBackoff(bo, s, netState), ctx)
+}
+
+func (s *Sweeper) markedRecently() bool {
+	if s == nil {
+		return false
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return !s.lastMark.IsZero() && time.Since(s.lastMark) < recentMarkWindow
+}
+
+// sweep closes the registered connections and aborts the in-flight dials
+// older than cutoff, and returns how many connections it closed. A dial
+// whose connection was not yet handed to WrapConn is marked, so the late
+// WrapConn closes it instead of registering it.
+func (s *Sweeper) sweep(cutoff uint64) int {
+	if s == nil {
+		return 0
+	}
+
+	s.mu.Lock()
+	var conns []net.Conn
+	for id, e := range s.conns {
+		if e.gen < cutoff {
+			delete(s.conns, id)
+			conns = append(conns, e.conn)
+		}
+	}
+	var dials []*Dial
+	for id, d := range s.dials {
+		if d.gen < cutoff {
+			d.done = true
+			delete(s.dials, id)
+			dials = append(dials, d)
+		}
+	}
+	s.mu.Unlock()
+
+	if len(dials) > 0 {
+		log.Debugf("aborting %d in-flight dials", len(dials))
+		for _, d := range dials {
+			d.cancel()
+		}
+	}
+
+	for _, conn := range conns {
+		log.Debugf("sweeping connection %s -> %s", conn.LocalAddr(), conn.RemoteAddr())
+		if err := conn.Close(); err != nil {
+			log.Debugf("swept connection close error: %v", err)
+		}
+	}
+	return len(conns)
+}
+
+func (s *Sweeper) deregister(id sweepID) {
+	s.mu.Lock()
+	delete(s.conns, id)
+	s.mu.Unlock()
+}
diff --git a/client/netevents/sweep/sweep_test.go b/client/netevents/sweep/sweep_test.go
new file mode 100644
index 000000000..c162d4c0f
--- /dev/null
+++ b/client/netevents/sweep/sweep_test.go
@@ -0,0 +1,241 @@
+package sweep
+
+import (
+	"context"
+	"math"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSweepClosesRegisteredConns(t *testing.T) {
+	sweeper := New()
+
+	c1 := wrap(t, sweeper, connPair(t))
+	c2 := wrap(t, sweeper, connPair(t))
+
+	assert.Equal(t, 2, sweeper.sweepAll(), "both live connections should be closed")
+
+	// The wrappers must report closed now.
+	buf := make([]byte, 1)
+	_, err := c1.Read(buf)
+	assert.Error(t, err, "first connection should be unusable after the sweep")
+	_, err = c2.Read(buf)
+	assert.Error(t, err, "second connection should be unusable after the sweep")
+
+	assert.Equal(t, 0, sweeper.sweepAll(), "second sweep should find nothing")
+}
+
+func TestCloseDeregisters(t *testing.T) {
+	sweeper := New()
+
+	conn := wrap(t, sweeper, connPair(t))
+	require.NoError(t, conn.Close())
+
+	assert.Equal(t, 0, sweeper.sweepAll(), "closed connection must leave the registry")
+}
+
+func TestCloseIsIdempotent(t *testing.T) {
+	sweeper := New()
+
+	conn := wrap(t, sweeper, connPair(t))
+	require.NoError(t, conn.Close())
+	assert.Error(t, conn.Close(), "double close surfaces the underlying error but must not panic")
+}
+
+func TestSweepOnlyAffectsOlderConns(t *testing.T) {
+	sweeper := New()
+
+	_ = wrap(t, sweeper, connPair(t))
+	assert.Equal(t, 1, sweeper.sweepAll())
+
+	// A connection dialed after the sweep must survive until the next one.
+	_ = wrap(t, sweeper, connPair(t))
+	assert.Equal(t, 1, sweeper.sweepAll(), "post-sweep connection belongs to the next sweep")
+}
+
+func TestSweepAbortsInFlightDials(t *testing.T) {
+	sweeper := New()
+
+	dial := sweeper.StartDial(context.Background())
+	defer dial.Release()
+
+	sweeper.sweepAll()
+
+	assert.ErrorIs(t, dial.Ctx().Err(), context.Canceled, "sweep must cancel the in-flight dial context")
+}
+
+func TestReleasedDialIsNotAborted(t *testing.T) {
+	sweeper := New()
+
+	// Simulate a dial that finished before the sweep.
+	released := sweeper.StartDial(context.Background())
+	released.Release()
+
+	// A dial still in flight during the sweep.
+	pending := sweeper.StartDial(context.Background())
+	defer pending.Release()
+
+	sweeper.sweepAll()
+	assert.ErrorIs(t, pending.Ctx().Err(), context.Canceled, "pending dial must be aborted")
+}
+
+func TestSweepBetweenDialAndHandoffClosesConn(t *testing.T) {
+	sweeper := New()
+
+	dial := sweeper.StartDial(context.Background())
+	defer dial.Release()
+
+	// The dial succeeds on the old network, then the sweep lands before the
+	// connection is handed over.
+	conn := connPair(t)
+	assert.Equal(t, 0, sweeper.sweepAll(), "the connection is not registered yet")
+
+	wrapped, err := dial.WrapConn(conn)
+	require.ErrorIs(t, err, ErrSwept)
+	require.Nil(t, wrapped)
+
+	buf := make([]byte, 1)
+	_, err = conn.Read(buf)
+	assert.Error(t, err, "the old-network connection must be closed, not leaked")
+
+	assert.Equal(t, 0, sweeper.sweepAll(), "nothing may leak into the next sweep")
+}
+
+func TestMarkNetworkChangeSparesFreshConns(t *testing.T) {
+	sweeper := NewWithConfig(Config{SweepDelay: 10 * time.Millisecond})
+
+	stale := wrap(t, sweeper, connPair(t))
+	sweeper.MarkNetworkChange()
+	_ = wrap(t, sweeper, connPair(t))
+
+	_ = stale.SetReadDeadline(time.Now().Add(time.Second))
+	buf := make([]byte, 1)
+	_, err := stale.Read(buf)
+	require.ErrorIs(t, err, net.ErrClosed, "stale connection must be closed by the delayed sweep")
+
+	assert.Equal(t, 1, sweeper.sweepAll(), "the fresh connection must survive the stale sweep")
+}
+
+func TestMarkNetworkChangeAbortsStaleDials(t *testing.T) {
+	sweeper := NewWithConfig(Config{SweepDelay: 10 * time.Millisecond})
+
+	stale := sweeper.StartDial(context.Background())
+	defer stale.Release()
+	sweeper.MarkNetworkChange()
+	fresh := sweeper.StartDial(context.Background())
+	defer fresh.Release()
+
+	assert.Eventually(t, func() bool {
+		return stale.Ctx().Err() != nil
+	}, time.Second, 5*time.Millisecond, "stale dial must be aborted by the delayed sweep")
+	assert.NoError(t, fresh.Ctx().Err(), "post-mark dial must not be aborted")
+}
+
+func TestConnInheritsDialGeneration(t *testing.T) {
+	sweeper := NewWithConfig(Config{SweepDelay: 20 * time.Millisecond})
+
+	// The dial starts before the network change but completes after it: the
+	// socket is bound to the old network, so the sweep must still cut it.
+	dial := sweeper.StartDial(context.Background())
+	defer dial.Release()
+	sweeper.MarkNetworkChange()
+
+	wrapped, err := dial.WrapConn(connPair(t))
+	require.NoError(t, err)
+
+	_ = wrapped.SetReadDeadline(time.Now().Add(time.Second))
+	buf := make([]byte, 1)
+	_, err = wrapped.Read(buf)
+	require.ErrorIs(t, err, net.ErrClosed, "old-generation connection must be swept")
+}
+
+func TestRepeatedMarksCoalesce(t *testing.T) {
+	sweeper := NewWithConfig(Config{SweepDelay: 20 * time.Millisecond})
+
+	first := wrap(t, sweeper, connPair(t))
+	sweeper.MarkNetworkChange()
+	second := wrap(t, sweeper, connPair(t))
+	sweeper.MarkNetworkChange()
+	_ = wrap(t, sweeper, connPair(t))
+
+	buf := make([]byte, 1)
+	for _, conn := range []net.Conn{first, second} {
+		_ = conn.SetReadDeadline(time.Now().Add(time.Second))
+		_, err := conn.Read(buf)
+		require.ErrorIs(t, err, net.ErrClosed, "every pre-mark connection must be swept by the rescheduled sweep")
+	}
+	assert.Equal(t, 1, sweeper.sweepAll(), "only the newest-generation connection may remain")
+}
+
+func TestNilSweeperIsNoop(t *testing.T) {
+	var sweeper *Sweeper
+
+	conn := connPair(t)
+	dial := sweeper.StartDial(context.Background())
+	defer dial.Release()
+
+	wrapped, err := dial.WrapConn(conn)
+	require.NoError(t, err)
+	assert.Equal(t, conn, wrapped, "nil sweeper must return the conn unchanged")
+	assert.NoError(t, dial.Ctx().Err(), "nil sweeper must not cancel the dial context")
+	assert.Equal(t, 0, sweeper.sweepAll(), "nil sweeper closes nothing")
+}
+
+// wrap registers conn with the sweeper through a completed dial.
+func wrap(t *testing.T, sweeper *Sweeper, conn net.Conn) net.Conn {
+	t.Helper()
+
+	dial := sweeper.StartDial(context.Background())
+	defer dial.Release()
+
+	wrapped, err := dial.WrapConn(conn)
+	require.NoError(t, err)
+	return wrapped
+}
+
+// connPair dials a loopback TCP connection and keeps the accepted peer open
+// until the test ends: a peer that closed early would make the connection
+// unreadable on its own, so a read error after the sweep would prove nothing.
+func connPair(t *testing.T) net.Conn {
+	t.Helper()
+
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		if err := l.Close(); err != nil {
+			t.Logf("listener close error: %v", err)
+		}
+	})
+
+	accepted := make(chan net.Conn, 1)
+	go func() {
+		conn, err := l.Accept()
+		if err != nil {
+			close(accepted)
+			return
+		}
+		accepted <- conn
+	}()
+
+	conn, err := net.Dial("tcp", l.Addr().String())
+	require.NoError(t, err)
+
+	peer, ok := <-accepted
+	require.True(t, ok, "listener must accept the dialed connection")
+	t.Cleanup(func() {
+		if err := peer.Close(); err != nil {
+			t.Logf("peer close error: %v", err)
+		}
+	})
+
+	return conn
+}
+
+// sweepAll cuts every registration regardless of generation.
+func (s *Sweeper) sweepAll() int {
+	return s.sweep(math.MaxUint64)
+}
diff --git a/client/proto/daemon.pb.go b/client/proto/daemon.pb.go
index 488b0186c..ec0cd6258 100644
--- a/client/proto/daemon.pb.go
+++ b/client/proto/daemon.pb.go
@@ -192,7 +192,7 @@ func (x SystemEvent_Severity) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use SystemEvent_Severity.Descriptor instead.
 func (SystemEvent_Severity) EnumDescriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{51, 0}
+	return file_daemon_proto_rawDescGZIP(), []int{53, 0}
 }
 
 type SystemEvent_Category int32
@@ -247,7 +247,7 @@ func (x SystemEvent_Category) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use SystemEvent_Category.Descriptor instead.
 func (SystemEvent_Category) EnumDescriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{51, 1}
+	return file_daemon_proto_rawDescGZIP(), []int{53, 1}
 }
 
 type EmptyRequest struct {
@@ -343,8 +343,13 @@ type LoginRequest struct {
 	DisableSSHAuth                *bool   `protobuf:"varint,38,opt,name=disableSSHAuth,proto3,oneof" json:"disableSSHAuth,omitempty"`
 	SshJWTCacheTTL                *int32  `protobuf:"varint,39,opt,name=sshJWTCacheTTL,proto3,oneof" json:"sshJWTCacheTTL,omitempty"`
 	DisableIpv6                   *bool   `protobuf:"varint,40,opt,name=disable_ipv6,json=disableIpv6,proto3,oneof" json:"disable_ipv6,omitempty"`
-	unknownFields                 protoimpl.UnknownFields
-	sizeCache                     protoimpl.SizeCache
+	EnableLocalMetrics            *bool   `protobuf:"varint,41,opt,name=enable_local_metrics,json=enableLocalMetrics,proto3,oneof" json:"enable_local_metrics,omitempty"`
+	LocalMetricsAddress           *string `protobuf:"bytes,42,opt,name=local_metrics_address,json=localMetricsAddress,proto3,oneof" json:"local_metrics_address,omitempty"`
+	// remoteJobsAllowed opts the peer into management-requested remote jobs
+	// (e.g. debug bundles). Absent leaves the stored value unchanged.
+	RemoteJobsAllowed *bool `protobuf:"varint,43,opt,name=remoteJobsAllowed,proto3,oneof" json:"remoteJobsAllowed,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *LoginRequest) Reset() {
@@ -658,6 +663,27 @@ func (x *LoginRequest) GetDisableIpv6() bool {
 	return false
 }
 
+func (x *LoginRequest) GetEnableLocalMetrics() bool {
+	if x != nil && x.EnableLocalMetrics != nil {
+		return *x.EnableLocalMetrics
+	}
+	return false
+}
+
+func (x *LoginRequest) GetLocalMetricsAddress() string {
+	if x != nil && x.LocalMetricsAddress != nil {
+		return *x.LocalMetricsAddress
+	}
+	return ""
+}
+
+func (x *LoginRequest) GetRemoteJobsAllowed() bool {
+	if x != nil && x.RemoteJobsAllowed != nil {
+		return *x.RemoteJobsAllowed
+	}
+	return false
+}
+
 type LoginResponse struct {
 	state                   protoimpl.MessageState `protogen:"open.v1"`
 	NeedsSSOLogin           bool                   `protobuf:"varint,1,opt,name=needsSSOLogin,proto3" json:"needsSSOLogin,omitempty"`
@@ -823,9 +849,15 @@ func (x *WaitSSOLoginResponse) GetEmail() string {
 }
 
 type UpRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	ProfileName   *string                `protobuf:"bytes,1,opt,name=profileName,proto3,oneof" json:"profileName,omitempty"`
-	Username      *string                `protobuf:"bytes,2,opt,name=username,proto3,oneof" json:"username,omitempty"`
+	state       protoimpl.MessageState `protogen:"open.v1"`
+	ProfileName *string                `protobuf:"bytes,1,opt,name=profileName,proto3,oneof" json:"profileName,omitempty"`
+	Username    *string                `protobuf:"bytes,2,opt,name=username,proto3,oneof" json:"username,omitempty"`
+	// async instructs the daemon to start the connection attempt and return
+	// immediately without waiting for the engine to become ready. Status updates
+	// are delivered via the SubscribeStatus stream. When false (the default) the
+	// RPC blocks until the engine is running or gives up, which is the behaviour
+	// needed by the CLI.
+	Async         bool `protobuf:"varint,4,opt,name=async,proto3" json:"async,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -874,6 +906,13 @@ func (x *UpRequest) GetUsername() string {
 	return ""
 }
 
+func (x *UpRequest) GetAsync() bool {
+	if x != nil {
+		return x.Async
+	}
+	return false
+}
+
 type UpResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -978,8 +1017,12 @@ type StatusResponse struct {
 	FullStatus *FullStatus `protobuf:"bytes,2,opt,name=fullStatus,proto3" json:"fullStatus,omitempty"`
 	// NetBird daemon version
 	DaemonVersion string `protobuf:"bytes,3,opt,name=daemonVersion,proto3" json:"daemonVersion,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	// Absolute UTC instant at which the peer's SSO session expires.
+	// Unset when the peer is not SSO-registered or login expiration is disabled.
+	// The UI derives "warning active" from this value and its own clock.
+	SessionExpiresAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=sessionExpiresAt,proto3" json:"sessionExpiresAt,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *StatusResponse) Reset() {
@@ -1033,6 +1076,13 @@ func (x *StatusResponse) GetDaemonVersion() string {
 	return ""
 }
 
+func (x *StatusResponse) GetSessionExpiresAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.SessionExpiresAt
+	}
+	return nil
+}
+
 type DownRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -1191,6 +1241,7 @@ type GetConfigResponse struct {
 	DisableSSHAuth                bool   `protobuf:"varint,25,opt,name=disableSSHAuth,proto3" json:"disableSSHAuth,omitempty"`
 	SshJWTCacheTTL                int32  `protobuf:"varint,26,opt,name=sshJWTCacheTTL,proto3" json:"sshJWTCacheTTL,omitempty"`
 	DisableIpv6                   bool   `protobuf:"varint,27,opt,name=disable_ipv6,json=disableIpv6,proto3" json:"disable_ipv6,omitempty"`
+	RemoteJobsAllowed             bool   `protobuf:"varint,29,opt,name=remoteJobsAllowed,proto3" json:"remoteJobsAllowed,omitempty"`
 	// mDMManagedFields lists the names of configuration keys whose value is
 	// currently enforced by an MDM policy. Names match mdm.Key* constants
 	// (e.g. "managementURL", "disableClientRoutes"). UI/CLI clients should
@@ -1420,6 +1471,13 @@ func (x *GetConfigResponse) GetDisableIpv6() bool {
 	return false
 }
 
+func (x *GetConfigResponse) GetRemoteJobsAllowed() bool {
+	if x != nil {
+		return x.RemoteJobsAllowed
+	}
+	return false
+}
+
 func (x *GetConfigResponse) GetMDMManagedFields() []string {
 	if x != nil {
 		return x.MDMManagedFields
@@ -2118,19 +2176,27 @@ func (x *SSHServerState) GetSessions() []*SSHSessionInfo {
 
 // FullStatus contains the full state held by the Status instance
 type FullStatus struct {
-	state                   protoimpl.MessageState `protogen:"open.v1"`
-	ManagementState         *ManagementState       `protobuf:"bytes,1,opt,name=managementState,proto3" json:"managementState,omitempty"`
-	SignalState             *SignalState           `protobuf:"bytes,2,opt,name=signalState,proto3" json:"signalState,omitempty"`
-	LocalPeerState          *LocalPeerState        `protobuf:"bytes,3,opt,name=localPeerState,proto3" json:"localPeerState,omitempty"`
-	Peers                   []*PeerState           `protobuf:"bytes,4,rep,name=peers,proto3" json:"peers,omitempty"`
-	Relays                  []*RelayState          `protobuf:"bytes,5,rep,name=relays,proto3" json:"relays,omitempty"`
-	DnsServers              []*NSGroupState        `protobuf:"bytes,6,rep,name=dns_servers,json=dnsServers,proto3" json:"dns_servers,omitempty"`
-	NumberOfForwardingRules int32                  `protobuf:"varint,8,opt,name=NumberOfForwardingRules,proto3" json:"NumberOfForwardingRules,omitempty"`
-	Events                  []*SystemEvent         `protobuf:"bytes,7,rep,name=events,proto3" json:"events,omitempty"`
-	LazyConnectionEnabled   bool                   `protobuf:"varint,9,opt,name=lazyConnectionEnabled,proto3" json:"lazyConnectionEnabled,omitempty"`
-	SshServerState          *SSHServerState        `protobuf:"bytes,10,opt,name=sshServerState,proto3" json:"sshServerState,omitempty"`
-	unknownFields           protoimpl.UnknownFields
-	sizeCache               protoimpl.SizeCache
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	ManagementState *ManagementState       `protobuf:"bytes,1,opt,name=managementState,proto3" json:"managementState,omitempty"`
+	SignalState     *SignalState           `protobuf:"bytes,2,opt,name=signalState,proto3" json:"signalState,omitempty"`
+	LocalPeerState  *LocalPeerState        `protobuf:"bytes,3,opt,name=localPeerState,proto3" json:"localPeerState,omitempty"`
+	Peers           []*PeerState           `protobuf:"bytes,4,rep,name=peers,proto3" json:"peers,omitempty"`
+	Relays          []*RelayState          `protobuf:"bytes,5,rep,name=relays,proto3" json:"relays,omitempty"`
+	DnsServers      []*NSGroupState        `protobuf:"bytes,6,rep,name=dns_servers,json=dnsServers,proto3" json:"dns_servers,omitempty"`
+	// Unused; the ingress port-forwarding feature was discontinued.
+	//
+	// Deprecated: Marked as deprecated in daemon.proto.
+	NumberOfForwardingRules int32           `protobuf:"varint,8,opt,name=NumberOfForwardingRules,proto3" json:"NumberOfForwardingRules,omitempty"`
+	Events                  []*SystemEvent  `protobuf:"bytes,7,rep,name=events,proto3" json:"events,omitempty"`
+	LazyConnectionEnabled   bool            `protobuf:"varint,9,opt,name=lazyConnectionEnabled,proto3" json:"lazyConnectionEnabled,omitempty"`
+	SshServerState          *SSHServerState `protobuf:"bytes,10,opt,name=sshServerState,proto3" json:"sshServerState,omitempty"`
+	// networksRevision bumps whenever the set of routed networks (route and
+	// exit-node candidates) or their selected state changes. The UI fingerprints
+	// on it to know when to re-fetch ListNetworks via the push stream, instead
+	// of polling on every status snapshot.
+	NetworksRevision uint64 `protobuf:"varint,11,opt,name=networksRevision,proto3" json:"networksRevision,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *FullStatus) Reset() {
@@ -2205,6 +2271,7 @@ func (x *FullStatus) GetDnsServers() []*NSGroupState {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in daemon.proto.
 func (x *FullStatus) GetNumberOfForwardingRules() int32 {
 	if x != nil {
 		return x.NumberOfForwardingRules
@@ -2233,6 +2300,13 @@ func (x *FullStatus) GetSshServerState() *SSHServerState {
 	return nil
 }
 
+func (x *FullStatus) GetNetworksRevision() uint64 {
+	if x != nil {
+		return x.NetworksRevision
+	}
+	return 0
+}
+
 // Networks
 type ListNetworksRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -2530,7 +2604,10 @@ func (x *Network) GetResolvedIPs() map[string]*IPList {
 	return nil
 }
 
-// ForwardingRules
+// PortInfo, ForwardingRule and ForwardingRulesResponse are unused; the ingress
+// port-forwarding feature was discontinued.
+//
+// Deprecated: Marked as deprecated in daemon.proto.
 type PortInfo struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Types that are valid to be assigned to PortSelection:
@@ -2613,6 +2690,7 @@ func (*PortInfo_Port) isPortInfo_PortSelection() {}
 
 func (*PortInfo_Range_) isPortInfo_PortSelection() {}
 
+// Deprecated: Marked as deprecated in daemon.proto.
 type ForwardingRule struct {
 	state              protoimpl.MessageState `protogen:"open.v1"`
 	Protocol           string                 `protobuf:"bytes,1,opt,name=protocol,proto3" json:"protocol,omitempty"`
@@ -2689,6 +2767,7 @@ func (x *ForwardingRule) GetTranslatedPort() *PortInfo {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in daemon.proto.
 type ForwardingRulesResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Rules         []*ForwardingRule      `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
@@ -2735,14 +2814,23 @@ func (x *ForwardingRulesResponse) GetRules() []*ForwardingRule {
 
 // DebugBundler
 type DebugBundleRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Anonymize     bool                   `protobuf:"varint,1,opt,name=anonymize,proto3" json:"anonymize,omitempty"`
-	SystemInfo    bool                   `protobuf:"varint,3,opt,name=systemInfo,proto3" json:"systemInfo,omitempty"`
-	UploadURL     string                 `protobuf:"bytes,4,opt,name=uploadURL,proto3" json:"uploadURL,omitempty"`
-	LogFileCount  uint32                 `protobuf:"varint,5,opt,name=logFileCount,proto3" json:"logFileCount,omitempty"`
-	CliVersion    string                 `protobuf:"bytes,6,opt,name=cliVersion,proto3" json:"cliVersion,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state        protoimpl.MessageState `protogen:"open.v1"`
+	Anonymize    bool                   `protobuf:"varint,1,opt,name=anonymize,proto3" json:"anonymize,omitempty"`
+	SystemInfo   bool                   `protobuf:"varint,3,opt,name=systemInfo,proto3" json:"systemInfo,omitempty"`
+	UploadURL    string                 `protobuf:"bytes,4,opt,name=uploadURL,proto3" json:"uploadURL,omitempty"`
+	LogFileCount uint32                 `protobuf:"varint,5,opt,name=logFileCount,proto3" json:"logFileCount,omitempty"`
+	CliVersion   string                 `protobuf:"bytes,6,opt,name=cliVersion,proto3" json:"cliVersion,omitempty"`
+	// uploadInsecure allows uploading to an http endpoint or one with an
+	// untrusted TLS certificate. Restricted to privileged callers; for
+	// self-hosted upload servers.
+	UploadInsecure bool `protobuf:"varint,7,opt,name=uploadInsecure,proto3" json:"uploadInsecure,omitempty"`
+	// anonymizeLevel selects how much the anonymizer redacts: "default"
+	// (or empty) keeps internal IP ranges, "strict" also anonymizes them.
+	// Unknown values are treated as "strict". Only meaningful with anonymize;
+	// "strict" implies it.
+	AnonymizeLevel string `protobuf:"bytes,8,opt,name=anonymizeLevel,proto3" json:"anonymizeLevel,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *DebugBundleRequest) Reset() {
@@ -2810,6 +2898,20 @@ func (x *DebugBundleRequest) GetCliVersion() string {
 	return ""
 }
 
+func (x *DebugBundleRequest) GetUploadInsecure() bool {
+	if x != nil {
+		return x.UploadInsecure
+	}
+	return false
+}
+
+func (x *DebugBundleRequest) GetAnonymizeLevel() string {
+	if x != nil {
+		return x.AnonymizeLevel
+	}
+	return ""
+}
+
 type DebugBundleResponse struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`
 	Path                string                 `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
@@ -3030,6 +3132,86 @@ func (*SetLogLevelResponse) Descriptor() ([]byte, []int) {
 	return file_daemon_proto_rawDescGZIP(), []int{36}
 }
 
+type RegisterUILogRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Path          string                 `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RegisterUILogRequest) Reset() {
+	*x = RegisterUILogRequest{}
+	mi := &file_daemon_proto_msgTypes[37]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RegisterUILogRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RegisterUILogRequest) ProtoMessage() {}
+
+func (x *RegisterUILogRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[37]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RegisterUILogRequest.ProtoReflect.Descriptor instead.
+func (*RegisterUILogRequest) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{37}
+}
+
+func (x *RegisterUILogRequest) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+type RegisterUILogResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RegisterUILogResponse) Reset() {
+	*x = RegisterUILogResponse{}
+	mi := &file_daemon_proto_msgTypes[38]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RegisterUILogResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RegisterUILogResponse) ProtoMessage() {}
+
+func (x *RegisterUILogResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[38]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RegisterUILogResponse.ProtoReflect.Descriptor instead.
+func (*RegisterUILogResponse) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{38}
+}
+
 // State represents a daemon state entry
 type State struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -3040,7 +3222,7 @@ type State struct {
 
 func (x *State) Reset() {
 	*x = State{}
-	mi := &file_daemon_proto_msgTypes[37]
+	mi := &file_daemon_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3052,7 +3234,7 @@ func (x *State) String() string {
 func (*State) ProtoMessage() {}
 
 func (x *State) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[37]
+	mi := &file_daemon_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3065,7 +3247,7 @@ func (x *State) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use State.ProtoReflect.Descriptor instead.
 func (*State) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{37}
+	return file_daemon_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *State) GetName() string {
@@ -3084,7 +3266,7 @@ type ListStatesRequest struct {
 
 func (x *ListStatesRequest) Reset() {
 	*x = ListStatesRequest{}
-	mi := &file_daemon_proto_msgTypes[38]
+	mi := &file_daemon_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3096,7 +3278,7 @@ func (x *ListStatesRequest) String() string {
 func (*ListStatesRequest) ProtoMessage() {}
 
 func (x *ListStatesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[38]
+	mi := &file_daemon_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3109,7 +3291,7 @@ func (x *ListStatesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListStatesRequest.ProtoReflect.Descriptor instead.
 func (*ListStatesRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{38}
+	return file_daemon_proto_rawDescGZIP(), []int{40}
 }
 
 // ListStatesResponse contains a list of states
@@ -3122,7 +3304,7 @@ type ListStatesResponse struct {
 
 func (x *ListStatesResponse) Reset() {
 	*x = ListStatesResponse{}
-	mi := &file_daemon_proto_msgTypes[39]
+	mi := &file_daemon_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3134,7 +3316,7 @@ func (x *ListStatesResponse) String() string {
 func (*ListStatesResponse) ProtoMessage() {}
 
 func (x *ListStatesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[39]
+	mi := &file_daemon_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3147,7 +3329,7 @@ func (x *ListStatesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListStatesResponse.ProtoReflect.Descriptor instead.
 func (*ListStatesResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{39}
+	return file_daemon_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *ListStatesResponse) GetStates() []*State {
@@ -3168,7 +3350,7 @@ type CleanStateRequest struct {
 
 func (x *CleanStateRequest) Reset() {
 	*x = CleanStateRequest{}
-	mi := &file_daemon_proto_msgTypes[40]
+	mi := &file_daemon_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3180,7 +3362,7 @@ func (x *CleanStateRequest) String() string {
 func (*CleanStateRequest) ProtoMessage() {}
 
 func (x *CleanStateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[40]
+	mi := &file_daemon_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3193,7 +3375,7 @@ func (x *CleanStateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CleanStateRequest.ProtoReflect.Descriptor instead.
 func (*CleanStateRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{40}
+	return file_daemon_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *CleanStateRequest) GetStateName() string {
@@ -3220,7 +3402,7 @@ type CleanStateResponse struct {
 
 func (x *CleanStateResponse) Reset() {
 	*x = CleanStateResponse{}
-	mi := &file_daemon_proto_msgTypes[41]
+	mi := &file_daemon_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3232,7 +3414,7 @@ func (x *CleanStateResponse) String() string {
 func (*CleanStateResponse) ProtoMessage() {}
 
 func (x *CleanStateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[41]
+	mi := &file_daemon_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3245,7 +3427,7 @@ func (x *CleanStateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CleanStateResponse.ProtoReflect.Descriptor instead.
 func (*CleanStateResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{41}
+	return file_daemon_proto_rawDescGZIP(), []int{43}
 }
 
 func (x *CleanStateResponse) GetCleanedStates() int32 {
@@ -3266,7 +3448,7 @@ type DeleteStateRequest struct {
 
 func (x *DeleteStateRequest) Reset() {
 	*x = DeleteStateRequest{}
-	mi := &file_daemon_proto_msgTypes[42]
+	mi := &file_daemon_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3278,7 +3460,7 @@ func (x *DeleteStateRequest) String() string {
 func (*DeleteStateRequest) ProtoMessage() {}
 
 func (x *DeleteStateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[42]
+	mi := &file_daemon_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3291,7 +3473,7 @@ func (x *DeleteStateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteStateRequest.ProtoReflect.Descriptor instead.
 func (*DeleteStateRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{42}
+	return file_daemon_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *DeleteStateRequest) GetStateName() string {
@@ -3318,7 +3500,7 @@ type DeleteStateResponse struct {
 
 func (x *DeleteStateResponse) Reset() {
 	*x = DeleteStateResponse{}
-	mi := &file_daemon_proto_msgTypes[43]
+	mi := &file_daemon_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3330,7 +3512,7 @@ func (x *DeleteStateResponse) String() string {
 func (*DeleteStateResponse) ProtoMessage() {}
 
 func (x *DeleteStateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[43]
+	mi := &file_daemon_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3343,7 +3525,7 @@ func (x *DeleteStateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteStateResponse.ProtoReflect.Descriptor instead.
 func (*DeleteStateResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{43}
+	return file_daemon_proto_rawDescGZIP(), []int{45}
 }
 
 func (x *DeleteStateResponse) GetDeletedStates() int32 {
@@ -3362,7 +3544,7 @@ type SetSyncResponsePersistenceRequest struct {
 
 func (x *SetSyncResponsePersistenceRequest) Reset() {
 	*x = SetSyncResponsePersistenceRequest{}
-	mi := &file_daemon_proto_msgTypes[44]
+	mi := &file_daemon_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3374,7 +3556,7 @@ func (x *SetSyncResponsePersistenceRequest) String() string {
 func (*SetSyncResponsePersistenceRequest) ProtoMessage() {}
 
 func (x *SetSyncResponsePersistenceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[44]
+	mi := &file_daemon_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3387,7 +3569,7 @@ func (x *SetSyncResponsePersistenceRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use SetSyncResponsePersistenceRequest.ProtoReflect.Descriptor instead.
 func (*SetSyncResponsePersistenceRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{44}
+	return file_daemon_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *SetSyncResponsePersistenceRequest) GetEnabled() bool {
@@ -3405,7 +3587,7 @@ type SetSyncResponsePersistenceResponse struct {
 
 func (x *SetSyncResponsePersistenceResponse) Reset() {
 	*x = SetSyncResponsePersistenceResponse{}
-	mi := &file_daemon_proto_msgTypes[45]
+	mi := &file_daemon_proto_msgTypes[47]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3417,7 +3599,7 @@ func (x *SetSyncResponsePersistenceResponse) String() string {
 func (*SetSyncResponsePersistenceResponse) ProtoMessage() {}
 
 func (x *SetSyncResponsePersistenceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[45]
+	mi := &file_daemon_proto_msgTypes[47]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3430,7 +3612,7 @@ func (x *SetSyncResponsePersistenceResponse) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use SetSyncResponsePersistenceResponse.ProtoReflect.Descriptor instead.
 func (*SetSyncResponsePersistenceResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{45}
+	return file_daemon_proto_rawDescGZIP(), []int{47}
 }
 
 type TCPFlags struct {
@@ -3447,7 +3629,7 @@ type TCPFlags struct {
 
 func (x *TCPFlags) Reset() {
 	*x = TCPFlags{}
-	mi := &file_daemon_proto_msgTypes[46]
+	mi := &file_daemon_proto_msgTypes[48]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3459,7 +3641,7 @@ func (x *TCPFlags) String() string {
 func (*TCPFlags) ProtoMessage() {}
 
 func (x *TCPFlags) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[46]
+	mi := &file_daemon_proto_msgTypes[48]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3472,7 +3654,7 @@ func (x *TCPFlags) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TCPFlags.ProtoReflect.Descriptor instead.
 func (*TCPFlags) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{46}
+	return file_daemon_proto_rawDescGZIP(), []int{48}
 }
 
 func (x *TCPFlags) GetSyn() bool {
@@ -3534,7 +3716,7 @@ type TracePacketRequest struct {
 
 func (x *TracePacketRequest) Reset() {
 	*x = TracePacketRequest{}
-	mi := &file_daemon_proto_msgTypes[47]
+	mi := &file_daemon_proto_msgTypes[49]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3546,7 +3728,7 @@ func (x *TracePacketRequest) String() string {
 func (*TracePacketRequest) ProtoMessage() {}
 
 func (x *TracePacketRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[47]
+	mi := &file_daemon_proto_msgTypes[49]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3559,7 +3741,7 @@ func (x *TracePacketRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TracePacketRequest.ProtoReflect.Descriptor instead.
 func (*TracePacketRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{47}
+	return file_daemon_proto_rawDescGZIP(), []int{49}
 }
 
 func (x *TracePacketRequest) GetSourceIp() string {
@@ -3637,7 +3819,7 @@ type TraceStage struct {
 
 func (x *TraceStage) Reset() {
 	*x = TraceStage{}
-	mi := &file_daemon_proto_msgTypes[48]
+	mi := &file_daemon_proto_msgTypes[50]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3649,7 +3831,7 @@ func (x *TraceStage) String() string {
 func (*TraceStage) ProtoMessage() {}
 
 func (x *TraceStage) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[48]
+	mi := &file_daemon_proto_msgTypes[50]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3662,7 +3844,7 @@ func (x *TraceStage) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TraceStage.ProtoReflect.Descriptor instead.
 func (*TraceStage) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{48}
+	return file_daemon_proto_rawDescGZIP(), []int{50}
 }
 
 func (x *TraceStage) GetName() string {
@@ -3703,7 +3885,7 @@ type TracePacketResponse struct {
 
 func (x *TracePacketResponse) Reset() {
 	*x = TracePacketResponse{}
-	mi := &file_daemon_proto_msgTypes[49]
+	mi := &file_daemon_proto_msgTypes[51]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3715,7 +3897,7 @@ func (x *TracePacketResponse) String() string {
 func (*TracePacketResponse) ProtoMessage() {}
 
 func (x *TracePacketResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[49]
+	mi := &file_daemon_proto_msgTypes[51]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3728,7 +3910,7 @@ func (x *TracePacketResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TracePacketResponse.ProtoReflect.Descriptor instead.
 func (*TracePacketResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{49}
+	return file_daemon_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *TracePacketResponse) GetStages() []*TraceStage {
@@ -3753,7 +3935,7 @@ type SubscribeRequest struct {
 
 func (x *SubscribeRequest) Reset() {
 	*x = SubscribeRequest{}
-	mi := &file_daemon_proto_msgTypes[50]
+	mi := &file_daemon_proto_msgTypes[52]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3765,7 +3947,7 @@ func (x *SubscribeRequest) String() string {
 func (*SubscribeRequest) ProtoMessage() {}
 
 func (x *SubscribeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[50]
+	mi := &file_daemon_proto_msgTypes[52]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3778,7 +3960,7 @@ func (x *SubscribeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubscribeRequest.ProtoReflect.Descriptor instead.
 func (*SubscribeRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{50}
+	return file_daemon_proto_rawDescGZIP(), []int{52}
 }
 
 type SystemEvent struct {
@@ -3796,7 +3978,7 @@ type SystemEvent struct {
 
 func (x *SystemEvent) Reset() {
 	*x = SystemEvent{}
-	mi := &file_daemon_proto_msgTypes[51]
+	mi := &file_daemon_proto_msgTypes[53]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3808,7 +3990,7 @@ func (x *SystemEvent) String() string {
 func (*SystemEvent) ProtoMessage() {}
 
 func (x *SystemEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[51]
+	mi := &file_daemon_proto_msgTypes[53]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3821,7 +4003,7 @@ func (x *SystemEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemEvent.ProtoReflect.Descriptor instead.
 func (*SystemEvent) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{51}
+	return file_daemon_proto_rawDescGZIP(), []int{53}
 }
 
 func (x *SystemEvent) GetId() string {
@@ -3881,7 +4063,7 @@ type GetEventsRequest struct {
 
 func (x *GetEventsRequest) Reset() {
 	*x = GetEventsRequest{}
-	mi := &file_daemon_proto_msgTypes[52]
+	mi := &file_daemon_proto_msgTypes[54]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3893,7 +4075,7 @@ func (x *GetEventsRequest) String() string {
 func (*GetEventsRequest) ProtoMessage() {}
 
 func (x *GetEventsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[52]
+	mi := &file_daemon_proto_msgTypes[54]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3906,7 +4088,7 @@ func (x *GetEventsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetEventsRequest.ProtoReflect.Descriptor instead.
 func (*GetEventsRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{52}
+	return file_daemon_proto_rawDescGZIP(), []int{54}
 }
 
 type GetEventsResponse struct {
@@ -3918,7 +4100,7 @@ type GetEventsResponse struct {
 
 func (x *GetEventsResponse) Reset() {
 	*x = GetEventsResponse{}
-	mi := &file_daemon_proto_msgTypes[53]
+	mi := &file_daemon_proto_msgTypes[55]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3930,7 +4112,7 @@ func (x *GetEventsResponse) String() string {
 func (*GetEventsResponse) ProtoMessage() {}
 
 func (x *GetEventsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[53]
+	mi := &file_daemon_proto_msgTypes[55]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3943,7 +4125,7 @@ func (x *GetEventsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetEventsResponse.ProtoReflect.Descriptor instead.
 func (*GetEventsResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{53}
+	return file_daemon_proto_rawDescGZIP(), []int{55}
 }
 
 func (x *GetEventsResponse) GetEvents() []*SystemEvent {
@@ -3965,7 +4147,7 @@ type SwitchProfileRequest struct {
 
 func (x *SwitchProfileRequest) Reset() {
 	*x = SwitchProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[54]
+	mi := &file_daemon_proto_msgTypes[56]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3977,7 +4159,7 @@ func (x *SwitchProfileRequest) String() string {
 func (*SwitchProfileRequest) ProtoMessage() {}
 
 func (x *SwitchProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[54]
+	mi := &file_daemon_proto_msgTypes[56]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3990,7 +4172,7 @@ func (x *SwitchProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SwitchProfileRequest.ProtoReflect.Descriptor instead.
 func (*SwitchProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{54}
+	return file_daemon_proto_rawDescGZIP(), []int{56}
 }
 
 func (x *SwitchProfileRequest) GetProfileName() string {
@@ -4019,7 +4201,7 @@ type SwitchProfileResponse struct {
 
 func (x *SwitchProfileResponse) Reset() {
 	*x = SwitchProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[55]
+	mi := &file_daemon_proto_msgTypes[57]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4031,7 +4213,7 @@ func (x *SwitchProfileResponse) String() string {
 func (*SwitchProfileResponse) ProtoMessage() {}
 
 func (x *SwitchProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[55]
+	mi := &file_daemon_proto_msgTypes[57]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4044,7 +4226,7 @@ func (x *SwitchProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SwitchProfileResponse.ProtoReflect.Descriptor instead.
 func (*SwitchProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{55}
+	return file_daemon_proto_rawDescGZIP(), []int{57}
 }
 
 func (x *SwitchProfileResponse) GetId() string {
@@ -4094,13 +4276,18 @@ type SetConfigRequest struct {
 	DisableSSHAuth                *bool                `protobuf:"varint,33,opt,name=disableSSHAuth,proto3,oneof" json:"disableSSHAuth,omitempty"`
 	SshJWTCacheTTL                *int32               `protobuf:"varint,34,opt,name=sshJWTCacheTTL,proto3,oneof" json:"sshJWTCacheTTL,omitempty"`
 	DisableIpv6                   *bool                `protobuf:"varint,35,opt,name=disable_ipv6,json=disableIpv6,proto3,oneof" json:"disable_ipv6,omitempty"`
-	unknownFields                 protoimpl.UnknownFields
-	sizeCache                     protoimpl.SizeCache
+	EnableLocalMetrics            *bool                `protobuf:"varint,36,opt,name=enable_local_metrics,json=enableLocalMetrics,proto3,oneof" json:"enable_local_metrics,omitempty"`
+	LocalMetricsAddress           *string              `protobuf:"bytes,37,opt,name=local_metrics_address,json=localMetricsAddress,proto3,oneof" json:"local_metrics_address,omitempty"`
+	// remoteJobsAllowed opts the peer into management-requested remote jobs
+	// (e.g. debug bundles). Absent leaves the stored value unchanged.
+	RemoteJobsAllowed *bool `protobuf:"varint,38,opt,name=remoteJobsAllowed,proto3,oneof" json:"remoteJobsAllowed,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *SetConfigRequest) Reset() {
 	*x = SetConfigRequest{}
-	mi := &file_daemon_proto_msgTypes[56]
+	mi := &file_daemon_proto_msgTypes[58]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4112,7 +4299,7 @@ func (x *SetConfigRequest) String() string {
 func (*SetConfigRequest) ProtoMessage() {}
 
 func (x *SetConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[56]
+	mi := &file_daemon_proto_msgTypes[58]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4125,7 +4312,7 @@ func (x *SetConfigRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SetConfigRequest.ProtoReflect.Descriptor instead.
 func (*SetConfigRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{56}
+	return file_daemon_proto_rawDescGZIP(), []int{58}
 }
 
 func (x *SetConfigRequest) GetUsername() string {
@@ -4373,6 +4560,27 @@ func (x *SetConfigRequest) GetDisableIpv6() bool {
 	return false
 }
 
+func (x *SetConfigRequest) GetEnableLocalMetrics() bool {
+	if x != nil && x.EnableLocalMetrics != nil {
+		return *x.EnableLocalMetrics
+	}
+	return false
+}
+
+func (x *SetConfigRequest) GetLocalMetricsAddress() string {
+	if x != nil && x.LocalMetricsAddress != nil {
+		return *x.LocalMetricsAddress
+	}
+	return ""
+}
+
+func (x *SetConfigRequest) GetRemoteJobsAllowed() bool {
+	if x != nil && x.RemoteJobsAllowed != nil {
+		return *x.RemoteJobsAllowed
+	}
+	return false
+}
+
 type SetConfigResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -4381,7 +4589,7 @@ type SetConfigResponse struct {
 
 func (x *SetConfigResponse) Reset() {
 	*x = SetConfigResponse{}
-	mi := &file_daemon_proto_msgTypes[57]
+	mi := &file_daemon_proto_msgTypes[59]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4393,7 +4601,7 @@ func (x *SetConfigResponse) String() string {
 func (*SetConfigResponse) ProtoMessage() {}
 
 func (x *SetConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[57]
+	mi := &file_daemon_proto_msgTypes[59]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4406,7 +4614,7 @@ func (x *SetConfigResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SetConfigResponse.ProtoReflect.Descriptor instead.
 func (*SetConfigResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{57}
+	return file_daemon_proto_rawDescGZIP(), []int{59}
 }
 
 type AddProfileRequest struct {
@@ -4421,7 +4629,7 @@ type AddProfileRequest struct {
 
 func (x *AddProfileRequest) Reset() {
 	*x = AddProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[58]
+	mi := &file_daemon_proto_msgTypes[60]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4433,7 +4641,7 @@ func (x *AddProfileRequest) String() string {
 func (*AddProfileRequest) ProtoMessage() {}
 
 func (x *AddProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[58]
+	mi := &file_daemon_proto_msgTypes[60]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4446,7 +4654,7 @@ func (x *AddProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AddProfileRequest.ProtoReflect.Descriptor instead.
 func (*AddProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{58}
+	return file_daemon_proto_rawDescGZIP(), []int{60}
 }
 
 func (x *AddProfileRequest) GetUsername() string {
@@ -4474,7 +4682,7 @@ type AddProfileResponse struct {
 
 func (x *AddProfileResponse) Reset() {
 	*x = AddProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[59]
+	mi := &file_daemon_proto_msgTypes[61]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4486,7 +4694,7 @@ func (x *AddProfileResponse) String() string {
 func (*AddProfileResponse) ProtoMessage() {}
 
 func (x *AddProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[59]
+	mi := &file_daemon_proto_msgTypes[61]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4499,7 +4707,7 @@ func (x *AddProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AddProfileResponse.ProtoReflect.Descriptor instead.
 func (*AddProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{59}
+	return file_daemon_proto_rawDescGZIP(), []int{61}
 }
 
 func (x *AddProfileResponse) GetId() string {
@@ -4522,7 +4730,7 @@ type RenameProfileRequest struct {
 
 func (x *RenameProfileRequest) Reset() {
 	*x = RenameProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[60]
+	mi := &file_daemon_proto_msgTypes[62]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4534,7 +4742,7 @@ func (x *RenameProfileRequest) String() string {
 func (*RenameProfileRequest) ProtoMessage() {}
 
 func (x *RenameProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[60]
+	mi := &file_daemon_proto_msgTypes[62]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4547,7 +4755,7 @@ func (x *RenameProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RenameProfileRequest.ProtoReflect.Descriptor instead.
 func (*RenameProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{60}
+	return file_daemon_proto_rawDescGZIP(), []int{62}
 }
 
 func (x *RenameProfileRequest) GetUsername() string {
@@ -4581,7 +4789,7 @@ type RenameProfileResponse struct {
 
 func (x *RenameProfileResponse) Reset() {
 	*x = RenameProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[61]
+	mi := &file_daemon_proto_msgTypes[63]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4593,7 +4801,7 @@ func (x *RenameProfileResponse) String() string {
 func (*RenameProfileResponse) ProtoMessage() {}
 
 func (x *RenameProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[61]
+	mi := &file_daemon_proto_msgTypes[63]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4606,7 +4814,7 @@ func (x *RenameProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RenameProfileResponse.ProtoReflect.Descriptor instead.
 func (*RenameProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{61}
+	return file_daemon_proto_rawDescGZIP(), []int{63}
 }
 
 func (x *RenameProfileResponse) GetOldProfileName() string {
@@ -4628,7 +4836,7 @@ type RemoveProfileRequest struct {
 
 func (x *RemoveProfileRequest) Reset() {
 	*x = RemoveProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[62]
+	mi := &file_daemon_proto_msgTypes[64]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4640,7 +4848,7 @@ func (x *RemoveProfileRequest) String() string {
 func (*RemoveProfileRequest) ProtoMessage() {}
 
 func (x *RemoveProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[62]
+	mi := &file_daemon_proto_msgTypes[64]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4653,7 +4861,7 @@ func (x *RemoveProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemoveProfileRequest.ProtoReflect.Descriptor instead.
 func (*RemoveProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{62}
+	return file_daemon_proto_rawDescGZIP(), []int{64}
 }
 
 func (x *RemoveProfileRequest) GetUsername() string {
@@ -4681,7 +4889,7 @@ type RemoveProfileResponse struct {
 
 func (x *RemoveProfileResponse) Reset() {
 	*x = RemoveProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[63]
+	mi := &file_daemon_proto_msgTypes[65]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4693,7 +4901,7 @@ func (x *RemoveProfileResponse) String() string {
 func (*RemoveProfileResponse) ProtoMessage() {}
 
 func (x *RemoveProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[63]
+	mi := &file_daemon_proto_msgTypes[65]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4706,7 +4914,7 @@ func (x *RemoveProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemoveProfileResponse.ProtoReflect.Descriptor instead.
 func (*RemoveProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{63}
+	return file_daemon_proto_rawDescGZIP(), []int{65}
 }
 
 func (x *RemoveProfileResponse) GetId() string {
@@ -4725,7 +4933,7 @@ type ListProfilesRequest struct {
 
 func (x *ListProfilesRequest) Reset() {
 	*x = ListProfilesRequest{}
-	mi := &file_daemon_proto_msgTypes[64]
+	mi := &file_daemon_proto_msgTypes[66]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4737,7 +4945,7 @@ func (x *ListProfilesRequest) String() string {
 func (*ListProfilesRequest) ProtoMessage() {}
 
 func (x *ListProfilesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[64]
+	mi := &file_daemon_proto_msgTypes[66]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4750,7 +4958,7 @@ func (x *ListProfilesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListProfilesRequest.ProtoReflect.Descriptor instead.
 func (*ListProfilesRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{64}
+	return file_daemon_proto_rawDescGZIP(), []int{66}
 }
 
 func (x *ListProfilesRequest) GetUsername() string {
@@ -4769,7 +4977,7 @@ type ListProfilesResponse struct {
 
 func (x *ListProfilesResponse) Reset() {
 	*x = ListProfilesResponse{}
-	mi := &file_daemon_proto_msgTypes[65]
+	mi := &file_daemon_proto_msgTypes[67]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4781,7 +4989,7 @@ func (x *ListProfilesResponse) String() string {
 func (*ListProfilesResponse) ProtoMessage() {}
 
 func (x *ListProfilesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[65]
+	mi := &file_daemon_proto_msgTypes[67]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4794,7 +5002,7 @@ func (x *ListProfilesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListProfilesResponse.ProtoReflect.Descriptor instead.
 func (*ListProfilesResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{65}
+	return file_daemon_proto_rawDescGZIP(), []int{67}
 }
 
 func (x *ListProfilesResponse) GetProfiles() []*Profile {
@@ -4815,7 +5023,7 @@ type Profile struct {
 
 func (x *Profile) Reset() {
 	*x = Profile{}
-	mi := &file_daemon_proto_msgTypes[66]
+	mi := &file_daemon_proto_msgTypes[68]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4827,7 +5035,7 @@ func (x *Profile) String() string {
 func (*Profile) ProtoMessage() {}
 
 func (x *Profile) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[66]
+	mi := &file_daemon_proto_msgTypes[68]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4840,7 +5048,7 @@ func (x *Profile) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Profile.ProtoReflect.Descriptor instead.
 func (*Profile) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{66}
+	return file_daemon_proto_rawDescGZIP(), []int{68}
 }
 
 func (x *Profile) GetName() string {
@@ -4872,7 +5080,7 @@ type GetActiveProfileRequest struct {
 
 func (x *GetActiveProfileRequest) Reset() {
 	*x = GetActiveProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[67]
+	mi := &file_daemon_proto_msgTypes[69]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4884,7 +5092,7 @@ func (x *GetActiveProfileRequest) String() string {
 func (*GetActiveProfileRequest) ProtoMessage() {}
 
 func (x *GetActiveProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[67]
+	mi := &file_daemon_proto_msgTypes[69]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4897,7 +5105,7 @@ func (x *GetActiveProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetActiveProfileRequest.ProtoReflect.Descriptor instead.
 func (*GetActiveProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{67}
+	return file_daemon_proto_rawDescGZIP(), []int{69}
 }
 
 type GetActiveProfileResponse struct {
@@ -4911,7 +5119,7 @@ type GetActiveProfileResponse struct {
 
 func (x *GetActiveProfileResponse) Reset() {
 	*x = GetActiveProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[68]
+	mi := &file_daemon_proto_msgTypes[70]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4923,7 +5131,7 @@ func (x *GetActiveProfileResponse) String() string {
 func (*GetActiveProfileResponse) ProtoMessage() {}
 
 func (x *GetActiveProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[68]
+	mi := &file_daemon_proto_msgTypes[70]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4936,7 +5144,7 @@ func (x *GetActiveProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetActiveProfileResponse.ProtoReflect.Descriptor instead.
 func (*GetActiveProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{68}
+	return file_daemon_proto_rawDescGZIP(), []int{70}
 }
 
 func (x *GetActiveProfileResponse) GetProfileName() string {
@@ -4970,7 +5178,7 @@ type LogoutRequest struct {
 
 func (x *LogoutRequest) Reset() {
 	*x = LogoutRequest{}
-	mi := &file_daemon_proto_msgTypes[69]
+	mi := &file_daemon_proto_msgTypes[71]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4982,7 +5190,7 @@ func (x *LogoutRequest) String() string {
 func (*LogoutRequest) ProtoMessage() {}
 
 func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[69]
+	mi := &file_daemon_proto_msgTypes[71]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4995,7 +5203,7 @@ func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogoutRequest.ProtoReflect.Descriptor instead.
 func (*LogoutRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{69}
+	return file_daemon_proto_rawDescGZIP(), []int{71}
 }
 
 func (x *LogoutRequest) GetProfileName() string {
@@ -5020,7 +5228,7 @@ type LogoutResponse struct {
 
 func (x *LogoutResponse) Reset() {
 	*x = LogoutResponse{}
-	mi := &file_daemon_proto_msgTypes[70]
+	mi := &file_daemon_proto_msgTypes[72]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5032,7 +5240,7 @@ func (x *LogoutResponse) String() string {
 func (*LogoutResponse) ProtoMessage() {}
 
 func (x *LogoutResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[70]
+	mi := &file_daemon_proto_msgTypes[72]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5045,7 +5253,79 @@ func (x *LogoutResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogoutResponse.ProtoReflect.Descriptor instead.
 func (*LogoutResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{70}
+	return file_daemon_proto_rawDescGZIP(), []int{72}
+}
+
+type WailsUIReadyRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WailsUIReadyRequest) Reset() {
+	*x = WailsUIReadyRequest{}
+	mi := &file_daemon_proto_msgTypes[73]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WailsUIReadyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WailsUIReadyRequest) ProtoMessage() {}
+
+func (x *WailsUIReadyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[73]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WailsUIReadyRequest.ProtoReflect.Descriptor instead.
+func (*WailsUIReadyRequest) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{73}
+}
+
+type WailsUIReadyResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WailsUIReadyResponse) Reset() {
+	*x = WailsUIReadyResponse{}
+	mi := &file_daemon_proto_msgTypes[74]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WailsUIReadyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WailsUIReadyResponse) ProtoMessage() {}
+
+func (x *WailsUIReadyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[74]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WailsUIReadyResponse.ProtoReflect.Descriptor instead.
+func (*WailsUIReadyResponse) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{74}
 }
 
 type GetFeaturesRequest struct {
@@ -5056,7 +5336,7 @@ type GetFeaturesRequest struct {
 
 func (x *GetFeaturesRequest) Reset() {
 	*x = GetFeaturesRequest{}
-	mi := &file_daemon_proto_msgTypes[71]
+	mi := &file_daemon_proto_msgTypes[75]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5068,7 +5348,7 @@ func (x *GetFeaturesRequest) String() string {
 func (*GetFeaturesRequest) ProtoMessage() {}
 
 func (x *GetFeaturesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[71]
+	mi := &file_daemon_proto_msgTypes[75]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5081,7 +5361,7 @@ func (x *GetFeaturesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetFeaturesRequest.ProtoReflect.Descriptor instead.
 func (*GetFeaturesRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{71}
+	return file_daemon_proto_rawDescGZIP(), []int{75}
 }
 
 type GetFeaturesResponse struct {
@@ -5089,13 +5369,19 @@ type GetFeaturesResponse struct {
 	DisableProfiles       bool                   `protobuf:"varint,1,opt,name=disable_profiles,json=disableProfiles,proto3" json:"disable_profiles,omitempty"`
 	DisableUpdateSettings bool                   `protobuf:"varint,2,opt,name=disable_update_settings,json=disableUpdateSettings,proto3" json:"disable_update_settings,omitempty"`
 	DisableNetworks       bool                   `protobuf:"varint,3,opt,name=disable_networks,json=disableNetworks,proto3" json:"disable_networks,omitempty"`
-	unknownFields         protoimpl.UnknownFields
-	sizeCache             protoimpl.SizeCache
+	// disableAdvancedView gates the upcoming UI revision's advanced
+	// section. Tristate: unset = no MDM directive, the UI applies its
+	// own default; true = MDM enforces disable; false = MDM enforces
+	// enable. Sourced exclusively from the MDM policy — no CLI /
+	// config flag backs this value.
+	DisableAdvancedView *bool `protobuf:"varint,4,opt,name=disable_advanced_view,json=disableAdvancedView,proto3,oneof" json:"disable_advanced_view,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
 }
 
 func (x *GetFeaturesResponse) Reset() {
 	*x = GetFeaturesResponse{}
-	mi := &file_daemon_proto_msgTypes[72]
+	mi := &file_daemon_proto_msgTypes[76]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5107,7 +5393,7 @@ func (x *GetFeaturesResponse) String() string {
 func (*GetFeaturesResponse) ProtoMessage() {}
 
 func (x *GetFeaturesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[72]
+	mi := &file_daemon_proto_msgTypes[76]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5120,7 +5406,7 @@ func (x *GetFeaturesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetFeaturesResponse.ProtoReflect.Descriptor instead.
 func (*GetFeaturesResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{72}
+	return file_daemon_proto_rawDescGZIP(), []int{76}
 }
 
 func (x *GetFeaturesResponse) GetDisableProfiles() bool {
@@ -5144,6 +5430,13 @@ func (x *GetFeaturesResponse) GetDisableNetworks() bool {
 	return false
 }
 
+func (x *GetFeaturesResponse) GetDisableAdvancedView() bool {
+	if x != nil && x.DisableAdvancedView != nil {
+		return *x.DisableAdvancedView
+	}
+	return false
+}
+
 // MDMManagedFieldsViolation is attached as a gRPC error detail on a
 // FailedPrecondition status returned from SetConfig (and similar mutating
 // RPCs) when the caller tries to modify one or more MDM-enforced fields.
@@ -5158,7 +5451,7 @@ type MDMManagedFieldsViolation struct {
 
 func (x *MDMManagedFieldsViolation) Reset() {
 	*x = MDMManagedFieldsViolation{}
-	mi := &file_daemon_proto_msgTypes[73]
+	mi := &file_daemon_proto_msgTypes[77]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5170,7 +5463,7 @@ func (x *MDMManagedFieldsViolation) String() string {
 func (*MDMManagedFieldsViolation) ProtoMessage() {}
 
 func (x *MDMManagedFieldsViolation) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[73]
+	mi := &file_daemon_proto_msgTypes[77]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5183,7 +5476,7 @@ func (x *MDMManagedFieldsViolation) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MDMManagedFieldsViolation.ProtoReflect.Descriptor instead.
 func (*MDMManagedFieldsViolation) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{73}
+	return file_daemon_proto_rawDescGZIP(), []int{77}
 }
 
 func (x *MDMManagedFieldsViolation) GetFields() []string {
@@ -5201,7 +5494,7 @@ type TriggerUpdateRequest struct {
 
 func (x *TriggerUpdateRequest) Reset() {
 	*x = TriggerUpdateRequest{}
-	mi := &file_daemon_proto_msgTypes[74]
+	mi := &file_daemon_proto_msgTypes[78]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5213,7 +5506,7 @@ func (x *TriggerUpdateRequest) String() string {
 func (*TriggerUpdateRequest) ProtoMessage() {}
 
 func (x *TriggerUpdateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[74]
+	mi := &file_daemon_proto_msgTypes[78]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5226,7 +5519,7 @@ func (x *TriggerUpdateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TriggerUpdateRequest.ProtoReflect.Descriptor instead.
 func (*TriggerUpdateRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{74}
+	return file_daemon_proto_rawDescGZIP(), []int{78}
 }
 
 type TriggerUpdateResponse struct {
@@ -5239,7 +5532,7 @@ type TriggerUpdateResponse struct {
 
 func (x *TriggerUpdateResponse) Reset() {
 	*x = TriggerUpdateResponse{}
-	mi := &file_daemon_proto_msgTypes[75]
+	mi := &file_daemon_proto_msgTypes[79]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5251,7 +5544,7 @@ func (x *TriggerUpdateResponse) String() string {
 func (*TriggerUpdateResponse) ProtoMessage() {}
 
 func (x *TriggerUpdateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[75]
+	mi := &file_daemon_proto_msgTypes[79]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5264,7 +5557,7 @@ func (x *TriggerUpdateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TriggerUpdateResponse.ProtoReflect.Descriptor instead.
 func (*TriggerUpdateResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{75}
+	return file_daemon_proto_rawDescGZIP(), []int{79}
 }
 
 func (x *TriggerUpdateResponse) GetSuccess() bool {
@@ -5292,7 +5585,7 @@ type GetPeerSSHHostKeyRequest struct {
 
 func (x *GetPeerSSHHostKeyRequest) Reset() {
 	*x = GetPeerSSHHostKeyRequest{}
-	mi := &file_daemon_proto_msgTypes[76]
+	mi := &file_daemon_proto_msgTypes[80]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5304,7 +5597,7 @@ func (x *GetPeerSSHHostKeyRequest) String() string {
 func (*GetPeerSSHHostKeyRequest) ProtoMessage() {}
 
 func (x *GetPeerSSHHostKeyRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[76]
+	mi := &file_daemon_proto_msgTypes[80]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5317,7 +5610,7 @@ func (x *GetPeerSSHHostKeyRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetPeerSSHHostKeyRequest.ProtoReflect.Descriptor instead.
 func (*GetPeerSSHHostKeyRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{76}
+	return file_daemon_proto_rawDescGZIP(), []int{80}
 }
 
 func (x *GetPeerSSHHostKeyRequest) GetPeerAddress() string {
@@ -5344,7 +5637,7 @@ type GetPeerSSHHostKeyResponse struct {
 
 func (x *GetPeerSSHHostKeyResponse) Reset() {
 	*x = GetPeerSSHHostKeyResponse{}
-	mi := &file_daemon_proto_msgTypes[77]
+	mi := &file_daemon_proto_msgTypes[81]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5356,7 +5649,7 @@ func (x *GetPeerSSHHostKeyResponse) String() string {
 func (*GetPeerSSHHostKeyResponse) ProtoMessage() {}
 
 func (x *GetPeerSSHHostKeyResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[77]
+	mi := &file_daemon_proto_msgTypes[81]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5369,7 +5662,7 @@ func (x *GetPeerSSHHostKeyResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetPeerSSHHostKeyResponse.ProtoReflect.Descriptor instead.
 func (*GetPeerSSHHostKeyResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{77}
+	return file_daemon_proto_rawDescGZIP(), []int{81}
 }
 
 func (x *GetPeerSSHHostKeyResponse) GetSshHostKey() []byte {
@@ -5404,14 +5697,18 @@ func (x *GetPeerSSHHostKeyResponse) GetFound() bool {
 type RequestJWTAuthRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// hint for OIDC login_hint parameter (typically email address)
-	Hint          *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	Hint *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
+	// hasGraphicalSession tells the daemon that the caller has a graphical session,
+	// which decides whether PKCE or the device code flow is preferred. The daemon
+	// cannot detect this itself: it does not inherit the session environment.
+	HasGraphicalSession bool `protobuf:"varint,2,opt,name=hasGraphicalSession,proto3" json:"hasGraphicalSession,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
 }
 
 func (x *RequestJWTAuthRequest) Reset() {
 	*x = RequestJWTAuthRequest{}
-	mi := &file_daemon_proto_msgTypes[78]
+	mi := &file_daemon_proto_msgTypes[82]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5423,7 +5720,7 @@ func (x *RequestJWTAuthRequest) String() string {
 func (*RequestJWTAuthRequest) ProtoMessage() {}
 
 func (x *RequestJWTAuthRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[78]
+	mi := &file_daemon_proto_msgTypes[82]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5436,7 +5733,7 @@ func (x *RequestJWTAuthRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RequestJWTAuthRequest.ProtoReflect.Descriptor instead.
 func (*RequestJWTAuthRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{78}
+	return file_daemon_proto_rawDescGZIP(), []int{82}
 }
 
 func (x *RequestJWTAuthRequest) GetHint() string {
@@ -5446,6 +5743,13 @@ func (x *RequestJWTAuthRequest) GetHint() string {
 	return ""
 }
 
+func (x *RequestJWTAuthRequest) GetHasGraphicalSession() bool {
+	if x != nil {
+		return x.HasGraphicalSession
+	}
+	return false
+}
+
 // RequestJWTAuthResponse contains authentication flow information
 type RequestJWTAuthResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -5469,7 +5773,7 @@ type RequestJWTAuthResponse struct {
 
 func (x *RequestJWTAuthResponse) Reset() {
 	*x = RequestJWTAuthResponse{}
-	mi := &file_daemon_proto_msgTypes[79]
+	mi := &file_daemon_proto_msgTypes[83]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5481,7 +5785,7 @@ func (x *RequestJWTAuthResponse) String() string {
 func (*RequestJWTAuthResponse) ProtoMessage() {}
 
 func (x *RequestJWTAuthResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[79]
+	mi := &file_daemon_proto_msgTypes[83]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5494,7 +5798,7 @@ func (x *RequestJWTAuthResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RequestJWTAuthResponse.ProtoReflect.Descriptor instead.
 func (*RequestJWTAuthResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{79}
+	return file_daemon_proto_rawDescGZIP(), []int{83}
 }
 
 func (x *RequestJWTAuthResponse) GetVerificationURI() string {
@@ -5559,7 +5863,7 @@ type WaitJWTTokenRequest struct {
 
 func (x *WaitJWTTokenRequest) Reset() {
 	*x = WaitJWTTokenRequest{}
-	mi := &file_daemon_proto_msgTypes[80]
+	mi := &file_daemon_proto_msgTypes[84]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5571,7 +5875,7 @@ func (x *WaitJWTTokenRequest) String() string {
 func (*WaitJWTTokenRequest) ProtoMessage() {}
 
 func (x *WaitJWTTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[80]
+	mi := &file_daemon_proto_msgTypes[84]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5584,7 +5888,7 @@ func (x *WaitJWTTokenRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WaitJWTTokenRequest.ProtoReflect.Descriptor instead.
 func (*WaitJWTTokenRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{80}
+	return file_daemon_proto_rawDescGZIP(), []int{84}
 }
 
 func (x *WaitJWTTokenRequest) GetDeviceCode() string {
@@ -5616,7 +5920,7 @@ type WaitJWTTokenResponse struct {
 
 func (x *WaitJWTTokenResponse) Reset() {
 	*x = WaitJWTTokenResponse{}
-	mi := &file_daemon_proto_msgTypes[81]
+	mi := &file_daemon_proto_msgTypes[85]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5628,7 +5932,7 @@ func (x *WaitJWTTokenResponse) String() string {
 func (*WaitJWTTokenResponse) ProtoMessage() {}
 
 func (x *WaitJWTTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[81]
+	mi := &file_daemon_proto_msgTypes[85]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5641,7 +5945,7 @@ func (x *WaitJWTTokenResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WaitJWTTokenResponse.ProtoReflect.Descriptor instead.
 func (*WaitJWTTokenResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{81}
+	return file_daemon_proto_rawDescGZIP(), []int{85}
 }
 
 func (x *WaitJWTTokenResponse) GetToken() string {
@@ -5665,6 +5969,329 @@ func (x *WaitJWTTokenResponse) GetExpiresIn() int64 {
 	return 0
 }
 
+// RequestExtendAuthSessionRequest kicks off the session-extension SSO flow.
+type RequestExtendAuthSessionRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Optional OIDC login_hint (typically the user's email) to pre-fill the
+	// IdP login form.
+	Hint *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
+	// hasGraphicalSession tells the daemon that the caller has a graphical session,
+	// which decides whether PKCE or the device code flow is preferred. The daemon
+	// cannot detect this itself: it does not inherit the session environment.
+	HasGraphicalSession bool `protobuf:"varint,2,opt,name=hasGraphicalSession,proto3" json:"hasGraphicalSession,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
+}
+
+func (x *RequestExtendAuthSessionRequest) Reset() {
+	*x = RequestExtendAuthSessionRequest{}
+	mi := &file_daemon_proto_msgTypes[86]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RequestExtendAuthSessionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestExtendAuthSessionRequest) ProtoMessage() {}
+
+func (x *RequestExtendAuthSessionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[86]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestExtendAuthSessionRequest.ProtoReflect.Descriptor instead.
+func (*RequestExtendAuthSessionRequest) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{86}
+}
+
+func (x *RequestExtendAuthSessionRequest) GetHint() string {
+	if x != nil && x.Hint != nil {
+		return *x.Hint
+	}
+	return ""
+}
+
+func (x *RequestExtendAuthSessionRequest) GetHasGraphicalSession() bool {
+	if x != nil {
+		return x.HasGraphicalSession
+	}
+	return false
+}
+
+// RequestExtendAuthSessionResponse carries the verification URI the UI
+// should open in a browser. The daemon retains the flow state and resolves
+// it via WaitExtendAuthSession.
+type RequestExtendAuthSessionResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// verification URI for the user to open in the browser
+	VerificationURI string `protobuf:"bytes,1,opt,name=verificationURI,proto3" json:"verificationURI,omitempty"`
+	// complete verification URI (with embedded user code)
+	VerificationURIComplete string `protobuf:"bytes,2,opt,name=verificationURIComplete,proto3" json:"verificationURIComplete,omitempty"`
+	// user code to enter on verification URI (for device-code flows)
+	UserCode string `protobuf:"bytes,3,opt,name=userCode,proto3" json:"userCode,omitempty"`
+	// device code for matching the WaitExtendAuthSession call to this flow
+	DeviceCode string `protobuf:"bytes,4,opt,name=deviceCode,proto3" json:"deviceCode,omitempty"`
+	// expiration time in seconds for the device code / PKCE flow
+	ExpiresIn     int64 `protobuf:"varint,5,opt,name=expiresIn,proto3" json:"expiresIn,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RequestExtendAuthSessionResponse) Reset() {
+	*x = RequestExtendAuthSessionResponse{}
+	mi := &file_daemon_proto_msgTypes[87]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RequestExtendAuthSessionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestExtendAuthSessionResponse) ProtoMessage() {}
+
+func (x *RequestExtendAuthSessionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[87]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestExtendAuthSessionResponse.ProtoReflect.Descriptor instead.
+func (*RequestExtendAuthSessionResponse) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{87}
+}
+
+func (x *RequestExtendAuthSessionResponse) GetVerificationURI() string {
+	if x != nil {
+		return x.VerificationURI
+	}
+	return ""
+}
+
+func (x *RequestExtendAuthSessionResponse) GetVerificationURIComplete() string {
+	if x != nil {
+		return x.VerificationURIComplete
+	}
+	return ""
+}
+
+func (x *RequestExtendAuthSessionResponse) GetUserCode() string {
+	if x != nil {
+		return x.UserCode
+	}
+	return ""
+}
+
+func (x *RequestExtendAuthSessionResponse) GetDeviceCode() string {
+	if x != nil {
+		return x.DeviceCode
+	}
+	return ""
+}
+
+func (x *RequestExtendAuthSessionResponse) GetExpiresIn() int64 {
+	if x != nil {
+		return x.ExpiresIn
+	}
+	return 0
+}
+
+// WaitExtendAuthSessionRequest is sent by the UI after it opens the
+// verification URI. The daemon blocks on this call until the user
+// completes (or aborts) the SSO step.
+type WaitExtendAuthSessionRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// device code returned by RequestExtendAuthSession
+	DeviceCode string `protobuf:"bytes,1,opt,name=deviceCode,proto3" json:"deviceCode,omitempty"`
+	// user code for verification
+	UserCode      string `protobuf:"bytes,2,opt,name=userCode,proto3" json:"userCode,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WaitExtendAuthSessionRequest) Reset() {
+	*x = WaitExtendAuthSessionRequest{}
+	mi := &file_daemon_proto_msgTypes[88]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WaitExtendAuthSessionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WaitExtendAuthSessionRequest) ProtoMessage() {}
+
+func (x *WaitExtendAuthSessionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[88]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WaitExtendAuthSessionRequest.ProtoReflect.Descriptor instead.
+func (*WaitExtendAuthSessionRequest) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{88}
+}
+
+func (x *WaitExtendAuthSessionRequest) GetDeviceCode() string {
+	if x != nil {
+		return x.DeviceCode
+	}
+	return ""
+}
+
+func (x *WaitExtendAuthSessionRequest) GetUserCode() string {
+	if x != nil {
+		return x.UserCode
+	}
+	return ""
+}
+
+// WaitExtendAuthSessionResponse carries the refreshed deadline returned
+// by the management server. Unset when the management server reports the
+// peer is not eligible for session extension.
+type WaitExtendAuthSessionResponse struct {
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	SessionExpiresAt *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=sessionExpiresAt,proto3" json:"sessionExpiresAt,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *WaitExtendAuthSessionResponse) Reset() {
+	*x = WaitExtendAuthSessionResponse{}
+	mi := &file_daemon_proto_msgTypes[89]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WaitExtendAuthSessionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WaitExtendAuthSessionResponse) ProtoMessage() {}
+
+func (x *WaitExtendAuthSessionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[89]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WaitExtendAuthSessionResponse.ProtoReflect.Descriptor instead.
+func (*WaitExtendAuthSessionResponse) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{89}
+}
+
+func (x *WaitExtendAuthSessionResponse) GetSessionExpiresAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.SessionExpiresAt
+	}
+	return nil
+}
+
+// DismissSessionWarningRequest is sent by the UI when the user clicks
+// "Dismiss" on the T-WarningLead notification.
+type DismissSessionWarningRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DismissSessionWarningRequest) Reset() {
+	*x = DismissSessionWarningRequest{}
+	mi := &file_daemon_proto_msgTypes[90]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DismissSessionWarningRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DismissSessionWarningRequest) ProtoMessage() {}
+
+func (x *DismissSessionWarningRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[90]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DismissSessionWarningRequest.ProtoReflect.Descriptor instead.
+func (*DismissSessionWarningRequest) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{90}
+}
+
+// DismissSessionWarningResponse acknowledges the dismissal. Carries no
+// payload — the daemon's only obligation is to silence the upcoming
+// T-FinalWarningLead fallback for the current deadline.
+type DismissSessionWarningResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DismissSessionWarningResponse) Reset() {
+	*x = DismissSessionWarningResponse{}
+	mi := &file_daemon_proto_msgTypes[91]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DismissSessionWarningResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DismissSessionWarningResponse) ProtoMessage() {}
+
+func (x *DismissSessionWarningResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[91]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DismissSessionWarningResponse.ProtoReflect.Descriptor instead.
+func (*DismissSessionWarningResponse) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{91}
+}
+
 // StartCPUProfileRequest for starting CPU profiling
 type StartCPUProfileRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -5674,7 +6301,7 @@ type StartCPUProfileRequest struct {
 
 func (x *StartCPUProfileRequest) Reset() {
 	*x = StartCPUProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[82]
+	mi := &file_daemon_proto_msgTypes[92]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5686,7 +6313,7 @@ func (x *StartCPUProfileRequest) String() string {
 func (*StartCPUProfileRequest) ProtoMessage() {}
 
 func (x *StartCPUProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[82]
+	mi := &file_daemon_proto_msgTypes[92]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5699,7 +6326,7 @@ func (x *StartCPUProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartCPUProfileRequest.ProtoReflect.Descriptor instead.
 func (*StartCPUProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{82}
+	return file_daemon_proto_rawDescGZIP(), []int{92}
 }
 
 // StartCPUProfileResponse confirms CPU profiling has started
@@ -5711,7 +6338,7 @@ type StartCPUProfileResponse struct {
 
 func (x *StartCPUProfileResponse) Reset() {
 	*x = StartCPUProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[83]
+	mi := &file_daemon_proto_msgTypes[93]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5723,7 +6350,7 @@ func (x *StartCPUProfileResponse) String() string {
 func (*StartCPUProfileResponse) ProtoMessage() {}
 
 func (x *StartCPUProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[83]
+	mi := &file_daemon_proto_msgTypes[93]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5736,7 +6363,7 @@ func (x *StartCPUProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartCPUProfileResponse.ProtoReflect.Descriptor instead.
 func (*StartCPUProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{83}
+	return file_daemon_proto_rawDescGZIP(), []int{93}
 }
 
 // StopCPUProfileRequest for stopping CPU profiling
@@ -5748,7 +6375,7 @@ type StopCPUProfileRequest struct {
 
 func (x *StopCPUProfileRequest) Reset() {
 	*x = StopCPUProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[84]
+	mi := &file_daemon_proto_msgTypes[94]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5760,7 +6387,7 @@ func (x *StopCPUProfileRequest) String() string {
 func (*StopCPUProfileRequest) ProtoMessage() {}
 
 func (x *StopCPUProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[84]
+	mi := &file_daemon_proto_msgTypes[94]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5773,7 +6400,7 @@ func (x *StopCPUProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopCPUProfileRequest.ProtoReflect.Descriptor instead.
 func (*StopCPUProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{84}
+	return file_daemon_proto_rawDescGZIP(), []int{94}
 }
 
 // StopCPUProfileResponse confirms CPU profiling has stopped
@@ -5785,7 +6412,7 @@ type StopCPUProfileResponse struct {
 
 func (x *StopCPUProfileResponse) Reset() {
 	*x = StopCPUProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[85]
+	mi := &file_daemon_proto_msgTypes[95]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5797,7 +6424,7 @@ func (x *StopCPUProfileResponse) String() string {
 func (*StopCPUProfileResponse) ProtoMessage() {}
 
 func (x *StopCPUProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[85]
+	mi := &file_daemon_proto_msgTypes[95]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5810,7 +6437,7 @@ func (x *StopCPUProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopCPUProfileResponse.ProtoReflect.Descriptor instead.
 func (*StopCPUProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{85}
+	return file_daemon_proto_rawDescGZIP(), []int{95}
 }
 
 type InstallerResultRequest struct {
@@ -5821,7 +6448,7 @@ type InstallerResultRequest struct {
 
 func (x *InstallerResultRequest) Reset() {
 	*x = InstallerResultRequest{}
-	mi := &file_daemon_proto_msgTypes[86]
+	mi := &file_daemon_proto_msgTypes[96]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5833,7 +6460,7 @@ func (x *InstallerResultRequest) String() string {
 func (*InstallerResultRequest) ProtoMessage() {}
 
 func (x *InstallerResultRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[86]
+	mi := &file_daemon_proto_msgTypes[96]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5846,7 +6473,7 @@ func (x *InstallerResultRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InstallerResultRequest.ProtoReflect.Descriptor instead.
 func (*InstallerResultRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{86}
+	return file_daemon_proto_rawDescGZIP(), []int{96}
 }
 
 type InstallerResultResponse struct {
@@ -5859,7 +6486,7 @@ type InstallerResultResponse struct {
 
 func (x *InstallerResultResponse) Reset() {
 	*x = InstallerResultResponse{}
-	mi := &file_daemon_proto_msgTypes[87]
+	mi := &file_daemon_proto_msgTypes[97]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5871,7 +6498,7 @@ func (x *InstallerResultResponse) String() string {
 func (*InstallerResultResponse) ProtoMessage() {}
 
 func (x *InstallerResultResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[87]
+	mi := &file_daemon_proto_msgTypes[97]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5884,7 +6511,7 @@ func (x *InstallerResultResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InstallerResultResponse.ProtoReflect.Descriptor instead.
 func (*InstallerResultResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{87}
+	return file_daemon_proto_rawDescGZIP(), []int{97}
 }
 
 func (x *InstallerResultResponse) GetSuccess() bool {
@@ -5917,7 +6544,7 @@ type ExposeServiceRequest struct {
 
 func (x *ExposeServiceRequest) Reset() {
 	*x = ExposeServiceRequest{}
-	mi := &file_daemon_proto_msgTypes[88]
+	mi := &file_daemon_proto_msgTypes[98]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5929,7 +6556,7 @@ func (x *ExposeServiceRequest) String() string {
 func (*ExposeServiceRequest) ProtoMessage() {}
 
 func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[88]
+	mi := &file_daemon_proto_msgTypes[98]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5942,7 +6569,7 @@ func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceRequest.ProtoReflect.Descriptor instead.
 func (*ExposeServiceRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{88}
+	return file_daemon_proto_rawDescGZIP(), []int{98}
 }
 
 func (x *ExposeServiceRequest) GetPort() uint32 {
@@ -6013,7 +6640,7 @@ type ExposeServiceEvent struct {
 
 func (x *ExposeServiceEvent) Reset() {
 	*x = ExposeServiceEvent{}
-	mi := &file_daemon_proto_msgTypes[89]
+	mi := &file_daemon_proto_msgTypes[99]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6025,7 +6652,7 @@ func (x *ExposeServiceEvent) String() string {
 func (*ExposeServiceEvent) ProtoMessage() {}
 
 func (x *ExposeServiceEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[89]
+	mi := &file_daemon_proto_msgTypes[99]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6038,7 +6665,7 @@ func (x *ExposeServiceEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceEvent.ProtoReflect.Descriptor instead.
 func (*ExposeServiceEvent) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{89}
+	return file_daemon_proto_rawDescGZIP(), []int{99}
 }
 
 func (x *ExposeServiceEvent) GetEvent() isExposeServiceEvent_Event {
@@ -6079,7 +6706,7 @@ type ExposeServiceReady struct {
 
 func (x *ExposeServiceReady) Reset() {
 	*x = ExposeServiceReady{}
-	mi := &file_daemon_proto_msgTypes[90]
+	mi := &file_daemon_proto_msgTypes[100]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6091,7 +6718,7 @@ func (x *ExposeServiceReady) String() string {
 func (*ExposeServiceReady) ProtoMessage() {}
 
 func (x *ExposeServiceReady) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[90]
+	mi := &file_daemon_proto_msgTypes[100]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6104,7 +6731,7 @@ func (x *ExposeServiceReady) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceReady.ProtoReflect.Descriptor instead.
 func (*ExposeServiceReady) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{90}
+	return file_daemon_proto_rawDescGZIP(), []int{100}
 }
 
 func (x *ExposeServiceReady) GetServiceName() string {
@@ -6149,7 +6776,7 @@ type StartCaptureRequest struct {
 
 func (x *StartCaptureRequest) Reset() {
 	*x = StartCaptureRequest{}
-	mi := &file_daemon_proto_msgTypes[91]
+	mi := &file_daemon_proto_msgTypes[101]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6161,7 +6788,7 @@ func (x *StartCaptureRequest) String() string {
 func (*StartCaptureRequest) ProtoMessage() {}
 
 func (x *StartCaptureRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[91]
+	mi := &file_daemon_proto_msgTypes[101]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6174,7 +6801,7 @@ func (x *StartCaptureRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartCaptureRequest.ProtoReflect.Descriptor instead.
 func (*StartCaptureRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{91}
+	return file_daemon_proto_rawDescGZIP(), []int{101}
 }
 
 func (x *StartCaptureRequest) GetTextOutput() bool {
@@ -6228,7 +6855,7 @@ type CapturePacket struct {
 
 func (x *CapturePacket) Reset() {
 	*x = CapturePacket{}
-	mi := &file_daemon_proto_msgTypes[92]
+	mi := &file_daemon_proto_msgTypes[102]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6240,7 +6867,7 @@ func (x *CapturePacket) String() string {
 func (*CapturePacket) ProtoMessage() {}
 
 func (x *CapturePacket) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[92]
+	mi := &file_daemon_proto_msgTypes[102]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6253,7 +6880,7 @@ func (x *CapturePacket) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CapturePacket.ProtoReflect.Descriptor instead.
 func (*CapturePacket) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{92}
+	return file_daemon_proto_rawDescGZIP(), []int{102}
 }
 
 func (x *CapturePacket) GetData() []byte {
@@ -6274,7 +6901,7 @@ type StartBundleCaptureRequest struct {
 
 func (x *StartBundleCaptureRequest) Reset() {
 	*x = StartBundleCaptureRequest{}
-	mi := &file_daemon_proto_msgTypes[93]
+	mi := &file_daemon_proto_msgTypes[103]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6286,7 +6913,7 @@ func (x *StartBundleCaptureRequest) String() string {
 func (*StartBundleCaptureRequest) ProtoMessage() {}
 
 func (x *StartBundleCaptureRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[93]
+	mi := &file_daemon_proto_msgTypes[103]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6299,7 +6926,7 @@ func (x *StartBundleCaptureRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartBundleCaptureRequest.ProtoReflect.Descriptor instead.
 func (*StartBundleCaptureRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{93}
+	return file_daemon_proto_rawDescGZIP(), []int{103}
 }
 
 func (x *StartBundleCaptureRequest) GetTimeout() *durationpb.Duration {
@@ -6317,7 +6944,7 @@ type StartBundleCaptureResponse struct {
 
 func (x *StartBundleCaptureResponse) Reset() {
 	*x = StartBundleCaptureResponse{}
-	mi := &file_daemon_proto_msgTypes[94]
+	mi := &file_daemon_proto_msgTypes[104]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6329,7 +6956,7 @@ func (x *StartBundleCaptureResponse) String() string {
 func (*StartBundleCaptureResponse) ProtoMessage() {}
 
 func (x *StartBundleCaptureResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[94]
+	mi := &file_daemon_proto_msgTypes[104]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6342,7 +6969,7 @@ func (x *StartBundleCaptureResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartBundleCaptureResponse.ProtoReflect.Descriptor instead.
 func (*StartBundleCaptureResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{94}
+	return file_daemon_proto_rawDescGZIP(), []int{104}
 }
 
 type StopBundleCaptureRequest struct {
@@ -6353,7 +6980,7 @@ type StopBundleCaptureRequest struct {
 
 func (x *StopBundleCaptureRequest) Reset() {
 	*x = StopBundleCaptureRequest{}
-	mi := &file_daemon_proto_msgTypes[95]
+	mi := &file_daemon_proto_msgTypes[105]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6365,7 +6992,7 @@ func (x *StopBundleCaptureRequest) String() string {
 func (*StopBundleCaptureRequest) ProtoMessage() {}
 
 func (x *StopBundleCaptureRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[95]
+	mi := &file_daemon_proto_msgTypes[105]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6378,7 +7005,7 @@ func (x *StopBundleCaptureRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopBundleCaptureRequest.ProtoReflect.Descriptor instead.
 func (*StopBundleCaptureRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{95}
+	return file_daemon_proto_rawDescGZIP(), []int{105}
 }
 
 type StopBundleCaptureResponse struct {
@@ -6389,7 +7016,7 @@ type StopBundleCaptureResponse struct {
 
 func (x *StopBundleCaptureResponse) Reset() {
 	*x = StopBundleCaptureResponse{}
-	mi := &file_daemon_proto_msgTypes[96]
+	mi := &file_daemon_proto_msgTypes[106]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6401,7 +7028,7 @@ func (x *StopBundleCaptureResponse) String() string {
 func (*StopBundleCaptureResponse) ProtoMessage() {}
 
 func (x *StopBundleCaptureResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[96]
+	mi := &file_daemon_proto_msgTypes[106]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6414,7 +7041,7 @@ func (x *StopBundleCaptureResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopBundleCaptureResponse.ProtoReflect.Descriptor instead.
 func (*StopBundleCaptureResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{96}
+	return file_daemon_proto_rawDescGZIP(), []int{106}
 }
 
 type PortInfo_Range struct {
@@ -6427,7 +7054,7 @@ type PortInfo_Range struct {
 
 func (x *PortInfo_Range) Reset() {
 	*x = PortInfo_Range{}
-	mi := &file_daemon_proto_msgTypes[98]
+	mi := &file_daemon_proto_msgTypes[108]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6439,7 +7066,7 @@ func (x *PortInfo_Range) String() string {
 func (*PortInfo_Range) ProtoMessage() {}
 
 func (x *PortInfo_Range) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[98]
+	mi := &file_daemon_proto_msgTypes[108]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6474,7 +7101,7 @@ var File_daemon_proto protoreflect.FileDescriptor
 const file_daemon_proto_rawDesc = "" +
 	"\n" +
 	"\fdaemon.proto\x12\x06daemon\x1a google/protobuf/descriptor.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1egoogle/protobuf/duration.proto\"\x0e\n" +
-	"\fEmptyRequest\"\xef\x12\n" +
+	"\fEmptyRequest\"\xdb\x14\n" +
 	"\fLoginRequest\x12\x1a\n" +
 	"\bsetupKey\x18\x01 \x01(\tR\bsetupKey\x12&\n" +
 	"\fpreSharedKey\x18\x02 \x01(\tB\x02\x18\x01R\fpreSharedKey\x12$\n" +
@@ -6519,7 +7146,10 @@ const file_daemon_proto_rawDesc = "" +
 	"\x1denableSSHRemotePortForwarding\x18% \x01(\bH\x18R\x1denableSSHRemotePortForwarding\x88\x01\x01\x12+\n" +
 	"\x0edisableSSHAuth\x18& \x01(\bH\x19R\x0edisableSSHAuth\x88\x01\x01\x12+\n" +
 	"\x0esshJWTCacheTTL\x18' \x01(\x05H\x1aR\x0esshJWTCacheTTL\x88\x01\x01\x12&\n" +
-	"\fdisable_ipv6\x18( \x01(\bH\x1bR\vdisableIpv6\x88\x01\x01B\x13\n" +
+	"\fdisable_ipv6\x18( \x01(\bH\x1bR\vdisableIpv6\x88\x01\x01\x125\n" +
+	"\x14enable_local_metrics\x18) \x01(\bH\x1cR\x12enableLocalMetrics\x88\x01\x01\x127\n" +
+	"\x15local_metrics_address\x18* \x01(\tH\x1dR\x13localMetricsAddress\x88\x01\x01\x121\n" +
+	"\x11remoteJobsAllowed\x18+ \x01(\bH\x1eR\x11remoteJobsAllowed\x88\x01\x01B\x13\n" +
 	"\x11_rosenpassEnabledB\x10\n" +
 	"\x0e_interfaceNameB\x10\n" +
 	"\x0e_wireguardPortB\x17\n" +
@@ -6547,7 +7177,10 @@ const file_daemon_proto_rawDesc = "" +
 	"\x1e_enableSSHRemotePortForwardingB\x11\n" +
 	"\x0f_disableSSHAuthB\x11\n" +
 	"\x0f_sshJWTCacheTTLB\x0f\n" +
-	"\r_disable_ipv6\"\xb5\x01\n" +
+	"\r_disable_ipv6B\x17\n" +
+	"\x15_enable_local_metricsB\x18\n" +
+	"\x16_local_metrics_addressB\x14\n" +
+	"\x12_remoteJobsAllowed\"\xb5\x01\n" +
 	"\rLoginResponse\x12$\n" +
 	"\rneedsSSOLogin\x18\x01 \x01(\bR\rneedsSSOLogin\x12\x1a\n" +
 	"\buserCode\x18\x02 \x01(\tR\buserCode\x12(\n" +
@@ -6557,10 +7190,11 @@ const file_daemon_proto_rawDesc = "" +
 	"\buserCode\x18\x01 \x01(\tR\buserCode\x12\x1a\n" +
 	"\bhostname\x18\x02 \x01(\tR\bhostname\",\n" +
 	"\x14WaitSSOLoginResponse\x12\x14\n" +
-	"\x05email\x18\x01 \x01(\tR\x05email\"v\n" +
+	"\x05email\x18\x01 \x01(\tR\x05email\"\x8c\x01\n" +
 	"\tUpRequest\x12%\n" +
 	"\vprofileName\x18\x01 \x01(\tH\x00R\vprofileName\x88\x01\x01\x12\x1f\n" +
-	"\busername\x18\x02 \x01(\tH\x01R\busername\x88\x01\x01B\x0e\n" +
+	"\busername\x18\x02 \x01(\tH\x01R\busername\x88\x01\x01\x12\x14\n" +
+	"\x05async\x18\x04 \x01(\bR\x05asyncB\x0e\n" +
 	"\f_profileNameB\v\n" +
 	"\t_usernameJ\x04\b\x03\x10\x04\"\f\n" +
 	"\n" +
@@ -6569,18 +7203,19 @@ const file_daemon_proto_rawDesc = "" +
 	"\x11getFullPeerStatus\x18\x01 \x01(\bR\x11getFullPeerStatus\x12(\n" +
 	"\x0fshouldRunProbes\x18\x02 \x01(\bR\x0fshouldRunProbes\x12'\n" +
 	"\fwaitForReady\x18\x03 \x01(\bH\x00R\fwaitForReady\x88\x01\x01B\x0f\n" +
-	"\r_waitForReady\"\x82\x01\n" +
+	"\r_waitForReady\"\xca\x01\n" +
 	"\x0eStatusResponse\x12\x16\n" +
 	"\x06status\x18\x01 \x01(\tR\x06status\x122\n" +
 	"\n" +
 	"fullStatus\x18\x02 \x01(\v2\x12.daemon.FullStatusR\n" +
 	"fullStatus\x12$\n" +
-	"\rdaemonVersion\x18\x03 \x01(\tR\rdaemonVersion\"\r\n" +
+	"\rdaemonVersion\x18\x03 \x01(\tR\rdaemonVersion\x12F\n" +
+	"\x10sessionExpiresAt\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\x10sessionExpiresAt\"\r\n" +
 	"\vDownRequest\"\x0e\n" +
 	"\fDownResponse\"P\n" +
 	"\x10GetConfigRequest\x12 \n" +
 	"\vprofileName\x18\x01 \x01(\tR\vprofileName\x12\x1a\n" +
-	"\busername\x18\x02 \x01(\tR\busername\"\xaa\t\n" +
+	"\busername\x18\x02 \x01(\tR\busername\"\xd8\t\n" +
 	"\x11GetConfigResponse\x12$\n" +
 	"\rmanagementUrl\x18\x01 \x01(\tR\rmanagementUrl\x12\x1e\n" +
 	"\n" +
@@ -6612,7 +7247,8 @@ const file_daemon_proto_rawDesc = "" +
 	"\x1denableSSHRemotePortForwarding\x18\x17 \x01(\bR\x1denableSSHRemotePortForwarding\x12&\n" +
 	"\x0edisableSSHAuth\x18\x19 \x01(\bR\x0edisableSSHAuth\x12&\n" +
 	"\x0esshJWTCacheTTL\x18\x1a \x01(\x05R\x0esshJWTCacheTTL\x12!\n" +
-	"\fdisable_ipv6\x18\x1b \x01(\bR\vdisableIpv6\x12*\n" +
+	"\fdisable_ipv6\x18\x1b \x01(\bR\vdisableIpv6\x12,\n" +
+	"\x11remoteJobsAllowed\x18\x1d \x01(\bR\x11remoteJobsAllowed\x12*\n" +
 	"\x10mDMManagedFields\x18\x1c \x03(\tR\x10mDMManagedFields\"\x92\x06\n" +
 	"\tPeerState\x12\x0e\n" +
 	"\x02IP\x18\x01 \x01(\tR\x02IP\x12\x16\n" +
@@ -6676,7 +7312,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\fportForwards\x18\x05 \x03(\tR\fportForwards\"^\n" +
 	"\x0eSSHServerState\x12\x18\n" +
 	"\aenabled\x18\x01 \x01(\bR\aenabled\x122\n" +
-	"\bsessions\x18\x02 \x03(\v2\x16.daemon.SSHSessionInfoR\bsessions\"\xaf\x04\n" +
+	"\bsessions\x18\x02 \x03(\v2\x16.daemon.SSHSessionInfoR\bsessions\"\xdf\x04\n" +
 	"\n" +
 	"FullStatus\x12A\n" +
 	"\x0fmanagementState\x18\x01 \x01(\v2\x17.daemon.ManagementStateR\x0fmanagementState\x125\n" +
@@ -6685,12 +7321,13 @@ const file_daemon_proto_rawDesc = "" +
 	"\x05peers\x18\x04 \x03(\v2\x11.daemon.PeerStateR\x05peers\x12*\n" +
 	"\x06relays\x18\x05 \x03(\v2\x12.daemon.RelayStateR\x06relays\x125\n" +
 	"\vdns_servers\x18\x06 \x03(\v2\x14.daemon.NSGroupStateR\n" +
-	"dnsServers\x128\n" +
-	"\x17NumberOfForwardingRules\x18\b \x01(\x05R\x17NumberOfForwardingRules\x12+\n" +
+	"dnsServers\x12<\n" +
+	"\x17NumberOfForwardingRules\x18\b \x01(\x05B\x02\x18\x01R\x17NumberOfForwardingRules\x12+\n" +
 	"\x06events\x18\a \x03(\v2\x13.daemon.SystemEventR\x06events\x124\n" +
 	"\x15lazyConnectionEnabled\x18\t \x01(\bR\x15lazyConnectionEnabled\x12>\n" +
 	"\x0esshServerState\x18\n" +
-	" \x01(\v2\x16.daemon.SSHServerStateR\x0esshServerState\"\x15\n" +
+	" \x01(\v2\x16.daemon.SSHServerStateR\x0esshServerState\x12*\n" +
+	"\x10networksRevision\x18\v \x01(\x04R\x10networksRevision\"\x15\n" +
 	"\x13ListNetworksRequest\"?\n" +
 	"\x14ListNetworksResponse\x12'\n" +
 	"\x06routes\x18\x01 \x03(\v2\x0f.daemon.NetworkR\x06routes\"a\n" +
@@ -6711,22 +7348,22 @@ const file_daemon_proto_rawDesc = "" +
 	"\vresolvedIPs\x18\x05 \x03(\v2 .daemon.Network.ResolvedIPsEntryR\vresolvedIPs\x1aN\n" +
 	"\x10ResolvedIPsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12$\n" +
-	"\x05value\x18\x02 \x01(\v2\x0e.daemon.IPListR\x05value:\x028\x01\"\x92\x01\n" +
+	"\x05value\x18\x02 \x01(\v2\x0e.daemon.IPListR\x05value:\x028\x01\"\x96\x01\n" +
 	"\bPortInfo\x12\x14\n" +
 	"\x04port\x18\x01 \x01(\rH\x00R\x04port\x12.\n" +
 	"\x05range\x18\x02 \x01(\v2\x16.daemon.PortInfo.RangeH\x00R\x05range\x1a/\n" +
 	"\x05Range\x12\x14\n" +
 	"\x05start\x18\x01 \x01(\rR\x05start\x12\x10\n" +
-	"\x03end\x18\x02 \x01(\rR\x03endB\x0f\n" +
-	"\rportSelection\"\x80\x02\n" +
+	"\x03end\x18\x02 \x01(\rR\x03end:\x02\x18\x01B\x0f\n" +
+	"\rportSelection\"\x84\x02\n" +
 	"\x0eForwardingRule\x12\x1a\n" +
 	"\bprotocol\x18\x01 \x01(\tR\bprotocol\x12:\n" +
 	"\x0fdestinationPort\x18\x02 \x01(\v2\x10.daemon.PortInfoR\x0fdestinationPort\x12,\n" +
 	"\x11translatedAddress\x18\x03 \x01(\tR\x11translatedAddress\x12.\n" +
 	"\x12translatedHostname\x18\x04 \x01(\tR\x12translatedHostname\x128\n" +
-	"\x0etranslatedPort\x18\x05 \x01(\v2\x10.daemon.PortInfoR\x0etranslatedPort\"G\n" +
+	"\x0etranslatedPort\x18\x05 \x01(\v2\x10.daemon.PortInfoR\x0etranslatedPort:\x02\x18\x01\"K\n" +
 	"\x17ForwardingRulesResponse\x12,\n" +
-	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\xb4\x01\n" +
+	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules:\x02\x18\x01\"\x84\x02\n" +
 	"\x12DebugBundleRequest\x12\x1c\n" +
 	"\tanonymize\x18\x01 \x01(\bR\tanonymize\x12\x1e\n" +
 	"\n" +
@@ -6736,7 +7373,9 @@ const file_daemon_proto_rawDesc = "" +
 	"\flogFileCount\x18\x05 \x01(\rR\flogFileCount\x12\x1e\n" +
 	"\n" +
 	"cliVersion\x18\x06 \x01(\tR\n" +
-	"cliVersion\"}\n" +
+	"cliVersion\x12&\n" +
+	"\x0euploadInsecure\x18\a \x01(\bR\x0euploadInsecure\x12&\n" +
+	"\x0eanonymizeLevel\x18\b \x01(\tR\x0eanonymizeLevel\"}\n" +
 	"\x13DebugBundleResponse\x12\x12\n" +
 	"\x04path\x18\x01 \x01(\tR\x04path\x12 \n" +
 	"\vuploadedKey\x18\x02 \x01(\tR\vuploadedKey\x120\n" +
@@ -6746,7 +7385,10 @@ const file_daemon_proto_rawDesc = "" +
 	"\x05level\x18\x01 \x01(\x0e2\x10.daemon.LogLevelR\x05level\"<\n" +
 	"\x12SetLogLevelRequest\x12&\n" +
 	"\x05level\x18\x01 \x01(\x0e2\x10.daemon.LogLevelR\x05level\"\x15\n" +
-	"\x13SetLogLevelResponse\"\x1b\n" +
+	"\x13SetLogLevelResponse\"*\n" +
+	"\x14RegisterUILogRequest\x12\x12\n" +
+	"\x04path\x18\x01 \x01(\tR\x04path\"\x17\n" +
+	"\x15RegisterUILogResponse\"\x1b\n" +
 	"\x05State\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\"\x13\n" +
 	"\x11ListStatesRequest\";\n" +
@@ -6834,7 +7476,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\f_profileNameB\v\n" +
 	"\t_username\"'\n" +
 	"\x15SwitchProfileResponse\x12\x0e\n" +
-	"\x02id\x18\x01 \x01(\tR\x02id\"\x98\x11\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\"\x84\x13\n" +
 	"\x10SetConfigRequest\x12\x1a\n" +
 	"\busername\x18\x01 \x01(\tR\busername\x12 \n" +
 	"\vprofileName\x18\x02 \x01(\tR\vprofileName\x12$\n" +
@@ -6874,7 +7516,10 @@ const file_daemon_proto_rawDesc = "" +
 	"\x1denableSSHRemotePortForwarding\x18  \x01(\bH\x15R\x1denableSSHRemotePortForwarding\x88\x01\x01\x12+\n" +
 	"\x0edisableSSHAuth\x18! \x01(\bH\x16R\x0edisableSSHAuth\x88\x01\x01\x12+\n" +
 	"\x0esshJWTCacheTTL\x18\" \x01(\x05H\x17R\x0esshJWTCacheTTL\x88\x01\x01\x12&\n" +
-	"\fdisable_ipv6\x18# \x01(\bH\x18R\vdisableIpv6\x88\x01\x01B\x13\n" +
+	"\fdisable_ipv6\x18# \x01(\bH\x18R\vdisableIpv6\x88\x01\x01\x125\n" +
+	"\x14enable_local_metrics\x18$ \x01(\bH\x19R\x12enableLocalMetrics\x88\x01\x01\x127\n" +
+	"\x15local_metrics_address\x18% \x01(\tH\x1aR\x13localMetricsAddress\x88\x01\x01\x121\n" +
+	"\x11remoteJobsAllowed\x18& \x01(\bH\x1bR\x11remoteJobsAllowed\x88\x01\x01B\x13\n" +
 	"\x11_rosenpassEnabledB\x10\n" +
 	"\x0e_interfaceNameB\x10\n" +
 	"\x0e_wireguardPortB\x17\n" +
@@ -6899,7 +7544,10 @@ const file_daemon_proto_rawDesc = "" +
 	"\x1e_enableSSHRemotePortForwardingB\x11\n" +
 	"\x0f_disableSSHAuthB\x11\n" +
 	"\x0f_sshJWTCacheTTLB\x0f\n" +
-	"\r_disable_ipv6\"\x13\n" +
+	"\r_disable_ipv6B\x17\n" +
+	"\x15_enable_local_metricsB\x18\n" +
+	"\x16_local_metrics_addressB\x14\n" +
+	"\x12_remoteJobsAllowed\"\x13\n" +
 	"\x11SetConfigResponse\"Q\n" +
 	"\x11AddProfileRequest\x12\x1a\n" +
 	"\busername\x18\x01 \x01(\tR\busername\x12 \n" +
@@ -6935,12 +7583,16 @@ const file_daemon_proto_rawDesc = "" +
 	"\busername\x18\x02 \x01(\tH\x01R\busername\x88\x01\x01B\x0e\n" +
 	"\f_profileNameB\v\n" +
 	"\t_username\"\x10\n" +
-	"\x0eLogoutResponse\"\x14\n" +
-	"\x12GetFeaturesRequest\"\xa3\x01\n" +
+	"\x0eLogoutResponse\"\x15\n" +
+	"\x13WailsUIReadyRequest\"\x16\n" +
+	"\x14WailsUIReadyResponse\"\x14\n" +
+	"\x12GetFeaturesRequest\"\xf6\x01\n" +
 	"\x13GetFeaturesResponse\x12)\n" +
 	"\x10disable_profiles\x18\x01 \x01(\bR\x0fdisableProfiles\x126\n" +
 	"\x17disable_update_settings\x18\x02 \x01(\bR\x15disableUpdateSettings\x12)\n" +
-	"\x10disable_networks\x18\x03 \x01(\bR\x0fdisableNetworks\"3\n" +
+	"\x10disable_networks\x18\x03 \x01(\bR\x0fdisableNetworks\x127\n" +
+	"\x15disable_advanced_view\x18\x04 \x01(\bH\x00R\x13disableAdvancedView\x88\x01\x01B\x18\n" +
+	"\x16_disable_advanced_view\"3\n" +
 	"\x19MDMManagedFieldsViolation\x12\x16\n" +
 	"\x06fields\x18\x01 \x03(\tR\x06fields\"\x16\n" +
 	"\x14TriggerUpdateRequest\"M\n" +
@@ -6955,9 +7607,10 @@ const file_daemon_proto_rawDesc = "" +
 	"sshHostKey\x12\x16\n" +
 	"\x06peerIP\x18\x02 \x01(\tR\x06peerIP\x12\x1a\n" +
 	"\bpeerFQDN\x18\x03 \x01(\tR\bpeerFQDN\x12\x14\n" +
-	"\x05found\x18\x04 \x01(\bR\x05found\"9\n" +
+	"\x05found\x18\x04 \x01(\bR\x05found\"k\n" +
 	"\x15RequestJWTAuthRequest\x12\x17\n" +
-	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01B\a\n" +
+	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01\x120\n" +
+	"\x13hasGraphicalSession\x18\x02 \x01(\bR\x13hasGraphicalSessionB\a\n" +
 	"\x05_hint\"\x9a\x02\n" +
 	"\x16RequestJWTAuthResponse\x12(\n" +
 	"\x0fverificationURI\x18\x01 \x01(\tR\x0fverificationURI\x128\n" +
@@ -6977,7 +7630,28 @@ const file_daemon_proto_rawDesc = "" +
 	"\x14WaitJWTTokenResponse\x12\x14\n" +
 	"\x05token\x18\x01 \x01(\tR\x05token\x12\x1c\n" +
 	"\ttokenType\x18\x02 \x01(\tR\ttokenType\x12\x1c\n" +
-	"\texpiresIn\x18\x03 \x01(\x03R\texpiresIn\"\x18\n" +
+	"\texpiresIn\x18\x03 \x01(\x03R\texpiresIn\"u\n" +
+	"\x1fRequestExtendAuthSessionRequest\x12\x17\n" +
+	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01\x120\n" +
+	"\x13hasGraphicalSession\x18\x02 \x01(\bR\x13hasGraphicalSessionB\a\n" +
+	"\x05_hint\"\xe0\x01\n" +
+	" RequestExtendAuthSessionResponse\x12(\n" +
+	"\x0fverificationURI\x18\x01 \x01(\tR\x0fverificationURI\x128\n" +
+	"\x17verificationURIComplete\x18\x02 \x01(\tR\x17verificationURIComplete\x12\x1a\n" +
+	"\buserCode\x18\x03 \x01(\tR\buserCode\x12\x1e\n" +
+	"\n" +
+	"deviceCode\x18\x04 \x01(\tR\n" +
+	"deviceCode\x12\x1c\n" +
+	"\texpiresIn\x18\x05 \x01(\x03R\texpiresIn\"Z\n" +
+	"\x1cWaitExtendAuthSessionRequest\x12\x1e\n" +
+	"\n" +
+	"deviceCode\x18\x01 \x01(\tR\n" +
+	"deviceCode\x12\x1a\n" +
+	"\buserCode\x18\x02 \x01(\tR\buserCode\"g\n" +
+	"\x1dWaitExtendAuthSessionResponse\x12F\n" +
+	"\x10sessionExpiresAt\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\x10sessionExpiresAt\"\x1e\n" +
+	"\x1cDismissSessionWarningRequest\"\x1f\n" +
+	"\x1dDismissSessionWarningResponse\"\x18\n" +
 	"\x16StartCPUProfileRequest\"\x19\n" +
 	"\x17StartCPUProfileResponse\"\x17\n" +
 	"\x15StopCPUProfileRequest\"\x18\n" +
@@ -7040,18 +7714,19 @@ const file_daemon_proto_rawDesc = "" +
 	"\n" +
 	"EXPOSE_UDP\x10\x03\x12\x0e\n" +
 	"\n" +
-	"EXPOSE_TLS\x10\x042\xff\x17\n" +
+	"EXPOSE_TLS\x10\x042\xa6\x1c\n" +
 	"\rDaemonService\x126\n" +
 	"\x05Login\x12\x14.daemon.LoginRequest\x1a\x15.daemon.LoginResponse\"\x00\x12K\n" +
 	"\fWaitSSOLogin\x12\x1b.daemon.WaitSSOLoginRequest\x1a\x1c.daemon.WaitSSOLoginResponse\"\x00\x12-\n" +
 	"\x02Up\x12\x11.daemon.UpRequest\x1a\x12.daemon.UpResponse\"\x00\x129\n" +
-	"\x06Status\x12\x15.daemon.StatusRequest\x1a\x16.daemon.StatusResponse\"\x00\x123\n" +
+	"\x06Status\x12\x15.daemon.StatusRequest\x1a\x16.daemon.StatusResponse\"\x00\x12D\n" +
+	"\x0fSubscribeStatus\x12\x15.daemon.StatusRequest\x1a\x16.daemon.StatusResponse\"\x000\x01\x123\n" +
 	"\x04Down\x12\x13.daemon.DownRequest\x1a\x14.daemon.DownResponse\"\x00\x12B\n" +
 	"\tGetConfig\x12\x18.daemon.GetConfigRequest\x1a\x19.daemon.GetConfigResponse\"\x00\x12K\n" +
 	"\fListNetworks\x12\x1b.daemon.ListNetworksRequest\x1a\x1c.daemon.ListNetworksResponse\"\x00\x12Q\n" +
 	"\x0eSelectNetworks\x12\x1d.daemon.SelectNetworksRequest\x1a\x1e.daemon.SelectNetworksResponse\"\x00\x12S\n" +
-	"\x10DeselectNetworks\x12\x1d.daemon.SelectNetworksRequest\x1a\x1e.daemon.SelectNetworksResponse\"\x00\x12J\n" +
-	"\x0fForwardingRules\x12\x14.daemon.EmptyRequest\x1a\x1f.daemon.ForwardingRulesResponse\"\x00\x12H\n" +
+	"\x10DeselectNetworks\x12\x1d.daemon.SelectNetworksRequest\x1a\x1e.daemon.SelectNetworksResponse\"\x00\x12M\n" +
+	"\x0fForwardingRules\x12\x14.daemon.EmptyRequest\x1a\x1f.daemon.ForwardingRulesResponse\"\x03\x88\x02\x01\x12H\n" +
 	"\vDebugBundle\x12\x1a.daemon.DebugBundleRequest\x1a\x1b.daemon.DebugBundleResponse\"\x00\x12H\n" +
 	"\vGetLogLevel\x12\x1a.daemon.GetLogLevelRequest\x1a\x1b.daemon.GetLogLevelResponse\"\x00\x12H\n" +
 	"\vSetLogLevel\x12\x1a.daemon.SetLogLevelRequest\x1a\x1b.daemon.SetLogLevelResponse\"\x00\x12E\n" +
@@ -7067,6 +7742,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x11StopBundleCapture\x12 .daemon.StopBundleCaptureRequest\x1a!.daemon.StopBundleCaptureResponse\"\x00\x12D\n" +
 	"\x0fSubscribeEvents\x12\x18.daemon.SubscribeRequest\x1a\x13.daemon.SystemEvent\"\x000\x01\x12B\n" +
 	"\tGetEvents\x12\x18.daemon.GetEventsRequest\x1a\x19.daemon.GetEventsResponse\"\x00\x12N\n" +
+	"\rRegisterUILog\x12\x1c.daemon.RegisterUILogRequest\x1a\x1d.daemon.RegisterUILogResponse\"\x00\x12N\n" +
 	"\rSwitchProfile\x12\x1c.daemon.SwitchProfileRequest\x1a\x1d.daemon.SwitchProfileResponse\"\x00\x12B\n" +
 	"\tSetConfig\x12\x18.daemon.SetConfigRequest\x1a\x19.daemon.SetConfigResponse\"\x00\x12E\n" +
 	"\n" +
@@ -7080,11 +7756,15 @@ const file_daemon_proto_rawDesc = "" +
 	"\rTriggerUpdate\x12\x1c.daemon.TriggerUpdateRequest\x1a\x1d.daemon.TriggerUpdateResponse\"\x00\x12Z\n" +
 	"\x11GetPeerSSHHostKey\x12 .daemon.GetPeerSSHHostKeyRequest\x1a!.daemon.GetPeerSSHHostKeyResponse\"\x00\x12Q\n" +
 	"\x0eRequestJWTAuth\x12\x1d.daemon.RequestJWTAuthRequest\x1a\x1e.daemon.RequestJWTAuthResponse\"\x00\x12K\n" +
-	"\fWaitJWTToken\x12\x1b.daemon.WaitJWTTokenRequest\x1a\x1c.daemon.WaitJWTTokenResponse\"\x00\x12T\n" +
+	"\fWaitJWTToken\x12\x1b.daemon.WaitJWTTokenRequest\x1a\x1c.daemon.WaitJWTTokenResponse\"\x00\x12o\n" +
+	"\x18RequestExtendAuthSession\x12'.daemon.RequestExtendAuthSessionRequest\x1a(.daemon.RequestExtendAuthSessionResponse\"\x00\x12f\n" +
+	"\x15WaitExtendAuthSession\x12$.daemon.WaitExtendAuthSessionRequest\x1a%.daemon.WaitExtendAuthSessionResponse\"\x00\x12f\n" +
+	"\x15DismissSessionWarning\x12$.daemon.DismissSessionWarningRequest\x1a%.daemon.DismissSessionWarningResponse\"\x00\x12T\n" +
 	"\x0fStartCPUProfile\x12\x1e.daemon.StartCPUProfileRequest\x1a\x1f.daemon.StartCPUProfileResponse\"\x00\x12Q\n" +
 	"\x0eStopCPUProfile\x12\x1d.daemon.StopCPUProfileRequest\x1a\x1e.daemon.StopCPUProfileResponse\"\x00\x12W\n" +
 	"\x12GetInstallerResult\x12\x1e.daemon.InstallerResultRequest\x1a\x1f.daemon.InstallerResultResponse\"\x00\x12M\n" +
-	"\rExposeService\x12\x1c.daemon.ExposeServiceRequest\x1a\x1a.daemon.ExposeServiceEvent\"\x000\x01B\bZ\x06/protob\x06proto3"
+	"\rExposeService\x12\x1c.daemon.ExposeServiceRequest\x1a\x1a.daemon.ExposeServiceEvent\"\x000\x01\x12K\n" +
+	"\fWailsUIReady\x12\x1b.daemon.WailsUIReadyRequest\x1a\x1c.daemon.WailsUIReadyResponse\"\x00B\bZ\x06/protob\x06proto3"
 
 var (
 	file_daemon_proto_rawDescOnce sync.Once
@@ -7099,7 +7779,7 @@ func file_daemon_proto_rawDescGZIP() []byte {
 }
 
 var file_daemon_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
-var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 100)
+var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 110)
 var file_daemon_proto_goTypes = []any{
 	(LogLevel)(0),                              // 0: daemon.LogLevel
 	(ExposeProtocol)(0),                        // 1: daemon.ExposeProtocol
@@ -7142,195 +7822,219 @@ var file_daemon_proto_goTypes = []any{
 	(*GetLogLevelResponse)(nil),                // 38: daemon.GetLogLevelResponse
 	(*SetLogLevelRequest)(nil),                 // 39: daemon.SetLogLevelRequest
 	(*SetLogLevelResponse)(nil),                // 40: daemon.SetLogLevelResponse
-	(*State)(nil),                              // 41: daemon.State
-	(*ListStatesRequest)(nil),                  // 42: daemon.ListStatesRequest
-	(*ListStatesResponse)(nil),                 // 43: daemon.ListStatesResponse
-	(*CleanStateRequest)(nil),                  // 44: daemon.CleanStateRequest
-	(*CleanStateResponse)(nil),                 // 45: daemon.CleanStateResponse
-	(*DeleteStateRequest)(nil),                 // 46: daemon.DeleteStateRequest
-	(*DeleteStateResponse)(nil),                // 47: daemon.DeleteStateResponse
-	(*SetSyncResponsePersistenceRequest)(nil),  // 48: daemon.SetSyncResponsePersistenceRequest
-	(*SetSyncResponsePersistenceResponse)(nil), // 49: daemon.SetSyncResponsePersistenceResponse
-	(*TCPFlags)(nil),                           // 50: daemon.TCPFlags
-	(*TracePacketRequest)(nil),                 // 51: daemon.TracePacketRequest
-	(*TraceStage)(nil),                         // 52: daemon.TraceStage
-	(*TracePacketResponse)(nil),                // 53: daemon.TracePacketResponse
-	(*SubscribeRequest)(nil),                   // 54: daemon.SubscribeRequest
-	(*SystemEvent)(nil),                        // 55: daemon.SystemEvent
-	(*GetEventsRequest)(nil),                   // 56: daemon.GetEventsRequest
-	(*GetEventsResponse)(nil),                  // 57: daemon.GetEventsResponse
-	(*SwitchProfileRequest)(nil),               // 58: daemon.SwitchProfileRequest
-	(*SwitchProfileResponse)(nil),              // 59: daemon.SwitchProfileResponse
-	(*SetConfigRequest)(nil),                   // 60: daemon.SetConfigRequest
-	(*SetConfigResponse)(nil),                  // 61: daemon.SetConfigResponse
-	(*AddProfileRequest)(nil),                  // 62: daemon.AddProfileRequest
-	(*AddProfileResponse)(nil),                 // 63: daemon.AddProfileResponse
-	(*RenameProfileRequest)(nil),               // 64: daemon.RenameProfileRequest
-	(*RenameProfileResponse)(nil),              // 65: daemon.RenameProfileResponse
-	(*RemoveProfileRequest)(nil),               // 66: daemon.RemoveProfileRequest
-	(*RemoveProfileResponse)(nil),              // 67: daemon.RemoveProfileResponse
-	(*ListProfilesRequest)(nil),                // 68: daemon.ListProfilesRequest
-	(*ListProfilesResponse)(nil),               // 69: daemon.ListProfilesResponse
-	(*Profile)(nil),                            // 70: daemon.Profile
-	(*GetActiveProfileRequest)(nil),            // 71: daemon.GetActiveProfileRequest
-	(*GetActiveProfileResponse)(nil),           // 72: daemon.GetActiveProfileResponse
-	(*LogoutRequest)(nil),                      // 73: daemon.LogoutRequest
-	(*LogoutResponse)(nil),                     // 74: daemon.LogoutResponse
-	(*GetFeaturesRequest)(nil),                 // 75: daemon.GetFeaturesRequest
-	(*GetFeaturesResponse)(nil),                // 76: daemon.GetFeaturesResponse
-	(*MDMManagedFieldsViolation)(nil),          // 77: daemon.MDMManagedFieldsViolation
-	(*TriggerUpdateRequest)(nil),               // 78: daemon.TriggerUpdateRequest
-	(*TriggerUpdateResponse)(nil),              // 79: daemon.TriggerUpdateResponse
-	(*GetPeerSSHHostKeyRequest)(nil),           // 80: daemon.GetPeerSSHHostKeyRequest
-	(*GetPeerSSHHostKeyResponse)(nil),          // 81: daemon.GetPeerSSHHostKeyResponse
-	(*RequestJWTAuthRequest)(nil),              // 82: daemon.RequestJWTAuthRequest
-	(*RequestJWTAuthResponse)(nil),             // 83: daemon.RequestJWTAuthResponse
-	(*WaitJWTTokenRequest)(nil),                // 84: daemon.WaitJWTTokenRequest
-	(*WaitJWTTokenResponse)(nil),               // 85: daemon.WaitJWTTokenResponse
-	(*StartCPUProfileRequest)(nil),             // 86: daemon.StartCPUProfileRequest
-	(*StartCPUProfileResponse)(nil),            // 87: daemon.StartCPUProfileResponse
-	(*StopCPUProfileRequest)(nil),              // 88: daemon.StopCPUProfileRequest
-	(*StopCPUProfileResponse)(nil),             // 89: daemon.StopCPUProfileResponse
-	(*InstallerResultRequest)(nil),             // 90: daemon.InstallerResultRequest
-	(*InstallerResultResponse)(nil),            // 91: daemon.InstallerResultResponse
-	(*ExposeServiceRequest)(nil),               // 92: daemon.ExposeServiceRequest
-	(*ExposeServiceEvent)(nil),                 // 93: daemon.ExposeServiceEvent
-	(*ExposeServiceReady)(nil),                 // 94: daemon.ExposeServiceReady
-	(*StartCaptureRequest)(nil),                // 95: daemon.StartCaptureRequest
-	(*CapturePacket)(nil),                      // 96: daemon.CapturePacket
-	(*StartBundleCaptureRequest)(nil),          // 97: daemon.StartBundleCaptureRequest
-	(*StartBundleCaptureResponse)(nil),         // 98: daemon.StartBundleCaptureResponse
-	(*StopBundleCaptureRequest)(nil),           // 99: daemon.StopBundleCaptureRequest
-	(*StopBundleCaptureResponse)(nil),          // 100: daemon.StopBundleCaptureResponse
-	nil,                                        // 101: daemon.Network.ResolvedIPsEntry
-	(*PortInfo_Range)(nil),                     // 102: daemon.PortInfo.Range
-	nil,                                        // 103: daemon.SystemEvent.MetadataEntry
-	(*durationpb.Duration)(nil),                // 104: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),              // 105: google.protobuf.Timestamp
+	(*RegisterUILogRequest)(nil),               // 41: daemon.RegisterUILogRequest
+	(*RegisterUILogResponse)(nil),              // 42: daemon.RegisterUILogResponse
+	(*State)(nil),                              // 43: daemon.State
+	(*ListStatesRequest)(nil),                  // 44: daemon.ListStatesRequest
+	(*ListStatesResponse)(nil),                 // 45: daemon.ListStatesResponse
+	(*CleanStateRequest)(nil),                  // 46: daemon.CleanStateRequest
+	(*CleanStateResponse)(nil),                 // 47: daemon.CleanStateResponse
+	(*DeleteStateRequest)(nil),                 // 48: daemon.DeleteStateRequest
+	(*DeleteStateResponse)(nil),                // 49: daemon.DeleteStateResponse
+	(*SetSyncResponsePersistenceRequest)(nil),  // 50: daemon.SetSyncResponsePersistenceRequest
+	(*SetSyncResponsePersistenceResponse)(nil), // 51: daemon.SetSyncResponsePersistenceResponse
+	(*TCPFlags)(nil),                           // 52: daemon.TCPFlags
+	(*TracePacketRequest)(nil),                 // 53: daemon.TracePacketRequest
+	(*TraceStage)(nil),                         // 54: daemon.TraceStage
+	(*TracePacketResponse)(nil),                // 55: daemon.TracePacketResponse
+	(*SubscribeRequest)(nil),                   // 56: daemon.SubscribeRequest
+	(*SystemEvent)(nil),                        // 57: daemon.SystemEvent
+	(*GetEventsRequest)(nil),                   // 58: daemon.GetEventsRequest
+	(*GetEventsResponse)(nil),                  // 59: daemon.GetEventsResponse
+	(*SwitchProfileRequest)(nil),               // 60: daemon.SwitchProfileRequest
+	(*SwitchProfileResponse)(nil),              // 61: daemon.SwitchProfileResponse
+	(*SetConfigRequest)(nil),                   // 62: daemon.SetConfigRequest
+	(*SetConfigResponse)(nil),                  // 63: daemon.SetConfigResponse
+	(*AddProfileRequest)(nil),                  // 64: daemon.AddProfileRequest
+	(*AddProfileResponse)(nil),                 // 65: daemon.AddProfileResponse
+	(*RenameProfileRequest)(nil),               // 66: daemon.RenameProfileRequest
+	(*RenameProfileResponse)(nil),              // 67: daemon.RenameProfileResponse
+	(*RemoveProfileRequest)(nil),               // 68: daemon.RemoveProfileRequest
+	(*RemoveProfileResponse)(nil),              // 69: daemon.RemoveProfileResponse
+	(*ListProfilesRequest)(nil),                // 70: daemon.ListProfilesRequest
+	(*ListProfilesResponse)(nil),               // 71: daemon.ListProfilesResponse
+	(*Profile)(nil),                            // 72: daemon.Profile
+	(*GetActiveProfileRequest)(nil),            // 73: daemon.GetActiveProfileRequest
+	(*GetActiveProfileResponse)(nil),           // 74: daemon.GetActiveProfileResponse
+	(*LogoutRequest)(nil),                      // 75: daemon.LogoutRequest
+	(*LogoutResponse)(nil),                     // 76: daemon.LogoutResponse
+	(*WailsUIReadyRequest)(nil),                // 77: daemon.WailsUIReadyRequest
+	(*WailsUIReadyResponse)(nil),               // 78: daemon.WailsUIReadyResponse
+	(*GetFeaturesRequest)(nil),                 // 79: daemon.GetFeaturesRequest
+	(*GetFeaturesResponse)(nil),                // 80: daemon.GetFeaturesResponse
+	(*MDMManagedFieldsViolation)(nil),          // 81: daemon.MDMManagedFieldsViolation
+	(*TriggerUpdateRequest)(nil),               // 82: daemon.TriggerUpdateRequest
+	(*TriggerUpdateResponse)(nil),              // 83: daemon.TriggerUpdateResponse
+	(*GetPeerSSHHostKeyRequest)(nil),           // 84: daemon.GetPeerSSHHostKeyRequest
+	(*GetPeerSSHHostKeyResponse)(nil),          // 85: daemon.GetPeerSSHHostKeyResponse
+	(*RequestJWTAuthRequest)(nil),              // 86: daemon.RequestJWTAuthRequest
+	(*RequestJWTAuthResponse)(nil),             // 87: daemon.RequestJWTAuthResponse
+	(*WaitJWTTokenRequest)(nil),                // 88: daemon.WaitJWTTokenRequest
+	(*WaitJWTTokenResponse)(nil),               // 89: daemon.WaitJWTTokenResponse
+	(*RequestExtendAuthSessionRequest)(nil),    // 90: daemon.RequestExtendAuthSessionRequest
+	(*RequestExtendAuthSessionResponse)(nil),   // 91: daemon.RequestExtendAuthSessionResponse
+	(*WaitExtendAuthSessionRequest)(nil),       // 92: daemon.WaitExtendAuthSessionRequest
+	(*WaitExtendAuthSessionResponse)(nil),      // 93: daemon.WaitExtendAuthSessionResponse
+	(*DismissSessionWarningRequest)(nil),       // 94: daemon.DismissSessionWarningRequest
+	(*DismissSessionWarningResponse)(nil),      // 95: daemon.DismissSessionWarningResponse
+	(*StartCPUProfileRequest)(nil),             // 96: daemon.StartCPUProfileRequest
+	(*StartCPUProfileResponse)(nil),            // 97: daemon.StartCPUProfileResponse
+	(*StopCPUProfileRequest)(nil),              // 98: daemon.StopCPUProfileRequest
+	(*StopCPUProfileResponse)(nil),             // 99: daemon.StopCPUProfileResponse
+	(*InstallerResultRequest)(nil),             // 100: daemon.InstallerResultRequest
+	(*InstallerResultResponse)(nil),            // 101: daemon.InstallerResultResponse
+	(*ExposeServiceRequest)(nil),               // 102: daemon.ExposeServiceRequest
+	(*ExposeServiceEvent)(nil),                 // 103: daemon.ExposeServiceEvent
+	(*ExposeServiceReady)(nil),                 // 104: daemon.ExposeServiceReady
+	(*StartCaptureRequest)(nil),                // 105: daemon.StartCaptureRequest
+	(*CapturePacket)(nil),                      // 106: daemon.CapturePacket
+	(*StartBundleCaptureRequest)(nil),          // 107: daemon.StartBundleCaptureRequest
+	(*StartBundleCaptureResponse)(nil),         // 108: daemon.StartBundleCaptureResponse
+	(*StopBundleCaptureRequest)(nil),           // 109: daemon.StopBundleCaptureRequest
+	(*StopBundleCaptureResponse)(nil),          // 110: daemon.StopBundleCaptureResponse
+	nil,                                        // 111: daemon.Network.ResolvedIPsEntry
+	(*PortInfo_Range)(nil),                     // 112: daemon.PortInfo.Range
+	nil,                                        // 113: daemon.SystemEvent.MetadataEntry
+	(*durationpb.Duration)(nil),                // 114: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),              // 115: google.protobuf.Timestamp
 }
 var file_daemon_proto_depIdxs = []int32{
-	104, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	114, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
 	25,  // 1: daemon.StatusResponse.fullStatus:type_name -> daemon.FullStatus
-	105, // 2: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
-	105, // 3: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
-	104, // 4: daemon.PeerState.latency:type_name -> google.protobuf.Duration
-	23,  // 5: daemon.SSHServerState.sessions:type_name -> daemon.SSHSessionInfo
-	20,  // 6: daemon.FullStatus.managementState:type_name -> daemon.ManagementState
-	19,  // 7: daemon.FullStatus.signalState:type_name -> daemon.SignalState
-	18,  // 8: daemon.FullStatus.localPeerState:type_name -> daemon.LocalPeerState
-	17,  // 9: daemon.FullStatus.peers:type_name -> daemon.PeerState
-	21,  // 10: daemon.FullStatus.relays:type_name -> daemon.RelayState
-	22,  // 11: daemon.FullStatus.dns_servers:type_name -> daemon.NSGroupState
-	55,  // 12: daemon.FullStatus.events:type_name -> daemon.SystemEvent
-	24,  // 13: daemon.FullStatus.sshServerState:type_name -> daemon.SSHServerState
-	31,  // 14: daemon.ListNetworksResponse.routes:type_name -> daemon.Network
-	101, // 15: daemon.Network.resolvedIPs:type_name -> daemon.Network.ResolvedIPsEntry
-	102, // 16: daemon.PortInfo.range:type_name -> daemon.PortInfo.Range
-	32,  // 17: daemon.ForwardingRule.destinationPort:type_name -> daemon.PortInfo
-	32,  // 18: daemon.ForwardingRule.translatedPort:type_name -> daemon.PortInfo
-	33,  // 19: daemon.ForwardingRulesResponse.rules:type_name -> daemon.ForwardingRule
-	0,   // 20: daemon.GetLogLevelResponse.level:type_name -> daemon.LogLevel
-	0,   // 21: daemon.SetLogLevelRequest.level:type_name -> daemon.LogLevel
-	41,  // 22: daemon.ListStatesResponse.states:type_name -> daemon.State
-	50,  // 23: daemon.TracePacketRequest.tcp_flags:type_name -> daemon.TCPFlags
-	52,  // 24: daemon.TracePacketResponse.stages:type_name -> daemon.TraceStage
-	2,   // 25: daemon.SystemEvent.severity:type_name -> daemon.SystemEvent.Severity
-	3,   // 26: daemon.SystemEvent.category:type_name -> daemon.SystemEvent.Category
-	105, // 27: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
-	103, // 28: daemon.SystemEvent.metadata:type_name -> daemon.SystemEvent.MetadataEntry
-	55,  // 29: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
-	104, // 30: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
-	70,  // 31: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
-	1,   // 32: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
-	94,  // 33: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
-	104, // 34: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
-	104, // 35: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
-	30,  // 36: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
-	5,   // 37: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
-	7,   // 38: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
-	9,   // 39: daemon.DaemonService.Up:input_type -> daemon.UpRequest
-	11,  // 40: daemon.DaemonService.Status:input_type -> daemon.StatusRequest
-	13,  // 41: daemon.DaemonService.Down:input_type -> daemon.DownRequest
-	15,  // 42: daemon.DaemonService.GetConfig:input_type -> daemon.GetConfigRequest
-	26,  // 43: daemon.DaemonService.ListNetworks:input_type -> daemon.ListNetworksRequest
-	28,  // 44: daemon.DaemonService.SelectNetworks:input_type -> daemon.SelectNetworksRequest
-	28,  // 45: daemon.DaemonService.DeselectNetworks:input_type -> daemon.SelectNetworksRequest
-	4,   // 46: daemon.DaemonService.ForwardingRules:input_type -> daemon.EmptyRequest
-	35,  // 47: daemon.DaemonService.DebugBundle:input_type -> daemon.DebugBundleRequest
-	37,  // 48: daemon.DaemonService.GetLogLevel:input_type -> daemon.GetLogLevelRequest
-	39,  // 49: daemon.DaemonService.SetLogLevel:input_type -> daemon.SetLogLevelRequest
-	42,  // 50: daemon.DaemonService.ListStates:input_type -> daemon.ListStatesRequest
-	44,  // 51: daemon.DaemonService.CleanState:input_type -> daemon.CleanStateRequest
-	46,  // 52: daemon.DaemonService.DeleteState:input_type -> daemon.DeleteStateRequest
-	48,  // 53: daemon.DaemonService.SetSyncResponsePersistence:input_type -> daemon.SetSyncResponsePersistenceRequest
-	51,  // 54: daemon.DaemonService.TracePacket:input_type -> daemon.TracePacketRequest
-	95,  // 55: daemon.DaemonService.StartCapture:input_type -> daemon.StartCaptureRequest
-	97,  // 56: daemon.DaemonService.StartBundleCapture:input_type -> daemon.StartBundleCaptureRequest
-	99,  // 57: daemon.DaemonService.StopBundleCapture:input_type -> daemon.StopBundleCaptureRequest
-	54,  // 58: daemon.DaemonService.SubscribeEvents:input_type -> daemon.SubscribeRequest
-	56,  // 59: daemon.DaemonService.GetEvents:input_type -> daemon.GetEventsRequest
-	58,  // 60: daemon.DaemonService.SwitchProfile:input_type -> daemon.SwitchProfileRequest
-	60,  // 61: daemon.DaemonService.SetConfig:input_type -> daemon.SetConfigRequest
-	62,  // 62: daemon.DaemonService.AddProfile:input_type -> daemon.AddProfileRequest
-	64,  // 63: daemon.DaemonService.RenameProfile:input_type -> daemon.RenameProfileRequest
-	66,  // 64: daemon.DaemonService.RemoveProfile:input_type -> daemon.RemoveProfileRequest
-	68,  // 65: daemon.DaemonService.ListProfiles:input_type -> daemon.ListProfilesRequest
-	71,  // 66: daemon.DaemonService.GetActiveProfile:input_type -> daemon.GetActiveProfileRequest
-	73,  // 67: daemon.DaemonService.Logout:input_type -> daemon.LogoutRequest
-	75,  // 68: daemon.DaemonService.GetFeatures:input_type -> daemon.GetFeaturesRequest
-	78,  // 69: daemon.DaemonService.TriggerUpdate:input_type -> daemon.TriggerUpdateRequest
-	80,  // 70: daemon.DaemonService.GetPeerSSHHostKey:input_type -> daemon.GetPeerSSHHostKeyRequest
-	82,  // 71: daemon.DaemonService.RequestJWTAuth:input_type -> daemon.RequestJWTAuthRequest
-	84,  // 72: daemon.DaemonService.WaitJWTToken:input_type -> daemon.WaitJWTTokenRequest
-	86,  // 73: daemon.DaemonService.StartCPUProfile:input_type -> daemon.StartCPUProfileRequest
-	88,  // 74: daemon.DaemonService.StopCPUProfile:input_type -> daemon.StopCPUProfileRequest
-	90,  // 75: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
-	92,  // 76: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
-	6,   // 77: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
-	8,   // 78: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
-	10,  // 79: daemon.DaemonService.Up:output_type -> daemon.UpResponse
-	12,  // 80: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
-	14,  // 81: daemon.DaemonService.Down:output_type -> daemon.DownResponse
-	16,  // 82: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
-	27,  // 83: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
-	29,  // 84: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
-	29,  // 85: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
-	34,  // 86: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
-	36,  // 87: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
-	38,  // 88: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
-	40,  // 89: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
-	43,  // 90: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
-	45,  // 91: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
-	47,  // 92: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
-	49,  // 93: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
-	53,  // 94: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
-	96,  // 95: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
-	98,  // 96: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
-	100, // 97: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
-	55,  // 98: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
-	57,  // 99: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
-	59,  // 100: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
-	61,  // 101: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
-	63,  // 102: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
-	65,  // 103: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
-	67,  // 104: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
-	69,  // 105: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
-	72,  // 106: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
-	74,  // 107: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
-	76,  // 108: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
-	79,  // 109: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
-	81,  // 110: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
-	83,  // 111: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
-	85,  // 112: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
-	87,  // 113: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
-	89,  // 114: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
-	91,  // 115: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
-	93,  // 116: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
-	77,  // [77:117] is the sub-list for method output_type
-	37,  // [37:77] is the sub-list for method input_type
-	37,  // [37:37] is the sub-list for extension type_name
-	37,  // [37:37] is the sub-list for extension extendee
-	0,   // [0:37] is the sub-list for field type_name
+	115, // 2: daemon.StatusResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	115, // 3: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
+	115, // 4: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
+	114, // 5: daemon.PeerState.latency:type_name -> google.protobuf.Duration
+	23,  // 6: daemon.SSHServerState.sessions:type_name -> daemon.SSHSessionInfo
+	20,  // 7: daemon.FullStatus.managementState:type_name -> daemon.ManagementState
+	19,  // 8: daemon.FullStatus.signalState:type_name -> daemon.SignalState
+	18,  // 9: daemon.FullStatus.localPeerState:type_name -> daemon.LocalPeerState
+	17,  // 10: daemon.FullStatus.peers:type_name -> daemon.PeerState
+	21,  // 11: daemon.FullStatus.relays:type_name -> daemon.RelayState
+	22,  // 12: daemon.FullStatus.dns_servers:type_name -> daemon.NSGroupState
+	57,  // 13: daemon.FullStatus.events:type_name -> daemon.SystemEvent
+	24,  // 14: daemon.FullStatus.sshServerState:type_name -> daemon.SSHServerState
+	31,  // 15: daemon.ListNetworksResponse.routes:type_name -> daemon.Network
+	111, // 16: daemon.Network.resolvedIPs:type_name -> daemon.Network.ResolvedIPsEntry
+	112, // 17: daemon.PortInfo.range:type_name -> daemon.PortInfo.Range
+	32,  // 18: daemon.ForwardingRule.destinationPort:type_name -> daemon.PortInfo
+	32,  // 19: daemon.ForwardingRule.translatedPort:type_name -> daemon.PortInfo
+	33,  // 20: daemon.ForwardingRulesResponse.rules:type_name -> daemon.ForwardingRule
+	0,   // 21: daemon.GetLogLevelResponse.level:type_name -> daemon.LogLevel
+	0,   // 22: daemon.SetLogLevelRequest.level:type_name -> daemon.LogLevel
+	43,  // 23: daemon.ListStatesResponse.states:type_name -> daemon.State
+	52,  // 24: daemon.TracePacketRequest.tcp_flags:type_name -> daemon.TCPFlags
+	54,  // 25: daemon.TracePacketResponse.stages:type_name -> daemon.TraceStage
+	2,   // 26: daemon.SystemEvent.severity:type_name -> daemon.SystemEvent.Severity
+	3,   // 27: daemon.SystemEvent.category:type_name -> daemon.SystemEvent.Category
+	115, // 28: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
+	113, // 29: daemon.SystemEvent.metadata:type_name -> daemon.SystemEvent.MetadataEntry
+	57,  // 30: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
+	114, // 31: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	72,  // 32: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
+	115, // 33: daemon.WaitExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	1,   // 34: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
+	104, // 35: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
+	114, // 36: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
+	114, // 37: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
+	30,  // 38: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
+	5,   // 39: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
+	7,   // 40: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
+	9,   // 41: daemon.DaemonService.Up:input_type -> daemon.UpRequest
+	11,  // 42: daemon.DaemonService.Status:input_type -> daemon.StatusRequest
+	11,  // 43: daemon.DaemonService.SubscribeStatus:input_type -> daemon.StatusRequest
+	13,  // 44: daemon.DaemonService.Down:input_type -> daemon.DownRequest
+	15,  // 45: daemon.DaemonService.GetConfig:input_type -> daemon.GetConfigRequest
+	26,  // 46: daemon.DaemonService.ListNetworks:input_type -> daemon.ListNetworksRequest
+	28,  // 47: daemon.DaemonService.SelectNetworks:input_type -> daemon.SelectNetworksRequest
+	28,  // 48: daemon.DaemonService.DeselectNetworks:input_type -> daemon.SelectNetworksRequest
+	4,   // 49: daemon.DaemonService.ForwardingRules:input_type -> daemon.EmptyRequest
+	35,  // 50: daemon.DaemonService.DebugBundle:input_type -> daemon.DebugBundleRequest
+	37,  // 51: daemon.DaemonService.GetLogLevel:input_type -> daemon.GetLogLevelRequest
+	39,  // 52: daemon.DaemonService.SetLogLevel:input_type -> daemon.SetLogLevelRequest
+	44,  // 53: daemon.DaemonService.ListStates:input_type -> daemon.ListStatesRequest
+	46,  // 54: daemon.DaemonService.CleanState:input_type -> daemon.CleanStateRequest
+	48,  // 55: daemon.DaemonService.DeleteState:input_type -> daemon.DeleteStateRequest
+	50,  // 56: daemon.DaemonService.SetSyncResponsePersistence:input_type -> daemon.SetSyncResponsePersistenceRequest
+	53,  // 57: daemon.DaemonService.TracePacket:input_type -> daemon.TracePacketRequest
+	105, // 58: daemon.DaemonService.StartCapture:input_type -> daemon.StartCaptureRequest
+	107, // 59: daemon.DaemonService.StartBundleCapture:input_type -> daemon.StartBundleCaptureRequest
+	109, // 60: daemon.DaemonService.StopBundleCapture:input_type -> daemon.StopBundleCaptureRequest
+	56,  // 61: daemon.DaemonService.SubscribeEvents:input_type -> daemon.SubscribeRequest
+	58,  // 62: daemon.DaemonService.GetEvents:input_type -> daemon.GetEventsRequest
+	41,  // 63: daemon.DaemonService.RegisterUILog:input_type -> daemon.RegisterUILogRequest
+	60,  // 64: daemon.DaemonService.SwitchProfile:input_type -> daemon.SwitchProfileRequest
+	62,  // 65: daemon.DaemonService.SetConfig:input_type -> daemon.SetConfigRequest
+	64,  // 66: daemon.DaemonService.AddProfile:input_type -> daemon.AddProfileRequest
+	66,  // 67: daemon.DaemonService.RenameProfile:input_type -> daemon.RenameProfileRequest
+	68,  // 68: daemon.DaemonService.RemoveProfile:input_type -> daemon.RemoveProfileRequest
+	70,  // 69: daemon.DaemonService.ListProfiles:input_type -> daemon.ListProfilesRequest
+	73,  // 70: daemon.DaemonService.GetActiveProfile:input_type -> daemon.GetActiveProfileRequest
+	75,  // 71: daemon.DaemonService.Logout:input_type -> daemon.LogoutRequest
+	79,  // 72: daemon.DaemonService.GetFeatures:input_type -> daemon.GetFeaturesRequest
+	82,  // 73: daemon.DaemonService.TriggerUpdate:input_type -> daemon.TriggerUpdateRequest
+	84,  // 74: daemon.DaemonService.GetPeerSSHHostKey:input_type -> daemon.GetPeerSSHHostKeyRequest
+	86,  // 75: daemon.DaemonService.RequestJWTAuth:input_type -> daemon.RequestJWTAuthRequest
+	88,  // 76: daemon.DaemonService.WaitJWTToken:input_type -> daemon.WaitJWTTokenRequest
+	90,  // 77: daemon.DaemonService.RequestExtendAuthSession:input_type -> daemon.RequestExtendAuthSessionRequest
+	92,  // 78: daemon.DaemonService.WaitExtendAuthSession:input_type -> daemon.WaitExtendAuthSessionRequest
+	94,  // 79: daemon.DaemonService.DismissSessionWarning:input_type -> daemon.DismissSessionWarningRequest
+	96,  // 80: daemon.DaemonService.StartCPUProfile:input_type -> daemon.StartCPUProfileRequest
+	98,  // 81: daemon.DaemonService.StopCPUProfile:input_type -> daemon.StopCPUProfileRequest
+	100, // 82: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
+	102, // 83: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
+	77,  // 84: daemon.DaemonService.WailsUIReady:input_type -> daemon.WailsUIReadyRequest
+	6,   // 85: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
+	8,   // 86: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
+	10,  // 87: daemon.DaemonService.Up:output_type -> daemon.UpResponse
+	12,  // 88: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
+	12,  // 89: daemon.DaemonService.SubscribeStatus:output_type -> daemon.StatusResponse
+	14,  // 90: daemon.DaemonService.Down:output_type -> daemon.DownResponse
+	16,  // 91: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
+	27,  // 92: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
+	29,  // 93: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
+	29,  // 94: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
+	34,  // 95: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
+	36,  // 96: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
+	38,  // 97: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
+	40,  // 98: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
+	45,  // 99: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
+	47,  // 100: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
+	49,  // 101: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
+	51,  // 102: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
+	55,  // 103: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
+	106, // 104: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
+	108, // 105: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
+	110, // 106: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
+	57,  // 107: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
+	59,  // 108: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
+	42,  // 109: daemon.DaemonService.RegisterUILog:output_type -> daemon.RegisterUILogResponse
+	61,  // 110: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
+	63,  // 111: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
+	65,  // 112: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
+	67,  // 113: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
+	69,  // 114: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
+	71,  // 115: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
+	74,  // 116: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
+	76,  // 117: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
+	80,  // 118: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
+	83,  // 119: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
+	85,  // 120: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
+	87,  // 121: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
+	89,  // 122: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
+	91,  // 123: daemon.DaemonService.RequestExtendAuthSession:output_type -> daemon.RequestExtendAuthSessionResponse
+	93,  // 124: daemon.DaemonService.WaitExtendAuthSession:output_type -> daemon.WaitExtendAuthSessionResponse
+	95,  // 125: daemon.DaemonService.DismissSessionWarning:output_type -> daemon.DismissSessionWarningResponse
+	97,  // 126: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
+	99,  // 127: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
+	101, // 128: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
+	103, // 129: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
+	78,  // 130: daemon.DaemonService.WailsUIReady:output_type -> daemon.WailsUIReadyResponse
+	85,  // [85:131] is the sub-list for method output_type
+	39,  // [39:85] is the sub-list for method input_type
+	39,  // [39:39] is the sub-list for extension type_name
+	39,  // [39:39] is the sub-list for extension extendee
+	0,   // [0:39] is the sub-list for field type_name
 }
 
 func init() { file_daemon_proto_init() }
@@ -7345,13 +8049,15 @@ func file_daemon_proto_init() {
 		(*PortInfo_Port)(nil),
 		(*PortInfo_Range_)(nil),
 	}
-	file_daemon_proto_msgTypes[47].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[48].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[54].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[49].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[50].OneofWrappers = []any{}
 	file_daemon_proto_msgTypes[56].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[69].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[78].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[89].OneofWrappers = []any{
+	file_daemon_proto_msgTypes[58].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[71].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[76].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[82].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[86].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[99].OneofWrappers = []any{
 		(*ExposeServiceEvent_Ready)(nil),
 	}
 	type x struct{}
@@ -7360,7 +8066,7 @@ func file_daemon_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_daemon_proto_rawDesc), len(file_daemon_proto_rawDesc)),
 			NumEnums:      4,
-			NumMessages:   100,
+			NumMessages:   110,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/client/proto/daemon.pb.gw.go b/client/proto/daemon.pb.gw.go
new file mode 100644
index 000000000..b64dfeea1
--- /dev/null
+++ b/client/proto/daemon.pb.gw.go
@@ -0,0 +1,2921 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: daemon.proto
+
+/*
+Package proto is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package proto
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var (
+	_ codes.Code
+	_ io.Reader
+	_ status.Status
+	_ = errors.New
+	_ = runtime.String
+	_ = utilities.NewDoubleArray
+	_ = metadata.Join
+)
+
+func request_DaemonService_Login_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq LoginRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.Login(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_Login_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq LoginRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Login(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_WaitSSOLogin_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WaitSSOLoginRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.WaitSSOLogin(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_WaitSSOLogin_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WaitSSOLoginRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.WaitSSOLogin(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_Up_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.Up(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_Up_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Up(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_Status_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StatusRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.Status(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_Status_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StatusRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Status(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SubscribeStatus_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (DaemonService_SubscribeStatusClient, runtime.ServerMetadata, error) {
+	var (
+		protoReq StatusRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	stream, err := client.SubscribeStatus(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+}
+
+func request_DaemonService_Down_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DownRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.Down(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_Down_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DownRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Down(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetConfig_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetConfigRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetConfig_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetConfigRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetConfig(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ListNetworks_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ListNetworks(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ListNetworks_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ListNetworks(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SelectNetworks_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SelectNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.SelectNetworks(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_SelectNetworks_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SelectNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SelectNetworks(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_DeselectNetworks_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SelectNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.DeselectNetworks(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_DeselectNetworks_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SelectNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.DeselectNetworks(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ForwardingRules_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq EmptyRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ForwardingRules(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ForwardingRules_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq EmptyRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ForwardingRules(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_DebugBundle_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DebugBundleRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.DebugBundle(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_DebugBundle_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DebugBundleRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.DebugBundle(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetLogLevel_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetLogLevelRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetLogLevel(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetLogLevel_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetLogLevelRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetLogLevel(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SetLogLevel_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetLogLevelRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.SetLogLevel(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_SetLogLevel_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetLogLevelRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SetLogLevel(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ListStates_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListStatesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ListStates(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ListStates_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListStatesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ListStates(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_CleanState_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq CleanStateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.CleanState(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_CleanState_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq CleanStateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.CleanState(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_DeleteState_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteStateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.DeleteState(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_DeleteState_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteStateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.DeleteState(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SetSyncResponsePersistence_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetSyncResponsePersistenceRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.SetSyncResponsePersistence(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_SetSyncResponsePersistence_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetSyncResponsePersistenceRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SetSyncResponsePersistence(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_TracePacket_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TracePacketRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.TracePacket(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_TracePacket_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TracePacketRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.TracePacket(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_StartCapture_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (DaemonService_StartCaptureClient, runtime.ServerMetadata, error) {
+	var (
+		protoReq StartCaptureRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	stream, err := client.StartCapture(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+}
+
+func request_DaemonService_StartBundleCapture_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StartBundleCaptureRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.StartBundleCapture(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_StartBundleCapture_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StartBundleCaptureRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.StartBundleCapture(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_StopBundleCapture_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StopBundleCaptureRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.StopBundleCapture(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_StopBundleCapture_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StopBundleCaptureRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.StopBundleCapture(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SubscribeEvents_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (DaemonService_SubscribeEventsClient, runtime.ServerMetadata, error) {
+	var (
+		protoReq SubscribeRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	stream, err := client.SubscribeEvents(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+}
+
+func request_DaemonService_GetEvents_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetEventsRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetEvents(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetEvents_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetEventsRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetEvents(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_RegisterUILog_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RegisterUILogRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.RegisterUILog(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_RegisterUILog_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RegisterUILogRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RegisterUILog(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SwitchProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SwitchProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.SwitchProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_SwitchProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SwitchProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SwitchProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SetConfig_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetConfigRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.SetConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_SetConfig_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetConfigRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SetConfig(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_AddProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq AddProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.AddProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_AddProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq AddProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.AddProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_RenameProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RenameProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.RenameProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_RenameProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RenameProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RenameProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_RemoveProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RemoveProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.RemoveProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_RemoveProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RemoveProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RemoveProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ListProfiles_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListProfilesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ListProfiles(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ListProfiles_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListProfilesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ListProfiles(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetActiveProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetActiveProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetActiveProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetActiveProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetActiveProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetActiveProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_Logout_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq LogoutRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.Logout(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_Logout_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq LogoutRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Logout(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetFeatures_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetFeaturesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetFeatures(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetFeatures_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetFeaturesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetFeatures(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_TriggerUpdate_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TriggerUpdateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.TriggerUpdate(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_TriggerUpdate_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TriggerUpdateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.TriggerUpdate(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetPeerSSHHostKey_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetPeerSSHHostKeyRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetPeerSSHHostKey(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetPeerSSHHostKey_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetPeerSSHHostKeyRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetPeerSSHHostKey(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_RequestJWTAuth_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RequestJWTAuthRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.RequestJWTAuth(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_RequestJWTAuth_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RequestJWTAuthRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RequestJWTAuth(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_WaitJWTToken_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WaitJWTTokenRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.WaitJWTToken(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_WaitJWTToken_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WaitJWTTokenRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.WaitJWTToken(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_RequestExtendAuthSession_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RequestExtendAuthSessionRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.RequestExtendAuthSession(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_RequestExtendAuthSession_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RequestExtendAuthSessionRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RequestExtendAuthSession(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_WaitExtendAuthSession_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WaitExtendAuthSessionRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.WaitExtendAuthSession(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_WaitExtendAuthSession_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WaitExtendAuthSessionRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.WaitExtendAuthSession(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_DismissSessionWarning_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DismissSessionWarningRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.DismissSessionWarning(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_DismissSessionWarning_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DismissSessionWarningRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.DismissSessionWarning(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_StartCPUProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StartCPUProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.StartCPUProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_StartCPUProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StartCPUProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.StartCPUProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_StopCPUProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StopCPUProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.StopCPUProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_StopCPUProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StopCPUProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.StopCPUProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetInstallerResult_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq InstallerResultRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetInstallerResult(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetInstallerResult_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq InstallerResultRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetInstallerResult(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ExposeService_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (DaemonService_ExposeServiceClient, runtime.ServerMetadata, error) {
+	var (
+		protoReq ExposeServiceRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	stream, err := client.ExposeService(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+}
+
+func request_DaemonService_WailsUIReady_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WailsUIReadyRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.WailsUIReady(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_WailsUIReady_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WailsUIReadyRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.WailsUIReady(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+// RegisterDaemonServiceHandlerServer registers the http handlers for service DaemonService to "mux".
+// UnaryRPC     :call DaemonServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterDaemonServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
+func RegisterDaemonServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server DaemonServiceServer) error {
+	mux.Handle(http.MethodPost, pattern_DaemonService_Login_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/Login", runtime.WithHTTPPathPattern("/daemon.DaemonService/Login"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_Login_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Login_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WaitSSOLogin_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/WaitSSOLogin", runtime.WithHTTPPathPattern("/daemon.DaemonService/WaitSSOLogin"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_WaitSSOLogin_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WaitSSOLogin_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Up_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/Up", runtime.WithHTTPPathPattern("/daemon.DaemonService/Up"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_Up_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Up_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Status_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/Status", runtime.WithHTTPPathPattern("/daemon.DaemonService/Status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_Status_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Status_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	mux.Handle(http.MethodPost, pattern_DaemonService_SubscribeStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Down_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/Down", runtime.WithHTTPPathPattern("/daemon.DaemonService/Down"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_Down_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Down_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetConfig", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetConfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetConfig_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ListNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ListNetworks_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SelectNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/SelectNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/SelectNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_SelectNetworks_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SelectNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DeselectNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/DeselectNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/DeselectNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_DeselectNetworks_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DeselectNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ForwardingRules_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ForwardingRules", runtime.WithHTTPPathPattern("/daemon.DaemonService/ForwardingRules"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ForwardingRules_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ForwardingRules_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DebugBundle_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/DebugBundle", runtime.WithHTTPPathPattern("/daemon.DaemonService/DebugBundle"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_DebugBundle_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DebugBundle_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetLogLevel_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetLogLevel", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetLogLevel"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetLogLevel_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetLogLevel_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetLogLevel_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/SetLogLevel", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetLogLevel"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_SetLogLevel_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetLogLevel_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListStates_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ListStates", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListStates"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ListStates_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListStates_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_CleanState_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/CleanState", runtime.WithHTTPPathPattern("/daemon.DaemonService/CleanState"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_CleanState_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_CleanState_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DeleteState_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/DeleteState", runtime.WithHTTPPathPattern("/daemon.DaemonService/DeleteState"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_DeleteState_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DeleteState_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetSyncResponsePersistence_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/SetSyncResponsePersistence", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetSyncResponsePersistence"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_SetSyncResponsePersistence_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetSyncResponsePersistence_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_TracePacket_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/TracePacket", runtime.WithHTTPPathPattern("/daemon.DaemonService/TracePacket"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_TracePacket_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_TracePacket_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartBundleCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/StartBundleCapture", runtime.WithHTTPPathPattern("/daemon.DaemonService/StartBundleCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_StartBundleCapture_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StartBundleCapture_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StopBundleCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/StopBundleCapture", runtime.WithHTTPPathPattern("/daemon.DaemonService/StopBundleCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_StopBundleCapture_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StopBundleCapture_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	mux.Handle(http.MethodPost, pattern_DaemonService_SubscribeEvents_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetEvents_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetEvents", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetEvents"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetEvents_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetEvents_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RegisterUILog_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/RegisterUILog", runtime.WithHTTPPathPattern("/daemon.DaemonService/RegisterUILog"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_RegisterUILog_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RegisterUILog_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SwitchProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/SwitchProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/SwitchProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_SwitchProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SwitchProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/SetConfig", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetConfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_SetConfig_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_AddProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/AddProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/AddProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_AddProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_AddProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RenameProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/RenameProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/RenameProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_RenameProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RenameProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RemoveProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/RemoveProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/RemoveProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_RemoveProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RemoveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListProfiles_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ListProfiles", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListProfiles"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ListProfiles_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListProfiles_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetActiveProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetActiveProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetActiveProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetActiveProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetActiveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Logout_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/Logout", runtime.WithHTTPPathPattern("/daemon.DaemonService/Logout"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_Logout_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Logout_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetFeatures_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetFeatures", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetFeatures"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetFeatures_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetFeatures_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_TriggerUpdate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/TriggerUpdate", runtime.WithHTTPPathPattern("/daemon.DaemonService/TriggerUpdate"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_TriggerUpdate_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_TriggerUpdate_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetPeerSSHHostKey_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetPeerSSHHostKey", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetPeerSSHHostKey"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetPeerSSHHostKey_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetPeerSSHHostKey_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RequestJWTAuth_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/RequestJWTAuth", runtime.WithHTTPPathPattern("/daemon.DaemonService/RequestJWTAuth"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_RequestJWTAuth_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RequestJWTAuth_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WaitJWTToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/WaitJWTToken", runtime.WithHTTPPathPattern("/daemon.DaemonService/WaitJWTToken"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_WaitJWTToken_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WaitJWTToken_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RequestExtendAuthSession_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/RequestExtendAuthSession", runtime.WithHTTPPathPattern("/daemon.DaemonService/RequestExtendAuthSession"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_RequestExtendAuthSession_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RequestExtendAuthSession_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WaitExtendAuthSession_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/WaitExtendAuthSession", runtime.WithHTTPPathPattern("/daemon.DaemonService/WaitExtendAuthSession"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_WaitExtendAuthSession_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WaitExtendAuthSession_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DismissSessionWarning_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/DismissSessionWarning", runtime.WithHTTPPathPattern("/daemon.DaemonService/DismissSessionWarning"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_DismissSessionWarning_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DismissSessionWarning_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartCPUProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/StartCPUProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/StartCPUProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_StartCPUProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StartCPUProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StopCPUProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/StopCPUProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/StopCPUProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_StopCPUProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StopCPUProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetInstallerResult_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetInstallerResult", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetInstallerResult"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetInstallerResult_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetInstallerResult_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	mux.Handle(http.MethodPost, pattern_DaemonService_ExposeService_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WailsUIReady_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/WailsUIReady", runtime.WithHTTPPathPattern("/daemon.DaemonService/WailsUIReady"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_WailsUIReady_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WailsUIReady_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	return nil
+}
+
+// RegisterDaemonServiceHandlerFromEndpoint is same as RegisterDaemonServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterDaemonServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.NewClient(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+	return RegisterDaemonServiceHandler(ctx, mux, conn)
+}
+
+// RegisterDaemonServiceHandler registers the http handlers for service DaemonService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterDaemonServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterDaemonServiceHandlerClient(ctx, mux, NewDaemonServiceClient(conn))
+}
+
+// RegisterDaemonServiceHandlerClient registers the http handlers for service DaemonService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "DaemonServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "DaemonServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "DaemonServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
+func RegisterDaemonServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client DaemonServiceClient) error {
+	mux.Handle(http.MethodPost, pattern_DaemonService_Login_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/Login", runtime.WithHTTPPathPattern("/daemon.DaemonService/Login"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_Login_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Login_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WaitSSOLogin_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/WaitSSOLogin", runtime.WithHTTPPathPattern("/daemon.DaemonService/WaitSSOLogin"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_WaitSSOLogin_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WaitSSOLogin_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Up_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/Up", runtime.WithHTTPPathPattern("/daemon.DaemonService/Up"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_Up_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Up_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Status_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/Status", runtime.WithHTTPPathPattern("/daemon.DaemonService/Status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_Status_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Status_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SubscribeStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SubscribeStatus", runtime.WithHTTPPathPattern("/daemon.DaemonService/SubscribeStatus"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SubscribeStatus_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SubscribeStatus_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Down_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/Down", runtime.WithHTTPPathPattern("/daemon.DaemonService/Down"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_Down_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Down_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetConfig", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetConfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetConfig_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ListNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ListNetworks_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SelectNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SelectNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/SelectNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SelectNetworks_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SelectNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DeselectNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/DeselectNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/DeselectNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_DeselectNetworks_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DeselectNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ForwardingRules_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ForwardingRules", runtime.WithHTTPPathPattern("/daemon.DaemonService/ForwardingRules"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ForwardingRules_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ForwardingRules_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DebugBundle_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/DebugBundle", runtime.WithHTTPPathPattern("/daemon.DaemonService/DebugBundle"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_DebugBundle_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DebugBundle_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetLogLevel_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetLogLevel", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetLogLevel"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetLogLevel_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetLogLevel_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetLogLevel_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SetLogLevel", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetLogLevel"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SetLogLevel_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetLogLevel_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListStates_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ListStates", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListStates"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ListStates_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListStates_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_CleanState_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/CleanState", runtime.WithHTTPPathPattern("/daemon.DaemonService/CleanState"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_CleanState_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_CleanState_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DeleteState_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/DeleteState", runtime.WithHTTPPathPattern("/daemon.DaemonService/DeleteState"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_DeleteState_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DeleteState_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetSyncResponsePersistence_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SetSyncResponsePersistence", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetSyncResponsePersistence"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SetSyncResponsePersistence_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetSyncResponsePersistence_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_TracePacket_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/TracePacket", runtime.WithHTTPPathPattern("/daemon.DaemonService/TracePacket"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_TracePacket_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_TracePacket_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/StartCapture", runtime.WithHTTPPathPattern("/daemon.DaemonService/StartCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_StartCapture_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StartCapture_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartBundleCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/StartBundleCapture", runtime.WithHTTPPathPattern("/daemon.DaemonService/StartBundleCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_StartBundleCapture_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StartBundleCapture_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StopBundleCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/StopBundleCapture", runtime.WithHTTPPathPattern("/daemon.DaemonService/StopBundleCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_StopBundleCapture_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StopBundleCapture_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SubscribeEvents_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SubscribeEvents", runtime.WithHTTPPathPattern("/daemon.DaemonService/SubscribeEvents"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SubscribeEvents_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SubscribeEvents_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetEvents_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetEvents", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetEvents"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetEvents_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetEvents_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RegisterUILog_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/RegisterUILog", runtime.WithHTTPPathPattern("/daemon.DaemonService/RegisterUILog"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_RegisterUILog_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RegisterUILog_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SwitchProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SwitchProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/SwitchProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SwitchProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SwitchProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SetConfig", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetConfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SetConfig_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_AddProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/AddProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/AddProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_AddProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_AddProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RenameProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/RenameProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/RenameProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_RenameProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RenameProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RemoveProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/RemoveProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/RemoveProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_RemoveProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RemoveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListProfiles_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ListProfiles", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListProfiles"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ListProfiles_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListProfiles_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetActiveProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetActiveProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetActiveProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetActiveProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetActiveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Logout_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/Logout", runtime.WithHTTPPathPattern("/daemon.DaemonService/Logout"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_Logout_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Logout_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetFeatures_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetFeatures", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetFeatures"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetFeatures_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetFeatures_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_TriggerUpdate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/TriggerUpdate", runtime.WithHTTPPathPattern("/daemon.DaemonService/TriggerUpdate"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_TriggerUpdate_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_TriggerUpdate_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetPeerSSHHostKey_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetPeerSSHHostKey", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetPeerSSHHostKey"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetPeerSSHHostKey_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetPeerSSHHostKey_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RequestJWTAuth_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/RequestJWTAuth", runtime.WithHTTPPathPattern("/daemon.DaemonService/RequestJWTAuth"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_RequestJWTAuth_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RequestJWTAuth_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WaitJWTToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/WaitJWTToken", runtime.WithHTTPPathPattern("/daemon.DaemonService/WaitJWTToken"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_WaitJWTToken_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WaitJWTToken_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RequestExtendAuthSession_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/RequestExtendAuthSession", runtime.WithHTTPPathPattern("/daemon.DaemonService/RequestExtendAuthSession"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_RequestExtendAuthSession_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RequestExtendAuthSession_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WaitExtendAuthSession_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/WaitExtendAuthSession", runtime.WithHTTPPathPattern("/daemon.DaemonService/WaitExtendAuthSession"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_WaitExtendAuthSession_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WaitExtendAuthSession_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DismissSessionWarning_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/DismissSessionWarning", runtime.WithHTTPPathPattern("/daemon.DaemonService/DismissSessionWarning"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_DismissSessionWarning_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DismissSessionWarning_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartCPUProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/StartCPUProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/StartCPUProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_StartCPUProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StartCPUProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StopCPUProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/StopCPUProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/StopCPUProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_StopCPUProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StopCPUProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetInstallerResult_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetInstallerResult", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetInstallerResult"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetInstallerResult_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetInstallerResult_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ExposeService_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ExposeService", runtime.WithHTTPPathPattern("/daemon.DaemonService/ExposeService"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ExposeService_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ExposeService_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WailsUIReady_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/WailsUIReady", runtime.WithHTTPPathPattern("/daemon.DaemonService/WailsUIReady"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_WailsUIReady_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WailsUIReady_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	return nil
+}
+
+var (
+	pattern_DaemonService_Login_0                      = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Login"}, ""))
+	pattern_DaemonService_WaitSSOLogin_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "WaitSSOLogin"}, ""))
+	pattern_DaemonService_Up_0                         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Up"}, ""))
+	pattern_DaemonService_Status_0                     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Status"}, ""))
+	pattern_DaemonService_SubscribeStatus_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SubscribeStatus"}, ""))
+	pattern_DaemonService_Down_0                       = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Down"}, ""))
+	pattern_DaemonService_GetConfig_0                  = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetConfig"}, ""))
+	pattern_DaemonService_ListNetworks_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ListNetworks"}, ""))
+	pattern_DaemonService_SelectNetworks_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SelectNetworks"}, ""))
+	pattern_DaemonService_DeselectNetworks_0           = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "DeselectNetworks"}, ""))
+	pattern_DaemonService_ForwardingRules_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ForwardingRules"}, ""))
+	pattern_DaemonService_DebugBundle_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "DebugBundle"}, ""))
+	pattern_DaemonService_GetLogLevel_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetLogLevel"}, ""))
+	pattern_DaemonService_SetLogLevel_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SetLogLevel"}, ""))
+	pattern_DaemonService_ListStates_0                 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ListStates"}, ""))
+	pattern_DaemonService_CleanState_0                 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "CleanState"}, ""))
+	pattern_DaemonService_DeleteState_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "DeleteState"}, ""))
+	pattern_DaemonService_SetSyncResponsePersistence_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SetSyncResponsePersistence"}, ""))
+	pattern_DaemonService_TracePacket_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "TracePacket"}, ""))
+	pattern_DaemonService_StartCapture_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StartCapture"}, ""))
+	pattern_DaemonService_StartBundleCapture_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StartBundleCapture"}, ""))
+	pattern_DaemonService_StopBundleCapture_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StopBundleCapture"}, ""))
+	pattern_DaemonService_SubscribeEvents_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SubscribeEvents"}, ""))
+	pattern_DaemonService_GetEvents_0                  = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetEvents"}, ""))
+	pattern_DaemonService_RegisterUILog_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RegisterUILog"}, ""))
+	pattern_DaemonService_SwitchProfile_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SwitchProfile"}, ""))
+	pattern_DaemonService_SetConfig_0                  = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SetConfig"}, ""))
+	pattern_DaemonService_AddProfile_0                 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "AddProfile"}, ""))
+	pattern_DaemonService_RenameProfile_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RenameProfile"}, ""))
+	pattern_DaemonService_RemoveProfile_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RemoveProfile"}, ""))
+	pattern_DaemonService_ListProfiles_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ListProfiles"}, ""))
+	pattern_DaemonService_GetActiveProfile_0           = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetActiveProfile"}, ""))
+	pattern_DaemonService_Logout_0                     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Logout"}, ""))
+	pattern_DaemonService_GetFeatures_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetFeatures"}, ""))
+	pattern_DaemonService_TriggerUpdate_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "TriggerUpdate"}, ""))
+	pattern_DaemonService_GetPeerSSHHostKey_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetPeerSSHHostKey"}, ""))
+	pattern_DaemonService_RequestJWTAuth_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RequestJWTAuth"}, ""))
+	pattern_DaemonService_WaitJWTToken_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "WaitJWTToken"}, ""))
+	pattern_DaemonService_RequestExtendAuthSession_0   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RequestExtendAuthSession"}, ""))
+	pattern_DaemonService_WaitExtendAuthSession_0      = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "WaitExtendAuthSession"}, ""))
+	pattern_DaemonService_DismissSessionWarning_0      = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "DismissSessionWarning"}, ""))
+	pattern_DaemonService_StartCPUProfile_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StartCPUProfile"}, ""))
+	pattern_DaemonService_StopCPUProfile_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StopCPUProfile"}, ""))
+	pattern_DaemonService_GetInstallerResult_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetInstallerResult"}, ""))
+	pattern_DaemonService_ExposeService_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ExposeService"}, ""))
+	pattern_DaemonService_WailsUIReady_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "WailsUIReady"}, ""))
+)
+
+var (
+	forward_DaemonService_Login_0                      = runtime.ForwardResponseMessage
+	forward_DaemonService_WaitSSOLogin_0               = runtime.ForwardResponseMessage
+	forward_DaemonService_Up_0                         = runtime.ForwardResponseMessage
+	forward_DaemonService_Status_0                     = runtime.ForwardResponseMessage
+	forward_DaemonService_SubscribeStatus_0            = runtime.ForwardResponseStream
+	forward_DaemonService_Down_0                       = runtime.ForwardResponseMessage
+	forward_DaemonService_GetConfig_0                  = runtime.ForwardResponseMessage
+	forward_DaemonService_ListNetworks_0               = runtime.ForwardResponseMessage
+	forward_DaemonService_SelectNetworks_0             = runtime.ForwardResponseMessage
+	forward_DaemonService_DeselectNetworks_0           = runtime.ForwardResponseMessage
+	forward_DaemonService_ForwardingRules_0            = runtime.ForwardResponseMessage
+	forward_DaemonService_DebugBundle_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_GetLogLevel_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_SetLogLevel_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_ListStates_0                 = runtime.ForwardResponseMessage
+	forward_DaemonService_CleanState_0                 = runtime.ForwardResponseMessage
+	forward_DaemonService_DeleteState_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_SetSyncResponsePersistence_0 = runtime.ForwardResponseMessage
+	forward_DaemonService_TracePacket_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_StartCapture_0               = runtime.ForwardResponseStream
+	forward_DaemonService_StartBundleCapture_0         = runtime.ForwardResponseMessage
+	forward_DaemonService_StopBundleCapture_0          = runtime.ForwardResponseMessage
+	forward_DaemonService_SubscribeEvents_0            = runtime.ForwardResponseStream
+	forward_DaemonService_GetEvents_0                  = runtime.ForwardResponseMessage
+	forward_DaemonService_RegisterUILog_0              = runtime.ForwardResponseMessage
+	forward_DaemonService_SwitchProfile_0              = runtime.ForwardResponseMessage
+	forward_DaemonService_SetConfig_0                  = runtime.ForwardResponseMessage
+	forward_DaemonService_AddProfile_0                 = runtime.ForwardResponseMessage
+	forward_DaemonService_RenameProfile_0              = runtime.ForwardResponseMessage
+	forward_DaemonService_RemoveProfile_0              = runtime.ForwardResponseMessage
+	forward_DaemonService_ListProfiles_0               = runtime.ForwardResponseMessage
+	forward_DaemonService_GetActiveProfile_0           = runtime.ForwardResponseMessage
+	forward_DaemonService_Logout_0                     = runtime.ForwardResponseMessage
+	forward_DaemonService_GetFeatures_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_TriggerUpdate_0              = runtime.ForwardResponseMessage
+	forward_DaemonService_GetPeerSSHHostKey_0          = runtime.ForwardResponseMessage
+	forward_DaemonService_RequestJWTAuth_0             = runtime.ForwardResponseMessage
+	forward_DaemonService_WaitJWTToken_0               = runtime.ForwardResponseMessage
+	forward_DaemonService_RequestExtendAuthSession_0   = runtime.ForwardResponseMessage
+	forward_DaemonService_WaitExtendAuthSession_0      = runtime.ForwardResponseMessage
+	forward_DaemonService_DismissSessionWarning_0      = runtime.ForwardResponseMessage
+	forward_DaemonService_StartCPUProfile_0            = runtime.ForwardResponseMessage
+	forward_DaemonService_StopCPUProfile_0             = runtime.ForwardResponseMessage
+	forward_DaemonService_GetInstallerResult_0         = runtime.ForwardResponseMessage
+	forward_DaemonService_ExposeService_0              = runtime.ForwardResponseStream
+	forward_DaemonService_WailsUIReady_0               = runtime.ForwardResponseMessage
+)
diff --git a/client/proto/daemon.proto b/client/proto/daemon.proto
index c1e3fe513..39a8ea7c6 100644
--- a/client/proto/daemon.proto
+++ b/client/proto/daemon.proto
@@ -24,6 +24,12 @@ service DaemonService {
   // Status of the service.
   rpc Status(StatusRequest) returns (StatusResponse) {}
 
+  // SubscribeStatus pushes a fresh StatusResponse on connection state
+  // changes (Connected / Disconnected / Connecting / address change /
+  // peers list change). The first message on the stream is the current
+  // snapshot, so a freshly-subscribed UI doesn't need to also call Status.
+  rpc SubscribeStatus(StatusRequest) returns (stream StatusResponse) {}
+
   // Down stops engine work in the daemon.
   rpc Down(DownRequest) returns (DownResponse) {}
 
@@ -39,7 +45,10 @@ service DaemonService {
   // Deselect specific routes
   rpc DeselectNetworks(SelectNetworksRequest) returns (SelectNetworksResponse) {}
 
-  rpc ForwardingRules(EmptyRequest) returns (ForwardingRulesResponse) {}
+  // Unused; the ingress port-forwarding feature was discontinued.
+  rpc ForwardingRules(EmptyRequest) returns (ForwardingRulesResponse) {
+    option deprecated = true;
+  }
 
   // DebugBundle creates a debug bundle
   rpc DebugBundle(DebugBundleRequest) returns (DebugBundleResponse) {}
@@ -79,6 +88,11 @@ service DaemonService {
 
   rpc GetEvents(GetEventsRequest) returns (GetEventsResponse) {}
 
+  // RegisterUILog records the desktop UI's absolute log path so the daemon's
+  // debug bundle can collect it (the daemon runs as root and can't resolve the
+  // user's config dir).
+  rpc RegisterUILog(RegisterUILogRequest) returns (RegisterUILogResponse) {}
+
   rpc SwitchProfile(SwitchProfileRequest) returns (SwitchProfileResponse) {}
 
   rpc SetConfig(SetConfigRequest) returns (SetConfigResponse) {}
@@ -111,6 +125,25 @@ service DaemonService {
   // WaitJWTToken waits for JWT authentication completion
   rpc WaitJWTToken(WaitJWTTokenRequest) returns (WaitJWTTokenResponse) {}
 
+  // RequestExtendAuthSession initiates an SSO session-extension flow.
+  // The daemon prepares a PKCE/device-code request against the IdP and
+  // returns the verification URI; the UI is expected to open it. The flow
+  // state is kept in the daemon until WaitExtendAuthSession completes it.
+  rpc RequestExtendAuthSession(RequestExtendAuthSessionRequest) returns (RequestExtendAuthSessionResponse) {}
+
+  // WaitExtendAuthSession blocks until the user finishes the SSO step
+  // started by RequestExtendAuthSession, then forwards the resulting JWT
+  // to the management server's ExtendAuthSession RPC. Returns the new
+  // session expiry deadline. The tunnel stays up the entire time.
+  rpc WaitExtendAuthSession(WaitExtendAuthSessionRequest) returns (WaitExtendAuthSessionResponse) {}
+
+  // DismissSessionWarning records that the user clicked "Dismiss" on the
+  // T-WarningLead interactive notification, suppressing the auto-opened
+  // SessionAboutToExpire dialog that would otherwise fire at
+  // T-FinalWarningLead for the current deadline. Idempotent and best-effort:
+  // a missed call only means the fallback dialog will still appear.
+  rpc DismissSessionWarning(DismissSessionWarningRequest) returns (DismissSessionWarningResponse) {}
+
 // StartCPUProfile starts CPU profiling in the daemon
   rpc StartCPUProfile(StartCPUProfileRequest) returns (StartCPUProfileResponse) {}
 
@@ -121,6 +154,11 @@ service DaemonService {
 
   // ExposeService exposes a local port via the NetBird reverse proxy
   rpc ExposeService(ExposeServiceRequest) returns (stream ExposeServiceEvent) {}
+
+  // WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
+  // only cares whether the daemon implements it: an Unimplemented response
+  // means the daemon predates this UI and is too old to drive it.
+  rpc WailsUIReady(WailsUIReadyRequest) returns (WailsUIReadyResponse) {}
 }
 
 
@@ -207,6 +245,12 @@ message LoginRequest {
   optional bool disableSSHAuth = 38;
   optional int32 sshJWTCacheTTL = 39;
   optional bool disable_ipv6 = 40;
+
+  optional bool enable_local_metrics = 41;
+  optional string local_metrics_address = 42;
+  // remoteJobsAllowed opts the peer into management-requested remote jobs
+  // (e.g. debug bundles). Absent leaves the stored value unchanged.
+  optional bool remoteJobsAllowed = 43;
 }
 
 message LoginResponse {
@@ -229,6 +273,12 @@ message UpRequest {
   optional string profileName = 1;
   optional string username = 2;
   reserved 3;
+  // async instructs the daemon to start the connection attempt and return
+  // immediately without waiting for the engine to become ready. Status updates
+  // are delivered via the SubscribeStatus stream. When false (the default) the
+  // RPC blocks until the engine is running or gives up, which is the behaviour
+  // needed by the CLI.
+  bool async = 4;
 }
 
 message UpResponse {}
@@ -246,6 +296,10 @@ message StatusResponse{
   FullStatus fullStatus = 2;
   // NetBird daemon version
   string daemonVersion = 3;
+  // Absolute UTC instant at which the peer's SSO session expires.
+  // Unset when the peer is not SSO-registered or login expiration is disabled.
+  // The UI derives "warning active" from this value and its own clock.
+  google.protobuf.Timestamp sessionExpiresAt = 4;
 }
 
 message DownRequest {}
@@ -317,6 +371,8 @@ message GetConfigResponse {
 
   bool disable_ipv6 = 27;
 
+  bool remoteJobsAllowed = 29;
+
   // mDMManagedFields lists the names of configuration keys whose value is
   // currently enforced by an MDM policy. Names match mdm.Key* constants
   // (e.g. "managementURL", "disableClientRoutes"). UI/CLI clients should
@@ -415,12 +471,19 @@ message FullStatus {
   repeated PeerState peers = 4;
   repeated RelayState relays = 5;
   repeated NSGroupState dns_servers = 6;
-  int32 NumberOfForwardingRules = 8;
+  // Unused; the ingress port-forwarding feature was discontinued.
+  int32 NumberOfForwardingRules = 8 [deprecated = true];
 
   repeated SystemEvent events = 7;
 
   bool lazyConnectionEnabled = 9;
   SSHServerState sshServerState = 10;
+
+  // networksRevision bumps whenever the set of routed networks (route and
+  // exit-node candidates) or their selected state changes. The UI fingerprints
+  // on it to know when to re-fetch ListNetworks via the push stream, instead
+  // of polling on every status snapshot.
+  uint64 networksRevision = 11;
 }
 
 // Networks
@@ -452,8 +515,11 @@ message Network {
   map<string, IPList> resolvedIPs = 5;
 }
 
-// ForwardingRules
+// PortInfo, ForwardingRule and ForwardingRulesResponse are unused; the ingress
+// port-forwarding feature was discontinued.
 message PortInfo {
+  option deprecated = true;
+
   oneof portSelection {
     uint32 port = 1;
     Range range = 2;
@@ -466,6 +532,8 @@ message PortInfo {
 }
 
 message ForwardingRule {
+  option deprecated = true;
+
   string protocol = 1;
   PortInfo destinationPort = 2;
   string translatedAddress = 3;
@@ -474,10 +542,11 @@ message ForwardingRule {
 }
 
 message ForwardingRulesResponse {
+  option deprecated = true;
+
   repeated ForwardingRule rules = 1;
 }
 
-
 // DebugBundler
 message DebugBundleRequest {
   bool anonymize = 1;
@@ -485,6 +554,15 @@ message DebugBundleRequest {
   string uploadURL = 4;
   uint32 logFileCount = 5;
   string cliVersion = 6;
+  // uploadInsecure allows uploading to an http endpoint or one with an
+  // untrusted TLS certificate. Restricted to privileged callers; for
+  // self-hosted upload servers.
+  bool uploadInsecure = 7;
+  // anonymizeLevel selects how much the anonymizer redacts: "default"
+  // (or empty) keeps internal IP ranges, "strict" also anonymizes them.
+  // Unknown values are treated as "strict". Only meaningful with anonymize;
+  // "strict" implies it.
+  string anonymizeLevel = 8;
 }
 
 message DebugBundleResponse {
@@ -518,6 +596,13 @@ message SetLogLevelRequest {
 message SetLogLevelResponse {
 }
 
+message RegisterUILogRequest {
+  string path = 1;
+}
+
+message RegisterUILogResponse {
+}
+
 // State represents a daemon state entry
 message State {
   string name = 1;
@@ -699,6 +784,12 @@ message SetConfigRequest {
   optional bool disableSSHAuth = 33;
   optional int32 sshJWTCacheTTL = 34;
   optional bool disable_ipv6 = 35;
+
+  optional bool enable_local_metrics = 36;
+  optional string local_metrics_address = 37;
+  // remoteJobsAllowed opts the peer into management-requested remote jobs
+  // (e.g. debug bundles). Absent leaves the stored value unchanged.
+  optional bool remoteJobsAllowed = 38;
 }
 
 message SetConfigResponse{}
@@ -771,12 +862,22 @@ message LogoutRequest {
 
 message LogoutResponse {}
 
+message WailsUIReadyRequest {}
+
+message WailsUIReadyResponse {}
+
 message GetFeaturesRequest{}
 
 message GetFeaturesResponse{
   bool disable_profiles = 1;
   bool disable_update_settings = 2;
   bool disable_networks = 3;
+  // disableAdvancedView gates the upcoming UI revision's advanced
+  // section. Tristate: unset = no MDM directive, the UI applies its
+  // own default; true = MDM enforces disable; false = MDM enforces
+  // enable. Sourced exclusively from the MDM policy — no CLI /
+  // config flag backs this value.
+  optional bool disable_advanced_view = 4;
 }
 
 // MDMManagedFieldsViolation is attached as a gRPC error detail on a
@@ -817,6 +918,10 @@ message GetPeerSSHHostKeyResponse {
 message RequestJWTAuthRequest {
   // hint for OIDC login_hint parameter (typically email address)
   optional string hint = 1;
+  // hasGraphicalSession tells the daemon that the caller has a graphical session,
+  // which decides whether PKCE or the device code flow is preferred. The daemon
+  // cannot detect this itself: it does not inherit the session environment.
+  bool hasGraphicalSession = 2;
 }
 
 // RequestJWTAuthResponse contains authentication flow information
@@ -855,6 +960,59 @@ message WaitJWTTokenResponse {
   int64 expiresIn = 3;
 }
 
+// RequestExtendAuthSessionRequest kicks off the session-extension SSO flow.
+message RequestExtendAuthSessionRequest {
+  // Optional OIDC login_hint (typically the user's email) to pre-fill the
+  // IdP login form.
+  optional string hint = 1;
+  // hasGraphicalSession tells the daemon that the caller has a graphical session,
+  // which decides whether PKCE or the device code flow is preferred. The daemon
+  // cannot detect this itself: it does not inherit the session environment.
+  bool hasGraphicalSession = 2;
+}
+
+// RequestExtendAuthSessionResponse carries the verification URI the UI
+// should open in a browser. The daemon retains the flow state and resolves
+// it via WaitExtendAuthSession.
+message RequestExtendAuthSessionResponse {
+  // verification URI for the user to open in the browser
+  string verificationURI = 1;
+  // complete verification URI (with embedded user code)
+  string verificationURIComplete = 2;
+  // user code to enter on verification URI (for device-code flows)
+  string userCode = 3;
+  // device code for matching the WaitExtendAuthSession call to this flow
+  string deviceCode = 4;
+  // expiration time in seconds for the device code / PKCE flow
+  int64 expiresIn = 5;
+}
+
+// WaitExtendAuthSessionRequest is sent by the UI after it opens the
+// verification URI. The daemon blocks on this call until the user
+// completes (or aborts) the SSO step.
+message WaitExtendAuthSessionRequest {
+  // device code returned by RequestExtendAuthSession
+  string deviceCode = 1;
+  // user code for verification
+  string userCode = 2;
+}
+
+// WaitExtendAuthSessionResponse carries the refreshed deadline returned
+// by the management server. Unset when the management server reports the
+// peer is not eligible for session extension.
+message WaitExtendAuthSessionResponse {
+  google.protobuf.Timestamp sessionExpiresAt = 1;
+}
+
+// DismissSessionWarningRequest is sent by the UI when the user clicks
+// "Dismiss" on the T-WarningLead notification.
+message DismissSessionWarningRequest {}
+
+// DismissSessionWarningResponse acknowledges the dismissal. Carries no
+// payload — the daemon's only obligation is to silence the upcoming
+// T-FinalWarningLead fallback for the current deadline.
+message DismissSessionWarningResponse {}
+
 // StartCPUProfileRequest for starting CPU profiling
 message StartCPUProfileRequest {}
 
diff --git a/client/proto/daemon_gateway_test.go b/client/proto/daemon_gateway_test.go
new file mode 100644
index 000000000..20031e9d9
--- /dev/null
+++ b/client/proto/daemon_gateway_test.go
@@ -0,0 +1,80 @@
+package proto
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	gatewayruntime "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/test/bufconn"
+)
+
+func TestGatewayServerRoutesCoverDaemonRPCs(t *testing.T) {
+	mux := gatewayruntime.NewServeMux()
+	if err := RegisterDaemonServiceHandlerServer(context.Background(), mux, UnimplementedDaemonServiceServer{}); err != nil {
+		t.Fatalf("register daemon gateway server handlers: %v", err)
+	}
+
+	assertAllDaemonGatewayRoutesRegistered(t, mux)
+}
+
+func TestGatewayClientRoutesCoverDaemonRPCs(t *testing.T) {
+	listener := bufconn.Listen(1024 * 1024)
+	server := grpc.NewServer()
+	RegisterDaemonServiceServer(server, UnimplementedDaemonServiceServer{})
+	go func() {
+		if err := server.Serve(listener); err != nil && err != grpc.ErrServerStopped {
+			t.Errorf("serve bufconn gRPC server: %v", err)
+		}
+	}()
+	t.Cleanup(func() {
+		server.Stop()
+		_ = listener.Close()
+	})
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	mux := gatewayruntime.NewServeMux()
+	opts := []grpc.DialOption{
+		grpc.WithContextDialer(func(context.Context, string) (net.Conn, error) {
+			return listener.Dial()
+		}),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}
+	if err := RegisterDaemonServiceHandlerFromEndpoint(ctx, mux, "passthrough:///bufnet", opts); err != nil {
+		t.Fatalf("register daemon gateway client handlers: %v", err)
+	}
+
+	assertAllDaemonGatewayRoutesRegistered(t, mux)
+}
+
+func assertAllDaemonGatewayRoutesRegistered(t *testing.T, mux http.Handler) {
+	t.Helper()
+	for _, method := range DaemonService_ServiceDesc.Methods {
+		assertGatewayRouteRegistered(t, mux, method.MethodName)
+	}
+	for _, stream := range DaemonService_ServiceDesc.Streams {
+		assertGatewayRouteRegistered(t, mux, stream.StreamName)
+	}
+}
+
+func assertGatewayRouteRegistered(t *testing.T, mux http.Handler, methodName string) {
+	t.Helper()
+
+	path := "/daemon.DaemonService/" + methodName
+	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader("{}"))
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	mux.ServeHTTP(res, req)
+
+	if res.Code == http.StatusNotFound {
+		t.Fatalf("gateway route for %s is not registered", methodName)
+	}
+}
diff --git a/client/proto/daemon_grpc.pb.go b/client/proto/daemon_grpc.pb.go
index 5f585aafc..c9b291e14 100644
--- a/client/proto/daemon_grpc.pb.go
+++ b/client/proto/daemon_grpc.pb.go
@@ -23,6 +23,7 @@ const (
 	DaemonService_WaitSSOLogin_FullMethodName               = "/daemon.DaemonService/WaitSSOLogin"
 	DaemonService_Up_FullMethodName                         = "/daemon.DaemonService/Up"
 	DaemonService_Status_FullMethodName                     = "/daemon.DaemonService/Status"
+	DaemonService_SubscribeStatus_FullMethodName            = "/daemon.DaemonService/SubscribeStatus"
 	DaemonService_Down_FullMethodName                       = "/daemon.DaemonService/Down"
 	DaemonService_GetConfig_FullMethodName                  = "/daemon.DaemonService/GetConfig"
 	DaemonService_ListNetworks_FullMethodName               = "/daemon.DaemonService/ListNetworks"
@@ -42,6 +43,7 @@ const (
 	DaemonService_StopBundleCapture_FullMethodName          = "/daemon.DaemonService/StopBundleCapture"
 	DaemonService_SubscribeEvents_FullMethodName            = "/daemon.DaemonService/SubscribeEvents"
 	DaemonService_GetEvents_FullMethodName                  = "/daemon.DaemonService/GetEvents"
+	DaemonService_RegisterUILog_FullMethodName              = "/daemon.DaemonService/RegisterUILog"
 	DaemonService_SwitchProfile_FullMethodName              = "/daemon.DaemonService/SwitchProfile"
 	DaemonService_SetConfig_FullMethodName                  = "/daemon.DaemonService/SetConfig"
 	DaemonService_AddProfile_FullMethodName                 = "/daemon.DaemonService/AddProfile"
@@ -55,10 +57,14 @@ const (
 	DaemonService_GetPeerSSHHostKey_FullMethodName          = "/daemon.DaemonService/GetPeerSSHHostKey"
 	DaemonService_RequestJWTAuth_FullMethodName             = "/daemon.DaemonService/RequestJWTAuth"
 	DaemonService_WaitJWTToken_FullMethodName               = "/daemon.DaemonService/WaitJWTToken"
+	DaemonService_RequestExtendAuthSession_FullMethodName   = "/daemon.DaemonService/RequestExtendAuthSession"
+	DaemonService_WaitExtendAuthSession_FullMethodName      = "/daemon.DaemonService/WaitExtendAuthSession"
+	DaemonService_DismissSessionWarning_FullMethodName      = "/daemon.DaemonService/DismissSessionWarning"
 	DaemonService_StartCPUProfile_FullMethodName            = "/daemon.DaemonService/StartCPUProfile"
 	DaemonService_StopCPUProfile_FullMethodName             = "/daemon.DaemonService/StopCPUProfile"
 	DaemonService_GetInstallerResult_FullMethodName         = "/daemon.DaemonService/GetInstallerResult"
 	DaemonService_ExposeService_FullMethodName              = "/daemon.DaemonService/ExposeService"
+	DaemonService_WailsUIReady_FullMethodName               = "/daemon.DaemonService/WailsUIReady"
 )
 
 // DaemonServiceClient is the client API for DaemonService service.
@@ -74,6 +80,11 @@ type DaemonServiceClient interface {
 	Up(ctx context.Context, in *UpRequest, opts ...grpc.CallOption) (*UpResponse, error)
 	// Status of the service.
 	Status(ctx context.Context, in *StatusRequest, opts ...grpc.CallOption) (*StatusResponse, error)
+	// SubscribeStatus pushes a fresh StatusResponse on connection state
+	// changes (Connected / Disconnected / Connecting / address change /
+	// peers list change). The first message on the stream is the current
+	// snapshot, so a freshly-subscribed UI doesn't need to also call Status.
+	SubscribeStatus(ctx context.Context, in *StatusRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StatusResponse], error)
 	// Down stops engine work in the daemon.
 	Down(ctx context.Context, in *DownRequest, opts ...grpc.CallOption) (*DownResponse, error)
 	// GetConfig of the daemon.
@@ -84,6 +95,8 @@ type DaemonServiceClient interface {
 	SelectNetworks(ctx context.Context, in *SelectNetworksRequest, opts ...grpc.CallOption) (*SelectNetworksResponse, error)
 	// Deselect specific routes
 	DeselectNetworks(ctx context.Context, in *SelectNetworksRequest, opts ...grpc.CallOption) (*SelectNetworksResponse, error)
+	// Deprecated: Do not use.
+	// Unused; the ingress port-forwarding feature was discontinued.
 	ForwardingRules(ctx context.Context, in *EmptyRequest, opts ...grpc.CallOption) (*ForwardingRulesResponse, error)
 	// DebugBundle creates a debug bundle
 	DebugBundle(ctx context.Context, in *DebugBundleRequest, opts ...grpc.CallOption) (*DebugBundleResponse, error)
@@ -110,6 +123,10 @@ type DaemonServiceClient interface {
 	StopBundleCapture(ctx context.Context, in *StopBundleCaptureRequest, opts ...grpc.CallOption) (*StopBundleCaptureResponse, error)
 	SubscribeEvents(ctx context.Context, in *SubscribeRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[SystemEvent], error)
 	GetEvents(ctx context.Context, in *GetEventsRequest, opts ...grpc.CallOption) (*GetEventsResponse, error)
+	// RegisterUILog records the desktop UI's absolute log path so the daemon's
+	// debug bundle can collect it (the daemon runs as root and can't resolve the
+	// user's config dir).
+	RegisterUILog(ctx context.Context, in *RegisterUILogRequest, opts ...grpc.CallOption) (*RegisterUILogResponse, error)
 	SwitchProfile(ctx context.Context, in *SwitchProfileRequest, opts ...grpc.CallOption) (*SwitchProfileResponse, error)
 	SetConfig(ctx context.Context, in *SetConfigRequest, opts ...grpc.CallOption) (*SetConfigResponse, error)
 	AddProfile(ctx context.Context, in *AddProfileRequest, opts ...grpc.CallOption) (*AddProfileResponse, error)
@@ -129,6 +146,22 @@ type DaemonServiceClient interface {
 	RequestJWTAuth(ctx context.Context, in *RequestJWTAuthRequest, opts ...grpc.CallOption) (*RequestJWTAuthResponse, error)
 	// WaitJWTToken waits for JWT authentication completion
 	WaitJWTToken(ctx context.Context, in *WaitJWTTokenRequest, opts ...grpc.CallOption) (*WaitJWTTokenResponse, error)
+	// RequestExtendAuthSession initiates an SSO session-extension flow.
+	// The daemon prepares a PKCE/device-code request against the IdP and
+	// returns the verification URI; the UI is expected to open it. The flow
+	// state is kept in the daemon until WaitExtendAuthSession completes it.
+	RequestExtendAuthSession(ctx context.Context, in *RequestExtendAuthSessionRequest, opts ...grpc.CallOption) (*RequestExtendAuthSessionResponse, error)
+	// WaitExtendAuthSession blocks until the user finishes the SSO step
+	// started by RequestExtendAuthSession, then forwards the resulting JWT
+	// to the management server's ExtendAuthSession RPC. Returns the new
+	// session expiry deadline. The tunnel stays up the entire time.
+	WaitExtendAuthSession(ctx context.Context, in *WaitExtendAuthSessionRequest, opts ...grpc.CallOption) (*WaitExtendAuthSessionResponse, error)
+	// DismissSessionWarning records that the user clicked "Dismiss" on the
+	// T-WarningLead interactive notification, suppressing the auto-opened
+	// SessionAboutToExpire dialog that would otherwise fire at
+	// T-FinalWarningLead for the current deadline. Idempotent and best-effort:
+	// a missed call only means the fallback dialog will still appear.
+	DismissSessionWarning(ctx context.Context, in *DismissSessionWarningRequest, opts ...grpc.CallOption) (*DismissSessionWarningResponse, error)
 	// StartCPUProfile starts CPU profiling in the daemon
 	StartCPUProfile(ctx context.Context, in *StartCPUProfileRequest, opts ...grpc.CallOption) (*StartCPUProfileResponse, error)
 	// StopCPUProfile stops CPU profiling in the daemon
@@ -136,6 +169,10 @@ type DaemonServiceClient interface {
 	GetInstallerResult(ctx context.Context, in *InstallerResultRequest, opts ...grpc.CallOption) (*InstallerResultResponse, error)
 	// ExposeService exposes a local port via the NetBird reverse proxy
 	ExposeService(ctx context.Context, in *ExposeServiceRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExposeServiceEvent], error)
+	// WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
+	// only cares whether the daemon implements it: an Unimplemented response
+	// means the daemon predates this UI and is too old to drive it.
+	WailsUIReady(ctx context.Context, in *WailsUIReadyRequest, opts ...grpc.CallOption) (*WailsUIReadyResponse, error)
 }
 
 type daemonServiceClient struct {
@@ -186,6 +223,25 @@ func (c *daemonServiceClient) Status(ctx context.Context, in *StatusRequest, opt
 	return out, nil
 }
 
+func (c *daemonServiceClient) SubscribeStatus(ctx context.Context, in *StatusRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StatusResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[0], DaemonService_SubscribeStatus_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[StatusRequest, StatusResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type DaemonService_SubscribeStatusClient = grpc.ServerStreamingClient[StatusResponse]
+
 func (c *daemonServiceClient) Down(ctx context.Context, in *DownRequest, opts ...grpc.CallOption) (*DownResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DownResponse)
@@ -236,6 +292,7 @@ func (c *daemonServiceClient) DeselectNetworks(ctx context.Context, in *SelectNe
 	return out, nil
 }
 
+// Deprecated: Do not use.
 func (c *daemonServiceClient) ForwardingRules(ctx context.Context, in *EmptyRequest, opts ...grpc.CallOption) (*ForwardingRulesResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ForwardingRulesResponse)
@@ -328,7 +385,7 @@ func (c *daemonServiceClient) TracePacket(ctx context.Context, in *TracePacketRe
 
 func (c *daemonServiceClient) StartCapture(ctx context.Context, in *StartCaptureRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[CapturePacket], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[0], DaemonService_StartCapture_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[1], DaemonService_StartCapture_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -367,7 +424,7 @@ func (c *daemonServiceClient) StopBundleCapture(ctx context.Context, in *StopBun
 
 func (c *daemonServiceClient) SubscribeEvents(ctx context.Context, in *SubscribeRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[SystemEvent], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[1], DaemonService_SubscribeEvents_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[2], DaemonService_SubscribeEvents_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -394,6 +451,16 @@ func (c *daemonServiceClient) GetEvents(ctx context.Context, in *GetEventsReques
 	return out, nil
 }
 
+func (c *daemonServiceClient) RegisterUILog(ctx context.Context, in *RegisterUILogRequest, opts ...grpc.CallOption) (*RegisterUILogResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RegisterUILogResponse)
+	err := c.cc.Invoke(ctx, DaemonService_RegisterUILog_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *daemonServiceClient) SwitchProfile(ctx context.Context, in *SwitchProfileRequest, opts ...grpc.CallOption) (*SwitchProfileResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SwitchProfileResponse)
@@ -524,6 +591,36 @@ func (c *daemonServiceClient) WaitJWTToken(ctx context.Context, in *WaitJWTToken
 	return out, nil
 }
 
+func (c *daemonServiceClient) RequestExtendAuthSession(ctx context.Context, in *RequestExtendAuthSessionRequest, opts ...grpc.CallOption) (*RequestExtendAuthSessionResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RequestExtendAuthSessionResponse)
+	err := c.cc.Invoke(ctx, DaemonService_RequestExtendAuthSession_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonServiceClient) WaitExtendAuthSession(ctx context.Context, in *WaitExtendAuthSessionRequest, opts ...grpc.CallOption) (*WaitExtendAuthSessionResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(WaitExtendAuthSessionResponse)
+	err := c.cc.Invoke(ctx, DaemonService_WaitExtendAuthSession_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonServiceClient) DismissSessionWarning(ctx context.Context, in *DismissSessionWarningRequest, opts ...grpc.CallOption) (*DismissSessionWarningResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DismissSessionWarningResponse)
+	err := c.cc.Invoke(ctx, DaemonService_DismissSessionWarning_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *daemonServiceClient) StartCPUProfile(ctx context.Context, in *StartCPUProfileRequest, opts ...grpc.CallOption) (*StartCPUProfileResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(StartCPUProfileResponse)
@@ -556,7 +653,7 @@ func (c *daemonServiceClient) GetInstallerResult(ctx context.Context, in *Instal
 
 func (c *daemonServiceClient) ExposeService(ctx context.Context, in *ExposeServiceRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExposeServiceEvent], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[2], DaemonService_ExposeService_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[3], DaemonService_ExposeService_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -573,6 +670,16 @@ func (c *daemonServiceClient) ExposeService(ctx context.Context, in *ExposeServi
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type DaemonService_ExposeServiceClient = grpc.ServerStreamingClient[ExposeServiceEvent]
 
+func (c *daemonServiceClient) WailsUIReady(ctx context.Context, in *WailsUIReadyRequest, opts ...grpc.CallOption) (*WailsUIReadyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(WailsUIReadyResponse)
+	err := c.cc.Invoke(ctx, DaemonService_WailsUIReady_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // DaemonServiceServer is the server API for DaemonService service.
 // All implementations must embed UnimplementedDaemonServiceServer
 // for forward compatibility.
@@ -586,6 +693,11 @@ type DaemonServiceServer interface {
 	Up(context.Context, *UpRequest) (*UpResponse, error)
 	// Status of the service.
 	Status(context.Context, *StatusRequest) (*StatusResponse, error)
+	// SubscribeStatus pushes a fresh StatusResponse on connection state
+	// changes (Connected / Disconnected / Connecting / address change /
+	// peers list change). The first message on the stream is the current
+	// snapshot, so a freshly-subscribed UI doesn't need to also call Status.
+	SubscribeStatus(*StatusRequest, grpc.ServerStreamingServer[StatusResponse]) error
 	// Down stops engine work in the daemon.
 	Down(context.Context, *DownRequest) (*DownResponse, error)
 	// GetConfig of the daemon.
@@ -596,6 +708,8 @@ type DaemonServiceServer interface {
 	SelectNetworks(context.Context, *SelectNetworksRequest) (*SelectNetworksResponse, error)
 	// Deselect specific routes
 	DeselectNetworks(context.Context, *SelectNetworksRequest) (*SelectNetworksResponse, error)
+	// Deprecated: Do not use.
+	// Unused; the ingress port-forwarding feature was discontinued.
 	ForwardingRules(context.Context, *EmptyRequest) (*ForwardingRulesResponse, error)
 	// DebugBundle creates a debug bundle
 	DebugBundle(context.Context, *DebugBundleRequest) (*DebugBundleResponse, error)
@@ -622,6 +736,10 @@ type DaemonServiceServer interface {
 	StopBundleCapture(context.Context, *StopBundleCaptureRequest) (*StopBundleCaptureResponse, error)
 	SubscribeEvents(*SubscribeRequest, grpc.ServerStreamingServer[SystemEvent]) error
 	GetEvents(context.Context, *GetEventsRequest) (*GetEventsResponse, error)
+	// RegisterUILog records the desktop UI's absolute log path so the daemon's
+	// debug bundle can collect it (the daemon runs as root and can't resolve the
+	// user's config dir).
+	RegisterUILog(context.Context, *RegisterUILogRequest) (*RegisterUILogResponse, error)
 	SwitchProfile(context.Context, *SwitchProfileRequest) (*SwitchProfileResponse, error)
 	SetConfig(context.Context, *SetConfigRequest) (*SetConfigResponse, error)
 	AddProfile(context.Context, *AddProfileRequest) (*AddProfileResponse, error)
@@ -641,6 +759,22 @@ type DaemonServiceServer interface {
 	RequestJWTAuth(context.Context, *RequestJWTAuthRequest) (*RequestJWTAuthResponse, error)
 	// WaitJWTToken waits for JWT authentication completion
 	WaitJWTToken(context.Context, *WaitJWTTokenRequest) (*WaitJWTTokenResponse, error)
+	// RequestExtendAuthSession initiates an SSO session-extension flow.
+	// The daemon prepares a PKCE/device-code request against the IdP and
+	// returns the verification URI; the UI is expected to open it. The flow
+	// state is kept in the daemon until WaitExtendAuthSession completes it.
+	RequestExtendAuthSession(context.Context, *RequestExtendAuthSessionRequest) (*RequestExtendAuthSessionResponse, error)
+	// WaitExtendAuthSession blocks until the user finishes the SSO step
+	// started by RequestExtendAuthSession, then forwards the resulting JWT
+	// to the management server's ExtendAuthSession RPC. Returns the new
+	// session expiry deadline. The tunnel stays up the entire time.
+	WaitExtendAuthSession(context.Context, *WaitExtendAuthSessionRequest) (*WaitExtendAuthSessionResponse, error)
+	// DismissSessionWarning records that the user clicked "Dismiss" on the
+	// T-WarningLead interactive notification, suppressing the auto-opened
+	// SessionAboutToExpire dialog that would otherwise fire at
+	// T-FinalWarningLead for the current deadline. Idempotent and best-effort:
+	// a missed call only means the fallback dialog will still appear.
+	DismissSessionWarning(context.Context, *DismissSessionWarningRequest) (*DismissSessionWarningResponse, error)
 	// StartCPUProfile starts CPU profiling in the daemon
 	StartCPUProfile(context.Context, *StartCPUProfileRequest) (*StartCPUProfileResponse, error)
 	// StopCPUProfile stops CPU profiling in the daemon
@@ -648,6 +782,10 @@ type DaemonServiceServer interface {
 	GetInstallerResult(context.Context, *InstallerResultRequest) (*InstallerResultResponse, error)
 	// ExposeService exposes a local port via the NetBird reverse proxy
 	ExposeService(*ExposeServiceRequest, grpc.ServerStreamingServer[ExposeServiceEvent]) error
+	// WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
+	// only cares whether the daemon implements it: an Unimplemented response
+	// means the daemon predates this UI and is too old to drive it.
+	WailsUIReady(context.Context, *WailsUIReadyRequest) (*WailsUIReadyResponse, error)
 	mustEmbedUnimplementedDaemonServiceServer()
 }
 
@@ -670,6 +808,9 @@ func (UnimplementedDaemonServiceServer) Up(context.Context, *UpRequest) (*UpResp
 func (UnimplementedDaemonServiceServer) Status(context.Context, *StatusRequest) (*StatusResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method Status not implemented")
 }
+func (UnimplementedDaemonServiceServer) SubscribeStatus(*StatusRequest, grpc.ServerStreamingServer[StatusResponse]) error {
+	return status.Error(codes.Unimplemented, "method SubscribeStatus not implemented")
+}
 func (UnimplementedDaemonServiceServer) Down(context.Context, *DownRequest) (*DownResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method Down not implemented")
 }
@@ -727,6 +868,9 @@ func (UnimplementedDaemonServiceServer) SubscribeEvents(*SubscribeRequest, grpc.
 func (UnimplementedDaemonServiceServer) GetEvents(context.Context, *GetEventsRequest) (*GetEventsResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method GetEvents not implemented")
 }
+func (UnimplementedDaemonServiceServer) RegisterUILog(context.Context, *RegisterUILogRequest) (*RegisterUILogResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RegisterUILog not implemented")
+}
 func (UnimplementedDaemonServiceServer) SwitchProfile(context.Context, *SwitchProfileRequest) (*SwitchProfileResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method SwitchProfile not implemented")
 }
@@ -766,6 +910,15 @@ func (UnimplementedDaemonServiceServer) RequestJWTAuth(context.Context, *Request
 func (UnimplementedDaemonServiceServer) WaitJWTToken(context.Context, *WaitJWTTokenRequest) (*WaitJWTTokenResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method WaitJWTToken not implemented")
 }
+func (UnimplementedDaemonServiceServer) RequestExtendAuthSession(context.Context, *RequestExtendAuthSessionRequest) (*RequestExtendAuthSessionResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RequestExtendAuthSession not implemented")
+}
+func (UnimplementedDaemonServiceServer) WaitExtendAuthSession(context.Context, *WaitExtendAuthSessionRequest) (*WaitExtendAuthSessionResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method WaitExtendAuthSession not implemented")
+}
+func (UnimplementedDaemonServiceServer) DismissSessionWarning(context.Context, *DismissSessionWarningRequest) (*DismissSessionWarningResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method DismissSessionWarning not implemented")
+}
 func (UnimplementedDaemonServiceServer) StartCPUProfile(context.Context, *StartCPUProfileRequest) (*StartCPUProfileResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method StartCPUProfile not implemented")
 }
@@ -778,6 +931,9 @@ func (UnimplementedDaemonServiceServer) GetInstallerResult(context.Context, *Ins
 func (UnimplementedDaemonServiceServer) ExposeService(*ExposeServiceRequest, grpc.ServerStreamingServer[ExposeServiceEvent]) error {
 	return status.Error(codes.Unimplemented, "method ExposeService not implemented")
 }
+func (UnimplementedDaemonServiceServer) WailsUIReady(context.Context, *WailsUIReadyRequest) (*WailsUIReadyResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method WailsUIReady not implemented")
+}
 func (UnimplementedDaemonServiceServer) mustEmbedUnimplementedDaemonServiceServer() {}
 func (UnimplementedDaemonServiceServer) testEmbeddedByValue()                       {}
 
@@ -871,6 +1027,17 @@ func _DaemonService_Status_Handler(srv interface{}, ctx context.Context, dec fun
 	return interceptor(ctx, in, info, handler)
 }
 
+func _DaemonService_SubscribeStatus_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(StatusRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(DaemonServiceServer).SubscribeStatus(m, &grpc.GenericServerStream[StatusRequest, StatusResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type DaemonService_SubscribeStatusServer = grpc.ServerStreamingServer[StatusResponse]
+
 func _DaemonService_Down_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(DownRequest)
 	if err := dec(in); err != nil {
@@ -1199,6 +1366,24 @@ func _DaemonService_GetEvents_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }
 
+func _DaemonService_RegisterUILog_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RegisterUILogRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).RegisterUILog(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_RegisterUILog_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).RegisterUILog(ctx, req.(*RegisterUILogRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _DaemonService_SwitchProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(SwitchProfileRequest)
 	if err := dec(in); err != nil {
@@ -1433,6 +1618,60 @@ func _DaemonService_WaitJWTToken_Handler(srv interface{}, ctx context.Context, d
 	return interceptor(ctx, in, info, handler)
 }
 
+func _DaemonService_RequestExtendAuthSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RequestExtendAuthSessionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).RequestExtendAuthSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_RequestExtendAuthSession_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).RequestExtendAuthSession(ctx, req.(*RequestExtendAuthSessionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DaemonService_WaitExtendAuthSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(WaitExtendAuthSessionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).WaitExtendAuthSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_WaitExtendAuthSession_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).WaitExtendAuthSession(ctx, req.(*WaitExtendAuthSessionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DaemonService_DismissSessionWarning_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DismissSessionWarningRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).DismissSessionWarning(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_DismissSessionWarning_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).DismissSessionWarning(ctx, req.(*DismissSessionWarningRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _DaemonService_StartCPUProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(StartCPUProfileRequest)
 	if err := dec(in); err != nil {
@@ -1498,6 +1737,24 @@ func _DaemonService_ExposeService_Handler(srv interface{}, stream grpc.ServerStr
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type DaemonService_ExposeServiceServer = grpc.ServerStreamingServer[ExposeServiceEvent]
 
+func _DaemonService_WailsUIReady_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(WailsUIReadyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).WailsUIReady(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_WailsUIReady_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).WailsUIReady(ctx, req.(*WailsUIReadyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // DaemonService_ServiceDesc is the grpc.ServiceDesc for DaemonService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -1589,6 +1846,10 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetEvents",
 			Handler:    _DaemonService_GetEvents_Handler,
 		},
+		{
+			MethodName: "RegisterUILog",
+			Handler:    _DaemonService_RegisterUILog_Handler,
+		},
 		{
 			MethodName: "SwitchProfile",
 			Handler:    _DaemonService_SwitchProfile_Handler,
@@ -1641,6 +1902,18 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "WaitJWTToken",
 			Handler:    _DaemonService_WaitJWTToken_Handler,
 		},
+		{
+			MethodName: "RequestExtendAuthSession",
+			Handler:    _DaemonService_RequestExtendAuthSession_Handler,
+		},
+		{
+			MethodName: "WaitExtendAuthSession",
+			Handler:    _DaemonService_WaitExtendAuthSession_Handler,
+		},
+		{
+			MethodName: "DismissSessionWarning",
+			Handler:    _DaemonService_DismissSessionWarning_Handler,
+		},
 		{
 			MethodName: "StartCPUProfile",
 			Handler:    _DaemonService_StartCPUProfile_Handler,
@@ -1653,8 +1926,17 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetInstallerResult",
 			Handler:    _DaemonService_GetInstallerResult_Handler,
 		},
+		{
+			MethodName: "WailsUIReady",
+			Handler:    _DaemonService_WailsUIReady_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "SubscribeStatus",
+			Handler:       _DaemonService_SubscribeStatus_Handler,
+			ServerStreams: true,
+		},
 		{
 			StreamName:    "StartCapture",
 			Handler:       _DaemonService_StartCapture_Handler,
diff --git a/client/proto/generate.sh b/client/proto/generate.sh
index 1ae55e380..d73367d12 100755
--- a/client/proto/generate.sh
+++ b/client/proto/generate.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 if ! which realpath >/dev/null 2>&1; then
@@ -12,5 +12,11 @@ script_path=$(dirname "$(realpath "$0")")
 cd "$script_path"
 go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.6
 go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.6.1
-protoc -I ./ ./daemon.proto --go_out=../ --go-grpc_out=../ --experimental_allow_proto3_optional
+go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@v2.26.3
+protoc -I ./ ./daemon.proto \
+  --go_out=../ \
+  --go-grpc_out=../ \
+  --grpc-gateway_out=../ \
+  --grpc-gateway_opt=generate_unbound_methods=true \
+  --experimental_allow_proto3_optional
 cd "$old_pwd"
diff --git a/client/proto/metadata.go b/client/proto/metadata.go
new file mode 100644
index 000000000..9b1dbd16e
--- /dev/null
+++ b/client/proto/metadata.go
@@ -0,0 +1,61 @@
+package proto
+
+// SystemEvent metadata markers. The daemon stamps these on internal control
+// events it publishes over SubscribeEvents (profile-list refresh, log-level
+// change); the desktop UI recognises them and acts on them instead of
+// surfacing them as user-facing notifications.
+//
+// These live in the proto package — the shared contract both the daemon
+// (client/server) and the UI (client/ui/services) already import — so producer
+// and consumer reference the same constant rather than duplicating literals.
+// This file is hand-written and not touched by protoc.
+const (
+	// MetadataKindKey is the SystemEvent.metadata key carrying the event-kind
+	// marker (one of the MetadataKind* values below).
+	MetadataKindKey = "kind"
+
+	// MetadataKindProfileListChanged marks a CLI-driven profile add/remove that
+	// should nudge the UI's profile views to refresh.
+	MetadataKindProfileListChanged = "profile-list-changed"
+	// MetadataKindLogLevelChanged marks a daemon log-level change (or the
+	// per-subscription snapshot) that drives the GUI's file logging on/off.
+	MetadataKindLogLevelChanged = "log-level-changed"
+
+	// MetadataProfileKey carries the profile name for
+	// MetadataKindProfileListChanged.
+	MetadataProfileKey = "profile"
+	// MetadataLevelKey carries the lowercase logrus level name for
+	// MetadataKindLogLevelChanged.
+	MetadataLevelKey = "level"
+)
+
+// SystemEvent metadata markers for daemon config-change events. The daemon
+// publishes a SYSTEM-category event whenever its effective Config is
+// replaced (engine spawn, Up RPC, MDM policy diff); the UI re-fetches its
+// cached config/features in response and, for the MDM source, shows a
+// localised toast. Producer (client/server) and consumer (client/ui) share
+// these so neither duplicates the wire literals.
+const (
+	// MetadataTypeKey is the SystemEvent.metadata key carrying the
+	// config-change event type (one of the MetadataType* values below).
+	MetadataTypeKey = "type"
+	// MetadataTypeConfigChanged marks a config replacement that should nudge
+	// UIs to re-fetch their cached config + features. UserMessage is empty so
+	// the change is silent; the source is carried in MetadataSourceKey.
+	MetadataTypeConfigChanged = "config_changed"
+	// MetadataTypePolicyApplied marks an MDM-policy-driven config change. The
+	// daemon stamps it with a (non-localised) UserMessage; the UI suppresses
+	// that and builds its own localised toast off the paired config_changed
+	// event instead.
+	MetadataTypePolicyApplied = "policy_applied"
+
+	// MetadataSourceKey is the SystemEvent.metadata key carrying what
+	// triggered a config_changed event (one of the MetadataSource* values).
+	MetadataSourceKey = "source"
+	// MetadataSourceStartup marks a config_changed from the daemon Start path.
+	MetadataSourceStartup = "startup"
+	// MetadataSourceUpRPC marks a config_changed from the Up RPC.
+	MetadataSourceUpRPC = "up_rpc"
+	// MetadataSourceMDM marks a config_changed driven by an MDM policy diff.
+	MetadataSourceMDM = "mdm"
+)
diff --git a/client/server/debug.go b/client/server/debug.go
index 14dcaba33..8f4a506b4 100644
--- a/client/server/debug.go
+++ b/client/server/debug.go
@@ -7,18 +7,63 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"path/filepath"
 	"runtime/pprof"
+	"strings"
+	"time"
 
 	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
 
+	"github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/internal/debug"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/version"
 )
 
 // DebugBundle creates a debug bundle and returns the location.
-func (s *Server) DebugBundle(_ context.Context, req *proto.DebugBundleRequest) (resp *proto.DebugBundleResponse, err error) {
+func (s *Server) DebugBundle(callerCtx context.Context, req *proto.DebugBundleRequest) (resp *proto.DebugBundleResponse, err error) {
+	if err := requirePrivilegeForUploadURL(callerCtx, req.GetUploadURL(), req.GetUploadInsecure()); err != nil {
+		return nil, err
+	}
+
+	// The UI log is opened as whoever asked for this bundle, so a caller only
+	// collects a log it owns (privileged callers excepted). ok is false on a
+	// socket that carries no identity, which skips the UI log.
+	callerID, callerIdentified := ipcauth.CallerIdentity(callerCtx)
+
+	path, managementURL, err := s.generateDebugBundle(req, uiLogOpener(callerID, callerIdentified))
+	if err != nil {
+		return nil, err
+	}
+
+	if req.GetUploadURL() == "" {
+		return &proto.DebugBundleResponse{Path: path}, nil
+	}
+
+	// The upload runs without s.mutex held: it does network I/O to a possibly
+	// slow destination and must not block the other RPCs that take the lock. The
+	// bounded context is a backstop against a hung connection.
+	uploadCtx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+	key, err := debug.UploadDebugBundle(uploadCtx, req.GetUploadURL(), managementURL, path, req.GetUploadInsecure())
+	if err != nil {
+		log.Errorf("failed to upload debug bundle to %s: %v", req.GetUploadURL(), err)
+		return &proto.DebugBundleResponse{Path: path, UploadFailureReason: err.Error()}, nil
+	}
+
+	log.Infof("debug bundle uploaded to %s with key %s", req.GetUploadURL(), key)
+
+	return &proto.DebugBundleResponse{Path: path, UploadedKey: key}, nil
+}
+
+// generateDebugBundle builds the bundle under s.mutex and returns its path plus
+// the management URL captured under the lock, so the caller can run the upload
+// without holding the lock.
+func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener debug.LogOpener) (path string, managementURL string, err error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
@@ -53,7 +98,10 @@ func (s *Server) DebugBundle(_ context.Context, req *proto.DebugBundleRequest) (
 		if engine != nil {
 			refreshStatus = func() {
 				log.Debug("refreshing system health status for debug bundle")
-				engine.RunHealthProbes(true)
+				// Background ctx: the bundle wants a full, fresh probe regardless
+				// of the DebugBundle RPC client's lifetime. The engine's own ctx
+				// still aborts it on shutdown.
+				engine.RunHealthProbes(context.Background(), true)
 			}
 		}
 	}
@@ -64,6 +112,8 @@ func (s *Server) DebugBundle(_ context.Context, req *proto.DebugBundleRequest) (
 			StatusRecorder: s.statusRecorder,
 			SyncResponse:   syncResponse,
 			LogPath:        s.logFile,
+			UILogPath:      s.uiLogPath,
+			UILogOpener:    uiOpener,
 			CPUProfile:     cpuProfileData,
 			CapturePath:    capturePath,
 			RefreshStatus:  refreshStatus,
@@ -73,28 +123,22 @@ func (s *Server) DebugBundle(_ context.Context, req *proto.DebugBundleRequest) (
 		},
 		debug.BundleConfig{
 			Anonymize:         req.GetAnonymize(),
+			AnonymizeLevel:    anonymize.ParseLevel(req.GetAnonymizeLevel()),
 			IncludeSystemInfo: req.GetSystemInfo(),
 			LogFileCount:      req.GetLogFileCount(),
 		},
 	)
 
-	path, err := bundleGenerator.Generate()
+	path, err = bundleGenerator.Generate()
 	if err != nil {
-		return nil, fmt.Errorf("generate debug bundle: %w", err)
+		return "", "", fmt.Errorf("generate debug bundle: %w", err)
 	}
 
-	if req.GetUploadURL() == "" {
-		return &proto.DebugBundleResponse{Path: path}, nil
-	}
-	key, err := debug.UploadDebugBundle(context.Background(), req.GetUploadURL(), s.config.ManagementURL.String(), path)
-	if err != nil {
-		log.Errorf("failed to upload debug bundle to %s: %v", req.GetUploadURL(), err)
-		return &proto.DebugBundleResponse{Path: path, UploadFailureReason: err.Error()}, nil
+	if s.config != nil && s.config.ManagementURL != nil {
+		managementURL = s.config.ManagementURL.String()
 	}
 
-	log.Infof("debug bundle uploaded to %s with key %s", req.GetUploadURL(), key)
-
-	return &proto.DebugBundleResponse{Path: path, UploadedKey: key}, nil
+	return path, managementURL, nil
 }
 
 // GetLogLevel gets the current logging level for the server.
@@ -124,9 +168,48 @@ func (s *Server) SetLogLevel(_ context.Context, req *proto.SetLogLevelRequest) (
 
 	log.Infof("Log level set to %s", level.String())
 
+	// Signal the desktop UI so it can attach/detach its gui-client.log. Rides
+	// the SubscribeEvents stream as a marked event (see publishLogLevelChanged).
+	s.publishLogLevelChanged(level.String())
+
 	return &proto.SetLogLevelResponse{}, nil
 }
 
+// RegisterUILog records the desktop UI's absolute log path so DebugBundle can
+// collect the GUI log. The daemon runs as root and can't resolve the user's
+// config dir, so the UI reports it. Last-writer-wins (one UI per socket).
+//
+// The path arrives over an IPC any local user can reach and is later opened by
+// a root daemon, so it is constrained to the file name the UI writes and to a
+// local absolute path. Authorization happens when DebugBundle opens it: the
+// bundle refuses a file its requester does not own. A caller the daemon cannot
+// identify cannot register a path at all.
+func (s *Server) RegisterUILog(callerCtx context.Context, req *proto.RegisterUILogRequest) (*proto.RegisterUILogResponse, error) {
+	if _, ok := ipcauth.CallerIdentity(callerCtx); !ok {
+		return nil, gstatus.Error(codes.PermissionDenied,
+			"registering a UI log path requires a control channel that carries the caller's identity")
+	}
+
+	path := filepath.Clean(req.GetPath())
+	if !filepath.IsAbs(path) || filepath.Base(path) != uiLogFileName {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "UI log path must be an absolute path ending in %s", uiLogFileName)
+	}
+	// filepath.IsAbs accepts a Windows UNC path (\\host\share\...) and a device
+	// path (\\.\, \\?\); opening one would make the root daemon reach a remote
+	// or device namespace. Require a plain local path.
+	if strings.HasPrefix(path, `\\`) {
+		return nil, gstatus.Error(codes.InvalidArgument, "UI log path must be a local path, not a UNC or device path")
+	}
+
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	s.uiLogPath = path
+	log.Infof("registered UI log path %s", s.uiLogPath)
+
+	return &proto.RegisterUILogResponse{}, nil
+}
+
 // SetSyncResponsePersistence sets the sync response persistence for the server.
 func (s *Server) SetSyncResponsePersistence(_ context.Context, req *proto.SetSyncResponsePersistenceRequest) (*proto.SetSyncResponsePersistenceResponse, error) {
 	s.mutex.Lock()
diff --git a/client/server/debug_gate.go b/client/server/debug_gate.go
new file mode 100644
index 000000000..983a13aaf
--- /dev/null
+++ b/client/server/debug_gate.go
@@ -0,0 +1,99 @@
+//go:build !android && !ios
+
+package server
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/configs"
+	"github.com/netbirdio/netbird/client/internal/debug"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/upload-server/types"
+)
+
+// uiLogFileName is the only file name the daemon accepts as a UI log path. The
+// UI (writer), this validation, and the bundle collector all read it from
+// configs so they cannot drift.
+const uiLogFileName = configs.UILogFile
+
+// uiLogOpener opens the registered UI log, and its rotated siblings, on behalf
+// of the caller requesting the bundle: OpenOwnedFile then collects the log only
+// when that caller owns it (or is privileged). identified is false on a socket
+// that carries no caller identity, in which case nothing is opened.
+func uiLogOpener(id ipcauth.Identity, identified bool) debug.LogOpener {
+	return func(path string) (*os.File, error) {
+		if !identified {
+			return nil, fmt.Errorf("bundle requester has no verified identity")
+		}
+		return ipcauth.OpenOwnedFile(id, path)
+	}
+}
+
+// requirePrivilegeForUploadURL restricts where the daemon may send a debug
+// bundle. The bundle holds the daemon's own logs and state, and the daemon
+// fetches the upload URL itself, so an unrestricted endpoint turns the daemon
+// into both an exfiltration channel and a request forwarder that reaches
+// services only it can talk to.
+//
+// The upload service NetBird publishes is open to any caller, since that is what
+// the CLI and the desktop UI use. Any other endpoint, self-hosted upload servers
+// included, requires a privileged caller. Plaintext is refused for everyone: the
+// daemon fetches the URL and then PUTs the bundle to whatever that fetch returns,
+// so an http hop is a place to intercept the bundle or the redirect.
+//
+// insecure relaxes transport security (http, or an untrusted TLS certificate)
+// for a self-hosted server. It weakens a root-privileged upload, so it is
+// refused for an unprivileged caller regardless of the host.
+func requirePrivilegeForUploadURL(ctx context.Context, rawURL string, insecure bool) error {
+	if rawURL == "" {
+		return nil
+	}
+
+	parsed, err := url.Parse(rawURL)
+	if err != nil {
+		return gstatus.Errorf(codes.InvalidArgument, "parse upload URL: %v", err)
+	}
+
+	// --insecure relaxes https to http or an untrusted certificate; it does not
+	// widen the URL to arbitrary schemes, so a host and http/https are required
+	// before the insecure branch takes over.
+	if parsed.Host == "" || (parsed.Scheme != "https" && parsed.Scheme != "http") {
+		return gstatus.Errorf(codes.InvalidArgument, "upload URL must be http or https with a host")
+	}
+
+	if insecure {
+		return denyPrivileged(ctx,
+			"uploading a debug bundle without transport security (--upload-bundle-insecure)",
+			ipcauth.ElevatedCommand("netbird debug bundle -U --upload-bundle-insecure --upload-bundle-url <url>"))
+	}
+
+	if parsed.Scheme != "https" {
+		return gstatus.Errorf(codes.InvalidArgument, "upload URL must use https, got scheme %q", parsed.Scheme)
+	}
+
+	if isDefaultUploadService(parsed) {
+		return nil
+	}
+
+	return denyPrivileged(ctx,
+		"uploading a debug bundle to an upload service other than the default one",
+		ipcauth.ElevatedCommand("netbird debug bundle -U --upload-bundle-url <url>"))
+}
+
+// isDefaultUploadService reports whether the URL points at the upload service
+// NetBird runs. Only the host is compared: the service's path may differ between
+// releases, and the host is what decides who receives the bundle.
+func isDefaultUploadService(parsed *url.URL) bool {
+	defaultURL, err := url.Parse(types.DefaultBundleURL)
+	if err != nil {
+		return false
+	}
+	return parsed.Scheme == defaultURL.Scheme && strings.EqualFold(parsed.Host, defaultURL.Host)
+}
diff --git a/client/server/debug_gate_test.go b/client/server/debug_gate_test.go
new file mode 100644
index 000000000..e958fc581
--- /dev/null
+++ b/client/server/debug_gate_test.go
@@ -0,0 +1,157 @@
+//go:build !android && !ios
+
+package server
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/upload-server/types"
+)
+
+func TestRegisterUILogRefusesUnidentifiedCaller(t *testing.T) {
+	s := &Server{}
+
+	_, err := s.RegisterUILog(noIdentityCtx(), &proto.RegisterUILogRequest{
+		Path: filepath.Join(t.TempDir(), uiLogFileName),
+	})
+
+	if gstatus.Code(err) != codes.PermissionDenied {
+		t.Fatalf("code = %v, want PermissionDenied", gstatus.Code(err))
+	}
+}
+
+func TestRegisterUILogRefusesForeignPath(t *testing.T) {
+	secret := "/etc/shadow"
+	if runtime.GOOS == "windows" {
+		secret = `C:\Windows\System32\config\SAM`
+	}
+
+	tests := []struct {
+		name string
+		path string
+	}{
+		{"empty", ""},
+		{"relative", filepath.Join("netbird", uiLogFileName)},
+		{"another file", secret},
+		{"directory of the log", t.TempDir()},
+		{"unc path", `\\attacker\share\` + uiLogFileName},
+		{"device path", `\\.\C:\` + uiLogFileName},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			s := &Server{}
+
+			_, err := s.RegisterUILog(userCtx(), &proto.RegisterUILogRequest{Path: tc.path})
+
+			if gstatus.Code(err) != codes.InvalidArgument {
+				t.Fatalf("code = %v, want InvalidArgument", gstatus.Code(err))
+			}
+			if s.uiLogPath != "" {
+				t.Fatalf("path %q was recorded despite the refusal", s.uiLogPath)
+			}
+		})
+	}
+}
+
+func TestRegisterUILogRecordsPath(t *testing.T) {
+	s := &Server{}
+	path := filepath.Join(t.TempDir(), uiLogFileName)
+
+	if _, err := s.RegisterUILog(userCtx(), &proto.RegisterUILogRequest{Path: path}); err != nil {
+		t.Fatalf("register: %v", err)
+	}
+
+	if s.uiLogPath != path {
+		t.Fatalf("path = %q, want %q", s.uiLogPath, path)
+	}
+}
+
+// The UI log is opened as the bundle requester, so a second local user cannot
+// collect a log they do not own, and an unidentified requester collects nothing.
+func TestUILogOpenerBindsToRequester(t *testing.T) {
+	path := filepath.Join(t.TempDir(), uiLogFileName)
+	if err := os.WriteFile(path, []byte("log line"), 0600); err != nil {
+		t.Fatalf("write log: %v", err)
+	}
+
+	// A different unprivileged user than the file's owner: refused.
+	if _, err := uiLogOpener(unprivilegedIdentity(), true)(path); err == nil {
+		t.Fatal("expected a file the requester does not own to be refused")
+	}
+
+	// No verified identity: refused.
+	if _, err := uiLogOpener(ipcauth.Identity{}, false)(path); err == nil {
+		t.Fatal("expected an unidentified requester to be refused")
+	}
+
+	// The requester that owns the file: allowed. The test process created it, so
+	// its own identity is the owner (and a privileged runner is exempt anyway).
+	owner, err := ipcauth.CurrentProcessIdentity()
+	if err != nil {
+		t.Fatalf("current identity: %v", err)
+	}
+	f, err := uiLogOpener(owner, true)(path)
+	if err != nil {
+		t.Fatalf("expected the owning requester to be allowed, got %v", err)
+	}
+	_ = f.Close()
+}
+
+func TestRequirePrivilegeForUploadURL(t *testing.T) {
+	tests := []struct {
+		name     string
+		url      string
+		insecure bool
+		unprivOK bool
+		invalid  bool
+		rootAlso bool
+	}{
+		{name: "no upload", url: "", unprivOK: true},
+		{name: "default service", url: types.DefaultBundleURL, unprivOK: true},
+		{name: "default service, other path", url: "https://upload.debug.netbird.io/other", unprivOK: true},
+		{name: "loopback exfiltration endpoint", url: "https://127.0.0.1:8080/upload-url", rootAlso: true},
+		{name: "custom upload service", url: "https://attacker.example/upload-url", rootAlso: true},
+		{name: "plaintext default host", url: "http://upload.debug.netbird.io/upload-url", invalid: true},
+		{name: "plaintext custom host", url: "http://attacker.example/upload-url", invalid: true},
+		{name: "unsupported scheme", url: "file:///etc/shadow", invalid: true},
+		// insecure relaxes transport security; privileged only, whatever the host.
+		{name: "insecure http custom", url: "http://selfhosted.local/upload-url", insecure: true, rootAlso: true},
+		{name: "insecure https custom", url: "https://selfhosted.local/upload-url", insecure: true, rootAlso: true},
+		{name: "insecure default host", url: types.DefaultBundleURL, insecure: true, rootAlso: true},
+		// --insecure must not widen the URL to non-http(s) schemes or a hostless URL.
+		{name: "insecure file scheme", url: "file:///etc/shadow", insecure: true, invalid: true},
+		{name: "insecure hostless", url: "https:///upload-url", insecure: true, invalid: true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := requirePrivilegeForUploadURL(userCtx(), tc.url, tc.insecure)
+
+			switch {
+			case tc.invalid:
+				if gstatus.Code(err) != codes.InvalidArgument {
+					t.Fatalf("code = %v, want InvalidArgument", gstatus.Code(err))
+				}
+				return
+			case tc.unprivOK:
+				assertAllowed(t, err)
+				return
+			default:
+				assertDenied(t, err)
+			}
+
+			if tc.rootAlso {
+				assertAllowed(t, requirePrivilegeForUploadURL(rootCtx(), tc.url, tc.insecure))
+			}
+		})
+	}
+}
diff --git a/client/server/event.go b/client/server/event.go
index d93151c96..753a051e7 100644
--- a/client/server/event.go
+++ b/client/server/event.go
@@ -1,7 +1,9 @@
 package server
 
 import (
+	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/netbirdio/netbird/client/proto"
 )
@@ -16,6 +18,15 @@ func (s *Server) SubscribeEvents(req *proto.SubscribeRequest, stream proto.Daemo
 	log.Debug("client subscribed to events")
 	s.startUpdateManagerForGUI()
 
+	// Replay the current log level to this subscriber so a freshly-connected UI
+	// learns it even when the daemon was already started with --log-level debug
+	// (the change-driven publishLogLevelChanged only fires on SetLogLevel). Sent
+	// directly on this stream rather than via PublishEvent so it reaches only
+	// the new subscriber, not every connected client.
+	if err := s.sendCurrentLogLevel(stream); err != nil {
+		return err
+	}
+
 	for {
 		select {
 		case event := <-subscription.Events():
@@ -28,3 +39,24 @@ func (s *Server) SubscribeEvents(req *proto.SubscribeRequest, stream proto.Daemo
 		}
 	}
 }
+
+// sendCurrentLogLevel sends a marked log-level-changed SystemEvent carrying the
+// daemon's current level directly to one subscriber. Mirrors the shape
+// publishLogLevelChanged emits so the UI's dispatchSystemEvent handles both the
+// same way.
+func (s *Server) sendCurrentLogLevel(stream proto.DaemonService_SubscribeEventsServer) error {
+	level := log.GetLevel().String()
+	event := &proto.SystemEvent{
+		Id:        uuid.New().String(),
+		Severity:  proto.SystemEvent_INFO,
+		Category:  proto.SystemEvent_SYSTEM,
+		Message:   "Log level changed",
+		Metadata:  map[string]string{proto.MetadataKindKey: proto.MetadataKindLogLevelChanged, proto.MetadataLevelKey: level},
+		Timestamp: timestamppb.Now(),
+	}
+	if err := stream.Send(event); err != nil {
+		log.Warnf("error sending initial log level event: %v", err)
+		return err
+	}
+	return nil
+}
diff --git a/client/server/extend_authsession_test.go b/client/server/extend_authsession_test.go
new file mode 100644
index 000000000..a1a048a7c
--- /dev/null
+++ b/client/server/extend_authsession_test.go
@@ -0,0 +1,42 @@
+package server
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+)
+
+func TestInnermostStatus(t *testing.T) {
+	t.Run("wrapped gRPC status", func(t *testing.T) {
+		inner := gstatus.Error(codes.PermissionDenied, "peer is already registered by a different User or a Setup Key")
+		// Mirror the daemon wrap chain: engine wraps with %w, mgm error is the inner status.
+		wrapped := fmt.Errorf("extend auth session on management: %w", inner)
+
+		st := innermostStatus(wrapped)
+		require.NotNil(t, st)
+		require.Equal(t, codes.PermissionDenied, st.Code())
+		require.Equal(t, "peer is already registered by a different User or a Setup Key", st.Message())
+	})
+
+	t.Run("deepest status wins over an outer one", func(t *testing.T) {
+		inner := gstatus.Error(codes.PermissionDenied, "deepest")
+		chain := fmt.Errorf("outer: %w", fmt.Errorf("mid: %w", inner))
+
+		st := innermostStatus(chain)
+		require.NotNil(t, st)
+		require.Equal(t, codes.PermissionDenied, st.Code())
+		require.Equal(t, "deepest", st.Message())
+	})
+
+	t.Run("no status in chain", func(t *testing.T) {
+		require.Nil(t, innermostStatus(errors.New("plain error")))
+	})
+
+	t.Run("nil error", func(t *testing.T) {
+		require.Nil(t, innermostStatus(nil))
+	})
+}
diff --git a/client/server/forwardingrules.go b/client/server/forwardingrules.go
deleted file mode 100644
index 3d706c36d..000000000
--- a/client/server/forwardingrules.go
+++ /dev/null
@@ -1,54 +0,0 @@
-package server
-
-import (
-	"context"
-
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-func (s *Server) ForwardingRules(context.Context, *proto.EmptyRequest) (*proto.ForwardingRulesResponse, error) {
-	s.mutex.Lock()
-	defer s.mutex.Unlock()
-
-	rules := s.statusRecorder.ForwardingRules()
-	responseRules := make([]*proto.ForwardingRule, 0, len(rules))
-	for _, rule := range rules {
-		respRule := &proto.ForwardingRule{
-			Protocol:           string(rule.Protocol),
-			DestinationPort:    portToProto(rule.DestinationPort),
-			TranslatedAddress:  rule.TranslatedAddress.String(),
-			TranslatedHostname: s.hostNameByTranslateAddress(rule.TranslatedAddress.String()),
-			TranslatedPort:     portToProto(rule.TranslatedPort),
-		}
-		responseRules = append(responseRules, respRule)
-
-	}
-
-	return &proto.ForwardingRulesResponse{Rules: responseRules}, nil
-}
-
-func (s *Server) hostNameByTranslateAddress(ip string) string {
-	hostName, ok := s.statusRecorder.PeerByIP(ip)
-	if !ok {
-		return ip
-	}
-
-	return hostName
-}
-
-func portToProto(port firewall.Port) *proto.PortInfo {
-	var portInfo proto.PortInfo
-
-	if !port.IsRange {
-		portInfo.PortSelection = &proto.PortInfo_Port{Port: uint32(port.Values[0])}
-	} else {
-		portInfo.PortSelection = &proto.PortInfo_Range_{
-			Range: &proto.PortInfo_Range{
-				Start: uint32(port.Values[0]),
-				End:   uint32(port.Values[1]),
-			},
-		}
-	}
-	return &portInfo
-}
diff --git a/client/server/jwt_cache.go b/client/server/jwt_cache.go
index 21e170517..73cec046d 100644
--- a/client/server/jwt_cache.go
+++ b/client/server/jwt_cache.go
@@ -6,11 +6,21 @@ import (
 
 	"github.com/awnumar/memguard"
 	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 )
 
 type jwtCache struct {
-	mu           sync.RWMutex
-	enclave      *memguard.Enclave
+	mu      sync.RWMutex
+	enclave *memguard.Enclave
+	owner   *ipcauth.Identity
+
+	// generation counts the invalidations. A caller that starts an
+	// authentication takes the generation first and hands it back to store, so
+	// a token obtained under a session that ended while the IdP was being
+	// polled cannot land in the cache the new session is using.
+	generation uint64
+
 	expiresAt    time.Time
 	timer        *time.Timer
 	maxTokenSize int
@@ -22,10 +32,23 @@ func newJWTCache() *jwtCache {
 	}
 }
 
-func (c *jwtCache) store(token string, maxAge time.Duration) {
+func (c *jwtCache) currentGeneration() uint64 {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	return c.generation
+}
+
+// store keeps the token only while generation is still the current one, and
+// reports whether it did. See the generation field.
+func (c *jwtCache) store(token string, owner ipcauth.Identity, maxAge time.Duration, generation uint64) bool {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
+	if c.generation != generation {
+		return false
+	}
+
 	c.cleanup()
 
 	if c.timer != nil {
@@ -35,6 +58,7 @@ func (c *jwtCache) store(token string, maxAge time.Duration) {
 	tokenBytes := []byte(token)
 	c.enclave = memguard.NewEnclave(tokenBytes)
 
+	c.owner = &owner
 	c.expiresAt = time.Now().Add(maxAge)
 
 	var timer *time.Timer
@@ -49,9 +73,12 @@ func (c *jwtCache) store(token string, maxAge time.Duration) {
 		log.Debugf("JWT token cache expired after %v, securely wiped from memory", maxAge)
 	})
 	c.timer = timer
+
+	return true
 }
 
-func (c *jwtCache) get() (string, bool) {
+// get returns the cached token to the identity that stored it.
+func (c *jwtCache) get(caller ipcauth.Identity) (string, bool) {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
 
@@ -59,6 +86,11 @@ func (c *jwtCache) get() (string, bool) {
 		return "", false
 	}
 
+	if c.owner == nil || !c.owner.SameUser(caller) {
+		log.Warnf("refusing the cached SSH JWT: caller %s is not the identity that obtained it", caller)
+		return "", false
+	}
+
 	buffer, err := c.enclave.Open()
 	if err != nil {
 		log.Debugf("Failed to open JWT token enclave: %v", err)
@@ -70,10 +102,23 @@ func (c *jwtCache) get() (string, bool) {
 	return token, true
 }
 
+func (c *jwtCache) clear() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.timer != nil {
+		c.timer.Stop()
+		c.timer = nil
+	}
+	c.cleanup()
+	c.generation++
+}
+
 // cleanup destroys the secure enclave, must be called with lock held
 func (c *jwtCache) cleanup() {
 	if c.enclave != nil {
 		c.enclave = nil
 	}
+	c.owner = nil
 	c.expiresAt = time.Time{}
 }
diff --git a/client/server/jwt_cache_test.go b/client/server/jwt_cache_test.go
new file mode 100644
index 000000000..11d208ade
--- /dev/null
+++ b/client/server/jwt_cache_test.go
@@ -0,0 +1,176 @@
+package server
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+const testTTL = time.Minute
+
+func unixCaller(uid uint32) ipcauth.Identity {
+	return ipcauth.Identity{UID: uid, GID: uid}
+}
+
+func windowsCaller(sid string) ipcauth.Identity {
+	return ipcauth.Identity{SID: sid}
+}
+
+func TestJWTCache_ServesTheOwner(t *testing.T) {
+	c := newJWTCache()
+	owner := unixCaller(1000)
+	c.store("token-for-1000", owner, testTTL, c.currentGeneration())
+
+	got, found := c.get(owner)
+
+	require.True(t, found, "the identity that stored the token must get it back")
+	assert.Equal(t, "token-for-1000", got)
+}
+
+// The disclosure this cache guards against: one local account collecting the
+// SSH JWT another account's authentication put in the daemon-wide cache.
+func TestJWTCache_RefusesAnotherLocalUser(t *testing.T) {
+	tests := []struct {
+		name   string
+		owner  ipcauth.Identity
+		caller ipcauth.Identity
+	}{
+		{"different uid", unixCaller(1000), unixCaller(65534)},
+		{"root is not the owner either", unixCaller(1000), unixCaller(0)},
+		{"different sid", windowsCaller("S-1-5-21-1-2-3-1001"), windowsCaller("S-1-5-21-1-2-3-1002")},
+		{"windows caller against a unix owner", unixCaller(0), windowsCaller("S-1-5-18")},
+		{"unix caller against a windows owner", windowsCaller("S-1-5-18"), unixCaller(0)},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := newJWTCache()
+			c.store("victim-token", tt.owner, testTTL, c.currentGeneration())
+
+			got, found := c.get(tt.caller)
+
+			assert.False(t, found, "a caller that is not the owner must get a miss")
+			assert.Empty(t, got)
+		})
+	}
+}
+
+func TestJWTCache_EmptyCacheMatchesNobody(t *testing.T) {
+	c := newJWTCache()
+
+	got, found := c.get(unixCaller(0))
+
+	assert.False(t, found)
+	assert.Empty(t, got)
+}
+
+// An entry with no recorded owner must match nobody, root included: an
+// unidentified caller arrives as the zero Identity, which carries uid 0. This
+// pins the nil-owner guard rather than the comparison, so it sets up an entry
+// that exists and then drops its owner.
+func TestJWTCache_UnownedEntryMatchesNobody(t *testing.T) {
+	c := newJWTCache()
+	c.store("token", unixCaller(1000), testTTL, c.currentGeneration())
+	c.owner = nil
+
+	got, found := c.get(unixCaller(0))
+
+	assert.False(t, found)
+	assert.Empty(t, got)
+}
+
+// The same user calling once elevated and once not is still the same user, so
+// hiding their own token from them would be wrong.
+func TestJWTCache_ElevationDoesNotChangeTheOwner(t *testing.T) {
+	c := newJWTCache()
+	sid := "S-1-5-21-1-2-3-1001"
+	owner := windowsCaller(sid)
+	owner.Elevated = true
+	c.store("token", owner, testTTL, c.currentGeneration())
+
+	got, found := c.get(windowsCaller(sid))
+
+	require.True(t, found)
+	assert.Equal(t, "token", got)
+}
+
+func TestJWTCache_Expiry(t *testing.T) {
+	c := newJWTCache()
+	owner := unixCaller(1000)
+	c.store("token", owner, testTTL, c.currentGeneration())
+	c.expiresAt = time.Now().Add(-time.Second)
+
+	_, found := c.get(owner)
+
+	assert.False(t, found)
+}
+
+// Logout and SwitchProfile call clear — Down deliberately does not: the NetBird
+// session the token speaks for is over, so not even its owner may have it back.
+func TestJWTCache_ClearDropsTheEntry(t *testing.T) {
+	c := newJWTCache()
+	owner := unixCaller(1000)
+	c.store("token", owner, testTTL, c.currentGeneration())
+
+	c.clear()
+
+	_, found := c.get(owner)
+	assert.False(t, found)
+	assert.Nil(t, c.owner, "clear must forget the owner too")
+	assert.Nil(t, c.timer, "clear must stop the expiry timer")
+}
+
+// WaitJWTToken polls the IdP unlocked, so a logout or a profile switch can
+// clear the cache while a flow is still in the air. The token that flow returns
+// belongs to the session that ended, so it must not land in the cache the new
+// session is using.
+func TestJWTCache_StoreFromAnEndedSessionIsDropped(t *testing.T) {
+	c := newJWTCache()
+	owner := unixCaller(1000)
+
+	// The generation a caller takes when its authentication starts.
+	generation := c.currentGeneration()
+
+	c.clear() // logout or profile switch, while the IdP is still being polled
+
+	stored := c.store("stale-token", owner, testTTL, generation)
+
+	assert.False(t, stored, "a token from an ended session must not be cached")
+	_, found := c.get(owner)
+	assert.False(t, found, "the cache must stay empty after the session ended")
+}
+
+// The same caller must still be able to store once it re-reads the generation, so
+// the guard does not wedge the cache after any invalidation.
+func TestJWTCache_StoreWorksAgainAfterClear(t *testing.T) {
+	c := newJWTCache()
+	owner := unixCaller(1000)
+
+	c.clear()
+
+	require.True(t, c.store("token", owner, testTTL, c.currentGeneration()))
+
+	got, found := c.get(owner)
+	require.True(t, found)
+	assert.Equal(t, "token", got)
+}
+
+func TestJWTCache_StoreReplacesThePreviousOwner(t *testing.T) {
+	c := newJWTCache()
+	first := unixCaller(1000)
+	second := unixCaller(1001)
+
+	c.store("first-token", first, testTTL, c.currentGeneration())
+	c.store("second-token", second, testTTL, c.currentGeneration())
+
+	_, found := c.get(first)
+	assert.False(t, found, "the previous owner must not reach the new token")
+
+	got, found := c.get(second)
+	require.True(t, found)
+	assert.Equal(t, "second-token", got)
+}
diff --git a/client/server/lock_order_test.go b/client/server/lock_order_test.go
new file mode 100644
index 000000000..457e3db34
--- /dev/null
+++ b/client/server/lock_order_test.go
@@ -0,0 +1,51 @@
+package server
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// The daemon takes guardedConfigMu before s.mutex. authorizeAndPrepareLogin
+// takes s.mutex while holding guardedConfigMu, so a SetConfig that grabbed
+// s.mutex first and then waited for guardedConfigMu would deadlock the daemon
+// against a concurrent login: two unprivileged IPC calls are enough.
+//
+// The held guardedConfigMu below stands in for that login. While SetConfig waits
+// for it, s.mutex must stay free, otherwise the login waiting for s.mutex could
+// never release guardedConfigMu.
+func TestSetConfig_TakesGuardedConfigMuBeforeServerMutex(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+
+	s.guardedConfigMu.Lock()
+
+	done := make(chan error, 1)
+	go func() {
+		_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+			ProfileName: profName,
+			Username:    username,
+		})
+		done <- err
+	}()
+
+	require.Never(t, func() bool {
+		if !s.mutex.TryLock() {
+			return true
+		}
+		s.mutex.Unlock()
+		return false
+	}, 500*time.Millisecond, 10*time.Millisecond,
+		"SetConfig held s.mutex while waiting for guardedConfigMu, which deadlocks against a concurrent login")
+
+	s.guardedConfigMu.Unlock()
+
+	select {
+	case err := <-done:
+		require.NoError(t, err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("SetConfig did not finish after guardedConfigMu was released")
+	}
+}
diff --git a/client/server/login_account_test.go b/client/server/login_account_test.go
new file mode 100644
index 000000000..6198a00bc
--- /dev/null
+++ b/client/server/login_account_test.go
@@ -0,0 +1,332 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/auth"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+type jwtStoringMDMFetcher struct {
+	cache      *jwtCache
+	caller     ipcauth.Identity
+	generation uint64
+}
+
+func (f *jwtStoringMDMFetcher) Fetch() map[string]any {
+	f.generation = f.cache.currentGeneration()
+	f.cache.store("previous-profile-token", f.caller, time.Minute, f.generation)
+	return nil
+}
+
+type stubOAuthFlow struct {
+	token  auth.TokenInfo
+	onWait func()
+}
+
+func (f *stubOAuthFlow) RequestAuthInfo(context.Context) (auth.AuthFlowInfo, error) {
+	return auth.AuthFlowInfo{}, nil
+}
+
+func (f *stubOAuthFlow) WaitToken(context.Context, auth.AuthFlowInfo) (auth.TokenInfo, error) {
+	if f.onWait != nil {
+		f.onWait()
+	}
+	return f.token, nil
+}
+
+func (f *stubOAuthFlow) GetClientID(context.Context) string {
+	return "stub-client"
+}
+
+func TestWaitSSOLogin_WrongAccountArmsPromptAndFails(t *testing.T) {
+	s := newSSOTestServer(t, "user@example.com", false, "other@example.com")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return "", nil
+	}
+
+	resp, err := s.WaitSSOLogin(callerCtx(t), &proto.WaitSSOLoginRequest{UserCode: "code"})
+	require.Error(t, err)
+	require.Nil(t, resp)
+	require.Equal(t, 0, attempts, "the wrong account's token reached the management login")
+	require.True(t, s.forceAccountPrompt, "the next login was not armed to ask for the account")
+	require.Nil(t, s.oauthAuthFlow.flow, "the mismatched flow stayed cached for reuse")
+
+	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
+	require.NoError(t, stateErr)
+	require.Equal(t, internal.StatusNeedsLogin, status, "the mismatch must stay retryable")
+}
+
+func TestWaitSSOLogin_WrongAccountAfterPromptProceeds(t *testing.T) {
+	s := newSSOTestServer(t, "user@example.com", true, "other@example.com")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return "", nil
+	}
+
+	resp, err := s.WaitSSOLogin(callerCtx(t), &proto.WaitSSOLoginRequest{UserCode: "code"})
+	require.NoError(t, err, "a prompted round must not error again on a mismatch")
+	require.NotNil(t, resp)
+	require.Equal(t, "other@example.com", resp.Email)
+	require.Equal(t, 1, attempts)
+	require.False(t, s.forceAccountPrompt)
+}
+
+func TestWaitSSOLogin_MatchingAccountProceeds(t *testing.T) {
+	s := newSSOTestServer(t, "user@example.com", false, "User@Example.com")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return "", nil
+	}
+
+	resp, err := s.WaitSSOLogin(callerCtx(t), &proto.WaitSSOLoginRequest{UserCode: "code"})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, 1, attempts)
+	require.False(t, s.forceAccountPrompt)
+}
+
+func TestWaitSSOLogin_NoHintIsNotJudged(t *testing.T) {
+	s := newSSOTestServer(t, "", false, "whoever@example.com")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return "", nil
+	}
+
+	_, err := s.WaitSSOLogin(callerCtx(t), &proto.WaitSSOLoginRequest{UserCode: "code"})
+	require.NoError(t, err)
+	require.Equal(t, 1, attempts)
+	require.False(t, s.forceAccountPrompt)
+}
+
+func TestSwitchProfile_DropsAccountPromptAndPendingFlow(t *testing.T) {
+	s, ctx, _, _, _ := setupServerWithProfile(t)
+	s.forceAccountPrompt = true
+	cancelled := false
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:       &stubOAuthFlow{},
+		hint:       "user@example.com",
+		waitCancel: func() { cancelled = true },
+	}
+
+	extendCancelled := false
+	s.extendAuthSessionFlow.Set(&stubOAuthFlow{}, auth.AuthFlowInfo{DeviceCode: "device"})
+	s.extendAuthSessionFlow.SetWaitCancel(func() { extendCancelled = true })
+
+	_, err := s.SwitchProfile(ctx, nil)
+	require.NoError(t, err)
+	require.False(t, s.forceAccountPrompt, "the prompt flag leaked across a profile switch")
+	require.Nil(t, s.oauthAuthFlow.flow, "the previous profile's flow leaked across a profile switch")
+	require.Empty(t, s.oauthAuthFlow.hint)
+	require.True(t, cancelled, "the pending wait was not cancelled")
+
+	require.True(t, extendCancelled, "the pending extend wait was not cancelled")
+	_, _, pending := s.extendAuthSessionFlow.Get()
+	require.False(t, pending, "the previous profile's extend flow leaked across a profile switch")
+}
+
+func TestLogin_ProfileSwitchDropsAccountPromptAndPendingFlow(t *testing.T) {
+	s, _, _, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		return true, nil
+	}
+
+	other := "other-profile"
+	otherPath := filepath.Join(filepath.Dir(cfgPath), other+".json")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    otherPath,
+		ManagementURL: "https://api.netbird.io:443",
+	})
+	require.NoError(t, err)
+	breakProfilePrivateKey(t, otherPath)
+
+	s.forceAccountPrompt = true
+	cancelled := false
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:       &stubOAuthFlow{},
+		hint:       "user@example.com",
+		waitCancel: func() { cancelled = true },
+	}
+
+	extendCancelled := false
+	s.extendAuthSessionFlow.Set(&stubOAuthFlow{}, auth.AuthFlowInfo{DeviceCode: "device"})
+	s.extendAuthSessionFlow.SetWaitCancel(func() { extendCancelled = true })
+
+	generation := s.jwtCache.currentGeneration()
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{ProfileName: &other, Username: &username})
+	require.Error(t, err, "the broken key must stop the login before a flow is built")
+
+	active, err := s.profileManager.GetActiveProfileState()
+	require.NoError(t, err)
+	require.Equal(t, profilemanager.ID(other), active.ID, "the login did not switch the profile")
+
+	require.False(t, s.forceAccountPrompt, "the prompt flag leaked across a login-driven profile switch")
+	require.Nil(t, s.oauthAuthFlow.flow, "the previous profile's flow leaked across a login-driven profile switch")
+	require.Empty(t, s.oauthAuthFlow.hint)
+	require.True(t, cancelled, "the pending wait was not cancelled")
+
+	require.True(t, extendCancelled, "the pending extend wait was not cancelled")
+	_, _, pending := s.extendAuthSessionFlow.Get()
+	require.False(t, pending, "the previous profile's extend flow leaked across a login-driven profile switch")
+
+	require.Greater(t, s.jwtCache.currentGeneration(), generation, "the previous profile's JWT cache survived a login-driven profile switch")
+}
+
+func TestLogin_ProfileSwitchRejectsJWTObtainedUnderPreviousConfig(t *testing.T) {
+	s, _, _, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		return false, errors.New("stop once the config is swapped")
+	}
+
+	other := "other-profile"
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    filepath.Join(filepath.Dir(cfgPath), other+".json"),
+		ManagementURL: "https://api.netbird.io:443",
+	})
+	require.NoError(t, err)
+
+	// getConfig loads the MDM policy right before Login swaps s.config, so the
+	// fetcher runs where a RequestJWTAuth racing the login would land: after the
+	// switch dropped the previous profile's state, while s.config still belongs
+	// to the previous profile. It caches a token under the generation current at
+	// that point, as WaitJWTToken would.
+	generation := s.jwtCache.currentGeneration()
+	fetcher := &jwtStoringMDMFetcher{cache: s.jwtCache, caller: unprivilegedIdentity()}
+	s.mdmLoader = mdm.NewLoader(fetcher)
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{ProfileName: &other, Username: &username})
+	require.Error(t, err)
+
+	require.Greater(t, fetcher.generation, generation, "the token was not cached after the switch dropped the previous profile's state")
+	_, found := s.jwtCache.get(fetcher.caller)
+	require.False(t, found, "a JWT obtained under the previous profile's config survived the login-driven switch")
+}
+
+func TestLogin_SameProfileKeepsPendingFlow(t *testing.T) {
+	s, _, profName, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		return true, nil
+	}
+	breakProfilePrivateKey(t, cfgPath)
+
+	cancelled := false
+	flow := &stubOAuthFlow{}
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:       flow,
+		hint:       "user@example.com",
+		waitCancel: func() { cancelled = true },
+	}
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{ProfileName: &profName, Username: &username})
+	require.Error(t, err, "the broken key must stop the login before a flow is built")
+
+	require.Equal(t, flow, s.oauthAuthFlow.flow, "a login on the same profile dropped the flow a second client could join")
+	require.Equal(t, "user@example.com", s.oauthAuthFlow.hint)
+	require.False(t, cancelled, "a login on the same profile cancelled the pending wait")
+}
+
+func TestWaitSSOLogin_JudgesTheFlowThatProducedTheToken(t *testing.T) {
+	s := newSSOTestServer(t, "user@example.com", false, "user@example.com")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return "", nil
+	}
+
+	flow := s.oauthAuthFlow.flow.(*stubOAuthFlow)
+	flow.onWait = func() {
+		s.mutex.Lock()
+		defer s.mutex.Unlock()
+		s.oauthAuthFlow.hint = "someone-else@example.com"
+	}
+
+	resp, err := s.WaitSSOLogin(callerCtx(t), &proto.WaitSSOLoginRequest{UserCode: "code"})
+	require.NoError(t, err, "a flow replaced mid-wait must not decide this wait's verdict")
+	require.NotNil(t, resp)
+	require.Equal(t, 1, attempts)
+	require.False(t, s.forceAccountPrompt, "the prompt was armed off another flow's hint")
+}
+
+func TestReuseOAuthFlow_ForcedPromptRefusesTheCachedFlow(t *testing.T) {
+	s := New(internal.CtxInitState(context.Background()), "console", "", false, false, false, false)
+	cancelled := false
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:       &stubOAuthFlow{},
+		info:       auth.AuthFlowInfo{UserCode: "code"},
+		expiresAt:  time.Now().Add(time.Hour),
+		waitCancel: func() { cancelled = true },
+	}
+
+	state := internal.CtxGetState(s.rootCtx)
+	resp := s.reuseOAuthFlow(context.Background(), &stubOAuthFlow{}, state, true)
+	require.Nil(t, resp, "a forced account prompt reused the flow that skipped it")
+	require.True(t, cancelled, "the predecessor wait was orphaned")
+
+	resp = s.reuseOAuthFlow(context.Background(), &stubOAuthFlow{}, state, false)
+	require.NotNil(t, resp, "an unforced login stopped reusing a live flow")
+	require.Equal(t, "code", resp.UserCode)
+}
+
+func TestReplaceOAuthFlow_CancelsTheDisplacedWait(t *testing.T) {
+	s := New(internal.CtxInitState(context.Background()), "console", "", false, false, false, false)
+	cancelled := false
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:            &stubOAuthFlow{},
+		info:            auth.AuthFlowInfo{UserCode: "code"},
+		expiresAt:       time.Now().Add(time.Hour),
+		hint:            "user@example.com",
+		accountPrompted: true,
+		waitCancel:      func() { cancelled = true },
+	}
+
+	next := &stubOAuthFlow{}
+	s.replaceOAuthFlow(oauthAuthFlow{flow: next, info: auth.AuthFlowInfo{UserCode: "next"}})
+
+	require.True(t, cancelled, "the displaced wait was left without an owner")
+	require.Equal(t, next, s.oauthAuthFlow.flow)
+	require.Equal(t, "next", s.oauthAuthFlow.info.UserCode)
+	require.Empty(t, s.oauthAuthFlow.hint, "the previous flow's hint survived the replacement")
+	require.False(t, s.oauthAuthFlow.accountPrompted)
+	require.Nil(t, s.oauthAuthFlow.waitCancel, "the consumed cancel stayed on the record")
+}
+
+func newSSOTestServer(t *testing.T, hint string, accountPrompted bool, tokenEmail string) *Server {
+	t.Helper()
+	s := New(internal.CtxInitState(context.Background()), "console", "", false, false, false, false)
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:            &stubOAuthFlow{token: auth.TokenInfo{Email: tokenEmail, EmailClaim: tokenEmail}},
+		info:            auth.AuthFlowInfo{UserCode: "code"},
+		expiresAt:       time.Now().Add(time.Minute),
+		hint:            hint,
+		accountPrompted: accountPrompted,
+	}
+	return s
+}
+
+// callerCtx is the gRPC caller's context. WaitSSOLogin parks a goroutine on it
+// for the whole browser leg, so a test that never cancels leaks one.
+func callerCtx(t *testing.T) context.Context {
+	t.Helper()
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	return ctx
+}
diff --git a/client/server/login_gate_test.go b/client/server/login_gate_test.go
new file mode 100644
index 000000000..17ae3ecad
--- /dev/null
+++ b/client/server/login_gate_test.go
@@ -0,0 +1,127 @@
+package server
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// A refused login must not leave the profile switched. Login can both switch
+// profiles and carry the guarded config fields, so the gate has to run before the
+// switch: otherwise a caller whose change is refused still gets the side effect of
+// activating whichever profile the request named.
+func TestLogin_RefusedChangeLeavesTheProfileAlone(t *testing.T) {
+	s, _, activeProfile, username, _ := setupServerWithProfile(t)
+
+	// Login reads process state off the daemon's root context.
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	// A second profile that runs the SSH server, which is what makes repointing
+	// its management binding a privileged change.
+	target := "ssh-enabled"
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:       filepath.Join(profilemanager.DefaultConfigPathDir, target+".json"),
+		ManagementURL:    "https://api.netbird.io:443",
+		ServerSSHAllowed: boolPtr(true),
+	})
+	require.NoError(t, err)
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{
+		ProfileName:   &target,
+		Username:      &username,
+		ManagementUrl: "https://mgmt.attacker.example:443",
+	})
+	require.Error(t, err, "an unprivileged caller must not move the management URL of an SSH-enabled profile")
+	require.Equal(t, codes.PermissionDenied, gstatus.Code(err), "want a privilege refusal, got %v", err)
+
+	active, err := s.profileManager.GetActiveProfileState()
+	require.NoError(t, err)
+	require.Equal(t, profilemanager.ID(activeProfile), active.ID,
+		"the refused login switched the active profile anyway")
+}
+
+// A caller whose change becomes privileged only after its first check must be
+// refused without having cancelled a login or switched profiles: the first check is
+// unsynchronized, so the SSH server can be enabled by a concurrent privileged
+// request in between, and the authoritative check happens before any side effect.
+func TestLogin_ChangeThatBecomesPrivilegedMidRequestHasNoSideEffects(t *testing.T) {
+	s, _, activeProfile, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	// The target profile has SSH off, so the first check lets the request through.
+	target := "ssh-later"
+	targetPath := filepath.Join(profilemanager.DefaultConfigPathDir, target+".json")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:       targetPath,
+		ManagementURL:    "https://api.netbird.io:443",
+		ServerSSHAllowed: boolPtr(false),
+	})
+	require.NoError(t, err)
+
+	cancelled := false
+	s.actCancel = func() { cancelled = true }
+
+	// Stand in for a privileged SetConfig that enables the SSH server between the
+	// two checks, which is the interleaving the lock has to make safe.
+	afterLoginPreCheck = func() {
+		_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+			ConfigPath:       targetPath,
+			ServerSSHAllowed: boolPtr(true),
+		})
+		require.NoError(t, err)
+	}
+	t.Cleanup(func() { afterLoginPreCheck = nil })
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{
+		ProfileName:   &target,
+		Username:      &username,
+		ManagementUrl: "https://mgmt.attacker.example:443",
+	})
+	require.Error(t, err)
+	require.Equal(t, codes.PermissionDenied, gstatus.Code(err), "want a privilege refusal, got %v", err)
+	require.False(t, cancelled, "the refused login cancelled the login already in progress")
+
+	active, err := s.profileManager.GetActiveProfileState()
+	require.NoError(t, err)
+	require.Equal(t, profilemanager.ID(activeProfile), active.ID, "the refused login switched the active profile anyway")
+
+	stored, err := profilemanager.GetExistingConfig(targetPath)
+	require.NoError(t, err)
+	require.Equal(t, "https://api.netbird.io:443", stored.ManagementURL.String(), "the refused login moved the management URL")
+}
+
+// Login cancels whatever login is already in progress before starting its own. A
+// refused caller must not get that far, otherwise anyone able to reach the socket
+// can abort someone else's login by sending a request that is denied.
+func TestLogin_RefusedChangeLeavesAnInProgressLoginAlone(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	target := "ssh-enabled"
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:       filepath.Join(profilemanager.DefaultConfigPathDir, target+".json"),
+		ManagementURL:    "https://api.netbird.io:443",
+		ServerSSHAllowed: boolPtr(true),
+	})
+	require.NoError(t, err)
+
+	cancelled := false
+	s.actCancel = func() { cancelled = true }
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{
+		ProfileName:   &target,
+		Username:      &username,
+		ManagementUrl: "https://mgmt.attacker.example:443",
+	})
+	require.Error(t, err)
+	require.Equal(t, codes.PermissionDenied, gstatus.Code(err), "want a privilege refusal, got %v", err)
+	require.False(t, cancelled, "the refused login cancelled the login already in progress")
+}
diff --git a/client/server/login_outcome_test.go b/client/server/login_outcome_test.go
new file mode 100644
index 000000000..7ebf04f92
--- /dev/null
+++ b/client/server/login_outcome_test.go
@@ -0,0 +1,110 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// A login that never reached Management is not a decision about the peer's
+// credentials, so it must come back as a retryable error rather than an SSO
+// prompt: the user cannot finish a browser login while Management is down, and
+// the CLI's own backoff resolves the outage on its own once the daemon reports
+// the failure. Reproduces `netbird down; netbird up` printing a device-code URL
+// because Management happened to be restarting when the daemon dialed it.
+func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	unreachable := errors.New("create connection: dial context: context deadline exceeded")
+	attempts := 0
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		attempts++
+		return false, unreachable
+	}
+
+	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
+	require.Error(t, err)
+	require.ErrorIs(t, err, unreachable, "the transport failure was replaced by something else")
+	require.Nil(t, resp, "a failed login must not answer with a login response")
+	require.Equal(t, 1, attempts)
+	require.Nil(t, s.oauthAuthFlow.flow, "the daemon started an SSO flow for a peer whose login was never decided")
+
+	status, err := internal.CtxGetState(s.rootCtx).Status()
+	require.NoError(t, err)
+	require.Equal(t, internal.StatusLoginFailed, status,
+		"a peer that could not reach Management is not waiting on a login")
+}
+
+// The counterpart: Management refusing the peer's credentials is a decision, and
+// the SSO flow still has to start for it. The profile carries an unusable
+// private key so the flow setup fails immediately instead of dialing, which is
+// enough to show the branch was entered — the refusal itself is never what comes
+// back out.
+func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
+	s, _, _, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	breakProfilePrivateKey(t, cfgPath)
+
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		return true, nil
+	}
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
+	require.Error(t, err)
+
+	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
+	require.NoError(t, stateErr)
+	require.Equal(t, internal.StatusLoginFailed, status,
+		"the SSO flow setup was never reached with the broken key")
+}
+
+func TestLogin_SetupKeyStillRunsWhenPeerNeedsLogin(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		return true, nil
+	}
+
+	var keysTried []string
+	s.loginAttemptFn = func(_ context.Context, setupKey, _ string) (internal.StatusType, error) {
+		keysTried = append(keysTried, setupKey)
+		return "", nil
+	}
+
+	setupKey := "A2C8E32F-AEB2-4B45-8FD3-8A0C1B2D3E4F"
+	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username, SetupKey: setupKey})
+	require.NoError(t, err, "the probe's outcome leaked out as the login result")
+	require.NotNil(t, resp)
+	require.Equal(t, []string{setupKey}, keysTried, "the setup key never reached the login attempt")
+	require.Nil(t, s.oauthAuthFlow.flow, "a setup-key login started an SSO flow")
+
+	status, err := internal.CtxGetState(s.rootCtx).Status()
+	require.NoError(t, err)
+	require.Equal(t, internal.StatusIdle, status)
+}
+
+// breakProfilePrivateKey replaces the profile's private key with an unparseable
+// one, which makes any attempt to build a Management client fail on the spot.
+func breakProfilePrivateKey(t *testing.T, cfgPath string) {
+	t.Helper()
+
+	raw, err := os.ReadFile(cfgPath)
+	require.NoError(t, err)
+
+	var cfg map[string]any
+	require.NoError(t, json.Unmarshal(raw, &cfg))
+	cfg["PrivateKey"] = "not-a-key"
+
+	patched, err := json.Marshal(cfg)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(cfgPath, patched, 0o600))
+}
diff --git a/client/server/login_overrides_test.go b/client/server/login_overrides_test.go
index 5a2298764..f858c6059 100644
--- a/client/server/login_overrides_test.go
+++ b/client/server/login_overrides_test.go
@@ -7,6 +7,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
 )
 
 func TestPersistLoginOverrides(t *testing.T) {
@@ -80,10 +81,13 @@ func TestPersistLoginOverrides(t *testing.T) {
 			require.NoError(t, err, "seed config")
 
 			activeProf := &profilemanager.ActiveProfileState{ID: "default"}
-			err = persistLoginOverrides(activeProf, tt.newMgmtURL, tt.newPSK)
+			err = persistLoginOverrides(activeProf, &proto.LoginRequest{
+				ManagementUrl:        tt.newMgmtURL,
+				OptionalPreSharedKey: tt.newPSK,
+			})
 			require.NoError(t, err, "persistLoginOverrides")
 
-			cfg, err := profilemanager.ReadConfig(profilemanager.DefaultConfigPath)
+			cfg, err := profilemanager.ReadConfigOrDefault(profilemanager.DefaultConfigPath)
 			require.NoError(t, err, "read back config")
 
 			require.Equal(t, tt.wantMgmtURL, cfg.ManagementURL.String(), "management URL")
diff --git a/client/server/logout_gate_test.go b/client/server/logout_gate_test.go
new file mode 100644
index 000000000..d88801959
--- /dev/null
+++ b/client/server/logout_gate_test.go
@@ -0,0 +1,200 @@
+package server
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// unreachableManagementURL keeps a test that is expected to stop at a gate from
+// reaching the network if the gate ever regresses: the profiles a logout must
+// not touch point here, so a leak fails fast instead of contacting a real
+// management server.
+const unreachableManagementURL = "https://127.0.0.1:9"
+
+// enableSSHOnProfile rewrites the profile config at cfgPath with the SSH server
+// enabled. Deregistering an SSH-enabled profile is a privileged change, so an
+// unprivileged caller is refused by requirePrivilegeForDeregistration before any
+// management connection is attempted, which is what keeps these tests offline.
+func enableSSHOnProfile(t *testing.T, cfgPath string) {
+	t.Helper()
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:       cfgPath,
+		ManagementURL:    "https://api.netbird.io:443",
+		ServerSSHAllowed: boolPtr(true),
+	})
+	require.NoError(t, err)
+}
+
+// Logging out of the profile the daemon is already running is a deregistration,
+// not profile management, so the profiles-disabled kill switch must not block
+// it. The desktop UI always addresses logout by profile (both the profile menu
+// and the session-expiration dialog), so gating it left users with
+// disableProfiles enforced unable to log out at all.
+func TestLogout_ActiveProfileAllowedWhenProfilesDisabled(t *testing.T) {
+	s, _, activeProfile, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	enableSSHOnProfile(t, cfgPath)
+
+	s.profilesDisabled = true
+
+	_, err := s.Logout(userCtx(), &proto.LogoutRequest{
+		ProfileName: &activeProfile,
+		Username:    &username,
+	})
+
+	require.Error(t, err, "the SSH privilege gate is expected to refuse this unprivileged caller")
+	require.Equal(t, codes.PermissionDenied, gstatus.Code(err),
+		"logout of the active profile must reach the deregistration path, not be refused as profile management: %v", err)
+	require.NotContains(t, gstatus.Convert(err).Message(), errProfilesDisabled)
+}
+
+// A profile-addressed logout that targets some *other* profile does manage
+// profiles, so it stays gated: with profiles disabled the daemon must not
+// deregister a peer the user is not currently running.
+func TestLogout_OtherProfileStaysGatedWhenProfilesDisabled(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	other := "other-profile"
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    filepath.Join(profilemanager.DefaultConfigPathDir, other+".json"),
+		ManagementURL: unreachableManagementURL,
+	})
+	require.NoError(t, err)
+
+	s.profilesDisabled = true
+
+	_, err = s.Logout(userCtx(), &proto.LogoutRequest{
+		ProfileName: &other,
+		Username:    &username,
+	})
+
+	require.Error(t, err)
+	require.Equal(t, codes.Unavailable, gstatus.Code(err), "want the profiles-disabled refusal, got %v", err)
+	require.Contains(t, gstatus.Convert(err).Message(), errProfilesDisabled)
+}
+
+// A legacy profile ID is a display name, so two users can hold the same ID in
+// their own profile directories. Matching on the ID alone would let one user's
+// logout pass the gate against the other user's active profile, so the username
+// is part of the comparison.
+func TestLogout_ForeignUserProfileStaysGatedWhenProfilesDisabled(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	// A legacy-style profile whose ID is its filename stem, and an active state
+	// claiming that same ID for a different user.
+	shared := "shared-legacy-name"
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    filepath.Join(profilemanager.DefaultConfigPathDir, shared+".json"),
+		ManagementURL: unreachableManagementURL,
+	})
+	require.NoError(t, err)
+	require.NoError(t, s.profileManager.SetActiveProfileState(&profilemanager.ActiveProfileState{
+		ID:       profilemanager.ID(shared),
+		Username: "someone-else",
+	}))
+
+	s.profilesDisabled = true
+
+	_, err = s.Logout(userCtx(), &proto.LogoutRequest{
+		ProfileName: &shared,
+		Username:    &username,
+	})
+
+	require.Error(t, err)
+	require.Equal(t, codes.Unavailable, gstatus.Code(err),
+		"another user's profile must not pass the gate on an ID match alone: %v", err)
+}
+
+// Deregistering a namesake profile must not go out with the running config.
+// logoutFromProfile reuses the connected client's config when the target is the
+// active profile, and on an ID-only match a shared legacy ID made it reuse it
+// for another user's profile, deregistering the active peer instead.
+func TestLogout_ForeignUserProfileDoesNotUseTheRunningConfig(t *testing.T) {
+	s, _, _, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	// The running config has the SSH server enabled, so reusing it would be
+	// refused with PermissionDenied. The namesake profile does not, so the
+	// correct path gets as far as dialing its own unreachable management URL.
+	enableSSHOnProfile(t, cfgPath)
+	running, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	s.config = running
+	s.connectClient = newDummyConnectClient(context.Background())
+
+	shared := "shared-legacy-name"
+	_, err = profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    filepath.Join(profilemanager.DefaultConfigPathDir, shared+".json"),
+		ManagementURL: unreachableManagementURL,
+	})
+	require.NoError(t, err)
+	require.NoError(t, s.profileManager.SetActiveProfileState(&profilemanager.ActiveProfileState{
+		ID:       profilemanager.ID(shared),
+		Username: "someone-else",
+	}))
+
+	// Bounded so the deregistration the fixed path attempts fails on the dial
+	// rather than sitting in gRPC backoff for the whole test timeout.
+	ctx, cancel := context.WithTimeout(userCtx(), 2*time.Second)
+	t.Cleanup(cancel)
+
+	_, err = s.Logout(ctx, &proto.LogoutRequest{
+		ProfileName: &shared,
+		Username:    &username,
+	})
+
+	require.Error(t, err)
+	require.NotEqual(t, codes.PermissionDenied, gstatus.Code(err),
+		"the namesake profile was deregistered with the running config: %v", err)
+}
+
+// The connection teardown follows the profile that is active when the logout
+// completes, not the one seen before it started: Login switches profiles under
+// guardedConfigMu, which the logout path does not hold, so a login that landed
+// meanwhile must keep its connection.
+func TestCleanupAfterProfileLogout_FollowsTheCurrentActiveProfile(t *testing.T) {
+	s, _, activeProfile, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	state := internal.CtxGetState(s.rootCtx)
+
+	s.cleanupAfterProfileLogout("some-other-profile", username)
+	status, err := state.Status()
+	require.NoError(t, err)
+	require.NotEqual(t, internal.StatusNeedsLogin, status,
+		"logging out of a profile that is not active must not ask for a new login")
+
+	s.cleanupAfterProfileLogout(profilemanager.ID(activeProfile), username)
+	status, err = state.Status()
+	require.NoError(t, err)
+	require.Equal(t, internal.StatusNeedsLogin, status,
+		"logging out of the active profile must ask for a new login")
+}
+
+// With profiles enabled the gate is out of the way on both surfaces; the active
+// profile still reaches the deregistration path.
+func TestLogout_ActiveProfileAllowedWhenProfilesEnabled(t *testing.T) {
+	s, _, activeProfile, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	enableSSHOnProfile(t, cfgPath)
+
+	_, err := s.Logout(userCtx(), &proto.LogoutRequest{
+		ProfileName: &activeProfile,
+		Username:    &username,
+	})
+
+	require.Error(t, err, "the SSH privilege gate is expected to refuse this unprivileged caller")
+	require.Equal(t, codes.PermissionDenied, gstatus.Code(err), "want the privilege refusal, got %v", err)
+}
diff --git a/client/server/mdm.go b/client/server/mdm.go
index db7db2759..b22c3b0a3 100644
--- a/client/server/mdm.go
+++ b/client/server/mdm.go
@@ -13,28 +13,6 @@ import (
 	"github.com/netbirdio/netbird/client/proto"
 )
 
-// preSharedKeyRedactedSentinel is the value GetConfig returns in place
-// of an actual PSK, so a UI that round-trips the field back to the
-// daemon (via SetConfig / Login) can be distinguished from a deliberate
-// override. Any incoming PSK that equals this sentinel is treated as
-// a no-op echo, never as a conflict with the policy.
-const preSharedKeyRedactedSentinel = "**********"
-
-// loadMDMPolicy is the indirection used by server handlers to read the
-// active MDM policy. Tests override this to inject a fake policy.
-var loadMDMPolicy = mdm.LoadPolicy
-
-// conflictCheck is a value-aware comparison between a single field in
-// the incoming request and the corresponding MDM-enforced value. It
-// runs only when the field was actually set in the request (presence
-// already filtered upstream); ok=true reports the policy value, ok=false
-// means the policy is silent on the key — both are treated as conflicts
-// to be safe (an MDM key declared as managed must hold a value).
-type conflictCheck struct {
-	key   string
-	check func(*mdm.Policy) (match bool)
-}
-
 // onMDMPolicyChange is invoked by the MDM reload ticker every time the
 // OS-native managed-config store reports a diff vs the last observation.
 //
@@ -99,7 +77,10 @@ func (s *Server) onMDMPolicyChange(_, _ *mdm.Policy) error {
 		proto.SystemEvent_SYSTEM,
 		"MDM policy applied",
 		"NetBird configuration was updated by your IT policy.",
-		map[string]string{"source": "mdm", "type": "policy_applied"},
+		map[string]string{
+			proto.MetadataSourceKey: proto.MetadataSourceMDM,
+			proto.MetadataTypeKey:   proto.MetadataTypePolicyApplied,
+		},
 	)
 	return nil
 }
@@ -124,8 +105,8 @@ func (s *Server) publishConfigChangedEvent(source string) {
 		fmt.Sprintf("daemon config changed (source=%s)", source),
 		"",
 		map[string]string{
-			"source": source,
-			"type":   "config_changed",
+			proto.MetadataSourceKey: source,
+			proto.MetadataTypeKey:   proto.MetadataTypeConfigChanged,
 		},
 	)
 }
@@ -160,81 +141,10 @@ func (s *Server) restartEngineForMDMLocked() error {
 	s.clientGiveUpChan = make(chan struct{})
 	log.Info("MDM restart: spawning connectWithRetryRuns with re-resolved config")
 	go s.connectWithRetryRuns(ctx, config, s.statusRecorder, s.clientRunningChan, s.clientGiveUpChan)
-	s.publishConfigChangedEvent("mdm")
+	s.publishConfigChangedEvent(proto.MetadataSourceMDM)
 	return nil
 }
 
-// conflictBool builds a conflictCheck for a boolean MDM key. If p is nil
-// the field is treated as matching (no override requested); otherwise the
-// check returns true only when the policy contains the key and its
-// boolean value equals *p.
-func conflictBool(key string, p *bool) conflictCheck {
-	return conflictCheck{
-		key: key,
-		check: func(pol *mdm.Policy) bool {
-			if p == nil {
-				return true // absent → match by definition
-			}
-			want, ok := pol.GetBool(key)
-			return ok && want == *p
-		},
-	}
-}
-
-// conflictString builds a conflictCheck for a string MDM key. An empty
-// `got` is treated as "field not set" (no override requested); otherwise
-// the check returns true only when the policy contains the key and its
-// value equals got.
-func conflictString(key, got string) conflictCheck {
-	return conflictCheck{
-		key: key,
-		check: func(pol *mdm.Policy) bool {
-			if got == "" {
-				return true
-			}
-			want, ok := pol.GetString(key)
-			return ok && want == got
-		},
-	}
-}
-
-// conflictInt64 builds a conflictCheck for an integer MDM key. If p is
-// nil the field is treated as matching; otherwise the check returns
-// true only when the policy contains the key and its int value equals *p.
-func conflictInt64(key string, p *int64) conflictCheck {
-	return conflictCheck{
-		key: key,
-		check: func(pol *mdm.Policy) bool {
-			if p == nil {
-				return true
-			}
-			want, ok := pol.GetInt(key)
-			return ok && want == *p
-		},
-	}
-}
-
-// resolveConflicts walks the per-field checks against the active MDM
-// policy and returns the names of keys whose requested value diverges
-// from the policy-enforced value. Keys not present in the policy are
-// skipped silently (the gate fires only for keys the admin has
-// actually pushed). Returns nil for an empty policy.
-func resolveConflicts(policy *mdm.Policy, checks []conflictCheck) []string {
-	if policy.IsEmpty() {
-		return nil
-	}
-	var conflicts []string
-	for _, c := range checks {
-		if !policy.HasKey(c.key) {
-			continue
-		}
-		if !c.check(policy) {
-			conflicts = append(conflicts, c.key)
-		}
-	}
-	return conflicts
-}
-
 // mdmManagedFieldConflicts returns the names of MDM-managed keys whose
 // requested value in the SetConfigRequest differs from the MDM-enforced
 // value. A field set to the same value the policy already enforces is
@@ -248,107 +158,28 @@ func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) [
 		return nil
 	}
 
-	// PSK round-trip echo: collapse the sentinel to empty so the
-	// shared check treats it as "field not set".
-	pskGot := ""
-	if msg.OptionalPreSharedKey != nil && *msg.OptionalPreSharedKey != preSharedKeyRedactedSentinel {
-		pskGot = *msg.OptionalPreSharedKey
+	pskGot := msg.OptionalPreSharedKey
+	if pskGot != nil && *pskGot == mdm.PreSharedKeyRedactedSentinel {
+		pskGot = nil
 	}
 
-	return resolveConflicts(policy, []conflictCheck{
-		conflictString(mdm.KeyManagementURL, msg.ManagementUrl),
-		conflictString(mdm.KeyPreSharedKey, pskGot),
-		conflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
-		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
-		conflictBool(mdm.KeyDisableAutoConnect, msg.DisableAutoConnect),
-		conflictBool(mdm.KeyAllowServerSSH, msg.ServerSSHAllowed),
-		conflictBool(mdm.KeyDisableClientRoutes, msg.DisableClientRoutes),
-		conflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
-		conflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
-		conflictInt64(mdm.KeyWireguardPort, msg.WireguardPort),
+	return mdm.ResolveConflicts(policy, []mdm.ConflictCheck{
+		mdm.ConflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
+		mdm.ConflictStringPtr(mdm.KeyPreSharedKey, pskGot),
+		mdm.ConflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
+		mdm.ConflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
+		mdm.ConflictBool(mdm.KeyDisableAutoConnect, msg.DisableAutoConnect),
+		mdm.ConflictBool(mdm.KeyAllowServerSSH, msg.ServerSSHAllowed),
+		mdm.ConflictBool(mdm.KeyRemoteJobsAllowed, msg.RemoteJobsAllowed),
+		mdm.ConflictBool(mdm.KeyDisableClientRoutes, msg.DisableClientRoutes),
+		mdm.ConflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
+		mdm.ConflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
+		mdm.ConflictInt64(mdm.KeyWireguardPort, msg.WireguardPort),
+		mdm.ConflictBool(mdm.KeyEnableLocalMetrics, msg.EnableLocalMetrics),
+		mdm.ConflictStringPtr(mdm.KeyLocalMetricsAddress, msg.LocalMetricsAddress),
 	})
 }
 
-// setConfigRequestHasConfigOverrides reports whether the SetConfigRequest
-// carries ANY field that would actually mutate the persisted config.
-// The CLI builds a SetConfigRequest unconditionally on every
-// `netbird up` (see setupSetConfigReq in cmd/up.go) — a plain
-// `netbird up` produces a request with every field at its zero value;
-// the gate must skip such no-op invocations or it would always fire
-// even when the user did not pass any --flag. Returns false on a nil
-// msg; true when any management/admin URL, PSK, DNS/NAT list+clean
-// flag, interface/port/MTU, or any optional bool/duration field is set.
-func setConfigRequestHasConfigOverrides(msg *proto.SetConfigRequest) bool {
-	if msg == nil {
-		return false
-	}
-	return msg.ManagementUrl != "" ||
-		msg.AdminURL != "" ||
-		msg.OptionalPreSharedKey != nil ||
-		len(msg.CustomDNSAddress) > 0 ||
-		len(msg.NatExternalIPs) > 0 || msg.CleanNATExternalIPs ||
-		len(msg.ExtraIFaceBlacklist) > 0 ||
-		len(msg.DnsLabels) > 0 || msg.CleanDNSLabels ||
-		msg.DnsRouteInterval != nil ||
-		msg.RosenpassEnabled != nil ||
-		msg.RosenpassPermissive != nil ||
-		msg.InterfaceName != nil ||
-		msg.WireguardPort != nil ||
-		msg.Mtu != nil ||
-		msg.DisableAutoConnect != nil ||
-		msg.ServerSSHAllowed != nil ||
-		msg.NetworkMonitor != nil ||
-		msg.DisableClientRoutes != nil ||
-		msg.DisableServerRoutes != nil ||
-		msg.DisableDns != nil ||
-		msg.DisableFirewall != nil ||
-		msg.BlockLanAccess != nil ||
-		msg.DisableNotifications != nil ||
-		msg.BlockInbound != nil ||
-		msg.DisableIpv6 != nil ||
-		msg.EnableSSHRoot != nil ||
-		msg.EnableSSHSFTP != nil ||
-		msg.EnableSSHLocalPortForwarding != nil ||
-		msg.EnableSSHRemotePortForwarding != nil ||
-		msg.DisableSSHAuth != nil ||
-		msg.SshJWTCacheTTL != nil
-}
-
-// loginRequestHasConfigOverrides reports whether the LoginRequest
-// carries ANY field that would mutate persisted daemon configuration
-// (as opposed to pure-auth fields like setupKey, hostname, hint,
-// profileName, username). Used by the Login handler to decide whether
-// the `--disable-update-settings` / MDM gates must run: a re-auth that
-// changes nothing about the configuration is always allowed.
-func loginRequestHasConfigOverrides(msg *proto.LoginRequest) bool {
-	if msg == nil {
-		return false
-	}
-	return msg.ManagementUrl != "" ||
-		msg.AdminURL != "" ||
-		msg.PreSharedKey != "" || //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
-		msg.OptionalPreSharedKey != nil ||
-		len(msg.CustomDNSAddress) > 0 ||
-		len(msg.NatExternalIPs) > 0 || msg.CleanNATExternalIPs ||
-		msg.RosenpassEnabled != nil ||
-		msg.InterfaceName != nil ||
-		msg.WireguardPort != nil ||
-		msg.DisableAutoConnect != nil ||
-		msg.ServerSSHAllowed != nil ||
-		msg.RosenpassPermissive != nil ||
-		len(msg.ExtraIFaceBlacklist) > 0 ||
-		msg.NetworkMonitor != nil ||
-		msg.DnsRouteInterval != nil ||
-		msg.DisableClientRoutes != nil ||
-		msg.DisableServerRoutes != nil ||
-		msg.DisableDns != nil ||
-		msg.DisableFirewall != nil ||
-		msg.BlockLanAccess != nil ||
-		msg.DisableNotifications != nil ||
-		len(msg.DnsLabels) > 0 || msg.CleanDNSLabels ||
-		msg.BlockInbound != nil
-}
-
 // loginRequestMDMConflicts mirrors mdmManagedFieldConflicts but for the
 // LoginRequest surface. Same value-aware semantics: a field set to the
 // MDM-enforced value is a no-op echo, not a conflict; only a divergent
@@ -362,31 +193,28 @@ func loginRequestMDMConflicts(msg *proto.LoginRequest, policy *mdm.Policy) []str
 		return nil
 	}
 
-	// Collapse the two PSK fields + the redaction sentinel down to a
-	// single "got" string the shared check can compare against the
-	// policy: OptionalPreSharedKey wins if set; PreSharedKey (deprecated)
-	// is the fallback; sentinel echo is treated as "field not set".
-	pskGot := ""
-	if msg.OptionalPreSharedKey != nil {
-		pskGot = *msg.OptionalPreSharedKey
-	} else if msg.PreSharedKey != "" { //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
-		pskGot = msg.PreSharedKey //nolint:staticcheck // SA1019
+	pskGot := msg.OptionalPreSharedKey
+	if pskGot == nil && msg.PreSharedKey != "" { //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
+		pskGot = &msg.PreSharedKey //nolint:staticcheck // SA1019
 	}
-	if pskGot == preSharedKeyRedactedSentinel {
-		pskGot = ""
+	if pskGot != nil && *pskGot == mdm.PreSharedKeyRedactedSentinel {
+		pskGot = nil
 	}
 
-	return resolveConflicts(policy, []conflictCheck{
-		conflictString(mdm.KeyManagementURL, msg.ManagementUrl),
-		conflictString(mdm.KeyPreSharedKey, pskGot),
-		conflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
-		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
-		conflictBool(mdm.KeyDisableAutoConnect, msg.DisableAutoConnect),
-		conflictBool(mdm.KeyAllowServerSSH, msg.ServerSSHAllowed),
-		conflictBool(mdm.KeyDisableClientRoutes, msg.DisableClientRoutes),
-		conflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
-		conflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
-		conflictInt64(mdm.KeyWireguardPort, msg.WireguardPort),
+	return mdm.ResolveConflicts(policy, []mdm.ConflictCheck{
+		mdm.ConflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
+		mdm.ConflictStringPtr(mdm.KeyPreSharedKey, pskGot),
+		mdm.ConflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
+		mdm.ConflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
+		mdm.ConflictBool(mdm.KeyDisableAutoConnect, msg.DisableAutoConnect),
+		mdm.ConflictBool(mdm.KeyAllowServerSSH, msg.ServerSSHAllowed),
+		mdm.ConflictBool(mdm.KeyRemoteJobsAllowed, msg.RemoteJobsAllowed),
+		mdm.ConflictBool(mdm.KeyDisableClientRoutes, msg.DisableClientRoutes),
+		mdm.ConflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
+		mdm.ConflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
+		mdm.ConflictInt64(mdm.KeyWireguardPort, msg.WireguardPort),
+		mdm.ConflictBool(mdm.KeyEnableLocalMetrics, msg.EnableLocalMetrics),
+		mdm.ConflictStringPtr(mdm.KeyLocalMetricsAddress, msg.LocalMetricsAddress),
 	})
 }
 
diff --git a/client/server/network.go b/client/server/network.go
index 7a3c08f2e..69eaabf8a 100644
--- a/client/server/network.go
+++ b/client/server/network.go
@@ -8,7 +8,6 @@ import (
 	"sort"
 	"strings"
 
-	"golang.org/x/exp/maps"
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
@@ -161,19 +160,11 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 		return nil, fmt.Errorf("no route manager")
 	}
 
-	routeSelector := routeManager.GetRouteSelector()
 	if req.GetAll() {
-		routeSelector.SelectAllRoutes()
-	} else {
-		routes := toNetIDs(req.GetNetworkIDs())
-		routesMap := routeManager.GetClientRoutesWithNetID()
-		routes = route.ExpandV6ExitPairs(routes, routesMap)
-		netIdRoutes := maps.Keys(routesMap)
-		if err := routeSelector.SelectRoutes(routes, req.GetAppend(), netIdRoutes); err != nil {
-			return nil, fmt.Errorf("select routes: %w", err)
-		}
+		routeManager.SelectAllRoutes()
+	} else if err := routeManager.SelectRoutes(toNetIDs(req.GetNetworkIDs()), req.GetAppend()); err != nil {
+		return nil, err
 	}
-	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 
 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
@@ -213,19 +204,11 @@ func (s *Server) DeselectNetworks(_ context.Context, req *proto.SelectNetworksRe
 		return nil, fmt.Errorf("no route manager")
 	}
 
-	routeSelector := routeManager.GetRouteSelector()
 	if req.GetAll() {
-		routeSelector.DeselectAllRoutes()
-	} else {
-		routes := toNetIDs(req.GetNetworkIDs())
-		routesMap := routeManager.GetClientRoutesWithNetID()
-		routes = route.ExpandV6ExitPairs(routes, routesMap)
-		netIdRoutes := maps.Keys(routesMap)
-		if err := routeSelector.DeselectRoutes(routes, netIdRoutes); err != nil {
-			return nil, fmt.Errorf("deselect routes: %w", err)
-		}
+		routeManager.DeselectAllRoutes()
+	} else if err := routeManager.DeselectRoutes(toNetIDs(req.GetNetworkIDs())); err != nil {
+		return nil, err
 	}
-	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 
 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
diff --git a/client/server/panic_windows.go b/client/server/panic_windows.go
index 8592f12ad..4bed6662f 100644
--- a/client/server/panic_windows.go
+++ b/client/server/panic_windows.go
@@ -3,6 +3,7 @@
 package server
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path"
@@ -69,7 +70,7 @@ func setStdHandle(f *os.File) error {
 	handle := f.Fd()
 	r0, _, e1 := setStdHandleFn.Call(stdErrorHandle, handle)
 	if r0 == 0 {
-		if e1 != nil {
+		if !errors.Is(e1, syscall.Errno(0)) {
 			return e1
 		}
 		return syscall.EINVAL
diff --git a/client/server/probe_throttle.go b/client/server/probe_throttle.go
new file mode 100644
index 000000000..ec6137e15
--- /dev/null
+++ b/client/server/probe_throttle.go
@@ -0,0 +1,88 @@
+package server
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// healthProbeRunner runs the full, expensive probe (network round-trips to
+// management, signal and the relays) and reports whether every component was
+// healthy. ctx cancels the probe when the caller gives up. Satisfied by
+// *internal.Engine.
+type healthProbeRunner interface {
+	RunHealthProbes(ctx context.Context, waitForResult bool) bool
+}
+
+// statsRefresher does the cheap WireGuard-stats refresh callers fall back to
+// when a fresh probe isn't warranted. Satisfied by *peer.Status.
+type statsRefresher interface {
+	RefreshWireGuardStats() error
+}
+
+// probeThrottle rate-limits and single-flights the daemon's health probes.
+//
+// Health probes are expensive (network round-trips to management, signal and
+// the relays), while Status(GetFullPeerStatus=true) RPCs can arrive frequently
+// and concurrently — the desktop UI alone issues one per connect/disconnect.
+// probeThrottle keeps that load bounded with two rules:
+//
+//   - Single-flight: only one probe runs at a time. Callers that pile up while
+//     a probe is in flight share its result instead of each launching another,
+//     even when that probe failed. A failed probe therefore does not make every
+//     waiter re-probe in turn; the next, non-overlapping caller can try again.
+//   - Throttle: after a fully successful probe the result is cached for
+//     interval. While any component is unhealthy the cache is not advanced, so
+//     later callers keep probing frequently and notice recovery quickly — the
+//     intentional "probe often while unhealthy" behaviour from the original
+//     design.
+type probeThrottle struct {
+	interval time.Duration
+
+	mu          sync.Mutex
+	lastOK      time.Time // last fully-successful probe; drives the throttle window
+	completedAt time.Time // when the most recent probe finished; drives single-flight sharing
+}
+
+func newProbeThrottle(interval time.Duration) *probeThrottle {
+	return &probeThrottle{interval: interval}
+}
+
+// Run decides whether to run a fresh health probe or serve the most recent
+// result. It serialises concurrent callers: at most one runner.RunHealthProbes
+// executes at a time and the rest call refresher.RefreshWireGuardStats and read
+// the snapshot it produced.
+//
+// Both calls run while the throttle's lock is held, so a slow probe blocks
+// other callers until it completes — that blocking is the single-flight
+// guarantee. ctx is forwarded to RunHealthProbes so a caller that gives up
+// cancels the in-flight probe (and any caller still queued on the lock falls
+// through quickly once it acquires it, since the probe ctx is already done).
+func (t *probeThrottle) Run(ctx context.Context, runner healthProbeRunner, refresher statsRefresher, waitForResult bool) {
+	entered := time.Now()
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	// A probe that finished after we entered ran while we were waiting on the
+	// lock — i.e. a peer in the same burst already probed for us, so share its
+	// result rather than launch another. This holds even when that probe
+	// failed, so a failed probe doesn't make every waiter re-probe in turn.
+	sharedRecentProbe := t.completedAt.After(entered)
+	throttled := time.Since(t.lastOK) <= t.interval
+
+	if sharedRecentProbe || throttled {
+		if err := refresher.RefreshWireGuardStats(); err != nil {
+			log.Debugf("failed to refresh WireGuard stats: %v", err)
+		}
+		return
+	}
+
+	healthy := runner.RunHealthProbes(ctx, waitForResult)
+	t.completedAt = time.Now()
+	if healthy {
+		t.lastOK = t.completedAt
+	}
+}
diff --git a/client/server/probe_throttle_test.go b/client/server/probe_throttle_test.go
new file mode 100644
index 000000000..cae776fa4
--- /dev/null
+++ b/client/server/probe_throttle_test.go
@@ -0,0 +1,109 @@
+package server
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// fakeProber implements both healthProbeRunner and statsRefresher with
+// caller-supplied behaviour.
+type fakeProber struct {
+	onProbe   func() bool
+	onRefresh func()
+}
+
+func (f fakeProber) RunHealthProbes(context.Context, bool) bool {
+	return f.onProbe()
+}
+
+func (f fakeProber) RefreshWireGuardStats() error {
+	if f.onRefresh != nil {
+		f.onRefresh()
+	}
+	return nil
+}
+
+func TestProbeThrottle_CachesAfterSuccess(t *testing.T) {
+	pt := newProbeThrottle(time.Minute)
+
+	var probes, refreshes int
+	prober := fakeProber{
+		onProbe:   func() bool { probes++; return true },
+		onRefresh: func() { refreshes++ },
+	}
+
+	pt.Run(context.Background(), prober, prober, false)
+	pt.Run(context.Background(), prober, prober, false)
+
+	if probes != 1 {
+		t.Fatalf("expected 1 probe within the throttle window, got %d", probes)
+	}
+	if refreshes != 1 {
+		t.Fatalf("expected the throttled caller to refresh stats once, got %d", refreshes)
+	}
+}
+
+func TestProbeThrottle_StaysOpenWhileUnhealthy(t *testing.T) {
+	pt := newProbeThrottle(time.Minute)
+
+	var probes int
+	prober := fakeProber{onProbe: func() bool { probes++; return false }} // never healthy
+
+	// Sequential, non-overlapping callers must each re-probe while unhealthy:
+	// a failed probe does not advance the throttle window.
+	pt.Run(context.Background(), prober, prober, false)
+	pt.Run(context.Background(), prober, prober, false)
+	pt.Run(context.Background(), prober, prober, false)
+
+	if probes != 3 {
+		t.Fatalf("expected every non-overlapping caller to probe while unhealthy, got %d", probes)
+	}
+}
+
+func TestProbeThrottle_SingleFlightSharesResult(t *testing.T) {
+	pt := newProbeThrottle(time.Minute)
+
+	var probes int32
+	release := make(chan struct{})
+	started := make(chan struct{})
+
+	// First caller blocks inside the probe until released, holding the lock so
+	// the others pile up behind it.
+	prober := fakeProber{onProbe: func() bool {
+		if atomic.AddInt32(&probes, 1) == 1 {
+			close(started)
+			<-release
+		}
+		return false // unhealthy — the share must happen regardless of result
+	}}
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		pt.Run(context.Background(), prober, prober, false)
+	}()
+
+	<-started // ensure the first probe is in flight before the burst arrives
+
+	const waiters = 9
+	wg.Add(waiters)
+	for i := 0; i < waiters; i++ {
+		go func() {
+			defer wg.Done()
+			pt.Run(context.Background(), prober, prober, false)
+		}()
+	}
+
+	// Give the waiters time to block on the lock, then let the first finish.
+	time.Sleep(50 * time.Millisecond)
+	close(release)
+	wg.Wait()
+
+	if got := atomic.LoadInt32(&probes); got != 1 {
+		t.Fatalf("expected a concurrent burst to run exactly 1 probe, got %d", got)
+	}
+}
diff --git a/client/server/provision_identity_test.go b/client/server/provision_identity_test.go
new file mode 100644
index 000000000..c944cdb1a
--- /dev/null
+++ b/client/server/provision_identity_test.go
@@ -0,0 +1,59 @@
+package server
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// The daemon provisions the peer's identity and persists it, because a key that
+// stayed in memory would come back different on the next start and register a
+// second peer. Provisioning is idempotent: a profile that already has an
+// identity keeps the one on disk.
+func TestProvisionProfileIdentity(t *testing.T) {
+	origDir := profilemanager.DefaultConfigPathDir
+	origPath := profilemanager.DefaultConfigPath
+	t.Cleanup(func() {
+		profilemanager.DefaultConfigPathDir = origDir
+		profilemanager.DefaultConfigPath = origPath
+	})
+
+	dir := t.TempDir()
+	profilemanager.DefaultConfigPathDir = dir
+	profilemanager.DefaultConfigPath = filepath.Join(dir, "default.json")
+
+	activeProf := &profilemanager.ActiveProfileState{ID: "default"}
+
+	t.Run("a profile with no file is provisioned and written", func(t *testing.T) {
+		_, err := os.Stat(profilemanager.DefaultConfigPath)
+		require.True(t, os.IsNotExist(err), "the fixture starts without a config file")
+
+		config, existed, err := provisionProfileIdentity(activeProf)
+		require.NoError(t, err)
+		require.False(t, existed, "the file was reported as pre-existing")
+		require.NotEmpty(t, config.PrivateKey)
+
+		stored, err := profilemanager.GetExistingConfig(profilemanager.DefaultConfigPath)
+		require.NoError(t, err, "provisioning did not write the config out")
+		require.Equal(t, config.PrivateKey, stored.PrivateKey, "the persisted identity is not the one returned")
+		require.NotEmpty(t, stored.SSHKey)
+	})
+
+	t.Run("a second call keeps the identity on disk", func(t *testing.T) {
+		before, err := profilemanager.GetExistingConfig(profilemanager.DefaultConfigPath)
+		require.NoError(t, err)
+
+		config, existed, err := provisionProfileIdentity(activeProf)
+		require.NoError(t, err)
+		require.True(t, existed)
+		require.Equal(t, before.PrivateKey, config.PrivateKey, "provisioning minted a second identity")
+
+		after, err := profilemanager.GetExistingConfig(profilemanager.DefaultConfigPath)
+		require.NoError(t, err)
+		require.Equal(t, before.PrivateKey, after.PrivateKey, "provisioning rewrote the stored identity")
+	})
+}
diff --git a/client/server/server.go b/client/server/server.go
index e8ef2f96e..4ce2a5c82 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -19,9 +19,14 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	gstatus "google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/expose"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/netbirdio/netbird/client/internal/localmetrics"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	sleephandler "github.com/netbirdio/netbird/client/internal/sleep/handler"
 	"github.com/netbirdio/netbird/client/mdm"
@@ -34,6 +39,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
 	"github.com/netbirdio/netbird/util/capture"
 	"github.com/netbirdio/netbird/version"
 )
@@ -52,14 +58,23 @@ const (
 	// JWT token cache TTL for the client daemon (disabled by default)
 	defaultJWTCacheTTL = 0
 
-	errRestoreResidualState   = "failed to restore residual state: %v"
-	errProfilesDisabled       = "profiles are disabled, you cannot use this feature without profiles enabled"
+	errRestoreResidualState = "failed to restore residual state: %v"
+	errProfilesDisabled     = "profiles are disabled, you cannot use this feature without profiles enabled"
+	// errUpdateSettingsDisabled is returned with codes.FailedPrecondition, not
+	// codes.Unavailable: the daemon answered, and it refused. Unavailable means
+	// "the daemon cannot serve this", which is why the CLI downgrades it to a
+	// warning and the GUI reads it as an unreachable daemon — both wrong for a
+	// refusal the caller has to act on.
 	errUpdateSettingsDisabled = "update settings are disabled, you cannot use this feature without update settings enabled"
 	errNetworksDisabled       = "network selection is disabled by the administrator"
 )
 
 var ErrServiceNotUp = errors.New("service is not up")
 
+type statusSetter interface {
+	Set(update internal.StatusType)
+}
+
 // Server for service control.
 type Server struct {
 	rootCtx   context.Context
@@ -67,7 +82,34 @@ type Server struct {
 
 	logFile string
 
+	// uiLogPath is the desktop UI's absolute log path, reported via
+	// RegisterUILog. Guarded by mutex. Consumed by DebugBundle so the bundle
+	// can collect the GUI log even though the daemon runs as root and can't
+	// resolve the user's config dir. Last-writer-wins (one UI per socket).
+	// DebugBundle opens it on behalf of the bundle requester and refuses a file
+	// that caller does not own, so a local user cannot read another user's log
+	// or a root-only file through it.
+	uiLogPath string
+
 	oauthAuthFlow oauthAuthFlow
+	// forceAccountPrompt makes the next startSSOLogin build its flow with a
+	// forced account prompt. Armed when a login came back for an account other
+	// than the hinted one: that flow's browser is gone, so the correction has to
+	// ride on the user's next connect. Guarded by mutex; deliberately not
+	// persisted — a lost flag only costs one more mismatch round.
+	forceAccountPrompt bool
+	// extendAuthSessionFlow holds the pending PKCE flow created by
+	// RequestExtendAuthSession until WaitExtendAuthSession resolves it.
+	// Kept separate from oauthAuthFlow (which is reserved for the SSH
+	// JWT path) so a concurrent SSH auth doesn't clobber the session
+	// extend flow or vice versa.
+	extendAuthSessionFlow *auth.PendingFlow
+
+	// guardedConfigMu serializes a privilege check against the write it
+	// authorizes. Without it the two are separate steps over the same file, and a
+	// change that was allowed because the profile had the SSH server disabled
+	// could land after a concurrent privileged request enabled it.
+	guardedConfigMu sync.Mutex
 
 	mutex  sync.Mutex
 	config *profilemanager.Config
@@ -86,8 +128,9 @@ type Server struct {
 
 	statusRecorder *peer.Status
 	sessionWatcher *internal.SessionWatcher
+	localMetrics   *localmetrics.Manager
 
-	lastProbe           time.Time
+	probeThrottle       *probeThrottle
 	persistSyncResponse bool
 	isSessionActive     atomic.Bool
 
@@ -110,16 +153,48 @@ type Server struct {
 	// stopped by the rootCtx cancellation.
 	mdmTicker *mdm.Ticker
 
+	// mdmLoader is the daemon-owned source of the active MDM policy.
+	// Constructed once during Server.Start (with a nil PolicyFetcher on
+	// desktop — the build-tagged Loader.loadPlatform reads the OS
+	// registry / plist directly) and injected into every consumer:
+	// mdmTicker for its periodic reload, the SetConfig / Login MDM
+	// gates for conflict detection, and every Config produced via
+	// getConfig() so its apply() picks up the same overlay.
+	mdmLoader *mdm.Loader
+
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
+
+	// loginAttemptFn stands in for the Management login round trip. Tests set
+	// it to drive the login outcomes that need a server on the other end;
+	// production leaves it nil, and every login goes through loginAttempt.
+	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
+
+	isLoginRequiredFn func(ctx context.Context) (bool, error)
 }
 
 type oauthAuthFlow struct {
-	expiresAt  time.Time
-	flow       auth.OAuthFlow
-	info       auth.AuthFlowInfo
+	expiresAt time.Time
+	flow      auth.OAuthFlow
+	info      auth.AuthFlowInfo
+
+	// cacheGeneration is the SSH JWT cache's generation as of the start of the
+	// request that created this flow. The flow outlives a profile switch, so
+	// reading the generation any later — when the IdP has answered, or when the
+	// token finally arrives — would read the new session's one and let the old
+	// session's token into the new session's cache.
+	cacheGeneration uint64
+
 	waitCancel context.CancelFunc
+	// hint is the account the flow was asked to sign in (login_hint). The token
+	// that comes back is compared against it; empty means nothing to compare.
+	hint string
+	// accountPrompted records that this flow already asked the IdP to re-decide
+	// the account (or could not ask — the device flow has no way to). A token
+	// for the wrong account is then let through with a warning instead of
+	// erroring again, so the flow cannot loop.
+	accountPrompted bool
 }
 
 // New server instance constructor.
@@ -135,14 +210,35 @@ func New(ctx context.Context, logFile string, configFile string, profilesDisable
 		captureEnabled:         captureEnabled,
 		networksDisabled:       networksDisabled,
 		jwtCache:               newJWTCache(),
+		extendAuthSessionFlow:  auth.NewPendingFlow(),
+		probeThrottle:          newProbeThrottle(probeThreshold),
 	}
 	agent := &serverAgent{s}
 	s.sleepHandler = sleephandler.New(agent)
 	s.startSleepDetector()
 
+	s.localMetrics = localmetrics.NewManager(ctx, s.statusRecorder, s.clientMetricsGatherer)
+
 	return s
 }
 
+// clientMetricsGatherer returns the Prometheus gatherer of the running
+// engine's client metrics, or nil when no engine is running.
+func (s *Server) clientMetricsGatherer() prometheus.Gatherer {
+	s.mutex.Lock()
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+
+	if connectClient == nil {
+		return nil
+	}
+	engine := connectClient.Engine()
+	if engine == nil {
+		return nil
+	}
+	return engine.GetClientMetrics().PrometheusGatherer()
+}
+
 func (s *Server) Start() error {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
@@ -152,12 +248,21 @@ func (s *Server) Start() error {
 	}
 
 	state := internal.CtxGetState(s.rootCtx)
+	// Every contextState.Set in the connect/login/server paths must push a
+	// SubscribeStatus snapshot, otherwise transitions that don't happen to
+	// be accompanied by a Mark{Management,Signal,...} call (e.g. plain
+	// StatusNeedsLogin after a PermissionDenied login, StatusLoginFailed
+	// after OAuth init failure, StatusIdle in the Login defer) leave the
+	// UI stuck on the previous status until the next unrelated peer event.
+	// Binding the recorder here means new state.Set callsites don't have
+	// to opt in individually.
+	state.SetOnChange(s.statusRecorder.NotifyStateChange)
 
 	if err := handlePanicLog(); err != nil {
 		log.Warnf("failed to redirect stderr: %v", err)
 	}
 
-	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
@@ -173,8 +278,14 @@ func (s *Server) Start() error {
 	// Runs re-resolves Config (re-running profilemanager.Config.apply which
 	// applies the freshly-read MDM policy as the last layer) and brings
 	// the engine back with the new values.
+	if s.mdmLoader == nil {
+		// Desktop builds pass a nil PolicyFetcher: the Loader's
+		// build-tagged loadPlatform reads the OS source directly
+		// (registry on Windows, plist on macOS, no-op elsewhere).
+		s.mdmLoader = mdm.NewLoader(nil)
+	}
 	if s.mdmTicker == nil {
-		s.mdmTicker = mdm.NewTicker(mdm.DefaultReloadInterval)
+		s.mdmTicker = mdm.NewTicker(mdm.DefaultReloadInterval, s.mdmLoader)
 		go s.mdmTicker.Run(s.rootCtx, s.onMDMPolicyChange)
 	}
 
@@ -214,6 +325,7 @@ func (s *Server) Start() error {
 
 	s.statusRecorder.UpdateManagementAddress(config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(config.RosenpassEnabled, config.RosenpassPermissive)
+	s.localMetrics.Reconcile(config.LocalMetricsEnabled, config.LocalMetricsAddress)
 
 	if s.sessionWatcher == nil {
 		s.sessionWatcher = internal.NewSessionWatcher(s.rootCtx, s.statusRecorder)
@@ -235,7 +347,7 @@ func (s *Server) Start() error {
 	s.clientRunningChan = make(chan struct{})
 	s.clientGiveUpChan = make(chan struct{})
 	go s.connectWithRetryRuns(ctx, config, s.statusRecorder, s.clientRunningChan, s.clientGiveUpChan)
-	s.publishConfigChangedEvent("startup")
+	s.publishConfigChangedEvent(proto.MetadataSourceStartup)
 	return nil
 }
 
@@ -252,6 +364,10 @@ func (s *Server) Start() error {
 // "intent" (clientRunning) is maintained by the RPC handlers, not by this
 // goroutine.
 func (s *Server) connectWithRetryRuns(ctx context.Context, profileConfig *profilemanager.Config, statusRecorder *peer.Status, runningChan chan struct{}, giveUpChan chan struct{}) {
+	// close(giveUpChan) MUST run on every exit path (DisableAutoConnect
+	// return, backoff.Retry return, panic) — Down() blocks for up to 5s
+	// waiting on this signal before flipping the state to Idle, and a
+	// missed close leaves Down() always hitting the timeout.
 	defer func() {
 		if giveUpChan != nil {
 			close(giveUpChan)
@@ -290,6 +406,15 @@ func (s *Server) connectWithRetryRuns(ctx context.Context, profileConfig *profil
 	runOperation := func() error {
 		err := s.connect(ctx, profileConfig, statusRecorder, runningChan)
 		if err != nil {
+			// PermissionDenied means the daemon transitioned to NeedsLogin
+			// inside connect(). Without backoff.Permanent the outer retry
+			// re-enters connect(), which resets the state to Connecting and
+			// makes the tray flicker between NeedsLogin and Connecting until
+			// the user logs in. Stop retrying and let the state stick.
+			if s, ok := gstatus.FromError(err); ok && s.Code() == codes.PermissionDenied {
+				log.Debugf("run client connection exited with PermissionDenied, waiting for login")
+				return backoff.Permanent(err)
+			}
 			log.Debugf("run client connection exited with error: %v. Will retry in the background", err)
 			return err
 		}
@@ -324,7 +449,34 @@ func (s *Server) connectionGoroutineRunning() bool {
 	}
 }
 
-// loginAttempt attempts to login using the provided information. it returns a status in case something fails
+// attemptLogin runs a login round trip against Management, or the stand-in a
+// test installed in place of it.
+func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
+	if s.loginAttemptFn != nil {
+		return s.loginAttemptFn(ctx, setupKey, jwtToken)
+	}
+	return s.loginAttempt(ctx, setupKey, jwtToken)
+}
+
+func (s *Server) isLoginRequired(ctx context.Context) (bool, error) {
+	if s.isLoginRequiredFn != nil {
+		return s.isLoginRequiredFn(ctx)
+	}
+
+	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
+	if err != nil {
+		log.Errorf("failed to create auth client: %v", err)
+		return false, err
+	}
+	defer authClient.Close()
+
+	return authClient.IsLoginRequired(ctx)
+}
+
+// loginAttempt attempts to login using the provided information. It returns
+// StatusNeedsLogin when Management refused the peer's credentials and
+// StatusLoginFailed for every other failure, so callers can tell an
+// authentication decision apart from a login that never got made.
 func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
 	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
 	if err != nil {
@@ -350,27 +502,21 @@ func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (i
 
 // Login uses setup key to prepare configuration for the daemon.
 func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigRequest) (*proto.SetConfigResponse, error) {
+	// Privilege gate: refuse the parts of the request that would let a local
+	// user turn the root daemon into a root shell. Held across the write so the
+	// config cannot gain the SSH server between the decision and the update.
+	//
+	// Taken before s.mutex: authorizeAndPrepareLogin takes s.mutex while holding
+	// guardedConfigMu, so acquiring the two in the other order here would let a
+	// concurrent login deadlock the daemon.
+	s.guardedConfigMu.Lock()
+	defer s.guardedConfigMu.Unlock()
+
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	// Skip the update-settings gate when the request carries no actual
-	// overrides: the CLI builds a SetConfigRequest unconditionally on
-	// every `netbird up` (setupSetConfigReq in cmd/up.go), so a plain
-	// `netbird up` would otherwise always trip the gate and surface a
-	// misleading "setConfig method is not available" warning, even when
-	// the user did not pass any config flag.
-	if setConfigRequestHasConfigOverrides(msg) {
-		if s.checkUpdateSettingsDisabled() {
-			return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
-		}
-	}
-
-	// MDM gate: refuse the whole request if any of its fields is enforced
-	// by the active MDM policy. The error carries an MDMManagedFields-
-	// Violation detail listing the offending key names. Non-conflicting
-	// fields in the same request are not applied either.
-	policy := loadMDMPolicy()
-	if err := rejectMDMManagedFieldConflicts(mdmManagedFieldConflicts(msg, policy)); err != nil {
+	stored, err := s.storedProfileConfig(msg.ProfileName, msg.Username)
+	if err != nil {
 		return nil, err
 	}
 
@@ -379,11 +525,44 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		return nil, err
 	}
 
-	if _, err := profilemanager.UpdateConfig(config); err != nil {
+	// Update-settings gate: refuse the request only when it would actually
+	// change a persisted setting. The CLI builds a SetConfigRequest
+	// unconditionally on every `netbird up` (setupSetConfigReq in
+	// cmd/up.go) and fills it from its flags and environment, so a service
+	// or container that restates the configuration it already runs with
+	// must pass the gate. Deciding this on field presence alone refused
+	// those callers, and — through the identical gate in Login — refused
+	// their login too, which left a client configured by environment
+	// (NB_MANAGEMENT_URL and friends) unable to come up at all.
+	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, config) {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
+	}
+
+	// MDM gate: refuse the whole request if any of its fields is enforced
+	// by the active MDM policy. The error carries an MDMManagedFields-
+	// Violation detail listing the offending key names. Non-conflicting
+	// fields in the same request are not applied either.
+	policy := s.mdmLoader.Load()
+	if err := rejectMDMManagedFieldConflicts(mdmManagedFieldConflicts(msg, policy)); err != nil {
+		return nil, err
+	}
+
+	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromSetConfig(msg)); err != nil {
+		return nil, err
+	}
+
+	updatedConf, err := profilemanager.UpdateConfig(config)
+	if err != nil {
 		log.Errorf("failed to update profile config: %v", err)
 		return nil, fmt.Errorf("failed to update profile config: %w", err)
 	}
 
+	if activeProf, err := s.profileManager.GetActiveProfileState(); err == nil {
+		if activePath, err := activeProf.FilePath(); err == nil && activePath == config.ConfigPath {
+			s.localMetrics.Reconcile(updatedConf.LocalMetricsEnabled, updatedConf.LocalMetricsAddress)
+		}
+	}
+
 	return &proto.SetConfigResponse{}, nil
 }
 
@@ -424,7 +603,7 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 		wgPort := int(*msg.WireguardPort)
 		config.WireguardPort = &wgPort
 	}
-	if msg.OptionalPreSharedKey != nil && *msg.OptionalPreSharedKey != "" {
+	if msg.OptionalPreSharedKey != nil {
 		config.PreSharedKey = msg.OptionalPreSharedKey
 	}
 
@@ -453,8 +632,11 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 
 	config.RosenpassEnabled = msg.RosenpassEnabled
 	config.RosenpassPermissive = msg.RosenpassPermissive
+	config.LocalMetricsEnabled = msg.EnableLocalMetrics
+	config.LocalMetricsAddress = msg.LocalMetricsAddress
 	config.DisableAutoConnect = msg.DisableAutoConnect
 	config.ServerSSHAllowed = msg.ServerSSHAllowed
+	config.RemoteJobsAllowed = msg.RemoteJobsAllowed
 	config.NetworkMonitor = msg.NetworkMonitor
 	config.DisableClientRoutes = msg.DisableClientRoutes
 	config.DisableServerRoutes = msg.DisableServerRoutes
@@ -484,41 +666,55 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 
 // Login uses setup key to prepare configuration for the daemon.
 func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*proto.LoginResponse, error) {
+	activeProf, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get active profile state: %w", err)
+	}
+
+	// The stored config of the profile this request targets backs all three
+	// gates below. It is read before anything changes daemon state, so a
+	// refused login neither switches the profile nor cancels a login already
+	// in progress, and it is the profile the switch further down would
+	// activate.
+	stored, err := s.storedLoginConfig(activeProf, msg)
+	if err != nil {
+		return nil, err
+	}
+
 	// Config-override gates. LoginRequest carries the same surface as
 	// SetConfigRequest (managementUrl, PSK, ssh/rosenpass/port toggles,
 	// ...), so the same protections must apply. Without these the CLI
 	// command `netbird up --management-url=X` (which falls through to
 	// Login when SetConfig is rejected — see cmd/up.go) would silently
 	// bypass `--disable-update-settings` and any MDM policy.
-	if loginRequestHasConfigOverrides(msg) {
-		if s.checkUpdateSettingsDisabled() {
-			return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
-		}
-		policy := loadMDMPolicy()
-		if err := rejectMDMManagedFieldConflicts(loginRequestMDMConflicts(msg, policy)); err != nil {
-			return nil, err
-		}
+	//
+	// The update-settings gate is value-aware, as in SetConfig: it looks at
+	// what a login would actually persist (loginOverridesInput) and refuses
+	// only a real divergence from the stored config. A login that restates
+	// the values already on disk changes nothing, so it must go through —
+	// that is what keeps a re-login, or a container restart carrying
+	// NB_MANAGEMENT_URL, working with the kill switch on.
+	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, loginOverridesInput(msg)) {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
 	}
 
-	s.mutex.Lock()
-	if s.actCancel != nil {
-		s.actCancel()
-	}
-	ctx, cancel := context.WithCancel(callerCtx)
-
-	md, ok := metadata.FromIncomingContext(callerCtx)
-	if ok {
-		ctx = metadata.NewOutgoingContext(ctx, md)
+	policy := s.mdmLoader.Load()
+	if err := rejectMDMManagedFieldConflicts(loginRequestMDMConflicts(msg, policy)); err != nil {
+		return nil, err
 	}
 
-	s.actCancel = cancel
-	s.mutex.Unlock()
-
-	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
-		log.Warnf(errRestoreResidualState, err)
+	// Privilege gate: same restrictions as SetConfig, since LoginRequest can carry
+	// the same fields.
+	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromLogin(msg)); err != nil {
+		return nil, err
 	}
 
 	state := internal.CtxGetState(s.rootCtx)
+	status := state.CurrentStatus()
+	if status == internal.StatusConnected {
+		return &proto.LoginResponse{}, nil
+	}
+
 	defer func() {
 		status, err := state.Status()
 		if err != nil || (status != internal.StatusNeedsLogin && status != internal.StatusLoginFailed) {
@@ -526,23 +722,16 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		}
 	}()
 
-	activeProf, err := s.profileManager.GetActiveProfileState()
+	ctx, activeProf, switched, err := s.authorizeAndPrepareLogin(callerCtx, msg, activeProf)
 	if err != nil {
-		log.Errorf("failed to get active profile state: %v", err)
-		return nil, fmt.Errorf("failed to get active profile state: %w", err)
-	}
-
-	if msg.ProfileName != nil {
-		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
-			log.Errorf("failed to switch profile: %v", err)
-			return nil, err
+		// The RPC boundary is where this gets recorded: nothing logs handler
+		// errors for us, and a caller that retries would otherwise leave no
+		// trace in the daemon log. A refusal is skipped because the gate has
+		// already logged the decision, with the caller's identity.
+		if gstatus.Code(err) != codes.PermissionDenied {
+			log.Errorf("failed to prepare login: %v", err)
 		}
-	}
-
-	activeProf, err = s.profileManager.GetActiveProfileState()
-	if err != nil {
-		log.Errorf("failed to get active profile state: %v", err)
-		return nil, fmt.Errorf("failed to get active profile state: %w", err)
+		return nil, err
 	}
 
 	log.Infof("active profile: %s for %s", activeProf.ID, activeProf.Username)
@@ -556,11 +745,6 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 
 	s.mutex.Unlock()
 
-	if err := persistLoginOverrides(activeProf, msg.ManagementUrl, msg.OptionalPreSharedKey); err != nil {
-		log.Errorf("failed to persist login overrides: %v", err)
-		return nil, fmt.Errorf("persist login overrides: %w", err)
-	}
-
 	config, _, err := s.getConfig(activeProf)
 	if err != nil {
 		log.Errorf("failed to get active profile config: %v", err)
@@ -568,66 +752,40 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	}
 	s.mutex.Lock()
 	s.config = config
+	if switched {
+		s.jwtCache.clear()
+	}
 	s.mutex.Unlock()
 
-	if _, err := s.loginAttempt(ctx, "", ""); err == nil {
+	s.localMetrics.Reconcile(config.LocalMetricsEnabled, config.LocalMetricsAddress)
+
+	// A probe that errors leaves the login undecided: Management unreachable, a
+	// restart mid-request, an internal error. Those are returned for the caller
+	// to retry, because turning them into an SSO prompt asks the user to solve
+	// something that is not theirs to solve, and a browser login cannot succeed
+	// while Management is unreachable anyway. Only Management refusing the
+	// peer's key is a decision, and IsLoginRequired reports that as
+	// needsLogin=true rather than an error.
+	needsLogin, err := s.isLoginRequired(ctx)
+	if err != nil {
+		state.Set(internal.StatusLoginFailed)
+		return nil, err
+	}
+	if !needsLogin {
 		state.Set(internal.StatusIdle)
 		return &proto.LoginResponse{}, nil
 	}
 
-	state.Set(internal.StatusConnecting)
-
 	if msg.SetupKey == "" {
-		hint := ""
-		if msg.Hint != nil {
-			hint = *msg.Hint
-		}
-		oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.IsUnixDesktopClient, false, hint)
-		if err != nil {
-			state.Set(internal.StatusLoginFailed)
-			return nil, err
-		}
-
-		if s.oauthAuthFlow.flow != nil && s.oauthAuthFlow.flow.GetClientID(ctx) == oAuthFlow.GetClientID(ctx) {
-			if s.oauthAuthFlow.expiresAt.After(time.Now().Add(90 * time.Second)) {
-				log.Debugf("using previous oauth flow info")
-				return &proto.LoginResponse{
-					NeedsSSOLogin:           true,
-					VerificationURI:         s.oauthAuthFlow.info.VerificationURI,
-					VerificationURIComplete: s.oauthAuthFlow.info.VerificationURIComplete,
-					UserCode:                s.oauthAuthFlow.info.UserCode,
-				}, nil
-			} else {
-				log.Warnf("canceling previous waiting execution")
-				if s.oauthAuthFlow.waitCancel != nil {
-					s.oauthAuthFlow.waitCancel()
-				}
-			}
-		}
-
-		authInfo, err := oAuthFlow.RequestAuthInfo(ctx)
-		if err != nil {
-			log.Errorf("getting a request OAuth flow failed: %v", err)
-			return nil, err
-		}
-
-		s.mutex.Lock()
-		s.oauthAuthFlow.flow = oAuthFlow
-		s.oauthAuthFlow.info = authInfo
-		s.oauthAuthFlow.expiresAt = time.Now().Add(time.Duration(authInfo.ExpiresIn) * time.Second)
-		s.mutex.Unlock()
-
-		state.Set(internal.StatusNeedsLogin)
-
-		return &proto.LoginResponse{
-			NeedsSSOLogin:           true,
-			VerificationURI:         authInfo.VerificationURI,
-			VerificationURIComplete: authInfo.VerificationURIComplete,
-			UserCode:                authInfo.UserCode,
-		}, nil
+		return s.startSSOLogin(ctx, msg, config, state)
 	}
 
-	if loginStatus, err := s.loginAttempt(ctx, msg.SetupKey, ""); err != nil {
+	// Setup-key path: we are about to dial Management with the key, so the
+	// Connecting paint is meaningful here — unlike the SSO branch above,
+	// which returns NeedsLogin and parks on the browser leg.
+	state.Set(internal.StatusConnecting)
+
+	if loginStatus, err := s.attemptLogin(ctx, msg.SetupKey, ""); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -635,8 +793,165 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	return &proto.LoginResponse{}, nil
 }
 
-// WaitSSOLogin uses the userCode to validate the TokenInfo and
-// waits for the user to continue with the login on a browser
+// startSSOLogin opens the interactive leg of a login: it reuses the in-flight
+// OAuth flow when one is still valid for the same client, and otherwise
+// requests fresh auth info and parks the daemon on StatusNeedsLogin.
+func (s *Server) startSSOLogin(ctx context.Context, msg *proto.LoginRequest, config *profilemanager.Config, state statusSetter) (*proto.LoginResponse, error) {
+	hint := ""
+	if msg.Hint != nil {
+		hint = *msg.Hint
+	}
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.IsUnixDesktopClient, false, hint, false)
+	if err != nil {
+		state.Set(internal.StatusLoginFailed)
+		return nil, err
+	}
+
+	s.mutex.Lock()
+	promptForAccount := s.forceAccountPrompt
+	s.forceAccountPrompt = false
+	s.mutex.Unlock()
+	if promptForAccount && auth.RetryFlowForAccount(oAuthFlow) == nil {
+		// The device flow cannot ask; run it as-is. accountPrompted still goes
+		// true below so a second mismatch is let through instead of looping.
+		log.Warnf("the previous login returned a different account, but this flow cannot ask the IdP to choose one")
+	}
+
+	if resp := s.reuseOAuthFlow(ctx, oAuthFlow, state, promptForAccount); resp != nil {
+		return resp, nil
+	}
+
+	authInfo, err := oAuthFlow.RequestAuthInfo(ctx)
+	if err != nil {
+		log.Errorf("getting a request OAuth flow failed: %v", err)
+		return nil, err
+	}
+
+	s.replaceOAuthFlow(oauthAuthFlow{
+		flow:            oAuthFlow,
+		info:            authInfo,
+		expiresAt:       time.Now().Add(time.Duration(authInfo.ExpiresIn) * time.Second),
+		hint:            hint,
+		accountPrompted: promptForAccount,
+	})
+
+	state.Set(internal.StatusNeedsLogin)
+
+	return &proto.LoginResponse{
+		NeedsSSOLogin:           true,
+		VerificationURI:         authInfo.VerificationURI,
+		VerificationURIComplete: authInfo.VerificationURIComplete,
+		UserCode:                authInfo.UserCode,
+	}, nil
+}
+
+// replaceOAuthFlow installs next as the shared OAuth flow record and takes over
+// the wait it displaces, so a WaitSSOLogin still parked on the old flow is not
+// left without an owner: nothing would preempt it, and it could go on to run
+// attemptLogin or mutate the record behind the new flow.
+//
+// The displaced cancel is read in the same critical section that replaces the
+// record, so two callers racing here cannot both take the same predecessor. The
+// cancel runs after the unlock — the displaced wait takes s.mutex as it unwinds.
+func (s *Server) replaceOAuthFlow(next oauthAuthFlow) {
+	s.mutex.Lock()
+	staleCancel := s.oauthAuthFlow.waitCancel
+	s.oauthAuthFlow = next
+	s.mutex.Unlock()
+
+	if staleCancel != nil {
+		staleCancel()
+	}
+}
+
+func (s *Server) expireOAuthFlow(flow auth.OAuthFlow) {
+	s.mutex.Lock()
+	if s.oauthAuthFlow.flow == flow {
+		s.oauthAuthFlow.expiresAt = time.Now()
+	}
+	s.mutex.Unlock()
+}
+
+// reuseOAuthFlow returns the cached auth info when the previous flow targets
+// the same client and still has enough life left, and otherwise cancels the
+// stale wait and returns nil so the caller requests a fresh flow.
+//
+// promptForAccount rules reuse out: the cached flow was built without the
+// account prompt, so handing its URL back would repeat the silent
+// authorization that returned the wrong account — and with the flag already
+// consumed, no later round would ask either. The predecessor's wait is still
+// cancelled on the way out, so it is not orphaned on its device-code window.
+//
+// The whole decision runs off one snapshot taken under s.mutex: a concurrent
+// WaitSSOLogin replaces waitCancel and expires the flow, so reading the fields
+// one at a time could cancel a wait that no longer belongs to the flow just
+// judged stale, or answer with auth info from a flow that was already replaced.
+// The cancel itself is called after unlocking — it runs arbitrary teardown, and
+// WaitSSOLogin takes s.mutex on the way out.
+func (s *Server) reuseOAuthFlow(ctx context.Context, oAuthFlow auth.OAuthFlow, state statusSetter, promptForAccount bool) *proto.LoginResponse {
+	s.mutex.Lock()
+	current := s.oauthAuthFlow
+	s.mutex.Unlock()
+
+	if current.flow == nil || current.flow.GetClientID(ctx) != oAuthFlow.GetClientID(ctx) {
+		return nil
+	}
+
+	if promptForAccount || !current.expiresAt.After(time.Now().Add(90*time.Second)) {
+		log.Warnf("canceling previous waiting execution")
+		if current.waitCancel != nil {
+			current.waitCancel()
+		}
+		return nil
+	}
+
+	log.Debugf("using previous oauth flow info")
+	state.Set(internal.StatusNeedsLogin)
+	return &proto.LoginResponse{
+		NeedsSSOLogin:           true,
+		VerificationURI:         current.info.VerificationURI,
+		VerificationURIComplete: current.info.VerificationURIComplete,
+		UserCode:                current.info.UserCode,
+	}
+}
+
+// WaitSSOLogin validates the supplied userCode against the in-flight OAuth
+// device/PKCE flow and blocks until the user finishes the browser leg.
+//
+// The daemon holds StatusNeedsLogin for the whole browser wait (set on
+// entry): the login is not done until the token returns, so a client that
+// (re)attaches mid-wait — a restarted UI, a second `netbird up` — reads
+// "login required" and offers the affordance, instead of a Connecting that
+// never resolves. The wait is also tied to the caller's context (see the
+// goroutine below), so a client that goes away cancels the wait instead of
+// orphaning it on rootCtx until the device-code window expires.
+//
+// State transitions on exit:
+//
+//	┌──────────────────────────────────────────┬──────────────────────────────────┐
+//	│ Outcome                                  │ contextState                     │
+//	├──────────────────────────────────────────┼──────────────────────────────────┤
+//	│ Success → loginAttempt ok                │ NeedsLogin held; the caller's Up │
+//	│                                          │   drives Connecting → Connected  │
+//	│ Success → loginAttempt → still-NeedsLogin│ StatusNeedsLogin (loginAttempt)  │
+//	│ Success → loginAttempt error             │ StatusLoginFailed (loginAttempt) │
+//	│ UserCode mismatch                        │ StatusLoginFailed                │
+//	│ WaitToken: context.Canceled              │ NeedsLogin held. Caller gone     │
+//	│   (caller went away — UI restart /       │   (UI/CLI) → a fresh client      │
+//	│   Ctrl+C — or internal abort: profile    │   shows the login affordance;    │
+//	│   switch / app quit / another            │   internal aborts are            │
+//	│   WaitSSOLogin via actCancel/waitCancel) │   overwritten by the next Up.    │
+//	│ WaitToken: context.DeadlineExceeded      │ StatusNeedsLogin                 │
+//	│   (OAuth device-code window expired      │   (retryable; the UI's "Connect" │
+//	│   while waiting on the browser leg)      │   re-enters the Login flow)      │
+//	│ WaitToken: any other error               │ StatusLoginFailed                │
+//	│   (access_denied, expired_token, HTTP    │   (genuine auth/IO failure;      │
+//	│   failure, token validation rejection)   │   surfaced verbatim to caller)   │
+//	└──────────────────────────────────────────┴──────────────────────────────────┘
+//
+// The defer still applies a StatusIdle fallback for the early
+// oauth-flow-not-initialized return (before the entry Set), so a half state
+// doesn't leak when there is nothing to wait on.
 func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLoginRequest) (*proto.WaitSSOLoginResponse, error) {
 	s.mutex.Lock()
 	if s.actCancel != nil {
@@ -644,6 +959,21 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	}
 	ctx, cancel := context.WithCancel(s.rootCtx)
 
+	// Tie the in-flight browser wait to the caller. ctx stays rooted in
+	// rootCtx so CtxGetState resolves the daemon's contextState, but if the
+	// UI window or CLI that drove the login goes away mid-flow (restart,
+	// Ctrl+C) the gRPC callerCtx cancels and we cancel the wait instead of
+	// orphaning it on rootCtx until the OAuth device-code window expires.
+	// The goroutine exits as soon as either context completes, so it can't
+	// outlive the RPC.
+	go func() {
+		select {
+		case <-callerCtx.Done():
+			cancel()
+		case <-ctx.Done():
+		}
+	}()
+
 	md, ok := metadata.FromIncomingContext(callerCtx)
 	if ok {
 		ctx = metadata.NewOutgoingContext(ctx, md)
@@ -655,9 +985,16 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	}
 
 	s.actCancel = cancel
+	// One snapshot of the flow this wait belongs to. hint and accountPrompted
+	// are judged against the token that comes back below, and WaitToken blocks
+	// for the whole browser leg: a concurrent Login or RequestJWTAuth replaces
+	// s.oauthAuthFlow meanwhile, so re-reading them after the wait would judge
+	// this flow's token against another flow's account.
+	pending := s.oauthAuthFlow
+	flow := pending.flow
 	s.mutex.Unlock()
 
-	if s.oauthAuthFlow.flow == nil {
+	if flow == nil {
 		return nil, gstatus.Errorf(codes.Internal, "oauth flow is not initialized")
 	}
 
@@ -669,47 +1006,105 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 		}
 	}()
 
-	state.Set(internal.StatusConnecting)
+	// Hold NeedsLogin for the whole browser wait — the login is not done
+	// until the token returns, so a client that (re)attaches mid-wait
+	// (restarted UI, second `netbird up`) reads "login required" and offers
+	// the affordance instead of a Connecting that never resolves.
+	state.Set(internal.StatusNeedsLogin)
 
-	s.mutex.Lock()
-	flowInfo := s.oauthAuthFlow.info
-	s.mutex.Unlock()
+	flowInfo := pending.info
 
 	if flowInfo.UserCode != msg.UserCode {
 		state.Set(internal.StatusLoginFailed)
 		return nil, gstatus.Errorf(codes.InvalidArgument, "sso user code is invalid")
 	}
 
-	if s.oauthAuthFlow.waitCancel != nil {
-		s.oauthAuthFlow.waitCancel()
-	}
-
 	waitCTX, cancel := context.WithCancel(ctx)
 	defer cancel()
 
+	// Swap in this wait's cancel and take over the one it displaces in a single
+	// critical section, so two WaitSSOLogin calls racing here cannot both read
+	// the same predecessor and leave one wait uncancelled. Cancelling happens
+	// after the unlock: the displaced wait takes s.mutex as it unwinds.
 	s.mutex.Lock()
+	if s.oauthAuthFlow.flow != flow {
+		s.mutex.Unlock()
+		return nil, gstatus.Errorf(codes.Canceled, "sso login was replaced by a newer login")
+	}
+	staleCancel := s.oauthAuthFlow.waitCancel
 	s.oauthAuthFlow.waitCancel = cancel
 	s.mutex.Unlock()
 
-	tokenInfo, err := s.oauthAuthFlow.flow.WaitToken(waitCTX, flowInfo)
+	if staleCancel != nil {
+		staleCancel()
+	}
+
+	tokenInfo, err := flow.WaitToken(waitCTX, flowInfo)
 	if err != nil {
-		s.mutex.Lock()
-		s.oauthAuthFlow.expiresAt = time.Now()
-		s.mutex.Unlock()
-		state.Set(internal.StatusLoginFailed)
+		s.expireOAuthFlow(flow)
+		switch {
+		case errors.Is(err, context.Canceled):
+			// External abort. If our caller cancelled (the client closed
+			// the browser-login popup, or the UI went away — callerCtx is
+			// done), clear the abandoned OAuth flow so a fresh Login starts
+			// a new device code instead of reusing this one. The entry
+			// NeedsLogin stays in place, so a reattaching client shows the
+			// login affordance. An internal abort (actCancel from a new
+			// Login/WaitSSOLogin, callerCtx still live) leaves the flow for
+			// the new owner — don't clobber it.
+			if callerCtx.Err() != nil {
+				s.mutex.Lock()
+				if s.oauthAuthFlow.flow == flow {
+					s.oauthAuthFlow = oauthAuthFlow{}
+				}
+				s.mutex.Unlock()
+			}
+		case errors.Is(err, context.DeadlineExceeded):
+			// OAuth device-code window expired with no user action.
+			// Retryable — leave the daemon in NeedsLogin so the UI
+			// keeps the Login affordance instead of reading as a
+			// hard failure.
+			state.Set(internal.StatusNeedsLogin)
+		default:
+			state.Set(internal.StatusLoginFailed)
+		}
 		log.Errorf("waiting for browser login failed: %v", err)
 		return nil, err
 	}
 
-	s.mutex.Lock()
-	s.oauthAuthFlow.expiresAt = time.Now()
-	s.mutex.Unlock()
+	s.expireOAuthFlow(flow)
 
-	if loginStatus, err := s.loginAttempt(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
+	if !tokenInfo.MatchesAccount(pending.hint) {
+		if !pending.accountPrompted {
+			// The IdP answered from a session belonging to another account. The
+			// browser for this flow is gone, so a new URL cannot be handed out
+			// here — arm the prompt for the user's next connect and fail this
+			// round. Never log in with the token: on a registered peer the
+			// server would reject it, and on a fresh one it would silently
+			// register the peer under the wrong account.
+			log.Warnf("login returned an account other than the one this profile is bound to; the next connect will ask the IdP to choose")
+			s.mutex.Lock()
+			if s.oauthAuthFlow.flow == flow {
+				s.oauthAuthFlow = oauthAuthFlow{}
+				s.forceAccountPrompt = true
+			}
+			s.mutex.Unlock()
+			state.Set(internal.StatusNeedsLogin)
+			return nil, gstatus.Errorf(codes.FailedPrecondition, "the login used a different account than this profile; connect again to choose the account")
+		}
+		// Already asked once; the account may legitimately differ (a changed
+		// email address). Refusing again would lock the user out of the profile,
+		// and the management server still rejects a token that does not own the
+		// peer.
+		log.Warnf("login still returned a different account after the prompt, continuing with it")
+	}
+
+	if loginStatus, err := s.attemptLogin(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
 
+	log.Infof("SSO login flow finished, returning success to caller")
 	return &proto.WaitSSOLoginResponse{
 		Email: tokenInfo.Email,
 	}, nil
@@ -717,6 +1112,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 
 // Up starts engine work in the daemon.
 func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpResponse, error) {
+	log.Infof("up request received")
 	s.mutex.Lock()
 	// clientRunning is the daemon-intent flag (set by previous Up/Start, cleared
 	// by Down). connectionGoroutineRunning() reports whether the previous retry-loop
@@ -738,7 +1134,7 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 
 		return s.waitForUp(callerCtx)
 	}
-	if err := restoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := RestoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
@@ -753,6 +1149,22 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 		return nil, err
 	}
 
+	// StatusNeedsLogin is a legitimate fresh-start entry state: a successful
+	// WaitSSOLogin deliberately leaves the daemon in NeedsLogin (the login is
+	// done, the token is in hand, but the engine hasn't been brought up yet —
+	// see WaitSSOLogin's state-transition table). The same holds after a
+	// mid-session expiry tore the engine down (clientRunning == false) and the
+	// user re-authenticated. In both cases the caller's Up is expected to drive
+	// the connection; treat NeedsLogin like Idle and reset to Idle so the
+	// engine's own StatusConnecting → StatusConnected progression starts from a
+	// clean slate. Without this, the first Up after an SSO login fails with
+	// "up already in progress" and the user has to trigger Up a second time
+	// (CLI: re-run `netbird up`; GUI: click Connect again).
+	if status == internal.StatusNeedsLogin {
+		status = internal.StatusIdle
+		state.Set(internal.StatusIdle)
+	}
+
 	if status != internal.StatusIdle {
 		s.mutex.Unlock()
 		return nil, fmt.Errorf("up already in progress: current status %s", status)
@@ -783,11 +1195,15 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 	}
 
 	if msg != nil && msg.ProfileName != nil {
-		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
+		switched, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf)
+		if err != nil {
 			s.mutex.Unlock()
 			log.Errorf("failed to switch profile: %v", err)
 			return nil, err
 		}
+		if switched {
+			s.dropPendingAuthFlows()
+		}
 	}
 
 	activeProf, err = s.profileManager.GetActiveProfileState()
@@ -809,15 +1225,19 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 
 	s.statusRecorder.UpdateManagementAddress(s.config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(s.config.RosenpassEnabled, s.config.RosenpassPermissive)
+	s.localMetrics.Reconcile(s.config.LocalMetricsEnabled, s.config.LocalMetricsAddress)
 
 	s.clientRunning = true
 	s.clientRunningChan = make(chan struct{})
 	s.clientGiveUpChan = make(chan struct{})
 
 	go s.connectWithRetryRuns(ctx, s.config, s.statusRecorder, s.clientRunningChan, s.clientGiveUpChan)
-	s.publishConfigChangedEvent("up_rpc")
+	s.publishConfigChangedEvent(proto.MetadataSourceUpRPC)
 
 	s.mutex.Unlock()
+	if msg.GetAsync() {
+		return &proto.UpResponse{}, nil
+	}
 	return s.waitForUp(callerCtx)
 }
 
@@ -841,6 +1261,67 @@ func (s *Server) waitForUp(callerCtx context.Context) (*proto.UpResponse, error)
 	}
 }
 
+// storedProfileConfig loads the on-disk config of the profile a request
+// targets, so a privileged-change decision can be made against the values the
+// profile currently holds. A profile that has no config file yet yields nil,
+// which every caller must read as "nothing enabled yet".
+func (s *Server) storedProfileConfig(handle, username string) (*profilemanager.Config, error) {
+	resolved, err := s.resolveProfileHandle(handle, username)
+	if err != nil {
+		return nil, err
+	}
+
+	path := resolved.Path
+	if path == "" {
+		path = profilemanager.DefaultConfigPath
+	}
+
+	return s.storedConfigAtPath(path)
+}
+
+// storedLoginConfig loads the on-disk config of the profile a login request
+// targets: the one it names, or the active one when it names none. Used to decide
+// a privileged change before the request is allowed to switch profiles.
+func (s *Server) storedLoginConfig(activeProf *profilemanager.ActiveProfileState, msg *proto.LoginRequest) (*profilemanager.Config, error) {
+	if msg.ProfileName == nil {
+		cfgPath, err := activeProf.FilePath()
+		if err != nil {
+			return nil, fmt.Errorf("active profile file path: %w", err)
+		}
+		return s.storedConfigAtPath(cfgPath)
+	}
+
+	// Mirrors switchProfileIfNeeded: the default profile resolves without a
+	// username, so this reads the same profile the switch would activate.
+	handle := *msg.ProfileName
+	username := ""
+	if handle != profilemanager.DefaultProfileName {
+		username = msg.GetUsername()
+	}
+	return s.storedProfileConfig(handle, username)
+}
+
+// storedConfigAtPath reads a profile config file, yielding nil when it does not
+// exist yet.
+//
+// Reading it has no side effect: profilemanager.GetExistingConfig does not
+// write, so a request that the gates go on to refuse leaves the profile file as
+// it found it.
+func (s *Server) storedConfigAtPath(path string) (*profilemanager.Config, error) {
+	if _, err := os.Stat(path); err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil //nolint:nilnil
+		}
+		return nil, fmt.Errorf("stat profile config: %w", err)
+	}
+
+	cfg, err := profilemanager.GetExistingConfig(path)
+	if err != nil {
+		return nil, fmt.Errorf("read profile config: %w", err)
+	}
+	return cfg, nil
+}
+
 // resolveProfileHandle resolves a wire-level profile handle (display
 // name, ID, or unique ID prefix) to a concrete profile. Returns gRPC
 // status errors so handlers can return them directly.
@@ -860,12 +1341,12 @@ func (s *Server) resolveProfileHandle(handle, username string) (*profilemanager.
 }
 
 // switchProfileIfNeeded resolves the user-supplied handle, updates the
-// active profile state if it differs from the current one, and returns
-// the resolved profile so callers can include its ID in RPC responses.
-func (s *Server) switchProfileIfNeeded(handle string, userName *string, activeProf *profilemanager.ActiveProfileState) (*profilemanager.Profile, error) {
+// active profile state if it differs from the current one, and reports
+// whether the active profile changed.
+func (s *Server) switchProfileIfNeeded(handle string, userName *string, activeProf *profilemanager.ActiveProfileState) (bool, error) {
 	if handle != profilemanager.DefaultProfileName && (userName == nil || *userName == "") {
 		log.Errorf("profile name is set to %s, but username is not provided", handle)
-		return nil, fmt.Errorf("profile name is set to %s, but username is not provided", handle)
+		return false, fmt.Errorf("profile name is set to %s, but username is not provided", handle)
 	}
 
 	var username string
@@ -875,26 +1356,48 @@ func (s *Server) switchProfileIfNeeded(handle string, userName *string, activePr
 
 	resolved, err := s.resolveProfileHandle(handle, username)
 	if err != nil {
-		return nil, err
+		return false, err
 	}
 
-	if resolved.ID != activeProf.ID || username != activeProf.Username {
-		if s.checkProfilesDisabled() {
-			log.Errorf("profiles are disabled, you cannot use this feature without profiles enabled")
-			return nil, gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
-		}
-
-		log.Infof("switching to profile %s (%s) for user %s", resolved.Name, resolved.ID, username)
-		if err := s.profileManager.SetActiveProfileState(&profilemanager.ActiveProfileState{
-			ID:       resolved.ID,
-			Username: username,
-		}); err != nil {
-			log.Errorf("failed to set active profile state: %v", err)
-			return nil, fmt.Errorf("failed to set active profile state: %w", err)
-		}
+	if resolved.ID == activeProf.ID && username == activeProf.Username {
+		return false, nil
 	}
 
-	return resolved, nil
+	if s.checkProfilesDisabled() {
+		log.Errorf("profiles are disabled, you cannot use this feature without profiles enabled")
+		return false, gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
+	}
+
+	log.Infof("switching to profile %s (%s) for user %s", resolved.Name, resolved.ID, username)
+	if err := s.profileManager.SetActiveProfileState(&profilemanager.ActiveProfileState{
+		ID:       resolved.ID,
+		Username: username,
+	}); err != nil {
+		log.Errorf("failed to set active profile state: %v", err)
+		return false, fmt.Errorf("failed to set active profile state: %w", err)
+	}
+
+	return true, nil
+}
+
+func (s *Server) dropPendingAuthFlows() {
+	// A pending login flow and the account-prompt flag describe the previous
+	// profile's login; carried across a switch they would judge the new
+	// profile's token against the old profile's account. CancelFunc is
+	// non-blocking, so calling it under the mutex is safe.
+	if cancel := s.oauthAuthFlow.waitCancel; cancel != nil {
+		cancel()
+	}
+	s.oauthAuthFlow = oauthAuthFlow{}
+	s.forceAccountPrompt = false
+
+	// A pending session extend belongs to the previous profile too: its device
+	// code was issued by that profile's IdP client, and WaitExtendAuthSession
+	// would submit the resulting token against the new profile's engine.
+	s.extendAuthSessionFlow.CancelWait()
+	s.extendAuthSessionFlow.Clear()
+
+	s.jwtCache.clear()
 }
 
 // SwitchProfile switches the active profile in the daemon.
@@ -926,6 +1429,13 @@ func (s *Server) SwitchProfile(callerCtx context.Context, msg *proto.SwitchProfi
 	}
 
 	s.config = config
+	s.localMetrics.Reconcile(config.LocalMetricsEnabled, config.LocalMetricsAddress)
+
+	s.dropPendingAuthFlows()
+
+	if msg != nil && msg.ProfileName != nil {
+		s.publishProfileListChanged(*msg.ProfileName)
+	}
 
 	return &proto.SwitchProfileResponse{Id: activeProf.ID.String()}, nil
 }
@@ -938,28 +1448,45 @@ func (s *Server) Down(ctx context.Context, _ *proto.DownRequest) (*proto.DownRes
 
 	if err := s.cleanupConnection(); err != nil {
 		s.mutex.Unlock()
-		// todo review to update the status in case any type of error
+		if errors.Is(err, ErrServiceNotUp) {
+			log.Debugf("Down called while service not up: %v", err)
+			return nil, err
+		}
 		log.Errorf("failed to shut down properly: %v", err)
 		return nil, err
 	}
 
-	state := internal.CtxGetState(s.rootCtx)
-	state.Set(internal.StatusIdle)
-
 	s.mutex.Unlock()
 
 	// Wait for the connectWithRetryRuns goroutine to finish with a short timeout.
 	// This prevents the goroutine from setting ErrResetConnection after Down() returns.
-	// The giveUpChan is closed at the end of connectWithRetryRuns.
+	// The giveUpChan is closed by the goroutine's deferred cleanup (see
+	// connectWithRetryRuns) on every exit path. A timeout here typically
+	// means the goroutine is still wedged inside a slow teardown step.
 	if giveUpChan != nil {
 		select {
 		case <-giveUpChan:
-			log.Debugf("client goroutine finished successfully")
+			log.Debugf("client goroutine finished, giveUpChan closed")
 		case <-time.After(5 * time.Second):
 			log.Warnf("timeout waiting for client goroutine to finish, proceeding anyway")
 		}
 	}
 
+	// Set Idle only after the retry goroutine has exited (or timed out).
+	// Setting it earlier races with the goroutine's own Set(StatusConnecting)
+	// at the top of each retry attempt, which would leave the snapshot
+	// stuck at Connecting long after the user asked to disconnect.
+	internal.CtxGetState(s.rootCtx).Set(internal.StatusIdle)
+
+	// Clear stale management/signal errors so the next Up() (typically for a
+	// different profile) starts with a clean status snapshot. Without this,
+	// a managementError left over from a LoginFailed cycle persists in the
+	// statusRecorder and appears in the new profile's initial
+	// SubscribeStatus snapshot, making the new profile look like it also
+	// failed to log in.
+	s.statusRecorder.MarkManagementDisconnected(nil)
+	s.statusRecorder.MarkSignalDisconnected(nil)
+
 	return &proto.DownResponse{}, nil
 }
 
@@ -997,7 +1524,7 @@ func (s *Server) cleanupConnection() error {
 	// making the run loop the sole owner of engine shutdown.
 	if engine != nil {
 		if err := engine.Stop(); err != nil {
-			return err
+			log.Errorf("failed to stop engine during cleanup: %v", err)
 		}
 	}
 
@@ -1031,27 +1558,56 @@ func (s *Server) handleProfileLogout(ctx context.Context, msg *proto.LogoutReque
 		return nil, err
 	}
 
-	if err := s.validateProfileOperation(resolved.ID, true); err != nil {
+	activeProf, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "failed to get active profile state: %v", err)
+	}
+
+	if err := s.validateProfileLogout(resolved.ID, isActiveProfile(activeProf, resolved.ID, username)); err != nil {
 		return nil, err
 	}
 
-	if err := s.logoutFromProfile(ctx, resolved); err != nil {
+	if err := s.logoutFromProfile(ctx, resolved, username); err != nil {
 		log.Errorf("failed to logout from profile %s: %v", resolved.ID, err)
+		// A refused deregistration is already a status error carrying the reason
+		// and the command to run; rewrapping it as Internal would flatten both
+		// into a gRPC dump for the user.
+		if _, isStatus := gstatus.FromError(err); isStatus {
+			return nil, err
+		}
 		return nil, gstatus.Errorf(codes.Internal, "logout: %v", err)
 	}
 
-	activeProf, _ := s.profileManager.GetActiveProfileState()
-	if activeProf != nil && activeProf.ID == resolved.ID {
-		if err := s.cleanupConnection(); err != nil && !errors.Is(err, ErrServiceNotUp) {
-			log.Errorf("failed to cleanup connection: %v", err)
-		}
-		state := internal.CtxGetState(s.rootCtx)
-		state.Set(internal.StatusNeedsLogin)
-	}
+	s.cleanupAfterProfileLogout(resolved.ID, username)
 
 	return &proto.LogoutResponse{}, nil
 }
 
+// cleanupAfterProfileLogout tears the connection down and asks for a new login
+// when the profile that was just deregistered is the one the daemon is running.
+// The active profile is read again here rather than reused from the pre-flight
+// check: Login switches profiles under guardedConfigMu, which this path does not
+// hold, so a login that landed meanwhile must not have its fresh connection
+// dropped by a logout that targeted the profile it replaced.
+func (s *Server) cleanupAfterProfileLogout(id profilemanager.ID, username string) {
+	activeProf, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		log.Errorf("failed to get active profile state after logout from profile %s: %v", id, err)
+		return
+	}
+
+	if !isActiveProfile(activeProf, id, username) {
+		return
+	}
+
+	if err := s.cleanupConnection(); err != nil && !errors.Is(err, ErrServiceNotUp) {
+		log.Errorf("failed to cleanup connection: %v", err)
+	}
+	s.jwtCache.clear()
+	state := internal.CtxGetState(s.rootCtx)
+	state.Set(internal.StatusNeedsLogin)
+}
+
 func (s *Server) handleActiveProfileLogout(ctx context.Context) (*proto.LogoutResponse, error) {
 	if s.config == nil {
 		activeProf, err := s.profileManager.GetActiveProfileState()
@@ -1076,6 +1632,7 @@ func (s *Server) handleActiveProfileLogout(ctx context.Context) (*proto.LogoutRe
 		log.Errorf("failed to cleanup connection: %v", err)
 		return nil, err
 	}
+	s.jwtCache.clear()
 
 	state := internal.CtxGetState(s.rootCtx)
 	state.Set(internal.StatusNeedsLogin)
@@ -1083,8 +1640,16 @@ func (s *Server) handleActiveProfileLogout(ctx context.Context) (*proto.LogoutRe
 	return &proto.LogoutResponse{}, nil
 }
 
-// getConfig reads config file and returns Config and whether the config file already existed. Errors out if it does not exist
-func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*profilemanager.Config, bool, error) {
+// provisionProfileIdentity resolves the active profile's config and puts the
+// keys that identify the peer on disk, reporting whether the config file
+// already existed.
+//
+// This is the daemon's provisioning point: the config resolved here is the one
+// the peer runs with, so it needs its identity, and that has to reach disk — a
+// key that stays in memory would come back different on the next start and
+// re-register the peer. Reads themselves are pure, so the write is here, in
+// the open, instead of hiding inside the reader.
+func provisionProfileIdentity(activeProf *profilemanager.ActiveProfileState) (*profilemanager.Config, bool, error) {
 	cfgPath, err := activeProf.FilePath()
 	if err != nil {
 		return nil, false, fmt.Errorf("failed to get active profile file path: %w", err)
@@ -1095,48 +1660,84 @@ func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*prof
 
 	log.Infof("active profile config existed: %t, err %v", configExisted, err)
 
-	config, err := profilemanager.ReadConfig(cfgPath)
+	config, err := profilemanager.ReadConfigOrDefault(cfgPath)
 	if err != nil {
 		return nil, false, fmt.Errorf("failed to get config: %w", err)
 	}
 
+	generated, err := config.EnsureIdentity()
+	if err != nil {
+		return nil, false, fmt.Errorf("ensure profile identity: %w", err)
+	}
+
+	if generated || !configExisted {
+		if err := profilemanager.WriteOutConfig(cfgPath, config); err != nil {
+			return nil, false, fmt.Errorf("write out profile config: %w", err)
+		}
+	}
+
 	return config, configExisted, nil
 }
 
-func (s *Server) canRemoveProfile(id profilemanager.ID) error {
-	if id == profilemanager.DefaultProfileName {
-		return fmt.Errorf("remove profile with reserved name: %s", profilemanager.DefaultProfileName)
+// getConfig resolves the active profile's config, provisions its identity and
+// reports whether the config file already existed.
+func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*profilemanager.Config, bool, error) {
+	config, configExisted, err := provisionProfileIdentity(activeProf)
+	if err != nil {
+		return nil, false, err
 	}
 
-	activeProf, err := s.profileManager.GetActiveProfileState()
-	if err == nil && activeProf.ID == id {
-		return fmt.Errorf("remove active profile: %s", id)
-	}
+	// Apply the daemon-owned MDM policy on top of the just-resolved Config.
+	// profilemanager's apply() initialises the policy to empty — the Loader
+	// lives outside Config, so this overlay step is driven externally here.
+	// After the write above, on purpose: the overlay is runtime-only and
+	// re-derived on every load, so the file keeps the profile's own values.
+	config.ApplyMDMPolicy(s.mdmLoader.Load())
 
-	return nil
+	return config, configExisted, nil
 }
 
-func (s *Server) validateProfileOperation(id profilemanager.ID, allowActiveProfile bool) error {
-	if s.checkProfilesDisabled() {
-		return gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
-	}
-
+// validateProfileLogout gates a profile-addressed logout. Deregistering the
+// profile the daemon already runs is what a plain `netbird logout` does, so the
+// profiles-disabled kill switch must not block it. Logging out of any other
+// profile is profile management and stays gated.
+func (s *Server) validateProfileLogout(id profilemanager.ID, isActive bool) error {
 	if id == "" {
 		return gstatus.Errorf(codes.InvalidArgument, "profile name must be provided")
 	}
 
-	if !allowActiveProfile {
-		if err := s.canRemoveProfile(id); err != nil {
-			return gstatus.Errorf(codes.InvalidArgument, "%v", err)
-		}
+	if isActive {
+		return nil
+	}
+
+	if s.checkProfilesDisabled() {
+		return gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
 	}
 
 	return nil
 }
 
-func (s *Server) logoutFromProfile(ctx context.Context, profile *profilemanager.Profile) error {
+// isActiveProfile reports whether id is the profile the daemon runs for
+// username. The username is part of the comparison because legacy profile IDs
+// are display names, which two users can both hold; the default profile is
+// shared by every user and carries no username.
+func isActiveProfile(activeProf *profilemanager.ActiveProfileState, id profilemanager.ID, username string) bool {
+	if activeProf == nil || activeProf.ID != id {
+		return false
+	}
+
+	return id == profilemanager.DefaultProfileName || activeProf.Username == username
+}
+
+// logoutFromProfile deregisters profile, reusing the running config when
+// profile is the one the daemon is connected with. The username takes part in
+// that decision for the same reason it does in the logout gate: a legacy
+// profile ID is a display name two users can share, and sending the running
+// config for a namesake would deregister the active peer instead of the
+// requested one.
+func (s *Server) logoutFromProfile(ctx context.Context, profile *profilemanager.Profile, username string) error {
 	activeProf, err := s.profileManager.GetActiveProfileState()
-	if err == nil && activeProf.ID == profile.ID && s.connectClient != nil {
+	if err == nil && isActiveProfile(activeProf, profile.ID, username) && s.connectClient != nil {
 		return s.sendLogoutRequest(ctx)
 	}
 
@@ -1145,10 +1746,13 @@ func (s *Server) logoutFromProfile(ctx context.Context, profile *profilemanager.
 		cfgPath = profilemanager.DefaultConfigPath
 	}
 
-	config, err := profilemanager.GetConfig(cfgPath)
+	config, err := profilemanager.GetExistingConfig(cfgPath)
 	if err != nil {
 		return fmt.Errorf("profile '%s' not found", profile.ID)
 	}
+	// Honour any MDM-enforced ManagementURL when issuing the logout
+	// RPC: the user-stored value may have been overridden by policy.
+	config.ApplyMDMPolicy(s.mdmLoader.Load())
 
 	return s.sendLogoutRequestWithConfig(ctx, config)
 }
@@ -1158,6 +1762,26 @@ func (s *Server) sendLogoutRequest(ctx context.Context) error {
 }
 
 func (s *Server) sendLogoutRequestWithConfig(ctx context.Context, config *profilemanager.Config) error {
+	// Privilege gate: deregistering frees this machine's key to be registered
+	// against another management server, which is only restricted while the SSH
+	// server makes that a privilege handover.
+	// Ahead of the privilege gate on purpose. A profile with no identity was
+	// never registered — a logout clears the keys in place, so logging the same
+	// profile out twice lands here — so there is nothing to deregister and
+	// nothing for the gate to protect: what it guards against is handing this
+	// machine's registered key to another management server. Behind the gate,
+	// an unprivileged caller would be refused instead, and for a profile whose
+	// ServerSSHAllowed is unset that is every caller, since an absent value
+	// counts as SSH enabled.
+	if config.PrivateKey == "" {
+		log.Infof("profile carries no identity, nothing to deregister")
+		return nil
+	}
+
+	if err := requirePrivilegeForDeregistration(ctx, config); err != nil {
+		return err
+	}
+
 	key, err := wgtypes.ParseKey(config.PrivateKey)
 	if err != nil {
 		return fmt.Errorf("parse private key: %w", err)
@@ -1174,7 +1798,19 @@ func (s *Server) sendLogoutRequestWithConfig(ctx context.Context, config *profil
 		}
 	}()
 
-	return mgmClient.Logout()
+	if err := mgmClient.Logout(); err != nil {
+		// The peer is already gone from the management server (e.g. deleted
+		// from the dashboard). The logout's goal — deregistering this peer —
+		// is therefore already satisfied, so treat NotFound as success rather
+		// than blocking the logout/profile-removal flow.
+		if logoutPeerGone(err) {
+			log.Infof("peer already removed from management server, treating logout as successful")
+			return nil
+		}
+		return err
+	}
+
+	return nil
 }
 
 // Status returns the daemon status
@@ -1227,9 +1863,24 @@ func (s *Server) Status(
 		}
 	}
 
-	status, err := internal.CtxGetState(s.rootCtx).Status()
+	return s.buildStatusResponse(ctx, msg)
+}
+
+// buildStatusResponse composes a StatusResponse from the current daemon
+// state. Shared between the unary Status RPC and the SubscribeStatus
+// stream so both paths return identical snapshots. ctx scopes the health
+// probe runProbes may trigger — a caller that disconnects cancels it.
+func (s *Server) buildStatusResponse(ctx context.Context, msg *proto.StatusRequest) (*proto.StatusResponse, error) {
+	state := internal.CtxGetState(s.rootCtx)
+	status, err := state.Status()
 	if err != nil {
-		return nil, err
+		// state.Status() blanks the status when err is set (e.g. management
+		// retry loop wrapped a connection error). The underlying status is
+		// still meaningful and the failure is already surfaced via
+		// FullStatus.ManagementState.Error, so don't propagate err — that
+		// would tear down the SubscribeStatus stream and cause the UI to
+		// mark the daemon as unreachable on every retry.
+		status = state.CurrentStatus()
 	}
 
 	if status == internal.StatusNeedsLogin && s.isSessionActive.Load() {
@@ -1240,15 +1891,20 @@ func (s *Server) Status(
 
 	statusResponse := proto.StatusResponse{Status: string(status), DaemonVersion: version.NetbirdVersion()}
 
+	if deadline := s.statusRecorder.GetSessionExpiresAt(); !deadline.IsZero() {
+		statusResponse.SessionExpiresAt = timestamppb.New(deadline)
+	}
+
 	s.statusRecorder.UpdateManagementAddress(s.config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(s.config.RosenpassEnabled, s.config.RosenpassPermissive)
 
 	if msg.GetFullPeerStatus {
-		s.runProbes(msg.ShouldRunProbes)
+		s.runProbes(ctx, msg.ShouldRunProbes)
 		fullStatus := s.statusRecorder.GetFullStatus()
 		pbFullStatus := fullStatus.ToProto()
 		pbFullStatus.Events = s.statusRecorder.GetEventHistory()
 		pbFullStatus.SshServerState = s.getSSHServerState()
+		pbFullStatus.NetworksRevision = s.statusRecorder.GetNetworksRevision()
 		statusResponse.FullStatus = pbFullStatus
 	}
 
@@ -1361,6 +2017,20 @@ func (s *Server) getJWTCacheTTL() time.Duration {
 	return ttl
 }
 
+// cachedJWT returns the cached SSH JWT to the identity that obtained it, and a
+// miss on a control channel that carries no caller identity.
+func (s *Server) cachedJWT(ctx context.Context) (string, bool) {
+	caller, ok := ipcauth.CallerIdentity(ctx)
+	if !ok {
+		// Expected and handled on a control channel with no peer identity: the
+		// caller re-authenticates. daemonServerOptions warns about it once at
+		// startup, so this stays out of the per-request log.
+		log.Debug("not serving the cached SSH JWT: the caller's identity cannot be verified on this control channel")
+		return "", false
+	}
+	return s.jwtCache.get(caller)
+}
+
 // RequestJWTAuth initiates JWT authentication flow for SSH
 func (s *Server) RequestJWTAuth(
 	ctx context.Context,
@@ -1370,8 +2040,14 @@ func (s *Server) RequestJWTAuth(
 		return nil, ctx.Err()
 	}
 
+	// The generation is read here, with the config and under the same lock, not
+	// where the flow is stored below: RequestAuthInfo talks to the IdP in
+	// between, and a switch or a logout during that call would otherwise be
+	// read as the generation this flow belongs to. SwitchProfile holds
+	// s.mutex across its own clear(), so the pair cannot be torn.
 	s.mutex.Lock()
 	config := s.config
+	cacheGeneration := s.jwtCache.currentGeneration()
 	s.mutex.Unlock()
 
 	if config == nil {
@@ -1380,7 +2056,7 @@ func (s *Server) RequestJWTAuth(
 
 	jwtCacheTTL := s.getJWTCacheTTL()
 	if jwtCacheTTL > 0 {
-		if cachedToken, found := s.jwtCache.get(); found {
+		if cachedToken, found := s.cachedJWT(ctx); found {
 			log.Debugf("JWT token found in cache, returning cached token for SSH authentication")
 
 			return &proto.RequestJWTAuthResponse{
@@ -1399,8 +2075,8 @@ func (s *Server) RequestJWTAuth(
 		hint = profilemanager.GetLoginHint()
 	}
 
-	isDesktop := isUnixRunningDesktop()
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isDesktop, false, hint)
+	// the daemon has no graphical session of its own, only the caller can answer this
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint, false)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}
@@ -1410,11 +2086,15 @@ func (s *Server) RequestJWTAuth(
 		return nil, gstatus.Errorf(codes.Internal, "failed to request auth info: %v", err)
 	}
 
-	s.mutex.Lock()
-	s.oauthAuthFlow.flow = oAuthFlow
-	s.oauthAuthFlow.info = authInfo
-	s.oauthAuthFlow.expiresAt = time.Now().Add(time.Duration(authInfo.ExpiresIn) * time.Second)
-	s.mutex.Unlock()
+	// This flow carries no profile hint: leaving the previous login's hint and
+	// accountPrompted in place would have WaitSSOLogin judge a later token
+	// against them.
+	s.replaceOAuthFlow(oauthAuthFlow{
+		flow:            oAuthFlow,
+		info:            authInfo,
+		expiresAt:       time.Now().Add(time.Duration(authInfo.ExpiresIn) * time.Second),
+		cacheGeneration: cacheGeneration,
+	})
 
 	return &proto.RequestJWTAuthResponse{
 		VerificationURI:         authInfo.VerificationURI,
@@ -1438,6 +2118,10 @@ func (s *Server) WaitJWTToken(
 	s.mutex.Lock()
 	oAuthFlow := s.oauthAuthFlow.flow
 	authInfo := s.oauthAuthFlow.info
+	// Recorded when the flow was created, not read here: the flow survives a
+	// profile switch, and everything from RequestJWTAuth to the IdP answering
+	// has to count as the same session for the cache.
+	generation := s.oauthAuthFlow.cacheGeneration
 	s.mutex.Unlock()
 
 	if oAuthFlow == nil || authInfo.DeviceCode != req.DeviceCode {
@@ -1452,11 +2136,17 @@ func (s *Server) WaitJWTToken(
 	token := tokenInfo.GetTokenToUse()
 
 	jwtCacheTTL := s.getJWTCacheTTL()
-	if jwtCacheTTL > 0 {
-		s.jwtCache.store(token, jwtCacheTTL)
-		log.Debugf("JWT token cached for SSH authentication, TTL: %v", jwtCacheTTL)
-	} else {
+	switch caller, ok := ipcauth.CallerIdentity(ctx); {
+	case jwtCacheTTL <= 0:
 		log.Debug("JWT caching disabled, not storing token")
+	case !ok:
+		log.Debug("not caching the SSH JWT: the caller's identity cannot be verified on this control channel")
+	default:
+		if s.jwtCache.store(token, caller, jwtCacheTTL, generation) {
+			log.Debugf("JWT token cached for SSH authentication, TTL: %v", jwtCacheTTL)
+		} else {
+			log.Debug("not caching the SSH JWT: the session it was obtained under ended while the IdP was polled")
+		}
 	}
 
 	s.mutex.Lock()
@@ -1469,6 +2159,154 @@ func (s *Server) WaitJWTToken(
 	}, nil
 }
 
+// RequestExtendAuthSession initiates the SSO session-extension flow and
+// returns the verification URI the UI should open. The flow state is held
+// in s.extendAuthSessionFlow until WaitExtendAuthSession resolves it.
+func (s *Server) RequestExtendAuthSession(
+	ctx context.Context,
+	msg *proto.RequestExtendAuthSessionRequest,
+) (*proto.RequestExtendAuthSessionResponse, error) {
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+
+	s.mutex.Lock()
+	config := s.config
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+
+	if config == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not configured")
+	}
+	if connectClient == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
+	}
+	if connectClient.Engine() == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "session can no longer be extended, log in again to reconnect")
+	}
+
+	hint := ""
+	if msg.Hint != nil {
+		hint = *msg.Hint
+	}
+	if hint == "" {
+		hint = profilemanager.GetLoginHint()
+	}
+
+	// the daemon has no graphical session of its own, only the caller can answer this
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint, true)
+	if err != nil {
+		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
+	}
+
+	authInfo, err := oAuthFlow.RequestAuthInfo(ctx)
+	if err != nil {
+		return nil, gstatus.Errorf(codes.Internal, "failed to request auth info: %v", err)
+	}
+
+	s.extendAuthSessionFlow.Set(oAuthFlow, authInfo)
+
+	return &proto.RequestExtendAuthSessionResponse{
+		VerificationURI:         authInfo.VerificationURI,
+		VerificationURIComplete: authInfo.VerificationURIComplete,
+		UserCode:                authInfo.UserCode,
+		DeviceCode:              authInfo.DeviceCode,
+		ExpiresIn:               int64(authInfo.ExpiresIn),
+	}, nil
+}
+
+// WaitExtendAuthSession blocks until the user completes the SSO step
+// initiated by RequestExtendAuthSession, then forwards the resulting JWT
+// to the management server's ExtendAuthSession RPC. The returned deadline
+// is also applied locally via the engine so SubscribeStatus consumers see
+// the refreshed state.
+func (s *Server) WaitExtendAuthSession(
+	ctx context.Context,
+	req *proto.WaitExtendAuthSessionRequest,
+) (*proto.WaitExtendAuthSessionResponse, error) {
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+
+	oAuthFlow, authInfo, ok := s.extendAuthSessionFlow.Get()
+
+	s.mutex.Lock()
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+
+	if !ok || authInfo.DeviceCode != req.DeviceCode {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "invalid device code or no active extend-session flow")
+	}
+
+	// Preempt a previous WaitExtendAuthSession (e.g. when the tray
+	// notification and the about-to-expire dialog both start a flow on
+	// the same deadline). The older waiter exits via context.Canceled;
+	// the new one takes over the IdP poll.
+	s.extendAuthSessionFlow.CancelWait()
+
+	waitCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	s.extendAuthSessionFlow.SetWaitCancel(cancel)
+
+	tokenInfo, err := oAuthFlow.WaitToken(waitCtx, authInfo)
+	if err != nil {
+		if errors.Is(err, context.Canceled) {
+			return nil, gstatus.Errorf(codes.Canceled, "extend-session flow preempted")
+		}
+		return nil, gstatus.Errorf(codes.Internal, "failed to obtain JWT token: %v", err)
+	}
+
+	// Clear pending flow before talking to mgm so a retry can re-initiate.
+	s.extendAuthSessionFlow.Clear()
+
+	if connectClient == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
+	}
+	engine := connectClient.Engine()
+	if engine == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "engine is not initialised")
+	}
+
+	deadline, err := engine.ExtendAuthSession(ctx, tokenInfo.GetTokenToUse())
+	if err != nil {
+		// Log the full wrapped chain, but return only the innermost gRPC
+		// status (code + clean desc) so the UI shows the root cause, not
+		// the daemon's wrapping layers.
+		log.Errorf("management ExtendAuthSession failed: %v", err)
+		if st := innermostStatus(err); st != nil {
+			return nil, gstatus.Error(st.Code(), st.Message())
+		}
+		return nil, gstatus.Errorf(codes.Internal, "%v", err)
+	}
+
+	resp := &proto.WaitExtendAuthSessionResponse{}
+	if !deadline.IsZero() {
+		resp.SessionExpiresAt = timestamppb.New(deadline)
+	}
+	return resp, nil
+}
+
+// DismissSessionWarning forwards the user's "Dismiss" click on the
+// T-WarningLead notification down to the engine's sessionWatcher so the
+// T-FinalWarningLead fallback is suppressed for the current deadline.
+// Best-effort: when the client/engine is not yet running the call is a
+// successful no-op (the watcher has no deadline to dismiss anyway).
+func (s *Server) DismissSessionWarning(
+	_ context.Context,
+	_ *proto.DismissSessionWarningRequest,
+) (*proto.DismissSessionWarningResponse, error) {
+	s.mutex.Lock()
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+	if connectClient == nil {
+		return &proto.DismissSessionWarningResponse{}, nil
+	}
+	if engine := connectClient.Engine(); engine != nil {
+		engine.DismissSessionWarning()
+	}
+	return &proto.DismissSessionWarningResponse{}, nil
+}
+
 // ExposeService exposes a local port via the NetBird reverse proxy.
 func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.DaemonService_ExposeServiceServer) error {
 	s.mutex.Lock()
@@ -1528,14 +2366,7 @@ func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.Daemon
 	return nil
 }
 
-func isUnixRunningDesktop() bool {
-	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
-		return false
-	}
-	return os.Getenv("DESKTOP_SESSION") != "" || os.Getenv("XDG_CURRENT_DESKTOP") != ""
-}
-
-func (s *Server) runProbes(waitForProbeResult bool) {
+func (s *Server) runProbes(ctx context.Context, waitForProbeResult bool) {
 	if s.connectClient == nil {
 		return
 	}
@@ -1545,15 +2376,7 @@ func (s *Server) runProbes(waitForProbeResult bool) {
 		return
 	}
 
-	if time.Since(s.lastProbe) > probeThreshold {
-		if engine.RunHealthProbes(waitForProbeResult) {
-			s.lastProbe = time.Now()
-		}
-	} else {
-		if err := s.statusRecorder.RefreshWireGuardStats(); err != nil {
-			log.Debugf("failed to refresh WireGuard stats: %v", err)
-		}
-	}
+	s.probeThrottle.Run(ctx, engine, s.statusRecorder, waitForProbeResult)
 }
 
 // GetConfig of the daemon.
@@ -1575,11 +2398,16 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		cfgPath = profilemanager.DefaultConfigPath
 	}
 
-	cfg, err := profilemanager.GetConfig(cfgPath)
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
 	if err != nil {
 		log.Errorf("failed to get active profile config: %v", err)
 		return nil, fmt.Errorf("failed to get active profile config: %w", err)
 	}
+	// Overlay the active MDM policy so the response's MDMManagedFields
+	// list reflects what the GUI / CLI must render as read-only.
+	// profilemanager.GetConfig itself returns a Config without the
+	// overlay (Loader lives outside profilemanager).
+	cfg.ApplyMDMPolicy(s.mdmLoader.Load())
 	managementURL := cfg.ManagementURL
 	adminURL := cfg.AdminURL
 
@@ -1643,6 +2471,7 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		Mtu:                           int64(cfg.MTU),
 		DisableAutoConnect:            cfg.DisableAutoConnect,
 		ServerSSHAllowed:              *cfg.ServerSSHAllowed,
+		RemoteJobsAllowed:             util.ReturnBoolWithDefaultFalse(cfg.RemoteJobsAllowed),
 		RosenpassEnabled:              cfg.RosenpassEnabled,
 		RosenpassPermissive:           cfg.RosenpassPermissive,
 		BlockInbound:                  cfg.BlockInbound,
@@ -1682,6 +2511,8 @@ func (s *Server) AddProfile(ctx context.Context, msg *proto.AddProfileRequest) (
 		return nil, fmt.Errorf("failed to create profile: %w", err)
 	}
 
+	s.publishProfileListChanged(msg.ProfileName)
+
 	return &proto.AddProfileResponse{Id: created.ID.String()}, nil
 }
 
@@ -1708,6 +2539,8 @@ func (s *Server) RenameProfile(ctx context.Context, msg *proto.RenameProfileRequ
 		return nil, fmt.Errorf("failed to rename profile: %w", err)
 	}
 
+	s.publishProfileListChanged(msg.NewProfileName)
+
 	return &proto.RenameProfileResponse{OldProfileName: resolved.Name}, nil
 }
 
@@ -1729,8 +2562,11 @@ func (s *Server) RemoveProfile(ctx context.Context, msg *proto.RemoveProfileRequ
 		return nil, err
 	}
 
-	if err := s.logoutFromProfile(ctx, resolved); err != nil {
-		log.Warnf("failed to logout from profile %s before removal: %v", resolved.ID, err)
+	if err := s.logoutFromProfile(ctx, resolved, msg.Username); err != nil {
+		// Deregistration is best-effort here: the local profile is removed
+		// either way, so an unprivileged caller leaves the peer registered on
+		// the management server rather than being blocked from removing it.
+		log.Warnf("removing profile %s locally without deregistering it: %v", resolved.ID, err)
 	}
 
 	if err := s.profileManager.RemoveProfile(resolved.ID, msg.Username); err != nil {
@@ -1738,9 +2574,51 @@ func (s *Server) RemoveProfile(ctx context.Context, msg *proto.RemoveProfileRequ
 		return nil, fmt.Errorf("failed to remove profile: %w", err)
 	}
 
+	s.publishProfileListChanged(msg.ProfileName)
+
 	return &proto.RemoveProfileResponse{Id: resolved.ID.String()}, nil
 }
 
+// publishProfileListChanged nudges the desktop UI to refresh its profile list
+// after a CLI-driven add/remove. The daemon exposes no dedicated
+// profile-changed RPC event, and a profile add/remove doesn't move the
+// connection status, so the UI's SubscribeStatus path never fires for it (and
+// the tray's status-string guard would swallow it anyway). Instead we publish
+// a marked INFO/SYSTEM event over SubscribeEvents: the UI's dispatchSystemEvent
+// recognises the metadata "kind" marker and translates it into its internal
+// profile-changed signal that both the tray menu and the React profile views
+// already subscribe to (see proto.MetadataKindProfileListChanged, recognised in
+// client/ui/services/daemon_feed.go). userMessage is intentionally empty so this
+// stays a silent refresh signal rather than a user-facing notification.
+func (s *Server) publishProfileListChanged(profileName string) {
+	s.statusRecorder.PublishEvent(
+		proto.SystemEvent_INFO,
+		proto.SystemEvent_SYSTEM,
+		"Profile list changed",
+		"",
+		map[string]string{proto.MetadataKindKey: proto.MetadataKindProfileListChanged, proto.MetadataProfileKey: profileName},
+	)
+}
+
+// publishLogLevelChanged signals the desktop UI that the daemon log level
+// changed, so it can attach/detach its rotated gui-client.log. Like
+// publishProfileListChanged, this rides the SubscribeEvents stream as a marked
+// INFO/SYSTEM event (kind "log-level-changed", level the lowercase logrus
+// name); the UI's dispatchSystemEvent recognises the marker and routes it to
+// the logging toggle instead of an OS toast (userMessage is empty so it stays
+// a silent control signal). The "level" value matches log.Level.String()
+// (e.g. "debug", "info") so the UI can parse it directly. See
+// proto.MetadataKindLogLevelChanged, recognised in client/ui/services/daemon_feed.go.
+func (s *Server) publishLogLevelChanged(level string) {
+	s.statusRecorder.PublishEvent(
+		proto.SystemEvent_INFO,
+		proto.SystemEvent_SYSTEM,
+		"Log level changed",
+		"",
+		map[string]string{proto.MetadataKindKey: proto.MetadataKindLogLevelChanged, proto.MetadataLevelKey: level},
+	)
+}
+
 // ListProfiles lists all profiles in the daemon.
 func (s *Server) ListProfiles(ctx context.Context, msg *proto.ListProfilesRequest) (*proto.ListProfilesResponse, error) {
 	s.mutex.Lock()
@@ -1812,14 +2690,50 @@ func (s *Server) GetFeatures(ctx context.Context, msg *proto.GetFeaturesRequest)
 		DisableProfiles:       s.checkProfilesDisabled(),
 		DisableUpdateSettings: s.checkUpdateSettingsDisabled(),
 		DisableNetworks:       s.checkNetworksDisabled(),
+		DisableAdvancedView:   s.checkDisableAdvancedView(),
 	}
 
 	return features, nil
 }
 
+// WailsUIReady is a no-op the Wails UI probes at startup; merely answering it
+// (rather than returning Unimplemented) tells the UI this daemon is new enough.
+func (s *Server) WailsUIReady(context.Context, *proto.WailsUIReadyRequest) (*proto.WailsUIReadyResponse, error) {
+	return &proto.WailsUIReadyResponse{}, nil
+}
+
+// checkDisableAdvancedView reports the MDM-policy directive for the
+// upcoming UI's advanced-view section. Tristate: returns nil when no
+// MDM directive is set so the UI applies its own default; returns
+// &true / &false when MDM explicitly enforces. No CLI flag backs
+// this feature — MDM is the sole source.
+func (s *Server) checkDisableAdvancedView() *bool {
+	if s.config == nil {
+		return nil
+	}
+	if v, ok := s.config.Policy().GetBool(mdm.KeyDisableAdvancedView); ok {
+		return &v
+	}
+	return nil
+}
+
+// profileOwnerOption passes the OS account of the active profile to the connect client,
+// which reads that account's certificate store for user certificate posture checks.
+func (s *Server) profileOwnerOption() []internal.ConnectClientOption {
+	if s.profileManager == nil {
+		return nil
+	}
+	activeProf, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		log.Warnf("failed to read the active profile owner, no user certificate store is used for certificate posture: %v", err)
+		return []internal.ConnectClientOption{internal.WithUnknownProfileOwner()}
+	}
+	return []internal.ConnectClientOption{internal.WithProfileOwner(activeProf.Username)}
+}
+
 func (s *Server) connect(ctx context.Context, config *profilemanager.Config, statusRecorder *peer.Status, runningChan chan struct{}) error {
 	log.Tracef("running client connection")
-	client := internal.NewConnectClient(ctx, config, statusRecorder)
+	client := internal.NewConnectClient(ctx, config, statusRecorder, s.profileOwnerOption()...)
 	client.SetUpdateManager(s.updateManager)
 	client.SetSyncResponsePersistence(s.persistSyncResponse)
 
@@ -1961,13 +2875,100 @@ func sendTerminalNotification() error {
 	return wallCmd.Wait()
 }
 
-// persistLoginOverrides writes management URL and pre-shared key from a LoginRequest to the
-// active profile config so that subsequent reads pick them up. Empty/nil values are ignored.
-func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, managementURL string, preSharedKey *string) error {
-	if preSharedKey != nil && *preSharedKey == "" {
-		preSharedKey = nil
+// afterLoginPreCheck is a seam for tests to run a concurrent config change
+// between Login's first privilege check and the authoritative one.
+var afterLoginPreCheck func()
+
+// authorizeAndPrepareLogin makes the authoritative privilege decision for a login
+// and, when it passes, carries out every state change that decision authorizes:
+// cancelling an login already in progress, switching to the requested profile, and
+// persisting the config overrides the request carries.
+//
+// All of it happens under guardedConfigMu, which SetConfig also holds across its
+// own check and write. Login's earlier check refuses the ordinary case before any
+// of this is reached; this one exists because that check is not synchronized
+// against a concurrent privileged request that enables the SSH server, and a
+// caller refused here must not have cancelled or switched anything either.
+func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.LoginRequest, activeProf *profilemanager.ActiveProfileState) (context.Context, *profilemanager.ActiveProfileState, bool, error) {
+	if afterLoginPreCheck != nil {
+		afterLoginPreCheck()
 	}
-	if managementURL == "" && preSharedKey == nil {
+
+	s.guardedConfigMu.Lock()
+	defer s.guardedConfigMu.Unlock()
+
+	stored, err := s.storedLoginConfig(activeProf, msg)
+	if err != nil {
+		return nil, nil, false, err
+	}
+	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromLogin(msg)); err != nil {
+		return nil, nil, false, err
+	}
+
+	// The update-settings decision is re-taken here for the same reason as the
+	// privilege one: Login's earlier check ran outside this lock, so the stored
+	// config it compared against could have moved since. This one is the
+	// authoritative check, and it is the last read before persistLoginOverrides
+	// writes.
+	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, loginOverridesInput(msg)) {
+		return nil, nil, false, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
+	}
+
+	s.mutex.Lock()
+	if s.actCancel != nil {
+		s.actCancel()
+	}
+	ctx, cancel := context.WithCancel(callerCtx)
+	if md, ok := metadata.FromIncomingContext(callerCtx); ok {
+		ctx = metadata.NewOutgoingContext(ctx, md)
+	}
+	s.actCancel = cancel
+	s.mutex.Unlock()
+
+	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+		log.Warnf(errRestoreResidualState, err)
+	}
+
+	switched := false
+	if msg.ProfileName != nil {
+		switched, err = s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf)
+		if err != nil {
+			return nil, nil, false, fmt.Errorf("switch profile: %w", err)
+		}
+		if switched {
+			s.mutex.Lock()
+			s.dropPendingAuthFlows()
+			s.mutex.Unlock()
+		}
+	}
+
+	activeProf, err = s.profileManager.GetActiveProfileState()
+	if err != nil {
+		return nil, nil, false, fmt.Errorf("active profile state: %w", err)
+	}
+
+	if err := persistLoginOverrides(activeProf, msg); err != nil {
+		return nil, nil, false, fmt.Errorf("persist login overrides: %w", err)
+	}
+
+	// Provisioning under the same lock as the decision above, and next to the
+	// write it guards. getConfig would otherwise mint the identity and persist
+	// it once this returns: between its read and its write, a SetConfig that
+	// had already answered its caller would be overwritten by the config this
+	// login read before it landed.
+	if _, _, err := provisionProfileIdentity(activeProf); err != nil {
+		return nil, nil, false, err
+	}
+
+	return ctx, activeProf, switched, nil
+}
+
+// persistLoginOverrides writes the config fields a login request is allowed to
+// carry into the active profile. It shares its input builder with the
+// update-settings gate, so the gate judges exactly the fields this writes.
+func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, msg *proto.LoginRequest) error {
+	input := loginOverridesInput(msg)
+	if input.ManagementURL == "" && input.PreSharedKey == nil {
 		return nil
 	}
 
@@ -1976,13 +2977,34 @@ func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, manage
 		return fmt.Errorf("active profile file path: %w", err)
 	}
 
-	input := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
-		ManagementURL: managementURL,
-		PreSharedKey:  preSharedKey,
-	}
+	input.ConfigPath = cfgPath
 	if _, err := profilemanager.UpdateOrCreateConfig(input); err != nil {
 		return fmt.Errorf("update config: %w", err)
 	}
 	return nil
 }
+
+// logoutPeerGone reports whether a management Logout failed because the peer
+// no longer exists server-side (gRPC NotFound), walking the wrap chain since
+// the client wraps the gRPC status with fmt.Errorf.
+func logoutPeerGone(err error) bool {
+	for e := err; e != nil; e = errors.Unwrap(e) {
+		if s, ok := gstatus.FromError(e); ok && s.Code() == codes.NotFound {
+			return true
+		}
+	}
+	return false
+}
+
+// innermostStatus walks the wrap chain and returns the deepest gRPC status,
+// or nil when none is present. gstatus.FromError does not unwrap, so a status
+// wrapped with fmt.Errorf %w would otherwise be missed.
+func innermostStatus(err error) *gstatus.Status {
+	var found *gstatus.Status
+	for e := err; e != nil; e = errors.Unwrap(e) {
+		if s, ok := gstatus.FromError(e); ok {
+			found = s
+		}
+	}
+	return found
+}
diff --git a/client/server/server_connect_test.go b/client/server/server_connect_test.go
index 0c6e03a4a..28bbfccde 100644
--- a/client/server/server_connect_test.go
+++ b/client/server/server_connect_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/proto"
 )
@@ -18,6 +19,11 @@ func newTestServer() *Server {
 	return &Server{
 		rootCtx:        context.Background(),
 		statusRecorder: peer.NewRecorder(""),
+		// New always populates the SSH JWT cache and the logout and
+		// profile-switch paths call into it unconditionally, so a Server
+		// assembled field by field has to populate it too.
+		jwtCache:              newJWTCache(),
+		extendAuthSessionFlow: auth.NewPendingFlow(),
 	}
 }
 
diff --git a/client/server/server_jwt_test.go b/client/server/server_jwt_test.go
new file mode 100644
index 000000000..3fec5598a
--- /dev/null
+++ b/client/server/server_jwt_test.go
@@ -0,0 +1,188 @@
+package server
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/auth"
+	"github.com/netbirdio/netbird/client/internal/localmetrics"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// These cover the RPC side of the cache: the cache itself is exercised in
+// jwt_cache_test.go, but a correct cache buys nothing if the handlers around it
+// consult the wrong identity or forget to clear it.
+
+func TestCachedJWT_ServesTheOwner(t *testing.T) {
+	s := newTestServer()
+	owner := unprivilegedIdentity()
+	s.jwtCache.store("token", owner, testTTL, s.jwtCache.currentGeneration())
+
+	got, found := s.cachedJWT(ctxWithIdentity(owner))
+
+	require.True(t, found, "the identity that obtained the token must get it back")
+	assert.Equal(t, "token", got)
+}
+
+func TestCachedJWT_RefusesAnotherCaller(t *testing.T) {
+	s := newTestServer()
+	s.jwtCache.store("token", unprivilegedIdentity(), testTTL, s.jwtCache.currentGeneration())
+
+	got, found := s.cachedJWT(ctxWithIdentity(privilegedIdentity()))
+
+	assert.False(t, found, "a caller that did not obtain the token must get a miss")
+	assert.Empty(t, got)
+}
+
+// A control channel that carries no caller identity — a TCP daemon socket, or a
+// platform with no peer-credential primitive — cannot tell one local user from
+// another, so cachedJWT must fail closed there.
+func TestCachedJWT_WithoutCallerIdentity(t *testing.T) {
+	s := newTestServer()
+	s.jwtCache.store("token", unprivilegedIdentity(), testTTL, s.jwtCache.currentGeneration())
+
+	got, found := s.cachedJWT(context.Background())
+
+	assert.False(t, found)
+	assert.Empty(t, got)
+}
+
+// profileFixture points the profile globals at a temp dir holding a single
+// default profile, which is the one ActiveProfileState.FilePath resolves
+// without consulting the current OS user.
+func profileFixture(t *testing.T) string {
+	t.Helper()
+
+	dir := t.TempDir()
+	defaultConfig := filepath.Join(dir, "default.json")
+	require.NoError(t, os.WriteFile(defaultConfig, []byte("{}"), 0o600))
+
+	origDir := profilemanager.DefaultConfigPathDir
+	origDefault := profilemanager.DefaultConfigPath
+	origState := profilemanager.ActiveProfileStatePath
+	origOverride := profilemanager.ConfigDirOverride
+
+	profilemanager.DefaultConfigPathDir = dir
+	profilemanager.DefaultConfigPath = defaultConfig
+	profilemanager.ActiveProfileStatePath = filepath.Join(dir, "active_profile.json")
+	profilemanager.ConfigDirOverride = dir
+
+	t.Cleanup(func() {
+		profilemanager.DefaultConfigPathDir = origDir
+		profilemanager.DefaultConfigPath = origDefault
+		profilemanager.ActiveProfileStatePath = origState
+		profilemanager.ConfigDirOverride = origOverride
+	})
+
+	return defaultConfig
+}
+
+// A profile carries its own NetBird account, so a token obtained under the
+// previous one must not survive the switch even for the local user who
+// obtained it.
+func TestSwitchProfile_ClearsJWTCache(t *testing.T) {
+	defaultConfig := profileFixture(t)
+
+	// localmetrics.NewManager runs until its context is done, so the manager
+	// must not outlive the test.
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	s := newTestServer()
+	s.profileManager = profilemanager.NewServiceManager(defaultConfig)
+	s.localMetrics = localmetrics.NewManager(ctx, s.statusRecorder, nil)
+
+	// A second profile to move to, so the request goes through
+	// switchProfileIfNeeded rather than the no-op path a nil request takes.
+	const target = "second"
+	username := "tester"
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    filepath.Join(profilemanager.DefaultConfigPathDir, target+".json"),
+		ManagementURL: "https://api.netbird.io:443",
+	})
+	require.NoError(t, err)
+
+	owner := unprivilegedIdentity()
+	s.jwtCache.store("token", owner, testTTL, s.jwtCache.currentGeneration())
+
+	name := target
+	_, err = s.SwitchProfile(ctx, &proto.SwitchProfileRequest{ProfileName: &name, Username: &username})
+	require.NoError(t, err)
+
+	active, err := s.profileManager.GetActiveProfileState()
+	require.NoError(t, err)
+	require.Equal(t, profilemanager.ID(target), active.ID, "the profile must actually have changed")
+
+	_, found := s.jwtCache.get(owner)
+	assert.False(t, found, "switching profile must drop the cached SSH JWT")
+}
+
+// Down ends the connection, not the session: the peer stays enrolled and the
+// token still belongs to the same NetBird identity, so `down` followed by `up`
+// must not cost the owner a fresh device-code flow.
+//
+// The logout handlers do call cleanupConnection, and SwitchProfile does not;
+// what they have in common is that each clears the cache itself, right after,
+// so tearing the connection down is no longer what decides the token's fate.
+func TestCleanupConnection_KeepsJWTCache(t *testing.T) {
+	s := newTestServer()
+	_, cancel := context.WithCancel(context.Background())
+	s.actCancel = cancel
+
+	owner := unprivilegedIdentity()
+	s.jwtCache.store("token", owner, testTTL, s.jwtCache.currentGeneration())
+
+	require.NoError(t, s.cleanupConnection())
+
+	got, found := s.jwtCache.get(owner)
+	require.True(t, found, "going down must not drop the cached SSH JWT")
+	assert.Equal(t, "token", got)
+}
+
+// fakeOAuthFlow stands in for the IdP round trip so a test can drive
+// WaitJWTToken without a real device-code flow.
+type fakeOAuthFlow struct {
+	token string
+}
+
+func (f *fakeOAuthFlow) RequestAuthInfo(context.Context) (auth.AuthFlowInfo, error) {
+	return auth.AuthFlowInfo{DeviceCode: "device-code"}, nil
+}
+
+func (f *fakeOAuthFlow) WaitToken(context.Context, auth.AuthFlowInfo) (auth.TokenInfo, error) {
+	return auth.TokenInfo{AccessToken: f.token}, nil
+}
+
+func (f *fakeOAuthFlow) GetClientID(context.Context) string { return "client-id" }
+
+// The flow outlives a profile switch, because SwitchProfile does not reset
+// s.oauthAuthFlow. A switch between RequestJWTAuth and the IdP answering must
+// still keep the token out of the cache the new profile uses, and the
+// generation the flow carries is what decides it: reading the cache's own
+// generation at store time would already be the new one.
+func TestWaitJWTToken_DropsTokenFromASessionThatEndedBeforeTheWait(t *testing.T) {
+	s := newTestServer()
+	owner := unprivilegedIdentity()
+	ttl := int(testTTL.Seconds())
+	s.config = &profilemanager.Config{SSHJWTCacheTTL: &ttl}
+
+	// RequestJWTAuth ran under the previous session and recorded its generation.
+	s.oauthAuthFlow.flow = &fakeOAuthFlow{token: "token-from-the-old-session"}
+	s.oauthAuthFlow.info = auth.AuthFlowInfo{DeviceCode: "device-code"}
+	s.oauthAuthFlow.cacheGeneration = s.jwtCache.currentGeneration()
+
+	// A profile switch or a logout lands before the caller reaches WaitJWTToken.
+	s.jwtCache.clear()
+
+	_, err := s.WaitJWTToken(ctxWithIdentity(owner), &proto.WaitJWTTokenRequest{DeviceCode: "device-code"})
+	require.NoError(t, err)
+
+	_, found := s.jwtCache.get(owner)
+	assert.False(t, found, "a token whose flow started under the previous session must not be cached")
+}
diff --git a/client/server/server_privileged_test.go b/client/server/server_privileged_test.go
index 225cf6494..bea2e8568 100644
--- a/client/server/server_privileged_test.go
+++ b/client/server/server_privileged_test.go
@@ -6,12 +6,13 @@ import (
 	"context"
 	"net"
 	"os/user"
+	"path/filepath"
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
 
@@ -35,7 +36,6 @@ import (
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -59,9 +59,25 @@ var (
 	}
 )
 
-// TestConnectWithRetryRuns checks that the connectWithRetry function runs and runs the retries according to the times specified via environment variables
-// we will use a management server started via to simulate the server and capture the number of retries
-func TestConnectWithRetryRuns(t *testing.T) {
+// TestConnectStopsRetryOnPermissionDenied verifies connectWithRetryRuns stops after a single login
+// attempt on PermissionDenied, despite the fast retry config that would otherwise drive several.
+func TestConnectStopsRetryOnPermissionDenied(t *testing.T) {
+	// Redirect profile paths to a temp dir so the test does not need root.
+	tempDir := t.TempDir()
+	origDefaultProfileDir := profilemanager.DefaultConfigPathDir
+	origActiveProfileStatePath := profilemanager.ActiveProfileStatePath
+	origDefaultConfigPath := profilemanager.DefaultConfigPath
+	profilemanager.ConfigDirOverride = tempDir
+	profilemanager.DefaultConfigPathDir = tempDir
+	profilemanager.ActiveProfileStatePath = filepath.Join(tempDir, "active_profile.json")
+	profilemanager.DefaultConfigPath = filepath.Join(tempDir, "default.json")
+	t.Cleanup(func() {
+		profilemanager.DefaultConfigPathDir = origDefaultProfileDir
+		profilemanager.ActiveProfileStatePath = origActiveProfileStatePath
+		profilemanager.DefaultConfigPath = origDefaultConfigPath
+		profilemanager.ConfigDirOverride = ""
+	})
+
 	// start the signal server
 	_, signalAddr, err := startSignal(t)
 	if err != nil {
@@ -113,8 +129,8 @@ func TestConnectWithRetryRuns(t *testing.T) {
 	t.Setenv(retryMultiplierVar, "1")
 
 	s.connectWithRetryRuns(ctx, config, s.statusRecorder, nil, nil)
-	if counter < 3 {
-		t.Fatalf("expected counter > 2, got %d", counter)
+	if counter != 1 {
+		t.Fatalf("expected exactly 1 login attempt (PermissionDenied must stop the retry loop), got %d", counter)
 	}
 }
 
@@ -183,8 +199,8 @@ func startManagement(t *testing.T, signalAddr string, counter *int) (*grpc.Serve
 
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
 	peersUpdateManager := update_channel.NewPeersUpdateManager(metrics)
-	networkMapController := controller.NewController(context.Background(), store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config)
-	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	networkMapController := controller.NewController(context.Background(), store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", manager.NewEphemeralManager(store, peersManager), config, nil)
+	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {
 		return nil, "", err
 	}
diff --git a/client/server/setconfig_mdm_test.go b/client/server/setconfig_mdm_test.go
index 9818f9fdf..d174dc47b 100644
--- a/client/server/setconfig_mdm_test.go
+++ b/client/server/setconfig_mdm_test.go
@@ -16,14 +16,40 @@ import (
 	"github.com/netbirdio/netbird/client/proto"
 )
 
-// withMDMPolicy temporarily overrides the server-package loadMDMPolicy hook
-// so SetConfig observes the supplied Policy. Restores the original loader
-// at test cleanup.
-func withMDMPolicy(t *testing.T, policy *mdm.Policy) {
+// fakeMDMFetcher implements mdm.PolicyFetcher returning a pre-set
+// policy map. Tests build one per Server instance to inject a
+// scripted MDM overlay via a Loader rather than via package-level state.
+type fakeMDMFetcher struct{ values map[string]any }
+
+func (f *fakeMDMFetcher) Fetch() map[string]any { return f.values }
+
+// withMDMPolicy installs an mdm.Loader on the given Server whose
+// loadPlatform returns the supplied Policy's underlying values. Use
+// after setupServerWithProfile to inject the scripted policy the
+// SetConfig / Login MDM gates will observe.
+func withMDMPolicy(t *testing.T, s *Server, policy *mdm.Policy) {
 	t.Helper()
-	prev := loadMDMPolicy
-	loadMDMPolicy = func() *mdm.Policy { return policy }
-	t.Cleanup(func() { loadMDMPolicy = prev })
+	values := map[string]any{}
+	if policy != nil {
+		for _, k := range policy.ManagedKeys() {
+			if v, ok := policy.GetString(k); ok {
+				values[k] = v
+				continue
+			}
+			if v, ok := policy.GetInt(k); ok {
+				values[k] = v
+				continue
+			}
+			if v, ok := policy.GetBool(k); ok {
+				values[k] = v
+				continue
+			}
+			if v, ok := policy.GetStringSlice(k); ok {
+				values[k] = v
+			}
+		}
+	}
+	s.mdmLoader = mdm.NewLoader(&fakeMDMFetcher{values: values})
 }
 
 // setupServerWithProfile mirrors the boilerplate of TestSetConfig_AllFieldsSaved:
@@ -66,7 +92,11 @@ func setupServerWithProfile(t *testing.T) (s *Server, ctx context.Context, profN
 		Username: currUser.Username,
 	}))
 
-	ctx = context.Background()
+	// The privileged-change gate reads the caller's kernel identity from the
+	// context, which a real caller gets from the daemon's transport credentials.
+	// This test drives the handler directly, so it stands in for a root caller;
+	// without an identity the gate would (correctly) refuse the SSH fields.
+	ctx = privilegedTestCtx()
 	s = New(ctx, "console", "", false, false, false, false)
 	return s, ctx, profName, currUser.Username, cfgPath
 }
@@ -89,12 +119,11 @@ func extractViolation(t *testing.T, err error) *proto.MDMManagedFieldsViolation
 }
 
 func TestSetConfig_MDMReject_SingleField(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "https://mdm.example.com:443",
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:   profName,
 		Username:      username,
@@ -106,14 +135,13 @@ func TestSetConfig_MDMReject_SingleField(t *testing.T) {
 }
 
 func TestSetConfig_MDMReject_MultipleFields(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL:    "https://mdm.example.com:443",
 		mdm.KeyBlockInbound:     true,
 		mdm.KeyRosenpassEnabled: true,
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	blockInbound := false
 	rosenpassEnabled := false
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
@@ -132,17 +160,123 @@ func TestSetConfig_MDMReject_MultipleFields(t *testing.T) {
 	}, v.GetFields())
 }
 
+func TestSetConfig_MDMReject_LocalMetrics(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
+		mdm.KeyEnableLocalMetrics:  true,
+		mdm.KeyLocalMetricsAddress: "127.0.0.1:9191",
+	}))
+
+	enabled := false
+	addr := "0.0.0.0:9999"
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:         profName,
+		Username:            username,
+		EnableLocalMetrics:  &enabled,
+		LocalMetricsAddress: &addr,
+	})
+
+	v := extractViolation(t, err)
+	assert.ElementsMatch(t, []string{
+		mdm.KeyEnableLocalMetrics,
+		mdm.KeyLocalMetricsAddress,
+	}, v.GetFields())
+}
+
+// An explicitly empty address still changes the effective listen address
+// (the manager falls back to the default), so presence must be honored
+// rather than collapsed to "field not set".
+func TestSetConfig_MDMReject_LocalMetricsEmptyAddress(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
+		mdm.KeyLocalMetricsAddress: "127.0.0.1:9999",
+	}))
+
+	addr := ""
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:         profName,
+		Username:            username,
+		LocalMetricsAddress: &addr,
+	})
+
+	v := extractViolation(t, err)
+	assert.ElementsMatch(t, []string{mdm.KeyLocalMetricsAddress}, v.GetFields())
+}
+
+func TestSetConfig_MDMReject_EmptyPreSharedKey(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
+		mdm.KeyPreSharedKey: "mdm-enforced-psk",
+	}))
+
+	psk := ""
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:          profName,
+		Username:             username,
+		OptionalPreSharedKey: &psk,
+	})
+
+	v := extractViolation(t, err)
+	assert.ElementsMatch(t, []string{mdm.KeyPreSharedKey}, v.GetFields())
+}
+
+func TestSetConfig_MDMAllow_PreSharedKeySentinelEcho(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
+		mdm.KeyPreSharedKey: "mdm-enforced-psk",
+	}))
+
+	psk := mdm.PreSharedKeyRedactedSentinel
+	resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:          profName,
+		Username:             username,
+		OptionalPreSharedKey: &psk,
+	})
+
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+}
+
+func TestLoginRequestMDMConflicts_PreSharedKey(t *testing.T) {
+	policy := mdm.NewPolicy(map[string]any{
+		mdm.KeyPreSharedKey: "mdm-enforced-psk",
+	})
+	empty := ""
+	sentinel := mdm.PreSharedKeyRedactedSentinel
+	same := "mdm-enforced-psk"
+	other := "user-psk"
+
+	tests := []struct {
+		name string
+		msg  *proto.LoginRequest
+		want []string
+	}{
+		{name: "unset", msg: &proto.LoginRequest{}, want: nil},
+		{name: "optional empty", msg: &proto.LoginRequest{OptionalPreSharedKey: &empty}, want: []string{mdm.KeyPreSharedKey}},
+		{name: "optional sentinel echo", msg: &proto.LoginRequest{OptionalPreSharedKey: &sentinel}, want: nil},
+		{name: "optional same value", msg: &proto.LoginRequest{OptionalPreSharedKey: &same}, want: nil},
+		{name: "optional divergent", msg: &proto.LoginRequest{OptionalPreSharedKey: &other}, want: []string{mdm.KeyPreSharedKey}},
+		{name: "legacy empty is unset", msg: &proto.LoginRequest{PreSharedKey: ""}, want: nil},                         //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
+		{name: "legacy sentinel echo", msg: &proto.LoginRequest{PreSharedKey: sentinel}, want: nil},                    //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
+		{name: "legacy divergent", msg: &proto.LoginRequest{PreSharedKey: other}, want: []string{mdm.KeyPreSharedKey}}, //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, loginRequestMDMConflicts(tc.msg, policy))
+		})
+	}
+}
+
 func TestSetConfig_MDMReject_AllOrNothing(t *testing.T) {
 	// MDM enforces ManagementURL only; user request touches both the
 	// enforced field AND a non-enforced field (RosenpassEnabled).
 	// The whole request must be rejected — non-conflicting fields are not
 	// applied either.
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "https://mdm.example.com:443",
 	}))
 
-	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
-
 	rosenpassEnabled := true
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:      profName,
@@ -156,7 +290,7 @@ func TestSetConfig_MDMReject_AllOrNothing(t *testing.T) {
 
 	// Confirm RosenpassEnabled was NOT applied even though it was not
 	// in the conflict list: the request was rejected as a whole.
-	reloaded, err := profilemanager.GetConfig(cfgPath)
+	reloaded, err := profilemanager.GetExistingConfig(cfgPath)
 	require.NoError(t, err)
 	assert.False(t, reloaded.RosenpassEnabled, "non-conflicting field must not be applied when request is rejected")
 }
@@ -164,12 +298,11 @@ func TestSetConfig_MDMReject_AllOrNothing(t *testing.T) {
 func TestSetConfig_MDMAllow_NonManagedFields(t *testing.T) {
 	// MDM enforces ManagementURL but the user only writes RosenpassEnabled.
 	// Request must succeed.
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "https://mdm.example.com:443",
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	rosenpassEnabled := true
 	resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:      profName,
@@ -181,11 +314,46 @@ func TestSetConfig_MDMAllow_NonManagedFields(t *testing.T) {
 	require.NotNil(t, resp)
 }
 
+// TestSetConfig_MDMAllow_ManagementURLPortNormalized covers the
+// regression from discussion #6483: MDM URL without explicit port vs
+// UI echo with the parseURL-appended default port must be treated as
+// a no-op echo, not a conflict.
+func TestSetConfig_MDMAllow_ManagementURLPortNormalized(t *testing.T) {
+	tests := []struct {
+		name      string
+		mdmURL    string
+		submitURL string
+	}{
+		{"policy_no_port_submit_with_443", "https://netbird.corp.example", "https://netbird.corp.example:443"},
+		{"policy_with_443_submit_no_port", "https://netbird.corp.example:443", "https://netbird.corp.example"},
+		{"http_policy_no_port_submit_with_80", "http://netbird.corp.example", "http://netbird.corp.example:80"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			s, ctx, profName, username, _ := setupServerWithProfile(t)
+			withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
+				mdm.KeyManagementURL: tc.mdmURL,
+			}))
+
+			rosenpassEnabled := true
+			resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+				ProfileName:      profName,
+				Username:         username,
+				ManagementUrl:    tc.submitURL,
+				RosenpassEnabled: &rosenpassEnabled,
+			})
+
+			require.NoError(t, err, "port-normalized URL echo must not trip MDM conflict gate")
+			require.NotNil(t, resp)
+		})
+	}
+}
+
 func TestSetConfig_MDMEmpty_NoEnforcement(t *testing.T) {
 	// No MDM policy active: any field can be written.
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-
 	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(nil))
 
 	resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:   profName,
diff --git a/client/server/setconfig_test.go b/client/server/setconfig_test.go
index 0e55257a9..d7f7b2bd5 100644
--- a/client/server/setconfig_test.go
+++ b/client/server/setconfig_test.go
@@ -1,7 +1,6 @@
 package server
 
 import (
-	"context"
 	"os/user"
 	"path/filepath"
 	"reflect"
@@ -52,12 +51,17 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	ctx := context.Background()
+	// The privileged-change gate reads the caller's kernel identity from the
+	// context, which a real caller gets from the daemon's transport credentials.
+	// This test drives the handler directly, so it stands in for a root caller;
+	// without an identity the gate would (correctly) refuse the SSH fields.
+	ctx := privilegedTestCtx()
 	s := New(ctx, "console", "", false, false, false, false)
 
 	rosenpassEnabled := true
 	rosenpassPermissive := true
 	serverSSHAllowed := true
+	remoteJobsAllowed := true
 	interfaceName := "utun100"
 	wireguardPort := int64(51820)
 	preSharedKey := "test-psk"
@@ -73,6 +77,8 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	disableIPv6 := true
 	mtu := int64(1280)
 	sshJWTCacheTTL := int32(300)
+	enableLocalMetrics := true
+	localMetricsAddress := "127.0.0.1:9292"
 
 	req := &proto.SetConfigRequest{
 		ProfileName:          profName,
@@ -82,6 +88,7 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 		RosenpassEnabled:     &rosenpassEnabled,
 		RosenpassPermissive:  &rosenpassPermissive,
 		ServerSSHAllowed:     &serverSSHAllowed,
+		RemoteJobsAllowed:    &remoteJobsAllowed,
 		InterfaceName:        &interfaceName,
 		WireguardPort:        &wireguardPort,
 		OptionalPreSharedKey: &preSharedKey,
@@ -104,6 +111,8 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 		DnsRouteInterval:     durationpb.New(2 * time.Minute),
 		Mtu:                  &mtu,
 		SshJWTCacheTTL:       &sshJWTCacheTTL,
+		EnableLocalMetrics:   &enableLocalMetrics,
+		LocalMetricsAddress:  &localMetricsAddress,
 	}
 
 	_, err = s.SetConfig(ctx, req)
@@ -116,7 +125,7 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	cfgPath, err := profState.FilePath()
 	require.NoError(t, err)
 
-	cfg, err := profilemanager.GetConfig(cfgPath)
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
 	require.NoError(t, err)
 
 	require.Equal(t, "https://new-api.netbird.io:443", cfg.ManagementURL.String())
@@ -125,6 +134,8 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.Equal(t, rosenpassPermissive, cfg.RosenpassPermissive)
 	require.NotNil(t, cfg.ServerSSHAllowed)
 	require.Equal(t, serverSSHAllowed, *cfg.ServerSSHAllowed)
+	require.NotNil(t, cfg.RemoteJobsAllowed)
+	require.Equal(t, remoteJobsAllowed, *cfg.RemoteJobsAllowed)
 	require.Equal(t, interfaceName, cfg.WgIface)
 	require.Equal(t, int(wireguardPort), cfg.WgPort)
 	require.Equal(t, preSharedKey, cfg.PreSharedKey)
@@ -150,6 +161,8 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.Equal(t, uint16(mtu), cfg.MTU)
 	require.NotNil(t, cfg.SSHJWTCacheTTL)
 	require.Equal(t, int(sshJWTCacheTTL), *cfg.SSHJWTCacheTTL)
+	require.Equal(t, enableLocalMetrics, cfg.LocalMetricsEnabled)
+	require.Equal(t, localMetricsAddress, cfg.LocalMetricsAddress)
 
 	verifyAllFieldsCovered(t, req)
 }
@@ -177,6 +190,7 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 		"RosenpassEnabled":              true,
 		"RosenpassPermissive":           true,
 		"ServerSSHAllowed":              true,
+		"RemoteJobsAllowed":             true,
 		"InterfaceName":                 true,
 		"WireguardPort":                 true,
 		"OptionalPreSharedKey":          true,
@@ -202,6 +216,8 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 		"EnableSSHRemotePortForwarding": true,
 		"DisableSSHAuth":                true,
 		"SshJWTCacheTTL":                true,
+		"EnableLocalMetrics":            true,
+		"LocalMetricsAddress":           true,
 	}
 
 	val := reflect.ValueOf(req).Elem()
@@ -237,6 +253,7 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 		"enable-rosenpass":                  "RosenpassEnabled",
 		"rosenpass-permissive":              "RosenpassPermissive",
 		"allow-server-ssh":                  "ServerSSHAllowed",
+		"allow-remote-jobs":                 "RemoteJobsAllowed",
 		"interface-name":                    "InterfaceName",
 		"wireguard-port":                    "WireguardPort",
 		"preshared-key":                     "OptionalPreSharedKey",
@@ -261,6 +278,8 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 		"enable-ssh-remote-port-forwarding": "EnableSSHRemotePortForwarding",
 		"disable-ssh-auth":                  "DisableSSHAuth",
 		"ssh-jwt-cache-ttl":                 "SshJWTCacheTTL",
+		"enable-local-metrics":              "EnableLocalMetrics",
+		"local-metrics-address":             "LocalMetricsAddress",
 	}
 
 	// SetConfigRequest fields that don't have CLI flags (settable only via UI or other means).
diff --git a/client/server/ssh_gate.go b/client/server/ssh_gate.go
new file mode 100644
index 000000000..40d66b7a5
--- /dev/null
+++ b/client/server/ssh_gate.go
@@ -0,0 +1,335 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"runtime"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/localmetrics"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
+)
+
+// The daemon runs as root/LocalSystem, so a handful of config changes cross the
+// user-to-root boundary and are restricted to privileged callers:
+//
+//   - Enabling SSH root login, or disabling SSH authentication, turns the
+//     daemon's SSH server into a root (or unauthenticated) shell.
+//   - Enabling the SSH server at all is what makes the above reachable, and a
+//     profile the caller owns is not a privilege they hold.
+//   - While the SSH server is enabled, repointing the profile at another
+//     management identity hands SSH authorization decisions, including which
+//     keys and users are accepted, to whoever controls that identity. Changing
+//     the management URL and deregistering the peer are both ways to do that.
+//   - Binding the local metrics endpoint to a non-loopback address publishes
+//     peer names and connectivity state to the network without authentication.
+//
+// Everything else stays unauthenticated, so this is not an authorization model:
+// it only refuses the changes that would let a local user become root. A caller
+// whose identity cannot be established is refused as well.
+
+// privilegedConfigChange is the subset of a config request that crosses the
+// user-to-root boundary. Fields are nil or empty when the request leaves them
+// untouched.
+type privilegedConfigChange struct {
+	managementURL       string
+	serverSSHAllowed    *bool
+	remoteJobsAllowed   *bool
+	enableSSHRoot       *bool
+	disableSSHAuth      *bool
+	enableLocalMetrics  *bool
+	localMetricsAddress *string
+}
+
+func privilegedChangeFromSetConfig(msg *proto.SetConfigRequest) privilegedConfigChange {
+	return privilegedConfigChange{
+		managementURL:       msg.GetManagementUrl(),
+		serverSSHAllowed:    msg.ServerSSHAllowed,
+		remoteJobsAllowed:   msg.RemoteJobsAllowed,
+		enableSSHRoot:       msg.EnableSSHRoot,
+		disableSSHAuth:      msg.DisableSSHAuth,
+		enableLocalMetrics:  msg.EnableLocalMetrics,
+		localMetricsAddress: msg.LocalMetricsAddress,
+	}
+}
+
+func privilegedChangeFromLogin(msg *proto.LoginRequest) privilegedConfigChange {
+	return privilegedConfigChange{
+		managementURL:       msg.GetManagementUrl(),
+		serverSSHAllowed:    msg.ServerSSHAllowed,
+		remoteJobsAllowed:   msg.RemoteJobsAllowed,
+		enableSSHRoot:       msg.EnableSSHRoot,
+		disableSSHAuth:      msg.DisableSSHAuth,
+		enableLocalMetrics:  msg.EnableLocalMetrics,
+		localMetricsAddress: msg.LocalMetricsAddress,
+	}
+}
+
+// requirePrivilegeForConfigChange refuses the privileged parts of a config
+// change when the caller is not root/administrator. stored is the profile's
+// current config, or nil when it has none yet.
+//
+// Each check compares against the stored value so that a request restating a
+// value it does not change is never refused: a UI that submits the whole
+// settings form must not start failing once an administrator has enabled SSH.
+func requirePrivilegeForConfigChange(ctx context.Context, stored *profilemanager.Config, change privilegedConfigChange) error {
+	if enables(storedFlag(stored, func(c *profilemanager.Config) *bool { return c.EnableSSHRoot }), change.enableSSHRoot) {
+		return denyPrivileged(ctx, "enabling SSH root login", ipcauth.UpCommand("--enable-ssh-root"))
+	}
+
+	if enables(storedFlag(stored, func(c *profilemanager.Config) *bool { return c.DisableSSHAuth }), change.disableSSHAuth) {
+		return denyPrivileged(ctx, "disabling SSH authentication", ipcauth.UpCommand("--disable-ssh-auth"))
+	}
+
+	if enables(sshServerCurrentlyAllowed(stored), change.serverSSHAllowed) {
+		return denyPrivileged(ctx, "enabling the NetBird SSH server", ipcauth.UpCommand("--allow-server-ssh"))
+	}
+
+	// Enabling remote jobs lets the management server run jobs (e.g. debug
+	// bundles) on this host, so turning it on crosses the user-to-root
+	// boundary the same way enabling the SSH server does. The stored value
+	// defaults to off (nil = off), so a legacy config is correctly seen as
+	// off and turning it on requires privilege.
+	if enables(storedFlag(stored, func(c *profilemanager.Config) *bool { return c.RemoteJobsAllowed }), change.remoteJobsAllowed) {
+		return denyPrivileged(ctx, "enabling remote jobs", ipcauth.UpCommand("--allow-remote-jobs"))
+	}
+
+	if addr, exposes := exposesLocalMetrics(stored, change); exposes {
+		return denyPrivileged(ctx,
+			"exposing the local metrics endpoint on a non-loopback address",
+			ipcauth.UpCommand("--enable-local-metrics --local-metrics-address "+addr))
+	}
+
+	// Only guard the management binding while the SSH server is enabled: that is
+	// when the management identity decides who may open a shell here.
+	if !sshServerEnabled(stored) {
+		return nil
+	}
+
+	if change.managementURL != "" && !sameManagementURL(stored.ManagementURL, change.managementURL) {
+		return denyPrivileged(ctx,
+			"changing the management URL while the NetBird SSH server is enabled",
+			ipcauth.UpCommand("-m "+change.managementURL))
+	}
+
+	return nil
+}
+
+// requirePrivilegeForDeregistration refuses to deregister the peer from the
+// management server when the caller is not privileged and the profile has the
+// SSH server enabled. Deregistering frees the peer's key to be registered
+// against another management identity, which is the same handover the
+// management URL check refuses.
+//
+// Callers that treat deregistration as best-effort (profile removal) continue
+// without it; callers that were asked to deregister surface the error.
+func requirePrivilegeForDeregistration(ctx context.Context, cfg *profilemanager.Config) error {
+	if !sshServerEnabled(cfg) {
+		return nil
+	}
+
+	return denyPrivileged(ctx,
+		"deregistering this peer while the NetBird SSH server is enabled",
+		ipcauth.ElevatedCommand("netbird logout"))
+}
+
+// denyPrivileged returns nil when the caller is privileged, and otherwise a
+// PermissionDenied whose message names the action and the command that performs
+// it with the privileges it needs. The same summary and command ride along as an
+// ErrorInfo detail so the CLI and the UI can present them without parsing text.
+//
+// action reads as the subject of a sentence ("enabling SSH root login"), and
+// command is the equivalent command, already elevated for the platform.
+func denyPrivileged(ctx context.Context, action, command string) error {
+	id, ok := ipcauth.CallerIdentity(ctx)
+	if !ok {
+		log.Warnf("denying %s: the caller's identity cannot be verified on this control channel", action)
+		return privilegeError(unidentifiedSummary(action), reinstallCommand())
+	}
+
+	if ipcauth.IsPrivilegedCaller(id) {
+		log.Infof("allowing %s for privileged caller %s", action, id)
+		return nil
+	}
+
+	log.Warnf("denying %s for unprivileged caller %s", action, id)
+	actor, command := requiredActor(command)
+	return privilegeError(privilegeSummary(action, actor), command)
+}
+
+// requiredActor names who may perform the operation and adjusts the command to
+// match. A daemon that is not itself privileged delegates to its own identity, so
+// telling that host's user to become root is wrong twice over: root is not what the
+// daemon checks for, and a rootless container has neither root nor sudo.
+func requiredActor(command string) (string, string) {
+	self, delegates := ipcauth.SelfDelegatesTo()
+	if !delegates {
+		return ipcauth.PrivilegedActor(), command
+	}
+	return fmt.Sprintf("the user the daemon runs as (%s)", self), strings.ReplaceAll(command, "sudo ", "")
+}
+
+// privilegeError builds the PermissionDenied carrying summary and command.
+func privilegeError(summary, command string) error {
+	st := gstatus.New(codes.PermissionDenied, fmt.Sprintf("%s\n\n%s", summary, command))
+
+	detailed, err := st.WithDetails(&errdetails.ErrorInfo{
+		Reason: ipcauth.ErrorReasonPrivilegeRequired,
+		Domain: ipcauth.ErrorDomain,
+		Metadata: map[string]string{
+			ipcauth.ErrorMetaSummary: summary,
+			ipcauth.ErrorMetaCommand: command,
+		},
+	})
+	if err != nil {
+		log.Debugf("attach privilege error detail: %v", err)
+		return st.Err()
+	}
+	return detailed.Err()
+}
+
+// privilegeSummary states what is refused and what it needs, in one sentence
+// that reads the same in a dialog and in a terminal.
+func privilegeSummary(action, actor string) string {
+	return fmt.Sprintf("%s requires %s.", capitalize(action), actor)
+}
+
+// unidentifiedSummary covers a control channel that carries no caller identity.
+// Elevating does not help there, so it points at the daemon's socket instead.
+func unidentifiedSummary(action string) string {
+	return fmt.Sprintf("%s requires %s, and the daemon cannot verify who is calling over its current socket. "+
+		"Reinstall the service on a socket that carries the caller's identity.", capitalize(action), ipcauth.PrivilegedActor())
+}
+
+// reinstallCommand is the command that moves the daemon onto a socket whose
+// callers can be identified.
+func reinstallCommand() string {
+	if runtime.GOOS == "windows" {
+		return fmt.Sprintf("netbird service install --daemon-addr %s", daemonaddr.WindowsPipeAddr)
+	}
+	return "sudo netbird service install --daemon-addr unix:///var/run/netbird.sock"
+}
+
+func capitalize(s string) string {
+	if s == "" {
+		return s
+	}
+	return strings.ToUpper(s[:1]) + s[1:]
+}
+
+// enables reports whether requested turns a flag on that is currently off. A
+// request that restates the stored value, or turns the flag off, is not a
+// privileged change.
+func enables(stored, requested *bool) bool {
+	if requested == nil || !*requested {
+		return false
+	}
+	return stored == nil || !*stored
+}
+
+// storedFlag reads a flag from the stored config, tolerating a config that does
+// not exist yet.
+func storedFlag(cfg *profilemanager.Config, get func(*profilemanager.Config) *bool) *bool {
+	if cfg == nil {
+		return nil
+	}
+	return get(cfg)
+}
+
+// sshServerEnabled reports whether the profile currently runs the SSH server.
+//
+// A nil flag means ON, matching what the engine does with the same config
+// (util.ReturnBoolWithDefaultTrue in internal/connect.go, kept for configs written
+// before the flag existed). Reading it as OFF here would open the management-URL
+// and deregistration guards on exactly those legacy hosts, whose SSH server is
+// running. Configs loaded through profilemanager have already been materialised by
+// apply(), so this is the same answer by a route that does not depend on that.
+func sshServerEnabled(cfg *profilemanager.Config) bool {
+	if cfg == nil {
+		return false
+	}
+	return util.ReturnBoolWithDefaultTrue(cfg.ServerSSHAllowed)
+}
+
+// sshServerCurrentlyAllowed is the value an enable request is compared against. It
+// shares sshServerEnabled's nil-means-on default, so restating "on" for a legacy
+// config is correctly seen as no change.
+func sshServerCurrentlyAllowed(cfg *profilemanager.Config) *bool {
+	enabled := sshServerEnabled(cfg)
+	if cfg == nil {
+		return nil
+	}
+	return &enabled
+}
+
+// exposesLocalMetrics reports whether the change would leave the metrics
+// endpoint enabled on an address that is not confirmed loopback, and returns
+// that address. A request that restates the stored state is not a change, so a
+// settings form resubmitted after an administrator opened the endpoint is not
+// refused.
+func exposesLocalMetrics(stored *profilemanager.Config, change privilegedConfigChange) (string, bool) {
+	storedEnabled, storedAddr := storedLocalMetrics(stored)
+
+	enabled := storedEnabled
+	if change.enableLocalMetrics != nil {
+		enabled = *change.enableLocalMetrics
+	}
+	addr := storedAddr
+	if change.localMetricsAddress != nil {
+		addr = metricsAddrOrDefault(*change.localMetricsAddress)
+	}
+
+	if !enabled || localmetrics.IsLoopback(addr) {
+		return "", false
+	}
+	if storedEnabled && storedAddr == addr {
+		return "", false
+	}
+	return addr, true
+}
+
+// storedLocalMetrics reads the metrics settings from the stored config,
+// tolerating a config that does not exist yet.
+func storedLocalMetrics(cfg *profilemanager.Config) (bool, string) {
+	if cfg == nil {
+		return false, localmetrics.DefaultListenAddress
+	}
+	return cfg.LocalMetricsEnabled, metricsAddrOrDefault(cfg.LocalMetricsAddress)
+}
+
+func metricsAddrOrDefault(addr string) string {
+	if addr == "" {
+		return localmetrics.DefaultListenAddress
+	}
+	return addr
+}
+
+// sameManagementURL reports whether requested addresses the same management
+// server as stored, comparing scheme, host and effective port so that an
+// equivalent spelling ("https://api.netbird.io" for a stored
+// "https://api.netbird.io:443") is not treated as a change. It fails closed:
+// anything unparseable counts as a change and therefore needs privilege.
+func sameManagementURL(stored *url.URL, requested string) bool {
+	if stored == nil {
+		return false
+	}
+
+	// Normalise the requested URL through the config layer's own parser, so the
+	// comparison cannot drift from how the value would actually be stored.
+	parsed, err := profilemanager.ParseServiceURL("Management URL", requested)
+	if err != nil {
+		return false
+	}
+
+	return profilemanager.SameServiceURL(stored, parsed)
+}
diff --git a/client/server/ssh_gate_test.go b/client/server/ssh_gate_test.go
new file mode 100644
index 000000000..b4712c64a
--- /dev/null
+++ b/client/server/ssh_gate_test.go
@@ -0,0 +1,474 @@
+package server
+
+import (
+	"context"
+	"net/url"
+	"os"
+	"runtime"
+	"strings"
+	"testing"
+
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// ctxWithIdentity builds a request context carrying the identity the transport
+// credentials would have attached.
+func ctxWithIdentity(id ipcauth.Identity) context.Context {
+	return peer.NewContext(context.Background(), &peer.Peer{
+		AuthInfo: ipcauth.AuthInfo{
+			CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+			Identity:       id,
+		},
+	})
+}
+
+// unprivUID is deliberately not this process's own uid. An unprivileged daemon
+// treats a caller sharing its identity as privileged (rootless containers), and
+// the test binary would otherwise stand in for both the daemon and the caller.
+// os.Geteuid returns -1 on Windows, where identities are SIDs instead and this is
+// unused.
+var unprivUID = uint32(os.Geteuid() + 1)
+
+// The fabricated identities have to be shaped like the platform's: a uid says
+// nothing on Windows, and a zero uid there would read as root and be privileged.
+func rootCtx() context.Context { return ctxWithIdentity(privilegedIdentity()) }
+func userCtx() context.Context { return ctxWithIdentity(unprivilegedIdentity()) }
+
+func privilegedIdentity() ipcauth.Identity {
+	if runtime.GOOS == "windows" {
+		// LocalSystem, which is what the Windows service account is.
+		return ipcauth.Identity{SID: "S-1-5-18"}
+	}
+	return ipcauth.Identity{UID: 0}
+}
+
+func unprivilegedIdentity() ipcauth.Identity {
+	if runtime.GOOS == "windows" {
+		// A plain user SID: no groups, so no BUILTIN\Administrators, and not
+		// elevated.
+		return ipcauth.Identity{SID: "S-1-5-21-1-2-3-1001"}
+	}
+	return ipcauth.Identity{UID: unprivUID, GID: unprivUID}
+}
+func noIdentityCtx() context.Context { return context.Background() }
+
+func boolPtr(v bool) *bool { return &v }
+
+func strPtr(v string) *string { return &v }
+
+func mustURL(t *testing.T, raw string) *url.URL {
+	t.Helper()
+	u, err := url.Parse(raw)
+	if err != nil {
+		t.Fatalf("parse %q: %v", raw, err)
+	}
+	return u
+}
+
+func assertDenied(t *testing.T, err error) {
+	t.Helper()
+	if err == nil {
+		t.Fatal("expected the change to be refused, got nil")
+	}
+	st := gstatus.Convert(err)
+	if st.Code() != codes.PermissionDenied {
+		t.Fatalf("code = %v, want PermissionDenied", st.Code())
+	}
+	// The refusal must be machine-readable: the CLI and the UI render the
+	// summary and command from the detail rather than parsing the message.
+	var info *errdetails.ErrorInfo
+	for _, d := range st.Details() {
+		if got, ok := d.(*errdetails.ErrorInfo); ok {
+			info = got
+		}
+	}
+	if info == nil {
+		t.Fatal("refusal carries no ErrorInfo detail")
+	}
+	if info.GetReason() != ipcauth.ErrorReasonPrivilegeRequired || info.GetDomain() != ipcauth.ErrorDomain {
+		t.Fatalf("detail = %s/%s, want %s/%s", info.GetDomain(), info.GetReason(), ipcauth.ErrorDomain, ipcauth.ErrorReasonPrivilegeRequired)
+	}
+	if info.GetMetadata()[ipcauth.ErrorMetaSummary] == "" {
+		t.Error("detail carries no summary")
+	}
+	if info.GetMetadata()[ipcauth.ErrorMetaCommand] == "" {
+		t.Error("detail carries no command")
+	}
+}
+
+func assertAllowed(t *testing.T, err error) {
+	t.Helper()
+	if err != nil {
+		t.Fatalf("expected the change to be allowed, got %v", err)
+	}
+}
+
+func TestRequirePrivilegeForConfigChange_SSHFlags(t *testing.T) {
+	tests := []struct {
+		name       string
+		stored     *profilemanager.Config
+		change     privilegedConfigChange
+		privileged bool
+		wantDeny   bool
+	}{
+		{
+			name:     "enabling the ssh server unprivileged is refused",
+			stored:   &profilemanager.Config{ServerSSHAllowed: boolPtr(false)},
+			change:   privilegedConfigChange{serverSSHAllowed: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:       "enabling the ssh server as root is allowed",
+			stored:     &profilemanager.Config{ServerSSHAllowed: boolPtr(false)},
+			change:     privilegedConfigChange{serverSSHAllowed: boolPtr(true)},
+			privileged: true,
+		},
+		{
+			name:   "restating an already enabled ssh server is not a change",
+			stored: &profilemanager.Config{ServerSSHAllowed: boolPtr(true)},
+			change: privilegedConfigChange{serverSSHAllowed: boolPtr(true)},
+		},
+		{
+			name:   "turning the ssh server off is not guarded",
+			stored: &profilemanager.Config{ServerSSHAllowed: boolPtr(true)},
+			change: privilegedConfigChange{serverSSHAllowed: boolPtr(false)},
+		},
+		{
+			name:     "a profile with no config yet counts as off, so enabling is refused",
+			stored:   nil,
+			change:   privilegedConfigChange{serverSSHAllowed: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:     "enabling ssh root login unprivileged is refused",
+			stored:   &profilemanager.Config{EnableSSHRoot: boolPtr(false)},
+			change:   privilegedConfigChange{enableSSHRoot: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:   "restating ssh root login is not a change",
+			stored: &profilemanager.Config{EnableSSHRoot: boolPtr(true)},
+			change: privilegedConfigChange{enableSSHRoot: boolPtr(true)},
+		},
+		{
+			name:   "turning ssh root login off is not guarded",
+			stored: &profilemanager.Config{EnableSSHRoot: boolPtr(true)},
+			change: privilegedConfigChange{enableSSHRoot: boolPtr(false)},
+		},
+		{
+			name:     "disabling ssh authentication unprivileged is refused",
+			stored:   &profilemanager.Config{DisableSSHAuth: boolPtr(false)},
+			change:   privilegedConfigChange{disableSSHAuth: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:   "re-enabling ssh authentication is not guarded",
+			stored: &profilemanager.Config{DisableSSHAuth: boolPtr(true)},
+			change: privilegedConfigChange{disableSSHAuth: boolPtr(false)},
+		},
+		{
+			name:     "enabling remote jobs unprivileged is refused",
+			stored:   &profilemanager.Config{RemoteJobsAllowed: boolPtr(false)},
+			change:   privilegedConfigChange{remoteJobsAllowed: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:       "enabling remote jobs as root is allowed",
+			stored:     &profilemanager.Config{RemoteJobsAllowed: boolPtr(false)},
+			change:     privilegedConfigChange{remoteJobsAllowed: boolPtr(true)},
+			privileged: true,
+		},
+		{
+			name:     "a profile with no config yet counts as off, so enabling remote jobs is refused",
+			stored:   nil,
+			change:   privilegedConfigChange{remoteJobsAllowed: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:   "restating already-enabled remote jobs is not a change",
+			stored: &profilemanager.Config{RemoteJobsAllowed: boolPtr(true)},
+			change: privilegedConfigChange{remoteJobsAllowed: boolPtr(true)},
+		},
+		{
+			name:   "turning remote jobs off is not guarded",
+			stored: &profilemanager.Config{RemoteJobsAllowed: boolPtr(true)},
+			change: privilegedConfigChange{remoteJobsAllowed: boolPtr(false)},
+		},
+		{
+			name:   "a request that touches none of the guarded fields is allowed",
+			stored: &profilemanager.Config{ServerSSHAllowed: boolPtr(false)},
+			change: privilegedConfigChange{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := userCtx()
+			if tt.privileged {
+				ctx = rootCtx()
+			}
+			err := requirePrivilegeForConfigChange(ctx, tt.stored, tt.change)
+			if tt.wantDeny {
+				assertDenied(t, err)
+				return
+			}
+			assertAllowed(t, err)
+		})
+	}
+}
+
+func TestRequirePrivilegeForConfigChange_LocalMetrics(t *testing.T) {
+	exposed := &profilemanager.Config{LocalMetricsEnabled: true, LocalMetricsAddress: "0.0.0.0:9191"}
+
+	tests := []struct {
+		name       string
+		stored     *profilemanager.Config
+		change     privilegedConfigChange
+		privileged bool
+		wantDeny   bool
+	}{
+		{
+			name:     "binding a non-loopback address unprivileged is refused",
+			stored:   &profilemanager.Config{},
+			change:   privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("0.0.0.0:9191")},
+			wantDeny: true,
+		},
+		{
+			name:       "binding a non-loopback address as root is allowed",
+			stored:     &profilemanager.Config{},
+			change:     privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("0.0.0.0:9191")},
+			privileged: true,
+		},
+		{
+			name:   "enabling on the default loopback address is not guarded",
+			stored: &profilemanager.Config{},
+			change: privilegedConfigChange{enableLocalMetrics: boolPtr(true)},
+		},
+		{
+			name:   "enabling on an explicit loopback address is not guarded",
+			stored: &profilemanager.Config{},
+			change: privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("127.0.0.1:9999")},
+		},
+		{
+			name:   "enabling on the IPv6 loopback address is not guarded",
+			stored: &profilemanager.Config{},
+			change: privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("[::1]:9191")},
+		},
+		{
+			// The address alone does nothing while the endpoint stays off.
+			name:   "a non-loopback address without enabling is not guarded",
+			stored: &profilemanager.Config{},
+			change: privilegedConfigChange{localMetricsAddress: strPtr("0.0.0.0:9191")},
+		},
+		{
+			name:     "widening an already enabled loopback endpoint is refused",
+			stored:   &profilemanager.Config{LocalMetricsEnabled: true, LocalMetricsAddress: "127.0.0.1:9191"},
+			change:   privilegedConfigChange{localMetricsAddress: strPtr("0.0.0.0:9191")},
+			wantDeny: true,
+		},
+		{
+			name:   "restating an already exposed endpoint is not a change",
+			stored: exposed,
+			change: privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("0.0.0.0:9191")},
+		},
+		{
+			name:   "turning an exposed endpoint off is not guarded",
+			stored: exposed,
+			change: privilegedConfigChange{enableLocalMetrics: boolPtr(false)},
+		},
+		{
+			name:     "re-enabling an exposed endpoint that was turned off is refused",
+			stored:   &profilemanager.Config{LocalMetricsEnabled: false, LocalMetricsAddress: "0.0.0.0:9191"},
+			change:   privilegedConfigChange{enableLocalMetrics: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			// Fail closed: an address that cannot be parsed is not confirmed loopback.
+			name:     "an unparseable address is refused",
+			stored:   &profilemanager.Config{},
+			change:   privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("not-an-address")},
+			wantDeny: true,
+		},
+		{
+			name:     "a profile with no config yet counts as off, so exposing is refused",
+			stored:   nil,
+			change:   privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("0.0.0.0:9191")},
+			wantDeny: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := userCtx()
+			if tt.privileged {
+				ctx = rootCtx()
+			}
+			err := requirePrivilegeForConfigChange(ctx, tt.stored, tt.change)
+			if tt.wantDeny {
+				assertDenied(t, err)
+				return
+			}
+			assertAllowed(t, err)
+		})
+	}
+}
+
+func TestRequirePrivilegeForConfigChange_ManagementURL(t *testing.T) {
+	sshOn := func(raw string) *profilemanager.Config {
+		return &profilemanager.Config{ServerSSHAllowed: boolPtr(true), ManagementURL: mustURL(t, raw)}
+	}
+	sshOff := func(raw string) *profilemanager.Config {
+		return &profilemanager.Config{ServerSSHAllowed: boolPtr(false), ManagementURL: mustURL(t, raw)}
+	}
+
+	tests := []struct {
+		name       string
+		stored     *profilemanager.Config
+		requested  string
+		privileged bool
+		wantDeny   bool
+	}{
+		{
+			name:      "moving the binding while ssh is enabled is refused",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "https://attacker.example.com:443",
+			wantDeny:  true,
+		},
+		{
+			name:       "moving the binding as root is allowed",
+			stored:     sshOn("https://api.netbird.io:443"),
+			requested:  "https://selfhosted.example.com:443",
+			privileged: true,
+		},
+		{
+			name:      "the same url restated is not a change",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "https://api.netbird.io:443",
+		},
+		{
+			name:      "an equivalent spelling of the same url is not a change",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "https://api.netbird.io",
+		},
+		{
+			name:      "an equivalent spelling with an explicit http port is not a change",
+			stored:    sshOn("http://mgmt.internal:80"),
+			requested: "http://mgmt.internal",
+		},
+		{
+			name:      "a different port on the same host is a change",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "https://api.netbird.io:8443",
+			wantDeny:  true,
+		},
+		{
+			name:      "a different scheme on the same host is a change",
+			stored:    sshOn("https://mgmt.internal:443"),
+			requested: "http://mgmt.internal:443",
+			wantDeny:  true,
+		},
+		{
+			name:      "with ssh disabled the binding is not guarded at all",
+			stored:    sshOff("https://api.netbird.io:443"),
+			requested: "https://attacker.example.com:443",
+		},
+		{
+			name:      "an unparseable url fails closed",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "ht tp://%zz",
+			wantDeny:  true,
+		},
+		{
+			name:      "an empty url leaves the binding alone",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := userCtx()
+			if tt.privileged {
+				ctx = rootCtx()
+			}
+			err := requirePrivilegeForConfigChange(ctx, tt.stored, privilegedConfigChange{managementURL: tt.requested})
+			if tt.wantDeny {
+				assertDenied(t, err)
+				return
+			}
+			assertAllowed(t, err)
+		})
+	}
+}
+
+// A caller the daemon cannot identify must be refused, not trusted: that is the
+// state on a TCP daemon socket, where no peer credentials exist.
+func TestRequirePrivilegeForConfigChange_UnidentifiedCallerIsRefused(t *testing.T) {
+	err := requirePrivilegeForConfigChange(noIdentityCtx(),
+		&profilemanager.Config{ServerSSHAllowed: boolPtr(false)},
+		privilegedConfigChange{serverSSHAllowed: boolPtr(true)})
+	assertDenied(t, err)
+
+	// The guidance must point at the socket rather than at sudo, since elevating
+	// would not help.
+	st := gstatus.Convert(err)
+	if !strings.Contains(st.Message(), "service install") {
+		t.Errorf("message %q does not tell the operator how to fix the socket", st.Message())
+	}
+}
+
+func TestRequirePrivilegeForDeregistration(t *testing.T) {
+	tests := []struct {
+		name       string
+		cfg        *profilemanager.Config
+		privileged bool
+		wantDeny   bool
+	}{
+		{
+			name:     "deregistering while ssh is enabled is refused",
+			cfg:      &profilemanager.Config{ServerSSHAllowed: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:       "deregistering while ssh is enabled is allowed for root",
+			cfg:        &profilemanager.Config{ServerSSHAllowed: boolPtr(true)},
+			privileged: true,
+		},
+		{
+			name: "deregistering with ssh disabled is not guarded",
+			cfg:  &profilemanager.Config{ServerSSHAllowed: boolPtr(false)},
+		},
+		{
+			name: "deregistering a profile with no config is not guarded",
+			cfg:  nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := userCtx()
+			if tt.privileged {
+				ctx = rootCtx()
+			}
+			err := requirePrivilegeForDeregistration(ctx, tt.cfg)
+			if tt.wantDeny {
+				assertDenied(t, err)
+				return
+			}
+			assertAllowed(t, err)
+		})
+	}
+}
+
+// privilegedTestCtx is the context a handler-level test should use when it is
+// standing in for a root/administrator caller. Tests that drive the handlers
+// directly have no transport credentials, and the privileged-change gate refuses
+// a caller it cannot identify.
+func privilegedTestCtx() context.Context { return rootCtx() }
diff --git a/client/server/state.go b/client/server/state.go
index f2d823465..a4e91468e 100644
--- a/client/server/state.go
+++ b/client/server/state.go
@@ -46,7 +46,7 @@ func (s *Server) CleanState(ctx context.Context, req *proto.CleanStateRequest) (
 
 	if req.All {
 		// Reuse existing cleanup logic for all states
-		if err := restoreResidualState(ctx, statePath); err != nil {
+		if err := RestoreResidualState(ctx, statePath); err != nil {
 			return nil, status.Errorf(codes.Internal, "failed to clean all states: %v", err)
 		}
 
@@ -113,9 +113,9 @@ func (s *Server) DeleteState(ctx context.Context, req *proto.DeleteStateRequest)
 	}, nil
 }
 
-// restoreResidualState checks if the client was not shut down in a clean way and restores residual if required.
+// RestoreResidualState checks if the client was not shut down in a clean way and restores residual if required.
 // Otherwise, we might not be able to connect to the management server to retrieve new config.
-func restoreResidualState(ctx context.Context, statePath string) error {
+func RestoreResidualState(ctx context.Context, statePath string) error {
 	if statePath == "" {
 		return nil
 	}
diff --git a/client/server/status_stream.go b/client/server/status_stream.go
new file mode 100644
index 000000000..c6ba547eb
--- /dev/null
+++ b/client/server/status_stream.go
@@ -0,0 +1,57 @@
+package server
+
+import (
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// SubscribeStatus pushes a fresh StatusResponse on every connection state
+// change. The first message is the current snapshot, so a re-subscribing
+// client doesn't need to also call Status. Subsequent messages fire when
+// the peer recorder reports any of: connected/disconnected/connecting,
+// management or signal flip, address change, or peers list change.
+//
+// The change channel coalesces bursts to a single tick. If the consumer
+// is slow the daemon drops extras (not blocks), and the next snapshot
+// the consumer pulls already reflects everything.
+func (s *Server) SubscribeStatus(req *proto.StatusRequest, stream proto.DaemonService_SubscribeStatusServer) error {
+	subID, ch := s.statusRecorder.SubscribeToStateChanges()
+	defer func() {
+		s.statusRecorder.UnsubscribeFromStateChanges(subID)
+		log.Debug("client unsubscribed from status updates")
+	}()
+
+	log.Debug("client subscribed to status updates")
+
+	if err := s.sendStatusSnapshot(req, stream); err != nil {
+		return err
+	}
+
+	for {
+		select {
+		case _, ok := <-ch:
+			if !ok {
+				return nil
+			}
+			if err := s.sendStatusSnapshot(req, stream); err != nil {
+				return err
+			}
+		case <-stream.Context().Done():
+			return nil
+		}
+	}
+}
+
+func (s *Server) sendStatusSnapshot(req *proto.StatusRequest, stream proto.DaemonService_SubscribeStatusServer) error {
+	resp, err := s.buildStatusResponse(stream.Context(), req)
+	if err != nil {
+		log.Warnf("build status snapshot for stream: %v", err)
+		return err
+	}
+	if err := stream.Send(resp); err != nil {
+		log.Warnf("send status snapshot to stream: %v", err)
+		return err
+	}
+	return nil
+}
diff --git a/client/server/update_settings_gate.go b/client/server/update_settings_gate.go
new file mode 100644
index 000000000..b4d32754f
--- /dev/null
+++ b/client/server/update_settings_gate.go
@@ -0,0 +1,55 @@
+package server
+
+import (
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// configChangeRequested reports whether applying input would move the target
+// profile away from the configuration it already persists. It is the decision
+// procedure of the update-settings kill switch (--disable-update-settings /
+// NB_DISABLE_UPDATE_SETTINGS / the MDM DisableUpdateSettings key): that switch
+// forbids *changing* settings, so a request that restates the stored values is
+// not a change and must not be refused.
+//
+// This has to be judged on values, not on field presence. `netbird up` rebuilds
+// the whole config surface of SetConfigRequest and LoginRequest from its flags
+// and environment on every invocation, so a service or container configured by
+// environment restates its own configuration on every start. A presence-based
+// gate refused those requests, and because Login carries the same fields it
+// refused the login too — leaving such a client unable to come up at all.
+//
+// A dry run that cannot be evaluated fails closed: the request counts as a
+// change, so a malformed field can never open the gate. The error itself is
+// reported to the caller by the real update path.
+func configChangeRequested(stored *profilemanager.Config, input profilemanager.ConfigInput) bool {
+	changed, err := stored.WouldChange(input)
+	if err != nil {
+		log.Warnf("cannot evaluate the requested config change, treating it as a change: %v", err)
+		return true
+	}
+	return changed
+}
+
+// loginOverridesInput builds the ConfigInput a login request persists. The
+// management URL and the pre-shared key are the only config fields the daemon
+// applies from a LoginRequest; everything else on that message is either pure
+// auth or ignored. An empty pre-shared key is dropped rather than written, so
+// a login cannot clear the stored key by omission.
+//
+// Both the write (persistLoginOverrides) and the update-settings gate go
+// through this builder, so the gate can neither refuse a field the write
+// ignores nor miss one it applies.
+func loginOverridesInput(msg *proto.LoginRequest) profilemanager.ConfigInput {
+	preSharedKey := msg.OptionalPreSharedKey
+	if preSharedKey != nil && *preSharedKey == "" {
+		preSharedKey = nil
+	}
+
+	return profilemanager.ConfigInput{
+		ManagementURL: msg.ManagementUrl,
+		PreSharedKey:  preSharedKey,
+	}
+}
diff --git a/client/server/update_settings_gate_test.go b/client/server/update_settings_gate_test.go
new file mode 100644
index 000000000..0d2cd8810
--- /dev/null
+++ b/client/server/update_settings_gate_test.go
@@ -0,0 +1,390 @@
+package server
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// The seeded profile of setupServerWithProfile is created with this management
+// URL, so a request carrying it restates what the profile already holds.
+const storedManagementURL = "https://api.netbird.io:443"
+
+// A client configured by environment re-sends its whole configuration on every
+// `netbird up`: the CLI fills the request from its flags and env regardless of
+// what changed. With the update-settings kill switch on, such a request must
+// pass — nothing about the configuration moves.
+func TestSetConfig_RestatingTheStoredConfigPassesTheGate(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: storedManagementURL,
+	})
+	require.NoError(t, err, "restating the stored management URL is not a settings change")
+}
+
+// The same endpoint written without its default port is the same endpoint. A
+// gate that compared raw strings refused NB_MANAGEMENT_URL=https://host, which
+// is how the URL is normally spelled.
+func TestSetConfig_EquivalentManagementURLPassesTheGate(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://api.netbird.io",
+	})
+	require.NoError(t, err, "an implicit :443 is the same management URL")
+}
+
+// The kill switch still has to do its job: a request that moves a setting is
+// refused, and the profile keeps the value it had.
+func TestSetConfig_ChangingASettingIsRefused(t *testing.T) {
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.Error(t, err, "moving the management URL is a settings change")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, storedManagementURL, cfg.ManagementURL.String(), "the refused request changed the config anyway")
+}
+
+// A field whose requested value differs from the stored one is a change even
+// when the rest of the request restates the configuration.
+func TestSetConfig_SingleDivergingFieldIsRefused(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	rosenpass := true
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:      profName,
+		Username:         username,
+		ManagementUrl:    storedManagementURL,
+		RosenpassEnabled: &rosenpass,
+	})
+	require.Error(t, err, "enabling Rosenpass is a settings change")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+}
+
+// With the switch off, the same diverging request goes through: the gate must
+// not leak into a daemon that never enabled it.
+func TestSetConfig_ChangeAllowedWhenTheSwitchIsOff(t *testing.T) {
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.NoError(t, err)
+
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, "https://mgmt.elsewhere.example:443", cfg.ManagementURL.String())
+}
+
+// Login carries the same config surface as SetConfig, so it is gated the same
+// way: a login that would move a protected setting is refused before it can
+// touch daemon state.
+func TestLogin_ChangingTheManagementURLIsRefused(t *testing.T) {
+	s, _, profName, username, cfgPath := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	cancelled := false
+	s.actCancel = func() { cancelled = true }
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{
+		Username:      &username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.Error(t, err, "moving the management URL through Login is a settings change")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+
+	// "Refused before it can touch daemon state" is the contract, so check the
+	// state as well as the error.
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, storedManagementURL, cfg.ManagementURL.String(), "the refused login moved the management URL")
+	require.False(t, cancelled, "the refused login cancelled the login already in progress")
+
+	active, err := s.profileManager.GetActiveProfileState()
+	require.NoError(t, err)
+	require.Equal(t, profilemanager.ID(profName), active.ID, "the refused login switched the active profile")
+}
+
+// seedProfileConfig writes a profile config carrying the given management URL
+// and pre-shared key into a temp dir, and returns its path.
+func seedProfileConfig(t *testing.T, managementURL, preSharedKey string) string {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "seeded.json")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: managementURL,
+		PreSharedKey:  &preSharedKey,
+	})
+	require.NoError(t, err, "seed profile config")
+	return path
+}
+
+// The decision procedure itself, over the fields a login actually persists.
+// A login that restates the stored values must not be refused: that is what
+// keeps a re-login, or a container restart carrying NB_MANAGEMENT_URL, working
+// with the kill switch on.
+func TestLoginGateDecision(t *testing.T) {
+	stored, err := profilemanager.GetExistingConfig(seedProfileConfig(t, storedManagementURL, "stored-key"))
+	require.NoError(t, err)
+
+	redacted := mdm.PreSharedKeyRedactedSentinel
+	empty := ""
+	sameKey := "stored-key"
+	otherKey := "other-key"
+
+	tests := []struct {
+		name        string
+		msg         *proto.LoginRequest
+		wantChanged bool
+	}{
+		{
+			name:        "pure auth carries no config",
+			msg:         &proto.LoginRequest{SetupKey: "ABC"},
+			wantChanged: false,
+		},
+		{
+			name:        "stored management URL restated",
+			msg:         &proto.LoginRequest{ManagementUrl: storedManagementURL},
+			wantChanged: false,
+		},
+		{
+			name:        "stored management URL without its default port",
+			msg:         &proto.LoginRequest{ManagementUrl: "https://api.netbird.io"},
+			wantChanged: false,
+		},
+		{
+			name:        "different management URL",
+			msg:         &proto.LoginRequest{ManagementUrl: "https://mgmt.elsewhere.example:443"},
+			wantChanged: true,
+		},
+		{
+			name:        "stored pre-shared key restated",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &sameKey},
+			wantChanged: false,
+		},
+		{
+			name:        "redacted pre-shared key echoed back",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &redacted},
+			wantChanged: false,
+		},
+		{
+			name:        "empty pre-shared key is not a request to clear it",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &empty},
+			wantChanged: false,
+		},
+		{
+			name:        "different pre-shared key",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &otherKey},
+			wantChanged: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.wantChanged, configChangeRequested(stored, loginOverridesInput(tt.msg)))
+		})
+	}
+}
+
+// A profile with no config on disk yet is judged against the config the daemon
+// would create for it, so a first login that asks for the defaults is not a
+// change while one that asks for a different management URL is.
+func TestGateDecisionWithoutStoredConfig(t *testing.T) {
+	require.False(t, configChangeRequested(nil, profilemanager.ConfigInput{}),
+		"a request carrying nothing cannot change anything")
+	require.False(t, configChangeRequested(nil, profilemanager.ConfigInput{ManagementURL: profilemanager.DefaultManagementURL}),
+		"asking for the default management URL is what the daemon would write anyway")
+	require.True(t, configChangeRequested(nil, profilemanager.ConfigInput{ManagementURL: "https://mgmt.elsewhere.example:443"}),
+		"asking for a non-default management URL is a change")
+}
+
+// A dry run that cannot be evaluated must fail closed, or a malformed field
+// would open the gate.
+func TestGateDecisionFailsClosedOnAnInvalidRequest(t *testing.T) {
+	require.True(t, configChangeRequested(nil, profilemanager.ConfigInput{ManagementURL: "not-a-url"}),
+		"an unevaluable request must count as a change")
+}
+
+// The gate reads the stored config to decide, and reading it must not write it:
+// a refused request has to leave the profile file byte-for-byte as it was.
+// A config file missing a field the config layer fills in (MTU, here) is what
+// makes the normalization write fire.
+func TestSetConfig_RefusedRequestLeavesTheConfigFileUntouched(t *testing.T) {
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	require.NoError(t, os.WriteFile(cfgPath, []byte(`{"WgIface":"wt0"}`), 0o600))
+	before, err := os.ReadFile(cfgPath)
+	require.NoError(t, err)
+
+	_, err = s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.Error(t, err)
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+
+	after, err := os.ReadFile(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, string(before), string(after), "the refused request rewrote the profile config")
+}
+
+// The container case that the string comparison still broke: the management URL
+// supplied through the environment is the stored one, written with a trailing
+// slash.
+func TestSetConfig_ManagementURLSpellingsPassTheGate(t *testing.T) {
+	for _, spelling := range []string{
+		"https://api.netbird.io",
+		"https://api.netbird.io/",
+		"https://api.netbird.io:443/",
+		"https://API.netbird.io:443",
+	} {
+		t.Run(spelling, func(t *testing.T) {
+			s, ctx, profName, username, _ := setupServerWithProfile(t)
+			s.updateSettingsDisabled = true
+
+			_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+				ProfileName:   profName,
+				Username:      username,
+				ManagementUrl: spelling,
+			})
+			require.NoError(t, err, "%q is the stored management URL written differently", spelling)
+		})
+	}
+}
+
+// The RPC the whole fix hangs on. Login is retried by the CLI in a backoff
+// loop, so a login that restates the stored configuration — which is what a
+// container configured by environment sends on every start — must get past the
+// gate, or the client never comes up at all.
+//
+// Past the gate the handler goes on to do real work this test does not stand
+// up, so the assertion is only that the refusal did not happen.
+func TestLogin_RestatingTheStoredConfigPassesTheGate(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	// Stand in for the management round trip the handler makes once the gate
+	// lets it through, so this test exercises the gate and not the network:
+	// without it the profile's management URL is dialed for real.
+	s.isLoginRequiredFn = func(context.Context) (bool, error) { return false, nil }
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{
+		Username:      &username,
+		ManagementUrl: storedManagementURL,
+	})
+	if err != nil {
+		require.NotEqual(t, codes.FailedPrecondition, gstatus.Code(err),
+			"the gate refused a login that changes nothing: %v", err)
+		require.NotContains(t, err.Error(), "update settings are disabled",
+			"the gate refused a login that changes nothing: %v", err)
+	}
+}
+
+// The value-aware decision has the same synchronization problem as the
+// privileged-change one: Login's first check runs outside guardedConfigMu, so
+// the stored config it compared against can move before the write. A login that
+// was a no-op when it was checked must not be written once it has become a
+// change.
+func TestLogin_ChangeThatAppearsMidRequestIsRefused(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	target := "moved-under-us"
+	targetPath := filepath.Join(profilemanager.DefaultConfigPathDir, target+".json")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    targetPath,
+		ManagementURL: storedManagementURL,
+	})
+	require.NoError(t, err)
+
+	cancelled := false
+	s.actCancel = func() { cancelled = true }
+
+	// Stand in for a concurrent writer that repoints the profile between the two
+	// checks, which is the interleaving the lock has to make safe. The login
+	// restates the URL the profile held when it was checked, so the first check
+	// sees a no-op and lets it through.
+	afterLoginPreCheck = func() {
+		_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+			ConfigPath:    targetPath,
+			ManagementURL: "https://mgmt.elsewhere.example:443",
+		})
+		require.NoError(t, err)
+	}
+	t.Cleanup(func() { afterLoginPreCheck = nil })
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{
+		ProfileName:   &target,
+		Username:      &username,
+		ManagementUrl: storedManagementURL,
+	})
+	require.Error(t, err, "the login became a settings change before it was written")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+	require.False(t, cancelled, "the refused login cancelled the login already in progress")
+
+	stored, err := profilemanager.GetExistingConfig(targetPath)
+	require.NoError(t, err)
+	require.Equal(t, "https://mgmt.elsewhere.example:443", stored.ManagementURL.String(),
+		"the refused login wrote the management URL it was asked for")
+}
+
+// Logging out a profile that was already logged out must not fail: the logout
+// clears the keys in place, so the second attempt finds a profile with no
+// identity, which was never registered and has nothing to deregister.
+func TestLogout_ProfileWithoutAnIdentityIsANoOp(t *testing.T) {
+	s, _, _, _, cfgPath := setupServerWithProfile(t)
+
+	loggedOut, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	loggedOut.PrivateKey = ""
+	loggedOut.SSHKey = ""
+	require.NoError(t, profilemanager.WriteOutConfig(cfgPath, loggedOut))
+
+	stored, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.NoError(t, s.sendLogoutRequestWithConfig(privilegedTestCtx(), stored),
+		"logging out an identity-less profile must not fail")
+
+	// And for an unprivileged caller too: the deregistration privilege gate
+	// guards the handover of a registered key, so with no key there is nothing
+	// to guard. An unset SSH setting is what arms that gate — sshServerEnabled
+	// reads an absent value as enabled — so this stands in for every legacy
+	// profile, where behind the gate the caller would be refused.
+	stored.ServerSSHAllowed = nil
+	require.NoError(t, s.sendLogoutRequestWithConfig(userCtx(), stored),
+		"an unprivileged caller could not log out a profile with nothing to deregister")
+}
diff --git a/client/ssh/auth/auth.go b/client/ssh/auth/auth.go
index 079282fdc..92f517fac 100644
--- a/client/ssh/auth/auth.go
+++ b/client/ssh/auth/auth.go
@@ -3,6 +3,7 @@ package auth
 import (
 	"errors"
 	"fmt"
+	"slices"
 	"sync"
 
 	log "github.com/sirupsen/logrus"
@@ -155,6 +156,24 @@ func (a *Authorizer) GetUserIDClaim() string {
 	return a.userIDClaim
 }
 
+// Config returns the authorization currently in force. The user list and the
+// machine-user map are copies; the originals stay in use here.
+func (a *Authorizer) Config() *Config {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+
+	machineUsers := make(map[string][]uint32, len(a.machineUsers))
+	for osUser, indexes := range a.machineUsers {
+		machineUsers[osUser] = slices.Clone(indexes)
+	}
+
+	return &Config{
+		UserIDClaim:     a.userIDClaim,
+		AuthorizedUsers: slices.Clone(a.authorizedUsers),
+		MachineUsers:    machineUsers,
+	}
+}
+
 // findUserIndex finds the index of a hashed user ID in the authorized users list
 // Returns the index and true if found, 0 and false if not found
 func (a *Authorizer) findUserIndex(hashedUserID sshuserhash.UserIDHash) (int, bool) {
diff --git a/client/ssh/client/client.go b/client/ssh/client/client.go
index ebf8eb794..dc94c33f4 100644
--- a/client/ssh/client/client.go
+++ b/client/ssh/client/client.go
@@ -9,7 +9,6 @@ import (
 	"path/filepath"
 	"runtime"
 	"strconv"
-	"strings"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -17,7 +16,6 @@ import (
 	"golang.org/x/crypto/ssh/knownhosts"
 	"golang.org/x/term"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
 
 	"github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
@@ -32,7 +30,7 @@ const (
 	// DefaultDaemonAddr is the default address for the NetBird daemon
 	DefaultDaemonAddr = "unix:///var/run/netbird.sock"
 	// DefaultDaemonAddrWindows is the default address for the NetBird daemon on Windows
-	DefaultDaemonAddrWindows = "tcp://127.0.0.1:41731"
+	DefaultDaemonAddrWindows = daemonaddr.WindowsPipeAddr
 )
 
 // Client wraps crypto/ssh Client for simplified SSH operations
@@ -168,7 +166,8 @@ func (c *Client) ExecuteCommandWithIO(ctx context.Context, command string) error
 	case <-ctx.Done():
 		_ = session.Signal(ssh.SIGTERM)
 		select {
-		case <-done:
+		case err := <-done:
+			log.Debugf("session ended after SIGTERM: %v", err)
 			return ctx.Err()
 		case <-time.After(100 * time.Millisecond):
 			return ctx.Err()
@@ -207,7 +206,8 @@ func (c *Client) ExecuteCommandWithPTY(ctx context.Context, command string) erro
 	case <-ctx.Done():
 		_ = session.Signal(ssh.SIGTERM)
 		select {
-		case <-done:
+		case err := <-done:
+			log.Debugf("session ended after SIGTERM: %v", err)
 			return ctx.Err()
 		case <-time.After(100 * time.Millisecond):
 			return ctx.Err()
@@ -268,7 +268,7 @@ func getDefaultDaemonAddr() string {
 		return addr
 	}
 	if runtime.GOOS == "windows" {
-		return DefaultDaemonAddrWindows
+		return daemonaddr.ResolveDaemonAddr(DefaultDaemonAddrWindows)
 	}
 	return daemonaddr.ResolveUnixDaemonAddr(DefaultDaemonAddr)
 }
@@ -315,21 +315,23 @@ func Dial(ctx context.Context, addr, user string, opts DialOptions) (*Client, er
 
 // dialSSH establishes an SSH connection without JWT authentication
 func dialSSH(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*Client, error) {
+	if config.Timeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, config.Timeout)
+		defer cancel()
+	}
+
 	dialer := &net.Dialer{}
 	conn, err := dialer.DialContext(ctx, network, addr)
 	if err != nil {
 		return nil, fmt.Errorf("dial %s: %w", addr, err)
 	}
 
-	clientConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
+	client, err := nbssh.Handshake(ctx, conn, addr, config)
 	if err != nil {
-		if closeErr := conn.Close(); closeErr != nil {
-			log.Debugf("connection close after handshake failure: %v", closeErr)
-		}
-		return nil, fmt.Errorf("ssh handshake: %w", err)
+		return nil, err
 	}
 
-	client := ssh.NewClient(clientConn, chans, reqs)
 	return &Client{
 		client: client,
 	}, nil
@@ -410,12 +412,9 @@ func verifyHostKeyViaDaemon(hostname string, remote net.Addr, key ssh.PublicKey,
 }
 
 func connectToDaemon(daemonAddr string) (*grpc.ClientConn, error) {
-	addr := strings.TrimPrefix(daemonAddr, "tcp://")
+	target, opts := daemonaddr.DialTarget(daemonAddr)
 
-	conn, err := grpc.NewClient(
-		addr,
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-	)
+	conn, err := grpc.NewClient(target, opts...)
 	if err != nil {
 		log.Debugf("failed to create gRPC client for NetBird daemon at %s: %v", daemonAddr, err)
 		return nil, fmt.Errorf("failed to connect to NetBird daemon: %w", err)
diff --git a/client/ssh/client/terminal_unix.go b/client/ssh/client/terminal_unix.go
index aaa3418f9..a963dc8be 100644
--- a/client/ssh/client/terminal_unix.go
+++ b/client/ssh/client/terminal_unix.go
@@ -12,6 +12,8 @@ import (
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/term"
+
+	nbssh "github.com/netbirdio/netbird/client/ssh"
 )
 
 func (c *Client) setupTerminalMode(ctx context.Context, session *ssh.Session) error {
@@ -82,37 +84,7 @@ func (c *Client) setupTerminal(session *ssh.Session, fd int) error {
 		return fmt.Errorf("get terminal size: %w", err)
 	}
 
-	modes := ssh.TerminalModes{
-		ssh.ECHO:          1,
-		ssh.TTY_OP_ISPEED: 14400,
-		ssh.TTY_OP_OSPEED: 14400,
-		// Ctrl+C
-		ssh.VINTR: 3,
-		// Ctrl+\
-		ssh.VQUIT: 28,
-		// Backspace
-		ssh.VERASE: 127,
-		// Ctrl+U
-		ssh.VKILL: 21,
-		// Ctrl+D
-		ssh.VEOF:  4,
-		ssh.VEOL:  0,
-		ssh.VEOL2: 0,
-		// Ctrl+Q
-		ssh.VSTART: 17,
-		// Ctrl+S
-		ssh.VSTOP: 19,
-		// Ctrl+Z
-		ssh.VSUSP: 26,
-		// Ctrl+O
-		ssh.VDISCARD: 15,
-		// Ctrl+R
-		ssh.VREPRINT: 18,
-		// Ctrl+W
-		ssh.VWERASE: 23,
-		// Ctrl+V
-		ssh.VLNEXT: 22,
-	}
+	modes := nbssh.DefaultTerminalModes
 
 	terminal := os.Getenv("TERM")
 	if terminal == "" {
diff --git a/client/ssh/client/terminal_windows.go b/client/ssh/client/terminal_windows.go
index 462438317..c6156fc26 100644
--- a/client/ssh/client/terminal_windows.go
+++ b/client/ssh/client/terminal_windows.go
@@ -10,6 +10,8 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
+
+	nbssh "github.com/netbirdio/netbird/client/ssh"
 )
 
 const (
@@ -80,28 +82,14 @@ func (c *Client) setupTerminalMode(_ context.Context, session *ssh.Session) erro
 	w, h := c.getWindowsConsoleSize()
 
 	modes := ssh.TerminalModes{
-		ssh.ECHO:          1,
-		ssh.TTY_OP_ISPEED: 14400,
-		ssh.TTY_OP_OSPEED: 14400,
-		ssh.ICRNL:         1,
-		ssh.OPOST:         1,
-		ssh.ONLCR:         1,
-		ssh.ISIG:          1,
-		ssh.ICANON:        1,
-		ssh.VINTR:         3,   // Ctrl+C
-		ssh.VQUIT:         28,  // Ctrl+\
-		ssh.VERASE:        127, // Backspace
-		ssh.VKILL:         21,  // Ctrl+U
-		ssh.VEOF:          4,   // Ctrl+D
-		ssh.VEOL:          0,
-		ssh.VEOL2:         0,
-		ssh.VSTART:        17, // Ctrl+Q
-		ssh.VSTOP:         19, // Ctrl+S
-		ssh.VSUSP:         26, // Ctrl+Z
-		ssh.VDISCARD:      15, // Ctrl+O
-		ssh.VWERASE:       23, // Ctrl+W
-		ssh.VLNEXT:        22, // Ctrl+V
-		ssh.VREPRINT:      18, // Ctrl+R
+		ssh.ICRNL:  1,
+		ssh.OPOST:  1,
+		ssh.ONLCR:  1,
+		ssh.ISIG:   1,
+		ssh.ICANON: 1,
+	}
+	for mode, value := range nbssh.DefaultTerminalModes {
+		modes[mode] = value
 	}
 
 	if err := session.RequestPty("xterm-256color", h, w, modes); err != nil {
diff --git a/client/ssh/common.go b/client/ssh/common.go
index 92e647b7d..4ebf8842a 100644
--- a/client/ssh/common.go
+++ b/client/ssh/common.go
@@ -13,6 +13,7 @@ import (
 	"golang.org/x/crypto/ssh"
 
 	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
 )
 
 const (
@@ -34,6 +35,19 @@ type HostKeyVerifier interface {
 	VerifySSHHostKey(peerAddress string, key []byte) error
 }
 
+// PeerKeyLookup returns the stored SSH host key for a peer address.
+type PeerKeyLookup func(peerAddress string) ([]byte, bool)
+
+// VerifySSHHostKey implements HostKeyVerifier by looking up the stored key
+// and comparing it against the presented key.
+func (l PeerKeyLookup) VerifySSHHostKey(peerAddress string, presentedKey []byte) error {
+	storedKey, found := l(peerAddress)
+	if !found {
+		return ErrPeerNotFound
+	}
+	return VerifyHostKey(storedKey, presentedKey, peerAddress)
+}
+
 // DaemonHostKeyVerifier implements HostKeyVerifier using the NetBird daemon
 type DaemonHostKeyVerifier struct {
 	client proto.DaemonServiceClient
@@ -92,7 +106,8 @@ func printAuthInstructions(stderr io.Writer, authResponse *proto.RequestJWTAuthR
 
 // RequestJWTToken requests or retrieves a JWT token for SSH authentication
 func RequestJWTToken(ctx context.Context, client proto.DaemonServiceClient, stdout, stderr io.Writer, useCache bool, hint string, openBrowser func(string) error) (string, error) {
-	req := &proto.RequestJWTAuthRequest{}
+	// the ssh client runs in the user's session, the daemon does not: tell it what we can see
+	req := &proto.RequestJWTAuthRequest{HasGraphicalSession: util.HasGraphicalSession()}
 	if hint != "" {
 		req.Hint = &hint
 	}
@@ -193,4 +208,3 @@ func buildAddressList(hostname string, remote net.Addr) []string {
 	}
 	return addresses
 }
-
diff --git a/client/ssh/config/manager.go b/client/ssh/config/manager.go
index 20695cb4d..e15330739 100644
--- a/client/ssh/config/manager.go
+++ b/client/ssh/config/manager.go
@@ -14,6 +14,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 const (
@@ -218,11 +219,20 @@ func (m *Manager) buildHostPatterns(peer PeerSSHInfo) []string {
 	if peer.IPv6.IsValid() {
 		hostPatterns = append(hostPatterns, peer.IPv6.String())
 	}
-	if peer.FQDN != "" {
+	// Peer FQDNs and hostnames originate from remote peers, so they must be
+	// validated as plain DNS names before being embedded in the ssh_config
+	// "Match host" pattern list. This prevents injection of arbitrary
+	// ssh_config directives via embedded quotes, whitespace, newlines, the
+	// comma pattern separator, or the "*"/"?" pattern metacharacters.
+	if domain.IsValidDomainNoWildcard(peer.FQDN) {
 		hostPatterns = append(hostPatterns, peer.FQDN)
+	} else if peer.FQDN != "" {
+		log.Warnf("skipping peer FQDN with invalid characters in SSH config: %q", peer.FQDN)
 	}
-	if peer.Hostname != "" && peer.Hostname != peer.FQDN {
+	if peer.Hostname != peer.FQDN && domain.IsValidDomainNoWildcard(peer.Hostname) {
 		hostPatterns = append(hostPatterns, peer.Hostname)
+	} else if peer.Hostname != "" && peer.Hostname != peer.FQDN {
+		log.Warnf("skipping peer hostname with invalid characters in SSH config: %q", peer.Hostname)
 	}
 	return hostPatterns
 }
diff --git a/client/ssh/config/manager_test.go b/client/ssh/config/manager_test.go
index 8e6be40a3..f65d0ba6d 100644
--- a/client/ssh/config/manager_test.go
+++ b/client/ssh/config/manager_test.go
@@ -148,6 +148,45 @@ func TestManager_MatchHostFormat(t *testing.T) {
 		"should use Match host with comma-separated patterns")
 }
 
+func TestManager_HostPatternInjection(t *testing.T) {
+	tempDir, err := os.MkdirTemp("", "netbird-ssh-config-test")
+	require.NoError(t, err)
+	defer func() { assert.NoError(t, os.RemoveAll(tempDir)) }()
+
+	manager := &Manager{
+		sshConfigDir:  filepath.Join(tempDir, "ssh_config.d"),
+		sshConfigFile: "99-netbird.conf",
+	}
+
+	// A malicious peer FQDN/hostname attempts to break out of the Match host
+	// directive and inject arbitrary ssh_config (a ProxyCommand executing a
+	// command). It must be rejected, not written to the config.
+	peers := []PeerSSHInfo{
+		{
+			Hostname: "evil\"\n    ProxyCommand touch /tmp/pwned\nHost x",
+			IP:       netip.MustParseAddr("100.125.1.1"),
+			FQDN:     "evil\"\n    ProxyCommand touch /tmp/pwned\nHost x.nb.internal",
+		},
+		{Hostname: "peer2", IP: netip.MustParseAddr("100.125.1.2"), FQDN: "peer2.nb.internal"},
+	}
+
+	err = manager.SetupSSHClientConfig(peers)
+	require.NoError(t, err)
+
+	configPath := filepath.Join(manager.sshConfigDir, manager.sshConfigFile)
+	content, err := os.ReadFile(configPath)
+	require.NoError(t, err)
+	configStr := string(content)
+
+	assert.NotContains(t, configStr, "ProxyCommand touch /tmp/pwned",
+		"injected directive must not appear in generated config")
+	assert.NotContains(t, configStr, "evil",
+		"malicious pattern must be dropped entirely")
+	// The valid peer must still be present, on a single Match host line.
+	assert.Contains(t, configStr, "Match host \"100.125.1.1,100.125.1.2,peer2.nb.internal,peer2\"",
+		"valid peers must survive, injected patterns dropped")
+}
+
 func TestManager_ForcedSSHConfig(t *testing.T) {
 	// Set force environment variable
 	t.Setenv(EnvForceSSHConfig, "true")
diff --git a/client/ssh/handshake.go b/client/ssh/handshake.go
new file mode 100644
index 000000000..a718748df
--- /dev/null
+++ b/client/ssh/handshake.go
@@ -0,0 +1,48 @@
+package ssh
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/crypto/ssh"
+)
+
+// Handshake runs the SSH client handshake on an already dialed conn and
+// returns the resulting client. Dialing bounds only the TCP establishment;
+// a peer that accepts and then goes silent would block the handshake forever,
+// so conn is closed as soon as ctx is done, which unblocks the handshake and
+// surfaces the context error. conn is closed on any error.
+func Handshake(ctx context.Context, conn net.Conn, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
+	stop := context.AfterFunc(ctx, func() { closeHandshake(conn, "conn on context done") })
+
+	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
+	if err != nil {
+		if stop() {
+			closeHandshake(conn, "conn after handshake error")
+		}
+		return nil, handshakeError(ctx, err)
+	}
+
+	if !stop() {
+		closeHandshake(sshConn, "ssh conn after context done")
+		return nil, fmt.Errorf("ssh handshake: %w", ctx.Err())
+	}
+
+	return ssh.NewClient(sshConn, chans, reqs), nil
+}
+
+func closeHandshake(c io.Closer, label string) {
+	if err := c.Close(); err != nil {
+		log.Debugf("ssh: close %s: %v", label, err)
+	}
+}
+
+func handshakeError(ctx context.Context, err error) error {
+	if ctxErr := ctx.Err(); ctxErr != nil {
+		return fmt.Errorf("ssh handshake: %w: %w", ctxErr, err)
+	}
+	return fmt.Errorf("ssh handshake: %w", err)
+}
diff --git a/client/ssh/handshake_test.go b/client/ssh/handshake_test.go
new file mode 100644
index 000000000..77a6f916b
--- /dev/null
+++ b/client/ssh/handshake_test.go
@@ -0,0 +1,90 @@
+package ssh
+
+import (
+	"context"
+	"errors"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+
+func TestHandshake_ContextDeadlineWrapped(t *testing.T) {
+	conn := dialSilentServer(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+
+	_, err := Handshake(ctx, conn, conn.RemoteAddr().String(), testClientConfig())
+	require.Error(t, err)
+	require.True(t, errors.Is(err, context.DeadlineExceeded), "expected context.DeadlineExceeded, got: %v", err)
+}
+
+func TestHandshake_ContextCancelUnblocks(t *testing.T) {
+	conn := dialSilentServer(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	time.AfterFunc(50*time.Millisecond, cancel)
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := Handshake(ctx, conn, conn.RemoteAddr().String(), testClientConfig())
+		errCh <- err
+	}()
+
+	select {
+	case err := <-errCh:
+		require.Error(t, err)
+		require.True(t, errors.Is(err, context.Canceled), "expected context.Canceled, got: %v", err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("handshake did not return after context cancellation")
+	}
+}
+
+func TestHandshake_NonContextErrorNotWrapped(t *testing.T) {
+	conn := dialSilentServer(t)
+	require.NoError(t, conn.Close())
+
+	_, err := Handshake(context.Background(), conn, conn.RemoteAddr().String(), testClientConfig())
+	require.Error(t, err)
+	require.False(t, errors.Is(err, context.Canceled))
+	require.False(t, errors.Is(err, context.DeadlineExceeded))
+}
+
+func testClientConfig() *ssh.ClientConfig {
+	return &ssh.ClientConfig{
+		User:            "test",
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+	}
+}
+
+// dialSilentServer returns a client conn to a server that accepts and never
+// sends anything, so the SSH handshake blocks until the context is done.
+func dialSilentServer(t *testing.T) net.Conn {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = listener.Close() })
+
+	done := make(chan struct{})
+	t.Cleanup(func() { close(done) })
+
+	go func() {
+		c, err := listener.Accept()
+		if err != nil {
+			return
+		}
+		defer func() { _ = c.Close() }()
+		<-done
+	}()
+
+	conn, err := net.Dial("tcp", listener.Addr().String())
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	return conn
+}
diff --git a/client/ssh/proxy/proxy.go b/client/ssh/proxy/proxy.go
index 73b50122c..070515b57 100644
--- a/client/ssh/proxy/proxy.go
+++ b/client/ssh/proxy/proxy.go
@@ -9,7 +9,6 @@ import (
 	"net"
 	"os"
 	"strconv"
-	"strings"
 	"sync"
 	"time"
 
@@ -17,8 +16,8 @@ import (
 	log "github.com/sirupsen/logrus"
 	cryptossh "golang.org/x/crypto/ssh"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
 
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 	nbssh "github.com/netbirdio/netbird/client/ssh"
@@ -55,8 +54,8 @@ type SSHProxy struct {
 }
 
 func New(daemonAddr, targetHost string, targetPort int, stderr io.Writer, browserOpener func(string) error) (*SSHProxy, error) {
-	grpcAddr := strings.TrimPrefix(daemonAddr, "tcp://")
-	grpcConn, err := grpc.NewClient(grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	target, opts := daemonaddr.DialTarget(daemonAddr)
+	grpcConn, err := grpc.NewClient(target, opts...)
 	if err != nil {
 		return nil, fmt.Errorf("connect to daemon: %w", err)
 	}
@@ -611,13 +610,10 @@ func (p *SSHProxy) dialBackend(ctx context.Context, addr, user, jwtToken string)
 		return nil, fmt.Errorf("connect to server: %w", err)
 	}
 
-	clientConn, chans, reqs, err := cryptossh.NewClientConn(conn, addr, config)
-	if err != nil {
-		_ = conn.Close()
-		return nil, fmt.Errorf("SSH handshake: %w", err)
-	}
+	handshakeCtx, cancel := context.WithTimeout(ctx, sshHandshakeTimeout)
+	defer cancel()
 
-	return cryptossh.NewClient(clientConn, chans, reqs), nil
+	return nbssh.Handshake(handshakeCtx, conn, addr, config)
 }
 
 func (p *SSHProxy) verifyHostKey(hostname string, remote net.Addr, key cryptossh.PublicKey) error {
diff --git a/client/ssh/server/command_execution.go b/client/ssh/server/command_execution.go
index b0a85fe4b..c8b3240d0 100644
--- a/client/ssh/server/command_execution.go
+++ b/client/ssh/server/command_execution.go
@@ -75,8 +75,8 @@ func (s *Server) createCommand(logger *log.Entry, privilegeResult PrivilegeCheck
 	}
 
 	// Try su first for system integration (PAM/audit) when privileged
-	cmd, err := s.createSuCommand(logger, session, localUser, hasPty)
-	if err != nil || privilegeResult.UsedFallback {
+	cmd, err := s.createSuCommand(logger, session, localUser, hasPty) //nolint:staticcheck
+	if err != nil || privilegeResult.UsedFallback {                   //nolint:staticcheck // always errors on platforms without su
 		logger.Debugf("su command failed, falling back to executor: %v", err)
 		cmd, cleanup, err := s.createExecutorCommand(logger, session, localUser, hasPty)
 		if err != nil {
diff --git a/client/ssh/server/command_execution_windows.go b/client/ssh/server/command_execution_windows.go
index e1ba777f6..feb8daa26 100644
--- a/client/ssh/server/command_execution_windows.go
+++ b/client/ssh/server/command_execution_windows.go
@@ -243,7 +243,7 @@ func (s *Server) setUserEnvironmentVariables(envMap map[string]string, userProfi
 
 // prepareCommandEnv prepares environment variables for command execution on Windows
 func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, session ssh.Session) []string {
-	username, domain := s.parseUsername(localUser.Username)
+	username, domain := parseUsername(localUser.Username)
 	userEnv, err := s.getUserEnvironment(logger, username, domain)
 	if err != nil {
 		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
@@ -383,7 +383,7 @@ func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _
 		return false
 	}
 
-	username, domain := s.parseUsername(localUser.Username)
+	username, domain := parseUsername(localUser.Username)
 	shell := getUserShell(localUser.Uid)
 
 	req := PtyExecutionRequest{
diff --git a/client/ssh/server/executor_windows.go b/client/ssh/server/executor_windows.go
index 51c995ec3..9c2969d5d 100644
--- a/client/ssh/server/executor_windows.go
+++ b/client/ssh/server/executor_windows.go
@@ -6,7 +6,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"os"
 	"os/exec"
 	"os/user"
 	"strings"
@@ -506,15 +505,37 @@ func userExists(fullUsername, username, domain string) error {
 	return nil
 }
 
-// isLocalUser determines if this is a local user vs domain user
+// isLocalUser reports whether domain refers to this machine rather than to a
+// Windows domain.
 func (pd *PrivilegeDropper) isLocalUser(domain string) bool {
-	hostname, err := os.Hostname()
-	if err != nil {
-		hostname = "localhost"
+	return isLocalDomain(domain, netbiosComputerName)
+}
+
+// isLocalDomain compares against the NetBIOS name because Windows qualifies local
+// accounts with it, and it is the DNS host name truncated to 15 characters.
+// An unknown name falls back to the domain path: treating it as local could
+// authenticate a same named local account instead.
+// https://learn.microsoft.com/en-us/windows/win32/sysinfo/computer-names
+func isLocalDomain(domain string, machineName func() (string, error)) bool {
+	if domain == "" || domain == "." {
+		return true
 	}
 
-	return domain == "" || domain == "." ||
-		strings.EqualFold(domain, hostname)
+	name, err := machineName()
+	if err != nil {
+		log.Debugf("read NetBIOS computer name: %v", err)
+		return false
+	}
+	return strings.EqualFold(domain, name)
+}
+
+func netbiosComputerName() (string, error) {
+	buf := make([]uint16, windows.MAX_COMPUTERNAME_LENGTH+1)
+	size := uint32(len(buf))
+	if err := windows.GetComputerNameEx(windows.ComputerNamePhysicalNetBIOS, &buf[0], &size); err != nil {
+		return "", fmt.Errorf("GetComputerNameEx: %w", err)
+	}
+	return windows.UTF16ToString(buf[:size]), nil
 }
 
 // authenticateLocalUser handles authentication for local users
diff --git a/client/ssh/server/executor_windows_test.go b/client/ssh/server/executor_windows_test.go
new file mode 100644
index 000000000..678ca22b7
--- /dev/null
+++ b/client/ssh/server/executor_windows_test.go
@@ -0,0 +1,48 @@
+//go:build windows
+
+package server
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+// Past 15 characters the DNS host name and the NetBIOS name differ, and Windows
+// qualifies local accounts with the NetBIOS one.
+func TestIsLocalDomain(t *testing.T) {
+	const dnsHostname = "WINTESTMACHINE01XYZ" // 19 characters
+	netbios := dnsHostname[:windows.MAX_COMPUTERNAME_LENGTH]
+	require.NotEqual(t, strings.ToLower(dnsHostname), strings.ToLower(netbios),
+		"a 19 character name must not equal its 15 character truncation")
+
+	name := func() (string, error) { return netbios, nil }
+	unreadable := func() (string, error) { return "", errors.New("name unavailable") }
+
+	tests := []struct {
+		name        string
+		domain      string
+		machineName func() (string, error)
+		want        bool
+	}{
+		{"empty_domain", "", unreadable, true},
+		{"dot_domain", ".", unreadable, true},
+		{"truncated_netbios_name", netbios, name, true},
+		{"netbios_name_lowercase", strings.ToLower(netbios), name, true},
+		{"untruncated_dns_host_name", dnsHostname, name, false},
+		{"real_domain", "CORP", name, false},
+		// Must not resolve to local: that could authenticate the wrong account.
+		{"unreadable_machine_name", netbios, unreadable, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isLocalDomain(tt.domain, tt.machineName),
+				"classification of domain %q", tt.domain)
+		})
+	}
+}
diff --git a/client/ssh/server/getent_cgo_unix.go b/client/ssh/server/getent_cgo_unix.go
deleted file mode 100644
index 4afbfc627..000000000
--- a/client/ssh/server/getent_cgo_unix.go
+++ /dev/null
@@ -1,24 +0,0 @@
-//go:build cgo && !osusergo && !windows
-
-package server
-
-import "os/user"
-
-// lookupWithGetent with CGO delegates directly to os/user.Lookup.
-// When CGO is enabled, os/user uses libc (getpwnam_r) which goes through
-// the NSS stack natively. If it fails, the user truly doesn't exist and
-// getent would also fail.
-func lookupWithGetent(username string) (*user.User, error) {
-	return user.Lookup(username)
-}
-
-// currentUserWithGetent with CGO delegates directly to os/user.Current.
-func currentUserWithGetent() (*user.User, error) {
-	return user.Current()
-}
-
-// groupIdsWithFallback with CGO delegates directly to user.GroupIds.
-// libc's getgrouplist handles NSS groups natively.
-func groupIdsWithFallback(u *user.User) ([]string, error) {
-	return u.GroupIds()
-}
diff --git a/client/ssh/server/getent_nocgo_unix.go b/client/ssh/server/getent_nocgo_unix.go
deleted file mode 100644
index 314daae4c..000000000
--- a/client/ssh/server/getent_nocgo_unix.go
+++ /dev/null
@@ -1,74 +0,0 @@
-//go:build (!cgo || osusergo) && !windows
-
-package server
-
-import (
-	"os"
-	"os/user"
-	"strconv"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// lookupWithGetent looks up a user by name, falling back to getent if os/user fails.
-// Without CGO, os/user only reads /etc/passwd and misses NSS-provided users.
-// getent goes through the host's NSS stack.
-func lookupWithGetent(username string) (*user.User, error) {
-	u, err := user.Lookup(username)
-	if err == nil {
-		return u, nil
-	}
-
-	stdErr := err
-	log.Debugf("os/user.Lookup(%q) failed, trying getent: %v", username, err)
-
-	u, _, getentErr := runGetent(username)
-	if getentErr != nil {
-		log.Debugf("getent fallback for %q also failed: %v", username, getentErr)
-		return nil, stdErr
-	}
-
-	return u, nil
-}
-
-// currentUserWithGetent gets the current user, falling back to getent if os/user fails.
-func currentUserWithGetent() (*user.User, error) {
-	u, err := user.Current()
-	if err == nil {
-		return u, nil
-	}
-
-	stdErr := err
-	uid := strconv.Itoa(os.Getuid())
-	log.Debugf("os/user.Current() failed, trying getent with UID %s: %v", uid, err)
-
-	u, _, getentErr := runGetent(uid)
-	if getentErr != nil {
-		return nil, stdErr
-	}
-
-	return u, nil
-}
-
-// groupIdsWithFallback gets group IDs for a user via the id command first,
-// falling back to user.GroupIds().
-// NOTE: unlike lookupWithGetent/currentUserWithGetent which try stdlib first,
-// this intentionally tries `id -G` first because without CGO, user.GroupIds()
-// only reads /etc/group and silently returns incomplete results for NSS users
-// (no error, just missing groups). The id command goes through NSS and returns
-// the full set.
-func groupIdsWithFallback(u *user.User) ([]string, error) {
-	ids, err := runIdGroups(u.Username)
-	if err == nil {
-		return ids, nil
-	}
-
-	log.Debugf("id -G %q failed, falling back to user.GroupIds(): %v", u.Username, err)
-
-	ids, stdErr := u.GroupIds()
-	if stdErr != nil {
-		return nil, stdErr
-	}
-
-	return ids, nil
-}
diff --git a/client/ssh/server/getent_unix.go b/client/ssh/server/getent_unix.go
deleted file mode 100644
index 18edb2fdf..000000000
--- a/client/ssh/server/getent_unix.go
+++ /dev/null
@@ -1,122 +0,0 @@
-//go:build !windows
-
-package server
-
-import (
-	"context"
-	"fmt"
-	"os/exec"
-	"os/user"
-	"runtime"
-	"strings"
-	"time"
-)
-
-const getentTimeout = 5 * time.Second
-
-// getShellFromGetent gets a user's login shell via getent by UID.
-// This is needed even with CGO because getShellFromPasswd reads /etc/passwd
-// directly and won't find NSS-provided users there.
-func getShellFromGetent(userID string) string {
-	_, shell, err := runGetent(userID)
-	if err != nil {
-		return ""
-	}
-	return shell
-}
-
-// runGetent executes `getent passwd <query>` and returns the user and login shell.
-func runGetent(query string) (*user.User, string, error) {
-	if !validateGetentInput(query) {
-		return nil, "", fmt.Errorf("invalid getent input: %q", query)
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), getentTimeout)
-	defer cancel()
-
-	out, err := exec.CommandContext(ctx, "getent", "passwd", query).Output()
-	if err != nil {
-		return nil, "", fmt.Errorf("getent passwd %s: %w", query, err)
-	}
-
-	return parseGetentPasswd(string(out))
-}
-
-// parseGetentPasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell"
-func parseGetentPasswd(output string) (*user.User, string, error) {
-	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
-	if len(fields) < 6 {
-		return nil, "", fmt.Errorf("unexpected getent output (need 6+ fields): %q", output)
-	}
-
-	if fields[0] == "" || fields[2] == "" || fields[3] == "" {
-		return nil, "", fmt.Errorf("missing required fields in getent output: %q", output)
-	}
-
-	var shell string
-	if len(fields) >= 7 {
-		shell = fields[6]
-	}
-
-	return &user.User{
-		Username: fields[0],
-		Uid:      fields[2],
-		Gid:      fields[3],
-		Name:     fields[4],
-		HomeDir:  fields[5],
-	}, shell, nil
-}
-
-// validateGetentInput checks that the input is safe to pass to getent or id.
-// Allows POSIX usernames, numeric UIDs, and common NSS extensions
-// (@ for Kerberos, $ for Samba, + for NIS compat).
-func validateGetentInput(input string) bool {
-	maxLen := 32
-	if runtime.GOOS == "linux" {
-		maxLen = 256
-	}
-
-	if len(input) == 0 || len(input) > maxLen {
-		return false
-	}
-
-	for _, r := range input {
-		if isAllowedGetentChar(r) {
-			continue
-		}
-		return false
-	}
-	return true
-}
-
-func isAllowedGetentChar(r rune) bool {
-	if r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' {
-		return true
-	}
-	switch r {
-	case '.', '_', '-', '@', '+', '$':
-		return true
-	}
-	return false
-}
-
-// runIdGroups runs `id -G <username>` and returns the space-separated group IDs.
-func runIdGroups(username string) ([]string, error) {
-	if !validateGetentInput(username) {
-		return nil, fmt.Errorf("invalid username for id command: %q", username)
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), getentTimeout)
-	defer cancel()
-
-	out, err := exec.CommandContext(ctx, "id", "-G", username).Output()
-	if err != nil {
-		return nil, fmt.Errorf("id -G %s: %w", username, err)
-	}
-
-	trimmed := strings.TrimSpace(string(out))
-	if trimmed == "" {
-		return nil, fmt.Errorf("id -G %s: empty output", username)
-	}
-	return strings.Fields(trimmed), nil
-}
diff --git a/client/ssh/server/getent_windows.go b/client/ssh/server/getent_windows.go
deleted file mode 100644
index 3e76b3e8e..000000000
--- a/client/ssh/server/getent_windows.go
+++ /dev/null
@@ -1,26 +0,0 @@
-//go:build windows
-
-package server
-
-import "os/user"
-
-// lookupWithGetent on Windows just delegates to os/user.Lookup.
-// Windows does not use NSS/getent; its user lookup works without CGO.
-func lookupWithGetent(username string) (*user.User, error) {
-	return user.Lookup(username)
-}
-
-// currentUserWithGetent on Windows just delegates to os/user.Current.
-func currentUserWithGetent() (*user.User, error) {
-	return user.Current()
-}
-
-// getShellFromGetent is a no-op on Windows; shell resolution uses PowerShell detection.
-func getShellFromGetent(_ string) string {
-	return ""
-}
-
-// groupIdsWithFallback on Windows just delegates to u.GroupIds().
-func groupIdsWithFallback(u *user.User) ([]string, error) {
-	return u.GroupIds()
-}
diff --git a/client/ssh/server/port_forwarding.go b/client/ssh/server/port_forwarding.go
index a47fdb48a..81d3b9173 100644
--- a/client/ssh/server/port_forwarding.go
+++ b/client/ssh/server/port_forwarding.go
@@ -133,7 +133,12 @@ func (s *Server) checkPrivilegedPortAccess(forwardType string, port uint32, resu
 		return nil
 	}
 
-	if result.User != nil && isPrivilegedUsername(result.User.Username) {
+	// Only uid 0 may bind below the threshold, which is the kernel's own rule and
+	// is asked directly rather than through isPrivilegedOrUnknown: that helper
+	// reports an account it cannot evaluate as privileged, which is safe for a
+	// refusal and unsafe for a grant such as this one. Windows has returned
+	// above, so Uid here is a Unix uid and never a SID.
+	if result.User != nil && result.User.Uid == "0" {
 		return nil
 	}
 
diff --git a/client/ssh/server/privileges_other.go b/client/ssh/server/privileges_other.go
new file mode 100644
index 000000000..89440dea8
--- /dev/null
+++ b/client/ssh/server/privileges_other.go
@@ -0,0 +1,16 @@
+//go:build !windows
+
+package server
+
+// isProcessElevated is only meaningful on Windows; other platforms use the
+// effective UID check in isCurrentProcessPrivileged.
+func isProcessElevated() bool {
+	return false
+}
+
+// isWindowsAccountPrivilegedOrUnknown is only reachable on Windows. Report
+// privileged on other platforms so a caller refusing privileged accounts fails
+// closed.
+func isWindowsAccountPrivilegedOrUnknown(string) bool {
+	return true
+}
diff --git a/client/ssh/server/privileges_windows.go b/client/ssh/server/privileges_windows.go
new file mode 100644
index 000000000..41ea00fd7
--- /dev/null
+++ b/client/ssh/server/privileges_windows.go
@@ -0,0 +1,228 @@
+//go:build windows
+
+package server
+
+import (
+	"fmt"
+	"strings"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+var (
+	netapi32                  = windows.NewLazySystemDLL("netapi32.dll")
+	procNetUserGetLocalGroups = netapi32.NewProc("NetUserGetLocalGroups")
+)
+
+const (
+	// lgIncludeIndirect makes NetUserGetLocalGroups also return local groups
+	// the user belongs to through a global group.
+	lgIncludeIndirect  = 0x1
+	maxPreferredLength = 0xFFFFFFFF
+)
+
+// localGroupUsersInfo0 mirrors LOCALGROUP_USERS_INFO_0.
+type localGroupUsersInfo0 struct {
+	name *uint16
+}
+
+// isProcessElevated reports whether the current process token is elevated
+// (TokenElevation): true for elevated administrators, the built-in
+// Administrator, administrators with UAC disabled, and SYSTEM; false for
+// standard users and administrators running with a UAC-filtered token.
+func isProcessElevated() bool {
+	return windows.GetCurrentProcessToken().IsElevated()
+}
+
+// isWindowsAccountPrivilegedOrUnknown reports whether the account is privileged
+// on this machine: a well-known service account, a built-in Administrator
+// (RID 500), or a member of the local Administrators group, directly or through
+// nested groups.
+//
+// An account whose privilege cannot be determined counts as privileged, which
+// is why the name says "or unknown". That is fail-closed for a caller that
+// refuses privileged accounts, and fail-open for a caller that grants something
+// to them, so only the former may use this.
+func isWindowsAccountPrivilegedOrUnknown(username string) bool {
+	sid, _, _, err := windows.LookupSID("", username)
+	if err != nil {
+		log.Warnf("privilege check: SID lookup for %q failed, treating as privileged: %v", username, err)
+		return true
+	}
+
+	if isPrivilegedUserSID(sid) {
+		return true
+	}
+
+	member, err := isLocalAdminsMember(username)
+	if err != nil {
+		log.Warnf("privilege check: cannot determine Administrators membership for %q, treating as privileged: %v", username, err)
+		return true
+	}
+	return member
+}
+
+// isPrivilegedUserSID reports whether the SID itself identifies a privileged
+// principal, without consulting group membership.
+func isPrivilegedUserSID(sid *windows.SID) bool {
+	wellKnown := []windows.WELL_KNOWN_SID_TYPE{
+		windows.WinLocalSystemSid,
+		windows.WinLocalServiceSid,
+		windows.WinNetworkServiceSid,
+		windows.WinBuiltinAdministratorsSid,
+	}
+	for _, sidType := range wellKnown {
+		if sid.IsWellKnown(sidType) {
+			return true
+		}
+	}
+	return isBuiltinAdministratorSID(sid)
+}
+
+// isBuiltinAdministratorSID reports whether the SID is a machine or domain
+// built-in Administrator account (S-1-5-21-...-500). RID 500 is reserved for
+// that account; it can be renamed but cannot be removed from the
+// Administrators group.
+func isBuiltinAdministratorSID(sid *windows.SID) bool {
+	if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
+		return false
+	}
+	count := sid.SubAuthorityCount()
+	if count < 2 || sid.SubAuthority(0) != 21 {
+		return false
+	}
+	return sid.SubAuthority(uint32(count-1)) == 500
+}
+
+// isLocalAdminsMember reports whether the account is a member of the local
+// Administrators group.
+//
+// Local accounts are checked against the local SAM, which is authoritative for
+// them and, unlike a token, cannot under-report: UAC filters the tokens of
+// local administrators, and a filtered token carries Administrators as
+// deny-only, which a membership check on the token would read as "not a
+// member". Domain accounts are exempt from that filtering, so for them an S4U
+// token is preferred because its group list is LSA's transitive expansion and
+// therefore covers nested and universal groups plus the machine's own local
+// groups. NetUserGetLocalGroups expands only one global-group hop but needs no
+// logon, so it serves as the fallback when no token can be obtained.
+func isLocalAdminsMember(username string) (bool, error) {
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	if err != nil {
+		return false, fmt.Errorf("create Administrators SID: %w", err)
+	}
+
+	account, domain := parseUsername(username)
+	if NewPrivilegeDropper().isLocalUser(domain) {
+		return localGroupsContainSID(account, adminSid)
+	}
+
+	member, s4uErr := s4uTokenIsMember(account, domain, adminSid)
+	if s4uErr == nil {
+		return member, nil
+	}
+	log.Debugf("privilege check: S4U membership check for %q failed, falling back to local group enumeration: %v", username, s4uErr)
+
+	member, err = localGroupsContainSID(buildUserCpn(account, domain), adminSid)
+	if err != nil {
+		return false, fmt.Errorf("S4U check: %w; local group enumeration: %w", s4uErr, err)
+	}
+	return member, nil
+}
+
+// s4uTokenIsMember obtains an S4U token for the account and checks whether the
+// given SID is enabled in it.
+func s4uTokenIsMember(account, domain string, sid *windows.SID) (bool, error) {
+	token, err := generateS4UUserToken(log.NewEntry(log.StandardLogger()), account, domain)
+	if err != nil {
+		return false, err
+	}
+	defer func() {
+		if err := windows.CloseHandle(token); err != nil {
+			log.Debugf("close S4U token: %v", err)
+		}
+	}()
+	return windows.Token(token).IsMember(sid)
+}
+
+// localGroupsContainSID reports whether the wanted group is among the local
+// groups the account belongs to, directly or through a global group.
+//
+// The wanted SID is resolved to its group name once and compared against the
+// enumerated names. Well-known SIDs resolve from a static table, so that lookup
+// needs no domain controller, and it keeps the comparison correct for a renamed
+// or localized group because both sides then carry the new name. Resolving each
+// enumerated name back to a SID instead would add a lookup per group that can
+// block until it times out while a domain controller is unreachable, and cannot
+// change the outcome: the names enumerated here are local groups of this
+// machine, whose names are unique, so a name match identifies the group.
+//
+// A failure to resolve the wanted SID is returned rather than reported as
+// "not a member", so a privilege check built on this fails closed.
+func localGroupsContainSID(username string, want *windows.SID) (bool, error) {
+	wantName, _, _, err := want.LookupAccount("")
+	if err != nil {
+		return false, fmt.Errorf("resolve group SID %s to a name: %w", want, err)
+	}
+
+	groups, err := netUserGetLocalGroups(username)
+	if err != nil {
+		return false, err
+	}
+
+	for _, group := range groups {
+		if strings.EqualFold(group, wantName) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// netUserGetLocalGroups returns the names of the local groups the account is a
+// member of, including indirect membership through global groups.
+func netUserGetLocalGroups(username string) ([]string, error) {
+	name16, err := windows.UTF16PtrFromString(username)
+	if err != nil {
+		return nil, fmt.Errorf("convert username: %w", err)
+	}
+
+	var buf *byte
+	var entriesRead, totalEntries uint32
+	status, _, _ := procNetUserGetLocalGroups.Call(
+		0, // local server
+		uintptr(unsafe.Pointer(name16)),
+		0, // level 0: LOCALGROUP_USERS_INFO_0
+		lgIncludeIndirect,
+		uintptr(unsafe.Pointer(&buf)),
+		maxPreferredLength,
+		uintptr(unsafe.Pointer(&entriesRead)),
+		uintptr(unsafe.Pointer(&totalEntries)),
+	)
+	if status != 0 {
+		return nil, fmt.Errorf("NetUserGetLocalGroups for %q: status %d", username, status)
+	}
+	if buf == nil {
+		return nil, nil
+	}
+	defer func() {
+		if err := windows.NetApiBufferFree(buf); err != nil {
+			log.Debugf("free NetApi buffer: %v", err)
+		}
+	}()
+
+	// MAX_PREFERRED_LENGTH makes the API allocate as much as it needs, so a
+	// short read is not expected. Report it rather than silently returning a
+	// subset of the account's groups.
+	if entriesRead != totalEntries {
+		return nil, fmt.Errorf("NetUserGetLocalGroups for %q returned %d of %d groups", username, entriesRead, totalEntries)
+	}
+
+	entries := unsafe.Slice((*localGroupUsersInfo0)(unsafe.Pointer(buf)), entriesRead)
+	groups := make([]string, 0, entriesRead)
+	for _, entry := range entries {
+		groups = append(groups, windows.UTF16PtrToString(entry.name))
+	}
+	return groups, nil
+}
diff --git a/client/ssh/server/privileges_windows_test.go b/client/ssh/server/privileges_windows_test.go
new file mode 100644
index 000000000..983fccdf7
--- /dev/null
+++ b/client/ssh/server/privileges_windows_test.go
@@ -0,0 +1,293 @@
+//go:build windows
+
+package server
+
+import (
+	"os/user"
+	"testing"
+	"unsafe"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+// filterNormalAccount limits NetUserEnum to normal user accounts.
+const filterNormalAccount = 0x2
+
+// TOKEN_ELEVATION_TYPE values.
+const (
+	tokenElevationTypeDefault = 1
+	tokenElevationTypeFull    = 2
+	tokenElevationTypeLimited = 3
+)
+
+// tokenElevationType reads TokenElevationType from a token.
+func tokenElevationType(token windows.Token) (uint32, error) {
+	var elevationType, returnedLen uint32
+	err := windows.GetTokenInformation(token, windows.TokenElevationType,
+		(*byte)(unsafe.Pointer(&elevationType)), uint32(unsafe.Sizeof(elevationType)), &returnedLen)
+	if err != nil {
+		return 0, err
+	}
+	return elevationType, nil
+}
+
+// userInfo0 mirrors USER_INFO_0.
+type userInfo0 struct {
+	name *uint16
+}
+
+func mustParseSID(t *testing.T, s string) *windows.SID {
+	t.Helper()
+	sid, err := windows.StringToSid(s)
+	require.NoError(t, err, "parse SID %s", s)
+	return sid
+}
+
+// localAccountNames returns the names of the local user accounts.
+func localAccountNames(t *testing.T) []string {
+	t.Helper()
+
+	var buf *byte
+	var entriesRead, totalEntries, resume uint32
+	err := windows.NetUserEnum(nil, 0, filterNormalAccount, &buf, maxPreferredLength,
+		&entriesRead, &totalEntries, &resume)
+	require.NoError(t, err, "enumerate local users")
+	t.Cleanup(func() {
+		require.NoError(t, windows.NetApiBufferFree(buf), "free NetApi buffer")
+	})
+
+	entries := unsafe.Slice((*userInfo0)(unsafe.Pointer(buf)), entriesRead)
+	names := make([]string, 0, entriesRead)
+	for _, entry := range entries {
+		names = append(names, windows.UTF16PtrToString(entry.name))
+	}
+	return names
+}
+
+// localAccountNameByRID returns the name of the local account carrying the
+// given RID. Accounts such as Administrator and Guest can be renamed and are
+// localized, so tests must not name them literally.
+func localAccountNameByRID(t *testing.T, rid uint32) string {
+	t.Helper()
+
+	for _, name := range localAccountNames(t) {
+		sid, _, _, err := windows.LookupSID("", name)
+		if err != nil {
+			continue
+		}
+		if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
+			continue
+		}
+		count := sid.SubAuthorityCount()
+		if count < 2 || sid.SubAuthority(0) != 21 {
+			continue
+		}
+		if sid.SubAuthority(uint32(count-1)) == rid {
+			return name
+		}
+	}
+
+	t.Fatalf("no local account with RID %d", rid)
+	return ""
+}
+
+// wellKnownAccountName resolves a well-known SID to the qualified account name
+// the local system uses for it, which is localized.
+func wellKnownAccountName(t *testing.T, sidType windows.WELL_KNOWN_SID_TYPE) string {
+	t.Helper()
+
+	sid, err := windows.CreateWellKnownSid(sidType)
+	require.NoError(t, err, "create well-known SID")
+	name, domain, _, err := sid.LookupAccount("")
+	require.NoError(t, err, "resolve %s to an account name", sid)
+	if domain == "" {
+		return name
+	}
+	return domain + `\` + name
+}
+
+func TestIsBuiltinAdministratorSID(t *testing.T) {
+	tests := []struct {
+		name string
+		sid  string
+		want bool
+	}{
+		{"machine_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
+		{"domain_administrator", "S-1-5-21-3390233681-4087452608-412898826-500", true},
+		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
+		{"guest_account", "S-1-5-21-1111111111-2222222222-3333333333-501", false},
+		{"domain_admins_group", "S-1-5-21-1111111111-2222222222-3333333333-512", false},
+		{"system", "S-1-5-18", false},
+		{"administrators_group", "S-1-5-32-544", false},
+		{"non_nt_authority", "S-1-1-0", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isBuiltinAdministratorSID(mustParseSID(t, tt.sid))
+			assert.Equal(t, tt.want, result, "RID 500 detection for %s", tt.sid)
+		})
+	}
+}
+
+func TestIsPrivilegedUserSID(t *testing.T) {
+	tests := []struct {
+		name string
+		sid  string
+		want bool
+	}{
+		{"local_system", "S-1-5-18", true},
+		{"local_service", "S-1-5-19", true},
+		{"network_service", "S-1-5-20", true},
+		{"administrators_group", "S-1-5-32-544", true},
+		{"builtin_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
+		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
+		{"users_group", "S-1-5-32-545", false},
+		{"everyone", "S-1-1-0", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isPrivilegedUserSID(mustParseSID(t, tt.sid))
+			assert.Equal(t, tt.want, result, "SID privilege classification for %s", tt.sid)
+		})
+	}
+}
+
+func TestIsWindowsAccountPrivilegedOrUnknown(t *testing.T) {
+	tests := []struct {
+		name     string
+		username string
+		want     bool
+	}{
+		{"system", wellKnownAccountName(t, windows.WinLocalSystemSid), true},
+		{"local_service", wellKnownAccountName(t, windows.WinLocalServiceSid), true},
+		{"network_service", wellKnownAccountName(t, windows.WinNetworkServiceSid), true},
+		{"administrators_group", wellKnownAccountName(t, windows.WinBuiltinAdministratorsSid), true},
+		// The built-in Administrator (RID 500) and Guest (RID 501) accounts
+		// exist on every Windows installation, though they may be disabled.
+		{"builtin_administrator", localAccountNameByRID(t, 500), true},
+		{"guest", localAccountNameByRID(t, 501), false},
+		// Unresolvable accounts fail closed.
+		{"nonexistent_user", "netbird-no-such-user", true},
+		{"empty_username", "", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isWindowsAccountPrivilegedOrUnknown(tt.username)
+			assert.Equal(t, tt.want, result, "account privilege classification for %q", tt.username)
+		})
+	}
+}
+
+func TestIsProcessElevated(t *testing.T) {
+	elevated := isProcessElevated()
+
+	// TokenElevationType is a second, independent view of the same token:
+	// Full means elevated and Limited means a filtered administrator, while
+	// Default covers both a standard user and an administrator with no linked
+	// token (UAC off, the built-in Administrator, SYSTEM), so it implies nothing.
+	elevationType, err := tokenElevationType(windows.GetCurrentProcessToken())
+	require.NoError(t, err, "read token elevation type")
+
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	// Token(0) makes CheckTokenMembership evaluate the caller's own token. It
+	// counts only enabled SIDs, so a filtered administrator reports false here.
+	member, err := windows.Token(0).IsMember(adminSid)
+	require.NoError(t, err, "check own Administrators membership")
+
+	t.Logf("elevated=%v elevationType=%d memberOfAdministrators=%v", elevated, elevationType, member)
+
+	switch elevationType {
+	case tokenElevationTypeFull:
+		assert.True(t, elevated, "a token of elevation type Full must report elevated")
+	case tokenElevationTypeLimited:
+		assert.False(t, elevated, "a filtered administrator token must not report elevated")
+	}
+
+	// Administrators enabled in the token means the token wields administrative
+	// rights, which is what elevation reports.
+	if member {
+		assert.True(t, elevated, "token with enabled Administrators membership must report elevated")
+	}
+}
+
+// TestS4UMembershipAgreesWithLocalGroups exercises the S4U token path used
+// for domain accounts. S4U logons need the TCB privilege, so the test runs
+// only as SYSTEM (which is how CI executes the suite). For local accounts the
+// token's Administrators membership must agree with the SAM enumeration.
+func TestS4UMembershipAgreesWithLocalGroups(t *testing.T) {
+	system, err := windows.CreateWellKnownSid(windows.WinLocalSystemSid)
+	require.NoError(t, err, "create SYSTEM SID")
+	current, err := user.Current()
+	require.NoError(t, err, "get current user")
+	if current.Uid != system.String() {
+		t.Skipf("S4U logon requires SYSTEM (running as %s)", current.Username)
+	}
+
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	checked := 0
+	for _, name := range localAccountNames(t) {
+		viaToken, err := s4uTokenIsMember(name, ".", adminSid)
+		if err != nil {
+			// Disabled or logon-restricted accounts cannot get an S4U logon.
+			t.Logf("skipping %s: %v", name, err)
+			continue
+		}
+		viaSAM, err := localGroupsContainSID(name, adminSid)
+		require.NoError(t, err, "enumerate local groups for %s", name)
+
+		assert.Equal(t, viaSAM, viaToken, "S4U token and SAM enumeration must agree on Administrators membership for %s", name)
+		checked++
+	}
+	// Ineligible accounts are skipped, so without this the test could report
+	// success while comparing nothing at all.
+	require.Positive(t, checked, "no local account completed an S4U logon, so nothing was compared")
+	t.Logf("checked %d local accounts via S4U", checked)
+}
+
+// TestLocalGroupsContainSID_Administrator checks the positive case against the
+// built-in Administrator, a member of Administrators on every installation.
+func TestLocalGroupsContainSID_Administrator(t *testing.T) {
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	administrator := localAccountNameByRID(t, 500)
+	member, err := localGroupsContainSID(administrator, adminSid)
+	require.NoError(t, err, "enumerate local groups for %s", administrator)
+	assert.True(t, member, "%s is a member of the Administrators group", administrator)
+}
+
+// TestLocalGroupsContainSID_UnresolvableGroupFailsClosed covers a wanted SID
+// that resolves to no group: the error must surface rather than being reported
+// as "not a member", so the privilege check treats the account as privileged.
+func TestLocalGroupsContainSID_UnresolvableGroupFailsClosed(t *testing.T) {
+	unknown := mustParseSID(t, "S-1-5-21-1111111111-2222222222-3333333333-4444")
+
+	_, err := localGroupsContainSID(localAccountNameByRID(t, 500), unknown)
+	require.Error(t, err, "must report an error when the wanted group cannot be identified")
+}
+
+func TestLocalGroupsContainSID_Guest(t *testing.T) {
+	guestsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinGuestsSid)
+	require.NoError(t, err, "create Guests SID")
+	adminsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	guest := localAccountNameByRID(t, 501)
+
+	inGuests, err := localGroupsContainSID(guest, guestsSid)
+	require.NoError(t, err, "enumerate local groups for %s", guest)
+	assert.True(t, inGuests, "%s is a member of the Guests group", guest)
+
+	inAdmins, err := localGroupsContainSID(guest, adminsSid)
+	require.NoError(t, err, "enumerate local groups for %s", guest)
+	assert.False(t, inAdmins, "%s is not a member of the Administrators group", guest)
+}
diff --git a/client/ssh/server/server.go b/client/ssh/server/server.go
index 6735e0f3b..b32da796e 100644
--- a/client/ssh/server/server.go
+++ b/client/ssh/server/server.go
@@ -197,6 +197,12 @@ type Config struct {
 
 	// HostKey is the SSH server host key in PEM format
 	HostKeyPEM []byte
+
+	// Auth is the fine-grained authorization to open with. Nil starts with an
+	// empty authorizer, which authorizes nobody until UpdateSSHAuth is called.
+	// Setting it here rather than afterwards means the server never accepts a
+	// login before it knows who is allowed.
+	Auth *sshauth.Config
 }
 
 // SessionInfo contains information about an active SSH session
@@ -220,7 +226,11 @@ func New(config *Config) *Server {
 		connections:            make(map[connKey]*connState),
 		jwtEnabled:             config.JWT != nil,
 		jwtConfig:              config.JWT,
-		authorizer:             sshauth.NewAuthorizer(), // Initialize with empty config
+		authorizer:             sshauth.NewAuthorizer(),
+	}
+
+	if config.Auth != nil {
+		s.authorizer.Update(config.Auth)
 	}
 
 	return s
@@ -461,6 +471,27 @@ func (s *Server) UpdateSSHAuth(config *sshauth.Config) {
 	s.authorizer.Update(config)
 }
 
+// JWTConfig returns the JWT authentication this server was built with, or nil
+// when JWT authentication is disabled.
+func (s *Server) JWTConfig() *JWTConfig {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.jwtConfig
+}
+
+// AuthConfig returns the fine-grained authorization currently in force, or nil
+// when the server has no authorizer.
+func (s *Server) AuthConfig() *sshauth.Config {
+	s.mu.RLock()
+	authorizer := s.authorizer
+	s.mu.RUnlock()
+
+	if authorizer == nil {
+		return nil
+	}
+	return authorizer.Config()
+}
+
 // ensureJWTValidator initializes the JWT validator and extractor if not already initialized
 func (s *Server) ensureJWTValidator() error {
 	s.mu.RLock()
diff --git a/client/ssh/server/server_config_test.go b/client/ssh/server/server_config_test.go
index f70e29963..983bd7a43 100644
--- a/client/ssh/server/server_config_test.go
+++ b/client/ssh/server/server_config_test.go
@@ -239,6 +239,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 		forwardType   string
 		port          uint32
 		username      string
+		uid           string
 		expectError   bool
 		errorMsg      string
 		skipOnWindows bool
@@ -248,6 +249,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "remote",
 			port:          80,
 			username:      "testuser",
+			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -257,6 +259,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "tcpip-forward",
 			port:          443,
 			username:      "testuser",
+			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -266,6 +269,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        8080,
 			username:    "testuser",
+			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -273,6 +277,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        0,
 			username:    "testuser",
+			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -280,13 +285,35 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        22,
 			username:    "root",
+			uid:         "0",
 			expectError: false,
 		},
+		{
+			// Only uid 0 is privileged, whatever the account is called.
+			name:          "uid 0 under another name may bind a privileged port",
+			forwardType:   "remote",
+			port:          22,
+			username:      "toor",
+			uid:           "0",
+			expectError:   false,
+			skipOnWindows: true,
+		},
+		{
+			name:          "account named root without uid 0 may not",
+			forwardType:   "remote",
+			port:          22,
+			username:      "root",
+			uid:           "1000",
+			expectError:   true,
+			errorMsg:      "cannot bind to privileged port",
+			skipOnWindows: true,
+		},
 		{
 			name:        "local forward privileged port allowed for non-root",
 			forwardType: "local",
 			port:        80,
 			username:    "testuser",
+			uid:         "1000",
 			expectError: false,
 		},
 	}
@@ -299,7 +326,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 
 			result := PrivilegeCheckResult{
 				Allowed: true,
-				User:    &user.User{Username: tt.username},
+				User:    &user.User{Username: tt.username, Uid: tt.uid},
 			}
 
 			err := server.checkPrivilegedPortAccess(tt.forwardType, tt.port, result)
@@ -420,6 +447,13 @@ func TestServer_PortConflictHandling(t *testing.T) {
 
 func TestServer_IsPrivilegedUser(t *testing.T) {
 
+	// Windows classification depends on account SIDs and group membership, and
+	// the accounts involved carry localized, renameable names. It is covered by
+	// TestIsWindowsAccountPrivileged, which resolves them from well-known SIDs.
+	if runtime.GOOS == "windows" {
+		t.Skip("covered by TestIsWindowsAccountPrivileged")
+	}
+
 	tests := []struct {
 		username    string
 		expected    bool
@@ -440,44 +474,16 @@ func TestServer_IsPrivilegedUser(t *testing.T) {
 			expected:    false,
 			description: "empty username should not be privileged",
 		},
-	}
-
-	// Add Windows-specific tests
-	if runtime.GOOS == "windows" {
-		tests = append(tests, []struct {
-			username    string
-			expected    bool
-			description string
-		}{
-			{
-				username:    "Administrator",
-				expected:    true,
-				description: "Administrator should be considered privileged on Windows",
-			},
-			{
-				username:    "administrator",
-				expected:    true,
-				description: "administrator should be considered privileged on Windows (case insensitive)",
-			},
-		}...)
-	} else {
-		// On non-Windows systems, Administrator should not be privileged
-		tests = append(tests, []struct {
-			username    string
-			expected    bool
-			description string
-		}{
-			{
-				username:    "Administrator",
-				expected:    false,
-				description: "Administrator should not be privileged on non-Windows systems",
-			},
-		}...)
+		{
+			username:    "Administrator",
+			expected:    false,
+			description: "Administrator should not be privileged on non-Windows systems",
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.description, func(t *testing.T) {
-			result := isPrivilegedUsername(tt.username)
+			result := isPrivilegedOrUnknown(tt.username)
 			assert.Equal(t, tt.expected, result, tt.description)
 		})
 	}
diff --git a/client/ssh/server/sftp_windows.go b/client/ssh/server/sftp_windows.go
index dc532b9e7..25cd17298 100644
--- a/client/ssh/server/sftp_windows.go
+++ b/client/ssh/server/sftp_windows.go
@@ -17,7 +17,7 @@ import (
 // createSftpCommand creates a Windows SFTP command with user switching.
 // The caller must close the returned token handle after starting the process.
 func (s *Server) createSftpCommand(targetUser *user.User, sess ssh.Session) (*exec.Cmd, windows.Token, error) {
-	username, domain := s.parseUsername(targetUser.Username)
+	username, domain := parseUsername(targetUser.Username)
 
 	netbirdPath, err := os.Executable()
 	if err != nil {
diff --git a/client/ssh/server/shell.go b/client/ssh/server/shell.go
index 1e8ff5e31..7b356b2a0 100644
--- a/client/ssh/server/shell.go
+++ b/client/ssh/server/shell.go
@@ -13,6 +13,8 @@ import (
 
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/getent"
 )
 
 const (
@@ -56,7 +58,11 @@ func getUnixUserShell(userID string) string {
 		return shell
 	}
 
-	if shell := getShellFromGetent(userID); shell != "" {
+	shell, err := getent.UserShell(userID)
+	if err != nil {
+		log.Debugf("look up the shell for uid %s through getent: %v", userID, err)
+	}
+	if shell != "" {
 		return shell
 	}
 
diff --git a/client/ssh/server/shell_unix_test.go b/client/ssh/server/shell_unix_test.go
new file mode 100644
index 000000000..c5e65e535
--- /dev/null
+++ b/client/ssh/server/shell_unix_test.go
@@ -0,0 +1,94 @@
+//go:build !windows
+
+package server
+
+import (
+	"os/exec"
+	"os/user"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/getent"
+)
+
+// TestGetShellFromPasswd_CurrentUser verifies that getShellFromPasswd correctly
+// reads the current user's shell from /etc/passwd by comparing it against what
+// getent reports (which goes through NSS).
+func TestGetShellFromPasswd_CurrentUser(t *testing.T) {
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	shell := getShellFromPasswd(current.Uid)
+	if shell == "" {
+		t.Skip("current user not found in /etc/passwd (may be an NSS-only user)")
+	}
+
+	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
+
+	if _, err := exec.LookPath("getent"); err == nil {
+		getentShell, getentErr := getent.UserShell(current.Uid)
+		if getentErr == nil && getentShell != "" {
+			assert.Equal(t, getentShell, shell, "shell from /etc/passwd should match getent")
+		}
+	}
+}
+
+// TestGetShellFromPasswd_RootUser verifies that getShellFromPasswd can read
+// root's shell from /etc/passwd. Root is guaranteed to be in /etc/passwd on
+// any standard Unix system.
+func TestGetShellFromPasswd_RootUser(t *testing.T) {
+	shell := getShellFromPasswd("0")
+	require.NotEmpty(t, shell, "root (UID 0) must be in /etc/passwd")
+	assert.True(t, shell[0] == '/', "root shell should be an absolute path, got %q", shell)
+}
+
+// TestGetShellFromPasswd_NonexistentUID verifies that getShellFromPasswd
+// returns empty for a UID that doesn't exist in /etc/passwd.
+func TestGetShellFromPasswd_NonexistentUID(t *testing.T) {
+	shell := getShellFromPasswd("4294967294")
+	assert.Empty(t, shell, "nonexistent UID should return empty shell")
+}
+
+// TestGetShellFromPasswd_MatchesGetentForKnownUsers reads /etc/passwd directly
+// and cross-validates every entry against getent to ensure the two shell
+// sources agree.
+func TestGetShellFromPasswd_MatchesGetentForKnownUsers(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available")
+	}
+
+	// Pick a few well-known system UIDs that are virtually always in /etc/passwd.
+	uids := []string{"0"} // root
+
+	current, err := user.Current()
+	require.NoError(t, err)
+	uids = append(uids, current.Uid)
+
+	for _, uid := range uids {
+		passwdShell := getShellFromPasswd(uid)
+		if passwdShell == "" {
+			continue
+		}
+
+		getentShell, err := getent.UserShell(uid)
+		if err != nil {
+			continue
+		}
+
+		assert.Equal(t, getentShell, passwdShell, "shell mismatch for UID %s", uid)
+	}
+}
+
+// TestIntegration_ShellLookupChain tests the full shell resolution chain
+// (getShellFromPasswd -> getent -> $SHELL -> default).
+func TestIntegration_ShellLookupChain(t *testing.T) {
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	// getUserShell is the top-level function used by the SSH server.
+	shell := getUserShell(current.Uid)
+	require.NotEmpty(t, shell, "getUserShell must always return a shell")
+	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
+}
diff --git a/client/ssh/server/test.go b/client/ssh/server/test.go
index 454d3afa3..7ca28f034 100644
--- a/client/ssh/server/test.go
+++ b/client/ssh/server/test.go
@@ -1,3 +1,11 @@
+// This file is intentionally named test.go (not test_test.go) so the exported
+// StartTestServer helper is visible to the ssh/proxy and ssh/client external
+// test packages, not just this package's own tests. The //go:build !js tag
+// keeps its "testing" import, along with the whole testing/flag/regexp
+// transitive chain it drags in, out of the wasm client, which links
+// ssh/server through the engine but never runs Go tests under GOOS=js.
+//go:build !js
+
 package server
 
 import (
diff --git a/client/ssh/server/user_utils.go b/client/ssh/server/user_utils.go
index bc2aa2d7d..f2f33b3d7 100644
--- a/client/ssh/server/user_utils.go
+++ b/client/ssh/server/user_utils.go
@@ -9,6 +9,8 @@ import (
 	"strings"
 
 	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/getent"
 )
 
 var (
@@ -16,19 +18,17 @@ var (
 	ErrPrivilegedUserSwitch = errors.New("cannot switch to privileged user - current user lacks required privileges")
 )
 
-// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
-func isPlatformUnix() bool {
-	return getCurrentOS() != "windows"
-}
-
 // Dependency injection variables for testing - allows mocking dynamic runtime checks
 var (
-	getCurrentUser         = currentUserWithGetent
-	lookupUser             = lookupWithGetent
+	getCurrentUser         = getent.CurrentUser
+	lookupUser             = getent.LookupUser
 	getCurrentOS           = func() string { return runtime.GOOS }
 	getIsProcessPrivileged = isCurrentProcessPrivileged
 
 	getEuid = os.Geteuid
+
+	getProcessElevated                   = isProcessElevated
+	getWindowsAccountPrivilegedOrUnknown = isWindowsAccountPrivilegedOrUnknown
 )
 
 const (
@@ -65,6 +65,13 @@ type PrivilegeCheckResult struct {
 	RequiresUserSwitching bool
 }
 
+// privilegeCheckContext holds all context needed for privilege checking
+type privilegeCheckContext struct {
+	currentUser           *user.User
+	currentUserPrivileged bool
+	allowRoot             bool
+}
+
 // CheckPrivileges performs comprehensive privilege checking for all SSH features.
 // This is the single source of truth for privilege decisions across the SSH server.
 func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult {
@@ -75,7 +82,7 @@ func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult
 
 	// Handle empty username case - but still check root access controls
 	if req.RequestedUsername == "" {
-		if isPrivilegedUsername(context.currentUser.Username) && !context.allowRoot {
+		if isPrivilegedOrUnknown(context.currentUser.Username) && !context.allowRoot {
 			return PrivilegeCheckResult{
 				Allowed: false,
 				Error:   &PrivilegedUserError{Username: context.currentUser.Username},
@@ -135,7 +142,7 @@ func (s *Server) checkUserRequest(ctx *privilegeCheckContext, req PrivilegeCheck
 
 	needsUserSwitching := !isSameResolvedUser(resolvedUser, ctx.currentUser)
 
-	if isPrivilegedUsername(resolvedUser.Username) && !ctx.allowRoot {
+	if isPrivilegedOrUnknown(resolvedUser.Username) && !ctx.allowRoot {
 		return PrivilegeCheckResult{
 			Allowed:               false,
 			Error:                 &PrivilegedUserError{Username: resolvedUser.Username},
@@ -175,6 +182,42 @@ func (s *Server) resolveRequestedUser(requestedUsername string) (*user.User, err
 	return u, nil
 }
 
+// SetAllowRootLogin configures root login access
+func (s *Server) SetAllowRootLogin(allow bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.allowRootLogin = allow
+}
+
+// userNameLookup performs user lookup with root login permission check
+func (s *Server) userNameLookup(username string) (*user.User, error) {
+	result, err := s.userPrivilegeCheck(username)
+	if err != nil {
+		return nil, err
+	}
+	return result.User, nil
+}
+
+// userPrivilegeCheck performs user lookup with full privilege check result
+func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return result, result.Error
+	}
+
+	return result, nil
+}
+
+// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
+func isPlatformUnix() bool {
+	return getCurrentOS() != "windows"
+}
+
 // isSameResolvedUser compares two resolved user identities
 func isSameResolvedUser(user1, user2 *user.User) bool {
 	if user1 == nil || user2 == nil {
@@ -183,13 +226,6 @@ func isSameResolvedUser(user1, user2 *user.User) bool {
 	return user1.Uid == user2.Uid
 }
 
-// privilegeCheckContext holds all context needed for privilege checking
-type privilegeCheckContext struct {
-	currentUser           *user.User
-	currentUserPrivileged bool
-	allowRoot             bool
-}
-
 // isSameUser checks if two usernames refer to the same user
 // SECURITY: This function must be conservative - it should only return true
 // when we're certain both usernames refer to the exact same user identity
@@ -253,159 +289,30 @@ func isWindowsSameUser(requestedUsername, currentUsername string) bool {
 	return strings.EqualFold(reqDomain, curDomain)
 }
 
-// SetAllowRootLogin configures root login access
-func (s *Server) SetAllowRootLogin(allow bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.allowRootLogin = allow
-}
-
-// userNameLookup performs user lookup with root login permission check
-func (s *Server) userNameLookup(username string) (*user.User, error) {
-	result := s.CheckPrivileges(PrivilegeCheckRequest{
-		RequestedUsername:         username,
-		FeatureSupportsUserSwitch: true,
-		FeatureName:               FeatureSSHLogin,
-	})
-
-	if !result.Allowed {
-		return nil, result.Error
-	}
-
-	return result.User, nil
-}
-
-// userPrivilegeCheck performs user lookup with full privilege check result
-func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
-	result := s.CheckPrivileges(PrivilegeCheckRequest{
-		RequestedUsername:         username,
-		FeatureSupportsUserSwitch: true,
-		FeatureName:               FeatureSSHLogin,
-	})
-
-	if !result.Allowed {
-		return result, result.Error
-	}
-
-	return result, nil
-}
-
-// isPrivilegedUsername checks if the given username represents a privileged user across platforms.
-// On Unix: root
-// On Windows: Administrator, SYSTEM (case-insensitive)
-// Handles domain-qualified usernames like "DOMAIN\Administrator" or "user@domain.com"
-func isPrivilegedUsername(username string) bool {
+// isPrivilegedOrUnknown reports whether the given username represents a
+// privileged user, or on Windows an account whose privilege could not be
+// determined.
+// On Unix: root.
+// On Windows: well-known service accounts, built-in Administrator accounts,
+// and members of the local Administrators group; handles domain-qualified
+// usernames like "DOMAIN\user" or "user@domain.com". An account that cannot be
+// resolved or evaluated is reported as privileged.
+//
+// Use this to refuse privileged accounts, never to grant them anything: the
+// undetermined case is safe for a refusal and unsafe for a grant.
+func isPrivilegedOrUnknown(username string) bool {
 	if getCurrentOS() != "windows" {
 		return username == "root"
 	}
-
-	bareUsername := username
-	// Handle Windows domain format: DOMAIN\username
-	if idx := strings.LastIndex(username, `\`); idx != -1 {
-		bareUsername = username[idx+1:]
-	}
-	// Handle email-style format: username@domain.com
-	if idx := strings.Index(bareUsername, "@"); idx != -1 {
-		bareUsername = bareUsername[:idx]
-	}
-
-	return isWindowsPrivilegedUser(bareUsername)
-}
-
-// isWindowsPrivilegedUser checks if a bare username (domain already stripped) represents a Windows privileged account
-func isWindowsPrivilegedUser(bareUsername string) bool {
-	// common privileged usernames (case insensitive)
-	privilegedNames := []string{
-		"administrator",
-		"admin",
-		"root",
-		"system",
-		"localsystem",
-		"networkservice",
-		"localservice",
-	}
-
-	usernameLower := strings.ToLower(bareUsername)
-	for _, privilegedName := range privilegedNames {
-		if usernameLower == privilegedName {
-			return true
-		}
-	}
-
-	// computer accounts (ending with $) are not privileged by themselves
-	// They only gain privileges through group membership or specific SIDs
-
-	if targetUser, err := lookupUser(bareUsername); err == nil {
-		return isWindowsPrivilegedSID(targetUser.Uid)
-	}
-
-	return false
-}
-
-// isWindowsPrivilegedSID checks if a Windows SID represents a privileged account
-func isWindowsPrivilegedSID(sid string) bool {
-	privilegedSIDs := []string{
-		"S-1-5-18",     // Local System (SYSTEM)
-		"S-1-5-19",     // Local Service (NT AUTHORITY\LOCAL SERVICE)
-		"S-1-5-20",     // Network Service (NT AUTHORITY\NETWORK SERVICE)
-		"S-1-5-32-544", // Administrators group (BUILTIN\Administrators)
-		"S-1-5-500",    // Built-in Administrator account (local machine RID 500)
-	}
-
-	for _, privilegedSID := range privilegedSIDs {
-		if sid == privilegedSID {
-			return true
-		}
-	}
-
-	// Check for domain administrator accounts (RID 500 in any domain)
-	// Format: S-1-5-21-domain-domain-domain-500
-	// This is reliable as RID 500 is reserved for the domain Administrator account
-	if strings.HasPrefix(sid, "S-1-5-21-") && strings.HasSuffix(sid, "-500") {
-		return true
-	}
-
-	// Check for other well-known privileged RIDs in domain contexts
-	// RID 512 = Domain Admins group, RID 516 = Domain Controllers group
-	if strings.HasPrefix(sid, "S-1-5-21-") {
-		if strings.HasSuffix(sid, "-512") || // Domain Admins group
-			strings.HasSuffix(sid, "-516") || // Domain Controllers group
-			strings.HasSuffix(sid, "-519") { // Enterprise Admins group
-			return true
-		}
-	}
-
-	return false
+	return getWindowsAccountPrivilegedOrUnknown(username)
 }
 
 // isCurrentProcessPrivileged checks if the current process is running with elevated privileges.
 // On Unix systems, this means running as root (UID 0).
-// On Windows, this means running as Administrator or SYSTEM.
+// On Windows, this means the process token is elevated (administrators, SYSTEM).
 func isCurrentProcessPrivileged() bool {
 	if getCurrentOS() == "windows" {
-		return isWindowsElevated()
+		return getProcessElevated()
 	}
 	return getEuid() == 0
 }
-
-// isWindowsElevated checks if the current process is running with elevated privileges on Windows
-func isWindowsElevated() bool {
-	currentUser, err := getCurrentUser()
-	if err != nil {
-		log.Errorf("failed to get current user for privilege check, assuming non-privileged: %v", err)
-		return false
-	}
-
-	if isWindowsPrivilegedSID(currentUser.Uid) {
-		log.Debugf("Windows user switching supported: running as privileged SID %s", currentUser.Uid)
-		return true
-	}
-
-	if isPrivilegedUsername(currentUser.Username) {
-		log.Debugf("Windows user switching supported: running as privileged username %s", currentUser.Username)
-		return true
-	}
-
-	log.Debugf("Windows user switching not supported: not running as privileged user (current: %s)", currentUser.Uid)
-	return false
-}
diff --git a/client/ssh/server/user_utils_test.go b/client/ssh/server/user_utils_test.go
index 637dc10d0..2fa9b68ee 100644
--- a/client/ssh/server/user_utils_test.go
+++ b/client/ssh/server/user_utils_test.go
@@ -4,6 +4,7 @@ import (
 	"errors"
 	"os/user"
 	"runtime"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -27,8 +28,8 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 	originalLookupUser := lookupUser
 	originalGetCurrentOS := getCurrentOS
 	originalGetEuid := getEuid
-
-	// Reset caches to ensure clean test state
+	originalGetProcessElevated := getProcessElevated
+	originalGetWindowsAccountPrivilegedOrUnknown := getWindowsAccountPrivilegedOrUnknown
 
 	// Set test values - inject platform dependencies
 	getCurrentUser = func() (*user.User, error) {
@@ -53,16 +54,31 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		return euid
 	}
 
-	// Mock privilege detection based on the test user
-	getIsProcessPrivileged = func() bool {
+	// Simulate the Windows token elevation check based on the fixture user:
+	// the built-in Administrator (RID 500) and SYSTEM run elevated.
+	getProcessElevated = func() bool {
 		if currentUser == nil {
 			return false
 		}
-		// Check both username and SID for Windows systems
-		if os == "windows" && isWindowsPrivilegedSID(currentUser.Uid) {
+		return currentUser.Uid == "S-1-5-18" || strings.HasSuffix(currentUser.Uid, "-500")
+	}
+
+	// Simulate the Windows account classifier for the fixture accounts.
+	// "root" does not exist on Windows; the real classifier fails closed on
+	// unresolvable accounts, so it counts as privileged here too.
+	getWindowsAccountPrivilegedOrUnknown = func(username string) bool {
+		bare := username
+		if idx := strings.LastIndex(bare, `\`); idx != -1 {
+			bare = bare[idx+1:]
+		}
+		if idx := strings.Index(bare, "@"); idx != -1 {
+			bare = bare[:idx]
+		}
+		switch strings.ToLower(bare) {
+		case "administrator", "system", "root":
 			return true
 		}
-		return isPrivilegedUsername(currentUser.Username)
+		return false
 	}
 
 	// Return cleanup function
@@ -71,10 +87,8 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		lookupUser = originalLookupUser
 		getCurrentOS = originalGetCurrentOS
 		getEuid = originalGetEuid
-
-		getIsProcessPrivileged = isCurrentProcessPrivileged
-
-		// Reset caches after test
+		getProcessElevated = originalGetProcessElevated
+		getWindowsAccountPrivilegedOrUnknown = originalGetWindowsAccountPrivilegedOrUnknown
 	}
 }
 
@@ -421,6 +435,9 @@ func TestUsedFallback_MeansNoPrivilegeDropping(t *testing.T) {
 }
 
 func TestPrivilegedUsernameDetection(t *testing.T) {
+	// Windows classification is syscall-backed (SID resolution, group
+	// membership) and is covered by privileges_windows_test.go; here only the
+	// Unix logic and the platform dispatch are exercised.
 	tests := []struct {
 		name       string
 		username   string
@@ -432,25 +449,9 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 		{"unix_regular_user", "alice", "linux", false},
 		{"unix_root_capital", "Root", "linux", false}, // Case-sensitive
 
-		// Windows tests
+		// Windows dispatch to the (mocked) account classifier
 		{"windows_administrator", "Administrator", "windows", true},
-		{"windows_system", "SYSTEM", "windows", true},
-		{"windows_admin", "admin", "windows", true},
-		{"windows_admin_lowercase", "administrator", "windows", true}, // Case-insensitive
-		{"windows_domain_admin", "DOMAIN\\Administrator", "windows", true},
-		{"windows_email_admin", "admin@domain.com", "windows", true},
 		{"windows_regular_user", "alice", "windows", false},
-		{"windows_domain_user", "DOMAIN\\alice", "windows", false},
-		{"windows_localsystem", "localsystem", "windows", true},
-		{"windows_networkservice", "networkservice", "windows", true},
-		{"windows_localservice", "localservice", "windows", true},
-
-		// Computer accounts (these depend on current user context in real implementation)
-		{"windows_computer_account", "WIN2K19-C2$", "windows", false},      // Computer account by itself not privileged
-		{"windows_domain_computer", "DOMAIN\\COMPUTER$", "windows", false}, // Domain computer account
-
-		// Cross-platform
-		{"root_on_windows", "root", "windows", true}, // Root should be privileged everywhere
 	}
 
 	for _, tt := range tests {
@@ -459,50 +460,8 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 			cleanup := setupTestDependencies(nil, nil, tt.platform, 1000, nil, nil)
 			defer cleanup()
 
-			result := isPrivilegedUsername(tt.username)
-			assert.Equal(t, tt.privileged, result)
-		})
-	}
-}
-
-func TestWindowsPrivilegedSIDDetection(t *testing.T) {
-	tests := []struct {
-		name        string
-		sid         string
-		privileged  bool
-		description string
-	}{
-		// Well-known system accounts
-		{"system_account", "S-1-5-18", true, "Local System (SYSTEM)"},
-		{"local_service", "S-1-5-19", true, "Local Service"},
-		{"network_service", "S-1-5-20", true, "Network Service"},
-		{"administrators_group", "S-1-5-32-544", true, "Administrators group"},
-		{"builtin_administrator", "S-1-5-500", true, "Built-in Administrator"},
-
-		// Domain accounts
-		{"domain_administrator", "S-1-5-21-1234567890-1234567890-1234567890-500", true, "Domain Administrator (RID 500)"},
-		{"domain_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-512", true, "Domain Admins group"},
-		{"domain_controllers_group", "S-1-5-21-1234567890-1234567890-1234567890-516", true, "Domain Controllers group"},
-		{"enterprise_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-519", true, "Enterprise Admins group"},
-
-		// Regular users
-		{"regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1001", false, "Regular domain user"},
-		{"another_regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1234", false, "Another regular user"},
-		{"local_user", "S-1-5-21-1234567890-1234567890-1234567890-1000", false, "Local regular user"},
-
-		// Groups that are not privileged
-		{"domain_users", "S-1-5-21-1234567890-1234567890-1234567890-513", false, "Domain Users group"},
-		{"power_users", "S-1-5-32-547", false, "Power Users group"},
-
-		// Invalid SIDs
-		{"malformed_sid", "S-1-5-invalid", false, "Malformed SID"},
-		{"empty_sid", "", false, "Empty SID"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isWindowsPrivilegedSID(tt.sid)
-			assert.Equal(t, tt.privileged, result, "Failed for %s: %s", tt.description, tt.sid)
+			result := isPrivilegedOrUnknown(tt.username)
+			assert.Equal(t, tt.privileged, result, "privilege classification for %s on %s", tt.username, tt.platform)
 		})
 	}
 }
diff --git a/client/ssh/server/userswitching_unix.go b/client/ssh/server/userswitching_unix.go
index 220e2240f..ae60ec64c 100644
--- a/client/ssh/server/userswitching_unix.go
+++ b/client/ssh/server/userswitching_unix.go
@@ -16,6 +16,8 @@ import (
 
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/getent"
 )
 
 // POSIX portable filename character set regex: [a-zA-Z0-9._-]
@@ -160,7 +162,7 @@ func (s *Server) parseUserCredentials(localUser *user.User) (uint32, uint32, []u
 // getSupplementaryGroups retrieves supplementary group IDs for a user.
 // Uses id/getent fallback for NSS users in CGO_ENABLED=0 builds.
 func (s *Server) getSupplementaryGroups(u *user.User) ([]uint32, error) {
-	groupIDStrings, err := groupIdsWithFallback(u)
+	groupIDStrings, err := getent.GroupIDs(u)
 	if err != nil {
 		return nil, fmt.Errorf("get group IDs for user %s: %w", u.Username, err)
 	}
diff --git a/client/ssh/server/userswitching_windows.go b/client/ssh/server/userswitching_windows.go
index 260e1301e..9e8cd5b30 100644
--- a/client/ssh/server/userswitching_windows.go
+++ b/client/ssh/server/userswitching_windows.go
@@ -91,7 +91,7 @@ func validateUsernameFormat(username string) error {
 func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, localUser *user.User, hasPty bool) (*exec.Cmd, func(), error) {
 	logger.Debugf("creating Windows executor command for user %s (Pty: %v)", localUser.Username, hasPty)
 
-	username, _ := s.parseUsername(localUser.Username)
+	username, _ := parseUsername(localUser.Username)
 	if err := validateUsername(username); err != nil {
 		return nil, nil, fmt.Errorf("invalid username %q: %w", username, err)
 	}
@@ -102,7 +102,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 // createUserSwitchCommand creates a command with Windows user switching.
 // Returns the command and a cleanup function that must be called after starting the process.
 func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session, localUser *user.User) (*exec.Cmd, func(), error) {
-	username, domain := s.parseUsername(localUser.Username)
+	username, domain := parseUsername(localUser.Username)
 
 	shell := getUserShell(localUser.Uid)
 
@@ -138,7 +138,7 @@ func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session,
 }
 
 // parseUsername extracts username and domain from a Windows username
-func (s *Server) parseUsername(fullUsername string) (username, domain string) {
+func parseUsername(fullUsername string) (username, domain string) {
 	// Handle DOMAIN\username format
 	if idx := strings.LastIndex(fullUsername, `\`); idx != -1 {
 		domain = fullUsername[:idx]
diff --git a/client/ssh/session.go b/client/ssh/session.go
new file mode 100644
index 000000000..999b6f251
--- /dev/null
+++ b/client/ssh/session.go
@@ -0,0 +1,84 @@
+package ssh
+
+import (
+	"fmt"
+	"io"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/crypto/ssh"
+)
+
+// DefaultTerminalModes are the PTY modes used by the interactive terminal clients.
+var DefaultTerminalModes = ssh.TerminalModes{
+	ssh.ECHO:          1,
+	ssh.TTY_OP_ISPEED: 14400,
+	ssh.TTY_OP_OSPEED: 14400,
+	ssh.VINTR:         3,   // Ctrl+C
+	ssh.VQUIT:         28,  // Ctrl+\
+	ssh.VERASE:        127, // Backspace
+	ssh.VKILL:         21,  // Ctrl+U
+	ssh.VEOF:          4,   // Ctrl+D
+	ssh.VEOL:          0,
+	ssh.VEOL2:         0,
+	ssh.VSTART:        17, // Ctrl+Q
+	ssh.VSTOP:         19, // Ctrl+S
+	ssh.VSUSP:         26, // Ctrl+Z
+	ssh.VDISCARD:      15, // Ctrl+O
+	ssh.VREPRINT:      18, // Ctrl+R
+	ssh.VWERASE:       23, // Ctrl+W
+	ssh.VLNEXT:        22, // Ctrl+V
+}
+
+// PTYSession is an interactive shell session with a PTY and its I/O pipes.
+type PTYSession struct {
+	Session *ssh.Session
+	Stdin   io.WriteCloser
+	Stdout  io.Reader
+	Stderr  io.Reader
+}
+
+// StartPTYSession opens a session on the client, requests an xterm-256color PTY
+// with the default terminal modes, wires up the I/O pipes and starts a shell.
+// The session is closed on any error.
+func StartPTYSession(client *ssh.Client, cols, rows int) (*PTYSession, error) {
+	session, err := client.NewSession()
+	if err != nil {
+		return nil, fmt.Errorf("new session: %w", err)
+	}
+
+	pty, err := setupPTYSession(session, cols, rows)
+	if err != nil {
+		if closeErr := session.Close(); closeErr != nil {
+			log.Debugf("ssh: session close after setup error: %v", closeErr)
+		}
+		return nil, err
+	}
+	return pty, nil
+}
+
+// setupPTYSession requests the PTY, opens the pipes and starts the shell on an
+// already created session.
+func setupPTYSession(session *ssh.Session, cols, rows int) (*PTYSession, error) {
+	if err := session.RequestPty("xterm-256color", rows, cols, DefaultTerminalModes); err != nil {
+		return nil, fmt.Errorf("request pty: %w", err)
+	}
+
+	stdin, err := session.StdinPipe()
+	if err != nil {
+		return nil, fmt.Errorf("stdin pipe: %w", err)
+	}
+	stdout, err := session.StdoutPipe()
+	if err != nil {
+		return nil, fmt.Errorf("stdout pipe: %w", err)
+	}
+	stderr, err := session.StderrPipe()
+	if err != nil {
+		return nil, fmt.Errorf("stderr pipe: %w", err)
+	}
+
+	if err := session.Shell(); err != nil {
+		return nil, fmt.Errorf("start shell: %w", err)
+	}
+
+	return &PTYSession{Session: session, Stdin: stdin, Stdout: stdout, Stderr: stderr}, nil
+}
diff --git a/client/status/status.go b/client/status/status.go
index 5b815aaa3..e0585b8f0 100644
--- a/client/status/status.go
+++ b/client/status/status.go
@@ -46,7 +46,10 @@ func ParseDaemonStatus(s string) DaemonStatus {
 
 // ConvertOptions holds parameters for ConvertToStatusOutputOverview.
 type ConvertOptions struct {
-	Anonymize            bool
+	Anonymize bool
+	// AnonymizeLevel selects how much the anonymizer redacts. Only
+	// meaningful when Anonymize is set.
+	AnonymizeLevel       anonymize.Level
 	DaemonVersion        string
 	DaemonStatus         DaemonStatus
 	StatusFilter         string
@@ -55,6 +58,10 @@ type ConvertOptions struct {
 	IPsFilter            map[string]struct{}
 	ConnectionTypeFilter string
 	ProfileName          string
+	// SessionExpiresAt is the absolute UTC instant at which the peer's SSO
+	// session expires. Zero when the peer is not SSO-tracked or login
+	// expiration is disabled. Sourced from StatusResponse.SessionExpiresAt.
+	SessionExpiresAt time.Time
 }
 
 type PeerStateDetailOutput struct {
@@ -133,28 +140,32 @@ type SSHServerStateOutput struct {
 }
 
 type OutputOverview struct {
-	Peers                   PeersStateOutput           `json:"peers" yaml:"peers"`
-	CliVersion              string                     `json:"cliVersion" yaml:"cliVersion"`
-	DaemonVersion           string                     `json:"daemonVersion" yaml:"daemonVersion"`
-	DaemonStatus            DaemonStatus               `json:"daemonStatus" yaml:"daemonStatus"`
-	ManagementState         ManagementStateOutput      `json:"management" yaml:"management"`
-	SignalState             SignalStateOutput          `json:"signal" yaml:"signal"`
-	Relays                  RelayStateOutput           `json:"relays" yaml:"relays"`
-	IP                      string                     `json:"netbirdIp" yaml:"netbirdIp"`
-	IPv6                    string                     `json:"netbirdIpv6,omitempty" yaml:"netbirdIpv6,omitempty"`
-	PubKey                  string                     `json:"publicKey" yaml:"publicKey"`
-	KernelInterface         bool                       `json:"usesKernelInterface" yaml:"usesKernelInterface"`
-	WgPort                  int                        `json:"wireguardPort" yaml:"wireguardPort"`
-	FQDN                    string                     `json:"fqdn" yaml:"fqdn"`
-	RosenpassEnabled        bool                       `json:"quantumResistance" yaml:"quantumResistance"`
-	RosenpassPermissive     bool                       `json:"quantumResistancePermissive" yaml:"quantumResistancePermissive"`
-	Networks                []string                   `json:"networks" yaml:"networks"`
-	NumberOfForwardingRules int                        `json:"forwardingRules" yaml:"forwardingRules"`
-	NSServerGroups          []NsServerGroupStateOutput `json:"dnsServers" yaml:"dnsServers"`
-	Events                  []SystemEventOutput        `json:"events" yaml:"events"`
-	LazyConnectionEnabled   bool                       `json:"lazyConnectionEnabled" yaml:"lazyConnectionEnabled"`
-	ProfileName             string                     `json:"profileName" yaml:"profileName"`
-	SSHServerState          SSHServerStateOutput       `json:"sshServer" yaml:"sshServer"`
+	Peers                 PeersStateOutput           `json:"peers" yaml:"peers"`
+	CliVersion            string                     `json:"cliVersion" yaml:"cliVersion"`
+	DaemonVersion         string                     `json:"daemonVersion" yaml:"daemonVersion"`
+	DaemonStatus          DaemonStatus               `json:"daemonStatus" yaml:"daemonStatus"`
+	ManagementState       ManagementStateOutput      `json:"management" yaml:"management"`
+	SignalState           SignalStateOutput          `json:"signal" yaml:"signal"`
+	Relays                RelayStateOutput           `json:"relays" yaml:"relays"`
+	IP                    string                     `json:"netbirdIp" yaml:"netbirdIp"`
+	IPv6                  string                     `json:"netbirdIpv6,omitempty" yaml:"netbirdIpv6,omitempty"`
+	PubKey                string                     `json:"publicKey" yaml:"publicKey"`
+	KernelInterface       bool                       `json:"usesKernelInterface" yaml:"usesKernelInterface"`
+	WgPort                int                        `json:"wireguardPort" yaml:"wireguardPort"`
+	FQDN                  string                     `json:"fqdn" yaml:"fqdn"`
+	RosenpassEnabled      bool                       `json:"quantumResistance" yaml:"quantumResistance"`
+	RosenpassPermissive   bool                       `json:"quantumResistancePermissive" yaml:"quantumResistancePermissive"`
+	Networks              []string                   `json:"networks" yaml:"networks"`
+	NSServerGroups        []NsServerGroupStateOutput `json:"dnsServers" yaml:"dnsServers"`
+	Events                []SystemEventOutput        `json:"events" yaml:"events"`
+	LazyConnectionEnabled bool                       `json:"lazyConnectionEnabled" yaml:"lazyConnectionEnabled"`
+	ProfileName           string                     `json:"profileName" yaml:"profileName"`
+	SSHServerState        SSHServerStateOutput       `json:"sshServer" yaml:"sshServer"`
+	// SessionExpiresAt is the absolute UTC instant at which the peer's SSO
+	// session expires. nil when the peer is not SSO-tracked or login
+	// expiration is disabled. Pointer (rather than zero-value time.Time) so
+	// JSON / YAML omit the field entirely with `,omitempty`.
+	SessionExpiresAt *time.Time `json:"sessionExpiresAt,omitempty" yaml:"sessionExpiresAt,omitempty"`
 }
 
 // ConvertToStatusOutputOverview converts protobuf status to the output overview.
@@ -178,32 +189,36 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 	peersOverview := mapPeers(pbFullStatus.GetPeers(), opts.StatusFilter, opts.PrefixNamesFilter, opts.PrefixNamesFilterMap, opts.IPsFilter, opts.ConnectionTypeFilter)
 
 	overview := OutputOverview{
-		Peers:                   peersOverview,
-		CliVersion:              version.NetbirdVersion(),
-		DaemonVersion:           opts.DaemonVersion,
-		DaemonStatus:            opts.DaemonStatus,
-		ManagementState:         managementOverview,
-		SignalState:             signalOverview,
-		Relays:                  relayOverview,
-		IP:                      pbFullStatus.GetLocalPeerState().GetIP(),
-		IPv6:                    pbFullStatus.GetLocalPeerState().GetIpv6(),
-		PubKey:                  pbFullStatus.GetLocalPeerState().GetPubKey(),
-		KernelInterface:         pbFullStatus.GetLocalPeerState().GetKernelInterface(),
-		WgPort:                  int(pbFullStatus.GetLocalPeerState().GetWgPort()),
-		FQDN:                    pbFullStatus.GetLocalPeerState().GetFqdn(),
-		RosenpassEnabled:        pbFullStatus.GetLocalPeerState().GetRosenpassEnabled(),
-		RosenpassPermissive:     pbFullStatus.GetLocalPeerState().GetRosenpassPermissive(),
-		Networks:                pbFullStatus.GetLocalPeerState().GetNetworks(),
-		NumberOfForwardingRules: int(pbFullStatus.GetNumberOfForwardingRules()),
-		NSServerGroups:          mapNSGroups(pbFullStatus.GetDnsServers()),
-		Events:                  mapEvents(pbFullStatus.GetEvents()),
-		LazyConnectionEnabled:   pbFullStatus.GetLazyConnectionEnabled(),
-		ProfileName:             opts.ProfileName,
-		SSHServerState:          sshServerOverview,
+		Peers:                 peersOverview,
+		CliVersion:            version.NetbirdVersion(),
+		DaemonVersion:         opts.DaemonVersion,
+		DaemonStatus:          opts.DaemonStatus,
+		ManagementState:       managementOverview,
+		SignalState:           signalOverview,
+		Relays:                relayOverview,
+		IP:                    pbFullStatus.GetLocalPeerState().GetIP(),
+		IPv6:                  pbFullStatus.GetLocalPeerState().GetIpv6(),
+		PubKey:                pbFullStatus.GetLocalPeerState().GetPubKey(),
+		KernelInterface:       pbFullStatus.GetLocalPeerState().GetKernelInterface(),
+		WgPort:                int(pbFullStatus.GetLocalPeerState().GetWgPort()),
+		FQDN:                  pbFullStatus.GetLocalPeerState().GetFqdn(),
+		RosenpassEnabled:      pbFullStatus.GetLocalPeerState().GetRosenpassEnabled(),
+		RosenpassPermissive:   pbFullStatus.GetLocalPeerState().GetRosenpassPermissive(),
+		Networks:              pbFullStatus.GetLocalPeerState().GetNetworks(),
+		NSServerGroups:        mapNSGroups(pbFullStatus.GetDnsServers()),
+		Events:                mapEvents(pbFullStatus.GetEvents()),
+		LazyConnectionEnabled: pbFullStatus.GetLazyConnectionEnabled(),
+		ProfileName:           opts.ProfileName,
+		SSHServerState:        sshServerOverview,
+	}
+	if !opts.SessionExpiresAt.IsZero() {
+		t := opts.SessionExpiresAt
+		overview.SessionExpiresAt = &t
 	}
 
 	if opts.Anonymize {
 		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+		anonymizer.SetLevel(opts.AnonymizeLevel)
 		anonymizeOverview(anonymizer, &overview)
 	}
 
@@ -547,9 +562,13 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 
 	peersCountString := fmt.Sprintf("%d/%d Connected", o.Peers.Connected, o.Peers.Total)
 
-	var forwardingRulesString string
-	if o.NumberOfForwardingRules > 0 {
-		forwardingRulesString = fmt.Sprintf("Forwarding rules: %d\n", o.NumberOfForwardingRules)
+	var sessionExpiryString string
+	if o.SessionExpiresAt != nil && !o.SessionExpiresAt.IsZero() {
+		sessionExpiryString = fmt.Sprintf(
+			"Session expires: %s (in %s)\n",
+			o.SessionExpiresAt.Format(time.RFC3339),
+			FormatRemainingDuration(time.Until(*o.SessionExpiresAt)),
+		)
 	}
 
 	goos := runtime.GOOS
@@ -611,7 +630,7 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		lazyConnectionEnabledStatus,
 		sshServerStatus,
 		networks,
-		forwardingRulesString,
+		sessionExpiryString,
 		peersCountString,
 	)
 	return summary
@@ -663,7 +682,6 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 	pbFullStatus.LocalPeerState.RosenpassPermissive = fullStatus.RosenpassState.Permissive
 	pbFullStatus.LocalPeerState.RosenpassEnabled = fullStatus.RosenpassState.Enabled
 	pbFullStatus.LocalPeerState.Networks = maps.Keys(fullStatus.LocalPeerState.Routes)
-	pbFullStatus.NumberOfForwardingRules = int32(fullStatus.NumOfForwardingRules)
 	pbFullStatus.LazyConnectionEnabled = fullStatus.LazyConnectionEnabled
 
 	for _, peerState := range fullStatus.Peers {
@@ -722,6 +740,8 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
 	}
 
+	pbFullStatus.Events = fullStatus.Events
+
 	return &pbFullStatus
 }
 
@@ -950,6 +970,7 @@ func timeAgo(t time.Time) string {
 
 func anonymizePeerDetail(a *anonymize.Anonymizer, peer *PeerStateDetailOutput) {
 	peer.FQDN = a.AnonymizeDomain(peer.FQDN)
+	peer.PubKey = a.AnonymizeWGKey(peer.PubKey)
 	if localIP, port, err := net.SplitHostPort(peer.IceCandidateEndpoint.Local); err == nil {
 		peer.IceCandidateEndpoint.Local = fmt.Sprintf("%s:%s", a.AnonymizeIPString(localIP), port)
 	}
@@ -981,6 +1002,7 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 	overview.SignalState.URL = a.AnonymizeURI(overview.SignalState.URL)
 	overview.SignalState.Error = a.AnonymizeString(overview.SignalState.Error)
 
+	overview.PubKey = a.AnonymizeWGKey(overview.PubKey)
 	overview.IP = a.AnonymizeIPString(overview.IP)
 	overview.IPv6 = a.AnonymizeIPString(overview.IPv6)
 	for i, detail := range overview.Relays.Details {
@@ -1025,3 +1047,57 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 		overview.SSHServerState.Sessions[i].Command = a.AnonymizeString(session.Command)
 	}
 }
+
+// FormatRemainingDuration renders a time.Duration for the "Session expires"
+// line. Examples: "2h 15m", "47m 12s", "8s", "expired 3m ago".
+//
+// Granularity drops to seconds only under a minute, otherwise minutes are
+// the smallest unit shown — sub-minute precision is noise for a deadline
+// that's hours or days out.
+func FormatRemainingDuration(d time.Duration) string {
+	if d <= 0 {
+		return "expired " + HumaniseDuration(-d) + " ago"
+	}
+	return HumaniseDuration(d)
+}
+
+// HumaniseDuration renders a positive duration in compact form (e.g.
+// "2h 15m", "47m", "8s"). Exposed alongside FormatRemainingDuration so
+// callers that don't need the "expired … ago" wording can format
+// positive durations directly.
+func HumaniseDuration(d time.Duration) string {
+	if d < time.Minute {
+		s := int(d.Round(time.Second).Seconds())
+		if s < 1 {
+			s = 1
+		}
+		return fmt.Sprintf("%ds", s)
+	}
+
+	const (
+		day    = 24 * time.Hour
+		hour   = time.Hour
+		minute = time.Minute
+	)
+
+	days := int64(d / day)
+	d -= time.Duration(days) * day
+	hours := int64(d / hour)
+	d -= time.Duration(hours) * hour
+	minutes := int64(d / minute)
+
+	switch {
+	case days > 0:
+		if hours == 0 {
+			return fmt.Sprintf("%dd", days)
+		}
+		return fmt.Sprintf("%dd %dh", days, hours)
+	case hours > 0:
+		if minutes == 0 {
+			return fmt.Sprintf("%dh", hours)
+		}
+		return fmt.Sprintf("%dh %dm", hours, minutes)
+	default:
+		return fmt.Sprintf("%dm", minutes)
+	}
+}
diff --git a/client/status/status_test.go b/client/status/status_test.go
index 44fc30baf..1580aca6d 100644
--- a/client/status/status_test.go
+++ b/client/status/status_test.go
@@ -378,7 +378,6 @@ func TestParsingToJSON(t *testing.T) {
           "networks": [
             "10.10.0.0/24"
           ],
-          "forwardingRules": 0,
           "dnsServers": [
             {
               "servers": [
@@ -496,7 +495,6 @@ quantumResistance: false
 quantumResistancePermissive: false
 networks:
     - 10.10.0.0/24
-forwardingRules: 0
 dnsServers:
     - servers:
         - 8.8.8.8:53
@@ -648,6 +646,53 @@ func TestTimeAgo(t *testing.T) {
 	}
 }
 
+func TestHumaniseDuration(t *testing.T) {
+	cases := []struct {
+		in   time.Duration
+		want string
+	}{
+		{0, "1s"},
+		{500 * time.Millisecond, "1s"},
+		{8 * time.Second, "8s"},
+		{59 * time.Second, "59s"},
+		{time.Minute, "1m"},
+		{47*time.Minute + 12*time.Second, "47m"},
+		{time.Hour, "1h"},
+		{2*time.Hour + 15*time.Minute, "2h 15m"},
+		{2 * time.Hour, "2h"},
+		{24 * time.Hour, "1d"},
+		{2*24*time.Hour + 3*time.Hour, "2d 3h"},
+	}
+	for _, tc := range cases {
+		got := HumaniseDuration(tc.in)
+		assert.Equal(t, tc.want, got, "input %s", tc.in)
+	}
+}
+
+func TestFormatRemainingDuration_Expired(t *testing.T) {
+	assert.Equal(t, "expired 3m ago", FormatRemainingDuration(-3*time.Minute))
+	assert.Equal(t, "expired 1s ago", FormatRemainingDuration(-500*time.Millisecond))
+}
+
+func TestSessionExpiresLineRendered(t *testing.T) {
+	in := overview // copy of the package-level fixture
+	deadline := time.Now().Add(2*time.Hour + 30*time.Minute).UTC()
+	in.SessionExpiresAt = &deadline
+
+	out := in.GeneralSummary(false, false, false, false)
+	assert.Contains(t, out, "Session expires: ")
+	assert.Contains(t, out, deadline.Format(time.RFC3339))
+	// 2h 30m drifts to "2h 29m" within 60s — match the family prefix.
+	assert.Contains(t, out, "(in 2h ")
+}
+
+func TestSessionExpiresLineOmittedWhenNil(t *testing.T) {
+	in := overview
+	in.SessionExpiresAt = nil
+	out := in.GeneralSummary(false, false, false, false)
+	assert.NotContains(t, out, "Session expires")
+}
+
 func TestMapRelaysTransport(t *testing.T) {
 	out := mapRelays([]*proto.RelayState{
 		{URI: "rels://relay.example:443", Available: true, Transport: "quic"},
diff --git a/client/system/info.go b/client/system/info.go
index 1838204b8..c64093cb2 100644
--- a/client/system/info.go
+++ b/client/system/info.go
@@ -11,6 +11,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc/metadata"
 
+	"github.com/netbirdio/netbird/shared/management/certposture"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -61,10 +62,12 @@ type Info struct {
 	SystemManufacturer string
 	Environment        Environment
 	Files              []File // for posture checks
+	CertificateProofs  []certposture.Proof
 
 	RosenpassEnabled    bool
 	RosenpassPermissive bool
 	ServerSSHAllowed    bool
+	RemoteJobsAllowed   bool
 
 	DisableClientRoutes bool
 	DisableServerRoutes bool
@@ -79,21 +82,27 @@ type Info struct {
 	EnableSSHLocalPortForwarding  bool
 	EnableSSHRemotePortForwarding bool
 	DisableSSHAuth                bool
+
+	SyncMessageVersion *int
 }
 
 func (i *Info) SetFlags(
 	rosenpassEnabled, rosenpassPermissive bool,
 	serverSSHAllowed *bool,
 	disableClientRoutes, disableServerRoutes,
-	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6 bool,
+	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6 bool, syncMessageVersion *int,
 	enableSSHRoot, enableSSHSFTP, enableSSHLocalPortForwarding, enableSSHRemotePortForwarding *bool,
 	disableSSHAuth *bool,
+	remoteJobsAllowed *bool,
 ) {
 	i.RosenpassEnabled = rosenpassEnabled
 	i.RosenpassPermissive = rosenpassPermissive
 	if serverSSHAllowed != nil {
 		i.ServerSSHAllowed = *serverSSHAllowed
 	}
+	if remoteJobsAllowed != nil {
+		i.RemoteJobsAllowed = *remoteJobsAllowed
+	}
 
 	i.DisableClientRoutes = disableClientRoutes
 	i.DisableServerRoutes = disableServerRoutes
@@ -103,6 +112,8 @@ func (i *Info) SetFlags(
 	i.BlockInbound = blockInbound
 	i.DisableIPv6 = disableIPv6
 
+	i.SyncMessageVersion = syncMessageVersion
+
 	if enableSSHRoot != nil {
 		i.EnableSSHRoot = *enableSSHRoot
 	}
@@ -195,12 +206,27 @@ func GetInfoWithChecks(ctx context.Context, checks []*proto.Checks, excludeIPs .
 // The buffered channel lets the abandoned goroutine finish and exit once its blocking call
 // returns, so it does not leak beyond the duration of that call.
 func GetInfoWithChecksTimeout(ctx context.Context, timeout time.Duration, checks []*proto.Checks, excludeIPs ...netip.Addr) (*Info, bool) {
+	return getInfoWithChecksTimeout(ctx, timeout, checks, nil, excludeIPs...)
+}
+
+// gatherInfoWithChecks is the gathering getInfoWithChecksTimeout bounds. Tests replace it
+// to control when a gathering finishes.
+var gatherInfoWithChecks = GetInfoWithChecks
+
+// getInfoWithChecksTimeout is GetInfoWithChecksTimeout that calls done, when not nil, once
+// the gathering is over: on return when it finished in time, else when the goroutine
+// exits, which may be well after the timeout. done may be called twice and must be
+// idempotent.
+func getInfoWithChecksTimeout(ctx context.Context, timeout time.Duration, checks []*proto.Checks, done func(), excludeIPs ...netip.Addr) (*Info, bool) {
 	ctx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
 	infoCh := make(chan *Info, 1)
 	go func() {
-		info, err := GetInfoWithChecks(ctx, checks, excludeIPs...)
+		if done != nil {
+			defer done()
+		}
+		info, err := gatherInfoWithChecks(ctx, checks, excludeIPs...)
 		if err != nil {
 			if ctx.Err() != nil {
 				return
@@ -214,6 +240,9 @@ func GetInfoWithChecksTimeout(ctx context.Context, timeout time.Duration, checks
 
 	select {
 	case info := <-infoCh:
+		if done != nil {
+			done()
+		}
 		return info, true
 	case <-ctx.Done():
 		if errors.Is(ctx.Err(), context.DeadlineExceeded) {
diff --git a/client/system/info_android.go b/client/system/info_android.go
index 3c71573bb..d4f479386 100644
--- a/client/system/info_android.go
+++ b/client/system/info_android.go
@@ -30,6 +30,11 @@ func GetInfo(ctx context.Context) *Info {
 		kernelVersion = osInfo[2]
 	}
 
+	addrs, err := networkAddresses()
+	if err != nil {
+		log.Warnf("discover network addresses: %s", err)
+	}
+
 	gio := &Info{
 		GoOS:               runtime.GOOS,
 		Kernel:             kernel,
@@ -41,6 +46,7 @@ func GetInfo(ctx context.Context) *Info {
 		NetbirdVersion:     version.NetbirdVersion(),
 		UIVersion:          extractUIVersion(ctx),
 		KernelVersion:      kernelVersion,
+		NetworkAddresses:   addrs,
 		SystemSerialNumber: serial(),
 		SystemProductName:  productModel(),
 		SystemManufacturer: productManufacturer(),
diff --git a/client/system/info_js.go b/client/system/info_js.go
index f32532881..3323fb542 100644
--- a/client/system/info_js.go
+++ b/client/system/info_js.go
@@ -15,7 +15,7 @@ func UpdateStaticInfoAsync() {
 }
 
 // GetInfo retrieves system information for WASM environment
-func GetInfo(_ context.Context) *Info {
+func GetInfo(ctx context.Context) *Info {
 	info := &Info{
 		GoOS:           runtime.GOOS,
 		Kernel:         runtime.GOARCH,
@@ -30,6 +30,13 @@ func GetInfo(_ context.Context) *Info {
 	collectBrowserInfo(info)
 	collectLocationInfo(info)
 	collectSystemInfo(info)
+
+	// A caller-provided device name wins, as on the other platforms. A peer
+	// registered over an API keeps reporting the name it was registered with,
+	// so its meta does not change on the first sync.
+	if name := extractDeviceName(ctx, info.Hostname); name != "" {
+		info.Hostname = name
+	}
 	return info
 }
 
diff --git a/client/system/info_js_test.go b/client/system/info_js_test.go
new file mode 100644
index 000000000..e2a33ada0
--- /dev/null
+++ b/client/system/info_js_test.go
@@ -0,0 +1,27 @@
+//go:build js
+
+package system
+
+import (
+	"context"
+	"testing"
+)
+
+// TestGetInfoHonorsDeviceName covers a caller-provided device name reaching the
+// reported hostname, so a peer registered over an API keeps reporting the name
+// it was registered with instead of renaming itself on its first sync.
+func TestGetInfoHonorsDeviceName(t *testing.T) {
+	ctx := context.WithValue(context.Background(), DeviceNameCtxKey, "session-name")
+	if got := GetInfo(ctx).Hostname; got != "session-name" {
+		t.Errorf("hostname should carry the caller's device name, got %q", got)
+	}
+}
+
+// TestGetInfoWithoutDeviceNameKeepsFallback covers the embed layer's habit of
+// always setting the context value: an empty name must not blank the hostname.
+func TestGetInfoWithoutDeviceNameKeepsFallback(t *testing.T) {
+	ctx := context.WithValue(context.Background(), DeviceNameCtxKey, "")
+	if got := GetInfo(ctx).Hostname; got == "" {
+		t.Error("an empty device name must not blank the hostname")
+	}
+}
diff --git a/client/system/info_source.go b/client/system/info_source.go
new file mode 100644
index 000000000..2d5c43a72
--- /dev/null
+++ b/client/system/info_source.go
@@ -0,0 +1,157 @@
+package system
+
+import (
+	"context"
+	"net/netip"
+	"slices"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const (
+	// infoLostAfter is how many timeouts an abandoned gathering is waited for before
+	// another may start beside it. A system call that is merely slow returns well within
+	// that; only one blocked for good, such as a stat on a dead network mount, is worked
+	// around.
+	infoLostAfter = 10
+
+	// maxAbandoned bounds how many gatherings may be left blocked, so a call that never
+	// returns cannot leak a goroutine on every refresh for the life of the daemon.
+	maxAbandoned = 2
+)
+
+// InfoSource gathers the system info sent to management, keeping the posture
+// check results from the last Refresh for the cheap Current snapshots. The zero value is
+// ready to use.
+type InfoSource struct {
+	// started numbers Refresh calls in the order they began.
+	started atomic.Uint64
+	// now overrides the clock when set.
+	now func() time.Time
+
+	mu sync.Mutex
+	// abandoned holds the start of each gathering that timed out and is still blocked in
+	// a system call, by Refresh number.
+	abandoned map[uint64]time.Time
+	// files holds the file check results of the latest-started Refresh that succeeded,
+	// filesFrom its number.
+	files     []File
+	filesFrom uint64
+}
+
+// Refresh gathers the info with the posture checks evaluated, bounded by timeout. It may
+// run concurrently with other calls; the results Current reuses are those of the call
+// that started last, so an older call finishing late cannot replace them. It reports
+// false on a timeout, and also while a gathering that timed out earlier is still blocked
+// in a system call: starting another would only add one more goroutine stuck on it.
+// That one is given up on once it has run for infoLostAfter timeouts, up to maxAbandoned.
+func (s *InfoSource) Refresh(ctx context.Context, timeout time.Duration, checks []*proto.Checks, excludeIPs ...netip.Addr) (*Info, bool) {
+	started := s.clock()
+	if !s.mayStart(started, time.Duration(infoLostAfter)*timeout) {
+		return nil, false
+	}
+	seq := s.started.Add(1)
+
+	var mu sync.Mutex
+	var finished, abandoned bool
+	done := func() {
+		mu.Lock()
+		defer mu.Unlock()
+		if finished {
+			return
+		}
+		finished = true
+		if abandoned {
+			s.release(seq)
+		}
+	}
+	info, ok := getInfoWithChecksTimeout(ctx, timeout, checks, done, excludeIPs...)
+	if !ok {
+		mu.Lock()
+		if !finished {
+			abandoned = true
+			s.abandon(seq, started)
+		}
+		mu.Unlock()
+		return nil, false
+	}
+	s.publishFiles(seq, info.Files)
+	return info, true
+}
+
+// mayStart reports whether a gathering may start at now. Every abandoned gathering must
+// have run for lost, and fewer than maxAbandoned may be left running.
+func (s *InfoSource) mayStart(now time.Time, lost time.Duration) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if len(s.abandoned) == 0 {
+		return true
+	}
+	if len(s.abandoned) >= maxAbandoned {
+		log.Warnf("%d system info gatherings are stuck, skipping this one", len(s.abandoned))
+		return false
+	}
+	for _, started := range s.abandoned {
+		if now.Sub(started) < lost {
+			log.Warnf("system info gathering that timed out earlier is still running, skipping this one")
+			return false
+		}
+	}
+	log.Warnf("system info gathering has been stuck for over %s, starting another", lost)
+	return true
+}
+
+// abandon records that gathering seq, started at started, timed out but is still running.
+func (s *InfoSource) abandon(seq uint64, started time.Time) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.abandoned == nil {
+		s.abandoned = map[uint64]time.Time{}
+	}
+	s.abandoned[seq] = started
+}
+
+// release records that the abandoned gathering seq has returned.
+func (s *InfoSource) release(seq uint64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.abandoned, seq)
+}
+
+func (s *InfoSource) abandonedCount() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.abandoned)
+}
+
+func (s *InfoSource) clock() time.Time {
+	if s.now != nil {
+		return s.now()
+	}
+	return time.Now()
+}
+
+func (s *InfoSource) publishFiles(seq uint64, files []File) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if seq < s.filesFrom {
+		return
+	}
+	s.files = slices.Clone(files)
+	s.filesFrom = seq
+}
+
+// Current gathers the info without evaluating the checks, reusing the last Refresh results.
+func (s *InfoSource) Current(ctx context.Context, excludeIPs ...netip.Addr) *Info {
+	info := GetInfo(ctx)
+	info.removeAddresses(excludeIPs...)
+	s.mu.Lock()
+	info.Files = slices.Clone(s.files)
+	s.mu.Unlock()
+	return info
+}
diff --git a/client/system/info_source_test.go b/client/system/info_source_test.go
new file mode 100644
index 000000000..29183e134
--- /dev/null
+++ b/client/system/info_source_test.go
@@ -0,0 +1,198 @@
+package system
+
+import (
+	"context"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestInfoSource_CurrentBeforeRefresh(t *testing.T) {
+	var src InfoSource
+
+	info := src.Current(context.Background())
+
+	assert.Empty(t, info.Files)
+}
+
+func TestInfoSource_CurrentReusesRefreshedFiles(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "agent")
+	require.NoError(t, os.WriteFile(path, nil, 0o600))
+	checks := []*proto.Checks{{Files: []string{path}}}
+
+	var src InfoSource
+	refreshed, ok := src.Refresh(context.Background(), 15*time.Second, checks)
+	require.True(t, ok)
+	require.Equal(t, []File{{Path: path, Exist: true}}, refreshed.Files)
+
+	info := src.Current(context.Background())
+
+	assert.Equal(t, refreshed.Files, info.Files)
+}
+
+// TestInfoSource_RefreshSkipsWhileEarlierGatheringRuns stands in for a gathering that
+// timed out and is still blocked in a system call: no second one starts on top of it,
+// and gathering works again once it exits.
+func TestInfoSource_RefreshSkipsWhileEarlierGatheringRuns(t *testing.T) {
+	var src InfoSource
+	src.abandoned = map[uint64]time.Time{1: time.Now()}
+
+	_, ok := src.Refresh(context.Background(), 15*time.Second, nil)
+	assert.False(t, ok, "no gathering starts while an earlier one is still running")
+
+	src.abandoned = nil
+	_, ok = src.Refresh(context.Background(), 15*time.Second, nil)
+	require.True(t, ok, "gathering runs once the earlier one exited")
+
+	_, ok = src.Refresh(context.Background(), 15*time.Second, nil)
+	assert.True(t, ok, "a gathering that finished in time does not block the next one")
+}
+
+// TestInfoSource_RefreshReleasesAfterTimedOutGatheringExits checks that a gathering that
+// timed out releases the source once its goroutine finishes, not before.
+func TestInfoSource_RefreshReleasesAfterTimedOutGatheringExits(t *testing.T) {
+	var src InfoSource
+
+	_, ok := src.Refresh(context.Background(), time.Nanosecond, nil)
+	require.False(t, ok, "gathering cannot finish within a nanosecond")
+
+	require.Eventually(t, func() bool { return src.abandonedCount() == 0 }, 10*time.Second, 10*time.Millisecond,
+		"the source is released when the abandoned gathering exits")
+	_, ok = src.Refresh(context.Background(), 15*time.Second, nil)
+	assert.True(t, ok, "gathering works again after the abandoned one exited")
+}
+
+// stubGathering replaces the gathering with one that reports a single file check for the
+// path the checks name, and blocks a gathering for blockedPath until release is closed.
+// entered receives once that gathering has started.
+func stubGathering(t *testing.T, blockedPath string) (entered chan struct{}, release chan struct{}) {
+	t.Helper()
+	entered = make(chan struct{}, 1)
+	release = make(chan struct{})
+	original := gatherInfoWithChecks
+	gatherInfoWithChecks = func(_ context.Context, checks []*proto.Checks, _ ...netip.Addr) (*Info, error) {
+		path := checks[0].Files[0]
+		if path == blockedPath {
+			entered <- struct{}{}
+			<-release
+		}
+		return &Info{Files: []File{{Path: path, Exist: true}}}, nil
+	}
+	t.Cleanup(func() { gatherInfoWithChecks = original })
+	return entered, release
+}
+
+func filesCheck(path string) []*proto.Checks {
+	return []*proto.Checks{{Files: []string{path}}}
+}
+
+// TestInfoSource_RefreshRunsConcurrently: only a gathering that timed out holds off new
+// ones; a caller gathering while another gathering is in progress is served.
+func TestInfoSource_RefreshRunsConcurrently(t *testing.T) {
+	entered, release := stubGathering(t, "/slow")
+	var src InfoSource
+
+	slowDone := make(chan bool, 1)
+	go func() {
+		_, ok := src.Refresh(context.Background(), 15*time.Second, filesCheck("/slow"))
+		slowDone <- ok
+	}()
+	<-entered
+
+	_, ok := src.Refresh(context.Background(), 15*time.Second, filesCheck("/fast"))
+	assert.True(t, ok, "a gathering runs while another one is still in progress")
+
+	close(release)
+	assert.True(t, <-slowDone, "the slower gathering completes too")
+}
+
+// TestInfoSource_LateOlderRefreshDoesNotReplaceNewerResults: a Refresh for the previous
+// checks that finishes after one for the current checks must not bring back the old
+// results Current reports.
+func TestInfoSource_LateOlderRefreshDoesNotReplaceNewerResults(t *testing.T) {
+	entered, release := stubGathering(t, "/old")
+	var src InfoSource
+
+	oldDone := make(chan struct{})
+	go func() {
+		defer close(oldDone)
+		_, _ = src.Refresh(context.Background(), 15*time.Second, filesCheck("/old"))
+	}()
+	<-entered
+
+	_, ok := src.Refresh(context.Background(), 15*time.Second, filesCheck("/new"))
+	require.True(t, ok)
+	close(release)
+	<-oldDone
+
+	files := src.Current(context.Background()).Files
+	require.Len(t, files, 1)
+	assert.Equal(t, "/new", files[0].Path, "the results of the refresh that started last are kept")
+}
+
+func TestInfoSource_CurrentExcludesAddresses(t *testing.T) {
+	addrs := GetInfo(context.Background()).NetworkAddresses
+	if len(addrs) == 0 {
+		t.Skip("no network addresses on this host")
+	}
+	excluded := addrs[0].NetIP.Addr()
+	matching := 0
+	for _, addr := range addrs {
+		if addr.NetIP.Addr() == excluded {
+			matching++
+		}
+	}
+
+	var src InfoSource
+	info := src.Current(context.Background(), excluded)
+
+	assert.Len(t, info.NetworkAddresses, len(addrs)-matching)
+	for _, addr := range info.NetworkAddresses {
+		assert.NotEqual(t, excluded, addr.NetIP.Addr())
+	}
+}
+
+// TestInfoSource_LostGatheringDoesNotBlockForever: a gathering blocked for good, such as
+// an os.Stat on a dead network mount, must not stop every later meta sync. Once it has
+// run for lostAfter timeouts another starts beside it, and no more than maxAbandoned
+// are ever left running.
+func TestInfoSource_LostGatheringDoesNotBlockForever(t *testing.T) {
+	entered, release := stubGathering(t, "/wedged")
+	t.Cleanup(func() { close(release) })
+	now := time.Now()
+	src := InfoSource{now: func() time.Time { return now }}
+	const timeout = 10 * time.Millisecond
+	lost := time.Duration(infoLostAfter) * timeout
+
+	_, ok := src.Refresh(context.Background(), timeout, filesCheck("/wedged"))
+	require.False(t, ok, "the wedged gathering times out")
+	<-entered
+
+	_, ok = src.Refresh(context.Background(), timeout, filesCheck("/wedged"))
+	assert.False(t, ok, "a gathering that may still finish holds off the next one")
+
+	now = now.Add(lost)
+	_, ok = src.Refresh(context.Background(), timeout, filesCheck("/wedged"))
+	require.False(t, ok, "the second wedged gathering times out too")
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		t.Fatal("once the first gathering is lost another one starts")
+	}
+
+	now = now.Add(lost)
+	_, ok = src.Refresh(context.Background(), timeout, filesCheck("/wedged"))
+	assert.False(t, ok, "no more than maxAbandoned gatherings are left running")
+	select {
+	case <-entered:
+		t.Fatal("a third gathering started beside two lost ones")
+	case <-time.After(50 * time.Millisecond):
+	}
+}
diff --git a/client/system/network_addr.go b/client/system/network_addr.go
index 44260a938..505a6f0ea 100644
--- a/client/system/network_addr.go
+++ b/client/system/network_addr.go
@@ -1,4 +1,4 @@
-//go:build !ios
+//go:build !ios && !android
 
 package system
 
diff --git a/client/system/network_addr_android.go b/client/system/network_addr_android.go
new file mode 100644
index 000000000..99a71e105
--- /dev/null
+++ b/client/system/network_addr_android.go
@@ -0,0 +1,89 @@
+package system
+
+import (
+	"net/netip"
+	"strings"
+)
+
+var iFaceDiscover IFaceDiscover
+
+type IFaceDiscover interface {
+	IFaces() (string, error)
+}
+
+// SetIFaceDiscover configures the Android interface discovery provider.
+func SetIFaceDiscover(discover IFaceDiscover) {
+	iFaceDiscover = discover
+}
+
+func networkAddresses() ([]NetworkAddress, error) {
+	if iFaceDiscover == nil {
+		return nil, nil
+	}
+	ifaces, err := iFaceDiscover.IFaces()
+	if err != nil {
+		return nil, err
+	}
+
+	var netAddresses []NetworkAddress
+	for _, line := range strings.Split(ifaces, "\n") {
+		addresses, ok := interfaceAddresses(line)
+		if !ok {
+			continue
+		}
+		for _, address := range addresses {
+			netAddr, ok := toNetworkAddress(address)
+			if !ok {
+				continue
+			}
+			if isDuplicated(netAddresses, netAddr) {
+				continue
+			}
+			netAddresses = append(netAddresses, netAddr)
+		}
+	}
+	return netAddresses, nil
+}
+
+func interfaceAddresses(line string) ([]string, bool) {
+	parts := strings.Split(line, "|")
+	if len(parts) != 2 {
+		return nil, false
+	}
+	flags := strings.Fields(parts[0])
+	if len(flags) != 8 {
+		return nil, false
+	}
+	up, loopback := flags[3], flags[5]
+	if up != "true" || loopback == "true" {
+		return nil, false
+	}
+	return strings.Fields(parts[1]), true
+}
+
+func toNetworkAddress(address string) (NetworkAddress, bool) {
+	prefix, err := netip.ParsePrefix(address)
+	if err != nil {
+		return NetworkAddress{}, false
+	}
+	if prefix.Addr().Is4In6() {
+		if prefix.Bits() < 96 {
+			return NetworkAddress{}, false
+		}
+		prefix = netip.PrefixFrom(prefix.Addr().Unmap(), prefix.Bits()-96)
+	}
+	ip := prefix.Addr()
+	if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsMulticast() {
+		return NetworkAddress{}, false
+	}
+	return NetworkAddress{NetIP: prefix}, true
+}
+
+func isDuplicated(addresses []NetworkAddress, addr NetworkAddress) bool {
+	for _, duplicated := range addresses {
+		if duplicated.NetIP == addr.NetIP {
+			return true
+		}
+	}
+	return false
+}
diff --git a/client/system/network_addr_test.go b/client/system/network_addr_test.go
index a5f9c4279..b0be40f0a 100644
--- a/client/system/network_addr_test.go
+++ b/client/system/network_addr_test.go
@@ -1,4 +1,4 @@
-//go:build !ios
+//go:build !ios && !android
 
 package system
 
diff --git a/client/system/process.go b/client/system/process.go
index 07f69a212..fefa7d913 100644
--- a/client/system/process.go
+++ b/client/system/process.go
@@ -7,7 +7,7 @@ import (
 	"os"
 	"slices"
 
-	"github.com/shirou/gopsutil/v3/process"
+	"github.com/shirou/gopsutil/v4/process"
 )
 
 // getRunningProcesses returns a list of running process paths. The context bounds the work:
diff --git a/client/system/process_test.go b/client/system/process_test.go
index 44a1c8ba0..de1cfc1db 100644
--- a/client/system/process_test.go
+++ b/client/system/process_test.go
@@ -1,10 +1,12 @@
+//go:build windows || (linux && !android) || (darwin && !ios) || freebsd
+
 package system
 
 import (
 	"context"
 	"testing"
 
-	"github.com/shirou/gopsutil/v3/process"
+	"github.com/shirou/gopsutil/v4/process"
 )
 
 func Benchmark_getRunningProcesses(b *testing.B) {
diff --git a/client/test/json-socket-docker.sh b/client/test/json-socket-docker.sh
new file mode 100755
index 000000000..a878f13d6
--- /dev/null
+++ b/client/test/json-socket-docker.sh
@@ -0,0 +1,223 @@
+#!/usr/bin/env bash
+set -eEuo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: client/test/json-socket-docker.sh [tcp|unix|both]
+
+Builds the NetBird client Docker image from the local source tree, starts
+`netbird service run` in a container with --enable-json-socket, and verifies
+that the HTTP/JSON daemon gateway responds to Status requests.
+
+Modes:
+  tcp   Validate tcp://0.0.0.0:8080 via a published localhost port (default)
+  unix  Validate unix:///sock/netbird-http.sock via a bind-mounted socket dir
+  both  Run both validations
+
+Environment:
+  CONTAINER_RUNTIME  docker or podman. Auto-detected if unset.
+  IMAGE              Image tag to build. Default: netbird-json-socket-test:local
+  TARGETARCH         Go/Docker target arch. Default: `go env GOARCH`
+  PLATFORM           Docker platform. Default: linux/$TARGETARCH
+  WAIT_TIMEOUT       Seconds to wait for the JSON socket. Default: 30
+EOF
+}
+
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+
+MODE="${1:-tcp}"
+case "${MODE}" in
+  tcp|unix|both) ;;
+  *)
+    usage >&2
+    echo "invalid mode: ${MODE}" >&2
+    exit 2
+    ;;
+esac
+
+RUNTIME="${CONTAINER_RUNTIME:-}"
+if [[ -z "${RUNTIME}" ]]; then
+  if command -v docker >/dev/null 2>&1; then
+    RUNTIME=docker
+  elif command -v podman >/dev/null 2>&1; then
+    RUNTIME=podman
+  else
+    echo "docker or podman is required" >&2
+    exit 127
+  fi
+fi
+if ! command -v "${RUNTIME}" >/dev/null 2>&1; then
+  echo "container runtime not found: ${RUNTIME}" >&2
+  exit 127
+fi
+
+if ! command -v curl >/dev/null 2>&1; then
+  echo "curl is required" >&2
+  exit 127
+fi
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+IMAGE="${IMAGE:-netbird-json-socket-test:local}"
+TARGETARCH="${TARGETARCH:-$(go env GOARCH)}"
+PLATFORM="${PLATFORM:-linux/${TARGETARCH}}"
+WAIT_TIMEOUT="${WAIT_TIMEOUT:-30}"
+TMP_DIR="$(mktemp -d)"
+CONTAINERS=()
+
+cleanup() {
+  local status=$?
+  for container in "${CONTAINERS[@]:-}"; do
+    "${RUNTIME}" rm -f "${container}" >/dev/null 2>&1 || true
+  done
+  rm -rf "${TMP_DIR}"
+  exit "${status}"
+}
+trap cleanup EXIT
+
+build_image() {
+  echo "==> Building Linux ${TARGETARCH} netbird binary"
+  mkdir -p "${TMP_DIR}/context/client"
+  cp "${ROOT_DIR}/client/Dockerfile" "${TMP_DIR}/context/Dockerfile"
+  cp "${ROOT_DIR}/client/netbird-entrypoint.sh" "${TMP_DIR}/context/client/netbird-entrypoint.sh"
+
+  (cd "${ROOT_DIR}" && CGO_ENABLED=0 GOOS=linux GOARCH="${TARGETARCH}" go build -o "${TMP_DIR}/context/netbird" ./client)
+
+  echo "==> Building ${IMAGE} for ${PLATFORM}"
+  "${RUNTIME}" build \
+    --platform "${PLATFORM}" \
+    --build-arg NETBIRD_BINARY=netbird \
+    -t "${IMAGE}" \
+    -f "${TMP_DIR}/context/Dockerfile" \
+    "${TMP_DIR}/context"
+}
+
+pick_port() {
+  python3 - <<'PY'
+import socket
+sock = socket.socket()
+sock.bind(("127.0.0.1", 0))
+print(sock.getsockname()[1])
+sock.close()
+PY
+}
+
+assert_status_json() {
+  local response_file="$1"
+  if command -v python3 >/dev/null 2>&1; then
+    python3 - "${response_file}" <<'PY'
+import json
+import sys
+with open(sys.argv[1], encoding="utf-8") as fh:
+    data = json.load(fh)
+if not data.get("status"):
+    raise SystemExit("missing non-empty status field")
+if "daemonVersion" not in data:
+    raise SystemExit("missing daemonVersion field")
+print(f"status={data['status']} daemonVersion={data['daemonVersion']}")
+PY
+  else
+    grep -q '"status"' "${response_file}"
+    grep -q '"daemonVersion"' "${response_file}"
+    cat "${response_file}"
+  fi
+}
+
+container_logs() {
+  local container="$1"
+  echo "---- ${container} logs ----" >&2
+  "${RUNTIME}" logs "${container}" >&2 || true
+  echo "--------------------------" >&2
+}
+
+wait_for_http_status() {
+  local container="$1"
+  local response="${TMP_DIR}/${container}.json"
+  local curl_err="${TMP_DIR}/${container}.curl.err"
+  shift
+  local deadline=$((SECONDS + WAIT_TIMEOUT))
+
+  while (( SECONDS < deadline )); do
+    if curl -fsS "$@" \
+      -X POST \
+      -H 'Content-Type: application/json' \
+      -d '{}' \
+      -o "${response}" \
+      2>"${curl_err}"; then
+      assert_status_json "${response}"
+      return 0
+    fi
+
+    if ! "${RUNTIME}" ps --format '{{.Names}}' | grep -Fxq "${container}"; then
+      echo "container exited before JSON socket became ready" >&2
+      container_logs "${container}"
+      return 1
+    fi
+    sleep 1
+  done
+
+  echo "timed out waiting for JSON socket after ${WAIT_TIMEOUT}s" >&2
+  cat "${curl_err}" >&2 || true
+  container_logs "${container}"
+  return 1
+}
+
+run_netbird_container() {
+  local container="$1"
+  local json_socket="$2"
+  shift 2
+
+  CONTAINERS+=("${container}")
+  "${RUNTIME}" run --rm -d \
+    --name "${container}" \
+    -e NB_STATE_DIR=/tmp/netbird-state \
+    --entrypoint /usr/local/bin/netbird \
+    "$@" \
+    "${IMAGE}" \
+    --log-file console \
+    --daemon-addr unix:///tmp/netbird.sock \
+    service run \
+    --enable-json-socket \
+    --json-socket "${json_socket}" >/dev/null
+}
+
+run_tcp_test() {
+  local port container
+  port="$(pick_port)"
+  container="nb-json-socket-tcp-$RANDOM-$RANDOM"
+
+  echo "==> Validating TCP JSON socket on 127.0.0.1:${port}"
+  run_netbird_container "${container}" "tcp://0.0.0.0:8080" -p "127.0.0.1:${port}:8080"
+  wait_for_http_status "${container}" "http://127.0.0.1:${port}/daemon.DaemonService/Status"
+}
+
+run_unix_test() {
+  local sock_dir sock_path container
+  sock_dir="${TMP_DIR}/sock"
+  sock_path="${sock_dir}/netbird-http.sock"
+  container="nb-json-socket-unix-$RANDOM-$RANDOM"
+  mkdir -p "${sock_dir}"
+
+  echo "==> Validating Unix JSON socket at ${sock_path}"
+  run_netbird_container "${container}" "unix:///sock/netbird-http.sock" -v "${sock_dir}:/sock"
+  wait_for_http_status "${container}" --unix-socket "${sock_path}" "http://unix/daemon.DaemonService/Status"
+}
+
+build_image
+
+case "${MODE}" in
+  tcp)
+    run_tcp_test
+    ;;
+  unix)
+    run_unix_test
+    ;;
+  both)
+    run_tcp_test
+    run_unix_test
+    ;;
+esac
+
+echo "==> Docker JSON socket validation passed (${MODE})"
diff --git a/client/testutil/privileged/runner_test.go b/client/testutil/privileged/runner_test.go
index d1945894d..157005d3e 100644
--- a/client/testutil/privileged/runner_test.go
+++ b/client/testutil/privileged/runner_test.go
@@ -25,7 +25,7 @@ import (
 // (.github/workflows/golang-test-linux.yml, test_client_on_docker).
 const (
 	containerImage = "golang"
-	containerTag   = "1.25-alpine"
+	containerTag   = "1.26.7-alpine"
 )
 
 const (
diff --git a/client/ui/.gitignore b/client/ui/.gitignore
new file mode 100644
index 000000000..9f233d8b6
--- /dev/null
+++ b/client/ui/.gitignore
@@ -0,0 +1,8 @@
+.task
+bin
+frontend/dist
+frontend/node_modules
+frontend/bindings
+frontend/.vite
+build/linux/appimage/build
+build/windows/nsis/MicrosoftEdgeWebview2Setup.exe
diff --git a/client/ui/Netbird.icns b/client/ui/Netbird.icns
deleted file mode 100644
index 20af72825..000000000
Binary files a/client/ui/Netbird.icns and /dev/null differ
diff --git a/client/ui/Taskfile.yml b/client/ui/Taskfile.yml
new file mode 100644
index 000000000..2d0af9018
--- /dev/null
+++ b/client/ui/Taskfile.yml
@@ -0,0 +1,58 @@
+version: '3'
+
+includes:
+  common: ./build/Taskfile.yml
+  windows: ./build/windows/Taskfile.yml
+  darwin: ./build/darwin/Taskfile.yml
+  linux: ./build/linux/Taskfile.yml
+
+vars:
+  APP_NAME: "netbird-ui"
+  BIN_DIR: "bin"
+  VITE_PORT: '{{.WAILS_VITE_PORT | default 9245}}'
+
+tasks:
+  build:
+    summary: Builds the application
+    cmds:
+      - task: "{{OS}}:build"
+
+  package:
+    summary: Packages a production build of the application
+    cmds:
+      - task: "{{OS}}:package"
+
+  run:
+    summary: Runs the application
+    cmds:
+      - task: "{{OS}}:run"
+
+  dev:
+    summary: Runs the application in development mode
+    cmds:
+      - wails3 dev -config ./build/config.yml -port {{.VITE_PORT}}
+
+  setup:docker:
+    summary: Builds Docker image for cross-compilation (~800MB download)
+    cmds:
+      - task: common:setup:docker
+
+  build:server:
+    summary: Builds the application in server mode (no GUI, HTTP server only)
+    cmds:
+      - task: common:build:server
+
+  run:server:
+    summary: Runs the application in server mode
+    cmds:
+      - task: common:run:server
+
+  build:docker:
+    summary: Builds a Docker image for server mode deployment
+    cmds:
+      - task: common:build:docker
+
+  run:docker:
+    summary: Builds and runs the Docker image
+    cmds:
+      - task: common:run:docker
diff --git a/client/ui/assets/connected.png b/client/ui/assets/connected.png
deleted file mode 100644
index 7dd2ab01a..000000000
Binary files a/client/ui/assets/connected.png and /dev/null differ
diff --git a/client/ui/assets/disconnected.png b/client/ui/assets/disconnected.png
deleted file mode 100644
index 421632b52..000000000
Binary files a/client/ui/assets/disconnected.png and /dev/null differ
diff --git a/client/ui/assets/netbird-disconnected.ico b/client/ui/assets/netbird-disconnected.ico
deleted file mode 100644
index 812e9d283..000000000
Binary files a/client/ui/assets/netbird-disconnected.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-disconnected.png b/client/ui/assets/netbird-disconnected.png
deleted file mode 100644
index 79d4775ea..000000000
Binary files a/client/ui/assets/netbird-disconnected.png and /dev/null differ
diff --git a/client/ui/assets/netbird-menu-16.png b/client/ui/assets/netbird-menu-16.png
new file mode 100644
index 000000000..d5dcab446
Binary files /dev/null and b/client/ui/assets/netbird-menu-16.png differ
diff --git a/client/ui/assets/netbird-menu-24.png b/client/ui/assets/netbird-menu-24.png
new file mode 100644
index 000000000..087c1c2ae
Binary files /dev/null and b/client/ui/assets/netbird-menu-24.png differ
diff --git a/client/ui/assets/netbird-menu-about-18.png b/client/ui/assets/netbird-menu-about-18.png
new file mode 100644
index 000000000..bb12c6367
Binary files /dev/null and b/client/ui/assets/netbird-menu-about-18.png differ
diff --git a/client/ui/assets/netbird-menu-dot-connected-16.png b/client/ui/assets/netbird-menu-dot-connected-16.png
new file mode 100644
index 000000000..3a7fa31a4
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-connected-16.png differ
diff --git a/client/ui/assets/netbird-menu-dot-connected-22.png b/client/ui/assets/netbird-menu-dot-connected-22.png
new file mode 100644
index 000000000..78b068748
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-connected-22.png differ
diff --git a/client/ui/assets/netbird-menu-dot-connected.png b/client/ui/assets/netbird-menu-dot-connected.png
new file mode 100644
index 000000000..fc8ce4d85
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-connected.png differ
diff --git a/client/ui/assets/netbird-menu-dot-connecting-16.png b/client/ui/assets/netbird-menu-dot-connecting-16.png
new file mode 100644
index 000000000..f874706b5
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-connecting-16.png differ
diff --git a/client/ui/assets/netbird-menu-dot-connecting-22.png b/client/ui/assets/netbird-menu-dot-connecting-22.png
new file mode 100644
index 000000000..d8e5970f5
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-connecting-22.png differ
diff --git a/client/ui/assets/netbird-menu-dot-connecting.png b/client/ui/assets/netbird-menu-dot-connecting.png
new file mode 100644
index 000000000..3f8bc29d8
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-connecting.png differ
diff --git a/client/ui/assets/netbird-menu-dot-error-16.png b/client/ui/assets/netbird-menu-dot-error-16.png
new file mode 100644
index 000000000..cdc6254da
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-error-16.png differ
diff --git a/client/ui/assets/netbird-menu-dot-error-22.png b/client/ui/assets/netbird-menu-dot-error-22.png
new file mode 100644
index 000000000..d9bd013d6
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-error-22.png differ
diff --git a/client/ui/assets/netbird-menu-dot-error.png b/client/ui/assets/netbird-menu-dot-error.png
new file mode 100644
index 000000000..ce5d0e8ef
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-error.png differ
diff --git a/client/ui/assets/netbird-menu-dot-idle-16.png b/client/ui/assets/netbird-menu-dot-idle-16.png
new file mode 100644
index 000000000..354b5b860
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-idle-16.png differ
diff --git a/client/ui/assets/netbird-menu-dot-idle-22.png b/client/ui/assets/netbird-menu-dot-idle-22.png
new file mode 100644
index 000000000..675cf1ffe
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-idle-22.png differ
diff --git a/client/ui/assets/netbird-menu-dot-idle.png b/client/ui/assets/netbird-menu-dot-idle.png
new file mode 100644
index 000000000..79e7bbbf8
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-idle.png differ
diff --git a/client/ui/assets/netbird-menu-dot-offline-16.png b/client/ui/assets/netbird-menu-dot-offline-16.png
new file mode 100644
index 000000000..f9aa5c3e9
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-offline-16.png differ
diff --git a/client/ui/assets/netbird-menu-dot-offline-22.png b/client/ui/assets/netbird-menu-dot-offline-22.png
new file mode 100644
index 000000000..5202c8baa
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-offline-22.png differ
diff --git a/client/ui/assets/netbird-menu-dot-offline.png b/client/ui/assets/netbird-menu-dot-offline.png
new file mode 100644
index 000000000..7aec5d01d
Binary files /dev/null and b/client/ui/assets/netbird-menu-dot-offline.png differ
diff --git a/client/ui/assets/netbird-systemtray-connected-dark.ico b/client/ui/assets/netbird-systemtray-connected-dark.ico
deleted file mode 100644
index 0db8a0862..000000000
Binary files a/client/ui/assets/netbird-systemtray-connected-dark.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-systemtray-connected-macos.png b/client/ui/assets/netbird-systemtray-connected-macos.png
index ead210250..d29a7ade8 100644
Binary files a/client/ui/assets/netbird-systemtray-connected-macos.png and b/client/ui/assets/netbird-systemtray-connected-macos.png differ
diff --git a/client/ui/assets/netbird-systemtray-connected-mono-dark.png b/client/ui/assets/netbird-systemtray-connected-mono-dark.png
new file mode 100644
index 000000000..1f7d40121
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-connected-mono-dark.png differ
diff --git a/client/ui/assets/netbird-systemtray-connected-mono.png b/client/ui/assets/netbird-systemtray-connected-mono.png
new file mode 100644
index 000000000..8a8710746
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-connected-mono.png differ
diff --git a/client/ui/assets/netbird-systemtray-connected.ico b/client/ui/assets/netbird-systemtray-connected.ico
deleted file mode 100644
index c16bec3f5..000000000
Binary files a/client/ui/assets/netbird-systemtray-connected.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-systemtray-connecting-dark.ico b/client/ui/assets/netbird-systemtray-connecting-dark.ico
deleted file mode 100644
index 615d40f07..000000000
Binary files a/client/ui/assets/netbird-systemtray-connecting-dark.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-systemtray-connecting-macos.png b/client/ui/assets/netbird-systemtray-connecting-macos.png
index 0fe7fa0db..306c6ddf5 100644
Binary files a/client/ui/assets/netbird-systemtray-connecting-macos.png and b/client/ui/assets/netbird-systemtray-connecting-macos.png differ
diff --git a/client/ui/assets/netbird-systemtray-connecting-mono-dark.png b/client/ui/assets/netbird-systemtray-connecting-mono-dark.png
new file mode 100644
index 000000000..f208cb6bf
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-connecting-mono-dark.png differ
diff --git a/client/ui/assets/netbird-systemtray-connecting-mono.png b/client/ui/assets/netbird-systemtray-connecting-mono.png
new file mode 100644
index 000000000..e254321fd
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-connecting-mono.png differ
diff --git a/client/ui/assets/netbird-systemtray-connecting.ico b/client/ui/assets/netbird-systemtray-connecting.ico
deleted file mode 100644
index 4e4c3a9b1..000000000
Binary files a/client/ui/assets/netbird-systemtray-connecting.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-systemtray-disconnected-macos.png b/client/ui/assets/netbird-systemtray-disconnected-macos.png
index 36b9a488f..48cfa7c60 100644
Binary files a/client/ui/assets/netbird-systemtray-disconnected-macos.png and b/client/ui/assets/netbird-systemtray-disconnected-macos.png differ
diff --git a/client/ui/assets/netbird-systemtray-disconnected-mono-dark.png b/client/ui/assets/netbird-systemtray-disconnected-mono-dark.png
new file mode 100644
index 000000000..035e71ba7
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-disconnected-mono-dark.png differ
diff --git a/client/ui/assets/netbird-systemtray-disconnected-mono.png b/client/ui/assets/netbird-systemtray-disconnected-mono.png
new file mode 100644
index 000000000..d68c4dc5b
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-disconnected-mono.png differ
diff --git a/client/ui/assets/netbird-systemtray-disconnected.ico b/client/ui/assets/netbird-systemtray-disconnected.ico
deleted file mode 100644
index dcb9f4bf8..000000000
Binary files a/client/ui/assets/netbird-systemtray-disconnected.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-systemtray-error-dark.ico b/client/ui/assets/netbird-systemtray-error-dark.ico
deleted file mode 100644
index 083816188..000000000
Binary files a/client/ui/assets/netbird-systemtray-error-dark.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-systemtray-error-macos.png b/client/ui/assets/netbird-systemtray-error-macos.png
index 9a9998bcf..580fe647c 100644
Binary files a/client/ui/assets/netbird-systemtray-error-macos.png and b/client/ui/assets/netbird-systemtray-error-macos.png differ
diff --git a/client/ui/assets/netbird-systemtray-error-mono-dark.png b/client/ui/assets/netbird-systemtray-error-mono-dark.png
new file mode 100644
index 000000000..6bcdacd44
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-error-mono-dark.png differ
diff --git a/client/ui/assets/netbird-systemtray-error-mono.png b/client/ui/assets/netbird-systemtray-error-mono.png
new file mode 100644
index 000000000..164d65a4f
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-error-mono.png differ
diff --git a/client/ui/assets/netbird-systemtray-error.ico b/client/ui/assets/netbird-systemtray-error.ico
deleted file mode 100644
index 1abc45c2a..000000000
Binary files a/client/ui/assets/netbird-systemtray-error.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-systemtray-needs-login-macos.png b/client/ui/assets/netbird-systemtray-needs-login-macos.png
new file mode 100644
index 000000000..580fe647c
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-needs-login-macos.png differ
diff --git a/client/ui/assets/netbird-systemtray-needs-login-mono-dark.png b/client/ui/assets/netbird-systemtray-needs-login-mono-dark.png
new file mode 100644
index 000000000..6bcdacd44
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-needs-login-mono-dark.png differ
diff --git a/client/ui/assets/netbird-systemtray-needs-login-mono.png b/client/ui/assets/netbird-systemtray-needs-login-mono.png
new file mode 100644
index 000000000..164d65a4f
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-needs-login-mono.png differ
diff --git a/client/ui/assets/netbird-systemtray-needs-login.png b/client/ui/assets/netbird-systemtray-needs-login.png
new file mode 100644
index 000000000..722342989
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-needs-login.png differ
diff --git a/client/ui/assets/netbird-systemtray-update-connected-dark.ico b/client/ui/assets/netbird-systemtray-update-connected-dark.ico
deleted file mode 100644
index b11bb5492..000000000
Binary files a/client/ui/assets/netbird-systemtray-update-connected-dark.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-systemtray-update-connected-macos.png b/client/ui/assets/netbird-systemtray-update-connected-macos.png
index 8a6b2f2db..8b7b9f131 100644
Binary files a/client/ui/assets/netbird-systemtray-update-connected-macos.png and b/client/ui/assets/netbird-systemtray-update-connected-macos.png differ
diff --git a/client/ui/assets/netbird-systemtray-update-connected-mono-dark.png b/client/ui/assets/netbird-systemtray-update-connected-mono-dark.png
new file mode 100644
index 000000000..284efa880
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-update-connected-mono-dark.png differ
diff --git a/client/ui/assets/netbird-systemtray-update-connected-mono.png b/client/ui/assets/netbird-systemtray-update-connected-mono.png
new file mode 100644
index 000000000..ed9ceb8a2
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-update-connected-mono.png differ
diff --git a/client/ui/assets/netbird-systemtray-update-connected.ico b/client/ui/assets/netbird-systemtray-update-connected.ico
deleted file mode 100644
index d3ce2f0f3..000000000
Binary files a/client/ui/assets/netbird-systemtray-update-connected.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-systemtray-update-disconnected-dark.ico b/client/ui/assets/netbird-systemtray-update-disconnected-dark.ico
deleted file mode 100644
index 123237f66..000000000
Binary files a/client/ui/assets/netbird-systemtray-update-disconnected-dark.ico and /dev/null differ
diff --git a/client/ui/assets/netbird-systemtray-update-disconnected-macos.png b/client/ui/assets/netbird-systemtray-update-disconnected-macos.png
index 8b190034e..b6afa3937 100644
Binary files a/client/ui/assets/netbird-systemtray-update-disconnected-macos.png and b/client/ui/assets/netbird-systemtray-update-disconnected-macos.png differ
diff --git a/client/ui/assets/netbird-systemtray-update-disconnected-mono-dark.png b/client/ui/assets/netbird-systemtray-update-disconnected-mono-dark.png
new file mode 100644
index 000000000..eb0c4bcf5
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-update-disconnected-mono-dark.png differ
diff --git a/client/ui/assets/netbird-systemtray-update-disconnected-mono.png b/client/ui/assets/netbird-systemtray-update-disconnected-mono.png
new file mode 100644
index 000000000..519ea014a
Binary files /dev/null and b/client/ui/assets/netbird-systemtray-update-disconnected-mono.png differ
diff --git a/client/ui/assets/netbird-systemtray-update-disconnected.ico b/client/ui/assets/netbird-systemtray-update-disconnected.ico
deleted file mode 100644
index 968dc4105..000000000
Binary files a/client/ui/assets/netbird-systemtray-update-disconnected.ico and /dev/null differ
diff --git a/client/ui/assets/netbird.ico b/client/ui/assets/netbird.ico
deleted file mode 100644
index 2bab8a503..000000000
Binary files a/client/ui/assets/netbird.ico and /dev/null differ
diff --git a/client/ui/assets/svg/needs-login.svg b/client/ui/assets/svg/needs-login.svg
new file mode 100644
index 000000000..5c01b48d4
--- /dev/null
+++ b/client/ui/assets/svg/needs-login.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
+  <g transform="translate(0.5 4.5) scale(1.0)" opacity="0.7">
+    <path d="M21.4631 0.523438C17.8173 0.857913 16.0028 2.95675 15.3171 4.01871L4.66406 22.4734H17.5163L30.1929 0.523438H21.4631Z" fill="#F68330"/>
+    <path d="M17.5265 22.4737L0 3.88525C0 3.88525 19.8177 -1.44128 21.7493 15.1738L17.5265 22.4737Z" fill="#F68330"/>
+    <path d="M14.9236 4.70563L9.54688 14.0208L17.5158 22.4747L21.7385 15.158C21.0696 9.44682 18.2851 6.32784 14.9236 4.69727" fill="#F05252"/>
+  </g>
+  <circle cx="25" cy="25" r="7" fill="white"/>
+  <path d="M 22.6 24.5 v -1.4 a 2.4 2.4 0 0 1 4.8 0 v 1.4" fill="none" stroke="#D97706" stroke-width="1.5" stroke-linecap="round"/>
+  <rect x="21.6" y="24.5" width="6.8" height="4.9" rx="0.9" fill="none" stroke="#D97706" stroke-width="1.5"/>
+</svg>
diff --git a/client/ui/assets/svg/netbird-menu.svg b/client/ui/assets/svg/netbird-menu.svg
new file mode 100644
index 000000000..bd4e9d65d
--- /dev/null
+++ b/client/ui/assets/svg/netbird-menu.svg
@@ -0,0 +1,7 @@
+<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(0.5 4.5)">
+    <path d="M21.4631 0.523438C17.8173 0.857913 16.0028 2.95675 15.3171 4.01871L4.66406 22.4734H17.5163L30.1929 0.523438H21.4631Z" fill="#F68330"/>
+    <path d="M17.5265 22.4737L0 3.88525C0 3.88525 19.8177 -1.44128 21.7493 15.1738L17.5265 22.4737Z" fill="#F68330"/>
+    <path d="M14.9236 4.70563L9.54688 14.0208L17.5158 22.4747L21.7385 15.158C21.0696 9.44682 18.2851 6.32784 14.9236 4.69727" fill="#F05252"/>
+  </g>
+</svg>
diff --git a/client/ui/authsession/service.go b/client/ui/authsession/service.go
new file mode 100644
index 000000000..9c094c2a1
--- /dev/null
+++ b/client/ui/authsession/service.go
@@ -0,0 +1,129 @@
+//go:build !android && !ios && !freebsd && !js
+
+package authsession
+
+import (
+	"context"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+type ExtendStartParams struct {
+	// Hint is the OIDC login_hint, typically the user's email.
+	Hint string `json:"hint"`
+}
+
+type ExtendStartResult struct {
+	VerificationURI         string `json:"verificationUri"`
+	VerificationURIComplete string `json:"verificationUriComplete"`
+	UserCode                string `json:"userCode"`
+	DeviceCode              string `json:"deviceCode"`
+	ExpiresIn               int64  `json:"expiresIn"`
+}
+
+type ExtendWaitParams struct {
+	DeviceCode string `json:"deviceCode"`
+	UserCode   string `json:"userCode"`
+}
+
+// ExtendResult: ExpiresAt is nil when the peer is ineligible for extension.
+// Preempted means a newer WaitExtend took over the IdP poll — a no-op, not a failure.
+type ExtendResult struct {
+	ExpiresAt *time.Time `json:"sessionExpiresAt,omitempty"`
+	Preempted bool       `json:"preempted,omitempty"`
+}
+
+// DaemonConn duplicates services.DaemonConn to avoid an import cycle.
+type DaemonConn interface {
+	Client() (proto.DaemonServiceClient, error)
+}
+
+// Session bundles the session-auth daemon RPCs the UI drives.
+type Session struct {
+	conn DaemonConn
+}
+
+func NewSession(conn DaemonConn) *Session {
+	return &Session{conn: conn}
+}
+
+// RequestExtend starts the SSO session-extension flow on the daemon.
+func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (ExtendStartResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return ExtendStartResult{}, err
+	}
+
+	// a request from the UI implies a graphical session, which the daemon cannot detect itself
+	req := &proto.RequestExtendAuthSessionRequest{HasGraphicalSession: true}
+	hint := p.Hint
+	if hint == "" {
+		pm := profilemanager.NewProfileManager()
+		if active, perr := pm.GetActiveProfile(); perr != nil {
+			log.Debugf("failed to get active profile for login hint: %v", perr)
+		} else if state, serr := pm.GetProfileState(active.ID); serr != nil {
+			log.Debugf("failed to get profile state for login hint: %v", serr)
+		} else {
+			hint = state.Email
+		}
+	}
+	if hint != "" {
+		req.Hint = &hint
+	}
+
+	resp, err := cli.RequestExtendAuthSession(ctx, req)
+	if err != nil {
+		return ExtendStartResult{}, err
+	}
+
+	return ExtendStartResult{
+		VerificationURI:         resp.GetVerificationURI(),
+		VerificationURIComplete: resp.GetVerificationURIComplete(),
+		UserCode:                resp.GetUserCode(),
+		DeviceCode:              resp.GetDeviceCode(),
+		ExpiresIn:               resp.GetExpiresIn(),
+	}, nil
+}
+
+// WaitExtend blocks until the user completes the SSO flow started by RequestExtend.
+func (s *Session) WaitExtend(ctx context.Context, p ExtendWaitParams) (ExtendResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return ExtendResult{}, err
+	}
+
+	resp, err := cli.WaitExtendAuthSession(ctx, &proto.WaitExtendAuthSessionRequest{
+		DeviceCode: p.DeviceCode,
+		UserCode:   p.UserCode,
+	})
+	if err != nil {
+		if st, ok := gstatus.FromError(err); ok && st.Code() == codes.Canceled {
+			return ExtendResult{Preempted: true}, nil
+		}
+		return ExtendResult{}, err
+	}
+
+	out := ExtendResult{}
+	if ts := resp.GetSessionExpiresAt(); ts.IsValid() && !ts.AsTime().IsZero() {
+		t := ts.AsTime().UTC()
+		out.ExpiresAt = &t
+	}
+	return out, nil
+}
+
+// DismissWarning suppresses the daemon's T-FinalWarningLead fallback dialog for
+// the current deadline. Best-effort: a stale call is silently swallowed daemon-side.
+func (s *Session) DismissWarning(ctx context.Context) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.DismissSessionWarning(ctx, &proto.DismissSessionWarningRequest{})
+	return err
+}
diff --git a/client/ui/authsession/warning.go b/client/ui/authsession/warning.go
new file mode 100644
index 000000000..91ae7f101
--- /dev/null
+++ b/client/ui/authsession/warning.go
@@ -0,0 +1,64 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package authsession holds the UI-side domain logic for the SSO
+// session-extend feature. The Wails facades in client/ui/services/session*.go
+// are thin adapters over these types.
+package authsession
+
+import (
+	"time"
+
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+)
+
+// Re-exported from sessionwatch so UI-side consumers don't import the
+// daemon-internal package directly.
+const (
+	MetaWarning          = sessionwatch.MetaSessionWarning
+	MetaFinal            = sessionwatch.MetaSessionFinal
+	MetaExpiresAt        = sessionwatch.MetaSessionExpiresAt
+	MetaLeadMinutes      = sessionwatch.MetaSessionLeadMinutes
+	MetaDeadlineRejected = sessionwatch.MetaSessionDeadlineRejected
+)
+
+// Warning is the typed payload emitted on the session-warning Wails events.
+type Warning struct {
+	// Absolute UTC deadline; best-effort, stays zero when metadata is
+	// missing or malformed (e.g. an older daemon) and the UI falls back
+	// to the Status snapshot.
+	ExpiresAt time.Time `json:"sessionExpiresAt"`
+	// Configured lead time, so the UI need not hardcode the constant.
+	LeadMinutes int `json:"leadMinutes"`
+	// True on the final-warning fallback event.
+	Final bool `json:"final"`
+}
+
+// WarningFromMetadata parses SystemEvent metadata into a Warning, or returns
+// (nil, false) when the event is not a session-warning. A field that fails to
+// parse stays zero; the event is still surfaced.
+func WarningFromMetadata(meta map[string]string) (*Warning, bool) {
+	if meta == nil || meta[MetaWarning] != "true" {
+		return nil, false
+	}
+
+	out := &Warning{
+		Final: meta[MetaFinal] == "true",
+	}
+	if raw := meta[MetaExpiresAt]; raw != "" {
+		if t, err := sessionwatch.ParseExpiresAt(raw); err == nil {
+			out.ExpiresAt = t
+		}
+	}
+	if raw := meta[MetaLeadMinutes]; raw != "" {
+		if n, err := sessionwatch.ParseLeadMinutes(raw); err == nil {
+			out.LeadMinutes = n
+		}
+	}
+	return out, true
+}
+
+// ParseExpiresAt re-exports sessionwatch.ParseExpiresAt so UI-side call sites
+// don't import the daemon-internal package.
+func ParseExpiresAt(s string) (time.Time, error) {
+	return sessionwatch.ParseExpiresAt(s)
+}
diff --git a/client/ui/authsession/warning_test.go b/client/ui/authsession/warning_test.go
new file mode 100644
index 000000000..297073ded
--- /dev/null
+++ b/client/ui/authsession/warning_test.go
@@ -0,0 +1,82 @@
+//go:build !android && !ios && !freebsd && !js
+
+package authsession
+
+import (
+	"testing"
+	"time"
+)
+
+func TestWarningFromMetadata_NotASessionWarning(t *testing.T) {
+	cases := []struct {
+		name string
+		meta map[string]string
+	}{
+		{"nil metadata", nil},
+		{"empty map", map[string]string{}},
+		{"unrelated event", map[string]string{"new_version_available": "0.65.0"}},
+		{"flag not 'true'", map[string]string{"session_warning": "1"}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if w, ok := WarningFromMetadata(tc.meta); ok {
+				t.Fatalf("expected (nil, false), got (%+v, %v)", w, ok)
+			}
+		})
+	}
+}
+
+func TestWarningFromMetadata_FullPayload(t *testing.T) {
+	ts := "2026-05-18T13:30:00Z"
+	meta := map[string]string{
+		"session_warning":    "true",
+		"session_expires_at": ts,
+		"lead_minutes":       "10",
+	}
+
+	got, ok := WarningFromMetadata(meta)
+	if !ok {
+		t.Fatalf("expected the warning to be recognised, got ok=false")
+	}
+	want, _ := time.Parse(time.RFC3339, ts)
+	if !got.ExpiresAt.Equal(want.UTC()) {
+		t.Errorf("ExpiresAt = %v, want %v", got.ExpiresAt, want.UTC())
+	}
+	if got.LeadMinutes != 10 {
+		t.Errorf("LeadMinutes = %d, want 10", got.LeadMinutes)
+	}
+}
+
+func TestWarningFromMetadata_BadFieldsStillEmits(t *testing.T) {
+	// Older or buggy daemon: the flag is set but the timestamp/lead are
+	// missing or malformed. The UI should still get a warning so it can
+	// at least surface "session expires soon"; field zero-values are fine.
+	meta := map[string]string{
+		"session_warning":    "true",
+		"session_expires_at": "not-a-timestamp",
+		"lead_minutes":       "abc",
+	}
+
+	got, ok := WarningFromMetadata(meta)
+	if !ok {
+		t.Fatalf("warning should still be recognised even with malformed fields")
+	}
+	if !got.ExpiresAt.IsZero() {
+		t.Errorf("malformed timestamp should leave field zero, got %v", got.ExpiresAt)
+	}
+	if got.LeadMinutes != 0 {
+		t.Errorf("malformed lead_minutes should leave field 0, got %d", got.LeadMinutes)
+	}
+}
+
+func TestWarningFromMetadata_MissingFieldsStillEmits(t *testing.T) {
+	// Only the flag is present (e.g. future-trimmed event). Still emit.
+	meta := map[string]string{"session_warning": "true"}
+	got, ok := WarningFromMetadata(meta)
+	if !ok {
+		t.Fatalf("warning should still be recognised when only flag is present")
+	}
+	if got.ExpiresAt.IsZero() != true || got.LeadMinutes != 0 {
+		t.Errorf("missing fields should be zero-valued, got %+v", got)
+	}
+}
diff --git a/client/ui/autostart_default.go b/client/ui/autostart_default.go
new file mode 100644
index 000000000..0c67667dd
--- /dev/null
+++ b/client/ui/autostart_default.go
@@ -0,0 +1,121 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// autostartDefaultState carries the guard inputs of the one-time autostart
+// default decision so the decision itself stays a pure, testable function.
+type autostartDefaultState struct {
+	supported    bool
+	mdmDisabled  bool
+	priorInstall bool
+}
+
+// shouldEnableAutostartDefault applies the first-run guards in order and
+// returns whether autostart may be enabled, plus the reason when it may not.
+func shouldEnableAutostartDefault(s autostartDefaultState) (bool, string) {
+	switch {
+	case !s.supported:
+		return false, "autostart not supported on this platform"
+	case s.mdmDisabled:
+		return false, "autostart disabled by MDM policy"
+	case s.priorInstall:
+		return false, "existing NetBird installation"
+	}
+	return true, ""
+}
+
+// autostartDisabledByMDM reports whether the MDM policy manages the
+// disableAutostart key in a way that must suppress the default. An
+// unparseable managed value is treated as disabled to stay on the safe side.
+func autostartDisabledByMDM(policy *mdm.Policy) bool {
+	if !policy.HasKey(mdm.KeyDisableAutostart) {
+		return false
+	}
+	disabled, ok := policy.GetBool(mdm.KeyDisableAutostart)
+	return !ok || disabled
+}
+
+// netbirdFootprintExists reports whether the machine already carries NetBird
+// daemon config or state, meaning this is not a genuinely fresh install. It is
+// the update-safety gate for the autostart default: upgrading users always
+// have a footprint, so an update can never trigger a autostart entry write.
+func netbirdFootprintExists() bool {
+	candidates := []string{
+		profilemanager.DefaultConfigPath,
+		filepath.Join(profilemanager.DefaultConfigPathDir, "config.json"),
+		filepath.Join(profilemanager.DefaultConfigPathDir, "state.json"),
+	}
+	for _, path := range candidates {
+		if path != "" && fileExists(path) {
+			return true
+		}
+	}
+	return false
+}
+
+// applyAutostartDefault runs the one-time launch-on-login default for genuinely
+// fresh installs. The autostartInitialized marker is persisted before any
+// enable attempt so a crash mid-flow degrades to "never enabled" instead of
+// retrying autostart entry writes on every launch. A user's later disable in
+// Settings is never overridden: the marker guarantees at-most-once, ever.
+func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, prefs *preferences.Store, prefsFileExisted bool) {
+	mdmDisabled := autostartDisabledByMDM(mdm.NewLoader(nil).Load())
+
+	if mdmDisabled {
+		if enabled, err := autostart.IsEnabled(ctx); err != nil {
+			log.Warnf("MDM disableAutostart: read autostart state: %v", err)
+		} else if enabled {
+			if err := autostart.SetEnabled(ctx, false); err != nil {
+				log.Warnf("MDM disableAutostart: force off failed: %v", err)
+			} else {
+				log.Info("MDM disableAutostart enforced: autostart turned off")
+			}
+		}
+	}
+
+	priorFootprint := netbirdFootprintExists() || prefsFileExisted
+
+	if prefs.Get().AutostartInitialized {
+		return
+	}
+	if err := prefs.SetAutostartInitialized(true); err != nil {
+		log.Warnf("persist autostart marker, skipping autostart default: %v", err)
+		return
+	}
+
+	state := autostartDefaultState{
+		supported:    autostart.Supported(ctx),
+		mdmDisabled:  mdmDisabled,
+		priorInstall: priorFootprint,
+	}
+	enable, reason := shouldEnableAutostartDefault(state)
+	if !enable {
+		log.Debugf("skipping autostart default: %s", reason)
+		return
+	}
+
+	if err := autostart.SetEnabled(ctx, true); err != nil {
+		log.Warnf("enable autostart on fresh install: %v", err)
+		return
+	}
+	log.Info("autostart enabled by default on fresh install")
+}
+
+// fileExists reports whether path exists.
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}
diff --git a/client/ui/autostart_default_test.go b/client/ui/autostart_default_test.go
new file mode 100644
index 000000000..b7bdf9f2a
--- /dev/null
+++ b/client/ui/autostart_default_test.go
@@ -0,0 +1,125 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+func TestShouldEnableAutostartDefault(t *testing.T) {
+	allPass := autostartDefaultState{
+		supported:    true,
+		mdmDisabled:  false,
+		priorInstall: false,
+	}
+
+	tests := []struct {
+		name       string
+		mutate     func(*autostartDefaultState)
+		wantEnable bool
+		wantReason string
+	}{
+		{
+			name:       "fresh install with all guards passing enables",
+			mutate:     func(*autostartDefaultState) {},
+			wantEnable: true,
+		},
+		{
+			name:       "unsupported platform skips",
+			mutate:     func(s *autostartDefaultState) { s.supported = false },
+			wantReason: "autostart not supported on this platform",
+		},
+		{
+			name:       "MDM disable skips",
+			mutate:     func(s *autostartDefaultState) { s.mdmDisabled = true },
+			wantReason: "autostart disabled by MDM policy",
+		},
+		{
+			name:       "existing installation (upgrade) skips",
+			mutate:     func(s *autostartDefaultState) { s.priorInstall = true },
+			wantReason: "existing NetBird installation",
+		},
+		{
+			name: "unsupported wins over every other guard",
+			mutate: func(s *autostartDefaultState) {
+				s.supported = false
+				s.mdmDisabled = true
+				s.priorInstall = true
+			},
+			wantReason: "autostart not supported on this platform",
+		},
+		{
+			name: "MDM disable wins over prior install",
+			mutate: func(s *autostartDefaultState) {
+				s.mdmDisabled = true
+				s.priorInstall = true
+			},
+			wantReason: "autostart disabled by MDM policy",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			state := allPass
+			tc.mutate(&state)
+			enable, reason := shouldEnableAutostartDefault(state)
+			assert.Equal(t, tc.wantEnable, enable, "enable decision should match for state %+v", state)
+			assert.Equal(t, tc.wantReason, reason, "skip reason should identify the failing guard")
+		})
+	}
+}
+
+func TestAutostartDisabledByMDM(t *testing.T) {
+	tests := []struct {
+		name   string
+		values map[string]any
+		want   bool
+	}{
+		{
+			name:   "empty policy does not disable",
+			values: nil,
+			want:   false,
+		},
+		{
+			name:   "unrelated managed keys do not disable",
+			values: map[string]any{mdm.KeyDisableAutoConnect: true},
+			want:   false,
+		},
+		{
+			name:   "disableAutostart true disables",
+			values: map[string]any{mdm.KeyDisableAutostart: true},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart registry DWORD 1 disables",
+			values: map[string]any{mdm.KeyDisableAutostart: int64(1)},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart string true disables",
+			values: map[string]any{mdm.KeyDisableAutostart: "true"},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart explicit false allows",
+			values: map[string]any{mdm.KeyDisableAutostart: false},
+			want:   false,
+		},
+		{
+			name:   "unparseable managed value is treated as disabled",
+			values: map[string]any{mdm.KeyDisableAutostart: "not-a-bool"},
+			want:   true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := autostartDisabledByMDM(mdm.NewPolicy(tc.values))
+			assert.Equal(t, tc.want, got, "MDM disable decision should match for values %v", tc.values)
+		})
+	}
+}
diff --git a/client/ui/build/Taskfile.yml b/client/ui/build/Taskfile.yml
new file mode 100644
index 000000000..590d4791b
--- /dev/null
+++ b/client/ui/build/Taskfile.yml
@@ -0,0 +1,295 @@
+version: '3'
+
+tasks:
+  go:mod:tidy:
+    summary: Runs `go mod tidy`
+    internal: true
+    cmds:
+      - go mod tidy
+
+  install:frontend:deps:
+    summary: Install frontend dependencies
+    dir: frontend
+    sources:
+      - package.json
+      - pnpm-lock.yaml
+    generates:
+      - node_modules
+    preconditions:
+      - sh: pnpm --version
+        msg: "Looks like pnpm isn't installed. Install with: corepack enable && corepack prepare pnpm@latest --activate"
+    cmds:
+      - pnpm install
+
+  build:frontend:
+    label: build:frontend (DEV={{.DEV}})
+    summary: Build the frontend project
+    dir: frontend
+    sources:
+      - "**/*"
+      - exclude: node_modules/**/*
+    generates:
+      - dist/**/*
+    deps:
+      - task: install:frontend:deps
+      - task: generate:bindings
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+    cmds:
+      - pnpm run {{.BUILD_COMMAND}}
+    env:
+      PRODUCTION: '{{if eq .DEV "true"}}false{{else}}true{{end}}'
+    vars:
+      BUILD_COMMAND: '{{if eq .DEV "true"}}build:dev{{else}}build{{end}}'
+
+
+  frontend:vendor:puppertino:
+    summary: Fetches Puppertino CSS into frontend/public for consistent mobile styling
+    sources:
+      - frontend/public/puppertino/puppertino.css
+    generates:
+      - frontend/public/puppertino/puppertino.css
+    cmds:
+      - |
+        set -euo pipefail
+        mkdir -p frontend/public/puppertino
+        # If bundled Puppertino exists, prefer it. Otherwise, try to fetch, but don't fail build on error.
+        if [ ! -f frontend/public/puppertino/puppertino.css ]; then
+          echo "No bundled Puppertino found. Attempting to fetch from GitHub..."
+          if curl -fsSL https://raw.githubusercontent.com/codedgar/Puppertino/main/dist/css/full.css -o frontend/public/puppertino/puppertino.css; then
+            curl -fsSL https://raw.githubusercontent.com/codedgar/Puppertino/main/LICENSE -o frontend/public/puppertino/LICENSE || true
+            echo "Puppertino CSS downloaded to frontend/public/puppertino/puppertino.css"
+          else
+            echo "Warning: Could not fetch Puppertino CSS. Proceeding without download since template may bundle it."
+          fi
+        else
+          echo "Using bundled Puppertino at frontend/public/puppertino/puppertino.css"
+        fi
+        # Ensure index.html includes Puppertino CSS and button classes
+        INDEX_HTML=frontend/index.html
+        if [ -f "$INDEX_HTML" ]; then
+          if ! grep -q 'href="/puppertino/puppertino.css"' "$INDEX_HTML"; then
+            # Insert Puppertino link tag after style.css link
+            awk '
+              /href="\/style.css"\/?/ && !x { print; print "    <link rel=\"stylesheet\" href=\"/puppertino/puppertino.css\"/>"; x=1; next }1
+            ' "$INDEX_HTML" > "$INDEX_HTML.tmp" && mv "$INDEX_HTML.tmp" "$INDEX_HTML"
+          fi
+          # Replace default .btn with Puppertino primary button classes if present
+          sed -E -i'' 's/class=\"btn\"/class=\"p-btn p-prim-col\"/g' "$INDEX_HTML" || true
+        fi
+
+
+  generate:bindings:
+    label: generate:bindings (BUILD_FLAGS={{.BUILD_FLAGS}})
+    summary: Generates bindings for the frontend
+    deps:
+      - task: go:mod:tidy
+    sources:
+      - "**/*.[jt]s"
+      - exclude: frontend/**/*
+      - frontend/bindings/**/*  # Rerun when switching between dev/production mode causes changes in output
+      - "**/*.go"
+      - go.mod
+      - go.sum
+    generates:
+      - frontend/bindings/**/*
+    cmds:
+      - wails3 generate bindings -f '{{.BUILD_FLAGS}}' -clean=true -ts
+
+  generate:icons:
+    summary: Generates Windows `.ico` and Mac `.icns` from an image; on macOS, `-iconcomposerinput appicon.icon -macassetdir darwin` also produces `Assets.car` from a `.icon` file (skipped on other platforms).
+    dir: build
+    sources:
+      - "appicon.png"
+      - "appicon.icon"
+    generates:
+      - "darwin/icons.icns"
+      - "windows/icon.ico"
+    cmds:
+      - wails3 generate icons -input appicon.png -macfilename darwin/icons.icns -windowsfilename windows/icon.ico -iconcomposerinput appicon.icon -macassetdir darwin
+
+  generate:tray:icons:
+    summary: Rebuild Windows multi-res .ico files from the per-state PNGs.
+    desc: |
+      The colored tray PNGs (assets/netbird-systemtray-<state>.png) and the
+      macOS template variants are committed to the repo as the canonical
+      source. This task only regenerates the Windows multi-resolution .ico
+      files from those PNGs by downscaling each to 16/24/32/48 px and
+      packing them with icotool, so Shell_NotifyIcon picks the frame
+      matching the user's DPI instead of downscaling a single large PNG.
+
+      Run after replacing any of the colored PNGs (e.g. when copying a new
+      version of the icons from client/ui/assets). The SVG sources in
+      assets/svg/ are kept for reference but are not built by default.
+    dir: assets
+    sources:
+      - "netbird-systemtray-connected.png"
+      - "netbird-systemtray-disconnected.png"
+      - "netbird-systemtray-connecting.png"
+      - "netbird-systemtray-error.png"
+      - "netbird-systemtray-update-connected.png"
+      - "netbird-systemtray-update-disconnected.png"
+    generates:
+      - "netbird-systemtray-*.ico"
+    preconditions:
+      - sh: command -v magick >/dev/null 2>&1 || command -v convert >/dev/null 2>&1
+        msg: "ImageMagick is required to downscale PNGs (apt install imagemagick)"
+      - sh: command -v icotool >/dev/null 2>&1
+        msg: "icotool is required to pack tray .ico files (apt install icoutils)"
+    cmds:
+      - |
+        set -euo pipefail
+        tmp=$(mktemp -d)
+        trap 'rm -rf "$tmp"' EXIT
+        resize=$(command -v magick || echo convert)
+        for state in connected disconnected connecting error update-connected update-disconnected; do
+          for sz in 16 24 32 48; do
+            "$resize" "netbird-systemtray-$state.png" -resize ${sz}x${sz} "$tmp/$state-$sz.png"
+          done
+          icotool -c -o "netbird-systemtray-$state.ico" \
+            "$tmp/$state-16.png" "$tmp/$state-24.png" "$tmp/$state-32.png" "$tmp/$state-48.png"
+        done
+
+  dev:frontend:
+    summary: Runs the frontend in development mode
+    dir: frontend
+    deps:
+      - task: install:frontend:deps
+    cmds:
+      - pnpm exec vite --port {{.VITE_PORT}} --strictPort
+
+  update:build-assets:
+    summary: Updates the build assets
+    dir: build
+    cmds:
+      - wails3 update build-assets -name "{{.APP_NAME}}" -binaryname "{{.APP_NAME}}" -config config.yml -dir .
+
+  build:server:
+    summary: Builds the application in server mode (no GUI, HTTP server only)
+    desc: |
+      Builds the application with the server build tag enabled.
+      Server mode runs as a pure HTTP server without native GUI dependencies.
+      Usage: task build:server
+    deps:
+      - task: build:frontend
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+    cmds:
+      - go build -tags server {{.BUILD_FLAGS}} -o {{.BIN_DIR}}/{{.APP_NAME}}-server{{exeExt}}
+    vars:
+      BUILD_FLAGS: "{{.BUILD_FLAGS}}"
+
+  run:server:
+    summary: Builds and runs the application in server mode
+    deps:
+      - task: build:server
+    cmds:
+      - ./{{.BIN_DIR}}/{{.APP_NAME}}-server{{exeExt}}
+
+  build:docker:
+    summary: Builds a Docker image for server mode deployment
+    desc: |
+      Creates a minimal Docker image containing the server mode binary.
+      The image is based on distroless for security and small size.
+      Usage: task build:docker [TAG=myapp:latest]
+    cmds:
+      - docker build -t {{.TAG | default (printf "%s:latest" .APP_NAME)}} -f build/docker/Dockerfile.server .
+    vars:
+      TAG: "{{.TAG}}"
+    preconditions:
+      - sh: docker info > /dev/null 2>&1
+        msg: "Docker is required. Please install Docker first."
+      - sh: test -f build/docker/Dockerfile.server
+        msg: "Dockerfile.server not found. Run 'wails3 update build-assets' to generate it."
+
+  run:docker:
+    summary: Builds and runs the Docker image
+    desc: |
+      Builds the Docker image and runs it, exposing port 8080.
+      Usage: task run:docker [TAG=myapp:latest] [PORT=8080]
+      Note: The internal container port is always 8080. The PORT variable
+      only changes the host port mapping. Ensure your app uses port 8080
+      or modify the Dockerfile to match your ServerOptions.Port setting.
+    deps:
+      - task: build:docker
+        vars:
+          TAG:
+            ref: .TAG
+    cmds:
+      - docker run --rm -p {{.PORT | default "8080"}}:8080 {{.TAG | default (printf "%s:latest" .APP_NAME)}}
+    vars:
+      TAG: "{{.TAG}}"
+      PORT: "{{.PORT}}"
+
+  setup:docker:
+    summary: Builds Docker image for cross-compilation (~800MB download)
+    desc: |
+      Builds the Docker image needed for cross-compiling to any platform.
+      Run this once to enable cross-platform builds from any OS.
+    cmds:
+      - docker build -t wails-cross -f build/docker/Dockerfile.cross build/docker/
+    preconditions:
+      - sh: docker info > /dev/null 2>&1
+        msg: "Docker is required. Please install Docker first."
+
+  ios:device:list:
+    summary: Lists connected iOS devices (UDIDs)
+    cmds:
+      - xcrun xcdevice list
+
+  ios:run:device:
+    summary: Build, install, and launch on a physical iPhone using Apple tools (xcodebuild/devicectl)
+    vars:
+      PROJECT: '{{.PROJECT}}'   # e.g., build/ios/xcode/<YourProject>.xcodeproj
+      SCHEME: '{{.SCHEME}}'     # e.g., ios.dev
+      CONFIG: '{{.CONFIG | default "Debug"}}'
+      DERIVED: '{{.DERIVED | default "build/ios/DerivedData"}}'
+      UDID: '{{.UDID}}'         # from `task ios:device:list`
+      BUNDLE_ID: '{{.BUNDLE_ID}}' # e.g., com.yourco.wails.ios.dev
+      TEAM_ID: '{{.TEAM_ID}}'   # optional, if your project is not already set up for signing
+    preconditions:
+      - sh: xcrun -f xcodebuild
+        msg: "xcodebuild not found. Please install Xcode."
+      - sh: xcrun -f devicectl
+        msg: "devicectl not found. Please update to Xcode 15+ (which includes devicectl)."
+      - sh: test -n '{{.PROJECT}}'
+        msg: "Set PROJECT to your .xcodeproj path (e.g., PROJECT=build/ios/xcode/App.xcodeproj)."
+      - sh: test -n '{{.SCHEME}}'
+        msg: "Set SCHEME to your app scheme (e.g., SCHEME=ios.dev)."
+      - sh: test -n '{{.UDID}}'
+        msg: "Set UDID to your device UDID (see: task ios:device:list)."
+      - sh: test -n '{{.BUNDLE_ID}}'
+        msg: "Set BUNDLE_ID to your app's bundle identifier (e.g., com.yourco.wails.ios.dev)."
+    cmds:
+      - |
+        set -euo pipefail
+        echo "Building for device: UDID={{.UDID}} SCHEME={{.SCHEME}} PROJECT={{.PROJECT}}"
+        XCB_ARGS=(
+          -project "{{.PROJECT}}"
+          -scheme "{{.SCHEME}}"
+          -configuration "{{.CONFIG}}"
+          -destination "id={{.UDID}}"
+          -derivedDataPath "{{.DERIVED}}"
+          -allowProvisioningUpdates
+          -allowProvisioningDeviceRegistration
+        )
+        # Optionally inject signing identifiers if provided
+        if [ -n '{{.TEAM_ID}}' ]; then XCB_ARGS+=(DEVELOPMENT_TEAM={{.TEAM_ID}}); fi
+        if [ -n '{{.BUNDLE_ID}}' ]; then XCB_ARGS+=(PRODUCT_BUNDLE_IDENTIFIER={{.BUNDLE_ID}}); fi
+        xcodebuild "${XCB_ARGS[@]}" build | xcpretty || true
+        # If xcpretty isn't installed, run without it
+        if [ "${PIPESTATUS[0]}" -ne 0 ]; then
+          xcodebuild "${XCB_ARGS[@]}" build
+        fi
+        # Find built .app
+        APP_PATH=$(find "{{.DERIVED}}/Build/Products" -type d -name "*.app" -maxdepth 3 | head -n 1)
+        if [ -z "$APP_PATH" ]; then
+          echo "Could not locate built .app under {{.DERIVED}}/Build/Products" >&2
+          exit 1
+        fi
+        echo "Installing: $APP_PATH"
+        xcrun devicectl device install app --device "{{.UDID}}" "$APP_PATH"
+        echo "Launching: {{.BUNDLE_ID}}"
+        xcrun devicectl device process launch --device "{{.UDID}}" --stderr console --stdout console "{{.BUNDLE_ID}}"
diff --git a/client/ui/build/appicon.icon/Assets/wails_icon_vector.svg b/client/ui/build/appicon.icon/Assets/wails_icon_vector.svg
new file mode 100644
index 000000000..83c4c22a9
--- /dev/null
+++ b/client/ui/build/appicon.icon/Assets/wails_icon_vector.svg
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!--
+  macOS Icon Composer source. Designed on a 1024x1024 canvas with the bird
+  glyph centered and sized to ~75% of canvas width, leaving padding for
+  the system squircle treatment.
+-->
+<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024">
+  <g transform="translate(128, 227) scale(24.77)">
+    <path d="M21.4631 0.523438C17.8173 0.857913 16.0028 2.95675 15.3171 4.01871L4.66406 22.4734H17.5163L30.1929 0.523438H21.4631Z" fill="#F68330"/>
+    <path d="M17.5265 22.4737L0 3.88525C0 3.88525 19.8177 -1.44128 21.7493 15.1738L17.5265 22.4737Z" fill="#F68330"/>
+    <path d="M14.9236 4.70563L9.54688 14.0208L17.5158 22.4747L21.7385 15.158C21.0696 9.44682 18.2851 6.32784 14.9236 4.69727" fill="#F05252"/>
+  </g>
+</svg>
diff --git a/client/ui/build/appicon.icon/icon.json b/client/ui/build/appicon.icon/icon.json
new file mode 100644
index 000000000..4a0371af3
--- /dev/null
+++ b/client/ui/build/appicon.icon/icon.json
@@ -0,0 +1,26 @@
+{
+  "fill" : {
+    "solid" : "srgb:1.00000,1.00000,1.00000,1.00000"
+  },
+  "groups" : [
+    {
+      "layers" : [
+        {
+          "image-name" : "wails_icon_vector.svg",
+          "name" : "wails_icon_vector"
+        }
+      ],
+      "shadow" : {
+        "kind" : "neutral",
+        "opacity" : 0.5
+      },
+      "specular" : true
+    }
+  ],
+  "supported-platforms" : {
+    "circles" : [
+      "watchOS"
+    ],
+    "squares" : "shared"
+  }
+}
diff --git a/client/ui/build/appicon.png b/client/ui/build/appicon.png
new file mode 100644
index 000000000..977d2400a
Binary files /dev/null and b/client/ui/build/appicon.png differ
diff --git a/client/ui/build/build-ui-linux.sh b/client/ui/build/build-ui-linux.sh
deleted file mode 100644
index eab08214d..000000000
--- a/client/ui/build/build-ui-linux.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/bash
-sudo apt update
-sudo apt remove gir1.2-appindicator3-0.1
-sudo apt install -y libayatana-appindicator3-dev
-go build
\ No newline at end of file
diff --git a/client/ui/build/config.yml b/client/ui/build/config.yml
new file mode 100644
index 000000000..08b95b6bd
--- /dev/null
+++ b/client/ui/build/config.yml
@@ -0,0 +1,78 @@
+# This file contains the configuration for this project.
+# When you update `info` or `fileAssociations`, run `wails3 task common:update:build-assets` to update the assets.
+# Note that this will overwrite any changes you have made to the assets.
+version: '3'
+
+# This information is used to generate the build assets.
+info:
+  companyName: "NetBird GmbH" # The name of the company
+  productName: "NetBird" # The name of the application
+  productIdentifier: "io.netbird.client" # The unique product identifier
+  description: "NetBird desktop client" # The application description
+  copyright: "NetBird GmbH" # Copyright text
+  comments: "Some Product Comments" # Comments
+  version: "0.0.1" # The application version
+  # cfBundleIconName: "appicon" # The macOS icon name in Assets.car icon bundles (optional)
+  #                               # Should match the name of your .icon file without the extension
+  #                               # If not set and Assets.car exists, defaults to "appicon"
+
+# iOS build configuration (uncomment to customise iOS project generation)
+# Note: Keys under `ios` OVERRIDE values under `info` when set.
+# ios:
+#   # The iOS bundle identifier used in the generated Xcode project (CFBundleIdentifier)
+#   bundleID: "com.mycompany.myproduct"
+#   # The display name shown under the app icon (CFBundleDisplayName/CFBundleName)
+#   displayName: "My Product"
+#   # The app version to embed in Info.plist (CFBundleShortVersionString/CFBundleVersion)
+#   version: "0.0.1"
+#   # The company/organisation name for templates and project settings
+#   company: "My Company"
+#   # Additional comments to embed in Info.plist metadata
+#   comments: "Some Product Comments"
+
+# Dev mode configuration
+dev_mode:
+  root_path: .
+  log_level: warn
+  debounce: 1000
+  ignore:
+    dir:
+      - .git
+      - node_modules
+      - frontend
+      - bin
+    file:
+      - .DS_Store
+      - .gitignore
+      - .gitkeep
+    watched_extension:
+      - "*.go"
+      - "*.js" # Watch for changes to JS/TS files included using the //wails:include directive.
+      - "*.ts" # The frontend directory will be excluded entirely by the setting above.
+    git_ignore: true
+  executes:
+    - cmd: wails3 build DEV=true
+      type: blocking
+    - cmd: wails3 task common:dev:frontend
+      type: background
+    - cmd: wails3 task run
+      type: primary
+
+# File Associations
+# More information at: https://v3.wails.io/noit/done/yet
+fileAssociations:
+#  - ext: wails
+#    name: Wails
+#    description: Wails Application File
+#    iconName: wailsFileIcon
+#    role: Editor
+#  - ext: jpg
+#    name: JPEG
+#    description: Image File
+#    iconName: jpegFileIcon
+#    role: Editor
+#    mimeType: image/jpeg  # (optional)
+
+# Other data
+other:
+  - name: My Other Data
\ No newline at end of file
diff --git a/client/ui/build/darwin/Info.dev.plist b/client/ui/build/darwin/Info.dev.plist
new file mode 100644
index 000000000..78f5a7b1c
--- /dev/null
+++ b/client/ui/build/darwin/Info.dev.plist
@@ -0,0 +1,38 @@
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>CFBundlePackageType</key>
+            <string>APPL</string>
+        <key>CFBundleName</key>
+            <string>NetBird</string>
+        <key>CFBundleDisplayName</key>
+            <string>NetBird</string>
+        <key>CFBundleExecutable</key>
+            <string>netbird-ui</string>
+        <key>CFBundleIdentifier</key>
+            <string>io.netbird.client</string>
+        <key>CFBundleVersion</key>
+            <string>0.0.1</string>
+        <key>CFBundleGetInfoString</key>
+            <string>This is a comment</string>
+        <key>CFBundleShortVersionString</key>
+            <string>0.0.1</string>
+        <key>CFBundleIconFile</key>
+            <string>icons</string>
+        <key>CFBundleIconName</key>
+            <string>appicon</string>
+        <key>LSMinimumSystemVersion</key>
+            <string>10.15.0</string>
+        <key>NSHighResolutionCapable</key>
+            <string>true</string>
+        <key>LSUIElement</key>
+            <string>1</string>
+        <key>NSHumanReadableCopyright</key>
+            <string>NetBird GmbH</string>
+        <key>NSAppTransportSecurity</key>
+        <dict>
+            <key>NSAllowsLocalNetworking</key>
+            <true/>
+        </dict>
+    </dict>
+</plist>
\ No newline at end of file
diff --git a/client/ui/build/darwin/Info.plist b/client/ui/build/darwin/Info.plist
new file mode 100644
index 000000000..1e12b049b
--- /dev/null
+++ b/client/ui/build/darwin/Info.plist
@@ -0,0 +1,36 @@
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>CFBundlePackageType</key>
+            <string>APPL</string>
+        <key>CFBundleName</key>
+            <string>NetBird</string>
+        <key>CFBundleDisplayName</key>
+            <string>NetBird</string>
+        <key>CFBundleExecutable</key>
+            <string>netbird-ui</string>
+        <key>CFBundleIdentifier</key>
+            <string>io.netbird.client</string>
+        <key>CFBundleVersion</key>
+            <string>0.0.1</string>
+        <key>CFBundleGetInfoString</key>
+            <string>This is a comment</string>
+        <key>CFBundleShortVersionString</key>
+            <string>0.0.1</string>
+        <key>CFBundleIconFile</key>
+            <string>icons</string>
+        <key>CFBundleIconName</key>
+            <string>appicon</string>
+        <key>LSMinimumSystemVersion</key>
+            <string>10.15.0</string>
+        <key>NSHighResolutionCapable</key>
+            <string>true</string>
+        <!-- Accessory mode: tray-only app, no Dock entry, no Cmd-Tab
+             presence. Matches the legacy Fyne client and the sign-pipelines
+             Info.plist used in signed .pkg releases. -->
+        <key>LSUIElement</key>
+            <string>1</string>
+        <key>NSHumanReadableCopyright</key>
+            <string>NetBird GmbH</string>
+    </dict>
+</plist>
\ No newline at end of file
diff --git a/client/ui/build/darwin/Taskfile.yml b/client/ui/build/darwin/Taskfile.yml
new file mode 100644
index 000000000..8a5c27bdc
--- /dev/null
+++ b/client/ui/build/darwin/Taskfile.yml
@@ -0,0 +1,210 @@
+version: '3'
+
+includes:
+  common: ../Taskfile.yml
+
+vars:
+  # Signing configuration - edit these values for your project
+  # SIGN_IDENTITY: "Developer ID Application: Your Company (TEAMID)"
+  # KEYCHAIN_PROFILE: "my-notarize-profile"
+  # ENTITLEMENTS: "build/darwin/entitlements.plist"
+
+  # Docker image for cross-compilation (used when building on non-macOS)
+  CROSS_IMAGE: wails-cross
+
+tasks:
+  build:
+    summary: Builds the application
+    cmds:
+      - task: '{{if eq OS "darwin"}}build:native{{else}}build:docker{{end}}'
+        vars:
+          ARCH: '{{.ARCH}}'
+          DEV: '{{.DEV}}'
+          OUTPUT: '{{.OUTPUT}}'
+          EXTRA_TAGS: '{{.EXTRA_TAGS}}'
+    vars:
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+
+  build:native:
+    summary: Builds the application natively on macOS
+    internal: true
+    deps:
+      - task: common:go:mod:tidy
+      - task: common:build:frontend
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+          DEV:
+            ref: .DEV
+      - task: common:generate:icons
+    cmds:
+      - go build {{.BUILD_FLAGS}} -o {{.OUTPUT}}
+    vars:
+      BUILD_FLAGS: '{{if eq .DEV "true"}}{{if .EXTRA_TAGS}}-tags {{.EXTRA_TAGS}} {{end}}-gcflags=all="-l"{{else}}-tags production{{if .EXTRA_TAGS}},{{.EXTRA_TAGS}}{{end}} -trimpath -ldflags="-w -s"{{end}}'
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+    env:
+      GOOS: darwin
+      CGO_ENABLED: 1
+      GOARCH: '{{.ARCH | default ARCH}}'
+      CGO_CFLAGS: "-mmacosx-version-min=10.15"
+      CGO_LDFLAGS: "-mmacosx-version-min=10.15"
+      MACOSX_DEPLOYMENT_TARGET: "10.15"
+
+  build:docker:
+    summary: Cross-compiles for macOS using Docker (for Linux/Windows hosts)
+    internal: true
+    deps:
+      - task: common:build:frontend
+      - task: common:generate:icons
+    preconditions:
+      - sh: docker info > /dev/null 2>&1
+        msg: "Docker is required for cross-compilation. Please install Docker."
+      - sh: docker image inspect {{.CROSS_IMAGE}} > /dev/null 2>&1
+        msg: |
+          Docker image '{{.CROSS_IMAGE}}' not found.
+          Build it first: wails3 task setup:docker
+    cmds:
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" {{.GO_CACHE_MOUNT}} {{.REPLACE_MOUNTS}} -e APP_NAME="{{.APP_NAME}}" {{if .EXTRA_TAGS}}-e EXTRA_TAGS="{{.EXTRA_TAGS}}"{{end}} {{.CROSS_IMAGE}} darwin {{.DOCKER_ARCH}}
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" alpine chown -R $(id -u):$(id -g) /app/bin
+      - mkdir -p {{.BIN_DIR}}
+      - mv "bin/{{.APP_NAME}}-darwin-{{.DOCKER_ARCH}}" "{{.OUTPUT}}"
+    vars:
+      DOCKER_ARCH: '{{if eq .ARCH "arm64"}}arm64{{else if eq .ARCH "amd64"}}amd64{{else}}arm64{{end}}'
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+      # Mount Go module cache for faster builds
+      GO_CACHE_MOUNT:
+        sh: 'echo "-v ${GOPATH:-$HOME/go}/pkg/mod:/go/pkg/mod"'
+      # Extract replace directives from go.mod and create -v mounts for each
+      # Handles both relative (=> ../) and absolute (=> /) paths
+      REPLACE_MOUNTS:
+        sh: |
+          grep -E '^replace .* => ' go.mod 2>/dev/null | while read -r line; do
+            path=$(echo "$line" | sed -E 's/^replace .* => //' | tr -d '\r')
+            # Convert relative paths to absolute
+            if [ "${path#/}" = "$path" ]; then
+              path="$(cd "$(dirname "$path")" 2>/dev/null && pwd)/$(basename "$path")"
+            fi
+            # Only mount if directory exists
+            if [ -d "$path" ]; then
+              echo "-v $path:$path:ro"
+            fi
+          done | tr '\n' ' '
+
+  build:universal:
+    summary: Builds darwin universal binary (arm64 + amd64)
+    deps:
+      - task: build
+        vars:
+          ARCH: amd64
+          OUTPUT: "{{.BIN_DIR}}/{{.APP_NAME}}-amd64"
+      - task: build
+        vars:
+          ARCH: arm64
+          OUTPUT: "{{.BIN_DIR}}/{{.APP_NAME}}-arm64"
+    cmds:
+      - task: '{{if eq OS "darwin"}}build:universal:lipo:native{{else}}build:universal:lipo:go{{end}}'
+
+  build:universal:lipo:native:
+    summary: Creates universal binary using native lipo (macOS)
+    internal: true
+    cmds:
+      - lipo -create -output "{{.BIN_DIR}}/{{.APP_NAME}}" "{{.BIN_DIR}}/{{.APP_NAME}}-amd64" "{{.BIN_DIR}}/{{.APP_NAME}}-arm64"
+      - rm "{{.BIN_DIR}}/{{.APP_NAME}}-amd64" "{{.BIN_DIR}}/{{.APP_NAME}}-arm64"
+
+  build:universal:lipo:go:
+    summary: Creates universal binary using wails3 tool lipo (Linux/Windows)
+    internal: true
+    cmds:
+      - wails3 tool lipo -output "{{.BIN_DIR}}/{{.APP_NAME}}" -input "{{.BIN_DIR}}/{{.APP_NAME}}-amd64" -input "{{.BIN_DIR}}/{{.APP_NAME}}-arm64"
+      - rm -f "{{.BIN_DIR}}/{{.APP_NAME}}-amd64" "{{.BIN_DIR}}/{{.APP_NAME}}-arm64"
+
+  package:
+    summary: Packages the application into a `.app` bundle
+    deps:
+      - task: build
+    cmds:
+      - task: create:app:bundle
+
+  package:universal:
+    summary: Packages darwin universal binary (arm64 + amd64)
+    deps:
+      - task: build:universal
+    cmds:
+      - task: create:app:bundle
+
+
+  create:app:bundle:
+    summary: Creates an `.app` bundle
+    cmds:
+      - mkdir -p "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents/MacOS"
+      - mkdir -p "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents/Resources"
+      - cp build/darwin/icons.icns "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents/Resources"
+      - |
+        if [ -f build/darwin/Assets.car ]; then
+          cp build/darwin/Assets.car "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents/Resources"
+        fi
+      - cp "{{.BIN_DIR}}/{{.APP_NAME}}" "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents/MacOS"
+      - cp build/darwin/Info.plist "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents"
+      - task: '{{if eq OS "darwin"}}codesign:adhoc{{else}}codesign:skip{{end}}'
+
+  codesign:adhoc:
+    summary: Ad-hoc signs the app bundle (macOS only)
+    internal: true
+    cmds:
+      - codesign --force --deep --sign - "{{.BIN_DIR}}/{{.APP_NAME}}.app"
+
+  codesign:skip:
+    summary: Skips codesigning when cross-compiling
+    internal: true
+    cmds:
+      - 'echo "Skipping codesign (not available on {{OS}}). Sign the .app on macOS before distribution."'
+
+  run:
+    deps:
+      - task: common:generate:icons
+    cmds:
+      - mkdir -p "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/MacOS"
+      - mkdir -p "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/Resources"
+      - cp build/darwin/icons.icns "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/Resources"
+      - |
+        if [ -f build/darwin/Assets.car ]; then
+          cp build/darwin/Assets.car "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/Resources"
+        fi
+      - cp "{{.BIN_DIR}}/{{.APP_NAME}}" "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/MacOS"
+      - cp "build/darwin/Info.dev.plist" "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/Info.plist"
+      - codesign --force --deep --sign - "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app"
+      - '{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/MacOS/{{.APP_NAME}}'
+
+  sign:
+    summary: Signs the application bundle with Developer ID
+    desc: |
+      Signs the .app bundle for distribution.
+      Configure SIGN_IDENTITY in the vars section at the top of this file.
+    deps:
+      - task: package
+    cmds:
+      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}.app" --identity "{{.SIGN_IDENTITY}}" {{if .ENTITLEMENTS}}--entitlements {{.ENTITLEMENTS}}{{end}}
+    preconditions:
+      - sh: '[ -n "{{.SIGN_IDENTITY}}" ]'
+        msg: "SIGN_IDENTITY is required. Set it in the vars section at the top of build/darwin/Taskfile.yml"
+
+  sign:notarize:
+    summary: Signs and notarizes the application bundle
+    desc: |
+      Signs the .app bundle and submits it for notarization.
+      Configure SIGN_IDENTITY and KEYCHAIN_PROFILE in the vars section at the top of this file.
+
+      Setup (one-time):
+        wails3 signing credentials --apple-id "you@email.com" --team-id "TEAMID" --password "app-specific-password" --profile "my-profile"
+    deps:
+      - task: package
+    cmds:
+      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}.app" --identity "{{.SIGN_IDENTITY}}" {{if .ENTITLEMENTS}}--entitlements {{.ENTITLEMENTS}}{{end}} --notarize --keychain-profile {{.KEYCHAIN_PROFILE}}
+    preconditions:
+      - sh: '[ -n "{{.SIGN_IDENTITY}}" ]'
+        msg: "SIGN_IDENTITY is required. Set it in the vars section at the top of build/darwin/Taskfile.yml"
+      - sh: '[ -n "{{.KEYCHAIN_PROFILE}}" ]'
+        msg: "KEYCHAIN_PROFILE is required. Set it in the vars section at the top of build/darwin/Taskfile.yml"
diff --git a/client/ui/build/darwin/icons.icns b/client/ui/build/darwin/icons.icns
new file mode 100644
index 000000000..fb78a18a9
Binary files /dev/null and b/client/ui/build/darwin/icons.icns differ
diff --git a/client/ui/build/docker/Dockerfile.cross b/client/ui/build/docker/Dockerfile.cross
new file mode 100644
index 000000000..55c0d69e1
--- /dev/null
+++ b/client/ui/build/docker/Dockerfile.cross
@@ -0,0 +1,203 @@
+# Cross-compile Wails v3 apps to any platform
+#
+# Darwin: Zig + macOS SDK
+# Linux: Native GCC when host matches target, Zig for cross-arch
+# Windows: Zig + bundled mingw
+#
+# Usage:
+#   docker build -t wails-cross -f Dockerfile.cross .
+#   docker run --rm -v $(pwd):/app wails-cross darwin arm64
+#   docker run --rm -v $(pwd):/app wails-cross darwin amd64
+#   docker run --rm -v $(pwd):/app wails-cross linux amd64
+#   docker run --rm -v $(pwd):/app wails-cross linux arm64
+#   docker run --rm -v $(pwd):/app wails-cross windows amd64
+#   docker run --rm -v $(pwd):/app wails-cross windows arm64
+
+FROM golang:1.26.7-bookworm
+
+ARG TARGETARCH
+
+# Install base tools, GCC, and GTK/WebKit dev packages
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl xz-utils nodejs npm pkg-config gcc libc6-dev \
+    libgtk-3-dev libwebkit2gtk-4.1-dev \
+    libgtk-4-dev libwebkitgtk-6.0-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Zig - automatically selects correct binary for host architecture
+ARG ZIG_VERSION=0.14.0
+RUN ZIG_ARCH=$(case "${TARGETARCH}" in arm64) echo "aarch64" ;; *) echo "x86_64" ;; esac) && \
+    curl -L "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-${ZIG_ARCH}-${ZIG_VERSION}.tar.xz" \
+    | tar -xJ -C /opt \
+    && ln -s /opt/zig-linux-${ZIG_ARCH}-${ZIG_VERSION}/zig /usr/local/bin/zig
+
+# Download macOS SDK (required for darwin targets)
+ARG MACOS_SDK_VERSION=14.5
+RUN curl -L "https://github.com/joseluisq/macosx-sdks/releases/download/${MACOS_SDK_VERSION}/MacOSX${MACOS_SDK_VERSION}.sdk.tar.xz" \
+    | tar -xJ -C /opt \
+    && mv /opt/MacOSX${MACOS_SDK_VERSION}.sdk /opt/macos-sdk
+
+ENV MACOS_SDK_PATH=/opt/macos-sdk
+
+# Create Zig CC wrappers for cross-compilation targets
+# Darwin and Windows use Zig; Linux uses native GCC (run with --platform for cross-arch)
+
+# Darwin arm64
+COPY <<'ZIGWRAP' /usr/local/bin/zcc-darwin-arm64
+#!/bin/sh
+ARGS=""
+SKIP_NEXT=0
+for arg in "$@"; do
+    if [ $SKIP_NEXT -eq 1 ]; then
+        SKIP_NEXT=0
+        continue
+    fi
+    case "$arg" in
+        -target) SKIP_NEXT=1 ;;
+        -mmacosx-version-min=*) ;;
+        *) ARGS="$ARGS $arg" ;;
+    esac
+done
+exec zig cc -fno-sanitize=all -target aarch64-macos-none -isysroot /opt/macos-sdk -I/opt/macos-sdk/usr/include -L/opt/macos-sdk/usr/lib -F/opt/macos-sdk/System/Library/Frameworks -w $ARGS
+ZIGWRAP
+RUN chmod +x /usr/local/bin/zcc-darwin-arm64
+
+# Darwin amd64
+COPY <<'ZIGWRAP' /usr/local/bin/zcc-darwin-amd64
+#!/bin/sh
+ARGS=""
+SKIP_NEXT=0
+for arg in "$@"; do
+    if [ $SKIP_NEXT -eq 1 ]; then
+        SKIP_NEXT=0
+        continue
+    fi
+    case "$arg" in
+        -target) SKIP_NEXT=1 ;;
+        -mmacosx-version-min=*) ;;
+        *) ARGS="$ARGS $arg" ;;
+    esac
+done
+exec zig cc -fno-sanitize=all -target x86_64-macos-none -isysroot /opt/macos-sdk -I/opt/macos-sdk/usr/include -L/opt/macos-sdk/usr/lib -F/opt/macos-sdk/System/Library/Frameworks -w $ARGS
+ZIGWRAP
+RUN chmod +x /usr/local/bin/zcc-darwin-amd64
+
+# Windows amd64 - uses Zig's bundled mingw
+COPY <<'ZIGWRAP' /usr/local/bin/zcc-windows-amd64
+#!/bin/sh
+ARGS=""
+SKIP_NEXT=0
+for arg in "$@"; do
+    if [ $SKIP_NEXT -eq 1 ]; then
+        SKIP_NEXT=0
+        continue
+    fi
+    case "$arg" in
+        -target) SKIP_NEXT=1 ;;
+        -Wl,*) ;;
+        *) ARGS="$ARGS $arg" ;;
+    esac
+done
+exec zig cc -target x86_64-windows-gnu $ARGS
+ZIGWRAP
+RUN chmod +x /usr/local/bin/zcc-windows-amd64
+
+# Windows arm64 - uses Zig's bundled mingw
+COPY <<'ZIGWRAP' /usr/local/bin/zcc-windows-arm64
+#!/bin/sh
+ARGS=""
+SKIP_NEXT=0
+for arg in "$@"; do
+    if [ $SKIP_NEXT -eq 1 ]; then
+        SKIP_NEXT=0
+        continue
+    fi
+    case "$arg" in
+        -target) SKIP_NEXT=1 ;;
+        -Wl,*) ;;
+        *) ARGS="$ARGS $arg" ;;
+    esac
+done
+exec zig cc -target aarch64-windows-gnu $ARGS
+ZIGWRAP
+RUN chmod +x /usr/local/bin/zcc-windows-arm64
+
+# Build script
+COPY <<'SCRIPT' /usr/local/bin/build.sh
+#!/bin/sh
+set -e
+
+OS=${1:-darwin}
+ARCH=${2:-arm64}
+
+case "${OS}-${ARCH}" in
+    darwin-arm64|darwin-aarch64)
+        export CC=zcc-darwin-arm64
+        export GOARCH=arm64
+        export GOOS=darwin
+        ;;
+    darwin-amd64|darwin-x86_64)
+        export CC=zcc-darwin-amd64
+        export GOARCH=amd64
+        export GOOS=darwin
+        ;;
+    linux-arm64|linux-aarch64)
+        export CC=gcc
+        export GOARCH=arm64
+        export GOOS=linux
+        ;;
+    linux-amd64|linux-x86_64)
+        export CC=gcc
+        export GOARCH=amd64
+        export GOOS=linux
+        ;;
+    windows-arm64|windows-aarch64)
+        export CC=zcc-windows-arm64
+        export GOARCH=arm64
+        export GOOS=windows
+        ;;
+    windows-amd64|windows-x86_64)
+        export CC=zcc-windows-amd64
+        export GOARCH=amd64
+        export GOOS=windows
+        ;;
+    *)
+        echo "Usage: <os> <arch>"
+        echo "  os: darwin, linux, windows"
+        echo "  arch: amd64, arm64"
+        exit 1
+        ;;
+esac
+
+export CGO_ENABLED=1
+export CGO_CFLAGS="-w"
+
+# Build frontend if exists and not already built (host may have built it)
+if [ -d "frontend" ] && [ -f "frontend/package.json" ] && [ ! -d "frontend/dist" ]; then
+    (cd frontend && npm install --silent && npm run build --silent)
+fi
+
+# Build
+APP=${APP_NAME:-$(basename $(pwd))}
+mkdir -p bin
+
+EXT=""
+LDFLAGS="-s -w"
+if [ "$GOOS" = "windows" ]; then
+    EXT=".exe"
+    LDFLAGS="-s -w -H windowsgui"
+fi
+
+TAGS="production"
+if [ -n "$EXTRA_TAGS" ]; then
+    TAGS="${TAGS},${EXTRA_TAGS}"
+fi
+
+go build -tags "$TAGS" -trimpath -ldflags="$LDFLAGS" -o bin/${APP}-${GOOS}-${GOARCH}${EXT} .
+echo "Built: bin/${APP}-${GOOS}-${GOARCH}${EXT}"
+SCRIPT
+RUN chmod +x /usr/local/bin/build.sh
+
+WORKDIR /app
+ENTRYPOINT ["/usr/local/bin/build.sh"]
+CMD ["darwin", "arm64"]
diff --git a/client/ui/build/docker/Dockerfile.server b/client/ui/build/docker/Dockerfile.server
new file mode 100644
index 000000000..57183f1d2
--- /dev/null
+++ b/client/ui/build/docker/Dockerfile.server
@@ -0,0 +1,41 @@
+# Wails Server Mode Dockerfile
+# Multi-stage build for minimal image size
+
+# Build stage
+FROM golang:1.26.7-alpine AS builder
+
+WORKDIR /app
+
+# Install build dependencies
+RUN apk add --no-cache git
+
+# Copy source code
+COPY . .
+
+# Remove local replace directive if present (for production builds)
+RUN sed -i '/^replace/d' go.mod || true
+
+# Download dependencies
+RUN go mod tidy
+
+# Build the server binary
+RUN go build -tags server -ldflags="-s -w" -o server .
+
+# Runtime stage - minimal image
+FROM gcr.io/distroless/static-debian12
+
+# Copy the binary
+COPY --from=builder /app/server /server
+
+# Copy frontend assets
+COPY --from=builder /app/frontend/dist /frontend/dist
+
+# Expose the default port
+EXPOSE 8080
+
+# Bind to all interfaces (required for Docker)
+# Can be overridden at runtime with -e WAILS_SERVER_HOST=...
+ENV WAILS_SERVER_HOST=0.0.0.0
+
+# Run the server
+ENTRYPOINT ["/server"]
diff --git a/client/ui/build/linux/Taskfile.yml b/client/ui/build/linux/Taskfile.yml
new file mode 100644
index 000000000..94d041375
--- /dev/null
+++ b/client/ui/build/linux/Taskfile.yml
@@ -0,0 +1,235 @@
+version: '3'
+
+includes:
+  common: ../Taskfile.yml
+
+vars:
+  # Signing configuration - edit these values for your project
+  # PGP_KEY: "path/to/signing-key.asc"
+  # SIGN_ROLE: "builder"  # Options: origin, maint, archive, builder
+  #
+  # Password is stored securely in system keychain. Run: wails3 setup signing
+
+  # Docker image for cross-compilation (used when building on non-Linux or no CC available)
+  CROSS_IMAGE: wails-cross
+
+tasks:
+  build:
+    summary: Builds the application for Linux
+    cmds:
+      # Linux requires CGO - use Docker when:
+      # 1. Cross-compiling from non-Linux, OR
+      # 2. No C compiler is available, OR
+      # 3. Target architecture differs from host architecture (cross-arch compilation)
+      - task: '{{if and (eq OS "linux") (eq .HAS_CC "true") (eq .TARGET_ARCH ARCH)}}build:native{{else}}build:docker{{end}}'
+        vars:
+          ARCH: '{{.ARCH}}'
+          DEV: '{{.DEV}}'
+          OUTPUT: '{{.OUTPUT}}'
+          EXTRA_TAGS: '{{.EXTRA_TAGS}}'
+    vars:
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+      # Determine target architecture (defaults to host ARCH if not specified)
+      TARGET_ARCH: '{{.ARCH | default ARCH}}'
+      # Check if a C compiler is available (gcc or clang)
+      HAS_CC:
+        sh: '(command -v gcc >/dev/null 2>&1 || command -v clang >/dev/null 2>&1) && echo "true" || echo "false"'
+
+  build:native:
+    summary: Builds the application natively on Linux
+    internal: true
+    deps:
+      - task: common:go:mod:tidy
+      - task: common:build:frontend
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+          DEV:
+            ref: .DEV
+      - task: common:generate:icons
+      - task: generate:dotdesktop
+    cmds:
+      - go build {{.BUILD_FLAGS}} -o {{.OUTPUT}}
+    vars:
+      BUILD_FLAGS: '{{if eq .DEV "true"}}{{if .EXTRA_TAGS}}-tags {{.EXTRA_TAGS}} {{end}}-gcflags=all="-l"{{else}}-tags production{{if .EXTRA_TAGS}},{{.EXTRA_TAGS}}{{end}} -trimpath -ldflags="-w -s"{{end}}'
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+    env:
+      GOOS: linux
+      CGO_ENABLED: 1
+      GOARCH: '{{.ARCH | default ARCH}}'
+
+  build:docker:
+    summary: Builds for Linux using Docker (for non-Linux hosts or when no C compiler available)
+    internal: true
+    deps:
+      - task: common:build:frontend
+      - task: common:generate:icons
+      - task: generate:dotdesktop
+    preconditions:
+      - sh: docker info > /dev/null 2>&1
+        msg: "Docker is required for cross-compilation to Linux. Please install Docker."
+      - sh: docker image inspect {{.CROSS_IMAGE}} > /dev/null 2>&1
+        msg: |
+          Docker image '{{.CROSS_IMAGE}}' not found.
+          Build it first: wails3 task setup:docker
+    cmds:
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" {{.GO_CACHE_MOUNT}} {{.REPLACE_MOUNTS}} -e APP_NAME="{{.APP_NAME}}" {{if .EXTRA_TAGS}}-e EXTRA_TAGS="{{.EXTRA_TAGS}}"{{end}} "{{.CROSS_IMAGE}}" linux {{.DOCKER_ARCH}}
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" alpine chown -R $(id -u):$(id -g) /app/bin
+      - mkdir -p {{.BIN_DIR}}
+      - mv "bin/{{.APP_NAME}}-linux-{{.DOCKER_ARCH}}" "{{.OUTPUT}}"
+    vars:
+      DOCKER_ARCH: '{{.ARCH | default "amd64"}}'
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+      # Mount Go module cache for faster builds
+      GO_CACHE_MOUNT:
+        sh: 'echo "-v ${GOPATH:-$HOME/go}/pkg/mod:/go/pkg/mod"'
+      # Extract replace directives from go.mod and create -v mounts for each
+      REPLACE_MOUNTS:
+        sh: |
+          grep -E '^replace .* => ' go.mod 2>/dev/null | while read -r line; do
+            path=$(echo "$line" | sed -E 's/^replace .* => //' | tr -d '\r')
+            # Convert relative paths to absolute
+            if [ "${path#/}" = "$path" ]; then
+              path="$(cd "$(dirname "$path")" 2>/dev/null && pwd)/$(basename "$path")"
+            fi
+            # Only mount if directory exists
+            if [ -d "$path" ]; then
+              echo "-v $path:$path:ro"
+            fi
+          done | tr '\n' ' '
+
+  package:
+    summary: Packages the application for Linux
+    deps:
+      - task: build
+    cmds:
+      - task: create:appimage
+      - task: create:deb
+      - task: create:rpm
+      - task: create:aur
+
+  create:appimage:
+    summary: Creates an AppImage
+    dir: build/linux/appimage
+    deps:
+      - task: build
+      - task: generate:dotdesktop
+    cmds:
+      - cp "{{.APP_BINARY}}" "{{.APP_NAME}}"
+      - cp ../../appicon.png "{{.APP_NAME}}.png"
+      - wails3 generate appimage -binary "{{.APP_NAME}}" -icon {{.ICON}} -desktopfile {{.DESKTOP_FILE}} -outputdir {{.OUTPUT_DIR}} -builddir {{.ROOT_DIR}}/build/linux/appimage/build
+    vars:
+      APP_NAME: '{{.APP_NAME}}'
+      APP_BINARY: '../../../bin/{{.APP_NAME}}'
+      ICON: '{{.APP_NAME}}.png'
+      DESKTOP_FILE: '../{{.APP_NAME}}.desktop'
+      OUTPUT_DIR: '../../../bin'
+
+  create:deb:
+    summary: Creates a deb package
+    deps:
+      - task: build
+    cmds:
+      - task: generate:dotdesktop
+      - task: generate:deb
+
+  create:rpm:
+    summary: Creates a rpm package
+    deps:
+      - task: build
+    cmds:
+      - task: generate:dotdesktop
+      - task: generate:rpm
+
+  create:aur:
+    summary: Creates a arch linux packager package
+    deps:
+      - task: build
+    cmds:
+      - task: generate:dotdesktop
+      - task: generate:aur
+
+  generate:deb:
+    summary: Creates a deb package
+    cmds:
+      - wails3 tool package -name "{{.APP_NAME}}" -format deb -config ./build/linux/nfpm/nfpm.yaml -out {{.ROOT_DIR}}/bin
+
+  generate:rpm:
+    summary: Creates a rpm package
+    cmds:
+      - wails3 tool package -name "{{.APP_NAME}}" -format rpm -config ./build/linux/nfpm/nfpm.yaml -out {{.ROOT_DIR}}/bin
+
+  generate:aur:
+    summary: Creates a arch linux packager package
+    cmds:
+      - wails3 tool package -name "{{.APP_NAME}}" -format archlinux -config ./build/linux/nfpm/nfpm.yaml -out {{.ROOT_DIR}}/bin
+
+  generate:dotdesktop:
+    summary: Generates a `.desktop` file
+    dir: build
+    cmds:
+      - mkdir -p {{.ROOT_DIR}}/build/linux/appimage
+      - wails3 generate .desktop -name "{{.APP_NAME}}" -exec "{{.EXEC}}" -icon "{{.ICON}}" -outputfile "{{.ROOT_DIR}}/build/linux/{{.APP_NAME}}.desktop" -categories "{{.CATEGORIES}}"
+      # Wrap Exec= with `env WEBKIT_DISABLE_DMABUF_RENDERER=1 ...` so launches
+      # from any desktop environment use the working renderer. See build/linux/Taskfile.yml :run for the matching dev-mode env block.
+      - sed -i -E 's|^Exec=([^ ]+)(.*)$|Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 \1\2|' {{.ROOT_DIR}}/build/linux/{{.APP_NAME}}.desktop
+    vars:
+      APP_NAME: '{{.APP_NAME}}'
+      EXEC: '{{.APP_NAME}}'
+      ICON: '{{.APP_NAME}}'
+      CATEGORIES: 'Development;'
+      OUTPUTFILE: '{{.ROOT_DIR}}/build/linux/{{.APP_NAME}}.desktop'
+
+  run:
+    cmds:
+      - '{{.BIN_DIR}}/{{.APP_NAME}}'
+    env:
+      # WebKitGTK 2.50's default DMA-BUF renderer fails on RDP, VirtualBox/QEMU,
+      # and some bare WMs (Fluxbox, dwm) where DRM dumb-buffer access is
+      # restricted. Disabling it falls back to the GLES2/cairo path which works
+      # everywhere. Production launchers must set this too.
+      WEBKIT_DISABLE_DMABUF_RENDERER: "1"
+
+  sign:deb:
+    summary: Signs the DEB package
+    desc: |
+      Signs the .deb package with a PGP key.
+      Configure PGP_KEY in the vars section at the top of this file.
+      Password is retrieved from system keychain (run: wails3 setup signing)
+    deps:
+      - task: create:deb
+    cmds:
+      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}*.deb" --pgp-key {{.PGP_KEY}} {{if .SIGN_ROLE}}--role {{.SIGN_ROLE}}{{end}}
+    preconditions:
+      - sh: '[ -n "{{.PGP_KEY}}" ]'
+        msg: "PGP_KEY is required. Set it in the vars section at the top of build/linux/Taskfile.yml"
+
+  sign:rpm:
+    summary: Signs the RPM package
+    desc: |
+      Signs the .rpm package with a PGP key.
+      Configure PGP_KEY in the vars section at the top of this file.
+      Password is retrieved from system keychain (run: wails3 setup signing)
+    deps:
+      - task: create:rpm
+    cmds:
+      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}*.rpm" --pgp-key {{.PGP_KEY}}
+    preconditions:
+      - sh: '[ -n "{{.PGP_KEY}}" ]'
+        msg: "PGP_KEY is required. Set it in the vars section at the top of build/linux/Taskfile.yml"
+
+  sign:packages:
+    summary: Signs all Linux packages (DEB and RPM)
+    desc: |
+      Signs both .deb and .rpm packages with a PGP key.
+      Configure PGP_KEY in the vars section at the top of this file.
+      Password is retrieved from system keychain (run: wails3 setup signing)
+    cmds:
+      - task: sign:deb
+      - task: sign:rpm
+    preconditions:
+      - sh: '[ -n "{{.PGP_KEY}}" ]'
+        msg: "PGP_KEY is required. Set it in the vars section at the top of build/linux/Taskfile.yml"
diff --git a/client/ui/build/linux/appimage/build.sh b/client/ui/build/linux/appimage/build.sh
new file mode 100644
index 000000000..85901c34e
--- /dev/null
+++ b/client/ui/build/linux/appimage/build.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Copyright (c) 2018-Present Lea Anthony
+# SPDX-License-Identifier: MIT
+
+# Fail script on any error
+set -euxo pipefail
+
+# Define variables
+APP_DIR="${APP_NAME}.AppDir"
+
+# Create AppDir structure
+mkdir -p "${APP_DIR}/usr/bin"
+cp -r "${APP_BINARY}" "${APP_DIR}/usr/bin/"
+cp "${ICON_PATH}" "${APP_DIR}/"
+cp "${DESKTOP_FILE}" "${APP_DIR}/"
+
+if [[ $(uname -m) == *x86_64* ]]; then
+    # Download linuxdeploy and make it executable
+    wget -q -4 -N https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage
+    chmod +x linuxdeploy-x86_64.AppImage
+
+    # Run linuxdeploy to bundle the application
+    ./linuxdeploy-x86_64.AppImage --appdir "${APP_DIR}" --output appimage
+else
+    # Download linuxdeploy and make it executable (arm64)
+    wget -q -4 -N https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-aarch64.AppImage
+    chmod +x linuxdeploy-aarch64.AppImage
+
+    # Run linuxdeploy to bundle the application (arm64)
+    ./linuxdeploy-aarch64.AppImage --appdir "${APP_DIR}" --output appimage
+fi
+
+# Rename the generated AppImage
+mv "${APP_NAME}*.AppImage" "${APP_NAME}.AppImage"
+
diff --git a/client/ui/build/linux/desktop b/client/ui/build/linux/desktop
new file mode 100644
index 000000000..deadfe9f4
--- /dev/null
+++ b/client/ui/build/linux/desktop
@@ -0,0 +1,13 @@
+[Desktop Entry]
+Version=1.0
+Name=NetBird
+Comment=NetBird desktop client
+# The Exec line includes %u to pass the URL to the application
+Exec=/usr/local/bin/netbird-ui %u
+Terminal=false
+Type=Application
+Icon=netbird-ui
+Categories=Utility;
+StartupWMClass=netbird-ui
+
+ 
diff --git a/client/ui/build/linux/netbird-ui.desktop b/client/ui/build/linux/netbird-ui.desktop
new file mode 100755
index 000000000..6b6ed42a5
--- /dev/null
+++ b/client/ui/build/linux/netbird-ui.desktop
@@ -0,0 +1,10 @@
+[Desktop Entry]
+Type=Application
+Name=netbird-ui
+Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 netbird-ui
+Icon=netbird-ui
+Categories=Development;
+Terminal=false
+Keywords=wails
+Version=1.0
+StartupNotify=false
diff --git a/client/ui/build/linux/netbird.desktop b/client/ui/build/linux/netbird.desktop
new file mode 100644
index 000000000..0d43b62a2
--- /dev/null
+++ b/client/ui/build/linux/netbird.desktop
@@ -0,0 +1,10 @@
+[Desktop Entry]
+Name=NetBird
+Comment=NetBird desktop client
+Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 /usr/bin/netbird-ui
+Icon=netbird
+Type=Application
+Terminal=false
+Categories=Utility;
+Keywords=netbird;
+StartupWMClass=org.wails.netbird
\ No newline at end of file
diff --git a/client/ui/build/linux/nfpm/nfpm.yaml b/client/ui/build/linux/nfpm/nfpm.yaml
new file mode 100644
index 000000000..764855a63
--- /dev/null
+++ b/client/ui/build/linux/nfpm/nfpm.yaml
@@ -0,0 +1,70 @@
+# Feel free to remove those if you don't want/need to use them.
+# Make sure to check the documentation at https://nfpm.goreleaser.com
+#
+# The lines below are called `modelines`. See `:help modeline`
+
+name: "netbird-ui"
+arch: ${GOARCH}
+platform: "linux"
+version: "0.0.1"
+section: "default"
+priority: "extra"
+maintainer: ${GIT_COMMITTER_NAME} <${GIT_COMMITTER_EMAIL}>
+description: "NetBird desktop client"
+vendor: "NetBird"
+homepage: "https://wails.io"
+license: "MIT"
+release: "1"
+
+contents:
+  - src: "./bin/netbird-ui"
+    dst: "/usr/local/bin/netbird-ui"
+  - src: "./build/appicon.png"
+    dst: "/usr/share/icons/hicolor/128x128/apps/netbird-ui.png"
+  - src: "./build/linux/netbird-ui.desktop"
+    dst: "/usr/share/applications/netbird-ui.desktop"
+
+# Default dependencies for the GTK4 + WebKitGTK 6.0 stack (Ubuntu 24.04+ / Debian 13+)
+depends:
+  - libgtk-4-1 (>= 4.14)
+  - libwebkitgtk-6.0-4
+  - xdg-utils
+
+# Distribution-specific overrides for different package formats
+overrides:
+  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux / openSUSE
+  rpm:
+    depends:
+      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
+      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
+      - xdg-utils
+
+  # Arch Linux packages
+  archlinux:
+    depends:
+      - gtk4
+      - webkitgtk-6.0
+      - xdg-utils
+
+# scripts section to ensure desktop database is updated after install
+scripts:
+  postinstall: "./build/linux/nfpm/scripts/postinstall.sh"
+  # You can also add preremove, postremove if needed
+  # preremove: "./build/linux/nfpm/scripts/preremove.sh"
+  # postremove: "./build/linux/nfpm/scripts/postremove.sh"
+
+# replaces:
+#   - foobar
+# provides:
+#   - bar
+# depends:
+#   - gtk3
+#   - libwebkit2gtk
+# recommends:
+#   - whatever
+# suggests:
+#   - something-else
+# conflicts:
+#   - not-foo
+#   - not-bar
+# changelog: "changelog.yaml"
diff --git a/client/ui/build/linux/nfpm/scripts/postinstall.sh b/client/ui/build/linux/nfpm/scripts/postinstall.sh
new file mode 100644
index 000000000..4bbb815a3
--- /dev/null
+++ b/client/ui/build/linux/nfpm/scripts/postinstall.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# Update desktop database for .desktop file changes
+# This makes the application appear in application menus and registers its capabilities.
+if command -v update-desktop-database >/dev/null 2>&1; then
+  echo "Updating desktop database..."
+  update-desktop-database -q /usr/share/applications
+else
+  echo "Warning: update-desktop-database command not found. Desktop file may not be immediately recognized." >&2
+fi
+
+# Update MIME database for custom URL schemes (x-scheme-handler)
+# This ensures the system knows how to handle your custom protocols.
+if command -v update-mime-database >/dev/null 2>&1; then
+  echo "Updating MIME database..."
+  update-mime-database -n /usr/share/mime
+else
+  echo "Warning: update-mime-database command not found. Custom URL schemes may not be immediately recognized." >&2
+fi
+
+exit 0
diff --git a/client/ui/build/linux/nfpm/scripts/postremove.sh b/client/ui/build/linux/nfpm/scripts/postremove.sh
new file mode 100644
index 000000000..a9bf588e2
--- /dev/null
+++ b/client/ui/build/linux/nfpm/scripts/postremove.sh
@@ -0,0 +1 @@
+#!/bin/bash
diff --git a/client/ui/build/linux/nfpm/scripts/preinstall.sh b/client/ui/build/linux/nfpm/scripts/preinstall.sh
new file mode 100644
index 000000000..a9bf588e2
--- /dev/null
+++ b/client/ui/build/linux/nfpm/scripts/preinstall.sh
@@ -0,0 +1 @@
+#!/bin/bash
diff --git a/client/ui/build/linux/nfpm/scripts/preremove.sh b/client/ui/build/linux/nfpm/scripts/preremove.sh
new file mode 100644
index 000000000..a9bf588e2
--- /dev/null
+++ b/client/ui/build/linux/nfpm/scripts/preremove.sh
@@ -0,0 +1 @@
+#!/bin/bash
diff --git a/client/ui/build/linux/polkit/io.netbird.settings.policy b/client/ui/build/linux/polkit/io.netbird.settings.policy
new file mode 100644
index 000000000..e12f1ddc7
--- /dev/null
+++ b/client/ui/build/linux/polkit/io.netbird.settings.policy
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+
+<!--
+  Names the action behind the elevation prompt the desktop app raises for an SSH
+  setting the daemon restricts to root; without it pkexec's generic dialog offers
+  the raw command line instead. The argv1 annotation keeps this wording to the
+  one-shot mode that applies those settings.
+
+  auth_admin rather than auth_admin_keep: each of these settings is its own grant
+  of shell access, so a credential cache would let a second, unasked-for change
+  ride along on the authorization given the first.
+
+  exec.path takes no wildcard and the binary's location depends on the package,
+  hence one action per path.
+-->
+<policyconfig>
+  <vendor>NetBird</vendor>
+  <vendor_url>https://netbird.io</vendor_url>
+
+  <action id="io.netbird.settings.apply-privileged">
+    <description>Change privileged NetBird settings</description>
+    <message>Authentication is required to change NetBird settings that grant SSH access to this computer.</message>
+    <icon_name>netbird</icon_name>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>auth_admin</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/netbird-ui</annotate>
+    <annotate key="org.freedesktop.policykit.exec.argv1">--apply-privileged-settings</annotate>
+  </action>
+
+  <action id="io.netbird.settings.apply-privileged-local">
+    <description>Change privileged NetBird settings</description>
+    <message>Authentication is required to change NetBird settings that grant SSH access to this computer.</message>
+    <icon_name>netbird</icon_name>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>auth_admin</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/local/bin/netbird-ui</annotate>
+    <annotate key="org.freedesktop.policykit.exec.argv1">--apply-privileged-settings</annotate>
+  </action>
+</policyconfig>
diff --git a/client/ui/build/netbird.desktop b/client/ui/build/netbird.desktop
deleted file mode 100644
index b3a1b92dc..000000000
--- a/client/ui/build/netbird.desktop
+++ /dev/null
@@ -1,8 +0,0 @@
-[Desktop Entry]
-Name=Netbird
-Exec=/usr/bin/netbird-ui
-Icon=netbird
-Type=Application
-Terminal=false
-Categories=Utility;
-Keywords=netbird;
diff --git a/client/ui/build/windows/Taskfile.yml b/client/ui/build/windows/Taskfile.yml
new file mode 100644
index 000000000..f51f7fbee
--- /dev/null
+++ b/client/ui/build/windows/Taskfile.yml
@@ -0,0 +1,243 @@
+version: '3'
+
+includes:
+  common: ../Taskfile.yml
+
+vars:
+  # Signing configuration - edit these values for your project
+  # SIGN_CERTIFICATE: "path/to/certificate.pfx"
+  # SIGN_THUMBPRINT: "certificate-thumbprint"  # Alternative to SIGN_CERTIFICATE
+  # TIMESTAMP_SERVER: "http://timestamp.digicert.com"
+  #
+  # Password is stored securely in system keychain. Run: wails3 setup signing
+
+  # Docker image for cross-compilation with CGO (used when CGO_ENABLED=1 on non-Windows)
+  CROSS_IMAGE: wails-cross
+
+tasks:
+  build:
+    summary: Builds the application for Windows
+    cmds:
+      # CGO Windows builds from Linux use mingw-w64 (lighter than docker).
+      # Docker is only needed if mingw-w64 is unavailable.
+      - task: build:native
+        vars:
+          ARCH: '{{.ARCH}}'
+          DEV: '{{.DEV}}'
+          EXTRA_TAGS: '{{.EXTRA_TAGS}}'
+    vars:
+      CGO_ENABLED: '{{.CGO_ENABLED | default "0"}}'
+
+  build:console:
+    summary: Builds a console-attached Windows binary so logs go to the terminal.
+    desc: |
+      Same as `windows:build` but links against the console PE subsystem
+      instead of windowsgui, so stdout/stderr (logrus, panics) print to the
+      terminal that launched the .exe. Useful for chasing tray, event-stream,
+      or daemon-RPC bugs that have no other feedback channel on Windows.
+
+      Output is bin/netbird-ui-console.exe — kept distinct so the production
+      binary built by `windows:build` isn't shadowed.
+
+      Cross-compile from Linux works the same way:
+        CGO_ENABLED=1 task windows:build:console
+
+      Pass DEV=true to drop the `production` build tag so the WebKit/WebView2
+      DevTools inspector (right-click → Inspect, or F12) stays enabled and the
+      frontend JS console is reachable — same DEV handling as windows:build:
+        CGO_ENABLED=1 task windows:build:console DEV=true
+    deps:
+      - task: common:go:mod:tidy
+      - task: common:build:frontend
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+          DEV:
+            ref: .DEV
+      - task: common:generate:icons
+    preconditions:
+      - sh: '[ "{{OS}}" = "windows" ] || [ "{{.CGO_ENABLED}}" != "1" ] || command -v {{.CC}}'
+        msg: "{{.CC}} not found. Install with: sudo apt-get install gcc-mingw-w64-x86-64 (Debian/Ubuntu) / sudo dnf install mingw64-gcc (Fedora)"
+    cmds:
+      - task: generate:syso
+      - go build {{.BUILD_FLAGS}} -o "{{.BIN_DIR}}/{{.APP_NAME}}-console.exe"
+      - cmd: powershell Remove-item *.syso
+        platforms: [windows]
+      - cmd: rm -f *.syso
+        platforms: [linux, darwin]
+    vars:
+      # Identical to build:native's flags (including DEV handling) except no
+      # -H windowsgui, so the binary attaches to the launching console. With
+      # DEV=true the `production` tag is dropped, keeping the WebKit/WebView2
+      # DevTools inspector enabled so the frontend JS console is reachable.
+      BUILD_FLAGS: '{{if eq .DEV "true"}}{{if .EXTRA_TAGS}}-tags {{.EXTRA_TAGS}} {{end}}-gcflags=all="-l"{{else}}-tags production{{if .EXTRA_TAGS}},{{.EXTRA_TAGS}}{{end}} -trimpath -ldflags="-w -s"{{end}}'
+      CGO_ENABLED: '{{.CGO_ENABLED | default "0"}}'
+      CC: '{{.CC | default "x86_64-w64-mingw32-gcc"}}'
+    env:
+      GOOS: windows
+      CGO_ENABLED: '{{.CGO_ENABLED}}'
+      GOARCH: '{{.ARCH | default ARCH}}'
+      CC: '{{.CC}}'
+
+  build:native:
+    summary: Builds for Windows natively, or cross-compiles from Linux/macOS via mingw-w64.
+    internal: true
+    deps:
+      - task: common:go:mod:tidy
+      - task: common:build:frontend
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+          DEV:
+            ref: .DEV
+      - task: common:generate:icons
+    preconditions:
+      # When cross-compiling with CGO from a non-Windows host, the mingw-w64
+      # cross-gcc must be present. Native Windows builds skip this check.
+      - sh: '[ "{{OS}}" = "windows" ] || [ "{{.CGO_ENABLED}}" != "1" ] || command -v {{.CC}}'
+        msg: "{{.CC}} not found. Install with: sudo apt-get install gcc-mingw-w64-x86-64 (Debian/Ubuntu) / sudo dnf install mingw64-gcc (Fedora)"
+    cmds:
+      - task: generate:syso
+      - go build {{.BUILD_FLAGS}} -o "{{.BIN_DIR}}/{{.APP_NAME}}.exe"
+      - cmd: powershell Remove-item *.syso
+        platforms: [windows]
+      - cmd: rm -f *.syso
+        platforms: [linux, darwin]
+    vars:
+      BUILD_FLAGS: '{{if eq .DEV "true"}}{{if .EXTRA_TAGS}}-tags {{.EXTRA_TAGS}} {{end}}-gcflags=all="-l"{{else}}-tags production{{if .EXTRA_TAGS}},{{.EXTRA_TAGS}}{{end}} -trimpath -ldflags="-w -s -H windowsgui"{{end}}'
+      CGO_ENABLED: '{{.CGO_ENABLED | default "0"}}'
+      CC: '{{.CC | default "x86_64-w64-mingw32-gcc"}}'
+    env:
+      GOOS: windows
+      CGO_ENABLED: '{{.CGO_ENABLED}}'
+      GOARCH: '{{.ARCH | default ARCH}}'
+      CC: '{{.CC}}'
+
+  build:docker:
+    summary: Cross-compiles for Windows using Docker with Zig (for CGO builds on non-Windows)
+    internal: true
+    deps:
+      - task: common:build:frontend
+      - task: common:generate:icons
+    preconditions:
+      - sh: docker info > /dev/null 2>&1
+        msg: "Docker is required for CGO cross-compilation. Please install Docker."
+      - sh: docker image inspect {{.CROSS_IMAGE}} > /dev/null 2>&1
+        msg: |
+          Docker image '{{.CROSS_IMAGE}}' not found.
+          Build it first: wails3 task setup:docker
+    cmds:
+      - task: generate:syso
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" {{.GO_CACHE_MOUNT}} {{.REPLACE_MOUNTS}} -e APP_NAME="{{.APP_NAME}}" {{if .EXTRA_TAGS}}-e EXTRA_TAGS="{{.EXTRA_TAGS}}"{{end}} {{.CROSS_IMAGE}} windows {{.DOCKER_ARCH}}
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" alpine chown -R $(id -u):$(id -g) /app/bin
+      - rm -f *.syso
+    vars:
+      DOCKER_ARCH: '{{.ARCH | default "amd64"}}'
+      # Mount Go module cache for faster builds
+      GO_CACHE_MOUNT:
+        sh: 'echo "-v ${GOPATH:-$HOME/go}/pkg/mod:/go/pkg/mod"'
+      # Extract replace directives from go.mod and create -v mounts for each
+      REPLACE_MOUNTS:
+        sh: |
+          grep -E '^replace .* => ' go.mod 2>/dev/null | while read -r line; do
+            path=$(echo "$line" | sed -E 's/^replace .* => //' | tr -d '\r')
+            # Convert relative paths to absolute
+            if [ "${path#/}" = "$path" ]; then
+              path="$(cd "$(dirname "$path")" 2>/dev/null && pwd)/$(basename "$path")"
+            fi
+            # Only mount if directory exists
+            if [ -d "$path" ]; then
+              echo "-v $path:$path:ro"
+            fi
+          done | tr '\n' ' '
+
+  package:
+    summary: Packages the application
+    cmds:
+      - task: '{{if eq (.FORMAT | default "nsis") "msix"}}create:msix:package{{else}}create:nsis:installer{{end}}'
+    vars:
+      FORMAT: '{{.FORMAT | default "nsis"}}'
+
+  generate:syso:
+    summary: Generates Windows `.syso` file
+    dir: build
+    cmds:
+      - wails3 generate syso -arch {{.ARCH}} -icon windows/icon.ico -manifest windows/wails.exe.manifest -info windows/info.json -out ../wails_windows_{{.ARCH}}.syso
+    vars:
+      ARCH: '{{.ARCH | default ARCH}}'
+
+  create:nsis:installer:
+    summary: Creates an NSIS installer
+    dir: build/windows/nsis
+    deps:
+      - task: build
+    cmds:
+      # Create the Microsoft WebView2 bootstrapper if it doesn't exist
+      - wails3 generate webview2bootstrapper -dir "{{.ROOT_DIR}}/build/windows/nsis"
+      - | 
+        {{if eq OS "windows"}}
+        makensis -DARG_WAILS_{{.ARG_FLAG}}_BINARY="{{.ROOT_DIR}}\{{.BIN_DIR}}\{{.APP_NAME}}.exe" project.nsi
+        {{else}}
+        makensis -DARG_WAILS_{{.ARG_FLAG}}_BINARY="{{.ROOT_DIR}}/{{.BIN_DIR}}/{{.APP_NAME}}.exe" project.nsi
+        {{end}}
+    vars:
+      ARCH: '{{.ARCH | default ARCH}}'
+      ARG_FLAG: '{{if eq .ARCH "amd64"}}AMD64{{else}}ARM64{{end}}'
+
+  create:msix:package:
+    summary: Creates an MSIX package
+    deps:
+      - task: build
+    cmds:
+      - |-
+        wails3 tool msix \
+          --config "{{.ROOT_DIR}}/wails.json" \
+          --name "{{.APP_NAME}}" \
+          --executable "{{.ROOT_DIR}}/{{.BIN_DIR}}/{{.APP_NAME}}.exe" \
+          --arch "{{.ARCH}}" \
+          --out "{{.ROOT_DIR}}/{{.BIN_DIR}}/{{.APP_NAME}}-{{.ARCH}}.msix" \
+          {{if .CERT_PATH}}--cert "{{.CERT_PATH}}"{{end}} \
+          {{if .PUBLISHER}}--publisher "{{.PUBLISHER}}"{{end}} \
+          {{if .USE_MSIX_TOOL}}--use-msix-tool{{else}}--use-makeappx{{end}}
+    vars:
+      ARCH: '{{.ARCH | default ARCH}}'
+      CERT_PATH: '{{.CERT_PATH | default ""}}'
+      PUBLISHER: '{{.PUBLISHER | default ""}}'
+      USE_MSIX_TOOL: '{{.USE_MSIX_TOOL | default "false"}}'
+
+  install:msix:tools:
+    summary: Installs tools required for MSIX packaging
+    cmds:
+      - wails3 tool msix-install-tools
+
+  run:
+    cmds:
+      - '{{.BIN_DIR}}/{{.APP_NAME}}.exe'
+
+  sign:
+    summary: Signs the Windows executable
+    desc: |
+      Signs the .exe with an Authenticode certificate.
+      Configure SIGN_CERTIFICATE or SIGN_THUMBPRINT in the vars section at the top of this file.
+      Password is retrieved from system keychain (run: wails3 setup signing)
+    deps:
+      - task: build
+    cmds:
+      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}.exe" {{if .SIGN_CERTIFICATE}}--certificate {{.SIGN_CERTIFICATE}}{{end}} {{if .SIGN_THUMBPRINT}}--thumbprint {{.SIGN_THUMBPRINT}}{{end}} {{if .TIMESTAMP_SERVER}}--timestamp {{.TIMESTAMP_SERVER}}{{end}}
+    preconditions:
+      - sh: '[ -n "{{.SIGN_CERTIFICATE}}" ] || [ -n "{{.SIGN_THUMBPRINT}}" ]'
+        msg: "Either SIGN_CERTIFICATE or SIGN_THUMBPRINT is required. Set it in the vars section at the top of build/windows/Taskfile.yml"
+
+  sign:installer:
+    summary: Signs the NSIS installer
+    desc: |
+      Creates and signs the NSIS installer.
+      Configure SIGN_CERTIFICATE or SIGN_THUMBPRINT in the vars section at the top of this file.
+      Password is retrieved from system keychain (run: wails3 setup signing)
+    deps:
+      - task: create:nsis:installer
+    cmds:
+      - wails3 tool sign --input "build/windows/nsis/{{.APP_NAME}}-installer.exe" {{if .SIGN_CERTIFICATE}}--certificate {{.SIGN_CERTIFICATE}}{{end}} {{if .SIGN_THUMBPRINT}}--thumbprint {{.SIGN_THUMBPRINT}}{{end}} {{if .TIMESTAMP_SERVER}}--timestamp {{.TIMESTAMP_SERVER}}{{end}}
+    preconditions:
+      - sh: '[ -n "{{.SIGN_CERTIFICATE}}" ] || [ -n "{{.SIGN_THUMBPRINT}}" ]'
+        msg: "Either SIGN_CERTIFICATE or SIGN_THUMBPRINT is required. Set it in the vars section at the top of build/windows/Taskfile.yml"
diff --git a/client/ui/build/windows/icon.ico b/client/ui/build/windows/icon.ico
new file mode 100644
index 000000000..7abbfa5a3
Binary files /dev/null and b/client/ui/build/windows/icon.ico differ
diff --git a/client/ui/build/windows/info.json b/client/ui/build/windows/info.json
new file mode 100644
index 000000000..a67c8fd81
--- /dev/null
+++ b/client/ui/build/windows/info.json
@@ -0,0 +1,15 @@
+{
+	"fixed": {
+		"file_version": "0.0.1"
+	},
+	"info": {
+		"0000": {
+			"ProductVersion": "0.0.1",
+			"CompanyName": "NetBird",
+			"FileDescription": "NetBird desktop client",
+			"LegalCopyright": "NetBird GmbH",
+			"ProductName": "NetBird",
+			"Comments": "This is a comment"
+		}
+	}
+}
\ No newline at end of file
diff --git a/client/ui/build/windows/msix/app_manifest.xml b/client/ui/build/windows/msix/app_manifest.xml
new file mode 100644
index 000000000..0ae55ce77
--- /dev/null
+++ b/client/ui/build/windows/msix/app_manifest.xml
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Package
+  xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
+  xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
+  xmlns:uap3="http://schemas.microsoft.com/appx/manifest/uap/windows10/3"
+  xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
+  xmlns:desktop="http://schemas.microsoft.com/appx/manifest/desktop/windows10"
+  IgnorableNamespaces="uap3">
+  
+  <Identity 
+    Name="io.netbird.client"
+    Publisher="CN=NetBird"
+    Version="0.0.1.0" 
+    ProcessorArchitecture="x64" />
+  
+  <Properties>
+    <DisplayName>NetBird</DisplayName>
+    <PublisherDisplayName>NetBird</PublisherDisplayName>
+    <Description>NetBird desktop client</Description>
+    <Logo>Assets\StoreLogo.png</Logo>
+  </Properties>
+  
+  <Dependencies>
+    <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.17763.0" MaxVersionTested="10.0.19041.0" />
+  </Dependencies>
+  
+  <Resources>
+    <Resource Language="en-us" />
+  </Resources>
+  
+  <Applications>
+    <Application Id="io.netbird.client" Executable="netbird-ui" EntryPoint="Windows.FullTrustApplication">
+      <uap:VisualElements
+        DisplayName="NetBird"
+        Description="NetBird desktop client"
+        BackgroundColor="transparent"
+        Square150x150Logo="Assets\Square150x150Logo.png"
+        Square44x44Logo="Assets\Square44x44Logo.png">
+        <uap:DefaultTile Wide310x150Logo="Assets\Wide310x150Logo.png" />
+        <uap:SplashScreen Image="Assets\SplashScreen.png" />
+      </uap:VisualElements>
+      
+      <Extensions>
+        <desktop:Extension Category="windows.fullTrustProcess" Executable="netbird-ui" />
+        
+        
+      </Extensions>
+    </Application>
+  </Applications>
+  
+  <Capabilities>
+    <rescap:Capability Name="runFullTrust" />
+    
+  </Capabilities>
+</Package>
diff --git a/client/ui/build/windows/msix/template.xml b/client/ui/build/windows/msix/template.xml
new file mode 100644
index 000000000..437a68097
--- /dev/null
+++ b/client/ui/build/windows/msix/template.xml
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="utf-8"?>
+<MsixPackagingToolTemplate
+    xmlns="http://schemas.microsoft.com/msix/packaging/msixpackagingtool/template/2022">
+    <Settings
+        AllowTelemetry="false"
+        ApplyACLsToPackageFiles="true"
+        GenerateCommandLineFile="true"
+        AllowPromptForPassword="false">
+    </Settings>
+    <Installer
+        Path="netbird-ui"
+        Arguments=""
+        InstallLocation="C:\Program Files\NetBird\NetBird">
+    </Installer>
+    <PackageInformation
+        PackageName="NetBird"
+        PackageDisplayName="NetBird"
+        PublisherName="CN=NetBird"
+        PublisherDisplayName="NetBird"
+        Version="0.0.1.0"
+        PackageDescription="NetBird desktop client">
+        <Capabilities>
+            <Capability Name="runFullTrust" />
+            
+        </Capabilities>
+        <Applications>
+            <Application
+                Id="io.netbird.client"
+                Description="NetBird desktop client"
+                DisplayName="NetBird"
+                ExecutableName="netbird-ui"
+                EntryPoint="Windows.FullTrustApplication">
+                
+            </Application>
+        </Applications>
+        <Resources>
+            <Resource Language="en-us" />
+        </Resources>
+        <Dependencies>
+            <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.17763.0" MaxVersionTested="10.0.19041.0" />
+        </Dependencies>
+        <Properties>
+            <Framework>false</Framework>
+            <DisplayName>NetBird</DisplayName>
+            <PublisherDisplayName>NetBird</PublisherDisplayName>
+            <Description>NetBird desktop client</Description>
+            <Logo>Assets\AppIcon.png</Logo>
+        </Properties>
+    </PackageInformation>
+    <SaveLocation PackagePath="netbird-ui.msix" />
+    <PackageIntegrity>
+        <CertificatePath></CertificatePath>
+    </PackageIntegrity>
+</MsixPackagingToolTemplate>
diff --git a/client/ui/build/windows/nsis/project.nsi b/client/ui/build/windows/nsis/project.nsi
new file mode 100644
index 000000000..8d2530972
--- /dev/null
+++ b/client/ui/build/windows/nsis/project.nsi
@@ -0,0 +1,114 @@
+Unicode true
+
+####
+## Please note: Template replacements don't work in this file. They are provided with default defines like
+## mentioned underneath.
+## If the keyword is not defined, "wails_tools.nsh" will populate them.
+## If they are defined here, "wails_tools.nsh" will not touch them. This allows you to use this project.nsi manually
+## from outside of Wails for debugging and development of the installer.
+## 
+## For development first make a wails nsis build to populate the "wails_tools.nsh":
+## > wails build --target windows/amd64 --nsis
+## Then you can call makensis on this file with specifying the path to your binary:
+## For a AMD64 only installer:
+## > makensis -DARG_WAILS_AMD64_BINARY=..\..\bin\app.exe
+## For a ARM64 only installer:
+## > makensis -DARG_WAILS_ARM64_BINARY=..\..\bin\app.exe
+## For a installer with both architectures:
+## > makensis -DARG_WAILS_AMD64_BINARY=..\..\bin\app-amd64.exe -DARG_WAILS_ARM64_BINARY=..\..\bin\app-arm64.exe
+####
+## The following information is taken from the wails_tools.nsh file, but they can be overwritten here.
+####
+## !define INFO_PROJECTNAME    "my-project" # Default "netbird-ui"
+## !define INFO_COMPANYNAME    "My Company" # Default "NetBird"
+## !define INFO_PRODUCTNAME    "My Product Name" # Default "NetBird"
+## !define INFO_PRODUCTVERSION "1.0.0"     # Default "0.0.1"
+## !define INFO_COPYRIGHT      "(c) Now, My Company" # Default "© 2026, My Company"
+###
+## !define PRODUCT_EXECUTABLE  "Application.exe"      # Default "${INFO_PROJECTNAME}.exe"
+## !define UNINST_KEY_NAME     "UninstKeyInRegistry"  # Default "${INFO_COMPANYNAME}${INFO_PRODUCTNAME}"
+####
+## !define REQUEST_EXECUTION_LEVEL "admin"            # Default "admin"  see also https://nsis.sourceforge.io/Docs/Chapter4.html
+####
+## Include the wails tools
+####
+!include "wails_tools.nsh"
+
+# The version information for this two must consist of 4 parts
+VIProductVersion "${INFO_PRODUCTVERSION}.0"
+VIFileVersion    "${INFO_PRODUCTVERSION}.0"
+
+VIAddVersionKey "CompanyName"     "${INFO_COMPANYNAME}"
+VIAddVersionKey "FileDescription" "${INFO_PRODUCTNAME} Installer"
+VIAddVersionKey "ProductVersion"  "${INFO_PRODUCTVERSION}"
+VIAddVersionKey "FileVersion"     "${INFO_PRODUCTVERSION}"
+VIAddVersionKey "LegalCopyright"  "${INFO_COPYRIGHT}"
+VIAddVersionKey "ProductName"     "${INFO_PRODUCTNAME}"
+
+# Enable HiDPI support. https://nsis.sourceforge.io/Reference/ManifestDPIAware
+ManifestDPIAware true
+
+!include "MUI.nsh"
+
+!define MUI_ICON "..\icon.ico"
+!define MUI_UNICON "..\icon.ico"
+# !define MUI_WELCOMEFINISHPAGE_BITMAP "resources\leftimage.bmp" #Include this to add a bitmap on the left side of the Welcome Page. Must be a size of 164x314
+!define MUI_FINISHPAGE_NOAUTOCLOSE # Wait on the INSTFILES page so the user can take a look into the details of the installation steps
+!define MUI_ABORTWARNING # This will warn the user if they exit from the installer.
+
+!insertmacro MUI_PAGE_WELCOME # Welcome to the installer page.
+# !insertmacro MUI_PAGE_LICENSE "resources\eula.txt" # Adds a EULA page to the installer
+!insertmacro MUI_PAGE_DIRECTORY # In which folder install page.
+!insertmacro MUI_PAGE_INSTFILES # Installing page.
+!insertmacro MUI_PAGE_FINISH # Finished installation page.
+
+!insertmacro MUI_UNPAGE_INSTFILES # Uninstalling page
+
+!insertmacro MUI_LANGUAGE "English" # Set the Language of the installer
+
+## The following two statements can be used to sign the installer and the uninstaller. The path to the binaries are provided in %1
+#!uninstfinalize 'signtool --file "%1"'
+#!finalize 'signtool --file "%1"'
+
+Name "${INFO_PRODUCTNAME}"
+OutFile "..\..\..\bin\${INFO_PROJECTNAME}-${ARCH}-installer.exe" # Name of the installer's file.
+InstallDir "$PROGRAMFILES64\${INFO_COMPANYNAME}\${INFO_PRODUCTNAME}" # Default installing folder ($PROGRAMFILES is Program Files folder).
+ShowInstDetails show # This will always show the installation details.
+
+Function .onInit
+   !insertmacro wails.checkArchitecture
+FunctionEnd
+
+Section
+    !insertmacro wails.setShellContext
+
+    !insertmacro wails.webview2runtime
+
+    SetOutPath $INSTDIR
+    
+    !insertmacro wails.files
+
+    CreateShortcut "$SMPROGRAMS\${INFO_PRODUCTNAME}.lnk" "$INSTDIR\${PRODUCT_EXECUTABLE}"
+    CreateShortCut "$DESKTOP\${INFO_PRODUCTNAME}.lnk" "$INSTDIR\${PRODUCT_EXECUTABLE}"
+
+    !insertmacro wails.associateFiles
+    !insertmacro wails.associateCustomProtocols
+    
+    !insertmacro wails.writeUninstaller
+SectionEnd
+
+Section "uninstall" 
+    !insertmacro wails.setShellContext
+
+    RMDir /r "$AppData\${PRODUCT_EXECUTABLE}" # Remove the WebView2 DataPath
+
+    RMDir /r $INSTDIR
+
+    Delete "$SMPROGRAMS\${INFO_PRODUCTNAME}.lnk"
+    Delete "$DESKTOP\${INFO_PRODUCTNAME}.lnk"
+
+    !insertmacro wails.unassociateFiles
+    !insertmacro wails.unassociateCustomProtocols
+
+    !insertmacro wails.deleteUninstaller
+SectionEnd
diff --git a/client/ui/build/windows/nsis/wails_tools.nsh b/client/ui/build/windows/nsis/wails_tools.nsh
new file mode 100644
index 000000000..b63101b32
--- /dev/null
+++ b/client/ui/build/windows/nsis/wails_tools.nsh
@@ -0,0 +1,236 @@
+# DO NOT EDIT - Generated automatically by `wails build`
+
+!include "x64.nsh"
+!include "WinVer.nsh"
+!include "FileFunc.nsh"
+
+!ifndef INFO_PROJECTNAME
+    !define INFO_PROJECTNAME "netbird-ui"
+!endif
+!ifndef INFO_COMPANYNAME
+    !define INFO_COMPANYNAME "NetBird"
+!endif
+!ifndef INFO_PRODUCTNAME
+    !define INFO_PRODUCTNAME "NetBird"
+!endif
+!ifndef INFO_PRODUCTVERSION
+    !define INFO_PRODUCTVERSION "0.0.1"
+!endif
+!ifndef INFO_COPYRIGHT
+    !define INFO_COPYRIGHT "NetBird GmbH"
+!endif
+!ifndef PRODUCT_EXECUTABLE
+    !define PRODUCT_EXECUTABLE "${INFO_PROJECTNAME}.exe"
+!endif
+!ifndef UNINST_KEY_NAME
+    !define UNINST_KEY_NAME "${INFO_COMPANYNAME}${INFO_PRODUCTNAME}"
+!endif
+!define UNINST_KEY "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINST_KEY_NAME}"
+
+!ifndef REQUEST_EXECUTION_LEVEL
+    !define REQUEST_EXECUTION_LEVEL "admin"
+!endif
+
+RequestExecutionLevel "${REQUEST_EXECUTION_LEVEL}"
+
+!ifdef ARG_WAILS_AMD64_BINARY
+    !define SUPPORTS_AMD64
+!endif
+
+!ifdef ARG_WAILS_ARM64_BINARY
+    !define SUPPORTS_ARM64
+!endif
+
+!ifdef SUPPORTS_AMD64
+    !ifdef SUPPORTS_ARM64
+        !define ARCH "amd64_arm64"
+    !else
+        !define ARCH "amd64"
+    !endif
+!else
+    !ifdef SUPPORTS_ARM64
+        !define ARCH "arm64"
+    !else
+        !error "Wails: Undefined ARCH, please provide at least one of ARG_WAILS_AMD64_BINARY or ARG_WAILS_ARM64_BINARY"
+    !endif
+!endif
+
+!macro wails.checkArchitecture
+    !ifndef WAILS_WIN10_REQUIRED
+        !define WAILS_WIN10_REQUIRED "This product is only supported on Windows 10 (Server 2016) and later."
+    !endif
+
+    !ifndef WAILS_ARCHITECTURE_NOT_SUPPORTED
+        !define WAILS_ARCHITECTURE_NOT_SUPPORTED "This product can't be installed on the current Windows architecture. Supports: ${ARCH}"
+    !endif
+
+    ${If} ${AtLeastWin10}
+        !ifdef SUPPORTS_AMD64
+            ${if} ${IsNativeAMD64}
+                Goto ok
+            ${EndIf}
+        !endif
+
+        !ifdef SUPPORTS_ARM64
+            ${if} ${IsNativeARM64}
+                Goto ok
+            ${EndIf}
+        !endif
+
+        IfSilent silentArch notSilentArch
+        silentArch:
+            SetErrorLevel 65
+            Abort
+        notSilentArch:
+            MessageBox MB_OK "${WAILS_ARCHITECTURE_NOT_SUPPORTED}"
+            Quit
+    ${else}
+        IfSilent silentWin notSilentWin
+        silentWin:
+            SetErrorLevel 64
+            Abort
+        notSilentWin:
+            MessageBox MB_OK "${WAILS_WIN10_REQUIRED}"
+            Quit
+    ${EndIf}
+
+    ok:
+!macroend
+
+!macro wails.files
+    !ifdef SUPPORTS_AMD64
+        ${if} ${IsNativeAMD64}
+            File "/oname=${PRODUCT_EXECUTABLE}" "${ARG_WAILS_AMD64_BINARY}"
+        ${EndIf}
+    !endif
+
+    !ifdef SUPPORTS_ARM64
+        ${if} ${IsNativeARM64}
+            File "/oname=${PRODUCT_EXECUTABLE}" "${ARG_WAILS_ARM64_BINARY}"
+        ${EndIf}
+    !endif
+!macroend
+
+!macro wails.writeUninstaller
+    WriteUninstaller "$INSTDIR\uninstall.exe"
+
+    SetRegView 64
+    WriteRegStr HKLM "${UNINST_KEY}" "Publisher" "${INFO_COMPANYNAME}"
+    WriteRegStr HKLM "${UNINST_KEY}" "DisplayName" "${INFO_PRODUCTNAME}"
+    WriteRegStr HKLM "${UNINST_KEY}" "DisplayVersion" "${INFO_PRODUCTVERSION}"
+    WriteRegStr HKLM "${UNINST_KEY}" "DisplayIcon" "$INSTDIR\${PRODUCT_EXECUTABLE}"
+    WriteRegStr HKLM "${UNINST_KEY}" "UninstallString" "$\"$INSTDIR\uninstall.exe$\""
+    WriteRegStr HKLM "${UNINST_KEY}" "QuietUninstallString" "$\"$INSTDIR\uninstall.exe$\" /S"
+
+    ${GetSize} "$INSTDIR" "/S=0K" $0 $1 $2
+    IntFmt $0 "0x%08X" $0
+    WriteRegDWORD HKLM "${UNINST_KEY}" "EstimatedSize" "$0"
+!macroend
+
+!macro wails.deleteUninstaller
+    Delete "$INSTDIR\uninstall.exe"
+
+    SetRegView 64
+    DeleteRegKey HKLM "${UNINST_KEY}"
+!macroend
+
+!macro wails.setShellContext
+    ${If} ${REQUEST_EXECUTION_LEVEL} == "admin"
+        SetShellVarContext all
+    ${else}
+        SetShellVarContext current
+    ${EndIf}
+!macroend
+
+# Install webview2 by launching the bootstrapper
+# See https://docs.microsoft.com/en-us/microsoft-edge/webview2/concepts/distribution#online-only-deployment
+!macro wails.webview2runtime
+    !ifndef WAILS_INSTALL_WEBVIEW_DETAILPRINT
+        !define WAILS_INSTALL_WEBVIEW_DETAILPRINT "Installing: WebView2 Runtime"
+    !endif
+
+    SetRegView 64
+	# If the admin key exists and is not empty then webview2 is already installed
+	ReadRegStr $0 HKLM "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" "pv"
+    ${If} $0 != ""
+        Goto ok
+    ${EndIf}
+
+    ${If} ${REQUEST_EXECUTION_LEVEL} == "user"
+        # If the installer is run in user level, check the user specific key exists and is not empty then webview2 is already installed
+	    ReadRegStr $0 HKCU "Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" "pv"
+        ${If} $0 != ""
+            Goto ok
+        ${EndIf}
+     ${EndIf}
+    
+	SetDetailsPrint both
+    DetailPrint "${WAILS_INSTALL_WEBVIEW_DETAILPRINT}"
+    SetDetailsPrint listonly
+    
+    InitPluginsDir
+    CreateDirectory "$pluginsdir\webview2bootstrapper"
+    SetOutPath "$pluginsdir\webview2bootstrapper"
+    File "MicrosoftEdgeWebview2Setup.exe"
+    ExecWait '"$pluginsdir\webview2bootstrapper\MicrosoftEdgeWebview2Setup.exe" /silent /install'
+    
+    SetDetailsPrint both
+    ok:
+!macroend
+
+# Copy of APP_ASSOCIATE and APP_UNASSOCIATE macros from here https://gist.github.com/nikku/281d0ef126dbc215dd58bfd5b3a5cd5b
+!macro APP_ASSOCIATE EXT FILECLASS DESCRIPTION ICON COMMANDTEXT COMMAND
+  ; Backup the previously associated file class
+  ReadRegStr $R0 SHELL_CONTEXT "Software\Classes\.${EXT}" ""
+  WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "${FILECLASS}_backup" "$R0"
+
+  WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "" "${FILECLASS}"
+
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}" "" `${DESCRIPTION}`
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}\DefaultIcon" "" `${ICON}`
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}\shell" "" "open"
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}\shell\open" "" `${COMMANDTEXT}`
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}\shell\open\command" "" `${COMMAND}`
+!macroend
+
+!macro APP_UNASSOCIATE EXT FILECLASS
+  ; Backup the previously associated file class
+  ReadRegStr $R0 SHELL_CONTEXT "Software\Classes\.${EXT}" `${FILECLASS}_backup`
+  WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "" "$R0"
+
+  DeleteRegKey SHELL_CONTEXT `Software\Classes\${FILECLASS}`
+!macroend
+
+!macro wails.associateFiles
+    ; Create file associations
+    
+!macroend
+
+!macro wails.unassociateFiles
+    ; Delete app associations
+    
+!macroend
+
+!macro CUSTOM_PROTOCOL_ASSOCIATE PROTOCOL DESCRIPTION ICON COMMAND
+  DeleteRegKey SHELL_CONTEXT "Software\Classes\${PROTOCOL}"
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}" "" "${DESCRIPTION}"
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}" "URL Protocol" ""
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}\DefaultIcon" "" "${ICON}"
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}\shell" "" ""
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}\shell\open" "" ""
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}\shell\open\command" "" "${COMMAND}"
+!macroend
+
+!macro CUSTOM_PROTOCOL_UNASSOCIATE PROTOCOL
+  DeleteRegKey SHELL_CONTEXT "Software\Classes\${PROTOCOL}"
+!macroend
+
+!macro wails.associateCustomProtocols
+    ; Create custom protocols associations
+    
+!macroend
+
+!macro wails.unassociateCustomProtocols
+    ; Delete app custom protocol associations
+    
+!macroend
\ No newline at end of file
diff --git a/client/ui/build/windows/wails.exe.manifest b/client/ui/build/windows/wails.exe.manifest
new file mode 100644
index 000000000..f8b7b8e14
--- /dev/null
+++ b/client/ui/build/windows/wails.exe.manifest
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
+    <assemblyIdentity type="win32" name="io.netbird.client" version="0.0.1.0" processorArchitecture="*"/>
+    <dependency>
+        <dependentAssembly>
+            <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>
+        </dependentAssembly>
+    </dependency>
+    <asmv3:application>
+        <asmv3:windowsSettings>
+            <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware> <!-- fallback for Windows 7 and 8 -->
+            <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">permonitorv2,permonitor</dpiAwareness> <!-- falls back to per-monitor if per-monitor v2 is not supported -->
+        </asmv3:windowsSettings>
+    </asmv3:application>
+    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+        <security>
+            <requestedPrivileges>
+                <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
+            </requestedPrivileges>
+        </security>
+    </trustInfo>
+</assembly>
diff --git a/client/ui/client_ui.go b/client/ui/client_ui.go
deleted file mode 100644
index 2b19c2bf5..000000000
--- a/client/ui/client_ui.go
+++ /dev/null
@@ -1,2016 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	_ "embed"
-	"errors"
-	"flag"
-	"fmt"
-	"net/url"
-	"os"
-	"os/exec"
-	"os/user"
-	"path"
-	"runtime"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-	"unicode"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/app"
-	"fyne.io/fyne/v2/canvas"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/dialog"
-	"fyne.io/fyne/v2/layout"
-	"fyne.io/fyne/v2/theme"
-	"fyne.io/fyne/v2/widget"
-	"fyne.io/systray"
-	"github.com/cenkalti/backoff/v4"
-	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/mdm"
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/client/ui/desktop"
-	"github.com/netbirdio/netbird/client/ui/event"
-	"github.com/netbirdio/netbird/client/ui/notifier"
-	"github.com/netbirdio/netbird/client/ui/process"
-	"github.com/netbirdio/netbird/util"
-
-	"github.com/netbirdio/netbird/version"
-)
-
-const (
-	defaultFailTimeout = 3 * time.Second
-	failFastTimeout    = time.Second
-)
-
-const (
-	censoredPreSharedKey = "**********"
-	maxSSHJWTCacheTTL    = 86_400 // 24 hours in seconds
-	// mdmFieldSuffix is appended to plain-text Entry widgets in the
-	// advanced Settings window when the underlying field is enforced
-	// by MDM, so the user sees the lock indicator inline next to the
-	// value. Stripped before any read site that feeds the value back
-	// into a SetConfig request (saveSettings / parseNumericSettings).
-	mdmFieldSuffix = " (MDM)"
-)
-
-// main is the entry point for the UI tray/client binary. Parses CLI
-// flags, initialises logging, builds the Fyne application and tray
-// icons, and constructs the service client (which may open a
-// requested UI window). When a window-mode flag is set the Fyne event
-// loop runs and main returns; otherwise main enforces single-instance
-// behaviour (signalling an existing instance to show its window when
-// present), sets up signal handling + default fonts, and runs the
-// system tray loop.
-func main() {
-	flags := parseFlags()
-
-	// Initialize file logging if needed.
-	var logFile string
-	if flags.saveLogsInFile {
-		file, err := initLogFile()
-		if err != nil {
-			log.Errorf("error while initializing log: %v", err)
-			return
-		}
-		logFile = file
-	} else {
-		_ = util.InitLog("trace", util.LogConsole)
-	}
-
-	// Create the Fyne application.
-	a := app.NewWithID("NetBird")
-	a.SetIcon(fyne.NewStaticResource("netbird", iconDisconnected))
-
-	// Show error message window if needed.
-	if flags.errorMsg != "" {
-		showErrorMessage(flags.errorMsg)
-		return
-	}
-
-	// Create the service client (this also builds the settings or networks UI if requested).
-	client := newServiceClient(&newServiceClientArgs{
-		addr:              flags.daemonAddr,
-		logFile:           logFile,
-		app:               a,
-		showSettings:      flags.showSettings,
-		showNetworks:      flags.showNetworks,
-		showLoginURL:      flags.showLoginURL,
-		showDebug:         flags.showDebug,
-		showProfiles:      flags.showProfiles,
-		showQuickActions:  flags.showQuickActions,
-		showUpdate:        flags.showUpdate,
-		showUpdateVersion: flags.showUpdateVersion,
-	})
-
-	// Watch for theme/settings changes to update the icon.
-	go watchSettingsChanges(a, client)
-
-	// Run in window mode if any UI flag was set.
-	if flags.showSettings || flags.showNetworks || flags.showDebug || flags.showLoginURL || flags.showProfiles || flags.showQuickActions || flags.showUpdate {
-		a.Run()
-		return
-	}
-
-	// Check for another running process.
-	pid, running, err := process.IsAnotherProcessRunning()
-	if err != nil {
-		log.Errorf("error while checking process: %v", err)
-		return
-	}
-	if running {
-		log.Infof("another process is running with pid %d, sending signal to show window", pid)
-		if err := sendShowWindowSignal(pid); err != nil {
-			log.Errorf("send signal to running instance: %v", err)
-		}
-		return
-	}
-
-	client.setupSignalHandler(client.ctx)
-
-	client.setDefaultFonts()
-	systray.Run(client.onTrayReady, client.onTrayExit)
-}
-
-type cliFlags struct {
-	daemonAddr        string
-	showSettings      bool
-	showNetworks      bool
-	showProfiles      bool
-	showDebug         bool
-	showLoginURL      bool
-	showQuickActions  bool
-	errorMsg          string
-	saveLogsInFile    bool
-	showUpdate        bool
-	showUpdateVersion string
-}
-
-// parseFlags reads and returns all needed command-line flags.
-func parseFlags() *cliFlags {
-	var flags cliFlags
-
-	defaultDaemonAddr := "unix:///var/run/netbird.sock"
-	if runtime.GOOS == "windows" {
-		defaultDaemonAddr = "tcp://127.0.0.1:41731"
-	}
-	flag.StringVar(&flags.daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp]://[path|host:port]")
-	flag.BoolVar(&flags.showSettings, "settings", false, "run settings window")
-	flag.BoolVar(&flags.showNetworks, "networks", false, "run networks window")
-	flag.BoolVar(&flags.showProfiles, "profiles", false, "run profiles window")
-	flag.BoolVar(&flags.showDebug, "debug", false, "run debug window")
-	flag.BoolVar(&flags.showQuickActions, "quick-actions", false, "run quick actions window")
-	flag.StringVar(&flags.errorMsg, "error-msg", "", "displays an error message window")
-	flag.BoolVar(&flags.saveLogsInFile, "use-log-file", false, fmt.Sprintf("save logs in a file: %s/netbird-ui-PID.log", os.TempDir()))
-	flag.BoolVar(&flags.showLoginURL, "login-url", false, "show login URL in a popup window")
-	flag.BoolVar(&flags.showUpdate, "update", false, "show update progress window")
-	flag.StringVar(&flags.showUpdateVersion, "update-version", "", "version to update to")
-	flag.Parse()
-	return &flags
-}
-
-// initLogFile initializes logging into a file.
-func initLogFile() (string, error) {
-	logFile := path.Join(os.TempDir(), fmt.Sprintf("netbird-ui-%d.log", os.Getpid()))
-	return logFile, util.InitLog("trace", logFile)
-}
-
-// watchSettingsChanges listens for Fyne theme/settings changes and updates the client icon.
-func watchSettingsChanges(a fyne.App, client *serviceClient) {
-	a.Settings().AddListener(func(settings fyne.Settings) {
-		client.updateIcon()
-	})
-}
-
-// showErrorMessage displays an error message in a simple window.
-func showErrorMessage(msg string) {
-	a := app.New()
-	w := a.NewWindow("NetBird Error")
-	label := widget.NewLabel(msg)
-	label.Wrapping = fyne.TextWrapWord
-	w.SetContent(label)
-	w.Resize(fyne.NewSize(400, 100))
-	w.Show()
-	a.Run()
-}
-
-//go:embed assets/netbird-systemtray-connected-macos.png
-var iconConnectedMacOS []byte
-
-//go:embed assets/netbird-systemtray-disconnected-macos.png
-var iconDisconnectedMacOS []byte
-
-//go:embed assets/netbird-systemtray-update-disconnected-macos.png
-var iconUpdateDisconnectedMacOS []byte
-
-//go:embed assets/netbird-systemtray-update-connected-macos.png
-var iconUpdateConnectedMacOS []byte
-
-//go:embed assets/netbird-systemtray-connecting-macos.png
-var iconConnectingMacOS []byte
-
-//go:embed assets/netbird-systemtray-error-macos.png
-var iconErrorMacOS []byte
-
-//go:embed assets/connected.png
-var iconConnectedDot []byte
-
-//go:embed assets/disconnected.png
-var iconDisconnectedDot []byte
-
-type serviceClient struct {
-	ctx      context.Context
-	cancel   context.CancelFunc
-	addr     string
-	conn     proto.DaemonServiceClient
-	connLock sync.Mutex
-
-	eventHandler *eventHandler
-
-	profileManager *profilemanager.ProfileManager
-
-	icAbout              []byte
-	icConnected          []byte
-	icConnectedDot       []byte
-	icDisconnected       []byte
-	icDisconnectedDot    []byte
-	icUpdateConnected    []byte
-	icUpdateDisconnected []byte
-	icConnecting         []byte
-	icError              []byte
-
-	// systray menu items
-	mStatus            *systray.MenuItem
-	mUp                *systray.MenuItem
-	mDown              *systray.MenuItem
-	mSettings          *systray.MenuItem
-	mProfile           *profileMenu
-	mAbout             *systray.MenuItem
-	mGitHub            *systray.MenuItem
-	mVersionUI         *systray.MenuItem
-	mVersionDaemon     *systray.MenuItem
-	mUpdate            *systray.MenuItem
-	mQuit              *systray.MenuItem
-	mNetworks          *systray.MenuItem
-	mAllowSSH          *systray.MenuItem
-	mAutoConnect       *systray.MenuItem
-	mEnableRosenpass   *systray.MenuItem
-	mBlockInbound      *systray.MenuItem
-	mNotifications     *systray.MenuItem
-	mAdvancedSettings  *systray.MenuItem
-	mCreateDebugBundle *systray.MenuItem
-	mExitNode          *systray.MenuItem
-
-	// application with main windows.
-	app                  fyne.App
-	notifier             notifier.Notifier
-	wSettings            fyne.Window
-	showAdvancedSettings bool
-	sendNotification     bool
-
-	// input elements for settings form
-	iMngURL        *widget.Entry
-	iLogFile       *widget.Entry
-	iPreSharedKey  *widget.Entry
-	iInterfaceName *widget.Entry
-	iInterfacePort *widget.Entry
-	iMTU           *widget.Entry
-
-	// switch elements for settings form
-	sRosenpassPermissive        *widget.Check
-	sNetworkMonitor             *widget.Check
-	sDisableDNS                 *widget.Check
-	sDisableClientRoutes        *widget.Check
-	sDisableServerRoutes        *widget.Check
-	sDisableIPv6                *widget.Check
-	sBlockLANAccess             *widget.Check
-	sEnableSSHRoot              *widget.Check
-	sEnableSSHSFTP              *widget.Check
-	sEnableSSHLocalPortForward  *widget.Check
-	sEnableSSHRemotePortForward *widget.Check
-	sDisableSSHAuth             *widget.Check
-	iSSHJWTCacheTTL             *widget.Entry
-
-	// observable settings over corresponding iMngURL and iPreSharedKey values.
-	managementURL string
-	preSharedKey  string
-
-	RosenpassPermissive        bool
-	interfaceName              string
-	interfacePort              int
-	mtu                        uint16
-	networkMonitor             bool
-	disableDNS                 bool
-	disableClientRoutes        bool
-	disableServerRoutes        bool
-	disableIPv6                bool
-	blockLANAccess             bool
-	enableSSHRoot              bool
-	enableSSHSFTP              bool
-	enableSSHLocalPortForward  bool
-	enableSSHRemotePortForward bool
-	disableSSHAuth             bool
-	sshJWTCacheTTL             int
-
-	connected            bool
-	daemonVersion        string
-	updateIndicationLock sync.Mutex
-	isUpdateIconActive   bool
-	isEnforcedUpdate     bool
-	lastNotifiedVersion  string
-	profilesEnabled      bool
-	networksEnabled      bool
-	// networksMenuEnabled caches the last applied enabled-state of the
-	// mNetworks + mExitNode submenu items. Combines features.DisableNetworks
-	// AND s.connected — both must be true for the menus to be active.
-	// Zero value (false) matches the Disable() call at AddMenuItem time.
-	networksMenuEnabled bool
-	showNetworks        bool
-	wNetworks           fyne.Window
-	wProfiles           fyne.Window
-	wQuickActions       fyne.Window
-
-	eventManager *event.Manager
-
-	exitNodeMu           sync.Mutex
-	mExitNodeItems       []menuHandler
-	exitNodeRetryCancel  context.CancelFunc
-	mExitNodeSeparator   *systray.MenuItem
-	mExitNodeDeselectAll *systray.MenuItem
-	logFile              string
-	wLoginURL            fyne.Window
-	wUpdateProgress      fyne.Window
-	updateContextCancel  context.CancelFunc
-
-	connectCancel context.CancelFunc
-
-	// mdmManagedFields caches the names of MDM-enforced policy keys
-	// surfaced by the daemon in GetConfigResponse. Each refresh of
-	// daemon config (loadSettings, getSrvConfig, config_changed event)
-	// updates this set and re-applies the lock/badge to the affected
-	// menu items and settings-form widgets.
-	mdmManagedFields map[string]bool
-}
-
-type menuHandler struct {
-	*systray.MenuItem
-	cancel context.CancelFunc
-}
-
-type newServiceClientArgs struct {
-	addr              string
-	logFile           string
-	app               fyne.App
-	showSettings      bool
-	showNetworks      bool
-	showDebug         bool
-	showLoginURL      bool
-	showProfiles      bool
-	showQuickActions  bool
-	showUpdate        bool
-	showUpdateVersion string
-}
-
-// newServiceClient instance constructor
-//
-// This constructor also builds the UI elements for the settings window.
-func newServiceClient(args *newServiceClientArgs) *serviceClient {
-	ctx, cancel := context.WithCancel(context.Background())
-	s := &serviceClient{
-		ctx:              ctx,
-		cancel:           cancel,
-		addr:             args.addr,
-		app:              args.app,
-		notifier:         notifier.New(args.app),
-		logFile:          args.logFile,
-		sendNotification: false,
-
-		showAdvancedSettings: args.showSettings,
-		showNetworks:         args.showNetworks,
-		networksEnabled:      true,
-	}
-
-	s.eventHandler = newEventHandler(s)
-	s.profileManager = profilemanager.NewProfileManager()
-	s.setNewIcons()
-
-	switch {
-	case args.showSettings:
-		s.showSettingsUI()
-	case args.showNetworks:
-		s.showNetworksUI()
-	case args.showLoginURL:
-		s.showLoginURL()
-	case args.showDebug:
-		s.showDebugUI()
-	case args.showProfiles:
-		s.showProfilesUI()
-	case args.showQuickActions:
-		// Suppress the on-boot Quick Actions popup when the daemon
-		// reports DisableAutoConnect=true — that flag carries both the
-		// user's "Connect on Startup = off" preference AND any MDM-
-		// enforced override (applyMDMPolicy writes the policy value
-		// into the same Config field). See netbirdio/netbird#5744.
-		if !s.disableAutoConnectFromDaemon() {
-			s.showQuickActionsUI()
-		}
-	case args.showUpdate:
-		s.showUpdateProgress(ctx, args.showUpdateVersion)
-	}
-
-	return s
-}
-
-func (s *serviceClient) setNewIcons() {
-	s.icAbout = iconAbout
-	s.icConnectedDot = iconConnectedDot
-	s.icDisconnectedDot = iconDisconnectedDot
-	if s.app.Settings().ThemeVariant() == theme.VariantDark {
-		s.icConnected = iconConnectedDark
-		s.icDisconnected = iconDisconnected
-		s.icUpdateConnected = iconUpdateConnectedDark
-		s.icUpdateDisconnected = iconUpdateDisconnectedDark
-		s.icConnecting = iconConnectingDark
-		s.icError = iconErrorDark
-	} else {
-		s.icConnected = iconConnected
-		s.icDisconnected = iconDisconnected
-		s.icUpdateConnected = iconUpdateConnected
-		s.icUpdateDisconnected = iconUpdateDisconnected
-		s.icConnecting = iconConnecting
-		s.icError = iconError
-	}
-}
-
-func (s *serviceClient) updateIcon() {
-	s.setNewIcons()
-	s.updateIndicationLock.Lock()
-	if s.connected {
-		if s.isUpdateIconActive {
-			systray.SetTemplateIcon(iconUpdateConnectedMacOS, s.icUpdateConnected)
-		} else {
-			systray.SetTemplateIcon(iconConnectedMacOS, s.icConnected)
-		}
-	} else {
-		if s.isUpdateIconActive {
-			systray.SetTemplateIcon(iconUpdateDisconnectedMacOS, s.icUpdateDisconnected)
-		} else {
-			systray.SetTemplateIcon(iconDisconnectedMacOS, s.icDisconnected)
-		}
-	}
-	s.updateIndicationLock.Unlock()
-}
-
-func (s *serviceClient) showSettingsUI() {
-	// DisableUpdateSettings no longer gates the window from opening:
-	// the daemon blocks every actual mutation at SetConfig / Login,
-	// so the window is safe to show as a read-only view. The previous
-	// early-return also blocked Advanced Settings whenever update
-	// editing was off, which conflated two distinct kill switches
-	// (see comment in checkAndUpdateFeatures).
-
-	// add settings window UI elements.
-	s.wSettings = s.app.NewWindow("NetBird Settings")
-	s.wSettings.SetOnClosed(s.cancel)
-
-	s.iMngURL = widget.NewEntry()
-
-	s.iLogFile = widget.NewEntry()
-	s.iLogFile.Disable()
-	s.iPreSharedKey = widget.NewPasswordEntry()
-	s.iInterfaceName = widget.NewEntry()
-	s.iInterfacePort = widget.NewEntry()
-	s.iMTU = widget.NewEntry()
-
-	s.sRosenpassPermissive = widget.NewCheck("Enable Rosenpass permissive mode", nil)
-
-	s.sNetworkMonitor = widget.NewCheck("Restarts NetBird when the network changes", nil)
-	s.sDisableDNS = widget.NewCheck("Keeps system DNS settings unchanged", nil)
-	s.sDisableClientRoutes = widget.NewCheck("This peer won't route traffic to other peers", nil)
-	s.sDisableServerRoutes = widget.NewCheck("This peer won't act as router for others", nil)
-	s.sDisableIPv6 = widget.NewCheck("Disable IPv6 overlay addressing", nil)
-	s.sBlockLANAccess = widget.NewCheck("Blocks local network access when used as exit node", nil)
-	s.sEnableSSHRoot = widget.NewCheck("Enable SSH Root Login", nil)
-	s.sEnableSSHSFTP = widget.NewCheck("Enable SSH SFTP", nil)
-	s.sEnableSSHLocalPortForward = widget.NewCheck("Enable SSH Local Port Forwarding", nil)
-	s.sEnableSSHRemotePortForward = widget.NewCheck("Enable SSH Remote Port Forwarding", nil)
-	s.sDisableSSHAuth = widget.NewCheck("Disable SSH Authentication", nil)
-	s.iSSHJWTCacheTTL = widget.NewEntry()
-
-	s.wSettings.SetContent(s.getSettingsForm())
-	s.wSettings.Resize(fyne.NewSize(600, 400))
-	s.wSettings.SetFixedSize(true)
-
-	s.getSrvConfig()
-	s.wSettings.Show()
-}
-
-func (s *serviceClient) getConnectionForm() *widget.Form {
-	var activeProfName string
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Errorf("get active profile: %v", err)
-	} else {
-		activeProfName = activeProf.Name
-	}
-	return &widget.Form{
-		Items: []*widget.FormItem{
-			{Text: "Profile", Widget: widget.NewLabel(activeProfName)},
-			{Text: "Management URL", Widget: s.iMngURL},
-			{Text: "Pre-shared Key", Widget: s.iPreSharedKey},
-			{Text: "Quantum-Resistance", Widget: s.sRosenpassPermissive},
-			{Text: "Interface Name", Widget: s.iInterfaceName},
-			{Text: "Interface Port", Widget: s.iInterfacePort, HintText: "If set to 0, a random free port will be used"},
-			{Text: "MTU", Widget: s.iMTU},
-			{Text: "Log File", Widget: s.iLogFile},
-		},
-	}
-}
-
-func (s *serviceClient) saveSettings() {
-	// Check if update settings are disabled by daemon
-	features, err := s.getFeatures()
-	if err != nil {
-		log.Errorf("failed to get features from daemon: %v", err)
-		// Continue with default behavior if features can't be retrieved
-	} else if features != nil && features.DisableUpdateSettings {
-		log.Warn("Configuration updates are disabled by daemon")
-		dialog.ShowError(fmt.Errorf("configuration updates are disabled by daemon"), s.wSettings)
-		return
-	}
-
-	if err := s.validateSettings(); err != nil {
-		dialog.ShowError(err, s.wSettings)
-		return
-	}
-
-	port, mtu, err := s.parseNumericSettings()
-	if err != nil {
-		dialog.ShowError(err, s.wSettings)
-		return
-	}
-
-	iMngURL := strings.TrimSpace(strings.TrimSuffix(s.iMngURL.Text, mdmFieldSuffix))
-
-	if s.hasSettingsChanged(iMngURL, port, mtu) {
-		if err := s.applySettingsChanges(iMngURL, port, mtu); err != nil {
-			dialog.ShowError(err, s.wSettings)
-			return
-		}
-	}
-
-	s.wSettings.Close()
-}
-
-func (s *serviceClient) validateSettings() error {
-	if s.iPreSharedKey.Text != "" && s.iPreSharedKey.Text != censoredPreSharedKey {
-		if _, err := wgtypes.ParseKey(s.iPreSharedKey.Text); err != nil {
-			return fmt.Errorf("invalid pre-shared key value")
-		}
-	}
-	return nil
-}
-
-func (s *serviceClient) parseNumericSettings() (int64, int64, error) {
-	port, err := strconv.ParseInt(strings.TrimSpace(strings.TrimSuffix(s.iInterfacePort.Text, mdmFieldSuffix)), 10, 64)
-	if err != nil {
-		return 0, 0, errors.New("invalid interface port")
-	}
-	if port < 0 || port > 65535 {
-		return 0, 0, errors.New("invalid interface port: out of range 0-65535")
-	}
-
-	var mtu int64
-	mtuText := strings.TrimSpace(s.iMTU.Text)
-	if mtuText != "" {
-		mtu, err = strconv.ParseInt(mtuText, 10, 64)
-		if err != nil {
-			return 0, 0, errors.New("invalid MTU value")
-		}
-		if mtu < iface.MinMTU || mtu > iface.MaxMTU {
-			return 0, 0, fmt.Errorf("MTU must be between %d and %d bytes", iface.MinMTU, iface.MaxMTU)
-		}
-	}
-
-	return port, mtu, nil
-}
-
-func (s *serviceClient) hasSettingsChanged(iMngURL string, port, mtu int64) bool {
-	return s.managementURL != iMngURL ||
-		s.preSharedKey != s.iPreSharedKey.Text ||
-		s.RosenpassPermissive != s.sRosenpassPermissive.Checked ||
-		s.interfaceName != s.iInterfaceName.Text ||
-		s.interfacePort != int(port) ||
-		s.mtu != uint16(mtu) ||
-		s.networkMonitor != s.sNetworkMonitor.Checked ||
-		s.disableDNS != s.sDisableDNS.Checked ||
-		s.disableClientRoutes != s.sDisableClientRoutes.Checked ||
-		s.disableServerRoutes != s.sDisableServerRoutes.Checked ||
-		s.disableIPv6 != s.sDisableIPv6.Checked ||
-		s.blockLANAccess != s.sBlockLANAccess.Checked ||
-		s.hasSSHChanges()
-}
-
-func (s *serviceClient) applySettingsChanges(iMngURL string, port, mtu int64) error {
-	s.managementURL = iMngURL
-	s.preSharedKey = s.iPreSharedKey.Text
-	s.mtu = uint16(mtu)
-
-	req, err := s.buildSetConfigRequest(iMngURL, port, mtu)
-	if err != nil {
-		return fmt.Errorf("build config request: %w", err)
-	}
-
-	if err := s.sendConfigUpdate(req); err != nil {
-		return fmt.Errorf("set configuration: %w", err)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) buildSetConfigRequest(iMngURL string, port, mtu int64) (*proto.SetConfigRequest, error) {
-	currUser, err := user.Current()
-	if err != nil {
-		return nil, fmt.Errorf("get current user: %w", err)
-	}
-
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		return nil, fmt.Errorf("get active profile: %w", err)
-	}
-
-	req := &proto.SetConfigRequest{
-		ProfileName: activeProf.ID.String(),
-		Username:    currUser.Username,
-	}
-
-	if iMngURL != "" {
-		req.ManagementUrl = iMngURL
-	}
-
-	req.RosenpassPermissive = &s.sRosenpassPermissive.Checked
-	req.InterfaceName = &s.iInterfaceName.Text
-	req.WireguardPort = &port
-	if mtu > 0 {
-		req.Mtu = &mtu
-	}
-
-	req.NetworkMonitor = &s.sNetworkMonitor.Checked
-	req.DisableDns = &s.sDisableDNS.Checked
-	req.DisableClientRoutes = &s.sDisableClientRoutes.Checked
-	req.DisableServerRoutes = &s.sDisableServerRoutes.Checked
-	req.DisableIpv6 = &s.sDisableIPv6.Checked
-	req.BlockLanAccess = &s.sBlockLANAccess.Checked
-
-	req.EnableSSHRoot = &s.sEnableSSHRoot.Checked
-	req.EnableSSHSFTP = &s.sEnableSSHSFTP.Checked
-	req.EnableSSHLocalPortForwarding = &s.sEnableSSHLocalPortForward.Checked
-	req.EnableSSHRemotePortForwarding = &s.sEnableSSHRemotePortForward.Checked
-	req.DisableSSHAuth = &s.sDisableSSHAuth.Checked
-
-	sshJWTCacheTTLText := strings.TrimSpace(s.iSSHJWTCacheTTL.Text)
-	if sshJWTCacheTTLText != "" {
-		sshJWTCacheTTL, err := strconv.ParseInt(sshJWTCacheTTLText, 10, 32)
-		if err != nil {
-			return nil, errors.New("invalid SSH JWT Cache TTL value")
-		}
-		if sshJWTCacheTTL < 0 || sshJWTCacheTTL > maxSSHJWTCacheTTL {
-			return nil, fmt.Errorf("SSH JWT Cache TTL must be between 0 and %d seconds", maxSSHJWTCacheTTL)
-		}
-		sshJWTCacheTTL32 := int32(sshJWTCacheTTL)
-		req.SshJWTCacheTTL = &sshJWTCacheTTL32
-	}
-
-	// Only attach the PSK when the user actually typed something:
-	// - "" means the field was left untouched (we deliberately render
-	//   an empty Text + placeholder hint to avoid leaking the daemon's
-	//   "**********" redaction through the password reveal toggle);
-	//   sending an empty pointer would tell the daemon to clear / overwrite
-	//   the on-disk or MDM-enforced PSK, which then trips the MDM
-	//   conflict gate when PSK is policy-managed.
-	// - "**********" is the redacted echo (legacy non-MDM path); also a no-op.
-	if s.iPreSharedKey.Text != "" && s.iPreSharedKey.Text != censoredPreSharedKey {
-		req.OptionalPreSharedKey = &s.iPreSharedKey.Text
-	}
-
-	return req, nil
-}
-
-func (s *serviceClient) sendConfigUpdate(req *proto.SetConfigRequest) error {
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		return fmt.Errorf("get client: %w", err)
-	}
-
-	_, err = conn.SetConfig(s.ctx, req)
-	if err != nil {
-		return fmt.Errorf("set config: %w", err)
-	}
-
-	// Reconnect if connected to apply the new settings.
-	// Use a background context so the reconnect outlives the settings window.
-	go func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer cancel()
-		status, err := conn.Status(ctx, &proto.StatusRequest{})
-		if err != nil {
-			log.Errorf("failed to get service status: %v", err)
-			return
-		}
-		if status.Status == string(internal.StatusConnected) {
-			if _, err = conn.Down(ctx, &proto.DownRequest{}); err != nil {
-				log.Errorf("failed to stop service: %v", err)
-			}
-			// TODO: wait for the service to be idle before calling Up, or use a fresh connection
-			if _, err = conn.Up(ctx, &proto.UpRequest{}); err != nil {
-				log.Errorf("failed to start service: %v", err)
-			}
-		}
-	}()
-
-	return nil
-}
-
-func (s *serviceClient) getSettingsForm() fyne.CanvasObject {
-	connectionForm := s.getConnectionForm()
-	networkForm := s.getNetworkForm()
-	sshForm := s.getSSHForm()
-	tabs := container.NewAppTabs(
-		container.NewTabItem("Connection", connectionForm),
-		container.NewTabItem("Network", networkForm),
-		container.NewTabItem("SSH", sshForm),
-	)
-	saveButton := widget.NewButtonWithIcon("Save", theme.ConfirmIcon(), s.saveSettings)
-	saveButton.Importance = widget.HighImportance
-	cancelButton := widget.NewButtonWithIcon("Cancel", theme.CancelIcon(), func() {
-		s.wSettings.Close()
-	})
-	buttonContainer := container.NewHBox(
-		layout.NewSpacer(),
-		cancelButton,
-		saveButton,
-	)
-	return container.NewBorder(nil, buttonContainer, nil, nil, tabs)
-}
-
-func (s *serviceClient) getNetworkForm() *widget.Form {
-	return &widget.Form{
-		Items: []*widget.FormItem{
-			{Text: "Network Monitor", Widget: s.sNetworkMonitor},
-			{Text: "Disable DNS", Widget: s.sDisableDNS},
-			{Text: "Disable Client Routes", Widget: s.sDisableClientRoutes},
-			{Text: "Disable Server Routes", Widget: s.sDisableServerRoutes},
-			{Text: "Disable IPv6", Widget: s.sDisableIPv6},
-			{Text: "Disable LAN Access", Widget: s.sBlockLANAccess},
-		},
-	}
-}
-
-func (s *serviceClient) getSSHForm() *widget.Form {
-	return &widget.Form{
-		Items: []*widget.FormItem{
-			{Text: "Enable SSH Root Login", Widget: s.sEnableSSHRoot},
-			{Text: "Enable SSH SFTP", Widget: s.sEnableSSHSFTP},
-			{Text: "Enable SSH Local Port Forwarding", Widget: s.sEnableSSHLocalPortForward},
-			{Text: "Enable SSH Remote Port Forwarding", Widget: s.sEnableSSHRemotePortForward},
-			{Text: "Disable SSH Authentication", Widget: s.sDisableSSHAuth},
-			{Text: "JWT Cache TTL (seconds, 0=disabled)", Widget: s.iSSHJWTCacheTTL},
-		},
-	}
-}
-
-func (s *serviceClient) hasSSHChanges() bool {
-	currentSSHJWTCacheTTL := s.sshJWTCacheTTL
-	if text := strings.TrimSpace(s.iSSHJWTCacheTTL.Text); text != "" {
-		val, err := strconv.Atoi(text)
-		if err != nil {
-			return true
-		}
-		currentSSHJWTCacheTTL = val
-	}
-
-	return s.enableSSHRoot != s.sEnableSSHRoot.Checked ||
-		s.enableSSHSFTP != s.sEnableSSHSFTP.Checked ||
-		s.enableSSHLocalPortForward != s.sEnableSSHLocalPortForward.Checked ||
-		s.enableSSHRemotePortForward != s.sEnableSSHRemotePortForward.Checked ||
-		s.disableSSHAuth != s.sDisableSSHAuth.Checked ||
-		s.sshJWTCacheTTL != currentSSHJWTCacheTTL
-}
-
-func (s *serviceClient) login(ctx context.Context, openURL bool) (*proto.LoginResponse, error) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return nil, fmt.Errorf("get daemon client: %w", err)
-	}
-
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		return nil, fmt.Errorf("get active profile: %w", err)
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		return nil, fmt.Errorf("get current user: %w", err)
-	}
-
-	handle := activeProf.ID.String()
-
-	loginReq := &proto.LoginRequest{
-		IsUnixDesktopClient: runtime.GOOS == "linux" || runtime.GOOS == "freebsd",
-		ProfileName:         &handle,
-		Username:            &currUser.Username,
-	}
-
-	profileState, err := s.profileManager.GetProfileState(activeProf.ID)
-	if err != nil {
-		log.Debugf("failed to get profile state for login hint: %v", err)
-	} else if profileState.Email != "" {
-		loginReq.Hint = &profileState.Email
-	}
-
-	loginResp, err := conn.Login(ctx, loginReq)
-	if err != nil {
-		return nil, fmt.Errorf("login to management: %w", err)
-	}
-
-	if loginResp.NeedsSSOLogin && openURL {
-		if err = s.handleSSOLogin(ctx, loginResp, conn); err != nil {
-			return nil, fmt.Errorf("SSO login: %w", err)
-		}
-	}
-
-	return loginResp, nil
-}
-
-func (s *serviceClient) handleSSOLogin(ctx context.Context, loginResp *proto.LoginResponse, conn proto.DaemonServiceClient) error {
-	if err := openURL(loginResp.VerificationURIComplete); err != nil {
-		return fmt.Errorf("open browser: %w", err)
-	}
-
-	resp, err := conn.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{UserCode: loginResp.UserCode})
-	if err != nil {
-		return fmt.Errorf("wait for SSO login: %w", err)
-	}
-
-	if resp.Email != "" {
-		if err := s.profileManager.SetActiveProfileState(&profilemanager.ProfileState{
-			Email: resp.Email,
-		}); err != nil {
-			log.Debugf("failed to set profile state: %v", err)
-		} else {
-			s.mProfile.refresh()
-		}
-	}
-
-	return nil
-}
-
-func (s *serviceClient) menuUpClick(ctx context.Context) error {
-	systray.SetTemplateIcon(iconConnectingMacOS, s.icConnecting)
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		systray.SetTemplateIcon(iconErrorMacOS, s.icError)
-		return fmt.Errorf("get daemon client: %w", err)
-	}
-
-	_, err = s.login(ctx, true)
-	if err != nil {
-		return fmt.Errorf("login: %w", err)
-	}
-
-	status, err := conn.Status(ctx, &proto.StatusRequest{})
-	if err != nil {
-		return fmt.Errorf("get status: %w", err)
-	}
-
-	if status.Status == string(internal.StatusConnected) {
-		return nil
-	}
-
-	if _, err := s.conn.Up(s.ctx, &proto.UpRequest{}); err != nil {
-		return fmt.Errorf("start connection: %w", err)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) menuDownClick() error {
-	systray.SetTemplateIcon(iconConnectingMacOS, s.icConnecting)
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf("get daemon client: %w", err)
-	}
-
-	status, err := conn.Status(s.ctx, &proto.StatusRequest{})
-	if err != nil {
-		return fmt.Errorf("get status: %w", err)
-	}
-
-	if status.Status != string(internal.StatusConnected) && status.Status != string(internal.StatusConnecting) {
-		return nil
-	}
-
-	if _, err := conn.Down(s.ctx, &proto.DownRequest{}); err != nil {
-		return fmt.Errorf("stop connection: %w", err)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) updateStatus() error {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return err
-	}
-	err = backoff.Retry(func() error {
-		status, err := conn.Status(s.ctx, &proto.StatusRequest{})
-		if err != nil {
-			log.Errorf("get service status: %v", err)
-			if s.connected {
-				s.notifier.Send("Error", "Connection to service lost")
-			}
-			s.setDisconnectedStatus()
-			return err
-		}
-
-		s.updateIndicationLock.Lock()
-		defer s.updateIndicationLock.Unlock()
-
-		// notify the user when the session has expired
-		if status.Status == string(internal.StatusSessionExpired) {
-			s.onSessionExpire()
-		}
-
-		var systrayIconState bool
-
-		switch {
-		case status.Status == string(internal.StatusConnected) && !s.connected:
-			s.connected = true
-			s.sendNotification = true
-			if s.isUpdateIconActive {
-				systray.SetTemplateIcon(iconUpdateConnectedMacOS, s.icUpdateConnected)
-			} else {
-				systray.SetTemplateIcon(iconConnectedMacOS, s.icConnected)
-			}
-			systray.SetTooltip("NetBird (Connected)")
-			s.mStatus.SetTitle("Connected")
-			s.mStatus.SetIcon(s.icConnectedDot)
-			s.mUp.Disable()
-			s.mDown.Enable()
-			if s.networksEnabled {
-				s.mNetworks.Enable()
-				s.mExitNode.Enable()
-			}
-			s.startExitNodeRefresh()
-			systrayIconState = true
-		case status.Status == string(internal.StatusConnecting):
-			s.setConnectingStatus()
-		case status.Status != string(internal.StatusConnected) && s.mUp.Disabled():
-			s.setDisconnectedStatus()
-			systrayIconState = false
-		}
-
-		// if the daemon version changed (e.g. after a successful update), reset the update indication
-		if s.daemonVersion != status.DaemonVersion {
-			if s.daemonVersion != "" {
-				s.mUpdate.Hide()
-				s.isUpdateIconActive = false
-			}
-			s.daemonVersion = status.DaemonVersion
-			if !s.isUpdateIconActive {
-				if systrayIconState {
-					systray.SetTemplateIcon(iconConnectedMacOS, s.icConnected)
-				} else {
-					systray.SetTemplateIcon(iconDisconnectedMacOS, s.icDisconnected)
-				}
-			}
-
-			daemonVersionTitle := normalizedVersion(s.daemonVersion)
-			s.mVersionDaemon.SetTitle(fmt.Sprintf("Daemon: %s", daemonVersionTitle))
-			s.mVersionDaemon.SetTooltip(fmt.Sprintf("Daemon version: %s", daemonVersionTitle))
-			s.mVersionDaemon.Show()
-		}
-
-		return nil
-	}, &backoff.ExponentialBackOff{
-		InitialInterval:     time.Second,
-		RandomizationFactor: backoff.DefaultRandomizationFactor,
-		Multiplier:          backoff.DefaultMultiplier,
-		MaxInterval:         300 * time.Millisecond,
-		MaxElapsedTime:      2 * time.Second,
-		Stop:                backoff.Stop,
-		Clock:               backoff.SystemClock,
-	})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (s *serviceClient) setDisconnectedStatus() {
-	s.connected = false
-	if s.isUpdateIconActive {
-		systray.SetTemplateIcon(iconUpdateDisconnectedMacOS, s.icUpdateDisconnected)
-	} else {
-		systray.SetTemplateIcon(iconDisconnectedMacOS, s.icDisconnected)
-	}
-	systray.SetTooltip("NetBird (Disconnected)")
-	s.mStatus.SetTitle("Disconnected")
-	s.mStatus.SetIcon(s.icDisconnectedDot)
-	s.mDown.Disable()
-	s.mUp.Enable()
-	s.mNetworks.Disable()
-	s.mExitNode.Disable()
-	s.cancelExitNodeRetry()
-	go s.updateExitNodes()
-}
-
-func (s *serviceClient) setConnectingStatus() {
-	s.connected = false
-	systray.SetTemplateIcon(iconConnectingMacOS, s.icConnecting)
-	systray.SetTooltip("NetBird (Connecting)")
-	s.mStatus.SetTitle("Connecting")
-	s.mUp.Disable()
-	s.mDown.Enable()
-	s.mNetworks.Disable()
-	s.mExitNode.Disable()
-}
-
-func (s *serviceClient) onTrayReady() {
-	systray.SetTemplateIcon(iconDisconnectedMacOS, s.icDisconnected)
-	systray.SetTooltip("NetBird")
-
-	// setup systray menu items
-	s.mStatus = systray.AddMenuItem("Disconnected", "Disconnected")
-	s.mStatus.SetIcon(s.icDisconnectedDot)
-	s.mStatus.Disable()
-
-	profileMenuItem := systray.AddMenuItem("", "")
-	emailMenuItem := systray.AddMenuItem("", "")
-
-	newProfileMenuArgs := &newProfileMenuArgs{
-		ctx:                  s.ctx,
-		serviceClient:        s,
-		profileManager:       s.profileManager,
-		eventHandler:         s.eventHandler,
-		profileMenuItem:      profileMenuItem,
-		emailMenuItem:        emailMenuItem,
-		downClickCallback:    s.menuDownClick,
-		upClickCallback:      s.menuUpClick,
-		getSrvClientCallback: s.getSrvClient,
-		loadSettingsCallback: s.loadSettings,
-		app:                  s.app,
-	}
-
-	s.mProfile = newProfileMenu(*newProfileMenuArgs)
-	// Seed the transition cache to match the actual default menu
-	// state (visible / enabled). Without this, the first
-	// checkAndUpdateFeatures tick that observes DisableProfiles=true
-	// is a no-op (cache zero-value == desired-false) and the menu
-	// never gets hidden — symptom: MDM enforces the kill switch but
-	// the profile menu stays clickable.
-	s.profilesEnabled = true
-
-	systray.AddSeparator()
-	s.mUp = systray.AddMenuItem("Connect", "Connect")
-	s.mDown = systray.AddMenuItem("Disconnect", "Disconnect")
-	s.mDown.Disable()
-	systray.AddSeparator()
-
-	s.mSettings = systray.AddMenuItem("Settings", disabledMenuDescr)
-	s.mAllowSSH = s.mSettings.AddSubMenuItemCheckbox("Allow SSH", allowSSHMenuDescr, false)
-	s.mAutoConnect = s.mSettings.AddSubMenuItemCheckbox("Connect on Startup", autoConnectMenuDescr, false)
-	s.mEnableRosenpass = s.mSettings.AddSubMenuItemCheckbox("Enable Quantum-Resistance", quantumResistanceMenuDescr, false)
-	s.mBlockInbound = s.mSettings.AddSubMenuItemCheckbox("Block Inbound Connections", blockInboundMenuDescr, false)
-	s.mNotifications = s.mSettings.AddSubMenuItemCheckbox("Notifications", notificationsMenuDescr, false)
-	s.mSettings.AddSeparator()
-	s.mAdvancedSettings = s.mSettings.AddSubMenuItem("Advanced Settings", advancedSettingsMenuDescr)
-	s.mCreateDebugBundle = s.mSettings.AddSubMenuItem("Create Debug Bundle", debugBundleMenuDescr)
-	s.loadSettings()
-
-	// Disable profile menu if profiles are disabled by daemon.
-	// DisableUpdateSettings is enforced at the daemon's SetConfig /
-	// Login gates, not by hiding the UI — so the Settings menu (and
-	// its Advanced Settings submenu, which has its own kill switch)
-	// stays visible and the user can still inspect current values.
-	features, err := s.getFeatures()
-	if err != nil {
-		log.Errorf("failed to get features from daemon: %v", err)
-		// Continue with default behavior if features can't be retrieved
-	} else if features != nil && features.DisableProfiles {
-		s.mProfile.setEnabled(false)
-		s.profilesEnabled = false
-	}
-
-	s.exitNodeMu.Lock()
-	s.mExitNode = systray.AddMenuItem("Exit Node", disabledMenuDescr)
-	s.mExitNode.Disable()
-	s.exitNodeMu.Unlock()
-
-	s.mNetworks = systray.AddMenuItem("Networks", networksMenuDescr)
-	s.mNetworks.Disable()
-	systray.AddSeparator()
-
-	s.mAbout = systray.AddMenuItem("About", "About")
-	s.mAbout.SetIcon(s.icAbout)
-
-	s.mGitHub = s.mAbout.AddSubMenuItem("GitHub", "GitHub")
-
-	versionString := normalizedVersion(version.NetbirdVersion())
-	s.mVersionUI = s.mAbout.AddSubMenuItem(fmt.Sprintf("GUI: %s", versionString), fmt.Sprintf("GUI Version: %s", versionString))
-	s.mVersionUI.Disable()
-
-	s.mVersionDaemon = s.mAbout.AddSubMenuItem("", "")
-	s.mVersionDaemon.Disable()
-	s.mVersionDaemon.Hide()
-
-	s.mUpdate = s.mAbout.AddSubMenuItem("Download latest version", latestVersionMenuDescr)
-	s.mUpdate.Hide()
-
-	systray.AddSeparator()
-	s.mQuit = systray.AddMenuItem("Quit", quitMenuDescr)
-
-	// update exit node menu in case service is already connected
-	go s.updateExitNodes()
-
-	// Features (DisableProfiles, DisableUpdateSettings, DisableNetworks,
-	// ...) only change in two ways: at service install time (CLI flag,
-	// static) and at MDM ticker diff time. The daemon already publishes
-	// a SystemEvent{type=config_changed} on every MDM-driven engine
-	// restart, so the UI no longer needs to poll GetFeatures every 2 s.
-	// A single fetch at startup covers the static CLI-flag case; the
-	// event handler below covers MDM transitions. updateStatus stays in
-	// the 2 s loop because connection / peer state genuinely change
-	// continuously and have no event yet.
-	s.checkAndUpdateFeatures()
-	go func() {
-		s.getSrvConfig()
-		time.Sleep(100 * time.Millisecond) // To prevent race condition caused by systray not being fully initialized and ignoring setIcon
-		for {
-			err := s.updateStatus()
-			if err != nil {
-				log.Errorf("error while updating status: %v", err)
-			}
-
-			time.Sleep(2 * time.Second)
-		}
-	}()
-
-	s.eventManager = event.NewManager(s.notifier, s.addr)
-	s.eventManager.SetNotificationsEnabled(s.mNotifications.Checked())
-	s.eventManager.AddHandler(func(event *proto.SystemEvent) {
-		if event.Category == proto.SystemEvent_SYSTEM {
-			s.updateExitNodes()
-		}
-	})
-	s.eventManager.AddHandler(func(event *proto.SystemEvent) {
-		// todo use new Category
-		if windowAction, ok := event.Metadata["progress_window"]; ok {
-			targetVersion, ok := event.Metadata["version"]
-			if !ok {
-				targetVersion = "unknown"
-			}
-			log.Debugf("window action: %v", windowAction)
-			if windowAction == "show" {
-				if s.updateContextCancel != nil {
-					s.updateContextCancel()
-					s.updateContextCancel = nil
-				}
-
-				subCtx, cancel := context.WithCancel(s.ctx)
-				go s.eventHandler.runSelfCommand(subCtx, "update", "--update-version", targetVersion)
-				s.updateContextCancel = cancel
-			}
-		}
-	})
-	s.eventManager.AddHandler(func(event *proto.SystemEvent) {
-		if newVersion, ok := event.Metadata["new_version_available"]; ok {
-			_, enforced := event.Metadata["enforced"]
-			log.Infof("received new_version_available event: version=%s enforced=%v", newVersion, enforced)
-			s.onUpdateAvailable(newVersion, enforced)
-		}
-	})
-	s.eventManager.AddHandler(func(event *proto.SystemEvent) {
-		// Daemon emits a config_changed event after every engine spawn
-		// (Server.Start, Server.Up, MDM ticker restart). Re-sync the
-		// tray submenu checkboxes from the fresh daemon-side config so
-		// the user does not have to restart the tray to see CLI- or
-		// MDM-driven changes.
-		if event.Category == proto.SystemEvent_SYSTEM && event.Metadata["type"] == "config_changed" {
-			log.Infof("config_changed event received (source=%s); refreshing settings + features", event.Metadata["source"])
-			s.loadSettings()
-			// MDM-driven feature kill switches (DisableProfiles /
-			// DisableUpdateSettings / DisableNetworks) ride the same
-			// config_changed signal because the daemon re-applies its
-			// MDM policy on every engine spawn. Pull them in here so
-			// the UI is up to date without a periodic GetFeatures poll.
-			s.checkAndUpdateFeatures()
-		}
-	})
-
-	go s.eventManager.Start(s.ctx)
-	go s.eventHandler.listen(s.ctx)
-}
-
-func (s *serviceClient) attachOutput(cmd *exec.Cmd) *os.File {
-	if s.logFile == "" {
-		// attach child's streams to parent's streams
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-
-		return nil
-	}
-
-	out, err := os.OpenFile(s.logFile, os.O_WRONLY|os.O_APPEND, 0)
-	if err != nil {
-		log.Errorf("Failed to open log file %s: %v", s.logFile, err)
-		return nil
-	}
-	cmd.Stdout = out
-	cmd.Stderr = out
-	return out
-}
-
-func normalizedVersion(version string) string {
-	versionString := version
-	if unicode.IsDigit(rune(versionString[0])) {
-		versionString = fmt.Sprintf("v%s", versionString)
-	}
-	return versionString
-}
-
-// onTrayExit is called when the tray icon is closed.
-func (s *serviceClient) onTrayExit() {
-	s.cancel()
-}
-
-// getSrvClient connection to the service.
-func (s *serviceClient) getSrvClient(timeout time.Duration) (proto.DaemonServiceClient, error) {
-	s.connLock.Lock()
-	defer s.connLock.Unlock()
-	if s.conn != nil {
-		return s.conn, nil
-	}
-
-	ctx, cancel := context.WithTimeout(s.ctx, timeout)
-	defer cancel()
-
-	conn, err := grpc.DialContext(
-		ctx,
-		strings.TrimPrefix(s.addr, "tcp://"),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithBlock(),
-		grpc.WithUserAgent(desktop.GetUIUserAgent()),
-	)
-	if err != nil {
-		return nil, fmt.Errorf("dial service: %w", err)
-	}
-
-	s.conn = proto.NewDaemonServiceClient(conn)
-	return s.conn, nil
-}
-
-// checkAndUpdateFeatures checks the current features and updates the UI accordingly
-func (s *serviceClient) checkAndUpdateFeatures() {
-	features, err := s.getFeatures()
-	if err != nil {
-		log.Errorf("failed to get features from daemon: %v", err)
-		return
-	}
-
-	s.updateIndicationLock.Lock()
-	defer s.updateIndicationLock.Unlock()
-
-	// DisableUpdateSettings is enforced server-side by the daemon gates
-	// on SetConfig + Login: any attempt to mutate config from UI or
-	// CLI is rejected at that layer. The UI deliberately keeps the
-	// Settings menu visible so the user can still inspect current
-	// values — read-only by virtue of the daemon refusing edits.
-
-	// Update profile menu based on current features
-	if s.mProfile != nil {
-		profilesEnabled := features == nil || !features.DisableProfiles
-		if s.profilesEnabled != profilesEnabled {
-			s.profilesEnabled = profilesEnabled
-			s.mProfile.setEnabled(profilesEnabled)
-		}
-	}
-
-	// Update networks and exit node menus based on current features.
-	// `networksEnabled` is the bare feature flag (read elsewhere, e.g. at
-	// connection-status transitions). `networksMenuEnabled` is the
-	// transition-cached state actually applied to the menu items —
-	// it folds in the connection state so a Connected client with the
-	// kill switch off shows the menus active, and only flips on diff.
-	s.networksEnabled = features == nil || !features.DisableNetworks
-	desiredNetworksMenu := s.networksEnabled && s.connected
-	if desiredNetworksMenu != s.networksMenuEnabled {
-		s.networksMenuEnabled = desiredNetworksMenu
-		if desiredNetworksMenu {
-			s.mNetworks.Enable()
-			s.mExitNode.Enable()
-		} else {
-			s.mNetworks.Disable()
-			s.mExitNode.Disable()
-		}
-	}
-}
-
-// getFeatures from the daemon to determine which features are enabled/disabled.
-func (s *serviceClient) getFeatures() (*proto.GetFeaturesResponse, error) {
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		return nil, fmt.Errorf("get client for features: %w", err)
-	}
-
-	features, err := conn.GetFeatures(s.ctx, &proto.GetFeaturesRequest{})
-	if err != nil {
-		return nil, fmt.Errorf("get features from daemon: %w", err)
-	}
-
-	return features, nil
-}
-
-// disableAutoConnectFromDaemon returns true when the daemon reports
-// the active profile has DisableAutoConnect=true. Used by the
-// --quick-actions startup path to suppress the on-boot popup when the
-// user (or an MDM admin) opted out of auto-connecting; both cases
-// converge on the same Config field because applyMDMPolicy writes the
-// policy value into it. Returns false on any RPC / lookup failure so a
-// daemon hiccup does not silently swallow the popup.
-func (s *serviceClient) disableAutoConnectFromDaemon() bool {
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Warnf("disableAutoConnectFromDaemon: get active profile: %v", err)
-		return false
-	}
-	currUser, err := user.Current()
-	if err != nil {
-		log.Warnf("disableAutoConnectFromDaemon: get current user: %v", err)
-		return false
-	}
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		log.Warnf("disableAutoConnectFromDaemon: get daemon client: %v", err)
-		return false
-	}
-	srvCfg, err := conn.GetConfig(s.ctx, &proto.GetConfigRequest{
-		ProfileName: activeProf.ID.String(),
-		Username:    currUser.Username,
-	})
-	if err != nil {
-		log.Warnf("disableAutoConnectFromDaemon: GetConfig RPC: %v", err)
-		return false
-	}
-	return srvCfg.GetDisableAutoConnect()
-}
-
-// getSrvConfig from the service to show it in the settings window.
-func (s *serviceClient) getSrvConfig() {
-	s.managementURL = profilemanager.DefaultManagementURL
-
-	_, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Errorf("get active profile: %v", err)
-		return
-	}
-
-	var cfg *profilemanager.Config
-
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		log.Errorf("get client: %v", err)
-		return
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		log.Errorf("get current user: %v", err)
-		return
-	}
-
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Errorf("get active profile: %v", err)
-		return
-	}
-
-	srvCfg, err := conn.GetConfig(s.ctx, &proto.GetConfigRequest{
-		ProfileName: activeProf.ID.String(),
-		Username:    currUser.Username,
-	})
-	if err != nil {
-		log.Errorf("get config settings from server: %v", err)
-		return
-	}
-
-	cfg = protoConfigToConfig(srvCfg)
-
-	if cfg.ManagementURL.String() != "" {
-		s.managementURL = cfg.ManagementURL.String()
-	}
-	s.preSharedKey = cfg.PreSharedKey
-	s.RosenpassPermissive = cfg.RosenpassPermissive
-	s.interfaceName = cfg.WgIface
-	s.interfacePort = cfg.WgPort
-	s.mtu = cfg.MTU
-
-	s.networkMonitor = *cfg.NetworkMonitor
-	s.disableDNS = cfg.DisableDNS
-	s.disableClientRoutes = cfg.DisableClientRoutes
-	s.disableServerRoutes = cfg.DisableServerRoutes
-	s.disableIPv6 = cfg.DisableIPv6
-	s.blockLANAccess = cfg.BlockLANAccess
-
-	if cfg.EnableSSHRoot != nil {
-		s.enableSSHRoot = *cfg.EnableSSHRoot
-	}
-	if cfg.EnableSSHSFTP != nil {
-		s.enableSSHSFTP = *cfg.EnableSSHSFTP
-	}
-	if cfg.EnableSSHLocalPortForwarding != nil {
-		s.enableSSHLocalPortForward = *cfg.EnableSSHLocalPortForwarding
-	}
-	if cfg.EnableSSHRemotePortForwarding != nil {
-		s.enableSSHRemotePortForward = *cfg.EnableSSHRemotePortForwarding
-	}
-	if cfg.DisableSSHAuth != nil {
-		s.disableSSHAuth = *cfg.DisableSSHAuth
-	}
-	if cfg.SSHJWTCacheTTL != nil {
-		s.sshJWTCacheTTL = *cfg.SSHJWTCacheTTL
-	}
-
-	if s.showAdvancedSettings {
-		s.iMngURL.SetText(s.managementURL)
-		// PSK is rendered with an empty Text and a hint via the
-		// placeholder so the eye toggle never reveals literal asterisks
-		// (the daemon returns the "**********" sentinel — writing that
-		// into a PasswordEntry would surface the literal sentinel when
-		// the user unmasks the field). The placeholder communicates the
-		// configured / MDM-managed state without exposing any value.
-		s.iPreSharedKey.SetText("")
-		s.iPreSharedKey.SetPlaceHolder(preSharedKeyPlaceholder(srvCfg))
-		s.iInterfaceName.SetText(cfg.WgIface)
-		s.iInterfacePort.SetText(strconv.Itoa(cfg.WgPort))
-		if cfg.MTU != 0 {
-			s.iMTU.SetText(strconv.Itoa(int(cfg.MTU)))
-		} else {
-			s.iMTU.SetText("")
-			s.iMTU.SetPlaceHolder(strconv.Itoa(int(iface.DefaultMTU)))
-		}
-		s.sRosenpassPermissive.SetChecked(cfg.RosenpassPermissive)
-		// Re-baseline the enabled state on every refresh: when Rosenpass
-		// is on the checkbox is editable, when it's off the field is
-		// inert. Without an explicit Enable() here the control stays
-		// stuck disabled after a previous refresh (or an MDM unlock) had
-		// turned it off — applyMDMLocksToSettingsForm below adds the
-		// MDM lock on top of this baseline.
-		if cfg.RosenpassEnabled {
-			s.sRosenpassPermissive.Enable()
-		} else {
-			s.sRosenpassPermissive.Disable()
-		}
-		s.sNetworkMonitor.SetChecked(*cfg.NetworkMonitor)
-		s.sDisableDNS.SetChecked(cfg.DisableDNS)
-		s.sDisableClientRoutes.SetChecked(cfg.DisableClientRoutes)
-		s.sDisableServerRoutes.SetChecked(cfg.DisableServerRoutes)
-		s.sDisableIPv6.SetChecked(cfg.DisableIPv6)
-		s.sBlockLANAccess.SetChecked(cfg.BlockLANAccess)
-		if cfg.EnableSSHRoot != nil {
-			s.sEnableSSHRoot.SetChecked(*cfg.EnableSSHRoot)
-		}
-		if cfg.EnableSSHSFTP != nil {
-			s.sEnableSSHSFTP.SetChecked(*cfg.EnableSSHSFTP)
-		}
-		if cfg.EnableSSHLocalPortForwarding != nil {
-			s.sEnableSSHLocalPortForward.SetChecked(*cfg.EnableSSHLocalPortForwarding)
-		}
-		if cfg.EnableSSHRemotePortForwarding != nil {
-			s.sEnableSSHRemotePortForward.SetChecked(*cfg.EnableSSHRemotePortForwarding)
-		}
-		if cfg.DisableSSHAuth != nil {
-			s.sDisableSSHAuth.SetChecked(*cfg.DisableSSHAuth)
-		}
-		if cfg.SSHJWTCacheTTL != nil {
-			s.iSSHJWTCacheTTL.SetText(strconv.Itoa(*cfg.SSHJWTCacheTTL))
-		}
-	}
-
-	// MDM locks must run before the mNotifications-nil early return:
-	// the Settings window is rendered by a separate UI process launched
-	// with --settings (see handleAdvancedSettingsClick), and that child
-	// process does NOT run onReady — so its mNotifications is nil and
-	// the early return below skipped the lock pass entirely.
-	s.applyMDMLocks(srvCfg.MDMManagedFields)
-
-	if s.mNotifications == nil {
-		return
-	}
-	if cfg.DisableNotifications != nil && *cfg.DisableNotifications {
-		s.mNotifications.Uncheck()
-	} else {
-		s.mNotifications.Check()
-	}
-	if s.eventManager != nil {
-		s.eventManager.SetNotificationsEnabled(s.mNotifications.Checked())
-	}
-}
-
-func protoConfigToConfig(cfg *proto.GetConfigResponse) *profilemanager.Config {
-
-	var config profilemanager.Config
-
-	if cfg.ManagementUrl != "" {
-		parsed, err := url.Parse(cfg.ManagementUrl)
-		if err != nil {
-			log.Errorf("parse management URL: %v", err)
-		} else {
-			config.ManagementURL = parsed
-		}
-	}
-
-	if cfg.PreSharedKey != "" {
-		if cfg.PreSharedKey != censoredPreSharedKey {
-			config.PreSharedKey = cfg.PreSharedKey
-		} else {
-			config.PreSharedKey = ""
-		}
-	}
-	if cfg.AdminURL != "" {
-		parsed, err := url.Parse(cfg.AdminURL)
-		if err != nil {
-			log.Errorf("parse admin URL: %v", err)
-		} else {
-			config.AdminURL = parsed
-		}
-	}
-
-	config.WgIface = cfg.InterfaceName
-	if cfg.WireguardPort >= 0 && cfg.WireguardPort <= 65535 {
-		config.WgPort = int(cfg.WireguardPort)
-	} else {
-		config.WgPort = iface.DefaultWgPort
-	}
-
-	if cfg.Mtu != 0 {
-		config.MTU = uint16(cfg.Mtu)
-	} else {
-		config.MTU = iface.DefaultMTU
-	}
-
-	config.DisableAutoConnect = cfg.DisableAutoConnect
-	config.ServerSSHAllowed = &cfg.ServerSSHAllowed
-	config.RosenpassEnabled = cfg.RosenpassEnabled
-	config.RosenpassPermissive = cfg.RosenpassPermissive
-	config.DisableNotifications = &cfg.DisableNotifications
-	config.BlockInbound = cfg.BlockInbound
-	config.NetworkMonitor = &cfg.NetworkMonitor
-	config.DisableDNS = cfg.DisableDns
-	config.DisableClientRoutes = cfg.DisableClientRoutes
-	config.DisableServerRoutes = cfg.DisableServerRoutes
-	config.DisableIPv6 = cfg.DisableIpv6
-	config.BlockLANAccess = cfg.BlockLanAccess
-
-	config.EnableSSHRoot = &cfg.EnableSSHRoot
-	config.EnableSSHSFTP = &cfg.EnableSSHSFTP
-	config.EnableSSHLocalPortForwarding = &cfg.EnableSSHLocalPortForwarding
-	config.EnableSSHRemotePortForwarding = &cfg.EnableSSHRemotePortForwarding
-	config.DisableSSHAuth = &cfg.DisableSSHAuth
-
-	ttl := int(cfg.SshJWTCacheTTL)
-	config.SSHJWTCacheTTL = &ttl
-
-	return &config
-}
-
-func (s *serviceClient) onUpdateAvailable(newVersion string, enforced bool) {
-	s.updateIndicationLock.Lock()
-	defer s.updateIndicationLock.Unlock()
-
-	s.isEnforcedUpdate = enforced
-	if enforced {
-		s.mUpdate.SetTitle("Install version " + newVersion)
-	} else {
-		s.lastNotifiedVersion = ""
-		s.mUpdate.SetTitle("Download latest version")
-	}
-
-	s.mUpdate.Show()
-	s.isUpdateIconActive = true
-
-	if s.connected {
-		systray.SetTemplateIcon(iconUpdateConnectedMacOS, s.icUpdateConnected)
-	} else {
-		systray.SetTemplateIcon(iconUpdateDisconnectedMacOS, s.icUpdateDisconnected)
-	}
-
-	if enforced && s.lastNotifiedVersion != newVersion {
-		s.lastNotifiedVersion = newVersion
-		s.notifier.Send("Update available", "A new version "+newVersion+" is ready to install")
-	}
-}
-
-// onSessionExpire sends a notification to the user when the session expires.
-func (s *serviceClient) onSessionExpire() {
-	s.sendNotification = true
-	if s.sendNotification {
-		go s.eventHandler.runSelfCommand(s.ctx, "login-url", "true")
-		s.sendNotification = false
-	}
-}
-
-// loadSettings loads the settings from the config file and updates the UI elements accordingly.
-func (s *serviceClient) loadSettings() {
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		log.Errorf("get client: %v", err)
-		return
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		log.Errorf("get current user: %v", err)
-		return
-	}
-
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Errorf("get active profile: %v", err)
-		return
-	}
-
-	cfg, err := conn.GetConfig(s.ctx, &proto.GetConfigRequest{
-		ProfileName: activeProf.ID.String(),
-		Username:    currUser.Username,
-	})
-	if err != nil {
-		log.Errorf("get config settings from server: %v", err)
-		return
-	}
-
-	if cfg.ServerSSHAllowed {
-		s.mAllowSSH.Check()
-	} else {
-		s.mAllowSSH.Uncheck()
-	}
-
-	if cfg.DisableAutoConnect {
-		s.mAutoConnect.Uncheck()
-	} else {
-		s.mAutoConnect.Check()
-	}
-
-	if cfg.RosenpassEnabled {
-		s.mEnableRosenpass.Check()
-	} else {
-		s.mEnableRosenpass.Uncheck()
-	}
-
-	if cfg.BlockInbound {
-		s.mBlockInbound.Check()
-	} else {
-		s.mBlockInbound.Uncheck()
-	}
-
-	if cfg.DisableNotifications {
-		s.mNotifications.Uncheck()
-	} else {
-		s.mNotifications.Check()
-	}
-	if s.eventManager != nil {
-		s.eventManager.SetNotificationsEnabled(s.mNotifications.Checked())
-	}
-	s.applyMDMLocks(cfg.MDMManagedFields)
-}
-
-// applyMDMLocks disables and badges any tray submenu item or settings-
-// form widget whose underlying field is enforced by the active MDM
-// policy. Called from loadSettings (submenu refresh) and from
-// getSrvConfig (settings-window refresh). Locked items keep their value
-// already set by the surrounding refresh code — this routine only
-// flips the enabled state and the title suffix, never the value.
-func (s *serviceClient) applyMDMLocks(managed []string) {
-	set := make(map[string]bool, len(managed))
-	for _, k := range managed {
-		set[k] = true
-	}
-	s.mdmManagedFields = set
-	if len(managed) > 0 {
-		log.Infof("MDM-managed UI fields: %v", managed)
-	}
-
-	type submenuTarget struct {
-		item  *systray.MenuItem
-		title string
-		key   string
-	}
-	for _, t := range []submenuTarget{
-		{s.mAllowSSH, "Allow SSH", mdm.KeyAllowServerSSH},
-		{s.mAutoConnect, "Connect on Startup", mdm.KeyDisableAutoConnect},
-		{s.mEnableRosenpass, "Enable Quantum-Resistance", mdm.KeyRosenpassEnabled},
-		{s.mBlockInbound, "Block Inbound Connections", mdm.KeyBlockInbound},
-	} {
-		if t.item == nil {
-			continue
-		}
-		if set[t.key] {
-			t.item.SetTitle(t.title + " (MDM)")
-			t.item.Disable()
-		} else {
-			t.item.SetTitle(t.title)
-			t.item.Enable()
-		}
-	}
-
-	s.applyMDMLocksToSettingsForm(set)
-}
-
-// preSharedKeyPlaceholder returns the hint string shown in the PSK
-// Entry's placeholder slot. The placeholder is the only signal the
-// user gets that a PSK is configured, because the entry's Text is
-// forced to empty to keep the password reveal toggle from leaking
-// the daemon-returned "**********" redaction sentinel. Returns "" if
-// no PSK is present, "MDM-managed" if the key is enforced by MDM,
-// and "configured" otherwise.
-func preSharedKeyPlaceholder(cfg *proto.GetConfigResponse) string {
-	if cfg == nil || cfg.PreSharedKey == "" {
-		return ""
-	}
-	for _, k := range cfg.MDMManagedFields {
-		if k == mdm.KeyPreSharedKey {
-			return "MDM-managed"
-		}
-	}
-	return "configured"
-}
-
-// applyMDMLocksToSettingsForm disables the per-field input widgets in
-// the advanced Settings window when the corresponding MDM key is set.
-// For plain-text entries (Management URL, Interface Port) the visible
-// value is suffixed with " (MDM)" so the user sees the lock indicator
-// inline; for the password entry the suffix is skipped (a password
-// widget renders every char as a dot and the indicator would not be
-// readable). The widgets are created lazily by showSettingsUI, so
-// guard each ref against nil.
-func (s *serviceClient) applyMDMLocksToSettingsForm(set map[string]bool) {
-	type entryTarget struct {
-		entry     *widget.Entry
-		key       string
-		inlineTag bool
-	}
-	for _, t := range []entryTarget{
-		{s.iMngURL, mdm.KeyManagementURL, true},
-		{s.iPreSharedKey, mdm.KeyPreSharedKey, false},
-		{s.iInterfacePort, mdm.KeyWireguardPort, true},
-	} {
-		if t.entry == nil {
-			continue
-		}
-		if set[t.key] {
-			if t.inlineTag && t.entry.Text != "" && !strings.HasSuffix(t.entry.Text, mdmFieldSuffix) {
-				t.entry.SetText(t.entry.Text + mdmFieldSuffix)
-			}
-			t.entry.Disable()
-		} else {
-			if t.inlineTag {
-				t.entry.SetText(strings.TrimSuffix(t.entry.Text, mdmFieldSuffix))
-			}
-			t.entry.Enable()
-		}
-	}
-	type checkTarget struct {
-		check *widget.Check
-		key   string
-	}
-	for _, t := range []checkTarget{
-		{s.sDisableClientRoutes, mdm.KeyDisableClientRoutes},
-		{s.sDisableServerRoutes, mdm.KeyDisableServerRoutes},
-	} {
-		if t.check == nil {
-			continue
-		}
-		if set[t.key] {
-			t.check.Disable()
-		} else {
-			t.check.Enable()
-		}
-	}
-	if s.sRosenpassPermissive != nil && set[mdm.KeyRosenpassPermissive] {
-		// MDM lock layered on top of the Rosenpass-on/off baseline
-		// applied by getSrvConfig. No Enable() branch here: when the
-		// MDM key is removed, the next getSrvConfig refresh re-baselines
-		// the control on cfg.RosenpassEnabled and brings it back if
-		// Rosenpass is on.
-		s.sRosenpassPermissive.Disable()
-	}
-}
-
-// updateConfig updates the configuration parameters
-// based on the values selected in the settings window.
-func (s *serviceClient) updateConfig() error {
-	disableAutoStart := !s.mAutoConnect.Checked()
-	sshAllowed := s.mAllowSSH.Checked()
-	rosenpassEnabled := s.mEnableRosenpass.Checked()
-	blockInbound := s.mBlockInbound.Checked()
-	notificationsDisabled := !s.mNotifications.Checked()
-
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Errorf("get active profile: %v", err)
-		return err
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		log.Errorf("get current user: %v", err)
-		return err
-	}
-
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		log.Errorf("get client: %v", err)
-		return err
-	}
-
-	req := proto.SetConfigRequest{
-		ProfileName:          activeProf.ID.String(),
-		Username:             currUser.Username,
-		DisableAutoConnect:   &disableAutoStart,
-		ServerSSHAllowed:     &sshAllowed,
-		RosenpassEnabled:     &rosenpassEnabled,
-		BlockInbound:         &blockInbound,
-		DisableNotifications: &notificationsDisabled,
-	}
-
-	if _, err := conn.SetConfig(s.ctx, &req); err != nil {
-		log.Errorf("set config settings on server: %v", err)
-		return err
-	}
-
-	return nil
-}
-
-// showLoginURL creates a borderless window styled like a pop-up in the top-right corner using s.wLoginURL.
-// It also starts a background goroutine that periodically checks if the client is already connected
-// and closes the window if so. The goroutine can be cancelled by the returned CancelFunc, and it is
-// also cancelled when the window is closed.
-func (s *serviceClient) showLoginURL() context.CancelFunc {
-
-	// create a cancellable context for the background check goroutine
-	ctx, cancel := context.WithCancel(s.ctx)
-
-	resIcon := fyne.NewStaticResource("netbird.png", iconAbout)
-
-	if s.wLoginURL == nil {
-		s.wLoginURL = s.app.NewWindow("NetBird Session Expired")
-		s.wLoginURL.Resize(fyne.NewSize(400, 200))
-		s.wLoginURL.SetIcon(resIcon)
-	}
-	// ensure goroutine is cancelled when the window is closed
-	s.wLoginURL.SetOnClosed(func() { cancel() })
-	// add a description label
-	label := widget.NewLabel("Your NetBird session has expired.\nPlease re-authenticate to continue using NetBird.")
-
-	btn := widget.NewButtonWithIcon("Re-authenticate", theme.ViewRefreshIcon(), func() {
-
-		conn, err := s.getSrvClient(defaultFailTimeout)
-		if err != nil {
-			log.Errorf("get client: %v", err)
-			return
-		}
-
-		resp, err := s.login(ctx, false)
-		if err != nil {
-			log.Errorf("failed to fetch login URL: %v", err)
-			return
-		}
-		verificationURL := resp.VerificationURIComplete
-		if verificationURL == "" {
-			verificationURL = resp.VerificationURI
-		}
-
-		if verificationURL == "" {
-			log.Error("no verification URL provided in the login response")
-			return
-		}
-
-		if err := openURL(verificationURL); err != nil {
-			log.Errorf("failed to open login URL: %v", err)
-			return
-		}
-
-		_, err = conn.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{UserCode: resp.UserCode})
-		if err != nil {
-			log.Errorf("Waiting sso login failed with: %v", err)
-			label.SetText("Waiting login failed, please create \na debug bundle in the settings and contact support.")
-			return
-		}
-
-		label.SetText("Re-authentication successful.\nReconnecting")
-		status, err := conn.Status(ctx, &proto.StatusRequest{})
-		if err != nil {
-			log.Errorf("get service status: %v", err)
-			return
-		}
-
-		if status.Status == string(internal.StatusConnected) {
-			label.SetText("Already connected.\nClosing this window.")
-			time.Sleep(2 * time.Second)
-			s.wLoginURL.Close()
-			return
-		}
-
-		_, err = conn.Up(ctx, &proto.UpRequest{})
-		if err != nil {
-			label.SetText("Reconnecting failed, please create \na debug bundle in the settings and contact support.")
-			log.Errorf("Reconnecting failed with: %v", err)
-			return
-		}
-
-		label.SetText("Connection successful.\nClosing this window.")
-		time.Sleep(time.Second)
-
-		s.wLoginURL.Close()
-	})
-
-	img := canvas.NewImageFromResource(resIcon)
-	img.FillMode = canvas.ImageFillContain
-	img.SetMinSize(fyne.NewSize(64, 64))
-	img.Resize(fyne.NewSize(64, 64))
-
-	// center the content vertically
-	content := container.NewVBox(
-		layout.NewSpacer(),
-		img,
-		label,
-		btn,
-		layout.NewSpacer(),
-	)
-	s.wLoginURL.SetContent(container.NewCenter(content))
-
-	// start a goroutine to check connection status and close the window if connected
-	go func() {
-		ticker := time.NewTicker(5 * time.Second)
-		defer ticker.Stop()
-
-		conn, err := s.getSrvClient(failFastTimeout)
-		if err != nil {
-			return
-		}
-
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-ticker.C:
-				status, err := conn.Status(s.ctx, &proto.StatusRequest{})
-				if err != nil {
-					continue
-				}
-				if status.Status == string(internal.StatusConnected) {
-					if s.wLoginURL != nil {
-						s.wLoginURL.Close()
-					}
-					return
-				}
-			}
-		}
-	}()
-
-	s.wLoginURL.Show()
-
-	// return cancel func so callers can stop the background goroutine if desired
-	return cancel
-}
-
-func openURL(url string) error {
-	if browser := os.Getenv("BROWSER"); browser != "" {
-		return exec.Command(browser, url).Start()
-	}
-
-	var err error
-	switch runtime.GOOS {
-	case "windows":
-		err = exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
-	case "darwin":
-		err = exec.Command("open", url).Start()
-	case "linux", "freebsd":
-		err = exec.Command("xdg-open", url).Start()
-	default:
-		err = fmt.Errorf("unsupported platform")
-	}
-	return err
-}
diff --git a/client/ui/const.go b/client/ui/const.go
deleted file mode 100644
index ce7a9a294..000000000
--- a/client/ui/const.go
+++ /dev/null
@@ -1,15 +0,0 @@
-package main
-
-const (
-	allowSSHMenuDescr          = "Allow SSH connections"
-	autoConnectMenuDescr       = "Connect automatically when the service starts"
-	quantumResistanceMenuDescr = "Enable post-quantum security via Rosenpass"
-	blockInboundMenuDescr      = "Block inbound connections to the local machine and routed networks"
-	notificationsMenuDescr     = "Enable notifications"
-	advancedSettingsMenuDescr  = "Advanced settings of the application"
-	debugBundleMenuDescr       = "Create and open debug information bundle"
-	disabledMenuDescr          = ""
-	networksMenuDescr          = "Open the networks management window"
-	latestVersionMenuDescr     = "Download latest version"
-	quitMenuDescr              = "Quit the client app"
-)
diff --git a/client/ui/debug.go b/client/ui/debug.go
deleted file mode 100644
index d3d4fa4f8..000000000
--- a/client/ui/debug.go
+++ /dev/null
@@ -1,730 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"path/filepath"
-	"strconv"
-	"sync"
-	"time"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/dialog"
-	"fyne.io/fyne/v2/widget"
-	log "github.com/sirupsen/logrus"
-	"github.com/skratchdot/open-golang/open"
-	"google.golang.org/protobuf/types/known/durationpb"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/proto"
-	uptypes "github.com/netbirdio/netbird/upload-server/types"
-	"github.com/netbirdio/netbird/version"
-)
-
-// Initial state for the debug collection
-type debugInitialState struct {
-	wasDown        bool
-	needsRestoreUp bool
-	logLevel       proto.LogLevel
-	isLevelTrace   bool
-}
-
-// Debug collection parameters
-type debugCollectionParams struct {
-	duration          time.Duration
-	anonymize         bool
-	systemInfo        bool
-	upload            bool
-	uploadURL         string
-	enablePersistence bool
-	capture           bool
-}
-
-// UI components for progress tracking
-type progressUI struct {
-	statusLabel *widget.Label
-	progressBar *widget.ProgressBar
-	uiControls  []fyne.Disableable
-	window      fyne.Window
-}
-
-func (s *serviceClient) showDebugUI() {
-	w := s.app.NewWindow("NetBird Debug")
-	w.SetOnClosed(s.cancel)
-	w.Resize(fyne.NewSize(600, 500))
-	w.SetFixedSize(true)
-
-	anonymizeCheck := widget.NewCheck("Anonymize sensitive information (public IPs, domains, ...)", nil)
-	systemInfoCheck := widget.NewCheck("Include system information (routes, interfaces, ...)", nil)
-	systemInfoCheck.SetChecked(true)
-	captureCheck := widget.NewCheck("Include packet capture", nil)
-	uploadCheck := widget.NewCheck("Upload bundle automatically after creation", nil)
-	uploadCheck.SetChecked(true)
-
-	uploadURLContainer, uploadURL := s.buildUploadSection(uploadCheck)
-
-	debugModeContainer, runForDurationCheck, durationInput, noteLabel := s.buildDurationSection()
-
-	statusLabel := widget.NewLabel("")
-	statusLabel.Hide()
-	progressBar := widget.NewProgressBar()
-	progressBar.Hide()
-	createButton := widget.NewButton("Create Debug Bundle", nil)
-
-	uiControls := []fyne.Disableable{
-		anonymizeCheck, systemInfoCheck, captureCheck,
-		uploadCheck, uploadURL, runForDurationCheck, durationInput, createButton,
-	}
-
-	createButton.OnTapped = s.getCreateHandler(
-		statusLabel, progressBar, uploadCheck, uploadURL,
-		anonymizeCheck, systemInfoCheck, captureCheck,
-		runForDurationCheck, durationInput, uiControls, w,
-	)
-
-	content := container.NewVBox(
-		widget.NewLabel("Create a debug bundle to help troubleshoot issues with NetBird"),
-		widget.NewLabel(""),
-		anonymizeCheck, systemInfoCheck, captureCheck,
-		uploadCheck, uploadURLContainer,
-		widget.NewLabel(""),
-		debugModeContainer, noteLabel,
-		widget.NewLabel(""),
-		statusLabel, progressBar, createButton,
-	)
-
-	w.SetContent(container.NewPadded(content))
-	w.Show()
-}
-
-func (s *serviceClient) buildUploadSection(uploadCheck *widget.Check) (*fyne.Container, *widget.Entry) {
-	uploadURL := widget.NewEntry()
-	uploadURL.SetText(uptypes.DefaultBundleURL)
-	uploadURL.SetPlaceHolder("Enter upload URL")
-
-	uploadURLContainer := container.NewVBox(widget.NewLabel("Debug upload URL:"), uploadURL)
-
-	uploadCheck.OnChanged = func(checked bool) {
-		if checked {
-			uploadURLContainer.Show()
-		} else {
-			uploadURLContainer.Hide()
-		}
-	}
-	return uploadURLContainer, uploadURL
-}
-
-func (s *serviceClient) buildDurationSection() (*fyne.Container, *widget.Check, *widget.Entry, *widget.Label) {
-	runForDurationCheck := widget.NewCheck("Run with trace logs before creating bundle", nil)
-	runForDurationCheck.SetChecked(true)
-
-	forLabel := widget.NewLabel("for")
-	durationInput := widget.NewEntry()
-	durationInput.SetText("1")
-	minutesLabel := widget.NewLabel("minute")
-	durationInput.Validator = func(s string) error {
-		return validateMinute(s, minutesLabel)
-	}
-
-	noteLabel := widget.NewLabel("Note: NetBird will be brought up and down during collection")
-
-	runForDurationCheck.OnChanged = func(checked bool) {
-		if checked {
-			forLabel.Show()
-			durationInput.Show()
-			minutesLabel.Show()
-			noteLabel.Show()
-		} else {
-			forLabel.Hide()
-			durationInput.Hide()
-			minutesLabel.Hide()
-			noteLabel.Hide()
-		}
-	}
-
-	modeContainer := container.NewHBox(runForDurationCheck, forLabel, durationInput, minutesLabel)
-	return modeContainer, runForDurationCheck, durationInput, noteLabel
-}
-
-func validateMinute(s string, minutesLabel *widget.Label) error {
-	if val, err := strconv.Atoi(s); err != nil || val < 1 {
-		return fmt.Errorf("must be a number ≥ 1")
-	}
-	if s == "1" {
-		minutesLabel.SetText("minute")
-	} else {
-		minutesLabel.SetText("minutes")
-	}
-	return nil
-}
-
-// disableUIControls disables the provided UI controls
-func disableUIControls(controls []fyne.Disableable) {
-	for _, control := range controls {
-		control.Disable()
-	}
-}
-
-// enableUIControls enables the provided UI controls
-func enableUIControls(controls []fyne.Disableable) {
-	for _, control := range controls {
-		control.Enable()
-	}
-}
-
-func (s *serviceClient) getCreateHandler(
-	statusLabel *widget.Label,
-	progressBar *widget.ProgressBar,
-	uploadCheck *widget.Check,
-	uploadURL *widget.Entry,
-	anonymizeCheck *widget.Check,
-	systemInfoCheck *widget.Check,
-	captureCheck *widget.Check,
-	runForDurationCheck *widget.Check,
-	duration *widget.Entry,
-	uiControls []fyne.Disableable,
-	w fyne.Window,
-) func() {
-	return func() {
-		disableUIControls(uiControls)
-		statusLabel.Show()
-
-		var url string
-		if uploadCheck.Checked {
-			url = uploadURL.Text
-			if url == "" {
-				statusLabel.SetText("Error: Upload URL is required when upload is enabled")
-				enableUIControls(uiControls)
-				return
-			}
-		}
-
-		params := &debugCollectionParams{
-			anonymize:         anonymizeCheck.Checked,
-			systemInfo:        systemInfoCheck.Checked,
-			capture:           captureCheck.Checked,
-			upload:            uploadCheck.Checked,
-			uploadURL:         url,
-			enablePersistence: true,
-		}
-
-		runForDuration := runForDurationCheck.Checked
-		if runForDuration {
-			minutes, err := time.ParseDuration(duration.Text + "m")
-			if err != nil {
-				statusLabel.SetText(fmt.Sprintf("Error: Invalid duration: %v", err))
-				enableUIControls(uiControls)
-				return
-			}
-			params.duration = minutes
-
-			statusLabel.SetText(fmt.Sprintf("Running in debug mode for %d minutes...", int(minutes.Minutes())))
-			progressBar.Show()
-			progressBar.SetValue(0)
-
-			go s.handleRunForDuration(
-				statusLabel,
-				progressBar,
-				uiControls,
-				w,
-				params,
-			)
-			return
-		}
-
-		statusLabel.SetText("Creating debug bundle...")
-		go s.handleDebugCreation(
-			params,
-			statusLabel,
-			uiControls,
-			w,
-		)
-	}
-}
-
-func (s *serviceClient) handleRunForDuration(
-	statusLabel *widget.Label,
-	progressBar *widget.ProgressBar,
-	uiControls []fyne.Disableable,
-	w fyne.Window,
-	params *debugCollectionParams,
-) {
-	progressUI := &progressUI{
-		statusLabel: statusLabel,
-		progressBar: progressBar,
-		uiControls:  uiControls,
-		window:      w,
-	}
-
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		handleError(progressUI, fmt.Sprintf("Failed to get client for debug: %v", err))
-		return
-	}
-
-	initialState, err := s.getInitialState(conn)
-	if err != nil {
-		handleError(progressUI, err.Error())
-		return
-	}
-
-	defer s.restoreServiceState(conn, initialState)
-
-	if err := s.collectDebugData(conn, initialState, params, progressUI); err != nil {
-		handleError(progressUI, err.Error())
-		return
-	}
-
-	if err := s.createDebugBundleFromCollection(conn, params, progressUI); err != nil {
-		handleError(progressUI, err.Error())
-		return
-	}
-
-	progressUI.statusLabel.SetText("Bundle created successfully")
-}
-
-// Get initial state of the service
-func (s *serviceClient) getInitialState(conn proto.DaemonServiceClient) (*debugInitialState, error) {
-	statusResp, err := conn.Status(s.ctx, &proto.StatusRequest{})
-	if err != nil {
-		return nil, fmt.Errorf(" get status: %v", err)
-	}
-
-	logLevelResp, err := conn.GetLogLevel(s.ctx, &proto.GetLogLevelRequest{})
-	if err != nil {
-		return nil, fmt.Errorf("get log level: %v", err)
-	}
-
-	wasDown := statusResp.Status != string(internal.StatusConnected) &&
-		statusResp.Status != string(internal.StatusConnecting)
-
-	initialLogLevel := logLevelResp.GetLevel()
-	initialLevelTrace := initialLogLevel >= proto.LogLevel_TRACE
-
-	return &debugInitialState{
-		wasDown:      wasDown,
-		logLevel:     initialLogLevel,
-		isLevelTrace: initialLevelTrace,
-	}, nil
-}
-
-// Handle progress tracking during collection
-func startProgressTracker(ctx context.Context, wg *sync.WaitGroup, duration time.Duration, progress *progressUI) {
-	progress.progressBar.Show()
-	progress.progressBar.SetValue(0)
-
-	startTime := time.Now()
-	endTime := startTime.Add(duration)
-	wg.Add(1)
-
-	go func() {
-		defer wg.Done()
-		ticker := time.NewTicker(500 * time.Millisecond)
-		defer ticker.Stop()
-
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-ticker.C:
-				remaining := time.Until(endTime)
-				if remaining <= 0 {
-					remaining = 0
-				}
-
-				elapsed := time.Since(startTime)
-				progressVal := float64(elapsed) / float64(duration)
-				if progressVal > 1.0 {
-					progressVal = 1.0
-				}
-
-				progress.progressBar.SetValue(progressVal)
-				progress.statusLabel.SetText(fmt.Sprintf("Running with trace logs... %s remaining", formatDuration(remaining)))
-			}
-		}
-	}()
-
-}
-
-func (s *serviceClient) configureServiceForDebug(
-	conn proto.DaemonServiceClient,
-	state *debugInitialState,
-	params *debugCollectionParams,
-) {
-	if state.wasDown {
-		if _, err := conn.Up(s.ctx, &proto.UpRequest{}); err != nil {
-			log.Warnf("failed to bring service up: %v", err)
-		} else {
-			log.Info("Service brought up for debug")
-			time.Sleep(time.Second * 10)
-		}
-	}
-
-	if !state.isLevelTrace {
-		if _, err := conn.SetLogLevel(s.ctx, &proto.SetLogLevelRequest{Level: proto.LogLevel_TRACE}); err != nil {
-			log.Warnf("failed to set log level to TRACE: %v", err)
-		} else {
-			log.Info("Log level set to TRACE for debug")
-		}
-	}
-
-	if _, err := conn.Down(s.ctx, &proto.DownRequest{}); err != nil {
-		log.Warnf("failed to bring service down: %v", err)
-	} else {
-		state.needsRestoreUp = !state.wasDown
-		time.Sleep(time.Second)
-	}
-
-	if params.enablePersistence {
-		if _, err := conn.SetSyncResponsePersistence(s.ctx, &proto.SetSyncResponsePersistenceRequest{
-			Enabled: true,
-		}); err != nil {
-			log.Warnf("failed to enable sync response persistence: %v", err)
-		} else {
-			log.Info("Sync response persistence enabled for debug")
-		}
-	}
-
-	if _, err := conn.Up(s.ctx, &proto.UpRequest{}); err != nil {
-		log.Warnf("failed to bring service back up: %v", err)
-	} else {
-		state.needsRestoreUp = false
-		time.Sleep(time.Second * 3)
-	}
-
-	if _, err := conn.StartCPUProfile(s.ctx, &proto.StartCPUProfileRequest{}); err != nil {
-		log.Warnf("failed to start CPU profiling: %v", err)
-	}
-
-	s.startBundleCaptureIfEnabled(conn, params)
-}
-
-func (s *serviceClient) startBundleCaptureIfEnabled(conn proto.DaemonServiceClient, params *debugCollectionParams) {
-	if !params.capture {
-		return
-	}
-
-	const maxCapture = 10 * time.Minute
-	timeout := params.duration + 30*time.Second
-	if timeout > maxCapture {
-		timeout = maxCapture
-		log.Warnf("packet capture clamped to %s (server maximum)", maxCapture)
-	}
-	if _, err := conn.StartBundleCapture(s.ctx, &proto.StartBundleCaptureRequest{
-		Timeout: durationpb.New(timeout),
-	}); err != nil {
-		log.Warnf("failed to start bundle capture: %v", err)
-	}
-}
-
-func (s *serviceClient) collectDebugData(
-	conn proto.DaemonServiceClient,
-	state *debugInitialState,
-	params *debugCollectionParams,
-	progress *progressUI,
-) error {
-	ctx, cancel := context.WithTimeout(s.ctx, params.duration)
-	defer cancel()
-	var wg sync.WaitGroup
-	startProgressTracker(ctx, &wg, params.duration, progress)
-
-	s.configureServiceForDebug(conn, state, params)
-
-	wg.Wait()
-	progress.progressBar.Hide()
-	progress.statusLabel.SetText("Collecting debug data...")
-
-	if _, err := conn.StopCPUProfile(s.ctx, &proto.StopCPUProfileRequest{}); err != nil {
-		log.Warnf("failed to stop CPU profiling: %v", err)
-	}
-
-	if params.capture {
-		stopCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		if _, err := conn.StopBundleCapture(stopCtx, &proto.StopBundleCaptureRequest{}); err != nil {
-			log.Warnf("failed to stop bundle capture: %v", err)
-		}
-	}
-
-	return nil
-}
-
-// Create the debug bundle with collected data
-func (s *serviceClient) createDebugBundleFromCollection(
-	conn proto.DaemonServiceClient,
-	params *debugCollectionParams,
-	progress *progressUI,
-) error {
-	progress.statusLabel.SetText("Creating debug bundle with collected logs...")
-
-	request := &proto.DebugBundleRequest{
-		Anonymize:  params.anonymize,
-		SystemInfo: params.systemInfo,
-		CliVersion: version.NetbirdVersion(),
-	}
-
-	if params.upload {
-		request.UploadURL = params.uploadURL
-	}
-
-	resp, err := conn.DebugBundle(s.ctx, request)
-	if err != nil {
-		return fmt.Errorf("create debug bundle: %v", err)
-	}
-
-	// Show appropriate dialog based on upload status
-	localPath := resp.GetPath()
-	uploadFailureReason := resp.GetUploadFailureReason()
-	uploadedKey := resp.GetUploadedKey()
-
-	if params.upload {
-		if uploadFailureReason != "" {
-			showUploadFailedDialog(progress.window, localPath, uploadFailureReason)
-		} else {
-			showUploadSuccessDialog(s.app, progress.window, localPath, uploadedKey)
-		}
-	} else {
-		showBundleCreatedDialog(progress.window, localPath)
-	}
-
-	enableUIControls(progress.uiControls)
-	return nil
-}
-
-// Restore service to original state
-func (s *serviceClient) restoreServiceState(conn proto.DaemonServiceClient, state *debugInitialState) {
-	if state.needsRestoreUp {
-		if _, err := conn.Up(s.ctx, &proto.UpRequest{}); err != nil {
-			log.Warnf("failed to restore up state: %v", err)
-		} else {
-			log.Info("Service state restored to up")
-		}
-	}
-
-	if state.wasDown {
-		if _, err := conn.Down(s.ctx, &proto.DownRequest{}); err != nil {
-			log.Warnf("failed to restore down state: %v", err)
-		} else {
-			log.Info("Service state restored to down")
-		}
-	}
-
-	if !state.isLevelTrace {
-		if _, err := conn.SetLogLevel(s.ctx, &proto.SetLogLevelRequest{Level: state.logLevel}); err != nil {
-			log.Warnf("failed to restore log level: %v", err)
-		} else {
-			log.Info("Log level restored to original setting")
-		}
-	}
-}
-
-// Handle errors during debug collection
-func handleError(progress *progressUI, errMsg string) {
-	log.Errorf("%s", errMsg)
-	progress.statusLabel.SetText(errMsg)
-	progress.progressBar.Hide()
-	enableUIControls(progress.uiControls)
-}
-
-func (s *serviceClient) handleDebugCreation(
-	params *debugCollectionParams,
-	statusLabel *widget.Label,
-	uiControls []fyne.Disableable,
-	w fyne.Window,
-) {
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		log.Errorf("Failed to get client for debug: %v", err)
-		statusLabel.SetText(fmt.Sprintf("Error: %v", err))
-		enableUIControls(uiControls)
-		return
-	}
-
-	if params.capture {
-		if _, err := conn.StartBundleCapture(s.ctx, &proto.StartBundleCaptureRequest{
-			Timeout: durationpb.New(30 * time.Second),
-		}); err != nil {
-			log.Warnf("failed to start bundle capture: %v", err)
-		} else {
-			defer func() {
-				stopCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-				defer cancel()
-				if _, err := conn.StopBundleCapture(stopCtx, &proto.StopBundleCaptureRequest{}); err != nil {
-					log.Warnf("failed to stop bundle capture: %v", err)
-				}
-			}()
-			time.Sleep(2 * time.Second)
-		}
-	}
-
-	resp, err := s.createDebugBundle(params.anonymize, params.systemInfo, params.uploadURL)
-	if err != nil {
-		log.Errorf("Failed to create debug bundle: %v", err)
-		statusLabel.SetText(fmt.Sprintf("Error creating bundle: %v", err))
-		enableUIControls(uiControls)
-		return
-	}
-
-	localPath := resp.GetPath()
-	uploadFailureReason := resp.GetUploadFailureReason()
-	uploadedKey := resp.GetUploadedKey()
-
-	if params.upload {
-		if uploadFailureReason != "" {
-			showUploadFailedDialog(w, localPath, uploadFailureReason)
-		} else {
-			showUploadSuccessDialog(s.app, w, localPath, uploadedKey)
-		}
-	} else {
-		showBundleCreatedDialog(w, localPath)
-	}
-
-	enableUIControls(uiControls)
-	statusLabel.SetText("Bundle created successfully")
-}
-
-func (s *serviceClient) createDebugBundle(anonymize bool, systemInfo bool, uploadURL string) (*proto.DebugBundleResponse, error) {
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		return nil, fmt.Errorf("get client: %v", err)
-	}
-
-	request := &proto.DebugBundleRequest{
-		Anonymize:  anonymize,
-		SystemInfo: systemInfo,
-		CliVersion: version.NetbirdVersion(),
-	}
-
-	if uploadURL != "" {
-		request.UploadURL = uploadURL
-	}
-
-	resp, err := conn.DebugBundle(s.ctx, request)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create debug bundle via daemon: %v", err)
-	}
-
-	return resp, nil
-}
-
-// formatDuration formats a duration in HH:MM:SS format
-func formatDuration(d time.Duration) string {
-	d = d.Round(time.Second)
-	h := d / time.Hour
-	d %= time.Hour
-	m := d / time.Minute
-	d %= time.Minute
-	s := d / time.Second
-	return fmt.Sprintf("%02d:%02d:%02d", h, m, s)
-}
-
-// createButtonWithAction creates a button with the given label and action
-func createButtonWithAction(label string, action func()) *widget.Button {
-	button := widget.NewButton(label, action)
-	return button
-}
-
-// showUploadFailedDialog displays a dialog when upload fails
-func showUploadFailedDialog(w fyne.Window, localPath, failureReason string) {
-	content := container.NewVBox(
-		widget.NewLabel(fmt.Sprintf("Bundle upload failed:\n%s\n\n"+
-			"A local copy was saved at:\n%s", failureReason, localPath)),
-	)
-
-	customDialog := dialog.NewCustom("Upload Failed", "Cancel", content, w)
-
-	buttonBox := container.NewHBox(
-		createButtonWithAction("Open file", func() {
-			log.Infof("Attempting to open local file: %s", localPath)
-			if openErr := open.Start(localPath); openErr != nil {
-				log.Errorf("Failed to open local file '%s': %v", localPath, openErr)
-				dialog.ShowError(fmt.Errorf("open the local file:\n%s\n\nError: %v", localPath, openErr), w)
-			}
-		}),
-		createButtonWithAction("Open folder", func() {
-			folderPath := filepath.Dir(localPath)
-			log.Infof("Attempting to open local folder: %s", folderPath)
-			if openErr := open.Start(folderPath); openErr != nil {
-				log.Errorf("Failed to open local folder '%s': %v", folderPath, openErr)
-				dialog.ShowError(fmt.Errorf("open the local folder:\n%s\n\nError: %v", folderPath, openErr), w)
-			}
-		}),
-	)
-
-	content.Add(buttonBox)
-	customDialog.Show()
-}
-
-// showUploadSuccessDialog displays a dialog when upload succeeds
-func showUploadSuccessDialog(a fyne.App, w fyne.Window, localPath, uploadedKey string) {
-	log.Infof("Upload key: %s", uploadedKey)
-	keyEntry := widget.NewEntry()
-	keyEntry.SetText(uploadedKey)
-	keyEntry.Disable()
-
-	content := container.NewVBox(
-		widget.NewLabel("Bundle uploaded successfully!"),
-		widget.NewLabel(""),
-		widget.NewLabel("Upload key:"),
-		keyEntry,
-		widget.NewLabel(""),
-		widget.NewLabel(fmt.Sprintf("Local copy saved at:\n%s", localPath)),
-	)
-
-	customDialog := dialog.NewCustom("Upload Successful", "OK", content, w)
-
-	copyBtn := createButtonWithAction("Copy key", func() {
-		a.Clipboard().SetContent(uploadedKey)
-		log.Info("Upload key copied to clipboard")
-	})
-
-	buttonBox := createButtonBox(localPath, w, copyBtn)
-	content.Add(buttonBox)
-	customDialog.Show()
-}
-
-// showBundleCreatedDialog displays a dialog when bundle is created without upload
-func showBundleCreatedDialog(w fyne.Window, localPath string) {
-	content := container.NewVBox(
-		widget.NewLabel(fmt.Sprintf("Bundle created locally at:\n%s\n\n"+
-			"Administrator privileges may be required to access the file.", localPath)),
-	)
-
-	customDialog := dialog.NewCustom("Debug Bundle Created", "Cancel", content, w)
-
-	buttonBox := createButtonBox(localPath, w, nil)
-	content.Add(buttonBox)
-	customDialog.Show()
-}
-
-func createButtonBox(localPath string, w fyne.Window, elems ...fyne.Widget) *fyne.Container {
-	box := container.NewHBox()
-	for _, elem := range elems {
-		box.Add(elem)
-	}
-
-	fileBtn := createButtonWithAction("Open file", func() {
-		log.Infof("Attempting to open local file: %s", localPath)
-		if openErr := open.Start(localPath); openErr != nil {
-			log.Errorf("Failed to open local file '%s': %v", localPath, openErr)
-			dialog.ShowError(fmt.Errorf("open the local file:\n%s\n\nError: %v", localPath, openErr), w)
-		}
-	})
-
-	folderBtn := createButtonWithAction("Open folder", func() {
-		folderPath := filepath.Dir(localPath)
-		log.Infof("Attempting to open local folder: %s", folderPath)
-		if openErr := open.Start(folderPath); openErr != nil {
-			log.Errorf("Failed to open local folder '%s': %v", folderPath, openErr)
-			dialog.ShowError(fmt.Errorf("open the local folder:\n%s\n\nError: %v", folderPath, openErr), w)
-		}
-	})
-
-	box.Add(fileBtn)
-	box.Add(folderBtn)
-
-	return box
-}
diff --git a/client/ui/dock_darwin.go b/client/ui/dock_darwin.go
new file mode 100644
index 000000000..dd8c60073
--- /dev/null
+++ b/client/ui/dock_darwin.go
@@ -0,0 +1,70 @@
+//go:build darwin
+
+package main
+
+/*
+#cgo CFLAGS: -x objective-c
+#cgo LDFLAGS: -framework Cocoa
+#import <Cocoa/Cocoa.h>
+
+static int lastDockState = -1;
+
+static void refreshDockPolicy(void) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+        Class cls = NSClassFromString(@"WebviewWindow");
+        if (cls == nil) {
+            return;
+        }
+        int visible = 0;
+        for (NSWindow *w in [NSApp windows]) {
+            if ([w isKindOfClass:cls] && [w isVisible]) {
+                visible = 1;
+                break;
+            }
+        }
+        if (visible == lastDockState) {
+            return;
+        }
+        lastDockState = visible;
+
+        // Set application to "Regular" and show dock icon (when visible) or to "Accessory" (when hidden)
+        if (visible) {
+            [NSApp setActivationPolicy:NSApplicationActivationPolicyRegular];
+            [NSApp activateIgnoringOtherApps:YES];
+        } else {
+            [NSApp setActivationPolicy:NSApplicationActivationPolicyAccessory];
+        }
+    });
+}
+
+static int dockObserverInstalled = 0;
+
+static void initDockObserver(void) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+        if (dockObserverInstalled) {
+            return;
+        }
+        dockObserverInstalled = 1;
+        NSNotificationCenter *nc = [NSNotificationCenter defaultCenter];
+        void (^trigger)(NSNotification *) = ^(NSNotification *_) {
+            refreshDockPolicy();
+        };
+
+        [nc addObserverForName:NSWindowDidChangeOcclusionStateNotification
+                        object:nil
+                         queue:nil
+                    usingBlock:trigger];
+        [nc addObserverForName:NSWindowWillCloseNotification
+                        object:nil
+                         queue:nil
+                    usingBlock:trigger];
+
+        refreshDockPolicy();
+    });
+}
+*/
+import "C"
+
+func initDockObserver() {
+	C.initDockObserver()
+}
diff --git a/client/ui/dock_other.go b/client/ui/dock_other.go
new file mode 100644
index 000000000..0ace89552
--- /dev/null
+++ b/client/ui/dock_other.go
@@ -0,0 +1,7 @@
+//go:build !darwin && !android && !ios && !freebsd && !js
+
+package main
+
+func initDockObserver() {
+	// macOS-only; Linux and Windows taskbar entries already gate on window visibility natively.
+}
diff --git a/client/ui/event/event.go b/client/ui/event/event.go
deleted file mode 100644
index 3b43fdc7f..000000000
--- a/client/ui/event/event.go
+++ /dev/null
@@ -1,184 +0,0 @@
-package event
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	log "github.com/sirupsen/logrus"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/client/ui/desktop"
-)
-
-// Notifier sends desktop notifications. Defined here so the event package
-// does not depend on fyne or the platform-specific notifier implementation.
-type Notifier interface {
-	Send(title, body string)
-}
-
-type Handler func(*proto.SystemEvent)
-
-type Manager struct {
-	notifier Notifier
-	addr     string
-
-	mu       sync.Mutex
-	ctx      context.Context
-	cancel   context.CancelFunc
-	enabled  bool
-	handlers []Handler
-}
-
-func NewManager(notifier Notifier, addr string) *Manager {
-	return &Manager{
-		notifier: notifier,
-		addr:     addr,
-	}
-}
-
-func (e *Manager) Start(ctx context.Context) {
-	e.mu.Lock()
-	e.ctx, e.cancel = context.WithCancel(ctx)
-	e.mu.Unlock()
-
-	expBackOff := backoff.WithContext(&backoff.ExponentialBackOff{
-		InitialInterval:     time.Second,
-		RandomizationFactor: backoff.DefaultRandomizationFactor,
-		Multiplier:          backoff.DefaultMultiplier,
-		MaxInterval:         10 * time.Second,
-		MaxElapsedTime:      0,
-		Stop:                backoff.Stop,
-		Clock:               backoff.SystemClock,
-	}, ctx)
-
-	if err := backoff.Retry(e.streamEvents, expBackOff); err != nil {
-		log.Errorf("event stream ended: %v", err)
-	}
-}
-
-func (e *Manager) streamEvents() error {
-	e.mu.Lock()
-	ctx := e.ctx
-	e.mu.Unlock()
-
-	client, err := getClient(e.addr)
-	if err != nil {
-		return fmt.Errorf("create client: %w", err)
-	}
-
-	stream, err := client.SubscribeEvents(ctx, &proto.SubscribeRequest{})
-	if err != nil {
-		return fmt.Errorf("failed to subscribe to events: %w", err)
-	}
-
-	log.Info("subscribed to daemon events")
-	defer func() {
-		log.Info("unsubscribed from daemon events")
-	}()
-
-	for {
-		event, err := stream.Recv()
-		if err != nil {
-			return fmt.Errorf("error receiving event: %w", err)
-		}
-		e.handleEvent(event)
-	}
-}
-
-func (e *Manager) Stop() {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	if e.cancel != nil {
-		e.cancel()
-	}
-}
-
-func (e *Manager) SetNotificationsEnabled(enabled bool) {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	e.enabled = enabled
-}
-
-func (e *Manager) handleEvent(event *proto.SystemEvent) {
-	e.mu.Lock()
-	enabled := e.enabled
-	handlers := slices.Clone(e.handlers)
-	e.mu.Unlock()
-
-	if event.UserMessage != "" && (enabled || event.Severity == proto.SystemEvent_CRITICAL) && !isV6DefaultRoutePartner(event) {
-		title := e.getEventTitle(event)
-		body := event.UserMessage
-		id := event.Metadata["id"]
-		if id != "" {
-			body += fmt.Sprintf(" ID: %s", id)
-		}
-		e.notifier.Send(title, body)
-	}
-
-	for _, handler := range handlers {
-		go handler(event)
-	}
-}
-
-func (e *Manager) AddHandler(handler Handler) {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	e.handlers = append(e.handlers, handler)
-}
-
-// isV6DefaultRoutePartner reports whether the event is the IPv6 half of a
-// paired v4/v6 default-route event. Management always pairs ::/0 with 0.0.0.0/0
-// for exit nodes, so the v4 partner already drives the user-facing toast and
-// the v6 one is suppressed to avoid a duplicate notification.
-func isV6DefaultRoutePartner(event *proto.SystemEvent) bool {
-	return event.Category == proto.SystemEvent_NETWORK && event.Metadata["network"] == "::/0"
-}
-
-func (e *Manager) getEventTitle(event *proto.SystemEvent) string {
-	var prefix string
-	switch event.Severity {
-	case proto.SystemEvent_CRITICAL:
-		prefix = "Critical"
-	case proto.SystemEvent_ERROR:
-		prefix = "Error"
-	case proto.SystemEvent_WARNING:
-		prefix = "Warning"
-	default:
-		prefix = "Info"
-	}
-
-	var category string
-	switch event.Category {
-	case proto.SystemEvent_DNS:
-		category = "DNS"
-	case proto.SystemEvent_NETWORK:
-		category = "Network"
-	case proto.SystemEvent_AUTHENTICATION:
-		category = "Authentication"
-	case proto.SystemEvent_CONNECTIVITY:
-		category = "Connectivity"
-	default:
-		category = "System"
-	}
-
-	return fmt.Sprintf("%s: %s", prefix, category)
-}
-
-func getClient(addr string) (proto.DaemonServiceClient, error) {
-	conn, err := grpc.NewClient(
-		strings.TrimPrefix(addr, "tcp://"),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithUserAgent(desktop.GetUIUserAgent()),
-	)
-	if err != nil {
-		return nil, err
-	}
-	return proto.NewDaemonServiceClient(conn), nil
-}
diff --git a/client/ui/event_handler.go b/client/ui/event_handler.go
deleted file mode 100644
index 902082308..000000000
--- a/client/ui/event_handler.go
+++ /dev/null
@@ -1,315 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-
-	"fyne.io/systray"
-	log "github.com/sirupsen/logrus"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/version"
-)
-
-type eventHandler struct {
-	client *serviceClient
-}
-
-func newEventHandler(client *serviceClient) *eventHandler {
-	return &eventHandler{
-		client: client,
-	}
-}
-
-func (h *eventHandler) listen(ctx context.Context) {
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-h.client.mUp.ClickedCh:
-			h.handleConnectClick()
-		case <-h.client.mDown.ClickedCh:
-			h.handleDisconnectClick()
-		case <-h.client.mAllowSSH.ClickedCh:
-			h.handleAllowSSHClick()
-		case <-h.client.mAutoConnect.ClickedCh:
-			h.handleAutoConnectClick()
-		case <-h.client.mEnableRosenpass.ClickedCh:
-			h.handleRosenpassClick()
-		case <-h.client.mBlockInbound.ClickedCh:
-			h.handleBlockInboundClick()
-		case <-h.client.mAdvancedSettings.ClickedCh:
-			h.handleAdvancedSettingsClick()
-		case <-h.client.mCreateDebugBundle.ClickedCh:
-			h.handleCreateDebugBundleClick()
-		case <-h.client.mQuit.ClickedCh:
-			h.handleQuitClick()
-			return
-		case <-h.client.mGitHub.ClickedCh:
-			h.handleGitHubClick()
-		case <-h.client.mUpdate.ClickedCh:
-			h.handleUpdateClick()
-		case <-h.client.mNetworks.ClickedCh:
-			h.handleNetworksClick()
-		case <-h.client.mNotifications.ClickedCh:
-			h.handleNotificationsClick()
-		case <-systray.TrayOpenedCh:
-			h.client.updateExitNodes()
-		}
-	}
-}
-
-func (h *eventHandler) handleConnectClick() {
-	h.client.mUp.Disable()
-
-	if h.client.connectCancel != nil {
-		h.client.connectCancel()
-	}
-
-	connectCtx, connectCancel := context.WithCancel(h.client.ctx)
-	h.client.connectCancel = connectCancel
-
-	go func() {
-		defer connectCancel()
-
-		if err := h.client.menuUpClick(connectCtx); err != nil {
-			st, ok := status.FromError(err)
-			if errors.Is(err, context.Canceled) || (ok && st.Code() == codes.Canceled) {
-				log.Debugf("connect operation cancelled by user")
-			} else {
-				h.client.notifier.Send("Error", "Failed to connect")
-				log.Errorf("connect failed: %v", err)
-			}
-		}
-
-		if err := h.client.updateStatus(); err != nil {
-			log.Debugf("failed to update status after connect: %v", err)
-		}
-	}()
-}
-
-func (h *eventHandler) handleDisconnectClick() {
-	h.client.mDown.Disable()
-	h.client.cancelExitNodeRetry()
-
-	if h.client.connectCancel != nil {
-		log.Debugf("cancelling ongoing connect operation")
-		h.client.connectCancel()
-		h.client.connectCancel = nil
-	}
-
-	go func() {
-		if err := h.client.menuDownClick(); err != nil {
-			st, ok := status.FromError(err)
-			if !errors.Is(err, context.Canceled) && !(ok && st.Code() == codes.Canceled) {
-				h.client.notifier.Send("Error", "Failed to disconnect")
-				log.Errorf("disconnect failed: %v", err)
-			} else {
-				log.Debugf("disconnect cancelled or already disconnecting")
-			}
-		}
-
-		if err := h.client.updateStatus(); err != nil {
-			log.Debugf("failed to update status after disconnect: %v", err)
-		}
-	}()
-}
-
-func (h *eventHandler) handleAllowSSHClick() {
-	h.toggleCheckbox(h.client.mAllowSSH)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mAllowSSH) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update SSH settings")
-	}
-
-}
-
-func (h *eventHandler) handleAutoConnectClick() {
-	h.toggleCheckbox(h.client.mAutoConnect)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mAutoConnect) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update auto-connect settings")
-	}
-}
-
-func (h *eventHandler) handleRosenpassClick() {
-	h.toggleCheckbox(h.client.mEnableRosenpass)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mEnableRosenpass) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update Rosenpass settings")
-	}
-}
-
-func (h *eventHandler) handleBlockInboundClick() {
-	h.toggleCheckbox(h.client.mBlockInbound)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mBlockInbound) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update block inbound settings")
-	}
-}
-
-func (h *eventHandler) handleNotificationsClick() {
-	h.toggleCheckbox(h.client.mNotifications)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mNotifications) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update notifications settings")
-	} else if h.client.eventManager != nil {
-		h.client.eventManager.SetNotificationsEnabled(h.client.mNotifications.Checked())
-	}
-
-}
-
-func (h *eventHandler) handleAdvancedSettingsClick() {
-	h.client.mAdvancedSettings.Disable()
-	go func() {
-		defer h.client.mAdvancedSettings.Enable()
-		defer h.client.getSrvConfig()
-		h.runSelfCommand(h.client.ctx, "settings")
-	}()
-}
-
-func (h *eventHandler) handleCreateDebugBundleClick() {
-	h.client.mCreateDebugBundle.Disable()
-	go func() {
-		defer h.client.mCreateDebugBundle.Enable()
-		h.runSelfCommand(h.client.ctx, "debug")
-	}()
-}
-
-func (h *eventHandler) handleQuitClick() {
-	systray.Quit()
-}
-
-func (h *eventHandler) handleGitHubClick() {
-	if err := openURL("https://github.com/netbirdio/netbird"); err != nil {
-		log.Errorf("failed to open GitHub URL: %v", err)
-	}
-}
-
-func (h *eventHandler) handleUpdateClick() {
-	h.client.updateIndicationLock.Lock()
-	enforced := h.client.isEnforcedUpdate
-	h.client.updateIndicationLock.Unlock()
-
-	if !enforced {
-		if err := openURL(version.DownloadUrl()); err != nil {
-			log.Errorf("failed to open download URL: %v", err)
-		}
-		return
-	}
-
-	// prevent blocking against a busy server
-	h.client.mUpdate.Disable()
-	go func() {
-		defer h.client.mUpdate.Enable()
-		conn, err := h.client.getSrvClient(defaultFailTimeout)
-		if err != nil {
-			log.Errorf("failed to get service client for update: %v", err)
-			_ = openURL(version.DownloadUrl())
-			return
-		}
-
-		resp, err := conn.TriggerUpdate(h.client.ctx, &proto.TriggerUpdateRequest{})
-		if err != nil {
-			log.Errorf("TriggerUpdate failed: %v", err)
-			_ = openURL(version.DownloadUrl())
-			return
-		}
-		if !resp.Success {
-			log.Errorf("TriggerUpdate failed: %s", resp.ErrorMsg)
-			_ = openURL(version.DownloadUrl())
-			return
-		}
-
-		log.Infof("update triggered via daemon")
-	}()
-}
-
-func (h *eventHandler) handleNetworksClick() {
-	h.client.mNetworks.Disable()
-	go func() {
-		defer h.client.mNetworks.Enable()
-		h.runSelfCommand(h.client.ctx, "networks")
-	}()
-}
-
-func (h *eventHandler) toggleCheckbox(item *systray.MenuItem) {
-	if item.Checked() {
-		item.Uncheck()
-	} else {
-		item.Check()
-	}
-}
-
-func (h *eventHandler) updateConfigWithErr() error {
-	if err := h.client.updateConfig(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (h *eventHandler) runSelfCommand(ctx context.Context, command string, args ...string) {
-	proc, err := os.Executable()
-	if err != nil {
-		log.Errorf("error getting executable path: %v", err)
-		return
-	}
-
-	// Build the full command arguments
-	cmdArgs := []string{
-		fmt.Sprintf("--%s=true", command),
-		fmt.Sprintf("--daemon-addr=%s", h.client.addr),
-	}
-	cmdArgs = append(cmdArgs, args...)
-
-	cmd := exec.CommandContext(ctx, proc, cmdArgs...)
-
-	if out := h.client.attachOutput(cmd); out != nil {
-		defer func() {
-			if err := out.Close(); err != nil {
-				log.Errorf("error closing log file %s: %v", h.client.logFile, err)
-			}
-		}()
-	}
-
-	log.Printf("running command: %s", cmd.String())
-
-	if err := cmd.Run(); err != nil {
-		var exitErr *exec.ExitError
-		if errors.As(err, &exitErr) {
-			log.Printf("command '%s' failed with exit code %d", cmd.String(), exitErr.ExitCode())
-		}
-		return
-	}
-
-	log.Printf("command '%s' completed successfully", cmd.String())
-}
-
-func (h *eventHandler) logout(ctx context.Context) error {
-	client, err := h.client.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf("failed to get service client: %w", err)
-	}
-
-	_, err = client.Logout(ctx, &proto.LogoutRequest{})
-	if err != nil {
-		return fmt.Errorf("logout failed: %w", err)
-	}
-
-	h.client.getSrvConfig()
-
-	return nil
-}
diff --git a/client/ui/font_bsd.go b/client/ui/font_bsd.go
deleted file mode 100644
index 139f38f40..000000000
--- a/client/ui/font_bsd.go
+++ /dev/null
@@ -1,30 +0,0 @@
-//go:build freebsd || openbsd || netbsd || dragonfly
-
-package main
-
-import (
-	"os"
-	"runtime"
-
-	log "github.com/sirupsen/logrus"
-)
-
-func (s *serviceClient) setDefaultFonts() {
-	paths := []string{
-		"/usr/local/share/fonts/TTF/DejaVuSans.ttf",
-		"/usr/local/share/fonts/dejavu/DejaVuSans.ttf",
-		"/usr/local/share/noto/NotoSans-Regular.ttf",
-		"/usr/local/share/fonts/noto/NotoSans-Regular.ttf",
-		"/usr/local/share/fonts/liberation-fonts-ttf/LiberationSans-Regular.ttf",
-	}
-
-	for _, fontPath := range paths {
-		if _, err := os.Stat(fontPath); err == nil {
-			os.Setenv("FYNE_FONT", fontPath)
-			log.Debugf("Using font: %s", fontPath)
-			return
-		}
-	}
-
-	log.Errorf("Failed to find any suitable font files for %s", runtime.GOOS)
-}
diff --git a/client/ui/font_darwin.go b/client/ui/font_darwin.go
deleted file mode 100644
index cafb72f59..000000000
--- a/client/ui/font_darwin.go
+++ /dev/null
@@ -1,18 +0,0 @@
-package main
-
-import (
-	"os"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const defaultFontPath = "/Library/Fonts/Arial Unicode.ttf"
-
-func (s *serviceClient) setDefaultFonts() {
-	if _, err := os.Stat(defaultFontPath); err != nil {
-		log.Errorf("Failed to find default font file: %v", err)
-		return
-	}
-
-	os.Setenv("FYNE_FONT", defaultFontPath)
-}
diff --git a/client/ui/font_linux.go b/client/ui/font_linux.go
deleted file mode 100644
index 4aa92494a..000000000
--- a/client/ui/font_linux.go
+++ /dev/null
@@ -1,7 +0,0 @@
-//go:build !386
-
-package main
-
-func (s *serviceClient) setDefaultFonts() {
-	//TODO: Linux Multiple Language Support
-}
diff --git a/client/ui/font_windows.go b/client/ui/font_windows.go
deleted file mode 100644
index 6346a9fb9..000000000
--- a/client/ui/font_windows.go
+++ /dev/null
@@ -1,90 +0,0 @@
-package main
-
-import (
-	"os"
-	"path"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-func (s *serviceClient) setDefaultFonts() {
-	defaultFontPath := s.getWindowsFontFilePath()
-
-	if _, err := os.Stat(defaultFontPath); err != nil {
-		log.Errorf("Failed to find default font file: %v", err)
-		return
-	}
-
-	os.Setenv("FYNE_FONT", defaultFontPath)
-}
-
-func (s *serviceClient) getWindowsFontFilePath() string {
-	var (
-		fontFolder  = "C:/Windows/Fonts"
-		fontMapping = map[string]string{
-			"default":     "Segoeui.ttf",
-			"zh-CN":       "Segoeui.ttf",
-			"am-ET":       "Ebrima.ttf",
-			"nirmala":     "Nirmala.ttf",
-			"chr-CHER-US": "Gadugi.ttf",
-			"zh-HK":       "Segoeui.ttf",
-			"zh-TW":       "Segoeui.ttf",
-			"km-KH":       "Leelawui.ttf",
-			"ko-KR":       "Malgun.ttf",
-			"th-TH":       "Leelawui.ttf",
-			"ti-ET":       "Ebrima.ttf",
-		}
-		nirMalaLang = []string{
-			"as-IN",
-			"bn-BD",
-			"bn-IN",
-			"gu-IN",
-			"hi-IN",
-			"kn-IN",
-			"kok-IN",
-			"ml-IN",
-			"mr-IN",
-			"ne-NP",
-			"or-IN",
-			"pa-IN",
-			"si-LK",
-			"ta-IN",
-			"te-IN",
-		}
-	)
-
-	// getUserDefaultLocaleName.Call() panics if the func is not found
-	defer func() {
-		if r := recover(); r != nil {
-			log.Errorf("Recovered from panic: %v", r)
-		}
-	}()
-
-	kernel32 := windows.NewLazySystemDLL("kernel32.dll")
-	getUserDefaultLocaleName := kernel32.NewProc("GetUserDefaultLocaleName")
-
-	buf := make([]uint16, 85) // LOCALE_NAME_MAX_LENGTH is usually 85
-	r, _, err := getUserDefaultLocaleName.Call(uintptr(unsafe.Pointer(&buf[0])), uintptr(len(buf)))
-	// returns 0 on failure, err is always non-nil
-	// https://learn.microsoft.com/en-us/windows/win32/api/winnls/nf-winnls-getuserdefaultlocalename
-	if r == 0 {
-		log.Errorf("GetUserDefaultLocaleName call failed: %v", err)
-		return path.Join(fontFolder, fontMapping["default"])
-	}
-
-	defaultLanguage := windows.UTF16ToString(buf)
-
-	for _, lang := range nirMalaLang {
-		if defaultLanguage == lang {
-			return path.Join(fontFolder, fontMapping["nirmala"])
-		}
-	}
-
-	if font, ok := fontMapping[defaultLanguage]; ok {
-		return path.Join(fontFolder, font)
-	}
-
-	return path.Join(fontFolder, fontMapping["default"])
-}
diff --git a/client/ui/frontend/.prettierignore b/client/ui/frontend/.prettierignore
new file mode 100644
index 000000000..c78cb7cc3
--- /dev/null
+++ b/client/ui/frontend/.prettierignore
@@ -0,0 +1,7 @@
+dist
+build
+node_modules
+pnpm-lock.yaml
+wailsjs
+*.min.js
+*.min.css
diff --git a/client/ui/frontend/.prettierrc b/client/ui/frontend/.prettierrc
new file mode 100644
index 000000000..e47a94f56
--- /dev/null
+++ b/client/ui/frontend/.prettierrc
@@ -0,0 +1,12 @@
+{
+    "tabWidth": 4,
+    "useTabs": false,
+    "semi": true,
+    "singleQuote": false,
+    "trailingComma": "all",
+    "printWidth": 100,
+    "arrowParens": "always",
+    "endOfLine": "lf",
+    "plugins": ["prettier-plugin-tailwindcss"],
+    "tailwindFunctions": ["cn", "clsx", "cva", "tw"]
+}
diff --git a/client/ui/frontend/WAILS-API.md b/client/ui/frontend/WAILS-API.md
new file mode 100644
index 000000000..6cc1dd79c
--- /dev/null
+++ b/client/ui/frontend/WAILS-API.md
@@ -0,0 +1,281 @@
+# Wails Go API reference (frontend)
+
+Reference for every binding method and model shape exposed to the frontend. Generated from `client/ui/services/*.go` via `wails3 generate bindings -clean=true -ts` — regenerate after any Go-side change. Authoritative source is always `bindings/github.com/netbirdio/netbird/client/ui/services/*.ts`.
+
+Every method returns `$CancellablePromise<T>` (a Wails3 wrapper around `Promise`). Call `.cancel()` to abort the underlying gRPC call; in practice we just `await` and let it run.
+
+## Imports
+
+```ts
+// Services
+import {
+  Connection, Peers, ProfileSwitcher, Profiles,
+  Settings, Networks, Debug, Update, WindowManager,
+  I18n, Preferences,
+} from "@bindings/services";
+
+// Models (types-only)
+import type {
+  Status, PeerStatus, PeerLink, LocalPeer, SystemEvent,
+  Profile, ProfileRef, ActiveProfile,
+  Config, ConfigParams, SetConfigParams, Features,
+  Network, SelectNetworksParams,
+  LoginParams, LoginResult, LogoutParams, WaitSSOParams, UpParams,
+  DebugBundleParams, DebugBundleResult, LogLevel,
+  UpdateResult, UpdateAvailable, UpdateProgress,
+} from "@bindings/services/models.js";
+
+// i18n / preferences models live in sibling packages, not services/models
+import { LanguageCode, type Language } from "@bindings/i18n/models.js";
+import type { UIPreferences } from "@bindings/preferences/models.js";
+```
+
+## Push events
+
+Subscribe with `Events.On(name, handler)` from `@wailsio/runtime`. Handlers receive `{ data: <payload> }`.
+
+| Event | Payload | Fires on |
+|---|---|---|
+| `netbird:status` | `Status` | Daemon SubscribeStatus snapshot — connection-state change, peer-list change, address change, mgmt/signal flip. Synthetic `StatusDaemonUnavailable` is emitted when the gRPC socket is unreachable, and a synthetic `Connecting` is emitted at the start of an active profile switch. |
+| `netbird:event` | `SystemEvent` | One push per daemon SubscribeEvents item (DNS / network / authentication / connectivity / system). Used by the tray for OS toasts; the TS side reads events through `Status.events` instead. |
+| `netbird:update:available` | `UpdateAvailable` | Daemon detected a new version (fan-out of the `new_version_available` metadata key). |
+| `netbird:preferences:changed` | `{ language: string }` | Fires after every successful `Preferences.SetLanguage` (including the caller's own window). `src/lib/i18n.ts` subscribes and calls `i18next.changeLanguage`. |
+| `netbird:update:progress` | `UpdateProgress` | Daemon enforced-update install progress (`action: "show"` etc.). |
+| `browser-login:cancel` | (none) | Either the user closed the `BrowserLogin` window (Go-emitted) or the page's Cancel button (frontend-emitted). |
+| `trigger-login` | (none) | Reserved by the tray for asking the frontend to start an SSO flow. `layouts/ConnectionStatusSwitch.tsx` subscribes and runs `startLogin()`; no Go-side emitter today. |
+
+The two stream loops behind `netbird:status` and `netbird:event` start automatically — `main.go` calls `peers.Watch(context.Background())` at boot. `Peers.Watch` is still exported but the frontend doesn't need to invoke it.
+
+## `Connection`
+
+```ts
+Connection.Login(p: LoginParams): Promise<LoginResult>
+Connection.WaitSSOLogin(p: WaitSSOParams): Promise<string>   // returns email
+Connection.Up(p: UpParams): Promise<void>                    // async on the daemon
+Connection.Down(): Promise<void>
+Connection.Logout(p: LogoutParams): Promise<void>
+Connection.OpenURL(url: string): Promise<void>               // honors $BROWSER
+```
+
+`Login` Down-resets the daemon first to dislodge a stale `WaitSSOLogin` (so a previously abandoned SSO flow doesn't fail the next attempt). `Up` always uses async mode — status flows back through `netbird:status`. **Do not call `Up` on an `Idle` / `NeedsLogin` daemon** — the daemon's internal 50s `waitForUp` will block and return `DeadlineExceeded`.
+
+Full SSO sequence: `Login` → if `result.needsSsoLogin`, open `result.verificationUriComplete` via `OpenURL` + `WindowManager.OpenBrowserLogin(uri)` → `WaitSSOLogin({ userCode })` → `Up({})`. The canonical implementation is `startLogin()` in `layouts/ConnectionStatusSwitch.tsx`.
+
+## `Peers`
+
+```ts
+Peers.Get(): Promise<Status>            // one-shot snapshot
+Peers.Watch(): Promise<void>            // already invoked from main.go
+Peers.BeginProfileSwitch(): Promise<void>
+Peers.CancelProfileSwitch(): Promise<void>
+```
+
+`BeginProfileSwitch` and `CancelProfileSwitch` are normally driven by `ProfileSwitcher` / the tray, not the frontend.
+
+## `ProfileSwitcher`
+
+```ts
+ProfileSwitcher.SwitchActive(p: ProfileRef): Promise<void>
+```
+
+The single entry point both tray and frontend should use for profile flips. Applies the reconnect policy below, mirrors the switch into the user-side `profilemanager` (so the CLI's `netbird up` reads a consistent active profile), and drives the optimistic-Connecting paint via `Peers.BeginProfileSwitch`.
+
+Reconnect policy (driven by `prevStatus` captured at entry):
+
+| Previous status | Action | Optimistic UI | Suppressed events until new flow |
+|---|---|---|---|
+| Connected | Switch + Down + Up | Connecting (synthetic) | Connected, Idle |
+| Connecting | Switch + Down + Up | Connecting (unchanged) | Connected, Idle |
+| NeedsLogin / LoginFailed / SessionExpired | Switch + Down | (no change) | — |
+| Idle | Switch only | (no change) | — |
+
+## `Profiles`
+
+```ts
+Profiles.Username(): Promise<string>            // current OS username
+Profiles.List(username: string): Promise<Profile[]>
+Profiles.GetActive(): Promise<ActiveProfile>
+Profiles.Switch(p: ProfileRef): Promise<void>   // raw daemon RPC; prefer ProfileSwitcher.SwitchActive
+Profiles.Add(p: ProfileRef): Promise<void>
+Profiles.Remove(p: ProfileRef): Promise<void>
+```
+
+`Profile.email` is populated by the **UI process** reading the per-profile state file (`~/Library/Application Support/netbird/<name>.state.json` on macOS), not by the daemon — the daemon runs as root and can't read user-owned files.
+
+## `Settings`
+
+```ts
+Settings.GetConfig(p: ConfigParams): Promise<Config>
+Settings.SetConfig(p: SetConfigParams): Promise<void>     // partial update
+Settings.GetFeatures(): Promise<Features>                 // operator-disabled UI sections
+```
+
+`SetConfig` is a partial update: only fields you set are pushed to the daemon. `profileName` + `username` are always required; the typed fields in `SetConfigParams` are optional (`field?: T | null`). `managementUrl` and `adminUrl` are always-string for historical reasons.
+
+**PSK mask quirk:** `GetConfig` returns existing pre-shared keys as `"**********"`. If you send the mask back, `wgtypes.ParseKey` fails on the next connect. `SettingsContext.save` drops the field when it equals `"**********"`. See `modules/settings/SettingsContext.tsx`.
+
+`SetConfigParams` carries one field that `Config` does not: `disableFirewall`. There's no current GET path for it.
+
+## `Networks`
+
+```ts
+Networks.List(): Promise<Network[]>
+Networks.Select(p: SelectNetworksParams): Promise<void>
+Networks.Deselect(p: SelectNetworksParams): Promise<void>
+```
+
+`SelectNetworksParams.append=true` merges into the existing selection; `false` replaces. `all=true` ignores `networkIds` and targets every network (Select-All / Deselect-All).
+
+Exit-node filter: `range === "0.0.0.0/0" || range === "::/0"`. Domain network: `domains.length > 0`. CIDR overlap check is client-side.
+
+## `Debug`
+
+```ts
+Debug.GetLogLevel(): Promise<LogLevel>
+Debug.SetLogLevel(lvl: LogLevel): Promise<void>
+Debug.Bundle(p: DebugBundleParams): Promise<DebugBundleResult>
+Debug.RevealFile(path: string): Promise<void>          // OS file-manager focus
+```
+
+**Log level case sensitivity bug:** `proto.LogLevel_value` is keyed on uppercase enum names (`"TRACE"`, `"DEBUG"`, `"INFO"`, `"WARN"`, `"ERROR"`, `"PANIC"`, `"FATAL"`, `"UNKNOWN"`). `Debug.SetLogLevel` calls `proto.LogLevel_value[lvl.Level]` and falls back to `INFO` on miss. `useDebugBundle` currently passes `"trace"` (lowercase), which silently maps to `INFO` — the trace-capture flow doesn't actually raise the log level today. To raise to trace, pass `{ level: "TRACE" }`. Fix on the cleanup list.
+
+`Debug.Bundle` uploads when `uploadUrl != ""`. Result fields: `path` (local copy), `uploadedKey` (set on success), `uploadFailureReason` (set on upload failure — the local copy is still saved).
+
+## `Update`
+
+```ts
+Update.Trigger(): Promise<UpdateResult>             // start the install
+Update.GetInstallerResult(): Promise<UpdateResult>  // poll the outcome (long-running)
+Update.Quit(): Promise<void>                        // 100ms later, app.Quit()
+```
+
+Typical enforced-update flow on the `/update` route: call `Trigger` once, then poll `GetInstallerResult` every 2s with a 15-minute total timeout. On `success: true` call `Quit`. On `success: false` show `errorMsg`. If the gRPC poll itself starts failing for `DAEMON_DOWN_GRACE_MS` (5s), treat that as success and quit too — the installer commonly takes the daemon offline mid-upgrade. See `pages/Update.tsx` for the canonical implementation.
+
+## `WindowManager`
+
+```ts
+WindowManager.OpenSettings(): Promise<void>
+WindowManager.OpenBrowserLogin(uri: string): Promise<void>   // uri appended as ?uri=…
+WindowManager.CloseBrowserLogin(): Promise<void>
+WindowManager.OpenError(title: string, message: string): Promise<void>  // custom branded error window; both query-escaped as ?title=…&message=…
+WindowManager.CloseError(): Promise<void>
+```
+
+Prefer `errorDialog({Title, Message})` from `lib/dialogs.ts` over calling `OpenError` directly — it's the app's single error surface (the old native MessageBox wrapper now routes here). Both strings must be pre-localised.
+
+Both auxiliary windows are created on first open and destroyed on close (mutex-guarded singleton). The BrowserLogin window's red-X close fires the `browser-login:cancel` event so `startLogin()` can tear down the pending daemon `WaitSSOLogin`.
+
+## `I18n`
+
+```ts
+I18n.Languages(): Promise<Language[]>                       // from _index.json
+I18n.Bundle(code: LanguageCode): Promise<Record<string,string>>  // full key→text map
+```
+
+Source of truth is `client/ui/i18n/locales/` (shared with the Go tray). The frontend's i18next bootstrap doesn't need `I18n.Bundle` at runtime (bundles are statically imported by Vite via the glob in `src/lib/i18n.ts`), but the language picker reads `I18n.Languages()` so the list matches `_index.json` without duplicating it in TS.
+
+## `Preferences`
+
+```ts
+Preferences.Get(): Promise<UIPreferences>                   // { language: string }
+Preferences.SetLanguage(code: LanguageCode): Promise<void>  // rejects on unknown code
+```
+
+`SetLanguage` validates against the loaded `i18n.Bundle`, persists to `os.UserConfigDir()/netbird/ui-preferences.json`, and emits `netbird:preferences:changed`. The frontend's `src/lib/i18n.ts` listens to that event and calls `i18next.changeLanguage` so a flip in any window paints in all of them. Missing preferences file → defaults to `en`, written on first read.
+
+## Daemon `Status.status` values
+
+Mirror `internal.Status*` in `client/internal/state.go` plus the synthetic UI label:
+
+| Value | Meaning |
+|---|---|
+| `"Idle"` | Tunnel down (Up never invoked or Down completed) |
+| `"Connecting"` | Up in progress |
+| `"Connected"` | Tunnel up |
+| `"NeedsLogin"` | Fresh install or token cleared; needs Login → SSO → Up |
+| `"LoginFailed"` | Previous Login attempt errored |
+| `"SessionExpired"` | SSO token expired; needs re-Login |
+| `"DaemonUnavailable"` | **Synthetic** — UI side, emitted when the daemon gRPC socket is unreachable. Not a real daemon enum. |
+
+The tray also reads a tray-only synthetic `"Error"` for icon purposes; the frontend doesn't see that.
+
+## Model field reference
+
+`Status`:
+```ts
+{ status, daemonVersion: string;
+  management: PeerLink; signal: PeerLink;
+  local: LocalPeer;
+  peers: PeerStatus[];
+  events: SystemEvent[]; }
+```
+
+`PeerLink`: `{ url: string; connected: boolean; error?: string }`.
+
+`LocalPeer`: `{ ip, pubKey, fqdn: string; networks: string[] }`.
+
+`PeerStatus`:
+```ts
+{ ip, pubKey, fqdn, connStatus: string;
+  connStatusUpdateUnix: number;
+  relayed: boolean;
+  localIceCandidateType, remoteIceCandidateType: string;     // pion: "host"|"srflx"|"prflx"|"relay"|""
+  localIceCandidateEndpoint, remoteIceCandidateEndpoint: string;
+  bytesRx, bytesTx, latencyMs, lastHandshakeUnix: number;
+  relayAddress: string;                                       // set when relayed=true
+  rosenpassEnabled: boolean;
+  networks: string[]; }
+```
+
+`SystemEvent`:
+```ts
+{ id: string;
+  severity: string;       // "info"|"warning"|"error"|"critical" (lowercased proto enum, "SystemEvent_" prefix stripped)
+  category: string;       // "network"|"dns"|"authentication"|"connectivity"|"system" (same casing rules)
+  message: string;        // technical / log line
+  userMessage: string;    // human-friendly — render this
+  timestamp: number;      // unix seconds
+  metadata: Record<string, string>; }   // keys: "new_version_available", "enforced", "id", "network", "version", "progress_window", …
+```
+
+`Profile`: `{ name: string; isActive: boolean; email: string }`.
+
+`Config` (read-only mirror, all required):
+```ts
+{ managementUrl, adminUrl, configFile, logFile, preSharedKey, interfaceName: string;
+  wireguardPort, mtu, sshJwtCacheTtl: number;
+  disableAutoConnect, serverSshAllowed,
+  rosenpassEnabled, rosenpassPermissive,
+  disableNotifications, lazyConnectionEnabled, blockInbound,
+  networkMonitor, disableClientRoutes, disableServerRoutes,
+  disableDns, disableIpv6, blockLanAccess,
+  enableSshRoot, enableSshSftp,
+  enableSshLocalPortForwarding, enableSshRemotePortForwarding,
+  disableSshAuth: boolean; }
+```
+
+`SetConfigParams` has all `Config` fields as `field?: T | null` (partial update), plus the write-only `disableFirewall?: boolean | null`, plus `profileName` / `username` / `managementUrl` / `adminUrl` as required strings.
+
+`Features`: `{ disableProfiles, disableUpdateSettings, disableNetworks: boolean }`.
+
+`Network`: `{ id, range: string; selected: boolean; domains: string[]; resolvedIps: Record<string, string[]> }`.
+
+`LoginParams`: `{ profileName, username, managementUrl, setupKey, preSharedKey, hostname, hint: string }`.
+
+`LoginResult`: `{ needsSsoLogin: boolean; userCode, verificationUri, verificationUriComplete: string }`.
+
+`WaitSSOParams`: `{ userCode, hostname: string }`. Resolves to the user's email.
+
+`UpParams` / `LogoutParams` / `ProfileRef` / `ConfigParams` / `ActiveProfile`: all `{ profileName, username: string }` (different names but same shape — kept distinct by Wails for clarity).
+
+`DebugBundleParams`: `{ anonymize, systemInfo: boolean; uploadUrl: string; logFileCount: number }`.
+
+`DebugBundleResult`: `{ path, uploadedKey, uploadFailureReason: string }`.
+
+`LogLevel`: `{ level: string }` — **uppercase** proto enum name (`"TRACE"`, `"DEBUG"`, `"INFO"`, `"WARN"`, `"ERROR"`, `"PANIC"`, `"FATAL"`).
+
+`UpdateResult`: `{ success: boolean; errorMsg: string }`.
+
+`UpdateAvailable`: `{ version: string; enforced: boolean }`.
+
+`UpdateProgress`: `{ action: string; version: string }`.
diff --git a/client/ui/frontend/eslint.config.js b/client/ui/frontend/eslint.config.js
new file mode 100644
index 000000000..f00623b68
--- /dev/null
+++ b/client/ui/frontend/eslint.config.js
@@ -0,0 +1,75 @@
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+import react from "eslint-plugin-react";
+import reactHooks from "eslint-plugin-react-hooks";
+import reactRefresh from "eslint-plugin-react-refresh";
+import jsxA11y from "eslint-plugin-jsx-a11y";
+import globals from "globals";
+
+export default tseslint.config(
+    {
+        ignores: ["dist/**", "node_modules/**", "bindings/**", "sonar/**"],
+    },
+    js.configs.recommended,
+    ...tseslint.configs.recommended,
+    {
+        files: ["src/**/*.{ts,tsx}"],
+        plugins: {
+            react,
+            "react-hooks": reactHooks,
+            "react-refresh": reactRefresh,
+            "jsx-a11y": jsxA11y,
+        },
+        languageOptions: {
+            ecmaVersion: 2022,
+            sourceType: "module",
+            globals: { ...globals.browser },
+            parserOptions: {
+                ecmaFeatures: { jsx: true },
+            },
+        },
+        settings: {
+            react: { version: "detect" },
+        },
+        rules: {
+            // ----- a11y / semantic HTML (jsx-a11y recommended) -----
+            ...jsxA11y.configs.recommended.rules,
+            "jsx-a11y/no-autofocus": ["warn", { ignoreNonDOM: true }],
+
+            // ----- React -----
+            ...react.configs.recommended.rules,
+            ...react.configs["jsx-runtime"].rules,
+            "react/prop-types": "off",
+            "react/jsx-no-target-blank": ["error", { allowReferrer: true }],
+            "react/self-closing-comp": "warn",
+
+            // ----- React hooks -----
+            "react-hooks/rules-of-hooks": "error",
+            "react-hooks/exhaustive-deps": "warn",
+
+            // ----- Vite / HMR (Fast Refresh) -----
+            "react-refresh/only-export-components": "off",
+
+            // ----- TypeScript -----
+            "@typescript-eslint/no-unused-vars": [
+                "warn",
+                {
+                    argsIgnorePattern: "^_",
+                    varsIgnorePattern: "^_",
+                    caughtErrorsIgnorePattern: "^_",
+                },
+            ],
+            "@typescript-eslint/consistent-type-imports": [
+                "warn",
+                { prefer: "type-imports", fixStyle: "inline-type-imports" },
+            ],
+            "@typescript-eslint/no-explicit-any": "warn",
+
+            // ----- General correctness -----
+            eqeqeq: ["error", "smart"],
+            "no-console": ["warn", { allow: ["warn", "error", "info"] }],
+            "no-debugger": "error",
+            "prefer-const": "warn",
+        },
+    },
+);
diff --git a/client/ui/frontend/index.html b/client/ui/frontend/index.html
new file mode 100644
index 000000000..f4c8b3d68
--- /dev/null
+++ b/client/ui/frontend/index.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html lang="en" class="dark">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>NetBird</title>
+    <style>
+      html, body { background: #181A1D; }
+      html:not(.dark), html:not(.dark) body { background: #F3F3F3; }
+    </style>
+    <script>
+      // Pre-paint theme guard: apply the last-known theme before first render
+      // to avoid a flash of the wrong theme. ThemeContext keeps the mirror
+      // fresh from the persisted preference and the Go-reported OS appearance.
+      (function () {
+        try {
+          var pref = localStorage.getItem("nb-theme-pref") || "system";
+          var dark;
+          if (pref === "dark") dark = true;
+          else if (pref === "light") dark = false;
+          else dark = window.matchMedia("(prefers-color-scheme: dark)").matches;
+          document.documentElement.classList.toggle("dark", dark);
+        } catch (e) {
+          /* keep the default dark class */
+        }
+      })();
+    </script>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/app.tsx"></script>
+  </body>
+</html>
diff --git a/client/ui/frontend/package.json b/client/ui/frontend/package.json
new file mode 100644
index 000000000..dcef99ad3
--- /dev/null
+++ b/client/ui/frontend/package.json
@@ -0,0 +1,70 @@
+{
+  "name": "netbird-ui",
+  "private": true,
+  "version": "0.0.1",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build:dev": "tsc && vite build --minify false --mode development",
+    "build": "tsc && vite build --mode production",
+    "preview": "vite preview",
+    "typecheck": "tsc --noEmit",
+    "bindings": "cd .. && wails3 generate bindings -clean=true -ts",
+    "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,css,json,md}\"",
+    "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,css,json,md}\"",
+    "lint": "eslint \"src/**/*.{ts,tsx}\"",
+    "lint:fix": "eslint \"src/**/*.{ts,tsx}\" --fix",
+    "check": "pnpm lint && pnpm typecheck && pnpm format:check",
+    "check:fix": "pnpm lint:fix && pnpm format && pnpm typecheck",
+    "i18n:check": "node ../i18n/check-translations.mjs"
+  },
+  "dependencies": {
+    "@radix-ui/react-dialog": "^1.1.15",
+    "@radix-ui/react-dropdown-menu": "^2.1.16",
+    "@radix-ui/react-label": "^2.1.8",
+    "@radix-ui/react-popover": "^1.1.15",
+    "@radix-ui/react-radio-group": "^1.3.8",
+    "@radix-ui/react-scroll-area": "^1.2.10",
+    "@radix-ui/react-switch": "^1.2.6",
+    "@radix-ui/react-tabs": "^1.1.13",
+    "@radix-ui/react-tooltip": "^1.2.8",
+    "@radix-ui/react-visually-hidden": "^1.2.4",
+    "@wailsio/runtime": "latest",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cmdk": "^1.1.1",
+    "framer-motion": "^12.38.0",
+    "i18next": "^26.2.0",
+    "lucide-react": "^0.566.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-i18next": "^17.0.8",
+    "react-loading-skeleton": "^3.5.0",
+    "react-router-dom": "^7.1.3",
+    "react-virtuoso": "^4.12.5",
+    "tailwind-merge": "^2.6.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^25.6.0",
+    "@types/react": "^18.3.18",
+    "@types/react-dom": "^18.3.5",
+    "@vitejs/plugin-react": "^4.3.4",
+    "autoprefixer": "^10.4.20",
+    "eslint": "^9.39.4",
+    "eslint-plugin-jsx-a11y": "^6.10.2",
+    "eslint-plugin-react": "^7.37.5",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    "eslint-plugin-react-refresh": "^0.5.3",
+    "globals": "^17.6.0",
+    "postcss": "^8.5.1",
+    "prettier": "^3.8.3",
+    "prettier-plugin-tailwindcss": "^0.8.0",
+    "tailwindcss": "^3.4.17",
+    "tailwindcss-animate": "^1.0.7",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.61.1",
+    "vite": "^6.0.7"
+  },
+  "packageManager": "pnpm@11.4.0+sha512.f0febc7e37552ab485494a914241b338e0b3580b93d54ce31f00933015880863129038a1b4ae4e414a0ee63ac35bf21197e990172c4a68256450b5636310968f"
+}
diff --git a/client/ui/frontend/pnpm-lock.yaml b/client/ui/frontend/pnpm-lock.yaml
new file mode 100644
index 000000000..b6b3dd336
--- /dev/null
+++ b/client/ui/frontend/pnpm-lock.yaml
@@ -0,0 +1,5240 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      '@radix-ui/react-dialog':
+        specifier: ^1.1.15
+        version: 1.1.15(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-dropdown-menu':
+        specifier: ^2.1.16
+        version: 2.1.16(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-label':
+        specifier: ^2.1.8
+        version: 2.1.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-popover':
+        specifier: ^1.1.15
+        version: 1.1.15(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-radio-group':
+        specifier: ^1.3.8
+        version: 1.3.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-scroll-area':
+        specifier: ^1.2.10
+        version: 1.2.10(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-switch':
+        specifier: ^1.2.6
+        version: 1.2.6(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-tabs':
+        specifier: ^1.1.13
+        version: 1.1.13(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-tooltip':
+        specifier: ^1.2.8
+        version: 1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-visually-hidden':
+        specifier: ^1.2.4
+        version: 1.2.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@wailsio/runtime':
+        specifier: latest
+        version: 3.0.0-alpha.79
+      class-variance-authority:
+        specifier: ^0.7.1
+        version: 0.7.1
+      clsx:
+        specifier: ^2.1.1
+        version: 2.1.1
+      cmdk:
+        specifier: ^1.1.1
+        version: 1.1.1(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      framer-motion:
+        specifier: ^12.38.0
+        version: 12.40.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      i18next:
+        specifier: ^26.2.0
+        version: 26.3.0(typescript@5.9.3)
+      lucide-react:
+        specifier: ^0.566.0
+        version: 0.566.0(react@18.3.1)
+      react:
+        specifier: ^18.3.1
+        version: 18.3.1
+      react-dom:
+        specifier: ^18.3.1
+        version: 18.3.1(react@18.3.1)
+      react-i18next:
+        specifier: ^17.0.8
+        version: 17.0.8(i18next@26.3.0(typescript@5.9.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.9.3)
+      react-loading-skeleton:
+        specifier: ^3.5.0
+        version: 3.5.0(react@18.3.1)
+      react-router-dom:
+        specifier: ^7.1.3
+        version: 7.15.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react-virtuoso:
+        specifier: ^4.12.5
+        version: 4.18.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      tailwind-merge:
+        specifier: ^2.6.0
+        version: 2.6.1
+    devDependencies:
+      '@eslint/js':
+        specifier: ^10.0.1
+        version: 10.0.1(eslint@9.39.4(jiti@1.21.7))
+      '@types/node':
+        specifier: ^25.6.0
+        version: 25.9.1
+      '@types/react':
+        specifier: ^18.3.18
+        version: 18.3.29
+      '@types/react-dom':
+        specifier: ^18.3.5
+        version: 18.3.7(@types/react@18.3.29)
+      '@vitejs/plugin-react':
+        specifier: ^4.3.4
+        version: 4.7.0(vite@6.4.2(@types/node@25.9.1)(jiti@1.21.7))
+      autoprefixer:
+        specifier: ^10.4.20
+        version: 10.5.0(postcss@8.5.15)
+      eslint:
+        specifier: ^9.39.4
+        version: 9.39.4(jiti@1.21.7)
+      eslint-plugin-jsx-a11y:
+        specifier: ^6.10.2
+        version: 6.10.2(eslint@9.39.4(jiti@1.21.7))
+      eslint-plugin-react:
+        specifier: ^7.37.5
+        version: 7.37.5(eslint@9.39.4(jiti@1.21.7))
+      eslint-plugin-react-hooks:
+        specifier: ^7.1.1
+        version: 7.1.1(eslint@9.39.4(jiti@1.21.7))
+      eslint-plugin-react-refresh:
+        specifier: ^0.5.3
+        version: 0.5.3(eslint@9.39.4(jiti@1.21.7))
+      globals:
+        specifier: ^17.6.0
+        version: 17.6.0
+      postcss:
+        specifier: ^8.5.1
+        version: 8.5.15
+      prettier:
+        specifier: ^3.8.3
+        version: 3.8.3
+      prettier-plugin-tailwindcss:
+        specifier: ^0.8.0
+        version: 0.8.0(prettier@3.8.3)
+      tailwindcss:
+        specifier: ^3.4.17
+        version: 3.4.19
+      tailwindcss-animate:
+        specifier: ^1.0.7
+        version: 1.0.7(tailwindcss@3.4.19)
+      typescript:
+        specifier: ^5.7.3
+        version: 5.9.3
+      typescript-eslint:
+        specifier: ^8.61.1
+        version: 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      vite:
+        specifier: ^6.0.7
+        version: 6.4.2(@types/node@25.9.1)(jiti@1.21.7)
+
+packages:
+
+  '@alloc/quick-lru@5.2.0':
+    resolution: {integrity: sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==}
+    engines: {node: '>=10'}
+
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/compat-data@7.29.7':
+    resolution: {integrity: sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.29.7':
+    resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.29.7':
+    resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-compilation-targets@7.29.7':
+    resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-globals@7.29.7':
+    resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.29.7':
+    resolution: {integrity: sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-transforms@7.29.7':
+    resolution: {integrity: sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-plugin-utils@7.29.7':
+    resolution: {integrity: sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-string-parser@7.29.7':
+    resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-option@7.29.7':
+    resolution: {integrity: sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helpers@7.29.7':
+    resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.29.7':
+    resolution: {integrity: sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/plugin-transform-react-jsx-self@7.29.7':
+    resolution: {integrity: sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-jsx-source@7.29.7':
+    resolution: {integrity: sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/runtime@7.29.7':
+    resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/template@7.29.7':
+    resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.29.7':
+    resolution: {integrity: sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.29.7':
+    resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
+    engines: {node: '>=6.9.0'}
+
+  '@esbuild/aix-ppc64@0.25.12':
+    resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.25.12':
+    resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.25.12':
+    resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.25.12':
+    resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.25.12':
+    resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.25.12':
+    resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.25.12':
+    resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.25.12':
+    resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.25.12':
+    resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.25.12':
+    resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.25.12':
+    resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.25.12':
+    resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.25.12':
+    resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.25.12':
+    resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.25.12':
+    resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.25.12':
+    resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.25.12':
+    resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.25.12':
+    resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.25.12':
+    resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.25.12':
+    resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.25.12':
+    resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.25.12':
+    resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@eslint-community/eslint-utils@4.9.1':
+    resolution: {integrity: sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    peerDependencies:
+      eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
+
+  '@eslint-community/regexpp@4.12.2':
+    resolution: {integrity: sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==}
+    engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
+
+  '@eslint/config-array@0.21.2':
+    resolution: {integrity: sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/config-helpers@0.4.2':
+    resolution: {integrity: sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/core@0.17.0':
+    resolution: {integrity: sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/eslintrc@3.3.5':
+    resolution: {integrity: sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/js@10.0.1':
+    resolution: {integrity: sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
+    peerDependencies:
+      eslint: ^10.0.0
+    peerDependenciesMeta:
+      eslint:
+        optional: true
+
+  '@eslint/js@9.39.4':
+    resolution: {integrity: sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/object-schema@2.1.7':
+    resolution: {integrity: sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/plugin-kit@0.4.1':
+    resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@floating-ui/core@1.7.5':
+    resolution: {integrity: sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==}
+
+  '@floating-ui/dom@1.7.6':
+    resolution: {integrity: sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==}
+
+  '@floating-ui/react-dom@2.1.8':
+    resolution: {integrity: sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==}
+    peerDependencies:
+      react: '>=16.8.0'
+      react-dom: '>=16.8.0'
+
+  '@floating-ui/utils@0.2.11':
+    resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
+
+  '@humanfs/core@0.19.2':
+    resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanfs/node@0.16.8':
+    resolution: {integrity: sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanfs/types@0.15.0':
+    resolution: {integrity: sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanwhocodes/module-importer@1.0.1':
+    resolution: {integrity: sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==}
+    engines: {node: '>=12.22'}
+
+  '@humanwhocodes/retry@0.4.3':
+    resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
+    engines: {node: '>=18.18'}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
+  '@jridgewell/remapping@2.3.5':
+    resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
+
+  '@jridgewell/resolve-uri@3.1.2':
+    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/sourcemap-codec@1.5.5':
+    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+
+  '@nodelib/fs.scandir@2.1.5':
+    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.stat@2.0.5':
+    resolution: {integrity: sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.walk@1.2.8':
+    resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
+    engines: {node: '>= 8'}
+
+  '@radix-ui/number@1.1.1':
+    resolution: {integrity: sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g==}
+
+  '@radix-ui/primitive@1.1.3':
+    resolution: {integrity: sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==}
+
+  '@radix-ui/react-arrow@1.1.7':
+    resolution: {integrity: sha512-F+M1tLhO+mlQaOWspE8Wstg+z6PwxwRd8oQ8IXceWz92kfAmalTRf0EjrouQeo7QssEPfCn05B4Ihs1K9WQ/7w==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-collection@1.1.7':
+    resolution: {integrity: sha512-Fh9rGN0MoI4ZFUNyfFVNU4y9LUz93u9/0K+yLgA2bwRojxM8JU1DyvvMBabnZPBgMWREAJvU2jjVzq+LrFUglw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-compose-refs@1.1.2':
+    resolution: {integrity: sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-context@1.1.2':
+    resolution: {integrity: sha512-jCi/QKUM2r1Ju5a3J64TH2A5SpKAgh0LpknyqdQ4m6DCV0xJ2HG1xARRwNGPQfi1SLdLWZ1OJz6F4OMBBNiGJA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-dialog@1.1.15':
+    resolution: {integrity: sha512-TCglVRtzlffRNxRMEyR36DGBLJpeusFcgMVD9PZEzAKnUs1lKCgX5u9BmC2Yg+LL9MgZDugFFs1Vl+Jp4t/PGw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-direction@1.1.1':
+    resolution: {integrity: sha512-1UEWRX6jnOA2y4H5WczZ44gOOjTEmlqv1uNW4GAJEO5+bauCBhv8snY65Iw5/VOS/ghKN9gr2KjnLKxrsvoMVw==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-dismissable-layer@1.1.11':
+    resolution: {integrity: sha512-Nqcp+t5cTB8BinFkZgXiMJniQH0PsUt2k51FUhbdfeKvc4ACcG2uQniY/8+h1Yv6Kza4Q7lD7PQV0z0oicE0Mg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-dropdown-menu@2.1.16':
+    resolution: {integrity: sha512-1PLGQEynI/3OX/ftV54COn+3Sud/Mn8vALg2rWnBLnRaGtJDduNW/22XjlGgPdpcIbiQxjKtb7BkcjP00nqfJw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-focus-guards@1.1.3':
+    resolution: {integrity: sha512-0rFg/Rj2Q62NCm62jZw0QX7a3sz6QCQU0LpZdNrJX8byRGaGVTqbrW9jAoIAHyMQqsNpeZ81YgSizOt5WXq0Pw==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-focus-scope@1.1.7':
+    resolution: {integrity: sha512-t2ODlkXBQyn7jkl6TNaw/MtVEVvIGelJDCG41Okq/KwUsJBwQ4XVZsHAVUkK4mBv3ewiAS3PGuUWuY2BoK4ZUw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-id@1.1.1':
+    resolution: {integrity: sha512-kGkGegYIdQsOb4XjsfM97rXsiHaBwco+hFI66oO4s9LU+PLAC5oJ7khdOVFxkhsmlbpUqDAvXw11CluXP+jkHg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-label@2.1.8':
+    resolution: {integrity: sha512-FmXs37I6hSBVDlO4y764TNz1rLgKwjJMQ0EGte6F3Cb3f4bIuHB/iLa/8I9VKkmOy+gNHq8rql3j686ACVV21A==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-menu@2.1.16':
+    resolution: {integrity: sha512-72F2T+PLlphrqLcAotYPp0uJMr5SjP5SL01wfEspJbru5Zs5vQaSHb4VB3ZMJPimgHHCHG7gMOeOB9H3Hdmtxg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-popover@1.1.15':
+    resolution: {integrity: sha512-kr0X2+6Yy/vJzLYJUPCZEc8SfQcf+1COFoAqauJm74umQhta9M7lNJHP7QQS3vkvcGLQUbWpMzwrXYwrYztHKA==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-popper@1.2.8':
+    resolution: {integrity: sha512-0NJQ4LFFUuWkE7Oxf0htBKS6zLkkjBH+hM1uk7Ng705ReR8m/uelduy1DBo0PyBXPKVnBA6YBlU94MBGXrSBCw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-portal@1.1.9':
+    resolution: {integrity: sha512-bpIxvq03if6UNwXZ+HTK71JLh4APvnXntDc6XOX8UVq4XQOVl7lwok0AvIl+b8zgCw3fSaVTZMpAPPagXbKmHQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-presence@1.1.5':
+    resolution: {integrity: sha512-/jfEwNDdQVBCNvjkGit4h6pMOzq8bHkopq458dPt2lMjx+eBQUohZNG9A7DtO/O5ukSbxuaNGXMjHicgwy6rQQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-primitive@2.1.3':
+    resolution: {integrity: sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-primitive@2.1.4':
+    resolution: {integrity: sha512-9hQc4+GNVtJAIEPEqlYqW5RiYdrr8ea5XQ0ZOnD6fgru+83kqT15mq2OCcbe8KnjRZl5vF3ks69AKz3kh1jrhg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-radio-group@1.3.8':
+    resolution: {integrity: sha512-VBKYIYImA5zsxACdisNQ3BjCBfmbGH3kQlnFVqlWU4tXwjy7cGX8ta80BcrO+WJXIn5iBylEH3K6ZTlee//lgQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-roving-focus@1.1.11':
+    resolution: {integrity: sha512-7A6S9jSgm/S+7MdtNDSb+IU859vQqJ/QAtcYQcfFC6W8RS4IxIZDldLR0xqCFZ6DCyrQLjLPsxtTNch5jVA4lA==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-scroll-area@1.2.10':
+    resolution: {integrity: sha512-tAXIa1g3sM5CGpVT0uIbUx/U3Gs5N8T52IICuCtObaos1S8fzsrPXG5WObkQN3S6NVl6wKgPhAIiBGbWnvc97A==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-slot@1.2.3':
+    resolution: {integrity: sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-slot@1.2.4':
+    resolution: {integrity: sha512-Jl+bCv8HxKnlTLVrcDE8zTMJ09R9/ukw4qBs/oZClOfoQk/cOTbDn+NceXfV7j09YPVQUryJPHurafcSg6EVKA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-switch@1.2.6':
+    resolution: {integrity: sha512-bByzr1+ep1zk4VubeEVViV592vu2lHE2BZY5OnzehZqOOgogN80+mNtCqPkhn2gklJqOpxWgPoYTSnhBCqpOXQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-tabs@1.1.13':
+    resolution: {integrity: sha512-7xdcatg7/U+7+Udyoj2zodtI9H/IIopqo+YOIcZOq1nJwXWBZ9p8xiu5llXlekDbZkca79a/fozEYQXIA4sW6A==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-tooltip@1.2.8':
+    resolution: {integrity: sha512-tY7sVt1yL9ozIxvmbtN5qtmH2krXcBCfjEiCgKGLqunJHvgvZG2Pcl2oQ3kbcZARb1BGEHdkLzcYGO8ynVlieg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-use-callback-ref@1.1.1':
+    resolution: {integrity: sha512-FkBMwD+qbGQeMu1cOHnuGB6x4yzPjho8ap5WtbEJ26umhgqVXbhekKUQO+hZEL1vU92a3wHwdp0HAcqAUF5iDg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-controllable-state@1.2.2':
+    resolution: {integrity: sha512-BjasUjixPFdS+NKkypcyyN5Pmg83Olst0+c6vGov0diwTEo6mgdqVR6hxcEgFuh4QrAs7Rc+9KuGJ9TVCj0Zzg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-effect-event@0.0.2':
+    resolution: {integrity: sha512-Qp8WbZOBe+blgpuUT+lw2xheLP8q0oatc9UpmiemEICxGvFLYmHm9QowVZGHtJlGbS6A6yJ3iViad/2cVjnOiA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-escape-keydown@1.1.1':
+    resolution: {integrity: sha512-Il0+boE7w/XebUHyBjroE+DbByORGR9KKmITzbR7MyQ4akpORYP/ZmbhAr0DG7RmmBqoOnZdy2QlvajJ2QA59g==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-layout-effect@1.1.1':
+    resolution: {integrity: sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-previous@1.1.1':
+    resolution: {integrity: sha512-2dHfToCj/pzca2Ck724OZ5L0EVrr3eHRNsG/b3xQJLA2hZpVCS99bLAX+hm1IHXDEnzU6by5z/5MIY794/a8NQ==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-rect@1.1.1':
+    resolution: {integrity: sha512-QTYuDesS0VtuHNNvMh+CjlKJ4LJickCMUAqjlE3+j8w+RlRpwyX3apEQKGFzbZGdo7XNG1tXa+bQqIE7HIXT2w==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-size@1.1.1':
+    resolution: {integrity: sha512-ewrXRDTAqAXlkl6t/fkXWNAhFX9I+CkKlw6zjEwk86RSPKwZr3xpBRso655aqYafwtnbpHLj6toFzmd6xdVptQ==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-visually-hidden@1.2.3':
+    resolution: {integrity: sha512-pzJq12tEaaIhqjbzpCuv/OypJY/BPavOofm+dbab+MHLajy277+1lLm6JFcGgF5eskJ6mquGirhXY2GD/8u8Ug==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-visually-hidden@1.2.4':
+    resolution: {integrity: sha512-kaeiyGCe844dkb9AVF+rb4yTyb1LiLN/e3es3nLiRyN4dC8AduBYPMnnNlDjX2VDOcvDEiPnRNMJeWCfsX0txg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/rect@1.1.1':
+    resolution: {integrity: sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw==}
+
+  '@rolldown/pluginutils@1.0.0-beta.27':
+    resolution: {integrity: sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==}
+
+  '@rollup/rollup-android-arm-eabi@4.60.4':
+    resolution: {integrity: sha512-F5QXMSiFebS9hKZj02XhWLLnRpJ3B3AROP0tWbFBSj+6kCbg5m9j5JoHKd4mmSVy5mS/IMQloYgYxCuJC0fxEQ==}
+    cpu: [arm]
+    os: [android]
+
+  '@rollup/rollup-android-arm64@4.60.4':
+    resolution: {integrity: sha512-GxxTKApUpzRhof7poWvCJHRF51C67u1R7D6DiluBE8wKU1u5GWE8t+v81JvJYtbawoBFX1hLv5Ei4eVjkWokaw==}
+    cpu: [arm64]
+    os: [android]
+
+  '@rollup/rollup-darwin-arm64@4.60.4':
+    resolution: {integrity: sha512-tua0TaJxMOB1R0V0RS1jFZ/RpURFDJIOR2A6jWwQeawuFyS4gBW+rntLRaQd0EQ4bd6Vp44Z2rXW+YYDBsj6IA==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rollup/rollup-darwin-x64@4.60.4':
+    resolution: {integrity: sha512-CSKq7MsP+5PFIcydhAiR1K0UhEI1A2jWXVKHPCBZ151yOutENwvnPocgVHkivu2kviURtCEB6zUQw0vs8RrhMg==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rollup/rollup-freebsd-arm64@4.60.4':
+    resolution: {integrity: sha512-+O8OkVdyvXMtJEciu2wS/pzm1IxntEEQx3z5TAVy4l32G0etZn+RsA48ARRrFm6Ri8fvqPQfgrvNxSjKAbnd3g==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@rollup/rollup-freebsd-x64@4.60.4':
+    resolution: {integrity: sha512-Iw3oMskH3AfNuhU0MSN7vNbdi4me/NiYo2azqPz/Le16zHSa+3RRmliCMWWQmh4lcndccU40xcJuTYJZxNo/lw==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.60.4':
+    resolution: {integrity: sha512-EIPRXTVQpHyF8WOo219AD2yEltPehLTcTMz2fn6JsatLYSzQf00hj3rulF+yauOlF9/FtM2WpkT/hJh/KJFGhA==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-arm-musleabihf@4.60.4':
+    resolution: {integrity: sha512-J3Yh9PzzF1Ovah2At+lHiGQdsYgArxBbXv/zHfSyaiFQEqvNv7DcW98pCrmdjCZBrqBiKrKKe2V+aaSGWuBe/w==}
+    cpu: [arm]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-arm64-gnu@4.60.4':
+    resolution: {integrity: sha512-BFDEZMYfUvLn37ONE1yMBojPxnMlTFsdyNoqncT0qFq1mAfllL+ATMMJd8TeuVMiX84s1KbcxcZbXInmcO2mRg==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-arm64-musl@4.60.4':
+    resolution: {integrity: sha512-pc9EYOSlOgdQ2uPl1o9PF6/kLSgaUosia7gOuS8mB69IxJvlclko1MECXysjs5ryez1/5zjYqx3+xYU0TU6R1A==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-loong64-gnu@4.60.4':
+    resolution: {integrity: sha512-NxnomyxYerDh5n4iLrNa+sH+Z+U4BMEE46V2PgQ/hoB909i8gV1M5wPojWg9fk1jWpO3IQnOs20K4wyZuFLEFQ==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-loong64-musl@4.60.4':
+    resolution: {integrity: sha512-nbJnQ8a3z1mtmrwImCYhc6BGpThAyYVRQxw9uKSKG4wR6aAYno9sVjJ0zaZcW9BPJX1GbrDPf+SvdWjgTuDmnw==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-ppc64-gnu@4.60.4':
+    resolution: {integrity: sha512-2EU6acNrQLd8tYvo/LXW535wupT3m6fo7HKo6lr7ktQoItxTyOL1ZCR/GfGCuXl2vR+zmfI6eRXkSemafv+iVg==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-ppc64-musl@4.60.4':
+    resolution: {integrity: sha512-WeBtoMuaMxiiIrO2IYP3xs6GMWkJP2C0EoT8beTLkUPmzV1i/UcOSVw1d5r9KBODtHKilG5yFxsGRnBbK3wJ4A==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-riscv64-gnu@4.60.4':
+    resolution: {integrity: sha512-FJHFfqpKUI3A10WrWKiFbBZ7yVbGT4q4B5o1qKFFojqpaYoh9LrQgqWCmmcxQzVSXYtyB5bzkXrYzlHTs21MYA==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-riscv64-musl@4.60.4':
+    resolution: {integrity: sha512-mcEl6CUT5IAUmQf1m9FYSmVqCJlpQ8r8eyftFUHG8i9OhY7BkBXSUdnLH5DOf0wCOjcP9v/QO93zpmF1SptCCw==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-s390x-gnu@4.60.4':
+    resolution: {integrity: sha512-ynt3JxVd2w2buzoKDWIyiV1pJW93xlQic1THVLXilz429oijRpSHivZAgp65KBu+cMcgf1eVVjdnTLvPxgCuoQ==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-x64-gnu@4.60.4':
+    resolution: {integrity: sha512-Boiz5+MsaROEWDf+GGEwF8VMHGhlUoQMtIPjOgA5fv4osupqTVnJteQNKJwUcnUog2G55jYXH7KZFFiJe0TEzQ==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-x64-musl@4.60.4':
+    resolution: {integrity: sha512-+qfSY27qIrFfI/Hom04KYFw3GKZSGU4lXus51wsb5EuySfFlWRwjkKWoE9emgRw/ukoT4Udsj4W/+xxG8VbPKg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-openbsd-x64@4.60.4':
+    resolution: {integrity: sha512-VpTfOPHgVXEBeeR8hZ2O0F3aSso+JDWqTWmTmzcQKted54IAdUVbxE+j/MVxUsKa8L20HJhv3vUezVPoquqWjA==}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@rollup/rollup-openharmony-arm64@4.60.4':
+    resolution: {integrity: sha512-IPOsh5aRYuLv/nkU51X10Bf75Bsf6+gZdx1X+QP5QM6lIJFHHqbHLG0uJn/hWthzo13UAc2umiUorqZy3axoZg==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rollup/rollup-win32-arm64-msvc@4.60.4':
+    resolution: {integrity: sha512-4QzE9E81OohJ/HKzHhsqU+zcYYojVOXlFMs1DdyMT6qXl/niOH7AVElmmEdUNHHS/oRkc++d5k6Vy85zFs0DEw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rollup/rollup-win32-ia32-msvc@4.60.4':
+    resolution: {integrity: sha512-zTPgT1YuHHcd+Tmx7h8aml0FWFVelV5N54oHow9SLj+GfoDy/huQ+UV396N/C7KpMDMiPspRktzM1/0r1usYEA==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-gnu@4.60.4':
+    resolution: {integrity: sha512-DRS4G7mi9lJxqEDezIkKCaUIKCrLUUDCUaCsTPCi/rtqaC6D/jjwslMQyiDU50Ka0JKpeXeRBFBAXwArY52vBw==}
+    cpu: [x64]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-msvc@4.60.4':
+    resolution: {integrity: sha512-QVTUovf40zgTqlFVrKA1uXMVvU2QWEFWfAH8Wdc48IxLvrJMQVMBRjuQyUpzZCDkakImib9eVazbWlC6ksWtJw==}
+    cpu: [x64]
+    os: [win32]
+
+  '@types/babel__core@7.20.5':
+    resolution: {integrity: sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==}
+
+  '@types/babel__generator@7.27.0':
+    resolution: {integrity: sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==}
+
+  '@types/babel__template@7.4.4':
+    resolution: {integrity: sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==}
+
+  '@types/babel__traverse@7.28.0':
+    resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
+
+  '@types/estree@1.0.8':
+    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
+
+  '@types/json-schema@7.0.15':
+    resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
+
+  '@types/node@25.9.1':
+    resolution: {integrity: sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==}
+
+  '@types/prop-types@15.7.15':
+    resolution: {integrity: sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw==}
+
+  '@types/react-dom@18.3.7':
+    resolution: {integrity: sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==}
+    peerDependencies:
+      '@types/react': ^18.0.0
+
+  '@types/react@18.3.29':
+    resolution: {integrity: sha512-ch0qJdr2JY0r04NXSprbK6TXOgnaJ1Tz23fm5W+z0/CBah6BSBc3n96h7K9GOtwh0HrilNWHIBzE1Ko4Dcw/Wg==}
+
+  '@typescript-eslint/eslint-plugin@8.61.1':
+    resolution: {integrity: sha512-ZPlVl3PB3et/59Ne0fv/sci6ZXz4T4Hp4nTJ56i/Y0gR89ARb+KphojTq6j+56E5PIezmOIOOWyY+aWQFd+IkQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      '@typescript-eslint/parser': ^8.61.1
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/parser@8.61.1':
+    resolution: {integrity: sha512-PJ5vePq5/ognBbrIcoC5+SHO5dfpeLPzP9FpLkzWrguoYQEeeSjlJpVwOpo1JRSTEi7dRcwNy4h4dzV70PqHcg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/project-service@8.61.1':
+    resolution: {integrity: sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/scope-manager@8.61.1':
+    resolution: {integrity: sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/tsconfig-utils@8.61.1':
+    resolution: {integrity: sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/type-utils@8.61.1':
+    resolution: {integrity: sha512-GYRicKmVK0C4fsKgaACaknOUAq9Oa2kwsjnpFhFcS/5p4Ht5IP9OVLbgIgcK4SRk92nVHFluurg1lumD9dBcLw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/types@8.61.1':
+    resolution: {integrity: sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/typescript-estree@8.61.1':
+    resolution: {integrity: sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/utils@8.61.1':
+    resolution: {integrity: sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/visitor-keys@8.61.1':
+    resolution: {integrity: sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@vitejs/plugin-react@4.7.0':
+    resolution: {integrity: sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==}
+    engines: {node: ^14.18.0 || >=16.0.0}
+    peerDependencies:
+      vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
+
+  '@wailsio/runtime@3.0.0-alpha.79':
+    resolution: {integrity: sha512-NITzxKmJsMEruc39L166lbPJVECxzcbdqpHVqOOF7Cu/7Zqk/e3B/gNpkUjhNyo5rVb3V1wpS8oEgLUmpu1cwA==}
+
+  acorn-jsx@5.3.2:
+    resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
+    peerDependencies:
+      acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
+
+  acorn@8.17.0:
+    resolution: {integrity: sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
+  ajv@6.15.0:
+    resolution: {integrity: sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==}
+
+  ansi-styles@4.3.0:
+    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
+    engines: {node: '>=8'}
+
+  any-promise@1.3.0:
+    resolution: {integrity: sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
+
+  anymatch@3.1.3:
+    resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
+    engines: {node: '>= 8'}
+
+  arg@5.0.2:
+    resolution: {integrity: sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==}
+
+  argparse@2.0.1:
+    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
+
+  aria-hidden@1.2.6:
+    resolution: {integrity: sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==}
+    engines: {node: '>=10'}
+
+  aria-query@5.3.2:
+    resolution: {integrity: sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==}
+    engines: {node: '>= 0.4'}
+
+  array-buffer-byte-length@1.0.2:
+    resolution: {integrity: sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw==}
+    engines: {node: '>= 0.4'}
+
+  array-includes@3.1.9:
+    resolution: {integrity: sha512-FmeCCAenzH0KH381SPT5FZmiA/TmpndpcaShhfgEN9eCVjnFBqq3l1xrI42y8+PPLI6hypzou4GXw00WHmPBLQ==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.findlast@1.2.5:
+    resolution: {integrity: sha512-CVvd6FHg1Z3POpBLxO6E6zr+rSKEQ9L6rZHAaY7lLfhKsWYUBBOuMs0e9o24oopj6H+geRCX0YJ+TJLBK2eHyQ==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.flat@1.3.3:
+    resolution: {integrity: sha512-rwG/ja1neyLqCuGZ5YYrznA62D4mZXg0i1cIskIUKSiqF3Cje9/wXAls9B9s1Wa2fomMsIv8czB8jZcPmxCXFg==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.flatmap@1.3.3:
+    resolution: {integrity: sha512-Y7Wt51eKJSyi80hFrJCePGGNo5ktJCslFuboqJsbf57CCPcm5zztluPlc4/aD8sWsKvlwatezpV4U1efk8kpjg==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.tosorted@1.1.4:
+    resolution: {integrity: sha512-p6Fx8B7b7ZhL/gmUsAy0D15WhvDccw3mnGNbZpi3pmeJdxtWsj2jEaI4Y6oo3XiHfzuSgPwKc04MYt6KgvC/wA==}
+    engines: {node: '>= 0.4'}
+
+  arraybuffer.prototype.slice@1.0.4:
+    resolution: {integrity: sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==}
+    engines: {node: '>= 0.4'}
+
+  ast-types-flow@0.0.8:
+    resolution: {integrity: sha512-OH/2E5Fg20h2aPrbe+QL8JZQFko0YZaF+j4mnQ7BGhfavO7OpSLa8a0y9sBwomHdSbkhTS8TQNayBfnW5DwbvQ==}
+
+  async-function@1.0.0:
+    resolution: {integrity: sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==}
+    engines: {node: '>= 0.4'}
+
+  autoprefixer@10.5.0:
+    resolution: {integrity: sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==}
+    engines: {node: ^10 || ^12 || >=14}
+    hasBin: true
+    peerDependencies:
+      postcss: ^8.1.0
+
+  available-typed-arrays@1.0.7:
+    resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
+    engines: {node: '>= 0.4'}
+
+  axe-core@4.12.1:
+    resolution: {integrity: sha512-s7iGf5GaVMxEG0ENN9x+xTr7GFZCb1ZP/1uATUpCEK2X78nDB3RwbtFCo9pGAf9ru+VwoQ464DkaLEeRM08wJA==}
+    engines: {node: '>=4'}
+
+  axobject-query@4.1.0:
+    resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==}
+    engines: {node: '>= 0.4'}
+
+  balanced-match@1.0.2:
+    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
+
+  balanced-match@4.0.4:
+    resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
+    engines: {node: 18 || 20 || >=22}
+
+  baseline-browser-mapping@2.10.32:
+    resolution: {integrity: sha512-wbPvpyjJPC0zdfdKXxqEL3Ea+bOMD/87X4lftiJkkaBiuG6ALQy1SLmEd7BSmVCuwCQsBrCamgBoLyfFDD1EPg==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  binary-extensions@2.3.0:
+    resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
+    engines: {node: '>=8'}
+
+  brace-expansion@1.1.15:
+    resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==}
+
+  brace-expansion@5.0.6:
+    resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==}
+    engines: {node: 18 || 20 || >=22}
+
+  braces@3.0.3:
+    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+    engines: {node: '>=8'}
+
+  browserslist@4.28.2:
+    resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  call-bind-apply-helpers@1.0.2:
+    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bind@1.0.9:
+    resolution: {integrity: sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bound@1.0.4:
+    resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
+    engines: {node: '>= 0.4'}
+
+  callsites@3.1.0:
+    resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
+    engines: {node: '>=6'}
+
+  camelcase-css@2.0.1:
+    resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
+    engines: {node: '>= 6'}
+
+  caniuse-lite@1.0.30001793:
+    resolution: {integrity: sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==}
+
+  chalk@4.1.2:
+    resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
+    engines: {node: '>=10'}
+
+  chokidar@3.6.0:
+    resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
+    engines: {node: '>= 8.10.0'}
+
+  class-variance-authority@0.7.1:
+    resolution: {integrity: sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==}
+
+  clsx@2.1.1:
+    resolution: {integrity: sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==}
+    engines: {node: '>=6'}
+
+  cmdk@1.1.1:
+    resolution: {integrity: sha512-Vsv7kFaXm+ptHDMZ7izaRsP70GgrW9NBNGswt9OZaVBLlE0SNpDq8eu/VGXyF9r7M0azK3Wy7OlYXsuyYLFzHg==}
+    peerDependencies:
+      react: ^18 || ^19 || ^19.0.0-rc
+      react-dom: ^18 || ^19 || ^19.0.0-rc
+
+  color-convert@2.0.1:
+    resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
+    engines: {node: '>=7.0.0'}
+
+  color-name@1.1.4:
+    resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
+
+  commander@4.1.1:
+    resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
+    engines: {node: '>= 6'}
+
+  concat-map@0.0.1:
+    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
+
+  convert-source-map@2.0.0:
+    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
+
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
+  cross-spawn@7.0.6:
+    resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
+    engines: {node: '>= 8'}
+
+  cssesc@3.0.0:
+    resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  csstype@3.2.3:
+    resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
+
+  damerau-levenshtein@1.0.8:
+    resolution: {integrity: sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==}
+
+  data-view-buffer@1.0.2:
+    resolution: {integrity: sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==}
+    engines: {node: '>= 0.4'}
+
+  data-view-byte-length@1.0.2:
+    resolution: {integrity: sha512-tuhGbE6CfTM9+5ANGf+oQb72Ky/0+s3xKUpHvShfiz2RxMFgFPjsXuRLBVMtvMs15awe45SRb83D6wH4ew6wlQ==}
+    engines: {node: '>= 0.4'}
+
+  data-view-byte-offset@1.0.1:
+    resolution: {integrity: sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==}
+    engines: {node: '>= 0.4'}
+
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  deep-is@0.1.4:
+    resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
+
+  define-data-property@1.1.4:
+    resolution: {integrity: sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
+    engines: {node: '>= 0.4'}
+
+  define-properties@1.2.1:
+    resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
+    engines: {node: '>= 0.4'}
+
+  detect-node-es@1.1.0:
+    resolution: {integrity: sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==}
+
+  didyoumean@1.2.2:
+    resolution: {integrity: sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==}
+
+  dlv@1.1.3:
+    resolution: {integrity: sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==}
+
+  doctrine@2.1.0:
+    resolution: {integrity: sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==}
+    engines: {node: '>=0.10.0'}
+
+  dunder-proto@1.0.1:
+    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
+    engines: {node: '>= 0.4'}
+
+  electron-to-chromium@1.5.362:
+    resolution: {integrity: sha512-PUY2DrLvkjkUuWqq+KPL2iWshrJsZOcIojzRQ7eXFacc9dWga7MGMJAa15VbiejSZB1PAXaRLAiKgruHP8LB1w==}
+
+  emoji-regex@9.2.2:
+    resolution: {integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==}
+
+  es-abstract-get@1.0.0:
+    resolution: {integrity: sha512-6PMWXpdhshVvFp+FoWYs1EvG1Nj0tvk0dZM+XcK0xMEM1czRVcP6ohqPWHy6qPagSpC8j4+p89WXlT+xXJs/fg==}
+    engines: {node: '>= 0.4'}
+
+  es-abstract@1.24.2:
+    resolution: {integrity: sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==}
+    engines: {node: '>= 0.4'}
+
+  es-define-property@1.0.1:
+    resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
+    engines: {node: '>= 0.4'}
+
+  es-errors@1.3.0:
+    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+    engines: {node: '>= 0.4'}
+
+  es-iterator-helpers@1.3.3:
+    resolution: {integrity: sha512-0PuBxFi+4uPanB97iDxCLWuHeYud2FALrw5HFZGtAF38UpJDbDC8frwp2cnDyae692CQ0dou60UwWfhgsa4U/g==}
+    engines: {node: '>= 0.4'}
+
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
+    engines: {node: '>= 0.4'}
+
+  es-set-tostringtag@2.1.0:
+    resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
+    engines: {node: '>= 0.4'}
+
+  es-shim-unscopables@1.1.0:
+    resolution: {integrity: sha512-d9T8ucsEhh8Bi1woXCf+TIKDIROLG5WCkxg8geBCbvk22kzwC5G2OnXVMO6FUsvQlgUUXQ2itephWDLqDzbeCw==}
+    engines: {node: '>= 0.4'}
+
+  es-to-primitive@1.3.1:
+    resolution: {integrity: sha512-CxN9N56HYfd2m/acc/NOFrZQsN9kU4eh+2kk6A707Kz1krH8tKmfrs5RnftB8WNX80T0NS7vSQsDOlg23diR2g==}
+    engines: {node: '>= 0.4'}
+
+  esbuild@0.25.12:
+    resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  escalade@3.2.0:
+    resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
+    engines: {node: '>=6'}
+
+  escape-string-regexp@4.0.0:
+    resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
+    engines: {node: '>=10'}
+
+  eslint-plugin-jsx-a11y@6.10.2:
+    resolution: {integrity: sha512-scB3nz4WmG75pV8+3eRUQOHZlNSUhFNq37xnpgRkCCELU3XMvXAxLk1eqWWyE22Ki4Q01Fnsw9BA3cJHDPgn2Q==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9
+
+  eslint-plugin-react-hooks@7.1.1:
+    resolution: {integrity: sha512-f2I7Gw6JbvCexzIInuSbZpfdQ44D7iqdWX01FKLvrPgqxoE7oMj8clOfto8U6vYiz4yd5oKu39rRSVOe1zRu0g==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0 || ^10.0.0
+
+  eslint-plugin-react-refresh@0.5.3:
+    resolution: {integrity: sha512-5EMmLCV98Pi4o/f/3DP/v/tNqLHMIc9I8LKClNDWhZ9JTho89/kQcitCXQBMG7sAfVRK0Ie3T2EDOzp1YXYiVA==}
+    peerDependencies:
+      eslint: ^9 || ^10
+
+  eslint-plugin-react@7.37.5:
+    resolution: {integrity: sha512-Qteup0SqU15kdocexFNAJMvCJEfa2xUKNV4CC1xsVMrIIqEy3SQ/rqyxCWNzfrd3/ldy6HMlD2e0JDVpDg2qIA==}
+    engines: {node: '>=4'}
+    peerDependencies:
+      eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7
+
+  eslint-scope@8.4.0:
+    resolution: {integrity: sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@3.4.3:
+    resolution: {integrity: sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
+  eslint-visitor-keys@4.2.1:
+    resolution: {integrity: sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@5.0.1:
+    resolution: {integrity: sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
+
+  eslint@9.39.4:
+    resolution: {integrity: sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    hasBin: true
+    peerDependencies:
+      jiti: '*'
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+
+  espree@10.4.0:
+    resolution: {integrity: sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  esquery@1.7.0:
+    resolution: {integrity: sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==}
+    engines: {node: '>=0.10'}
+
+  esrecurse@4.3.0:
+    resolution: {integrity: sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==}
+    engines: {node: '>=4.0'}
+
+  estraverse@5.3.0:
+    resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
+    engines: {node: '>=4.0'}
+
+  esutils@2.0.3:
+    resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
+    engines: {node: '>=0.10.0'}
+
+  fast-deep-equal@3.1.3:
+    resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
+
+  fast-glob@3.3.3:
+    resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
+    engines: {node: '>=8.6.0'}
+
+  fast-json-stable-stringify@2.1.0:
+    resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
+
+  fast-levenshtein@2.0.6:
+    resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
+
+  fastq@1.20.1:
+    resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  file-entry-cache@8.0.0:
+    resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
+    engines: {node: '>=16.0.0'}
+
+  fill-range@7.1.1:
+    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
+    engines: {node: '>=8'}
+
+  find-up@5.0.0:
+    resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
+    engines: {node: '>=10'}
+
+  flat-cache@4.0.1:
+    resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
+    engines: {node: '>=16'}
+
+  flatted@3.4.2:
+    resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
+
+  for-each@0.3.5:
+    resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
+    engines: {node: '>= 0.4'}
+
+  fraction.js@5.3.4:
+    resolution: {integrity: sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==}
+
+  framer-motion@12.40.0:
+    resolution: {integrity: sha512-uaBd3qC1v3KQqBEjwTUd183K6PbS+j0yR9w9VmEOLWA/tnUcSn8Xa3uck7t4dgpDoUss8xQTcj8W2L07lrnLFg==}
+    peerDependencies:
+      '@emotion/is-prop-valid': '*'
+      react: ^18.0.0 || ^19.0.0
+      react-dom: ^18.0.0 || ^19.0.0
+    peerDependenciesMeta:
+      '@emotion/is-prop-valid':
+        optional: true
+      react:
+        optional: true
+      react-dom:
+        optional: true
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+  function.prototype.name@1.2.0:
+    resolution: {integrity: sha512-jObKIik1P2QjPHP5nz5BaOtUlfgS0fWo8IUByNXkM+o+02sJOi94em77GwJKQSJ3gfPHdgzLNrHc1uokV4P/ew==}
+    engines: {node: '>= 0.4'}
+
+  functions-have-names@1.2.3:
+    resolution: {integrity: sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==}
+
+  generator-function@2.0.1:
+    resolution: {integrity: sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==}
+    engines: {node: '>= 0.4'}
+
+  gensync@1.0.0-beta.2:
+    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
+    engines: {node: '>=6.9.0'}
+
+  get-intrinsic@1.3.0:
+    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
+    engines: {node: '>= 0.4'}
+
+  get-nonce@1.0.1:
+    resolution: {integrity: sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==}
+    engines: {node: '>=6'}
+
+  get-proto@1.0.1:
+    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+    engines: {node: '>= 0.4'}
+
+  get-symbol-description@1.1.0:
+    resolution: {integrity: sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==}
+    engines: {node: '>= 0.4'}
+
+  glob-parent@5.1.2:
+    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
+    engines: {node: '>= 6'}
+
+  glob-parent@6.0.2:
+    resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
+    engines: {node: '>=10.13.0'}
+
+  globals@14.0.0:
+    resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
+    engines: {node: '>=18'}
+
+  globals@17.6.0:
+    resolution: {integrity: sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==}
+    engines: {node: '>=18'}
+
+  globalthis@1.0.4:
+    resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==}
+    engines: {node: '>= 0.4'}
+
+  gopd@1.2.0:
+    resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
+    engines: {node: '>= 0.4'}
+
+  has-bigints@1.1.0:
+    resolution: {integrity: sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==}
+    engines: {node: '>= 0.4'}
+
+  has-flag@4.0.0:
+    resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
+    engines: {node: '>=8'}
+
+  has-property-descriptors@1.0.2:
+    resolution: {integrity: sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==}
+
+  has-proto@1.2.0:
+    resolution: {integrity: sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ==}
+    engines: {node: '>= 0.4'}
+
+  has-symbols@1.1.0:
+    resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
+    engines: {node: '>= 0.4'}
+
+  has-tostringtag@1.0.2:
+    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
+    engines: {node: '>= 0.4'}
+
+  hasown@2.0.3:
+    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+    engines: {node: '>= 0.4'}
+
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
+  hermes-estree@0.25.1:
+    resolution: {integrity: sha512-0wUoCcLp+5Ev5pDW2OriHC2MJCbwLwuRx+gAqMTOkGKJJiBCLjtrvy4PWUGn6MIVefecRpzoOZ/UV6iGdOr+Cw==}
+
+  hermes-parser@0.25.1:
+    resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}
+
+  html-parse-stringify@3.0.1:
+    resolution: {integrity: sha512-KknJ50kTInJ7qIScF3jeaFRpMpE8/lfiTdzf/twXyPBLAGrLRTmkz3AdTnKeh40X8k9L2fdYwEp/42WGXIRGcg==}
+
+  i18next@26.3.0:
+    resolution: {integrity: sha512-gHSgGpUXVmuqE2El1W61DmxeyeTlFfZgdJRWMo9jScAn5pu7TuTuiccb1zh3E2J9hEBVGJ23+96x0ieBhfuIHA==}
+    peerDependencies:
+      typescript: ^5 || ^6
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  ignore@5.3.2:
+    resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
+    engines: {node: '>= 4'}
+
+  ignore@7.0.5:
+    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
+    engines: {node: '>= 4'}
+
+  import-fresh@3.3.1:
+    resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
+    engines: {node: '>=6'}
+
+  imurmurhash@0.1.4:
+    resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
+    engines: {node: '>=0.8.19'}
+
+  internal-slot@1.1.0:
+    resolution: {integrity: sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
+    engines: {node: '>= 0.4'}
+
+  is-array-buffer@3.0.5:
+    resolution: {integrity: sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==}
+    engines: {node: '>= 0.4'}
+
+  is-async-function@2.1.1:
+    resolution: {integrity: sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ==}
+    engines: {node: '>= 0.4'}
+
+  is-bigint@1.1.0:
+    resolution: {integrity: sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ==}
+    engines: {node: '>= 0.4'}
+
+  is-binary-path@2.1.0:
+    resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
+    engines: {node: '>=8'}
+
+  is-boolean-object@1.2.2:
+    resolution: {integrity: sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==}
+    engines: {node: '>= 0.4'}
+
+  is-callable@1.2.7:
+    resolution: {integrity: sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==}
+    engines: {node: '>= 0.4'}
+
+  is-core-module@2.16.2:
+    resolution: {integrity: sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==}
+    engines: {node: '>= 0.4'}
+
+  is-data-view@1.0.2:
+    resolution: {integrity: sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw==}
+    engines: {node: '>= 0.4'}
+
+  is-date-object@1.1.0:
+    resolution: {integrity: sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==}
+    engines: {node: '>= 0.4'}
+
+  is-document.all@1.0.0:
+    resolution: {integrity: sha512-+XSoyS05OdBbhFuELhgTCpFNHkpBOJqtsZfUFFpe5QTw+9Sjbh8zitxhQkYAo6wV7e1Vb8cAPvpCk9jGam/82g==}
+    engines: {node: '>= 0.4'}
+
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
+  is-finalizationregistry@1.1.1:
+    resolution: {integrity: sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg==}
+    engines: {node: '>= 0.4'}
+
+  is-generator-function@1.1.2:
+    resolution: {integrity: sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==}
+    engines: {node: '>= 0.4'}
+
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
+  is-map@2.0.3:
+    resolution: {integrity: sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==}
+    engines: {node: '>= 0.4'}
+
+  is-negative-zero@2.0.3:
+    resolution: {integrity: sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw==}
+    engines: {node: '>= 0.4'}
+
+  is-number-object@1.1.1:
+    resolution: {integrity: sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw==}
+    engines: {node: '>= 0.4'}
+
+  is-number@7.0.0:
+    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
+    engines: {node: '>=0.12.0'}
+
+  is-regex@1.2.1:
+    resolution: {integrity: sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==}
+    engines: {node: '>= 0.4'}
+
+  is-set@2.0.3:
+    resolution: {integrity: sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg==}
+    engines: {node: '>= 0.4'}
+
+  is-shared-array-buffer@1.0.4:
+    resolution: {integrity: sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==}
+    engines: {node: '>= 0.4'}
+
+  is-string@1.1.1:
+    resolution: {integrity: sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==}
+    engines: {node: '>= 0.4'}
+
+  is-symbol@1.1.1:
+    resolution: {integrity: sha512-9gGx6GTtCQM73BgmHQXfDmLtfjjTUDSyoxTCbp5WtoixAhfgsDirWIcVQ/IHpvI5Vgd5i/J5F7B9cN/WlVbC/w==}
+    engines: {node: '>= 0.4'}
+
+  is-typed-array@1.1.15:
+    resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
+    engines: {node: '>= 0.4'}
+
+  is-weakmap@2.0.2:
+    resolution: {integrity: sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==}
+    engines: {node: '>= 0.4'}
+
+  is-weakref@1.1.1:
+    resolution: {integrity: sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew==}
+    engines: {node: '>= 0.4'}
+
+  is-weakset@2.0.4:
+    resolution: {integrity: sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==}
+    engines: {node: '>= 0.4'}
+
+  isarray@2.0.5:
+    resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
+
+  isexe@2.0.0:
+    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
+
+  iterator.prototype@1.1.5:
+    resolution: {integrity: sha512-H0dkQoCa3b2VEeKQBOxFph+JAbcrQdE7KC0UkqwpLmv2EC4P41QXP+rqo9wYodACiG5/WM5s9oDApTU8utwj9g==}
+    engines: {node: '>= 0.4'}
+
+  jiti@1.21.7:
+    resolution: {integrity: sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==}
+    hasBin: true
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  js-yaml@4.2.0:
+    resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
+    hasBin: true
+
+  jsesc@3.1.0:
+    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  json-buffer@3.0.1:
+    resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
+
+  json-schema-traverse@0.4.1:
+    resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
+
+  json-stable-stringify-without-jsonify@1.0.1:
+    resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  jsx-ast-utils@3.3.5:
+    resolution: {integrity: sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==}
+    engines: {node: '>=4.0'}
+
+  keyv@4.5.4:
+    resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
+
+  language-subtag-registry@0.3.23:
+    resolution: {integrity: sha512-0K65Lea881pHotoGEa5gDlMxt3pctLi2RplBb7Ezh4rRdLEOtgi7n4EwK9lamnUCkKBqaeKRVebTq6BAxSkpXQ==}
+
+  language-tags@1.0.9:
+    resolution: {integrity: sha512-MbjN408fEndfiQXbFQ1vnd+1NoLDsnQW41410oQBXiyXDMYH5z505juWa4KUE1LqxRC7DgOgZDbKLxHIwm27hA==}
+    engines: {node: '>=0.10'}
+
+  levn@0.4.1:
+    resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
+    engines: {node: '>= 0.8.0'}
+
+  lilconfig@3.1.3:
+    resolution: {integrity: sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==}
+    engines: {node: '>=14'}
+
+  lines-and-columns@1.2.4:
+    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
+
+  locate-path@6.0.0:
+    resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
+    engines: {node: '>=10'}
+
+  lodash.merge@4.6.2:
+    resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
+
+  loose-envify@1.4.0:
+    resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
+    hasBin: true
+
+  lru-cache@5.1.1:
+    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
+
+  lucide-react@0.566.0:
+    resolution: {integrity: sha512-b18qC/JAh1X9rVKlF5EtSIyumdIYuh78b0JShynZnHbcaWR4AW4oZyi8Ms/aQYVSnLPlAnMhug2hSr19BgVZAw==}
+    peerDependencies:
+      react: ^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  math-intrinsics@1.1.0:
+    resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
+    engines: {node: '>= 0.4'}
+
+  merge2@1.4.1:
+    resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
+    engines: {node: '>= 8'}
+
+  micromatch@4.0.8:
+    resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
+    engines: {node: '>=8.6'}
+
+  minimatch@10.2.5:
+    resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
+    engines: {node: 18 || 20 || >=22}
+
+  minimatch@3.1.5:
+    resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
+
+  motion-dom@12.40.0:
+    resolution: {integrity: sha512-HxU3ZaBwNPVQUBQf1xxgq+7JrPNZvjLVxgbpEZL7RrWJnsxOf0/OM+yrHG9ogLQ31Do/r57Oz2gQWPK+6q62mg==}
+
+  motion-utils@12.39.0:
+    resolution: {integrity: sha512-8nadJAJjTtqRkmRF36FoJTrywK9nnFmnPwnSMyxaOCU7GDjN9RTMJIxx9De8ErM+vpPhMccr/6fo5WciyQLnMQ==}
+
+  ms@2.1.3:
+    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+  mz@2.7.0:
+    resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
+
+  nanoid@3.3.12:
+    resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  natural-compare@1.4.0:
+    resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
+
+  node-exports-info@1.6.0:
+    resolution: {integrity: sha512-pyFS63ptit/P5WqUkt+UUfe+4oevH+bFeIiPPdfb0pFeYEu/1ELnJu5l+5EcTKYL5M7zaAa7S8ddywgXypqKCw==}
+    engines: {node: '>= 0.4'}
+
+  node-releases@2.0.46:
+    resolution: {integrity: sha512-GYVXHE2KnrzAfsAjl4uP++evGFCrAU1jta4ubEjIG7YWt/64Gqv66a30yKwWczVjA6j3bM4nBwH7Pk1JmDHaxQ==}
+    engines: {node: '>=18'}
+
+  normalize-path@3.0.0:
+    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
+    engines: {node: '>=0.10.0'}
+
+  object-assign@4.1.1:
+    resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
+    engines: {node: '>=0.10.0'}
+
+  object-hash@3.0.0:
+    resolution: {integrity: sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==}
+    engines: {node: '>= 6'}
+
+  object-inspect@1.13.4:
+    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
+    engines: {node: '>= 0.4'}
+
+  object-keys@1.1.1:
+    resolution: {integrity: sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==}
+    engines: {node: '>= 0.4'}
+
+  object.assign@4.1.7:
+    resolution: {integrity: sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw==}
+    engines: {node: '>= 0.4'}
+
+  object.entries@1.1.9:
+    resolution: {integrity: sha512-8u/hfXFRBD1O0hPUjioLhoWFHRmt6tKA4/vZPyckBr18l1KE9uHrFaFaUi8MDRTpi4uak2goyPTSNJLXX2k2Hw==}
+    engines: {node: '>= 0.4'}
+
+  object.fromentries@2.0.8:
+    resolution: {integrity: sha512-k6E21FzySsSK5a21KRADBd/NGneRegFO5pLHfdQLpRDETUNJueLXs3WCzyQ3tFRDYgbq3KHGXfTbi2bs8WQ6rQ==}
+    engines: {node: '>= 0.4'}
+
+  object.values@1.2.1:
+    resolution: {integrity: sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==}
+    engines: {node: '>= 0.4'}
+
+  optionator@0.9.4:
+    resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
+    engines: {node: '>= 0.8.0'}
+
+  own-keys@1.0.1:
+    resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==}
+    engines: {node: '>= 0.4'}
+
+  p-limit@3.1.0:
+    resolution: {integrity: sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
+    engines: {node: '>=10'}
+
+  p-locate@5.0.0:
+    resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
+    engines: {node: '>=10'}
+
+  parent-module@1.0.1:
+    resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
+    engines: {node: '>=6'}
+
+  path-exists@4.0.0:
+    resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
+    engines: {node: '>=8'}
+
+  path-key@3.1.1:
+    resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
+    engines: {node: '>=8'}
+
+  path-parse@1.0.7:
+    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@2.3.2:
+    resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
+    engines: {node: '>=8.6'}
+
+  picomatch@4.0.4:
+    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
+    engines: {node: '>=12'}
+
+  pify@2.3.0:
+    resolution: {integrity: sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==}
+    engines: {node: '>=0.10.0'}
+
+  pirates@4.0.7:
+    resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
+    engines: {node: '>= 6'}
+
+  possible-typed-array-names@1.1.0:
+    resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
+    engines: {node: '>= 0.4'}
+
+  postcss-import@15.1.0:
+    resolution: {integrity: sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      postcss: ^8.0.0
+
+  postcss-js@4.1.0:
+    resolution: {integrity: sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==}
+    engines: {node: ^12 || ^14 || >= 16}
+    peerDependencies:
+      postcss: ^8.4.21
+
+  postcss-load-config@6.0.1:
+    resolution: {integrity: sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==}
+    engines: {node: '>= 18'}
+    peerDependencies:
+      jiti: '>=1.21.0'
+      postcss: '>=8.0.9'
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+      postcss:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  postcss-nested@6.2.0:
+    resolution: {integrity: sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==}
+    engines: {node: '>=12.0'}
+    peerDependencies:
+      postcss: ^8.2.14
+
+  postcss-selector-parser@6.1.2:
+    resolution: {integrity: sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==}
+    engines: {node: '>=4'}
+
+  postcss-value-parser@4.2.0:
+    resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
+
+  postcss@8.5.15:
+    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  prelude-ls@1.2.1:
+    resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
+    engines: {node: '>= 0.8.0'}
+
+  prettier-plugin-tailwindcss@0.8.0:
+    resolution: {integrity: sha512-V8ITGH87yuBDF6JpEZTOVlUz/saAwqb8f3HRgUj8Lh+tGCcrmorhsLpYqzygwFwK0PE2Ib6Mv3M7T/uE2tZV1g==}
+    engines: {node: '>=20.19'}
+    peerDependencies:
+      '@ianvs/prettier-plugin-sort-imports': '*'
+      '@prettier/plugin-hermes': '*'
+      '@prettier/plugin-oxc': '*'
+      '@prettier/plugin-pug': '*'
+      '@shopify/prettier-plugin-liquid': '*'
+      '@trivago/prettier-plugin-sort-imports': '*'
+      '@zackad/prettier-plugin-twig': '*'
+      prettier: ^3.0
+      prettier-plugin-astro: '*'
+      prettier-plugin-css-order: '*'
+      prettier-plugin-jsdoc: '*'
+      prettier-plugin-marko: '*'
+      prettier-plugin-multiline-arrays: '*'
+      prettier-plugin-organize-attributes: '*'
+      prettier-plugin-organize-imports: '*'
+      prettier-plugin-sort-imports: '*'
+      prettier-plugin-svelte: '*'
+    peerDependenciesMeta:
+      '@ianvs/prettier-plugin-sort-imports':
+        optional: true
+      '@prettier/plugin-hermes':
+        optional: true
+      '@prettier/plugin-oxc':
+        optional: true
+      '@prettier/plugin-pug':
+        optional: true
+      '@shopify/prettier-plugin-liquid':
+        optional: true
+      '@trivago/prettier-plugin-sort-imports':
+        optional: true
+      '@zackad/prettier-plugin-twig':
+        optional: true
+      prettier-plugin-astro:
+        optional: true
+      prettier-plugin-css-order:
+        optional: true
+      prettier-plugin-jsdoc:
+        optional: true
+      prettier-plugin-marko:
+        optional: true
+      prettier-plugin-multiline-arrays:
+        optional: true
+      prettier-plugin-organize-attributes:
+        optional: true
+      prettier-plugin-organize-imports:
+        optional: true
+      prettier-plugin-sort-imports:
+        optional: true
+      prettier-plugin-svelte:
+        optional: true
+
+  prettier@3.8.3:
+    resolution: {integrity: sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==}
+    engines: {node: '>=14'}
+    hasBin: true
+
+  prop-types@15.8.1:
+    resolution: {integrity: sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==}
+
+  punycode@2.3.1:
+    resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
+    engines: {node: '>=6'}
+
+  queue-microtask@1.2.3:
+    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
+
+  react-dom@18.3.1:
+    resolution: {integrity: sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==}
+    peerDependencies:
+      react: ^18.3.1
+
+  react-i18next@17.0.8:
+    resolution: {integrity: sha512-0ooKbGLU8JXhe1zwpQUWIeXSgLPOfwJmgheWRIUpcoA0CpyabpGhayjdG+/eA5esC1AQ8h2jWpXjJfzQzeDOCw==}
+    peerDependencies:
+      i18next: '>= 26.2.0'
+      react: '>= 16.8.0'
+      react-dom: '*'
+      react-native: '*'
+      typescript: ^5 || ^6
+    peerDependenciesMeta:
+      react-dom:
+        optional: true
+      react-native:
+        optional: true
+      typescript:
+        optional: true
+
+  react-is@16.13.1:
+    resolution: {integrity: sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==}
+
+  react-loading-skeleton@3.5.0:
+    resolution: {integrity: sha512-gxxSyLbrEAdXTKgfbpBEFZCO/P153DnqSCQau2+o6lNy1jgMRr2MmRmOzMmyrwSaSYLRB8g7b0waYPmUjz7IhQ==}
+    peerDependencies:
+      react: '>=16.8.0'
+
+  react-refresh@0.17.0:
+    resolution: {integrity: sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ==}
+    engines: {node: '>=0.10.0'}
+
+  react-remove-scroll-bar@2.3.8:
+    resolution: {integrity: sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-remove-scroll@2.7.2:
+    resolution: {integrity: sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-router-dom@7.15.1:
+    resolution: {integrity: sha512-AzF62gjY6U9rkMq4RfP/r2EVtQ7DMfNMjyOp/flLTCrtRylLiK4wT4pSq6O8rOXZ2eXdZYJPEYe+ifomiv+Igg==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      react: '>=18'
+      react-dom: '>=18'
+
+  react-router@7.15.1:
+    resolution: {integrity: sha512-R8rl9HhgikFYoPJymnUtPXWbnDb3oget6lQnfIoupbt61aT9aOhRkDsY2XRhZRyX1Z/8a5sL74fXmFNm3NRK5A==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      react: '>=18'
+      react-dom: '>=18'
+    peerDependenciesMeta:
+      react-dom:
+        optional: true
+
+  react-style-singleton@2.2.3:
+    resolution: {integrity: sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-virtuoso@4.18.7:
+    resolution: {integrity: sha512-xNF5zDGEEIMB7cKwcen/pLig0YDf6OnfFrVgKFa7sHPf9fRem0CaLshyObbBcP88jzn0enavL39EgplgdyT21g==}
+    peerDependencies:
+      react: '>=16 || >=17 || >= 18 || >= 19'
+      react-dom: '>=16 || >=17 || >= 18 || >=19'
+
+  react@18.3.1:
+    resolution: {integrity: sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==}
+    engines: {node: '>=0.10.0'}
+
+  read-cache@1.0.0:
+    resolution: {integrity: sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==}
+
+  readdirp@3.6.0:
+    resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
+    engines: {node: '>=8.10.0'}
+
+  reflect.getprototypeof@1.0.10:
+    resolution: {integrity: sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==}
+    engines: {node: '>= 0.4'}
+
+  regexp.prototype.flags@1.5.4:
+    resolution: {integrity: sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
+    engines: {node: '>= 0.4'}
+
+  resolve-from@4.0.0:
+    resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
+    engines: {node: '>=4'}
+
+  resolve@1.22.12:
+    resolution: {integrity: sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
+  resolve@2.0.0-next.7:
+    resolution: {integrity: sha512-tqt+NBWwyaMgw3zDsnygx4CByWjQEJHOPMdslYhppaQSJUtL/D4JO9CcBBlhPoI8lz9oJIDXkwXfhF4aWqP8xQ==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  rollup@4.60.4:
+    resolution: {integrity: sha512-WHeFSbZYsPu3+bLoNRUuAO+wavNlocOPf3wSHTP7hcFKVnJeWsYlCDbr3mTS14FCizf9ccIxXA8sGL8zKeQN3g==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
+  run-parallel@1.2.0:
+    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
+
+  safe-array-concat@1.1.4:
+    resolution: {integrity: sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg==}
+    engines: {node: '>=0.4'}
+
+  safe-push-apply@1.0.0:
+    resolution: {integrity: sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==}
+    engines: {node: '>= 0.4'}
+
+  safe-regex-test@1.1.0:
+    resolution: {integrity: sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==}
+    engines: {node: '>= 0.4'}
+
+  scheduler@0.23.2:
+    resolution: {integrity: sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==}
+
+  semver@6.3.1:
+    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
+    hasBin: true
+
+  semver@7.8.4:
+    resolution: {integrity: sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  set-cookie-parser@2.7.2:
+    resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
+
+  set-function-length@1.2.2:
+    resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
+    engines: {node: '>= 0.4'}
+
+  set-function-name@2.0.2:
+    resolution: {integrity: sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==}
+    engines: {node: '>= 0.4'}
+
+  set-proto@1.0.0:
+    resolution: {integrity: sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==}
+    engines: {node: '>= 0.4'}
+
+  shebang-command@2.0.0:
+    resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
+    engines: {node: '>=8'}
+
+  shebang-regex@3.0.0:
+    resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
+    engines: {node: '>=8'}
+
+  side-channel-list@1.0.1:
+    resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-map@1.0.1:
+    resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-weakmap@1.0.2:
+    resolution: {integrity: sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
+    engines: {node: '>= 0.4'}
+
+  side-channel@1.1.1:
+    resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
+    engines: {node: '>= 0.4'}
+
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
+  stop-iteration-iterator@1.1.0:
+    resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.includes@2.0.1:
+    resolution: {integrity: sha512-o7+c9bW6zpAdJHTtujeePODAhkuicdAryFsfVKwA+wGw89wJ4GTY484WTucM9hLtDEOpOvI+aHnzqnC5lHp4Rg==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.matchall@4.0.12:
+    resolution: {integrity: sha512-6CC9uyBL+/48dYizRf7H7VAYCMCNTBeM78x/VTUe9bFEaxBepPJDa1Ow99LqI/1yF7kuy7Q3cQsYMrcjGUcskA==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.repeat@1.0.0:
+    resolution: {integrity: sha512-0u/TldDbKD8bFCQ/4f5+mNRrXwZ8hg2w7ZR8wa16e8z9XpePWl3eGEcUD0OXpEH/VJH/2G3gjUtR3ZOiBe2S/w==}
+
+  string.prototype.trim@1.2.11:
+    resolution: {integrity: sha512-PwvK7BU+CMTJGYQCTZb5RWXIML92lftJLhQz1tBzgKiqGxJaMlBAa48POXaNAC2s4y8jr3EFqrkF9+44neS46w==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trimend@1.0.10:
+    resolution: {integrity: sha512-2+3aDAOmPTmuFwjDnmJG2ctEkQKVki7vOSqaxkv42Mowj1V6PnvuwFCRrR5lChUux1TBskPjfkeTOhqczDMxTw==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trimstart@1.0.8:
+    resolution: {integrity: sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg==}
+    engines: {node: '>= 0.4'}
+
+  strip-json-comments@3.1.1:
+    resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
+    engines: {node: '>=8'}
+
+  sucrase@3.35.1:
+    resolution: {integrity: sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==}
+    engines: {node: '>=16 || 14 >=14.17'}
+    hasBin: true
+
+  supports-color@7.2.0:
+    resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
+    engines: {node: '>=8'}
+
+  supports-preserve-symlinks-flag@1.0.0:
+    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
+    engines: {node: '>= 0.4'}
+
+  tailwind-merge@2.6.1:
+    resolution: {integrity: sha512-Oo6tHdpZsGpkKG88HJ8RR1rg/RdnEkQEfMoEk2x1XRI3F1AxeU+ijRXpiVUF4UbLfcxxRGw6TbUINKYdWVsQTQ==}
+
+  tailwindcss-animate@1.0.7:
+    resolution: {integrity: sha512-bl6mpH3T7I3UFxuvDEXLxy/VuFxBk5bbzplh7tXI68mwMokNYd1t9qPBHlnyTwfa4JGC4zP516I1hYYtQ/vspA==}
+    peerDependencies:
+      tailwindcss: '>=3.0.0 || insiders'
+
+  tailwindcss@3.4.19:
+    resolution: {integrity: sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
+  thenify-all@1.6.0:
+    resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
+    engines: {node: '>=0.8'}
+
+  thenify@3.3.1:
+    resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
+
+  tinyglobby@0.2.16:
+    resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
+    engines: {node: '>=12.0.0'}
+
+  to-regex-range@5.0.1:
+    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
+    engines: {node: '>=8.0'}
+
+  ts-api-utils@2.5.0:
+    resolution: {integrity: sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==}
+    engines: {node: '>=18.12'}
+    peerDependencies:
+      typescript: '>=4.8.4'
+
+  ts-interface-checker@0.1.13:
+    resolution: {integrity: sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==}
+
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+  type-check@0.4.0:
+    resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
+    engines: {node: '>= 0.8.0'}
+
+  typed-array-buffer@1.0.3:
+    resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-byte-length@1.0.3:
+    resolution: {integrity: sha512-BaXgOuIxz8n8pIq3e7Atg/7s+DpiYrxn4vdot3w9KbnBhcRQq6o3xemQdIfynqSeXeDrF32x+WvfzmOjPiY9lg==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-byte-offset@1.0.4:
+    resolution: {integrity: sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-length@1.0.8:
+    resolution: {integrity: sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==}
+    engines: {node: '>= 0.4'}
+
+  typescript-eslint@8.61.1:
+    resolution: {integrity: sha512-V7PayAfJokV3pEHgN7/v03D1SpujhRfQtYLbLIiBfDDncdg4PAiRBfoS4cnCANK4jmAPncczi59QO3afiXUlNw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  typescript@5.9.3:
+    resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  unbox-primitive@1.1.0:
+    resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==}
+    engines: {node: '>= 0.4'}
+
+  undici-types@7.24.6:
+    resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
+
+  update-browserslist-db@1.2.3:
+    resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  uri-js@4.4.1:
+    resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
+
+  use-callback-ref@1.3.3:
+    resolution: {integrity: sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  use-sidecar@1.1.3:
+    resolution: {integrity: sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  use-sync-external-store@1.6.0:
+    resolution: {integrity: sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  util-deprecate@1.0.2:
+    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
+
+  vite@6.4.2:
+    resolution: {integrity: sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      jiti: '>=1.21.0'
+      less: '*'
+      lightningcss: ^1.21.0
+      sass: '*'
+      sass-embedded: '*'
+      stylus: '*'
+      sugarss: '*'
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  void-elements@3.1.0:
+    resolution: {integrity: sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==}
+    engines: {node: '>=0.10.0'}
+
+  which-boxed-primitive@1.1.1:
+    resolution: {integrity: sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==}
+    engines: {node: '>= 0.4'}
+
+  which-builtin-type@1.2.1:
+    resolution: {integrity: sha512-6iBczoX+kDQ7a3+YJBnh3T+KZRxM/iYNPXicqk66/Qfm1b93iu+yOImkg0zHbj5LNOcNv1TEADiZ0xa34B4q6Q==}
+    engines: {node: '>= 0.4'}
+
+  which-collection@1.0.2:
+    resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
+    engines: {node: '>= 0.4'}
+
+  which-typed-array@1.1.22:
+    resolution: {integrity: sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==}
+    engines: {node: '>= 0.4'}
+
+  which@2.0.2:
+    resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
+    engines: {node: '>= 8'}
+    hasBin: true
+
+  word-wrap@1.2.5:
+    resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
+    engines: {node: '>=0.10.0'}
+
+  yallist@3.1.1:
+    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
+
+  yocto-queue@0.1.0:
+    resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
+    engines: {node: '>=10'}
+
+  zod-validation-error@4.0.2:
+    resolution: {integrity: sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ==}
+    engines: {node: '>=18.0.0'}
+    peerDependencies:
+      zod: ^3.25.0 || ^4.0.0
+
+  zod@4.4.3:
+    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
+
+snapshots:
+
+  '@alloc/quick-lru@5.2.0': {}
+
+  '@babel/code-frame@7.29.7':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.29.7
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.29.7': {}
+
+  '@babel/core@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/helper-compilation-targets': 7.29.7
+      '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
+      '@babel/helpers': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/template': 7.29.7
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/generator@7.29.7':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
+  '@babel/helper-compilation-targets@7.29.7':
+    dependencies:
+      '@babel/compat-data': 7.29.7
+      '@babel/helper-validator-option': 7.29.7
+      browserslist: 4.28.2
+      lru-cache: 5.1.1
+      semver: 6.3.1
+
+  '@babel/helper-globals@7.29.7': {}
+
+  '@babel/helper-module-imports@7.29.7':
+    dependencies:
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-module-imports': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+      '@babel/traverse': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-plugin-utils@7.29.7': {}
+
+  '@babel/helper-string-parser@7.29.7': {}
+
+  '@babel/helper-validator-identifier@7.29.7': {}
+
+  '@babel/helper-validator-option@7.29.7': {}
+
+  '@babel/helpers@7.29.7':
+    dependencies:
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@babel/parser@7.29.7':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@babel/plugin-transform-react-jsx-self@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/plugin-transform-react-jsx-source@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/runtime@7.29.7': {}
+
+  '@babel/template@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@babel/traverse@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/helper-globals': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.7
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/types@7.29.7':
+    dependencies:
+      '@babel/helper-string-parser': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+
+  '@esbuild/aix-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm@0.25.12':
+    optional: true
+
+  '@esbuild/android-x64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-x64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/linux-loong64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-s390x@0.25.12':
+    optional: true
+
+  '@esbuild/linux-x64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/sunos-x64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/win32-x64@0.25.12':
+    optional: true
+
+  '@eslint-community/eslint-utils@4.9.1(eslint@9.39.4(jiti@1.21.7))':
+    dependencies:
+      eslint: 9.39.4(jiti@1.21.7)
+      eslint-visitor-keys: 3.4.3
+
+  '@eslint-community/regexpp@4.12.2': {}
+
+  '@eslint/config-array@0.21.2':
+    dependencies:
+      '@eslint/object-schema': 2.1.7
+      debug: 4.4.3
+      minimatch: 3.1.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/config-helpers@0.4.2':
+    dependencies:
+      '@eslint/core': 0.17.0
+
+  '@eslint/core@0.17.0':
+    dependencies:
+      '@types/json-schema': 7.0.15
+
+  '@eslint/eslintrc@3.3.5':
+    dependencies:
+      ajv: 6.15.0
+      debug: 4.4.3
+      espree: 10.4.0
+      globals: 14.0.0
+      ignore: 5.3.2
+      import-fresh: 3.3.1
+      js-yaml: 4.2.0
+      minimatch: 3.1.5
+      strip-json-comments: 3.1.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/js@10.0.1(eslint@9.39.4(jiti@1.21.7))':
+    optionalDependencies:
+      eslint: 9.39.4(jiti@1.21.7)
+
+  '@eslint/js@9.39.4': {}
+
+  '@eslint/object-schema@2.1.7': {}
+
+  '@eslint/plugin-kit@0.4.1':
+    dependencies:
+      '@eslint/core': 0.17.0
+      levn: 0.4.1
+
+  '@floating-ui/core@1.7.5':
+    dependencies:
+      '@floating-ui/utils': 0.2.11
+
+  '@floating-ui/dom@1.7.6':
+    dependencies:
+      '@floating-ui/core': 1.7.5
+      '@floating-ui/utils': 0.2.11
+
+  '@floating-ui/react-dom@2.1.8(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@floating-ui/dom': 1.7.6
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+
+  '@floating-ui/utils@0.2.11': {}
+
+  '@humanfs/core@0.19.2':
+    dependencies:
+      '@humanfs/types': 0.15.0
+
+  '@humanfs/node@0.16.8':
+    dependencies:
+      '@humanfs/core': 0.19.2
+      '@humanfs/types': 0.15.0
+      '@humanwhocodes/retry': 0.4.3
+
+  '@humanfs/types@0.15.0': {}
+
+  '@humanwhocodes/module-importer@1.0.1': {}
+
+  '@humanwhocodes/retry@0.4.3': {}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/remapping@2.3.5':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/resolve-uri@3.1.2': {}
+
+  '@jridgewell/sourcemap-codec@1.5.5': {}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@nodelib/fs.scandir@2.1.5':
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      run-parallel: 1.2.0
+
+  '@nodelib/fs.stat@2.0.5': {}
+
+  '@nodelib/fs.walk@1.2.8':
+    dependencies:
+      '@nodelib/fs.scandir': 2.1.5
+      fastq: 1.20.1
+
+  '@radix-ui/number@1.1.1': {}
+
+  '@radix-ui/primitive@1.1.3': {}
+
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-context@1.1.2(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-dialog@1.1.15(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      aria-hidden: 1.2.6
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      react-remove-scroll: 2.7.2(@types/react@18.3.29)(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-direction@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-dropdown-menu@2.1.16(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-id@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-label@2.1.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-menu@2.1.16(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      aria-hidden: 1.2.6
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      react-remove-scroll: 2.7.2(@types/react@18.3.29)(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-popover@1.1.15(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      aria-hidden: 1.2.6
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      react-remove-scroll: 2.7.2(@types/react@18.3.29)(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@floating-ui/react-dom': 2.1.8(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/rect': 1.1.1
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-presence@1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-primitive@2.1.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-slot': 1.2.4(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/number': 1.1.1
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-slot@1.2.3(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-slot@1.2.4(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-switch@1.2.6(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-tabs@1.1.13(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-previous@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-rect@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/rect': 1.1.1
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-size@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-visually-hidden@1.2.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/rect@1.1.1': {}
+
+  '@rolldown/pluginutils@1.0.0-beta.27': {}
+
+  '@rollup/rollup-android-arm-eabi@4.60.4':
+    optional: true
+
+  '@rollup/rollup-android-arm64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-darwin-arm64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-darwin-x64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-freebsd-arm64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-freebsd-x64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm-musleabihf@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-musl@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-musl@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-musl@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-musl@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-s390x-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-x64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-x64-musl@4.60.4':
+    optional: true
+
+  '@rollup/rollup-openbsd-x64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-openharmony-arm64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-win32-arm64-msvc@4.60.4':
+    optional: true
+
+  '@rollup/rollup-win32-ia32-msvc@4.60.4':
+    optional: true
+
+  '@rollup/rollup-win32-x64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-win32-x64-msvc@4.60.4':
+    optional: true
+
+  '@types/babel__core@7.20.5':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+      '@types/babel__generator': 7.27.0
+      '@types/babel__template': 7.4.4
+      '@types/babel__traverse': 7.28.0
+
+  '@types/babel__generator@7.27.0':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@types/babel__template@7.4.4':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@types/babel__traverse@7.28.0':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@types/estree@1.0.8': {}
+
+  '@types/json-schema@7.0.15': {}
+
+  '@types/node@25.9.1':
+    dependencies:
+      undici-types: 7.24.6
+
+  '@types/prop-types@15.7.15': {}
+
+  '@types/react-dom@18.3.7(@types/react@18.3.29)':
+    dependencies:
+      '@types/react': 18.3.29
+
+  '@types/react@18.3.29':
+    dependencies:
+      '@types/prop-types': 15.7.15
+      csstype: 3.2.3
+
+  '@typescript-eslint/eslint-plugin@8.61.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/regexpp': 4.12.2
+      '@typescript-eslint/parser': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/type-utils': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.61.1
+      eslint: 9.39.4(jiti@1.21.7)
+      ignore: 7.0.5
+      natural-compare: 1.4.0
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.61.1
+      debug: 4.4.3
+      eslint: 9.39.4(jiti@1.21.7)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.61.1(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/types': 8.61.1
+      debug: 4.4.3
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/scope-manager@8.61.1':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/visitor-keys': 8.61.1
+
+  '@typescript-eslint/tsconfig-utils@8.61.1(typescript@5.9.3)':
+    dependencies:
+      typescript: 5.9.3
+
+  '@typescript-eslint/type-utils@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      debug: 4.4.3
+      eslint: 9.39.4(jiti@1.21.7)
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/types@8.61.1': {}
+
+  '@typescript-eslint/typescript-estree@8.61.1(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/tsconfig-utils': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/visitor-keys': 8.61.1
+      debug: 4.4.3
+      minimatch: 10.2.5
+      semver: 7.8.4
+      tinyglobby: 0.2.16
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@1.21.7))
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@5.9.3)
+      eslint: 9.39.4(jiti@1.21.7)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/visitor-keys@8.61.1':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      eslint-visitor-keys: 5.0.1
+
+  '@vitejs/plugin-react@4.7.0(vite@6.4.2(@types/node@25.9.1)(jiti@1.21.7))':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/plugin-transform-react-jsx-self': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-react-jsx-source': 7.29.7(@babel/core@7.29.7)
+      '@rolldown/pluginutils': 1.0.0-beta.27
+      '@types/babel__core': 7.20.5
+      react-refresh: 0.17.0
+      vite: 6.4.2(@types/node@25.9.1)(jiti@1.21.7)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@wailsio/runtime@3.0.0-alpha.79': {}
+
+  acorn-jsx@5.3.2(acorn@8.17.0):
+    dependencies:
+      acorn: 8.17.0
+
+  acorn@8.17.0: {}
+
+  ajv@6.15.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-json-stable-stringify: 2.1.0
+      json-schema-traverse: 0.4.1
+      uri-js: 4.4.1
+
+  ansi-styles@4.3.0:
+    dependencies:
+      color-convert: 2.0.1
+
+  any-promise@1.3.0: {}
+
+  anymatch@3.1.3:
+    dependencies:
+      normalize-path: 3.0.0
+      picomatch: 2.3.2
+
+  arg@5.0.2: {}
+
+  argparse@2.0.1: {}
+
+  aria-hidden@1.2.6:
+    dependencies:
+      tslib: 2.8.1
+
+  aria-query@5.3.2: {}
+
+  array-buffer-byte-length@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      is-array-buffer: 3.0.5
+
+  array-includes@3.1.9:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      is-string: 1.1.1
+      math-intrinsics: 1.1.0
+
+  array.prototype.findlast@1.2.5:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.flat@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.flatmap@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.tosorted@1.1.4:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-shim-unscopables: 1.1.0
+
+  arraybuffer.prototype.slice@1.0.4:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      is-array-buffer: 3.0.5
+
+  ast-types-flow@0.0.8: {}
+
+  async-function@1.0.0: {}
+
+  autoprefixer@10.5.0(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      caniuse-lite: 1.0.30001793
+      fraction.js: 5.3.4
+      picocolors: 1.1.1
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  available-typed-arrays@1.0.7:
+    dependencies:
+      possible-typed-array-names: 1.1.0
+
+  axe-core@4.12.1: {}
+
+  axobject-query@4.1.0: {}
+
+  balanced-match@1.0.2: {}
+
+  balanced-match@4.0.4: {}
+
+  baseline-browser-mapping@2.10.32: {}
+
+  binary-extensions@2.3.0: {}
+
+  brace-expansion@1.1.15:
+    dependencies:
+      balanced-match: 1.0.2
+      concat-map: 0.0.1
+
+  brace-expansion@5.0.6:
+    dependencies:
+      balanced-match: 4.0.4
+
+  braces@3.0.3:
+    dependencies:
+      fill-range: 7.1.1
+
+  browserslist@4.28.2:
+    dependencies:
+      baseline-browser-mapping: 2.10.32
+      caniuse-lite: 1.0.30001793
+      electron-to-chromium: 1.5.362
+      node-releases: 2.0.46
+      update-browserslist-db: 1.2.3(browserslist@4.28.2)
+
+  call-bind-apply-helpers@1.0.2:
+    dependencies:
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+
+  call-bind@1.0.9:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      get-intrinsic: 1.3.0
+      set-function-length: 1.2.2
+
+  call-bound@1.0.4:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      get-intrinsic: 1.3.0
+
+  callsites@3.1.0: {}
+
+  camelcase-css@2.0.1: {}
+
+  caniuse-lite@1.0.30001793: {}
+
+  chalk@4.1.2:
+    dependencies:
+      ansi-styles: 4.3.0
+      supports-color: 7.2.0
+
+  chokidar@3.6.0:
+    dependencies:
+      anymatch: 3.1.3
+      braces: 3.0.3
+      glob-parent: 5.1.2
+      is-binary-path: 2.1.0
+      is-glob: 4.0.3
+      normalize-path: 3.0.0
+      readdirp: 3.6.0
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  class-variance-authority@0.7.1:
+    dependencies:
+      clsx: 2.1.1
+
+  clsx@2.1.1: {}
+
+  cmdk@1.1.1(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    transitivePeerDependencies:
+      - '@types/react'
+      - '@types/react-dom'
+
+  color-convert@2.0.1:
+    dependencies:
+      color-name: 1.1.4
+
+  color-name@1.1.4: {}
+
+  commander@4.1.1: {}
+
+  concat-map@0.0.1: {}
+
+  convert-source-map@2.0.0: {}
+
+  cookie@1.1.1: {}
+
+  cross-spawn@7.0.6:
+    dependencies:
+      path-key: 3.1.1
+      shebang-command: 2.0.0
+      which: 2.0.2
+
+  cssesc@3.0.0: {}
+
+  csstype@3.2.3: {}
+
+  damerau-levenshtein@1.0.8: {}
+
+  data-view-buffer@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  data-view-byte-length@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  data-view-byte-offset@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  debug@4.4.3:
+    dependencies:
+      ms: 2.1.3
+
+  deep-is@0.1.4: {}
+
+  define-data-property@1.1.4:
+    dependencies:
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  define-properties@1.2.1:
+    dependencies:
+      define-data-property: 1.1.4
+      has-property-descriptors: 1.0.2
+      object-keys: 1.1.1
+
+  detect-node-es@1.1.0: {}
+
+  didyoumean@1.2.2: {}
+
+  dlv@1.1.3: {}
+
+  doctrine@2.1.0:
+    dependencies:
+      esutils: 2.0.3
+
+  dunder-proto@1.0.1:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  electron-to-chromium@1.5.362: {}
+
+  emoji-regex@9.2.2: {}
+
+  es-abstract-get@1.0.0:
+    dependencies:
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      is-callable: 1.2.7
+      object-inspect: 1.13.4
+
+  es-abstract@1.24.2:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      arraybuffer.prototype.slice: 1.0.4
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      data-view-buffer: 1.0.2
+      data-view-byte-length: 1.0.2
+      data-view-byte-offset: 1.0.1
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      es-set-tostringtag: 2.1.0
+      es-to-primitive: 1.3.1
+      function.prototype.name: 1.2.0
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      get-symbol-description: 1.1.0
+      globalthis: 1.0.4
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+      has-proto: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.3
+      internal-slot: 1.1.0
+      is-array-buffer: 3.0.5
+      is-callable: 1.2.7
+      is-data-view: 1.0.2
+      is-negative-zero: 2.0.3
+      is-regex: 1.2.1
+      is-set: 2.0.3
+      is-shared-array-buffer: 1.0.4
+      is-string: 1.1.1
+      is-typed-array: 1.1.15
+      is-weakref: 1.1.1
+      math-intrinsics: 1.1.0
+      object-inspect: 1.13.4
+      object-keys: 1.1.1
+      object.assign: 4.1.7
+      own-keys: 1.0.1
+      regexp.prototype.flags: 1.5.4
+      safe-array-concat: 1.1.4
+      safe-push-apply: 1.0.0
+      safe-regex-test: 1.1.0
+      set-proto: 1.0.0
+      stop-iteration-iterator: 1.1.0
+      string.prototype.trim: 1.2.11
+      string.prototype.trimend: 1.0.10
+      string.prototype.trimstart: 1.0.8
+      typed-array-buffer: 1.0.3
+      typed-array-byte-length: 1.0.3
+      typed-array-byte-offset: 1.0.4
+      typed-array-length: 1.0.8
+      unbox-primitive: 1.1.0
+      which-typed-array: 1.1.22
+
+  es-define-property@1.0.1: {}
+
+  es-errors@1.3.0: {}
+
+  es-iterator-helpers@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-set-tostringtag: 2.1.0
+      function-bind: 1.1.2
+      get-intrinsic: 1.3.0
+      globalthis: 1.0.4
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+      has-proto: 1.2.0
+      has-symbols: 1.1.0
+      internal-slot: 1.1.0
+      iterator.prototype: 1.1.5
+      math-intrinsics: 1.1.0
+
+  es-object-atoms@1.1.2:
+    dependencies:
+      es-errors: 1.3.0
+
+  es-set-tostringtag@2.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.3
+
+  es-shim-unscopables@1.1.0:
+    dependencies:
+      hasown: 2.0.3
+
+  es-to-primitive@1.3.1:
+    dependencies:
+      es-abstract-get: 1.0.0
+      es-errors: 1.3.0
+      is-callable: 1.2.7
+      is-date-object: 1.1.0
+      is-symbol: 1.1.1
+
+  esbuild@0.25.12:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.25.12
+      '@esbuild/android-arm': 0.25.12
+      '@esbuild/android-arm64': 0.25.12
+      '@esbuild/android-x64': 0.25.12
+      '@esbuild/darwin-arm64': 0.25.12
+      '@esbuild/darwin-x64': 0.25.12
+      '@esbuild/freebsd-arm64': 0.25.12
+      '@esbuild/freebsd-x64': 0.25.12
+      '@esbuild/linux-arm': 0.25.12
+      '@esbuild/linux-arm64': 0.25.12
+      '@esbuild/linux-ia32': 0.25.12
+      '@esbuild/linux-loong64': 0.25.12
+      '@esbuild/linux-mips64el': 0.25.12
+      '@esbuild/linux-ppc64': 0.25.12
+      '@esbuild/linux-riscv64': 0.25.12
+      '@esbuild/linux-s390x': 0.25.12
+      '@esbuild/linux-x64': 0.25.12
+      '@esbuild/netbsd-arm64': 0.25.12
+      '@esbuild/netbsd-x64': 0.25.12
+      '@esbuild/openbsd-arm64': 0.25.12
+      '@esbuild/openbsd-x64': 0.25.12
+      '@esbuild/openharmony-arm64': 0.25.12
+      '@esbuild/sunos-x64': 0.25.12
+      '@esbuild/win32-arm64': 0.25.12
+      '@esbuild/win32-ia32': 0.25.12
+      '@esbuild/win32-x64': 0.25.12
+
+  escalade@3.2.0: {}
+
+  escape-string-regexp@4.0.0: {}
+
+  eslint-plugin-jsx-a11y@6.10.2(eslint@9.39.4(jiti@1.21.7)):
+    dependencies:
+      aria-query: 5.3.2
+      array-includes: 3.1.9
+      array.prototype.flatmap: 1.3.3
+      ast-types-flow: 0.0.8
+      axe-core: 4.12.1
+      axobject-query: 4.1.0
+      damerau-levenshtein: 1.0.8
+      emoji-regex: 9.2.2
+      eslint: 9.39.4(jiti@1.21.7)
+      hasown: 2.0.3
+      jsx-ast-utils: 3.3.5
+      language-tags: 1.0.9
+      minimatch: 3.1.5
+      object.fromentries: 2.0.8
+      safe-regex-test: 1.1.0
+      string.prototype.includes: 2.0.1
+
+  eslint-plugin-react-hooks@7.1.1(eslint@9.39.4(jiti@1.21.7)):
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/parser': 7.29.7
+      eslint: 9.39.4(jiti@1.21.7)
+      hermes-parser: 0.25.1
+      zod: 4.4.3
+      zod-validation-error: 4.0.2(zod@4.4.3)
+    transitivePeerDependencies:
+      - supports-color
+
+  eslint-plugin-react-refresh@0.5.3(eslint@9.39.4(jiti@1.21.7)):
+    dependencies:
+      eslint: 9.39.4(jiti@1.21.7)
+
+  eslint-plugin-react@7.37.5(eslint@9.39.4(jiti@1.21.7)):
+    dependencies:
+      array-includes: 3.1.9
+      array.prototype.findlast: 1.2.5
+      array.prototype.flatmap: 1.3.3
+      array.prototype.tosorted: 1.1.4
+      doctrine: 2.1.0
+      es-iterator-helpers: 1.3.3
+      eslint: 9.39.4(jiti@1.21.7)
+      estraverse: 5.3.0
+      hasown: 2.0.3
+      jsx-ast-utils: 3.3.5
+      minimatch: 3.1.5
+      object.entries: 1.1.9
+      object.fromentries: 2.0.8
+      object.values: 1.2.1
+      prop-types: 15.8.1
+      resolve: 2.0.0-next.7
+      semver: 6.3.1
+      string.prototype.matchall: 4.0.12
+      string.prototype.repeat: 1.0.0
+
+  eslint-scope@8.4.0:
+    dependencies:
+      esrecurse: 4.3.0
+      estraverse: 5.3.0
+
+  eslint-visitor-keys@3.4.3: {}
+
+  eslint-visitor-keys@4.2.1: {}
+
+  eslint-visitor-keys@5.0.1: {}
+
+  eslint@9.39.4(jiti@1.21.7):
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@1.21.7))
+      '@eslint-community/regexpp': 4.12.2
+      '@eslint/config-array': 0.21.2
+      '@eslint/config-helpers': 0.4.2
+      '@eslint/core': 0.17.0
+      '@eslint/eslintrc': 3.3.5
+      '@eslint/js': 9.39.4
+      '@eslint/plugin-kit': 0.4.1
+      '@humanfs/node': 0.16.8
+      '@humanwhocodes/module-importer': 1.0.1
+      '@humanwhocodes/retry': 0.4.3
+      '@types/estree': 1.0.8
+      ajv: 6.15.0
+      chalk: 4.1.2
+      cross-spawn: 7.0.6
+      debug: 4.4.3
+      escape-string-regexp: 4.0.0
+      eslint-scope: 8.4.0
+      eslint-visitor-keys: 4.2.1
+      espree: 10.4.0
+      esquery: 1.7.0
+      esutils: 2.0.3
+      fast-deep-equal: 3.1.3
+      file-entry-cache: 8.0.0
+      find-up: 5.0.0
+      glob-parent: 6.0.2
+      ignore: 5.3.2
+      imurmurhash: 0.1.4
+      is-glob: 4.0.3
+      json-stable-stringify-without-jsonify: 1.0.1
+      lodash.merge: 4.6.2
+      minimatch: 3.1.5
+      natural-compare: 1.4.0
+      optionator: 0.9.4
+    optionalDependencies:
+      jiti: 1.21.7
+    transitivePeerDependencies:
+      - supports-color
+
+  espree@10.4.0:
+    dependencies:
+      acorn: 8.17.0
+      acorn-jsx: 5.3.2(acorn@8.17.0)
+      eslint-visitor-keys: 4.2.1
+
+  esquery@1.7.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  esrecurse@4.3.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  estraverse@5.3.0: {}
+
+  esutils@2.0.3: {}
+
+  fast-deep-equal@3.1.3: {}
+
+  fast-glob@3.3.3:
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      '@nodelib/fs.walk': 1.2.8
+      glob-parent: 5.1.2
+      merge2: 1.4.1
+      micromatch: 4.0.8
+
+  fast-json-stable-stringify@2.1.0: {}
+
+  fast-levenshtein@2.0.6: {}
+
+  fastq@1.20.1:
+    dependencies:
+      reusify: 1.1.0
+
+  fdir@6.5.0(picomatch@4.0.4):
+    optionalDependencies:
+      picomatch: 4.0.4
+
+  file-entry-cache@8.0.0:
+    dependencies:
+      flat-cache: 4.0.1
+
+  fill-range@7.1.1:
+    dependencies:
+      to-regex-range: 5.0.1
+
+  find-up@5.0.0:
+    dependencies:
+      locate-path: 6.0.0
+      path-exists: 4.0.0
+
+  flat-cache@4.0.1:
+    dependencies:
+      flatted: 3.4.2
+      keyv: 4.5.4
+
+  flatted@3.4.2: {}
+
+  for-each@0.3.5:
+    dependencies:
+      is-callable: 1.2.7
+
+  fraction.js@5.3.4: {}
+
+  framer-motion@12.40.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      motion-dom: 12.40.0
+      motion-utils: 12.39.0
+      tslib: 2.8.1
+    optionalDependencies:
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+
+  fsevents@2.3.3:
+    optional: true
+
+  function-bind@1.1.2: {}
+
+  function.prototype.name@1.2.0:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      functions-have-names: 1.2.3
+      has-property-descriptors: 1.0.2
+      hasown: 2.0.4
+      is-callable: 1.2.7
+      is-document.all: 1.0.0
+
+  functions-have-names@1.2.3: {}
+
+  generator-function@2.0.1: {}
+
+  gensync@1.0.0-beta.2: {}
+
+  get-intrinsic@1.3.0:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      function-bind: 1.1.2
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.3
+      math-intrinsics: 1.1.0
+
+  get-nonce@1.0.1: {}
+
+  get-proto@1.0.1:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-object-atoms: 1.1.2
+
+  get-symbol-description@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+
+  glob-parent@5.1.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob-parent@6.0.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  globals@14.0.0: {}
+
+  globals@17.6.0: {}
+
+  globalthis@1.0.4:
+    dependencies:
+      define-properties: 1.2.1
+      gopd: 1.2.0
+
+  gopd@1.2.0: {}
+
+  has-bigints@1.1.0: {}
+
+  has-flag@4.0.0: {}
+
+  has-property-descriptors@1.0.2:
+    dependencies:
+      es-define-property: 1.0.1
+
+  has-proto@1.2.0:
+    dependencies:
+      dunder-proto: 1.0.1
+
+  has-symbols@1.1.0: {}
+
+  has-tostringtag@1.0.2:
+    dependencies:
+      has-symbols: 1.1.0
+
+  hasown@2.0.3:
+    dependencies:
+      function-bind: 1.1.2
+
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
+  hermes-estree@0.25.1: {}
+
+  hermes-parser@0.25.1:
+    dependencies:
+      hermes-estree: 0.25.1
+
+  html-parse-stringify@3.0.1:
+    dependencies:
+      void-elements: 3.1.0
+
+  i18next@26.3.0(typescript@5.9.3):
+    optionalDependencies:
+      typescript: 5.9.3
+
+  ignore@5.3.2: {}
+
+  ignore@7.0.5: {}
+
+  import-fresh@3.3.1:
+    dependencies:
+      parent-module: 1.0.1
+      resolve-from: 4.0.0
+
+  imurmurhash@0.1.4: {}
+
+  internal-slot@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      hasown: 2.0.3
+      side-channel: 1.1.1
+
+  is-array-buffer@3.0.5:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+
+  is-async-function@2.1.1:
+    dependencies:
+      async-function: 1.0.0
+      call-bound: 1.0.4
+      get-proto: 1.0.1
+      has-tostringtag: 1.0.2
+      safe-regex-test: 1.1.0
+
+  is-bigint@1.1.0:
+    dependencies:
+      has-bigints: 1.1.0
+
+  is-binary-path@2.1.0:
+    dependencies:
+      binary-extensions: 2.3.0
+
+  is-boolean-object@1.2.2:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-callable@1.2.7: {}
+
+  is-core-module@2.16.2:
+    dependencies:
+      hasown: 2.0.3
+
+  is-data-view@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      is-typed-array: 1.1.15
+
+  is-date-object@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-document.all@1.0.0:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-extglob@2.1.1: {}
+
+  is-finalizationregistry@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-generator-function@1.1.2:
+    dependencies:
+      call-bound: 1.0.4
+      generator-function: 2.0.1
+      get-proto: 1.0.1
+      has-tostringtag: 1.0.2
+      safe-regex-test: 1.1.0
+
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
+  is-map@2.0.3: {}
+
+  is-negative-zero@2.0.3: {}
+
+  is-number-object@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-number@7.0.0: {}
+
+  is-regex@1.2.1:
+    dependencies:
+      call-bound: 1.0.4
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.3
+
+  is-set@2.0.3: {}
+
+  is-shared-array-buffer@1.0.4:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-string@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-symbol@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-symbols: 1.1.0
+      safe-regex-test: 1.1.0
+
+  is-typed-array@1.1.15:
+    dependencies:
+      which-typed-array: 1.1.22
+
+  is-weakmap@2.0.2: {}
+
+  is-weakref@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-weakset@2.0.4:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+
+  isarray@2.0.5: {}
+
+  isexe@2.0.0: {}
+
+  iterator.prototype@1.1.5:
+    dependencies:
+      define-data-property: 1.1.4
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      has-symbols: 1.1.0
+      set-function-name: 2.0.2
+
+  jiti@1.21.7: {}
+
+  js-tokens@4.0.0: {}
+
+  js-yaml@4.2.0:
+    dependencies:
+      argparse: 2.0.1
+
+  jsesc@3.1.0: {}
+
+  json-buffer@3.0.1: {}
+
+  json-schema-traverse@0.4.1: {}
+
+  json-stable-stringify-without-jsonify@1.0.1: {}
+
+  json5@2.2.3: {}
+
+  jsx-ast-utils@3.3.5:
+    dependencies:
+      array-includes: 3.1.9
+      array.prototype.flat: 1.3.3
+      object.assign: 4.1.7
+      object.values: 1.2.1
+
+  keyv@4.5.4:
+    dependencies:
+      json-buffer: 3.0.1
+
+  language-subtag-registry@0.3.23: {}
+
+  language-tags@1.0.9:
+    dependencies:
+      language-subtag-registry: 0.3.23
+
+  levn@0.4.1:
+    dependencies:
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+
+  lilconfig@3.1.3: {}
+
+  lines-and-columns@1.2.4: {}
+
+  locate-path@6.0.0:
+    dependencies:
+      p-locate: 5.0.0
+
+  lodash.merge@4.6.2: {}
+
+  loose-envify@1.4.0:
+    dependencies:
+      js-tokens: 4.0.0
+
+  lru-cache@5.1.1:
+    dependencies:
+      yallist: 3.1.1
+
+  lucide-react@0.566.0(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+
+  math-intrinsics@1.1.0: {}
+
+  merge2@1.4.1: {}
+
+  micromatch@4.0.8:
+    dependencies:
+      braces: 3.0.3
+      picomatch: 2.3.2
+
+  minimatch@10.2.5:
+    dependencies:
+      brace-expansion: 5.0.6
+
+  minimatch@3.1.5:
+    dependencies:
+      brace-expansion: 1.1.15
+
+  motion-dom@12.40.0:
+    dependencies:
+      motion-utils: 12.39.0
+
+  motion-utils@12.39.0: {}
+
+  ms@2.1.3: {}
+
+  mz@2.7.0:
+    dependencies:
+      any-promise: 1.3.0
+      object-assign: 4.1.1
+      thenify-all: 1.6.0
+
+  nanoid@3.3.12: {}
+
+  natural-compare@1.4.0: {}
+
+  node-exports-info@1.6.0:
+    dependencies:
+      array.prototype.flatmap: 1.3.3
+      es-errors: 1.3.0
+      object.entries: 1.1.9
+      semver: 6.3.1
+
+  node-releases@2.0.46: {}
+
+  normalize-path@3.0.0: {}
+
+  object-assign@4.1.1: {}
+
+  object-hash@3.0.0: {}
+
+  object-inspect@1.13.4: {}
+
+  object-keys@1.1.1: {}
+
+  object.assign@4.1.7:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+      has-symbols: 1.1.0
+      object-keys: 1.1.1
+
+  object.entries@1.1.9:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  object.fromentries@2.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.2
+
+  object.values@1.2.1:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  optionator@0.9.4:
+    dependencies:
+      deep-is: 0.1.4
+      fast-levenshtein: 2.0.6
+      levn: 0.4.1
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+      word-wrap: 1.2.5
+
+  own-keys@1.0.1:
+    dependencies:
+      get-intrinsic: 1.3.0
+      object-keys: 1.1.1
+      safe-push-apply: 1.0.0
+
+  p-limit@3.1.0:
+    dependencies:
+      yocto-queue: 0.1.0
+
+  p-locate@5.0.0:
+    dependencies:
+      p-limit: 3.1.0
+
+  parent-module@1.0.1:
+    dependencies:
+      callsites: 3.1.0
+
+  path-exists@4.0.0: {}
+
+  path-key@3.1.1: {}
+
+  path-parse@1.0.7: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@2.3.2: {}
+
+  picomatch@4.0.4: {}
+
+  pify@2.3.0: {}
+
+  pirates@4.0.7: {}
+
+  possible-typed-array-names@1.1.0: {}
+
+  postcss-import@15.1.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+      read-cache: 1.0.0
+      resolve: 1.22.12
+
+  postcss-js@4.1.0(postcss@8.5.15):
+    dependencies:
+      camelcase-css: 2.0.1
+      postcss: 8.5.15
+
+  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.15):
+    dependencies:
+      lilconfig: 3.1.3
+    optionalDependencies:
+      jiti: 1.21.7
+      postcss: 8.5.15
+
+  postcss-nested@6.2.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-selector-parser: 6.1.2
+
+  postcss-selector-parser@6.1.2:
+    dependencies:
+      cssesc: 3.0.0
+      util-deprecate: 1.0.2
+
+  postcss-value-parser@4.2.0: {}
+
+  postcss@8.5.15:
+    dependencies:
+      nanoid: 3.3.12
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  prelude-ls@1.2.1: {}
+
+  prettier-plugin-tailwindcss@0.8.0(prettier@3.8.3):
+    dependencies:
+      prettier: 3.8.3
+
+  prettier@3.8.3: {}
+
+  prop-types@15.8.1:
+    dependencies:
+      loose-envify: 1.4.0
+      object-assign: 4.1.1
+      react-is: 16.13.1
+
+  punycode@2.3.1: {}
+
+  queue-microtask@1.2.3: {}
+
+  react-dom@18.3.1(react@18.3.1):
+    dependencies:
+      loose-envify: 1.4.0
+      react: 18.3.1
+      scheduler: 0.23.2
+
+  react-i18next@17.0.8(i18next@26.3.0(typescript@5.9.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.9.3):
+    dependencies:
+      '@babel/runtime': 7.29.7
+      html-parse-stringify: 3.0.1
+      i18next: 26.3.0(typescript@5.9.3)
+      react: 18.3.1
+      use-sync-external-store: 1.6.0(react@18.3.1)
+    optionalDependencies:
+      react-dom: 18.3.1(react@18.3.1)
+      typescript: 5.9.3
+
+  react-is@16.13.1: {}
+
+  react-loading-skeleton@3.5.0(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+
+  react-refresh@0.17.0: {}
+
+  react-remove-scroll-bar@2.3.8(@types/react@18.3.29)(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      react-style-singleton: 2.2.3(@types/react@18.3.29)(react@18.3.1)
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  react-remove-scroll@2.7.2(@types/react@18.3.29)(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      react-remove-scroll-bar: 2.3.8(@types/react@18.3.29)(react@18.3.1)
+      react-style-singleton: 2.2.3(@types/react@18.3.29)(react@18.3.1)
+      tslib: 2.8.1
+      use-callback-ref: 1.3.3(@types/react@18.3.29)(react@18.3.1)
+      use-sidecar: 1.1.3(@types/react@18.3.29)(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  react-router-dom@7.15.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      react-router: 7.15.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+
+  react-router@7.15.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      cookie: 1.1.1
+      react: 18.3.1
+      set-cookie-parser: 2.7.2
+    optionalDependencies:
+      react-dom: 18.3.1(react@18.3.1)
+
+  react-style-singleton@2.2.3(@types/react@18.3.29)(react@18.3.1):
+    dependencies:
+      get-nonce: 1.0.1
+      react: 18.3.1
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  react-virtuoso@4.18.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+
+  react@18.3.1:
+    dependencies:
+      loose-envify: 1.4.0
+
+  read-cache@1.0.0:
+    dependencies:
+      pify: 2.3.0
+
+  readdirp@3.6.0:
+    dependencies:
+      picomatch: 2.3.2
+
+  reflect.getprototypeof@1.0.10:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      which-builtin-type: 1.2.1
+
+  regexp.prototype.flags@1.5.4:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-errors: 1.3.0
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      set-function-name: 2.0.2
+
+  resolve-from@4.0.0: {}
+
+  resolve@1.22.12:
+    dependencies:
+      es-errors: 1.3.0
+      is-core-module: 2.16.2
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
+  resolve@2.0.0-next.7:
+    dependencies:
+      es-errors: 1.3.0
+      is-core-module: 2.16.2
+      node-exports-info: 1.6.0
+      object-keys: 1.1.1
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
+  reusify@1.1.0: {}
+
+  rollup@4.60.4:
+    dependencies:
+      '@types/estree': 1.0.8
+    optionalDependencies:
+      '@rollup/rollup-android-arm-eabi': 4.60.4
+      '@rollup/rollup-android-arm64': 4.60.4
+      '@rollup/rollup-darwin-arm64': 4.60.4
+      '@rollup/rollup-darwin-x64': 4.60.4
+      '@rollup/rollup-freebsd-arm64': 4.60.4
+      '@rollup/rollup-freebsd-x64': 4.60.4
+      '@rollup/rollup-linux-arm-gnueabihf': 4.60.4
+      '@rollup/rollup-linux-arm-musleabihf': 4.60.4
+      '@rollup/rollup-linux-arm64-gnu': 4.60.4
+      '@rollup/rollup-linux-arm64-musl': 4.60.4
+      '@rollup/rollup-linux-loong64-gnu': 4.60.4
+      '@rollup/rollup-linux-loong64-musl': 4.60.4
+      '@rollup/rollup-linux-ppc64-gnu': 4.60.4
+      '@rollup/rollup-linux-ppc64-musl': 4.60.4
+      '@rollup/rollup-linux-riscv64-gnu': 4.60.4
+      '@rollup/rollup-linux-riscv64-musl': 4.60.4
+      '@rollup/rollup-linux-s390x-gnu': 4.60.4
+      '@rollup/rollup-linux-x64-gnu': 4.60.4
+      '@rollup/rollup-linux-x64-musl': 4.60.4
+      '@rollup/rollup-openbsd-x64': 4.60.4
+      '@rollup/rollup-openharmony-arm64': 4.60.4
+      '@rollup/rollup-win32-arm64-msvc': 4.60.4
+      '@rollup/rollup-win32-ia32-msvc': 4.60.4
+      '@rollup/rollup-win32-x64-gnu': 4.60.4
+      '@rollup/rollup-win32-x64-msvc': 4.60.4
+      fsevents: 2.3.3
+
+  run-parallel@1.2.0:
+    dependencies:
+      queue-microtask: 1.2.3
+
+  safe-array-concat@1.1.4:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      has-symbols: 1.1.0
+      isarray: 2.0.5
+
+  safe-push-apply@1.0.0:
+    dependencies:
+      es-errors: 1.3.0
+      isarray: 2.0.5
+
+  safe-regex-test@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-regex: 1.2.1
+
+  scheduler@0.23.2:
+    dependencies:
+      loose-envify: 1.4.0
+
+  semver@6.3.1: {}
+
+  semver@7.8.4: {}
+
+  set-cookie-parser@2.7.2: {}
+
+  set-function-length@1.2.2:
+    dependencies:
+      define-data-property: 1.1.4
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+      get-intrinsic: 1.3.0
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+
+  set-function-name@2.0.2:
+    dependencies:
+      define-data-property: 1.1.4
+      es-errors: 1.3.0
+      functions-have-names: 1.2.3
+      has-property-descriptors: 1.0.2
+
+  set-proto@1.0.0:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+
+  shebang-command@2.0.0:
+    dependencies:
+      shebang-regex: 3.0.0
+
+  shebang-regex@3.0.0: {}
+
+  side-channel-list@1.0.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-map@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-weakmap@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-map: 1.0.1
+
+  side-channel@1.1.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-list: 1.0.1
+      side-channel-map: 1.0.1
+      side-channel-weakmap: 1.0.2
+
+  source-map-js@1.2.1: {}
+
+  stop-iteration-iterator@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      internal-slot: 1.1.0
+
+  string.prototype.includes@2.0.1:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+
+  string.prototype.matchall@4.0.12:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      internal-slot: 1.1.0
+      regexp.prototype.flags: 1.5.4
+      set-function-name: 2.0.2
+      side-channel: 1.1.1
+
+  string.prototype.repeat@1.0.0:
+    dependencies:
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+
+  string.prototype.trim@1.2.11:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-data-property: 1.1.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.2
+      has-property-descriptors: 1.0.2
+      safe-regex-test: 1.1.0
+
+  string.prototype.trimend@1.0.10:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  string.prototype.trimstart@1.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  strip-json-comments@3.1.1: {}
+
+  sucrase@3.35.1:
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      commander: 4.1.1
+      lines-and-columns: 1.2.4
+      mz: 2.7.0
+      pirates: 4.0.7
+      tinyglobby: 0.2.16
+      ts-interface-checker: 0.1.13
+
+  supports-color@7.2.0:
+    dependencies:
+      has-flag: 4.0.0
+
+  supports-preserve-symlinks-flag@1.0.0: {}
+
+  tailwind-merge@2.6.1: {}
+
+  tailwindcss-animate@1.0.7(tailwindcss@3.4.19):
+    dependencies:
+      tailwindcss: 3.4.19
+
+  tailwindcss@3.4.19:
+    dependencies:
+      '@alloc/quick-lru': 5.2.0
+      arg: 5.0.2
+      chokidar: 3.6.0
+      didyoumean: 1.2.2
+      dlv: 1.1.3
+      fast-glob: 3.3.3
+      glob-parent: 6.0.2
+      is-glob: 4.0.3
+      jiti: 1.21.7
+      lilconfig: 3.1.3
+      micromatch: 4.0.8
+      normalize-path: 3.0.0
+      object-hash: 3.0.0
+      picocolors: 1.1.1
+      postcss: 8.5.15
+      postcss-import: 15.1.0(postcss@8.5.15)
+      postcss-js: 4.1.0(postcss@8.5.15)
+      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.15)
+      postcss-nested: 6.2.0(postcss@8.5.15)
+      postcss-selector-parser: 6.1.2
+      resolve: 1.22.12
+      sucrase: 3.35.1
+    transitivePeerDependencies:
+      - tsx
+      - yaml
+
+  thenify-all@1.6.0:
+    dependencies:
+      thenify: 3.3.1
+
+  thenify@3.3.1:
+    dependencies:
+      any-promise: 1.3.0
+
+  tinyglobby@0.2.16:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
+
+  to-regex-range@5.0.1:
+    dependencies:
+      is-number: 7.0.0
+
+  ts-api-utils@2.5.0(typescript@5.9.3):
+    dependencies:
+      typescript: 5.9.3
+
+  ts-interface-checker@0.1.13: {}
+
+  tslib@2.8.1: {}
+
+  type-check@0.4.0:
+    dependencies:
+      prelude-ls: 1.2.1
+
+  typed-array-buffer@1.0.3:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-typed-array: 1.1.15
+
+  typed-array-byte-length@1.0.3:
+    dependencies:
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      has-proto: 1.2.0
+      is-typed-array: 1.1.15
+
+  typed-array-byte-offset@1.0.4:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      has-proto: 1.2.0
+      is-typed-array: 1.1.15
+      reflect.getprototypeof: 1.0.10
+
+  typed-array-length@1.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      is-typed-array: 1.1.15
+      possible-typed-array-names: 1.1.0
+      reflect.getprototypeof: 1.0.10
+
+  typescript-eslint@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3):
+    dependencies:
+      '@typescript-eslint/eslint-plugin': 8.61.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      eslint: 9.39.4(jiti@1.21.7)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  typescript@5.9.3: {}
+
+  unbox-primitive@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      has-bigints: 1.1.0
+      has-symbols: 1.1.0
+      which-boxed-primitive: 1.1.1
+
+  undici-types@7.24.6: {}
+
+  update-browserslist-db@1.2.3(browserslist@4.28.2):
+    dependencies:
+      browserslist: 4.28.2
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
+  uri-js@4.4.1:
+    dependencies:
+      punycode: 2.3.1
+
+  use-callback-ref@1.3.3(@types/react@18.3.29)(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  use-sidecar@1.1.3(@types/react@18.3.29)(react@18.3.1):
+    dependencies:
+      detect-node-es: 1.1.0
+      react: 18.3.1
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  use-sync-external-store@1.6.0(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+
+  util-deprecate@1.0.2: {}
+
+  vite@6.4.2(@types/node@25.9.1)(jiti@1.21.7):
+    dependencies:
+      esbuild: 0.25.12
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
+      postcss: 8.5.15
+      rollup: 4.60.4
+      tinyglobby: 0.2.16
+    optionalDependencies:
+      '@types/node': 25.9.1
+      fsevents: 2.3.3
+      jiti: 1.21.7
+
+  void-elements@3.1.0: {}
+
+  which-boxed-primitive@1.1.1:
+    dependencies:
+      is-bigint: 1.1.0
+      is-boolean-object: 1.2.2
+      is-number-object: 1.1.1
+      is-string: 1.1.1
+      is-symbol: 1.1.1
+
+  which-builtin-type@1.2.1:
+    dependencies:
+      call-bound: 1.0.4
+      function.prototype.name: 1.2.0
+      has-tostringtag: 1.0.2
+      is-async-function: 2.1.1
+      is-date-object: 1.1.0
+      is-finalizationregistry: 1.1.1
+      is-generator-function: 1.1.2
+      is-regex: 1.2.1
+      is-weakref: 1.1.1
+      isarray: 2.0.5
+      which-boxed-primitive: 1.1.1
+      which-collection: 1.0.2
+      which-typed-array: 1.1.22
+
+  which-collection@1.0.2:
+    dependencies:
+      is-map: 2.0.3
+      is-set: 2.0.3
+      is-weakmap: 2.0.2
+      is-weakset: 2.0.4
+
+  which-typed-array@1.1.22:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      for-each: 0.3.5
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+
+  which@2.0.2:
+    dependencies:
+      isexe: 2.0.0
+
+  word-wrap@1.2.5: {}
+
+  yallist@3.1.1: {}
+
+  yocto-queue@0.1.0: {}
+
+  zod-validation-error@4.0.2(zod@4.4.3):
+    dependencies:
+      zod: 4.4.3
+
+  zod@4.4.3: {}
diff --git a/client/ui/frontend/pnpm-workspace.yaml b/client/ui/frontend/pnpm-workspace.yaml
new file mode 100644
index 000000000..5ed0b5af0
--- /dev/null
+++ b/client/ui/frontend/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+allowBuilds:
+  esbuild: true
diff --git a/client/ui/frontend/postcss.config.js b/client/ui/frontend/postcss.config.js
new file mode 100644
index 000000000..2aa7205d4
--- /dev/null
+++ b/client/ui/frontend/postcss.config.js
@@ -0,0 +1,6 @@
+export default {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+};
diff --git a/client/ui/frontend/src/app.tsx b/client/ui/frontend/src/app.tsx
new file mode 100644
index 000000000..6accda36f
--- /dev/null
+++ b/client/ui/frontend/src/app.tsx
@@ -0,0 +1,73 @@
+import React from "react";
+import ReactDOM from "react-dom/client";
+import "./globals.css";
+import { HashRouter, Navigate, Route, Routes } from "react-router-dom";
+import SessionExpirationDialog from "@/modules/session/SessionExpirationDialog.tsx";
+import UpdateInProgressDialog from "@/modules/auto-update/UpdateInProgressDialog.tsx";
+import WelcomeDialog from "@/modules/welcome/WelcomeDialog.tsx";
+import ErrorDialog from "@/modules/error/ErrorDialog.tsx";
+import { AppLayout } from "@/layouts/AppLayout.tsx";
+import { MainPage } from "@/modules/main/MainPage.tsx";
+import { SettingsPage } from "@/modules/settings/SettingsPage.tsx";
+import { SkeletonTheme } from "react-loading-skeleton";
+import "react-loading-skeleton/dist/skeleton.css";
+import { welcome } from "@/lib/welcome";
+import LoginWaitingForBrowserDialog from "@/modules/login/LoginWaitingForBrowserDialog.tsx";
+import { ThemeProvider } from "@/contexts/ThemeContext.tsx";
+import { initI18n } from "@/lib/i18n";
+import { initPlatform } from "@/lib/platform";
+import { initLogForwarding } from "@/lib/logs";
+import { initStallWatch } from "@/lib/stallwatch";
+
+// Must run first so even init-time logs reach the Go log pipeline.
+initLogForwarding();
+
+initStallWatch();
+
+welcome();
+
+Promise.all([
+    initI18n().catch((e) => {
+        console.error("i18n init failed:", e);
+    }),
+    initPlatform().catch((e) => {
+        console.error("platform init failed:", e);
+    }),
+]).finally(() => {
+    ReactDOM.createRoot(document.getElementById("root")!).render(
+        <React.StrictMode>
+            <ThemeProvider>
+                <SkeletonTheme
+                    baseColor={"rgb(var(--skeleton-base))"}
+                    highlightColor={"rgb(var(--skeleton-highlight))"}
+                >
+                    <HashRouter>
+                        <Routes>
+                            <Route path={"dialog"}>
+                                <Route
+                                    path={"browser-login"}
+                                    element={<LoginWaitingForBrowserDialog />}
+                                />
+                                <Route
+                                    path={"install-progress"}
+                                    element={<UpdateInProgressDialog />}
+                                />
+                                <Route
+                                    path={"session-expiration"}
+                                    element={<SessionExpirationDialog />}
+                                />
+                                <Route path={"welcome"} element={<WelcomeDialog />} />
+                                <Route path={"error"} element={<ErrorDialog />} />
+                            </Route>
+                            <Route element={<AppLayout />}>
+                                <Route index element={<MainPage />} />
+                                <Route path={"settings"} element={<SettingsPage />} />
+                                <Route path={"*"} element={<Navigate to={"/"} replace />} />
+                            </Route>
+                        </Routes>
+                    </HashRouter>
+                </SkeletonTheme>
+            </ThemeProvider>
+        </React.StrictMode>,
+    );
+});
diff --git a/client/ui/frontend/src/assets/fonts/inter-variable.ttf b/client/ui/frontend/src/assets/fonts/inter-variable.ttf
new file mode 100644
index 000000000..4ab79e010
Binary files /dev/null and b/client/ui/frontend/src/assets/fonts/inter-variable.ttf differ
diff --git a/client/ui/frontend/src/assets/fonts/jetbrains-mono-variable.ttf b/client/ui/frontend/src/assets/fonts/jetbrains-mono-variable.ttf
new file mode 100644
index 000000000..b60e77f5d
Binary files /dev/null and b/client/ui/frontend/src/assets/fonts/jetbrains-mono-variable.ttf differ
diff --git a/client/ui/frontend/src/assets/img/tray-darwin.png b/client/ui/frontend/src/assets/img/tray-darwin.png
new file mode 100644
index 000000000..75df803d8
Binary files /dev/null and b/client/ui/frontend/src/assets/img/tray-darwin.png differ
diff --git a/client/ui/frontend/src/assets/img/tray-linux.png b/client/ui/frontend/src/assets/img/tray-linux.png
new file mode 100644
index 000000000..08cea81af
Binary files /dev/null and b/client/ui/frontend/src/assets/img/tray-linux.png differ
diff --git a/client/ui/frontend/src/assets/img/tray-windows.png b/client/ui/frontend/src/assets/img/tray-windows.png
new file mode 100644
index 000000000..cebbf6153
Binary files /dev/null and b/client/ui/frontend/src/assets/img/tray-windows.png differ
diff --git a/client/ui/frontend/src/assets/logos/netbird-full-light.svg b/client/ui/frontend/src/assets/logos/netbird-full-light.svg
new file mode 100644
index 000000000..3457b50c6
--- /dev/null
+++ b/client/ui/frontend/src/assets/logos/netbird-full-light.svg
@@ -0,0 +1,19 @@
+<svg width="133" height="23" viewBox="0 0 133 23" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_0_3)">
+<path d="M46.9438 7.5013C48.1229 8.64688 48.7082 10.3025 48.7082 12.4683V21.6663H46.1411V12.8362C46.1411 11.2809 45.7481 10.0851 44.9704 9.26566C44.1928 8.43783 43.1308 8.0281 41.7846 8.0281C40.4383 8.0281 39.3345 8.45455 38.5234 9.30747C37.7123 10.1604 37.3109 11.4063 37.3109 13.0369V21.6663H34.7188V6.06305H37.3109V8.28732C37.821 7.49294 38.5234 6.87416 39.4014 6.43934C40.2878 6.00452 41.2578 5.78711 42.3197 5.78711C44.2179 5.78711 45.7565 6.36408 46.9355 7.50966L46.9438 7.5013Z" fill="#1f2124"/>
+<path d="M67.1048 14.8344H54.6288C54.7208 16.373 55.2476 17.5771 56.2092 18.4384C57.1708 19.2997 58.3331 19.7345 59.6961 19.7345C60.8166 19.7345 61.7531 19.4753 62.4973 18.9485C63.2499 18.4301 63.7767 17.7277 64.0777 16.858H66.8706C66.4525 18.3548 65.6163 19.5756 64.3621 20.5205C63.1078 21.4571 61.5525 21.9337 59.6878 21.9337C58.2077 21.9337 56.8865 21.5992 55.7159 20.9386C54.5452 20.278 53.6337 19.3331 52.9648 18.1039C52.2958 16.8831 51.9697 15.4616 51.9697 13.8477C51.9697 12.2339 52.2958 10.8207 52.9397 9.60825C53.5836 8.39578 54.495 7.45924 55.6573 6.80702C56.828 6.15479 58.1659 5.82031 59.6878 5.82031C61.2096 5.82031 62.4806 6.14643 63.6178 6.79029C64.7551 7.43416 65.6331 8.32052 66.2518 9.44938C66.8706 10.5782 67.18 11.8576 67.18 13.2791C67.18 13.7725 67.1549 14.2909 67.0964 14.8428L67.1048 14.8344ZM63.8603 10.1769C63.4255 9.4661 62.8318 8.92258 62.0793 8.55465C61.3267 8.18673 60.4989 8.00277 59.5874 8.00277C58.2746 8.00277 57.1625 8.42086 56.2427 9.25705C55.3228 10.0932 54.796 11.2472 54.6623 12.7356H64.5126C64.5126 11.7489 64.2952 10.896 63.8603 10.1852V10.1769Z" fill="#1f2124"/>
+<path d="M73.7695 8.20355V17.4016C73.7695 18.1626 73.9284 18.6977 74.2545 19.0071C74.5806 19.3165 75.1409 19.4754 75.9352 19.4754H77.8418V21.6662H75.5088C74.0622 21.6662 72.9835 21.3317 72.2644 20.6711C71.5452 20.0105 71.1857 18.9151 71.1857 17.3933V8.19519H69.1621V6.0629H71.1857V2.13281H73.7779V6.0629H77.8501V8.19519H73.7779L73.7695 8.20355Z" fill="#1f2124"/>
+<path d="M85.9022 6.68902C86.9307 6.10369 88.093 5.80266 89.4058 5.80266C90.8106 5.80266 92.0732 6.13714 93.1937 6.79773C94.3142 7.46668 95.2006 8.39485 95.8444 9.59896C96.4883 10.8031 96.8144 12.2079 96.8144 13.7966C96.8144 15.3854 96.4883 16.7818 95.8444 18.011C95.2006 19.2486 94.3142 20.2018 93.1854 20.8875C92.0565 21.5732 90.7939 21.916 89.4141 21.916C88.0344 21.916 86.8805 21.6234 85.8687 21.0297C84.8569 20.4443 84.0876 19.6918 83.5775 18.7803V21.6568H80.9854V0.601562H83.5775V8.97182C84.1127 8.04365 84.8904 7.28272 85.9105 6.69738L85.9022 6.68902ZM93.4529 10.7362C92.9763 9.86654 92.3408 9.19759 91.5297 8.74605C90.7186 8.29451 89.8322 8.06037 88.8706 8.06037C87.909 8.06037 87.0394 8.29451 86.2366 8.75441C85.4255 9.22268 84.7817 9.89163 84.2967 10.778C83.8117 11.6643 83.5692 12.6845 83.5692 13.8384C83.5692 14.9924 83.8117 16.046 84.2967 16.9323C84.7817 17.8187 85.4255 18.4877 86.2366 18.9559C87.0394 19.4242 87.9174 19.65 88.8706 19.65C89.8239 19.65 90.727 19.4158 91.5297 18.9559C92.3324 18.4877 92.9763 17.8187 93.4529 16.9323C93.9296 16.046 94.1637 15.0091 94.1637 13.8134C94.1637 12.6176 93.9296 11.6142 93.4529 10.7362Z" fill="#1f2124"/>
+<path d="M100.318 3.01864C99.9749 2.67581 99.8076 2.25771 99.8076 1.76436C99.8076 1.27101 99.9749 0.852913 100.318 0.510076C100.661 0.167238 101.079 0 101.572 0C102.065 0 102.45 0.167238 102.784 0.510076C103.119 0.852913 103.286 1.27101 103.286 1.76436C103.286 2.25771 103.119 2.67581 102.784 3.01864C102.45 3.36148 102.049 3.52872 101.572 3.52872C101.095 3.52872 100.661 3.36148 100.318 3.01864ZM102.826 6.06237V21.6657H100.234V6.06237H102.826Z" fill="#1f2124"/>
+<path d="M111.773 6.52155C112.617 6.0282 113.646 5.77734 114.867 5.77734V8.45315H114.181C111.28 8.45315 109.825 10.0252 109.825 13.1776V21.6649H107.232V6.06165H109.825V8.5953C110.276 7.70058 110.928 7.00654 111.773 6.51319V6.52155Z" fill="#1f2124"/>
+<path d="M117.861 9.60732C118.505 8.40321 119.391 7.46668 120.52 6.80609C121.649 6.1455 122.92 5.81102 124.325 5.81102C125.537 5.81102 126.666 6.09533 127.711 6.64721C128.757 7.20746 129.551 7.94331 130.103 8.85475V0.601562H132.72V21.6735H130.103V18.7385C129.593 19.6667 128.832 20.436 127.828 21.0297C126.825 21.6317 125.646 21.9244 124.3 21.9244C122.953 21.9244 121.657 21.5816 120.528 20.8959C119.4 20.2102 118.513 19.257 117.869 18.0194C117.226 16.7818 116.899 15.377 116.899 13.805C116.899 12.233 117.226 10.8114 117.869 9.60732H117.861ZM129.392 10.7613C128.915 9.89163 128.28 9.22268 127.469 8.75441C126.658 8.28614 125.771 8.06037 124.81 8.06037C123.848 8.06037 122.962 8.28614 122.159 8.74605C121.356 9.20595 120.729 9.86654 120.253 10.7362C119.776 11.6058 119.542 12.6343 119.542 13.8134C119.542 14.9924 119.776 16.046 120.253 16.9323C120.729 17.8187 121.365 18.4877 122.159 18.9559C122.953 19.4242 123.84 19.65 124.81 19.65C125.78 19.65 126.666 19.4158 127.469 18.9559C128.272 18.4877 128.915 17.8187 129.392 16.9323C129.869 16.046 130.103 15.0175 130.103 13.8384C130.103 12.6594 129.869 11.6393 129.392 10.7613Z" fill="#1f2124"/>
+<path d="M21.4651 0.568359C17.8193 0.902835 16.0047 3.00167 15.3191 4.06363L4.66602 22.5183H17.5182L30.1949 0.568359H21.4651Z" fill="#F68330"/>
+<path d="M17.5265 22.5187L0 3.9302C0 3.9302 19.8177 -1.39633 21.7493 15.2188L17.5265 22.5187Z" fill="#F68330"/>
+<path d="M14.9255 4.75055L9.54883 14.0657L17.5177 22.5196L21.7405 15.2029C21.0715 9.49174 18.287 6.37276 14.9255 4.74219" fill="#F35E32"/>
+</g>
+<defs>
+<clipPath id="clip0_0_3">
+<rect width="132.72" height="22.5186" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/client/ui/frontend/src/assets/logos/netbird-full.svg b/client/ui/frontend/src/assets/logos/netbird-full.svg
new file mode 100644
index 000000000..f925d5761
--- /dev/null
+++ b/client/ui/frontend/src/assets/logos/netbird-full.svg
@@ -0,0 +1,19 @@
+<svg width="133" height="23" viewBox="0 0 133 23" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_0_3)">
+<path d="M46.9438 7.5013C48.1229 8.64688 48.7082 10.3025 48.7082 12.4683V21.6663H46.1411V12.8362C46.1411 11.2809 45.7481 10.0851 44.9704 9.26566C44.1928 8.43783 43.1308 8.0281 41.7846 8.0281C40.4383 8.0281 39.3345 8.45455 38.5234 9.30747C37.7123 10.1604 37.3109 11.4063 37.3109 13.0369V21.6663H34.7188V6.06305H37.3109V8.28732C37.821 7.49294 38.5234 6.87416 39.4014 6.43934C40.2878 6.00452 41.2578 5.78711 42.3197 5.78711C44.2179 5.78711 45.7565 6.36408 46.9355 7.50966L46.9438 7.5013Z" fill="#F2F2F2"/>
+<path d="M67.1048 14.8344H54.6288C54.7208 16.373 55.2476 17.5771 56.2092 18.4384C57.1708 19.2997 58.3331 19.7345 59.6961 19.7345C60.8166 19.7345 61.7531 19.4753 62.4973 18.9485C63.2499 18.4301 63.7767 17.7277 64.0777 16.858H66.8706C66.4525 18.3548 65.6163 19.5756 64.3621 20.5205C63.1078 21.4571 61.5525 21.9337 59.6878 21.9337C58.2077 21.9337 56.8865 21.5992 55.7159 20.9386C54.5452 20.278 53.6337 19.3331 52.9648 18.1039C52.2958 16.8831 51.9697 15.4616 51.9697 13.8477C51.9697 12.2339 52.2958 10.8207 52.9397 9.60825C53.5836 8.39578 54.495 7.45924 55.6573 6.80702C56.828 6.15479 58.1659 5.82031 59.6878 5.82031C61.2096 5.82031 62.4806 6.14643 63.6178 6.79029C64.7551 7.43416 65.6331 8.32052 66.2518 9.44938C66.8706 10.5782 67.18 11.8576 67.18 13.2791C67.18 13.7725 67.1549 14.2909 67.0964 14.8428L67.1048 14.8344ZM63.8603 10.1769C63.4255 9.4661 62.8318 8.92258 62.0793 8.55465C61.3267 8.18673 60.4989 8.00277 59.5874 8.00277C58.2746 8.00277 57.1625 8.42086 56.2427 9.25705C55.3228 10.0932 54.796 11.2472 54.6623 12.7356H64.5126C64.5126 11.7489 64.2952 10.896 63.8603 10.1852V10.1769Z" fill="#F2F2F2"/>
+<path d="M73.7695 8.20355V17.4016C73.7695 18.1626 73.9284 18.6977 74.2545 19.0071C74.5806 19.3165 75.1409 19.4754 75.9352 19.4754H77.8418V21.6662H75.5088C74.0622 21.6662 72.9835 21.3317 72.2644 20.6711C71.5452 20.0105 71.1857 18.9151 71.1857 17.3933V8.19519H69.1621V6.0629H71.1857V2.13281H73.7779V6.0629H77.8501V8.19519H73.7779L73.7695 8.20355Z" fill="#F2F2F2"/>
+<path d="M85.9022 6.68902C86.9307 6.10369 88.093 5.80266 89.4058 5.80266C90.8106 5.80266 92.0732 6.13714 93.1937 6.79773C94.3142 7.46668 95.2006 8.39485 95.8444 9.59896C96.4883 10.8031 96.8144 12.2079 96.8144 13.7966C96.8144 15.3854 96.4883 16.7818 95.8444 18.011C95.2006 19.2486 94.3142 20.2018 93.1854 20.8875C92.0565 21.5732 90.7939 21.916 89.4141 21.916C88.0344 21.916 86.8805 21.6234 85.8687 21.0297C84.8569 20.4443 84.0876 19.6918 83.5775 18.7803V21.6568H80.9854V0.601562H83.5775V8.97182C84.1127 8.04365 84.8904 7.28272 85.9105 6.69738L85.9022 6.68902ZM93.4529 10.7362C92.9763 9.86654 92.3408 9.19759 91.5297 8.74605C90.7186 8.29451 89.8322 8.06037 88.8706 8.06037C87.909 8.06037 87.0394 8.29451 86.2366 8.75441C85.4255 9.22268 84.7817 9.89163 84.2967 10.778C83.8117 11.6643 83.5692 12.6845 83.5692 13.8384C83.5692 14.9924 83.8117 16.046 84.2967 16.9323C84.7817 17.8187 85.4255 18.4877 86.2366 18.9559C87.0394 19.4242 87.9174 19.65 88.8706 19.65C89.8239 19.65 90.727 19.4158 91.5297 18.9559C92.3324 18.4877 92.9763 17.8187 93.4529 16.9323C93.9296 16.046 94.1637 15.0091 94.1637 13.8134C94.1637 12.6176 93.9296 11.6142 93.4529 10.7362Z" fill="#F2F2F2"/>
+<path d="M100.318 3.01864C99.9749 2.67581 99.8076 2.25771 99.8076 1.76436C99.8076 1.27101 99.9749 0.852913 100.318 0.510076C100.661 0.167238 101.079 0 101.572 0C102.065 0 102.45 0.167238 102.784 0.510076C103.119 0.852913 103.286 1.27101 103.286 1.76436C103.286 2.25771 103.119 2.67581 102.784 3.01864C102.45 3.36148 102.049 3.52872 101.572 3.52872C101.095 3.52872 100.661 3.36148 100.318 3.01864ZM102.826 6.06237V21.6657H100.234V6.06237H102.826Z" fill="#F2F2F2"/>
+<path d="M111.773 6.52155C112.617 6.0282 113.646 5.77734 114.867 5.77734V8.45315H114.181C111.28 8.45315 109.825 10.0252 109.825 13.1776V21.6649H107.232V6.06165H109.825V8.5953C110.276 7.70058 110.928 7.00654 111.773 6.51319V6.52155Z" fill="#F2F2F2"/>
+<path d="M117.861 9.60732C118.505 8.40321 119.391 7.46668 120.52 6.80609C121.649 6.1455 122.92 5.81102 124.325 5.81102C125.537 5.81102 126.666 6.09533 127.711 6.64721C128.757 7.20746 129.551 7.94331 130.103 8.85475V0.601562H132.72V21.6735H130.103V18.7385C129.593 19.6667 128.832 20.436 127.828 21.0297C126.825 21.6317 125.646 21.9244 124.3 21.9244C122.953 21.9244 121.657 21.5816 120.528 20.8959C119.4 20.2102 118.513 19.257 117.869 18.0194C117.226 16.7818 116.899 15.377 116.899 13.805C116.899 12.233 117.226 10.8114 117.869 9.60732H117.861ZM129.392 10.7613C128.915 9.89163 128.28 9.22268 127.469 8.75441C126.658 8.28614 125.771 8.06037 124.81 8.06037C123.848 8.06037 122.962 8.28614 122.159 8.74605C121.356 9.20595 120.729 9.86654 120.253 10.7362C119.776 11.6058 119.542 12.6343 119.542 13.8134C119.542 14.9924 119.776 16.046 120.253 16.9323C120.729 17.8187 121.365 18.4877 122.159 18.9559C122.953 19.4242 123.84 19.65 124.81 19.65C125.78 19.65 126.666 19.4158 127.469 18.9559C128.272 18.4877 128.915 17.8187 129.392 16.9323C129.869 16.046 130.103 15.0175 130.103 13.8384C130.103 12.6594 129.869 11.6393 129.392 10.7613Z" fill="#F2F2F2"/>
+<path d="M21.4651 0.568359C17.8193 0.902835 16.0047 3.00167 15.3191 4.06363L4.66602 22.5183H17.5182L30.1949 0.568359H21.4651Z" fill="#F68330"/>
+<path d="M17.5265 22.5187L0 3.9302C0 3.9302 19.8177 -1.39633 21.7493 15.2188L17.5265 22.5187Z" fill="#F68330"/>
+<path d="M14.9255 4.75055L9.54883 14.0657L17.5177 22.5196L21.7405 15.2029C21.0715 9.49174 18.287 6.37276 14.9255 4.74219" fill="#F35E32"/>
+</g>
+<defs>
+<clipPath id="clip0_0_3">
+<rect width="132.72" height="22.5186" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/client/ui/frontend/src/assets/logos/netbird.svg b/client/ui/frontend/src/assets/logos/netbird.svg
new file mode 100644
index 000000000..6254931c6
--- /dev/null
+++ b/client/ui/frontend/src/assets/logos/netbird.svg
@@ -0,0 +1,5 @@
+<svg width="31" height="23" viewBox="0 0 31 23" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M21.4631 0.523438C17.8173 0.857913 16.0028 2.95675 15.3171 4.01871L4.66406 22.4734H17.5163L30.1929 0.523438H21.4631Z" fill="#F68330"/>
+<path d="M17.5265 22.4737L0 3.88525C0 3.88525 19.8177 -1.44128 21.7493 15.1738L17.5265 22.4737Z" fill="#F68330"/>
+<path d="M14.9236 4.70563L9.54688 14.0208L17.5158 22.4747L21.7385 15.158C21.0696 9.44682 18.2851 6.32784 14.9236 4.69727" fill="#F05252"/>
+</svg>
diff --git a/client/ui/frontend/src/components/Badge.tsx b/client/ui/frontend/src/components/Badge.tsx
new file mode 100644
index 000000000..a6f2e886a
--- /dev/null
+++ b/client/ui/frontend/src/components/Badge.tsx
@@ -0,0 +1,45 @@
+import { forwardRef, type ComponentType, type HTMLAttributes } from "react";
+import type { LucideProps } from "lucide-react";
+import { cn } from "@/lib/cn";
+
+export type BadgeVariant = "info" | "neutral" | "brand" | "success" | "warning" | "danger";
+
+type Props = HTMLAttributes<HTMLSpanElement> & {
+    variant?: BadgeVariant;
+    icon?: ComponentType<LucideProps>;
+    iconSize?: number;
+};
+
+const VARIANT_CLASSES: Record<BadgeVariant, string> = {
+    info: "bg-sky-100 border border-sky-300 text-sky-800 dark:bg-sky-900 dark:border-sky-700 dark:text-sky-200",
+    neutral: "bg-nb-gray-900 border border-nb-gray-850 text-nb-gray-200",
+    brand: "bg-netbird/15 border border-netbird/30 text-netbird-700 dark:text-netbird",
+    success:
+        "bg-green-100 border border-green-300 text-green-800 dark:bg-green-900 dark:border-green-700 dark:text-green-200",
+    warning:
+        "bg-yellow-100 border border-yellow-300 text-yellow-800 dark:bg-yellow-900 dark:border-yellow-700 dark:text-yellow-200",
+    danger: "bg-red-100 border border-red-300 text-red-800 dark:bg-red-900 dark:border-red-700 dark:text-red-200",
+};
+
+export const Badge = forwardRef<HTMLSpanElement, Props>(function Badge(
+    { variant = "info", icon: Icon, iconSize = 10, className, children, ...rest },
+    ref,
+) {
+    return (
+        <span
+            ref={ref}
+            className={cn(
+                "relative top-px inline-flex items-center gap-1 rounded-full px-1.5 py-[0.15rem]",
+                "shrink-0 text-[0.64rem] font-semibold leading-none",
+                VARIANT_CLASSES[variant],
+                className,
+            )}
+            {...rest}
+        >
+            {Icon && <Icon size={iconSize} aria-hidden={"true"} />}
+            {children}
+        </span>
+    );
+});
+
+export default Badge;
diff --git a/client/ui/frontend/src/components/CopyToClipboard.tsx b/client/ui/frontend/src/components/CopyToClipboard.tsx
new file mode 100644
index 000000000..b3d5a8715
--- /dev/null
+++ b/client/ui/frontend/src/components/CopyToClipboard.tsx
@@ -0,0 +1,131 @@
+import { useEffect, useRef, useState, type KeyboardEvent, type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { Check, Copy } from "lucide-react";
+import { cn } from "@/lib/cn";
+
+const VARIANT_HOVER = {
+    default: "group-hover/copy:[&_*]:text-nb-gray-300",
+    bright: "group-hover/copy:[&_*]:text-nb-gray-200",
+} as const;
+
+type CopyToClipboardVariant = keyof typeof VARIANT_HOVER;
+
+type CopyToClipboardProps = {
+    children: ReactNode;
+    message?: string;
+    size?: number;
+    iconAlignment?: "left" | "right";
+    className?: string;
+    iconClassName?: string;
+    alwaysShowIcon?: boolean;
+    // wrap lets long content (a shell command, a path) break across lines
+    // instead of being truncated to one line.
+    wrap?: boolean;
+    variant?: CopyToClipboardVariant;
+    "aria-label"?: string;
+    tabIndex?: number;
+    onKeyDown?: (e: KeyboardEvent<HTMLButtonElement>) => void;
+};
+
+export const CopyToClipboard = ({
+    children,
+    message,
+    size = 10,
+    iconAlignment = "right",
+    className,
+    iconClassName,
+    alwaysShowIcon = false,
+    wrap = false,
+    variant = "default",
+    "aria-label": ariaLabel,
+    tabIndex = 0,
+    onKeyDown,
+}: CopyToClipboardProps) => {
+    const { t } = useTranslation();
+    const wrapperRef = useRef<HTMLButtonElement>(null);
+    const [copied, setCopied] = useState(false);
+    const copyTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+    useEffect(
+        () => () => {
+            if (copyTimer.current) clearTimeout(copyTimer.current);
+        },
+        [],
+    );
+
+    const handleClick = async (e: React.MouseEvent) => {
+        e.stopPropagation();
+        e.preventDefault();
+        const text = message ?? wrapperRef.current?.innerText ?? "";
+        if (!text) return;
+        try {
+            await navigator.clipboard.writeText(text);
+            setCopied(true);
+            if (copyTimer.current) clearTimeout(copyTimer.current);
+            copyTimer.current = setTimeout(() => setCopied(false), 500);
+        } catch (e) {
+            console.warn("copy to clipboard failed", e);
+        }
+    };
+
+    const resolvedLabel =
+        ariaLabel ?? (message ? `${t("common.copy")} ${message}` : t("common.copy"));
+
+    return (
+        <button
+            type={"button"}
+            ref={wrapperRef}
+            onClick={handleClick}
+            onKeyDown={onKeyDown}
+            tabIndex={tabIndex}
+            aria-label={resolvedLabel}
+            aria-live={"polite"}
+            className={cn(
+                "group/copy wails-no-draggable pointer-events-auto inline-flex cursor-default items-center gap-2 rounded-sm text-start outline-none",
+                "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                className,
+            )}
+        >
+            <span
+                className={cn(
+                    "relative min-w-0",
+                    wrap ? "whitespace-pre-wrap break-all" : "truncate",
+                    "[&_*]:transition-colors",
+                    VARIANT_HOVER[variant],
+                )}
+            >
+                {children}
+                <span
+                    aria-hidden={"true"}
+                    className={
+                        "pointer-events-none absolute inset-x-0 bottom-0 border-b border-dashed border-transparent group-hover/copy:border-nb-gray-500"
+                    }
+                />
+            </span>
+            <span
+                aria-hidden={"true"}
+                className={cn(
+                    "relative end-[1px] top-[2px] inline-flex shrink-0",
+                    iconAlignment === "left" ? "order-first" : "order-last",
+                    iconClassName,
+                )}
+            >
+                <Check
+                    size={size}
+                    className={cn(
+                        "text-nb-gray-100",
+                        !copied && "hidden",
+                        !alwaysShowIcon && !copied && "opacity-0",
+                    )}
+                />
+                <Copy
+                    size={size}
+                    className={cn(
+                        "text-nb-gray-100 group-hover/copy:opacity-100",
+                        copied && "hidden",
+                        !alwaysShowIcon && "opacity-0",
+                    )}
+                />
+            </span>
+        </button>
+    );
+};
diff --git a/client/ui/frontend/src/components/DropdownMenu.tsx b/client/ui/frontend/src/components/DropdownMenu.tsx
new file mode 100644
index 000000000..4bedc7c8a
--- /dev/null
+++ b/client/ui/frontend/src/components/DropdownMenu.tsx
@@ -0,0 +1,241 @@
+import * as DropdownMenuPrimitive from "@radix-ui/react-dropdown-menu";
+import { cva } from "class-variance-authority";
+import { Check, ChevronRight } from "lucide-react";
+import * as React from "react";
+import { cn } from "@/lib/cn";
+import { useDirection } from "@/hooks/useDirection";
+
+const DropdownMenu = (props: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) => {
+    const dir = useDirection();
+    return <DropdownMenuPrimitive.Root dir={dir} {...props} />;
+};
+const DropdownMenuTrigger = DropdownMenuPrimitive.Trigger;
+const DropdownMenuGroup = DropdownMenuPrimitive.Group;
+const DropdownMenuPortal = DropdownMenuPrimitive.Portal;
+const DropdownMenuSub = DropdownMenuPrimitive.Sub;
+const DropdownMenuRadioGroup = DropdownMenuPrimitive.RadioGroup;
+
+const menuItemVariants = cva("", {
+    variants: {
+        variant: {
+            default:
+                "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50 focus-visible:bg-nb-gray-900 focus-visible:text-nb-gray-50 data-[state=open]:bg-nb-gray-900 data-[state=open]:text-nb-gray-50",
+            danger: "text-red-500 hover:bg-red-500/10 hover:text-red-500 focus-visible:bg-red-500/10 focus-visible:text-red-500 dark:hover:bg-red-900/20 dark:focus-visible:bg-red-900/20",
+        },
+    },
+    defaultVariants: { variant: "default" },
+});
+
+const DropdownMenuSubTrigger = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.SubTrigger>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.SubTrigger> & {
+        inset?: boolean;
+        variant?: "default" | "danger";
+    }
+>(({ className, inset, children, variant, ...props }, ref) => (
+    <DropdownMenuPrimitive.SubTrigger
+        ref={ref}
+        className={cn(
+            "relative flex cursor-default select-none items-center rounded-md py-1.5 pe-2 ps-3 text-sm outline-none",
+            "transition-colors data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            inset && "ps-8",
+            menuItemVariants({ variant }),
+            className,
+        )}
+        {...props}
+    >
+        {children}
+        <ChevronRight className={"ms-auto h-4 w-4 rtl:-scale-x-100"} aria-hidden={"true"} />
+    </DropdownMenuPrimitive.SubTrigger>
+));
+DropdownMenuSubTrigger.displayName = DropdownMenuPrimitive.SubTrigger.displayName;
+
+const DropdownMenuSubContent = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.SubContent>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.SubContent>
+>(({ className, ...props }, ref) => (
+    <DropdownMenuPrimitive.SubContent
+        ref={ref}
+        className={cn(
+            "z-50 min-w-[8rem] overflow-hidden rounded-md border border-nb-gray-900 bg-nb-gray-930 p-1 text-nb-gray-200 shadow-lg",
+            "data-[state=open]:animate-in data-[state=closed]:animate-out",
+            "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+            "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
+            "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2",
+            "data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+            className,
+        )}
+        {...props}
+    />
+));
+DropdownMenuSubContent.displayName = DropdownMenuPrimitive.SubContent.displayName;
+
+const DropdownMenuContent = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.Content>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Content>
+>(({ className, sideOffset = 4, ...props }, ref) => (
+    <DropdownMenuPrimitive.Portal>
+        <DropdownMenuPrimitive.Content
+            ref={ref}
+            sideOffset={sideOffset}
+            className={cn(
+                "z-50 min-w-[8rem] overflow-hidden rounded-lg border border-nb-gray-900 bg-nb-gray-935 p-1 text-nb-gray-200 shadow-lg",
+                "data-[state=open]:animate-in data-[state=closed]:animate-out",
+                "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+                "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
+                "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2",
+                "data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+                className,
+            )}
+            {...props}
+        />
+    </DropdownMenuPrimitive.Portal>
+));
+DropdownMenuContent.displayName = DropdownMenuPrimitive.Content.displayName;
+
+const DropdownMenuItem = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.Item>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Item> & {
+        inset?: boolean;
+        variant?: "default" | "danger";
+        href?: string;
+        target?: string;
+        rel?: string;
+    }
+>(({ className, inset, variant, onClick, href, target, rel, children, ...props }, ref) => (
+    <DropdownMenuPrimitive.Item
+        ref={ref}
+        className={cn(
+            "relative flex cursor-default select-none items-center rounded-md px-2 py-1.5 text-sm outline-none",
+            "transition-colors data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            inset && "ps-8",
+            menuItemVariants({ variant }),
+            className,
+        )}
+        onClick={(e) => {
+            if (href) return;
+            e.preventDefault();
+            e.stopPropagation();
+            onClick?.(e);
+        }}
+        {...props}
+    >
+        {href ? (
+            <a href={href} target={target} rel={rel} className={"flex w-full items-center gap-3"}>
+                {children}
+            </a>
+        ) : (
+            children
+        )}
+    </DropdownMenuPrimitive.Item>
+));
+DropdownMenuItem.displayName = DropdownMenuPrimitive.Item.displayName;
+
+const DropdownMenuCheckboxItem = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.CheckboxItem>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.CheckboxItem>
+>(({ className, children, checked, ...props }, ref) => (
+    <DropdownMenuPrimitive.CheckboxItem
+        ref={ref}
+        className={cn(
+            "relative flex cursor-default select-none items-center rounded-sm py-1.5 pe-2 ps-8 text-sm outline-none",
+            "text-nb-gray-200 transition-colors hover:bg-nb-gray-900 hover:text-nb-gray-50 focus-visible:bg-nb-gray-900 focus-visible:text-nb-gray-50",
+            "data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            className,
+        )}
+        checked={checked}
+        {...props}
+    >
+        <span className={"absolute start-2 flex h-3.5 w-3.5 items-center justify-center"}>
+            <DropdownMenuPrimitive.ItemIndicator>
+                <Check className={"h-4 w-4"} />
+            </DropdownMenuPrimitive.ItemIndicator>
+        </span>
+        {children}
+    </DropdownMenuPrimitive.CheckboxItem>
+));
+DropdownMenuCheckboxItem.displayName = DropdownMenuPrimitive.CheckboxItem.displayName;
+
+const DropdownMenuRadioItem = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.RadioItem>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.RadioItem>
+>(({ className, children, ...props }, ref) => (
+    <DropdownMenuPrimitive.RadioItem
+        ref={ref}
+        className={cn(
+            "my-0.5 flex cursor-default select-none items-center gap-2 rounded-md px-2 py-2 outline-none",
+            "text-xs font-semibold text-nb-gray-200 transition-colors",
+            "data-[highlighted]:bg-nb-gray-850 data-[highlighted]:text-nb-gray-50",
+            "data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            className,
+        )}
+        {...props}
+    >
+        {children}
+        <span
+            aria-hidden={"true"}
+            className={"ms-auto flex w-4 shrink-0 items-center justify-center"}
+        >
+            <DropdownMenuPrimitive.ItemIndicator>
+                <Check size={14} className={"text-netbird"} />
+            </DropdownMenuPrimitive.ItemIndicator>
+        </span>
+    </DropdownMenuPrimitive.RadioItem>
+));
+DropdownMenuRadioItem.displayName = DropdownMenuPrimitive.RadioItem.displayName;
+
+const DropdownMenuLabel = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.Label>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Label> & {
+        inset?: boolean;
+    }
+>(({ className, inset, ...props }, ref) => (
+    <DropdownMenuPrimitive.Label
+        ref={ref}
+        className={cn(
+            "px-2 py-1.5 text-sm font-semibold text-nb-gray-200",
+            inset && "ps-8",
+            className,
+        )}
+        {...props}
+    />
+));
+DropdownMenuLabel.displayName = DropdownMenuPrimitive.Label.displayName;
+
+const DropdownMenuSeparator = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.Separator>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Separator>
+>(({ className, ...props }, ref) => (
+    <DropdownMenuPrimitive.Separator
+        ref={ref}
+        className={cn("-mx-1 my-1 h-px bg-nb-gray-910", className)}
+        {...props}
+    />
+));
+DropdownMenuSeparator.displayName = DropdownMenuPrimitive.Separator.displayName;
+
+const DropdownMenuShortcut = ({ className, ...props }: React.HTMLAttributes<HTMLSpanElement>) => (
+    <span
+        className={cn("ms-auto text-xs tracking-widest text-nb-gray-100 opacity-60", className)}
+        {...props}
+    />
+);
+DropdownMenuShortcut.displayName = "DropdownMenuShortcut";
+
+export {
+    DropdownMenu,
+    DropdownMenuCheckboxItem,
+    DropdownMenuContent,
+    DropdownMenuGroup,
+    DropdownMenuItem,
+    DropdownMenuLabel,
+    DropdownMenuPortal,
+    DropdownMenuRadioGroup,
+    DropdownMenuRadioItem,
+    DropdownMenuSeparator,
+    DropdownMenuShortcut,
+    DropdownMenuSub,
+    DropdownMenuSubContent,
+    DropdownMenuSubTrigger,
+    DropdownMenuTrigger,
+};
diff --git a/client/ui/frontend/src/components/LanguagePicker.tsx b/client/ui/frontend/src/components/LanguagePicker.tsx
new file mode 100644
index 000000000..1e1fdb17b
--- /dev/null
+++ b/client/ui/frontend/src/components/LanguagePicker.tsx
@@ -0,0 +1,245 @@
+import { useEffect, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import * as Popover from "@radix-ui/react-popover";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { Command } from "cmdk";
+import { CheckIcon, ChevronDown, LanguagesIcon, Search } from "lucide-react";
+import { Preferences } from "@bindings/services";
+import { type LanguageCode, type Language } from "@bindings/i18n/models.js";
+import { HelpText } from "@/components/typography/HelpText";
+import { Label } from "@/components/typography/Label";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { loadLanguages } from "@/lib/i18n";
+import { cn } from "@/lib/cn";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+import { useDirection } from "@/hooks/useDirection";
+
+// No flag icons: flags represent countries, not languages. https://www.flagsarenotlanguages.com/blog/
+
+const labelFor = (lang: Language): string =>
+    lang.englishName && lang.englishName !== lang.displayName
+        ? `${lang.displayName} (${lang.englishName})`
+        : lang.displayName;
+
+export function LanguagePicker() {
+    const dir = useDirection();
+    const { t, i18n } = useTranslation();
+    const [languages, setLanguages] = useState<Language[]>([]);
+    const [open, setOpen] = useState(false);
+    const [busy, setBusy] = useState(false);
+    const isFocusVisible = useFocusVisible();
+
+    useEffect(() => {
+        let cancelled = false;
+        loadLanguages()
+            .then((list) => {
+                if (!cancelled) setLanguages(list);
+            })
+            .catch((err: unknown) => console.error("load languages failed", err));
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    const sorted = useMemo(
+        () => [...languages].sort((a, b) => a.displayName.localeCompare(b.displayName)),
+        [languages],
+    );
+
+    const current = useMemo(
+        () =>
+            languages.find((l) => l.code === i18n.language) ??
+            languages.find((l) => l.code === "en"),
+        [languages, i18n.language],
+    );
+
+    const handleTriggerKeyDown = (e: React.KeyboardEvent<HTMLButtonElement>) => {
+        if (open) return;
+        if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+            e.preventDefault();
+            setOpen(true);
+        }
+    };
+
+    const select = async (code: string) => {
+        setOpen(false);
+        if (busy || code === i18n.language) return;
+        setBusy(true);
+        try {
+            await Preferences.SetLanguage(code as LanguageCode);
+        } catch (e) {
+            await errorDialog({
+                Title: t("settings.error.saveTitle"),
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            setBusy(false);
+        }
+    };
+
+    return (
+        <div className={"flex items-center justify-between gap-6"}>
+            <div className={"max-w-md flex-1"}>
+                <Label as={"div"}>{t("settings.general.language.label")}</Label>
+                <HelpText margin={false}>{t("settings.general.language.help")}</HelpText>
+            </div>
+            <div className={"shrink-0"}>
+                <Popover.Root open={open} onOpenChange={setOpen}>
+                    <Popover.Trigger asChild>
+                        <button
+                            type={"button"}
+                            tabIndex={0}
+                            disabled={busy || languages.length === 0}
+                            onKeyDown={handleTriggerKeyDown}
+                            aria-label={
+                                current
+                                    ? `${t("settings.general.language.label")}: ${labelFor(current)}`
+                                    : t("settings.general.language.label")
+                            }
+                            aria-haspopup={"listbox"}
+                            aria-expanded={open}
+                            className={cn(
+                                "inline-flex h-[40px] min-w-[240px] items-center gap-2 px-3",
+                                "rounded-md border bg-white dark:bg-nb-gray-900",
+                                "border-neutral-200 dark:border-nb-gray-700",
+                                "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
+                                "hover:border-nb-gray-700 data-[state=open]:border-nb-gray-700 dark:hover:border-nb-gray-600 dark:data-[state=open]:border-nb-gray-600",
+                                isFocusVisible &&
+                                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                "disabled:opacity-50",
+                            )}
+                        >
+                            <LanguagesIcon
+                                size={16}
+                                aria-hidden={"true"}
+                                className={"shrink-0 text-nb-gray-200"}
+                            />
+                            <span className={"flex-1 truncate text-start"}>
+                                {current ? labelFor(current) : "—"}
+                            </span>
+                            <ChevronDown
+                                size={12}
+                                aria-hidden={"true"}
+                                className={"shrink-0 text-nb-gray-400"}
+                            />
+                        </button>
+                    </Popover.Trigger>
+
+                    <Popover.Portal>
+                        <Popover.Content
+                            align={"start"}
+                            sideOffset={6}
+                            className={cn(
+                                "w-[var(--radix-popover-trigger-width)]",
+                                "z-50 rounded-lg border border-nb-gray-850 bg-nb-gray-920 p-1 shadow-lg",
+                                "data-[side=bottom]:origin-top data-[side=top]:origin-bottom",
+                                "data-[state=open]:animate-in",
+                                "data-[state=open]:fade-in-0",
+                                "data-[state=open]:zoom-in-95",
+                                "data-[side=bottom]:slide-in-from-top-1",
+                                "data-[side=top]:slide-in-from-bottom-1",
+                                "duration-150 ease-out",
+                            )}
+                        >
+                            <Command
+                                loop
+                                className={cn(
+                                    "flex flex-col",
+                                    "[&_[cmdk-input-wrapper]]:flex [&_[cmdk-input-wrapper]]:items-center",
+                                )}
+                            >
+                                <div className={"px-1 pb-1"}>
+                                    <div
+                                        role={"search"}
+                                        className={"group flex h-8 items-center gap-2 px-1"}
+                                    >
+                                        <Search
+                                            size={14}
+                                            aria-hidden={"true"}
+                                            className={"shrink-0 text-nb-gray-200"}
+                                        />
+                                        <Command.Input
+                                            autoFocus
+                                            placeholder={t("settings.general.language.search")}
+                                            aria-label={t("settings.general.language.search")}
+                                            className={cn(
+                                                "w-full bg-transparent text-xs text-nb-gray-100 placeholder:text-nb-gray-600 dark:placeholder:text-nb-gray-300",
+                                                "border-none outline-none",
+                                            )}
+                                        />
+                                    </div>
+                                </div>
+
+                                <ScrollArea.Root
+                                    dir={dir}
+                                    type={"auto"}
+                                    className={"-mx-1 overflow-hidden"}
+                                >
+                                    <ScrollArea.Viewport className={"max-h-64 px-1"}>
+                                        <Command.List>
+                                            <Command.Empty>
+                                                <div
+                                                    className={
+                                                        "px-3 py-4 text-center text-[0.7rem] text-nb-gray-400"
+                                                    }
+                                                >
+                                                    {t("settings.general.language.empty")}
+                                                </div>
+                                            </Command.Empty>
+
+                                            {sorted.map((lang) => {
+                                                const checked = lang.code === i18n.language;
+                                                return (
+                                                    <Command.Item
+                                                        key={lang.code}
+                                                        value={`${lang.displayName} ${lang.englishName} ${lang.code}`}
+                                                        onSelect={() => void select(lang.code)}
+                                                        className={cn(
+                                                            "my-0.5 flex cursor-default items-center gap-2 rounded-md px-2 py-2 outline-none",
+                                                            "text-xs font-semibold text-nb-gray-200",
+                                                            "data-[selected=true]:bg-nb-gray-850 data-[selected=true]:text-nb-gray-50",
+                                                        )}
+                                                    >
+                                                        <span className={"min-w-0 flex-1 truncate"}>
+                                                            {labelFor(lang)}
+                                                        </span>
+                                                        <span
+                                                            aria-hidden={"true"}
+                                                            className={
+                                                                "flex w-4 shrink-0 items-center justify-center"
+                                                            }
+                                                        >
+                                                            {checked && (
+                                                                <CheckIcon
+                                                                    size={14}
+                                                                    className={"text-netbird"}
+                                                                />
+                                                            )}
+                                                        </span>
+                                                    </Command.Item>
+                                                );
+                                            })}
+                                        </Command.List>
+                                    </ScrollArea.Viewport>
+                                    <ScrollArea.Scrollbar
+                                        orientation={"vertical"}
+                                        className={cn(
+                                            "flex touch-none select-none transition-colors",
+                                            "w-1.5 bg-transparent py-1",
+                                        )}
+                                    >
+                                        <ScrollArea.Thumb
+                                            className={
+                                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                                            }
+                                        />
+                                    </ScrollArea.Scrollbar>
+                                </ScrollArea.Root>
+                            </Command>
+                        </Popover.Content>
+                    </Popover.Portal>
+                </Popover.Root>
+            </div>
+        </div>
+    );
+}
diff --git a/client/ui/frontend/src/components/ManagementServerSwitch.tsx b/client/ui/frontend/src/components/ManagementServerSwitch.tsx
new file mode 100644
index 000000000..0083a767a
--- /dev/null
+++ b/client/ui/frontend/src/components/ManagementServerSwitch.tsx
@@ -0,0 +1,38 @@
+import { useTranslation } from "react-i18next";
+import netbirdLogo from "@/assets/logos/netbird.svg";
+import { SwitchItem } from "@/components/switches/SwitchItem";
+import { SwitchItemGroup } from "@/components/switches/SwitchItemGroup";
+import { ManagementMode } from "@/hooks/useManagementUrl.ts";
+
+type Props = {
+    value: ManagementMode;
+    onChange: (mode: ManagementMode) => void;
+    fullWidth?: boolean;
+};
+
+export const ManagementServerSwitch = ({ value, onChange, fullWidth = false }: Props) => {
+    const { t, i18n } = useTranslation();
+    const itemClass = fullWidth ? "flex-1" : undefined;
+    return (
+        <SwitchItemGroup
+            key={i18n.language}
+            value={value}
+            onChange={(v) => onChange(v as ManagementMode)}
+            aria-label={t("settings.general.management.label")}
+            className={fullWidth ? "w-full" : undefined}
+        >
+            <SwitchItem value={ManagementMode.Cloud} className={itemClass}>
+                <img
+                    src={netbirdLogo}
+                    alt={""}
+                    aria-hidden={"true"}
+                    className={"aspect-[31/23] h-[0.8rem] shrink-0"}
+                />
+                {t("settings.general.management.cloud")}
+            </SwitchItem>
+            <SwitchItem value={ManagementMode.SelfHosted} className={itemClass}>
+                {t("settings.general.management.selfHosted")}
+            </SwitchItem>
+        </SwitchItemGroup>
+    );
+};
diff --git a/client/ui/frontend/src/components/ReadySignal.tsx b/client/ui/frontend/src/components/ReadySignal.tsx
new file mode 100644
index 000000000..6a98b30ea
--- /dev/null
+++ b/client/ui/frontend/src/components/ReadySignal.tsx
@@ -0,0 +1,21 @@
+import { useEffect, useRef } from "react";
+import { useSearchParams } from "react-router-dom";
+import { Events } from "@wailsio/runtime";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+
+const EVENT_WINDOW_PAINTED = "netbird:window-painted";
+
+export const ReadySignal = () => {
+    const { isReady } = useStatus();
+    const [params] = useSearchParams();
+    const generation = params.get("gen") ?? "";
+    const sent = useRef<string | null>(null);
+
+    useEffect(() => {
+        if (!isReady || sent.current === generation) return;
+        sent.current = generation;
+        void Events.Emit(EVENT_WINDOW_PAINTED, generation);
+    }, [isReady, generation]);
+
+    return null;
+};
diff --git a/client/ui/frontend/src/components/SquareIcon.tsx b/client/ui/frontend/src/components/SquareIcon.tsx
new file mode 100644
index 000000000..aaf3b1100
--- /dev/null
+++ b/client/ui/frontend/src/components/SquareIcon.tsx
@@ -0,0 +1,37 @@
+import { type ComponentType } from "react";
+import { type LucideProps } from "lucide-react";
+import { cn } from "@/lib/cn";
+
+export type SquareIconVariant = "default" | "info" | "warning" | "danger";
+
+const variantClass: Record<SquareIconVariant, string> = {
+    default: "text-nb-gray-50",
+    info: "text-sky-400",
+    warning: "text-netbird",
+    danger: "text-red-500",
+};
+
+type SquareIconProps = {
+    icon: ComponentType<LucideProps>;
+    iconSize?: number;
+    variant?: SquareIconVariant;
+    className?: string;
+};
+
+export const SquareIcon = ({
+    icon: Icon,
+    iconSize = 18,
+    variant = "default",
+    className,
+}: SquareIconProps) => (
+    <div
+        aria-hidden={"true"}
+        className={cn(
+            "flex h-11 w-11 items-center justify-center rounded-lg border border-nb-gray-800 bg-nb-gray-920 dark:border-nb-gray-900",
+            variantClass[variant],
+            className,
+        )}
+    >
+        <Icon size={iconSize} />
+    </div>
+);
diff --git a/client/ui/frontend/src/components/ThemePicker.tsx b/client/ui/frontend/src/components/ThemePicker.tsx
new file mode 100644
index 000000000..3acb11a99
--- /dev/null
+++ b/client/ui/frontend/src/components/ThemePicker.tsx
@@ -0,0 +1,57 @@
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { MonitorIcon, MoonIcon, SunMediumIcon, type LucideIcon } from "lucide-react";
+import { Select } from "@/components/inputs/Select";
+import { HelpText } from "@/components/typography/HelpText";
+import { Label } from "@/components/typography/Label";
+import { useTheme, type ThemePreference } from "@/contexts/ThemeContext";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+const OPTIONS: { value: ThemePreference; icon: LucideIcon; labelKey: string }[] = [
+    { value: "system", icon: MonitorIcon, labelKey: "settings.general.theme.system" },
+    { value: "light", icon: SunMediumIcon, labelKey: "settings.general.theme.light" },
+    { value: "dark", icon: MoonIcon, labelKey: "settings.general.theme.dark" },
+];
+
+export function ThemePicker() {
+    const { t } = useTranslation();
+    const { theme, setTheme } = useTheme();
+    const [busy, setBusy] = useState(false);
+
+    const select = async (value: ThemePreference) => {
+        if (busy || value === theme) return;
+        setBusy(true);
+        try {
+            await setTheme(value);
+        } catch (e) {
+            await errorDialog({
+                Title: t("settings.error.saveTitle"),
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            setBusy(false);
+        }
+    };
+
+    return (
+        <div className={"flex items-center justify-between gap-6"}>
+            <div className={"max-w-md flex-1"}>
+                <Label as={"div"}>{t("settings.general.theme.label")}</Label>
+                <HelpText margin={false}>{t("settings.general.theme.help")}</HelpText>
+            </div>
+            <div className={"shrink-0"}>
+                <Select
+                    value={theme}
+                    options={OPTIONS.map(({ value, icon, labelKey }) => ({
+                        value,
+                        icon,
+                        label: t(labelKey),
+                    }))}
+                    onChange={(v) => void select(v)}
+                    ariaLabel={t("settings.general.theme.label")}
+                    disabled={busy}
+                />
+            </div>
+        </div>
+    );
+}
diff --git a/client/ui/frontend/src/components/Tooltip.tsx b/client/ui/frontend/src/components/Tooltip.tsx
new file mode 100644
index 000000000..86589e47f
--- /dev/null
+++ b/client/ui/frontend/src/components/Tooltip.tsx
@@ -0,0 +1,107 @@
+import { type ReactNode, useEffect, useRef, useState } from "react";
+import * as RTooltip from "@radix-ui/react-tooltip";
+import { cn } from "@/lib/cn";
+import { useDirection } from "@/hooks/useDirection";
+
+type Props = {
+    content: ReactNode;
+    children: ReactNode;
+    side?: RTooltip.TooltipContentProps["side"];
+    align?: RTooltip.TooltipContentProps["align"];
+    delayDuration?: number;
+    sideOffset?: number;
+    alignOffset?: number;
+    interactive?: boolean;
+    keepOpenOnClick?: boolean;
+    contentClassName?: string;
+    closeDelay?: number;
+};
+
+export const Tooltip = ({
+    content,
+    children,
+    side = "bottom",
+    align = "center",
+    delayDuration = 200,
+    sideOffset = 6,
+    alignOffset = 0,
+    interactive = false,
+    keepOpenOnClick = true,
+    contentClassName,
+    closeDelay = 0,
+}: Props) => {
+    const dir = useDirection();
+    const physicalSide = dir === "rtl" ? mirrorSide(side) : side;
+    const [open, setOpen] = useState(false);
+    const hoveringRef = useRef(false);
+    const closeTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+    const cancelClose = () => {
+        if (closeTimer.current) {
+            clearTimeout(closeTimer.current);
+            closeTimer.current = null;
+        }
+    };
+    const scheduleClose = () => {
+        cancelClose();
+        if (closeDelay <= 0) {
+            setOpen(false);
+            return;
+        }
+        closeTimer.current = setTimeout(() => setOpen(false), closeDelay);
+    };
+    useEffect(() => () => cancelClose(), []);
+
+    const handleOpenChange = (next: boolean) => {
+        if (!next && keepOpenOnClick && hoveringRef.current) return;
+        if (next) cancelClose();
+        setOpen(next);
+    };
+
+    return (
+        <RTooltip.Provider delayDuration={delayDuration} disableHoverableContent={!interactive}>
+            <RTooltip.Root open={open} onOpenChange={handleOpenChange}>
+                <RTooltip.Trigger
+                    asChild
+                    onPointerEnter={() => {
+                        hoveringRef.current = true;
+                        cancelClose();
+                    }}
+                    onPointerLeave={() => {
+                        hoveringRef.current = false;
+                        scheduleClose();
+                    }}
+                >
+                    {children}
+                </RTooltip.Trigger>
+                <RTooltip.Portal>
+                    <RTooltip.Content
+                        side={physicalSide}
+                        align={align}
+                        sideOffset={sideOffset}
+                        alignOffset={alignOffset}
+                        onPointerEnter={interactive ? cancelClose : undefined}
+                        onPointerLeave={interactive ? scheduleClose : undefined}
+                        onPointerDownOutside={interactive ? undefined : (e) => e.preventDefault()}
+                        className={cn(
+                            "z-50 select-none text-xs text-nb-gray-100 shadow-sm dark:shadow-lg",
+                            "data-[state=delayed-open]:animate-in data-[state=closed]:animate-out",
+                            "data-[state=closed]:fade-out-0 data-[state=delayed-open]:fade-in-0",
+                            !interactive && "pointer-events-none",
+                            contentClassName ??
+                                "rounded-md border border-nb-gray-800 bg-white px-2 py-1 dark:border-nb-gray-850 dark:bg-nb-gray-900",
+                        )}
+                    >
+                        {content}
+                    </RTooltip.Content>
+                </RTooltip.Portal>
+            </RTooltip.Root>
+        </RTooltip.Provider>
+    );
+};
+
+function mirrorSide(side: Props["side"]): Props["side"] {
+    if (side === "left") return "right";
+    if (side === "right") return "left";
+    return side;
+}
diff --git a/client/ui/frontend/src/components/TruncatedText.tsx b/client/ui/frontend/src/components/TruncatedText.tsx
new file mode 100644
index 000000000..1174a8b42
--- /dev/null
+++ b/client/ui/frontend/src/components/TruncatedText.tsx
@@ -0,0 +1,39 @@
+import { useLayoutEffect, useRef, useState, type ReactNode } from "react";
+import { Tooltip } from "@/components/Tooltip";
+
+type Props = {
+    text: string;
+    className?: string;
+    tooltipContent?: ReactNode;
+    delayDuration?: number;
+    dir?: "ltr" | "rtl" | "auto";
+};
+
+export const TruncatedText = ({
+    text,
+    className,
+    tooltipContent,
+    delayDuration = 600,
+    dir = "auto",
+}: Props) => {
+    const ref = useRef<HTMLSpanElement>(null);
+    const [overflowing, setOverflowing] = useState(false);
+
+    useLayoutEffect(() => {
+        const el = ref.current;
+        if (!el) return;
+        setOverflowing(el.scrollWidth > el.clientWidth);
+    }, [text]);
+
+    const span = (
+        <span ref={ref} dir={dir} className={className}>
+            {text}
+        </span>
+    );
+    if (!overflowing) return span;
+    return (
+        <Tooltip content={tooltipContent ?? text} delayDuration={delayDuration}>
+            {span}
+        </Tooltip>
+    );
+};
diff --git a/client/ui/frontend/src/components/VerticalTabs.tsx b/client/ui/frontend/src/components/VerticalTabs.tsx
new file mode 100644
index 000000000..bd1912662
--- /dev/null
+++ b/client/ui/frontend/src/components/VerticalTabs.tsx
@@ -0,0 +1,103 @@
+import { type ComponentType, type ReactNode, forwardRef } from "react";
+import * as Tabs from "@radix-ui/react-tabs";
+import { type LucideProps } from "lucide-react";
+import { cn } from "@/lib/cn";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { useDirection } from "@/hooks/useDirection";
+
+const Root = forwardRef<HTMLDivElement, Omit<Tabs.TabsProps, "orientation">>(
+    function VerticalTabsRoot({ className, ...props }, ref) {
+        const dir = useDirection();
+        return (
+            <Tabs.Root
+                ref={ref}
+                dir={dir}
+                orientation={"vertical"}
+                className={cn("flex min-h-0 flex-1", className)}
+                {...props}
+            />
+        );
+    },
+);
+
+const List = forwardRef<HTMLDivElement, Tabs.TabsListProps>(function VerticalTabsList(
+    { className, ...props },
+    ref,
+) {
+    return (
+        <Tabs.List
+            ref={ref}
+            className={cn("flex w-full flex-col gap-1 p-5 pe-0", className)}
+            {...props}
+        />
+    );
+});
+
+type TriggerProps = Tabs.TabsTriggerProps & {
+    icon: ComponentType<LucideProps>;
+    title: string;
+    iconSize?: number;
+    adornment?: ReactNode;
+};
+
+const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTabsTrigger(
+    { icon: Icon, title, iconSize = 16, adornment, className, ...props },
+    ref,
+) {
+    const isFocusVisible = useFocusVisible();
+    return (
+        <Tabs.Trigger
+            ref={ref}
+            className={cn(
+                "group flex w-full cursor-default items-center gap-3 rounded-md border border-transparent px-2 py-2.5 text-start outline-none dark:border-0",
+                "transition-colors duration-150",
+                "data-[state=active]:border-nb-gray-800 data-[state=active]:bg-white dark:data-[state=active]:bg-nb-gray-930",
+                "data-[state=inactive]:hover:bg-nb-gray-850 dark:data-[state=inactive]:hover:bg-nb-gray-935",
+                isFocusVisible &&
+                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                className,
+            )}
+            {...props}
+        >
+            <Icon
+                size={iconSize}
+                aria-hidden={"true"}
+                className={cn(
+                    "ms-2 shrink-0 transition-colors duration-150",
+                    "text-nb-gray-350 dark:text-nb-gray-400",
+                    "group-data-[state=active]:text-nb-gray-100",
+                )}
+            />
+            <span
+                className={cn(
+                    "min-w-0 truncate text-sm font-medium transition-colors duration-150",
+                    "text-nb-gray-350 dark:text-nb-gray-400",
+                    "group-data-[state=active]:font-semibold group-data-[state=active]:text-nb-gray-100 dark:group-data-[state=active]:font-medium",
+                )}
+            >
+                {title}
+            </span>
+            {adornment && (
+                <div aria-hidden={"true"} className={"me-2 ms-auto shrink-0"}>
+                    {adornment}
+                </div>
+            )}
+        </Tabs.Trigger>
+    );
+});
+
+const Content = forwardRef<HTMLDivElement, Tabs.TabsContentProps>(function VerticalTabsContent(
+    { className, ...props },
+    ref,
+) {
+    return (
+        <Tabs.Content
+            ref={ref}
+            tabIndex={-1}
+            className={cn("outline-none", className)}
+            {...props}
+        />
+    );
+});
+
+export const VerticalTabs = Object.assign(Root, { List, Trigger, Content });
diff --git a/client/ui/frontend/src/components/buttons/Button.tsx b/client/ui/frontend/src/components/buttons/Button.tsx
new file mode 100644
index 000000000..50e8c919d
--- /dev/null
+++ b/client/ui/frontend/src/components/buttons/Button.tsx
@@ -0,0 +1,204 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import { Check, Copy, Loader2 } from "lucide-react";
+import { type ButtonHTMLAttributes, forwardRef, useEffect, useRef, useState } from "react";
+
+import { cn } from "@/lib/cn";
+
+type ButtonVariants = VariantProps<typeof buttonVariants>;
+
+interface ButtonProps extends ButtonHTMLAttributes<HTMLButtonElement>, ButtonVariants {
+    disabled?: boolean;
+    stopPropagation?: boolean;
+    copy?: string;
+    loading?: boolean;
+}
+
+const buttonVariants = cva(
+    [
+        "relative",
+        "cursor-default select-none whitespace-nowrap text-sm font-medium shadow-sm focus:z-10 focus:outline-none focus:ring-2",
+        "inline-flex items-center justify-center gap-2 transition-colors focus:ring-offset-1",
+        "disabled:cursor-not-allowed disabled:opacity-40 dark:ring-offset-neutral-950/50 disabled:dark:text-nb-gray-300",
+    ],
+    {
+        variants: {
+            variant: {
+                default: [
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
+                    "dark:border-gray-700/30 dark:bg-nb-gray dark:text-gray-400 dark:hover:bg-zinc-800/50 dark:hover:text-nb-gray-50 dark:focus:ring-zinc-800/50",
+                ],
+                primary: [
+                    "dark:text-gray-100 dark:ring-offset-neutral-950/50 dark:focus:ring-netbird-600/50 enabled:dark:bg-netbird enabled:dark:hover:bg-netbird-500/80 enabled:dark:hover:text-nb-gray-50 disabled:dark:bg-nb-gray-900",
+                    "enabled:bg-netbird enabled:text-white enabled:hover:bg-netbird-500 enabled:focus:ring-netbird-400/50 disabled:bg-nb-gray-700",
+                ],
+                secondary: [
+                    "border-neutral-200 bg-white text-neutral-900 hover:border-nb-gray-700 hover:bg-nb-gray-950 hover:text-black focus:ring-nb-gray-500/50 focus:ring-offset-0",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20 dark:focus:ring-offset-1",
+                    "dark:border-gray-700/40 dark:bg-nb-gray-920 dark:text-gray-400 dark:hover:border-gray-700/40 dark:hover:bg-nb-gray-910 dark:hover:text-nb-gray-50",
+                ],
+                secondaryLighter: [
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
+                    "dark:border-gray-700/70 dark:bg-nb-gray-900/70 dark:text-gray-400 dark:hover:bg-nb-gray-800/60 dark:hover:text-nb-gray-50",
+                ],
+                subtle: [
+                    "border-neutral-200 bg-neutral-50 text-neutral-900 hover:bg-neutral-100 focus:ring-neutral-200/60",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-nb-gray-200/40",
+                    "dark:border-nb-gray-200 dark:bg-nb-gray-50 dark:text-nb-gray-900 dark:hover:bg-nb-gray-100 dark:hover:text-nb-gray-950",
+                ],
+                input: [
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
+                    "dark:border-nb-gray-700 dark:bg-nb-gray-900 dark:text-gray-400 dark:hover:bg-nb-gray-900/80",
+                ],
+                dropdown: [
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
+                    "dark:border-nb-gray-900 dark:bg-nb-gray-900/40 dark:text-gray-400 dark:hover:bg-nb-gray-900/50",
+                ],
+                dotted: [
+                    "border-dashed border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
+                    "dark:border-gray-500/40 dark:bg-nb-gray-900/30 dark:text-gray-400 dark:hover:bg-nb-gray-900/50 dark:hover:text-nb-gray-50",
+                ],
+                tertiary: [
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
+                    "dark:border-gray-700/40 dark:bg-white dark:text-gray-800 dark:hover:bg-neutral-200 dark:focus:ring-zinc-800/50 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300",
+                ],
+                white: [
+                    "border-white bg-white text-neutral-800 outline-none hover:bg-neutral-200 focus:ring-white/50 dark:text-gray-800 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300",
+                    "disabled:dark:border-nb-gray-900 disabled:dark:bg-nb-gray-900 disabled:dark:text-nb-gray-300",
+                ],
+                outline: [
+                    "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
+                    "dark:border-netbird dark:bg-transparent dark:text-netbird dark:hover:bg-nb-gray-900/30 dark:focus:ring-zinc-800/50",
+                ],
+                "danger-outline": [
+                    "bg-transparent text-red-600 enabled:hover:bg-red-50 enabled:focus:ring-red-200/50",
+                    "dark:bg-transparent dark:text-red-500 enabled:dark:hover:border-red-800/50 enabled:hover:dark:bg-red-950/50 enabled:dark:focus:bg-red-950/40 enabled:dark:focus:ring-red-800/20",
+                ],
+                "danger-text": [
+                    "rounded-sm border-transparent bg-transparent !px-0 !py-0 text-red-600 !shadow-none hover:text-red-700 focus:ring-red-500/30",
+                    "dark:border-transparent dark:bg-transparent dark:text-red-500 dark:ring-offset-neutral-950/50 dark:hover:text-red-600",
+                ],
+                "default-outline": [
+                    "ring-offset-nb-gray-950/50 focus:ring-nb-gray-500/20",
+                    "border-transparent bg-transparent text-nb-gray-400 hover:border-nb-gray-800/50 hover:bg-nb-gray-900/30 hover:text-nb-gray-50",
+                    "data-[state=open]:border-nb-gray-800/50 data-[state=open]:bg-nb-gray-900/30 data-[state=open]:text-nb-gray-50",
+                ],
+                ghost: [
+                    "ring-offset-nb-gray-950/50 focus:ring-nb-gray-500/20",
+                    "border-transparent bg-transparent text-nb-gray-400 hover:bg-nb-gray-900/30 hover:text-nb-gray-50",
+                ],
+                danger: [
+                    "bg-red-600 text-red-50 hover:bg-red-700 focus:bg-red-700 focus:ring-red-700/20",
+                    "dark:bg-red-600 dark:text-red-100 dark:hover:border-red-800/50 hover:dark:bg-red-700 dark:focus:bg-red-700 dark:focus:ring-red-700/20",
+                ],
+            },
+            size: {
+                xs: "px-3.5 py-2.5 text-xs",
+                xs2: "px-4 py-[1.1rem] text-[0.78rem] leading-[0]",
+                sm: "px-4 py-[9px] text-sm",
+                md: "px-4 py-[9px]",
+                lg: "px-4 py-[9px] text-lg",
+            },
+            rounded: {
+                true: "rounded-md",
+                false: "",
+            },
+            border: {
+                0: "border",
+                1: "border border-transparent",
+                2: "border border-b-0 border-t-0",
+            },
+        },
+    },
+);
+
+export const Button = forwardRef<HTMLButtonElement, ButtonProps>(function Button(
+    {
+        variant = "default",
+        rounded = true,
+        border = 1,
+        size = "md",
+        stopPropagation = true,
+        type = "button",
+        children,
+        className,
+        onClick,
+        disabled,
+        copy,
+        loading = false,
+        ...props
+    },
+    ref,
+) {
+    const [copied, setCopied] = useState(false);
+    const copyTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+    useEffect(
+        () => () => {
+            if (copyTimer.current) clearTimeout(copyTimer.current);
+        },
+        [],
+    );
+    const iconSize = size === "xs" ? 12 : 14;
+    return (
+        <button
+            ref={ref}
+            type={type}
+            tabIndex={0}
+            disabled={disabled}
+            aria-disabled={loading || undefined}
+            aria-busy={loading || undefined}
+            className={cn(
+                buttonVariants({
+                    variant,
+                    rounded,
+                    border: border ? 1 : 0,
+                    size,
+                }),
+                loading && "pointer-events-none",
+                className,
+            )}
+            onClick={(e) => {
+                if (stopPropagation) e.stopPropagation();
+                if (loading) {
+                    e.preventDefault();
+                    return;
+                }
+                if (copy !== undefined) {
+                    void navigator.clipboard
+                        .writeText(copy)
+                        .then(() => {
+                            setCopied(true);
+                            if (copyTimer.current) clearTimeout(copyTimer.current);
+                            copyTimer.current = setTimeout(() => setCopied(false), 1500);
+                        })
+                        .catch((e: unknown) => console.warn("copy to clipboard failed", e));
+                }
+                onClick?.(e);
+            }}
+            {...props}
+        >
+            {loading && (
+                <span
+                    aria-hidden={"true"}
+                    className={"absolute inset-0 flex items-center justify-center"}
+                >
+                    <Loader2 size={iconSize} className={"animate-spin"} />
+                </span>
+            )}
+            <span className={cn("contents", loading && "invisible")}>
+                {copy !== undefined &&
+                    (copied ? (
+                        <Check size={iconSize} aria-hidden={"true"} />
+                    ) : (
+                        <Copy size={iconSize} aria-hidden={"true"} />
+                    ))}
+                {children}
+            </span>
+        </button>
+    );
+});
+
+export default Button;
diff --git a/client/ui/frontend/src/components/buttons/IconButton.tsx b/client/ui/frontend/src/components/buttons/IconButton.tsx
new file mode 100644
index 000000000..8d688cb0b
--- /dev/null
+++ b/client/ui/frontend/src/components/buttons/IconButton.tsx
@@ -0,0 +1,36 @@
+import { type ButtonHTMLAttributes, type ComponentType, forwardRef } from "react";
+import { type LucideProps } from "lucide-react";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { cn } from "@/lib/cn";
+
+type Props = ButtonHTMLAttributes<HTMLButtonElement> & {
+    icon: ComponentType<LucideProps>;
+    iconSize?: number;
+    iconClassName?: string;
+};
+
+export const IconButton = forwardRef<HTMLButtonElement, Props>(function IconButton(
+    { icon: Icon, iconSize = 17, iconClassName, className, type = "button", disabled, ...props },
+    ref,
+) {
+    const isFocusVisible = useFocusVisible();
+    return (
+        <button
+            ref={ref}
+            type={type}
+            disabled={disabled}
+            tabIndex={disabled ? -1 : 0}
+            className={cn(
+                "flex h-10 w-10 cursor-default items-center justify-center rounded-lg outline-none",
+                "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-300",
+                isFocusVisible &&
+                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                "wails-no-draggable transition-colors duration-150",
+                className,
+            )}
+            {...props}
+        >
+            <Icon size={iconSize} className={iconClassName} />
+        </button>
+    );
+});
diff --git a/client/ui/frontend/src/components/dialog/ConfirmDialog.tsx b/client/ui/frontend/src/components/dialog/ConfirmDialog.tsx
new file mode 100644
index 000000000..caf98c2c8
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/ConfirmDialog.tsx
@@ -0,0 +1,35 @@
+import { type ReactNode, forwardRef } from "react";
+import { cn } from "@/lib/cn.ts";
+import { isMacOS } from "@/lib/platform.ts";
+
+type ConfirmDialogProps = {
+    children: ReactNode;
+    "aria-label"?: string;
+    "aria-labelledby"?: string;
+};
+
+export const ConfirmDialog = forwardRef<HTMLDivElement, ConfirmDialogProps>(function ConfirmDialog(
+    { children, "aria-label": ariaLabel, "aria-labelledby": ariaLabelledBy },
+    ref,
+) {
+    return (
+        <dialog
+            open
+            aria-label={ariaLabel}
+            aria-labelledby={ariaLabelledBy}
+            className={
+                "wails-draggable static m-0 flex max-h-none w-full max-w-none select-none flex-col items-center border-0 bg-transparent p-0 text-inherit"
+            }
+        >
+            <div
+                ref={ref}
+                className={cn(
+                    "flex flex-col items-center gap-5 px-8 pb-7 pt-6 text-center",
+                    isMacOS() && "pt-10",
+                )}
+            >
+                {children}
+            </div>
+        </dialog>
+    );
+});
diff --git a/client/ui/frontend/src/components/dialog/ConfirmModal.tsx b/client/ui/frontend/src/components/dialog/ConfirmModal.tsx
new file mode 100644
index 000000000..e9c33e677
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/ConfirmModal.tsx
@@ -0,0 +1,87 @@
+import { type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import * as Dialog from "@/components/dialog/Dialog";
+import { Button } from "@/components/buttons/Button";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogActions } from "@/components/dialog/DialogActions";
+
+type ConfirmModalProps = {
+    open: boolean;
+    title: ReactNode;
+    description: ReactNode;
+    confirmLabel: string;
+    cancelLabel?: string;
+    danger?: boolean;
+    busy?: boolean;
+    cancellable?: boolean;
+    onConfirm: () => void;
+    onCancel: () => void;
+};
+
+export const ConfirmModal = ({
+    open,
+    title,
+    description,
+    confirmLabel,
+    cancelLabel,
+    danger = false,
+    busy = false,
+    cancellable,
+    onConfirm,
+    onCancel,
+}: ConfirmModalProps) => {
+    const { t } = useTranslation();
+    const resolvedCancel = cancelLabel ?? t("common.cancel");
+    const canCancel = cancellable ?? !busy;
+
+    const srTitle = typeof title === "string" ? title : undefined;
+    const srDescription = typeof description === "string" ? description : undefined;
+
+    return (
+        <Dialog.Root
+            open={open}
+            onOpenChange={(next) => {
+                if (!next && canCancel) onCancel();
+            }}
+        >
+            <Dialog.Content
+                maxWidthClass={"max-w-sm"}
+                showClose={false}
+                className={"py-5"}
+                srTitle={srTitle}
+                srDescription={srDescription}
+                onOpenAutoFocus={(e) => e.preventDefault()}
+            >
+                <div className={"flex flex-col gap-5 px-5"}>
+                    <div className={"flex flex-col gap-1 ps-1"}>
+                        <DialogHeading align={"start"}>{title}</DialogHeading>
+                        <DialogDescription align={"start"} className={"whitespace-pre-line"}>
+                            {description}
+                        </DialogDescription>
+                    </div>
+
+                    <DialogActions className={"flex-row justify-end gap-2.5"}>
+                        <Button
+                            variant={"secondary"}
+                            size={"sm"}
+                            disabled={!canCancel}
+                            onClick={onCancel}
+                        >
+                            {resolvedCancel}
+                        </Button>
+                        <Button
+                            autoFocus
+                            variant={danger ? "danger" : "primary"}
+                            size={"sm"}
+                            loading={busy}
+                            onClick={onConfirm}
+                        >
+                            {confirmLabel}
+                        </Button>
+                    </DialogActions>
+                </div>
+            </Dialog.Content>
+        </Dialog.Root>
+    );
+};
diff --git a/client/ui/frontend/src/components/dialog/Dialog.tsx b/client/ui/frontend/src/components/dialog/Dialog.tsx
new file mode 100644
index 000000000..3d0d47fc2
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/Dialog.tsx
@@ -0,0 +1,159 @@
+import {
+    forwardRef,
+    type ComponentPropsWithoutRef,
+    type ElementRef,
+    type HTMLAttributes,
+} from "react";
+import * as DialogPrimitive from "@radix-ui/react-dialog";
+import { VisuallyHidden } from "@radix-ui/react-visually-hidden";
+import { X } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { cn } from "@/lib/cn";
+
+export const Root = DialogPrimitive.Root;
+
+type OverlayProps = ComponentPropsWithoutRef<typeof DialogPrimitive.Overlay> & {
+    exitAnimation?: boolean;
+};
+
+const Overlay = forwardRef<ElementRef<typeof DialogPrimitive.Overlay>, OverlayProps>(
+    function DialogOverlay({ className, exitAnimation = false, ...props }, ref) {
+        return (
+            <DialogPrimitive.Overlay
+                ref={ref}
+                className={cn(
+                    "fixed inset-0 z-50 grid items-center justify-items-center overflow-y-auto px-10 py-16",
+                    "bg-black/25 dark:bg-black/60",
+                    "data-[state=open]:animate-in data-[state=open]:fade-in-0",
+                    exitAnimation &&
+                        "data-[state=closed]:animate-out data-[state=closed]:fade-out-0",
+                    "duration-150 ease-out",
+                    className,
+                )}
+                {...props}
+            />
+        );
+    },
+);
+
+type ContentProps = ComponentPropsWithoutRef<typeof DialogPrimitive.Content> & {
+    showClose?: boolean;
+    maxWidthClass?: string;
+    exitAnimation?: boolean;
+    srTitle?: string;
+    srDescription?: string;
+};
+
+export const Content = forwardRef<ElementRef<typeof DialogPrimitive.Content>, ContentProps>(
+    function DialogContent(
+        {
+            className,
+            children,
+            showClose = true,
+            maxWidthClass = "max-w-md",
+            exitAnimation = false,
+            srTitle,
+            srDescription,
+            ...props
+        },
+        ref,
+    ) {
+        const { t } = useTranslation();
+        return (
+            <DialogPrimitive.Portal>
+                <Overlay exitAnimation={exitAnimation}>
+                    <DialogPrimitive.Content
+                        ref={ref}
+                        className={cn(
+                            "relative z-[52] mx-auto w-full outline-none ring-0",
+                            "focus:outline-none focus:ring-0 focus-visible:outline-none focus-visible:ring-0",
+                            "rounded-lg border border-nb-gray-800 bg-nb-gray-940 py-7 shadow-2xl dark:border-nb-gray-900 dark:bg-nb-gray",
+                            "data-[state=open]:animate-in data-[state=open]:fade-in-0",
+                            "data-[state=open]:zoom-in-95 data-[state=open]:slide-in-from-left-1",
+                            exitAnimation &&
+                                "data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=closed]:slide-out-to-left-1",
+                            "duration-150 ease-out",
+                            maxWidthClass,
+                            className,
+                        )}
+                        onClick={(e) => e.stopPropagation()}
+                        {...props}
+                    >
+                        <VisuallyHidden asChild>
+                            <DialogPrimitive.Title>
+                                {srTitle ?? t("common.netbird")}
+                            </DialogPrimitive.Title>
+                        </VisuallyHidden>
+                        {srDescription && (
+                            <VisuallyHidden asChild>
+                                <DialogPrimitive.Description>
+                                    {srDescription}
+                                </DialogPrimitive.Description>
+                            </VisuallyHidden>
+                        )}
+                        {children}
+                        {showClose && (
+                            <DialogPrimitive.Close
+                                className={cn(
+                                    "absolute end-3 top-3 z-10 rounded-md p-3 transition-colors",
+                                    "text-nb-gray-300 hover:text-nb-gray-100",
+                                    "focus:outline-none disabled:pointer-events-none",
+                                )}
+                                aria-label={t("common.close")}
+                            >
+                                <X className={"h-4 w-4"} aria-hidden={"true"} />
+                            </DialogPrimitive.Close>
+                        )}
+                    </DialogPrimitive.Content>
+                </Overlay>
+            </DialogPrimitive.Portal>
+        );
+    },
+);
+
+export const Title = forwardRef<
+    ElementRef<typeof DialogPrimitive.Title>,
+    ComponentPropsWithoutRef<typeof DialogPrimitive.Title>
+>(function DialogTitle({ className, ...props }, ref) {
+    return (
+        <DialogPrimitive.Title
+            ref={ref}
+            className={cn(
+                "text-md font-semibold leading-none tracking-tight text-nb-gray-50",
+                className,
+            )}
+            {...props}
+        />
+    );
+});
+
+export const Description = forwardRef<
+    ElementRef<typeof DialogPrimitive.Description>,
+    ComponentPropsWithoutRef<typeof DialogPrimitive.Description>
+>(function DialogDescription({ className, ...props }, ref) {
+    return (
+        <DialogPrimitive.Description
+            ref={ref}
+            className={cn("mt-2 text-sm leading-snug text-nb-gray-400", className)}
+            {...props}
+        />
+    );
+});
+
+type FooterProps = HTMLAttributes<HTMLDivElement> & {
+    separator?: boolean;
+};
+
+export const Footer = ({ className, separator = true, ...props }: FooterProps) => (
+    <div className={cn(separator && "mt-6 border-t border-nb-gray-900")}>
+        <div
+            className={cn(
+                "flex flex-col-reverse gap-3 sm:flex-row sm:justify-end",
+                "[&>*]:w-full sm:[&>*]:w-auto",
+                "px-8 pt-6",
+                className,
+            )}
+            {...props}
+        />
+    </div>
+);
diff --git a/client/ui/frontend/src/components/dialog/DialogActions.tsx b/client/ui/frontend/src/components/dialog/DialogActions.tsx
new file mode 100644
index 000000000..3aa3a1fe5
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/DialogActions.tsx
@@ -0,0 +1,13 @@
+import { type ReactNode } from "react";
+import { cn } from "@/lib/cn";
+
+type DialogActionsProps = {
+    children: ReactNode;
+    className?: string;
+};
+
+export const DialogActions = ({ children, className }: DialogActionsProps) => (
+    <div className={cn("wails-no-draggable mx-auto flex w-full flex-col gap-3", className)}>
+        {children}
+    </div>
+);
diff --git a/client/ui/frontend/src/components/dialog/DialogDescription.tsx b/client/ui/frontend/src/components/dialog/DialogDescription.tsx
new file mode 100644
index 000000000..3d6ecbba7
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/DialogDescription.tsx
@@ -0,0 +1,26 @@
+import { type ReactNode } from "react";
+import { cn } from "@/lib/cn";
+
+type DialogAlign = "start" | "center" | "end";
+
+const alignClass: Record<DialogAlign, string> = {
+    start: "text-start",
+    center: "text-center",
+    end: "text-end",
+};
+
+type DialogDescriptionProps = {
+    children: ReactNode;
+    className?: string;
+    align?: DialogAlign;
+};
+
+export const DialogDescription = ({
+    children,
+    className,
+    align = "center",
+}: DialogDescriptionProps) => (
+    <p className={cn("w-full select-none text-sm text-nb-gray-300", alignClass[align], className)}>
+        {children}
+    </p>
+);
diff --git a/client/ui/frontend/src/components/dialog/DialogHeading.tsx b/client/ui/frontend/src/components/dialog/DialogHeading.tsx
new file mode 100644
index 000000000..52eb0c369
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/DialogHeading.tsx
@@ -0,0 +1,35 @@
+import { type ReactNode } from "react";
+import { cn } from "@/lib/cn";
+
+type DialogAlign = "start" | "center" | "end";
+
+const alignClass: Record<DialogAlign, string> = {
+    start: "text-start",
+    center: "text-center",
+    end: "text-end",
+};
+
+type DialogHeadingProps = {
+    children: ReactNode;
+    className?: string;
+    align?: DialogAlign;
+    id?: string;
+};
+
+export const DialogHeading = ({
+    children,
+    className,
+    align = "center",
+    id,
+}: DialogHeadingProps) => (
+    <h2
+        id={id}
+        className={cn(
+            "w-full select-none text-base font-semibold text-nb-gray-50",
+            alignClass[align],
+            className,
+        )}
+    >
+        {children}
+    </h2>
+);
diff --git a/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx b/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
new file mode 100644
index 000000000..da04bb4d7
--- /dev/null
+++ b/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
@@ -0,0 +1,99 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { AlertTriangleIcon, DownloadIcon } from "lucide-react";
+import { Browser } from "@wailsio/runtime";
+import { Version } from "@bindings/services";
+import { Button } from "@/components/buttons/Button";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+
+const RELEASES_URL = "https://github.com/netbirdio/netbird/releases/latest";
+const RC_RELEASES_URL = "https://pkgs.netbird.io/releases/rc";
+
+function openUrl(url: string) {
+    Browser.OpenURL(url).catch(() => globalThis.open(url, "_blank"));
+}
+
+export const DaemonOutdatedOverlay = () => {
+    const { t } = useTranslation();
+    const { status, isDaemonOutdated } = useStatus();
+
+    const [guiVersion, setGuiVersion] = useState<string>("-");
+    const clientVersion = status?.daemonVersion ?? "—";
+
+    const isRc = /-rc/i.test(guiVersion) || /-rc/i.test(clientVersion);
+    const downloadUrl = isRc ? RC_RELEASES_URL : RELEASES_URL;
+
+    useEffect(() => {
+        if (!isDaemonOutdated) return;
+        let cancelled = false;
+        Version.GUI()
+            .then((v) => {
+                if (!cancelled) setGuiVersion(v);
+            })
+            .catch((err) => console.error("[DaemonOutdatedOverlay] GUI version error", err));
+        return () => {
+            cancelled = true;
+        };
+    }, [isDaemonOutdated]);
+
+    if (!isDaemonOutdated) return null;
+
+    return (
+        <div
+            className={
+                "wails-draggable fixed inset-0 z-[100] flex cursor-default select-none items-center justify-center bg-nb-gray-950 backdrop-blur-sm"
+            }
+        >
+            <div className={"flex max-w-lg flex-col items-center gap-5 px-8 text-center"}>
+                <div
+                    className={
+                        "flex h-11 w-11 items-center justify-center rounded-xl border border-nb-gray-900 bg-nb-gray-920 text-amber-500"
+                    }
+                >
+                    <AlertTriangleIcon size={20} />
+                </div>
+
+                <div className={"flex flex-col items-center gap-1"}>
+                    <p className={"text-base font-medium text-nb-gray-50"}>
+                        {t("daemon.outdated.title")}
+                    </p>
+                    <p className={"text-sm text-nb-gray-300"}>{t("daemon.outdated.description")}</p>
+                </div>
+
+                <div className={"flex flex-col items-center gap-0.5 text-center"}>
+                    <p className={"text-sm font-semibold text-nb-gray-100"}>
+                        {clientVersion === "development" ? (
+                            <span>
+                                {t("settings.about.clientName")}{" "}
+                                <span dir={"auto"} className={"font-mono text-yellow-400"}>
+                                    {t("settings.about.development")}
+                                </span>
+                            </span>
+                        ) : (
+                            t("settings.about.client", { version: clientVersion })
+                        )}
+                    </p>
+                    <p className={"text-sm font-medium text-nb-gray-250"}>
+                        {guiVersion === "development" ? (
+                            <span>
+                                {t("settings.about.guiName")}{" "}
+                                <span dir={"auto"} className={"font-mono text-yellow-400"}>
+                                    {t("settings.about.development")}
+                                </span>
+                            </span>
+                        ) : (
+                            t("settings.about.gui", { version: guiVersion })
+                        )}
+                    </p>
+                </div>
+
+                <div className={"wails-no-draggable"}>
+                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(downloadUrl)}>
+                        <DownloadIcon size={14} />
+                        {t("daemon.outdated.download")}
+                    </Button>
+                </div>
+            </div>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/components/empty-state/DaemonUnavailableOverlay.tsx b/client/ui/frontend/src/components/empty-state/DaemonUnavailableOverlay.tsx
new file mode 100644
index 000000000..89c121e21
--- /dev/null
+++ b/client/ui/frontend/src/components/empty-state/DaemonUnavailableOverlay.tsx
@@ -0,0 +1,52 @@
+import { useTranslation } from "react-i18next";
+import { AlertCircleIcon, BookText } from "lucide-react";
+import { Browser } from "@wailsio/runtime";
+import { Button } from "@/components/buttons/Button";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+
+const DOCS_URL = "https://docs.netbird.io/how-to/installation";
+
+function openUrl(url: string) {
+    Browser.OpenURL(url).catch(() => globalThis.open(url, "_blank"));
+}
+
+export const DaemonUnavailableOverlay = () => {
+    const { t } = useTranslation();
+    const { isDaemonUnavailable } = useStatus();
+
+    if (!isDaemonUnavailable) return null;
+
+    return (
+        <div
+            className={
+                "wails-draggable fixed inset-0 z-[100] flex cursor-default select-none items-center justify-center bg-nb-gray-950 backdrop-blur-sm"
+            }
+        >
+            <div className={"flex max-w-lg flex-col items-center gap-5 px-8 text-center"}>
+                <div
+                    className={
+                        "flex h-11 w-11 items-center justify-center rounded-xl border border-nb-gray-900 bg-nb-gray-920 text-red-500"
+                    }
+                >
+                    <AlertCircleIcon size={20} />
+                </div>
+
+                <div className={"flex flex-col items-center gap-1"}>
+                    <p className={"text-base font-medium text-nb-gray-50"}>
+                        {t("daemon.unavailable.title")}
+                    </p>
+                    <p className={"text-sm text-nb-gray-300"}>
+                        {t("daemon.unavailable.description")}
+                    </p>
+                </div>
+
+                <div className={"wails-no-draggable"}>
+                    <Button variant={"secondary"} size={"xs"} onClick={() => openUrl(DOCS_URL)}>
+                        <BookText size={14} />
+                        {t("daemon.unavailable.docsLink")}
+                    </Button>
+                </div>
+            </div>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/components/empty-state/EmptyState.tsx b/client/ui/frontend/src/components/empty-state/EmptyState.tsx
new file mode 100644
index 000000000..7d6890a98
--- /dev/null
+++ b/client/ui/frontend/src/components/empty-state/EmptyState.tsx
@@ -0,0 +1,31 @@
+import { type ComponentType } from "react";
+import { type LucideProps } from "lucide-react";
+import { cn } from "@/lib/cn";
+import { SquareIcon } from "@/components/SquareIcon";
+import { isMacOS } from "@/lib/platform";
+
+// Knob to shift the centered main-window content up/down together.
+export const contentVerticalOffset = (): string => (isMacOS() ? "0.6rem" : "-1.4rem");
+export const contentTop = (base: string) => `calc(${base} + ${contentVerticalOffset()})`;
+
+type Props = {
+    icon: ComponentType<LucideProps>;
+    title: string;
+    description?: string;
+    className?: string;
+};
+
+export const EmptyState = ({ icon, title, description, className }: Props) => {
+    return (
+        <div className={cn("py-12 text-center", className)}>
+            <div
+                className={"relative mx-auto flex max-w-sm flex-col items-center justify-start"}
+                style={{ top: contentTop("7.8rem") }}
+            >
+                <SquareIcon icon={icon} className={"mb-3"} />
+                <p className={"mb-1 text-[0.95rem] font-medium text-nb-gray-200"}>{title}</p>
+                {description && <p className={"text-sm text-nb-gray-350"}>{description}</p>}
+            </div>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/components/empty-state/NoResults.tsx b/client/ui/frontend/src/components/empty-state/NoResults.tsx
new file mode 100644
index 000000000..cf0995b37
--- /dev/null
+++ b/client/ui/frontend/src/components/empty-state/NoResults.tsx
@@ -0,0 +1,22 @@
+import { type ComponentType } from "react";
+import { FunnelXIcon, type LucideProps } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { EmptyState } from "./EmptyState";
+
+type Props = {
+    icon?: ComponentType<LucideProps>;
+    title?: string;
+    description?: string;
+};
+
+export const NoResults = ({ icon = FunnelXIcon, title, description }: Props) => {
+    const { t } = useTranslation();
+    return (
+        <EmptyState
+            icon={icon}
+            title={title ?? t("common.noResults.title")}
+            description={description ?? t("common.noResults.description")}
+            className={"pointer-events-none relative -top-[3.8rem]"}
+        />
+    );
+};
diff --git a/client/ui/frontend/src/components/empty-state/NotConnectedState.tsx b/client/ui/frontend/src/components/empty-state/NotConnectedState.tsx
new file mode 100644
index 000000000..2bcf70376
--- /dev/null
+++ b/client/ui/frontend/src/components/empty-state/NotConnectedState.tsx
@@ -0,0 +1,16 @@
+import { GlobeOffIcon } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { EmptyState } from "./EmptyState";
+
+export const NotConnectedState = () => {
+    const { t } = useTranslation();
+    return (
+        <div className={"relative top-[3rem] w-full"}>
+            <EmptyState
+                icon={GlobeOffIcon}
+                title={t("notConnected.title")}
+                description={t("notConnected.description")}
+            />
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/components/inputs/Input.tsx b/client/ui/frontend/src/components/inputs/Input.tsx
new file mode 100644
index 000000000..9d82f4dad
--- /dev/null
+++ b/client/ui/frontend/src/components/inputs/Input.tsx
@@ -0,0 +1,379 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import { Check, ChevronDown, ChevronUp, Copy, Eye, EyeOff } from "lucide-react";
+import {
+    forwardRef,
+    type InputHTMLAttributes,
+    type ReactNode,
+    useEffect,
+    useId,
+    useRef,
+    useState,
+} from "react";
+import { useTranslation } from "react-i18next";
+import { cn } from "@/lib/cn";
+import { Label } from "@/components/typography/Label";
+
+type InputVariants = VariantProps<typeof inputVariants>;
+
+export interface InputProps extends InputHTMLAttributes<HTMLInputElement>, InputVariants {
+    label?: string;
+    customPrefix?: ReactNode;
+    customSuffix?: ReactNode;
+    maxWidthClass?: string;
+    icon?: ReactNode;
+    error?: string;
+    warning?: string;
+    prefixClassName?: string;
+    showPasswordToggle?: boolean;
+    copy?: boolean;
+}
+
+const inputVariants = cva("", {
+    variants: {
+        variant: {
+            default: [
+                "border-neutral-200 placeholder:text-nb-gray-600 dark:border-nb-gray-700 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
+                "ring-offset-neutral-200/20 focus-visible:ring-neutral-300/10 dark:ring-offset-neutral-950/50 dark:focus-visible:ring-neutral-500/20",
+            ],
+            darker: [
+                "border-neutral-300 placeholder:text-nb-gray-600 dark:border-nb-gray-800 dark:bg-nb-gray-920 dark:placeholder:text-neutral-400/70",
+                "ring-offset-neutral-200/20 focus-visible:ring-neutral-300/10 dark:ring-offset-neutral-950/50 dark:focus-visible:ring-neutral-500/20",
+            ],
+            error: [
+                "border-neutral-200 text-red-500 placeholder:text-nb-gray-600 dark:border-red-500 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
+                "ring-offset-red-500/10 focus-visible:ring-red-500/10 dark:ring-offset-red-500/10 dark:focus-visible:ring-red-500/10",
+            ],
+            warning: [
+                "border-neutral-200 text-orange-400 placeholder:text-nb-gray-600 dark:border-orange-400 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
+                "ring-offset-orange-400/10 focus-visible:ring-orange-400/10 dark:ring-offset-orange-400/10 dark:focus-visible:ring-orange-400/10",
+            ],
+        },
+        prefixSuffixVariant: {
+            default: [
+                "border-neutral-200 text-nb-gray-300 dark:border-nb-gray-700 dark:bg-nb-gray-900",
+            ],
+            error: ["border-red-500 text-nb-gray-300 text-red-500 dark:bg-nb-gray-900"],
+        },
+    },
+});
+
+function computeNextStepValue(el: HTMLInputElement, delta: 1 | -1): number {
+    const stepAttr = el.step === "" ? 1 : Number(el.step);
+    const step = Number.isFinite(stepAttr) && stepAttr > 0 ? stepAttr : 1;
+    const min = el.min === "" ? -Infinity : Number(el.min);
+    const max = el.max === "" ? Infinity : Number(el.max);
+    const current = el.value === "" ? 0 : Number(el.value);
+    let next = (Number.isFinite(current) ? current : 0) + delta * step;
+    if (next < min) next = min;
+    if (next > max) next = max;
+    return next;
+}
+
+function buildInputClassName(
+    opts: Readonly<{
+        variant: InputVariants["variant"];
+        hasCustomPrefix: boolean;
+        hasSuffix: boolean;
+        hasIcon: boolean;
+        readOnly?: boolean;
+        showStepper: boolean;
+        className?: string;
+    }>,
+): string {
+    return cn(
+        inputVariants({ variant: opts.variant }),
+        "flex h-[40px] w-full select-text rounded-md bg-white px-3 py-2 text-sm",
+        "file:border-0 file:bg-transparent file:text-sm file:font-medium",
+        "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2",
+        "disabled:cursor-not-allowed disabled:opacity-40",
+        opts.hasCustomPrefix && "!rounded-s-none !border-s-0",
+        opts.hasSuffix && "!pe-9",
+        opts.hasIcon && "!ps-10",
+        "border",
+        opts.readOnly && "!border-nb-gray-800 !bg-nb-gray-910 text-nb-gray-350",
+        opts.showStepper &&
+            "!rounded-e-none [-moz-appearance:textfield] [&::-webkit-inner-spin-button]:appearance-none [&::-webkit-outer-spin-button]:appearance-none",
+        opts.className,
+    );
+}
+
+function InputAffix({
+    content,
+    error,
+    disabled,
+    className,
+}: Readonly<{ content: ReactNode; error?: string; disabled?: boolean; className?: string }>) {
+    return (
+        <div
+            className={cn(
+                inputVariants({ prefixSuffixVariant: error ? "error" : "default" }),
+                "flex h-[40px] w-auto rounded-s-md bg-white px-3 py-2 text-sm",
+                "items-center whitespace-nowrap border",
+                disabled && "opacity-40",
+                className,
+            )}
+        >
+            {content}
+        </div>
+    );
+}
+
+function InputIconSlot({ icon, disabled }: Readonly<{ icon: ReactNode; disabled?: boolean }>) {
+    return (
+        <div
+            className={cn(
+                "absolute start-0 top-0 flex h-full items-center ps-3 text-xs leading-[0] dark:text-nb-gray-300",
+                disabled && "opacity-40",
+            )}
+        >
+            {icon}
+        </div>
+    );
+}
+
+function InputSuffixSlot({
+    suffix,
+    disabled,
+}: Readonly<{ suffix: ReactNode; disabled?: boolean }>) {
+    return (
+        <div
+            className={cn(
+                "pointer-events-none absolute end-0 top-0 flex h-full select-none items-center pe-3 text-xs leading-[0] dark:text-nb-gray-300",
+                disabled && "opacity-30",
+            )}
+        >
+            {suffix}
+        </div>
+    );
+}
+
+function NumberStepper({
+    error,
+    disabled,
+    onStep,
+}: Readonly<{ error?: string; disabled?: boolean; onStep: (delta: 1 | -1) => void }>) {
+    const { t } = useTranslation();
+    return (
+        <div
+            className={cn(
+                "flex h-[40px] shrink-0 flex-col overflow-hidden",
+                "rounded-e-md border border-s-0",
+                "border-neutral-200 bg-white dark:border-nb-gray-700 dark:bg-nb-gray-900",
+                error && "dark:border-red-500",
+                disabled && "pointer-events-none opacity-40",
+            )}
+        >
+            <button
+                type={"button"}
+                tabIndex={-1}
+                aria-label={t("common.increase")}
+                onClick={() => onStep(1)}
+                className={
+                    "flex w-9 flex-1 cursor-default items-center justify-center text-nb-gray-300 transition-colors hover:bg-nb-gray-800"
+                }
+            >
+                <ChevronUp size={12} aria-hidden={"true"} />
+            </button>
+            <button
+                type={"button"}
+                tabIndex={-1}
+                aria-label={t("common.decrease")}
+                onClick={() => onStep(-1)}
+                className={cn(
+                    "flex w-9 flex-1 cursor-default items-center justify-center text-nb-gray-300 transition-colors hover:bg-nb-gray-800",
+                    "border-t border-neutral-200 dark:border-nb-gray-700",
+                )}
+            >
+                <ChevronDown size={12} aria-hidden={"true"} />
+            </button>
+        </div>
+    );
+}
+
+function FieldMessage({
+    id,
+    error,
+    warning,
+}: Readonly<{ id?: string; error?: string; warning?: string }>) {
+    if (!error && !warning) return null;
+    return (
+        <span
+            id={id}
+            role={error ? "alert" : "status"}
+            className={cn(
+                "mt-2 inline-flex items-center gap-1 text-xs",
+                error ? "text-red-500" : "text-orange-400",
+            )}
+        >
+            {error ?? warning}
+        </span>
+    );
+}
+
+export const Input = forwardRef<HTMLInputElement, InputProps>(function Input(
+    {
+        className,
+        type,
+        label,
+        customSuffix,
+        customPrefix,
+        icon,
+        maxWidthClass = "",
+        error,
+        warning,
+        variant = "default",
+        prefixClassName,
+        showPasswordToggle = false,
+        copy = false,
+        id,
+        dir,
+        ...props
+    },
+    ref,
+) {
+    const { t } = useTranslation();
+    const [showPassword, setShowPassword] = useState(false);
+    const [copied, setCopied] = useState(false);
+    const isPasswordType = type === "password";
+    const inputType = isPasswordType && showPassword ? "text" : type;
+    const isNumber = type === "number";
+
+    const reactId = useId();
+    const fallbackId = `input-${reactId}`;
+    const inputId = id ?? (label ? fallbackId : undefined);
+    const messageId = error || warning ? `${inputId ?? fallbackId}-message` : undefined;
+
+    const copyTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+    useEffect(
+        () => () => {
+            if (copyTimer.current) clearTimeout(copyTimer.current);
+        },
+        [],
+    );
+
+    const internalRef = useRef<HTMLInputElement | null>(null);
+    const setRefs = (el: HTMLInputElement | null) => {
+        internalRef.current = el;
+        if (typeof ref === "function") ref(el);
+        else if (ref) ref.current = el;
+    };
+
+    const stepBy = (delta: 1 | -1) => {
+        const el = internalRef.current;
+        if (!el || el.disabled || el.readOnly) return;
+        const setter = Object.getOwnPropertyDescriptor(
+            globalThis.HTMLInputElement.prototype,
+            "value",
+        )?.set;
+        const next = computeNextStepValue(el, delta);
+        setter?.call(el, String(next));
+        el.dispatchEvent(new Event("input", { bubbles: true }));
+    };
+
+    const passwordToggle =
+        isPasswordType && showPasswordToggle ? (
+            <button
+                type={"button"}
+                onClick={() => setShowPassword((s) => !s)}
+                className={
+                    "pointer-events-auto text-nb-gray-400 transition-colors hover:text-nb-gray-50 dark:text-nb-gray-300 dark:hover:text-nb-gray-50"
+                }
+                aria-label={t("common.togglePasswordVisibility")}
+                aria-pressed={showPassword}
+            >
+                {showPassword ? (
+                    <EyeOff size={18} aria-hidden={"true"} />
+                ) : (
+                    <Eye size={18} aria-hidden={"true"} />
+                )}
+            </button>
+        ) : null;
+
+    const onCopy = async () => {
+        const text = props.value == null ? (internalRef.current?.value ?? "") : String(props.value);
+        if (!text) return;
+        try {
+            await navigator.clipboard.writeText(text);
+            setCopied(true);
+            if (copyTimer.current) clearTimeout(copyTimer.current);
+            copyTimer.current = setTimeout(() => setCopied(false), 1500);
+        } catch (e) {
+            console.warn("copy to clipboard failed", e);
+        }
+    };
+
+    const copyToggle = copy ? (
+        <button
+            type={"button"}
+            onClick={onCopy}
+            className={
+                "pointer-events-auto text-nb-gray-400 transition-colors hover:text-nb-gray-50 dark:text-nb-gray-300 dark:hover:text-nb-gray-50"
+            }
+            aria-label={t("common.copy")}
+        >
+            {copied ? (
+                <Check size={16} aria-hidden={"true"} />
+            ) : (
+                <Copy size={16} aria-hidden={"true"} />
+            )}
+        </button>
+    ) : null;
+
+    const suffix = passwordToggle || copyToggle || customSuffix;
+    const showStepper = isNumber;
+    const warningVariant = warning ? "warning" : variant;
+    const resolvedVariant = error ? "error" : warningVariant;
+
+    const inputClassName = buildInputClassName({
+        variant: resolvedVariant,
+        hasCustomPrefix: !!customPrefix,
+        hasSuffix: !!suffix,
+        hasIcon: !!icon,
+        readOnly: props.readOnly,
+        showStepper,
+        className,
+    });
+
+    return (
+        <div className={"flex w-full min-w-0 flex-col"}>
+            {label && <Label htmlFor={inputId}>{label}</Label>}
+            <div dir={dir} className={cn("relative flex h-[40px] w-full", maxWidthClass)}>
+                {customPrefix && (
+                    <InputAffix
+                        content={customPrefix}
+                        error={error}
+                        disabled={props.disabled}
+                        className={prefixClassName}
+                    />
+                )}
+
+                {icon && <InputIconSlot icon={icon} disabled={props.disabled} />}
+
+                <div className={"relative flex min-w-0 flex-grow"}>
+                    <input
+                        id={inputId}
+                        type={inputType}
+                        ref={setRefs}
+                        aria-invalid={error ? true : undefined}
+                        aria-describedby={
+                            messageId
+                                ? [props["aria-describedby"], messageId].filter(Boolean).join(" ")
+                                : props["aria-describedby"]
+                        }
+                        {...props}
+                        className={inputClassName}
+                    />
+
+                    {suffix && <InputSuffixSlot suffix={suffix} disabled={props.disabled} />}
+                </div>
+
+                {showStepper && (
+                    <NumberStepper error={error} disabled={props.disabled} onStep={stepBy} />
+                )}
+            </div>
+            <FieldMessage id={messageId} error={error} warning={warning} />
+        </div>
+    );
+});
+
+export default Input;
diff --git a/client/ui/frontend/src/components/inputs/SearchInput.tsx b/client/ui/frontend/src/components/inputs/SearchInput.tsx
new file mode 100644
index 000000000..e6d9ef4b6
--- /dev/null
+++ b/client/ui/frontend/src/components/inputs/SearchInput.tsx
@@ -0,0 +1,59 @@
+import { forwardRef, type InputHTMLAttributes, type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { SearchIcon } from "lucide-react";
+import { cn } from "@/lib/cn";
+
+type Props = InputHTMLAttributes<HTMLInputElement> & {
+    iconSize?: number;
+    shortcut?: ReactNode;
+};
+
+export const SearchInput = forwardRef<HTMLInputElement, Props>(function SearchInput(
+    { iconSize = 16, className, disabled, shortcut, "aria-label": ariaLabel, ...props },
+    ref,
+) {
+    const { t } = useTranslation();
+    return (
+        <div
+            role={"search"}
+            className={cn("flex h-10 items-center gap-2 px-1", disabled && "opacity-50")}
+        >
+            <SearchIcon
+                size={iconSize}
+                aria-hidden={"true"}
+                className={"shrink-0 text-nb-gray-300"}
+            />
+            <input
+                ref={ref}
+                type={"search"}
+                disabled={disabled}
+                aria-label={ariaLabel ?? props.placeholder ?? t("common.search")}
+                autoCorrect={"off"}
+                autoCapitalize={"off"}
+                spellCheck={false}
+                {...props}
+                className={cn(
+                    "w-full bg-transparent text-sm text-nb-gray-200 placeholder:text-nb-gray-600 dark:placeholder:text-nb-gray-400",
+                    "border-none outline-none",
+                    disabled && "cursor-not-allowed",
+                    className,
+                )}
+            />
+            {shortcut && (
+                <span
+                    aria-hidden={"true"}
+                    className={cn(
+                        "shrink-0 select-none",
+                        "inline-flex items-center justify-center",
+                        "h-5 min-w-[20px] rounded px-1.5",
+                        "border border-nb-gray-850 bg-nb-gray-920",
+                        "text-[10px] font-medium text-nb-gray-400",
+                        "wails-no-draggable",
+                    )}
+                >
+                    {shortcut}
+                </span>
+            )}
+        </div>
+    );
+});
diff --git a/client/ui/frontend/src/components/inputs/Select.tsx b/client/ui/frontend/src/components/inputs/Select.tsx
new file mode 100644
index 000000000..d9c7512d2
--- /dev/null
+++ b/client/ui/frontend/src/components/inputs/Select.tsx
@@ -0,0 +1,99 @@
+import type { LucideIcon } from "lucide-react";
+import { ChevronDown } from "lucide-react";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuRadioGroup,
+    DropdownMenuRadioItem,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { cn } from "@/lib/cn";
+
+export type SelectOption<T extends string> = {
+    value: T;
+    label: string;
+    icon?: LucideIcon;
+};
+
+type SelectProps<T extends string> = {
+    value: T;
+    options: SelectOption<T>[];
+    onChange: (value: T) => void;
+    ariaLabel: string;
+    disabled?: boolean;
+    className?: string;
+};
+
+export function Select<T extends string>({
+    value,
+    options,
+    onChange,
+    ariaLabel,
+    disabled,
+    className,
+}: SelectProps<T>) {
+    const isFocusVisible = useFocusVisible();
+    const current = options.find((o) => o.value === value) ?? options[0];
+    const CurrentIcon = current?.icon;
+
+    return (
+        <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+                <button
+                    type={"button"}
+                    tabIndex={0}
+                    disabled={disabled}
+                    aria-label={current ? `${ariaLabel}: ${current.label}` : ariaLabel}
+                    className={cn(
+                        "inline-flex h-[40px] min-w-[160px] items-center gap-2 px-3",
+                        "rounded-md border bg-white dark:bg-nb-gray-900",
+                        "border-neutral-200 dark:border-nb-gray-700",
+                        "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
+                        "hover:border-nb-gray-700 data-[state=open]:border-nb-gray-700 dark:hover:border-nb-gray-600 dark:data-[state=open]:border-nb-gray-600",
+                        isFocusVisible &&
+                            "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                        "disabled:opacity-50",
+                        className,
+                    )}
+                >
+                    {CurrentIcon && (
+                        <CurrentIcon
+                            size={16}
+                            aria-hidden={"true"}
+                            className={"shrink-0 text-nb-gray-200"}
+                        />
+                    )}
+                    <span className={"flex-1 truncate text-start"}>{current?.label ?? "—"}</span>
+                    <ChevronDown
+                        size={12}
+                        aria-hidden={"true"}
+                        className={"shrink-0 text-nb-gray-400"}
+                    />
+                </button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent
+                align={"start"}
+                sideOffset={6}
+                className={
+                    "w-[var(--radix-dropdown-menu-trigger-width)] border-nb-gray-850 bg-nb-gray-920"
+                }
+            >
+                <DropdownMenuRadioGroup value={value} onValueChange={(v) => onChange(v as T)}>
+                    {options.map(({ value: optionValue, label, icon: Icon }) => (
+                        <DropdownMenuRadioItem key={optionValue} value={optionValue}>
+                            {Icon && (
+                                <Icon
+                                    size={14}
+                                    aria-hidden={"true"}
+                                    className={"shrink-0 text-nb-gray-300"}
+                                />
+                            )}
+                            <span className={"min-w-0 flex-1 truncate"}>{label}</span>
+                        </DropdownMenuRadioItem>
+                    ))}
+                </DropdownMenuRadioGroup>
+            </DropdownMenuContent>
+        </DropdownMenu>
+    );
+}
diff --git a/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx b/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
new file mode 100644
index 000000000..b6331ee2d
--- /dev/null
+++ b/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
@@ -0,0 +1,104 @@
+import React from "react";
+import { HelpText } from "@/components/typography/HelpText";
+import { Label } from "@/components/typography/Label";
+import { ToggleSwitch } from "@/components/switches/ToggleSwitch";
+import { cn } from "@/lib/cn";
+
+interface Props {
+    value: boolean;
+    onChange: (value: boolean) => void;
+    helpText?: React.ReactNode;
+    label?: React.ReactNode;
+    children?: React.ReactNode;
+    disabled?: boolean;
+    loading?: boolean;
+    dataCy?: string;
+    className?: string;
+    labelClassName?: string;
+    textWrapperClassName?: string;
+}
+
+export default function FancyToggleSwitch({
+    value,
+    onChange,
+    helpText,
+    label,
+    children,
+    disabled = false,
+    loading = false,
+    dataCy,
+    className,
+    labelClassName,
+    textWrapperClassName = "max-w-lg",
+}: Readonly<Props>) {
+    const switchId = React.useId();
+    const descriptionId = React.useId();
+
+    if (loading) {
+        const shimmer =
+            "text-transparent select-none rounded bg-nb-gray-920 box-decoration-clone animate-pulse";
+        return (
+            <div
+                role={"status"}
+                aria-busy={"true"}
+                aria-live={"polite"}
+                className={cn("inline-block w-full text-start", className)}
+            >
+                <div className={"flex justify-between gap-10"}>
+                    <div className={cn(textWrapperClassName)}>
+                        <Label className={labelClassName}>
+                            <span className={shimmer}>{label}</span>
+                        </Label>
+                        <HelpText margin={false}>
+                            <span className={cn(shimmer, "text-[0.6rem] leading-relaxed")}>
+                                {helpText}
+                            </span>
+                        </HelpText>
+                    </div>
+                    <div className={"mt-2 pe-1"}>
+                        <div
+                            aria-hidden={"true"}
+                            className={
+                                "h-[24px] w-[44px] animate-pulse rounded-full bg-nb-gray-920"
+                            }
+                        />
+                    </div>
+                </div>
+            </div>
+        );
+    }
+
+    return (
+        <div
+            {...(disabled ? { inert: "" } : {})}
+            className={cn(
+                "relative z-[1] cursor-default transition-all duration-300",
+                "inline-block w-full text-start",
+                disabled && "pointer-events-none opacity-30",
+                className,
+            )}
+        >
+            <div className={"flex justify-between gap-10"}>
+                <div className={cn(textWrapperClassName)}>
+                    <Label htmlFor={switchId} className={labelClassName}>
+                        {label}
+                    </Label>
+                    <HelpText margin={false}>
+                        <span id={descriptionId}>{helpText}</span>
+                    </HelpText>
+                </div>
+                <div className={"mt-2 pe-1"}>
+                    <ToggleSwitch
+                        id={switchId}
+                        checked={value}
+                        onCheckedChange={onChange}
+                        disabled={disabled}
+                        dataCy={dataCy}
+                        aria-describedby={helpText ? descriptionId : undefined}
+                    />
+                </div>
+            </div>
+            {children && value ? <div className={"mt-4"}>{children}</div> : null}
+        </div>
+    );
+}
diff --git a/client/ui/frontend/src/components/switches/SwitchItem.tsx b/client/ui/frontend/src/components/switches/SwitchItem.tsx
new file mode 100644
index 000000000..6b598ee8f
--- /dev/null
+++ b/client/ui/frontend/src/components/switches/SwitchItem.tsx
@@ -0,0 +1,44 @@
+import * as RadioGroup from "@radix-ui/react-radio-group";
+import { motion } from "framer-motion";
+import { type ReactNode } from "react";
+import { cn } from "@/lib/cn";
+import { useSwitchItemGroup } from "@/components/switches/SwitchItemGroup";
+
+type Props = {
+    value: string;
+    children: ReactNode;
+    className?: string;
+};
+
+export const SwitchItem = ({ value, children, className }: Props) => {
+    const { value: activeValue, layoutId } = useSwitchItemGroup();
+    const active = activeValue === value;
+
+    return (
+        <RadioGroup.Item
+            value={value}
+            className={cn(
+                "relative inline-flex items-center justify-center gap-1 rounded-md px-3.5 py-2 text-xs font-semibold",
+                "cursor-default outline-none",
+                "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                active
+                    ? "text-nb-gray-100"
+                    : "text-nb-gray-400 hover:text-nb-gray-200 active:text-nb-gray-100",
+                className,
+            )}
+        >
+            {active && (
+                <motion.span
+                    layoutId={layoutId}
+                    className={
+                        "absolute inset-0 rounded-md bg-white shadow-sm dark:bg-nb-gray-700 dark:shadow-none"
+                    }
+                    transition={{ type: "spring", stiffness: 500, damping: 35 }}
+                />
+            )}
+            <span className={"relative inline-flex items-center justify-center gap-1"}>
+                {children}
+            </span>
+        </RadioGroup.Item>
+    );
+};
diff --git a/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx b/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
new file mode 100644
index 000000000..df4bac3df
--- /dev/null
+++ b/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
@@ -0,0 +1,63 @@
+import * as RadioGroup from "@radix-ui/react-radio-group";
+import { createContext, type ReactNode, useContext, useId, useMemo } from "react";
+import { cn } from "@/lib/cn";
+import { useDirection } from "@/hooks/useDirection";
+
+type SwitchItemGroupContextValue = {
+    value: string;
+    layoutId: string;
+};
+
+const SwitchItemGroupContext = createContext<SwitchItemGroupContextValue | null>(null);
+
+export const useSwitchItemGroup = () => {
+    const ctx = useContext(SwitchItemGroupContext);
+    if (!ctx) {
+        throw new Error("SwitchItem must be used inside a SwitchItemGroup");
+    }
+    return ctx;
+};
+
+type Props = {
+    value: string;
+    onChange: (value: string) => void;
+    children: ReactNode;
+    className?: string;
+    disabled?: boolean;
+    "aria-label"?: string;
+    "aria-labelledby"?: string;
+};
+
+export const SwitchItemGroup = ({
+    value,
+    onChange,
+    children,
+    className,
+    disabled = false,
+    "aria-label": ariaLabel,
+    "aria-labelledby": ariaLabelledBy,
+}: Props) => {
+    const layoutId = useId();
+    const dir = useDirection();
+    const contextValue = useMemo(() => ({ value, layoutId }), [value, layoutId]);
+
+    return (
+        <SwitchItemGroupContext.Provider value={contextValue}>
+            <RadioGroup.Root
+                dir={dir}
+                value={value}
+                onValueChange={onChange}
+                disabled={disabled}
+                aria-label={ariaLabel}
+                aria-labelledby={ariaLabelledBy}
+                className={cn(
+                    "flex shrink-0 overflow-hidden rounded-lg border border-nb-gray-800 bg-nb-gray-910 p-1 dark:border-nb-gray-850",
+                    disabled && "pointer-events-none opacity-50",
+                    className,
+                )}
+            >
+                {children}
+            </RadioGroup.Root>
+        </SwitchItemGroupContext.Provider>
+    );
+};
diff --git a/client/ui/frontend/src/components/switches/ToggleSwitch.tsx b/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
new file mode 100644
index 000000000..6862f85d8
--- /dev/null
+++ b/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
@@ -0,0 +1,77 @@
+"use client";
+
+import * as SwitchPrimitives from "@radix-ui/react-switch";
+import { cva, type VariantProps } from "class-variance-authority";
+import * as React from "react";
+import { cn } from "@/lib/cn";
+
+type SwitchVariants = VariantProps<typeof switchVariants>;
+
+const switchVariants = cva("", {
+    variants: {
+        size: {
+            default: "h-[24px] w-[44px]",
+            small: "h-[18px] w-[36px]",
+            large: "h-[36px] w-[66px]",
+        },
+        variant: {
+            default: [
+                "dark:data-[state=checked]:bg-netbird dark:data-[state=unchecked]:bg-nb-gray-700",
+                "dark:data-[state=checked]:hover:bg-netbird-500 dark:data-[state=unchecked]:hover:bg-nb-gray-600",
+                "data-[state=checked]:bg-netbird data-[state=unchecked]:bg-nb-gray-700",
+                "data-[state=checked]:hover:bg-netbird-500 data-[state=unchecked]:hover:bg-nb-gray-600/60",
+            ],
+            "red-green": [
+                "dark:data-[state=checked]:bg-red-600 dark:data-[state=unchecked]:bg-nb-gray-700",
+                "dark:data-[state=checked]:hover:bg-red-500 dark:data-[state=unchecked]:hover:bg-nb-gray-600",
+                "data-[state=checked]:bg-red-500 data-[state=unchecked]:bg-red-200",
+                "data-[state=checked]:hover:bg-red-400 data-[state=unchecked]:hover:bg-red-300",
+            ],
+            red: [
+                "dark:data-[state=checked]:bg-red-600 dark:data-[state=unchecked]:bg-nb-gray-700",
+                "dark:data-[state=checked]:hover:bg-red-500 dark:data-[state=unchecked]:hover:bg-nb-gray-600",
+                "data-[state=checked]:bg-red-500 data-[state=unchecked]:bg-red-200",
+                "data-[state=checked]:hover:bg-red-400 data-[state=unchecked]:hover:bg-red-300",
+            ],
+        },
+        "thumb-size": {
+            default:
+                "h-5 w-5 data-[state=checked]:translate-x-5 data-[state=unchecked]:translate-x-0 rtl:data-[state=checked]:-translate-x-5",
+            small: "h-[14px] w-[14px] data-[state=checked]:translate-x-[17px] data-[state=unchecked]:translate-x-0 rtl:data-[state=checked]:-translate-x-[17px]",
+            large: "h-[30px] w-[30px] data-[state=checked]:translate-x-[31px] data-[state=unchecked]:translate-x-[1px] rtl:data-[state=checked]:-translate-x-[31px] rtl:data-[state=unchecked]:-translate-x-[1px]",
+        },
+    },
+});
+
+const ToggleSwitch = React.forwardRef<
+    React.ElementRef<typeof SwitchPrimitives.Root>,
+    React.ComponentPropsWithoutRef<typeof SwitchPrimitives.Root> &
+        SwitchVariants & { dataCy?: string }
+>(({ className, size = "default", variant = "default", dataCy, disabled, ...props }, ref) => (
+    <SwitchPrimitives.Root
+        disabled={disabled}
+        tabIndex={disabled ? -1 : 0}
+        className={cn(
+            "wails-no-draggable peer inline-flex shrink-0 cursor-default items-center rounded-full border-2 border-transparent transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940 disabled:cursor-not-allowed disabled:opacity-50",
+            className,
+            switchVariants({ size, variant }),
+        )}
+        {...props}
+        data-cy={dataCy}
+        onClick={(e) => {
+            e.stopPropagation();
+            props.onClick?.(e);
+        }}
+        ref={ref}
+    >
+        <SwitchPrimitives.Thumb
+            className={cn(
+                switchVariants({ "thumb-size": size }),
+                "pointer-events-none block rounded-full bg-white shadow-lg ring-0 transition-transform dark:bg-white",
+            )}
+        />
+    </SwitchPrimitives.Root>
+));
+ToggleSwitch.displayName = SwitchPrimitives.Root.displayName;
+
+export { ToggleSwitch };
diff --git a/client/ui/frontend/src/components/typography/HelpText.tsx b/client/ui/frontend/src/components/typography/HelpText.tsx
new file mode 100644
index 000000000..70d5cf9b1
--- /dev/null
+++ b/client/ui/frontend/src/components/typography/HelpText.tsx
@@ -0,0 +1,24 @@
+import { type ReactNode } from "react";
+import { cn } from "@/lib/cn";
+
+type Props = {
+    children?: ReactNode;
+    margin?: boolean;
+    className?: string;
+    disabled?: boolean;
+};
+
+export const HelpText = ({ children, margin = true, className, disabled = false }: Props) => (
+    <span
+        className={cn(
+            "block text-[.81rem] font-light tracking-wide text-nb-gray-300 transition-all duration-300",
+            margin && "mb-2",
+            disabled && "pointer-events-none opacity-30",
+            className,
+        )}
+    >
+        {children}
+    </span>
+);
+
+export default HelpText;
diff --git a/client/ui/frontend/src/components/typography/Label.tsx b/client/ui/frontend/src/components/typography/Label.tsx
new file mode 100644
index 000000000..a8e1a446f
--- /dev/null
+++ b/client/ui/frontend/src/components/typography/Label.tsx
@@ -0,0 +1,42 @@
+import * as LabelPrimitive from "@radix-ui/react-label";
+import { cva, type VariantProps } from "class-variance-authority";
+import { type ComponentPropsWithoutRef, forwardRef, type Ref } from "react";
+import { cn } from "@/lib/cn";
+
+const labelVariants = cva(
+    "mb-1.5 inline-block flex items-center gap-2 text-sm font-medium leading-none tracking-wider peer-disabled:cursor-not-allowed peer-disabled:opacity-70 dark:text-nb-gray-100",
+);
+
+type LabelProps = ComponentPropsWithoutRef<typeof LabelPrimitive.Root> &
+    VariantProps<typeof labelVariants> & {
+        as?: "label" | "div";
+        disabled?: boolean;
+    };
+
+export const Label = forwardRef<HTMLElement, LabelProps>(function Label(
+    { className, as = "label", disabled = false, children, ...props },
+    ref,
+) {
+    const classes = cn(
+        labelVariants(),
+        className,
+        "select-none transition-all duration-300",
+        disabled && "pointer-events-none opacity-30",
+    );
+
+    if (as === "div") {
+        return (
+            <div ref={ref as Ref<HTMLDivElement>} className={classes}>
+                {children}
+            </div>
+        );
+    }
+
+    return (
+        <LabelPrimitive.Root ref={ref as Ref<HTMLLabelElement>} className={classes} {...props}>
+            {children}
+        </LabelPrimitive.Root>
+    );
+});
+
+export default Label;
diff --git a/client/ui/frontend/src/contexts/ClientVersionContext.tsx b/client/ui/frontend/src/contexts/ClientVersionContext.tsx
new file mode 100644
index 000000000..c0699a9ee
--- /dev/null
+++ b/client/ui/frontend/src/contexts/ClientVersionContext.tsx
@@ -0,0 +1,114 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+
+import { Update as UpdateSvc, WindowManager } from "@bindings/services";
+import type { State as UpdateState } from "@bindings/updater/models.js";
+import i18next from "@/lib/i18n";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+const isDaemonUnavailable = (e: unknown): boolean => {
+    const msg = e instanceof Error ? e.message : String(e);
+    return msg.includes("code = Unavailable");
+};
+
+type ClientVersionContextValue = {
+    updateAvailable: boolean;
+    updateVersion: string | null;
+    enforced: boolean;
+    installing: boolean;
+    triggerUpdate: () => void;
+    updating: boolean;
+};
+
+const EVENT_UPDATE_STATE = "netbird:update:state";
+
+const emptyState: UpdateState = {
+    available: false,
+    version: "",
+    enforced: false,
+    installing: false,
+};
+
+const ClientVersionContext = createContext<ClientVersionContextValue | null>(null);
+
+export const useClientVersion = () => {
+    const ctx = useContext(ClientVersionContext);
+    if (!ctx) {
+        throw new Error("useClientVersion must be used inside ClientVersionProvider");
+    }
+    return ctx;
+};
+
+export const ClientVersionProvider = ({ children }: { children: ReactNode }) => {
+    const [state, setState] = useState<UpdateState>(emptyState);
+    const [updating, setUpdating] = useState(false);
+
+    useEffect(() => {
+        let cancelled = false;
+        UpdateSvc.GetState()
+            .then((s) => {
+                if (cancelled || !s) return;
+                setState(s);
+            })
+            .catch((e) => {
+                if (cancelled || isDaemonUnavailable(e)) return;
+                void errorDialog({
+                    Title: i18next.t("update.error.loadStateTitle"),
+                    Message: formatErrorMessage(e),
+                });
+            });
+        const off = Events.On(EVENT_UPDATE_STATE, (ev: { data: UpdateState }) => {
+            if (ev?.data) setState(ev.data);
+        });
+        return () => {
+            cancelled = true;
+            off?.();
+        };
+    }, []);
+
+    const prevInstallingRef = useRef(false);
+    useEffect(() => {
+        if (state.installing && !prevInstallingRef.current) {
+            WindowManager.OpenInstallProgress(state.version || "").catch(console.error);
+        }
+        prevInstallingRef.current = state.installing;
+    }, [state.installing, state.version]);
+
+    const triggerUpdate = useCallback(() => {
+        setUpdating(true);
+        WindowManager.OpenInstallProgress(state.version || "").catch(console.error);
+        UpdateSvc.Trigger()
+            .catch(async (e) => {
+                if (isDaemonUnavailable(e)) return;
+                WindowManager.CloseInstallProgress().catch(console.error);
+                await errorDialog({
+                    Title: i18next.t("update.error.triggerTitle"),
+                    Message: formatErrorMessage(e),
+                });
+            })
+            .finally(() => setUpdating(false));
+    }, [state.version]);
+
+    const value = useMemo<ClientVersionContextValue>(
+        () => ({
+            updateAvailable: state.available,
+            updateVersion: state.version || null,
+            enforced: state.enforced,
+            installing: state.installing,
+            triggerUpdate,
+            updating,
+        }),
+        [state, triggerUpdate, updating],
+    );
+
+    return <ClientVersionContext.Provider value={value}>{children}</ClientVersionContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/DebugBundleContext.tsx b/client/ui/frontend/src/contexts/DebugBundleContext.tsx
new file mode 100644
index 000000000..5f2ed9041
--- /dev/null
+++ b/client/ui/frontend/src/contexts/DebugBundleContext.tsx
@@ -0,0 +1,319 @@
+import { createContext, useContext, useEffect, useRef, useState, type ReactNode } from "react";
+import { Connection as ConnectionSvc, Debug as DebugSvc } from "@bindings/services";
+import type { DebugBundleResult } from "@bindings/services/models.js";
+import i18next from "@/lib/i18n";
+import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
+import { startConnection } from "@/lib/connection.ts";
+
+const NETBIRD_UPLOAD_URL = "https://upload.debug.netbird.io/upload-url";
+const TRACE_LOG_FILE_COUNT = 5;
+const PLAIN_LOG_FILE_COUNT = 1;
+const TRACE_LOG_LEVEL = "trace";
+const DEFAULT_LOG_LEVEL = "info";
+
+export type DebugStage =
+    | { kind: "idle" }
+    | { kind: "preparing-trace" }
+    | { kind: "reconnecting" }
+    | { kind: "capturing"; remainingSec: number; totalSec: number }
+    | { kind: "restoring-level" }
+    | { kind: "bundling" }
+    | { kind: "uploading" }
+    | { kind: "cancelling" }
+    | { kind: "done"; result: DebugBundleResult; uploadAttempted: boolean };
+
+const sleep = (ms: number, signal: AbortSignal) =>
+    new Promise<void>((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new DOMException("aborted", "AbortError"));
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(id);
+            reject(new DOMException("aborted", "AbortError"));
+        };
+        const id = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", onAbort);
+    });
+
+const isAbort = (e: unknown) => e instanceof DOMException && e.name === "AbortError";
+
+const throwIfAborted = (signal: AbortSignal) => {
+    if (signal.aborted) throw new DOMException("aborted", "AbortError");
+};
+
+const setLogLevelBestEffort = async (level: string) => {
+    try {
+        await DebugSvc.SetLogLevel({ level });
+    } catch (e) {
+        console.warn("[DebugBundle] best-effort set log level failed", e);
+    }
+};
+
+const stopCaptureBestEffort = async () => {
+    try {
+        await DebugSvc.StopBundleCapture();
+    } catch (e) {
+        console.warn("[DebugBundle] best-effort stop packet capture failed", e);
+    }
+};
+
+type LevelState = { original: string; raised: boolean };
+type CaptureState = { started: boolean };
+
+type BundleOptions = {
+    trace: boolean;
+    capture: boolean;
+    capturePackets: boolean;
+    hasWindow: boolean;
+    totalSec: number;
+    uploadUrl: string;
+    anonymizeLevel: AnonymizeLevel;
+    systemInfo: boolean;
+};
+
+export type AnonymizeLevel = "none" | "default" | "strict";
+
+const startCaptureBestEffort = async (totalSec: number, pcap: CaptureState) => {
+    try {
+        // Mirror the CLI's safety margin: window + 30s, server caps at 10m.
+        await DebugSvc.StartBundleCapture(totalSec + 30);
+        pcap.started = true;
+    } catch (e) {
+        console.warn("[DebugBundle] start packet capture failed", e);
+    }
+};
+
+const cleanupBestEffort = async (pcap: CaptureState, level: LevelState, restoreLevel: boolean) => {
+    if (pcap.started) {
+        await stopCaptureBestEffort();
+        pcap.started = false;
+    }
+    if (restoreLevel && level.raised) {
+        await setLogLevelBestEffort(level.original);
+    }
+};
+
+const raiseToTrace = async (
+    signal: AbortSignal,
+    level: LevelState,
+    setStage: (s: DebugStage) => void,
+) => {
+    setStage({ kind: "preparing-trace" });
+    try {
+        const cur = await DebugSvc.GetLogLevel();
+        if (cur?.level) level.original = cur.level;
+    } catch (e) {
+        console.warn("[DebugBundle] read current log level failed", e);
+    }
+    throwIfAborted(signal);
+    await DebugSvc.SetLogLevel({ level: TRACE_LOG_LEVEL });
+    level.raised = true;
+};
+
+const cycleConnection = async (signal: AbortSignal, setStage: (s: DebugStage) => void) => {
+    throwIfAborted(signal);
+    setStage({ kind: "reconnecting" });
+    try {
+        await ConnectionSvc.Down();
+    } catch (e) {
+        console.warn("[DebugBundle] disconnect before capture failed", e);
+    }
+    throwIfAborted(signal);
+    await startConnection(undefined, signal);
+};
+
+const restoreLogLevel = async (level: LevelState, setStage: (s: DebugStage) => void) => {
+    setStage({ kind: "restoring-level" });
+    try {
+        await DebugSvc.SetLogLevel({ level: level.original });
+        level.raised = false;
+    } catch (e) {
+        console.warn("[DebugBundle] restore log level failed", e);
+    }
+};
+
+const waitCaptureWindow = async (
+    signal: AbortSignal,
+    setStage: (s: DebugStage) => void,
+    totalSec: number,
+) => {
+    for (let remaining = totalSec; remaining > 0; remaining--) {
+        setStage({ kind: "capturing", remainingSec: remaining, totalSec });
+        await sleep(1000, signal);
+    }
+};
+
+const runBundleFlow = async (
+    signal: AbortSignal,
+    opts: BundleOptions,
+    level: LevelState,
+    pcap: CaptureState,
+    setStage: (s: DebugStage) => void,
+    setLastBundlePath: (p: string) => void,
+) => {
+    if (opts.trace) {
+        await raiseToTrace(signal, level, setStage);
+    }
+    throwIfAborted(signal);
+
+    if (opts.capture) {
+        await cycleConnection(signal, setStage);
+    }
+    throwIfAborted(signal);
+
+    if (opts.hasWindow && opts.capturePackets) {
+        await startCaptureBestEffort(opts.totalSec, pcap);
+    }
+    throwIfAborted(signal);
+
+    if (opts.hasWindow) {
+        await waitCaptureWindow(signal, setStage, opts.totalSec);
+    }
+
+    if (pcap.started) {
+        await stopCaptureBestEffort();
+        pcap.started = false;
+    }
+
+    if (level.raised) {
+        await restoreLogLevel(level, setStage);
+    }
+
+    throwIfAborted(signal);
+    setStage({ kind: "bundling" });
+    const logFileCount = opts.trace ? TRACE_LOG_FILE_COUNT : PLAIN_LOG_FILE_COUNT;
+
+    if (opts.uploadUrl) setStage({ kind: "uploading" });
+    const result = await DebugSvc.Bundle({
+        anonymize: opts.anonymizeLevel !== "none",
+        // The daemon only knows "default" and "strict"; "none" is expressed
+        // through the anonymize flag being off.
+        anonymizeLevel: opts.anonymizeLevel === "strict" ? "strict" : "default",
+        systemInfo: opts.systemInfo,
+        uploadUrl: opts.uploadUrl,
+        logFileCount,
+    });
+    throwIfAborted(signal);
+    if (result.path) setLastBundlePath(result.path);
+    setStage({ kind: "done", result, uploadAttempted: Boolean(opts.uploadUrl) });
+};
+
+const useDebugBundle = () => {
+    const [anonymizeLevel, setAnonymizeLevel] = useState<AnonymizeLevel>("none");
+    const [systemInfo, setSystemInfo] = useState(true);
+    const [upload, setUpload] = useState(true);
+    const [trace, setTrace] = useState(true);
+    const [capture, setCapture] = useState(false);
+    const [traceMinutes, setTraceMinutes] = useState(1);
+    const [capturePackets, setCapturePackets] = useState(true);
+    const [stage, setStage] = useState<DebugStage>({ kind: "idle" });
+    const [lastBundlePath, setLastBundlePath] = useState<string>("");
+    const abortRef = useRef<AbortController | null>(null);
+
+    useEffect(() => {
+        return () => {
+            abortRef.current?.abort();
+        };
+    }, []);
+
+    const isRunning = stage.kind !== "idle" && stage.kind !== "done";
+
+    const reset = () => setStage({ kind: "idle" });
+
+    const cancel = () => {
+        if (!abortRef.current || abortRef.current.signal.aborted) return;
+        abortRef.current.abort();
+        setStage({ kind: "cancelling" });
+    };
+
+    const run = async () => {
+        const ctrl = new AbortController();
+        abortRef.current = ctrl;
+        const signal = ctrl.signal;
+
+        const totalSec = Math.max(1, Math.min(30, traceMinutes)) * 60;
+        const level: LevelState = { original: DEFAULT_LOG_LEVEL, raised: false };
+        const pcap: CaptureState = { started: false };
+        const opts: BundleOptions = {
+            trace,
+            capture,
+            capturePackets,
+            hasWindow: capture && totalSec > 0,
+            totalSec,
+            uploadUrl: upload ? NETBIRD_UPLOAD_URL : "",
+            anonymizeLevel,
+            systemInfo,
+        };
+
+        try {
+            await runBundleFlow(signal, opts, level, pcap, setStage, setLastBundlePath);
+        } catch (e) {
+            if (isAbort(e)) {
+                setStage({ kind: "cancelling" });
+                await cleanupBestEffort(pcap, level, true);
+                setStage({ kind: "idle" });
+                return;
+            }
+            await cleanupBestEffort(pcap, level, false);
+            setStage({ kind: "idle" });
+            await errorDialog({
+                Title: i18next.t("settings.error.debugBundleTitle"),
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            if (abortRef.current === ctrl) abortRef.current = null;
+        }
+    };
+
+    const openBundleDir = () => {
+        if (!lastBundlePath) return;
+        DebugSvc.RevealFile(lastBundlePath).catch((err: unknown) =>
+            console.error("[DebugBundleContext] reveal failed", err),
+        );
+    };
+
+    return {
+        anonymizeLevel,
+        setAnonymizeLevel,
+        systemInfo,
+        setSystemInfo,
+        upload,
+        setUpload,
+        trace,
+        setTrace,
+        capture,
+        setCapture,
+        traceMinutes,
+        setTraceMinutes,
+        capturePackets,
+        setCapturePackets,
+        stage,
+        isRunning,
+        lastBundlePath,
+        run,
+        cancel,
+        reset,
+        openBundleDir,
+    };
+};
+
+export type DebugBundleContextValue = ReturnType<typeof useDebugBundle>;
+
+const DebugBundleContext = createContext<DebugBundleContextValue | null>(null);
+
+export const DebugBundleProvider = ({ children }: { children: ReactNode }) => {
+    const value = useDebugBundle();
+    return <DebugBundleContext.Provider value={value}>{children}</DebugBundleContext.Provider>;
+};
+
+export const useDebugBundleContext = () => {
+    const ctx = useContext(DebugBundleContext);
+    if (!ctx) {
+        throw new Error("useDebugBundleContext must be used inside DebugBundleProvider");
+    }
+    return ctx;
+};
diff --git a/client/ui/frontend/src/contexts/DialogContext.tsx b/client/ui/frontend/src/contexts/DialogContext.tsx
new file mode 100644
index 000000000..9619b43d0
--- /dev/null
+++ b/client/ui/frontend/src/contexts/DialogContext.tsx
@@ -0,0 +1,120 @@
+import {
+    createContext,
+    type ReactNode,
+    useCallback,
+    useContext,
+    useMemo,
+    useRef,
+    useState,
+} from "react";
+import { ConfirmModal } from "@/components/dialog/ConfirmModal";
+import i18next from "@/lib/i18n";
+
+// Nothing on the daemon path carries a deadline, so a hung call would leave the
+// modal spinning with no way out. Cancel comes back once the wait stops looking
+// normal, and the wait is abandoned entirely at the deadline.
+const CANCELLABLE_AFTER_MS = 15_000;
+const TIMEOUT_MS = 30_000;
+
+const withTimeout = async (action: () => Promise<unknown>) => {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const expiry = new Promise<never>((_, reject) => {
+        timer = setTimeout(
+            () => reject(new Error(i18next.t("error.daemon_unreachable"))),
+            TIMEOUT_MS,
+        );
+    });
+    try {
+        await Promise.race([action(), expiry]);
+    } finally {
+        clearTimeout(timer);
+    }
+};
+
+export type ConfirmOptions = {
+    title: ReactNode;
+    description: ReactNode;
+    confirmLabel: string;
+    cancelLabel?: string;
+    danger?: boolean;
+    onConfirm?: () => Promise<unknown>;
+};
+
+type DialogContextValue = {
+    confirm: (options: ConfirmOptions) => Promise<boolean>;
+};
+
+const DialogContext = createContext<DialogContextValue | null>(null);
+
+type Settler = { resolve: (result: boolean) => void; reject: (reason: unknown) => void };
+
+export function DialogProvider({ children }: Readonly<{ children: ReactNode }>) {
+    const [open, setOpen] = useState(false);
+    const [busy, setBusy] = useState(false);
+    const [stalled, setStalled] = useState(false);
+    const [options, setOptions] = useState<ConfirmOptions | null>(null);
+    const resolverRef = useRef<Settler | null>(null);
+
+    const confirm = useCallback((opts: ConfirmOptions) => {
+        setOptions(opts);
+        setOpen(true);
+        return new Promise<boolean>((resolve, reject) => {
+            resolverRef.current = { resolve, reject };
+        });
+    }, []);
+
+    const take = (expected?: Settler | null) => {
+        const settler = resolverRef.current;
+        if (expected && settler !== expected) return null;
+        resolverRef.current = null;
+        setBusy(false);
+        setStalled(false);
+        setOpen(false);
+        return settler;
+    };
+
+    const handleConfirm = async () => {
+        const action = options?.onConfirm;
+        if (!action) {
+            take()?.resolve(true);
+            return;
+        }
+        const dispatched = resolverRef.current;
+        setBusy(true);
+        const stallTimer = setTimeout(() => setStalled(true), CANCELLABLE_AFTER_MS);
+        try {
+            await withTimeout(action);
+            take(dispatched)?.resolve(true);
+        } catch (e) {
+            take(dispatched)?.reject(e);
+        } finally {
+            clearTimeout(stallTimer);
+        }
+    };
+
+    const value = useMemo<DialogContextValue>(() => ({ confirm }), [confirm]);
+
+    return (
+        <DialogContext.Provider value={value}>
+            {children}
+            <ConfirmModal
+                open={open}
+                title={options?.title ?? ""}
+                description={options?.description ?? ""}
+                confirmLabel={options?.confirmLabel ?? ""}
+                cancelLabel={options?.cancelLabel}
+                danger={options?.danger}
+                busy={busy}
+                cancellable={!busy || stalled}
+                onConfirm={() => void handleConfirm()}
+                onCancel={() => take()?.resolve(false)}
+            />
+        </DialogContext.Provider>
+    );
+}
+
+export const useConfirm = () => {
+    const ctx = useContext(DialogContext);
+    if (!ctx) throw new Error("useConfirm must be used within a DialogProvider");
+    return ctx.confirm;
+};
diff --git a/client/ui/frontend/src/contexts/NavSectionContext.tsx b/client/ui/frontend/src/contexts/NavSectionContext.tsx
new file mode 100644
index 000000000..c08a3c824
--- /dev/null
+++ b/client/ui/frontend/src/contexts/NavSectionContext.tsx
@@ -0,0 +1,24 @@
+import { createContext, useContext, useMemo, useState, type ReactNode } from "react";
+
+export type NavSection = "peers" | "networks";
+
+type NavSectionContextValue = {
+    section: NavSection;
+    setSection: (s: NavSection) => void;
+};
+
+const NavSectionContext = createContext<NavSectionContextValue | null>(null);
+
+export const useNavSection = (): NavSectionContextValue => {
+    const ctx = useContext(NavSectionContext);
+    if (!ctx) {
+        throw new Error("useNavSection must be used inside NavSectionProvider");
+    }
+    return ctx;
+};
+
+export const NavSectionProvider = ({ children }: { children: ReactNode }) => {
+    const [section, setSection] = useState<NavSection>("peers");
+    const value = useMemo<NavSectionContextValue>(() => ({ section, setSection }), [section]);
+    return <NavSectionContext.Provider value={value}>{children}</NavSectionContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/NetworksContext.tsx b/client/ui/frontend/src/contexts/NetworksContext.tsx
new file mode 100644
index 000000000..ef7231700
--- /dev/null
+++ b/client/ui/frontend/src/contexts/NetworksContext.tsx
@@ -0,0 +1,222 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Networks as NetworksSvc } from "@bindings/services";
+import type { Network } from "@bindings/services/models.js";
+import { useStatus } from "@/contexts/StatusContext";
+
+// A route that covers all traffic (0.0.0.0/0 or ::/0) is an exit node.
+// The daemon may merge a v4+v6 pair into a single comma-joined range string.
+export const isExitNode = (range: string): boolean =>
+    range.split(",").some((part) => {
+        const trimmed = part.trim();
+        return trimmed === "0.0.0.0/0" || trimmed === "::/0";
+    });
+
+type NetworksContextValue = {
+    routes: Network[];
+    networkRoutes: Network[];
+    exitNodes: Network[];
+    activeExitNode: Network | null;
+    refresh: () => Promise<void>;
+    toggleNetwork: (id: string, selected: boolean) => Promise<void>;
+    toggleExitNode: (id: string, selected: boolean) => Promise<void>;
+    setNetworksSelected: (ids: string[], selected: boolean) => Promise<void>;
+};
+
+const NetworksContext = createContext<NetworksContextValue | null>(null);
+
+export const useNetworks = () => {
+    const ctx = useContext(NetworksContext);
+    if (!ctx) {
+        throw new Error("useNetworks must be used inside NetworksProvider");
+    }
+    return ctx;
+};
+
+export const NetworksProvider = ({ children }: { children: ReactNode }) => {
+    const { status } = useStatus();
+    const [routes, setRoutes] = useState<Network[]>([]);
+    const [pending, setPending] = useState<Map<string, boolean>>(new Map());
+    const pendingRef = useRef(pending);
+    useEffect(() => {
+        pendingRef.current = pending;
+    }, [pending]);
+
+    // Safety timer: if a prediction diverges from the daemon, the override would mask the true value forever.
+    const STUCK_OVERRIDE_MS = 4000;
+    const timersRef = useRef<Map<string, ReturnType<typeof setTimeout>>>(new Map());
+
+    const clearTimer = useCallback((id: string) => {
+        const tid = timersRef.current.get(id);
+        if (tid !== undefined) {
+            clearTimeout(tid);
+            timersRef.current.delete(id);
+        }
+    }, []);
+
+    const clearPendingFor = useCallback(
+        (ids: string[]) => {
+            for (const id of ids) clearTimer(id);
+            setPending((prev) => {
+                if (ids.every((id) => !prev.has(id))) return prev;
+                const next = new Map(prev);
+                for (const id of ids) next.delete(id);
+                return next;
+            });
+        },
+        [clearTimer],
+    );
+
+    const setPendingFor = useCallback(
+        (updates: Array<[string, boolean]>) => {
+            setPending((prev) => {
+                const next = new Map(prev);
+                for (const [id, sel] of updates) next.set(id, sel);
+                return next;
+            });
+            for (const [id] of updates) {
+                clearTimer(id);
+                timersRef.current.set(
+                    id,
+                    setTimeout(() => clearPendingFor([id]), STUCK_OVERRIDE_MS),
+                );
+            }
+        },
+        [clearTimer, clearPendingFor],
+    );
+
+    useEffect(() => {
+        const timers = timersRef.current;
+        return () => {
+            for (const tid of timers.values()) clearTimeout(tid);
+            timers.clear();
+        };
+    }, []);
+
+    const refresh = useCallback(async () => {
+        try {
+            const list = await NetworksSvc.List();
+            setRoutes(list);
+        } catch (e) {
+            console.error("[NetworksContext] refresh failed", e);
+        }
+    }, []);
+
+    const networksRevision = status?.networksRevision;
+    useEffect(() => {
+        refresh().catch((err: unknown) => console.error("[NetworksContext] refresh failed", err));
+    }, [refresh, networksRevision]);
+
+    useEffect(() => {
+        if (pendingRef.current.size === 0) return;
+        const confirmed: string[] = [];
+        for (const r of routes) {
+            const expected = pendingRef.current.get(r.id);
+            if (expected !== undefined && r.selected === expected) {
+                confirmed.push(r.id);
+            }
+        }
+        if (confirmed.length > 0) clearPendingFor(confirmed);
+    }, [routes, clearPendingFor]);
+
+    const mutate = useCallback(
+        async (ids: string[], selected: boolean, rollback: Array<[string, boolean]>) => {
+            try {
+                if (selected) {
+                    await NetworksSvc.Select({ networkIds: ids, append: true, all: false });
+                } else {
+                    await NetworksSvc.Deselect({ networkIds: ids, append: false, all: false });
+                }
+                // Don't clear pending here — let the snapshot-match effect confirm, else a refresh racing the RPC return flashes back.
+                await refresh();
+            } catch (e) {
+                console.error(e);
+                setPending((prev) => {
+                    const next = new Map(prev);
+                    for (const [id] of rollback) next.delete(id);
+                    return next;
+                });
+                throw e;
+            }
+        },
+        [refresh],
+    );
+
+    const toggleNetwork = useCallback(
+        async (id: string, selected: boolean) => {
+            const target = !selected;
+            setPendingFor([[id, target]]);
+            await mutate([id], target, [[id, selected]]).catch(() => {});
+        },
+        [mutate, setPendingFor],
+    );
+
+    const setNetworksSelected = useCallback(
+        async (ids: string[], selected: boolean) => {
+            if (ids.length === 0) return;
+            const prevById = new Map(routes.map((r) => [r.id, r.selected]));
+            const rollback: Array<[string, boolean]> = ids.map((id) => [
+                id,
+                prevById.get(id) ?? !selected,
+            ]);
+            setPendingFor(ids.map((id) => [id, selected]));
+            await mutate(ids, selected, rollback).catch(() => {});
+        },
+        [mutate, setPendingFor, routes],
+    );
+
+    // Daemon enforces exit-node mutual exclusion; mirror it locally so the optimistic paint matches.
+    const toggleExitNode = useCallback(
+        async (id: string, selected: boolean) => {
+            const target = !selected;
+            const updates: Array<[string, boolean]> = [[id, target]];
+            const rollback: Array<[string, boolean]> = [[id, selected]];
+            if (target) {
+                for (const r of routes) {
+                    if (r.id !== id && isExitNode(r.range) && r.selected) {
+                        updates.push([r.id, false]);
+                        rollback.push([r.id, true]);
+                    }
+                }
+            }
+            setPendingFor(updates);
+            await mutate([id], target, rollback).catch(() => {});
+        },
+        [mutate, setPendingFor, routes],
+    );
+
+    const value = useMemo<NetworksContextValue>(() => {
+        const effective =
+            pending.size === 0
+                ? routes
+                : routes.map((r) => {
+                      const override = pending.get(r.id);
+                      return override === undefined || override === r.selected
+                          ? r
+                          : { ...r, selected: override };
+                  });
+        const networkRoutes = effective.filter((r) => !isExitNode(r.range));
+        const exitNodes = effective.filter((r) => isExitNode(r.range));
+        const activeExitNode = exitNodes.find((r) => r.selected) ?? null;
+        return {
+            routes: effective,
+            networkRoutes,
+            exitNodes,
+            activeExitNode,
+            refresh,
+            toggleNetwork,
+            toggleExitNode,
+            setNetworksSelected,
+        };
+    }, [routes, pending, refresh, toggleNetwork, toggleExitNode, setNetworksSelected]);
+
+    return <NetworksContext.Provider value={value}>{children}</NetworksContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/PeerDetailContext.tsx b/client/ui/frontend/src/contexts/PeerDetailContext.tsx
new file mode 100644
index 000000000..3ab20891f
--- /dev/null
+++ b/client/ui/frontend/src/contexts/PeerDetailContext.tsx
@@ -0,0 +1,50 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import type { PeerStatus } from "@bindings/services/models.js";
+
+type PeerDetailContextValue = {
+    selected: PeerStatus | null;
+    setSelected: (p: PeerStatus | null) => void;
+};
+
+const PeerDetailContext = createContext<PeerDetailContextValue | null>(null);
+
+export const usePeerDetail = (): PeerDetailContextValue => {
+    const ctx = useContext(PeerDetailContext);
+    if (!ctx) {
+        throw new Error("usePeerDetail must be used inside PeerDetailProvider");
+    }
+    return ctx;
+};
+
+export const PeerDetailProvider = ({ children }: { children: ReactNode }) => {
+    const [selected, setSelected] = useState<PeerStatus | null>(null);
+    const openerRef = useRef<HTMLElement | null>(null);
+
+    const select = useCallback((p: PeerStatus | null) => {
+        if (p) {
+            const active = document.activeElement;
+            openerRef.current = active instanceof HTMLElement ? active : null;
+        } else {
+            const opener = openerRef.current;
+            openerRef.current = null;
+            if (opener?.isConnected) {
+                queueMicrotask(() => opener.focus());
+            }
+        }
+        setSelected(p);
+    }, []);
+
+    const value = useMemo<PeerDetailContextValue>(
+        () => ({ selected, setSelected: select }),
+        [selected, select],
+    );
+    return <PeerDetailContext.Provider value={value}>{children}</PeerDetailContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/ProfileContext.tsx b/client/ui/frontend/src/contexts/ProfileContext.tsx
new file mode 100644
index 000000000..62377f1bc
--- /dev/null
+++ b/client/ui/frontend/src/contexts/ProfileContext.tsx
@@ -0,0 +1,195 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+import { Connection, ProfileSwitcher, Profiles as ProfilesSvc } from "@bindings/services";
+import type { Profile } from "@bindings/services/models.js";
+import i18next from "@/lib/i18n";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+const EVENT_PROFILE_CHANGED = "netbird:profile:changed";
+
+type ProfileContextValue = {
+    username: string;
+    // activeProfile is the display NAME of the active profile (for rendering
+    // and the "default" check). activeProfileId is its stable on-disk ID, used
+    // as the handle for daemon requests and for active-profile comparisons,
+    // since display names can collide.
+    activeProfile: string;
+    activeProfileId: string;
+    profiles: Profile[];
+    loaded: boolean;
+    refresh: () => Promise<void>;
+    switchProfile: (id: string) => Promise<void>;
+    switchProfileNoConnect: (id: string) => Promise<void>;
+    addProfile: (name: string) => Promise<string>;
+    removeProfile: (id: string) => Promise<void>;
+    renameProfile: (id: string, newName: string) => Promise<void>;
+    logoutProfile: (id: string) => Promise<void>;
+};
+
+const ProfileContext = createContext<ProfileContextValue | null>(null);
+
+export const useProfile = () => {
+    const ctx = useContext(ProfileContext);
+    if (!ctx) {
+        throw new Error("useProfile must be used inside ProfileProvider");
+    }
+    return ctx;
+};
+
+export const ProfileProvider = ({ children }: { children: ReactNode }) => {
+    const [username, setUsername] = useState("");
+    const [activeProfile, setActiveProfile] = useState("");
+    const [activeProfileId, setActiveProfileId] = useState("");
+    const [profiles, setProfiles] = useState<Profile[]>([]);
+    const [loaded, setLoaded] = useState(false);
+    const retryRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+    const refresh = useCallback(async () => {
+        if (retryRef.current) {
+            clearTimeout(retryRef.current);
+            retryRef.current = null;
+        }
+        try {
+            const u = await ProfilesSvc.Username();
+            const [active, list] = await Promise.all([
+                ProfilesSvc.GetActive(),
+                ProfilesSvc.List(u),
+            ]);
+            setUsername(u);
+            setActiveProfile(active.profileName || "default");
+            setActiveProfileId(active.id || "default");
+            setProfiles(list);
+            setLoaded(true);
+        } catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            if (msg.includes("code = Unavailable")) {
+                retryRef.current = setTimeout(() => {
+                    void refresh();
+                }, 1000);
+                return;
+            }
+            setLoaded(true);
+            await errorDialog({
+                Title: i18next.t("profile.error.loadTitle"),
+                Message: formatErrorMessage(e),
+            });
+        }
+    }, []);
+
+    useEffect(() => {
+        refresh().catch((err: unknown) => console.error("[ProfileContext] refresh failed", err));
+        return () => {
+            if (retryRef.current) clearTimeout(retryRef.current);
+        };
+    }, [refresh]);
+
+    useEffect(() => {
+        const off = Events.On(EVENT_PROFILE_CHANGED, () => {
+            refresh().catch((err: unknown) =>
+                console.error("[ProfileContext] refresh failed", err),
+            );
+        });
+        return () => {
+            off();
+        };
+    }, [refresh]);
+
+    // id is a handle: the daemon resolves an exact ID, ID prefix, or unique
+    // display name. The UI passes the profile's ID for precision.
+    const switchProfile = useCallback(
+        async (id: string) => {
+            await ProfileSwitcher.SwitchActive({ profileName: id, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
+    // Manage-profiles variant: switches without connecting, so the user can
+    // still adjust the management URL before bringing the connection up.
+    const switchProfileNoConnect = useCallback(
+        async (id: string) => {
+            await ProfileSwitcher.SwitchActiveNoConnect({ profileName: id, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
+    // addProfile creates a profile by display name and returns the
+    // daemon-generated ID, so the caller can immediately address it by ID.
+    const addProfile = useCallback(
+        async (name: string) => {
+            const id = await ProfilesSvc.Add({ profileName: name, username });
+            await refresh();
+            return id;
+        },
+        [username, refresh],
+    );
+
+    const removeProfile = useCallback(
+        async (id: string) => {
+            await ProfilesSvc.Remove({ profileName: id, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
+    // The daemon resolves the handle (exact ID, ID prefix, or unique display
+    // name) — passing the ID is precise and avoids collisions on rename.
+    const renameProfile = useCallback(
+        async (id: string, newName: string) => {
+            await ProfilesSvc.Rename({ handle: id, newName, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
+    const logoutProfile = useCallback(
+        async (id: string) => {
+            await Connection.Logout({ profileName: id, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
+    const value = useMemo<ProfileContextValue>(
+        () => ({
+            username,
+            activeProfile,
+            activeProfileId,
+            profiles,
+            loaded,
+            refresh,
+            switchProfile,
+            switchProfileNoConnect,
+            addProfile,
+            removeProfile,
+            renameProfile,
+            logoutProfile,
+        }),
+        [
+            username,
+            activeProfile,
+            activeProfileId,
+            profiles,
+            loaded,
+            refresh,
+            switchProfile,
+            switchProfileNoConnect,
+            addProfile,
+            removeProfile,
+            renameProfile,
+            logoutProfile,
+        ],
+    );
+
+    return <ProfileContext.Provider value={value}>{children}</ProfileContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/RestrictionsContext.tsx b/client/ui/frontend/src/contexts/RestrictionsContext.tsx
new file mode 100644
index 000000000..572bf17ec
--- /dev/null
+++ b/client/ui/frontend/src/contexts/RestrictionsContext.tsx
@@ -0,0 +1,65 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+import { Settings as SettingsSvc } from "@bindings/services";
+import { Restrictions } from "@bindings/services/models.js";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+
+const EVENT_SYSTEM = "netbird:event";
+const EMPTY = new Restrictions();
+
+const RestrictionsContext = createContext<Restrictions>(EMPTY);
+
+export const useRestrictions = () => useContext(RestrictionsContext);
+
+export const RestrictionsProvider = ({ children }: { children: ReactNode }) => {
+    const [restrictions, setRestrictions] = useState<Restrictions>(EMPTY);
+    const mounted = useRef(true);
+    const { status } = useStatus();
+
+    const refresh = useCallback(async () => {
+        try {
+            const r = await SettingsSvc.GetRestrictions();
+            if (mounted.current) setRestrictions(r);
+        } catch (e) {
+            console.error("[RestrictionsContext] refresh failed", e);
+        }
+    }, []);
+
+    useEffect(() => {
+        mounted.current = true;
+
+        const off = Events.On(
+            EVENT_SYSTEM,
+            (e: { data?: { metadata?: { [k: string]: string | undefined } } }) => {
+                if (e.data?.metadata?.type === "config_changed") refresh();
+            },
+        );
+
+        const onVisible = () => {
+            if (document.visibilityState === "visible") refresh();
+        };
+        document.addEventListener("visibilitychange", onVisible);
+
+        return () => {
+            mounted.current = false;
+            off();
+            document.removeEventListener("visibilitychange", onVisible);
+        };
+    }, [refresh]);
+
+    useEffect(() => {
+        if (status?.status) refresh();
+    }, [status?.status, refresh]);
+
+    return (
+        <RestrictionsContext.Provider value={restrictions}>{children}</RestrictionsContext.Provider>
+    );
+};
diff --git a/client/ui/frontend/src/contexts/SettingsContext.tsx b/client/ui/frontend/src/contexts/SettingsContext.tsx
new file mode 100644
index 000000000..a7574c7e5
--- /dev/null
+++ b/client/ui/frontend/src/contexts/SettingsContext.tsx
@@ -0,0 +1,377 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+import { Autostart, Settings as SettingsSvc, Version } from "@bindings/services";
+import type { Config } from "@bindings/services/models.js";
+import i18next from "@/lib/i18n";
+import { useProfile } from "@/contexts/ProfileContext.tsx";
+import { SettingsSkeleton } from "@/modules/settings/SettingsSkeleton.tsx";
+import { errorCommand, errorDialog, formatErrorMessage as errorMessage } from "@/lib/errors.ts";
+
+const SAVE_DEBOUNCE_MS = 400;
+
+const logSaveError = (err: unknown) => console.error("[SettingsContext] save failed", err);
+
+export type AutostartState = { supported: boolean; enabled: boolean };
+
+// GuardedField is a setting the daemon only accepts from root/administrator.
+// Turning one on goes through saveGuardedField, which asks the operating system
+// for the privileges rather than sending a request that would be refused.
+export type GuardedField = "serverSshAllowed" | "enableSshRoot" | "disableSshAuth";
+
+type SettingsContextValue = {
+    config: Config;
+    guiVersion: string;
+    setField: <K extends keyof Config>(k: K, v: Config[K]) => void;
+    saveField: <K extends keyof Config>(k: K, v: Config[K]) => Promise<void>;
+    saveFields: (partial: Partial<Config>, opts?: { preSharedKey?: string }) => Promise<void>;
+    saveGuardedField: (k: GuardedField, v: boolean) => Promise<void>;
+    saveNow: () => Promise<void>;
+};
+
+type AutostartContextValue = {
+    autostart: AutostartState | null;
+    setAutostartEnabled: (enabled: boolean) => Promise<void>;
+};
+
+const SettingsContext = createContext<SettingsContextValue | null>(null);
+const AutostartContext = createContext<AutostartContextValue | null>(null);
+
+export const useSettings = () => {
+    const ctx = useContext(SettingsContext);
+    if (!ctx) {
+        throw new Error("useSettings must be used inside SettingsProvider");
+    }
+    return ctx;
+};
+
+export const useAutostartSetting = () => {
+    const ctx = useContext(AutostartContext);
+    if (!ctx) {
+        throw new Error("useAutostartSetting must be used inside AutostartSettingsProvider");
+    }
+    return ctx;
+};
+
+type LoadedConfig = { profileName: string; data: Config };
+
+const useSettingsState = () => {
+    const { username, activeProfileId, loaded: profileLoaded } = useProfile();
+    const [loaded, setLoaded] = useState<LoadedConfig | null>(null);
+    const [guiVersion, setGuiVersion] = useState<string>("—");
+    const saveTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+    const loadedRef = useRef<LoadedConfig | null>(null);
+    // Set when the daemon's config changed while a save was pending, so the read
+    // that was skipped to protect the pending edit happens once it is through.
+    // Without it the form keeps values the daemon no longer has and the next save
+    // submits them, which for a guarded setting means asking the user to authorize
+    // a change they never made.
+    const reloadOwed = useRef(false);
+
+    useEffect(() => {
+        loadedRef.current = loaded;
+    }, [loaded]);
+
+    // reload re-reads the daemon's config, which is authoritative. Used on
+    // mount, on the daemon's config_changed event, and to undo an optimistic
+    // update the daemon then rejected.
+    const reload = useCallback(
+        async (profileName: string) => {
+            reloadOwed.current = false;
+            try {
+                const data = await SettingsSvc.GetConfig({ profileName, username });
+                setLoaded({ profileName, data });
+            } catch (e) {
+                console.warn("[SettingsContext] reload after rejected save failed", e);
+            }
+        },
+        [username],
+    );
+
+    useEffect(() => {
+        if (!profileLoaded || !activeProfileId) return;
+        let cancelled = false;
+
+        const load = async (showError: boolean) => {
+            try {
+                const data = await SettingsSvc.GetConfig({
+                    profileName: activeProfileId,
+                    username,
+                });
+                if (cancelled) return;
+                // A pending edit outranks the daemon's copy until it is saved, so
+                // the read is owed rather than dropped: see reloadOwed.
+                if (saveTimer.current) {
+                    reloadOwed.current = true;
+                    return;
+                }
+                setLoaded({ profileName: activeProfileId, data });
+            } catch (e) {
+                if (cancelled || !showError) return;
+                await errorDialog({
+                    Title: i18next.t("settings.error.loadTitle"),
+                    Message: errorMessage(e),
+                });
+            }
+        };
+
+        load(true);
+
+        const off = Events.On(
+            "netbird:event",
+            (e: { data?: { metadata?: { [k: string]: string | undefined } } }) => {
+                if (e.data?.metadata?.type === "config_changed") load(false);
+            },
+        );
+
+        return () => {
+            cancelled = true;
+            off();
+        };
+    }, [profileLoaded, activeProfileId, username]);
+
+    useEffect(() => {
+        let cancelled = false;
+        Version.GUI().then((v) => {
+            if (!cancelled) setGuiVersion(v);
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    useEffect(
+        () => () => {
+            if (saveTimer.current) clearTimeout(saveTimer.current);
+        },
+        [],
+    );
+
+    const save = useCallback(
+        async (profileName: string, next: Config, preSharedKey?: string) => {
+            const preSharedKeyWrite = preSharedKey === undefined ? {} : { preSharedKey };
+            try {
+                const { declined } = await SettingsSvc.SetConfig({
+                    ...next,
+                    ...preSharedKeyWrite,
+                    profileName,
+                    username,
+                });
+                // The change needed authorization and the user said no, so the
+                // optimistic update is wrong. Nothing to report: they know.
+                if (declined || reloadOwed.current) {
+                    await reload(profileName);
+                }
+            } catch (e) {
+                // The optimistic update is wrong now: the daemon refused it
+                // (a change that needs elevated privileges, an MDM-managed
+                // field, ...). Snap the controls back to what it actually
+                // holds before reporting, so the UI never shows a value the
+                // daemon does not have.
+                await reload(profileName);
+                await errorDialog({
+                    Title: i18next.t("settings.error.saveTitle"),
+                    Message: errorMessage(e),
+                    Command: errorCommand(e),
+                });
+            }
+        },
+        [username, reload],
+    );
+
+    const setField = useCallback(
+        <K extends keyof Config>(k: K, v: Config[K]) => {
+            const cur = loadedRef.current;
+            if (!cur) return;
+            const next: LoadedConfig = {
+                profileName: cur.profileName,
+                data: { ...cur.data, [k]: v },
+            };
+            loadedRef.current = next;
+            setLoaded(next);
+            if (saveTimer.current) clearTimeout(saveTimer.current);
+            saveTimer.current = setTimeout(() => {
+                saveTimer.current = null;
+                save(next.profileName, next.data).catch(logSaveError);
+            }, SAVE_DEBOUNCE_MS);
+        },
+        [save],
+    );
+
+    const saveNow = useCallback(async () => {
+        if (!loaded) return;
+        if (saveTimer.current) {
+            clearTimeout(saveTimer.current);
+            saveTimer.current = null;
+        }
+        await save(loaded.profileName, loaded.data);
+    }, [loaded, save]);
+
+    const saveField = useCallback(
+        async <K extends keyof Config>(k: K, v: Config[K]) => {
+            if (!loaded) return;
+            if (saveTimer.current) {
+                clearTimeout(saveTimer.current);
+                saveTimer.current = null;
+            }
+            const next = { ...loaded.data, [k]: v };
+            setLoaded({ profileName: loaded.profileName, data: next });
+            await save(loaded.profileName, next);
+        },
+        [loaded, save],
+    );
+
+    // saveGuardedField applies a setting the daemon restricts to
+    // root/administrator by having the Go side run the app again under the
+    // platform's elevation prompt (UAC, the macOS authentication dialog, polkit).
+    // The prompt is the user's, so the call is made straight from their gesture
+    // and never from the debounce.
+    const saveGuardedField = useCallback(
+        async (k: GuardedField, v: boolean) => {
+            const cur = loadedRef.current;
+            if (!cur) return;
+
+            // Flush what the debounce still owes, before the optimistic update
+            // below joins it: a later save carrying the guarded value would be
+            // refused, and its error dialog would be the second one for a change
+            // the user already authorized.
+            if (saveTimer.current) {
+                clearTimeout(saveTimer.current);
+                saveTimer.current = null;
+                await save(cur.profileName, cur.data);
+            }
+
+            const next: LoadedConfig = {
+                profileName: cur.profileName,
+                data: { ...cur.data, [k]: v },
+            };
+            loadedRef.current = next;
+            setLoaded(next);
+
+            try {
+                await SettingsSvc.SetGuardedSettings({
+                    profileName: cur.profileName,
+                    username,
+                    [k]: v,
+                });
+            } catch (e) {
+                // The daemon is authoritative either way, so re-read before
+                // reporting. A declined prompt is not an error and does not come
+                // through here at all; this is a prompt that could not be raised,
+                // which carries the command that would have done it.
+                await reload(cur.profileName);
+                await errorDialog({
+                    Title: i18next.t("settings.error.saveTitle"),
+                    Message: errorMessage(e),
+                    Command: errorCommand(e),
+                });
+                return;
+            }
+            // Either the change went through or the user declined it. The daemon
+            // says which.
+            await reload(cur.profileName);
+        },
+        [username, save, reload],
+    );
+
+    const saveFields = useCallback(
+        async (partial: Partial<Config>, opts?: { preSharedKey?: string }) => {
+            if (!loaded) return;
+            if (saveTimer.current) {
+                clearTimeout(saveTimer.current);
+                saveTimer.current = null;
+            }
+
+            const merged: Config = { ...loaded.data, ...partial };
+            const next: Config =
+                opts?.preSharedKey === undefined
+                    ? merged
+                    : { ...merged, preSharedKeySet: opts.preSharedKey !== "" };
+            setLoaded({ profileName: loaded.profileName, data: next });
+            await save(loaded.profileName, next, opts?.preSharedKey);
+        },
+        [loaded, save],
+    );
+
+    return {
+        config: loaded?.data ?? null,
+        guiVersion,
+        setField,
+        saveField,
+        saveFields,
+        saveGuardedField,
+        saveNow,
+    };
+};
+
+export const SettingsProvider = ({ children }: { children: ReactNode }) => {
+    const { config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow } =
+        useSettingsState();
+
+    const value = useMemo<SettingsContextValue | null>(
+        () =>
+            config
+                ? { config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow }
+                : null,
+        [config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow],
+    );
+
+    if (!value) {
+        return (
+            <div className={"min-h-0 flex-1 overflow-y-auto px-7 py-8"}>
+                <SettingsSkeleton />
+            </div>
+        );
+    }
+
+    return <SettingsContext.Provider value={value}>{children}</SettingsContext.Provider>;
+};
+
+export const AutostartSettingsProvider = ({ children }: { children: ReactNode }) => {
+    const [autostart, setAutostart] = useState<AutostartState | null>(null);
+
+    useEffect(() => {
+        let cancelled = false;
+        (async () => {
+            const supported = await Autostart.Supported();
+            const enabled = supported ? await Autostart.IsEnabled() : false;
+            if (cancelled) return;
+            setAutostart({ supported, enabled });
+        })().catch((err: unknown) => {
+            if (cancelled) return;
+            console.warn("[SettingsContext] load autostart state failed", err);
+            setAutostart({ supported: false, enabled: false });
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    const setAutostartEnabled = useCallback(async (enabled: boolean) => {
+        setAutostart((s) => (s ? { ...s, enabled } : s));
+        try {
+            await Autostart.SetEnabled(enabled);
+        } catch (e) {
+            setAutostart((s) => (s ? { ...s, enabled: !enabled } : s));
+            await errorDialog({
+                Title: i18next.t("settings.general.autostart.errorTitle"),
+                Message: errorMessage(e),
+            });
+        }
+    }, []);
+
+    const value = useMemo<AutostartContextValue>(
+        () => ({ autostart, setAutostartEnabled }),
+        [autostart, setAutostartEnabled],
+    );
+
+    return <AutostartContext.Provider value={value}>{children}</AutostartContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/StatusContext.tsx b/client/ui/frontend/src/contexts/StatusContext.tsx
new file mode 100644
index 000000000..0ad9c7875
--- /dev/null
+++ b/client/ui/frontend/src/contexts/StatusContext.tsx
@@ -0,0 +1,106 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+import { DaemonFeed } from "@bindings/services";
+import { Status } from "@bindings/services/models.js";
+import { DaemonOutdatedOverlay } from "@/components/empty-state/DaemonOutdatedOverlay.tsx";
+import { DaemonUnavailableOverlay } from "@/components/empty-state/DaemonUnavailableOverlay.tsx";
+import { isDaemonCompatible } from "@/lib/compat";
+
+const EVENT_STATUS = "netbird:status";
+
+type StatusContextValue = {
+    status: Status | null;
+    error: string | null;
+    refresh: () => Promise<void>;
+    isReady: boolean;
+    isDaemonUnavailable: boolean;
+    isDaemonAvailable: boolean;
+    isDaemonOutdated: boolean;
+};
+
+const StatusContext = createContext<StatusContextValue | null>(null);
+
+export const useStatus = () => {
+    const ctx = useContext(StatusContext);
+    if (!ctx) {
+        throw new Error("useStatus must be used inside StatusProvider");
+    }
+    return ctx;
+};
+
+export const StatusProvider = ({ children }: { children: ReactNode }) => {
+    const [status, setStatus] = useState<Status | null>(null);
+    const [error, setError] = useState<string | null>(null);
+    const [isDaemonOutdated, setIsDaemonOutdated] = useState(false);
+
+    const refresh = useCallback(async () => {
+        try {
+            const s = await DaemonFeed.Get();
+            setStatus(s);
+            setError(null);
+        } catch (e) {
+            // Synthesize DaemonUnavailable so cold-start-without-daemon isn't a blank UI (isReady stays false otherwise).
+            setStatus(Status.createFrom({ status: "DaemonUnavailable" }));
+            setError(String(e));
+        }
+    }, []);
+
+    useEffect(() => {
+        refresh().catch((err: unknown) => console.error("[StatusContext] refresh failed", err));
+        const off = Events.On(EVENT_STATUS, (ev: { data: Status }) => {
+            setStatus(ev.data);
+            setError(null);
+        });
+        return () => {
+            off();
+        };
+    }, [refresh]);
+
+    const isReady = status !== null;
+    const isDaemonUnavailable = isReady && status.status === "DaemonUnavailable";
+    const isDaemonAvailable = isReady && !isDaemonUnavailable;
+
+    useEffect(() => {
+        if (!isDaemonAvailable) return;
+        let cancelled = false;
+        isDaemonCompatible()
+            .then((ok) => {
+                if (!cancelled) setIsDaemonOutdated(!ok);
+            })
+            .catch((err) => {
+                console.error("[StatusContext] daemon compatible error", err);
+            });
+        return () => {
+            cancelled = true;
+        };
+    }, [isDaemonAvailable]);
+
+    const value = useMemo<StatusContextValue>(
+        () => ({
+            status,
+            error,
+            refresh,
+            isReady,
+            isDaemonUnavailable,
+            isDaemonAvailable,
+            isDaemonOutdated,
+        }),
+        [status, error, refresh, isReady, isDaemonUnavailable, isDaemonAvailable, isDaemonOutdated],
+    );
+
+    return (
+        <StatusContext.Provider value={value}>
+            {isDaemonAvailable && !isDaemonOutdated && children}
+            <DaemonUnavailableOverlay />
+            <DaemonOutdatedOverlay />
+        </StatusContext.Provider>
+    );
+};
diff --git a/client/ui/frontend/src/contexts/ThemeContext.tsx b/client/ui/frontend/src/contexts/ThemeContext.tsx
new file mode 100644
index 000000000..9aabaa379
--- /dev/null
+++ b/client/ui/frontend/src/contexts/ThemeContext.tsx
@@ -0,0 +1,129 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+import { Preferences, Theme } from "@bindings/services";
+import { type Theme as ThemePref, type UIPreferences } from "@bindings/preferences/models.js";
+
+export type ThemePreference = "system" | "light" | "dark";
+
+const PREF_KEY = "nb-theme-pref";
+const SYSTEM_KEY = "nb-system-dark";
+
+const isPreference = (v: unknown): v is ThemePreference =>
+    v === "system" || v === "light" || v === "dark";
+
+const initialSystemDark = (): boolean => {
+    try {
+        const mirrored = localStorage.getItem(SYSTEM_KEY);
+        if (mirrored !== null) return mirrored === "true";
+    } catch {
+        /* fall through */
+    }
+    return window.matchMedia("(prefers-color-scheme: dark)").matches;
+};
+
+type ThemeContextValue = {
+    theme: ThemePreference;
+    resolvedDark: boolean;
+    setTheme: (theme: ThemePreference) => Promise<void>;
+};
+
+const ThemeContext = createContext<ThemeContextValue | null>(null);
+
+export const ThemeProvider = ({ children }: { children: ReactNode }) => {
+    const [theme, setThemeState] = useState<ThemePreference>(() => {
+        try {
+            const mirrored = localStorage.getItem(PREF_KEY);
+            if (isPreference(mirrored)) return mirrored;
+        } catch {
+            /* fall through */
+        }
+        return "system";
+    });
+    const [systemDark, setSystemDark] = useState<boolean>(initialSystemDark);
+    const themeRef = useRef(theme);
+    themeRef.current = theme;
+    // Blocks the initial Preferences.Get snapshot from overwriting newer updates.
+    const supersededRef = useRef(false);
+
+    useEffect(() => {
+        let cancelled = false;
+        Preferences.Get()
+            .then((prefs) => {
+                if (cancelled || supersededRef.current) return;
+                if (isPreference(prefs?.theme)) setThemeState(prefs.theme);
+            })
+            .catch((err: unknown) => console.warn("[ThemeContext] load preferences failed", err));
+        Theme.SystemDarkMode()
+            .then((dark) => {
+                if (!cancelled) setSystemDark(dark);
+            })
+            .catch((err: unknown) => console.warn("[ThemeContext] SystemDarkMode failed", err));
+
+        // Cross-window sync: a flip in the settings window reaches every window.
+        const offPrefs = Events.On("netbird:preferences:changed", (e: { data?: UIPreferences }) => {
+            if (isPreference(e.data?.theme)) {
+                supersededRef.current = true;
+                setThemeState(e.data.theme);
+            }
+        });
+        const offSystem = Events.On(
+            "netbird:system-theme:changed",
+            (e: { data?: { dark?: boolean } }) => {
+                if (typeof e.data?.dark === "boolean") setSystemDark(e.data.dark);
+            },
+        );
+        return () => {
+            cancelled = true;
+            offPrefs();
+            offSystem();
+        };
+    }, []);
+
+    const resolvedDark = theme === "dark" || (theme === "system" && systemDark);
+
+    // Apply the class and refresh the pre-paint mirror (index.html reads it).
+    useEffect(() => {
+        document.documentElement.classList.toggle("dark", resolvedDark);
+        try {
+            localStorage.setItem(PREF_KEY, theme);
+            localStorage.setItem(SYSTEM_KEY, String(systemDark));
+        } catch {
+            /* mirror is best-effort */
+        }
+    }, [theme, systemDark, resolvedDark]);
+
+    // Optimistic; reverts on persist failure so UI matches the stored pref.
+    const setTheme = useCallback(async (next: ThemePreference) => {
+        const prev = themeRef.current;
+        supersededRef.current = true;
+        setThemeState(next);
+        try {
+            await Preferences.SetTheme(next as ThemePref);
+        } catch (err) {
+            setThemeState(prev);
+            throw err;
+        }
+    }, []);
+
+    const value = useMemo<ThemeContextValue>(
+        () => ({ theme, resolvedDark, setTheme }),
+        [theme, resolvedDark, setTheme],
+    );
+
+    return <ThemeContext.Provider value={value}>{children}</ThemeContext.Provider>;
+};
+
+export const useTheme = () => {
+    const ctx = useContext(ThemeContext);
+    if (!ctx) throw new Error("useTheme must be used inside ThemeProvider");
+    return ctx;
+};
diff --git a/client/ui/frontend/src/contexts/ViewModeContext.tsx b/client/ui/frontend/src/contexts/ViewModeContext.tsx
new file mode 100644
index 000000000..7db3abae0
--- /dev/null
+++ b/client/ui/frontend/src/contexts/ViewModeContext.tsx
@@ -0,0 +1,89 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Window } from "@wailsio/runtime";
+import { Preferences } from "@bindings/services";
+import { ViewMode as ViewModePref } from "@bindings/preferences/models.js";
+
+export type ViewMode = "default" | "advanced";
+
+// Don't pass a fixed height to Window.SetSize: macOS SetSize is frame (incl. ~28px
+// title bar) while creation is content, so re-asserting a constant chops the content on first switch.
+export const VIEW_WIDTH: Record<ViewMode, number> = {
+    default: 380,
+    advanced: 900,
+};
+
+type ViewModeContextValue = {
+    viewMode: ViewMode;
+    setViewMode: (mode: ViewMode) => void;
+};
+
+const ViewModeContext = createContext<ViewModeContextValue | null>(null);
+
+export const ViewModeProvider = ({ children }: { children: ReactNode }) => {
+    const [mode, setMode] = useState<ViewMode>("default");
+    const modeRef = useRef<ViewMode>("default");
+
+    useEffect(() => {
+        let cancelled = false;
+        Preferences.Get()
+            .then((prefs) => {
+                if (cancelled) return;
+                const saved = prefs?.viewMode as ViewMode | undefined;
+                if (saved === "default" || saved === "advanced") {
+                    modeRef.current = saved;
+                    setMode(saved);
+                }
+            })
+            .catch((err: unknown) =>
+                console.warn("[ViewModeContext] load preferences failed", err),
+            );
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    // Resize before flipping React state, else the layout paints into a window that hasn't grown yet.
+    const setViewMode = useCallback((mode: ViewMode) => {
+        if (modeRef.current === mode) return;
+        modeRef.current = mode;
+        (async () => {
+            const size = await Window.Size().catch((err: unknown) => {
+                console.warn("[ViewModeContext] read window size failed", err);
+                return null;
+            });
+            const width = VIEW_WIDTH[mode];
+            const height = size?.height ?? 640;
+            await Window.SetSize(width, height).catch((err: unknown) =>
+                console.warn("[ViewModeContext] set window size failed", err),
+            );
+            setMode(mode);
+            const pref =
+                mode === "advanced" ? ViewModePref.ViewModeAdvanced : ViewModePref.ViewModeDefault;
+            Preferences.SetViewMode(pref).catch((err: unknown) =>
+                console.error("[ViewModeContext] SetViewMode failed", err),
+            );
+        })().catch((err: unknown) => console.error("[ViewModeContext] setViewMode failed", err));
+    }, []);
+
+    const value = useMemo<ViewModeContextValue>(
+        () => ({ viewMode: mode, setViewMode }),
+        [mode, setViewMode],
+    );
+
+    return <ViewModeContext.Provider value={value}>{children}</ViewModeContext.Provider>;
+};
+
+export const useViewMode = () => {
+    const ctx = useContext(ViewModeContext);
+    if (!ctx) throw new Error("useViewMode must be used inside ViewModeProvider");
+    return ctx;
+};
diff --git a/client/ui/frontend/src/globals.css b/client/ui/frontend/src/globals.css
new file mode 100644
index 000000000..bfdabeb31
--- /dev/null
+++ b/client/ui/frontend/src/globals.css
@@ -0,0 +1,111 @@
+@font-face {
+    font-family: "Inter Variable";
+    font-style: normal;
+    font-weight: 100 900;
+    src: url("./assets/fonts/inter-variable.ttf") format("truetype");
+}
+
+@font-face {
+    font-family: "JetBrains Mono Variable";
+    font-style: normal;
+    font-weight: 100 800;
+    src: url("./assets/fonts/jetbrains-mono-variable.ttf") format("truetype");
+}
+
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+/* nb-gray channels (space-separated RGB) consumed by tailwind.config.ts.
+   :root is the inverted light ramp — high stops are surfaces (near-white),
+   low stops are text (near-black); .dark restores the original dark ramp.
+   Surfaces stay darker than content cards to preserve their separation. */
+:root {
+    --nb-gray-DEFAULT: 243 243 243;
+    --nb-gray-50: 26 26 26;
+    --nb-gray-100: 33 33 33;
+    --nb-gray-200: 50 50 50;
+    --nb-gray-250: 58 58 58;
+    --nb-gray-300: 77 77 77;
+    --nb-gray-350: 92 92 92;
+    --nb-gray-400: 108 108 108;
+    --nb-gray-500: 135 135 135;
+    --nb-gray-600: 154 154 154;
+    --nb-gray-700: 209 209 209;
+    --nb-gray-800: 226 226 226;
+    --nb-gray-850: 234 234 234;
+    --nb-gray-900: 238 238 238;
+    --nb-gray-910: 240 240 240;
+    --nb-gray-920: 243 243 243;
+    --nb-gray-925: 245 245 245;
+    --nb-gray-930: 246 246 246;
+    --nb-gray-935: 248 248 248;
+    --nb-gray-940: 250 250 250;
+    --nb-gray-950: 252 252 252;
+    --nb-gray-960: 255 255 255;
+
+    --skeleton-base: 238 238 238;
+    --skeleton-highlight: 247 247 247;
+}
+
+.dark {
+    --nb-gray-DEFAULT: 24 26 29;
+    --nb-gray-50: 244 246 247;
+    --nb-gray-100: 228 231 233;
+    --nb-gray-200: 203 210 214;
+    --nb-gray-250: 183 192 198;
+    --nb-gray-300: 163 173 181;
+    --nb-gray-350: 143 156 168;
+    --nb-gray-400: 124 137 148;
+    --nb-gray-500: 97 110 121;
+    --nb-gray-600: 83 93 103;
+    --nb-gray-700: 71 78 87;
+    --nb-gray-800: 63 68 75;
+    --nb-gray-850: 54 59 64;
+    --nb-gray-900: 46 50 56;
+    --nb-gray-910: 43 47 51;
+    --nb-gray-920: 37 40 45;
+    --nb-gray-925: 30 33 35;
+    --nb-gray-930: 37 40 44;
+    --nb-gray-935: 31 33 36;
+    --nb-gray-940: 28 30 33;
+    --nb-gray-950: 24 26 29;
+    --nb-gray-960: 22 24 27;
+
+    --skeleton-base: 37 40 45;
+    --skeleton-highlight: 51 55 62;
+}
+
+html,
+body,
+#root {
+    height: 100%;
+    overflow: hidden;
+}
+
+/*
+ * Body bg is fully opaque on purpose. The main window uses
+ * MacBackdropTranslucent (main.go) and TitleBarHiddenInset, which on macOS
+ * lets the desktop wallpaper bleed through any non-opaque pixel. A 90%
+ * body alpha meant two machines with different wallpapers saw different
+ * effective backgrounds. Matching the per-theme Wails BackgroundColour
+ * (services.CurrentWindowBackgroundColour, nb-gray DEFAULT in both ramps)
+ * keeps things consistent regardless of the OS backdrop.
+ */
+body {
+    @apply bg-nb-gray font-sans text-nb-gray-200 antialiased;
+}
+
+[dir="rtl"] :is(.font-mono, code, kbd):not([dir]) {
+    direction: ltr;
+    unicode-bidi: isolate;
+}
+
+.wails-draggable {
+    --wails-draggable: drag;
+    cursor: default;
+}
+
+.wails-no-draggable {
+    --wails-draggable: no-drag;
+}
diff --git a/client/ui/frontend/src/hooks/useAutoSizeWindow.ts b/client/ui/frontend/src/hooks/useAutoSizeWindow.ts
new file mode 100644
index 000000000..6623e72c2
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useAutoSizeWindow.ts
@@ -0,0 +1,64 @@
+import { useLayoutEffect, useRef } from "react";
+import { useSearchParams } from "react-router-dom";
+import { Events, Window } from "@wailsio/runtime";
+import i18next from "@/lib/i18n";
+import { isLinux } from "@/lib/platform";
+
+const EVENT_WINDOW_PAINTED = "netbird:window-painted";
+
+// Sizes the current Wails window to the measured content height (keeping `width`),
+// then reports it as painted so Go shows it. Re-applies on content resize and language change.
+export function useAutoSizeWindow<T extends HTMLElement>(width: number, ready: boolean = true) {
+    const ref = useRef<T | null>(null);
+    const [params] = useSearchParams();
+    const generation = params.get("gen") ?? "";
+    useLayoutEffect(() => {
+        const el = ref.current;
+        if (!el) return;
+        let painted = false;
+        let raf1 = 0;
+        let raf2 = 0;
+        const paintedOnce = () => {
+            if (painted) return;
+            painted = true;
+            Events.Emit(EVENT_WINDOW_PAINTED, generation).catch(() => {});
+        };
+        const apply = async () => {
+            if (!ready) return;
+            const h = Math.ceil(el.getBoundingClientRect().height);
+            if (h <= 0) return;
+            try {
+                // Window.SetSize takes the frame size, so add the OS title-bar height or content clips.
+                const frame = await Window.Size();
+                const targetH = h + Math.max(0, frame.height - window.innerHeight);
+                // Linux: SetSize no-ops on a mapped non-resizable window (X11), so pin via min/max instead.
+                if (isLinux()) {
+                    await Window.SetMinSize(width, targetH);
+                    await Window.SetMaxSize(width, targetH);
+                }
+                await Window.SetSize(width, targetH);
+                paintedOnce();
+            } catch {
+                // window gone / not ready — ignore
+            }
+        };
+        const scheduleApply = () => {
+            cancelAnimationFrame(raf1);
+            cancelAnimationFrame(raf2);
+            raf1 = requestAnimationFrame(() => {
+                raf2 = requestAnimationFrame(apply);
+            });
+        };
+        apply();
+        const ro = new ResizeObserver(apply);
+        ro.observe(el);
+        i18next.on("languageChanged", scheduleApply);
+        return () => {
+            ro.disconnect();
+            cancelAnimationFrame(raf1);
+            cancelAnimationFrame(raf2);
+            i18next.off("languageChanged", scheduleApply);
+        };
+    }, [width, ready, generation]);
+    return ref;
+}
diff --git a/client/ui/frontend/src/hooks/useDirection.ts b/client/ui/frontend/src/hooks/useDirection.ts
new file mode 100644
index 000000000..4609a2ae2
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useDirection.ts
@@ -0,0 +1,6 @@
+import { useTranslation } from "react-i18next";
+
+export function useDirection(): "ltr" | "rtl" {
+    const { i18n } = useTranslation();
+    return i18n.dir(i18n.language);
+}
diff --git a/client/ui/frontend/src/hooks/useFocusVisible.ts b/client/ui/frontend/src/hooks/useFocusVisible.ts
new file mode 100644
index 000000000..6061beb9c
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useFocusVisible.ts
@@ -0,0 +1,49 @@
+import { useEffect, useState } from "react";
+
+// Tracks the user's current input modality (keyboard vs pointer) at module
+// scope, mirroring what @react-aria/interactions does. Radix programmatically
+// focuses elements like Tabs triggers and Select triggers, which makes the
+// browser's :focus-visible heuristic light up on mouse-driven interactions too.
+// Gating focus styles on this hook lets us only paint a focus ring when the
+// user is actually navigating with the keyboard.
+// See react-aria's useFocusVisible for context.
+
+type Modality = "keyboard" | "pointer";
+
+let currentModality: Modality = "pointer";
+const subscribers = new Set<(m: Modality) => void>();
+
+const setModality = (m: Modality) => {
+    if (m === currentModality) return;
+    currentModality = m;
+    subscribers.forEach((cb) => cb(m));
+};
+
+const isKeyboardEvent = (e: KeyboardEvent) => {
+    if (e.metaKey || e.ctrlKey || e.altKey) return false;
+    return e.key === "Tab" || e.key === "Escape" || e.key.startsWith("Arrow");
+};
+
+if (globalThis.window !== undefined) {
+    globalThis.addEventListener(
+        "keydown",
+        (e) => {
+            if (isKeyboardEvent(e)) setModality("keyboard");
+        },
+        true,
+    );
+    globalThis.addEventListener("pointerdown", () => setModality("pointer"), true);
+}
+
+export const useFocusVisible = (): boolean => {
+    const [visible, setVisible] = useState(currentModality === "keyboard");
+    useEffect(() => {
+        setVisible(currentModality === "keyboard");
+        const cb = (m: Modality) => setVisible(m === "keyboard");
+        subscribers.add(cb);
+        return () => {
+            subscribers.delete(cb);
+        };
+    }, []);
+    return visible;
+};
diff --git a/client/ui/frontend/src/hooks/useKeepConnectedOnQuit.ts b/client/ui/frontend/src/hooks/useKeepConnectedOnQuit.ts
new file mode 100644
index 000000000..eb68dd997
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useKeepConnectedOnQuit.ts
@@ -0,0 +1,35 @@
+import { useCallback, useEffect, useState } from "react";
+import { Preferences } from "@bindings/services";
+
+export const useKeepConnectedOnQuit = () => {
+    const [keepConnected, setKeepConnected] = useState<boolean | null>(null);
+
+    useEffect(() => {
+        let cancelled = false;
+        Preferences.Get()
+            .then((prefs) => {
+                if (cancelled) return;
+                setKeepConnected(prefs?.keepConnectedOnQuit ?? false);
+            })
+            .catch((err: unknown) => {
+                if (cancelled) return;
+                console.warn("[useKeepConnectedOnQuit] load preferences failed", err);
+                setKeepConnected(false);
+            });
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    const setKeepConnectedOnQuit = useCallback(async (keep: boolean) => {
+        setKeepConnected(keep);
+        try {
+            await Preferences.SetKeepConnectedOnQuit(keep);
+        } catch (err: unknown) {
+            setKeepConnected(!keep);
+            console.error("[useKeepConnectedOnQuit] SetKeepConnectedOnQuit failed", err);
+        }
+    }, []);
+
+    return { keepConnected, setKeepConnectedOnQuit };
+};
diff --git a/client/ui/frontend/src/hooks/useKeyboardShortcut.ts b/client/ui/frontend/src/hooks/useKeyboardShortcut.ts
new file mode 100644
index 000000000..ea67d8375
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useKeyboardShortcut.ts
@@ -0,0 +1,46 @@
+import { useEffect } from "react";
+import { isMacOS } from "@/lib/platform";
+
+export type Shortcut = {
+    key: string;
+    cmd?: boolean;
+    shift?: boolean;
+    alt?: boolean;
+    preventDefault?: boolean;
+};
+
+export const useKeyboardShortcut = (shortcut: Shortcut, callback: () => void, enabled = true) => {
+    useEffect(() => {
+        if (!enabled) return;
+        const onKey = (e: KeyboardEvent) => {
+            if (e.key.toLowerCase() !== shortcut.key.toLowerCase()) return;
+            const mod = e.metaKey || e.ctrlKey;
+            if (!!shortcut.cmd !== mod) return;
+            if (!!shortcut.shift !== e.shiftKey) return;
+            if (!!shortcut.alt !== e.altKey) return;
+            if (shortcut.preventDefault !== false) e.preventDefault();
+            callback();
+        };
+        globalThis.addEventListener("keydown", onKey);
+        return () => globalThis.removeEventListener("keydown", onKey);
+    }, [
+        shortcut.key,
+        shortcut.cmd,
+        shortcut.shift,
+        shortcut.alt,
+        shortcut.preventDefault,
+        callback,
+        enabled,
+    ]);
+};
+
+export const formatShortcut = (shortcut: Shortcut): string => {
+    // navigator.platform is empty on some WebView2 builds → misrenders ⌘ as Ctrl on Mac.
+    const mac = isMacOS();
+    const parts: string[] = [];
+    if (shortcut.cmd) parts.push(mac ? "⌘" : "Ctrl");
+    if (shortcut.shift) parts.push(mac ? "⇧" : "Shift");
+    if (shortcut.alt) parts.push(mac ? "⌥" : "Alt");
+    parts.push(shortcut.key.length === 1 ? shortcut.key.toUpperCase() : shortcut.key);
+    return parts.join(mac ? "" : "+");
+};
diff --git a/client/ui/frontend/src/hooks/useManagementUrl.ts b/client/ui/frontend/src/hooks/useManagementUrl.ts
new file mode 100644
index 000000000..6a0ef1b81
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useManagementUrl.ts
@@ -0,0 +1,143 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useConfirm } from "@/contexts/DialogContext.tsx";
+
+export const CLOUD_MANAGEMENT_URL = "https://api.netbird.io:443";
+const CLOUD_MANAGEMENT_URLS = new Set([
+    CLOUD_MANAGEMENT_URL,
+    "https://api.wiretrustee.com:443", // legacy cloud endpoint
+]);
+
+export function isNetbirdCloud(url: string): boolean {
+    if (!url || url.trim() === "") return true;
+    return CLOUD_MANAGEMENT_URLS.has(url);
+}
+
+// Matches http(s)://host[:port][/path][?query][#fragment]; host = domain, localhost, or IPv4.
+// Syntactic validation only — reachability is checked via checkManagementUrlReachable.
+export const URL_PATTERN = new RegExp(
+    String.raw`^(https?:\/\/)?` +
+        String.raw`((([a-z\d]([a-z\d-]*[a-z\d])?)\.)+[a-z]{2,}|localhost|` +
+        String.raw`((\d{1,3}\.){3}\d{1,3}))` +
+        String.raw`(\:\d+)?(\/[-a-z\d%_.~+]*)*` +
+        String.raw`(\?[;&a-z\d%_.~+=-]*)?` +
+        String.raw`(\#[-a-z\d_]*)?$`,
+    "i",
+);
+
+export function normalizeManagementUrl(input: string): string {
+    const trimmed = input.trim();
+    if (!trimmed) return "";
+    if (/^https?:\/\//i.test(trimmed)) return trimmed;
+    return `https://${trimmed}`;
+}
+
+export function isValidManagementUrl(input: string): boolean {
+    const trimmed = input.trim();
+    if (!trimmed) return false;
+    return URL_PATTERN.test(trimmed);
+}
+
+// Can false-negative for self-hosted behind internal DNS / self-signed certs — treat as a soft warning, not a hard block.
+export async function checkManagementUrlReachable(
+    url: string,
+    timeoutMs: number = 5000,
+): Promise<boolean> {
+    const target = normalizeManagementUrl(url);
+    if (!target) return false;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        await fetch(target, { method: "GET", mode: "no-cors", signal: controller.signal });
+        return true;
+    } catch {
+        return false;
+    } finally {
+        clearTimeout(timer);
+    }
+}
+
+export enum ManagementMode {
+    Cloud = "cloud",
+    SelfHosted = "selfhosted",
+}
+
+function modeFromUrl(url: string): ManagementMode {
+    return isNetbirdCloud(url) ? ManagementMode.Cloud : ManagementMode.SelfHosted;
+}
+
+export function useManagementUrl() {
+    const { t } = useTranslation();
+    const confirm = useConfirm();
+    const { config, saveField } = useSettings();
+    const [modeState, setModeState] = useState<ManagementMode>(modeFromUrl(config.managementUrl));
+    const [url, setUrl] = useState(
+        isNetbirdCloud(config.managementUrl) ? "" : config.managementUrl,
+    );
+    const [checking, setChecking] = useState(false);
+    const [unreachable, setUnreachable] = useState(false);
+
+    useEffect(() => {
+        setModeState(modeFromUrl(config.managementUrl));
+        if (!isNetbirdCloud(config.managementUrl)) {
+            setUrl(config.managementUrl);
+        }
+    }, [config.managementUrl]);
+
+    useEffect(() => {
+        setUnreachable(false);
+    }, [url, modeState]);
+
+    const setMode = async (next: ManagementMode) => {
+        if (next === ManagementMode.Cloud && !isNetbirdCloud(config.managementUrl)) {
+            const ok = await confirm({
+                title: t("settings.general.management.switchCloudTitle"),
+                description: t("settings.general.management.switchCloudMessage"),
+                confirmLabel: t("settings.general.management.switchCloudConfirm"),
+            });
+            if (!ok) return;
+            setModeState(ManagementMode.Cloud);
+            saveField("managementUrl", CLOUD_MANAGEMENT_URL).catch((err: unknown) =>
+                console.error("save managementUrl failed", err),
+            );
+            return;
+        }
+        setModeState(next);
+    };
+
+    const normalizedUrl = normalizeManagementUrl(url);
+    const urlValid = isValidManagementUrl(url);
+    const targetUrl = modeState === ManagementMode.Cloud ? CLOUD_MANAGEMENT_URL : normalizedUrl;
+    const dirty = targetUrl !== config.managementUrl;
+    const showError = modeState === ManagementMode.SelfHosted && url.trim() !== "" && !urlValid;
+    const canSave = dirty && (modeState === ManagementMode.Cloud || urlValid);
+    const displayUrl = modeState === ManagementMode.Cloud ? CLOUD_MANAGEMENT_URL : url;
+
+    const save = async () => {
+        if (modeState === ManagementMode.SelfHosted && !unreachable) {
+            setChecking(true);
+            const reachable = await checkManagementUrlReachable(targetUrl);
+            setChecking(false);
+            if (!reachable) {
+                setUnreachable(true);
+                return;
+            }
+        }
+        await saveField("managementUrl", targetUrl);
+        setUnreachable(false);
+    };
+
+    return {
+        mode: modeState,
+        setMode,
+        url,
+        setUrl,
+        displayUrl,
+        showError,
+        canSave,
+        save,
+        checking,
+        unreachable,
+    };
+}
diff --git a/client/ui/frontend/src/hooks/usePrivilege.ts b/client/ui/frontend/src/hooks/usePrivilege.ts
new file mode 100644
index 000000000..d67fcc4b1
--- /dev/null
+++ b/client/ui/frontend/src/hooks/usePrivilege.ts
@@ -0,0 +1,32 @@
+import { useEffect, useState } from "react";
+import { Settings as SettingsSvc } from "@bindings/services";
+import { type Privilege } from "@bindings/services/models.js";
+
+// usePrivilege reports whether this UI process may perform the changes the daemon
+// restricts to root/administrator. It is answered in-process from our own token
+// with the daemon's own rule, so there is no round-trip and it works while the
+// daemon is down.
+//
+// null means "not known yet", which includes the read having failed. Callers must
+// treat that as "do not restrict": the daemon enforces this regardless, so the
+// only thing a wrong guess here costs is a control that looks unavailable when it
+// is not, or a save that fails with the daemon's own guidance.
+export const usePrivilege = (): Privilege | null => {
+    const [privilege, setPrivilege] = useState<Privilege | null>(null);
+
+    useEffect(() => {
+        let cancelled = false;
+        SettingsSvc.Privilege()
+            .then((p) => {
+                if (!cancelled) setPrivilege(p);
+            })
+            .catch((e: unknown) => {
+                console.warn("[usePrivilege] read failed, not restricting controls", e);
+            });
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    return privilege;
+};
diff --git a/client/ui/frontend/src/layouts/AppLayout.tsx b/client/ui/frontend/src/layouts/AppLayout.tsx
new file mode 100644
index 000000000..0c2837b53
--- /dev/null
+++ b/client/ui/frontend/src/layouts/AppLayout.tsx
@@ -0,0 +1,29 @@
+import { Outlet } from "react-router-dom";
+import { ClientVersionProvider } from "@/contexts/ClientVersionContext.tsx";
+import { StatusProvider } from "@/contexts/StatusContext.tsx";
+import { DebugBundleProvider } from "@/contexts/DebugBundleContext.tsx";
+import { ProfileProvider } from "@/contexts/ProfileContext.tsx";
+import { DialogProvider } from "@/contexts/DialogContext.tsx";
+import { RestrictionsProvider } from "@/contexts/RestrictionsContext.tsx";
+import { ReadySignal } from "@/components/ReadySignal.tsx";
+
+export const AppLayout = () => {
+    return (
+        <div className={"relative flex h-full flex-col"}>
+            <DialogProvider>
+                <StatusProvider>
+                    <ProfileProvider>
+                        <RestrictionsProvider>
+                            <DebugBundleProvider>
+                                <ClientVersionProvider>
+                                    <Outlet />
+                                    <ReadySignal />
+                                </ClientVersionProvider>
+                            </DebugBundleProvider>
+                        </RestrictionsProvider>
+                    </ProfileProvider>
+                </StatusProvider>
+            </DialogProvider>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/layouts/AppRightPanel.tsx b/client/ui/frontend/src/layouts/AppRightPanel.tsx
new file mode 100644
index 000000000..4e7bcb0f4
--- /dev/null
+++ b/client/ui/frontend/src/layouts/AppRightPanel.tsx
@@ -0,0 +1,41 @@
+import { type ReactNode } from "react";
+import { motion } from "framer-motion";
+import { cn } from "@/lib/cn.ts";
+import { useDirection } from "@/hooks/useDirection";
+
+type Props = {
+    children: ReactNode;
+    overlay?: ReactNode;
+    overlayOpen?: boolean;
+    className?: string;
+};
+
+const PANEL_TRANSITION = {
+    duration: 0.32,
+    ease: [0.32, 0.72, 0, 1] as [number, number, number, number],
+};
+
+export const AppRightPanel = ({ children, overlay, overlayOpen = false, className }: Props) => {
+    const dir = useDirection();
+    const parallaxX = dir === "rtl" ? 48 : -48;
+    return (
+        <div
+            className={cn(
+                "wails-no-draggable relative m-5",
+                "border border-nb-gray-800 bg-nb-gray-940 dark:border-nb-gray-920",
+                "flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden rounded-xl rounded-ee-2xl",
+                className,
+            )}
+        >
+            <motion.div
+                animate={{ x: overlayOpen ? parallaxX : 0 }}
+                transition={PANEL_TRANSITION}
+                className={"flex min-h-0 min-w-0 flex-1 flex-col"}
+                style={{ pointerEvents: overlayOpen ? "none" : "auto" }}
+            >
+                {children}
+            </motion.div>
+            {overlay}
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/lib/cn.ts b/client/ui/frontend/src/lib/cn.ts
new file mode 100644
index 000000000..e6a8be071
--- /dev/null
+++ b/client/ui/frontend/src/lib/cn.ts
@@ -0,0 +1,6 @@
+import { clsx, type ClassValue } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]) {
+    return twMerge(clsx(inputs));
+}
diff --git a/client/ui/frontend/src/lib/compat.ts b/client/ui/frontend/src/lib/compat.ts
new file mode 100644
index 000000000..b2981da90
--- /dev/null
+++ b/client/ui/frontend/src/lib/compat.ts
@@ -0,0 +1,19 @@
+import { Compat } from "@bindings/services";
+
+let cached: boolean | null = null;
+
+/**
+ * isDaemonCompatible probes whether the running daemon implements the WailsUIReady
+ * RPC. A false result means the daemon predates this UI (Unimplemented) and is too
+ * old to drive it. The Go side returns an error instead when the daemon is simply
+ * unreachable, so a throw here is NOT an outdated daemon — treat it as "unknown"
+ * and let the normal connection flow report it.
+ *
+ * The result is cached for the session: daemon identity does not change without a
+ * UI restart, and a freshly started daemon is reachable again under the same socket.
+ */
+export async function isDaemonCompatible(): Promise<boolean> {
+    if (cached !== null) return cached;
+    cached = await Compat.DaemonReady();
+    return cached;
+}
diff --git a/client/ui/frontend/src/lib/connection.ts b/client/ui/frontend/src/lib/connection.ts
new file mode 100644
index 000000000..cc0e67cb3
--- /dev/null
+++ b/client/ui/frontend/src/lib/connection.ts
@@ -0,0 +1,133 @@
+import { Events } from "@wailsio/runtime";
+import { Connection, WindowManager } from "@bindings/services";
+import i18next from "@/lib/i18n";
+import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
+
+export const EVENT_BROWSER_LOGIN_CANCEL = "browser-login:cancel";
+export const EVENT_TRIGGER_LOGIN = "trigger-login";
+
+let connectionInFlight = false;
+
+type SsoState = {
+    cancelled: boolean;
+    offCancel?: () => void;
+    offSignal?: () => void;
+};
+
+async function openBrowserLoginUri(uri: string): Promise<void> {
+    try {
+        await WindowManager.OpenBrowserLogin(uri);
+    } catch (e) {
+        console.error(e);
+    }
+}
+
+function buildSsoCancelPromise(state: SsoState, signal?: AbortSignal): Promise<void> {
+    return new Promise<void>((resolve) => {
+        state.offCancel = Events.On(EVENT_BROWSER_LOGIN_CANCEL, () => {
+            state.cancelled = true;
+            resolve();
+        });
+        if (!signal) return;
+        const onAbort = () => {
+            state.cancelled = true;
+            resolve();
+        };
+        if (signal.aborted) {
+            onAbort();
+            return;
+        }
+        signal.addEventListener("abort", onAbort);
+        state.offSignal = () => signal.removeEventListener("abort", onAbort);
+    });
+}
+
+async function runSsoLogin(
+    result: {
+        verificationUri: string;
+        verificationUriComplete: string;
+        userCode: string;
+        profileId: string;
+    },
+    state: SsoState,
+    signal?: AbortSignal,
+): Promise<void> {
+    const uri = result.verificationUriComplete || result.verificationUri;
+    if (uri) await openBrowserLoginUri(uri);
+
+    const cancelPromise = buildSsoCancelPromise(state, signal);
+    // Combine wait + up in Go so the connection comes up the moment SSO
+    // completes. During SSO the tray window is hidden and the webview is
+    // suspended, so a frontend-driven Up (a promise continuation) would not
+    // fire until the user woke the window (e.g. hovering the tray icon).
+    const waitPromise = Connection.WaitSSOLoginAndUp(
+        { userCode: result.userCode, hostname: "", profileId: result.profileId },
+        { profileName: "", username: "" },
+    );
+
+    try {
+        await Promise.race([waitPromise, cancelPromise]);
+    } finally {
+        WindowManager.CloseBrowserLogin().catch(console.error);
+    }
+
+    if (state.cancelled) {
+        waitPromise.cancel?.();
+        waitPromise.catch(() => {});
+    }
+}
+
+export async function startConnection(onSettled?: () => void, signal?: AbortSignal): Promise<void> {
+    if (connectionInFlight || signal?.aborted) {
+        onSettled?.();
+        return;
+    }
+    connectionInFlight = true;
+
+    const state: SsoState = { cancelled: false };
+    let connectError: unknown;
+
+    try {
+        const result = await Connection.Login({
+            profileName: "",
+            username: "",
+            managementUrl: "",
+            setupKey: "",
+            preSharedKey: "",
+            hostname: "",
+            hint: "",
+        });
+
+        if (signal?.aborted) state.cancelled = true;
+
+        if (!state.cancelled && result.needsSsoLogin) {
+            // runSsoLogin brings the connection up in Go once SSO completes.
+            await runSsoLogin(result, state, signal);
+        } else {
+            if (!state.cancelled && signal?.aborted) state.cancelled = true;
+            if (!state.cancelled) {
+                await Connection.Up({ profileName: "", username: "" });
+            }
+        }
+    } catch (e) {
+        WindowManager.CloseBrowserLogin().catch(console.error);
+        if (!state.cancelled) connectError = e;
+    } finally {
+        state.offCancel?.();
+        state.offSignal?.();
+        connectionInFlight = false;
+        onSettled?.();
+    }
+
+    if (connectError !== undefined) {
+        await errorDialog({
+            Title: i18next.t("connect.error.loginTitle"),
+            Message: formatErrorMessage(connectError),
+        });
+        return;
+    }
+
+    if (state.cancelled && signal) {
+        throw new DOMException("aborted", "AbortError");
+    }
+}
diff --git a/client/ui/frontend/src/lib/errors.ts b/client/ui/frontend/src/lib/errors.ts
new file mode 100644
index 000000000..b4dee2717
--- /dev/null
+++ b/client/ui/frontend/src/lib/errors.ts
@@ -0,0 +1,73 @@
+import { WindowManager } from "@bindings/services";
+
+type ClassifiedError = { short: string; long: string; command: string };
+
+const asObject = (v: unknown): Record<string, unknown> | null =>
+    v && typeof v === "object" ? (v as Record<string, unknown>) : null;
+
+const parseJsonObject = (s: unknown): Record<string, unknown> | null => {
+    if (typeof s !== "string") return null;
+    const t = s.trim();
+    if (!t.startsWith("{") || !t.endsWith("}")) return null;
+    try {
+        return asObject(JSON.parse(t));
+    } catch {
+        return null;
+    }
+};
+
+const toWailsEnvelope = (e: unknown): Record<string, unknown> | null => {
+    const obj = asObject(e);
+    if (!obj) return null;
+    return asObject(obj.cause) ?? parseJsonObject(obj.message);
+};
+
+// Read { short, long, command } from wherever the classified error sits in the envelope
+const toClassifiedError = (v: unknown): ClassifiedError | null => {
+    const o = asObject(v);
+    if (!o) return null;
+    const short = typeof o.short === "string" ? o.short : "";
+    const long = typeof o.long === "string" ? o.long : "";
+    const command = typeof o.command === "string" ? o.command : "";
+    return short || long ? { short, long, command } : null;
+};
+
+const classify = (e: unknown): ClassifiedError | null => {
+    const envelope = toWailsEnvelope(e);
+    return toClassifiedError(envelope?.cause) ?? toClassifiedError(envelope);
+};
+
+export const formatErrorMessage = (e: unknown): string => {
+    // Prefer the structured { short, long } the daemon classifier produced.
+    const classified = classify(e);
+    if (classified) {
+        const { short, long } = classified;
+        if (short && long && long !== short) return `${short} Details: ${long}`;
+        if (short) return short;
+        if (long) return long;
+    }
+
+    // Unclassified (a service returned the raw daemon error)
+    const envelope = toWailsEnvelope(e);
+    const message = envelope?.message;
+    if (typeof message === "string" && message) return message;
+    if (e instanceof Error) return e.message;
+    return String(e);
+};
+
+// errorCommand returns a command the user can run to complete an operation the
+// daemon refused, when the error carries one (a change that needs elevated
+// privileges). Empty for every other error.
+export const errorCommand = (e: unknown): string => classify(e)?.command ?? "";
+
+export type ErrorDialogOptions = {
+    Title: string;
+    Message: string;
+    // Command is shown for copying below the message. Defaults to the one the
+    // error carries, so callers only pass it to override.
+    Command?: string;
+};
+
+export function errorDialog(options: ErrorDialogOptions): Promise<void> {
+    return WindowManager.OpenError(options.Title, options.Message, options.Command ?? "");
+}
diff --git a/client/ui/frontend/src/lib/formatters.ts b/client/ui/frontend/src/lib/formatters.ts
new file mode 100644
index 000000000..a4a2f557e
--- /dev/null
+++ b/client/ui/frontend/src/lib/formatters.ts
@@ -0,0 +1,44 @@
+export const formatBytes = (bytes: number, decimals: number = 2): string => {
+    if (!Number.isFinite(bytes) || bytes <= 0) return "0 B";
+
+    const k = 1024;
+    const sizes = ["B", "KB", "MB", "GB", "TB"];
+    const i = Math.min(sizes.length - 1, Math.floor(Math.log(bytes) / Math.log(k)));
+
+    return Number.parseFloat((bytes / Math.pow(k, i)).toFixed(decimals)) + " " + sizes[i];
+};
+
+export const latencyColor = (ms: number): string => {
+    if (ms <= 0) return "text-nb-gray-400";
+    if (ms < 100) return "text-green-600 dark:text-green-400";
+    return "text-yellow-600 dark:text-yellow-400";
+};
+
+export const formatRelative = (unixSeconds: number, nowMs: number = Date.now()): string | null => {
+    if (!Number.isFinite(unixSeconds) || unixSeconds <= 0) return null;
+    const diff = Math.max(0, Math.floor(nowMs / 1000 - unixSeconds));
+    if (diff < 60) return `${diff}s ago`;
+    if (diff < 3600) return `${Math.floor(diff / 60)}m ago`;
+    if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`;
+    return `${Math.floor(diff / 86400)}d ago`;
+};
+
+// Base domain is operator-configurable, so cut at the first dot rather than match a known suffix.
+export const shortenDns = (fqdn: string | undefined | null): string => {
+    if (!fqdn) return "";
+    const dot = fqdn.indexOf(".");
+    return dot === -1 ? fqdn : fqdn.slice(0, dot);
+};
+
+// Countdown clock: mm:ss, widening to hh:mm:ss / dd:hh:mm:ss as the duration grows.
+export const formatRemaining = (seconds: number): string => {
+    const s = Math.max(0, Math.trunc(seconds));
+    const days = Math.floor(s / 86400);
+    const hours = Math.floor((s % 86400) / 3600);
+    const minutes = Math.floor((s % 3600) / 60);
+    const secs = s % 60;
+    const pad = (n: number) => String(n).padStart(2, "0");
+    if (days > 0) return `${pad(days)}:${pad(hours)}:${pad(minutes)}:${pad(secs)}`;
+    if (hours > 0) return `${pad(hours)}:${pad(minutes)}:${pad(secs)}`;
+    return `${pad(minutes)}:${pad(secs)}`;
+};
diff --git a/client/ui/frontend/src/lib/i18n.ts b/client/ui/frontend/src/lib/i18n.ts
new file mode 100644
index 000000000..25f2b282a
--- /dev/null
+++ b/client/ui/frontend/src/lib/i18n.ts
@@ -0,0 +1,119 @@
+import i18next from "i18next";
+import { initReactI18next } from "react-i18next";
+import { Events } from "@wailsio/runtime";
+
+import { Preferences, I18n } from "@bindings/services";
+import { type LanguageCode } from "@bindings/i18n/models.js";
+
+// Relative path on purpose — alias globs (`@/…`) silently match nothing in some Vite dev setups.
+type BundleEntry = { message: string; description?: string };
+const bundleModules = import.meta.glob<Record<string, BundleEntry>>(
+    "../../../i18n/locales/*/common.json",
+    { eager: true, import: "default" },
+);
+
+const resources: Record<string, { common: Record<string, string> }> = {};
+for (const path in bundleModules) {
+    const match = /locales\/([^/]+)\/common\.json$/.exec(path);
+    if (match) {
+        const entries = bundleModules[path];
+        const messages: Record<string, string> = {};
+        for (const key in entries) {
+            messages[key] = entries[key].message;
+        }
+        resources[match[1]] = { common: messages };
+    }
+}
+
+function detectBrowserLanguage(available: string[]): string | null {
+    const tags = [navigator.language, ...(navigator.languages ?? [])].filter(
+        (tag): tag is string => typeof tag === "string" && tag.length > 0,
+    );
+    const byLower = new Map(available.map((code) => [code.toLowerCase(), code]));
+    for (const tag of tags) {
+        const lower = tag.toLowerCase();
+        const exact = byLower.get(lower);
+        if (exact) return exact;
+        const base = byLower.get(lower.split("-")[0]);
+        if (base) return base;
+    }
+    return null;
+}
+
+// Only locales listed in _index.json are shipped. A bundle on disk without an
+// _index.json row (e.g. a new Crowdin language not released yet) must not be
+// auto-detected or loaded, matching the Go side, which rejects saving it.
+async function shippedLanguages(): Promise<string[]> {
+    const onDisk = Object.keys(resources);
+    try {
+        const listed = new Set<string>((await I18n.Languages()).map((l) => l.code));
+        return onDisk.filter((code) => listed.has(code));
+    } catch (e) {
+        console.warn("load shipped languages failed, using all bundled locales", e);
+        return onDisk;
+    }
+}
+
+// An empty persisted language code is the Go-side signal for first run. A
+// persisted code that is no longer shipped is treated the same way.
+export async function initI18n(): Promise<void> {
+    const available = await shippedLanguages();
+    let language = "en";
+    let firstRun = false;
+    try {
+        const prefs = await Preferences.Get();
+        if (prefs?.language && available.includes(prefs.language)) {
+            language = prefs.language;
+        } else {
+            firstRun = true;
+            language = detectBrowserLanguage(available) ?? "en";
+        }
+    } catch (e) {
+        console.warn("read preferences for language failed, defaulting to en", e);
+    }
+
+    if (firstRun) {
+        Preferences.SetLanguage(language as LanguageCode).catch((err: unknown) =>
+            console.warn("persist detected language failed", err),
+        );
+    }
+
+    await i18next.use(initReactI18next).init({
+        lng: language,
+        fallbackLng: "en",
+        defaultNS: "common",
+        ns: ["common"],
+        resources: Object.fromEntries(available.map((code) => [code, resources[code]])),
+        interpolation: {
+            prefix: "{",
+            suffix: "}",
+            escapeValue: false,
+        },
+        returnNull: false,
+    });
+
+    syncDocumentLang();
+    i18next.on("languageChanged", syncDocumentLang);
+
+    Events.On("netbird:preferences:changed", (e) => {
+        const next = e.data?.language;
+        if (next && next !== i18next.language) {
+            i18next.changeLanguage(next).catch((err: unknown) => {
+                console.error("changeLanguage failed", err);
+            });
+        }
+    });
+}
+
+function syncDocumentLang() {
+    if (typeof document !== "undefined") {
+        document.documentElement.lang = i18next.language;
+        document.documentElement.dir = i18next.dir(i18next.language);
+    }
+}
+
+export async function loadLanguages() {
+    return I18n.Languages();
+}
+
+export default i18next;
diff --git a/client/ui/frontend/src/lib/logs.ts b/client/ui/frontend/src/lib/logs.ts
new file mode 100644
index 000000000..499023fa3
--- /dev/null
+++ b/client/ui/frontend/src/lib/logs.ts
@@ -0,0 +1,139 @@
+import { UILog } from "@bindings/services";
+
+type Level = "trace" | "debug" | "info" | "warn" | "error";
+
+const METHOD_LEVELS: Record<string, Level> = {
+    trace: "trace",
+    debug: "debug",
+    log: "info",
+    info: "info",
+    warn: "warn",
+    error: "error",
+};
+
+const IGNORED_SOURCES = new Set(["welcome.ts"]);
+
+const RATE_LIMIT = 50;
+const RATE_WINDOW_MS = 1000;
+
+let installed = false;
+let inForward = false;
+let windowStart = 0;
+let windowCount = 0;
+
+function describeCause(rawCause: unknown): string {
+    if (rawCause instanceof Error) return `${rawCause.name}: ${rawCause.message}`;
+    if (typeof rawCause === "object" && rawCause !== null) {
+        try {
+            return JSON.stringify(rawCause);
+        } catch {
+            // Circular ref — fall through to a tag instead of "[object Object]".
+            return `<${rawCause.constructor?.name ?? "object"}>`;
+        }
+    }
+    return String(rawCause);
+}
+
+function formatCause(rawCause: unknown): string {
+    if (rawCause === undefined) return "";
+    return `\ncaused by ${describeCause(rawCause)}`;
+}
+
+// WebKit (macOS WKWebView) omits the "Name: message" header from Error.stack,
+// so a bare stack hides the real cause. Prepend name+message, then the stack.
+function formatError(e: Error): string {
+    const head = `${e.name}: ${e.message}`;
+    const cause = formatCause((e as { cause?: unknown }).cause);
+    if (!e.stack) return `${head}${cause}`;
+    if (e.stack.startsWith(head)) return `${head}${cause}`;
+    return `${head}${cause}\n${e.stack}`;
+}
+
+function format(args: unknown[]): string {
+    return args
+        .map((a) => {
+            if (typeof a === "string") return a;
+            if (a instanceof Error) return formatError(a);
+            try {
+                return JSON.stringify(a);
+            } catch {
+                return String(a);
+            }
+        })
+        .join(" ");
+}
+
+function parseStackLine(line: string): string {
+    // Find the file:line:col tail at the end of the path.
+    const colonCol = line.lastIndexOf(":");
+    if (colonCol <= 0) return "";
+    const colonLine = line.lastIndexOf(":", colonCol - 1);
+    if (colonLine <= 0) return "";
+    const col = line.slice(colonCol + 1);
+    const lineNo = line.slice(colonLine + 1, colonCol);
+    if (!/^\d+$/.test(col) || !/^\d+$/.test(lineNo)) return "";
+    const before = line.slice(0, colonLine);
+    const sep = Math.max(
+        before.lastIndexOf("/"),
+        before.lastIndexOf("\\"),
+        before.lastIndexOf("("),
+        before.lastIndexOf(" "),
+    );
+    const file = before.slice(sep + 1);
+    if (!file.includes(".")) return "";
+    return `${file}:${lineNo}`;
+}
+
+function callerSource(): string {
+    const stack = new Error().stack;
+    if (!stack) return "";
+    for (const line of stack.split("\n").slice(1)) {
+        if (line.includes("/logs.ts")) continue;
+        const parsed = parseStackLine(line);
+        if (parsed) return parsed;
+    }
+    return "";
+}
+
+function forward(level: Level, args: unknown[]) {
+    if (inForward) return;
+    inForward = true;
+    try {
+        const now = Date.now();
+        if (now - windowStart >= RATE_WINDOW_MS) {
+            windowStart = now;
+            windowCount = 0;
+        }
+        if (++windowCount > RATE_LIMIT) return;
+
+        const source = callerSource();
+        if (IGNORED_SOURCES.has(source.split(":")[0])) return;
+        // Don't touch console here — it would recurse back into forward().
+        UILog.Log(level, source, format(args)).catch(() => {});
+    } catch {
+        // Swallow — log forwarding must never throw back into the caller.
+    } finally {
+        inForward = false;
+    }
+}
+
+export function initLogForwarding() {
+    if (installed) return;
+    installed = true;
+
+    const c = console as unknown as Record<string, (...a: unknown[]) => void>;
+    for (const [method, level] of Object.entries(METHOD_LEVELS)) {
+        const original = c[method]?.bind(console);
+        c[method] = (...args: unknown[]) => {
+            original?.(...args);
+            forward(level, args);
+        };
+    }
+
+    globalThis.addEventListener("error", (e) => {
+        forward("error", [`uncaught error: ${e.message}`, e.error ?? ""]);
+    });
+    globalThis.addEventListener("unhandledrejection", (e) => {
+        forward("error", ["unhandled promise rejection:", e.reason]);
+    });
+}
diff --git a/client/ui/frontend/src/lib/platform.ts b/client/ui/frontend/src/lib/platform.ts
new file mode 100644
index 000000000..c256dde23
--- /dev/null
+++ b/client/ui/frontend/src/lib/platform.ts
@@ -0,0 +1,39 @@
+import { System } from "@wailsio/runtime";
+
+export type Platform = {
+    isWindows: boolean;
+    isMacOS: boolean;
+};
+
+let cached: Platform | null = null;
+
+export async function initPlatform(): Promise<void> {
+    if (cached) return;
+
+    const syncIsMac = System.IsMac();
+    const syncIsWindows = System.IsWindows();
+
+    let env: Awaited<ReturnType<typeof System.Environment>> | null = null;
+    try {
+        env = await System.Environment();
+    } catch (e) {
+        console.error("[platform] System.Environment() threw:", e);
+    }
+
+    const os = (env?.OS ?? "").toLowerCase();
+    cached = {
+        isWindows: os ? os === "windows" : syncIsWindows,
+        isMacOS: os ? os === "darwin" : syncIsMac,
+    };
+}
+
+function get(): Platform {
+    if (!cached) {
+        throw new Error("platform: initPlatform() must complete before sync getters are used");
+    }
+    return cached;
+}
+
+export const isWindows = (): boolean => get().isWindows;
+export const isMacOS = (): boolean => get().isMacOS;
+export const isLinux = (): boolean => !get().isWindows && !get().isMacOS;
diff --git a/client/ui/frontend/src/lib/sorting.ts b/client/ui/frontend/src/lib/sorting.ts
new file mode 100644
index 000000000..70622f705
--- /dev/null
+++ b/client/ui/frontend/src/lib/sorting.ts
@@ -0,0 +1,27 @@
+// Stable, order-preserving reconciliation for lists that re-fetch from the daemon
+// on every status push (peers, networks, profiles). Re-sorting on each refresh would
+// make rows jump around under the user, so instead:
+//   - items already on screen keep their existing order (from `prev`),
+//   - items that vanished are dropped,
+//   - newly-arrived items are sorted among themselves (`compareFresh`) and appended.
+// Net effect: the only visible movement is new rows landing at the bottom.
+//
+// Must stay pure and idempotent: callers write the returned `order` into a ref
+// during render (useMemo), so a rerun must reproduce the first pass — never
+// branch on run count or read external mutable state.
+export function reconcileOrder<T>(
+    prev: string[],
+    items: T[],
+    keyOf: (item: T) => string,
+    compareFresh: (a: T, b: T) => number,
+): { order: string[]; items: T[] } {
+    const byKey = new Map(items.map((i) => [keyOf(i), i]));
+    const kept = prev.filter((k) => byKey.has(k));
+    const known = new Set(kept);
+    const fresh = items
+        .filter((i) => !known.has(keyOf(i)))
+        .sort(compareFresh)
+        .map(keyOf);
+    const order = [...kept, ...fresh];
+    return { order, items: order.map((k) => byKey.get(k)!) };
+}
diff --git a/client/ui/frontend/src/lib/stallwatch.ts b/client/ui/frontend/src/lib/stallwatch.ts
new file mode 100644
index 000000000..aca7d75bb
--- /dev/null
+++ b/client/ui/frontend/src/lib/stallwatch.ts
@@ -0,0 +1,31 @@
+// Detects webview suspension (macOS App Nap / hidden-window timer throttling).
+// While the webview is suspended no JS runs at all, so detection happens on
+// resume: a 1s interval measures wall-clock drift and reports how long timers
+// were frozen. Silent unless a stall actually occurred; a stalled webview is
+// what delays promise continuations such as the WaitSSOLogin → Up handoff.
+
+const INTERVAL_MS = 1000;
+const STALL_THRESHOLD_MS = 5000;
+const REPORT_COOLDOWN_MS = 60_000;
+
+let started = false;
+
+export function initStallWatch() {
+    if (started) return;
+    started = true;
+
+    let last = Date.now();
+    let lastReport = 0;
+    setInterval(() => {
+        const now = Date.now();
+        const stall = now - last - INTERVAL_MS;
+        last = now;
+        if (stall < STALL_THRESHOLD_MS) return;
+        if (now - lastReport < REPORT_COOLDOWN_MS) return;
+        lastReport = now;
+        console.warn(
+            `webview timers were suspended for ${(stall / 1000).toFixed(1)}s ` +
+                `(App Nap / hidden-window throttling); pending UI work ran late`,
+        );
+    }, INTERVAL_MS);
+}
diff --git a/client/ui/frontend/src/lib/welcome.ts b/client/ui/frontend/src/lib/welcome.ts
new file mode 100644
index 000000000..d9df3fc8d
--- /dev/null
+++ b/client/ui/frontend/src/lib/welcome.ts
@@ -0,0 +1,25 @@
+const ART = `
+    _   __     __  ____  _          __   ______          __    __  __
+   / | / /__  / /_/ __ )(_)________/ /  / ____/___ ___  / /_  / / / /
+  /  |/ / _ \\/ __/ __  / / ___/ __  /  / / __/ __ \`__ \\/ __ \\/ /_/ /
+ / /|  /  __/ /_/ /_/ / / /  / /_/ /  / /_/ / / / / / / /_/ / __  /
+/_/ |_/\\___/\\__/_____/_/_/   \\__,_/   \\____/_/ /_/ /_/_.___/_/ /_/
+`;
+
+export function welcome() {
+    const message = `%c${ART}%c
+NetBird — The Only Secure Access Platform You'll Ever Need.
+
+WEBSITE:      https://netbird.io/
+WE'RE HIRING: https://netbird.io/careers
+OPEN SOURCE:  https://github.com/netbirdio/netbird
+`;
+
+    // Intentional NetBird ASCII banner in the devtools console.
+    // eslint-disable-next-line no-console
+    console.log(
+        message,
+        "color: #f68330; font-family: monospace; font-weight: normal; line-height: 1;",
+        "color: #f5f5f5; font-family: monospace; font-weight: normal; line-height: 1.4;",
+    );
+}
diff --git a/client/ui/frontend/src/modules/auto-update/UpdateBadge.tsx b/client/ui/frontend/src/modules/auto-update/UpdateBadge.tsx
new file mode 100644
index 000000000..3345e0a9f
--- /dev/null
+++ b/client/ui/frontend/src/modules/auto-update/UpdateBadge.tsx
@@ -0,0 +1,27 @@
+import { forwardRef, type HTMLAttributes } from "react";
+import { ArrowUpCircleIcon } from "lucide-react";
+import { cn } from "@/lib/cn";
+
+type Props = HTMLAttributes<HTMLDivElement> & {
+    size?: number;
+};
+
+export const UpdateBadge = forwardRef<HTMLDivElement, Props>(function UpdateBadge(
+    { size = 15, className, ...rest },
+    ref,
+) {
+    return (
+        <div
+            ref={ref}
+            className={cn("relative flex items-center justify-center", className)}
+            {...rest}
+        >
+            <span
+                className={
+                    "pointer-events-none absolute inline-flex h-[15px] w-[15px] animate-ping rounded-full bg-netbird opacity-20"
+                }
+            />
+            <ArrowUpCircleIcon size={size} className={"text-netbird"} />
+        </div>
+    );
+});
diff --git a/client/ui/frontend/src/modules/auto-update/UpdateInProgressDialog.tsx b/client/ui/frontend/src/modules/auto-update/UpdateInProgressDialog.tsx
new file mode 100644
index 000000000..1519613e0
--- /dev/null
+++ b/client/ui/frontend/src/modules/auto-update/UpdateInProgressDialog.tsx
@@ -0,0 +1,187 @@
+import { useEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useSearchParams } from "react-router-dom";
+import { Loader2, XCircle } from "lucide-react";
+import { Update as UpdateSvc, WindowManager } from "@bindings/services";
+import { Button } from "@/components/buttons/Button";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { SquareIcon } from "@/components/SquareIcon";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+
+const TIMEOUT_MS = 15 * 60 * 1000;
+const POLL_INTERVAL_MS = 2000;
+// Sustained gRPC failure during install is taken as success (installer restarts the daemon mid-flight).
+const DAEMON_DOWN_GRACE_MS = 5000;
+const WINDOW_WIDTH = 360;
+
+type Phase =
+    | { kind: "running" }
+    | { kind: "timeout" }
+    | { kind: "canceled" }
+    | { kind: "failed"; message: string };
+
+export default function UpdateInProgressDialog() {
+    const { t } = useTranslation();
+    const [params] = useSearchParams();
+    const version = params.get("version") ?? "";
+    const [phase, setPhase] = useState<Phase>({ kind: "running" });
+    const phaseRef = useRef(phase);
+    phaseRef.current = phase;
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
+
+    useEffect(() => {
+        let cancelled = false;
+        let done = false;
+        let timer: ReturnType<typeof setTimeout> | null = null;
+        const start = Date.now();
+        let firstUnreachableAt: number | null = null;
+
+        const poll = async () => {
+            if (cancelled || done) return;
+            if (phaseRef.current.kind !== "running") return;
+
+            if (Date.now() - start > TIMEOUT_MS) {
+                done = true;
+                setPhase({ kind: "timeout" });
+                return;
+            }
+
+            try {
+                const r = await UpdateSvc.GetInstallerResult();
+                if (cancelled || done || phaseRef.current.kind !== "running") return;
+                firstUnreachableAt = null;
+                if (r.success) {
+                    done = true;
+                    UpdateSvc.Quit().catch(console.error);
+                    return;
+                }
+                if (r.errorMsg) {
+                    done = true;
+                    setPhase(mapInstallError(r.errorMsg));
+                    return;
+                }
+            } catch {
+                if (cancelled || done || phaseRef.current.kind !== "running") return;
+                const now = Date.now();
+                if (firstUnreachableAt === null) {
+                    firstUnreachableAt = now;
+                } else if (now - firstUnreachableAt >= DAEMON_DOWN_GRACE_MS) {
+                    done = true;
+                    UpdateSvc.Quit().catch(console.error);
+                    return;
+                }
+            }
+
+            if (!cancelled && !done) {
+                timer = setTimeout(poll, POLL_INTERVAL_MS);
+            }
+        };
+
+        timer = setTimeout(poll, POLL_INTERVAL_MS);
+
+        return () => {
+            cancelled = true;
+            if (timer) clearTimeout(timer);
+        };
+    }, []);
+
+    const isError = phase.kind !== "running";
+    const errorInfo = isError ? classifyPhase(phase, version, t) : null;
+    const updatingHeading = version
+        ? t("update.overlay.updatingVersion", { version })
+        : t("update.overlay.updating");
+
+    return (
+        <ConfirmDialog ref={contentRef}>
+            {isError ? (
+                <SquareIcon icon={XCircle} className={"bg-red-500 [&_svg]:text-white"} />
+            ) : (
+                <SquareIcon icon={Loader2} className={"[&_svg]:animate-spin"} />
+            )}
+
+            <div className={"flex flex-col items-center gap-2"}>
+                <DialogHeading className={"text-balance"}>
+                    {errorInfo ? errorInfo.title : updatingHeading}
+                </DialogHeading>
+                <DialogDescription>
+                    {errorInfo ? (
+                        <>
+                            {errorInfo.description}
+                            {errorInfo.message && (
+                                <>
+                                    <br />
+                                    <span className={"first-letter:uppercase"}>
+                                        {errorInfo.message}
+                                    </span>
+                                </>
+                            )}
+                        </>
+                    ) : (
+                        t("update.overlay.description")
+                    )}
+                </DialogDescription>
+            </div>
+
+            {isError && (
+                <DialogActions>
+                    <Button
+                        autoFocus
+                        variant={"secondary"}
+                        size={"md"}
+                        className={"w-full"}
+                        onClick={() => WindowManager.CloseInstallProgress().catch(console.error)}
+                    >
+                        {t("common.close")}
+                    </Button>
+                </DialogActions>
+            )}
+        </ConfirmDialog>
+    );
+}
+
+function mapInstallError(msg: string): Phase {
+    const m = msg.trim().toLowerCase();
+    if (m === "") return { kind: "failed", message: "" };
+    if (m.includes("deadline exceeded") || m.includes("timeout") || m.includes("timed out")) {
+        return { kind: "timeout" };
+    }
+    if (m.includes("canceled") || m.includes("cancelled") || m.includes("cancel")) {
+        return { kind: "canceled" };
+    }
+    return { kind: "failed", message: msg };
+}
+
+type Variant = { title: string; description: string; message?: string };
+
+function classifyPhase(
+    phase: Phase,
+    version: string,
+    t: (key: string, options?: Record<string, unknown>) => string,
+): Variant {
+    const target = version
+        ? t("update.overlay.error.targetVersion", { version })
+        : t("update.overlay.error.targetFallback");
+    switch (phase.kind) {
+        case "timeout":
+            return {
+                title: t("update.overlay.error.timeoutTitle"),
+                description: t("update.overlay.error.timeoutDescription", { target }),
+            };
+        case "canceled":
+            return {
+                title: t("update.overlay.error.canceledTitle"),
+                description: t("update.overlay.error.canceledDescription", { target }),
+            };
+        case "failed":
+            return {
+                title: t("update.overlay.error.failTitle"),
+                description: t("update.overlay.error.failDescription", { target }),
+                message: phase.message || t("update.overlay.error.unknownMessage"),
+            };
+        default:
+            return { title: "", description: "" };
+    }
+}
diff --git a/client/ui/frontend/src/modules/auto-update/UpdateVersionCard.tsx b/client/ui/frontend/src/modules/auto-update/UpdateVersionCard.tsx
new file mode 100644
index 000000000..4861c492a
--- /dev/null
+++ b/client/ui/frontend/src/modules/auto-update/UpdateVersionCard.tsx
@@ -0,0 +1,99 @@
+import { type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { Browser } from "@wailsio/runtime";
+import { DownloadIcon, NotepadText } from "lucide-react";
+import { Update as UpdateSvc } from "@bindings/services";
+import { Button } from "@/components/buttons/Button";
+import { useClientVersion } from "@/contexts/ClientVersionContext";
+import { cn } from "@/lib/cn";
+
+const GITHUB_RELEASES = "https://github.com/netbirdio/netbird/releases/latest";
+
+function openUrl(url: string) {
+    Browser.OpenURL(url).catch(() => {
+        window.open(url, "_blank");
+    });
+}
+
+function openInstallerDownload() {
+    UpdateSvc.DownloadURL()
+        .then(openUrl)
+        .catch(() => openUrl(GITHUB_RELEASES));
+}
+
+export function UpdateVersionCard() {
+    const { t } = useTranslation();
+    const { updateVersion, enforced, triggerUpdate } = useClientVersion();
+
+    if (updateVersion) {
+        const titleKey = enforced
+            ? "update.card.versionAvailableInstall"
+            : "update.card.versionAvailableDownload";
+        return (
+            <Card className={"max-w-lg"}>
+                <div>
+                    <Title>{t(titleKey, { version: updateVersion })}</Title>
+                    <Link
+                        url={`https://github.com/netbirdio/netbird/releases/tag/v${updateVersion}`}
+                    >
+                        {t("update.card.whatsNew")}
+                    </Link>
+                </div>
+                {enforced ? (
+                    <Button variant={"primary"} size={"xs"} onClick={triggerUpdate}>
+                        {t("update.card.installNow")}
+                    </Button>
+                ) : (
+                    <Button variant={"primary"} size={"xs"} onClick={openInstallerDownload}>
+                        <DownloadIcon size={14} />
+                        {t("update.card.getInstaller")}
+                    </Button>
+                )}
+            </Card>
+        );
+    }
+
+    return (
+        <Card className={"max-w-lg"}>
+            <div>
+                <Title>{t("update.card.onLatestVersion")}</Title>
+                <p className={"text-sm text-nb-gray-300"}>{t("update.card.autoCheckInterval")}</p>
+            </div>
+            <Button variant={"primary"} size={"xs"} onClick={() => openUrl(GITHUB_RELEASES)}>
+                <NotepadText size={14} />
+                {t("update.card.changelog")}
+            </Button>
+        </Card>
+    );
+}
+
+function Card({ children, className }: Readonly<{ children: ReactNode; className?: string }>) {
+    return (
+        <div
+            className={cn(
+                "flex w-full items-center justify-between gap-4 rounded-md border border-nb-gray-800 bg-nb-gray-910 px-4 py-3",
+                className,
+            )}
+        >
+            {children}
+        </div>
+    );
+}
+
+function Title({ children }: Readonly<{ children: ReactNode }>) {
+    return <p className={"text-sm font-semibold"}>{children}</p>;
+}
+
+function Link({ url, children }: Readonly<{ url: string; children: ReactNode }>) {
+    return (
+        <button
+            type={"button"}
+            onClick={() => openUrl(url)}
+            className={
+                "text-sm font-medium text-netbird hover:underline hover:decoration-[0.5px] hover:underline-offset-4"
+            }
+        >
+            {children}
+        </button>
+    );
+}
diff --git a/client/ui/frontend/src/modules/error/ErrorDialog.tsx b/client/ui/frontend/src/modules/error/ErrorDialog.tsx
new file mode 100644
index 000000000..0be13b86e
--- /dev/null
+++ b/client/ui/frontend/src/modules/error/ErrorDialog.tsx
@@ -0,0 +1,95 @@
+import { useCallback, useEffect } from "react";
+import { useTranslation } from "react-i18next";
+import { useSearchParams } from "react-router-dom";
+import { AlertCircleIcon } from "lucide-react";
+import { Button } from "@/components/buttons/Button";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { SquareIcon } from "@/components/SquareIcon";
+import { WindowManager } from "@bindings/services";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+
+const WINDOW_WIDTH = 380;
+// A command needs the room to wrap at a sensible number of characters instead of
+// breaking every few words.
+const WINDOW_WIDTH_WITH_COMMAND = 460;
+
+export default function ErrorDialog() {
+    const { t } = useTranslation();
+    const [params] = useSearchParams();
+
+    const title = params.get("title") || t("window.title.error");
+    const message = params.get("message") || "";
+    // Set when the daemon refused an operation that needs elevated privileges:
+    // the command that performs it, offered for copying.
+    const command = params.get("command") || "";
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(
+        command ? WINDOW_WIDTH_WITH_COMMAND : WINDOW_WIDTH,
+    );
+
+    const close = useCallback(() => {
+        WindowManager.CloseError().catch(console.error);
+    }, []);
+
+    useEffect(() => {
+        const onKey = (e: KeyboardEvent) => {
+            if (e.key === "Escape") close();
+        };
+        globalThis.addEventListener("keydown", onKey);
+        return () => globalThis.removeEventListener("keydown", onKey);
+    }, [close]);
+
+    return (
+        <ConfirmDialog ref={contentRef} aria-labelledby={"nb-error-dialog-title"}>
+            <SquareIcon icon={AlertCircleIcon} variant={"danger"} />
+
+            <div className={"flex w-full flex-col items-center gap-1"}>
+                <DialogHeading id={"nb-error-dialog-title"} className={"text-balance"}>
+                    {title}
+                </DialogHeading>
+                {message && (
+                    <DialogDescription className={"text-balance"}>
+                        {/* select-text: the message often names a path, a flag or an
+                            address the user needs to act on. */}
+                        <span className={"select-text whitespace-pre-wrap break-words"}>
+                            {message}
+                        </span>
+                    </DialogDescription>
+                )}
+                {command && (
+                    <CopyToClipboard
+                        message={command}
+                        alwaysShowIcon
+                        wrap
+                        variant={"bright"}
+                        className={
+                            "mt-2 w-full items-start gap-2 rounded-md bg-nb-gray-930 px-3 py-2 text-start"
+                        }
+                        aria-label={t("common.copy")}
+                    >
+                        <code
+                            className={"select-text break-all font-mono text-xs text-nb-gray-200"}
+                        >
+                            {command}
+                        </code>
+                    </CopyToClipboard>
+                )}
+            </div>
+
+            <DialogActions>
+                <Button
+                    autoFocus
+                    variant={"primary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={close}
+                >
+                    {t("common.close")}
+                </Button>
+            </DialogActions>
+        </ConfirmDialog>
+    );
+}
diff --git a/client/ui/frontend/src/modules/login/LoginWaitingForBrowserDialog.tsx b/client/ui/frontend/src/modules/login/LoginWaitingForBrowserDialog.tsx
new file mode 100644
index 000000000..f03751c4d
--- /dev/null
+++ b/client/ui/frontend/src/modules/login/LoginWaitingForBrowserDialog.tsx
@@ -0,0 +1,82 @@
+import { useCallback } from "react";
+import { useTranslation } from "react-i18next";
+import { useSearchParams } from "react-router-dom";
+import { Events } from "@wailsio/runtime";
+import { Loader2 } from "lucide-react";
+import { Connection } from "@bindings/services";
+import { Button } from "@/components/buttons/Button";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { SquareIcon } from "@/components/SquareIcon";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+const EVENT_CANCEL = "browser-login:cancel";
+const WINDOW_WIDTH = 360;
+
+export default function LoginWaitingForBrowserDialog() {
+    const { t } = useTranslation();
+    const [params] = useSearchParams();
+    const uri = params.get("uri") ?? "";
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
+
+    const reportOpenFailure = useCallback(
+        (e: unknown) => {
+            void errorDialog({
+                Title: t("browserLogin.openFailedTitle"),
+                Message: formatErrorMessage(e),
+            });
+        },
+        [t],
+    );
+
+    const tryAgain = useCallback(() => {
+        if (!uri) return;
+        Connection.OpenURL(uri).catch(reportOpenFailure);
+    }, [uri, reportOpenFailure]);
+
+    const cancel = useCallback(() => {
+        Events.Emit(EVENT_CANCEL).catch((err: unknown) =>
+            console.error("emit browser-login cancel", err),
+        );
+    }, []);
+
+    return (
+        <ConfirmDialog ref={contentRef} aria-labelledby={"nb-browser-login-title"}>
+            <SquareIcon icon={Loader2} className={"[&_svg]:animate-spin"} />
+
+            <div className={"flex flex-col items-center gap-2"}>
+                <DialogHeading id={"nb-browser-login-title"} className={"text-balance"}>
+                    {t("browserLogin.title")}
+                </DialogHeading>
+                <DialogDescription>
+                    {t("browserLogin.notSeeing")}{" "}
+                    <button
+                        type={"button"}
+                        onClick={tryAgain}
+                        disabled={!uri}
+                        className={
+                            "wails-no-draggable text-netbird hover:underline disabled:cursor-not-allowed disabled:opacity-40"
+                        }
+                    >
+                        {t("browserLogin.tryAgain")}
+                    </button>
+                </DialogDescription>
+            </div>
+
+            <DialogActions>
+                <Button
+                    autoFocus
+                    variant={"secondary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={cancel}
+                >
+                    {t("common.cancel")}
+                </Button>
+            </DialogActions>
+        </ConfirmDialog>
+    );
+}
diff --git a/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx b/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
new file mode 100644
index 000000000..df48524c1
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
@@ -0,0 +1,418 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Events } from "@wailsio/runtime";
+import { Connection, WindowManager } from "@bindings/services";
+import { ToggleSwitch } from "@/components/switches/ToggleSwitch.tsx";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+import { useProfile } from "@/contexts/ProfileContext.tsx";
+import { cn } from "@/lib/cn.ts";
+import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
+import {
+    startConnection,
+    EVENT_BROWSER_LOGIN_CANCEL,
+    EVENT_TRIGGER_LOGIN,
+} from "@/lib/connection.ts";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
+import { TruncatedText } from "@/components/TruncatedText";
+import { shortenDns } from "@/lib/formatters";
+import { contentTop } from "@/components/empty-state/EmptyState";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { Check as CheckIcon, ChevronDownIcon, Copy as CopyIcon } from "lucide-react";
+import * as Popover from "@radix-ui/react-popover";
+import netbirdFullLogo from "@/assets/logos/netbird-full.svg";
+import netbirdFullLogoLight from "@/assets/logos/netbird-full-light.svg";
+
+enum ConnectionState {
+    Disconnected = "disconnected",
+    Connecting = "connecting",
+    Connected = "connected",
+    Disconnecting = "disconnecting",
+}
+
+const STATUS_KEY: Record<ConnectionState, string> = {
+    [ConnectionState.Disconnected]: "connect.status.disconnected",
+    [ConnectionState.Connecting]: "connect.status.connecting",
+    [ConnectionState.Connected]: "connect.status.connected",
+    [ConnectionState.Disconnecting]: "connect.status.disconnecting",
+};
+
+const NEEDS_LOGIN_STATES = new Set(["NeedsLogin", "SessionExpired", "LoginFailed"]);
+
+const FORCE_TOGGLE_DELAY_MS = 7000;
+
+const errorMessage = formatErrorMessage;
+
+export const MainConnectionStatusSwitch = () => {
+    const { t } = useTranslation();
+    const { status, refresh } = useStatus();
+    const { activeProfileId, username } = useProfile();
+
+    const daemonState = status?.status ?? "Idle";
+    const needsLogin = NEEDS_LOGIN_STATES.has(daemonState);
+    const unreachable = daemonState === "DaemonUnavailable";
+
+    type Action = "connect" | "logging-in" | "disconnect" | null;
+    const [action, setAction] = useState<Action>(null);
+
+    const loginGuard = useRef(false);
+    const driveLogin = useCallback(() => {
+        if (loginGuard.current) return;
+        loginGuard.current = true;
+        setAction("logging-in");
+        void startConnection(() => {
+            loginGuard.current = false;
+            setAction(null);
+            refresh().catch((err: unknown) => console.error("refresh after login failed", err));
+        });
+    }, [refresh]);
+
+    const connState: ConnectionState = useMemo(() => {
+        if (action === "disconnect" && daemonState === "Connected") {
+            return ConnectionState.Disconnecting;
+        }
+        if ((action === "connect" || action === "logging-in") && daemonState !== "Connected") {
+            return ConnectionState.Connecting;
+        }
+        switch (daemonState) {
+            case "Connected":
+                return ConnectionState.Connected;
+            case "Connecting":
+                return ConnectionState.Connecting;
+            case "Idle":
+            case "NeedsLogin":
+            case "LoginFailed":
+            case "SessionExpired":
+            case "DaemonUnavailable":
+                return ConnectionState.Disconnected;
+            default:
+                return ConnectionState.Disconnected;
+        }
+    }, [daemonState, action]);
+
+    const connect = async () => {
+        setAction("connect");
+        try {
+            await Connection.Up({
+                profileName: activeProfileId,
+                username,
+            });
+            await refresh();
+        } catch (e) {
+            setAction(null);
+            await refresh();
+            await errorDialog({
+                Title: t("connect.error.connectTitle"),
+                Message: errorMessage(e),
+            });
+        }
+    };
+
+    const disconnect = async () => {
+        setAction("disconnect");
+        try {
+            await Connection.Down();
+            await refresh();
+        } catch (e) {
+            setAction(null);
+            await refresh();
+            await errorDialog({
+                Title: t("connect.error.disconnectTitle"),
+                Message: errorMessage(e),
+            });
+        }
+    };
+
+    const sawConnectingRef = useRef(false);
+
+    useEffect(() => {
+        if (action === null) {
+            sawConnectingRef.current = false;
+            return;
+        }
+        if (daemonState === "Connecting") {
+            sawConnectingRef.current = true;
+        }
+        if (action === "connect") {
+            if (needsLogin) {
+                driveLogin();
+                return;
+            }
+            if (daemonState === "Connected" || unreachable) {
+                setAction(null);
+                return;
+            }
+            if (sawConnectingRef.current && daemonState === "Idle") {
+                setAction(null);
+            }
+            return;
+        }
+        if (action === "disconnect") {
+            if (daemonState === "Idle" || daemonState === "Disconnected" || unreachable) {
+                setAction(null);
+            }
+        }
+    }, [action, daemonState, needsLogin, unreachable, driveLogin]);
+
+    useEffect(() => {
+        const off = Events.On(EVENT_TRIGGER_LOGIN, () => {
+            driveLogin();
+        });
+        return () => off();
+    }, [driveLogin]);
+
+    const handleSwitch = (next: boolean) => {
+        if (unreachable) return;
+        if (isTransitioning) {
+            if (canForceCancel) void forceCancel();
+            return;
+        }
+        if (action !== null) return;
+        if (needsLogin) {
+            driveLogin();
+            return;
+        }
+        if (next && connState === ConnectionState.Disconnected) {
+            void connect();
+        } else if (!next && connState === ConnectionState.Connected) {
+            void disconnect();
+        }
+    };
+
+    const isTransitioning =
+        connState === ConnectionState.Connecting || connState === ConnectionState.Disconnecting;
+    const isOn =
+        connState === ConnectionState.Connected || connState === ConnectionState.Connecting;
+
+    const [canForceCancel, setCanForceCancel] = useState(false);
+    useEffect(() => {
+        if (!isTransitioning) {
+            setCanForceCancel(false);
+            return;
+        }
+        const id = setTimeout(() => setCanForceCancel(true), FORCE_TOGGLE_DELAY_MS);
+        return () => clearTimeout(id);
+    }, [isTransitioning]);
+
+    const forceCancel = async () => {
+        if (action === "logging-in") {
+            Events.Emit(EVENT_BROWSER_LOGIN_CANCEL).catch((err: unknown) =>
+                console.error("emit browser-login cancel failed", err),
+            );
+        }
+        WindowManager.CloseBrowserLogin().catch((err: unknown) =>
+            console.warn("close browser-login window failed", err),
+        );
+        setAction("disconnect");
+        try {
+            await Connection.Down();
+            await refresh();
+        } catch (e) {
+            setAction(null);
+            await refresh();
+            await errorDialog({
+                Title: t("connect.error.disconnectTitle"),
+                Message: errorMessage(e),
+            });
+        }
+    };
+    const show = connState === ConnectionState.Connected;
+    const fqdn = status?.local.fqdn || "";
+    const ip = status?.local.ip || "";
+    const ipv6 = status?.local.ipv6 || "";
+
+    return (
+        <div
+            className={cn("flex h-full w-full flex-col items-center gap-4", "relative")}
+            style={{ top: contentTop("11.7rem") }}
+        >
+            <img
+                src={netbirdFullLogoLight}
+                alt={"NetBird"}
+                className={"wails-no-draggable mb-4 h-7 w-auto select-none dark:hidden"}
+                draggable={false}
+            />
+            <img
+                src={netbirdFullLogo}
+                alt={"NetBird"}
+                className={"wails-no-draggable mb-4 hidden h-7 w-auto select-none dark:block"}
+                draggable={false}
+            />
+
+            <ToggleSwitch
+                size={"large"}
+                checked={isOn}
+                onCheckedChange={handleSwitch}
+                disabled={(isTransitioning && !canForceCancel) || unreachable}
+                aria-label={t("connect.toggle.label")}
+                aria-describedby={"nb-connection-status"}
+                aria-busy={isTransitioning}
+                className={cn(unreachable && "opacity-80", isTransitioning && "animate-pulse")}
+            />
+
+            <div className={"flex flex-col items-center"}>
+                <p
+                    id={"nb-connection-status"}
+                    role={"status"}
+                    aria-live={"polite"}
+                    className={
+                        "wails-no-draggable mb-1 select-none text-sm font-medium tracking-wide text-nb-gray-200 transition-colors duration-300"
+                    }
+                >
+                    {t(STATUS_KEY[connState])}
+                </p>
+                <CopyToClipboard
+                    message={fqdn}
+                    variant={"bright"}
+                    iconClassName={"-top-px"}
+                    tabIndex={show && fqdn ? 0 : -1}
+                    className={cn(
+                        "mt-1 max-h-[1em] min-h-[1em] max-w-full transition-opacity duration-300",
+                        "relative start-[0.55rem]",
+                        show && fqdn ? "opacity-100" : "pointer-events-none opacity-0",
+                    )}
+                >
+                    <TruncatedText
+                        text={shortenDns(fqdn) || " "}
+                        dir={"ltr"}
+                        className={
+                            "block h-[18px] max-w-[310px] truncate font-mono text-[0.8rem] leading-tight text-nb-gray-300"
+                        }
+                    />
+                </CopyToClipboard>
+                <LocalIpLine ip={ip} ipv6={ipv6} show={show} />
+            </div>
+        </div>
+    );
+};
+
+const LocalIpLine = ({ ip, ipv6, show }: { ip: string; ipv6: string; show: boolean }) => {
+    const { t } = useTranslation();
+    const [open, setOpen] = useState(false);
+    const isFocusVisible = useFocusVisible();
+    const hasV6 = !!ipv6;
+
+    if (!hasV6) {
+        return (
+            <CopyToClipboard
+                message={ip}
+                variant={"bright"}
+                tabIndex={show && ip ? 0 : -1}
+                className={cn(
+                    "mt-1 max-h-[1em] min-h-[1em] transition-opacity duration-300",
+                    "relative start-[0.55rem]",
+                    show && ip ? "opacity-100" : "pointer-events-none opacity-0",
+                )}
+            >
+                <span className={"font-mono text-[0.8rem] leading-tight text-nb-gray-300"}>
+                    {ip || " "}
+                </span>
+            </CopyToClipboard>
+        );
+    }
+
+    return (
+        <div
+            className={cn(
+                "min-h-[1em] max-w-full transition-opacity duration-300",
+                "wails-no-draggable relative",
+                show && ip ? "opacity-100" : "pointer-events-none opacity-0",
+            )}
+        >
+            <Popover.Root open={open} onOpenChange={setOpen}>
+                <Popover.Trigger asChild>
+                    <button
+                        type={"button"}
+                        tabIndex={show && ip ? 0 : -1}
+                        aria-label={t("connect.localIp.label")}
+                        aria-haspopup={"dialog"}
+                        aria-expanded={open}
+                        className={cn(
+                            "group relative inline-flex cursor-default items-center rounded-sm outline-none",
+                            isFocusVisible &&
+                                "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                            "transition-colors",
+                        )}
+                    >
+                        <span
+                            className={cn(
+                                "font-mono text-[0.8rem] leading-tight text-nb-gray-300 transition-colors",
+                                "group-hover:text-nb-gray-200",
+                                "group-data-[state=open]:text-nb-gray-200",
+                            )}
+                        >
+                            {ip || " "}
+                        </span>
+                        <ChevronDownIcon
+                            size={14}
+                            aria-hidden={"true"}
+                            className={cn(
+                                "absolute -end-5 top-1/2 -translate-y-1/2",
+                                "shrink-0 text-nb-gray-300 transition-colors",
+                                "group-hover:text-nb-gray-200",
+                                "group-data-[state=open]:text-nb-gray-200",
+                            )}
+                        />
+                    </button>
+                </Popover.Trigger>
+                <Popover.Portal>
+                    <Popover.Content
+                        side={"bottom"}
+                        align={"center"}
+                        sideOffset={6}
+                        onOpenAutoFocus={(e) => e.preventDefault()}
+                        className={cn(
+                            "z-50 min-w-64 max-w-[280px] overflow-hidden",
+                            "rounded-lg border border-nb-gray-900 bg-nb-gray-935",
+                            "p-1 text-nb-gray-200 shadow-lg outline-none",
+                            "flex flex-col",
+                        )}
+                    >
+                        <IpRow value={ip} />
+                        <div className={"-mx-1 my-1 h-px bg-nb-gray-910"} />
+                        <IpRow value={ipv6} />
+                    </Popover.Content>
+                </Popover.Portal>
+            </Popover.Root>
+        </div>
+    );
+};
+
+const IpRow = ({ value }: { value: string }) => {
+    const { t } = useTranslation();
+    const [copied, setCopied] = useState(false);
+    const isFocusVisible = useFocusVisible();
+    const handleClick = async () => {
+        if (!value) return;
+        try {
+            await navigator.clipboard.writeText(value);
+            setCopied(true);
+            setTimeout(() => setCopied(false), 500);
+        } catch (e) {
+            console.warn("copy IP to clipboard failed", e);
+        }
+    };
+    return (
+        <button
+            type={"button"}
+            onClick={handleClick}
+            tabIndex={0}
+            aria-label={`${t("common.copy")} ${value}`}
+            className={cn(
+                "group/iprow relative flex items-center justify-between gap-3",
+                "rounded-md px-2 py-1.5 text-start",
+                "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50",
+                "cursor-default outline-none transition-colors",
+                isFocusVisible &&
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
+            )}
+        >
+            <span className={"min-w-0 truncate font-mono text-[0.75rem]"}>{value}</span>
+            <span
+                aria-hidden={"true"}
+                className={"inline-flex shrink-0 items-center text-nb-gray-200"}
+            >
+                {copied ? <CheckIcon size={11} /> : <CopyIcon size={11} />}
+            </span>
+        </button>
+    );
+};
diff --git a/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx b/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
new file mode 100644
index 000000000..3e6281352
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
@@ -0,0 +1,262 @@
+import { forwardRef, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import * as Popover from "@radix-ui/react-popover";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { Command } from "cmdk";
+import { Check, ChevronsUpDown, type LucideProps, SquareArrowUpRight } from "lucide-react";
+import { cn } from "@/lib/cn";
+import { TruncatedText } from "@/components/TruncatedText";
+import { useNetworks } from "@/contexts/NetworksContext";
+import { useStatus } from "@/contexts/StatusContext";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { useDirection } from "@/hooks/useDirection";
+
+const NONE_VALUE = "__none__";
+
+export const MainExitNodeSwitcher = () => {
+    const dir = useDirection();
+    const { t } = useTranslation();
+    const { status } = useStatus();
+    const { exitNodes, toggleExitNode } = useNetworks();
+    const active = exitNodes.find((n) => n.selected) ?? null;
+    const isConnected = status?.status === "Connected";
+    const hasAny = exitNodes.length > 0;
+    const disabled = !isConnected || !hasAny;
+
+    const [open, setOpen] = useState(false);
+    const listRef = useRef<HTMLDivElement>(null);
+
+    const handleTriggerKeyDown = (e: React.KeyboardEvent<HTMLButtonElement>) => {
+        if (open || disabled) return;
+        if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+            e.preventDefault();
+            setOpen(true);
+        }
+    };
+
+    const handleSelect = (next: string) => {
+        setOpen(false);
+        if (next === NONE_VALUE) {
+            if (active)
+                toggleExitNode(active.id, true).catch((err: unknown) =>
+                    console.error("toggle exit node failed", err),
+                );
+            return;
+        }
+        if (active?.id === next) return;
+        toggleExitNode(next, false).catch((err: unknown) =>
+            console.error("toggle exit node failed", err),
+        );
+    };
+
+    const title = active ? active.id : t("exitNodes.card.title");
+    const activeDescription = active
+        ? t("exitNodes.card.statusActive")
+        : t("exitNodes.card.statusInactive");
+    const description = hasAny ? activeDescription : t("exitNodes.empty.title");
+
+    return (
+        <Popover.Root open={open} onOpenChange={setOpen}>
+            <Popover.Trigger asChild className={"wails-no-draggable"}>
+                <ExitNodeTriggerCard
+                    title={title}
+                    description={description}
+                    disabled={disabled}
+                    active={!!active}
+                    aria-label={t("exitNodes.dropdown.trigger")}
+                    aria-haspopup={"listbox"}
+                    aria-expanded={open}
+                    onKeyDown={handleTriggerKeyDown}
+                />
+            </Popover.Trigger>
+            <Popover.Portal>
+                <Popover.Content
+                    align={"center"}
+                    side={"top"}
+                    sideOffset={8}
+                    collisionPadding={12}
+                    onOpenAutoFocus={(e) => {
+                        e.preventDefault();
+                        listRef.current?.focus();
+                    }}
+                    style={{ width: "var(--radix-popover-trigger-width)" }}
+                    className={cn(
+                        "wails-no-draggable z-50 select-none overflow-hidden rounded-lg border border-nb-gray-900 bg-nb-gray-935 p-1 text-nb-gray-200 shadow-lg",
+                        "data-[state=open]:animate-in data-[state=closed]:animate-out",
+                        "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+                        "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
+                        "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2",
+                        "data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+                    )}
+                >
+                    <Command
+                        loop
+                        shouldFilter={false}
+                        onKeyDown={(e) => e.stopPropagation()}
+                        className={"outline-none focus:outline-none focus-visible:outline-none"}
+                    >
+                        <Command.List
+                            ref={listRef}
+                            aria-label={t("exitNodes.dropdown.trigger")}
+                            className={"outline-none focus:outline-none focus-visible:outline-none"}
+                        >
+                            <NoneRow isActive={!active} onSelect={() => handleSelect(NONE_VALUE)} />
+                            {hasAny && <div className={"-mx-1 my-1 h-px bg-nb-gray-910"} />}
+                            {hasAny && (
+                                <ScrollArea.Root
+                                    dir={dir}
+                                    type={"auto"}
+                                    className={"-mx-1 overflow-hidden"}
+                                >
+                                    <ScrollArea.Viewport className={"max-h-72 px-1"}>
+                                        {exitNodes.map((n) => (
+                                            <ExitNodeRow
+                                                key={n.id}
+                                                id={n.id}
+                                                label={n.id}
+                                                isActive={active?.id === n.id}
+                                                onSelect={() => handleSelect(n.id)}
+                                            />
+                                        ))}
+                                    </ScrollArea.Viewport>
+                                    <ScrollArea.Scrollbar
+                                        orientation={"vertical"}
+                                        className={cn(
+                                            "flex touch-none select-none transition-colors",
+                                            "w-1.5 bg-transparent",
+                                        )}
+                                    >
+                                        <ScrollArea.Thumb
+                                            className={
+                                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                                            }
+                                        />
+                                    </ScrollArea.Scrollbar>
+                                </ScrollArea.Root>
+                            )}
+                        </Command.List>
+                    </Command>
+                </Popover.Content>
+            </Popover.Portal>
+        </Popover.Root>
+    );
+};
+
+type TriggerProps = React.ButtonHTMLAttributes<HTMLButtonElement> & {
+    title: string;
+    description: string;
+    active?: boolean;
+};
+
+const ExitNodeTriggerCard = forwardRef<HTMLButtonElement, TriggerProps>(
+    function ExitNodeTriggerCard(
+        { title, description, disabled, active = false, className, ...props },
+        ref,
+    ) {
+        const isFocusVisible = useFocusVisible();
+        return (
+            <button
+                ref={ref}
+                type={"button"}
+                tabIndex={0}
+                disabled={disabled}
+                className={cn(
+                    "flex w-full items-center gap-3 rounded-xl p-2.5 pe-5 text-start outline-none",
+                    "border border-nb-gray-800 bg-nb-gray-940 dark:border-nb-gray-920",
+                    "transition-colors duration-150",
+                    "wails-no-draggable",
+                    isFocusVisible &&
+                        "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    disabled
+                        ? "cursor-not-allowed opacity-60"
+                        : "cursor-default hover:border-nb-gray-700 hover:bg-nb-gray-935 data-[state=open]:border-nb-gray-700 data-[state=open]:bg-nb-gray-935 dark:hover:border-nb-gray-900 dark:data-[state=open]:border-nb-gray-900",
+                    className,
+                )}
+                {...props}
+            >
+                <div
+                    aria-hidden={"true"}
+                    className={cn(
+                        "flex h-9 w-9 shrink-0 items-center justify-center rounded-md",
+                        active
+                            ? "bg-green-500/25 text-green-400"
+                            : "bg-nb-gray-900 text-nb-gray-300",
+                    )}
+                >
+                    <ExitNodeIcon size={14} />
+                </div>
+                <div className={"min-w-0 flex-1"}>
+                    <span className={"block truncate text-sm font-medium text-nb-gray-100"}>
+                        {title}
+                    </span>
+                    <TruncatedText
+                        text={description}
+                        className={
+                            "block max-w-full truncate text-[0.85rem] font-medium text-nb-gray-400"
+                        }
+                    />
+                </div>
+                <ChevronsUpDown
+                    size={16}
+                    aria-hidden={"true"}
+                    className={"shrink-0 text-nb-gray-400"}
+                />
+            </button>
+        );
+    },
+);
+
+type NoneRowProps = {
+    isActive: boolean;
+    onSelect: () => void;
+};
+
+const NoneRow = ({ isActive, onSelect }: NoneRowProps) => {
+    const { t } = useTranslation();
+    return (
+        <Command.Item
+            value={NONE_VALUE}
+            onSelect={onSelect}
+            className={cn(
+                "flex items-center gap-2 px-2 py-2 pe-3",
+                "cursor-default rounded-md text-sm outline-none",
+                "data-[selected=true]:bg-nb-gray-900",
+            )}
+        >
+            <span className={"min-w-0 flex-1 truncate"}>{t("exitNodes.dropdown.noneTitle")}</span>
+            {isActive && (
+                <Check size={16} aria-hidden={"true"} className={"shrink-0 text-netbird"} />
+            )}
+        </Command.Item>
+    );
+};
+
+type ExitNodeRowProps = {
+    id: string;
+    label: string;
+    isActive: boolean;
+    onSelect: () => void;
+};
+
+const ExitNodeRow = ({ id, label, isActive, onSelect }: ExitNodeRowProps) => (
+    <Command.Item
+        value={id}
+        onSelect={onSelect}
+        className={cn(
+            "flex items-center gap-2 px-2 py-2 pe-3",
+            "cursor-default rounded-md text-sm outline-none",
+            "data-[selected=true]:bg-nb-gray-900",
+        )}
+    >
+        <span className={"min-w-0 flex-1 truncate"}>{label}</span>
+        {isActive && <Check size={16} aria-hidden={"true"} className={"shrink-0 text-netbird"} />}
+    </Command.Item>
+);
+
+const ExitNodeIcon = ({ size, ...props }: LucideProps) => (
+    <SquareArrowUpRight
+        {...props}
+        size={typeof size === "number" ? size - 2 : size}
+        className={cn("rotate-45", props.className)}
+    />
+);
diff --git a/client/ui/frontend/src/modules/main/MainHeader.tsx b/client/ui/frontend/src/modules/main/MainHeader.tsx
new file mode 100644
index 000000000..6aa5b7993
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/MainHeader.tsx
@@ -0,0 +1,204 @@
+import { useCallback, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+    ArrowUpCircleIcon,
+    Check,
+    MoreVertical,
+    PanelsRightBottom,
+    RectangleVertical,
+    Settings,
+    type LucideIcon,
+} from "lucide-react";
+import { WindowManager } from "@bindings/services";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuSeparator,
+    DropdownMenuShortcut,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
+import { IconButton } from "@/components/buttons/IconButton";
+import { ProfileDropdown } from "@/modules/profiles/ProfileDropdown";
+import { useClientVersion } from "@/contexts/ClientVersionContext";
+import { cn } from "@/lib/cn";
+import { formatShortcut, useKeyboardShortcut } from "@/hooks/useKeyboardShortcut";
+import { useViewMode, type ViewMode } from "@/contexts/ViewModeContext";
+import { useRestrictions } from "@/contexts/RestrictionsContext";
+import { isMacOS, isWindows } from "@/lib/platform.ts";
+import { useDirection } from "@/hooks/useDirection";
+
+const SETTINGS_SHORTCUT = { key: ",", cmd: true } as const;
+
+export const MainHeader = () => {
+    const { t } = useTranslation();
+    const [menuOpen, setMenuOpen] = useState(false);
+    const { viewMode, setViewMode } = useViewMode();
+    const { updateAvailable } = useClientVersion();
+    const { mdm, features } = useRestrictions();
+    const dir = useDirection();
+    const pinSettingsRight = isMacOS();
+
+    const openSettings = useCallback(() => {
+        setMenuOpen(false);
+        WindowManager.OpenSettings("").catch((err: unknown) =>
+            console.error("open settings window failed", err),
+        );
+    }, []);
+
+    useKeyboardShortcut(SETTINGS_SHORTCUT, openSettings);
+
+    const openAbout = () => {
+        setMenuOpen(false);
+        WindowManager.OpenSettings("about").catch((err: unknown) =>
+            console.error("open settings (about) window failed", err),
+        );
+    };
+
+    const openManageProfiles = () => {
+        WindowManager.OpenSettings("profiles").catch((err: unknown) =>
+            console.error("open settings (profiles) window failed", err),
+        );
+    };
+
+    const selectMode = (mode: ViewMode) => {
+        setMenuOpen(false);
+        setViewMode(mode);
+    };
+
+    const profileSlot = features.disableProfiles ? null : (
+        <ProfileDropdown onManageProfiles={openManageProfiles} />
+    );
+
+    const settingsSlot = (
+        <div className={"relative"}>
+            <DropdownMenu modal={false} open={menuOpen} onOpenChange={setMenuOpen}>
+                <DropdownMenuTrigger asChild className={"wails-no-draggable"}>
+                    <IconButton
+                        icon={MoreVertical}
+                        iconClassName={"text-nb-gray-200 wails-no-draggable"}
+                        className={
+                            "select-none hover:bg-nb-gray-800 data-[state=open]:bg-nb-gray-800 dark:hover:bg-nb-gray-900 dark:data-[state=open]:bg-nb-gray-900"
+                        }
+                        aria-label={t("header.menu.open")}
+                        aria-haspopup={"menu"}
+                        aria-expanded={menuOpen}
+                    />
+                </DropdownMenuTrigger>
+                <DropdownMenuContent
+                    align={pinSettingsRight && dir === "rtl" ? "start" : "end"}
+                    sideOffset={8}
+                    className={
+                        "min-w-52 select-none data-[state=closed]:!animate-none data-[state=closed]:!duration-0"
+                    }
+                >
+                    {updateAvailable && (
+                        <>
+                            <DropdownMenuItem onClick={openAbout}>
+                                <div className={"flex items-center gap-2"}>
+                                    <ArrowUpCircleIcon
+                                        size={14}
+                                        className={"text-netbird"}
+                                        aria-hidden={"true"}
+                                    />
+                                    <span className={"text-netbird"}>
+                                        {t("header.menu.updateAvailable")}
+                                    </span>
+                                </div>
+                            </DropdownMenuItem>
+                            <DropdownMenuSeparator />
+                        </>
+                    )}
+                    <DropdownMenuItem onClick={openSettings}>
+                        <div className={"flex w-full items-center gap-2"}>
+                            <Settings size={14} aria-hidden={"true"} />
+                            <span className={"flex-1"}>{t("header.menu.settings")}</span>
+                            <DropdownMenuShortcut>
+                                {formatShortcut(SETTINGS_SHORTCUT)}
+                            </DropdownMenuShortcut>
+                        </div>
+                    </DropdownMenuItem>
+                    {!mdm.disableAdvancedView && (
+                        <>
+                            <DropdownMenuSeparator />
+                            <ViewModeItem
+                                icon={RectangleVertical}
+                                label={t("header.menu.defaultView")}
+                                selected={viewMode === "default"}
+                                onSelect={() => selectMode("default")}
+                            />
+                            <ViewModeItem
+                                icon={PanelsRightBottom}
+                                label={t("header.menu.advancedView")}
+                                selected={viewMode === "advanced"}
+                                onSelect={() => selectMode("advanced")}
+                            />
+                        </>
+                    )}
+                </DropdownMenuContent>
+            </DropdownMenu>
+            {updateAvailable && (
+                <span
+                    aria-hidden={"true"}
+                    className={
+                        "pointer-events-none absolute end-1.5 top-1.5 flex h-2.5 w-2.5 items-center justify-center"
+                    }
+                >
+                    <span
+                        className={
+                            "absolute inset-0 animate-ping rounded-full bg-netbird opacity-60"
+                        }
+                    />
+                    <span className={"relative h-1.5 w-1.5 rounded-full bg-netbird"} />
+                </span>
+            )}
+        </div>
+    );
+
+    return (
+        <header
+            className={cn(
+                "wails-draggable relative z-10 shrink-0 cursor-default",
+                "top-3 flex h-12 items-center",
+            )}
+        >
+            {/* Windows narrower width compensates for the OS frame Wails counts differently than macOS.
+                See https://github.com/wailsapp/wails/issues/3260 */}
+            <div
+                className={cn(
+                    "grid shrink-0 grid-cols-3 items-center",
+                    isWindows() ? "w-[364px]" : "w-[380px]",
+                )}
+            >
+                <div />
+                <div className={"ml-4 flex justify-center rtl:ml-1"}>{profileSlot}</div>
+                <div />
+            </div>
+            <div
+                className={cn(
+                    "absolute top-1/2 -translate-y-1/2",
+                    pinSettingsRight ? "right-[1.3rem]" : "end-[1.3rem]",
+                )}
+            >
+                {settingsSlot}
+            </div>
+        </header>
+    );
+};
+
+type ViewModeItemProps = {
+    icon: LucideIcon;
+    label: string;
+    selected: boolean;
+    onSelect: () => void;
+};
+
+const ViewModeItem = ({ icon: Icon, label, selected, onSelect }: ViewModeItemProps) => (
+    <DropdownMenuItem onClick={onSelect} role={"menuitemradio"} aria-checked={selected}>
+        <div className={"flex w-full items-center gap-2"}>
+            <Icon size={14} aria-hidden={"true"} />
+            <span className={"flex-1"}>{label}</span>
+            {selected && <Check size={14} className={"text-netbird"} aria-hidden={"true"} />}
+        </div>
+    </DropdownMenuItem>
+);
diff --git a/client/ui/frontend/src/modules/main/MainPage.tsx b/client/ui/frontend/src/modules/main/MainPage.tsx
new file mode 100644
index 000000000..1d8f8d1f6
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/MainPage.tsx
@@ -0,0 +1,114 @@
+import { MainConnectionStatusSwitch } from "@/modules/main/MainConnectionStatusSwitch.tsx";
+import { MainExitNodeSwitcher } from "@/modules/main/MainExitNodeSwitcher.tsx";
+import { MainHeader } from "@/modules/main/MainHeader.tsx";
+import { AppRightPanel } from "@/layouts/AppRightPanel.tsx";
+import { Navigation } from "@/modules/main/advanced/Navigation.tsx";
+import { cn } from "@/lib/cn";
+import { NavSectionProvider, useNavSection } from "@/contexts/NavSectionContext";
+import { ViewModeProvider, useViewMode } from "@/contexts/ViewModeContext";
+import { useEffect } from "react";
+import { NotConnectedState } from "@/components/empty-state/NotConnectedState";
+import { useStatus } from "@/contexts/StatusContext";
+import { Peers } from "@/modules/main/advanced/peers/Peers";
+import { Networks } from "@/modules/main/advanced/networks/Networks";
+import { NetworksProvider } from "@/contexts/NetworksContext";
+import { PeerDetailProvider, usePeerDetail } from "@/contexts/PeerDetailContext";
+import { useRestrictions } from "@/contexts/RestrictionsContext";
+import { PeerDetailPanel } from "@/modules/main/advanced/peers/PeerDetailPanel";
+import { isWindows } from "@/lib/platform.ts";
+
+export const MainPage = () => {
+    return (
+        <ViewModeProvider>
+            <MainHeader />
+            <NetworksProvider>
+                <PeerDetailProvider>
+                    <MainBody />
+                </PeerDetailProvider>
+            </NetworksProvider>
+        </ViewModeProvider>
+    );
+};
+
+const MainBody = () => {
+    const { viewMode, setViewMode } = useViewMode();
+    const { mdm, features } = useRestrictions();
+
+    // Force flip the view if MDM disabled advanced
+    useEffect(() => {
+        if (mdm.disableAdvancedView && viewMode === "advanced") {
+            setViewMode("default");
+        }
+    }, [mdm.disableAdvancedView, viewMode, setViewMode]);
+
+    const isAdvanced = viewMode === "advanced";
+
+    return (
+        <main className={"wails-draggable flex min-h-0 flex-1"}>
+            {/* Windows narrower width compensates for the OS frame Wails counts differently than macOS.
+                See https://github.com/wailsapp/wails/issues/3260 */}
+            <div
+                className={cn(
+                    "relative flex shrink-0 flex-col items-center",
+                    isWindows() ? "w-[364px]" : "w-[380px]",
+                )}
+            >
+                <MainConnectionStatusSwitch />
+                {!features.disableNetworks && (
+                    <div className={"wails-no-draggable absolute inset-x-5 bottom-5"}>
+                        <MainExitNodeSwitcher />
+                    </div>
+                )}
+            </div>
+            {isAdvanced && (
+                <NavSectionProvider>
+                    <AdvancedAppRightPanel />
+                </NavSectionProvider>
+            )}
+        </main>
+    );
+};
+
+const AdvancedAppRightPanel = () => {
+    const { section } = useNavSection();
+    const { selected } = usePeerDetail();
+    const { status } = useStatus();
+    const isConnected = status?.status === "Connected";
+
+    return (
+        <AppRightPanel
+            overlay={<PeerDetailPanel />}
+            overlayOpen={selected !== null}
+            className={"m-5 ms-0"}
+        >
+            <div
+                ref={(el) => {
+                    if (!el) return;
+                    if (isConnected) el.removeAttribute("inert");
+                    else el.setAttribute("inert", "");
+                }}
+                className={cn(
+                    "flex min-h-0 min-w-0 flex-1 flex-col",
+                    !isConnected && "pointer-events-none select-none",
+                )}
+                aria-hidden={!isConnected}
+            >
+                <Navigation />
+                <div
+                    role={"tabpanel"}
+                    id={`nb-tabpanel-${section}`}
+                    aria-labelledby={`nb-tab-${section}`}
+                    className={"flex min-h-0 flex-1 flex-col"}
+                >
+                    {section === "peers" && <Peers />}
+                    {section === "networks" && <Networks />}
+                </div>
+            </div>
+            {!isConnected && (
+                <div className={"pointer-events-auto absolute inset-0 z-20 flex bg-nb-gray-940"}>
+                    <NotConnectedState />
+                </div>
+            )}
+        </AppRightPanel>
+    );
+};
diff --git a/client/ui/frontend/src/modules/main/advanced/Navigation.tsx b/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
new file mode 100644
index 000000000..1f0f527d1
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
@@ -0,0 +1,139 @@
+import { type ComponentType, type KeyboardEvent, useEffect, useRef } from "react";
+import { useTranslation } from "react-i18next";
+import { Layers3Icon, type LucideProps, MonitorSmartphoneIcon } from "lucide-react";
+import { cn } from "@/lib/cn";
+import { useNavSection, type NavSection } from "@/contexts/NavSectionContext";
+import { useStatus } from "@/contexts/StatusContext";
+import { useRestrictions } from "@/contexts/RestrictionsContext";
+import { useDirection } from "@/hooks/useDirection";
+
+type TabEntry = {
+    value: NavSection;
+    label: string;
+    icon: ComponentType<LucideProps>;
+};
+
+export const Navigation = () => {
+    const { t } = useTranslation();
+    const { section, setSection } = useNavSection();
+    const { status } = useStatus();
+    const { features } = useRestrictions();
+    const isConnected = status?.status === "Connected";
+
+    // Reset back to peers tab if mdm or feature flag flipped it
+    useEffect(() => {
+        if (features.disableNetworks && section === "networks") {
+            setSection("peers");
+        }
+    }, [features.disableNetworks, section, setSection]);
+
+    const tabs: TabEntry[] = [
+        {
+            value: "peers",
+            label: t("nav.peers.title"),
+            icon: MonitorSmartphoneIcon,
+        },
+    ];
+    if (!features.disableNetworks) {
+        tabs.push({
+            value: "networks",
+            label: t("nav.resources.title"),
+            icon: Layers3Icon,
+        });
+    }
+
+    const tabRefs = useRef<Record<string, HTMLButtonElement | null>>({});
+
+    const focusTab = (value: NavSection) => {
+        setSection(value);
+        requestAnimationFrame(() => tabRefs.current[value]?.focus());
+    };
+
+    const dir = useDirection();
+    const forwardKey = dir === "rtl" ? "ArrowLeft" : "ArrowRight";
+    const backwardKey = dir === "rtl" ? "ArrowRight" : "ArrowLeft";
+
+    const handleKeyDown = (e: KeyboardEvent<HTMLButtonElement>) => {
+        const enabled = tabs.filter((t) => isConnected || t.value === section);
+        if (enabled.length < 2) return;
+        const currentIndex = enabled.findIndex((t) => t.value === section);
+        if (currentIndex === -1) return;
+        let nextIndex: number;
+        switch (e.key) {
+            case forwardKey:
+                nextIndex = (currentIndex + 1) % enabled.length;
+                break;
+            case backwardKey:
+                nextIndex = (currentIndex - 1 + enabled.length) % enabled.length;
+                break;
+            case "Home":
+                nextIndex = 0;
+                break;
+            case "End":
+                nextIndex = enabled.length - 1;
+                break;
+            default:
+                return;
+        }
+        e.preventDefault();
+        focusTab(enabled[nextIndex].value);
+    };
+
+    return (
+        <div
+            role={"tablist"}
+            aria-orientation={"horizontal"}
+            aria-label={t("nav.peers.title")}
+            className={"wails-no-draggable flex shrink-0 items-stretch"}
+        >
+            {tabs.map((tab, index) => {
+                const isActive = tab.value === section;
+                const isDisabled = !isConnected && !isActive;
+                const isFirst = index === 0;
+                const isLast = index === tabs.length - 1;
+                const Icon = tab.icon;
+                return (
+                    <button
+                        key={tab.value}
+                        ref={(el) => {
+                            tabRefs.current[tab.value] = el;
+                        }}
+                        type={"button"}
+                        role={"tab"}
+                        aria-selected={isActive}
+                        aria-controls={`nb-tabpanel-${tab.value}`}
+                        id={`nb-tab-${tab.value}`}
+                        tabIndex={isActive ? 0 : -1}
+                        onClick={() => setSection(tab.value)}
+                        onKeyDown={handleKeyDown}
+                        disabled={isDisabled}
+                        className={cn(
+                            "group relative flex flex-1 items-center justify-center",
+                            "gap-2.5 px-5 py-3.5",
+                            "outline-none transition-all",
+                            isFirst && "rounded-ss-xl",
+                            isLast && "rounded-se-xl",
+                            "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
+                            isActive ? "text-netbird" : "text-nb-gray-400 hover:text-nb-gray-300",
+                            isDisabled ? "cursor-not-allowed opacity-50" : "cursor-default",
+                        )}
+                    >
+                        <Icon size={14} aria-hidden={"true"} />
+                        <span className={"text-sm font-normal"}>{tab.label}</span>
+                        <span
+                            aria-hidden={"true"}
+                            className={cn(
+                                "absolute inset-x-0 bottom-0 h-px transition-all",
+                                isActive
+                                    ? "bg-netbird"
+                                    : "bg-nb-gray-910 group-hover:bg-nb-gray-700",
+                            )}
+                        />
+                    </button>
+                );
+            })}
+        </div>
+    );
+};
+
+export type { NavSection } from "@/contexts/NavSectionContext";
diff --git a/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx b/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
new file mode 100644
index 000000000..3686275f0
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
@@ -0,0 +1,84 @@
+import { useState } from "react";
+import { CheckIcon, ChevronDown, ListFilter } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { cn } from "@/lib/cn";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
+
+export type NetworkFilter = "all" | "active" | "overlapping";
+
+type Props = {
+    value: NetworkFilter;
+    onChange: (value: NetworkFilter) => void;
+    counts: Record<NetworkFilter, number>;
+    disabled?: boolean;
+};
+
+export const NetworkFilters = ({ value, onChange, counts, disabled }: Props) => {
+    const { t } = useTranslation();
+    const [open, setOpen] = useState(false);
+    const filters: { value: NetworkFilter; label: string }[] = [
+        { value: "all", label: t("networks.filter.all") },
+        { value: "active", label: t("networks.filter.active") },
+        { value: "overlapping", label: t("networks.filter.overlapping") },
+    ];
+    const active = filters.find((f) => f.value === value) ?? filters[0];
+
+    const handleSelect = (v: NetworkFilter) => {
+        onChange(v);
+        setOpen(false);
+    };
+
+    return (
+        <DropdownMenu open={open} onOpenChange={setOpen}>
+            <DropdownMenuTrigger
+                disabled={disabled}
+                tabIndex={0}
+                aria-label={t("common.filter")}
+                className={cn(
+                    "inline-flex h-9 items-center gap-1.5 rounded-md px-2",
+                    "text-sm text-nb-gray-200",
+                    "outline-none transition-colors duration-150 hover:bg-nb-gray-900 data-[state=open]:bg-nb-gray-900",
+                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    "disabled:pointer-events-none disabled:opacity-50",
+                    "wails-no-draggable cursor-default",
+                )}
+            >
+                <ListFilter size={14} aria-hidden={"true"} className={"shrink-0"} />
+                <span>
+                    {active.label} <span className={"tabular-nums"}>({counts[active.value]})</span>
+                </span>
+                <ChevronDown size={14} aria-hidden={"true"} className={"ms-0.5 shrink-0"} />
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align={"end"} className={"min-w-[10rem]"}>
+                {filters.map((f) => {
+                    const checked = f.value === value;
+                    return (
+                        <DropdownMenuItem
+                            key={f.value}
+                            onClick={() => handleSelect(f.value)}
+                            role={"menuitemradio"}
+                            aria-checked={checked}
+                            className={"gap-2"}
+                        >
+                            <span className={"flex-1 truncate"}>
+                                {f.label}{" "}
+                                <span className={"tabular-nums"}>({counts[f.value]})</span>
+                            </span>
+                            <span
+                                aria-hidden={"true"}
+                                className={"flex w-4 shrink-0 items-center justify-center"}
+                            >
+                                {checked && <CheckIcon size={14} className={"text-netbird"} />}
+                            </span>
+                        </DropdownMenuItem>
+                    );
+                })}
+            </DropdownMenuContent>
+        </DropdownMenu>
+    );
+};
diff --git a/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx b/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
new file mode 100644
index 000000000..da8028155
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
@@ -0,0 +1,538 @@
+import {
+    type KeyboardEvent,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ComponentType,
+    type ReactNode,
+} from "react";
+import { useTranslation } from "react-i18next";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { Virtuoso, type VirtuosoHandle } from "react-virtuoso";
+import { GlobeIcon, Layers3Icon, type LucideProps, NetworkIcon, WorkflowIcon } from "lucide-react";
+import type { Network } from "@bindings/services/models.js";
+import { cn } from "@/lib/cn";
+import { reconcileOrder } from "@/lib/sorting";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
+import { Tooltip } from "@/components/Tooltip";
+import { TruncatedText } from "@/components/TruncatedText";
+import { SearchInput } from "@/components/inputs/SearchInput";
+import { EmptyState } from "@/components/empty-state/EmptyState";
+import { NoResults } from "@/components/empty-state/NoResults";
+import { useStatus } from "@/contexts/StatusContext";
+import { useNetworks } from "@/contexts/NetworksContext";
+import { type NetworkFilter, NetworkFilters } from "./NetworkFilters";
+import { useDirection } from "@/hooks/useDirection";
+
+// Daemon renders DNS-route prefixes (zero netip.Prefix) as "invalid Prefix".
+const INVALID_PREFIX = "invalid Prefix";
+
+const isDnsRoute = (n: Network): boolean =>
+    n.domains.length > 0 && (!n.range || n.range === INVALID_PREFIX);
+
+type ResourceType = "host" | "subnet" | "domain";
+
+const isHostCidr = (cidr: string): boolean => {
+    const [addr, bitsStr] = cidr.split("/");
+    if (!addr || !bitsStr) return false;
+    const bits = Number(bitsStr);
+    const isV6 = addr.includes(":");
+    return isV6 ? bits === 128 : bits === 32;
+};
+
+const resourceTypeOf = (n: Network): ResourceType => {
+    if (isDnsRoute(n)) return "domain";
+    const primary = n.range.split(",")[0].trim();
+    return isHostCidr(primary) ? "host" : "subnet";
+};
+
+const resourceIconFor = (type: ResourceType): ComponentType<LucideProps> => {
+    if (type === "host") return WorkflowIcon;
+    if (type === "domain") return GlobeIcon;
+    return NetworkIcon;
+};
+
+const buildOverlapMap = (
+    routes: { id: string; range: string; domains: string[] }[],
+): Map<string, string[]> => {
+    const byRange = new Map<string, string[]>();
+    for (const r of routes) {
+        if (r.domains.length > 0) continue;
+        const arr = byRange.get(r.range) ?? [];
+        arr.push(r.id);
+        byRange.set(r.range, arr);
+    }
+    const out = new Map<string, string[]>();
+    for (const [range, ids] of byRange) {
+        if (ids.length > 1) out.set(range, ids);
+    }
+    return out;
+};
+
+export const Networks = () => {
+    const dir = useDirection();
+    const { t } = useTranslation();
+    const { status } = useStatus();
+    const isConnected = status?.status === "Connected";
+    const { networkRoutes, toggleNetwork, setNetworksSelected } = useNetworks();
+    const [search, setSearch] = useState("");
+    const [filter, setFilter] = useState<NetworkFilter>("all");
+    const [scrollParent, setScrollParent] = useState<HTMLDivElement | null>(null);
+    const searchRef = useRef<HTMLInputElement>(null);
+
+    useEffect(() => {
+        searchRef.current?.focus();
+    }, []);
+
+    const overlapGroups = useMemo(() => buildOverlapMap(networkRoutes), [networkRoutes]);
+
+    const overlapById = useMemo(() => {
+        const map = new Map<string, string[]>();
+        for (const ids of overlapGroups.values()) {
+            for (const id of ids) map.set(id, ids);
+        }
+        return map;
+    }, [overlapGroups]);
+
+    const counts = useMemo<Record<NetworkFilter, number>>(
+        () => ({
+            all: networkRoutes.length,
+            active: networkRoutes.filter((r) => r.selected).length,
+            overlapping: overlapById.size,
+        }),
+        [networkRoutes, overlapById],
+    );
+
+    const orderRef = useRef<string[]>([]);
+    const ordered = useMemo(() => {
+        const { order, items } = reconcileOrder(
+            orderRef.current,
+            networkRoutes,
+            (r) => r.id,
+            (a, b) => {
+                if (a.selected !== b.selected) return a.selected ? -1 : 1;
+                return a.id.localeCompare(b.id);
+            },
+        );
+        orderRef.current = order;
+        return items;
+    }, [networkRoutes]);
+
+    const filtered = useMemo(() => {
+        const q = search.trim().toLowerCase();
+        return ordered.filter((r) => {
+            if (filter === "active" && !r.selected) return false;
+            if (filter === "overlapping" && !overlapById.has(r.id)) return false;
+            if (q) {
+                const haystack = [r.id, r.range, ...r.domains].join(" ").toLowerCase();
+                if (!haystack.includes(q)) return false;
+            }
+            return true;
+        });
+    }, [ordered, search, filter, overlapById]);
+
+    if (isConnected && networkRoutes.length === 0) {
+        return (
+            <EmptyState
+                icon={Layers3Icon}
+                title={t("networks.empty.title")}
+                description={t("networks.empty.description")}
+            />
+        );
+    }
+
+    const selectedInView = filtered.filter((r) => r.selected).length;
+    const allSelected = filtered.length > 0 && selectedInView === filtered.length;
+    const bulkLabel = allSelected ? t("networks.bulk.disableAll") : t("networks.bulk.enableAll");
+
+    const onBulkClick = () => {
+        if (filtered.length === 0) return;
+        if (allSelected) {
+            setNetworksSelected(
+                filtered.map((r) => r.id),
+                false,
+            ).catch((err: unknown) => console.error("disable all networks failed", err));
+        } else {
+            const ids = filtered.filter((r) => !r.selected).map((r) => r.id);
+            setNetworksSelected(ids, true).catch((err: unknown) =>
+                console.error("enable all networks failed", err),
+            );
+        }
+    };
+
+    return (
+        <div className={"flex h-full min-h-0 w-full flex-col"}>
+            <div className={"flex items-center gap-2 border-b border-nb-gray-910 px-6 py-2.5"}>
+                <div className={"min-w-0 flex-1"}>
+                    <SearchInput
+                        ref={searchRef}
+                        placeholder={t("networks.search.placeholder")}
+                        value={search}
+                        onChange={(e) => setSearch(e.target.value)}
+                    />
+                </div>
+                <NetworkFilters value={filter} onChange={setFilter} counts={counts} />
+            </div>
+            {filtered.length === 0 ? (
+                <NoResults />
+            ) : (
+                <ScrollArea.Root
+                    dir={dir}
+                    type={"auto"}
+                    className={"min-h-0 flex-1 overflow-hidden"}
+                >
+                    <ScrollArea.Viewport ref={setScrollParent} className={"h-full w-full"}>
+                        {scrollParent && (
+                            <NetworksList
+                                data={filtered}
+                                onToggle={toggleNetwork}
+                                scrollParent={scrollParent}
+                            />
+                        )}
+                    </ScrollArea.Viewport>
+                    <ScrollArea.Scrollbar
+                        orientation={"vertical"}
+                        className={cn(
+                            "flex touch-none select-none transition-colors",
+                            "w-1.5 bg-transparent py-1",
+                        )}
+                    >
+                        <ScrollArea.Thumb
+                            className={
+                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                            }
+                        />
+                    </ScrollArea.Scrollbar>
+                </ScrollArea.Root>
+            )}
+            {filtered.length > 0 && (
+                <div
+                    className={cn(
+                        "flex items-center gap-3 px-6 py-3.5",
+                        "border-t border-nb-gray-910",
+                    )}
+                >
+                    <span className={"flex-1 text-xs font-medium tabular-nums text-nb-gray-300"}>
+                        {t("networks.bulk.selectionCount", {
+                            selected: selectedInView,
+                            total: filtered.length,
+                        })}
+                    </span>
+                    <button
+                        type={"button"}
+                        tabIndex={0}
+                        onClick={onBulkClick}
+                        aria-label={t("networks.bulk.label")}
+                        className={cn(
+                            "inline-flex h-8 items-center rounded-md px-3",
+                            "text-xs font-medium text-nb-gray-100",
+                            "border border-nb-gray-900 bg-nb-gray-920 hover:border-nb-gray-850 hover:bg-nb-gray-910",
+                            "wails-no-draggable cursor-pointer outline-none transition-colors",
+                            "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                        )}
+                    >
+                        {bulkLabel}
+                    </button>
+                </div>
+            )}
+        </div>
+    );
+};
+
+type NetworksListProps = {
+    data: Network[];
+    onToggle: (id: string, selected: boolean) => void;
+    scrollParent: HTMLElement;
+};
+
+const NetworksHeader = () => <div className={"h-2"} />;
+
+const NetworksList = ({ data, onToggle, scrollParent }: NetworksListProps) => {
+    const virtuosoRef = useRef<VirtuosoHandle>(null);
+    const rowRefs = useRef<Map<string, HTMLButtonElement>>(new Map());
+
+    const focusRow = (index: number) => {
+        if (index < 0 || index >= data.length) return;
+        const row = data[index];
+        const tryFocus = () => {
+            const el = rowRefs.current.get(row.id);
+            if (el) {
+                el.focus();
+                return true;
+            }
+            return false;
+        };
+        if (!tryFocus()) {
+            virtuosoRef.current?.scrollToIndex({ index, behavior: "auto" });
+            requestAnimationFrame(() => {
+                if (!tryFocus()) requestAnimationFrame(tryFocus);
+            });
+        }
+    };
+
+    const handleRowKeyDown = (e: KeyboardEvent<Element>, index: number) => {
+        switch (e.key) {
+            case "ArrowDown":
+                e.preventDefault();
+                focusRow(Math.min(index + 1, data.length - 1));
+                break;
+            case "ArrowUp":
+                e.preventDefault();
+                focusRow(Math.max(index - 1, 0));
+                break;
+            case "Home":
+                e.preventDefault();
+                focusRow(0);
+                break;
+            case "End":
+                e.preventDefault();
+                focusRow(data.length - 1);
+                break;
+        }
+    };
+
+    const setRowRef = (id: string, el: HTMLButtonElement | null) => {
+        if (el) rowRefs.current.set(id, el);
+        else rowRefs.current.delete(id);
+    };
+
+    const ctx = useMemo<NetworkRowContext>(
+        () => ({ onKeyDown: handleRowKeyDown, onToggle, setRowRef }),
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+        [data, onToggle],
+    );
+
+    return (
+        <Virtuoso<Network, NetworkRowContext>
+            ref={virtuosoRef}
+            data={data}
+            customScrollParent={scrollParent}
+            increaseViewportBy={400}
+            computeItemKey={(_, n) => n.id}
+            components={{ Header: NetworksHeader }}
+            context={ctx}
+            itemContent={renderNetworkRow}
+        />
+    );
+};
+
+type NetworkRowContext = {
+    onKeyDown: (e: KeyboardEvent<Element>, index: number) => void;
+    onToggle: (id: string, selected: boolean) => void;
+    setRowRef: (id: string, el: HTMLButtonElement | null) => void;
+};
+
+const renderNetworkRow = (index: number, n: Network, ctx: NetworkRowContext): ReactNode => (
+    <NetworkRow
+        network={n}
+        index={index}
+        onKeyDown={ctx.onKeyDown}
+        onToggle={ctx.onToggle}
+        setRowRef={ctx.setRowRef}
+    />
+);
+
+type NetworkRowProps = {
+    network: Network;
+    index: number;
+    onKeyDown: (e: KeyboardEvent<Element>, index: number) => void;
+    onToggle: (id: string, selected: boolean) => void;
+    setRowRef: (id: string, el: HTMLButtonElement | null) => void;
+};
+
+const NetworkRow = ({ network: n, index, onKeyDown, onToggle, setRowRef }: NetworkRowProps) => {
+    const { t } = useTranslation();
+    // Same handler is attached to the overlay button and to the network-id copy
+    // button so arrow nav works wherever focus sits inside the row.
+    const handleKey = (e: KeyboardEvent<Element>) => onKeyDown(e, index);
+    return (
+        <div
+            className={cn(
+                "group relative flex min-w-0 items-start gap-2.5 py-3 pe-9 ps-6",
+                "transition-colors hover:bg-nb-gray-900/40",
+                "wails-no-draggable",
+            )}
+        >
+            <button
+                type={"button"}
+                tabIndex={0}
+                ref={(el) => setRowRef(n.id, el)}
+                aria-label={t("networks.row.toggle", { name: n.id })}
+                aria-pressed={n.selected}
+                onClick={() => onToggle(n.id, n.selected)}
+                onKeyDown={handleKey}
+                className={cn(
+                    "absolute inset-0 cursor-pointer outline-none",
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
+                )}
+            />
+            <ResourceIconBadge type={resourceTypeOf(n)} />
+            <div
+                className={
+                    "pointer-events-none relative flex min-w-0 flex-1 flex-col leading-tight"
+                }
+            >
+                <div>
+                    <CopyToClipboard message={n.id} onKeyDown={handleKey}>
+                        <TruncatedText
+                            text={n.id}
+                            className={
+                                "block max-w-[300px] truncate text-[0.81rem] font-medium text-nb-gray-100"
+                            }
+                        />
+                    </CopyToClipboard>
+                </div>
+                <Subtitle network={n} onKeyDown={handleKey} />
+            </div>
+            <div
+                aria-hidden={"true"}
+                className={"pointer-events-none relative shrink-0 self-center"}
+            >
+                <NetworkToggle checked={n.selected} />
+            </div>
+        </div>
+    );
+};
+
+const ResourceIconBadge = ({ type }: { type: ResourceType }) => {
+    const Icon = resourceIconFor(type);
+    return (
+        <div
+            aria-hidden={"true"}
+            className={cn(
+                "mt-[0.25rem] flex h-9 w-9 shrink-0 items-center justify-center rounded-md",
+                "border border-nb-gray-800 bg-white text-nb-gray-300 transition-colors group-hover:border-nb-gray-700",
+                "dark:border-nb-gray-900 dark:bg-nb-gray-920 dark:group-hover:border-nb-gray-900",
+            )}
+        >
+            <Icon size={14} />
+        </div>
+    );
+};
+
+type SubtitleProps = {
+    network: Network;
+    onKeyDown: (e: KeyboardEvent<Element>) => void;
+};
+
+const Subtitle = ({ network, onKeyDown }: SubtitleProps) => {
+    if (isDnsRoute(network)) {
+        const domain = network.domains[0];
+        const ips = network.resolvedIps[domain] ?? [];
+        return <DomainSubtitle domain={domain} ips={ips} onKeyDown={onKeyDown} />;
+    }
+
+    if (network.range && network.range !== INVALID_PREFIX) {
+        return (
+            <div>
+                <CopyToClipboard message={network.range} onKeyDown={onKeyDown}>
+                    <TruncatedText
+                        text={network.range}
+                        dir={"ltr"}
+                        className={
+                            "block max-w-[300px] truncate font-mono text-xs text-nb-gray-400"
+                        }
+                    />
+                </CopyToClipboard>
+            </div>
+        );
+    }
+
+    return null;
+};
+
+type DomainSubtitleProps = {
+    domain: string;
+    ips: string[];
+    onKeyDown: (e: KeyboardEvent<Element>) => void;
+};
+
+const DomainSubtitle = ({ domain, ips, onKeyDown }: DomainSubtitleProps) => {
+    const span = (
+        <span className={"block max-w-[300px] truncate font-mono text-xs text-nb-gray-400"}>
+            {domain}
+        </span>
+    );
+    return (
+        <div>
+            <CopyToClipboard message={domain} onKeyDown={onKeyDown}>
+                {ips.length > 0 ? (
+                    <Tooltip
+                        content={<ResolvedIpsTooltip ips={ips} />}
+                        delayDuration={300}
+                        closeDelay={300}
+                        side={"right"}
+                        align={"start"}
+                        alignOffset={-8}
+                        interactive
+                        keepOpenOnClick
+                        contentClassName={cn(
+                            "max-h-72 max-w-[18rem] overflow-auto",
+                            "rounded-lg border border-nb-gray-800 bg-white dark:border-nb-gray-900 dark:bg-nb-gray-935",
+                            "p-2 pe-4",
+                        )}
+                    >
+                        {span}
+                    </Tooltip>
+                ) : (
+                    span
+                )}
+            </CopyToClipboard>
+        </div>
+    );
+};
+
+const ResolvedIpsTooltip = ({ ips }: { ips: string[] }) => {
+    const { t } = useTranslation();
+    return (
+        <>
+            <div className={"px-1 pb-1 text-[10px] uppercase tracking-wide text-nb-gray-300"}>
+                {t("networks.ips.heading")}
+            </div>
+            <ul className={"flex flex-col"}>
+                {ips.map((ip) => (
+                    <li key={ip}>
+                        <CopyToClipboard message={ip} className={"px-1 py-0.5"}>
+                            <span
+                                className={
+                                    "whitespace-nowrap font-mono text-[0.72rem] text-nb-gray-100"
+                                }
+                            >
+                                {ip}
+                            </span>
+                        </CopyToClipboard>
+                    </li>
+                ))}
+            </ul>
+        </>
+    );
+};
+
+type ToggleProps = {
+    checked: boolean;
+    mixed?: boolean;
+};
+
+const NetworkToggle = ({ checked, mixed }: ToggleProps) => {
+    const checkedTranslate = checked
+        ? "translate-x-[1.125rem] rtl:-translate-x-[1.125rem]"
+        : "translate-x-0.5 rtl:-translate-x-0.5";
+    return (
+        <span
+            className={cn(
+                "inline-flex h-5 w-9 shrink-0 items-center rounded-full",
+                "wails-no-draggable transition-colors",
+                checked || mixed ? "bg-netbird" : "bg-nb-gray-700",
+                mixed && "opacity-60",
+            )}
+        >
+            <span
+                className={cn(
+                    "inline-block h-4 w-4 rounded-full bg-white transition-transform",
+                    mixed ? "translate-x-2.5 rtl:-translate-x-2.5" : checkedTranslate,
+                )}
+            />
+        </span>
+    );
+};
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx b/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
new file mode 100644
index 000000000..e22054c68
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
@@ -0,0 +1,587 @@
+import {
+    type ComponentType,
+    Fragment,
+    type KeyboardEvent as ReactKeyboardEvent,
+    type ReactNode,
+    useCallback,
+    useEffect,
+    useRef,
+    useState,
+} from "react";
+import { useTranslation } from "react-i18next";
+import { AnimatePresence, motion, type Transition } from "framer-motion";
+import * as Popover from "@radix-ui/react-popover";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import {
+    ArrowDownIcon,
+    ArrowLeftIcon,
+    ArrowUpDownIcon,
+    ArrowUpIcon,
+    Check as CheckIcon,
+    ChevronDownIcon,
+    ChevronsLeftRightEllipsisIcon,
+    ClockIcon,
+    Copy as CopyIcon,
+    GaugeIcon,
+    HandshakeIcon,
+    KeyRoundIcon,
+    Layers3Icon,
+    type LucideProps,
+    MapPinIcon,
+    MonitorIcon,
+    Radio,
+    RefreshCwIcon,
+    WaypointsIcon,
+} from "lucide-react";
+import type { PeerStatus } from "@bindings/services/models.js";
+import { cn } from "@/lib/cn";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
+import { Tooltip } from "@/components/Tooltip";
+import { TruncatedText } from "@/components/TruncatedText";
+import { formatBytes, formatRelative, latencyColor, shortenDns } from "@/lib/formatters";
+import { useStatus } from "@/contexts/StatusContext";
+import { usePeerDetail } from "@/contexts/PeerDetailContext";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { peerStatusLabelKey } from "./Peers";
+import { useDirection } from "@/hooks/useDirection";
+
+const DEFAULT_TRANSITION: Transition = {
+    duration: 0.32,
+    ease: [0.32, 0.72, 0, 1],
+};
+
+const DASH = "-";
+
+const dotClass = (connStatus: string): string => {
+    switch (connStatus) {
+        case "Connected":
+            return "bg-green-500 dark:bg-green-400";
+        case "Connecting":
+            return "bg-yellow-500 animate-pulse-slow dark:bg-yellow-300";
+        default:
+            return "bg-nb-gray-500";
+    }
+};
+
+type Props = {
+    transition?: Transition;
+};
+
+export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
+    const { t } = useTranslation();
+    const { selected, setSelected } = usePeerDetail();
+    const { status, refresh } = useStatus();
+    const dir = useDirection();
+    const offscreenX = dir === "rtl" ? "-100%" : "100%";
+
+    useEffect(() => {
+        if (!selected) return;
+        const peers = status?.peers ?? [];
+        const fresh = peers.find((p) => p.pubKey === selected.pubKey);
+        if (!fresh) {
+            setSelected(null);
+            return;
+        }
+        if (fresh !== selected) setSelected(fresh);
+    }, [status, selected, setSelected]);
+
+    // Daemon updates latency/bytes/handshake without pushing a fresh status
+    // snapshot, so tick locally to keep relative timestamps live.
+    const [now, setNow] = useState(() => Date.now());
+    useEffect(() => {
+        if (!selected) return;
+        const id = setInterval(() => setNow(Date.now()), 1000);
+        return () => clearInterval(id);
+    }, [selected]);
+
+    const [refreshing, setRefreshing] = useState(false);
+    const onRefresh = useCallback(async () => {
+        if (refreshing) return;
+        setRefreshing(true);
+        const MIN_SPIN_MS = 600;
+        const minDelay = new Promise<void>((r) => setTimeout(r, MIN_SPIN_MS));
+        try {
+            await Promise.all([refresh(), minDelay]);
+        } finally {
+            setRefreshing(false);
+        }
+    }, [refresh, refreshing]);
+
+    useEffect(() => {
+        if (!selected) return;
+        const onKey = (e: KeyboardEvent) => {
+            if (e.key === "Escape") {
+                setSelected(null);
+                return;
+            }
+            if (e.key === (dir === "rtl" ? "ArrowRight" : "ArrowLeft")) {
+                const target = e.target as HTMLElement | null;
+                const tag = target?.tagName;
+                if (tag === "INPUT" || tag === "TEXTAREA" || target?.isContentEditable) return;
+                setSelected(null);
+            }
+        };
+        globalThis.addEventListener("keydown", onKey);
+        return () => globalThis.removeEventListener("keydown", onKey);
+    }, [selected, setSelected, dir]);
+
+    const dialogRef = useRef<HTMLDivElement>(null);
+    const backButtonRef = useRef<HTMLButtonElement>(null);
+
+    useEffect(() => {
+        if (!selected) return;
+        // Defer focus until the slide-in animation has started rendering.
+        // preventScroll avoids the browser scrolling the parent to chase the
+        // still-offscreen button, which lands as a stutter at the end of the slide.
+        requestAnimationFrame(() => backButtonRef.current?.focus({ preventScroll: true }));
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [selected?.pubKey]);
+
+    const getFocusable = (): HTMLElement[] => {
+        const root = dialogRef.current;
+        if (!root) return [];
+        const sel =
+            "button:not([disabled]), [href], input:not([disabled]), select:not([disabled])," +
+            ' textarea:not([disabled]), [tabindex]:not([tabindex="-1"])';
+        return Array.from(root.querySelectorAll<HTMLElement>(sel)).filter(
+            (el) => el.offsetParent !== null || el === document.activeElement,
+        );
+    };
+
+    const onDialogKeyDown = (e: ReactKeyboardEvent<HTMLDivElement>) => {
+        if (e.key !== "Tab") return;
+        const focusables = getFocusable();
+        if (focusables.length === 0) return;
+        const first = focusables[0];
+        const last = focusables[focusables.length - 1];
+        const active = document.activeElement as HTMLElement | null;
+        if (e.shiftKey) {
+            if (active === first || !active || !dialogRef.current?.contains(active)) {
+                e.preventDefault();
+                last.focus();
+            }
+        } else if (active === last) {
+            e.preventDefault();
+            first.focus();
+        }
+    };
+
+    return (
+        <AnimatePresence>
+            {selected && (
+                <motion.div
+                    ref={dialogRef}
+                    role={"dialog"}
+                    aria-modal={"true"}
+                    aria-labelledby={"nb-peer-detail-title"}
+                    onKeyDown={onDialogKeyDown}
+                    initial={{ x: offscreenX }}
+                    animate={{ x: 0 }}
+                    exit={{ x: offscreenX }}
+                    transition={transition}
+                    style={{ willChange: "transform" }}
+                    className={cn("absolute inset-0 z-20 flex flex-col", "bg-nb-gray-940")}
+                >
+                    <div
+                        className={cn(
+                            "flex shrink-0 items-center gap-3",
+                            "h-12 border-b border-nb-gray-910 px-3",
+                        )}
+                    >
+                        <button
+                            ref={backButtonRef}
+                            type={"button"}
+                            tabIndex={0}
+                            onClick={() => setSelected(null)}
+                            aria-label={t("common.close")}
+                            className={cn(
+                                "flex h-8 w-8 shrink-0 items-center justify-center rounded-md",
+                                "text-nb-gray-300 hover:bg-nb-gray-910 hover:text-nb-gray-100",
+                                "cursor-default outline-none transition-colors",
+                                "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                "wails-no-draggable",
+                            )}
+                        >
+                            <ArrowLeftIcon
+                                size={16}
+                                aria-hidden={"true"}
+                                className={"rtl:-scale-x-100"}
+                            />
+                        </button>
+                        <Tooltip content={t(peerStatusLabelKey(selected.connStatus))} side={"top"}>
+                            <span
+                                aria-hidden={"true"}
+                                className={cn(
+                                    "h-2 w-2 shrink-0 rounded-full",
+                                    dotClass(selected.connStatus),
+                                )}
+                            />
+                        </Tooltip>
+                        <CopyToClipboard
+                            message={selected.fqdn || selected.ip}
+                            size={11}
+                            className={"min-w-0 flex-1"}
+                            iconClassName={"top-[2px]"}
+                        >
+                            <span
+                                id={"nb-peer-detail-title"}
+                                className={"truncate text-sm font-medium text-nb-gray-100"}
+                            >
+                                {shortenDns(selected.fqdn) || selected.ip}
+                            </span>
+                        </CopyToClipboard>
+                        <Tooltip content={t("peers.details.refresh")}>
+                            <button
+                                type={"button"}
+                                tabIndex={0}
+                                onClick={onRefresh}
+                                disabled={refreshing}
+                                aria-label={t("peers.details.refresh")}
+                                aria-busy={refreshing}
+                                className={cn(
+                                    "flex h-8 w-8 shrink-0 items-center justify-center rounded-md",
+                                    "text-nb-gray-300 hover:bg-nb-gray-910 hover:text-nb-gray-100",
+                                    "cursor-default outline-none transition-colors",
+                                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                    "wails-no-draggable",
+                                    "disabled:opacity-50 disabled:hover:bg-transparent",
+                                )}
+                            >
+                                <RefreshCwIcon
+                                    size={14}
+                                    aria-hidden={"true"}
+                                    className={refreshing ? "animate-spin" : undefined}
+                                />
+                            </button>
+                        </Tooltip>
+                    </div>
+                    <ScrollArea.Root
+                        dir={dir}
+                        type={"auto"}
+                        className={"min-h-0 flex-1 overflow-hidden"}
+                    >
+                        <ScrollArea.Viewport className={"h-full w-full"}>
+                            <PeerDetails peer={selected} now={now} />
+                        </ScrollArea.Viewport>
+                        <ScrollArea.Scrollbar
+                            orientation={"vertical"}
+                            className={cn(
+                                "flex touch-none select-none transition-colors",
+                                "w-1.5 bg-transparent py-1",
+                            )}
+                        >
+                            <ScrollArea.Thumb
+                                className={
+                                    "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                                }
+                            />
+                        </ScrollArea.Scrollbar>
+                    </ScrollArea.Root>
+                </motion.div>
+            )}
+        </AnimatePresence>
+    );
+};
+
+const PeerDetails = ({ peer, now }: { peer: PeerStatus; now: number }) => {
+    const { t } = useTranslation();
+    const formatAge = (unix: number, fallback: string): string => {
+        if (!Number.isFinite(unix) || unix <= 0) return fallback;
+        const diff = Math.floor(now / 1000 - unix);
+        if (diff < 1) return t("peers.details.justNow");
+        return formatRelative(unix, now) ?? fallback;
+    };
+    const lastHandshake = formatAge(peer.lastHandshakeUnix, t("peers.details.never"));
+    const statusSince = formatAge(peer.connStatusUpdateUnix, DASH);
+    const isConnected = peer.connStatus === "Connected";
+    const connectionLabel = peer.relayed ? t("peers.details.relayed") : t("peers.details.p2p");
+
+    return (
+        <ul className={"flex flex-col divide-y divide-nb-gray-920"}>
+            <Row icon={MapPinIcon} label={t("peers.details.netbirdIp")}>
+                {peer.ip ? (
+                    <CopyToClipboard
+                        message={peer.ip}
+                        alwaysShowIcon
+                        className={"max-w-full"}
+                        iconClassName={"top-0"}
+                    >
+                        <span className={"font-mono"}>{peer.ip}</span>
+                    </CopyToClipboard>
+                ) : (
+                    DASH
+                )}
+            </Row>
+            {peer.ipv6 && (
+                <Row icon={MapPinIcon} label={t("peers.details.netbirdIpv6")}>
+                    <CopyToClipboard
+                        message={peer.ipv6}
+                        alwaysShowIcon
+                        className={"min-w-0 max-w-full"}
+                        iconClassName={"top-0"}
+                    >
+                        <TruncatedRowValue value={peer.ipv6} mono />
+                    </CopyToClipboard>
+                </Row>
+            )}
+            {isConnected && (
+                <Row icon={ChevronsLeftRightEllipsisIcon} label={t("peers.details.connection")}>
+                    <span className={"whitespace-nowrap"}>{connectionLabel}</span>
+                </Row>
+            )}
+            {peer.relayed && (
+                <Row icon={WaypointsIcon} label={t("peers.details.relayAddress")}>
+                    {peer.relayAddress ? (
+                        <CopyToClipboard
+                            message={peer.relayAddress}
+                            alwaysShowIcon
+                            className={"min-w-0 max-w-full"}
+                            iconClassName={"top-0"}
+                        >
+                            <TruncatedRowValue value={peer.relayAddress} mono />
+                        </CopyToClipboard>
+                    ) : (
+                        DASH
+                    )}
+                </Row>
+            )}
+            {peer.latencyMs > 0 && (
+                <Row icon={GaugeIcon} label={t("peers.details.latency")}>
+                    <span className={cn("tabular-nums", latencyColor(peer.latencyMs))}>
+                        {peer.latencyMs} ms
+                    </span>
+                </Row>
+            )}
+            {(peer.bytesRx > 0 || peer.bytesTx > 0) && (
+                <Row icon={ArrowUpDownIcon} label={t("peers.details.bytes")}>
+                    <div
+                        className={
+                            "flex items-center justify-end gap-3 font-medium text-nb-gray-300"
+                        }
+                    >
+                        <div className={"flex items-center gap-1.5 whitespace-nowrap"}>
+                            <ArrowDownIcon
+                                size={13}
+                                aria-hidden={"true"}
+                                className={"text-sky-400"}
+                            />
+                            <span className={"sr-only"}>{t("peers.details.bytesReceived")}:</span>
+                            <span className={"tabular-nums"}>{formatBytes(peer.bytesRx)}</span>
+                        </div>
+                        <div className={"flex items-center gap-1.5 whitespace-nowrap"}>
+                            <ArrowUpIcon
+                                size={13}
+                                aria-hidden={"true"}
+                                className={"text-netbird"}
+                            />
+                            <span className={"sr-only"}>{t("peers.details.bytesSent")}:</span>
+                            <span className={"tabular-nums"}>{formatBytes(peer.bytesTx)}</span>
+                        </div>
+                    </div>
+                </Row>
+            )}
+            <Row icon={HandshakeIcon} label={t("peers.details.lastHandshake")}>
+                {lastHandshake}
+            </Row>
+            <Row icon={ClockIcon} label={t("peers.details.statusSince")}>
+                {statusSince}
+            </Row>
+            {peer.networks.length > 0 && (
+                <Row icon={Layers3Icon} label={t("peers.details.networks")}>
+                    <ResourcesValue networks={peer.networks} />
+                </Row>
+            )}
+            <IceRow
+                icon={MonitorIcon}
+                baseLabel={t("peers.details.localIce")}
+                type={peer.localIceCandidateType}
+                endpoint={peer.localIceCandidateEndpoint}
+            />
+            <IceRow
+                icon={Radio}
+                baseLabel={t("peers.details.remoteIce")}
+                type={peer.remoteIceCandidateType}
+                endpoint={peer.remoteIceCandidateEndpoint}
+            />
+            <Row icon={KeyRoundIcon} label={t("peers.details.publicKey")}>
+                {peer.pubKey ? (
+                    <CopyToClipboard
+                        message={peer.pubKey}
+                        alwaysShowIcon
+                        className={"min-w-0 max-w-full"}
+                        iconClassName={"top-0"}
+                    >
+                        <TruncatedRowValue value={peer.pubKey} mono />
+                    </CopyToClipboard>
+                ) : (
+                    DASH
+                )}
+            </Row>
+        </ul>
+    );
+};
+
+type RowProps = {
+    icon: ComponentType<LucideProps>;
+    iconClassName?: string;
+    label: string;
+    children: ReactNode;
+};
+
+type IceRowProps = {
+    icon: ComponentType<LucideProps>;
+    baseLabel: string;
+    type: string;
+    endpoint: string;
+};
+
+const capitalize = (s: string): string => (s ? s[0].toUpperCase() + s.slice(1) : s);
+
+const IceRow = ({ icon, baseLabel, type, endpoint }: IceRowProps) => {
+    if (!type && !endpoint) return null;
+    const label = type ? `${baseLabel} (${capitalize(type)})` : baseLabel;
+    return (
+        <Row icon={icon} label={label}>
+            {endpoint ? (
+                <CopyToClipboard
+                    message={endpoint}
+                    alwaysShowIcon
+                    className={"min-w-0 max-w-full"}
+                    iconClassName={"top-0"}
+                >
+                    <TruncatedRowValue value={endpoint} mono />
+                </CopyToClipboard>
+            ) : (
+                <span className={"truncate"}>{capitalize(type)}</span>
+            )}
+        </Row>
+    );
+};
+
+const ResourcesValue = ({ networks }: { networks: string[] }) => (
+    <ResourcesPopover networks={networks} />
+);
+
+const ResourcesPopover = ({ networks }: { networks: string[] }) => {
+    const [open, setOpen] = useState(false);
+
+    return (
+        <Popover.Root open={open} onOpenChange={setOpen}>
+            <Popover.Trigger asChild>
+                <button
+                    type={"button"}
+                    tabIndex={0}
+                    aria-haspopup={"dialog"}
+                    aria-expanded={open}
+                    className={cn(
+                        "inline-flex shrink-0 items-center gap-1 rounded",
+                        "bg-nb-gray-930 hover:bg-nb-gray-910/80 data-[state=open]:bg-nb-gray-910",
+                        "border border-nb-gray-900",
+                        "py-1 pe-2 ps-2.5 text-xs font-medium text-nb-gray-300",
+                        "wails-no-draggable cursor-default outline-none transition-all",
+                        "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    )}
+                >
+                    {networks.length}
+                    <ChevronDownIcon
+                        size={12}
+                        aria-hidden={"true"}
+                        className={cn("transition-transform duration-150", open && "rotate-180")}
+                    />
+                </button>
+            </Popover.Trigger>
+            <Popover.Portal>
+                <Popover.Content
+                    side={"bottom"}
+                    align={"end"}
+                    sideOffset={6}
+                    onOpenAutoFocus={(e) => e.preventDefault()}
+                    className={cn(
+                        "z-50 max-h-72 min-w-64 max-w-[280px] overflow-auto",
+                        "rounded-lg border border-nb-gray-900 bg-nb-gray-935",
+                        "p-1 text-nb-gray-200 shadow-lg outline-none",
+                        "flex flex-col",
+                    )}
+                >
+                    {networks.map((n, i) => (
+                        <Fragment key={n}>
+                            {i > 0 && <div className={"-mx-1 my-1 h-px bg-nb-gray-910"} />}
+                            <ResourceRow value={n} />
+                        </Fragment>
+                    ))}
+                </Popover.Content>
+            </Popover.Portal>
+        </Popover.Root>
+    );
+};
+
+const ResourceRow = ({ value }: { value: string }) => {
+    const { t } = useTranslation();
+    const [copied, setCopied] = useState(false);
+    const isFocusVisible = useFocusVisible();
+    const handleClick = async () => {
+        if (!value) return;
+        try {
+            await navigator.clipboard.writeText(value);
+            setCopied(true);
+            setTimeout(() => setCopied(false), 500);
+        } catch (e) {
+            console.warn("copy resource to clipboard failed", e);
+        }
+    };
+    return (
+        <button
+            type={"button"}
+            onClick={handleClick}
+            tabIndex={0}
+            aria-label={`${t("common.copy")} ${value}`}
+            className={cn(
+                "group/resourcerow relative flex items-center justify-between gap-3",
+                "rounded-md px-2 py-1.5 text-start",
+                "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50",
+                "cursor-default outline-none transition-colors",
+                isFocusVisible &&
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
+            )}
+        >
+            <span className={"min-w-0 truncate font-mono text-[0.75rem]"}>{value}</span>
+            <span
+                aria-hidden={"true"}
+                className={"inline-flex shrink-0 items-center text-nb-gray-200"}
+            >
+                {copied ? <CheckIcon size={11} /> : <CopyIcon size={11} />}
+            </span>
+        </button>
+    );
+};
+
+const TruncatedRowValue = ({ value, mono }: { value: string; mono?: boolean }) => (
+    <TruncatedText
+        text={value}
+        dir={mono ? "ltr" : "auto"}
+        className={cn(
+            "inline-block min-w-0 max-w-[260px] truncate align-middle",
+            mono && "font-mono",
+        )}
+    />
+);
+
+const Row = ({ icon: Icon, iconClassName, label, children }: RowProps) => (
+    <li className={"flex min-w-0 items-center gap-2 px-5 py-4 text-xs text-nb-gray-100"}>
+        <Icon
+            size={14}
+            aria-hidden={"true"}
+            className={cn("shrink-0 text-nb-gray-100", iconClassName)}
+        />
+        <span className={"shrink-0 font-semibold text-nb-gray-200"}>{label}</span>
+        <span
+            className={cn(
+                "min-w-0 flex-1 ps-8 text-end",
+                "font-medium text-nb-gray-350",
+                "flex items-center justify-end",
+            )}
+        >
+            {children}
+        </span>
+    </li>
+);
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx b/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
new file mode 100644
index 000000000..524bae5d4
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
@@ -0,0 +1,84 @@
+import { useState } from "react";
+import { CheckIcon, ChevronDown, ListFilter } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { cn } from "@/lib/cn";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
+
+export type StatusFilter = "all" | "online" | "offline";
+
+type Props = {
+    value: StatusFilter;
+    onChange: (value: StatusFilter) => void;
+    counts: Record<StatusFilter, number>;
+    disabled?: boolean;
+};
+
+export const PeerFilters = ({ value, onChange, counts, disabled }: Props) => {
+    const { t } = useTranslation();
+    const [open, setOpen] = useState(false);
+    const filters: { value: StatusFilter; label: string }[] = [
+        { value: "all", label: t("peers.filter.all") },
+        { value: "online", label: t("peers.filter.online") },
+        { value: "offline", label: t("peers.filter.offline") },
+    ];
+    const active = filters.find((f) => f.value === value) ?? filters[0];
+
+    const handleSelect = (v: StatusFilter) => {
+        onChange(v);
+        setOpen(false);
+    };
+
+    return (
+        <DropdownMenu open={open} onOpenChange={setOpen}>
+            <DropdownMenuTrigger
+                disabled={disabled}
+                tabIndex={0}
+                aria-label={t("common.filter")}
+                className={cn(
+                    "inline-flex h-9 items-center gap-1.5 rounded-md px-2",
+                    "text-sm text-nb-gray-200",
+                    "outline-none transition-colors duration-150 hover:bg-nb-gray-900 data-[state=open]:bg-nb-gray-900",
+                    "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    "disabled:pointer-events-none disabled:opacity-50",
+                    "wails-no-draggable cursor-default",
+                )}
+            >
+                <ListFilter size={14} aria-hidden={"true"} className={"shrink-0"} />
+                <span>
+                    {active.label} <span className={"tabular-nums"}>({counts[active.value]})</span>
+                </span>
+                <ChevronDown size={14} aria-hidden={"true"} className={"ms-0.5 shrink-0"} />
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align={"end"} className={"min-w-[10rem]"}>
+                {filters.map((f) => {
+                    const checked = f.value === value;
+                    return (
+                        <DropdownMenuItem
+                            key={f.value}
+                            onClick={() => handleSelect(f.value)}
+                            role={"menuitemradio"}
+                            aria-checked={checked}
+                            className={"gap-2"}
+                        >
+                            <span className={"flex-1 truncate"}>
+                                {f.label}{" "}
+                                <span className={"tabular-nums"}>({counts[f.value]})</span>
+                            </span>
+                            <span
+                                aria-hidden={"true"}
+                                className={"flex w-4 shrink-0 items-center justify-center"}
+                            >
+                                {checked && <CheckIcon size={14} className={"text-netbird"} />}
+                            </span>
+                        </DropdownMenuItem>
+                    );
+                })}
+            </DropdownMenuContent>
+        </DropdownMenu>
+    );
+};
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx b/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
new file mode 100644
index 000000000..79a02a471
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
@@ -0,0 +1,360 @@
+import { type KeyboardEvent, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { Virtuoso, type VirtuosoHandle } from "react-virtuoso";
+import { ChevronRightIcon, MonitorSmartphoneIcon } from "lucide-react";
+import type { PeerStatus } from "@bindings/services/models.js";
+import { cn } from "@/lib/cn";
+import { reconcileOrder } from "@/lib/sorting";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
+import { SearchInput } from "@/components/inputs/SearchInput";
+import { EmptyState } from "@/components/empty-state/EmptyState";
+import { NoResults } from "@/components/empty-state/NoResults";
+import { latencyColor, shortenDns } from "@/lib/formatters";
+import { useStatus } from "@/contexts/StatusContext";
+import { usePeerDetail } from "@/contexts/PeerDetailContext";
+import { Tooltip } from "@/components/Tooltip";
+import { TruncatedText } from "@/components/TruncatedText";
+import { useDirection } from "@/hooks/useDirection";
+import { PeerFilters, type StatusFilter } from "./PeerFilters";
+
+const isOnline = (connStatus: string) => connStatus === "Connected";
+
+const dotClass = (connStatus: string): string => {
+    switch (connStatus) {
+        case "Connected":
+            return "bg-green-500 dark:bg-green-400";
+        case "Connecting":
+            return "bg-yellow-500 animate-pulse-slow dark:bg-yellow-300";
+        default:
+            return "bg-nb-gray-500";
+    }
+};
+
+export const peerStatusLabelKey = (connStatus: string): string => {
+    switch (connStatus) {
+        case "Connected":
+            return "peers.status.connected";
+        case "Connecting":
+            return "peers.status.connecting";
+        default:
+            return "peers.status.disconnected";
+    }
+};
+
+export const Peers = () => {
+    const dir = useDirection();
+    const { t } = useTranslation();
+    const { status } = useStatus();
+    const [search, setSearch] = useState("");
+    const [statusFilter, setStatusFilter] = useState<StatusFilter>("all");
+    const [scrollParent, setScrollParent] = useState<HTMLDivElement | null>(null);
+    const searchRef = useRef<HTMLInputElement>(null);
+
+    useEffect(() => {
+        searchRef.current?.focus();
+    }, []);
+
+    const isConnected = status?.status === "Connected";
+    const peers = useMemo(() => status?.peers ?? [], [status?.peers]);
+
+    const counts = useMemo<Record<StatusFilter, number>>(() => {
+        const online = peers.filter((p) => isOnline(p.connStatus)).length;
+        return {
+            all: peers.length,
+            online,
+            offline: peers.length - online,
+        };
+    }, [peers]);
+
+    // Stay in live-sort until every peer is stable. Right after Up the daemon
+    // emits all peers as "Connecting"; committing then would lock that
+    // alphabetical-only order forever.
+    const orderRef = useRef<string[]>([]);
+    const stickyRef = useRef(false);
+    const ordered = useMemo(() => {
+        const compare = (a: PeerStatus, b: PeerStatus) => {
+            const aOnline = isOnline(a.connStatus);
+            const bOnline = isOnline(b.connStatus);
+            if (aOnline !== bOnline) return aOnline ? -1 : 1;
+            const aName = (a.fqdn || a.ip).toLowerCase();
+            const bName = (b.fqdn || b.ip).toLowerCase();
+            return aName.localeCompare(bName);
+        };
+
+        if (peers.length === 0) {
+            orderRef.current = [];
+            stickyRef.current = false;
+            return [];
+        }
+
+        if (!stickyRef.current) {
+            const sorted = [...peers].sort(compare);
+            if (peers.every((p) => p.connStatus !== "Connecting")) {
+                orderRef.current = sorted.map((p) => p.pubKey);
+                stickyRef.current = true;
+            }
+            return sorted;
+        }
+
+        const { order, items } = reconcileOrder(orderRef.current, peers, (p) => p.pubKey, compare);
+        orderRef.current = order;
+        return items;
+    }, [peers]);
+
+    const filtered = useMemo(() => {
+        const q = search.trim().toLowerCase();
+        return ordered.filter((p) => {
+            if (statusFilter === "online" && !isOnline(p.connStatus)) return false;
+            if (statusFilter === "offline" && isOnline(p.connStatus)) return false;
+            return !q || p.fqdn.toLowerCase().includes(q) || p.ip.includes(q);
+        });
+    }, [ordered, search, statusFilter]);
+
+    if (isConnected && peers.length === 0) {
+        return (
+            <EmptyState
+                icon={MonitorSmartphoneIcon}
+                title={t("peers.empty.title")}
+                description={t("peers.empty.description")}
+            />
+        );
+    }
+
+    return (
+        <div className={"flex h-full min-h-0 w-full flex-col"}>
+            <div className={"flex items-center gap-2 border-b border-nb-gray-910 px-6 py-2.5"}>
+                <div className={"min-w-0 flex-1"}>
+                    <SearchInput
+                        ref={searchRef}
+                        placeholder={t("peers.search.placeholder")}
+                        value={search}
+                        onChange={(e) => setSearch(e.target.value)}
+                    />
+                </div>
+                <PeerFilters value={statusFilter} onChange={setStatusFilter} counts={counts} />
+            </div>
+            {filtered.length === 0 ? (
+                <NoResults />
+            ) : (
+                <ScrollArea.Root
+                    dir={dir}
+                    type={"auto"}
+                    className={"min-h-0 flex-1 overflow-hidden"}
+                >
+                    <ScrollArea.Viewport ref={setScrollParent} className={"h-full w-full"}>
+                        {scrollParent && <PeersList data={filtered} scrollParent={scrollParent} />}
+                    </ScrollArea.Viewport>
+                    <ScrollArea.Scrollbar
+                        orientation={"vertical"}
+                        className={cn(
+                            "flex touch-none select-none transition-colors",
+                            "w-1.5 bg-transparent py-1",
+                        )}
+                    >
+                        <ScrollArea.Thumb
+                            className={
+                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                            }
+                        />
+                    </ScrollArea.Scrollbar>
+                </ScrollArea.Root>
+            )}
+        </div>
+    );
+};
+
+const ListTopSpacer = () => <div className={"h-2"} />;
+
+type PeersListProps = {
+    data: PeerStatus[];
+    scrollParent: HTMLElement;
+};
+
+const PeersList = ({ data, scrollParent }: PeersListProps) => {
+    const { setSelected } = usePeerDetail();
+    const dir = useDirection();
+    const virtuosoRef = useRef<VirtuosoHandle>(null);
+    const rowRefs = useRef<Map<string, HTMLButtonElement>>(new Map());
+
+    const focusRow = (index: number) => {
+        if (index < 0 || index >= data.length) return;
+        const peer = data[index];
+        const tryFocus = () => {
+            const el = rowRefs.current.get(peer.pubKey);
+            if (el) {
+                el.focus();
+                return true;
+            }
+            return false;
+        };
+        if (!tryFocus()) {
+            virtuosoRef.current?.scrollToIndex({ index, behavior: "auto" });
+            // Row may not be mounted yet — retry after Virtuoso renders it.
+            requestAnimationFrame(() => {
+                if (!tryFocus()) requestAnimationFrame(tryFocus);
+            });
+        }
+    };
+
+    const handleRowKeyDown = (e: KeyboardEvent<Element>, index: number) => {
+        switch (e.key) {
+            case "ArrowDown":
+                e.preventDefault();
+                focusRow(Math.min(index + 1, data.length - 1));
+                break;
+            case "ArrowUp":
+                e.preventDefault();
+                focusRow(Math.max(index - 1, 0));
+                break;
+            case dir === "rtl" ? "ArrowLeft" : "ArrowRight":
+                e.preventDefault();
+                setSelected(data[index]);
+                break;
+            case "Home":
+                e.preventDefault();
+                focusRow(0);
+                break;
+            case "End":
+                e.preventDefault();
+                focusRow(data.length - 1);
+                break;
+        }
+    };
+
+    const setRowRef = (pubKey: string, el: HTMLButtonElement | null) => {
+        if (el) rowRefs.current.set(pubKey, el);
+        else rowRefs.current.delete(pubKey);
+    };
+
+    const ctx = useMemo<PeerRowContext>(
+        () => ({ onKeyDown: handleRowKeyDown, onSelect: setSelected, setRowRef }),
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+        [data, setSelected, dir],
+    );
+
+    return (
+        <Virtuoso<PeerStatus, PeerRowContext>
+            ref={virtuosoRef}
+            data={data}
+            customScrollParent={scrollParent}
+            increaseViewportBy={400}
+            computeItemKey={(_, peer) => peer.pubKey}
+            components={{ Header: ListTopSpacer }}
+            context={ctx}
+            itemContent={renderPeerRow}
+        />
+    );
+};
+
+type PeerRowContext = {
+    onKeyDown: (e: KeyboardEvent<Element>, index: number) => void;
+    onSelect: (peer: PeerStatus) => void;
+    setRowRef: (pubKey: string, el: HTMLButtonElement | null) => void;
+};
+
+const renderPeerRow = (index: number, peer: PeerStatus, ctx: PeerRowContext): ReactNode => (
+    <PeerRow
+        peer={peer}
+        index={index}
+        onKeyDown={ctx.onKeyDown}
+        onSelect={ctx.onSelect}
+        setRowRef={ctx.setRowRef}
+    />
+);
+
+type PeerRowProps = {
+    peer: PeerStatus;
+    index: number;
+    onKeyDown: (e: KeyboardEvent<Element>, index: number) => void;
+    onSelect: (peer: PeerStatus) => void;
+    setRowRef: (pubKey: string, el: HTMLButtonElement | null) => void;
+};
+
+const PeerRow = ({ peer, index, onKeyDown, onSelect, setRowRef }: PeerRowProps) => {
+    const { t } = useTranslation();
+    const isConnected = peer.connStatus === "Connected";
+    const peerName = shortenDns(peer.fqdn) || peer.ip;
+    const statusLabel = t(peerStatusLabelKey(peer.connStatus));
+    const handleKey = (e: KeyboardEvent<Element>) => onKeyDown(e, index);
+    return (
+        <div
+            className={cn(
+                "group relative flex min-w-0 items-start gap-2.5 py-3 pe-4 ps-6",
+                "transition-colors hover:bg-nb-gray-900/40",
+                "wails-no-draggable",
+            )}
+        >
+            <button
+                type={"button"}
+                tabIndex={0}
+                ref={(el) => setRowRef(peer.pubKey, el)}
+                aria-label={t("peers.row.label", { name: peerName, status: statusLabel })}
+                onClick={() => onSelect(peer)}
+                onKeyDown={handleKey}
+                className={cn(
+                    "absolute inset-0 cursor-default outline-none",
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
+                )}
+            />
+            <Tooltip content={statusLabel} side={"left"}>
+                <span
+                    aria-hidden={"true"}
+                    className={cn(
+                        "relative mt-2 h-2 w-2 shrink-0 rounded-full",
+                        dotClass(peer.connStatus),
+                    )}
+                />
+            </Tooltip>
+            <div
+                className={
+                    "pointer-events-none relative flex min-w-0 flex-1 flex-col leading-tight"
+                }
+            >
+                <div>
+                    <CopyToClipboard
+                        message={peer.fqdn}
+                        className={"pointer-events-auto"}
+                        onKeyDown={handleKey}
+                    >
+                        <TruncatedText
+                            text={shortenDns(peer.fqdn)}
+                            className={
+                                "block max-w-[300px] truncate text-[0.81rem] font-medium text-nb-gray-100"
+                            }
+                        />
+                    </CopyToClipboard>
+                </div>
+                <div>
+                    <CopyToClipboard
+                        message={peer.ip}
+                        className={"pointer-events-auto"}
+                        onKeyDown={handleKey}
+                    >
+                        <span className={"truncate font-mono text-xs text-nb-gray-400"}>
+                            {peer.ip}
+                        </span>
+                    </CopyToClipboard>
+                </div>
+            </div>
+            {isConnected && peer.latencyMs > 0 && (
+                <span
+                    className={cn(
+                        "pointer-events-none relative shrink-0 self-center text-xs tabular-nums",
+                        latencyColor(peer.latencyMs),
+                    )}
+                >
+                    {peer.latencyMs} ms
+                </span>
+            )}
+            <ChevronRightIcon
+                size={16}
+                aria-hidden={"true"}
+                className={cn(
+                    "pointer-events-none relative shrink-0 self-center text-nb-gray-300 rtl:-scale-x-100",
+                    "opacity-0 transition-opacity group-hover:opacity-100",
+                )}
+            />
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/modules/profiles/ProfileAvatar.tsx b/client/ui/frontend/src/modules/profiles/ProfileAvatar.tsx
new file mode 100644
index 000000000..70d45acc5
--- /dev/null
+++ b/client/ui/frontend/src/modules/profiles/ProfileAvatar.tsx
@@ -0,0 +1,76 @@
+import { type ButtonHTMLAttributes, forwardRef } from "react";
+import {
+    Briefcase,
+    Building,
+    Cloud,
+    Construction,
+    FlaskConical,
+    Gamepad2,
+    GraduationCap,
+    House,
+    Radio,
+    Server,
+    SquareCode,
+    Terminal,
+    UserCircle,
+    UserPlus,
+    Users,
+    type LucideIcon,
+} from "lucide-react";
+import { cn } from "@/lib/cn";
+
+// Scanned in order — put more-specific tokens first (e.g. "staging" before "stage").
+const ICON_MAP: ReadonlyArray<[RegExp, LucideIcon]> = [
+    [/(default|personal)/i, UserCircle],
+    [/(work|business|office|company|corp|corporate)/i, Briefcase],
+    [/(home|house|private)/i, House],
+    [/(dev|development|developer|code|coding|engineering)/i, SquareCode],
+    [/(local|localhost|loopback)/i, Terminal],
+    [/(stage|staging|preprod|pre-prod)/i, Construction],
+    [/(test|testing|qa)/i, FlaskConical],
+    [/(prod|production)/i, Cloud],
+    [/(live)/i, Radio],
+    [/(selfhosted|self-hosted|on-prem|onprem)/i, Server],
+    [/(school|university|edu|study|student)/i, GraduationCap],
+    [/(client|customer)/i, Building],
+    [/(family)/i, Users],
+    [/(gaming|game)/i, Gamepad2],
+    [/(guest)/i, UserPlus],
+];
+
+export const pickProfileIcon = (name: string | undefined): LucideIcon | null => {
+    if (!name) return null;
+    for (const [pattern, Icon] of ICON_MAP) {
+        if (pattern.test(name)) return Icon;
+    }
+    return null;
+};
+
+type Props = ButtonHTMLAttributes<HTMLButtonElement> & {
+    name?: string;
+    size?: number;
+};
+
+export const ProfileAvatar = forwardRef<HTMLButtonElement, Props>(function ProfileAvatar(
+    { name = "", size = 28, className, type = "button", ...props },
+    ref,
+) {
+    const Icon = pickProfileIcon(name) ?? UserCircle;
+    return (
+        <button
+            ref={ref}
+            type={type}
+            className={cn(
+                "inline-grid place-items-center rounded-full bg-nb-gray-900 p-0 text-center",
+                "cursor-default outline-none",
+                "transition-colors duration-150 hover:bg-nb-gray-850",
+                "data-[state=open]:bg-nb-gray-850",
+                className,
+            )}
+            style={{ width: size, height: size }}
+            {...props}
+        >
+            <Icon size={Math.round(size * 0.4)} className={"text-nb-gray-200"} />
+        </button>
+    );
+});
diff --git a/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx b/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
new file mode 100644
index 000000000..487080f3d
--- /dev/null
+++ b/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
@@ -0,0 +1,264 @@
+import { type FormEvent, useEffect, useId, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import * as Dialog from "@/components/dialog/Dialog";
+import { Input } from "@/components/inputs/Input";
+import { Button } from "@/components/buttons/Button";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { Label } from "@/components/typography/Label";
+import { HelpText } from "@/components/typography/HelpText";
+import { ManagementServerSwitch } from "@/components/ManagementServerSwitch";
+import {
+    CLOUD_MANAGEMENT_URL,
+    ManagementMode,
+    checkManagementUrlReachable,
+    isValidManagementUrl,
+    normalizeManagementUrl,
+} from "@/hooks/useManagementUrl";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+export type ProfileFormInitial = {
+    name: string;
+    managementUrl: string;
+};
+
+type Props = {
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+    onSubmit: (name: string, managementUrl: string) => void | Promise<void>;
+    initial?: ProfileFormInitial;
+};
+
+const MAX_PROFILE_NAME_LEN = 128;
+
+export const ProfileCreationModal = ({ open, onOpenChange, onSubmit, initial }: Props) => {
+    const { t } = useTranslation();
+    const { mdm } = useRestrictions();
+    const managedManagementUrl = mdm.managementURL;
+    const nameId = useId();
+    const urlId = useId();
+    const isEdit = !!initial;
+    const initialModeFromUrl = (u: string): ManagementMode =>
+        u && u !== CLOUD_MANAGEMENT_URL ? ManagementMode.SelfHosted : ManagementMode.Cloud;
+    const initialSelfHostedUrl = (u: string): string => (u && u !== CLOUD_MANAGEMENT_URL ? u : "");
+
+    const [name, setName] = useState(initial?.name ?? "");
+    const [nameError, setNameError] = useState<string | null>(null);
+    const nameRef = useRef<HTMLInputElement>(null);
+
+    const [mode, setMode] = useState<ManagementMode>(
+        initial ? initialModeFromUrl(initial.managementUrl) : ManagementMode.Cloud,
+    );
+    const [url, setUrl] = useState(initial ? initialSelfHostedUrl(initial.managementUrl) : "");
+    const [urlError, setUrlError] = useState<string | null>(null);
+    const [unreachable, setUnreachable] = useState(false);
+    const [checking, setChecking] = useState(false);
+    const urlRef = useRef<HTMLInputElement>(null);
+
+    useEffect(() => {
+        if (open) {
+            setName(initial?.name ?? "");
+            setMode(initial ? initialModeFromUrl(initial.managementUrl) : ManagementMode.Cloud);
+            setUrl(initial ? initialSelfHostedUrl(initial.managementUrl) : "");
+            setNameError(null);
+            setUrlError(null);
+            setUnreachable(false);
+            setChecking(false);
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [open, initial?.name, initial?.managementUrl]);
+
+    const initialModeRef = useRef<ManagementMode>(ManagementMode.Cloud);
+    useEffect(() => {
+        if (!open) return;
+        initialModeRef.current = mode;
+        const id = globalThis.setTimeout(() => {
+            nameRef.current?.focus();
+            nameRef.current?.select();
+        }, 0);
+        return () => globalThis.clearTimeout(id);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [open]);
+
+    // When the user toggles to Self-hosted inside the dialog (not on initial
+    // open), move focus to the URL input so they can start typing immediately.
+    useEffect(() => {
+        if (!open) return;
+        if (mode === initialModeRef.current) return;
+        if (mode !== ManagementMode.SelfHosted) return;
+        urlRef.current?.focus();
+    }, [open, mode]);
+
+    useEffect(() => {
+        setUrlError(null);
+        setUnreachable(false);
+    }, [url, mode]);
+
+    const resolveTargetUrl = (): { url: string; needsReachCheck: boolean } | null => {
+        if (managedManagementUrl) {
+            return { url: managedManagementUrl, needsReachCheck: false };
+        }
+        if (mode === ManagementMode.Cloud) {
+            return { url: CLOUD_MANAGEMENT_URL, needsReachCheck: false };
+        }
+        const trimmed = url.trim();
+        if (!trimmed || !isValidManagementUrl(trimmed)) {
+            setUrlError(t("settings.general.management.urlError"));
+            urlRef.current?.focus();
+            return null;
+        }
+        const target = normalizeManagementUrl(trimmed);
+
+        const unchanged = target === initial?.managementUrl;
+        return { url: target, needsReachCheck: !unchanged };
+    };
+
+    const handleSubmit = async (e: FormEvent) => {
+        e.preventDefault();
+        if (checking) return;
+
+        const sanitized = name.trim();
+        if (sanitized.length === 0) {
+            setNameError(t("profile.dialog.required"));
+            nameRef.current?.focus();
+            return;
+        }
+
+        const target = resolveTargetUrl();
+        if (!target) return;
+
+        if (target.needsReachCheck) {
+            setChecking(true);
+            const reachable = await checkManagementUrlReachable(target.url);
+            setChecking(false);
+            if (!reachable && !unreachable) {
+                setUnreachable(true);
+                return;
+            }
+        }
+
+        await onSubmit(sanitized, target.url);
+        onOpenChange(false);
+    };
+
+    const handleNameChange = (value: string) => {
+        setName(value);
+        if (nameError) setNameError(null);
+    };
+
+    const trimmedUrl = url.trim();
+    const showUrlSyntaxError =
+        mode === ManagementMode.SelfHosted &&
+        trimmedUrl !== "" &&
+        !isValidManagementUrl(trimmedUrl);
+    const urlInputError = showUrlSyntaxError
+        ? t("settings.general.management.urlError")
+        : (urlError ?? undefined);
+    const urlInputWarning =
+        !urlInputError && unreachable ? t("profile.dialog.urlUnreachable") : undefined;
+
+    return (
+        <Dialog.Root open={open} onOpenChange={onOpenChange}>
+            <Dialog.Content
+                maxWidthClass={"max-w-md"}
+                showClose={false}
+                className={"py-7"}
+                srTitle={isEdit ? t("profile.edit.title") : t("profile.dialog.title")}
+                srDescription={t("profile.dialog.description")}
+                onOpenAutoFocus={(e) => {
+                    e.preventDefault();
+                    // Focus + select-all so editing an existing name is one
+                    // keystroke away from overwriting it.
+                    nameRef.current?.focus();
+                    nameRef.current?.select();
+                }}
+            >
+                <form onSubmit={handleSubmit}>
+                    <div className={"flex flex-col gap-6 px-7"}>
+                        <div className={"flex flex-col gap-2"}>
+                            <div className={"ps-1"}>
+                                <Label htmlFor={nameId} className={"mb-0.5"}>
+                                    {t("profile.dialog.nameLabel")}
+                                </Label>
+                                <HelpText margin={false}>
+                                    {t("profile.dialog.description")}
+                                </HelpText>
+                            </div>
+                            <Input
+                                id={nameId}
+                                ref={nameRef}
+                                autoFocus
+                                placeholder={t("profile.dialog.placeholder")}
+                                value={name}
+                                onChange={(e) => handleNameChange(e.target.value)}
+                                error={nameError ?? undefined}
+                                maxLength={MAX_PROFILE_NAME_LEN}
+                                spellCheck={false}
+                                autoComplete={"off"}
+                                autoCapitalize={"off"}
+                            />
+                        </div>
+
+                        {!managedManagementUrl && (
+                            <div className={"flex flex-col gap-2"}>
+                                <div className={"ps-1"}>
+                                    <Label as={"div"} className={"mb-0.5"}>
+                                        {t("settings.general.management.label")}
+                                    </Label>
+                                    <HelpText margin={false}>
+                                        {t("profile.dialog.managementHelp")}
+                                    </HelpText>
+                                </div>
+                                <div className={"flex flex-col gap-3"}>
+                                    <ManagementServerSwitch
+                                        value={mode}
+                                        onChange={setMode}
+                                        fullWidth
+                                    />
+                                    {mode === ManagementMode.SelfHosted && (
+                                        <Input
+                                            id={urlId}
+                                            dir={"ltr"}
+                                            ref={urlRef}
+                                            aria-label={t("settings.general.management.label")}
+                                            placeholder={t(
+                                                "settings.general.management.urlPlaceholder",
+                                            )}
+                                            value={url}
+                                            onChange={(e) => setUrl(e.target.value)}
+                                            error={urlInputError}
+                                            warning={urlInputWarning}
+                                            spellCheck={false}
+                                            autoComplete={"off"}
+                                            autoCorrect={"off"}
+                                            autoCapitalize={"off"}
+                                        />
+                                    )}
+                                </div>
+                            </div>
+                        )}
+
+                        <DialogActions className={"flex-row items-center justify-end gap-2.5 pt-2"}>
+                            <Button
+                                type={"button"}
+                                variant={"secondary"}
+                                size={"sm"}
+                                disabled={checking}
+                                onClick={() => onOpenChange(false)}
+                            >
+                                {t("common.cancel")}
+                            </Button>
+                            <Button
+                                type={"submit"}
+                                variant={"primary"}
+                                size={"sm"}
+                                loading={checking}
+                            >
+                                {isEdit ? t("profile.edit.submit") : t("profile.dialog.submit")}
+                            </Button>
+                        </DialogActions>
+                    </div>
+                </form>
+            </Dialog.Content>
+        </Dialog.Root>
+    );
+};
diff --git a/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx b/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
new file mode 100644
index 000000000..ec70fb923
--- /dev/null
+++ b/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
@@ -0,0 +1,296 @@
+import { forwardRef, useLayoutEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import * as Popover from "@radix-ui/react-popover";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { Command } from "cmdk";
+import { Check, ChevronDown, Settings2, UserCircle } from "lucide-react";
+import { pickProfileIcon } from "@/modules/profiles/ProfileAvatar";
+import type { Profile } from "@bindings/services/models.js";
+import { Tooltip } from "@/components/Tooltip";
+import { useProfile } from "@/contexts/ProfileContext";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { cn } from "@/lib/cn";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+import { useDirection } from "@/hooks/useDirection";
+
+type ProfileDropdownProps = {
+    onManageProfiles?: () => void;
+};
+
+const MANAGE_VALUE = "__manage_profiles__";
+
+export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
+    const dir = useDirection();
+    const { t } = useTranslation();
+    const { activeProfile, activeProfileId, profiles, switchProfile, loaded } = useProfile();
+    const [open, setOpen] = useState(false);
+    const [busy, setBusy] = useState(false);
+    const listRef = useRef<HTMLDivElement>(null);
+
+    const handleTriggerKeyDown = (e: React.KeyboardEvent<HTMLButtonElement>) => {
+        if (open) return;
+        if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+            e.preventDefault();
+            setOpen(true);
+        }
+    };
+
+    const sortedProfiles = [...profiles].sort((a, b) => {
+        if (a.id === activeProfileId) return -1;
+        if (b.id === activeProfileId) return 1;
+        return a.name.localeCompare(b.name);
+    });
+
+    const guarded = async (title: string, fn: () => Promise<void>) => {
+        if (busy) return;
+        setBusy(true);
+        try {
+            await fn();
+        } catch (e) {
+            await errorDialog({
+                Title: title,
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            setBusy(false);
+        }
+    };
+
+    const handleSelect = (id: string) => {
+        setOpen(false);
+        if (id === activeProfileId) return;
+        void guarded(t("profile.error.switchTitle"), () => switchProfile(id));
+    };
+
+    const handleManage = () => {
+        setOpen(false);
+        onManageProfiles?.();
+    };
+
+    if (!loaded) return <ProfileTriggerSkeleton />;
+
+    const hasProfile = !!activeProfileId;
+    const activeFromList = profiles.find((p) => p.id === activeProfileId)?.name;
+    const displayName = hasProfile
+        ? (activeFromList ?? activeProfile)
+        : t("profile.selector.noProfile");
+
+    return (
+        <Popover.Root open={open} onOpenChange={setOpen}>
+            <Popover.Trigger asChild className={"wails-no-draggable"} disabled={!hasProfile}>
+                <ProfileTriggerButton
+                    name={displayName}
+                    disabled={!hasProfile}
+                    onKeyDown={handleTriggerKeyDown}
+                />
+            </Popover.Trigger>
+            <Popover.Portal>
+                <Popover.Content
+                    align={"center"}
+                    sideOffset={8}
+                    collisionPadding={12}
+                    onOpenAutoFocus={(e) => {
+                        e.preventDefault();
+                        listRef.current?.focus();
+                    }}
+                    className={cn(
+                        "wails-no-draggable z-50 min-w-64 select-none overflow-hidden rounded-lg border border-nb-gray-800 bg-nb-gray-950 p-1 text-nb-gray-200 shadow-lg dark:border-nb-gray-900 dark:bg-nb-gray-935",
+                        "data-[state=open]:animate-in data-[state=closed]:animate-out",
+                        "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+                        "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
+                        "data-[side=bottom]:origin-top data-[side=top]:origin-bottom",
+                        "data-[side=left]:origin-right data-[side=right]:origin-left",
+                        "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2",
+                        "data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+                    )}
+                >
+                    <Command
+                        loop
+                        shouldFilter={false}
+                        onKeyDown={(e) => e.stopPropagation()}
+                        className={"outline-none focus:outline-none focus-visible:outline-none"}
+                    >
+                        <Command.List
+                            ref={listRef}
+                            aria-label={t("header.profile.switch")}
+                            className={"outline-none focus:outline-none focus-visible:outline-none"}
+                        >
+                            {sortedProfiles.length > 0 && (
+                                <>
+                                    <ScrollArea.Root
+                                        dir={dir}
+                                        type={"auto"}
+                                        className={"-mx-1 overflow-hidden"}
+                                    >
+                                        <ScrollArea.Viewport className={"max-h-60 px-1"}>
+                                            {sortedProfiles.map((profile) => (
+                                                <ProfileRow
+                                                    key={profile.id}
+                                                    profile={profile}
+                                                    isActive={profile.id === activeProfileId}
+                                                    onSelect={handleSelect}
+                                                />
+                                            ))}
+                                        </ScrollArea.Viewport>
+                                        <ScrollArea.Scrollbar
+                                            orientation={"vertical"}
+                                            className={cn(
+                                                "flex touch-none select-none transition-colors",
+                                                "w-1.5 bg-transparent",
+                                            )}
+                                        >
+                                            <ScrollArea.Thumb
+                                                className={
+                                                    "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                                                }
+                                            />
+                                        </ScrollArea.Scrollbar>
+                                    </ScrollArea.Root>
+                                    <div className={"-mx-1 h-px bg-nb-gray-910"} />
+                                </>
+                            )}
+
+                            <div className={"pt-1"}>
+                                <Command.Item
+                                    value={MANAGE_VALUE}
+                                    onSelect={handleManage}
+                                    disabled={!onManageProfiles}
+                                    className={cn(
+                                        "flex items-center gap-2 px-2 py-1.5",
+                                        "cursor-default rounded-md text-sm outline-none",
+                                        "data-[selected=true]:bg-nb-gray-900",
+                                        "data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50",
+                                    )}
+                                >
+                                    <Settings2
+                                        size={14}
+                                        aria-hidden={"true"}
+                                        className={"shrink-0"}
+                                    />
+                                    <span className={"flex-1 truncate"}>
+                                        {t("profile.dropdown.manageProfiles")}
+                                    </span>
+                                </Command.Item>
+                            </div>
+                        </Command.List>
+                    </Command>
+                </Popover.Content>
+            </Popover.Portal>
+        </Popover.Root>
+    );
+};
+
+const ProfileTriggerSkeleton = () => (
+    <div
+        role={"status"}
+        aria-busy={"true"}
+        aria-live={"polite"}
+        className={"wails-no-draggable flex h-10 select-none items-center gap-2 rounded-lg px-3"}
+    >
+        <div
+            aria-hidden={"true"}
+            className={"size-4 shrink-0 animate-pulse rounded-full bg-nb-gray-900"}
+        />
+        <div aria-hidden={"true"} className={"h-4 w-24 animate-pulse rounded bg-nb-gray-900"} />
+    </div>
+);
+
+type ProfileTriggerButtonProps = React.ButtonHTMLAttributes<HTMLButtonElement> & {
+    name: string;
+};
+
+const ProfileTriggerButton = forwardRef<HTMLButtonElement, ProfileTriggerButtonProps>(
+    function ProfileTriggerButton({ name, className, disabled, ...props }, ref) {
+        const { t } = useTranslation();
+        const isFocusVisible = useFocusVisible();
+        const Icon = pickProfileIcon(name) ?? UserCircle;
+        return (
+            <button
+                ref={ref}
+                type={"button"}
+                disabled={disabled}
+                tabIndex={disabled ? -1 : 0}
+                aria-label={t("header.profile.switch")}
+                aria-haspopup={"listbox"}
+                className={cn(
+                    "wails-no-draggable flex h-10 cursor-default select-none items-center gap-2 rounded-lg px-3 outline-none",
+                    "text-nb-gray-200 hover:bg-nb-gray-800 dark:hover:bg-nb-gray-900",
+                    "data-[state=open]:bg-nb-gray-800 dark:data-[state=open]:bg-nb-gray-900",
+                    "disabled:opacity-50 disabled:hover:bg-transparent dark:disabled:hover:bg-transparent",
+                    isFocusVisible &&
+                        "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    "wails-no-draggable transition-colors duration-150",
+                    className,
+                )}
+                {...props}
+            >
+                <Icon
+                    size={16}
+                    aria-hidden={"true"}
+                    className={"wails-no-draggable shrink-0 text-nb-gray-200"}
+                />
+                <span className={"wails-no-draggable max-w-[140px] truncate text-sm font-medium"}>
+                    {name}
+                </span>
+                <ChevronDown
+                    size={14}
+                    aria-hidden={"true"}
+                    className={"wails-no-draggable shrink-0 text-nb-gray-200"}
+                />
+            </button>
+        );
+    },
+);
+
+type ProfileRowProps = {
+    profile: Profile;
+    isActive: boolean;
+    onSelect: (id: string) => void;
+};
+
+const ProfileRow = ({ profile, isActive, onSelect }: ProfileRowProps) => {
+    const showEmail = !!profile.email;
+    return (
+        <Command.Item
+            value={profile.id}
+            onSelect={() => onSelect(profile.id)}
+            className={cn(
+                "flex w-auto gap-2 px-2 py-2 pe-3 last:mb-1",
+                "cursor-default rounded-md text-sm outline-none",
+                "data-[selected=true]:bg-nb-gray-900",
+                showEmail ? "items-start" : "items-center",
+            )}
+        >
+            <div className={"flex min-w-0 flex-1 flex-col leading-tight"}>
+                <span className={"truncate"}>{profile.name}</span>
+                {showEmail && <TruncatedEmail email={profile.email} />}
+            </div>
+            {isActive && (
+                <Check
+                    size={16}
+                    aria-hidden={"true"}
+                    className={cn("shrink-0 text-netbird", showEmail && "mt-0.5")}
+                />
+            )}
+        </Command.Item>
+    );
+};
+
+const TruncatedEmail = ({ email }: { email: string }) => {
+    const ref = useRef<HTMLSpanElement>(null);
+    const [overflowing, setOverflowing] = useState(false);
+
+    useLayoutEffect(() => {
+        const el = ref.current;
+        if (!el) return;
+        setOverflowing(el.scrollWidth > el.clientWidth);
+    }, [email]);
+
+    const span = (
+        <span ref={ref} className={"mt-0.5 max-w-[180px] truncate text-xs text-nb-gray-300"}>
+            {email}
+        </span>
+    );
+    if (!overflowing) return span;
+    return <Tooltip content={email}>{span}</Tooltip>;
+};
diff --git a/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
new file mode 100644
index 000000000..509f48061
--- /dev/null
+++ b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
@@ -0,0 +1,679 @@
+import { type KeyboardEvent, useLayoutEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+    CircleMinus,
+    LogIn,
+    MoreVertical,
+    PencilLine,
+    PlusCircle,
+    Trash2,
+    UserCircle,
+} from "lucide-react";
+import type { Profile } from "@bindings/services/models.js";
+import { Badge } from "@/components/Badge";
+import { Button } from "@/components/buttons/Button";
+import HelpText from "@/components/typography/HelpText";
+import {
+    ProfileCreationModal,
+    type ProfileFormInitial,
+} from "@/modules/profiles/ProfileCreationModal";
+import { pickProfileIcon } from "@/modules/profiles/ProfileAvatar";
+import { Tooltip } from "@/components/Tooltip";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
+import i18next from "@/lib/i18n";
+import { useProfile } from "@/contexts/ProfileContext";
+import { useConfirm } from "@/contexts/DialogContext";
+import { Settings as SettingsSvc } from "@bindings/services";
+import { SetConfigParams } from "@bindings/services/models.js";
+import { isNetbirdCloud } from "@/hooks/useManagementUrl.ts";
+import { SectionGroup, SettingsBottomBar } from "@/modules/settings/SettingsSection.tsx";
+import { cn } from "@/lib/cn";
+import { reconcileOrder } from "@/lib/sorting";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+const DEFAULT_PROFILE_ID = "default";
+
+export function ProfilesTab() {
+    const { t } = useTranslation();
+    const {
+        profiles,
+        activeProfileId,
+        loaded,
+        username,
+        switchProfileNoConnect,
+        addProfile,
+        removeProfile,
+        renameProfile,
+        logoutProfile,
+    } = useProfile();
+
+    const confirm = useConfirm();
+    const [newOpen, setNewOpen] = useState(false);
+    const [editTarget, setEditTarget] = useState<{
+        profile: Profile;
+        initial: ProfileFormInitial;
+    } | null>(null);
+    const [busy, setBusy] = useState(false);
+
+    // Order is held stable so switching only flips the badge, never reorders rows
+    // (else the clicked row jumps to the top under the cursor).
+    const orderRef = useRef<string[]>([]);
+    const ordered = useMemo(() => {
+        const { order, items } = reconcileOrder(
+            orderRef.current,
+            profiles,
+            (p) => p.id,
+            (a, b) => {
+                if (a.id === activeProfileId) return -1;
+                if (b.id === activeProfileId) return 1;
+                return a.name.localeCompare(b.name);
+            },
+        );
+        orderRef.current = order;
+        return items;
+    }, [profiles, activeProfileId]);
+
+    const guarded = async (title: string, fn: () => Promise<unknown>) => {
+        if (busy) return;
+        setBusy(true);
+        try {
+            await fn();
+        } catch (e) {
+            await errorDialog({
+                Title: title,
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            setBusy(false);
+        }
+    };
+
+    const handleSwitch = async (id: string, name: string) => {
+        const ok = await confirm({
+            title: t("profile.switch.title", { name }),
+            description: t("profile.switch.message", { name }),
+            confirmLabel: t("profile.switch.confirm"),
+        });
+        if (!ok) return;
+        await guarded(i18next.t("profile.error.switchTitle"), () => switchProfileNoConnect(id));
+    };
+
+    const handleDeregister = async (id: string, name: string) => {
+        const ok = await confirm({
+            title: t("profile.deregister.title", { name }),
+            description: t("profile.deregister.message", { name }),
+            confirmLabel: t("profile.deregister.confirm"),
+        });
+        if (!ok) return;
+        void guarded(i18next.t("profile.error.deregisterTitle"), () => logoutProfile(id));
+    };
+
+    const handleDelete = async (id: string, name: string) => {
+        if (id === DEFAULT_PROFILE_ID) return;
+        await guarded(i18next.t("profile.error.deleteTitle"), () =>
+            confirm({
+                title: t("profile.delete.title", { name }),
+                description: t("profile.delete.message", { name }),
+                confirmLabel: t("common.delete"),
+                danger: true,
+                onConfirm: () => removeProfile(id),
+            }),
+        );
+    };
+
+    const handleCreate = async (name: string, managementUrl: string) => {
+        await guarded(i18next.t("profile.error.createTitle"), async () => {
+            const id = await addProfile(name);
+            // SetConfig is keyed by the new profile's ID, so it writes the
+            // not-yet-active profile before the switch makes it current.
+            if (!isNetbirdCloud(managementUrl)) {
+                await SettingsSvc.SetConfig(
+                    new SetConfigParams({ profileName: id, username, managementUrl }),
+                );
+            }
+            await switchProfileNoConnect(id);
+        });
+    };
+
+    const handleEdit = async (id: string, name: string) => {
+        await guarded(i18next.t("profile.error.editTitle"), async () => {
+            const config = await SettingsSvc.GetConfig({ profileName: id, username });
+            const profile = profiles.find((p) => p.id === id);
+            if (!profile) return;
+            setEditTarget({
+                profile,
+                initial: { name, managementUrl: config.managementUrl },
+            });
+        });
+    };
+
+    const handleSave = async (name: string, managementUrl: string) => {
+        if (!editTarget) return;
+        const { profile, initial } = editTarget;
+        await guarded(i18next.t("profile.error.editTitle"), async () => {
+            if (name !== initial.name) {
+                await renameProfile(profile.id, name);
+            }
+            if (managementUrl !== initial.managementUrl) {
+                await SettingsSvc.SetConfig(
+                    new SetConfigParams({
+                        profileName: profile.id,
+                        username,
+                        managementUrl,
+                    }),
+                );
+            }
+        });
+    };
+
+    return (
+        <div>
+            <SectionGroup title={t("settings.profiles.section.profiles")}>
+                <HelpText className={"-mt-2 mb-0"}>{t("settings.profiles.intro")}</HelpText>
+
+                <div
+                    className={cn(
+                        "overflow-hidden rounded-xl border border-nb-gray-800 bg-nb-gray-930/60 dark:border-nb-gray-900",
+                    )}
+                >
+                    <ProfilesTable
+                        ordered={ordered}
+                        activeProfileId={activeProfileId}
+                        onSwitch={handleSwitch}
+                        onEdit={handleEdit}
+                        onDeregister={handleDeregister}
+                        onDelete={handleDelete}
+                    />
+
+                    {loaded && ordered.length === 0 && (
+                        <div
+                            className={
+                                "flex flex-col items-center justify-center py-10 text-center"
+                            }
+                        >
+                            <UserCircle
+                                size={28}
+                                aria-hidden={"true"}
+                                className={"mb-2 text-nb-gray-500"}
+                            />
+                            <p className={"text-sm font-semibold text-nb-gray-200"}>
+                                {t("settings.profiles.emptyTitle")}
+                            </p>
+                            <p className={"mt-1 max-w-sm text-balance text-xs text-nb-gray-400"}>
+                                {t("settings.profiles.emptyDescription")}
+                            </p>
+                        </div>
+                    )}
+                </div>
+
+                <SettingsBottomBar>
+                    <Button variant={"primary"} size={"md"} onClick={() => setNewOpen(true)}>
+                        <PlusCircle size={14} aria-hidden={"true"} />
+                        {t("settings.profiles.addProfile")}
+                    </Button>
+                </SettingsBottomBar>
+            </SectionGroup>
+
+            <ProfileCreationModal
+                open={newOpen}
+                onOpenChange={setNewOpen}
+                onSubmit={handleCreate}
+            />
+
+            <ProfileCreationModal
+                open={editTarget !== null}
+                onOpenChange={(o) => {
+                    if (!o) setEditTarget(null);
+                }}
+                initial={editTarget?.initial}
+                onSubmit={handleSave}
+            />
+        </div>
+    );
+}
+
+type ProfilesTableProps = {
+    ordered: Profile[];
+    activeProfileId: string | undefined;
+    onSwitch: (id: string, name: string) => void;
+    onEdit: (id: string, name: string) => void;
+    onDeregister: (id: string, name: string) => void;
+    onDelete: (id: string, name: string) => void;
+};
+
+const ProfilesTable = ({
+    ordered,
+    activeProfileId,
+    onSwitch,
+    onEdit,
+    onDeregister,
+    onDelete,
+}: ProfilesTableProps) => {
+    const { t } = useTranslation();
+    const [focusedIndex, setFocusedIndex] = useState(0);
+    const rowRefs = useRef<Map<string, HTMLTableRowElement>>(new Map());
+
+    const focusRow = (index: number) => {
+        if (index < 0 || index >= ordered.length) return;
+        setFocusedIndex(index);
+        const el = rowRefs.current.get(ordered[index].id);
+        el?.focus();
+    };
+
+    const actionButtonsIn = (row: HTMLTableRowElement | undefined) =>
+        Array.from(
+            row?.querySelectorAll<HTMLButtonElement>(
+                "button:not([aria-hidden='true']):not([aria-disabled='true'])",
+            ) ?? [],
+        );
+
+    const handleRowKey = (e: KeyboardEvent<HTMLTableRowElement>, index: number): boolean => {
+        switch (e.key) {
+            case "ArrowDown":
+                focusRow(Math.min(index + 1, ordered.length - 1));
+                return true;
+            case "ArrowUp":
+                focusRow(Math.max(index - 1, 0));
+                return true;
+            case "Home":
+                focusRow(0);
+                return true;
+            case "End":
+                focusRow(ordered.length - 1);
+                return true;
+        }
+        return false;
+    };
+
+    const handleButtonKey = (
+        e: KeyboardEvent<HTMLTableRowElement>,
+        index: number,
+        row: HTMLTableRowElement,
+    ): boolean => {
+        const buttons = actionButtonsIn(row);
+        const current = buttons.indexOf(e.target as HTMLButtonElement);
+        if (current === -1) return false;
+
+        switch (e.key) {
+            case "ArrowDown":
+                focusRow(Math.min(index + 1, ordered.length - 1));
+                return true;
+            case "ArrowUp":
+                focusRow(Math.max(index - 1, 0));
+                return true;
+            case "Escape":
+                row.focus();
+                return true;
+            case "Tab":
+                // At the last button: jump to the next row instead of exiting the table.
+                // At the first button with Shift+Tab: jump back to the row.
+                if (!e.shiftKey && current === buttons.length - 1 && index < ordered.length - 1) {
+                    focusRow(index + 1);
+                    return true;
+                }
+                if (e.shiftKey && current === 0) {
+                    row.focus();
+                    return true;
+                }
+                return false;
+        }
+        return false;
+    };
+
+    const handleRowKeyDown = (e: KeyboardEvent<HTMLTableRowElement>, index: number) => {
+        const row = rowRefs.current.get(ordered[index].id);
+        if (!row) return;
+        const onRow = e.target === row;
+        const handled = onRow ? handleRowKey(e, index) : handleButtonKey(e, index, row);
+        if (handled) e.preventDefault();
+    };
+
+    const safeFocusedIndex = Math.min(focusedIndex, Math.max(0, ordered.length - 1));
+
+    return (
+        <table
+            aria-label={t("settings.profiles.section.profiles")}
+            className={"w-full border-separate border-spacing-0 text-sm"}
+        >
+            <tbody className={"flex flex-col"}>
+                {ordered.map((profile, index) => (
+                    <ProfileRow
+                        key={profile.id}
+                        profile={profile}
+                        isActive={profile.id === activeProfileId}
+                        isFocused={index === safeFocusedIndex}
+                        isFirst={index === 0}
+                        isLast={index === ordered.length - 1}
+                        rowRef={(el) => {
+                            if (el) rowRefs.current.set(profile.id, el);
+                            else rowRefs.current.delete(profile.id);
+                        }}
+                        onKeyDown={(e) => handleRowKeyDown(e, index)}
+                        onFocus={() => setFocusedIndex(index)}
+                        onSwitch={() => onSwitch(profile.id, profile.name)}
+                        onEdit={() => onEdit(profile.id, profile.name)}
+                        onDeregister={() => onDeregister(profile.id, profile.name)}
+                        onDelete={() => onDelete(profile.id, profile.name)}
+                    />
+                ))}
+            </tbody>
+        </table>
+    );
+};
+
+type ProfileRowProps = {
+    profile: Profile;
+    isActive: boolean;
+    isFocused: boolean;
+    isFirst: boolean;
+    isLast: boolean;
+    rowRef: (el: HTMLTableRowElement | null) => void;
+    onKeyDown: (e: KeyboardEvent<HTMLTableRowElement>) => void;
+    onFocus: () => void;
+    onSwitch: () => void;
+    onEdit: () => void;
+    onDeregister: () => void;
+    onDelete: () => void;
+};
+
+const ProfileRow = ({
+    profile,
+    isActive,
+    isFocused,
+    isFirst,
+    isLast,
+    rowRef,
+    onKeyDown,
+    onFocus,
+    onSwitch,
+    onEdit,
+    onDeregister,
+    onDelete,
+}: ProfileRowProps) => {
+    const { t } = useTranslation();
+    const Icon = pickProfileIcon(profile.name) ?? UserCircle;
+    const showEmail = !!profile.email;
+
+    return (
+        <tr
+            ref={rowRef}
+            tabIndex={isFocused ? 0 : -1}
+            onKeyDown={onKeyDown}
+            onFocus={onFocus}
+            aria-label={profile.name}
+            className={cn(
+                "flex items-center gap-4 px-4 py-2.5",
+                "border-b border-nb-gray-910 last:border-b-0",
+                "outline-none",
+                isFirst && "rounded-t-xl",
+                isLast && "rounded-b-xl",
+                "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
+            )}
+        >
+            <td
+                className={cn(
+                    "flex min-w-0 flex-1 gap-2 leading-tight",
+                    showEmail ? "items-start" : "items-center",
+                )}
+            >
+                <Icon
+                    size={15}
+                    aria-hidden={"true"}
+                    className={cn("shrink-0 text-nb-gray-200", showEmail ? "mt-0.5" : "")}
+                />
+                <div className={"flex min-w-0 flex-1 flex-col leading-tight"}>
+                    <div className={"flex min-w-0 items-center gap-2"}>
+                        <span
+                            className={
+                                "cursor-text select-text truncate font-medium text-nb-gray-100"
+                            }
+                        >
+                            {profile.name}
+                        </span>
+                        {isActive && <Badge>{t("settings.profiles.active")}</Badge>}
+                    </div>
+                    {showEmail && <TruncatedEmail email={profile.email} />}
+                </div>
+            </td>
+            <td className={"shrink-0 text-end"}>
+                <RowActions
+                    canSwitch={!isActive}
+                    canDeregister={!!profile.email}
+                    isDefault={profile.id === DEFAULT_PROFILE_ID}
+                    isActive={isActive}
+                    rowFocused={isFocused}
+                    onSwitch={onSwitch}
+                    onEdit={onEdit}
+                    onDeregister={onDeregister}
+                    onDelete={onDelete}
+                />
+            </td>
+        </tr>
+    );
+};
+
+const TruncatedEmail = ({ email }: { email: string }) => {
+    const ref = useRef<HTMLSpanElement>(null);
+    const [overflowing, setOverflowing] = useState(false);
+
+    useLayoutEffect(() => {
+        const el = ref.current;
+        if (!el) return;
+        setOverflowing(el.scrollWidth > el.clientWidth);
+    }, [email]);
+
+    const span = (
+        <span
+            ref={ref}
+            className={"mt-0.5 cursor-text select-text truncate text-xs text-nb-gray-300"}
+        >
+            {email}
+        </span>
+    );
+    if (!overflowing) return span;
+    return <Tooltip content={email}>{span}</Tooltip>;
+};
+
+type RowActionsProps = {
+    canSwitch: boolean;
+    canDeregister: boolean;
+    isDefault: boolean;
+    isActive: boolean;
+    rowFocused: boolean;
+    onSwitch: () => void;
+    onEdit: () => void;
+    onDeregister: () => void;
+    onDelete: () => void;
+};
+
+const RowActions = ({
+    canSwitch,
+    canDeregister,
+    isDefault,
+    isActive,
+    rowFocused,
+    onSwitch,
+    onEdit,
+    onDeregister,
+    onDelete,
+}: RowActionsProps) => {
+    const { t } = useTranslation();
+    const deleteDisabled = isDefault || isActive;
+    let deleteDisabledReason: string | null = null;
+    if (isDefault) deleteDisabledReason = t("profile.delete.disabledDefault");
+    else if (isActive) deleteDisabledReason = t("profile.delete.disabledActive");
+    return (
+        <div className={"inline-flex items-center gap-1"}>
+            <ActionIconButton
+                label={t("profile.selector.switchTo")}
+                icon={LogIn}
+                onClick={onSwitch}
+                hidden={!canSwitch}
+                tabbable={rowFocused}
+            />
+            <RowMoreMenu
+                canDeregister={canDeregister}
+                deleteDisabled={deleteDisabled}
+                deleteDisabledReason={deleteDisabledReason}
+                rowFocused={rowFocused}
+                onEdit={onEdit}
+                onDeregister={onDeregister}
+                onDelete={onDelete}
+            />
+        </div>
+    );
+};
+
+type RowMoreMenuProps = {
+    canDeregister: boolean;
+    deleteDisabled: boolean;
+    deleteDisabledReason: string | null;
+    rowFocused: boolean;
+    onEdit: () => void;
+    onDeregister: () => void;
+    onDelete: () => void;
+};
+
+const RowMoreMenu = ({
+    canDeregister,
+    deleteDisabled,
+    deleteDisabledReason,
+    rowFocused,
+    onEdit,
+    onDeregister,
+    onDelete,
+}: RowMoreMenuProps) => {
+    const { t } = useTranslation();
+    const moreLabel = t("profile.selector.moreOptions");
+    return (
+        <DropdownMenu modal={false}>
+            <DropdownMenuTrigger asChild>
+                <button
+                    type={"button"}
+                    aria-label={moreLabel}
+                    tabIndex={rowFocused ? 0 : -1}
+                    className={cn(
+                        "inline-flex h-9 w-9 cursor-default items-center justify-center rounded-md outline-none",
+                        "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-100",
+                        "transition-colors duration-150",
+                        "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                        "data-[state=open]:bg-nb-gray-900 data-[state=open]:text-nb-gray-100",
+                    )}
+                >
+                    <MoreVertical size={16} aria-hidden={"true"} />
+                </button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align={"end"} sideOffset={4} className={"min-w-36 select-none"}>
+                <DropdownMenuItem onClick={onEdit}>
+                    <div className={"flex w-full items-center gap-2"}>
+                        <PencilLine size={14} aria-hidden={"true"} />
+                        <span className={"flex-1"}>{t("profile.selector.edit")}</span>
+                    </div>
+                </DropdownMenuItem>
+                {canDeregister && (
+                    <DropdownMenuItem onClick={onDeregister}>
+                        <div className={"flex w-full items-center gap-2"}>
+                            <CircleMinus size={14} aria-hidden={"true"} />
+                            <span className={"flex-1"}>{t("profile.selector.deregister")}</span>
+                        </div>
+                    </DropdownMenuItem>
+                )}
+                <DeleteMenuItem
+                    disabled={deleteDisabled}
+                    disabledReason={deleteDisabledReason}
+                    onDelete={onDelete}
+                />
+            </DropdownMenuContent>
+        </DropdownMenu>
+    );
+};
+
+type DeleteMenuItemProps = {
+    disabled: boolean;
+    disabledReason: string | null;
+    onDelete: () => void;
+};
+
+const DeleteMenuItem = ({ disabled, disabledReason, onDelete }: DeleteMenuItemProps) => {
+    const { t } = useTranslation();
+    const item = (
+        <DropdownMenuItem
+            disabled={disabled}
+            onClick={disabled ? undefined : onDelete}
+            className={cn(!disabled && "text-red-500 hover:!text-red-500 focus:text-red-500")}
+        >
+            <div className={"flex w-full items-center gap-2"}>
+                <Trash2 size={14} aria-hidden={"true"} />
+                <span className={"flex-1"}>{t("profile.selector.delete")}</span>
+            </div>
+        </DropdownMenuItem>
+    );
+    if (!disabled || !disabledReason) return item;
+    return (
+        <Tooltip
+            content={<span className={"block max-w-[260px] leading-snug"}>{disabledReason}</span>}
+            side={"left"}
+        >
+            <span className={"block"}>{item}</span>
+        </Tooltip>
+    );
+};
+
+type ActionIconButtonProps = {
+    label: string;
+    icon: typeof CircleMinus;
+    onClick: () => void;
+    variant?: "default" | "danger";
+    /** Occupies space but invisible and non-interactive (preserves row layout). */
+    hidden?: boolean;
+    disabled?: boolean;
+    tabbable?: boolean;
+};
+
+const ActionIconButton = ({
+    label,
+    icon: Icon,
+    onClick,
+    variant = "default",
+    hidden = false,
+    disabled = false,
+    tabbable = true,
+}: ActionIconButtonProps) => {
+    const button = (
+        <button
+            type={"button"}
+            onClick={disabled ? undefined : onClick}
+            aria-label={label}
+            aria-hidden={hidden || undefined}
+            aria-disabled={disabled || undefined}
+            tabIndex={hidden || !tabbable ? -1 : 0}
+            className={cn(
+                "inline-flex h-9 w-9 cursor-default items-center justify-center rounded-md outline-none",
+                "transition-colors duration-150",
+                "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                variant === "danger"
+                    ? "text-nb-gray-400 hover:bg-red-500/10 hover:text-red-500"
+                    : "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-100",
+                hidden && "pointer-events-none opacity-0",
+                disabled &&
+                    "cursor-not-allowed opacity-40 hover:!bg-transparent hover:!text-nb-gray-400",
+            )}
+        >
+            <Icon size={16} aria-hidden={"true"} />
+        </button>
+    );
+    if (hidden) return button;
+    return (
+        <Tooltip
+            content={<span className={"block max-w-[260px] leading-snug"}>{label}</span>}
+            side={"top"}
+        >
+            {button}
+        </Tooltip>
+    );
+};
diff --git a/client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx b/client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx
new file mode 100644
index 000000000..e57040a7a
--- /dev/null
+++ b/client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx
@@ -0,0 +1,255 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useSearchParams } from "react-router-dom";
+import { Events } from "@wailsio/runtime";
+import { AlertCircleIcon, ClockIcon } from "lucide-react";
+import { Button } from "@/components/buttons/Button";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { SquareIcon } from "@/components/SquareIcon";
+import { Connection, Profiles as ProfilesSvc, Session, WindowManager } from "@bindings/services";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+import { EVENT_BROWSER_LOGIN_CANCEL, EVENT_TRIGGER_LOGIN } from "@/lib/connection";
+import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
+import { formatRemaining } from "@/lib/formatters";
+
+const DEFAULT_SECONDS = 360;
+const WINDOW_WIDTH = 360;
+const SOON_THRESHOLD_SECONDS = 60 * 60;
+const DEADLINE_TOLERANCE_MS = 5 * 1000;
+// The final-warning deadline reaches the Go side as RFC3339 truncated to whole
+// seconds, while the status snapshot carries millisecond precision, so an
+// unchanged deadline can look up to 999 ms newer than the exact URL value.
+const EXACT_DEADLINE_TOLERANCE_MS = 999;
+
+export default function SessionExpirationDialog() {
+    const { t } = useTranslation();
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
+    const [params] = useSearchParams();
+    const initialSeconds = useMemo(() => {
+        const raw = params.get("seconds");
+        if (!raw) return DEFAULT_SECONDS;
+        const n = Number.parseInt(raw, 10);
+        return Number.isFinite(n) && n > 0 ? n : DEFAULT_SECONDS;
+    }, [params]);
+    const initialDeadline = useMemo(() => {
+        const raw = params.get("deadline");
+        if (!raw) return null;
+        const n = Number.parseInt(raw, 10);
+        return Number.isFinite(n) && n > 0 ? n : null;
+    }, [params]);
+
+    const [remaining, setRemaining] = useState(initialSeconds);
+    const [busy, setBusy] = useState(false);
+    const busyRef = useRef(busy);
+    busyRef.current = busy;
+    const openedDeadlineRef = useRef(initialDeadline ?? Date.now() + initialSeconds * 1000);
+    const exactDeadlineRef = useRef(initialDeadline !== null);
+    const expired = remaining <= 0;
+    const expiredRef = useRef(expired);
+    expiredRef.current = expired;
+    const soon = remaining <= SOON_THRESHOLD_SECONDS;
+    const activeTitle = soon ? t("sessionExpiration.title") : t("sessionExpiration.titleLater");
+    const activeDescription = soon
+        ? t("sessionExpiration.description")
+        : t("sessionExpiration.descriptionLater");
+
+    useEffect(() => {
+        setRemaining(initialSeconds);
+        openedDeadlineRef.current = initialDeadline ?? Date.now() + initialSeconds * 1000;
+        exactDeadlineRef.current = initialDeadline !== null;
+    }, [initialSeconds, initialDeadline]);
+
+    // Recompute from the absolute deadline instead of decrementing per tick: webview
+    // timers get suspended for tens of seconds (App Nap / hidden-window throttling),
+    // so a tick counter drifts behind the wall clock by the suspended time.
+    useEffect(() => {
+        const id = globalThis.setInterval(() => {
+            setRemaining(Math.max(0, Math.ceil((openedDeadlineRef.current - Date.now()) / 1000)));
+        }, 1000);
+        return () => globalThis.clearInterval(id);
+    }, [initialSeconds]);
+
+    // Auto-close only when the session was actually renewed elsewhere (tray action, CLI,
+    // main window): the daemon keeps emitting Connected snapshots regardless of session
+    // state, so the signal is the deadline jumping past the one this dialog was opened for.
+    // With the exact deadline from the URL any jump past its sub-second precision loss
+    // counts; the seconds-derived fallback needs a wider tolerance for the Go-side
+    // truncation and mount latency.
+    // Don't auto-close while busy (aborts our WaitExtend) or expired (hides the state).
+    useEffect(() => {
+        const off = Events.On(
+            "netbird:status",
+            (ev: { data: { status?: string; sessionExpiresAt?: string | null } }) => {
+                if (busyRef.current || expiredRef.current) return;
+                if (ev?.data?.status !== "Connected") return;
+                const raw = ev?.data?.sessionExpiresAt;
+                if (!raw) return;
+                const renewed = Date.parse(raw);
+                if (!Number.isFinite(renewed)) return;
+                const tolerance = exactDeadlineRef.current
+                    ? EXACT_DEADLINE_TOLERANCE_MS
+                    : DEADLINE_TOLERANCE_MS;
+                if (renewed - openedDeadlineRef.current > tolerance) {
+                    WindowManager.CloseSessionExpiration().catch(console.error);
+                }
+            },
+        );
+        return () => {
+            off();
+        };
+    }, []);
+
+    const stay = useCallback(async () => {
+        if (busy) return;
+        setBusy(true);
+
+        let offCancel: (() => void) | undefined;
+
+        // Return the dialog to its interactive state and dismiss the browser popup
+        const resetDialog = () => {
+            offCancel?.();
+            WindowManager.CloseBrowserLogin().catch(console.error);
+            setBusy(false);
+        };
+
+        try {
+            const start = await Session.RequestExtend({ hint: "" });
+            const uri = start.verificationUriComplete || start.verificationUri;
+
+            // The popup opens the URL and (Go-side) hides this window, restoring it on close.
+            if (uri) {
+                try {
+                    await WindowManager.OpenBrowserLogin(uri);
+                } catch (e) {
+                    console.error(e);
+                }
+            }
+
+            const cancelPromise = new Promise<void>((resolve) => {
+                offCancel = Events.On(EVENT_BROWSER_LOGIN_CANCEL, () => {
+                    resolve();
+                });
+            });
+
+            const waitPromise = Session.WaitExtend({
+                deviceCode: start.deviceCode,
+                userCode: start.userCode,
+            });
+
+            const outcome = await Promise.race([
+                waitPromise.then((r) => ({ kind: "done" as const, result: r })),
+                cancelPromise.then(() => ({ kind: "cancel" as const })),
+            ]);
+
+            if (outcome.kind === "cancel") {
+                waitPromise.cancel?.();
+                waitPromise.catch(() => {});
+                resetDialog();
+                return;
+            }
+
+            // Another surface owns this flow; keep the dialog open to retry.
+            if (outcome.result.preempted) {
+                resetDialog();
+                return;
+            }
+            WindowManager.CloseRenewFlow().catch(console.error);
+        } catch (e) {
+            resetDialog();
+            await errorDialog({
+                Title: t("sessionExpiration.extendFailedTitle"),
+                Message: formatErrorMessage(e),
+            });
+        }
+    }, [busy, t]);
+
+    const authenticate = useCallback(async () => {
+        if (busy) return;
+        setBusy(true);
+        try {
+            await Events.Emit(EVENT_TRIGGER_LOGIN);
+            await WindowManager.CloseSessionExpiration();
+        } catch (e) {
+            setBusy(false);
+            await errorDialog({
+                Title: t("connect.error.loginTitle"),
+                Message: formatErrorMessage(e),
+            });
+        }
+    }, [busy, t]);
+
+    const logout = useCallback(async () => {
+        if (busy) return;
+        setBusy(true);
+        try {
+            const username = await ProfilesSvc.Username();
+            const active = await ProfilesSvc.GetActive();
+            await Connection.Logout({
+                profileName: active.id || "default",
+                username,
+            });
+            WindowManager.CloseSessionExpiration().catch(console.error);
+        } catch (e) {
+            setBusy(false);
+            await errorDialog({
+                Title: t("sessionExpiration.logoutFailedTitle"),
+                Message: formatErrorMessage(e),
+            });
+        }
+    }, [busy, t]);
+
+    const close = useCallback(() => {
+        WindowManager.CloseSessionExpiration().catch(console.error);
+    }, []);
+
+    return (
+        <ConfirmDialog ref={contentRef} aria-labelledby={"nb-session-expiration-title"}>
+            <SquareIcon icon={expired ? AlertCircleIcon : ClockIcon} />
+
+            <div className={"flex flex-col items-center gap-1"}>
+                <DialogHeading id={"nb-session-expiration-title"}>
+                    {expired ? t("sessionExpiration.expired") : activeTitle}
+                </DialogHeading>
+                <DialogDescription>
+                    {expired ? t("sessionExpiration.expiredDescription") : activeDescription}
+                </DialogDescription>
+            </div>
+
+            {!expired && (
+                <div
+                    className={
+                        "font-mono text-2xl font-semibold tabular-nums tracking-wider text-nb-gray-50"
+                    }
+                    aria-live={"polite"}
+                >
+                    {formatRemaining(remaining)}
+                </div>
+            )}
+
+            <DialogActions>
+                <Button
+                    autoFocus
+                    variant={"primary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={expired ? authenticate : stay}
+                    disabled={busy}
+                >
+                    {expired ? t("sessionExpiration.authenticate") : t("sessionExpiration.stay")}
+                </Button>
+                <Button
+                    variant={"secondary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={expired ? close : logout}
+                    disabled={busy}
+                >
+                    {expired ? t("sessionExpiration.close") : t("sessionExpiration.logout")}
+                </Button>
+            </DialogActions>
+        </ConfirmDialog>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsAbout.tsx b/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
new file mode 100644
index 000000000..7228e2a6c
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
@@ -0,0 +1,179 @@
+import type { ComponentType, SVGProps } from "react";
+import { useTranslation } from "react-i18next";
+import { Browser } from "@wailsio/runtime";
+import { BookOpen, MessageSquareText, MessagesSquare } from "lucide-react";
+import netbirdFull from "@/assets/logos/netbird-full.svg";
+import netbirdFullLight from "@/assets/logos/netbird-full-light.svg";
+
+// Brand glyphs from simpleicons.org (lucide deprecated its brand icons).
+const GithubIcon = (props: SVGProps<SVGSVGElement>) => (
+    <svg viewBox={"0 0 24 24"} fill={"currentColor"} {...props}>
+        <path
+            d={
+                "M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"
+            }
+        />
+    </svg>
+);
+const SlackIcon = (props: SVGProps<SVGSVGElement>) => (
+    <svg viewBox={"0 0 24 24"} fill={"currentColor"} {...props}>
+        <path
+            d={
+                "M5.042 15.165a2.528 2.528 0 0 1-2.52 2.523A2.528 2.528 0 0 1 0 15.165a2.527 2.527 0 0 1 2.522-2.52h2.52v2.52zM6.313 15.165a2.527 2.527 0 0 1 2.521-2.52 2.527 2.527 0 0 1 2.521 2.52v6.313A2.528 2.528 0 0 1 8.834 24a2.528 2.528 0 0 1-2.521-2.522v-6.313zM8.834 5.042a2.528 2.528 0 0 1-2.521-2.52A2.528 2.528 0 0 1 8.834 0a2.528 2.528 0 0 1 2.521 2.522v2.52H8.834zM8.834 6.313a2.528 2.528 0 0 1 2.521 2.521 2.528 2.528 0 0 1-2.521 2.521H2.522A2.528 2.528 0 0 1 0 8.834a2.528 2.528 0 0 1 2.522-2.521h6.312zM18.956 8.834a2.528 2.528 0 0 1 2.522-2.521A2.528 2.528 0 0 1 24 8.834a2.528 2.528 0 0 1-2.522 2.521h-2.522V8.834zM17.688 8.834a2.528 2.528 0 0 1-2.523 2.521 2.527 2.527 0 0 1-2.52-2.521V2.522A2.527 2.527 0 0 1 15.165 0a2.528 2.528 0 0 1 2.523 2.522v6.312zM15.165 18.956a2.528 2.528 0 0 1 2.523 2.522A2.528 2.528 0 0 1 15.165 24a2.527 2.527 0 0 1-2.52-2.522v-2.522h2.52zM15.165 17.688a2.527 2.527 0 0 1-2.52-2.523 2.526 2.526 0 0 1 2.52-2.52h6.313A2.527 2.527 0 0 1 24 15.165a2.528 2.528 0 0 1-2.522 2.523h-6.313z"
+            }
+        />
+    </svg>
+);
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+import { UpdateVersionCard } from "@/modules/auto-update/UpdateVersionCard";
+import { useAccentTrigger } from "@/modules/settings/SettingsAccent";
+
+function openUrl(url: string) {
+    Browser.OpenURL(url).catch(() => {
+        window.open(url, "_blank");
+    });
+}
+
+export function SettingsAbout() {
+    const { t } = useTranslation();
+    const { status } = useStatus();
+    const { guiVersion } = useSettings();
+    const daemonVersion = status?.daemonVersion ?? "—";
+
+    const handleVersionClick = useAccentTrigger();
+
+    const COMMUNITY_LINKS: {
+        label: string;
+        url: string;
+        Icon: ComponentType<SVGProps<SVGSVGElement>>;
+        iconClassName?: string;
+    }[] = [
+        {
+            label: t("settings.about.community.github"),
+            url: "https://github.com/netbirdio/netbird",
+            Icon: GithubIcon,
+            iconClassName: "h-3 w-3",
+        },
+        {
+            label: t("settings.about.community.slack"),
+            url: "https://docs.netbird.io/slack-url",
+            Icon: SlackIcon,
+            iconClassName: "h-3 w-3",
+        },
+        {
+            label: t("settings.about.community.forum"),
+            url: "https://forum.netbird.io",
+            Icon: MessagesSquare,
+        },
+        {
+            label: t("settings.about.community.documentation"),
+            url: "https://docs.netbird.io",
+            Icon: BookOpen,
+        },
+        {
+            label: t("settings.about.community.feedback"),
+            url: "https://forms.gle/TeLw2zrXEdw6RcQ36",
+            Icon: MessageSquareText,
+        },
+    ];
+
+    const LEGAL_LINKS: { label: string; url: string }[] = [
+        { label: t("settings.about.links.imprint"), url: "https://netbird.io/imprint" },
+        { label: t("settings.about.links.privacy"), url: "https://netbird.io/privacy" },
+        { label: t("settings.about.links.cla"), url: "https://netbird.io/cla" },
+        { label: t("settings.about.links.terms"), url: "https://netbird.io/terms" },
+    ];
+
+    return (
+        <div
+            className={
+                "mx-auto flex min-h-[calc(100vh-12rem)] max-w-2xl flex-col items-center justify-center gap-4"
+            }
+        >
+            <img
+                src={netbirdFullLight}
+                alt={t("common.netbird")}
+                className={"h-7 w-auto dark:hidden"}
+            />
+            <img
+                src={netbirdFull}
+                alt={t("common.netbird")}
+                className={"hidden h-7 w-auto dark:block"}
+            />
+            <div className={"flex flex-col items-center gap-0.5 text-center"}>
+                <button
+                    type={"button"}
+                    onClick={handleVersionClick}
+                    className={
+                        "cursor-text select-text bg-transparent text-sm font-semibold text-nb-gray-100 outline-none"
+                    }
+                >
+                    {daemonVersion === "development" ? (
+                        <span>
+                            {t("settings.about.clientName")}{" "}
+                            <span dir={"auto"} className={"font-mono text-yellow-400"}>
+                                {t("settings.about.development")}
+                            </span>
+                        </span>
+                    ) : (
+                        t("settings.about.client", { version: daemonVersion })
+                    )}
+                </button>
+                <p className={"cursor-text select-text text-sm font-medium text-nb-gray-250"}>
+                    {guiVersion === "development" ? (
+                        <span>
+                            {t("settings.about.guiName")}{" "}
+                            <span dir={"auto"} className={"font-mono text-yellow-400"}>
+                                {t("settings.about.development")}
+                            </span>
+                        </span>
+                    ) : (
+                        t("settings.about.gui", { version: guiVersion })
+                    )}
+                </p>
+            </div>
+
+            <UpdateVersionCard />
+
+            <p className={"mt-2 text-center text-sm text-nb-gray-300"}>
+                {t("settings.about.copyright", { year: new Date().getFullYear() })}
+            </p>
+            <div
+                className={"flex flex-wrap justify-center gap-x-4 gap-y-1 text-xs text-nb-gray-200"}
+            >
+                {COMMUNITY_LINKS.map(({ label, url, Icon, iconClassName }) => (
+                    <button
+                        key={url}
+                        type={"button"}
+                        tabIndex={0}
+                        onClick={() => openUrl(url)}
+                        className={
+                            "inline-flex items-center gap-1.5 rounded-sm decoration-[0.5px] underline-offset-4 outline-none transition hover:text-nb-gray-100 hover:underline focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940"
+                        }
+                    >
+                        <Icon aria-hidden={"true"} className={iconClassName ?? "h-3.5 w-3.5"} />
+                        <span>{label}</span>
+                    </button>
+                ))}
+            </div>
+            <div
+                className={"flex flex-wrap justify-center gap-x-4 gap-y-1 text-xs text-nb-gray-200"}
+            >
+                {LEGAL_LINKS.map((link) => (
+                    <button
+                        key={link.url}
+                        type={"button"}
+                        tabIndex={0}
+                        onClick={() => openUrl(link.url)}
+                        className={
+                            "rounded-sm decoration-[0.5px] underline-offset-4 outline-none transition hover:text-nb-gray-100 hover:underline focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940"
+                        }
+                    >
+                        {link.label}
+                    </button>
+                ))}
+            </div>
+        </div>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsAccent.tsx b/client/ui/frontend/src/modules/settings/SettingsAccent.tsx
new file mode 100644
index 000000000..37a22dcad
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsAccent.tsx
@@ -0,0 +1,263 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { createRoot } from "react-dom/client";
+import netbirdLogo from "@/assets/logos/netbird.svg";
+
+const scratch = new Uint32Array(1);
+
+function random() {
+    crypto.getRandomValues(scratch);
+    return scratch[0] / 2 ** 32;
+}
+
+type Mask = {
+    cols: number;
+    rows: number;
+    cells: Uint8Array;
+    seeds: Uint8Array;
+    glow: Float32Array;
+};
+
+export function useAccentTrigger() {
+    const clicksRef = useRef(0);
+    const lastClickRef = useRef(0);
+
+    return useCallback(() => {
+        const now = performance.now();
+        if (now - lastClickRef.current > 400) {
+            clicksRef.current = 0;
+        }
+        lastClickRef.current = now;
+        clicksRef.current += 1;
+        if (clicksRef.current >= 10) {
+            clicksRef.current = 0;
+            triggerAccent();
+        }
+    }, []);
+}
+
+function triggerAccent() {
+    if (document.getElementById("nb-accent-root")) return;
+
+    const container = document.createElement("div");
+    container.id = "nb-accent-root";
+    document.body.appendChild(container);
+    const root = createRoot(container);
+
+    const cleanup = () => {
+        root.unmount();
+        container.remove();
+    };
+
+    root.render(<Accent onDone={cleanup} />);
+}
+
+function Accent({ onDone }: Readonly<{ onDone: () => void }>) {
+    const canvasRef = useRef<HTMLCanvasElement>(null);
+    const [visible, setVisible] = useState(false);
+
+    useEffect(() => {
+        const raf = requestAnimationFrame(() => setVisible(true));
+        return () => cancelAnimationFrame(raf);
+    }, []);
+
+    useEffect(() => {
+        const canvas = canvasRef.current;
+        if (!canvas) return;
+        const ctx = canvas.getContext("2d");
+        if (!ctx) return;
+
+        const chars = "DRIBTENMAET".split("").reverse().join("");
+
+        let disposed = false;
+        let mask: Mask | null = null;
+
+        const dpr = window.devicePixelRatio || 1;
+        let columns = 0;
+        let drops: number[] = [];
+        let latestBuild = 0;
+        let rebuild: ReturnType<typeof setTimeout> | undefined;
+
+        const resize = () => {
+            canvas.width = window.innerWidth * dpr;
+            canvas.height = window.innerHeight * dpr;
+            canvas.style.width = `${window.innerWidth}px`;
+            canvas.style.height = `${window.innerHeight}px`;
+            ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+
+            const next = Math.floor(window.innerWidth / 15);
+            if (next !== columns) {
+                columns = next;
+                drops = Array.from({ length: columns }, () => random() * -60);
+                mask = null;
+            }
+
+            globalThis.clearTimeout(rebuild);
+            rebuild = globalThis.setTimeout(() => {
+                const build = ++latestBuild;
+                void buildMask().then((m) => {
+                    if (!disposed && build === latestBuild) mask = m;
+                });
+            }, 100);
+        };
+        resize();
+        window.addEventListener("resize", resize);
+
+        let raf = 0;
+        let last = 0;
+        let frame = 0;
+        const draw = (t: number) => {
+            if (t - last > 50) {
+                last = t;
+
+                ctx.globalCompositeOperation = "destination-out";
+                ctx.fillStyle = "rgba(0, 0, 0, 0.12)";
+                ctx.fillRect(0, 0, window.innerWidth, window.innerHeight);
+
+                ctx.globalCompositeOperation = "source-over";
+                ctx.font = "15px ui-monospace, monospace";
+                ctx.textBaseline = "top";
+
+                ctx.shadowBlur = 0;
+                ctx.fillStyle = "rgba(246, 131, 48, 0.5)";
+                for (let i = 0; i < drops.length; i++) {
+                    const ch = chars[Math.floor(random() * chars.length)];
+                    const y = drops[i] * 15;
+                    ctx.fillText(ch, i * 15, y);
+
+                    igniteTrail(mask, i, Math.floor(drops[i]));
+
+                    if (y > window.innerHeight && random() > 0.86) {
+                        drops[i] = random() * -12;
+                    }
+                    drops[i]++;
+                }
+
+                drawGlow(ctx, mask, frame, chars);
+                frame++;
+            }
+            raf = requestAnimationFrame(draw);
+        };
+        raf = requestAnimationFrame(draw);
+
+        const timeout = globalThis.setTimeout(() => {
+            setVisible(false);
+            globalThis.setTimeout(onDone, 500);
+        }, 9000);
+
+        return () => {
+            disposed = true;
+            cancelAnimationFrame(raf);
+            globalThis.clearTimeout(timeout);
+            globalThis.clearTimeout(rebuild);
+            window.removeEventListener("resize", resize);
+        };
+    }, [onDone]);
+
+    return (
+        <div
+            className={`pointer-events-none fixed inset-0 z-50 bg-black/5 transition-opacity duration-500 ${visible ? "opacity-100" : "opacity-0"}`}
+        >
+            <canvas ref={canvasRef} className={"block"} />
+        </div>
+    );
+}
+
+function igniteTrail(mask: Mask | null, col: number, row: number) {
+    if (!mask || col < 0 || col >= mask.cols) return;
+    for (let k = 0; k < 6; k++) {
+        const r = row - k;
+        if (r < 0 || r >= mask.rows) continue;
+        const idx = r * mask.cols + col;
+        if (mask.cells[idx] === 0) continue;
+        const heat = 1 - k / 6;
+        if (heat > mask.glow[idx]) mask.glow[idx] = heat;
+    }
+}
+
+function drawGlow(ctx: CanvasRenderingContext2D, mask: Mask | null, frame: number, chars: string) {
+    if (!mask) return;
+
+    for (let idx = 0; idx < mask.cells.length; idx++) {
+        const heat = fade(mask, idx);
+        if (heat === 0) continue;
+
+        const seed = mask.seeds[idx];
+        const core = mask.cells[idx] === 2;
+
+        ctx.shadowColor = core ? "#f05252" : "#f68330";
+        ctx.shadowBlur = 10 * heat;
+        ctx.fillStyle = core ? `rgba(255, 226, 210, ${heat})` : `rgba(255, 255, 255, ${heat})`;
+        ctx.fillText(
+            chars[(seed + Math.floor(frame / (3 + (seed % 5)))) % chars.length],
+            (idx % mask.cols) * 15,
+            Math.floor(idx / mask.cols) * 15,
+        );
+    }
+    ctx.shadowBlur = 0;
+}
+
+function fade(mask: Mask, idx: number) {
+    if (mask.cells[idx] === 0) return 0;
+
+    const heat = mask.glow[idx];
+    if (heat <= 0.02) {
+        mask.glow[idx] = 0;
+        return 0;
+    }
+    mask.glow[idx] = heat * 0.94;
+    return heat;
+}
+
+function loadLogo() {
+    return new Promise<HTMLImageElement>((resolve, reject) => {
+        const img = new Image();
+        img.onload = () => resolve(img);
+        img.onerror = reject;
+        img.src = netbirdLogo;
+    });
+}
+
+async function buildMask(): Promise<Mask | null> {
+    const cols = Math.floor(window.innerWidth / 15);
+    const rows = Math.ceil(window.innerHeight / 15);
+    if (cols <= 0 || rows <= 0) return null;
+
+    let img: HTMLImageElement;
+    try {
+        img = await loadLogo();
+    } catch {
+        return null;
+    }
+
+    const off = document.createElement("canvas");
+    off.width = cols;
+    off.height = rows;
+    const offCtx = off.getContext("2d", { willReadFrequently: true });
+    if (!offCtx) return null;
+
+    const aspect = (img.naturalWidth || 31) / (img.naturalHeight || 23);
+    let w = cols * 0.8;
+    let h = w / aspect;
+    if (h > rows * 0.8) {
+        h = rows * 0.8;
+        w = h * aspect;
+    }
+
+    offCtx.imageSmoothingEnabled = false;
+    offCtx.drawImage(img, (cols - w) / 2, (rows - h) / 2, w, h);
+
+    const { data } = offCtx.getImageData(0, 0, cols, rows);
+    const cells = new Uint8Array(cols * rows);
+    const seeds = new Uint8Array(cols * rows);
+    const glow = new Float32Array(cols * rows);
+    for (let i = 0; i < cells.length; i++) {
+        seeds[i] = Math.floor(random() * 251);
+        const alpha = data[i * 4 + 3];
+        if (alpha < 64) continue;
+        const r = data[i * 4];
+        const g = data[i * 4 + 1];
+        const b = data[i * 4 + 2];
+        cells[i] = r > 180 && g < 130 && b < 130 && g <= b + 24 ? 2 : 1;
+    }
+    return { cols, rows, cells, seeds, glow };
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx b/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
new file mode 100644
index 000000000..6cb54d124
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
@@ -0,0 +1,181 @@
+import { useEffect, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { System } from "@wailsio/runtime";
+import Button from "@/components/buttons/Button";
+import { HelpText } from "@/components/typography/HelpText";
+import { Input } from "@/components/inputs/Input";
+import { Label } from "@/components/typography/Label";
+import { SectionGroup, SettingsBottomBar } from "@/modules/settings/SettingsSection.tsx";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+// macOS daemon/CLI only accept utun<N> (Darwin parses digits as the utun unit); Linux caps at IFNAMSIZ-1 = 15 chars.
+const IS_MAC = System.IsMac();
+const INTERFACE_NAME_RE = IS_MAC ? /^utun\d+$/ : /^[A-Za-z0-9._-]{1,15}$/;
+const INTERFACE_NAME_ERROR_KEY = IS_MAC
+    ? "settings.advanced.interfaceName.errorMac"
+    : "settings.advanced.interfaceName.error";
+
+// Port 0 lets the daemon pick a random free port.
+const PORT_MIN = 0;
+const PORT_MAX = 65535;
+
+// Mirrors client/iface/iface.go MinMTU / MaxMTU.
+const MTU_MIN = 576;
+const MTU_MAX = 8192;
+
+const PSK_MASK = "**********";
+
+export function SettingsAdvanced() {
+    const { t } = useTranslation();
+    const { config, saveFields } = useSettings();
+    const { mdm } = useRestrictions();
+
+    const initialPsk = config.preSharedKeySet ? PSK_MASK : "";
+
+    const [values, setValues] = useState({
+        interfaceName: config.interfaceName,
+        wireguardPort: config.wireguardPort,
+        mtu: config.mtu,
+    });
+
+    const [pskInputValue, setPskInputValue] = useState(initialPsk);
+    const [saving, setSaving] = useState(false);
+
+    useEffect(() => {
+        setValues({
+            interfaceName: config.interfaceName,
+            wireguardPort: config.wireguardPort,
+            mtu: config.mtu,
+        });
+        setPskInputValue(config.preSharedKeySet ? PSK_MASK : "");
+    }, [config.interfaceName, config.wireguardPort, config.mtu, config.preSharedKeySet]);
+
+    const errors = useMemo(() => {
+        const out: { interfaceName?: string; wireguardPort?: string; mtu?: string } = {};
+        if (!INTERFACE_NAME_RE.test(values.interfaceName)) {
+            out.interfaceName = t(INTERFACE_NAME_ERROR_KEY);
+        }
+        if (
+            !Number.isInteger(values.wireguardPort) ||
+            values.wireguardPort < PORT_MIN ||
+            values.wireguardPort > PORT_MAX
+        ) {
+            out.wireguardPort = t("settings.advanced.port.error", {
+                min: PORT_MIN,
+                max: PORT_MAX,
+            });
+        }
+        if (!Number.isInteger(values.mtu) || values.mtu < MTU_MIN || values.mtu > MTU_MAX) {
+            out.mtu = t("settings.advanced.mtu.error", { min: MTU_MIN, max: MTU_MAX });
+        }
+        return out;
+    }, [values.interfaceName, values.wireguardPort, values.mtu, t]);
+
+    const filteredErrors = mdm.wireguardPort ? { ...errors, wireguardPort: undefined } : errors;
+    const hasErrors = Object.values(filteredErrors).some((v) => v !== undefined);
+    const pskChanged = pskInputValue !== initialPsk;
+    const hasChanges =
+        values.interfaceName !== config.interfaceName ||
+        (!mdm.wireguardPort && values.wireguardPort !== config.wireguardPort) ||
+        values.mtu !== config.mtu ||
+        (!mdm.preSharedKey && pskChanged);
+
+    const handleSave = async () => {
+        if (!hasChanges || saving || hasErrors) return;
+        setSaving(true);
+        try {
+            const partial: typeof values = { ...values };
+            if (mdm.wireguardPort) partial.wireguardPort = config.wireguardPort;
+
+            const pskEdited = !mdm.preSharedKey && pskChanged && pskInputValue !== PSK_MASK;
+            const pskOpts = pskEdited ? { preSharedKey: pskInputValue } : undefined;
+            await saveFields(partial, pskOpts);
+            if (pskEdited) setPskInputValue(pskInputValue === "" ? "" : PSK_MASK);
+        } finally {
+            setSaving(false);
+        }
+    };
+
+    return (
+        <>
+            <SectionGroup title={t("settings.advanced.section.interface")}>
+                <Input
+                    label={t("settings.advanced.interfaceName.label")}
+                    dir={"ltr"}
+                    value={values.interfaceName}
+                    error={errors.interfaceName}
+                    onChange={(e) => setValues((v) => ({ ...v, interfaceName: e.target.value }))}
+                    spellCheck={false}
+                    autoComplete={"off"}
+                    autoCorrect={"off"}
+                    autoCapitalize={"off"}
+                />
+                <div className={mdm.wireguardPort ? "" : "grid grid-cols-2 gap-4"}>
+                    {!mdm.wireguardPort && (
+                        <div>
+                            <Input
+                                label={t("settings.advanced.port.label")}
+                                type={"number"}
+                                min={PORT_MIN}
+                                max={PORT_MAX}
+                                value={values.wireguardPort}
+                                error={errors.wireguardPort}
+                                onChange={(e) =>
+                                    setValues((v) => ({
+                                        ...v,
+                                        wireguardPort: Number(e.target.value),
+                                    }))
+                                }
+                            />
+                            <HelpText className={"mt-1.5"}>
+                                {t("settings.advanced.port.help")}
+                            </HelpText>
+                        </div>
+                    )}
+                    <Input
+                        label={t("settings.advanced.mtu.label")}
+                        type={"number"}
+                        min={MTU_MIN}
+                        max={MTU_MAX}
+                        value={values.mtu}
+                        error={errors.mtu}
+                        onChange={(e) => setValues((v) => ({ ...v, mtu: Number(e.target.value) }))}
+                    />
+                </div>
+            </SectionGroup>
+
+            {!mdm.preSharedKey && (
+                <SectionGroup title={t("settings.advanced.section.security")}>
+                    <div>
+                        <Label as={"div"}>{t("settings.advanced.psk.label")}</Label>
+                        <HelpText>{t("settings.advanced.psk.help")}</HelpText>
+                        <Input
+                            type={"password"}
+                            dir={"ltr"}
+                            showPasswordToggle={pskInputValue !== PSK_MASK}
+                            placeholder={"kQv0qF3oQpJYdgD5mC9hL7sB2xZ8nT4eU6wY1aR3jK0="}
+                            value={pskInputValue}
+                            onChange={(e) => setPskInputValue(e.target.value)}
+                            spellCheck={false}
+                            autoComplete={"new-password"}
+                            autoCorrect={"off"}
+                            autoCapitalize={"off"}
+                        />
+                    </div>
+                </SectionGroup>
+            )}
+
+            <SettingsBottomBar>
+                <Button
+                    variant={"primary"}
+                    size={"md"}
+                    disabled={!hasChanges || saving || hasErrors}
+                    onClick={handleSave}
+                >
+                    {t("common.saveChanges")}
+                </Button>
+            </SettingsBottomBar>
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
new file mode 100644
index 000000000..06620614e
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
@@ -0,0 +1,127 @@
+import { useEffect, useId, useRef } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@/components/buttons/Button";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import { HelpText } from "@/components/typography/HelpText";
+import { Input } from "@/components/inputs/Input";
+import { Label } from "@/components/typography/Label";
+import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
+import { useAutostartSetting, useSettings } from "@/contexts/SettingsContext.tsx";
+import { ManagementServerSwitch } from "@/components/ManagementServerSwitch.tsx";
+import { ManagementMode, useManagementUrl } from "@/hooks/useManagementUrl.ts";
+import { LanguagePicker } from "@/components/LanguagePicker.tsx";
+import { ThemePicker } from "@/components/ThemePicker.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+import { useKeepConnectedOnQuit } from "@/hooks/useKeepConnectedOnQuit.ts";
+
+export function SettingsGeneral() {
+    const { t } = useTranslation();
+    const { config, setField } = useSettings();
+    const { autostart, setAutostartEnabled } = useAutostartSetting();
+    const { mode, setMode, setUrl, displayUrl, showError, canSave, save, checking, unreachable } =
+        useManagementUrl();
+    const { mdm, features } = useRestrictions();
+    const { keepConnected, setKeepConnectedOnQuit } = useKeepConnectedOnQuit();
+
+    const inputRef = useRef<HTMLInputElement>(null);
+    const managementUrlId = useId();
+    const prevMode = useRef(mode);
+    useEffect(() => {
+        if (prevMode.current === ManagementMode.Cloud && mode === ManagementMode.SelfHosted) {
+            inputRef.current?.focus();
+        }
+        prevMode.current = mode;
+    }, [mode]);
+
+    return (
+        <>
+            <SectionGroup title={t("settings.general.section.general")}>
+                <LanguagePicker />
+                <ThemePicker />
+                <FancyToggleSwitch
+                    value={!config.disableNotifications}
+                    onChange={(v) => setField("disableNotifications", !v)}
+                    label={t("settings.general.notifications.label")}
+                    helpText={t("settings.general.notifications.help")}
+                />
+                {!mdm.disableAutoConnect && !features.disableUpdateSettings && (
+                    <FancyToggleSwitch
+                        value={!config.disableAutoConnect}
+                        onChange={(v) => setField("disableAutoConnect", !v)}
+                        label={t("settings.general.connectOnStartup.label")}
+                        helpText={t("settings.general.connectOnStartup.help")}
+                    />
+                )}
+                {(autostart === null || autostart.supported) && (
+                    <FancyToggleSwitch
+                        value={autostart?.enabled ?? false}
+                        onChange={setAutostartEnabled}
+                        loading={autostart === null}
+                        label={t("settings.general.autostart.label")}
+                        helpText={t("settings.general.autostart.help")}
+                    />
+                )}
+                <FancyToggleSwitch
+                    value={keepConnected ?? false}
+                    onChange={(v) => {
+                        void setKeepConnectedOnQuit(v);
+                    }}
+                    loading={keepConnected === null}
+                    label={t("settings.general.keepConnectedOnQuit.label")}
+                    helpText={t("settings.general.keepConnectedOnQuit.help")}
+                />
+            </SectionGroup>
+
+            {!mdm.managementURL && !features.disableUpdateSettings && (
+                <SectionGroup title={t("settings.general.section.connection")}>
+                    <div>
+                        <div className={"flex items-start gap-3"}>
+                            <div className={"min-w-0 flex-1"}>
+                                <Label htmlFor={managementUrlId}>
+                                    {t("settings.general.management.label")}
+                                </Label>
+                                <HelpText>{t("settings.general.management.help")}</HelpText>
+                            </div>
+                            <ManagementServerSwitch value={mode} onChange={setMode} />
+                        </div>
+                        {mode === ManagementMode.SelfHosted && (
+                            <div className={"mt-2 flex items-start gap-3"}>
+                                <Input
+                                    id={managementUrlId}
+                                    dir={"ltr"}
+                                    ref={inputRef}
+                                    value={displayUrl}
+                                    onChange={(e) => setUrl(e.target.value)}
+                                    placeholder={t("settings.general.management.urlPlaceholder")}
+                                    error={
+                                        showError
+                                            ? t("settings.general.management.urlError")
+                                            : undefined
+                                    }
+                                    warning={
+                                        unreachable
+                                            ? t("settings.general.management.urlUnreachable")
+                                            : undefined
+                                    }
+                                    spellCheck={false}
+                                    autoComplete={"off"}
+                                    autoCorrect={"off"}
+                                    autoCapitalize={"off"}
+                                />
+                                <Button
+                                    variant={"primary"}
+                                    size={"md"}
+                                    disabled={!canSave}
+                                    loading={checking}
+                                    onClick={() => save()}
+                                >
+                                    {t("common.save")}
+                                </Button>
+                            </div>
+                        )}
+                    </div>
+                </SectionGroup>
+            )}
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsNavigation.tsx b/client/ui/frontend/src/modules/settings/SettingsNavigation.tsx
new file mode 100644
index 000000000..816dcb71f
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsNavigation.tsx
@@ -0,0 +1,87 @@
+import { useTranslation } from "react-i18next";
+import { Tooltip } from "@/components/Tooltip.tsx";
+import { VerticalTabs } from "@/components/VerticalTabs.tsx";
+import { UpdateBadge } from "@/modules/auto-update/UpdateBadge.tsx";
+import { useClientVersion } from "@/contexts/ClientVersionContext.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+import {
+    BoltIcon,
+    InfoIcon,
+    LifeBuoyIcon,
+    NetworkIcon,
+    ShieldIcon,
+    SlidersHorizontalIcon,
+    SquareTerminalIcon,
+    UserCircleIcon,
+} from "lucide-react";
+
+export const SettingsNavigation = () => {
+    const { t } = useTranslation();
+    const { updateAvailable } = useClientVersion();
+    const { mdm, features } = useRestrictions();
+    const showSsh = mdm.allowServerSSH ?? !features.disableUpdateSettings;
+
+    const aboutAdornment = updateAvailable ? (
+        <Tooltip content={t("settings.tabs.updateAvailable")} side={"right"}>
+            <UpdateBadge />
+        </Tooltip>
+    ) : undefined;
+
+    return (
+        <div className={"flex w-52 shrink-0 select-none flex-col items-center"}>
+            <VerticalTabs.List aria-label={t("settings.nav.label")}>
+                <VerticalTabs.Trigger
+                    value={"general"}
+                    icon={SlidersHorizontalIcon}
+                    title={t("settings.tabs.general")}
+                />
+                {!features.disableUpdateSettings && (
+                    <>
+                        <VerticalTabs.Trigger
+                            value={"network"}
+                            icon={NetworkIcon}
+                            title={t("settings.tabs.network")}
+                        />
+                        <VerticalTabs.Trigger
+                            value={"security"}
+                            icon={ShieldIcon}
+                            title={t("settings.tabs.security")}
+                        />
+                    </>
+                )}
+                {!features.disableProfiles && (
+                    <VerticalTabs.Trigger
+                        value={"profiles"}
+                        icon={UserCircleIcon}
+                        title={t("settings.tabs.profiles")}
+                    />
+                )}
+                {showSsh && (
+                    <VerticalTabs.Trigger
+                        value={"ssh"}
+                        icon={SquareTerminalIcon}
+                        title={t("settings.tabs.ssh")}
+                    />
+                )}
+                {!features.disableUpdateSettings && (
+                    <VerticalTabs.Trigger
+                        value={"advanced"}
+                        icon={BoltIcon}
+                        title={t("settings.tabs.advanced")}
+                    />
+                )}
+                <VerticalTabs.Trigger
+                    value={"troubleshooting"}
+                    icon={LifeBuoyIcon}
+                    title={t("settings.tabs.troubleshooting")}
+                />
+                <VerticalTabs.Trigger
+                    value={"about"}
+                    icon={InfoIcon}
+                    title={t("settings.tabs.about")}
+                    adornment={aboutAdornment}
+                />
+            </VerticalTabs.List>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/modules/settings/SettingsNetwork.tsx b/client/ui/frontend/src/modules/settings/SettingsNetwork.tsx
new file mode 100644
index 000000000..7c903b634
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsNetwork.tsx
@@ -0,0 +1,55 @@
+import { useTranslation } from "react-i18next";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+export function SettingsNetwork() {
+    const { t } = useTranslation();
+    const { config, setField } = useSettings();
+    const { mdm } = useRestrictions();
+
+    return (
+        <>
+            <SectionGroup title={t("settings.network.section.connectivity")}>
+                <FancyToggleSwitch
+                    value={config.networkMonitor}
+                    onChange={(v) => setField("networkMonitor", v)}
+                    label={t("settings.network.monitor.label")}
+                    helpText={t("settings.network.monitor.help")}
+                />
+            </SectionGroup>
+
+            <SectionGroup title={t("settings.network.section.routingDns")}>
+                <FancyToggleSwitch
+                    value={!config.disableDns}
+                    onChange={(v) => setField("disableDns", !v)}
+                    label={t("settings.network.dns.label")}
+                    helpText={t("settings.network.dns.help")}
+                />
+                {!mdm.disableClientRoutes && (
+                    <FancyToggleSwitch
+                        value={!config.disableClientRoutes}
+                        onChange={(v) => setField("disableClientRoutes", !v)}
+                        label={t("settings.network.clientRoutes.label")}
+                        helpText={t("settings.network.clientRoutes.help")}
+                    />
+                )}
+                {!mdm.disableServerRoutes && (
+                    <FancyToggleSwitch
+                        value={!config.disableServerRoutes}
+                        onChange={(v) => setField("disableServerRoutes", !v)}
+                        label={t("settings.network.serverRoutes.label")}
+                        helpText={t("settings.network.serverRoutes.help")}
+                    />
+                )}
+                <FancyToggleSwitch
+                    value={!config.disableIpv6}
+                    onChange={(v) => setField("disableIpv6", !v)}
+                    label={t("settings.network.ipv6.label")}
+                    helpText={t("settings.network.ipv6.help")}
+                />
+            </SectionGroup>
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsPage.tsx b/client/ui/frontend/src/modules/settings/SettingsPage.tsx
new file mode 100644
index 000000000..9fb6e2129
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsPage.tsx
@@ -0,0 +1,134 @@
+import { useEffect, useMemo, useState, type ReactNode } from "react";
+import { useLocation } from "react-router-dom";
+import { Events } from "@wailsio/runtime";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { cn } from "@/lib/cn";
+import { isMacOS } from "@/lib/platform";
+import { AppRightPanel } from "@/layouts/AppRightPanel.tsx";
+import { VerticalTabs } from "@/components/VerticalTabs.tsx";
+import { SettingsNavigation } from "@/modules/settings/SettingsNavigation.tsx";
+import { AutostartSettingsProvider, SettingsProvider } from "@/contexts/SettingsContext.tsx";
+import { SettingsGeneral } from "@/modules/settings/SettingsGeneral.tsx";
+import { SettingsNetwork } from "@/modules/settings/SettingsNetwork.tsx";
+import { SettingsSecurity } from "@/modules/settings/SettingsSecurity.tsx";
+import { ProfilesTab } from "@/modules/profiles/ProfilesTab.tsx";
+import { SettingsSSH } from "@/modules/settings/SettingsSSH.tsx";
+import { SettingsAdvanced } from "@/modules/settings/SettingsAdvanced.tsx";
+import { SettingsTroubleshooting } from "@/modules/settings/SettingsTroubleshooting.tsx";
+import { SettingsAbout } from "@/modules/settings/SettingsAbout.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+import { useDirection } from "@/hooks/useDirection";
+
+const EVENT_SETTINGS_OPEN = "netbird:settings:open";
+
+const enum Tab {
+    General = "general",
+    Network = "network",
+    Security = "security",
+    Profiles = "profiles",
+    SSH = "ssh",
+    Advanced = "advanced",
+    Troubleshooting = "troubleshooting",
+    About = "about",
+}
+
+const TAB_CONTENT: Record<Tab, ReactNode> = {
+    [Tab.General]: <SettingsGeneral />,
+    [Tab.Network]: <SettingsNetwork />,
+    [Tab.Security]: <SettingsSecurity />,
+    [Tab.Profiles]: <ProfilesTab />,
+    [Tab.SSH]: <SettingsSSH />,
+    [Tab.Advanced]: <SettingsAdvanced />,
+    [Tab.Troubleshooting]: <SettingsTroubleshooting />,
+    [Tab.About]: <SettingsAbout />,
+};
+
+export const SettingsPage = () => {
+    const dir = useDirection();
+    const location = useLocation();
+    const navState = location.state as { tab?: string } | null;
+    const { mdm, features } = useRestrictions();
+
+    const visibleTabs = useMemo<Tab[]>(() => {
+        const editable = !features.disableUpdateSettings;
+        const visibility: Record<Tab, boolean> = {
+            [Tab.General]: true,
+            [Tab.Network]: editable,
+            [Tab.Security]: editable,
+            [Tab.Profiles]: !features.disableProfiles,
+            [Tab.SSH]: mdm.allowServerSSH ?? editable,
+            [Tab.Advanced]: editable,
+            [Tab.Troubleshooting]: true,
+            [Tab.About]: true,
+        };
+        return (Object.keys(visibility) as Tab[]).filter((t) => visibility[t]);
+    }, [features.disableUpdateSettings, features.disableProfiles, mdm.allowServerSSH]);
+
+    const defaultTab = visibleTabs[0];
+    const [active, setActive] = useState<string>(() => navState?.tab ?? defaultTab);
+
+    useEffect(() => {
+        if (navState?.tab) setActive(navState.tab);
+    }, [navState?.tab, location.key]);
+
+    useEffect(() => {
+        return Events.On(EVENT_SETTINGS_OPEN, (e: { data: string }) => {
+            setActive(e.data || defaultTab);
+        });
+    }, [defaultTab]);
+
+    // Reset active tab if it got disabled by any feature flag or mdm restrictions
+    useEffect(() => {
+        if (!visibleTabs.includes(active as Tab)) setActive(defaultTab);
+    }, [visibleTabs, active, defaultTab]);
+
+    return (
+        <>
+            {isMacOS() ? (
+                <div className={"wails-draggable h-12 shrink-0 cursor-default select-none"} />
+            ) : (
+                <div className={"h-px shrink-0 bg-nb-gray-920/0"} />
+            )}
+            <main className={"flex min-h-0 flex-1"}>
+                <VerticalTabs value={active} onValueChange={setActive}>
+                    <SettingsNavigation />
+                    <AppRightPanel>
+                        <AutostartSettingsProvider>
+                            <SettingsProvider>
+                                <ScrollArea.Root
+                                    dir={dir}
+                                    key={active}
+                                    type={"auto"}
+                                    className={"min-h-0 flex-1 overflow-hidden"}
+                                >
+                                    <ScrollArea.Viewport className={"h-full w-full"}>
+                                        <div className={"px-7 py-6"}>
+                                            {visibleTabs.map((tab) => (
+                                                <VerticalTabs.Content key={tab} value={tab}>
+                                                    {TAB_CONTENT[tab]}
+                                                </VerticalTabs.Content>
+                                            ))}
+                                        </div>
+                                    </ScrollArea.Viewport>
+                                    <ScrollArea.Scrollbar
+                                        orientation={"vertical"}
+                                        className={cn(
+                                            "flex touch-none select-none transition-colors",
+                                            "w-1.5 bg-transparent py-1",
+                                        )}
+                                    >
+                                        <ScrollArea.Thumb
+                                            className={
+                                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                                            }
+                                        />
+                                    </ScrollArea.Scrollbar>
+                                </ScrollArea.Root>
+                            </SettingsProvider>
+                        </AutostartSettingsProvider>
+                    </AppRightPanel>
+                </VerticalTabs>
+            </main>
+        </>
+    );
+};
diff --git a/client/ui/frontend/src/modules/settings/SettingsSSH.tsx b/client/ui/frontend/src/modules/settings/SettingsSSH.tsx
new file mode 100644
index 000000000..d74afae73
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsSSH.tsx
@@ -0,0 +1,284 @@
+import { type TFunction } from "i18next";
+import { useTranslation } from "react-i18next";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import { HelpText } from "@/components/typography/HelpText";
+import { Input } from "@/components/inputs/Input";
+import { Label } from "@/components/typography/Label";
+import { cn } from "@/lib/cn";
+import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
+import { type GuardedField, useSettings } from "@/contexts/SettingsContext.tsx";
+import { usePrivilege } from "@/hooks/usePrivilege.ts";
+import type { Privilege } from "@bindings/services/models.js";
+import { type ChangeEvent, type ReactNode, useEffect, useId, useState } from "react";
+
+export function SettingsSSH() {
+    const { t } = useTranslation();
+    const { config, setField, saveGuardedField } = useSettings();
+    const privilege = usePrivilege();
+    // The field whose elevation prompt is currently up, if any. The prompt is
+    // modal to the operating system, not to us, so the guarded controls are held
+    // still meanwhile rather than allowed to stack a second one behind it.
+    const [authorizing, setAuthorizing] = useState<GuardedField | null>(null);
+    const isSSHServerEnabled = config.serverSshAllowed;
+
+    const authorize = async (field: GuardedField, value: boolean) => {
+        setAuthorizing(field);
+        try {
+            await saveGuardedField(field, value);
+        } finally {
+            setAuthorizing(null);
+        }
+    };
+
+    // The daemon restricts only the direction that hands out shells from a process
+    // running as root: for all three settings that is switching the field on.
+    //
+    // An unprivileged user gets that direction routed through the platform's
+    // elevation prompt where there is one to raise, and otherwise the old
+    // arrangement, where the control is either unavailable (it is off and only a
+    // privileged caller could turn it on) or a one-way switch (it is on, they may
+    // turn it off but not back on) with the command that does it.
+    //
+    // A null privilege means we could not determine it: leave the control alone
+    // rather than greying it out with nothing to explain why. The daemon enforces
+    // this regardless, and a rejected save reports its own guidance.
+    const guarded = (
+        field: GuardedField,
+        command: (p: Privilege) => string,
+        // inverted marks a control whose guarded direction is switching it off, so
+        // the one-way warning has to read the other way round.
+        inverted = false,
+    ) => {
+        const plain = (value: boolean) => setField(field, value);
+        if (!privilege || privilege.privileged) {
+            return { apply: plain, disabled: false, hint: undefined };
+        }
+
+        const guardedDirectionActive = config[field];
+        const hint = (pending: boolean, command?: string) => (
+            <GuardedHint
+                actor={actorLabel(privilege, t)}
+                oneWay={guardedDirectionActive}
+                inverted={inverted}
+                pending={pending}
+                command={command}
+            />
+        );
+
+        if (privilege.canElevate) {
+            return {
+                // Switching off is ours to do; only switching on is authorized.
+                apply: (value: boolean) => {
+                    if (!value) {
+                        plain(value);
+                        return;
+                    }
+                    void authorize(field, value);
+                },
+                disabled: authorizing !== null,
+                hint: hint(authorizing === field),
+            };
+        }
+        return {
+            apply: plain,
+            disabled: !guardedDirectionActive,
+            hint: hint(false, command(privilege)),
+        };
+    };
+
+    const sshServer = guarded("serverSshAllowed", (p) => p.allowSshServer);
+    const sshRoot = guarded("enableSshRoot", (p) => p.enableSshRoot);
+    // Inverted control: the guarded direction is switching authentication off, so
+    // it is the already-disabled state that is the one-way one.
+    const sshAuth = guarded("disableSshAuth", (p) => p.disableSshAuth, true);
+    const jwtTtlId = useId();
+    const [jwtTtlInput, setJwtTtlInput] = useState(String(config.sshJwtCacheTtl));
+
+    useEffect(() => {
+        setJwtTtlInput(String(config.sshJwtCacheTtl));
+    }, [config.sshJwtCacheTtl]);
+
+    const handleJwtTtlChange = (e: ChangeEvent<HTMLInputElement>) => {
+        const v = e.target.value;
+        setJwtTtlInput(v);
+        if (v === "") return;
+        const n = Number(v);
+        if (Number.isFinite(n) && n >= 0) {
+            setField("sshJwtCacheTtl", n);
+        }
+    };
+
+    const handleJwtTtlBlur = () => {
+        if (jwtTtlInput === "") {
+            setJwtTtlInput("0");
+            setField("sshJwtCacheTtl", 0);
+            return;
+        }
+        const n = Number(jwtTtlInput);
+        if (!Number.isFinite(n) || n < 0) {
+            setJwtTtlInput(String(config.sshJwtCacheTtl));
+        }
+    };
+    return (
+        <>
+            <SectionGroup title={t("settings.ssh.section.server")}>
+                <FancyToggleSwitch
+                    value={config.serverSshAllowed}
+                    onChange={sshServer.apply}
+                    disabled={sshServer.disabled}
+                    label={t("settings.ssh.server.label")}
+                    helpText={t("settings.ssh.server.help")}
+                />
+                {sshServer.hint}
+            </SectionGroup>
+
+            <SectionGroup
+                title={t("settings.ssh.section.capabilities")}
+                disabled={!isSSHServerEnabled}
+            >
+                <FancyToggleSwitch
+                    value={config.enableSshRoot}
+                    onChange={sshRoot.apply}
+                    disabled={sshRoot.disabled}
+                    label={t("settings.ssh.root.label")}
+                    helpText={t("settings.ssh.root.help")}
+                />
+                {sshRoot.hint}
+                <FancyToggleSwitch
+                    value={config.enableSshSftp}
+                    onChange={(v) => setField("enableSshSftp", v)}
+                    label={t("settings.ssh.sftp.label")}
+                    helpText={t("settings.ssh.sftp.help")}
+                />
+                <FancyToggleSwitch
+                    value={config.enableSshLocalPortForwarding}
+                    onChange={(v) => setField("enableSshLocalPortForwarding", v)}
+                    label={t("settings.ssh.localForward.label")}
+                    helpText={t("settings.ssh.localForward.help")}
+                />
+                <FancyToggleSwitch
+                    value={config.enableSshRemotePortForwarding}
+                    onChange={(v) => setField("enableSshRemotePortForwarding", v)}
+                    label={t("settings.ssh.remoteForward.label")}
+                    helpText={t("settings.ssh.remoteForward.help")}
+                />
+            </SectionGroup>
+
+            <SectionGroup
+                title={t("settings.ssh.section.authentication")}
+                disabled={!isSSHServerEnabled}
+            >
+                <FancyToggleSwitch
+                    value={!config.disableSshAuth}
+                    onChange={(v) => sshAuth.apply(!v)}
+                    disabled={sshAuth.disabled}
+                    label={t("settings.ssh.jwt.label")}
+                    helpText={t("settings.ssh.jwt.help")}
+                />
+                {sshAuth.hint}
+                <div
+                    className={cn(
+                        "flex items-center justify-between gap-6",
+                        config.disableSshAuth && "pointer-events-none opacity-50",
+                    )}
+                >
+                    <div className={"max-w-md flex-1"}>
+                        <Label htmlFor={jwtTtlId}>{t("settings.ssh.jwtTtl.label")}</Label>
+                        <HelpText margin={false}>{t("settings.ssh.jwtTtl.help")}</HelpText>
+                    </div>
+                    <div className={"w-40 shrink-0"}>
+                        <Input
+                            id={jwtTtlId}
+                            type={"number"}
+                            min={0}
+                            value={jwtTtlInput}
+                            onChange={handleJwtTtlChange}
+                            onBlur={handleJwtTtlBlur}
+                            customSuffix={t("settings.ssh.jwtTtl.suffix")}
+                        />
+                    </div>
+                </div>
+            </SectionGroup>
+        </>
+    );
+}
+
+// actorLabel names the principal the daemon requires, in the user's language. The
+// Go side reports which one it is rather than wording it, because "administrator
+// privileges" is English and a translated sentence cannot borrow it.
+function actorLabel(privilege: Privilege, t: TFunction): string {
+    return privilege.actorKey === "administrator"
+        ? t("settings.ssh.privilege.actorAdministrator")
+        : t("settings.ssh.privilege.actorRoot");
+}
+
+// GuardedHint is what a control the daemon guards says to an unprivileged user.
+// There are three things worth saying, and it says at most one:
+//
+//   - A prompt is open. Worth a line because it can take a few seconds to appear,
+//     long enough that a control which merely went inert would read as a hang.
+//   - The setting is in its guarded state already (oneWay), so the user may switch
+//     it back as they please and it is switching it away again that will ask. No
+//     command either way: the direction they can take is theirs to take.
+//   - Only a privileged caller can move it at all, and there is no prompt to
+//     raise: the command that does it belongs here, and nothing else will do.
+//
+// Which leaves the case of a control whose guarded direction is still ahead of the
+// user and a prompt that can be raised for it: nothing to say, because clicking it
+// raises the prompt and the prompt explains itself.
+function GuardedHint({
+    actor,
+    oneWay,
+    inverted,
+    pending,
+    command,
+}: {
+    actor: string;
+    oneWay: boolean;
+    inverted: boolean;
+    pending: boolean;
+    command?: string;
+}): ReactNode {
+    const { t } = useTranslation();
+
+    if (pending) {
+        return <HintBox>{t("settings.ssh.privilege.authorizePending")}</HintBox>;
+    }
+    if (oneWay) {
+        return (
+            <HintBox>
+                <span>
+                    {inverted
+                        ? t("settings.ssh.privilege.oneWayInverted", { actor })
+                        : t("settings.ssh.privilege.oneWay", { actor })}
+                </span>
+            </HintBox>
+        );
+    }
+    if (!command) return null;
+    return (
+        <HintBox>
+            <span>{t("settings.ssh.privilege.hint", { actor })}</span>
+            <CopyToClipboard message={command} alwaysShowIcon wrap variant={"bright"}>
+                <code className={"select-text break-all font-mono text-xs text-nb-gray-200"}>
+                    {command}
+                </code>
+            </CopyToClipboard>
+        </HintBox>
+    );
+}
+
+// HintBox is the box a guarded control puts its explanation in, directly under the
+// control it belongs to.
+function HintBox({ children }: { children: ReactNode }): ReactNode {
+    return (
+        <div
+            className={
+                "-mt-2 flex flex-col gap-1 rounded-md bg-nb-gray-930 px-3 py-2 text-xs text-nb-gray-300"
+            }
+        >
+            {children}
+        </div>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsSection.tsx b/client/ui/frontend/src/modules/settings/SettingsSection.tsx
new file mode 100644
index 000000000..3a39d661f
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsSection.tsx
@@ -0,0 +1,43 @@
+import type { ReactNode } from "react";
+import { cn } from "@/lib/cn";
+
+export const SectionGroup = ({
+    title,
+    children,
+    disabled = false,
+}: {
+    title: string;
+    children: ReactNode;
+    disabled?: boolean;
+}) => (
+    <section
+        aria-label={title}
+        tabIndex={disabled ? -1 : 0}
+        {...(disabled ? { inert: "" } : {})}
+        className={cn(
+            "mb-8 rounded-md px-1 outline-none last:mb-1",
+            "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+            disabled && "pointer-events-none opacity-30",
+        )}
+    >
+        <h2 className={"mb-4 text-xs font-semibold uppercase tracking-wider text-nb-gray-400"}>
+            {title}
+        </h2>
+        <div className={"flex flex-col gap-5"}>{children}</div>
+    </section>
+);
+
+export const SettingsBottomBar = ({ children }: { children: ReactNode }) => (
+    <>
+        <div className={"h-[3.2rem] shrink-0"} aria-hidden={"true"} />
+        <div className={"absolute bottom-0 start-0 w-full"}>
+            <div
+                className={
+                    "flex w-full justify-end gap-3 border-t border-nb-gray-800 bg-nb-gray-940 px-8 py-5 dark:border-nb-gray-920"
+                }
+            >
+                {children}
+            </div>
+        </div>
+    </>
+);
diff --git a/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx b/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx
new file mode 100644
index 000000000..db1ad9c8f
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx
@@ -0,0 +1,61 @@
+import { useTranslation } from "react-i18next";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+export function SettingsSecurity() {
+    const { t } = useTranslation();
+    const { config, setField } = useSettings();
+    const { mdm } = useRestrictions();
+    const hideRosenpassEnabled = mdm.rosenpassEnabled;
+    const hideRosenpassPermissive =
+        mdm.rosenpassPermissive || (mdm.rosenpassEnabled && !config.rosenpassEnabled);
+    const showEncryptionSection = !(hideRosenpassEnabled && hideRosenpassPermissive);
+
+    return (
+        <>
+            <SectionGroup title={t("settings.security.section.firewall")}>
+                {!mdm.blockInbound && (
+                    <FancyToggleSwitch
+                        value={config.blockInbound}
+                        onChange={(v) => setField("blockInbound", v)}
+                        label={t("settings.security.blockInbound.label")}
+                        helpText={t("settings.security.blockInbound.help")}
+                    />
+                )}
+                <FancyToggleSwitch
+                    value={config.blockLanAccess}
+                    onChange={(v) => setField("blockLanAccess", v)}
+                    label={t("settings.security.blockLan.label")}
+                    helpText={t("settings.security.blockLan.help")}
+                />
+            </SectionGroup>
+
+            {showEncryptionSection && (
+                <SectionGroup title={t("settings.security.section.encryption")}>
+                    {!hideRosenpassEnabled && (
+                        <FancyToggleSwitch
+                            value={config.rosenpassEnabled}
+                            onChange={(v) => {
+                                setField("rosenpassEnabled", v);
+                                if (!v) setField("rosenpassPermissive", false);
+                            }}
+                            label={t("settings.security.rosenpass.label")}
+                            helpText={t("settings.security.rosenpass.help")}
+                        />
+                    )}
+                    {!hideRosenpassPermissive && (
+                        <FancyToggleSwitch
+                            value={config.rosenpassPermissive}
+                            onChange={(v) => setField("rosenpassPermissive", v)}
+                            label={t("settings.security.rosenpassPermissive.label")}
+                            helpText={t("settings.security.rosenpassPermissive.help")}
+                            disabled={!config.rosenpassEnabled}
+                        />
+                    )}
+                </SectionGroup>
+            )}
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsSkeleton.tsx b/client/ui/frontend/src/modules/settings/SettingsSkeleton.tsx
new file mode 100644
index 000000000..afce192e6
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsSkeleton.tsx
@@ -0,0 +1,27 @@
+import Skeleton from "react-loading-skeleton";
+
+export const SettingsSkeleton = () => {
+    return (
+        <div className={"flex flex-col gap-6"}>
+            <div>
+                <Skeleton width={100} height={16} className={"mb-4"} />
+                <div>
+                    <Skeleton width={100} height={14} />
+                    <Skeleton width={400} height={10} />
+                </div>
+                <div className={"mt-3"}>
+                    <Skeleton width={100} height={14} />
+                    <Skeleton width={400} height={10} />
+                </div>
+            </div>
+            <div>
+                <Skeleton width={100} height={16} className={"mb-4"} />
+                <div>
+                    <Skeleton width={100} height={14} />
+                    <Skeleton width={400} height={10} />
+                    <Skeleton width={300} height={10} />
+                </div>
+            </div>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx b/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
new file mode 100644
index 000000000..de7b2cba2
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
@@ -0,0 +1,391 @@
+import { useId, type ReactNode } from "react";
+import { Trans, useTranslation } from "react-i18next";
+import {
+    CircleCheckBig,
+    FolderOpen,
+    Info,
+    Loader2,
+    Shield,
+    ShieldCheck,
+    ShieldOff,
+    type LucideIcon,
+} from "lucide-react";
+import { Browser } from "@wailsio/runtime";
+import { Debug as DebugSvc } from "@bindings/services";
+import type { DebugBundleResult } from "@bindings/services/models.js";
+import { Button } from "@/components/buttons/Button";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import HelpText from "@/components/typography/HelpText.tsx";
+import { Input } from "@/components/inputs/Input";
+import { Label } from "@/components/typography/Label";
+import { Select } from "@/components/inputs/Select";
+import { SquareIcon } from "@/components/SquareIcon";
+import { Tooltip } from "@/components/Tooltip";
+import { formatRemaining } from "@/lib/formatters";
+import type { AnonymizeLevel, DebugStage } from "@/contexts/DebugBundleContext";
+import { useDebugBundleContext } from "@/contexts/DebugBundleContext";
+import { SectionGroup, SettingsBottomBar } from "@/modules/settings/SettingsSection.tsx";
+
+const SUPPORT_DOCS_URL = "https://docs.netbird.io/help/report-bug-issues";
+
+const ANONYMIZE_LEVELS: { value: AnonymizeLevel; icon: LucideIcon }[] = [
+    { value: "none", icon: ShieldOff },
+    { value: "default", icon: Shield },
+    { value: "strict", icon: ShieldCheck },
+];
+
+export function SettingsTroubleshooting() {
+    const { t } = useTranslation();
+    const durationId = useId();
+    const {
+        anonymizeLevel,
+        setAnonymizeLevel,
+        systemInfo,
+        setSystemInfo,
+        upload,
+        setUpload,
+        trace,
+        setTrace,
+        capture,
+        setCapture,
+        traceMinutes,
+        setTraceMinutes,
+        capturePackets,
+        setCapturePackets,
+        run,
+        stage,
+        cancel,
+        reset,
+    } = useDebugBundleContext();
+
+    if (stage.kind === "done") {
+        return (
+            <DoneResult result={stage.result} uploaded={stage.uploadAttempted} onClose={reset} />
+        );
+    }
+    if (stage.kind !== "idle") {
+        return <ProgressSection stage={stage} onCancel={cancel} />;
+    }
+
+    return (
+        <SectionGroup title={t("settings.troubleshooting.section.title")}>
+            <div className={"flex items-center justify-between gap-6"}>
+                <div className={"max-w-md flex-1"}>
+                    <Label as={"div"}>
+                        <span className={"inline-flex items-center gap-1.5"}>
+                            {t("settings.troubleshooting.anonymize.label")}
+                            <Tooltip
+                                content={
+                                    <div className={"max-w-xs whitespace-normal leading-relaxed"}>
+                                        {t("settings.troubleshooting.anonymize.info")}
+                                    </div>
+                                }
+                            >
+                                <Info
+                                    size={14}
+                                    aria-label={t("settings.troubleshooting.anonymize.label")}
+                                    className={"shrink-0 cursor-default text-nb-gray-400"}
+                                />
+                            </Tooltip>
+                        </span>
+                    </Label>
+                    <HelpText margin={false}>
+                        {t("settings.troubleshooting.anonymize.help")}
+                    </HelpText>
+                </div>
+                <div className={"shrink-0"}>
+                    <Select
+                        value={anonymizeLevel}
+                        options={ANONYMIZE_LEVELS.map(({ value, icon }) => ({
+                            value,
+                            icon,
+                            label: t(`settings.troubleshooting.anonymize.${value}`),
+                        }))}
+                        onChange={setAnonymizeLevel}
+                        ariaLabel={t("settings.troubleshooting.anonymize.label")}
+                    />
+                </div>
+            </div>
+            <FancyToggleSwitch
+                value={systemInfo}
+                onChange={setSystemInfo}
+                label={t("settings.troubleshooting.systemInfo.label")}
+                helpText={t("settings.troubleshooting.systemInfo.help")}
+            />
+            <FancyToggleSwitch
+                value={upload}
+                onChange={setUpload}
+                label={t("settings.troubleshooting.upload.label")}
+                helpText={t("settings.troubleshooting.upload.help")}
+            />
+            <FancyToggleSwitch
+                value={trace}
+                onChange={setTrace}
+                label={t("settings.troubleshooting.trace.label")}
+                helpText={t("settings.troubleshooting.trace.help")}
+            />
+            <FancyToggleSwitch
+                value={capture}
+                onChange={setCapture}
+                label={t("settings.troubleshooting.capture.label")}
+                helpText={t("settings.troubleshooting.capture.help")}
+            />
+            <div className={"flex flex-col gap-4"}>
+                <FancyToggleSwitch
+                    value={capturePackets}
+                    onChange={setCapturePackets}
+                    label={t("settings.troubleshooting.packets.label")}
+                    helpText={t("settings.troubleshooting.packets.help")}
+                    disabled={!capture}
+                />
+                <div
+                    className={"flex items-center justify-between gap-6"}
+                    {...(capture ? {} : { inert: "" })}
+                >
+                    <div className={"max-w-md flex-1"}>
+                        <Label htmlFor={durationId} disabled={!capture}>
+                            {t("settings.troubleshooting.duration.label")}
+                        </Label>
+                        <HelpText margin={false} disabled={!capture}>
+                            {t("settings.troubleshooting.duration.help")}
+                        </HelpText>
+                    </div>
+                    <div className={"w-40 shrink-0"}>
+                        <Input
+                            id={durationId}
+                            type={"number"}
+                            min={1}
+                            max={30}
+                            value={traceMinutes}
+                            onChange={(e) =>
+                                setTraceMinutes(
+                                    Math.max(1, Math.min(30, Number(e.target.value) || 1)),
+                                )
+                            }
+                            customSuffix={t("settings.troubleshooting.duration.suffix")}
+                            disabled={!capture}
+                        />
+                    </div>
+                </div>
+            </div>
+
+            <SettingsBottomBar>
+                <Button variant={"primary"} size={"md"} onClick={run}>
+                    {t("settings.troubleshooting.create")}
+                </Button>
+            </SettingsBottomBar>
+        </SectionGroup>
+    );
+}
+
+function CenteredPanel({ children }: Readonly<{ children: ReactNode }>) {
+    return (
+        <div
+            className={
+                "absolute inset-0 flex flex-col items-center justify-center gap-5 p-8 text-center"
+            }
+        >
+            {children}
+        </div>
+    );
+}
+
+function ProgressSection({
+    stage,
+    onCancel,
+}: Readonly<{ stage: DebugStage; onCancel: () => void }>) {
+    const { t } = useTranslation();
+    const cancelling = stage.kind === "cancelling";
+    return (
+        <CenteredPanel>
+            <SquareIcon icon={Loader2} className={"[&_svg]:animate-spin"} />
+
+            <div className={"flex max-w-sm flex-col items-center gap-2"}>
+                <DialogHeading className={"text-balance"}>{stageLabel(stage, t)}</DialogHeading>
+                <DialogDescription>
+                    {t("settings.troubleshooting.progress.description")}
+                </DialogDescription>
+            </div>
+
+            {stage.kind === "capturing" && (
+                <div
+                    className={
+                        "font-mono text-2xl font-semibold tabular-nums tracking-wider text-nb-gray-50"
+                    }
+                    aria-live={"polite"}
+                >
+                    {formatRemaining(stage.remainingSec)}
+                </div>
+            )}
+
+            <DialogActions className={"max-w-[220px]"}>
+                <Button
+                    autoFocus
+                    variant={"secondary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={onCancel}
+                    disabled={cancelling}
+                >
+                    {t("common.cancel")}
+                </Button>
+            </DialogActions>
+        </CenteredPanel>
+    );
+}
+
+function DoneResult({
+    result,
+    uploaded,
+    onClose,
+}: Readonly<{
+    result: DebugBundleResult;
+    uploaded: boolean;
+    onClose: () => void;
+}>) {
+    const { t } = useTranslation();
+    const showKey = uploaded && Boolean(result.uploadedKey);
+    const uploadFailed = uploaded && !result.uploadedKey;
+    const onRevealPath = () => {
+        if (!result.path) return;
+        DebugSvc.RevealFile(result.path).catch((err: unknown) =>
+            console.error("reveal debug bundle file", err),
+        );
+    };
+    return (
+        <CenteredPanel>
+            <SquareIcon
+                icon={CircleCheckBig}
+                className={"bg-white dark:bg-nb-gray-920 [&_svg]:text-green-500"}
+            />
+
+            <div className={"flex max-w-sm flex-col items-center gap-2"}>
+                <DialogHeading className={"text-balance"}>
+                    {showKey
+                        ? t("settings.troubleshooting.done.uploadedTitle")
+                        : t("settings.troubleshooting.done.savedTitle")}
+                </DialogHeading>
+                <DialogDescription>
+                    {showKey ? (
+                        <Trans
+                            i18nKey={"settings.troubleshooting.done.uploadedDescription"}
+                            components={{
+                                docs: (
+                                    <a
+                                        href={SUPPORT_DOCS_URL}
+                                        aria-label={t("settings.about.community.documentation")}
+                                        onClick={(e) => {
+                                            e.preventDefault();
+                                            Browser.OpenURL(SUPPORT_DOCS_URL).catch(() =>
+                                                globalThis.open(SUPPORT_DOCS_URL, "_blank"),
+                                            );
+                                        }}
+                                        className={"text-netbird hover:underline"}
+                                    >
+                                        {/* content is provided by <Trans> */}
+                                        <span />
+                                    </a>
+                                ),
+                            }}
+                        />
+                    ) : (
+                        t("settings.troubleshooting.done.savedDescription")
+                    )}
+                </DialogDescription>
+            </div>
+
+            <div className={"flex w-full max-w-sm flex-col gap-3"}>
+                {showKey && <Input dir={"ltr"} value={result.uploadedKey} readOnly copy />}
+
+                {result.path && !showKey && (
+                    <Input
+                        dir={"ltr"}
+                        value={result.path}
+                        readOnly
+                        aria-label={t("settings.troubleshooting.done.savedTitle")}
+                        customSuffix={
+                            <button
+                                type={"button"}
+                                onClick={onRevealPath}
+                                className={
+                                    "pointer-events-auto transition-all hover:text-nb-gray-50"
+                                }
+                                aria-label={t("settings.troubleshooting.done.openFileLocation")}
+                            >
+                                <FolderOpen size={16} aria-hidden={"true"} />
+                            </button>
+                        }
+                    />
+                )}
+
+                {uploadFailed && (
+                    <div
+                        role={"alert"}
+                        className={
+                            "rounded-md border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-700 dark:text-red-300"
+                        }
+                    >
+                        {result.uploadFailureReason
+                            ? t("settings.troubleshooting.uploadFailedWithReason", {
+                                  reason: result.uploadFailureReason,
+                              })
+                            : t("settings.troubleshooting.uploadFailed")}
+                    </div>
+                )}
+            </div>
+
+            <DialogActions className={"max-w-[220px]"}>
+                {showKey ? (
+                    <Button
+                        autoFocus
+                        variant={"primary"}
+                        size={"md"}
+                        className={"w-full"}
+                        copy={result.uploadedKey}
+                    >
+                        {t("settings.troubleshooting.done.copyKey")}
+                    </Button>
+                ) : (
+                    result.path && (
+                        <Button
+                            autoFocus
+                            variant={"primary"}
+                            size={"md"}
+                            className={"w-full"}
+                            onClick={onRevealPath}
+                        >
+                            <FolderOpen size={14} aria-hidden={"true"} />
+                            {t("settings.troubleshooting.done.openFolder")}
+                        </Button>
+                    )
+                )}
+                <Button variant={"secondary"} size={"md"} className={"w-full"} onClick={onClose}>
+                    {t("common.close")}
+                </Button>
+            </DialogActions>
+        </CenteredPanel>
+    );
+}
+
+const stageLabel = (
+    stage: DebugStage,
+    t: (key: string, options?: Record<string, unknown>) => string,
+): string => {
+    switch (stage.kind) {
+        case "reconnecting":
+            return t("settings.troubleshooting.stage.reconnecting");
+        case "capturing":
+            return t("settings.troubleshooting.stage.capturing");
+        case "bundling":
+            return t("settings.troubleshooting.stage.bundling");
+        case "uploading":
+            return t("settings.troubleshooting.stage.uploading");
+        case "cancelling":
+            return t("settings.troubleshooting.stage.cancelling");
+        default:
+            return "";
+    }
+};
diff --git a/client/ui/frontend/src/modules/welcome/WelcomeDialog.tsx b/client/ui/frontend/src/modules/welcome/WelcomeDialog.tsx
new file mode 100644
index 000000000..7be59f102
--- /dev/null
+++ b/client/ui/frontend/src/modules/welcome/WelcomeDialog.tsx
@@ -0,0 +1,170 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+import {
+    Preferences,
+    Profiles as ProfilesSvc,
+    Settings as SettingsSvc,
+    WindowManager,
+} from "@bindings/services";
+import { Restrictions, SetConfigParams } from "@bindings/services/models.js";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+import i18next from "@/lib/i18n";
+import { isNetbirdCloud } from "@/hooks/useManagementUrl";
+import { WelcomeStepTray } from "./WelcomeStepTray";
+import { WelcomeStepManagement } from "./WelcomeStepManagement";
+
+const WINDOW_WIDTH = 360;
+
+type WelcomeStep = "tray" | "management";
+
+function shouldShowManagementStep(
+    activeProfileId: string,
+    email: string,
+    managementUrl: string,
+    managedManagementUrl: string,
+): boolean {
+    if (managedManagementUrl) return false;
+    // The default profile's ID equals the literal "default", so this check
+    // holds whether we pass an ID or the legacy name.
+    if (activeProfileId !== "default") return false;
+    if (email.trim() !== "") return false;
+    return isNetbirdCloud(managementUrl);
+}
+
+type InitialState = {
+    profileName: string;
+    username: string;
+    managementUrl: string;
+    needsManagementStep: boolean;
+};
+
+export default function WelcomeDialog() {
+    const [step, setStep] = useState<WelcomeStep>("tray");
+    const [initial, setInitial] = useState<InitialState | null>(null);
+    const [closing, setClosing] = useState(false);
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH, initial !== null);
+
+    useEffect(() => {
+        let cancelled = false;
+        (async () => {
+            try {
+                const [username, active] = await Promise.all([
+                    ProfilesSvc.Username(),
+                    ProfilesSvc.GetActive(),
+                ]);
+                const profileId = active.id || "default";
+                const [config, list, restrictions] = await Promise.all([
+                    SettingsSvc.GetConfig({ profileName: profileId, username }),
+                    ProfilesSvc.List(username),
+                    SettingsSvc.GetRestrictions().catch(() => new Restrictions()),
+                ]);
+                const profile = list.find((p) => p.id === profileId);
+                const email = profile?.email ?? "";
+                if (cancelled) return;
+                setInitial({
+                    profileName: profileId,
+                    username,
+                    managementUrl: config.managementUrl,
+                    needsManagementStep: shouldShowManagementStep(
+                        profileId,
+                        email,
+                        config.managementUrl,
+                        restrictions.mdm.managementURL,
+                    ),
+                });
+            } catch (e) {
+                console.error("welcome: initial probe failed", e);
+                if (cancelled) return;
+                setInitial({
+                    profileName: "default",
+                    username: "",
+                    managementUrl: "",
+                    needsManagementStep: false,
+                });
+            }
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    const finish = useCallback(async () => {
+        if (closing) return;
+        setClosing(true);
+        try {
+            await Preferences.SetOnboardingCompleted(true);
+        } catch (e) {
+            console.error("persist onboarding flag:", e);
+        }
+        try {
+            await WindowManager.OpenMain();
+        } catch (e) {
+            console.error("open main window:", e);
+        }
+        try {
+            await WindowManager.CloseWelcome();
+        } catch (e) {
+            console.error("close welcome window:", e);
+        }
+    }, [closing]);
+
+    const handleTrayContinue = useCallback(async () => {
+        if (initial?.needsManagementStep) {
+            setStep("management");
+        } else {
+            await finish();
+        }
+    }, [initial, finish]);
+
+    const handleManagementContinue = useCallback(
+        async (url: string) => {
+            if (!initial) return;
+            try {
+                // SetConfig is a partial update — undefined fields are preserved Go-side.
+                await SettingsSvc.SetConfig(
+                    new SetConfigParams({
+                        profileName: initial.profileName,
+                        username: initial.username,
+                        managementUrl: url,
+                    }),
+                );
+            } catch (e) {
+                await errorDialog({
+                    Title: i18next.t("settings.error.saveTitle"),
+                    Message: formatErrorMessage(e),
+                });
+                throw e;
+            }
+            setInitial((s) => (s ? { ...s, managementUrl: url } : s));
+            await finish();
+        },
+        [initial, finish],
+    );
+
+    const content = useMemo(() => {
+        if (!initial) {
+            return null;
+        }
+        switch (step) {
+            case "tray":
+                return <WelcomeStepTray onContinue={handleTrayContinue} />;
+            case "management":
+                return (
+                    <WelcomeStepManagement
+                        initialUrl={initial.managementUrl}
+                        onContinue={handleManagementContinue}
+                    />
+                );
+        }
+    }, [initial, step, handleTrayContinue, handleManagementContinue]);
+
+    return (
+        <ConfirmDialog
+            ref={contentRef}
+            aria-labelledby={step === "tray" ? "nb-welcome-title" : "nb-welcome-management-title"}
+        >
+            {content}
+        </ConfirmDialog>
+    );
+}
diff --git a/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx b/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
new file mode 100644
index 000000000..0fb973122
--- /dev/null
+++ b/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
@@ -0,0 +1,136 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@/components/buttons/Button";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { Input } from "@/components/inputs/Input";
+import { ManagementServerSwitch } from "@/components/ManagementServerSwitch";
+import {
+    CLOUD_MANAGEMENT_URL,
+    ManagementMode,
+    checkManagementUrlReachable,
+    isNetbirdCloud,
+    isValidManagementUrl,
+    normalizeManagementUrl,
+} from "@/hooks/useManagementUrl";
+import { cn } from "@/lib/cn.ts";
+import { isMacOS } from "@/lib/platform.ts";
+
+type WelcomeStepManagementProps = {
+    initialUrl: string;
+    onContinue: (url: string) => Promise<void>;
+};
+
+export function WelcomeStepManagement({
+    initialUrl,
+    onContinue,
+}: Readonly<WelcomeStepManagementProps>) {
+    const { t } = useTranslation();
+    const startsCloud = isNetbirdCloud(initialUrl);
+    const [mode, setMode] = useState<ManagementMode>(
+        startsCloud ? ManagementMode.Cloud : ManagementMode.SelfHosted,
+    );
+    const [url, setUrl] = useState(startsCloud ? "" : initialUrl);
+    const [syntaxError, setSyntaxError] = useState<string | null>(null);
+    const [unreachable, setUnreachable] = useState(false);
+    const [checking, setChecking] = useState(false);
+
+    const trimmedUrl = url.trim();
+    const syntaxValid = mode === ManagementMode.Cloud || isValidManagementUrl(trimmedUrl);
+    const inputRef = useRef<HTMLInputElement | null>(null);
+    const initialMountRef = useRef(true);
+    const initialSelfHostedRef = useRef(!startsCloud);
+
+    useEffect(() => {
+        setSyntaxError(null);
+        setUnreachable(false);
+    }, [url, mode]);
+
+    useEffect(() => {
+        if (initialMountRef.current && initialSelfHostedRef.current) {
+            inputRef.current?.focus();
+        }
+        initialMountRef.current = false;
+    }, []);
+
+    const handleContinue = useCallback(async () => {
+        if (checking) return;
+        if (mode === ManagementMode.SelfHosted && (!trimmedUrl || !syntaxValid)) {
+            setSyntaxError(t("welcome.management.urlInvalid"));
+            inputRef.current?.focus();
+            return;
+        }
+        const target =
+            mode === ManagementMode.Cloud
+                ? CLOUD_MANAGEMENT_URL
+                : normalizeManagementUrl(trimmedUrl);
+        if (mode === ManagementMode.SelfHosted && !unreachable) {
+            setChecking(true);
+            const reachable = await checkManagementUrlReachable(target);
+            setChecking(false);
+            if (!reachable) {
+                setUnreachable(true);
+                return;
+            }
+        }
+        try {
+            await onContinue(target);
+        } catch (e) {
+            console.error("save management url:", e);
+        }
+    }, [checking, mode, syntaxValid, trimmedUrl, unreachable, onContinue, t]);
+
+    const inputError = syntaxError ?? undefined;
+    const inputWarning = useMemo(
+        () => (!syntaxError && unreachable ? t("welcome.management.urlUnreachable") : undefined),
+        [syntaxError, unreachable, t],
+    );
+
+    return (
+        <>
+            <div className={cn("flex flex-col items-center gap-1", isMacOS() && "mt-4")}>
+                <DialogHeading id={"nb-welcome-management-title"} align={"start"}>
+                    {t("welcome.management.title")}
+                </DialogHeading>
+                <DialogDescription align={"start"}>
+                    {t("welcome.management.description")}
+                </DialogDescription>
+            </div>
+
+            <div className={"wails-no-draggable w-full"}>
+                <ManagementServerSwitch value={mode} onChange={setMode} fullWidth />
+            </div>
+
+            {mode === ManagementMode.SelfHosted && (
+                <div className={"wails-no-draggable w-full text-start"}>
+                    <Input
+                        ref={inputRef}
+                        dir={"ltr"}
+                        placeholder={t("welcome.management.urlPlaceholder")}
+                        value={url}
+                        onChange={(e) => setUrl(e.target.value)}
+                        error={inputError}
+                        warning={inputWarning}
+                        spellCheck={false}
+                        autoComplete={"off"}
+                        autoCorrect={"off"}
+                        autoCapitalize={"off"}
+                    />
+                </div>
+            )}
+
+            <DialogActions>
+                <Button
+                    variant={"primary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={handleContinue}
+                    disabled={checking}
+                >
+                    {checking ? t("welcome.management.checking") : t("welcome.continue")}
+                </Button>
+            </DialogActions>
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx b/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
new file mode 100644
index 000000000..8838e5c92
--- /dev/null
+++ b/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
@@ -0,0 +1,61 @@
+import { useTranslation } from "react-i18next";
+import { Button } from "@/components/buttons/Button";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { isMacOS, isWindows } from "@/lib/platform";
+import trayScreenshotDarwin from "@/assets/img/tray-darwin.png";
+import trayScreenshotWindows from "@/assets/img/tray-windows.png";
+import trayScreenshotLinux from "@/assets/img/tray-linux.png";
+
+// Call at render time, not module scope: initPlatform() must run before isMacOS/isWindows.
+function trayScreenshotForOS(): string {
+    if (isMacOS()) return trayScreenshotDarwin;
+    if (isWindows()) return trayScreenshotWindows;
+    return trayScreenshotLinux;
+}
+
+type WelcomeStepTrayProps = {
+    onContinue: () => void;
+};
+
+export function WelcomeStepTray({ onContinue }: Readonly<WelcomeStepTrayProps>) {
+    const { t } = useTranslation();
+    const trayScreenshot = trayScreenshotForOS();
+    // macOS has no tray — the icon sits in the menu bar, so the copy says so.
+    const titleKey = isMacOS() ? "welcome.titleMac" : "welcome.title";
+    const descriptionKey = isMacOS() ? "welcome.descriptionMac" : "welcome.description";
+
+    return (
+        <>
+            <div className={"px-1"}>
+                <img
+                    src={trayScreenshot}
+                    alt={""}
+                    className={"pointer-events-none h-auto w-full select-none rounded-2xl"}
+                    draggable={false}
+                />
+            </div>
+
+            <div className={"flex w-full flex-col gap-1"}>
+                <DialogHeading id={"nb-welcome-title"} align={"start"}>
+                    {t(titleKey)}
+                </DialogHeading>
+                <DialogDescription align={"start"}>{t(descriptionKey)}</DialogDescription>
+            </div>
+
+            <DialogActions>
+                <Button
+                    autoFocus
+                    variant={"primary"}
+                    size={"md"}
+                    tabIndex={0}
+                    className={"w-full"}
+                    onClick={onContinue}
+                >
+                    {t("welcome.continue")}
+                </Button>
+            </DialogActions>
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/vite-env.d.ts b/client/ui/frontend/src/vite-env.d.ts
new file mode 100644
index 000000000..11f02fe2a
--- /dev/null
+++ b/client/ui/frontend/src/vite-env.d.ts
@@ -0,0 +1 @@
+/// <reference types="vite/client" />
diff --git a/client/ui/frontend/tailwind.config.ts b/client/ui/frontend/tailwind.config.ts
new file mode 100644
index 000000000..da41ee111
--- /dev/null
+++ b/client/ui/frontend/tailwind.config.ts
@@ -0,0 +1,180 @@
+import type { Config } from "tailwindcss";
+
+const config: Config = {
+  content: ["./index.html", "./src/**/*.{ts,tsx}"],
+  darkMode: "class",
+  theme: {
+    fontFamily: {
+      sans: ['"Inter Variable"', 'ui-sans-serif', 'system-ui', 'sans-serif'],
+      mono: ['"JetBrains Mono Variable"', 'ui-monospace', 'monospace'],
+    },
+    extend: {
+      colors: {
+        // nb-gray is theme-aware: channels come from CSS variables in
+        // globals.css (:root = light ramp, .dark = original dark ramp). The
+        // rgb(var(...) / <alpha-value>) form keeps opacity modifiers working.
+        "nb-gray": {
+          DEFAULT: "rgb(var(--nb-gray-DEFAULT) / <alpha-value>)",
+          50: "rgb(var(--nb-gray-50) / <alpha-value>)",
+          100: "rgb(var(--nb-gray-100) / <alpha-value>)",
+          200: "rgb(var(--nb-gray-200) / <alpha-value>)",
+          250: "rgb(var(--nb-gray-250) / <alpha-value>)",
+          300: "rgb(var(--nb-gray-300) / <alpha-value>)",
+          350: "rgb(var(--nb-gray-350) / <alpha-value>)",
+          400: "rgb(var(--nb-gray-400) / <alpha-value>)",
+          500: "rgb(var(--nb-gray-500) / <alpha-value>)",
+          600: "rgb(var(--nb-gray-600) / <alpha-value>)",
+          700: "rgb(var(--nb-gray-700) / <alpha-value>)",
+          800: "rgb(var(--nb-gray-800) / <alpha-value>)",
+          850: "rgb(var(--nb-gray-850) / <alpha-value>)",
+          900: "rgb(var(--nb-gray-900) / <alpha-value>)",
+          910: "rgb(var(--nb-gray-910) / <alpha-value>)",
+          920: "rgb(var(--nb-gray-920) / <alpha-value>)",
+          925: "rgb(var(--nb-gray-925) / <alpha-value>)",
+          930: "rgb(var(--nb-gray-930) / <alpha-value>)",
+          935: "rgb(var(--nb-gray-935) / <alpha-value>)",
+          940: "rgb(var(--nb-gray-940) / <alpha-value>)",
+          950: "rgb(var(--nb-gray-950) / <alpha-value>)",
+          960: "rgb(var(--nb-gray-960) / <alpha-value>)",
+        },
+        gray: {
+          50: "#F9FAFB",
+          100: "#F3F4F6",
+          200: "#E5E7EB",
+          300: "#D1D5DB",
+          400: "#9CA3AF",
+          500: "#6B7280",
+          600: "#4B5563",
+          700: "#374151",
+          800: "#1F2937",
+          900: "#111827",
+        },
+        red: {
+          50: "#FDF2F2",
+          100: "#FDE8E8",
+          200: "#FBD5D5",
+          300: "#F8B4B4",
+          400: "#F98080",
+          500: "#F05252",
+          600: "#E02424",
+          700: "#C81E1E",
+          800: "#9B1C1C",
+          900: "#771D1D",
+        },
+        yellow: {
+          50: "#FDFDEA",
+          100: "#FDF6B2",
+          200: "#FCE96A",
+          300: "#FACA15",
+          400: "#E3A008",
+          500: "#C27803",
+          600: "#9F580A",
+          700: "#8E4B10",
+          800: "#723B13",
+          900: "#633112",
+        },
+        green: {
+          50: "#F3FAF7",
+          100: "#DEF7EC",
+          200: "#BCF0DA",
+          300: "#84E1BC",
+          400: "#31C48D",
+          500: "#0E9F6E",
+          600: "#057A55",
+          700: "#046C4E",
+          800: "#03543F",
+          900: "#014737",
+        },
+        blue: {
+          50: "#EBF5FF",
+          100: "#E1EFFE",
+          200: "#C3DDFD",
+          300: "#A4CAFE",
+          400: "#76A9FA",
+          500: "#3F83F8",
+          600: "#1C64F2",
+          700: "#1A56DB",
+          800: "#1E429F",
+          900: "#233876",
+        },
+        indigo: {
+          50: "#F0F5FF",
+          100: "#E5EDFF",
+          200: "#CDDBFE",
+          300: "#B4C6FC",
+          400: "#8DA2FB",
+          500: "#6875F5",
+          600: "#5850EC",
+          700: "#5145CD",
+          800: "#42389D",
+          900: "#362F78",
+        },
+        purple: {
+          50: "#F6F5FF",
+          100: "#EDEBFE",
+          200: "#DCD7FE",
+          300: "#CABFFD",
+          400: "#AC94FA",
+          500: "#9061F9",
+          600: "#7E3AF2",
+          700: "#6C2BD9",
+          800: "#5521B5",
+          900: "#4A1D96",
+        },
+        pink: {
+          50: "#FDF2F8",
+          100: "#FCE8F3",
+          200: "#FAD1E8",
+          300: "#F8B4D9",
+          400: "#F17EB8",
+          500: "#E74694",
+          600: "#D61F69",
+          700: "#BF125D",
+          800: "#99154B",
+          900: "#751A3D",
+        },
+        netbird: {
+          DEFAULT: "#f68330",
+          50: "#fff6ed",
+          100: "#feecd6",
+          150: "#ffdfb8",
+          200: "#ffd4a6",
+          300: "#fab677",
+          400: "#f68330",
+          500: "#f46d1b",
+          600: "#e55311",
+          700: "#be3e10",
+          800: "#973215",
+          900: "#7a2b14",
+          950: "#421308",
+        },
+      },
+      backgroundImage: {
+        "conic-netbird": "conic-gradient(from 0deg, #e55311 0%, #f68330 10%, #e55311 20%, #e55311 100%)",
+      },
+      keyframes: {
+        "pulse-reverse": {
+          "0%, 100%": { opacity: "1" },
+          "50%": { opacity: "0.4" },
+        },
+        "spin-slow": {
+          "0%": { transform: "rotate(0deg)" },
+          "100%": { transform: "rotate(360deg)" },
+        },
+        "ping-slow": {
+          "0%": { transform: "scale(1)", opacity: "1" },
+          "75%, 100%": { transform: "scale(2)", opacity: "0" },
+        },
+      },
+      animation: {
+        "ping-slow": "ping-slow 2s cubic-bezier(0, 0, 0.2, 1) infinite",
+        "pulse-slow": "pulse-reverse 2s cubic-bezier(0.5, 0, 0.6, 1) infinite",
+        "pulse-slower": "pulse-reverse 3s cubic-bezier(0.5, 0, 0.6, 1) infinite",
+        "spin-slow": "spin-slow 2s linear infinite",
+      },
+    },
+  },
+  plugins: [require("tailwindcss-animate")],
+};
+
+export default config;
diff --git a/client/ui/frontend/tsconfig.json b/client/ui/frontend/tsconfig.json
new file mode 100644
index 000000000..f95ce9015
--- /dev/null
+++ b/client/ui/frontend/tsconfig.json
@@ -0,0 +1,30 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "useDefineForClassFields": true,
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": false,
+    "noImplicitAny": false,
+    "noFallthroughCasesInSwitch": true,
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["src/*"],
+      "@bindings/*": ["bindings/github.com/netbirdio/netbird/client/ui/*"]
+    }
+  },
+  "include": ["src", "bindings"],
+}
diff --git a/client/ui/frontend/vite.config.ts b/client/ui/frontend/vite.config.ts
new file mode 100644
index 000000000..48b1c5630
--- /dev/null
+++ b/client/ui/frontend/vite.config.ts
@@ -0,0 +1,28 @@
+import path from "path";
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import wails from "@wailsio/runtime/plugins/vite";
+
+// https://vitejs.dev/config/
+export default defineConfig({
+  resolve: {
+    alias: {
+      "@": path.resolve(__dirname, "./src"),
+      "@bindings": path.resolve(
+        __dirname,
+        "./bindings/github.com/netbirdio/netbird/client/ui",
+      ),
+    },
+  },
+  plugins: [react(), wails("./bindings")],
+  server: {
+    host: "127.0.0.1",
+    port: 9245,
+    strictPort: true,
+    fs: {
+      // The i18n bundles live at ../i18n/locales (shared with the Go tray).
+      // Whitelist the parent dir so Vite's dev server serves them.
+      allow: [path.resolve(__dirname, ".."), __dirname],
+    },
+  },
+});
diff --git a/client/ui/grpc.go b/client/ui/grpc.go
new file mode 100644
index 000000000..5450e136d
--- /dev/null
+++ b/client/ui/grpc.go
@@ -0,0 +1,71 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"fmt"
+	"runtime"
+	"sync"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/backoff"
+
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/desktop"
+)
+
+// Conn is the lazy, lock-protected gRPC connection shared by all services so they reuse one channel.
+type Conn struct {
+	addr string
+
+	mu     sync.Mutex
+	client proto.DaemonServiceClient
+}
+
+func NewConn(addr string) *Conn {
+	return &Conn{addr: addr}
+}
+
+func (c *Conn) Client() (proto.DaemonServiceClient, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.client != nil {
+		return c.client, nil
+	}
+
+	// Lazy on purpose: grpc.NewClient does not connect here, so a daemon that
+	// is down surfaces as a per-RPC Unavailable instead of blocking the UI.
+	target, opts := daemonaddr.DialTarget(daemonaddr.ResolveDaemonAddr(c.addr))
+	opts = append(opts,
+		grpc.WithUserAgent(desktop.GetUIUserAgent()),
+		// Cap reconnect backoff at 5s; gRPC's default 120s MaxDelay would
+		// leave the UI waiting 30-60s to notice a freshly-started daemon.
+		grpc.WithConnectParams(grpc.ConnectParams{
+			Backoff: backoff.Config{
+				BaseDelay:  1 * time.Second,
+				Multiplier: 1.6,
+				Jitter:     0.2,
+				MaxDelay:   5 * time.Second,
+			},
+		}),
+	)
+
+	cc, err := grpc.NewClient(target, opts...)
+	if err != nil {
+		return nil, fmt.Errorf("dial daemon: %w", err)
+	}
+	c.client = proto.NewDaemonServiceClient(cc)
+	return c.client, nil
+}
+
+// DaemonAddr returns the default daemon gRPC address: a Unix socket on
+// Linux/macOS, a named pipe on Windows. The pipe carries the caller's token,
+// which loopback TCP does not, so the daemon can tell who is calling.
+func DaemonAddr() string {
+	if runtime.GOOS == "windows" {
+		return daemonaddr.WindowsPipeAddr
+	}
+	return "unix:///var/run/netbird.sock"
+}
diff --git a/client/ui/guilog/debuglog.go b/client/ui/guilog/debuglog.go
new file mode 100644
index 000000000..3a25c26c8
--- /dev/null
+++ b/client/ui/guilog/debuglog.go
@@ -0,0 +1,77 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package guilog manages gui-client.log, which follows the daemon's log level:
+// in debug/trace the GUI attaches a rotated file alongside the console so its
+// (and the React frontend's forwarded) output is captured for the debug bundle.
+package guilog
+
+import (
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/util"
+)
+
+// DebugLog attaches/detaches gui-client.log based on the daemon's log level,
+// fed via Apply. The file is left on disk for the debug bundle to collect.
+// Disabled (and never touches logging) when the user set --log-file explicitly.
+type DebugLog struct {
+	uiPath  string
+	enabled bool
+
+	mu     sync.Mutex
+	fileOn bool
+}
+
+// NewDebugLog builds the GUI debug log. enabled is false when the user passed
+// --log-file (manual override).
+func NewDebugLog(uiPath string, enabled bool) *DebugLog {
+	return &DebugLog{uiPath: uiPath, enabled: enabled}
+}
+
+// Path returns the GUI log path to register with the daemon, or "" when disabled
+// so the daemon won't collect a file the GUI never writes.
+func (d *DebugLog) Path() string {
+	if !d.enabled {
+		return ""
+	}
+	return d.uiPath
+}
+
+// Apply reacts to a daemon log level (the logrus name, e.g. "debug").
+// Idempotent via the fileOn guard, so the startup replay plus a racing
+// change-event are harmless.
+func (d *DebugLog) Apply(level string) {
+	if !d.enabled {
+		return
+	}
+
+	// Compared numerically so there are no hard-coded level-name literals.
+	lvl, err := log.ParseLevel(level)
+	if err != nil {
+		lvl = log.InfoLevel
+	}
+	debug := lvl >= log.DebugLevel
+
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	switch {
+	case debug && !d.fileOn:
+		if err := util.SetLogOutputs(log.StandardLogger(), util.LogConsole, d.uiPath); err != nil {
+			log.Errorf("attach GUI file log %s: %v", d.uiPath, err)
+			return
+		}
+		log.SetLevel(lvl)
+		d.fileOn = true
+		log.Infof("GUI file logging enabled (daemon level %s), writing to %s", level, d.uiPath)
+	case !debug && d.fileOn:
+		if err := util.SetLogOutputs(log.StandardLogger(), util.LogConsole); err != nil {
+			log.Errorf("detach GUI file log: %v", err)
+		}
+		log.SetLevel(log.InfoLevel)
+		d.fileOn = false
+		log.Infof("GUI file logging disabled (daemon level: %s)", level)
+	}
+}
diff --git a/client/ui/i18n/TRANSLATING.md b/client/ui/i18n/TRANSLATING.md
new file mode 100644
index 000000000..803e093c8
--- /dev/null
+++ b/client/ui/i18n/TRANSLATING.md
@@ -0,0 +1,130 @@
+# Translating the NetBird UI
+
+A short brief for translating the desktop UI — for any translator, human or AI agent (*"you"* = whoever's translating).
+
+**Translations are managed on Crowdin: <https://crowdin.com/project/netbird>.** Join the project, pick your language, and translate in the editor. Each string carries a context note (the `description` from the source file) telling you what it is and where it shows up, and the project's glossary, style guide, and QA checks mirror this document.
+
+> 💡 **The one habit that matters most:** read each string's context before translating it. Labels are terse and ambiguous on their own; the context tells you what the string is, where it shows up, what to keep verbatim, and what it actually means.
+
+---
+
+## How contributions flow
+
+```text
+i18n/locales/en/common.json ──sync──▶ Crowdin ──service PR──▶ i18n/locales/<code>/common.json
+```
+
+- `i18n/locales/en/common.json` is the source of truth. New and changed strings sync to Crowdin automatically (see `crowdin.yml` in the repository root).
+- Crowdin opens and updates a service pull request with the translated bundles, keeping the source's file shape and key order. Keys nobody has translated yet are left out of the export; the app falls back to English for them at runtime. Maintainers review and merge that PR.
+- Don't hand-edit `i18n/locales/<code>/common.json` in your own PRs: the next sync would conflict with or overwrite your changes. Translate on Crowdin instead.
+- Missing your language? Request it on the Crowdin project page or in a [GitHub discussion](https://github.com/netbirdio/netbird/discussions). When a language first ships, a maintainer adds its row to `i18n/locales/_index.json` with `code`, `displayName` (the native name), and `englishName`, which puts it in the app's language picker.
+
+**Prefer translating with an AI agent?** That still works: drive it with *"Read `i18n/TRANSLATING.md` and translate the UI to Russian"* as before, but deliver the result to Crowdin instead of a pull request. Download your language's file from the Crowdin editor, let the agent translate it, and upload it back (the editor's offline translation flow). Crowdin runs its QA checks on upload, and the next service PR carries the strings into the repo.
+
+---
+
+## What NetBird is
+
+A **business zero-trust VPN** — an encrypted **overlay mesh** between a company's devices, built on **WireGuard®**, connecting peers directly with a **relay** fallback. This is the **desktop client** (tray app + windows) someone runs to connect, switch profiles, browse peers, and pick an exit node — *not* the admin dashboard.
+
+**Audience:** IT-literate professionals. **Tone:** clear and professional, never consumer-cute.
+
+**The vocabulary you'll meet:**
+
+| Term | What it means here |
+|---|---|
+| **Peer** | A device on the network (laptop, server, phone) |
+| **Resource / Network** | A routed network or service reachable through NetBird (UI calls these "Resources") |
+| **Exit Node** | A peer that routes *all* internet traffic, like a full-tunnel gateway |
+| **Profile** | A saved connection identity you can switch between |
+| **Daemon** | The background service the UI talks to |
+| **Management server** | The control plane — *Cloud* (hosted) or *self-hosted* (customer-run) |
+| **Relay** | Forwards traffic when two peers can't connect directly |
+| **Rosenpass** | Post-quantum security layered over WireGuard® |
+| **Handshake** | The periodic WireGuard® key sync between peers |
+
+---
+
+## Hard rules — get these exactly right
+
+These are the usual ways a translation *breaks the app*, not just reads oddly.
+
+| ✅ Do | ❌ Don't |
+|---|---|
+| Copy `{placeholders}` verbatim — `{version}`, `{count}`, `{name}`… | Translate the word inside the braces (`{verbleibend}` breaks it) |
+| Reposition a placeholder so the sentence flows | Drop or duplicate a placeholder |
+| Preserve every `\n`, leading/trailing space, and trailing `...` | Trim "invisible" spaces or the `...` (they're load-bearing) |
+| Keep `®` in WireGuard® and quotes around `{name}` | Strip punctuation the context flags |
+
+**Plurals:** the app has only a *one / other* split — the singular key fires only when `count == 1`; the `{count}` key covers everything else (0, 2, 5, 100…). Languages with more than two forms (ru, pl, uk) can't be fully correct here — use the form that fits the widest range (Russian genitive plural: `минут` / `часов` / `дней`). Don't invent extra keys or cram multiple forms into one string. When no single form fits every value — a unit label after a number field, say — reach for a number-agnostic form (an abbreviation, or wording that reads the same for 1 and 100) instead of forcing a plural the *one / other* split can't supply.
+
+**Agreement:** a `{placeholder}` drops a value into a fixed frame, so the words around it must fit *every* value the app can supply. In inflected languages, write the frame in the case the surrounding preposition demands — German's duration fragments are **dative** because they land inside "…in {remaining}" (`in {count} Tagen`, `weniger als einer Minute`), not nominative `Tage`. Check the key that *consumes* the fragment (here `tray.session.expiresIn`) before choosing the form.
+
+---
+
+## Glossary
+
+**Tier A — never translate (brands):** `NetBird` · `WireGuard®` · `Rosenpass` · `GitHub` · `ICE` · company/product names · sample URLs · version numbers.
+
+When a brand sits beside a common noun, keep its exact spelling but join them the way your language builds such phrases — a hyphen, a connector word, an inflected noun — rather than copying English's bare noun-stack.
+
+**Tier B — keep as-is (acronyms):** `SSO` · `MFA` · `DNS` · `IP`/`IPv6` · `ACL` · `SSH` · `GUI` · `P2P` · `URL` · `TCP`/`UDP`.
+
+**Tier C — judgment.** One rule decides every term:
+
+> **Use the word that language's IT users actually say.** Translate when a natural, common term exists; keep the English term *only* when the literal translation would be awkward or no one in that field really uses it.
+
+Apply each term **consistently** — same English term → same translation everywhere — and keep a term once you've settled it. Whether a term stays English or takes a native word is **language-dependent**: a technical loanword (e.g. *Daemon*, *Handshake*) often stays, an everyday word (e.g. *Latency*, *Public key*) usually localizes, and some (*Exit Node*, *Peer*) go either way depending on the language. Decide per term with the rule above — a foreign origin alone is no reason to keep English. **Your main reference is the existing translation:** match how a term was already rendered for your language rather than re-deciding it.
+
+Two checks before you commit a term:
+
+- **Prefer established localized wording.** If a widely used tool in this space (for example WireGuard) ships your language, its wording for a shared term such as *handshake* is what users already expect — look at the translated app, not just English docs. For generic UI verbs and formal address, follow your OS vendor's style guide (Microsoft / Apple / Google).
+- **Watch for false friends.** A literal translation can collide with a *different* established term in your field — confirm your word doesn't already mean something else in this domain before using it.
+
+These tiers are mirrored in the Crowdin project glossary, so the editor highlights them inline. When you settle a new Tier C term for your language, add its translation to the glossary entry so it sticks for everyone who comes after you.
+
+---
+
+## Style
+
+| ✅ Do | ❌ Don't |
+|---|---|
+| Use the **formal "you"** (de *Sie*, fr *vous*, ru *вы*, it *Lei*, zh 您) | Use casual/informal address |
+| Keep **buttons, menu, and tray** items short, in your language's action form (de "Speichern", fr "Enregistrer") | Let a label run much longer than the English — space is tight |
+| Follow **locale punctuation** (fr NBSP + « », de „…", zh full-width), including around a quoted UI label | Carry over English Title Case (use sentence case; German nouns excepted) |
+| Translate a term the **same way everywhere** | Vary wording for the same concept across screens |
+
+Where it reads naturally, aim to keep each string **roughly the same length** as the English — the UI is tight and over-long strings can wrap or truncate. It's a soft preference, not a rule: if your language simply needs more words, use them.
+
+A few habits that keep a translation reading like one product rather than a word-for-word port:
+
+- **Translate meaning, not words.** Render what a string *does*. An idiom or an awkward source phrase should become natural in your language, not a literal calque.
+- **Keep one voice within a family.** Sibling strings — the connection states, every settings *help* caption, every "… Failed" title — should share a grammatical form. If one member sounds wrong in that form, re-voice the whole family rather than leave one odd sibling.
+- **Mirror opposites.** A status should read as the natural counterpart of its pair: translate *Disconnected* as the opposite of however you rendered *Connected*, not as an unrelated word. Same for Active/Inactive, Selected/Not selected.
+- **Give a standalone label its subject.** A bare button or title can lose the context the surrounding English UI implied — add the noun back if it would otherwise read ambiguously.
+
+---
+
+## Reviewing a language
+
+**On Crowdin:** proofread in the editor — context, glossary highlights, and QA flags sit inline next to each string.
+
+**In the repo** — e.g. driving an AI agent with *"Read `i18n/TRANSLATING.md` and review the existing German translation"* — read source and target side by side; for each key check glossary conformance (e.g. de `Exit-Node` → `Exit Node`, hu `Kilépő csomópont` → `Exit Node`), placeholder/`\n` integrity, consistency, tone, and that the meaning matches the English `description`. Report what you found, and apply the fixes **on Crowdin** — direct edits to the locale files are overwritten by the next sync.
+
+---
+
+## QA before you finish
+
+- [ ] Every `{placeholder}`, `\n`, and intentional space preserved · `...` / `… Failed` / `{name}` quotes kept
+- [ ] Tier A/B left intact · Tier C applied consistently (and matching the existing translation for your language)
+- [ ] Buttons & tray short · locale punctuation and capitalization applied
+- [ ] Crowdin QA flags resolved (variables, glossary terms, punctuation)
+- [ ] **Tested in the running app** ↓
+
+---
+
+## Test it in the app
+
+A translation can pass every check above and still read wrong on screen. **Run the app, switch to your language, and click through the real surfaces** — tray menu, main window, every Settings tab, the dialogs. Watch for text overflow or truncation, labels that are technically right but wrong *for what the control does*, leaked placeholders, and terms that drift between screens.
+
+How to run the app and switch language: see the project README. Can't run it (e.g. a headless agent)? Say so in your summary — don't silently skip this step.
diff --git a/client/ui/i18n/bundle.go b/client/ui/i18n/bundle.go
new file mode 100644
index 000000000..892916999
--- /dev/null
+++ b/client/ui/i18n/bundle.go
@@ -0,0 +1,196 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package i18n loads and serves translation strings for both the tray (Go)
+// and the React UI (via the services.I18n facade).
+//
+// The locale tree is passed in as an fs.FS so the embed directive can live in
+// the main binary.
+package i18n
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"path"
+	"sort"
+	"strings"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	localeIndexFile = "_index.json"
+
+	// commonBundleFile shape is Chrome-extension JSON (key -> "message" plus
+	// optional Crowdin "description"); loadBundle flattens to key->message.
+	commonBundleFile = "common.json"
+)
+
+// LanguageCode is a BCP-47-ish locale identifier ("en", "hu", ...).
+type LanguageCode string
+
+// DefaultLanguage is the fallback bundle for missing keys and the default
+// when no preference is on disk.
+const DefaultLanguage LanguageCode = "en"
+
+var ErrUnsupportedLanguage = errors.New("unsupported language")
+
+// Language describes one shipped UI locale. DisplayName is in the locale's
+// own script (a Hungarian entry reads "Magyar" regardless of UI language).
+type Language struct {
+	Code        LanguageCode `json:"code"`
+	DisplayName string       `json:"displayName"`
+	EnglishName string       `json:"englishName"`
+}
+
+type localeIndex struct {
+	Languages []Language `json:"languages"`
+}
+
+// Bundle holds the parsed translation bundles. Loaded once at construction
+// and never mutated.
+type Bundle struct {
+	mu        sync.RWMutex
+	languages []Language
+	bundles   map[LanguageCode]map[string]string
+}
+
+// NewBundle parses _index.json plus every <code>/common.json in the locale
+// tree. Hard-fails only when the default language is missing; other locales
+// without a bundle are dropped with a warning.
+func NewBundle(localesFS fs.FS) (*Bundle, error) {
+	idx, err := loadLocaleIndex(localesFS)
+	if err != nil {
+		return nil, fmt.Errorf("load locale index: %w", err)
+	}
+
+	bundles := make(map[LanguageCode]map[string]string, len(idx.Languages))
+	available := make([]Language, 0, len(idx.Languages))
+	for _, l := range idx.Languages {
+		b, err := loadBundle(localesFS, l.Code)
+		if err != nil {
+			log.Warnf("skip language %q: %v", l.Code, err)
+			continue
+		}
+		bundles[l.Code] = b
+		available = append(available, l)
+	}
+
+	if _, ok := bundles[DefaultLanguage]; !ok {
+		return nil, fmt.Errorf("default language %q bundle missing", DefaultLanguage)
+	}
+
+	sort.Slice(available, func(i, j int) bool { return available[i].Code < available[j].Code })
+
+	return &Bundle{
+		languages: available,
+		bundles:   bundles,
+	}, nil
+}
+
+// Languages returns a copy of the available locales.
+func (b *Bundle) Languages() []Language {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	out := make([]Language, len(b.languages))
+	copy(out, b.languages)
+	return out
+}
+
+func (b *Bundle) HasLanguage(code LanguageCode) bool {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	_, ok := b.bundles[code]
+	return ok
+}
+
+// BundleFor returns a copy of the full key->text map for one language.
+func (b *Bundle) BundleFor(code LanguageCode) (map[string]string, error) {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	bundle, ok := b.bundles[code]
+	if !ok {
+		return nil, fmt.Errorf("%w: %q", ErrUnsupportedLanguage, code)
+	}
+	out := make(map[string]string, len(bundle))
+	for k, v := range bundle {
+		out[k] = v
+	}
+	return out, nil
+}
+
+// Translate resolves key for lang, substituting args given as name/value
+// pairs ("version", "1.2.3" replaces "{version}"). Unknown keys fall back to
+// the default language, then to the key itself so a miss is visible in the UI.
+func (b *Bundle) Translate(lang LanguageCode, key string, args ...string) string {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	if v, ok := b.bundles[lang][key]; ok {
+		return applyPlaceholders(v, args)
+	}
+	if lang != DefaultLanguage {
+		if v, ok := b.bundles[DefaultLanguage][key]; ok {
+			return applyPlaceholders(v, args)
+		}
+	}
+	return key
+}
+
+// applyPlaceholders substitutes {name} in s using args as flat name/value
+// pairs. An odd-length args drops the trailing item.
+func applyPlaceholders(s string, args []string) string {
+	if len(args) == 0 {
+		return s
+	}
+	if len(args)%2 != 0 {
+		log.Debugf("i18n placeholder args not paired: %d items, last dropped", len(args))
+		args = args[:len(args)-1]
+	}
+	for j := 0; j < len(args); j += 2 {
+		s = strings.ReplaceAll(s, "{"+args[j]+"}", args[j+1])
+	}
+	return s
+}
+
+func loadLocaleIndex(localesFS fs.FS) (*localeIndex, error) {
+	data, err := fs.ReadFile(localesFS, localeIndexFile)
+	if err != nil {
+		return nil, err
+	}
+	var idx localeIndex
+	if err := json.Unmarshal(data, &idx); err != nil {
+		return nil, fmt.Errorf("parse %s: %w", localeIndexFile, err)
+	}
+	if len(idx.Languages) == 0 {
+		return nil, errors.New("no languages declared")
+	}
+	return &idx, nil
+}
+
+// bundleEntry is one translation key on disk; Description is Crowdin context,
+// ignored at runtime.
+type bundleEntry struct {
+	Message     string `json:"message"`
+	Description string `json:"description,omitempty"`
+}
+
+func loadBundle(localesFS fs.FS, code LanguageCode) (map[string]string, error) {
+	p := path.Join(string(code), commonBundleFile)
+	data, err := fs.ReadFile(localesFS, p)
+	if err != nil {
+		return nil, err
+	}
+	var entries map[string]bundleEntry
+	if err := json.Unmarshal(data, &entries); err != nil {
+		return nil, fmt.Errorf("parse %s: %w", p, err)
+	}
+	bundle := make(map[string]string, len(entries))
+	for k, e := range entries {
+		bundle[k] = e.Message
+	}
+	return bundle, nil
+}
diff --git a/client/ui/i18n/bundle_test.go b/client/ui/i18n/bundle_test.go
new file mode 100644
index 000000000..d0b0d24d7
--- /dev/null
+++ b/client/ui/i18n/bundle_test.go
@@ -0,0 +1,156 @@
+//go:build !android && !ios && !freebsd && !js
+
+package i18n
+
+import (
+	"testing"
+	"testing/fstest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeLocales returns an in-memory FS that mirrors the real
+// client/ui/i18n/locales layout (root-level _index.json plus
+// <code>/common.json bundles). Used by every Bundle test so we don't
+// depend on the embedded production bundles staying stable.
+func fakeLocales() fstest.MapFS {
+	return fstest.MapFS{
+		"_index.json": {Data: []byte(`{
+            "languages": [
+                {"code": "en", "displayName": "English", "englishName": "English"},
+                {"code": "hu", "displayName": "Magyar", "englishName": "Hungarian"}
+            ]
+        }`)},
+		"en/common.json": {Data: []byte(`{
+            "tray.menu.connect": {"message": "Connect", "description": "Tray menu item"},
+            "tray.menu.installVersion": {"message": "Install version {version}"},
+            "notify.update.body": {"message": "NetBird {version} is available."}
+        }`)},
+		"hu/common.json": {Data: []byte(`{
+            "tray.menu.connect": {"message": "Csatlakozás"},
+            "tray.menu.installVersion": {"message": "{version} telepítése"}
+        }`)},
+	}
+}
+
+func TestBundle_LoadsAllLanguages(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	langs := b.Languages()
+	require.Len(t, langs, 2)
+	codes := []LanguageCode{langs[0].Code, langs[1].Code}
+	assert.ElementsMatch(t, []LanguageCode{"en", "hu"}, codes, "Languages should list every bundle that loaded")
+}
+
+func TestBundle_TranslateLooksUpKey(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	assert.Equal(t, "Csatlakozás", b.Translate("hu", "tray.menu.connect"))
+	assert.Equal(t, "Connect", b.Translate("en", "tray.menu.connect"))
+}
+
+func TestBundle_TranslateSubstitutesPlaceholders(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	assert.Equal(t, "Install version 1.2.3",
+		b.Translate("en", "tray.menu.installVersion", "version", "1.2.3"),
+		"placeholders should substitute by name")
+	assert.Equal(t, "1.2.3 telepítése",
+		b.Translate("hu", "tray.menu.installVersion", "version", "1.2.3"))
+}
+
+func TestBundle_TranslateFallsBackToEnglish(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	// notify.update.body is missing from the hu bundle; English fallback
+	// applies so the user always sees a populated label rather than the
+	// raw key.
+	got := b.Translate("hu", "notify.update.body", "version", "9.9.9")
+	assert.Equal(t, "NetBird 9.9.9 is available.", got, "missing hu key should fall back to en bundle")
+}
+
+func TestBundle_TranslateUnknownKeyReturnsKey(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	assert.Equal(t, "tray.missing", b.Translate("en", "tray.missing"),
+		"unknown key should return the key itself for debugability")
+}
+
+func TestBundle_BundleForReturnsCopy(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	m, err := b.BundleFor("en")
+	require.NoError(t, err)
+	require.NotEmpty(t, m, "BundleFor should return populated map for known language")
+
+	m["tray.menu.connect"] = "Mutated"
+	assert.Equal(t, "Connect", b.Translate("en", "tray.menu.connect"),
+		"BundleFor must return a copy, not the live map")
+}
+
+func TestBundle_BundleForUnknownLanguage(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	_, err = b.BundleFor("xx")
+	assert.ErrorIs(t, err, ErrUnsupportedLanguage)
+}
+
+func TestBundle_HasLanguage(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	assert.True(t, b.HasLanguage("en"))
+	assert.True(t, b.HasLanguage("hu"))
+	assert.False(t, b.HasLanguage("de"))
+}
+
+func TestBundle_MissingDefaultBundleFails(t *testing.T) {
+	// Without an en bundle we have nothing to fall back to, so construction
+	// must hard-fail. Catches packaging accidents where someone drops the
+	// English locale.
+	fs := fstest.MapFS{
+		"_index.json":    {Data: []byte(`{"languages":[{"code":"hu","displayName":"Magyar","englishName":"Hungarian"}]}`)},
+		"hu/common.json": {Data: []byte(`{"k":{"message":"v"}}`)},
+	}
+	_, err := NewBundle(fs)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "default language")
+}
+
+func TestBundle_MissingBundleSkipsLanguage(t *testing.T) {
+	// A language declared in the index but missing its bundle file is
+	// dropped from Languages with a warning — adding a new language must
+	// be a two-step process (declare + ship), not declare-only.
+	fs := fstest.MapFS{
+		"_index.json": {Data: []byte(`{"languages":[
+            {"code":"en","displayName":"English","englishName":"English"},
+            {"code":"de","displayName":"Deutsch","englishName":"German"}
+        ]}`)},
+		"en/common.json": {Data: []byte(`{"k":{"message":"v"}}`)},
+	}
+	b, err := NewBundle(fs)
+	require.NoError(t, err)
+
+	langs := b.Languages()
+	require.Len(t, langs, 1)
+	assert.Equal(t, LanguageCode("en"), langs[0].Code, "language without a bundle file must be dropped")
+	assert.False(t, b.HasLanguage("de"))
+}
+
+func TestBundle_OddPlaceholderArgsDoNotPanic(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	// Trailing dangling arg should be dropped, not panic — preserves UI
+	// stability when a caller passes an unpaired placeholder by mistake.
+	got := b.Translate("en", "tray.menu.installVersion", "version", "1.2.3", "extra")
+	assert.Equal(t, "Install version 1.2.3", got)
+}
diff --git a/client/ui/i18n/check-translations.mjs b/client/ui/i18n/check-translations.mjs
new file mode 100644
index 000000000..a6b666337
--- /dev/null
+++ b/client/ui/i18n/check-translations.mjs
@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+// Validates every shipped translation bundle against the English source of
+// truth. English (en) defines the keys; for every other locale declared in
+// _index.json:
+//
+//   - missing keys are reported as a warning, not a failure — a missing key
+//     falls back to English at runtime (see i18n bundle fallback), and Crowdin
+//     exports only translated strings (skip_untranslated_strings in
+//     crowdin.yml), so a locale is routinely behind English until translators
+//     catch up;
+//   - orphaned keys fail — keys left behind after an English key is renamed or
+//     removed are dead weight and a sign the locale is drifting;
+//   - empty messages fail — a present key with an empty, whitespace-only or
+//     missing message renders blank instead of falling back to English;
+//   - placeholder mismatches fail — a translation must use exactly the
+//     {placeholders} of its English string, otherwise a value silently never
+//     renders (or a literal "{name}" leaks into the UI).
+//
+// Pure Node, no dependencies, so it runs without installing the frontend
+// toolchain.
+//
+//   Local:  node client/ui/i18n/check-translations.mjs   (or: pnpm i18n:check)
+//   CI:     .github/workflows/ui-translations.yml
+
+import { readdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SOURCE = "en";
+const localesDir = join(dirname(fileURLToPath(import.meta.url)), "locales");
+const isCI = Boolean(process.env.GITHUB_ACTIONS);
+
+// Matches the i18next interpolation configured in the frontend
+// (prefix "{", suffix "}") and the Go bundle's applyPlaceholders.
+const PLACEHOLDER = /\{([^{}\s]+)\}/g;
+
+function readJSON(path) {
+    return JSON.parse(readFileSync(path, "utf8"));
+}
+
+function messagesOf(langCode) {
+    const entries = readJSON(join(localesDir, langCode, "common.json"));
+    const messages = new Map();
+    for (const [key, entry] of Object.entries(entries)) {
+        // null marks an unusable entry (missing or non-string message).
+        messages.set(key, typeof entry?.message === "string" ? entry.message : null);
+    }
+    return messages;
+}
+
+function placeholdersOf(message) {
+    // Code-point order: placeholder names are identifiers, not prose.
+    return [...new Set([...message.matchAll(PLACEHOLDER)].map((m) => m[1]))].sort((a, b) => {
+        if (a < b) return -1;
+        if (a > b) return 1;
+        return 0;
+    });
+}
+
+function formatPlaceholders(names) {
+    return names.length ? names.map((n) => `{${n}}`).join(", ") : "none";
+}
+
+// Emit a GitHub Actions annotation so findings render inline on the PR diff.
+function annotate(level, file, message) {
+    if (isCI) console.log(`::${level} file=${file}::${message}`);
+}
+
+const index = readJSON(join(localesDir, "_index.json"));
+const declared = index.languages.map((l) => l.code);
+
+if (!declared.includes(SOURCE)) {
+    console.error(`FATAL: source language "${SOURCE}" is not declared in _index.json`);
+    process.exit(1);
+}
+
+const source = messagesOf(SOURCE);
+const sourceKeys = [...source.keys()];
+const emptySource = sourceKeys.filter((k) => !source.get(k)?.trim());
+if (emptySource.length) {
+    console.error(`FATAL: ${SOURCE}/common.json has empty or missing messages: ${emptySource.join(", ")}`);
+    process.exit(1);
+}
+console.log(`Source of truth: ${SOURCE}/common.json — ${sourceKeys.length} keys\n`);
+
+let failed = false;
+
+for (const code of declared) {
+    if (code === SOURCE) continue;
+    const file = `client/ui/i18n/locales/${code}/common.json`;
+
+    let messages;
+    try {
+        messages = messagesOf(code);
+    } catch (e) {
+        failed = true;
+        const msg = `bundle is declared in _index.json but common.json is missing or invalid (${e.message})`;
+        console.error(`✗ ${code}: ${msg}`);
+        annotate("error", "client/ui/i18n/locales/_index.json", `${code}: ${msg}`);
+        continue;
+    }
+
+    const missing = sourceKeys.filter((k) => !messages.has(k));
+    const extra = [...messages.keys()].filter((k) => !source.has(k));
+    const empty = [];
+    const badPlaceholders = [];
+    for (const [key, message] of messages) {
+        if (!source.has(key)) continue;
+        if (!message?.trim()) {
+            empty.push(key);
+            continue;
+        }
+        const want = placeholdersOf(source.get(key));
+        const got = placeholdersOf(message);
+        if (want.length !== got.length || want.some((name, i) => name !== got[i])) {
+            badPlaceholders.push(`${key} (expected ${formatPlaceholders(want)}, got ${formatPlaceholders(got)})`);
+        }
+    }
+
+    const translated = sourceKeys.length - missing.length - empty.length;
+    const coverage = Math.floor((translated / sourceKeys.length) * 100);
+    const hasErrors = extra.length > 0 || empty.length > 0 || badPlaceholders.length > 0;
+    let mark = "✓";
+    if (hasErrors) mark = "✗";
+    else if (missing.length) mark = "⚠";
+    const log = hasErrors ? console.error : console.log;
+    log(`${mark} ${code}: ${translated}/${sourceKeys.length} keys translated (${coverage}%)`);
+
+    if (missing.length) {
+        console.warn(`    missing ${missing.length} (falls back to English): ${missing.join(", ")}`);
+        annotate("warning", file, `Missing ${missing.length} key(s) present in ${SOURCE}, shown in English: ${missing.join(", ")}`);
+    }
+    if (extra.length) {
+        failed = true;
+        console.error(`    extra ${extra.length}: ${extra.join(", ")}`);
+        annotate("error", file, `Has ${extra.length} key(s) not present in ${SOURCE}: ${extra.join(", ")}`);
+    }
+    if (empty.length) {
+        failed = true;
+        console.error(`    empty message ${empty.length} (renders blank): ${empty.join(", ")}`);
+        annotate("error", file, `Empty or missing message in ${empty.length} key(s), renders blank: ${empty.join(", ")}`);
+    }
+    if (badPlaceholders.length) {
+        failed = true;
+        console.error(`    placeholder mismatch ${badPlaceholders.length}: ${badPlaceholders.join("; ")}`);
+        annotate("error", file, `Placeholders differ from ${SOURCE} in ${badPlaceholders.length} key(s): ${badPlaceholders.join("; ")}`);
+    }
+}
+
+// Locale directories present on disk but not declared in _index.json are not
+// offered in the language picker — surface them so dead translation files don't
+// rot silently.
+const onDisk = readdirSync(localesDir, { withFileTypes: true })
+    .filter((e) => e.isDirectory())
+    .map((e) => e.name);
+const undeclared = onDisk.filter((d) => !declared.includes(d));
+if (undeclared.length) {
+    console.warn(`\n⚠ locale directories not declared in _index.json (not shipped): ${undeclared.join(", ")}`);
+}
+
+console.log();
+if (failed) {
+    console.error("Translation check FAILED — fix orphaned keys, empty messages and placeholder mismatches above.");
+    process.exit(1);
+}
+console.log("Translation check passed — no orphaned keys, empty messages or placeholder mismatches.");
diff --git a/client/ui/i18n/locales/_index.json b/client/ui/i18n/locales/_index.json
new file mode 100644
index 000000000..4e9b632b5
--- /dev/null
+++ b/client/ui/i18n/locales/_index.json
@@ -0,0 +1,17 @@
+{
+    "languages": [
+        {"code": "en", "displayName": "English (US)", "englishName": "English (US)"},
+        {"code": "uk", "displayName": "Українська", "englishName": "Ukrainian"},
+        {"code": "de", "displayName": "Deutsch", "englishName": "German"},
+        {"code": "hu", "displayName": "Magyar", "englishName": "Hungarian"},
+        {"code": "ru", "displayName": "Русский", "englishName": "Russian"},
+        {"code": "es", "displayName": "Español", "englishName": "Spanish"},
+        {"code": "fr", "displayName": "Français", "englishName": "French"},
+        {"code": "it", "displayName": "Italiano", "englishName": "Italian"},
+        {"code": "pt", "displayName": "Português", "englishName": "Portuguese"},
+        {"code": "zh-CN", "displayName": "简体中文", "englishName": "Simplified Chinese"},
+        {"code": "ja", "displayName": "日本語", "englishName": "Japanese"},
+        {"code": "gl", "displayName": "Galego", "englishName": "Galician"},
+        {"code": "he", "displayName": "עברית", "englishName": "Hebrew"}
+    ]
+}
diff --git a/client/ui/i18n/locales/de/common.json b/client/ui/i18n/locales/de/common.json
new file mode 100644
index 000000000..105c8c0b3
--- /dev/null
+++ b/client/ui/i18n/locales/de/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Nicht verbunden"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Nicht aktiv"
+    },
+    "tray.status.error": {
+        "message": "Fehler"
+    },
+    "tray.status.connected": {
+        "message": "Verbunden"
+    },
+    "tray.status.connecting": {
+        "message": "Wird verbunden"
+    },
+    "tray.status.needsLogin": {
+        "message": "Anmeldung erforderlich"
+    },
+    "tray.status.loginFailed": {
+        "message": "Anmeldung fehlgeschlagen"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sitzung abgelaufen"
+    },
+    "tray.session.expiresIn": {
+        "message": "Sitzung läuft ab in {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "weniger als einer Minute"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 Minute"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} Minuten"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 Stunde"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} Stunden"
+    },
+    "tray.session.unit.day": {
+        "message": "1 Tag"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} Tagen"
+    },
+    "tray.menu.open": {
+        "message": "NetBird öffnen"
+    },
+    "tray.menu.connect": {
+        "message": "Verbinden"
+    },
+    "tray.menu.disconnect": {
+        "message": "Trennen"
+    },
+    "tray.menu.exitNode": {
+        "message": "Exit Node"
+    },
+    "tray.menu.networks": {
+        "message": "Ressourcen"
+    },
+    "tray.menu.profiles": {
+        "message": "Profile"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Profile verwalten"
+    },
+    "tray.menu.settings": {
+        "message": "Einstellungen …"
+    },
+    "tray.menu.debugBundle": {
+        "message": "Debug-Paket erstellen"
+    },
+    "tray.menu.about": {
+        "message": "Hilfe & Support"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Dokumentation"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Fehlerbehebung"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Neueste Version herunterladen"
+    },
+    "tray.menu.installVersion": {
+        "message": "Version {version} installieren"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "NetBird beenden"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "NetBird-Dienst ist veraltet"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Aktualisieren Sie den NetBird-Dienst, um diese App zu verwenden."
+    },
+    "notify.update.title": {
+        "message": "NetBird-Update verfügbar"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} ist verfügbar."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Ihr Administrator verlangt dieses Update."
+    },
+    "notify.error.title": {
+        "message": "Fehler"
+    },
+    "notify.error.connect": {
+        "message": "Verbindung fehlgeschlagen"
+    },
+    "notify.error.disconnect": {
+        "message": "Trennen fehlgeschlagen"
+    },
+    "notify.error.switchProfile": {
+        "message": "Wechsel zu {profile} fehlgeschlagen"
+    },
+    "notify.error.exitNode": {
+        "message": "Exit Node {name} konnte nicht aktualisiert werden"
+    },
+    "notify.sessionExpired.title": {
+        "message": "NetBird-Sitzung abgelaufen"
+    },
+    "notify.sessionExpired.body": {
+        "message": "Ihre NetBird-Sitzung ist abgelaufen. Bitte melden Sie sich erneut an."
+    },
+    "notify.sessionWarning.title": {
+        "message": "Sitzung läuft bald ab"
+    },
+    "notify.sessionWarning.body": {
+        "message": "Ihre NetBird-Sitzung läuft in {remaining} ab. Klicken Sie auf Jetzt verlängern, um zu erneuern."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Ihre NetBird-Sitzung läuft bald ab. Klicken Sie auf Jetzt verlängern, um zu erneuern."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Jetzt verlängern"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Verwerfen"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "NetBird-Sitzung konnte nicht verlängert werden"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "NetBird-Sitzung verlängert"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Ihre Sitzung wurde erneuert."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Ungültige Sitzungsablaufzeit"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "Der Server hat eine ungültige Sitzungsablaufzeit übermittelt. Bitte melden Sie sich erneut an."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird-Einstellungen aktualisiert"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Ihre NetBird-Konfiguration wurde durch Ihre IT-Richtlinie aktualisiert."
+    },
+    "common.cancel": {
+        "message": "Abbrechen"
+    },
+    "common.save": {
+        "message": "Speichern"
+    },
+    "common.saveChanges": {
+        "message": "Änderungen speichern"
+    },
+    "common.saving": {
+        "message": "Speichert…"
+    },
+    "common.close": {
+        "message": "Schließen"
+    },
+    "common.copy": {
+        "message": "Kopieren"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Passwortsichtbarkeit umschalten"
+    },
+    "common.increase": {
+        "message": "Erhöhen"
+    },
+    "common.decrease": {
+        "message": "Verringern"
+    },
+    "common.delete": {
+        "message": "Löschen"
+    },
+    "common.create": {
+        "message": "Erstellen"
+    },
+    "common.add": {
+        "message": "Hinzufügen"
+    },
+    "common.remove": {
+        "message": "Entfernen"
+    },
+    "common.refresh": {
+        "message": "Aktualisieren"
+    },
+    "common.loading": {
+        "message": "Lädt…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Keine Ergebnisse gefunden"
+    },
+    "common.noResults.description": {
+        "message": "Es konnten keine Ergebnisse gefunden werden. Bitte versuchen Sie es mit einem anderen Suchbegriff oder ändern Sie Ihre Filter."
+    },
+    "notConnected.title": {
+        "message": "Nicht verbunden"
+    },
+    "notConnected.description": {
+        "message": "Verbinden Sie sich zuerst mit NetBird, um detaillierte Informationen zu Ihren Peers, Netzwerkressourcen und Exit Nodes einzusehen."
+    },
+    "connect.status.disconnected": {
+        "message": "Nicht verbunden"
+    },
+    "connect.status.connecting": {
+        "message": "Wird verbunden…"
+    },
+    "connect.status.connected": {
+        "message": "Verbunden"
+    },
+    "connect.status.disconnecting": {
+        "message": "Wird getrennt…"
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon nicht verfügbar"
+    },
+    "connect.status.loginRequired": {
+        "message": "Anmeldung erforderlich"
+    },
+    "connect.error.loginTitle": {
+        "message": "Anmeldung fehlgeschlagen"
+    },
+    "connect.error.connectTitle": {
+        "message": "Verbindung fehlgeschlagen"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Trennen fehlgeschlagen"
+    },
+    "nav.peers.title": {
+        "message": "Peers"
+    },
+    "nav.peers.description": {
+        "message": "{connected} von {total} verbunden"
+    },
+    "nav.resources.title": {
+        "message": "Ressourcen"
+    },
+    "nav.resources.description": {
+        "message": "{active} von {total} aktiv"
+    },
+    "nav.exitNode.title": {
+        "message": "Exit Nodes"
+    },
+    "nav.exitNode.none": {
+        "message": "Nicht aktiv"
+    },
+    "nav.exitNode.using": {
+        "message": "Über {name}"
+    },
+    "header.openSettings": {
+        "message": "Einstellungen öffnen"
+    },
+    "header.togglePanel": {
+        "message": "Seitenleiste umschalten"
+    },
+    "profile.selector.loading": {
+        "message": "Lädt…"
+    },
+    "profile.selector.noProfile": {
+        "message": "Kein Profil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Profil nach Namen suchen…"
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Keine Profile gefunden"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Versuchen Sie einen anderen Suchbegriff oder erstellen Sie ein neues Profil."
+    },
+    "profile.selector.newProfile": {
+        "message": "Neues Profil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Weitere Optionen"
+    },
+    "profile.selector.deregister": {
+        "message": "Abmelden"
+    },
+    "profile.selector.delete": {
+        "message": "Profil löschen"
+    },
+    "profile.selector.switchTo": {
+        "message": "Zu diesem Profil wechseln"
+    },
+    "profile.selector.edit": {
+        "message": "Bearbeiten"
+    },
+    "profile.edit.title": {
+        "message": "Profil bearbeiten"
+    },
+    "profile.edit.submit": {
+        "message": "Änderungen speichern"
+    },
+    "profile.dialog.title": {
+        "message": "Neues Profil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Profilname"
+    },
+    "profile.dialog.description": {
+        "message": "Legen Sie einen leicht erkennbaren Namen für Ihr Profil fest."
+    },
+    "profile.dialog.placeholder": {
+        "message": "z. B. Arbeit"
+    },
+    "profile.dialog.submit": {
+        "message": "Profil hinzufügen"
+    },
+    "profile.dialog.required": {
+        "message": "Bitte geben Sie einen Profilnamen ein, z. B. Arbeit, Privat"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "NetBird Cloud oder Ihr eigener Server."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Server nicht erreichbar. Überprüfen Sie die URL, oder fügen Sie das Profil trotzdem hinzu, wenn Sie sicher sind, dass sie korrekt ist."
+    },
+    "header.menu.settings": {
+        "message": "Einstellungen …"
+    },
+    "header.menu.defaultView": {
+        "message": "Standardansicht"
+    },
+    "header.menu.advancedView": {
+        "message": "Erweiterte Ansicht"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Update verfügbar"
+    },
+    "header.menu.open": {
+        "message": "Menü öffnen"
+    },
+    "header.profile.switch": {
+        "message": "Profil wechseln"
+    },
+    "connect.toggle.label": {
+        "message": "NetBird-Verbindung umschalten"
+    },
+    "connect.localIp.label": {
+        "message": "Lokale IP-Adressen"
+    },
+    "common.search": {
+        "message": "Suchen"
+    },
+    "common.filter": {
+        "message": "Filtern"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Exit-Node auswählen"
+    },
+    "peers.row.label": {
+        "message": "Details öffnen für {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Peer-Details"
+    },
+    "networks.row.toggle": {
+        "message": "{name} umschalten"
+    },
+    "networks.bulk.label": {
+        "message": "Alle sichtbaren Ressourcen umschalten"
+    },
+    "profile.switch.title": {
+        "message": "Zu Profil \"{name}\" wechseln?"
+    },
+    "profile.switch.message": {
+        "message": "Sind Sie sicher, dass Sie das Profil wechseln möchten?\nIhr aktuelles Profil wird getrennt."
+    },
+    "profile.switch.confirm": {
+        "message": "Bestätigen"
+    },
+    "profile.deregister.title": {
+        "message": "Profil \"{name}\" abmelden?"
+    },
+    "profile.deregister.message": {
+        "message": "Sind Sie sicher, dass Sie dieses Profil abmelden möchten?\nSie müssen sich erneut anmelden, um es zu nutzen."
+    },
+    "profile.deregister.confirm": {
+        "message": "Abmelden"
+    },
+    "profile.delete.title": {
+        "message": "Profil \"{name}\" löschen?"
+    },
+    "profile.delete.message": {
+        "message": "Sind Sie sicher, dass Sie dieses Profil löschen möchten?\nDiese Aktion kann nicht rückgängig gemacht werden."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Aktive Profile können nicht gelöscht werden. Wechseln Sie zu einem anderen Profil, bevor Sie dieses löschen."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Das Standardprofil kann nicht gelöscht werden."
+    },
+    "profile.error.switchTitle": {
+        "message": "Profilwechsel fehlgeschlagen"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Abmeldung fehlgeschlagen"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Löschen des Profils fehlgeschlagen"
+    },
+    "profile.error.createTitle": {
+        "message": "Erstellen des Profils fehlgeschlagen"
+    },
+    "profile.error.editTitle": {
+        "message": "Bearbeiten des Profils fehlgeschlagen"
+    },
+    "profile.error.loadTitle": {
+        "message": "Laden der Profile fehlgeschlagen"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Aktives Profil"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Profil wechseln"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Andere"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Profil hinzufügen"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Profile verwalten"
+    },
+    "profile.dropdown.settings": {
+        "message": "Einstellungen"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Profile"
+    },
+    "settings.profiles.intro": {
+        "message": "Verwalten Sie mehrere NetBird-Profile parallel, zum Beispiel berufliche und private Konten oder verschiedene Management-Server. Fügen Sie unten Profile hinzu, melden Sie sie ab oder löschen Sie sie."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Profil hinzufügen"
+    },
+    "settings.profiles.active": {
+        "message": "Aktiv"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Keine Profile"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Erstellen Sie ein Profil, um sich mit einem NetBird-Management-Server zu verbinden."
+    },
+    "settings.error.loadTitle": {
+        "message": "Laden der Einstellungen fehlgeschlagen"
+    },
+    "settings.error.saveTitle": {
+        "message": "Speichern der Einstellungen fehlgeschlagen"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Debug-Paket fehlgeschlagen"
+    },
+    "settings.nav.label": {
+        "message": "Einstellungsbereiche"
+    },
+    "settings.tabs.general": {
+        "message": "Allgemein"
+    },
+    "settings.tabs.network": {
+        "message": "Netzwerk"
+    },
+    "settings.tabs.security": {
+        "message": "Sicherheit"
+    },
+    "settings.tabs.profiles": {
+        "message": "Profile"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Erweitert"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Fehlerbehebung"
+    },
+    "settings.tabs.about": {
+        "message": "Über"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Update verfügbar"
+    },
+    "settings.general.section.general": {
+        "message": "Allgemein"
+    },
+    "settings.general.section.connection": {
+        "message": "Verbindung"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Beim Start verbinden"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Beim Start des Dienstes automatisch eine Verbindung herstellen."
+    },
+    "settings.general.notifications.label": {
+        "message": "Desktop-Benachrichtigungen"
+    },
+    "settings.general.notifications.help": {
+        "message": "Desktop-Benachrichtigungen für neue Updates und Verbindungsereignisse anzeigen."
+    },
+    "settings.general.autostart.label": {
+        "message": "NetBird-UI beim Anmelden starten"
+    },
+    "settings.general.autostart.help": {
+        "message": "Die NetBird-Oberfläche beim Anmelden automatisch starten. Dies betrifft nur die grafische Oberfläche, nicht den Hintergrunddienst."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Ändern des Autostarts fehlgeschlagen"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Nach dem Beenden verbunden bleiben"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "Die Verbindung bleibt im Hintergrund bestehen, nachdem Sie NetBird schließen. Sie endet erst, wenn Sie sie selbst trennen."
+    },
+    "settings.general.language.label": {
+        "message": "Anzeigesprache"
+    },
+    "settings.general.language.help": {
+        "message": "Wählen Sie die Sprache der NetBird-Oberfläche."
+    },
+    "settings.general.language.search": {
+        "message": "Sprache suchen…"
+    },
+    "settings.general.language.empty": {
+        "message": "Keine Sprachen gefunden."
+    },
+    "settings.general.theme.label": {
+        "message": "Erscheinungsbild"
+    },
+    "settings.general.theme.help": {
+        "message": "Hell, Dunkel oder die Systemeinstellung verwenden."
+    },
+    "settings.general.theme.system": {
+        "message": "System"
+    },
+    "settings.general.theme.light": {
+        "message": "Hell"
+    },
+    "settings.general.theme.dark": {
+        "message": "Dunkel"
+    },
+    "settings.general.management.label": {
+        "message": "Management-Server"
+    },
+    "settings.general.management.help": {
+        "message": "Mit NetBird Cloud oder Ihrem eigenen self-hosted Management-Server verbinden. Änderungen lösen eine Neuverbindung des Clients aus."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Self-hosted"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Bitte geben Sie eine gültige URL ein, z. B. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Server nicht erreichbar. Überprüfen Sie die URL, oder speichern Sie trotzdem, wenn Sie sicher sind, dass sie korrekt ist."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Zu NetBird Cloud wechseln?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Dies trennt die Verbindung zu Ihrem self-hosted Server.\nMöglicherweise müssen Sie sich erneut anmelden."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Zu Cloud wechseln"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Konnektivität"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Routing & DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Bei Netzwerkwechsel neu verbinden"
+    },
+    "settings.network.monitor.help": {
+        "message": "Das Netzwerk überwachen und bei Änderungen (z. B. WLAN-Wechsel, Ethernet-Änderungen oder Rückkehr aus dem Ruhezustand) automatisch neu verbinden."
+    },
+    "settings.network.dns.label": {
+        "message": "DNS aktivieren"
+    },
+    "settings.network.dns.help": {
+        "message": "NetBird-verwaltete DNS-Einstellungen auf den Host-Resolver anwenden."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Client-Routen aktivieren"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Routen von anderen Peers übernehmen, um deren Netzwerke zu erreichen."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Server-Routen aktivieren"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Lokale Routen dieses Hosts an andere Peers ankündigen."
+    },
+    "settings.network.ipv6.label": {
+        "message": "IPv6 aktivieren"
+    },
+    "settings.network.ipv6.help": {
+        "message": "IPv6-Adressierung für das NetBird-Overlay-Netzwerk verwenden."
+    },
+    "settings.security.section.firewall": {
+        "message": "Firewall"
+    },
+    "settings.security.section.encryption": {
+        "message": "Verschlüsselung"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Eingehenden Verkehr blockieren"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Unaufgeforderte Verbindungen von Peers zu diesem Gerät und den von ihm gerouteten Netzwerken ablehnen. Ausgehender Verkehr ist nicht betroffen."
+    },
+    "settings.security.blockLan.label": {
+        "message": "LAN-Zugriff blockieren"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Verhindert, dass Peers Ihr lokales Netzwerk oder dessen Geräte erreichen, wenn dieses Gerät deren Verkehr routet."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Quantenresistenz aktivieren"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Einen Post-Quanten-Schlüsselaustausch über Rosenpass zusätzlich zu WireGuard® hinzufügen."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Permissiven Modus aktivieren"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Verbindungen zu Peers ohne Quantenresistenz-Unterstützung erlauben."
+    },
+    "settings.ssh.section.server": {
+        "message": "Server"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Funktionen"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Authentifizierung"
+    },
+    "settings.ssh.server.label": {
+        "message": "SSH-Server aktivieren"
+    },
+    "settings.ssh.server.help": {
+        "message": "Den NetBird SSH-Server auf diesem Host ausführen, damit andere Peers sich verbinden können."
+    },
+    "settings.ssh.root.label": {
+        "message": "Root-Login erlauben"
+    },
+    "settings.ssh.root.help": {
+        "message": "Peers dürfen sich als root anmelden. Deaktivieren, um ein nicht-privilegiertes Konto zu erfordern."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "SFTP erlauben"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Dateien sicher über native SFTP- oder SCP-Clients übertragen."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Lokale Portweiterleitung"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Verbundene Peers können lokale Ports zu von diesem Host erreichbaren Diensten tunneln."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Remote-Portweiterleitung"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Verbundene Peers können Ports dieses Hosts an ihren eigenen Rechner weitergeben."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "JWT-Authentifizierung aktivieren"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Jede SSH-Sitzung gegen Ihren IdP für Identität und Audit prüfen. Deaktivieren, um sich nur auf Netzwerk-ACL-Richtlinien zu verlassen — sinnvoll, wenn kein IdP verfügbar ist."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "JWT-Cache-TTL"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Wie lange dieser Client ein JWT zwischenspeichert, bevor bei ausgehenden SSH-Verbindungen erneut nachgefragt wird. Auf 0 setzen, um den Cache zu deaktivieren und bei jeder Verbindung zu authentifizieren."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "Sekunde(n)"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Schnittstelle"
+    },
+    "settings.advanced.section.security": {
+        "message": "Sicherheit"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Name"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Verwenden Sie 1–15 Buchstaben, Ziffern, Punkte, Bindestriche oder Unterstriche."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Muss mit „utun“ und einer Zahl beginnen (z. B. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Port"
+    },
+    "settings.advanced.port.error": {
+        "message": "Geben Sie einen Port zwischen {min} und {max} ein."
+    },
+    "settings.advanced.port.help": {
+        "message": "Wenn auf 0 gesetzt, wird ein zufälliger freier Port verwendet."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Geben Sie einen MTU-Wert zwischen {min} und {max} ein."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Pre-shared Key"
+    },
+    "settings.advanced.psk.help": {
+        "message": "Optionaler WireGuard-PSK für zusätzliche symmetrische Verschlüsselung. Nicht identisch mit einem NetBird Setup-Key. Sie kommunizieren nur mit Peers, die denselben Pre-shared Key verwenden."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Debug-Paket"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Sensible Informationen anonymisieren"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Verbirgt IP-Adressen, Domains und andere sensible Werte."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Der Standardmodus lässt interne IPv4-Adressen und Peer-Namen für den Support lesbar. Der strikte Modus anonymisiert zusätzlich private (RFC 1918), CGNAT- und Link-Local-IP-Adressen, Peer-Namen und öffentliche WireGuard-Schlüssel. Wiederkehrende Werte erhalten denselben Platzhalter, sodass Peers unterscheidbar bleiben. Verwenden Sie den strikten Modus, wenn Sie das Debug-Paket außerhalb Ihrer Organisation weitergeben."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Keine"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Standard"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Strikt"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Systeminformationen einschließen"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "OS, Kernel, Netzwerkschnittstellen und Routing-Tabellen einschließen."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Paket an NetBird-Server hochladen"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Gibt einen Upload-Schlüssel zurück, den Sie mit dem NetBird-Support teilen können."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Trace-Logs aktivieren"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Hebt das Log-Level auf TRACE an und stellt es danach wieder her."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Aufzeichnungssitzung"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Stellt die Verbindung neu her und wartet, damit Sie das Problem reproduzieren können."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Netzwerkpakete aufzeichnen"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Speichert eine .pcap-Datei des Netzwerkverkehrs während der Aufzeichnung."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Aufzeichnungsdauer"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Wie lange die Aufzeichnungssitzung läuft."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "Minute(n)"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Debug-Paket erstellen"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Logs, Systemdetails und Verbindungszustand werden gesammelt. Dies dauert in der Regel einen Moment — lassen Sie dieses Fenster geöffnet, bis es abgeschlossen ist."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Wird abgebrochen…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Debug-Paket erfolgreich hochgeladen!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Paket gespeichert"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Teilen Sie den unten angezeigten Upload-Schlüssel mit dem <docs>NetBird-Support</docs>. Eine lokale Kopie wurde ebenfalls auf Ihrem Gerät gespeichert."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Ihr Debug-Paket wurde lokal gespeichert."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Schlüssel kopieren"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Ordner öffnen"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Speicherort öffnen"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Upload fehlgeschlagen: {reason} Das Paket wurde trotzdem lokal gespeichert."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Upload fehlgeschlagen. Das Paket wurde trotzdem lokal gespeichert."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "NetBird wird neu verbunden…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Debug-Logs werden erfasst"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Debug-Paket wird erstellt…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Wird zu NetBird hochgeladen…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Wird abgebrochen…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client"
+    },
+    "settings.about.development": {
+        "message": "[Entwicklung]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Alle Rechte vorbehalten."
+    },
+    "settings.about.links.imprint": {
+        "message": "Impressum"
+    },
+    "settings.about.links.privacy": {
+        "message": "Datenschutz"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Nutzungsbedingungen"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Forum"
+    },
+    "settings.about.community.documentation": {
+        "message": "Dokumentation"
+    },
+    "settings.about.community.feedback": {
+        "message": "Feedback"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} ist installationsbereit."
+    },
+    "update.banner.later": {
+        "message": "Später"
+    },
+    "update.banner.installNow": {
+        "message": "Jetzt installieren"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "Version {version} ist zum Herunterladen verfügbar."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "Version {version} ist zur Installation verfügbar."
+    },
+    "update.card.whatsNew": {
+        "message": "Was ist neu?"
+    },
+    "update.card.installNow": {
+        "message": "Jetzt installieren"
+    },
+    "update.card.getInstaller": {
+        "message": "Herunterladen"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird sucht im Hintergrund nach Updates."
+    },
+    "update.card.changelog": {
+        "message": "Changelog"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Sie verwenden die neueste Version"
+    },
+    "update.header.tooltip": {
+        "message": "Update verfügbar"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "NetBird wird auf v{version} aktualisiert"
+    },
+    "update.overlay.updating": {
+        "message": "NetBird wird aktualisiert"
+    },
+    "update.overlay.description": {
+        "message": "Eine neuere Version ist verfügbar und wird installiert. NetBird startet nach Abschluss des Updates automatisch neu."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "Update dauert zu lange"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "Die Installation von {target} hat zu lange gedauert und wurde nicht abgeschlossen."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Update wurde abgebrochen"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "Das Update auf {target} wurde vor dem Abschluss abgebrochen."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Update konnte nicht installiert werden"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "{target} konnte nicht installiert werden."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "unbekannter Fehler"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "die neue Version"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Laden des Update-Status fehlgeschlagen"
+    },
+    "update.error.triggerTitle": {
+        "message": "Update-Start fehlgeschlagen"
+    },
+    "update.page.versionLine": {
+        "message": "Client wird aktualisiert auf: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Client wird aktualisiert."
+    },
+    "update.page.outdated": {
+        "message": "Ihre Client-Version ist älter als die im Management eingestellte Auto-Update-Version."
+    },
+    "update.page.status.running": {
+        "message": "Wird aktualisiert"
+    },
+    "update.page.status.timeout": {
+        "message": "Zeitüberschreitung beim Update. Bitte erneut versuchen."
+    },
+    "update.page.status.canceled": {
+        "message": "Update abgebrochen."
+    },
+    "update.page.status.failed": {
+        "message": "Update fehlgeschlagen: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "unbekannter Update-Fehler"
+    },
+    "update.page.failedTitle": {
+        "message": "Update fehlgeschlagen"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Zeitüberschreitung beim Update."
+    },
+    "update.page.dontClose": {
+        "message": "Bitte schließen Sie dieses Fenster nicht."
+    },
+    "update.page.updating": {
+        "message": "Wird aktualisiert…"
+    },
+    "update.page.complete": {
+        "message": "Update abgeschlossen"
+    },
+    "update.page.failed": {
+        "message": "Update fehlgeschlagen"
+    },
+    "window.title.settings": {
+        "message": "Einstellungen"
+    },
+    "window.title.signIn": {
+        "message": "Anmeldung"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sitzung läuft ab"
+    },
+    "window.title.updating": {
+        "message": "Aktualisierung"
+    },
+    "window.title.welcome": {
+        "message": "Willkommen bei NetBird"
+    },
+    "window.title.error": {
+        "message": "Fehler"
+    },
+    "welcome.title": {
+        "message": "Suchen Sie NetBird in der Taskleiste"
+    },
+    "welcome.titleMac": {
+        "message": "Suchen Sie NetBird in der Menüleiste"
+    },
+    "welcome.description": {
+        "message": "NetBird läuft in Ihrer Taskleiste. Klicken Sie auf das Symbol, um sich zu verbinden, Profile zu wechseln oder die Einstellungen zu öffnen."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird läuft in Ihrer Menüleiste. Klicken Sie auf das Symbol, um sich zu verbinden, Profile zu wechseln oder die Einstellungen zu öffnen."
+    },
+    "welcome.continue": {
+        "message": "Weiter"
+    },
+    "welcome.back": {
+        "message": "Zurück"
+    },
+    "welcome.management.title": {
+        "message": "NetBird einrichten"
+    },
+    "welcome.management.description": {
+        "message": "Klicken Sie auf „Weiter“, um loszulegen, oder wählen Sie „Self-hosted“, wenn Sie einen eigenen NetBird-Server haben."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Nutzen Sie unseren gehosteten Dienst. Keine Einrichtung nötig."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Self-hosted"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Verbindung zu Ihrem eigenen Management-Server."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL des Management-Servers"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Bitte geben Sie eine gültige URL ein, z. B. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Server nicht erreichbar. Überprüfen Sie die URL oder Ihr Netzwerk und fahren Sie fort, wenn Sie sicher sind, dass sie korrekt ist."
+    },
+    "welcome.management.checking": {
+        "message": "Wird geprüft …"
+    },
+    "browserLogin.title": {
+        "message": "Anmeldung im Browser abschließen"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Sehen Sie den Browser-Tab nicht?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Erneut versuchen"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Browser konnte nicht geöffnet werden"
+    },
+    "sessionExpiration.title": {
+        "message": "Sitzung läuft bald ab"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Ihre Sitzung läuft ab"
+    },
+    "sessionExpiration.description": {
+        "message": "Dieses Gerät wird bald getrennt. Browser-Anmeldung zum Erneuern erforderlich."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Eine Browser-Anmeldung hält dieses Gerät mit Ihrem Netzwerk verbunden."
+    },
+    "sessionExpiration.stay": {
+        "message": "Sitzung erneuern"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Anmelden"
+    },
+    "sessionExpiration.logout": {
+        "message": "Abmelden"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sitzung abgelaufen"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Gerät getrennt. Mit Browser-Anmeldung authentifizieren, um erneut zu verbinden."
+    },
+    "sessionExpiration.close": {
+        "message": "Schließen"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Sitzungsverlängerung fehlgeschlagen"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Abmeldung fehlgeschlagen"
+    },
+    "peers.search.placeholder": {
+        "message": "Nach Name oder IP suchen"
+    },
+    "peers.filter.all": {
+        "message": "Alle"
+    },
+    "peers.filter.online": {
+        "message": "Online"
+    },
+    "peers.filter.offline": {
+        "message": "Offline"
+    },
+    "peers.empty.title": {
+        "message": "Keine Peers verfügbar"
+    },
+    "peers.empty.description": {
+        "message": "Sie haben entweder keine Peers verfügbar oder keinen Zugriff auf einen davon."
+    },
+    "peers.details.domain": {
+        "message": "Domain"
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird-IP"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird-IPv6"
+    },
+    "peers.details.publicKey": {
+        "message": "Öffentlicher Schlüssel"
+    },
+    "peers.details.connection": {
+        "message": "Verbindung"
+    },
+    "peers.details.latency": {
+        "message": "Latenz"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Letzter Handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Letzte Verbindungsaktualisierung"
+    },
+    "peers.details.bytes": {
+        "message": "Bytes"
+    },
+    "peers.details.bytesSent": {
+        "message": "Gesendet"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Empfangen"
+    },
+    "peers.details.localIce": {
+        "message": "Lokales ICE"
+    },
+    "peers.details.remoteIce": {
+        "message": "Remote ICE"
+    },
+    "peers.details.never": {
+        "message": "Nie"
+    },
+    "peers.details.justNow": {
+        "message": "Gerade eben"
+    },
+    "peers.details.refresh": {
+        "message": "Aktualisieren"
+    },
+    "peers.status.connected": {
+        "message": "Verbunden"
+    },
+    "peers.status.connecting": {
+        "message": "Wird verbunden"
+    },
+    "peers.status.disconnected": {
+        "message": "Nicht verbunden"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay"
+    },
+    "peers.details.networks": {
+        "message": "Ressourcen"
+    },
+    "peers.details.relayed": {
+        "message": "Relayed"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass aktiviert"
+    },
+    "networks.search.placeholder": {
+        "message": "Nach Netzwerk oder Domain suchen"
+    },
+    "networks.filter.all": {
+        "message": "Alle"
+    },
+    "networks.filter.active": {
+        "message": "Aktiv"
+    },
+    "networks.filter.overlapping": {
+        "message": "Überlappend"
+    },
+    "networks.empty.title": {
+        "message": "Keine Ressourcen verfügbar"
+    },
+    "networks.empty.description": {
+        "message": "Sie haben entweder keine Netzwerkressourcen verfügbar oder keinen Zugriff auf eine davon."
+    },
+    "networks.selected": {
+        "message": "Ausgewählt"
+    },
+    "networks.unselected": {
+        "message": "Nicht ausgewählt"
+    },
+    "networks.ips.heading": {
+        "message": "Aufgelöste IPs"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} von {total} aktiv"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Alle aktivieren"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Alle deaktivieren"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Exit Nodes suchen"
+    },
+    "exitNodes.none": {
+        "message": "Keiner"
+    },
+    "exitNodes.empty.title": {
+        "message": "Keine Exit Nodes verfügbar"
+    },
+    "exitNodes.empty.description": {
+        "message": "Für diesen Peer wurden keine Exit Nodes freigegeben."
+    },
+    "exitNodes.card.title": {
+        "message": "Exit Node"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Aktiv"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inaktiv"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Keiner"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Direkte Verbindung ohne Exit Node"
+    },
+    "quickActions.connect": {
+        "message": "Verbinden"
+    },
+    "quickActions.disconnect": {
+        "message": "Trennen"
+    },
+    "daemon.unavailable.title": {
+        "message": "NetBird-Dienst läuft nicht"
+    },
+    "daemon.unavailable.description": {
+        "message": "Die App stellt automatisch die Verbindung wieder her, sobald der Dienst läuft."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Dokumentation"
+    },
+    "daemon.outdated.title": {
+        "message": "NetBird Client ist veraltet"
+    },
+    "daemon.outdated.description": {
+        "message": "Die neue GUI ist nicht mit Ihrem älteren Client kompatibel. Aktualisieren Sie Ihren Client, um die neue Anwendung zu verwenden."
+    },
+    "daemon.outdated.download": {
+        "message": "Neueste Version herunterladen"
+    },
+    "error.jwt_clock_skew": {
+        "message": "Anmeldung fehlgeschlagen: Die Uhr dieses Geräts ist nicht mit dem Server synchron. Bitte synchronisieren Sie die Systemuhr und versuchen Sie es erneut."
+    },
+    "error.jwt_expired": {
+        "message": "Ihr Anmeldetoken ist abgelaufen. Bitte melden Sie sich erneut an."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Anmeldung fehlgeschlagen: Die Token-Signatur ist ungültig. Bitte wenden Sie sich an Ihren Administrator."
+    },
+    "error.session_expired": {
+        "message": "Ihre Sitzung ist abgelaufen. Bitte melden Sie sich erneut an."
+    },
+    "error.invalid_setup_key": {
+        "message": "Der Setup-Key fehlt oder ist ungültig."
+    },
+    "error.permission_denied": {
+        "message": "Die Anmeldung wurde vom Server abgelehnt."
+    },
+    "error.daemon_unreachable": {
+        "message": "Der NetBird-Dienst antwortet nicht. Bitte prüfen Sie, ob der Dienst läuft."
+    },
+    "error.settings_locked": {
+        "message": "Die Einstellungen können auf diesem Gerät nicht geändert werden: Ein Administrator hat sie gesperrt."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Diese Einstellung wird von Ihrer Organisation verwaltet und kann nicht geändert werden."
+    },
+    "error.unknown": {
+        "message": "Vorgang fehlgeschlagen."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird konnte auf diesem System nicht die nötigen Rechte anfordern. Führen Sie stattdessen dies aus:"
+    },
+    "error.elevation_failed": {
+        "message": "Die Änderung konnte mit erhöhten Rechten nicht angewendet werden. Führen Sie stattdessen dies aus:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root-Rechte"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "Administratorrechte"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Erfordert {actor}. Führen Sie stattdessen dies aus:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Sie können dies deaktivieren, zum erneuten Aktivieren sind {actor} erforderlich."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Sie können dies aktivieren, zum erneuten Deaktivieren sind {actor} erforderlich."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Warten auf Autorisierung…"
+    }
+}
diff --git a/client/ui/i18n/locales/en/common.json b/client/ui/i18n/locales/en/common.json
new file mode 100644
index 000000000..94d741b3e
--- /dev/null
+++ b/client/ui/i18n/locales/en/common.json
@@ -0,0 +1,1862 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird",
+        "description": "Hover tooltip on the system-tray / menu-bar icon. Brand name — do not translate."
+    },
+    "tray.status.disconnected": {
+        "message": "Disconnected",
+        "description": "Connection status surfaced through the tray icon: the client is not connected to the network."
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Not running",
+        "description": "Tray status: the background NetBird service (daemon) is not running."
+    },
+    "tray.status.error": {
+        "message": "Error",
+        "description": "Tray status: the client is in an error state."
+    },
+    "tray.status.connected": {
+        "message": "Connected",
+        "description": "Tray status: connected to the NetBird network."
+    },
+    "tray.status.connecting": {
+        "message": "Connecting",
+        "description": "Tray status: a connection is being established."
+    },
+    "tray.status.needsLogin": {
+        "message": "Login required",
+        "description": "Tray status: the user must sign in before connecting."
+    },
+    "tray.status.loginFailed": {
+        "message": "Login failed",
+        "description": "Tray status: the last sign-in attempt failed."
+    },
+    "tray.status.sessionExpired": {
+        "message": "Session expired",
+        "description": "Tray status: the authenticated session expired; the user must sign in again."
+    },
+    "tray.session.expiresIn": {
+        "message": "Session expires in {remaining}",
+        "description": "Tray row showing time left before the session expires. {remaining} is a human-readable duration such as '5 minutes', built from the tray.session.unit.* strings. Keep {remaining} unchanged."
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "less than a minute",
+        "description": "Duration fragment substituted into {remaining} (see tray.session.expiresIn). Used when under one minute remains."
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minute",
+        "description": "Duration fragment for exactly one minute, substituted into {remaining}."
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutes",
+        "description": "Duration fragment for several minutes, substituted into {remaining}. {count} is the number of minutes; keep {count}."
+    },
+    "tray.session.unit.hour": {
+        "message": "1 hour",
+        "description": "Duration fragment for exactly one hour, substituted into {remaining}."
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} hours",
+        "description": "Duration fragment for several hours. {count} is the number of hours; keep {count}."
+    },
+    "tray.session.unit.day": {
+        "message": "1 day",
+        "description": "Duration fragment for exactly one day, substituted into {remaining}."
+    },
+    "tray.session.unit.days": {
+        "message": "{count} days",
+        "description": "Duration fragment for several days. {count} is the number of days; keep {count}."
+    },
+    "tray.menu.open": {
+        "message": "Open NetBird",
+        "description": "Tray menu item that opens the main NetBird window. Keep short."
+    },
+    "tray.menu.connect": {
+        "message": "Connect",
+        "description": "Tray menu item that connects to the network. Keep short."
+    },
+    "tray.menu.disconnect": {
+        "message": "Disconnect",
+        "description": "Tray menu item that disconnects from the network. Keep short."
+    },
+    "tray.menu.exitNode": {
+        "message": "Exit Node",
+        "description": "Tray submenu title for choosing an exit node (route all traffic through another peer)."
+    },
+    "tray.menu.networks": {
+        "message": "Resources",
+        "description": "Tray submenu title listing network resources the user can reach. Labelled 'Resources' in the UI even though the key says networks."
+    },
+    "tray.menu.profiles": {
+        "message": "Profiles",
+        "description": "Tray submenu title listing connection profiles."
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Manage Profiles",
+        "description": "Tray menu item that opens Settings → Profiles."
+    },
+    "tray.menu.settings": {
+        "message": "Settings...",
+        "description": "Tray menu item that opens the Settings window. The trailing '...' signals that a window opens; keep it."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Create Debug Bundle",
+        "description": "Tray menu item that generates a diagnostic log bundle for support."
+    },
+    "tray.menu.about": {
+        "message": "Help & Support",
+        "description": "Tray submenu title for help and support links."
+    },
+    "tray.menu.github": {
+        "message": "GitHub",
+        "description": "Tray menu link to the GitHub repository. Brand name — do not translate."
+    },
+    "tray.menu.documentation": {
+        "message": "Documentation",
+        "description": "Tray menu link to the online documentation."
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Troubleshoot",
+        "description": "Tray menu link to troubleshooting help."
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Download latest version",
+        "description": "Tray menu item to download the latest available version."
+    },
+    "tray.menu.installVersion": {
+        "message": "Install version {version}",
+        "description": "Tray menu item to install a specific update. {version} is a version number like 0.30.1; keep {version}."
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}",
+        "description": "Tray menu row showing the installed UI version. 'GUI' = the graphical app. {version} is a version number; keep it."
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}",
+        "description": "Tray menu row showing the background-service version. 'Daemon' = the background NetBird service. {version} is a version number; keep it."
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—",
+        "description": "Placeholder shown in version rows when the version can't be determined. It is an em dash — leave as-is."
+    },
+    "tray.menu.quit": {
+        "message": "Quit NetBird",
+        "description": "Tray menu item that fully exits the app and removes the tray icon. Keep short."
+    },
+    "notify.daemonOutdated.title": {
+        "message": "NetBird service is outdated",
+        "description": "Title of the OS desktop notification shown when the running daemon is too old for this UI."
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Update the NetBird service to use this app.",
+        "description": "Body of the desktop notification telling the user to upgrade the daemon."
+    },
+    "notify.update.title": {
+        "message": "NetBird update available",
+        "description": "Title of the OS desktop notification shown when an app update is available."
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} is available.",
+        "description": "Body of the update-available desktop notification. {version} is the new version number; keep it."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Your administrator requires this update.",
+        "description": "Sentence appended to the update notification body when the admin has made the update mandatory. Note the leading space — keep it."
+    },
+    "notify.error.title": {
+        "message": "Error",
+        "description": "Title of a generic error desktop notification."
+    },
+    "notify.error.connect": {
+        "message": "Failed to connect",
+        "description": "Error notification body shown when connecting failed."
+    },
+    "notify.error.disconnect": {
+        "message": "Failed to disconnect",
+        "description": "Error notification body shown when disconnecting failed."
+    },
+    "notify.error.switchProfile": {
+        "message": "Failed to switch to {profile}",
+        "description": "Error notification shown when switching profiles failed. {profile} is the target profile name; keep it."
+    },
+    "notify.error.exitNode": {
+        "message": "Failed to update exit node {name}",
+        "description": "Error notification shown when updating the exit node failed. {name} is the exit node name; keep it."
+    },
+    "notify.sessionExpired.title": {
+        "message": "NetBird session expired",
+        "description": "Title of the desktop notification shown when the session has expired."
+    },
+    "notify.sessionExpired.body": {
+        "message": "Your NetBird session has expired. Please log in again.",
+        "description": "Body of the session-expired desktop notification."
+    },
+    "notify.sessionWarning.title": {
+        "message": "Session expires soon",
+        "description": "Title of the desktop notification warning that the session will expire soon."
+    },
+    "notify.sessionWarning.body": {
+        "message": "Your NetBird session expires in {remaining}. Click Extend now to renew.",
+        "description": "Body of the session-expiry warning notification. {remaining} is a human-readable duration (see tray.session.unit.*); keep it. 'Extend now' refers to the action button notify.sessionWarning.extend."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Your NetBird session is about to expire. Click Extend now to renew.",
+        "description": "Generic session-expiry warning body used when the exact remaining time isn't known."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Extend now",
+        "description": "Action button on the session-expiry notification that renews the session. Keep short."
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Dismiss",
+        "description": "Action button on the session-expiry notification that dismisses it. Keep short."
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Failed to extend NetBird session",
+        "description": "Notification shown when renewing the session failed."
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "NetBird session extended",
+        "description": "Title of the notification confirming the session was renewed."
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Your session has been refreshed.",
+        "description": "Body of the notification confirming the session was renewed."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Session deadline rejected",
+        "description": "Title of the notification shown when the server sent an invalid session deadline."
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "The server sent an invalid session deadline. Please sign in again.",
+        "description": "Body explaining the server sent an invalid session deadline and the user must sign in again."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird settings updated",
+        "description": "Title of the desktop notification shown when an MDM (IT-managed) policy changed the daemon configuration at runtime."
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Your NetBird configuration was updated by your IT policy.",
+        "description": "Body of the MDM policy-applied notification, telling the user their settings were changed by their organization's device-management policy."
+    },
+    "common.cancel": {
+        "message": "Cancel",
+        "description": "Generic Cancel button label, reused across dialogs. Keep short."
+    },
+    "common.save": {
+        "message": "Save",
+        "description": "Generic Save button label. Keep short."
+    },
+    "common.saveChanges": {
+        "message": "Save Changes",
+        "description": "Button label to save edited settings. Keep short."
+    },
+    "common.saving": {
+        "message": "Saving…",
+        "description": "Button label / status shown while a save is in progress. Ends with an ellipsis."
+    },
+    "common.close": {
+        "message": "Close",
+        "description": "Generic Close button label. Keep short."
+    },
+    "common.copy": {
+        "message": "Copy",
+        "description": "Generic Copy button label (copy to clipboard). Keep short."
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Toggle password visibility",
+        "description": "Accessibility label for the show/hide button inside a password field."
+    },
+    "common.increase": {
+        "message": "Increase",
+        "description": "Accessibility label for the increment (+) button on a numeric stepper input."
+    },
+    "common.decrease": {
+        "message": "Decrease",
+        "description": "Accessibility label for the decrement (−) button on a numeric stepper input."
+    },
+    "common.delete": {
+        "message": "Delete",
+        "description": "Generic Delete button label. Keep short."
+    },
+    "common.create": {
+        "message": "Create",
+        "description": "Generic Create button label. Keep short."
+    },
+    "common.add": {
+        "message": "Add",
+        "description": "Generic Add button label. Keep short."
+    },
+    "common.remove": {
+        "message": "Remove",
+        "description": "Generic Remove button label. Keep short."
+    },
+    "common.refresh": {
+        "message": "Refresh",
+        "description": "Generic Refresh button label. Keep short."
+    },
+    "common.loading": {
+        "message": "Loading…",
+        "description": "Generic loading indicator text. Ends with an ellipsis."
+    },
+    "common.netbird": {
+        "message": "NetBird",
+        "description": "The product name. Brand — do not translate."
+    },
+    "common.noResults.title": {
+        "message": "Could not find any results",
+        "description": "Title of the empty state shown when a search or filter returns nothing."
+    },
+    "common.noResults.description": {
+        "message": "We couldn't find any results. Please try a different search term or change your filters.",
+        "description": "Body of the no-results empty state, suggesting a different search term or filters."
+    },
+    "notConnected.title": {
+        "message": "Disconnected",
+        "description": "Title of the placeholder shown on data screens while disconnected."
+    },
+    "notConnected.description": {
+        "message": "Connect to NetBird first to view detailed information about your peers, network resources, and exit nodes.",
+        "description": "Body explaining the user must connect to NetBird first to see peer, resource, and exit-node details."
+    },
+    "connect.status.disconnected": {
+        "message": "Disconnected",
+        "description": "Label on the main-window connection toggle: not connected."
+    },
+    "connect.status.connecting": {
+        "message": "Connecting...",
+        "description": "Connection toggle label while connecting. Ends with an ellipsis."
+    },
+    "connect.status.connected": {
+        "message": "Connected",
+        "description": "Connection toggle label when connected."
+    },
+    "connect.status.disconnecting": {
+        "message": "Disconnecting...",
+        "description": "Connection toggle label while disconnecting. Ends with an ellipsis."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon unavailable",
+        "description": "Connection toggle label when the background service is unavailable. 'Daemon' = background service."
+    },
+    "connect.status.loginRequired": {
+        "message": "Login required",
+        "description": "Connection toggle label when sign-in is required before connecting."
+    },
+    "connect.error.loginTitle": {
+        "message": "Login Failed",
+        "description": "Error-dialog title shown when sign-in fails. The action-named '… Failed' style is intentional — keep it."
+    },
+    "connect.error.connectTitle": {
+        "message": "Connect Failed",
+        "description": "Error-dialog title shown when connecting fails."
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Disconnect Failed",
+        "description": "Error-dialog title shown when disconnecting fails."
+    },
+    "nav.peers.title": {
+        "message": "Peers",
+        "description": "Navigation label for the Peers section (other devices in the network)."
+    },
+    "nav.peers.description": {
+        "message": "{connected} of {total} connected",
+        "description": "Sub-label under Peers showing how many are connected. {connected} and {total} are numbers; keep both."
+    },
+    "nav.resources.title": {
+        "message": "Resources",
+        "description": "Navigation label for the Resources section (routed networks)."
+    },
+    "nav.resources.description": {
+        "message": "{active} of {total} active",
+        "description": "Sub-label under Resources showing how many are active. {active} and {total} are numbers; keep both."
+    },
+    "nav.exitNode.title": {
+        "message": "Exit Nodes",
+        "description": "Navigation label for the Exit Nodes section."
+    },
+    "nav.exitNode.none": {
+        "message": "Not active",
+        "description": "Sub-label under Exit Nodes when no exit node is in use."
+    },
+    "nav.exitNode.using": {
+        "message": "Via {name}",
+        "description": "Sub-label under Exit Nodes when one is active. {name} is the exit node's name; keep it."
+    },
+    "header.openSettings": {
+        "message": "Open settings",
+        "description": "Accessibility label / tooltip for the gear icon that opens Settings."
+    },
+    "header.togglePanel": {
+        "message": "Toggle side panel",
+        "description": "Accessibility label / tooltip for the button that shows or hides the side panel."
+    },
+    "profile.selector.loading": {
+        "message": "Loading...",
+        "description": "Shown in the profile picker while profiles load. Ends with an ellipsis."
+    },
+    "profile.selector.noProfile": {
+        "message": "No profile",
+        "description": "Shown in the profile picker when no profile is selected."
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Search profile by name...",
+        "description": "Placeholder text in the profile picker's search field."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "No Profiles Found",
+        "description": "Title shown in the profile picker when a search matches no profiles."
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Try a different search term or create a new profile.",
+        "description": "Body shown when no profiles match the search, suggesting a different term or creating one."
+    },
+    "profile.selector.newProfile": {
+        "message": "New Profile",
+        "description": "Button in the profile picker to create a new profile. Keep short."
+    },
+    "profile.selector.moreOptions": {
+        "message": "More options",
+        "description": "Accessibility label for the per-profile kebab (⋯) menu."
+    },
+    "profile.selector.deregister": {
+        "message": "Deregister",
+        "description": "Per-profile menu action: deregister (sign out of the profile but keep it)."
+    },
+    "profile.selector.delete": {
+        "message": "Delete",
+        "description": "Per-profile menu action: delete the profile."
+    },
+    "profile.selector.switchTo": {
+        "message": "Switch to this profile",
+        "description": "Tooltip / label for the action that switches to a profile."
+    },
+    "profile.selector.edit": {
+        "message": "Edit",
+        "description": "Per-profile menu action: open the edit dialog to rename or change the management server."
+    },
+    "profile.edit.title": {
+        "message": "Edit Profile",
+        "description": "Title of the dialog for editing an existing profile."
+    },
+    "profile.edit.submit": {
+        "message": "Save Changes",
+        "description": "Submit button on the edit-profile dialog. Keep short."
+    },
+    "profile.dialog.title": {
+        "message": "Enter Profile Name",
+        "description": "Title of the dialog for naming a new profile."
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Profile Name",
+        "description": "Field label for the profile name."
+    },
+    "profile.dialog.description": {
+        "message": "Set an easily identifiable name for your profile.",
+        "description": "Helper text under the profile-name field."
+    },
+    "profile.dialog.placeholder": {
+        "message": "e.g. Work",
+        "description": "Example placeholder shown in the profile-name field. 'Work' is a sample value; translate it to a natural example."
+    },
+    "profile.dialog.submit": {
+        "message": "Add Profile",
+        "description": "Submit button on the add-profile dialog. Keep short."
+    },
+    "profile.dialog.required": {
+        "message": "Please enter a profile name, e.g. work, home",
+        "description": "Validation message shown when the profile name is empty. The examples (work, home) may be localized."
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Use NetBird Cloud or your own server.",
+        "description": "Helper text noting the profile can use NetBird Cloud or a self-hosted server."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Couldn't reach this server. Check the URL, or add the profile anyway if you're sure it's correct.",
+        "description": "Soft warning when the entered server URL couldn't be reached; the user may add the profile anyway."
+    },
+    "header.menu.settings": {
+        "message": "Settings...",
+        "description": "'More' menu item in the header that opens Settings. The trailing '...' signals a window opens."
+    },
+    "header.menu.defaultView": {
+        "message": "Default View",
+        "description": "'More' menu item that switches the main window to the compact default view."
+    },
+    "header.menu.advancedView": {
+        "message": "Advanced View",
+        "description": "'More' menu item that switches the main window to the wider advanced view."
+    },
+    "header.menu.updateAvailable": {
+        "message": "Update Available",
+        "description": "'More' menu item / badge shown when an update is available."
+    },
+    "header.menu.open": {
+        "message": "Open menu",
+        "description": "Accessibility label for the header's more (⋮) button that opens the menu."
+    },
+    "header.profile.switch": {
+        "message": "Switch profile",
+        "description": "Accessibility label for the header's profile selector button."
+    },
+    "connect.toggle.label": {
+        "message": "Toggle NetBird connection",
+        "description": "Accessibility label for the large connect/disconnect toggle on the main page."
+    },
+    "connect.localIp.label": {
+        "message": "Local IP addresses",
+        "description": "Accessibility label for the local IP selector that toggles between IPv4 and IPv6 on the main page."
+    },
+    "common.search": {
+        "message": "Search",
+        "description": "Accessibility label for a generic search input."
+    },
+    "common.filter": {
+        "message": "Filter",
+        "description": "Accessibility label for a generic filter control."
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Select exit node",
+        "description": "Accessibility label for the exit-node picker button at the bottom of the main page."
+    },
+    "peers.row.label": {
+        "message": "Open details for {name}, {status}",
+        "description": "Accessibility label for a peer row in the list. {name} is the peer name and {status} is the connection status; keep both placeholders."
+    },
+    "peers.dialog.title": {
+        "message": "Peer details",
+        "description": "Accessibility title (announced to screen readers) for the peer details dialog/panel."
+    },
+    "networks.row.toggle": {
+        "message": "Toggle {name}",
+        "description": "Accessibility label for the row-wide toggle on a network/resource. {name} is the resource id; keep the placeholder."
+    },
+    "networks.bulk.label": {
+        "message": "Toggle all visible resources",
+        "description": "Accessibility label for the bulk enable/disable button at the bottom of the resources list."
+    },
+    "profile.switch.title": {
+        "message": "Switch Profile to \"{name}\"?",
+        "description": "Confirmation-dialog title for switching profiles. {name} is the target profile name, shown in quotes; keep {name} and the surrounding quotes."
+    },
+    "profile.switch.message": {
+        "message": "Are you sure you want to switch profiles?\nYour current profile will be disconnected.",
+        "description": "Confirmation body for switching profiles. Contains a line break (\\n) — keep it."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirm",
+        "description": "Confirm button on the switch-profile dialog. Keep short."
+    },
+    "profile.deregister.title": {
+        "message": "Deregister Profile \"{name}\"?",
+        "description": "Confirmation-dialog title for deregistering a profile. {name} is the profile name; keep it and the quotes."
+    },
+    "profile.deregister.message": {
+        "message": "Are you sure you want to deregister this profile?\nYou will need to log in again to use it.",
+        "description": "Confirmation body for deregistering; warns the user must sign in again. Contains a line break (\\n) — keep it."
+    },
+    "profile.deregister.confirm": {
+        "message": "Deregister",
+        "description": "Confirm button on the deregister dialog. Keep short."
+    },
+    "profile.delete.title": {
+        "message": "Delete Profile \"{name}\"?",
+        "description": "Confirmation-dialog title for deleting a profile. {name} is the profile name; keep it and the quotes."
+    },
+    "profile.delete.message": {
+        "message": "Are you sure you want to delete this profile?\nThis action cannot be undone.",
+        "description": "Confirmation body for deleting; warns the action can't be undone. Contains a line break (\\n) — keep it."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Active profiles cannot be deleted. Switch to a different one before deleting this profile.",
+        "description": "Tooltip explaining the active profile can't be deleted until the user switches away."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "The default profile cannot be deleted.",
+        "description": "Tooltip explaining the default profile can't be deleted."
+    },
+    "profile.error.switchTitle": {
+        "message": "Switch Profile Failed",
+        "description": "Error-dialog title when switching profiles fails."
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Deregister Profile Failed",
+        "description": "Error-dialog title when deregistering a profile fails."
+    },
+    "profile.error.deleteTitle": {
+        "message": "Delete Profile Failed",
+        "description": "Error-dialog title when deleting a profile fails."
+    },
+    "profile.error.createTitle": {
+        "message": "Create Profile Failed",
+        "description": "Error-dialog title when creating a profile fails."
+    },
+    "profile.error.editTitle": {
+        "message": "Edit Profile Failed",
+        "description": "Error-dialog title when editing a profile (rename or management URL change) fails."
+    },
+    "profile.error.loadTitle": {
+        "message": "Load Profiles Failed",
+        "description": "Error-dialog title when loading profiles fails."
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Active profile",
+        "description": "Section heading in the header profile dropdown for the current profile."
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Switch Profile",
+        "description": "Section heading / action in the profile dropdown to switch profiles."
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Other",
+        "description": "Label shown for a profile that has no associated email address."
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Add Profile",
+        "description": "Profile dropdown action to add a profile."
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Manage Profiles",
+        "description": "Profile dropdown action that opens Settings → Profiles."
+    },
+    "profile.dropdown.settings": {
+        "message": "Settings",
+        "description": "Profile dropdown action that opens Settings."
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Profiles",
+        "description": "Section heading on the Profiles settings tab."
+    },
+    "settings.profiles.intro": {
+        "message": "Keep separate NetBird identities side by side, for example work and personal accounts, or different management servers. Add, deregister, or delete profiles below.",
+        "description": "Intro paragraph on the Profiles settings tab explaining what profiles are for."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Add Profile",
+        "description": "Button on the Profiles settings tab to add a profile."
+    },
+    "settings.profiles.active": {
+        "message": "Active",
+        "description": "Badge marking the currently active profile in the profiles table."
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "No Profiles",
+        "description": "Title of the empty state when there are no profiles."
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Create a profile to connect to a NetBird management server.",
+        "description": "Body of the no-profiles empty state."
+    },
+    "settings.error.loadTitle": {
+        "message": "Load Settings Failed",
+        "description": "Error-dialog title when loading settings fails."
+    },
+    "settings.error.saveTitle": {
+        "message": "Save Settings Failed",
+        "description": "Error-dialog title when saving settings fails."
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Debug Bundle Failed",
+        "description": "Error-dialog title when creating the debug bundle fails."
+    },
+    "settings.nav.label": {
+        "message": "Settings sections",
+        "description": "Accessibility label for the Settings page's side navigation (list of section tabs)."
+    },
+    "settings.tabs.general": {
+        "message": "General",
+        "description": "Settings tab label: General. Keep short."
+    },
+    "settings.tabs.network": {
+        "message": "Network",
+        "description": "Settings tab label: Network. Keep short."
+    },
+    "settings.tabs.security": {
+        "message": "Security",
+        "description": "Settings tab label: Security. Keep short."
+    },
+    "settings.tabs.profiles": {
+        "message": "Profiles",
+        "description": "Settings tab label: Profiles. Keep short."
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH",
+        "description": "Settings tab label: SSH. Acronym — keep as-is."
+    },
+    "settings.tabs.advanced": {
+        "message": "Advanced",
+        "description": "Settings tab label: Advanced. Keep short."
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Troubleshoot",
+        "description": "Settings tab label: Troubleshoot. Keep short."
+    },
+    "settings.tabs.about": {
+        "message": "About",
+        "description": "Settings tab label: About. Keep short."
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Update Available",
+        "description": "Settings tab label / badge shown when an update is available."
+    },
+    "settings.general.section.general": {
+        "message": "General",
+        "description": "Section heading on the General settings tab."
+    },
+    "settings.general.section.connection": {
+        "message": "Connection",
+        "description": "Section heading for connection-related options on the General tab."
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Connect on Startup",
+        "description": "Toggle label: connect automatically when the service starts."
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Automatically establish a connection when the service starts.",
+        "description": "Helper text for the connect-on-startup toggle."
+    },
+    "settings.general.notifications.label": {
+        "message": "Desktop Notifications",
+        "description": "Toggle label: enable desktop notifications."
+    },
+    "settings.general.notifications.help": {
+        "message": "Show desktop notifications for new updates and connection events.",
+        "description": "Helper text for the desktop-notifications toggle."
+    },
+    "settings.general.autostart.label": {
+        "message": "Launch NetBird UI at Login",
+        "description": "Toggle label: launch the NetBird UI at login."
+    },
+    "settings.general.autostart.help": {
+        "message": "Start the NetBird interface automatically when you log in. This affects the graphical interface only, not the background service.",
+        "description": "Helper text clarifying autostart affects only the UI, not the background service."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Autostart Change Failed",
+        "description": "Error-dialog title when changing the autostart setting fails."
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Stay Connected After Quitting",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "The connection stays up in the background after you close NetBird. It only stops when you disconnect it yourself.",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
+    "settings.general.language.label": {
+        "message": "Display Language",
+        "description": "Label for the display-language picker."
+    },
+    "settings.general.language.help": {
+        "message": "Choose the language for the NetBird interface.",
+        "description": "Helper text for the language picker."
+    },
+    "settings.general.language.search": {
+        "message": "Search language…",
+        "description": "Placeholder in the language picker's search field."
+    },
+    "settings.general.language.empty": {
+        "message": "No languages match.",
+        "description": "Shown when no languages match the search."
+    },
+    "settings.general.theme.label": {
+        "message": "Theme",
+        "description": "Label for the appearance/theme picker."
+    },
+    "settings.general.theme.help": {
+        "message": "Choose light or dark, or follow your system appearance.",
+        "description": "Helper text for the theme picker."
+    },
+    "settings.general.theme.system": {
+        "message": "System",
+        "description": "Theme option: follow the OS appearance."
+    },
+    "settings.general.theme.light": {
+        "message": "Light",
+        "description": "Theme option: light appearance."
+    },
+    "settings.general.theme.dark": {
+        "message": "Dark",
+        "description": "Theme option: dark appearance."
+    },
+    "settings.general.management.label": {
+        "message": "Management Server",
+        "description": "Label for the management-server selector."
+    },
+    "settings.general.management.help": {
+        "message": "Connect to NetBird Cloud or your own self-hosted management server. Changes will reconnect the client.",
+        "description": "Helper text explaining Cloud vs self-hosted management server; warns that changes reconnect the client."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud",
+        "description": "Option label for using NetBird Cloud as the management server."
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Self-hosted",
+        "description": "Option label for using a self-hosted management server. 'Self-hosted' is a common technical term."
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443",
+        "description": "Example URL placeholder for the self-hosted server field. It is a sample URL — do not translate the URL itself."
+    },
+    "settings.general.management.urlError": {
+        "message": "Please enter a valid URL, e.g., https://netbird.selfhosted.com:443",
+        "description": "Validation message for an invalid management-server URL. The example URL stays as-is."
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Couldn't reach this server. Check the URL, or save anyway if you're sure it's correct.",
+        "description": "Soft warning when the management URL couldn't be reached; the user may save anyway."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Switch to NetBird Cloud?",
+        "description": "Confirmation-dialog title for switching to NetBird Cloud."
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "This disconnects your self-hosted server.\nYou may need to log in again.",
+        "description": "Confirmation body warning the self-hosted server will be disconnected. Contains a line break (\\n) — keep it."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Switch to Cloud",
+        "description": "Confirm button for switching to Cloud. Keep short."
+    },
+    "settings.network.section.connectivity": {
+        "message": "Connectivity",
+        "description": "Section heading for connectivity options on the Network tab."
+    },
+    "settings.network.section.routingDns": {
+        "message": "Routing & DNS",
+        "description": "Section heading for routing and DNS options. 'DNS' is an acronym — keep it."
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconnect on Network Change",
+        "description": "Toggle label: reconnect automatically on network change."
+    },
+    "settings.network.monitor.help": {
+        "message": "Monitor the network and automatically reconnect on changes such as Wi-Fi switching, Ethernet changes, or resume from sleep.",
+        "description": "Helper text for the network-change reconnect toggle."
+    },
+    "settings.network.dns.label": {
+        "message": "Enable DNS",
+        "description": "Toggle label: enable DNS. 'DNS' — keep acronym."
+    },
+    "settings.network.dns.help": {
+        "message": "Apply NetBird-managed DNS settings to the host resolver.",
+        "description": "Helper text for the enable-DNS toggle."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Enable Client Routes",
+        "description": "Toggle label: enable client routes."
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Accept routes from other peers to reach their networks.",
+        "description": "Helper text for client routes (accept routes from other peers)."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Enable Server Routes",
+        "description": "Toggle label: enable server routes."
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Advertise this host's local routes to other peers.",
+        "description": "Helper text for server routes (advertise this host's local routes to other peers)."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Enable IPv6",
+        "description": "Toggle label: enable IPv6. 'IPv6' — keep as-is."
+    },
+    "settings.network.ipv6.help": {
+        "message": "Use IPv6 addressing for the NetBird overlay network.",
+        "description": "Helper text for the IPv6 toggle."
+    },
+    "settings.security.section.firewall": {
+        "message": "Firewall",
+        "description": "Section heading: Firewall."
+    },
+    "settings.security.section.encryption": {
+        "message": "Encryption",
+        "description": "Section heading: Encryption."
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Block Inbound Traffic",
+        "description": "Toggle label: block inbound traffic."
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Reject unsolicited connections from peers to this device and any networks it routes. Outbound traffic is unaffected.",
+        "description": "Helper text for blocking inbound traffic."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Block LAN Access",
+        "description": "Toggle label: block LAN access. 'LAN' — keep acronym."
+    },
+    "settings.security.blockLan.help": {
+        "message": "Prevent peers from reaching your local network or its devices when this device routes their traffic.",
+        "description": "Helper text for blocking LAN access."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Enable Quantum-Resistance",
+        "description": "Toggle label: enable quantum-resistance."
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Add a post-quantum key exchange via Rosenpass on top of WireGuard®.",
+        "description": "Helper text: adds a post-quantum key exchange via Rosenpass on top of WireGuard®. 'Rosenpass' and 'WireGuard®' are product names — do not translate; keep the ® symbol."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Enable Permissive Mode",
+        "description": "Toggle label: enable permissive mode (for quantum-resistance)."
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Allow connections to peers without quantum-resistance support.",
+        "description": "Helper text for permissive mode (allow peers without quantum-resistance support)."
+    },
+    "settings.ssh.section.server": {
+        "message": "Server",
+        "description": "Section heading: Server (SSH settings)."
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Capabilities",
+        "description": "Section heading: Capabilities (SSH features)."
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Authentication",
+        "description": "Section heading: Authentication (SSH)."
+    },
+    "settings.ssh.server.label": {
+        "message": "Enable SSH Server",
+        "description": "Toggle label: enable the SSH server."
+    },
+    "settings.ssh.server.help": {
+        "message": "Run the NetBird SSH server on this host so other peers can connect to it.",
+        "description": "Helper text for the SSH server toggle."
+    },
+    "settings.ssh.root.label": {
+        "message": "Allow Root Login",
+        "description": "Toggle label: allow root login over SSH. 'root' is the Unix superuser account — keep as-is."
+    },
+    "settings.ssh.root.help": {
+        "message": "Let peers sign in as the root user. Disable to require a non-privileged account.",
+        "description": "Helper text for allowing root login."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Allow SFTP",
+        "description": "Toggle label: allow SFTP. 'SFTP' — keep acronym."
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transfer files securely using native SFTP or SCP clients.",
+        "description": "Helper text about SFTP/SCP file transfer. Keep the acronyms."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Local Port Forwarding",
+        "description": "Toggle label: local port forwarding."
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Let connecting peers tunnel local ports to services reachable from this host.",
+        "description": "Helper text for local port forwarding."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Remote Port Forwarding",
+        "description": "Toggle label: remote port forwarding."
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Let connecting peers expose ports on this host back to their own machine.",
+        "description": "Helper text for remote port forwarding."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Enable JWT Authentication",
+        "description": "Toggle label: enable JWT authentication. 'JWT' — keep acronym."
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verify each SSH session against your IdP for user identity and audit. Disable to rely on network ACL policies only, useful when no IdP is available.",
+        "description": "Helper text for JWT auth. 'IdP' (identity provider) and 'ACL' are acronyms — keep them."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "JWT Cache TTL",
+        "description": "Label for the JWT cache time-to-live field. 'JWT' and 'TTL' — keep acronyms."
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "How long this client caches a JWT before prompting again on outgoing SSH connections. Set to 0 to disable caching and authenticate on every connection.",
+        "description": "Helper text for the JWT cache TTL; mentions setting 0 to disable caching."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "Second(s)",
+        "description": "Unit suffix shown after the JWT TTL number field. The '(s)' marks an optional plural."
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interface",
+        "description": "Section heading: Interface (network-interface settings)."
+    },
+    "settings.advanced.section.security": {
+        "message": "Security",
+        "description": "Section heading: Security (advanced)."
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Name",
+        "description": "Field label for the WireGuard interface name."
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Use 1-15 letters, digits, dots, hyphens, or underscores.",
+        "description": "Validation message for the interface name (allowed characters)."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Must start with \"utun\" followed by a number (e.g. utun100).",
+        "description": "Validation message specific to macOS, where the name must start with 'utun' followed by a number. Keep 'utun' and the example."
+    },
+    "settings.advanced.port.label": {
+        "message": "Port",
+        "description": "Field label: Port."
+    },
+    "settings.advanced.port.error": {
+        "message": "Enter a port between {min} and {max}.",
+        "description": "Validation message for the port range. {min} and {max} are numbers; keep them."
+    },
+    "settings.advanced.port.help": {
+        "message": "If set to 0, a random free port will be used.",
+        "description": "Helper text: 0 means a random free port is used."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU",
+        "description": "Field label: MTU. 'MTU' — keep acronym."
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Enter an MTU value between {min} and {max}.",
+        "description": "Validation message for the MTU range. {min} and {max} are numbers; keep them."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Pre-shared Key",
+        "description": "Field label: Pre-shared Key."
+    },
+    "settings.advanced.psk.help": {
+        "message": "Optional WireGuard PSK for extra symmetric encryption. Not the same as a NetBird Setup Key. You will only communicate with peers that use the same pre-shared key.",
+        "description": "Helper text for the WireGuard PSK. 'WireGuard', 'PSK', and 'NetBird Setup Key' are product/technical terms — keep them."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Debug bundle",
+        "description": "Section heading: Debug bundle."
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonymize Sensitive Information",
+        "description": "Label for the anonymization level dropdown (None, Default, Strict)."
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Hides IP addresses, domains, and other sensitive values.",
+        "description": "Helper text under the anonymization dropdown. The level details live in the info tooltip."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Default keeps internal IPv4 addresses and peer names readable for support. Strict additionally anonymizes private (RFC 1918), CGNAT, and link-local IP addresses, peer names, and WireGuard public keys. Recurring values map to the same placeholder, so peers stay distinguishable. Use Strict when sharing the bundle outside your organization.",
+        "description": "Info tooltip explaining the anonymization levels. 'RFC 1918', 'CGNAT', 'link-local', and 'WireGuard' are technical terms — keep them."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "None",
+        "description": "Dropdown option: no anonymization."
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Default",
+        "description": "Dropdown option: default anonymization level."
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Strict",
+        "description": "Dropdown option: strict anonymization level."
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Include System Information",
+        "description": "Toggle label: include system information in the bundle."
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Include OS, kernel, network interfaces, and routing tables.",
+        "description": "Helper text listing the system info included (OS, kernel, interfaces, routing tables)."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Upload Bundle to NetBird Servers",
+        "description": "Toggle label: upload the bundle to NetBird servers."
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Returns an upload key to share with NetBird support.",
+        "description": "Helper text for uploading the bundle."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Enable Trace Logs",
+        "description": "Toggle label: raise daemon log level to TRACE while the bundle is built. 'TRACE' is a log level."
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Raises the log level to TRACE and restores it after.",
+        "description": "Helper text for the trace toggle. 'TRACE' is a log level — keep as-is."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Capture Session",
+        "description": "Toggle label: open a capture session — reconnect NetBird, wait a duration, optionally record packets."
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Reconnects and waits so you can reproduce the issue.",
+        "description": "Helper text for the master Capture Session toggle."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capture Network Packets",
+        "description": "Toggle label: capture packets to a .pcap during the capture session."
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Saves a .pcap of network traffic during the capture window.",
+        "description": "Helper text for the packet recording toggle. '.pcap' is a file extension — keep it."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Capture Duration",
+        "description": "Label for the trace-capture duration field."
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "How long the capture session runs.",
+        "description": "Helper text for the capture duration."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "Minute(s)",
+        "description": "Unit suffix after the duration field. The '(s)' marks an optional plural."
+    },
+    "settings.troubleshooting.create": {
+        "message": "Create Bundle",
+        "description": "Button to create the debug bundle. Keep short."
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Collecting logs, system details, and connection state. This usually takes a moment. You can keep using NetBird or close Settings while it finishes.",
+        "description": "Status text shown while the debug bundle is being collected; reassures the user they can keep using NetBird or close Settings meanwhile."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Canceling…",
+        "description": "Status shown while cancelling bundle creation. Ends with an ellipsis."
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Debug bundle successfully uploaded!",
+        "description": "Success title after the bundle was uploaded."
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Bundle saved",
+        "description": "Title shown when the bundle was saved locally (not uploaded)."
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Share the upload key below with <docs>NetBird support</docs>. A local copy was also saved on your device.",
+        "description": "Body after upload, telling the user to share the upload key with support. '<docs>…</docs>' wraps the inline link to the NetBird support docs — keep the tags exactly and wrap the phrase that means 'NetBird support'."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Your debug bundle has been saved locally.",
+        "description": "Body shown when the bundle was only saved locally."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copy Key",
+        "description": "Button to copy the upload key. Keep short."
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Open Folder",
+        "description": "Button to open the folder containing the bundle. Keep short."
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Open file location",
+        "description": "Button to reveal the bundle file in the OS file manager."
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Upload failed: {reason} The bundle is still saved locally.",
+        "description": "Shown when upload failed but the bundle was saved locally. {reason} is the server error text; keep it."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Upload failed. The bundle is still saved locally.",
+        "description": "Shown when upload failed (no specific reason) but the bundle was saved locally."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconnecting NetBird…",
+        "description": "Progress stage: reconnecting NetBird. Ends with an ellipsis."
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capturing debug logs",
+        "description": "Progress stage: capturing logs. {elapsed} and {total} are time values (e.g. 0:30 / 2:00); keep both."
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Generating debug bundle…",
+        "description": "Progress stage: generating the debug bundle. Ends with an ellipsis."
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Uploading to NetBird…",
+        "description": "Progress stage: uploading to NetBird. Ends with an ellipsis."
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Canceling…",
+        "description": "Progress stage: cancelling. Ends with an ellipsis."
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}",
+        "description": "About tab: client product name and version. {version} is a version number; keep it. 'NetBird Client' — keep brand."
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client",
+        "description": "About tab: the client product name shown when no version is available. Brand — do not translate."
+    },
+    "settings.about.development": {
+        "message": "[Development]",
+        "description": "Badge shown next to the version on development builds. Keep the square brackets."
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}",
+        "description": "About tab: UI component name and version. {version} is a version number; keep it. 'GUI' = the graphical app."
+    },
+    "settings.about.guiName": {
+        "message": "GUI",
+        "description": "About tab: the UI component name shown without a version. 'GUI' = the graphical app."
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. All Rights Reserved.",
+        "description": "Copyright line. {year} is the current year; keep it. 'NetBird' — brand."
+    },
+    "settings.about.links.imprint": {
+        "message": "Imprint",
+        "description": "Footer link: Imprint (legal notice / Impressum)."
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacy",
+        "description": "Footer link: Privacy policy."
+    },
+    "settings.about.links.cla": {
+        "message": "CLA",
+        "description": "Footer link: CLA (Contributor License Agreement). Acronym — keep as-is."
+    },
+    "settings.about.links.terms": {
+        "message": "Terms of Service",
+        "description": "Footer link: Terms of Service."
+    },
+    "settings.about.community.github": {
+        "message": "GitHub",
+        "description": "Community link: GitHub. Brand — do not translate."
+    },
+    "settings.about.community.slack": {
+        "message": "Slack",
+        "description": "Community link: Slack. Brand — do not translate."
+    },
+    "settings.about.community.forum": {
+        "message": "Forum",
+        "description": "Community link: Forum."
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentation",
+        "description": "Community link: Documentation."
+    },
+    "settings.about.community.feedback": {
+        "message": "Feedback",
+        "description": "Community link: Feedback."
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} is ready to install.",
+        "description": "Update banner text when a new version is ready to install. {version} is the version number; keep it."
+    },
+    "update.banner.later": {
+        "message": "Later",
+        "description": "Banner button to postpone the update. Keep short."
+    },
+    "update.banner.installNow": {
+        "message": "Install now",
+        "description": "Banner button to install the update now. Keep short."
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "Version {version} is available for download.",
+        "description": "Update card text when a version is available to download. {version} is the version number; keep it."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "Version {version} is available for install.",
+        "description": "Update card text when a version is available to install. {version} is the version number; keep it."
+    },
+    "update.card.whatsNew": {
+        "message": "What's new?",
+        "description": "Link / label that opens the release notes."
+    },
+    "update.card.installNow": {
+        "message": "Install Now",
+        "description": "Update card button: install now. Keep short."
+    },
+    "update.card.getInstaller": {
+        "message": "Download",
+        "description": "Update card button: download the installer."
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird checks for updates in the background.",
+        "description": "Note that NetBird checks for updates in the background."
+    },
+    "update.card.changelog": {
+        "message": "Changelog",
+        "description": "Link / label: Changelog."
+    },
+    "update.card.onLatestVersion": {
+        "message": "You're on the latest version",
+        "description": "Shown when the client is already up to date."
+    },
+    "update.header.tooltip": {
+        "message": "Update Available",
+        "description": "Tooltip on the header update badge."
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Updating NetBird to v{version}",
+        "description": "Heading in the install-progress window while updating to a specific version. {version} is the version number; keep it. The 'v' prefix is part of the version display."
+    },
+    "update.overlay.updating": {
+        "message": "Updating NetBird",
+        "description": "Heading in the install-progress window while updating when the target version isn't known."
+    },
+    "update.overlay.description": {
+        "message": "A newer version is available and is being installed. NetBird will restart automatically once the update is finished.",
+        "description": "Install-progress window body explaining NetBird will restart automatically after the update."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "Update Is Taking Too Long",
+        "description": "Install-progress window error title: the update took too long."
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "Installing {target} took too long and didn't finish.",
+        "description": "Install-progress window error body for a timeout. {target} is the target-version label (see update.overlay.error.targetVersion / targetFallback); keep it."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Update Was Stopped",
+        "description": "Install-progress window error title: the update was stopped / canceled."
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "The update to {target} was canceled before it finished.",
+        "description": "Install-progress window error body for a canceled update. {target} is the target-version label; keep it."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Couldn't Install the Update",
+        "description": "Install-progress window error title: the update couldn't be installed."
+    },
+    "update.overlay.error.failDescription": {
+        "message": "{target} couldn't be installed.",
+        "description": "Install-progress window error body for a failed install. {target} is the target-version label; keep it."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "unknown error",
+        "description": "Fallback text for an unspecified error, used inside other messages."
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}",
+        "description": "The target-version label substituted into {target}. {version} is a number; keep the 'v' prefix."
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "the new version",
+        "description": "Fallback target label used when the version isn't known, substituted into {target}."
+    },
+    "update.error.loadStateTitle": {
+        "message": "Load Update State Failed",
+        "description": "Error-dialog title when loading update state fails."
+    },
+    "update.error.triggerTitle": {
+        "message": "Start Update Failed",
+        "description": "Error-dialog title when starting the update fails."
+    },
+    "update.page.versionLine": {
+        "message": "Updating client to: {version}.",
+        "description": "Install-progress window text naming the target version. {version} is the version number; keep it."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Updating client.",
+        "description": "Install-progress text used when the target version isn't known."
+    },
+    "update.page.outdated": {
+        "message": "Your client version is older than the auto-update version set in Management.",
+        "description": "Note that the client is older than the auto-update version set in Management. 'Management' = the NetBird management server / console."
+    },
+    "update.page.status.running": {
+        "message": "Updating",
+        "description": "Install status: updating."
+    },
+    "update.page.status.timeout": {
+        "message": "Update timed out. Please try again.",
+        "description": "Install status: timed out; asks the user to retry."
+    },
+    "update.page.status.canceled": {
+        "message": "Update canceled.",
+        "description": "Install status: canceled."
+    },
+    "update.page.status.failed": {
+        "message": "Update failed: {message}",
+        "description": "Install status: failed. {message} is the error detail; keep it."
+    },
+    "update.page.status.unknownError": {
+        "message": "unknown update error",
+        "description": "Fallback text for an unknown update error, used inside update.page.status.failed."
+    },
+    "update.page.failedTitle": {
+        "message": "Update Failed",
+        "description": "Heading shown when the install failed."
+    },
+    "update.page.timeoutMessage": {
+        "message": "Update timed out.",
+        "description": "Message shown when the install timed out."
+    },
+    "update.page.dontClose": {
+        "message": "Please don't close this window.",
+        "description": "Warning asking the user not to close the install window."
+    },
+    "update.page.updating": {
+        "message": "Updating…",
+        "description": "Short status: updating. Ends with an ellipsis."
+    },
+    "update.page.complete": {
+        "message": "Update complete",
+        "description": "Short status: update complete."
+    },
+    "update.page.failed": {
+        "message": "Update failed",
+        "description": "Short status: update failed."
+    },
+    "window.title.settings": {
+        "message": "Settings",
+        "description": "OS window-chrome title for the Settings window. The app prefixes it with 'NetBird - '."
+    },
+    "window.title.signIn": {
+        "message": "Sign-in",
+        "description": "OS window-chrome title for the sign-in window."
+    },
+    "window.title.sessionExpiration": {
+        "message": "Session Expiring",
+        "description": "OS window-chrome title for the session-expiration window."
+    },
+    "window.title.updating": {
+        "message": "Updating",
+        "description": "OS window-chrome title for the update / install window."
+    },
+    "window.title.welcome": {
+        "message": "Welcome to NetBird",
+        "description": "OS window-chrome title for the first-launch welcome window. 'NetBird' — brand."
+    },
+    "window.title.error": {
+        "message": "Error",
+        "description": "OS window-chrome title for the error window."
+    },
+    "welcome.title": {
+        "message": "Look for NetBird in your tray",
+        "description": "Heading on the first onboarding step, pointing the user to the tray icon. Shown on Windows and Linux; macOS uses welcome.titleMac."
+    },
+    "welcome.titleMac": {
+        "message": "Look for NetBird in your menu bar",
+        "description": "Heading on the first onboarding step on macOS, pointing the user to the menu bar icon. Use your language's Apple term for the macOS menu bar."
+    },
+    "welcome.description": {
+        "message": "NetBird lives in your tray. Click the icon to connect, switch profiles, or open settings.",
+        "description": "Body of the first onboarding step explaining the tray icon. Shown on Windows and Linux; macOS uses welcome.descriptionMac."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird lives in your menu bar. Click the icon to connect, switch profiles, or open settings.",
+        "description": "Body of the first onboarding step on macOS explaining the menu bar icon. Use your language's Apple term for the macOS menu bar."
+    },
+    "welcome.continue": {
+        "message": "Continue",
+        "description": "Primary button to advance the onboarding. Keep short."
+    },
+    "welcome.back": {
+        "message": "Back",
+        "description": "Button to go back a step in onboarding. Keep short."
+    },
+    "welcome.management.title": {
+        "message": "Set up NetBird",
+        "description": "Heading on the onboarding step for choosing a management server."
+    },
+    "welcome.management.description": {
+        "message": "Click Continue to get started, or pick Self-hosted if you have your own NetBird server.",
+        "description": "Body of the management step; mentions choosing Self-hosted if the user runs their own server."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud",
+        "description": "Option title: NetBird Cloud. Brand — do not translate 'NetBird Cloud'."
+    },
+    "welcome.management.cloud.description": {
+        "message": "Use our hosted service. No setup required.",
+        "description": "Option body for NetBird Cloud (hosted service, no setup required)."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Self-hosted",
+        "description": "Option title: Self-hosted."
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Connect to your own management server.",
+        "description": "Option body for connecting to your own management server."
+    },
+    "welcome.management.urlLabel": {
+        "message": "Management server URL",
+        "description": "Field label for the management-server URL."
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443",
+        "description": "Example URL placeholder. Sample URL — do not translate it."
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Please enter a valid URL, e.g., https://netbird.selfhosted.com:443",
+        "description": "Validation message for an invalid URL. The example URL stays as-is."
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Couldn't reach this server. Check the URL or your network, then continue if you're sure it's correct.",
+        "description": "Soft warning when the server couldn't be reached during onboarding; the user may continue anyway."
+    },
+    "welcome.management.checking": {
+        "message": "Checking…",
+        "description": "Status shown while checking the server URL. Ends with an ellipsis."
+    },
+    "browserLogin.title": {
+        "message": "Complete login in your browser",
+        "description": "Heading telling the user to finish signing in via their browser."
+    },
+    "browserLogin.notSeeing": {
+        "message": "We opened a browser tab so you can finish signing in. Not seeing it?",
+        "description": "Prompt asking whether the user doesn't see the opened browser tab."
+    },
+    "browserLogin.tryAgain": {
+        "message": "Try again",
+        "description": "Button to re-open the browser sign-in page. Keep short."
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Open Browser Failed",
+        "description": "Error-dialog title when the browser couldn't be opened."
+    },
+    "sessionExpiration.title": {
+        "message": "Session expiring soon",
+        "description": "Heading warning the session will expire soon."
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Your session will expire",
+        "description": "Alternate, less-urgent heading: the session will expire."
+    },
+    "sessionExpiration.description": {
+        "message": "This device will disconnect soon. Renew with a browser sign-in.",
+        "description": "Body warning the device will disconnect soon; renew via a browser sign-in."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "A browser sign-in keeps this device connected to your network.",
+        "description": "Body for the less-urgent variant; a browser sign-in keeps the device connected."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renew session",
+        "description": "Button to renew the session (keep connected). Keep short."
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Authenticate",
+        "description": "Button to authenticate / sign in. Keep short."
+    },
+    "sessionExpiration.logout": {
+        "message": "Logout",
+        "description": "Button to log out. Keep short."
+    },
+    "sessionExpiration.expired": {
+        "message": "Session expired",
+        "description": "Heading shown once the session has actually expired."
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Device disconnected. Authenticate with a browser sign-in to reconnect.",
+        "description": "Body shown after expiry; authenticate via a browser sign-in to reconnect."
+    },
+    "sessionExpiration.close": {
+        "message": "Close",
+        "description": "Close button on the session window. Keep short."
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Extend Session Failed",
+        "description": "Error-dialog title when extending the session fails."
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Logout Failed",
+        "description": "Error-dialog title when logging out fails."
+    },
+    "peers.search.placeholder": {
+        "message": "Search by name or IP",
+        "description": "Placeholder in the peers search field."
+    },
+    "peers.filter.all": {
+        "message": "All",
+        "description": "Peers filter option: All. Keep short."
+    },
+    "peers.filter.online": {
+        "message": "Online",
+        "description": "Peers filter option: Online. Keep short."
+    },
+    "peers.filter.offline": {
+        "message": "Offline",
+        "description": "Peers filter option: Offline. Keep short."
+    },
+    "peers.empty.title": {
+        "message": "No peers available",
+        "description": "Title of the empty state when no peers are available."
+    },
+    "peers.empty.description": {
+        "message": "You either don't have any peers available or have no access to any of them.",
+        "description": "Body of the no-peers empty state."
+    },
+    "peers.details.domain": {
+        "message": "Domain",
+        "description": "Peer detail label: Domain."
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird IP",
+        "description": "Peer detail label: NetBird IP address. 'NetBird' — brand; 'IP' — keep acronym."
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird IPv6",
+        "description": "Peer detail label: NetBird IPv6 address. Keep 'NetBird' and 'IPv6'."
+    },
+    "peers.details.publicKey": {
+        "message": "Public key",
+        "description": "Peer detail label: WireGuard public key."
+    },
+    "peers.details.connection": {
+        "message": "Connection",
+        "description": "Peer detail label: Connection."
+    },
+    "peers.details.latency": {
+        "message": "Latency",
+        "description": "Peer detail label: Latency."
+    },
+    "peers.details.lastHandshake": {
+        "message": "Last handshake",
+        "description": "Peer detail label: time of the last WireGuard handshake."
+    },
+    "peers.details.statusSince": {
+        "message": "Last connection update",
+        "description": "Peer detail label: time since the last connection-status update."
+    },
+    "peers.details.bytes": {
+        "message": "Bytes",
+        "description": "Peer detail label: Bytes (data transferred)."
+    },
+    "peers.details.bytesSent": {
+        "message": "Sent",
+        "description": "Peer detail label: bytes sent."
+    },
+    "peers.details.bytesReceived": {
+        "message": "Received",
+        "description": "Peer detail label: bytes received."
+    },
+    "peers.details.localIce": {
+        "message": "Local ICE",
+        "description": "Peer detail label: local ICE candidate. 'ICE' — keep acronym."
+    },
+    "peers.details.remoteIce": {
+        "message": "Remote ICE",
+        "description": "Peer detail label: remote ICE candidate. 'ICE' — keep acronym."
+    },
+    "peers.details.never": {
+        "message": "Never",
+        "description": "Value shown when an event has never happened (e.g. last handshake = Never)."
+    },
+    "peers.details.justNow": {
+        "message": "Just now",
+        "description": "Relative-time value meaning a moment ago."
+    },
+    "peers.details.refresh": {
+        "message": "Refresh",
+        "description": "Button to refresh peer details. Keep short."
+    },
+    "peers.status.connected": {
+        "message": "Connected",
+        "description": "Peer status: connected."
+    },
+    "peers.status.connecting": {
+        "message": "Connecting",
+        "description": "Peer status: connecting."
+    },
+    "peers.status.disconnected": {
+        "message": "Disconnected",
+        "description": "Peer status: disconnected."
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay",
+        "description": "Peer detail label: Relay (relay-server address)."
+    },
+    "peers.details.networks": {
+        "message": "Resources",
+        "description": "Peer detail label for the peer's network resources. Labelled 'Resources' in the UI."
+    },
+    "peers.details.relayed": {
+        "message": "Relayed",
+        "description": "Connection-type value: the connection is relayed (not direct). Technical term."
+    },
+    "peers.details.p2p": {
+        "message": "P2P",
+        "description": "Connection-type value: peer-to-peer (direct). 'P2P' — keep as-is."
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass enabled",
+        "description": "Peer detail indicating Rosenpass (quantum-resistance) is enabled. 'Rosenpass' — product name, do not translate."
+    },
+    "networks.search.placeholder": {
+        "message": "Search by network or domain",
+        "description": "Placeholder in the resources search field."
+    },
+    "networks.filter.all": {
+        "message": "All",
+        "description": "Resources filter: All. Keep short."
+    },
+    "networks.filter.active": {
+        "message": "Active",
+        "description": "Resources filter: Active. Keep short."
+    },
+    "networks.filter.overlapping": {
+        "message": "Overlapping",
+        "description": "Resources filter: Overlapping (overlapping IP ranges). Keep short."
+    },
+    "networks.empty.title": {
+        "message": "No resources available",
+        "description": "Title of the empty state when no resources are available."
+    },
+    "networks.empty.description": {
+        "message": "You either don't have any network resources available or have no access to any of them.",
+        "description": "Body of the no-resources empty state."
+    },
+    "networks.selected": {
+        "message": "Selected",
+        "description": "Label / badge: the resource is selected (enabled)."
+    },
+    "networks.unselected": {
+        "message": "Not selected",
+        "description": "Label / badge: the resource is not selected."
+    },
+    "networks.ips.heading": {
+        "message": "Resolved IPs",
+        "description": "Heading for the list of a resource's resolved IP addresses."
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} of {total} Active",
+        "description": "Header showing how many resources are active. {selected} and {total} are numbers; keep both."
+    },
+    "networks.bulk.enableAll": {
+        "message": "Enable all",
+        "description": "Button to enable all resources. Keep short."
+    },
+    "networks.bulk.disableAll": {
+        "message": "Disable all",
+        "description": "Button to disable all resources. Keep short."
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Search exit nodes",
+        "description": "Placeholder in the exit-nodes search field."
+    },
+    "exitNodes.none": {
+        "message": "None",
+        "description": "Option meaning no exit node. Keep short."
+    },
+    "exitNodes.empty.title": {
+        "message": "No exit nodes available",
+        "description": "Title of the empty state when no exit nodes are available."
+    },
+    "exitNodes.empty.description": {
+        "message": "No exit nodes have been shared with this peer.",
+        "description": "Body of the no-exit-nodes empty state."
+    },
+    "exitNodes.card.title": {
+        "message": "Exit Node",
+        "description": "Card heading: Exit Node."
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Active",
+        "description": "Exit node card status: Active."
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inactive",
+        "description": "Exit node card status: Inactive."
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "None",
+        "description": "Dropdown option title: None (no exit node)."
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Direct connection without an exit node",
+        "description": "Dropdown option body for None: direct connection without an exit node."
+    },
+    "quickActions.connect": {
+        "message": "Connect",
+        "description": "Quick-action button: Connect. Keep short."
+    },
+    "quickActions.disconnect": {
+        "message": "Disconnect",
+        "description": "Quick-action button: Disconnect. Keep short."
+    },
+    "daemon.unavailable.title": {
+        "message": "NetBird Service Is Not Running",
+        "description": "Title of the overlay shown when the NetBird background service isn't running."
+    },
+    "daemon.unavailable.description": {
+        "message": "The app will reconnect automatically once the service is running.",
+        "description": "Body reassuring the user the app will reconnect once the service is running."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentation",
+        "description": "Documentation link on the daemon-unavailable overlay."
+    },
+    "daemon.outdated.title": {
+        "message": "NetBird Client Is Outdated",
+        "description": "Title of the overlay shown when the NetBird client (daemon) is too old to drive this UI."
+    },
+    "daemon.outdated.description": {
+        "message": "The new GUI isn't compatible with the older NetBird client. Update your client to use the new application.",
+        "description": "Body of the daemon-outdated overlay explaining that the GUI is newer than the client and the client must be updated."
+    },
+    "daemon.outdated.download": {
+        "message": "Download Latest",
+        "description": "Button on the daemon-outdated overlay that opens the download page for the latest release."
+    },
+    "error.jwt_clock_skew": {
+        "message": "Sign-in failed: this device's clock is out of sync with the server. Please sync your system clock and try again.",
+        "description": "Sign-in error shown to the user: the device clock is out of sync with the server."
+    },
+    "error.jwt_expired": {
+        "message": "Your sign-in token has expired. Please sign in again.",
+        "description": "Sign-in error: the sign-in token expired; sign in again."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Sign-in failed: the token signature is invalid. Please contact your administrator.",
+        "description": "Sign-in error: the token signature is invalid; contact the administrator."
+    },
+    "error.session_expired": {
+        "message": "Your session has expired. Please sign in again.",
+        "description": "Error: the session expired; sign in again."
+    },
+    "error.invalid_setup_key": {
+        "message": "The setup key is missing or invalid.",
+        "description": "Error: the setup key is missing or invalid. 'setup key' is a NetBird term."
+    },
+    "error.permission_denied": {
+        "message": "Sign-in was rejected by the server.",
+        "description": "Error: the server rejected the sign-in."
+    },
+    "error.daemon_unreachable": {
+        "message": "The NetBird daemon is not responding. Please check that the service is running.",
+        "description": "Error: the NetBird background service isn't responding. 'daemon' = the background service."
+    },
+    "error.settings_locked": {
+        "message": "Settings cannot be changed on this device: an administrator has locked them.",
+        "description": "Error: the local daemon was started with update-settings disabled, so it refuses configuration changes."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "This setting is managed by your organization and cannot be changed.",
+        "description": "Error: the setting is enforced by an MDM policy. 'MDM' = mobile device management, the organization's device-management system."
+    },
+    "error.unknown": {
+        "message": "Operation failed.",
+        "description": "Generic fallback error message used when no specific error applies."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird could not ask this system for the privileges the change needs. Run this instead:",
+        "description": "Error: this computer has no way to prompt for elevated privileges. Followed by a copyable command that applies the setting from a terminal."
+    },
+    "error.elevation_failed": {
+        "message": "The change could not be applied with elevated privileges. Run this instead:",
+        "description": "Error: the authorization succeeded but applying the setting afterwards failed. Followed by a copyable command that applies the setting from a terminal."
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root",
+        "description": "Fills {actor} in the settings.ssh.privilege.* messages on Linux, macOS and BSD, where the daemon requires the root account. 'root' is an account name and stays as it is; add the word for privileges or rights around it if the sentence needs one to read naturally."
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "administrator privileges",
+        "description": "Fills {actor} in the settings.ssh.privilege.* messages on Windows, where the daemon requires an elevated administrator. The Windows term for the rights an account is asked to elevate to."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Requires {actor}. Run this instead:",
+        "description": "Help text under an SSH setting the user cannot change: it needs elevated privileges. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "You can switch this off, but switching it back on needs {actor}.",
+        "description": "Help text under an SSH setting that is already on: an unprivileged user may switch it off freely, and switching it on again is what needs the privileges. No command follows, since the direction they can take is theirs to take. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "You can switch this on, but switching it back off needs {actor}.",
+        "description": "Same as settings.ssh.privilege.oneWay, for the SSH authentication setting once it has been switched off: switching it off again is what needs the privileges."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Waiting for authorization…",
+        "description": "Replaces the help text under a guarded SSH setting while the authorization prompt is open, which can take a few seconds to appear. Keep the trailing ellipsis."
+    }
+}
diff --git a/client/ui/i18n/locales/es/common.json b/client/ui/i18n/locales/es/common.json
new file mode 100644
index 000000000..f786592a7
--- /dev/null
+++ b/client/ui/i18n/locales/es/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "No está en ejecución"
+    },
+    "tray.status.error": {
+        "message": "Error"
+    },
+    "tray.status.connected": {
+        "message": "Conectado"
+    },
+    "tray.status.connecting": {
+        "message": "Conectando"
+    },
+    "tray.status.needsLogin": {
+        "message": "Inicio de sesión requerido"
+    },
+    "tray.status.loginFailed": {
+        "message": "Error al iniciar sesión"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sesión expirada"
+    },
+    "tray.session.expiresIn": {
+        "message": "La sesión expira en {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "menos de un minuto"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minuto"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutos"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 hora"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} horas"
+    },
+    "tray.session.unit.day": {
+        "message": "1 día"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} días"
+    },
+    "tray.menu.open": {
+        "message": "Abrir NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Conectar"
+    },
+    "tray.menu.disconnect": {
+        "message": "Desconectar"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nodo de salida"
+    },
+    "tray.menu.networks": {
+        "message": "Recursos"
+    },
+    "tray.menu.profiles": {
+        "message": "Perfiles"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Gestionar perfiles"
+    },
+    "tray.menu.settings": {
+        "message": "Configuración..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Crear paquete de diagnóstico"
+    },
+    "tray.menu.about": {
+        "message": "Ayuda y soporte"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentación"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Solucionar problemas"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Descargar la última versión"
+    },
+    "tray.menu.installVersion": {
+        "message": "Instalar la versión {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Salir de NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "El servicio de NetBird está desactualizado"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Actualice el servicio de NetBird para usar esta aplicación."
+    },
+    "notify.update.title": {
+        "message": "Actualización de NetBird disponible"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} está disponible."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Su administrador requiere esta actualización."
+    },
+    "notify.error.title": {
+        "message": "Error"
+    },
+    "notify.error.connect": {
+        "message": "Error al conectar"
+    },
+    "notify.error.disconnect": {
+        "message": "Error al desconectar"
+    },
+    "notify.error.switchProfile": {
+        "message": "Error al cambiar a {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Error al actualizar el nodo de salida {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Sesión de NetBird expirada"
+    },
+    "notify.sessionExpired.body": {
+        "message": "Su sesión de NetBird ha expirado. Inicie sesión de nuevo."
+    },
+    "notify.sessionWarning.title": {
+        "message": "La sesión expira pronto"
+    },
+    "notify.sessionWarning.body": {
+        "message": "Su sesión de NetBird expira en {remaining}. Haga clic en Renovar ahora para renovarla."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Su sesión de NetBird está a punto de expirar. Haga clic en Renovar ahora para renovarla."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Renovar ahora"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Descartar"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Error al renovar la sesión de NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Sesión de NetBird renovada"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Su sesión se ha renovado."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Plazo de sesión rechazado"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "El servidor envió un plazo de sesión no válido. Inicie sesión de nuevo."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Configuración de NetBird actualizada"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Su configuración de NetBird fue actualizada por su política de TI."
+    },
+    "common.cancel": {
+        "message": "Cancelar"
+    },
+    "common.save": {
+        "message": "Guardar"
+    },
+    "common.saveChanges": {
+        "message": "Guardar cambios"
+    },
+    "common.saving": {
+        "message": "Guardando…"
+    },
+    "common.close": {
+        "message": "Cerrar"
+    },
+    "common.copy": {
+        "message": "Copiar"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Mostrar u ocultar la contraseña"
+    },
+    "common.increase": {
+        "message": "Aumentar"
+    },
+    "common.decrease": {
+        "message": "Disminuir"
+    },
+    "common.delete": {
+        "message": "Eliminar"
+    },
+    "common.create": {
+        "message": "Crear"
+    },
+    "common.add": {
+        "message": "Añadir"
+    },
+    "common.remove": {
+        "message": "Quitar"
+    },
+    "common.refresh": {
+        "message": "Actualizar"
+    },
+    "common.loading": {
+        "message": "Cargando…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "No se encontraron resultados"
+    },
+    "common.noResults.description": {
+        "message": "No se encontraron resultados. Pruebe con otro término de búsqueda o cambie los filtros."
+    },
+    "notConnected.title": {
+        "message": "Desconectado"
+    },
+    "notConnected.description": {
+        "message": "Conéctese primero a NetBird para ver información detallada sobre sus peers, recursos de red y nodos de salida."
+    },
+    "connect.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "connect.status.connecting": {
+        "message": "Conectando..."
+    },
+    "connect.status.connected": {
+        "message": "Conectado"
+    },
+    "connect.status.disconnecting": {
+        "message": "Desconectando..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon no disponible"
+    },
+    "connect.status.loginRequired": {
+        "message": "Inicio de sesión requerido"
+    },
+    "connect.error.loginTitle": {
+        "message": "Error al iniciar sesión"
+    },
+    "connect.error.connectTitle": {
+        "message": "Error al conectar"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Error al desconectar"
+    },
+    "nav.peers.title": {
+        "message": "Peers"
+    },
+    "nav.peers.description": {
+        "message": "{connected} de {total} conectados"
+    },
+    "nav.resources.title": {
+        "message": "Recursos"
+    },
+    "nav.resources.description": {
+        "message": "{active} de {total} activos"
+    },
+    "nav.exitNode.title": {
+        "message": "Nodos de salida"
+    },
+    "nav.exitNode.none": {
+        "message": "Inactivo"
+    },
+    "nav.exitNode.using": {
+        "message": "Vía {name}"
+    },
+    "header.openSettings": {
+        "message": "Abrir configuración"
+    },
+    "header.togglePanel": {
+        "message": "Mostrar u ocultar el panel lateral"
+    },
+    "profile.selector.loading": {
+        "message": "Cargando..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Sin perfil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Buscar perfil por nombre..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "No se encontraron perfiles"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Pruebe con otro término de búsqueda o cree un perfil nuevo."
+    },
+    "profile.selector.newProfile": {
+        "message": "Nuevo perfil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Más opciones"
+    },
+    "profile.selector.deregister": {
+        "message": "Anular registro"
+    },
+    "profile.selector.delete": {
+        "message": "Eliminar"
+    },
+    "profile.selector.switchTo": {
+        "message": "Cambiar a este perfil"
+    },
+    "profile.selector.edit": {
+        "message": "Editar"
+    },
+    "profile.edit.title": {
+        "message": "Editar perfil"
+    },
+    "profile.edit.submit": {
+        "message": "Guardar cambios"
+    },
+    "profile.dialog.title": {
+        "message": "Introduzca el nombre del perfil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nombre del perfil"
+    },
+    "profile.dialog.description": {
+        "message": "Asigne un nombre fácil de identificar a su perfil."
+    },
+    "profile.dialog.placeholder": {
+        "message": "p. ej. trabajo"
+    },
+    "profile.dialog.submit": {
+        "message": "Añadir perfil"
+    },
+    "profile.dialog.required": {
+        "message": "Introduzca un nombre de perfil, p. ej. trabajo, casa"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Use NetBird Cloud o su propio servidor."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "No se pudo contactar con este servidor. Compruebe la URL o añada el perfil de todos modos si está seguro de que es correcta."
+    },
+    "header.menu.settings": {
+        "message": "Configuración..."
+    },
+    "header.menu.defaultView": {
+        "message": "Vista predeterminada"
+    },
+    "header.menu.advancedView": {
+        "message": "Vista avanzada"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Actualización disponible"
+    },
+    "header.menu.open": {
+        "message": "Abrir menú"
+    },
+    "header.profile.switch": {
+        "message": "Cambiar de perfil"
+    },
+    "connect.toggle.label": {
+        "message": "Conmutar conexión NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Direcciones IP locales"
+    },
+    "common.search": {
+        "message": "Buscar"
+    },
+    "common.filter": {
+        "message": "Filtrar"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Seleccionar nodo de salida"
+    },
+    "peers.row.label": {
+        "message": "Abrir detalles de {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Detalles del par"
+    },
+    "networks.row.toggle": {
+        "message": "Conmutar {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Conmutar todos los recursos visibles"
+    },
+    "profile.switch.title": {
+        "message": "¿Cambiar el perfil a «{name}»?"
+    },
+    "profile.switch.message": {
+        "message": "¿Seguro que desea cambiar de perfil?\nSu perfil actual se desconectará."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirmar"
+    },
+    "profile.deregister.title": {
+        "message": "¿Anular el registro del perfil «{name}»?"
+    },
+    "profile.deregister.message": {
+        "message": "¿Seguro que desea anular el registro de este perfil?\nDeberá iniciar sesión de nuevo para usarlo."
+    },
+    "profile.deregister.confirm": {
+        "message": "Anular registro"
+    },
+    "profile.delete.title": {
+        "message": "¿Eliminar el perfil «{name}»?"
+    },
+    "profile.delete.message": {
+        "message": "¿Seguro que desea eliminar este perfil?\nEsta acción no se puede deshacer."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Los perfiles activos no se pueden eliminar. Cambie a otro antes de eliminar este perfil."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "El perfil predeterminado no se puede eliminar."
+    },
+    "profile.error.switchTitle": {
+        "message": "Error al cambiar de perfil"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Error al anular el registro del perfil"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Error al eliminar el perfil"
+    },
+    "profile.error.createTitle": {
+        "message": "Error al crear el perfil"
+    },
+    "profile.error.editTitle": {
+        "message": "Error al editar el perfil"
+    },
+    "profile.error.loadTitle": {
+        "message": "Error al cargar los perfiles"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Perfil activo"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Cambiar de perfil"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Otro"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Añadir perfil"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Gestionar perfiles"
+    },
+    "profile.dropdown.settings": {
+        "message": "Configuración"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Perfiles"
+    },
+    "settings.profiles.intro": {
+        "message": "Mantenga identidades de NetBird independientes en paralelo, por ejemplo cuentas de trabajo y personales, o distintos servidores de gestión. Añada, anule el registro o elimine perfiles a continuación."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Añadir perfil"
+    },
+    "settings.profiles.active": {
+        "message": "Activo"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Sin perfiles"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Cree un perfil para conectarse a un servidor de gestión de NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Error al cargar la configuración"
+    },
+    "settings.error.saveTitle": {
+        "message": "Error al guardar la configuración"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Error en el paquete de diagnóstico"
+    },
+    "settings.nav.label": {
+        "message": "Secciones de configuración"
+    },
+    "settings.tabs.general": {
+        "message": "General"
+    },
+    "settings.tabs.network": {
+        "message": "Red"
+    },
+    "settings.tabs.security": {
+        "message": "Seguridad"
+    },
+    "settings.tabs.profiles": {
+        "message": "Perfiles"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avanzado"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Solución de problemas"
+    },
+    "settings.tabs.about": {
+        "message": "Acerca de"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Actualización disponible"
+    },
+    "settings.general.section.general": {
+        "message": "General"
+    },
+    "settings.general.section.connection": {
+        "message": "Conexión"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Conectar al iniciar"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Establece una conexión automáticamente cuando se inicia el servicio."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notificaciones de escritorio"
+    },
+    "settings.general.notifications.help": {
+        "message": "Muestra notificaciones de escritorio para nuevas actualizaciones y eventos de conexión."
+    },
+    "settings.general.autostart.label": {
+        "message": "Iniciar la interfaz de NetBird al iniciar sesión"
+    },
+    "settings.general.autostart.help": {
+        "message": "Inicia la interfaz de NetBird automáticamente al iniciar sesión. Esto afecta solo a la interfaz gráfica, no al servicio en segundo plano."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Error al cambiar el inicio automático"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Permanecer conectado al salir"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "La conexión sigue activa en segundo plano después de cerrar NetBird. Solo se detiene cuando la desconectas tú."
+    },
+    "settings.general.language.label": {
+        "message": "Idioma de la interfaz"
+    },
+    "settings.general.language.help": {
+        "message": "Elija el idioma de la interfaz de NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Buscar idioma…"
+    },
+    "settings.general.language.empty": {
+        "message": "Ningún idioma coincide."
+    },
+    "settings.general.theme.label": {
+        "message": "Tema"
+    },
+    "settings.general.theme.help": {
+        "message": "Elija el tema claro u oscuro, o siga la apariencia del sistema."
+    },
+    "settings.general.theme.system": {
+        "message": "Sistema"
+    },
+    "settings.general.theme.light": {
+        "message": "Claro"
+    },
+    "settings.general.theme.dark": {
+        "message": "Oscuro"
+    },
+    "settings.general.management.label": {
+        "message": "Servidor de gestión"
+    },
+    "settings.general.management.help": {
+        "message": "Conéctese a NetBird Cloud o a su propio servidor de gestión autoalojado. Los cambios reconectarán el cliente."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Autoalojado"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Introduzca una URL válida, p. ej., https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "No se pudo contactar con este servidor. Compruebe la URL o guarde de todos modos si está seguro de que es correcta."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "¿Cambiar a NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Esto desconecta su servidor autoalojado.\nEs posible que deba iniciar sesión de nuevo."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Cambiar a Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Conectividad"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Enrutamiento y DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconectar al cambiar de red"
+    },
+    "settings.network.monitor.help": {
+        "message": "Monitoriza la red y reconecta automáticamente ante cambios como cambios de Wi-Fi, cambios de Ethernet o la reanudación tras la suspensión."
+    },
+    "settings.network.dns.label": {
+        "message": "Habilitar DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Aplica la configuración de DNS gestionada por NetBird al resolutor del host."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Habilitar rutas de cliente"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Acepta rutas de otros peers para alcanzar sus redes."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Habilitar rutas de servidor"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Anuncia las rutas locales de este host a otros peers."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Habilitar IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Usa direccionamiento IPv6 para la red superpuesta de NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Cortafuegos"
+    },
+    "settings.security.section.encryption": {
+        "message": "Cifrado"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bloquear tráfico entrante"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rechaza conexiones no solicitadas de peers hacia este dispositivo y cualquier red que enrute. El tráfico saliente no se ve afectado."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Bloquear acceso a la LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Impide que los peers alcancen su red local o sus dispositivos cuando este dispositivo enruta su tráfico."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Habilitar resistencia cuántica"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Añade un intercambio de claves poscuántico mediante Rosenpass sobre WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Habilitar modo permisivo"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Permite conexiones con peers sin compatibilidad con resistencia cuántica."
+    },
+    "settings.ssh.section.server": {
+        "message": "Servidor"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Capacidades"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Autenticación"
+    },
+    "settings.ssh.server.label": {
+        "message": "Habilitar el servidor SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Ejecuta el servidor SSH de NetBird en este host para que otros peers puedan conectarse a él."
+    },
+    "settings.ssh.root.label": {
+        "message": "Permitir inicio de sesión como root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permite que los peers inicien sesión como usuario root. Desactívelo para exigir una cuenta sin privilegios."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Permitir SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transfiere archivos de forma segura mediante clientes SFTP o SCP nativos."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Reenvío de puertos local"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permite que los peers conectados tunelicen puertos locales hacia servicios accesibles desde este host."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Reenvío de puertos remoto"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permite que los peers conectados expongan puertos de este host de vuelta a su propia máquina."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Habilitar autenticación JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verifica cada sesión SSH contra su IdP para la identidad del usuario y la auditoría. Desactívelo para basarse solo en las políticas de ACL de red, útil cuando no hay ningún IdP disponible."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL de la caché JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Cuánto tiempo almacena en caché este cliente un JWT antes de volver a solicitarlo en conexiones SSH salientes. Establézcalo en 0 para desactivar la caché y autenticar en cada conexión."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "s"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interfaz"
+    },
+    "settings.advanced.section.security": {
+        "message": "Seguridad"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nombre"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Use de 1 a 15 letras, dígitos, puntos, guiones o guiones bajos."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Debe empezar por \"utun\" seguido de un número (p. ej. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Puerto"
+    },
+    "settings.advanced.port.error": {
+        "message": "Introduzca un puerto entre {min} y {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Si se establece en 0, se usará un puerto libre aleatorio."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Introduzca un valor de MTU entre {min} y {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Clave precompartida"
+    },
+    "settings.advanced.psk.help": {
+        "message": "PSK de WireGuard opcional para cifrado simétrico adicional. No es lo mismo que una clave de instalación de NetBird. Solo se comunicará con peers que usen la misma clave precompartida."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Paquete de diagnóstico"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonimizar información sensible"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Oculta direcciones IP, dominios y otros valores sensibles."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "El modo predeterminado mantiene legibles las direcciones IPv4 internas y los nombres de los peers para el soporte. El modo estricto anonimiza además las direcciones IP privadas (RFC 1918), CGNAT y de enlace local, los nombres de los peers y las claves públicas de WireGuard. Los valores recurrentes se asignan al mismo marcador de posición, por lo que los peers siguen siendo distinguibles. Use el modo estricto cuando comparta el paquete de diagnóstico fuera de su organización."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Ninguno"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Predeterminado"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Estricto"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Incluir información del sistema"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Incluye el OS, el kernel, las interfaces de red y las tablas de enrutamiento."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Subir el paquete a los servidores de NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Devuelve una clave de subida para compartir con el soporte de NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Activar registros de seguimiento"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Eleva el nivel de registro a TRACE y lo restaura después."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Sesión de captura"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Vuelve a conectar y espera para que pueda reproducir el problema."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capturar paquetes de red"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Guarda un .pcap del tráfico de red durante la sesión de captura."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Duración de la captura"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Cuánto tiempo se ejecuta la sesión de captura."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "min"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Crear paquete"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Recopilando registros, detalles del sistema y estado de la conexión. Esto suele tardar un momento; mantenga esta ventana abierta hasta que termine."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "¡Paquete de diagnóstico subido correctamente!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Paquete guardado"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Comparta la clave de subida de abajo con el <docs>soporte de NetBird</docs>. También se guardó una copia local en su dispositivo."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Su paquete de diagnóstico se ha guardado localmente."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copiar clave"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Abrir carpeta"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Abrir ubicación del archivo"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Error en la subida: {reason} El paquete sigue guardado localmente."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Error en la subida. El paquete sigue guardado localmente."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconectando NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capturando registros de depuración"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Generando el paquete de diagnóstico…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Subiendo a NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client"
+    },
+    "settings.about.development": {
+        "message": "[Desarrollo]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Todos los derechos reservados."
+    },
+    "settings.about.links.imprint": {
+        "message": "Aviso legal"
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacidad"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Términos del servicio"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Foro"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentación"
+    },
+    "settings.about.community.feedback": {
+        "message": "Comentarios"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} está listo para instalar."
+    },
+    "update.banner.later": {
+        "message": "Más tarde"
+    },
+    "update.banner.installNow": {
+        "message": "Instalar ahora"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "La versión {version} está disponible para descargar."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "La versión {version} está disponible para instalar."
+    },
+    "update.card.whatsNew": {
+        "message": "¿Qué hay de nuevo?"
+    },
+    "update.card.installNow": {
+        "message": "Instalar ahora"
+    },
+    "update.card.getInstaller": {
+        "message": "Descargar"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird busca actualizaciones en segundo plano."
+    },
+    "update.card.changelog": {
+        "message": "Registro de cambios"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Tiene la última versión"
+    },
+    "update.header.tooltip": {
+        "message": "Actualización disponible"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Actualizando NetBird a v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Actualizando NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Hay una versión más reciente disponible y se está instalando. NetBird se reiniciará automáticamente cuando finalice la actualización."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "La actualización está tardando demasiado"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "La instalación de {target} tardó demasiado y no finalizó."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "La actualización se detuvo"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "La actualización a {target} se canceló antes de finalizar."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "No se pudo instalar la actualización"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "No se pudo instalar {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "error desconocido"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "la nueva versión"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Error al cargar el estado de la actualización"
+    },
+    "update.error.triggerTitle": {
+        "message": "Error al iniciar la actualización"
+    },
+    "update.page.versionLine": {
+        "message": "Actualizando el cliente a: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Actualizando el cliente."
+    },
+    "update.page.outdated": {
+        "message": "La versión de su cliente es anterior a la versión de actualización automática configurada en Management."
+    },
+    "update.page.status.running": {
+        "message": "Actualizando"
+    },
+    "update.page.status.timeout": {
+        "message": "Se agotó el tiempo de la actualización. Inténtelo de nuevo."
+    },
+    "update.page.status.canceled": {
+        "message": "Actualización cancelada."
+    },
+    "update.page.status.failed": {
+        "message": "Error en la actualización: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "error de actualización desconocido"
+    },
+    "update.page.failedTitle": {
+        "message": "Error en la actualización"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Se agotó el tiempo de la actualización."
+    },
+    "update.page.dontClose": {
+        "message": "No cierre esta ventana."
+    },
+    "update.page.updating": {
+        "message": "Actualizando…"
+    },
+    "update.page.complete": {
+        "message": "Actualización completada"
+    },
+    "update.page.failed": {
+        "message": "Error en la actualización"
+    },
+    "window.title.settings": {
+        "message": "Configuración"
+    },
+    "window.title.signIn": {
+        "message": "Inicio de sesión"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sesión a punto de expirar"
+    },
+    "window.title.updating": {
+        "message": "Actualizando"
+    },
+    "window.title.welcome": {
+        "message": "Bienvenido a NetBird"
+    },
+    "window.title.error": {
+        "message": "Error"
+    },
+    "welcome.title": {
+        "message": "Busque NetBird en su bandeja del sistema"
+    },
+    "welcome.titleMac": {
+        "message": "Busque NetBird en su barra de menús"
+    },
+    "welcome.description": {
+        "message": "NetBird reside en su bandeja del sistema. Haga clic en el icono para conectarse, cambiar de perfil o abrir la configuración."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird reside en su barra de menús. Haga clic en el icono para conectarse, cambiar de perfil o abrir la configuración."
+    },
+    "welcome.continue": {
+        "message": "Continuar"
+    },
+    "welcome.back": {
+        "message": "Atrás"
+    },
+    "welcome.management.title": {
+        "message": "Configurar NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Haga clic en Continuar para empezar, o elija Autoalojado si tiene su propio servidor de NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Use nuestro servicio alojado. No requiere configuración."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Autoalojado"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Conéctese a su propio servidor de gestión."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL del servidor de gestión"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Introduzca una URL válida, p. ej., https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "No se pudo contactar con este servidor. Compruebe la URL o su red y, a continuación, continúe si está seguro de que es correcta."
+    },
+    "welcome.management.checking": {
+        "message": "Comprobando…"
+    },
+    "browserLogin.title": {
+        "message": "Continúe en su navegador para completar el inicio de sesión"
+    },
+    "browserLogin.notSeeing": {
+        "message": "¿No ve la pestaña del navegador?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Reintentar"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Error al abrir el navegador"
+    },
+    "sessionExpiration.title": {
+        "message": "La sesión expira pronto"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Su sesión expirará"
+    },
+    "sessionExpiration.description": {
+        "message": "Este dispositivo se desconectará pronto. Renuévela iniciando sesión en el navegador."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Iniciar sesión en el navegador mantiene este dispositivo conectado a su red."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renovar sesión"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Autenticar"
+    },
+    "sessionExpiration.logout": {
+        "message": "Cerrar sesión"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sesión expirada"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Dispositivo desconectado. Autentíquese iniciando sesión en el navegador para reconectar."
+    },
+    "sessionExpiration.close": {
+        "message": "Cerrar"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Error al renovar la sesión"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Error al cerrar sesión"
+    },
+    "peers.search.placeholder": {
+        "message": "Buscar por nombre o IP"
+    },
+    "peers.filter.all": {
+        "message": "Todos"
+    },
+    "peers.filter.online": {
+        "message": "En línea"
+    },
+    "peers.filter.offline": {
+        "message": "Sin conexión"
+    },
+    "peers.empty.title": {
+        "message": "No hay peers disponibles"
+    },
+    "peers.empty.description": {
+        "message": "No tiene ningún peer disponible o no tiene acceso a ninguno de ellos."
+    },
+    "peers.details.domain": {
+        "message": "Dominio"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP de NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 de NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Clave pública"
+    },
+    "peers.details.connection": {
+        "message": "Conexión"
+    },
+    "peers.details.latency": {
+        "message": "Latencia"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Último handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Última actualización de la conexión"
+    },
+    "peers.details.bytes": {
+        "message": "Bytes"
+    },
+    "peers.details.bytesSent": {
+        "message": "Enviados"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Recibidos"
+    },
+    "peers.details.localIce": {
+        "message": "ICE local"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE remoto"
+    },
+    "peers.details.never": {
+        "message": "Nunca"
+    },
+    "peers.details.justNow": {
+        "message": "Justo ahora"
+    },
+    "peers.details.refresh": {
+        "message": "Actualizar"
+    },
+    "peers.status.connected": {
+        "message": "Conectado"
+    },
+    "peers.status.connecting": {
+        "message": "Conectando"
+    },
+    "peers.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay"
+    },
+    "peers.details.networks": {
+        "message": "Recursos"
+    },
+    "peers.details.relayed": {
+        "message": "Retransmitida"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass habilitado"
+    },
+    "networks.search.placeholder": {
+        "message": "Buscar por red o dominio"
+    },
+    "networks.filter.all": {
+        "message": "Todos"
+    },
+    "networks.filter.active": {
+        "message": "Activos"
+    },
+    "networks.filter.overlapping": {
+        "message": "Solapados"
+    },
+    "networks.empty.title": {
+        "message": "No hay recursos disponibles"
+    },
+    "networks.empty.description": {
+        "message": "No tiene ningún recurso de red disponible o no tiene acceso a ninguno de ellos."
+    },
+    "networks.selected": {
+        "message": "Seleccionado"
+    },
+    "networks.unselected": {
+        "message": "No seleccionado"
+    },
+    "networks.ips.heading": {
+        "message": "IP resueltas"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} de {total} activos"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Habilitar todos"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Deshabilitar todos"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Buscar nodos de salida"
+    },
+    "exitNodes.none": {
+        "message": "Ninguno"
+    },
+    "exitNodes.empty.title": {
+        "message": "No hay nodos de salida disponibles"
+    },
+    "exitNodes.empty.description": {
+        "message": "No se ha compartido ningún nodo de salida con este peer."
+    },
+    "exitNodes.card.title": {
+        "message": "Nodo de salida"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Activo"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inactivo"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Ninguno"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Conexión directa sin nodo de salida"
+    },
+    "quickActions.connect": {
+        "message": "Conectar"
+    },
+    "quickActions.disconnect": {
+        "message": "Desconectar"
+    },
+    "daemon.unavailable.title": {
+        "message": "El servicio de NetBird no está en ejecución"
+    },
+    "daemon.unavailable.description": {
+        "message": "La aplicación se reconectará automáticamente cuando el servicio esté en ejecución."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentación"
+    },
+    "daemon.outdated.title": {
+        "message": "NetBird Client está desactualizado"
+    },
+    "daemon.outdated.description": {
+        "message": "La nueva GUI no es compatible con su cliente anterior. Actualice su cliente para usar la nueva aplicación."
+    },
+    "daemon.outdated.download": {
+        "message": "Descargar la última versión"
+    },
+    "error.jwt_clock_skew": {
+        "message": "Error al iniciar sesión: el reloj de este dispositivo no está sincronizado con el servidor. Sincronice el reloj del sistema e inténtelo de nuevo."
+    },
+    "error.jwt_expired": {
+        "message": "Su token de inicio de sesión ha expirado. Inicie sesión de nuevo."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Error al iniciar sesión: la firma del token no es válida. Póngase en contacto con su administrador."
+    },
+    "error.session_expired": {
+        "message": "Su sesión ha expirado. Inicie sesión de nuevo."
+    },
+    "error.invalid_setup_key": {
+        "message": "La clave de instalación falta o no es válida."
+    },
+    "error.permission_denied": {
+        "message": "El servidor rechazó el inicio de sesión."
+    },
+    "error.daemon_unreachable": {
+        "message": "El daemon de NetBird no responde. Compruebe que el servicio esté en ejecución."
+    },
+    "error.settings_locked": {
+        "message": "La configuración no se puede cambiar en este dispositivo: un administrador la ha bloqueado."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Esta configuración está gestionada por su organización y no se puede cambiar."
+    },
+    "error.unknown": {
+        "message": "La operación falló."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird no pudo solicitar a este sistema los privilegios necesarios. Ejecute esto en su lugar:"
+    },
+    "error.elevation_failed": {
+        "message": "No se pudo aplicar el cambio con privilegios elevados. Ejecute esto en su lugar:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "privilegios de root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "privilegios de administrador"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Requiere {actor}. Ejecute esto en su lugar:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Puede desactivarlo, pero volver a activarlo requiere {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Puede activarlo, pero volver a desactivarlo requiere {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Esperando la autorización…"
+    }
+}
diff --git a/client/ui/i18n/locales/fr/common.json b/client/ui/i18n/locales/fr/common.json
new file mode 100644
index 000000000..87e833e3f
--- /dev/null
+++ b/client/ui/i18n/locales/fr/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Déconnecté"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Non démarré"
+    },
+    "tray.status.error": {
+        "message": "Erreur"
+    },
+    "tray.status.connected": {
+        "message": "Connecté"
+    },
+    "tray.status.connecting": {
+        "message": "Connexion"
+    },
+    "tray.status.needsLogin": {
+        "message": "Connexion requise"
+    },
+    "tray.status.loginFailed": {
+        "message": "Échec de la connexion"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Session expirée"
+    },
+    "tray.session.expiresIn": {
+        "message": "La session expire dans {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "moins d’une minute"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minute"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutes"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 heure"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} heures"
+    },
+    "tray.session.unit.day": {
+        "message": "1 jour"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} jours"
+    },
+    "tray.menu.open": {
+        "message": "Ouvrir NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Se connecter"
+    },
+    "tray.menu.disconnect": {
+        "message": "Se déconnecter"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nœud de sortie"
+    },
+    "tray.menu.networks": {
+        "message": "Ressources"
+    },
+    "tray.menu.profiles": {
+        "message": "Profils"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Gérer les profils"
+    },
+    "tray.menu.settings": {
+        "message": "Paramètres..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Créer un lot de diagnostic"
+    },
+    "tray.menu.about": {
+        "message": "Aide et assistance"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentation"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Dépannage"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Télécharger la dernière version"
+    },
+    "tray.menu.installVersion": {
+        "message": "Installer la version {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI : {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon : {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Quitter NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "Le service NetBird est obsolète"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Mettez à jour le service NetBird pour utiliser cette application."
+    },
+    "notify.update.title": {
+        "message": "Mise à jour de NetBird disponible"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} est disponible."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Votre administrateur impose cette mise à jour."
+    },
+    "notify.error.title": {
+        "message": "Erreur"
+    },
+    "notify.error.connect": {
+        "message": "Échec de la connexion"
+    },
+    "notify.error.disconnect": {
+        "message": "Échec de la déconnexion"
+    },
+    "notify.error.switchProfile": {
+        "message": "Échec du passage à {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Échec de la mise à jour du nœud de sortie {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Session NetBird expirée"
+    },
+    "notify.sessionExpired.body": {
+        "message": "Votre session NetBird a expiré. Veuillez vous reconnecter."
+    },
+    "notify.sessionWarning.title": {
+        "message": "La session expire bientôt"
+    },
+    "notify.sessionWarning.body": {
+        "message": "Votre session NetBird expire dans {remaining}. Cliquez sur Prolonger pour la renouveler."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Votre session NetBird est sur le point d’expirer. Cliquez sur Prolonger pour la renouveler."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Prolonger"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Ignorer"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Échec de la prolongation de la session NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Session NetBird prolongée"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Votre session a été renouvelée."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Échéance de session rejetée"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "Le serveur a envoyé une échéance de session invalide. Veuillez vous reconnecter."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Paramètres NetBird mis à jour"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Votre configuration NetBird a été mise à jour par votre politique informatique."
+    },
+    "common.cancel": {
+        "message": "Annuler"
+    },
+    "common.save": {
+        "message": "Enregistrer"
+    },
+    "common.saveChanges": {
+        "message": "Enregistrer les modifications"
+    },
+    "common.saving": {
+        "message": "Enregistrement…"
+    },
+    "common.close": {
+        "message": "Fermer"
+    },
+    "common.copy": {
+        "message": "Copier"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Afficher ou masquer le mot de passe"
+    },
+    "common.increase": {
+        "message": "Augmenter"
+    },
+    "common.decrease": {
+        "message": "Diminuer"
+    },
+    "common.delete": {
+        "message": "Supprimer"
+    },
+    "common.create": {
+        "message": "Créer"
+    },
+    "common.add": {
+        "message": "Ajouter"
+    },
+    "common.remove": {
+        "message": "Retirer"
+    },
+    "common.refresh": {
+        "message": "Actualiser"
+    },
+    "common.loading": {
+        "message": "Chargement…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Aucun résultat trouvé"
+    },
+    "common.noResults.description": {
+        "message": "Nous n’avons trouvé aucun résultat. Essayez un autre terme de recherche ou modifiez vos filtres."
+    },
+    "notConnected.title": {
+        "message": "Déconnecté"
+    },
+    "notConnected.description": {
+        "message": "Connectez-vous d’abord à NetBird pour consulter les informations détaillées sur vos pairs, vos ressources réseau et vos nœuds de sortie."
+    },
+    "connect.status.disconnected": {
+        "message": "Déconnecté"
+    },
+    "connect.status.connecting": {
+        "message": "Connexion..."
+    },
+    "connect.status.connected": {
+        "message": "Connecté"
+    },
+    "connect.status.disconnecting": {
+        "message": "Déconnexion..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon indisponible"
+    },
+    "connect.status.loginRequired": {
+        "message": "Connexion requise"
+    },
+    "connect.error.loginTitle": {
+        "message": "Échec de la connexion"
+    },
+    "connect.error.connectTitle": {
+        "message": "Échec de la connexion"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Échec de la déconnexion"
+    },
+    "nav.peers.title": {
+        "message": "Pairs"
+    },
+    "nav.peers.description": {
+        "message": "{connected} sur {total} connectés"
+    },
+    "nav.resources.title": {
+        "message": "Ressources"
+    },
+    "nav.resources.description": {
+        "message": "{active} sur {total} actives"
+    },
+    "nav.exitNode.title": {
+        "message": "Nœuds de sortie"
+    },
+    "nav.exitNode.none": {
+        "message": "Inactif"
+    },
+    "nav.exitNode.using": {
+        "message": "Via {name}"
+    },
+    "header.openSettings": {
+        "message": "Ouvrir les paramètres"
+    },
+    "header.togglePanel": {
+        "message": "Afficher ou masquer le panneau latéral"
+    },
+    "profile.selector.loading": {
+        "message": "Chargement..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Aucun profil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Rechercher un profil par nom..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Aucun profil trouvé"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Essayez un autre terme de recherche ou créez un nouveau profil."
+    },
+    "profile.selector.newProfile": {
+        "message": "Nouveau profil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Plus d’options"
+    },
+    "profile.selector.deregister": {
+        "message": "Désinscrire"
+    },
+    "profile.selector.delete": {
+        "message": "Supprimer"
+    },
+    "profile.selector.switchTo": {
+        "message": "Basculer vers ce profil"
+    },
+    "profile.selector.edit": {
+        "message": "Modifier"
+    },
+    "profile.edit.title": {
+        "message": "Modifier le profil"
+    },
+    "profile.edit.submit": {
+        "message": "Enregistrer les modifications"
+    },
+    "profile.dialog.title": {
+        "message": "Saisir le nom du profil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nom du profil"
+    },
+    "profile.dialog.description": {
+        "message": "Choisissez un nom facilement identifiable pour votre profil."
+    },
+    "profile.dialog.placeholder": {
+        "message": "ex. travail"
+    },
+    "profile.dialog.submit": {
+        "message": "Ajouter un profil"
+    },
+    "profile.dialog.required": {
+        "message": "Veuillez saisir un nom de profil, ex. travail, domicile"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Utilisez NetBird Cloud ou votre propre serveur."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Impossible de joindre ce serveur. Vérifiez l’URL, ou ajoutez le profil quand même si vous êtes sûr qu’elle est correcte."
+    },
+    "header.menu.settings": {
+        "message": "Paramètres..."
+    },
+    "header.menu.defaultView": {
+        "message": "Vue par défaut"
+    },
+    "header.menu.advancedView": {
+        "message": "Vue avancée"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Mise à jour disponible"
+    },
+    "header.menu.open": {
+        "message": "Ouvrir le menu"
+    },
+    "header.profile.switch": {
+        "message": "Changer de profil"
+    },
+    "connect.toggle.label": {
+        "message": "Activer/désactiver la connexion NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Adresses IP locales"
+    },
+    "common.search": {
+        "message": "Rechercher"
+    },
+    "common.filter": {
+        "message": "Filtrer"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Sélectionner un nœud de sortie"
+    },
+    "peers.row.label": {
+        "message": "Ouvrir les détails pour {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Détails du pair"
+    },
+    "networks.row.toggle": {
+        "message": "Activer/désactiver {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Activer/désactiver toutes les ressources visibles"
+    },
+    "profile.switch.title": {
+        "message": "Basculer vers le profil « {name} » ?"
+    },
+    "profile.switch.message": {
+        "message": "Voulez-vous vraiment changer de profil ?\nVotre profil actuel sera déconnecté."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirmer"
+    },
+    "profile.deregister.title": {
+        "message": "Désinscrire le profil « {name} » ?"
+    },
+    "profile.deregister.message": {
+        "message": "Voulez-vous vraiment désinscrire ce profil ?\nVous devrez vous reconnecter pour l’utiliser."
+    },
+    "profile.deregister.confirm": {
+        "message": "Désinscrire"
+    },
+    "profile.delete.title": {
+        "message": "Supprimer le profil « {name} » ?"
+    },
+    "profile.delete.message": {
+        "message": "Voulez-vous vraiment supprimer ce profil ?\nCette action est irréversible."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Les profils actifs ne peuvent pas être supprimés. Basculez vers un autre profil avant de supprimer celui-ci."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Le profil par défaut ne peut pas être supprimé."
+    },
+    "profile.error.switchTitle": {
+        "message": "Échec du changement de profil"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Échec de la désinscription du profil"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Échec de la suppression du profil"
+    },
+    "profile.error.createTitle": {
+        "message": "Échec de la création du profil"
+    },
+    "profile.error.editTitle": {
+        "message": "Échec de la modification du profil"
+    },
+    "profile.error.loadTitle": {
+        "message": "Échec du chargement des profils"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Profil actif"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Changer de profil"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Autre"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Ajouter un profil"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Gérer les profils"
+    },
+    "profile.dropdown.settings": {
+        "message": "Paramètres"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Profils"
+    },
+    "settings.profiles.intro": {
+        "message": "Conservez plusieurs identités NetBird côte à côte, par exemple des comptes professionnels et personnels, ou différents serveurs de gestion. Ajoutez, désinscrivez ou supprimez des profils ci-dessous."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Ajouter un profil"
+    },
+    "settings.profiles.active": {
+        "message": "Actif"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Aucun profil"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Créez un profil pour vous connecter à un serveur de gestion NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Échec du chargement des paramètres"
+    },
+    "settings.error.saveTitle": {
+        "message": "Échec de l’enregistrement des paramètres"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Échec du lot de diagnostic"
+    },
+    "settings.nav.label": {
+        "message": "Sections des paramètres"
+    },
+    "settings.tabs.general": {
+        "message": "Général"
+    },
+    "settings.tabs.network": {
+        "message": "Réseau"
+    },
+    "settings.tabs.security": {
+        "message": "Sécurité"
+    },
+    "settings.tabs.profiles": {
+        "message": "Profils"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avancé"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Dépannage"
+    },
+    "settings.tabs.about": {
+        "message": "À propos"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Mise à jour disponible"
+    },
+    "settings.general.section.general": {
+        "message": "Général"
+    },
+    "settings.general.section.connection": {
+        "message": "Connexion"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Se connecter au démarrage"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Établir automatiquement une connexion au démarrage du service."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notifications du bureau"
+    },
+    "settings.general.notifications.help": {
+        "message": "Afficher des notifications du bureau pour les nouvelles mises à jour et les événements de connexion."
+    },
+    "settings.general.autostart.label": {
+        "message": "Lancer l’interface NetBird à l’ouverture de session"
+    },
+    "settings.general.autostart.help": {
+        "message": "Démarrer automatiquement l’interface NetBird à l’ouverture de votre session. Cela n’affecte que l’interface graphique, pas le service en arrière-plan."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Échec de la modification du démarrage automatique"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Rester connecté après la fermeture"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "La connexion reste active en arrière-plan après la fermeture de NetBird. Elle ne s'arrête que si vous la coupez vous-même."
+    },
+    "settings.general.language.label": {
+        "message": "Langue d’affichage"
+    },
+    "settings.general.language.help": {
+        "message": "Choisissez la langue de l’interface NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Rechercher une langue…"
+    },
+    "settings.general.language.empty": {
+        "message": "Aucune langue ne correspond."
+    },
+    "settings.general.theme.label": {
+        "message": "Thème"
+    },
+    "settings.general.theme.help": {
+        "message": "Choisissez le thème clair ou sombre, ou suivez l'apparence du système."
+    },
+    "settings.general.theme.system": {
+        "message": "Système"
+    },
+    "settings.general.theme.light": {
+        "message": "Clair"
+    },
+    "settings.general.theme.dark": {
+        "message": "Sombre"
+    },
+    "settings.general.management.label": {
+        "message": "Serveur de gestion"
+    },
+    "settings.general.management.help": {
+        "message": "Connectez-vous à NetBird Cloud ou à votre propre serveur de gestion auto-hébergé. Les modifications reconnecteront le client."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Auto-hébergé"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Veuillez saisir une URL valide, ex. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Impossible de joindre ce serveur. Vérifiez l’URL, ou enregistrez quand même si vous êtes sûr qu’elle est correcte."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Basculer vers NetBird Cloud ?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Cela déconnecte votre serveur auto-hébergé.\nVous devrez peut-être vous reconnecter."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Basculer vers Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Connectivité"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Routage et DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconnecter en cas de changement de réseau"
+    },
+    "settings.network.monitor.help": {
+        "message": "Surveiller le réseau et se reconnecter automatiquement lors de changements tels qu’un basculement Wi-Fi, une modification Ethernet ou une reprise après la mise en veille."
+    },
+    "settings.network.dns.label": {
+        "message": "Activer le DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Appliquer les paramètres DNS gérés par NetBird au résolveur de l’hôte."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Activer les routes client"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Accepter les routes d’autres pairs pour atteindre leurs réseaux."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Activer les routes serveur"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Annoncer les routes locales de cet hôte aux autres pairs."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Activer IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Utiliser l’adressage IPv6 pour le réseau overlay NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Pare-feu"
+    },
+    "settings.security.section.encryption": {
+        "message": "Chiffrement"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bloquer le trafic entrant"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rejeter les connexions non sollicitées des pairs vers cet appareil et les réseaux qu’il route. Le trafic sortant n’est pas affecté."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Bloquer l’accès au LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Empêcher les pairs d’atteindre votre réseau local ou ses appareils lorsque cet appareil route leur trafic."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Activer la résistance quantique"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Ajouter un échange de clés post-quantique via Rosenpass au-dessus de WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Activer le mode permissif"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Autoriser les connexions vers des pairs sans prise en charge de la résistance quantique."
+    },
+    "settings.ssh.section.server": {
+        "message": "Serveur"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Fonctionnalités"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Authentification"
+    },
+    "settings.ssh.server.label": {
+        "message": "Activer le serveur SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Exécuter le serveur SSH NetBird sur cet hôte afin que d’autres pairs puissent s’y connecter."
+    },
+    "settings.ssh.root.label": {
+        "message": "Autoriser la connexion en root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permettre aux pairs de se connecter en tant qu’utilisateur root. Désactivez pour exiger un compte non privilégié."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Autoriser SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transférer des fichiers en toute sécurité à l’aide de clients SFTP ou SCP natifs."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Redirection de port locale"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permettre aux pairs connectés de tunneliser des ports locaux vers des services accessibles depuis cet hôte."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Redirection de port distante"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permettre aux pairs connectés d’exposer des ports de cet hôte vers leur propre machine."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Activer l’authentification JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Vérifier chaque session SSH auprès de votre IdP pour l’identité de l’utilisateur et l’audit. Désactivez pour vous appuyer uniquement sur les politiques ACL réseau, utile lorsqu’aucun IdP n’est disponible."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL du cache JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Durée pendant laquelle ce client met en cache un JWT avant de redemander lors des connexions SSH sortantes. Définissez 0 pour désactiver la mise en cache et vous authentifier à chaque connexion."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "s"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interface"
+    },
+    "settings.advanced.section.security": {
+        "message": "Sécurité"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nom"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Utilisez 1 à 15 lettres, chiffres, points, tirets ou traits de soulignement."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Doit commencer par « utun » suivi d’un nombre (ex. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Port"
+    },
+    "settings.advanced.port.error": {
+        "message": "Saisissez un port compris entre {min} et {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Si la valeur est 0, un port libre aléatoire sera utilisé."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Saisissez une valeur MTU comprise entre {min} et {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Clé pré-partagée"
+    },
+    "settings.advanced.psk.help": {
+        "message": "PSK WireGuard facultative pour un chiffrement symétrique supplémentaire. Différente d’une clé d’installation NetBird. Vous ne communiquerez qu’avec les pairs utilisant la même clé pré-partagée."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Lot de diagnostic"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonymiser les informations sensibles"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Masque les adresses IP, les domaines et d'autres valeurs sensibles."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Le mode par défaut garde les adresses IPv4 internes et les noms des pairs lisibles pour le support. Le mode strict anonymise en plus les adresses IP privées (RFC 1918), CGNAT et de lien local, les noms des pairs et les clés publiques WireGuard. Les valeurs récurrentes reçoivent le même espace réservé, les pairs restent donc distinguables. Utilisez le mode strict lorsque vous partagez le lot de diagnostic en dehors de votre organisation."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Aucune"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Par défaut"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Strict"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Inclure les informations système"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Inclure l’OS, le noyau, les interfaces réseau et les tables de routage."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Envoyer le lot aux serveurs NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Renvoie une clé d’envoi à partager avec l’assistance NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Activer les journaux trace"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Élève le niveau de journalisation à TRACE, puis le rétablit ensuite."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Session de capture"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Se reconnecte et attend pour que vous puissiez reproduire le problème."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capturer les paquets réseau"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Enregistre un .pcap du trafic réseau pendant la session de capture."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Durée de capture"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Durée d’exécution de la session de capture."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "min"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Créer le lot"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Collecte des journaux, des détails système et de l’état de connexion. Cela prend généralement un instant — gardez cette fenêtre ouverte jusqu’à la fin."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Annulation…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Lot de diagnostic envoyé avec succès !"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Lot enregistré"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Partagez la clé d’envoi ci-dessous avec l’<docs>assistance NetBird</docs>. Une copie locale a également été enregistrée sur votre appareil."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Votre lot de diagnostic a été enregistré localement."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copier la clé"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Ouvrir le dossier"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Ouvrir l’emplacement du fichier"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Échec de l’envoi : {reason} Le lot reste enregistré localement."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Échec de l’envoi. Le lot reste enregistré localement."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconnexion de NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capture des journaux de débogage"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Génération du lot de diagnostic…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Envoi vers NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Annulation…"
+    },
+    "settings.about.client": {
+        "message": "Client NetBird v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "Client NetBird"
+    },
+    "settings.about.development": {
+        "message": "[Développement]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Tous droits réservés."
+    },
+    "settings.about.links.imprint": {
+        "message": "Mentions légales"
+    },
+    "settings.about.links.privacy": {
+        "message": "Confidentialité"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Conditions d’utilisation"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Forum"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentation"
+    },
+    "settings.about.community.feedback": {
+        "message": "Retour d’expérience"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} est prêt à être installé."
+    },
+    "update.banner.later": {
+        "message": "Plus tard"
+    },
+    "update.banner.installNow": {
+        "message": "Installer maintenant"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "La version {version} est disponible au téléchargement."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "La version {version} est disponible à l’installation."
+    },
+    "update.card.whatsNew": {
+        "message": "Quoi de neuf ?"
+    },
+    "update.card.installNow": {
+        "message": "Installer maintenant"
+    },
+    "update.card.getInstaller": {
+        "message": "Télécharger"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird vérifie les mises à jour en arrière-plan."
+    },
+    "update.card.changelog": {
+        "message": "Journal des modifications"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Vous utilisez la dernière version"
+    },
+    "update.header.tooltip": {
+        "message": "Mise à jour disponible"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Mise à jour de NetBird vers v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Mise à jour de NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Une version plus récente est disponible et en cours d’installation. NetBird redémarrera automatiquement une fois la mise à jour terminée."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "La mise à jour prend trop de temps"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "L’installation de {target} a pris trop de temps et ne s’est pas terminée."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "La mise à jour a été interrompue"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "La mise à jour vers {target} a été annulée avant de se terminer."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Impossible d’installer la mise à jour"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Impossible d’installer {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "erreur inconnue"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "la nouvelle version"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Échec du chargement de l’état de mise à jour"
+    },
+    "update.error.triggerTitle": {
+        "message": "Échec du démarrage de la mise à jour"
+    },
+    "update.page.versionLine": {
+        "message": "Mise à jour du client vers : {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Mise à jour du client."
+    },
+    "update.page.outdated": {
+        "message": "La version de votre client est antérieure à la version de mise à jour automatique définie dans Management."
+    },
+    "update.page.status.running": {
+        "message": "Mise à jour en cours"
+    },
+    "update.page.status.timeout": {
+        "message": "La mise à jour a expiré. Veuillez réessayer."
+    },
+    "update.page.status.canceled": {
+        "message": "Mise à jour annulée."
+    },
+    "update.page.status.failed": {
+        "message": "Échec de la mise à jour : {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "erreur de mise à jour inconnue"
+    },
+    "update.page.failedTitle": {
+        "message": "Échec de la mise à jour"
+    },
+    "update.page.timeoutMessage": {
+        "message": "La mise à jour a expiré."
+    },
+    "update.page.dontClose": {
+        "message": "Veuillez ne pas fermer cette fenêtre."
+    },
+    "update.page.updating": {
+        "message": "Mise à jour…"
+    },
+    "update.page.complete": {
+        "message": "Mise à jour terminée"
+    },
+    "update.page.failed": {
+        "message": "Échec de la mise à jour"
+    },
+    "window.title.settings": {
+        "message": "Paramètres"
+    },
+    "window.title.signIn": {
+        "message": "Connexion"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Expiration de session"
+    },
+    "window.title.updating": {
+        "message": "Mise à jour"
+    },
+    "window.title.welcome": {
+        "message": "Bienvenue dans NetBird"
+    },
+    "window.title.error": {
+        "message": "Erreur"
+    },
+    "welcome.title": {
+        "message": "Cherchez NetBird dans votre barre d’état système"
+    },
+    "welcome.titleMac": {
+        "message": "Cherchez NetBird dans votre barre des menus"
+    },
+    "welcome.description": {
+        "message": "NetBird se trouve dans votre barre d’état système. Cliquez sur l’icône pour vous connecter, changer de profil ou ouvrir les paramètres."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird se trouve dans votre barre des menus. Cliquez sur l’icône pour vous connecter, changer de profil ou ouvrir les paramètres."
+    },
+    "welcome.continue": {
+        "message": "Continuer"
+    },
+    "welcome.back": {
+        "message": "Retour"
+    },
+    "welcome.management.title": {
+        "message": "Configurer NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Cliquez sur Continuer pour commencer, ou choisissez Auto-hébergé si vous disposez de votre propre serveur NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Utilisez notre service hébergé. Aucune configuration requise."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Auto-hébergé"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Connectez-vous à votre propre serveur de gestion."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL du serveur de gestion"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Veuillez saisir une URL valide, ex. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Impossible de joindre ce serveur. Vérifiez l’URL ou votre réseau, puis continuez si vous êtes sûr qu’elle est correcte."
+    },
+    "welcome.management.checking": {
+        "message": "Vérification…"
+    },
+    "browserLogin.title": {
+        "message": "Continuez dans votre navigateur pour terminer la connexion"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Vous ne voyez pas l’onglet du navigateur ?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Réessayer"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Échec de l’ouverture du navigateur"
+    },
+    "sessionExpiration.title": {
+        "message": "La session expire bientôt"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Votre session va expirer"
+    },
+    "sessionExpiration.description": {
+        "message": "Cet appareil sera bientôt déconnecté. Renouvelez via une connexion dans le navigateur."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Une connexion dans le navigateur maintient cet appareil connecté à votre réseau."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renouveler la session"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "S’authentifier"
+    },
+    "sessionExpiration.logout": {
+        "message": "Se déconnecter"
+    },
+    "sessionExpiration.expired": {
+        "message": "Session expirée"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Appareil déconnecté. Authentifiez-vous via une connexion dans le navigateur pour vous reconnecter."
+    },
+    "sessionExpiration.close": {
+        "message": "Fermer"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Échec de la prolongation de la session"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Échec de la déconnexion"
+    },
+    "peers.search.placeholder": {
+        "message": "Rechercher par nom ou IP"
+    },
+    "peers.filter.all": {
+        "message": "Tous"
+    },
+    "peers.filter.online": {
+        "message": "En ligne"
+    },
+    "peers.filter.offline": {
+        "message": "Hors ligne"
+    },
+    "peers.empty.title": {
+        "message": "Aucun pair disponible"
+    },
+    "peers.empty.description": {
+        "message": "Soit vous n’avez aucun pair disponible, soit vous n’y avez pas accès."
+    },
+    "peers.details.domain": {
+        "message": "Domaine"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Clé publique"
+    },
+    "peers.details.connection": {
+        "message": "Connexion"
+    },
+    "peers.details.latency": {
+        "message": "Latence"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Dernier handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Dernière mise à jour de connexion"
+    },
+    "peers.details.bytes": {
+        "message": "Octets"
+    },
+    "peers.details.bytesSent": {
+        "message": "Envoyés"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Reçus"
+    },
+    "peers.details.localIce": {
+        "message": "ICE local"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE distant"
+    },
+    "peers.details.never": {
+        "message": "Jamais"
+    },
+    "peers.details.justNow": {
+        "message": "À l’instant"
+    },
+    "peers.details.refresh": {
+        "message": "Actualiser"
+    },
+    "peers.status.connected": {
+        "message": "Connecté"
+    },
+    "peers.status.connecting": {
+        "message": "Connexion"
+    },
+    "peers.status.disconnected": {
+        "message": "Déconnecté"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relais"
+    },
+    "peers.details.networks": {
+        "message": "Ressources"
+    },
+    "peers.details.relayed": {
+        "message": "Relayée"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass activé"
+    },
+    "networks.search.placeholder": {
+        "message": "Rechercher par réseau ou domaine"
+    },
+    "networks.filter.all": {
+        "message": "Toutes"
+    },
+    "networks.filter.active": {
+        "message": "Actives"
+    },
+    "networks.filter.overlapping": {
+        "message": "Chevauchantes"
+    },
+    "networks.empty.title": {
+        "message": "Aucune ressource disponible"
+    },
+    "networks.empty.description": {
+        "message": "Soit vous n’avez aucune ressource réseau disponible, soit vous n’y avez pas accès."
+    },
+    "networks.selected": {
+        "message": "Sélectionnée"
+    },
+    "networks.unselected": {
+        "message": "Non sélectionnée"
+    },
+    "networks.ips.heading": {
+        "message": "IP résolues"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} sur {total} actives"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Tout activer"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Tout désactiver"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Rechercher des nœuds de sortie"
+    },
+    "exitNodes.none": {
+        "message": "Aucun"
+    },
+    "exitNodes.empty.title": {
+        "message": "Aucun nœud de sortie disponible"
+    },
+    "exitNodes.empty.description": {
+        "message": "Aucun nœud de sortie n’a été partagé avec ce pair."
+    },
+    "exitNodes.card.title": {
+        "message": "Nœud de sortie"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Actif"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inactif"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Aucun"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Connexion directe sans nœud de sortie"
+    },
+    "quickActions.connect": {
+        "message": "Se connecter"
+    },
+    "quickActions.disconnect": {
+        "message": "Se déconnecter"
+    },
+    "daemon.unavailable.title": {
+        "message": "Le service NetBird n’est pas en cours d’exécution"
+    },
+    "daemon.unavailable.description": {
+        "message": "L’application se reconnectera automatiquement une fois le service en cours d’exécution."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentation"
+    },
+    "daemon.outdated.title": {
+        "message": "Le Client NetBird est obsolète"
+    },
+    "daemon.outdated.description": {
+        "message": "La nouvelle GUI n'est pas compatible avec votre ancien client. Mettez à jour votre client pour utiliser la nouvelle application."
+    },
+    "daemon.outdated.download": {
+        "message": "Télécharger la dernière version"
+    },
+    "error.jwt_clock_skew": {
+        "message": "Échec de la connexion : l’horloge de cet appareil n’est pas synchronisée avec le serveur. Veuillez synchroniser l’horloge de votre système et réessayer."
+    },
+    "error.jwt_expired": {
+        "message": "Votre jeton de connexion a expiré. Veuillez vous reconnecter."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Échec de la connexion : la signature du jeton est invalide. Veuillez contacter votre administrateur."
+    },
+    "error.session_expired": {
+        "message": "Votre session a expiré. Veuillez vous reconnecter."
+    },
+    "error.invalid_setup_key": {
+        "message": "La clé d’installation est manquante ou invalide."
+    },
+    "error.permission_denied": {
+        "message": "La connexion a été rejetée par le serveur."
+    },
+    "error.daemon_unreachable": {
+        "message": "Le daemon NetBird ne répond pas. Veuillez vérifier que le service est en cours d’exécution."
+    },
+    "error.settings_locked": {
+        "message": "Les paramètres ne peuvent pas être modifiés sur cet appareil : un administrateur les a verrouillés."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Ce paramètre est géré par votre organisation et ne peut pas être modifié."
+    },
+    "error.unknown": {
+        "message": "L’opération a échoué."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird n’a pas pu demander à ce système les privilèges nécessaires. Exécutez plutôt ceci :"
+    },
+    "error.elevation_failed": {
+        "message": "La modification n’a pas pu être appliquée avec des privilèges élevés. Exécutez plutôt ceci :"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "les privilèges root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "les privilèges administrateur"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Nécessite {actor}. Exécutez plutôt ceci :"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Vous pouvez le désactiver, mais le réactiver nécessite {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Vous pouvez l’activer, mais le désactiver de nouveau nécessite {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "En attente de l’autorisation…"
+    }
+}
diff --git a/client/ui/i18n/locales/gl/common.json b/client/ui/i18n/locales/gl/common.json
new file mode 100644
index 000000000..2b948104e
--- /dev/null
+++ b/client/ui/i18n/locales/gl/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Non está en execución"
+    },
+    "tray.status.error": {
+        "message": "Erro"
+    },
+    "tray.status.connected": {
+        "message": "Conectado"
+    },
+    "tray.status.connecting": {
+        "message": "Conectando"
+    },
+    "tray.status.needsLogin": {
+        "message": "Inicio de sesión requirido"
+    },
+    "tray.status.loginFailed": {
+        "message": "Erro ao iniciar sesión"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sesión caducada"
+    },
+    "tray.session.expiresIn": {
+        "message": "A sesión caduca en {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "menos dun minuto"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minuto"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutos"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 hora"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} horas"
+    },
+    "tray.session.unit.day": {
+        "message": "1 día"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} días"
+    },
+    "tray.menu.open": {
+        "message": "Abrir NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Conectar"
+    },
+    "tray.menu.disconnect": {
+        "message": "Desconectar"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nodo de saída"
+    },
+    "tray.menu.networks": {
+        "message": "Recursos"
+    },
+    "tray.menu.profiles": {
+        "message": "Perfís"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Xestionar perfís"
+    },
+    "tray.menu.settings": {
+        "message": "Configuración..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Crear paquete de depuración"
+    },
+    "tray.menu.about": {
+        "message": "Axuda e soporte"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentación"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Resolución de problemas"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Descargar a última versión"
+    },
+    "tray.menu.installVersion": {
+        "message": "Instalar versión {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Saír de NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "O servizo NetBird está desactualizado"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Actualice o servizo NetBird para usar esta aplicación."
+    },
+    "notify.update.title": {
+        "message": "Actualización de NetBird dispoñible"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} está dispoñible."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " O seu administrador require esta actualización."
+    },
+    "notify.error.title": {
+        "message": "Erro"
+    },
+    "notify.error.connect": {
+        "message": "Erro ao conectar"
+    },
+    "notify.error.disconnect": {
+        "message": "Erro ao desconectar"
+    },
+    "notify.error.switchProfile": {
+        "message": "Erro ao cambiar a {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Erro ao actualizar o nodo de saída {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Sesión caducada"
+    },
+    "notify.sessionExpired.body": {
+        "message": "A súa sesión caducou. Volva iniciar sesión para conectar."
+    },
+    "notify.sessionWarning.title": {
+        "message": "A sesión caduca en breve"
+    },
+    "notify.sessionWarning.body": {
+        "message": "A súa sesión de NetBird caduca en {remaining}. Prema en Prolongar agora para renovar."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "A súa sesión de NetBird está a punto de caducar. Prema en Prolongar agora para renovar."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Prolongar agora"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Descartar"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Erro ao prolongar a sesión de NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Sesión de NetBird prolongada"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "A súa sesión foi renovada."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Data límite de sesión rexeitada"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "O servidor enviou unha data límite de sesión non válida. Por favor, inicie sesión de novo."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Configuración de NetBird actualizada"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "A súa configuración de NetBird foi actualizada pola súa política de IT."
+    },
+    "common.cancel": {
+        "message": "Cancelar"
+    },
+    "common.save": {
+        "message": "Gardar"
+    },
+    "common.saveChanges": {
+        "message": "Gardar cambios"
+    },
+    "common.saving": {
+        "message": "Gardando…"
+    },
+    "common.close": {
+        "message": "Pechar"
+    },
+    "common.copy": {
+        "message": "Copiar"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Amosar ou ocultar o contrasinal"
+    },
+    "common.increase": {
+        "message": "Aumentar"
+    },
+    "common.decrease": {
+        "message": "Diminuír"
+    },
+    "common.delete": {
+        "message": "Eliminar"
+    },
+    "common.create": {
+        "message": "Crear"
+    },
+    "common.add": {
+        "message": "Engadir"
+    },
+    "common.remove": {
+        "message": "Quitar"
+    },
+    "common.refresh": {
+        "message": "Actualizar"
+    },
+    "common.loading": {
+        "message": "Cargando…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Non se puido atopar ningún resultado"
+    },
+    "common.noResults.description": {
+        "message": "Non puidemos atopar ningún resultado. Por favor, tente cun termo de busca diferente ou cambie os seus filtros."
+    },
+    "notConnected.title": {
+        "message": "Sen conexión"
+    },
+    "notConnected.description": {
+        "message": "Conéctese primeiro a NetBird para ver información detallada sobre os seus peers, recursos de rede e nodos de saída."
+    },
+    "connect.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "connect.status.connecting": {
+        "message": "Establecendo conexión..."
+    },
+    "connect.status.connected": {
+        "message": "Conectado á rede NetBird"
+    },
+    "connect.status.disconnecting": {
+        "message": "Desconectando..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon non dispoñible"
+    },
+    "connect.status.loginRequired": {
+        "message": "Inicie sesión para conectar"
+    },
+    "connect.error.loginTitle": {
+        "message": "Erro ao iniciar sesión"
+    },
+    "connect.error.connectTitle": {
+        "message": "Erro ao conectar"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Erro ao desconectar"
+    },
+    "nav.peers.title": {
+        "message": "Peers"
+    },
+    "nav.peers.description": {
+        "message": "{connected} de {total} conectados"
+    },
+    "nav.resources.title": {
+        "message": "Recursos"
+    },
+    "nav.resources.description": {
+        "message": "{active} de {total} activos"
+    },
+    "nav.exitNode.title": {
+        "message": "Nodos de saída"
+    },
+    "nav.exitNode.none": {
+        "message": "Non activo"
+    },
+    "nav.exitNode.using": {
+        "message": "Vía {name}"
+    },
+    "header.openSettings": {
+        "message": "Abrir configuración"
+    },
+    "header.togglePanel": {
+        "message": "Alternar panel lateral"
+    },
+    "profile.selector.loading": {
+        "message": "Cargando..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Sen perfil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Buscar perfil por nome..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Non se atoparon perfís"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Probe cun termo de busca diferente ou cree un novo perfil."
+    },
+    "profile.selector.newProfile": {
+        "message": "Novo perfil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Máis opcións"
+    },
+    "profile.selector.deregister": {
+        "message": "Dar de baixa"
+    },
+    "profile.selector.delete": {
+        "message": "Eliminar"
+    },
+    "profile.selector.switchTo": {
+        "message": "Cambiar a este perfil"
+    },
+    "profile.selector.edit": {
+        "message": "Editar"
+    },
+    "profile.edit.title": {
+        "message": "Editar perfil"
+    },
+    "profile.edit.submit": {
+        "message": "Gardar cambios"
+    },
+    "profile.dialog.title": {
+        "message": "Introduza o nome do perfil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nome do perfil"
+    },
+    "profile.dialog.description": {
+        "message": "Estableza un nome facilmente identificable para o seu perfil."
+    },
+    "profile.dialog.placeholder": {
+        "message": "p. ex. Traballo"
+    },
+    "profile.dialog.submit": {
+        "message": "Engadir perfil"
+    },
+    "profile.dialog.required": {
+        "message": "Por favor, introduza un nome de perfil, p. ex. traballo, casa"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Use NetBird Cloud ou o seu propio servidor."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Non se puido acadar este servidor. Comprobe o URL ou engada o perfil de todas formas se ten a certeza de que é correcto."
+    },
+    "header.menu.settings": {
+        "message": "Configuración..."
+    },
+    "header.menu.defaultView": {
+        "message": "Vista predeterminada"
+    },
+    "header.menu.advancedView": {
+        "message": "Vista avanzada"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Actualización dispoñible"
+    },
+    "header.menu.open": {
+        "message": "Abrir menú"
+    },
+    "header.profile.switch": {
+        "message": "Cambiar de perfil"
+    },
+    "connect.toggle.label": {
+        "message": "Alternar conexión de NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Enderezos IP locais"
+    },
+    "common.search": {
+        "message": "Buscar"
+    },
+    "common.filter": {
+        "message": "Filtrar"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Seleccionar nodo de saída"
+    },
+    "peers.row.label": {
+        "message": "Abrir detalles de {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Detalles do peer"
+    },
+    "networks.row.toggle": {
+        "message": "Alternar {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Alternar todos os recursos visibles"
+    },
+    "profile.switch.title": {
+        "message": "Cambiar ao perfil «{name}»?"
+    },
+    "profile.switch.message": {
+        "message": "Ten a certeza de que quere cambiar de perfil?\nO seu perfil actual desconectarase."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirmar"
+    },
+    "profile.deregister.title": {
+        "message": "Dar de baixa o perfil «{name}»?"
+    },
+    "profile.deregister.message": {
+        "message": "Ten a certeza de que quere dar de baixa este perfil?\nTerá que iniciar sesión de novo para usalo."
+    },
+    "profile.deregister.confirm": {
+        "message": "Dar de baixa"
+    },
+    "profile.delete.title": {
+        "message": "Eliminar o perfil «{name}»?"
+    },
+    "profile.delete.message": {
+        "message": "Ten a certeza de que quere eliminar este perfil?\nEsta acción non se pode desfacer."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Os perfís activos non se poden eliminar. Cambie a un perfil diferente antes de eliminar este perfil."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "O perfil predeterminado non se pode eliminar."
+    },
+    "profile.error.switchTitle": {
+        "message": "Erro ao cambiar de perfil"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Erro ao dar de baixa o perfil"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Erro ao eliminar o perfil"
+    },
+    "profile.error.createTitle": {
+        "message": "Erro ao crear o perfil"
+    },
+    "profile.error.editTitle": {
+        "message": "Erro ao editar o perfil"
+    },
+    "profile.error.loadTitle": {
+        "message": "Erro ao cargar os perfís"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Perfil activo"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Cambiar de perfil"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Outro"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Engadir perfil"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Xestionar perfís"
+    },
+    "profile.dropdown.settings": {
+        "message": "Configuración"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Perfís"
+    },
+    "settings.profiles.intro": {
+        "message": "Manteña identidades de NetBird separadas lado a lado, por exemplo contas de traballo e persoais, ou diferentes servidores de xestión. Engada, dea de baixa ou elimine perfís a continuación."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Engadir perfil"
+    },
+    "settings.profiles.active": {
+        "message": "Activo"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Sen perfís"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Cree un perfil para conectarse a un servidor de xestión de NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Erro ao cargar a configuración"
+    },
+    "settings.error.saveTitle": {
+        "message": "Erro ao gardar a configuración"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Erro no paquete de depuración"
+    },
+    "settings.nav.label": {
+        "message": "Seccións de configuración"
+    },
+    "settings.tabs.general": {
+        "message": "Xeral"
+    },
+    "settings.tabs.network": {
+        "message": "Rede"
+    },
+    "settings.tabs.security": {
+        "message": "Seguridade"
+    },
+    "settings.tabs.profiles": {
+        "message": "Perfís"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avanzado"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Resolución de problemas"
+    },
+    "settings.tabs.about": {
+        "message": "Acerca de"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Actualización dispoñible"
+    },
+    "settings.general.section.general": {
+        "message": "Xeral"
+    },
+    "settings.general.section.connection": {
+        "message": "Conexión"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Conectar ao iniciar"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Establece a conexión automaticamente cando se inicia o servizo."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notificacións de escritorio"
+    },
+    "settings.general.notifications.help": {
+        "message": "Amosar notificacións de escritorio para novas actualizacións e eventos de conexión."
+    },
+    "settings.general.autostart.label": {
+        "message": "Iniciar UI de NetBird ao acceder"
+    },
+    "settings.general.autostart.help": {
+        "message": "Inicie a interface de NetBird automaticamente cando inicie sesión. Isto afecta só á interface gráfica, non ao servizo en segundo plano."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Erro ao cambiar o inicio automático"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Manter conectado ao pechar"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "Mantén a conexión de NetBird en segundo plano cando se pecha a xanela principal."
+    },
+    "settings.general.language.label": {
+        "message": "Idioma da interface"
+    },
+    "settings.general.language.help": {
+        "message": "Escolla o idioma no que se amosa a aplicación NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Buscar idioma…"
+    },
+    "settings.general.language.empty": {
+        "message": "Ningún idioma coincide."
+    },
+    "settings.general.theme.label": {
+        "message": "Tema"
+    },
+    "settings.general.theme.help": {
+        "message": "Escolla claro ou escuro, ou siga a aparencia do seu sistema."
+    },
+    "settings.general.theme.system": {
+        "message": "Sistema"
+    },
+    "settings.general.theme.light": {
+        "message": "Claro"
+    },
+    "settings.general.theme.dark": {
+        "message": "Escuro"
+    },
+    "settings.general.management.label": {
+        "message": "Servidor de xestión"
+    },
+    "settings.general.management.help": {
+        "message": "Conéctese a NetBird Cloud ou ao seu propio servidor de xestión autoaloxado. Os cambios volverán conectar o cliente."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Autoaloxado"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Por favor, introduza un URL válido, p. ex. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Non se puido acadar este servidor. Comprobe o URL ou garde de todas formas se ten a certeza de que é correcto."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Cambiar a NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Isto desconecta o seu servidor autoaloxado.\nPode que teña que iniciar sesión de novo."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Cambiar a Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Conectividade"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Encamiñamento e DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconectar ao cambiar de rede"
+    },
+    "settings.network.monitor.help": {
+        "message": "Supervisa a rede e reconéctase automaticamente ante cambios como o cambio de Wi-Fi ou o reinicio tras a suspensión."
+    },
+    "settings.network.dns.label": {
+        "message": "Activar DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Aplica a configuración DNS xestionada por NetBird ao resolutor do sistema."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Activar rutas de cliente"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Acepta rutas doutros peers para acadar as súas redes."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Activar rutas de servidor"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Anuncia as rutas locais deste equipo a outros peers."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Activar IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Use o enderezamento IPv6 para a rede superposta de NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Cortafogos"
+    },
+    "settings.security.section.encryption": {
+        "message": "Cifrado"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bloquear tráfico entrante"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rexeita conexións non solicitadas de peers a este dispositivo e a calquera rede que encamiñe. O tráfico saínte non se ve afectado."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Bloquear acceso a LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Evita que os peers acaden a súa rede local ou os seus dispositivos cando este dispositivo encamiñe o seu tráfico."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Activar resistencia cuántica"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Engade un intercambio de chaves poscuántico mediante Rosenpass sobre WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Activar modo permisivo"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Permite conexións con peers que non teñan soporte de resistencia cuántica."
+    },
+    "settings.ssh.section.server": {
+        "message": "Servidor"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Capacidades"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Autenticación"
+    },
+    "settings.ssh.server.label": {
+        "message": "Activar servidor SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Executa o servidor SSH de NetBird neste equipo para que outros peers poidan conectarse a el."
+    },
+    "settings.ssh.root.label": {
+        "message": "Permitir inicio de sesión de root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permite que os peers inicien sesión como usuario root. Desactíveo para requirir unha conta sen privilexios."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Permitir SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transfire ficheiros de xeito seguro usando clientes nativos de SFTP ou SCP."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Reenvío de portos locais"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permite que os peers conectados fagan túneles de portos locais cara a servizos accesibles desde este equipo."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Reenvío de portos remotos"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permite que os peers conectados expoñan portos neste equipo cara á súa propia máquina."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Activar autenticación JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verifica cada sesión SSH co seu IdP para a identidade do usuario e auditar. Desactíveo para depender só de políticas ACL de rede, útil cando non hai IdP dispoñible."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL da caché JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Canto tempo almacena este cliente un JWT na caché antes de solicitalo de novo nas conexións SSH saíntes. Estableza en 0 para desactivar a caché e autenticar en cada conexión."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "Segundo(s)"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interface"
+    },
+    "settings.advanced.section.security": {
+        "message": "Seguridade"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nome"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Use entre 1 e 15 letras, díxitos, puntos, guións ou guións baixos."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Debe comezar por \"utun\" seguido dun número (p. ex. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Porto"
+    },
+    "settings.advanced.port.error": {
+        "message": "Introduza un porto entre {min} e {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Se se establece en 0, usarase un porto libre ao azar."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Introduza un valor de MTU entre {min} e {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Chave precompartida"
+    },
+    "settings.advanced.psk.help": {
+        "message": "Chave PSK opcional de WireGuard para cifrado simétrico adicional. Non é o mesmo que unha chave de configuración de NetBird. Só se comunicará con peers que usen a mesma chave precompartida."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Paquete de depuración"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonimizar información confidencial"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Oculta enderezos IP públicos e dominios que non sexan de NetBird nos rexistros."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "O nivel predeterminado mantén lexibles os enderezos IPv4 internos e os nomes dos peers para o soporte. O nivel estrito anonimiza ademais os enderezos IP privados (RFC 1918), CGNAT e de ligazón local, os nomes dos peers e as chaves públicas de WireGuard. Os valores recorrentes asígnanse ao mesmo marcador, polo que os peers seguen sendo distinguibles. Use Estrito cando comparta o paquete fóra da súa organización."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Ningunha"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Predeterminada"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Estrita"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Incluír información do sistema"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Inclúe SO, kernel, interfaces de rede e táboas de encamiñamento."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Subir paquete aos servidores de NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Devolve unha chave de subida para compartir co soporte de NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Activar rexistros de traza"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Eleva o nivel de rexistro a TRACE e restaúrao despois."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Sesión de captura"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Volve conectar e agarda para que poida reproducir a incidencia."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capturar paquetes de rede"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Garda un ficheiro .pcap do tráfico de rede durante a xanela de captura."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Duración da captura"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Canto tempo se executa a sesión de captura."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "Minuto(s)"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Crear paquete"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Recompilando rexistros, detalles do sistema e estado de conexión. Isto adoita levar un momento. Pode seguir usando NetBird ou pechar a Configuración mentres remata."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Paquete de depuración subido con éxito!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Paquete gardado"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Comparta a chave de subida de abaixo co <docs>soporte de NetBird</docs>. Tamén se gardou unha copia local no seu dispositivo."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "O seu paquete de depuración gardouse localmente."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copiar chave"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Abrir cartafol"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Abrir localización do ficheiro"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Erro na subida: {reason} O paquete aínda está gardado localmente."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Erro na subida. O paquete aínda está gardado localmente."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconectando NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capturando rexistros de depuración"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Xerando paquete de depuración…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Subindo a NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.about.client": {
+        "message": "Cliente NetBird v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "Cliente NetBird"
+    },
+    "settings.about.development": {
+        "message": "[Desenvolvemento]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Todos os dereitos reservados."
+    },
+    "settings.about.links.imprint": {
+        "message": "Aviso legal"
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacidade"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Termos do servizo"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Foro"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentación"
+    },
+    "settings.about.community.feedback": {
+        "message": "Comentarios"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} está listo para instalar."
+    },
+    "update.banner.later": {
+        "message": "Máis tarde"
+    },
+    "update.banner.installNow": {
+        "message": "Instalar agora"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "A versión {version} está dispoñible para descargar."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "A versión {version} está dispoñible para instalar."
+    },
+    "update.card.whatsNew": {
+        "message": "Que hai de novo?"
+    },
+    "update.card.installNow": {
+        "message": "Instalar agora"
+    },
+    "update.card.getInstaller": {
+        "message": "Descargar"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird busca actualizacións en segundo plano."
+    },
+    "update.card.changelog": {
+        "message": "Rexistro de cambios"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Ten a versión máis recente"
+    },
+    "update.header.tooltip": {
+        "message": "Actualización dispoñible"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Actualizando NetBird á v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Actualizando NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Unha versión máis recente está dispoñible e estase instalando. NetBird reiniciarase automaticamente unha vez remate a actualización."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "A actualización está tardando demasiado"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "A instalación de {target} tardou demasiado e non rematou."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Detívose a actualización"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "A actualización a {target} cancelouse antes de rematar."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Non se puido instalar a actualización"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Non se puido instalar {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "erro descoñecido"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "a nova versión"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Erro ao cargar o estado de actualización"
+    },
+    "update.error.triggerTitle": {
+        "message": "Erro ao iniciar a actualización"
+    },
+    "update.page.versionLine": {
+        "message": "Actualizando cliente a: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Actualizando cliente."
+    },
+    "update.page.outdated": {
+        "message": "A súa versión de cliente é máis antiga que a versión de actualización automática establecida na xestión."
+    },
+    "update.page.status.running": {
+        "message": "Actualizando"
+    },
+    "update.page.status.timeout": {
+        "message": "Esgotouse o tempo de espera da actualización. Por favor, inténteo de novo."
+    },
+    "update.page.status.canceled": {
+        "message": "Actualización cancelada."
+    },
+    "update.page.status.failed": {
+        "message": "Erro na actualización: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "erro de actualización descoñecido"
+    },
+    "update.page.failedTitle": {
+        "message": "Erro na actualización"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Esgotouse o tempo de espera da actualización."
+    },
+    "update.page.dontClose": {
+        "message": "Por favor, non peche esta xanela."
+    },
+    "update.page.updating": {
+        "message": "Actualizando…"
+    },
+    "update.page.complete": {
+        "message": "Actualización completada"
+    },
+    "update.page.failed": {
+        "message": "Erro na actualización"
+    },
+    "window.title.settings": {
+        "message": "Configuración"
+    },
+    "window.title.signIn": {
+        "message": "Iniciar sesión"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sesión a punto de caducar"
+    },
+    "window.title.updating": {
+        "message": "Actualizando"
+    },
+    "window.title.welcome": {
+        "message": "Benvido a NetBird"
+    },
+    "window.title.error": {
+        "message": "Erro"
+    },
+    "welcome.title": {
+        "message": "Busque NetBird na súa área de notificación"
+    },
+    "welcome.titleMac": {
+        "message": "Busque NetBird na súa barra de menú"
+    },
+    "welcome.description": {
+        "message": "NetBird reside na súa área de notificación. Faga clic na icona para conectar, cambiar de perfil ou abrir a configuración."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird reside na súa barra de menú. Faga clic na icona para conectar, cambiar de perfil ou abrir a configuración."
+    },
+    "welcome.continue": {
+        "message": "Continuar"
+    },
+    "welcome.back": {
+        "message": "Volver"
+    },
+    "welcome.management.title": {
+        "message": "Configurar NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Faga clic en Continuar para comezar, ou escolla Autoaloxado se ten o seu propio servidor de NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Use o noso servizo aloxado. Sen necesidade de configuración."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Autoaloxado"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Conéctese ao seu propio servidor de xestión."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL do servidor de xestión"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Por favor, introduza un URL válido, p. ex. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Non se puido acadar este servidor. Comprobe o URL ou a súa rede, e continúe se ten a certeza de que é correcto."
+    },
+    "welcome.management.checking": {
+        "message": "Comprobando…"
+    },
+    "browserLogin.title": {
+        "message": "Complete o inicio de sesión no navegador"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Abrimos unha lapela no seu navegador para que poida rematar de iniciar sesión. Non a ve?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Tentar de novo"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Erro ao abrir o navegador"
+    },
+    "sessionExpiration.title": {
+        "message": "A sesión caduca en breve"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "A súa sesión caducará"
+    },
+    "sessionExpiration.description": {
+        "message": "Este dispositivo desconectarase en breve. Renove iniciando sesión no navegador."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Un inicio de sesión no navegador mantén este dispositivo conectado á súa rede."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renovar sesión"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Autenticar"
+    },
+    "sessionExpiration.logout": {
+        "message": "Pechar sesión"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sesión caducada"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Dispositivo desconectado. Autentíquese cun inicio de sesión no navegador para volver conectar."
+    },
+    "sessionExpiration.close": {
+        "message": "Pechar"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Erro ao prolongar a sesión"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Erro ao pechar sesión"
+    },
+    "peers.search.placeholder": {
+        "message": "Buscar por nome ou IP"
+    },
+    "peers.filter.all": {
+        "message": "Todos"
+    },
+    "peers.filter.online": {
+        "message": "En liña"
+    },
+    "peers.filter.offline": {
+        "message": "Fóra de liña"
+    },
+    "peers.empty.title": {
+        "message": "Sen peers dispoñibles"
+    },
+    "peers.empty.description": {
+        "message": "Ou non ten ningún peer dispoñible ou non ten acceso a ningún deles."
+    },
+    "peers.details.domain": {
+        "message": "Dominio"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP de NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 de NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Chave pública"
+    },
+    "peers.details.connection": {
+        "message": "Conexión"
+    },
+    "peers.details.latency": {
+        "message": "Latencia"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Último handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Última actualización de conexión"
+    },
+    "peers.details.bytes": {
+        "message": "Bytes"
+    },
+    "peers.details.bytesSent": {
+        "message": "Enviados"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Recibidos"
+    },
+    "peers.details.localIce": {
+        "message": "ICE local"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE remoto"
+    },
+    "peers.details.never": {
+        "message": "Nunca"
+    },
+    "peers.details.justNow": {
+        "message": "Agora mesmo"
+    },
+    "peers.details.refresh": {
+        "message": "Actualizar"
+    },
+    "peers.status.connected": {
+        "message": "Conectado"
+    },
+    "peers.status.connecting": {
+        "message": "Conectando"
+    },
+    "peers.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "peers.details.relayAddress": {
+        "message": "Servidor de retransmisión"
+    },
+    "peers.details.networks": {
+        "message": "Recursos"
+    },
+    "peers.details.relayed": {
+        "message": "Retransmitido"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass activado"
+    },
+    "networks.search.placeholder": {
+        "message": "Buscar por rede ou dominio"
+    },
+    "networks.filter.all": {
+        "message": "Todos"
+    },
+    "networks.filter.active": {
+        "message": "Activos"
+    },
+    "networks.filter.overlapping": {
+        "message": "Sobrepostos"
+    },
+    "networks.empty.title": {
+        "message": "Sen recursos dispoñibles"
+    },
+    "networks.empty.description": {
+        "message": "Ou non ten recursos de rede dispoñibles ou non ten acceso a ningún deles."
+    },
+    "networks.selected": {
+        "message": "Seleccionado"
+    },
+    "networks.unselected": {
+        "message": "Non seleccionado"
+    },
+    "networks.ips.heading": {
+        "message": "IPs resoltas"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} de {total} Activos"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Activar todos"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Desactivar todos"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Buscar nodos de saída"
+    },
+    "exitNodes.none": {
+        "message": "Ningún"
+    },
+    "exitNodes.empty.title": {
+        "message": "Sen nodos de saída dispoñibles"
+    },
+    "exitNodes.empty.description": {
+        "message": "Non se compartiron nodos de saída con este peer."
+    },
+    "exitNodes.card.title": {
+        "message": "Nodo de saída"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Activo"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inactivo"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Ningún"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Conexión directa sen nodo de saída"
+    },
+    "quickActions.connect": {
+        "message": "Conectar"
+    },
+    "quickActions.disconnect": {
+        "message": "Desconectar"
+    },
+    "daemon.unavailable.title": {
+        "message": "O servizo NetBird non está en execución"
+    },
+    "daemon.unavailable.description": {
+        "message": "A aplicación volverá conectar automaticamente cando o servizo estea en execución."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentación"
+    },
+    "daemon.outdated.title": {
+        "message": "O cliente NetBird está desactualizado"
+    },
+    "daemon.outdated.description": {
+        "message": "A nova GUI non é compatible co cliente NetBird máis antigo. Actualice o seu cliente para usar a nova aplicación."
+    },
+    "daemon.outdated.download": {
+        "message": "Descargar a última versión"
+    },
+    "error.jwt_clock_skew": {
+        "message": "Erro ao iniciar sesión: o reloxo deste dispositivo non está sincronizado co servidor. Por favor, sincronice o reloxo do sistema e inténteo de novo."
+    },
+    "error.jwt_expired": {
+        "message": "O seu token de inicio de sesión caducou. Por favor, inicie sesión de novo."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Erro ao iniciar sesión: a sinatura do token non é válida. Por favor, contacte co seu administrador."
+    },
+    "error.session_expired": {
+        "message": "A súa sesión caducou. Por favor, inicie sesión de novo."
+    },
+    "error.invalid_setup_key": {
+        "message": "A chave de configuración falta ou non é válida."
+    },
+    "error.permission_denied": {
+        "message": "O inicio de sesión foi rexeitado polo servidor."
+    },
+    "error.daemon_unreachable": {
+        "message": "O daemon de NetBird non responde. Por favor, comprobe que o servizo está en execución."
+    },
+    "error.settings_locked": {
+        "message": "A configuración non se pode cambiar neste dispositivo: un administrador bloqueouna."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Esta configuración está xestionada pola súa organización e non se pode cambiar."
+    },
+    "error.unknown": {
+        "message": "A operación fallou."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird non puido solicitar a este sistema os privilexios que o cambio require. Execute isto no seu lugar:"
+    },
+    "error.elevation_failed": {
+        "message": "O cambio non se puido aplicar con privilexios elevados. Execute isto no seu lugar:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "privilexios de administrador"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Require {actor}. Execute isto no seu lugar:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Pode desactivalo, pero para volvelo activar requírese {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Pode activalo, pero para volvelo desactivar requírese {actor}:"
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Agardando pola autorización…"
+    }
+}
diff --git a/client/ui/i18n/locales/he/common.json b/client/ui/i18n/locales/he/common.json
new file mode 100644
index 000000000..640f6b3da
--- /dev/null
+++ b/client/ui/i18n/locales/he/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "מנותק"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "לא פעיל"
+    },
+    "tray.status.error": {
+        "message": "שגיאה"
+    },
+    "tray.status.connected": {
+        "message": "מחובר"
+    },
+    "tray.status.connecting": {
+        "message": "מתחבר"
+    },
+    "tray.status.needsLogin": {
+        "message": "צריך להיכנס"
+    },
+    "tray.status.loginFailed": {
+        "message": "הכניסה נכשלה"
+    },
+    "tray.status.sessionExpired": {
+        "message": "תוקף ההפעלה פג"
+    },
+    "tray.session.expiresIn": {
+        "message": "תוקף ההפעלה יפוג בעוד {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "פחות מדקה"
+    },
+    "tray.session.unit.minute": {
+        "message": "דקה"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} דקות"
+    },
+    "tray.session.unit.hour": {
+        "message": "שעה"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} שעות"
+    },
+    "tray.session.unit.day": {
+        "message": "יום"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} ימים"
+    },
+    "tray.menu.open": {
+        "message": "פתיחת NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "התחברות"
+    },
+    "tray.menu.disconnect": {
+        "message": "התנתקות"
+    },
+    "tray.menu.exitNode": {
+        "message": "נקודת יציאה"
+    },
+    "tray.menu.networks": {
+        "message": "משאבים"
+    },
+    "tray.menu.profiles": {
+        "message": "פרופילים"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "ניהול פרופילים"
+    },
+    "tray.menu.settings": {
+        "message": "הגדרות…"
+    },
+    "tray.menu.debugBundle": {
+        "message": "יצירת מאגד ניפוי שגיאות"
+    },
+    "tray.menu.about": {
+        "message": "עזרה ותמיכה"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "תיעוד"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "פתרון בעיות"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "הורדת הגרסה העדכנית ביותר"
+    },
+    "tray.menu.installVersion": {
+        "message": "התקנת גרסה {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "ממשק משתמש: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "סוכן: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "יציאה מ־NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "שירות NetBird אינו עדכני"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "יש לעדכן את שירות NetBird כדי להשתמש ביישום הזה."
+    },
+    "notify.update.title": {
+        "message": "יש עדכון ל־NetBird"
+    },
+    "notify.update.body": {
+        "message": "יצא NetBird {version}."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " הנהלת המערכת דורשת ממך לעדכן לגרסה הזאת."
+    },
+    "notify.error.title": {
+        "message": "שגיאה"
+    },
+    "notify.error.connect": {
+        "message": "החיבור נכשל"
+    },
+    "notify.error.disconnect": {
+        "message": "הניתוק נכשל"
+    },
+    "notify.error.switchProfile": {
+        "message": "המעבר לפרופיל {profile} נכשל"
+    },
+    "notify.error.exitNode": {
+        "message": "עדכון נקודת היציאה {name} נכשל"
+    },
+    "notify.sessionExpired.title": {
+        "message": "תוקף הפעלת NetBird פג"
+    },
+    "notify.sessionExpired.body": {
+        "message": "תוקף הפעלת ה־NetBird שלך פג. נא להיכנס למערכת שוב."
+    },
+    "notify.sessionWarning.title": {
+        "message": "תוקף ההפעלה יפוג בקרוב"
+    },
+    "notify.sessionWarning.body": {
+        "message": "הפעלת ה־NetBird שלך תפוג בעוד {remaining}. לחיצה על להאריך כעת תחדש אותה."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "תוקף הפעלת ה־NetBird שלך עומד לפוג. לחיצה על להאריך כעת תחדש אותו."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "להאריך כעת"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "התעלמות"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "הארכת ההפעלה של NetBird נכשלה"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "ההפעלה של NetBird הוארכה"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "ההפעלה שלך התרעננה."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "מועד הסיום של ההפעלה נדחה"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "השרת שלח מועד סיום שגוי להפעלה. נא להיכנס שוב למערכת."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "ההגדרות של NetBird עודכנו"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "הגדרות ה־NetBird שלך עודכנו על ידי מדיניות צוות המחשוב שלך."
+    },
+    "common.cancel": {
+        "message": "ביטול"
+    },
+    "common.save": {
+        "message": "שמירה"
+    },
+    "common.saveChanges": {
+        "message": "שמירת השינויים"
+    },
+    "common.saving": {
+        "message": "שמירה…"
+    },
+    "common.close": {
+        "message": "סגירה"
+    },
+    "common.copy": {
+        "message": "העתקה"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "הסתרת/חשיפת סיסמה"
+    },
+    "common.increase": {
+        "message": "הגדלה"
+    },
+    "common.decrease": {
+        "message": "הקטנה"
+    },
+    "common.delete": {
+        "message": "מחיקה"
+    },
+    "common.create": {
+        "message": "יצירה"
+    },
+    "common.add": {
+        "message": "הוספה"
+    },
+    "common.remove": {
+        "message": "הסרה"
+    },
+    "common.refresh": {
+        "message": "ריענון"
+    },
+    "common.loading": {
+        "message": "בטעינה…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "לא ניתן למצוא תוצאות כלשהן."
+    },
+    "common.noResults.description": {
+        "message": "לא הצלחנו למצוא תוצאות כלשהן. נא לנסות ביטוי חיפוש אחר או לשנות את המסננים שלך."
+    },
+    "notConnected.title": {
+        "message": "מנותק"
+    },
+    "notConnected.description": {
+        "message": "יש להתחבר ל־NetBird תחילה כדי לצפות במידע מפורט על העמיתים, משאבי הרשת ונקודות היציאה שלך."
+    },
+    "connect.status.disconnected": {
+        "message": "מנותק"
+    },
+    "connect.status.connecting": {
+        "message": "מתחבר…"
+    },
+    "connect.status.connected": {
+        "message": "מחובר"
+    },
+    "connect.status.disconnecting": {
+        "message": "מתנתק…"
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "הסוכן לא זמין"
+    },
+    "connect.status.loginRequired": {
+        "message": "נדרשת כניסה"
+    },
+    "connect.error.loginTitle": {
+        "message": "הכניסה נכשלה"
+    },
+    "connect.error.connectTitle": {
+        "message": "התחברות נכשלה"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "התנתקות נכשלה"
+    },
+    "nav.peers.title": {
+        "message": "עמיתים"
+    },
+    "nav.peers.description": {
+        "message": "{connected} מתוך {total} מחוברים"
+    },
+    "nav.resources.title": {
+        "message": "משאבים"
+    },
+    "nav.resources.description": {
+        "message": "{active} מתוך {total} פעילים"
+    },
+    "nav.exitNode.title": {
+        "message": "נקודות יציאה"
+    },
+    "nav.exitNode.none": {
+        "message": "לא פעיל"
+    },
+    "nav.exitNode.using": {
+        "message": "דרך {name}"
+    },
+    "header.openSettings": {
+        "message": "פתיחת הגדרות"
+    },
+    "header.togglePanel": {
+        "message": "הצגת/הסתרת לוח צד"
+    },
+    "profile.selector.loading": {
+        "message": "בטעינה…"
+    },
+    "profile.selector.noProfile": {
+        "message": "אין פרופיל"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "חיפוש פרופיל לפי שם…"
+    },
+    "profile.selector.emptyTitle": {
+        "message": "לא נמצאו פרופילים"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "כדאי לנסות ביטוי אחר לחיפוש או ליצור פרופיל חדש."
+    },
+    "profile.selector.newProfile": {
+        "message": "פרופיל חדש"
+    },
+    "profile.selector.moreOptions": {
+        "message": "אפשרויות נוספות"
+    },
+    "profile.selector.deregister": {
+        "message": "ביטול רישום"
+    },
+    "profile.selector.delete": {
+        "message": "מחיקה"
+    },
+    "profile.selector.switchTo": {
+        "message": "החלפה לפרופיל הזה"
+    },
+    "profile.selector.edit": {
+        "message": "עריכה"
+    },
+    "profile.edit.title": {
+        "message": "עריכת פרופיל"
+    },
+    "profile.edit.submit": {
+        "message": "שמירת השינויים"
+    },
+    "profile.dialog.title": {
+        "message": "נא למלא שם פרופיל"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "שם פרופיל"
+    },
+    "profile.dialog.description": {
+        "message": "הגדרת שם שניתן לזהות בקלות לפרופיל שלך."
+    },
+    "profile.dialog.placeholder": {
+        "message": "למשל: עבודה"
+    },
+    "profile.dialog.submit": {
+        "message": "הוספת פרופיל"
+    },
+    "profile.dialog.required": {
+        "message": "נא למלא שם לפרופיל, למשל: עבודה, בית"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "אפשר להשתמש בענן של NetBird או בשרת משלך."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "לא ניתן להגיע לשרת. נא לבדוק שהכתובת נכונה או להוסיף את הפרופיל בכל זאת אם ברור לך שהיא נכונה."
+    },
+    "header.menu.settings": {
+        "message": "הגדרות…"
+    },
+    "header.menu.defaultView": {
+        "message": "תצוגת ברירת מחדל"
+    },
+    "header.menu.advancedView": {
+        "message": "תצוגה מתקדמת"
+    },
+    "header.menu.updateAvailable": {
+        "message": "יש עדכון"
+    },
+    "header.menu.open": {
+        "message": "פתיחת התפריט"
+    },
+    "header.profile.switch": {
+        "message": "החלפת פרופיל"
+    },
+    "connect.toggle.label": {
+        "message": "החלפת מצב חיבור NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "כתובות IP מקומיות"
+    },
+    "common.search": {
+        "message": "חיפוש"
+    },
+    "common.filter": {
+        "message": "סינון"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "בחירת נקודת יציאה"
+    },
+    "peers.row.label": {
+        "message": "פתיחת פרטים עבור {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "פרטי עמית"
+    },
+    "networks.row.toggle": {
+        "message": "להחליף את המצב של {name}"
+    },
+    "networks.bulk.label": {
+        "message": "להחליף את המצב של כל המשאבים הגלויים"
+    },
+    "profile.switch.title": {
+        "message": "להחליף את הפרופיל כך שיהיה „{name}”?"
+    },
+    "profile.switch.message": {
+        "message": "להחליף פרופילים?\nהפרופיל הנוכחי שלך יתנתק."
+    },
+    "profile.switch.confirm": {
+        "message": "אישור"
+    },
+    "profile.deregister.title": {
+        "message": "לבטל את רישום הפרופיל „{name}”?"
+    },
+    "profile.deregister.message": {
+        "message": "לבטל את רישום הפרופיל הזה?\nצריך להיכנס שוב כדי להשתמש בו."
+    },
+    "profile.deregister.confirm": {
+        "message": "לבטל רישום"
+    },
+    "profile.delete.title": {
+        "message": "למחוק את הפרופיל „{name}”?"
+    },
+    "profile.delete.message": {
+        "message": "למחוק את הפרופיל הזה?\nזאת פעולה בלתי הפיכה."
+    },
+    "profile.delete.disabledActive": {
+        "message": "לא ניתן למחוק פרופילים פעילים. יש להחליף לפרופיל אחר בטרם מחיקת הפרופיל הזה."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "לא ניתן למחוק את פרופיל ברירת המחדל."
+    },
+    "profile.error.switchTitle": {
+        "message": "החלפת פרופיל נכשלה"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "ביטול רישום פרופיל נכשל"
+    },
+    "profile.error.deleteTitle": {
+        "message": "מחיקת פרופיל נכשלה"
+    },
+    "profile.error.createTitle": {
+        "message": "יצירת פרופיל נכשלה"
+    },
+    "profile.error.editTitle": {
+        "message": "עריכת פרופיל נכשלה"
+    },
+    "profile.error.loadTitle": {
+        "message": "טעינת הפרופילים נכשלה"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "הפרופיל הפעיל"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "החלפת פרופיל"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "אחר"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "הוספת פרופיל"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "ניהול פרופילים"
+    },
+    "profile.dropdown.settings": {
+        "message": "הגדרות"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "פרופילים"
+    },
+    "settings.profiles.intro": {
+        "message": "ניתן להחזיק את זהויות ה־NetBird הנפרדות זו לצד זו, למשל חשבון עבודה וחשבון פרטי או שרתי ניהול שונים. אפשר להוסיף, לבטל רישום או למחוק פרופילים להלן."
+    },
+    "settings.profiles.addProfile": {
+        "message": "הוספת פרופיל"
+    },
+    "settings.profiles.active": {
+        "message": "פעיל"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "אין פרופילים"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "יש ליצור פרופיל כדי להתחבר לשרת ניהול של NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "טעינת ההגדרות נכשלה"
+    },
+    "settings.error.saveTitle": {
+        "message": "שמירת ההגדרות נכשלה"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "מאגד ניפוי השגיאות נכשל"
+    },
+    "settings.nav.label": {
+        "message": "סעיפי הגדרות"
+    },
+    "settings.tabs.general": {
+        "message": "כללי"
+    },
+    "settings.tabs.network": {
+        "message": "רשת"
+    },
+    "settings.tabs.security": {
+        "message": "אבטחה"
+    },
+    "settings.tabs.profiles": {
+        "message": "פרופילים"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "מתקדם"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "פתרון בעיות"
+    },
+    "settings.tabs.about": {
+        "message": "על אודות"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "יש עדכון"
+    },
+    "settings.general.section.general": {
+        "message": "כללי"
+    },
+    "settings.general.section.connection": {
+        "message": "חיבור"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "להתחבר עם העלייה"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "להקים חיבור אוטומטית כשהשירות מופעל."
+    },
+    "settings.general.notifications.label": {
+        "message": "התראות שולחן עבודה"
+    },
+    "settings.general.notifications.help": {
+        "message": "להציג התראות שולחן עבודה על עדכונים חדשים ואירועי חיבור."
+    },
+    "settings.general.autostart.label": {
+        "message": "להפעיל את ממשק המשתמש של NetBird עם הכניסה למערכת"
+    },
+    "settings.general.autostart.help": {
+        "message": "להפעיל את הממשק של NetBird אוטומטית עם הכניסה. הפעולה הזאת משפיעה על הממשק הגרפי בלבד, לא על שירות הרקע."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "שינוי בהפעלה האוטומטית נכשל"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "להשאיר את החיבור לאחר היציאה"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "החיבור נשאר פעיל ברקע לאחר סגירת NetBird. הוא נקטע רק כשבחרת לנתק אותו בעצמך."
+    },
+    "settings.general.language.label": {
+        "message": "שפת התצוגה"
+    },
+    "settings.general.language.help": {
+        "message": "בחירת שפת הממשק של NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "חיפוש שפה…"
+    },
+    "settings.general.language.empty": {
+        "message": "אין שפות תואמות."
+    },
+    "settings.general.theme.label": {
+        "message": "ערכת עיצוב"
+    },
+    "settings.general.theme.help": {
+        "message": "נא לבחור בהירה או כהה או להתאים למערכת."
+    },
+    "settings.general.theme.system": {
+        "message": "מערכת"
+    },
+    "settings.general.theme.light": {
+        "message": "בהירה"
+    },
+    "settings.general.theme.dark": {
+        "message": "כהה"
+    },
+    "settings.general.management.label": {
+        "message": "שרת ניהול"
+    },
+    "settings.general.management.help": {
+        "message": "אפשר להתחבר לענן של NetBird או לשרת ניהול באירוח שלך. שינויים יחברו את הלקוח מחדש."
+    },
+    "settings.general.management.cloud": {
+        "message": "ענן"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "אירוח עצמי"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "נא למלא כתובת תקפה, למשל, https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "לא ניתן להגיע לשרת הזה. נא לבדוק את הכתובת או לשמור בכל זאת אם ברור לך שהיא נכונה."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "לעבור לענן NetBird?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "מנתק אותך מהשרת שלך באירוח עצמי.\nיתכן שיהיה עליך להיכנס למערכת שוב."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "מעבר לענן"
+    },
+    "settings.network.section.connectivity": {
+        "message": "קישוריות"
+    },
+    "settings.network.section.routingDns": {
+        "message": "ניתוב ו־DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "להתחבר מחדש כשחל שינוי ברשת"
+    },
+    "settings.network.monitor.help": {
+        "message": "מעקב אחר הרשת כדי להתחבר מחדש עקב שינויים כגון מעבר רשת אלחוטית, שינויים בחיבור הקווי או התעוררות משינה."
+    },
+    "settings.network.dns.label": {
+        "message": "הפעלת DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "החלת הגדרות DNS בניהול NetBird לפותר שמות המארחים."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "הפעלת ניתובי לקוח"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "קבלת ניתובים מעמיתים אחרים כדי להגיע לרשתות שלהם."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "הפעלת ניתובי שרת"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "לפרסם את הניתובים המקומיים של המארח הזה לעמיתים אחרים."
+    },
+    "settings.network.ipv6.label": {
+        "message": "הפעלת IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "להשתמש בחלוקת כתובות IPv6 לרשת שכבת העל של NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "חומת אש"
+    },
+    "settings.security.section.encryption": {
+        "message": "הצפנה"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "חסימת תעבורה נכנסת"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "לדחות חיבורים שלא התבקשו מעמיתים למכשיר הזה ולרשתות כלשהן שהוא מנתב אליהן. אין השפעה על התקשורת היוצאת."
+    },
+    "settings.security.blockLan.label": {
+        "message": "חסימת גישה לרשת המקומית"
+    },
+    "settings.security.blockLan.help": {
+        "message": "למנוע מעמיתים להגיע לרשת המקומית שלך או המכשירים שבה כאשר המכשיר הזה מנתב את התעבורה שלהם."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "הפעלת עמידות לפיענוח צפנים קוונטי"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "הוספת החלפת מפתחות עמידה לפיענוח צפנים קוונטי דרך Rosenpass על גבי WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "הפעלת מצב מתירני"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "לאפשר חיבורים לעמיתים ללא תמיכה בעמידות לפיענוח צפנים קוונטי."
+    },
+    "settings.ssh.section.server": {
+        "message": "שרת"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "יכולות"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "אימות"
+    },
+    "settings.ssh.server.label": {
+        "message": "הפעלת שרת SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "להריץ את שרת ה־SSH של NetBird על המארח הזה כדי שעמיתים אחרים יוכלו להתחבר אליו."
+    },
+    "settings.ssh.root.label": {
+        "message": "לאפשר כניסת ניהול (root)"
+    },
+    "settings.ssh.root.help": {
+        "message": "לאפשר לעמיתים להיכנס בתור משתמש הניהול. אפשר להשבית כדי לדרוש שזה יהיה חשבון ללא הרשאות מופלגות."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "לאפשר SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "העברת קבצים בבטחה עם לקוחות מובנים של SFTP או SCP."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "העברת פתחה מקומית"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "לאפשר לעמיתים שמתחברים לתעל פתחות מקומיות לשירותים שנגישים למארח הזה."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "העברת פתחה מרוחקת"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "לאפשר לעמיתים שמתחברים לחשוף בפני המארח הזה פתחות שחוזרות למכונות שלהם."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "הפעלת אימות JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "לאמת כל הפעלת SSH מול ספק הזהות (IdP) שלך לזהות המשתמש ולפיקוח. יש להשבית כדי לסמוך רק על מדיניויות ה־ACL (רשימת בקרת גישה) של הרשתות בלבד, שימושי כשאין ספק זהות (IdP) זמין."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "זמן חיי JWT במטמון (TTL)"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "כמה זמן הלקוח הזה שומר JWT במטמון בטרם הצגת בקשה חוזרת לחיבורי SSH יוצאים. יש להגדיר ל־0 כדי להשבית את המטמון ולעבור אימות עם כל חיבור מחדש."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "שנייה/ות"
+    },
+    "settings.advanced.section.interface": {
+        "message": "ממשק"
+    },
+    "settings.advanced.section.security": {
+        "message": "אבטחה"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "שם"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "יש להשתמש ב־1-15 אותיות, ספרות, נקודות, מינוסים או קווים תחתיים."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "חייב להתחיל ב־„utun” ולאחריו מספר (למשל: utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "פתחה"
+    },
+    "settings.advanced.port.error": {
+        "message": "נא למלא פתחה בין {min} ל־{max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "אם מוגדר ל־0, ייעשה שימוש בפתחה פנויה אקראית."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "נא למלא ערך MTU בין {min} לבין {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "מפתח ששותף מראש"
+    },
+    "settings.advanced.psk.help": {
+        "message": "מפתח ששותף מראש (PSK) של WireGuard כרשות להצפנה סימטרית בנוסף. לא זהה למפתח התקנה של NetBird. תהיה לך תקשורת רק מול עמיתים שמשתמשים באותו המפתח ששותף מראש."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "מאגד ניפוי שגיאות"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "הסוואת מידע רגיש עם מידע אלמוני"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "הסתרת כתובות IP ציבוריות ושמות תחום שאינם של NetBird מהיומנים."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "ברירת המחדל משאירה את כתובות ה־IPv4 הפנימיות ואת שמות העמיתים קריאים למטרות תמיכה. מצב מחמיר מסתיר באלמוניות כתובות פרטיות (RFC 1918), CGNAT ו־link-local (קישור מקומי), שמות עמיתים ומפתחות ציבוריים של WireGuard. ערכים חוזרים ממופים לאותו ממלא המקום, כך שהעמיתים נשארים בלתי ניתנים להבדלה. כדאי להשתמש במחמיר בעת שיתוף המאגד מחוץ לארגון שלך."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "ללא"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "ברירת מחדל"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "מחמיר"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "לכלול את פרטי המערכת"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "לכלול את מערכת ההפעלה, הליבה, ממשקי הרשת וטבלאות הניתוב."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "להעלות את המאגד לשרתים של NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "החזרת מפתח שליחה לשיתוף עם התמיכה של NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "הפעלת יומני מעקב"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "הגברת רמת התיעוד ביומן ל־TRACE (מעקב) ומשחזרת אותה לאחר מכן."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "הפעלת לכידה"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "חיבור מחדש והמתנה כדי לאפשר ליצור את התקלה מחדש."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "לכידת מנות נתונים מהרשת"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "שמירת ‎.pcap של תעבורת רשת בזמן חלון האיסוף."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "משך לכידה"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "למשך כמה זמן הפעלת הלכידה רצה."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "דקה/ות"
+    },
+    "settings.troubleshooting.create": {
+        "message": "יצירת מאגד"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "היומנים, פרטי המערכת ומצב החיבור נאספים. האיסוף בדרך כלל לוקח כמה רגעים. אפשר להמשיך להשתמש ב־NetBird או לסגור את ההגדרות בזמן שהתהליך מסתיים."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "מבוטל…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "מאגד ניפוי השגיאות נשלח בהצלחה!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "המאגד נשמר"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "יש לשתף את מפתח השליחה להלן עם <docs>התמיכה של NetBird</docs>. עותק מקומי נשמר בנוסף על המכונה שלך."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "מאגד ניפוי השגיאות שלך נשמר מקומית."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "העתקת מפתח"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "פתיחת תיקייה"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "פתיחת מקום הקובץ"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "ההעלאה נכשלה: {reason}, המאגד עדיין שמור מקומית."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "ההעלאה נכשלה. המאגד עדיין שמור מקומית."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "NetBird מתחבר מחדש…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "יומני ניפוי השגיאות נלכדים"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "מאגד ניפוי שגיאות נוצר…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "נשלח ל־NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "מבטל…"
+    },
+    "settings.about.client": {
+        "message": "לקוח NetBird v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "לקוח NetBird"
+    },
+    "settings.about.development": {
+        "message": "[פיתוח]"
+    },
+    "settings.about.gui": {
+        "message": "ממשק משתמש v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "ממשק משתמש"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. כל הזכויות שמורות."
+    },
+    "settings.about.links.imprint": {
+        "message": "הצהרה משפטית"
+    },
+    "settings.about.links.privacy": {
+        "message": "פרטיות"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "תנאי השירות"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "פורום"
+    },
+    "settings.about.community.documentation": {
+        "message": "תיעוד"
+    },
+    "settings.about.community.feedback": {
+        "message": "משוב"
+    },
+    "update.banner.message": {
+        "message": "ההתקנה של NetBird {version} מוכנה."
+    },
+    "update.banner.later": {
+        "message": "אחר כך"
+    },
+    "update.banner.installNow": {
+        "message": "להתקין עכשיו"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "גרסה {version} זמינה להורדה."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "גרסה {version} זמינה להתקנה."
+    },
+    "update.card.whatsNew": {
+        "message": "מה חדש?"
+    },
+    "update.card.installNow": {
+        "message": "להתקין עכשיו"
+    },
+    "update.card.getInstaller": {
+        "message": "הורדה"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird בודק ברקע אם יש עדכונים."
+    },
+    "update.card.changelog": {
+        "message": "יומן שינויים"
+    },
+    "update.card.onLatestVersion": {
+        "message": "הגרסה המותקנת היא העדכנית ביותר"
+    },
+    "update.header.tooltip": {
+        "message": "יש עדכון"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "NetBird מתעדכן ל־v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "NetBird מתעדכן"
+    },
+    "update.overlay.description": {
+        "message": "גרסה חדשה יותר זמינה ומותקנת כרגע. NetBird יופעל מחדש אוטומטית לאחר סיום העדכון."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "העדכון אורך זמן רב מדי"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "התקנת {target} ארכה זמן רב מדי ולא הסתיימה."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "העדכון נעצר"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "העדכון לגרסה {target} בוטל לפני שהספיק להסתיים."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "לא ניתן להתקין את העדכון"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "לא ניתן להתקין את {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "שגיאה לא ידועה"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "הגרסה החדשה"
+    },
+    "update.error.loadStateTitle": {
+        "message": "טעינת מצב העדכון נכשלה"
+    },
+    "update.error.triggerTitle": {
+        "message": "התחלת העדכון נכשלה"
+    },
+    "update.page.versionLine": {
+        "message": "הלקוח מתעדכן לגרסה: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "הלקוח מתעדכן."
+    },
+    "update.page.outdated": {
+        "message": "גרסת הלקוח שלך ישנה מגרסת העדכון האוטומטי שהוגדרה בניהול."
+    },
+    "update.page.status.running": {
+        "message": "מתעדכן"
+    },
+    "update.page.status.timeout": {
+        "message": "הזמן שהוקצב לעדכון הסתיים. נא לנסות שוב."
+    },
+    "update.page.status.canceled": {
+        "message": "העדכון בוטל."
+    },
+    "update.page.status.failed": {
+        "message": "העדכון נכשל: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "שגיאת עדכון לא ידועה"
+    },
+    "update.page.failedTitle": {
+        "message": "העדכון נכשל"
+    },
+    "update.page.timeoutMessage": {
+        "message": "הזמן שהוקצב לעדכון תם."
+    },
+    "update.page.dontClose": {
+        "message": "נא לא לסגור את החלון הזה"
+    },
+    "update.page.updating": {
+        "message": "מתעדכן…"
+    },
+    "update.page.complete": {
+        "message": "העדכון הושלם"
+    },
+    "update.page.failed": {
+        "message": "העדכון נכשל"
+    },
+    "window.title.settings": {
+        "message": "הגדרות"
+    },
+    "window.title.signIn": {
+        "message": "כניסה"
+    },
+    "window.title.sessionExpiration": {
+        "message": "תוקף ההפעלה פג"
+    },
+    "window.title.updating": {
+        "message": "מתעדכן"
+    },
+    "window.title.welcome": {
+        "message": "ברוך בואך ל־NetBird"
+    },
+    "window.title.error": {
+        "message": "שגיאה"
+    },
+    "welcome.title": {
+        "message": "כדאי לחפש את NetBird בשורת המשימות שלך"
+    },
+    "welcome.titleMac": {
+        "message": "כדאי לחפש את NetBird בשורת התפריטים שלך"
+    },
+    "welcome.description": {
+        "message": "NetBird שוכן בשורת המשימות שלך. יש ללחוץ על הסמל כדי להתחבר, להחליף פרופילים או כדי לפתוח את ההגדרות."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird שוכן בסרגל התפריטים שלך. יש ללחוץ על הסמל כדי להתחבר, להחליף פרופילים או כדי לפתוח את ההגדרות."
+    },
+    "welcome.continue": {
+        "message": "המשך"
+    },
+    "welcome.back": {
+        "message": "חזרה"
+    },
+    "welcome.management.title": {
+        "message": "הגדרת NetBird"
+    },
+    "welcome.management.description": {
+        "message": "יש ללחוץ על המשך כדי להתחיל או לבחור באירוח עצמי אם יש לך שרת NetBird משלך."
+    },
+    "welcome.management.cloud.title": {
+        "message": "ענן NetBird"
+    },
+    "welcome.management.cloud.description": {
+        "message": "אפשר להשתמש בשירות באירוח שלנו. לא צריך הגדרות."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "אירוח עצמי"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "התחברות לשרת ניהול משלך."
+    },
+    "welcome.management.urlLabel": {
+        "message": "כתובת שרת ניהול"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "נא למלא כתובת שרת ניהול תקפה, כגון, https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "לא ניתן להגיע לשרת הזה. נא לבדוק את הכתובת או את הרשת שלך, לאחר מכן להמשיך אם היא נכונה בוודאות."
+    },
+    "welcome.management.checking": {
+        "message": "מתבצעת בדיקה…"
+    },
+    "browserLogin.title": {
+        "message": "יש להשלים את הכניסה בדפדפן שלך"
+    },
+    "browserLogin.notSeeing": {
+        "message": "פתחנו לשונית בדפדפן כדי לאפשר לך לסיים את הכניסה למערכת. לא רואה אותה?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "לנסות שוב"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "פתיחת הדפדפן נכשלה"
+    },
+    "sessionExpiration.title": {
+        "message": "תוקף ההפעלה עומד לפוג בקרוב"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "תוקף ההפעלה שלך יפוג"
+    },
+    "sessionExpiration.description": {
+        "message": "המכשיר הזה ינותק בהקדם. יש לחדש את הכניסה דרך הדפדפן."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "כניסה עם דפדפן משאירה את המכשיר הזה מחובר לרשת שלך."
+    },
+    "sessionExpiration.stay": {
+        "message": "חידוש הפעלה"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "אימות"
+    },
+    "sessionExpiration.logout": {
+        "message": "יציאה"
+    },
+    "sessionExpiration.expired": {
+        "message": "תוקף ההפעלה פג"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "המכשיר נותק. יש לעבור אימות עם כניסת דפדפן כדי להתחבר מחדש."
+    },
+    "sessionExpiration.close": {
+        "message": "סגירה"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "הארכת ההפעלה נכשלה"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "היציאה מהחשבון נכשלה"
+    },
+    "peers.search.placeholder": {
+        "message": "חיפוש לפי שם או IP"
+    },
+    "peers.filter.all": {
+        "message": "כולם"
+    },
+    "peers.filter.online": {
+        "message": "מחוברים"
+    },
+    "peers.filter.offline": {
+        "message": "מנותקים"
+    },
+    "peers.empty.title": {
+        "message": "אין עמיתים זמינים"
+    },
+    "peers.empty.description": {
+        "message": "או שאין לך עמיתים זמינים או שאין לך גישה לאף אחד מהם."
+    },
+    "peers.details.domain": {
+        "message": "שם תחום"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP של NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 של NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "מפתח ציבורי"
+    },
+    "peers.details.connection": {
+        "message": "חיבור"
+    },
+    "peers.details.latency": {
+        "message": "עיכוב"
+    },
+    "peers.details.lastHandshake": {
+        "message": "לחיצת יד אחרונה"
+    },
+    "peers.details.statusSince": {
+        "message": "עדכון אחרון על החיבור"
+    },
+    "peers.details.bytes": {
+        "message": "בתים"
+    },
+    "peers.details.bytesSent": {
+        "message": "נשלחו"
+    },
+    "peers.details.bytesReceived": {
+        "message": "התקבלו"
+    },
+    "peers.details.localIce": {
+        "message": "ICE מקומי"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE מרוחק"
+    },
+    "peers.details.never": {
+        "message": "אף פעם לא"
+    },
+    "peers.details.justNow": {
+        "message": "כרגע"
+    },
+    "peers.details.refresh": {
+        "message": "ריענון"
+    },
+    "peers.status.connected": {
+        "message": "מחובר"
+    },
+    "peers.status.connecting": {
+        "message": "מתחבר"
+    },
+    "peers.status.disconnected": {
+        "message": "מנותק"
+    },
+    "peers.details.relayAddress": {
+        "message": "ממסר"
+    },
+    "peers.details.networks": {
+        "message": "משאבים"
+    },
+    "peers.details.relayed": {
+        "message": "דרך ממסר"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass הופעל"
+    },
+    "networks.search.placeholder": {
+        "message": "חיפוש לפי רשת או שם תחום"
+    },
+    "networks.filter.all": {
+        "message": "כולן"
+    },
+    "networks.filter.active": {
+        "message": "פעילות"
+    },
+    "networks.filter.overlapping": {
+        "message": "חופפות"
+    },
+    "networks.empty.title": {
+        "message": "אין משאבים זמינים"
+    },
+    "networks.empty.description": {
+        "message": "או שאין לך משאבי רשת זמינים או שאין לך גישה לאף אחד מהם."
+    },
+    "networks.selected": {
+        "message": "נבחרה"
+    },
+    "networks.unselected": {
+        "message": "לא נבחרה"
+    },
+    "networks.ips.heading": {
+        "message": "כתובות IP שנפתרו"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} מתוך {total} פעילות"
+    },
+    "networks.bulk.enableAll": {
+        "message": "להפעיל הכול"
+    },
+    "networks.bulk.disableAll": {
+        "message": "לכבות הכול"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "חיפוש נקודות יציאה"
+    },
+    "exitNodes.none": {
+        "message": "אין"
+    },
+    "exitNodes.empty.title": {
+        "message": "אין נקודות יציאה זמינות"
+    },
+    "exitNodes.empty.description": {
+        "message": "לא שותפו נקודות יציאה עם העמית הזה."
+    },
+    "exitNodes.card.title": {
+        "message": "נקודת יציאה"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "פעילה"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "כבויה"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "אין"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "חיבור ישיר ללא נקודת יציאה"
+    },
+    "quickActions.connect": {
+        "message": "התחברות"
+    },
+    "quickActions.disconnect": {
+        "message": "התנתקות"
+    },
+    "daemon.unavailable.title": {
+        "message": "שירות NetBird לא פעיל"
+    },
+    "daemon.unavailable.description": {
+        "message": "היישום יתחבר אוטומטית לאחר שהשירות יופעל."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "תיעוד"
+    },
+    "daemon.outdated.title": {
+        "message": "שירות NetBird אינו עדכני"
+    },
+    "daemon.outdated.description": {
+        "message": "ממשק המשתמש החדש לא תואם ללקוח ישן יותר של NetBird. יש לעדכן את הלקוח שלך כדי להשתמש ביישום החדש"
+    },
+    "daemon.outdated.download": {
+        "message": "להוריד את העדכני ביותר"
+    },
+    "error.jwt_clock_skew": {
+        "message": "הכניסה נכשלה: השעון של המכשיר הזה לא תואם במדויק את זה של השרת. נא לכוון את שעון המערכת שלך ולנסות שוב."
+    },
+    "error.jwt_expired": {
+        "message": "תוקף אסימון הכניסה שלך פג. נא להיכנס שוב."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "הכניסה נכשלה: חתימת האסימון שגויה. נא ליצור קשר עם הנהלת המערכת שלך."
+    },
+    "error.session_expired": {
+        "message": "תוקף ההפעלה שלך פג. נא להיכנס שוב."
+    },
+    "error.invalid_setup_key": {
+        "message": "מפתח ההתקנה חסר או שגוי."
+    },
+    "error.permission_denied": {
+        "message": "בקשת הכניסה נדחתה על ידי השרת."
+    },
+    "error.daemon_unreachable": {
+        "message": "הסוכן של NetBird לא מגיב. נא לבדוק שהשירות פעיל."
+    },
+    "error.settings_locked": {
+        "message": "אי אפשר לשנות את ההגדרות במכשיר הזה: הן ננעלו על ידי ההנהלה."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "ההגדרה הזאת מנוהלת על ידי הארגון שלך ואי אפשר לשנות אותה."
+    },
+    "error.unknown": {
+        "message": "הפעולה נכשלה."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird לא הצליח לבקש מהמערכת הזאת את ההרשאות שהשינוי הזה צריך. יש להריץ את זה במקום:"
+    },
+    "error.elevation_failed": {
+        "message": "אי אפשר להחיל את השינויים עם הרשאות גבוהות יותר. יש להריץ את זה במקום:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "משתמש על/root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "הרשאות ניהול"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "דורש {actor}. יש להריץ את זה במקום:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "אפשר לכבות את זה, אבל ההפעלה דורשת {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "אפשר להפעיל את זה, אבל הכיבוי דורש {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "בהמתנה לאימות…"
+    }
+}
diff --git a/client/ui/i18n/locales/hu/common.json b/client/ui/i18n/locales/hu/common.json
new file mode 100644
index 000000000..36705afbc
--- /dev/null
+++ b/client/ui/i18n/locales/hu/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Lecsatlakozva"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Nem fut"
+    },
+    "tray.status.error": {
+        "message": "Hiba"
+    },
+    "tray.status.connected": {
+        "message": "Csatlakozva"
+    },
+    "tray.status.connecting": {
+        "message": "Csatlakozás"
+    },
+    "tray.status.needsLogin": {
+        "message": "Bejelentkezés szükséges"
+    },
+    "tray.status.loginFailed": {
+        "message": "Sikertelen bejelentkezés"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Munkamenet lejárt"
+    },
+    "tray.session.expiresIn": {
+        "message": "Munkamenet lejár {remaining} múlva"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "egy percnél kevesebb"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 perc"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} perc"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 óra"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} óra"
+    },
+    "tray.session.unit.day": {
+        "message": "1 nap"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} nap"
+    },
+    "tray.menu.open": {
+        "message": "NetBird megnyitása"
+    },
+    "tray.menu.connect": {
+        "message": "Csatlakozás"
+    },
+    "tray.menu.disconnect": {
+        "message": "Bontás"
+    },
+    "tray.menu.exitNode": {
+        "message": "Exit Node"
+    },
+    "tray.menu.networks": {
+        "message": "Erőforrások"
+    },
+    "tray.menu.profiles": {
+        "message": "Profilok"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Profilok kezelése"
+    },
+    "tray.menu.settings": {
+        "message": "Beállítások…"
+    },
+    "tray.menu.debugBundle": {
+        "message": "Hibakeresési csomag készítése"
+    },
+    "tray.menu.about": {
+        "message": "Súgó és támogatás"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Dokumentáció"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Hibakeresés"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Legfrissebb verzió letöltése"
+    },
+    "tray.menu.installVersion": {
+        "message": "{version} verzió telepítése"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "NetBird bezárása"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "A NetBird szolgáltatás elavult"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Frissítsd a NetBird szolgáltatást az alkalmazás használatához."
+    },
+    "notify.update.title": {
+        "message": "NetBird frissítés elérhető"
+    },
+    "notify.update.body": {
+        "message": "Elérhető a NetBird {version}."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " A rendszergazda kötelezővé tette ezt a frissítést."
+    },
+    "notify.error.title": {
+        "message": "Hiba"
+    },
+    "notify.error.connect": {
+        "message": "Csatlakozás sikertelen"
+    },
+    "notify.error.disconnect": {
+        "message": "Bontás sikertelen"
+    },
+    "notify.error.switchProfile": {
+        "message": "Átváltás sikertelen erre: {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Az Exit Node frissítése sikertelen: {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "NetBird munkamenet lejárt"
+    },
+    "notify.sessionExpired.body": {
+        "message": "A NetBird munkamenet lejárt. Kérjük, jelentkezzen be újra."
+    },
+    "notify.sessionWarning.title": {
+        "message": "Munkamenet hamarosan lejár"
+    },
+    "notify.sessionWarning.body": {
+        "message": "A NetBird munkamenet {remaining} múlva lejár. Kattintson a Meghosszabbítás gombra a megújításhoz."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "A NetBird munkamenet hamarosan lejár. Kattintson a Meghosszabbítás gombra a megújításhoz."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Meghosszabbítás"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Elvetés"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "A NetBird munkamenet meghosszabbítása sikertelen"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "NetBird munkamenet meghosszabbítva"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "A munkamenet frissítve."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Munkamenet-határidő elutasítva"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "A szerver érvénytelen munkamenet-határidőt küldött. Kérjük, jelentkezzen be újra."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird beállítások frissítve"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "A NetBird konfigurációt az IT-szabályzat frissítette."
+    },
+    "common.cancel": {
+        "message": "Mégse"
+    },
+    "common.save": {
+        "message": "Mentés"
+    },
+    "common.saveChanges": {
+        "message": "Módosítások mentése"
+    },
+    "common.saving": {
+        "message": "Mentés…"
+    },
+    "common.close": {
+        "message": "Bezárás"
+    },
+    "common.copy": {
+        "message": "Másolás"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Jelszó láthatóságának váltása"
+    },
+    "common.increase": {
+        "message": "Növelés"
+    },
+    "common.decrease": {
+        "message": "Csökkentés"
+    },
+    "common.delete": {
+        "message": "Törlés"
+    },
+    "common.create": {
+        "message": "Létrehozás"
+    },
+    "common.add": {
+        "message": "Hozzáadás"
+    },
+    "common.remove": {
+        "message": "Eltávolítás"
+    },
+    "common.refresh": {
+        "message": "Frissítés"
+    },
+    "common.loading": {
+        "message": "Betöltés…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Nincs találat"
+    },
+    "common.noResults.description": {
+        "message": "Nem találtunk eredményt. Próbáljon meg másik keresési kifejezést, vagy módosítsa a szűrőket."
+    },
+    "notConnected.title": {
+        "message": "Lecsatlakozva"
+    },
+    "notConnected.description": {
+        "message": "Csatlakozzon először a NetBirdhöz, hogy részletes információkat láthasson a Peerekről, a hálózati erőforrásokról és az Exit Node-okról."
+    },
+    "connect.status.disconnected": {
+        "message": "Lecsatlakozva"
+    },
+    "connect.status.connecting": {
+        "message": "Csatlakozás…"
+    },
+    "connect.status.connected": {
+        "message": "Csatlakozva"
+    },
+    "connect.status.disconnecting": {
+        "message": "Lecsatlakozás…"
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon nem elérhető"
+    },
+    "connect.status.loginRequired": {
+        "message": "Bejelentkezés szükséges"
+    },
+    "connect.error.loginTitle": {
+        "message": "Bejelentkezés sikertelen"
+    },
+    "connect.error.connectTitle": {
+        "message": "Csatlakozás sikertelen"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Bontás sikertelen"
+    },
+    "nav.peers.title": {
+        "message": "Peerek"
+    },
+    "nav.peers.description": {
+        "message": "{connected} / {total} csatlakoztatva"
+    },
+    "nav.resources.title": {
+        "message": "Erőforrások"
+    },
+    "nav.resources.description": {
+        "message": "{active} / {total} aktív"
+    },
+    "nav.exitNode.title": {
+        "message": "Exit Node-ok"
+    },
+    "nav.exitNode.none": {
+        "message": "Nem aktív"
+    },
+    "nav.exitNode.using": {
+        "message": "Ezen át: {name}"
+    },
+    "header.openSettings": {
+        "message": "Beállítások megnyitása"
+    },
+    "header.togglePanel": {
+        "message": "Oldalsó panel váltása"
+    },
+    "profile.selector.loading": {
+        "message": "Betöltés…"
+    },
+    "profile.selector.noProfile": {
+        "message": "Nincs profil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Profil keresése név alapján…"
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Nem található profil"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Próbáljon más keresőkifejezést, vagy hozzon létre új profilt."
+    },
+    "profile.selector.newProfile": {
+        "message": "Új profil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "További műveletek"
+    },
+    "profile.selector.deregister": {
+        "message": "Leválasztás"
+    },
+    "profile.selector.delete": {
+        "message": "Profil törlése"
+    },
+    "profile.selector.switchTo": {
+        "message": "Váltás erre a profilra"
+    },
+    "profile.selector.edit": {
+        "message": "Szerkesztés"
+    },
+    "profile.edit.title": {
+        "message": "Profil szerkesztése"
+    },
+    "profile.edit.submit": {
+        "message": "Módosítások mentése"
+    },
+    "profile.dialog.title": {
+        "message": "Új profil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Profilnév"
+    },
+    "profile.dialog.description": {
+        "message": "Adjon profiljának egy könnyen azonosítható nevet."
+    },
+    "profile.dialog.placeholder": {
+        "message": "pl. Munka"
+    },
+    "profile.dialog.submit": {
+        "message": "Profil hozzáadása"
+    },
+    "profile.dialog.required": {
+        "message": "Adjon meg egy profilnevet, pl. Munka, Otthon"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "NetBird Cloud vagy saját kiszolgáló."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "A szerver nem érhető el. Ellenőrizze az URL-t, vagy adja hozzá a profilt, ha biztos benne, hogy helyes."
+    },
+    "header.menu.settings": {
+        "message": "Beállítások…"
+    },
+    "header.menu.defaultView": {
+        "message": "Alapnézet"
+    },
+    "header.menu.advancedView": {
+        "message": "Speciális nézet"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Frissítés elérhető"
+    },
+    "header.menu.open": {
+        "message": "Menü megnyitása"
+    },
+    "header.profile.switch": {
+        "message": "Profilváltás"
+    },
+    "connect.toggle.label": {
+        "message": "NetBird-kapcsolat be/ki"
+    },
+    "connect.localIp.label": {
+        "message": "Helyi IP-címek"
+    },
+    "common.search": {
+        "message": "Keresés"
+    },
+    "common.filter": {
+        "message": "Szűrés"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Kilépőcsomópont kiválasztása"
+    },
+    "peers.row.label": {
+        "message": "Részletek megnyitása: {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Társ részletei"
+    },
+    "networks.row.toggle": {
+        "message": "{name} be/ki"
+    },
+    "networks.bulk.label": {
+        "message": "Összes látható erőforrás be/ki"
+    },
+    "profile.switch.title": {
+        "message": "Váltás a(z) \"{name}\" profilra?"
+    },
+    "profile.switch.message": {
+        "message": "Biztosan profilt szeretne váltani?\nAz aktuális profilja le lesz választva."
+    },
+    "profile.switch.confirm": {
+        "message": "Megerősítés"
+    },
+    "profile.deregister.title": {
+        "message": "\"{name}\" profil leválasztása?"
+    },
+    "profile.deregister.message": {
+        "message": "Biztosan le szeretné választani ezt a profilt?\nÚjra be kell jelentkeznie a használatához."
+    },
+    "profile.deregister.confirm": {
+        "message": "Leválasztás"
+    },
+    "profile.delete.title": {
+        "message": "\"{name}\" profil törlése?"
+    },
+    "profile.delete.message": {
+        "message": "Biztosan törölni szeretné ezt a profilt?\nEz a művelet nem vonható vissza."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Aktív profilok nem törölhetők. Váltson másik profilra, mielőtt törölné ezt."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Az alapértelmezett profil nem törölhető."
+    },
+    "profile.error.switchTitle": {
+        "message": "Profilváltás sikertelen"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Leválasztás sikertelen"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Profil törlése sikertelen"
+    },
+    "profile.error.createTitle": {
+        "message": "Profil létrehozása sikertelen"
+    },
+    "profile.error.editTitle": {
+        "message": "Profil szerkesztése sikertelen"
+    },
+    "profile.error.loadTitle": {
+        "message": "Profilok betöltése sikertelen"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Aktív profil"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Profilváltás"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Egyéb"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Profil hozzáadása"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Profilok kezelése"
+    },
+    "profile.dropdown.settings": {
+        "message": "Beállítások"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Profilok"
+    },
+    "settings.profiles.intro": {
+        "message": "Kezeljen több NetBird-profilt párhuzamosan, például munkahelyi és személyes fiókokat, vagy különböző felügyeleti szervereket. Lent hozzáadhat, leválaszthat vagy törölhet profilokat."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Profil hozzáadása"
+    },
+    "settings.profiles.active": {
+        "message": "Aktív"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Nincsenek profilok"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Hozzon létre egy profilt a NetBird felügyeleti szerverhez való csatlakozáshoz."
+    },
+    "settings.error.loadTitle": {
+        "message": "Beállítások betöltése sikertelen"
+    },
+    "settings.error.saveTitle": {
+        "message": "Beállítások mentése sikertelen"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Hibakeresési csomag sikertelen"
+    },
+    "settings.nav.label": {
+        "message": "Beállítások szakaszai"
+    },
+    "settings.tabs.general": {
+        "message": "Általános"
+    },
+    "settings.tabs.network": {
+        "message": "Hálózat"
+    },
+    "settings.tabs.security": {
+        "message": "Biztonság"
+    },
+    "settings.tabs.profiles": {
+        "message": "Profilok"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Speciális"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Hibaelhárítás"
+    },
+    "settings.tabs.about": {
+        "message": "Névjegy"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Frissítés elérhető"
+    },
+    "settings.general.section.general": {
+        "message": "Általános"
+    },
+    "settings.general.section.connection": {
+        "message": "Kapcsolat"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Csatlakozás indításkor"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "A szolgáltatás indulásakor automatikusan kapcsolatot létesít."
+    },
+    "settings.general.notifications.label": {
+        "message": "Asztali értesítések"
+    },
+    "settings.general.notifications.help": {
+        "message": "Asztali értesítések megjelenítése új frissítésekről és kapcsolati eseményekről."
+    },
+    "settings.general.autostart.label": {
+        "message": "NetBird UI indítása bejelentkezéskor"
+    },
+    "settings.general.autostart.help": {
+        "message": "A NetBird felület automatikus indítása bejelentkezéskor. Ez csak a grafikus felületet érinti, a háttérszolgáltatást nem."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Az automatikus indítás módosítása sikertelen"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Kapcsolat megtartása kilépéskor"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "A kapcsolat a háttérben megmarad, miután bezárod a NetBirdöt. Csak akkor szakad meg, ha te magad bontod."
+    },
+    "settings.general.language.label": {
+        "message": "Megjelenítési nyelv"
+    },
+    "settings.general.language.help": {
+        "message": "Válassza ki a NetBird felület nyelvét."
+    },
+    "settings.general.language.search": {
+        "message": "Nyelv keresése…"
+    },
+    "settings.general.language.empty": {
+        "message": "Nincs találat."
+    },
+    "settings.general.theme.label": {
+        "message": "Téma"
+    },
+    "settings.general.theme.help": {
+        "message": "Válassza a világos vagy sötét témát, vagy kövesse a rendszer beállítását."
+    },
+    "settings.general.theme.system": {
+        "message": "Rendszer"
+    },
+    "settings.general.theme.light": {
+        "message": "Világos"
+    },
+    "settings.general.theme.dark": {
+        "message": "Sötét"
+    },
+    "settings.general.management.label": {
+        "message": "Felügyeleti szerver"
+    },
+    "settings.general.management.help": {
+        "message": "Csatlakozás a NetBird Cloudhoz vagy saját üzemeltetésű felügyeleti szerverhez. A módosítások újracsatlakozást váltanak ki."
+    },
+    "settings.general.management.cloud": {
+        "message": "Felhő"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Saját üzemeltetésű"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Adjon meg egy érvényes URL-t, pl. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "A szerver nem érhető el. Ellenőrizze az URL-t, vagy mentse el, ha biztos benne, hogy helyes."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Átváltás a NetBird Cloudra?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Ez leválasztja a saját üzemeltetésű kiszolgálót.\nLehet, hogy újra be kell jelentkeznie."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Váltás a felhőre"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Kapcsolódás"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Útválasztás és DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Újracsatlakozás hálózatváltáskor"
+    },
+    "settings.network.monitor.help": {
+        "message": "A hálózat figyelése és automatikus újracsatlakozás változások (pl. Wi-Fi-váltás, Ethernet-változás vagy alvó állapotból való visszatérés) esetén."
+    },
+    "settings.network.dns.label": {
+        "message": "DNS engedélyezése"
+    },
+    "settings.network.dns.help": {
+        "message": "A NetBird által kezelt DNS-beállítások alkalmazása a gazda DNS-feloldójára."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Kliens útvonalak engedélyezése"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Más Peerek útvonalainak elfogadása a hálózataik eléréséhez."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Szerver útvonalak engedélyezése"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Ennek a gazdának a helyi útvonalainak meghirdetése más Peerek számára."
+    },
+    "settings.network.ipv6.label": {
+        "message": "IPv6 engedélyezése"
+    },
+    "settings.network.ipv6.help": {
+        "message": "IPv6-címzés használata a NetBird overlay hálózathoz."
+    },
+    "settings.security.section.firewall": {
+        "message": "Tűzfal"
+    },
+    "settings.security.section.encryption": {
+        "message": "Titkosítás"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bejövő forgalom blokkolása"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Visszautasítja a Peerektől érkező nem kért kapcsolatokat ezen eszközhöz és az általa irányított hálózatokhoz. A kimenő forgalmat nem érinti."
+    },
+    "settings.security.blockLan.label": {
+        "message": "LAN-hozzáférés blokkolása"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Megakadályozza, hogy a Peerek elérjék a helyi hálózatot vagy annak eszközeit, amikor ez az eszköz irányítja a forgalmukat."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Kvantumellenálló titkosítás engedélyezése"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Post-kvantum kulcscsere hozzáadása Rosenpass segítségével a WireGuard® tetejére."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Engedékeny mód engedélyezése"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Kapcsolatok engedélyezése kvantumellenálló titkosítás nélküli Peerekkel."
+    },
+    "settings.ssh.section.server": {
+        "message": "Szerver"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Képességek"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Hitelesítés"
+    },
+    "settings.ssh.server.label": {
+        "message": "SSH szerver engedélyezése"
+    },
+    "settings.ssh.server.help": {
+        "message": "Futtassa a NetBird SSH szervert ezen a gazdán, hogy más Peerek csatlakozhassanak."
+    },
+    "settings.ssh.root.label": {
+        "message": "Root bejelentkezés engedélyezése"
+    },
+    "settings.ssh.root.help": {
+        "message": "A Peerek bejelentkezhetnek root felhasználóként. Tiltsa le, ha nem privilegizált fiók szükséges."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "SFTP engedélyezése"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Fájlok biztonságos átvitele natív SFTP- vagy SCP-kliensekkel."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Helyi porttovábbítás"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "A csatlakozó Peerek helyi portokat alagútba helyezhetnek erről a gazdáról elérhető szolgáltatásokhoz."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Távoli porttovábbítás"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "A csatlakozó Peerek ezen a gazdán lévő portokat tehetnek elérhetővé a saját gépük számára."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "JWT-hitelesítés engedélyezése"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Minden SSH-munkamenet ellenőrzése az IdP-vel a felhasználói identitás és audit céljából. Tiltsa le, ha csak a hálózati ACL-szabályokra kíván támaszkodni — hasznos, ha nincs elérhető IdP."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "JWT gyorsítótár TTL"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Mennyi ideig őrzi meg a kliens a JWT-t, mielőtt újra kérné a kimenő SSH-kapcsolatoknál. 0 érték esetén a gyorsítótárazás kikapcsol, és minden kapcsolatnál hitelesít."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "másodperc"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interfész"
+    },
+    "settings.advanced.section.security": {
+        "message": "Biztonság"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Név"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Használjon 1–15 betűt, számot, pontot, kötőjelet vagy aláhúzást."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "„utun” után számmal kezdődjön (pl. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Port"
+    },
+    "settings.advanced.port.error": {
+        "message": "Adjon meg egy portot {min} és {max} között."
+    },
+    "settings.advanced.port.help": {
+        "message": "Ha 0-ra állítja, egy véletlenszerű szabad portot használ."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Adjon meg egy MTU értéket {min} és {max} között."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Pre-shared kulcs"
+    },
+    "settings.advanced.psk.help": {
+        "message": "Opcionális WireGuard PSK további szimmetrikus titkosításhoz. Nem azonos a NetBird telepítőkulccsal. Csak olyan Peerekkel kommunikál, akik ugyanazt a pre-shared kulcsot használják."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Hibakeresési csomag"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Érzékeny információk anonimizálása"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Elrejti az IP-címeket, a tartományokat és más érzékeny értékeket."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Az Alapértelmezett szint a belső IPv4-címeket és a peer-neveket olvashatóan hagyja a támogatás számára. A Szigorú ezen felül anonimizálja a privát (RFC 1918), CGNAT és link-local IP-címeket, a peer-neveket és a WireGuard nyilvános kulcsokat. Az ismétlődő értékek ugyanazt a helyettesítőt kapják, így a peerek megkülönböztethetők maradnak. Használja a Szigorú szintet, ha a hibakeresési csomagot a szervezetén kívül osztja meg."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Nincs"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Alapértelmezett"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Szigorú"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Rendszerinformációk beillesztése"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Tartalmazza az OS-t, a kernelt, a hálózati interfészeket és az útválasztási táblákat."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Csomag feltöltése a NetBird szerverekre"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Egy feltöltési kulcsot ad vissza, amelyet megoszthat a NetBird támogatással."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Trace naplók engedélyezése"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "TRACE szintre emeli a naplózást, majd utána visszaállítja."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Rögzítési munkamenet"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Újra csatlakozik és vár, hogy reprodukálhassa a problémát."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Hálózati csomagok rögzítése"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "A rögzítés ideje alatt elmenti a hálózati forgalom .pcap fájlját."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Rögzítés időtartama"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Mennyi ideig fusson a rögzítési munkamenet."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "perc"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Hibakeresési csomag létrehozása"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Naplók, rendszerinformációk és kapcsolati állapot gyűjtése folyamatban. Általában néhány pillanatot vesz igénybe — tartsa nyitva ezt az ablakot a befejezésig."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Megszakítás…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "A hibakeresési csomag feltöltése sikeres!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Csomag elmentve"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Ossza meg az alábbi feltöltési kulcsot a <docs>NetBird támogatással</docs>. A helyi másolat is elmentve van az eszközén."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "A hibakeresési csomag helyileg elmentve."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Kulcs másolása"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Mappa megnyitása"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Fájl helyének megnyitása"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Feltöltés sikertelen: {reason} A csomag továbbra is el van mentve helyileg."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Feltöltés sikertelen. A csomag továbbra is el van mentve helyileg."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "NetBird újracsatlakoztatása…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Hibakeresési naplók rögzítése"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Hibakeresési csomag generálása…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Feltöltés a NetBirdhöz…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Megszakítás…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Kliens v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Kliens"
+    },
+    "settings.about.development": {
+        "message": "[Fejlesztés]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Minden jog fenntartva."
+    },
+    "settings.about.links.imprint": {
+        "message": "Impresszum"
+    },
+    "settings.about.links.privacy": {
+        "message": "Adatvédelem"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Felhasználási feltételek"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Fórum"
+    },
+    "settings.about.community.documentation": {
+        "message": "Dokumentáció"
+    },
+    "settings.about.community.feedback": {
+        "message": "Visszajelzés"
+    },
+    "update.banner.message": {
+        "message": "A NetBird {version} telepítésre kész."
+    },
+    "update.banner.later": {
+        "message": "Később"
+    },
+    "update.banner.installNow": {
+        "message": "Telepítés most"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "A {version} verzió letöltésre elérhető."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "A {version} verzió telepítésre elérhető."
+    },
+    "update.card.whatsNew": {
+        "message": "Mi az újdonság?"
+    },
+    "update.card.installNow": {
+        "message": "Telepítés most"
+    },
+    "update.card.getInstaller": {
+        "message": "Letöltés"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "A NetBird a háttérben keres frissítéseket."
+    },
+    "update.card.changelog": {
+        "message": "Változásnapló"
+    },
+    "update.card.onLatestVersion": {
+        "message": "A legfrissebb verziót használja"
+    },
+    "update.header.tooltip": {
+        "message": "Frissítés elérhető"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "NetBird frissítése a következőre: v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "NetBird frissítése"
+    },
+    "update.overlay.description": {
+        "message": "Egy újabb verzió elérhető és települ. A NetBird automatikusan újraindul a frissítés befejeztével."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "A frissítés túl sokáig tart"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "A(z) {target} telepítése túl sokáig tartott, és nem fejeződött be."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "A frissítés megszakítva"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "A(z) {target} frissítését megszakították a befejezés előtt."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "A frissítés nem telepíthető"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "A(z) {target} nem volt telepíthető."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "ismeretlen hiba"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "az új verzió"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Frissítési állapot betöltése sikertelen"
+    },
+    "update.error.triggerTitle": {
+        "message": "Frissítés indítása sikertelen"
+    },
+    "update.page.versionLine": {
+        "message": "Kliens frissítése erre: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Kliens frissítése."
+    },
+    "update.page.outdated": {
+        "message": "Az Ön kliensverziója régebbi, mint a Managementben beállított automatikus frissítési verzió."
+    },
+    "update.page.status.running": {
+        "message": "Frissítés"
+    },
+    "update.page.status.timeout": {
+        "message": "A frissítés időtúllépés miatt megszakadt. Kérjük, próbálja újra."
+    },
+    "update.page.status.canceled": {
+        "message": "Frissítés megszakítva."
+    },
+    "update.page.status.failed": {
+        "message": "Frissítés sikertelen: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "ismeretlen frissítési hiba"
+    },
+    "update.page.failedTitle": {
+        "message": "Frissítés sikertelen"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Frissítés időtúllépés."
+    },
+    "update.page.dontClose": {
+        "message": "Kérjük, ne zárja be ezt az ablakot."
+    },
+    "update.page.updating": {
+        "message": "Frissítés…"
+    },
+    "update.page.complete": {
+        "message": "Frissítés kész"
+    },
+    "update.page.failed": {
+        "message": "Frissítés sikertelen"
+    },
+    "window.title.settings": {
+        "message": "Beállítások"
+    },
+    "window.title.signIn": {
+        "message": "Bejelentkezés"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Munkamenet lejár"
+    },
+    "window.title.updating": {
+        "message": "Frissítés"
+    },
+    "window.title.welcome": {
+        "message": "Üdvözli a NetBird"
+    },
+    "window.title.error": {
+        "message": "Hiba"
+    },
+    "welcome.title": {
+        "message": "Keresse a NetBirdöt a tálcán"
+    },
+    "welcome.titleMac": {
+        "message": "Keresse a NetBirdöt a menüsorban"
+    },
+    "welcome.description": {
+        "message": "A NetBird a tálcán fut. Kattintson az ikonra a csatlakozáshoz, profilváltáshoz vagy a beállítások megnyitásához."
+    },
+    "welcome.descriptionMac": {
+        "message": "A NetBird a menüsorban fut. Kattintson az ikonra a csatlakozáshoz, profilváltáshoz vagy a beállítások megnyitásához."
+    },
+    "welcome.continue": {
+        "message": "Folytatás"
+    },
+    "welcome.back": {
+        "message": "Vissza"
+    },
+    "welcome.management.title": {
+        "message": "NetBird beállítása"
+    },
+    "welcome.management.description": {
+        "message": "Kattintson a Folytatás gombra a kezdéshez, vagy válassza a „Saját üzemeltetésű” lehetőséget, ha saját NetBird-szervere van."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Használja az általunk üzemeltetett szolgáltatást. Nincs szükség beállításra."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Saját üzemeltetésű"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Csatlakozás a saját felügyeleti szerveréhez."
+    },
+    "welcome.management.urlLabel": {
+        "message": "Felügyeleti szerver URL"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Adjon meg egy érvényes URL-t, pl. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "A szerver nem érhető el. Ellenőrizze az URL-t vagy a hálózatot, majd folytassa, ha biztos benne, hogy helyes."
+    },
+    "welcome.management.checking": {
+        "message": "Ellenőrzés…"
+    },
+    "browserLogin.title": {
+        "message": "Folytassa a böngészőben a bejelentkezés befejezéséhez"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Nem látja a böngésző fülét?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Próbálja újra"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "A böngésző megnyitása sikertelen"
+    },
+    "sessionExpiration.title": {
+        "message": "A munkamenet hamarosan lejár"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "A munkamenete lejár"
+    },
+    "sessionExpiration.description": {
+        "message": "Az eszköz hamarosan lecsatlakozik. Megújításhoz böngészős bejelentkezés kell."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Egy böngészős bejelentkezés a hálózaton tartja az eszközt."
+    },
+    "sessionExpiration.stay": {
+        "message": "Munkamenet megújítása"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Bejelentkezés"
+    },
+    "sessionExpiration.logout": {
+        "message": "Kijelentkezés"
+    },
+    "sessionExpiration.expired": {
+        "message": "Munkamenet lejárt"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Eszköz lecsatlakozott. Hitelesítés böngészős bejelentkezéssel az újracsatlakozáshoz."
+    },
+    "sessionExpiration.close": {
+        "message": "Bezárás"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "A munkamenet meghosszabbítása sikertelen"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Kijelentkezés sikertelen"
+    },
+    "peers.search.placeholder": {
+        "message": "Keresés név vagy IP alapján"
+    },
+    "peers.filter.all": {
+        "message": "Összes"
+    },
+    "peers.filter.online": {
+        "message": "Online"
+    },
+    "peers.filter.offline": {
+        "message": "Offline"
+    },
+    "peers.empty.title": {
+        "message": "Nincs elérhető Peer"
+    },
+    "peers.empty.description": {
+        "message": "Önnek vagy nincsenek elérhető Peerei, vagy nincs hozzáférése egyikhez sem."
+    },
+    "peers.details.domain": {
+        "message": "Domain"
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird IP"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird IPv6"
+    },
+    "peers.details.publicKey": {
+        "message": "Nyilvános kulcs"
+    },
+    "peers.details.connection": {
+        "message": "Kapcsolat"
+    },
+    "peers.details.latency": {
+        "message": "Késleltetés"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Utolsó Handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Utolsó kapcsolati frissítés"
+    },
+    "peers.details.bytes": {
+        "message": "Bájtok"
+    },
+    "peers.details.bytesSent": {
+        "message": "Küldve"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Fogadva"
+    },
+    "peers.details.localIce": {
+        "message": "Helyi ICE"
+    },
+    "peers.details.remoteIce": {
+        "message": "Távoli ICE"
+    },
+    "peers.details.never": {
+        "message": "Soha"
+    },
+    "peers.details.justNow": {
+        "message": "Épp most"
+    },
+    "peers.details.refresh": {
+        "message": "Frissítés"
+    },
+    "peers.status.connected": {
+        "message": "Csatlakozva"
+    },
+    "peers.status.connecting": {
+        "message": "Csatlakozás"
+    },
+    "peers.status.disconnected": {
+        "message": "Lecsatlakozva"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay"
+    },
+    "peers.details.networks": {
+        "message": "Erőforrások"
+    },
+    "peers.details.relayed": {
+        "message": "Relayed"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass engedélyezve"
+    },
+    "networks.search.placeholder": {
+        "message": "Keresés hálózat vagy domain alapján"
+    },
+    "networks.filter.all": {
+        "message": "Összes"
+    },
+    "networks.filter.active": {
+        "message": "Aktív"
+    },
+    "networks.filter.overlapping": {
+        "message": "Átfedő"
+    },
+    "networks.empty.title": {
+        "message": "Nincs elérhető erőforrás"
+    },
+    "networks.empty.description": {
+        "message": "Önnek vagy nincsenek elérhető hálózati erőforrásai vagy nincs hozzáférése egyikhez sem."
+    },
+    "networks.selected": {
+        "message": "Kiválasztva"
+    },
+    "networks.unselected": {
+        "message": "Nincs kiválasztva"
+    },
+    "networks.ips.heading": {
+        "message": "Feloldott IP-címek"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} / {total} aktív"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Összes engedélyezése"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Összes letiltása"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Keresés az Exit Node-ok között"
+    },
+    "exitNodes.none": {
+        "message": "Egyik sem"
+    },
+    "exitNodes.empty.title": {
+        "message": "Nincs elérhető Exit Node"
+    },
+    "exitNodes.empty.description": {
+        "message": "Ehhez a Peerhez nem osztottak meg Exit Node-okat."
+    },
+    "exitNodes.card.title": {
+        "message": "Exit Node"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Aktív"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inaktív"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Egyik sem"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Közvetlen kapcsolat Exit Node nélkül"
+    },
+    "quickActions.connect": {
+        "message": "Csatlakozás"
+    },
+    "quickActions.disconnect": {
+        "message": "Bontás"
+    },
+    "daemon.unavailable.title": {
+        "message": "A NetBird szolgáltatás nem fut"
+    },
+    "daemon.unavailable.description": {
+        "message": "Az alkalmazás automatikusan újracsatlakozik, amint a szolgáltatás újra elérhető."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Dokumentáció"
+    },
+    "daemon.outdated.title": {
+        "message": "A NetBird Kliens elavult"
+    },
+    "daemon.outdated.description": {
+        "message": "Az új GUI nem kompatibilis a régebbi klienseddel. Frissítsd a klienst az új alkalmazás használatához."
+    },
+    "daemon.outdated.download": {
+        "message": "Legújabb letöltése"
+    },
+    "error.jwt_clock_skew": {
+        "message": "A bejelentkezés sikertelen: az eszköz órája eltér a szerverétől. Kérjük, szinkronizálja a rendszer óráját, majd próbálja újra."
+    },
+    "error.jwt_expired": {
+        "message": "A bejelentkezési token lejárt. Kérjük, jelentkezzen be újra."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "A bejelentkezés sikertelen: a token aláírása érvénytelen. Kérjük, lépjen kapcsolatba a rendszergazdával."
+    },
+    "error.session_expired": {
+        "message": "A munkamenet lejárt. Kérjük, jelentkezzen be újra."
+    },
+    "error.invalid_setup_key": {
+        "message": "A telepítőkulcs hiányzik vagy érvénytelen."
+    },
+    "error.permission_denied": {
+        "message": "A szerver elutasította a bejelentkezést."
+    },
+    "error.daemon_unreachable": {
+        "message": "A NetBird szolgáltatás nem válaszol. Kérjük, ellenőrizze, hogy fut-e a szolgáltatás."
+    },
+    "error.settings_locked": {
+        "message": "A beállítások ezen az eszközön nem módosíthatók: egy rendszergazda zárolta őket."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Ezt a beállítást a szervezete kezeli, ezért nem módosítható."
+    },
+    "error.unknown": {
+        "message": "A művelet meghiúsult."
+    },
+    "error.elevation_unavailable": {
+        "message": "A NetBird nem tudta bekérni a rendszertől a szükséges jogosultságokat. Futtassa inkább ezt:"
+    },
+    "error.elevation_failed": {
+        "message": "A módosítást emelt szintű jogosultságokkal sem sikerült alkalmazni. Futtassa inkább ezt:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root jogosultság"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "rendszergazdai jogosultság"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "{actor} szükséges hozzá. Futtassa inkább ezt:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Kikapcsolhatja, de a visszakapcsolásához {actor} szükséges."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Bekapcsolhatja, de az ismételt kikapcsolásához {actor} szükséges."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Várakozás az engedélyezésre…"
+    }
+}
diff --git a/client/ui/i18n/locales/it/common.json b/client/ui/i18n/locales/it/common.json
new file mode 100644
index 000000000..6590a01fe
--- /dev/null
+++ b/client/ui/i18n/locales/it/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Disconnesso"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Non in esecuzione"
+    },
+    "tray.status.error": {
+        "message": "Errore"
+    },
+    "tray.status.connected": {
+        "message": "Connesso"
+    },
+    "tray.status.connecting": {
+        "message": "Connessione"
+    },
+    "tray.status.needsLogin": {
+        "message": "Accesso richiesto"
+    },
+    "tray.status.loginFailed": {
+        "message": "Accesso non riuscito"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sessione scaduta"
+    },
+    "tray.session.expiresIn": {
+        "message": "La sessione scade tra {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "meno di un minuto"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minuto"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minuti"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 ora"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} ore"
+    },
+    "tray.session.unit.day": {
+        "message": "1 giorno"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} giorni"
+    },
+    "tray.menu.open": {
+        "message": "Apri NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Connetti"
+    },
+    "tray.menu.disconnect": {
+        "message": "Disconnetti"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nodo di uscita"
+    },
+    "tray.menu.networks": {
+        "message": "Risorse"
+    },
+    "tray.menu.profiles": {
+        "message": "Profili"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Gestisci profili"
+    },
+    "tray.menu.settings": {
+        "message": "Impostazioni..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Crea pacchetto di debug"
+    },
+    "tray.menu.about": {
+        "message": "Guida e supporto"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentazione"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Risoluzione dei problemi"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Scarica l'ultima versione"
+    },
+    "tray.menu.installVersion": {
+        "message": "Installa la versione {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Esci da NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "Il servizio NetBird è obsoleto"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Aggiorna il servizio NetBird per usare questa app."
+    },
+    "notify.update.title": {
+        "message": "Aggiornamento NetBird disponibile"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} è disponibile."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " L'amministratore richiede questo aggiornamento."
+    },
+    "notify.error.title": {
+        "message": "Errore"
+    },
+    "notify.error.connect": {
+        "message": "Connessione non riuscita"
+    },
+    "notify.error.disconnect": {
+        "message": "Disconnessione non riuscita"
+    },
+    "notify.error.switchProfile": {
+        "message": "Impossibile passare a {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Impossibile aggiornare il nodo di uscita {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Sessione NetBird scaduta"
+    },
+    "notify.sessionExpired.body": {
+        "message": "La sessione NetBird è scaduta. Effettui di nuovo l'accesso."
+    },
+    "notify.sessionWarning.title": {
+        "message": "La sessione sta per scadere"
+    },
+    "notify.sessionWarning.body": {
+        "message": "La sessione NetBird scade tra {remaining}. Clicchi su Rinnova ora per rinnovarla."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "La sessione NetBird sta per scadere. Clicchi su Rinnova ora per rinnovarla."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Rinnova ora"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Ignora"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Impossibile rinnovare la sessione NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Sessione NetBird rinnovata"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "La sessione è stata rinnovata."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Scadenza sessione rifiutata"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "Il server ha inviato una scadenza di sessione non valida. Effettui di nuovo l'accesso."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Impostazioni NetBird aggiornate"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "La configurazione di NetBird è stata aggiornata dalla policy IT."
+    },
+    "common.cancel": {
+        "message": "Annulla"
+    },
+    "common.save": {
+        "message": "Salva"
+    },
+    "common.saveChanges": {
+        "message": "Salva modifiche"
+    },
+    "common.saving": {
+        "message": "Salvataggio…"
+    },
+    "common.close": {
+        "message": "Chiudi"
+    },
+    "common.copy": {
+        "message": "Copia"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Mostra/nascondi password"
+    },
+    "common.increase": {
+        "message": "Aumenta"
+    },
+    "common.decrease": {
+        "message": "Diminuisci"
+    },
+    "common.delete": {
+        "message": "Elimina"
+    },
+    "common.create": {
+        "message": "Crea"
+    },
+    "common.add": {
+        "message": "Aggiungi"
+    },
+    "common.remove": {
+        "message": "Rimuovi"
+    },
+    "common.refresh": {
+        "message": "Aggiorna"
+    },
+    "common.loading": {
+        "message": "Caricamento…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Nessun risultato trovato"
+    },
+    "common.noResults.description": {
+        "message": "Non è stato trovato alcun risultato. Provi un altro termine di ricerca o modifichi i filtri."
+    },
+    "notConnected.title": {
+        "message": "Disconnesso"
+    },
+    "notConnected.description": {
+        "message": "Si connetta prima a NetBird per visualizzare informazioni dettagliate su peer, risorse di rete e nodi di uscita."
+    },
+    "connect.status.disconnected": {
+        "message": "Disconnesso"
+    },
+    "connect.status.connecting": {
+        "message": "Connessione..."
+    },
+    "connect.status.connected": {
+        "message": "Connesso"
+    },
+    "connect.status.disconnecting": {
+        "message": "Disconnessione..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon non disponibile"
+    },
+    "connect.status.loginRequired": {
+        "message": "Accesso richiesto"
+    },
+    "connect.error.loginTitle": {
+        "message": "Accesso non riuscito"
+    },
+    "connect.error.connectTitle": {
+        "message": "Connessione non riuscita"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Disconnessione non riuscita"
+    },
+    "nav.peers.title": {
+        "message": "Peer"
+    },
+    "nav.peers.description": {
+        "message": "{connected} di {total} connessi"
+    },
+    "nav.resources.title": {
+        "message": "Risorse"
+    },
+    "nav.resources.description": {
+        "message": "{active} di {total} attive"
+    },
+    "nav.exitNode.title": {
+        "message": "Nodi di uscita"
+    },
+    "nav.exitNode.none": {
+        "message": "Non attivo"
+    },
+    "nav.exitNode.using": {
+        "message": "Tramite {name}"
+    },
+    "header.openSettings": {
+        "message": "Apri impostazioni"
+    },
+    "header.togglePanel": {
+        "message": "Mostra/nascondi pannello laterale"
+    },
+    "profile.selector.loading": {
+        "message": "Caricamento..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Nessun profilo"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Cerca profilo per nome..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Nessun profilo trovato"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Provi un altro termine di ricerca o crei un nuovo profilo."
+    },
+    "profile.selector.newProfile": {
+        "message": "Nuovo profilo"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Altre opzioni"
+    },
+    "profile.selector.deregister": {
+        "message": "Annulla registrazione"
+    },
+    "profile.selector.delete": {
+        "message": "Elimina"
+    },
+    "profile.selector.switchTo": {
+        "message": "Passa a questo profilo"
+    },
+    "profile.selector.edit": {
+        "message": "Modifica"
+    },
+    "profile.edit.title": {
+        "message": "Modifica profilo"
+    },
+    "profile.edit.submit": {
+        "message": "Salva modifiche"
+    },
+    "profile.dialog.title": {
+        "message": "Inserisci il nome del profilo"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nome del profilo"
+    },
+    "profile.dialog.description": {
+        "message": "Imposti un nome facilmente riconoscibile per il profilo."
+    },
+    "profile.dialog.placeholder": {
+        "message": "es. lavoro"
+    },
+    "profile.dialog.submit": {
+        "message": "Aggiungi profilo"
+    },
+    "profile.dialog.required": {
+        "message": "Inserisca un nome per il profilo, es. lavoro, casa"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Usi NetBird Cloud o il suo server."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Impossibile raggiungere questo server. Controlli l'URL, oppure aggiunga comunque il profilo se è certo che sia corretto."
+    },
+    "header.menu.settings": {
+        "message": "Impostazioni..."
+    },
+    "header.menu.defaultView": {
+        "message": "Vista predefinita"
+    },
+    "header.menu.advancedView": {
+        "message": "Vista avanzata"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Aggiornamento disponibile"
+    },
+    "header.menu.open": {
+        "message": "Apri menu"
+    },
+    "header.profile.switch": {
+        "message": "Cambia profilo"
+    },
+    "connect.toggle.label": {
+        "message": "Attiva/disattiva connessione NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Indirizzi IP locali"
+    },
+    "common.search": {
+        "message": "Cerca"
+    },
+    "common.filter": {
+        "message": "Filtra"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Seleziona nodo di uscita"
+    },
+    "peers.row.label": {
+        "message": "Apri dettagli di {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Dettagli peer"
+    },
+    "networks.row.toggle": {
+        "message": "Attiva/disattiva {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Attiva/disattiva tutte le risorse visibili"
+    },
+    "profile.switch.title": {
+        "message": "Passare al profilo «{name}»?"
+    },
+    "profile.switch.message": {
+        "message": "Vuole davvero cambiare profilo?\nIl profilo attuale verrà disconnesso."
+    },
+    "profile.switch.confirm": {
+        "message": "Conferma"
+    },
+    "profile.deregister.title": {
+        "message": "Annullare la registrazione del profilo «{name}»?"
+    },
+    "profile.deregister.message": {
+        "message": "Vuole davvero annullare la registrazione di questo profilo?\nDovrà accedere di nuovo per usarlo."
+    },
+    "profile.deregister.confirm": {
+        "message": "Annulla registrazione"
+    },
+    "profile.delete.title": {
+        "message": "Eliminare il profilo «{name}»?"
+    },
+    "profile.delete.message": {
+        "message": "Vuole davvero eliminare questo profilo?\nQuesta azione non può essere annullata."
+    },
+    "profile.delete.disabledActive": {
+        "message": "I profili attivi non possono essere eliminati. Passi a un altro profilo prima di eliminare questo."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Il profilo predefinito non può essere eliminato."
+    },
+    "profile.error.switchTitle": {
+        "message": "Cambio profilo non riuscito"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Annullamento registrazione non riuscito"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Eliminazione profilo non riuscita"
+    },
+    "profile.error.createTitle": {
+        "message": "Creazione profilo non riuscita"
+    },
+    "profile.error.editTitle": {
+        "message": "Modifica del profilo non riuscita"
+    },
+    "profile.error.loadTitle": {
+        "message": "Caricamento profili non riuscito"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Profilo attivo"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Cambia profilo"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Altro"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Aggiungi profilo"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Gestisci profili"
+    },
+    "profile.dropdown.settings": {
+        "message": "Impostazioni"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Profili"
+    },
+    "settings.profiles.intro": {
+        "message": "Mantenga affiancate identità NetBird separate, ad esempio account di lavoro e personali, oppure server di gestione diversi. Aggiunga, annulli la registrazione o elimini i profili qui sotto."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Aggiungi profilo"
+    },
+    "settings.profiles.active": {
+        "message": "Attivo"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Nessun profilo"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Crei un profilo per connettersi a un server di gestione NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Caricamento impostazioni non riuscito"
+    },
+    "settings.error.saveTitle": {
+        "message": "Salvataggio impostazioni non riuscito"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Pacchetto di debug non riuscito"
+    },
+    "settings.nav.label": {
+        "message": "Sezioni delle impostazioni"
+    },
+    "settings.tabs.general": {
+        "message": "Generale"
+    },
+    "settings.tabs.network": {
+        "message": "Rete"
+    },
+    "settings.tabs.security": {
+        "message": "Sicurezza"
+    },
+    "settings.tabs.profiles": {
+        "message": "Profili"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avanzate"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Risoluzione problemi"
+    },
+    "settings.tabs.about": {
+        "message": "Informazioni"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Aggiornamento disponibile"
+    },
+    "settings.general.section.general": {
+        "message": "Generale"
+    },
+    "settings.general.section.connection": {
+        "message": "Connessione"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Connetti all'avvio"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Stabilisce automaticamente una connessione all'avvio del servizio."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notifiche desktop"
+    },
+    "settings.general.notifications.help": {
+        "message": "Mostra notifiche desktop per nuovi aggiornamenti ed eventi di connessione."
+    },
+    "settings.general.autostart.label": {
+        "message": "Avvia l'interfaccia NetBird all'accesso"
+    },
+    "settings.general.autostart.help": {
+        "message": "Avvia automaticamente l'interfaccia NetBird quando effettua l'accesso. Riguarda solo l'interfaccia grafica, non il servizio in background."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Modifica avvio automatico non riuscita"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Resta connesso dopo la chiusura"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "La connessione resta attiva in background dopo la chiusura di NetBird. Si interrompe solo quando la disconnetti tu."
+    },
+    "settings.general.language.label": {
+        "message": "Lingua dell'interfaccia"
+    },
+    "settings.general.language.help": {
+        "message": "Scelga la lingua dell'interfaccia NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Cerca lingua…"
+    },
+    "settings.general.language.empty": {
+        "message": "Nessuna lingua corrisponde."
+    },
+    "settings.general.theme.label": {
+        "message": "Tema"
+    },
+    "settings.general.theme.help": {
+        "message": "Scelga il tema chiaro o scuro, oppure segua l'aspetto del sistema."
+    },
+    "settings.general.theme.system": {
+        "message": "Sistema"
+    },
+    "settings.general.theme.light": {
+        "message": "Chiaro"
+    },
+    "settings.general.theme.dark": {
+        "message": "Scuro"
+    },
+    "settings.general.management.label": {
+        "message": "Server di gestione"
+    },
+    "settings.general.management.help": {
+        "message": "Si connetta a NetBird Cloud o al suo server di gestione self-hosted. Le modifiche riconnettono il client."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Self-hosted"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Inserisca un URL valido, es. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Impossibile raggiungere questo server. Controlli l'URL, oppure salvi comunque se è certo che sia corretto."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Passare a NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Questo disconnette il suo server self-hosted.\nPotrebbe dover accedere di nuovo."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Passa a Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Connettività"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Routing e DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Riconnetti al cambio di rete"
+    },
+    "settings.network.monitor.help": {
+        "message": "Monitora la rete e si riconnette automaticamente ai cambiamenti, come il passaggio di Wi-Fi, le modifiche Ethernet o la ripresa dalla sospensione."
+    },
+    "settings.network.dns.label": {
+        "message": "Abilita DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Applica le impostazioni DNS gestite da NetBird al resolver dell'host."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Abilita route client"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Accetta le route da altri peer per raggiungere le loro reti."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Abilita route server"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Annuncia le route locali di questo host agli altri peer."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Abilita IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Usa l'indirizzamento IPv6 per la rete overlay NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Firewall"
+    },
+    "settings.security.section.encryption": {
+        "message": "Crittografia"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Blocca traffico in entrata"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rifiuta le connessioni non richieste dai peer verso questo dispositivo e le reti che instrada. Il traffico in uscita non è interessato."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Blocca accesso alla LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Impedisce ai peer di raggiungere la sua rete locale o i suoi dispositivi quando questo dispositivo instrada il loro traffico."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Abilita resistenza quantistica"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Aggiunge uno scambio di chiavi post-quantistico tramite Rosenpass sopra WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Abilita modalità permissiva"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Consente le connessioni con peer privi del supporto alla resistenza quantistica."
+    },
+    "settings.ssh.section.server": {
+        "message": "Server"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Funzionalità"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Autenticazione"
+    },
+    "settings.ssh.server.label": {
+        "message": "Abilita server SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Esegue il server SSH di NetBird su questo host in modo che altri peer possano connettersi."
+    },
+    "settings.ssh.root.label": {
+        "message": "Consenti accesso come root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permette ai peer di accedere come utente root. Disabiliti per richiedere un account senza privilegi."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Consenti SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Trasferisca file in modo sicuro usando client SFTP o SCP nativi."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Inoltro porte locale"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permette ai peer in connessione di inoltrare porte locali verso servizi raggiungibili da questo host."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Inoltro porte remoto"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permette ai peer in connessione di esporre porte di questo host verso la loro macchina."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Abilita autenticazione JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verifica ogni sessione SSH con il suo IdP per l'identità utente e l'audit. Disabiliti per basarsi solo sulle policy ACL di rete, utile quando non è disponibile un IdP."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL cache JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Per quanto tempo questo client memorizza un JWT prima di richiederlo di nuovo sulle connessioni SSH in uscita. Imposti 0 per disabilitare la cache e autenticarsi a ogni connessione."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "sec."
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interfaccia"
+    },
+    "settings.advanced.section.security": {
+        "message": "Sicurezza"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nome"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Usi da 1 a 15 lettere, cifre, punti, trattini o trattini bassi."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Deve iniziare con \"utun\" seguito da un numero (es. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Porta"
+    },
+    "settings.advanced.port.error": {
+        "message": "Inserisca una porta compresa tra {min} e {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Se impostata su 0, verrà usata una porta libera casuale."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Inserisca un valore MTU compreso tra {min} e {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Chiave pre-condivisa"
+    },
+    "settings.advanced.psk.help": {
+        "message": "PSK WireGuard opzionale per una crittografia simmetrica aggiuntiva. Non è la stessa cosa di una chiave di configurazione NetBird. Comunicherà solo con i peer che usano la stessa chiave pre-condivisa."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Pacchetto di debug"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonimizza informazioni sensibili"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Nasconde indirizzi IP, domini e altri valori sensibili."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "La modalità predefinita mantiene leggibili gli indirizzi IPv4 interni e i nomi dei peer per il supporto. La modalità rigorosa anonimizza inoltre gli indirizzi IP privati (RFC 1918), CGNAT e link-local, i nomi dei peer e le chiavi pubbliche WireGuard. I valori ricorrenti vengono associati allo stesso segnaposto, quindi i peer restano distinguibili. Usa la modalità rigorosa quando condividi il pacchetto di debug al di fuori della tua organizzazione."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Nessuna"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Predefinito"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Rigoroso"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Includi informazioni di sistema"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Include OS, kernel, interfacce di rete e tabelle di routing."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Carica il pacchetto sui server NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Restituisce una chiave di caricamento da condividere con il supporto NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Abilita log di traccia"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Aumenta il livello di log a TRACE e lo ripristina al termine."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Sessione di acquisizione"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Si riconnette e attende per consentirle di riprodurre il problema."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Acquisisci pacchetti di rete"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Salva un .pcap del traffico di rete durante la sessione di acquisizione."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Durata acquisizione"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Per quanto tempo viene eseguita la sessione di acquisizione."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "min."
+    },
+    "settings.troubleshooting.create": {
+        "message": "Crea pacchetto"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Raccolta di log, dettagli di sistema e stato della connessione. Di solito richiede un momento: tenga aperta questa finestra fino al completamento."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Annullamento…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Pacchetto di debug caricato con successo!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Pacchetto salvato"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Condivida la chiave di caricamento qui sotto con il <docs>supporto NetBird</docs>. Una copia locale è stata salvata anche sul suo dispositivo."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Il pacchetto di debug è stato salvato localmente."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copia chiave"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Apri cartella"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Apri posizione file"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Caricamento non riuscito: {reason} Il pacchetto è comunque salvato localmente."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Caricamento non riuscito. Il pacchetto è comunque salvato localmente."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Riconnessione di NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Acquisizione log di debug"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Generazione del pacchetto di debug…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Caricamento su NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Annullamento…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client"
+    },
+    "settings.about.development": {
+        "message": "[Development]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Tutti i diritti riservati."
+    },
+    "settings.about.links.imprint": {
+        "message": "Note legali"
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacy"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Termini di servizio"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Forum"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentazione"
+    },
+    "settings.about.community.feedback": {
+        "message": "Feedback"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} è pronto per l'installazione."
+    },
+    "update.banner.later": {
+        "message": "Più tardi"
+    },
+    "update.banner.installNow": {
+        "message": "Installa ora"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "La versione {version} è disponibile per il download."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "La versione {version} è disponibile per l'installazione."
+    },
+    "update.card.whatsNew": {
+        "message": "Novità?"
+    },
+    "update.card.installNow": {
+        "message": "Installa ora"
+    },
+    "update.card.getInstaller": {
+        "message": "Scarica"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird verifica gli aggiornamenti in background."
+    },
+    "update.card.changelog": {
+        "message": "Changelog"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Sta usando l'ultima versione"
+    },
+    "update.header.tooltip": {
+        "message": "Aggiornamento disponibile"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Aggiornamento di NetBird alla v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Aggiornamento di NetBird"
+    },
+    "update.overlay.description": {
+        "message": "È disponibile una versione più recente ed è in corso l'installazione. NetBird si riavvierà automaticamente al termine dell'aggiornamento."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "L'aggiornamento richiede troppo tempo"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "L'installazione di {target} ha richiesto troppo tempo e non è stata completata."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Aggiornamento interrotto"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "L'aggiornamento a {target} è stato annullato prima del completamento."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Impossibile installare l'aggiornamento"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Impossibile installare {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "errore sconosciuto"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "la nuova versione"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Caricamento stato aggiornamento non riuscito"
+    },
+    "update.error.triggerTitle": {
+        "message": "Avvio aggiornamento non riuscito"
+    },
+    "update.page.versionLine": {
+        "message": "Aggiornamento del client a: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Aggiornamento del client."
+    },
+    "update.page.outdated": {
+        "message": "La versione del client è precedente alla versione di aggiornamento automatico impostata in Management."
+    },
+    "update.page.status.running": {
+        "message": "Aggiornamento in corso"
+    },
+    "update.page.status.timeout": {
+        "message": "Aggiornamento scaduto. Riprovi."
+    },
+    "update.page.status.canceled": {
+        "message": "Aggiornamento annullato."
+    },
+    "update.page.status.failed": {
+        "message": "Aggiornamento non riuscito: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "errore di aggiornamento sconosciuto"
+    },
+    "update.page.failedTitle": {
+        "message": "Aggiornamento non riuscito"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Aggiornamento scaduto."
+    },
+    "update.page.dontClose": {
+        "message": "Non chiuda questa finestra."
+    },
+    "update.page.updating": {
+        "message": "Aggiornamento…"
+    },
+    "update.page.complete": {
+        "message": "Aggiornamento completato"
+    },
+    "update.page.failed": {
+        "message": "Aggiornamento non riuscito"
+    },
+    "window.title.settings": {
+        "message": "Impostazioni"
+    },
+    "window.title.signIn": {
+        "message": "Accesso"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sessione in scadenza"
+    },
+    "window.title.updating": {
+        "message": "Aggiornamento"
+    },
+    "window.title.welcome": {
+        "message": "Benvenuto in NetBird"
+    },
+    "window.title.error": {
+        "message": "Errore"
+    },
+    "welcome.title": {
+        "message": "Cerchi NetBird nella tray"
+    },
+    "welcome.titleMac": {
+        "message": "Cerchi NetBird nella barra dei menu"
+    },
+    "welcome.description": {
+        "message": "NetBird risiede nella tray. Clicchi sull'icona per connettersi, cambiare profilo o aprire le impostazioni."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird risiede nella barra dei menu. Clicchi sull'icona per connettersi, cambiare profilo o aprire le impostazioni."
+    },
+    "welcome.continue": {
+        "message": "Continua"
+    },
+    "welcome.back": {
+        "message": "Indietro"
+    },
+    "welcome.management.title": {
+        "message": "Configura NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Clicchi su Continua per iniziare, oppure scelga Self-hosted se dispone di un proprio server NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Usi il nostro servizio gestito. Nessuna configurazione necessaria."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Self-hosted"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Si connetta al suo server di gestione."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL del server di gestione"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Inserisca un URL valido, es. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Impossibile raggiungere questo server. Controlli l'URL o la sua rete, poi prosegua se è certo che sia corretto."
+    },
+    "welcome.management.checking": {
+        "message": "Verifica…"
+    },
+    "browserLogin.title": {
+        "message": "Continui nel browser per completare l'accesso"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Non vede la scheda del browser?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Riprova"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Apertura browser non riuscita"
+    },
+    "sessionExpiration.title": {
+        "message": "La sessione sta per scadere"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "La sessione scadrà"
+    },
+    "sessionExpiration.description": {
+        "message": "Questo dispositivo verrà disconnesso a breve. Rinnovi con un accesso dal browser."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Un accesso dal browser mantiene questo dispositivo connesso alla sua rete."
+    },
+    "sessionExpiration.stay": {
+        "message": "Rinnova sessione"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Autenticati"
+    },
+    "sessionExpiration.logout": {
+        "message": "Esci"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sessione scaduta"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Dispositivo disconnesso. Si autentichi con un accesso dal browser per riconnettersi."
+    },
+    "sessionExpiration.close": {
+        "message": "Chiudi"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Rinnovo sessione non riuscito"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Disconnessione non riuscita"
+    },
+    "peers.search.placeholder": {
+        "message": "Cerca per nome o IP"
+    },
+    "peers.filter.all": {
+        "message": "Tutti"
+    },
+    "peers.filter.online": {
+        "message": "Online"
+    },
+    "peers.filter.offline": {
+        "message": "Offline"
+    },
+    "peers.empty.title": {
+        "message": "Nessun peer disponibile"
+    },
+    "peers.empty.description": {
+        "message": "Non ha peer disponibili oppure non ha accesso a nessuno di essi."
+    },
+    "peers.details.domain": {
+        "message": "Dominio"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Chiave pubblica"
+    },
+    "peers.details.connection": {
+        "message": "Connessione"
+    },
+    "peers.details.latency": {
+        "message": "Latenza"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Ultimo handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Ultimo aggiornamento connessione"
+    },
+    "peers.details.bytes": {
+        "message": "Byte"
+    },
+    "peers.details.bytesSent": {
+        "message": "Inviati"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Ricevuti"
+    },
+    "peers.details.localIce": {
+        "message": "ICE locale"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE remoto"
+    },
+    "peers.details.never": {
+        "message": "Mai"
+    },
+    "peers.details.justNow": {
+        "message": "Proprio ora"
+    },
+    "peers.details.refresh": {
+        "message": "Aggiorna"
+    },
+    "peers.status.connected": {
+        "message": "Connesso"
+    },
+    "peers.status.connecting": {
+        "message": "Connessione"
+    },
+    "peers.status.disconnected": {
+        "message": "Disconnesso"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay"
+    },
+    "peers.details.networks": {
+        "message": "Risorse"
+    },
+    "peers.details.relayed": {
+        "message": "Tramite relay"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass abilitato"
+    },
+    "networks.search.placeholder": {
+        "message": "Cerca per rete o dominio"
+    },
+    "networks.filter.all": {
+        "message": "Tutte"
+    },
+    "networks.filter.active": {
+        "message": "Attive"
+    },
+    "networks.filter.overlapping": {
+        "message": "Sovrapposte"
+    },
+    "networks.empty.title": {
+        "message": "Nessuna risorsa disponibile"
+    },
+    "networks.empty.description": {
+        "message": "Non ha risorse di rete disponibili oppure non ha accesso a nessuna di esse."
+    },
+    "networks.selected": {
+        "message": "Selezionata"
+    },
+    "networks.unselected": {
+        "message": "Non selezionata"
+    },
+    "networks.ips.heading": {
+        "message": "IP risolti"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} di {total} attive"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Abilita tutte"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Disabilita tutte"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Cerca nodi di uscita"
+    },
+    "exitNodes.none": {
+        "message": "Nessuno"
+    },
+    "exitNodes.empty.title": {
+        "message": "Nessun nodo di uscita disponibile"
+    },
+    "exitNodes.empty.description": {
+        "message": "Nessun nodo di uscita è stato condiviso con questo peer."
+    },
+    "exitNodes.card.title": {
+        "message": "Nodo di uscita"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Attivo"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inattivo"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Nessuno"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Connessione diretta senza nodo di uscita"
+    },
+    "quickActions.connect": {
+        "message": "Connetti"
+    },
+    "quickActions.disconnect": {
+        "message": "Disconnetti"
+    },
+    "daemon.unavailable.title": {
+        "message": "Il servizio NetBird non è in esecuzione"
+    },
+    "daemon.unavailable.description": {
+        "message": "L'app si riconnetterà automaticamente non appena il servizio sarà in esecuzione."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentazione"
+    },
+    "daemon.outdated.title": {
+        "message": "NetBird Client è obsoleto"
+    },
+    "daemon.outdated.description": {
+        "message": "La nuova GUI non è compatibile con il tuo client precedente. Aggiorna il client per usare la nuova applicazione."
+    },
+    "daemon.outdated.download": {
+        "message": "Scarica l'ultima versione"
+    },
+    "error.jwt_clock_skew": {
+        "message": "Accesso non riuscito: l'orologio di questo dispositivo non è sincronizzato con il server. Sincronizzi l'orologio di sistema e riprovi."
+    },
+    "error.jwt_expired": {
+        "message": "Il token di accesso è scaduto. Effettui di nuovo l'accesso."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Accesso non riuscito: la firma del token non è valida. Contatti il suo amministratore."
+    },
+    "error.session_expired": {
+        "message": "La sessione è scaduta. Effettui di nuovo l'accesso."
+    },
+    "error.invalid_setup_key": {
+        "message": "La chiave di configurazione è mancante o non valida."
+    },
+    "error.permission_denied": {
+        "message": "L'accesso è stato rifiutato dal server."
+    },
+    "error.daemon_unreachable": {
+        "message": "Il daemon NetBird non risponde. Verifichi che il servizio sia in esecuzione."
+    },
+    "error.settings_locked": {
+        "message": "Le impostazioni non possono essere modificate su questo dispositivo: un amministratore le ha bloccate."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Questa impostazione è gestita dalla sua organizzazione e non può essere modificata."
+    },
+    "error.unknown": {
+        "message": "Operazione non riuscita."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird non ha potuto richiedere a questo sistema i privilegi necessari. Esegua invece questo:"
+    },
+    "error.elevation_failed": {
+        "message": "Non è stato possibile applicare la modifica con privilegi elevati. Esegua invece questo:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "i privilegi di root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "i privilegi di amministratore"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Richiede {actor}. Esegua invece questo:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Può disabilitarlo, ma riabilitarlo richiede {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Può abilitarlo, ma disabilitarlo di nuovo richiede {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "In attesa dell'autorizzazione…"
+    }
+}
diff --git a/client/ui/i18n/locales/ja/common.json b/client/ui/i18n/locales/ja/common.json
new file mode 100644
index 000000000..c8918e4ae
--- /dev/null
+++ b/client/ui/i18n/locales/ja/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "未接続"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "実行されていません"
+    },
+    "tray.status.error": {
+        "message": "エラー"
+    },
+    "tray.status.connected": {
+        "message": "接続済み"
+    },
+    "tray.status.connecting": {
+        "message": "接続中"
+    },
+    "tray.status.needsLogin": {
+        "message": "ログインが必要"
+    },
+    "tray.status.loginFailed": {
+        "message": "ログインに失敗しました"
+    },
+    "tray.status.sessionExpired": {
+        "message": "セッションが期限切れ"
+    },
+    "tray.session.expiresIn": {
+        "message": "セッションはあと{remaining}で期限切れ"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "1分未満"
+    },
+    "tray.session.unit.minute": {
+        "message": "1分"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count}分"
+    },
+    "tray.session.unit.hour": {
+        "message": "1時間"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count}時間"
+    },
+    "tray.session.unit.day": {
+        "message": "1日"
+    },
+    "tray.session.unit.days": {
+        "message": "{count}日"
+    },
+    "tray.menu.open": {
+        "message": "NetBird を開く"
+    },
+    "tray.menu.connect": {
+        "message": "接続"
+    },
+    "tray.menu.disconnect": {
+        "message": "切断"
+    },
+    "tray.menu.exitNode": {
+        "message": "出口ノード"
+    },
+    "tray.menu.networks": {
+        "message": "リソース"
+    },
+    "tray.menu.profiles": {
+        "message": "プロファイル"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "プロファイルの管理"
+    },
+    "tray.menu.settings": {
+        "message": "設定..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "デバッグバンドルを作成"
+    },
+    "tray.menu.about": {
+        "message": "ヘルプとサポート"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "ドキュメント"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "トラブルシューティング"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "最新バージョンをダウンロード"
+    },
+    "tray.menu.installVersion": {
+        "message": "バージョン {version} をインストール"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "デーモン: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "NetBird を終了"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "NetBird サービスが古くなっています"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "このアプリを使用するには NetBird サービスを更新してください。"
+    },
+    "notify.update.title": {
+        "message": "NetBird の更新が利用可能"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} が利用可能です。"
+    },
+    "notify.update.enforcedSuffix": {
+        "message": "管理者がこの更新を必須にしています。"
+    },
+    "notify.error.title": {
+        "message": "エラー"
+    },
+    "notify.error.connect": {
+        "message": "接続に失敗しました"
+    },
+    "notify.error.disconnect": {
+        "message": "切断に失敗しました"
+    },
+    "notify.error.switchProfile": {
+        "message": "{profile} への切り替えに失敗しました"
+    },
+    "notify.error.exitNode": {
+        "message": "出口ノード {name} の更新に失敗しました"
+    },
+    "notify.sessionExpired.title": {
+        "message": "NetBird セッションが期限切れ"
+    },
+    "notify.sessionExpired.body": {
+        "message": "NetBird セッションの有効期限が切れました。もう一度ログインしてください。"
+    },
+    "notify.sessionWarning.title": {
+        "message": "まもなくセッションが期限切れ"
+    },
+    "notify.sessionWarning.body": {
+        "message": "NetBird セッションはあと{remaining}で期限切れになります。更新するには「今すぐ延長」をクリックしてください。"
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "NetBird セッションはまもなく期限切れになります。更新するには「今すぐ延長」をクリックしてください。"
+    },
+    "notify.sessionWarning.extend": {
+        "message": "今すぐ延長"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "閉じる"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "NetBird セッションの延長に失敗しました"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "NetBird セッションを延長しました"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "セッションが更新されました。"
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "セッション期限が拒否されました"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "サーバーが無効なセッション期限を送信しました。もう一度サインインしてください。"
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird 設定が更新されました"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "NetBird の構成が IT ポリシーによって更新されました。"
+    },
+    "common.cancel": {
+        "message": "キャンセル"
+    },
+    "common.save": {
+        "message": "保存"
+    },
+    "common.saveChanges": {
+        "message": "変更を保存"
+    },
+    "common.saving": {
+        "message": "保存中…"
+    },
+    "common.close": {
+        "message": "閉じる"
+    },
+    "common.copy": {
+        "message": "コピー"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "パスワードの表示を切り替え"
+    },
+    "common.increase": {
+        "message": "増やす"
+    },
+    "common.decrease": {
+        "message": "減らす"
+    },
+    "common.delete": {
+        "message": "削除"
+    },
+    "common.create": {
+        "message": "作成"
+    },
+    "common.add": {
+        "message": "追加"
+    },
+    "common.remove": {
+        "message": "削除"
+    },
+    "common.refresh": {
+        "message": "更新"
+    },
+    "common.loading": {
+        "message": "読み込み中…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "結果が見つかりませんでした"
+    },
+    "common.noResults.description": {
+        "message": "結果が見つかりませんでした。別の検索語を試すか、フィルターを変更してください。"
+    },
+    "notConnected.title": {
+        "message": "未接続"
+    },
+    "notConnected.description": {
+        "message": "ピア、ネットワークリソース、出口ノードの詳細情報を表示するには、まず NetBird に接続してください。"
+    },
+    "connect.status.disconnected": {
+        "message": "未接続"
+    },
+    "connect.status.connecting": {
+        "message": "接続中..."
+    },
+    "connect.status.connected": {
+        "message": "接続済み"
+    },
+    "connect.status.disconnecting": {
+        "message": "切断中..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "デーモンが利用できません"
+    },
+    "connect.status.loginRequired": {
+        "message": "ログインが必要"
+    },
+    "connect.error.loginTitle": {
+        "message": "ログインに失敗しました"
+    },
+    "connect.error.connectTitle": {
+        "message": "接続に失敗しました"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "切断に失敗しました"
+    },
+    "nav.peers.title": {
+        "message": "ピア"
+    },
+    "nav.peers.description": {
+        "message": "{total}台中{connected}台接続中"
+    },
+    "nav.resources.title": {
+        "message": "リソース"
+    },
+    "nav.resources.description": {
+        "message": "{total}件中{active}件有効"
+    },
+    "nav.exitNode.title": {
+        "message": "出口ノード"
+    },
+    "nav.exitNode.none": {
+        "message": "未使用"
+    },
+    "nav.exitNode.using": {
+        "message": "{name} 経由"
+    },
+    "header.openSettings": {
+        "message": "設定を開く"
+    },
+    "header.togglePanel": {
+        "message": "サイドパネルを切り替え"
+    },
+    "profile.selector.loading": {
+        "message": "読み込み中..."
+    },
+    "profile.selector.noProfile": {
+        "message": "プロファイルなし"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "名前でプロファイルを検索..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "プロファイルが見つかりません"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "別の検索語を試すか、新しいプロファイルを作成してください。"
+    },
+    "profile.selector.newProfile": {
+        "message": "新しいプロファイル"
+    },
+    "profile.selector.moreOptions": {
+        "message": "その他のオプション"
+    },
+    "profile.selector.deregister": {
+        "message": "登録解除"
+    },
+    "profile.selector.delete": {
+        "message": "削除"
+    },
+    "profile.selector.switchTo": {
+        "message": "このプロファイルに切り替え"
+    },
+    "profile.selector.edit": {
+        "message": "編集"
+    },
+    "profile.edit.title": {
+        "message": "プロファイルを編集"
+    },
+    "profile.edit.submit": {
+        "message": "変更を保存"
+    },
+    "profile.dialog.title": {
+        "message": "プロファイル名を入力"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "プロファイル名"
+    },
+    "profile.dialog.description": {
+        "message": "分かりやすいプロファイル名を設定してください。"
+    },
+    "profile.dialog.placeholder": {
+        "message": "例: 仕事"
+    },
+    "profile.dialog.submit": {
+        "message": "プロファイルを追加"
+    },
+    "profile.dialog.required": {
+        "message": "プロファイル名を入力してください（例: 仕事、自宅）"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "NetBird Cloud または独自のサーバーを使用します。"
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "このサーバーに到達できませんでした。URLを確認するか、正しいことが確実な場合はそのままプロファイルを追加してください。"
+    },
+    "header.menu.settings": {
+        "message": "設定..."
+    },
+    "header.menu.defaultView": {
+        "message": "デフォルト表示"
+    },
+    "header.menu.advancedView": {
+        "message": "詳細表示"
+    },
+    "header.menu.updateAvailable": {
+        "message": "更新が利用可能"
+    },
+    "header.menu.open": {
+        "message": "メニューを開く"
+    },
+    "header.profile.switch": {
+        "message": "プロファイルを切り替え"
+    },
+    "connect.toggle.label": {
+        "message": "NetBird 接続を切り替え"
+    },
+    "connect.localIp.label": {
+        "message": "ローカル IP アドレス"
+    },
+    "common.search": {
+        "message": "検索"
+    },
+    "common.filter": {
+        "message": "フィルター"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "出口ノードを選択"
+    },
+    "peers.row.label": {
+        "message": "{name} の詳細を開く、{status}"
+    },
+    "peers.dialog.title": {
+        "message": "ピアの詳細"
+    },
+    "networks.row.toggle": {
+        "message": "{name} を切り替え"
+    },
+    "networks.bulk.label": {
+        "message": "表示中のすべてのリソースを切り替え"
+    },
+    "profile.switch.title": {
+        "message": "プロファイルを「{name}」に切り替えますか？"
+    },
+    "profile.switch.message": {
+        "message": "プロファイルを切り替えてもよろしいですか？\n現在のプロファイルは切断されます。"
+    },
+    "profile.switch.confirm": {
+        "message": "確認"
+    },
+    "profile.deregister.title": {
+        "message": "プロファイル「{name}」の登録を解除しますか？"
+    },
+    "profile.deregister.message": {
+        "message": "このプロファイルの登録を解除してもよろしいですか？\n再度使用するにはログインが必要になります。"
+    },
+    "profile.deregister.confirm": {
+        "message": "登録解除"
+    },
+    "profile.delete.title": {
+        "message": "プロファイル「{name}」を削除しますか？"
+    },
+    "profile.delete.message": {
+        "message": "このプロファイルを削除してもよろしいですか？\nこの操作は取り消せません。"
+    },
+    "profile.delete.disabledActive": {
+        "message": "使用中のプロファイルは削除できません。削除する前に別のプロファイルに切り替えてください。"
+    },
+    "profile.delete.disabledDefault": {
+        "message": "デフォルトのプロファイルは削除できません。"
+    },
+    "profile.error.switchTitle": {
+        "message": "プロファイルの切り替えに失敗しました"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "プロファイルの登録解除に失敗しました"
+    },
+    "profile.error.deleteTitle": {
+        "message": "プロファイルの削除に失敗しました"
+    },
+    "profile.error.createTitle": {
+        "message": "プロファイルの作成に失敗しました"
+    },
+    "profile.error.editTitle": {
+        "message": "プロファイルの編集に失敗しました"
+    },
+    "profile.error.loadTitle": {
+        "message": "プロファイルの読み込みに失敗しました"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "使用中のプロファイル"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "プロファイルを切り替え"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "その他"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "プロファイルを追加"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "プロファイルの管理"
+    },
+    "profile.dropdown.settings": {
+        "message": "設定"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "プロファイル"
+    },
+    "settings.profiles.intro": {
+        "message": "仕事用と個人用のアカウント、あるいは異なる管理サーバーなど、複数の NetBird ID を並行して管理できます。以下でプロファイルの追加、登録解除、削除ができます。"
+    },
+    "settings.profiles.addProfile": {
+        "message": "プロファイルを追加"
+    },
+    "settings.profiles.active": {
+        "message": "使用中"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "プロファイルがありません"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "NetBird 管理サーバーに接続するプロファイルを作成してください。"
+    },
+    "settings.error.loadTitle": {
+        "message": "設定の読み込みに失敗しました"
+    },
+    "settings.error.saveTitle": {
+        "message": "設定の保存に失敗しました"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "デバッグバンドルの作成に失敗しました"
+    },
+    "settings.nav.label": {
+        "message": "設定セクション"
+    },
+    "settings.tabs.general": {
+        "message": "一般"
+    },
+    "settings.tabs.network": {
+        "message": "ネットワーク"
+    },
+    "settings.tabs.security": {
+        "message": "セキュリティ"
+    },
+    "settings.tabs.profiles": {
+        "message": "プロファイル"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "詳細設定"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "トラブルシューティング"
+    },
+    "settings.tabs.about": {
+        "message": "情報"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "更新が利用可能"
+    },
+    "settings.general.section.general": {
+        "message": "一般"
+    },
+    "settings.general.section.connection": {
+        "message": "接続"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "起動時に接続"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "サービスの起動時に自動的に接続を確立します。"
+    },
+    "settings.general.notifications.label": {
+        "message": "デスクトップ通知"
+    },
+    "settings.general.notifications.help": {
+        "message": "新しい更新や接続イベントに関するデスクトップ通知を表示します。"
+    },
+    "settings.general.autostart.label": {
+        "message": "ログイン時に NetBird UI を起動"
+    },
+    "settings.general.autostart.help": {
+        "message": "ログイン時に NetBird インターフェースを自動的に起動します。これはグラフィカルインターフェースにのみ影響し、バックグラウンドサービスには影響しません。"
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "自動起動の変更に失敗しました"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "終了後も接続を維持"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "NetBird を閉じたあとも接続はバックグラウンドで維持されます。自分で切断したときにだけ停止します。"
+    },
+    "settings.general.language.label": {
+        "message": "表示言語"
+    },
+    "settings.general.language.help": {
+        "message": "NetBird インターフェースの言語を選択します。"
+    },
+    "settings.general.language.search": {
+        "message": "言語を検索…"
+    },
+    "settings.general.language.empty": {
+        "message": "一致する言語がありません。"
+    },
+    "settings.general.theme.label": {
+        "message": "テーマ"
+    },
+    "settings.general.theme.help": {
+        "message": "ライト、ダーク、またはシステムの外観に従います。"
+    },
+    "settings.general.theme.system": {
+        "message": "システム"
+    },
+    "settings.general.theme.light": {
+        "message": "ライト"
+    },
+    "settings.general.theme.dark": {
+        "message": "ダーク"
+    },
+    "settings.general.management.label": {
+        "message": "管理サーバー"
+    },
+    "settings.general.management.help": {
+        "message": "NetBird Cloud または自身のセルフホスト管理サーバーに接続します。変更するとクライアントが再接続します。"
+    },
+    "settings.general.management.cloud": {
+        "message": "クラウド"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "セルフホスト"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "有効なURLを入力してください（例: https://netbird.selfhosted.com:443）"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "このサーバーに到達できませんでした。URLを確認するか、正しいことが確実な場合はそのまま保存してください。"
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "NetBird Cloud に切り替えますか？"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "セルフホストサーバーが切断されます。\n再度ログインが必要になる場合があります。"
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "クラウドに切り替え"
+    },
+    "settings.network.section.connectivity": {
+        "message": "ネットワーク接続"
+    },
+    "settings.network.section.routingDns": {
+        "message": "ルーティングとDNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "ネットワーク変更時に再接続"
+    },
+    "settings.network.monitor.help": {
+        "message": "ネットワークを監視し、Wi-Fiの切り替え、イーサネットの変更、スリープからの復帰などの変化時に自動的に再接続します。"
+    },
+    "settings.network.dns.label": {
+        "message": "DNSを有効にする"
+    },
+    "settings.network.dns.help": {
+        "message": "NetBird が管理する DNS 設定をホストのリゾルバに適用します。"
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "クライアントルートを有効にする"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "他のピアからルートを受け入れ、そのネットワークに到達できるようにします。"
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "サーバールートを有効にする"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "このホストのローカルルートを他のピアにアドバタイズします。"
+    },
+    "settings.network.ipv6.label": {
+        "message": "IPv6を有効にする"
+    },
+    "settings.network.ipv6.help": {
+        "message": "NetBird オーバーレイネットワークで IPv6 アドレッシングを使用します。"
+    },
+    "settings.security.section.firewall": {
+        "message": "ファイアウォール"
+    },
+    "settings.security.section.encryption": {
+        "message": "暗号化"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "受信トラフィックをブロック"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "このデバイスおよびこのデバイスがルーティングするネットワークへの、ピアからの要求されていない接続を拒否します。送信トラフィックには影響しません。"
+    },
+    "settings.security.blockLan.label": {
+        "message": "LANアクセスをブロック"
+    },
+    "settings.security.blockLan.help": {
+        "message": "このデバイスがピアのトラフィックをルーティングする際に、ピアがローカルネットワークやそのデバイスに到達できないようにします。"
+    },
+    "settings.security.rosenpass.label": {
+        "message": "量子耐性を有効にする"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "WireGuard® に加えて Rosenpass によるポスト量子鍵交換を追加します。"
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "寛容モードを有効にする"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "量子耐性に対応していないピアへの接続を許可します。"
+    },
+    "settings.ssh.section.server": {
+        "message": "サーバー"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "機能"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "認証"
+    },
+    "settings.ssh.server.label": {
+        "message": "SSHサーバーを有効にする"
+    },
+    "settings.ssh.server.help": {
+        "message": "このホストで NetBird SSH サーバーを実行し、他のピアが接続できるようにします。"
+    },
+    "settings.ssh.root.label": {
+        "message": "rootログインを許可"
+    },
+    "settings.ssh.root.help": {
+        "message": "ピアが root ユーザーとしてサインインできるようにします。無効にすると非特権アカウントが必要になります。"
+    },
+    "settings.ssh.sftp.label": {
+        "message": "SFTPを許可"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "ネイティブの SFTP または SCP クライアントを使用してファイルを安全に転送します。"
+    },
+    "settings.ssh.localForward.label": {
+        "message": "ローカルポート転送"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "接続するピアが、このホストから到達可能なサービスへローカルポートをトンネリングできるようにします。"
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "リモートポート転送"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "接続するピアが、このホスト上のポートを自身のマシンに公開できるようにします。"
+    },
+    "settings.ssh.jwt.label": {
+        "message": "JWT認証を有効にする"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "各 SSH セッションを IdP に対して検証し、ユーザー ID と監査を行います。無効にするとネットワークの ACL ポリシーのみに依存します。IdP が利用できない場合に便利です。"
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "JWTキャッシュTTL"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "発信 SSH 接続で再度認証を求めるまでに、このクライアントが JWT をキャッシュする期間です。0 に設定するとキャッシュを無効にし、接続ごとに認証します。"
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "秒"
+    },
+    "settings.advanced.section.interface": {
+        "message": "インターフェース"
+    },
+    "settings.advanced.section.security": {
+        "message": "セキュリティ"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "名前"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "1〜15文字の英字、数字、ドット、ハイフン、アンダースコアを使用してください。"
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "「utun」に続けて数字で始まる必要があります（例: utun100）。"
+    },
+    "settings.advanced.port.label": {
+        "message": "ポート"
+    },
+    "settings.advanced.port.error": {
+        "message": "{min}〜{max}の範囲でポートを入力してください。"
+    },
+    "settings.advanced.port.help": {
+        "message": "0 に設定すると、ランダムな空きポートが使用されます。"
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "{min}〜{max}の範囲で MTU 値を入力してください。"
+    },
+    "settings.advanced.psk.label": {
+        "message": "事前共有鍵"
+    },
+    "settings.advanced.psk.help": {
+        "message": "追加の対称暗号化のためのオプションの WireGuard PSK です。NetBird セットアップキーとは異なります。同じ事前共有鍵を使用するピアとのみ通信できます。"
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "デバッグバンドル"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "機密情報を匿名化"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "IP アドレス、ドメイン、その他の機密性の高い値を隠します。"
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "「デフォルト」では、サポートのために内部 IPv4 アドレスとピア名は読める状態のまま残ります。「厳格」では、さらにプライベート (RFC 1918)、CGNAT、リンクローカルの IP アドレス、ピア名、WireGuard 公開鍵も匿名化されます。繰り返し現れる値は同じプレースホルダーに置き換えられるため、ピアは区別できます。デバッグバンドルを組織外に共有する場合は「厳格」を使用してください。"
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "なし"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "デフォルト"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "厳格"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "システム情報を含める"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "OS、カーネル、ネットワークインターフェース、ルーティングテーブルを含めます。"
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "バンドルを NetBird サーバーにアップロード"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "NetBird サポートと共有するためのアップロードキーを返します。"
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "トレースログを有効にする"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "ログレベルを TRACE に引き上げ、その後元に戻します。"
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "キャプチャセッション"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "再接続して待機し、問題を再現できるようにします。"
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "ネットワークパケットをキャプチャ"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "キャプチャ期間中のネットワークトラフィックを .pcap として保存します。"
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "キャプチャ時間"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "キャプチャセッションを実行する時間です。"
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "分"
+    },
+    "settings.troubleshooting.create": {
+        "message": "バンドルを作成"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "ログ、システムの詳細、接続状態を収集しています。通常はしばらくで完了します。完了するまで NetBird を使い続けても、設定を閉じても構いません。"
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "キャンセル中…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "デバッグバンドルのアップロードに成功しました！"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "バンドルを保存しました"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "下記のアップロードキーを <docs>NetBird サポート</docs> と共有してください。ローカルコピーもお使いのデバイスに保存されました。"
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "デバッグバンドルはローカルに保存されました。"
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "キーをコピー"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "フォルダを開く"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "ファイルの場所を開く"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "アップロードに失敗しました: {reason} バンドルはローカルに保存されています。"
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "アップロードに失敗しました。バンドルはローカルに保存されています。"
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "NetBird を再接続しています…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "デバッグログをキャプチャしています"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "デバッグバンドルを生成しています…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "NetBird にアップロードしています…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "キャンセル中…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client"
+    },
+    "settings.about.development": {
+        "message": "[開発版]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. All Rights Reserved."
+    },
+    "settings.about.links.imprint": {
+        "message": "運営者情報"
+    },
+    "settings.about.links.privacy": {
+        "message": "プライバシー"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "利用規約"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "フォーラム"
+    },
+    "settings.about.community.documentation": {
+        "message": "ドキュメント"
+    },
+    "settings.about.community.feedback": {
+        "message": "フィードバック"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} をインストールする準備ができました。"
+    },
+    "update.banner.later": {
+        "message": "後で"
+    },
+    "update.banner.installNow": {
+        "message": "今すぐインストール"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "バージョン {version} がダウンロード可能です。"
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "バージョン {version} がインストール可能です。"
+    },
+    "update.card.whatsNew": {
+        "message": "新機能は？"
+    },
+    "update.card.installNow": {
+        "message": "今すぐインストール"
+    },
+    "update.card.getInstaller": {
+        "message": "ダウンロード"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird はバックグラウンドで更新を確認します。"
+    },
+    "update.card.changelog": {
+        "message": "変更履歴"
+    },
+    "update.card.onLatestVersion": {
+        "message": "最新バージョンを使用しています"
+    },
+    "update.header.tooltip": {
+        "message": "更新が利用可能"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "NetBird を v{version} に更新しています"
+    },
+    "update.overlay.updating": {
+        "message": "NetBird を更新しています"
+    },
+    "update.overlay.description": {
+        "message": "新しいバージョンが利用可能で、インストール中です。更新が完了すると NetBird は自動的に再起動します。"
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "更新に時間がかかっています"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "{target} のインストールに時間がかかりすぎ、完了しませんでした。"
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "更新が停止されました"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "{target} への更新は完了前にキャンセルされました。"
+    },
+    "update.overlay.error.failTitle": {
+        "message": "更新をインストールできませんでした"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "{target} をインストールできませんでした。"
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "不明なエラー"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "新しいバージョン"
+    },
+    "update.error.loadStateTitle": {
+        "message": "更新状態の読み込みに失敗しました"
+    },
+    "update.error.triggerTitle": {
+        "message": "更新の開始に失敗しました"
+    },
+    "update.page.versionLine": {
+        "message": "クライアントを次のバージョンに更新しています: {version}。"
+    },
+    "update.page.versionLineGeneric": {
+        "message": "クライアントを更新しています。"
+    },
+    "update.page.outdated": {
+        "message": "クライアントのバージョンが、管理サーバーで設定された自動更新バージョンより古くなっています。"
+    },
+    "update.page.status.running": {
+        "message": "更新中"
+    },
+    "update.page.status.timeout": {
+        "message": "更新がタイムアウトしました。もう一度お試しください。"
+    },
+    "update.page.status.canceled": {
+        "message": "更新がキャンセルされました。"
+    },
+    "update.page.status.failed": {
+        "message": "更新に失敗しました: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "不明な更新エラー"
+    },
+    "update.page.failedTitle": {
+        "message": "更新に失敗しました"
+    },
+    "update.page.timeoutMessage": {
+        "message": "更新がタイムアウトしました。"
+    },
+    "update.page.dontClose": {
+        "message": "このウィンドウを閉じないでください。"
+    },
+    "update.page.updating": {
+        "message": "更新中…"
+    },
+    "update.page.complete": {
+        "message": "更新が完了しました"
+    },
+    "update.page.failed": {
+        "message": "更新に失敗しました"
+    },
+    "window.title.settings": {
+        "message": "設定"
+    },
+    "window.title.signIn": {
+        "message": "サインイン"
+    },
+    "window.title.sessionExpiration": {
+        "message": "セッションの期限切れ"
+    },
+    "window.title.updating": {
+        "message": "更新中"
+    },
+    "window.title.welcome": {
+        "message": "NetBird へようこそ"
+    },
+    "window.title.error": {
+        "message": "エラー"
+    },
+    "welcome.title": {
+        "message": "トレイの NetBird を確認してください"
+    },
+    "welcome.titleMac": {
+        "message": "メニューバーの NetBird を確認してください"
+    },
+    "welcome.description": {
+        "message": "NetBird はトレイに常駐します。アイコンをクリックして、接続、プロファイルの切り替え、設定を開くことができます。"
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird はメニューバーに常駐します。アイコンをクリックして、接続、プロファイルの切り替え、設定を開くことができます。"
+    },
+    "welcome.continue": {
+        "message": "続ける"
+    },
+    "welcome.back": {
+        "message": "戻る"
+    },
+    "welcome.management.title": {
+        "message": "NetBird をセットアップ"
+    },
+    "welcome.management.description": {
+        "message": "「続ける」をクリックして開始するか、独自の NetBird サーバーをお持ちの場合は「セルフホスト」を選択してください。"
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "当社のホスト型サービスを使用します。セットアップは不要です。"
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "セルフホスト"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "独自の管理サーバーに接続します。"
+    },
+    "welcome.management.urlLabel": {
+        "message": "管理サーバーのURL"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "有効なURLを入力してください（例: https://netbird.selfhosted.com:443）"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "このサーバーに到達できませんでした。URLまたはネットワークを確認し、正しいことが確実な場合は続行してください。"
+    },
+    "welcome.management.checking": {
+        "message": "確認中…"
+    },
+    "browserLogin.title": {
+        "message": "ブラウザでログインを完了してください"
+    },
+    "browserLogin.notSeeing": {
+        "message": "サインインを完了できるようブラウザのタブを開きました。表示されませんか？"
+    },
+    "browserLogin.tryAgain": {
+        "message": "再試行"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "ブラウザの起動に失敗しました"
+    },
+    "sessionExpiration.title": {
+        "message": "まもなくセッションが期限切れになります"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "セッションが期限切れになります"
+    },
+    "sessionExpiration.description": {
+        "message": "このデバイスはまもなく切断されます。ブラウザでのサインインで更新してください。"
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "ブラウザでサインインすると、このデバイスがネットワークに接続されたままになります。"
+    },
+    "sessionExpiration.stay": {
+        "message": "セッションを更新"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "認証"
+    },
+    "sessionExpiration.logout": {
+        "message": "ログアウト"
+    },
+    "sessionExpiration.expired": {
+        "message": "セッションが期限切れになりました"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "デバイスが切断されました。再接続するにはブラウザでサインインして認証してください。"
+    },
+    "sessionExpiration.close": {
+        "message": "閉じる"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "セッションの延長に失敗しました"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "ログアウトに失敗しました"
+    },
+    "peers.search.placeholder": {
+        "message": "名前または IP で検索"
+    },
+    "peers.filter.all": {
+        "message": "すべて"
+    },
+    "peers.filter.online": {
+        "message": "オンライン"
+    },
+    "peers.filter.offline": {
+        "message": "オフライン"
+    },
+    "peers.empty.title": {
+        "message": "利用可能なピアがありません"
+    },
+    "peers.empty.description": {
+        "message": "利用可能なピアがないか、いずれのピアにもアクセス権がありません。"
+    },
+    "peers.details.domain": {
+        "message": "ドメイン"
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird IP"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird IPv6"
+    },
+    "peers.details.publicKey": {
+        "message": "公開鍵"
+    },
+    "peers.details.connection": {
+        "message": "接続"
+    },
+    "peers.details.latency": {
+        "message": "レイテンシ"
+    },
+    "peers.details.lastHandshake": {
+        "message": "最終ハンドシェイク"
+    },
+    "peers.details.statusSince": {
+        "message": "最終接続更新"
+    },
+    "peers.details.bytes": {
+        "message": "バイト"
+    },
+    "peers.details.bytesSent": {
+        "message": "送信"
+    },
+    "peers.details.bytesReceived": {
+        "message": "受信"
+    },
+    "peers.details.localIce": {
+        "message": "ローカル ICE"
+    },
+    "peers.details.remoteIce": {
+        "message": "リモート ICE"
+    },
+    "peers.details.never": {
+        "message": "なし"
+    },
+    "peers.details.justNow": {
+        "message": "たった今"
+    },
+    "peers.details.refresh": {
+        "message": "更新"
+    },
+    "peers.status.connected": {
+        "message": "接続済み"
+    },
+    "peers.status.connecting": {
+        "message": "接続中"
+    },
+    "peers.status.disconnected": {
+        "message": "未接続"
+    },
+    "peers.details.relayAddress": {
+        "message": "リレー"
+    },
+    "peers.details.networks": {
+        "message": "リソース"
+    },
+    "peers.details.relayed": {
+        "message": "リレー経由"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass 有効"
+    },
+    "networks.search.placeholder": {
+        "message": "ネットワークまたはドメインで検索"
+    },
+    "networks.filter.all": {
+        "message": "すべて"
+    },
+    "networks.filter.active": {
+        "message": "有効"
+    },
+    "networks.filter.overlapping": {
+        "message": "重複"
+    },
+    "networks.empty.title": {
+        "message": "利用可能なリソースがありません"
+    },
+    "networks.empty.description": {
+        "message": "利用可能なネットワークリソースがないか、いずれのリソースにもアクセス権がありません。"
+    },
+    "networks.selected": {
+        "message": "選択中"
+    },
+    "networks.unselected": {
+        "message": "未選択"
+    },
+    "networks.ips.heading": {
+        "message": "解決された IP"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{total}件中{selected}件有効"
+    },
+    "networks.bulk.enableAll": {
+        "message": "すべて有効化"
+    },
+    "networks.bulk.disableAll": {
+        "message": "すべて無効化"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "出口ノードを検索"
+    },
+    "exitNodes.none": {
+        "message": "なし"
+    },
+    "exitNodes.empty.title": {
+        "message": "利用可能な出口ノードがありません"
+    },
+    "exitNodes.empty.description": {
+        "message": "このピアと共有されている出口ノードはありません。"
+    },
+    "exitNodes.card.title": {
+        "message": "出口ノード"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "有効"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "無効"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "なし"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "出口ノードを使用しない直接接続"
+    },
+    "quickActions.connect": {
+        "message": "接続"
+    },
+    "quickActions.disconnect": {
+        "message": "切断"
+    },
+    "daemon.unavailable.title": {
+        "message": "NetBird サービスが実行されていません"
+    },
+    "daemon.unavailable.description": {
+        "message": "サービスが実行されると、アプリは自動的に再接続します。"
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "ドキュメント"
+    },
+    "daemon.outdated.title": {
+        "message": "NetBird サービスが古くなっています"
+    },
+    "daemon.outdated.description": {
+        "message": "このアプリを使用するには NetBird サービスを更新してください。"
+    },
+    "daemon.outdated.download": {
+        "message": "最新版をダウンロード"
+    },
+    "error.jwt_clock_skew": {
+        "message": "サインインに失敗しました: このデバイスの時計がサーバーと同期していません。システムの時計を同期してからもう一度お試しください。"
+    },
+    "error.jwt_expired": {
+        "message": "サインイントークンの有効期限が切れました。もう一度サインインしてください。"
+    },
+    "error.jwt_signature_invalid": {
+        "message": "サインインに失敗しました: トークンの署名が無効です。管理者にお問い合わせください。"
+    },
+    "error.session_expired": {
+        "message": "セッションの有効期限が切れました。もう一度サインインしてください。"
+    },
+    "error.invalid_setup_key": {
+        "message": "セットアップキーがないか、無効です。"
+    },
+    "error.permission_denied": {
+        "message": "サインインがサーバーによって拒否されました。"
+    },
+    "error.daemon_unreachable": {
+        "message": "NetBird デーモンが応答していません。サービスが実行されているか確認してください。"
+    },
+    "error.settings_locked": {
+        "message": "この端末では設定を変更できません。管理者によってロックされています。"
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "この設定は組織によって管理されているため、変更できません。"
+    },
+    "error.unknown": {
+        "message": "操作に失敗しました。"
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird はこのシステムに必要な権限を要求できませんでした。代わりに次のコマンドを実行してください:"
+    },
+    "error.elevation_failed": {
+        "message": "昇格した権限でも変更を適用できませんでした。代わりに次のコマンドを実行してください:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root 権限"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "管理者権限"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "{actor}が必要です。代わりに次のコマンドを実行してください:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "無効にはできますが、再度有効にするには{actor}が必要です。"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "有効にはできますが、再度無効にするには{actor}が必要です。"
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "承認を待っています…"
+    }
+}
diff --git a/client/ui/i18n/locales/pt/common.json b/client/ui/i18n/locales/pt/common.json
new file mode 100644
index 000000000..aca458a4d
--- /dev/null
+++ b/client/ui/i18n/locales/pt/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Não está em execução"
+    },
+    "tray.status.error": {
+        "message": "Erro"
+    },
+    "tray.status.connected": {
+        "message": "Conectado"
+    },
+    "tray.status.connecting": {
+        "message": "Conectando"
+    },
+    "tray.status.needsLogin": {
+        "message": "Login necessário"
+    },
+    "tray.status.loginFailed": {
+        "message": "Falha no login"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sessão expirada"
+    },
+    "tray.session.expiresIn": {
+        "message": "A sessão expira em {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "menos de um minuto"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minuto"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutos"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 hora"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} horas"
+    },
+    "tray.session.unit.day": {
+        "message": "1 dia"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} dias"
+    },
+    "tray.menu.open": {
+        "message": "Abrir o NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Conectar"
+    },
+    "tray.menu.disconnect": {
+        "message": "Desconectar"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nó de saída"
+    },
+    "tray.menu.networks": {
+        "message": "Recursos"
+    },
+    "tray.menu.profiles": {
+        "message": "Perfis"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Gerenciar perfis"
+    },
+    "tray.menu.settings": {
+        "message": "Configurações..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Criar pacote de depuração"
+    },
+    "tray.menu.about": {
+        "message": "Ajuda e suporte"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentação"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Solução de problemas"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Baixar a versão mais recente"
+    },
+    "tray.menu.installVersion": {
+        "message": "Instalar a versão {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Sair do NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "O serviço NetBird está desatualizado"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Atualize o serviço NetBird para usar este aplicativo."
+    },
+    "notify.update.title": {
+        "message": "Atualização do NetBird disponível"
+    },
+    "notify.update.body": {
+        "message": "O NetBird {version} está disponível."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " O seu administrador exige esta atualização."
+    },
+    "notify.error.title": {
+        "message": "Erro"
+    },
+    "notify.error.connect": {
+        "message": "Falha ao conectar"
+    },
+    "notify.error.disconnect": {
+        "message": "Falha ao desconectar"
+    },
+    "notify.error.switchProfile": {
+        "message": "Falha ao alternar para {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Falha ao atualizar o nó de saída {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Sessão do NetBird expirada"
+    },
+    "notify.sessionExpired.body": {
+        "message": "A sua sessão do NetBird expirou. Faça login novamente."
+    },
+    "notify.sessionWarning.title": {
+        "message": "A sessão expira em breve"
+    },
+    "notify.sessionWarning.body": {
+        "message": "A sua sessão do NetBird expira em {remaining}. Clique em Renovar agora para renová-la."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "A sua sessão do NetBird está prestes a expirar. Clique em Renovar agora para renová-la."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Renovar agora"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Dispensar"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Falha ao renovar a sessão do NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Sessão do NetBird renovada"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "A sua sessão foi renovada."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Prazo da sessão rejeitado"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "O servidor enviou um prazo de sessão inválido. Faça login novamente."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Definições do NetBird atualizadas"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "A sua configuração do NetBird foi atualizada pela política de TI."
+    },
+    "common.cancel": {
+        "message": "Cancelar"
+    },
+    "common.save": {
+        "message": "Salvar"
+    },
+    "common.saveChanges": {
+        "message": "Salvar alterações"
+    },
+    "common.saving": {
+        "message": "Salvando…"
+    },
+    "common.close": {
+        "message": "Fechar"
+    },
+    "common.copy": {
+        "message": "Copiar"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Alternar visibilidade da senha"
+    },
+    "common.increase": {
+        "message": "Aumentar"
+    },
+    "common.decrease": {
+        "message": "Diminuir"
+    },
+    "common.delete": {
+        "message": "Excluir"
+    },
+    "common.create": {
+        "message": "Criar"
+    },
+    "common.add": {
+        "message": "Adicionar"
+    },
+    "common.remove": {
+        "message": "Remover"
+    },
+    "common.refresh": {
+        "message": "Atualizar"
+    },
+    "common.loading": {
+        "message": "Carregando…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Nenhum resultado encontrado"
+    },
+    "common.noResults.description": {
+        "message": "Não encontramos nenhum resultado. Tente um termo de busca diferente ou altere os filtros."
+    },
+    "notConnected.title": {
+        "message": "Desconectado"
+    },
+    "notConnected.description": {
+        "message": "Conecte-se ao NetBird primeiro para ver informações detalhadas sobre seus peers, recursos de rede e nós de saída."
+    },
+    "connect.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "connect.status.connecting": {
+        "message": "Conectando..."
+    },
+    "connect.status.connected": {
+        "message": "Conectado"
+    },
+    "connect.status.disconnecting": {
+        "message": "Desconectando..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon indisponível"
+    },
+    "connect.status.loginRequired": {
+        "message": "Login necessário"
+    },
+    "connect.error.loginTitle": {
+        "message": "Falha no login"
+    },
+    "connect.error.connectTitle": {
+        "message": "Falha ao conectar"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Falha ao desconectar"
+    },
+    "nav.peers.title": {
+        "message": "Peers"
+    },
+    "nav.peers.description": {
+        "message": "{connected} de {total} conectados"
+    },
+    "nav.resources.title": {
+        "message": "Recursos"
+    },
+    "nav.resources.description": {
+        "message": "{active} de {total} ativos"
+    },
+    "nav.exitNode.title": {
+        "message": "Nós de saída"
+    },
+    "nav.exitNode.none": {
+        "message": "Inativo"
+    },
+    "nav.exitNode.using": {
+        "message": "Via {name}"
+    },
+    "header.openSettings": {
+        "message": "Abrir configurações"
+    },
+    "header.togglePanel": {
+        "message": "Alternar painel lateral"
+    },
+    "profile.selector.loading": {
+        "message": "Carregando..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Nenhum perfil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Buscar perfil por nome..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Nenhum perfil encontrado"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Tente um termo de busca diferente ou crie um novo perfil."
+    },
+    "profile.selector.newProfile": {
+        "message": "Novo perfil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Mais opções"
+    },
+    "profile.selector.deregister": {
+        "message": "Cancelar registro"
+    },
+    "profile.selector.delete": {
+        "message": "Excluir"
+    },
+    "profile.selector.switchTo": {
+        "message": "Alternar para este perfil"
+    },
+    "profile.selector.edit": {
+        "message": "Editar"
+    },
+    "profile.edit.title": {
+        "message": "Editar perfil"
+    },
+    "profile.edit.submit": {
+        "message": "Salvar alterações"
+    },
+    "profile.dialog.title": {
+        "message": "Insira o nome do perfil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nome do perfil"
+    },
+    "profile.dialog.description": {
+        "message": "Defina um nome fácil de identificar para o seu perfil."
+    },
+    "profile.dialog.placeholder": {
+        "message": "ex.: trabalho"
+    },
+    "profile.dialog.submit": {
+        "message": "Adicionar perfil"
+    },
+    "profile.dialog.required": {
+        "message": "Insira um nome de perfil, ex.: trabalho, casa"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Use o NetBird Cloud ou seu próprio servidor."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Não foi possível acessar este servidor. Verifique a URL ou adicione o perfil mesmo assim se tiver certeza de que está correta."
+    },
+    "header.menu.settings": {
+        "message": "Configurações..."
+    },
+    "header.menu.defaultView": {
+        "message": "Visualização padrão"
+    },
+    "header.menu.advancedView": {
+        "message": "Visualização avançada"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Atualização disponível"
+    },
+    "header.menu.open": {
+        "message": "Abrir menu"
+    },
+    "header.profile.switch": {
+        "message": "Trocar perfil"
+    },
+    "connect.toggle.label": {
+        "message": "Alternar conexão NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Endereços IP locais"
+    },
+    "common.search": {
+        "message": "Pesquisar"
+    },
+    "common.filter": {
+        "message": "Filtrar"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Selecionar nó de saída"
+    },
+    "peers.row.label": {
+        "message": "Abrir detalhes de {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Detalhes do par"
+    },
+    "networks.row.toggle": {
+        "message": "Alternar {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Alternar todos os recursos visíveis"
+    },
+    "profile.switch.title": {
+        "message": "Alternar perfil para \"{name}\"?"
+    },
+    "profile.switch.message": {
+        "message": "Tem certeza de que deseja alternar de perfil?\nO seu perfil atual será desconectado."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirmar"
+    },
+    "profile.deregister.title": {
+        "message": "Cancelar registro do perfil \"{name}\"?"
+    },
+    "profile.deregister.message": {
+        "message": "Tem certeza de que deseja cancelar o registro deste perfil?\nVocê precisará fazer login novamente para usá-lo."
+    },
+    "profile.deregister.confirm": {
+        "message": "Cancelar registro"
+    },
+    "profile.delete.title": {
+        "message": "Excluir o perfil \"{name}\"?"
+    },
+    "profile.delete.message": {
+        "message": "Tem certeza de que deseja excluir este perfil?\nEsta ação não pode ser desfeita."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Perfis ativos não podem ser excluídos. Alterne para outro antes de excluir este perfil."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "O perfil padrão não pode ser excluído."
+    },
+    "profile.error.switchTitle": {
+        "message": "Falha ao alternar de perfil"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Falha ao cancelar registro do perfil"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Falha ao excluir o perfil"
+    },
+    "profile.error.createTitle": {
+        "message": "Falha ao criar o perfil"
+    },
+    "profile.error.editTitle": {
+        "message": "Falha ao editar o perfil"
+    },
+    "profile.error.loadTitle": {
+        "message": "Falha ao carregar os perfis"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Perfil ativo"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Alternar perfil"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Outro"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Adicionar perfil"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Gerenciar perfis"
+    },
+    "profile.dropdown.settings": {
+        "message": "Configurações"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Perfis"
+    },
+    "settings.profiles.intro": {
+        "message": "Mantenha identidades separadas do NetBird lado a lado, por exemplo contas de trabalho e pessoais, ou diferentes servidores de gerenciamento. Adicione, cancele o registro ou exclua perfis abaixo."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Adicionar perfil"
+    },
+    "settings.profiles.active": {
+        "message": "Ativo"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Nenhum perfil"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Crie um perfil para conectar a um servidor de gerenciamento do NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Falha ao carregar as configurações"
+    },
+    "settings.error.saveTitle": {
+        "message": "Falha ao salvar as configurações"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Falha no pacote de depuração"
+    },
+    "settings.nav.label": {
+        "message": "Seções das configurações"
+    },
+    "settings.tabs.general": {
+        "message": "Geral"
+    },
+    "settings.tabs.network": {
+        "message": "Rede"
+    },
+    "settings.tabs.security": {
+        "message": "Segurança"
+    },
+    "settings.tabs.profiles": {
+        "message": "Perfis"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avançado"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Solução de problemas"
+    },
+    "settings.tabs.about": {
+        "message": "Sobre"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Atualização disponível"
+    },
+    "settings.general.section.general": {
+        "message": "Geral"
+    },
+    "settings.general.section.connection": {
+        "message": "Conexão"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Conectar ao iniciar"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Estabelecer uma conexão automaticamente quando o serviço iniciar."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notificações na área de trabalho"
+    },
+    "settings.general.notifications.help": {
+        "message": "Mostrar notificações na área de trabalho para novas atualizações e eventos de conexão."
+    },
+    "settings.general.autostart.label": {
+        "message": "Iniciar a interface do NetBird ao fazer login"
+    },
+    "settings.general.autostart.help": {
+        "message": "Iniciar a interface do NetBird automaticamente quando você fizer login. Isto afeta apenas a interface gráfica, não o serviço em segundo plano."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Falha ao alterar o início automático"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Permanecer conectado ao sair"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "A conexão continua ativa em segundo plano depois de fechar o NetBird. Ela só para quando você mesmo a desconecta."
+    },
+    "settings.general.language.label": {
+        "message": "Idioma de exibição"
+    },
+    "settings.general.language.help": {
+        "message": "Escolha o idioma da interface do NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Buscar idioma…"
+    },
+    "settings.general.language.empty": {
+        "message": "Nenhum idioma corresponde."
+    },
+    "settings.general.theme.label": {
+        "message": "Tema"
+    },
+    "settings.general.theme.help": {
+        "message": "Escolha claro, escuro ou siga a aparência do sistema."
+    },
+    "settings.general.theme.system": {
+        "message": "Sistema"
+    },
+    "settings.general.theme.light": {
+        "message": "Claro"
+    },
+    "settings.general.theme.dark": {
+        "message": "Escuro"
+    },
+    "settings.general.management.label": {
+        "message": "Servidor de gerenciamento"
+    },
+    "settings.general.management.help": {
+        "message": "Conecte ao NetBird Cloud ou ao seu próprio servidor de gerenciamento auto-hospedado. As alterações reconectarão o cliente."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Auto-hospedado"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Insira uma URL válida, ex.: https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Não foi possível acessar este servidor. Verifique a URL ou salve mesmo assim se tiver certeza de que está correta."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Alternar para o NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Isto desconecta o seu servidor auto-hospedado.\nVocê pode precisar fazer login novamente."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Alternar para o Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Conectividade"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Roteamento e DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconectar ao mudar de rede"
+    },
+    "settings.network.monitor.help": {
+        "message": "Monitora a rede e reconecta automaticamente diante de mudanças como troca de Wi-Fi, alterações na Ethernet ou retorno do modo de suspensão."
+    },
+    "settings.network.dns.label": {
+        "message": "Ativar DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Aplicar as configurações de DNS gerenciadas pelo NetBird ao resolvedor do host."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Ativar rotas de cliente"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Aceitar rotas de outros peers para alcançar as redes deles."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Ativar rotas de servidor"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Anunciar as rotas locais deste host para outros peers."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Ativar IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Usar endereçamento IPv6 para a rede de sobreposição do NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Firewall"
+    },
+    "settings.security.section.encryption": {
+        "message": "Criptografia"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bloquear tráfego de entrada"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rejeitar conexões não solicitadas de peers para este dispositivo e quaisquer redes que ele roteie. O tráfego de saída não é afetado."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Bloquear acesso à LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Impedir que peers alcancem a sua rede local ou os dispositivos dela quando este dispositivo roteia o tráfego deles."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Ativar resistência quântica"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Adicionar uma troca de chaves pós-quântica via Rosenpass sobre o WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Ativar modo permissivo"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Permitir conexões com peers sem suporte a resistência quântica."
+    },
+    "settings.ssh.section.server": {
+        "message": "Servidor"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Recursos"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Autenticação"
+    },
+    "settings.ssh.server.label": {
+        "message": "Ativar servidor SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Executar o servidor SSH do NetBird neste host para que outros peers possam conectar a ele."
+    },
+    "settings.ssh.root.label": {
+        "message": "Permitir login como root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permitir que peers façam login como usuário root. Desative para exigir uma conta sem privilégios."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Permitir SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transferir arquivos com segurança usando clientes SFTP ou SCP nativos."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Encaminhamento de porta local"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permitir que peers conectados encaminhem portas locais para serviços acessíveis a partir deste host."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Encaminhamento de porta remota"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permitir que peers conectados exponham portas deste host de volta para a própria máquina deles."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Ativar autenticação JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verificar cada sessão SSH no seu IdP para identidade do usuário e auditoria. Desative para depender apenas das políticas de ACL da rede, útil quando nenhum IdP está disponível."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL do cache de JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Por quanto tempo este cliente mantém um JWT em cache antes de solicitar novamente em conexões SSH de saída. Defina como 0 para desativar o cache e autenticar em cada conexão."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "s"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interface"
+    },
+    "settings.advanced.section.security": {
+        "message": "Segurança"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nome"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Use de 1 a 15 letras, dígitos, pontos, hifens ou sublinhados."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Deve começar com \"utun\" seguido de um número (ex.: utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Porta"
+    },
+    "settings.advanced.port.error": {
+        "message": "Insira uma porta entre {min} e {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Se definida como 0, uma porta livre aleatória será usada."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Insira um valor de MTU entre {min} e {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Chave pré-compartilhada"
+    },
+    "settings.advanced.psk.help": {
+        "message": "PSK opcional do WireGuard para criptografia simétrica adicional. Não é o mesmo que uma chave de configuração do NetBird. Você só se comunicará com peers que usem a mesma chave pré-compartilhada."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Pacote de depuração"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonimizar informações sensíveis"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Oculta endereços IP, domínios e outros valores sensíveis."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "O modo padrão mantém os endereços IPv4 internos e os nomes dos peers legíveis para o suporte. O modo estrito anonimiza também os endereços IP privados (RFC 1918), CGNAT e link-local, os nomes dos peers e as chaves públicas do WireGuard. Valores recorrentes recebem o mesmo marcador, então os peers continuam distinguíveis. Use o modo estrito ao compartilhar o pacote de depuração fora da sua organização."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Nenhum"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Padrão"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Estrito"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Incluir informações do sistema"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Incluir o OS, o kernel, as interfaces de rede e as tabelas de roteamento."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Enviar pacote aos servidores do NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Retorna uma chave de upload para compartilhar com o suporte do NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Habilitar logs de trace"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Eleva o nível de log para TRACE e o restaura em seguida."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Sessão de captura"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Reconecta e aguarda para que você possa reproduzir o problema."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capturar pacotes de rede"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Salva um .pcap do tráfego de rede durante a sessão de captura."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Duração da captura"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Por quanto tempo a sessão de captura é executada."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "min"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Criar pacote"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Coletando logs, detalhes do sistema e estado da conexão. Isto costuma levar um instante — mantenha esta janela aberta até concluir."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Pacote de depuração enviado com sucesso!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Pacote salvo"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Compartilhe a chave de upload abaixo com o <docs>suporte do NetBird</docs>. Uma cópia local também foi salva no seu dispositivo."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "O seu pacote de depuração foi salvo localmente."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copiar chave"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Abrir pasta"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Abrir local do arquivo"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Falha no upload: {reason} O pacote continua salvo localmente."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Falha no upload. O pacote continua salvo localmente."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconectando o NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capturando logs de depuração"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Gerando o pacote de depuração…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Enviando para o NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client"
+    },
+    "settings.about.development": {
+        "message": "[Development]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Todos os direitos reservados."
+    },
+    "settings.about.links.imprint": {
+        "message": "Identificação legal"
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacidade"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Termos de serviço"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Fórum"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentação"
+    },
+    "settings.about.community.feedback": {
+        "message": "Feedback"
+    },
+    "update.banner.message": {
+        "message": "O NetBird {version} está pronto para instalar."
+    },
+    "update.banner.later": {
+        "message": "Mais tarde"
+    },
+    "update.banner.installNow": {
+        "message": "Instalar agora"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "A versão {version} está disponível para download."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "A versão {version} está disponível para instalação."
+    },
+    "update.card.whatsNew": {
+        "message": "Novidades?"
+    },
+    "update.card.installNow": {
+        "message": "Instalar agora"
+    },
+    "update.card.getInstaller": {
+        "message": "Baixar"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "O NetBird verifica atualizações em segundo plano."
+    },
+    "update.card.changelog": {
+        "message": "Registro de alterações"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Você está na versão mais recente"
+    },
+    "update.header.tooltip": {
+        "message": "Atualização disponível"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Atualizando o NetBird para a v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Atualizando o NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Uma versão mais recente está disponível e sendo instalada. O NetBird reiniciará automaticamente quando a atualização terminar."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "A atualização está demorando demais"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "A instalação de {target} demorou demais e não foi concluída."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "A atualização foi interrompida"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "A atualização para {target} foi cancelada antes de terminar."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Não foi possível instalar a atualização"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Não foi possível instalar {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "erro desconhecido"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "a nova versão"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Falha ao carregar o estado da atualização"
+    },
+    "update.error.triggerTitle": {
+        "message": "Falha ao iniciar a atualização"
+    },
+    "update.page.versionLine": {
+        "message": "Atualizando o cliente para: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Atualizando o cliente."
+    },
+    "update.page.outdated": {
+        "message": "A versão do seu cliente é anterior à versão de atualização automática definida no Management."
+    },
+    "update.page.status.running": {
+        "message": "Atualizando"
+    },
+    "update.page.status.timeout": {
+        "message": "A atualização expirou. Tente novamente."
+    },
+    "update.page.status.canceled": {
+        "message": "Atualização cancelada."
+    },
+    "update.page.status.failed": {
+        "message": "Falha na atualização: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "erro de atualização desconhecido"
+    },
+    "update.page.failedTitle": {
+        "message": "Falha na atualização"
+    },
+    "update.page.timeoutMessage": {
+        "message": "A atualização expirou."
+    },
+    "update.page.dontClose": {
+        "message": "Não feche esta janela."
+    },
+    "update.page.updating": {
+        "message": "Atualizando…"
+    },
+    "update.page.complete": {
+        "message": "Atualização concluída"
+    },
+    "update.page.failed": {
+        "message": "Falha na atualização"
+    },
+    "window.title.settings": {
+        "message": "Configurações"
+    },
+    "window.title.signIn": {
+        "message": "Login"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sessão expirando"
+    },
+    "window.title.updating": {
+        "message": "Atualizando"
+    },
+    "window.title.welcome": {
+        "message": "Bem-vindo ao NetBird"
+    },
+    "window.title.error": {
+        "message": "Erro"
+    },
+    "welcome.title": {
+        "message": "Procure o NetBird na sua bandeja"
+    },
+    "welcome.titleMac": {
+        "message": "Procure o NetBird na sua barra de menus"
+    },
+    "welcome.description": {
+        "message": "O NetBird fica na sua bandeja. Clique no ícone para conectar, alternar perfis ou abrir as configurações."
+    },
+    "welcome.descriptionMac": {
+        "message": "O NetBird fica na sua barra de menus. Clique no ícone para conectar, alternar perfis ou abrir as configurações."
+    },
+    "welcome.continue": {
+        "message": "Continuar"
+    },
+    "welcome.back": {
+        "message": "Voltar"
+    },
+    "welcome.management.title": {
+        "message": "Configurar o NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Clique em Continuar para começar ou escolha Auto-hospedado se você tiver o seu próprio servidor NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Use o nosso serviço hospedado. Sem configuração necessária."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Auto-hospedado"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Conecte ao seu próprio servidor de gerenciamento."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL do servidor de gerenciamento"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Insira uma URL válida, ex.: https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Não foi possível acessar este servidor. Verifique a URL ou a sua rede e continue se tiver certeza de que está correta."
+    },
+    "welcome.management.checking": {
+        "message": "Verificando…"
+    },
+    "browserLogin.title": {
+        "message": "Continue no seu navegador para concluir o login"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Não está vendo a aba do navegador?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Tentar novamente"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Falha ao abrir o navegador"
+    },
+    "sessionExpiration.title": {
+        "message": "A sessão expira em breve"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "A sua sessão vai expirar"
+    },
+    "sessionExpiration.description": {
+        "message": "Este dispositivo será desconectado em breve. Renove com um login pelo navegador."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Um login pelo navegador mantém este dispositivo conectado à sua rede."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renovar sessão"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Autenticar"
+    },
+    "sessionExpiration.logout": {
+        "message": "Sair"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sessão expirada"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Dispositivo desconectado. Autentique com um login pelo navegador para reconectar."
+    },
+    "sessionExpiration.close": {
+        "message": "Fechar"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Falha ao renovar a sessão"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Falha ao sair"
+    },
+    "peers.search.placeholder": {
+        "message": "Buscar por nome ou IP"
+    },
+    "peers.filter.all": {
+        "message": "Todos"
+    },
+    "peers.filter.online": {
+        "message": "Online"
+    },
+    "peers.filter.offline": {
+        "message": "Offline"
+    },
+    "peers.empty.title": {
+        "message": "Nenhum peer disponível"
+    },
+    "peers.empty.description": {
+        "message": "Você não tem nenhum peer disponível ou não tem acesso a nenhum deles."
+    },
+    "peers.details.domain": {
+        "message": "Domínio"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP do NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 do NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Chave pública"
+    },
+    "peers.details.connection": {
+        "message": "Conexão"
+    },
+    "peers.details.latency": {
+        "message": "Latência"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Último handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Última atualização da conexão"
+    },
+    "peers.details.bytes": {
+        "message": "Bytes"
+    },
+    "peers.details.bytesSent": {
+        "message": "Enviados"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Recebidos"
+    },
+    "peers.details.localIce": {
+        "message": "ICE local"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE remoto"
+    },
+    "peers.details.never": {
+        "message": "Nunca"
+    },
+    "peers.details.justNow": {
+        "message": "Agora mesmo"
+    },
+    "peers.details.refresh": {
+        "message": "Atualizar"
+    },
+    "peers.status.connected": {
+        "message": "Conectado"
+    },
+    "peers.status.connecting": {
+        "message": "Conectando"
+    },
+    "peers.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay"
+    },
+    "peers.details.networks": {
+        "message": "Recursos"
+    },
+    "peers.details.relayed": {
+        "message": "Via relay"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass ativado"
+    },
+    "networks.search.placeholder": {
+        "message": "Buscar por rede ou domínio"
+    },
+    "networks.filter.all": {
+        "message": "Todos"
+    },
+    "networks.filter.active": {
+        "message": "Ativos"
+    },
+    "networks.filter.overlapping": {
+        "message": "Sobrepostos"
+    },
+    "networks.empty.title": {
+        "message": "Nenhum recurso disponível"
+    },
+    "networks.empty.description": {
+        "message": "Você não tem nenhum recurso de rede disponível ou não tem acesso a nenhum deles."
+    },
+    "networks.selected": {
+        "message": "Selecionado"
+    },
+    "networks.unselected": {
+        "message": "Não selecionado"
+    },
+    "networks.ips.heading": {
+        "message": "IPs resolvidos"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} de {total} ativos"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Ativar todos"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Desativar todos"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Buscar nós de saída"
+    },
+    "exitNodes.none": {
+        "message": "Nenhum"
+    },
+    "exitNodes.empty.title": {
+        "message": "Nenhum nó de saída disponível"
+    },
+    "exitNodes.empty.description": {
+        "message": "Nenhum nó de saída foi compartilhado com este peer."
+    },
+    "exitNodes.card.title": {
+        "message": "Nó de saída"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Ativo"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inativo"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Nenhum"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Conexão direta sem um nó de saída"
+    },
+    "quickActions.connect": {
+        "message": "Conectar"
+    },
+    "quickActions.disconnect": {
+        "message": "Desconectar"
+    },
+    "daemon.unavailable.title": {
+        "message": "O serviço do NetBird não está em execução"
+    },
+    "daemon.unavailable.description": {
+        "message": "O aplicativo reconectará automaticamente assim que o serviço estiver em execução."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentação"
+    },
+    "daemon.outdated.title": {
+        "message": "O NetBird Client está desatualizado"
+    },
+    "daemon.outdated.description": {
+        "message": "A nova GUI não é compatível com o seu cliente mais antigo. Atualize o seu cliente para usar o novo aplicativo."
+    },
+    "daemon.outdated.download": {
+        "message": "Baixar a versão mais recente"
+    },
+    "error.jwt_clock_skew": {
+        "message": "Falha no login: o relógio deste dispositivo está fora de sincronia com o servidor. Sincronize o relógio do sistema e tente novamente."
+    },
+    "error.jwt_expired": {
+        "message": "O seu token de login expirou. Faça login novamente."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Falha no login: a assinatura do token é inválida. Entre em contato com o seu administrador."
+    },
+    "error.session_expired": {
+        "message": "A sua sessão expirou. Faça login novamente."
+    },
+    "error.invalid_setup_key": {
+        "message": "A chave de configuração está ausente ou é inválida."
+    },
+    "error.permission_denied": {
+        "message": "O login foi rejeitado pelo servidor."
+    },
+    "error.daemon_unreachable": {
+        "message": "O daemon do NetBird não está respondendo. Verifique se o serviço está em execução."
+    },
+    "error.settings_locked": {
+        "message": "As configurações não podem ser alteradas neste dispositivo: um administrador bloqueou-as."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Esta configuração é gerida pela sua organização e não pode ser alterada."
+    },
+    "error.unknown": {
+        "message": "A operação falhou."
+    },
+    "error.elevation_unavailable": {
+        "message": "O NetBird não conseguiu solicitar a este sistema os privilégios necessários. Execute isto em vez disso:"
+    },
+    "error.elevation_failed": {
+        "message": "Não foi possível aplicar a alteração com privilégios elevados. Execute isto em vez disso:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "privilégios de root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "privilégios de administrador"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Requer {actor}. Execute isto em vez disso:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Você pode desativar isto, mas ativar novamente requer {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Você pode ativar isto, mas desativar novamente requer {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Aguardando a autorização…"
+    }
+}
diff --git a/client/ui/i18n/locales/ru/common.json b/client/ui/i18n/locales/ru/common.json
new file mode 100644
index 000000000..a0795c1da
--- /dev/null
+++ b/client/ui/i18n/locales/ru/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Отключено"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Не запущено"
+    },
+    "tray.status.error": {
+        "message": "Ошибка"
+    },
+    "tray.status.connected": {
+        "message": "Подключено"
+    },
+    "tray.status.connecting": {
+        "message": "Подключение"
+    },
+    "tray.status.needsLogin": {
+        "message": "Требуется вход"
+    },
+    "tray.status.loginFailed": {
+        "message": "Ошибка входа"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Сеанс истёк"
+    },
+    "tray.session.expiresIn": {
+        "message": "Сеанс истекает через {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "менее чем минуту"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 минуту"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} минут"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 час"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} часов"
+    },
+    "tray.session.unit.day": {
+        "message": "1 день"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} дней"
+    },
+    "tray.menu.open": {
+        "message": "Открыть NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Подключиться"
+    },
+    "tray.menu.disconnect": {
+        "message": "Отключиться"
+    },
+    "tray.menu.exitNode": {
+        "message": "Выходной узел"
+    },
+    "tray.menu.networks": {
+        "message": "Ресурсы"
+    },
+    "tray.menu.profiles": {
+        "message": "Профили"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Управление профилями"
+    },
+    "tray.menu.settings": {
+        "message": "Настройки…"
+    },
+    "tray.menu.debugBundle": {
+        "message": "Создать отладочный пакет"
+    },
+    "tray.menu.about": {
+        "message": "Помощь и поддержка"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Документация"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Диагностика"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Загрузить последнюю версию"
+    },
+    "tray.menu.installVersion": {
+        "message": "Установить версию {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Демон: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Выйти из NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "Служба NetBird устарела"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Обновите службу NetBird, чтобы использовать это приложение."
+    },
+    "notify.update.title": {
+        "message": "Доступно обновление NetBird"
+    },
+    "notify.update.body": {
+        "message": "Доступна версия NetBird {version}."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Ваш администратор требует установить это обновление."
+    },
+    "notify.error.title": {
+        "message": "Ошибка"
+    },
+    "notify.error.connect": {
+        "message": "Не удалось подключиться"
+    },
+    "notify.error.disconnect": {
+        "message": "Не удалось отключиться"
+    },
+    "notify.error.switchProfile": {
+        "message": "Не удалось переключиться на {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Не удалось обновить выходной узел {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Сеанс NetBird истёк"
+    },
+    "notify.sessionExpired.body": {
+        "message": "Сеанс NetBird истёк. Пожалуйста, войдите снова."
+    },
+    "notify.sessionWarning.title": {
+        "message": "Сеанс скоро истечёт"
+    },
+    "notify.sessionWarning.body": {
+        "message": "Сеанс NetBird истекает через {remaining}. Нажмите «Продлить сейчас», чтобы продлить сеанс."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Сеанс NetBird скоро истечёт. Нажмите «Продлить сейчас», чтобы продлить сеанс."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Продлить сейчас"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Закрыть"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Не удалось продлить сеанс NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Сеанс NetBird продлён"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Сеанс обновлён."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Неверный срок действия сеанса"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "Сервер передал неверный срок действия сеанса. Пожалуйста, войдите снова."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Настройки NetBird обновлены"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Конфигурация NetBird была обновлена в соответствии с вашей ИТ-политикой."
+    },
+    "common.cancel": {
+        "message": "Отмена"
+    },
+    "common.save": {
+        "message": "Сохранить"
+    },
+    "common.saveChanges": {
+        "message": "Сохранить изменения"
+    },
+    "common.saving": {
+        "message": "Сохранение…"
+    },
+    "common.close": {
+        "message": "Закрыть"
+    },
+    "common.copy": {
+        "message": "Копировать"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Показать или скрыть пароль"
+    },
+    "common.increase": {
+        "message": "Увеличить"
+    },
+    "common.decrease": {
+        "message": "Уменьшить"
+    },
+    "common.delete": {
+        "message": "Удалить"
+    },
+    "common.create": {
+        "message": "Создать"
+    },
+    "common.add": {
+        "message": "Добавить"
+    },
+    "common.remove": {
+        "message": "Убрать"
+    },
+    "common.refresh": {
+        "message": "Обновить"
+    },
+    "common.loading": {
+        "message": "Загрузка…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Ничего не найдено"
+    },
+    "common.noResults.description": {
+        "message": "Ничего не найдено. Попробуйте изменить поисковый запрос или фильтры."
+    },
+    "notConnected.title": {
+        "message": "Отключено"
+    },
+    "notConnected.description": {
+        "message": "Сначала подключитесь к NetBird, чтобы увидеть подробную информацию о пирах, сетевых ресурсах и выходных узлах."
+    },
+    "connect.status.disconnected": {
+        "message": "Отключено"
+    },
+    "connect.status.connecting": {
+        "message": "Подключение…"
+    },
+    "connect.status.connected": {
+        "message": "Подключено"
+    },
+    "connect.status.disconnecting": {
+        "message": "Отключение…"
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Демон недоступен"
+    },
+    "connect.status.loginRequired": {
+        "message": "Требуется вход"
+    },
+    "connect.error.loginTitle": {
+        "message": "Не удалось войти"
+    },
+    "connect.error.connectTitle": {
+        "message": "Не удалось подключиться"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Не удалось отключиться"
+    },
+    "nav.peers.title": {
+        "message": "Пиры"
+    },
+    "nav.peers.description": {
+        "message": "{connected} из {total} подключено"
+    },
+    "nav.resources.title": {
+        "message": "Ресурсы"
+    },
+    "nav.resources.description": {
+        "message": "{active} из {total} активно"
+    },
+    "nav.exitNode.title": {
+        "message": "Выходные узлы"
+    },
+    "nav.exitNode.none": {
+        "message": "Не активен"
+    },
+    "nav.exitNode.using": {
+        "message": "Через {name}"
+    },
+    "header.openSettings": {
+        "message": "Открыть настройки"
+    },
+    "header.togglePanel": {
+        "message": "Показать или скрыть боковую панель"
+    },
+    "profile.selector.loading": {
+        "message": "Загрузка…"
+    },
+    "profile.selector.noProfile": {
+        "message": "Нет профиля"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Поиск профиля по имени…"
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Профили не найдены"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Измените поисковый запрос или создайте новый профиль."
+    },
+    "profile.selector.newProfile": {
+        "message": "Новый профиль"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Дополнительные параметры"
+    },
+    "profile.selector.deregister": {
+        "message": "Отменить регистрацию"
+    },
+    "profile.selector.delete": {
+        "message": "Удалить"
+    },
+    "profile.selector.switchTo": {
+        "message": "Переключиться на этот профиль"
+    },
+    "profile.selector.edit": {
+        "message": "Изменить"
+    },
+    "profile.edit.title": {
+        "message": "Изменить профиль"
+    },
+    "profile.edit.submit": {
+        "message": "Сохранить изменения"
+    },
+    "profile.dialog.title": {
+        "message": "Введите имя профиля"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Имя профиля"
+    },
+    "profile.dialog.description": {
+        "message": "Задайте легко узнаваемое имя для профиля."
+    },
+    "profile.dialog.placeholder": {
+        "message": "например, работа"
+    },
+    "profile.dialog.submit": {
+        "message": "Добавить профиль"
+    },
+    "profile.dialog.required": {
+        "message": "Введите имя профиля, например работа или дом"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Используйте NetBird Cloud или собственный сервер."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Не удалось связаться с сервером. Проверьте URL или всё равно добавьте профиль, если уверены, что он правильный."
+    },
+    "header.menu.settings": {
+        "message": "Настройки…"
+    },
+    "header.menu.defaultView": {
+        "message": "Обычный вид"
+    },
+    "header.menu.advancedView": {
+        "message": "Расширенный вид"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Доступно обновление"
+    },
+    "header.menu.open": {
+        "message": "Открыть меню"
+    },
+    "header.profile.switch": {
+        "message": "Сменить профиль"
+    },
+    "connect.toggle.label": {
+        "message": "Переключить подключение NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Локальные IP-адреса"
+    },
+    "common.search": {
+        "message": "Поиск"
+    },
+    "common.filter": {
+        "message": "Фильтр"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Выбрать выходной узел"
+    },
+    "peers.row.label": {
+        "message": "Открыть подробности для {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Сведения об узле"
+    },
+    "networks.row.toggle": {
+        "message": "Переключить {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Переключить все видимые ресурсы"
+    },
+    "profile.switch.title": {
+        "message": "Переключиться на профиль «{name}»?"
+    },
+    "profile.switch.message": {
+        "message": "Вы действительно хотите переключить профиль?\nТекущий профиль будет отключён."
+    },
+    "profile.switch.confirm": {
+        "message": "Подтвердить"
+    },
+    "profile.deregister.title": {
+        "message": "Отменить регистрацию профиля «{name}»?"
+    },
+    "profile.deregister.message": {
+        "message": "Вы действительно хотите отменить регистрацию этого профиля?\nДля его использования потребуется войти снова."
+    },
+    "profile.deregister.confirm": {
+        "message": "Отменить регистрацию"
+    },
+    "profile.delete.title": {
+        "message": "Удалить профиль «{name}»?"
+    },
+    "profile.delete.message": {
+        "message": "Вы действительно хотите удалить этот профиль?\nЭто действие нельзя отменить."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Активные профили нельзя удалить. Переключитесь на другой профиль, прежде чем удалять этот."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Профиль по умолчанию нельзя удалить."
+    },
+    "profile.error.switchTitle": {
+        "message": "Не удалось переключить профиль"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Не удалось отменить регистрацию профиля"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Не удалось удалить профиль"
+    },
+    "profile.error.createTitle": {
+        "message": "Не удалось создать профиль"
+    },
+    "profile.error.editTitle": {
+        "message": "Не удалось изменить профиль"
+    },
+    "profile.error.loadTitle": {
+        "message": "Не удалось загрузить профили"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Активный профиль"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Переключить профиль"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Другое"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Добавить профиль"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Управление профилями"
+    },
+    "profile.dropdown.settings": {
+        "message": "Настройки"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Профили"
+    },
+    "settings.profiles.intro": {
+        "message": "Управляйте несколькими профилями NetBird параллельно — например, рабочими и личными учётными записями или разными серверами управления. Ниже можно добавлять профили, отменять их регистрацию и удалять их."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Добавить профиль"
+    },
+    "settings.profiles.active": {
+        "message": "Активен"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Нет профилей"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Создайте профиль, чтобы подключиться к серверу управления NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Не удалось загрузить настройки"
+    },
+    "settings.error.saveTitle": {
+        "message": "Не удалось сохранить настройки"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Не удалось создать отладочный пакет"
+    },
+    "settings.nav.label": {
+        "message": "Разделы настроек"
+    },
+    "settings.tabs.general": {
+        "message": "Общие"
+    },
+    "settings.tabs.network": {
+        "message": "Сеть"
+    },
+    "settings.tabs.security": {
+        "message": "Безопасность"
+    },
+    "settings.tabs.profiles": {
+        "message": "Профили"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Дополнительно"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Диагностика"
+    },
+    "settings.tabs.about": {
+        "message": "О программе"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Доступно обновление"
+    },
+    "settings.general.section.general": {
+        "message": "Общие"
+    },
+    "settings.general.section.connection": {
+        "message": "Подключение"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Подключаться при запуске"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Автоматически устанавливать подключение при запуске службы."
+    },
+    "settings.general.notifications.label": {
+        "message": "Уведомления на рабочем столе"
+    },
+    "settings.general.notifications.help": {
+        "message": "Показывать уведомления о новых обновлениях и событиях подключения."
+    },
+    "settings.general.autostart.label": {
+        "message": "Запускать интерфейс NetBird при входе"
+    },
+    "settings.general.autostart.help": {
+        "message": "Автоматически запускать интерфейс NetBird при входе в систему. Это влияет только на графический интерфейс, но не на фоновую службу."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Не удалось изменить автозапуск"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Оставаться подключённым после выхода"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "Соединение остаётся активным в фоне после закрытия NetBird. Оно прервётся, только когда вы отключите его сами."
+    },
+    "settings.general.language.label": {
+        "message": "Язык интерфейса"
+    },
+    "settings.general.language.help": {
+        "message": "Выберите язык интерфейса NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Поиск языка…"
+    },
+    "settings.general.language.empty": {
+        "message": "Языки не найдены."
+    },
+    "settings.general.theme.label": {
+        "message": "Тема"
+    },
+    "settings.general.theme.help": {
+        "message": "Выберите светлую или тёмную тему либо следуйте системной."
+    },
+    "settings.general.theme.system": {
+        "message": "Системная"
+    },
+    "settings.general.theme.light": {
+        "message": "Светлая"
+    },
+    "settings.general.theme.dark": {
+        "message": "Тёмная"
+    },
+    "settings.general.management.label": {
+        "message": "Сервер управления"
+    },
+    "settings.general.management.help": {
+        "message": "Подключайтесь к NetBird Cloud или к собственному серверу управления. Изменения вызовут переподключение клиента."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Собственный сервер"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Введите корректный URL, например https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Не удалось связаться с сервером. Проверьте URL или всё равно сохраните, если уверены, что он правильный."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Переключиться на NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Это отключит ваш собственный сервер.\nВозможно, потребуется войти снова."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Переключиться на Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Подключение"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Маршрутизация и DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Переподключаться при смене сети"
+    },
+    "settings.network.monitor.help": {
+        "message": "Отслеживать сеть и автоматически переподключаться при изменениях, таких как смена Wi-Fi, изменения Ethernet или выход из спящего режима."
+    },
+    "settings.network.dns.label": {
+        "message": "Включить DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Применять управляемые NetBird настройки DNS к системному резолверу."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Включить клиентские маршруты"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Принимать маршруты от других пиров для доступа к их сетям."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Включить серверные маршруты"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Анонсировать локальные маршруты этого хоста другим пирам."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Включить IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Использовать IPv6-адресацию для оверлейной сети NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Брандмауэр"
+    },
+    "settings.security.section.encryption": {
+        "message": "Шифрование"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Блокировать входящий трафик"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Отклонять незапрошенные подключения от пиров к этому устройству и сетям, которые оно маршрутизирует. Исходящий трафик не затрагивается."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Блокировать доступ к LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Запрещать пирам доступ к вашей локальной сети и её устройствам, когда это устройство маршрутизирует их трафик."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Включить квантовую устойчивость"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Добавить постквантовый обмен ключами через Rosenpass поверх WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Включить разрешающий режим"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Разрешать подключения к пирам без поддержки квантовой устойчивости."
+    },
+    "settings.ssh.section.server": {
+        "message": "Сервер"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Возможности"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Аутентификация"
+    },
+    "settings.ssh.server.label": {
+        "message": "Включить SSH-сервер"
+    },
+    "settings.ssh.server.help": {
+        "message": "Запускать SSH-сервер NetBird на этом хосте, чтобы другие пиры могли к нему подключаться."
+    },
+    "settings.ssh.root.label": {
+        "message": "Разрешить вход под root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Разрешить пирам входить под пользователем root. Отключите, чтобы требовать непривилегированную учётную запись."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Разрешить SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Безопасно передавать файлы через стандартные клиенты SFTP или SCP."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Локальная переадресация портов"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Разрешить подключающимся пирам туннелировать локальные порты к службам, доступным с этого хоста."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Удалённая переадресация портов"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Разрешить подключающимся пирам пробрасывать порты этого хоста на свою машину."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Включить аутентификацию JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Проверять каждую сессию SSH через ваш IdP для идентификации пользователя и аудита. Отключите, чтобы полагаться только на сетевые политики ACL — полезно, когда IdP недоступен."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL кэша JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Как долго этот клиент кэширует JWT, прежде чем снова запрашивать его при исходящих SSH-подключениях. Установите 0, чтобы отключить кэширование и аутентифицироваться при каждом подключении."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "сек."
+    },
+    "settings.advanced.section.interface": {
+        "message": "Интерфейс"
+    },
+    "settings.advanced.section.security": {
+        "message": "Безопасность"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Имя"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Используйте от 1 до 15 букв, цифр, точек, дефисов или подчёркиваний."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Должно начинаться с «utun», за которым следует число (например, utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Порт"
+    },
+    "settings.advanced.port.error": {
+        "message": "Введите порт от {min} до {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Если задано 0, будет использован случайный свободный порт."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Введите значение MTU от {min} до {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Общий ключ"
+    },
+    "settings.advanced.psk.help": {
+        "message": "Необязательный PSK WireGuard для дополнительного симметричного шифрования. Это не то же самое, что ключ установки NetBird. Вы будете обмениваться данными только с пирами, использующими тот же общий ключ."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Отладочный пакет"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Анонимизировать конфиденциальную информацию"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Скрывает IP-адреса, домены и другие конфиденциальные значения."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Режим «По умолчанию» оставляет внутренние IPv4-адреса и имена пиров читаемыми для поддержки. Режим «Строгий» дополнительно анонимизирует частные (RFC 1918), CGNAT и link-local IP-адреса, имена пиров и публичные ключи WireGuard. Повторяющиеся значения заменяются одним и тем же заполнителем, поэтому пиры остаются различимыми. Используйте режим «Строгий», когда передаёте отладочный пакет за пределы вашей организации."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Нет"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "По умолчанию"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Строгий"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Включить сведения о системе"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Включить ОС, ядро, сетевые интерфейсы и таблицы маршрутизации."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Загрузить пакет на серверы NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Возвращает ключ загрузки, который можно передать поддержке NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Включить журналы TRACE"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Повышает уровень журналирования до TRACE и затем восстанавливает прежний."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Сеанс записи"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Переподключается и ожидает, чтобы вы могли воспроизвести проблему."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Записывать сетевые пакеты"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Сохраняет .pcap сетевого трафика во время сеанса записи."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Длительность записи"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Как долго длится сеанс записи."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "мин."
+    },
+    "settings.troubleshooting.create": {
+        "message": "Создать отладочный пакет"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Сбор журналов, сведений о системе и состояния подключения. Обычно это занимает несколько секунд — не закрывайте это окно до завершения."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Отмена…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Отладочный пакет успешно загружен!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Пакет сохранён"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Поделитесь ключом загрузки ниже с <docs>поддержкой NetBird</docs>. Локальная копия также сохранена на вашем устройстве."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Отладочный пакет сохранён локально."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Копировать ключ"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Открыть папку"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Открыть расположение файла"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Не удалось загрузить: {reason} Пакет всё равно сохранён локально."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Не удалось загрузить. Пакет всё равно сохранён локально."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Переподключение NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Сбор отладочных журналов"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Создание отладочного пакета…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Загрузка в NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Отмена…"
+    },
+    "settings.about.client": {
+        "message": "Клиент NetBird v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "Клиент NetBird"
+    },
+    "settings.about.development": {
+        "message": "[Разработка]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Все права защищены."
+    },
+    "settings.about.links.imprint": {
+        "message": "Правовая информация"
+    },
+    "settings.about.links.privacy": {
+        "message": "Конфиденциальность"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Условия использования"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Форум"
+    },
+    "settings.about.community.documentation": {
+        "message": "Документация"
+    },
+    "settings.about.community.feedback": {
+        "message": "Обратная связь"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} готов к установке."
+    },
+    "update.banner.later": {
+        "message": "Позже"
+    },
+    "update.banner.installNow": {
+        "message": "Установить сейчас"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "Версия {version} доступна для загрузки."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "Версия {version} доступна для установки."
+    },
+    "update.card.whatsNew": {
+        "message": "Что нового?"
+    },
+    "update.card.installNow": {
+        "message": "Установить сейчас"
+    },
+    "update.card.getInstaller": {
+        "message": "Загрузить"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird проверяет обновления в фоновом режиме."
+    },
+    "update.card.changelog": {
+        "message": "Список изменений"
+    },
+    "update.card.onLatestVersion": {
+        "message": "У вас установлена последняя версия"
+    },
+    "update.header.tooltip": {
+        "message": "Доступно обновление"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Обновление NetBird до v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Обновление NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Доступна более новая версия, идёт её установка. NetBird автоматически перезапустится после завершения обновления."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "Обновление занимает слишком много времени"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "Установка {target} заняла слишком много времени и не завершилась."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Обновление остановлено"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "Обновление до {target} было отменено до завершения."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Не удалось установить обновление"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Не удалось установить обновление до {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "неизвестная ошибка"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "новой версии"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Не удалось загрузить состояние обновления"
+    },
+    "update.error.triggerTitle": {
+        "message": "Не удалось запустить обновление"
+    },
+    "update.page.versionLine": {
+        "message": "Обновление клиента до версии {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Обновление клиента."
+    },
+    "update.page.outdated": {
+        "message": "Версия вашего клиента старше версии автообновления, заданной на сервере управления."
+    },
+    "update.page.status.running": {
+        "message": "Обновление"
+    },
+    "update.page.status.timeout": {
+        "message": "Время ожидания обновления истекло. Повторите попытку."
+    },
+    "update.page.status.canceled": {
+        "message": "Обновление отменено."
+    },
+    "update.page.status.failed": {
+        "message": "Не удалось обновить: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "неизвестная ошибка обновления"
+    },
+    "update.page.failedTitle": {
+        "message": "Не удалось обновить"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Время ожидания обновления истекло."
+    },
+    "update.page.dontClose": {
+        "message": "Пожалуйста, не закрывайте это окно."
+    },
+    "update.page.updating": {
+        "message": "Обновление…"
+    },
+    "update.page.complete": {
+        "message": "Обновление завершено"
+    },
+    "update.page.failed": {
+        "message": "Обновление не удалось"
+    },
+    "window.title.settings": {
+        "message": "Настройки"
+    },
+    "window.title.signIn": {
+        "message": "Вход"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Истечение сеанса"
+    },
+    "window.title.updating": {
+        "message": "Обновление"
+    },
+    "window.title.welcome": {
+        "message": "Добро пожаловать в NetBird"
+    },
+    "window.title.error": {
+        "message": "Ошибка"
+    },
+    "welcome.title": {
+        "message": "Найдите NetBird в системном трее"
+    },
+    "welcome.titleMac": {
+        "message": "Найдите NetBird в строке меню"
+    },
+    "welcome.description": {
+        "message": "NetBird находится в системном трее. Нажмите на значок, чтобы подключиться, переключить профиль или открыть настройки."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird находится в строке меню. Нажмите на значок, чтобы подключиться, переключить профиль или открыть настройки."
+    },
+    "welcome.continue": {
+        "message": "Продолжить"
+    },
+    "welcome.back": {
+        "message": "Назад"
+    },
+    "welcome.management.title": {
+        "message": "Настройка NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Нажмите «Продолжить», чтобы начать, или выберите «Собственный сервер», если у вас есть свой сервер NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Используйте наш облачный сервис. Настройка не требуется."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Собственный сервер"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Подключитесь к собственному серверу управления."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL сервера управления"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Введите корректный URL, например https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Не удалось связаться с сервером. Проверьте URL или сеть, затем продолжите, если уверены, что он правильный."
+    },
+    "welcome.management.checking": {
+        "message": "Проверка…"
+    },
+    "browserLogin.title": {
+        "message": "Завершите вход в браузере"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Мы открыли вкладку браузера, чтобы вы могли войти в аккаунт. Не видите вкладку?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Повторить"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Не удалось открыть браузер"
+    },
+    "sessionExpiration.title": {
+        "message": "Сеанс скоро истечёт"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Ваш сеанс истечёт"
+    },
+    "sessionExpiration.description": {
+        "message": "Это устройство скоро будет отключено. Продлите сеанс через вход в браузере."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Вход в браузере сохранит подключение этого устройства к вашей сети."
+    },
+    "sessionExpiration.stay": {
+        "message": "Продлить сеанс"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Войти"
+    },
+    "sessionExpiration.logout": {
+        "message": "Выйти"
+    },
+    "sessionExpiration.expired": {
+        "message": "Сеанс истёк"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Устройство отключено. Войдите через браузер, чтобы переподключиться."
+    },
+    "sessionExpiration.close": {
+        "message": "Закрыть"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Не удалось продлить сеанс"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Не удалось выйти"
+    },
+    "peers.search.placeholder": {
+        "message": "Поиск по имени или IP"
+    },
+    "peers.filter.all": {
+        "message": "Все"
+    },
+    "peers.filter.online": {
+        "message": "В сети"
+    },
+    "peers.filter.offline": {
+        "message": "Не в сети"
+    },
+    "peers.empty.title": {
+        "message": "Нет доступных пиров"
+    },
+    "peers.empty.description": {
+        "message": "У вас нет доступных пиров или нет доступа ни к одному из них."
+    },
+    "peers.details.domain": {
+        "message": "Домен"
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird IP"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird IPv6"
+    },
+    "peers.details.publicKey": {
+        "message": "Открытый ключ"
+    },
+    "peers.details.connection": {
+        "message": "Подключение"
+    },
+    "peers.details.latency": {
+        "message": "Задержка"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Последнее рукопожатие"
+    },
+    "peers.details.statusSince": {
+        "message": "Последнее обновление подключения"
+    },
+    "peers.details.bytes": {
+        "message": "Байты"
+    },
+    "peers.details.bytesSent": {
+        "message": "Отправлено"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Получено"
+    },
+    "peers.details.localIce": {
+        "message": "Локальный ICE"
+    },
+    "peers.details.remoteIce": {
+        "message": "Удалённый ICE"
+    },
+    "peers.details.never": {
+        "message": "Никогда"
+    },
+    "peers.details.justNow": {
+        "message": "Только что"
+    },
+    "peers.details.refresh": {
+        "message": "Обновить"
+    },
+    "peers.status.connected": {
+        "message": "Подключено"
+    },
+    "peers.status.connecting": {
+        "message": "Подключение"
+    },
+    "peers.status.disconnected": {
+        "message": "Отключено"
+    },
+    "peers.details.relayAddress": {
+        "message": "Ретранслятор"
+    },
+    "peers.details.networks": {
+        "message": "Ресурсы"
+    },
+    "peers.details.relayed": {
+        "message": "Через ретранслятор"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass включён"
+    },
+    "networks.search.placeholder": {
+        "message": "Поиск по сети или домену"
+    },
+    "networks.filter.all": {
+        "message": "Все"
+    },
+    "networks.filter.active": {
+        "message": "Активные"
+    },
+    "networks.filter.overlapping": {
+        "message": "Пересекающиеся"
+    },
+    "networks.empty.title": {
+        "message": "Нет доступных ресурсов"
+    },
+    "networks.empty.description": {
+        "message": "У вас нет доступных сетевых ресурсов или нет доступа ни к одному из них."
+    },
+    "networks.selected": {
+        "message": "Выбрано"
+    },
+    "networks.unselected": {
+        "message": "Не выбрано"
+    },
+    "networks.ips.heading": {
+        "message": "Распознанные IP-адреса"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} из {total} активно"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Включить все"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Отключить все"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Поиск выходных узлов"
+    },
+    "exitNodes.none": {
+        "message": "Нет"
+    },
+    "exitNodes.empty.title": {
+        "message": "Нет доступных выходных узлов"
+    },
+    "exitNodes.empty.description": {
+        "message": "Этому пиру не предоставлены выходные узлы."
+    },
+    "exitNodes.card.title": {
+        "message": "Выходной узел"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Активен"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Неактивен"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Нет"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Прямое подключение без выходного узла"
+    },
+    "quickActions.connect": {
+        "message": "Подключиться"
+    },
+    "quickActions.disconnect": {
+        "message": "Отключиться"
+    },
+    "daemon.unavailable.title": {
+        "message": "Служба NetBird не запущена"
+    },
+    "daemon.unavailable.description": {
+        "message": "Приложение автоматически переподключится, как только служба будет запущена."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Документация"
+    },
+    "daemon.outdated.title": {
+        "message": "Клиент NetBird устарел"
+    },
+    "daemon.outdated.description": {
+        "message": "Новый GUI несовместим с вашим более старым клиентом. Обновите клиент, чтобы использовать новое приложение."
+    },
+    "daemon.outdated.download": {
+        "message": "Скачать последнюю версию"
+    },
+    "error.jwt_clock_skew": {
+        "message": "Не удалось войти: часы этого устройства рассинхронизированы с сервером. Синхронизируйте системные часы и повторите попытку."
+    },
+    "error.jwt_expired": {
+        "message": "Срок действия токена входа истёк. Войдите снова."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Не удалось войти: недействительная подпись токена. Обратитесь к администратору."
+    },
+    "error.session_expired": {
+        "message": "Ваш сеанс истёк. Войдите снова."
+    },
+    "error.invalid_setup_key": {
+        "message": "Ключ установки отсутствует или недействителен."
+    },
+    "error.permission_denied": {
+        "message": "Сервер отклонил вход."
+    },
+    "error.daemon_unreachable": {
+        "message": "Демон NetBird не отвечает. Проверьте, запущена ли служба."
+    },
+    "error.settings_locked": {
+        "message": "Настройки на этом устройстве изменить нельзя: администратор заблокировал их."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Эта настройка управляется вашей организацией и не может быть изменена."
+    },
+    "error.unknown": {
+        "message": "Не удалось выполнить операцию."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird не смог запросить у этой системы нужные права. Выполните вместо этого:"
+    },
+    "error.elevation_failed": {
+        "message": "Не удалось применить изменение с повышенными правами. Выполните вместо этого:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "права root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "права администратора"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Требуются {actor}. Выполните вместо этого:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Отключить можно, но чтобы включить снова, нужны {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Включить можно, но чтобы отключить снова, нужны {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Ожидание авторизации…"
+    }
+}
diff --git a/client/ui/i18n/locales/uk/common.json b/client/ui/i18n/locales/uk/common.json
new file mode 100644
index 000000000..01d2f4452
--- /dev/null
+++ b/client/ui/i18n/locales/uk/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Відключено"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Не запущено"
+    },
+    "tray.status.error": {
+        "message": "Помилка"
+    },
+    "tray.status.connected": {
+        "message": "Підключено"
+    },
+    "tray.status.connecting": {
+        "message": "Підключення"
+    },
+    "tray.status.needsLogin": {
+        "message": "Потрібно ввійти"
+    },
+    "tray.status.loginFailed": {
+        "message": "Помилка входу"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Сеанс закінчився"
+    },
+    "tray.session.expiresIn": {
+        "message": "До завершення сеансу: {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "менше хвилини"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 хв."
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} хв."
+    },
+    "tray.session.unit.hour": {
+        "message": "1 год."
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} год."
+    },
+    "tray.session.unit.day": {
+        "message": "1 дн."
+    },
+    "tray.session.unit.days": {
+        "message": "{count} дн."
+    },
+    "tray.menu.open": {
+        "message": "Відкрити NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Підключитися"
+    },
+    "tray.menu.disconnect": {
+        "message": "Відключитися"
+    },
+    "tray.menu.exitNode": {
+        "message": "Вихідний вузол"
+    },
+    "tray.menu.networks": {
+        "message": "Ресурси"
+    },
+    "tray.menu.profiles": {
+        "message": "Профілі"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Керування профілями"
+    },
+    "tray.menu.settings": {
+        "message": "Налаштування…"
+    },
+    "tray.menu.debugBundle": {
+        "message": "Створити архів діагностики"
+    },
+    "tray.menu.about": {
+        "message": "Допомога та підтримка"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Документація"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Діагностика"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Завантажити останню версію"
+    },
+    "tray.menu.installVersion": {
+        "message": "Встановити версію {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "Графічний інтерфейс: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Служба: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Вийти з NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "Служба NetBird застаріла"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Оновіть службу NetBird, щоб користуватися застосунком."
+    },
+    "notify.update.title": {
+        "message": "Доступне оновлення NetBird"
+    },
+    "notify.update.body": {
+        "message": "Доступна версія NetBird {version}."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Ваш адміністратор вимагає встановити це оновлення."
+    },
+    "notify.error.title": {
+        "message": "Помилка"
+    },
+    "notify.error.connect": {
+        "message": "Не вдалося підключитися"
+    },
+    "notify.error.disconnect": {
+        "message": "Не вдалося відключитися"
+    },
+    "notify.error.switchProfile": {
+        "message": "Не вдалося перемкнутися на {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Не вдалося оновити вихідний вузол {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Сеанс NetBird закінчився"
+    },
+    "notify.sessionExpired.body": {
+        "message": "Ваш сеанс NetBird закінчився. Будь ласка, увійдіть знову."
+    },
+    "notify.sessionWarning.title": {
+        "message": "Сеанс невдовзі закінчиться"
+    },
+    "notify.sessionWarning.body": {
+        "message": "Ваш сеанс NetBird закінчиться через {remaining}. Натисніть «Продовжити зараз», щоб оновити його."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Ваш сеанс NetBird невдовзі закінчиться. Натисніть «Продовжити зараз», щоб оновити його."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Продовжити зараз"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Закрити"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Не вдалося продовжити сеанс NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Сеанс NetBird продовжено"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Ваш сеанс успішно продовжено."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Недійсний термін дії сеансу"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "Сервер надіслав недійсний термін дії сеансу. Будь ласка, увійдіть знову."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Налаштування NetBird оновлено"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Конфігурацію NetBird оновлено відповідно до політики вашої організації."
+    },
+    "common.cancel": {
+        "message": "Скасувати"
+    },
+    "common.save": {
+        "message": "Зберегти"
+    },
+    "common.saveChanges": {
+        "message": "Зберегти зміни"
+    },
+    "common.saving": {
+        "message": "Збереження…"
+    },
+    "common.close": {
+        "message": "Закрити"
+    },
+    "common.copy": {
+        "message": "Копіювати"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Показати/сховати пароль"
+    },
+    "common.increase": {
+        "message": "Збільшити"
+    },
+    "common.decrease": {
+        "message": "Зменшити"
+    },
+    "common.delete": {
+        "message": "Видалити"
+    },
+    "common.create": {
+        "message": "Створити"
+    },
+    "common.add": {
+        "message": "Додати"
+    },
+    "common.remove": {
+        "message": "Вилучити"
+    },
+    "common.refresh": {
+        "message": "Оновити"
+    },
+    "common.loading": {
+        "message": "Завантаження…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Результатів не знайдено"
+    },
+    "common.noResults.description": {
+        "message": "Ми не змогли нічого знайти. Спробуйте змінити пошуковий запит або налаштування фільтрів."
+    },
+    "notConnected.title": {
+        "message": "Відключено"
+    },
+    "notConnected.description": {
+        "message": "Спочатку підключіться до NetBird, щоб переглянути детальну інформацію про піри, мережеві ресурси та вихідні вузли."
+    },
+    "connect.status.disconnected": {
+        "message": "Відключено"
+    },
+    "connect.status.connecting": {
+        "message": "Підключення…"
+    },
+    "connect.status.connected": {
+        "message": "Підключено"
+    },
+    "connect.status.disconnecting": {
+        "message": "Відключення…"
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Служба недоступна"
+    },
+    "connect.status.loginRequired": {
+        "message": "Потрібно ввійти"
+    },
+    "connect.error.loginTitle": {
+        "message": "Помилка входу"
+    },
+    "connect.error.connectTitle": {
+        "message": "Помилка підключення"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Помилка відключення"
+    },
+    "nav.peers.title": {
+        "message": "Піри"
+    },
+    "nav.peers.description": {
+        "message": "Підключено {connected} з {total}"
+    },
+    "nav.resources.title": {
+        "message": "Ресурси"
+    },
+    "nav.resources.description": {
+        "message": "Активно {active} з {total}"
+    },
+    "nav.exitNode.title": {
+        "message": "Вихідні вузли"
+    },
+    "nav.exitNode.none": {
+        "message": "Неактивний"
+    },
+    "nav.exitNode.using": {
+        "message": "Через {name}"
+    },
+    "header.openSettings": {
+        "message": "Відкрити налаштування"
+    },
+    "header.togglePanel": {
+        "message": "Показати/сховати бічну панель"
+    },
+    "profile.selector.loading": {
+        "message": "Завантаження…"
+    },
+    "profile.selector.noProfile": {
+        "message": "Немає профілю"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Пошук профілю за назвою…"
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Профілів не знайдено"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Спробуйте змінити пошуковий запит або створіть новий профіль."
+    },
+    "profile.selector.newProfile": {
+        "message": "Новий профіль"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Додаткові параметри"
+    },
+    "profile.selector.deregister": {
+        "message": "Вийти з профілю"
+    },
+    "profile.selector.delete": {
+        "message": "Видалити"
+    },
+    "profile.selector.switchTo": {
+        "message": "Перемкнутися на цей профіль"
+    },
+    "profile.selector.edit": {
+        "message": "Редагувати"
+    },
+    "profile.edit.title": {
+        "message": "Редагувати профіль"
+    },
+    "profile.edit.submit": {
+        "message": "Зберегти зміни"
+    },
+    "profile.dialog.title": {
+        "message": "Введіть назву профілю"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Назва профілю"
+    },
+    "profile.dialog.description": {
+        "message": "Вкажіть зрозумілу назву для вашого профілю."
+    },
+    "profile.dialog.placeholder": {
+        "message": "наприклад, Робота"
+    },
+    "profile.dialog.submit": {
+        "message": "Додати профіль"
+    },
+    "profile.dialog.required": {
+        "message": "Будь ласка, введіть назву профілю, наприклад, «Робота» або «Дім»."
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Використовуйте NetBird Cloud або власний сервер."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Не вдалося підключитися до цього сервера. Перевірте URL-адресу або додайте профіль, якщо ви впевнені, що вона правильна."
+    },
+    "header.menu.settings": {
+        "message": "Налаштування…"
+    },
+    "header.menu.defaultView": {
+        "message": "Стандартний вигляд"
+    },
+    "header.menu.advancedView": {
+        "message": "Розширений вигляд"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Доступне оновлення"
+    },
+    "header.menu.open": {
+        "message": "Відкрити меню"
+    },
+    "header.profile.switch": {
+        "message": "Змінити профіль"
+    },
+    "connect.toggle.label": {
+        "message": "Перемкнути підключення NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Локальні IP-адреси"
+    },
+    "common.search": {
+        "message": "Пошук"
+    },
+    "common.filter": {
+        "message": "Фільтр"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Вибрати вихідний вузол"
+    },
+    "peers.row.label": {
+        "message": "Відкрити деталі для {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Деталі піра"
+    },
+    "networks.row.toggle": {
+        "message": "Перемкнути {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Перемкнути всі видимі ресурси"
+    },
+    "profile.switch.title": {
+        "message": "Перемкнутися на профіль «{name}»?"
+    },
+    "profile.switch.message": {
+        "message": "Ви впевнені, що хочете змінити профіль?\nВаш поточний профіль буде відключено."
+    },
+    "profile.switch.confirm": {
+        "message": "Підтвердити"
+    },
+    "profile.deregister.title": {
+        "message": "Вийти з профілю «{name}»?"
+    },
+    "profile.deregister.message": {
+        "message": "Ви впевнені, що хочете вийти з цього профілю?\nВам доведеться увійти знову, щоб використовувати його."
+    },
+    "profile.deregister.confirm": {
+        "message": "Вийти"
+    },
+    "profile.delete.title": {
+        "message": "Видалити профіль «{name}»?"
+    },
+    "profile.delete.message": {
+        "message": "Ви впевнені, що хочете видалити цей профіль?\nЦю дію неможливо скасувати."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Активні профілі не можна видаляти. Перемкніться на інший профіль перед видаленням цього."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Профіль за замовчуванням не можна видалити."
+    },
+    "profile.error.switchTitle": {
+        "message": "Помилка зміни профілю"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Помилка виходу з профілю"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Помилка видалення профілю"
+    },
+    "profile.error.createTitle": {
+        "message": "Помилка створення профілю"
+    },
+    "profile.error.editTitle": {
+        "message": "Помилка редагування профілю"
+    },
+    "profile.error.loadTitle": {
+        "message": "Помилка завантаження профілів"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Активний профіль"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Змінити профіль"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Інше"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Додати профіль"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Керування профілями"
+    },
+    "profile.dropdown.settings": {
+        "message": "Налаштування"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Профілі"
+    },
+    "settings.profiles.intro": {
+        "message": "Використовуйте кілька профілів NetBird одночасно, наприклад, робочий та особистий облікові записи або різні сервери керування. Додавайте профілі, виходьте з них або видаляйте їх нижче."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Додати профіль"
+    },
+    "settings.profiles.active": {
+        "message": "Активний"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Немає профілів"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Створіть профіль, щоб підключитися до сервера керування NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Помилка завантаження налаштувань"
+    },
+    "settings.error.saveTitle": {
+        "message": "Помилка збереження налаштувань"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Помилка створення архіву діагностики"
+    },
+    "settings.nav.label": {
+        "message": "Розділи налаштувань"
+    },
+    "settings.tabs.general": {
+        "message": "Загальні"
+    },
+    "settings.tabs.network": {
+        "message": "Мережа"
+    },
+    "settings.tabs.security": {
+        "message": "Безпека"
+    },
+    "settings.tabs.profiles": {
+        "message": "Профілі"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Розширені"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Діагностика"
+    },
+    "settings.tabs.about": {
+        "message": "Про програму"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Доступне оновлення"
+    },
+    "settings.general.section.general": {
+        "message": "Загальні"
+    },
+    "settings.general.section.connection": {
+        "message": "Підключення"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Підключитися під час запуску"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Автоматично встановлювати підключення під час запуску служби."
+    },
+    "settings.general.notifications.label": {
+        "message": "Сповіщення на робочому столі"
+    },
+    "settings.general.notifications.help": {
+        "message": "Показувати сповіщення на робочому столі про нові оновлення та події підключення."
+    },
+    "settings.general.autostart.label": {
+        "message": "Запускати інтерфейс NetBird під час входу"
+    },
+    "settings.general.autostart.help": {
+        "message": "Автоматично запускати інтерфейс NetBird під час входу в систему. Це стосується лише графічного інтерфейсу, а не фонової служби."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Помилка зміни автозапуску"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Залишатися підключеним після виходу"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "Підключення залишатиметься активним у фоновому режимі після закриття NetBird. Воно буде розірвано лише тоді, коли ви відключите його самостійно."
+    },
+    "settings.general.language.label": {
+        "message": "Мова інтерфейсу"
+    },
+    "settings.general.language.help": {
+        "message": "Виберіть мову для інтерфейсу NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Пошук мови…"
+    },
+    "settings.general.language.empty": {
+        "message": "Не знайдено жодної мови."
+    },
+    "settings.general.theme.label": {
+        "message": "Тема"
+    },
+    "settings.general.theme.help": {
+        "message": "Виберіть світлу чи темну тему або використовуйте системні налаштування."
+    },
+    "settings.general.theme.system": {
+        "message": "Системна"
+    },
+    "settings.general.theme.light": {
+        "message": "Світла"
+    },
+    "settings.general.theme.dark": {
+        "message": "Темна"
+    },
+    "settings.general.management.label": {
+        "message": "Сервер керування"
+    },
+    "settings.general.management.help": {
+        "message": "Підключайтеся до NetBird Cloud або власного сервера керування. Зміни призведуть до перепідключення клієнта."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Власний сервер"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Будь ласка, введіть дійсну URL-адресу, наприклад: https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Не вдалося підключитися до цього сервера. Перевірте URL-адресу або все одно збережіть зміни, якщо ви впевнені, що вона правильна."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Перемкнутися на NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Це відключить вас від власного сервера.\nВам може знадобитися увійти знову."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Перемкнутися на Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Підключення"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Маршрутизація та DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Перепідключатися при зміні мережі"
+    },
+    "settings.network.monitor.help": {
+        "message": "Відстежувати мережу й автоматично перепідключатися у разі таких змін, як перемикання Wi-Fi, зміна Ethernet-підключення або вихід із режиму сну."
+    },
+    "settings.network.dns.label": {
+        "message": "Увімкнути DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Застосовувати налаштування DNS, якими керує NetBird, до локального DNS-розв’язувача хоста."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Увімкнути клієнтські маршрути"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Приймати маршрути від інших пірів для доступу до їхніх мереж."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Увімкнути серверні маршрути"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Анонсувати локальні маршрути цього хоста іншим пірам."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Увімкнути IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Використовувати адресацію IPv6 для оверлейної мережі NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Брандмауер"
+    },
+    "settings.security.section.encryption": {
+        "message": "Шифрування"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Блокувати вхідний трафік"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Відхиляти небажані підключення від пірів до цього пристрою та будь-яких мереж, які він маршрутизує. Вихідний трафік не обмежується."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Блокувати доступ до LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Заборонити пірам отримувати доступ до вашої локальної мережі або її пристроїв, коли цей пристрій маршрутизує їхній трафік."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Увімкнути постквантову стійкість"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Додати постквантовий обмін ключами через Rosenpass поверх WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Увімкнути дозвільний режим"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Дозволити підключення до пірів без підтримки постквантової стійкості."
+    },
+    "settings.ssh.section.server": {
+        "message": "Сервер"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Можливості"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Автентифікація"
+    },
+    "settings.ssh.server.label": {
+        "message": "Увімкнути SSH-сервер"
+    },
+    "settings.ssh.server.help": {
+        "message": "Запустити SSH-сервер NetBird на цьому хості, щоб інші піри могли підключатися до нього."
+    },
+    "settings.ssh.root.label": {
+        "message": "Дозволити вхід як root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Дозволити пірам входити як користувач root. Вимкніть, щоб вимагати непривілейований обліковий запис."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Дозволити SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Безпечно передавати файли за допомогою нативних клієнтів SFTP або SCP."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Локальне переспрямування портів"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Дозволити пірам, що підключаються, переспрямовувати локальні порти до сервісів, доступних із цього хоста."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Віддалене переспрямування портів"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Дозволити підключеним пірам відкривати порти на цьому хості з переспрямуванням на свої машини."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Увімкнути JWT-автентифікацію"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Перевіряти кожен сеанс SSH через ваш IdP для ідентифікації користувачів та аудиту. Вимкніть, щоб покладатися лише на політики мережевих ACL, що корисно, коли IdP недоступний."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "Час кешування JWT (TTL)"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Як довго цей клієнт кешує JWT перед повторним запитом для вихідних SSH-з’єднань. Встановіть 0, щоб вимкнути кешування та проходити автентифікацію при кожному підключенні."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "сек."
+    },
+    "settings.advanced.section.interface": {
+        "message": "Інтерфейс"
+    },
+    "settings.advanced.section.security": {
+        "message": "Безпека"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Назва"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Використовуйте 1-15 літер, цифр, крапок, дефісів або підкреслень."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Повинно починатися з «utun», після якого має йти число (наприклад, utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Порт"
+    },
+    "settings.advanced.port.error": {
+        "message": "Введіть порт між {min} та {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Якщо встановлено 0, буде використано випадковий вільний порт."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Введіть значення MTU між {min} та {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Попередньо узгоджений ключ"
+    },
+    "settings.advanced.psk.help": {
+        "message": "Додатковий PSK WireGuard для симетричного шифрування. Це не те саме, що NetBird Setup Key. Ви зможете обмінюватися даними лише з тими пірами, які використовують такий самий попередньо узгоджений ключ."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Архів діагностики"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Анонімізувати чутливу інформацію"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Приховує IP-адреси, домени та інші конфіденційні дані."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "«Стандартний» залишає внутрішні адреси IPv4 та імена пірів читабельними для служби підтримки. «Суворий» додатково анонімізує приватні (RFC 1918), CGNAT- та link-local-адреси, імена пірів і публічні ключі WireGuard. Однакові значення замінюються тим самим псевдонімом, тож піри залишаються розрізнюваними. Використовуйте «Суворий», якщо ділитеся архівом за межами організації."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Вимкнено"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Стандартний"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Суворий"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Додати інформацію про систему"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Додати дані про ОС, ядро, мережеві інтерфейси та таблиці маршрутизації."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Завантажити архів на сервери NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Створює ключ завантаження, який можна передати службі підтримки NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Увімкнути журнали рівня TRACE"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Підвищує рівень журналювання до TRACE на час створення архіву та відновлює його після завершення."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Запис сеансу"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Перепідключає NetBird і чекає, щоб ви могли відтворити проблему."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Захоплювати мережеві пакети"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Зберігає файл .pcap із мережевим трафіком протягом сеансу захоплення."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Тривалість захоплення"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Скільки часу триває сеанс захоплення."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "хв."
+    },
+    "settings.troubleshooting.create": {
+        "message": "Створити архів"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Збір журналів, даних про систему та інформації про стан підключення. Зазвичай це займає хвилину. Ви можете продовжувати використовувати NetBird або закрити вікно налаштувань, поки процес триває."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Скасування…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Архів діагностики успішно завантажено!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Архів збережено"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Поділіться ключем завантаження нижче зі <docs>службою підтримки NetBird</docs>. Локальну копію також збережено на вашому пристрої."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Ваш архів діагностики збережено локально."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Копіювати ключ"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Відкрити папку"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Відкрити розташування файлу"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Помилка завантаження: {reason} Архів все одно збережено локально"
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Помилка завантаження. Архів все одно збережено локально."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Перепідключення NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Запис журналів діагностики"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Створення архіву діагностики…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Завантаження на сервери NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Скасування…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client"
+    },
+    "settings.about.development": {
+        "message": "[Розробка]"
+    },
+    "settings.about.gui": {
+        "message": "Графічний інтерфейс v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "Графічний інтерфейс"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Усі права захищено."
+    },
+    "settings.about.links.imprint": {
+        "message": "Реквізити"
+    },
+    "settings.about.links.privacy": {
+        "message": "Конфіденційність"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Умови використання"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Форум"
+    },
+    "settings.about.community.documentation": {
+        "message": "Документація"
+    },
+    "settings.about.community.feedback": {
+        "message": "Зворотний зв’язок"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} готовий до встановлення."
+    },
+    "update.banner.later": {
+        "message": "Пізніше"
+    },
+    "update.banner.installNow": {
+        "message": "Встановити зараз"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "Версія {version} доступна для завантаження."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "Версія {version} доступна для встановлення."
+    },
+    "update.card.whatsNew": {
+        "message": "Що нового?"
+    },
+    "update.card.installNow": {
+        "message": "Встановити зараз"
+    },
+    "update.card.getInstaller": {
+        "message": "Завантажити"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird перевіряє наявність оновлень у фоновому режимі."
+    },
+    "update.card.changelog": {
+        "message": "Список змін"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Ви використовуєте останню версію"
+    },
+    "update.header.tooltip": {
+        "message": "Доступне оновлення"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Оновлення NetBird до v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Оновлення NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Доступна новіша версія, яка зараз встановлюється. NetBird автоматично перезапуститься після завершення оновлення."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "Оновлення триває занадто довго"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "Встановлення {target} тривало занадто довго і не завершилося."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Оновлення зупинено"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "Оновлення до {target} було скасовано до його завершення."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Не вдалося встановити оновлення"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Не вдалося встановити оновлення до {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "Невідома помилка"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "нової версії"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Помилка завантаження стану оновлення"
+    },
+    "update.error.triggerTitle": {
+        "message": "Помилка запуску оновлення"
+    },
+    "update.page.versionLine": {
+        "message": "Оновлення клієнта до версії {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Оновлення клієнта."
+    },
+    "update.page.outdated": {
+        "message": "Ваша версія клієнта старіша за версію для автооновлення, задану в Management."
+    },
+    "update.page.status.running": {
+        "message": "Оновлення"
+    },
+    "update.page.status.timeout": {
+        "message": "Час очікування оновлення минув. Будь ласка, спробуйте ще раз."
+    },
+    "update.page.status.canceled": {
+        "message": "Оновлення скасовано."
+    },
+    "update.page.status.failed": {
+        "message": "Помилка оновлення: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "невідома помилка оновлення"
+    },
+    "update.page.failedTitle": {
+        "message": "Помилка оновлення"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Час очікування оновлення минув."
+    },
+    "update.page.dontClose": {
+        "message": "Будь ласка, не закривайте це вікно."
+    },
+    "update.page.updating": {
+        "message": "Оновлення…"
+    },
+    "update.page.complete": {
+        "message": "Оновлення завершено"
+    },
+    "update.page.failed": {
+        "message": "Помилка оновлення"
+    },
+    "window.title.settings": {
+        "message": "Налаштування"
+    },
+    "window.title.signIn": {
+        "message": "Вхід"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Термін дії сеансу закінчується"
+    },
+    "window.title.updating": {
+        "message": "Оновлення"
+    },
+    "window.title.welcome": {
+        "message": "Ласкаво просимо до NetBird"
+    },
+    "window.title.error": {
+        "message": "Помилка"
+    },
+    "welcome.title": {
+        "message": "Знайдіть NetBird в області сповіщень"
+    },
+    "welcome.titleMac": {
+        "message": "Знайдіть NetBird у рядку меню"
+    },
+    "welcome.description": {
+        "message": "NetBird працює в області сповіщень. Натисніть на іконку, щоб підключитися, змінити профіль або відкрити налаштування."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird працює в рядку меню. Натисніть на іконку, щоб підключитися, змінити профіль або відкрити налаштування."
+    },
+    "welcome.continue": {
+        "message": "Продовжити"
+    },
+    "welcome.back": {
+        "message": "Назад"
+    },
+    "welcome.management.title": {
+        "message": "Налаштування NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Натисніть «Продовжити», щоб розпочати, або виберіть Власний сервер, якщо у вас є власний сервер NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Використовуйте наш хмарний сервіс. Налаштування не потрібне."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Власний сервер"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Підключіться до власного сервера керування."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL-адреса сервера керування"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Будь ласка, введіть дійсну URL-адресу, наприклад: https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Не вдалося підключитися до цього сервера. Перевірте URL-адресу або вашу мережу, а потім продовжуйте, якщо ви впевнені, що вона правильна."
+    },
+    "welcome.management.checking": {
+        "message": "Перевірка…"
+    },
+    "browserLogin.title": {
+        "message": "Завершіть вхід у браузері"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Ми відкрили вкладку браузера, щоб ви могли завершити вхід. Не бачите її?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Спробувати ще раз"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Помилка відкриття браузера"
+    },
+    "sessionExpiration.title": {
+        "message": "Термін дії сеансу невдовзі закінчиться"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Термін дії вашого сеансу закінчиться"
+    },
+    "sessionExpiration.description": {
+        "message": "Цей пристрій невдовзі буде відключено. Поновіть сеанс, увійшовши через браузер."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Вхід через браузер підтримує підключення цього пристрою до вашої мережі."
+    },
+    "sessionExpiration.stay": {
+        "message": "Продовжити сеанс"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Увійти"
+    },
+    "sessionExpiration.logout": {
+        "message": "Вийти"
+    },
+    "sessionExpiration.expired": {
+        "message": "Термін дії сеансу закінчився"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Пристрій відключено. Пройдіть автентифікацію у браузері, щоб перепідключитися."
+    },
+    "sessionExpiration.close": {
+        "message": "Закрити"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Помилка продовження сеансу"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Помилка виходу"
+    },
+    "peers.search.placeholder": {
+        "message": "Пошук за ім’ям або IP"
+    },
+    "peers.filter.all": {
+        "message": "Усі"
+    },
+    "peers.filter.online": {
+        "message": "Онлайн"
+    },
+    "peers.filter.offline": {
+        "message": "Офлайн"
+    },
+    "peers.empty.title": {
+        "message": "Немає доступних пірів"
+    },
+    "peers.empty.description": {
+        "message": "У вас немає доступних пірів або доступу до жодного з них."
+    },
+    "peers.details.domain": {
+        "message": "Домен"
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird IP"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird IPv6"
+    },
+    "peers.details.publicKey": {
+        "message": "Публічний ключ"
+    },
+    "peers.details.connection": {
+        "message": "Підключення"
+    },
+    "peers.details.latency": {
+        "message": "Затримка"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Останнє рукостискання"
+    },
+    "peers.details.statusSince": {
+        "message": "Останнє оновлення підключення"
+    },
+    "peers.details.bytes": {
+        "message": "Байти"
+    },
+    "peers.details.bytesSent": {
+        "message": "Надіслано"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Отримано"
+    },
+    "peers.details.localIce": {
+        "message": "Локальний ICE"
+    },
+    "peers.details.remoteIce": {
+        "message": "Віддалений ICE"
+    },
+    "peers.details.never": {
+        "message": "Ніколи"
+    },
+    "peers.details.justNow": {
+        "message": "Щойно"
+    },
+    "peers.details.refresh": {
+        "message": "Оновити"
+    },
+    "peers.status.connected": {
+        "message": "Підключено"
+    },
+    "peers.status.connecting": {
+        "message": "Підключення"
+    },
+    "peers.status.disconnected": {
+        "message": "Відключено"
+    },
+    "peers.details.relayAddress": {
+        "message": "Ретранслятор"
+    },
+    "peers.details.networks": {
+        "message": "Ресурси"
+    },
+    "peers.details.relayed": {
+        "message": "Через ретранслятор"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass увімкнено"
+    },
+    "networks.search.placeholder": {
+        "message": "Пошук за мережею або доменом"
+    },
+    "networks.filter.all": {
+        "message": "Усі"
+    },
+    "networks.filter.active": {
+        "message": "Активні"
+    },
+    "networks.filter.overlapping": {
+        "message": "Перетинаються"
+    },
+    "networks.empty.title": {
+        "message": "Немає доступних ресурсів"
+    },
+    "networks.empty.description": {
+        "message": "У вас немає доступних мережевих ресурсів або доступу до жодного з них."
+    },
+    "networks.selected": {
+        "message": "Вибрано"
+    },
+    "networks.unselected": {
+        "message": "Не вибрано"
+    },
+    "networks.ips.heading": {
+        "message": "Визначені IP-адреси"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "Активні: {selected} з {total}"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Увімкнути всі"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Вимкнути всі"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Пошук вихідних вузлів"
+    },
+    "exitNodes.none": {
+        "message": "Немає"
+    },
+    "exitNodes.empty.title": {
+        "message": "Немає доступних вихідних вузлів"
+    },
+    "exitNodes.empty.description": {
+        "message": "Цьому піру не надано жодного вихідного вузла."
+    },
+    "exitNodes.card.title": {
+        "message": "Вихідний вузол"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Активний"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Неактивний"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Немає"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Пряме підключення без вихідного вузла"
+    },
+    "quickActions.connect": {
+        "message": "Підключитися"
+    },
+    "quickActions.disconnect": {
+        "message": "Відключитися"
+    },
+    "daemon.unavailable.title": {
+        "message": "Служба NetBird не запущена"
+    },
+    "daemon.unavailable.description": {
+        "message": "Програма перепідключиться автоматично, щойно служба запрацює."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Документація"
+    },
+    "daemon.outdated.title": {
+        "message": "Клієнт NetBird застарів"
+    },
+    "daemon.outdated.description": {
+        "message": "Новий графічний інтерфейс несумісний зі старою версією клієнта NetBird. Оновіть клієнт, щоб використовувати нову програму."
+    },
+    "daemon.outdated.download": {
+        "message": "Завантажити останню версію"
+    },
+    "error.jwt_clock_skew": {
+        "message": "Помилка входу: годинник цього пристрою не синхронізовано із сервером. Будь ласка, синхронізуйте системний годинник і спробуйте знову."
+    },
+    "error.jwt_expired": {
+        "message": "Термін дії вашого токена входу закінчився. Будь ласка, увійдіть знову."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Помилка входу: недійсний підпис токена. Будь ласка, зверніться до адміністратора."
+    },
+    "error.session_expired": {
+        "message": "Термін дії вашого сеансу закінчився. Будь ласка, увійдіть знову."
+    },
+    "error.invalid_setup_key": {
+        "message": "Setup Key відсутній або недійсний."
+    },
+    "error.permission_denied": {
+        "message": "Вхід відхилено сервером."
+    },
+    "error.daemon_unreachable": {
+        "message": "Служба NetBird не відповідає. Будь ласка, перевірте, чи запущена служба."
+    },
+    "error.settings_locked": {
+        "message": "Налаштування на цьому пристрої змінити неможливо: адміністратор їх заблокував."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Це налаштування керується вашою організацією і не може бути змінене."
+    },
+    "error.unknown": {
+        "message": "Помилка операції."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird не зміг запросити в системи привілеї, необхідні для внесення змін. Замість цього виконайте:"
+    },
+    "error.elevation_failed": {
+        "message": "Не вдалося застосувати зміни з підвищеними привілеями. Замість цього виконайте:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "прав root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "прав адміністратора"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Потребує {actor}. Замість цього виконайте:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Ви можете вимкнути це, але щоб увімкнути знову, знадобиться {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Ви можете увімкнути це, але щоб вимкнути знову, знадобиться {actor}:"
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Очікування авторизації…"
+    }
+}
diff --git a/client/ui/i18n/locales/zh-CN/common.json b/client/ui/i18n/locales/zh-CN/common.json
new file mode 100644
index 000000000..9f4713899
--- /dev/null
+++ b/client/ui/i18n/locales/zh-CN/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "已断开连接"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "未运行"
+    },
+    "tray.status.error": {
+        "message": "错误"
+    },
+    "tray.status.connected": {
+        "message": "已连接"
+    },
+    "tray.status.connecting": {
+        "message": "正在连接"
+    },
+    "tray.status.needsLogin": {
+        "message": "需要登录"
+    },
+    "tray.status.loginFailed": {
+        "message": "登录失败"
+    },
+    "tray.status.sessionExpired": {
+        "message": "会话已过期"
+    },
+    "tray.session.expiresIn": {
+        "message": "会话将在 {remaining} 后过期"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "不到一分钟"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 分钟"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} 分钟"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 小时"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} 小时"
+    },
+    "tray.session.unit.day": {
+        "message": "1 天"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} 天"
+    },
+    "tray.menu.open": {
+        "message": "打开 NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "连接"
+    },
+    "tray.menu.disconnect": {
+        "message": "断开连接"
+    },
+    "tray.menu.exitNode": {
+        "message": "出口节点"
+    },
+    "tray.menu.networks": {
+        "message": "资源"
+    },
+    "tray.menu.profiles": {
+        "message": "配置文件"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "管理配置文件"
+    },
+    "tray.menu.settings": {
+        "message": "设置…"
+    },
+    "tray.menu.debugBundle": {
+        "message": "创建调试包"
+    },
+    "tray.menu.about": {
+        "message": "帮助与支持"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "文档"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "故障排除"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "下载最新版本"
+    },
+    "tray.menu.installVersion": {
+        "message": "安装 {version} 版本"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI：{version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "守护进程：{version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "退出 NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "NetBird 服务版本过旧"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "请更新 NetBird 服务以使用此应用。"
+    },
+    "notify.update.title": {
+        "message": "NetBird 有可用更新"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} 已可用。"
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " 您的管理员要求进行此次更新。"
+    },
+    "notify.error.title": {
+        "message": "错误"
+    },
+    "notify.error.connect": {
+        "message": "连接失败"
+    },
+    "notify.error.disconnect": {
+        "message": "断开连接失败"
+    },
+    "notify.error.switchProfile": {
+        "message": "切换到 {profile} 失败"
+    },
+    "notify.error.exitNode": {
+        "message": "更新出口节点 {name} 失败"
+    },
+    "notify.sessionExpired.title": {
+        "message": "NetBird 会话已过期"
+    },
+    "notify.sessionExpired.body": {
+        "message": "您的 NetBird 会话已过期。请重新登录。"
+    },
+    "notify.sessionWarning.title": {
+        "message": "会话即将过期"
+    },
+    "notify.sessionWarning.body": {
+        "message": "您的 NetBird 会话将在 {remaining} 后过期。点击“立即延长”以续期。"
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "您的 NetBird 会话即将过期。点击“立即延长”以续期。"
+    },
+    "notify.sessionWarning.extend": {
+        "message": "立即延长"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "忽略"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "延长 NetBird 会话失败"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "NetBird 会话已延长"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "您的会话已刷新。"
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "会话截止时间被拒绝"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "服务器发送了无效的会话截止时间。请重新登录。"
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird 设置已更新"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "您的 NetBird 配置已根据 IT 策略更新。"
+    },
+    "common.cancel": {
+        "message": "取消"
+    },
+    "common.save": {
+        "message": "保存"
+    },
+    "common.saveChanges": {
+        "message": "保存更改"
+    },
+    "common.saving": {
+        "message": "正在保存…"
+    },
+    "common.close": {
+        "message": "关闭"
+    },
+    "common.copy": {
+        "message": "复制"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "切换密码可见性"
+    },
+    "common.increase": {
+        "message": "增加"
+    },
+    "common.decrease": {
+        "message": "减少"
+    },
+    "common.delete": {
+        "message": "删除"
+    },
+    "common.create": {
+        "message": "创建"
+    },
+    "common.add": {
+        "message": "添加"
+    },
+    "common.remove": {
+        "message": "移除"
+    },
+    "common.refresh": {
+        "message": "刷新"
+    },
+    "common.loading": {
+        "message": "正在加载…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "未找到任何结果"
+    },
+    "common.noResults.description": {
+        "message": "我们未能找到任何结果。请尝试其他搜索词或更改筛选条件。"
+    },
+    "notConnected.title": {
+        "message": "已断开连接"
+    },
+    "notConnected.description": {
+        "message": "请先连接到 NetBird，以查看有关对等节点、网络资源和出口节点的详细信息。"
+    },
+    "connect.status.disconnected": {
+        "message": "已断开连接"
+    },
+    "connect.status.connecting": {
+        "message": "正在连接…"
+    },
+    "connect.status.connected": {
+        "message": "已连接"
+    },
+    "connect.status.disconnecting": {
+        "message": "正在断开连接…"
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "守护进程不可用"
+    },
+    "connect.status.loginRequired": {
+        "message": "需要登录"
+    },
+    "connect.error.loginTitle": {
+        "message": "登录失败"
+    },
+    "connect.error.connectTitle": {
+        "message": "连接失败"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "断开连接失败"
+    },
+    "nav.peers.title": {
+        "message": "对等节点"
+    },
+    "nav.peers.description": {
+        "message": "{total} 个中已连接 {connected} 个"
+    },
+    "nav.resources.title": {
+        "message": "资源"
+    },
+    "nav.resources.description": {
+        "message": "{total} 个中已激活 {active} 个"
+    },
+    "nav.exitNode.title": {
+        "message": "出口节点"
+    },
+    "nav.exitNode.none": {
+        "message": "未激活"
+    },
+    "nav.exitNode.using": {
+        "message": "经由 {name}"
+    },
+    "header.openSettings": {
+        "message": "打开设置"
+    },
+    "header.togglePanel": {
+        "message": "切换侧边栏"
+    },
+    "profile.selector.loading": {
+        "message": "正在加载…"
+    },
+    "profile.selector.noProfile": {
+        "message": "无配置文件"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "按名称搜索配置文件…"
+    },
+    "profile.selector.emptyTitle": {
+        "message": "未找到配置文件"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "请尝试其他搜索词或创建新的配置文件。"
+    },
+    "profile.selector.newProfile": {
+        "message": "新建配置文件"
+    },
+    "profile.selector.moreOptions": {
+        "message": "更多选项"
+    },
+    "profile.selector.deregister": {
+        "message": "注销"
+    },
+    "profile.selector.delete": {
+        "message": "删除"
+    },
+    "profile.selector.switchTo": {
+        "message": "切换到此配置文件"
+    },
+    "profile.selector.edit": {
+        "message": "编辑"
+    },
+    "profile.edit.title": {
+        "message": "编辑配置文件"
+    },
+    "profile.edit.submit": {
+        "message": "保存更改"
+    },
+    "profile.dialog.title": {
+        "message": "输入配置文件名称"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "配置文件名称"
+    },
+    "profile.dialog.description": {
+        "message": "为您的配置文件设置一个易于识别的名称。"
+    },
+    "profile.dialog.placeholder": {
+        "message": "例如：工作"
+    },
+    "profile.dialog.submit": {
+        "message": "添加配置文件"
+    },
+    "profile.dialog.required": {
+        "message": "请输入配置文件名称，例如：工作、家庭"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "使用 NetBird Cloud 或您自己的服务器。"
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "无法连接到此服务器。请检查 URL，如果确认无误，也可以照常添加该配置文件。"
+    },
+    "header.menu.settings": {
+        "message": "设置…"
+    },
+    "header.menu.defaultView": {
+        "message": "默认视图"
+    },
+    "header.menu.advancedView": {
+        "message": "高级视图"
+    },
+    "header.menu.updateAvailable": {
+        "message": "有可用更新"
+    },
+    "header.menu.open": {
+        "message": "打开菜单"
+    },
+    "header.profile.switch": {
+        "message": "切换配置文件"
+    },
+    "connect.toggle.label": {
+        "message": "切换 NetBird 连接"
+    },
+    "connect.localIp.label": {
+        "message": "本地 IP 地址"
+    },
+    "common.search": {
+        "message": "搜索"
+    },
+    "common.filter": {
+        "message": "筛选"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "选择出口节点"
+    },
+    "peers.row.label": {
+        "message": "打开 {name} 的详情，{status}"
+    },
+    "peers.dialog.title": {
+        "message": "对等节点详情"
+    },
+    "networks.row.toggle": {
+        "message": "切换 {name}"
+    },
+    "networks.bulk.label": {
+        "message": "切换所有可见资源"
+    },
+    "profile.switch.title": {
+        "message": "切换到配置文件“{name}”？"
+    },
+    "profile.switch.message": {
+        "message": "您确定要切换配置文件吗？\n您当前的配置文件将被断开连接。"
+    },
+    "profile.switch.confirm": {
+        "message": "确认"
+    },
+    "profile.deregister.title": {
+        "message": "注销配置文件“{name}”？"
+    },
+    "profile.deregister.message": {
+        "message": "您确定要注销此配置文件吗？\n您将需要重新登录才能使用它。"
+    },
+    "profile.deregister.confirm": {
+        "message": "注销"
+    },
+    "profile.delete.title": {
+        "message": "删除配置文件“{name}”？"
+    },
+    "profile.delete.message": {
+        "message": "您确定要删除此配置文件吗？\n此操作无法撤销。"
+    },
+    "profile.delete.disabledActive": {
+        "message": "无法删除处于活动状态的配置文件。请先切换到其他配置文件，再删除此配置文件。"
+    },
+    "profile.delete.disabledDefault": {
+        "message": "无法删除默认配置文件。"
+    },
+    "profile.error.switchTitle": {
+        "message": "切换配置文件失败"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "注销配置文件失败"
+    },
+    "profile.error.deleteTitle": {
+        "message": "删除配置文件失败"
+    },
+    "profile.error.createTitle": {
+        "message": "创建配置文件失败"
+    },
+    "profile.error.editTitle": {
+        "message": "编辑配置文件失败"
+    },
+    "profile.error.loadTitle": {
+        "message": "加载配置文件失败"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "当前配置文件"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "切换配置文件"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "其他"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "添加配置文件"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "管理配置文件"
+    },
+    "profile.dropdown.settings": {
+        "message": "设置"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "配置文件"
+    },
+    "settings.profiles.intro": {
+        "message": "并行保留多个独立的 NetBird 身份，例如工作和个人账户，或不同的管理服务器。可在下方添加、注销或删除配置文件。"
+    },
+    "settings.profiles.addProfile": {
+        "message": "添加配置文件"
+    },
+    "settings.profiles.active": {
+        "message": "活动"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "无配置文件"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "创建一个配置文件以连接到 NetBird 管理服务器。"
+    },
+    "settings.error.loadTitle": {
+        "message": "加载设置失败"
+    },
+    "settings.error.saveTitle": {
+        "message": "保存设置失败"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "创建调试包失败"
+    },
+    "settings.nav.label": {
+        "message": "设置部分"
+    },
+    "settings.tabs.general": {
+        "message": "常规"
+    },
+    "settings.tabs.network": {
+        "message": "网络"
+    },
+    "settings.tabs.security": {
+        "message": "安全"
+    },
+    "settings.tabs.profiles": {
+        "message": "配置文件"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "高级"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "故障排除"
+    },
+    "settings.tabs.about": {
+        "message": "关于"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "有可用更新"
+    },
+    "settings.general.section.general": {
+        "message": "常规"
+    },
+    "settings.general.section.connection": {
+        "message": "连接"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "启动时连接"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "在服务启动时自动建立连接。"
+    },
+    "settings.general.notifications.label": {
+        "message": "桌面通知"
+    },
+    "settings.general.notifications.help": {
+        "message": "显示有关新更新和连接事件的桌面通知。"
+    },
+    "settings.general.autostart.label": {
+        "message": "登录时启动 NetBird 界面"
+    },
+    "settings.general.autostart.help": {
+        "message": "在您登录时自动启动 NetBird 界面。此设置仅影响图形界面，不影响后台服务。"
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "更改自启动设置失败"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "退出后保持连接"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "关闭 NetBird 后，连接会在后台保持。只有你自己断开时才会停止。"
+    },
+    "settings.general.language.label": {
+        "message": "显示语言"
+    },
+    "settings.general.language.help": {
+        "message": "选择 NetBird 界面的语言。"
+    },
+    "settings.general.language.search": {
+        "message": "搜索语言…"
+    },
+    "settings.general.language.empty": {
+        "message": "没有匹配的语言。"
+    },
+    "settings.general.theme.label": {
+        "message": "主题"
+    },
+    "settings.general.theme.help": {
+        "message": "选择浅色、深色或跟随系统外观。"
+    },
+    "settings.general.theme.system": {
+        "message": "跟随系统"
+    },
+    "settings.general.theme.light": {
+        "message": "浅色"
+    },
+    "settings.general.theme.dark": {
+        "message": "深色"
+    },
+    "settings.general.management.label": {
+        "message": "管理服务器"
+    },
+    "settings.general.management.help": {
+        "message": "连接到 NetBird Cloud 或您自己的自托管管理服务器。更改将使客户端重新连接。"
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "自托管"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "请输入有效的 URL，例如：https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "无法连接到此服务器。请检查 URL，如果确认无误，也可以照常保存。"
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "切换到 NetBird Cloud？"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "这将断开您的自托管服务器。\n您可能需要重新登录。"
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "切换到 Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "连接性"
+    },
+    "settings.network.section.routingDns": {
+        "message": "路由与 DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "网络变化时重新连接"
+    },
+    "settings.network.monitor.help": {
+        "message": "监测网络，并在发生变化时自动重新连接，例如切换 Wi-Fi、以太网变化或从睡眠中恢复。"
+    },
+    "settings.network.dns.label": {
+        "message": "启用 DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "将 NetBird 管理的 DNS 设置应用到主机解析器。"
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "启用客户端路由"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "接受来自其他对等节点的路由，以访问它们的网络。"
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "启用服务器路由"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "向其他对等节点通告此主机的本地路由。"
+    },
+    "settings.network.ipv6.label": {
+        "message": "启用 IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "为 NetBird 叠加网络使用 IPv6 寻址。"
+    },
+    "settings.security.section.firewall": {
+        "message": "防火墙"
+    },
+    "settings.security.section.encryption": {
+        "message": "加密"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "阻止入站流量"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "拒绝对等节点向本设备及其路由的任何网络发起的未经请求的连接。出站流量不受影响。"
+    },
+    "settings.security.blockLan.label": {
+        "message": "阻止 LAN 访问"
+    },
+    "settings.security.blockLan.help": {
+        "message": "当本设备为对等节点路由流量时，阻止它们访问您的本地网络或其设备。"
+    },
+    "settings.security.rosenpass.label": {
+        "message": "启用抗量子加密"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "在 WireGuard® 之上通过 Rosenpass 添加后量子密钥交换。"
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "启用宽松模式"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "允许连接到不支持抗量子加密的对等节点。"
+    },
+    "settings.ssh.section.server": {
+        "message": "服务器"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "功能"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "身份验证"
+    },
+    "settings.ssh.server.label": {
+        "message": "启用 SSH 服务器"
+    },
+    "settings.ssh.server.help": {
+        "message": "在此主机上运行 NetBird SSH 服务器，以便其他对等节点可以连接到它。"
+    },
+    "settings.ssh.root.label": {
+        "message": "允许 root 登录"
+    },
+    "settings.ssh.root.help": {
+        "message": "允许对等节点以 root 用户身份登录。禁用后将要求使用非特权账户。"
+    },
+    "settings.ssh.sftp.label": {
+        "message": "允许 SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "使用原生 SFTP 或 SCP 客户端安全地传输文件。"
+    },
+    "settings.ssh.localForward.label": {
+        "message": "本地端口转发"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "允许连接的对等节点将本地端口隧道转发到此主机可访问的服务。"
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "远程端口转发"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "允许连接的对等节点将此主机上的端口反向暴露到它们自己的机器。"
+    },
+    "settings.ssh.jwt.label": {
+        "message": "启用 JWT 身份验证"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "针对您的 IdP 验证每个 SSH 会话，以确认用户身份并进行审计。禁用后将仅依赖网络 ACL 策略，在没有可用 IdP 时很有用。"
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "JWT 缓存 TTL"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "在出站 SSH 连接再次提示前，此客户端缓存 JWT 的时长。设为 0 可禁用缓存，每次连接都进行身份验证。"
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "秒"
+    },
+    "settings.advanced.section.interface": {
+        "message": "接口"
+    },
+    "settings.advanced.section.security": {
+        "message": "安全"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "名称"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "请使用 1-15 个字母、数字、点、连字符或下划线。"
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "必须以“utun”开头，后跟一个数字（例如 utun100）。"
+    },
+    "settings.advanced.port.label": {
+        "message": "端口"
+    },
+    "settings.advanced.port.error": {
+        "message": "请输入介于 {min} 和 {max} 之间的端口。"
+    },
+    "settings.advanced.port.help": {
+        "message": "如果设为 0，将使用一个随机的空闲端口。"
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "请输入介于 {min} 和 {max} 之间的 MTU 值。"
+    },
+    "settings.advanced.psk.label": {
+        "message": "预共享密钥"
+    },
+    "settings.advanced.psk.help": {
+        "message": "可选的 WireGuard PSK，用于额外的对称加密。它与 NetBird 设置密钥不同。您将只能与使用相同预共享密钥的对等节点通信。"
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "调试包"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "匿名化敏感信息"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "隐藏 IP 地址、域名和其他敏感值。"
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "默认级别保留内部 IPv4 地址和对等节点名称，便于支持人员阅读。严格级别还会匿名化私有 (RFC 1918)、CGNAT 和链路本地 IP 地址、对等节点名称以及 WireGuard 公钥。相同的值会映射到相同的占位符，因此对等节点仍可区分。向组织外部分享调试包时请使用严格级别。"
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "无"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "默认"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "严格"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "包含系统信息"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "包含操作系统、内核、网络接口和路由表。"
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "将调试包上传到 NetBird 服务器"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "返回一个上传密钥，供您分享给 NetBird 支持团队。"
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "启用跟踪日志"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "将日志级别提升到 TRACE，之后再恢复原级别。"
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "捕获会话"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "重新连接并等待，以便您复现问题。"
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "捕获网络数据包"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "在捕获期间将网络流量保存为 .pcap 文件。"
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "捕获时长"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "捕获会话运行的时长。"
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "分钟"
+    },
+    "settings.troubleshooting.create": {
+        "message": "创建调试包"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "正在收集日志、系统详情和连接状态。这通常只需片刻——请保持此窗口打开，直到完成。"
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "正在取消…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "调试包已成功上传！"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "调试包已保存"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "请将下方的上传密钥分享给 <docs>NetBird 支持团队</docs>。本地也已保存了一份副本。"
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "您的调试包已保存在本地。"
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "复制密钥"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "打开文件夹"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "打开文件位置"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "上传失败：{reason} 调试包仍已保存在本地。"
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "上传失败。调试包仍已保存在本地。"
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "正在重新连接 NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "正在捕获调试日志"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "正在生成调试包…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "正在上传到 NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "正在取消…"
+    },
+    "settings.about.client": {
+        "message": "NetBird 客户端 v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird 客户端"
+    },
+    "settings.about.development": {
+        "message": "[开发版]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird。保留所有权利。"
+    },
+    "settings.about.links.imprint": {
+        "message": "法律声明"
+    },
+    "settings.about.links.privacy": {
+        "message": "隐私"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "服务条款"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "论坛"
+    },
+    "settings.about.community.documentation": {
+        "message": "文档"
+    },
+    "settings.about.community.feedback": {
+        "message": "反馈"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} 已准备好安装。"
+    },
+    "update.banner.later": {
+        "message": "稍后"
+    },
+    "update.banner.installNow": {
+        "message": "立即安装"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "{version} 版本可供下载。"
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "{version} 版本可供安装。"
+    },
+    "update.card.whatsNew": {
+        "message": "更新内容？"
+    },
+    "update.card.installNow": {
+        "message": "立即安装"
+    },
+    "update.card.getInstaller": {
+        "message": "下载"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird 会在后台检查更新。"
+    },
+    "update.card.changelog": {
+        "message": "更新日志"
+    },
+    "update.card.onLatestVersion": {
+        "message": "您已是最新版本"
+    },
+    "update.header.tooltip": {
+        "message": "有可用更新"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "正在将 NetBird 更新到 v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "正在更新 NetBird"
+    },
+    "update.overlay.description": {
+        "message": "有更新的版本可用，正在安装。更新完成后，NetBird 将自动重启。"
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "更新耗时过长"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "安装 {target} 耗时过长，未能完成。"
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "更新已停止"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "对 {target} 的更新在完成前已被取消。"
+    },
+    "update.overlay.error.failTitle": {
+        "message": "无法安装更新"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "无法安装 {target}。"
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "未知错误"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "新版本"
+    },
+    "update.error.loadStateTitle": {
+        "message": "加载更新状态失败"
+    },
+    "update.error.triggerTitle": {
+        "message": "启动更新失败"
+    },
+    "update.page.versionLine": {
+        "message": "正在将客户端更新到：{version}。"
+    },
+    "update.page.versionLineGeneric": {
+        "message": "正在更新客户端。"
+    },
+    "update.page.outdated": {
+        "message": "您的客户端版本早于管理服务器中设置的自动更新版本。"
+    },
+    "update.page.status.running": {
+        "message": "正在更新"
+    },
+    "update.page.status.timeout": {
+        "message": "更新超时。请重试。"
+    },
+    "update.page.status.canceled": {
+        "message": "更新已取消。"
+    },
+    "update.page.status.failed": {
+        "message": "更新失败：{message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "未知的更新错误"
+    },
+    "update.page.failedTitle": {
+        "message": "更新失败"
+    },
+    "update.page.timeoutMessage": {
+        "message": "更新超时。"
+    },
+    "update.page.dontClose": {
+        "message": "请勿关闭此窗口。"
+    },
+    "update.page.updating": {
+        "message": "正在更新…"
+    },
+    "update.page.complete": {
+        "message": "更新完成"
+    },
+    "update.page.failed": {
+        "message": "更新失败"
+    },
+    "window.title.settings": {
+        "message": "设置"
+    },
+    "window.title.signIn": {
+        "message": "登录"
+    },
+    "window.title.sessionExpiration": {
+        "message": "会话即将过期"
+    },
+    "window.title.updating": {
+        "message": "正在更新"
+    },
+    "window.title.welcome": {
+        "message": "欢迎使用 NetBird"
+    },
+    "window.title.error": {
+        "message": "错误"
+    },
+    "welcome.title": {
+        "message": "在托盘中查找 NetBird"
+    },
+    "welcome.titleMac": {
+        "message": "在菜单栏中查找 NetBird"
+    },
+    "welcome.description": {
+        "message": "NetBird 驻留在您的托盘中。点击图标即可连接、切换配置文件或打开设置。"
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird 驻留在您的菜单栏中。点击图标即可连接、切换配置文件或打开设置。"
+    },
+    "welcome.continue": {
+        "message": "继续"
+    },
+    "welcome.back": {
+        "message": "返回"
+    },
+    "welcome.management.title": {
+        "message": "设置 NetBird"
+    },
+    "welcome.management.description": {
+        "message": "点击“继续”即可开始；如果您有自己的 NetBird 服务器，请选择“自托管”。"
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "使用我们的托管服务。无需任何设置。"
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "自托管"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "连接到您自己的管理服务器。"
+    },
+    "welcome.management.urlLabel": {
+        "message": "管理服务器 URL"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "请输入有效的 URL，例如：https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "无法连接到此服务器。请检查 URL 或您的网络，如果确认无误，再继续。"
+    },
+    "welcome.management.checking": {
+        "message": "正在检查…"
+    },
+    "browserLogin.title": {
+        "message": "请在浏览器中继续以完成登录"
+    },
+    "browserLogin.notSeeing": {
+        "message": "没看到浏览器标签页？"
+    },
+    "browserLogin.tryAgain": {
+        "message": "重试"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "打开浏览器失败"
+    },
+    "sessionExpiration.title": {
+        "message": "会话即将过期"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "您的会话即将过期"
+    },
+    "sessionExpiration.description": {
+        "message": "此设备即将断开连接。通过浏览器登录进行续期。"
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "通过浏览器登录可让此设备保持连接到您的网络。"
+    },
+    "sessionExpiration.stay": {
+        "message": "续期会话"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "进行身份验证"
+    },
+    "sessionExpiration.logout": {
+        "message": "退出登录"
+    },
+    "sessionExpiration.expired": {
+        "message": "会话已过期"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "设备已断开连接。通过浏览器登录进行身份验证以重新连接。"
+    },
+    "sessionExpiration.close": {
+        "message": "关闭"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "延长会话失败"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "退出登录失败"
+    },
+    "peers.search.placeholder": {
+        "message": "按名称或 IP 搜索"
+    },
+    "peers.filter.all": {
+        "message": "全部"
+    },
+    "peers.filter.online": {
+        "message": "在线"
+    },
+    "peers.filter.offline": {
+        "message": "离线"
+    },
+    "peers.empty.title": {
+        "message": "无可用的对等节点"
+    },
+    "peers.empty.description": {
+        "message": "您可能没有任何可用的对等节点，或者无权访问其中任何一个。"
+    },
+    "peers.details.domain": {
+        "message": "域名"
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird IP"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird IPv6"
+    },
+    "peers.details.publicKey": {
+        "message": "公钥"
+    },
+    "peers.details.connection": {
+        "message": "连接"
+    },
+    "peers.details.latency": {
+        "message": "延迟"
+    },
+    "peers.details.lastHandshake": {
+        "message": "上次握手"
+    },
+    "peers.details.statusSince": {
+        "message": "上次连接更新"
+    },
+    "peers.details.bytes": {
+        "message": "字节"
+    },
+    "peers.details.bytesSent": {
+        "message": "已发送"
+    },
+    "peers.details.bytesReceived": {
+        "message": "已接收"
+    },
+    "peers.details.localIce": {
+        "message": "本地 ICE"
+    },
+    "peers.details.remoteIce": {
+        "message": "远程 ICE"
+    },
+    "peers.details.never": {
+        "message": "从不"
+    },
+    "peers.details.justNow": {
+        "message": "刚刚"
+    },
+    "peers.details.refresh": {
+        "message": "刷新"
+    },
+    "peers.status.connected": {
+        "message": "已连接"
+    },
+    "peers.status.connecting": {
+        "message": "正在连接"
+    },
+    "peers.status.disconnected": {
+        "message": "已断开连接"
+    },
+    "peers.details.relayAddress": {
+        "message": "中继"
+    },
+    "peers.details.networks": {
+        "message": "资源"
+    },
+    "peers.details.relayed": {
+        "message": "经中继"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "已启用 Rosenpass"
+    },
+    "networks.search.placeholder": {
+        "message": "按网络或域名搜索"
+    },
+    "networks.filter.all": {
+        "message": "全部"
+    },
+    "networks.filter.active": {
+        "message": "活动"
+    },
+    "networks.filter.overlapping": {
+        "message": "重叠"
+    },
+    "networks.empty.title": {
+        "message": "无可用资源"
+    },
+    "networks.empty.description": {
+        "message": "您可能没有任何可用的网络资源，或者无权访问其中任何一个。"
+    },
+    "networks.selected": {
+        "message": "已选择"
+    },
+    "networks.unselected": {
+        "message": "未选择"
+    },
+    "networks.ips.heading": {
+        "message": "已解析的 IP"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{total} 个中已激活 {selected} 个"
+    },
+    "networks.bulk.enableAll": {
+        "message": "全部启用"
+    },
+    "networks.bulk.disableAll": {
+        "message": "全部禁用"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "搜索出口节点"
+    },
+    "exitNodes.none": {
+        "message": "无"
+    },
+    "exitNodes.empty.title": {
+        "message": "无可用的出口节点"
+    },
+    "exitNodes.empty.description": {
+        "message": "尚未向此对等节点共享任何出口节点。"
+    },
+    "exitNodes.card.title": {
+        "message": "出口节点"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "活动"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "非活动"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "无"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "不使用出口节点的直接连接"
+    },
+    "quickActions.connect": {
+        "message": "连接"
+    },
+    "quickActions.disconnect": {
+        "message": "断开连接"
+    },
+    "daemon.unavailable.title": {
+        "message": "NetBird 服务未运行"
+    },
+    "daemon.unavailable.description": {
+        "message": "服务运行后，应用将自动重新连接。"
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "文档"
+    },
+    "daemon.outdated.title": {
+        "message": "NetBird 客户端版本过旧"
+    },
+    "daemon.outdated.description": {
+        "message": "新版 GUI 与您较旧的客户端不兼容。请更新客户端以使用新应用。"
+    },
+    "daemon.outdated.download": {
+        "message": "下载最新版本"
+    },
+    "error.jwt_clock_skew": {
+        "message": "登录失败：此设备的时钟与服务器不同步。请同步您的系统时钟后重试。"
+    },
+    "error.jwt_expired": {
+        "message": "您的登录令牌已过期。请重新登录。"
+    },
+    "error.jwt_signature_invalid": {
+        "message": "登录失败：令牌签名无效。请联系您的管理员。"
+    },
+    "error.session_expired": {
+        "message": "您的会话已过期。请重新登录。"
+    },
+    "error.invalid_setup_key": {
+        "message": "设置密钥缺失或无效。"
+    },
+    "error.permission_denied": {
+        "message": "登录被服务器拒绝。"
+    },
+    "error.daemon_unreachable": {
+        "message": "NetBird 守护进程无响应。请检查服务是否正在运行。"
+    },
+    "error.settings_locked": {
+        "message": "此设备上的设置无法更改：管理员已将其锁定。"
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "此设置由您的组织管理，无法更改。"
+    },
+    "error.unknown": {
+        "message": "操作失败。"
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird 无法向此系统请求所需的权限。请改为运行："
+    },
+    "error.elevation_failed": {
+        "message": "即使使用提升的权限也无法应用此更改。请改为运行："
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root 权限"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "管理员权限"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "需要{actor}。请改为运行："
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "您可以关闭此项，但重新开启需要{actor}。"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "您可以开启此项，但再次关闭需要{actor}。"
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "正在等待授权…"
+    }
+}
diff --git a/client/ui/icons.go b/client/ui/icons.go
index 874f24fdd..5ab19ca05 100644
--- a/client/ui/icons.go
+++ b/client/ui/icons.go
@@ -1,16 +1,10 @@
-//go:build !(linux && 386) && !windows
+//go:build !android && !ios && !freebsd && !js
 
 package main
 
-import (
-	_ "embed"
-)
+import _ "embed"
 
-//go:embed assets/netbird.png
-var iconAbout []byte
-
-//go:embed assets/netbird-disconnected.png
-var iconAboutDisconnected []byte
+// Windows reuses these PNGs: multi-frame .ico never redrew under Wails3's NIM_MODIFY, single-frame PNG does.
 
 //go:embed assets/netbird-systemtray-connected.png
 var iconConnected []byte
@@ -21,18 +15,6 @@ var iconConnectedDark []byte
 //go:embed assets/netbird-systemtray-disconnected.png
 var iconDisconnected []byte
 
-//go:embed assets/netbird-systemtray-update-disconnected.png
-var iconUpdateDisconnected []byte
-
-//go:embed assets/netbird-systemtray-update-disconnected-dark.png
-var iconUpdateDisconnectedDark []byte
-
-//go:embed assets/netbird-systemtray-update-connected.png
-var iconUpdateConnected []byte
-
-//go:embed assets/netbird-systemtray-update-connected-dark.png
-var iconUpdateConnectedDark []byte
-
 //go:embed assets/netbird-systemtray-connecting.png
 var iconConnecting []byte
 
@@ -44,3 +26,91 @@ var iconError []byte
 
 //go:embed assets/netbird-systemtray-error-dark.png
 var iconErrorDark []byte
+
+//go:embed assets/netbird-systemtray-needs-login.png
+var iconNeedsLogin []byte
+
+//go:embed assets/netbird-systemtray-update-connected.png
+var iconUpdateConnected []byte
+
+//go:embed assets/netbird-systemtray-update-connected-dark.png
+var iconUpdateConnectedDark []byte
+
+//go:embed assets/netbird-systemtray-update-disconnected.png
+var iconUpdateDisconnected []byte
+
+//go:embed assets/netbird-systemtray-update-disconnected-dark.png
+var iconUpdateDisconnectedDark []byte
+
+//go:embed assets/netbird-systemtray-connected-macos.png
+var iconConnectedMacOS []byte
+
+//go:embed assets/netbird-systemtray-disconnected-macos.png
+var iconDisconnectedMacOS []byte
+
+//go:embed assets/netbird-systemtray-connecting-macos.png
+var iconConnectingMacOS []byte
+
+//go:embed assets/netbird-systemtray-error-macos.png
+var iconErrorMacOS []byte
+
+//go:embed assets/netbird-systemtray-needs-login-macos.png
+var iconNeedsLoginMacOS []byte
+
+//go:embed assets/netbird-systemtray-update-connected-macos.png
+var iconUpdateConnectedMacOS []byte
+
+//go:embed assets/netbird-systemtray-update-disconnected-macos.png
+var iconUpdateDisconnectedMacOS []byte
+
+// SNI has no template recoloring, so ship an explicit pair: black (*-mono.png)
+// for light panels, white (*-mono-dark.png) for dark panels.
+
+//go:embed assets/netbird-systemtray-connected-mono.png
+var iconConnectedMono []byte
+
+//go:embed assets/netbird-systemtray-connected-mono-dark.png
+var iconConnectedMonoDark []byte
+
+//go:embed assets/netbird-systemtray-connecting-mono.png
+var iconConnectingMono []byte
+
+//go:embed assets/netbird-systemtray-connecting-mono-dark.png
+var iconConnectingMonoDark []byte
+
+//go:embed assets/netbird-systemtray-disconnected-mono.png
+var iconDisconnectedMono []byte
+
+//go:embed assets/netbird-systemtray-disconnected-mono-dark.png
+var iconDisconnectedMonoDark []byte
+
+//go:embed assets/netbird-systemtray-error-mono.png
+var iconErrorMono []byte
+
+//go:embed assets/netbird-systemtray-error-mono-dark.png
+var iconErrorMonoDark []byte
+
+//go:embed assets/netbird-systemtray-needs-login-mono.png
+var iconNeedsLoginMono []byte
+
+//go:embed assets/netbird-systemtray-needs-login-mono-dark.png
+var iconNeedsLoginMonoDark []byte
+
+//go:embed assets/netbird-systemtray-update-connected-mono.png
+var iconUpdateConnectedMono []byte
+
+//go:embed assets/netbird-systemtray-update-connected-mono-dark.png
+var iconUpdateConnectedMonoDark []byte
+
+//go:embed assets/netbird-systemtray-update-disconnected-mono.png
+var iconUpdateDisconnectedMono []byte
+
+//go:embed assets/netbird-systemtray-update-disconnected-mono-dark.png
+var iconUpdateDisconnectedMonoDark []byte
+
+//go:embed assets/netbird.png
+var iconWindow []byte
+
+// Per-platform menu-row icons live in icons_menu_{windows,other}.go. Windows
+// uses 16x16: they go into the Win32 check-mark slot (SM_CXMENUCHECK, ~16x16 at
+// 100% DPI) which crops anything bigger; macOS/Linux use 24x24.
diff --git a/client/ui/icons_menu_darwin.go b/client/ui/icons_menu_darwin.go
new file mode 100644
index 000000000..c077a6d2d
--- /dev/null
+++ b/client/ui/icons_menu_darwin.go
@@ -0,0 +1,23 @@
+//go:build darwin
+
+package main
+
+import _ "embed"
+
+// 22px matches the NSMenuItem row text weight (HIG's 18-22 range);
+// Windows uses 16px and Linux 24px — see the sibling icons_menu_*.go.
+
+//go:embed assets/netbird-menu-dot-connected-22.png
+var iconMenuDotConnected []byte
+
+//go:embed assets/netbird-menu-dot-connecting-22.png
+var iconMenuDotConnecting []byte
+
+//go:embed assets/netbird-menu-dot-error-22.png
+var iconMenuDotError []byte
+
+//go:embed assets/netbird-menu-dot-idle-22.png
+var iconMenuDotIdle []byte
+
+//go:embed assets/netbird-menu-dot-offline-22.png
+var iconMenuDotOffline []byte
diff --git a/client/ui/icons_menu_linux.go b/client/ui/icons_menu_linux.go
new file mode 100644
index 000000000..54e0c743a
--- /dev/null
+++ b/client/ui/icons_menu_linux.go
@@ -0,0 +1,22 @@
+//go:build linux
+
+package main
+
+import _ "embed"
+
+// 24x24: GTK4 menu rows render 22–48 px with no downscaling.
+
+//go:embed assets/netbird-menu-dot-connected.png
+var iconMenuDotConnected []byte
+
+//go:embed assets/netbird-menu-dot-connecting.png
+var iconMenuDotConnecting []byte
+
+//go:embed assets/netbird-menu-dot-error.png
+var iconMenuDotError []byte
+
+//go:embed assets/netbird-menu-dot-idle.png
+var iconMenuDotIdle []byte
+
+//go:embed assets/netbird-menu-dot-offline.png
+var iconMenuDotOffline []byte
diff --git a/client/ui/icons_menu_windows.go b/client/ui/icons_menu_windows.go
new file mode 100644
index 000000000..c08359902
--- /dev/null
+++ b/client/ui/icons_menu_windows.go
@@ -0,0 +1,24 @@
+//go:build windows
+
+package main
+
+import _ "embed"
+
+// SetMenuItemBitmaps sizes the HBITMAP to SM_CXMENUCHECK/SM_CYMENUCHECK (16x16
+// at 100% DPI); larger bitmaps overflow the row, hence this Windows-only set
+// downscaled from the 24x24 originals.
+
+//go:embed assets/netbird-menu-dot-connected-16.png
+var iconMenuDotConnected []byte
+
+//go:embed assets/netbird-menu-dot-connecting-16.png
+var iconMenuDotConnecting []byte
+
+//go:embed assets/netbird-menu-dot-error-16.png
+var iconMenuDotError []byte
+
+//go:embed assets/netbird-menu-dot-idle-16.png
+var iconMenuDotIdle []byte
+
+//go:embed assets/netbird-menu-dot-offline-16.png
+var iconMenuDotOffline []byte
diff --git a/client/ui/icons_windows.go b/client/ui/icons_windows.go
deleted file mode 100644
index bd57b2690..000000000
--- a/client/ui/icons_windows.go
+++ /dev/null
@@ -1,44 +0,0 @@
-package main
-
-import (
-	_ "embed"
-)
-
-//go:embed assets/netbird.ico
-var iconAbout []byte
-
-//go:embed assets/netbird-disconnected.ico
-var iconAboutDisconnected []byte
-
-//go:embed assets/netbird-systemtray-connected.ico
-var iconConnected []byte
-
-//go:embed assets/netbird-systemtray-connected-dark.ico
-var iconConnectedDark []byte
-
-//go:embed assets/netbird-systemtray-disconnected.ico
-var iconDisconnected []byte
-
-//go:embed assets/netbird-systemtray-update-disconnected.ico
-var iconUpdateDisconnected []byte
-
-//go:embed assets/netbird-systemtray-update-disconnected-dark.ico
-var iconUpdateDisconnectedDark []byte
-
-//go:embed assets/netbird-systemtray-update-connected.ico
-var iconUpdateConnected []byte
-
-//go:embed assets/netbird-systemtray-update-connected-dark.ico
-var iconUpdateConnectedDark []byte
-
-//go:embed assets/netbird-systemtray-connecting.ico
-var iconConnecting []byte
-
-//go:embed assets/netbird-systemtray-connecting-dark.ico
-var iconConnectingDark []byte
-
-//go:embed assets/netbird-systemtray-error.ico
-var iconError []byte
-
-//go:embed assets/netbird-systemtray-error-dark.ico
-var iconErrorDark []byte
diff --git a/client/ui/localizer.go b/client/ui/localizer.go
new file mode 100644
index 000000000..33c1cf205
--- /dev/null
+++ b/client/ui/localizer.go
@@ -0,0 +1,130 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"strings"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// Localizer caches the active language so key lookups skip the preferences store.
+//
+// Kept in the main package (not i18n/) because StatusLabel maps daemon
+// status enum strings to translations; moving it would invert the
+// dependency direction.
+type Localizer struct {
+	bundle *i18n.Bundle
+	store  *preferences.Store
+
+	mu   sync.RWMutex
+	lang i18n.LanguageCode
+
+	unsubscribe func()
+}
+
+// NewLocalizer seeds the active language from the on-disk preference. Either
+// argument may be nil (tests): T then returns the raw key and Watch is a no-op.
+func NewLocalizer(bundle *i18n.Bundle, store *preferences.Store) *Localizer {
+	l := &Localizer{
+		bundle: bundle,
+		store:  store,
+		lang:   i18n.DefaultLanguage,
+	}
+	if store != nil {
+		if p := store.Get(); p.Language != "" {
+			l.lang = p.Language
+		}
+	}
+	return l
+}
+
+// Language returns the active language code.
+func (l *Localizer) Language() i18n.LanguageCode {
+	l.mu.RLock()
+	defer l.mu.RUnlock()
+	return l.lang
+}
+
+// T resolves key in the current language; args are {placeholder}/value pairs.
+// With no bundle wired it returns key unchanged.
+func (l *Localizer) T(key string, args ...string) string {
+	if l == nil || l.bundle == nil {
+		return key
+	}
+	l.mu.RLock()
+	lang := l.lang
+	l.mu.RUnlock()
+	return l.bundle.Translate(lang, key, args...)
+}
+
+// Watch invokes cb on each language change, after the cached language is
+// updated so cb may call l.T with the new locale. Replaces any prior subscription.
+func (l *Localizer) Watch(cb func(lang i18n.LanguageCode)) {
+	if l.store == nil {
+		return
+	}
+	ch, unsubscribe := l.store.Subscribe()
+	l.mu.Lock()
+	if l.unsubscribe != nil {
+		l.unsubscribe()
+	}
+	l.unsubscribe = unsubscribe
+	l.mu.Unlock()
+
+	go func() {
+		for p := range ch {
+			if p.Language == "" {
+				continue
+			}
+			l.mu.Lock()
+			if l.lang == p.Language {
+				l.mu.Unlock()
+				continue
+			}
+			l.lang = p.Language
+			l.mu.Unlock()
+			log.Infof("localizer: language switched to %s", p.Language)
+			if cb != nil {
+				cb(p.Language)
+			}
+		}
+	}()
+}
+
+// Close cancels the preference subscription.
+func (l *Localizer) Close() {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.unsubscribe != nil {
+		l.unsubscribe()
+		l.unsubscribe = nil
+	}
+}
+
+// StatusLabel maps a daemon status string to its tray label; unrecognised
+// statuses pass through verbatim.
+func (l *Localizer) StatusLabel(status string) string {
+	switch {
+	case status == "", strings.EqualFold(status, services.StatusIdle):
+		return l.T("tray.status.disconnected")
+	case strings.EqualFold(status, services.StatusDaemonUnavailable):
+		return l.T("tray.status.daemonUnavailable")
+	case strings.EqualFold(status, services.StatusConnected):
+		return l.T("tray.status.connected")
+	case strings.EqualFold(status, services.StatusConnecting):
+		return l.T("tray.status.connecting")
+	case strings.EqualFold(status, services.StatusNeedsLogin):
+		return l.T("tray.status.needsLogin")
+	case strings.EqualFold(status, services.StatusLoginFailed):
+		return l.T("tray.status.loginFailed")
+	case strings.EqualFold(status, services.StatusSessionExpired):
+		return l.T("tray.status.sessionExpired")
+	}
+	return status
+}
diff --git a/client/ui/main.go b/client/ui/main.go
new file mode 100644
index 000000000..764562fe7
--- /dev/null
+++ b/client/ui/main.go
@@ -0,0 +1,403 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"embed"
+	"flag"
+	"io/fs"
+	"log"
+	"os"
+	"runtime"
+	"strings"
+
+	"github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/events"
+
+	"github.com/netbirdio/netbird/client/ui/authsession"
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+	"github.com/netbirdio/netbird/client/ui/services"
+	"github.com/netbirdio/netbird/client/ui/updater"
+	"github.com/netbirdio/netbird/util"
+)
+
+//go:embed all:frontend/dist
+var assets embed.FS
+
+// localesRoot embeds the i18n bundles shared by the tray (Go) and the React
+// UI (Vite imports the same files). The `all:` prefix is required so
+// _index.json is included — //go:embed drops files starting with "_" or "."
+// otherwise.
+//
+//go:embed all:i18n/locales
+var localesRoot embed.FS
+
+// stringList collects repeated string flags. The first user-supplied value
+// drops the seeded default; subsequent passes append.
+type stringList struct {
+	values  []string
+	userSet bool
+}
+
+func (s *stringList) String() string {
+	return strings.Join(s.values, ",")
+}
+
+func (s *stringList) Set(v string) error {
+	if !s.userSet {
+		s.values = nil
+		s.userSet = true
+	}
+	s.values = append(s.values, v)
+	return nil
+}
+
+type registeredServices struct {
+	connection      *services.Connection
+	authSession     *authsession.Session
+	settings        *services.Settings
+	networks        *services.Networks
+	profiles        *services.Profiles
+	update          *services.Update
+	daemonFeed      *services.DaemonFeed
+	notifier        *Notifier
+	compat          *services.Compat
+	profileSwitcher *services.ProfileSwitcher
+	bundle          *i18n.Bundle
+	prefStore       *preferences.Store
+}
+
+func init() {
+	application.RegisterEvent[services.Status](services.EventStatusSnapshot)
+	application.RegisterEvent[services.SystemEvent](services.EventDaemonNotification)
+	application.RegisterEvent[services.ProfileRef](services.EventProfileChanged)
+	application.RegisterEvent[authsession.Warning](services.EventSessionWarning)
+	application.RegisterEvent[updater.State](updater.EventStateChanged)
+	application.RegisterEvent[preferences.UIPreferences](preferences.EventPreferencesChanged)
+	application.RegisterEvent[services.SystemTheme](services.EventSystemThemeChanged)
+}
+
+func main() {
+	// The one-shot that applies the settings the daemon restricts to
+	// root/administrator, which this binary runs itself as under the platform's
+	// elevation prompt. Handled before anything GUI so no window, tray or
+	// single-instance lock is involved.
+	if services.IsPrivilegedSettingsRun(os.Args[1:]) {
+		os.Exit(runPrivilegedSettings(os.Args[1:]))
+	}
+
+	daemonAddr, userSetLogFile := parseFlagsAndInitLog()
+	conn := NewConn(daemonAddr)
+
+	// Without --log-file, the GUI manages a gui-client.log that follows the
+	// daemon's debug level and is collected in the debug bundle. It rides
+	// DaemonFeed's SubscribeEvents stream (see guilog.DebugLog).
+	debugLog := newDebugLog(userSetLogFile)
+
+	// Declared before app.New so the SingleInstance callback closes over it.
+	var tray *Tray
+	app := newApplication(func() {
+		if tray != nil {
+			go tray.ShowWindow()
+		}
+	})
+
+	profiles := services.NewProfiles(conn)
+	// updater.Holder owns the typed update State; DaemonFeed feeds it and the
+	// Update service is a thin Wails-bound facade over it plus the install RPCs.
+	updaterHolder := updater.NewHolder(app.Event)
+	update := services.NewUpdate(conn, updaterHolder)
+	daemonFeed := services.NewDaemonFeed(conn, app.Event, updaterHolder, debugLog)
+	notifier := newNotifier()
+	compat := services.NewCompat(conn)
+	// macOS shows no toast until permission is requested. Run it after
+	// ApplicationStarted so the notifier's Startup has initialised the
+	// notification-center delegate. No-op on Linux/Windows (stubs report
+	// authorized).
+	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		go requestNotificationAuthorization(notifier)
+		initDockObserver()
+	})
+
+	bundle, prefStore, localizer := buildI18n(app)
+
+	// Before any window exists so creation-time backgrounds are already themed.
+	app.RegisterService(application.NewService(services.NewTheme(app, prefStore)))
+
+	// After bundle + prefStore: both are used to localise daemon errors.
+	settings := services.NewSettings(conn, bundle, prefStore, daemonAddr)
+	connection := services.NewConnection(conn, bundle, prefStore)
+	profileSwitcher := services.NewProfileSwitcher(profiles, connection, daemonFeed)
+	// authsession.Session owns the full extend + dismiss surface the tray
+	// drives directly; the Wails-bound services.Session wraps only the subset
+	// the React frontend calls, keeping the generated TS surface minimal.
+	authSession := authsession.NewSession(conn)
+	networks := services.NewNetworks(conn)
+
+	registerServices(app, conn, registeredServices{
+		connection:      connection,
+		authSession:     authSession,
+		settings:        settings,
+		networks:        networks,
+		profiles:        profiles,
+		update:          update,
+		daemonFeed:      daemonFeed,
+		notifier:        notifier,
+		compat:          compat,
+		profileSwitcher: profileSwitcher,
+		bundle:          bundle,
+		prefStore:       prefStore,
+	})
+
+	windowManager := services.NewWindowManager(app, nil, bundle, prefStore, iconWindow)
+	windowManager.SetMainFactory(func(startURL string) *application.WebviewWindow {
+		return newMainWindow(app, prefStore, windowManager, startURL)
+	})
+	registerDockReopenHook(app, windowManager)
+	// Minimal WMs (XEmbed-tray path) neither center small windows nor restore
+	// position across hide -> show, dropping them top-left. Gate Go-side
+	// re-centering on that environment; nil leaves placement to the WM on full
+	// desktops, macOS, and Windows.
+	windowManager.SetRecenterOnShow(recenterOnShowPredicate())
+	app.RegisterService(application.NewService(windowManager))
+
+	// Welcome window, first launch only — Continue flips OnboardingCompleted
+	// so later launches skip it. ApplicationStarted hook so the Wails window
+	// machinery is fully up before the window is created.
+	if !prefStore.Get().OnboardingCompleted {
+		app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+			windowManager.OpenWelcome()
+		})
+	}
+
+	// In-process StatusNotifierWatcher so the tray works on minimal WMs that
+	// don't ship one (Fluxbox, i3, GNOME without AppIndicator). No-op off
+	// Linux. Must run before NewTray so the systray's
+	// RegisterStatusNotifierItem hits a watcher we control.
+	startStatusNotifierWatcher()
+
+	tray = NewTray(app, nil, TrayServices{
+		Connection:      connection,
+		Settings:        settings,
+		Profiles:        profiles,
+		Networks:        networks,
+		DaemonFeed:      daemonFeed,
+		Notifier:        notifier,
+		Update:          update,
+		ProfileSwitcher: profileSwitcher,
+		WindowManager:   windowManager,
+		Session:         authSession,
+		Localizer:       localizer,
+		Preferences:     prefStore,
+	})
+	listenForShowSignal(context.Background(), tray)
+
+	// Start the feed only after every service's ServiceStartup has run. The
+	// first SubscribeEvents message replays cached state synchronously and can
+	// fire an OS notification; if Watch ran before app.Run it could beat the
+	// notifier's ServiceStartup, where the Linux notifier connects the session
+	// bus — its *dbus.Conn would still be nil and SendNotification would
+	// nil-deref (fatal panic on the dispatch goroutine, observed on Linux
+	// Mint). ApplicationStarted fires after the startup loop, so the bus is up.
+	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		daemonFeed.Watch(context.Background())
+		// Probe daemon compatibility once the notifier bus is up; an outdated
+		// daemon may keep the main window from showing, so the OS toast is the
+		// only reliable signal the user gets.
+		go notifyIfDaemonOutdated(compat, notifier, localizer)
+		// One-time launch-on-login default for fresh installs; gated by the
+		// NetBird footprint check, MDM policy, and the persisted marker.
+		go applyAutostartDefault(context.Background(), services.NewAutostart(app.Autostart), prefStore, prefStore.ExistedAtLoad())
+	})
+
+	if err := app.Run(); err != nil {
+		log.Fatal(err)
+	}
+}
+
+// requestNotificationAuthorization prompts for macOS notification permission.
+// The request blocks until the user responds (up to 3 minutes), so callers run
+// it in a goroutine. No-op on Linux/Windows.
+func requestNotificationAuthorization(notifier *Notifier) {
+	authorized, err := notifier.CheckNotificationAuthorization()
+	if err != nil {
+		logrus.Debugf("check notification authorization: %v", err)
+		return
+	}
+	if authorized {
+		return
+	}
+	if _, err := notifier.RequestNotificationAuthorization(); err != nil {
+		logrus.Debugf("request notification authorization: %v", err)
+	}
+}
+
+// parseFlagsAndInitLog returns the daemon gRPC address and userSetLogFile
+// (true when --log-file was passed). userSetLogFile is the manual-override
+// signal: true leaves logging alone, false lets the GUI manage a
+// daemon-driven gui-client.log. The flag default is empty (not "console") so
+// "no flag" and an explicit "--log-file console" stay distinguishable; empty
+// falls back to console for InitLog.
+func parseFlagsAndInitLog() (string, bool) {
+	daemonAddr := flag.String("daemon-addr", DaemonAddr(), "Daemon gRPC address: unix:///path or tcp://host:port")
+	logFiles := &stringList{}
+	flag.Var(logFiles, "log-file", "Log destination. Repeat to log to multiple targets at once, e.g. `--log-file console --log-file Y:/netbird-ui.log`. Each value is one of: console, syslog, or a file path. File destinations are rotated by lumberjack (same as the daemon). Defaults to console. Passing any value disables the daemon-debug-driven gui-client.log.")
+	logLevel := flag.String("log-level", "info", "Log level: trace|debug|info|warn|error.")
+	flag.Parse()
+
+	userSetLogFile := len(logFiles.values) > 0
+	targets := logFiles.values
+	if !userSetLogFile {
+		targets = []string{"console"}
+	}
+
+	if err := util.InitLog(*logLevel, targets...); err != nil {
+		log.Fatalf("init log: %v", err)
+	}
+	return *daemonAddr, userSetLogFile
+}
+
+// newApplication constructs the Wails application. onSecondInstance fires when
+// a second process launches under the same SingleInstance UniqueID.
+func newApplication(onSecondInstance func()) *application.App {
+	// On macOS, Options.Icon feeds NSApplication's setApplicationIconImage,
+	// overriding the bundle icon (Assets.car / icons.icns) the OS already
+	// picked. Suppress it on darwin to keep the bundle's squircle.
+	appIcon := iconWindow
+	if runtime.GOOS == "darwin" {
+		appIcon = nil
+	}
+
+	return application.New(application.Options{
+		// On Windows, Name is the AppUserModelID for toast notifications and
+		// the HKCU\Software\Classes\AppUserModelId\ registry path. It must
+		// match the System.AppUserModel.ID the MSI sets on the Start Menu
+		// shortcut (client/netbird.wxs) and the AppUserModelId key the
+		// installer pre-populates with the toast activator CLSID; otherwise
+		// toasts show under a different identity and the MSI's CustomActivator
+		// value is orphaned.
+		Name:        "NetBird",
+		Description: "NetBird desktop client",
+		Icon:        appIcon,
+		Assets: application.AssetOptions{
+			Handler: application.AssetFileServerFS(assets),
+		},
+		Mac: application.MacOptions{
+			ApplicationShouldTerminateAfterLastWindowClosed: false,
+			ActivationPolicy: application.ActivationPolicyAccessory,
+		},
+		Linux: application.LinuxOptions{
+			ProgramName:                   "netbird",
+			DisableQuitOnLastWindowClosed: true,
+		},
+		Windows: application.WindowsOptions{
+			WndProcInterceptor:            endSessionInterceptor(),
+			DisableQuitOnLastWindowClosed: true,
+		},
+		SingleInstance: &application.SingleInstanceOptions{
+			UniqueID: "io.netbird.ui",
+			OnSecondInstanceLaunch: func(_ application.SecondInstanceData) {
+				onSecondInstance()
+			},
+		},
+	})
+}
+
+// buildI18n constructs the i18n bundle, preferences store, and tray localizer.
+// The Bundle satisfies preferences.LanguageValidator so SetLanguage rejects
+// codes that have no shipped translation.
+func buildI18n(app *application.App) (*i18n.Bundle, *preferences.Store, *Localizer) {
+	// Reroot the embedded tree at the locales dir so the bundle sees
+	// _index.json and <lang>/common.json at top level (//go:embed roots at
+	// the package, not the leaf dir).
+	localesFS, err := fs.Sub(localesRoot, "i18n/locales")
+	if err != nil {
+		log.Fatalf("locate locales fs: %v", err)
+	}
+	bundle, err := i18n.NewBundle(localesFS)
+	if err != nil {
+		log.Fatalf("init i18n bundle: %v", err)
+	}
+	prefStore, err := preferences.NewStore(bundle, app.Event)
+	if err != nil {
+		log.Fatalf("init preferences store: %v", err)
+	}
+	return bundle, prefStore, NewLocalizer(bundle, prefStore)
+}
+
+// registerServices binds every Wails-facing service onto the application.
+// Services with no other caller are constructed inline; the rest arrive
+// already built so the tray and feed loops share the same instances.
+func registerServices(app *application.App, conn *Conn, s registeredServices) {
+	app.RegisterService(application.NewService(s.connection))
+	app.RegisterService(application.NewService(services.NewSession(s.authSession, s.bundle, s.prefStore)))
+	app.RegisterService(application.NewService(s.settings))
+	app.RegisterService(application.NewService(s.networks))
+	app.RegisterService(application.NewService(s.profiles))
+	app.RegisterService(application.NewService(services.NewDebug(conn)))
+	app.RegisterService(application.NewService(s.update))
+	app.RegisterService(application.NewService(s.daemonFeed))
+	app.RegisterService(application.NewService(s.notifier))
+	app.RegisterService(application.NewService(s.profileSwitcher))
+	app.RegisterService(application.NewService(services.NewI18n(s.bundle)))
+	app.RegisterService(application.NewService(services.NewPreferences(s.prefStore)))
+	app.RegisterService(application.NewService(services.NewAutostart(app.Autostart)))
+	app.RegisterService(application.NewService(services.NewVersion()))
+	app.RegisterService(application.NewService(services.NewUILog()))
+	app.RegisterService(application.NewService(s.compat))
+}
+
+func newMainWindow(app *application.App, prefStore *preferences.Store, wm *services.WindowManager, startURL string) *application.WebviewWindow {
+	// Width matches the last view mode so Advanced-mode users don't see the
+	// window pop from 380px to 900px on launch. Height is mode-agnostic.
+	initialWidth := 380
+	if prefStore.Get().ViewMode == preferences.ViewModeAdvanced {
+		initialWidth = 900
+	}
+	appearance := services.CurrentAppearance()
+	window := app.Window.NewWithOptions(application.WebviewWindowOptions{
+		Name:   "main",
+		Title:  "NetBird",
+		Width:  initialWidth,
+		Height: services.WindowHeight,
+		// Center on first show; minimal WMs (fluxbox, the XEmbed tray path)
+		// drop new windows top-left unless asked.
+		InitialPosition:     application.WindowCentered,
+		Hidden:              true,
+		BackgroundColour:    services.WindowBackgroundColour(appearance),
+		URL:                 startURL,
+		DisableResize:       true,
+		MinimiseButtonState: application.ButtonHidden,
+		MaximiseButtonState: application.ButtonHidden,
+		Mac:                 services.AppleMacOSAppearanceOptions(appearance),
+		Windows:             services.MicrosoftWindowsAppearanceOptions(appearance),
+		Linux: application.LinuxWindow{
+			Icon: iconWindow,
+		},
+	})
+
+	window.RegisterHook(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+		if services.ShuttingDown() {
+			return
+		}
+		wm.ForgetMain()
+	})
+
+	return window
+}
+
+func registerDockReopenHook(app *application.App, wm *services.WindowManager) {
+	if runtime.GOOS != "darwin" {
+		return
+	}
+	app.Event.RegisterApplicationEventHook(events.Mac.ApplicationShouldHandleReopen, func(e *application.ApplicationEvent) {
+		if e.Context().HasVisibleWindows() {
+			return
+		}
+		e.Cancel()
+		wm.ShowMain()
+	})
+}
diff --git a/client/ui/manifest.xml b/client/ui/manifest.xml
deleted file mode 100644
index c71a407e5..000000000
--- a/client/ui/manifest.xml
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
-    <assemblyIdentity
-            version="0.0.0.1"
-            processorArchitecture="*"
-            name="netbird-ui.exe"
-            type="win32"
-    />
-    <description>Netbird UI application</description>
-    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
-        <security>
-            <requestedPrivileges>
-                <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
-            </requestedPrivileges>
-        </security>
-    </trustInfo>
-</assembly>
\ No newline at end of file
diff --git a/client/ui/netbird-ui.rb.tmpl b/client/ui/netbird-ui.rb.tmpl
index 06971909d..a6ef59d3f 100644
--- a/client/ui/netbird-ui.rb.tmpl
+++ b/client/ui/netbird-ui.rb.tmpl
@@ -17,20 +17,17 @@ cask "{{ $projectName }}" do
 
   depends_on formula: "netbird"
 
-  postflight do
-    set_permissions "/Applications/Netbird UI.app/installer.sh", '0755'
-    set_permissions "/Applications/Netbird UI.app/uninstaller.sh", '0755'
+  postflight_steps do
+    set_permissions ["Netbird UI.app/installer.sh", "Netbird UI.app/uninstaller.sh"], "0755",
+                    base: :appdir, recursive: false
+    run "Netbird UI.app/installer.sh", args: ["#{version}"], base: :appdir, sudo: true
   end
 
-  postflight do
-    system_command "#{appdir}/Netbird UI.app/installer.sh",
-                   args: ["#{version}"],
-                   sudo: true
-  end
-
-  uninstall_preflight do
-    system_command "#{appdir}/Netbird UI.app/uninstaller.sh",
-                   sudo: false
+  uninstall_preflight_steps do
+    run "/bin/launchctl", args: ["bootout", "system/netbird"], sudo: true, must_succeed: false
+    run "/bin/launchctl", args: ["unload", "/Library/LaunchDaemons/netbird.plist"],
+        sudo: true, must_succeed: false
+    remove "/Library/LaunchDaemons/netbird.plist", sudo: true
   end
 
   name "Netbird UI"
diff --git a/client/ui/network.go b/client/ui/network.go
deleted file mode 100644
index cd5d23558..000000000
--- a/client/ui/network.go
+++ /dev/null
@@ -1,707 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"runtime"
-	"sort"
-	"strings"
-	"time"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/dialog"
-	"fyne.io/fyne/v2/layout"
-	"fyne.io/fyne/v2/widget"
-	"fyne.io/systray"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-const (
-	allNetworksText                = "All networks"
-	overlappingNetworksText        = "Overlapping networks"
-	exitNodeNetworksText           = "Exit-node networks"
-	allNetworks             filter = "all"
-	overlappingNetworks     filter = "overlapping"
-	exitNodeNetworks        filter = "exit-node"
-	getClientFMT                   = "get client: %v"
-)
-
-type filter string
-
-func (s *serviceClient) showNetworksUI() {
-	s.wNetworks = s.app.NewWindow("Networks")
-	s.wNetworks.SetOnClosed(s.cancel)
-
-	allGrid := container.New(layout.NewGridLayout(3))
-	go s.updateNetworks(allGrid, allNetworks)
-	overlappingGrid := container.New(layout.NewGridLayout(3))
-	exitNodeGrid := container.New(layout.NewGridLayout(3))
-	routeCheckContainer := container.NewVBox()
-	tabs := container.NewAppTabs(
-		container.NewTabItem(allNetworksText, allGrid),
-		container.NewTabItem(overlappingNetworksText, overlappingGrid),
-		container.NewTabItem(exitNodeNetworksText, exitNodeGrid),
-	)
-	tabs.OnSelected = func(item *container.TabItem) {
-		s.updateNetworksBasedOnDisplayTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-	}
-	tabs.OnUnselected = func(item *container.TabItem) {
-		grid, _ := getGridAndFilterFromTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-		grid.Objects = nil
-	}
-
-	routeCheckContainer.Add(tabs)
-	scrollContainer := container.NewVScroll(routeCheckContainer)
-	scrollContainer.SetMinSize(fyne.NewSize(200, 300))
-
-	buttonBox := container.NewHBox(
-		layout.NewSpacer(),
-		widget.NewButton("Refresh", func() {
-			s.updateNetworksBasedOnDisplayTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-		}),
-		widget.NewButton("Select all", func() {
-			_, f := getGridAndFilterFromTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-			s.selectAllFilteredNetworks(f)
-			s.updateNetworksBasedOnDisplayTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-		}),
-		widget.NewButton("Deselect All", func() {
-			_, f := getGridAndFilterFromTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-			s.deselectAllFilteredNetworks(f)
-			s.updateNetworksBasedOnDisplayTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-		}),
-		layout.NewSpacer(),
-	)
-
-	content := container.NewBorder(nil, buttonBox, nil, nil, scrollContainer)
-
-	s.wNetworks.SetContent(content)
-	s.wNetworks.Show()
-
-	s.startAutoRefresh(10*time.Second, tabs, allGrid, overlappingGrid, exitNodeGrid)
-}
-
-func (s *serviceClient) updateNetworks(grid *fyne.Container, f filter) {
-	grid.Objects = nil
-	grid.Refresh()
-	idHeader := widget.NewLabelWithStyle("      ID", fyne.TextAlignLeading, fyne.TextStyle{Bold: true})
-	networkHeader := widget.NewLabelWithStyle("Range/Domains", fyne.TextAlignLeading, fyne.TextStyle{Bold: true})
-	resolvedIPsHeader := widget.NewLabelWithStyle("Resolved IPs", fyne.TextAlignLeading, fyne.TextStyle{Bold: true})
-
-	grid.Add(idHeader)
-	grid.Add(networkHeader)
-	grid.Add(resolvedIPsHeader)
-
-	filteredRoutes, err := s.getFilteredNetworks(f)
-	if err != nil {
-		return
-	}
-
-	sortNetworksByIDs(filteredRoutes)
-
-	for _, route := range filteredRoutes {
-		r := route
-
-		checkBox := widget.NewCheck(r.GetID(), func(checked bool) {
-			s.selectNetwork(r.ID, checked)
-		})
-		checkBox.Checked = route.Selected
-		checkBox.Resize(fyne.NewSize(20, 20))
-		checkBox.Refresh()
-
-		grid.Add(checkBox)
-		network := r.GetRange()
-		domains := r.GetDomains()
-
-		if len(domains) == 0 {
-			grid.Add(widget.NewLabel(network))
-			grid.Add(widget.NewLabel(""))
-			continue
-		}
-
-		// our selectors are only for display
-		noopFunc := func(_ string) {
-			// do nothing
-		}
-
-		domainsSelector := widget.NewSelect(domains, noopFunc)
-		domainsSelector.Selected = domains[0]
-		grid.Add(domainsSelector)
-
-		var resolvedIPsList []string
-		for domain, ipList := range r.GetResolvedIPs() {
-			resolvedIPsList = append(resolvedIPsList, fmt.Sprintf("%s: %s", domain, strings.Join(ipList.GetIps(), ", ")))
-		}
-
-		if len(resolvedIPsList) == 0 {
-			grid.Add(widget.NewLabel(""))
-			continue
-		}
-
-		// TODO: limit width within the selector display
-		resolvedIPsSelector := widget.NewSelect(resolvedIPsList, noopFunc)
-		resolvedIPsSelector.Selected = resolvedIPsList[0]
-		resolvedIPsSelector.Resize(fyne.NewSize(100, 100))
-		grid.Add(resolvedIPsSelector)
-	}
-
-	s.wNetworks.Content().Refresh()
-	grid.Refresh()
-}
-
-func (s *serviceClient) getFilteredNetworks(f filter) ([]*proto.Network, error) {
-	routes, err := s.fetchNetworks()
-	if err != nil {
-		log.Errorf(getClientFMT, err)
-		s.showError(fmt.Errorf(getClientFMT, err))
-		return nil, err
-	}
-	switch f {
-	case overlappingNetworks:
-		return getOverlappingNetworks(routes), nil
-	case exitNodeNetworks:
-		return getExitNodeNetworks(routes), nil
-	default:
-	}
-	return routes, nil
-}
-
-func getOverlappingNetworks(routes []*proto.Network) []*proto.Network {
-	var filteredRoutes []*proto.Network
-	existingRange := make(map[string][]*proto.Network)
-	for _, route := range routes {
-		if len(route.Domains) > 0 {
-			continue
-		}
-		if r, exists := existingRange[route.GetRange()]; exists {
-			r = append(r, route)
-			existingRange[route.GetRange()] = r
-		} else {
-			existingRange[route.GetRange()] = []*proto.Network{route}
-		}
-	}
-	for _, r := range existingRange {
-		if len(r) > 1 {
-			filteredRoutes = append(filteredRoutes, r...)
-		}
-	}
-	return filteredRoutes
-}
-
-func isDefaultRoute(routeRange string) bool {
-	// routeRange is the merged display string from the daemon, e.g. "0.0.0.0/0",
-	// "::/0", or "0.0.0.0/0, ::/0" when a v4 exit node has a paired v6 entry.
-	for _, part := range strings.Split(routeRange, ",") {
-		switch strings.TrimSpace(part) {
-		case "0.0.0.0/0", "::/0":
-			return true
-		}
-	}
-	return false
-}
-
-func getExitNodeNetworks(routes []*proto.Network) []*proto.Network {
-	var filteredRoutes []*proto.Network
-	for _, route := range routes {
-		if isDefaultRoute(route.Range) {
-			filteredRoutes = append(filteredRoutes, route)
-		}
-	}
-	return filteredRoutes
-}
-
-func sortNetworksByIDs(routes []*proto.Network) {
-	sort.Slice(routes, func(i, j int) bool {
-		return strings.ToLower(routes[i].GetID()) < strings.ToLower(routes[j].GetID())
-	})
-}
-
-func (s *serviceClient) fetchNetworks() ([]*proto.Network, error) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return nil, fmt.Errorf(getClientFMT, err)
-	}
-
-	resp, err := conn.ListNetworks(s.ctx, &proto.ListNetworksRequest{})
-	if err != nil {
-		return nil, fmt.Errorf("failed to list routes: %v", err)
-	}
-
-	return resp.Routes, nil
-}
-
-func (s *serviceClient) selectNetwork(id string, checked bool) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		log.Errorf(getClientFMT, err)
-		s.showError(fmt.Errorf(getClientFMT, err))
-		return
-	}
-
-	req := &proto.SelectNetworksRequest{
-		NetworkIDs: []string{id},
-		Append:     checked,
-	}
-
-	if checked {
-		if _, err := conn.SelectNetworks(s.ctx, req); err != nil {
-			log.Errorf("failed to select network: %v", err)
-			s.showError(fmt.Errorf("failed to select network: %v", err))
-			return
-		}
-		log.Infof("Network '%s' selected", id)
-	} else {
-		if _, err := conn.DeselectNetworks(s.ctx, req); err != nil {
-			log.Errorf("failed to deselect network: %v", err)
-			s.showError(fmt.Errorf("failed to deselect network: %v", err))
-			return
-		}
-		log.Infof("Network '%s' deselected", id)
-	}
-}
-
-func (s *serviceClient) selectAllFilteredNetworks(f filter) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		log.Errorf(getClientFMT, err)
-		return
-	}
-
-	req := s.getNetworksRequest(f, true)
-	if _, err := conn.SelectNetworks(s.ctx, req); err != nil {
-		log.Errorf("failed to select all networks: %v", err)
-		s.showError(fmt.Errorf("failed to select all networks: %v", err))
-		return
-	}
-
-	log.Debug("All networks selected")
-}
-
-func (s *serviceClient) deselectAllFilteredNetworks(f filter) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		log.Errorf(getClientFMT, err)
-		return
-	}
-
-	req := s.getNetworksRequest(f, false)
-	if _, err := conn.DeselectNetworks(s.ctx, req); err != nil {
-		log.Errorf("failed to deselect all networks: %v", err)
-		s.showError(fmt.Errorf("failed to deselect all networks: %v", err))
-		return
-	}
-
-	log.Debug("All networks deselected")
-}
-
-func (s *serviceClient) getNetworksRequest(f filter, appendRoute bool) *proto.SelectNetworksRequest {
-	req := &proto.SelectNetworksRequest{}
-	if f == allNetworks {
-		req.All = true
-	} else {
-		routes, err := s.getFilteredNetworks(f)
-		if err != nil {
-			return nil
-		}
-		for _, route := range routes {
-			req.NetworkIDs = append(req.NetworkIDs, route.GetID())
-		}
-		req.Append = appendRoute
-	}
-	return req
-}
-
-func (s *serviceClient) showError(err error) {
-	wrappedMessage := wrapText(err.Error(), 50)
-
-	dialog.ShowError(fmt.Errorf("%s", wrappedMessage), s.wNetworks)
-}
-
-func (s *serviceClient) startAutoRefresh(interval time.Duration, tabs *container.AppTabs, allGrid, overlappingGrid, exitNodesGrid *fyne.Container) {
-	ticker := time.NewTicker(interval)
-	go func() {
-		for range ticker.C {
-			s.updateNetworksBasedOnDisplayTab(tabs, allGrid, overlappingGrid, exitNodesGrid)
-		}
-	}()
-
-	s.wNetworks.SetOnClosed(func() {
-		ticker.Stop()
-		s.cancel()
-	})
-}
-
-func (s *serviceClient) updateNetworksBasedOnDisplayTab(tabs *container.AppTabs, allGrid, overlappingGrid, exitNodesGrid *fyne.Container) {
-	grid, f := getGridAndFilterFromTab(tabs, allGrid, overlappingGrid, exitNodesGrid)
-	s.wNetworks.Content().Refresh()
-	s.updateNetworks(grid, f)
-}
-
-// startExitNodeRefresh initiates exit node menu refresh after connecting.
-// On Windows, TrayOpenedCh is not supported by the systray library, so we use
-// a background poller to keep exit nodes in sync while connected.
-// On macOS/Linux, TrayOpenedCh handles refreshes on each tray open.
-func (s *serviceClient) startExitNodeRefresh() {
-	s.cancelExitNodeRetry()
-
-	if runtime.GOOS == "windows" {
-		ctx, cancel := context.WithCancel(s.ctx)
-		s.exitNodeMu.Lock()
-		s.exitNodeRetryCancel = cancel
-		s.exitNodeMu.Unlock()
-
-		go s.pollExitNodes(ctx)
-	} else {
-		go s.updateExitNodes()
-	}
-}
-
-func (s *serviceClient) cancelExitNodeRetry() {
-	s.exitNodeMu.Lock()
-	if s.exitNodeRetryCancel != nil {
-		s.exitNodeRetryCancel()
-		s.exitNodeRetryCancel = nil
-	}
-	s.exitNodeMu.Unlock()
-}
-
-// pollExitNodes periodically refreshes exit nodes while connected.
-// Uses a short initial interval to catch routes from the management sync,
-// then switches to a longer interval for ongoing updates.
-func (s *serviceClient) pollExitNodes(ctx context.Context) {
-	// Initial fast polling to catch routes as they appear after connect.
-	for i := 0; i < 5; i++ {
-		if s.updateExitNodes() {
-			break
-		}
-		select {
-		case <-ctx.Done():
-			return
-		case <-time.After(2 * time.Second):
-		}
-	}
-
-	ticker := time.NewTicker(10 * time.Second)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			s.updateExitNodes()
-		}
-	}
-}
-
-// updateExitNodes fetches exit nodes from the daemon and recreates the menu.
-// Returns true if exit nodes were found.
-func (s *serviceClient) updateExitNodes() bool {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		log.Errorf("get client: %v", err)
-		return false
-	}
-	exitNodes, err := s.getExitNodes(conn)
-	if err != nil {
-		log.Errorf("get exit nodes: %v", err)
-		return false
-	}
-
-	s.exitNodeMu.Lock()
-	defer s.exitNodeMu.Unlock()
-
-	s.recreateExitNodeMenu(exitNodes)
-
-	if len(s.mExitNodeItems) > 0 {
-		s.mExitNode.Enable()
-		return true
-	}
-
-	s.mExitNode.Disable()
-	return false
-}
-
-func (s *serviceClient) recreateExitNodeMenu(exitNodes []*proto.Network) {
-	for _, node := range s.mExitNodeItems {
-		node.cancel()
-		node.Hide()
-		node.Remove()
-	}
-	s.mExitNodeItems = nil
-	if s.mExitNodeSeparator != nil {
-		s.mExitNodeSeparator.Remove()
-		s.mExitNodeSeparator = nil
-	}
-	if s.mExitNodeDeselectAll != nil {
-		s.mExitNodeDeselectAll.Remove()
-		s.mExitNodeDeselectAll = nil
-	}
-
-	if runtime.GOOS == "linux" || runtime.GOOS == "freebsd" {
-		s.mExitNode.Remove()
-		s.mExitNode = systray.AddMenuItem("Exit Node", disabledMenuDescr)
-	}
-
-	var showDeselectAll bool
-
-	for _, node := range exitNodes {
-		if node.Selected {
-			showDeselectAll = true
-		}
-
-		menuItem := s.mExitNode.AddSubMenuItemCheckbox(
-			node.ID,
-			fmt.Sprintf("Use exit node %s", node.ID),
-			node.Selected,
-		)
-
-		ctx, cancel := context.WithCancel(s.ctx)
-		s.mExitNodeItems = append(s.mExitNodeItems, menuHandler{
-			MenuItem: menuItem,
-			cancel:   cancel,
-		})
-		go s.handleChecked(ctx, node.ID, menuItem)
-	}
-
-	if showDeselectAll {
-		s.addExitNodeDeselectAll()
-	}
-
-}
-
-func (s *serviceClient) addExitNodeDeselectAll() {
-	sep := s.mExitNode.AddSubMenuItem("───────────────", "")
-	sep.Disable()
-	s.mExitNodeSeparator = sep
-
-	deselectAllItem := s.mExitNode.AddSubMenuItem("Deselect All", "Deselect All")
-	s.mExitNodeDeselectAll = deselectAllItem
-
-	go func() {
-		for {
-			_, ok := <-deselectAllItem.ClickedCh
-			if !ok {
-				return
-			}
-			exitNodes, err := s.handleExitNodeMenuDeselectAll()
-			if err != nil {
-				log.Warnf("failed to handle deselect all exit nodes: %v", err)
-			} else {
-				s.exitNodeMu.Lock()
-				s.recreateExitNodeMenu(exitNodes)
-				s.exitNodeMu.Unlock()
-			}
-		}
-	}()
-}
-
-func (s *serviceClient) getExitNodes(conn proto.DaemonServiceClient) ([]*proto.Network, error) {
-	ctx, cancel := context.WithTimeout(s.ctx, defaultFailTimeout)
-	defer cancel()
-
-	resp, err := conn.ListNetworks(ctx, &proto.ListNetworksRequest{})
-	if err != nil {
-		return nil, fmt.Errorf("list networks: %v", err)
-	}
-
-	var exitNodes []*proto.Network
-	for _, network := range resp.Routes {
-		if isDefaultRoute(network.Range) {
-			exitNodes = append(exitNodes, network)
-		}
-	}
-	return exitNodes, nil
-}
-
-func (s *serviceClient) handleChecked(ctx context.Context, id string, item *systray.MenuItem) {
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case _, ok := <-item.ClickedCh:
-			if !ok {
-				return
-			}
-			if err := s.toggleExitNode(id, item); err != nil {
-				log.Errorf("failed to toggle exit node: %v", err)
-				continue
-			}
-		}
-	}
-}
-
-func (s *serviceClient) handleExitNodeMenuDeselectAll() ([]*proto.Network, error) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return nil, fmt.Errorf("get client: %v", err)
-	}
-
-	exitNodes, err := s.getExitNodes(conn)
-	if err != nil {
-		return nil, fmt.Errorf("get exit nodes: %v", err)
-	}
-
-	var ids []string
-	for _, e := range exitNodes {
-		if e.Selected {
-			ids = append(ids, e.ID)
-		}
-	}
-
-	// deselect selected exit nodes
-	if err := s.deselectOtherExitNodes(conn, ids); err != nil {
-		return nil, err
-	}
-
-	updatedExitNodes, err := s.getExitNodes(conn)
-	if err != nil {
-		return nil, fmt.Errorf("re-fetch exit nodes: %v", err)
-	}
-
-	return updatedExitNodes, nil
-}
-
-// Add function to toggle exit node selection
-func (s *serviceClient) toggleExitNode(nodeID string, item *systray.MenuItem) error {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf("get client: %v", err)
-	}
-
-	log.Infof("Toggling exit node '%s'", nodeID)
-
-	s.exitNodeMu.Lock()
-	defer s.exitNodeMu.Unlock()
-
-	exitNodes, err := s.getExitNodes(conn)
-	if err != nil {
-		return fmt.Errorf("get exit nodes: %v", err)
-	}
-
-	var exitNode *proto.Network
-	// find other selected nodes and ours
-	ids := make([]string, 0, len(exitNodes))
-	for _, node := range exitNodes {
-		if node.ID == nodeID {
-			// preserve original state
-			cp := *node //nolint:govet
-			exitNode = &cp
-
-			// set desired state for recreation
-			node.Selected = true
-			continue
-		}
-		if node.Selected {
-			ids = append(ids, node.ID)
-
-			// set desired state for recreation
-			node.Selected = false
-		}
-	}
-
-	// exit node is the only selected node, deselect it
-	deselectAll := item.Checked() && len(ids) == 0
-	if deselectAll {
-		ids = append(ids, nodeID)
-		for _, node := range exitNodes {
-			if node.ID == nodeID {
-				// set desired state for recreation
-				node.Selected = false
-			}
-		}
-	}
-
-	// deselect all other selected exit nodes
-	if err := s.deselectOtherExitNodes(conn, ids); err != nil {
-		return err
-	}
-
-	if !deselectAll {
-		if err := s.selectNewExitNode(conn, exitNode, nodeID, item); err != nil {
-			return err
-		}
-	}
-
-	// linux/bsd doesn't handle Check/Uncheck well, so we recreate the menu
-	if runtime.GOOS == "linux" || runtime.GOOS == "freebsd" {
-		s.recreateExitNodeMenu(exitNodes)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) deselectOtherExitNodes(conn proto.DaemonServiceClient, ids []string) error {
-	// deselect all other selected exit nodes
-	if len(ids) > 0 {
-		deselectReq := &proto.SelectNetworksRequest{
-			NetworkIDs: ids,
-		}
-		if _, err := conn.DeselectNetworks(s.ctx, deselectReq); err != nil {
-			return fmt.Errorf("deselect networks: %v", err)
-		}
-
-		log.Infof("Deselected exit nodes: %v", ids)
-	}
-
-	// uncheck all other exit node menu items
-	for _, i := range s.mExitNodeItems {
-		i.Uncheck()
-		log.Infof("Unchecked exit node %v", i)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) selectNewExitNode(conn proto.DaemonServiceClient, exitNode *proto.Network, nodeID string, item *systray.MenuItem) error {
-	if exitNode != nil && !exitNode.Selected {
-		selectReq := &proto.SelectNetworksRequest{
-			NetworkIDs: []string{exitNode.ID},
-			Append:     true,
-		}
-		if _, err := conn.SelectNetworks(s.ctx, selectReq); err != nil {
-			return fmt.Errorf("select network: %v", err)
-		}
-
-		log.Infof("Selected exit node '%s'", nodeID)
-	}
-
-	item.Check()
-	log.Infof("Checked exit node '%s'", nodeID)
-
-	return nil
-}
-
-func getGridAndFilterFromTab(tabs *container.AppTabs, allGrid, overlappingGrid, exitNodesGrid *fyne.Container) (*fyne.Container, filter) {
-	switch tabs.Selected().Text {
-	case overlappingNetworksText:
-		return overlappingGrid, overlappingNetworks
-	case exitNodeNetworksText:
-		return exitNodesGrid, exitNodeNetworks
-	default:
-		return allGrid, allNetworks
-	}
-}
-
-// wrapText inserts newlines into the text to ensure that each line is
-// no longer than 'lineLength' runes.
-func wrapText(text string, lineLength int) string {
-	var sb strings.Builder
-	var currentLineLength int
-
-	for _, runeValue := range text {
-		sb.WriteRune(runeValue)
-		currentLineLength++
-
-		if currentLineLength >= lineLength || runeValue == '\n' {
-			sb.WriteRune('\n')
-			currentLineLength = 0
-		}
-	}
-
-	return sb.String()
-}
diff --git a/client/ui/notifier.go b/client/ui/notifier.go
new file mode 100644
index 000000000..71ae3b0df
--- /dev/null
+++ b/client/ui/notifier.go
@@ -0,0 +1,101 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+)
+
+var errNotificationsUnavailable = errors.New("notifications unavailable")
+
+// Notifier wraps the Wails notification service so an unavailable backend
+// disables notifications instead of aborting the app. Startup fails for
+// environment reasons (a bare unbundled binary on macOS has no bundle
+// identifier, a headless Linux session has no D-Bus session bus), and Wails
+// treats a service startup error as fatal. After a failed startup every call
+// is a no-op: on macOS, touching UNUserNotificationCenter without a bundle
+// identifier raises an Objective-C exception that recover() cannot catch.
+type Notifier struct {
+	inner     *notifications.NotificationService
+	available atomic.Bool
+}
+
+func newNotifier() *Notifier {
+	return &Notifier{inner: notifications.New()}
+}
+
+// ServiceName implements the Wails service-name hook for startup logs.
+func (n *Notifier) ServiceName() string {
+	return n.inner.ServiceName()
+}
+
+// ServiceStartup starts the platform notifier, downgrading failure to a
+// warning so the app keeps running without notifications.
+func (n *Notifier) ServiceStartup(ctx context.Context, options application.ServiceOptions) error {
+	if err := n.inner.ServiceStartup(ctx, options); err != nil {
+		log.Warnf("notifications disabled: %v", err)
+		return nil
+	}
+	n.available.Store(true)
+	return nil
+}
+
+func (n *Notifier) ServiceShutdown() error {
+	if !n.available.Load() {
+		return nil
+	}
+	return n.inner.ServiceShutdown()
+}
+
+func (n *Notifier) CheckNotificationAuthorization() (bool, error) {
+	if !n.available.Load() {
+		return false, errNotificationsUnavailable
+	}
+	return n.inner.CheckNotificationAuthorization()
+}
+
+func (n *Notifier) RequestNotificationAuthorization() (bool, error) {
+	if !n.available.Load() {
+		return false, errNotificationsUnavailable
+	}
+	return n.inner.RequestNotificationAuthorization()
+}
+
+// SendNotification delivers a notification, silently dropping it when the
+// backend never started (notifications are best-effort everywhere).
+func (n *Notifier) SendNotification(options notifications.NotificationOptions) error {
+	if !n.available.Load() {
+		log.Debugf("notifications disabled, dropping %q", options.ID)
+		return nil
+	}
+	return n.inner.SendNotification(options)
+}
+
+func (n *Notifier) SendNotificationWithActions(options notifications.NotificationOptions) error {
+	if !n.available.Load() {
+		log.Debugf("notifications disabled, dropping %q", options.ID)
+		return nil
+	}
+	return n.inner.SendNotificationWithActions(options)
+}
+
+func (n *Notifier) RegisterNotificationCategory(category notifications.NotificationCategory) error {
+	if !n.available.Load() {
+		return nil
+	}
+	return n.inner.RegisterNotificationCategory(category)
+}
+
+// OnNotificationResponse registers the response callback. Pure Go state, so
+// it is safe (and simply inert) when the backend never started.
+//
+//wails:ignore
+func (n *Notifier) OnNotificationResponse(callback func(result notifications.NotificationResult)) {
+	n.inner.OnNotificationResponse(callback)
+}
diff --git a/client/ui/notifier/notifier.go b/client/ui/notifier/notifier.go
deleted file mode 100644
index 8d1cbe4c4..000000000
--- a/client/ui/notifier/notifier.go
+++ /dev/null
@@ -1,27 +0,0 @@
-// Package notifier sends desktop notifications. On Windows it uses the WinRT
-// COM API directly via go-toast/v2 to avoid the PowerShell window flash that
-// fyne's default implementation produces. On other platforms it delegates to
-// fyne.
-package notifier
-
-import "fyne.io/fyne/v2"
-
-// Notifier sends desktop notifications.
-type Notifier interface {
-	Send(title, body string)
-}
-
-// New returns a platform-specific Notifier. The fyne app is used as the
-// fallback notifier on platforms where no native implementation is wired up,
-// and on Windows when the COM path fails to initialize.
-func New(app fyne.App) Notifier {
-	return newNotifier(app)
-}
-
-type fyneNotifier struct {
-	app fyne.App
-}
-
-func (f *fyneNotifier) Send(title, body string) {
-	f.app.SendNotification(fyne.NewNotification(title, body))
-}
diff --git a/client/ui/notifier/notifier_other.go b/client/ui/notifier/notifier_other.go
deleted file mode 100644
index 686d2885f..000000000
--- a/client/ui/notifier/notifier_other.go
+++ /dev/null
@@ -1,9 +0,0 @@
-//go:build !windows
-
-package notifier
-
-import "fyne.io/fyne/v2"
-
-func newNotifier(app fyne.App) Notifier {
-	return &fyneNotifier{app: app}
-}
diff --git a/client/ui/notifier/notifier_windows.go b/client/ui/notifier/notifier_windows.go
deleted file mode 100644
index c7afb43ae..000000000
--- a/client/ui/notifier/notifier_windows.go
+++ /dev/null
@@ -1,88 +0,0 @@
-package notifier
-
-import (
-	"os"
-	"path/filepath"
-	"sync"
-
-	"fyne.io/fyne/v2"
-	toast "git.sr.ht/~jackmordaunt/go-toast/v2"
-	"git.sr.ht/~jackmordaunt/go-toast/v2/wintoast"
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	// appID is the AppUserModelID shown in the Windows Action Center. It
-	// must match the System.AppUserModel.ID property set on the Start Menu
-	// shortcut by the MSI (see client/netbird.wxs); otherwise Windows
-	// groups toasts under a separate, unbranded entry.
-	appID = "NetBird"
-
-	// appGUID identifies the COM activation callback class. Generated once
-	// for NetBird; do not change without coordinating an installer bump,
-	// since old registry entries pointing at the previous GUID would orphan.
-	appGUID = "{0E1B4DE7-E148-432B-9814-544F941826EC}"
-)
-
-type comNotifier struct {
-	fallback *fyneNotifier
-	ready    bool
-	iconPath string
-}
-
-var (
-	initOnce sync.Once
-	initErr  error
-)
-
-func newNotifier(app fyne.App) Notifier {
-	n := &comNotifier{
-		fallback: &fyneNotifier{app: app},
-		iconPath: resolveIcon(),
-	}
-	initOnce.Do(func() {
-		initErr = wintoast.SetAppData(wintoast.AppData{
-			AppID:    appID,
-			GUID:     appGUID,
-			IconPath: n.iconPath,
-		})
-	})
-	if initErr != nil {
-		log.Warnf("toast: register app data failed, falling back to fyne notifications: %v", initErr)
-		return n.fallback
-	}
-	n.ready = true
-	return n
-}
-
-func (n *comNotifier) Send(title, body string) {
-	if !n.ready {
-		n.fallback.Send(title, body)
-		return
-	}
-	notification := toast.Notification{
-		AppID: appID,
-		Title: title,
-		Body:  body,
-		Icon:  n.iconPath,
-	}
-	if err := notification.Push(); err != nil {
-		log.Warnf("toast: push failed, using fyne fallback: %v", err)
-		n.fallback.Send(title, body)
-	}
-}
-
-// resolveIcon returns an absolute path to the toast icon, or an empty string
-// when no icon can be located. Windows requires a PNG/JPG for the
-// AppUserModelId IconUri registry value; .ico is silently ignored.
-func resolveIcon() string {
-	exe, err := os.Executable()
-	if err != nil {
-		return ""
-	}
-	candidate := filepath.Join(filepath.Dir(exe), "netbird.png")
-	if _, err := os.Stat(candidate); err == nil {
-		return candidate
-	}
-	return ""
-}
diff --git a/client/ui/preferences/store.go b/client/ui/preferences/store.go
new file mode 100644
index 000000000..9f3f9297e
--- /dev/null
+++ b/client/ui/preferences/store.go
@@ -0,0 +1,385 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package preferences holds user-scope UI state, independent of the daemon
+// profile and shared across all profiles. The Store persists to JSON under
+// os.UserConfigDir() and broadcasts changes to in-process subscribers plus an
+// optional emitter.
+package preferences
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/util"
+)
+
+// Lives under os.UserConfigDir()/netbird (OS-user writable, not the daemon's
+// root-owned state).
+const preferencesFileName = "ui-preferences.json"
+
+// EventPreferencesChanged fires on every persisted update, payload UIPreferences.
+const EventPreferencesChanged = "netbird:preferences:changed"
+
+// ViewMode is the preferred Main-window layout: "default" (compact, 380-wide)
+// or "advanced" (900-wide).
+type ViewMode string
+
+const (
+	ViewModeDefault  ViewMode = "default"
+	ViewModeAdvanced ViewMode = "advanced"
+)
+
+// DefaultViewMode applies when no file exists or its view-mode is empty.
+const DefaultViewMode = ViewModeDefault
+
+var ErrUnsupportedViewMode = errors.New("unsupported view mode")
+
+func (v ViewMode) IsValid() bool {
+	switch v {
+	case ViewModeDefault, ViewModeAdvanced:
+		return true
+	}
+	return false
+}
+
+// Theme is the preferred UI appearance: follow the OS ("system") or force
+// "light"/"dark".
+type Theme string
+
+const (
+	ThemeSystem Theme = "system"
+	ThemeLight  Theme = "light"
+	ThemeDark   Theme = "dark"
+)
+
+// DefaultTheme applies when no file exists or its theme is empty/unknown.
+const DefaultTheme = ThemeSystem
+
+var ErrUnsupportedTheme = errors.New("unsupported theme")
+
+func (t Theme) IsValid() bool {
+	switch t {
+	case ThemeSystem, ThemeLight, ThemeDark:
+		return true
+	}
+	return false
+}
+
+// UIPreferences is rewritten in full on every change; there are no partial updates.
+type UIPreferences struct {
+	Language            i18n.LanguageCode `json:"language"`
+	ViewMode            ViewMode          `json:"viewMode"`
+	Theme               Theme             `json:"theme"`
+	OnboardingCompleted bool              `json:"onboardingCompleted"`
+	// AutostartInitialized records that the one-time autostart default
+	// decision has run for this OS user. It only ever transitions to true
+	// and is never reset, so the default-on flow runs at most once, ever.
+	AutostartInitialized bool `json:"autostartInitialized"`
+	// KeepConnectedOnQuit leaves the daemon connected when the GUI quits.
+	// Its false zero value preserves the historical disconnect-on-quit
+	// behaviour for preference files written before the field existed.
+	KeepConnectedOnQuit bool `json:"keepConnectedOnQuit"`
+}
+
+// LanguageValidator rejects SetLanguage inputs with no shipped bundle.
+// *i18n.Bundle satisfies it.
+type LanguageValidator interface {
+	HasLanguage(code i18n.LanguageCode) bool
+}
+
+// Emitter broadcasts changes to the frontend. Wails'
+// *application.EventProcessor satisfies it; tests pass nil or a fake.
+type Emitter interface {
+	Emit(name string, data ...any) bool
+}
+
+// Store is the user-scope UI preferences store.
+type Store struct {
+	path string
+
+	mu            sync.RWMutex
+	current       UIPreferences
+	existedAtLoad bool
+
+	subsMu sync.Mutex
+	subs   []chan UIPreferences
+
+	validator LanguageValidator
+	emitter   Emitter
+}
+
+// NewStore loads preferences from disk, falling back to defaults. A nil
+// validator skips SetLanguage validation; a nil emitter skips broadcasting.
+func NewStore(validator LanguageValidator, emitter Emitter) (*Store, error) {
+	path, err := preferencesPath()
+	if err != nil {
+		return nil, fmt.Errorf("resolve preferences path: %w", err)
+	}
+
+	// Language starts empty: the frontend treats absence as the signal to
+	// detect the browser locale on first launch and call SetLanguage.
+	s := &Store{
+		path:      path,
+		validator: validator,
+		emitter:   emitter,
+		current:   UIPreferences{ViewMode: DefaultViewMode, Theme: DefaultTheme},
+	}
+
+	if err := s.load(); err != nil {
+		log.Warnf("load ui preferences from %s: %v (using defaults)", path, err)
+	}
+
+	return s, nil
+}
+
+// Get returns a copy of the current preferences.
+func (s *Store) Get() UIPreferences {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.current
+}
+
+// SetViewMode validates, persists, and broadcasts. No-op if unchanged.
+func (s *Store) SetViewMode(mode ViewMode) error {
+	if !mode.IsValid() {
+		return fmt.Errorf("%w: %q", ErrUnsupportedViewMode, mode)
+	}
+
+	s.mu.Lock()
+	if s.current.ViewMode == mode {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.ViewMode = mode
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
+// SetTheme validates, persists, and broadcasts. No-op if unchanged.
+func (s *Store) SetTheme(theme Theme) error {
+	if !theme.IsValid() {
+		return fmt.Errorf("%w: %q", ErrUnsupportedTheme, theme)
+	}
+
+	s.mu.Lock()
+	if s.current.Theme == theme {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.Theme = theme
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
+// SetOnboardingCompleted persists the welcome-window dismissal. No-op if unchanged.
+func (s *Store) SetOnboardingCompleted(done bool) error {
+	s.mu.Lock()
+	if s.current.OnboardingCompleted == done {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.OnboardingCompleted = done
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
+// SetAutostartInitialized persists the one-time autostart decision marker.
+// No-op if unchanged.
+func (s *Store) SetAutostartInitialized(done bool) error {
+	s.mu.Lock()
+	if s.current.AutostartInitialized == done {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.AutostartInitialized = done
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
+// SetKeepConnectedOnQuit persists the disconnect-on-quit opt-out. No-op if unchanged.
+func (s *Store) SetKeepConnectedOnQuit(keep bool) error {
+	s.mu.Lock()
+	if s.current.KeepConnectedOnQuit == keep {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.KeepConnectedOnQuit = keep
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
+// SetLanguage validates, persists, and broadcasts. No-op if unchanged.
+func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
+	if lang == "" {
+		return fmt.Errorf("%w: empty code", i18n.ErrUnsupportedLanguage)
+	}
+	if s.validator != nil && !s.validator.HasLanguage(lang) {
+		return fmt.Errorf("%w: %q", i18n.ErrUnsupportedLanguage, lang)
+	}
+
+	s.mu.Lock()
+	if s.current.Language == lang {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.Language = lang
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
+// Subscribe returns a channel of persisted changes and an unsubscribe func.
+// The unsubscribe func closes the channel; callers must not close it themselves.
+func (s *Store) Subscribe() (<-chan UIPreferences, func()) {
+	ch := make(chan UIPreferences, 4)
+	s.subsMu.Lock()
+	s.subs = append(s.subs, ch)
+	s.subsMu.Unlock()
+
+	unsubscribe := func() {
+		s.subsMu.Lock()
+		defer s.subsMu.Unlock()
+		for i, c := range s.subs {
+			if c == ch {
+				s.subs = append(s.subs[:i], s.subs[i+1:]...)
+				close(ch)
+				return
+			}
+		}
+	}
+	return ch, unsubscribe
+}
+
+// ExistedAtLoad reports whether the backing preferences file was present on
+// disk when the store loaded. It distinguishes a user who ran a prior GUI
+// version from a brand-new OS user with no preferences yet.
+func (s *Store) ExistedAtLoad() bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.existedAtLoad
+}
+
+// load reads the file into current. A missing file is not an error (the
+// in-memory default stands); malformed contents return an error.
+func (s *Store) load() error {
+	if _, err := os.Stat(s.path); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			log.Infof("no ui preferences file at %s; using defaults", s.path)
+			return nil
+		}
+		return fmt.Errorf("stat preferences: %w", err)
+	}
+
+	s.mu.Lock()
+	s.existedAtLoad = true
+	s.mu.Unlock()
+
+	var loaded UIPreferences
+	if _, err := util.ReadJson(s.path, &loaded); err != nil {
+		return err
+	}
+
+	if !loaded.ViewMode.IsValid() {
+		loaded.ViewMode = DefaultViewMode
+	}
+	if !loaded.Theme.IsValid() {
+		loaded.Theme = DefaultTheme
+	}
+
+	s.mu.Lock()
+	s.current = loaded
+	s.mu.Unlock()
+	return nil
+}
+
+// persistLocked writes v to disk. Caller must hold s.mu and update in-memory
+// state only after this returns nil.
+func (s *Store) persistLocked(v UIPreferences) error {
+	if err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {
+		return fmt.Errorf("mkdir %s: %w", filepath.Dir(s.path), err)
+	}
+	return util.WriteJson(context.Background(), s.path, v)
+}
+
+// broadcast fans v out to subscribers and the emitter. Full-buffer subscribers
+// are skipped: consumers only need the latest value, so dropping is safe.
+func (s *Store) broadcast(v UIPreferences) {
+	s.subsMu.Lock()
+	subs := make([]chan UIPreferences, len(s.subs))
+	copy(subs, s.subs)
+	s.subsMu.Unlock()
+
+	for _, ch := range subs {
+		select {
+		case ch <- v:
+		default:
+			log.Debugf("preferences subscriber channel full; dropping update")
+		}
+	}
+
+	if s.emitter != nil {
+		s.emitter.Emit(EventPreferencesChanged, v)
+	}
+}
+
+func preferencesPath() (string, error) {
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, "netbird", preferencesFileName), nil
+}
diff --git a/client/ui/preferences/store_test.go b/client/ui/preferences/store_test.go
new file mode 100644
index 000000000..3e1cb3107
--- /dev/null
+++ b/client/ui/preferences/store_test.go
@@ -0,0 +1,301 @@
+//go:build !android && !ios && !freebsd && !js
+
+package preferences
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+)
+
+// fakeValidator implements LanguageValidator for tests so we don't need a
+// fully-loaded i18n.Bundle.
+type fakeValidator struct{ ok map[i18n.LanguageCode]bool }
+
+func (f fakeValidator) HasLanguage(code i18n.LanguageCode) bool { return f.ok[code] }
+
+// recordingEmitter captures Emit calls so tests can assert the broadcast
+// fired.
+type recordingEmitter struct {
+	mu    sync.Mutex
+	calls []emitCall
+}
+
+type emitCall struct {
+	name string
+	data []any
+}
+
+func (r *recordingEmitter) Emit(name string, data ...any) bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.calls = append(r.calls, emitCall{name: name, data: data})
+	return true
+}
+
+func (r *recordingEmitter) calledWith(name string) []emitCall {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	var out []emitCall
+	for _, c := range r.calls {
+		if c.name == name {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+// withTempConfigDir reroots os.UserConfigDir() at a temporary directory by
+// pointing the OS-specific env vars there. Restored automatically by
+// t.Setenv.
+func withTempConfigDir(t *testing.T) string {
+	t.Helper()
+	tmp := t.TempDir()
+	switch runtime.GOOS {
+	case "darwin":
+		t.Setenv("HOME", tmp)
+		require.NoError(t, os.MkdirAll(filepath.Join(tmp, "Library", "Application Support"), 0o755))
+	case "windows":
+		t.Setenv("AppData", tmp)
+	default:
+		t.Setenv("XDG_CONFIG_HOME", tmp)
+	}
+	return tmp
+}
+
+func TestStore_DefaultsWhenFileMissing(t *testing.T) {
+	withTempConfigDir(t)
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true}}, nil)
+	require.NoError(t, err)
+
+	got := s.Get()
+	assert.Equal(t, i18n.LanguageCode(""), got.Language, "language must be empty when no file is on disk so the frontend can detect the browser locale")
+	assert.Equal(t, DefaultViewMode, got.ViewMode, "view-mode default should still apply")
+}
+
+func TestStore_SetLanguagePersistsAndBroadcasts(t *testing.T) {
+	withTempConfigDir(t)
+	emitter := &recordingEmitter{}
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true, "hu": true}}, emitter)
+	require.NoError(t, err)
+
+	ch, unsubscribe := s.Subscribe()
+	defer unsubscribe()
+
+	require.NoError(t, s.SetLanguage("hu"))
+
+	got := s.Get()
+	assert.Equal(t, i18n.LanguageCode("hu"), got.Language, "Get should reflect the SetLanguage value")
+
+	select {
+	case v := <-ch:
+		assert.Equal(t, i18n.LanguageCode("hu"), v.Language, "subscriber should receive the new value")
+	case <-time.After(time.Second):
+		t.Fatal("subscriber timed out waiting for update")
+	}
+
+	emits := emitter.calledWith(EventPreferencesChanged)
+	require.Len(t, emits, 1, "Emit should fire exactly once per SetLanguage")
+	payload, ok := emits[0].data[0].(UIPreferences)
+	require.True(t, ok, "emitter payload should be UIPreferences")
+	assert.Equal(t, i18n.LanguageCode("hu"), payload.Language)
+}
+
+func TestStore_LoadFromDisk(t *testing.T) {
+	withTempConfigDir(t)
+	path, err := preferencesPath()
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+	require.NoError(t, os.WriteFile(path, []byte(`{"language":"hu"}`), 0o644))
+
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"hu": true}}, nil)
+	require.NoError(t, err)
+
+	got := s.Get()
+	assert.Equal(t, i18n.LanguageCode("hu"), got.Language, "Get should load language from existing file")
+}
+
+func TestStore_UnsupportedLanguageRejected(t *testing.T) {
+	withTempConfigDir(t)
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true}}, nil)
+	require.NoError(t, err)
+
+	err = s.SetLanguage("xx")
+	require.Error(t, err, "unknown language must be rejected")
+	assert.ErrorIs(t, err, i18n.ErrUnsupportedLanguage)
+
+	err = s.SetLanguage("")
+	assert.ErrorIs(t, err, i18n.ErrUnsupportedLanguage, "empty language code must be rejected")
+}
+
+func TestStore_NoValidatorAcceptsAnything(t *testing.T) {
+	withTempConfigDir(t)
+	s, err := NewStore(nil, nil)
+	require.NoError(t, err)
+
+	require.NoError(t, s.SetLanguage("fr"))
+	got := s.Get()
+	assert.Equal(t, i18n.LanguageCode("fr"), got.Language)
+}
+
+func TestStore_SetLanguageIdempotent(t *testing.T) {
+	withTempConfigDir(t)
+	emitter := &recordingEmitter{}
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true}}, emitter)
+	require.NoError(t, err)
+
+	// First call goes from "" (unset) to "en" — real change, one broadcast.
+	require.NoError(t, s.SetLanguage("en"))
+	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1,
+		"first SetLanguage from unset should broadcast")
+
+	// Second call is a no-op — no disk write, no broadcast. Without this
+	// guard the tray would re-render the menu on every cosmetic re-save of
+	// the preferences file.
+	require.NoError(t, s.SetLanguage("en"))
+	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1,
+		"re-setting the current language should not broadcast again")
+}
+
+func TestStore_CorruptFileFallsBackToDefault(t *testing.T) {
+	withTempConfigDir(t)
+	path, err := preferencesPath()
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+	require.NoError(t, os.WriteFile(path, []byte("{not json"), 0o644))
+
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true}}, nil)
+	require.NoError(t, err, "corrupt file should not fail construction")
+
+	got := s.Get()
+	assert.Equal(t, i18n.LanguageCode(""), got.Language, "corrupt JSON should leave the empty (unset) default in place so the frontend can re-detect")
+}
+
+func TestStore_UnsubscribeStopsUpdates(t *testing.T) {
+	withTempConfigDir(t)
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true, "hu": true}}, nil)
+	require.NoError(t, err)
+
+	ch, unsubscribe := s.Subscribe()
+	unsubscribe()
+
+	require.NoError(t, s.SetLanguage("hu"))
+
+	select {
+	case _, ok := <-ch:
+		assert.False(t, ok, "channel should be closed after unsubscribe")
+	case <-time.After(time.Second):
+		t.Fatal("expected closed channel, got nothing")
+	}
+}
+
+func TestStore_FileShapeIsJSON(t *testing.T) {
+	withTempConfigDir(t)
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"hu": true}}, nil)
+	require.NoError(t, err)
+	require.NoError(t, s.SetLanguage("hu"))
+
+	path, err := preferencesPath()
+	require.NoError(t, err)
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	var parsed UIPreferences
+	require.NoError(t, json.Unmarshal(data, &parsed), "on-disk file must be valid JSON")
+	assert.Equal(t, i18n.LanguageCode("hu"), parsed.Language)
+}
+
+func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
+	withTempConfigDir(t)
+	emitter := &recordingEmitter{}
+	s, err := NewStore(nil, emitter)
+	require.NoError(t, err)
+
+	assert.False(t, s.Get().AutostartInitialized, "marker must default to false when no file is on disk")
+
+	require.NoError(t, s.SetAutostartInitialized(true))
+	assert.True(t, s.Get().AutostartInitialized, "Get should reflect the persisted marker")
+	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first marker write should broadcast")
+
+	// Re-setting the same value must be a no-op: no disk write, no broadcast.
+	require.NoError(t, s.SetAutostartInitialized(true))
+	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent marker write should not broadcast again")
+
+	// A fresh Store (new GUI launch) must see the marker so the autostart
+	// default decision never runs twice.
+	reloaded, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
+}
+
+func TestStore_SetKeepConnectedOnQuitPersistsAcrossReload(t *testing.T) {
+	withTempConfigDir(t)
+	emitter := &recordingEmitter{}
+	s, err := NewStore(nil, emitter)
+	require.NoError(t, err)
+
+	assert.False(t, s.Get().KeepConnectedOnQuit, "quitting must disconnect by default")
+
+	require.NoError(t, s.SetKeepConnectedOnQuit(true))
+	assert.True(t, s.Get().KeepConnectedOnQuit, "Get should reflect the persisted opt-out")
+	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first write should broadcast")
+
+	require.NoError(t, s.SetKeepConnectedOnQuit(true))
+	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent write should not broadcast again")
+
+	reloaded, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.True(t, reloaded.Get().KeepConnectedOnQuit, "opt-out must survive a reload from disk")
+}
+
+func TestStore_KeepConnectedOnQuitDefaultsFalseForPreExistingFile(t *testing.T) {
+	withTempConfigDir(t)
+
+	// A preferences file written before the field existed must keep the
+	// historical disconnect-on-quit behaviour rather than silently opting out.
+	path, err := preferencesPath()
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+	require.NoError(t, os.WriteFile(path, []byte(`{"language":"en","viewMode":"default"}`), 0o600))
+
+	s, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.False(t, s.Get().KeepConnectedOnQuit, "a file predating the field must not opt out of disconnect-on-quit")
+	assert.True(t, s.ExistedAtLoad(), "the pre-existing file must be seen on disk")
+}
+
+func TestStore_ExistedAtLoad(t *testing.T) {
+	withTempConfigDir(t)
+
+	// Brand-new OS user: no preferences file on disk yet.
+	fresh, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.False(t, fresh.ExistedAtLoad(), "ExistedAtLoad must be false when no file is on disk")
+
+	// Persisting a value writes the file to disk.
+	require.NoError(t, fresh.SetLanguage("en"))
+
+	// A subsequent GUI launch reopens the now-present file.
+	reopened, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.True(t, reopened.ExistedAtLoad(), "ExistedAtLoad must be true after the store has persisted and is reopened")
+}
+
+func TestStore_ErrUnsupportedSentinel(t *testing.T) {
+	// Verifies callers can match on the sentinel error rather than parsing
+	// strings — protects against accidental %v -> %w changes that would
+	// silently break errors.Is.
+	err := errors.New("inner")
+	wrapped := errors.Join(i18n.ErrUnsupportedLanguage, err)
+	assert.ErrorIs(t, wrapped, i18n.ErrUnsupportedLanguage)
+}
diff --git a/client/ui/privileged_settings.go b/client/ui/privileged_settings.go
new file mode 100644
index 000000000..1e8b4bbf6
--- /dev/null
+++ b/client/ui/privileged_settings.go
@@ -0,0 +1,27 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// The one-shot mode this binary runs itself in, elevated, to apply the settings the
+// daemon restricts to root/administrator. It is handled before anything GUI, so no
+// window, tray or single-instance lock is involved.
+//
+// Only the wiring is here: what the mode accepts and does lives beside the code
+// that asks for it, in services.RunPrivilegedSettings, so the settings it will
+// apply are declared once. There is nothing privileged about the mode itself; it
+// sends the same request the frontend would have sent, and the daemon authorizes it
+// from the identity the kernel reports on the control channel exactly as it does
+// for `sudo netbird up`.
+func runPrivilegedSettings(args []string) int {
+	return services.RunPrivilegedSettings(args, func(addr string) (proto.DaemonServiceClient, error) {
+		if addr == "" {
+			addr = DaemonAddr()
+		}
+		return NewConn(addr).Client()
+	})
+}
diff --git a/client/ui/process/process.go b/client/ui/process/process.go
deleted file mode 100644
index 28276f416..000000000
--- a/client/ui/process/process.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package process
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/shirou/gopsutil/v3/process"
-)
-
-func IsAnotherProcessRunning() (int32, bool, error) {
-	processes, err := process.Processes()
-	if err != nil {
-		return 0, false, err
-	}
-
-	pid := os.Getpid()
-	processName := strings.ToLower(filepath.Base(os.Args[0]))
-
-	for _, p := range processes {
-		if int(p.Pid) == pid {
-			continue
-		}
-
-		runningProcessPath, err := p.Exe()
-		// most errors are related to short-lived processes
-		if err != nil {
-			continue
-		}
-
-		runningProcessName := strings.ToLower(filepath.Base(runningProcessPath))
-		if runningProcessName == processName && isProcessOwnedByCurrentUser(p) {
-			return p.Pid, true, nil
-		}
-	}
-
-	return 0, false, nil
-}
diff --git a/client/ui/process/process_nonwindows.go b/client/ui/process/process_nonwindows.go
deleted file mode 100644
index cf9f6443d..000000000
--- a/client/ui/process/process_nonwindows.go
+++ /dev/null
@@ -1,26 +0,0 @@
-//go:build !windows
-
-package process
-
-import (
-	"os"
-
-	"github.com/shirou/gopsutil/v3/process"
-	log "github.com/sirupsen/logrus"
-)
-
-func isProcessOwnedByCurrentUser(p *process.Process) bool {
-	currentUserID := os.Getuid()
-	uids, err := p.Uids()
-	if err != nil {
-		log.Errorf("get process uids: %v", err)
-		return false
-	}
-	for _, id := range uids {
-		log.Debugf("checking process uid: %d", id)
-		if int(id) == currentUserID {
-			return true
-		}
-	}
-	return false
-}
diff --git a/client/ui/process/process_windows.go b/client/ui/process/process_windows.go
deleted file mode 100644
index 2d211d1a4..000000000
--- a/client/ui/process/process_windows.go
+++ /dev/null
@@ -1,24 +0,0 @@
-package process
-
-import (
-	"os/user"
-
-	"github.com/shirou/gopsutil/v3/process"
-	log "github.com/sirupsen/logrus"
-)
-
-func isProcessOwnedByCurrentUser(p *process.Process) bool {
-	processUsername, err := p.Username()
-	if err != nil {
-		log.Errorf("get process username error: %v", err)
-		return false
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		log.Errorf("get current user error: %v", err)
-		return false
-	}
-
-	return processUsername == currUser.Username
-}
diff --git a/client/ui/profile.go b/client/ui/profile.go
deleted file mode 100644
index 83b0ec18b..000000000
--- a/client/ui/profile.go
+++ /dev/null
@@ -1,775 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os/user"
-	"slices"
-	"sort"
-	"sync"
-	"time"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/dialog"
-	"fyne.io/fyne/v2/layout"
-	"fyne.io/fyne/v2/widget"
-	"fyne.io/systray"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// showProfilesUI creates and displays the Profiles window with a list of existing profiles,
-// a button to add new profiles, allows removal, and lets the user switch the active profile.
-func (s *serviceClient) showProfilesUI() {
-
-	profiles, err := s.getProfiles()
-	if err != nil {
-		log.Errorf("get profiles: %v", err)
-		return
-	}
-
-	var refresh func()
-	// List widget for profiles
-	list := widget.NewList(
-		func() int { return len(profiles) },
-		func() fyne.CanvasObject {
-			// Each item: Selected indicator, Name, spacer, Select, Logout & Remove buttons
-			return container.NewHBox(
-				widget.NewLabel(""), // indicator
-				widget.NewLabel(""), // profile name
-				layout.NewSpacer(),
-				widget.NewButton("Select", nil),
-				widget.NewButton("Deregister", nil),
-				widget.NewButton("Remove", nil),
-			)
-		},
-		func(i widget.ListItemID, item fyne.CanvasObject) {
-			// Populate each row
-			row := item.(*fyne.Container)
-			indicator := row.Objects[0].(*widget.Label)
-			nameLabel := row.Objects[1].(*widget.Label)
-			selectBtn := row.Objects[3].(*widget.Button)
-			logoutBtn := row.Objects[4].(*widget.Button)
-			removeBtn := row.Objects[5].(*widget.Button)
-
-			profile := profiles[i]
-			// Show a checkmark if selected
-			if profile.IsActive {
-				indicator.SetText("✓")
-			} else {
-				indicator.SetText("")
-			}
-			nameLabel.SetText(formatProfileLabel(profile, profiles))
-
-			// Configure Select/Active button
-			selectBtn.SetText(func() string {
-				if profile.IsActive {
-					return "Active"
-				}
-				return "Select"
-			}())
-			selectBtn.OnTapped = func() {
-				if profile.IsActive {
-					return // already active
-				}
-				// confirm switch
-				dialog.ShowConfirm(
-					"Switch Profile",
-					fmt.Sprintf("Are you sure you want to switch to '%s'?", profile.Name),
-					func(confirm bool) {
-						if !confirm {
-							return
-						}
-						// switch
-						err = s.switchProfile(profile.ID)
-						if err != nil {
-							log.Errorf("failed to switch profile: %v", err)
-							dialog.ShowError(errors.New("failed to select profile"), s.wProfiles)
-							return
-						}
-
-						dialog.ShowInformation(
-							"Profile Switched",
-							fmt.Sprintf("Profile '%s' switched successfully", profile.Name),
-							s.wProfiles,
-						)
-
-						conn, err := s.getSrvClient(defaultFailTimeout)
-						if err != nil {
-							log.Errorf("failed to get daemon client: %v", err)
-							return
-						}
-
-						status, err := conn.Status(s.ctx, &proto.StatusRequest{})
-						if err != nil {
-							log.Errorf("failed to get status after switching profile: %v", err)
-							return
-						}
-
-						if status.Status == string(internal.StatusConnected) {
-							if err := s.menuDownClick(); err != nil {
-								log.Errorf("failed to handle down click after switching profile: %v", err)
-								dialog.ShowError(fmt.Errorf("failed to handle down click"), s.wProfiles)
-								return
-							}
-						}
-						// update slice flags
-						refresh()
-					},
-					s.wProfiles,
-				)
-			}
-
-			logoutBtn.Show()
-			logoutBtn.SetText("Deregister")
-			logoutBtn.OnTapped = func() {
-				s.handleProfileLogout(profile, refresh)
-			}
-
-			// Remove profile
-			removeBtn.SetText("Remove")
-			removeBtn.OnTapped = func() {
-				dialog.ShowConfirm(
-					"Delete Profile",
-					fmt.Sprintf("Are you sure you want to delete '%s'?", profile.Name),
-					func(confirm bool) {
-						if !confirm {
-							return
-						}
-
-						err = s.removeProfile(profile.ID)
-						if err != nil {
-							log.Errorf("failed to remove profile: %v", err)
-							dialog.ShowError(fmt.Errorf("failed to remove profile"), s.wProfiles)
-							return
-						}
-						dialog.ShowInformation(
-							"Profile Removed",
-							fmt.Sprintf("Profile '%s' removed successfully", profile.Name),
-							s.wProfiles,
-						)
-						// update slice
-						refresh()
-					},
-					s.wProfiles,
-				)
-			}
-		},
-	)
-
-	refresh = func() {
-		newProfiles, err := s.getProfiles()
-		if err != nil {
-			dialog.ShowError(err, s.wProfiles)
-			return
-		}
-		profiles = newProfiles // update the slice
-		list.Refresh()         // tell Fyne to re-call length/update on every visible row
-	}
-
-	// Button to add a new profile
-	newBtn := widget.NewButton("New Profile", func() {
-		nameEntry := widget.NewEntry()
-		nameEntry.SetPlaceHolder("Enter Profile Name")
-
-		formItems := []*widget.FormItem{{Text: "Name:", Widget: nameEntry}}
-		dlg := dialog.NewForm(
-			"New Profile",
-			"Create",
-			"Cancel",
-			formItems,
-			func(confirm bool) {
-				if !confirm {
-					return
-				}
-				name := nameEntry.Text
-				if name == "" {
-					dialog.ShowError(errors.New("profile name cannot be empty"), s.wProfiles)
-					return
-				}
-
-				// add profile
-				err = s.addProfile(name)
-				if err != nil {
-					log.Errorf("failed to create profile: %v", err)
-					dialog.ShowError(fmt.Errorf("failed to create profile"), s.wProfiles)
-					return
-				}
-				dialog.ShowInformation(
-					"Profile Created",
-					fmt.Sprintf("Profile '%s' created successfully", name),
-					s.wProfiles,
-				)
-				// update slice
-				refresh()
-			},
-			s.wProfiles,
-		)
-		// make dialog wider
-		dlg.Resize(fyne.NewSize(350, 150))
-		dlg.Show()
-	})
-
-	// Assemble window content
-	content := container.NewBorder(nil, newBtn, nil, nil, list)
-	s.wProfiles = s.app.NewWindow("NetBird Profiles")
-	s.wProfiles.SetContent(content)
-	s.wProfiles.Resize(fyne.NewSize(400, 300))
-	s.wProfiles.SetOnClosed(s.cancel)
-
-	s.wProfiles.Show()
-}
-
-func (s *serviceClient) addProfile(profileName string) error {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf(getClientFMT, err)
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		return fmt.Errorf("get current user: %w", err)
-	}
-
-	_, err = conn.AddProfile(s.ctx, &proto.AddProfileRequest{
-		ProfileName: profileName,
-		Username:    currUser.Username,
-	})
-
-	if err != nil {
-		return fmt.Errorf("add profile: %w", err)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) switchProfile(handle string) error {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf(getClientFMT, err)
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		return fmt.Errorf("get current user: %w", err)
-	}
-
-	resp, err := conn.SwitchProfile(s.ctx, &proto.SwitchProfileRequest{
-		ProfileName: &handle,
-		Username:    &currUser.Username,
-	})
-	if err != nil {
-		return fmt.Errorf("switch profile failed: %w", err)
-	}
-
-	if err := s.profileManager.SwitchProfile(profilemanager.ID(resp.Id)); err != nil {
-		return fmt.Errorf("switch profile: %w", err)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) removeProfile(profileName string) error {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf(getClientFMT, err)
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		return fmt.Errorf("get current user: %w", err)
-	}
-
-	_, err = conn.RemoveProfile(s.ctx, &proto.RemoveProfileRequest{
-		ProfileName: profileName,
-		Username:    currUser.Username,
-	})
-	if err != nil {
-		return fmt.Errorf("remove profile: %w", err)
-	}
-
-	return nil
-}
-
-type Profile struct {
-	ID       string
-	Name     string
-	IsActive bool
-}
-
-// formatProfileLabel returns the display label for a profile. Profiles can
-// share the same Name, so when more than one profile in profiles carries this
-// Name, a short form of the ID is appended to disambiguate the entries.
-func formatProfileLabel(profile Profile, profiles []Profile) string {
-	count := 0
-	for _, p := range profiles {
-		if p.Name == profile.Name {
-			count++
-		}
-	}
-	if count <= 1 {
-		return profile.Name
-	}
-	return fmt.Sprintf("%s (%s)", profile.Name, profilemanager.ID(profile.ID).ShortID())
-}
-
-func (s *serviceClient) getProfiles() ([]Profile, error) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return nil, fmt.Errorf(getClientFMT, err)
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		return nil, fmt.Errorf("get current user: %w", err)
-	}
-	profilesResp, err := conn.ListProfiles(s.ctx, &proto.ListProfilesRequest{
-		Username: currUser.Username,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("list profiles: %w", err)
-	}
-
-	var profiles []Profile
-
-	for _, profile := range profilesResp.Profiles {
-		profiles = append(profiles, Profile{
-			ID:       profile.Id,
-			Name:     profile.Name,
-			IsActive: profile.IsActive,
-		})
-	}
-
-	return profiles, nil
-}
-
-func (s *serviceClient) handleProfileLogout(profile Profile, refreshCallback func()) {
-	dialog.ShowConfirm(
-		"Deregister",
-		fmt.Sprintf("Are you sure you want to deregister from '%s'?", profile.Name),
-		func(confirm bool) {
-			if !confirm {
-				return
-			}
-
-			conn, err := s.getSrvClient(defaultFailTimeout)
-			if err != nil {
-				log.Errorf("failed to get service client: %v", err)
-				dialog.ShowError(fmt.Errorf("failed to connect to service"), s.wProfiles)
-				return
-			}
-
-			currUser, err := user.Current()
-			if err != nil {
-				log.Errorf("failed to get current user: %v", err)
-				dialog.ShowError(fmt.Errorf("failed to get current user"), s.wProfiles)
-				return
-			}
-
-			username := currUser.Username
-			// ProfileName is treated as a handle; send the ID so the
-			// daemon resolves to exactly this profile.
-			_, err = conn.Logout(s.ctx, &proto.LogoutRequest{
-				ProfileName: &profile.ID,
-				Username:    &username,
-			})
-			if err != nil {
-				log.Errorf("logout failed: %v", err)
-				dialog.ShowError(fmt.Errorf("deregister failed"), s.wProfiles)
-				return
-			}
-
-			dialog.ShowInformation(
-				"Deregistered",
-				fmt.Sprintf("Successfully deregistered from '%s'", profile.Name),
-				s.wProfiles,
-			)
-
-			refreshCallback()
-		},
-		s.wProfiles,
-	)
-}
-
-type subItem struct {
-	*systray.MenuItem
-	ctx    context.Context
-	cancel context.CancelFunc
-}
-
-type profileMenu struct {
-	mu                    sync.Mutex
-	ctx                   context.Context
-	serviceClient         *serviceClient
-	profileManager        *profilemanager.ProfileManager
-	eventHandler          *eventHandler
-	profileMenuItem       *systray.MenuItem
-	emailMenuItem         *systray.MenuItem
-	profileSubItems       []*subItem
-	manageProfilesSubItem *subItem
-	logoutSubItem         *subItem
-	profilesState         []Profile
-	downClickCallback     func() error
-	upClickCallback       func(context.Context) error
-	getSrvClientCallback  func(timeout time.Duration) (proto.DaemonServiceClient, error)
-	loadSettingsCallback  func()
-	app                   fyne.App
-}
-
-type newProfileMenuArgs struct {
-	ctx                  context.Context
-	serviceClient        *serviceClient
-	profileManager       *profilemanager.ProfileManager
-	eventHandler         *eventHandler
-	profileMenuItem      *systray.MenuItem
-	emailMenuItem        *systray.MenuItem
-	downClickCallback    func() error
-	upClickCallback      func(context.Context) error
-	getSrvClientCallback func(timeout time.Duration) (proto.DaemonServiceClient, error)
-	loadSettingsCallback func()
-	app                  fyne.App
-}
-
-func newProfileMenu(args newProfileMenuArgs) *profileMenu {
-	p := profileMenu{
-		ctx:                  args.ctx,
-		serviceClient:        args.serviceClient,
-		profileManager:       args.profileManager,
-		eventHandler:         args.eventHandler,
-		profileMenuItem:      args.profileMenuItem,
-		emailMenuItem:        args.emailMenuItem,
-		downClickCallback:    args.downClickCallback,
-		upClickCallback:      args.upClickCallback,
-		getSrvClientCallback: args.getSrvClientCallback,
-		loadSettingsCallback: args.loadSettingsCallback,
-		app:                  args.app,
-	}
-
-	p.emailMenuItem.Disable()
-	p.emailMenuItem.Hide()
-	p.refresh()
-	go p.updateMenu()
-
-	return &p
-}
-
-func (p *profileMenu) getProfiles() ([]Profile, error) {
-	conn, err := p.getSrvClientCallback(defaultFailTimeout)
-	if err != nil {
-		return nil, fmt.Errorf(getClientFMT, err)
-	}
-	currUser, err := user.Current()
-	if err != nil {
-		return nil, fmt.Errorf("get current user: %w", err)
-	}
-
-	profilesResp, err := conn.ListProfiles(p.ctx, &proto.ListProfilesRequest{
-		Username: currUser.Username,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("list profiles: %w", err)
-	}
-
-	var profiles []Profile
-
-	for _, profile := range profilesResp.Profiles {
-		profiles = append(profiles, Profile{
-			ID:       profile.Id,
-			Name:     profile.Name,
-			IsActive: profile.IsActive,
-		})
-	}
-
-	return profiles, nil
-}
-
-func (p *profileMenu) refresh() {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	profiles, err := p.getProfiles()
-	if err != nil {
-		log.Errorf("failed to list profiles: %v", err)
-		return
-	}
-
-	// Clear existing profile items
-	p.clear(profiles)
-
-	currUser, err := user.Current()
-	if err != nil {
-		log.Errorf("failed to get current user: %v", err)
-		return
-	}
-
-	conn, err := p.getSrvClientCallback(defaultFailTimeout)
-	if err != nil {
-		log.Errorf("failed to get daemon client: %v", err)
-		return
-	}
-
-	activeProf, err := conn.GetActiveProfile(p.ctx, &proto.GetActiveProfileRequest{})
-	if err != nil {
-		log.Errorf("failed to get active profile: %v", err)
-		return
-	}
-
-	if activeProf.ProfileName == "default" || activeProf.Username == currUser.Username {
-		activeProfState, err := p.profileManager.GetProfileState(profilemanager.ID(activeProf.Id))
-		if err != nil {
-			log.Warnf("failed to get active profile state: %v", err)
-			p.emailMenuItem.Hide()
-		} else if activeProfState.Email != "" {
-			p.emailMenuItem.SetTitle(fmt.Sprintf("(%s)", activeProfState.Email))
-			p.emailMenuItem.Show()
-		}
-	}
-
-	for _, profile := range profiles {
-		item := p.profileMenuItem.AddSubMenuItem(formatProfileLabel(profile, profiles), "")
-		if profile.IsActive {
-			item.Check()
-		}
-
-		ctx, cancel := context.WithCancel(context.Background())
-		p.profileSubItems = append(p.profileSubItems, &subItem{item, ctx, cancel})
-
-		go func() {
-			for {
-				select {
-				case <-ctx.Done():
-					return // context cancelled
-				case _, ok := <-item.ClickedCh:
-					if !ok {
-						return // channel closed
-					}
-
-					// Handle profile selection
-					if profile.IsActive {
-						log.Infof("Profile '%s' is already active", profile.Name)
-						return
-					}
-					conn, err := p.getSrvClientCallback(defaultFailTimeout)
-					if err != nil {
-						log.Errorf("failed to get daemon client: %v", err)
-						return
-					}
-
-					switchResp, err := conn.SwitchProfile(ctx, &proto.SwitchProfileRequest{
-						ProfileName: &profile.ID,
-						Username:    &currUser.Username,
-					})
-					if err != nil {
-						log.Errorf("failed to switch profile: %v", err)
-						// show  notification dialog
-						p.serviceClient.notifier.Send("Error", "Failed to switch profile")
-						return
-					}
-
-					err = p.profileManager.SwitchProfile(profilemanager.ID(switchResp.Id))
-					if err != nil {
-						log.Errorf("failed to switch profile '%s': %v", profile.Name, err)
-						return
-					}
-
-					log.Infof("Switched to profile '%s'", profile.Name)
-
-					status, err := conn.Status(ctx, &proto.StatusRequest{})
-					if err != nil {
-						log.Errorf("failed to get status after switching profile: %v", err)
-						return
-					}
-
-					if status.Status == string(internal.StatusConnected) {
-						if err := p.downClickCallback(); err != nil {
-							log.Errorf("failed to handle down click after switching profile: %v", err)
-						}
-					}
-
-					if p.serviceClient.connectCancel != nil {
-						p.serviceClient.connectCancel()
-					}
-
-					connectCtx, connectCancel := context.WithCancel(p.ctx)
-					p.serviceClient.connectCancel = connectCancel
-
-					if err := p.upClickCallback(connectCtx); err != nil {
-						log.Errorf("failed to handle up click after switching profile: %v", err)
-					}
-
-					connectCancel()
-
-					p.refresh()
-					p.loadSettingsCallback()
-				}
-			}
-		}()
-
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	manageItem := p.profileMenuItem.AddSubMenuItem("Manage Profiles", "")
-	p.manageProfilesSubItem = &subItem{manageItem, ctx, cancel}
-
-	go func() {
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case _, ok := <-manageItem.ClickedCh:
-				if !ok {
-					return
-				}
-				p.eventHandler.runSelfCommand(p.ctx, "profiles", "true")
-				p.refresh()
-				p.loadSettingsCallback()
-			}
-		}
-	}()
-
-	// Add Logout menu item
-	ctx2, cancel2 := context.WithCancel(context.Background())
-	logoutItem := p.profileMenuItem.AddSubMenuItem("Deregister", "")
-	p.logoutSubItem = &subItem{logoutItem, ctx2, cancel2}
-
-	go func() {
-		for {
-			select {
-			case <-ctx2.Done():
-				return
-			case _, ok := <-logoutItem.ClickedCh:
-				if !ok {
-					return
-				}
-				if err := p.eventHandler.logout(p.ctx); err != nil {
-					log.Errorf("logout failed: %v", err)
-					p.serviceClient.notifier.Send("Error", "Failed to deregister")
-				} else {
-					p.serviceClient.notifier.Send("Success", "Deregistered successfully")
-				}
-			}
-		}
-	}()
-
-	if activeProf.ProfileName == "default" || activeProf.Username == currUser.Username {
-		p.profileMenuItem.SetTitle(activeProf.ProfileName)
-	} else {
-		p.profileMenuItem.SetTitle(fmt.Sprintf("Profile: %s (User: %s)", activeProf.ProfileName, activeProf.Username))
-		p.emailMenuItem.Hide()
-	}
-
-}
-
-func (p *profileMenu) clear(profiles []Profile) {
-	for _, item := range p.profileSubItems {
-		item.Remove()
-		item.cancel()
-	}
-	p.profileSubItems = make([]*subItem, 0, len(profiles))
-	p.profilesState = profiles
-
-	if p.manageProfilesSubItem != nil {
-		p.manageProfilesSubItem.Remove()
-		p.manageProfilesSubItem.cancel()
-		p.manageProfilesSubItem = nil
-	}
-
-	if p.logoutSubItem != nil {
-		p.logoutSubItem.Remove()
-		p.logoutSubItem.cancel()
-		p.logoutSubItem = nil
-	}
-}
-
-// setEnabled greys out (Disable) the profile menu and every existing
-// sub-item when the daemon reports the kill switch active, so the user
-// sees the menu but cannot enter "Manage Profiles" or switch profile.
-// Previously this used Hide() on the parent, but Fyne's systray on
-// Windows does not propagate Hide() to a parent that already has
-// children — the submenu kept popping up and accepting clicks. Disable
-// is the reliable visual lock.
-func (p *profileMenu) setEnabled(enabled bool) {
-	if p.profileMenuItem == nil {
-		return
-	}
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	if enabled {
-		p.profileMenuItem.Enable()
-		p.profileMenuItem.SetTooltip("")
-	} else {
-		p.profileMenuItem.Disable()
-		p.profileMenuItem.SetTooltip("Profiles are disabled by daemon")
-	}
-
-	apply := func(item *systray.MenuItem) {
-		if item == nil {
-			return
-		}
-		if enabled {
-			item.Enable()
-		} else {
-			item.Disable()
-		}
-	}
-	for _, sub := range p.profileSubItems {
-		if sub != nil {
-			apply(sub.MenuItem)
-		}
-	}
-	if p.manageProfilesSubItem != nil {
-		apply(p.manageProfilesSubItem.MenuItem)
-	}
-	if p.logoutSubItem != nil {
-		apply(p.logoutSubItem.MenuItem)
-	}
-}
-
-func (p *profileMenu) updateMenu() {
-	// check every second
-	ticker := time.NewTicker(time.Second)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ticker.C:
-			// get profilesList
-			profiles, err := p.getProfiles()
-			if err != nil {
-				log.Errorf("failed to list profiles: %v", err)
-				continue
-			}
-
-			sort.Slice(profiles, func(i, j int) bool {
-				if profiles[i].Name != profiles[j].Name {
-					return profiles[i].Name < profiles[j].Name
-				}
-				return profiles[i].ID < profiles[j].ID
-			})
-
-			p.mu.Lock()
-			state := p.profilesState
-			p.mu.Unlock()
-
-			sort.Slice(state, func(i, j int) bool {
-				return state[i].Name < state[j].Name
-			})
-
-			if slices.Equal(profiles, state) {
-				continue
-			}
-
-			p.refresh()
-		case <-p.ctx.Done():
-			return // context cancelled
-
-		}
-	}
-}
diff --git a/client/ui/quickactions.go b/client/ui/quickactions.go
deleted file mode 100644
index bf47ac434..000000000
--- a/client/ui/quickactions.go
+++ /dev/null
@@ -1,349 +0,0 @@
-//go:build !(linux && 386)
-
-//go:generate fyne bundle -o quickactions_assets.go assets/connected.png
-//go:generate fyne bundle -o quickactions_assets.go -append assets/disconnected.png
-package main
-
-import (
-	"context"
-	_ "embed"
-	"fmt"
-	"runtime"
-	"sync/atomic"
-	"time"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/canvas"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/layout"
-	"fyne.io/fyne/v2/widget"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-type quickActionsUiState struct {
-	connectionStatus      string
-	isToggleButtonEnabled bool
-	isConnectionChanged   bool
-	toggleAction          func()
-}
-
-func newQuickActionsUiState() quickActionsUiState {
-	return quickActionsUiState{
-		connectionStatus:      string(internal.StatusIdle),
-		isToggleButtonEnabled: false,
-		isConnectionChanged:   false,
-	}
-}
-
-type clientConnectionStatusProvider interface {
-	connectionStatus(ctx context.Context) (string, error)
-}
-
-type daemonClientConnectionStatusProvider struct {
-	client proto.DaemonServiceClient
-}
-
-func (d daemonClientConnectionStatusProvider) connectionStatus(ctx context.Context) (string, error) {
-	childCtx, cancel := context.WithTimeout(ctx, 400*time.Millisecond)
-	defer cancel()
-	status, err := d.client.Status(childCtx, &proto.StatusRequest{})
-	if err != nil {
-		return "", err
-	}
-
-	return status.Status, nil
-}
-
-type clientCommand interface {
-	execute() error
-}
-
-type connectCommand struct {
-	connectClient func() error
-}
-
-func (c connectCommand) execute() error {
-	return c.connectClient()
-}
-
-type disconnectCommand struct {
-	disconnectClient func() error
-}
-
-func (c disconnectCommand) execute() error {
-	return c.disconnectClient()
-}
-
-type quickActionsViewModel struct {
-	provider                   clientConnectionStatusProvider
-	connect                    clientCommand
-	disconnect                 clientCommand
-	uiChan                     chan quickActionsUiState
-	isWatchingConnectionStatus atomic.Bool
-}
-
-func newQuickActionsViewModel(ctx context.Context, provider clientConnectionStatusProvider, connect, disconnect clientCommand, uiChan chan quickActionsUiState) {
-	viewModel := quickActionsViewModel{
-		provider:   provider,
-		connect:    connect,
-		disconnect: disconnect,
-		uiChan:     uiChan,
-	}
-
-	viewModel.isWatchingConnectionStatus.Store(true)
-
-	// base UI status
-	uiChan <- newQuickActionsUiState()
-
-	// this retrieves the current connection status
-	// and pushes the UI state that reflects it via uiChan
-	go viewModel.watchConnectionStatus(ctx)
-}
-
-func (q *quickActionsViewModel) updateUiState(ctx context.Context) {
-	uiState := newQuickActionsUiState()
-	connectionStatus, err := q.provider.connectionStatus(ctx)
-
-	if err != nil {
-		log.Errorf("Status: Error - %v", err)
-		q.uiChan <- uiState
-		return
-	}
-
-	if connectionStatus == string(internal.StatusConnected) {
-		uiState.toggleAction = func() {
-			q.executeCommand(q.disconnect)
-		}
-	} else {
-		uiState.toggleAction = func() {
-			q.executeCommand(q.connect)
-		}
-	}
-
-	uiState.isToggleButtonEnabled = true
-	uiState.connectionStatus = connectionStatus
-	q.uiChan <- uiState
-}
-
-func (q *quickActionsViewModel) watchConnectionStatus(ctx context.Context) {
-	ticker := time.NewTicker(1000 * time.Millisecond)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			if q.isWatchingConnectionStatus.Load() {
-				q.updateUiState(ctx)
-			}
-		}
-	}
-}
-
-func (q *quickActionsViewModel) executeCommand(command clientCommand) {
-	uiState := newQuickActionsUiState()
-	// newQuickActionsUiState starts with Idle connection status,
-	// and all that's necessary here is to just disable the toggle button.
-	uiState.connectionStatus = ""
-
-	q.uiChan <- uiState
-
-	q.isWatchingConnectionStatus.Store(false)
-
-	err := command.execute()
-
-	if err != nil {
-		log.Errorf("Status: Error - %v", err)
-		q.isWatchingConnectionStatus.Store(true)
-	} else {
-		uiState = newQuickActionsUiState()
-		uiState.isConnectionChanged = true
-		q.uiChan <- uiState
-	}
-}
-
-func getSystemTrayName() string {
-	os := runtime.GOOS
-	switch os {
-	case "darwin":
-		return "menu bar"
-	default:
-		return "system tray"
-	}
-}
-
-func (s *serviceClient) getNetBirdImage(name string, content []byte) *canvas.Image {
-	imageSize := fyne.NewSize(64, 64)
-
-	resource := fyne.NewStaticResource(name, content)
-	image := canvas.NewImageFromResource(resource)
-	image.FillMode = canvas.ImageFillContain
-	image.SetMinSize(imageSize)
-	image.Resize(imageSize)
-
-	return image
-}
-
-type quickActionsUiComponents struct {
-	content                                   *fyne.Container
-	toggleConnectionButton                    *widget.Button
-	connectedLabelText, disconnectedLabelText string
-	connectedImage, disconnectedImage         *canvas.Image
-	connectedCircleRes, disconnectedCircleRes fyne.Resource
-}
-
-// applyQuickActionsUiState applies a single UI state to the quick actions window.
-// It closes the window and returns true if the connection status has changed,
-// in which case the caller should stop processing further states.
-func (s *serviceClient) applyQuickActionsUiState(
-	uiState quickActionsUiState,
-	components quickActionsUiComponents,
-) bool {
-	if uiState.isConnectionChanged {
-		fyne.DoAndWait(func() {
-			s.wQuickActions.Close()
-		})
-		return true
-	}
-
-	var logo *canvas.Image
-	var buttonText string
-	var buttonIcon fyne.Resource
-
-	if uiState.connectionStatus == string(internal.StatusConnected) {
-		buttonText = components.connectedLabelText
-		buttonIcon = components.connectedCircleRes
-		logo = components.connectedImage
-	} else if uiState.connectionStatus == string(internal.StatusIdle) {
-		buttonText = components.disconnectedLabelText
-		buttonIcon = components.disconnectedCircleRes
-		logo = components.disconnectedImage
-	}
-
-	fyne.DoAndWait(func() {
-		if buttonText != "" {
-			components.toggleConnectionButton.SetText(buttonText)
-		}
-
-		if buttonIcon != nil {
-			components.toggleConnectionButton.SetIcon(buttonIcon)
-		}
-
-		if uiState.isToggleButtonEnabled {
-			components.toggleConnectionButton.Enable()
-		} else {
-			components.toggleConnectionButton.Disable()
-		}
-
-		components.toggleConnectionButton.OnTapped = func() {
-			if uiState.toggleAction != nil {
-				go uiState.toggleAction()
-			}
-		}
-
-		components.toggleConnectionButton.Refresh()
-
-		// the second position in the content's object array is the NetBird logo.
-		if logo != nil {
-			components.content.Objects[1] = logo
-			components.content.Refresh()
-		}
-	})
-
-	return false
-}
-
-// showQuickActionsUI displays a simple window with the NetBird logo and a connection toggle button.
-func (s *serviceClient) showQuickActionsUI() {
-	s.wQuickActions = s.app.NewWindow("NetBird")
-	vmCtx, vmCancel := context.WithCancel(s.ctx)
-	s.wQuickActions.SetOnClosed(vmCancel)
-
-	client, err := s.getSrvClient(defaultFailTimeout)
-
-	connCmd := connectCommand{
-		connectClient: func() error {
-			return s.menuUpClick(s.ctx)
-		},
-	}
-
-	disConnCmd := disconnectCommand{
-		disconnectClient: func() error {
-			return s.menuDownClick()
-		},
-	}
-
-	if err != nil {
-		log.Errorf("get service client: %v", err)
-		return
-	}
-
-	uiChan := make(chan quickActionsUiState, 1)
-	newQuickActionsViewModel(vmCtx, daemonClientConnectionStatusProvider{client: client}, connCmd, disConnCmd, uiChan)
-
-	connectedImage := s.getNetBirdImage("netbird.png", iconAbout)
-	disconnectedImage := s.getNetBirdImage("netbird-disconnected.png", iconAboutDisconnected)
-
-	connectedCircle := canvas.NewImageFromResource(resourceConnectedPng)
-	disconnectedCircle := canvas.NewImageFromResource(resourceDisconnectedPng)
-
-	connectedLabelText := "Disconnect"
-	disconnectedLabelText := "Connect"
-
-	toggleConnectionButton := widget.NewButtonWithIcon(disconnectedLabelText, disconnectedCircle.Resource, func() {
-		// This button's tap function will be set when an ui state arrives via the uiChan channel.
-	})
-
-	// Button starts disabled until the first ui state arrives.
-	toggleConnectionButton.Disable()
-
-	hintLabelText := fmt.Sprintf("You can always access NetBird from your %s.", getSystemTrayName())
-	hintLabel := widget.NewLabel(hintLabelText)
-
-	content := container.NewVBox(
-		layout.NewSpacer(),
-		disconnectedImage,
-		layout.NewSpacer(),
-		container.NewCenter(toggleConnectionButton),
-		layout.NewSpacer(),
-		container.NewCenter(hintLabel),
-	)
-
-	// this watches for ui state updates.
-	go func() {
-
-		for {
-			select {
-			case <-vmCtx.Done():
-				return
-			case uiState, ok := <-uiChan:
-				if !ok {
-					return
-				}
-
-				closed := s.applyQuickActionsUiState(
-					uiState,
-					quickActionsUiComponents{
-						content,
-						toggleConnectionButton,
-						connectedLabelText, disconnectedLabelText,
-						connectedImage, disconnectedImage,
-						connectedCircle.Resource, disconnectedCircle.Resource,
-					},
-				)
-				if closed {
-					return
-				}
-			}
-		}
-	}()
-
-	s.wQuickActions.SetContent(content)
-	s.wQuickActions.Resize(fyne.NewSize(400, 200))
-	s.wQuickActions.SetFixedSize(true)
-	s.wQuickActions.Show()
-}
diff --git a/client/ui/quickactions_assets.go b/client/ui/quickactions_assets.go
deleted file mode 100644
index 9ff5e85a2..000000000
--- a/client/ui/quickactions_assets.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// auto-generated
-// Code generated by '$ fyne bundle'. DO NOT EDIT.
-
-package main
-
-import (
-	_ "embed"
-	"fyne.io/fyne/v2"
-)
-
-//go:embed assets/connected.png
-var resourceConnectedPngData []byte
-var resourceConnectedPng = &fyne.StaticResource{
-	StaticName:    "assets/connected.png",
-	StaticContent: resourceConnectedPngData,
-}
-
-//go:embed assets/disconnected.png
-var resourceDisconnectedPngData []byte
-var resourceDisconnectedPng = &fyne.StaticResource{
-	StaticName:    "assets/disconnected.png",
-	StaticContent: resourceDisconnectedPngData,
-}
diff --git a/client/ui/recenter_linux.go b/client/ui/recenter_linux.go
new file mode 100644
index 000000000..25c468d7f
--- /dev/null
+++ b/client/ui/recenter_linux.go
@@ -0,0 +1,13 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+// recenterOnShowPredicate returns a per-show predicate; re-centering is only
+// needed under the minimal-WM / in-process-XEmbed-tray environment, which neither
+// centers small windows nor restores position across hide -> show. Evaluated per
+// show, not at startup, because the XEmbed tray can appear after the UI starts
+// (panel and autostarted app race at login); xembedTrayAvailable is a cheap,
+// side-effect-free probe safe to call repeatedly.
+func recenterOnShowPredicate() func() bool {
+	return xembedTrayAvailable
+}
diff --git a/client/ui/recenter_other.go b/client/ui/recenter_other.go
new file mode 100644
index 000000000..18ffe8730
--- /dev/null
+++ b/client/ui/recenter_other.go
@@ -0,0 +1,10 @@
+//go:build (!linux || (linux && 386)) && !freebsd && !android && !ios && !js
+
+package main
+
+// recenterOnShowPredicate returns nil off Linux: macOS and Windows WMs restore
+// window position across hide -> show themselves, so Go-side re-centering would
+// only fight a window the user moved.
+func recenterOnShowPredicate() func() bool {
+	return nil
+}
diff --git a/client/ui/services/appappearance_linux.go b/client/ui/services/appappearance_linux.go
new file mode 100644
index 000000000..0cfc46d5c
--- /dev/null
+++ b/client/ui/services/appappearance_linux.go
@@ -0,0 +1,99 @@
+//go:build linux && cgo && !android && !ios
+
+package services
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// setAppAppearance points GTK at the light or dark variant of the current theme
+// so the decorations match the webview. Without it a forced Light theme keeps
+// dark decorations on a dark desktop, and the reverse.
+//
+// The theme name is switched, not just gtk-application-prefer-dark-theme:
+// desktops such as Ubuntu implement dark mode as a separate theme (Yaru-dark),
+// which that flag cannot lighten. The flag is still set for themes that do
+// carry both variants under one name. Both are per-process settings, so this
+// changes only our own decorations; GTK re-reads the desktop value on a change,
+// which is why Theme.apply re-asserts. Must run on the main thread.
+//
+// GTK styling is app-wide, which is why this is separate from
+// setWindowAppearance: it must be applied even when no window exists yet, since
+// windows created later inherit it rather than carrying it in their options.
+func setAppAppearance(dark bool) {
+	target := baseGtkTheme(gtkThemeName())
+	if dark {
+		if variant, ok := darkGtkVariant(target); ok {
+			target = variant
+		}
+	}
+	// An unknown name would leave GTK with no theme at all, so fall back to
+	// changing nothing and let the prefer-dark flag do what it can.
+	if target != "" && !gtkThemeExists(target) {
+		target = ""
+	}
+	applyGtkTheme(target, dark)
+}
+
+// baseGtkTheme strips a dark-variant suffix, so "Yaru-dark" becomes "Yaru".
+func baseGtkTheme(name string) string {
+	for _, suffix := range []string{"-dark", "-Dark"} {
+		if len(name) > len(suffix) && strings.EqualFold(name[len(name)-len(suffix):], suffix) {
+			return name[:len(name)-len(suffix)]
+		}
+	}
+	return name
+}
+
+// darkGtkVariant reports the installed dark counterpart of a base theme name.
+// Themes that carry both variants under one name have none, and rely on
+// gtk-application-prefer-dark-theme instead.
+func darkGtkVariant(base string) (string, bool) {
+	if base == "" {
+		return "", false
+	}
+	for _, suffix := range []string{"-dark", "-Dark"} {
+		if candidate := base + suffix; gtkThemeExists(candidate) {
+			return candidate, true
+		}
+	}
+	return "", false
+}
+
+// gtkThemeExists reports whether a theme of that name is installed, searching
+// the same locations GTK does.
+func gtkThemeExists(name string) bool {
+	if name == "" {
+		return false
+	}
+	for _, dir := range gtkThemeDirs() {
+		if info, err := os.Stat(filepath.Join(dir, name)); err == nil && info.IsDir() {
+			return true
+		}
+	}
+	return false
+}
+
+func gtkThemeDirs() []string {
+	var dirs []string
+	if home, err := os.UserHomeDir(); err == nil {
+		dirs = append(dirs, filepath.Join(home, ".themes"))
+	}
+	if dataHome := os.Getenv("XDG_DATA_HOME"); dataHome != "" {
+		dirs = append(dirs, filepath.Join(dataHome, "themes"))
+	} else if home, err := os.UserHomeDir(); err == nil {
+		dirs = append(dirs, filepath.Join(home, ".local", "share", "themes"))
+	}
+	dataDirs := os.Getenv("XDG_DATA_DIRS")
+	if dataDirs == "" {
+		dataDirs = "/usr/local/share:/usr/share"
+	}
+	for _, dir := range strings.Split(dataDirs, ":") {
+		if dir != "" {
+			dirs = append(dirs, filepath.Join(dir, "themes"))
+		}
+	}
+	return dirs
+}
diff --git a/client/ui/services/appappearance_linux_gtk.go b/client/ui/services/appappearance_linux_gtk.go
new file mode 100644
index 000000000..2648b2808
--- /dev/null
+++ b/client/ui/services/appappearance_linux_gtk.go
@@ -0,0 +1,63 @@
+//go:build linux && cgo && !android && !ios
+
+package services
+
+/*
+// The GTK major version is the only difference between the two Linux builds, so
+// it is selected by these two directives rather than by keeping a second copy of
+// this file per version: the C below and the Go wrappers under it are identical
+// for GTK3 and GTK4, and both resolve <gtk/gtk.h> through pkg-config.
+#cgo gtk3 pkg-config: gtk+-3.0
+#cgo !gtk3 pkg-config: gtk4
+#include <stdlib.h>
+#include <gtk/gtk.h>
+
+static char *nbGetGtkThemeName(void) {
+	GtkSettings *settings = gtk_settings_get_default();
+	if (settings == NULL) {
+		return NULL;
+	}
+	char *name = NULL;
+	g_object_get(settings, "gtk-theme-name", &name, NULL);
+	return name;
+}
+
+// name may be NULL to leave the theme name untouched.
+static void nbSetGtkTheme(const char *name, int dark) {
+	GtkSettings *settings = gtk_settings_get_default();
+	if (settings == NULL) {
+		return;
+	}
+	if (name != NULL && name[0] != '\0') {
+		g_object_set(settings, "gtk-theme-name", name, NULL);
+	}
+	g_object_set(settings, "gtk-application-prefer-dark-theme", dark ? TRUE : FALSE, NULL);
+}
+
+static void nbFreeGtkString(char *s) { g_free(s); }
+*/
+import "C"
+
+import "unsafe"
+
+func gtkThemeName() string {
+	c := C.nbGetGtkThemeName()
+	if c == nil {
+		return ""
+	}
+	defer C.nbFreeGtkString(c)
+	return C.GoString(c)
+}
+
+func applyGtkTheme(name string, dark bool) {
+	var cName *C.char
+	if name != "" {
+		cName = C.CString(name)
+		defer C.free(unsafe.Pointer(cName))
+	}
+	var forced C.int
+	if dark {
+		forced = 1
+	}
+	C.nbSetGtkTheme(cName, forced)
+}
diff --git a/client/ui/services/appappearance_other.go b/client/ui/services/appappearance_other.go
new file mode 100644
index 000000000..aaad912b3
--- /dev/null
+++ b/client/ui/services/appappearance_other.go
@@ -0,0 +1,7 @@
+//go:build !(linux && cgo)
+
+package services
+
+// setAppAppearance is a no-op where the platform has no app-wide appearance to
+// set; macOS and Windows theme each window instead, via setWindowAppearance.
+func setAppAppearance(bool) {}
diff --git a/client/ui/services/autostart.go b/client/ui/services/autostart.go
new file mode 100644
index 000000000..98e893f04
--- /dev/null
+++ b/client/ui/services/autostart.go
@@ -0,0 +1,52 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+)
+
+// Autostart facade over Wails' AutostartManager. The OS autostart entry registration
+// is the single source of truth; nothing is mirrored to preferences.
+type Autostart struct {
+	mgr *application.AutostartManager
+}
+
+func NewAutostart(mgr *application.AutostartManager) *Autostart {
+	return &Autostart{mgr: mgr}
+}
+
+func (a *Autostart) Supported(_ context.Context) bool {
+	_, err := a.mgr.Status()
+	return !errors.Is(err, application.ErrAutostartNotSupported)
+}
+
+// IsEnabled returns false without error on unsupported platforms.
+func (a *Autostart) IsEnabled(_ context.Context) (bool, error) {
+	enabled, err := a.mgr.IsEnabled()
+	if err != nil {
+		if errors.Is(err, application.ErrAutostartNotSupported) {
+			return false, nil
+		}
+		return false, fmt.Errorf("read autostart state: %w", err)
+	}
+	return enabled, nil
+}
+
+// SetEnabled takes effect on the next login, not immediately.
+func (a *Autostart) SetEnabled(_ context.Context, enabled bool) error {
+	if enabled {
+		if err := a.mgr.Enable(); err != nil {
+			return fmt.Errorf("enable autostart: %w", err)
+		}
+		return nil
+	}
+	if err := a.mgr.Disable(); err != nil {
+		return fmt.Errorf("disable autostart: %w", err)
+	}
+	return nil
+}
diff --git a/client/ui/services/compat.go b/client/ui/services/compat.go
new file mode 100644
index 000000000..0cc6dd99f
--- /dev/null
+++ b/client/ui/services/compat.go
@@ -0,0 +1,40 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// Compat answers whether the running daemon is new enough to drive this UI.
+type Compat struct {
+	conn DaemonConn
+}
+
+func NewCompat(conn DaemonConn) *Compat {
+	return &Compat{conn: conn}
+}
+
+// DaemonReady probes the WailsUIReady RPC once. A true result means the daemon
+// implements it and is compatible. An Unimplemented response means the daemon
+// predates this UI and is too old; the caller should surface an upgrade prompt.
+// Any other error (daemon not running, transport failure) is returned so the
+// frontend can tell "outdated" apart from "not reachable".
+func (c *Compat) DaemonReady(ctx context.Context) (bool, error) {
+	client, err := c.conn.Client()
+	if err != nil {
+		return false, err
+	}
+	if _, err := client.WailsUIReady(ctx, &proto.WailsUIReadyRequest{}); err != nil {
+		if st, ok := status.FromError(err); ok && st.Code() == codes.Unimplemented {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
diff --git a/client/ui/services/conn.go b/client/ui/services/conn.go
new file mode 100644
index 000000000..531abe7d9
--- /dev/null
+++ b/client/ui/services/conn.go
@@ -0,0 +1,13 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import "github.com/netbirdio/netbird/client/proto"
+
+// DaemonConn returns a lazy gRPC client to the NetBird daemon.
+// All services receive a DaemonConn so they share a single connection.
+type DaemonConn interface {
+	Client() (proto.DaemonServiceClient, error)
+}
+
+func ptrStr(s string) *string { return &s }
diff --git a/client/ui/services/connection.go b/client/ui/services/connection.go
new file mode 100644
index 000000000..f6a8eca72
--- /dev/null
+++ b/client/ui/services/connection.go
@@ -0,0 +1,294 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"runtime"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// LoginParams are the inputs to Login.
+type LoginParams struct {
+	ProfileName   string `json:"profileName"`
+	Username      string `json:"username"`
+	ManagementURL string `json:"managementUrl"`
+	SetupKey      string `json:"setupKey"`
+	PreSharedKey  string `json:"preSharedKey"`
+	Hostname      string `json:"hostname"`
+	Hint          string `json:"hint"`
+}
+
+// LoginResult is the daemon's reply to Login.
+type LoginResult struct {
+	NeedsSSOLogin           bool   `json:"needsSsoLogin"`
+	UserCode                string `json:"userCode"`
+	VerificationURI         string `json:"verificationUri"`
+	VerificationURIComplete string `json:"verificationUriComplete"`
+	// ProfileID is the ID of the profile this login ran against, or "" when the
+	// caller named the profile itself and no ID was resolved. Pass it back in
+	// WaitSSOParams so the account email lands on this profile even if the
+	// active one changes during SSO.
+	ProfileID string `json:"profileId"`
+}
+
+// WaitSSOParams are the inputs to waitSSOLogin.
+type WaitSSOParams struct {
+	UserCode string `json:"userCode"`
+	Hostname string `json:"hostname"`
+	// ProfileID is the profile the login was started for, used to file the
+	// account email against it rather than against whichever profile is active
+	// when the flow returns. Optional: empty falls back to the active profile.
+	ProfileID string `json:"profileId"`
+}
+
+// UpParams selects the profile to bring up.
+type UpParams struct {
+	ProfileName string `json:"profileName"`
+	Username    string `json:"username"`
+}
+
+// LogoutParams selects the profile to log out.
+type LogoutParams struct {
+	ProfileName string `json:"profileName"`
+	Username    string `json:"username"`
+}
+
+// Connection groups the daemon RPCs that drive login / connect / disconnect.
+type Connection struct {
+	conn       DaemonConn
+	classifier errorClassifier
+}
+
+// NewConnection wires up a Connection. translator or prefs may be nil, in which
+// case classifyDaemonError falls back to the bare error key.
+func NewConnection(conn DaemonConn, translator ErrorTranslator, prefs LanguagePreference) *Connection {
+	return &Connection{conn: conn, classifier: errorClassifier{translator: translator, prefs: prefs}}
+}
+
+func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return LoginResult{}, err
+	}
+
+	// No pre-Login Down: Login dislodges a pending WaitSSOLogin itself, and a
+	// defensive Down would only flash an Idle blink in the tray during handoff.
+
+	// Fall back to the daemon's active profile and the current OS user.
+	profileName := p.ProfileName
+	username := p.Username
+	// Only set when the daemon told us the ID. A caller-supplied ProfileName is
+	// a handle — a display name or an ID prefix resolve too — and the state file
+	// is named after the ID, so passing a handle on would name the wrong file.
+	profileID := ""
+	if profileName == "" {
+		if active, aerr := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{}); aerr == nil {
+			// Address the active profile by ID (the daemon resolves it as a
+			// handle); names can collide, the ID cannot.
+			profileName = active.GetId()
+			profileID = profileName
+			if username == "" {
+				username = active.GetUsername()
+			}
+		}
+	}
+	if username == "" {
+		if u, uerr := user.Current(); uerr == nil {
+			username = u.Username
+		}
+	}
+
+	req := &proto.LoginRequest{
+		ManagementUrl: p.ManagementURL,
+		SetupKey:      p.SetupKey,
+		Hostname:      p.Hostname,
+		// a login driven by the UI always has a graphical session available
+		IsUnixDesktopClient: true,
+	}
+	if profileName != "" {
+		req.ProfileName = ptrStr(profileName)
+	}
+	if username != "" {
+		req.Username = ptrStr(username)
+	}
+	if p.PreSharedKey != "" {
+		req.OptionalPreSharedKey = ptrStr(p.PreSharedKey)
+	}
+	hint := p.Hint
+	if hint == "" && profileID != "" {
+		if state, serr := profilemanager.NewProfileManager().GetProfileState(profilemanager.ID(profileID)); serr == nil {
+			hint = state.Email
+		} else {
+			log.Debugf("failed to get profile state for login hint: %v", serr)
+		}
+	}
+	if hint != "" {
+		req.Hint = ptrStr(hint)
+	}
+
+	resp, err := cli.Login(ctx, req)
+	if err != nil {
+		return LoginResult{}, s.classifyDaemonError(err)
+	}
+	log.Infof("daemon login response received, needs SSO login: %v", resp.GetNeedsSSOLogin())
+	return LoginResult{
+		NeedsSSOLogin:           resp.GetNeedsSSOLogin(),
+		UserCode:                resp.GetUserCode(),
+		VerificationURI:         resp.GetVerificationURI(),
+		VerificationURIComplete: resp.GetVerificationURIComplete(),
+		ProfileID:               profileID,
+	}, nil
+}
+
+func (s *Connection) Up(ctx context.Context, p UpParams) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	log.Infof("sending up request to daemon")
+	// Always async: status updates flow via SubscribeStatus.
+	req := &proto.UpRequest{Async: true}
+	if p.ProfileName != "" {
+		req.ProfileName = ptrStr(p.ProfileName)
+	}
+	if p.Username != "" {
+		req.Username = ptrStr(p.Username)
+	}
+	if _, err = cli.Up(ctx, req); err != nil {
+		return s.classifyDaemonError(err)
+	}
+	return nil
+}
+
+// WaitSSOLoginAndUp blocks until the SSO login completes and then brings the
+// connection up, both from the Go side. Keeping the post-login Up here rather
+// than as a frontend continuation is deliberate: during SSO the tray window is
+// hidden and the webview is suspended (macOS App Nap / hidden-window timer
+// throttling), so a frontend-driven Up would not run until the user woke the
+// window (e.g. by hovering the tray icon). Doing it in Go connects the moment
+// the daemon reports SSO success. Returns the authenticated user's email.
+func (s *Connection) WaitSSOLoginAndUp(ctx context.Context, wait WaitSSOParams, up UpParams) (string, error) {
+	email, err := s.waitSSOLogin(ctx, wait)
+	if err != nil {
+		return "", err
+	}
+	if err := ctx.Err(); err != nil {
+		return "", err
+	}
+	if err := s.Up(ctx, up); err != nil {
+		return "", err
+	}
+	return email, nil
+}
+
+func (s *Connection) Down(ctx context.Context) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	if _, err = cli.Down(ctx, &proto.DownRequest{}); err != nil {
+		return s.classifyDaemonError(err)
+	}
+	return nil
+}
+
+// OpenURL opens url in an external browser; the embedded webview blocks
+// window.open, so the SSO verification page can't pop inline. Honors $BROWSER
+// before the platform default.
+func (s *Connection) OpenURL(url string) error {
+	return openURL(url)
+}
+
+func (s *Connection) Logout(ctx context.Context, p LogoutParams) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	req := &proto.LogoutRequest{}
+	if p.ProfileName != "" {
+		req.ProfileName = ptrStr(p.ProfileName)
+	}
+	if p.Username != "" {
+		req.Username = ptrStr(p.Username)
+	}
+	if _, err = cli.Logout(ctx, req); err != nil {
+		return s.classifyDaemonError(err)
+	}
+
+	return nil
+}
+
+// waitSSOLogin blocks until the daemon reports the SSO login result and returns
+// the authenticated user's email. It is unexported because the frontend drives
+// SSO through the exported WaitSSOLoginAndUp.
+func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	log.Infof("waiting for SSO login to complete")
+	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
+		UserCode: p.UserCode,
+		Hostname: p.Hostname,
+	})
+	if err != nil {
+		return "", s.classifyDaemonError(err)
+	}
+	log.Infof("SSO login completed, daemon reported success")
+
+	// Persist the account email the same way the CLI does after its own
+	// WaitSSOLogin: the daemon returns it but cannot store it, since it runs as
+	// root and the per-profile state file is user-owned (see Profiles.List).
+	// Without this the profile has no email, so Profiles.List shows no account
+	// and later logins and session extends go out without a login_hint —
+	// leaving the IdP to guess which account was meant.
+	if email := resp.GetEmail(); email != "" {
+		state := &profilemanager.ProfileState{Email: email}
+		pm := profilemanager.NewProfileManager()
+
+		// Against the profile the login was started for: SSO spans seconds of
+		// user interaction, and a profile switch in that window would otherwise
+		// file the email under the wrong profile.
+		if p.ProfileID != "" {
+			err = pm.SetProfileState(profilemanager.ID(p.ProfileID), state)
+		} else {
+			err = pm.SetActiveProfileState(state)
+		}
+		if err != nil {
+			// Non-fatal: the login itself succeeded.
+			log.Warnf("failed to store account email: %v", err)
+		}
+	}
+
+	return resp.GetEmail(), nil
+}
+
+// classifyDaemonError maps a gRPC error to a localised ClientError.
+func (s *Connection) classifyDaemonError(err error) *ClientError {
+	return s.classifier.classify(err)
+}
+
+func openURL(url string) error {
+	if browser := os.Getenv("BROWSER"); browser != "" {
+		return exec.Command(browser, url).Start()
+	}
+	switch runtime.GOOS {
+	case "windows":
+		return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
+	case "darwin":
+		return exec.Command("open", url).Start()
+	case "linux":
+		return exec.Command("xdg-open", url).Start()
+	default:
+		return fmt.Errorf("unsupported platform")
+	}
+}
diff --git a/client/ui/services/cursor_darwin.go b/client/ui/services/cursor_darwin.go
new file mode 100644
index 000000000..a927ff719
--- /dev/null
+++ b/client/ui/services/cursor_darwin.go
@@ -0,0 +1,42 @@
+//go:build darwin
+
+package services
+
+/*
+#cgo CFLAGS: -x objective-c
+#cgo LDFLAGS: -framework Foundation -framework Cocoa -framework AppKit
+#import <Cocoa/Cocoa.h>
+#import <AppKit/AppKit.h>
+
+typedef struct CursorPoint {
+    int x;
+    int y;
+    int ok;
+} CursorPoint;
+
+// NSEvent.mouseLocation is Y-up from primary's bottom-left; flip against
+// the primary's frame height so the point matches Wails' Y-down Screen.Bounds.
+CursorPoint nbGetCursorPos(void) {
+    CursorPoint p = {0, 0, 0};
+    NSArray<NSScreen *> *screens = [NSScreen screens];
+    if (screens == nil || screens.count == 0) return p;
+    NSScreen *primary = [screens firstObject];
+    if (primary == nil) return p;
+    NSPoint loc = [NSEvent mouseLocation];
+    p.x = (int)loc.x;
+    p.y = (int)(primary.frame.size.height - loc.y);
+    p.ok = 1;
+    return p;
+}
+*/
+import "C"
+
+import "github.com/wailsapp/wails/v3/pkg/application"
+
+func getCursorPosition(_ *application.App) (application.Point, bool) {
+	res := C.nbGetCursorPos()
+	if res.ok == 0 {
+		return application.Point{}, false
+	}
+	return application.Point{X: int(res.x), Y: int(res.y)}, true
+}
diff --git a/client/ui/services/cursor_linux.go b/client/ui/services/cursor_linux.go
new file mode 100644
index 000000000..3294f3c95
--- /dev/null
+++ b/client/ui/services/cursor_linux.go
@@ -0,0 +1,59 @@
+//go:build linux
+
+package services
+
+/*
+#cgo pkg-config: x11
+#cgo LDFLAGS: -lX11
+#include <X11/Xlib.h>
+#include <stdlib.h>
+
+typedef struct CursorPoint {
+    int x;
+    int y;
+    int ok;
+} CursorPoint;
+
+// XQueryPointer works on X11 and, via XWayland, on Wayland sessions.
+// ok=0 when no X server is reachable.
+CursorPoint nbGetCursorPos(void) {
+    CursorPoint p = {0, 0, 0};
+    Display *dpy = XOpenDisplay(NULL);
+    if (!dpy) return p;
+    Window root = DefaultRootWindow(dpy);
+    if (root == 0) { XCloseDisplay(dpy); return p; }
+    Window root_return = 0, child_return = 0;
+    int root_x = 0, root_y = 0, win_x = 0, win_y = 0;
+    unsigned int mask_return = 0;
+    if (XQueryPointer(dpy, root, &root_return, &child_return,
+                      &root_x, &root_y, &win_x, &win_y, &mask_return)) {
+        p.x = root_x;
+        p.y = root_y;
+        p.ok = 1;
+    }
+    XCloseDisplay(dpy);
+    return p;
+}
+*/
+import "C"
+
+import "github.com/wailsapp/wails/v3/pkg/application"
+
+func getCursorPosition(app *application.App) (application.Point, bool) {
+	res := C.nbGetCursorPos()
+	if res.ok == 0 {
+		return application.Point{}, false
+	}
+	p := application.Point{X: int(res.x), Y: int(res.y)}
+	// X11 root coords are physical pixels; Screen.Bounds is in DIPs.
+	if app == nil || app.Screen == nil {
+		return p, true
+	}
+	// The wails GTK3 backend caches screens from the active window; a tray app
+	// has none at startup, so the cache is empty and PhysicalToDipPoint would
+	// dereference a nil nearest screen. Raw pixels are correct there anyway.
+	if app.Screen.ScreenNearestPhysicalPoint(p) == nil {
+		return p, true
+	}
+	return app.Screen.PhysicalToDipPoint(p), true
+}
diff --git a/client/ui/services/cursor_other.go b/client/ui/services/cursor_other.go
new file mode 100644
index 000000000..7f35ff438
--- /dev/null
+++ b/client/ui/services/cursor_other.go
@@ -0,0 +1,9 @@
+//go:build !darwin && !windows && !linux && !freebsd && !android && !ios && !js
+
+package services
+
+import "github.com/wailsapp/wails/v3/pkg/application"
+
+func getCursorPosition(_ *application.App) (application.Point, bool) {
+	return application.Point{}, false
+}
diff --git a/client/ui/services/cursor_windows.go b/client/ui/services/cursor_windows.go
new file mode 100644
index 000000000..42ed32d74
--- /dev/null
+++ b/client/ui/services/cursor_windows.go
@@ -0,0 +1,17 @@
+//go:build windows
+
+package services
+
+import (
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/w32"
+)
+
+func getCursorPosition(app *application.App) (application.Point, bool) {
+	x, y, ok := w32.GetCursorPos()
+	if !ok || app == nil || app.Screen == nil {
+		return application.Point{}, false
+	}
+	// GetCursorPos is in physical pixels; Screen.Bounds is in DIPs.
+	return app.Screen.PhysicalToDipPoint(application.Point{X: x, Y: y}), true
+}
diff --git a/client/ui/services/daemon_feed.go b/client/ui/services/daemon_feed.go
new file mode 100644
index 000000000..632581fe9
--- /dev/null
+++ b/client/ui/services/daemon_feed.go
@@ -0,0 +1,590 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/authsession"
+	"github.com/netbirdio/netbird/client/ui/updater"
+)
+
+const (
+	EventStatusSnapshot = "netbird:status"
+	// EventDaemonNotification carries each SubscribeEvents message. Auto-update
+	// SystemEvents are also forwarded to updater.Holder.OnSystemEvent so the typed
+	// update state needs no second daemon subscription.
+	EventDaemonNotification = "netbird:event"
+	// EventProfileChanged fires after a daemon-side switch (payload: the new
+	// ProfileRef). The daemon emits no profile event, so this is the only signal
+	// that lets a flip driven from one surface paint in the others.
+	EventProfileChanged = "netbird:profile:changed"
+	// EventSessionWarning is a typed sibling of EventDaemonNotification so
+	// subscribers needn't filter the notification firehose. Consumers branch on
+	// SessionWarning.Final to tell the T-10 event from the T-2 fallback.
+	EventSessionWarning = "netbird:session:warning"
+
+	// StatusDaemonUnavailable is the synthetic Status emitted when the daemon's
+	// gRPC socket is unreachable. No internal.Status* collides with this label.
+	StatusDaemonUnavailable = "DaemonUnavailable"
+
+	// Daemon connection status strings — mirror internal.Status* in
+	// client/internal/state.go.
+	StatusConnected      = "Connected"
+	StatusConnecting     = "Connecting"
+	StatusIdle           = "Idle"
+	StatusNeedsLogin     = "NeedsLogin"
+	StatusLoginFailed    = "LoginFailed"
+	StatusSessionExpired = "SessionExpired"
+
+	// SeverityCritical is the lower-cased proto SystemEvent_CRITICAL severity, as
+	// emitted by systemEventFromProto. Critical events bypass the notifications gate.
+	SeverityCritical = "critical"
+)
+
+// Emitter sends a named payload to the frontend. Satisfied by Wails app.Event.
+type Emitter interface {
+	Emit(name string, data ...any) bool
+}
+
+// SystemEvent is the frontend-facing shape of a daemon SystemEvent.
+type SystemEvent struct {
+	ID          string            `json:"id"`
+	Severity    string            `json:"severity"`
+	Category    string            `json:"category"`
+	Message     string            `json:"message"`
+	UserMessage string            `json:"userMessage"`
+	Timestamp   int64             `json:"timestamp"`
+	Metadata    map[string]string `json:"metadata"`
+}
+
+// PeerStatus is the frontend-facing shape of a daemon PeerState.
+type PeerStatus struct {
+	IP                         string   `json:"ip"`
+	IPv6                       string   `json:"ipv6"`
+	PubKey                     string   `json:"pubKey"`
+	ConnStatus                 string   `json:"connStatus"`
+	ConnStatusUpdateUnix       int64    `json:"connStatusUpdateUnix"`
+	Relayed                    bool     `json:"relayed"`
+	LocalIceCandidateType      string   `json:"localIceCandidateType"`
+	RemoteIceCandidateType     string   `json:"remoteIceCandidateType"`
+	LocalIceCandidateEndpoint  string   `json:"localIceCandidateEndpoint"`
+	RemoteIceCandidateEndpoint string   `json:"remoteIceCandidateEndpoint"`
+	Fqdn                       string   `json:"fqdn"`
+	BytesRx                    int64    `json:"bytesRx"`
+	BytesTx                    int64    `json:"bytesTx"`
+	LatencyMs                  int64    `json:"latencyMs"`
+	RelayAddress               string   `json:"relayAddress"`
+	LastHandshakeUnix          int64    `json:"lastHandshakeUnix"`
+	RosenpassEnabled           bool     `json:"rosenpassEnabled"`
+	Networks                   []string `json:"networks"`
+}
+
+// PeerLink is this peer's connection to its mgmt or signal server.
+type PeerLink struct {
+	URL       string `json:"url"`
+	Connected bool   `json:"connected"`
+	Error     string `json:"error,omitempty"`
+}
+
+// LocalPeer mirrors LocalPeerState.
+type LocalPeer struct {
+	IP       string   `json:"ip"`
+	IPv6     string   `json:"ipv6"`
+	PubKey   string   `json:"pubKey"`
+	Fqdn     string   `json:"fqdn"`
+	Networks []string `json:"networks"`
+}
+
+// Status is the snapshot the frontend renders on the dashboard.
+type Status struct {
+	Status        string        `json:"status"`
+	DaemonVersion string        `json:"daemonVersion"`
+	Management    PeerLink      `json:"management"`
+	Signal        PeerLink      `json:"signal"`
+	Local         LocalPeer     `json:"local"`
+	Peers         []PeerStatus  `json:"peers"`
+	Events        []SystemEvent `json:"events"`
+	// NetworksRevision bumps whenever the daemon's routed-networks set or their
+	// selected state changes, so consumers know when to re-fetch ListNetworks
+	// instead of polling every snapshot.
+	NetworksRevision uint64 `json:"networksRevision"`
+	// SessionExpiresAt is the absolute UTC instant the SSO session expires; nil
+	// when the peer is not SSO-tracked or login expiration is disabled.
+	SessionExpiresAt *time.Time `json:"sessionExpiresAt,omitempty"`
+}
+
+// DaemonFeed fans the daemon's two long-running gRPC streams (SubscribeStatus,
+// SubscribeEvents) out to the frontend and tray, and exposes a one-shot Status
+// RPC for callers wanting the current snapshot without subscribing.
+//
+// Profile-switch suppression: BeginProfileSwitch makes statusStreamLoop swallow
+// the transient stale Connected and Idle pushes the daemon emits during Down, so
+// consumers see Connecting → new-profile-state instead of the full blink.
+//
+// Two flags govern the switch lifecycle, evaluated independently by
+// consumeForSwitch on every push because their lifetimes differ:
+//
+//	switchInProgress (suppression): clears on the first real push from the new
+//	    Up. Daemon-side StatusConnecting comes BEFORE any NeedsLogin, so
+//	    suppression must release here before the terminal arrives.
+//	switchLoginWatch (trigger):     outlives suppression. Watches for NeedsLogin
+//	    / LoginFailed / SessionExpired along the Up's retry loop and emits
+//	    EventTriggerLogin so the React orchestrator opens browser-login.
+//
+//	┌────────────────────────────────────────────┬──────────────────────────────────┐
+//	│ Incoming daemon status                     │ Action                           │
+//	├────────────────────────────────────────────┼──────────────────────────────────┤
+//	│ Connected, Idle (while switchInProgress)   │ Suppress (the blink we hide)     │
+//	│ Connecting                                 │ Emit, clear switchInProgress     │
+//	│ NeedsLogin, LoginFailed, SessionExpired    │ Emit, clear both flags, also     │
+//	│                                            │   emit EventTriggerLogin         │
+//	│ Connected, Idle (while only login-watch)   │ Emit, clear switchLoginWatch     │
+//	│ DaemonUnavailable                          │ Emit, clear both flags           │
+//	│ (timeout elapsed)                          │ Clear flags, emit normally       │
+//	└────────────────────────────────────────────┴──────────────────────────────────┘
+type DaemonFeed struct {
+	conn    DaemonConn
+	emitter Emitter
+	updater *updater.Holder
+	// logCtl attaches/detaches the GUI file log in response to the daemon's log
+	// level (a marked SystemEvent on the SubscribeEvents stream). nil when the GUI
+	// doesn't manage its log (server build / not wired), in which case the marker
+	// is ignored.
+	logCtl LogController
+
+	mu       sync.Mutex
+	cancel   context.CancelFunc
+	streamWg sync.WaitGroup
+
+	switchMu              sync.Mutex
+	switchInProgress      bool
+	switchInProgressUntil time.Time
+	switchLoginWatch      bool
+	switchLoginWatchUntil time.Time
+}
+
+// LogController is the subset of guilog.DebugLog that DaemonFeed drives: Apply
+// turns the GUI file log on/off for a daemon level; Path is the gui-client.log
+// path to register with the daemon (empty when the GUI doesn't own its log).
+type LogController interface {
+	Apply(level string)
+	Path() string
+}
+
+// NewDaemonFeed builds the feed. logCtl may be nil (server build / GUI log not
+// managed), in which case log-level markers on the event stream are ignored.
+func NewDaemonFeed(conn DaemonConn, emitter Emitter, updaterHolder *updater.Holder, logCtl LogController) *DaemonFeed {
+	return &DaemonFeed{conn: conn, emitter: emitter, updater: updaterHolder, logCtl: logCtl}
+}
+
+// BeginProfileSwitch arms suppression for a switch from Connected/Connecting,
+// where the daemon emits stale Connected updates during Down's teardown then an
+// Idle before the new Up; statusStreamLoop drops those, and a synthetic
+// Connecting snapshot is emitted so consumers paint optimistically. A 30s safety
+// timeout clears the flag if no follow-up status arrives.
+func (s *DaemonFeed) BeginProfileSwitch() {
+	now := time.Now()
+	s.switchMu.Lock()
+	s.switchInProgress = true
+	s.switchInProgressUntil = now.Add(30 * time.Second)
+	s.switchLoginWatch = true
+	s.switchLoginWatchUntil = now.Add(30 * time.Second)
+	s.switchMu.Unlock()
+	s.emitter.Emit(EventStatusSnapshot, Status{Status: StatusConnecting})
+}
+
+// CancelProfileSwitch aborts a switch midway (tray Disconnect while Connecting):
+// clears suppression so the next daemon Idle paints through, and disarms the
+// login-watch so the abort doesn't pop a browser-login after the user cancelled.
+func (s *DaemonFeed) CancelProfileSwitch() {
+	s.switchMu.Lock()
+	s.switchInProgress = false
+	s.switchLoginWatch = false
+	s.switchMu.Unlock()
+}
+
+// Watch starts the two background stream loops. Idempotent (a second call while
+// running is a no-op); both loops self-restart via exponential backoff.
+func (s *DaemonFeed) Watch(ctx context.Context) {
+	s.mu.Lock()
+	if s.cancel != nil {
+		s.mu.Unlock()
+		return
+	}
+	ctx, cancel := context.WithCancel(ctx)
+	s.cancel = cancel
+	s.mu.Unlock()
+
+	s.streamWg.Add(2)
+	go s.statusStreamLoop(ctx)
+	go s.toastStreamLoop(ctx)
+}
+
+// ServiceShutdown is the Wails service hook fired on app exit.
+func (s *DaemonFeed) ServiceShutdown() error {
+	s.mu.Lock()
+	cancel := s.cancel
+	s.cancel = nil
+	s.mu.Unlock()
+	if cancel != nil {
+		cancel()
+	}
+	s.streamWg.Wait()
+	return nil
+}
+
+// Get returns the current daemon status snapshot. An unreachable daemon socket
+// yields Status{Status: StatusDaemonUnavailable} rather than an error, so the
+// frontend keys off a single status enum without a parallel "error" path.
+func (s *DaemonFeed) Get(ctx context.Context) (Status, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		if isDaemonUnreachable(err) {
+			return Status{Status: StatusDaemonUnavailable}, nil
+		}
+		return Status{}, err
+	}
+	resp, err := cli.Status(ctx, &proto.StatusRequest{GetFullPeerStatus: true})
+	if err != nil {
+		if isDaemonUnreachable(err) {
+			return Status{Status: StatusDaemonUnavailable}, nil
+		}
+		return Status{}, err
+	}
+	return statusFromProto(resp), nil
+}
+
+// consumeForSwitch decides, for an incoming push during a profile switch,
+// whether to suppress it (suppress) and whether the switch landed in a state
+// needing the SSO flow (triggerLogin: NeedsLogin / SessionExpired / LoginFailed).
+//
+// The two flags have different lifetimes: suppression clears on Connecting, but
+// the trigger watcher must survive past it to catch the eventual NeedsLogin —
+// daemon-side StatusConnecting fires before loginToManagement, which is what may
+// then set StatusNeedsLogin.
+func (s *DaemonFeed) consumeForSwitch(st Status) (suppress, triggerLogin bool) {
+	s.switchMu.Lock()
+	defer s.switchMu.Unlock()
+
+	now := time.Now()
+	if s.switchInProgress && now.After(s.switchInProgressUntil) {
+		s.switchInProgress = false
+	}
+	if s.switchLoginWatch && now.After(s.switchLoginWatchUntil) {
+		s.switchLoginWatch = false
+	}
+
+	if s.switchInProgress {
+		switch {
+		case strings.EqualFold(st.Status, StatusConnecting),
+			strings.EqualFold(st.Status, StatusNeedsLogin),
+			strings.EqualFold(st.Status, StatusLoginFailed),
+			strings.EqualFold(st.Status, StatusSessionExpired),
+			strings.EqualFold(st.Status, StatusDaemonUnavailable):
+			// New flow has begun (Up started, or daemon refused it).
+			s.switchInProgress = false
+		default:
+			// Stale Connected from teardown or transient Idle: suppress so the
+			// optimistic Connecting stays painted. Login-watch stays armed.
+			return true, false
+		}
+	}
+
+	if s.switchLoginWatch {
+		switch {
+		case strings.EqualFold(st.Status, StatusNeedsLogin),
+			strings.EqualFold(st.Status, StatusLoginFailed),
+			strings.EqualFold(st.Status, StatusSessionExpired):
+			// SSO-needed terminal: trigger browser-login without a second click.
+			s.switchLoginWatch = false
+			return false, true
+		case strings.EqualFold(st.Status, StatusConnected),
+			strings.EqualFold(st.Status, StatusIdle),
+			strings.EqualFold(st.Status, StatusDaemonUnavailable):
+			// Terminal but not SSO — disarm without triggering.
+			s.switchLoginWatch = false
+		}
+	}
+
+	return false, false
+}
+
+// statusStreamLoop subscribes to SubscribeStatus and re-emits each snapshot on
+// the Wails event bus. The first message is the current snapshot; later ones
+// fire on connection-state changes only — no polling.
+func (s *DaemonFeed) statusStreamLoop(ctx context.Context) {
+	defer s.streamWg.Done()
+
+	bo := backoff.WithContext(&backoff.ExponentialBackOff{
+		InitialInterval:     time.Second,
+		RandomizationFactor: backoff.DefaultRandomizationFactor,
+		Multiplier:          backoff.DefaultMultiplier,
+		MaxInterval:         10 * time.Second,
+		MaxElapsedTime:      0,
+		Stop:                backoff.Stop,
+		Clock:               backoff.SystemClock,
+	}, ctx)
+
+	// unavailable fires the synthetic event once per outage, not on every retry.
+	unavailable := false
+	emitUnavailable := func() {
+		if unavailable {
+			return
+		}
+		unavailable = true
+		s.emitter.Emit(EventStatusSnapshot, Status{Status: StatusDaemonUnavailable})
+	}
+
+	op := func() error {
+		return s.subscribeAndStreamStatus(ctx, &unavailable, emitUnavailable)
+	}
+
+	if err := backoff.Retry(op, bo); err != nil && ctx.Err() == nil {
+		log.Errorf("status stream ended: %v", err)
+	}
+}
+
+// subscribeAndStreamStatus is one attempt of the status backoff loop: open
+// SubscribeStatus and re-emit every snapshot until it errors. A daemon-
+// unreachable failure also flips the synthetic-unavailable signal.
+func (s *DaemonFeed) subscribeAndStreamStatus(ctx context.Context, unavailable *bool, emitUnavailable func()) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		emitUnavailable()
+		return fmt.Errorf("get client: %w", err)
+	}
+	stream, err := cli.SubscribeStatus(ctx, &proto.StatusRequest{GetFullPeerStatus: true})
+	if err != nil {
+		if isDaemonUnreachable(err) {
+			emitUnavailable()
+		}
+		return fmt.Errorf("subscribe status: %w", err)
+	}
+	for {
+		resp, err := stream.Recv()
+		if err != nil {
+			return s.handleStatusRecvErr(ctx, err, emitUnavailable)
+		}
+		*unavailable = false
+		s.emitStatus(statusFromProto(resp))
+	}
+}
+
+// handleStatusRecvErr maps a SubscribeStatus Recv error into the backoff loop's
+// return: ctx cancellation stops the loop, an unreachable socket flips the
+// synthetic-unavailable signal, everything else is retryable.
+func (s *DaemonFeed) handleStatusRecvErr(ctx context.Context, err error, emitUnavailable func()) error {
+	if ctx.Err() != nil {
+		return ctx.Err()
+	}
+	if isDaemonUnreachable(err) {
+		emitUnavailable()
+	}
+	return fmt.Errorf("status stream recv: %w", err)
+}
+
+// emitStatus pushes a snapshot to the frontend, dropping the transient
+// stale-Connected / Idle pushes that occur mid profile switch.
+func (s *DaemonFeed) emitStatus(st Status) {
+	log.Infof("backend event: status status=%q peers=%d", st.Status, len(st.Peers))
+	suppress, triggerLogin := s.consumeForSwitch(st)
+	if suppress {
+		log.Debugf("suppressing status=%q during profile switch", st.Status)
+		return
+	}
+	s.emitter.Emit(EventStatusSnapshot, st)
+	if triggerLogin {
+		s.emitter.Emit(EventTriggerLogin)
+	}
+}
+
+// toastStreamLoop subscribes to SubscribeEvents and re-emits every SystemEvent
+// on the Wails event bus. Local name differs from the RPC so the file's two
+// streams aren't both called streamLoop.
+func (s *DaemonFeed) toastStreamLoop(ctx context.Context) {
+	defer s.streamWg.Done()
+
+	bo := backoff.WithContext(&backoff.ExponentialBackOff{
+		InitialInterval:     time.Second,
+		RandomizationFactor: backoff.DefaultRandomizationFactor,
+		Multiplier:          backoff.DefaultMultiplier,
+		MaxInterval:         10 * time.Second,
+		MaxElapsedTime:      0,
+		Stop:                backoff.Stop,
+		Clock:               backoff.SystemClock,
+	}, ctx)
+
+	op := func() error {
+		return s.subscribeAndStreamEvents(ctx)
+	}
+
+	if err := backoff.Retry(op, bo); err != nil && ctx.Err() == nil {
+		log.Errorf("event stream ended: %v", err)
+	}
+}
+
+// subscribeAndStreamEvents is one attempt of the event backoff loop: open
+// SubscribeEvents and fan out every SystemEvent until it errors.
+func (s *DaemonFeed) subscribeAndStreamEvents(ctx context.Context) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return fmt.Errorf("get client: %w", err)
+	}
+	stream, err := cli.SubscribeEvents(ctx, &proto.SubscribeRequest{})
+	if err != nil {
+		return fmt.Errorf("subscribe: %w", err)
+	}
+
+	// Re-register the GUI log path on every (re)connect so a daemon restart
+	// re-learns it. Best-effort — a failure must not abort the stream. Done even
+	// when file logging is off, so the path is known ahead of any debug toggle.
+	if s.logCtl != nil && s.logCtl.Path() != "" {
+		if _, err := cli.RegisterUILog(ctx, &proto.RegisterUILogRequest{Path: s.logCtl.Path()}); err != nil {
+			log.Warnf("register UI log path: %v", err)
+		}
+	}
+	for {
+		ev, err := stream.Recv()
+		if err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			return fmt.Errorf("stream recv: %w", err)
+		}
+		s.dispatchSystemEvent(ev)
+	}
+}
+
+// dispatchSystemEvent fans one daemon SystemEvent out to the frontend
+// notification stream, the typed session-warning event (when the metadata
+// carries one), and the updater holder (when present).
+func (s *DaemonFeed) dispatchSystemEvent(ev *proto.SystemEvent) {
+	se := systemEventFromProto(ev)
+	log.Infof("backend event: system severity=%s category=%s msg=%q", se.Severity, se.Category, se.UserMessage)
+	// Internal refresh signal (CLI-driven profile add/remove), not a notification:
+	// translate and stop so it never reaches Recent Events or fires an OS toast.
+	if se.Metadata[proto.MetadataKindKey] == proto.MetadataKindProfileListChanged {
+		s.emitter.Emit(EventProfileChanged, ProfileRef{})
+		return
+	}
+	// Internal control signal driving the GUI file log on/off — handle and stop
+	// so it never reaches Recent Events or toasts.
+	if se.Metadata[proto.MetadataKindKey] == proto.MetadataKindLogLevelChanged {
+		if s.logCtl != nil {
+			s.logCtl.Apply(se.Metadata[proto.MetadataLevelKey])
+		}
+		return
+	}
+	s.emitter.Emit(EventDaemonNotification, se)
+	if warn, ok := authsession.WarningFromMetadata(se.Metadata); ok {
+		s.emitter.Emit(EventSessionWarning, warn)
+	}
+	if s.updater != nil {
+		s.updater.OnSystemEvent(ev)
+	}
+}
+
+func statusFromProto(resp *proto.StatusResponse) Status {
+	full := resp.GetFullStatus()
+	mgmt := full.GetManagementState()
+	sig := full.GetSignalState()
+	local := full.GetLocalPeerState()
+
+	st := Status{
+		Status:           resp.GetStatus(),
+		DaemonVersion:    resp.GetDaemonVersion(),
+		NetworksRevision: full.GetNetworksRevision(),
+		Management: PeerLink{
+			URL:       mgmt.GetURL(),
+			Connected: mgmt.GetConnected(),
+			Error:     mgmt.GetError(),
+		},
+		Signal: PeerLink{
+			URL:       sig.GetURL(),
+			Connected: sig.GetConnected(),
+			Error:     sig.GetError(),
+		},
+		Local: LocalPeer{
+			IP:       local.GetIP(),
+			IPv6:     local.GetIpv6(),
+			PubKey:   local.GetPubKey(),
+			Fqdn:     local.GetFqdn(),
+			Networks: append([]string{}, local.GetNetworks()...),
+		},
+	}
+
+	for _, p := range full.GetPeers() {
+		st.Peers = append(st.Peers, PeerStatus{
+			IP:                         p.GetIP(),
+			IPv6:                       p.GetIpv6(),
+			PubKey:                     p.GetPubKey(),
+			ConnStatus:                 p.GetConnStatus(),
+			ConnStatusUpdateUnix:       p.GetConnStatusUpdate().GetSeconds(),
+			Relayed:                    p.GetRelayed(),
+			LocalIceCandidateType:      p.GetLocalIceCandidateType(),
+			RemoteIceCandidateType:     p.GetRemoteIceCandidateType(),
+			LocalIceCandidateEndpoint:  p.GetLocalIceCandidateEndpoint(),
+			RemoteIceCandidateEndpoint: p.GetRemoteIceCandidateEndpoint(),
+			Fqdn:                       p.GetFqdn(),
+			BytesRx:                    p.GetBytesRx(),
+			BytesTx:                    p.GetBytesTx(),
+			LatencyMs:                  p.GetLatency().AsDuration().Milliseconds(),
+			RelayAddress:               p.GetRelayAddress(),
+			LastHandshakeUnix:          p.GetLastWireguardHandshake().GetSeconds(),
+			RosenpassEnabled:           p.GetRosenpassEnabled(),
+			Networks:                   append([]string{}, p.GetNetworks()...),
+		})
+	}
+	for _, e := range full.GetEvents() {
+		st.Events = append(st.Events, systemEventFromProto(e))
+	}
+	if ts := resp.GetSessionExpiresAt(); ts.IsValid() && !ts.AsTime().IsZero() {
+		t := ts.AsTime().UTC()
+		st.SessionExpiresAt = &t
+	}
+	return st
+}
+
+func systemEventFromProto(e *proto.SystemEvent) SystemEvent {
+	out := SystemEvent{
+		ID:          e.GetId(),
+		Severity:    strings.ToLower(strings.TrimPrefix(e.GetSeverity().String(), "SystemEvent_")),
+		Category:    strings.ToLower(strings.TrimPrefix(e.GetCategory().String(), "SystemEvent_")),
+		Message:     e.GetMessage(),
+		UserMessage: e.GetUserMessage(),
+		Metadata:    map[string]string{},
+	}
+	if ts := e.GetTimestamp(); ts != nil {
+		out.Timestamp = ts.GetSeconds()
+	}
+	for k, v := range e.GetMetadata() {
+		out.Metadata[k] = v
+	}
+	return out
+}
+
+// isDaemonUnreachable reports whether a gRPC error means the daemon socket isn't
+// answering, versus the daemon responding with an application-level code. Only
+// the former should flip the tray to "Not running" — a daemon returning e.g.
+// FailedPrecondition is alive and must not be reported as down.
+func isDaemonUnreachable(err error) bool {
+	if err == nil {
+		return false
+	}
+	st, ok := status.FromError(err)
+	if !ok {
+		return true
+	}
+	return st.Code() == codes.Unavailable
+}
diff --git a/client/ui/services/debug.go b/client/ui/services/debug.go
new file mode 100644
index 000000000..d1f6555a8
--- /dev/null
+++ b/client/ui/services/debug.go
@@ -0,0 +1,140 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/version"
+)
+
+type DebugBundleParams struct {
+	Anonymize bool `json:"anonymize"`
+	// AnonymizeLevel is "default" or "strict"; strict also anonymizes
+	// private IP ranges, peer names, and WireGuard public keys.
+	AnonymizeLevel string `json:"anonymizeLevel"`
+	SystemInfo     bool   `json:"systemInfo"`
+	UploadURL      string `json:"uploadUrl"`
+	LogFileCount   uint32 `json:"logFileCount"`
+}
+
+// DebugBundleResult: Path is set for local-only bundles, UploadedKey on upload
+// success, UploadFailureReason on upload failure.
+type DebugBundleResult struct {
+	Path                string `json:"path"`
+	UploadedKey         string `json:"uploadedKey"`
+	UploadFailureReason string `json:"uploadFailureReason"`
+}
+
+// LogLevel carries a logrus level name: "error", "warn", "info", "debug", "trace".
+type LogLevel struct {
+	Level string `json:"level"`
+}
+
+type Debug struct {
+	conn DaemonConn
+}
+
+func NewDebug(conn DaemonConn) *Debug {
+	return &Debug{conn: conn}
+}
+
+func (s *Debug) Bundle(ctx context.Context, p DebugBundleParams) (DebugBundleResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return DebugBundleResult{}, err
+	}
+	resp, err := cli.DebugBundle(ctx, &proto.DebugBundleRequest{
+		Anonymize:      p.Anonymize,
+		AnonymizeLevel: p.AnonymizeLevel,
+		SystemInfo:     p.SystemInfo,
+		UploadURL:      p.UploadURL,
+		LogFileCount:   p.LogFileCount,
+		CliVersion:     version.NetbirdVersion(),
+	})
+	if err != nil {
+		return DebugBundleResult{}, err
+	}
+	return DebugBundleResult{
+		Path:                resp.GetPath(),
+		UploadedKey:         resp.GetUploadedKey(),
+		UploadFailureReason: resp.GetUploadFailureReason(),
+	}, nil
+}
+
+func (s *Debug) GetLogLevel(ctx context.Context) (LogLevel, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return LogLevel{}, err
+	}
+	resp, err := cli.GetLogLevel(ctx, &proto.GetLogLevelRequest{})
+	if err != nil {
+		return LogLevel{}, err
+	}
+	return LogLevel{Level: resp.GetLevel().String()}, nil
+}
+
+// RevealFile opens the OS file manager focused on path. Needed because Wails'
+// Browser.OpenURL refuses non-http(s) schemes like file://.
+func (s *Debug) RevealFile(_ context.Context, path string) error {
+	if path == "" {
+		return fmt.Errorf("empty path")
+	}
+	return revealFile(path)
+}
+
+// RegisterUILog reports the GUI log path to the daemon for bundle collection;
+// the daemon runs as root and can't resolve the user's config dir. Called on
+// each daemon (re)connect.
+func (s *Debug) RegisterUILog(ctx context.Context, path string) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.RegisterUILog(ctx, &proto.RegisterUILogRequest{Path: path})
+	return err
+}
+
+func (s *Debug) StartBundleCapture(ctx context.Context, timeoutSeconds int32) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	req := &proto.StartBundleCaptureRequest{}
+	if timeoutSeconds > 0 {
+		req.Timeout = durationpb.New(time.Duration(timeoutSeconds) * time.Second)
+	}
+	_, err = cli.StartBundleCapture(ctx, req)
+	return err
+}
+
+func (s *Debug) StopBundleCapture(ctx context.Context) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.StopBundleCapture(ctx, &proto.StopBundleCaptureRequest{})
+	return err
+}
+
+func (s *Debug) SetLogLevel(ctx context.Context, lvl LogLevel) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	// proto.LogLevel_value keys are upper-case enum names; callers pass
+	// lowercase logrus names. Upper-case before lookup or a valid level
+	// silently falls through to INFO.
+	level, ok := proto.LogLevel_value[strings.ToUpper(lvl.Level)]
+	if !ok {
+		level = int32(proto.LogLevel_INFO)
+	}
+	_, err = cli.SetLogLevel(ctx, &proto.SetLogLevelRequest{Level: proto.LogLevel(level)})
+	return err
+}
diff --git a/client/ui/services/debug_reveal_other.go b/client/ui/services/debug_reveal_other.go
new file mode 100644
index 000000000..bef0a58bb
--- /dev/null
+++ b/client/ui/services/debug_reveal_other.go
@@ -0,0 +1,20 @@
+//go:build !android && !ios && !freebsd && !js && !windows
+
+package services
+
+import (
+	"os/exec"
+	"path/filepath"
+	"runtime"
+)
+
+// revealFile opens the OS file manager focused on path.
+func revealFile(path string) error {
+	var cmd *exec.Cmd
+	if runtime.GOOS == "darwin" {
+		cmd = exec.Command("open", "-R", path)
+	} else {
+		cmd = exec.Command("xdg-open", filepath.Dir(path))
+	}
+	return cmd.Start()
+}
diff --git a/client/ui/services/debug_reveal_windows.go b/client/ui/services/debug_reveal_windows.go
new file mode 100644
index 000000000..790d23fab
--- /dev/null
+++ b/client/ui/services/debug_reveal_windows.go
@@ -0,0 +1,54 @@
+package services
+
+import (
+	"fmt"
+	"os/exec"
+	"path/filepath"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// SW_SHOWNORMAL for ShellExecuteW's nShowCmd.
+const swShowNormal = 1
+
+var (
+	shell32          = windows.NewLazySystemDLL("shell32.dll")
+	procShellExecute = shell32.NewProc("ShellExecuteW")
+)
+
+// revealFile opens Explorer focused on path. The debug bundle is written by the
+// daemon (running as SYSTEM) into C:\Windows\SystemTemp, whose ACL denies the
+// logged-in user. A plain "explorer /select" can't traverse it, so we elevate
+// via the ShellExecuteW "runas" verb (UAC prompt) — the elevated Explorer can
+// read the folder and highlight the file.
+func revealFile(path string) error {
+	verb, err := windows.UTF16PtrFromString("runas")
+	if err != nil {
+		return fmt.Errorf("encode verb: %w", err)
+	}
+	file, err := windows.UTF16PtrFromString("explorer.exe")
+	if err != nil {
+		return fmt.Errorf("encode file: %w", err)
+	}
+	params, err := windows.UTF16PtrFromString("/select," + path)
+	if err != nil {
+		return fmt.Errorf("encode params: %w", err)
+	}
+
+	// ShellExecuteW returns an HINSTANCE; a value <=32 is an error code.
+	ret, _, _ := procShellExecute.Call(
+		0,
+		uintptr(unsafe.Pointer(verb)),
+		uintptr(unsafe.Pointer(file)),
+		uintptr(unsafe.Pointer(params)),
+		0,
+		swShowNormal,
+	)
+	if ret <= 32 {
+		// Elevation declined or failed: fall back to an unelevated reveal of the
+		// parent directory so the user at least lands near the bundle.
+		return exec.Command("explorer", filepath.Dir(path)).Start() //nolint:gosec
+	}
+	return nil
+}
diff --git a/client/ui/services/errors.go b/client/ui/services/errors.go
new file mode 100644
index 000000000..d193e9f02
--- /dev/null
+++ b/client/ui/services/errors.go
@@ -0,0 +1,183 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"encoding/json"
+	"strings"
+
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	gcodes "google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// privilegeErrorInfo returns the daemon's privilege-refusal detail, if the error
+// carries one.
+func privilegeErrorInfo(err error) (*errdetails.ErrorInfo, bool) {
+	for _, detail := range gstatus.Convert(err).Details() {
+		info, ok := detail.(*errdetails.ErrorInfo)
+		if !ok {
+			continue
+		}
+		if info.GetReason() == ipcauth.ErrorReasonPrivilegeRequired && info.GetDomain() == ipcauth.ErrorDomain {
+			return info, true
+		}
+	}
+	return nil, false
+}
+
+// ErrorTranslator localises daemon errors; runtime impl is *i18n.Bundle.
+type ErrorTranslator interface {
+	Translate(lang i18n.LanguageCode, key string, args ...string) string
+}
+
+// LanguagePreference reports the current UI language; runtime impl is *preferences.Store.
+type LanguagePreference interface {
+	Get() preferences.UIPreferences
+}
+
+// ClientError is a structured error returned to the frontend. The frontend
+// translates Code via i18n; Short is an English fallback; Long carries the
+// unwrapped daemon message.
+type ClientError struct {
+	Code  string `json:"code"`
+	Short string `json:"short"`
+	Long  string `json:"long"`
+	// Command is a command the user can run to complete the operation
+	// themselves, set when the daemon refused it for want of privileges. The
+	// frontend offers it for copying.
+	Command string `json:"command,omitempty"`
+}
+
+// Error returns the short message for plain Go callers.
+func (e *ClientError) Error() string {
+	if e == nil {
+		return ""
+	}
+	return e.Short
+}
+
+// MarshalJSON emits the struct so the Wails binding sends an object, not the
+// default "error: ..." string.
+func (e *ClientError) MarshalJSON() ([]byte, error) {
+	if e == nil {
+		return []byte("null"), nil
+	}
+	type alias ClientError
+	return json.Marshal((*alias)(e))
+}
+
+// errorClassifier maps gRPC errors to a localised ClientError. Shared by the
+// daemon-facing services so the frontend gets a clean short message instead of
+// the wrapped gRPC chain.
+type errorClassifier struct {
+	translator ErrorTranslator
+	prefs      LanguagePreference
+}
+
+// classify maps a gRPC error to a ClientError by matching known substrings to a
+// stable code. A missing locale entry surfaces as a visible "error.<code>"
+// string — a deliberate fail-loud signal to update the bundle.
+func (c errorClassifier) classify(err error) *ClientError {
+	if err == nil {
+		return nil
+	}
+
+	msg := err.Error()
+	grpcCode := gcodes.Unknown
+	if st, ok := gstatus.FromError(err); ok {
+		msg = st.Message()
+		grpcCode = st.Code()
+	}
+
+	// A refusal for want of privileges carries its own summary and the command
+	// that performs the operation, both written for the user. Surface them
+	// verbatim: no substring guessing, and no localisation of a message the
+	// daemon composed.
+	if info, ok := privilegeErrorInfo(err); ok {
+		summary := info.GetMetadata()[ipcauth.ErrorMetaSummary]
+		if summary == "" {
+			summary = msg
+		}
+		return &ClientError{
+			Code:    "privilege_required",
+			Short:   summary,
+			Long:    summary,
+			Command: info.GetMetadata()[ipcauth.ErrorMetaCommand],
+		}
+	}
+
+	lower := strings.ToLower(msg)
+
+	code := "unknown"
+	switch {
+	case strings.Contains(lower, "token used before issued"),
+		strings.Contains(lower, "token is not valid yet"):
+		code = "jwt_clock_skew"
+	case strings.Contains(lower, "token is expired"),
+		strings.Contains(lower, "token has expired"):
+		code = "jwt_expired"
+	case strings.Contains(lower, "token signature is invalid"):
+		code = "jwt_signature_invalid"
+	case strings.Contains(lower, "peer login has expired"):
+		code = "session_expired"
+	case strings.Contains(lower, "invalid setup-key"),
+		strings.Contains(lower, "invalid setup key"):
+		code = "invalid_setup_key"
+	case strings.Contains(lower, "permission denied"):
+		code = "permission_denied"
+	case strings.Contains(lower, "no connection could be made"),
+		strings.Contains(lower, "connection refused"),
+		strings.Contains(lower, "context deadline exceeded"):
+		code = "daemon_unreachable"
+	case strings.Contains(lower, "update settings are disabled"):
+		code = "settings_locked"
+	case strings.Contains(lower, "managed by mdm"):
+		code = "settings_managed_by_mdm"
+	}
+
+	// Deliberately no blanket mapping for FailedPrecondition below: the daemon
+	// returns it for two dozen states that are not settings refusals at all —
+	// "not logged in", "client is not running", "session can no longer be
+	// extended" — and this classifier is shared with the session and connection
+	// services. Only the two refusals the daemon composes are named, by their
+	// message.
+
+	// Fall back to the gRPC status code when the message didn't match a known
+	// substring — the daemon now forwards the innermost code with a clean desc
+	// that no longer contains the English marker text.
+	if code == "unknown" {
+		switch grpcCode {
+		case gcodes.PermissionDenied:
+			code = "permission_denied"
+		case gcodes.Unavailable, gcodes.DeadlineExceeded:
+			code = "daemon_unreachable"
+		}
+	}
+
+	return &ClientError{
+		Code:  code,
+		Short: c.translateShort(code),
+		Long:  msg,
+	}
+}
+
+// translateShort resolves the localised short message for code, returning the
+// bare "error.<code>" key when no translation is available so the gap stays visible.
+func (c errorClassifier) translateShort(code string) string {
+	key := "error." + code
+	if c.translator == nil {
+		return key
+	}
+	lang := i18n.DefaultLanguage
+	if c.prefs != nil {
+		if pref := c.prefs.Get().Language; pref != "" {
+			lang = pref
+		}
+	}
+	return c.translator.Translate(lang, key)
+}
diff --git a/client/ui/services/errors_test.go b/client/ui/services/errors_test.go
new file mode 100644
index 000000000..c2a10442f
--- /dev/null
+++ b/client/ui/services/errors_test.go
@@ -0,0 +1,73 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	gcodes "google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+)
+
+func TestErrorClassifier_Classify(t *testing.T) {
+	c := errorClassifier{} // nil translator → Short is the bare "error.<code>" key
+
+	t.Run("permission denied by gRPC code with a clean desc", func(t *testing.T) {
+		// The daemon now forwards the innermost status: code + clean desc that
+		// no longer carries the English "permission denied" marker.
+		err := gstatus.Error(gcodes.PermissionDenied, "peer is already registered by a different User or a Setup Key")
+
+		ce := c.classify(err)
+		require.NotNil(t, ce)
+		require.Equal(t, "permission_denied", ce.Code)
+		require.Equal(t, "error.permission_denied", ce.Short)
+		require.Equal(t, "peer is already registered by a different User or a Setup Key", ce.Long)
+	})
+
+	t.Run("substring match still wins for unclassified codes", func(t *testing.T) {
+		err := gstatus.Error(gcodes.Unknown, "peer login has expired")
+
+		ce := c.classify(err)
+		require.NotNil(t, ce)
+		require.Equal(t, "session_expired", ce.Code)
+	})
+
+	t.Run("the update-settings kill switch is a refusal, not a failure", func(t *testing.T) {
+		err := gstatus.Error(gcodes.FailedPrecondition,
+			"update settings are disabled, you cannot use this feature without update settings enabled")
+
+		ce := c.classify(err)
+		require.NotNil(t, ce)
+		require.Equal(t, "settings_locked", ce.Code)
+	})
+
+	t.Run("an MDM-managed field is named as such", func(t *testing.T) {
+		err := gstatus.Error(gcodes.FailedPrecondition,
+			"fields managed by MDM cannot be modified: [managementURL]")
+
+		require.Equal(t, "settings_managed_by_mdm", c.classify(err).Code)
+	})
+
+	t.Run("an unrelated FailedPrecondition is not called a refusal", func(t *testing.T) {
+		// The daemon uses this code for states that are not settings refusals,
+		// and this classifier is shared with the session and connection
+		// services, so only the two refusals it composes are named.
+		require.Equal(t, "unknown", c.classify(gstatus.Error(gcodes.FailedPrecondition, "not logged in")).Code)
+	})
+
+	t.Run("unavailable code maps to daemon_unreachable", func(t *testing.T) {
+		ce := c.classify(gstatus.Error(gcodes.Unavailable, "transport closing"))
+		require.Equal(t, "daemon_unreachable", ce.Code)
+	})
+
+	t.Run("unmatched stays unknown", func(t *testing.T) {
+		ce := c.classify(errors.New("something odd"))
+		require.Equal(t, "unknown", ce.Code)
+	})
+
+	t.Run("nil error", func(t *testing.T) {
+		require.Nil(t, c.classify(nil))
+	})
+}
diff --git a/client/ui/services/foreground_other.go b/client/ui/services/foreground_other.go
new file mode 100644
index 000000000..e6e16a21a
--- /dev/null
+++ b/client/ui/services/foreground_other.go
@@ -0,0 +1,11 @@
+//go:build !windows && !android && !ios && !freebsd && !js
+
+package services
+
+import "github.com/wailsapp/wails/v3/pkg/application"
+
+func raiseToForeground(w *application.WebviewWindow) {
+	if w != nil {
+		w.Focus()
+	}
+}
diff --git a/client/ui/services/foreground_windows.go b/client/ui/services/foreground_windows.go
new file mode 100644
index 000000000..215f30093
--- /dev/null
+++ b/client/ui/services/foreground_windows.go
@@ -0,0 +1,43 @@
+//go:build windows
+
+package services
+
+import (
+	"syscall"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/w32"
+)
+
+var procAttachThreadInput = syscall.NewLazyDLL("user32.dll").NewProc("AttachThreadInput")
+
+func attachThreadInput(attach, attachTo w32.HANDLE, on bool) {
+	var flag uintptr
+	if on {
+		flag = 1
+	}
+	_, _, _ = procAttachThreadInput.Call(uintptr(attach), uintptr(attachTo), flag)
+}
+
+func raiseToForeground(w *application.WebviewWindow) {
+	if w == nil {
+		return
+	}
+	application.InvokeSync(func() {
+		ptr := w.NativeWindow()
+		if ptr == nil {
+			return
+		}
+		hwnd := w32.HWND(uintptr(ptr))
+
+		fgThread, _ := w32.GetWindowThreadProcessId(w32.GetForegroundWindow())
+		appThread := w32.GetCurrentThreadId()
+		if fgThread != appThread {
+			attachThreadInput(fgThread, appThread, true)
+			defer attachThreadInput(fgThread, appThread, false)
+		}
+		w32.ShowWindow(hwnd, w32.SW_SHOW)
+		w32.BringWindowToTop(hwnd)
+		w32.SetForegroundWindow(hwnd)
+	})
+}
diff --git a/client/ui/services/guarded.go b/client/ui/services/guarded.go
new file mode 100644
index 000000000..f425428b5
--- /dev/null
+++ b/client/ui/services/guarded.go
@@ -0,0 +1,231 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/elevate"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// The command line of the one-shot mode this binary runs itself in, elevated, to
+// apply a setting the daemon restricts to root/administrator. The setting flags
+// spell the same words as `netbird up`, so the command a user is shown and what
+// runs behind the prompt read alike. Parsed in oneshot.go.
+const (
+	FlagApplyPrivilegedSettings = "apply-privileged-settings"
+	FlagDaemonAddr              = "daemon-addr"
+	FlagProfile                 = "profile"
+	FlagUser                    = "user"
+	FlagLogLevel                = "log-level"
+	FlagManagementURL           = "management-url"
+	FlagAllowServerSSH          = "allow-server-ssh"
+	FlagEnableSSHRoot           = "enable-ssh-root"
+	FlagDisableSSHAuth          = "disable-ssh-auth"
+)
+
+// Error codes for the ways asking for privileges can fail.
+const (
+	CodeElevationUnavailable = "elevation_unavailable"
+	CodeElevationFailed      = "elevation_failed"
+)
+
+// elevationTimeout bounds the wait for a prompt and the change behind it, so a
+// dialog nobody answers does not leave its control disabled for the session. Long
+// enough to find a password manager, and no shorter than the platforms' own prompt
+// timeouts: Windows gives up on its consent dialog after two minutes by itself.
+//
+// It always ends our waiting, and not always the prompt: Security.framework offers
+// no way to withdraw a request, so on macOS the system's own timeout is what closes
+// the dialog.
+const elevationTimeout = 5 * time.Minute
+
+// elevator raises the platform's privilege prompt and runs the change behind it.
+// An interface so tests can answer without a prompt.
+type elevator interface {
+	// Run runs this binary again, elevated, with the given arguments.
+	Run(ctx context.Context, args ...string) error
+	// Available reports whether there is a prompt to raise on this host at all.
+	Available() bool
+}
+
+// osElevator is the real thing: see the elevate package.
+type osElevator struct{}
+
+func (osElevator) Run(ctx context.Context, args ...string) error {
+	return elevate.Run(ctx, args...)
+}
+
+func (osElevator) Available() bool {
+	return elevate.Available()
+}
+
+// SaveOutcome reports what became of a change that needed authorization.
+//
+// A declined prompt is a result, not an error: the user was asked and said no, so
+// nothing was applied and nothing went wrong. Reporting it as an error would have
+// every cancelled prompt logged as one.
+type SaveOutcome struct {
+	// Declined is set when the user dismissed the authorization prompt, or was
+	// refused by policy. Nothing was changed.
+	Declined bool `json:"declined"`
+}
+
+// GuardedSettings is the subset of the config the daemon restricts to
+// root/administrator. Only the fields that are set are changed: a nil pointer, or
+// an empty management URL, leaves that setting alone.
+//
+// The management URL is in here because pointing a host with the SSH server
+// running at another management identity hands the decision of who may open a
+// shell on it to whoever runs that server, which is the same power as enabling
+// the SSH server in the first place.
+type GuardedSettings struct {
+	ProfileName      string `json:"profileName"`
+	Username         string `json:"username"`
+	ManagementURL    string `json:"managementUrl,omitempty"`
+	ServerSSHAllowed *bool  `json:"serverSshAllowed,omitempty"`
+	EnableSSHRoot    *bool  `json:"enableSshRoot,omitempty"`
+	DisableSSHAuth   *bool  `json:"disableSshAuth,omitempty"`
+}
+
+// guardedSetting is one setting to change, in the two spellings this needs: the
+// one-shot's own flag, and the `netbird up` flag that does the same thing from a
+// terminal, for when there is no prompt to raise.
+type guardedSetting struct {
+	arg  string
+	flag string
+}
+
+// SetGuardedSettings applies settings the daemon refuses from an unprivileged
+// caller, by having the operating system run this binary again, elevated, to send
+// the same request the frontend would have sent itself.
+//
+// The user authorizes it at the platform's own prompt: the UAC consent dialog,
+// the macOS authentication dialog, or the polkit agent's. Any credentials are the
+// operating system's business; NetBird neither sees nor asks for them. Nothing
+// about the daemon's rules changes, and the elevated process is authorized like
+// any other privileged caller, from the identity the kernel reports for it.
+//
+// A declined prompt comes back as SaveOutcome.Declined with no error. When there is
+// no prompt to raise, or the elevated run failed, the error carries the command
+// that does the same thing from a terminal.
+func (s *Settings) SetGuardedSettings(ctx context.Context, p GuardedSettings) (SaveOutcome, error) {
+	settings := guardedSettings(p)
+	if len(settings) == 0 {
+		return SaveOutcome{}, &ClientError{
+			Code:  CodeElevationFailed,
+			Short: "no setting to apply",
+			Long:  "no setting to apply",
+		}
+	}
+
+	// The elevated run has no window and, on Linux, an environment pkexec has
+	// cleared, so what it writes to stderr is all there is to go on. It follows
+	// this process's level so that starting the app with --log-level debug says
+	// something about the run behind the prompt too.
+	args := append([]string{
+		"--" + FlagApplyPrivilegedSettings,
+		"--" + FlagDaemonAddr, s.daemonAddr,
+		"--" + FlagProfile, p.ProfileName,
+		"--" + FlagUser, p.Username,
+		"--" + FlagLogLevel, log.GetLevel().String(),
+	}, oneShotArgs(settings)...)
+
+	ctx, cancel := context.WithTimeout(ctx, elevationTimeout)
+	defer cancel()
+
+	// These changes hand out shells on this host, so both ends are logged: when the
+	// prompt went up, and what came of it. It is also the only account of a prompt
+	// that was slow to appear or never answered.
+	log.Infof("asking for privileges to apply %s", guardedSummary(p))
+
+	if err := s.elevator.Run(ctx, args...); err != nil {
+		return s.elevationOutcome(err, p)
+	}
+
+	log.Infof("applied %s with the privileges the user authorized", guardedSummary(p))
+	return SaveOutcome{}, nil
+}
+
+// elevationOutcome sorts what came back into the one normal ending and the two
+// that need reporting, with the command that does the same thing by hand.
+func (s *Settings) elevationOutcome(err error, p GuardedSettings) (SaveOutcome, error) {
+	switch {
+	case errors.Is(err, elevate.ErrDeclined):
+		// With the reason: an account that may not elevate at all lands here too,
+		// and the log is the only place that says which it was.
+		log.Infof("the elevation prompt for %s was declined: %v", guardedSummary(p), err)
+		return SaveOutcome{Declined: true}, nil
+	case errors.Is(err, elevate.ErrUnavailable):
+		log.Warnf("cannot ask for privileges to apply %s: %v", guardedSummary(p), err)
+		return SaveOutcome{}, &ClientError{
+			Code:    CodeElevationUnavailable,
+			Short:   s.classifier.translateShort(CodeElevationUnavailable),
+			Long:    err.Error(),
+			Command: guardedCommand(p),
+		}
+	default:
+		log.Errorf("applying %s with elevated privileges failed: %v", guardedSummary(p), err)
+		return SaveOutcome{}, &ClientError{
+			Code:    CodeElevationFailed,
+			Short:   s.classifier.translateShort(CodeElevationFailed),
+			Long:    err.Error(),
+			Command: guardedCommand(p),
+		}
+	}
+}
+
+// guardedSettings renders the settings that are actually being changed, from the
+// same table the one-shot parses them with: see oneshot.go.
+func guardedSettings(p GuardedSettings) []guardedSetting {
+	var settings []guardedSetting
+	for _, field := range guardedFields {
+		value, ok := field.read(p)
+		if !ok {
+			continue
+		}
+		settings = append(settings, guardedSetting{
+			arg:  "--" + field.flag + "=" + value,
+			flag: field.up(value),
+		})
+	}
+	return settings
+}
+
+func oneShotArgs(settings []guardedSetting) []string {
+	args := make([]string, 0, len(settings))
+	for _, setting := range settings {
+		args = append(args, setting.arg)
+	}
+	return args
+}
+
+func upFlags(settings []guardedSetting) []string {
+	flags := make([]string, 0, len(settings))
+	for _, setting := range settings {
+		flags = append(flags, setting.flag)
+	}
+	return flags
+}
+
+// guardedCommand is the elevated command line equivalent to the requested
+// change, the same shape the daemon names in its own refusals.
+func guardedCommand(p GuardedSettings) string {
+	settings := guardedSettings(p)
+	if len(settings) == 0 {
+		return ""
+	}
+	return ipcauth.UpCommand(strings.Join(upFlags(settings), " "))
+}
+
+// guardedSummary names the change for the log.
+func guardedSummary(p GuardedSettings) string {
+	return fmt.Sprintf("%v for profile %q", oneShotArgs(guardedSettings(p)), p.ProfileName)
+}
diff --git a/client/ui/services/guarded_test.go b/client/ui/services/guarded_test.go
new file mode 100644
index 000000000..42c00ce4f
--- /dev/null
+++ b/client/ui/services/guarded_test.go
@@ -0,0 +1,355 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/elevate"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// A Unix socket, so the daemon address is one that carries a caller's identity and
+// elevation is worth offering at all: see Settings.canElevate.
+const testDaemonAddr = "unix:///var/run/netbird.sock"
+
+// storedManagementURL is what the stub daemon already holds, so that a request
+// naming a different one is a change: see Settings.guardedChanges.
+const storedManagementURL = "https://stored.example.com"
+
+// stubElevator stands in for the platform's prompt: it records what would have run
+// and answers with a fixed outcome.
+type stubElevator struct {
+	outcome   error
+	available bool
+	calls     [][]string
+}
+
+func (e *stubElevator) Run(_ context.Context, args ...string) error {
+	e.calls = append(e.calls, args)
+	return e.outcome
+}
+
+func (e *stubElevator) Available() bool { return e.available }
+
+// stubDaemon implements only the RPCs under test. The embedded interface is nil, so
+// any other call panics rather than passing quietly.
+type stubDaemon struct {
+	proto.DaemonServiceClient
+	setConfig func(*proto.SetConfigRequest) error
+	// stored is what GetConfig reports, which is what a refused request's guarded
+	// settings are compared against.
+	stored   *proto.GetConfigResponse
+	requests []*proto.SetConfigRequest
+}
+
+func (d *stubDaemon) SetConfig(_ context.Context, in *proto.SetConfigRequest, _ ...grpc.CallOption) (*proto.SetConfigResponse, error) {
+	d.requests = append(d.requests, in)
+	if err := d.setConfig(in); err != nil {
+		return nil, err
+	}
+	return &proto.SetConfigResponse{}, nil
+}
+
+func (d *stubDaemon) GetConfig(_ context.Context, _ *proto.GetConfigRequest, _ ...grpc.CallOption) (*proto.GetConfigResponse, error) {
+	return d.stored, nil
+}
+
+type stubConn struct{ client proto.DaemonServiceClient }
+
+func (c stubConn) Client() (proto.DaemonServiceClient, error) { return c.client, nil }
+
+// privilegeRefusal is the error the daemon raises for a change it restricts to
+// root, detail and all: see server.privilegeError.
+func privilegeRefusal(t *testing.T) error {
+	t.Helper()
+
+	st, err := gstatus.New(codes.PermissionDenied, "Changing the management URL requires root.").
+		WithDetails(&errdetails.ErrorInfo{
+			Reason: ipcauth.ErrorReasonPrivilegeRequired,
+			Domain: ipcauth.ErrorDomain,
+			Metadata: map[string]string{
+				ipcauth.ErrorMetaSummary: "Changing the management URL requires root.",
+				ipcauth.ErrorMetaCommand: "sudo netbird down; sudo netbird up -m https://mgmt.example.com",
+			},
+		})
+	require.NoError(t, err, "build the refusal detail")
+	return st.Err()
+}
+
+func settingsWithElevation(t *testing.T, outcome error) (*Settings, *stubElevator) {
+	t.Helper()
+
+	elev := &stubElevator{outcome: outcome, available: true}
+	return &Settings{daemonAddr: testDaemonAddr, elevator: elev}, elev
+}
+
+// settingsRefusingOnce returns a Settings whose daemon refuses the first SetConfig
+// for want of privileges and accepts anything after it. Its stored config holds
+// another management server and no SSH grants, so a request naming either is a
+// change rather than a restatement.
+func settingsRefusingOnce(t *testing.T, elev *stubElevator) (*Settings, *stubDaemon) {
+	t.Helper()
+
+	refusal := privilegeRefusal(t)
+	daemon := &stubDaemon{stored: &proto.GetConfigResponse{ManagementUrl: storedManagementURL}}
+	daemon.setConfig = func(*proto.SetConfigRequest) error {
+		if len(daemon.requests) == 1 {
+			return refusal
+		}
+		return nil
+	}
+	return &Settings{conn: stubConn{client: daemon}, daemonAddr: testDaemonAddr, elevator: elev}, daemon
+}
+
+func TestSetGuardedSettingsPassesOnlyTheChangedSettings(t *testing.T) {
+	s, elev := settingsWithElevation(t, nil)
+
+	root := true
+	outcome, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
+		ProfileName:   "work",
+		Username:      "vma",
+		EnableSSHRoot: &root,
+	})
+	require.NoError(t, err)
+	assert.False(t, outcome.Declined, "the prompt was answered")
+
+	want := []string{
+		"--" + FlagApplyPrivilegedSettings,
+		"--" + FlagDaemonAddr, testDaemonAddr,
+		"--" + FlagProfile, "work",
+		"--" + FlagUser, "vma",
+		"--" + FlagLogLevel, log.GetLevel().String(),
+		"--" + FlagEnableSSHRoot + "=true",
+	}
+	require.Len(t, elev.calls, 1, "one prompt for one change")
+	assert.Equal(t, want, elev.calls[0], "elevated arguments")
+
+	// argv[1] is what the polkit action is pinned to, so the marker has to stay
+	// first however the rest of the line grows.
+	assert.Equal(t, "--"+FlagApplyPrivilegedSettings, elev.calls[0][0], "the flag polkit matches on")
+}
+
+// Turning a setting off has to be as explicit as turning it on: a bare flag would
+// read as "on" to the one-shot's parser.
+func TestSetGuardedSettingsSpellsOutFalse(t *testing.T) {
+	s, elev := settingsWithElevation(t, nil)
+
+	off := false
+	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
+		ProfileName:      "default",
+		ServerSSHAllowed: &off,
+		DisableSSHAuth:   &off,
+	})
+	require.NoError(t, err)
+
+	args := elev.calls[0]
+	assert.Contains(t, args, "--"+FlagAllowServerSSH+"=false", "the setting being switched off")
+	assert.Contains(t, args, "--"+FlagDisableSSHAuth+"=false", "the setting being switched off")
+	assert.NotContains(t, args, "--"+FlagEnableSSHRoot+"=false", "no flag for a setting nobody touched")
+}
+
+func TestSetGuardedSettingsPassesTheManagementURL(t *testing.T) {
+	s, elev := settingsWithElevation(t, nil)
+
+	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
+		ProfileName:   "default",
+		ManagementURL: "https://mgmt.example.com:33073",
+	})
+	require.NoError(t, err)
+
+	assert.Contains(t, elev.calls[0], "--"+FlagManagementURL+"=https://mgmt.example.com:33073",
+		"the management URL to point the profile at")
+}
+
+func TestSetGuardedSettingsWithoutASettingDoesNotElevate(t *testing.T) {
+	s, elev := settingsWithElevation(t, nil)
+
+	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{ProfileName: "default"})
+
+	require.Error(t, err, "nothing to apply is not something to prompt for")
+	assert.Empty(t, elev.calls, "no prompt at all")
+}
+
+// A declined prompt is the one ending that is not an error: reporting it as one
+// would have every cancelled prompt logged as a failure.
+func TestSetGuardedSettingsReportsADeclinedPromptAsAnOutcome(t *testing.T) {
+	s, _ := settingsWithElevation(t, elevate.ErrDeclined)
+
+	root := true
+	outcome, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
+		ProfileName:   "default",
+		EnableSSHRoot: &root,
+	})
+
+	require.NoError(t, err, "the user was asked and answered; nothing went wrong")
+	assert.True(t, outcome.Declined, "nothing was applied")
+}
+
+func TestSetGuardedSettingsMapsFailures(t *testing.T) {
+	tests := []struct {
+		name     string
+		outcome  error
+		wantCode string
+	}{
+		{
+			// Nothing to raise a prompt with: the user needs the command.
+			name:     "no mechanism falls back to the command",
+			outcome:  elevate.ErrUnavailable,
+			wantCode: CodeElevationUnavailable,
+		},
+		{
+			name:     "a failed run falls back to the command",
+			outcome:  errors.New("elevated netbird exited with 1"),
+			wantCode: CodeElevationFailed,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s, _ := settingsWithElevation(t, tt.outcome)
+
+			root := true
+			_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
+				ProfileName:   "default",
+				EnableSSHRoot: &root,
+			})
+
+			var clientErr *ClientError
+			require.ErrorAs(t, err, &clientErr, "the frontend needs a code to act on")
+			assert.Equal(t, tt.wantCode, clientErr.Code, "error code")
+			assert.Contains(t, clientErr.Command, "--"+FlagEnableSSHRoot+"=true",
+				"the setting in the fallback command")
+			assert.Contains(t, clientErr.Command, "netbird up", "the fallback command")
+		})
+	}
+}
+
+// Changing the management URL is only privileged while the host runs the SSH
+// server, which no control can know up front, so the refusal is what triggers the
+// prompt. The original request goes again afterwards, so the fields the one-shot
+// does not understand are applied too.
+func TestSetConfigElevatesAfterARefusalAndRetries(t *testing.T) {
+	elev := &stubElevator{available: true}
+	s, daemon := settingsRefusingOnce(t, elev)
+
+	mtu := int64(1280)
+	outcome, err := s.SetConfig(context.Background(), SetConfigParams{
+		ProfileName:   "default",
+		ManagementURL: "https://mgmt.example.com",
+		MTU:           &mtu,
+	})
+	require.NoError(t, err)
+	assert.False(t, outcome.Declined, "the prompt was answered")
+
+	require.Len(t, elev.calls, 1, "one prompt")
+	assert.Contains(t, elev.calls[0], "--"+FlagManagementURL+"=https://mgmt.example.com",
+		"the guarded part of the request")
+	require.Len(t, daemon.requests, 2, "the refused request and the retry")
+	assert.Equal(t, mtu, daemon.requests[1].GetMtu(),
+		"the retry carries the rest of the request, which the one-shot does not understand")
+}
+
+func TestSetConfigDoesNotRetryWhenTheUserDeclines(t *testing.T) {
+	elev := &stubElevator{outcome: elevate.ErrDeclined, available: true}
+	s, daemon := settingsRefusingOnce(t, elev)
+
+	outcome, err := s.SetConfig(context.Background(), SetConfigParams{
+		ProfileName:   "default",
+		ManagementURL: "https://mgmt.example.com",
+	})
+
+	require.NoError(t, err, "a declined prompt is not an error")
+	assert.True(t, outcome.Declined, "nothing was applied")
+	assert.Len(t, daemon.requests, 1, "only the refused request")
+}
+
+// With no prompt to raise, the refusal is reported as the daemon wrote it, which is
+// the guidance that was there before elevation existed.
+func TestSetConfigReportsTheRefusalWhenItCannotElevate(t *testing.T) {
+	elev := &stubElevator{available: false}
+	s, _ := settingsRefusingOnce(t, elev)
+
+	_, err := s.SetConfig(context.Background(), SetConfigParams{
+		ProfileName:   "default",
+		ManagementURL: "https://mgmt.example.com",
+	})
+
+	var clientErr *ClientError
+	require.ErrorAs(t, err, &clientErr)
+	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
+	assert.Contains(t, clientErr.Command, "netbird up -m https://mgmt.example.com",
+		"the daemon's own command")
+	assert.Empty(t, elev.calls, "no prompt where there is none to raise")
+}
+
+// One authorization must buy only the change the user made. A settings form
+// submits every field it holds, so most of a refused request restates what the
+// daemon already has, and elevating those too would apply a guarded setting the
+// user never touched — a value gone stale since the form loaded above all.
+func TestSetConfigElevatesOnlyTheGuardedSettingsThatChange(t *testing.T) {
+	elev := &stubElevator{available: true}
+	s, _ := settingsRefusingOnce(t, elev)
+
+	on, off := true, false
+	_, err := s.SetConfig(context.Background(), SetConfigParams{
+		ProfileName:      "default",
+		ManagementURL:    storedManagementURL,
+		ServerSSHAllowed: &off,
+		EnableSSHRoot:    &off,
+		DisableSSHAuth:   &on,
+	})
+	require.NoError(t, err)
+
+	require.Len(t, elev.calls, 1, "one prompt")
+	args := elev.calls[0]
+	assert.Contains(t, args, "--"+FlagDisableSSHAuth+"=true", "the setting that changes")
+	assert.NotContains(t, args, "--"+FlagManagementURL+"="+storedManagementURL,
+		"a management URL the daemon already holds")
+	assert.NotContains(t, args, "--"+FlagAllowServerSSH+"=false", "a setting already off")
+	assert.NotContains(t, args, "--"+FlagEnableSSHRoot+"=false", "a setting already off")
+}
+
+// A request that changes no guarded setting has nothing an elevated run could
+// apply, so the refusal must have come from somewhere a prompt cannot reach.
+func TestSetConfigDoesNotElevateWhenNoGuardedSettingChanges(t *testing.T) {
+	elev := &stubElevator{available: true}
+	s, _ := settingsRefusingOnce(t, elev)
+
+	off := false
+	_, err := s.SetConfig(context.Background(), SetConfigParams{
+		ProfileName:      "default",
+		ManagementURL:    storedManagementURL,
+		ServerSSHAllowed: &off,
+	})
+
+	var clientErr *ClientError
+	require.ErrorAs(t, err, &clientErr)
+	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
+	assert.Empty(t, elev.calls, "no prompt for a change nobody made")
+}
+
+// A refusal with nothing in the request the one-shot could apply: the daemon
+// cannot see who is calling, and being root would not help either.
+func TestSetConfigReportsARefusalWithNothingToElevate(t *testing.T) {
+	elev := &stubElevator{available: true}
+	s, _ := settingsRefusingOnce(t, elev)
+
+	_, err := s.SetConfig(context.Background(), SetConfigParams{ProfileName: "default"})
+
+	var clientErr *ClientError
+	require.ErrorAs(t, err, &clientErr)
+	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
+	assert.Empty(t, elev.calls, "no prompt")
+}
diff --git a/client/ui/services/i18n.go b/client/ui/services/i18n.go
new file mode 100644
index 000000000..755bbe02d
--- /dev/null
+++ b/client/ui/services/i18n.go
@@ -0,0 +1,30 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+)
+
+// I18n is the Wails-bound facade over i18n.Bundle; the translation logic lives
+// in client/ui/i18n.
+type I18n struct {
+	bundle *i18n.Bundle
+}
+
+func NewI18n(bundle *i18n.Bundle) *I18n {
+	return &I18n{bundle: bundle}
+}
+
+// Languages returns the shipped locales.
+func (s *I18n) Languages(_ context.Context) ([]i18n.Language, error) {
+	return s.bundle.Languages(), nil
+}
+
+// Bundle returns the full key->text map so the React side can drive its own
+// translation library off the same source bundles.
+func (s *I18n) Bundle(_ context.Context, code i18n.LanguageCode) (map[string]string, error) {
+	return s.bundle.BundleFor(code)
+}
diff --git a/client/ui/services/network.go b/client/ui/services/network.go
new file mode 100644
index 000000000..c2d127494
--- /dev/null
+++ b/client/ui/services/network.go
@@ -0,0 +1,88 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+type Network struct {
+	ID          string              `json:"id"`
+	Range       string              `json:"range"`
+	Selected    bool                `json:"selected"`
+	Domains     []string            `json:"domains"`
+	ResolvedIPs map[string][]string `json:"resolvedIps"`
+}
+
+// SelectNetworksParams: All targets every available network; Append merges IDs into the existing selection.
+type SelectNetworksParams struct {
+	NetworkIDs []string `json:"networkIds"`
+	Append     bool     `json:"append"`
+	All        bool     `json:"all"`
+}
+
+type Networks struct {
+	conn DaemonConn
+}
+
+func NewNetworks(conn DaemonConn) *Networks {
+	return &Networks{conn: conn}
+}
+
+func (s *Networks) List(ctx context.Context) ([]Network, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return nil, err
+	}
+	resp, err := cli.ListNetworks(ctx, &proto.ListNetworksRequest{})
+	if err != nil {
+		return nil, err
+	}
+	out := make([]Network, 0, len(resp.GetRoutes()))
+	for _, n := range resp.GetRoutes() {
+		out = append(out, networkFromProto(n))
+	}
+	return out, nil
+}
+
+func (s *Networks) Select(ctx context.Context, p SelectNetworksParams) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.SelectNetworks(ctx, &proto.SelectNetworksRequest{
+		NetworkIDs: p.NetworkIDs,
+		Append:     p.Append,
+		All:        p.All,
+	})
+	return err
+}
+
+func (s *Networks) Deselect(ctx context.Context, p SelectNetworksParams) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.DeselectNetworks(ctx, &proto.SelectNetworksRequest{
+		NetworkIDs: p.NetworkIDs,
+		Append:     p.Append,
+		All:        p.All,
+	})
+	return err
+}
+
+func networkFromProto(n *proto.Network) Network {
+	resolved := make(map[string][]string, len(n.GetResolvedIPs()))
+	for k, v := range n.GetResolvedIPs() {
+		resolved[k] = append([]string{}, v.GetIps()...)
+	}
+	return Network{
+		ID:          n.GetID(),
+		Range:       n.GetRange(),
+		Selected:    n.GetSelected(),
+		Domains:     append([]string{}, n.GetDomains()...),
+		ResolvedIPs: resolved,
+	}
+}
diff --git a/client/ui/services/oneshot.go b/client/ui/services/oneshot.go
new file mode 100644
index 000000000..d20b390cd
--- /dev/null
+++ b/client/ui/services/oneshot.go
@@ -0,0 +1,239 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"strconv"
+	"time"
+
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/elevate"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
+)
+
+// The other end of SetGuardedSettings: the mode this binary runs itself in,
+// elevated, to apply the settings the daemon restricts to root/administrator.
+//
+// Both ends are here on purpose. What may be changed this way is an allowlist, and
+// an allowlist declared twice is one that will eventually disagree with itself, so
+// the arguments are rendered and parsed from a single table: guardedFields. Adding
+// a setting is one row; nothing generic passes through, and no field outside the
+// table can be reached with an elevated request no matter what lands on the command
+// line.
+
+// oneShotTimeout bounds the whole one-shot: connect, one RPC, exit. Generous
+// because the user has just waited for an authentication dialog, and a failure here
+// costs them the entire round trip.
+const oneShotTimeout = 30 * time.Second
+
+// Exit codes the parent reads where the platform gives it one.
+const (
+	exitOK      = 0
+	exitFailure = 1
+	exitUsage   = 2
+)
+
+// guardedField is one setting the one-shot understands, in the two spellings it
+// needs and with the two halves of its plumbing.
+type guardedField struct {
+	// flag names it on the one-shot's command line.
+	flag  string
+	usage string
+	// read returns the value to send and whether the caller asked for this setting
+	// at all.
+	read func(GuardedSettings) (string, bool)
+	// write parses a value from the command line onto the request. It is the only
+	// thing that validates the value, so it fails on anything it does not
+	// recognise rather than guessing.
+	write func(*proto.SetConfigRequest, string) error
+	// up renders the equivalent `netbird up` flag, for the fallback command shown
+	// when there is no prompt to raise.
+	up func(value string) string
+}
+
+var guardedFields = []guardedField{
+	{
+		flag:  FlagManagementURL,
+		usage: "Management server the profile registers with.",
+		read:  func(p GuardedSettings) (string, bool) { return p.ManagementURL, p.ManagementURL != "" },
+		write: func(req *proto.SetConfigRequest, value string) error {
+			// Parsed with the config layer's own parser, so what the elevated run
+			// accepts cannot drift from what the daemon would store.
+			if _, err := profilemanager.ParseServiceURL("Management URL", value); err != nil {
+				return err
+			}
+			req.ManagementUrl = value
+			return nil
+		},
+		// The daemon names this one as `-m <url>` in its own refusals.
+		up: func(value string) string { return "-m " + value },
+	},
+	boolField(FlagAllowServerSSH, "Run the NetBird SSH server.",
+		func(p GuardedSettings) *bool { return p.ServerSSHAllowed },
+		func(req *proto.SetConfigRequest, v *bool) { req.ServerSSHAllowed = v }),
+	boolField(FlagEnableSSHRoot, "Allow SSH sessions to privileged accounts.",
+		func(p GuardedSettings) *bool { return p.EnableSSHRoot },
+		func(req *proto.SetConfigRequest, v *bool) { req.EnableSSHRoot = v }),
+	boolField(FlagDisableSSHAuth, "Accept SSH sessions without authentication.",
+		func(p GuardedSettings) *bool { return p.DisableSSHAuth },
+		func(req *proto.SetConfigRequest, v *bool) { req.DisableSSHAuth = v }),
+}
+
+// fieldValue is a flag that remembers whether it was given, and requires a value:
+// the renderer always writes one, so a bare flag is a caller that got it wrong.
+type fieldValue struct {
+	set   bool
+	value string
+}
+
+func (v *fieldValue) String() string {
+	if v == nil {
+		return ""
+	}
+	return v.value
+}
+
+func (v *fieldValue) Set(value string) error {
+	v.set, v.value = true, value
+	return nil
+}
+
+// boolField describes a setting that is on or off. The value is always spelled out,
+// so that turning a setting off is as unambiguous as turning it on and a flag with
+// no value is a mistake rather than an "on".
+func boolField(
+	name, usage string,
+	read func(GuardedSettings) *bool,
+	write func(*proto.SetConfigRequest, *bool),
+) guardedField {
+	return guardedField{
+		flag:  name,
+		usage: usage,
+		read: func(p GuardedSettings) (string, bool) {
+			value := read(p)
+			if value == nil {
+				return "", false
+			}
+			return strconv.FormatBool(*value), true
+		},
+		write: func(req *proto.SetConfigRequest, value string) error {
+			parsed, err := strconv.ParseBool(value)
+			if err != nil {
+				return fmt.Errorf("parse %q as a boolean: %w", value, err)
+			}
+			write(req, &parsed)
+			return nil
+		},
+		up: func(value string) string { return "--" + name + "=" + value },
+	}
+}
+
+// IsPrivilegedSettingsRun reports whether this process was started as the one-shot.
+// The flag is a marker rather than a value, so only the bare forms count: reading a
+// value would mean "--flag=false" started it too.
+func IsPrivilegedSettingsRun(args []string) bool {
+	for _, arg := range args {
+		if arg == "--"+FlagApplyPrivilegedSettings || arg == "-"+FlagApplyPrivilegedSettings {
+			return true
+		}
+	}
+	return false
+}
+
+// RunPrivilegedSettings applies the requested settings and returns the process exit
+// code. connect dials the daemon, which is the caller's business because only it
+// knows how this build talks to it.
+//
+// Everything it reports goes to stderr, which is what the parent captures where the
+// platform lets it. On success it says so on standard output, because macOS gives
+// the parent no exit status to read: see elevate.AppliedMarker.
+func RunPrivilegedSettings(args []string, connect func(addr string) (proto.DaemonServiceClient, error)) int {
+	fs := flag.NewFlagSet("netbird-ui --"+FlagApplyPrivilegedSettings, flag.ContinueOnError)
+	fs.Bool(FlagApplyPrivilegedSettings, false, "Apply the settings the daemon restricts to root/administrator and exit.")
+	daemonAddr := fs.String(FlagDaemonAddr, "", "Daemon gRPC address: unix:///path, npipe://name or tcp://host:port")
+	logLevel := fs.String(FlagLogLevel, "info", "Log level: trace|debug|info|warn|error.")
+	profile := fs.String(FlagProfile, "", "Profile to change.")
+	username := fs.String(FlagUser, "", "Owner of the profile.")
+
+	values := make([]fieldValue, len(guardedFields))
+	for i, field := range guardedFields {
+		fs.Var(&values[i], field.flag, field.usage)
+	}
+
+	if err := fs.Parse(args); err != nil {
+		return exitUsage
+	}
+
+	if err := util.InitLog(*logLevel, "console"); err != nil {
+		fmt.Fprintf(os.Stderr, "init log: %v\n", err)
+		return exitFailure
+	}
+
+	req, err := privilegedRequest(*profile, *username, values)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "%v\n", err)
+		return exitUsage
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), oneShotTimeout)
+	defer cancel()
+
+	if err := applyPrivilegedSettings(ctx, *daemonAddr, req, connect); err != nil {
+		fmt.Fprintf(os.Stderr, "apply settings: %v\n", err)
+		return exitFailure
+	}
+
+	fmt.Fprintln(os.Stdout, elevate.AppliedMarker)
+	return exitOK
+}
+
+// privilegedRequest builds the request from the flags that were given, and refuses
+// one that asks for nothing.
+func privilegedRequest(profile, username string, values []fieldValue) (*proto.SetConfigRequest, error) {
+	req := &proto.SetConfigRequest{ProfileName: profile, Username: username}
+
+	given := 0
+	for i, field := range guardedFields {
+		if !values[i].set {
+			continue
+		}
+		if err := field.write(req, values[i].value); err != nil {
+			return nil, fmt.Errorf("--%s: %w", field.flag, err)
+		}
+		given++
+	}
+	if given == 0 {
+		return nil, errors.New("no setting to apply")
+	}
+	return req, nil
+}
+
+func applyPrivilegedSettings(
+	ctx context.Context,
+	daemonAddr string,
+	req *proto.SetConfigRequest,
+	connect func(addr string) (proto.DaemonServiceClient, error),
+) error {
+	client, err := connect(daemonAddr)
+	if err != nil {
+		return err
+	}
+	if _, err := client.SetConfig(ctx, req); err != nil {
+		// Unwrapped: the daemon's message is written for a person, and a refusal
+		// elevation cannot fix has to say so where the parent can read it off
+		// stderr.
+		return errors.New(gstatus.Convert(err).Message())
+	}
+	return nil
+}
+
+// interface guard: the one-shot's flags are flag.Value.
+var _ flag.Value = (*fieldValue)(nil)
diff --git a/client/ui/services/oneshot_test.go b/client/ui/services/oneshot_test.go
new file mode 100644
index 000000000..f8eb43066
--- /dev/null
+++ b/client/ui/services/oneshot_test.go
@@ -0,0 +1,151 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"flag"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+func TestIsPrivilegedSettingsRun(t *testing.T) {
+	tests := []struct {
+		name string
+		args []string
+		want bool
+	}{
+		{name: "no arguments"},
+		{name: "double dash", args: []string{"--" + FlagApplyPrivilegedSettings}, want: true},
+		{name: "single dash", args: []string{"-" + FlagApplyPrivilegedSettings}, want: true},
+		{
+			name: "among other flags",
+			args: []string{"--daemon-addr", "unix:///tmp/x.sock", "--" + FlagApplyPrivilegedSettings},
+			want: true,
+		},
+		// A marker, not a value: the caller never passes one, and reading a value
+		// would mean "--flag=false" started the one-shot too.
+		{name: "with a value", args: []string{"--" + FlagApplyPrivilegedSettings + "=true"}},
+		{name: "unrelated flags", args: []string{"--log-level", "debug"}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, IsPrivilegedSettingsRun(tt.args), "args %v", tt.args)
+		})
+	}
+}
+
+// What SetGuardedSettings renders has to be what the one-shot reads back, for every
+// setting in the table. This is the property that keeps the two ends of an allowlist
+// from drifting, so it is checked field by field rather than by example.
+func TestGuardedFieldsRoundTrip(t *testing.T) {
+	on, off := true, false
+	tests := []struct {
+		name     string
+		settings GuardedSettings
+		want     func(*testing.T, *proto.SetConfigRequest)
+	}{
+		{
+			name:     "management url",
+			settings: GuardedSettings{ManagementURL: "https://mgmt.example.com:33073"},
+			want: func(t *testing.T, req *proto.SetConfigRequest) {
+				assert.Equal(t, "https://mgmt.example.com:33073", req.GetManagementUrl())
+			},
+		},
+		{
+			name:     "ssh server on",
+			settings: GuardedSettings{ServerSSHAllowed: &on},
+			want: func(t *testing.T, req *proto.SetConfigRequest) {
+				require.NotNil(t, req.ServerSSHAllowed)
+				assert.True(t, *req.ServerSSHAllowed)
+			},
+		},
+		{
+			name:     "ssh root off",
+			settings: GuardedSettings{EnableSSHRoot: &off},
+			want: func(t *testing.T, req *proto.SetConfigRequest) {
+				require.NotNil(t, req.EnableSSHRoot, "an explicit false must survive, not read as absent")
+				assert.False(t, *req.EnableSSHRoot)
+			},
+		},
+		{
+			name:     "ssh auth off",
+			settings: GuardedSettings{DisableSSHAuth: &on},
+			want: func(t *testing.T, req *proto.SetConfigRequest) {
+				require.NotNil(t, req.DisableSSHAuth)
+				assert.True(t, *req.DisableSSHAuth)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := parseRendered(t, tt.settings)
+			tt.want(t, req)
+		})
+	}
+}
+
+// A setting nobody asked about must not arrive at the daemon at all: sending its
+// zero value would change it.
+func TestGuardedFieldsCarryOnlyWhatWasAsked(t *testing.T) {
+	on := true
+	req := parseRendered(t, GuardedSettings{ProfileName: "work", EnableSSHRoot: &on})
+
+	assert.Equal(t, "work", req.GetProfileName(), "profile")
+	require.NotNil(t, req.EnableSSHRoot)
+	assert.Nil(t, req.ServerSSHAllowed, "untouched setting")
+	assert.Nil(t, req.DisableSSHAuth, "untouched setting")
+	assert.Empty(t, req.GetManagementUrl(), "untouched setting")
+}
+
+func TestPrivilegedRequestRejectsAnEmptyChange(t *testing.T) {
+	_, err := privilegedRequest("default", "vma", make([]fieldValue, len(guardedFields)))
+	require.Error(t, err, "nothing to apply is not a request worth sending as root")
+}
+
+// A value the table cannot parse is refused rather than guessed at.
+func TestPrivilegedRequestRejectsAnUnparseableValue(t *testing.T) {
+	values := make([]fieldValue, len(guardedFields))
+	for i, field := range guardedFields {
+		if field.flag != FlagEnableSSHRoot {
+			continue
+		}
+		require.NoError(t, values[i].Set("perhaps"))
+	}
+
+	_, err := privilegedRequest("default", "vma", values)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), FlagEnableSSHRoot, "which flag was wrong")
+}
+
+// parseRendered puts the settings through both ends: rendered as the arguments the
+// elevated process is given, then parsed by a flag set registered from the same
+// table, which is what the one-shot itself parses them with. Anything hand-rolled
+// here would pin down a parser nothing uses.
+func parseRendered(t *testing.T, p GuardedSettings) *proto.SetConfigRequest {
+	t.Helper()
+
+	rendered := guardedSettings(p)
+	require.NotEmpty(t, rendered, "nothing rendered for %+v", p)
+
+	args := make([]string, 0, len(rendered))
+	for _, setting := range rendered {
+		args = append(args, setting.arg)
+	}
+
+	fs := flag.NewFlagSet(t.Name(), flag.ContinueOnError)
+	values := make([]fieldValue, len(guardedFields))
+	for i, field := range guardedFields {
+		fs.Var(&values[i], field.flag, field.usage)
+	}
+	require.NoError(t, fs.Parse(args), "the one-shot's own flag set must accept %v", args)
+
+	req, err := privilegedRequest(p.ProfileName, p.Username, values)
+	require.NoError(t, err)
+	return req
+}
diff --git a/client/ui/services/preferences.go b/client/ui/services/preferences.go
new file mode 100644
index 000000000..592d52e7b
--- /dev/null
+++ b/client/ui/services/preferences.go
@@ -0,0 +1,44 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// Preferences is the Wails-bound facade over preferences.Store; the context.Context-first
+// signatures are what the binding generator requires.
+type Preferences struct {
+	store *preferences.Store
+}
+
+func NewPreferences(store *preferences.Store) *Preferences {
+	return &Preferences{store: store}
+}
+
+func (s *Preferences) Get(_ context.Context) (preferences.UIPreferences, error) {
+	return s.store.Get(), nil
+}
+
+func (s *Preferences) SetLanguage(_ context.Context, lang i18n.LanguageCode) error {
+	return s.store.SetLanguage(lang)
+}
+
+func (s *Preferences) SetViewMode(_ context.Context, mode preferences.ViewMode) error {
+	return s.store.SetViewMode(mode)
+}
+
+func (s *Preferences) SetTheme(_ context.Context, theme preferences.Theme) error {
+	return s.store.SetTheme(theme)
+}
+
+func (s *Preferences) SetOnboardingCompleted(_ context.Context, done bool) error {
+	return s.store.SetOnboardingCompleted(done)
+}
+
+func (s *Preferences) SetKeepConnectedOnQuit(_ context.Context, keep bool) error {
+	return s.store.SetKeepConnectedOnQuit(keep)
+}
diff --git a/client/ui/services/profile.go b/client/ui/services/profile.go
new file mode 100644
index 000000000..e76ab3db6
--- /dev/null
+++ b/client/ui/services/profile.go
@@ -0,0 +1,202 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"os/user"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+type Profile struct {
+	// ID is the daemon-generated on-disk identity of the profile. Display
+	// names can collide and be renamed, so the ID is the stable handle the
+	// daemon resolves switch/remove/logout requests against.
+	ID       string `json:"id"`
+	Name     string `json:"name"`
+	IsActive bool   `json:"isActive"`
+	// Email is read from the user-owned per-profile state file (CLI writes it
+	// after SSO login), not via ListProfiles: the daemon runs as root and can't
+	// reach it, while the UI runs as the logged-in user.
+	Email string `json:"email"`
+}
+
+type ProfileRef struct {
+	ProfileName string `json:"profileName"`
+	Username    string `json:"username"`
+}
+
+type ActiveProfile struct {
+	// ID is the active profile's stable on-disk identity. Use it (not the
+	// display name) as the handle for daemon requests and active-profile
+	// comparisons, since names can collide.
+	ID          string `json:"id"`
+	ProfileName string `json:"profileName"`
+	Username    string `json:"username"`
+}
+
+// RenameProfileParams selects a profile by handle and carries its new display
+// name.
+type RenameProfileParams struct {
+	// Handle selects the profile to rename: an exact ID, a unique ID prefix,
+	// or a unique display name. The daemon resolves it server-side.
+	Handle string `json:"handle"`
+	// NewName is the new free-form display name. The daemon sanitizes it
+	// (strips control characters, trims, caps length) but keeps spaces, emoji,
+	// punctuation, and non-ASCII letters.
+	NewName string `json:"newName"`
+
+	Username string `json:"username"`
+}
+
+type Profiles struct {
+	conn DaemonConn
+}
+
+func NewProfiles(conn DaemonConn) *Profiles {
+	return &Profiles{conn: conn}
+}
+
+// Username returns the OS username the daemon expects for profile lookups.
+func (s *Profiles) Username() (string, error) {
+	u, err := user.Current()
+	if err != nil {
+		return "", err
+	}
+	return u.Username, nil
+}
+
+func (s *Profiles) List(ctx context.Context, username string) ([]Profile, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return nil, err
+	}
+	resp, err := cli.ListProfiles(ctx, &proto.ListProfilesRequest{Username: username})
+	if err != nil {
+		return nil, err
+	}
+	pm := profilemanager.NewProfileManager()
+	out := make([]Profile, 0, len(resp.GetProfiles()))
+	for _, p := range resp.GetProfiles() {
+		prof := Profile{ID: p.GetId(), Name: p.GetName(), IsActive: p.GetIsActive()}
+		if state, err := pm.GetProfileState(profilemanager.ID(p.GetId())); err == nil {
+			prof.Email = state.Email
+		}
+		out = append(out, prof)
+	}
+	return out, nil
+}
+
+func (s *Profiles) GetActive(ctx context.Context) (ActiveProfile, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return ActiveProfile{}, err
+	}
+	resp, err := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{})
+	if err != nil {
+		return ActiveProfile{}, err
+	}
+	return ActiveProfile{
+		ID:          resp.GetId(),
+		ProfileName: resp.GetProfileName(),
+		Username:    resp.GetUsername(),
+	}, nil
+}
+
+// Switch sends a profile switch to the daemon and returns the resolved
+// on-disk ID of the now-active profile. ProfileName is treated as a handle
+// (exact ID, unique ID prefix, or unique display name); the daemon resolves
+// it server-side and echoes back the canonical ID.
+func (s *Profiles) Switch(ctx context.Context, p ProfileRef) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	req := &proto.SwitchProfileRequest{}
+	if p.ProfileName != "" {
+		req.ProfileName = ptrStr(p.ProfileName)
+	}
+	if p.Username != "" {
+		req.Username = ptrStr(p.Username)
+	}
+	resp, err := cli.SwitchProfile(ctx, req)
+	if err != nil {
+		return "", err
+	}
+	return resp.GetId(), nil
+}
+
+// Add creates a profile with the given display name and returns its
+// daemon-generated on-disk ID, so callers can address the new profile by ID
+// (e.g. to write config or switch to it) without re-resolving the name.
+func (s *Profiles) Add(ctx context.Context, p ProfileRef) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	resp, err := cli.AddProfile(ctx, &proto.AddProfileRequest{
+		ProfileName: p.ProfileName,
+		Username:    p.Username,
+	})
+	if err != nil {
+		return "", err
+	}
+	return resp.GetId(), nil
+}
+
+func (s *Profiles) Remove(ctx context.Context, p ProfileRef) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	resp, err := cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
+		ProfileName: p.ProfileName,
+		Username:    p.Username,
+	})
+	if err != nil {
+		return err
+	}
+
+	// The daemon deletes what it owns but runs as root, so it leaves the
+	// user-owned state file holding the account email behind. Logout keeps the
+	// email on purpose so later logins can pass it as the login_hint; profile
+	// removal is what deletes it. Legacy profiles are keyed by name rather than by a
+	// generated ID, so a recreated profile of the same name would inherit the
+	// deleted one's email and offer it as the login_hint.
+	//
+	// Keyed on the ID the daemon resolved, not on the request handle: that may
+	// have been a display name or an ID prefix, which would name a different
+	// file (or none).
+	if id := resp.GetId(); id != "" {
+		if err := profilemanager.NewProfileManager().RemoveProfileState(id); err != nil {
+			// Non-fatal: the profile itself is gone.
+			log.Warnf("failed to remove profile state for %s: %v", id, err)
+		}
+	}
+
+	return nil
+}
+
+// Rename changes a profile's display name. The on-disk ID is unaffected, so
+// the active profile and any ID-based references stay valid (the default
+// profile can be renamed too — only its display name changes). Returns the
+// profile's previous display name as confirmation.
+func (s *Profiles) Rename(ctx context.Context, p RenameProfileParams) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	resp, err := cli.RenameProfile(ctx, &proto.RenameProfileRequest{
+		Username:       p.Username,
+		Handle:         p.Handle,
+		NewProfileName: p.NewName,
+	})
+	if err != nil {
+		return "", err
+	}
+	return resp.GetOldProfileName(), nil
+}
diff --git a/client/ui/services/profileswitcher.go b/client/ui/services/profileswitcher.go
new file mode 100644
index 000000000..727b2473f
--- /dev/null
+++ b/client/ui/services/profileswitcher.go
@@ -0,0 +1,105 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// ProfileSwitcher holds the switch policy shared by the tray and React
+// frontend so both flip profiles identically. SwitchActive (plain selection:
+// header dropdown, tray submenu) always connects after the switch;
+// SwitchActiveNoConnect (manage-profiles screen) never does, so the user can
+// still adjust the management URL before connecting. prevStatus from
+// DaemonFeed.Get at entry only decides the teardown:
+//
+//	Connected/Connecting/NeedsLogin/LoginFailed/SessionExpired → Down first.
+//	Idle → no Down.
+type ProfileSwitcher struct {
+	profiles   *Profiles
+	connection *Connection
+	feed       *DaemonFeed
+}
+
+func NewProfileSwitcher(profiles *Profiles, connection *Connection, feed *DaemonFeed) *ProfileSwitcher {
+	return &ProfileSwitcher{profiles: profiles, connection: connection, feed: feed}
+}
+
+// SwitchActive switches to the named profile and always connects afterwards.
+func (s *ProfileSwitcher) SwitchActive(ctx context.Context, p ProfileRef) error {
+	return s.switchActive(ctx, p, true)
+}
+
+// SwitchActiveNoConnect switches to the named profile without connecting,
+// tearing down any existing connection first.
+func (s *ProfileSwitcher) SwitchActiveNoConnect(ctx context.Context, p ProfileRef) error {
+	return s.switchActive(ctx, p, false)
+}
+
+func (s *ProfileSwitcher) switchActive(ctx context.Context, p ProfileRef, connect bool) error {
+	prevStatus := ""
+	if s.feed != nil {
+		if st, err := s.feed.Get(ctx); err == nil {
+			prevStatus = st.Status
+		} else {
+			log.Warnf("profileswitcher: get status: %v", err)
+		}
+	}
+
+	needsDown := strings.EqualFold(prevStatus, StatusConnected) ||
+		strings.EqualFold(prevStatus, StatusConnecting) ||
+		strings.EqualFold(prevStatus, StatusNeedsLogin) ||
+		strings.EqualFold(prevStatus, StatusLoginFailed) ||
+		strings.EqualFold(prevStatus, StatusSessionExpired)
+
+	log.Infof("profileswitcher: switch profile=%q prevStatus=%q connect=%v needsDown=%v",
+		p.ProfileName, prevStatus, connect, needsDown)
+
+	// Optimistic Connecting paint plus stale-push suppression during Down (see
+	// DaemonFeed suppression table); also arms the login-watch that pops
+	// browser-login when the new profile turns out to need SSO.
+	if connect && s.feed != nil {
+		s.feed.BeginProfileSwitch()
+	}
+
+	resolvedID, err := s.profiles.Switch(ctx, p)
+	if err != nil {
+		return fmt.Errorf("switch profile %q: %w", p.ProfileName, err)
+	}
+
+	// Mirror into the user-side ProfileManager state: the CLI's `netbird up`
+	// reads this file and sends the ID back in the Up RPC, so if it diverges
+	// the daemon reverts the UI switch on the next CLI `up`. Best-effort — the
+	// daemon is authoritative; a failure only leaves the CLI's view stale.
+	// Use the daemon-resolved ID rather than the handle we sent, since the
+	// on-disk state is keyed by ID, not display name.
+	if err := profilemanager.NewProfileManager().SwitchProfile(profilemanager.ID(resolvedID)); err != nil {
+		log.Warnf("profileswitcher: mirror to user-side ProfileManager failed: %v", err)
+	}
+
+	if needsDown {
+		if err := s.connection.Down(ctx); err != nil {
+			log.Errorf("profileswitcher: Down: %v", err)
+		}
+	}
+
+	if connect {
+		if err := s.connection.Up(ctx, UpParams(p)); err != nil {
+			return fmt.Errorf("connect %q: %w", p.ProfileName, err)
+		}
+	}
+
+	// The daemon emits no profile event, so fan out ourselves or the React
+	// ProfileContext stays on the old profile after a tray-initiated switch.
+	if s.feed != nil && s.feed.emitter != nil {
+		s.feed.emitter.Emit(EventProfileChanged, p)
+	}
+
+	return nil
+}
diff --git a/client/ui/services/session.go b/client/ui/services/session.go
new file mode 100644
index 000000000..facb8e898
--- /dev/null
+++ b/client/ui/services/session.go
@@ -0,0 +1,48 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/client/ui/authsession"
+)
+
+// Re-exports so generated bindings reference services.* without importing authsession.
+type (
+	ExtendStartParams = authsession.ExtendStartParams
+	ExtendStartResult = authsession.ExtendStartResult
+	ExtendWaitParams  = authsession.ExtendWaitParams
+	ExtendResult      = authsession.ExtendResult
+)
+
+// Session wraps authsession.Session, exposing only the subset the React frontend
+// calls; the tray uses authsession.Session directly, keeping the generated TS surface minimal.
+type Session struct {
+	inner      *authsession.Session
+	classifier errorClassifier
+}
+
+// NewSession wraps inner; the caller retains ownership and may use it directly.
+// translator or prefs may be nil, in which case errors fall back to the bare code key.
+func NewSession(inner *authsession.Session, translator ErrorTranslator, prefs LanguagePreference) *Session {
+	return &Session{inner: inner, classifier: errorClassifier{translator: translator, prefs: prefs}}
+}
+
+// RequestExtend starts the SSO session-extension flow; the result carries the verification URI to open.
+func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (ExtendStartResult, error) {
+	res, err := s.inner.RequestExtend(ctx, p)
+	if err != nil {
+		return ExtendStartResult{}, s.classifier.classify(err)
+	}
+	return res, nil
+}
+
+// WaitExtend blocks until the RequestExtend flow completes; the deadline is nil when the peer is ineligible.
+func (s *Session) WaitExtend(ctx context.Context, p ExtendWaitParams) (ExtendResult, error) {
+	res, err := s.inner.WaitExtend(ctx, p)
+	if err != nil {
+		return ExtendResult{}, s.classifier.classify(err)
+	}
+	return res, nil
+}
diff --git a/client/ui/services/settings.go b/client/ui/services/settings.go
new file mode 100644
index 000000000..7c20184bd
--- /dev/null
+++ b/client/ui/services/settings.go
@@ -0,0 +1,406 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// MDMFields is the shared per-key MDM enforcement snapshot; see mdm.Fields.
+type MDMFields = mdm.Fields
+
+// Features is the shared feature-gate snapshot; see mdm.Features.
+type Features = mdm.Features
+
+// Restrictions is the shared UI enforcement snapshot; see mdm.Restrictions.
+type Restrictions = mdm.Restrictions
+
+// Privilege tells the frontend whether this process may perform the changes the
+// daemon restricts to root/administrator, whether it can ask the operating
+// system for the privileges instead, and the command for each so a control that
+// can do neither can still show the way.
+type Privilege struct {
+	Privileged bool `json:"privileged"`
+	// ActorKey identifies the principal the operation requires without wording it,
+	// so the frontend can name it in the user's language: see
+	// ipcauth.PrivilegedActorKey. The words are not sent, because English ones
+	// cannot be dropped into a translated sentence.
+	ActorKey string `json:"actorKey"`
+	// CanElevate reports whether a guarded control can offer to authorize the
+	// change through the platform's own prompt: see SetGuardedSettings.
+	CanElevate bool `json:"canElevate"`
+	// Commands equivalent to the settings the daemon guards, ready to copy.
+	AllowSSHServer string `json:"allowSshServer"`
+	EnableSSHRoot  string `json:"enableSshRoot"`
+	DisableSSHAuth string `json:"disableSshAuth"`
+}
+
+type ConfigParams struct {
+	ProfileName string `json:"profileName"`
+	Username    string `json:"username"`
+}
+
+type Config struct {
+	ManagementURL                 string `json:"managementUrl"`
+	AdminURL                      string `json:"adminUrl"`
+	ConfigFile                    string `json:"configFile"`
+	LogFile                       string `json:"logFile"`
+	PreSharedKeySet               bool   `json:"preSharedKeySet"`
+	InterfaceName                 string `json:"interfaceName"`
+	WireguardPort                 int64  `json:"wireguardPort"`
+	MTU                           int64  `json:"mtu"`
+	DisableAutoConnect            bool   `json:"disableAutoConnect"`
+	ServerSSHAllowed              bool   `json:"serverSshAllowed"`
+	RosenpassEnabled              bool   `json:"rosenpassEnabled"`
+	RosenpassPermissive           bool   `json:"rosenpassPermissive"`
+	DisableNotifications          bool   `json:"disableNotifications"`
+	BlockInbound                  bool   `json:"blockInbound"`
+	NetworkMonitor                bool   `json:"networkMonitor"`
+	DisableClientRoutes           bool   `json:"disableClientRoutes"`
+	DisableServerRoutes           bool   `json:"disableServerRoutes"`
+	DisableDNS                    bool   `json:"disableDns"`
+	DisableIPv6                   bool   `json:"disableIpv6"`
+	BlockLANAccess                bool   `json:"blockLanAccess"`
+	EnableSSHRoot                 bool   `json:"enableSshRoot"`
+	EnableSSHSFTP                 bool   `json:"enableSshSftp"`
+	EnableSSHLocalPortForwarding  bool   `json:"enableSshLocalPortForwarding"`
+	EnableSSHRemotePortForwarding bool   `json:"enableSshRemotePortForwarding"`
+	DisableSSHAuth                bool   `json:"disableSshAuth"`
+	SSHJWTCacheTTL                int32  `json:"sshJwtCacheTtl"`
+}
+
+// SetConfigParams is a partial update — only non-nil pointer fields are sent
+// to the daemon; nil fields are preserved.
+type SetConfigParams struct {
+	ProfileName                   string  `json:"profileName"`
+	Username                      string  `json:"username"`
+	ManagementURL                 string  `json:"managementUrl"`
+	AdminURL                      string  `json:"adminUrl"`
+	InterfaceName                 *string `json:"interfaceName,omitempty"`
+	WireguardPort                 *int64  `json:"wireguardPort,omitempty"`
+	MTU                           *int64  `json:"mtu,omitempty"`
+	PreSharedKey                  *string `json:"preSharedKey,omitempty"`
+	DisableAutoConnect            *bool   `json:"disableAutoConnect,omitempty"`
+	ServerSSHAllowed              *bool   `json:"serverSshAllowed,omitempty"`
+	RosenpassEnabled              *bool   `json:"rosenpassEnabled,omitempty"`
+	RosenpassPermissive           *bool   `json:"rosenpassPermissive,omitempty"`
+	DisableNotifications          *bool   `json:"disableNotifications,omitempty"`
+	BlockInbound                  *bool   `json:"blockInbound,omitempty"`
+	NetworkMonitor                *bool   `json:"networkMonitor,omitempty"`
+	DisableClientRoutes           *bool   `json:"disableClientRoutes,omitempty"`
+	DisableServerRoutes           *bool   `json:"disableServerRoutes,omitempty"`
+	DisableDNS                    *bool   `json:"disableDns,omitempty"`
+	DisableIPv6                   *bool   `json:"disableIpv6,omitempty"`
+	DisableFirewall               *bool   `json:"disableFirewall,omitempty"`
+	BlockLANAccess                *bool   `json:"blockLanAccess,omitempty"`
+	EnableSSHRoot                 *bool   `json:"enableSshRoot,omitempty"`
+	EnableSSHSFTP                 *bool   `json:"enableSshSftp,omitempty"`
+	EnableSSHLocalPortForwarding  *bool   `json:"enableSshLocalPortForwarding,omitempty"`
+	EnableSSHRemotePortForwarding *bool   `json:"enableSshRemotePortForwarding,omitempty"`
+	DisableSSHAuth                *bool   `json:"disableSshAuth,omitempty"`
+	SSHJWTCacheTTL                *int32  `json:"sshJwtCacheTtl,omitempty"`
+}
+
+type Settings struct {
+	conn       DaemonConn
+	classifier errorClassifier
+	// daemonAddr is where the daemon listens, used to tell whether it runs as
+	// this user and would therefore authorize us: see Privilege.
+	daemonAddr string
+	// elevator raises the platform's privilege prompt when a change needs more
+	// rights than this process has.
+	elevator elevator
+}
+
+func NewSettings(conn DaemonConn, translator ErrorTranslator, prefs LanguagePreference, daemonAddr string) *Settings {
+	return &Settings{
+		conn:       conn,
+		classifier: errorClassifier{translator: translator, prefs: prefs},
+		daemonAddr: daemonAddr,
+		elevator:   osElevator{},
+	}
+}
+
+func (s *Settings) GetConfig(ctx context.Context, p ConfigParams) (Config, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return Config{}, err
+	}
+	resp, err := cli.GetConfig(ctx, &proto.GetConfigRequest{
+		ProfileName: p.ProfileName,
+		Username:    p.Username,
+	})
+	if err != nil {
+		return Config{}, err
+	}
+	return Config{
+		ManagementURL:                 resp.GetManagementUrl(),
+		AdminURL:                      resp.GetAdminURL(),
+		ConfigFile:                    resp.GetConfigFile(),
+		LogFile:                       resp.GetLogFile(),
+		PreSharedKeySet:               resp.GetPreSharedKey() != "",
+		InterfaceName:                 resp.GetInterfaceName(),
+		WireguardPort:                 resp.GetWireguardPort(),
+		MTU:                           resp.GetMtu(),
+		DisableAutoConnect:            resp.GetDisableAutoConnect(),
+		ServerSSHAllowed:              resp.GetServerSSHAllowed(),
+		RosenpassEnabled:              resp.GetRosenpassEnabled(),
+		RosenpassPermissive:           resp.GetRosenpassPermissive(),
+		DisableNotifications:          resp.GetDisableNotifications(),
+		BlockInbound:                  resp.GetBlockInbound(),
+		NetworkMonitor:                resp.GetNetworkMonitor(),
+		DisableClientRoutes:           resp.GetDisableClientRoutes(),
+		DisableServerRoutes:           resp.GetDisableServerRoutes(),
+		DisableDNS:                    resp.GetDisableDns(),
+		DisableIPv6:                   resp.GetDisableIpv6(),
+		BlockLANAccess:                resp.GetBlockLanAccess(),
+		EnableSSHRoot:                 resp.GetEnableSSHRoot(),
+		EnableSSHSFTP:                 resp.GetEnableSSHSFTP(),
+		EnableSSHLocalPortForwarding:  resp.GetEnableSSHLocalPortForwarding(),
+		EnableSSHRemotePortForwarding: resp.GetEnableSSHRemotePortForwarding(),
+		DisableSSHAuth:                resp.GetDisableSSHAuth(),
+		SSHJWTCacheTTL:                resp.GetSshJWTCacheTTL(),
+	}, nil
+}
+
+func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) (SaveOutcome, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return SaveOutcome{}, err
+	}
+	req := &proto.SetConfigRequest{
+		ProfileName:                   p.ProfileName,
+		Username:                      p.Username,
+		ManagementUrl:                 p.ManagementURL,
+		AdminURL:                      p.AdminURL,
+		InterfaceName:                 p.InterfaceName,
+		WireguardPort:                 p.WireguardPort,
+		Mtu:                           p.MTU,
+		OptionalPreSharedKey:          p.PreSharedKey,
+		DisableAutoConnect:            p.DisableAutoConnect,
+		ServerSSHAllowed:              p.ServerSSHAllowed,
+		RosenpassEnabled:              p.RosenpassEnabled,
+		RosenpassPermissive:           p.RosenpassPermissive,
+		DisableNotifications:          p.DisableNotifications,
+		BlockInbound:                  p.BlockInbound,
+		NetworkMonitor:                p.NetworkMonitor,
+		DisableClientRoutes:           p.DisableClientRoutes,
+		DisableServerRoutes:           p.DisableServerRoutes,
+		DisableDns:                    p.DisableDNS,
+		DisableIpv6:                   p.DisableIPv6,
+		DisableFirewall:               p.DisableFirewall,
+		BlockLanAccess:                p.BlockLANAccess,
+		EnableSSHRoot:                 p.EnableSSHRoot,
+		EnableSSHSFTP:                 p.EnableSSHSFTP,
+		EnableSSHLocalPortForwarding:  p.EnableSSHLocalPortForwarding,
+		EnableSSHRemotePortForwarding: p.EnableSSHRemotePortForwarding,
+		DisableSSHAuth:                p.DisableSSHAuth,
+		SshJWTCacheTTL:                p.SSHJWTCacheTTL,
+	}
+	if _, err := cli.SetConfig(ctx, req); err != nil {
+		if _, refused := privilegeErrorInfo(err); refused {
+			return s.setConfigElevated(ctx, p, req, err)
+		}
+		// Classified so the frontend gets the daemon's guidance instead of the
+		// gRPC envelope.
+		return SaveOutcome{}, s.classifier.classify(err)
+	}
+	return SaveOutcome{}, nil
+}
+
+// setConfigElevated answers a request the daemon refused for want of privileges by
+// asking the user to authorize it, and sending it again if they do. It is the same
+// offer the SSH settings make up front, for the changes a control cannot know are
+// guarded until it is told: repointing a profile at another management server is
+// only privileged while that host runs the SSH server.
+//
+// Two steps, because the elevated one-shot deliberately understands only the
+// settings the daemon guards: it applies those, and the original request then goes
+// through as this user, its privileged parts now asking for nothing that is not
+// already stored. Nothing was applied by the refused attempt — the daemon decides
+// before it writes — so there is no half-applied state to undo either way.
+func (s *Settings) setConfigElevated(ctx context.Context, p SetConfigParams, req *proto.SetConfigRequest, refusal error) (SaveOutcome, error) {
+	if !s.canElevate() {
+		return SaveOutcome{}, s.classifier.classify(refusal)
+	}
+
+	guarded, err := s.guardedChanges(ctx, p)
+	if err != nil {
+		log.Warnf("cannot tell which guarded settings this request changes: %v", err)
+		return SaveOutcome{}, s.classifier.classify(refusal)
+	}
+	if len(guardedSettings(guarded)) == 0 {
+		// Refused over something no prompt can settle, such as a control channel
+		// that carries no caller identity. Report the daemon's own guidance.
+		return SaveOutcome{}, s.classifier.classify(refusal)
+	}
+
+	outcome, err := s.SetGuardedSettings(ctx, guarded)
+	if err != nil || outcome.Declined {
+		return outcome, err
+	}
+
+	cli, err := s.conn.Client()
+	if err != nil {
+		return SaveOutcome{}, err
+	}
+	if _, err := cli.SetConfig(ctx, req); err != nil {
+		return SaveOutcome{}, s.classifier.classify(err)
+	}
+	return SaveOutcome{}, nil
+}
+
+// guardedChanges is the guarded part of a request, reduced to what it actually
+// changes.
+//
+// A settings form submits every field it holds, so a request restates values the
+// daemon already has. Carrying those into the elevated run would spend one
+// authorization on more than the user asked for, and a value that has gone stale
+// since the form was loaded would spend it on something they never asked about.
+func (s *Settings) guardedChanges(ctx context.Context, p SetConfigParams) (GuardedSettings, error) {
+	stored, err := s.GetConfig(ctx, ConfigParams{ProfileName: p.ProfileName, Username: p.Username})
+	if err != nil {
+		return GuardedSettings{}, fmt.Errorf("read the stored config: %w", err)
+	}
+
+	guarded := GuardedSettings{
+		ProfileName:      p.ProfileName,
+		Username:         p.Username,
+		ServerSSHAllowed: changedFlag(p.ServerSSHAllowed, stored.ServerSSHAllowed),
+		EnableSSHRoot:    changedFlag(p.EnableSSHRoot, stored.EnableSSHRoot),
+		DisableSSHAuth:   changedFlag(p.DisableSSHAuth, stored.DisableSSHAuth),
+	}
+	// An empty URL leaves the setting alone, which is the daemon's rule too.
+	if p.ManagementURL != "" && p.ManagementURL != stored.ManagementURL {
+		guarded.ManagementURL = p.ManagementURL
+	}
+	return guarded, nil
+}
+
+// Privilege reports whether this UI process could carry out the changes the
+// daemon restricts to root/administrator, whether it can instead ask the
+// operating system for the privileges when the user wants one of them, and the
+// command that performs the ones users hit in the SSH settings. It applies the
+// daemon's own rule to what it can see locally, so the frontend can decide up
+// front how to present those controls instead of letting a save fail. No daemon
+// round-trip, so it also works while the daemon is down.
+//
+// Being root or an elevated administrator is one way. The other is running as the
+// daemon's own user while the daemon is unprivileged, which the daemon accepts
+// because such a caller can already rewrite the config it reads; that is the
+// rootless-container and Windows netstack-mode case, and it is read from the
+// ownership of the socket or pipe the daemon created.
+func (s *Settings) Privilege() Privilege {
+	id, err := ipcauth.CurrentProcessIdentity()
+	if err != nil {
+		// Fail closed: report unprivileged, which only ever asks for more.
+		log.Warnf("cannot read this process's identity, treating it as unprivileged: %v", err)
+		return s.newPrivilege(false)
+	}
+	if id.IsPrivileged() {
+		return s.newPrivilege(true)
+	}
+	return s.newPrivilege(daemonaddr.DaemonRunsAsSelf(s.daemonAddr))
+}
+
+func (s *Settings) newPrivilege(privileged bool) Privilege {
+	return Privilege{
+		Privileged:     privileged,
+		ActorKey:       ipcauth.PrivilegedActorKey(),
+		CanElevate:     s.canElevate(),
+		AllowSSHServer: ipcauth.UpCommand("--allow-server-ssh"),
+		EnableSSHRoot:  ipcauth.UpCommand("--enable-ssh-root"),
+		DisableSSHAuth: ipcauth.UpCommand("--disable-ssh-auth"),
+	}
+}
+
+// canElevate reports whether offering the platform's elevation prompt would get
+// the user anywhere. It needs a mechanism to raise the prompt with and a control
+// channel that tells the daemon who is calling: on loopback TCP the daemon
+// refuses these changes to everybody, root included, so a prompt there would
+// only waste the user's password.
+func (s *Settings) canElevate() bool {
+	if !daemonaddr.CarriesIdentity(s.daemonAddr) {
+		log.Debugf("not offering elevation: the daemon address %s carries no caller identity", s.daemonAddr)
+		return false
+	}
+	return s.elevator.Available()
+}
+
+func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return Restrictions{}, err
+	}
+	active, err := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{})
+	if err != nil {
+		return Restrictions{}, fmt.Errorf("get active profile: %w", err)
+	}
+	cfgResp, err := cli.GetConfig(ctx, &proto.GetConfigRequest{
+		ProfileName: active.GetId(),
+		Username:    active.GetUsername(),
+	})
+	if err != nil {
+		return Restrictions{}, err
+	}
+	featResp, err := cli.GetFeatures(ctx, &proto.GetFeaturesRequest{})
+	if err != nil {
+		return Restrictions{}, err
+	}
+	r := Restrictions{
+		Features: Features{
+			DisableProfiles:       featResp.GetDisableProfiles(),
+			DisableNetworks:       featResp.GetDisableNetworks(),
+			DisableUpdateSettings: featResp.GetDisableUpdateSettings(),
+		},
+	}
+	applyMDMRestrictions(&r.MDM, cfgResp)
+	r.MDM.DisableAdvancedView = featResp.DisableAdvancedView
+	return r, nil
+}
+
+// changedFlag returns requested only when it differs from what is stored, so a
+// setting the request merely restates is left out of the elevated run.
+func changedFlag(requested *bool, stored bool) *bool {
+	if requested == nil || *requested == stored {
+		return nil
+	}
+	return requested
+}
+
+func applyMDMRestrictions(mdm *MDMFields, cfgResp *proto.GetConfigResponse) {
+	managed := cfgResp.GetMDMManagedFields()
+	if len(managed) == 0 {
+		return
+	}
+	set := make(map[string]struct{}, len(managed))
+	for _, k := range managed {
+		set[k] = struct{}{}
+	}
+	v := reflect.ValueOf(mdm).Elem()
+	t := v.Type()
+	for i := 0; i < t.NumField(); i++ {
+		if v.Field(i).Kind() != reflect.Bool {
+			continue
+		}
+		if _, ok := set[t.Field(i).Tag.Get("json")]; ok {
+			v.Field(i).SetBool(true)
+		}
+	}
+	if _, ok := set["managementURL"]; ok {
+		mdm.ManagementURL = cfgResp.GetManagementUrl()
+	}
+	if _, ok := set["allowServerSSH"]; ok {
+		allowed := cfgResp.GetServerSSHAllowed()
+		mdm.AllowServerSSH = &allowed
+	}
+}
diff --git a/client/ui/services/shutdown.go b/client/ui/services/shutdown.go
new file mode 100644
index 000000000..0da51940c
--- /dev/null
+++ b/client/ui/services/shutdown.go
@@ -0,0 +1,24 @@
+package services
+
+import "sync/atomic"
+
+var (
+	sessionEnding atomic.Bool
+	quitting      atomic.Bool
+)
+
+func BeginSessionEnd() {
+	sessionEnding.Store(true)
+}
+
+func AbortSessionEnd() {
+	sessionEnding.Store(false)
+}
+
+func BeginShutdown() {
+	quitting.Store(true)
+}
+
+func ShuttingDown() bool {
+	return sessionEnding.Load() || quitting.Load()
+}
diff --git a/client/ui/services/theme.go b/client/ui/services/theme.go
new file mode 100644
index 000000000..52215e34b
--- /dev/null
+++ b/client/ui/services/theme.go
@@ -0,0 +1,194 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/events"
+
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// EventSystemThemeChanged fires when the OS appearance flips, payload SystemTheme.
+// The frontend resolves the "system" preference against it.
+const EventSystemThemeChanged = "netbird:system-theme:changed"
+
+// SystemTheme is the EventSystemThemeChanged payload.
+type SystemTheme struct {
+	Dark bool `json:"dark"`
+}
+
+// Theme keeps native window background colours in step with the persisted
+// theme preference so no window flashes the wrong surface before the webview
+// paints. The frontend applies the matching .dark class via ThemeContext.
+type Theme struct {
+	app   *application.App
+	store *preferences.Store
+	// mu serializes apply: concurrent callers could otherwise enqueue a stale
+	// pref's native updates after a newer one's.
+	mu sync.Mutex
+	// started gates the main-thread dispatch in apply: Run installs the platform
+	// layer InvokeAsync needs, and the store subscription can fire before that.
+	started atomic.Bool
+}
+
+// NewTheme wires the store subscription and OS theme-change listener. Call
+// before any window is created so creation-time colours are already themed.
+func NewTheme(app *application.App, store *preferences.Store) *Theme {
+	t := &Theme{app: app, store: store}
+	pref := store.Get().Theme
+	setAppearance(pref, resolveDark(pref, app.Env.IsDarkMode()))
+
+	// Window creation resolves through this rather than the seed above, which
+	// is wrong until Run installs the platform layer: Env.IsDarkMode reports
+	// light before that, so a "system" launch on a dark OS would build the
+	// first window light. The ApplicationStarted apply below cannot be relied
+	// on to land first because Wails runs each listener in its own goroutine.
+	// One store read backs both fields, so the snapshot is always self-consistent.
+	setAppearanceResolver(func() Appearance {
+		p := t.store.Get().Theme
+		return Appearance{Pref: p, Dark: resolveDark(p, t.app.Env.IsDarkMode())}
+	})
+
+	ch, _ := store.Subscribe()
+	go func() {
+		var last preferences.Theme
+		for p := range ch {
+			if p.Theme == last {
+				continue
+			}
+			last = p.Theme
+			t.apply()
+		}
+	}()
+
+	// Re-apply on every OS flip, not just for ThemeSystem: Windows re-evaluates
+	// process-level theme state on WM_SETTINGCHANGE, so a forced theme has to be
+	// re-asserted or the native chrome drifts to the OS appearance. The event's
+	// own IsDarkMode is deliberately unused: Wails runs each application event
+	// handler in its own goroutine, so two rapid flips race, and apply re-reads
+	// the appearance under mu instead.
+	app.Event.OnApplicationEvent(events.Common.ThemeChanged, func(*application.ApplicationEvent) {
+		t.apply()
+	})
+
+	// Startup is split in two because Wails runs every application-event
+	// listener in its own goroutine, so a listener cannot be ordered against the
+	// one that opens the first-launch window. Hooks can: they run sequentially,
+	// in registration order, and all of them before any listener is spawned.
+	//
+	// The app-wide GTK theme goes in the hook because it is the part a window
+	// must not be created without. On Linux it draws the decorations and
+	// application.LinuxWindow carries no theme of its own, so a window built
+	// before it lands shows OS-coloured decorations until it does. It is applied
+	// synchronously for the same reason -- returning from the hook has to mean
+	// the theme is live. This relies on the listener below existing: Wails skips
+	// an event's hooks entirely when it has no listeners.
+	app.Event.RegisterApplicationEventHook(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		t.started.Store(true)
+		t.syncAppAppearance()
+	})
+
+	// The rest of the startup apply. Env.IsDarkMode is a stub until the platform
+	// layer is up, so re-resolve once the app has started or a "system" launch on
+	// a light OS stays seeded dark.
+	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		t.apply()
+	})
+
+	return t
+}
+
+// syncAppAppearance applies the app-wide appearance and waits for the UI thread
+// to have done it. Use it where a window is about to be created and must not be
+// built against the OS appearance: apply dispatches its own native work
+// asynchronously, so on Linux the GTK theme behind the decorations can otherwise
+// land after the window exists.
+//
+// No-op before the app has started, where InvokeSync has no platform layer to
+// dispatch to. Reads the appearance under mu like apply, so the two cannot
+// interleave into a torn update.
+func (t *Theme) syncAppAppearance() {
+	if !t.started.Load() {
+		return
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	pref := t.store.Get().Theme
+	dark := resolveDark(pref, t.app.Env.IsDarkMode())
+	setAppearance(pref, dark)
+	application.InvokeSync(func() { setAppAppearance(dark) })
+}
+
+// SystemDarkMode reports the OS appearance; bound so the frontend can resolve
+// the "system" preference from the same source as the native layer.
+func (t *Theme) SystemDarkMode(_ context.Context) (bool, error) {
+	return t.app.Env.IsDarkMode(), nil
+}
+
+// resolveDark maps a preference to an effective appearance against a system
+// reading the caller already took.
+func resolveDark(pref preferences.Theme, systemDark bool) bool {
+	switch pref {
+	case preferences.ThemeDark:
+		return true
+	case preferences.ThemeLight:
+		return false
+	default:
+		return systemDark
+	}
+}
+
+// apply recomputes the effective appearance, re-tints every live window
+// (including the macOS NSWindow appearance so the frame matches the webview)
+// and publishes the system appearance the frontend resolves "system" against.
+//
+// Everything runs under mu and reads the appearance here rather than taking it
+// from a caller, so a later apply always carries the fresher state and the
+// frontend event is ordered by the same lock as the native assignments. Emit
+// only appends to a FIFO mailbox, so holding mu across it cannot block.
+//
+// The OS is read exactly once per update and the resolved value is passed on to
+// the background and the native chrome, so those cannot land on either side of
+// an OS flip that happens mid-apply. The event carries the raw system reading,
+// not the resolved one, because the frontend resolves "system" itself.
+func (t *Theme) apply() {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	pref := t.store.Get().Theme
+	systemDark := t.app.Env.IsDarkMode()
+	dark := resolveDark(pref, systemDark)
+	setAppearance(pref, dark)
+	t.app.Event.Emit(EventSystemThemeChanged, SystemTheme{Dark: systemDark})
+
+	// Before Run there is no platform layer for InvokeAsync to dispatch to.
+	// Windows created later read the globals set above.
+	if !t.started.Load() {
+		return
+	}
+
+	colour := windowBackgroundColour(dark)
+	// Re-tint on the UI thread and resolve each native handle there. Window
+	// teardown (markAsDestroyed then impl.close) runs as UI-thread work too, so
+	// a window closed meanwhile is either gone from GetAll or yields a nil
+	// handle -- never a freed handle the OS may already have reused.
+	application.InvokeAsync(func() {
+		// App-wide first, and unconditionally: on Linux this is the GTK theme
+		// that draws the decorations, and it must be set even with no window
+		// open because later windows inherit it instead of carrying it.
+		setAppAppearance(dark)
+		for _, w := range t.app.Window.GetAll() {
+			if w == nil {
+				continue
+			}
+			w.SetBackgroundColour(colour)
+			setWindowAppearance(w.NativeWindow(), pref, dark)
+		}
+	})
+}
diff --git a/client/ui/services/uilog.go b/client/ui/services/uilog.go
new file mode 100644
index 000000000..0d794c137
--- /dev/null
+++ b/client/ui/services/uilog.go
@@ -0,0 +1,36 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// UILog forwards frontend console output into logrus, tagging the JS origin
+// as the "ui" field to stay distinct from logrus's Go-caller source.
+type UILog struct{}
+
+func NewUILog() *UILog { return &UILog{} }
+
+// Log maps an unrecognised level to info; empty source becomes "unknown".
+func (s *UILog) Log(_ context.Context, level, source, msg string) {
+	origin := "unknown"
+	if source != "" {
+		origin = source
+	}
+	entry := log.WithField("ui", origin)
+	switch level {
+	case "trace":
+		entry.Trace(msg)
+	case "debug":
+		entry.Debug(msg)
+	case "warn", "warning":
+		entry.Warn(msg)
+	case "error":
+		entry.Error(msg)
+	default:
+		entry.Info(msg)
+	}
+}
diff --git a/client/ui/services/update.go b/client/ui/services/update.go
new file mode 100644
index 000000000..b743b9858
--- /dev/null
+++ b/client/ui/services/update.go
@@ -0,0 +1,80 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"time"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/updater"
+	"github.com/netbirdio/netbird/version"
+)
+
+// UpdateResult mirrors TriggerUpdateResponse.
+type UpdateResult struct {
+	Success  bool   `json:"success"`
+	ErrorMsg string `json:"errorMsg"`
+}
+
+// Update is the Wails-bound facade over the daemon's update RPCs. The state
+// machine and push event live in client/ui/updater.
+type Update struct {
+	conn   DaemonConn
+	holder *updater.Holder
+}
+
+func NewUpdate(conn DaemonConn, holder *updater.Holder) *Update {
+	return &Update{conn: conn, holder: holder}
+}
+
+func (s *Update) GetState() updater.State {
+	return s.holder.Get()
+}
+
+// DownloadURL returns the platform-appropriate installer download link for
+// manual (non-enforced) updates.
+func (s *Update) DownloadURL() string {
+	return version.DownloadUrl()
+}
+
+// Quit exits the app. Scheduled off the calling goroutine so the JS caller's
+// response returns before the runtime tears down.
+func (s *Update) Quit() {
+	go func() {
+		time.Sleep(100 * time.Millisecond)
+		application.Get().Quit()
+	}()
+}
+
+func (s *Update) Trigger(ctx context.Context) (UpdateResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return UpdateResult{}, err
+	}
+	resp, err := cli.TriggerUpdate(ctx, &proto.TriggerUpdateRequest{})
+	if err != nil {
+		return UpdateResult{}, err
+	}
+	return UpdateResult{
+		Success:  resp.GetSuccess(),
+		ErrorMsg: resp.GetErrorMsg(),
+	}, nil
+}
+
+func (s *Update) GetInstallerResult(ctx context.Context) (UpdateResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return UpdateResult{}, err
+	}
+	resp, err := cli.GetInstallerResult(ctx, &proto.InstallerResultRequest{})
+	if err != nil {
+		return UpdateResult{}, err
+	}
+	return UpdateResult{
+		Success:  resp.GetSuccess(),
+		ErrorMsg: resp.GetErrorMsg(),
+	}, nil
+}
diff --git a/client/ui/services/version.go b/client/ui/services/version.go
new file mode 100644
index 000000000..8caea9f72
--- /dev/null
+++ b/client/ui/services/version.go
@@ -0,0 +1,22 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/version"
+)
+
+// Version reports only the GUI's own version; the daemon version comes from
+// the status feed's DaemonVersion field.
+type Version struct{}
+
+func NewVersion() *Version {
+	return &Version{}
+}
+
+// GUI returns the UI binary's version, stamped via ldflags ("development" if un-stamped).
+func (v *Version) GUI(_ context.Context) string {
+	return version.NetbirdVersion()
+}
diff --git a/client/ui/services/windowappearance_darwin.go b/client/ui/services/windowappearance_darwin.go
new file mode 100644
index 000000000..3c0a28447
--- /dev/null
+++ b/client/ui/services/windowappearance_darwin.go
@@ -0,0 +1,53 @@
+package services
+
+/*
+#cgo CFLAGS: -x objective-c
+#cgo LDFLAGS: -framework AppKit
+
+#import <AppKit/AppKit.h>
+
+// forced < 0: follow the OS (appearance nil); 0: light; 1: dark.
+//
+// Assigns directly rather than dispatching: Theme.apply already runs this on
+// the main thread. Deferring would outlive the caller's check that the window
+// is alive, and the __bridge cast does not retain it, so the block could touch
+// a freed NSWindow.
+static void nbSetWindowAppearance(void *nsWindow, int forced) {
+	NSWindow *window = (__bridge NSWindow *)nsWindow;
+	if (forced < 0) {
+		window.appearance = nil;
+	} else {
+		NSAppearanceName name = forced == 1 ? NSAppearanceNameDarkAqua : NSAppearanceNameAqua;
+		window.appearance = [NSAppearance appearanceNamed:name];
+	}
+}
+*/
+import "C"
+
+import (
+	"unsafe"
+
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// setWindowAppearance pins the NSWindow appearance to the forced theme, or
+// hands it back to the OS for ThemeSystem. Without this, a window created
+// under one OS appearance keeps its dark/light frame after a manual theme
+// flip, leaving a mismatched border around the webview. Must run on the main
+// thread, which Theme.apply guarantees.
+//
+// The resolved appearance is unused: for ThemeSystem a nil NSAppearance lets
+// AppKit track the OS itself, which cannot drift from a snapshot we took.
+func setWindowAppearance(nsWindow unsafe.Pointer, pref preferences.Theme, _ bool) {
+	if nsWindow == nil {
+		return
+	}
+	forced := C.int(-1)
+	switch pref {
+	case preferences.ThemeLight:
+		forced = 0
+	case preferences.ThemeDark:
+		forced = 1
+	}
+	C.nbSetWindowAppearance(nsWindow, forced)
+}
diff --git a/client/ui/services/windowappearance_other.go b/client/ui/services/windowappearance_other.go
new file mode 100644
index 000000000..c2e9fbf74
--- /dev/null
+++ b/client/ui/services/windowappearance_other.go
@@ -0,0 +1,16 @@
+//go:build !darwin && !windows && !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"unsafe"
+
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// setWindowAppearance is a no-op wherever there is no per-window appearance to
+// set, which is every target this file covers. On Linux the appearance is real
+// but app-wide, so setAppAppearance owns it instead; on the remaining Unix
+// targets there is no native theming to apply at all and setAppAppearance is
+// itself a stub (appappearance_other.go).
+func setWindowAppearance(unsafe.Pointer, preferences.Theme, bool) {}
diff --git a/client/ui/services/windowappearance_windows.go b/client/ui/services/windowappearance_windows.go
new file mode 100644
index 000000000..8d5c88e47
--- /dev/null
+++ b/client/ui/services/windowappearance_windows.go
@@ -0,0 +1,54 @@
+package services
+
+import (
+	"unsafe"
+
+	"github.com/wailsapp/wails/v3/pkg/w32"
+
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// setWindowAppearance re-themes a live window's chrome; Wails only does this
+// itself on OS flips for SystemDefault windows.
+//
+// Must run on the UI thread, which Theme.apply guarantees: the uxtheme and
+// repaint calls behind w32.SetTheme belong to the window's thread, and hwnd is
+// only known live while we hold that thread. Re-dispatching here would let the
+// window be destroyed first and hand these writes a reused handle.
+//
+// dark is the appearance Theme.apply already resolved. Re-reading the OS here
+// would let the chrome land on the other side of an OS flip from the window
+// background and the webview.
+func setWindowAppearance(hwnd unsafe.Pointer, _ preferences.Theme, dark bool) {
+	if hwnd == nil || !w32.SupportsThemes() || w32.IsCurrentlyHighContrastMode() {
+		return
+	}
+
+	h := uintptr(hwnd)
+	w32.SetTheme(h, dark)
+
+	// After SetTheme, not before: its menu helper regates dark on the
+	// process-level ShouldAppsUseDarkMode and rewrites the per-window opt-in
+	// with that gated value, so forcing Dark on a light OS would lose it --
+	// and builds below 18985 need the opt-in for the pre-20H1 dark frame. The
+	// gated menu theme name is left alone on purpose: these windows carry no
+	// native menu, and popup-menu text follows the process policy, so forcing
+	// it dark gives dark text on dark.
+	if w32.AllowDarkModeForWindow != nil {
+		w32.AllowDarkModeForWindow(h, dark)
+	}
+
+	chrome := microsoftWindowsLightTheme
+	if dark {
+		chrome = microsoftWindowsDarkTheme
+	}
+	if chrome.TitleBarColour != nil {
+		w32.SetTitleBarColour(h, *chrome.TitleBarColour)
+	}
+	if chrome.TitleTextColour != nil {
+		w32.SetTitleTextColour(h, *chrome.TitleTextColour)
+	}
+	if chrome.BorderColour != nil {
+		w32.SetBorderColour(h, *chrome.BorderColour)
+	}
+}
diff --git a/client/ui/services/windowmanager.go b/client/ui/services/windowmanager.go
new file mode 100644
index 000000000..af6d726a3
--- /dev/null
+++ b/client/ui/services/windowmanager.go
@@ -0,0 +1,1419 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"net/url"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/events"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// LanguageSubscriber delivers UI preference changes so window titles follow the language.
+type LanguageSubscriber interface {
+	Subscribe() (<-chan preferences.UIPreferences, func())
+}
+
+type windowOp func(w *application.WebviewWindow, created bool)
+
+type windowCloser func(w *application.WebviewWindow)
+
+// hideableWindow is the slice of application.Window the hide/restore bookkeeping needs.
+// Narrow enough to fake in tests, which application.Window itself is not: it carries
+// unexported methods.
+type hideableWindow interface {
+	Show() application.Window
+	Hide() application.Window
+	IsVisible() bool
+	Name() string
+}
+
+// EventTriggerLogin asks the frontend's startLogin() to begin an SSO flow.
+const EventTriggerLogin = "trigger-login"
+
+// EventBrowserLoginCancel signals the user dismissed the BrowserLogin popup.
+const EventBrowserLoginCancel = "browser-login:cancel"
+
+// EventSettingsOpen tells the mounted settings window which tab to show.
+const EventSettingsOpen = "netbird:settings:open"
+
+const EventWindowPainted = "netbird:window-painted"
+
+// generationParam carries the painted-report token in each dialog's start URL.
+const generationParam = "gen"
+
+const paintedFallback = 3 * time.Second
+
+const headlessTeardownDelay = 2 * time.Second
+
+const (
+	windowMain              = "main"
+	windowSettings          = "settings"
+	windowBrowserLogin      = "browser-login"
+	windowSessionExpiration = "session-expiration"
+	windowInstallProgress   = "install-progress"
+	windowWelcome           = "welcome"
+	windowError             = "error"
+)
+
+// Window background per effective appearance. Both match the body background
+// (bg-nb-gray DEFAULT) in globals.css so opaque native pixels and the webview
+// paint the same surface; keep the three in sync.
+var (
+	windowBackgroundDark  = application.NewRGB(24, 26, 29)    // dark nb-gray DEFAULT
+	windowBackgroundLight = application.NewRGB(243, 243, 243) // light nb-gray DEFAULT
+)
+
+// Appearance is one view of the theme state: the preference and the appearance
+// it resolves to. Take it once per window with CurrentAppearance and pass the
+// same value to every option builder -- Pref drives the macOS frame while Dark
+// drives the background and the Windows chrome, so reading them separately can
+// build a window with a new background behind the previous native frame.
+type Appearance struct {
+	Pref preferences.Theme
+	Dark bool
+}
+
+// storedAppearance is the snapshot maintained by services.Theme, published as
+// one value so the pair can never tear. It is the fallback for window creation
+// until resolveAppearance is installed.
+var storedAppearance atomic.Value // Appearance
+
+// resolveAppearance re-resolves against the live OS state. Theme installs it so
+// window creation never reads a stale seed: app.Env.IsDarkMode reports light
+// until Run installs the platform layer, and Wails runs every
+// ApplicationStarted listener in its own goroutine, so a startup window can be
+// created before Theme's listener has corrected the seed.
+var resolveAppearance atomic.Value // func() Appearance
+
+func init() {
+	storedAppearance.Store(Appearance{Pref: preferences.DefaultTheme, Dark: true})
+}
+
+func setAppearance(pref preferences.Theme, dark bool) {
+	storedAppearance.Store(Appearance{Pref: pref, Dark: dark})
+}
+
+func setAppearanceResolver(f func() Appearance) { resolveAppearance.Store(f) }
+
+// CurrentAppearance returns the snapshot every window creation must build from.
+func CurrentAppearance() Appearance {
+	if f, _ := resolveAppearance.Load().(func() Appearance); f != nil {
+		return f()
+	}
+	a, _ := storedAppearance.Load().(Appearance)
+	return a
+}
+
+// WindowBackgroundColour returns the background for a snapshot; use it for
+// every WebviewWindowOptions.BackgroundColour.
+func WindowBackgroundColour(a Appearance) application.RGBA {
+	return windowBackgroundColour(a.Dark)
+}
+
+// windowBackgroundColour maps a resolved appearance to its window background.
+func windowBackgroundColour(dark bool) application.RGBA {
+	if dark {
+		return windowBackgroundDark
+	}
+	return windowBackgroundLight
+}
+
+// WindowHeight is shared by the main and Settings windows.
+const WindowHeight = 660
+
+// Wails reads CustomTheme colours as 0x00BBGGRR (RGB byte order reversed).
+var microsoftWindowsDarkTheme = &application.WindowTheme{
+	BorderColour:    u32ptr(0x00211E1C), // #1C1E21 nb-gray-940
+	TitleBarColour:  u32ptr(0x00211E1C),
+	TitleTextColour: u32ptr(0x00E9E7E4), // #E4E7E9 nb-gray-100
+}
+
+var microsoftWindowsLightTheme = &application.WindowTheme{
+	BorderColour:    u32ptr(0x00F3F3F3), // #F3F3F3 light nb-gray DEFAULT
+	TitleBarColour:  u32ptr(0x00F3F3F3),
+	TitleTextColour: u32ptr(0x00212121), // #212121 light nb-gray-100
+}
+
+// MicrosoftWindowsAppearanceOptions is the shared Windows chrome (Mica +
+// custom title bar), resolved at creation; setWindowAppearance re-themes live
+// windows on later changes. Never SystemDefault: Wails gives those windows a
+// SystemThemeChanged handler that re-themes chrome from the OS appearance,
+// which outlives a switch to a forced theme and fights it on the next OS flip.
+// Both CustomTheme slots hold one colour set for the same reason.
+func MicrosoftWindowsAppearanceOptions(a Appearance) application.WindowsWindow {
+	theme, chrome := application.Light, microsoftWindowsLightTheme
+	if a.Dark {
+		theme, chrome = application.Dark, microsoftWindowsDarkTheme
+	}
+	return application.WindowsWindow{
+		BackdropType: application.Mica,
+		Theme:        theme,
+		CustomTheme: application.ThemeSettings{
+			DarkModeActive:    chrome,
+			DarkModeInactive:  chrome,
+			LightModeActive:   chrome,
+			LightModeInactive: chrome,
+		},
+	}
+}
+
+// AppleMacOSAppearanceOptions is the shared macOS chrome; FullScreenNone keeps the fixed-size layout.
+func AppleMacOSAppearanceOptions(a Appearance) application.MacWindow {
+	appearance := application.DefaultAppearance
+	switch a.Pref {
+	case preferences.ThemeLight:
+		appearance = application.NSAppearanceNameAqua
+	case preferences.ThemeDark:
+		appearance = application.NSAppearanceNameDarkAqua
+	}
+	return application.MacWindow{
+		InvisibleTitleBarHeight: 38,
+		Backdrop:                application.MacBackdropNormal,
+		TitleBar:                application.MacTitleBarHiddenInset,
+		CollectionBehavior:      application.MacWindowCollectionBehaviorFullScreenNone,
+		Appearance:              appearance,
+	}
+}
+
+// LinuxAppearanceOptions is the shared Linux chrome; opaque so fake-translucency compositors paint it.
+func LinuxAppearanceOptions(icon []byte) application.LinuxWindow {
+	return application.LinuxWindow{
+		Icon:                icon,
+		WindowIsTranslucent: false,
+	}
+}
+
+// DialogWindowOptions is the baseline for every auxiliary dialog window; callers override per-dialog.
+func DialogWindowOptions(name, title, url string, linuxIcon []byte) application.WebviewWindowOptions {
+	a := CurrentAppearance()
+	return application.WebviewWindowOptions{
+		Name:                name,
+		Title:               title,
+		Width:               360,
+		Height:              320,
+		DisableResize:       true,
+		AlwaysOnTop:         true,
+		Hidden:              true,
+		MinimiseButtonState: application.ButtonHidden,
+		MaximiseButtonState: application.ButtonHidden,
+		CloseButtonState:    application.ButtonEnabled,
+		BackgroundColour:    WindowBackgroundColour(a),
+		URL:                 url,
+		Mac:                 AppleMacOSAppearanceOptions(a),
+		Windows:             MicrosoftWindowsAppearanceOptions(a),
+		Linux:               LinuxAppearanceOptions(linuxIcon),
+	}
+}
+
+// hiddenWindow records a window hidden by owner, the name of the popup that hid it.
+type hiddenWindow struct {
+	win   hideableWindow
+	owner string
+}
+
+type WindowManager struct {
+	app               *application.App
+	mainWindow        *application.WebviewWindow
+	translator        ErrorTranslator
+	prefs             LanguagePreference
+	linuxIcon         []byte
+	settings          *application.WebviewWindow
+	browserLogin      *application.WebviewWindow
+	sessionExpiration *application.WebviewWindow
+	installProgress   *application.WebviewWindow
+	welcome           *application.WebviewWindow
+	errorDialog       *application.WebviewWindow
+	// hiddenWindows holds windows hidden while a popup owns the screen, each tagged with
+	// the popup that hid it so closing one popup cannot restore what another still hides.
+	hiddenWindows []hiddenWindow
+	hiding        map[string]bool
+	// allWindows and raiseMain are the seams the hide/restore tests replace; both are nil
+	// in production, where the Wails app and the platform helper are used directly.
+	allWindows   func() []hideableWindow
+	raiseMain    func()
+	mu           sync.Mutex
+	newMain      func(startURL string) *application.WebviewWindow
+	creating     map[string]bool
+	pendingOps   map[string][]windowOp
+	pendingClose map[string]windowCloser
+	restoreGen   map[string]uint64
+	// painted gates showing a window: set by the frontend's first render, or by the
+	// fallback timer so a webview that never wakes up still becomes visible.
+	painted map[uint]bool
+	// mounted gates emitting to a window: set only by a real frontend report, since an
+	// event emitted to a frontend that has not subscribed yet is dropped, not queued.
+	mounted        map[uint]bool
+	showPending    map[uint]bool
+	pendingTab     map[uint]string
+	pendingEmits   map[uint][]string
+	fallbackTimers map[uint]*time.Timer
+	afterShow      map[uint]func()
+	// generation maps a window name to the token stamped into its current start URL, so a
+	// painted report from a replaced window can be told apart from the live one's.
+	generation     map[string]uint64
+	lastGeneration uint64
+	headlessMain   bool
+	headlessTimer  *time.Timer
+	// recenterOnShow is set only on the minimal-WM/XEmbed path, where the WM neither centers nor
+	// restores position; nil on full desktops so re-centering can't fight a user-moved window.
+	recenterOnShow func() bool
+}
+
+func NewWindowManager(app *application.App, mainWindow *application.WebviewWindow, translator ErrorTranslator, prefs LanguagePreference, linuxIcon []byte) *WindowManager {
+	s := &WindowManager{
+		app:            app,
+		mainWindow:     mainWindow,
+		translator:     translator,
+		prefs:          prefs,
+		linuxIcon:      linuxIcon,
+		creating:       map[string]bool{},
+		pendingOps:     map[string][]windowOp{},
+		pendingClose:   map[string]windowCloser{},
+		restoreGen:     map[string]uint64{},
+		hiding:         map[string]bool{},
+		painted:        map[uint]bool{},
+		mounted:        map[uint]bool{},
+		showPending:    map[uint]bool{},
+		pendingTab:     map[uint]string{},
+		pendingEmits:   map[uint][]string{},
+		fallbackTimers: map[uint]*time.Timer{},
+		afterShow:      map[uint]func(){},
+		generation:     map[string]uint64{},
+	}
+	s.watchPainted()
+	s.watchTriggerLogin()
+	// Re-title live windows on language flip. Wired internally so the binding generator
+	// doesn't try to expose the interface param.
+	if sub, ok := prefs.(LanguageSubscriber); ok && sub != nil {
+		ch, _ := sub.Subscribe()
+		go func() {
+			var last i18n.LanguageCode
+			for p := range ch {
+				if p.Language == "" || p.Language == last {
+					continue
+				}
+				last = p.Language
+				s.retitleAll()
+			}
+		}()
+	}
+	return s
+}
+
+func (s *WindowManager) newSettingsWindow() *application.WebviewWindow {
+	a := CurrentAppearance()
+	w := s.app.Window.NewWithOptions(application.WebviewWindowOptions{
+		Name:                windowSettings,
+		Title:               s.title("window.title.settings"),
+		Width:               900,
+		Height:              WindowHeight,
+		Hidden:              true,
+		DisableResize:       true,
+		MinimiseButtonState: application.ButtonHidden,
+		MaximiseButtonState: application.ButtonHidden,
+		CloseButtonState:    application.ButtonEnabled,
+		BackgroundColour:    WindowBackgroundColour(a),
+		URL:                 "/#/settings",
+		Mac:                 AppleMacOSAppearanceOptions(a),
+		Windows:             MicrosoftWindowsAppearanceOptions(a),
+		Linux:               LinuxAppearanceOptions(s.linuxIcon),
+	})
+	w.RegisterHook(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+		s.mu.Lock()
+		s.settings = nil
+		s.forgetWindowLocked(w)
+		s.mu.Unlock()
+	})
+	s.armReady(w)
+	return w
+}
+
+// OpenSettings shows the settings window on tab (empty → General), switching tab via
+// EventSettingsOpen rather than SetURL (which would remount the provider tree).
+func (s *WindowManager) OpenSettings(tab string) {
+	target := tab
+	if target == "" {
+		target = "general"
+	}
+
+	s.withWindow(windowSettings, &s.settings, s.newSettingsWindow, func(w *application.WebviewWindow, _ bool) {
+		s.mu.Lock()
+		mounted := s.mounted[w.ID()]
+		if !mounted {
+			s.pendingTab[w.ID()] = target
+		}
+		s.mu.Unlock()
+
+		if mounted {
+			s.app.Event.Emit(EventSettingsOpen, target)
+		}
+		s.showWhenReady(w)
+	})
+}
+
+// OpenBrowserLogin shows the SSO popup, creating it on first use.
+func (s *WindowManager) OpenBrowserLogin(uri string) {
+	startURL := "/#/dialog/browser-login"
+	if uri != "" {
+		startURL = "/#/dialog/browser-login?uri=" + url.QueryEscape(uri)
+	}
+	s.withWindow(windowBrowserLogin, &s.browserLogin, func() *application.WebviewWindow {
+		return s.newBrowserLoginWindow(s.stampGeneration(windowBrowserLogin, startURL))
+	}, func(w *application.WebviewWindow, created bool) {
+		if !created && uri != "" {
+			w.SetURL(s.stampGeneration(windowBrowserLogin, startURL))
+		}
+		s.centerOnCursorScreen(w)
+		s.showThenOpenBrowser(w, uri)
+	})
+}
+
+func (s *WindowManager) showThenOpenBrowser(w *application.WebviewWindow, uri string) {
+	if uri != "" {
+		s.mu.Lock()
+		s.afterShow[w.ID()] = func() { s.openBrowser(uri) }
+		s.mu.Unlock()
+	}
+	s.showWhenReady(w)
+}
+
+func (s *WindowManager) openBrowser(uri string) {
+	if uri == "" {
+		return
+	}
+	go func() {
+		if err := openURL(uri); err != nil {
+			log.Errorf("open browser for SSO login: %v", err)
+			s.OpenError(s.title("browserLogin.openFailedTitle"), err.Error(), "")
+		}
+	}()
+}
+
+func (s *WindowManager) newBrowserLoginWindow(startURL string) *application.WebviewWindow {
+	s.hideOtherWindows(windowBrowserLogin)
+	opts := DialogWindowOptions(windowBrowserLogin, s.title("window.title.signIn"), startURL, s.linuxIcon)
+	// Not always-on-top: it would obscure the browser tab the user logs in through.
+	opts.AlwaysOnTop = false
+	opts.InitialPosition = application.WindowCentered
+	// Open on the active (where users cursor is) display, like the session-expiration dialog.
+	opts.Screen = s.getScreenBasedOnCursorPosition()
+	w := s.app.Window.NewWithOptions(opts)
+	w.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+		s.mu.Lock()
+		// Only a live user red-X still has this registered; programmatic closers
+		// nil s.browserLogin first and clean up themselves. Guarding here stops a
+		// stale close event from wiping a replacement popup's state.
+		userClosed := s.browserLogin == w
+		if userClosed {
+			s.browserLogin = nil
+		}
+		s.forgetWindowLocked(w)
+		s.mu.Unlock()
+		if userClosed {
+			s.restoreHiddenWindows(windowBrowserLogin)
+			s.app.Event.Emit(EventBrowserLoginCancel)
+		}
+	})
+	s.armReady(w)
+	return w
+}
+
+// BrowserLoginWindow returns the live SSO popup, or nil. While non-nil it is the
+// app's focal window: tray "Open" and dock activation hand off to it, not the main window.
+func (s *WindowManager) BrowserLoginWindow() *application.WebviewWindow {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.browserLogin
+}
+
+// InstallProgressWindow returns the live install-progress window, or nil. Same focal-window
+// contract as BrowserLoginWindow; install supersedes everything, so check this first.
+func (s *WindowManager) InstallProgressWindow() *application.WebviewWindow {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.installProgress
+}
+
+func (s *WindowManager) CloseBrowserLogin() {
+	// The WindowClosing hook no-ops on a programmatic close, so the closer restores.
+	// The frontend calls this even when no popup was ever shown (resetDialog() after an
+	// early RequestExtend failure, or connection.ts's catch path); closeWindow skips the
+	// closer then, and an owner-scoped restore cannot touch what install-progress hides.
+	s.closeWindow(windowBrowserLogin, &s.browserLogin, s.restoringCloser(windowBrowserLogin))
+}
+
+// OpenSessionExpiration shows the countdown warning on the cursor's display; seconds seeds
+// the countdown and deadlineUnixMilli (0 when unknown) is the absolute deadline the dialog
+// compares renewal snapshots against. Singleton, destroyed on close.
+func (s *WindowManager) OpenSessionExpiration(seconds int, deadlineUnixMilli int64) {
+	startURL := "/#/dialog/session-expiration?seconds=" + strconv.Itoa(seconds)
+	if deadlineUnixMilli > 0 {
+		startURL += "&deadline=" + strconv.FormatInt(deadlineUnixMilli, 10)
+	}
+	s.withWindow(windowSessionExpiration, &s.sessionExpiration, func() *application.WebviewWindow {
+		return s.newSessionExpirationWindow(s.stampGeneration(windowSessionExpiration, startURL))
+	}, func(w *application.WebviewWindow, created bool) {
+		if !created {
+			w.SetURL(s.stampGeneration(windowSessionExpiration, startURL))
+		}
+		s.centerOnCursorScreen(w)
+		s.showWhenReady(w)
+	})
+}
+
+func (s *WindowManager) newSessionExpirationWindow(startURL string) *application.WebviewWindow {
+	opts := DialogWindowOptions(windowSessionExpiration, s.title("window.title.sessionExpiration"), startURL, s.linuxIcon)
+	opts.Screen = s.getScreenBasedOnCursorPosition()
+	opts.InitialPosition = application.WindowCentered
+	w := s.app.Window.NewWithOptions(opts)
+	w.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+		s.mu.Lock()
+		if s.sessionExpiration == w {
+			s.sessionExpiration = nil
+		}
+		s.forgetWindowLocked(w)
+		s.mu.Unlock()
+	})
+	s.armReady(w)
+	return w
+}
+
+func (s *WindowManager) CloseSessionExpiration() {
+	s.closeWindow(windowSessionExpiration, &s.sessionExpiration, closeOnly)
+}
+
+// CloseRenewFlow tears down the SSO session-renewal UI in a single call: it
+// closes the browser-login popup and the session-expiration window together.
+func (s *WindowManager) CloseRenewFlow() {
+	s.mu.Lock()
+	bl := s.takeWindowLocked(windowBrowserLogin, &s.browserLogin, s.restoringCloser(windowBrowserLogin))
+	se := s.takeWindowLocked(windowSessionExpiration, &s.sessionExpiration, closeOnly)
+	if se != nil {
+		kept := s.hiddenWindows[:0]
+		for _, hidden := range s.hiddenWindows {
+			if !sameWindow(hidden.win, se) {
+				kept = append(kept, hidden)
+			}
+		}
+		s.hiddenWindows = kept
+	}
+	s.mu.Unlock()
+
+	s.restoreHiddenWindows(windowBrowserLogin)
+	// Close after unlock so the re-entrant handlers can take s.mu.
+	if bl != nil {
+		bl.Close()
+	}
+	if se != nil {
+		se.Close()
+	}
+}
+
+// OpenInstallProgress shows the install-progress window and hides the rest for the duration
+// (restored on close). It owns its own result polling since the daemon restarts mid-install.
+func (s *WindowManager) OpenInstallProgress(version string) {
+	startURL := "/#/dialog/install-progress"
+	if version != "" {
+		startURL = "/#/dialog/install-progress?version=" + url.QueryEscape(version)
+	}
+	s.withWindow(windowInstallProgress, &s.installProgress, func() *application.WebviewWindow {
+		return s.newInstallProgressWindow(s.stampGeneration(windowInstallProgress, startURL))
+	}, func(w *application.WebviewWindow, created bool) {
+		if !created {
+			w.SetURL(s.stampGeneration(windowInstallProgress, startURL))
+		}
+		s.showWhenReady(w)
+	})
+}
+
+func (s *WindowManager) newInstallProgressWindow(startURL string) *application.WebviewWindow {
+	s.hideOtherWindows(windowInstallProgress)
+	w := s.app.Window.NewWithOptions(
+		DialogWindowOptions(windowInstallProgress, s.title("window.title.updating"), startURL, s.linuxIcon),
+	)
+	w.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+		s.mu.Lock()
+		userClosed := s.installProgress == w
+		if userClosed {
+			s.installProgress = nil
+		}
+		s.forgetWindowLocked(w)
+		s.mu.Unlock()
+		if userClosed {
+			s.restoreHiddenWindows(windowInstallProgress)
+		}
+	})
+	s.armReady(w)
+	return w
+}
+
+func (s *WindowManager) CloseInstallProgress() {
+	s.closeWindow(windowInstallProgress, &s.installProgress, s.restoringCloser(windowInstallProgress))
+}
+
+// OpenWelcome shows the first-launch onboarding window. Singleton, destroyed on close.
+func (s *WindowManager) OpenWelcome() {
+	s.withWindow(windowWelcome, &s.welcome, s.newWelcomeWindow, func(w *application.WebviewWindow, _ bool) {
+		s.showWhenReady(w)
+	})
+}
+
+func (s *WindowManager) newWelcomeWindow() *application.WebviewWindow {
+	opts := DialogWindowOptions(windowWelcome, s.title("window.title.welcome"), s.stampGeneration(windowWelcome, "/#/dialog/welcome"), s.linuxIcon)
+	opts.Width = 420
+	opts.InitialPosition = application.WindowCentered
+	w := s.app.Window.NewWithOptions(opts)
+	w.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+		s.mu.Lock()
+		if s.welcome == w {
+			s.welcome = nil
+		}
+		s.forgetWindowLocked(w)
+		s.mu.Unlock()
+	})
+	s.armReady(w)
+	return w
+}
+
+func (s *WindowManager) CloseWelcome() {
+	s.closeWindow(windowWelcome, &s.welcome, closeOnly)
+}
+
+// OpenError shows the custom error dialog; title/message/command are pre-localised
+// and ride in the start URL. command is optional and, when set, is offered for
+// copying so the user can run the operation the daemon refused. A second error
+// replaces the open one via SetURL. Singleton, destroyed on close.
+func (s *WindowManager) OpenError(title, message, command string) {
+	if ShuttingDown() {
+		return
+	}
+	startURL := errorDialogURL(title, message, command)
+	s.withWindow(windowError, &s.errorDialog, func() *application.WebviewWindow {
+		return s.newErrorWindow(s.stampGeneration(windowError, startURL))
+	}, func(w *application.WebviewWindow, created bool) {
+		if !created {
+			w.SetURL(s.stampGeneration(windowError, startURL))
+		}
+		s.showWhenReady(w)
+	})
+}
+
+func (s *WindowManager) newErrorWindow(startURL string) *application.WebviewWindow {
+	w := s.app.Window.NewWithOptions(
+		DialogWindowOptions(windowError, s.title("window.title.error"), startURL, s.linuxIcon),
+	)
+	w.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+		s.mu.Lock()
+		if s.errorDialog == w {
+			s.errorDialog = nil
+		}
+		s.forgetWindowLocked(w)
+		s.mu.Unlock()
+	})
+	s.armReady(w)
+	return w
+}
+
+func (s *WindowManager) CloseError() {
+	s.closeWindow(windowError, &s.errorDialog, closeOnly)
+}
+
+// OpenMain brings the main window forward; the welcome handoff uses it instead of the tray.
+func (s *WindowManager) OpenMain() {
+	s.ShowMain()
+}
+
+// ShowMain brings the main window forward (re-centering on minimal WMs). The single entry
+// point every surface (tray, SIGUSR1, welcome) should use so centering applies uniformly.
+func (s *WindowManager) ShowMain() {
+	s.ensureMain("/", func(w *application.WebviewWindow, _ bool) {
+		s.showWhenReady(w)
+	})
+}
+
+// ShowMainAndEmit brings the main window forward and emits event once its frontend is ready.
+func (s *WindowManager) ShowMainAndEmit(event string) {
+	s.ensureMain("/", func(w *application.WebviewWindow, _ bool) {
+		id := w.ID()
+		s.mu.Lock()
+		mounted := s.mounted[id]
+		if !mounted {
+			s.pendingEmits[id] = append(s.pendingEmits[id], event)
+		}
+		s.mu.Unlock()
+
+		s.showWhenReady(w)
+		if mounted {
+			s.app.Event.Emit(event)
+		}
+	})
+}
+
+func (s *WindowManager) MainWindow() *application.WebviewWindow {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.mainWindow
+}
+
+func (s *WindowManager) ensureMain(startURL string, op windowOp) {
+	s.mu.Lock()
+	factory := s.newMain
+	s.mu.Unlock()
+	if factory == nil {
+		s.withWindow(windowMain, &s.mainWindow, nil, op)
+		return
+	}
+	s.withWindow(windowMain, &s.mainWindow, func() *application.WebviewWindow {
+		w := factory(startURL)
+		s.armReady(w)
+		return w
+	}, op)
+}
+
+func (s *WindowManager) withWindow(name string, slot **application.WebviewWindow, factory func() *application.WebviewWindow, op windowOp) {
+	s.mu.Lock()
+	if s.creating[name] {
+		s.pendingOps[name] = append(s.pendingOps[name], op)
+		s.mu.Unlock()
+		return
+	}
+	if w := *slot; w != nil {
+		s.mu.Unlock()
+		op(w, false)
+		return
+	}
+	if factory == nil {
+		s.mu.Unlock()
+		return
+	}
+	s.creating[name] = true
+	s.mu.Unlock()
+
+	w := s.createWindow(name, slot, factory)
+	if w == nil {
+		return
+	}
+	s.finishCreation(name, slot, w, op)
+}
+
+func (s *WindowManager) createWindow(name string, slot **application.WebviewWindow, factory func() *application.WebviewWindow) *application.WebviewWindow {
+	created := false
+	defer func() {
+		if created {
+			return
+		}
+		s.mu.Lock()
+		s.releaseCreationLocked(name)
+		s.mu.Unlock()
+	}()
+
+	w := factory()
+	if w == nil {
+		return nil
+	}
+	s.mu.Lock()
+	*slot = w
+	s.mu.Unlock()
+	created = true
+	return w
+}
+
+func (s *WindowManager) finishCreation(name string, slot **application.WebviewWindow, w *application.WebviewWindow, op windowOp) {
+	finished := false
+	defer func() {
+		if finished {
+			return
+		}
+		s.mu.Lock()
+		s.releaseCreationLocked(name)
+		s.mu.Unlock()
+	}()
+
+	created := true
+	for {
+		s.mu.Lock()
+		if closer := s.pendingClose[name]; closer != nil {
+			if *slot == w {
+				*slot = nil
+			}
+			s.releaseCreationLocked(name)
+			finished = true
+			s.mu.Unlock()
+			closer(w)
+			return
+		}
+		var next windowOp
+		switch {
+		case created:
+			next = op
+		case len(s.pendingOps[name]) > 0:
+			next = s.pendingOps[name][0]
+			s.pendingOps[name] = s.pendingOps[name][1:]
+		default:
+			s.releaseCreationLocked(name)
+			finished = true
+			s.mu.Unlock()
+			return
+		}
+		s.mu.Unlock()
+		next(w, created)
+		created = false
+	}
+}
+
+func (s *WindowManager) closeWindow(name string, slot **application.WebviewWindow, closer windowCloser) {
+	s.mu.Lock()
+	w := s.takeWindowLocked(name, slot, closer)
+	s.mu.Unlock()
+	if w != nil {
+		closer(w)
+	}
+}
+
+func (s *WindowManager) takeWindowLocked(name string, slot **application.WebviewWindow, closer windowCloser) *application.WebviewWindow {
+	if s.creating[name] {
+		if s.pendingClose[name] == nil {
+			s.pendingClose[name] = closer
+		}
+		return nil
+	}
+	w := *slot
+	*slot = nil
+	return w
+}
+
+func (s *WindowManager) releaseCreationLocked(name string) {
+	delete(s.creating, name)
+	delete(s.pendingOps, name)
+	delete(s.pendingClose, name)
+}
+
+func (s *WindowManager) restoringCloser(owner string) windowCloser {
+	return func(w *application.WebviewWindow) {
+		s.restoreHiddenWindows(owner)
+		w.Close()
+	}
+}
+
+// armReady starts the fallback that shows w even if its frontend never reports a first
+// render. The timer starts at creation, because a hidden webview can be suspended before
+// it reaches WindowRuntimeReady — the very case this fallback covers. That makes the first
+// budget cover webview boot as well, so the runtime-ready hook rearms it to give the
+// frontend its own full budget to mount and paint.
+func (s *WindowManager) armReady(w *application.WebviewWindow) {
+	if w == nil {
+		return
+	}
+	s.armPaintedFallback(w)
+	w.RegisterHook(events.Common.WindowRuntimeReady, func(_ *application.WindowEvent) {
+		s.armPaintedFallback(w)
+	})
+}
+
+func (s *WindowManager) armPaintedFallback(w *application.WebviewWindow) {
+	id := w.ID()
+	timer := time.AfterFunc(paintedFallback, func() {
+		s.mu.Lock()
+		painted := s.painted[id]
+		s.mu.Unlock()
+		if painted {
+			return
+		}
+		log.Warnf("window %q never reported a first render, showing it anyway", w.Name())
+		s.markPainted(w)
+	})
+
+	s.mu.Lock()
+	if prev := s.fallbackTimers[id]; prev != nil {
+		prev.Stop()
+	}
+	if s.painted[id] {
+		timer.Stop()
+		delete(s.fallbackTimers, id)
+	} else {
+		s.fallbackTimers[id] = timer
+	}
+	s.mu.Unlock()
+}
+
+func (s *WindowManager) watchPainted() {
+	s.app.Event.On(EventWindowPainted, func(e *application.CustomEvent) {
+		w := s.windowByName(e.Sender)
+		if w == nil {
+			return
+		}
+		if !s.matchesGeneration(e.Sender, paintedGeneration(e.Data)) {
+			log.Debugf("ignoring stale painted report for window %q", e.Sender)
+			return
+		}
+		s.markPainted(w)
+		s.markMounted(w)
+	})
+}
+
+func (s *WindowManager) watchTriggerLogin() {
+	s.app.Event.On(EventTriggerLogin, func(_ *application.CustomEvent) {
+		s.mu.Lock()
+		if s.headlessTimer != nil {
+			s.headlessTimer.Stop()
+			s.headlessTimer = nil
+		}
+		w := s.mainWindow
+		ready := w != nil && s.mounted[w.ID()]
+		s.mu.Unlock()
+		if ready {
+			return
+		}
+
+		s.ensureMain("/", func(w *application.WebviewWindow, created bool) {
+			s.mu.Lock()
+			if created {
+				s.headlessMain = true
+			}
+			pending := !s.mounted[w.ID()]
+			if pending {
+				s.pendingEmits[w.ID()] = append(s.pendingEmits[w.ID()], EventTriggerLogin)
+			}
+			s.mu.Unlock()
+
+			if !pending {
+				s.app.Event.Emit(EventTriggerLogin)
+			}
+		})
+	})
+
+	s.app.Event.On(EventBrowserLoginCancel, func(_ *application.CustomEvent) {
+		s.scheduleHeadlessTeardown()
+	})
+
+	s.app.Event.On(EventStatusSnapshot, func(e *application.CustomEvent) {
+		st, ok := e.Data.(Status)
+		if !ok {
+			return
+		}
+		switch st.Status {
+		case StatusConnected, StatusLoginFailed, StatusDaemonUnavailable:
+			s.scheduleHeadlessTeardown()
+		}
+	})
+}
+
+func (s *WindowManager) scheduleHeadlessTeardown() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if !s.headlessMain || s.mainWindow == nil {
+		return
+	}
+	if s.headlessTimer != nil {
+		s.headlessTimer.Stop()
+	}
+	s.headlessTimer = time.AfterFunc(headlessTeardownDelay, s.closeHeadlessMain)
+}
+
+func (s *WindowManager) closeHeadlessMain() {
+	s.mu.Lock()
+	w := s.mainWindow
+	headless := s.headlessMain
+	s.headlessTimer = nil
+	s.mu.Unlock()
+	if !headless || w == nil {
+		return
+	}
+	w.Close()
+}
+
+func (s *WindowManager) forgetWindowLocked(w *application.WebviewWindow) {
+	if w == nil {
+		return
+	}
+
+	id := w.ID()
+	if timer := s.fallbackTimers[id]; timer != nil {
+		timer.Stop()
+	}
+	delete(s.fallbackTimers, id)
+	delete(s.painted, id)
+	delete(s.mounted, id)
+	delete(s.showPending, id)
+	delete(s.pendingTab, id)
+	delete(s.pendingEmits, id)
+	delete(s.afterShow, id)
+
+	kept := s.hiddenWindows[:0]
+	for _, hidden := range s.hiddenWindows {
+		if !sameWindow(hidden.win, w) {
+			kept = append(kept, hidden)
+		}
+	}
+	s.hiddenWindows = kept
+}
+
+func (s *WindowManager) stampGeneration(name, startURL string) string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.lastGeneration++
+	s.generation[name] = s.lastGeneration
+	return appendGeneration(startURL, s.lastGeneration)
+}
+
+func (s *WindowManager) matchesGeneration(name string, gen uint64) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	want, tracked := s.generation[name]
+	if !tracked {
+		return true
+	}
+	return want == gen
+}
+
+func (s *WindowManager) hideableWindows() []hideableWindow {
+	if s.allWindows != nil {
+		return s.allWindows()
+	}
+	all := s.app.Window.GetAll()
+	windows := make([]hideableWindow, 0, len(all))
+	for _, w := range all {
+		windows = append(windows, w)
+	}
+	return windows
+}
+
+func (s *WindowManager) isMainWindow(w hideableWindow, mainWindow *application.WebviewWindow) bool {
+	if s.allWindows != nil {
+		return w != nil && w.Name() == windowMain
+	}
+	return sameWindow(w, mainWindow)
+}
+
+func (s *WindowManager) raiseMainWindow(mainWindow *application.WebviewWindow) {
+	if s.raiseMain != nil {
+		s.raiseMain()
+		return
+	}
+	if mainWindow != nil {
+		raiseToForeground(mainWindow)
+	}
+}
+
+func (s *WindowManager) windowByName(name string) *application.WebviewWindow {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	switch name {
+	case windowMain:
+		return s.mainWindow
+	case windowSettings:
+		return s.settings
+	case windowBrowserLogin:
+		return s.browserLogin
+	case windowSessionExpiration:
+		return s.sessionExpiration
+	case windowInstallProgress:
+		return s.installProgress
+	case windowWelcome:
+		return s.welcome
+	case windowError:
+		return s.errorDialog
+	default:
+		return nil
+	}
+}
+
+func (s *WindowManager) markPainted(w *application.WebviewWindow) {
+	id := w.ID()
+	s.mu.Lock()
+	already := s.painted[id]
+	s.painted[id] = true
+	wanted := s.showPending[id]
+	delete(s.showPending, id)
+	if timer := s.fallbackTimers[id]; timer != nil {
+		timer.Stop()
+		delete(s.fallbackTimers, id)
+	}
+	s.mu.Unlock()
+
+	if already || !wanted {
+		return
+	}
+	s.showNow(w)
+}
+
+// markMounted records that the window's frontend is subscribed, and flushes the events
+// held back for it. The fallback timer never calls this: showing a blank window is
+// recoverable, emitting into a frontend that cannot hear it is not.
+func (s *WindowManager) markMounted(w *application.WebviewWindow) {
+	id := w.ID()
+	s.mu.Lock()
+	already := s.mounted[id]
+	s.mounted[id] = true
+	tab, hasTab := s.pendingTab[id]
+	emits := s.pendingEmits[id]
+	delete(s.pendingTab, id)
+	delete(s.pendingEmits, id)
+	s.mu.Unlock()
+
+	if already {
+		return
+	}
+
+	if hasTab {
+		s.app.Event.Emit(EventSettingsOpen, tab)
+	}
+
+	for _, event := range emits {
+		s.app.Event.Emit(event)
+	}
+}
+
+func (s *WindowManager) showWhenReady(w *application.WebviewWindow) {
+	if w == nil {
+		return
+	}
+
+	id := w.ID()
+	s.mu.Lock()
+	painted := s.painted[id]
+	if !painted {
+		s.showPending[id] = true
+	}
+	s.mu.Unlock()
+
+	if painted {
+		s.showNow(w)
+	}
+}
+
+func (s *WindowManager) showNow(w *application.WebviewWindow) {
+	id := w.ID()
+	s.mu.Lock()
+	if w == s.mainWindow {
+		s.headlessMain = false
+		if s.headlessTimer != nil {
+			s.headlessTimer.Stop()
+			s.headlessTimer = nil
+		}
+	}
+	after := s.afterShow[id]
+	delete(s.afterShow, id)
+	s.mu.Unlock()
+	w.Show()
+	w.Focus()
+	s.centerWhenReady(w)
+	if after != nil {
+		after()
+	}
+}
+
+func (s *WindowManager) ShowMainAt(url string) {
+	s.ensureMain(url, func(w *application.WebviewWindow, created bool) {
+		if !created {
+			w.SetURL(url)
+		}
+		s.showWhenReady(w)
+	})
+}
+
+func (s *WindowManager) SetMainFactory(f func(startURL string) *application.WebviewWindow) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.newMain = f
+}
+
+func (s *WindowManager) ForgetMain() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.forgetWindowLocked(s.mainWindow)
+	s.mainWindow = nil
+	s.headlessMain = false
+	if s.headlessTimer != nil {
+		s.headlessTimer.Stop()
+		s.headlessTimer = nil
+	}
+}
+
+// SetRecenterOnShow installs the recenterOnShow predicate (see the field).
+func (s *WindowManager) SetRecenterOnShow(pred func() bool) {
+	s.recenterOnShow = pred
+}
+
+// centerWhenReady centers w only on minimal WMs (recenterOnShow); elsewhere it
+// returns so it never fights a user-moved window. On GTK4 an inline Center()
+// no-ops until the GdkSurface is realized (async, after Show) and InvokeAsync
+// would deadlock, so a background goroutine retries until Position is non-zero,
+// bounded so a window genuinely at the origin can't spin forever.
+func (s *WindowManager) centerWhenReady(w *application.WebviewWindow) {
+	if w == nil || s.recenterOnShow == nil || !s.recenterOnShow() {
+		return
+	}
+	go func() {
+		for i := 0; i < 50; i++ { // ~1s budget at 20ms steps
+			w.Center()
+			if x, y := w.Position(); x != 0 || y != 0 {
+				return // surface realized
+			}
+			time.Sleep(20 * time.Millisecond)
+		}
+	}()
+}
+
+// centerOnCursorScreen centers w on the cursor's display; guards no-op on headless sessions.
+// On minimal WMs it uses the same realize-detection retry loop as centerWhenReady.
+func (s *WindowManager) centerOnCursorScreen(w *application.WebviewWindow) {
+	if w == nil {
+		return
+	}
+	place := func() {
+		screen := s.getScreenBasedOnCursorPosition()
+		if screen == nil {
+			return
+		}
+		width, height := w.Size()
+		if width <= 0 || height <= 0 {
+			return
+		}
+		wa := screen.WorkArea
+		if wa.Width <= 0 || wa.Height <= 0 {
+			return
+		}
+		w.SetPosition(wa.X+(wa.Width-width)/2, wa.Y+(wa.Height-height)/2)
+	}
+	place()
+	if s.recenterOnShow == nil || !s.recenterOnShow() {
+		return
+	}
+	go func() {
+		for i := 0; i < 50; i++ {
+			place()
+			if x, y := w.Position(); x != 0 || y != 0 {
+				return
+			}
+			time.Sleep(20 * time.Millisecond)
+		}
+	}()
+}
+
+// title resolves a window-title i18n key in the current language, or the raw key if unavailable.
+func (s *WindowManager) title(key string) string {
+	if s.translator == nil {
+		return key
+	}
+	lang := i18n.DefaultLanguage
+	if s.prefs != nil {
+		if pref := s.prefs.Get().Language; pref != "" {
+			lang = pref
+		}
+	}
+	return s.translator.Translate(lang, key)
+}
+
+// retitleAll re-applies the localised title to every live auxiliary window. Pointers are
+// snapshotted under s.mu; SetTitle is then safe to call after releasing the lock.
+func (s *WindowManager) retitleAll() {
+	s.mu.Lock()
+	type pair struct {
+		win *application.WebviewWindow
+		key string
+	}
+	wins := []pair{
+		{s.settings, "window.title.settings"},
+		{s.browserLogin, "window.title.signIn"},
+		{s.sessionExpiration, "window.title.sessionExpiration"},
+		{s.installProgress, "window.title.updating"},
+		{s.welcome, "window.title.welcome"},
+		{s.errorDialog, "window.title.error"},
+	}
+	s.mu.Unlock()
+	for _, p := range wins {
+		if p.win != nil {
+			p.win.SetTitle(s.title(p.key))
+		}
+	}
+}
+
+// hideOtherWindows hides every visible window except keepName, recording them against
+// keepName so only its own restore brings them back. A window already hidden by an
+// earlier popup is skipped, leaving it tagged to the popup that actually hid it. The
+// per-owner generation catches a restore for keepName that ran between the snapshot and
+// the record, in which case the windows are re-shown rather than stranded.
+func (s *WindowManager) hideOtherWindows(keepName string) {
+	s.mu.Lock()
+	s.hiding[keepName] = true
+	gen := s.restoreGen[keepName]
+	s.mu.Unlock()
+
+	var hidden []hideableWindow
+	for _, w := range s.hideableWindows() {
+		if w == nil || w.Name() == keepName || !w.IsVisible() {
+			continue
+		}
+		w.Hide()
+		hidden = append(hidden, w)
+	}
+	if len(hidden) == 0 {
+		return
+	}
+
+	s.mu.Lock()
+	restored := s.restoreGen[keepName] != gen
+	if !restored {
+		for _, w := range hidden {
+			s.hiddenWindows = append(s.hiddenWindows, hiddenWindow{win: w, owner: keepName})
+		}
+	}
+	s.mu.Unlock()
+	if !restored {
+		return
+	}
+	for _, w := range hidden {
+		w.Show()
+	}
+}
+
+// restoreHiddenWindows re-shows the windows owner hid, unless another popup still covers
+// them, in which case they are handed to that popup. If the main window was among them,
+// raiseToForeground lifts it above the SSO browser, which still owns the foreground — a
+// plain Show/Focus would be demoted to a taskbar flash and leave it stranded behind.
+func (s *WindowManager) restoreHiddenWindows(owner string) {
+	s.mu.Lock()
+	mainWindow := s.mainWindow
+	delete(s.hiding, owner)
+	var restore []hideableWindow
+	kept := s.hiddenWindows[:0]
+	for _, hidden := range s.hiddenWindows {
+		if hidden.owner != owner {
+			kept = append(kept, hidden)
+			continue
+		}
+		if coverer, covered := s.coveringPopupLocked(hidden.win); covered {
+			hidden.owner = coverer
+			kept = append(kept, hidden)
+			continue
+		}
+		if hidden.win != nil {
+			restore = append(restore, hidden.win)
+		}
+	}
+	s.hiddenWindows = kept
+	s.restoreGen[owner]++
+	s.mu.Unlock()
+
+	mainRestored := false
+	for _, w := range restore {
+		w.Show()
+		if s.isMainWindow(w, mainWindow) {
+			mainRestored = true
+		}
+	}
+	if mainRestored {
+		s.raiseMainWindow(mainWindow)
+	}
+}
+
+func (s *WindowManager) coveringPopupLocked(w hideableWindow) (string, bool) {
+	if w == nil {
+		return "", false
+	}
+	for name := range s.hiding {
+		if name != w.Name() {
+			return name, true
+		}
+	}
+	return "", false
+}
+
+// getScreenBasedOnCursorPosition returns the cursor's display, falling back to the
+// main-window screen, then nil (OS-default placement).
+func (s *WindowManager) getScreenBasedOnCursorPosition() *application.Screen {
+	if s.app == nil || s.app.Screen == nil {
+		return nil
+	}
+	if p, ok := getCursorPosition(s.app); ok {
+		if sc := s.app.Screen.ScreenNearestDipPoint(p); sc != nil {
+			return sc
+		}
+	}
+	s.mu.Lock()
+	mainWindow := s.mainWindow
+	s.mu.Unlock()
+	if mainWindow != nil {
+		if sc, err := mainWindow.GetScreen(); err == nil {
+			return sc
+		}
+	}
+	return nil
+}
+
+// errorDialogURL builds the error window's start URL with title/message/command as escaped query params.
+func errorDialogURL(title, message, command string) string {
+	q := url.Values{}
+	if title != "" {
+		q.Set("title", title)
+	}
+	if message != "" {
+		q.Set("message", message)
+	}
+	if command != "" {
+		q.Set("command", command)
+	}
+	startURL := "/#/dialog/error"
+	if enc := q.Encode(); enc != "" {
+		startURL += "?" + enc
+	}
+	return startURL
+}
+
+// appendGeneration adds the painted-report token to a dialog start URL, keeping any
+// existing query params intact across the "/#/path?params" hash-router form.
+func appendGeneration(startURL string, gen uint64) string {
+	sep := "?"
+	if strings.Contains(startURL, "?") {
+		sep = "&"
+	}
+	return startURL + sep + generationParam + "=" + strconv.FormatUint(gen, 10)
+}
+
+// paintedGeneration reads the token a painted report carries back, returning 0 when the
+// frontend sent none (an older bundle, or the main window, which is never stamped).
+func paintedGeneration(data any) uint64 {
+	switch v := data.(type) {
+	case string:
+		gen, err := strconv.ParseUint(v, 10, 64)
+		if err != nil {
+			return 0
+		}
+		return gen
+	case float64:
+		return uint64(v)
+	case []any:
+		if len(v) == 0 {
+			return 0
+		}
+		return paintedGeneration(v[0])
+	default:
+		return 0
+	}
+}
+
+// sameWindow reports whether a hidden entry refers to w, comparing through the interface
+// so a nil entry never matches a live window.
+func sameWindow(hidden hideableWindow, w *application.WebviewWindow) bool {
+	if hidden == nil || w == nil {
+		return false
+	}
+	other, ok := hidden.(*application.WebviewWindow)
+	return ok && other == w
+}
+
+// u32ptr returns a pointer to v, for the optional *uint32 Wails theme fields.
+func u32ptr(v uint32) *uint32 { return &v }
+
+func closeOnly(w *application.WebviewWindow) { w.Close() }
diff --git a/client/ui/services/windowmanager_test.go b/client/ui/services/windowmanager_test.go
new file mode 100644
index 000000000..890fba24f
--- /dev/null
+++ b/client/ui/services/windowmanager_test.go
@@ -0,0 +1,639 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"fmt"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"github.com/wailsapp/wails/v3/pkg/application"
+)
+
+func newTestWindowManager() *WindowManager {
+	return &WindowManager{
+		creating:     map[string]bool{},
+		pendingOps:   map[string][]windowOp{},
+		pendingClose: map[string]windowCloser{},
+		restoreGen:   map[string]uint64{},
+		hiding:       map[string]bool{},
+		generation:   map[string]uint64{},
+	}
+}
+
+type fakeWindow struct {
+	name    string
+	visible bool
+	shown   int
+	hidden  int
+}
+
+func newFakeWindow(name string) *fakeWindow {
+	return &fakeWindow{name: name, visible: true}
+}
+
+func (f *fakeWindow) Show() application.Window {
+	f.visible = true
+	f.shown++
+	return nil
+}
+
+func (f *fakeWindow) Hide() application.Window {
+	f.visible = false
+	f.hidden++
+	return nil
+}
+
+func (f *fakeWindow) IsVisible() bool { return f.visible }
+
+func (f *fakeWindow) Name() string { return f.name }
+
+type fakeDesktop struct {
+	windows []*fakeWindow
+	raised  int
+}
+
+func newFakeDesktop(s *WindowManager, windows ...*fakeWindow) *fakeDesktop {
+	d := &fakeDesktop{windows: windows}
+	s.allWindows = func() []hideableWindow {
+		all := make([]hideableWindow, 0, len(d.windows))
+		for _, w := range d.windows {
+			all = append(all, w)
+		}
+		return all
+	}
+	s.raiseMain = func() { d.raised++ }
+	return d
+}
+
+func ownersOf(hidden []hiddenWindow) []string {
+	owners := make([]string, 0, len(hidden))
+	for _, h := range hidden {
+		owners = append(owners, h.owner)
+	}
+	return owners
+}
+
+func waitDone(t *testing.T, done <-chan struct{}, msg string) {
+	t.Helper()
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal(msg)
+	}
+}
+
+func TestWithWindowReusesExistingWindow(t *testing.T) {
+	s := newTestWindowManager()
+	existing := &application.WebviewWindow{}
+	slot := existing
+	factoryCalls := 0
+	var got *application.WebviewWindow
+	created := true
+	s.withWindow(windowMain, &slot, func() *application.WebviewWindow {
+		factoryCalls++
+		return &application.WebviewWindow{}
+	}, func(w *application.WebviewWindow, c bool) {
+		got, created = w, c
+	})
+	require.Equal(t, 0, factoryCalls)
+	require.Same(t, existing, got)
+	require.False(t, created)
+}
+
+func TestWithWindowNilFactoryWithoutWindowSkipsOp(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	opCalls := 0
+	s.withWindow(windowMain, &slot, nil, func(*application.WebviewWindow, bool) {
+		opCalls++
+	})
+	require.Equal(t, 0, opCalls)
+	require.Nil(t, slot)
+}
+
+func TestWithWindowReentrantCallDuringCreationIsQueued(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	factoryCalls := 0
+	var order []string
+	var factory func() *application.WebviewWindow
+	factory = func() *application.WebviewWindow {
+		factoryCalls++
+		// Simulates the Windows message pump re-entering the tray click handler
+		// while WebView2 is still initialising the window being created.
+		s.withWindow(windowMain, &slot, factory, func(_ *application.WebviewWindow, created bool) {
+			order = append(order, fmt.Sprintf("reentrant:%v", created))
+		})
+		return &application.WebviewWindow{}
+	}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		s.withWindow(windowMain, &slot, factory, func(_ *application.WebviewWindow, created bool) {
+			order = append(order, fmt.Sprintf("outer:%v", created))
+		})
+	}()
+	waitDone(t, done, "withWindow deadlocked on a re-entrant call during creation")
+
+	require.Equal(t, 1, factoryCalls)
+	require.Equal(t, []string{"outer:true", "reentrant:false"}, order)
+	require.NotNil(t, slot)
+	require.Empty(t, s.creating)
+	require.Empty(t, s.pendingOps)
+}
+
+func TestWithWindowConcurrentCallersShareOneCreation(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	factoryEntered := make(chan struct{})
+	release := make(chan struct{})
+	var factoryCalls, opCalls atomic.Int32
+	factory := func() *application.WebviewWindow {
+		factoryCalls.Add(1)
+		close(factoryEntered)
+		<-release
+		return &application.WebviewWindow{}
+	}
+	op := func(*application.WebviewWindow, bool) { opCalls.Add(1) }
+
+	first := make(chan struct{})
+	go func() {
+		defer close(first)
+		s.withWindow(windowSettings, &slot, factory, op)
+	}()
+	<-factoryEntered
+
+	second := make(chan struct{})
+	go func() {
+		defer close(second)
+		s.withWindow(windowSettings, &slot, factory, op)
+	}()
+	waitDone(t, second, "second caller blocked while the window was being created")
+	require.Equal(t, int32(0), opCalls.Load())
+
+	close(release)
+	waitDone(t, first, "creator did not finish")
+
+	require.Equal(t, int32(1), factoryCalls.Load())
+	require.Equal(t, int32(2), opCalls.Load())
+	require.NotNil(t, slot)
+}
+
+func TestWithWindowOpsQueuedDuringCreationRunInArrivalOrder(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	var order []string
+	record := func(label string) windowOp {
+		return func(_ *application.WebviewWindow, created bool) {
+			order = append(order, fmt.Sprintf("%s:%v", label, created))
+		}
+	}
+	var factory func() *application.WebviewWindow
+	factory = func() *application.WebviewWindow {
+		s.withWindow(windowMain, &slot, factory, func(w *application.WebviewWindow, created bool) {
+			record("a")(w, created)
+			// Arrives while the creator is still draining the queue: it must not
+			// jump ahead of "b" through the existing-window fast path.
+			s.withWindow(windowMain, &slot, factory, record("c"))
+		})
+		s.withWindow(windowMain, &slot, factory, record("b"))
+		return &application.WebviewWindow{}
+	}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		s.withWindow(windowMain, &slot, factory, record("outer"))
+	}()
+	waitDone(t, done, "withWindow deadlocked while draining queued operations")
+
+	require.Equal(t, []string{"outer:true", "a:false", "b:false", "c:false"}, order)
+	require.Empty(t, s.creating)
+	require.Empty(t, s.pendingOps)
+}
+
+func TestWithWindowFactoryPanicReleasesCreation(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	func() {
+		defer func() { require.NotNil(t, recover()) }()
+		s.withWindow(windowMain, &slot, func() *application.WebviewWindow {
+			panic("factory failed")
+		}, func(*application.WebviewWindow, bool) {})
+	}()
+	require.Empty(t, s.creating)
+	require.Empty(t, s.pendingOps)
+	require.Nil(t, slot)
+
+	created := false
+	s.withWindow(windowMain, &slot, func() *application.WebviewWindow {
+		return &application.WebviewWindow{}
+	}, func(_ *application.WebviewWindow, c bool) {
+		created = c
+	})
+	require.True(t, created)
+	require.NotNil(t, slot)
+}
+
+func TestWithWindowNilFromFactoryReleasesCreation(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	opCalls := 0
+	s.withWindow(windowMain, &slot, func() *application.WebviewWindow {
+		return nil
+	}, func(*application.WebviewWindow, bool) {
+		opCalls++
+	})
+	require.Equal(t, 0, opCalls)
+	require.Empty(t, s.creating)
+	require.Nil(t, slot)
+}
+
+func TestCloseWindowDuringCreationDefersCloseAndSkipsOps(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	created := &application.WebviewWindow{}
+	opCalls, closeCalls := 0, 0
+	var closed *application.WebviewWindow
+	s.withWindow(windowError, &slot, func() *application.WebviewWindow {
+		s.closeWindow(windowError, &slot, func(w *application.WebviewWindow) {
+			closeCalls++
+			closed = w
+		})
+		require.Equal(t, 0, closeCalls)
+		return created
+	}, func(*application.WebviewWindow, bool) {
+		opCalls++
+	})
+	require.Equal(t, 0, opCalls)
+	require.Equal(t, 1, closeCalls)
+	require.Same(t, created, closed)
+	require.Nil(t, slot)
+	require.Empty(t, s.creating)
+	require.Empty(t, s.pendingOps)
+	require.Empty(t, s.pendingClose)
+
+	factoryCalls := 0
+	reopened := false
+	s.withWindow(windowError, &slot, func() *application.WebviewWindow {
+		factoryCalls++
+		return &application.WebviewWindow{}
+	}, func(_ *application.WebviewWindow, c bool) {
+		reopened = c
+	})
+	require.Equal(t, 1, factoryCalls)
+	require.True(t, reopened)
+	require.NotNil(t, slot)
+}
+
+func TestCloseWindowDuringDrainStopsRemainingOps(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	var order []string
+	closeCalls := 0
+	var factory func() *application.WebviewWindow
+	factory = func() *application.WebviewWindow {
+		s.withWindow(windowWelcome, &slot, factory, func(*application.WebviewWindow, bool) {
+			order = append(order, "a")
+			s.closeWindow(windowWelcome, &slot, func(*application.WebviewWindow) { closeCalls++ })
+			s.withWindow(windowWelcome, &slot, factory, func(*application.WebviewWindow, bool) {
+				order = append(order, "c")
+			})
+		})
+		s.withWindow(windowWelcome, &slot, factory, func(*application.WebviewWindow, bool) {
+			order = append(order, "b")
+		})
+		return &application.WebviewWindow{}
+	}
+	s.withWindow(windowWelcome, &slot, factory, func(*application.WebviewWindow, bool) {
+		order = append(order, "outer")
+	})
+
+	// "b" was queued before the close and "c" after it; a close supersedes both
+	// rather than showing a window that is about to be destroyed.
+	require.Equal(t, []string{"outer", "a"}, order)
+	require.Equal(t, 1, closeCalls)
+	require.Nil(t, slot)
+	require.Empty(t, s.creating)
+	require.Empty(t, s.pendingOps)
+	require.Empty(t, s.pendingClose)
+}
+
+func TestCloseWindowWithoutWindowSkipsCloser(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	calls := 0
+	s.closeWindow(windowBrowserLogin, &slot, func(*application.WebviewWindow) { calls++ })
+	require.Equal(t, 0, calls)
+	require.Nil(t, slot)
+	require.Empty(t, s.pendingClose)
+}
+
+func TestCloseWindowWithExistingWindowRunsCloser(t *testing.T) {
+	s := newTestWindowManager()
+	existing := &application.WebviewWindow{}
+	slot := existing
+	var got *application.WebviewWindow
+	s.closeWindow(windowError, &slot, func(w *application.WebviewWindow) { got = w })
+	require.Same(t, existing, got)
+	require.Nil(t, slot)
+	require.Empty(t, s.pendingClose)
+}
+
+func TestWithWindowNilFromFactoryDropsPendingClose(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	closeCalls := 0
+	s.withWindow(windowError, &slot, func() *application.WebviewWindow {
+		s.closeWindow(windowError, &slot, func(*application.WebviewWindow) { closeCalls++ })
+		return nil
+	}, func(*application.WebviewWindow, bool) {})
+	require.Equal(t, 0, closeCalls)
+	require.Nil(t, slot)
+	require.Empty(t, s.creating)
+	require.Empty(t, s.pendingClose)
+}
+
+func TestWithWindowFactoryPanicDropsPendingClose(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	closeCalls := 0
+	func() {
+		defer func() { require.NotNil(t, recover()) }()
+		s.withWindow(windowError, &slot, func() *application.WebviewWindow {
+			s.closeWindow(windowError, &slot, func(*application.WebviewWindow) { closeCalls++ })
+			panic("factory failed")
+		}, func(*application.WebviewWindow, bool) {})
+	}()
+	require.Equal(t, 0, closeCalls)
+	require.Empty(t, s.creating)
+	require.Empty(t, s.pendingClose)
+}
+
+func TestCloseWindowKeepsFirstDeferredCloser(t *testing.T) {
+	s := newTestWindowManager()
+	var slot *application.WebviewWindow
+	var ran []string
+	s.withWindow(windowError, &slot, func() *application.WebviewWindow {
+		s.closeWindow(windowError, &slot, func(*application.WebviewWindow) { ran = append(ran, "first") })
+		s.closeWindow(windowError, &slot, func(*application.WebviewWindow) { ran = append(ran, "second") })
+		return &application.WebviewWindow{}
+	}, func(*application.WebviewWindow, bool) {})
+	require.Equal(t, []string{"first"}, ran)
+	require.Nil(t, slot)
+	require.Empty(t, s.pendingClose)
+}
+
+func TestCloseRenewFlowDuringBrowserLoginCreationRestoresHiddenWindows(t *testing.T) {
+	s := newTestWindowManager()
+	s.withWindow(windowBrowserLogin, &s.browserLogin, func() *application.WebviewWindow {
+		s.CloseRenewFlow()
+		// Seeded after the call so the deferred closer, not CloseRenewFlow's own
+		// immediate restore, is what has to drain it. A nil entry is skipped by
+		// restoreHiddenWindows, so no Wails window is needed.
+		s.hiddenWindows = []hiddenWindow{{owner: windowBrowserLogin}}
+		return &application.WebviewWindow{}
+	}, func(*application.WebviewWindow, bool) {})
+
+	require.Nil(t, s.browserLogin)
+	require.Empty(t, s.hiddenWindows)
+	require.Empty(t, s.creating)
+	require.Empty(t, s.pendingClose)
+}
+
+func TestHideOtherWindowsSkipsKeepNameAndInvisible(t *testing.T) {
+	main := newFakeWindow(windowMain)
+	settings := newFakeWindow(windowSettings)
+	settings.visible = false
+	popup := newFakeWindow(windowBrowserLogin)
+	s := newTestWindowManager()
+	newFakeDesktop(s, main, settings, popup)
+
+	s.hideOtherWindows(windowBrowserLogin)
+
+	require.False(t, main.visible)
+	require.Equal(t, 1, main.hidden)
+	require.Equal(t, 0, settings.hidden, "an already hidden window must not be recorded")
+	require.Equal(t, 0, popup.hidden, "the popup itself must stay visible")
+	require.Equal(t, []string{windowBrowserLogin}, ownersOf(s.hiddenWindows))
+}
+
+func TestInstallDuringLoginKeepsMainHiddenUntilLoginCloses(t *testing.T) {
+	main := newFakeWindow(windowMain)
+	login := newFakeWindow(windowBrowserLogin)
+	install := newFakeWindow(windowInstallProgress)
+	install.visible = false
+	s := newTestWindowManager()
+	d := newFakeDesktop(s, main, login, install)
+
+	s.hideOtherWindows(windowBrowserLogin)
+	require.False(t, main.visible)
+
+	install.visible = true
+	s.hideOtherWindows(windowInstallProgress)
+	require.False(t, login.visible, "the install popup hides the login popup")
+
+	s.restoreHiddenWindows(windowInstallProgress)
+	require.True(t, login.visible, "the install popup restores the login popup it hid")
+	require.False(t, main.visible, "the main window stays hidden for the login popup")
+	require.Equal(t, 0, d.raised)
+	require.Equal(t, []string{windowBrowserLogin}, ownersOf(s.hiddenWindows))
+
+	s.restoreHiddenWindows(windowBrowserLogin)
+	require.True(t, main.visible)
+	require.Equal(t, 1, d.raised, "restoring the main window raises it above the SSO browser")
+	require.Empty(t, s.hiddenWindows)
+}
+
+func TestLoginClosingUnderInstallHandsMainToInstall(t *testing.T) {
+	main := newFakeWindow(windowMain)
+	login := newFakeWindow(windowBrowserLogin)
+	install := newFakeWindow(windowInstallProgress)
+	install.visible = false
+	s := newTestWindowManager()
+	d := newFakeDesktop(s, main, login, install)
+
+	s.hideOtherWindows(windowBrowserLogin)
+	install.visible = true
+	s.hideOtherWindows(windowInstallProgress)
+	require.False(t, main.visible)
+	require.False(t, login.visible, "the install popup hides the login popup")
+
+	// The login popup closes while the install popup is still up: the main window it
+	// hid must not resurface under the install popup, it is handed over instead.
+	s.restoreHiddenWindows(windowBrowserLogin)
+	require.False(t, main.visible, "the install popup still covers the main window")
+	require.Equal(t, 0, d.raised)
+	require.Equal(t, []string{windowInstallProgress, windowInstallProgress}, ownersOf(s.hiddenWindows))
+
+	s.restoreHiddenWindows(windowInstallProgress)
+	require.True(t, main.visible, "the install popup restores the handed-over main window")
+	require.Equal(t, 1, d.raised)
+	require.Empty(t, s.hiddenWindows)
+}
+
+func TestInstallClosingUnderLoginHandsMainToLogin(t *testing.T) {
+	main := newFakeWindow(windowMain)
+	install := newFakeWindow(windowInstallProgress)
+	login := newFakeWindow(windowBrowserLogin)
+	login.visible = false
+	s := newTestWindowManager()
+	d := newFakeDesktop(s, main, install, login)
+
+	s.hideOtherWindows(windowInstallProgress)
+	login.visible = true
+	s.hideOtherWindows(windowBrowserLogin)
+	require.False(t, install.visible, "the login popup hides the install popup")
+
+	s.restoreHiddenWindows(windowInstallProgress)
+	require.False(t, main.visible, "the login popup still covers the main window")
+	require.Equal(t, 0, d.raised)
+	require.Equal(t, []string{windowBrowserLogin, windowBrowserLogin}, ownersOf(s.hiddenWindows))
+
+	s.restoreHiddenWindows(windowBrowserLogin)
+	require.True(t, main.visible)
+	require.Equal(t, 1, d.raised)
+	require.Empty(t, s.hiddenWindows)
+}
+
+func TestPopupClosingReshowsTheCoveringPopupItself(t *testing.T) {
+	main := newFakeWindow(windowMain)
+	install := newFakeWindow(windowInstallProgress)
+	login := newFakeWindow(windowBrowserLogin)
+	login.visible = false
+	s := newTestWindowManager()
+	d := newFakeDesktop(s, main, install, login)
+
+	s.hideOtherWindows(windowInstallProgress)
+	login.visible = true
+	s.hideOtherWindows(windowBrowserLogin)
+
+	// The login popup hid the install popup itself; closing the login popup must bring
+	// the install popup back rather than hand it over to its own owner.
+	s.restoreHiddenWindows(windowBrowserLogin)
+	require.True(t, install.visible, "a popup is never handed over to itself")
+	require.False(t, main.visible, "the main window stays with the install popup")
+	require.Equal(t, 0, d.raised)
+	require.Equal(t, []string{windowInstallProgress}, ownersOf(s.hiddenWindows))
+}
+
+func TestRestoreHiddenWindowsUnknownOwnerKeepsEverything(t *testing.T) {
+	main := newFakeWindow(windowMain)
+	s := newTestWindowManager()
+	d := newFakeDesktop(s, main)
+	s.hideOtherWindows(windowBrowserLogin)
+
+	s.restoreHiddenWindows(windowWelcome)
+
+	require.False(t, main.visible)
+	require.Equal(t, []string{windowBrowserLogin}, ownersOf(s.hiddenWindows))
+	require.Equal(t, 0, d.raised)
+}
+
+func TestRestoreHiddenWindowsWithoutMainDoesNotRaise(t *testing.T) {
+	settings := newFakeWindow(windowSettings)
+	s := newTestWindowManager()
+	d := newFakeDesktop(s, settings)
+	s.hideOtherWindows(windowBrowserLogin)
+
+	s.restoreHiddenWindows(windowBrowserLogin)
+
+	require.True(t, settings.visible)
+	require.Equal(t, 0, d.raised)
+}
+
+func TestRestoreHiddenWindowsEmptyIsNoop(t *testing.T) {
+	s := newTestWindowManager()
+	require.NotPanics(t, func() { s.restoreHiddenWindows(windowBrowserLogin) })
+	require.Empty(t, s.hiddenWindows)
+}
+
+func TestHideOtherWindowsRacingOwnRestoreReshowsWhatItHid(t *testing.T) {
+	main := newFakeWindow(windowMain)
+	s := newTestWindowManager()
+	d := newFakeDesktop(s, main)
+	enumerate := s.allWindows
+	// A restore for the same owner lands between the generation snapshot and the record.
+	s.allWindows = func() []hideableWindow {
+		s.restoreHiddenWindows(windowBrowserLogin)
+		return enumerate()
+	}
+
+	s.hideOtherWindows(windowBrowserLogin)
+
+	require.True(t, main.visible)
+	require.Equal(t, 1, main.hidden)
+	require.Empty(t, s.hiddenWindows)
+	require.Equal(t, 0, d.raised)
+}
+
+func TestHideOtherWindowsIgnoresRestoreOfAnotherOwner(t *testing.T) {
+	main := newFakeWindow(windowMain)
+	s := newTestWindowManager()
+	newFakeDesktop(s, main)
+	enumerate := s.allWindows
+	s.allWindows = func() []hideableWindow {
+		s.restoreHiddenWindows(windowInstallProgress)
+		return enumerate()
+	}
+
+	s.hideOtherWindows(windowBrowserLogin)
+
+	require.False(t, main.visible)
+	require.Equal(t, []string{windowBrowserLogin}, ownersOf(s.hiddenWindows))
+}
+
+func TestRestoringCloserRestoresOnlyItsOwner(t *testing.T) {
+	main := newFakeWindow(windowMain)
+	s := newTestWindowManager()
+	newFakeDesktop(s, main)
+	s.hideOtherWindows(windowBrowserLogin)
+	s.hiddenWindows = append(s.hiddenWindows, hiddenWindow{owner: windowInstallProgress})
+
+	s.restoringCloser(windowBrowserLogin)(&application.WebviewWindow{})
+
+	require.True(t, main.visible)
+	require.Equal(t, []string{windowInstallProgress}, ownersOf(s.hiddenWindows))
+}
+
+func TestStampGenerationTracksLatestPerWindow(t *testing.T) {
+	s := newTestWindowManager()
+
+	first := s.stampGeneration(windowBrowserLogin, "/#/dialog/browser-login")
+	require.Equal(t, "/#/dialog/browser-login?gen=1", first)
+	require.True(t, s.matchesGeneration(windowBrowserLogin, 1))
+
+	second := s.stampGeneration(windowBrowserLogin, "/#/dialog/browser-login?uri=x")
+	require.Equal(t, "/#/dialog/browser-login?uri=x&gen=2", second)
+	require.False(t, s.matchesGeneration(windowBrowserLogin, 1))
+	require.True(t, s.matchesGeneration(windowBrowserLogin, 2))
+}
+
+func TestMatchesGenerationUntrackedWindowAccepts(t *testing.T) {
+	s := newTestWindowManager()
+	require.True(t, s.matchesGeneration(windowMain, 0))
+}
+
+func TestPaintedGeneration(t *testing.T) {
+	tests := []struct {
+		name string
+		data any
+		want uint64
+	}{
+		{"string", "7", 7},
+		{"float", float64(7), 7},
+		{"slice", []any{"7"}, 7},
+		{"empty slice", []any{}, 0},
+		{"unparsable", "abc", 0},
+		{"nil", nil, 0},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			require.Equal(t, tc.want, paintedGeneration(tc.data))
+		})
+	}
+}
diff --git a/client/ui/services/windowtheme_windows.go b/client/ui/services/windowtheme_windows.go
new file mode 100644
index 000000000..7dbc1164b
--- /dev/null
+++ b/client/ui/services/windowtheme_windows.go
@@ -0,0 +1,14 @@
+package services
+
+import "github.com/wailsapp/wails/v3/pkg/w32"
+
+// Wails assigns w32.AllowDarkModeForWindow only on builds >= 18334 but calls it
+// without a nil check when a window requests the Dark theme, crashing older
+// builds such as Windows Server 2019 (17763). Those builds still get a dark
+// title bar via the pre-20H1 DWM attribute that w32.SetTheme applies, so a
+// no-op stub keeps the Dark theme fully working there.
+func init() {
+	if w32.AllowDarkModeForWindow == nil {
+		w32.AllowDarkModeForWindow = func(w32.HWND, bool) uintptr { return 0 }
+	}
+}
diff --git a/client/ui/shutdown_other.go b/client/ui/shutdown_other.go
new file mode 100644
index 000000000..6e617233f
--- /dev/null
+++ b/client/ui/shutdown_other.go
@@ -0,0 +1,7 @@
+//go:build !windows && !android && !ios && !freebsd && !js
+
+package main
+
+func endSessionInterceptor() func(hwnd uintptr, msg uint32, wParam, lParam uintptr) (uintptr, bool) {
+	return nil
+}
diff --git a/client/ui/shutdown_windows.go b/client/ui/shutdown_windows.go
new file mode 100644
index 000000000..fbb92a518
--- /dev/null
+++ b/client/ui/shutdown_windows.go
@@ -0,0 +1,36 @@
+//go:build windows
+
+package main
+
+import (
+	"os"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+const (
+	wmQueryEndSession = 0x0011
+	wmEndSession      = 0x0016
+)
+
+func endSessionInterceptor() func(hwnd uintptr, msg uint32, wParam, lParam uintptr) (uintptr, bool) {
+	return func(_ uintptr, msg uint32, wParam, _ uintptr) (uintptr, bool) {
+		switch msg {
+		case wmQueryEndSession:
+			services.BeginSessionEnd()
+			return 1, true
+		case wmEndSession:
+			if wParam == 0 {
+				services.AbortSessionEnd()
+				return 0, true
+			}
+			log.Info("windows session is ending; exiting immediately")
+			os.Exit(0)
+			return 0, true
+		default:
+			return 0, false
+		}
+	}
+}
diff --git a/client/ui/signal_unix.go b/client/ui/signal_unix.go
index 99de99f0f..876c5dd6e 100644
--- a/client/ui/signal_unix.go
+++ b/client/ui/signal_unix.go
@@ -1,76 +1,31 @@
-//go:build !windows && !(linux && 386)
+//go:build !windows && !android && !ios && !freebsd && !js
 
 package main
 
 import (
 	"context"
 	"os"
-	"os/exec"
 	"os/signal"
 	"syscall"
 
 	log "github.com/sirupsen/logrus"
 )
 
-// setupSignalHandler sets up a signal handler to listen for SIGUSR1.
-// When received, it opens the quick actions window.
-func (s *serviceClient) setupSignalHandler(ctx context.Context) {
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, syscall.SIGUSR1)
+// listenForShowSignal lets external tools surface the running UI by signalling its pid (SIGUSR1).
+func listenForShowSignal(ctx context.Context, tray *Tray) {
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, syscall.SIGUSR1)
 
 	go func() {
 		for {
 			select {
 			case <-ctx.Done():
+				signal.Stop(sigCh)
 				return
-			case <-sigChan:
-				log.Info("received SIGUSR1 signal, opening quick actions window")
-				s.openQuickActions()
+			case <-sigCh:
+				log.Debug("SIGUSR1 received, showing window")
+				tray.ShowWindow()
 			}
 		}
 	}()
 }
-
-// openQuickActions opens the quick actions window by spawning a new process.
-func (s *serviceClient) openQuickActions() {
-	proc, err := os.Executable()
-	if err != nil {
-		log.Errorf("get executable path: %v", err)
-		return
-	}
-
-	cmd := exec.CommandContext(s.ctx, proc,
-		"--quick-actions=true",
-		"--daemon-addr="+s.addr,
-	)
-
-	if out := s.attachOutput(cmd); out != nil {
-		defer func() {
-			if err := out.Close(); err != nil {
-				log.Errorf("close log file %s: %v", s.logFile, err)
-			}
-		}()
-	}
-
-	log.Infof("running command: %s --quick-actions=true --daemon-addr=%s", proc, s.addr)
-
-	if err := cmd.Start(); err != nil {
-		log.Errorf("start quick actions window: %v", err)
-		return
-	}
-
-	go func() {
-		if err := cmd.Wait(); err != nil {
-			log.Debugf("quick actions window exited: %v", err)
-		}
-	}()
-}
-
-// sendShowWindowSignal sends SIGUSR1 to the specified PID.
-func sendShowWindowSignal(pid int32) error {
-	process, err := os.FindProcess(int(pid))
-	if err != nil {
-		return err
-	}
-	return process.Signal(syscall.SIGUSR1)
-}
diff --git a/client/ui/signal_windows.go b/client/ui/signal_windows.go
index 58f46374f..86caa6d0c 100644
--- a/client/ui/signal_windows.go
+++ b/client/ui/signal_windows.go
@@ -5,9 +5,6 @@ package main
 import (
 	"context"
 	"errors"
-	"fmt"
-	"os"
-	"os/exec"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -17,155 +14,65 @@ import (
 const (
 	quickActionsTriggerEventName = `Global\NetBirdQuickActionsTriggerEvent`
 	waitTimeout                  = 5 * time.Second
-	// SYNCHRONIZE is needed for WaitForSingleObject, EVENT_MODIFY_STATE for ResetEvent.
-	desiredAccesses = windows.SYNCHRONIZE | windows.EVENT_MODIFY_STATE
+	desiredAccesses              = windows.SYNCHRONIZE | windows.EVENT_MODIFY_STATE
+
+	// WAIT_TIMEOUT return code; not exposed by golang.org/x/sys/windows.
+	waitTimeoutCode uint32 = 0x00000102
 )
 
-func getEventNameUint16Pointer() (*uint16, error) {
-	eventNamePtr, err := windows.UTF16PtrFromString(quickActionsTriggerEventName)
-	if err != nil {
-		log.Errorf("Failed to convert event name '%s' to UTF16: %v", quickActionsTriggerEventName, err)
-		return nil, err
-	}
-
-	return eventNamePtr, nil
-}
-
-// setupSignalHandler sets up signal handling for Windows.
-// Windows doesn't support SIGUSR1, so this uses a similar approach using windows.Events.
-func (s *serviceClient) setupSignalHandler(ctx context.Context) {
-	eventNamePtr, err := getEventNameUint16Pointer()
+// listenForShowSignal shows the main window when an external process pulses the named event.
+func listenForShowSignal(ctx context.Context, tray *Tray) {
+	namePtr, err := windows.UTF16PtrFromString(quickActionsTriggerEventName)
 	if err != nil {
+		log.Errorf("trigger event name: %v", err)
 		return
 	}
 
-	eventHandle, err := windows.CreateEvent(nil, 1, 0, eventNamePtr)
-
+	handle, err := windows.CreateEvent(nil, 1, 0, namePtr)
 	if err != nil {
-		if errors.Is(err, windows.ERROR_ALREADY_EXISTS) {
-			log.Warnf("Quick actions trigger event '%s' already exists. Attempting to open.", quickActionsTriggerEventName)
-			eventHandle, err = windows.OpenEvent(desiredAccesses, false, eventNamePtr)
-			if err != nil {
-				log.Errorf("Failed to open existing quick actions trigger event '%s': %v", quickActionsTriggerEventName, err)
-				return
-			}
-			log.Infof("Successfully opened existing quick actions trigger event '%s'.", quickActionsTriggerEventName)
-		} else {
-			log.Errorf("Failed to create quick actions trigger event '%s': %v", quickActionsTriggerEventName, err)
+		if !errors.Is(err, windows.ERROR_ALREADY_EXISTS) {
+			log.Errorf("create trigger event %q: %v", quickActionsTriggerEventName, err)
+			return
+		}
+		handle, err = windows.OpenEvent(desiredAccesses, false, namePtr)
+		if err != nil {
+			log.Errorf("open trigger event %q: %v", quickActionsTriggerEventName, err)
 			return
 		}
 	}
 
-	if eventHandle == windows.InvalidHandle {
-		log.Errorf("Obtained an invalid handle for quick actions trigger event '%s'", quickActionsTriggerEventName)
+	if handle == windows.InvalidHandle {
+		log.Errorf("invalid handle for trigger event %q", quickActionsTriggerEventName)
 		return
 	}
 
-	log.Infof("Quick actions handler waiting for signal on event: %s", quickActionsTriggerEventName)
-
-	go s.waitForEvent(ctx, eventHandle)
+	go waitForTrigger(ctx, handle, tray)
 }
 
-func (s *serviceClient) waitForEvent(ctx context.Context, eventHandle windows.Handle) {
+func waitForTrigger(ctx context.Context, handle windows.Handle, tray *Tray) {
 	defer func() {
-		if err := windows.CloseHandle(eventHandle); err != nil {
-			log.Errorf("Failed to close quick actions event handle '%s': %v", quickActionsTriggerEventName, err)
+		if err := windows.CloseHandle(handle); err != nil {
+			log.Errorf("close trigger event handle: %v", err)
 		}
 	}()
 
+	timeoutMs := uint32(waitTimeout / time.Millisecond)
 	for {
 		if ctx.Err() != nil {
 			return
 		}
-
-		status, err := windows.WaitForSingleObject(eventHandle, uint32(waitTimeout.Milliseconds()))
-
-		switch status {
-		case windows.WAIT_OBJECT_0:
-			log.Info("Received signal on quick actions event. Opening quick actions window.")
-
-			// reset the event so it can be triggered again later (manual reset == 1)
-			if err := windows.ResetEvent(eventHandle); err != nil {
-				log.Errorf("Failed to reset quick actions event '%s': %v", quickActionsTriggerEventName, err)
-			}
-
-			s.openQuickActions()
-		case uint32(windows.WAIT_TIMEOUT):
-
-		default:
-			if isDone := logUnexpectedStatus(ctx, status, err); isDone {
-				return
+		ev, err := windows.WaitForSingleObject(handle, timeoutMs)
+		switch {
+		case err != nil:
+			log.Errorf("wait trigger event: %v", err)
+			return
+		case ev == waitTimeoutCode:
+			continue
+		case ev == windows.WAIT_OBJECT_0:
+			if err := windows.ResetEvent(handle); err != nil {
+				log.Errorf("reset trigger event: %v", err)
 			}
+			tray.ShowWindow()
 		}
 	}
 }
-
-func logUnexpectedStatus(ctx context.Context, status uint32, err error) bool {
-	log.Errorf("Unexpected status %d from WaitForSingleObject for quick actions event '%s': %v",
-		status, quickActionsTriggerEventName, err)
-	select {
-	case <-time.After(5 * time.Second):
-		return false
-	case <-ctx.Done():
-		return true
-	}
-}
-
-// openQuickActions opens the quick actions window by spawning a new process.
-func (s *serviceClient) openQuickActions() {
-	proc, err := os.Executable()
-	if err != nil {
-		log.Errorf("get executable path: %v", err)
-		return
-	}
-
-	cmd := exec.CommandContext(s.ctx, proc,
-		"--quick-actions=true",
-		"--daemon-addr="+s.addr,
-	)
-
-	if out := s.attachOutput(cmd); out != nil {
-		defer func() {
-			if err := out.Close(); err != nil {
-				log.Errorf("close log file %s: %v", s.logFile, err)
-			}
-		}()
-	}
-
-	log.Infof("running command: %s --quick-actions=true --daemon-addr=%s", proc, s.addr)
-
-	if err := cmd.Start(); err != nil {
-		log.Errorf("error starting quick actions window: %v", err)
-		return
-	}
-
-	go func() {
-		if err := cmd.Wait(); err != nil {
-			log.Debugf("quick actions window exited: %v", err)
-		}
-	}()
-}
-
-func sendShowWindowSignal(pid int32) error {
-	_, err := os.FindProcess(int(pid))
-	if err != nil {
-		return err
-	}
-
-	eventNamePtr, err := getEventNameUint16Pointer()
-	if err != nil {
-		return err
-	}
-
-	eventHandle, err := windows.OpenEvent(desiredAccesses, false, eventNamePtr)
-	if err != nil {
-		return err
-	}
-
-	err = windows.SetEvent(eventHandle)
-	if err != nil {
-		return fmt.Errorf("error setting event: %w", err)
-	}
-
-	return nil
-}
diff --git a/client/ui/tray.go b/client/ui/tray.go
new file mode 100644
index 000000000..c392a0b62
--- /dev/null
+++ b/client/ui/tray.go
@@ -0,0 +1,592 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/events"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+
+	"github.com/netbirdio/netbird/client/ui/authsession"
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+	"github.com/netbirdio/netbird/client/ui/services"
+	"github.com/netbirdio/netbird/version"
+)
+
+// Notification IDs are OS dedup keys that coalesce duplicate toasts;
+// statusError is a tray-only sentinel for the error-icon state.
+const (
+	notifyIDUpdatePrefix = "netbird-update-"
+	notifyIDEvent        = "netbird-event-"
+	notifyIDTrayError    = "netbird-tray-error"
+	notifyIDMDMPolicy    = "netbird-mdm-policy"
+
+	statusError = "Error"
+
+	quitDownTimeout = 5 * time.Second
+
+	urlGitHubRepo = "https://github.com/netbirdio/netbird"
+	urlDocs       = "https://docs.netbird.io"
+)
+
+// TrayServices bundles the services the tray menu needs, grouped so NewTray
+// stays under the linter's parameter-count threshold.
+type TrayServices struct {
+	Connection      *services.Connection
+	Settings        *services.Settings
+	Profiles        *services.Profiles
+	Networks        *services.Networks
+	DaemonFeed      *services.DaemonFeed
+	Notifier        *Notifier
+	Update          *services.Update
+	ProfileSwitcher *services.ProfileSwitcher
+	WindowManager   *services.WindowManager
+	// Session is bound to authsession directly because the services wrapper
+	// only re-exposes the React subset.
+	Session     *authsession.Session
+	Localizer   *Localizer
+	Preferences *preferences.Store
+}
+
+type Tray struct {
+	app    *application.App
+	tray   *application.SystemTray
+	window *application.WebviewWindow
+	svc    TrayServices
+	// panelDark reports whether the desktop panel uses a dark scheme, so
+	// iconForState can pick the black vs white mono tray icon on Linux. Set
+	// by startTrayTheme (Linux only); nil elsewhere, where panelIsDark falls
+	// back to its default.
+	panelDark func() bool
+	loc       *Localizer
+
+	// menu and the *Item/*Submenu fields below are reassigned by buildMenu
+	// on every relayout — touch them only with menuMu held. Exceptions:
+	// the Connect/Disconnect OnClick closures capture their own item, and
+	// refreshSessionExpiresLabel snapshots its item under menuMu.
+	menu       *application.Menu
+	statusItem *application.MenuItem
+	// sessionExpiresItem shows the SSO deadline as a remaining-time label,
+	// repainted by a 30s ticker.
+	sessionExpiresItem *application.MenuItem
+	upItem             *application.MenuItem
+	downItem           *application.MenuItem
+	exitNodeItem       *application.MenuItem
+	exitNodeSubmenu    *application.Menu
+	profileSubmenu     *application.Menu
+	profileSubmenuItem *application.MenuItem
+	profileEmailItem   *application.MenuItem
+	settingsItem       *application.MenuItem
+	daemonVersionItem  *application.MenuItem
+
+	updater *trayUpdater
+
+	// statusMu guards the daemon-status core mirrored on the tray. One mutex
+	// covers these fields because applyStatus writes them together on every
+	// Status push and the menu painters read them.
+	statusMu          sync.Mutex
+	connected         bool
+	lastStatus        string
+	lastDaemonVersion string
+	// lastNetworksRevision is the daemon's routed-networks revision; a bump (or
+	// a connect/disconnect transition) gates the refreshExitNodes re-fetch so
+	// ListNetworks runs only when routes change. The peer-status route list
+	// can't substitute: it carries only actively-routed routes, not candidate
+	// exit nodes.
+	lastNetworksRevision uint64
+	// pendingConnectLogin is set when handleConnect fires an Up on an idle
+	// daemon. The daemon flips to NeedsLogin if the peer is SSO-tracked with
+	// no cached token; applyStatus consumes the flag on that transition to
+	// open the browser-login flow, saving a second Connect click.
+	// Profile-switch reconnects are handled separately by
+	// DaemonFeed.statusStreamLoop.
+	pendingConnectLogin bool
+
+	// sessionMu guards the cached SSO deadline used by the session row.
+	// Independent of statusMu so the 30s ticker reader and the Status-push
+	// writer don't block each other.
+	sessionMu        sync.Mutex
+	sessionExpiresAt time.Time
+
+	// profileMu guards the profile-domain state (active identity, the
+	// notifications gate, the in-flight switch cancel). Independent of
+	// statusMu so a long-running switch holding switchCancel doesn't block a
+	// Status-push reader of t.connected.
+	profileMu            sync.Mutex
+	activeProfile        string
+	activeUsername       string
+	notificationsEnabled bool
+	switchCancel         context.CancelFunc
+
+	// profileLoadMu serializes loadProfiles so the applyStatus refresh can't
+	// race the ApplicationStarted seed or the post-switch reload — all
+	// manipulate profileSubmenu + SetMenu, which Wails isn't concurrency-safe
+	// against.
+	profileLoadMu sync.Mutex
+
+	// profilesMu guards the cached profile rows that relayoutMenu repaints
+	// into a freshly built Profiles submenu, kept separate from the live
+	// submenu so a relayout always has a source to repaint from without
+	// re-hitting the daemon.
+	profilesMu   sync.Mutex
+	profiles     []services.Profile
+	profilesUser string
+
+	// menuMu serialises relayoutMenu (buildMenu + SetMenu) and guards the
+	// menu/item-pointer fields above. relayoutMenu is the only post-startup
+	// SetMenu call site — a menu snapshot pushed outside the lock could
+	// reinstall a stale tree.
+	menuMu sync.Mutex
+
+	// exitNodesMu guards the exitNodes row cache so relayoutMenu's read (and
+	// the Repaint copy) doesn't contend with status-push readers of statusMu.
+	exitNodesMu sync.Mutex
+	exitNodes   []exitNodeEntry
+	// exitNodesRebuildMu serialises the ListNetworks fetch + submenu rebuild +
+	// SetMenu cycle so back-to-back Status pushes can't run it concurrently
+	// with itself.
+	exitNodesRebuildMu sync.Mutex
+
+	// featureMu guards the daemon feature kill switches mirrored on the tray.
+	// Fetched at startup and refreshed on every config_changed event (the
+	// daemon re-applies MDM policy per engine spawn), so featuresDisabled can
+	// grey out menus without polling GetFeatures.
+	featureMu       sync.Mutex
+	disableProfiles bool
+	disableNetworks bool
+}
+
+func NewTray(app *application.App, window *application.WebviewWindow, svc TrayServices) *Tray {
+	t := &Tray{
+		app:                  app,
+		window:               window,
+		svc:                  svc,
+		notificationsEnabled: true,
+		// Localizer is constructed by main so the first menu render is already
+		// in the right locale — no English flash then re-paint.
+		loc: svc.Localizer,
+	}
+	t.updater = newTrayUpdater(app, t.showMainAt, svc.Update, svc.Notifier, t.loc, func() { t.applyIcon() }, func() { t.relayoutMenu() })
+	t.tray = app.SystemTray.New()
+	// Seed panel-theme detection before the first paint so the initial icon
+	// matches the panel's light/dark scheme (Linux only).
+	t.startTrayTheme()
+	t.applyIcon()
+	t.tray.SetTooltip(t.loc.T("tray.tooltip"))
+	// On Linux the SNI hover tooltip rides on the systray label, not
+	// SetTooltip (a no-op there); without a label Wails shows the literal
+	// "Wails". macOS/Windows are skipped (label paints visible text on
+	// macOS; Windows uses SetTooltip above).
+	if runtime.GOOS == "linux" {
+		t.tray.SetLabel(t.loc.T("tray.tooltip"))
+	}
+	t.menu = t.buildMenu()
+	t.tray.SetMenu(t.menu)
+	// macOS/Linux give click→menu natively, so bindTrayClick is a no-op there
+	// (binding OnClick→OpenMenu on macOS would freeze the tray); Windows has no
+	// native left-click handler so it wires one to open the main window, leaving
+	// the menu on right-click (see tray_click_*.go). On Linux AttachWindow is
+	// skipped — with applySmartDefaults it would pop the window alongside the
+	// menu (e.g. GNOME Shell AppIndicator).
+	bindTrayClick(t)
+
+	app.Event.On(services.EventStatusSnapshot, t.onStatusEvent)
+	app.Event.On(services.EventDaemonNotification, t.onSystemEvent)
+	// Refresh the Profiles submenu on ProfileSwitcher's change event. A
+	// switch on an idle daemon drives no status transition, so without this
+	// hook a React-initiated switch leaves the tray's submenu stale.
+	app.Event.On(services.EventProfileChanged, func(*application.CustomEvent) {
+		go t.loadProfiles()
+	})
+	// Defer the first profile load until the menu impl is live — Menu.Update()
+	// short-circuits while app.running is false, and AppKit's main queue isn't
+	// ready earlier (see d23ef34 InvokeSync nil-deref).
+	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		go t.loadProfiles()
+		go t.refreshRestrictions()
+		go t.runSessionExpiryTicker()
+		// Category registration must run after the notifications service
+		// Startup populates appName/registry path on Windows; before app.Run()
+		// the category lookup silently falls back to a plain notification.
+		t.registerSessionWarningCategory()
+	})
+
+	t.loc.Watch(func(i18n.LanguageCode) { t.applyLanguage() })
+
+	go t.loadConfig()
+	return t
+}
+
+// ShowWindow brings the main window forward — used by SIGUSR1 / Windows event.
+// Show() alone is not enough on macOS (makeKeyAndOrderFront skips activation,
+// so the window pops up behind the active app); Focus() additionally calls
+// activateIgnoringOtherApps:YES on macOS and SetForegroundWindow on Windows.
+func (t *Tray) ShowWindow() {
+	// An install supersedes every other flow, so check it before BrowserLogin.
+	if w := t.svc.WindowManager.InstallProgressWindow(); w != nil {
+		w.Show()
+		w.Focus()
+		return
+	}
+	if w := t.svc.WindowManager.BrowserLoginWindow(); w != nil {
+		w.Show()
+		w.Focus()
+		return
+	}
+	// Route through WindowManager so the main window is centered on first
+	// show — minimal WMs (fluxbox, the XEmbed tray path) otherwise drop it in
+	// the top-left corner.
+	if t.svc.WindowManager != nil {
+		t.svc.WindowManager.ShowMain()
+		return
+	}
+	if w := t.mainWindow(); w != nil {
+		w.Show()
+		w.Focus()
+	}
+}
+
+func (t *Tray) mainWindow() *application.WebviewWindow {
+	if t.svc.WindowManager == nil {
+		return t.window
+	}
+	return t.svc.WindowManager.MainWindow()
+}
+
+func (t *Tray) showMainAt(url string) {
+	if t.svc.WindowManager != nil {
+		t.svc.WindowManager.ShowMainAt(url)
+		return
+	}
+	if w := t.mainWindow(); w != nil {
+		w.SetURL(url)
+		w.Show()
+		w.Focus()
+	}
+}
+
+func (t *Tray) showMain() {
+	if t.svc.WindowManager != nil {
+		t.svc.WindowManager.ShowMain()
+		return
+	}
+	if w := t.mainWindow(); w != nil {
+		w.Show()
+		w.Focus()
+	}
+}
+
+func (t *Tray) showMainAndEmit(event string) {
+	if t.svc.WindowManager != nil {
+		t.svc.WindowManager.ShowMainAndEmit(event)
+		return
+	}
+	t.showMain()
+	t.app.Event.Emit(event)
+}
+
+// applyLanguage re-renders every translated surface in the Localizer's current
+// language. Wails dispatches menu/tray APIs onto the UI thread internally, so
+// calling them from the Localizer's background goroutine is safe; profileLoadMu
+// prevents loadProfiles from racing the rebuild.
+func (t *Tray) applyLanguage() {
+	t.tray.SetTooltip(t.loc.T("tray.tooltip"))
+	// Mirror the Linux label fix from NewTray (the SNI tooltip rides on the
+	// label).
+	if runtime.GOOS == "linux" {
+		t.tray.SetLabel(t.loc.T("tray.tooltip"))
+	}
+	t.relayoutMenu()
+}
+
+// relayoutMenu rebuilds the entire tray menu, repaints the cached
+// status/session/profile/exit-node state into the fresh items, and pushes the
+// whole tree with a single SetMenu.
+//
+// A full rebuild is required because on KDE/Plasma the StatusNotifierItem host
+// caches a submenu's layout on first open (GetLayout for that submenu id) and
+// never re-fetches it on a LayoutUpdated(parent=0) signal — so Clear()+Add()
+// into the same container froze both the visible rows and the click→id mapping,
+// and stale ids no-op'd. buildMenu allocates a fresh submenu container id each
+// time, which Plasma treats as unseen and re-queries (confirmed via
+// dbus-monitor). This also covers the darwin detached-NSMenu workaround, since
+// it rebuilds the whole tree against the cached top-level pointer.
+//
+// Rows come from the profilesMu/exitNodes caches, so it never re-hits the
+// daemon or recurses back into loadProfiles.
+func (t *Tray) relayoutMenu() {
+	t.menuMu.Lock()
+	defer t.menuMu.Unlock()
+
+	t.menu = t.buildMenu()
+
+	t.statusMu.Lock()
+	connected := t.connected
+	lastStatus := t.lastStatus
+	daemonVersion := t.lastDaemonVersion
+	t.statusMu.Unlock()
+
+	t.sessionMu.Lock()
+	sessionDeadline := t.sessionExpiresAt
+	t.sessionMu.Unlock()
+
+	t.exitNodesMu.Lock()
+	exitNodeEntries := append([]exitNodeEntry(nil), t.exitNodes...)
+	t.exitNodesMu.Unlock()
+
+	disableProfiles, disableNetworks := t.featuresDisabled()
+
+	daemonUnavailable := strings.EqualFold(lastStatus, services.StatusDaemonUnavailable)
+	connecting := strings.EqualFold(lastStatus, services.StatusConnecting)
+
+	if t.statusItem != nil && lastStatus != "" {
+		t.statusItem.SetLabel(t.loc.StatusLabel(lastStatus))
+		t.statusItem.SetEnabled(statusRowEnabled())
+		t.applyStatusIndicator(lastStatus)
+	}
+	if t.sessionExpiresItem != nil {
+		if sessionDeadline.IsZero() {
+			t.sessionExpiresItem.SetHidden(true)
+		} else {
+			t.sessionExpiresItem.SetLabel(t.sessionRowLabel(sessionDeadline))
+			t.sessionExpiresItem.SetHidden(false)
+		}
+	}
+	if t.upItem != nil {
+		// Connect stays visible in the NeedsLogin states too — Up drives
+		// the SSO re-auth flow; hidden only when it would be a no-op.
+		t.upItem.SetHidden(connected || connecting || daemonUnavailable)
+		t.upItem.SetEnabled(!connected && !connecting && !daemonUnavailable)
+	}
+	if t.downItem != nil {
+		// Disconnect doubles as the Connecting abort path.
+		t.downItem.SetHidden(!connected && !connecting)
+		t.downItem.SetEnabled(connected || connecting)
+	}
+	if t.exitNodeItem != nil {
+		t.exitNodeItem.SetEnabled(connected && len(exitNodeEntries) > 0 && !disableNetworks)
+	}
+	if t.settingsItem != nil {
+		t.settingsItem.SetEnabled(!daemonUnavailable)
+	}
+	if t.profileSubmenuItem != nil {
+		t.profileSubmenuItem.SetEnabled(!daemonUnavailable && !disableProfiles)
+	}
+	if daemonVersion != "" && t.daemonVersionItem != nil {
+		t.daemonVersionItem.SetLabel(t.loc.T("tray.menu.daemonVersion", "version", daemonVersion))
+	}
+	if t.updater != nil {
+		t.updater.applyLanguage()
+	}
+	// buildMenu recreated empty submenus, so repaint both from their caches
+	// before SetMenu. Neither fill re-fetches. Do NOT re-take
+	// exitNodesRebuildMu here — refreshExitNodes already holds it when it
+	// calls relayoutMenu.
+	t.fillExitNodeSubmenu(exitNodeEntries)
+	t.fillProfileSubmenu()
+
+	// Single push of the whole tree: on Linux one LayoutUpdated with fresh
+	// container ids; on darwin an NSMenu rebuild against the cached pointer.
+	t.tray.SetMenu(t.menu)
+}
+
+func (t *Tray) buildMenu() *application.Menu {
+	menu := application.NewMenu()
+
+	// Enabled state is platform-dependent (see statusRowEnabled): Windows keeps
+	// it enabled because the disabled mask would desaturate the coloured status
+	// dot; macOS/Linux disable it so the greyed label signals it isn't
+	// clickable.
+	t.statusItem = menu.Add(t.loc.T("tray.status.disconnected")).
+		SetEnabled(statusRowEnabled()).
+		SetBitmap(iconMenuDotIdle)
+
+	menu.AddSeparator()
+
+	// The OnClick closures capture the local item because t.upItem/t.downItem
+	// are menuMu-guarded and must not be read from the click goroutine.
+	upItem := menu.Add(t.loc.T("tray.menu.connect"))
+	upItem.OnClick(func(*application.Context) { t.handleConnect(upItem) })
+	t.upItem = upItem
+	downItem := menu.Add(t.loc.T("tray.menu.disconnect"))
+	downItem.OnClick(func(*application.Context) { t.handleDisconnect(downItem) })
+	downItem.SetHidden(true)
+	t.downItem = downItem
+
+	menu.AddSeparator()
+
+	// Populated asynchronously once the app has started — Menu.Update() is a
+	// no-op before app.running is true, so the initial fill is gated on the
+	// ApplicationStarted hook.
+	profilesLabel := t.loc.T("tray.menu.profiles")
+	t.profileSubmenu = menu.AddSubmenu(profilesLabel)
+	// AddSubmenu returns the child *Menu, so retrieve the parent *MenuItem via
+	// FindByLabel.
+	t.profileSubmenuItem = menu.FindByLabel(profilesLabel)
+	t.profileEmailItem = menu.Add("").SetEnabled(false)
+	t.profileEmailItem.SetHidden(true)
+	// Click opens the SessionExpiration window so the user can extend ahead of
+	// the daemon's T-FinalWarningLead auto-prompt.
+	t.sessionExpiresItem = menu.Add("").OnClick(func(*application.Context) { t.openSessionExtendFlow() })
+	t.sessionExpiresItem.SetHidden(true)
+
+	menu.AddSeparator()
+	// Accelerators on the Settings/Quit entries below are a no-op on Windows in
+	// Wails v3 alpha.95 (impl commented out in menuitem_windows.go); still set
+	// for forward compatibility. macOS/GTK render and fire them.
+	menu.Add(t.loc.T("tray.menu.open")).OnClick(func(*application.Context) { t.ShowWindow() })
+
+	menu.AddSeparator()
+
+	// exitNodeSubmenu hosts one row per peer advertising a default route
+	// (0.0.0.0/0 or ::/0). FindByLabel grabs the parent so applyStatus can flip
+	// its enabled state independently of the children.
+	exitNodeLabel := t.loc.T("tray.menu.exitNode")
+	t.exitNodeSubmenu = menu.AddSubmenu(exitNodeLabel)
+	t.exitNodeItem = menu.FindByLabel(exitNodeLabel)
+	t.exitNodeItem.SetEnabled(false)
+
+	menu.AddSeparator()
+
+	// The label's trailing ellipsis follows the macOS HIG convention for items
+	// that open a window.
+	t.settingsItem = menu.Add(t.loc.T("tray.menu.settings")).
+		SetAccelerator("CmdOrCtrl+,").
+		OnClick(func(*application.Context) { t.svc.WindowManager.OpenSettings("") })
+
+	aboutLabel := menuLabel(t.loc.T("tray.menu.about"))
+	about := menu.AddSubmenu(aboutLabel)
+	about.Add(t.loc.T("tray.menu.github")).OnClick(func(*application.Context) {
+		_ = t.app.Browser.OpenURL(urlGitHubRepo)
+	})
+	about.Add(t.loc.T("tray.menu.documentation")).OnClick(func(*application.Context) {
+		_ = t.app.Browser.OpenURL(urlDocs)
+	})
+	about.Add(t.loc.T("tray.menu.troubleshoot")).OnClick(func(*application.Context) {
+		t.svc.WindowManager.OpenSettings("troubleshooting")
+	})
+	about.AddSeparator()
+	about.Add(t.loc.T("tray.menu.guiVersion", "version", version.NetbirdVersion())).SetEnabled(false)
+	t.daemonVersionItem = about.Add(t.loc.T("tray.menu.daemonVersion", "version", t.loc.T("tray.menu.versionUnknown"))).SetEnabled(false)
+	// trayUpdater rewrites the label between downloadLatest (opt-in) and
+	// installVersion (enforced) and drives the click.
+	updateItem := about.Add(t.loc.T("tray.menu.downloadLatest")).
+		OnClick(func(*application.Context) { t.updater.handleClick() })
+	updateItem.SetHidden(true)
+	t.updater.attach(updateItem)
+
+	menu.AddSeparator()
+	menu.Add(t.loc.T("tray.menu.quit")).
+		SetAccelerator("CmdOrCtrl+Q").
+		OnClick(func(*application.Context) { t.handleQuit() })
+
+	return menu
+}
+
+func (t *Tray) handleQuit() {
+	services.BeginShutdown()
+	t.profileMu.Lock()
+	if t.switchCancel != nil {
+		t.switchCancel()
+		t.switchCancel = nil
+	}
+	t.profileMu.Unlock()
+	t.svc.DaemonFeed.CancelProfileSwitch()
+
+	if t.svc.Preferences == nil || !t.svc.Preferences.Get().KeepConnectedOnQuit {
+		ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
+		defer cancel()
+		if err := t.svc.Connection.Down(ctx); err != nil {
+			log.Errorf("disconnect on quit: %v", err)
+		}
+	}
+	t.app.Quit()
+}
+
+// handleConnect receives the clicked item from the buildMenu closure —
+// t.upItem is menuMu-guarded and must not be read here.
+func (t *Tray) handleConnect(upItem *application.MenuItem) {
+	// NeedsLogin/SessionExpired/LoginFailed won't honor a plain Up RPC — they
+	// need the Login → WaitSSOLogin → Up sequence. Emit EventTriggerLogin so
+	// the React startLogin() (which owns the BrowserLogin popup) drives it;
+	// the WindowManager materialises a hidden main webview when none is live,
+	// so only the popup shows.
+	t.statusMu.Lock()
+	needsLogin := strings.EqualFold(t.lastStatus, services.StatusNeedsLogin) ||
+		strings.EqualFold(t.lastStatus, services.StatusSessionExpired) ||
+		strings.EqualFold(t.lastStatus, services.StatusLoginFailed)
+	t.statusMu.Unlock()
+	if needsLogin {
+		t.app.Event.Emit(services.EventTriggerLogin)
+		return
+	}
+	upItem.SetEnabled(false)
+	// Arm the SSO auto-handoff: Up() is async and the daemon may flip to
+	// NeedsLogin on an SSO peer with no cached token. applyStatus consumes the
+	// flag on that transition to trigger browser-login without a second Connect
+	// click, and clears it on any terminal state.
+	t.statusMu.Lock()
+	t.pendingConnectLogin = true
+	t.statusMu.Unlock()
+	go func() {
+		if err := t.svc.Connection.Up(context.Background(), services.UpParams{}); err != nil {
+			log.Errorf("connect: %v", err)
+			t.notifyError(t.loc.T("notify.error.connect"))
+			t.statusMu.Lock()
+			t.pendingConnectLogin = false
+			t.statusMu.Unlock()
+			upItem.SetEnabled(true)
+		}
+	}()
+}
+
+// handleDisconnect aborts any in-flight profile switch before sending Down —
+// otherwise the switcher's queued Up would reconnect right after, making the
+// click a no-op. Also clears Peers' optimistic-Connecting guard so the daemon's
+// Idle push paints through instead of being swallowed by the suppression filter.
+// Receives the clicked item from the buildMenu closure (see handleConnect).
+func (t *Tray) handleDisconnect(downItem *application.MenuItem) {
+	downItem.SetEnabled(false)
+	t.profileMu.Lock()
+	if t.switchCancel != nil {
+		t.switchCancel()
+		t.switchCancel = nil
+	}
+	t.profileMu.Unlock()
+	t.svc.DaemonFeed.CancelProfileSwitch()
+	go func() {
+		if err := t.svc.Connection.Down(context.Background()); err != nil {
+			log.Errorf("disconnect: %v", err)
+			t.notifyError(t.loc.T("notify.error.disconnect"))
+			downItem.SetEnabled(true)
+		}
+	}()
+}
+
+// notify wraps the Wails notification service with the tray's standard
+// id-prefix scheme and swallows errors (notifications are best-effort).
+func (t *Tray) notify(title, body, id string) {
+	if t.svc.Notifier == nil {
+		return
+	}
+	_ = safeSendNotification(t.svc.Notifier.SendNotification, title, notifications.NotificationOptions{
+		ID:    id,
+		Title: title,
+		Body:  body,
+	})
+}
+
+// notifyError fires a generic "Error" notification for tray-driven action
+// failures. Each tray click site already logs the underlying error; this
+// adds the user-visible toast.
+func (t *Tray) notifyError(message string) {
+	t.notify(t.loc.T("notify.error.title"), message, notifyIDTrayError)
+}
diff --git a/client/ui/tray_click_linux.go b/client/ui/tray_click_linux.go
new file mode 100644
index 000000000..95f5dfe85
--- /dev/null
+++ b/client/ui/tray_click_linux.go
@@ -0,0 +1,40 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+// bindTrayClick wires the tray icon's left-click handler on Linux.
+//
+// Expected behaviour per tray host:
+//
+//	Host                           Left click              Right click
+//	KDE Plasma, Waybar             main window (Activate)  menu (host-rendered)
+//	GNOME Shell + AppIndicator     menu only               menu only
+//	Minimal WMs via XEmbed host    main window (Activate)  XEmbed GTK popup
+//
+// OnClick fires only on org.kde.StatusNotifierItem.Activate — a real left
+// click. KDE/Waybar send it over D-Bus; the in-process XEmbed host
+// (xembed_host_linux.go) maps a Button1 press to the same Activate call.
+//
+// GNOME Shell + AppIndicator never sends Activate: it renders the dbusmenu
+// on ANY click and only reports the menu opening via dbusmenu
+// Event("opened"). Upstream Wails treated that event as a click, so on GNOME
+// both buttons raised the main window on top of the menu, and on KDE/Waybar
+// a right click raised it over the freshly opened menu. The netbirdio/wails
+// fork (go.mod replace) drops that heuristic: a menu open never fires
+// OnClick. On GNOME the main window is reached via the "Open NetBird" menu
+// entry; left-click-opens-window is not achievable there anyway, since the
+// host always opens the menu itself.
+//
+// We do NOT register OnDoubleClick: Wails' Linux SNI backend never fires it
+// (unlike Windows). And we deliberately skip AttachWindow — it plus Wails3's
+// applySmartDefaults would pop the window alongside the menu on GNOME Shell
+// with the AppIndicator extension (see the bindTrayClick comment in tray.go).
+//
+// ShowWindow() is the same dispatcher the explicit "Open NetBird" menu entry
+// and SIGUSR1 use: it brings the install-progress / browser-login window
+// forward when one of those flows is active, otherwise routes through
+// WindowManager.ShowMain so the window re-centers on minimal WMs / the XEmbed
+// path instead of landing in the top-left corner.
+func bindTrayClick(t *Tray) {
+	t.tray.OnClick(func() { t.ShowWindow() })
+}
diff --git a/client/ui/tray_click_other.go b/client/ui/tray_click_other.go
new file mode 100644
index 000000000..e6a29e419
--- /dev/null
+++ b/client/ui/tray_click_other.go
@@ -0,0 +1,13 @@
+//go:build !windows && !android && !ios && !freebsd && !js && (!linux || (linux && 386))
+
+package main
+
+func bindTrayClick(*Tray) {
+	// No-op: macOS's native NSStatusItem opens the menu on click itself, and
+	// binding OnClick→anything blocking there froze the tray historically
+	// (see tray_click_windows.go). Windows wires an explicit handler
+	// (tray_click_windows.go); Linux opens the window on left-click
+	// (tray_click_linux.go). The (linux && 386) arm keeps a no-op fallback for
+	// the i386 Linux build, which excludes the cgo XEmbed/SNI files that
+	// tray_click_linux.go's build tag matches.
+}
diff --git a/client/ui/tray_click_windows.go b/client/ui/tray_click_windows.go
new file mode 100644
index 000000000..04c66dd8a
--- /dev/null
+++ b/client/ui/tray_click_windows.go
@@ -0,0 +1,8 @@
+//go:build windows
+
+package main
+
+// Open application window on left click, right click opens the tray menu
+func bindTrayClick(t *Tray) {
+	t.tray.OnClick(func() { go t.ShowWindow() })
+}
diff --git a/client/ui/tray_events.go b/client/ui/tray_events.go
new file mode 100644
index 000000000..f23b5d715
--- /dev/null
+++ b/client/ui/tray_events.go
@@ -0,0 +1,138 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"fmt"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/authsession"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// onSystemEvent fires an OS notification for daemon SystemEvents that carry a
+// user-facing message. Gated by the "Notifications" toggle; critical events bypass it.
+func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
+	se, ok := ev.Data.(services.SystemEvent)
+	if !ok {
+		return
+	}
+	// config_changed carries no UserMessage, so handle it before the message gate below.
+	if se.Category == "system" && se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypeConfigChanged {
+		log.Infof("config_changed event received (source=%s); refreshing tray restrictions", se.Metadata[proto.MetadataSourceKey])
+		go t.refreshRestrictions()
+		go t.loadConfig()
+		// MDM gets a localised toast here; the daemon's English "policy_applied"
+		// event is suppressed in shouldSkipSystemEvent. Other sources stay silent.
+		if se.Metadata[proto.MetadataSourceKey] == proto.MetadataSourceMDM {
+			t.profileMu.Lock()
+			enabled := t.notificationsEnabled
+			t.profileMu.Unlock()
+			if enabled {
+				t.notify(
+					t.loc.T("notify.mdm.policyApplied.title"),
+					t.loc.T("notify.mdm.policyApplied.body"),
+					notifyIDMDMPolicy,
+				)
+			}
+		}
+		return
+	}
+	// Session-warning and deadline-rejected events build their body locally from
+	// metadata; every other event needs a UserMessage.
+	isSessionWarning := se.Metadata[authsession.MetaWarning] == "true"
+	isDeadlineRejected := se.Metadata[authsession.MetaDeadlineRejected] != ""
+	if !isSessionWarning && !isDeadlineRejected && se.UserMessage == "" {
+		return
+	}
+	if shouldSkipSystemEvent(se) {
+		return
+	}
+
+	critical := strings.EqualFold(se.Severity, services.SeverityCritical)
+	t.profileMu.Lock()
+	enabled := t.notificationsEnabled
+	t.profileMu.Unlock()
+	if !enabled && !critical {
+		return
+	}
+
+	// Session-warning events route via stable metadata flags rather than
+	// category/severity so a daemon-side reword still lands here. Final warning
+	// auto-opens the SessionExpiration dialog with no notification (the dialog is
+	// the last-chance reminder; doubling up would be noise).
+	if isDeadlineRejected {
+		t.notify(
+			t.loc.T("notify.sessionDeadlineRejected.title"),
+			t.loc.T("notify.sessionDeadlineRejected.body"),
+			notifyIDSessionExpired,
+		)
+		return
+	}
+
+	if se.Metadata != nil && se.Metadata[authsession.MetaWarning] == "true" {
+		if se.Metadata[authsession.MetaFinal] == "true" {
+			deadline, _ := authsession.ParseExpiresAt(se.Metadata[authsession.MetaExpiresAt])
+			t.openSessionExpiration(deadline)
+			return
+		}
+		t.notifySessionWarning(
+			t.loc.T("notify.sessionWarning.title"),
+			t.buildSessionWarningBody(se.Metadata),
+		)
+		return
+	}
+
+	body := se.UserMessage
+	if id := se.Metadata["id"]; id != "" {
+		body += fmt.Sprintf(" ID: %s", id)
+	}
+	t.notify(eventTitle(se), body, notifyIDEvent+se.ID)
+}
+
+// eventTitle composes a notification title, e.g. "Critical: DNS", "Warning: Authentication".
+func eventTitle(e services.SystemEvent) string {
+	prefix := titleCase(e.Severity)
+	if prefix == "" {
+		prefix = "Info"
+	}
+	category := titleCase(e.Category)
+	if category == "" {
+		category = "System"
+	}
+	return prefix + ": " + category
+}
+
+func titleCase(s string) string {
+	if s == "" {
+		return ""
+	}
+	return strings.ToUpper(s[:1]) + strings.ToLower(s[1:])
+}
+
+// shouldSkipSystemEvent reports whether a daemon SystemEvent must not surface as
+// a tray notification:
+//   - update-available announcements (trayUpdater emits its own)
+//   - install-progress signals (consumed by the install-progress window)
+//   - the ::/0 partner of an exit-node default route (0.0.0.0/0 already toasted)
+func shouldSkipSystemEvent(se services.SystemEvent) bool {
+	// "policy_applied" carries a hardcoded English message; the localised toast
+	// fires on the paired config_changed (source=mdm) event instead.
+	if se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypePolicyApplied {
+		return true
+	}
+	if _, isUpdate := se.Metadata["new_version_available"]; isUpdate {
+		return true
+	}
+	if _, isProgress := se.Metadata["progress_window"]; isProgress {
+		return true
+	}
+	if se.Category == "network" && se.Metadata["network"] == "::/0" {
+		return true
+	}
+	return false
+}
diff --git a/client/ui/tray_exitnodes.go b/client/ui/tray_exitnodes.go
new file mode 100644
index 000000000..3e6f30842
--- /dev/null
+++ b/client/ui/tray_exitnodes.go
@@ -0,0 +1,148 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"net/netip"
+	"sort"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// exitNodeEntry is one Exit Node submenu row; ID is the network's NetID, the Select/Deselect argument.
+type exitNodeEntry struct {
+	ID       string
+	Selected bool
+}
+
+// fillExitNodeSubmenu uses a "✓ " prefix with plain Add, not AddCheckbox: Wails
+// auto-toggles a checkbox on click before OnClick runs, so the deselect/select
+// round-trip would briefly show two checked rows. Callers must hold exitNodesRebuildMu.
+func (t *Tray) fillExitNodeSubmenu(nodes []exitNodeEntry) {
+	if t.exitNodeSubmenu == nil {
+		return
+	}
+	t.exitNodeSubmenu.Clear()
+	for _, n := range nodes {
+		id := n.ID
+		selected := n.Selected
+		label := id
+		if selected {
+			label = "✓ " + id
+		}
+		t.exitNodeSubmenu.Add(label).OnClick(func(*application.Context) {
+			t.toggleExitNode(id, selected)
+		})
+	}
+}
+
+// refreshExitNodes sources rows from Networks.List() rather than the Status stream
+// because only ListNetworks carries the NetID + selected state Select/Deselect need.
+// Serialized by exitNodesRebuildMu against overlapping Status pushes.
+func (t *Tray) refreshExitNodes() {
+	t.exitNodesRebuildMu.Lock()
+	defer t.exitNodesRebuildMu.Unlock()
+
+	t.statusMu.Lock()
+	connected := t.connected
+	t.statusMu.Unlock()
+
+	var nodes []exitNodeEntry
+	if connected {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		list, err := t.svc.Networks.List(ctx)
+		cancel()
+		if err != nil {
+			log.Debugf("tray list networks: %v", err)
+			return
+		}
+		nodes = exitNodesFromNetworks(list)
+	}
+
+	log.Infof("tray refreshExitNodes: %d exit node(s)", len(nodes))
+	for _, n := range nodes {
+		log.Infof("tray exit node: id=%q selected=%v", n.ID, n.Selected)
+	}
+
+	t.exitNodesMu.Lock()
+	changed := !equalExitNodes(nodes, t.exitNodes)
+	t.exitNodes = nodes
+	t.exitNodesMu.Unlock()
+
+	// relayoutMenu repaints from the cached entries, so the old exitNodeItem needs no poking here.
+	if changed {
+		t.relayoutMenu()
+	}
+}
+
+// toggleExitNode uses append=true: append=false would drop the whole current
+// selection (default-on semantics), turning off every other routed network the
+// user had enabled. Mutual exclusion of exit nodes is enforced daemon-side.
+func (t *Tray) toggleExitNode(id string, selected bool) {
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+
+		params := services.SelectNetworksParams{NetworkIDs: []string{id}, Append: true, All: false}
+		var err error
+		if selected {
+			err = t.svc.Networks.Deselect(ctx, params)
+		} else {
+			err = t.svc.Networks.Select(ctx, params)
+		}
+		if err != nil {
+			log.Errorf("tray toggle exit node %q: %v", id, err)
+			t.notifyError(t.loc.T("notify.error.exitNode", "name", id))
+			return
+		}
+		t.refreshExitNodes()
+	}()
+}
+
+// exitNodesFromNetworks keeps only networks whose range is a default route: those are the exit-node candidates.
+func exitNodesFromNetworks(networks []services.Network) []exitNodeEntry {
+	out := []exitNodeEntry{}
+	for _, n := range networks {
+		if !rangeIsDefaultRoute(n.Range) {
+			continue
+		}
+		out = append(out, exitNodeEntry{ID: n.ID, Selected: n.Selected})
+	}
+	sort.Slice(out, func(i, j int) bool {
+		return strings.ToLower(out[i].ID) < strings.ToLower(out[j].ID)
+	})
+	return out
+}
+
+// rangeIsDefaultRoute reports whether r contains a default route. The daemon may
+// comma-join a v4+v6 pair ("0.0.0.0/0, ::/0"), so each part is parsed rather than string-compared.
+func rangeIsDefaultRoute(r string) bool {
+	for _, part := range strings.Split(r, ",") {
+		pref, err := netip.ParsePrefix(strings.TrimSpace(part))
+		if err != nil {
+			continue
+		}
+		if pref.Bits() == 0 && pref.Addr().IsUnspecified() {
+			return true
+		}
+	}
+	return false
+}
+
+func equalExitNodes(a, b []exitNodeEntry) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/client/ui/tray_features.go b/client/ui/tray_features.go
new file mode 100644
index 000000000..2ff99e2be
--- /dev/null
+++ b/client/ui/tray_features.go
@@ -0,0 +1,37 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// refreshRestrictions re-reads the operator-disabled UI flags and re-gates the
+// menu. Must run on every config_changed event: the daemon re-applies its MDM
+// policy on each engine spawn.
+func (t *Tray) refreshRestrictions() {
+	r, err := t.svc.Settings.GetRestrictions(context.Background())
+	if err != nil {
+		log.Debugf("get restrictions: %v", err)
+		return
+	}
+	t.featureMu.Lock()
+	changed := t.disableProfiles != r.Features.DisableProfiles ||
+		t.disableNetworks != r.Features.DisableNetworks
+	t.disableProfiles = r.Features.DisableProfiles
+	t.disableNetworks = r.Features.DisableNetworks
+	t.featureMu.Unlock()
+	// relayoutMenu rebuilds the whole tree, so skip the no-op refresh (common case).
+	if changed {
+		t.relayoutMenu()
+	}
+}
+
+// featuresDisabled returns the cached flags under featureMu.
+func (t *Tray) featuresDisabled() (profiles, networks bool) {
+	t.featureMu.Lock()
+	defer t.featureMu.Unlock()
+	return t.disableProfiles, t.disableNetworks
+}
diff --git a/client/ui/tray_icon.go b/client/ui/tray_icon.go
new file mode 100644
index 000000000..6c7b85d79
--- /dev/null
+++ b/client/ui/tray_icon.go
@@ -0,0 +1,136 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"runtime"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+func (t *Tray) applyIcon() {
+	t.statusMu.Lock()
+	connected := t.connected
+	statusLabel := t.lastStatus
+	t.statusMu.Unlock()
+	hasUpdate := false
+	if t.updater != nil {
+		hasUpdate = t.updater.hasUpdate()
+	}
+
+	log.Infof("tray applyIcon: connected=%v hasUpdate=%v status=%q goos=%s",
+		connected, hasUpdate, statusLabel, runtime.GOOS)
+
+	icon, dark := t.iconForState()
+	if runtime.GOOS == "darwin" {
+		t.tray.SetTemplateIcon(icon)
+		return
+	}
+	if runtime.GOOS == "linux" {
+		// Wails' Linux SNI backend ignores SetDarkModeIcon (last write wins
+		// over SetIcon), so iconForState already picked the silhouette by
+		// panel theme; push that single icon.
+		t.tray.SetIcon(icon)
+		return
+	}
+	t.tray.SetIcon(icon)
+	if dark != nil {
+		t.tray.SetDarkModeIcon(dark)
+	}
+}
+
+// panelIsDark defaults to true when no detector is wired (panelDark nil —
+// non-Linux or portal unavailable), matching the common dark Linux panel.
+func (t *Tray) panelIsDark() bool {
+	if t.panelDark == nil {
+		return true
+	}
+	return t.panelDark()
+}
+
+func (t *Tray) iconForState() (icon, dark []byte) {
+	t.statusMu.Lock()
+	connected := t.connected
+	statusLabel := t.lastStatus
+	t.statusMu.Unlock()
+	hasUpdate := false
+	if t.updater != nil {
+		hasUpdate = t.updater.hasUpdate()
+	}
+
+	connecting := strings.EqualFold(statusLabel, services.StatusConnecting)
+	errored := strings.EqualFold(statusLabel, statusError) ||
+		strings.EqualFold(statusLabel, services.StatusDaemonUnavailable)
+	needsLogin := strings.EqualFold(statusLabel, services.StatusNeedsLogin) ||
+		strings.EqualFold(statusLabel, services.StatusSessionExpired) ||
+		strings.EqualFold(statusLabel, services.StatusLoginFailed)
+
+	if runtime.GOOS == "darwin" {
+		switch {
+		case connecting:
+			return iconConnectingMacOS, nil
+		case errored:
+			return iconErrorMacOS, nil
+		case needsLogin:
+			return iconNeedsLoginMacOS, nil
+		case connected && hasUpdate:
+			return iconUpdateConnectedMacOS, nil
+		case connected:
+			return iconConnectedMacOS, nil
+		case hasUpdate:
+			return iconUpdateDisconnectedMacOS, nil
+		default:
+			return iconDisconnectedMacOS, nil
+		}
+	}
+
+	if runtime.GOOS == "linux" {
+		// Theme resolved here (black for light panel, white for dark) since
+		// the SNI backend can't switch per theme (see applyIcon); second
+		// return is unused on Linux.
+		dark := t.panelIsDark()
+		pick := func(black, white []byte) ([]byte, []byte) {
+			if dark {
+				return white, nil
+			}
+			return black, nil
+		}
+		switch {
+		case connecting:
+			return pick(iconConnectingMono, iconConnectingMonoDark)
+		case errored:
+			return pick(iconErrorMono, iconErrorMonoDark)
+		case needsLogin:
+			return pick(iconNeedsLoginMono, iconNeedsLoginMonoDark)
+		case connected && hasUpdate:
+			return pick(iconUpdateConnectedMono, iconUpdateConnectedMonoDark)
+		case connected:
+			return pick(iconConnectedMono, iconConnectedMonoDark)
+		case hasUpdate:
+			return pick(iconUpdateDisconnectedMono, iconUpdateDisconnectedMonoDark)
+		default:
+			return pick(iconDisconnectedMono, iconDisconnectedMonoDark)
+		}
+	}
+
+	// Windows: colored PNGs.
+	switch {
+	case connecting:
+		return iconConnecting, iconConnectingDark
+	case errored:
+		return iconError, iconErrorDark
+	case needsLogin:
+		return iconNeedsLogin, iconNeedsLogin
+	case connected && hasUpdate:
+		return iconUpdateConnected, iconUpdateConnectedDark
+	case connected:
+		return iconConnected, iconConnectedDark
+	case hasUpdate:
+		return iconUpdateDisconnected, iconUpdateDisconnectedDark
+	default:
+		return iconDisconnected, iconDisconnected
+	}
+}
diff --git a/client/ui/tray_label_other.go b/client/ui/tray_label_other.go
new file mode 100644
index 000000000..e104bc8e8
--- /dev/null
+++ b/client/ui/tray_label_other.go
@@ -0,0 +1,7 @@
+//go:build !windows && !android && !ios && !freebsd && !js
+
+package main
+
+// menuLabel is the identity on macOS/Linux, which render "&" literally;
+// Windows escapes it separately (tray_label_windows.go) to dodge the Win32 mnemonic.
+func menuLabel(s string) string { return s }
diff --git a/client/ui/tray_label_windows.go b/client/ui/tray_label_windows.go
new file mode 100644
index 000000000..8c27ae9ea
--- /dev/null
+++ b/client/ui/tray_label_windows.go
@@ -0,0 +1,11 @@
+//go:build windows
+
+package main
+
+import "strings"
+
+// menuLabel doubles ampersands so Win32 draws a literal "&" instead of
+// consuming it as the menu mnemonic prefix (Wails passes the label unescaped).
+func menuLabel(s string) string {
+	return strings.ReplaceAll(s, "&", "&&")
+}
diff --git a/client/ui/tray_linux.go b/client/ui/tray_linux.go
new file mode 100644
index 000000000..1d6e0a48b
--- /dev/null
+++ b/client/ui/tray_linux.go
@@ -0,0 +1,71 @@
+//go:build linux && !386
+
+package main
+
+import (
+	"os"
+	"strings"
+)
+
+// init runs before Wails' own init(), so the env vars are set in time.
+func init() {
+	disableDMABUFRenderer()
+	disableCompositingMode()
+	disableWebKitSandboxIfNeeded()
+}
+
+func disableDMABUFRenderer() {
+	if os.Getenv("WEBKIT_DISABLE_DMABUF_RENDERER") != "" {
+		return
+	}
+
+	// WebKitGTK's DMA-BUF renderer leaves a blank-white window on many setups
+	// (VMs, containers, minimal WMs). Wails only disables it for NVIDIA+Wayland,
+	// but the issue is broader; software rendering is fine for a small UI.
+	_ = os.Setenv("WEBKIT_DISABLE_DMABUF_RENDERER", "1")
+}
+
+func disableCompositingMode() {
+	if os.Getenv("WEBKIT_DISABLE_COMPOSITING_MODE") != "" {
+		return
+	}
+	// Disabling the DMA-BUF renderer alone isn't enough on some Intel setups: the
+	// GL compositor still hits Mesa's unimplemented DRM-format-modifier paths and
+	// SIGSEGVs inside g_application_run before the first frame.
+	_ = os.Setenv("WEBKIT_DISABLE_COMPOSITING_MODE", "1")
+}
+
+// disableWebKitSandboxIfNeeded works around WebKitGTK crashing at startup when
+// its bwrap sandbox can't create an unprivileged user namespace (containers/VMs,
+// or Ubuntu 24.04+ AppArmor restrictions).
+func disableWebKitSandboxIfNeeded() {
+	if _, set := os.LookupEnv("WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS"); set {
+		return
+	}
+	if unprivilegedUsernsAllowed() {
+		return
+	}
+	_ = os.Setenv("WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS", "1")
+}
+
+// unprivilegedUsernsAllowed reports whether the kernel permits unprivileged
+// user namespaces (needed by WebKit's bwrap sandbox). Absent knobs are treated
+// as allowed, to avoid needlessly weakening the sandbox.
+func unprivilegedUsernsAllowed() bool {
+	// Debian/Ubuntu legacy switch: 0 disables unprivileged user namespaces.
+	if v, err := os.ReadFile("/proc/sys/kernel/unprivileged_userns_clone"); err == nil {
+		if strings.TrimSpace(string(v)) == "0" {
+			return false
+		}
+	}
+	// Ubuntu 24.04+ AppArmor restriction: non-zero restricts/blocks them.
+	if v, err := os.ReadFile("/proc/sys/kernel/apparmor_restrict_unprivileged_userns"); err == nil {
+		if strings.TrimSpace(string(v)) != "0" {
+			return false
+		}
+	}
+	return true
+}
+
+// Linux's tray provider needs the menu recreated rather than updated in place;
+// tray.go's rebuildExitNodeMenu already does this, so no extra workaround here.
diff --git a/client/ui/tray_notify.go b/client/ui/tray_notify.go
new file mode 100644
index 000000000..5b2629419
--- /dev/null
+++ b/client/ui/tray_notify.go
@@ -0,0 +1,61 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+const notifyIDDaemonOutdated = "netbird-daemon-outdated"
+
+// sendFn fits both NotificationService.SendNotification and SendNotificationWithActions.
+type sendFn func(notifications.NotificationOptions) error
+
+// safeSendNotification sends a best-effort OS notification, swallowing errors and panics.
+//
+// The panic guard is load-bearing on Linux: when Wails' notifier fails to
+// connect the session bus at startup (headless, unreachable
+// DBUS_SESSION_BUS_ADDRESS) it stays registered with a nil *dbus.Conn, so the
+// next send nil-derefs inside godbus. Because sends run on a Wails
+// event-dispatch goroutine that panic is fatal process-wide; recover() turns
+// it into a logged no-op.
+func safeSendNotification(send sendFn, what string, opts notifications.NotificationOptions) (err error) {
+	if services.ShuttingDown() {
+		return nil
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			log.Errorf("notify %s: recovered from panic (notification bus unavailable): %v", what, r)
+			err = nil
+		}
+	}()
+	if err := send(opts); err != nil {
+		log.Errorf("notify %s: %v", what, err)
+		return err
+	}
+	return nil
+}
+
+// notifyIfDaemonOutdated probes the daemon once and fires an OS toast when it
+// is reachable but too old for this UI. A probe error means the daemon isn't
+// reachable (not outdated), so it is left to the normal connection flow.
+func notifyIfDaemonOutdated(compat *services.Compat, notifier *Notifier, loc *Localizer) {
+	ready, err := compat.DaemonReady(context.Background())
+	if err != nil {
+		log.Debugf("daemon compatibility probe: %v", err)
+		return
+	}
+	if ready {
+		return
+	}
+	_ = safeSendNotification(notifier.SendNotification, "daemon-outdated", notifications.NotificationOptions{
+		ID:    notifyIDDaemonOutdated,
+		Title: loc.T("notify.daemonOutdated.title"),
+		Body:  loc.T("notify.daemonOutdated.body"),
+	})
+}
diff --git a/client/ui/tray_profiles.go b/client/ui/tray_profiles.go
new file mode 100644
index 000000000..5251c138e
--- /dev/null
+++ b/client/ui/tray_profiles.go
@@ -0,0 +1,194 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// formatProfileLabel returns the display label for a profile. Profiles can
+// share the same Name, so when more than one profile in profiles carries this
+// Name, a short form of the ID is appended to disambiguate the entries.
+func formatProfileLabel(profile services.Profile, profiles []services.Profile) string {
+	count := 0
+	for _, p := range profiles {
+		if p.Name == profile.Name {
+			count++
+		}
+	}
+	if count <= 1 {
+		return profile.Name
+	}
+	return fmt.Sprintf("%s (%s)", profile.Name, profilemanager.ID(profile.ID).ShortID())
+}
+
+// loadConfig caches the active-profile identity and the notifications gate.
+// Runs in a startup goroutine so a slow daemon does not block menu construction.
+func (t *Tray) loadConfig() {
+	ctx := context.Background()
+
+	active, err := t.svc.Profiles.GetActive(ctx)
+	if err != nil {
+		log.Debugf("get active profile: %v", err)
+		return
+	}
+	// Address the active profile by ID (the daemon resolves it as a handle),
+	// since display names can collide. ConfigParams no longer matches
+	// ActiveProfile's shape for a struct conversion now that it carries an ID.
+	cfg, err := t.svc.Settings.GetConfig(ctx, services.ConfigParams{
+		ProfileName: active.ID,
+		Username:    active.Username,
+	})
+	if err != nil {
+		log.Debugf("get config: %v", err)
+		return
+	}
+
+	t.profileMu.Lock()
+	t.activeProfile = active.ProfileName
+	t.activeUsername = active.Username
+	t.notificationsEnabled = !cfg.DisableNotifications
+	t.profileMu.Unlock()
+}
+
+// loadProfiles fetches the profile list and relayouts the menu. Also called
+// from applyStatus to catch flips from another channel (CLI, autoconnect),
+// since the daemon emits no active-profile event. Full relayout (not
+// Clear()+Add()) is required for KDE/Plasma — see relayoutMenu's doc comment.
+func (t *Tray) loadProfiles() {
+	t.profileLoadMu.Lock()
+	defer t.profileLoadMu.Unlock()
+	ctx := context.Background()
+
+	username, err := t.svc.Profiles.Username()
+	if err != nil {
+		log.Debugf("get current user: %v", err)
+		return
+	}
+	profiles, err := t.svc.Profiles.List(ctx, username)
+	if err != nil {
+		log.Debugf("list profiles: %v", err)
+		return
+	}
+
+	t.profilesMu.Lock()
+	t.profiles = profiles
+	t.profilesUser = username
+	t.profilesMu.Unlock()
+
+	t.relayoutMenu()
+}
+
+// fillProfileSubmenu paints cached profile rows into the freshly built submenu.
+// Pure UI: never fetches, never calls SetMenu (relayoutMenu owns the SetMenu).
+func (t *Tray) fillProfileSubmenu() {
+	if t.profileSubmenu == nil {
+		return
+	}
+	t.profilesMu.Lock()
+	profiles := append([]services.Profile(nil), t.profiles...)
+	username := t.profilesUser
+	t.profilesMu.Unlock()
+
+	sort.Slice(profiles, func(i, j int) bool {
+		if profiles[i].Name != profiles[j].Name {
+			return profiles[i].Name < profiles[j].Name
+		}
+		return profiles[i].ID < profiles[j].ID
+	})
+
+	// Wails' systray does not reliably propagate a disabled parent to its
+	// children on every platform, so disable each row explicitly.
+	disableProfiles, _ := t.featuresDisabled()
+
+	t.profileSubmenu.Clear()
+	var activeName, activeEmail string
+	for _, p := range profiles {
+		id := p.ID
+		// Display names can collide, so disambiguate with a short ID suffix.
+		display := formatProfileLabel(p, profiles)
+		active := p.IsActive
+		// Add, not AddCheckbox: Wails auto-toggles a checkbox on click before
+		// OnClick fires, so both old and new would briefly show checked during
+		// the switch. A plain item with a "✓ " prefix avoids the race.
+		label := display
+		if active {
+			label = "✓ " + display
+		}
+		item := t.profileSubmenu.Add(label)
+		item.OnClick(func(*application.Context) {
+			log.Infof("tray profile click: profile=%q id=%q wasActive=%v", display, id, active)
+			if active {
+				return
+			}
+			t.switchProfile(id, display)
+		})
+		item.SetEnabled(!disableProfiles)
+		if active {
+			activeName = display
+			activeEmail = p.Email
+		}
+	}
+	t.profileSubmenu.AddSeparator()
+	manageProfiles := t.profileSubmenu.Add(t.loc.T("tray.menu.manageProfiles"))
+	manageProfiles.OnClick(func(*application.Context) {
+		t.svc.WindowManager.OpenSettings("profiles")
+	})
+	manageProfiles.SetEnabled(!disableProfiles)
+	log.Infof("tray fillProfileSubmenu: %d profile(s) for user %q, active=%q", len(profiles), username, activeName)
+	if t.profileSubmenuItem != nil && activeName != "" {
+		t.profileSubmenuItem.SetLabel(activeName)
+	}
+	if t.profileEmailItem != nil {
+		if activeEmail != "" {
+			t.profileEmailItem.SetLabel(fmt.Sprintf("(%s)", activeEmail))
+			t.profileEmailItem.SetHidden(false)
+		} else {
+			t.profileEmailItem.SetHidden(true)
+		}
+	}
+}
+
+// switchProfile cancels any in-flight switch before starting a new one, so
+// rapid clicks converge to the last selected profile. Optimistic paint and
+// event suppression live in ProfileSwitcher, shared with the React Status page.
+// switchProfile sends handle (the profile's ID) to the daemon, which resolves
+// it precisely even when display names collide. display is used only for the
+// failure notification.
+func (t *Tray) switchProfile(handle, display string) {
+	t.profileMu.Lock()
+	if t.switchCancel != nil {
+		t.switchCancel()
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.switchCancel = cancel
+	t.profileMu.Unlock()
+
+	go func() {
+		username, err := t.svc.Profiles.Username()
+		if err != nil {
+			log.Errorf("tray switchProfile: get current user: %v", err)
+			return
+		}
+		if err := t.svc.ProfileSwitcher.SwitchActive(ctx, services.ProfileRef{
+			ProfileName: handle,
+			Username:    username,
+		}); err != nil {
+			if ctx.Err() != nil {
+				return
+			}
+			log.Errorf("tray switchProfile: %v", err)
+			t.notifyError(t.loc.T("notify.error.switchProfile", "profile", display))
+			return
+		}
+		t.loadProfiles()
+	}()
+}
diff --git a/client/ui/tray_session.go b/client/ui/tray_session.go
new file mode 100644
index 000000000..91c38be08
--- /dev/null
+++ b/client/ui/tray_session.go
@@ -0,0 +1,325 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"strconv"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+
+	nbstatus "github.com/netbirdio/netbird/client/status"
+	"github.com/netbirdio/netbird/client/ui/authsession"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+const (
+	notifyIDSessionExpired = "netbird-session-expired"
+	notifyIDSessionWarning = "netbird-session-warning"
+
+	notifyCategorySessionWarning = "netbird-session-warning"
+	notifyActionExtendNow        = "extend-now"
+	notifyActionDismiss          = "dismiss"
+
+	// finalWarningCountdownSeconds must stay in sync by hand with sessionwatch.FinalWarningLead.
+	finalWarningCountdownSeconds = 120
+)
+
+// handleSessionExpired notifies and brings the window forward so the user can reconnect.
+func (t *Tray) handleSessionExpired() {
+	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
+	t.showMain()
+}
+
+// applySessionExpiry refreshes the cached SSO deadline and reports whether it changed.
+// Cache-only; the caller relayouts when this returns true.
+func (t *Tray) applySessionExpiry(deadline *time.Time, connected bool) bool {
+	var d time.Time
+	if connected && deadline != nil {
+		d = *deadline
+	}
+
+	t.sessionMu.Lock()
+	changed := !t.sessionExpiresAt.Equal(d)
+	t.sessionExpiresAt = d
+	t.sessionMu.Unlock()
+
+	if changed {
+		switch {
+		case deadline == nil:
+			log.Infof("tray applySessionExpiry: deadline=<nil> connected=%v → row hidden", connected)
+		case deadline.IsZero():
+			log.Infof("tray applySessionExpiry: deadline=<zero> connected=%v → row hidden", connected)
+		default:
+			log.Infof("tray applySessionExpiry: deadline=%s (in %s) connected=%v",
+				deadline.Format(time.RFC3339), time.Until(*deadline), connected)
+		}
+	}
+	return changed
+}
+
+// runSessionExpiryTicker recomputes the "Expires in …" row label until process exit.
+// The interval scales with the remaining time: coarse when the deadline is far off,
+// down to 10s in the final two minutes so the label doesn't lag the ceiling-rounded
+// countdown near expiry. The cached deadline is re-read every iteration, so an extend
+// or reconnect that moves it is picked up on the next tick.
+func (t *Tray) runSessionExpiryTicker() {
+	tm := time.NewTimer(sessionRefreshInterval(t.sessionRemaining()))
+	defer tm.Stop()
+	for range tm.C {
+		t.refreshSessionExpiresLabel()
+		tm.Reset(sessionRefreshInterval(t.sessionRemaining()))
+	}
+}
+
+// sessionRemaining returns the time left on the cached SSO deadline, or 0 when unknown.
+func (t *Tray) sessionRemaining() time.Duration {
+	t.sessionMu.Lock()
+	deadline := t.sessionExpiresAt
+	t.sessionMu.Unlock()
+	if deadline.IsZero() {
+		return 0
+	}
+	return time.Until(deadline)
+}
+
+// sessionRefreshInterval picks how long to wait before the next label recompute.
+func sessionRefreshInterval(remaining time.Duration) time.Duration {
+	switch {
+	case remaining <= 0:
+		return 30 * time.Second
+	case remaining <= 2*time.Minute:
+		return 10 * time.Second
+	case remaining <= time.Hour:
+		return 30 * time.Second
+	default:
+		return time.Minute
+	}
+}
+
+// refreshSessionExpiresLabel updates only the countdown label, no relayout, to avoid disturbing an open menu.
+// The item is snapshotted under menuMu since buildMenu reassigns it on every relayout.
+func (t *Tray) refreshSessionExpiresLabel() {
+	t.menuMu.Lock()
+	item := t.sessionExpiresItem
+	t.menuMu.Unlock()
+	if item == nil {
+		return
+	}
+	t.sessionMu.Lock()
+	deadline := t.sessionExpiresAt
+	t.sessionMu.Unlock()
+	if deadline.IsZero() {
+		return
+	}
+	item.SetLabel(t.sessionRowLabel(deadline))
+}
+
+func (t *Tray) sessionRowLabel(deadline time.Time) string {
+	remaining := time.Until(deadline)
+	if remaining <= 0 {
+		return t.loc.T("tray.status.sessionExpired")
+	}
+	return t.loc.T("tray.session.expiresIn", "remaining", t.formatSessionRemaining(remaining))
+}
+
+// formatSessionRemaining renders d as a localised long-form string picking the largest non-zero unit.
+// Each unit is rounded up so the label never claims less time than actually remains, matching the
+// upper-bound sense of the sub-minute "less than a minute" fragment.
+// Singular/plural keys are split per language for proper translation.
+func (t *Tray) formatSessionRemaining(d time.Duration) string {
+	switch {
+	case d < time.Minute:
+		return t.loc.T("tray.session.unit.lessThanMinute")
+	case d <= 59*time.Minute:
+		m := ceilDiv(d, time.Minute)
+		if m == 1 {
+			return t.loc.T("tray.session.unit.minute")
+		}
+		return t.loc.T("tray.session.unit.minutes", "count", strconv.Itoa(m))
+	case d <= 23*time.Hour:
+		h := ceilDiv(d, time.Hour)
+		if h == 1 {
+			return t.loc.T("tray.session.unit.hour")
+		}
+		return t.loc.T("tray.session.unit.hours", "count", strconv.Itoa(h))
+	default:
+		days := ceilDiv(d, 24*time.Hour)
+		if days == 1 {
+			return t.loc.T("tray.session.unit.day")
+		}
+		return t.loc.T("tray.session.unit.days", "count", strconv.Itoa(days))
+	}
+}
+
+// ceilDiv divides d by unit rounding up, assuming d > 0.
+func ceilDiv(d, unit time.Duration) int {
+	return int((d + unit - time.Nanosecond) / unit)
+}
+
+// registerSessionWarningCategory wires the OS notification category and response handler for the expiry warning.
+// Errors are swallowed since the worst case is a plain notification without buttons.
+func (t *Tray) registerSessionWarningCategory() {
+	if t.svc.Notifier == nil {
+		return
+	}
+	if err := t.svc.Notifier.RegisterNotificationCategory(notifications.NotificationCategory{
+		ID: notifyCategorySessionWarning,
+		Actions: []notifications.NotificationAction{
+			{ID: notifyActionExtendNow, Title: t.loc.T("notify.sessionWarning.extend")},
+			{ID: notifyActionDismiss, Title: t.loc.T("notify.sessionWarning.dismiss")},
+		},
+	}); err != nil {
+		log.Debugf("register session-warning notification category: %v", err)
+	}
+	t.svc.Notifier.OnNotificationResponse(func(result notifications.NotificationResult) {
+		if result.Error != nil {
+			log.Debugf("notification response error: %v", result.Error)
+			return
+		}
+		if result.Response.CategoryID != notifyCategorySessionWarning {
+			return
+		}
+		switch result.Response.ActionIdentifier {
+		case notifyActionExtendNow, notifications.DefaultActionIdentifier:
+			// DefaultActionIdentifier is the body-click on platforms with no separate buttons; treat as Extend.
+			go t.runExtendSession()
+		case notifyActionDismiss:
+			go t.dismissSessionWarning()
+		}
+	})
+}
+
+// buildSessionWarningBody composes the localised notification body from the daemon's metadata.
+// The daemon has no locale, so it ships an RFC3339 deadline the tray turns into a user-language sentence.
+// Falls back to a generic string when metadata is missing or unparsable.
+func (t *Tray) buildSessionWarningBody(meta map[string]string) string {
+	if meta == nil {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	raw := meta[authsession.MetaExpiresAt]
+	if raw == "" {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	deadline, err := authsession.ParseExpiresAt(raw)
+	if err != nil {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	remaining := nbstatus.FormatRemainingDuration(time.Until(deadline))
+	return t.loc.T("notify.sessionWarning.body", "remaining", remaining)
+}
+
+// notifySessionWarning sends the interactive expiry notification, falling back to plain notify when the
+// with-actions variant is unavailable (older platform impls, or a bare Notifier in tests).
+func (t *Tray) notifySessionWarning(title, body string) {
+	if t.svc.Notifier == nil {
+		return
+	}
+	err := safeSendNotification(t.svc.Notifier.SendNotificationWithActions, "session-warning with actions", notifications.NotificationOptions{
+		ID:         notifyIDSessionWarning,
+		Title:      title,
+		Body:       body,
+		CategoryID: notifyCategorySessionWarning,
+	})
+	if err != nil {
+		// A recovered panic returns nil err, so a dead bus correctly skips this fallback (it would panic too).
+		t.notify(title, body, notifyIDSessionWarning)
+	}
+}
+
+// runExtendSession drives the daemon's RequestExtend + WaitExtend pair, opening the browser via Connection.OpenURL.
+// Errors surface as notifyError rather than foreground UI, since the warning may fire while the window is closed.
+func (t *Tray) runExtendSession() {
+	if t.svc.Session == nil || t.svc.Connection == nil {
+		log.Debugf("session-warning: extend requested but services not wired")
+		return
+	}
+	ctx := context.Background()
+
+	start, err := t.svc.Session.RequestExtend(ctx, services.ExtendStartParams{})
+	if err != nil {
+		log.Warnf("session-warning: RequestExtend failed: %v", err)
+		t.notifyError(t.loc.T("notify.sessionWarning.failed"))
+		return
+	}
+
+	uri := start.VerificationURIComplete
+	if uri == "" {
+		uri = start.VerificationURI
+	}
+	if uri != "" {
+		if err := t.svc.Connection.OpenURL(uri); err != nil {
+			log.Debugf("session-warning: opening verification URL: %v", err)
+		}
+	}
+
+	result, err := t.svc.Session.WaitExtend(ctx, services.ExtendWaitParams{
+		DeviceCode: start.DeviceCode,
+		UserCode:   start.UserCode,
+	})
+	if err != nil {
+		log.Warnf("session-warning: WaitExtend failed: %v", err)
+		t.notifyError(t.loc.T("notify.sessionWarning.failed"))
+		return
+	}
+	if result.Preempted {
+		// Another UI surface owns the flow; stay silent so the user only sees the surviving flow's outcome.
+		log.Debugf("session-warning: WaitExtend preempted by a newer flow")
+		return
+	}
+	t.notify(t.loc.T("notify.sessionWarning.successTitle"), t.loc.T("notify.sessionWarning.successBody"), notifyIDSessionWarning)
+}
+
+// dismissSessionWarning tells the daemon to silence the fallback dialog for the current deadline.
+// Best-effort: a failure only means the dialog will still appear.
+func (t *Tray) dismissSessionWarning() {
+	if t.svc.Session == nil {
+		return
+	}
+	if err := t.svc.Session.DismissWarning(context.Background()); err != nil {
+		log.Debugf("session-warning: DismissWarning failed: %v", err)
+	}
+}
+
+// openSessionExpiration fires the fallback dialog when the earlier warning notification wasn't dismissed.
+// deadline is the absolute expiry from the warning event's metadata; when zero (older daemon,
+// malformed metadata) the cached status-snapshot deadline fills in. Idempotent on the
+// WindowManager side.
+func (t *Tray) openSessionExpiration(deadline time.Time) {
+	if t.svc.WindowManager == nil {
+		return
+	}
+	if deadline.IsZero() {
+		t.sessionMu.Lock()
+		deadline = t.sessionExpiresAt
+		t.sessionMu.Unlock()
+	}
+	var deadlineMs int64
+	if !deadline.IsZero() {
+		deadlineMs = deadline.UnixMilli()
+	}
+	t.svc.WindowManager.OpenSessionExpiration(finalWarningCountdownSeconds, deadlineMs)
+}
+
+// openSessionExtendFlow opens the SessionExpiration window seeded with the cached deadline's remaining time,
+// for the "Expires in …" tray row. Once the deadline has elapsed the row reads "Session expired" and the
+// click routes to the login flow instead. No-op when the deadline is unknown.
+func (t *Tray) openSessionExtendFlow() {
+	t.sessionMu.Lock()
+	deadline := t.sessionExpiresAt
+	t.sessionMu.Unlock()
+	if deadline.IsZero() {
+		return
+	}
+	seconds := int(time.Until(deadline).Seconds())
+	if seconds <= 0 {
+		t.showMainAndEmit(services.EventTriggerLogin)
+		return
+	}
+	if t.svc.WindowManager == nil {
+		return
+	}
+	t.svc.WindowManager.OpenSessionExpiration(seconds, deadline.UnixMilli())
+}
diff --git a/client/ui/tray_status.go b/client/ui/tray_status.go
new file mode 100644
index 000000000..793f1785a
--- /dev/null
+++ b/client/ui/tray_status.go
@@ -0,0 +1,126 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"strings"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+func (t *Tray) onStatusEvent(ev *application.CustomEvent) {
+	st, ok := ev.Data.(services.Status)
+	if !ok {
+		return
+	}
+	t.applyStatus(st)
+}
+
+// applyStatus repaints the tray from a daemon snapshot. Icon refresh is skipped
+// when no icon-relevant input changed: the daemon emits rapid SubscribeStatus
+// bursts during health probes that would otherwise spam Shell_NotifyIcon.
+func (t *Tray) applyStatus(st services.Status) {
+	t.statusMu.Lock()
+	connected := strings.EqualFold(st.Status, services.StatusConnected)
+	iconChanged := connected != t.connected || st.Status != t.lastStatus
+	// The daemon re-emits SessionExpired on every snapshot while expired; act
+	// only on the transition into it so the notification fires once.
+	sessionExpiredEnter := strings.EqualFold(st.Status, services.StatusSessionExpired) &&
+		!strings.EqualFold(t.lastStatus, services.StatusSessionExpired)
+
+	triggerLogin := t.consumePendingConnectLogin(st.Status)
+
+	daemonVersionChanged := st.DaemonVersion != "" && st.DaemonVersion != t.lastDaemonVersion
+	t.connected = connected
+	t.lastStatus = st.Status
+	if daemonVersionChanged {
+		t.lastDaemonVersion = st.DaemonVersion
+	}
+
+	revisionChanged := st.NetworksRevision != t.lastNetworksRevision
+	t.lastNetworksRevision = st.NetworksRevision
+	t.statusMu.Unlock()
+
+	if triggerLogin {
+		t.app.Event.Emit(services.EventTriggerLogin)
+	}
+
+	// Cache-only; the row is painted by the relayout below.
+	sessionChanged := t.applySessionExpiry(st.SessionExpiresAt, connected)
+
+	if iconChanged {
+		t.applyIcon()
+	}
+	// All repainting goes through relayoutMenu (menuMu-serialised): applyStatus
+	// runs concurrently with itself and with relayouts, so in-place item
+	// mutation would race the buildMenu pointer swap.
+	if iconChanged || daemonVersionChanged || sessionChanged {
+		t.relayoutMenu()
+	}
+	// The revision is the only reliable signal: candidate routes never appear
+	// in the peer-status snapshot, so a removed exit node would go unnoticed.
+	if iconChanged || revisionChanged {
+		go t.refreshExitNodes()
+	}
+	// The daemon emits no active-profile event, so profile flips driven
+	// elsewhere (CLI, autoconnect) surface via status transitions.
+	if iconChanged {
+		go t.loadProfiles()
+	}
+	if sessionExpiredEnter {
+		t.handleSessionExpired()
+	}
+}
+
+// consumePendingConnectLogin acts on the SSO auto-handoff flag armed by
+// handleConnect. Returns true on NeedsLogin so the browser-login flow starts
+// without a second Connect click; clears the flag on any terminal state so a
+// stale flag can't fire on a later daemon flip. Must hold statusMu.
+func (t *Tray) consumePendingConnectLogin(status string) bool {
+	if !t.pendingConnectLogin {
+		return false
+	}
+	switch {
+	case strings.EqualFold(status, services.StatusNeedsLogin):
+		t.pendingConnectLogin = false
+		return true
+	case strings.EqualFold(status, services.StatusConnected),
+		strings.EqualFold(status, services.StatusIdle),
+		strings.EqualFold(status, services.StatusLoginFailed),
+		strings.EqualFold(status, services.StatusSessionExpired),
+		strings.EqualFold(status, services.StatusDaemonUnavailable):
+		t.pendingConnectLogin = false
+	}
+	return false
+}
+
+// applyStatusIndicator sets the status dot bitmap. Call only from relayoutMenu
+// (menuMu held): on macOS the bitmap repaints via the relayout's trailing
+// SetMenu, not here — the tree is half-built.
+func (t *Tray) applyStatusIndicator(status string) {
+	if t.statusItem == nil {
+		return
+	}
+	t.statusItem.SetBitmap(statusIndicatorBitmap(status))
+}
+
+func statusIndicatorBitmap(status string) []byte {
+	switch {
+	case strings.EqualFold(status, services.StatusConnected):
+		return iconMenuDotConnected
+	case strings.EqualFold(status, services.StatusConnecting):
+		return iconMenuDotConnecting
+	case strings.EqualFold(status, services.StatusNeedsLogin),
+		strings.EqualFold(status, services.StatusSessionExpired):
+		return iconMenuDotConnecting
+	case strings.EqualFold(status, services.StatusLoginFailed),
+		strings.EqualFold(status, statusError):
+		return iconMenuDotError
+	case strings.EqualFold(status, services.StatusDaemonUnavailable):
+		return iconMenuDotOffline
+	default:
+		return iconMenuDotIdle
+	}
+}
diff --git a/client/ui/tray_status_enabled_linux.go b/client/ui/tray_status_enabled_linux.go
new file mode 100644
index 000000000..ab7f869b8
--- /dev/null
+++ b/client/ui/tray_status_enabled_linux.go
@@ -0,0 +1,8 @@
+//go:build linux
+
+package main
+
+// statusRowEnabled keeps the top status row enabled on Linux: a disabled row
+// paints greyed-out, washing out the status dot. The row has no OnClick, so
+// enabling only affects drawing.
+func statusRowEnabled() bool { return true }
diff --git a/client/ui/tray_status_enabled_other.go b/client/ui/tray_status_enabled_other.go
new file mode 100644
index 000000000..606a7d702
--- /dev/null
+++ b/client/ui/tray_status_enabled_other.go
@@ -0,0 +1,7 @@
+//go:build !windows && !linux && !android && !ios && !freebsd && !js
+
+package main
+
+// statusRowEnabled is false on macOS: disabling the row dims the label (signalling
+// non-clickable) while keeping the bitmap opaque, so the coloured dot stays visible.
+func statusRowEnabled() bool { return false }
diff --git a/client/ui/tray_status_enabled_windows.go b/client/ui/tray_status_enabled_windows.go
new file mode 100644
index 000000000..06750b7c0
--- /dev/null
+++ b/client/ui/tray_status_enabled_windows.go
@@ -0,0 +1,7 @@
+//go:build windows
+
+package main
+
+// statusRowEnabled is always true on Windows: the Win32 disabled-state mask
+// desaturates the row's HBITMAP, which would grey out the coloured status dot.
+func statusRowEnabled() bool { return true }
diff --git a/client/ui/tray_theme_linux.go b/client/ui/tray_theme_linux.go
new file mode 100644
index 000000000..f9978a7fe
--- /dev/null
+++ b/client/ui/tray_theme_linux.go
@@ -0,0 +1,233 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+// Wails v3's Linux SNI backend ignores SetDarkModeIcon (it just calls setIcon,
+// last write wins) and SNI carries no panel dark/light hint, so we detect the
+// desktop colour scheme ourselves and pick the silhouette in iconForState.
+// The live watcher is in tray_theme_watcher_linux.go.
+
+import (
+	"bufio"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// The two KDE files that decide the panel's appearance. Both live in the user
+// config dir, so one directory watch covers them (see watchKdeConfig).
+const (
+	kdeglobalsFile = "kdeglobals"
+	plasmarcFile   = "plasmarc"
+)
+
+// startTrayTheme seeds t.panelDark and repaints on colour-scheme flips. Must
+// run before the first applyIcon so the initial paint uses the right silhouette.
+func (t *Tray) startTrayTheme() {
+	w := startThemeWatcher(func() { t.applyIcon() })
+	t.panelDark = w.IsDark
+}
+
+// isKDE reports whether the current desktop is KDE Plasma. XDG_CURRENT_DESKTOP
+// is a colon-separated list (e.g. "ubuntu:KDE"), so match per token.
+func isKDE() bool {
+	for _, d := range strings.Split(os.Getenv("XDG_CURRENT_DESKTOP"), ":") {
+		if strings.EqualFold(strings.TrimSpace(d), "KDE") {
+			return true
+		}
+	}
+	return false
+}
+
+// kdeConfigPath locates one of KDE's user config files. We read only the user
+// file, not the full XDG_CONFIG_DIRS cascade: Plasma writes the active scheme
+// and style there, and anything missing falls back to the portal.
+func kdeConfigPath(name string) string {
+	if dir := os.Getenv("XDG_CONFIG_HOME"); dir != "" {
+		return filepath.Join(dir, name)
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return ""
+	}
+	return filepath.Join(home, ".config", name)
+}
+
+func kdeglobalsPath() string { return kdeConfigPath(kdeglobalsFile) }
+func plasmarcPath() string   { return kdeConfigPath(plasmarcFile) }
+
+// kdePanelIsDark reports whether the KDE Plasma panel the tray icon sits on is
+// dark. ok is false when this isn't KDE or neither source was conclusive, so the
+// caller falls through to the portal/GTK path.
+func kdePanelIsDark() (dark, ok bool) {
+	if !isKDE() {
+		return false, false
+	}
+	// A pinned Plasma style paints the panel itself, so it outranks the
+	// application colour scheme: a style with dark colours under a Light scheme
+	// is still a dark panel and still needs the white silhouette.
+	if dark, ok := plasmaStyleIsDark(); ok {
+		return dark, true
+	}
+	// The default style follows the colour scheme, so decide by the luma of the
+	// window background Plasma derives the panel from. Deliberately not
+	// Complementary: that group is dark under Breeze *and* BreezeLight
+	// (42,46,50 measured on Plasma 6.7.4), so reading it kept the white icon on
+	// a light panel, where it is all but invisible.
+	rgb, ok := readKdeColour(kdeglobalsPath(), "[Colors:Window]")
+	if !ok {
+		return false, false
+	}
+	return isDarkRGB(rgb[0], rgb[1], rgb[2]), true
+}
+
+// plasmaStyleIsDark reports the appearance the pinned Plasma style paints the
+// panel with, decided by the style's own colours rather than by its name. A
+// style that ships a colours file overrides the colour scheme for the shell, and
+// nothing requires the name to admit it: breeze-dark happens to, but a style
+// named neutrally can carry dark colours just as well (measured on Plasma 6.7.4:
+// panel luma 38 while kdeglobals and the portal both reported light).
+//
+// ok is false when no style is pinned, when the pinned style ships no colours --
+// the "default" style, which is exactly the case that follows the colour scheme
+// -- and when its colours cannot be read; all three fall through to kdeglobals.
+func plasmaStyleIsDark() (dark, ok bool) {
+	name, found := readIniValue(plasmarcPath(), "[Theme]", "name")
+	if !found || name == "" {
+		return false, false
+	}
+	if !isBareStyleName(name) {
+		log.Debugf("tray theme: ignoring plasma style name %q, not a bare directory name", name)
+		return false, false
+	}
+	for _, dir := range plasmaStyleDirs(name) {
+		rgb, found := readKdeColour(filepath.Join(dir, "colors"), "[Colors:Window]")
+		if !found {
+			continue
+		}
+		return isDarkRGB(rgb[0], rgb[1], rgb[2]), true
+	}
+	return false, false
+}
+
+// isBareStyleName reports whether name is safe to index a directory with. The
+// name comes from a config file and is joined into a path, so it has to be a
+// single ordinary element: "../" in it would point the read anywhere, and ".",
+// ".." and "/" all survive filepath.Base(filepath.Clean(name)) unchanged, so
+// they need rejecting by name -- ".." alone resolves a level above desktoptheme.
+func isBareStyleName(name string) bool {
+	if name == "" || name == "." || name == ".." || filepath.IsAbs(name) {
+		return false
+	}
+	return name == filepath.Base(filepath.Clean(name))
+}
+
+// plasmaStyleDirs lists where a Plasma style of that name may live, in the order
+// Plasma itself resolves them: the user data dir first, so a local style shadows
+// a system one of the same name.
+func plasmaStyleDirs(name string) []string {
+	var dirs []string
+	for _, base := range xdgDataDirs() {
+		dirs = append(dirs, filepath.Join(base, "plasma", "desktoptheme", name))
+	}
+	return dirs
+}
+
+// xdgDataDirs returns XDG_DATA_HOME (or its default) followed by XDG_DATA_DIRS.
+func xdgDataDirs() []string {
+	var dirs []string
+	if home := os.Getenv("XDG_DATA_HOME"); home != "" {
+		dirs = append(dirs, home)
+	} else if h, err := os.UserHomeDir(); err == nil {
+		dirs = append(dirs, filepath.Join(h, ".local", "share"))
+	}
+	system := os.Getenv("XDG_DATA_DIRS")
+	if system == "" {
+		system = "/usr/local/share:/usr/share"
+	}
+	for _, dir := range strings.Split(system, ":") {
+		if dir != "" {
+			dirs = append(dirs, dir)
+		}
+	}
+	return dirs
+}
+
+// readKdeColour reads group's BackgroundNormal as an R,G,B triple.
+func readKdeColour(path, group string) (rgb [3]uint8, ok bool) {
+	val, found := readIniValue(path, group, "BackgroundNormal")
+	if !found {
+		return rgb, false
+	}
+	return parseRGB(val)
+}
+
+// readIniValue returns key's value inside group from a KDE-style INI file.
+// group carries its own brackets, e.g. "[Colors:Window]".
+func readIniValue(path, group, key string) (value string, ok bool) {
+	if path == "" {
+		return "", false
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		log.Debugf("tray theme: %s open failed, using portal: %v", filepath.Base(path), err)
+		return "", false
+	}
+	defer func() { _ = f.Close() }()
+
+	inGroup := false
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if strings.HasPrefix(line, "[") {
+			inGroup = line == group
+			continue
+		}
+		if !inGroup {
+			continue
+		}
+		k, v, found := strings.Cut(line, "=")
+		if !found || strings.TrimSpace(k) != key {
+			continue
+		}
+		return strings.TrimSpace(v), true
+	}
+	return "", false
+}
+
+// parseRGB parses KDE's "r,g,b" colour triple into bytes.
+func parseRGB(s string) (rgb [3]uint8, ok bool) {
+	parts := strings.Split(s, ",")
+	if len(parts) != 3 {
+		return rgb, false
+	}
+	for i, p := range parts {
+		n, err := strconv.Atoi(strings.TrimSpace(p))
+		if err != nil || n < 0 || n > 255 {
+			return rgb, false
+		}
+		rgb[i] = uint8(n)
+	}
+	return rgb, true
+}
+
+// isDarkRGB reports whether a colour is dark via Rec. 601 luma, split at the
+// 128 midpoint.
+func isDarkRGB(r, g, b uint8) bool {
+	luma := (299*int(r) + 587*int(g) + 114*int(b)) / 1000
+	return luma < 128
+}
+
+// gtkThemeIsDark inspects the GTK_THEME env var. Empty (no override) is treated
+// as dark to match the default-dark fallback used elsewhere.
+func gtkThemeIsDark() bool {
+	theme := os.Getenv("GTK_THEME")
+	if theme == "" {
+		return true
+	}
+	// GTK_THEME is "Name[:variant]"; the dark variant is ":dark".
+	return strings.Contains(strings.ToLower(theme), ":dark")
+}
diff --git a/client/ui/tray_theme_linux_test.go b/client/ui/tray_theme_linux_test.go
new file mode 100644
index 000000000..e3476055d
--- /dev/null
+++ b/client/ui/tray_theme_linux_test.go
@@ -0,0 +1,383 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// Values measured on Plasma 6.7.4 (Fedora 44) under each Breeze scheme. The
+// Complementary group is dark under both, which is why it can't decide the
+// panel; Window tracks it.
+const (
+	kdeglobalsLight = `[Colors:Complementary]
+BackgroundAlternate=27,30,32
+BackgroundNormal=42,46,50
+
+[Colors:Window]
+BackgroundNormal=239,240,241
+
+[General]
+ColorSchemeHash=0be804dba87e3512aeb4be3d78ed981f59f0f2f4
+`
+	kdeglobalsDark = `[Colors:Complementary]
+BackgroundNormal=32,35,38
+
+[Colors:Window]
+BackgroundNormal=32,35,38
+
+[General]
+ColorScheme=BreezeDark
+`
+)
+
+// plasmaStyle installs a Plasma style of that name under XDG_DATA_HOME. An
+// empty colours body installs the style without a colours file, which is what
+// the stock "default" style looks like.
+func plasmaStyle(t *testing.T, name, colours string) string {
+	t.Helper()
+	data := t.TempDir()
+	dir := filepath.Join(data, "plasma", "desktoptheme", name)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if colours != "" {
+		if err := os.WriteFile(filepath.Join(dir, "colors"), []byte(colours), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	t.Setenv("XDG_DATA_HOME", data)
+	// Keep the system dirs out of it so an installed breeze-dark cannot answer.
+	t.Setenv("XDG_DATA_DIRS", filepath.Join(data, "empty"))
+	return data
+}
+
+// kdeConfig points the KDE readers at a temp dir holding the given files, and
+// makes isKDE report KDE. An empty body skips the file.
+func kdeConfig(t *testing.T, kdeglobals, plasmarc string) {
+	t.Helper()
+	dir := t.TempDir()
+	for name, body := range map[string]string{kdeglobalsFile: kdeglobals, plasmarcFile: plasmarc} {
+		if body == "" {
+			continue
+		}
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	t.Setenv("XDG_CONFIG_HOME", dir)
+	t.Setenv("XDG_CURRENT_DESKTOP", "KDE")
+	// Point the Plasma style lookup at empty dirs so a style installed on the
+	// host cannot answer for a test that did not install one itself. Tests that
+	// want a style call plasmaStyle, which overrides these.
+	t.Setenv("XDG_DATA_HOME", filepath.Join(dir, "empty-data-home"))
+	t.Setenv("XDG_DATA_DIRS", filepath.Join(dir, "empty-data-dirs"))
+}
+
+// The reported bug: a Light global scheme left the panel reported dark, so the
+// tray kept the white silhouette on a light panel.
+func TestKdePanelIsDarkFollowsColourScheme(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		kdeglobals string
+		wantDark   bool
+	}{
+		{"light scheme", kdeglobalsLight, false},
+		{"dark scheme", kdeglobalsDark, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			kdeConfig(t, tc.kdeglobals, "")
+			dark, ok := kdePanelIsDark()
+			if !ok {
+				t.Fatal("expected a conclusive answer from kdeglobals")
+			}
+			if dark != tc.wantDark {
+				t.Fatalf("dark = %v, want %v", dark, tc.wantDark)
+			}
+		})
+	}
+}
+
+// A pinned Plasma style paints the panel regardless of the colour scheme, so it
+// has to outrank it in both directions. The styles are installed into the test's
+// own XDG_DATA_HOME: reading whatever the host happens to ship would make the
+// result depend on the machine.
+func TestKdePanelIsDarkPinnedStyleOutranksScheme(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		kdeglobals   string
+		style        string
+		styleColours string
+		wantDark     bool
+	}{
+		{"dark style, light scheme", kdeglobalsLight, "breeze-dark", kdeglobalsDark, true},
+		{"light style, dark scheme", kdeglobalsDark, "breeze-light", kdeglobalsLight, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			kdeConfig(t, tc.kdeglobals, "[Theme]\nname="+tc.style+"\n")
+			plasmaStyle(t, tc.style, tc.styleColours)
+			dark, ok := kdePanelIsDark()
+			if !ok {
+				t.Fatal("expected a conclusive answer from the pinned style")
+			}
+			if dark != tc.wantDark {
+				t.Fatalf("dark = %v, want %v", dark, tc.wantDark)
+			}
+		})
+	}
+}
+
+// "default" fixes nothing, so the colour scheme still decides.
+func TestKdePanelIsDarkDefaultStyleDefersToScheme(t *testing.T) {
+	kdeConfig(t, kdeglobalsLight, "[Theme]\nname=default\n")
+	dark, ok := kdePanelIsDark()
+	if !ok {
+		t.Fatal("expected the colour scheme to answer")
+	}
+	if dark {
+		t.Fatal("default style on a Light scheme is a light panel")
+	}
+}
+
+// No colours and no style: stay inconclusive so readDarkMode uses the portal
+// rather than guessing.
+func TestKdePanelIsDarkInconclusive(t *testing.T) {
+	t.Run("no window group", func(t *testing.T) {
+		kdeConfig(t, "[Colors:Complementary]\nBackgroundNormal=42,46,50\n", "")
+		if _, ok := kdePanelIsDark(); ok {
+			t.Fatal("expected not-ok without a Window group")
+		}
+	})
+	t.Run("no kde files", func(t *testing.T) {
+		kdeConfig(t, "", "")
+		if _, ok := kdePanelIsDark(); ok {
+			t.Fatal("expected not-ok with no kdeglobals at all")
+		}
+	})
+	t.Run("not kde", func(t *testing.T) {
+		kdeConfig(t, kdeglobalsDark, "")
+		t.Setenv("XDG_CURRENT_DESKTOP", "ubuntu:GNOME")
+		if _, ok := kdePanelIsDark(); ok {
+			t.Fatal("expected not-ok off KDE")
+		}
+	})
+}
+
+// The panel follows the pinned style's own colours, not its name. Reproduces
+// the measured case: a neutrally named style shipping dark colours while
+// kdeglobals reports light.
+func TestPlasmaStyleIsDarkUsesStyleColours(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		style    string
+		colours  string
+		wantDark bool
+	}{
+		{"neutral name, dark colours", "nbtestneutral", kdeglobalsDark, true},
+		{"neutral name, light colours", "nbtestneutral", kdeglobalsLight, false},
+		{"name says dark, colours are light", "midnight-dark", kdeglobalsLight, false},
+		{"name says light, colours are dark", "daylight", kdeglobalsDark, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			kdeConfig(t, kdeglobalsLight, "[Theme]\nname="+tc.style+"\n")
+			plasmaStyle(t, tc.style, tc.colours)
+			dark, ok := plasmaStyleIsDark()
+			if !ok {
+				t.Fatal("a style shipping colours should be conclusive")
+			}
+			if dark != tc.wantDark {
+				t.Fatalf("dark = %v, want %v", dark, tc.wantDark)
+			}
+		})
+	}
+}
+
+// End to end through kdePanelIsDark: the style's colours must beat kdeglobals.
+func TestKdePanelIsDarkStyleColoursBeatColourScheme(t *testing.T) {
+	kdeConfig(t, kdeglobalsLight, "[Theme]\nname=nbtestneutral\n")
+	plasmaStyle(t, "nbtestneutral", kdeglobalsDark)
+	dark, ok := kdePanelIsDark()
+	if !ok {
+		t.Fatal("expected a conclusive answer")
+	}
+	if !dark {
+		t.Fatal("a dark-coloured style on a Light scheme is a dark panel")
+	}
+}
+
+// A style with no colours file is the "default" case: it follows the scheme.
+func TestPlasmaStyleIsDarkNoColoursFile(t *testing.T) {
+	kdeConfig(t, kdeglobalsLight, "[Theme]\nname=default\n")
+	plasmaStyle(t, "default", "")
+	if _, ok := plasmaStyleIsDark(); ok {
+		t.Fatal("a style without colours must defer to the colour scheme")
+	}
+	// and the whole resolution then lands on the light scheme
+	dark, ok := kdePanelIsDark()
+	if !ok || dark {
+		t.Fatalf("kdePanelIsDark() = (%v, %v), want (false, true)", dark, ok)
+	}
+}
+
+func TestPlasmaStyleIsDarkInconclusive(t *testing.T) {
+	t.Run("no plasmarc", func(t *testing.T) {
+		kdeConfig(t, kdeglobalsLight, "")
+		plasmaStyle(t, "unused", kdeglobalsDark)
+		if _, ok := plasmaStyleIsDark(); ok {
+			t.Fatal("expected not-ok with no plasmarc")
+		}
+	})
+	t.Run("empty style name", func(t *testing.T) {
+		kdeConfig(t, kdeglobalsLight, "[Theme]\nname=\n")
+		if _, ok := plasmaStyleIsDark(); ok {
+			t.Fatal("expected not-ok for an empty style name")
+		}
+	})
+	t.Run("style not installed", func(t *testing.T) {
+		kdeConfig(t, kdeglobalsLight, "[Theme]\nname=absent\n")
+		plasmaStyle(t, "somethingelse", kdeglobalsDark)
+		if _, ok := plasmaStyleIsDark(); ok {
+			t.Fatal("expected not-ok when the style is not installed")
+		}
+	})
+	// ... but a leading dot in an ordinary name is fine.
+	for _, good := range []string{".hidden", "..."} {
+		t.Run("accepts "+good, func(t *testing.T) {
+			kdeConfig(t, kdeglobalsLight, "[Theme]\nname="+good+"\n")
+			plasmaStyle(t, good, kdeglobalsDark)
+			dark, ok := plasmaStyleIsDark()
+			if !ok || !dark {
+				t.Fatalf("plasmaStyleIsDark() = (%v, %v) for %q, want (true, true)", dark, ok, good)
+			}
+		})
+	}
+}
+
+// A traversing name must be rejected outright, not merely fail to find a file.
+// Each case plants colours at exactly the path the unguarded lookup would read,
+// so removing the name check makes plasmaStyleIsDark answer from the planted
+// file and these fail. Without the planted file the test would pass either way.
+func TestPlasmaStyleIsDarkRejectsPlantedEscape(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		// where filepath.Join(data, "plasma", "desktoptheme", name) lands
+		escaped []string
+	}{
+		{"..", []string{"plasma"}},
+		{".", []string{"plasma", "desktoptheme"}},
+		{"/", []string{"plasma", "desktoptheme"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			kdeConfig(t, kdeglobalsLight, "[Theme]\nname="+tc.name+"\n")
+			data := plasmaStyle(t, "unused", kdeglobalsLight)
+
+			target := filepath.Join(append([]string{data}, tc.escaped...)...)
+			// Guard the fixture itself: if Join ever stops landing here the
+			// test would go quietly vacuous again.
+			want := filepath.Clean(filepath.Join(data, "plasma", "desktoptheme", tc.name))
+			if target != want {
+				t.Fatalf("fixture targets %q but the lookup resolves %q", target, want)
+			}
+			if err := os.WriteFile(filepath.Join(target, "colors"), []byte(kdeglobalsDark), 0o600); err != nil {
+				t.Fatal(err)
+			}
+
+			if dark, ok := plasmaStyleIsDark(); ok {
+				t.Fatalf("plasmaStyleIsDark() = (%v, true) for %q: the name must be rejected, "+
+					"not resolved against %s", dark, tc.name, target)
+			}
+		})
+	}
+}
+
+// The rejection condition on its own, so every case is checked whether or not a
+// file happens to exist at the path it would resolve to.
+func TestIsBareStyleName(t *testing.T) {
+	for _, bad := range []string{"", ".", "..", "/", "//", "/etc", "../../../../etc", "a/b", "a/", "./x", "../x"} {
+		if isBareStyleName(bad) {
+			t.Errorf("isBareStyleName(%q) = true, want false", bad)
+		}
+	}
+	for _, good := range []string{"breeze-dark", "default", ".hidden", "...", "Breeze Dark", "a.b"} {
+		if !isBareStyleName(good) {
+			t.Errorf("isBareStyleName(%q) = false, want true", good)
+		}
+	}
+}
+
+// A local style of the same name shadows the system one, as in Plasma.
+func TestPlasmaStyleDirsPreferUserData(t *testing.T) {
+	t.Setenv("XDG_DATA_HOME", "/home/someone/.local/share")
+	t.Setenv("XDG_DATA_DIRS", "/usr/local/share:/usr/share")
+	got := plasmaStyleDirs("breeze-dark")
+	want := []string{
+		"/home/someone/.local/share/plasma/desktoptheme/breeze-dark",
+		"/usr/local/share/plasma/desktoptheme/breeze-dark",
+		"/usr/share/plasma/desktoptheme/breeze-dark",
+	}
+	if len(got) != len(want) {
+		t.Fatalf("plasmaStyleDirs() = %v, want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("plasmaStyleDirs()[%d] = %q, want %q", i, got[i], want[i])
+		}
+	}
+}
+
+func TestReadIniValue(t *testing.T) {
+	path := filepath.Join(t.TempDir(), kdeglobalsFile)
+	if err := os.WriteFile(path, []byte(kdeglobalsLight), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	// The same key exists in two groups, so a group-blind reader would return
+	// whichever came first.
+	if v, ok := readIniValue(path, "[Colors:Window]", "BackgroundNormal"); !ok || v != "239,240,241" {
+		t.Fatalf("Window BackgroundNormal = %q ok=%v, want \"239,240,241\" true", v, ok)
+	}
+	if v, ok := readIniValue(path, "[Colors:Complementary]", "BackgroundNormal"); !ok || v != "42,46,50" {
+		t.Fatalf("Complementary BackgroundNormal = %q ok=%v, want \"42,46,50\" true", v, ok)
+	}
+	if _, ok := readIniValue(path, "[Colors:Window]", "ColorSchemeHash"); ok {
+		t.Fatal("a key from another group should not be found")
+	}
+	if _, ok := readIniValue(filepath.Join(t.TempDir(), "absent"), "[Theme]", "name"); ok {
+		t.Fatal("a missing file should not be found")
+	}
+	if _, ok := readIniValue("", "[Theme]", "name"); ok {
+		t.Fatal("an empty path should not be found")
+	}
+}
+
+func TestParseRGB(t *testing.T) {
+	if _, ok := parseRGB("1,2"); ok {
+		t.Fatal("two components should fail")
+	}
+	if _, ok := parseRGB("300,0,0"); ok {
+		t.Fatal("out-of-range should fail")
+	}
+	if _, ok := parseRGB("a,b,c"); ok {
+		t.Fatal("non-numeric should fail")
+	}
+	rgb, ok := parseRGB(" 10 , 20 , 30 ")
+	if !ok || rgb != [3]uint8{10, 20, 30} {
+		t.Fatalf("parseRGB = %v ok=%v, want [10 20 30] true", rgb, ok)
+	}
+}
+
+func TestIsDarkRGB(t *testing.T) {
+	if !isDarkRGB(0, 0, 0) {
+		t.Fatal("black is dark")
+	}
+	if isDarkRGB(255, 255, 255) {
+		t.Fatal("white is light")
+	}
+	if !isDarkRGB(32, 35, 38) {
+		t.Fatal("BreezeDark window grey is dark")
+	}
+	if isDarkRGB(239, 240, 241) {
+		t.Fatal("Breeze window grey is light")
+	}
+}
diff --git a/client/ui/tray_theme_other.go b/client/ui/tray_theme_other.go
new file mode 100644
index 000000000..3f85e1603
--- /dev/null
+++ b/client/ui/tray_theme_other.go
@@ -0,0 +1,7 @@
+//go:build (!linux || (linux && 386)) && !android && !ios && !freebsd && !js
+
+package main
+
+func (t *Tray) startTrayTheme() {
+	// No-op off Linux: leaves panelDark nil so panelIsDark uses its default.
+}
diff --git a/client/ui/tray_theme_watcher_linux.go b/client/ui/tray_theme_watcher_linux.go
new file mode 100644
index 000000000..fa175e006
--- /dev/null
+++ b/client/ui/tray_theme_watcher_linux.go
@@ -0,0 +1,251 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+// Sources: the freedesktop Settings portal's SettingChanged signal, and on KDE
+// the kdeglobals and plasmarc files (a pinned Plasma style fixes the panel's
+// appearance without touching the portal's color-scheme — see readDarkMode).
+// The dark/light decision lives in tray_theme_linux.go; this file owns the
+// session-bus connection and subscriptions.
+
+import (
+	"path/filepath"
+	"sync"
+
+	"github.com/fsnotify/fsnotify"
+	"github.com/godbus/dbus/v5"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	portalBusName    = "org.freedesktop.portal.Desktop"
+	portalObjectPath = "/org/freedesktop/portal/desktop"
+	portalSettings   = "org.freedesktop.portal.Settings"
+
+	appearanceNamespace = "org.freedesktop.appearance"
+	colorSchemeKey      = "color-scheme"
+
+	colorSchemeNoPreference = 0
+	colorSchemePreferDark   = 1
+	colorSchemePreferLight  = 2
+)
+
+// themeWatcher owns a private session-bus connection so its signal subscription
+// is isolated from the SNI watcher's.
+type themeWatcher struct {
+	conn     *dbus.Conn
+	onChange func()
+
+	mu       sync.Mutex
+	darkMode bool
+}
+
+// startThemeWatcher returns nil if the session bus is unavailable; callers treat
+// a nil watcher as "no preference", keeping the default-dark icon.
+func startThemeWatcher(onChange func()) *themeWatcher {
+	conn, err := dbus.SessionBusPrivate()
+	if err != nil {
+		log.Debugf("tray theme: session bus unavailable, defaulting to dark icons: %v", err)
+		return nil
+	}
+	if err := conn.Auth(nil); err != nil {
+		_ = conn.Close()
+		log.Debugf("tray theme: dbus auth failed: %v", err)
+		return nil
+	}
+	if err := conn.Hello(); err != nil {
+		_ = conn.Close()
+		log.Debugf("tray theme: dbus hello failed: %v", err)
+		return nil
+	}
+
+	w := &themeWatcher{conn: conn, onChange: onChange}
+	w.darkMode = w.readDarkMode()
+
+	if err := w.subscribe(); err != nil {
+		log.Debugf("tray theme: SettingChanged subscription failed, theme is static: %v", err)
+		// Keep the connection: the seeded darkMode value is still useful.
+	}
+
+	// The portal's signal says nothing about a pinned Plasma style.
+	if isKDE() {
+		w.watchKdeConfig()
+	}
+
+	log.Infof("tray theme: panel dark mode = %v", w.IsDark())
+	return w
+}
+
+// IsDark reports true for a nil watcher, so the icon defaults to the white
+// silhouette suiting the common dark Linux panel.
+func (w *themeWatcher) IsDark() bool {
+	if w == nil {
+		return true
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return w.darkMode
+}
+
+// readDarkMode resolves whether the panel the tray icon sits on is dark.
+//
+// KDE goes first because a pinned Plasma style decides the panel on its own,
+// independently of the application colour scheme the portal reports; with no
+// style pinned that check defers to KDE's own colour files. Off KDE the
+// color-scheme portal is the source; on "no preference" (0) or when unavailable
+// we fall back to GTK_THEME (":dark" suffix ⇒ dark), then default to dark.
+func (w *themeWatcher) readDarkMode() bool {
+	if dark, ok := kdePanelIsDark(); ok {
+		return dark
+	}
+	switch w.readColorScheme() {
+	case colorSchemePreferDark:
+		return true
+	case colorSchemePreferLight:
+		return false
+	default:
+		return gtkThemeIsDark()
+	}
+}
+
+// readColorScheme returns the raw freedesktop color-scheme value, or
+// colorSchemeNoPreference when the portal can't be reached.
+func (w *themeWatcher) readColorScheme() uint32 {
+	obj := w.conn.Object(portalBusName, portalObjectPath)
+	call := obj.Call(portalSettings+".Read", 0, appearanceNamespace, colorSchemeKey)
+	if call.Err != nil {
+		log.Debugf("tray theme: portal Read failed, falling back to GTK_THEME: %v", call.Err)
+		return colorSchemeNoPreference
+	}
+
+	var v dbus.Variant
+	if err := call.Store(&v); err != nil {
+		log.Debugf("tray theme: portal Read decode failed, falling back to GTK_THEME: %v", err)
+		return colorSchemeNoPreference
+	}
+
+	return variantToColorScheme(v)
+}
+
+func (w *themeWatcher) subscribe() error {
+	if err := w.conn.AddMatchSignal(
+		dbus.WithMatchObjectPath(portalObjectPath),
+		dbus.WithMatchInterface(portalSettings),
+		dbus.WithMatchMember("SettingChanged"),
+	); err != nil {
+		return err
+	}
+
+	sigs := make(chan *dbus.Signal, 8)
+	w.conn.Signal(sigs)
+	go w.loop(sigs)
+	return nil
+}
+
+func (w *themeWatcher) loop(sigs chan *dbus.Signal) {
+	for sig := range sigs {
+		if sig.Name != portalSettings+".SettingChanged" {
+			continue
+		}
+		// Signal body: (namespace string, key string, value variant).
+		if len(sig.Body) < 3 {
+			continue
+		}
+		namespace, _ := sig.Body[0].(string)
+		key, _ := sig.Body[1].(string)
+		if namespace != appearanceNamespace || key != colorSchemeKey {
+			continue
+		}
+		if _, ok := sig.Body[2].(dbus.Variant); !ok {
+			continue
+		}
+
+		// Re-resolve via readDarkMode, not the signal value: under KDE a pinned
+		// Plasma style overrides it, so the signal value would be wrong.
+		w.update()
+	}
+}
+
+func (w *themeWatcher) update() {
+	dark := w.readDarkMode()
+	w.mu.Lock()
+	changed := dark != w.darkMode
+	w.darkMode = dark
+	w.mu.Unlock()
+
+	if changed && w.onChange != nil {
+		log.Infof("tray theme: panel dark mode changed to %v", dark)
+		w.onChange()
+	}
+}
+
+// watchKdeConfig repaints on writes to either KDE file that decides the panel
+// appearance. It watches their parent directory, not the files: KDE rewrites
+// them atomically (write-temp + rename), which would drop an inotify watch on
+// the original inode. Filtering by name re-arms implicitly.
+func (w *themeWatcher) watchKdeConfig() {
+	path := kdeglobalsPath()
+	if path == "" {
+		return
+	}
+	dir := filepath.Dir(path)
+
+	fw, err := fsnotify.NewWatcher()
+	if err != nil {
+		log.Debugf("tray theme: KDE config watcher unavailable, theme is static: %v", err)
+		return
+	}
+	if err := fw.Add(dir); err != nil {
+		log.Debugf("tray theme: watching %s failed, theme is static: %v", dir, err)
+		_ = fw.Close()
+		return
+	}
+
+	go func() {
+		defer func() { _ = fw.Close() }()
+		for {
+			select {
+			case event, ok := <-fw.Events:
+				if !ok {
+					return
+				}
+				switch filepath.Base(event.Name) {
+				case kdeglobalsFile, plasmarcFile:
+				default:
+					continue
+				}
+				// Remove counts: deleting plasmarc unpins the Plasma style, which
+				// hands the decision back to the colour scheme and can flip it.
+				if event.Op&(fsnotify.Write|fsnotify.Create|fsnotify.Rename|fsnotify.Remove) == 0 {
+					continue
+				}
+				w.update()
+			case err, ok := <-fw.Errors:
+				if !ok {
+					return
+				}
+				log.Debugf("tray theme: KDE config watch error: %v", err)
+			}
+		}
+	}()
+}
+
+// variantToColorScheme unwraps the color-scheme variant; the portal nests it one level.
+func variantToColorScheme(v dbus.Variant) uint32 {
+	inner := v.Value()
+	if nested, ok := inner.(dbus.Variant); ok {
+		inner = nested.Value()
+	}
+
+	switch n := inner.(type) {
+	case uint32:
+		return n
+	case int32:
+		return uint32(n)
+	case uint8:
+		return uint32(n)
+	default:
+		log.Debugf("tray theme: unexpected color-scheme type %T, assuming no preference", inner)
+		return colorSchemeNoPreference
+	}
+}
diff --git a/client/ui/tray_update.go b/client/ui/tray_update.go
new file mode 100644
index 000000000..3ce1f9600
--- /dev/null
+++ b/client/ui/tray_update.go
@@ -0,0 +1,197 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	neturl "net/url"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+	"github.com/netbirdio/netbird/client/ui/updater"
+	"github.com/netbirdio/netbird/version"
+)
+
+// trayUpdater owns the tray UI that reacts to auto-update. Composed inside Tray.
+type trayUpdater struct {
+	app          *application.App
+	showMainAt   func(url string)
+	update       *services.Update
+	notifier     *Notifier
+	loc          *Localizer
+	onIconChange func()
+	// onMenuChange drives a full tray relayout: the update row lives in the
+	// About submenu, which KDE/Plasma caches on first open and never re-fetches
+	// on a plain SetLabel/SetHidden — only a relayout (fresh submenu ids) repaints.
+	onMenuChange func()
+
+	mu                 sync.Mutex
+	item               *application.MenuItem
+	state              updater.State
+	notifiedVersion    string
+	progressWindowOpen bool
+}
+
+func newTrayUpdater(app *application.App, showMainAt func(url string), update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+	u := &trayUpdater{
+		app:          app,
+		showMainAt:   showMainAt,
+		update:       update,
+		notifier:     notifier,
+		loc:          loc,
+		onIconChange: onIconChange,
+		onMenuChange: onMenuChange,
+	}
+	app.Event.On(updater.EventStateChanged, u.onStateEvent)
+	// Seed from cached state to cover an event that fired before wiring completed.
+	u.state = update.GetState()
+	return u
+}
+
+// attach (re)binds the menu item on each Tray.buildMenu run. The caller owns the
+// item's OnClick handler.
+func (u *trayUpdater) attach(item *application.MenuItem) {
+	u.mu.Lock()
+	u.item = item
+	state := u.state
+	u.mu.Unlock()
+	u.refreshMenuItem(state)
+}
+
+// hasUpdate reports whether the tray should paint the "update available" icon.
+func (u *trayUpdater) hasUpdate() bool {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return u.state.Available
+}
+
+// applyLanguage re-renders the menu item label after a locale switch.
+func (u *trayUpdater) applyLanguage() {
+	u.mu.Lock()
+	state := u.state
+	u.mu.Unlock()
+	u.refreshMenuItem(state)
+}
+
+// handleClick opens the installer download link when not Enforced, otherwise
+// shows the progress page and asks the daemon to start the installer.
+func (u *trayUpdater) handleClick() {
+	u.mu.Lock()
+	state := u.state
+	u.mu.Unlock()
+
+	if !state.Enforced {
+		_ = u.app.Browser.OpenURL(version.DownloadUrl())
+		return
+	}
+
+	u.openProgressWindow(state.Version)
+
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		if _, err := u.update.Trigger(ctx); err != nil {
+			log.Errorf("trigger update: %v", err)
+		}
+	}()
+}
+
+func (u *trayUpdater) onStateEvent(ev *application.CustomEvent) {
+	st, ok := ev.Data.(updater.State)
+	if !ok {
+		log.Warnf("update state event payload not UpdateState: %T", ev.Data)
+		return
+	}
+	u.applyState(st)
+}
+
+// applyState diffs st against the cached state and drives the resulting side
+// effects: icon repaint, menu refresh, new-version notification, progress window.
+func (u *trayUpdater) applyState(st updater.State) {
+	u.mu.Lock()
+	prev := u.state
+	u.state = st
+
+	sendNotify := st.Available && st.Version != "" && st.Version != u.notifiedVersion
+	if sendNotify {
+		u.notifiedVersion = st.Version
+	}
+
+	showWindow := st.Installing && !u.progressWindowOpen
+	if showWindow {
+		u.progressWindowOpen = true
+	} else if !st.Installing {
+		u.progressWindowOpen = false
+	}
+	u.mu.Unlock()
+
+	// Full relayout rather than in-place: KDE layout-caches the About submenu, so
+	// a direct SetLabel/SetHidden wouldn't paint. Fall back if no hook was wired.
+	if u.onMenuChange != nil {
+		u.onMenuChange()
+	} else {
+		u.refreshMenuItem(st)
+	}
+	if prev.Available != st.Available && u.onIconChange != nil {
+		u.onIconChange()
+	}
+	if sendNotify {
+		u.sendUpdateNotification(st)
+	}
+	if showWindow {
+		u.openProgressWindow(st.Version)
+	}
+}
+
+func (u *trayUpdater) refreshMenuItem(st updater.State) {
+	u.mu.Lock()
+	item := u.item
+	u.mu.Unlock()
+	if item == nil {
+		return
+	}
+
+	if !st.Available {
+		item.SetHidden(true)
+		return
+	}
+	if st.Enforced {
+		item.SetLabel(u.loc.T("tray.menu.installVersion", "version", st.Version))
+	} else {
+		item.SetLabel(u.loc.T("tray.menu.downloadLatest"))
+	}
+	item.SetHidden(false)
+}
+
+func (u *trayUpdater) sendUpdateNotification(st updater.State) {
+	if u.notifier == nil {
+		return
+	}
+	body := u.loc.T("notify.update.body", "version", st.Version)
+	if st.Enforced {
+		body += u.loc.T("notify.update.enforcedSuffix")
+	}
+	_ = safeSendNotification(u.notifier.SendNotification, "update", notifications.NotificationOptions{
+		ID:    notifyIDUpdatePrefix + st.Version,
+		Title: u.loc.T("notify.update.title"),
+		Body:  body,
+	})
+}
+
+// openProgressWindow points the main window at the /update progress page and
+// brings it forward.
+func (u *trayUpdater) openProgressWindow(version string) {
+	if u.showMainAt == nil {
+		return
+	}
+	url := "/#/update"
+	if version != "" {
+		url += "?version=" + neturl.QueryEscape(version)
+	}
+	u.showMainAt(url)
+}
diff --git a/client/ui/tray_watcher_linux.go b/client/ui/tray_watcher_linux.go
new file mode 100644
index 000000000..38476179a
--- /dev/null
+++ b/client/ui/tray_watcher_linux.go
@@ -0,0 +1,176 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+// In-process org.kde.StatusNotifierWatcher for minimal WMs (Fluxbox, OpenBox,
+// i3) that ship no watcher. When an XEmbed tray exists (_NET_SYSTEM_TRAY_S0),
+// an in-process XEmbed host bridges the SNI icon into it.
+
+import (
+	"sync"
+	"time"
+
+	"github.com/godbus/dbus/v5"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	watcherName  = "org.kde.StatusNotifierWatcher"
+	watcherPath  = "/StatusNotifierWatcher"
+	watcherIface = "org.kde.StatusNotifierWatcher"
+
+	// The UI is often autostarted before the panel on minimal WMs, so a single
+	// startup probe would miss a tray that appears a second later.
+	watcherProbeInterval = 500 * time.Millisecond
+	watcherProbeTimeout  = 10 * time.Second
+)
+
+type statusNotifierWatcher struct {
+	conn    *dbus.Conn
+	items   []string
+	hosts   map[string]*xembedHost
+	hostsMu sync.Mutex
+}
+
+// RegisterStatusNotifierItem is the D-Bus method called by tray clients.
+// sender is injected by godbus and is not part of the D-Bus signature.
+func (w *statusNotifierWatcher) RegisterStatusNotifierItem(sender dbus.Sender, service string) *dbus.Error {
+	for _, s := range w.items {
+		if s == service {
+			return nil
+		}
+	}
+	w.items = append(w.items, service)
+	log.Debugf("StatusNotifierWatcher: registered item %q from %s", service, sender)
+
+	go w.tryStartXembedHost(string(sender), dbus.ObjectPath(service))
+	return nil
+}
+
+// RegisterStatusNotifierHost is required by the protocol but unused here.
+func (w *statusNotifierWatcher) RegisterStatusNotifierHost(service string) *dbus.Error {
+	log.Debugf("StatusNotifierWatcher: host registered %q", service)
+	return nil
+}
+
+// tryStartXembedHost is a no-op when no XEmbed tray manager is available.
+func (w *statusNotifierWatcher) tryStartXembedHost(busName string, objPath dbus.ObjectPath) {
+	w.hostsMu.Lock()
+	defer w.hostsMu.Unlock()
+
+	if _, exists := w.hosts[busName]; exists {
+		return
+	}
+
+	// Private session bus so our signal subscriptions don't reach Wails'
+	// signal handler, which panics on unexpected signals.
+	sessionConn, err := dbus.SessionBusPrivate()
+	if err != nil {
+		log.Debugf("StatusNotifierWatcher: cannot open private session bus for XEmbed host: %v", err)
+		return
+	}
+	if err := sessionConn.Auth(nil); err != nil {
+		log.Debugf("StatusNotifierWatcher: XEmbed host auth failed: %v", err)
+		closeBus(sessionConn)
+		return
+	}
+	if err := sessionConn.Hello(); err != nil {
+		log.Debugf("StatusNotifierWatcher: XEmbed host Hello failed: %v", err)
+		closeBus(sessionConn)
+		return
+	}
+
+	host, err := newXembedHost(sessionConn, busName, objPath)
+	if err != nil {
+		log.Debugf("StatusNotifierWatcher: XEmbed host not started: %v", err)
+		closeBus(sessionConn)
+		return
+	}
+
+	w.hosts[busName] = host
+	go host.run()
+	log.Infof("StatusNotifierWatcher: XEmbed tray icon created for %s", busName)
+}
+
+// startStatusNotifierWatcher claims org.kde.StatusNotifierWatcher only as a
+// bridge to an XEmbed tray on minimal WMs. The watcher is a stub that never
+// relays items to a real StatusNotifierHost, so claiming the name on a desktop
+// with a real host (e.g. Hyprland + Waybar) would dead-end every other tray
+// app's icon. It gates on the actual presence of an XEmbed tray rather than
+// GetNameOwner, which can't win a login-order race; without one it stays off
+// the bus so the real watcher owns the name. The XEmbed tray may come up after
+// the UI, so it re-probes for a grace period rather than deciding once.
+// Safe to call unconditionally.
+func startStatusNotifierWatcher() {
+	go func() {
+		deadline := time.Now().Add(watcherProbeTimeout)
+		for {
+			if xembedTrayAvailable() {
+				claimStatusNotifierWatcher()
+				return
+			}
+			if time.Now().After(deadline) {
+				log.Debugf("StatusNotifierWatcher: no XEmbed tray appeared within %s, leaving the watcher to the desktop", watcherProbeTimeout)
+				return
+			}
+			time.Sleep(watcherProbeInterval)
+		}
+	}()
+}
+
+// claimStatusNotifierWatcher takes ownership of org.kde.StatusNotifierWatcher
+// on a private session bus and exports the stub watcher. The GetNameOwner /
+// DoNotQueue guards back off if a real watcher already holds the name.
+func claimStatusNotifierWatcher() {
+	conn, err := dbus.SessionBusPrivate()
+	if err != nil {
+		log.Debugf("StatusNotifierWatcher: cannot open private session bus: %v", err)
+		return
+	}
+	if err := conn.Auth(nil); err != nil {
+		log.Debugf("StatusNotifierWatcher: auth failed: %v", err)
+		closeBus(conn)
+		return
+	}
+	if err := conn.Hello(); err != nil {
+		log.Debugf("StatusNotifierWatcher: Hello failed: %v", err)
+		closeBus(conn)
+		return
+	}
+
+	var owner string
+	callErr := conn.BusObject().Call("org.freedesktop.DBus.GetNameOwner", 0, watcherName).Store(&owner)
+	if callErr == nil && owner != "" {
+		log.Debugf("StatusNotifierWatcher: already owned by %s, skipping", owner)
+		closeBus(conn)
+		return
+	}
+
+	reply, err := conn.RequestName(watcherName, dbus.NameFlagDoNotQueue)
+	if err != nil || reply != dbus.RequestNameReplyPrimaryOwner {
+		log.Debugf("StatusNotifierWatcher: could not claim name (reply=%v err=%v)", reply, err)
+		closeBus(conn)
+		return
+	}
+
+	w := &statusNotifierWatcher{
+		conn:  conn,
+		hosts: make(map[string]*xembedHost),
+	}
+	if err := conn.ExportAll(w, dbus.ObjectPath(watcherPath), watcherIface); err != nil {
+		log.Errorf("StatusNotifierWatcher: export failed: %v", err)
+		closeBus(conn)
+		return
+	}
+
+	log.Infof("StatusNotifierWatcher: active on session bus (enables tray on minimal WMs)")
+	// Connection kept open for the process lifetime.
+}
+
+// closeBus closes a private session bus opened on a back-off path, logging a
+// warning rather than swallowing the error.
+func closeBus(conn *dbus.Conn) {
+	if err := conn.Close(); err != nil {
+		log.Warnf("StatusNotifierWatcher: closing session bus failed: %v", err)
+	}
+}
diff --git a/client/ui/tray_watcher_other.go b/client/ui/tray_watcher_other.go
new file mode 100644
index 000000000..ef8a1bb52
--- /dev/null
+++ b/client/ui/tray_watcher_other.go
@@ -0,0 +1,9 @@
+//go:build (!linux || (linux && 386)) && !freebsd && !android && !ios && !js
+
+package main
+
+// startStatusNotifierWatcher is a no-op stub so main.go can call it across all
+// build targets; only minimal Linux WMs need the real watcher (tray_watcher_linux.go).
+func startStatusNotifierWatcher() {
+	// Intentionally empty: only minimal Linux WMs need the real SNI watcher.
+}
diff --git a/client/ui/uilogpath.go b/client/ui/uilogpath.go
new file mode 100644
index 000000000..6fa400e01
--- /dev/null
+++ b/client/ui/uilogpath.go
@@ -0,0 +1,35 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"os"
+	"path/filepath"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/configs"
+	"github.com/netbirdio/netbird/client/ui/guilog"
+)
+
+// uiLogPath returns the GUI log path with native separators, since the daemon
+// opens it directly for debug-bundle collection. The file name comes from
+// configs.UILogFile so the daemon validates and collects the same name.
+func uiLogPath() (string, error) {
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, "netbird", configs.UILogFile), nil
+}
+
+// newDebugLog builds the GUI debug log, disabled when userSetLogFile is set
+// (manual --log-file override) or the config dir can't be resolved.
+func newDebugLog(userSetLogFile bool) *guilog.DebugLog {
+	path, err := uiLogPath()
+	if err != nil {
+		log.Warnf("resolve GUI log path: %v; GUI file logging disabled", err)
+		return guilog.NewDebugLog("", false)
+	}
+	return guilog.NewDebugLog(path, !userSetLogFile)
+}
diff --git a/client/ui/update.go b/client/ui/update.go
deleted file mode 100644
index 25c317bdf..000000000
--- a/client/ui/update.go
+++ /dev/null
@@ -1,140 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/widget"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-func (s *serviceClient) showUpdateProgress(ctx context.Context, version string) {
-	log.Infof("show installer progress window: %s", version)
-	s.wUpdateProgress = s.app.NewWindow("Automatically updating client")
-
-	statusLabel := widget.NewLabel("Updating...")
-	infoLabel := widget.NewLabel(fmt.Sprintf("Your client version is older than the auto-update version set in Management.\nUpdating client to: %s.", version))
-	content := container.NewVBox(infoLabel, statusLabel)
-	s.wUpdateProgress.SetContent(content)
-	s.wUpdateProgress.CenterOnScreen()
-	s.wUpdateProgress.SetFixedSize(true)
-	s.wUpdateProgress.SetCloseIntercept(func() {
-		// this is empty to lock window until result known
-	})
-	s.wUpdateProgress.RequestFocus()
-	s.wUpdateProgress.Show()
-
-	updateWindowCtx, cancel := context.WithTimeout(ctx, 15*time.Minute)
-
-	// Initialize dot updater
-	updateText := dotUpdater()
-
-	// Channel to receive the result from RPC call
-	resultErrCh := make(chan error, 1)
-	resultOkCh := make(chan struct{}, 1)
-
-	// Start RPC call in background
-	go func() {
-		conn, err := s.getSrvClient(defaultFailTimeout)
-		if err != nil {
-			log.Infof("backend not reachable, upgrade in progress: %v", err)
-			close(resultOkCh)
-			return
-		}
-
-		resp, err := conn.GetInstallerResult(updateWindowCtx, &proto.InstallerResultRequest{})
-		if err != nil {
-			log.Infof("backend stopped responding, upgrade in progress: %v", err)
-			close(resultOkCh)
-			return
-		}
-
-		if !resp.Success {
-			resultErrCh <- mapInstallError(resp.ErrorMsg)
-			return
-		}
-
-		// Success
-		close(resultOkCh)
-	}()
-
-	// Update UI with dots and wait for result
-	go func() {
-		ticker := time.NewTicker(time.Second)
-		defer ticker.Stop()
-		defer cancel()
-
-		// allow closing update window after 10 sec
-		timerResetCloseInterceptor := time.NewTimer(10 * time.Second)
-		defer timerResetCloseInterceptor.Stop()
-
-		for {
-			select {
-			case <-updateWindowCtx.Done():
-				s.showInstallerResult(statusLabel, updateWindowCtx.Err())
-				return
-			case err := <-resultErrCh:
-				s.showInstallerResult(statusLabel, err)
-				return
-			case <-resultOkCh:
-				log.Info("backend exited, upgrade in progress, closing all UI")
-				killParentUIProcess()
-				s.app.Quit()
-				return
-			case <-ticker.C:
-				statusLabel.SetText(updateText())
-			case <-timerResetCloseInterceptor.C:
-				s.wUpdateProgress.SetCloseIntercept(nil)
-			}
-		}
-	}()
-}
-
-func (s *serviceClient) showInstallerResult(statusLabel *widget.Label, err error) {
-	s.wUpdateProgress.SetCloseIntercept(nil)
-	switch {
-	case errors.Is(err, context.DeadlineExceeded):
-		log.Warn("update watcher timed out")
-		statusLabel.SetText("Update timed out. Please try again.")
-	case errors.Is(err, context.Canceled):
-		log.Info("update watcher canceled")
-		statusLabel.SetText("Update canceled.")
-	case err != nil:
-		log.Errorf("update failed: %v", err)
-		statusLabel.SetText("Update failed: " + err.Error())
-	default:
-		s.wUpdateProgress.Close()
-	}
-}
-
-// dotUpdater returns a closure that cycles through dots for a loading animation.
-func dotUpdater() func() string {
-	dotCount := 0
-	return func() string {
-		dotCount = (dotCount + 1) % 4
-		return fmt.Sprintf("%s%s", "Updating", strings.Repeat(".", dotCount))
-	}
-}
-
-func mapInstallError(msg string) error {
-	msg = strings.ToLower(strings.TrimSpace(msg))
-
-	switch {
-	case strings.Contains(msg, "deadline exceeded"), strings.Contains(msg, "timeout"):
-		return context.DeadlineExceeded
-	case strings.Contains(msg, "canceled"), strings.Contains(msg, "cancelled"):
-		return context.Canceled
-	case msg == "":
-		return errors.New("unknown update error")
-	default:
-		return errors.New(msg)
-	}
-}
diff --git a/client/ui/update_notwindows.go b/client/ui/update_notwindows.go
deleted file mode 100644
index 5766f18f7..000000000
--- a/client/ui/update_notwindows.go
+++ /dev/null
@@ -1,7 +0,0 @@
-//go:build !windows && !(linux && 386)
-
-package main
-
-func killParentUIProcess() {
-	// No-op on non-Windows platforms
-}
diff --git a/client/ui/update_windows.go b/client/ui/update_windows.go
deleted file mode 100644
index 1b03936f9..000000000
--- a/client/ui/update_windows.go
+++ /dev/null
@@ -1,44 +0,0 @@
-//go:build windows
-
-package main
-
-import (
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-
-	nbprocess "github.com/netbirdio/netbird/client/ui/process"
-)
-
-// killParentUIProcess finds and kills the parent systray UI process on Windows.
-// This is a workaround in case the MSI installer fails to properly terminate the UI process.
-// The installer should handle this via util:CloseApplication with TerminateProcess, but this
-// provides an additional safety mechanism to ensure the UI is closed before the upgrade proceeds.
-func killParentUIProcess() {
-	pid, running, err := nbprocess.IsAnotherProcessRunning()
-	if err != nil {
-		log.Warnf("failed to check for parent UI process: %v", err)
-		return
-	}
-
-	if !running {
-		log.Debug("no parent UI process found to kill")
-		return
-	}
-
-	log.Infof("killing parent UI process (PID: %d)", pid)
-
-	// Open the process with terminate rights
-	handle, err := windows.OpenProcess(windows.PROCESS_TERMINATE, false, uint32(pid))
-	if err != nil {
-		log.Warnf("failed to open parent process %d: %v", pid, err)
-		return
-	}
-	defer func() {
-		_ = windows.CloseHandle(handle)
-	}()
-
-	// Terminate the process with exit code 0
-	if err := windows.TerminateProcess(handle, 0); err != nil {
-		log.Warnf("failed to terminate parent process %d: %v", pid, err)
-	}
-}
diff --git a/client/ui/updater/state.go b/client/ui/updater/state.go
new file mode 100644
index 000000000..606f8b401
--- /dev/null
+++ b/client/ui/updater/state.go
@@ -0,0 +1,97 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package updater holds the auto-update domain: the typed State, the
+// daemon-SystemEvent metadata schema, and the Holder that caches the latest
+// state and broadcasts changes. No Wails dependency.
+package updater
+
+import (
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// EventStateChanged carries the full State snapshot as payload.
+const EventStateChanged = "netbird:update:state"
+
+// State is the typed snapshot of the daemon's update situation. Installing is
+// driven only by the daemon's progress_window:show event; a UI-side
+// Update.Trigger() does not flip it.
+type State struct {
+	Available  bool   `json:"available"`
+	Version    string `json:"version"`
+	Enforced   bool   `json:"enforced"`
+	Installing bool   `json:"installing"`
+}
+
+// Emitter is the broadcast dependency Holder needs; the Wails app.Event
+// processor satisfies it.
+type Emitter interface {
+	Emit(name string, data ...any) bool
+}
+
+// Holder caches the latest update State and broadcasts changes.
+type Holder struct {
+	emitter Emitter
+
+	mu    sync.Mutex
+	state State
+}
+
+// NewHolder constructs an empty-state Holder. A nil emitter skips the broadcast.
+func NewHolder(emitter Emitter) *Holder {
+	return &Holder{emitter: emitter}
+}
+
+// Get returns a copy of the cached State.
+func (h *Holder) Get() State {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.state
+}
+
+// OnSystemEvent folds update-related metadata into the cached state, emitting
+// EventStateChanged only on an actual change so repeated daemon snapshots
+// don't produce redundant pushes.
+func (h *Holder) OnSystemEvent(ev *proto.SystemEvent) {
+	md := ev.GetMetadata()
+	if len(md) == 0 {
+		return
+	}
+
+	h.mu.Lock()
+	changed := false
+	if v, ok := md["new_version_available"]; ok {
+		_, enforced := md["enforced"]
+		if !h.state.Available || h.state.Version != v || h.state.Enforced != enforced {
+			h.state.Available = true
+			h.state.Version = v
+			h.state.Enforced = enforced
+			changed = true
+		}
+	}
+	if md["progress_window"] == "show" {
+		if !h.state.Installing {
+			h.state.Installing = true
+			changed = true
+		}
+		if v, ok := md["version"]; ok && v != "" && h.state.Version != v {
+			h.state.Version = v
+			h.state.Available = true
+			changed = true
+		}
+	}
+	snap := h.state
+	h.mu.Unlock()
+
+	if !changed {
+		return
+	}
+	log.Infof("update state: available=%v version=%q enforced=%v installing=%v",
+		snap.Available, snap.Version, snap.Enforced, snap.Installing)
+	if h.emitter != nil {
+		h.emitter.Emit(EventStateChanged, snap)
+	}
+}
diff --git a/client/ui/xembed_host_gtk3_linux.go b/client/ui/xembed_host_gtk3_linux.go
new file mode 100644
index 000000000..b1f18cc90
--- /dev/null
+++ b/client/ui/xembed_host_gtk3_linux.go
@@ -0,0 +1,40 @@
+//go:build linux && gtk3 && !(linux && 386)
+
+package main
+
+import (
+	"errors"
+
+	"github.com/godbus/dbus/v5"
+)
+
+// The legacy GTK3 / WebKit2GTK 4.1 build (-tags gtk3) drops the in-process
+// XEmbed StatusNotifierWatcher entirely. The real implementation
+// (xembed_host_linux.go + xembed_tray_linux.c) links GTK4 and uses GTK4-only
+// popup-menu APIs that have no drop-in GTK3 equivalent, so rather than port the
+// C layer we stub the host out on gtk3 builds. The tray still works on every
+// desktop that ships its own StatusNotifierWatcher (KDE, GNOME+AppIndicator,
+// Cinnamon/xapp, XFCE, …); only the minimal-WM fallback (Fluxbox/OpenBox/i3/
+// dwm/vanilla GNOME) is unavailable on gtk3 packages. See LINUX-TRAY.md.
+
+// xembedHost is a placeholder so the package compiles on gtk3 builds; the real
+// type (with X11/GTK4 state) lives in xembed_host_linux.go. It is never
+// instantiated here because xembedTrayAvailable always reports false.
+type xembedHost struct{}
+
+// run satisfies the call in tray_watcher_linux.go; unreachable on gtk3 because
+// newXembedHost never returns a non-nil host.
+func (*xembedHost) run() {}
+
+// xembedTrayAvailable always reports false on gtk3 builds, so the watcher probe
+// loop in startStatusNotifierWatcher exits immediately and newXembedHost is
+// never reached. recenter_linux.go's predicate becomes a harmless no-op too.
+func xembedTrayAvailable() bool {
+	return false
+}
+
+// newXembedHost exists only to satisfy the reference in tray_watcher_linux.go;
+// it is unreachable because xembedTrayAvailable returns false on gtk3.
+func newXembedHost(conn *dbus.Conn, busName string, objPath dbus.ObjectPath) (*xembedHost, error) {
+	return nil, errors.New("xembed host unsupported on gtk3 build")
+}
diff --git a/client/ui/xembed_host_linux.go b/client/ui/xembed_host_linux.go
new file mode 100644
index 000000000..5551cd02a
--- /dev/null
+++ b/client/ui/xembed_host_linux.go
@@ -0,0 +1,443 @@
+//go:build linux && !gtk3 && !(linux && 386)
+
+package main
+
+/*
+#cgo pkg-config: x11 gtk4 gtk4-x11 cairo cairo-xlib
+#cgo LDFLAGS: -lX11
+#include "xembed_tray_linux.h"
+#include <X11/Xlib.h>
+#include <stdlib.h>
+#include <string.h>
+*/
+import "C"
+
+import (
+	"errors"
+	"sync"
+	"time"
+	"unsafe"
+
+	"github.com/godbus/dbus/v5"
+	log "github.com/sirupsen/logrus"
+)
+
+// activeMenuHost holds the popup owner; C callbacks cannot carry Go pointers.
+var (
+	activeMenuHost   *xembedHost
+	activeMenuHostMu sync.Mutex
+)
+
+// menuItemInfo is a dbusMenuLayout entry flattened for the C popup builder.
+type menuItemInfo struct {
+	id          int32
+	label       string
+	enabled     bool
+	isCheck     bool
+	checked     bool
+	isSeparator bool
+	children    []menuItemInfo
+}
+
+// dbusMenuLayout mirrors the (ia{sv}av) result of com.canonical.dbusmenu.GetLayout.
+// Each Children variant wraps a nested dbusMenuLayout, decoded in flattenMenu.
+type dbusMenuLayout struct {
+	ID         int32
+	Properties map[string]dbus.Variant
+	Children   []dbus.Variant
+}
+
+// xembedHost manages one XEmbed tray icon for an SNI item.
+type xembedHost struct {
+	conn    *dbus.Conn
+	busName string
+	objPath dbus.ObjectPath
+
+	dpy      *C.Display
+	trayMgr  C.Window
+	iconWin  C.Window
+	iconSize int
+
+	mu       sync.Mutex
+	iconData []byte
+	iconW    int
+	iconH    int
+
+	stopCh chan struct{}
+}
+
+// newXembedHost creates an XEmbed tray icon for the given SNI item.
+// Errors when no XEmbed tray manager is available, so callers can fall back.
+func newXembedHost(conn *dbus.Conn, busName string, objPath dbus.ObjectPath) (*xembedHost, error) {
+	dpy := C.XOpenDisplay(nil)
+	if dpy == nil {
+		return nil, errors.New("cannot open X display")
+	}
+	C.xembed_install_error_handlers()
+
+	screen := C.xembed_default_screen(dpy)
+	trayMgr := C.xembed_find_tray(dpy, screen)
+	if trayMgr == 0 {
+		C.XCloseDisplay(dpy)
+		return nil, errors.New("no XEmbed system tray found")
+	}
+
+	iconSize := int(C.xembed_get_icon_size(dpy, trayMgr))
+	if iconSize <= 0 {
+		iconSize = 24 // fallback
+	}
+
+	iconWin := C.xembed_create_icon(dpy, screen, C.int(iconSize), trayMgr)
+	if iconWin == 0 {
+		C.XCloseDisplay(dpy)
+		return nil, errors.New("failed to create icon window")
+	}
+
+	if C.xembed_dock(dpy, trayMgr, iconWin) != 0 {
+		C.xembed_destroy_icon(dpy, iconWin)
+		C.XCloseDisplay(dpy)
+		return nil, errors.New("failed to dock icon")
+	}
+
+	h := &xembedHost{
+		conn:     conn,
+		busName:  busName,
+		objPath:  objPath,
+		dpy:      dpy,
+		trayMgr:  trayMgr,
+		iconWin:  iconWin,
+		iconSize: iconSize,
+		stopCh:   make(chan struct{}),
+	}
+
+	h.fetchAndDrawIcon()
+	return h, nil
+}
+
+func (h *xembedHost) fetchAndDrawIcon() {
+	obj := h.conn.Object(h.busName, h.objPath)
+	variant, err := obj.GetProperty("org.kde.StatusNotifierItem.IconPixmap")
+	if err != nil {
+		log.Debugf("xembed: failed to get IconPixmap: %v", err)
+		return
+	}
+
+	// IconPixmap has D-Bus signature a(iiay).
+	type px struct {
+		W   int32
+		H   int32
+		Pix []byte
+	}
+
+	var icons []px
+	if err := variant.Store(&icons); err != nil {
+		log.Debugf("xembed: failed to decode IconPixmap: %v", err)
+		return
+	}
+
+	if len(icons) == 0 {
+		log.Debug("xembed: IconPixmap is empty")
+		return
+	}
+
+	icon := icons[0]
+	if icon.W <= 0 || icon.H <= 0 || len(icon.Pix) < int(icon.W*icon.H*4) {
+		log.Debug("xembed: invalid IconPixmap data")
+		return
+	}
+
+	h.mu.Lock()
+	h.iconData = icon.Pix
+	h.iconW = int(icon.W)
+	h.iconH = int(icon.H)
+	h.mu.Unlock()
+
+	h.drawIcon()
+}
+
+func (h *xembedHost) drawIcon() {
+	h.mu.Lock()
+	data := h.iconData
+	w := h.iconW
+	ht := h.iconH
+	h.mu.Unlock()
+
+	if data == nil || w <= 0 || ht <= 0 {
+		return
+	}
+
+	cData := C.CBytes(data)
+	defer C.free(cData)
+
+	C.xembed_draw_icon(h.dpy, h.iconWin, C.int(h.iconSize),
+		(*C.uchar)(cData), C.int(w), C.int(ht))
+}
+
+// run is the event loop: polls X11 events and D-Bus NewIcon signals until stopped.
+func (h *xembedHost) run() {
+	matchRule := "type='signal',interface='org.kde.StatusNotifierItem',member='NewIcon',sender='" + h.busName + "'"
+	if err := h.conn.BusObject().Call("org.freedesktop.DBus.AddMatch", 0, matchRule).Err; err != nil {
+		log.Debugf("xembed: failed to add signal match: %v", err)
+	}
+
+	sigCh := make(chan *dbus.Signal, 16)
+	h.conn.Signal(sigCh)
+	defer h.conn.RemoveSignal(sigCh)
+
+	ticker := time.NewTicker(50 * time.Millisecond)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-h.stopCh:
+			return
+
+		case sig := <-sigCh:
+			if sig == nil {
+				continue
+			}
+			if sig.Name == "org.kde.StatusNotifierItem.NewIcon" {
+				h.fetchAndDrawIcon()
+			}
+
+		case <-ticker.C:
+			var outX, outY C.int
+			result := C.xembed_poll_event(h.dpy, h.iconWin, &outX, &outY)
+
+			switch result {
+			case 1: // left click
+				go h.activate(int32(outX), int32(outY))
+			case 2: // right click
+				go h.contextMenu(int32(outX), int32(outY))
+			case 3: // expose
+				h.drawIcon()
+			case 4: // configure (resize)
+				newSize := int(outX)
+				if newSize > 0 && newSize != h.iconSize {
+					h.iconSize = newSize
+					h.drawIcon()
+				}
+			case -1: // tray died
+				log.Info("xembed: tray manager destroyed, cleaning up")
+				return
+			}
+		}
+	}
+}
+
+func (h *xembedHost) activate(x, y int32) {
+	obj := h.conn.Object(h.busName, h.objPath)
+	if err := obj.Call("org.kde.StatusNotifierItem.Activate", 0, x, y).Err; err != nil {
+		log.Debugf("xembed: Activate call failed: %v", err)
+	}
+}
+
+func (h *xembedHost) contextMenu(x, y int32) {
+	menuPath := dbus.ObjectPath("/StatusNotifierMenu")
+
+	menuObj := h.conn.Object(h.busName, menuPath)
+	var revision uint32
+	var layout dbusMenuLayout
+	err := menuObj.Call("com.canonical.dbusmenu.GetLayout", 0,
+		int32(0),   // parentId (root)
+		int32(-1),  // recursionDepth (all)
+		[]string{}, // propertyNames (all)
+	).Store(&revision, &layout)
+	if err != nil {
+		log.Debugf("xembed: GetLayout failed: %v", err)
+		return
+	}
+
+	items := h.flattenMenu(layout)
+	log.Debugf("xembed: menu has %d items (revision %d)", len(items), revision)
+	if len(items) == 0 {
+		return
+	}
+
+	var allocs []unsafe.Pointer
+	cItems := buildCItems(items, &allocs)
+	defer func() {
+		for _, p := range allocs {
+			C.free(p)
+		}
+	}()
+
+	// C callback reaches us through this global.
+	activeMenuHostMu.Lock()
+	activeMenuHost = h
+	activeMenuHostMu.Unlock()
+
+	C.xembed_show_popup_menu(cItems, C.int(len(items)),
+		nil, C.int(x), C.int(y))
+}
+
+func (h *xembedHost) flattenMenu(layout dbusMenuLayout) []menuItemInfo {
+	var items []menuItemInfo
+
+	for _, childVar := range layout.Children {
+		var child dbusMenuLayout
+		if err := dbus.Store([]interface{}{childVar.Value()}, &child); err != nil {
+			continue
+		}
+		if mi, ok := h.menuItemFromLayout(child); ok {
+			items = append(items, mi)
+		}
+	}
+
+	return items
+}
+
+// menuItemFromLayout decodes one dbusmenu child; ok is false for hidden items (drop them).
+func (h *xembedHost) menuItemFromLayout(child dbusMenuLayout) (menuItemInfo, bool) {
+	mi := menuItemInfo{id: child.ID, enabled: true}
+
+	if propString(child.Properties, "type") == "separator" {
+		mi.isSeparator = true
+		return mi, true
+	}
+
+	if vis, ok := propBool(child.Properties, "visible"); ok && !vis {
+		return menuItemInfo{}, false
+	}
+
+	mi.label = propString(child.Properties, "label")
+	if en, ok := propBool(child.Properties, "enabled"); ok {
+		mi.enabled = en
+	}
+	if propString(child.Properties, "toggle-type") == "checkmark" {
+		mi.isCheck = true
+	}
+	if n, ok := propInt32(child.Properties, "toggle-state"); ok && n == 1 {
+		mi.checked = true
+	}
+
+	// children are already present from the recursionDepth=-1 GetLayout.
+	if propString(child.Properties, "children-display") == "submenu" {
+		mi.children = h.flattenMenu(child)
+	}
+
+	return mi, true
+}
+
+func (h *xembedHost) sendMenuEvent(id int32) {
+	menuPath := dbus.ObjectPath("/StatusNotifierMenu")
+	menuObj := h.conn.Object(h.busName, menuPath)
+	data := dbus.MakeVariant("")
+	err := menuObj.Call("com.canonical.dbusmenu.Event", 0,
+		id, "clicked", data, uint32(0)).Err
+	if err != nil {
+		log.Debugf("xembed: menu Event call failed: %v", err)
+	}
+}
+
+func (h *xembedHost) stop() {
+	select {
+	case <-h.stopCh:
+		return
+	default:
+		close(h.stopCh)
+	}
+
+	C.xembed_destroy_icon(h.dpy, h.iconWin)
+	C.XCloseDisplay(h.dpy)
+}
+
+// buildCItems builds a C-allocated xembed_menu_item tree. Every malloc is
+// appended to *allocs for the caller to free once the C side has deep-copied it.
+func buildCItems(items []menuItemInfo, allocs *[]unsafe.Pointer) *C.xembed_menu_item {
+	if len(items) == 0 {
+		return nil
+	}
+	size := C.size_t(len(items)) * C.size_t(unsafe.Sizeof(C.xembed_menu_item{}))
+	arr := C.malloc(size)
+	*allocs = append(*allocs, arr)
+	C.memset(arr, 0, size)
+
+	slice := (*[1 << 16]C.xembed_menu_item)(arr)[:len(items):len(items)]
+	for i, mi := range items {
+		slice[i].id = C.int(mi.id)
+		slice[i].enabled = boolToInt(mi.enabled)
+		slice[i].is_check = boolToInt(mi.isCheck)
+		slice[i].checked = boolToInt(mi.checked)
+		slice[i].is_separator = boolToInt(mi.isSeparator)
+		if mi.label != "" {
+			cstr := C.CString(mi.label)
+			*allocs = append(*allocs, unsafe.Pointer(cstr))
+			slice[i].label = cstr
+		}
+		if len(mi.children) > 0 {
+			slice[i].children = buildCItems(mi.children, allocs)
+			slice[i].child_count = C.int(len(mi.children))
+		}
+	}
+
+	return (*C.xembed_menu_item)(arr)
+}
+
+// xembedTrayAvailable reports whether an XEmbed tray manager (_NET_SYSTEM_TRAY_S0)
+// owns the default screen. Side-effect-free probe. Gates the in-process
+// StatusNotifierWatcher: when a real SNI host already owns the tray (e.g. Waybar
+// on Wayland) we must not claim org.kde.StatusNotifierWatcher and shadow it.
+// Returns false when there is no X display (pure Wayland).
+func xembedTrayAvailable() bool {
+	dpy := C.XOpenDisplay(nil)
+	if dpy == nil {
+		return false
+	}
+	C.xembed_install_error_handlers()
+	defer C.XCloseDisplay(dpy)
+	screen := C.xembed_default_screen(dpy)
+	return C.xembed_find_tray(dpy, screen) != 0
+}
+
+// goMenuItemClicked is the C callback fired from the GTK main thread on popup
+// activation. The host is looked up via activeMenuHost since C callbacks can't
+// carry Go pointers; //export requires this to live in package main.
+//
+//export goMenuItemClicked
+func goMenuItemClicked(id C.int) {
+	activeMenuHostMu.Lock()
+	h := activeMenuHost
+	activeMenuHostMu.Unlock()
+
+	if h != nil {
+		go h.sendMenuEvent(int32(id))
+	}
+}
+
+func boolToInt(b bool) C.int {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+// propString returns the property's string value, or "" if absent or not a string.
+func propString(props map[string]dbus.Variant, key string) string {
+	if v, ok := props[key]; ok {
+		if s, ok := v.Value().(string); ok {
+			return s
+		}
+	}
+	return ""
+}
+
+// propBool returns the property's bool value; ok is false if absent or not a bool.
+func propBool(props map[string]dbus.Variant, key string) (value, ok bool) {
+	if v, present := props[key]; present {
+		if b, isBool := v.Value().(bool); isBool {
+			return b, true
+		}
+	}
+	return false, false
+}
+
+// propInt32 returns the property's int32 value; ok is false if absent or not an int32.
+func propInt32(props map[string]dbus.Variant, key string) (value int32, ok bool) {
+	if v, present := props[key]; present {
+		if n, isInt := v.Value().(int32); isInt {
+			return n, true
+		}
+	}
+	return 0, false
+}
diff --git a/client/ui/xembed_tray_linux.c b/client/ui/xembed_tray_linux.c
new file mode 100644
index 000000000..86da8bf70
--- /dev/null
+++ b/client/ui/xembed_tray_linux.c
@@ -0,0 +1,710 @@
+//go:build linux && !gtk3 && !(linux && 386)
+
+#include "xembed_tray_linux.h"
+
+#include <X11/Xatom.h>
+#include <X11/Xutil.h>
+#include <cairo/cairo-xlib.h>
+#include <cairo/cairo.h>
+#include <gtk/gtk.h>
+#include <gdk/x11/gdkx.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+#define SYSTEM_TRAY_REQUEST_DOCK 0
+#define XEMBED_MAPPED            (1 << 0)
+
+/* Xlib's default protocol-error handler calls exit() on any async X error,
+   killing the whole UI process. Handlers are process-global (not
+   per-Display), so a single install covers our raw tray Display and GDK's.
+   Tray work is full of races the X server reports asynchronously — the tray
+   manager window dying between xembed_find_tray and xembed_dock (BadWindow
+   on XSendEvent), or x11_move_window touching a popup the WM already
+   destroyed — and the default handler would take us down for any of them.
+   Returning 0 here makes the error a logged no-op instead. */
+static int xembed_x_error_handler(Display *dpy, XErrorEvent *ev) {
+    char buf[256];
+    XGetErrorText(dpy, ev->error_code, buf, sizeof(buf));
+    fprintf(stderr,
+            "xembed: X error (ignored): %s (code=%d, request=%d.%d, resource=0x%lx)\n",
+            buf, ev->error_code, ev->request_code, ev->minor_code,
+            ev->resourceid);
+    return 0;
+}
+
+/* The I/O error handler fires when the X connection itself drops (server
+   gone, socket closed). Xlib treats this as fatal and exits even if we
+   return, so this can't keep the process alive — it only logs a clearer
+   line than Xlib's terse default before the unavoidable exit. */
+static int xembed_x_io_error_handler(Display *dpy) {
+    (void)dpy;
+    fprintf(stderr, "xembed: X I/O error (connection lost)\n");
+    return 0;
+}
+
+/* Install the process-global handlers. Idempotent and cheap, so callers may
+   invoke it after every XOpenDisplay without tracking prior installs. */
+void xembed_install_error_handlers(void) {
+    XSetErrorHandler(xembed_x_error_handler);
+    XSetIOErrorHandler(xembed_x_io_error_handler);
+}
+
+Window xembed_find_tray(Display *dpy, int screen) {
+    char atom_name[64];
+    snprintf(atom_name, sizeof(atom_name), "_NET_SYSTEM_TRAY_S%d", screen);
+    Atom sel = XInternAtom(dpy, atom_name, False);
+    return XGetSelectionOwner(dpy, sel);
+}
+
+int xembed_get_icon_size(Display *dpy, Window tray_mgr) {
+    Atom atom = XInternAtom(dpy, "_NET_SYSTEM_TRAY_ICON_SIZE", False);
+    Atom actual_type;
+    int actual_format;
+    unsigned long nitems, bytes_after;
+    unsigned char *prop = NULL;
+    int size = 0;
+
+    if (XGetWindowProperty(dpy, tray_mgr, atom, 0, 1, False,
+                           XA_CARDINAL, &actual_type, &actual_format,
+                           &nitems, &bytes_after, &prop) == Success) {
+        if (prop && nitems == 1 && actual_format == 32) {
+            size = (int)(*(unsigned long *)prop);
+        }
+        if (prop)
+            XFree(prop);
+    }
+    return size;
+}
+
+Window xembed_create_icon(Display *dpy, int screen, int size,
+                           Window tray_mgr) {
+    (void)tray_mgr;  /* unused; kept in signature for caller symmetry */
+    Window root = RootWindow(dpy, screen);
+
+    /* Inherit visual & depth from the parent (tray manager / root) so
+       ParentRelative background works on every tray. Many minimal
+       toolbars (Fluxbox slit, OpenBox, etc.) only offer a 24-bit
+       default visual and do not composite alpha; ParentRelative makes
+       the X server texture this window's background from the parent,
+       so transparent pixels in the icon show the toolbar beneath
+       instead of solid black. ARGB-aware trays still work because the
+       cairo OVER blend in xembed_draw_icon honours per-pixel alpha
+       against whatever base the X server painted underneath. */
+    XSetWindowAttributes attrs;
+    memset(&attrs, 0, sizeof(attrs));
+    attrs.event_mask = ButtonPressMask | StructureNotifyMask | ExposureMask;
+    attrs.background_pixmap = ParentRelative;
+    unsigned long mask = CWEventMask | CWBackPixmap;
+
+    Window win = XCreateWindow(
+        dpy, root,
+        0, 0, size, size,
+        0,                          /* border width */
+        CopyFromParent,             /* depth */
+        InputOutput,
+        CopyFromParent,             /* visual */
+        mask,
+        &attrs
+    );
+
+    /* Set _XEMBED_INFO: version=0, flags=XEMBED_MAPPED */
+    Atom xembed_info = XInternAtom(dpy, "_XEMBED_INFO", False);
+    unsigned long info[2] = { 0, XEMBED_MAPPED };
+    XChangeProperty(dpy, win, xembed_info, xembed_info,
+                    32, PropModeReplace, (unsigned char *)info, 2);
+
+    return win;
+}
+
+int xembed_dock(Display *dpy, Window tray_mgr, Window icon_win) {
+    Atom opcode = XInternAtom(dpy, "_NET_SYSTEM_TRAY_OPCODE", False);
+
+    XClientMessageEvent ev;
+    memset(&ev, 0, sizeof(ev));
+    ev.type         = ClientMessage;
+    ev.window       = tray_mgr;
+    ev.message_type = opcode;
+    ev.format       = 32;
+    ev.data.l[0]    = CurrentTime;
+    ev.data.l[1]    = SYSTEM_TRAY_REQUEST_DOCK;
+    ev.data.l[2]    = (long)icon_win;
+
+    XSendEvent(dpy, tray_mgr, False, NoEventMask, (XEvent *)&ev);
+    XFlush(dpy);
+    return 0;
+}
+
+void xembed_draw_icon(Display *dpy, Window icon_win, int win_size,
+                      const unsigned char *data, int img_w, int img_h) {
+    if (!data || img_w <= 0 || img_h <= 0 || win_size <= 0)
+        return;
+
+    /* Query the window's actual visual and depth so cairo composites
+       through the matching ARGB pipeline. */
+    XWindowAttributes wa;
+    if (!XGetWindowAttributes(dpy, icon_win, &wa))
+        return;
+
+    /* Build a CAIRO_FORMAT_ARGB32 source surface from the SNI IconPixmap
+       bytes. SNI ships the pixels as [A,R,G,B,...] in network byte
+       order; cairo's ARGB32 stores native uint32 with B in the lowest
+       byte on little-endian hosts. Repack into native order with
+       pre-multiplied alpha so cairo can composite without tonemapping. */
+    int stride = cairo_format_stride_for_width(CAIRO_FORMAT_ARGB32, img_w);
+    unsigned char *buf = (unsigned char *)calloc(stride * img_h, 1);
+    if (!buf)
+        return;
+
+    for (int y = 0; y < img_h; y++) {
+        unsigned int *row = (unsigned int *)(buf + y * stride);
+        for (int x = 0; x < img_w; x++) {
+            int idx = (y * img_w + x) * 4;
+            unsigned int a = data[idx + 0];
+            unsigned int r = data[idx + 1];
+            unsigned int g = data[idx + 2];
+            unsigned int b = data[idx + 3];
+
+            if (a == 0) {
+                row[x] = 0;
+            } else if (a == 255) {
+                row[x] = (a << 24) | (r << 16) | (g << 8) | b;
+            } else {
+                unsigned int pr = r * a / 255;
+                unsigned int pg = g * a / 255;
+                unsigned int pb = b * a / 255;
+                row[x] = (a << 24) | (pr << 16) | (pg << 8) | pb;
+            }
+        }
+    }
+
+    cairo_surface_t *src = cairo_image_surface_create_for_data(
+        buf, CAIRO_FORMAT_ARGB32, img_w, img_h, stride);
+    if (cairo_surface_status(src) != CAIRO_STATUS_SUCCESS) {
+        cairo_surface_destroy(src);
+        free(buf);
+        return;
+    }
+
+    /* Wrap the X11 window in a cairo XLib surface using its real visual. */
+    cairo_surface_t *dst = cairo_xlib_surface_create(
+        dpy, icon_win, wa.visual, win_size, win_size);
+    if (cairo_surface_status(dst) != CAIRO_STATUS_SUCCESS) {
+        cairo_surface_destroy(dst);
+        cairo_surface_destroy(src);
+        free(buf);
+        return;
+    }
+
+    /* Repaint the ParentRelative background first — without this the
+       window keeps the previously-drawn icon underneath when an icon
+       update arrives, and cairo's OVER blend would composite the new
+       icon on top of the stale one. XClearWindow forces the X server
+       to retexture from the parent (tray toolbar), giving us a clean
+       opaque base. */
+    XClearWindow(dpy, icon_win);
+
+    cairo_t *cr = cairo_create(dst);
+
+    /* Scale the source onto the window with alpha compositing (default
+       OPERATOR_OVER). Transparent pixels keep the toolbar's pixels
+       visible underneath. */
+    double sx = (double)win_size / img_w;
+    double sy = (double)win_size / img_h;
+    cairo_scale(cr, sx, sy);
+    cairo_set_source_surface(cr, src, 0, 0);
+    cairo_paint(cr);
+
+    cairo_destroy(cr);
+    cairo_surface_destroy(dst);
+    cairo_surface_destroy(src);
+    free(buf);
+    XFlush(dpy);
+}
+
+void xembed_destroy_icon(Display *dpy, Window icon_win) {
+    if (icon_win)
+        XDestroyWindow(dpy, icon_win);
+    XFlush(dpy);
+}
+
+int xembed_poll_event(Display *dpy, Window icon_win,
+                      int *out_x, int *out_y) {
+    *out_x = 0;
+    *out_y = 0;
+
+    while (XPending(dpy) > 0) {
+        XEvent ev;
+        XNextEvent(dpy, &ev);
+
+        switch (ev.type) {
+        case ButtonPress:
+            if (ev.xbutton.window == icon_win) {
+                *out_x = ev.xbutton.x_root;
+                *out_y = ev.xbutton.y_root;
+                if (ev.xbutton.button == Button1)
+                    return 1;
+                if (ev.xbutton.button == Button3)
+                    return 2;
+            }
+            break;
+
+        case Expose:
+            if (ev.xexpose.window == icon_win && ev.xexpose.count == 0)
+                return 3;
+            break;
+
+        case DestroyNotify:
+            if (ev.xdestroywindow.window == icon_win)
+                return -1;
+            break;
+
+        case ConfigureNotify:
+            if (ev.xconfigure.window == icon_win) {
+                *out_x = ev.xconfigure.width;
+                *out_y = ev.xconfigure.height;
+                return 4;
+            }
+            break;
+
+        case ReparentNotify:
+            /* Tray manager reparented us — this is expected after docking. */
+            break;
+
+        default:
+            break;
+        }
+    }
+
+    return 0;
+}
+
+/* --- GTK4 popup window menu support --- */
+
+/* Implemented in Go via //export */
+extern void goMenuItemClicked(int id);
+
+/* The top-level popup window, reused across invocations. Submenu
+   popups are tracked in a separate list so they all close when the
+   top-level closes. */
+static GtkWidget *popup_win = NULL;
+static GList     *submenu_popups = NULL;  /* list of GtkWidget* */
+
+typedef struct {
+    xembed_menu_item  *items;
+    int                count;
+    int                x, y;
+} popup_data;
+
+/* Deep-free a heap-owned xembed_menu_item array (label + children). */
+static void free_items(xembed_menu_item *items, int count) {
+    if (!items) return;
+    for (int i = 0; i < count; i++) {
+        free((void *)items[i].label);
+        free_items(items[i].children, items[i].child_count);
+    }
+    free(items);
+}
+
+static void free_popup_data(popup_data *pd) {
+    if (!pd) return;
+    free_items(pd->items, pd->count);
+    free(pd);
+}
+
+
+/* Close every popup window — top-level plus any open submenus.
+   Called when the user clicks an actionable item or focus leaves the
+   menu tree. */
+static void close_all_popups(void) {
+    for (GList *l = submenu_popups; l; l = l->next) {
+        gtk_window_destroy(GTK_WINDOW(l->data));
+    }
+    g_list_free(submenu_popups);
+    submenu_popups = NULL;
+
+    if (popup_win) {
+        gtk_widget_set_visible(popup_win, FALSE);
+    }
+}
+
+static void on_button_clicked(GtkButton *btn, gpointer user_data) {
+    (void)btn;
+    int id = GPOINTER_TO_INT(user_data);
+    close_all_popups();
+    goMenuItemClicked(id);
+}
+
+static void on_check_toggled(GtkCheckButton *btn, gpointer user_data) {
+    (void)btn;
+    int id = GPOINTER_TO_INT(user_data);
+    close_all_popups();
+    goMenuItemClicked(id);
+}
+
+/* The popup is a regular WM-managed window (not override-redirect),
+   so the WM hands keyboard focus to it on map. When focus moves
+   elsewhere — the user clicked somewhere else, switched apps, etc. —
+   the focus controller's "leave" signal fires and we tear down the
+   menu tree. Submenus open from inside the top-level popup, so we
+   defer the actual close to an idle callback: that gives the new
+   submenu a chance to take focus first, and we only close if none of
+   our windows still has it. */
+static gboolean any_popup_has_focus(void) {
+    if (popup_win && gtk_window_is_active(GTK_WINDOW(popup_win)))
+        return TRUE;
+    for (GList *l = submenu_popups; l; l = l->next) {
+        if (gtk_window_is_active(GTK_WINDOW(l->data)))
+            return TRUE;
+    }
+    return FALSE;
+}
+
+static gboolean focus_out_recheck(gpointer user_data) {
+    (void)user_data;
+    if (!any_popup_has_focus())
+        close_all_popups();
+    return G_SOURCE_REMOVE;
+}
+
+static void on_popup_focus_leave(GtkEventControllerFocus *ctrl,
+                                  gpointer user_data) {
+    (void)ctrl; (void)user_data;
+    g_idle_add(focus_out_recheck, NULL);
+}
+
+/* Attach a focus controller that fires close_all_popups on focus loss. */
+static void attach_outside_click_close(GtkWidget *win) {
+    GtkEventController *focus = gtk_event_controller_focus_new();
+    g_signal_connect(focus, "leave",
+                     G_CALLBACK(on_popup_focus_leave), NULL);
+    gtk_widget_add_controller(win, focus);
+}
+
+/* Move a GtkWindow at the X11 level. GTK4 removed gtk_window_move(); the
+   GdkSurface is mapped to a real X11 Window we can reposition with
+   XMoveWindow. Must be called after the window has been realized (i.e.
+   after gtk_widget_set_visible TRUE).
+
+   The popup is **not** override-redirect — the WM keeps managing it so
+   focus tracking still works (focus-out fires when the user clicks
+   elsewhere). We tag the window with a stack of EWMH hints that make
+   sane WMs (fluxbox, openbox, i3, kwin, mutter) render it like a
+   floating menu: above the tray panel, skipped from taskbar/pager,
+   no decorations. */
+static void x11_move_window(GtkWidget *win, int x, int y) {
+    GdkSurface *surface = gtk_native_get_surface(GTK_NATIVE(win));
+    if (!surface || !GDK_IS_X11_SURFACE(surface))
+        return;
+    Window xid = gdk_x11_surface_get_xid(surface);
+    GdkDisplay *display = gdk_surface_get_display(surface);
+    Display *xdpy = gdk_x11_display_get_xdisplay(GDK_X11_DISPLAY(display));
+
+    /* These calls poke a window the WM may have already destroyed (a popup
+       torn down between scheduling and this idle callback). On GDK's Display
+       use GDK's own error trap rather than our global handler — push/pop is
+       the spec-correct way to make untrapped BadWindow/BadMatch from these
+       raw Xlib calls non-fatal, independent of whichever process-global
+       handler happens to be installed. */
+    gdk_x11_display_error_trap_push(display);
+
+    /* _NET_WM_WINDOW_TYPE_POPUP_MENU: makes fluxbox / openbox / etc
+       render the window above panels and skip decorations. Must be
+       set before the window is mapped to be honoured by some WMs;
+       on already-mapped windows it works for most modern WMs but a
+       few need an unmap/map cycle to re-read the property. */
+    Atom wm_type        = XInternAtom(xdpy, "_NET_WM_WINDOW_TYPE", False);
+    Atom wm_type_popup  = XInternAtom(xdpy, "_NET_WM_WINDOW_TYPE_POPUP_MENU", False);
+    XChangeProperty(xdpy, xid, wm_type, XA_ATOM, 32,
+                    PropModeReplace, (unsigned char *)&wm_type_popup, 1);
+
+    /* _NET_WM_STATE_ABOVE + SKIP_TASKBAR + SKIP_PAGER. Bundled into
+       one property write. */
+    Atom wm_state       = XInternAtom(xdpy, "_NET_WM_STATE", False);
+    Atom state_above    = XInternAtom(xdpy, "_NET_WM_STATE_ABOVE", False);
+    Atom state_skip_tb  = XInternAtom(xdpy, "_NET_WM_STATE_SKIP_TASKBAR", False);
+    Atom state_skip_pg  = XInternAtom(xdpy, "_NET_WM_STATE_SKIP_PAGER", False);
+    Atom states[3] = { state_above, state_skip_tb, state_skip_pg };
+    XChangeProperty(xdpy, xid, wm_state, XA_ATOM, 32,
+                    PropModeReplace, (unsigned char *)states, 3);
+
+    XMoveWindow(xdpy, xid, x, y);
+    XRaiseWindow(xdpy, xid);
+
+    /* POPUP_MENU windows aren't given keyboard focus by most WMs (the
+       spec says they're "menus", which traditionally use a grab rather
+       than focus). Without focus GtkEventControllerFocus's leave signal
+       never fires, so we'd have no way to notice the user clicking
+       elsewhere. Ask the WM to activate us via _NET_ACTIVE_WINDOW
+       (source=2 means "pager / pseudo-user request" which most WMs
+       honour without timestamp checks). This is safer than calling
+       XSetInputFocus directly — that races the X server with the
+       not-yet-fully-mapped window and trips BadMatch. */
+    Atom net_active = XInternAtom(xdpy, "_NET_ACTIVE_WINDOW", False);
+    XClientMessageEvent ev;
+    memset(&ev, 0, sizeof(ev));
+    ev.type         = ClientMessage;
+    ev.window       = xid;
+    ev.message_type = net_active;
+    ev.format       = 32;
+    ev.data.l[0]    = 2;            /* source: pager */
+    ev.data.l[1]    = CurrentTime;
+    XSendEvent(xdpy, DefaultRootWindow(xdpy), False,
+               SubstructureRedirectMask | SubstructureNotifyMask,
+               (XEvent *)&ev);
+
+    XFlush(xdpy);
+    gdk_x11_display_error_trap_pop_ignored(display);
+}
+
+/* Forward declaration — submenu buttons need to schedule a child popup. */
+static GtkWidget *build_menu_box(xembed_menu_item *items, int count);
+
+typedef struct {
+    xembed_menu_item *items;
+    int               count;
+    GtkWidget        *anchor;  /* the submenu button — used to position the popup */
+} submenu_open_data;
+
+static void on_submenu_button_clicked(GtkButton *btn, gpointer user_data) {
+    submenu_open_data *sd = (submenu_open_data *)user_data;
+
+    GtkWidget *win = gtk_window_new();
+    gtk_window_set_decorated(GTK_WINDOW(win), FALSE);
+    gtk_window_set_resizable(GTK_WINDOW(win), FALSE);
+
+    attach_outside_click_close(win);
+
+    GtkWidget *vbox = build_menu_box(sd->items, sd->count);
+    gtk_window_set_child(GTK_WINDOW(win), vbox);
+
+    /* Need the anchor button's position in root coordinates. GTK4
+       removed gtk_widget_translate_coordinates(); compute via the
+       button's bounds within its native widget plus the native
+       surface's screen origin via X11. */
+    graphene_rect_t bounds;
+    if (!gtk_widget_compute_bounds(GTK_WIDGET(btn),
+                                   GTK_WIDGET(gtk_widget_get_native(GTK_WIDGET(btn))),
+                                   &bounds)) {
+        bounds.origin.x = 0;
+        bounds.origin.y = 0;
+        bounds.size.width = 0;
+        bounds.size.height = 0;
+    }
+    GdkSurface *anchor_surface =
+        gtk_native_get_surface(gtk_widget_get_native(GTK_WIDGET(btn)));
+    int ox = 0, oy = 0;
+    if (anchor_surface && GDK_IS_X11_SURFACE(anchor_surface)) {
+        Window axid = gdk_x11_surface_get_xid(anchor_surface);
+        GdkDisplay *display = gdk_surface_get_display(anchor_surface);
+        Display *xdpy = gdk_x11_display_get_xdisplay(GDK_X11_DISPLAY(display));
+        Window child;
+        /* Trap BadWindow in case the anchor's surface is torn down between
+           the click and this handler running. */
+        gdk_x11_display_error_trap_push(display);
+        XTranslateCoordinates(xdpy, axid, DefaultRootWindow(xdpy),
+                              0, 0, &ox, &oy, &child);
+        gdk_x11_display_error_trap_pop_ignored(display);
+    }
+    int ax = ox + (int)bounds.origin.x;
+    int ay = oy + (int)bounds.origin.y;
+
+    gtk_widget_set_visible(win, TRUE);
+
+    int sw, sh;
+    gtk_window_get_default_size(GTK_WINDOW(win), &sw, &sh);
+    if (sw <= 0 || sh <= 0) {
+        /* default_size returns -1,-1 if never explicitly set; fall back
+           to the measured preferred size. */
+        GtkRequisition req;
+        gtk_widget_get_preferred_size(win, NULL, &req);
+        sw = req.width;
+        sh = req.height;
+    }
+
+    /* The parent popup grows upward from the tray, so submenu items
+       sit closer to the bottom of the screen than to the top. Align
+       the submenu's BOTTOM to the anchor button's bottom: the popup
+       grows upward, level with the row that opened it. */
+    int final_x = ax + (int)bounds.size.width;
+    int final_y = ay + (int)bounds.size.height - sh;
+
+    /* Horizontal flip against the monitor under the anchor button. */
+    GdkDisplay *display = gtk_widget_get_display(win);
+    GListModel *monitors = gdk_display_get_monitors(display);
+    guint n = g_list_model_get_n_items(monitors);
+    for (guint i = 0; i < n; i++) {
+        GdkMonitor *m = (GdkMonitor *)g_list_model_get_item(monitors, i);
+        GdkRectangle geom;
+        gdk_monitor_get_geometry(m, &geom);
+        if (ax >= geom.x && ax < geom.x + geom.width &&
+            ay >= geom.y && ay < geom.y + geom.height) {
+            if (final_x + sw > geom.x + geom.width)
+                final_x = ax - sw;          /* flip to the left */
+            g_object_unref(m);
+            break;
+        }
+        g_object_unref(m);
+    }
+
+    x11_move_window(win, final_x, final_y);
+    gtk_window_present(GTK_WINDOW(win));
+
+    submenu_popups = g_list_prepend(submenu_popups, win);
+}
+
+/* Build a vbox of GtkWidgets for the supplied items. Used for both the
+   top-level popup and each submenu popup. The submenu_open_data attached
+   to submenu buttons is freed when the button is destroyed. */
+static void on_button_destroy_free_data(GtkWidget *widget, gpointer user_data) {
+    (void)widget;
+    free(user_data);
+}
+
+static GtkWidget *build_menu_box(xembed_menu_item *items, int count) {
+    GtkWidget *vbox = gtk_box_new(GTK_ORIENTATION_VERTICAL, 0);
+
+    for (int i = 0; i < count; i++) {
+        xembed_menu_item *mi = &items[i];
+
+        if (mi->is_separator) {
+            GtkWidget *sep = gtk_separator_new(GTK_ORIENTATION_HORIZONTAL);
+            gtk_widget_set_margin_top(sep, 2);
+            gtk_widget_set_margin_bottom(sep, 2);
+            gtk_box_append(GTK_BOX(vbox), sep);
+            continue;
+        }
+
+        if (mi->is_check) {
+            GtkWidget *chk = gtk_check_button_new_with_label(
+                mi->label ? mi->label : "");
+            gtk_check_button_set_active(GTK_CHECK_BUTTON(chk), mi->checked);
+            gtk_widget_set_sensitive(chk, mi->enabled);
+            g_signal_connect(chk, "toggled",
+                             G_CALLBACK(on_check_toggled),
+                             GINT_TO_POINTER(mi->id));
+            gtk_box_append(GTK_BOX(vbox), chk);
+            continue;
+        }
+
+        /* Plain button (leaf) or submenu opener. Show "Label  ▸" for
+           submenu folders so users see they're nested. */
+        const char *label_text = mi->label ? mi->label : "";
+        char *display_label = NULL;
+        if (mi->child_count > 0 && mi->children) {
+            /* Compose "label  ▸" (BLACK RIGHT-POINTING SMALL TRIANGLE). */
+            size_t n = strlen(label_text) + 8;  /* ascii + " ▸" + NUL */
+            display_label = (char *)malloc(n);
+            snprintf(display_label, n, "%s \xE2\x96\xB8", label_text);
+            label_text = display_label;
+        }
+
+        GtkWidget *btn = gtk_button_new_with_label(label_text);
+        gtk_widget_set_sensitive(btn, mi->enabled);
+        gtk_button_set_has_frame(GTK_BUTTON(btn), FALSE);
+        GtkWidget *lbl = gtk_button_get_child(GTK_BUTTON(btn));
+        if (GTK_IS_LABEL(lbl))
+            gtk_label_set_xalign(GTK_LABEL(lbl), 0.0);
+
+        free(display_label);
+
+        if (mi->child_count > 0 && mi->children) {
+            submenu_open_data *sd =
+                (submenu_open_data *)calloc(1, sizeof(submenu_open_data));
+            sd->items   = mi->children;
+            sd->count   = mi->child_count;
+            sd->anchor  = btn;
+            g_signal_connect(btn, "clicked",
+                             G_CALLBACK(on_submenu_button_clicked), sd);
+            g_signal_connect(btn, "destroy",
+                             G_CALLBACK(on_button_destroy_free_data), sd);
+        } else {
+            g_signal_connect(btn, "clicked",
+                             G_CALLBACK(on_button_clicked),
+                             GINT_TO_POINTER(mi->id));
+        }
+        gtk_box_append(GTK_BOX(vbox), btn);
+    }
+
+    return vbox;
+}
+
+static gboolean popup_menu_idle(gpointer user_data) {
+    popup_data *pd = (popup_data *)user_data;
+
+    /* Destroy old top-level (and orphan submenus) before rebuilding. */
+    close_all_popups();
+    if (popup_win) {
+        gtk_window_destroy(GTK_WINDOW(popup_win));
+        popup_win = NULL;
+    }
+
+    popup_win = gtk_window_new();
+    gtk_window_set_decorated(GTK_WINDOW(popup_win), FALSE);
+    gtk_window_set_resizable(GTK_WINDOW(popup_win), FALSE);
+
+    attach_outside_click_close(popup_win);
+
+    GtkWidget *vbox = build_menu_box(pd->items, pd->count);
+    gtk_window_set_child(GTK_WINDOW(popup_win), vbox);
+
+    gtk_widget_set_visible(popup_win, TRUE);
+
+    /* Position the window above the click point (menu grows upward
+       from tray). Use measured preferred size — default_size is -1
+       until set. */
+    GtkRequisition req;
+    gtk_widget_get_preferred_size(popup_win, NULL, &req);
+    int win_w = req.width;
+    int win_h = req.height;
+
+    int final_x = pd->x - win_w / 2;
+    int final_y = pd->y - win_h;
+    if (final_x < 0) final_x = 0;
+    if (final_y < 0) final_y = pd->y;  /* fallback: below click */
+    x11_move_window(popup_win, final_x, final_y);
+
+    gtk_window_present(GTK_WINDOW(popup_win));
+
+    /* The vbox+children retain pointers into pd->items (via submenu
+       click handlers). free_popup_data() walks the array recursively
+       to release labels and children buffers — but we need to keep
+       the items alive while the popup is open. Defer the free until
+       the popup window is destroyed. */
+    g_object_set_data_full(G_OBJECT(popup_win), "popup_data", pd,
+                           (GDestroyNotify)free_popup_data);
+    return G_SOURCE_REMOVE;
+}
+
+/* Recursively deep-copy a Go-supplied items array into freshly-allocated
+   C memory. Each label is strdup'd, each children array is calloc'd. */
+static xembed_menu_item *copy_items(xembed_menu_item *src, int count) {
+    if (count <= 0 || !src) return NULL;
+    xembed_menu_item *dst =
+        (xembed_menu_item *)calloc(count, sizeof(xembed_menu_item));
+    for (int i = 0; i < count; i++) {
+        dst[i] = src[i];
+        if (src[i].label)
+            dst[i].label = strdup(src[i].label);
+        if (src[i].child_count > 0 && src[i].children) {
+            dst[i].children   = copy_items(src[i].children, src[i].child_count);
+            dst[i].child_count = src[i].child_count;
+        } else {
+            dst[i].children   = NULL;
+            dst[i].child_count = 0;
+        }
+    }
+    return dst;
+}
+
+void xembed_show_popup_menu(xembed_menu_item *items, int count,
+                            xembed_menu_click_cb cb, int x, int y) {
+    (void)cb;
+    popup_data *pd = (popup_data *)calloc(1, sizeof(popup_data));
+    pd->items = copy_items(items, count);
+    pd->count = count;
+    pd->x = x;
+    pd->y = y;
+
+    g_idle_add(popup_menu_idle, pd);
+}
diff --git a/client/ui/xembed_tray_linux.h b/client/ui/xembed_tray_linux.h
new file mode 100644
index 000000000..18a77c4c0
--- /dev/null
+++ b/client/ui/xembed_tray_linux.h
@@ -0,0 +1,81 @@
+#ifndef XEMBED_TRAY_H
+#define XEMBED_TRAY_H
+
+#include <X11/Xlib.h>
+
+// xembed_default_screen wraps the DefaultScreen macro for CGo.
+static inline int xembed_default_screen(Display *dpy) {
+    return DefaultScreen(dpy);
+}
+
+// xembed_install_error_handlers replaces Xlib's default protocol- and
+// I/O-error handlers (which call exit()) with logging handlers, so an async
+// X error from a tray race doesn't kill the UI process. Process-global and
+// idempotent; safe to call after every XOpenDisplay.
+void xembed_install_error_handlers(void);
+
+// xembed_find_tray returns the selection owner window for
+// _NET_SYSTEM_TRAY_S{screen}, or 0 if no XEmbed tray manager exists.
+Window xembed_find_tray(Display *dpy, int screen);
+
+// xembed_get_icon_size queries _NET_SYSTEM_TRAY_ICON_SIZE from the tray
+// manager window. Returns the size in pixels, or 0 if not set.
+int xembed_get_icon_size(Display *dpy, Window tray_mgr);
+
+// xembed_create_icon creates a tray icon window of the given size,
+// sets _XEMBED_INFO, and returns the window ID.
+// tray_mgr is the tray manager window; its _NET_SYSTEM_TRAY_VISUAL
+// property is queried to obtain a 32-bit ARGB visual for transparency.
+Window xembed_create_icon(Display *dpy, int screen, int size, Window tray_mgr);
+
+// xembed_dock sends _NET_SYSTEM_TRAY_OPCODE SYSTEM_TRAY_REQUEST_DOCK
+// to the tray manager to embed our icon window.
+int xembed_dock(Display *dpy, Window tray_mgr, Window icon_win);
+
+// xembed_draw_icon draws ARGB pixel data onto the icon window.
+// data is in [A,R,G,B] byte order per pixel (SNI IconPixmap format).
+// img_w, img_h are the source image dimensions.
+// win_size is the target window dimension (square).
+void xembed_draw_icon(Display *dpy, Window icon_win, int win_size,
+                      const unsigned char *data, int img_w, int img_h);
+
+// xembed_destroy_icon destroys the icon window.
+void xembed_destroy_icon(Display *dpy, Window icon_win);
+
+// xembed_poll_event processes pending X11 events. Returns:
+//   0 = no actionable event
+//   1 = left button press (out_x, out_y filled)
+//   2 = right button press (out_x, out_y filled)
+//   3 = expose (needs redraw)
+//   4 = configure (resize; out_x=width, out_y=height)
+//  -1 = DestroyNotify on icon window (tray died)
+int xembed_poll_event(Display *dpy, Window icon_win,
+                      int *out_x, int *out_y);
+
+// Callback type for menu item clicks. Called with the item's dbusmenu ID.
+typedef void (*xembed_menu_click_cb)(int id);
+
+// xembed_popup_menu builds and shows a GTK3 popup menu.
+// items is an array of menu item descriptors, count is the number of items.
+// cb is called (from the GTK main thread) when an item is clicked.
+// x, y are root coordinates for positioning the popup.
+// This must be called from the GTK main thread (use g_idle_add).
+
+typedef struct xembed_menu_item {
+    int    id;          // dbusmenu item ID
+    const char *label;  // display label (NULL for separator)
+    int    enabled;     // whether the item is clickable
+    int    is_check;    // whether this is a checkbox item
+    int    checked;     // checkbox state (0 or 1)
+    int    is_separator;// 1 if this is a separator
+    // children + child_count populate when this item is a submenu folder
+    // (dbusmenu's children-display=="submenu"). NULL/0 means leaf item.
+    struct xembed_menu_item *children;
+    int child_count;
+} xembed_menu_item;
+
+// Schedule a GTK popup menu on the main thread.
+void xembed_show_popup_menu(xembed_menu_item *items, int count,
+                            xembed_menu_click_cb cb, int x, int y);
+
+#endif
diff --git a/client/wasm/cmd/main.go b/client/wasm/cmd/main.go
index 4683f4033..260a528f0 100644
--- a/client/wasm/cmd/main.go
+++ b/client/wasm/cmd/main.go
@@ -56,8 +56,7 @@ func startClient(ctx context.Context, nbClient *netbird.Client) error {
 // parseClientOptions extracts NetBird options from JavaScript object
 func parseClientOptions(jsOptions js.Value) (netbird.Options, error) {
 	options := netbird.Options{
-		DeviceName: "dashboard-client",
-		LogLevel:   defaultLogLevel,
+		LogLevel: defaultLogLevel,
 	}
 
 	if jwtToken := jsOptions.Get("jwtToken"); !jwtToken.IsNull() && !jwtToken.IsUndefined() {
@@ -87,13 +86,41 @@ func parseClientOptions(jsOptions js.Value) (netbird.Options, error) {
 		options.DeviceName = deviceName.String()
 	}
 
-	if disableIPv6 := jsOptions.Get("disableIPv6"); !disableIPv6.IsNull() && !disableIPv6.IsUndefined() {
-		options.DisableIPv6 = disableIPv6.Bool()
+	disableIPv6, err := boolOption(jsOptions, "disableIPv6")
+	if err != nil {
+		return options, err
+	}
+	if disableIPv6 != nil {
+		options.DisableIPv6 = *disableIPv6
 	}
 
+	// The caller decides whether this client uses lazy connections; left unset it
+	// defers to the management feature flag. A short-lived, interactive caller
+	// turns it off so its sessions reach the few peers their grant covers eagerly,
+	// instead of the first request waiting for the connection to be established.
+	lazyConnectionEnabled, err := boolOption(jsOptions, "lazyConnectionEnabled")
+	if err != nil {
+		return options, err
+	}
+	options.LazyConnectionEnabled = lazyConnectionEnabled
+
 	return options, nil
 }
 
+// boolOption reads a boolean option, returning nil when the caller left it out.
+// js.Value.Bool panics on any other type, so a wrong type is reported instead.
+func boolOption(jsOptions js.Value, name string) (*bool, error) {
+	v := jsOptions.Get(name)
+	if v.IsNull() || v.IsUndefined() {
+		return nil, nil
+	}
+	if v.Type() != js.TypeBoolean {
+		return nil, fmt.Errorf("option %s must be a boolean, got %s", name, v.Type())
+	}
+	b := v.Bool()
+	return &b, nil
+}
+
 // createStartMethod creates the start method for the client
 func createStartMethod(client *netbird.Client) js.Func {
 	return js.FuncOf(func(this js.Value, args []js.Value) any {
diff --git a/client/wasm/cmd/main_test.go b/client/wasm/cmd/main_test.go
new file mode 100644
index 000000000..3ec5a8f6a
--- /dev/null
+++ b/client/wasm/cmd/main_test.go
@@ -0,0 +1,64 @@
+//go:build js
+
+package main
+
+import (
+	"syscall/js"
+	"testing"
+)
+
+// TestParseClientOptionsBooleans covers the boolean options against the value
+// kinds a JS caller can pass: js.Value.Bool panics on anything but a boolean,
+// so a wrong type has to be rejected before it reaches the client.
+func TestParseClientOptionsBooleans(t *testing.T) {
+	t.Run("unset leaves the lazy override empty", func(t *testing.T) {
+		options, err := parseClientOptions(js.Global().Get("Object").New())
+		if err != nil {
+			t.Fatalf("parse options: %v", err)
+		}
+		if options.LazyConnectionEnabled != nil {
+			t.Errorf("lazy override should stay unset, got %v", *options.LazyConnectionEnabled)
+		}
+		if options.DisableIPv6 {
+			t.Error("disableIPv6 should default to false")
+		}
+	})
+
+	t.Run("null defers to the management flag", func(t *testing.T) {
+		jsOptions := js.Global().Get("Object").New()
+		jsOptions.Set("lazyConnectionEnabled", js.Null())
+		options, err := parseClientOptions(jsOptions)
+		if err != nil {
+			t.Fatalf("parse options: %v", err)
+		}
+		if options.LazyConnectionEnabled != nil {
+			t.Errorf("lazy override should stay unset, got %v", *options.LazyConnectionEnabled)
+		}
+	})
+
+	t.Run("booleans are carried through", func(t *testing.T) {
+		jsOptions := js.Global().Get("Object").New()
+		jsOptions.Set("lazyConnectionEnabled", false)
+		jsOptions.Set("disableIPv6", true)
+		options, err := parseClientOptions(jsOptions)
+		if err != nil {
+			t.Fatalf("parse options: %v", err)
+		}
+		if options.LazyConnectionEnabled == nil || *options.LazyConnectionEnabled {
+			t.Errorf("lazy override should be false, got %v", options.LazyConnectionEnabled)
+		}
+		if !options.DisableIPv6 {
+			t.Error("disableIPv6 should be true")
+		}
+	})
+
+	t.Run("a non-boolean is rejected", func(t *testing.T) {
+		for _, value := range []any{"true", 1, js.Global().Get("Object").New()} {
+			jsOptions := js.Global().Get("Object").New()
+			jsOptions.Set("lazyConnectionEnabled", value)
+			if _, err := parseClientOptions(jsOptions); err == nil {
+				t.Errorf("value %v should be rejected", value)
+			}
+		}
+	})
+}
diff --git a/client/wasm/internal/rdp/rdcleanpath.go b/client/wasm/internal/rdp/rdcleanpath.go
index ee420dca4..3d8be8950 100644
--- a/client/wasm/internal/rdp/rdcleanpath.go
+++ b/client/wasm/internal/rdp/rdcleanpath.go
@@ -23,7 +23,7 @@ const (
 	RDCleanPathProxyHost   = "rdcleanpath.proxy.local"
 	RDCleanPathProxyScheme = "ws"
 
-	rdpDialTimeout = 15 * time.Second
+	rdpDialTimeout = 30 * time.Second
 
 	GeneralErrorCode = 1
 	WSAETimedOut     = 10060
diff --git a/client/wasm/internal/ssh/client.go b/client/wasm/internal/ssh/client.go
index 9cfe65266..28ae95ec0 100644
--- a/client/wasm/internal/ssh/client.go
+++ b/client/wasm/internal/ssh/client.go
@@ -80,13 +80,12 @@ func (c *Client) Connect(host string, port int, username, jwtToken string, ipVer
 		return fmt.Errorf("dial %s: %w", addr, err)
 	}
 
-	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
+	sshClient, err := nbssh.Handshake(ctx, conn, addr, config)
 	if err != nil {
-		closeWithLog(conn, "connection after handshake error")
-		return fmt.Errorf("SSH handshake: %w", err)
+		return err
 	}
 
-	c.sshClient = ssh.NewClient(sshConn, chans, reqs)
+	c.sshClient = sshClient
 	logrus.Infof("SSH: Connected to %s", addr)
 
 	return nil
@@ -119,57 +118,26 @@ func (c *Client) getAuthMethods(jwtToken string) ([]ssh.AuthMethod, error) {
 	return []ssh.AuthMethod{ssh.PublicKeys(signer)}, nil
 }
 
-// StartSession starts an SSH session with PTY
+// StartSession starts an SSH session with PTY. It holds the client lock for
+// the whole startup so Close cannot tear the client down mid-setup and the
+// new session cannot be installed into an already closed client.
 func (c *Client) StartSession(cols, rows int) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
 	if c.sshClient == nil {
 		return fmt.Errorf("SSH client not connected")
 	}
 
-	session, err := c.sshClient.NewSession()
+	pty, err := nbssh.StartPTYSession(c.sshClient, cols, rows)
 	if err != nil {
-		return fmt.Errorf("create session: %w", err)
+		return err
 	}
 
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.session = session
-
-	modes := ssh.TerminalModes{
-		ssh.ECHO:          1,
-		ssh.TTY_OP_ISPEED: 14400,
-		ssh.TTY_OP_OSPEED: 14400,
-		ssh.VINTR:         3,
-		ssh.VQUIT:         28,
-		ssh.VERASE:        127,
-	}
-
-	if err := session.RequestPty("xterm-256color", rows, cols, modes); err != nil {
-		closeWithLog(session, "session after PTY error")
-		return fmt.Errorf("PTY request: %w", err)
-	}
-
-	c.stdin, err = session.StdinPipe()
-	if err != nil {
-		closeWithLog(session, "session after stdin error")
-		return fmt.Errorf("get stdin: %w", err)
-	}
-
-	c.stdout, err = session.StdoutPipe()
-	if err != nil {
-		closeWithLog(session, "session after stdout error")
-		return fmt.Errorf("get stdout: %w", err)
-	}
-
-	c.stderr, err = session.StderrPipe()
-	if err != nil {
-		closeWithLog(session, "session after stderr error")
-		return fmt.Errorf("get stderr: %w", err)
-	}
-
-	if err := session.Shell(); err != nil {
-		closeWithLog(session, "session after shell error")
-		return fmt.Errorf("start shell: %w", err)
-	}
+	c.session = pty.Session
+	c.stdin = pty.Stdin
+	c.stdout = pty.Stdout
+	c.stderr = pty.Stderr
 
 	logrus.Info("SSH: Session started with PTY")
 	return nil
diff --git a/combined/Dockerfile.multistage b/combined/Dockerfile.multistage
index 79746819d..011379c2f 100644
--- a/combined/Dockerfile.multistage
+++ b/combined/Dockerfile.multistage
@@ -1,4 +1,4 @@
-FROM golang:1.25-bookworm AS builder
+FROM golang:1.26.7-bookworm AS builder
 WORKDIR /app
 
 # Install build dependencies
diff --git a/combined/Dockerfile.ubi b/combined/Dockerfile.ubi
new file mode 100644
index 000000000..66ef55a34
--- /dev/null
+++ b/combined/Dockerfile.ubi
@@ -0,0 +1,31 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-server" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Server" \
+      description="NetBird Server runs the Management, Signal, Relay and STUN services of a self-hosted NetBird deployment in a single process."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-server /go/bin/netbird-server
+COPY licenses/ /licenses/
+# Only the data directory shares the root group for arbitrary non-root UIDs.
+# Runtime-created keys and databases retain the application's restrictive modes.
+RUN mkdir -p /var/lib/netbird /etc/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+USER 1000:0
+ENV HOME=/var/lib/netbird
+# Runtimes such as OpenShift and Podman reserve ports below 1024 for root, so
+# the mounted config must set server.listenAddress to an unprivileged port.
+EXPOSE 8443 3478/udp
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/go/bin/netbird-server"]
+CMD ["--config", "/etc/netbird/config.yaml"]
diff --git a/combined/cmd/admin.go b/combined/cmd/admin.go
new file mode 100644
index 000000000..66fac4ac9
--- /dev/null
+++ b/combined/cmd/admin.go
@@ -0,0 +1,151 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/dexidp/dex/storage"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	"github.com/netbirdio/netbird/formatter/hook"
+	admincmd "github.com/netbirdio/netbird/management/cmd/admin"
+	tokencmd "github.com/netbirdio/netbird/management/cmd/token"
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	"github.com/netbirdio/netbird/management/server/activity"
+	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/util"
+)
+
+// newAdminCommands creates the admin command tree with combined-specific resource openers.
+func newAdminCommands() *cobra.Command {
+	return admincmd.NewCommands(admincmd.Openers{
+		Resources: withAdminResources,
+		Store:     withAdminStoreOnly,
+		IDP:       withAdminIDPOnly,
+	})
+}
+
+func newLegacyTokenCommand() *cobra.Command {
+	cmd := tokencmd.NewCommands(tokencmd.StoreOpener(withAdminStoreOnly))
+	cmd.Deprecated = "use 'admin token' instead"
+	return cmd
+}
+
+// withAdminResources loads the combined YAML config, initializes stores, and calls fn.
+func withAdminResources(cmd *cobra.Command, fn func(ctx context.Context, resources admincmd.Resources) error) error {
+	return withAdminConfig(cmd, func(ctx context.Context, cfg *CombinedConfig) error {
+		mgmtConfig, err := adminManagementConfig(cfg)
+		if err != nil {
+			return err
+		}
+
+		managementStore, err := openAdminStore(ctx, cfg)
+		if err != nil {
+			return err
+		}
+		defer admincmd.CloseStore(ctx, managementStore)
+
+		idpStorage, idpStorageFile, err := admincmd.OpenIDPStorage(mgmtConfig)
+		if err != nil {
+			return err
+		}
+		defer admincmd.CloseIDPStorage(idpStorage)
+
+		eventStore, esErr := openAdminEventStore(ctx, cfg, mgmtConfig)
+		if esErr != nil {
+			_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Warning: audit events will not be recorded: %v\n", esErr)
+		}
+		if eventStore != nil {
+			defer func() {
+				if err := eventStore.Close(ctx); err != nil {
+					log.Debugf("close activity event store: %v", err)
+				}
+			}()
+		}
+
+		return fn(ctx, admincmd.Resources{Store: managementStore, IDPStorage: idpStorage, IDPStorageFile: idpStorageFile, EventStore: eventStore})
+	})
+}
+
+// withAdminStoreOnly opens only the management store for admin subcommands that do not
+// need embedded IdP storage.
+func withAdminStoreOnly(cmd *cobra.Command, fn func(ctx context.Context, s store.Store) error) error {
+	return withAdminConfig(cmd, func(ctx context.Context, cfg *CombinedConfig) error {
+		managementStore, err := openAdminStore(ctx, cfg)
+		if err != nil {
+			return err
+		}
+		defer admincmd.CloseStore(ctx, managementStore)
+
+		return fn(ctx, managementStore)
+	})
+}
+
+func withAdminIDPOnly(cmd *cobra.Command, fn func(ctx context.Context, idpStorage storage.Storage, storageFile string) error) error {
+	return withAdminConfig(cmd, func(ctx context.Context, cfg *CombinedConfig) error {
+		mgmtConfig, err := adminManagementConfig(cfg)
+		if err != nil {
+			return err
+		}
+		idpStorage, idpStorageFile, err := admincmd.OpenIDPStorage(mgmtConfig)
+		if err != nil {
+			return err
+		}
+		defer admincmd.CloseIDPStorage(idpStorage)
+
+		return fn(ctx, idpStorage, idpStorageFile)
+	})
+}
+
+func withAdminConfig(cmd *cobra.Command, fn func(ctx context.Context, cfg *CombinedConfig) error) error {
+	if err := util.InitLog("error", "console"); err != nil {
+		return fmt.Errorf("init log: %w", err)
+	}
+
+	ctx := context.WithValue(cmd.Context(), hook.ExecutionContextKey, hook.SystemSource) //nolint:staticcheck
+
+	cfg, err := LoadConfig(configPath)
+	if err != nil {
+		return fmt.Errorf("load config: %w", err)
+	}
+	cfg.ApplyAdminDefaults()
+	applyServerStoreEnv(cfg.Server.Store)
+
+	return fn(ctx, cfg)
+}
+
+func adminManagementConfig(cfg *CombinedConfig) (*nbconfig.Config, error) {
+	mgmtConfig, err := cfg.ToManagementConfig()
+	if err != nil {
+		return nil, fmt.Errorf("create management config: %w", err)
+	}
+	return mgmtConfig, nil
+}
+
+func openAdminStore(ctx context.Context, cfg *CombinedConfig) (store.Store, error) {
+	managementStore, err := store.NewStore(ctx, types.Engine(cfg.Management.Store.Engine), cfg.Management.DataDir, nil, true)
+	if err != nil {
+		return nil, fmt.Errorf("create store: %w", err)
+	}
+	return managementStore, nil
+}
+
+func openAdminEventStore(ctx context.Context, cfg *CombinedConfig, config *nbconfig.Config) (activity.Store, error) {
+	if config.DataStoreEncryptionKey == "" {
+		return nil, fmt.Errorf("data store encryption key is not configured")
+	}
+	if err := applyActivityStoreEnv(cfg.Server.ActivityStore); err != nil {
+		return nil, fmt.Errorf("configure activity event store: %w", err)
+	}
+	eventStore, err := activitystore.NewSqlStore(ctx, config.Datadir, config.DataStoreEncryptionKey)
+	if err != nil {
+		return nil, fmt.Errorf("open activity event store: %w", err)
+	}
+	if eventStore == nil {
+		return nil, fmt.Errorf("open activity event store: returned nil store")
+	}
+	return eventStore, nil
+}
diff --git a/combined/cmd/admin_config_test.go b/combined/cmd/admin_config_test.go
new file mode 100644
index 000000000..ff7045d38
--- /dev/null
+++ b/combined/cmd/admin_config_test.go
@@ -0,0 +1,47 @@
+package cmd
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+)
+
+func TestApplyAdminDefaultsCopiesServerStoreWithoutExposedAddress(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.Server.ExposedAddress = ""
+	cfg.Server.DataDir = "/srv/netbird"
+	cfg.Server.Store = StoreConfig{
+		Engine: "postgres",
+		DSN:    "postgres://user:pass@example.com/netbird",
+	}
+
+	cfg.ApplyAdminDefaults()
+
+	require.Equal(t, "/srv/netbird", cfg.Management.DataDir)
+	require.Equal(t, "postgres", cfg.Management.Store.Engine)
+	require.Equal(t, cfg.Server.Store.DSN, cfg.Management.Store.DSN)
+}
+
+func TestOpenAdminEventStoreMissingEncryptionKeyReturnsNilInterface(t *testing.T) {
+	eventStore, err := openAdminEventStore(context.Background(), &CombinedConfig{}, &nbconfig.Config{})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "encryption key")
+	require.Nil(t, eventStore)
+}
+
+func TestApplyServerStoreEnv(t *testing.T) {
+	t.Setenv("NB_STORE_ENGINE_POSTGRES_DSN", "")
+	t.Setenv("NB_STORE_ENGINE_MYSQL_DSN", "")
+	t.Setenv("NB_STORE_ENGINE_SQLITE_FILE", "")
+
+	applyServerStoreEnv(StoreConfig{Engine: "postgres", DSN: "postgres-dsn", File: "store.db"})
+	require.Equal(t, "postgres-dsn", os.Getenv("NB_STORE_ENGINE_POSTGRES_DSN"))
+	require.Equal(t, "store.db", os.Getenv("NB_STORE_ENGINE_SQLITE_FILE"))
+
+	applyServerStoreEnv(StoreConfig{Engine: "mysql", DSN: "mysql-dsn"})
+	require.Equal(t, "mysql-dsn", os.Getenv("NB_STORE_ENGINE_MYSQL_DSN"))
+}
diff --git a/combined/cmd/config.go b/combined/cmd/config.go
index fe350e52a..890c86876 100644
--- a/combined/cmd/config.go
+++ b/combined/cmd/config.go
@@ -6,8 +6,7 @@ import (
 	"net"
 	"net/netip"
 	"os"
-	"path"
-	"path/filepath"
+	filePath "path/filepath"
 	"strings"
 	"time"
 
@@ -74,6 +73,16 @@ type ServerConfig struct {
 	ActivityStore           StoreConfig        `yaml:"activityStore"`
 	AuthStore               StoreConfig        `yaml:"authStore"`
 	ReverseProxy            ReverseProxyConfig `yaml:"reverseProxy"`
+
+	SupportedSyncMessageVersions           *int           `yaml:"supportedSyncMessageVersions,omitempty"`
+	PerAccountSupportedSyncMessageVersions map[string]int `yaml:"perAccountSupportedSyncMessageVersions,omitempty"`
+
+	AgentNetwork AgentNetworkConfig `yaml:"agentNetwork"`
+}
+
+// AgentNetworkConfig contains agent-network (LLM gateway) configuration.
+type AgentNetworkConfig struct {
+	PricingDefaultsFile string `yaml:"pricingDefaultsFile"`
 }
 
 // TLSConfig contains TLS/HTTPS settings
@@ -145,6 +154,7 @@ type AuthConfig struct {
 	CLIRedirectURIs                 []string          `yaml:"cliRedirectURIs"`
 	Owner                           *AuthOwnerConfig  `yaml:"owner,omitempty"`
 	DashboardPostLogoutRedirectURIs []string          `yaml:"dashboardPostLogoutRedirectURIs"`
+	GrantTypes                      []string          `yaml:"grantTypes"`
 }
 
 // AuthStorageConfig contains auth storage settings
@@ -299,6 +309,19 @@ func (c *CombinedConfig) ApplySimplifiedDefaults() {
 	c.autoConfigureClientSettings(exposedProto, exposedHost, exposedHostPort, hasExternalStuns, hasExternalRelay, hasExternalSignal)
 }
 
+// ApplyAdminDefaults applies the management settings needed by admin commands even
+// when the full server config is invalid and ApplySimplifiedDefaults cannot run.
+func (c *CombinedConfig) ApplyAdminDefaults() {
+	if c.Management.DataDir == "" || c.Management.DataDir == "/var/lib/netbird/" {
+		c.Management.DataDir = c.Server.DataDir
+	}
+	if c.Management.Store.Engine == "" || c.Management.Store.Engine == "sqlite" {
+		if c.Server.Store.Engine != "" || c.Server.Store.File != "" || c.Server.Store.DSN != "" {
+			c.Management.Store = c.Server.Store
+		}
+	}
+}
+
 // applyRelayDefaults configures the relay service if no external relay is configured.
 func (c *CombinedConfig) applyRelayDefaults(exposedProto, exposedHostPort string, hasExternalRelay, hasExternalStuns bool) {
 	if hasExternalRelay {
@@ -576,11 +599,11 @@ func (c *CombinedConfig) buildEmbeddedIdPConfig(mgmt ManagementConfig) (*idp.Emb
 			return nil, fmt.Errorf("authStore.dsn is required when authStore.engine is postgres")
 		}
 	} else {
-		authStorageFile = path.Join(mgmt.DataDir, "idp.db")
+		authStorageFile = filePath.Join(mgmt.DataDir, "idp.db")
 		if c.Server.AuthStore.File != "" {
 			authStorageFile = c.Server.AuthStore.File
-			if !filepath.IsAbs(authStorageFile) {
-				authStorageFile = filepath.Join(mgmt.DataDir, authStorageFile)
+			if !filePath.IsAbs(authStorageFile) {
+				authStorageFile = filePath.Join(mgmt.DataDir, authStorageFile)
 			}
 		}
 	}
@@ -604,6 +627,7 @@ func (c *CombinedConfig) buildEmbeddedIdPConfig(mgmt ManagementConfig) (*idp.Emb
 		DashboardRedirectURIs:           mgmt.Auth.DashboardRedirectURIs,
 		CLIRedirectURIs:                 mgmt.Auth.CLIRedirectURIs,
 		DashboardPostLogoutRedirectURIs: mgmt.Auth.DashboardPostLogoutRedirectURIs,
+		GrantTypes:                      mgmt.Auth.GrantTypes,
 	}
 
 	if mgmt.Auth.Owner != nil && mgmt.Auth.Owner.Email != "" {
@@ -694,16 +718,21 @@ func (c *CombinedConfig) ToManagementConfig() (*nbconfig.Config, error) {
 	httpConfig.AuthCallbackURL = callbackURL + types.ProxyCallbackEndpointFull
 
 	return &nbconfig.Config{
-		Stuns:                  stuns,
-		Relay:                  relayConfig,
-		Signal:                 signalConfig,
-		Datadir:                mgmt.DataDir,
-		DataStoreEncryptionKey: mgmt.Store.EncryptionKey,
-		HttpConfig:             httpConfig,
-		StoreConfig:            storeConfig,
-		ReverseProxy:           reverseProxy,
-		DisableDefaultPolicy:   mgmt.DisableDefaultPolicy,
-		EmbeddedIdP:            embeddedIdP,
+		Stuns:                              stuns,
+		Relay:                              relayConfig,
+		Signal:                             signalConfig,
+		Datadir:                            mgmt.DataDir,
+		DataStoreEncryptionKey:             mgmt.Store.EncryptionKey,
+		HttpConfig:                         httpConfig,
+		StoreConfig:                        storeConfig,
+		ReverseProxy:                       reverseProxy,
+		DisableDefaultPolicy:               mgmt.DisableDefaultPolicy,
+		EmbeddedIdP:                        embeddedIdP,
+		HighestSupportedSyncMessageVersion: c.Server.SupportedSyncMessageVersions,
+		PerAccountHighestSupportedSyncMessageVersion: c.Server.PerAccountSupportedSyncMessageVersions,
+		AgentNetwork: nbconfig.AgentNetwork{
+			PricingDefaultsFile: c.Server.AgentNetwork.PricingDefaultsFile,
+		},
 	}, nil
 }
 
@@ -727,7 +756,7 @@ func ApplyEmbeddedIdPConfig(ctx context.Context, cfg *nbconfig.Config, mgmtPort
 		cfg.EmbeddedIdP.Storage.Type = "sqlite3"
 	}
 	if cfg.EmbeddedIdP.Storage.Config.File == "" && cfg.Datadir != "" {
-		cfg.EmbeddedIdP.Storage.Config.File = path.Join(cfg.Datadir, "idp.db")
+		cfg.EmbeddedIdP.Storage.Config.File = filePath.Join(cfg.Datadir, "idp.db")
 	}
 
 	issuer := cfg.EmbeddedIdP.Issuer
diff --git a/combined/cmd/root.go b/combined/cmd/root.go
index 31e0580fb..26d6ceedb 100644
--- a/combined/cmd/root.go
+++ b/combined/cmd/root.go
@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
@@ -24,6 +25,7 @@ import (
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/encryption"
+	agentnetworkpricing "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	mgmtServer "github.com/netbirdio/netbird/management/internals/server"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/telemetry"
@@ -31,6 +33,7 @@ import (
 	relayServer "github.com/netbirdio/netbird/relay/server"
 	"github.com/netbirdio/netbird/relay/server/listener"
 	"github.com/netbirdio/netbird/relay/server/listener/ws"
+	syncgrpc "github.com/netbirdio/netbird/shared/management/grpc"
 	sharedMetrics "github.com/netbirdio/netbird/shared/metrics"
 	"github.com/netbirdio/netbird/shared/relay/auth"
 	"github.com/netbirdio/netbird/shared/signal/proto"
@@ -64,7 +67,8 @@ func init() {
 	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", "", "path to YAML configuration file (required)")
 	_ = rootCmd.MarkPersistentFlagRequired("config")
 
-	rootCmd.AddCommand(newTokenCommands())
+	rootCmd.AddCommand(newAdminCommands())
+	rootCmd.AddCommand(newLegacyTokenCommand())
 }
 
 func RootCmd() *cobra.Command {
@@ -116,12 +120,43 @@ func execute(cmd *cobra.Command, _ []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
-	err = shutdownServers(ctx, servers.relaySrv, servers.healthcheck, servers.stunServer, servers.mgmtSrv, servers.metricsServer)
+	err = shutdownServers(ctx, servers.relaySrv, servers.healthcheck, servers.stunServer, servers.mgmtSrv, servers.signalSrv, servers.metricsServer)
 	wg.Wait()
 	return err
 }
 
 // initializeConfig loads and validates the configuration, then initializes logging.
+func applyServerStoreEnv(storeConfig StoreConfig) {
+	if dsn := storeConfig.DSN; dsn != "" {
+		switch strings.ToLower(storeConfig.Engine) {
+		case "postgres":
+			os.Setenv("NB_STORE_ENGINE_POSTGRES_DSN", dsn)
+		case "mysql":
+			os.Setenv("NB_STORE_ENGINE_MYSQL_DSN", dsn)
+		}
+	}
+	if file := storeConfig.File; file != "" {
+		os.Setenv("NB_STORE_ENGINE_SQLITE_FILE", file)
+	}
+}
+
+func applyActivityStoreEnv(storeConfig StoreConfig) error {
+	if engine := storeConfig.Engine; engine != "" {
+		engineLower := strings.ToLower(engine)
+		if engineLower == "postgres" && storeConfig.DSN == "" {
+			return fmt.Errorf("activityStore.dsn is required when activityStore.engine is postgres")
+		}
+		os.Setenv("NB_ACTIVITY_EVENT_STORE_ENGINE", engineLower)
+		if dsn := storeConfig.DSN; dsn != "" {
+			os.Setenv("NB_ACTIVITY_EVENT_POSTGRES_DSN", dsn)
+		}
+	}
+	if file := storeConfig.File; file != "" {
+		os.Setenv("NB_ACTIVITY_EVENT_SQLITE_FILE", file)
+	}
+	return nil
+}
+
 func initializeConfig() error {
 	var err error
 	config, err = LoadConfig(configPath)
@@ -137,30 +172,10 @@ func initializeConfig() error {
 		return fmt.Errorf("failed to initialize log: %w", err)
 	}
 
-	if dsn := config.Server.Store.DSN; dsn != "" {
-		switch strings.ToLower(config.Server.Store.Engine) {
-		case "postgres":
-			os.Setenv("NB_STORE_ENGINE_POSTGRES_DSN", dsn)
-		case "mysql":
-			os.Setenv("NB_STORE_ENGINE_MYSQL_DSN", dsn)
-		}
-	}
-	if file := config.Server.Store.File; file != "" {
-		os.Setenv("NB_STORE_ENGINE_SQLITE_FILE", file)
-	}
+	applyServerStoreEnv(config.Server.Store)
 
-	if engine := config.Server.ActivityStore.Engine; engine != "" {
-		engineLower := strings.ToLower(engine)
-		if engineLower == "postgres" && config.Server.ActivityStore.DSN == "" {
-			return fmt.Errorf("activityStore.dsn is required when activityStore.engine is postgres")
-		}
-		os.Setenv("NB_ACTIVITY_EVENT_STORE_ENGINE", engineLower)
-		if dsn := config.Server.ActivityStore.DSN; dsn != "" {
-			os.Setenv("NB_ACTIVITY_EVENT_POSTGRES_DSN", dsn)
-		}
-	}
-	if file := config.Server.ActivityStore.File; file != "" {
-		os.Setenv("NB_ACTIVITY_EVENT_SQLITE_FILE", file)
+	if err := applyActivityStoreEnv(config.Server.ActivityStore); err != nil {
+		return err
 	}
 
 	log.Infof("Starting combined NetBird server")
@@ -190,7 +205,7 @@ func createAllServers(ctx context.Context, cfg *CombinedConfig) (*serverInstance
 		metricsServer: metricsServer,
 	}
 
-	_, tlsSupport, err := handleTLSConfig(cfg)
+	tlsConfig, tlsSupport, err := handleTLSConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("failed to setup TLS config: %w", err)
 	}
@@ -199,7 +214,7 @@ func createAllServers(ctx context.Context, cfg *CombinedConfig) (*serverInstance
 		return nil, err
 	}
 
-	if err := servers.createManagementServer(ctx, cfg); err != nil {
+	if err := servers.createManagementServer(ctx, cfg, tlsConfig); err != nil {
 		return nil, err
 	}
 
@@ -226,7 +241,7 @@ func (s *serverInstances) createRelayServer(cfg *CombinedConfig, tlsSupport bool
 	}
 
 	hashedSecret := sha256.Sum256([]byte(cfg.Relay.AuthSecret))
-	authenticator := auth.NewTimedHMACValidator(hashedSecret[:], 24*time.Hour)
+	authenticator := auth.NewTimedHMACValidator(hashedSecret[:])
 
 	relayCfg := relayServer.Config{
 		Meter:          s.metricsServer.Meter,
@@ -249,7 +264,7 @@ func (s *serverInstances) createRelayServer(cfg *CombinedConfig, tlsSupport bool
 	return nil
 }
 
-func (s *serverInstances) createManagementServer(ctx context.Context, cfg *CombinedConfig) error {
+func (s *serverInstances) createManagementServer(ctx context.Context, cfg *CombinedConfig, tlsConfig *tls.Config) error {
 	if !cfg.Management.Enabled {
 		return nil
 	}
@@ -275,9 +290,14 @@ func (s *serverInstances) createManagementServer(ctx context.Context, cfg *Combi
 		return fmt.Errorf("failed to ensure encryption key: %w", err)
 	}
 
+	if err := loadAgentNetworkPricing(ctx, mgmtConfig); err != nil {
+		cleanupSTUNListeners(s.stunListeners)
+		return fmt.Errorf("failed to load agent-network pricing defaults: %w", err)
+	}
+
 	LogConfigInfo(mgmtConfig)
 
-	s.mgmtSrv, err = createManagementServer(cfg, mgmtConfig)
+	s.mgmtSrv, err = createManagementServer(cfg, mgmtConfig, tlsConfig)
 	if err != nil {
 		cleanupSTUNListeners(s.stunListeners)
 		return fmt.Errorf("failed to create management server: %w", err)
@@ -345,7 +365,6 @@ func setupServerHooks(servers *serverInstances, cfg *CombinedConfig) {
 			})
 		}
 	}
-
 }
 
 func startServers(wg *sync.WaitGroup, srv *relayServer.Server, httpHealthcheck *healthcheck.Server, stunServer *stun.Server, metricsServer *sharedMetrics.Metrics) {
@@ -380,7 +399,7 @@ func startServers(wg *sync.WaitGroup, srv *relayServer.Server, httpHealthcheck *
 	}
 }
 
-func shutdownServers(ctx context.Context, srv *relayServer.Server, httpHealthcheck *healthcheck.Server, stunServer *stun.Server, mgmtSrv mgmtServer.Server, metricsServer *sharedMetrics.Metrics) error {
+func shutdownServers(ctx context.Context, srv *relayServer.Server, httpHealthcheck *healthcheck.Server, stunServer *stun.Server, mgmtSrv mgmtServer.Server, signalSrv *signalServer.Server, metricsServer *sharedMetrics.Metrics) error {
 	var errs error
 
 	if err := httpHealthcheck.Shutdown(ctx); err != nil {
@@ -406,6 +425,10 @@ func shutdownServers(ctx context.Context, srv *relayServer.Server, httpHealthche
 		}
 	}
 
+	if signalSrv != nil {
+		signalSrv.Stop()
+	}
+
 	if metricsServer != nil {
 		log.Infof("shutting down metrics server")
 		if err := metricsServer.Shutdown(ctx); err != nil {
@@ -494,7 +517,7 @@ func handleTLSConfig(cfg *CombinedConfig) (*tls.Config, bool, error) {
 	return nil, false, nil
 }
 
-func createManagementServer(cfg *CombinedConfig, mgmtConfig *nbconfig.Config) (mgmtServer.Server, error) {
+func createManagementServer(cfg *CombinedConfig, mgmtConfig *nbconfig.Config, tlsConfig *tls.Config) (mgmtServer.Server, error) {
 	mgmt := cfg.Management
 
 	// Extract port from listen address
@@ -505,14 +528,25 @@ func createManagementServer(cfg *CombinedConfig, mgmtConfig *nbconfig.Config) (m
 	}
 	mgmtPort, _ := strconv.Atoi(portStr)
 
+	if err := syncgrpc.ValidateSyncMessageVersion(mgmtConfig.HighestSupportedSyncMessageVersion); err != nil {
+		return nil, err
+	}
+
+	for accountId, version := range mgmtConfig.PerAccountHighestSupportedSyncMessageVersion {
+		if err := syncgrpc.ValidateSyncMessageVersion(&version); err != nil {
+			return nil, fmt.Errorf("unrecognized sync message version in perAccountSupportedSyncMessageVersions for account %s %w", accountId, err)
+		}
+	}
+
 	mgmtSrv := newServer(
 		&mgmtServer.Config{
 			NbConfig:                mgmtConfig,
 			DNSDomain:               "",
-			MgmtSingleAccModeDomain: "",
+			MgmtSingleAccModeDomain: mgmtServer.DefaultSelfHostedDomain,
 			AutoResolveDomains:      true,
 			MgmtPort:                mgmtPort,
 			MgmtMetricsPort:         cfg.Server.MetricsPort,
+			TLSConfig:               tlsConfig,
 			DisableMetrics:          mgmt.DisableAnonymousMetrics,
 			DisableGeoliteUpdate:    mgmt.DisableGeoliteUpdate,
 			// Always enable user deletion from IDP in combined server (embedded IdP is always enabled)
@@ -524,7 +558,7 @@ func createManagementServer(cfg *CombinedConfig, mgmtConfig *nbconfig.Config) (m
 }
 
 // createCombinedHandler creates an HTTP handler that multiplexes Management, Signal (via wsproxy), and Relay WebSocket traffic
-func createCombinedHandler(grpcServer *grpc.Server, httpHandler http.Handler, idpHandler http.Handler, relaySrv *relayServer.Server, meter metric.Meter, cfg *CombinedConfig) http.Handler {
+func createCombinedHandler(grpcServer *grpc.Server, httpHandler, idpHandler http.Handler, relaySrv *relayServer.Server, meter metric.Meter, cfg *CombinedConfig) http.Handler {
 	wsProxy := wsproxyserver.New(grpcServer, wsproxyserver.WithOTelMeter(meter))
 
 	var relayAcceptFn func(conn listener.Conn)
@@ -599,6 +633,32 @@ func handleRelayWebSocket(w http.ResponseWriter, r *http.Request, acceptFn func(
 	acceptFn(conn)
 }
 
+// loadAgentNetworkPricing loads the management-side LLM pricing defaults
+// file for the combined server and starts its periodic reloader. An
+// explicitly configured PricingDefaultsFile is required to load (a typo
+// must fail startup rather than silently bill with built-ins the operator
+// believes they replaced); a relative path is resolved against the data
+// directory so a bare filename like "pricing.yaml" lands in the datadir
+// alongside the store. With no path configured, <datadir>/<DefaultFileName>
+// is probed and may be absent (compiled-in defaults serve).
+func loadAgentNetworkPricing(ctx context.Context, mgmtConfig *nbconfig.Config) error {
+	pricingPath := mgmtConfig.AgentNetwork.PricingDefaultsFile
+	required := pricingPath != ""
+	if !required {
+		pricingPath = agentnetworkpricing.DefaultFileName
+	}
+	if !filepath.IsAbs(pricingPath) {
+		pricingPath = filepath.Join(mgmtConfig.Datadir, pricingPath)
+	}
+
+	log.Infof("loading agent-network pricing defaults from %s (required: %v)", pricingPath, required)
+	if err := agentnetworkpricing.LoadFile(pricingPath, required); err != nil {
+		return err
+	}
+	agentnetworkpricing.StartReloader(ctx, agentnetworkpricing.ReloadInterval)
+	return nil
+}
+
 // logConfig prints all configuration parameters for debugging
 func logConfig(cfg *CombinedConfig) {
 	log.Info("=== Configuration ===")
@@ -675,6 +735,25 @@ func logManagementConfig(cfg *CombinedConfig) {
 		log.Infof("    Relay addresses: %v", cfg.Management.Relays.Addresses)
 		log.Infof("    Relay credentials TTL: %s", cfg.Management.Relays.CredentialsTTL)
 	}
+
+	logAgentNetworkConfig(cfg)
+}
+
+func logAgentNetworkConfig(cfg *CombinedConfig) {
+	log.Info("  Agent Network:")
+	pricingPath := cfg.Server.AgentNetwork.PricingDefaultsFile
+	configured := pricingPath != ""
+	if !configured {
+		pricingPath = agentnetworkpricing.DefaultFileName
+	}
+	if !filepath.IsAbs(pricingPath) {
+		pricingPath = filepath.Join(cfg.Management.DataDir, pricingPath)
+	}
+	if configured {
+		log.Infof("    Pricing defaults file: %s", pricingPath)
+	} else {
+		log.Infof("    Pricing defaults file: %s (default, optional)", pricingPath)
+	}
 }
 
 // logEnvVars logs all NB_ environment variables that are currently set
diff --git a/combined/cmd/token.go b/combined/cmd/token.go
deleted file mode 100644
index 550480062..000000000
--- a/combined/cmd/token.go
+++ /dev/null
@@ -1,63 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-
-	"github.com/netbirdio/netbird/formatter/hook"
-	tokencmd "github.com/netbirdio/netbird/management/cmd/token"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/util"
-)
-
-// newTokenCommands creates the token command tree with combined-specific store opener.
-func newTokenCommands() *cobra.Command {
-	return tokencmd.NewCommands(withTokenStore)
-}
-
-// withTokenStore loads the combined YAML config, initializes the store, and calls fn.
-func withTokenStore(cmd *cobra.Command, fn func(ctx context.Context, s store.Store) error) error {
-	if err := util.InitLog("error", "console"); err != nil {
-		return fmt.Errorf("init log: %w", err)
-	}
-
-	ctx := context.WithValue(cmd.Context(), hook.ExecutionContextKey, hook.SystemSource) //nolint:staticcheck
-
-	cfg, err := LoadConfig(configPath)
-	if err != nil {
-		return fmt.Errorf("load config: %w", err)
-	}
-
-	if dsn := cfg.Server.Store.DSN; dsn != "" {
-		switch strings.ToLower(cfg.Server.Store.Engine) {
-		case "postgres":
-			os.Setenv("NB_STORE_ENGINE_POSTGRES_DSN", dsn)
-		case "mysql":
-			os.Setenv("NB_STORE_ENGINE_MYSQL_DSN", dsn)
-		}
-	}
-	if file := cfg.Server.Store.File; file != "" {
-		os.Setenv("NB_STORE_ENGINE_SQLITE_FILE", file)
-	}
-
-	datadir := cfg.Management.DataDir
-	engine := types.Engine(cfg.Management.Store.Engine)
-
-	s, err := store.NewStore(ctx, engine, datadir, nil, true)
-	if err != nil {
-		return fmt.Errorf("create store: %w", err)
-	}
-	defer func() {
-		if err := s.Close(ctx); err != nil {
-			log.Debugf("close store: %v", err)
-		}
-	}()
-
-	return fn(ctx, s)
-}
diff --git a/combined/config.yaml.example b/combined/config.yaml.example
index 66bc71703..085e4344f 100644
--- a/combined/config.yaml.example
+++ b/combined/config.yaml.example
@@ -134,3 +134,16 @@ server:
   #   trustedPeers: []                 # CIDRs of trusted peer networks (e.g. ["100.64.0.0/10"])
   #   accessLogRetentionDays: 7        # Days to retain HTTP access logs. 0 (or unset) defaults to 7. Negative values disable cleanup (logs kept indefinitely).
   #   accessLogCleanupIntervalHours: 24 # How often (in hours) to run the access-log cleanup job. 0 (or unset) is treated as "not set" and defaults to 24 hours; cleanup remains enabled. To disable cleanup, set accessLogRetentionDays to a negative value.
+
+  # Agent network (LLM gateway) settings (optional)
+  # agentNetwork:
+  #   # Path to the YAML file holding the default LLM pricing table. A relative
+  #   # path is resolved against dataDir, so a bare filename like "pricing.yaml"
+  #   # lands in the data directory. When empty, {dataDir}/defaults_llm_pricing.yaml
+  #   # is probed; if no file is present the compiled-in defaults are used.
+  #   # Schema: surface ("openai"/"anthropic"/"bedrock") -> model -> rates in USD
+  #   # per 1k tokens (input_per_1k, output_per_1k, and the optional
+  #   # cached_input_per_1k / cache_read_per_1k / cache_creation_per_1k). The file
+  #   # is re-read periodically (mtime poll). An explicitly configured path that
+  #   # fails to load fails startup; runtime reload errors keep the previous table.
+  #   pricingDefaultsFile: "pricing.yaml"
diff --git a/crowdin.yml b/crowdin.yml
new file mode 100644
index 000000000..efdbceb8d
--- /dev/null
+++ b/crowdin.yml
@@ -0,0 +1,11 @@
+skip_untranslated_strings: true
+skip_untranslated_files: true
+import_eq_suggestions: true
+
+files:
+  - source: /client/ui/i18n/locales/en/common.json
+    translation: /client/ui/i18n/locales/%two_letters_code%/common.json
+    type: chrome
+    languages_mapping:
+      two_letters_code:
+        zh-CN: zh-CN
diff --git a/dns/nameserver.go b/dns/nameserver.go
index 81c616c50..84e83e2b4 100644
--- a/dns/nameserver.go
+++ b/dns/nameserver.go
@@ -53,6 +53,7 @@ type NameServerGroup struct {
 	ID string `gorm:"primaryKey"`
 	// AccountID is a reference to Account that this object belongs
 	AccountID string `gorm:"index"`
+	PublicID  string `json:"-"`
 	// Name group name
 	Name string
 	// Description group description
diff --git a/docs/agent-networks/01-end-to-end-flows.md b/docs/agent-networks/01-end-to-end-flows.md
index 7264f3768..0de6b4c33 100644
--- a/docs/agent-networks/01-end-to-end-flows.md
+++ b/docs/agent-networks/01-end-to-end-flows.md
@@ -109,13 +109,13 @@ sequenceDiagram
         Chk->>Inj: continue
         Inj->>Inj: inject NetBird identity headers per provider config
         Inj->>Grd: continue
-        Grd->>Grd: enforce model allowlist
+        Grd->>Grd: enforce per-provider allowlist (fail-closed backstop)
         Grd->>Up: forward (over WireGuard)
         Up-->>Resp: response (JSON or SSE stream)
         Resp->>Resp: parse usage tokens, completion
         Note over Resp: capture_completion gates raw<br/>completion capture
         Resp->>Cost: tokens
-        Cost->>Cost: lookup pricing.yaml + compute cost
+        Cost->>Cost: lookup rates from config-delivered<br/>pricing table + compute cost
         Cost->>Rec: tokens + cost
         Rec->>MgmtGrpc: RecordLLMUsage(provider, model, prompt_t, completion_t, cost, groups, user)
         Rec-->>Log: emit access-log entry<br/>(if EnableLogCollection)
@@ -135,6 +135,21 @@ sequenceDiagram
   (`redact_pii = settings.RedactPii`). Phones, emails, credit cards,
   PII names — see `redact.go` for the full set. See
   [`modules/31-proxy-middleware-builtin.md`](modules/31-proxy-middleware-builtin.md).
+- The model allowlist is enforced in TWO places. `CheckLLMPolicyLimits`
+  is authoritative: it resolves the policy that governs this
+  (provider, caller-groups) and denies (`deny_code = llm_policy.model_blocked`)
+  when no applicable policy permits the model — so an allowlist scoped to
+  one group/provider never leaks to another, and an un-guardrailed policy
+  is genuinely unrestricted. `llm_guardrail` is a per-provider fail-closed
+  backstop: it only carries an allowlist for a provider every authorising
+  policy restricts, and blocks unknown/undetermined models even when
+  management is unreachable. Because that backstop allowlist is the UNION
+  of every restricting policy's models, per-group narrowing lives only in
+  the authoritative check: during a `CheckLLMPolicyLimits` outage
+  `llm_limit_check` fails open, so a caller can reach any model in the
+  provider's union — a group scoped to model A could reach model B if
+  another group restricts the same provider to B. This is the documented
+  fail-open trade-off; a future flag may switch it to fail-closed.
 - SSE streaming requires special handling on the response side; the
   parser must handle partial chunks without buffering the whole
   stream. See [`modules/32-proxy-llm-parsers.md`](modules/32-proxy-llm-parsers.md).
diff --git a/docs/agent-networks/modules/21-management-agentnetwork.md b/docs/agent-networks/modules/21-management-agentnetwork.md
index b64c1ba20..f91c369f7 100644
--- a/docs/agent-networks/modules/21-management-agentnetwork.md
+++ b/docs/agent-networks/modules/21-management-agentnetwork.md
@@ -15,6 +15,10 @@ Inside the package: `manager.go` is the CRUD + permissions-gated facade; `synthe
 | ---- | ---- |
 | `agentnetwork/manager.go` | Manager interface + CRUD + permission gates + bootstrap-settings + reconcile trigger |
 | `agentnetwork/synthesizer.go` | Settings/policy → wire-format synthesis; sole writer of the proxy middleware chain |
+| `agentnetwork/synthesizer_pricing.go` | `buildCostMeterConfigJSON` — default table + per-provider prices → `cost_meter` config |
+| `agentnetwork/pricing/defaults.go` | Default pricing table derived from the catalog + supplementals; `DefaultTable`, `LookupDefault`, wire `Entry` |
+| `agentnetwork/pricing/override.go` | `LoadFile`/`StartReloader` for `AgentNetwork.PricingDefaultsFile` (mtime poll, merge over compiled-in base) |
+| `agentnetwork/pricing/{exampleyaml,gen}.go` | Generates `defaults_llm_pricing.example.yaml` from the compiled-in table (golden-tested) |
 | `agentnetwork/policyselect.go` | Per-request policy attribution + account-budget ceiling (min-wins) |
 | `agentnetwork/reconcile.go` | Per-account synth diff vs in-memory cache → Create/Update/Delete |
 | `agentnetwork/catalog/catalog.go` | Static provider catalogue (auth headers, identity-injection shapes) |
@@ -48,6 +52,8 @@ flowchart TD
     I --> J[indexProviderGroups: providerID -> sorted source groups]
     J --> K[buildRouterConfigJSON drops orphan providers]
     J --> L[buildIdentityInjectConfigJSON per catalog entry]
+    J --> K2[buildCostMeterConfigJSON: default table + per-provider prices]
+    K2 --> P
     H --> M[mergeGuardrails: union allowlist, OR redact]
     M --> N[applyAccountCollectionControls account toggle = SOLE capture control]
     N --> O[marshalGuardrailConfig]
@@ -60,6 +66,84 @@ flowchart TD
     R --> T[accountManager.UpdateAccountPeers — fans synth ACLs into network map]
 ```
 
+### LLM pricing (management is the sole authority)
+
+**The proxy carries no price list.** Management synthesizes the entire pricing
+table and ships it inside `cost_meter`'s `ConfigJSON`, so a price change reaches
+the proxies as an ordinary mapping push — the chain rebuild installs a fresh
+table and there is nothing to reload on the proxy side.
+
+```mermaid
+flowchart TD
+    A[catalog.All — PricingSurfaces x Models] --> B[buildDefaultTable + supplementalDefaults]
+    B --> C{AgentNetwork.PricingDefaultsFile}
+    C -- absent --> D[compiled-in table serves]
+    C -- loaded --> E[LoadFile: merge file entries WHOLE over compiled base]
+    E --> F[mergedTable atomic.Pointer]
+    D --> G[DefaultTable]
+    F --> G
+    G --> H[buildCostMeterConfigJSON — pricing.defaults]
+    I[types.Provider.Models operator prices] --> J[normalizePricingModelID<br/>bedrock ARN/region/version, vertex @version]
+    J --> K[materializeEntry: default entry as base,<br/>operator input/output verbatim,<br/>cache pointers only when non-nil]
+    K --> L[pricing.providers keyed by provider record ID]
+    H --> M[cost_meter ConfigJSON]
+    L --> M
+    G --> N[GET /catalog — applyDefaultPricing prefills dashboard rows]
+    O[StartReloader: mtime poll every ReloadInterval 1m] --> E
+```
+
+**Two tiers, resolved per request on the proxy** (`synthesizer_pricing.go:22-35`):
+
+- `pricing.defaults` — surface (`openai`/`anthropic`/`bedrock`) → normalized model
+  id → rates. The **full** default table ships to every account: it is small
+  (~10 KB) and it is what keeps gateway-style providers (which enumerate no
+  models, so they claim every model) priced.
+- `pricing.providers` — provider **record** id → normalized model id → rates,
+  matched against the `llm.resolved_provider_id` the router stamps. Entries are
+  **fully materialized here**, at synth time: `materializeEntry` starts from the
+  default entry for that model so cache rates the operator didn't state are
+  inherited, overlays operator `input`/`output` verbatim (**including an explicit
+  0**, which prices a self-hosted or internal endpoint as free rather than
+  silently reverting to list price), and overlays cache-rate **pointers only when
+  non-nil** — `nil` means "inherit the default", an explicit `0` means "no
+  discount, bill this bucket at the input rate". The proxy therefore does two map
+  lookups and no merging.
+
+Same orphan rule as the router: a provider no enabled policy authorises is
+unreachable, so its prices aren't shipped. Model ids are normalized with the
+**same** functions the request parser uses (`NormalizeBedrockModel` /
+`NormalizeVertexModel`), which is what makes the per-record lookup key compare
+equal to the `llm.model` the proxy meters. Post-normalization duplicates resolve
+first-occurrence-wins, matching the routing dedup order.
+
+**`AgentNetwork.PricingDefaultsFile`** (`config.go:190-207`) lets an operator
+replace default rates without a rebuild. Schema is `surface → model → rates`
+(`input_per_1k`, `output_per_1k`, and optional `cached_input_per_1k` /
+`cache_read_per_1k` / `cache_creation_per_1k`). Semantics:
+
+- A **relative** path resolves against `<Datadir>`, so a bare filename lands
+  alongside the store. Empty config probes `<Datadir>/defaults_llm_pricing.yaml`.
+- An **explicitly configured** path is *required to load*: a typo or malformed
+  file fails startup, because the operator believes those rates are live. The
+  conventional probe is optional — an absent file just serves compiled-in
+  defaults, and the path stays watched in case it appears later.
+- File entries **replace** the compiled-in entry for the same (surface, model)
+  **whole** — they are not field-merged, so an entry must repeat the cache rates
+  it wants to keep. Everything the file doesn't mention keeps built-in rates.
+- Unknown YAML fields are rejected (`KnownFields(true)`) and every rate must be
+  finite and non-negative — the same constraints the HTTP API enforces on
+  operator per-provider prices.
+- Reload is an mtime poll (`ReloadInterval`, 1 min) and is **lenient at runtime**:
+  a parse error keeps the previous table, a deleted file reverts to compiled-in
+  defaults. A mid-edit save can never take pricing down.
+
+The live table feeds **both** consumers, which is what keeps them consistent: the
+synthesizer (what proxies actually bill with) and `GET /api/agent-network/catalog`
+via `applyDefaultPricing` (what the dashboard's model-row prices prefill with).
+`defaults_llm_pricing.example.yaml` is generated from the compiled-in table
+(`go generate ./management/internals/modules/agentnetwork/pricing`) and
+golden-tested, so operators start from a file matching the built-in rates exactly.
+
 ### Budget rule resolution (min-wins, group+user bound)
 
 ```mermaid
@@ -122,9 +206,9 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
   | on_request | 1 | `llm_router` | `{"providers":[{id, models[], upstream_*, auth_header_*, allowed_group_ids[]}]}` | **true** |
   | on_request | 2 | `llm_limit_check` | `{}` | – |
   | on_request | 3 | `llm_identity_inject` | `{"providers":[{provider_id, header_pair?, json_metadata?, extra_headers?}]}` | **true** |
-  | on_request | 4 | `llm_guardrail` | `{"model_allowlist"?, "prompt_capture":{enabled,redact_pii}}` | – |
+  | on_request | 4 | `llm_guardrail` | `{"provider_allowlists"?: {providerID: []model}, "prompt_capture":{enabled,redact_pii}}` | – |
   | on_response | 5 | `llm_limit_record` | `{}` (runs LAST at runtime) | – |
-  | on_response | 6 | `cost_meter` | `{}` | – |
+  | on_response | 6 | `cost_meter` | `{"pricing":{"defaults":{surface:{model:rates}},"providers"?:{providerRecordID:{model:rates}}}}` — rates are `{input_per_1k, output_per_1k, cached_input_per_1k?, cache_read_per_1k?, cache_creation_per_1k?}` | – |
   | on_response | 7 | `llm_response_parser` | `{"capture_completion": <bool>, "redact_pii"?: true}` | – |
 - **Synthesized service shape** (`synthesizer.go:739`): `Mode=HTTP`, `Private=true`, `Domain=<subdomain>.<cluster>`, `AccessGroups=unionSourceGroups(enabledPolicies)`, one `TargetTypeCluster` target with `Host=noop.invalid:443` (router rewrites per request), `Options.{DirectUpstream,AgentNetwork}=true`, `DisableAccessLog=!settings.EnableLogCollection`, `CaptureMax{Req,Resp}Bytes=1<<20`, `CaptureContentTypes=["application/json","text/event-stream"]`.
 
@@ -139,6 +223,12 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Orphan providers (no enabled policy authorises them) NEVER reach the router** (`synthesizer.go:351-357`); skipped from `identity_inject` for symmetry.
 - **Provider creation refuses empty `api_key`** (`manager.go:175`); **deletion refuses while any policy still references it** (`manager.go:265-273`).
 - **Session keypair stability across provider edits** (`manager.go:226-228`) — server-managed, copied through every `UpdateProvider`, never API-surfaced.
+- **Management is the sole pricing authority.** The proxy has no embedded price list, so an account whose `cost_meter` config carries no `pricing` block bills **nothing** (`cost.skipped=unknown_model`, $0) rather than falling back to stale built-ins. The top-level `pricing` wrapper is also the feature-detection signal in both directions: an old proxy ignores it as an unknown field, and a new proxy reads its absence as "old management".
+- **Per-provider prices are materialized at synth time, not merged on the proxy** (`synthesizer_pricing.go:114-131`). A per-record entry is always complete, so the proxy's lookup is per-record-then-defaults with no field-level fallback between tiers.
+- **An explicit operator price of `0` prices the model as free** — it must not be treated as "unset" and reverted to list price (`synthesizer_pricing.go:49-54`). Only *cache*-rate fields distinguish unset from zero, via `*float64`.
+- **Pricing model ids are normalized with the same functions the request parser uses** (`normalizePricingModelID`). If the two ever diverge, per-record prices silently stop matching and every request falls through to surface defaults.
+- **The default table's coverage is structural, not curated.** It is derived from the catalog via each provider's `PricingSurfaces`; `TestDefaultTable_CoversEveryCatalogModel` fails on an unpriced catalog model and `TestDefaultTable_NoConflictingContributions` fails if two providers contribute the same (surface, model) at different rates.
+- **A pricing-defaults file failure is fatal only at startup, and only for an explicitly configured path.** Runtime reload failures keep the previous table; a deleted file reverts to compiled-in defaults (`pricing/override.go:62-81, 113-148`).
 
 ## Things to scrutinize
 
@@ -176,10 +266,12 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Capture-pointer semantics (restated):** non-agent-network callers see no field → legacy nil-default emit, identical to pre-PR. Agent-network targets always carry an explicit `capture_*` value.
 - **`TestSynthesizeServices_HappyPath` was updated:** request-parser config moved from `{}` to `{"capture_prompt":false}` (`synthesizer_test.go:174`). External snapshot tests against synth output need updating.
 - **`MergedGuardrails` retains zeroed `TokenLimits`/`Budget`/`Retention`** even though `Policy.Limits` carries the real values now; `llm_limit_check` is the authoritative enforcement. Comment at `synthesizer.go:940-948` calls this out.
+- **`cost_meter`'s `pricing` block is version-skew-safe in both directions.** A proxy predating config-delivered pricing ignores the field as unknown JSON (it previously priced from its own embedded table, so it keeps billing — at its own rates, which is the skew to be aware of during a rolling upgrade). A current proxy paired with old management sees no `pricing` block, logs one warning at chain-build time, and records `cost.skipped=unknown_model` — token counting and cap enforcement are unaffected, only the USD annotation goes to $0.
 
 ### Performance
 
 - **`SynthesizeServices` runs on every controller tick / mutation reconcile.** Cost: 4 store reads + optional per-provider keypair backfill. Sort + index + merge are O(N log N) / O(P × G); dominant cost is JSON marshalling. No nested loops escape these dimensions.
+- **The full default pricing table is marshalled into every account's `cost_meter` config on every synth** (~10 KB serialized). This is a deliberate trade: it keeps gateway-style providers priced for every catalog model, and it is the largest single contributor to the synth JSON. `DefaultTable()` itself is a pointer load (or a `sync.Once`-built map) — the cost is the marshal, not the build.
 - **`reconcile.diffMappings` is O(N + M)** with N=M=1 per account today — effectively constant.
 - **`SynthesizeServicesForCluster`** (`synthesizer.go:71`) walks every account on a cluster; per-account failures are **swallowed** (`synthesizer.go:91-93`) so a single misconfigured account doesn't drop the cluster. Runs per proxy reconnect.
 
@@ -188,6 +280,7 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Activity codes:** `AgentNetwork{Provider,Policy,Guardrail,BudgetRule}{Created,Updated,Deleted}`; `AgentNetworkSettingsUpdated` with `log_collection/prompt_collection/redact_pii` payload (`manager.go:567-571`). **No activity code for `SelectPolicyForRequest` denies** — surfaced via proxy access log only (likely intentional given volume).
 - **Deny codes** namespaced: `llm_policy.{token,budget}_cap_exceeded`, `llm_account.{token,budget}_cap_exceeded` (`policyselect.go:18-26`).
 - **Reconcile failures are logged at warn and swallowed** (`reconcile.go:42-44`). Persistent synth failures (e.g. unknown catalog id) silently keep the proxy out of sync — consider a manager-level synth-health surface if this becomes a support burden.
+- **Pricing-file lifecycle logs at info** (load, reload, revert-to-built-ins) and **at warn** for a runtime reload failure; the mtime check itself is `Debugf`. There is no metric on reload failures, so an operator who breaks the file mid-flight keeps billing at the previous table with only a log line to show it (`pricing/override.go:113-148`).
 
 ## Test coverage
 
@@ -198,6 +291,9 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 | `synthesizer_guardrail_realstore_test.go` | `PromptCaptureAccountIsSoleControl`; `PromptCaptureFlowsWhenAccountOptsIn`; `AccountRedactWithoutGuardrailRedact`; `NoGuardrail_CaptureOff`. |
 | `synthesizer_log_collection_realstore_test.go` | `LogCollection{Off_SuppressesAccessLog,On_PermitsAccessLog}` — verifies `DisableAccessLog` propagation through `ToProtoMapping`. |
 | `synthesizer_parser_redact_realstore_test.go` | **Capture-pointer regression suite:** `ParserConfigsCarryRedactPii`; `ParserConfigsSuppressCaptureWhenLogCollectionOnly` (log=on/prompt=off ⇒ both capture flags false); `ParserConfigsOmitRedactPiiWhenOff`. |
+| `synthesizer_pricing_test.go` | `BuildCostMeterConfig_{BedrockModelNormalization,CacheRateNilVsZero,OrphanAndGatewayProviders}` — the per-record tier's three load-bearing rules: keys normalized like the parser's, `nil` cache pointer inherits vs explicit `0` bills at input rate, and orphan / gateway (empty `Models`) providers ship no per-record entry. |
+| `pricing/defaults_test.go` | `DefaultTable_{CoversEveryCatalogModel,NoConflictingContributions,AllRatesFiniteNonNegative,PinnedRates}`; `LookupDefault_SurfaceOrder`. Catalog-derived coverage + rate sanity are structural, not curated. |
+| `pricing/override_test.go` | `LoadFile_{MergesOverCompiledDefaults,MissingPath,RejectsInvalid}`; `Reload_LifeCycle` (mtime detect, parse error keeps previous, delete reverts to built-ins); `ExampleYAML_InSyncWithBuiltins` golden. |
 | `policyselect_test.go` | Mock-store: `NoApplicablePolicies`; `AllowWithLowestGroupAttribution`; `LargerPoolWinsAcrossUsageLevels`; `StaysOnLargerPoolAfterPartialDrain`; `FallsThroughToSmallerPoolWhenLargerExhausted`; `TiebreakBy{LargerGroupPool,CreatedAt}`; `DeniesWhenAllExhausted`; `UncappedPolicyAlwaysWinsAgainstCapped`; `DisabledPolicyIgnored`; `StoreErrorPropagates`; `RejectsEmptyAccount`; `SharesGroupCounterAcrossPolicies`; `AntiFallThroughOnLowestGroup`; `BudgetOnlyExhaustionDenies`; `BudgetTighterThanTokenWins`. |
 | `policyselect_realstore_test.go` | Real-sqlite regression guard: `NoApplicablePolicies`; `AllowAndLowestGroupAttribution`; `LargerPoolWins_FallsThroughWhenExhausted`; `BudgetCapDenies`; `GroupCounterSharedAcrossPolicies`; `DisabledPolicyIgnored`. |
 | `policyselect_account_realstore_test.go` | Account budget rules: `AccountCeilingBindsEvenWithUncappedPolicy` (min-wins); `AccountGroupCeiling`; `AccountTargetUsersBindsOnlyThatUser`; `AccountRuleRecordsToOwnWindow`. |
diff --git a/docs/agent-networks/modules/31-proxy-middleware-builtin.md b/docs/agent-networks/modules/31-proxy-middleware-builtin.md
index 904de6424..ad56feb77 100644
--- a/docs/agent-networks/modules/31-proxy-middleware-builtin.md
+++ b/docs/agent-networks/modules/31-proxy-middleware-builtin.md
@@ -5,7 +5,7 @@ LLM request. The two highest-blast-radius areas are the **capture-pointer
 semantics** and the **limit_check ⇒ limit_record** record-once invariant.
 
 Sibling module: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — the SDK
-adapters + pricing catalog this chain delegates to.
+adapters + pricing table and cost formula this chain delegates to.
 
 ---
 
@@ -34,7 +34,7 @@ rewrites.
 | `llm_identity_inject` | OnRequest | `llm.{resolved_provider_id,authorising_groups}`, `Input.{UserEmail,UserID,UserGroups,UserGroupNames}` | none | header strip/inject + optional body rewrite |
 | `llm_guardrail` | OnRequest | `llm.{model,request_prompt_raw}` | `llm_policy.{decision,reason}`, `llm.request_prompt` | none (model allowlist deny) |
 | `llm_response_parser` | OnResponse | `llm.provider`, `Input.{RespHeaders,RespBody,Status}` | `llm.{input,output,total,cached_input,cache_creation}_tokens`, `llm.response_completion` | none |
-| `cost_meter` | OnResponse | `llm.{provider,model}`, token buckets | `cost.usd_total` or `cost.skipped` | pricing lookup |
+| `cost_meter` | OnResponse | `llm.{provider,model,resolved_provider_id}`, token buckets | `cost.usd_{input,cached_input,cache_creation,output,total,cache}` or `cost.skipped` | none (in-memory pricing lookup) |
 | `llm_limit_record` | OnResponse | `llm.{attribution_group_id,attribution_window_seconds,input_tokens,output_tokens}`, `cost.usd_total` | none | gRPC `RecordLLMUsage` |
 
 [all_test.go:26–40](../../../proxy/internal/middleware/builtin/all_test.go)
@@ -44,7 +44,7 @@ locks the ID set; adding or removing one is a conscious extension.
 
 | File | LOC | Notes |
 |---|---:|---|
-| `builtin.go` | 86 | Registry + `FactoryContext` (ctx, data dir, meter, logger, mgmt client) |
+| `builtin.go` | 90 | Registry + `FactoryContext` (ctx, meter, logger, mgmt client) |
 | `all_test.go` | 41 | Locks the 8-ID registry surface |
 | `agentnetwork_chain_integration_test.go` | 319 | Live sqlite + real gRPC bufconn; gate→recorder wire path |
 | `llm_request_parser/*` | 162 / 66 / 356 | Provider detection, body parse, prompt extraction with capture-pointer gating |
@@ -53,7 +53,7 @@ locks the ID set; adding or removing one is a conscious extension.
 | `llm_identity_inject/*` | 440 / 108 / 666 | HeaderPair (LiteLLM) + JSONMetadata (Portkey) + ExtraHeaders |
 | `llm_guardrail/*` | 176 / 82 / 75 / 219 / 217 | Model allowlist + optional prompt capture with PII redaction |
 | `llm_response_parser/*` | 258 / 222 / 43 / 433 / 169 / 111 | Buffered + SSE accumulation; AWS event-stream accumulator (`streaming_bedrock.go`) for Bedrock; capture-pointer gates completion emit |
-| `cost_meter/*` | 181 / 84 / 439 | Token → USD via `proxy/internal/llm/pricing` |
+| `cost_meter/*` | 236 / 98 / 586 | Token → USD via `proxy/internal/llm/pricing`; both pricing tiers arrive in the middleware config |
 | `llm_limit_record/*` | 144 / 35 / 191 | Post-flight `RecordLLMUsage` (5s, debug-on-error) |
 
 ## Per-middleware
@@ -168,12 +168,46 @@ token schema.
 
 ### cost_meter
 
-Reads `llm.provider` + `llm.model` + token buckets, looks up per-1k rate via
-`pricing.Loader`, emits `cost.usd_total` or a closed-set `cost.skipped`
-reason (`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
-`unknown_model`). Loader's hot-reload goroutine is bound to proxy-lifetime
-context via `startReloader`. **Key invariant:** provider-shape switch lives
-in `pricing.Table.Cost` (sibling doc) — `cost_meter` stays provider-agnostic.
+Reads `llm.provider` + `llm.model` + token buckets, looks up the per-1k rates,
+and emits the full `cost.usd_*` breakdown (four per-bucket values plus the
+`_total` and `_cache` aggregates) or a closed-set `cost.skipped` reason
+(`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
+`unknown_model`).
+
+**Management owns pricing.** The proxy carries no embedded price list: the whole
+table arrives in this middleware's `ConfigJSON` as
+`{pricing: {defaults, providers}}`, synthesized by management from the catalog
+plus the operator's stored per-provider prices
+([factory.go:13–34](../../../proxy/internal/middleware/builtin/cost_meter/factory.go)).
+Both tiers are validated by `pricing.NewTable` / `pricing.NewEntries` at
+construction, so a non-finite or negative rate fails the chain build. A price
+change is an ordinary mapping push — the chain rebuild yields a fresh instance
+over a fresh immutable table, so there is no data dir, no pricing file, no
+reload goroutine, and nothing to invalidate.
+
+**Two-tier lookup**
+([middleware.go:165–183](../../../proxy/internal/middleware/builtin/cost_meter/middleware.go)):
+
+1. **Per-provider-record** — the operator's stored price for the route that
+   actually served the request, keyed by the `llm.resolved_provider_id` that
+   `llm_router` stamped on the allow path, then by normalized model id. Entries
+   arrive fully materialized (management folds default cache rates in at synth
+   time), so there is no merging here. Absent metadata — no router in the chain
+   — skips this tier.
+2. **Surface defaults** — the catalog-derived table keyed by `llm.provider`
+   (`openai`/`anthropic`/`bedrock`). This is also what prices gateway-style
+   providers, which enumerate no models and therefore get no per-record entry.
+
+**Backward compatibility:** a config with no `pricing` block means management
+predates config-delivered pricing. The factory logs one warning at build time
+and the instance records `cost.skipped=unknown_model` ($0) for every request
+rather than falling back to a stale built-in price list
+([factory.go:55–60](../../../proxy/internal/middleware/builtin/cost_meter/factory.go)).
+
+**Key invariant:** the provider-shape switch lives in `pricing.EntryCosts`
+(sibling doc) and is selected by the **surface**, not by which tier the entry
+came from — `cost_meter` stays provider-agnostic, and a per-record override on
+an Anthropic route still bills its cache buckets additively.
 
 ### llm_limit_record
 
@@ -244,14 +278,16 @@ no mocks. Tests: `TestChain_AllowPath_StampsAttributionAndRecordsCounter`
 | `llm_router` | `{providers: [{id, models, upstream_scheme, upstream_host, upstream_path?, auth_header_name, auth_header_value, allowed_group_ids}]}` |
 | `llm_limit_check` | `{}` — pulls `MgmtClient` from `FactoryContext` |
 | `llm_identity_inject` | `{providers: [{provider_id, header_pair?|json_metadata?, extra_headers?}]}` |
-| `llm_guardrail` | `{model_allowlist: []string, prompt_capture: {enabled, redact_pii}}` |
+| `llm_guardrail` | `{provider_allowlists: {providerID: []string}, prompt_capture: {enabled, redact_pii}}` — allowlist keyed by resolved provider id; a provider absent from the map is unrestricted (fail-closed backstop; authoritative per-policy/group check is management's `CheckLLMPolicyLimits`) |
 | `llm_response_parser` | `{redact_pii?, capture_completion?: *bool}` |
-| `cost_meter` | `{pricing_path?}` (basename inside data-dir; defaults `pricing.yaml`) |
+| `cost_meter` | `{pricing: {defaults: {surface: {model: rates}}, providers: {providerRecordID: {model: rates}}}}` — rates are `{input_per_1k, output_per_1k, cached_input_per_1k?, cache_read_per_1k?, cache_creation_per_1k?}`. A missing `pricing` key means "management predates config-delivered pricing": every request records `cost.skipped=unknown_model` |
 | `llm_limit_record` | `{}` — same pattern as `llm_limit_check` |
 
 All factories accept empty / null / `{}` / whitespace as zero-value config;
 only structurally invalid JSON is rejected so misconfig surfaces at chain
-build time.
+build time. `cost_meter` adds a semantic check on top of that: a `pricing`
+block carrying a negative or non-finite rate fails the build too, rather than
+mispricing live traffic.
 
 ## Invariants
 
@@ -320,10 +356,11 @@ non-object `metadata` field
 — header path still attributes, but body-level tag-budget enforcement
 doesn't run for that request.
 
-**Concurrency.** `cost_meter` shares a `pricing.Loader` via
-`atomic.Pointer[Table]`; readers always see a consistent table. Every
-middleware is a stateless value receiver. Integration test uses real bufconn
-gRPC — race detector is the meaningful bar.
+**Concurrency.** `cost_meter`'s two pricing tables are built once from the
+middleware config and never mutated, so the lookup path needs no lock or atomic
+swap — a price change replaces the whole instance. Every middleware is
+otherwise a stateless value receiver. Integration test uses real bufconn gRPC —
+race detector is the meaningful bar.
 
 **Perf.** Hot path is `lookupKV` linear scan over <10 KVs; `cost_meter.Cost`
 is O(1); SSE accumulation is single-pass. No map allocation per call.
@@ -349,13 +386,13 @@ counter accuracy.
 | `llm_guardrail/redact_test.go` | 15 | Email, SSN, phone (E.164 + NA), bearer, IPv4; fixture-driven |
 | `llm_response_parser/middleware_test.go` | 18 | Buffered OAI+Anthro, capture-pointer, redact, truncation |
 | `llm_response_parser/streaming_test.go` | 7 | OAI usage frame, Anthro message_delta, truncated body best-effort |
-| `cost_meter/middleware_test.go` | 17 | Each skip reason, provider-shape, pricing loader integration |
+| `cost_meter/middleware_test.go` | 22 | Each skip reason, provider-shape formulas, config-delivered defaults, per-record-beats-defaults + miss-falls-back, per-record uses surface formula, nil-pricing skips everything, invalid-rate rejection |
 | `llm_limit_record/middleware_test.go` | 7 | Skip-on-no-signal, skip-on-missing-attribution, RPC failure swallowed |
 
 ## Cross-references
 
 - Sibling: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — SDK adapters
-  + SSE framer + pricing loader.
+  + SSE framer + pricing table and cost formula.
 - Path-routed providers (Vertex AI + Bedrock), `keyfile::` credential, GCP
   token minting, `/bedrock` prefix:
   [50-path-routed-providers.md](./50-path-routed-providers.md).
diff --git a/docs/agent-networks/modules/32-proxy-llm-parsers.md b/docs/agent-networks/modules/32-proxy-llm-parsers.md
index 0376bc988..52faeaac1 100644
--- a/docs/agent-networks/modules/32-proxy-llm-parsers.md
+++ b/docs/agent-networks/modules/32-proxy-llm-parsers.md
@@ -9,7 +9,7 @@ pricing table's per-provider cost formula is the highest-leverage place a
 small bug would silently mis-bill operators.
 
 Sibling module: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
-— the 8 middlewares that consume this package's parsers + pricing loader.
+— the 8 middlewares that consume this package's parsers + pricing table.
 
 ---
 
@@ -24,8 +24,9 @@ proxy-framework dependencies:
 - `openai.go` / `anthropic.go` / `bedrock.go` — per-provider `Parser` impls.
 - `sse.go` — SSE scanner (`Scanner`, `Event`, `NewScanner`).
 - `errors.go` — sentinels callers branch on with `errors.Is`.
-- `pricing/` — embedded-default + hot-reload override table with
-  symlink-safe Unix loader (build-tagged stub elsewhere).
+- `pricing/` — immutable pricing table + the per-surface cost formula. The
+  rates themselves come from management inside `cost_meter`'s middleware
+  config; this package holds no price list and reads no files.
 - `fixtures/` — captured request/response/stream bodies the tests replay.
 
 The package carries zero proxy-framework dependencies so the same parsers can
@@ -47,12 +48,9 @@ be reused later by a WASM adapter
 | `sse_test.go` | 175 | 12 tests; fixture replay + multiline + size limits |
 | `parser_test.go` | 53 | `Parsers()`, `DetectParser`, provider enum values |
 | `errors.go` | 31 | 6 sentinels: `Err{Unknown,Unsupported}Provider/Model`, `Err{NotLLM,Malformed}Response`, `ErrStreamingUnsupported`, `ErrMalformedRequest` |
-| `pricing/pricing.go` | 421 | `Loader`, `Table`, `Entry`; embedded defaults + atomic swap + mtime reload |
-| `pricing/pricing_unix.go` | 69 | `O_NOFOLLOW` + fstat-from-FD + 1 MiB cap |
-| `pricing/pricing_other.go` | 21 | Stub returning "not supported on this platform" |
-| `pricing/pricing_test.go` | 432 | 21 tests — symlink rejection, reload race, path traversal, oversize |
-| `pricing/defaults_pricing.yaml` | 85 | go:embed source of truth |
-| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream + pricing starter |
+| `pricing/pricing.go` | 234 | `Table`, `Entry`, `EntryJSON`, `Costs`; `NewTable`/`NewEntries` validation + `EntryCosts` formula. No I/O, no reload, no embedded rates |
+| `pricing/pricing_test.go` | 177 | 10 tests — provider-shape formulas, cached clamp, rate fallback, nil-safety, rate validation |
+| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream |
 
 ## Request body → parser dispatch
 
@@ -188,9 +186,11 @@ response leg, covering both Bedrock body shapes:
   `totalTokens`). `firstNonZero` folds the two naming conventions into one
   `Usage`; when Converse omits `totalTokens` the parser sums the buckets.
 
-`ProviderName()` returns `"bedrock"` — its own `defaults_pricing.yaml` block,
-keyed by the **normalised** model id (region prefix + version suffix stripped by
-the request parser). `ParseResponse` returns `ErrStreamingUnsupported` for an
+`ProviderName()` returns `"bedrock"` — its own pricing surface in the table
+management ships, keyed by the **normalised** model id (region prefix + version
+suffix stripped by the request parser; management normalises its keys the same
+way at synth time so the two compare equal). `ParseResponse` returns
+`ErrStreamingUnsupported` for an
 AWS binary event-stream content-type (`application/vnd.amazon.eventstream`,
 `isAWSEventStream`) so the caller routes to the streaming accumulator instead.
 
@@ -205,11 +205,34 @@ response body. Streaming accumulators live in the middleware package
 ([llm_response_parser/streaming.go](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go))
 but use `llm.NewScanner` so the framing contract stays here.
 
-### Pricing catalog
+### Pricing table
 
-`Table.Cost`
-([pricing.go:129–174](../../../proxy/internal/llm/pricing/pricing.go))
-is the cost formula — most security-relevant math in this module:
+**Management is the sole pricing authority.** The proxy carries no embedded
+price list and reads no pricing file: the whole table arrives inside
+`cost_meter`'s `ConfigJSON` on the ordinary mapping push, and a price change
+is just another push — the chain rebuild constructs a fresh `Table`, so there
+is nothing to reload
+([pricing.go:1–7](../../../proxy/internal/llm/pricing/pricing.go)). The
+management side of the contract (catalog defaults, the operator's stored
+per-provider prices, and `AgentNetwork.PricingDefaultsFile`) is covered in the
+management-side module guide; `cost_meter`'s wire shape is in
+[31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md).
+
+`EntryJSON`
+([pricing.go:36–45](../../../proxy/internal/llm/pricing/pricing.go)) is the
+management→proxy contract — five USD-per-1k rates under `input_per_1k`,
+`output_per_1k`, `cached_input_per_1k`, `cache_read_per_1k`,
+`cache_creation_per_1k`. Management's `pricing.Entry` marshals the identical
+names, and `EntryJSON`/`Entry` are field-identical so `NewEntries` converts by
+direct struct conversion rather than field-by-field copying (a new rate can't
+be silently dropped in transit).
+
+`EntryCosts`
+([pricing.go:183–234](../../../proxy/internal/llm/pricing/pricing.go))
+is the cost formula — most security-relevant math in this module. The
+**surface** (the `llm.provider` value the request parser stamped) selects the
+formula, never the tier the entry came from: a per-provider-record override on
+an Anthropic route still bills its cache buckets additively.
 
 | Provider | Formula |
 |---|---|
@@ -218,7 +241,7 @@ is the cost formula — most security-relevant math in this module:
 | default | `inTokens × InputPer1K + outTokens × OutputPer1K` |
 
 `bedrock` shares the Anthropic additive-cache formula
-([pricing.go:172-174](../../../proxy/internal/llm/pricing/pricing.go)):
+([pricing.go:214–229](../../../proxy/internal/llm/pricing/pricing.go)):
 Anthropic-on-Bedrock reports the same additive cache buckets, while non-Anthropic
 Bedrock models (Nova, Llama) simply report zero in those buckets so cost reduces
 to `input + output`.
@@ -226,15 +249,12 @@ to `input + output`.
 Each per-bucket rate falls back to `InputPer1K` when zero — operators opt in
 to discounts by setting the field.
 
-`Loader`
-([pricing.go:212–268](../../../proxy/internal/llm/pricing/pricing.go))
-overlays an optional `pricing.yaml` from data-dir on top of the go:embed
-defaults. Atomic pointer swap means readers never observe a partial update.
-The mtime-poll reloader (30s default cadence) keeps the previous table on
-parse failure so cost annotation never goes blank during a botched edit.
-
-`defaults_pricing.yaml` is the source of truth for built-in pricing.
-Operator overrides only carry the entries they want to change.
+`Costs`
+([pricing.go:143–163](../../../proxy/internal/llm/pricing/pricing.go)) is the
+per-request split. The four per-bucket fields are the base; `TotalUSD` and
+`CacheUSD` are **derived** in `newCosts` so the aggregates can never drift from
+the breakdown. `InputUSD` is always the non-cached input bucket on both
+provider shapes, so input and cached-input never double-count.
 
 ## Public contracts
 
@@ -264,29 +284,38 @@ Order matters: `DetectFromURL` ties resolve by registration order.
 `ProviderBedrock = 3`. Numeric values are persisted in nothing today but treat
 them as wire-stable — new providers must take fresh numbers.
 
-**`Pricing` lookup**
-([pricing.go:129](../../../proxy/internal/llm/pricing/pricing.go)):
+**`Pricing` construction + lookup**
+([pricing.go:60–130](../../../proxy/internal/llm/pricing/pricing.go)):
 
 ```go
+func NewEntries(raw map[string]map[string]EntryJSON) (map[string]map[string]Entry, error)
+func NewTable(raw map[string]map[string]EntryJSON) (*Table, error)
+
+func (t *Table) Lookup(provider, model string) (Entry, bool)
 func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool)
+func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool)
+func EntryCosts(entry Entry, surface string, inTokens, outTokens, cachedInput, cacheCreation int64) Costs
 ```
 
-Nil-safe: `t.Cost` on a nil receiver returns `(0, false)`
-([pricing.go:130–132](../../../proxy/internal/llm/pricing/pricing.go)).
-`ok=false` means provider or model is absent from the loaded table; the caller
-emits `cost.skipped=unknown_model`.
+`NewTable` is the surface-keyed defaults table; `NewEntries` returns the raw
+two-level map `cost_meter` uses for the per-provider-record tier (it looks up an
+`Entry` directly and calls `EntryCosts`, so it needs no `Table` wrapper). Both
+reject any non-finite or negative rate, so a corrupt config fails the chain
+build rather than mispricing silently. Nil input yields an empty,
+never-matching table.
+
+Nil-safe: `t.Cost`/`t.Lookup` on a nil receiver returns `ok=false`
+([pricing.go:96–99](../../../proxy/internal/llm/pricing/pricing.go)).
+`ok=false` means the surface or model is absent from the table management sent;
+the caller emits `cost.skipped=unknown_model`.
 
 ## Invariants
 
-1. **Cross-platform pricing build.** `pricing_unix.go` carries the only
-   functional `loadPricing` (uses `syscall.O_NOFOLLOW` and `f.Stat()` on an
-   open descriptor — both Unix-only). `pricing_other.go` is a build-tag
-   fallback that returns `"not supported on this platform"`
-   ([pricing_other.go:14–16](../../../proxy/internal/llm/pricing/pricing_other.go)).
-   The proxy is Linux-only in production today; a Windows port needs an
-   equivalent path-as-handle implementation. Reviewers building on Windows
-   should expect this surface to return an error at startup if an override
-   file is configured.
+1. **The pricing package is pure and platform-independent.** No file I/O, no
+   `//go:embed`, no goroutines, no build tags — the rates arrive as config, so
+   there is nothing platform-specific left to port. Anything reintroducing a
+   read-from-disk path here re-splits pricing authority between management and
+   the proxy, which is exactly what this design removed.
 
 2. **SSE scanner handles partial chunks.** A buffered prefix that doesn't end
    in `\n\n` still yields its accumulated event before `io.EOF`
@@ -298,38 +327,45 @@ emits `cost.skipped=unknown_model`.
    usage rather than aborting
    ([streaming.go:68–73, 144–150](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go)).
 
-3. **`defaults_pricing.yaml` is the source of truth.** Compiled into the
-   binary via `//go:embed`
-   ([pricing.go:29–30](../../../proxy/internal/llm/pricing/pricing.go)).
-   `DefaultTable()` parses once and panics on parse failure
-   ([pricing.go:42–49](../../../proxy/internal/llm/pricing/pricing.go))
-   — by design: a broken embedded YAML must not ship to production.
+3. **Management is the only source of rates.** `Table` has no constructor that
+   invents prices: the only way in is `NewTable`/`NewEntries` over the wire map
+   management sent. A missing or empty `pricing` block therefore means *no
+   prices at all* (`cost_meter` records `cost.skipped=unknown_model`, $0) —
+   never a stale built-in fallback that would silently bill list price.
 
-4. **Loader path validation.** `resolveMiddlewareDataPath`
-   ([pricing.go:370–394](../../../proxy/internal/llm/pricing/pricing.go))
-   rejects absolute paths, traversal segments, and basenames that fail
-   `basenameRegex = ^[a-zA-Z0-9._-]+$`. The resolved path must remain
-   inside `baseDir` even after `filepath.Clean`. Tests:
-   `TestNewLoader_PathValidation`, `TestNewLoader_PathValidation_Extended`,
-   `TestNewLoader_SymlinkOutsideBaseDirRejected`, `TestNewLoader_SymlinkRejected`.
+4. **Tables are immutable once built.** `Table.entries` is written only in
+   `NewEntries` and never mutated afterwards, and `cost_meter`'s `perRecord`
+   map is likewise build-time-only
+   ([pricing.go:47–52](../../../proxy/internal/llm/pricing/pricing.go)). This
+   is what makes the no-reload design safe: a price change arrives as a mapping
+   push that builds a new middleware instance over a new table, so concurrent
+   readers can't observe a half-updated price list and no atomic swap or lock
+   is needed on the hot path.
 
-5. **Unix loader symlink safety.** `O_NOFOLLOW` on open, `f.Stat()` on the
-   open descriptor (never re-stat by path), `info.Mode().IsRegular()` check,
-   `io.LimitReader(f, maxPricingBytes+1)` with a final size assertion
-   ([pricing_unix.go:25–57](../../../proxy/internal/llm/pricing/pricing_unix.go)).
-   A mid-read symlink swap is detected because the fstat is on the original
-   fd. Test: `TestNewLoader_RejectsOversizedFile_FixesM4`.
+5. **Rate validation happens at chain-build time, not per request.**
+   `NewEntries` rejects negative, NaN, and ±Inf rates field by field
+   ([pricing.go:60–83](../../../proxy/internal/llm/pricing/pricing.go)), naming
+   the offending surface/model/field in the error. Management enforces the same
+   constraints at its API boundary and in its YAML parser, so this is
+   defense-in-depth — but it means a corrupt push fails loudly at build instead
+   of producing negative costs on live traffic. Test:
+   `TestNewTable_ValidatesRates`.
 
-6. **`yaml.NewDecoder(...).KnownFields(true)`**
-   ([pricing.go:397–398](../../../proxy/internal/llm/pricing/pricing.go))
-   rejects YAML files that carry fields not in the schema. A typo in an
-   operator override file fails loud instead of silently zeroing rates.
+6. **New rates must be added to `Entry`, `EntryJSON`, *and* management's
+   `pricing.Entry` together.** `NewEntries` converts by direct struct
+   conversion `Entry(e)`
+   ([pricing.go:76–78](../../../proxy/internal/llm/pricing/pricing.go)), which
+   only compiles while the two structs stay field-identical — so the proxy half
+   is compiler-enforced. The management half is not: a rate added there but not
+   here unmarshals into nothing and prices that bucket at `InputPer1K`.
 
 ## Things to scrutinise
 
-**Correctness.** Verify OpenAI cached-prompt clamp at
-[pricing.go:147–149](../../../proxy/internal/llm/pricing/pricing.go)
-short-circuits before subtraction. `Anthropic.TotalTokens` sums all four
+**Correctness.** Verify the OpenAI cached-prompt clamp at
+[pricing.go:203–206](../../../proxy/internal/llm/pricing/pricing.go)
+short-circuits before subtraction. Negative token counts are clamped to zero up
+front ([pricing.go:186–197](../../../proxy/internal/llm/pricing/pricing.go)) so
+no formula can yield a negative cost. `Anthropic.TotalTokens` sums all four
 buckets (in + out + cache_read + cache_creation) — downstream dashboards
 need to know this differs from `input + output`.
 `OpenAIParser.ExtractPrompt` falls through `messages → input → prompt`; a
@@ -338,22 +374,27 @@ noting).
 
 **Security.** `Scanner.maxLine = 1 MiB`; a 2 MiB single-line `data:` event
 errors from `Scanner.Next` and both accumulators stop with partial usage.
-Pricing file 1 MiB cap is orders of magnitude larger than realistic. Confirm
-new schema additions are mirrored in both `pricingFile` and `Entry`;
-`KnownFields(true)` will reject silently-typo'd operator overrides
-otherwise.
+Pricing is no longer file-backed, so the loader's path-traversal / symlink /
+oversize surface is gone entirely — the config channel (an authenticated
+mapping push from management) is now the only way rates enter the proxy, and
+`NewEntries` is the validation boundary on it. A new rate added to management's
+`pricing.Entry` but not to `EntryJSON` here is the remaining silent-mispricing
+path (see invariant 6).
 
-**Concurrency.** `Loader.table` is `atomic.Pointer[Table]`; readers never
-block or see a torn table. `Loader.Reload` is one goroutine, cancelled via
-context (`TestLoader_ReloadBackgroundLoopCancellation`). `DefaultTable()`
-uses `sync.Once`. Per-call `Scanner` instances mean no shared state across
-concurrent response-parser calls.
+**Concurrency.** Nothing in this package is shared mutable state: tables are
+built once and never written again, so `cost_meter`'s hot path is lock-free by
+construction rather than by atomic swap. Per-call `Scanner` instances mean no
+shared state across concurrent response-parser calls.
 
-**Perf.** `Table.Cost` is two map lookups + multiplications, O(1).
-`Scanner.Next` is one `ReadString('\n')` per line. Pricing reload poll 30s.
+**Perf.** `Table.Cost` is two map lookups + multiplications, O(1); the
+per-provider-record tier adds at most one more lookup. `Scanner.Next` is one
+`ReadString('\n')` per line. No background goroutines and no per-request
+allocation of pricing state.
 
-**Observability.** Reload failures count via `metric.Int64Counter` keyed
-`plugin`; warning log rate-limited at 5 min so a broken file doesn't flood.
+**Observability.** A config carrying no `pricing` block logs one warning at
+chain-build time (`cost_meter` factory) and then records
+`cost.skipped=unknown_model` per request, so an old-management deployment is
+visible in both logs and the access log rather than quietly reporting $0.
 Parser errors return sentinels — middleware uses `errors.Is` to map to the
 right `cost.skipped` reason.
 
@@ -365,7 +406,7 @@ right `cost.skipped` reason.
 | `openai_test.go` | 11 | Chat Completions + Responses API + legacy `prompt`; cached-tokens subset for both naming conventions; fixture replays |
 | `anthropic_test.go` | 7 | Messages + legacy `/v1/complete`; streaming REJECTED on `ParseResponse` (must use scanner); fixture replays |
 | `sse_test.go` | 12 | Fixture replay both providers; multiline `data:`; CRLF; comment skip; trailing-event-without-blank-line; oversize rejection |
-| `pricing/pricing_test.go` | 21 | Provider-shape switch; cached-rate fallback; cached-clamp; symlink rejection (target outside basedir + symlink to file); path validation matrix; oversize rejection; reload-keeps-previous-on-parse-error; mtime change detection; goroutine cancellation |
+| `pricing/pricing_test.go` | 10 | Provider-shape switch (surface selects the formula); cached-rate + cache-read/creation fallback to `InputPer1K`; cached-clamp; negative-token clamp; nil-receiver safety; rate validation (negative / NaN / Inf rejected); nil + empty table |
 
 **Fixtures** ([proxy/internal/llm/fixtures/](../../../proxy/internal/llm/fixtures/)):
 `openai_chat_completion.json` (chat.completions with usage),
@@ -373,14 +414,15 @@ right `cost.skipped` reason.
 `openai_stream.txt` (3 deltas + usage + `[DONE]`),
 `anthropic_messages.json` (Messages API non-streaming),
 `anthropic_stream.txt` (full 7-event sequence: message_start →
-content_block_{start,delta×2,stop} → message_delta (usage) → message_stop),
-`pricing.yaml` (realistic-pricing starter for operator overrides).
+content_block_{start,delta×2,stop} → message_delta (usage) → message_stop).
+No pricing fixture: the table is config-delivered, so pricing tests construct
+it in-process from a wire-shape map.
 
 ## Cross-references
 
 - Sibling: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
   — the chain that calls `llm.Parsers()`, `llm.ParserByName`,
-  `llm.NewScanner`, `pricing.NewLoader`.
+  `llm.NewScanner`, `pricing.NewTable` / `pricing.NewEntries`.
 - Path-routed providers (Vertex AI + Bedrock), credential syntax, and the
   Bedrock AWS event-stream accumulator:
   [50-path-routed-providers.md](./50-path-routed-providers.md).
diff --git a/docs/agent-networks/modules/33-proxy-runtime.md b/docs/agent-networks/modules/33-proxy-runtime.md
index f553473f8..54046b614 100644
--- a/docs/agent-networks/modules/33-proxy-runtime.md
+++ b/docs/agent-networks/modules/33-proxy-runtime.md
@@ -1,7 +1,7 @@
 # proxy/runtime — translate + serve + log
 
 > **Risk level:** High — every config push from management is translated here, and the chain runs on every HTTP request to a synth target.
-> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareDataDir`, `MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path.
+> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path. Middleware config is entirely wire-delivered — no proxy-side data dir is involved, including for LLM pricing, which management ships inside `cost_meter`'s config.
 
 ## Module boundary
 
@@ -114,8 +114,7 @@ At **request time** the access-log middleware stamps `CapturedData`; the auth ch
 
 ## Public contracts touched
 
-- `proxy.Server.MiddlewareDataDir` (string) — base dir for file-backed middleware config (server.go:238-241).
-- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:248-250).
+- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:249-253). There is no `MiddlewareDataDir`: no built-in middleware reads config from disk, so `builtin.FactoryContext` carries only the proxy-lifetime context, meter, logger, and management client.
 - `proxy/internal/proxy.WithMiddlewareManager(*middleware.Manager) Option` — new option on `NewReverseProxy`; nil keeps the fast path (reverseproxy.go:48-56).
 - `proxy/internal/proxy.PathTarget` adds `Middlewares`, `CaptureConfig`, `AgentNetwork`, `DisableAccessLog` (servicemapping.go:27-51), all zero-default.
 - `proxy/internal/proxy.CapturedData` adds `agentNetwork`, `suppressAccessLog`, `userGroupNames` behind `sync.RWMutex`; slices deep-copied (context.go:47-66, 183-258).
diff --git a/docs/agent-networks/modules/50-path-routed-providers.md b/docs/agent-networks/modules/50-path-routed-providers.md
index b7cda3a97..08c976c5f 100644
--- a/docs/agent-networks/modules/50-path-routed-providers.md
+++ b/docs/agent-networks/modules/50-path-routed-providers.md
@@ -87,9 +87,9 @@ strips the `@version` suffix from the model, and maps the publisher to a parser
 surface via `vertexPublisherVendor`:
 
 - `anthropic` → `llm.provider="anthropic"` → metered through the Anthropic
-  parser, priced under the **`anthropic`** block in `defaults_pricing.yaml`
-  (the parser emits the standard Anthropic provider label, so Vertex Claude
-  reuses first-party Anthropic prices).
+  parser, priced under the **`anthropic`** surface of the pricing table
+  management ships (the parser emits the standard Anthropic provider label, so
+  Vertex Claude reuses first-party Anthropic prices).
 - `openai` → `llm.provider="openai"` (reserved; not in the catalog lineup
   today).
 - anything else (notably `google` / Gemini) → empty vendor → **no parser**.
@@ -104,8 +104,9 @@ is omitted from the catalog.
 
 > Caveat: cross-region inference profiles in `eu` / `apac` carry a ~10% price
 > premium that the base per-token rates do **not** model — cost annotations for
-> those regions read low. Operators who need exact regional billing override
-> the affected entries in `pricing.yaml`.
+> those regions read low. Operators who need exact regional billing set the
+> affected models' prices on the provider record, or replace the default entries
+> via management's `AgentNetwork.PricingDefaultsFile`.
 
 ## AWS Bedrock (`bedrock_api`)
 
@@ -211,15 +212,19 @@ so a model-listing call can't be rewritten onto an upstream that would 404 it.
 ## Catalog ↔ pricing cross-check
 
 Catalog prices and context windows are cross-checked against LiteLLM's
-`model_prices_and_context_window.json`. The proxy's embedded
-`defaults_pricing.yaml` covers **every metered first-party model** the catalog
-enumerates — guarded by
-`TestDefaultTable_FirstPartyModelCoverage`
-([pricing/defaults_coverage_test.go](../../../proxy/internal/llm/pricing/defaults_coverage_test.go)),
-which fails if a catalog model has no embedded price. Bedrock entries are keyed
-by the **normalised** id the request parser emits (region prefix + version
-suffix stripped). Vertex Claude carries no Bedrock-style prefix, so it prices
-straight off the `anthropic` block.
+`model_prices_and_context_window.json`. The **catalog is the source of default
+prices**: management's `pricing.DefaultTable` folds every catalog provider's
+models into the surfaces that provider declares (`PricingSurfaces`), so coverage
+is structural rather than maintained in a parallel file
+([pricing/defaults.go](../../../management/internals/modules/agentnetwork/pricing/defaults.go)).
+`TestDefaultTable_CoversEveryCatalogModel` fails if a catalog model ends up
+unpriced, and `TestDefaultTable_NoConflictingContributions` fails if two
+providers contribute the same (surface, model) at different rates. Bedrock
+entries are keyed by the **normalised** id the request parser emits (region
+prefix + version suffix stripped) — management applies the same normalisation to
+per-provider prices at synth time, so the two keys compare equal. Vertex Claude
+carries no Bedrock-style prefix, so it prices straight off the `anthropic`
+surface.
 
 ## Things to scrutinise
 
@@ -232,16 +237,17 @@ operator-misconfigured Vertex provider and unmetered Gemini traffic; verify
 publishers).
 
 **Correctness.** `normalizeBedrockModel` is the join between the wire id and the
-pricing key — a model that normalises to something not in `defaults_pricing.yaml`
-meters at `cost.skipped=unknown_model` rather than failing the request. The
+pricing key — a model that normalises to something absent from the shipped
+pricing table meters at `cost.skipped=unknown_model` rather than failing the
+request. The
 `/bedrock` prefix strip must run on both the parser side (so the model is
 extracted) and the router side (so the upstream path is native); a regression in
 either silently breaks the other.
 
 **Metering caveats.** eu/apac cross-region Bedrock + Vertex profiles carry a
-~10% premium not modelled by base pricing — flagged in both the catalog comment
-and `defaults_pricing.yaml`. Operators needing exact regional billing override
-the relevant entries.
+~10% premium not modelled by base pricing — flagged in the catalog comment.
+Operators needing exact regional billing set per-provider prices on the model
+rows (or replace the default entries via `AgentNetwork.PricingDefaultsFile`).
 
 ## Cross-references
 
diff --git a/docs/custom-domain-validation.md b/docs/custom-domain-validation.md
new file mode 100644
index 000000000..4b0f95ae3
--- /dev/null
+++ b/docs/custom-domain-validation.md
@@ -0,0 +1,33 @@
+A new custom domain name is converted to lowercase ASCII (punycode), with a
+trailing dot removed, before availability and DNS validation checks. Invalid
+names and wildcard registrations are rejected before storage.
+
+A custom domain registration must complete validation within 48 hours of
+creation. Retrying validation does not extend this window. Once validation
+succeeds, the registration is exempt from this expiration policy.
+
+Management removes expired, unvalidated registrations at startup and every
+60 minutes. While management is running, removal normally occurs between
+48 and 49 hours after registration. Validation is refused after the 48-hour
+deadline even if cleanup has not yet removed the registration.
+
+Removal releases the name for a new registration. The new registration must
+complete its own validation. Its account does not inherit validation or
+services from the expired registration.
+
+The original account receives a system activity event named
+`CustomDomainValidationExpired`, displayed as "Unvalidated domain registration
+expired". The event includes the domain name, original registration ID, and
+validation deadline.
+
+On upgrade, existing unvalidated registrations receive a 48-hour validation
+window. Restarting management does not extend a previously assigned deadline.
+
+Registrations with existing services, including services using subdomains, are
+retained for operator review. Management logs their account and domain IDs so
+an operator can identify and resolve those dependencies before cleanup.
+
+Manual deletion is also refused while any service uses the domain or a subdomain,
+including disabled services. Delete those services or move them to another domain
+before removing the registration. A refused deletion returns HTTP 412 and leaves
+the domain and its services unchanged; no deletion activity event is recorded.
diff --git a/docs/io.netbird.client.plist b/docs/io.netbird.client.plist
index f42b6b3d2..eec96d35b 100644
--- a/docs/io.netbird.client.plist
+++ b/docs/io.netbird.client.plist
@@ -66,6 +66,9 @@
     <key>disableAutoConnect</key>
     <false/>
 
+    <key>disableAutostart</key>
+    <false/>
+
     <key>disableClientRoutes</key>
     <false/>
 
@@ -82,6 +85,21 @@
     <false/>
     -->
 
+    <!-- ===== Remote jobs (debug bundles) =====
+         allowRemoteJobs      : opt this device into management-requested
+                                remote jobs (e.g. debug bundles). Off by
+                                default; enabling is a privileged change.
+         debugBundleUploadURL : override the debug-bundle upload service URL
+                                for remote jobs (https URL with a host). Takes
+                                precedence over the management-supplied value. -->
+    <!--
+    <key>allowRemoteJobs</key>
+    <true/>
+
+    <key>debugBundleUploadURL</key>
+    <string>https://upload.example.com</string>
+    -->
+
     <!-- ===== WireGuard UDP port =====
          Range 1-65535. Omit to keep the daemon default. -->
     <!--
@@ -96,6 +114,10 @@
          disableProfiles         : hide the profile menu, reject profile CRUD.
          disableNetworks         : hide the Networks / Exit Node menus,
                                    reject the related RPCs.
+         disableAdvancedView     : hide the advanced-view section of the new
+                                   UI. Tristate at the daemon: set to true to
+                                   hide, false to explicitly show, omit the
+                                   key to let the UI apply its own default.
          disableMetricsCollection: opt out of anonymous usage telemetry. -->
     <!--
     <key>disableUpdateSettings</key>
@@ -107,6 +129,9 @@
     <key>disableNetworks</key>
     <true/>
 
+    <key>disableAdvancedView</key>
+    <true/>
+
     <key>disableMetricsCollection</key>
     <false/>
     -->
diff --git a/docs/netbird-macos.mobileconfig b/docs/netbird-macos.mobileconfig
index 53453db5c..5d886c283 100644
--- a/docs/netbird-macos.mobileconfig
+++ b/docs/netbird-macos.mobileconfig
@@ -103,6 +103,8 @@
                                 <!--
                                 <key>disableAutoConnect</key>
                                 <false/>
+                                <key>disableAutostart</key>
+                                <false/>
                                 <key>disableClientRoutes</key>
                                 <false/>
                                 <key>disableServerRoutes</key>
@@ -119,6 +121,19 @@
                                 <false/>
                                 -->
 
+                                <!-- ===== Remote jobs (debug bundles) =====
+                                     allowRemoteJobs      : opt into management-requested
+                                                            remote jobs. Off by default.
+                                     debugBundleUploadURL : override the debug-bundle upload
+                                                            service (https URL with a host);
+                                                            precedence over the management value. -->
+                                <!--
+                                <key>allowRemoteJobs</key>
+                                <true/>
+                                <key>debugBundleUploadURL</key>
+                                <string>https://upload.example.com</string>
+                                -->
+
                                 <!-- ===== WireGuard UDP port (int) =====
                                      Range 1-65535. Omit to keep the default. -->
                                 <!--
@@ -144,6 +159,8 @@
                                 <true/>
                                 <key>disableNetworks</key>
                                 <true/>
+                                <key>disableAdvancedView</key>
+                                <true/>
                                 <key>disableMetricsCollection</key>
                                 <false/>
                                 -->
diff --git a/docs/netbird-macos.sh b/docs/netbird-macos.sh
index a2f5ff5e8..3d57c557c 100644
--- a/docs/netbird-macos.sh
+++ b/docs/netbird-macos.sh
@@ -36,7 +36,9 @@
 # IDEMPOTENCY: re-running with the same values is a no-op from the
 # daemon's point of view (the 1-minute reload ticker diff returns empty).
 #
-# SECURITY: PreSharedKey is redacted in this script's log output.
+# SECURITY: PreSharedKey (and any secret-bearing debugBundleUploadURL) is
+#   redacted in this script's log output, and the installed plist is 0600
+#   root:wheel so its values are not readable by local non-root users.
 
 set -euo pipefail
 
@@ -56,14 +58,18 @@ NULL='__UNSET__'
 managementURL='https://api.netbird.io:443'
 preSharedKey="$NULL"                       # secret; redacted in log
 allowServerSSH='true'
+allowRemoteJobs="$NULL"
+debugBundleUploadURL="$NULL"                # HTTPS URL with a host; overrides management
 blockInbound="$NULL"
 disableAutoConnect="$NULL"
+disableAutostart="$NULL"
 disableClientRoutes="$NULL"
 disableServerRoutes="$NULL"
 disableMetricsCollection="$NULL"
 disableUpdateSettings="$NULL"
 disableProfiles="$NULL"
 disableNetworks="$NULL"
+disableAdvancedView="$NULL"           # tristate at the daemon
 rosenpassEnabled="$NULL"
 rosenpassPermissive="$NULL"
 wireguardPort='51820'
@@ -105,21 +111,35 @@ end_plist() {
 EOF
 }
 
-# emit_string appends a plist `<key>`/`<string>` entry for the given key and value to "$PLIST_PATH.tmp", XML-escaping `&`, `<`, and `>`, and logs the assignment (masking the logged value as `********** (secret)` when the key is `preSharedKey`).
+# emit_string appends a plist `<key>`/`<string>` entry for the given key and value to "$PLIST_PATH.tmp", XML-escaping `&`, `<`, and `>`, and logs the assignment (masking the logged value as `********** (secret)` for secret keys — `preSharedKey` and `debugBundleUploadURL`, which can embed credentials or a signed query token).
 emit_string() {
   local key="$1" value="$2" log_value="$2"
   # Escape XML entities in the value
   local escaped
   escaped="$(printf '%s' "$value" | sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g')"
   printf '    <key>%s</key>\n    <string>%s</string>\n' "$key" "$escaped" >> "$PLIST_PATH.tmp"
-  if [[ "$key" == "preSharedKey" ]]; then
-    log_value='********** (secret)'
-  fi
+  case "$key" in
+    preSharedKey|debugBundleUploadURL) log_value='********** (secret)' ;;
+    *) ;;
+  esac
   log "set $key = $log_value"
 }
 
-# emit_bool writes a boolean plist entry for a given key into the temporary plist file.
-# emit_bool writes a boolean plist entry for a key when the provided value matches an accepted boolean token; logs an error and skips the key on invalid input.
+# is_bool returns success if the value is an accepted boolean token.
+is_bool() {
+  local value="$1"
+  case "$value" in
+    true|True|TRUE|1|yes|false|False|FALSE|0|no) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# emit_bool writes a boolean plist entry for a key when the provided value matches
+# an accepted boolean token; logs an error and skips the key on invalid input.
+# It returns success even on invalid input (like emit_int) so a single typo in one
+# boolean does not abort the whole policy push under `set -euo pipefail`. Callers
+# that must fail closed on an invalid value (e.g. allowRemoteJobs) validate with
+# is_bool before calling and substitute a safe default themselves.
 emit_bool() {
   local key="$1" value="$2"
   local xml_bool
@@ -143,23 +163,45 @@ emit_int() {
   log "set $key = $value"
 }
 
-# main builds the NetBird MDM plist from configured policy variables, validates and installs it to /Library/Managed Preferences/io.netbird.client.plist (root:wheel, 644) and optionally triggers the NetBird daemon to reload.
+# main builds the NetBird MDM plist from configured policy variables, validates and installs it to /Library/Managed Preferences/io.netbird.client.plist (root:wheel, 600 — the daemon reads it directly as root, so it need not be world-readable) and optionally triggers the NetBird daemon to reload.
 main() {
   log "applying NetBird MDM policy to $PLIST_PATH"
+  # Restrict the temp plist while it is being built: it carries the same
+  # secret-bearing values as the final file, which is installed 0600 below.
+  umask 077
   /bin/mkdir -p "$PLIST_DIR"
   start_plist
+  # Force 0600 on the temp file explicitly: start_plist writes it with a
+  # truncating redirect, which keeps an existing file's mode, so a leftover
+  # 0644 tmp from an interrupted run would not be tightened by umask alone.
+  # start_plist only wrote the header so far — the secret-bearing values are
+  # appended after this point.
+  /bin/chmod 600 "$PLIST_PATH.tmp"
 
   is_set "$managementURL"             && emit_string  managementURL             "$managementURL"
   is_set "$preSharedKey"              && emit_string  preSharedKey              "$preSharedKey"
   is_set "$allowServerSSH"            && emit_bool    allowServerSSH            "$allowServerSSH"
+  # Fail closed: an invalid allowRemoteJobs value must not drop the key and
+  # leave a conflicting local opt-in active — enforce the safe default (false).
+  if is_set "$allowRemoteJobs"; then
+    if is_bool "$allowRemoteJobs"; then
+      emit_bool allowRemoteJobs "$allowRemoteJobs"
+    else
+      log "invalid boolean for allowRemoteJobs: $allowRemoteJobs; enforcing safe default (false)"
+      emit_bool allowRemoteJobs false
+    fi
+  fi
+  is_set "$debugBundleUploadURL"      && emit_string  debugBundleUploadURL      "$debugBundleUploadURL"
   is_set "$blockInbound"              && emit_bool    blockInbound              "$blockInbound"
   is_set "$disableAutoConnect"        && emit_bool    disableAutoConnect        "$disableAutoConnect"
+  is_set "$disableAutostart"          && emit_bool    disableAutostart          "$disableAutostart"
   is_set "$disableClientRoutes"       && emit_bool    disableClientRoutes       "$disableClientRoutes"
   is_set "$disableServerRoutes"       && emit_bool    disableServerRoutes       "$disableServerRoutes"
   is_set "$disableMetricsCollection"  && emit_bool    disableMetricsCollection  "$disableMetricsCollection"
   is_set "$disableUpdateSettings"     && emit_bool    disableUpdateSettings     "$disableUpdateSettings"
   is_set "$disableProfiles"           && emit_bool    disableProfiles           "$disableProfiles"
   is_set "$disableNetworks"           && emit_bool    disableNetworks           "$disableNetworks"
+  is_set "$disableAdvancedView"       && emit_bool    disableAdvancedView       "$disableAdvancedView"
   is_set "$rosenpassEnabled"          && emit_bool    rosenpassEnabled          "$rosenpassEnabled"
   is_set "$rosenpassPermissive"       && emit_bool    rosenpassPermissive       "$rosenpassPermissive"
   is_set "$wireguardPort"             && emit_int     wireguardPort             "$wireguardPort"
@@ -177,7 +219,12 @@ main() {
 
   /bin/mv -f "$PLIST_PATH.tmp" "$PLIST_PATH"
   /usr/sbin/chown root:wheel "$PLIST_PATH"
-  /bin/chmod 644 "$PLIST_PATH"
+  # 0600, not 0644: the daemon's loader (client/mdm/policy_darwin.go) opens the
+  # plist directly as root, so it does not need to be world-readable. Restricting
+  # it keeps secret-bearing values (preSharedKey, a signed debugBundleUploadURL)
+  # from any local non-root user. The loader's only mode check refuses a
+  # world-writable file, which 0600 satisfies.
+  /bin/chmod 600 "$PLIST_PATH"
 
   log "policy installed; NetBird daemon will pick it up within the next 1-minute reload tick"
 
diff --git a/docs/netbird-policy.reg b/docs/netbird-policy.reg
index ba4402e50..d116e4c77 100644
Binary files a/docs/netbird-policy.reg and b/docs/netbird-policy.reg differ
diff --git a/docs/netbird.adml b/docs/netbird.adml
index d49b05022..05cfb71ad 100644
--- a/docs/netbird.adml
+++ b/docs/netbird.adml
@@ -24,6 +24,9 @@
       <string id="DisableAutoConnect_Name">Disable auto-connect</string>
       <string id="DisableAutoConnect_Help">When enabled, the NetBird tunnel does not auto-connect at daemon startup. Equivalent to --disable-auto-connect.</string>
 
+      <string id="DisableAutostart_Name">Disable autostart</string>
+      <string id="DisableAutostart_Help">When enabled, the NetBird GUI is prevented from registering itself as an OS autostart entry on fresh installs, and any existing OS autostart entry registration is removed on the next GUI launch (Windows Registry Run key, macOS Login Item, Linux .desktop). Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings.</string>
+
       <string id="DisableClientRoutes_Name">Disable client routes</string>
       <string id="DisableClientRoutes_Help">When enabled, this client will not consume routes advertised by routing peers. Equivalent to --disable-client-routes.</string>
 
@@ -36,6 +39,12 @@
       <string id="AllowServerSSH_Name">Allow server SSH</string>
       <string id="AllowServerSSH_Help">When enabled, this client accepts incoming SSH sessions via NetBird SSH. Equivalent to --allow-server-ssh.</string>
 
+      <string id="AllowRemoteJobs_Name">Allow remote jobs</string>
+      <string id="AllowRemoteJobs_Help">When enabled, this client accepts management-requested remote jobs (e.g. debug bundles). Off by default. Equivalent to --allow-remote-jobs.</string>
+
+      <string id="DebugBundleUploadURL_Name">Debug bundle upload URL</string>
+      <string id="DebugBundleUploadURL_Help">Overrides the upload service used for debug bundles produced by remote jobs, taking precedence over the value requested by management. Must be an https URL with a host.</string>
+
       <string id="RosenpassEnabled_Name">Enable Rosenpass</string>
       <string id="RosenpassEnabled_Help">Enables Rosenpass post-quantum key exchange on WireGuard tunnels. Both peers must support it.</string>
 
@@ -60,6 +69,9 @@
       <string id="DisableNetworks_Name">Disable networks</string>
       <string id="DisableNetworks_Help">When enabled, the client UI/CLI cannot list, select or deselect NetBird networks (the corresponding daemon RPCs return Unavailable). Equivalent to --disable-networks.</string>
 
+      <string id="DisableAdvancedView_Name">Disable advanced view</string>
+      <string id="DisableAdvancedView_Help">When enabled, the client UI hides the advanced-view section of the new UI revision. Tristate at the daemon: 1 (enabled) hides the section; 0 (disabled) explicitly shows it; not configured leaves the UI's default behavior in place. MDM is the sole source — no equivalent CLI flag exists.</string>
+
       <string id="DisableMetricsCollection_Name">Disable metrics collection</string>
       <string id="DisableMetricsCollection_Help">When enabled, the client does not collect or report local usage metrics.</string>
 
@@ -73,6 +85,12 @@
         </textBox>
       </presentation>
 
+      <presentation id="DebugBundleUploadURL_Pres">
+        <textBox refId="DebugBundleUploadURL_Text">
+          <label>Debug bundle upload URL:</label>
+        </textBox>
+      </presentation>
+
       <presentation id="PreSharedKey_Pres">
         <textBox refId="PreSharedKey_Text">
           <label>Pre-shared key:</label>
diff --git a/docs/netbird.admx b/docs/netbird.admx
index 2f7645d63..6a188cff1 100644
--- a/docs/netbird.admx
+++ b/docs/netbird.admx
@@ -64,6 +64,18 @@
       <disabledValue><decimal value="0" /></disabledValue>
     </policy>
 
+    <policy name="DisableAutostart"
+            class="Machine"
+            displayName="$(string.DisableAutostart_Name)"
+            explainText="$(string.DisableAutostart_Help)"
+            key="Software\Policies\NetBird"
+            valueName="DisableAutostart">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <enabledValue><decimal value="1" /></enabledValue>
+      <disabledValue><decimal value="0" /></disabledValue>
+    </policy>
+
     <policy name="DisableClientRoutes"
             class="Machine"
             displayName="$(string.DisableClientRoutes_Name)"
@@ -112,6 +124,31 @@
       <disabledValue><decimal value="0" /></disabledValue>
     </policy>
 
+    <policy name="AllowRemoteJobs"
+            class="Machine"
+            displayName="$(string.AllowRemoteJobs_Name)"
+            explainText="$(string.AllowRemoteJobs_Help)"
+            key="Software\Policies\NetBird"
+            valueName="AllowRemoteJobs">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <enabledValue><decimal value="1" /></enabledValue>
+      <disabledValue><decimal value="0" /></disabledValue>
+    </policy>
+
+    <policy name="DebugBundleUploadURL"
+            class="Machine"
+            displayName="$(string.DebugBundleUploadURL_Name)"
+            explainText="$(string.DebugBundleUploadURL_Help)"
+            key="Software\Policies\NetBird"
+            presentation="$(presentation.DebugBundleUploadURL_Pres)">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <elements>
+        <text id="DebugBundleUploadURL_Text" valueName="DebugBundleUploadURL" required="false" />
+      </elements>
+    </policy>
+
     <policy name="RosenpassEnabled"
             class="Machine"
             displayName="$(string.RosenpassEnabled_Name)"
@@ -207,6 +244,18 @@
       <disabledValue><decimal value="0" /></disabledValue>
     </policy>
 
+    <policy name="DisableAdvancedView"
+            class="Machine"
+            displayName="$(string.DisableAdvancedView_Name)"
+            explainText="$(string.DisableAdvancedView_Help)"
+            key="Software\Policies\NetBird"
+            valueName="DisableAdvancedView">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <enabledValue><decimal value="1" /></enabledValue>
+      <disabledValue><decimal value="0" /></disabledValue>
+    </policy>
+
     <policy name="DisableMetricsCollection"
             class="Machine"
             displayName="$(string.DisableMetricsCollection_Name)"
diff --git a/docs/testing-privileged.md b/docs/testing-privileged.md
index cf2f23171..939770de9 100644
--- a/docs/testing-privileged.md
+++ b/docs/testing-privileged.md
@@ -1,7 +1,7 @@
 # Privileged tests
 
 Some tests in this repo need `root` or mutate host network state: they create
-TUN/WireGuard interfaces, open netlink/raw sockets, run eBPF programs, or shell
+TUN/WireGuard interfaces, open netlink/raw sockets, or shell
 out to `ip`/`iptables`/`nft`/`ifconfig`/`route`. Running them on a developer
 machine would require `sudo` and could leave stray interfaces or routes behind.
 
@@ -32,7 +32,7 @@ list; both are optional and default to the full privileged suite.
 
 1. Skips immediately when it detects it is already inside the container
    (`DOCKER_CI=true`), so the privileged tests run in place instead of recursing.
-2. Otherwise spins up a `golang:1.25-alpine` container (matching CI),
+2. Otherwise spins up a `golang:1.26.7-alpine` container (matching CI),
    bind-mounts the repo and the host Go build/module caches, installs the
    required packages, and runs `go test -tags 'devcert privileged'` over the
    client packages.
@@ -44,7 +44,6 @@ A test is privileged if it does any of:
 
 - creates a real interface via `iface.NewWGIFace(...).Create()`,
 - opens a netlink or raw socket that hard-fails without `CAP_NET_ADMIN`,
-- runs an eBPF program (`ebpf.*.Listen()`),
 - shells out to `ip`, `iptables`, `nft`, `ifconfig`, or `route` to change state.
 
 Add the tag to the **top** of the file, combined with any existing platform
diff --git a/e2e/agentnetwork/account_delete_test.go b/e2e/agentnetwork/account_delete_test.go
new file mode 100644
index 000000000..a8b52766f
--- /dev/null
+++ b/e2e/agentnetwork/account_delete_test.go
@@ -0,0 +1,292 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// accountDeleteModel is a made-up model id the provider enumerates and prices,
+// so the chat routes to the mock upstream and is metered deterministically.
+const accountDeleteModel = "e2e-account-delete-model"
+
+// agentNetworkConfigTables are deleted with the account, in its transaction.
+var agentNetworkConfigTables = []string{
+	"agent_network_settings",
+	"agent_network_providers",
+	"agent_network_policies",
+	"agent_network_guardrails",
+	"agent_network_budget_rules",
+}
+
+// TestAccountDelete_RemovesAgentNetworkState deletes an account that has a full
+// Agent Network setup and has served traffic, and checks what that leaves
+// behind, end to end:
+//
+//   - the proxy stops running the account's gateway, instead of keeping its
+//     mappings and provider API keys in memory until it next resyncs;
+//   - the configuration rows go with the account, while access logs and usage
+//     records stay for retention;
+//   - the account's consumption counters are swept once the cleanup runs;
+//   - the gateway domain is free for another account to claim.
+//
+// It runs on a dedicated server, since deleting the shared account would take
+// every other test down with it.
+func TestAccountDelete_RemovesAgentNetworkState(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	fresh, err := harnessStartFresh(ctx, t)
+	require.NoError(t, err, "start dedicated combined server")
+
+	accounts, err := fresh.API().Accounts.List(ctx)
+	require.NoError(t, err, "list accounts")
+	require.Len(t, accounts, 1, "a fresh server has exactly the bootstrapped account")
+	accountID := accounts[0].Id
+
+	cluster := harness.AgentNetworkCluster
+	settings, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{ProxyAddress: &cluster})
+	require.NoError(t, err, "bootstrap agent-network endpoint")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned at bootstrap")
+
+	env := provisionAccountDeleteEnv(t, ctx, fresh, settings.Endpoint)
+	chatThrough(t, ctx, env)
+
+	// Preconditions: the proxy runs the account's gateway, and the request left
+	// the traffic-driven rows the rest of the test expects to outlive the delete.
+	requireEventually(t, ctx, 60*time.Second, "proxy should run a client for the account", func() bool {
+		return proxyRunsAccount(t, ctx, env.proxy, accountID)
+	})
+	requireEventually(t, ctx, accessLogIngestWindow, "the request should leave consumption, usage and access-log rows", func() bool {
+		counts := accountRowCounts(t, fresh, accountID,
+			"agent_network_consumption", "agent_network_request_usage", "agent_network_access_log")
+		return counts["agent_network_consumption"] > 0 &&
+			counts["agent_network_request_usage"] > 0 &&
+			counts["agent_network_access_log"] > 0
+	})
+
+	require.NoError(t, fresh.API().Accounts.Delete(ctx, accountID), "delete account")
+
+	// The proxy is told to drop the gateway. A proxy that only learns on its
+	// next resync keeps serving the deleted account with its provider API keys.
+	if !eventually(ctx, 60*time.Second, func() bool { return proxyDroppedAccount(t, ctx, env.proxy, accountID) }) {
+		t.Errorf("proxy still runs a client for deleted account %s\n=== proxy logs ===\n%s",
+			accountID, env.proxy.Logs(context.Background()))
+	}
+
+	counts := accountRowCounts(t, fresh, accountID, append(slices.Clone(agentNetworkConfigTables),
+		"agent_network_request_usage", "agent_network_access_log")...)
+	for _, table := range agentNetworkConfigTables {
+		assert.Zero(t, counts[table], "%s rows should be deleted with the account", table)
+	}
+	assert.NotZero(t, counts["agent_network_request_usage"], "usage records should be kept")
+	assert.NotZero(t, counts["agent_network_access_log"], "access logs should be left for retention")
+
+	// The cleanup's first pass runs at startup, and whether instance setup is
+	// open again is only re-evaluated then.
+	require.NoError(t, fresh.Restart(ctx), "restart combined server")
+	requireEventually(t, ctx, 60*time.Second, "the cleanup should sweep the deleted account's consumption counters", func() bool {
+		return accountRowCounts(t, fresh, accountID, "agent_network_consumption")["agent_network_consumption"] == 0
+	})
+
+	// A new account can claim the deleted account's gateway domain: its
+	// settings row no longer holds the global unique index.
+	_, err = fresh.Bootstrap(ctx)
+	require.NoError(t, err, "bootstrap a second account once the first is gone")
+	claimed, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{Endpoint: &settings.Endpoint})
+	require.NoError(t, err, "a new account should be able to claim the deleted account's gateway domain")
+	assert.Equal(t, settings.Endpoint, claimed.Endpoint, "the new account should hold the released domain")
+}
+
+// accountDeleteEnv is a connected gateway for one account: a proxy running the
+// debug endpoint, a client peer, and the resolved endpoint.
+type accountDeleteEnv struct {
+	endpoint string
+	proxyIP  string
+	client   *harness.Client
+	proxy    *harness.Proxy
+}
+
+// provisionAccountDeleteEnv gives the server's account one of every Agent
+// Network configuration row (provider, guardrail, policy, budget rule; the
+// settings row is the caller's) and brings up a proxy and a client. The policy
+// and budget rule switch on usage metering, so a request records consumption.
+func provisionAccountDeleteEnv(t *testing.T, ctx context.Context, srv *harness.Combined, endpoint string) accountDeleteEnv {
+	t.Helper()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock vLLM upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-account-delete"})
+	require.NoError(t, err, "create group")
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-account-delete-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+
+	apiKey := "sk-account-delete-e2e"
+	models := []api.AgentNetworkProviderModel{{Id: accountDeleteModel, InputPer1k: 0.01, OutputPer1k: 0.02}}
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "account-delete",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &apiKey,
+		Enabled:     ptr(true),
+		Models:      &models,
+	})
+	require.NoError(t, err, "create provider")
+
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = "e2e-account-delete"
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = []string{accountDeleteModel}
+	guard, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail")
+
+	limits := api.AgentNetworkPolicyLimits{
+		TokenLimit: api.AgentNetworkPolicyTokenLimit{
+			Enabled:       true,
+			GroupCap:      10_000_000,
+			UserCap:       10_000_000,
+			WindowSeconds: 60,
+		},
+	}
+	_, err = srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-account-delete",
+		Enabled:                ptr(true),
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{guard.Id},
+		Limits:                 &limits,
+	})
+	require.NoError(t, err, "create policy")
+
+	_, err = srv.CreateBudgetRule(ctx, api.AgentNetworkBudgetRuleRequest{
+		Name:         "e2e-account-delete",
+		Limits:       limits,
+		TargetGroups: &[]string{grp.Id},
+	})
+	require.NoError(t, err, "create budget rule")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-account-delete-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken, map[string]string{"NB_PROXY_DEBUG_ENDPOINT": "true"})
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	proxyIP, err := cl.ResolveProxyIP(ctx, endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	return accountDeleteEnv{endpoint: endpoint, proxyIP: proxyIP, client: cl, proxy: px}
+}
+
+// chatThrough drives one chat through the gateway, retrying to absorb
+// first-call tunnel and DNS jitter.
+func chatThrough(t *testing.T, ctx context.Context, env accountDeleteEnv) {
+	t.Helper()
+	var code int
+	var body string
+	ok := eventually(ctx, 90*time.Second, func() bool {
+		c, b, err := env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireChat,
+			accountDeleteModel, "Reply with exactly: pong", "e2e-session-account-delete")
+		code, body = c, b
+		return err == nil && c == 200
+	})
+	require.True(t, ok, "chat must return 200, last got %d: %s\n=== proxy logs ===\n%s",
+		code, body, env.proxy.Logs(context.Background()))
+}
+
+// proxyRunsAccount reports whether a lookup succeeded and shows the proxy
+// running a client for the account.
+func proxyRunsAccount(t *testing.T, ctx context.Context, px *harness.Proxy, accountID string) bool {
+	t.Helper()
+	runs, ok := lookupProxyAccount(t, ctx, px, accountID)
+	return ok && runs
+}
+
+// proxyDroppedAccount reports whether a lookup succeeded and shows the proxy
+// no longer running a client for the account. A failed lookup confirms
+// nothing, so it keeps the caller polling rather than passing the check.
+func proxyDroppedAccount(t *testing.T, ctx context.Context, px *harness.Proxy, accountID string) bool {
+	t.Helper()
+	runs, ok := lookupProxyAccount(t, ctx, px, accountID)
+	return ok && !runs
+}
+
+// lookupProxyAccount asks the proxy whether it runs a client for the account;
+// ok is false when the lookup itself failed.
+func lookupProxyAccount(t *testing.T, ctx context.Context, px *harness.Proxy, accountID string) (runs, ok bool) {
+	t.Helper()
+	clients, err := px.DebugClients(ctx)
+	if err != nil {
+		t.Logf("proxy debug clients: %v", err)
+		return false, false
+	}
+	return slices.ContainsFunc(clients, func(c harness.ProxyDebugClient) bool { return c.AccountID == accountID }), true
+}
+
+// accountRowCounts counts the account's rows in each table, read from a
+// snapshot of the management store.
+func accountRowCounts(t *testing.T, srv *harness.Combined, accountID string, tables ...string) map[string]int64 {
+	t.Helper()
+	dbPath, err := srv.SnapshotStoreDB(t.TempDir())
+	require.NoError(t, err, "snapshot management sqlite store")
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
+	require.NoError(t, err, "open store snapshot")
+	sqlDB, err := db.DB()
+	require.NoError(t, err)
+	defer func() { _ = sqlDB.Close() }()
+
+	counts := make(map[string]int64, len(tables))
+	for _, table := range tables {
+		var n int64
+		require.NoError(t, db.Table(table).Where("account_id = ?", accountID).Count(&n).Error, "count %s rows", table)
+		counts[table] = n
+	}
+	return counts
+}
+
+// eventually polls cond every two seconds until it holds or timeout passes.
+func eventually(ctx context.Context, timeout time.Duration, cond func() bool) bool {
+	deadline := time.Now().Add(timeout)
+	for {
+		if cond() {
+			return true
+		}
+		if time.Now().After(deadline) || !waitBeforeRetry(ctx, 2*time.Second) {
+			return false
+		}
+	}
+}
+
+// requireEventually fails the test now if cond does not hold within timeout.
+func requireEventually(t *testing.T, ctx context.Context, timeout time.Duration, msg string, cond func() bool) {
+	t.Helper()
+	require.True(t, eventually(ctx, timeout, cond), msg)
+}
diff --git a/e2e/agentnetwork/agent_config_test.go b/e2e/agentnetwork/agent_config_test.go
new file mode 100644
index 000000000..89e7202e0
--- /dev/null
+++ b/e2e/agentnetwork/agent_config_test.go
@@ -0,0 +1,151 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// joinGroup places the PAT's own user into the group so caller-scoped answers
+// (GET /api/agent-network/agent-config) see the policies sourced from it, and
+// restores the previous auto-groups on cleanup. Self-service updates of one's
+// own auto_groups are permitted for every role, so this needs no second user.
+func joinGroup(t *testing.T, ctx context.Context, groupID string) {
+	t.Helper()
+	me, err := srv.API().Users.Current(ctx)
+	require.NoError(t, err, "read current user")
+	before := append([]string(nil), me.AutoGroups...)
+	_, err = srv.API().Users.Update(ctx, me.Id, api.PutApiUsersUserIdJSONRequestBody{
+		Role:       me.Role,
+		IsBlocked:  me.IsBlocked,
+		AutoGroups: append(append([]string(nil), before...), groupID),
+	})
+	require.NoError(t, err, "add the caller to the policy source group")
+	t.Cleanup(func() {
+		_, _ = srv.API().Users.Update(context.Background(), me.Id, api.PutApiUsersUserIdJSONRequestBody{
+			Role:       me.Role,
+			IsBlocked:  me.IsBlocked,
+			AutoGroups: before,
+		})
+	})
+}
+
+// configProvider returns the agent-config entry for the named provider, nil
+// when the answer does not offer it. The suite shares one account, so other
+// tests' fixtures may add unrelated providers to the caller's answer.
+func configProvider(cfg api.AgentNetworkAgentConfig, name string) *api.AgentNetworkAgentConfigProvider {
+	for i := range cfg.Providers {
+		if cfg.Providers[i].Name == name {
+			return &cfg.Providers[i]
+		}
+	}
+	return nil
+}
+
+// TestAgentConfigAllowlistOfDeclaredModels reproduces the post-#7221 field
+// report: a provider carrying a declared model set plus a policy guardrail
+// whose allowlist holds those same declared ids must advertise the models on
+// GET /api/agent-network/agent-config — the guardrail was built FROM the
+// provider's model list (the dashboard's allowlist picker persists the
+// declared ids verbatim), so nothing about the setup excludes them.
+//
+// The plain case passes today. The path-style case (Bedrock; Vertex has the
+// same shape) fails: the declared id is compared through the proxy parser's
+// canonical form (region prefix and version suffix stripped) while the
+// allowlist entry is not, so the raw-vs-raw pair never intersects and the
+// caller sees an empty model list. The same one-sided normalization sits in
+// policyPermitsModel, so the proxy also denies the model at request time —
+// the guardrail meant to allow exactly this model turns it off end to end.
+func TestAgentConfigAllowlistOfDeclaredModels(t *testing.T) {
+	ctx := context.Background()
+
+	// Saving a provider makes management verify the credential against the
+	// upstream, and a real vendor refuses the dummy key and the save with it.
+	// The providers point at the mock upstream instead: it resolves to a
+	// private address, which the check declines to dial and treats as
+	// unverifiable rather than as a failure, so the save goes through. The
+	// test is about the allowlist, not the upstream.
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	cases := []struct {
+		name      string
+		catalogID string
+		declared  string
+	}{
+		{
+			name:      "plain-declared-id",
+			catalogID: "openai_api",
+			declared:  "gpt-4o-mini",
+		},
+		{
+			// The operator declares the id AWS issues — region-prefixed
+			// inference profile with a version suffix — and the allowlist
+			// picker copies it as-is.
+			name:      "bedrock-declared-id",
+			catalogID: "bedrock_api",
+			declared:  "eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-agentcfg-" + tc.name})
+			require.NoError(t, err, "create source group")
+			t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+			joinGroup(t, ctx, grp.Id)
+
+			providerName := "e2e-agentcfg-" + tc.name
+			prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+				Name:        providerName,
+				ProviderId:  tc.catalogID,
+				UpstreamUrl: vllm.URL,
+				ApiKey:      ptr("sk-dummy-e2e-key"),
+				Enabled:     ptr(true),
+				Models:      &[]api.AgentNetworkProviderModel{{Id: tc.declared, InputPer1k: 0.001, OutputPer1k: 0.002}},
+			})
+			require.NoError(t, err, "create provider")
+			t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+			// Allowlist exactly the declared model, the way the dashboard
+			// builds a guardrail from the provider's model list.
+			var gr api.AgentNetworkGuardrailRequest
+			gr.Name = "e2e-agentcfg-" + tc.name
+			gr.Checks.ModelAllowlist.Enabled = true
+			gr.Checks.ModelAllowlist.Models = []string{tc.declared}
+			guard, err := srv.CreateGuardrail(ctx, gr)
+			require.NoError(t, err, "create guardrail")
+			t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
+
+			pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+				Name:                   "e2e-agentcfg-" + tc.name,
+				Enabled:                ptr(true),
+				SourceGroups:           []string{grp.Id},
+				DestinationProviderIds: []string{prov.Id},
+				GuardrailIds:           &[]string{guard.Id},
+			})
+			require.NoError(t, err, "create policy")
+			t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+			cfg, err := srv.GetAgentConfig(ctx)
+			require.NoError(t, err, "read the caller-scoped agent config")
+			require.True(t, cfg.Configured, "the account endpoint is bootstrapped by TestMain")
+
+			entry := configProvider(cfg, providerName)
+			require.NotNil(t, entry, "the policy authorizes the caller for the provider, so it must be offered")
+			assert.False(t, entry.AllModelsAllowed, "an allowlist guardrail restricts the provider")
+			assert.Equal(t, []string{tc.declared}, entry.Models,
+				"the allowlist holds the provider's own declared id, so that model must be advertised")
+		})
+	}
+}
diff --git a/e2e/agentnetwork/chat_test.go b/e2e/agentnetwork/chat_test.go
index 5e3a79273..792f67c89 100644
--- a/e2e/agentnetwork/chat_test.go
+++ b/e2e/agentnetwork/chat_test.go
@@ -9,25 +9,252 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
 
 	"github.com/netbirdio/netbird/e2e/harness"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
+// per1k is a model's published USD rates per 1k tokens. read is the prompt-cache read rate
+// (OpenAI: the cached-input discount rate); write is the cache-creation rate where one exists.
+type per1k struct{ in, out, read, write float64 }
+
+// publishedPer1k hardcodes the vendors' PUBLISHED rates for the models the live matrix can drive,
+// keyed by the normalized model id the proxy stamps. Deliberately independent of NetBird's own
+// default pricing table so a wrong default rate or a broken normalization fails the run.
+//
+// These rates are also what providerRequest registers as the operator's per-model prices. Since
+// management now ships operator prices to the cost meter as a per-provider-record table that is
+// consulted BEFORE the surface defaults, registering the published rate is what keeps this matrix
+// asserting vendor rates — and exercises the per-record path at the same time.
+var publishedPer1k = map[string]per1k{
+	"gpt-4o-mini":                 {0.00015, 0.0006, 0.000075, 0},
+	"gpt-4o":                      {0.0025, 0.01, 0.00125, 0},
+	"claude-haiku-4-5":            {0.001, 0.005, 0.0001, 0.00125},
+	"claude-sonnet-4-5":           {0.003, 0.015, 0.0003, 0.00375},
+	"claude-sonnet-4-6":           {0.003, 0.015, 0.0003, 0.00375},
+	"kimi-k3":                     {0.003, 0.015, 0.0003, 0.003}, // no published write rate: bills at the input rate
+	"anthropic.claude-haiku-4-5":  {0.001, 0.005, 0.0001, 0.00125},
+	"anthropic.claude-sonnet-4-5": {0.003, 0.015, 0.0003, 0.00375},
+	"anthropic.claude-sonnet-4-6": {0.003, 0.015, 0.0003, 0.00375},
+	// Gateway-prefixed ids (Vercel AI Gateway, OpenRouter). A gateway model is not in
+	// NetBird's default table, so before operator pricing it could only be recorded at
+	// cost 0. The operator names it and prices it — at the underlying vendor's published
+	// rate, which is what the gateway charges through — so these rows are now priced.
+	"openai/gpt-4o-mini": {0.00015, 0.0006, 0.000075, 0},
+	"openai/gpt-4o":      {0.0025, 0.01, 0.00125, 0},
+}
+
+// rawCostVerificationSQL is the operator-facing double-check, run straight against the management
+// sqlite store: recompute each usage row's expected total and cache cost from its own persisted
+// token buckets and hardcoded published rates. OpenAI counts cached tokens as a subset of input;
+// Anthropic-shape providers count cache buckets additively.
+//
+// The rate rows must stay in sync with publishedPer1k — they are the same vendor rates the matrix
+// registers as operator prices. The join is on model, so rows written by other tests in this
+// package (which price their own made-up model ids) are simply not covered here.
+const rawCostVerificationSQL = `
+WITH rates(model, in_rate, out_rate, read_rate, write_rate) AS (
+  VALUES
+    ('gpt-4o-mini',                 0.00015, 0.0006, 0.000075, 0.0),
+    ('gpt-4o',                      0.0025,  0.01,   0.00125,  0.0),
+    ('claude-haiku-4-5',            0.001,   0.005,  0.0001,   0.00125),
+    ('claude-sonnet-4-5',           0.003,   0.015,  0.0003,   0.00375),
+    ('claude-sonnet-4-6',           0.003,   0.015,  0.0003,   0.00375),
+    ('kimi-k3',                     0.003,   0.015,  0.0003,   0.003),
+    ('anthropic.claude-haiku-4-5',  0.001,   0.005,  0.0001,   0.00125),
+    ('anthropic.claude-sonnet-4-5', 0.003,   0.015,  0.0003,   0.00375),
+    ('anthropic.claude-sonnet-4-6', 0.003,   0.015,  0.0003,   0.00375),
+    ('openai/gpt-4o-mini',          0.00015, 0.0006, 0.000075, 0.0),
+    ('openai/gpt-4o',               0.0025,  0.01,   0.00125,  0.0)
+)
+SELECT
+  u.provider,
+  u.model,
+  u.input_tokens,
+  u.output_tokens,
+  u.cached_input_tokens,
+  u.cache_creation_tokens,
+  u.input_cost_usd,
+  u.cached_input_cost_usd,
+  u.cache_creation_cost_usd,
+  u.output_cost_usd,
+  -- No cost_usd / cache_cost_usd columns are stored: both are derived from the
+  -- four per-bucket columns above, exactly as the API renders them.
+  (u.input_cost_usd + u.cached_input_cost_usd + u.cache_creation_cost_usd + u.output_cost_usd) AS cost_usd,
+  (u.cached_input_cost_usd + u.cache_creation_cost_usd) AS cache_cost_usd,
+  CASE WHEN u.provider = 'openai' THEN
+    (u.input_tokens - MIN(u.cached_input_tokens, u.input_tokens))*r.in_rate/1000.0
+  ELSE
+    u.input_tokens*r.in_rate/1000.0
+  END AS expected_input,
+  CASE WHEN u.provider = 'openai' THEN
+    MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
+  ELSE
+    u.cached_input_tokens*r.read_rate/1000.0
+  END AS expected_cached_input,
+  CASE WHEN u.provider = 'openai' THEN
+    0.0
+  ELSE
+    u.cache_creation_tokens*r.write_rate/1000.0
+  END AS expected_cache_creation,
+  u.output_tokens*r.out_rate/1000.0 AS expected_output,
+  CASE WHEN u.provider = 'openai' THEN
+    (u.input_tokens - MIN(u.cached_input_tokens, u.input_tokens))*r.in_rate/1000.0
+      + MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
+      + u.output_tokens*r.out_rate/1000.0
+  ELSE
+    u.input_tokens*r.in_rate/1000.0 + u.cached_input_tokens*r.read_rate/1000.0
+      + u.cache_creation_tokens*r.write_rate/1000.0 + u.output_tokens*r.out_rate/1000.0
+  END AS expected_total,
+  CASE WHEN u.provider = 'openai' THEN
+    MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
+  ELSE
+    u.cached_input_tokens*r.read_rate/1000.0 + u.cache_creation_tokens*r.write_rate/1000.0
+  END AS expected_cache
+FROM agent_network_request_usage u
+JOIN rates r ON r.model = u.model
+ORDER BY u.timestamp`
+
+// verifyUsageRowsSQL re-checks every persisted usage row directly in the management sqlite store,
+// bypassing the API path — the same audit an operator can run on a production store.db.
+func verifyUsageRowsSQL(t *testing.T, srv *harness.Combined) {
+	t.Helper()
+
+	dbPath, err := srv.SnapshotStoreDB(t.TempDir())
+	require.NoError(t, err, "snapshot management sqlite store")
+
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
+	require.NoError(t, err, "open store snapshot")
+	sqlDB, err := db.DB()
+	require.NoError(t, err)
+	defer func() { _ = sqlDB.Close() }()
+
+	rows, err := db.Raw(rawCostVerificationSQL).Rows()
+	require.NoError(t, err, "run raw cost verification query")
+	defer func() { _ = rows.Close() }()
+
+	verified := 0
+	for rows.Next() {
+		var provider, model string
+		var inTok, outTok, readTok, writeTok int64
+		var inCost, cachedInCost, cacheCreateCost, outCost, cost, cacheCost float64
+		var wantInput, wantCachedInput, wantCacheCreation, wantOutput, wantTotal, wantCache float64
+		require.NoError(t, rows.Scan(&provider, &model, &inTok, &outTok, &readTok, &writeTok,
+			&inCost, &cachedInCost, &cacheCreateCost, &outCost, &cost, &cacheCost,
+			&wantInput, &wantCachedInput, &wantCacheCreation, &wantOutput, &wantTotal, &wantCache), "scan usage row")
+		t.Logf("[sql] %s/%s: in=%d out=%d cache_read=%d cache_write=%d stored in/cached/create/out=$%.6f/$%.6f/$%.6f/$%.6f total=$%.6f cache=$%.6f expected total=$%.6f cache=$%.6f",
+			provider, model, inTok, outTok, readTok, writeTok,
+			inCost, cachedInCost, cacheCreateCost, outCost, cost, cacheCost, wantTotal, wantCache)
+		assert.InDeltaf(t, wantInput, inCost, 1e-6, "stored input_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantCachedInput, cachedInCost, 1e-6, "stored cached_input_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantCacheCreation, cacheCreateCost, 1e-6, "stored cache_creation_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantOutput, outCost, 1e-6, "stored output_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantTotal, cost, 1e-6, "derived cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantCache, cacheCost, 1e-6, "derived cache_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, inCost+cachedInCost+cacheCreateCost+outCost, cost, 1e-9,
+			"stored buckets must sum to the derived cost_usd for %s/%s", provider, model)
+		verified++
+	}
+	require.NoError(t, rows.Err(), "iterate usage rows")
+	require.Positive(t, verified, "raw SQL check must cover at least one usage row")
+	t.Logf("[sql] verified %d usage rows in store.db against published rates", verified)
+
+	// Gateway-prefixed model ids are absent from NetBird's default pricing table, so they are
+	// priced only because the operator registered and priced them on the provider record. Assert
+	// they are priced (not silently 0) — the join above already checked the exact figures for the
+	// ones this matrix drives. A gateway row at cost 0 means the per-record table never reached
+	// the cost meter, which is the regression this guards.
+	gwRows, err := db.Raw(`SELECT model,
+	  (input_cost_usd + cached_input_cost_usd + cache_creation_cost_usd + output_cost_usd) AS cost_usd
+	  FROM agent_network_request_usage WHERE model LIKE '%/%'`).Rows()
+	require.NoError(t, err, "query gateway-prefixed usage rows")
+	defer func() { _ = gwRows.Close() }()
+	for gwRows.Next() {
+		var model string
+		var cost float64
+		require.NoError(t, gwRows.Scan(&model, &cost), "scan gateway usage row")
+		t.Logf("[sql] gateway %s: stored=$%.6f (priced from the operator's per-record rate)", model, cost)
+		assert.Positivef(t, cost, "gateway-prefixed model %q is priced on the provider record, so its cost must be > 0", model)
+	}
+	require.NoError(t, gwRows.Err(), "iterate gateway usage rows")
+}
+
+// validateAccessLogCost recomputes a live access-log row's expected total and cache cost from the
+// published per-1k rates and the row's persisted token buckets, and asserts both stored values.
+// Gateway-prefixed model ids the proxy deliberately does not price must store cost 0.
+func validateAccessLogCost(t *testing.T, pc providerCase, row api.AgentNetworkAccessLog) {
+	t.Helper()
+	model := catalogModel(pc)
+	provider := ""
+	if row.Provider != nil {
+		provider = *row.Provider
+	}
+	t.Logf("[cost] %s: provider=%s model=%s in=%d out=%d total=%d cache_read=%d cache_write=%d cost=$%.6f cache_cost=$%.6f",
+		pc.name, provider, model, row.InputTokens, row.OutputTokens, row.TotalTokens,
+		row.CachedInputTokens, row.CacheCreationTokens, row.CostUsd, row.CacheCostUsd)
+
+	rates, known := publishedPer1k[model]
+	if !known {
+		t.Logf("[cost] %s: no published rate on file for model %q (env-overridden?); skipping cost validation", pc.name, model)
+		return
+	}
+
+	// input_tokens may legitimately be 0: Moonshot/Kimi reports fully cached prompts under the cache
+	// buckets only. Output and total must always be present on a priced row.
+	require.Positive(t, row.OutputTokens, "priced row must carry output tokens")
+	require.Positive(t, row.TotalTokens, "priced row must carry total tokens")
+
+	var wantInput, wantCachedInput, wantCacheCreation float64
+	if provider == "openai" {
+		cached := min(row.CachedInputTokens, row.InputTokens) // cached is a subset of input
+		wantInput = float64(row.InputTokens-cached) / 1000 * rates.in
+		wantCachedInput = float64(cached) / 1000 * rates.read
+		// OpenAI has no cache-write bucket; wantCacheCreation stays 0.
+	} else {
+		// Anthropic / Bedrock shape: cache buckets are additive to input_tokens.
+		wantInput = float64(row.InputTokens) / 1000 * rates.in
+		wantCachedInput = float64(row.CachedInputTokens) / 1000 * rates.read
+		wantCacheCreation = float64(row.CacheCreationTokens) / 1000 * rates.write
+	}
+	wantOutput := float64(row.OutputTokens) / 1000 * rates.out
+	wantCache := wantCachedInput + wantCacheCreation
+	wantTotal := wantInput + wantCache + wantOutput
+
+	t.Logf("[cost] %s: expecting input=$%.6f cached_input=$%.6f cache_creation=$%.6f output=$%.6f total=$%.6f cache=$%.6f from published rates",
+		pc.name, wantInput, wantCachedInput, wantCacheCreation, wantOutput, wantTotal, wantCache)
+	assert.InDeltaf(t, wantInput, row.InputCostUsd, 1e-6, "stored input_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantCachedInput, row.CachedInputCostUsd, 1e-6, "stored cached_input_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantCacheCreation, row.CacheCreationCostUsd, 1e-6, "stored cache_creation_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantOutput, row.OutputCostUsd, 1e-6, "stored output_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantTotal, row.CostUsd, 1e-6, "derived cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantCache, row.CacheCostUsd, 1e-6, "derived cache_cost_usd for %s (%s)", pc.name, model)
+
+	// The aggregates must be exactly the sum of the stored components, not an
+	// independently-computed figure that could drift from the breakdown.
+	assert.InDeltaf(t, row.InputCostUsd+row.CachedInputCostUsd+row.CacheCreationCostUsd+row.OutputCostUsd,
+		row.CostUsd, 1e-9, "stored buckets must sum to the derived cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, row.CachedInputCostUsd+row.CacheCreationCostUsd,
+		row.CacheCostUsd, 1e-9, "stored cache buckets must sum to the derived cache_cost_usd for %s (%s)", pc.name, model)
+}
+
 // providerCase is one entry in the live provider matrix. The same scenario runs
 // for every available provider; availability is keyed off env vars so the suite
 // covers whatever credentials are present (source ~/.llm-keys locally / set the
 // Actions secrets in CI).
 type providerCase struct {
-	name      string
-	catalogID string
-	upstream  string
-	apiKey    string
-	model     string // body model (chat/messages) or path model@version (vertex)
-	kind      string // harness.WireChat, harness.WireMessages, or harness.WireVertex
-	project   string // vertex only: GCP project for the rawPredict path
-	region    string // vertex only: GCP region for the rawPredict path
+	name       string
+	catalogID  string
+	upstream   string
+	apiKey     string
+	model      string // body model (chat/messages) or path model@version (vertex)
+	kind       string // harness.WireChat, harness.WireMessages, or harness.WireVertex
+	project    string // vertex only: GCP project for the rawPredict path
+	region     string // vertex only: GCP region for the rawPredict path
+	pathPrefix string // base-URL path prefix the agent carries (e.g. "/anthropic" for Kimi)
 }
 
 // availableProviders builds the matrix from the provider env vars that are set.
@@ -39,6 +266,24 @@ func availableProviders() []providerCase {
 	if k := os.Getenv("ANTHROPIC_TOKEN"); k != "" {
 		ps = append(ps, providerCase{name: "anthropic", catalogID: "anthropic_api", upstream: "https://api.anthropic.com", apiKey: k, model: "claude-haiku-4-5", kind: harness.WireMessages})
 	}
+	if k := os.Getenv("KIMI_TOKEN"); k != "" {
+		// Kimi (Moonshot AI) serves two body shapes from the same key: OpenAI
+		// Chat Completions on the bare host (/v1/...) and the Anthropic
+		// Messages API under the /anthropic path prefix (the endpoint
+		// Moonshot's Claude Code guide uses). The provider keeps the bare
+		// default upstream and the AGENT carries the /anthropic prefix in
+		// its base URL — exactly the documented Claude Code / Kimi CLI
+		// setup (ANTHROPIC_BASE_URL=https://<endpoint>/anthropic) — so one
+		// provider serves both shapes and the prefix rides through to
+		// Moonshot. Run the Anthropic shape, the flagship Claude Code path;
+		// the OpenAI wire shape is covered live by the other chat-shaped
+		// matrix providers, and Kimi-over-chat passed with kimi-k3 before
+		// the single-model constraint surfaced (run #73 on the kimi feature
+		// branch). The platform serves this account exactly ONE model —
+		// kimi-k3 (kimi-k2-thinking and even kimi-latest return
+		// resource_not_found_error on both surfaces).
+		ps = append(ps, providerCase{name: "kimi", catalogID: "kimi_api", upstream: "https://api.moonshot.ai", apiKey: k, model: "kimi-k3", kind: harness.WireMessages, pathPrefix: "/anthropic"})
+	}
 	if k, u := os.Getenv("VERCEL_TOKEN"), os.Getenv("VERCEL_URL"); k != "" && u != "" {
 		ps = append(ps, providerCase{name: "vercel", catalogID: "vercel_ai_gateway", upstream: u, apiKey: k, model: "openai/gpt-4o-mini", kind: harness.WireChat})
 	}
@@ -84,21 +329,43 @@ func availableProviders() []providerCase {
 		}
 	}
 
-	// Bedrock: path-routed, bearer auth. Model is a cross-region inference
-	// profile id (distinct string from the first-party Anthropic case).
+	// Bedrock: path-routed, bearer auth. Model is the FULL cross-region
+	// inference-profile id exactly as AWS issues it — region-family prefix
+	// plus the date/version suffix. A bare or wrong-region id makes Bedrock
+	// reject the request with "The provided model identifier is invalid"
+	// before any inference runs. The proxy normalizes this id to the catalog
+	// key (anthropic.claude-haiku-4-5) for routing/pricing/allowlists.
+	// Defaults pair eu-central-1 with the eu.* profile; AWS_REGION overrides
+	// the region and the prefix follows its family.
 	if k := os.Getenv("AWS_BEARER_TOKEN_BEDROCK"); k != "" {
 		region := os.Getenv("AWS_REGION")
 		if region == "" {
-			region = "us-east-1"
+			region = "eu-central-1"
 		}
-		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: "us.anthropic.claude-haiku-4-5", kind: harness.WireMessages})
+		// A valid Bedrock inference-profile id, overridable per account (AWS_BEDROCK_MODEL, also the
+		// workflow's bedrock_model dispatch input). `global.` profiles work from any region. Defaults to
+		// Sonnet 4.6, whose id convention dropped the -YYYYMMDD-v1:0 suffix that Haiku 4.5 still carries.
+		model := os.Getenv("AWS_BEDROCK_MODEL")
+		if model == "" {
+			model = "global.anthropic.claude-sonnet-4-6"
+		}
+		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: model, kind: harness.WireBedrock})
 	}
 	return ps
 }
 
 // providerRequest builds a create request for a matrix provider: enabled, with
-// a uniquely-priced model for body-routed providers and none for the
-// path-routed Vertex (whose model lives in the request path).
+// its model registered at the vendor's published rates for body-routed
+// providers, and no models for the path-routed Vertex (whose model lives in the
+// request path, so it prices from the defaults table management ships).
+//
+// The registered rates matter: management synthesizes them into the cost
+// meter's per-provider-record table, which is consulted before the surface
+// defaults, so these are the rates the proxy actually bills with. Registering
+// the published rate keeps the cost assertions vendor-anchored while covering
+// the operator-pricing path. A model with no published rate on file (an
+// env-overridden Bedrock profile) falls back to a nominal rate, and
+// validateAccessLogCost skips its cost check.
 func providerRequest(pc providerCase) api.AgentNetworkProviderRequest {
 	req := api.AgentNetworkProviderRequest{
 		Name:        pc.name,
@@ -108,9 +375,31 @@ func providerRequest(pc providerCase) api.AgentNetworkProviderRequest {
 		Enabled:     ptr(true),
 	}
 	if pc.kind != harness.WireVertex {
-		req.Models = &[]api.AgentNetworkProviderModel{
-			{Id: pc.model, InputPer1k: 0.001, OutputPer1k: 0.002},
+		// The router matches the normalized catalog id. Bedrock's request model
+		// travels as a region-prefixed inference-profile id in the URL path
+		// (us.anthropic...), which the router strips before matching, so register
+		// the normalized form here or routing fails as model_not_routable.
+		modelID := pc.model
+		if pc.kind == harness.WireBedrock {
+			modelID = catalogModel(pc)
 		}
+		model := api.AgentNetworkProviderModel{Id: modelID, InputPer1k: 0.001, OutputPer1k: 0.002}
+		if rates, known := publishedPer1k[catalogModel(pc)]; known {
+			model.InputPer1k = rates.in
+			model.OutputPer1k = rates.out
+			// Pin the cache rates too, rather than letting them inherit from the
+			// defaults table: a gateway-prefixed id has no default entry to
+			// inherit from, and an unset rate bills that bucket at the input
+			// rate, which would not match the published-rate recompute.
+			if rates.read > 0 {
+				model.CachedInputPer1k = ptr(rates.read) // OpenAI shape
+				model.CacheReadPer1k = ptr(rates.read)   // Anthropic / Bedrock shape
+			}
+			if rates.write > 0 {
+				model.CacheCreationPer1k = ptr(rates.write)
+			}
+		}
+		req.Models = &[]api.AgentNetworkProviderModel{model}
 	}
 	return req
 }
@@ -149,14 +438,10 @@ func TestProvidersMatrix(t *testing.T) {
 	// Create every provider, all enabled, each with a unique model string so the
 	// proxy's connect-time snapshot carries them all and model→provider routing
 	// is unambiguous (provider toggles after connect don't reconcile to the
-	// proxy, so we enable everything up front). The first create bootstraps the
-	// cluster.
+	// proxy, so we enable everything up front).
 	ids := make([]string, 0, len(matrix))
-	for i, pc := range matrix {
+	for _, pc := range matrix {
 		req := providerRequest(pc)
-		if i == 0 {
-			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
-		}
 		prov, perr := srv.CreateProvider(ctx, req)
 		require.NoError(t, perr, "create provider %s", pc.name)
 		ids = append(ids, prov.Id)
@@ -201,11 +486,12 @@ func TestProvidersMatrix(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Probe first: the GET resolves the endpoint (DNS error fails) and its first packet wakes the lazy proxy peer, so WaitProxyPeer sees it connected; any HTTP status counts.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
 		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
 	}
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
 
 	for _, pc := range matrix {
 		pc := pc
@@ -216,6 +502,10 @@ func TestProvidersMatrix(t *testing.T) {
 			// session id and confirm the marker propagated end-to-end.
 			sessionID := "e2e-session-" + pc.name
 
+			// A long-form prompt so completions carry realistic token counts for cost validation;
+			// max_tokens in the harness bodies (2048) lets the full answer through.
+			const matrixPrompt = "explain GitHub workflow in 1000 words"
+
 			// Retry briefly to absorb tunnel/DNS jitter on the first call.
 			var code int
 			var body string
@@ -224,10 +514,13 @@ func TestProvidersMatrix(t *testing.T) {
 				var c int
 				var b string
 				var cerr error
-				if pc.kind == harness.WireVertex {
-					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, "Reply with exactly: pong", sessionID)
-				} else {
-					c, b, cerr = cl.Chat(ctx, settings.Endpoint, proxyIP, pc.kind, pc.model, "Reply with exactly: pong", sessionID)
+				switch pc.kind {
+				case harness.WireVertex:
+					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, matrixPrompt, sessionID)
+				case harness.WireBedrock:
+					c, b, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, pc.model, matrixPrompt, sessionID)
+				default:
+					c, b, cerr = cl.ChatPrefixed(ctx, settings.Endpoint, proxyIP, pc.pathPrefix, pc.kind, pc.model, matrixPrompt, sessionID)
 				}
 				if cerr == nil {
 					code, body = c, b
@@ -246,6 +539,7 @@ func TestProvidersMatrix(t *testing.T) {
 
 			// The session id sent as x-session-id must round-trip into the
 			// access-log row for this provider.
+			var row api.AgentNetworkAccessLog
 			require.Eventually(t, func() bool {
 				logs, lerr := srv.ListAccessLogs(ctx)
 				if lerr != nil {
@@ -253,11 +547,15 @@ func TestProvidersMatrix(t *testing.T) {
 				}
 				for _, r := range logs.Data {
 					if r.SessionId != nil && *r.SessionId == sessionID {
+						row = r
 						return true
 					}
 				}
 				return false
 			}, 30*time.Second, 2*time.Second, "session id %q must be recorded in an access-log row for %s", sessionID, pc.name)
+
+			// Stored total and cache cost must match the published rates applied to the row's buckets.
+			validateAccessLogCost(t, pc, row)
 		})
 	}
 
@@ -278,4 +576,7 @@ func TestProvidersMatrix(t *testing.T) {
 		}
 		return false
 	}, 60*time.Second, 3*time.Second, "consumption must be recorded with positive token counts after live traffic")
+
+	// Final raw-SQL audit: bypass the API and re-verify every persisted usage row in the store.
+	verifyUsageRowsSQL(t, srv)
 }
diff --git a/e2e/agentnetwork/credential_check_live_test.go b/e2e/agentnetwork/credential_check_live_test.go
new file mode 100644
index 000000000..f83a18129
--- /dev/null
+++ b/e2e/agentnetwork/credential_check_live_test.go
@@ -0,0 +1,235 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/client/rest"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// credentialCase is one vendor to try the save-time check against. The key is
+// the real one the suite already sources; corrupting it is what produces the
+// refusal, so the pair of cases differ only in the credential.
+type credentialCase struct {
+	name      string
+	catalogID string
+	upstream  string
+	apiKey    string
+}
+
+// liveCredentialCases mirrors the discovery matrix's env gating so a partial
+// key set still yields partial coverage. Vertex is left out: its credential is
+// a service-account keyfile, and mangling one produces a client-side parse
+// failure rather than the vendor refusal this is about.
+func liveCredentialCases() []credentialCase {
+	var cases []credentialCase
+
+	if k := os.Getenv("OPENAI_TOKEN"); k != "" {
+		cases = append(cases, credentialCase{
+			name: "openai", catalogID: "openai_api",
+			upstream: "https://api.openai.com", apiKey: k,
+		})
+	}
+	if k := os.Getenv("ANTHROPIC_TOKEN"); k != "" {
+		cases = append(cases, credentialCase{
+			name: "anthropic", catalogID: "anthropic_api",
+			upstream: "https://api.anthropic.com", apiKey: k,
+		})
+	}
+	if k := os.Getenv("AWS_BEARER_TOKEN_BEDROCK"); k != "" {
+		region := os.Getenv("AWS_REGION")
+		if region == "" {
+			region = "eu-central-1"
+		}
+		cases = append(cases, credentialCase{
+			name: "bedrock", catalogID: "bedrock_api",
+			upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k,
+		})
+	}
+
+	return cases
+}
+
+// TestLiveProviderCredentialCheck drives the save-time check against the real
+// vendors. A unit test can only assert that a mocked refusal is classified;
+// what it cannot show is that these vendors refuse a bad key on their listing
+// endpoint at all, which is the assumption the whole feature rests on.
+//
+// The good-key case matters just as much as the bad one: a check that refused
+// everything would pass a test asserting only the refusal, and would make the
+// product unusable.
+//
+// The suite asserts on the vendors themselves, so it inherits their
+// availability: the check blocks on 5xx and 429 by design, and a vendor outage
+// or a rate limit during a run fails "a good credential saves" with a
+// perfectly valid key. There is no retry here on purpose — a retry loop would
+// also mask the outage classification these tests exist to prove. Re-run the
+// job.
+func TestLiveProviderCredentialCheck(t *testing.T) {
+	cases := liveCredentialCases()
+	if len(cases) == 0 {
+		t.Skip("no live provider credentials in the environment; source ~/.llm-keys to run")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("a good credential saves", func(t *testing.T) {
+				prov, err := srv.CreateProvider(ctx, credentialProviderRequest(tc, "e2e-cred-ok-"+tc.name, tc.apiKey))
+				require.NoError(t, err, "the suite's own credential must pass its check")
+				t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+				require.NotEmpty(t, prov.Id)
+			})
+
+			t.Run("a rejected credential is refused", func(t *testing.T) {
+				_, err := srv.CreateProvider(ctx, credentialProviderRequest(tc, "e2e-cred-bad-"+tc.name, corrupt(tc.apiKey)))
+				require.Error(t, err, "a key the vendor rejects must not save")
+
+				var apiErr *rest.APIError
+				require.ErrorAs(t, err, &apiErr)
+				require.Equal(t, http.StatusUnprocessableEntity, apiErr.StatusCode,
+					"a refused credential is the caller's problem to fix, not a server fault")
+				require.Contains(t, strings.ToLower(apiErr.Message), "rejected the credential",
+					"the message must name the credential rather than the url")
+
+				// The record must be absent, not merely unusable: a provider
+				// saved despite its check is the state this prevents.
+				all, listErr := srv.ListProviders(ctx)
+				require.NoError(t, listErr)
+				for _, p := range all {
+					require.NotEqual(t, "e2e-cred-bad-"+tc.name, p.Name, "a refused provider must not be stored")
+				}
+			})
+		})
+	}
+}
+
+// TestLiveProviderUrlCheck points a real credential at a host that is not the
+// vendor's API. It is the half of the split a wrong key cannot exercise: the
+// operator has to be told the URL is at fault while their key is fine.
+//
+// One vendor, deliberately. The transport classification under test happens
+// before any vendor is reached, so running it per configured vendor would
+// repeat the same code path and multiply the wall-clock of a suite that
+// already creates real records. cases[0] is whichever vendor the environment
+// supplies first.
+func TestLiveProviderUrlCheck(t *testing.T) {
+	cases := liveCredentialCases()
+	if len(cases) == 0 {
+		t.Skip("no live provider credentials in the environment; source ~/.llm-keys to run")
+	}
+	tc := cases[0]
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	// A name that resolves nowhere. The check has to reach a verdict without
+	// the vendor's help, which is the transport half of the classification.
+	req := credentialProviderRequest(tc, "e2e-cred-badurl", tc.apiKey)
+	req.UpstreamUrl = "https://not-a-real-vendor-host.netbird-e2e.invalid"
+
+	_, err := srv.CreateProvider(ctx, req)
+	require.Error(t, err, "an upstream that does not resolve must not save")
+
+	var apiErr *rest.APIError
+	require.ErrorAs(t, err, &apiErr)
+	require.Equal(t, http.StatusUnprocessableEntity, apiErr.StatusCode)
+	require.Contains(t, strings.ToLower(apiErr.Message), "could not be reached",
+		"the message must name the url rather than the credential")
+
+	// An error is not the same fact as an absent record: a handler that saved
+	// first and reported afterwards would satisfy everything above.
+	all, listErr := srv.ListProviders(ctx)
+	require.NoError(t, listErr)
+	for _, p := range all {
+		require.NotEqual(t, "e2e-cred-badurl", p.Name, "a refused provider must not be stored")
+	}
+}
+
+// TestLiveProviderUpdateKeepsTheWorkingKey is the state the check exists to
+// prevent on the update path: a rejected rotation that has already replaced
+// the credential would take a working provider down.
+//
+// Also one vendor: the behaviour is in the manager's merge, not in any
+// vendor's response, and each run creates and mutates a real provider record.
+func TestLiveProviderUpdateKeepsTheWorkingKey(t *testing.T) {
+	cases := liveCredentialCases()
+	if len(cases) == 0 {
+		t.Skip("no live provider credentials in the environment; source ~/.llm-keys to run")
+	}
+	tc := cases[0]
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+
+	prov, err := srv.CreateProvider(ctx, credentialProviderRequest(tc, "e2e-cred-rotate", tc.apiKey))
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	rotation := credentialProviderRequest(tc, "e2e-cred-rotate", corrupt(tc.apiKey))
+	_, err = srv.UpdateProvider(ctx, prov.Id, rotation)
+	require.Error(t, err, "a rotation the vendor rejects must not be stored")
+
+	var apiErr *rest.APIError
+	require.ErrorAs(t, err, &apiErr)
+	require.Equal(t, http.StatusUnprocessableEntity, apiErr.StatusCode)
+
+	// The stored key is never returned by the API, so the proof that it
+	// survived is that an edit which reuses it still passes its check. A
+	// replaced key would fail here exactly as the rotation just did.
+	//
+	// The trailing slash is what makes that an actual check: an edit touching
+	// neither the url, the key nor the catalog entry is stored without asking
+	// the vendor anything, so a rename alone would pass whatever is on the
+	// record. Only the host is read out of the upstream, so the same vendor is
+	// reached — but the string differs, and the check runs.
+	recheck := credentialProviderRequest(tc, "e2e-cred-rotate-renamed", "")
+	recheck.UpstreamUrl = tc.upstream + "/"
+	updated, err := srv.UpdateProvider(ctx, prov.Id, recheck)
+	require.NoError(t, err, "the working key must still be the stored one")
+	require.Equal(t, "e2e-cred-rotate-renamed", updated.Name)
+}
+
+// credentialProviderRequest builds a create/update body for a case. An empty apiKey is
+// omitted rather than sent blank, which is how the form asks to keep whatever
+// is already stored.
+func credentialProviderRequest(tc credentialCase, name, apiKey string) api.AgentNetworkProviderRequest {
+	req := api.AgentNetworkProviderRequest{
+		Name:        name,
+		ProviderId:  tc.catalogID,
+		UpstreamUrl: tc.upstream,
+		Enabled:     ptr(true),
+	}
+	if apiKey != "" {
+		req.ApiKey = &apiKey
+	}
+	return req
+}
+
+// corrupt returns a key the vendor will reject while keeping the shape of the
+// original. Replacing the last character rather than appending keeps any
+// length or prefix validation satisfied, so the refusal comes from the vendor
+// checking the secret rather than from it rejecting an obviously malformed
+// one.
+func corrupt(key string) string {
+	if key == "" {
+		return key
+	}
+	last := key[len(key)-1]
+	replacement := byte('A')
+	if last == 'A' {
+		replacement = 'B'
+	}
+	return key[:len(key)-1] + string(replacement)
+}
diff --git a/e2e/agentnetwork/custom_pricing_test.go b/e2e/agentnetwork/custom_pricing_test.go
new file mode 100644
index 000000000..90e198d3d
--- /dev/null
+++ b/e2e/agentnetwork/custom_pricing_test.go
@@ -0,0 +1,776 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// The mock vLLM upstream (harness/vllm.go) always answers with this fixed usage
+// block, so every request drives deterministic token counts regardless of the
+// model the client asks for. The proxy prices off the REQUEST model, not the
+// upstream response model, so a made-up model id billed at operator rates lets
+// these tests assert exact costs without a real vendor key.
+// Sourced from the harness so the counts can't drift from the mock's config.
+const (
+	vllmPromptTokens     = harness.VLLMChatInputTokens
+	vllmCompletionTokens = harness.VLLMChatOutputTokens
+)
+
+// pricedEnv is a connected single-provider agent-network deployment pointed at
+// the mock vLLM upstream, with the proxy and client up and the endpoint resolved
+// — ready to drive chat. All containers are torn down via t.Cleanup.
+type pricedEnv struct {
+	providerID string
+	groupID    string // source group of the policy; the client peer's auto-group
+	policyID   string // policy that authorises (and meters) the requests
+	upstream   string // provider upstream URL, needed to re-send on a PUT update
+	endpoint   string
+	proxyIP    string
+	client     *harness.Client
+	proxy      *harness.Proxy
+}
+
+// provisionPricedProvider brings up the full path for a cost test: a mock vLLM
+// upstream, a group + reusable setup key, one openai_api provider pointed at the
+// mock enumerating exactly the given models (with the operator's per-1k prices),
+// a policy whose token limit switches on usage metering, and a connected proxy +
+// client. The provider is created with the given models so the router dispatches
+// them to this provider and the cost meter bills at these rates.
+//
+// Passing nil models makes it a gateway-style catch-all: the router claims every
+// model, and since the synthesizer ships no per-provider-record pricing entry
+// for a provider that enumerates nothing, the shipped defaults table is the only
+// thing that can price the request. The policy sets no model guardrail, so the
+// proxy's per-provider allowlist backstop stays empty and any model routes.
+func provisionPricedProvider(t *testing.T, ctx context.Context, name string, models []api.AgentNetworkProviderModel) pricedEnv {
+	t.Helper()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock vLLM upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-price-" + name})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-price-" + name + "-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	// The mock ignores auth, so a dummy key satisfies the "Bearer ${API_KEY}"
+	// template. openai_api is a known catalog provider; the enumerated model id
+	// need NOT be in the catalog — the operator names it and prices it here.
+	dummyKey := "sk-price-e2e"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        name,
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &dummyKey,
+		Enabled:     ptr(true),
+		Models:      &models,
+	})
+	require.NoError(t, err, "create provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	// Uncapped token limit: never blocks the handful of tokens driven here, but
+	// switches on usage metering — the switch that makes consumption rows record.
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-price-" + name,
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		Limits: &api.AgentNetworkPolicyLimits{
+			TokenLimit: api.AgentNetworkPolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      10_000_000,
+				UserCap:       10_000_000,
+				WindowSeconds: 60,
+			},
+		},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-price-"+name+"-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Probe first: the GET resolves the endpoint and its first packet wakes the
+	// lazy proxy peer, so WaitProxyPeer then observes it connected.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	return pricedEnv{
+		providerID: prov.Id,
+		groupID:    grp.Id,
+		policyID:   pol.Id,
+		upstream:   vllm.URL,
+		endpoint:   settings.Endpoint,
+		proxyIP:    proxyIP,
+		client:     cl,
+		proxy:      px,
+	}
+}
+
+// chatOnce drives one OpenAI-shaped chat for model through the tunnel, retrying
+// to absorb first-call tunnel/DNS jitter, and returns the response body.
+func chatOnce(t *testing.T, ctx context.Context, env pricedEnv, model, sessionID string) string {
+	t.Helper()
+	var code int
+	var body string
+	deadline := time.Now().Add(90 * time.Second)
+	for time.Now().Before(deadline) {
+		c, b, cerr := env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireChat, model, "Reply with exactly: pong", sessionID)
+		if cerr == nil {
+			code, body = c, b
+			if code == 200 {
+				break
+			}
+		}
+		if !waitBeforeRetry(ctx, 5*time.Second) {
+			break
+		}
+	}
+	require.Equal(t, 200, code,
+		"chat for %s must return 200; body: %s\n=== proxy logs ===\n%s", model, body, env.proxy.Logs(context.Background()))
+	return body
+}
+
+// accessLogIngestWindow is how long a single request's access-log row is given
+// to appear before the caller gives up on it.
+// accessLogIngestWindow bounds how long a row may take to appear after its
+// request returned. The proxy streams each entry to management with a 10s send
+// timeout of its own, so a request whose send hits one full timeout and is
+// retried has not yet missed anything real — 30s left barely three send
+// attempts of headroom and lost the race on a loaded runner.
+const accessLogIngestWindow = 60 * time.Second
+
+// accessLogPollInterval is how long the lookup waits between pages. Ingest is
+// asynchronous, so the row lands somewhere inside the window rather than on
+// any particular poll.
+const accessLogPollInterval = 2 * time.Second
+
+// lookupAccessLogBySession polls the access-log page for the row carrying
+// sessionID and reports whether it arrived within the window. It never fails
+// the test: callers that can recover — by firing a fresh request under a new
+// session — need to see the miss rather than die on it.
+func lookupAccessLogBySession(ctx context.Context, sessionID string, within time.Duration) (api.AgentNetworkAccessLog, bool) {
+	deadline := time.Now().Add(within)
+	for {
+		// Each poll is bounded by what is left of the window rather than by the
+		// caller's context: a single stalled request would otherwise hold the
+		// loop open long past the ingest window it is meant to enforce, and the
+		// caller would read the delay as a missing row.
+		if logs, lerr := listAccessLogsBy(ctx, deadline); lerr == nil {
+			for _, r := range logs.Data {
+				if r.SessionId != nil && *r.SessionId == sessionID {
+					return r, true
+				}
+			}
+		}
+		// The wait is bounded by the window as well, so the answer arrives when
+		// the caller's budget runs out rather than a poll interval later: a
+		// full interval slept past the deadline reports "no row" up to two
+		// seconds late, which reads as a slower lookup than the one asked for.
+		wait := time.Until(deadline)
+		if wait > accessLogPollInterval {
+			wait = accessLogPollInterval
+		}
+		if wait <= 0 {
+			return api.AgentNetworkAccessLog{}, false
+		}
+		timer := time.NewTimer(wait)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return api.AgentNetworkAccessLog{}, false
+		case <-timer.C:
+		}
+		// Checked after the wait rather than before the request: a poll issued
+		// past the deadline carries no budget and would fail on arrival.
+		if !time.Now().Before(deadline) {
+			return api.AgentNetworkAccessLog{}, false
+		}
+	}
+}
+
+// listAccessLogsBy fetches one access-log page under a context that expires at
+// deadline, so no single call can outlive the window its caller is polling
+// within. The parent's cancellation still applies: the child inherits it.
+func listAccessLogsBy(ctx context.Context, deadline time.Time) (api.AgentNetworkAccessLogsResponse, error) {
+	reqCtx, cancel := context.WithDeadline(ctx, deadline)
+	defer cancel()
+	return srv.ListAccessLogs(reqCtx)
+}
+
+// findAccessLogBySession polls the access-log page for the row carrying
+// sessionID, failing the test if it never lands. Use it for a request whose row
+// must exist; where a missing row is a recoverable race, use
+// lookupAccessLogBySession and retry.
+func findAccessLogBySession(t *testing.T, ctx context.Context, sessionID string) api.AgentNetworkAccessLog {
+	t.Helper()
+	row, ok := lookupAccessLogBySession(ctx, sessionID, accessLogIngestWindow)
+	require.True(t, ok, "session id %q must be recorded in an access-log row", sessionID)
+	return row
+}
+
+// assertOpenAICostAtRates asserts an access-log row's token counts and every cost
+// bucket match the mock's fixed usage priced at the given operator rates. The
+// openai surface has no cache-write bucket and the mock reports no cache tokens,
+// so the whole cost is input + output; cache costs must be exactly zero.
+func assertOpenAICostAtRates(t *testing.T, row api.AgentNetworkAccessLog, inRate, outRate float64) {
+	t.Helper()
+	wantInput := float64(vllmPromptTokens) / 1000 * inRate
+	wantOutput := float64(vllmCompletionTokens) / 1000 * outRate
+	wantTotal := wantInput + wantOutput
+
+	model := ""
+	if row.Model != nil {
+		model = *row.Model
+	}
+	t.Logf("[cost] model=%s in=%d out=%d rates in/out=%.4f/%.4f stored input/output/total=$%.6f/$%.6f/$%.6f expected input/output/total=$%.6f/$%.6f/$%.6f",
+		model, row.InputTokens, row.OutputTokens, inRate, outRate,
+		row.InputCostUsd, row.OutputCostUsd, row.CostUsd, wantInput, wantOutput, wantTotal)
+
+	assert.EqualValues(t, vllmPromptTokens, row.InputTokens, "prompt tokens from the mock usage block")
+	assert.EqualValues(t, vllmCompletionTokens, row.OutputTokens, "completion tokens from the mock usage block")
+	assert.InDeltaf(t, wantInput, row.InputCostUsd, 1e-6, "input_cost_usd must be prompt tokens at the operator input rate")
+	assert.InDeltaf(t, wantOutput, row.OutputCostUsd, 1e-6, "output_cost_usd must be completion tokens at the operator output rate")
+	assert.InDeltaf(t, wantTotal, row.CostUsd, 1e-6, "cost_usd must be the sum of the priced buckets")
+	assert.Zerof(t, row.CachedInputCostUsd, "no cache-read tokens, so cached_input_cost_usd must be 0")
+	assert.Zerof(t, row.CacheCreationCostUsd, "openai surface has no cache-write bucket, so cache_creation_cost_usd must be 0")
+	assert.Zerof(t, row.CacheCostUsd, "no cache usage, so cache_cost_usd must be 0")
+	assert.InDeltaf(t, row.InputCostUsd+row.OutputCostUsd, row.CostUsd, 1e-9, "stored buckets must sum to cost_usd")
+}
+
+// verifyUsageRowForSession re-checks the persisted usage row for a session
+// directly in the management sqlite store — the same audit an operator runs on a
+// production store.db — asserting its cost buckets match the operator rates.
+func verifyUsageRowForSession(t *testing.T, sessionID string, inRate, outRate float64) {
+	t.Helper()
+	dbPath, err := srv.SnapshotStoreDB(t.TempDir())
+	require.NoError(t, err, "snapshot management sqlite store")
+
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
+	require.NoError(t, err, "open store snapshot")
+	sqlDB, err := db.DB()
+	require.NoError(t, err)
+	defer func() { _ = sqlDB.Close() }()
+
+	var provider, model string
+	var inTok, outTok, cachedTok, cacheCreateTok int64
+	var inCost, cachedInCost, cacheCreateCost, outCost float64
+	row := db.Raw(`SELECT provider, model, input_tokens, output_tokens, cached_input_tokens, cache_creation_tokens,
+	  input_cost_usd, cached_input_cost_usd, cache_creation_cost_usd, output_cost_usd
+	  FROM agent_network_request_usage WHERE session_id = ? ORDER BY timestamp DESC LIMIT 1`, sessionID).Row()
+	require.NoError(t, row.Scan(&provider, &model, &inTok, &outTok, &cachedTok, &cacheCreateTok,
+		&inCost, &cachedInCost, &cacheCreateCost, &outCost),
+		"a usage row must exist for session %q", sessionID)
+
+	wantInput := float64(inTok) / 1000 * inRate
+	wantOutput := float64(outTok) / 1000 * outRate
+	t.Logf("[sql] session=%s %s/%s in=%d out=%d stored input/cached/create/output=$%.6f/$%.6f/$%.6f/$%.6f",
+		sessionID, provider, model, inTok, outTok, inCost, cachedInCost, cacheCreateCost, outCost)
+	assert.EqualValues(t, vllmPromptTokens, inTok, "usage row prompt tokens")
+	assert.EqualValues(t, vllmCompletionTokens, outTok, "usage row completion tokens")
+	assert.InDeltaf(t, wantInput, inCost, 1e-6, "usage input_cost_usd must be prompt tokens at the operator input rate")
+	assert.InDeltaf(t, wantOutput, outCost, 1e-6, "usage output_cost_usd must be completion tokens at the operator output rate")
+	assert.Zerof(t, cachedInCost, "usage cached_input_cost_usd must be 0 (no cache usage)")
+	assert.Zerof(t, cacheCreateCost, "usage cache_creation_cost_usd must be 0 (no cache usage)")
+}
+
+// TestCustomModelPricing proves an operator can serve a model that is NOT in
+// NetBird's compiled catalog, at prices they type themselves, and that those
+// operator prices drive the recorded cost end to end — access log AND usage
+// ledger. The provider enumerates one made-up model id at deliberately odd rates
+// (no default entry could supply them), the client requests it, and every cost
+// bucket must equal the mock's fixed token counts multiplied by those rates.
+func TestCustomModelPricing(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	const (
+		customModel = "e2e-custom-model" // absent from the compiled catalog
+		inRate      = 0.037              // odd rates so a stray default can't match
+		outRate     = 0.089
+	)
+
+	env := provisionPricedProvider(t, ctx, "custommodel", []api.AgentNetworkProviderModel{
+		{Id: customModel, InputPer1k: inRate, OutputPer1k: outRate},
+	})
+
+	sessionID := "e2e-session-custommodel"
+	body := chatOnce(t, ctx, env, customModel, sessionID)
+	require.Contains(t, body, "chat.completion", "body should be an OpenAI-compatible completion; got: %s", body)
+
+	row := findAccessLogBySession(t, ctx, sessionID)
+	require.NotNil(t, row.Model, "access-log row must carry the requested model")
+	assert.Equal(t, customModel, *row.Model, "the row must be stamped with the requested (custom) model, not the mock's response model")
+	assertOpenAICostAtRates(t, row, inRate, outRate)
+
+	// Metering: the uncapped token limit switches on usage recording, so the
+	// request must surface as a consumption row with positive tokens and cost.
+	require.Eventually(t, func() bool {
+		rows, lerr := srv.ListConsumption(ctx)
+		if lerr != nil {
+			return false
+		}
+		for _, r := range rows {
+			if r.TokensInput > 0 && r.TokensOutput > 0 && r.CostUsd > 0 {
+				return true
+			}
+		}
+		return false
+	}, 60*time.Second, 3*time.Second, "custom-model usage must be metered into a consumption row with positive cost")
+
+	// Final raw-SQL audit: bypass the API and re-verify the persisted usage row.
+	verifyUsageRowForSession(t, sessionID, inRate, outRate)
+}
+
+// TestPriceChangeUpdatesRecordedCost proves that changing a provider's model
+// price is reflected in the cost recorded for subsequent requests — in both the
+// access log and the usage ledger — while requests already priced at the old
+// rate keep their original cost. The update propagates to the connected proxy
+// live (a mapping push rebuilds the cost_meter chain with the new table), so no
+// reconnect or restart is needed; the test polls a fresh request until the new
+// rate lands.
+func TestPriceChangeUpdatesRecordedCost(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	const (
+		customModel = "e2e-repriced-model"
+		inRateA     = 0.010
+		outRateA    = 0.020
+		inRateB     = 0.050 // 5x / 4x the original, so a repriced row is unmistakable
+		outRateB    = 0.080
+		// Per-attempt ingest wait, shorter than the default so a request that
+		// produces no row costs one retry rather than most of the budget, and an
+		// overall deadline long enough to hold several attempts.
+		repriceIngestWindow = 20 * time.Second
+		repriceDeadline     = 180 * time.Second
+	)
+
+	env := provisionPricedProvider(t, ctx, "reprice", []api.AgentNetworkProviderModel{
+		{Id: customModel, InputPer1k: inRateA, OutputPer1k: outRateA},
+	})
+
+	// Phase 1 — request priced at the original rate A.
+	sessionA := "e2e-session-reprice-a"
+	chatOnce(t, ctx, env, customModel, sessionA)
+	rowA := findAccessLogBySession(t, ctx, sessionA)
+	assertOpenAICostAtRates(t, rowA, inRateA, outRateA)
+	verifyUsageRowForSession(t, sessionA, inRateA, outRateA)
+
+	// Change the model's price. The API key is omitted so the stored one is kept;
+	// the models array is re-sent with the new rates (PUT replaces the list).
+	// This reconciles synchronously and pushes a fresh cost_meter table to the
+	// already-connected proxy — no reconnect.
+	_, err := srv.UpdateProvider(ctx, env.providerID, api.AgentNetworkProviderRequest{
+		Name:        "reprice",
+		ProviderId:  "openai_api",
+		UpstreamUrl: env.upstream,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: customModel, InputPer1k: inRateB, OutputPer1k: outRateB},
+		},
+	})
+	require.NoError(t, err, "update provider price")
+
+	// Phase 2 — the push + chain rebuild is async, so drive fresh requests (each
+	// under its own session) until one is priced at the new rate B. Each iteration
+	// fires one request and waits for that session's row to be ingested before
+	// reading its cost, so an un-ingested row is never mistaken for "still rate A".
+	// The expected new input cost is unmistakably higher than rate A, so a
+	// lingering old-rate row can't satisfy the check.
+	//
+	// Every way an iteration can come up short — the request failing, its row not
+	// landing, or the row still carrying rate A — is a symptom of the same
+	// in-flight rebuild, so each one retries under a fresh session rather than
+	// ending the test. Only the outer deadline is fatal.
+	wantInputB := float64(vllmPromptTokens) / 1000 * inRateB
+	var repriced api.AgentNetworkAccessLog
+	var lastSession string
+	// The cost last read, kept separately: repriced is the zero value on every
+	// path that gives up, so reporting its cost would say "$0.000000" whether
+	// the rows were still at rate A or no row was ever read.
+	var lastCost float64
+	var sawRow bool
+	deadline := time.Now().Add(repriceDeadline)
+	// Everything inside the loop runs under the deadline rather than the
+	// test's own context. An attempt started just before it would otherwise
+	// run well past it: the chat container is capped at 90s of its own and the
+	// row lookup at another 20s, so the loop could report a repricing failure
+	// nearly two minutes after the window it was given had closed.
+	repriceCtx, cancelReprice := context.WithDeadline(ctx, deadline)
+	defer cancelReprice()
+	for time.Now().Before(deadline) {
+		lastSession = fmt.Sprintf("e2e-session-reprice-b-%d", time.Now().UnixNano())
+		code, _, cerr := env.client.Chat(repriceCtx, env.endpoint, env.proxyIP, harness.WireChat, customModel, "Reply with exactly: pong", lastSession)
+		if cerr != nil || code != 200 {
+			if !waitBeforeRetry(repriceCtx, 5*time.Second) {
+				break
+			}
+			continue
+		}
+		row, ok := lookupAccessLogBySession(repriceCtx, lastSession, repriceIngestWindow)
+		if !ok {
+			// No row for this request. The proxy now publishes a rebuilt chain
+			// before the route that reaches it, so a request can no longer be
+			// served unattributed mid-update; this retry covers the ingest
+			// window alone. Fire another one under a fresh session.
+			t.Logf("no access-log row for session %q within %s; retrying under a fresh session", lastSession, repriceIngestWindow)
+			continue
+		}
+		if inDelta(row.InputCostUsd, wantInputB, 1e-6) {
+			repriced = row
+			break
+		}
+		// Still priced at the old rate — the push hasn't landed yet; retry.
+		lastCost, sawRow = row.InputCostUsd, true
+		if !waitBeforeRetry(repriceCtx, 5*time.Second) {
+			break
+		}
+	}
+	lastSeen := "no row was ever read"
+	if sawRow {
+		lastSeen = fmt.Sprintf("last input_cost_usd=$%.6f", lastCost)
+	}
+	require.NotEmpty(t, repriced.Id, "a request after the price change must be priced at the new rate B; %s, wanted $%.6f\n=== proxy logs ===\n%s",
+		lastSeen, wantInputB, env.proxy.Logs(context.Background()))
+
+	assertOpenAICostAtRates(t, repriced, inRateB, outRateB)
+	verifyUsageRowForSession(t, lastSession, inRateB, outRateB)
+
+	// The original request keeps its original cost: repricing is not retroactive.
+	rowAStill := findAccessLogBySession(t, ctx, sessionA)
+	assertOpenAICostAtRates(t, rowAStill, inRateA, outRateA)
+	verifyUsageRowForSession(t, sessionA, inRateA, outRateA)
+}
+
+// TestPricingDefaultsFileDrivesCost proves the operator-supplied pricing
+// defaults file is what the proxy bills with. The harness configures
+// server.agentNetwork.pricingDefaultsFile as a BARE FILENAME and writes that
+// file into the bind-mounted datadir (see harness.PricingDefaultsFileName), so a
+// pass exercises the whole chain: combined yaml → ToManagementConfig →
+// pricing.LoadFile (relative path resolved against datadir) → DefaultTable →
+// the synthesizer's cost_meter defaults payload → the proxy's lookup.
+//
+// The provider enumerates NO models, so it is a catch-all route with no
+// per-provider-record pricing entry at all — the only rates that can price the
+// request are the shipped defaults. The model is a real catalog model whose
+// built-in rates the file replaces with deliberately odd values, so billing at
+// the compiled-in rates (i.e. the file never loaded) fails the assertions.
+func TestPricingDefaultsFileDrivesCost(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	// nil models: a gateway-style provider claiming every model. The synthesizer
+	// ships no per-record entry for it, so the defaults table is its price list.
+	env := provisionPricedProvider(t, ctx, "defaultsfile", nil)
+
+	sessionID := "e2e-session-defaultsfile"
+	body := chatOnce(t, ctx, env, harness.PricedDefaultModel, sessionID)
+	require.Contains(t, body, "chat.completion", "body should be an OpenAI-compatible completion; got: %s", body)
+
+	row := findAccessLogBySession(t, ctx, sessionID)
+	require.NotNil(t, row.Model, "access-log row must carry the requested model")
+	assert.Equal(t, harness.PricedDefaultModel, *row.Model, "the row must be stamped with the requested model")
+
+	// The file's rates, not the compiled-in catalog rates for this model.
+	assertOpenAICostAtRates(t, row, harness.PricedDefaultInputPer1k, harness.PricedDefaultOutputPer1k)
+	verifyUsageRowForSession(t, sessionID, harness.PricedDefaultInputPer1k, harness.PricedDefaultOutputPer1k)
+}
+
+// TestPricingDefaultsFileLeavesOtherModelsAlone proves the defaults file merges
+// per entry rather than replacing the whole table: the file names exactly one
+// model, so a DIFFERENT catalog model must still bill at its compiled-in rates.
+// Without this, a file that shipped as a wholesale replacement would silently
+// zero-cost every model the operator didn't list, and TestPricingDefaultsFile-
+// DrivesCost alone would not notice.
+func TestPricingDefaultsFileLeavesOtherModelsAlone(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	// gpt-4o-mini is a catalog model the pricing file does NOT mention, so it must
+	// keep its built-in rates. Pinned here independently of the catalog source so
+	// a rate change in either place surfaces as a failure to reconcile rather
+	// than passing silently.
+	const (
+		untouchedModel = "gpt-4o-mini"
+		builtinInRate  = 0.00015
+		builtinOutRate = 0.0006
+	)
+
+	env := provisionPricedProvider(t, ctx, "defaultsfileother", nil)
+
+	sessionID := "e2e-session-defaultsfile-other"
+	chatOnce(t, ctx, env, untouchedModel, sessionID)
+
+	row := findAccessLogBySession(t, ctx, sessionID)
+	assertOpenAICostAtRates(t, row, builtinInRate, builtinOutRate)
+	verifyUsageRowForSession(t, sessionID, builtinInRate, builtinOutRate)
+}
+
+// TestCustomModelAccessLogAttribution proves a custom (non-catalog) model is
+// handled correctly in the ACCESS LOG, not just in the cost columns. The other
+// tests here assert money; this one asserts the row's identity and attribution
+// dimensions — the columns the dashboard filters, groups and drills down on.
+//
+// A custom model id is the interesting case precisely because nothing in
+// NetBird's catalog describes it. Its provider vendor, parser surface, cost
+// buckets, and dashboard filterability all have to come from the operator's
+// provider record rather than from a compiled-in entry. So this checks:
+//
+//   - the row is stamped with the REQUESTED model id verbatim, not the mock
+//     upstream's response model (Qwen/Qwen2.5-0.5B-Instruct) and not a
+//     normalized or catalog-substituted id;
+//   - provider is the vendor SURFACE ("openai", from the catalog entry's
+//     ParserID) — a custom model does not change which wire shape was spoken;
+//   - resolved_provider_id / selected_policy_id / group_ids attribute the row to
+//     the operator's provider record, the authorising policy, and the caller's
+//     group, so spend on a custom model is attributable;
+//   - decision is "allow" with no deny reason, and the request dimensions
+//     (status 200, POST, the OpenAI chat path, non-stream, source IP, duration)
+//     are recorded;
+//   - management's SERVER-SIDE model filter finds the row by its custom id, so
+//     the model column is genuinely indexed and queryable rather than merely
+//     stored;
+//   - prompt/completion capture stays empty, since prompt collection is off by
+//     default and a custom model must not bypass that gate.
+func TestCustomModelAccessLogAttribution(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	// A model id no catalog entry carries, at odd rates so its cost cannot come
+	// from anywhere but the provider record.
+	const (
+		customModel = "e2e-attribution-model-v9"
+		inRate      = 0.0271
+		outRate     = 0.0913
+	)
+
+	env := provisionPricedProvider(t, ctx, "attribution", []api.AgentNetworkProviderModel{
+		{Id: customModel, InputPer1k: inRate, OutputPer1k: outRate},
+	})
+
+	sessionID := "e2e-session-attribution"
+	body := chatOnce(t, ctx, env, customModel, sessionID)
+	require.Contains(t, body, "chat.completion", "body should be an OpenAI-compatible completion; got: %s", body)
+
+	row := findAccessLogBySession(t, ctx, sessionID)
+
+	// Identity: the requested model verbatim. The mock answers with its own
+	// served model id, so a row carrying that instead means the log is sourced
+	// from the response body rather than the parsed request.
+	require.NotNil(t, row.Model, "access-log row must carry the requested model")
+	assert.Equal(t, customModel, *row.Model,
+		"the row must be stamped with the requested custom model id verbatim, not the mock upstream's response model (%s)", harness.VLLMModel)
+
+	// Surface: a custom model id does not change the wire shape that was spoken.
+	// provider is the vendor surface from the catalog entry's parser, which is
+	// also the key the cost meter's cache formula switches on.
+	require.NotNil(t, row.Provider, "access-log row must carry the vendor surface")
+	assert.Equal(t, "openai", *row.Provider,
+		"openai_api's parser surface is openai, regardless of how exotic the model id is")
+
+	// Attribution: which provider record served it, which policy authorised it,
+	// and which group the authorisation came through. Without these, spend on a
+	// custom model can be seen but not attributed.
+	require.NotNil(t, row.ResolvedProviderId, "row must name the provider record that served the request")
+	assert.Equal(t, env.providerID, *row.ResolvedProviderId,
+		"the router stamps the operator's provider record id; a custom model must attribute to the record that enumerated it")
+	require.NotNil(t, row.SelectedPolicyId, "row must name the policy that authorised the request")
+	assert.Equal(t, env.policyID, *row.SelectedPolicyId,
+		"the policy carrying the token limit is the one that paid for the request")
+	require.NotNil(t, row.GroupIds, "row must carry the authorising group ids")
+	assert.Contains(t, *row.GroupIds, env.groupID,
+		"the caller's group is the policy's source group, so it must be the authorising group")
+
+	// Decision + request dimensions.
+	require.NotNil(t, row.Decision, "row must carry the policy decision")
+	assert.Equal(t, "allow", *row.Decision, "the uncapped policy allows this request")
+	if row.DenyReason != nil {
+		assert.Empty(t, *row.DenyReason, "an allowed request must carry no deny reason")
+	}
+	assert.Equal(t, 200, row.StatusCode, "the mock upstream answers 200")
+	if row.Method != nil {
+		assert.Equal(t, "POST", *row.Method, "a chat completion is a POST")
+	}
+	require.NotNil(t, row.Path, "row must record the request path")
+	assert.Equal(t, "/v1/chat/completions", *row.Path,
+		"the OpenAI chat path the client called, as seen by the proxy")
+	require.NotNil(t, row.Host, "row must record the host the client addressed")
+	assert.Equal(t, env.endpoint, *row.Host, "the agent-network endpoint the client resolved")
+	if row.Stream != nil {
+		assert.False(t, *row.Stream, "the harness sends a non-streaming request")
+	}
+	require.NotNil(t, row.SourceIp, "row must record the caller's tunnel IP")
+	assert.NotEmpty(t, *row.SourceIp, "the request arrived over the tunnel, so a source IP is known")
+
+	// Tokens and cost, so the attribution above is anchored to a real priced row
+	// rather than an empty shell that happens to carry the right ids.
+	assertOpenAICostAtRates(t, row, inRate, outRate)
+	assert.EqualValues(t, vllmPromptTokens+vllmCompletionTokens, row.TotalTokens,
+		"total_tokens is the mock's reported total")
+
+	// Prompt capture is off by default (account master switch), and a custom
+	// model must not bypass that gate.
+	if row.RequestPrompt != nil {
+		assert.Empty(t, *row.RequestPrompt, "prompt collection is off by default, so no prompt may be stored")
+	}
+	if row.ResponseCompletion != nil {
+		assert.Empty(t, *row.ResponseCompletion, "prompt collection is off by default, so no completion may be stored")
+	}
+
+	// Queryability: management's SERVER-SIDE model filter must find the row by
+	// its custom id. findAccessLogBySession above scans a page client-side, so
+	// this is the check that the model column is actually indexed and filterable
+	// — the dashboard's per-model drill-down on a custom model depends on it.
+	filtered, err := srv.ListAccessLogsFiltered(ctx, url.Values{"model": []string{customModel}})
+	require.NoError(t, err, "filter access logs by the custom model id")
+	require.Positive(t, filtered.TotalRecords, "the custom model must be findable via the server-side model filter")
+	foundSession := false
+	for _, r := range filtered.Data {
+		require.NotNil(t, r.Model, "filtered row must carry a model")
+		assert.Equal(t, customModel, *r.Model, "the model filter must not return rows for other models")
+		if r.SessionId != nil && *r.SessionId == sessionID {
+			foundSession = true
+		}
+	}
+	assert.True(t, foundSession, "the filtered page must include this test's request")
+
+	// Final raw-SQL audit of the parallel usage row: the ledger must carry the
+	// same custom model, surface, and provider-record attribution as the log.
+	verifyUsageAttributionForSession(t, sessionID, customModel, "openai", env.providerID, env.groupID)
+}
+
+// verifyUsageAttributionForSession checks the usage ledger's attribution columns
+// for a session directly in the management sqlite store — including the group
+// child row, which the API renders but which only exists if the proxy's
+// authorising-group CSV was parsed into normalised rows. The usage table is
+// written unconditionally (independent of the log-collection toggle), so this is
+// the record that must attribute spend even for accounts with logs off.
+func verifyUsageAttributionForSession(t *testing.T, sessionID, wantModel, wantProvider, wantProviderID, wantGroupID string) {
+	t.Helper()
+	dbPath, err := srv.SnapshotStoreDB(t.TempDir())
+	require.NoError(t, err, "snapshot management sqlite store")
+
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
+	require.NoError(t, err, "open store snapshot")
+	sqlDB, err := db.DB()
+	require.NoError(t, err)
+	defer func() { _ = sqlDB.Close() }()
+
+	var id, provider, model, resolvedProviderID, userID string
+	require.NoError(t, db.Raw(
+		`SELECT id, provider, model, resolved_provider_id, user_id
+		 FROM agent_network_request_usage WHERE session_id = ? ORDER BY timestamp DESC LIMIT 1`, sessionID).
+		Row().Scan(&id, &provider, &model, &resolvedProviderID, &userID),
+		"a usage row must exist for session %q", sessionID)
+
+	t.Logf("[sql] usage attribution session=%s id=%s provider=%s model=%s resolved_provider_id=%s user_id=%s",
+		sessionID, id, provider, model, resolvedProviderID, userID)
+	assert.Equal(t, wantModel, model, "usage row must carry the requested custom model")
+	assert.Equal(t, wantProvider, provider, "usage row must carry the vendor surface")
+	assert.Equal(t, wantProviderID, resolvedProviderID, "usage row must attribute to the operator's provider record")
+	assert.NotEmpty(t, userID, "the tunnel peer resolves to a principal, so the usage row must be attributable to it")
+
+	// The authorising group lands in the normalised child table, which is what
+	// the usage overview joins on to break spend down by group.
+	var groupIDs []string
+	require.NoError(t, db.Raw(
+		`SELECT group_id FROM agent_network_request_usage_group WHERE usage_id = ?`, id).
+		Scan(&groupIDs).Error, "read usage group child rows")
+	assert.Contains(t, groupIDs, wantGroupID,
+		"the authorising group must be normalised into a usage_group row so spend can be grouped by it")
+}
+
+// inDelta reports whether a and b are within tol of each other.
+func inDelta(a, b, tol float64) bool {
+	d := a - b
+	if d < 0 {
+		d = -d
+	}
+	return d <= tol
+}
+
+// TestCustomDatedModelKeepsItsOwnPrice covers the review fix that anchored the
+// release-date fallback to Claude ids. Pricing looks every model up through
+// that helper, so while it matched a bare trailing date any operator id ending
+// in eight digits inherited the rate of its undated sibling — a silent
+// mis-bill on models NetBird knows nothing about.
+func TestCustomDatedModelKeepsItsOwnPrice(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	const (
+		baseModel  = "internal-llm"
+		datedModel = "internal-llm-20250101"
+		baseIn     = 0.010
+		baseOut    = 0.020
+		// An order of magnitude apart, so a row billed at the wrong entry is
+		// unmistakable rather than a rounding argument.
+		datedIn  = 0.100
+		datedOut = 0.200
+	)
+
+	env := provisionPricedProvider(t, ctx, "customdated", []api.AgentNetworkProviderModel{
+		{Id: baseModel, InputPer1k: baseIn, OutputPer1k: baseOut},
+		{Id: datedModel, InputPer1k: datedIn, OutputPer1k: datedOut},
+	})
+
+	t.Run("the undated id bills at its own rate", func(t *testing.T) {
+		session := fmt.Sprintf("e2e-session-customdated-base-%d", time.Now().UnixNano())
+		chatOnce(t, ctx, env, baseModel, session)
+		assertOpenAICostAtRates(t, findAccessLogBySession(t, ctx, session), baseIn, baseOut)
+	})
+
+	t.Run("the dated id keeps its own rate", func(t *testing.T) {
+		session := fmt.Sprintf("e2e-session-customdated-dated-%d", time.Now().UnixNano())
+		chatOnce(t, ctx, env, datedModel, session)
+		row := findAccessLogBySession(t, ctx, session)
+		assertOpenAICostAtRates(t, row, datedIn, datedOut)
+
+		// Spelled out because it is the regression: inheriting the sibling's
+		// rate would bill this request at a tenth of its price.
+		assert.Greater(t, row.InputCostUsd, float64(vllmPromptTokens)/1000*baseIn*2,
+			"a custom dated id must not inherit the undated entry's rate")
+	})
+}
diff --git a/e2e/agentnetwork/discovery_live_test.go b/e2e/agentnetwork/discovery_live_test.go
new file mode 100644
index 000000000..22c9f31c2
--- /dev/null
+++ b/e2e/agentnetwork/discovery_live_test.go
@@ -0,0 +1,447 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"sort"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	sharedllm "github.com/netbirdio/netbird/shared/llm"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestLiveModelDiscovery drives model discovery against the REAL vendor
+// endpoints — OpenAI, Anthropic, Bedrock and Vertex — rather than the mock.
+//
+// The mock upstream proves the filter's mechanics: it advertises ids we chose,
+// so a listing narrowing to the ones we authorised is arithmetic we already
+// controlled both sides of. What it cannot prove is that the filter survives
+// contact with a real catalogue — ids we never enumerated, dated builds whose
+// suffix the vendor picks, surfaces that answer a listing request with
+// something other than a listing. That is what this covers, and it is the part
+// a QA engineer would otherwise have to walk through by hand.
+//
+// One proxy serves every case. Each provider gets its own group, policy and
+// client, because a model-less request matches exactly ONE route
+// (matchModelless): with two providers authorised for the same caller, the
+// listing would go to whichever won the tiebreak and the other would go
+// untested. Group-scoping the caller makes each provider the only candidate
+// for its own client.
+func TestLiveModelDiscovery(t *testing.T) {
+	cases := liveDiscoveryCases()
+	if len(cases) == 0 {
+		t.Skip("no provider keys set; source ~/.llm-keys to run live model discovery")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
+	defer cancel()
+
+	t.Logf("[discovery] live matrix: %s", strings.Join(caseNames(cases), ", "))
+
+	// Provision every provider, group and policy before the proxy starts: the
+	// proxy takes a configuration snapshot at connect time and does not
+	// reconcile provider changes made afterwards.
+	keys := make(map[string]string, len(cases))
+	for i := range cases {
+		keys[cases[i].name] = provisionLiveDiscovery(t, ctx, &cases[i])
+	}
+
+	endpoint, firstIP, firstClient, px := connectClient(t, ctx, "disc-live", keys[cases[0].name])
+	clients := map[string]*harness.Client{cases[0].name: firstClient}
+	ips := map[string]string{cases[0].name: firstIP}
+	for _, tc := range cases[1:] {
+		cl := joinClient(t, ctx, px, endpoint, keys[tc.name])
+		ip, err := cl.ResolveProxyIP(ctx, endpoint)
+		require.NoError(t, err, "resolve endpoint from the %s client", tc.name)
+		clients[tc.name] = cl
+		ips[tc.name] = ip
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			runLiveDiscoveryCase(t, ctx, tc, clients[tc.name], endpoint, ips[tc.name])
+		})
+	}
+}
+
+// discoveryOutcome is what a discovery request must produce end to end. The
+// three are genuinely different contracts, not degrees of success: only the
+// first puts a bounded listing in front of the caller.
+type discoveryOutcome int
+
+const (
+	// outcomeFiltered: the proxy routes the request and bounds the response to
+	// what the caller may use.
+	outcomeFiltered discoveryOutcome = iota
+	// outcomeDenied: no provider of this shape can serve the surface, so the
+	// proxy refuses rather than rewriting the request onto an upstream that
+	// would 404 it. The caller gets a NetBird error, not a vendor one.
+	outcomeDenied
+	// outcomeUpstreamNoListing: the proxy routes the request to the configured
+	// upstream, and the vendor does not implement the endpoint there. Proxy
+	// side correct, product side a dead end — see the Bedrock case.
+	outcomeUpstreamNoListing
+)
+
+// liveDiscoveryCase is one provider's discovery surface and what the proxy
+// must make of it.
+type liveDiscoveryCase struct {
+	name      string
+	catalogID string
+	upstream  string
+	apiKey    string
+
+	// path is the discovery endpoint the client calls. Not every surface uses
+	// /v1/models: Bedrock lists inference profiles instead.
+	path string
+	// headers the vendor requires on a bare GET (Anthropic versions its API
+	// through a header, and rejects a request without one).
+	headers []string
+
+	// models the provider record enumerates. Empty models a gateway record,
+	// which enumerates nothing and claims everything.
+	models []string
+	// allowlist, when non-empty, is a guardrail narrowing the policy below the
+	// provider's own enumeration — the second of the two bounds discovery
+	// applies, and the only one a provider record alone cannot demonstrate.
+	allowlist []string
+
+	// outcome is what this surface must produce end to end.
+	outcome discoveryOutcome
+
+	// permitted is every id allowed to survive filtering, in the form the
+	// provider record registers it. A surviving id counts as permitted when it
+	// matches one of these outright or after Anthropic date-normalisation.
+	permitted []string
+	// wantHidden are ids the upstream is known to advertise and the bound must
+	// remove. Only set where we enumerate the model ourselves, so the
+	// expectation cannot rot when a vendor changes its catalogue.
+	wantHidden []string
+}
+
+// liveDiscoveryCases builds the matrix from whichever provider credentials are
+// present, mirroring availableProviders' env-var gating so a partial key set
+// still yields partial coverage.
+func liveDiscoveryCases() []liveDiscoveryCase {
+	var cases []liveDiscoveryCase
+
+	// OpenAI enumerates TWO real models and the policy permits one. That is
+	// the only case here where both bounds are observable at once: the
+	// upstream advertises dozens of ids, the provider record cuts them to two,
+	// and the guardrail cuts those to one.
+	if k := os.Getenv("OPENAI_TOKEN"); k != "" {
+		cases = append(cases, liveDiscoveryCase{
+			name: "openai", catalogID: "openai_api", upstream: "https://api.openai.com", apiKey: k,
+			path:       "/v1/models",
+			models:     []string{"gpt-4o-mini", "gpt-4o"},
+			allowlist:  []string{"gpt-4o-mini"},
+			outcome:    outcomeFiltered,
+			permitted:  []string{"gpt-4o-mini"},
+			wantHidden: []string{"gpt-4o"},
+		})
+	}
+
+	// Anthropic is the surface Claude Code actually calls. Its listing returns
+	// DATED build ids (claude-haiku-4-5-20251001) while the provider record
+	// registers the undated id, so this is the case that proves the filter's
+	// date-normalisation against ids the vendor chose rather than ids we wrote.
+	if k := os.Getenv("ANTHROPIC_TOKEN"); k != "" {
+		cases = append(cases, liveDiscoveryCase{
+			name: "anthropic", catalogID: "anthropic_api", upstream: "https://api.anthropic.com", apiKey: k,
+			path:      "/v1/models",
+			headers:   []string{"anthropic-version: 2023-06-01"},
+			models:    []string{"claude-haiku-4-5"},
+			outcome:   outcomeFiltered,
+			permitted: []string{"claude-haiku-4-5"},
+		})
+	}
+
+	// Bedrock lists inference profiles, not models: matchModelless routes
+	// /inference-profiles to a Bedrock route and refuses /v1/models for one.
+	//
+	// The listing is served by the CONTROL PLANE (bedrock.<region>), not the
+	// runtime host a provider record must point at for InvokeModel — the
+	// runtime host answers <UnknownOperationException/>. The router now sends
+	// the listing, and only the listing, to the control plane, so this case
+	// asserts a real filtered listing rather than the 404 it used to get.
+	//
+	// The mock upstream cannot show any of this: it answers
+	// /inference-profiles on the same listener as everything else, so a
+	// mock-based test passes whichever host the request went to.
+	if k := os.Getenv("AWS_BEARER_TOKEN_BEDROCK"); k != "" {
+		region := os.Getenv("AWS_REGION")
+		if region == "" {
+			region = "eu-central-1"
+		}
+		model := os.Getenv("AWS_BEDROCK_MODEL")
+		if model == "" {
+			model = "global.anthropic.claude-sonnet-4-6"
+		}
+		cases = append(cases, liveDiscoveryCase{
+			name: "bedrock", catalogID: "bedrock_api",
+			upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k,
+			path: "/inference-profiles",
+			// Registered verbatim, as an operator would copy it from AWS: the
+			// region prefix is what makes the id invocable, and the listing
+			// returns ids in exactly this form.
+			models:    []string{model},
+			outcome:   outcomeFiltered,
+			permitted: []string{model},
+		})
+	}
+
+	// Vertex carries the model in the rawPredict path and serves no listing
+	// endpoint at all, so the proxy must refuse discovery rather than rewrite
+	// it onto an upstream that would 404.
+	if sa := os.Getenv("GOOGLE_VERTEX_SA_BASE64"); sa != "" {
+		if project := os.Getenv("GOOGLE_VERTEX_PROJECT"); project != "" {
+			region := os.Getenv("GOOGLE_VERTEX_REGION")
+			if region == "" {
+				region = "global"
+			}
+			host := "aiplatform.googleapis.com"
+			if region != "global" {
+				host = region + "-aiplatform.googleapis.com"
+			}
+			cases = append(cases, liveDiscoveryCase{
+				name: "vertex", catalogID: "vertex_ai_api", upstream: "https://" + host,
+				apiKey:  "keyfile::" + sa,
+				path:    "/v1/models",
+				outcome: outcomeDenied,
+			})
+		}
+	}
+
+	return cases
+}
+
+// provisionLiveDiscovery creates the group, provider, optional guardrail and
+// policy for one case, and returns the setup key a client joins that group
+// with. Scoping each provider to its own group is what keeps it the only
+// candidate for its own client's model-less request.
+func provisionLiveDiscovery(t *testing.T, ctx context.Context, tc *liveDiscoveryCase) string {
+	t.Helper()
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-disc-live-" + tc.name})
+	require.NoError(t, err, "create group for %s", tc.name)
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-disc-live-" + tc.name,
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key for %s", tc.name)
+	require.NotEmpty(t, sk.Key, "setup key plaintext for %s", tc.name)
+
+	req := api.AgentNetworkProviderRequest{
+		Name:        "e2e-disc-live-" + tc.name,
+		ProviderId:  tc.catalogID,
+		UpstreamUrl: tc.upstream,
+		ApiKey:      &tc.apiKey,
+		Enabled:     ptr(true),
+	}
+	if len(tc.models) > 0 {
+		models := make([]api.AgentNetworkProviderModel, 0, len(tc.models))
+		for _, id := range tc.models {
+			models = append(models, api.AgentNetworkProviderModel{Id: id, InputPer1k: 0.001, OutputPer1k: 0.002})
+		}
+		req.Models = &models
+	}
+	prov, err := srv.CreateProvider(ctx, req)
+	require.NoError(t, err, "create provider %s", tc.name)
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	polReq := api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-disc-live-" + tc.name,
+		Enabled:                ptr(true),
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+	}
+	if len(tc.allowlist) > 0 {
+		var gr api.AgentNetworkGuardrailRequest
+		gr.Name = "e2e-disc-live-" + tc.name
+		gr.Checks.ModelAllowlist.Enabled = true
+		gr.Checks.ModelAllowlist.Models = tc.allowlist
+		g, gerr := srv.CreateGuardrail(ctx, gr)
+		require.NoError(t, gerr, "create guardrail for %s", tc.name)
+		t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), g.Id) })
+		polReq.GuardrailIds = &[]string{g.Id}
+	}
+	pol, err := srv.CreatePolicy(ctx, polReq)
+	require.NoError(t, err, "create policy for %s", tc.name)
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	return sk.Key
+}
+
+// runLiveDiscoveryCase issues the discovery request and reports everything the
+// vendor said before asserting on any of it. The log is the point on the first
+// run: a live catalogue is the one input we do not control, so a failure has to
+// arrive with the response that caused it rather than just a count.
+func runLiveDiscoveryCase(t *testing.T, ctx context.Context, tc liveDiscoveryCase, cl *harness.Client, endpoint, proxyIP string) {
+	t.Helper()
+
+	// A single request is enough for the two non-listing outcomes, and retrying
+	// them would burn the retry window waiting for a status that is never
+	// coming.
+	if tc.outcome != outcomeFiltered {
+		code, body, err := cl.Get(ctx, endpoint, proxyIP, tc.path, tc.headers)
+		require.NoError(t, err, "request must reach the proxy")
+		t.Logf("[discovery] %s GET %s -> %d; body: %s", tc.name, tc.path, code, truncate(body, 2000))
+		assert.NotEqual(t, 200, code,
+			"%s serves no bounded listing, so a 200 here would mean the caller was handed a picker nothing narrows; body: %s",
+			tc.name, truncate(body, 2000))
+
+		// Which side refused is the whole distinction between these two
+		// outcomes, and a NetBird error is the thing that tells them apart: the
+		// middleware chain stamps its own name on anything it generates.
+		if tc.outcome == outcomeDenied {
+			assert.True(t, isProxyError(body),
+				"%s serves no listing endpoint at all, so the proxy must refuse the request itself rather than forward it to an upstream that would answer for us; body: %s",
+				tc.name, truncate(body, 2000))
+			return
+		}
+		assert.False(t, isProxyError(body),
+			"%s discovery must be routed to the configured upstream and refused by the vendor, not blocked by the proxy; body: %s",
+			tc.name, truncate(body, 2000))
+		return
+	}
+
+	code, body := callUntil(t, func() (int, string, error) {
+		return cl.Get(ctx, endpoint, proxyIP, tc.path, tc.headers)
+	}, 200)
+	// Status only, not the body. A Bedrock listing embeds inference-profile
+	// ARNs carrying the 12-digit AWS account id, and these job logs are
+	// readable by anyone who can see the run. The ids line below is the finding
+	// anyway. The failure paths below are the same log: a listing that fails to
+	// arrive is an AWS refusal naming the resource it refused, and that name is
+	// an ARN carrying the same account id.
+	t.Logf("[discovery] %s GET %s -> %d", tc.name, tc.path, code)
+	require.Equal(t, 200, code, "%s discovery must be served; response was %s", tc.name, bodyShape(body))
+
+	ids, ok := listingIDs(body)
+	require.Truef(t, ok,
+		"%s answered discovery with something other than a {\"data\":[{\"id\":…}]} listing, which the filter forwards untouched — the caller would get an unbounded picker; response was %s",
+		tc.name, bodyShape(body))
+	sort.Strings(ids)
+	t.Logf("[discovery] %s: %d ids after filtering: %s", tc.name, len(ids), strings.Join(ids, ", "))
+
+	require.NotEmpty(t, ids, "%s filtered the listing down to nothing; the caller would see an empty picker", tc.name)
+
+	permitted := make(map[string]struct{}, len(tc.permitted)*2)
+	for _, id := range tc.permitted {
+		permitted[id] = struct{}{}
+		permitted[sharedllm.NormalizeAnthropicModel(id)] = struct{}{}
+	}
+	for _, id := range ids {
+		_, direct := permitted[id]
+		_, dated := permitted[sharedllm.NormalizeAnthropicModel(id)]
+		// Bedrock ids carry a region prefix and version suffix the record may
+		// not repeat; the proxy's filter tries the same forms.
+		_, bedrock := permitted[sharedllm.NormalizeBedrockModel(id)]
+		assert.Truef(t, direct || dated || bedrock,
+			"%s offered %q, which no policy on this route permits — every entry the picker shows must be a request the guardrail would allow", tc.name, id)
+	}
+	for _, hidden := range tc.wantHidden {
+		assert.NotContainsf(t, ids, hidden,
+			"%s offered %q, which the provider enumerates but the policy does not permit", tc.name, hidden)
+	}
+}
+
+// isProxyError reports whether a response body was generated by the middleware
+// chain rather than forwarded from a vendor. Every chain-generated error names
+// the middleware that raised it, which no upstream's error body does — so this
+// separates "the proxy refused" from "the proxy routed it and the vendor
+// refused", the two failures that otherwise look alike from the client side.
+func isProxyError(body string) bool {
+	return strings.Contains(body, `"middleware":`)
+}
+
+// listingIDs pulls the model ids out of a listing response. ok is false when
+// the body is neither envelope the proxy's filter recognises — the two must
+// stay in step, or this test reports "not a listing" for a response the proxy
+// filtered perfectly well.
+func listingIDs(body string) ([]string, bool) {
+	var doc struct {
+		// OpenAI's shape, which Anthropic adopted.
+		Data []struct {
+			ID string `json:"id"`
+		} `json:"data"`
+		// Bedrock returns inference-profile summaries under a key of its own,
+		// with the id under a field of its own.
+		Summaries []struct {
+			ID string `json:"inferenceProfileId"`
+		} `json:"inferenceProfileSummaries"`
+	}
+	if err := json.Unmarshal([]byte(body), &doc); err != nil {
+		return nil, false
+	}
+	switch {
+	case doc.Data != nil:
+		ids := make([]string, 0, len(doc.Data))
+		for _, entry := range doc.Data {
+			ids = append(ids, entry.ID)
+		}
+		return ids, true
+	case doc.Summaries != nil:
+		ids := make([]string, 0, len(doc.Summaries))
+		for _, entry := range doc.Summaries {
+			ids = append(ids, entry.ID)
+		}
+		return ids, true
+	}
+	return nil, false
+}
+
+func caseNames(cases []liveDiscoveryCase) []string {
+	names := make([]string, 0, len(cases))
+	for _, c := range cases {
+		names = append(names, c.name)
+	}
+	return names
+}
+
+// bodyShape describes a response without quoting any of it: its size and the
+// top-level keys it arrived under. That is what a discovery failure is
+// diagnosed from — which envelope the vendor answered with — and it is all
+// that may go in a message rendered into a public job log, because the values
+// underneath can carry an ARN and its account id.
+func bodyShape(body string) string {
+	var doc map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(body), &doc); err != nil {
+		return strconv.Itoa(len(body)) + " bytes, not a JSON object"
+	}
+	keys := make([]string, 0, len(doc))
+	for key := range doc {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	if len(keys) == 0 {
+		return strconv.Itoa(len(body)) + " bytes, an empty JSON object"
+	}
+	return strconv.Itoa(len(body)) + " bytes, keyed by: " + strings.Join(keys, ", ")
+}
+
+// truncate bounds a logged response body. A live catalogue can run to tens of
+// kilobytes, and the useful part is the front.
+func truncate(s string, limit int) string {
+	if len(s) <= limit {
+		return s
+	}
+	return s[:limit] + "… (" + strconv.Itoa(len(s)-limit) + " more bytes)"
+}
diff --git a/e2e/agentnetwork/discovery_multipolicy_test.go b/e2e/agentnetwork/discovery_multipolicy_test.go
new file mode 100644
index 000000000..447c1314c
--- /dev/null
+++ b/e2e/agentnetwork/discovery_multipolicy_test.go
@@ -0,0 +1,170 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestDiscoveryBoundToCallersPolicies covers a model listing on a provider two
+// teams reach under different allowlists.
+//
+// Bounding the listing by the provider's enumerated models alone is not enough
+// once more than one policy is in play: the caller would be offered every model
+// any team may use, and each one outside their own policy is a request the
+// guardrail refuses a moment later — the empty-or-wrong picker this endpoint
+// exists to avoid, just moved one level up.
+//
+// The client joins the main group only. Both models are enumerated by the same
+// provider and both are advertised by the upstream, so a listing that leaked
+// the other team's model would visibly contain it.
+func TestDiscoveryBoundToCallersPolicies(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grpMain, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-disc-mp-main"})
+	require.NoError(t, err, "create main group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpMain.Id) })
+
+	grpOther, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-disc-mp-other"})
+	require.NoError(t, err, "create other group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpOther.Id) })
+
+	ephemeral := false
+	mkKey := func(name, groupID string) string {
+		sk, kerr := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+			Name:       name,
+			Type:       "reusable",
+			ExpiresIn:  86400,
+			UsageLimit: 0,
+			AutoGroups: []string{groupID},
+			Ephemeral:  &ephemeral,
+		})
+		require.NoError(t, kerr, "mint setup key %s", name)
+		require.NotEmpty(t, sk.Key, "setup key plaintext")
+		return sk.Key
+	}
+	// One client per group. The second is what makes the first assertion mean
+	// something: without a client that DOES see the other team's model, its
+	// absence from the main client's listing could equally be a policy that
+	// never propagated.
+	keyMain := mkKey("e2e-disc-mp-main-client", grpMain.Id)
+	keyOther := mkKey("e2e-disc-mp-other-client", grpOther.Id)
+
+	// One provider enumerating both models the upstream advertises, so the
+	// listing is narrowed by policy rather than by what the provider serves.
+	staticKey := "static-e2e-token"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "e2e-disc-mp",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &staticKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.001},
+			{Id: harness.VLLMUnlistedModel, InputPer1k: 0.001, OutputPer1k: 0.001},
+		},
+	})
+	require.NoError(t, err, "create provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	mkGuardrail := func(name, model string) api.AgentNetworkGuardrail {
+		var gr api.AgentNetworkGuardrailRequest
+		gr.Name = name
+		gr.Checks.ModelAllowlist.Enabled = true
+		gr.Checks.ModelAllowlist.Models = []string{model}
+		g, gerr := srv.CreateGuardrail(ctx, gr)
+		require.NoError(t, gerr, "create guardrail %s", name)
+		t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), g.Id) })
+		return g
+	}
+	gMain := mkGuardrail("e2e-disc-mp-main", harness.VLLMModel)
+	gOther := mkGuardrail("e2e-disc-mp-other", harness.VLLMUnlistedModel)
+
+	enabled := true
+	polMain, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-disc-mp-main",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpMain.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{gMain.Id},
+	})
+	require.NoError(t, err, "create main policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polMain.Id) })
+
+	// The other team's policy, on the same provider, permitting the model the
+	// client must never be offered.
+	polOther, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-disc-mp-other",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpOther.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{gOther.Id},
+	})
+	require.NoError(t, err, "create other policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polOther.Id) })
+
+	endpoint, proxyIP, clMain, px := connectClient(t, ctx, "disc-mp", keyMain)
+	clOther := joinClient(t, ctx, px, endpoint, keyOther)
+
+	listing := func(t *testing.T, cl *harness.Client, ip string) string {
+		t.Helper()
+		code, body := callUntil(t, func() (int, string, error) {
+			return cl.Get(ctx, endpoint, ip, "/v1/models?limit=1000", nil)
+		}, 200)
+		require.Equal(t, 200, code, "discovery must be served; body: %s", body)
+		return body
+	}
+
+	otherIP, err := clOther.ResolveProxyIP(ctx, endpoint)
+	require.NoError(t, err, "resolve endpoint from the other client")
+
+	// The other team's client first: seeing its own model proves polOther is
+	// live, so the main client's listing is narrowed by policy scoping rather
+	// than by the other policy having failed to apply at all.
+	otherBody := listing(t, clOther, otherIP)
+	assert.Contains(t, otherBody, harness.VLLMUnlistedModel,
+		"the other group's policy must be in force, or this test proves nothing")
+	assert.NotContains(t, otherBody, harness.VLLMModel,
+		"and it must not be offered the main group's model either — isolation runs both ways")
+
+	mainBody := listing(t, clMain, proxyIP)
+	assert.Contains(t, mainBody, harness.VLLMModel,
+		"the model the caller's own policy permits must reach the picker")
+	assert.NotContains(t, mainBody, harness.VLLMUnlistedModel,
+		"a model only another group's policy permits must not be offered to this caller")
+}
+
+// joinClient starts a second tunnel client against an already-running proxy, so
+// a test can drive the same endpoint as two different group memberships without
+// paying for a second proxy.
+func joinClient(t *testing.T, ctx context.Context, px *harness.Proxy, endpoint, setupKey string) *harness.Client {
+	t.Helper()
+
+	cl, err := harness.StartClient(ctx, srv, setupKey)
+	require.NoError(t, err, "start second client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "second client must connect to management")
+	_, err = cl.ResolveProxyIP(ctx, endpoint)
+	require.NoError(t, err, "second client could not resolve the endpoint")
+	// Guarded rather than passed straight to require: px.Logs pulls the whole
+	// proxy container log, which is only worth fetching when the wait failed.
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		require.NoError(t, err, "second client did not see the proxy peer\n=== proxy logs ===\n%s",
+			px.Logs(context.Background()))
+	}
+	return cl
+}
diff --git a/e2e/agentnetwork/gateway_protocol_test.go b/e2e/agentnetwork/gateway_protocol_test.go
new file mode 100644
index 000000000..c21a4fc53
--- /dev/null
+++ b/e2e/agentnetwork/gateway_protocol_test.go
@@ -0,0 +1,455 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// Models each catalog surface is registered with in the matrix below. They
+// differ per provider so the router's choice is unambiguous: a request that
+// lands on the wrong provider record fails the surface assertion instead of
+// passing by coincidence.
+const (
+	matrixAnthropicModel = "claude-sonnet-5"
+	matrixBedrockModel   = "anthropic.claude-sonnet-5"
+	// matrixBedrockPathModel is what a Bedrock SDK client puts in the URL: a
+	// cross-region inference profile with a release date and version suffix.
+	// The proxy must normalise it back to matrixBedrockModel to route and price.
+	matrixBedrockPathModel = "us.anthropic.claude-sonnet-5-20250101-v1:0"
+	// matrixVertexModel differs from the Anthropic record's model on purpose:
+	// a shared id would leave two routes claiming it and make which one serves
+	// /v1/messages depend on declaration order.
+	matrixVertexModel   = "claude-haiku-4-5"
+	matrixVertexProject = "e2e-project"
+	matrixVertexRegion  = "us-east5"
+)
+
+// gatewayEnv is a connected client plus a set of provider records, all pointed
+// at one mock upstream, so several wire shapes can be driven over a single
+// tunnel.
+type gatewayEnv struct {
+	endpoint string
+	proxyIP  string
+	client   *harness.Client
+	proxy    *harness.Proxy
+	vllm     *harness.VLLM
+	// providerIDs maps the catalog id to the created provider record id.
+	providerIDs map[string]string
+}
+
+// provisionGatewayMatrix brings up one mock upstream and one provider record
+// per catalog surface, all authorised for the same group by a single policy.
+// Sharing one proxy and client keeps the wire-shape cases to one tunnel setup;
+// each case still creates its own session id so its access-log row is findable.
+func provisionGatewayMatrix(t *testing.T, ctx context.Context) gatewayEnv {
+	t.Helper()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gw-matrix"})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-gw-matrix-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	// The mock ignores auth, so a dummy credential satisfies each catalog
+	// entry's auth template. Vertex is the exception: its api_key is a GCP
+	// service-account keyfile the proxy mints an OAuth token from, and a dummy
+	// one cannot mint. That is deliberate — the Vertex case below asserts on
+	// routing, which happens before the token mint.
+	dummyKey := "sk-gw-e2e"
+	dummyKeyfile := "keyfile::" + "e2e-not-a-real-service-account-key"
+
+	specs := []struct {
+		name      string
+		catalogID string
+		apiKey    string
+		models    []api.AgentNetworkProviderModel
+	}{
+		{
+			name: "openai", catalogID: "openai_api", apiKey: dummyKey,
+			models: []api.AgentNetworkProviderModel{{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002}},
+		},
+		{
+			name: "anthropic", catalogID: "anthropic_api", apiKey: dummyKey,
+			models: []api.AgentNetworkProviderModel{{Id: matrixAnthropicModel, InputPer1k: 0.003, OutputPer1k: 0.015}},
+		},
+		{
+			name: "bedrock", catalogID: "bedrock_api", apiKey: dummyKey,
+			models: []api.AgentNetworkProviderModel{{Id: matrixBedrockModel, InputPer1k: 0.003, OutputPer1k: 0.015}},
+		},
+		{
+			name: "vertex", catalogID: "vertex_ai_api", apiKey: dummyKeyfile,
+			models: []api.AgentNetworkProviderModel{{Id: matrixVertexModel, InputPer1k: 0.001, OutputPer1k: 0.005}},
+		},
+	}
+
+	providerIDs := make(map[string]string, len(specs))
+	ids := make([]string, 0, len(specs))
+	for _, spec := range specs {
+		key := spec.apiKey
+		models := spec.models
+		prov, perr := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+			Name:        "e2e-gw-" + spec.name,
+			ProviderId:  spec.catalogID,
+			UpstreamUrl: vllm.URL,
+			ApiKey:      &key,
+			Enabled:     ptr(true),
+			Models:      &models,
+		})
+		require.NoError(t, perr, "create %s provider", spec.name)
+		id := prov.Id
+		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), id) })
+		providerIDs[spec.catalogID] = id
+		ids = append(ids, id)
+	}
+
+	// Uncapped token limit: never blocks the handful of tokens driven here, but
+	// switches on usage metering so consumption and cost land in the row.
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-gw-matrix",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: ids,
+		Limits: &api.AgentNetworkPolicyLimits{
+			TokenLimit: api.AgentNetworkPolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      10_000_000,
+				UserCap:       10_000_000,
+				WindowSeconds: 60,
+			},
+		},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	endpoint, proxyIP, cl, px := connectClient(t, ctx, "gw-matrix", sk.Key)
+	return gatewayEnv{
+		endpoint:    endpoint,
+		proxyIP:     proxyIP,
+		client:      cl,
+		proxy:       px,
+		vllm:        vllm,
+		providerIDs: providerIDs,
+	}
+}
+
+// connectClient starts a proxy and a tunnel client for the shared account and
+// waits until the client can reach the proxy peer, returning the endpoint and
+// the proxy's tunnel IP to pin requests to.
+func connectClient(t *testing.T, ctx context.Context, name, setupKey string) (string, string, *harness.Client, *harness.Proxy) {
+	t.Helper()
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-"+name+"-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, setupKey)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// The probe resolves the endpoint and its first packet wakes the lazy proxy
+	// peer, so WaitProxyPeer then observes it connected.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+	return settings.Endpoint, proxyIP, cl, px
+}
+
+// callUntil retries an HTTP call through the tunnel until it returns one of the
+// wanted statuses or the deadline passes, absorbing the DNS and tunnel jitter
+// the first call through a fresh tunnel can hit. The last status and body are
+// returned either way so the caller can assert with real detail.
+func callUntil(t *testing.T, call func() (int, string, error), want ...int) (int, string) {
+	t.Helper()
+	wanted := make(map[int]struct{}, len(want))
+	for _, w := range want {
+		wanted[w] = struct{}{}
+	}
+
+	var code int
+	var body string
+	deadline := time.Now().Add(90 * time.Second)
+	for time.Now().Before(deadline) {
+		c, b, err := call()
+		if err == nil {
+			code, body = c, b
+			if _, ok := wanted[code]; ok {
+				return code, body
+			}
+		}
+		time.Sleep(5 * time.Second)
+	}
+	return code, body
+}
+
+// TestGatewayProtocolProviderMatrix drives one request per wire shape over a
+// single tunnel, with a provider record per catalog surface behind it. It is
+// the regression net for the routing and parser-selection changes: each case
+// asserts the surface the request was metered under and the token counts that
+// surface's own usage block carries, so a request parsed by the wrong provider's
+// parser meters zero and fails rather than passing on a coincidence.
+func TestGatewayProtocolProviderMatrix(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	env := provisionGatewayMatrix(t, ctx)
+	diag := func() string {
+		return fmt.Sprintf("\n=== upstream logs ===\n%s\n=== proxy logs ===\n%s",
+			env.vllm.Logs(context.Background()), env.proxy.Logs(context.Background()))
+	}
+
+	t.Run("openai chat completions", func(t *testing.T) {
+		session := "e2e-gw-openai"
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireChat, harness.VLLMModel, "ping", session)
+		}, 200)
+		require.Equal(t, 200, code, "openai chat must succeed; body: %s%s", body, diag())
+		require.Contains(t, body, "chat.completion", "body must be an OpenAI completion; got: %s", body)
+
+		row := findAccessLogBySession(t, ctx, session)
+		require.NotNil(t, row.Provider)
+		assert.Equal(t, "openai", *row.Provider, "the OpenAI chat path must meter under the openai surface")
+		assert.Equal(t, int64(harness.VLLMChatInputTokens), row.InputTokens, "OpenAI usage block must be read")
+		assert.Equal(t, int64(harness.VLLMChatOutputTokens), row.OutputTokens)
+	})
+
+	t.Run("anthropic messages", func(t *testing.T) {
+		session := "e2e-gw-anthropic"
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages, matrixAnthropicModel, "ping", session)
+		}, 200)
+		require.Equal(t, 200, code, "anthropic messages must succeed; body: %s%s", body, diag())
+
+		row := findAccessLogBySession(t, ctx, session)
+		require.NotNil(t, row.Provider)
+		assert.Equal(t, "anthropic", *row.Provider, "the /v1/messages path must meter under the anthropic surface")
+		// These counts only appear if the Anthropic parser read the response:
+		// its usage fields are named differently from the OpenAI block.
+		assert.Equal(t, int64(harness.VLLMMessagesInputTokens), row.InputTokens,
+			"Anthropic input_tokens must be read; zero here means the wrong parser ran")
+		assert.Equal(t, int64(harness.VLLMMessagesOutputTokens), row.OutputTokens)
+		assert.Positive(t, row.CachedInputTokens, "the Anthropic cache-read bucket must be recorded")
+		assert.Positive(t, row.CostUsd, "a metered request must carry a cost")
+		require.NotNil(t, row.ResolvedProviderId)
+		assert.Equal(t, env.providerIDs["anthropic_api"], *row.ResolvedProviderId,
+			"a vendor-tagged request must not cross to another provider's record")
+	})
+
+	t.Run("bedrock invoke normalises the path model", func(t *testing.T) {
+		session := "e2e-gw-bedrock"
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Bedrock(ctx, env.endpoint, env.proxyIP, matrixBedrockPathModel, "ping", session)
+		}, 200)
+		require.Equal(t, 200, code, "bedrock invoke must succeed; body: %s%s", body, diag())
+
+		row := findAccessLogBySession(t, ctx, session)
+		require.NotNil(t, row.Provider)
+		assert.Equal(t, "bedrock", *row.Provider, "a native Bedrock path must meter under the bedrock surface")
+		require.NotNil(t, row.Model)
+		assert.Equal(t, matrixBedrockModel, *row.Model,
+			"the inference-profile prefix, release date and version suffix must be normalised away")
+		assert.Equal(t, int64(harness.VLLMMessagesInputTokens), row.InputTokens)
+	})
+
+	t.Run("anthropic token counting", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP, "/v1/messages/count_tokens",
+				fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":"ping"}]}`, matrixAnthropicModel),
+				[]string{"anthropic-version: 2023-06-01"})
+		}, 200)
+		assert.Equal(t, 200, code, "token counting must route rather than deny; body: %s%s", body, diag())
+	})
+
+	t.Run("bedrock token counting", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP,
+				"/model/"+matrixBedrockPathModel+"/count-tokens",
+				`{"input":{"converse":{"messages":[{"role":"user","content":[{"text":"ping"}]}]}}}`, nil)
+		}, 200)
+		assert.Equal(t, 200, code,
+			"the Bedrock count-tokens action must route; denying it pushes counting onto the billable inference path; body: %s%s",
+			body, diag())
+	})
+
+	t.Run("vertex token counting reaches its provider", func(t *testing.T) {
+		// The dummy service-account key cannot mint an OAuth token, so the
+		// request stops at the upstream credential. Both outcomes render as
+		// 403, so the deny code is what distinguishes them: upstream_auth_failed
+		// means the path resolved to the Vertex route and only the credential
+		// failed, while model_not_routable would mean the method segment was
+		// swallowed into the model id and no route ever claimed it.
+		path := fmt.Sprintf("/v1/projects/%s/locations/%s/publishers/anthropic/models/%s/count-tokens:rawPredict",
+			matrixVertexProject, matrixVertexRegion, matrixVertexModel)
+		_, body := callUntil(t, func() (int, string, error) {
+			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP, path,
+				`{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"ping"}]}`, nil)
+		}, 403)
+		assert.NotContains(t, body, "model_not_routable",
+			"the count-tokens method segment must not be parsed as part of the model id; body: %s%s", body, diag())
+		assert.Contains(t, body, "llm_policy.upstream_auth_failed",
+			"the request must reach the Vertex route and fail only at the credential; body: %s%s", body, diag())
+	})
+
+	t.Run("connection warming probe", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Get(ctx, env.endpoint, env.proxyIP, "/api/hello", nil)
+		}, 200)
+		assert.NotEqual(t, 403, code,
+			"the warm-up probe carries no model and must not be refused as unroutable; body: %s%s", body, diag())
+	})
+
+	t.Run("unknown model denies in the caller's error shape", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages,
+				"claude-not-a-real-model-9", "ping", "e2e-gw-unknown")
+		}, 403)
+		require.Equal(t, 403, code, "a model no provider claims must still be refused; body: %s%s", body, diag())
+
+		// The NetBird fields stay where they were for existing consumers.
+		assert.Contains(t, body, "llm_policy.model_not_routable", "the deny code must be preserved")
+		// And the vendor's own envelope rides alongside, so the client can show
+		// the reason instead of an unexplained API error.
+		assert.Contains(t, body, `"type":"error"`, "an Anthropic caller must get the Anthropic error envelope")
+		assert.Contains(t, body, "permission_error", "403 must map to the vendor's permission error type")
+	})
+}
+
+// TestModelDiscoveryWithModelAllowlist covers gateway model discovery on an
+// account that restricts models, which is the configuration that broke: the
+// listing carries no model, and the per-model allowlist fails closed on an
+// undetermined one, so discovery denied for exactly the accounts using the
+// feature. It also asserts the allowlist still refuses a model outside it, so
+// the exemption cannot be read as a way around the gate.
+func TestModelDiscoveryWithModelAllowlist(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gw-discovery"})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-gw-discovery-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	// One provider enumerating a single model, while the upstream's own listing
+	// advertises two. The proxy must serve the shorter list.
+	dummyKey := "sk-discovery-e2e"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "e2e-gw-discovery",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &dummyKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002},
+		},
+	})
+	require.NoError(t, err, "create provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	// The model allowlist is what makes this a regression test: without a
+	// guardrail enabled, discovery was never gated in the first place.
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = "e2e-gw-discovery-allowlist"
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = []string{harness.VLLMModel}
+	guard, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail")
+	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-gw-discovery",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{guard.Id},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	endpoint, proxyIP, cl, px := connectClient(t, ctx, "gw-discovery", sk.Key)
+	diag := func() string {
+		return fmt.Sprintf("\n=== upstream logs ===\n%s\n=== proxy logs ===\n%s",
+			vllm.Logs(context.Background()), px.Logs(context.Background()))
+	}
+
+	t.Run("listing is served and bounded by policy", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return cl.Get(ctx, endpoint, proxyIP, "/v1/models?limit=1000", nil)
+		}, 200)
+		require.Equal(t, 200, code,
+			"discovery must not be refused because the request carries no model; body: %s%s", body, diag())
+
+		assert.Contains(t, body, harness.VLLMModel, "the authorised model must reach the picker")
+		assert.NotContains(t, body, harness.VLLMUnlistedModel,
+			"a model the policy does not authorise must not be offered; body: %s", body)
+	})
+
+	t.Run("allowlist still refuses a model outside it", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return cl.Chat(ctx, endpoint, proxyIP, harness.WireChat,
+				harness.VLLMUnlistedModel, "ping", "e2e-gw-discovery-blocked")
+		}, 403)
+		require.Equal(t, 403, code,
+			"exempting model-less endpoints must not exempt inference; body: %s%s", body, diag())
+		assert.True(t,
+			strings.Contains(body, "llm_policy.model_blocked") || strings.Contains(body, "llm_policy.model_not_routable"),
+			"the refusal must name a model policy code; body: %s", body)
+	})
+
+	t.Run("allowlisted model still routes", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return cl.Chat(ctx, endpoint, proxyIP, harness.WireChat,
+				harness.VLLMModel, "ping", "e2e-gw-discovery-allowed")
+		}, 200)
+		require.Equal(t, 200, code, "the allowlisted model must still be served; body: %s%s", body, diag())
+	})
+}
diff --git a/e2e/agentnetwork/gateway_review_test.go b/e2e/agentnetwork/gateway_review_test.go
new file mode 100644
index 000000000..556bc4a53
--- /dev/null
+++ b/e2e/agentnetwork/gateway_review_test.go
@@ -0,0 +1,242 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// The cases in this file cover behaviour that arrived from code review, after
+// the gateway-protocol end-to-end tests were written. Each had unit coverage
+// only; none needed a new harness capability, which is why they belong here
+// rather than on a manual checklist.
+
+// TestNonInferenceEndpointsAreAuthorised covers the two review findings on the
+// endpoints that carry no body: the per-model lookup must be authorised
+// against the same allowlist that bounds the listing beside it, and only a read
+// method may claim the non-inference exemption that skips the token pre-flight.
+func TestNonInferenceEndpointsAreAuthorised(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	env := provisionDiscoveryProvider(t, ctx)
+
+	t.Run("lookup of an authorised model succeeds", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Get(ctx, env.endpoint, env.proxyIP, "/v1/models/"+harness.VLLMModel, nil)
+		}, 200)
+		assert.Equal(t, 200, code, "an allowlisted model must remain reachable; body: %s", body)
+	})
+
+	t.Run("lookup of an unauthorised model is refused", func(t *testing.T) {
+		code, body, err := env.client.Get(ctx, env.endpoint, env.proxyIP, "/v1/models/"+harness.VLLMUnlistedModel, nil)
+		require.NoError(t, err, "request must reach the proxy")
+		assert.Equal(t, 403, code,
+			"a model the policy does not authorise must not be confirmed by the detail lookup; body: %s", body)
+	})
+
+	// A write must not claim the exemption that lets the listing skip the token
+	// pre-flight. The body names no model on purpose: that is what a request
+	// probing for the exemption looks like, and it is the case the method gate
+	// exists to refuse. (A POST that does name a model is a different thing —
+	// it routes and meters as the inference request it is.)
+	for _, path := range []string{"/v1/models", "/v1/models/" + harness.VLLMModel, "/api/hello"} {
+		t.Run("write to "+path+" is refused", func(t *testing.T) {
+			code, body, err := env.client.PostJSON(ctx, env.endpoint, env.proxyIP, path,
+				`{"messages":[{"role":"user","content":"hi"}]}`, nil)
+			require.NoError(t, err, "request must reach the proxy")
+			assert.NotEqual(t, 200, code,
+				"a write to a non-inference path must not be served unmetered; body: %s", body)
+		})
+	}
+
+	// A request carrying the sub-agent attribution headers must still be served
+	// and metered normally. Asserting the ids themselves is not possible yet:
+	// the parser lifts them onto the request's metadata, but nothing persists
+	// them, so they have no queryable surface to check against.
+	t.Run("sub-agent headers do not disturb the request", func(t *testing.T) {
+		sessionID := fmt.Sprintf("e2e-session-agentid-%d", time.Now().UnixNano())
+		code, body, err := env.client.PostJSON(ctx, env.endpoint, env.proxyIP, "/v1/chat/completions",
+			fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":"Reply with exactly: pong"}]}`, harness.VLLMModel),
+			[]string{
+				"x-session-id: " + sessionID,
+				"x-claude-code-agent-id: agent-child-7",
+				"x-claude-code-parent-agent-id: agent-root-1",
+			})
+		require.NoError(t, err, "request must reach the proxy")
+		require.Equal(t, 200, code, "the request must succeed; body: %s", body)
+
+		row := findAccessLogBySession(t, ctx, sessionID)
+		assert.Positive(t, row.InputTokens, "the request must still be metered normally")
+	})
+}
+
+// TestDatedModelIdRouting covers both halves of the dated-id rule that review
+// tightened: a dated id still reaches an undated registration, but a route
+// pinned to one dated build must never serve a different one.
+func TestDatedModelIdRouting(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	const (
+		undated = "claude-sonnet-9"
+		datedA  = "claude-sonnet-9-20250101"
+		datedB  = "claude-sonnet-9-20250202"
+	)
+
+	t.Run("a dated id reaches its undated registration", func(t *testing.T) {
+		env := provisionModelProvider(t, ctx, "dated-undated", "anthropic_api", undated)
+
+		sessionID := fmt.Sprintf("e2e-session-dated-%d", time.Now().UnixNano())
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages, datedA, "Reply with exactly: pong", sessionID)
+		}, 200)
+		require.Equal(t, 200, code, "a pinned release of a registered family must route; body: %s", body)
+
+		row := findAccessLogBySession(t, ctx, sessionID)
+		assert.Positive(t, row.InputTokens, "the dated request must price at the registered rate, not zero")
+	})
+
+	t.Run("a route pinned to one dated build refuses another", func(t *testing.T) {
+		env := provisionModelProvider(t, ctx, "dated-pinned", "anthropic_api", datedA)
+
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages, datedA, "Reply with exactly: pong", "")
+		}, 200)
+		require.Equal(t, 200, code, "the exact dated id must still route; body: %s", body)
+
+		code, body, err := env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages, datedB, "Reply with exactly: pong", "")
+		require.NoError(t, err, "request must reach the proxy")
+		assert.Equal(t, 403, code,
+			"a provider pinned to one dated build must not serve another; body: %s", body)
+	})
+}
+
+// TestBedrockInferenceProfilesReachTheUpstream covers the startup lookup a
+// Bedrock client makes. The proxy forwards it to the configured upstream rather
+// than denying it, so what comes back is the upstream's answer — never a
+// NetBird policy rejection.
+func TestBedrockInferenceProfilesReachTheUpstream(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	env := provisionModelProvider(t, ctx, "infprofiles", "bedrock_api", "anthropic.claude-sonnet-5")
+
+	code, body := callUntil(t, func() (int, string, error) {
+		return env.client.Get(ctx, env.endpoint, env.proxyIP, "/inference-profiles", nil)
+	}, 200)
+
+	assert.Equal(t, 200, code, "the lookup must reach the upstream; body: %s", body)
+	assert.NotContains(t, body, "llm_policy.",
+		"the proxy must not answer a control-plane lookup with a policy denial")
+	assert.Contains(t, body, "inferenceProfileSummaries",
+		"the upstream's own answer must come back untouched")
+}
+
+// provisionDiscoveryProvider brings up one mock-backed provider enumerating a
+// single model, with an allowlist guardrail in effect, plus a connected client.
+func provisionDiscoveryProvider(t *testing.T, ctx context.Context) pricedEnv {
+	t.Helper()
+	env := provisionModelProvider(t, ctx, "noninference", "openai_api", harness.VLLMModel)
+
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = "e2e-noninference-allowlist-" + fmt.Sprint(time.Now().UnixNano())
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = []string{harness.VLLMModel}
+	guard, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail")
+	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
+
+	enabled := true
+	_, err = srv.UpdatePolicy(ctx, env.policyID, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-noninference",
+		Enabled:                &enabled,
+		SourceGroups:           []string{env.groupID},
+		DestinationProviderIds: []string{env.providerID},
+		GuardrailIds:           &[]string{guard.Id},
+	})
+	require.NoError(t, err, "attach guardrail to policy")
+	return env
+}
+
+// provisionModelProvider brings up the mock, one provider under the given
+// catalog id enumerating exactly one model, an authorising policy, and a
+// connected proxy + client.
+func provisionModelProvider(t *testing.T, ctx context.Context, name, catalogID, model string) pricedEnv {
+	t.Helper()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	suffix := strings.ToLower(name)
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gwr-" + suffix})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-gwr-" + suffix + "-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	dummyKey := "sk-gwr-e2e"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "e2e-gwr-" + suffix,
+		ProviderId:  catalogID,
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &dummyKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: model, InputPer1k: 0.001, OutputPer1k: 0.002},
+		},
+	})
+	require.NoError(t, err, "create provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-gwr-" + suffix,
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		Limits: &api.AgentNetworkPolicyLimits{
+			TokenLimit: api.AgentNetworkPolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      10_000_000,
+				UserCap:       10_000_000,
+				WindowSeconds: 60,
+			},
+		},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	endpoint, proxyIP, cl, px := connectClient(t, ctx, "gwr-"+suffix, sk.Key)
+	return pricedEnv{
+		providerID: prov.Id,
+		groupID:    grp.Id,
+		policyID:   pol.Id,
+		upstream:   vllm.URL,
+		endpoint:   endpoint,
+		proxyIP:    proxyIP,
+		client:     cl,
+		proxy:      px,
+	}
+}
diff --git a/e2e/agentnetwork/guardrail_block_test.go b/e2e/agentnetwork/guardrail_block_test.go
new file mode 100644
index 000000000..302b5107e
--- /dev/null
+++ b/e2e/agentnetwork/guardrail_block_test.go
@@ -0,0 +1,208 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// pathRoutedGuardrailCase is one provider's self-contained scenario: its own
+// provider, its own guardrail whose allowlist holds ONLY that provider's
+// allowed model, and its own policy. Each case runs in isolation (its own
+// proxy + client), so the guardrail the proxy enforces contains exactly this
+// provider's model — never a mixed cross-provider list.
+type pathRoutedGuardrailCase struct {
+	name       string
+	catalogID  string // agent-network catalog provider id
+	wire       string // harness.WireVertex | harness.WireBedrock
+	allowEntry string // the single model id put on the guardrail allowlist
+	allowModel string // model id sent that MUST be served (200)
+	blockModel string // model id sent that MUST be denied (403 model_blocked)
+}
+
+// TestGuardrailBlocksUnselectedModel_PathRouted is the end-to-end regression
+// guard for the customer report that a model-allowlist guardrail attached to a
+// policy has no effect for PATH-ROUTED providers — where the model travels in
+// the URL, not the JSON body: Google Vertex (…/models/{model}:rawPredict) and
+// AWS Bedrock (/model/{id}/invoke).
+//
+// Each provider is tested in isolation with a guardrail allowlisting a single
+// model of its own: the allowed model (in the URL path) is served (200) and an
+// unselected model (in the URL path) is denied 403 by the guardrail
+// (llm_policy.model_blocked) before the upstream. The Vertex case mirrors the
+// customer verbatim — allow Sonnet, and the unselected model is the exact
+// claude-opus-4-6 they reported reaching the model unblocked. The Bedrock case
+// sends a region-prefixed, versioned inference-profile id so URL-path model
+// normalization is exercised too.
+//
+// The provider is catch-all (no models), so the router forwards any model and a
+// 403 can only come from the guardrail, never model_not_routable. Only the
+// upstream LLM is mocked (the vLLM nginx answers any path with 200); management
+// synth/reconcile, the proxy middleware chain (URL-path model extraction,
+// router, guardrail) and the tunnel are all real, and the guardrail denies
+// before the upstream is dialed so the mock cannot influence the block. A
+// static bearer api key is used so the router injects a static Authorization
+// header instead of minting a GCP token — the only reason path-routed providers
+// normally need live credentials — so the test runs with none and is always on.
+func TestGuardrailBlocksUnselectedModel_PathRouted(t *testing.T) {
+	cases := []pathRoutedGuardrailCase{
+		{
+			name:       "vertex",
+			catalogID:  "vertex_ai_api",
+			wire:       harness.WireVertex,
+			allowEntry: "claude-sonnet-4-5",
+			allowModel: "claude-sonnet-4-5",
+			blockModel: "claude-opus-4-6", // the customer-reported model
+		},
+		{
+			name:       "bedrock",
+			catalogID:  "bedrock_api",
+			wire:       harness.WireBedrock,
+			allowEntry: "anthropic.claude-sonnet-4-5", // normalized catalog id
+			allowModel: "us.anthropic.claude-sonnet-4-5-v1:0",
+			blockModel: "us.anthropic.claude-opus-4-8-v1:0",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			runPathRoutedGuardrailCase(t, tc)
+		})
+	}
+}
+
+func runPathRoutedGuardrailCase(t *testing.T, tc pathRoutedGuardrailCase) {
+	t.Helper()
+
+	const (
+		vertexProject = "e2e-project"
+		vertexRegion  = "global"
+	)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-guardrail-" + tc.name})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-guardrail-" + tc.name + "-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	// Catch-all provider (no models) so the router forwards any model; a static
+	// bearer key means the router injects a static auth header instead of minting
+	// a GCP token.
+	staticKey := "static-e2e-token"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        tc.name,
+		ProviderId:  tc.catalogID,
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &staticKey,
+		Enabled:     ptr(true),
+	})
+	require.NoError(t, err, "create %s provider", tc.name)
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	// Guardrail allowlisting ONLY this provider's allowed model.
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = "e2e-guardrail-" + tc.name
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = []string{tc.allowEntry}
+	guard, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail")
+	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-guardrail-" + tc.name,
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{guard.Id},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-guardrail-"+tc.name+"-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Probe first: the GET resolves the endpoint and its first packet wakes the
+	// lazy proxy peer, so WaitProxyPeer then observes it connected.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	send := func(model string) (int, string) {
+		var code int
+		var body string
+		var cerr error
+		switch tc.wire {
+		case harness.WireVertex:
+			code, body, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, vertexProject, vertexRegion, model, "Reply with exactly: pong", "")
+		case harness.WireBedrock:
+			code, body, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, model, "Reply with exactly: pong", "")
+		default:
+			t.Fatalf("unsupported wire %q", tc.wire)
+		}
+		require.NoError(t, cerr, "request must reach the proxy for %s", tc.name)
+		return code, body
+	}
+
+	// Allowed model (in the URL path) is served. Retry to absorb tunnel/DNS
+	// jitter on the first call over the freshly warmed tunnel.
+	var code int
+	var body string
+	deadline := time.Now().Add(90 * time.Second)
+	for time.Now().Before(deadline) {
+		code, body = send(tc.allowModel)
+		if code == 200 {
+			break
+		}
+		time.Sleep(5 * time.Second)
+	}
+	assert.Equal(t, 200, code,
+		"allowed %s model (URL path) must be served; body: %s\n=== proxy logs ===\n%s", tc.name, body, px.Logs(context.Background()))
+
+	// Unselected model (in the URL path) must be blocked by the guardrail.
+	code, body = send(tc.blockModel)
+	assert.Equal(t, 403, code,
+		"unselected %s model (URL path) must be denied, not served; body: %s\n=== proxy logs ===\n%s", tc.name, body, px.Logs(context.Background()))
+	assert.Contains(t, body, "llm_policy.model_blocked",
+		"%s denial must come from the guardrail allowlist, not routing; body: %s", tc.name, body)
+}
diff --git a/e2e/agentnetwork/guardrail_declared_ids_test.go b/e2e/agentnetwork/guardrail_declared_ids_test.go
new file mode 100644
index 000000000..a34d545be
--- /dev/null
+++ b/e2e/agentnetwork/guardrail_declared_ids_test.go
@@ -0,0 +1,132 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestModelAllowlistOfDeclaredIDsServed drives the setup an operator actually
+// builds for a path-routed provider: the models are declared in the form the
+// vendor issues (Bedrock's region-prefixed, versioned inference-profile id;
+// Vertex's model@version), and the guardrail allowlist is built from that
+// declared list — the dashboard's allowlist picker persists the declared ids
+// verbatim. A request for the declared model must be served end to end, and a
+// model outside the allowlist must still be denied.
+//
+// TestModelAllowlistEnforced never caught this because it registers and
+// allowlists the pre-normalized catalog form (see the catalogModel comment
+// there and the one in providerRequest: "register the normalized form here or
+// routing fails as model_not_routable") — the harness encoded the
+// canonicalization workaround instead of the shape operators configure.
+func TestModelAllowlistOfDeclaredIDsServed(t *testing.T) {
+	var providers []providerCase
+	for _, pc := range availableProviders() {
+		if pc.kind == harness.WireBedrock || pc.kind == harness.WireVertex {
+			providers = append(providers, pc)
+		}
+	}
+	if len(providers) == 0 {
+		t.Skip("no path-routed provider keys set (AWS_BEARER_TOKEN_BEDROCK / GOOGLE_VERTEX_*); source ~/.llm-keys")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-declared-allowlist"})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-declared-allowlist-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	t.Cleanup(func() { _ = srv.API().SetupKeys.Delete(context.Background(), sk.Id) })
+
+	// Providers declaring the raw vendor-issued model id — NOT the normalized
+	// catalog form providerRequest would register.
+	ids := make([]string, 0, len(providers))
+	declared := make([]string, 0, len(providers))
+	for _, pc := range providers {
+		req := providerRequest(pc)
+		req.Models = &[]api.AgentNetworkProviderModel{{Id: pc.model, InputPer1k: 0.001, OutputPer1k: 0.002}}
+		prov, perr := srv.CreateProvider(ctx, req)
+		require.NoError(t, perr, "create provider %s", pc.name)
+		id := prov.Id
+		ids = append(ids, id)
+		declared = append(declared, pc.model)
+		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), id) })
+	}
+
+	// Guardrail allowlisting the declared ids verbatim, the way the dashboard
+	// builds an allowlist from the providers' model lists.
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = "e2e-declared-allowlist"
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = declared
+	guard, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail")
+	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-declared-allowlist",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: ids,
+		GuardrailIds:           &[]string{guard.Id},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings for endpoint")
+	require.NotEmpty(t, settings.Endpoint, "agent-network endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-proxy-declared-allowlist")
+	require.NoError(t, err, "mint proxy token via CLI")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Probe first: the GET resolves the endpoint (DNS error fails) and its first packet wakes the lazy proxy peer, so WaitProxyPeer sees it connected; any HTTP status counts.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	for _, pc := range providers {
+		pc := pc
+		t.Run(pc.name, func(t *testing.T) {
+			// The model the operator declared and allowlisted is served end to
+			// end: the route must claim it and the guardrail must permit it,
+			// both through the canonicalization the parser applies at request
+			// time — whatever id form the operator configured.
+			assert.Equal(t, 200, sendModel(ctx, t, cl, settings.Endpoint, proxyIP, pc, pc.model),
+				"the declared and allowlisted model must be served for %s", pc.name)
+			// A model outside the allowlist stays denied.
+			assert.Equal(t, 403, sendModel(ctx, t, cl, settings.Endpoint, proxyIP, pc, disallowedModel(pc)),
+				"model outside the allowlist must be denied for %s", pc.name)
+		})
+	}
+}
diff --git a/e2e/agentnetwork/guardrail_groupswitch_test.go b/e2e/agentnetwork/guardrail_groupswitch_test.go
new file mode 100644
index 000000000..7108bb587
--- /dev/null
+++ b/e2e/agentnetwork/guardrail_groupswitch_test.go
@@ -0,0 +1,204 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestGuardrailGroupSwitchTakesEffectAfterTTL proves that moving a peer between
+// groups flips its model-allowlist decision once the proxy's tunnel-peer cache
+// expires. The peer's groups reach the guardrail via ValidateTunnelPeer, which
+// the proxy caches; the switch is invisible until that cache expires. The proxy
+// runs with a short NB_PROXY_TUNNEL_CACHE_TTL so the flip happens in seconds
+// instead of the 5-minute default.
+//
+// Setup: one catch-all provider declaring modelA + modelB; polA (grpA -> allow
+// modelA) and polB (grpB -> allow modelB). The client starts in grpA. modelA is
+// served and modelB denied; after switching the client grpA -> grpB, modelB is
+// served and modelA denied. The cross-group deny comes from management's
+// per-policy/group CheckLLMPolicyLimits (the proxy backstop carries the union).
+func TestGuardrailGroupSwitchTakesEffectAfterTTL(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	const (
+		modelA = "e2e-model-a"
+		modelB = "e2e-model-b"
+		// Short tunnel-cache TTL so a group switch propagates in seconds.
+		// Exercises the NB_PROXY_TUNNEL_CACHE_TTL override.
+		cacheTTL = 3 * time.Second
+	)
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grpA, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gswitch-a"})
+	require.NoError(t, err, "create group A")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpA.Id) })
+
+	grpB, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gswitch-b"})
+	require.NoError(t, err, "create group B")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpB.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-gswitch-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grpA.Id}, // client starts in group A
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	staticKey := "static-e2e-token"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "gswitch",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &staticKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: modelA, InputPer1k: 0.001, OutputPer1k: 0.001},
+			{Id: modelB, InputPer1k: 0.001, OutputPer1k: 0.001},
+		},
+	})
+	require.NoError(t, err, "create provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	mkGuard := func(name, model string) api.AgentNetworkGuardrail {
+		var gr api.AgentNetworkGuardrailRequest
+		gr.Name = name
+		gr.Checks.ModelAllowlist.Enabled = true
+		gr.Checks.ModelAllowlist.Models = []string{model}
+		g, gerr := srv.CreateGuardrail(ctx, gr)
+		require.NoError(t, gerr, "create guardrail %s", name)
+		t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), g.Id) })
+		return g
+	}
+	gA := mkGuard("e2e-gswitch-a", modelA)
+	gB := mkGuard("e2e-gswitch-b", modelB)
+
+	enabled := true
+	polA, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-gswitch-a",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpA.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{gA.Id},
+	})
+	require.NoError(t, err, "create policy A")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polA.Id) })
+
+	polB, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-gswitch-b",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpB.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{gB.Id},
+	})
+	require.NoError(t, err, "create policy B")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polB.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-gswitch-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken, map[string]string{
+		"NB_PROXY_TUNNEL_CACHE_TTL": cacheTTL.String(),
+	})
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	send := func(model string) (int, string) {
+		code, body, cerr := cl.Chat(ctx, settings.Endpoint, proxyIP, harness.WireChat, model, "Reply with exactly: pong", "")
+		require.NoError(t, cerr, "request must reach the proxy")
+		return code, body
+	}
+	sendUntil := func(model string, want int, timeout time.Duration) (int, string) {
+		var code int
+		var body string
+		deadline := time.Now().Add(timeout)
+		for time.Now().Before(deadline) {
+			code, body = send(model)
+			if code == want {
+				return code, body
+			}
+			time.Sleep(2 * time.Second)
+		}
+		return code, body
+	}
+
+	// Phase 1 — client is in group A: modelA served, modelB denied.
+	code, body := sendUntil(modelA, 200, 90*time.Second)
+	assert.Equal(t, 200, code,
+		"group-A model must be served while the client is in group A; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+	code, body = send(modelB)
+	assert.Equal(t, 403, code,
+		"group-B model must be denied while the client is in group A; body: %s", body)
+	assert.Contains(t, body, "llm_policy.model_blocked")
+
+	// Switch the client peer from group A to group B.
+	peerID := clientPeerInGroup(t, ctx, grpA.Id)
+	_, err = srv.API().Groups.Update(ctx, grpB.Id, api.PutApiGroupsGroupIdJSONRequestBody{
+		Name:  grpB.Name,
+		Peers: &[]string{peerID},
+	})
+	require.NoError(t, err, "add peer to group B")
+	_, err = srv.API().Groups.Update(ctx, grpA.Id, api.PutApiGroupsGroupIdJSONRequestBody{
+		Name:  grpA.Name,
+		Peers: &[]string{},
+	})
+	require.NoError(t, err, "remove peer from group A")
+
+	// Phase 2 — after the short TTL expires the proxy re-validates the peer,
+	// sees group B, and the decision flips. Poll to absorb TTL + re-validation.
+	code, body = sendUntil(modelB, 200, 60*time.Second)
+	assert.Equal(t, 200, code,
+		"after the group switch + TTL, the group-B model must be served; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+	code, body = send(modelA)
+	assert.Equal(t, 403, code,
+		"after the switch, the old group-A model must be denied; body: %s", body)
+	assert.Contains(t, body, "llm_policy.model_blocked")
+}
+
+// clientPeerInGroup returns the id of the single peer that is a member of the
+// given group — the test client. The proxy peer is never added to test groups.
+func clientPeerInGroup(t *testing.T, ctx context.Context, groupID string) string {
+	t.Helper()
+	peers, err := srv.API().Peers.List(ctx)
+	require.NoError(t, err, "list peers")
+	for _, p := range peers {
+		for _, g := range p.Groups {
+			if g.Id == groupID {
+				return p.Id
+			}
+		}
+	}
+	t.Fatalf("no peer found in group %s", groupID)
+	return ""
+}
diff --git a/e2e/agentnetwork/guardrail_multipolicy_test.go b/e2e/agentnetwork/guardrail_multipolicy_test.go
new file mode 100644
index 000000000..2bb56b3bc
--- /dev/null
+++ b/e2e/agentnetwork/guardrail_multipolicy_test.go
@@ -0,0 +1,200 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestGuardrailMultiPolicyModelAllowlist: modelSelected served (200), grpOther's
+// modelOther denied for the grpMain client (403 model_blocked, no cross-group
+// leak), and openModel on the un-guardrailed policy's provider served (200).
+func TestGuardrailMultiPolicyModelAllowlist(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	const (
+		modelSelected = "e2e-selected"
+		modelOther    = "e2e-other"
+		openModel     = "e2e-open"
+	)
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grpMain, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-guardrail-mp-main"})
+	require.NoError(t, err, "create main group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpMain.Id) })
+
+	grpOther, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-guardrail-mp-other"})
+	require.NoError(t, err, "create other group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpOther.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-guardrail-mp-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grpMain.Id}, // client joins grpMain only
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	staticKey := "static-e2e-token"
+	models := func(ids ...string) *[]api.AgentNetworkProviderModel {
+		out := make([]api.AgentNetworkProviderModel, 0, len(ids))
+		for _, id := range ids {
+			out = append(out, api.AgentNetworkProviderModel{Id: id, InputPer1k: 0.001, OutputPer1k: 0.001})
+		}
+		return &out
+	}
+
+	// pRestricted declares the two guardrailed models so routing is deterministic
+	// (model -> provider).
+	pRestricted, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "restricted",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &staticKey,
+		Enabled:     ptr(true),
+		Models:      models(modelSelected, modelOther),
+	})
+	require.NoError(t, err, "create restricted provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), pRestricted.Id) })
+
+	pOpen, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "open",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &staticKey,
+		Enabled:     ptr(true),
+		Models:      models(openModel),
+	})
+	require.NoError(t, err, "create open provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), pOpen.Id) })
+
+	mkGuardrail := func(name, model string) api.AgentNetworkGuardrail {
+		var gr api.AgentNetworkGuardrailRequest
+		gr.Name = name
+		gr.Checks.ModelAllowlist.Enabled = true
+		gr.Checks.ModelAllowlist.Models = []string{model}
+		g, gerr := srv.CreateGuardrail(ctx, gr)
+		require.NoError(t, gerr, "create guardrail %s", name)
+		t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), g.Id) })
+		return g
+	}
+	gMain := mkGuardrail("e2e-guardrail-mp-main", modelSelected)
+	gOther := mkGuardrail("e2e-guardrail-mp-other", modelOther)
+
+	enabled := true
+	// polMain: grpMain restricted to modelSelected on pRestricted.
+	polMain, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-guardrail-mp-main",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpMain.Id},
+		DestinationProviderIds: []string{pRestricted.Id},
+		GuardrailIds:           &[]string{gMain.Id},
+	})
+	require.NoError(t, err, "create main policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polMain.Id) })
+
+	// polOther: grpOther restricted to modelOther on the SAME provider. The
+	// client is not in grpOther, so modelOther must never be usable by it.
+	polOther, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-guardrail-mp-other",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpOther.Id},
+		DestinationProviderIds: []string{pRestricted.Id},
+		GuardrailIds:           &[]string{gOther.Id},
+	})
+	require.NoError(t, err, "create other policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polOther.Id) })
+
+	// polOpen: grpMain on pOpen with NO guardrail — unrestricted.
+	polOpen, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-guardrail-mp-open",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpMain.Id},
+		DestinationProviderIds: []string{pOpen.Id},
+	})
+	require.NoError(t, err, "create open policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polOpen.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-guardrail-mp-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	send := func(model string) (int, string) {
+		code, body, cerr := cl.Chat(ctx, settings.Endpoint, proxyIP, harness.WireChat, model, "Reply with exactly: pong", "")
+		require.NoError(t, cerr, "request must reach the proxy")
+		return code, body
+	}
+	// sendUntil200 absorbs first-call tunnel/DNS jitter on the freshly warmed tunnel.
+	sendUntil200 := func(model string) (int, string) {
+		var code int
+		var body string
+		deadline := time.Now().Add(90 * time.Second)
+		for time.Now().Before(deadline) {
+			code, body = send(model)
+			if code == 200 {
+				break
+			}
+			time.Sleep(5 * time.Second)
+		}
+		return code, body
+	}
+
+	t.Run("selected model allowed for its group", func(t *testing.T) {
+		code, body := sendUntil200(modelSelected)
+		assert.Equal(t, 200, code,
+			"grpMain's allowlisted model must be served; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+	})
+
+	t.Run("other group's model does not leak", func(t *testing.T) {
+		// modelOther is allowlisted only for grpOther. The grpMain client must be
+		// denied by management's per-policy/group check — not waved through by an
+		// account-wide union. This is the security-critical wrong-ALLOW guard.
+		code, body := send(modelOther)
+		assert.Equal(t, 403, code,
+			"another group's allowlisted model must be denied for this caller; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+		assert.Contains(t, body, "llm_policy.model_blocked",
+			"denial must be a model-allowlist decision; body: %s", body)
+	})
+
+	t.Run("unguarded policy leaves its provider unrestricted", func(t *testing.T) {
+		// polOpen carries no guardrail, so pOpen is unrestricted for grpMain. The
+		// old account-wide union would have blocked openModel (it is on no
+		// allowlist); it must now be served — the false-DENY guard.
+		code, body := sendUntil200(openModel)
+		assert.Equal(t, 200, code,
+			"an un-guardrailed policy's provider must not be blocked by another policy's allowlist; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+	})
+}
diff --git a/e2e/agentnetwork/guardrail_pergroup_providers_test.go b/e2e/agentnetwork/guardrail_pergroup_providers_test.go
new file mode 100644
index 000000000..0e98330c4
--- /dev/null
+++ b/e2e/agentnetwork/guardrail_pergroup_providers_test.go
@@ -0,0 +1,418 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// pergroupCase describes one provider surface for the per-group allowlist matrix.
+// selectedReq/otherReq are the model identifiers as they travel in the request
+// (URL path for Bedrock/Vertex, body "model" for chat/messages). selectedAllow/
+// otherAllow are the (normalized) forms the guardrail allowlist holds — for
+// Bedrock these differ from the request form so path normalization is exercised.
+type pergroupCase struct {
+	name          string
+	catalogID     string
+	wire          string // "chat", "messages", "vertex", "bedrock"
+	models        *[]api.AgentNetworkProviderModel
+	selectedReq   string
+	selectedAllow string
+	otherReq      string
+	otherAllow    string
+
+	providerID string // filled during setup
+}
+
+// TestGuardrailPerGroupAllowlist_AllProviders proves the per-policy/group model
+// allowlist end to end across every always-on provider surface, including the
+// path-routed ones (Vertex, Bedrock) where the model travels in the URL.
+//
+// For each provider two policies target it: grpMain (the client) is allowed only
+// selectedReq; grpOther (which the client is NOT in) is allowed only otherReq.
+// The client must get selectedReq served (200) and otherReq denied (403,
+// llm_policy.model_blocked) — the cross-group no-leak property. The deny is the
+// authoritative per-policy/group decision from management (the proxy per-provider
+// backstop carries the union of both models), so this also confirms management
+// receives the correct normalized model for path-routed providers.
+func TestGuardrailPerGroupAllowlist_AllProviders(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	const (
+		vertexProject = "e2e-project"
+		vertexRegion  = "global"
+	)
+
+	priced := func(ids ...string) *[]api.AgentNetworkProviderModel {
+		out := make([]api.AgentNetworkProviderModel, 0, len(ids))
+		for _, id := range ids {
+			out = append(out, api.AgentNetworkProviderModel{Id: id, InputPer1k: 0.001, OutputPer1k: 0.001})
+		}
+		return &out
+	}
+
+	cases := []*pergroupCase{
+		{
+			name: "openai", catalogID: "openai_api", wire: harness.WireChat,
+			models:      priced("oai-model-a", "oai-model-b"),
+			selectedReq: "oai-model-a", selectedAllow: "oai-model-a",
+			otherReq: "oai-model-b", otherAllow: "oai-model-b",
+		},
+		{
+			name: "anthropic", catalogID: "anthropic_api", wire: harness.WireMessages,
+			models:      priced("ant-model-a", "ant-model-b"),
+			selectedReq: "ant-model-a", selectedAllow: "ant-model-a",
+			otherReq: "ant-model-b", otherAllow: "ant-model-b",
+		},
+		{
+			// Vertex catalog ids travel bare in the rawPredict path.
+			name: "vertex", catalogID: "vertex_ai_api", wire: "vertex",
+			selectedReq: "claude-sonnet-4-5", selectedAllow: "claude-sonnet-4-5",
+			otherReq: "claude-opus-4-6", otherAllow: "claude-opus-4-6",
+		},
+		{
+			// Bedrock request ids are region-prefixed/versioned; the parser
+			// normalizes them to the catalog key the allowlist holds.
+			name: "bedrock", catalogID: "bedrock_api", wire: "bedrock",
+			selectedReq: "us.anthropic.claude-sonnet-4-5-v1:0", selectedAllow: "anthropic.claude-sonnet-4-5",
+			otherReq: "us.anthropic.claude-opus-4-8-v1:0", otherAllow: "anthropic.claude-opus-4-8",
+		},
+	}
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grpMain, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-pergroup-main"})
+	require.NoError(t, err, "create main group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpMain.Id) })
+
+	grpOther, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-pergroup-other"})
+	require.NoError(t, err, "create other group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpOther.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-pergroup-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grpMain.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	staticKey := "static-e2e-token"
+	enabled := true
+
+	for _, c := range cases {
+		req := api.AgentNetworkProviderRequest{
+			Name:        "e2e-pergroup-" + c.name,
+			ProviderId:  c.catalogID,
+			UpstreamUrl: vllm.URL,
+			ApiKey:      &staticKey,
+			Enabled:     ptr(true),
+			Models:      c.models,
+		}
+		prov, perr := srv.CreateProvider(ctx, req)
+		require.NoError(t, perr, "create provider %s", c.name)
+		c.providerID = prov.Id
+		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+		gSel := mkAllowGuardrail(t, ctx, "e2e-pergroup-"+c.name+"-sel", c.selectedAllow)
+		gOth := mkAllowGuardrail(t, ctx, "e2e-pergroup-"+c.name+"-oth", c.otherAllow)
+
+		polMain, merr := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+			Name:                   "e2e-pergroup-" + c.name + "-main",
+			Enabled:                &enabled,
+			SourceGroups:           []string{grpMain.Id},
+			DestinationProviderIds: []string{prov.Id},
+			GuardrailIds:           &[]string{gSel.Id},
+		})
+		require.NoError(t, merr, "create main policy %s", c.name)
+		t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polMain.Id) })
+
+		polOther, oerr := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+			Name:                   "e2e-pergroup-" + c.name + "-other",
+			Enabled:                &enabled,
+			SourceGroups:           []string{grpOther.Id},
+			DestinationProviderIds: []string{prov.Id},
+			GuardrailIds:           &[]string{gOth.Id},
+		})
+		require.NoError(t, oerr, "create other policy %s", c.name)
+		t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polOther.Id) })
+	}
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-pergroup-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	send := func(c *pergroupCase, model string) (int, string) {
+		var code int
+		var body string
+		var cerr error
+		switch c.wire {
+		case "vertex":
+			code, body, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, vertexProject, vertexRegion, model, "Reply with exactly: pong", "")
+		case "bedrock":
+			code, body, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, model, "Reply with exactly: pong", "")
+		default:
+			code, body, cerr = cl.Chat(ctx, settings.Endpoint, proxyIP, c.wire, model, "Reply with exactly: pong", "")
+		}
+		require.NoError(t, cerr, "request must reach the proxy for %s", c.name)
+		return code, body
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			// grpMain's own model is served. Retry to absorb tunnel/DNS jitter on
+			// the first call over the freshly warmed tunnel.
+			var code int
+			var body string
+			deadline := time.Now().Add(90 * time.Second)
+			for time.Now().Before(deadline) {
+				code, body = send(c, c.selectedReq)
+				if code == 200 {
+					break
+				}
+				time.Sleep(5 * time.Second)
+			}
+			assert.Equal(t, 200, code,
+				"%s: grpMain's allowlisted model must be served; body: %s\n=== proxy logs ===\n%s", c.name, body, px.Logs(context.Background()))
+
+			// grpOther's model must NOT leak to the grpMain client.
+			code, body = send(c, c.otherReq)
+			assert.Equal(t, 403, code,
+				"%s: another group's allowlisted model must be denied for this caller; body: %s\n=== proxy logs ===\n%s", c.name, body, px.Logs(context.Background()))
+			assert.Contains(t, body, "llm_policy.model_blocked",
+				"%s: denial must be a model-allowlist decision, not routing; body: %s", c.name, body)
+		})
+	}
+}
+
+// TestGuardrailMultiGroupUser proves the per-policy/group decision for a caller
+// that belongs to MULTIPLE groups at once. Two scenarios, one shared stack:
+//
+//   - union across the user's groups: the client is in gUX and gUY, each with
+//     its own policy+guardrail on provider P1 (gUX->union-a, gUY->union-b). The
+//     client may use BOTH models (the union of its groups' allowlists) while a
+//     third, un-allowlisted model is denied.
+//   - an un-guardrailed group lifts the restriction: the client is in gMP and
+//     gMQ on provider P2, where gMP restricts to mix-a but gMQ's policy carries
+//     NO guardrail. Because one applicable policy is unrestricted, the client may
+//     use a model on no allowlist (mix-z) as well as mix-a.
+func TestGuardrailMultiGroupUser(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	const (
+		unionA = "mg-union-a"
+		unionB = "mg-union-b"
+		unionC = "mg-union-c" // allowlisted by neither group
+		mixA   = "mg-mix-a"
+		mixZ   = "mg-mix-z" // on no allowlist; reachable only via the un-guardrailed policy
+	)
+
+	priced := func(ids ...string) *[]api.AgentNetworkProviderModel {
+		out := make([]api.AgentNetworkProviderModel, 0, len(ids))
+		for _, id := range ids {
+			out = append(out, api.AgentNetworkProviderModel{Id: id, InputPer1k: 0.001, OutputPer1k: 0.001})
+		}
+		return &out
+	}
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	mkGroup := func(name string) *api.Group {
+		g, gerr := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: name})
+		require.NoError(t, gerr, "create group %s", name)
+		t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), g.Id) })
+		return g
+	}
+	gUX := mkGroup("e2e-mg-union-x")
+	gUY := mkGroup("e2e-mg-union-y")
+	gMP := mkGroup("e2e-mg-mix-p")
+	gMQ := mkGroup("e2e-mg-mix-q")
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-mg-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{gUX.Id, gUY.Id, gMP.Id, gMQ.Id}, // client in all four groups
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	staticKey := "static-e2e-token"
+	enabled := true
+
+	// P1 — union scenario: two restricting policies, one per group.
+	p1, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "e2e-mg-union",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &staticKey,
+		Enabled:     ptr(true),
+		Models:      priced(unionA, unionB, unionC),
+	})
+	require.NoError(t, err, "create union provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), p1.Id) })
+
+	polUX, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-mg-union-x",
+		Enabled:                &enabled,
+		SourceGroups:           []string{gUX.Id},
+		DestinationProviderIds: []string{p1.Id},
+		GuardrailIds:           &[]string{mkAllowGuardrail(t, ctx, "e2e-mg-union-x", unionA).Id},
+	})
+	require.NoError(t, err, "create union policy X")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polUX.Id) })
+
+	polUY, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-mg-union-y",
+		Enabled:                &enabled,
+		SourceGroups:           []string{gUY.Id},
+		DestinationProviderIds: []string{p1.Id},
+		GuardrailIds:           &[]string{mkAllowGuardrail(t, ctx, "e2e-mg-union-y", unionB).Id},
+	})
+	require.NoError(t, err, "create union policy Y")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polUY.Id) })
+
+	// P2 — mixed scenario: one restricting policy + one un-guardrailed policy.
+	p2, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "e2e-mg-mix",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &staticKey,
+		Enabled:     ptr(true),
+		Models:      priced(mixA, mixZ),
+	})
+	require.NoError(t, err, "create mix provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), p2.Id) })
+
+	polMP, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-mg-mix-p",
+		Enabled:                &enabled,
+		SourceGroups:           []string{gMP.Id},
+		DestinationProviderIds: []string{p2.Id},
+		GuardrailIds:           &[]string{mkAllowGuardrail(t, ctx, "e2e-mg-mix-p", mixA).Id},
+	})
+	require.NoError(t, err, "create mix policy P")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polMP.Id) })
+
+	polMQ, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-mg-mix-q",
+		Enabled:                &enabled,
+		SourceGroups:           []string{gMQ.Id},
+		DestinationProviderIds: []string{p2.Id}, // NO guardrail -> unrestricted
+	})
+	require.NoError(t, err, "create mix policy Q")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polMQ.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-mg-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	send := func(model string) (int, string) {
+		code, body, cerr := cl.Chat(ctx, settings.Endpoint, proxyIP, harness.WireChat, model, "Reply with exactly: pong", "")
+		require.NoError(t, cerr, "request must reach the proxy")
+		return code, body
+	}
+	sendUntil200 := func(model string) (int, string) {
+		var code int
+		var body string
+		deadline := time.Now().Add(90 * time.Second)
+		for time.Now().Before(deadline) {
+			code, body = send(model)
+			if code == 200 {
+				break
+			}
+			time.Sleep(5 * time.Second)
+		}
+		return code, body
+	}
+
+	t.Run("union across the user's groups", func(t *testing.T) {
+		code, body := sendUntil200(unionA)
+		assert.Equal(t, 200, code, "model allowed by group X must be served; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+
+		code, body = sendUntil200(unionB)
+		assert.Equal(t, 200, code, "model allowed by group Y must also be served (union across the user's groups); body: %s", body)
+
+		code, body = send(unionC)
+		assert.Equal(t, 403, code, "a model on neither group's allowlist must be denied; body: %s", body)
+		assert.Contains(t, body, "llm_policy.model_blocked")
+	})
+
+	t.Run("an un-guardrailed group lifts the restriction", func(t *testing.T) {
+		code, body := sendUntil200(mixA)
+		assert.Equal(t, 200, code, "the restricted group's model must be served; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+
+		code, body = sendUntil200(mixZ)
+		assert.Equal(t, 200, code,
+			"a non-allowlisted model must be served because the user is also in a group whose policy has no guardrail; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+	})
+}
+
+// mkAllowGuardrail creates a guardrail whose model allowlist is enabled and holds
+// exactly the given model, registering cleanup.
+func mkAllowGuardrail(t *testing.T, ctx context.Context, name, model string) api.AgentNetworkGuardrail {
+	t.Helper()
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = name
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = []string{model}
+	g, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail %s", name)
+	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), g.Id) })
+	return g
+}
diff --git a/e2e/agentnetwork/guardrail_test.go b/e2e/agentnetwork/guardrail_test.go
new file mode 100644
index 000000000..ddc95d62d
--- /dev/null
+++ b/e2e/agentnetwork/guardrail_test.go
@@ -0,0 +1,185 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// bedrockRegionPrefixes and bedrockVersionSuffix mirror the proxy's Bedrock
+// model normalization (region/inference-profile prefix + version suffix) so the
+// provider is registered under the same catalog key the router matches against.
+var (
+	bedrockRegionPrefixes = []string{"us.", "eu.", "apac.", "global."}
+	bedrockVersionSuffix  = regexp.MustCompile(`-(\d{8}-)?v\d+(:\d+)?$`)
+)
+
+// catalogModel returns the normalized catalog id the proxy stamps for a
+// path-routed provider's configured model — the form the router and guardrail
+// allowlist compare against (Bedrock region prefix + version stripped, Vertex
+// @version stripped).
+func catalogModel(pc providerCase) string {
+	switch pc.kind {
+	case harness.WireBedrock:
+		m := pc.model
+		for _, p := range bedrockRegionPrefixes {
+			if strings.HasPrefix(m, p) {
+				m = m[len(p):]
+				break
+			}
+		}
+		return bedrockVersionSuffix.ReplaceAllString(m, "")
+	case harness.WireVertex:
+		return strings.SplitN(pc.model, "@", 2)[0]
+	default:
+		return pc.model
+	}
+}
+
+// disallowedModel returns a valid-shaped model id for the provider that is NOT
+// the configured/allowed one, so the guardrail must reject it before the
+// request ever reaches the upstream.
+func disallowedModel(pc providerCase) string {
+	switch pc.kind {
+	case harness.WireBedrock:
+		// Same profile prefix as the allowed model so only the model name
+		// differs; the guardrail must deny it before it reaches AWS.
+		return strings.SplitN(pc.model, ".", 2)[0] + ".anthropic.claude-opus-4-8"
+	case harness.WireVertex:
+		return "claude-opus-4-8@20250101"
+	default:
+		return "unlisted-model"
+	}
+}
+
+// sendModel drives one request for the given model through the provider's native
+// wire shape and returns the HTTP status.
+func sendModel(ctx context.Context, t *testing.T, cl *harness.Client, endpoint, proxyIP string, pc providerCase, model string) int {
+	t.Helper()
+	var code int
+	var err error
+	switch pc.kind {
+	case harness.WireBedrock:
+		code, _, err = cl.Bedrock(ctx, endpoint, proxyIP, model, "Reply with exactly: pong", "")
+	case harness.WireVertex:
+		code, _, err = cl.Vertex(ctx, endpoint, proxyIP, pc.project, pc.region, model, "Reply with exactly: pong", "")
+	default:
+		code, _, err = cl.ChatPrefixed(ctx, endpoint, proxyIP, pc.pathPrefix, pc.kind, model, "Reply with exactly: pong", "")
+	}
+	require.NoError(t, err, "request must reach the proxy for %s", pc.name)
+	return code
+}
+
+// TestModelAllowlistEnforced provisions a Model Allowlist guardrail limiting each
+// path-routed provider (Bedrock, Vertex) to its configured model, then drives
+// requests over the tunnel: the allowed model returns 200 while a model outside
+// the allowlist is denied 403 by the guardrail before it reaches the upstream.
+// This is the coverage missing for #6751 — the model for these providers travels
+// in the URL path, and the allowlist must be enforced there.
+func TestModelAllowlistEnforced(t *testing.T) {
+	var providers []providerCase
+	for _, pc := range availableProviders() {
+		if pc.kind == harness.WireBedrock || pc.kind == harness.WireVertex {
+			providers = append(providers, pc)
+		}
+	}
+	if len(providers) == 0 {
+		t.Skip("no path-routed provider keys set (AWS_BEARER_TOKEN_BEDROCK / GOOGLE_VERTEX_*); source ~/.llm-keys")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-allowlist"})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-allowlist-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+
+	// Providers with their configured (allowed) models
+	ids := make([]string, 0, len(providers))
+	allowed := make([]string, 0, len(providers))
+	for _, pc := range providers {
+		req := providerRequest(pc)
+		prov, perr := srv.CreateProvider(ctx, req)
+		require.NoError(t, perr, "create provider %s", pc.name)
+		id := prov.Id
+		ids = append(ids, id)
+		allowed = append(allowed, catalogModel(pc))
+		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), id) })
+	}
+
+	// Guardrail allowlisting exactly the configured models.
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = "e2e-allowlist"
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = allowed
+	guard, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail")
+	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-allowlist",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: ids,
+		GuardrailIds:           &[]string{guard.Id},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings for endpoint")
+	require.NotEmpty(t, settings.Endpoint, "agent-network endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-proxy-allowlist")
+	require.NoError(t, err, "mint proxy token via CLI")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Probe first: the GET resolves the endpoint (DNS error fails) and its first packet wakes the lazy proxy peer, so WaitProxyPeer sees it connected; any HTTP status counts.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	for _, pc := range providers {
+		pc := pc
+		t.Run(pc.name, func(t *testing.T) {
+			// The admin's allowlisted model is served end to end.
+			assert.Equal(t, 200, sendModel(ctx, t, cl, settings.Endpoint, proxyIP, pc, pc.model),
+				"allowlisted model must be permitted for %s", pc.name)
+			// A model outside the allowlist is rejected by the guardrail (before
+			// the upstream), regardless of whether it is a real catalog model.
+			assert.Equal(t, 403, sendModel(ctx, t, cl, settings.Endpoint, proxyIP, pc, disallowedModel(pc)),
+				"model outside the allowlist must be denied for %s", pc.name)
+		})
+	}
+}
diff --git a/e2e/agentnetwork/main_test.go b/e2e/agentnetwork/main_test.go
index 17c5e00be..687af1d4d 100644
--- a/e2e/agentnetwork/main_test.go
+++ b/e2e/agentnetwork/main_test.go
@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
 // srv is the shared combined server for the package, ready (PAT-authenticated)
@@ -42,5 +43,30 @@ func run(m *testing.M) int {
 		return 1
 	}
 
+	// Bootstrap the account's agent-network endpoint once for the package:
+	// providers no longer have settings side effects, and every data-plane
+	// test expects the shared account pinned to the combined proxy cluster.
+	cluster := harness.AgentNetworkCluster
+	if _, err := srv.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{ProxyAddress: &cluster}); err != nil {
+		fmt.Fprintf(os.Stderr, "e2e: bootstrap agent-network endpoint: %v\n", err)
+		return 1
+	}
+
 	return m.Run()
 }
+
+// waitBeforeRetry pauses between attempts of a polling loop and reports
+// whether the caller should keep going. A cancelled context ends the loop
+// where a plain sleep would keep retrying against it: every call fails
+// instantly once ctx is done, so the loop would spend its whole remaining
+// window sleeping between failures nobody is waiting for any more.
+func waitBeforeRetry(ctx context.Context, d time.Duration) bool {
+	timer := time.NewTimer(d)
+	defer timer.Stop()
+	select {
+	case <-ctx.Done():
+		return false
+	case <-timer.C:
+		return true
+	}
+}
diff --git a/e2e/agentnetwork/management_test.go b/e2e/agentnetwork/management_test.go
index cfd03f63c..6868a9d4d 100644
--- a/e2e/agentnetwork/management_test.go
+++ b/e2e/agentnetwork/management_test.go
@@ -16,16 +16,21 @@ import (
 
 func ptr[T any](v T) *T { return &v }
 
-// newProvider creates an OpenAI-catalog provider with a dummy key (these tests
-// never call the upstream) and registers cleanup.
+// newProvider creates an OpenAI-catalog provider these tests can hang a policy
+// off, and registers cleanup. Nothing here calls the upstream.
 func newProvider(t *testing.T, ctx context.Context, name string) api.AgentNetworkProvider {
 	t.Helper()
+	// A provider save is credential-checked against the vendor, and every
+	// caller here wants a provider row to hang a policy off rather than a
+	// working upstream. A private address is left unchecked — the proxy would
+	// reach it through the tunnel, management cannot reach it at all — which
+	// keeps this fixture independent of whether the run has vendor keys, and
+	// covers the unchecked-provider-still-saves path while it is at it.
 	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:             name,
-		ProviderId:       "openai_api",
-		UpstreamUrl:      "https://api.openai.com",
-		ApiKey:           ptr("sk-dummy-e2e-key"),
-		BootstrapCluster: ptr("eu.proxy.netbird.test"),
+		Name:        name,
+		ProviderId:  "openai_api",
+		UpstreamUrl: "https://10.255.255.1",
+		ApiKey:      ptr("sk-dummy-e2e-key"),
 	})
 	require.NoError(t, err, "create provider %q", name)
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
@@ -57,17 +62,11 @@ func TestProviderLifecycle(t *testing.T) {
 		}}
 	}
 
-	for i, pc := range cases {
-		i, pc := i, pc
+	for _, pc := range cases {
+		pc := pc
 		t.Run(pc.name, func(t *testing.T) {
 			req := providerRequest(pc)
 			req.Name = "lc-" + pc.name
-			// Bootstrap the cluster on the first create in case the matrix has
-			// not run (e.g. no provider keys → settings not yet bootstrapped).
-			if i == 0 {
-				req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
-			}
-
 			prov, err := srv.CreateProvider(ctx, req)
 			require.NoError(t, err, "create %s provider", pc.name)
 			t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
@@ -137,34 +136,65 @@ func TestProviderValidation(t *testing.T) {
 	requireClientError(t, err)
 }
 
-// TestSettingsRoundTrip flips the collection toggles and confirms cluster /
-// subdomain stay immutable, then restores the original state.
+// TestSettingsRoundTrip flips the collection toggles and confirms the
+// endpoint and proxy address stay immutable, then restores the original
+// state. A second bootstrap attempt must be rejected as a conflict.
 func TestSettingsRoundTrip(t *testing.T) {
 	ctx := context.Background()
 
-	// Settings are bootstrapped on first provider create.
-	newProvider(t, ctx, "Settings Bootstrap")
-
+	// The package's TestMain bootstrapped the shared account's endpoint.
 	before, err := srv.GetSettings(ctx)
 	require.NoError(t, err, "get settings")
-	require.NotEmpty(t, before.Cluster, "settings must carry an assigned cluster")
+	require.NotEmpty(t, before.Endpoint, "settings must carry the bootstrapped endpoint")
+	require.NotEmpty(t, before.ProxyAddress, "settings must carry the bootstrapped proxy address")
+
+	require.NotNil(t, before.AccessLogRetentionDays, "bootstrapped settings must carry a retention")
+	beforeRetention := *before.AccessLogRetentionDays
 
 	flipped, err := srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		Endpoint:               before.Endpoint,
+		ProxyAddress:           before.ProxyAddress,
 		EnableLogCollection:    !before.EnableLogCollection,
 		EnablePromptCollection: !before.EnablePromptCollection,
 		RedactPii:              !before.RedactPii,
+		AccessLogRetentionDays: beforeRetention,
 	})
 	require.NoError(t, err, "update settings")
 	assert.Equal(t, !before.EnableLogCollection, flipped.EnableLogCollection, "log collection toggle must flip")
 	assert.Equal(t, !before.EnablePromptCollection, flipped.EnablePromptCollection, "prompt collection toggle must flip")
-	assert.Equal(t, before.Cluster, flipped.Cluster, "cluster must be immutable across updates")
-	assert.Equal(t, before.Subdomain, flipped.Subdomain, "subdomain must be immutable across updates")
+	require.NotNil(t, flipped.AccessLogRetentionDays)
+	assert.Equal(t, beforeRetention, *flipped.AccessLogRetentionDays,
+		"retention sent unchanged must round-trip, not reset to the zero value")
+	assert.Equal(t, before.Endpoint, flipped.Endpoint, "endpoint must be immutable across updates")
+	assert.Equal(t, before.ProxyAddress, flipped.ProxyAddress, "proxy address must be immutable across updates")
 
-	// Restore the original toggles.
+	// The account is already bootstrapped: a second bootstrap is a conflict,
+	// whatever shape it asks for.
+	_, err = srv.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
+		Endpoint: ptr("attacker.cluster.invalid"),
+	})
+	requireClientError(t, err)
+
+	// The identity fields ride along on the PUT as a required echo: a request
+	// carrying a different endpoint is rejected without applying anything.
 	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		Endpoint:               "other.cluster.invalid",
+		ProxyAddress:           before.ProxyAddress,
 		EnableLogCollection:    before.EnableLogCollection,
 		EnablePromptCollection: before.EnablePromptCollection,
 		RedactPii:              before.RedactPii,
+		AccessLogRetentionDays: beforeRetention,
+	})
+	requireClientError(t, err)
+
+	// Restore the original toggles.
+	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		Endpoint:               before.Endpoint,
+		ProxyAddress:           before.ProxyAddress,
+		EnableLogCollection:    before.EnableLogCollection,
+		EnablePromptCollection: before.EnablePromptCollection,
+		RedactPii:              before.RedactPii,
+		AccessLogRetentionDays: beforeRetention,
 	})
 	require.NoError(t, err, "restore settings")
 }
diff --git a/e2e/agentnetwork/nblink_test.go b/e2e/agentnetwork/nblink_test.go
new file mode 100644
index 000000000..c3302f870
--- /dev/null
+++ b/e2e/agentnetwork/nblink_test.go
@@ -0,0 +1,670 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+const (
+	// nblinkSecondPort serves a second forward to the same endpoint from the
+	// same process, so one login is shown to serve more than one listener.
+	nblinkSecondPort = 8081
+	// nblinkDeadPort forwards to a name nothing in the overlay serves.
+	nblinkDeadPort = 8082
+	// nblinkPublicPort binds every interface, so it is reachable from other
+	// containers on the network, which the loopback forwards are not.
+	nblinkPublicPort = 8083
+	// nblinkDeadUpstream is under the overlay's own domain, so the lookup is
+	// answered by the in-process resolver rather than by anything outside.
+	nblinkDeadUpstream = "https://nothing-serves-this.netbird.local"
+
+	// nblinkUnreachableBody is what the forwarder itself answers when the dial
+	// over the overlay fails.
+	nblinkUnreachableBody = "upstream unreachable over the overlay"
+)
+
+// TestNBLinkReachesAgentNetwork proves an agent-network endpoint can be
+// consumed from a process that has no privileges at all:
+//
+//	curl --> nblink (loopback, userspace peer) --tunnel--> proxy --http--> vllm
+//
+// The regular agent needs NET_ADMIN and a TUN device to put the endpoint on
+// the network. nblink runs the same client in netstack mode and hands the
+// endpoint to whatever can reach a loopback port, so the container is granted
+// no capabilities and mounts no device — the whole point of the binary, and
+// what fails first if netstack mode regresses.
+//
+// Three things are being proved together, and none of them holds on its own:
+//
+//   - The forward reaches the endpoint, which means the endpoint's name
+//     resolved inside the process. Nothing on the container can resolve it:
+//     the synthesized zone is served by the in-process DNS, /etc/resolv.conf
+//     is never touched, and a name that leaked to the host resolver would be
+//     NXDOMAIN.
+//   - The forwarder's peer is a peer like any other. Its request is authorized
+//     against the policy that names its group, metered, and written to the
+//     access log under its own identity.
+//   - The loopback listener still refuses what a browser can aim at it, which
+//     is the one new attack surface a forward on localhost creates.
+//
+// One forwarder carries most of the cases, because each one costs a session:
+// it serves three forwards, reads its setup key from a file, and keeps its
+// identity on a volume so the last case can restart it.
+func TestNBLinkReachesAgentNetwork(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 25*time.Minute)
+	defer cancel()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock vLLM server")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	// allowed holds the forwarder's peer and is named by the policy. denied
+	// holds a second forwarder's peer and is named by nothing, so the proxy
+	// has no policy to authorize it under.
+	allowed, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-nblink-allowed"})
+	require.NoError(t, err, "create allowed group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), allowed.Id) })
+
+	denied, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-nblink-denied"})
+	require.NoError(t, err, "create denied group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), denied.Id) })
+
+	allowedKey := mintSetupKey(ctx, t, "e2e-nblink-allowed-key", allowed.Id)
+	deniedKey := mintSetupKey(ctx, t, "e2e-nblink-denied-key", denied.Id)
+
+	dummyKey := "sk-nblink-e2e"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "nblink-vllm",
+		ProviderId:  "vllm",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &dummyKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002},
+		},
+	})
+	require.NoError(t, err, "create provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	// A second provider on the mock's streaming listener, which answers every
+	// request as server-sent events.
+	streamProv, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "nblink-stream",
+		ProviderId:  "anthropic_api",
+		UpstreamUrl: vllm.StreamURL,
+		ApiKey:      &dummyKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: streamedModel, InputPer1k: streamInRate, OutputPer1k: streamOutRate},
+		},
+	})
+	require.NoError(t, err, "create streaming provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), streamProv.Id) })
+
+	// Caps far above what this test drives, so the limit never blocks but
+	// usage metering is switched on — that is what writes consumption rows.
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-nblink-allow",
+		Enabled:                ptr(true),
+		SourceGroups:           []string{allowed.Id},
+		DestinationProviderIds: []string{prov.Id, streamProv.Id},
+		Limits: &api.AgentNetworkPolicyLimits{
+			TokenLimit: api.AgentNetworkPolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      10_000_000,
+				UserCap:       10_000_000,
+				WindowSeconds: 60,
+			},
+		},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-nblink-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	stateVolume := fmt.Sprintf("e2e-nblink-state-%d", time.Now().UnixNano())
+	t.Cleanup(func() { _ = harness.RemoveDockerVolume(context.Background(), stateVolume) })
+
+	// The upstream is the endpoint itself, over HTTPS. nblink verifies the
+	// certificate like any Go client, so it needs the proxy's self-signed cert
+	// — the curl helpers elsewhere in this suite sidestep that with -k.
+	forward := nblinkForward(harness.NBLinkPort, "https://"+settings.Endpoint)
+	nbOpts := []harness.NBLinkOption{
+		harness.WithNBLinkForwards(
+			nblinkForward(nblinkSecondPort, "https://"+settings.Endpoint),
+			nblinkForward(nblinkDeadPort, nblinkDeadUpstream),
+			fmt.Sprintf("http://0.0.0.0:%d=https://%s", nblinkPublicPort, settings.Endpoint),
+		),
+		harness.WithNBLinkEnv("NB_ALLOW_PUBLIC_BIND", "true"),
+		// The name other containers use for the public forward.
+		harness.WithNBLinkEnv("NB_ALLOWED_HOST", "nblink"),
+		harness.WithNBLinkSetupKeyFile(),
+		harness.WithNBLinkStateVolume(stateVolume),
+	}
+	nb, err := harness.StartNBLink(ctx, srv, allowedKey, forward, px.CACertPath(), nbOpts...)
+	require.NoError(t, err, "start nblink")
+	// nb is replaced by the restart case, so the cleanup reads the variable
+	// rather than the first value.
+	t.Cleanup(func() { _ = nb.Terminate(context.Background()) })
+
+	diag := func() string {
+		return "\n=== nblink logs ===\n" + nb.Logs(context.Background()) +
+			"\n=== proxy logs ===\n" + px.Logs(context.Background())
+	}
+
+	before, _ := srv.ListAccessLogs(ctx)
+	sessionID := "e2e-session-nblink"
+
+	// Retry to absorb the beat between the session coming up and the proxy
+	// peer being reachable; the forward itself is already bound by now.
+	code, body := chatUntil(ctx, t, nb, 200, 120*time.Second, sessionID)
+	require.Equal(t, 200, code,
+		"a chat through the nblink forward must be served; body: %s%s", body, diag())
+	require.Contains(t, body, "chat.completion",
+		"the body should be the upstream's OpenAI-compatible completion; got: %s", body)
+
+	var peer api.Peer
+	t.Run("the peer registers under its hostname", func(t *testing.T) {
+		peers := peersWithHostname(ctx, t, nb.Hostname())
+		require.Len(t, peers, 1, "exactly one peer must carry the forwarder's hostname %q", nb.Hostname())
+		peer = peers[0]
+		assert.True(t, peerInGroup(peer, allowed.Id),
+			"the setup key read from the file must have joined the peer to its auto-group")
+	})
+
+	t.Run("the request is attributed to the forwarder's own peer", func(t *testing.T) {
+		require.NotEmpty(t, peer.Ip, "the peer lookup must have run first")
+
+		var row *api.AgentNetworkAccessLog
+		require.Eventually(t, func() bool {
+			logs, lerr := srv.ListAccessLogs(ctx)
+			if lerr != nil || logs.TotalRecords <= before.TotalRecords {
+				return false
+			}
+			for i, r := range logs.Data {
+				if r.SessionId != nil && *r.SessionId == sessionID {
+					row = &logs.Data[i]
+					return true
+				}
+			}
+			return false
+		}, 30*time.Second, 2*time.Second,
+			"session %q must reach the access log; a forward is not a way around accounting%s", sessionID, diag())
+		require.NotNil(t, row.SourceIp, "the access log row must carry the caller's overlay address")
+		assert.Equal(t, peer.Ip, *row.SourceIp,
+			"the access log must name the forwarder's peer as the caller")
+
+		require.Eventually(t, func() bool {
+			rows, lerr := srv.ListConsumption(ctx)
+			if lerr != nil {
+				return false
+			}
+			for _, r := range rows {
+				if r.TokensInput > 0 && r.TokensOutput > 0 {
+					return true
+				}
+			}
+			return false
+		}, 60*time.Second, 3*time.Second, "the upstream's usage must be metered into a consumption row")
+	})
+
+	t.Run("every forward in one process serves over the same session", func(t *testing.T) {
+		scode, sbody, serr := nb.PostOn(ctx, nblinkSecondPort, harness.ChatPath,
+			harness.ChatBody(harness.VLLMModel, "Reply with exactly: pong"), nil)
+		require.NoError(t, serr, "the probe must reach the second listener")
+		assert.Equal(t, 200, scode, "the second forward must be served too; body: %s%s", sbody, diag())
+		assert.Contains(t, sbody, "chat.completion", "the second forward must carry the upstream completion back")
+	})
+
+	t.Run("an upstream nothing serves answers 502 without hanging", func(t *testing.T) {
+		start := time.Now()
+		dcode, dbody, derr := nb.PostOn(ctx, nblinkDeadPort, harness.ChatPath,
+			harness.ChatBody(harness.VLLMModel, "Reply with exactly: pong"), nil)
+		elapsed := time.Since(start)
+		require.NoError(t, derr, "the probe must reach the third listener")
+		assert.Equal(t, 502, dcode, "a forward whose upstream cannot be dialled must answer 502; body: %s", dbody)
+		assert.Contains(t, dbody, nblinkUnreachableBody, "the 502 must be the forwarder's own answer")
+		// The forwarder bounds a dial at 30s; anything near curl's 90s limit
+		// means a request was left hanging.
+		assert.Less(t, elapsed, 40*time.Second, "an unreachable upstream must fail fast, took %s", elapsed)
+	})
+
+	t.Run("a streamed reply arrives as events and is metered", func(t *testing.T) {
+		streamSession := "e2e-session-nblink-stream"
+		body := fmt.Sprintf(`{"model":%q,"max_tokens":64,"stream":true,"messages":[{"role":"user","content":"Reply with exactly: pong"}]}`, streamedModel)
+		scode, sbody, serr := nb.Post(ctx, "/v1/messages", body,
+			[]string{"anthropic-version: 2023-06-01", "x-session-id: " + streamSession})
+		require.NoError(t, serr, "the probe must reach the listener")
+		require.Equal(t, 200, scode, "a streamed request must be served; body: %s%s", sbody, diag())
+		assert.Contains(t, sbody, "event: message_start", "the caller must receive the event stream itself")
+		assert.Contains(t, sbody, "message_stop", "the stream must arrive complete")
+
+		row := findAccessLogBySession(t, ctx, streamSession)
+		assert.Equal(t, harness.VLLMStreamInputTokens, int(row.InputTokens),
+			"the proxy must meter a stream carried by the forwarder like any other")
+		assert.Equal(t, harness.VLLMStreamOutputTokens, int(row.OutputTokens),
+			"output tokens must be metered from the stream")
+	})
+
+	t.Run("only the public forward is reachable from the network", func(t *testing.T) {
+		chat := harness.ChatBody(harness.VLLMModel, "Reply with exactly: pong")
+
+		pcode, pbody, perr := nb.PostFromNetwork(ctx, nblinkPublicPort, harness.ChatPath, chat, nil)
+		require.NoError(t, perr, "the public forward must accept a connection from another container")
+		assert.Equal(t, 200, pcode, "the public forward must serve a caller under a listed name; body: %s", pbody)
+
+		// The shape a rebound page sends: its own name, with Origin and
+		// Sec-Fetch-Site agreeing that the request is same-origin.
+		rcode, rbody, rerr := nb.PostFromNetwork(ctx, nblinkPublicPort, harness.ChatPath, chat, []string{
+			"Host: attacker.example:8083", "Origin: http://attacker.example:8083", "Sec-Fetch-Site: same-origin",
+		})
+		require.NoError(t, rerr)
+		assert.Equal(t, 421, rcode, "a public forward must refuse a name it was not given; body: %s", rbody)
+		assert.Contains(t, nb.Logs(ctx), fmt.Sprintf("forwarding http://0.0.0.0:%d", nblinkPublicPort),
+			"a 0.0.0.0 forward must bind the IPv4 wildcard, not the dual-stack one")
+
+		// The Host check only protects loopback listeners, but the browser
+		// checks still hold on a public one.
+		ocode, _, oerr := nb.PostFromNetwork(ctx, nblinkPublicPort, harness.ChatPath, chat,
+			[]string{"Origin: https://attacker.example"})
+		require.NoError(t, oerr)
+		assert.Equal(t, 403, ocode, "a cross-origin browser request must be refused on a public forward too")
+
+		_, _, lerr := nb.PostFromNetwork(ctx, harness.NBLinkPort, harness.ChatPath, chat, nil)
+		assert.Error(t, lerr, "a loopback forward must refuse connections from other machines")
+	})
+
+	t.Run("the logs show no secrets and no side effects on the host", func(t *testing.T) {
+		// The suite runs at debug level, the most an operator can turn on.
+		logs := nb.Logs(ctx)
+		require.Contains(t, logs, "over the overlay", "the logs must have been read")
+		assert.NotContains(t, logs, allowedKey, "the setup key must not be logged")
+		assert.Contains(t, logs, "NAT port mapper disabled", "nblink must not ask the router for a port mapping")
+		assert.NotContains(t, logs, "/var/lib/netbird", "nblink must not touch an installed agent's state")
+		assert.NotContains(t, logs, "failed to login to Management Service",
+			"registering a new peer must not log an error")
+	})
+
+	t.Run("a peer no policy names cannot reach the endpoint", func(t *testing.T) {
+		other, oerr := harness.StartNBLink(ctx, srv, deniedKey, forward, px.CACertPath(),
+			harness.WithNBLinkName("nblink-denied"))
+		require.NoError(t, oerr, "start the second forwarder")
+		t.Cleanup(func() { _ = other.Terminate(context.Background()) })
+		otherDiag := func() string {
+			return "\n=== denied nblink logs ===\n" + other.Logs(context.Background()) +
+				"\n=== proxy logs ===\n" + px.Logs(context.Background())
+		}
+
+		// Management gives the endpoint's DNS record, the proxy peer and the
+		// rule allowing 443 to it only to peers in an enabled policy's source
+		// groups. This peer gets none of them, so it is refused in the overlay
+		// itself and the request never reaches the proxy's router. The
+		// forwarder reports that as its own 502.
+		//
+		// Keep asking for as long as the allowed forwarder needed to be served,
+		// so a 502 cannot be blamed on a tunnel that had not settled yet.
+		deniedSession := "e2e-session-nblink-denied"
+		deadline := time.Now().Add(60 * time.Second)
+		var ocode int
+		var obody string
+		for time.Now().Before(deadline) {
+			ocode, obody, _ = other.Chat(ctx, harness.VLLMModel, "Reply with exactly: pong", deniedSession)
+			if ocode != 502 {
+				break
+			}
+			time.Sleep(5 * time.Second)
+		}
+		assert.Equal(t, 502, ocode,
+			"a forwarder whose peer is in no policy's source group must not get through; body: %s%s", obody, otherDiag())
+		assert.Contains(t, obody, nblinkUnreachableBody,
+			"the refusal must be the forwarder failing to dial, not an answer from the proxy; body: %s", obody)
+		assert.NotContains(t, obody, "chat.completion", "the refusal must not carry an upstream completion")
+
+		// The forwarder logs why the dial failed at debug level, which this
+		// suite runs at. Finding the line ties the 502 to this upstream rather
+		// than to some other failure inside the forwarder.
+		dialFailure := fmt.Sprintf("dial %s:443 over the overlay failed", settings.Endpoint)
+		logs := other.Logs(ctx)
+		require.Contains(t, logs, dialFailure, "the 502 must come from the overlay dial; logs:\n%s", logs)
+		for _, line := range strings.Split(logs, "\n") {
+			if strings.Contains(line, dialFailure) {
+				t.Logf("denied forwarder: %s", strings.TrimSpace(line))
+				break
+			}
+		}
+
+		// The allowed forwarder is still served at the same moment, so the
+		// refusal is about this peer and not about the endpoint being down.
+		acode, abody := chatUntil(ctx, t, nb, 200, 30*time.Second, "")
+		assert.Equal(t, 200, acode, "the allowed forwarder must still be served; body: %s", abody)
+
+		rows, lerr := srv.ListAccessLogs(ctx)
+		require.NoError(t, lerr, "list access logs")
+		for _, r := range rows.Data {
+			assert.False(t, r.SessionId != nil && *r.SessionId == deniedSession,
+				"a request that never reached the proxy must leave no access log row")
+		}
+	})
+
+	t.Run("the loopback listener refuses browser-driven callers", func(t *testing.T) {
+		// A page the user visits can aim a request at a loopback listener in
+		// several shapes. Each must be refused before anything is proxied
+		// under the peer's identity, while an ordinary local caller is
+		// unaffected.
+		cases := []struct {
+			name    string
+			headers []string
+			want    int
+		}{
+			{
+				name:    "a foreign Host, which is DNS rebinding",
+				headers: []string{"Host: attacker.example"},
+				want:    421,
+			},
+			{
+				name:    "a cross-origin fetch",
+				headers: []string{"Origin: https://attacker.example"},
+				want:    403,
+			},
+			{
+				name: "a page on another local port, which is cross-origin too",
+				// Same machine, different origin: localhost:3000 has no more
+				// claim on this listener than any other site.
+				headers: []string{"Origin: http://localhost:3000"},
+				want:    403,
+			},
+			{
+				name: "an embedded no-cors GET, which carries no Origin at all",
+				// The shape the Host and Origin checks both miss: a loopback
+				// Host and no Origin. Sec-Fetch-Site is the only signal left.
+				headers: []string{"Sec-Fetch-Site: cross-site"},
+				want:    403,
+			},
+		}
+		// Every case sends the request already proven to return 200, so the
+		// only difference between a refusal and a success is the header under
+		// test.
+		body := harness.ChatBody(harness.VLLMModel, "Reply with exactly: pong")
+		for _, tc := range cases {
+			t.Run(tc.name, func(t *testing.T) {
+				gcode, gbody, gerr := nb.Post(ctx, harness.ChatPath, body, tc.headers)
+				require.NoError(t, gerr, "the probe itself must reach the listener")
+				assert.Equal(t, tc.want, gcode,
+					"%s must be refused by the listener, not proxied; body: %s", tc.name, gbody)
+				assert.NotContains(t, gbody, "chat.completion",
+					"a refused request must never carry an upstream completion back")
+			})
+		}
+
+		// The control: the same request with none of those headers is served,
+		// so the cases above prove a guard rather than a broken forward.
+		gcode, gbody, gerr := nb.Post(ctx, harness.ChatPath, body, nil)
+		require.NoError(t, gerr)
+		assert.Equal(t, 200, gcode,
+			"a plain local caller must still be served; body: %s%s", gbody, diag())
+	})
+
+	t.Run("an upstream whose certificate is not trusted is refused", func(t *testing.T) {
+		// No CA mounted: the proxy's self-signed certificate is unknown to the
+		// forwarder, which must refuse it rather than proxy in the clear.
+		untrusted, uerr := harness.StartNBLink(ctx, srv, allowedKey, forward, "",
+			harness.WithNBLinkName("nblink-untrusted"))
+		require.NoError(t, uerr, "start the forwarder without the proxy's CA")
+		t.Cleanup(func() { _ = untrusted.Terminate(context.Background()) })
+
+		// Until the tunnel settles the dial itself fails with the same 502, so
+		// wait for the handshake failure specifically.
+		var ucode int
+		var ubody string
+		require.Eventually(t, func() bool {
+			ucode, ubody, _ = untrusted.Chat(ctx, harness.VLLMModel, "Reply with exactly: pong", "")
+			return strings.Contains(untrusted.Logs(ctx), "x509")
+		}, 120*time.Second, 5*time.Second, "the forwarder must reach the TLS handshake and fail it; logs:\n%s", untrusted.Logs(ctx))
+		assert.Equal(t, 502, ucode, "an unverified upstream must not be served; body: %s", ubody)
+		assert.NotContains(t, ubody, "chat.completion", "no completion may come back over an unverified connection")
+	})
+
+	t.Run("an arbitrary UID in group 0 keeps its identity on a volume", func(t *testing.T) {
+		// OpenShift's restricted SCC runs the image as a UID from the
+		// namespace range with group 0. The state directory is group 0 and
+		// group-writable, and a fresh volume inherits that.
+		const name = "nblink-openshift"
+		volume := fmt.Sprintf("e2e-nblink-openshift-%d", time.Now().UnixNano())
+		t.Cleanup(func() { _ = harness.RemoveDockerVolume(context.Background(), volume) })
+		opts := []harness.NBLinkOption{
+			harness.WithNBLinkName(name),
+			harness.WithNBLinkUser("1000770000:0"),
+			harness.WithNBLinkStateVolume(volume),
+			harness.WithNBLinkSetupKeyFile(),
+		}
+
+		for range 2 {
+			fwdr, oerr := harness.StartNBLink(ctx, srv, allowedKey, forward, px.CACertPath(), opts...)
+			require.NoError(t, oerr, "start the forwarder as an arbitrary UID")
+			// Registered before the assertions below so a failure between here
+			// and the explicit Terminate cannot leave a container holding the
+			// volume the cleanup above tries to remove.
+			t.Cleanup(func() { _ = fwdr.Terminate(context.Background()) })
+			ocode, obody := chatUntil(ctx, t, fwdr, 200, 120*time.Second, "")
+			assert.Equal(t, 200, ocode, "the forwarder must serve as an arbitrary UID; body: %s", obody)
+			require.NoError(t, fwdr.Terminate(ctx), "stop the forwarder")
+		}
+		assert.Len(t, peersWithHostname(ctx, t, name), 1,
+			"an arbitrary UID must be able to persist the identity it registered")
+	})
+
+	t.Run("without a state dir every start is a new peer", func(t *testing.T) {
+		const name = "nblink-ephemeral"
+		for range 2 {
+			eph, eerr := harness.StartNBLink(ctx, srv, allowedKey, forward, px.CACertPath(), harness.WithNBLinkName(name))
+			require.NoError(t, eerr, "start the in-memory forwarder")
+			t.Cleanup(func() { _ = eph.Terminate(context.Background()) })
+			require.NoError(t, eph.Terminate(ctx), "stop the in-memory forwarder")
+		}
+		peers := peersWithHostname(ctx, t, name)
+		assert.Len(t, peers, 2, "each in-memory start must register its own peer, as the README warns")
+	})
+
+	// Last, because it replaces the forwarder every case above used.
+	t.Run("a state dir keeps the same peer across restarts", func(t *testing.T) {
+		require.NotEmpty(t, peer.Id, "the peer lookup must have run first")
+
+		// docker stop sends SIGTERM. The forwarder must drain and exit cleanly
+		// well inside the grace period rather than be killed at its end.
+		exitCode, took, serr := nb.Stop(ctx, 30*time.Second)
+		require.NoError(t, serr, "stop the first forwarder")
+		assert.Equal(t, 0, exitCode, "SIGTERM must be a clean exit")
+		assert.Less(t, took, 15*time.Second, "shutdown must not wait out the grace period")
+		assert.Contains(t, nb.Logs(ctx), "shutting down", "the forwarder must log the signal it handled")
+		require.NoError(t, nb.Terminate(ctx), "remove the first forwarder")
+
+		restarted, rerr := harness.StartNBLink(ctx, srv, allowedKey, forward, px.CACertPath(), nbOpts...)
+		require.NoError(t, rerr, "start the forwarder again on the same volume")
+		nb = restarted
+
+		peers := peersWithHostname(ctx, t, nb.Hostname())
+		require.Len(t, peers, 1,
+			"a restart on the same state dir must not register a second peer; got %d", len(peers))
+		assert.Equal(t, peer.Id, peers[0].Id, "the restarted forwarder must come back as the same peer")
+
+		rcode, rbody := chatUntil(ctx, t, nb, 200, 120*time.Second, "")
+		assert.Equal(t, 200, rcode, "the restarted forwarder must be served again; body: %s%s", rbody, diag())
+	})
+}
+
+// TestNBLinkWithoutManagement covers a forwarder that can never bring its
+// session up. It must fail rather than hang, and a signal while it is trying
+// must stop it straight away.
+func TestNBLinkWithoutManagement(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+
+	env := map[string]string{
+		"NB_MANAGEMENT_URL": "https://management.invalid",
+		"NB_SETUP_KEY":      "11111111-2222-3333-4444-555555555555",
+		"NB_FORWARD":        "http://8080=https://grafana.netbird.cloud",
+	}
+
+	t.Run("an unreachable management server fails the start", func(t *testing.T) {
+		start := time.Now()
+		res, err := harness.RunNBLinkIsolated(ctx, env)
+		took := time.Since(start)
+		require.NoError(t, err, "run the forwarder")
+		assert.NotEqual(t, 0, res.ExitCode, "a session that cannot come up must be an error; stderr: %s", res.Stderr)
+		assert.Contains(t, res.Stderr, "start client", "the error must say the session did not start")
+		assert.NotContains(t, res.Stderr, "over the overlay", "no forward may be announced without a session")
+		// startTimeout is 90s; past that something is waiting without a bound.
+		assert.Less(t, took, 120*time.Second, "the start must give up within its timeout")
+	})
+
+	t.Run("SIGTERM during startup exits at once", func(t *testing.T) {
+		exitCode, took, logs, err := harness.StopNBLinkDuringStartup(ctx, env, 3*time.Second, 30*time.Second)
+		require.NoError(t, err, "start and stop the forwarder")
+		assert.Equal(t, 0, exitCode, "a signal during startup is a clean exit; logs:\n%s", logs)
+		assert.Less(t, took, 5*time.Second, "the signal must not wait for the management dial to time out")
+	})
+}
+
+// TestNBLinkCheck runs the image with --check, which must validate the
+// configuration and print it without starting a session. The container has no
+// network, so a run that tried to reach management could not exit 0.
+func TestNBLinkCheck(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+
+	setupKey := "11111111-2222-3333-4444-555555555555"
+
+	t.Run("a valid configuration prints its forwards and exits 0", func(t *testing.T) {
+		res, err := harness.RunNBLinkCheck(ctx, map[string]string{
+			"NB_MANAGEMENT_URL": "https://management.invalid",
+			"NB_SETUP_KEY":      setupKey,
+			"NB_FORWARD":        "http://8080=https://one.netbird.cloud,http://127.0.0.1:0=http://two.netbird.cloud:8000/v1",
+		})
+		require.NoError(t, err, "run the check")
+		require.Equal(t, 0, res.ExitCode, "a valid configuration must pass; stderr: %s", res.Stderr)
+		assert.Contains(t, res.Stdout, "forwards: 2", "both comma-separated forwards must be parsed")
+		assert.Contains(t, res.Stdout, "127.0.0.1:8080 -> https://one.netbird.cloud",
+			"a port-only spec must bind loopback")
+		assert.Contains(t, res.Stdout, "127.0.0.1:0 -> http://two.netbird.cloud:8000/v1",
+			"the second forward must be printed as given")
+		assert.Contains(t, res.Stdout, "setup-key: true", "the check must report that a key is set")
+		assert.NotContains(t, res.Stdout+res.Stderr, setupKey, "the check must never print the key itself")
+		assert.NotContains(t, res.Stderr, "connecting to", "the check must not start a session")
+	})
+
+	t.Run("an unsupported forward exits non-zero and prints nothing", func(t *testing.T) {
+		res, err := harness.RunNBLinkCheck(ctx, map[string]string{
+			"NB_SETUP_KEY": setupKey,
+			"NB_FORWARD":   "http://8080=https://one.netbird.cloud,tcp://5432=db.netbird.cloud:5432",
+		})
+		require.NoError(t, err, "run the check")
+		assert.NotEqual(t, 0, res.ExitCode, "a bad spec must fail the check")
+		assert.Empty(t, strings.TrimSpace(res.Stdout), "a failed check must not print a configuration")
+		assert.Contains(t, res.Stderr, "tcp forwarding is not supported yet",
+			"the error must name the spec that failed")
+	})
+
+	t.Run("a public bind without the opt-in exits non-zero", func(t *testing.T) {
+		res, err := harness.RunNBLinkCheck(ctx, map[string]string{
+			"NB_FORWARD": "http://0.0.0.0:8080=https://one.netbird.cloud",
+		})
+		require.NoError(t, err, "run the check")
+		assert.NotEqual(t, 0, res.ExitCode, "binding beyond loopback must need --allow-public-bind")
+		assert.Contains(t, res.Stderr, "NB_ALLOW_PUBLIC_BIND", "the error must say how to opt in")
+	})
+}
+
+// nblinkForward builds a forward spec: a loopback listener on port, proxying
+// to upstream over the overlay.
+//
+// The listener stays on loopback, so --allow-public-bind is never passed and
+// the default an operator gets is what the suite exercises.
+func nblinkForward(port int, upstream string) string {
+	return fmt.Sprintf("http://127.0.0.1:%d=%s", port, upstream)
+}
+
+// peersWithHostname returns every peer registered under hostname.
+func peersWithHostname(ctx context.Context, t *testing.T, hostname string) []api.Peer {
+	t.Helper()
+
+	peers, err := srv.API().Peers.List(ctx)
+	require.NoError(t, err, "list peers")
+	var matched []api.Peer
+	for _, p := range peers {
+		if p.Hostname == hostname {
+			matched = append(matched, p)
+		}
+	}
+	return matched
+}
+
+func peerInGroup(p api.Peer, groupID string) bool {
+	for _, g := range p.Groups {
+		if g.Id == groupID {
+			return true
+		}
+	}
+	return false
+}
+
+// mintSetupKey creates a reusable setup key that auto-joins its peer to one
+// group, which is how a forwarder's peer lands in (or out of) a policy's
+// source groups.
+func mintSetupKey(ctx context.Context, t *testing.T, name, groupID string) string {
+	t.Helper()
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       name,
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{groupID},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key %s", name)
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+	return sk.Key
+}
+
+// chatUntil retries a chat through the forwarder until it answers with want,
+// returning the last status and body either way.
+func chatUntil(ctx context.Context, t *testing.T, nb *harness.NBLink, want int, timeout time.Duration, sessionID string) (int, string) {
+	t.Helper()
+
+	var code int
+	var body string
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		c, b, err := nb.Chat(ctx, harness.VLLMModel, "Reply with exactly: pong", sessionID)
+		if err == nil {
+			code, body = c, b
+			if code == want {
+				return code, body
+			}
+		}
+		if !waitBeforeRetry(ctx, 5*time.Second) {
+			break
+		}
+	}
+	return code, body
+}
diff --git a/e2e/agentnetwork/settings_bootstrap_test.go b/e2e/agentnetwork/settings_bootstrap_test.go
new file mode 100644
index 000000000..806ce82f4
--- /dev/null
+++ b/e2e/agentnetwork/settings_bootstrap_test.go
@@ -0,0 +1,179 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// harnessStartFresh boots a dedicated combined server with its own fresh
+// account and registers its teardown on t. Unlike the shared srv, the fresh
+// account has NOT had its agent-network endpoint bootstrapped.
+func harnessStartFresh(ctx context.Context, t *testing.T) (*harness.Combined, error) {
+	t.Helper()
+	fresh, err := harness.StartCombined(ctx)
+	if err != nil {
+		return nil, err
+	}
+	t.Cleanup(func() { _ = fresh.Terminate(context.Background()) })
+	if _, err := fresh.Bootstrap(ctx); err != nil {
+		return nil, err
+	}
+	return fresh, nil
+}
+
+// TestSettingsBootstrapViaPost covers the explicit bootstrap contract on an
+// account that has never been bootstrapped: the GET reads as the defaults
+// with an empty endpoint/proxy_address, a PUT has no row to update and fails,
+// and a POST creates the row and assigns the immutable endpoint — labeled
+// beneath a proxy address here, with the toggle overrides from the same
+// request applied. The shared srv cannot provide that starting state
+// (TestMain bootstraps it), so this boots a dedicated combined server — the
+// image is already built and cached by TestMain's StartCombined, so the extra
+// cost is one container start.
+func TestSettingsBootstrapViaPost(t *testing.T) {
+	ctx := context.Background()
+
+	fresh, err := harnessStartFresh(ctx, t)
+	require.NoError(t, err, "start dedicated combined server")
+
+	// Before agent-network bootstrap the settings read as the defaults, not
+	// as an error and not as a null body.
+	before, err := fresh.GetSettings(ctx)
+	require.NoError(t, err, "get settings on a fresh account must succeed")
+	assert.Empty(t, before.Endpoint, "endpoint must be empty before bootstrap")
+	assert.Empty(t, before.ProxyAddress, "proxy address must be empty before bootstrap")
+	assert.False(t, before.Dedicated, "an unbootstrapped account has no serving shape")
+	assert.True(t, before.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
+	assert.False(t, before.EnablePromptCollection, "defaults must show prompt collection off")
+
+	// A PUT has no row to update yet — bootstrap is the explicit POST.
+	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		EnableLogCollection:    true,
+		AccessLogRetentionDays: 30,
+	})
+	requireClientError(t, err)
+
+	// A POST with a proxy address bootstraps a labeled endpoint and applies
+	// the toggles from the same request. Every toggle is set away from its
+	// bootstrap default so each assertion can actually fail.
+	const cluster = "e2e.bootstrap.netbird.selfhosted"
+	bootstrapped, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
+		ProxyAddress:           ptr(cluster),
+		EnableLogCollection:    ptr(false),
+		EnablePromptCollection: ptr(true),
+		RedactPii:              ptr(true),
+	})
+	require.NoError(t, err, "bootstrap settings via POST must succeed")
+	assert.Equal(t, cluster, bootstrapped.ProxyAddress, "proxy address must be pinned from the request")
+	require.NotEmpty(t, bootstrapped.Endpoint, "endpoint must be assigned at bootstrap")
+	assert.True(t, strings.HasSuffix(bootstrapped.Endpoint, "."+cluster),
+		"labeled endpoint must hang one label beneath the proxy address: %s", bootstrapped.Endpoint)
+	assert.False(t, bootstrapped.Dedicated, "a labeled pin is not dedicated")
+	assert.False(t, bootstrapped.EnableLogCollection, "log collection from the bootstrap request must override the default")
+	assert.True(t, bootstrapped.EnablePromptCollection, "prompt collection from the bootstrap request must apply")
+	assert.True(t, bootstrapped.RedactPii, "redact toggle from the bootstrap request must apply")
+
+	// The row is persisted: an independent read agrees on every field.
+	after, err := fresh.GetSettings(ctx)
+	require.NoError(t, err, "get settings after bootstrap must succeed")
+	assert.Equal(t, bootstrapped.Endpoint, after.Endpoint, "bootstrap must persist across reads")
+	assert.Equal(t, bootstrapped.EnableLogCollection, after.EnableLogCollection, "log collection must persist")
+	assert.Equal(t, bootstrapped.EnablePromptCollection, after.EnablePromptCollection, "prompt collection must persist")
+	assert.Equal(t, bootstrapped.RedactPii, after.RedactPii, "redact toggle must persist")
+
+	// Once bootstrapped, PUT updates the toggles. The identity fields ride
+	// along as a required echo of the assigned values; a matching echo is
+	// accepted and never written.
+	persisted, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		Endpoint:               bootstrapped.Endpoint,
+		ProxyAddress:           bootstrapped.ProxyAddress,
+		EnableLogCollection:    true,
+		EnablePromptCollection: false,
+		RedactPii:              true,
+		AccessLogRetentionDays: 21,
+	})
+	require.NoError(t, err, "post-bootstrap update must succeed")
+	require.NotNil(t, persisted.AccessLogRetentionDays)
+	assert.Equal(t, 21, *persisted.AccessLogRetentionDays, "retention from the update must apply")
+	assert.Equal(t, bootstrapped.Endpoint, persisted.Endpoint, "endpoint must survive updates untouched")
+	assert.Equal(t, cluster, persisted.ProxyAddress, "proxy address must survive updates untouched")
+	assert.True(t, persisted.EnableLogCollection, "post-bootstrap toggle must apply")
+	assert.False(t, persisted.EnablePromptCollection, "post-bootstrap toggle must apply")
+
+	// The endpoint is immutable: a PUT carrying a different endpoint is
+	// rejected, and a second bootstrap is rejected as a conflict. Neither
+	// rejected write may disturb anything.
+	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		Endpoint:               "other.cluster.invalid",
+		ProxyAddress:           persisted.ProxyAddress,
+		EnableLogCollection:    persisted.EnableLogCollection,
+		EnablePromptCollection: persisted.EnablePromptCollection,
+		RedactPii:              persisted.RedactPii,
+		AccessLogRetentionDays: 21,
+	})
+	requireClientError(t, err)
+
+	_, err = fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
+		Endpoint: ptr("other.cluster.invalid"),
+	})
+	requireClientError(t, err)
+
+	final, err := fresh.GetSettings(ctx)
+	require.NoError(t, err, "get settings after the rejected bootstrap must succeed")
+	assert.Equal(t, persisted.Endpoint, final.Endpoint, "rejected bootstrap must not change the endpoint")
+	assert.Equal(t, persisted.ProxyAddress, final.ProxyAddress, "rejected bootstrap must not change the proxy address")
+	assert.Equal(t, persisted.EnableLogCollection, final.EnableLogCollection, "rejected bootstrap must not apply its toggles")
+	assert.Equal(t, persisted.EnablePromptCollection, final.EnablePromptCollection, "rejected bootstrap must not apply its toggles")
+	assert.Equal(t, persisted.RedactPii, final.RedactPii, "rejected bootstrap must not apply its toggles")
+}
+
+// TestSettingsBootstrapSelfAddressed covers the dedicated shape end to end:
+// a POST carrying an endpoint claims the hostname verbatim, the proxy address
+// equals it, and the pin reads as dedicated — the address-first flow a
+// self-hosted operator uses before deploying the proxy that will declare it.
+// The tail covers the recovery path the guarded DELETE exists for: with no
+// providers and no proxy at the address, the claim can be released and a
+// fresh bootstrap succeeds — the fix for a typo'd immutable endpoint.
+func TestSettingsBootstrapSelfAddressed(t *testing.T) {
+	ctx := context.Background()
+
+	fresh, err := harnessStartFresh(ctx, t)
+	require.NoError(t, err, "start dedicated combined server")
+
+	created, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
+		Endpoint: ptr("gw.e2e.netbird.selfhosted"),
+	})
+	require.NoError(t, err, "self-addressed bootstrap must succeed")
+	assert.Equal(t, "gw.e2e.netbird.selfhosted", created.Endpoint, "endpoint must be claimed verbatim")
+	assert.Equal(t, created.Endpoint, created.ProxyAddress, "self-addressed: proxy address is the endpoint")
+	assert.True(t, created.Dedicated, "a self-addressed pin is dedicated")
+
+	// No providers exist and no proxy declares the address, so both delete
+	// guards are clear: the delete releases the claim and the account reads
+	// as unbootstrapped defaults again.
+	require.NoError(t, fresh.DeleteSettings(ctx), "guarded delete with both guards clear must succeed")
+
+	after, err := fresh.GetSettings(ctx)
+	require.NoError(t, err, "get settings after delete must succeed")
+	assert.Empty(t, after.Endpoint, "a deleted account must read as unbootstrapped")
+
+	// A second delete has nothing to remove.
+	requireClientError(t, fresh.DeleteSettings(ctx))
+
+	// Re-creating is a fresh bootstrap — the released hostname is free to be
+	// claimed again, or a different one chosen.
+	recreated, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
+		Endpoint: ptr("gw2.e2e.netbird.selfhosted"),
+	})
+	require.NoError(t, err, "bootstrap after delete must succeed")
+	assert.Equal(t, "gw2.e2e.netbird.selfhosted", recreated.Endpoint, "the fresh bootstrap claims the new hostname")
+}
diff --git a/e2e/agentnetwork/settings_cluster_validation_test.go b/e2e/agentnetwork/settings_cluster_validation_test.go
new file mode 100644
index 000000000..82c84dc74
--- /dev/null
+++ b/e2e/agentnetwork/settings_cluster_validation_test.go
@@ -0,0 +1,178 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestSettingsBootstrapValidatesProxyCluster covers the bootstrap-time check
+// on the picked cluster, end to end against a real proxy.
+//
+// The synthesised gateway service is always private: agents reach it over the
+// WireGuard tunnel and are authorised by their peer identity. Only a cluster
+// with private capabilities can serve that, and management reports it per
+// cluster as the `private` capability — the same supports_private flag the
+// dashboard reads to decide which clusters it may offer. The endpoint assigned at bootstrap is immutable, so pinning
+// to a cluster that cannot serve it has to be refused up front rather than
+// leaving the account with a dead gateway.
+//
+// One combined server and one cluster address, walked through three states:
+// a live centralised proxy (refused), that proxy stopped so nothing in the
+// cluster is live any more (still refused — the record of what the cluster is
+// outlives its heartbeats), and finally a private-capable proxy (accepted, the
+// capability being any-true across the cluster's live proxies). Same account,
+// same address, so nothing but the cluster's state accounts for the different
+// answers.
+func TestSettingsBootstrapValidatesProxyCluster(t *testing.T) {
+	ctx := context.Background()
+
+	fresh, err := harnessStartFresh(ctx, t)
+	require.NoError(t, err, "start dedicated combined server")
+
+	proxyToken, err := fresh.CreateProxyTokenCLI(ctx, "e2e-cluster-validation")
+	require.NoError(t, err, "mint proxy token via CLI")
+
+	const cluster = harness.AgentNetworkCluster
+
+	// A centralised proxy: connected and serving the cluster, but without
+	// private capabilities, so it cannot serve a private service.
+	central, err := harness.StartProxy(ctx, fresh, proxyToken, map[string]string{
+		"NB_PROXY_PRIVATE": "false",
+	})
+	require.NoError(t, err, "start centralised proxy")
+	// Terminated mid-test; the cleanup only covers an early failure.
+	t.Cleanup(func() { _ = central.Terminate(context.Background()) })
+
+	waitClusterPrivate(ctx, t, fresh, cluster, false)
+
+	_, err = fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
+		ProxyAddress: ptr(cluster),
+	})
+	require.Error(t, err, "bootstrap onto a cluster without private capabilities must be refused")
+	requireClientError(t, err)
+	assert.Contains(t, err.Error(), "private capabilities",
+		"the refusal must name what the cluster is missing: %v", err)
+
+	after, err := fresh.GetSettings(ctx)
+	require.NoError(t, err, "settings must still read after a refused bootstrap")
+	assert.Empty(t, after.Endpoint, "a refused bootstrap must not assign an endpoint")
+	assert.Empty(t, after.ProxyAddress, "a refused bootstrap must not pin a cluster")
+
+	// Stopping the centralised proxy must not turn the refusal into an
+	// acceptance: the cluster's proxy rows outlive their heartbeats (only the
+	// hourly stale reaper removes them), so the cluster is still on record as
+	// one that cannot serve the gateway. Judging on liveness instead would
+	// make "wait for the proxy to go quiet" a way to pin the account's
+	// immutable endpoint to a cluster that can never serve it.
+	require.NoError(t, central.Terminate(ctx), "stop the centralised proxy")
+	waitClusterAbsent(ctx, t, fresh, cluster)
+
+	_, err = fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
+		ProxyAddress: ptr(cluster),
+	})
+	require.Error(t, err, "an offline cluster without private capabilities on record must stay refused")
+	requireClientError(t, err)
+
+	// Add a private-capable proxy to the same cluster: now it can serve a private
+	// service, and the very same request must go through.
+	privateProxy, err := harness.StartProxy(ctx, fresh, proxyToken)
+	require.NoError(t, err, "start private-capable proxy")
+	t.Cleanup(func() { _ = privateProxy.Terminate(context.Background()) })
+
+	waitClusterPrivate(ctx, t, fresh, cluster, true)
+
+	bootstrapped, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
+		ProxyAddress: ptr(cluster),
+	})
+	require.NoError(t, err, "bootstrap onto a private-capable cluster must succeed")
+	assert.Equal(t, cluster, bootstrapped.ProxyAddress, "the pinned cluster is the requested one")
+	assert.True(t, strings.HasSuffix(bootstrapped.Endpoint, "."+cluster),
+		"the endpoint must hang one label beneath the cluster: %s", bootstrapped.Endpoint)
+}
+
+// waitClusterPrivate polls the domains endpoint — the list the dashboard picks
+// its bootstrap cluster from — until the free domain for clusterAddr reports
+// supports_private == want. A proxy's capabilities land when it registers, so
+// this is the barrier between starting a proxy and asserting on what
+// management thinks its cluster can do.
+func waitClusterPrivate(ctx context.Context, t *testing.T, c *harness.Combined, clusterAddr string, want bool) {
+	t.Helper()
+
+	deadline := time.Now().Add(90 * time.Second)
+	var last string
+	for time.Now().Before(deadline) {
+		domains, err := c.API().ReverseProxyDomains.List(ctx)
+		if err != nil {
+			last = "list domains: " + err.Error()
+		} else {
+			last = "cluster not listed"
+			for _, d := range domains {
+				if d.Domain != clusterAddr {
+					continue
+				}
+				if d.SupportsPrivate == nil {
+					last = "supports_private not reported yet"
+					break
+				}
+				if *d.SupportsPrivate == want {
+					return
+				}
+				last = "supports_private is not the expected value"
+				break
+			}
+		}
+		if !waitBeforeRetry(ctx, 2*time.Second) {
+			break
+		}
+	}
+	t.Fatalf("cluster %s never reported supports_private=%v: %s", clusterAddr, want, last)
+}
+
+// waitClusterAbsent polls the domains endpoint until clusterAddr is no longer
+// offered, i.e. management sees no live proxy in it. The free-domain list is
+// built from the active clusters, so this is how a proxy going away becomes
+// observable — while the cluster's rows, and so its capability record, remain.
+//
+// The budget has to clear the active window, not just the disconnect: a proxy
+// that closes its stream cleanly is marked disconnected at once, but one that
+// dies without that is only dropped when its last heartbeat ages past
+// proxyActiveThreshold (2 minutes), so a 90s deadline could fail the test on
+// the slow path alone.
+func waitClusterAbsent(ctx context.Context, t *testing.T, c *harness.Combined, clusterAddr string) {
+	t.Helper()
+
+	deadline := time.Now().Add(3 * time.Minute)
+	var last string
+	for time.Now().Before(deadline) {
+		domains, err := c.API().ReverseProxyDomains.List(ctx)
+		if err != nil {
+			last = "list domains: " + err.Error()
+		} else {
+			listed := false
+			for _, d := range domains {
+				if d.Domain == clusterAddr {
+					listed = true
+					break
+				}
+			}
+			if !listed {
+				return
+			}
+			last = "cluster still listed as active"
+		}
+		if !waitBeforeRetry(ctx, 2*time.Second) {
+			break
+		}
+	}
+	t.Fatalf("cluster %s never dropped out of the active list: %s", clusterAddr, last)
+}
diff --git a/e2e/agentnetwork/skiptls_test.go b/e2e/agentnetwork/skiptls_test.go
index 077fd6005..85af8c604 100644
--- a/e2e/agentnetwork/skiptls_test.go
+++ b/e2e/agentnetwork/skiptls_test.go
@@ -66,9 +66,7 @@ func TestProviderSkipTLSVerification(t *testing.T) {
 		}
 	}
 
-	// First create bootstraps the account cluster.
 	insecureReq := newReq("skip-tls", insecureModel, true)
-	insecureReq.BootstrapCluster = ptr(harness.AgentNetworkCluster)
 	insecureProv, err := srv.CreateProvider(ctx, insecureReq)
 	require.NoError(t, err, "create skip-tls provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), insecureProv.Id) })
@@ -104,11 +102,12 @@ func TestProviderSkipTLSVerification(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Probe first: the GET resolves the endpoint (DNS error fails) and its first packet wakes the lazy proxy peer, so WaitProxyPeer sees it connected; any HTTP status counts.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
 		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
 	}
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve endpoint to proxy IP")
 
 	// Positive: skip=true reaches the self-signed upstream. Retry to absorb
 	// tunnel/DNS jitter on the first call; success also proves the path works.
diff --git a/e2e/agentnetwork/streaming_test.go b/e2e/agentnetwork/streaming_test.go
new file mode 100644
index 000000000..a5fa8df3f
--- /dev/null
+++ b/e2e/agentnetwork/streaming_test.go
@@ -0,0 +1,209 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// streamedModel is priced high enough that a mis-metered request is obvious in
+// the recorded cost, and named so it cannot collide with another test's route.
+const streamedModel = "e2e-streamed-model"
+
+const (
+	streamInRate  = 0.010
+	streamOutRate = 0.020
+	// The cache-read bucket is priced separately from input, so a run that
+	// folded the two together fails the per-bucket assertions below.
+	streamCacheReadRate = 0.001
+)
+
+// TestStreamingResponseMetersInputTokens is the end-to-end guard for the
+// metering bug this endpoint's gateway-protocol work fixed.
+//
+// On a streamed answer the input-token count exists only in the opening
+// message_start event; every later frame reports output. A response read with
+// the wrong vendor's parser — the shape a gateway record produces when it names
+// one API surface and serves another — never looks at that event, so input
+// metered as zero and the bulk of the bill silently vanished. Nothing in the
+// suite sent stream: true before this test, so the whole branch went unrun.
+//
+// The provider points at the mock's streaming listener, which answers every
+// request as SSE with token counts that differ from the buffered surface. That
+// difference is the point: passing these assertions is only possible if the
+// stream accumulator ran.
+func TestStreamingResponseMetersInputTokens(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	env := provisionStreamingProvider(t, ctx, "anthropic_api")
+
+	sessionID := fmt.Sprintf("e2e-session-stream-%d", time.Now().UnixNano())
+	code, body := chatStreamUntil(t, ctx, env, harness.WireMessages, streamedModel, sessionID)
+	require.Equal(t, 200, code, "streamed chat must succeed; body: %s", body)
+	assert.Contains(t, body, "message_start",
+		"the client must receive the event stream itself, not a buffered rewrite of it")
+
+	row := findAccessLogBySession(t, ctx, sessionID)
+
+	assert.Equal(t, harness.VLLMStreamInputTokens, int(row.InputTokens),
+		"input tokens live in message_start; zero here is the bug this test exists for")
+	assert.Equal(t, harness.VLLMStreamOutputTokens, int(row.OutputTokens),
+		"output tokens ride message_delta and supersede the message_start seed")
+	assert.Equal(t, harness.VLLMStreamCacheReadTokens, int(row.CachedInputTokens),
+		"the Anthropic cache bucket rides message_start too, and only its own parser reads it")
+
+	// The Anthropic surface bills cache reads additively, so the input bucket
+	// prices the full input count rather than a remainder.
+	wantInput := float64(harness.VLLMStreamInputTokens) / 1000 * streamInRate
+	wantOutput := float64(harness.VLLMStreamOutputTokens) / 1000 * streamOutRate
+	wantCacheRead := float64(harness.VLLMStreamCacheReadTokens) / 1000 * streamCacheReadRate
+	assert.InDelta(t, wantInput, row.InputCostUsd, 1e-6, "input cost must price the streamed input tokens")
+	assert.InDelta(t, wantOutput, row.OutputCostUsd, 1e-6, "output cost must price the streamed output tokens")
+	// The total, not merely a positive number: input and output alone are
+	// positive, so a cache bucket parsed and then never billed would pass any
+	// weaker assertion. The gap is 7e-6, well outside the delta.
+	assert.InDelta(t, wantInput+wantOutput+wantCacheRead, row.CostUsd, 1e-6,
+		"the recorded cost must be every bucket the surface bills, cache reads included")
+}
+
+// TestStreamingOnGatewayTypedProvider drives the same streamed Anthropic call
+// through a provider record whose catalog id names the OpenAI surface — the
+// exact misconfiguration that hid the bug, since gateway records commonly pin
+// one parser while the upstream serves another shape entirely.
+//
+// The router must choose the parser from the request path rather than the
+// record's provider id, or the Anthropic usage block goes unread and input
+// meters at zero all over again.
+func TestStreamingOnGatewayTypedProvider(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	env := provisionStreamingProvider(t, ctx, "openai_api")
+
+	sessionID := fmt.Sprintf("e2e-session-stream-gw-%d", time.Now().UnixNano())
+	code, body := chatStreamUntil(t, ctx, env, harness.WireMessages, streamedModel, sessionID)
+	require.Equal(t, 200, code, "streamed chat through a gateway record must succeed; body: %s", body)
+
+	row := findAccessLogBySession(t, ctx, sessionID)
+
+	assert.Equal(t, harness.VLLMStreamInputTokens, int(row.InputTokens),
+		"a record typed openai_api must still read the Anthropic usage block it is actually serving")
+	assert.Equal(t, harness.VLLMStreamOutputTokens, int(row.OutputTokens),
+		"output tokens must survive the surface mismatch too")
+	assert.InDelta(t, float64(harness.VLLMStreamInputTokens)/1000*streamInRate, row.InputCostUsd, 1e-6,
+		"the request must be priced on the surface it spoke, not the one the record names")
+}
+
+// provisionStreamingProvider brings up the mock, one provider pointed at its
+// streaming listener under the given catalog id, a policy authorising it, and a
+// connected proxy + client.
+func provisionStreamingProvider(t *testing.T, ctx context.Context, catalogID string) pricedEnv {
+	t.Helper()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	name := "stream-" + catalogID
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-" + name})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-" + name + "-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	// Deleting the group does not delete the key it auto-joins, so the key
+	// needs a cleanup of its own.
+	t.Cleanup(func() { _ = srv.API().SetupKeys.Delete(context.Background(), sk.Id) })
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	dummyKey := "sk-stream-e2e"
+	cacheRead := streamCacheReadRate
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        name,
+		ProviderId:  catalogID,
+		UpstreamUrl: vllm.StreamURL,
+		ApiKey:      &dummyKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{{
+			Id:             streamedModel,
+			InputPer1k:     streamInRate,
+			OutputPer1k:    streamOutRate,
+			CacheReadPer1k: &cacheRead,
+		}},
+	})
+	require.NoError(t, err, "create provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-" + name,
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		Limits: &api.AgentNetworkPolicyLimits{
+			TokenLimit: api.AgentNetworkPolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      10_000_000,
+				UserCap:       10_000_000,
+				WindowSeconds: 60,
+			},
+		},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	endpoint, proxyIP, cl, px := connectClient(t, ctx, name, sk.Key)
+	return pricedEnv{
+		providerID: prov.Id,
+		groupID:    grp.Id,
+		policyID:   pol.Id,
+		upstream:   vllm.StreamURL,
+		endpoint:   endpoint,
+		proxyIP:    proxyIP,
+		client:     cl,
+		proxy:      px,
+	}
+}
+
+// chatStreamUntil drives one streamed chat, retrying to absorb the tunnel and
+// DNS jitter a first call through a fresh peer can hit.
+func chatStreamUntil(t *testing.T, ctx context.Context, env pricedEnv, kind, model, sessionID string) (int, string) {
+	t.Helper()
+	var code int
+	var body string
+	deadline := time.Now().Add(90 * time.Second)
+	for time.Now().Before(deadline) {
+		c, b, cerr := env.client.ChatStream(ctx, env.endpoint, env.proxyIP, kind, model, "Reply with exactly: pong", sessionID)
+		if cerr == nil {
+			code, body = c, b
+			if code == 200 {
+				break
+			}
+		}
+		if !waitBeforeRetry(ctx, 5*time.Second) {
+			break
+		}
+	}
+	if code != 200 {
+		t.Logf("=== proxy logs ===\n%s", env.proxy.Logs(context.Background()))
+	}
+	return code, body
+}
diff --git a/e2e/agentnetwork/vllm_test.go b/e2e/agentnetwork/vllm_test.go
index 329994ca9..6f5117b2f 100644
--- a/e2e/agentnetwork/vllm_test.go
+++ b/e2e/agentnetwork/vllm_test.go
@@ -57,12 +57,11 @@ func TestVLLMProvider(t *testing.T) {
 	// is enumerated so the router dispatches this model string to this provider.
 	dummyKey := "sk-vllm-e2e"
 	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:             "vllm",
-		ProviderId:       "vllm",
-		UpstreamUrl:      vllm.URL,
-		ApiKey:           &dummyKey,
-		Enabled:          ptr(true),
-		BootstrapCluster: ptr(harness.AgentNetworkCluster),
+		Name:        "vllm",
+		ProviderId:  "vllm",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &dummyKey,
+		Enabled:     ptr(true),
 		Models: &[]api.AgentNetworkProviderModel{
 			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002},
 		},
@@ -106,11 +105,12 @@ func TestVLLMProvider(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Probe first: the GET resolves the endpoint (DNS error fails) and its first packet wakes the lazy proxy peer, so WaitProxyPeer sees it connected; any HTTP status counts.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
 		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
 	}
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve endpoint to proxy IP")
 
 	before, _ := srv.ListAccessLogs(ctx)
 	sessionID := "e2e-session-vllm"
diff --git a/e2e/harness/Dockerfile.client b/e2e/harness/Dockerfile.client
index 114577d60..4c76b95c6 100644
--- a/e2e/harness/Dockerfile.client
+++ b/e2e/harness/Dockerfile.client
@@ -3,7 +3,7 @@
 # artifact), so this mirrors its alpine runtime + entrypoint while compiling the
 # CGO-free client inline. BuildKit cache mounts keep rebuilds incremental.
 
-FROM golang:1.25-bookworm AS builder
+FROM golang:1.26.7-bookworm AS builder
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN --mount=type=cache,target=/go/pkg/mod go mod download
@@ -20,5 +20,9 @@ ENV NETBIRD_BIN="/usr/local/bin/netbird" \
     NB_ENABLE_CAPTURE="false" \
     NB_ENTRYPOINT_SERVICE_TIMEOUT="30"
 ENTRYPOINT [ "/usr/local/bin/netbird-entrypoint.sh" ]
-COPY client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
+# --chmod because the build context is not always a git checkout. A suite in
+# another module builds from this module's extracted copy in the module cache,
+# where every file is 0444 — the cache drops the executable bit git records — and
+# a bare COPY then produces an entrypoint the runtime cannot exec.
+COPY --chmod=0755 client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
 COPY --from=builder /out/netbird /usr/local/bin/netbird
diff --git a/e2e/harness/Dockerfile.nblink b/e2e/harness/Dockerfile.nblink
new file mode 100644
index 000000000..dac3aceec
--- /dev/null
+++ b/e2e/harness/Dockerfile.nblink
@@ -0,0 +1,37 @@
+# Multistage build for nblink, used in e2e tests. The release image
+# (client/Dockerfile-nblink) packages a goreleaser artifact, so this compiles
+# from source the way Dockerfile.client does for the agent, while keeping the
+# release image's runtime shape: distroless, non-root, numeric UID.
+#
+# The runtime stage deliberately grants nothing. nblink's claim is that it
+# needs no TUN device and no capabilities, so an image or a container request
+# that quietly hands it NET_ADMIN would make the suite prove the opposite of
+# what it is for.
+
+FROM golang:1.26.7-bookworm AS builder
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS=linux go build -o /out/nblink ./client/link/cmd/nblink \
+    && mkdir -p /out/state/nblink && chmod 770 /out/state/nblink
+
+FROM gcr.io/distroless/static-debian13:nonroot
+
+# Same state directory as the release image, so a volume mounted over it
+# starts out owned by 65532:0 and the identity-persistence case runs against
+# the ownership the release image ships.
+COPY --from=builder --chown=65532:0 /out/state/ /var/lib/
+
+# Numeric, as in the release image: the runtime may substitute its own UID and
+# there is no passwd entry to look up.
+USER 65532:0
+
+# No NB_STATE_DIR by default. State stays in memory and each run registers a
+# fresh peer; the persistence case sets it explicitly with a volume.
+ENV NB_LOG_LEVEL=info
+
+COPY --from=builder /out/nblink /usr/local/bin/nblink
+ENTRYPOINT ["/usr/local/bin/nblink"]
diff --git a/e2e/harness/agentnetwork.go b/e2e/harness/agentnetwork.go
index 192385ab1..8f688836d 100644
--- a/e2e/harness/agentnetwork.go
+++ b/e2e/harness/agentnetwork.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
@@ -74,6 +75,13 @@ func (c *Combined) DeleteProvider(ctx context.Context, id string) error {
 	return anDelete(ctx, c, "/api/agent-network/providers/"+id)
 }
 
+// UpdateProvider replaces a provider by id (PUT). The API key may be omitted on
+// the request to keep the stored one; Models replaces the enumerated list, so
+// this is the path a test uses to change a model's price mid-run.
+func (c *Combined) UpdateProvider(ctx context.Context, id string, req api.AgentNetworkProviderRequest) (api.AgentNetworkProvider, error) {
+	return anRequest[api.AgentNetworkProvider](ctx, c, http.MethodPut, "/api/agent-network/providers/"+id, req)
+}
+
 // SetProviderEnabled toggles a provider's enabled flag, preserving its other
 // fields (the API key is omitted, which keeps the stored one). Used to run one
 // provider at a time so model→provider routing is unambiguous.
@@ -92,6 +100,15 @@ func (c *Combined) SetProviderEnabled(ctx context.Context, id string, enabled bo
 	return err
 }
 
+// GetAgentConfig returns the caller-scoped self-service connection config —
+// the answer the dashboard's "Connect Agent" view renders for the PAT's user.
+// Providers appear only when the caller's own groups intersect an enabled
+// policy's source groups, so tests must place the PAT user into the policy's
+// source group first (via the Users API auto-groups).
+func (c *Combined) GetAgentConfig(ctx context.Context) (api.AgentNetworkAgentConfig, error) {
+	return anRequest[api.AgentNetworkAgentConfig](ctx, c, http.MethodGet, "/api/agent-network/agent-config", nil)
+}
+
 // CreatePolicy creates an agent-network policy.
 func (c *Combined) CreatePolicy(ctx context.Context, req api.AgentNetworkPolicyRequest) (api.AgentNetworkPolicy, error) {
 	return anRequest[api.AgentNetworkPolicy](ctx, c, http.MethodPost, "/api/agent-network/policies", req)
@@ -107,17 +124,49 @@ func (c *Combined) DeletePolicy(ctx context.Context, id string) error {
 	return anDelete(ctx, c, "/api/agent-network/policies/"+id)
 }
 
-// GetSettings returns the account's agent-network settings row. It exists only
-// after the first provider create bootstraps it.
+// CreateGuardrail creates an agent-network guardrail (e.g. a model allowlist)
+// that can then be attached to a policy via its GuardrailIds.
+func (c *Combined) CreateGuardrail(ctx context.Context, req api.AgentNetworkGuardrailRequest) (api.AgentNetworkGuardrail, error) {
+	return anRequest[api.AgentNetworkGuardrail](ctx, c, http.MethodPost, "/api/agent-network/guardrails", req)
+}
+
+// DeleteGuardrail removes a guardrail by id.
+func (c *Combined) DeleteGuardrail(ctx context.Context, id string) error {
+	return anDelete(ctx, c, "/api/agent-network/guardrails/"+id)
+}
+
+// CreateBudgetRule creates an account-level agent-network budget rule.
+func (c *Combined) CreateBudgetRule(ctx context.Context, req api.AgentNetworkBudgetRuleRequest) (api.AgentNetworkBudgetRule, error) {
+	return anRequest[api.AgentNetworkBudgetRule](ctx, c, http.MethodPost, "/api/agent-network/budget-rules", req)
+}
+
+// CreateSettings bootstraps the account's agent-network settings row,
+// assigning the immutable endpoint. Exactly one of req.ProxyAddress (labeled
+// endpoint beneath that cluster) and req.Endpoint (self-addressed dedicated
+// endpoint) must be set; a second bootstrap returns a conflict.
+func (c *Combined) CreateSettings(ctx context.Context, req api.AgentNetworkSettingsCreateRequest) (api.AgentNetworkSettings, error) {
+	return anRequest[api.AgentNetworkSettings](ctx, c, http.MethodPost, "/api/agent-network/settings", req)
+}
+
+// GetSettings returns the account's agent-network settings row. Before the
+// CreateSettings bootstrap it reads as the defaults with an empty endpoint.
 func (c *Combined) GetSettings(ctx context.Context) (api.AgentNetworkSettings, error) {
 	return anRequest[api.AgentNetworkSettings](ctx, c, http.MethodGet, "/api/agent-network/settings", nil)
 }
 
-// UpdateSettings applies the mutable collection toggles.
+// UpdateSettings applies the mutable collection toggles. The request must
+// echo the assigned endpoint and proxy address unchanged — the server rejects
+// a PUT that tries to change them.
 func (c *Combined) UpdateSettings(ctx context.Context, req api.AgentNetworkSettingsRequest) (api.AgentNetworkSettings, error) {
 	return anRequest[api.AgentNetworkSettings](ctx, c, http.MethodPut, "/api/agent-network/settings", req)
 }
 
+// DeleteSettings removes the account's settings row, releasing the endpoint.
+// Refused while providers exist or a proxy is actively serving the endpoint.
+func (c *Combined) DeleteSettings(ctx context.Context) error {
+	return anDelete(ctx, c, "/api/agent-network/settings")
+}
+
 // ListConsumption returns the account's consumption rows (possibly empty).
 func (c *Combined) ListConsumption(ctx context.Context) ([]api.AgentNetworkConsumption, error) {
 	return anRequest[[]api.AgentNetworkConsumption](ctx, c, http.MethodGet, "/api/agent-network/consumption", nil)
@@ -128,3 +177,16 @@ func (c *Combined) ListConsumption(ctx context.Context) ([]api.AgentNetworkConsu
 func (c *Combined) ListAccessLogs(ctx context.Context) (api.AgentNetworkAccessLogsResponse, error) {
 	return anRequest[api.AgentNetworkAccessLogsResponse](ctx, c, http.MethodGet, "/api/agent-network/access-logs", nil)
 }
+
+// ListAccessLogsFiltered returns the access-log page narrowed by the given
+// query parameters (e.g. model=..., session_id=..., provider_id=...). This
+// exercises management's server-side filtering rather than filtering client
+// side, so a row that is ingested but not indexed under the filtered column
+// surfaces as an empty page.
+func (c *Combined) ListAccessLogsFiltered(ctx context.Context, query url.Values) (api.AgentNetworkAccessLogsResponse, error) {
+	path := "/api/agent-network/access-logs"
+	if encoded := query.Encode(); encoded != "" {
+		path += "?" + encoded
+	}
+	return anRequest[api.AgentNetworkAccessLogsResponse](ctx, c, http.MethodGet, path, nil)
+}
diff --git a/e2e/harness/cert.go b/e2e/harness/cert.go
index c8a28e470..b322ab6d2 100644
--- a/e2e/harness/cert.go
+++ b/e2e/harness/cert.go
@@ -18,8 +18,8 @@ import (
 
 // writeSelfSignedCert generates a self-signed TLS cert/key pair covering the
 // given DNS names and writes them as tls.crt / tls.key in dir. The proxy serves
-// this for the agent-network endpoint; the client curls with -k, so validity
-// chains don't matter — the proxy just needs a usable cert to present.
+// this for the agent-network endpoint; test clients either trust the generated
+// certificate explicitly or opt out of verification inside the test network.
 func writeSelfSignedCert(dir string, dnsNames []string) error {
 	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
diff --git a/e2e/harness/client.go b/e2e/harness/client.go
index 1ce8c0f6e..9843c25b2 100644
--- a/e2e/harness/client.go
+++ b/e2e/harness/client.go
@@ -4,8 +4,10 @@ package harness
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
+	"net/http"
 	"os/exec"
 	"strconv"
 	"strings"
@@ -29,14 +31,41 @@ const (
 // Client is a running NetBird client container joined to the combined server.
 type Client struct {
 	container testcontainers.Container
+	// name is the container hostname the agent reports to management at
+	// registration — the name the peer appears under in the peers API.
+	name string
+}
+
+// clientOptions is what the ClientOption values assemble.
+type clientOptions struct {
+	name string
+}
+
+// ClientOption adjusts how StartClient runs the agent.
+type ClientOption func(*clientOptions)
+
+// WithClientName names the agent, which sets both its network alias and its
+// container hostname. The hostname matters beyond addressing: the agent reports
+// it to management at registration, so it is the name the peer appears under in
+// the API.
+//
+// Required to run more than one agent against the same server — the default name
+// is shared, and two containers cannot hold the same alias on one network.
+func WithClientName(name string) ClientOption {
+	return func(o *clientOptions) { o.name = name }
 }
 
 // StartClient builds the client image and runs it on the combined server's
 // network, joining via the given setup key. The image entrypoint brings the
 // daemon up automatically; callers wait for connectivity with WaitConnected /
 // WaitProxyPeer.
-func StartClient(ctx context.Context, c *Combined, setupKey string) (*Client, error) {
-	root, err := repoRoot()
+func StartClient(ctx context.Context, c *Combined, setupKey string, opts ...ClientOption) (*Client, error) {
+	o := clientOptions{name: clientAlias}
+	for _, opt := range opts {
+		opt(&o)
+	}
+
+	root, err := repoRoot(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -46,9 +75,13 @@ func StartClient(ctx context.Context, c *Combined, setupKey string) (*Client, er
 	}
 
 	req := testcontainers.ContainerRequest{
-		Image:          clientImage,
+		Image: clientImage,
+		// The agent reports the container's hostname to management, so this is
+		// the name the peer is addressable by in the API as well as on the
+		// network. The entrypoint takes no hostname flag of its own.
+		Hostname:       o.name,
 		Networks:       []string{c.network.Name},
-		NetworkAliases: map[string][]string{c.network.Name: {clientAlias}},
+		NetworkAliases: map[string][]string{c.network.Name: {o.name}},
 		Env: map[string]string{
 			"NB_MANAGEMENT_URL": combinedExposedURL,
 			"NB_SETUP_KEY":      setupKey,
@@ -69,24 +102,38 @@ func StartClient(ctx context.Context, c *Combined, setupKey string) (*Client, er
 	if err != nil {
 		return nil, fmt.Errorf("start client container: %w", err)
 	}
-	return &Client{container: ctr}, nil
+	return &Client{container: ctr, name: o.name}, nil
+}
+
+// Hostname returns the container hostname the agent reports to management —
+// the name the registered peer appears under in the peers API.
+func (cl *Client) Hostname() string {
+	return cl.name
 }
 
 // Restart bounces the client connection (netbird down/up) so it pulls a fresh
 // network map — the documented workaround for a freshly-joined client not yet
 // seeing a synthesized agent-network service.
 func (cl *Client) Restart(ctx context.Context) error {
+	return cl.Up(ctx)
+}
+
+// Up re-runs `netbird up` inside the client with the given extra flags (e.g.
+// "--allow-remote-jobs"), bouncing the connection first so the new config is
+// picked up and re-synced to management. Used to toggle peer options that ride
+// on the login/sync request without recreating the container.
+func (cl *Client) Up(ctx context.Context, extraArgs ...string) error {
 	if _, _, err := cl.container.Exec(ctx, []string{"netbird", "down"}, tcexec.Multiplexed()); err != nil {
 		return fmt.Errorf("netbird down: %w", err)
 	}
 	time.Sleep(2 * time.Second)
-	code, reader, err := cl.container.Exec(ctx, []string{"netbird", "up"}, tcexec.Multiplexed())
+	code, reader, err := cl.container.Exec(ctx, append([]string{"netbird", "up"}, extraArgs...), tcexec.Multiplexed())
 	if err != nil {
 		return fmt.Errorf("netbird up: %w", err)
 	}
 	if code != 0 {
 		out, _ := io.ReadAll(reader)
-		return fmt.Errorf("netbird up exited %d: %s", code, string(out))
+		return fmt.Errorf("netbird up %v exited %d: %s", extraArgs, code, string(out))
 	}
 	return nil
 }
@@ -167,22 +214,68 @@ func (cl *Client) pollStatus(ctx context.Context, timeout time.Duration, want st
 	return fmt.Errorf("timed out waiting for %q; last status:\n%s", want, last)
 }
 
-// ResolveProxyIP resolves the agent-network endpoint to the proxy peer's
-// NetBird IP from inside the client (via magic DNS).
+const (
+	// curlExitCouldNotResolve is curl's exit code for a DNS resolution failure, distinct from connection-level failures.
+	curlExitCouldNotResolve = 6
+	// curlExitCouldNotConnect is curl's exit code for a connection that never
+	// established. The probe exists to WAKE the lazy proxy peer, so the first
+	// attempt legitimately arrives before WireGuard has brought the tunnel up
+	// and fails here — which is propagation, exactly like an early NXDOMAIN,
+	// and belongs inside the retry window rather than failing the test outright.
+	curlExitCouldNotConnect = 7
+	// endpointProbeRetryWindow bounds retries of the transient failures above: the synthesized zone and the tunnel both land a beat after management connects. Still failing after this window is a real failure.
+	endpointProbeRetryWindow   = 30 * time.Second
+	endpointProbeRetryInterval = 2 * time.Second
+)
+
+// ResolveProxyIP GETs https://<endpoint>/ from the client's netns: any HTTP status proves DNS + tunnel and wakes the lazy proxy peer; DNS and connect failures retry, within endpointProbeRetryWindow. Returns the connected IP for --resolve pinning.
 func (cl *Client) ResolveProxyIP(ctx context.Context, endpoint string) (string, error) {
-	code, reader, err := cl.container.Exec(ctx, []string{"getent", "hosts", endpoint}, tcexec.Multiplexed())
-	if err != nil {
-		return "", err
+	args := []string{
+		"run", "--rm",
+		"--network", "container:" + cl.container.GetContainerID(),
+		curlImage,
+		"-ksS", "-o", "/dev/null",
+		"--connect-timeout", "30", "--max-time", "60",
+		"-w", "%{remote_ip}",
+		"https://" + endpoint + "/",
 	}
-	out, _ := io.ReadAll(reader)
-	if code != 0 {
-		return "", fmt.Errorf("getent hosts %s exited %d", endpoint, code)
+	deadline := time.Now().Add(endpointProbeRetryWindow)
+	for {
+		cmd := exec.CommandContext(ctx, "docker", args...)
+		var stdout, stderr strings.Builder
+		cmd.Stdout = &stdout
+		cmd.Stderr = &stderr
+		err := cmd.Run()
+		if err == nil {
+			ip := strings.TrimSpace(stdout.String())
+			if ip == "" {
+				return "", fmt.Errorf("got an HTTP response from %s but no remote IP", endpoint)
+			}
+			return ip, nil
+		}
+
+		var exitErr *exec.ExitError
+		if !errors.As(err, &exitErr) || !isTransientProbeExit(exitErr.ExitCode()) {
+			return "", fmt.Errorf("no HTTP response from %s: %w (%s)", endpoint, err, strings.TrimSpace(stderr.String()))
+		}
+		probeErr := fmt.Errorf("endpoint %s not reachable yet: %s", endpoint, strings.TrimSpace(stderr.String()))
+		if time.Until(deadline) < endpointProbeRetryInterval {
+			return "", probeErr
+		}
+		select {
+		case <-ctx.Done():
+			return "", fmt.Errorf("%w (%w)", probeErr, ctx.Err())
+		case <-time.After(endpointProbeRetryInterval):
+		}
 	}
-	fields := strings.Fields(string(out))
-	if len(fields) == 0 {
-		return "", fmt.Errorf("no address for %s", endpoint)
-	}
-	return fields[0], nil
+}
+
+// isTransientProbeExit reports whether a curl exit code describes a state the
+// endpoint is expected to pass THROUGH on its way up, rather than a settled
+// failure. Anything else — TLS refusal, a protocol error, a bad argument —
+// would still be failing after the retry window, so it fails immediately.
+func isTransientProbeExit(code int) bool {
+	return code == curlExitCouldNotResolve || code == curlExitCouldNotConnect
 }
 
 // Wire shapes for Chat.
@@ -194,6 +287,11 @@ const (
 	// WireVertex is the Anthropic-on-Vertex rawPredict shape: the client posts
 	// the full Vertex model path and the proxy mints the SA OAuth token.
 	WireVertex = "vertex"
+	// WireBedrock is the native AWS Bedrock InvokeModel shape: the model id
+	// travels in the URL path (/model/{id}/invoke), not the body, so the proxy
+	// routes by path. This is what a Bedrock SDK client sends and the shape the
+	// model-allowlist guardrail must enforce.
+	WireBedrock = "bedrock"
 )
 
 // Chat issues a chat-completion POST to the agent-network endpoint over the
@@ -201,17 +299,49 @@ const (
 // the wire shape: WireChat (OpenAI) or WireMessages (Anthropic). A non-empty
 // sessionID is sent as the universal x-session-id header the proxy records.
 func (cl *Client) Chat(ctx context.Context, endpoint, proxyIP, kind, model, prompt, sessionID string) (int, string, error) {
+	return cl.ChatPrefixed(ctx, endpoint, proxyIP, "", kind, model, prompt, sessionID)
+}
+
+// ChatPrefixed is Chat with a base-URL path prefix prepended to the wire
+// path, mirroring agents whose base URL carries a shape-selecting prefix that
+// rides through to the upstream — e.g. Claude Code against a Kimi provider
+// sets ANTHROPIC_BASE_URL=https://<endpoint>/anthropic so the proxy forwards
+// /anthropic/v1/messages to Moonshot's Anthropic surface while the provider's
+// upstream URL stays the bare https://api.moonshot.ai. Empty prefix is plain
+// Chat.
+func (cl *Client) ChatPrefixed(ctx context.Context, endpoint, proxyIP, pathPrefix, kind, model, prompt, sessionID string) (int, string, error) {
 	var path, body string
 	var headers []string
 	switch kind {
 	case WireMessages:
 		path = "/v1/messages"
 		headers = []string{"anthropic-version: 2023-06-01"}
-		body = fmt.Sprintf(`{"model":%q,"max_tokens":64,"messages":[{"role":"user","content":%q}]}`, model, prompt)
+		body = fmt.Sprintf(`{"model":%q,"max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, model, prompt)
 	default:
 		path = "/v1/chat/completions"
 		body = fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":%q}]}`, model, prompt)
 	}
+	return cl.post(ctx, endpoint, proxyIP, pathPrefix+path, body, withSessionID(headers, sessionID))
+}
+
+// ChatStream is Chat with "stream": true in the request body, so the proxy's
+// request parser marks the call as streaming and its response parser takes the
+// SSE accumulator rather than the buffered-body path. Pair it with a provider
+// pointed at VLLM.StreamURL, which answers every request as an event stream.
+func (cl *Client) ChatStream(ctx context.Context, endpoint, proxyIP, kind, model, prompt, sessionID string) (int, string, error) {
+	var path, body string
+	var headers []string
+	switch kind {
+	case WireMessages:
+		path = "/v1/messages"
+		headers = []string{"anthropic-version: 2023-06-01"}
+		body = fmt.Sprintf(`{"model":%q,"max_tokens":2048,"stream":true,"messages":[{"role":"user","content":%q}]}`, model, prompt)
+	default:
+		path = "/v1/chat/completions"
+		// include_usage is what makes a real OpenAI stream emit its final usage
+		// frame; without it the last chunk carries no tokens at all.
+		body = fmt.Sprintf(`{"model":%q,"stream":true,"stream_options":{"include_usage":true},"messages":[{"role":"user","content":%q}]}`, model, prompt)
+	}
 	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(headers, sessionID))
 }
 
@@ -222,7 +352,18 @@ func (cl *Client) Chat(ctx context.Context, endpoint, proxyIP, kind, model, prom
 // is sent as the universal x-session-id header the proxy records.
 func (cl *Client) Vertex(ctx context.Context, endpoint, proxyIP, project, region, model, prompt, sessionID string) (int, string, error) {
 	path := fmt.Sprintf("/v1/projects/%s/locations/%s/publishers/anthropic/models/%s:rawPredict", project, region, model)
-	body := fmt.Sprintf(`{"anthropic_version":"vertex-2023-10-16","max_tokens":64,"messages":[{"role":"user","content":%q}]}`, prompt)
+	body := fmt.Sprintf(`{"anthropic_version":"vertex-2023-10-16","max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, prompt)
+	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
+}
+
+// Bedrock issues a native AWS Bedrock InvokeModel POST over the tunnel. The
+// model id is carried in the request path (/model/{id}/invoke), so the proxy
+// routes by path; the body uses the bedrock anthropic_version rather than a
+// model field. A non-empty sessionID is sent as the universal x-session-id
+// header the proxy records.
+func (cl *Client) Bedrock(ctx context.Context, endpoint, proxyIP, model, prompt, sessionID string) (int, string, error) {
+	path := "/model/" + model + "/invoke"
+	body := fmt.Sprintf(`{"anthropic_version":"bedrock-2023-05-31","max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, prompt)
 	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
 }
 
@@ -234,10 +375,29 @@ func withSessionID(headers []string, sessionID string) []string {
 	return append(headers, "x-session-id: "+sessionID)
 }
 
-// post runs curl in a throwaway container sharing the client's network
-// namespace so the request traverses the WireGuard tunnel, pinning the endpoint
-// to the proxy IP. It returns the HTTP status and response body.
+// Get issues a GET to the agent-network endpoint over the client's tunnel.
+// Model discovery and the connection-warming probe are read-only endpoints
+// that carry no body, so they can't go through the chat helpers.
+func (cl *Client) Get(ctx context.Context, endpoint, proxyIP, path string, extraHeaders []string) (int, string, error) {
+	return cl.do(ctx, http.MethodGet, endpoint, proxyIP, path, "", extraHeaders)
+}
+
+// PostJSON issues an arbitrary JSON POST over the client's tunnel, for wire
+// shapes the typed helpers don't cover (token counting, say).
+func (cl *Client) PostJSON(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
+	return cl.do(ctx, http.MethodPost, endpoint, proxyIP, path, body, extraHeaders)
+}
+
+// post issues a JSON POST. Retained as the shorthand the chat helpers use.
 func (cl *Client) post(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
+	return cl.do(ctx, http.MethodPost, endpoint, proxyIP, path, body, extraHeaders)
+}
+
+// do runs curl in a throwaway container sharing the client's network
+// namespace so the request traverses the WireGuard tunnel, pinning the endpoint
+// to the proxy IP. It returns the HTTP status and response body. An empty body
+// sends no payload, which is what a GET needs.
+func (cl *Client) do(ctx context.Context, method, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
 	url := "https://" + endpoint + path
 	args := []string{
 		"run", "--rm",
@@ -246,13 +406,15 @@ func (cl *Client) post(ctx context.Context, endpoint, proxyIP, path, body string
 		"-sk", "--connect-timeout", "5", "--max-time", "90",
 		"--resolve", endpoint + ":443:" + proxyIP,
 		"-o", "/dev/stderr", "-w", "%{http_code}",
-		"-X", "POST", url,
+		"-X", method, url,
 		"-H", "Content-Type: application/json",
 	}
 	for _, h := range extraHeaders {
 		args = append(args, "-H", h)
 	}
-	args = append(args, "--data", body)
+	if body != "" {
+		args = append(args, "--data", body)
+	}
 	cmd := exec.CommandContext(ctx, "docker", args...)
 	// -w writes the status code to stdout; -o /dev/stderr writes the body to
 	// stderr so we can capture both separately.
@@ -281,7 +443,7 @@ func (cl *Client) Terminate(ctx context.Context) error {
 	return cl.container.Terminate(ctx)
 }
 
-// containerLogs reads up to 256 KiB of a container's logs for diagnostics.
+// containerLogs reads up to 4 MiB of a container's logs for diagnostics — enough for a whole provider-matrix run.
 func containerLogs(ctx context.Context, c testcontainers.Container) string {
 	if c == nil {
 		return ""
@@ -291,6 +453,6 @@ func containerLogs(ctx context.Context, c testcontainers.Container) string {
 		return fmt.Sprintf("<logs error: %v>", err)
 	}
 	defer r.Close()
-	b, _ := io.ReadAll(io.LimitReader(r, 256<<10))
+	b, _ := io.ReadAll(io.LimitReader(r, 4<<20))
 	return string(b)
 }
diff --git a/e2e/harness/combined.go b/e2e/harness/combined.go
index a6f43a139..ea451e3ad 100644
--- a/e2e/harness/combined.go
+++ b/e2e/harness/combined.go
@@ -61,11 +61,68 @@ type Combined struct {
 	workDir string
 }
 
+// combinedOptions is what the CombinedOption values assemble.
+type combinedOptions struct {
+	geolocation bool
+	env         map[string]string
+}
+
+// CombinedOption adjusts how StartCombined boots the server. The defaults suit a
+// suite that only drives the API; the options exist for the ones that need more
+// of the product than that.
+type CombinedOption func(*combinedOptions)
+
+// WithGeolocation leaves the GeoLite database download enabled. It is off by
+// default because the download adds startup latency that most suites get nothing
+// for. A suite asserting on location-based posture checks needs it: management
+// evaluates those rules against the database, and without it the rule fails
+// instead of passing without having been checked.
+func WithGeolocation() CombinedOption {
+	return func(o *combinedOptions) { o.geolocation = true }
+}
+
+// WithServerEnv adds environment variables to the combined container, overriding
+// the defaults on a key collision. For settings this harness does not model
+// directly, so a suite needing one does not have to fork the harness to get it.
+func WithServerEnv(env map[string]string) CombinedOption {
+	return func(o *combinedOptions) {
+		if o.env == nil {
+			o.env = map[string]string{}
+		}
+		for k, v := range env {
+			o.env[k] = v
+		}
+	}
+}
+
+// combinedEnv is the combined container's environment: setup-PAT enabled so the
+// caller can mint an admin token through /api/setup, geolocation off unless the
+// suite asked for it, and whatever the suite added on top.
+func combinedEnv(o combinedOptions) map[string]string {
+	env := map[string]string{
+		"NB_SETUP_PAT_ENABLED": "true",
+	}
+	if !o.geolocation {
+		// Skip the GeoLite DB download — it blocks startup and agent-network
+		// ingest doesn't use geolocation.
+		env["NB_DISABLE_GEOLOCATION"] = "true"
+	}
+	for k, v := range o.env {
+		env[k] = v
+	}
+	return env
+}
+
 // StartCombined builds the combined server from its multistage Dockerfile and
 // boots it with setup-PAT enabled on a fresh shared network, returning once the
 // API is serving. The caller still owns minting the admin PAT via Bootstrap.
-func StartCombined(ctx context.Context) (*Combined, error) {
-	root, err := repoRoot()
+func StartCombined(ctx context.Context, opts ...CombinedOption) (*Combined, error) {
+	var o combinedOptions
+	for _, opt := range opts {
+		opt(&o)
+	}
+
+	root, err := repoRoot(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -88,28 +145,32 @@ func StartCombined(ctx context.Context) (*Combined, error) {
 		return nil, fmt.Errorf("create work dir: %w", err)
 	}
 
-	cfg := fmt.Sprintf(combinedConfigYAML, combinedExposedURL, containerIssuer)
+	cfg := fmt.Sprintf(combinedConfigYAML, combinedExposedURL, !o.geolocation, containerIssuer)
 	if err := os.WriteFile(filepath.Join(workDir, "config.yaml"), []byte(cfg), 0o644); err != nil { //nolint:gosec // non-secret config, bind-mounted and read by the container
 		_ = net.Remove(ctx)
 		return nil, fmt.Errorf("write combined config: %w", err)
 	}
-	if err := os.MkdirAll(filepath.Join(workDir, "data"), 0o755); err != nil {
+	dataDir := filepath.Join(workDir, "data")
+	if err := os.MkdirAll(dataDir, 0o755); err != nil {
 		_ = net.Remove(ctx)
 		return nil, fmt.Errorf("create datadir: %w", err)
 	}
+	// The config's agentNetwork.pricingDefaultsFile is a bare filename, so the
+	// server resolves it against the datadir; write it there. It is an explicitly
+	// configured path, so a failure to load fails the server's startup — which
+	// surfaces here as the /api/instance readiness wait timing out.
+	if err := os.WriteFile(filepath.Join(dataDir, PricingDefaultsFileName), []byte(pricingDefaultsYAML), 0o644); err != nil { //nolint:gosec // non-secret config, bind-mounted and read by the container
+		_ = net.Remove(ctx)
+		return nil, fmt.Errorf("write pricing defaults: %w", err)
+	}
 
 	req := testcontainers.ContainerRequest{
 		Image:          combinedImage,
 		ExposedPorts:   []string{combinedHTTPPort},
 		Networks:       []string{net.Name},
 		NetworkAliases: map[string][]string{net.Name: {combinedAlias}},
-		Env: map[string]string{
-			"NB_SETUP_PAT_ENABLED": "true",
-			// Skip the GeoLite DB download — it blocks startup and agent-network
-			// ingest doesn't use geolocation.
-			"NB_DISABLE_GEOLOCATION": "true",
-		},
-		Cmd: []string{"--config", "/nb/config.yaml"},
+		Env:            combinedEnv(o),
+		Cmd:            []string{"--config", "/nb/config.yaml"},
 		HostConfigModifier: func(hc *container.HostConfig) {
 			hc.Binds = append(hc.Binds, workDir+":/nb")
 		},
@@ -221,6 +282,56 @@ func (c *Combined) CreateProxyTokenCLI(ctx context.Context, name string) (string
 	return "", fmt.Errorf("token not found in CLI output: %s", string(out))
 }
 
+// SnapshotStoreDB copies the management sqlite store (with WAL/SHM sidecars) out of the bind-mounted
+// data dir into dstDir and returns the copy's path; reading a copy avoids locking against live writes.
+func (c *Combined) SnapshotStoreDB(dstDir string) (string, error) {
+	src := filepath.Join(c.workDir, "data", "store.db")
+	if _, err := os.Stat(src); err != nil {
+		return "", fmt.Errorf("management store not found at %s: %w", src, err)
+	}
+	dst := filepath.Join(dstDir, "store.db")
+	for _, suffix := range []string{"", "-wal", "-shm"} {
+		data, err := os.ReadFile(src + suffix)
+		if err != nil {
+			if os.IsNotExist(err) && suffix != "" {
+				continue // sidecar only exists in WAL mode
+			}
+			return "", fmt.Errorf("read %s: %w", src+suffix, err)
+		}
+		if err := os.WriteFile(dst+suffix, data, 0o600); err != nil {
+			return "", fmt.Errorf("write %s: %w", dst+suffix, err)
+		}
+	}
+	return dst, nil
+}
+
+// Restart stops and starts the combined container, keeping its bind-mounted
+// data dir, and waits for the API again. The host port can change across a
+// restart, so BaseURL and the authenticated client are refreshed. Work that
+// management only does at startup (such as the agent-network cleanup's first
+// pass, or re-evaluating whether instance setup is required) runs again.
+func (c *Combined) Restart(ctx context.Context) error {
+	if err := c.container.Stop(ctx, nil); err != nil {
+		return fmt.Errorf("stop combined container: %w", err)
+	}
+	if err := c.container.Start(ctx); err != nil {
+		return fmt.Errorf("start combined container: %w", err)
+	}
+	host, err := c.container.Host(ctx)
+	if err != nil {
+		return fmt.Errorf("container host: %w", err)
+	}
+	mapped, err := c.container.MappedPort(ctx, nat.Port(combinedHTTPPort))
+	if err != nil {
+		return fmt.Errorf("mapped port: %w", err)
+	}
+	c.BaseURL = fmt.Sprintf("http://%s:%s", host, mapped.Port())
+	if c.PAT != "" {
+		c.api = rest.New(c.BaseURL, c.PAT)
+	}
+	return nil
+}
+
 // Logs returns the combined server container logs, for diagnostics.
 func (c *Combined) Logs(ctx context.Context) string {
 	return containerLogs(ctx, c.container)
diff --git a/e2e/harness/config.go b/e2e/harness/config.go
index b4bed60a2..f0952b18c 100644
--- a/e2e/harness/config.go
+++ b/e2e/harness/config.go
@@ -8,6 +8,18 @@ package harness
 // embedded IdP, local signal/relay/STUN, and a sqlite store under the mounted
 // data dir. exposedAddress is the address peers use to reach this container; it
 // is overridden per-run so the value matches the container's network alias.
+//
+// pricingDefaultsFile is deliberately a BARE FILENAME, not an absolute path: it
+// must resolve against dataDir (→ /nb/data/<name>), which is the resolution rule
+// the combined server applies. It is also an EXPLICITLY configured path, so the
+// server is required to load it — a broken path or malformed file fails startup
+// rather than silently falling back to the compiled-in rates, and TestMain then
+// fails with the container logs.
+//
+// disableGeoliteUpdate is a parameter rather than a fixed true because a suite
+// that exercises geolocation needs the database: management can only evaluate a
+// location rule with GeoLite loaded, and a rule it cannot evaluate fails rather
+// than passing vacuously. See WithGeolocation.
 const combinedConfigYAML = `server:
   listenAddress: ":8080"
   exposedAddress: "%s"
@@ -18,9 +30,41 @@ const combinedConfigYAML = `server:
   authSecret: "e2e-relay-secret"
   dataDir: "/nb/data"
   disableAnonymousMetrics: true
-  disableGeoliteUpdate: true
+  disableGeoliteUpdate: %t
   auth:
     issuer: "%s"
   store:
     engine: "sqlite"
+  agentNetwork:
+    pricingDefaultsFile: "` + PricingDefaultsFileName + `"
+`
+
+const (
+	// PricingDefaultsFileName is the basename of the operator-supplied LLM
+	// pricing defaults file the combined server is configured to load. Written
+	// into the bind-mounted datadir by StartCombined.
+	PricingDefaultsFileName = "e2e_llm_pricing.yaml"
+
+	// PricedDefaultModel is a real catalog model (openai surface) whose rates the
+	// defaults file below REPLACES. Tests drive it against the mock vLLM upstream
+	// and assert the file's rates were billed, which is only true if the file
+	// travelled: config → LoadFile → DefaultTable → synthesizer → the proxy's
+	// cost_meter defaults table.
+	PricedDefaultModel = "gpt-4.1-mini"
+	// PricedDefaultInputPer1k / PricedDefaultOutputPer1k are deliberately odd
+	// values that no compiled-in catalog entry carries (gpt-4.1-mini ships as
+	// 0.0004 / 0.0016), so a test asserting them cannot pass on the built-in
+	// table.
+	PricedDefaultInputPer1k  = 0.0123
+	PricedDefaultOutputPer1k = 0.0456
+)
+
+// pricingDefaultsYAML is the operator-supplied pricing defaults file. Its schema
+// is surface -> model -> per-1k rates. Entries replace the compiled-in entry for
+// the same surface+model whole; every other model keeps its built-in rates, so
+// this file overriding one model must not disturb the rest of the table.
+const pricingDefaultsYAML = `openai:
+  gpt-4.1-mini:
+    input_per_1k: 0.0123
+    output_per_1k: 0.0456
 `
diff --git a/e2e/harness/http_upstream.go b/e2e/harness/http_upstream.go
new file mode 100644
index 000000000..3b6fb7df6
--- /dev/null
+++ b/e2e/harness/http_upstream.go
@@ -0,0 +1,228 @@
+//go:build e2e
+
+package harness
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/go-connections/nat"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+const (
+	httpUpstreamImage   = "nginx:alpine"
+	httpUpstreamAlias   = "httpupstream"
+	httpUpstreamPort    = "8080/tcp"
+	httpUpstreamLogPath = "/tmp/e2e-access.log"
+)
+
+// httpUpstreamNginxConf returns request details from a plain HTTP upstream and
+// writes every request URI to an unbuffered file. Tests use unique path markers
+// to distinguish requests that reached the upstream from proxy-generated
+// responses with the same status.
+const httpUpstreamNginxConf = `pid /tmp/nginx.pid;
+worker_processes 1;
+events {}
+http {
+  log_format e2e escape=json '{"uri":"$request_uri"}';
+  access_log /tmp/e2e-access.log e2e;
+
+  server {
+    listen 8080;
+    location / {
+      default_type application/json;
+      return 200 '{"source":"netbird-e2e-http-upstream","path":"$uri","request_uri":"$request_uri","configured_auth":"$http_x_e2e_proxy_key","authorization":"$http_authorization","cookie":"$http_cookie","netbird_user":"$http_x_netbird_user","netbird_groups":"$http_x_netbird_groups"}';
+    }
+  }
+}
+`
+
+// HTTPUpstream is a plain HTTP server on the combined server's network. It
+// reflects selected request properties and records request URIs for tests that
+// need to distinguish proxy responses from upstream responses.
+type HTTPUpstream struct {
+	container     testcontainers.Container
+	workDir       string
+	directAddress string
+	syncSequence  atomic.Uint64
+	URL           string
+}
+
+// StartHTTPUpstream runs a request-observing nginx server on the shared network.
+func StartHTTPUpstream(ctx context.Context, c *Combined) (*HTTPUpstream, error) {
+	workDir, err := os.MkdirTemp("/tmp", "nb-e2e-http-upstream-*")
+	if err != nil {
+		return nil, fmt.Errorf("create HTTP upstream work dir: %w", err)
+	}
+	if err := os.Chmod(workDir, 0o755); err != nil { //nolint:gosec // throwaway e2e config dir, must be traversable by the container uid
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("chmod HTTP upstream dir: %w", err)
+	}
+	if err := os.WriteFile(filepath.Join(workDir, "nginx.conf"), []byte(httpUpstreamNginxConf), 0o644); err != nil { //nolint:gosec // non-secret e2e config
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("write HTTP upstream config: %w", err)
+	}
+
+	req := testcontainers.ContainerRequest{
+		Image:          httpUpstreamImage,
+		ExposedPorts:   []string{httpUpstreamPort},
+		Networks:       []string{c.network.Name},
+		NetworkAliases: map[string][]string{c.network.Name: {httpUpstreamAlias}},
+		Cmd:            []string{"nginx", "-c", "/conf/nginx.conf", "-g", "daemon off;"},
+		HostConfigModifier: func(hc *container.HostConfig) {
+			hc.Binds = append(hc.Binds, workDir+":/conf:ro")
+		},
+		WaitingFor: wait.ForListeningPort(httpUpstreamPort).WithStartupTimeout(60 * time.Second),
+	}
+
+	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	if err != nil {
+		cleanupHTTPUpstreamStart(ctr, workDir)
+		return nil, fmt.Errorf("start HTTP upstream container: %w", err)
+	}
+	host, err := ctr.Host(ctx)
+	if err != nil {
+		cleanupHTTPUpstreamStart(ctr, workDir)
+		return nil, fmt.Errorf("HTTP upstream container host: %w", err)
+	}
+	mapped, err := ctr.MappedPort(ctx, nat.Port(httpUpstreamPort))
+	if err != nil {
+		cleanupHTTPUpstreamStart(ctr, workDir)
+		return nil, fmt.Errorf("HTTP upstream mapped port: %w", err)
+	}
+
+	return &HTTPUpstream{
+		container:     ctr,
+		workDir:       workDir,
+		directAddress: net.JoinHostPort(host, mapped.Port()),
+		URL:           "http://" + httpUpstreamAlias + ":8080",
+	}, nil
+}
+
+func cleanupHTTPUpstreamStart(ctr testcontainers.Container, workDir string) {
+	if ctr != nil {
+		cleanupCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		_ = ctr.Terminate(cleanupCtx)
+		cancel()
+	}
+	_ = os.RemoveAll(workDir)
+}
+
+// Synchronize waits until the upstream has finalized all requests received
+// before a direct barrier request. The fixture runs one nginx worker and writes
+// access logs without buffering, so observing the barrier in the file proves
+// any earlier proxied request has also been recorded.
+func (u *HTTPUpstream) Synchronize(ctx context.Context) error {
+	marker := fmt.Sprintf("__e2e_upstream_barrier_%d__", u.syncSequence.Add(1))
+	requestURL := (&url.URL{
+		Scheme: "http",
+		Host:   u.directAddress,
+		Path:   "/" + marker,
+	}).String()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, requestURL, nil)
+	if err != nil {
+		return fmt.Errorf("create HTTP upstream barrier request: %w", err)
+	}
+	transport := &http.Transport{}
+	defer transport.CloseIdleConnections()
+	client := &http.Client{Transport: transport, Timeout: 5 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("send HTTP upstream barrier request: %w", err)
+	}
+	defer resp.Body.Close()
+	if _, err := io.Copy(io.Discard, resp.Body); err != nil {
+		return fmt.Errorf("read HTTP upstream barrier response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP upstream barrier returned status %d", resp.StatusCode)
+	}
+
+	waitCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	ticker := time.NewTicker(25 * time.Millisecond)
+	defer ticker.Stop()
+	for {
+		count, err := u.RequestCount(waitCtx, marker)
+		if err != nil {
+			return err
+		}
+		switch {
+		case count == 1:
+			return nil
+		case count > 1:
+			return fmt.Errorf("HTTP upstream recorded barrier %q %d times", marker, count)
+		}
+
+		select {
+		case <-waitCtx.Done():
+			return fmt.Errorf("wait for HTTP upstream barrier: %w", waitCtx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+// RequestCount returns the number of recorded request URIs containing marker.
+func (u *HTTPUpstream) RequestCount(ctx context.Context, marker string) (int, error) {
+	if marker == "" {
+		return 0, fmt.Errorf("request marker is empty")
+	}
+
+	reader, err := u.container.CopyFileFromContainer(ctx, httpUpstreamLogPath)
+	if err != nil {
+		return 0, fmt.Errorf("read HTTP upstream access log: %w", err)
+	}
+	defer reader.Close()
+
+	count := 0
+	scanner := bufio.NewScanner(reader)
+	for scanner.Scan() {
+		var entry struct {
+			URI string `json:"uri"`
+		}
+		if err := json.Unmarshal(scanner.Bytes(), &entry); err != nil {
+			return 0, fmt.Errorf("decode HTTP upstream access log: %w", err)
+		}
+		if strings.Contains(entry.URI, marker) {
+			count++
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return 0, fmt.Errorf("scan HTTP upstream access log: %w", err)
+	}
+	return count, nil
+}
+
+// Logs returns the HTTP upstream container logs for failure diagnostics.
+func (u *HTTPUpstream) Logs(ctx context.Context) string {
+	return containerLogs(ctx, u.container)
+}
+
+// Terminate stops the HTTP upstream container and removes its work directory.
+func (u *HTTPUpstream) Terminate(ctx context.Context) error {
+	var err error
+	if u.container != nil {
+		err = u.container.Terminate(ctx)
+	}
+	if u.workDir != "" {
+		_ = os.RemoveAll(u.workDir)
+	}
+	return err
+}
diff --git a/e2e/harness/nblink.go b/e2e/harness/nblink.go
new file mode 100644
index 000000000..1c5cc7ab0
--- /dev/null
+++ b/e2e/harness/nblink.go
@@ -0,0 +1,508 @@
+//go:build e2e
+
+package harness
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"os/exec"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/mount"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+const (
+	nblinkDockerfile = "e2e/harness/Dockerfile.nblink"
+	// defaultNBLinkImage is the local tag nblink is built under from
+	// nblinkDockerfile. Override with NB_E2E_NBLINK_IMAGE: a value with a "/"
+	// is pulled as a published image; a bare tag is built under that name.
+	defaultNBLinkImage = "netbird-nblink:e2e"
+	nblinkAlias        = "nblink"
+
+	// NBLinkPort is the loopback port every forwarder in this suite listens
+	// on. Tests reach it from a sidecar container sharing the forwarder's
+	// network namespace, so loopback is enough and --allow-public-bind stays
+	// off — the default an operator gets.
+	NBLinkPort = 8080
+
+	// nblinkCAPath is where the proxy's self-signed cert is mounted. nblink
+	// verifies its upstream like any Go HTTP client, so without this the
+	// forward fails the TLS handshake rather than reaching the endpoint.
+	nblinkCAPath = "/etc/nblink/upstream-ca.crt"
+
+	// nblinkReadyLog is the line startForwards writes once the overlay session
+	// is up and every forward is bound.
+	nblinkReadyLog = "over the overlay"
+
+	// nblinkSecretsDir holds the setup key for WithNBLinkSetupKeyFile, mounted
+	// read-only the way the README's container example mounts it.
+	nblinkSecretsDir = "/run/secrets"
+	nblinkKeyFile    = "nb_setup_key"
+	nblinkKeyPath    = nblinkSecretsDir + "/" + nblinkKeyFile
+	// keyWriterImage writes the key into its volume. The file is root-owned
+	// and readable by group 0 only, the ownership the README tells operators a
+	// key needs for UID 65532:0 to read it.
+	keyWriterImage = "alpine:3.22"
+
+	// nblinkStateDir is the state directory both images create, owned by
+	// 65532:0, so a volume mounted over it inherits that ownership.
+	nblinkStateDir = "/var/lib/nblink"
+)
+
+// ChatPath and ChatBody are the request the forwarder is driven with. They are
+// exported so a test can send the very same request with one header changed
+// and attribute the difference in the answer to that header alone.
+const ChatPath = "/v1/chat/completions"
+
+// NBLink is a running nblink container: a NetBird peer in userspace mode
+// forwarding a local port to an upstream reached inside the tunnel.
+type NBLink struct {
+	container testcontainers.Container
+	keyVolume string
+	network   string
+	name      string
+	port      int
+}
+
+// nblinkOptions is what the NBLinkOption values assemble.
+type nblinkOptions struct {
+	name        string
+	port        int
+	extra       []string
+	keyAsFile   bool
+	stateVolume string
+	env         map[string]string
+	user        string
+}
+
+// NBLinkOption adjusts how StartNBLink runs the forwarder.
+type NBLinkOption func(*nblinkOptions)
+
+// NBLinkCheckResult is what a --check run printed and how it exited.
+type NBLinkCheckResult struct {
+	Stdout   string
+	Stderr   string
+	ExitCode int
+}
+
+// StartNBLink builds the nblink image and runs it on the combined server's
+// network, joining with the given setup key and serving one HTTP forward.
+//
+// forward is a complete spec (scheme://[host:]port=upstream). caCertPath is a
+// PEM file on the host holding the upstream's certificate, mounted in and
+// pointed at with SSL_CERT_FILE; pass "" when the upstream needs no extra
+// trust.
+//
+// The container is granted no capabilities and no TUN device. That is the
+// assertion, not an oversight: nblink that needed either would not be able to
+// run where it claims to.
+func StartNBLink(ctx context.Context, c *Combined, setupKey, forward, caCertPath string, opts ...NBLinkOption) (*NBLink, error) {
+	o := nblinkOptions{name: nblinkAlias, port: NBLinkPort}
+	for _, opt := range opts {
+		opt(&o)
+	}
+
+	image, err := nblinkImage(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	env := map[string]string{
+		"NB_MANAGEMENT_URL": combinedExposedURL,
+		"NB_SETUP_KEY":      setupKey,
+		"NB_FORWARD":        strings.Join(append([]string{forward}, o.extra...), ","),
+		"NB_HOSTNAME":       o.name,
+		"NB_LOG_LEVEL":      "debug",
+		// Match the agent and the proxy: the combined relay is WebSocket-only,
+		// so the embedded client must use WS to hold a stable relay link.
+		"NB_RELAY_TRANSPORT": "ws",
+	}
+	if caCertPath != "" {
+		env["SSL_CERT_FILE"] = nblinkCAPath
+	}
+	var keyVolume string
+	if o.keyAsFile {
+		// The root filesystem is read-only, so the key cannot be copied in; it
+		// is mounted, as it would be in production.
+		keyVolume = fmt.Sprintf("e2e-nblink-key-%s-%d", o.name, time.Now().UnixNano())
+		if err := writeKeyVolume(ctx, keyVolume, setupKey); err != nil {
+			return nil, err
+		}
+		env["NB_SETUP_KEY"] = "file:" + nblinkKeyPath
+	}
+	if o.stateVolume != "" {
+		env["NB_STATE_DIR"] = nblinkStateDir
+	}
+	for k, v := range o.env {
+		env[k] = v
+	}
+
+	req := testcontainers.ContainerRequest{
+		Image: image,
+		// The embedded client reports the container hostname to management, so
+		// this is the name the peer is addressable by in the API.
+		Hostname:       o.name,
+		User:           o.user,
+		Networks:       []string{c.network.Name},
+		NetworkAliases: map[string][]string{c.network.Name: {o.name}},
+		Env:            env,
+		HostConfigModifier: func(hc *container.HostConfig) {
+			hardenNBLink(hc)
+			if caCertPath != "" {
+				hc.Binds = append(hc.Binds, caCertPath+":"+nblinkCAPath+":ro")
+			}
+			if keyVolume != "" {
+				hc.Mounts = append(hc.Mounts, mount.Mount{
+					Type:     mount.TypeVolume,
+					Source:   keyVolume,
+					Target:   nblinkSecretsDir,
+					ReadOnly: true,
+				})
+			}
+			if o.stateVolume != "" {
+				hc.Mounts = append(hc.Mounts, mount.Mount{
+					Type:   mount.TypeVolume,
+					Source: o.stateVolume,
+					Target: nblinkStateDir,
+				})
+			}
+		},
+		// The session has 90s of its own to come up, so the wait has to outlast
+		// that or a slow handshake reads as a missing log line.
+		WaitingFor: wait.ForLog(nblinkReadyLog).WithStartupTimeout(150 * time.Second),
+	}
+
+	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	if err != nil {
+		if ctr != nil {
+			_ = ctr.Terminate(context.Background())
+		}
+		if keyVolume != "" {
+			_ = RemoveDockerVolume(context.Background(), keyVolume)
+		}
+		return nil, fmt.Errorf("start nblink container: %w", err)
+	}
+	return &NBLink{container: ctr, keyVolume: keyVolume, network: c.network.Name, name: o.name, port: o.port}, nil
+}
+
+// Hostname returns the container hostname the embedded client reports to
+// management — the name the registered peer appears under in the peers API.
+func (n *NBLink) Hostname() string {
+	return n.name
+}
+
+// Post issues a JSON POST to the forwarder's primary listener and returns the
+// HTTP status and response body.
+func (n *NBLink) Post(ctx context.Context, path, body string, extraHeaders []string) (int, string, error) {
+	return n.do(ctx, n.port, http.MethodPost, path, body, extraHeaders)
+}
+
+// PostOn issues a JSON POST to the forwarder's listener on port, for a forward
+// added with WithNBLinkForwards.
+func (n *NBLink) PostOn(ctx context.Context, port int, path, body string, extraHeaders []string) (int, string, error) {
+	return n.do(ctx, port, http.MethodPost, path, body, extraHeaders)
+}
+
+// Get issues a GET to the forwarder's primary listener.
+func (n *NBLink) Get(ctx context.Context, path string, extraHeaders []string) (int, string, error) {
+	return n.do(ctx, n.port, http.MethodGet, path, "", extraHeaders)
+}
+
+// Chat issues an OpenAI-shaped chat completion to the forwarder, which proxies
+// it to the agent-network endpoint over the tunnel. A non-empty sessionID is
+// sent as the x-session-id header the proxy records.
+func (n *NBLink) Chat(ctx context.Context, model, prompt, sessionID string) (int, string, error) {
+	return n.Post(ctx, ChatPath, ChatBody(model, prompt), withSessionID(nil, sessionID))
+}
+
+// do runs curl in a throwaway container sharing the forwarder's network
+// namespace, so the request arrives on its loopback listener exactly as a
+// process running beside it would send one.
+//
+// Nothing here pins or rewrites Host: the loopback listener refuses a Host
+// that is not its own, and a test that papered over that would stop covering
+// it. Callers that want a foreign Host pass it in extraHeaders on purpose.
+func (n *NBLink) do(ctx context.Context, port int, method, path, body string, extraHeaders []string) (int, string, error) {
+	url := fmt.Sprintf("http://127.0.0.1:%d%s", port, path)
+	return curlStatus(ctx, []string{"--network", "container:" + n.container.GetContainerID()}, url, method, body, extraHeaders)
+}
+
+// PostFromNetwork issues a JSON POST to the forwarder by its network alias from
+// a separate container on the same network, the way another machine would
+// reach a publicly bound forward. A connection that is refused comes back as
+// an error, not a status.
+func (n *NBLink) PostFromNetwork(ctx context.Context, port int, path, body string, extraHeaders []string) (int, string, error) {
+	url := fmt.Sprintf("http://%s:%d%s", n.name, port, path)
+	return curlStatus(ctx, []string{"--network", n.network}, url, http.MethodPost, body, extraHeaders)
+}
+
+// Stop sends the forwarder SIGTERM, the way docker stop and an orchestrator
+// do, and reports how it exited and how long it took. The container is left
+// stopped for Logs; Terminate removes it.
+func (n *NBLink) Stop(ctx context.Context, grace time.Duration) (int, time.Duration, error) {
+	start := time.Now()
+	if err := n.container.Stop(ctx, &grace); err != nil {
+		return 0, 0, fmt.Errorf("stop nblink: %w", err)
+	}
+	took := time.Since(start)
+	state, err := n.container.State(ctx)
+	if err != nil {
+		return 0, took, fmt.Errorf("inspect nblink: %w", err)
+	}
+	return state.ExitCode, took, nil
+}
+
+// Logs returns the nblink container logs, for diagnostics on failure.
+func (n *NBLink) Logs(ctx context.Context) string {
+	return containerLogs(ctx, n.container)
+}
+
+// Terminate stops the nblink container.
+func (n *NBLink) Terminate(ctx context.Context) error {
+	if n.container == nil {
+		return nil
+	}
+	err := n.container.Terminate(ctx)
+	if n.keyVolume != "" {
+		// Not ctx: a cancelled or expired ctx is the likeliest reason the
+		// terminate above failed, and the volume has to go either way.
+		err = errors.Join(err, RemoveDockerVolume(context.Background(), n.keyVolume))
+	}
+	return err
+}
+
+// WithNBLinkName names the forwarder, setting both its network alias and its
+// container hostname. The hostname is what the peer registers under, so it is
+// the name the peer appears beneath in the peers API.
+//
+// Required to run a second forwarder against the same server: the default name
+// is shared and two containers cannot hold one alias on a network.
+func WithNBLinkName(name string) NBLinkOption {
+	return func(o *nblinkOptions) { o.name = name }
+}
+
+// WithNBLinkForwards adds forwards to the one StartNBLink is given. They are
+// passed in the same comma-separated NB_FORWARD, so one process serves all of
+// them over one session.
+func WithNBLinkForwards(specs ...string) NBLinkOption {
+	return func(o *nblinkOptions) { o.extra = append(o.extra, specs...) }
+}
+
+// WithNBLinkSetupKeyFile delivers the setup key as a file in the container and
+// points NB_SETUP_KEY at it with the file: prefix, instead of putting the key
+// itself in the environment.
+func WithNBLinkSetupKeyFile() NBLinkOption {
+	return func(o *nblinkOptions) { o.keyAsFile = true }
+}
+
+// WithNBLinkStateVolume mounts the named Docker volume as the state directory
+// and sets NB_STATE_DIR, so the peer identity outlives the container. The
+// volume is created on first use; RemoveDockerVolume deletes it.
+func WithNBLinkStateVolume(volume string) NBLinkOption {
+	return func(o *nblinkOptions) { o.stateVolume = volume }
+}
+
+// WithNBLinkUser runs the forwarder as uid:gid instead of the image's user,
+// the way OpenShift assigns an arbitrary UID in group 0.
+func WithNBLinkUser(user string) NBLinkOption {
+	return func(o *nblinkOptions) { o.user = user }
+}
+
+// WithNBLinkEnv sets an extra environment variable on the forwarder, for
+// settings such as NB_ALLOW_PUBLIC_BIND that have no option of their own.
+func WithNBLinkEnv(key, value string) NBLinkOption {
+	return func(o *nblinkOptions) {
+		if o.env == nil {
+			o.env = map[string]string{}
+		}
+		o.env[key] = value
+	}
+}
+
+// ChatBody builds an OpenAI-shaped chat completion request body.
+func ChatBody(model, prompt string) string {
+	return fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":%q}]}`, model, prompt)
+}
+
+// RunNBLinkCheck runs the nblink image with --check and the given environment.
+// The container gets no network at all, so a run that tried to reach
+// management would fail rather than quietly succeed.
+func RunNBLinkCheck(ctx context.Context, env map[string]string) (NBLinkCheckResult, error) {
+	return RunNBLinkIsolated(ctx, env, "--check")
+}
+
+// RunNBLinkIsolated runs the nblink image to completion with no network and
+// the given environment and arguments, the way a forwarder behaves when
+// management cannot be reached.
+func RunNBLinkIsolated(ctx context.Context, env map[string]string, extraArgs ...string) (NBLinkCheckResult, error) {
+	image, err := nblinkImage(ctx)
+	if err != nil {
+		return NBLinkCheckResult{}, err
+	}
+
+	args := append(isolatedRunArgs("--rm"), envArgs(env)...)
+	args = append(args, image)
+	args = append(args, extraArgs...)
+
+	cmd := exec.CommandContext(ctx, "docker", args...)
+	var stdout, stderr strings.Builder
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+	res := NBLinkCheckResult{}
+	err = cmd.Run()
+	res.Stdout, res.Stderr = stdout.String(), stderr.String()
+
+	var exitErr *exec.ExitError
+	if errors.As(err, &exitErr) {
+		res.ExitCode = exitErr.ExitCode()
+		return res, nil
+	}
+	if err != nil {
+		return res, fmt.Errorf("run nblink: %w", err)
+	}
+	return res, nil
+}
+
+// StopNBLinkDuringStartup starts the nblink image with no network, so the
+// session can never come up, sends it SIGTERM after wait, and reports how it
+// exited, how long the stop took, and what it logged.
+func StopNBLinkDuringStartup(ctx context.Context, env map[string]string, wait, grace time.Duration) (int, time.Duration, string, error) {
+	image, err := nblinkImage(ctx)
+	if err != nil {
+		return 0, 0, "", err
+	}
+
+	args := append(isolatedRunArgs("-d"), envArgs(env)...)
+	out, err := exec.CommandContext(ctx, "docker", append(args, image)...).Output()
+	if err != nil {
+		return 0, 0, "", fmt.Errorf("start nblink: %w", err)
+	}
+	id := strings.TrimSpace(string(out))
+	defer func() { _ = exec.Command("docker", "rm", "-f", id).Run() }()
+
+	timer := time.NewTimer(wait)
+	defer timer.Stop()
+	select {
+	case <-timer.C:
+	case <-ctx.Done():
+		return 0, 0, "", ctx.Err()
+	}
+
+	start := time.Now()
+	stop := exec.CommandContext(ctx, "docker", "stop", "-t", fmt.Sprint(int(grace.Seconds())), id)
+	if out, err := stop.CombinedOutput(); err != nil {
+		return 0, 0, "", fmt.Errorf("stop nblink: %w: %s", err, out)
+	}
+	took := time.Since(start)
+
+	state, err := exec.CommandContext(ctx, "docker", "inspect", "-f", "{{.State.ExitCode}}", id).Output()
+	if err != nil {
+		return 0, took, "", fmt.Errorf("inspect nblink: %w", err)
+	}
+	exitCode := 0
+	_, _ = fmt.Sscanf(strings.TrimSpace(string(state)), "%d", &exitCode)
+	logs, err := exec.CommandContext(ctx, "docker", "logs", id).CombinedOutput()
+	if err != nil {
+		return exitCode, took, "", fmt.Errorf("read nblink logs: %w", err)
+	}
+	return exitCode, took, string(logs), nil
+}
+
+// RemoveDockerVolume deletes a volume created by WithNBLinkStateVolume.
+func RemoveDockerVolume(ctx context.Context, volume string) error {
+	if out, err := exec.CommandContext(ctx, "docker", "volume", "rm", "-f", volume).CombinedOutput(); err != nil {
+		return fmt.Errorf("remove volume %s: %w: %s", volume, err, out)
+	}
+	return nil
+}
+
+// writeKeyVolume creates a volume holding the setup key as a root-owned file
+// of mode 0440. The key goes in on stdin so it never appears in a process
+// listing.
+func writeKeyVolume(ctx context.Context, volume, key string) error {
+	if out, err := exec.CommandContext(ctx, "docker", "volume", "create", volume).CombinedOutput(); err != nil {
+		return fmt.Errorf("create key volume: %w: %s", err, out)
+	}
+	script := fmt.Sprintf("cat > /k/%[1]s && chown 0:0 /k/%[1]s && chmod 440 /k/%[1]s", nblinkKeyFile)
+	cmd := exec.CommandContext(ctx, "docker", "run", "--rm", "-i", "-v", volume+":/k", keyWriterImage, "sh", "-c", script)
+	cmd.Stdin = strings.NewReader(key + "\n")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		_ = RemoveDockerVolume(context.Background(), volume)
+		return fmt.Errorf("write key volume: %w: %s", err, out)
+	}
+	return nil
+}
+
+// hardenNBLink takes away what Docker grants a container by default: every
+// capability, a writable root filesystem, and the ability to gain privileges.
+// nblink claims to need none of them, and this is where that claim is held to.
+// State, when kept, goes to a mounted volume.
+func hardenNBLink(hc *container.HostConfig) {
+	hc.CapDrop = []string{"ALL"}
+	hc.ReadonlyRootfs = true
+	hc.SecurityOpt = append(hc.SecurityOpt, "no-new-privileges")
+}
+
+func nblinkImage(ctx context.Context) (string, error) {
+	root, err := repoRoot(ctx)
+	if err != nil {
+		return "", err
+	}
+	return resolveImage(ctx, root, "NB_E2E_NBLINK_IMAGE", defaultNBLinkImage, nblinkDockerfile)
+}
+
+// curlStatus runs curl in a throwaway container with the given docker run
+// network arguments and returns the status and body.
+func curlStatus(ctx context.Context, network []string, url, method, body string, extraHeaders []string) (int, string, error) {
+	args := append([]string{"run", "--rm"}, network...)
+	args = append(args,
+		curlImage,
+		"-s", "--connect-timeout", "5", "--max-time", "90",
+		"-o", "/dev/stderr", "-w", "%{http_code}",
+		"-X", method, url,
+		"-H", "Content-Type: application/json",
+	)
+	for _, h := range extraHeaders {
+		args = append(args, "-H", h)
+	}
+	if body != "" {
+		args = append(args, "--data", body)
+	}
+
+	cmd := exec.CommandContext(ctx, "docker", args...)
+	// -w writes the status to stdout, -o /dev/stderr the body to stderr, so
+	// the two come back separately.
+	var stdout, stderr strings.Builder
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+	if err := cmd.Run(); err != nil {
+		return 0, stderr.String(), fmt.Errorf("curl through nblink: %w", err)
+	}
+
+	code := 0
+	_, _ = fmt.Sscanf(strings.TrimSpace(stdout.String()), "%d", &code)
+	return code, stderr.String(), nil
+}
+
+// isolatedRunArgs is docker run with no network and the same hardening
+// StartNBLink applies.
+func isolatedRunArgs(mode string) []string {
+	return []string{"run", mode, "--network", "none", "--cap-drop", "ALL", "--read-only", "--security-opt", "no-new-privileges"}
+}
+
+func envArgs(env map[string]string) []string {
+	var args []string
+	for k, v := range env {
+		args = append(args, "-e", k+"="+v)
+	}
+	return args
+}
diff --git a/e2e/harness/options_test.go b/e2e/harness/options_test.go
new file mode 100644
index 000000000..8a5557a83
--- /dev/null
+++ b/e2e/harness/options_test.go
@@ -0,0 +1,161 @@
+//go:build e2e
+
+package harness
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The options exist so a suite can ask for a deployment this harness would not
+// otherwise give it. What they configure is a container environment and a config
+// file, both assembled before anything is started, so they are checkable without
+// Docker — which is the point: a wiring mistake here would otherwise only show up
+// as a puzzling failure minutes into a container run.
+
+func TestCombinedEnvGeolocation(t *testing.T) {
+	var off combinedOptions
+	assert.Equal(t, "true", combinedEnv(off)["NB_DISABLE_GEOLOCATION"],
+		"geolocation should be off by default")
+
+	var on combinedOptions
+	WithGeolocation()(&on)
+	assert.NotContains(t, combinedEnv(on), "NB_DISABLE_GEOLOCATION",
+		"WithGeolocation must leave NB_DISABLE_GEOLOCATION unset, so the server downloads the database")
+	assert.Equal(t, "true", combinedEnv(on)["NB_SETUP_PAT_ENABLED"],
+		"the setup PAT must stay enabled whatever else is configured; Bootstrap depends on it")
+}
+
+// The config file carries the same decision as the environment variable, and the
+// server needs both to agree: disableGeoliteUpdate suppresses the download even
+// when geolocation itself is enabled.
+func TestCombinedConfigGeolocation(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		opts []CombinedOption
+		want string
+	}{
+		{name: "default", want: "disableGeoliteUpdate: true"},
+		{name: "with geolocation", opts: []CombinedOption{WithGeolocation()}, want: "disableGeoliteUpdate: false"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var o combinedOptions
+			for _, opt := range tc.opts {
+				opt(&o)
+			}
+			cfg := fmt.Sprintf(combinedConfigYAML, combinedExposedURL, !o.geolocation, containerIssuer)
+			assert.Contains(t, cfg, tc.want, "geolocation not rendered as expected")
+			// The issuer is the last verb; a mis-ordered argument list would put
+			// the boolean here instead and the server would fail to start.
+			assert.Contains(t, cfg, `issuer: "`+containerIssuer+`"`, "issuer not rendered")
+		})
+	}
+}
+
+func TestWithServerEnvOverrides(t *testing.T) {
+	var o combinedOptions
+	WithServerEnv(map[string]string{"NB_LOG_LEVEL": "debug"})(&o)
+	WithServerEnv(map[string]string{"NB_SETUP_PAT_ENABLED": "false"})(&o)
+
+	env := combinedEnv(o)
+	assert.Equal(t, "debug", env["NB_LOG_LEVEL"], "added variable missing")
+	assert.Equal(t, "false", env["NB_SETUP_PAT_ENABLED"], "a suite must be able to override a default")
+}
+
+// Two agents on one network cannot share an alias, so the name has to reach both
+// the alias and the hostname. The hostname is the one management records, so it is
+// also what the peer is addressable by through the API.
+func TestWithClientName(t *testing.T) {
+	o := clientOptions{name: clientAlias}
+	require.Equal(t, "client", o.name, "unexpected default client name")
+
+	WithClientName("peer2")(&o)
+	assert.Equal(t, "peer2", o.name, "WithClientName did not take")
+}
+
+// repoRoot has to recognise this module rather than merely finding a go.mod, or a
+// suite in another module gets its own root and a build context without the
+// component Dockerfiles in it.
+func TestIsModule(t *testing.T) {
+	dir := t.TempDir()
+
+	other := filepath.Join(dir, "go.mod")
+	require.NoError(t, os.WriteFile(other, []byte("module example.com/other\n\ngo 1.25\n"), 0o600))
+	assert.False(t, isModule(other, modulePath), "another module's go.mod must not be taken for this repo")
+
+	ours := filepath.Join(dir, "ours.mod")
+	require.NoError(t, os.WriteFile(ours, []byte("// a comment\n\nmodule "+modulePath+"\n\ngo 1.25\n"), 0o600))
+	assert.True(t, isModule(ours, modulePath), "this repo's go.mod was not recognised")
+
+	assert.False(t, isModule(filepath.Join(dir, "absent.mod"), modulePath),
+		"a missing go.mod must not report a match")
+}
+
+// Running from inside the repo, repoRoot finds it by walking up — the module
+// lookup is only the fallback, and this asserts the walk still wins so an in-repo
+// run never depends on the module cache.
+func TestRepoRootFindsThisRepo(t *testing.T) {
+	root, err := repoRoot(context.Background())
+	require.NoError(t, err)
+	assert.True(t, isModule(filepath.Join(root, "go.mod"), modulePath),
+		"repoRoot returned %s, which is not this module", root)
+
+	for _, f := range []string{combinedDockerfile, clientDockerfile} {
+		_, err := os.Stat(filepath.Join(root, f))
+		assert.NoError(t, err, "%s is not present under the reported root %s", f, root)
+	}
+}
+
+// A caller that vendors its dependencies puts the go command in automatic vendor
+// mode, where `go list -m -f {{.Dir}}` succeeds and reports an EMPTY directory:
+// vendor/ holds packages, not module source. Without -mod=readonly the lookup
+// would come back empty and the harness would report a missing module for a
+// dependency that is present.
+func TestModuleDirResolvesUnderVendorMode(t *testing.T) {
+	if _, err := exec.LookPath("go"); err != nil {
+		t.Skip("no go tool on PATH")
+	}
+	ctx := context.Background()
+
+	base := t.TempDir()
+	dep := filepath.Join(base, "dep")
+	main := filepath.Join(base, "main")
+	require.NoError(t, os.MkdirAll(dep, 0o750))
+	require.NoError(t, os.MkdirAll(main, 0o750))
+
+	// A local replacement rather than a real dependency, so this needs no network.
+	require.NoError(t, os.WriteFile(filepath.Join(dep, "go.mod"),
+		[]byte("module example.com/dep\n\ngo 1.25\n"), 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(dep, "dep.go"),
+		[]byte("package dep\n"), 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(main, "go.mod"),
+		[]byte("module example.com/main\n\ngo 1.25\n\nrequire example.com/dep v0.0.0\n\nreplace example.com/dep v0.0.0 => ../dep\n"), 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(main, "main.go"),
+		[]byte("package main\n\nimport _ \"example.com/dep\"\n\nfunc main() {}\n"), 0o600))
+
+	t.Chdir(main)
+	vendor := exec.CommandContext(ctx, "go", "mod", "vendor")
+	out, err := vendor.CombinedOutput()
+	require.NoError(t, err, "go mod vendor: %s", out)
+
+	dir, err := moduleDir(ctx, "example.com/dep")
+	require.NoError(t, err, "the module must still resolve with a vendor directory present")
+	assert.Equal(t, dep, dir, "resolved the wrong directory")
+}
+
+// A cancelled context has to stop the lookup rather than leaving the caller
+// waiting on a subprocess it has already given up on.
+func TestModuleDirHonoursContext(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	_, err := moduleDir(ctx, modulePath)
+	assert.ErrorIs(t, err, context.Canceled, "a cancelled context must stop the lookup")
+}
diff --git a/e2e/harness/paths.go b/e2e/harness/paths.go
index d7df6bbfa..569c32efc 100644
--- a/e2e/harness/paths.go
+++ b/e2e/harness/paths.go
@@ -3,27 +3,82 @@
 package harness
 
 import (
+	"context"
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"strings"
 )
 
-// repoRoot walks up from the working directory to the module root (the
-// directory holding go.mod), so the Docker build context is correct no matter
-// which package the test runs from.
-func repoRoot() (string, error) {
+// modulePath is this module, used both to recognise the repo when walking up
+// from the working directory and to locate it when the suite lives elsewhere.
+const modulePath = "github.com/netbirdio/netbird"
+
+// repoRoot returns the directory the component Dockerfiles are built from.
+//
+// Walking up from the working directory finds it for any test inside this repo,
+// no matter which package it runs from. A suite in another module gets a
+// different answer that way — its own module root, where combined/Dockerfile
+// does not exist — so the ancestor has to be this module and not merely some
+// module. When it is not, the build context is the extracted module directory of
+// whichever version that suite depends on, which is the right one: the server it
+// tests against is then built from the same revision as the client library it
+// was compiled with.
+func repoRoot(ctx context.Context) (string, error) {
 	dir, err := os.Getwd()
 	if err != nil {
 		return "", err
 	}
 	for {
-		if _, statErr := os.Stat(filepath.Join(dir, "go.mod")); statErr == nil {
+		if isModule(filepath.Join(dir, "go.mod"), modulePath) {
 			return dir, nil
 		}
 		parent := filepath.Dir(dir)
 		if parent == dir {
-			return "", fmt.Errorf("go.mod not found above %s", dir)
+			break
 		}
 		dir = parent
 	}
+	return moduleDir(ctx, modulePath)
+}
+
+// isModule reports whether the go.mod at path declares the given module.
+func isModule(path, want string) bool {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return false
+	}
+	for _, line := range strings.Split(string(b), "\n") {
+		if rest, ok := strings.CutPrefix(strings.TrimSpace(line), "module "); ok {
+			return strings.TrimSpace(rest) == want
+		}
+	}
+	return false
+}
+
+// moduleDir asks the go tool where a module's source is, which for a dependent
+// module is its extracted copy in the module cache. The cache is read-only, and
+// a Docker build context is only ever read.
+//
+// -mod=readonly is required rather than cosmetic. A caller that vendors its
+// dependencies puts the go command in automatic vendor mode, where this lookup
+// succeeds with an EMPTY directory — vendor/ holds packages, not module source,
+// so there is nothing to report. Asking in readonly mode resolves against the
+// module graph instead, which answers for both a cached module and a local
+// replacement, and neither writes to go.mod.
+func moduleDir(ctx context.Context, module string) (string, error) {
+	cmd := exec.CommandContext(ctx, "go", "list", "-mod=readonly", "-m", "-f", "{{.Dir}}", module)
+	out, err := cmd.Output()
+	if err != nil {
+		return "", fmt.Errorf("locate %s: %w", module, err)
+	}
+	dir := strings.TrimSpace(string(out))
+	if dir == "" {
+		return "", fmt.Errorf("locate %s: the go tool reported no directory; run `go mod download %s`", module, module)
+	}
+	if _, err := os.Stat(dir); err != nil {
+		return "", fmt.Errorf("locate %s: %w", module, err)
+	}
+	return dir, nil
 }
diff --git a/e2e/harness/proxy.go b/e2e/harness/proxy.go
index 8db2c140f..185aafa8b 100644
--- a/e2e/harness/proxy.go
+++ b/e2e/harness/proxy.go
@@ -3,13 +3,24 @@
 package harness
 
 import (
+	"bytes"
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
 	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
 	"os"
+	"path/filepath"
 	"time"
 
 	"github.com/docker/docker/api/types/container"
+	"github.com/docker/go-connections/nat"
 	"github.com/testcontainers/testcontainers-go"
+	tcexec "github.com/testcontainers/testcontainers-go/exec"
 	"github.com/testcontainers/testcontainers-go/wait"
 )
 
@@ -20,6 +31,7 @@ const (
 	// pulled as a published image; a bare tag is built under that name.
 	defaultProxyImage = "netbird-reverse-proxy:e2e"
 	proxyAlias        = "proxy"
+	proxyHTTPSPort    = "443/tcp"
 
 	// AgentNetworkCluster is the proxy cluster the e2e provider bootstraps and
 	// the proxy serves. It must equal the management's exposed domain
@@ -30,16 +42,22 @@ const (
 
 // Proxy is a running agent-network gateway (netbird proxy) container.
 type Proxy struct {
-	container testcontainers.Container
-	workDir   string
+	container    testcontainers.Container
+	workDir      string
+	httpsAddress string
+	tlsRootCAs   *x509.CertPool
 }
 
 // StartProxy builds the proxy image and runs it on the combined server's
 // network, registered via the given account proxy token and serving the
 // AgentNetworkCluster over a self-signed wildcard cert. It does not wait for
 // peer connectivity — callers poll management for the proxy peer.
-func StartProxy(ctx context.Context, c *Combined, proxyToken string) (*Proxy, error) {
-	root, err := repoRoot()
+// StartProxy launches the reverse-proxy container. Optional envOverrides are
+// merged into the container environment after the defaults, so callers can set
+// or override any NB_PROXY_* var (e.g. NB_PROXY_TUNNEL_CACHE_TTL for tests that
+// need a short authorization-cache window).
+func StartProxy(ctx context.Context, c *Combined, proxyToken string, envOverrides ...map[string]string) (*Proxy, error) {
+	root, err := repoRoot(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -55,14 +73,27 @@ func StartProxy(ctx context.Context, c *Combined, proxyToken string) (*Proxy, er
 	// MkdirTemp creates the dir 0700; widen it so the non-root proxy container
 	// can traverse the bind-mounted cert dir on Linux CI runners.
 	if err := os.Chmod(workDir, 0o755); err != nil { //nolint:gosec // throwaway e2e cert dir, must be traversable by the proxy container uid
+		_ = os.RemoveAll(workDir)
 		return nil, fmt.Errorf("chmod proxy cert dir: %w", err)
 	}
 	if err := writeSelfSignedCert(workDir, []string{"*." + AgentNetworkCluster, AgentNetworkCluster}); err != nil {
+		_ = os.RemoveAll(workDir)
 		return nil, err
 	}
+	certPEM, err := os.ReadFile(filepath.Join(workDir, "tls.crt"))
+	if err != nil {
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("read proxy certificate: %w", err)
+	}
+	tlsRootCAs := x509.NewCertPool()
+	if !tlsRootCAs.AppendCertsFromPEM(certPEM) {
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("parse proxy certificate")
+	}
 
 	req := testcontainers.ContainerRequest{
 		Image:          proxyImage,
+		ExposedPorts:   []string{proxyHTTPSPort},
 		Networks:       []string{c.network.Name},
 		NetworkAliases: map[string][]string{c.network.Name: {proxyAlias}},
 		Env: map[string]string{
@@ -93,15 +124,129 @@ func StartProxy(ctx context.Context, c *Combined, proxyToken string) (*Proxy, er
 		WaitingFor: wait.ForLog("Initial mapping sync complete").WithStartupTimeout(90 * time.Second),
 	}
 
+	for _, ov := range envOverrides {
+		for k, v := range ov {
+			req.Env[k] = v
+		}
+	}
+
 	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
 		ContainerRequest: req,
 		Started:          true,
 	})
 	if err != nil {
+		_ = os.RemoveAll(workDir)
 		return nil, fmt.Errorf("start proxy container: %w", err)
 	}
 
-	return &Proxy{container: ctr, workDir: workDir}, nil
+	host, err := ctr.Host(ctx)
+	if err != nil {
+		_ = ctr.Terminate(ctx)
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("proxy container host: %w", err)
+	}
+	mapped, err := ctr.MappedPort(ctx, nat.Port(proxyHTTPSPort))
+	if err != nil {
+		_ = ctr.Terminate(ctx)
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("proxy mapped HTTPS port: %w", err)
+	}
+
+	return &Proxy{
+		container:    ctr,
+		workDir:      workDir,
+		httpsAddress: net.JoinHostPort(host, mapped.Port()),
+		tlsRootCAs:   tlsRootCAs,
+	}, nil
+}
+
+// HTTPSGet reaches a public service through the proxy's host-mapped HTTPS
+// listener while retaining domain as the request Host and TLS server name.
+// Connections are not reused so callers can observe mapping removal without
+// an existing connection outliving the route.
+func (p *Proxy) HTTPSGet(ctx context.Context, domain, path string, headers http.Header) (int, string, error) {
+	requestURL := &url.URL{Scheme: "https", Host: domain, Path: path}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, requestURL.String(), nil)
+	if err != nil {
+		return 0, "", fmt.Errorf("create proxy request: %w", err)
+	}
+	req.Header = headers.Clone()
+
+	dialer := &net.Dialer{Timeout: 5 * time.Second}
+	transport := &http.Transport{
+		DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
+			return dialer.DialContext(ctx, "tcp", p.httpsAddress)
+		},
+		TLSClientConfig: &tls.Config{
+			MinVersion: tls.VersionTLS12,
+			RootCAs:    p.tlsRootCAs,
+			ServerName: domain,
+		},
+		DisableKeepAlives:     true,
+		TLSHandshakeTimeout:   5 * time.Second,
+		ResponseHeaderTimeout: 10 * time.Second,
+	}
+	defer transport.CloseIdleConnections()
+
+	client := &http.Client{
+		Transport: transport,
+		Timeout:   15 * time.Second,
+		CheckRedirect: func(*http.Request, []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return 0, "", fmt.Errorf("request public proxy service: %w", err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return 0, "", fmt.Errorf("read public proxy response: %w", err)
+	}
+	return resp.StatusCode, string(body), nil
+}
+
+// ProxyDebugClient is one per-account embedded client the proxy runs, as the
+// proxy's debug endpoint reports it.
+type ProxyDebugClient struct {
+	AccountID    string   `json:"account_id"`
+	ServiceCount int      `json:"service_count"`
+	ServiceKeys  []string `json:"service_keys"`
+}
+
+// DebugClients lists the per-account clients the proxy is running, through
+// the proxy's own debug CLI inside the container. The proxy must be started
+// with NB_PROXY_DEBUG_ENDPOINT=true.
+func (p *Proxy) DebugClients(ctx context.Context) ([]ProxyDebugClient, error) {
+	code, reader, err := p.container.Exec(ctx,
+		[]string{"/usr/bin/netbird-proxy", "debug", "clients", "--json"}, tcexec.Multiplexed())
+	if err != nil {
+		return nil, fmt.Errorf("exec debug clients: %w", err)
+	}
+	out, _ := io.ReadAll(reader)
+	if code != 0 {
+		return nil, fmt.Errorf("debug clients exited %d: %s", code, string(out))
+	}
+	// stderr is multiplexed in; the JSON document starts at the first brace.
+	start := bytes.IndexByte(out, '{')
+	if start < 0 {
+		return nil, fmt.Errorf("no JSON in debug clients output: %s", string(out))
+	}
+	var resp struct {
+		Clients []ProxyDebugClient `json:"clients"`
+	}
+	if err := json.NewDecoder(bytes.NewReader(out[start:])).Decode(&resp); err != nil {
+		return nil, fmt.Errorf("decode debug clients output: %w", err)
+	}
+	return resp.Clients, nil
+}
+
+// CACertPath returns the host path of the self-signed certificate the proxy
+// serves for the agent-network endpoint. A client that verifies TLS properly —
+// nblink does, where the curl helpers pass -k — needs it in its trust store.
+func (p *Proxy) CACertPath() string {
+	return filepath.Join(p.workDir, "tls.crt")
 }
 
 // Logs returns the proxy container logs, for diagnostics on failure.
diff --git a/e2e/harness/vllm.go b/e2e/harness/vllm.go
index 2f3d306cc..cf9316325 100644
--- a/e2e/harness/vllm.go
+++ b/e2e/harness/vllm.go
@@ -18,18 +18,63 @@ const (
 	vllmImage = "nginx:alpine"
 	vllmAlias = "vllm"
 	vllmPort  = "8000/tcp"
+	// vllmStreamPort serves the same wire shapes as an SSE stream. See the
+	// nginx config for why streaming lives on its own listener.
+	vllmStreamPort = "8001/tcp"
 	// VLLMModel is the served model id the mock advertises and echoes back. It
 	// matches a real small model commonly served by vLLM so the provider's
 	// enumerated model and the client's request line up.
 	VLLMModel = "Qwen/Qwen2.5-0.5B-Instruct"
+	// VLLMUnlistedModel is a second id the mock's model listing advertises but
+	// no test provider enumerates, so a filtered listing is observably shorter
+	// than the upstream's own.
+	VLLMUnlistedModel = "Qwen/Qwen2.5-7B-Instruct"
+)
+
+// Token counts the mock reports per wire shape. Tests assert on these rather
+// than on "> 0" so a response parsed with the wrong provider's parser (which
+// would read a different field, or none) fails loudly instead of passing on
+// a coincidental non-zero.
+const (
+	// VLLMChatInputTokens / VLLMChatOutputTokens ride the OpenAI usage block.
+	VLLMChatInputTokens  = 11
+	VLLMChatOutputTokens = 2
+	// VLLMMessagesInputTokens / VLLMMessagesOutputTokens ride the Anthropic
+	// usage block, whose field names the OpenAI parser cannot read.
+	VLLMMessagesInputTokens  = 17
+	VLLMMessagesOutputTokens = 3
+)
+
+// Token counts the streaming surface reports. They differ from the
+// non-streaming ones on purpose: a test that asserts these numbers proves the
+// SSE accumulator ran, rather than a buffered JSON body having been parsed.
+//
+// Input and cache-read arrive on message_start; output arrives on
+// message_delta and supersedes the seed value message_start carries. Any
+// parser that cannot read message_start reports zero input tokens — which is
+// exactly the bug these counts exist to catch.
+const (
+	VLLMStreamInputTokens     = 29
+	VLLMStreamOutputTokens    = 5
+	VLLMStreamCacheReadTokens = 7
 )
 
 // vllmNginxConf emulates a vLLM OpenAI-compatible server over plain HTTP (vLLM's
-// default: no TLS, port 8000). It answers /v1/models with a one-model list and
-// any chat/completions path with a canned OpenAI-shaped chat completion carrying
-// a non-zero usage block, so the proxy's OpenAI parser records real token
-// consumption. Running actual vLLM in CI is infeasible (GPU + multi-GB model
+// default: no TLS, port 8000), and additionally answers the wire shapes the
+// other catalog surfaces speak so one mock can stand in for every provider the
+// proxy routes to. Running actual vLLM in CI is infeasible (GPU + multi-GB model
 // download), so this stands in for the wire contract the proxy depends on.
+//
+// Each shape answers with its own vendor's usage block, so a response parsed
+// under the wrong surface meters zero rather than passing by accident:
+//
+//   - /v1/chat/completions (and any unmatched path): OpenAI chat completion.
+//   - /v1/messages: Anthropic Messages, snake_case usage plus a cache bucket.
+//   - /model/{id}/invoke: Bedrock InvokeModel, which carries the Anthropic body.
+//   - the token-counting endpoints: a count, with no usage block at all.
+//
+// The model listing advertises two models so a policy that authorises one
+// produces an observably shorter list than the upstream's own.
 const vllmNginxConf = `pid /tmp/nginx.pid;
 events {}
 http {
@@ -37,13 +82,75 @@ http {
     listen 8000;
     location = /v1/models {
       default_type application/json;
-      return 200 '{"object":"list","data":[{"id":"Qwen/Qwen2.5-0.5B-Instruct","object":"model","owned_by":"vllm"}]}';
+      return 200 '{"object":"list","data":[{"id":"Qwen/Qwen2.5-0.5B-Instruct","object":"model","owned_by":"vllm"},{"id":"Qwen/Qwen2.5-7B-Instruct","object":"model","owned_by":"vllm"}]}';
+    }
+    location = /v1/messages {
+      default_type application/json;
+      return 200 '{"id":"msg_e2e","type":"message","role":"assistant","model":"claude-sonnet-5","content":[{"type":"text","text":"pong"}],"stop_reason":"end_turn","usage":{"input_tokens":17,"output_tokens":3,"cache_read_input_tokens":5}}';
+    }
+    location = /v1/messages/count_tokens {
+      default_type application/json;
+      return 200 '{"input_tokens":7}';
+    }
+    location ~ ^/model/.+/invoke$ {
+      default_type application/json;
+      return 200 '{"id":"msg_e2e_bedrock","type":"message","role":"assistant","content":[{"type":"text","text":"pong"}],"stop_reason":"end_turn","usage":{"input_tokens":17,"output_tokens":3,"cache_read_input_tokens":5}}';
+    }
+    location ~ ^/model/.+/count-tokens$ {
+      default_type application/json;
+      return 200 '{"inputTokens":9}';
+    }
+    location = /api/hello {
+      return 200;
+    }
+    location = /inference-profiles {
+      default_type application/json;
+      return 200 '{"inferenceProfileSummaries":[{"inferenceProfileId":"us.anthropic.claude-sonnet-5","status":"ACTIVE"}]}';
     }
     location / {
       default_type application/json;
       return 200 '{"id":"chatcmpl-e2e-vllm","object":"chat.completion","created":1700000000,"model":"Qwen/Qwen2.5-0.5B-Instruct","choices":[{"index":0,"message":{"role":"assistant","content":"pong"},"finish_reason":"stop"}],"usage":{"prompt_tokens":11,"completion_tokens":2,"total_tokens":13}}';
     }
   }
+
+  # The streaming surface, on its own port so the response content type is a
+  # property of the listener rather than of a per-request branch: nginx sets
+  # Content-Type from default_type, which cannot be varied inside an "if", and
+  # a second Content-Type via add_header would leave the proxy reading the
+  # wrong one. A provider record pointed at this port streams every answer.
+  #
+  # Input and cache-read tokens ride message_start, output rides message_delta
+  # — the split that makes a stream different from a buffered body, and the
+  # reason a parser that ignores message_start meters input as zero.
+  server {
+    listen 8001;
+    location = /v1/messages {
+      default_type text/event-stream;
+      return 200 'event: message_start
+data: {"type":"message_start","message":{"id":"msg_e2e_stream","type":"message","role":"assistant","model":"claude-sonnet-5","content":[],"usage":{"input_tokens":29,"output_tokens":1,"cache_read_input_tokens":7}}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"pong"}}
+
+event: message_delta
+data: {"type":"message_delta","delta":{"stop_reason":"end_turn"},"usage":{"output_tokens":5}}
+
+event: message_stop
+data: {"type":"message_stop"}
+
+';
+    }
+    location / {
+      default_type text/event-stream;
+      return 200 'data: {"choices":[{"delta":{"content":"pong"}}]}
+
+data: {"choices":[],"usage":{"prompt_tokens":29,"completion_tokens":5,"total_tokens":34}}
+
+data: [DONE]
+
+';
+    }
+  }
 }
 `
 
@@ -55,6 +162,10 @@ type VLLM struct {
 	workDir   string
 	// URL is the upstream URL the vllm provider points at (http://<alias>:8000).
 	URL string
+	// StreamURL is the same mock's streaming listener. A provider pointed here
+	// answers every request as SSE, so the proxy's streaming accumulator runs
+	// instead of its buffered-body parser.
+	StreamURL string
 }
 
 // StartVLLM runs the mock vLLM server on the shared network over plain HTTP.
@@ -73,14 +184,17 @@ func StartVLLM(ctx context.Context, c *Combined) (*VLLM, error) {
 
 	req := testcontainers.ContainerRequest{
 		Image:          vllmImage,
-		ExposedPorts:   []string{vllmPort},
+		ExposedPorts:   []string{vllmPort, vllmStreamPort},
 		Networks:       []string{c.network.Name},
 		NetworkAliases: map[string][]string{c.network.Name: {vllmAlias}},
 		Cmd:            []string{"nginx", "-c", "/conf/nginx.conf", "-g", "daemon off;"},
 		HostConfigModifier: func(hc *container.HostConfig) {
 			hc.Binds = append(hc.Binds, workDir+":/conf:ro")
 		},
-		WaitingFor: wait.ForListeningPort(vllmPort).WithStartupTimeout(60 * time.Second),
+		WaitingFor: wait.ForAll(
+			wait.ForListeningPort(vllmPort),
+			wait.ForListeningPort(vllmStreamPort),
+		).WithStartupTimeout(60 * time.Second),
 	}
 
 	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
@@ -92,7 +206,12 @@ func StartVLLM(ctx context.Context, c *Combined) (*VLLM, error) {
 		return nil, fmt.Errorf("start vllm container: %w", err)
 	}
 
-	return &VLLM{container: ctr, workDir: workDir, URL: "http://" + vllmAlias + ":8000"}, nil
+	return &VLLM{
+		container: ctr,
+		workDir:   workDir,
+		URL:       "http://" + vllmAlias + ":8000",
+		StreamURL: "http://" + vllmAlias + ":8001",
+	}, nil
 }
 
 // Logs returns the vLLM container logs, for diagnostics on failure.
diff --git a/e2e/remotejobs/main_test.go b/e2e/remotejobs/main_test.go
new file mode 100644
index 000000000..962a5b5d0
--- /dev/null
+++ b/e2e/remotejobs/main_test.go
@@ -0,0 +1,47 @@
+//go:build e2e
+
+// Package remotejobs holds the container-based e2e suite for the remote-jobs
+// opt-in (PR #7153) and the debug-bundle job parameters anonymize_level /
+// upload_url (PR #7147). A combined server is built and bootstrapped once per
+// package run (TestMain) and shared via srv; each test registers its own client
+// and cleans it up.
+package remotejobs
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+)
+
+// srv is the shared combined server for the package, PAT-authenticated by the
+// time any Test runs.
+var srv *harness.Combined
+
+func TestMain(m *testing.M) {
+	os.Exit(run(m))
+}
+
+func run(m *testing.M) int {
+	// Generous timeout to cover a cold image build on first run.
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	var err error
+	srv, err = harness.StartCombined(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "e2e: start combined server: %v\n", err)
+		return 1
+	}
+	defer func() { _ = srv.Terminate(context.Background()) }()
+
+	if _, err := srv.Bootstrap(ctx); err != nil {
+		fmt.Fprintf(os.Stderr, "e2e: bootstrap admin PAT: %v\n", err)
+		return 1
+	}
+
+	return m.Run()
+}
diff --git a/e2e/remotejobs/remotejobs_test.go b/e2e/remotejobs/remotejobs_test.go
new file mode 100644
index 000000000..48d0bd986
--- /dev/null
+++ b/e2e/remotejobs/remotejobs_test.go
@@ -0,0 +1,197 @@
+//go:build e2e
+
+package remotejobs
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+const (
+	refusedReason = "remote jobs are not enabled on this peer"
+	// testUploadURL is the debug-bundle upload URL the job subtests pass; it only
+	// needs to be a well-formed https URL with a host (see ValidateBundleUploadURL).
+	testUploadURL = "https://uploads.example.com/bundle"
+)
+
+// TestRemoteJobsOptInAndBundleParams exercises the two PRs end-to-end against a
+// live management server and a real client:
+//
+//   - #7153: the peer's remote-jobs opt-in defaults off, is reported to
+//     management (visible via the peers API as remote_jobs_allowed), and gates
+//     job execution on the client — a streamed job is refused until the peer
+//     opts in with `netbird up --allow-remote-jobs`, after which it runs.
+//   - #7147: the debug-bundle job's anonymize_level is validated (an unknown
+//     value is rejected at creation) and normalized (trimmed + lowercased) in
+//     the stored job the API returns.
+func TestRemoteJobsOptInAndBundleParams(t *testing.T) {
+	ctx := context.Background()
+
+	// A group for the setup key to auto-assign; peers must land in some group.
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-remotejobs"})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-remotejobs",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+	t.Cleanup(func() { _ = srv.API().SetupKeys.Delete(context.Background(), sk.Id) })
+
+	// Start the client with a plain `netbird up` (remote jobs NOT enabled).
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+
+	peerID := waitForPeer(ctx, t, cl.Hostname())
+
+	t.Run("opt-in flag defaults to false and is reported to management (#7153)", func(t *testing.T) {
+		p, err := srv.API().Peers.Get(ctx, peerID)
+		require.NoError(t, err)
+		allowed := remoteJobsAllowed(p)
+		require.NotNil(t, allowed, "remote_jobs_allowed must be present on the peer API")
+		assert.False(t, *allowed, "a peer that ran plain `netbird up` must default to opt-out")
+	})
+
+	t.Run("anonymize_level is validated and normalized (#7147)", func(t *testing.T) {
+		// Unknown level is rejected at job creation.
+		_, err := srv.API().Peers.Jobs(peerID).Create(ctx, bundleJob("bogus", testUploadURL))
+		require.Error(t, err, "an unknown anonymize_level must be rejected")
+		assert.Contains(t, strings.ToLower(err.Error()), "anonymize_level",
+			"the rejection must name the offending field")
+
+		// A messy but valid level is normalized (trimmed + lowercased) in the
+		// stored job the API echoes back.
+		job, err := srv.API().Peers.Jobs(peerID).Create(ctx, bundleJob("  Strict  ", testUploadURL))
+		require.NoError(t, err, "a valid anonymize_level must be accepted")
+		bw, err := job.Workload.AsBundleWorkloadResponse()
+		require.NoError(t, err, "job workload must be a bundle")
+		require.NotNil(t, bw.Parameters.AnonymizeLevel)
+		assert.Equal(t, "strict", *bw.Parameters.AnonymizeLevel,
+			"anonymize_level must be normalized to trimmed lowercase")
+		waitForJobTerminal(ctx, t, peerID, job.Id) // let it settle before the next create
+	})
+
+	t.Run("a job is refused while the peer has not opted in (#7153 enforcement)", func(t *testing.T) {
+		job, err := srv.API().Peers.Jobs(peerID).Create(ctx, bundleJob("default", testUploadURL))
+		require.NoError(t, err, "job creation itself is allowed; enforcement is on the client")
+		final := waitForJobTerminal(ctx, t, peerID, job.Id)
+		assert.Equal(t, api.JobResponseStatusFailed, final.Status, "the client must refuse the job")
+		require.NotNil(t, final.FailedReason)
+		assert.Contains(t, *final.FailedReason, refusedReason,
+			"the failure must be the opt-out refusal, not some other error")
+	})
+
+	t.Run("opting in flips the flag and lets the job run (#7153)", func(t *testing.T) {
+		require.NoError(t, cl.Up(ctx, "--allow-remote-jobs"), "re-run up with --allow-remote-jobs")
+		require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must reconnect")
+
+		// The new opt-in must round-trip to management and surface on the API.
+		require.Eventually(t, func() bool {
+			p, err := srv.API().Peers.Get(ctx, peerID)
+			if err != nil {
+				return false
+			}
+			allowed := remoteJobsAllowed(p)
+			return allowed != nil && *allowed
+		}, 60*time.Second, 2*time.Second, "remote_jobs_allowed must become true after opt-in")
+
+		// The same job that was refused before must now be accepted for
+		// execution: whatever its outcome, it must NOT be the opt-out refusal.
+		job, err := srv.API().Peers.Jobs(peerID).Create(ctx, bundleJob("default", testUploadURL))
+		require.NoError(t, err)
+		final := waitForJobTerminal(ctx, t, peerID, job.Id)
+		if final.Status == api.JobResponseStatusFailed && final.FailedReason != nil {
+			assert.NotContains(t, *final.FailedReason, refusedReason,
+				"once opted in, the job must not be refused for opt-out; any failure must be for another reason (e.g. upload)")
+		}
+	})
+}
+
+// remoteJobsAllowed returns the peer's remote-jobs opt-in flag from the API
+// response (nil if the peer or its local flags are absent).
+func remoteJobsAllowed(p *api.Peer) *bool {
+	if p == nil || p.LocalFlags == nil {
+		return nil
+	}
+	return p.LocalFlags.RemoteJobsAllowed
+}
+
+// bundleJob builds a debug-bundle job request with the given anonymize_level
+// (omitted when empty) and upload_url (omitted when empty).
+func bundleJob(anonymizeLevel, uploadURL string) api.JobRequest {
+	params := api.BundleParameters{
+		Anonymize:    true,
+		LogFileCount: 1,
+	}
+	if anonymizeLevel != "" {
+		params.AnonymizeLevel = &anonymizeLevel
+	}
+	if uploadURL != "" {
+		params.UploadUrl = &uploadURL
+	}
+	var wl api.WorkloadRequest
+	// FromBundleWorkloadRequest cannot fail for a well-formed value.
+	_ = wl.FromBundleWorkloadRequest(api.BundleWorkloadRequest{
+		Type:       api.WorkloadTypeBundle,
+		Parameters: params,
+	})
+	return api.JobRequest{Workload: wl}
+}
+
+// waitForPeer polls the peers API until the client that registered under the
+// given hostname appears and returns its ID. Matching by hostname rather than
+// taking the first list entry keeps the test correct if the account ever holds
+// more than one peer (a shared bootstrap account, or a second client added to
+// the package).
+func waitForPeer(ctx context.Context, t *testing.T, hostname string) string {
+	t.Helper()
+	var peerID string
+	require.Eventually(t, func() bool {
+		peers, err := srv.API().Peers.List(ctx)
+		if err != nil {
+			return false
+		}
+		for _, p := range peers {
+			if p.Hostname == hostname {
+				peerID = p.Id
+				return true
+			}
+		}
+		return false
+	}, 60*time.Second, 2*time.Second, "the client peer must register with management")
+	return peerID
+}
+
+// waitForJobTerminal polls a job until it leaves the pending state, then returns
+// the final response.
+func waitForJobTerminal(ctx context.Context, t *testing.T, peerID, jobID string) *api.JobResponse {
+	t.Helper()
+	var final *api.JobResponse
+	require.Eventually(t, func() bool {
+		j, err := srv.API().Peers.Jobs(peerID).Get(ctx, jobID)
+		if err != nil || j == nil {
+			return false
+		}
+		if j.Status == api.JobResponseStatusPending {
+			return false
+		}
+		final = j
+		return true
+	}, 120*time.Second, 2*time.Second, "job must reach a terminal state")
+	return final
+}
diff --git a/e2e/reverseproxy/README.md b/e2e/reverseproxy/README.md
new file mode 100644
index 000000000..fdd5faca5
--- /dev/null
+++ b/e2e/reverseproxy/README.md
@@ -0,0 +1,36 @@
+# Reverse-proxy access E2E tests
+
+These tests run a real combined management server, reverse proxy, and HTTP
+upstream in isolated Docker containers. Services are configured through the
+management API, then requests go through the proxy's HTTPS listener. No external
+identity provider, public DNS record, or API credential is needed.
+
+Run from the repository root with Docker and Go available:
+
+```bash
+go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
+```
+
+The harness builds the combined server and proxy from the current checkout.
+To test existing images, pass full image references:
+
+```bash
+NB_E2E_COMBINED_IMAGE=local/netbird-combined:target-access \
+NB_E2E_PROXY_IMAGE=local/netbird-proxy:target-access \
+go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
+```
+
+Rebuild locally tagged images after backend changes. Both components must
+support target access actions; using an older management image does not test
+the feature.
+
+The suite checks inherited service authentication, anonymous bypass, blocked
+paths, longest-prefix precedence, credential stripping, live action updates,
+service restrictions, deletion, and private-service bypass rejection. Upstream
+request markers distinguish successful forwarding from proxy-generated
+responses and verify that denied requests never reach the backend.
+
+The `Reverse Proxy E2E` workflow runs this package for relevant pull requests
+and manual dispatches. It also remains part of the nightly `./e2e/...` suite.
+Dashboard browser coverage lives in the dashboard repository: it creates and
+edits services through the UI, then probes their real proxy behavior.
diff --git a/e2e/reverseproxy/main_test.go b/e2e/reverseproxy/main_test.go
new file mode 100644
index 000000000..be211510d
--- /dev/null
+++ b/e2e/reverseproxy/main_test.go
@@ -0,0 +1,42 @@
+//go:build e2e
+
+// Package reverseproxy contains container-based tests for public reverse-proxy
+// services. A real combined management server is shared across package tests;
+// each test owns and cleans up its proxy and service resources.
+package reverseproxy
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+)
+
+var srv *harness.Combined
+
+func TestMain(m *testing.M) {
+	os.Exit(run(m))
+}
+
+func run(m *testing.M) int {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	var err error
+	srv, err = harness.StartCombined(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "e2e: start combined server: %v\n", err)
+		return 1
+	}
+	defer func() { _ = srv.Terminate(context.Background()) }()
+
+	if _, err := srv.Bootstrap(ctx); err != nil {
+		fmt.Fprintf(os.Stderr, "e2e: bootstrap admin PAT: %v\n", err)
+		return 1
+	}
+
+	return m.Run()
+}
diff --git a/e2e/reverseproxy/target_access_control_test.go b/e2e/reverseproxy/target_access_control_test.go
new file mode 100644
index 000000000..a74ec22bc
--- /dev/null
+++ b/e2e/reverseproxy/target_access_control_test.go
@@ -0,0 +1,336 @@
+//go:build e2e
+
+package reverseproxy
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"net/http"
+	"net/url"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+const (
+	targetAccessDomain            = "target-access." + harness.AgentNetworkCluster
+	targetAccessHeader            = "X-E2E-Proxy-Key"
+	targetAccessSecret            = "e2e-target-access-secret"
+	targetAccessEchoPrefix        = "/e2e/proxy-echo/"
+	targetAccessApplicationAuth   = "Bearer e2e-application-token"
+	targetAccessApplicationCookie = "application_session=e2e-visible"
+)
+
+type targetAccessEcho struct {
+	Source         string `json:"source"`
+	Path           string `json:"path"`
+	RequestURI     string `json:"request_uri"`
+	ConfiguredAuth string `json:"configured_auth"`
+	Authorization  string `json:"authorization"`
+	Cookie         string `json:"cookie"`
+	NetBirdUser    string `json:"netbird_user"`
+	NetBirdGroups  string `json:"netbird_groups"`
+}
+
+func TestTargetAccessControl_PrivateServiceRejectsBypass(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 30*time.Second)
+	defer cancel()
+
+	group, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-private-target-access"})
+	require.NoError(t, err, "create private-service access group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), group.Id) })
+
+	request := targetAccessServiceRequest(t, "http://upstream.invalid:80",
+		api.ServiceTargetAccessActionBypass,
+		api.ServiceTargetAccessActionBlock,
+		nil,
+	)
+	private := true
+	accessGroups := []string{group.Id}
+	request.Domain = "private-target-access." + harness.AgentNetworkCluster
+	request.Name = "E2E private target access rejection"
+	request.Private = &private
+	request.AccessGroups = &accessGroups
+
+	created, err := srv.API().ReverseProxyServices.Create(ctx, request)
+	if created != nil {
+		t.Cleanup(func() { _ = srv.API().ReverseProxyServices.Delete(context.Background(), created.Id) })
+	}
+	assert.Nil(t, created)
+	assert.ErrorContains(t, err, "bypass access_action is not supported for private services")
+}
+
+func TestTargetAccessControl_PublicServiceLifecycle(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Minute)
+	defer cancel()
+
+	upstream, err := harness.StartHTTPUpstream(ctx, srv)
+	require.NoError(t, err, "start HTTP upstream")
+	t.Cleanup(func() { _ = upstream.Terminate(context.Background()) })
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-target-access-proxy")
+	require.NoError(t, err, "mint global proxy token")
+	// Cluster direct-upstream targets require a private-capable proxy, while the
+	// service itself remains public through request.Private below.
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start reverse proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	request := targetAccessServiceRequest(t, upstream.URL,
+		api.ServiceTargetAccessActionBypass,
+		api.ServiceTargetAccessActionBlock,
+		nil,
+	)
+	created, err := srv.API().ReverseProxyServices.Create(ctx, request)
+	require.NoError(t, err, "create service with per-target access actions")
+	removed := false
+	t.Cleanup(func() {
+		if !removed {
+			_ = srv.API().ReverseProxyServices.Delete(context.Background(), created.Id)
+		}
+	})
+
+	validAuth := targetAccessForwardedHeaders(targetAccessSecret)
+	wrongAuth := http.Header{targetAccessHeader: []string{"wrong-secret"}}
+	spoofedBypass := targetAccessForwardedHeaders("wrong-secret")
+
+	// Wait for the service snapshot before issuing unique one-shot markers. A
+	// marker used while polling could reach an older mapping and make an updated
+	// block look as though it forwarded after convergence.
+	requireProxyStatus(t, ctx, px, targetAccessPath("", "warm-created"), nil,
+		http.StatusUnauthorized, "wait for created service")
+	requireProxyAttempt(t, ctx, px, upstream, "", "inherit-missing", nil,
+		http.StatusUnauthorized, 0, "inherit target without service credentials")
+	requireProxyAttempt(t, ctx, px, upstream, "", "inherit-wrong", wrongAuth,
+		http.StatusUnauthorized, 0, "inherit target with invalid service credentials")
+	requireProxyEcho(t, ctx, px, upstream, "", "inherit-valid", validAuth,
+		"inherit target with valid service credentials")
+	requireProxyEcho(t, ctx, px, upstream, "/public", "bypass-initial", spoofedBypass,
+		"bypass target without valid service credentials")
+	requireProxyAttempt(t, ctx, px, upstream, "/public/private", "nested-missing", nil,
+		http.StatusUnauthorized, 0, "nested inherit target overrides bypass parent")
+	requireProxyEcho(t, ctx, px, upstream, "/public/private", "nested-valid", validAuth,
+		"nested inherit target accepts valid service credentials")
+	requireProxyAttempt(t, ctx, px, upstream, "/blocked", "block-initial", validAuth,
+		http.StatusForbidden, 0, "block target even with valid service credentials")
+
+	request = targetAccessServiceRequest(t, upstream.URL,
+		api.ServiceTargetAccessActionBlock,
+		api.ServiceTargetAccessActionBypass,
+		nil,
+	)
+	_, err = srv.API().ReverseProxyServices.Update(ctx, created.Id, request)
+	require.NoError(t, err, "swap target access actions")
+	requireProxyStatus(t, ctx, px, targetAccessPath("/public", "warm-actions-updated"), validAuth,
+		http.StatusForbidden, "wait for target action update")
+	requireProxyAttempt(t, ctx, px, upstream, "/public", "public-updated-block", validAuth,
+		http.StatusForbidden, 0, "updated public target is blocked")
+	requireProxyEcho(t, ctx, px, upstream, "/blocked", "blocked-updated-bypass", spoofedBypass,
+		"updated blocked target bypasses authentication")
+
+	blockedCIDRs := []string{"0.0.0.0/0", "::/0"}
+	request = targetAccessServiceRequest(t, upstream.URL,
+		api.ServiceTargetAccessActionBlock,
+		api.ServiceTargetAccessActionBypass,
+		&api.AccessRestrictions{BlockedCidrs: &blockedCIDRs},
+	)
+	_, err = srv.API().ReverseProxyServices.Update(ctx, created.Id, request)
+	require.NoError(t, err, "add connection restriction")
+	requireProxyStatus(t, ctx, px, targetAccessPath("/blocked", "warm-restricted"), nil,
+		http.StatusForbidden, "wait for connection restriction")
+	requireProxyAttempt(t, ctx, px, upstream, "/blocked", "blocked-restricted", spoofedBypass,
+		http.StatusForbidden, 0, "connection restriction runs before bypass")
+
+	// Clear the restriction and prove the route is live immediately before
+	// deleting it, so a stale 403 cannot make the removal check pass.
+	request = targetAccessServiceRequest(t, upstream.URL,
+		api.ServiceTargetAccessActionBlock,
+		api.ServiceTargetAccessActionBypass,
+		&api.AccessRestrictions{},
+	)
+	_, err = srv.API().ReverseProxyServices.Update(ctx, created.Id, request)
+	require.NoError(t, err, "clear connection restriction")
+	requireProxyStatus(t, ctx, px, targetAccessPath("/blocked", "warm-restriction-cleared"), nil,
+		http.StatusOK, "wait for cleared connection restriction")
+	requireProxyEcho(t, ctx, px, upstream, "/blocked", "blocked-restriction-cleared", spoofedBypass,
+		"bypass route is live before removal")
+
+	require.NoError(t, srv.API().ReverseProxyServices.Delete(ctx, created.Id), "delete service")
+	removed = true
+	requireProxyStatus(t, ctx, px, targetAccessPath("/blocked", "warm-deleted"), nil,
+		http.StatusNotFound, "wait for service deletion")
+	requireProxyAttempt(t, ctx, px, upstream, "/blocked", "blocked-deleted", nil,
+		http.StatusNotFound, 0, "deleted service is removed from the proxy")
+}
+
+func targetAccessServiceRequest(
+	t *testing.T,
+	upstreamURL string,
+	publicAction, blockedAction api.ServiceTargetAccessAction,
+	restrictions *api.AccessRestrictions,
+) api.ServiceRequest {
+	t.Helper()
+
+	u, err := url.Parse(upstreamURL)
+	require.NoError(t, err)
+	host, portText, err := net.SplitHostPort(u.Host)
+	require.NoError(t, err)
+	port, err := strconv.Atoi(portText)
+	require.NoError(t, err)
+
+	rootPath := "/"
+	publicPath := "/public"
+	nestedPath := "/public/private"
+	blockedPath := "/blocked"
+	directUpstream := true
+	mode := api.ServiceRequestModeHttp
+	private := false
+	inherit := api.ServiceTargetAccessActionInherit
+
+	target := func(path *string, action *api.ServiceTargetAccessAction) api.ServiceTarget {
+		return api.ServiceTarget{
+			AccessAction: action,
+			Enabled:      true,
+			Host:         &host,
+			Options:      &api.ServiceTargetOptions{DirectUpstream: &directUpstream},
+			Path:         path,
+			Port:         port,
+			Protocol:     api.ServiceTargetProtocolHttp,
+			TargetId:     harness.AgentNetworkCluster,
+			TargetType:   api.ServiceTargetTargetTypeCluster,
+		}
+	}
+	targets := []api.ServiceTarget{
+		target(&rootPath, &inherit),
+		target(&publicPath, &publicAction),
+		target(&nestedPath, &inherit),
+		target(&blockedPath, &blockedAction),
+	}
+	headerAuths := []api.HeaderAuthConfig{{
+		Enabled: true,
+		Header:  targetAccessHeader,
+		Value:   targetAccessSecret,
+	}}
+
+	return api.ServiceRequest{
+		AccessRestrictions: restrictions,
+		Auth:               &api.ServiceAuthConfig{HeaderAuths: &headerAuths},
+		Domain:             targetAccessDomain,
+		Enabled:            true,
+		Mode:               &mode,
+		Name:               "E2E target access control",
+		Private:            &private,
+		Targets:            &targets,
+	}
+}
+
+func targetAccessForwardedHeaders(authValue string) http.Header {
+	return http.Header{
+		targetAccessHeader: []string{authValue},
+		"Authorization":    []string{targetAccessApplicationAuth},
+		"Cookie":           []string{"nb_session=e2e-proxy-session; " + targetAccessApplicationCookie},
+		"X-NetBird-User":   []string{"spoofed@example.com"},
+		"X-NetBird-Groups": []string{"administrators"},
+	}
+}
+
+func targetAccessPath(targetPrefix, marker string) string {
+	return targetPrefix + targetAccessEchoPrefix + marker
+}
+
+func requireProxyAttempt(
+	t *testing.T,
+	ctx context.Context,
+	px *harness.Proxy,
+	upstream *harness.HTTPUpstream,
+	targetPrefix, marker string,
+	headers http.Header,
+	wantStatus, wantUpstreamRequests int,
+	description string,
+) string {
+	t.Helper()
+
+	path := targetAccessPath(targetPrefix, marker)
+	status, body, requestErr := px.HTTPSGet(ctx, targetAccessDomain, path, headers)
+	syncErr := upstream.Synchronize(ctx)
+	count, countErr := upstream.RequestCount(ctx, marker)
+	if requestErr != nil || syncErr != nil || countErr != nil || status != wantStatus || count != wantUpstreamRequests {
+		t.Fatalf("%s: wanted status=%d upstream_requests=%d, got status=%d upstream_requests=%d body=%q request_error=%v sync_error=%v count_error=%v\n=== proxy logs ===\n%s\n=== upstream logs ===\n%s",
+			description, wantStatus, wantUpstreamRequests, status, count, body, requestErr, syncErr, countErr,
+			px.Logs(context.Background()), upstream.Logs(context.Background()))
+	}
+	return body
+}
+
+func requireProxyEcho(
+	t *testing.T,
+	ctx context.Context,
+	px *harness.Proxy,
+	upstream *harness.HTTPUpstream,
+	targetPrefix, marker string,
+	headers http.Header,
+	description string,
+) {
+	t.Helper()
+
+	body := requireProxyAttempt(t, ctx, px, upstream, targetPrefix, marker, headers,
+		http.StatusOK, 1, description)
+	var echo targetAccessEcho
+	require.NoError(t, json.Unmarshal([]byte(body), &echo), "decode HTTP upstream observation")
+	wantPath := targetAccessEchoPrefix + marker
+	assert.Equal(t, "netbird-e2e-http-upstream", echo.Source, "response must come from the test upstream")
+	assert.Equal(t, wantPath, echo.Path, "upstream must receive the routed subpath")
+	assert.Equal(t, wantPath, echo.RequestURI, "upstream request URI must not contain the matched target prefix")
+	assert.Empty(t, echo.ConfiguredAuth, "configured proxy authentication header must be stripped")
+	assert.Equal(t, targetAccessApplicationAuth, echo.Authorization, "application authorization must be preserved")
+	assert.NotContains(t, echo.Cookie, "nb_session=", "proxy session cookie must be stripped")
+	assert.Contains(t, echo.Cookie, targetAccessApplicationCookie, "application cookie must be preserved")
+	assert.Empty(t, echo.NetBirdUser, "client-supplied NetBird identity must be stripped")
+	assert.Empty(t, echo.NetBirdGroups, "client-supplied NetBird groups must be stripped")
+}
+
+func requireProxyStatus(
+	t *testing.T,
+	ctx context.Context,
+	px *harness.Proxy,
+	path string,
+	headers http.Header,
+	want int,
+	description string,
+) {
+	t.Helper()
+
+	deadline := time.Now().Add(90 * time.Second)
+	var lastCode int
+	var lastBody string
+	var lastErr error
+	for time.Now().Before(deadline) {
+		lastCode, lastBody, lastErr = px.HTTPSGet(ctx, targetAccessDomain, path, headers)
+		if lastErr == nil && lastCode == want {
+			return
+		}
+		if !waitBeforeRetry(ctx, time.Second) {
+			break
+		}
+	}
+	t.Fatalf("%s: wanted status %d, last status=%d body=%q error=%v\n=== proxy logs ===\n%s",
+		description, want, lastCode, lastBody, lastErr, px.Logs(context.Background()))
+}
+
+func waitBeforeRetry(ctx context.Context, delay time.Duration) bool {
+	timer := time.NewTimer(delay)
+	defer timer.Stop()
+	select {
+	case <-ctx.Done():
+		return false
+	case <-timer.C:
+		return true
+	}
+}
diff --git a/encryption/message.go b/encryption/message.go
index 6e4cd7391..2bf2c59dc 100644
--- a/encryption/message.go
+++ b/encryption/message.go
@@ -6,6 +6,16 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
+type Encrypter interface {
+	EncryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, message pb.Message) ([]byte, error)
+}
+
+type DefaultEncrypter struct{}
+
+func (e DefaultEncrypter) EncryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, message pb.Message) ([]byte, error) {
+	return EncryptMessage(remotePubKey, ourPrivateKey, message)
+}
+
 // EncryptMessage encrypts a body of the given protobuf Message
 func EncryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, message pb.Message) ([]byte, error) {
 	byteResp, err := pb.Marshal(message)
diff --git a/encryption/sharedkey.go b/encryption/sharedkey.go
new file mode 100644
index 000000000..1509632c4
--- /dev/null
+++ b/encryption/sharedkey.go
@@ -0,0 +1,147 @@
+package encryption
+
+import (
+	"fmt"
+	"sync"
+
+	pb "github.com/golang/protobuf/proto" //nolint
+	"golang.org/x/crypto/nacl/box"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// SharedKeyCache encrypts and decrypts messages for one local private key, deriving
+// the box shared key once per remote public key instead of once per message.
+//
+// The shared key is a pure function of the two keys, so a cached entry never goes
+// stale: a different remote key is a different entry, and a different local key
+// needs a different cache. Entries are only dropped to stay under maxSharedKeys.
+// Every message still uses its own random nonce.
+//
+// The cached values are secret key material, as sensitive as the private key.
+type SharedKeyCache struct {
+	privateKey wgtypes.Key
+	limit      int
+
+	mu     sync.RWMutex
+	keys   map[wgtypes.Key]*[32]byte
+	closed bool
+}
+
+// NewSharedKeyCache returns a cache for messages sent and received with privateKey.
+func NewSharedKeyCache(privateKey wgtypes.Key) *SharedKeyCache {
+	return &SharedKeyCache{
+		privateKey: privateKey,
+		limit:      maxSharedKeys,
+		keys:       make(map[wgtypes.Key]*[32]byte),
+	}
+}
+
+// Encrypt encrypts msg for peerPublicKey. It is safe for concurrent use.
+func (c *SharedKeyCache) Encrypt(msg []byte, peerPublicKey wgtypes.Key) ([]byte, error) {
+	nonce, err := genNonce()
+	if err != nil {
+		return nil, err
+	}
+	return box.SealAfterPrecomputation(nonce[:], msg, nonce, c.sharedKey(peerPublicKey)), nil
+}
+
+// Decrypt decrypts a message that peerPublicKey encrypted for this cache's private
+// key. It is safe for concurrent use.
+func (c *SharedKeyCache) Decrypt(encryptedMsg []byte, peerPublicKey wgtypes.Key) ([]byte, error) {
+	if len(encryptedMsg) < nonceSize {
+		return nil, fmt.Errorf("invalid encrypted message length")
+	}
+
+	var nonce [nonceSize]byte
+	copy(nonce[:], encryptedMsg[:nonceSize])
+
+	shared, cached := c.cached(peerPublicKey)
+	if !cached {
+		shared = c.derive(peerPublicKey)
+	}
+
+	opened, ok := box.OpenAfterPrecomputation(nil, encryptedMsg[nonceSize:], &nonce, shared)
+	if !ok {
+		return nil, fmt.Errorf("failed to decrypt message from peer %s", peerPublicKey.String())
+	}
+
+	// The sender key of an incoming message is not authenticated until it opens, so
+	// only a key that produced a valid message is cached. Forged senders cannot fill
+	// the cache or evict real peers.
+	if !cached {
+		c.store(peerPublicKey, shared)
+	}
+	return opened, nil
+}
+
+// EncryptMessage marshals message and encrypts it for peerPublicKey.
+func (c *SharedKeyCache) EncryptMessage(peerPublicKey wgtypes.Key, message pb.Message) ([]byte, error) {
+	body, err := pb.Marshal(message)
+	if err != nil {
+		return nil, fmt.Errorf("marshal message: %w", err)
+	}
+	return c.Encrypt(body, peerPublicKey)
+}
+
+// DecryptMessage decrypts a message from peerPublicKey and unmarshals it into message.
+func (c *SharedKeyCache) DecryptMessage(peerPublicKey wgtypes.Key, encryptedMessage []byte, message pb.Message) error {
+	body, err := c.Decrypt(encryptedMessage, peerPublicKey)
+	if err != nil {
+		return err
+	}
+	if err := pb.Unmarshal(body, message); err != nil {
+		return fmt.Errorf("unmarshal message from peer %s: %w", peerPublicKey.String(), err)
+	}
+	return nil
+}
+
+// Close drops every cached shared key and stops caching new ones. Encrypt and
+// Decrypt keep working afterwards by deriving the key for each message.
+func (c *SharedKeyCache) Close() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.closed = true
+	clear(c.keys)
+}
+
+func (c *SharedKeyCache) sharedKey(peerPublicKey wgtypes.Key) *[32]byte {
+	if shared, ok := c.cached(peerPublicKey); ok {
+		return shared
+	}
+
+	shared := c.derive(peerPublicKey)
+	c.store(peerPublicKey, shared)
+	return shared
+}
+
+func (c *SharedKeyCache) cached(peerPublicKey wgtypes.Key) (*[32]byte, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	shared, ok := c.keys[peerPublicKey]
+	return shared, ok
+}
+
+// derive computes the shared key outside the lock: two goroutines racing on a new
+// peer compute the same value, and holding the lock would serialise the x25519 work
+// this cache avoids.
+func (c *SharedKeyCache) derive(peerPublicKey wgtypes.Key) *[32]byte {
+	shared := new([32]byte)
+	box.Precompute(shared, toByte32(peerPublicKey), toByte32(c.privateKey))
+	return shared
+}
+
+func (c *SharedKeyCache) store(peerPublicKey wgtypes.Key, shared *[32]byte) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.closed {
+		return
+	}
+	if len(c.keys) >= c.limit {
+		// Map iteration order is random, so this evicts an arbitrary entry.
+		for k := range c.keys {
+			delete(c.keys, k)
+			break
+		}
+	}
+	c.keys[peerPublicKey] = shared
+}
diff --git a/encryption/sharedkey_limit.go b/encryption/sharedkey_limit.go
new file mode 100644
index 000000000..b141492f6
--- /dev/null
+++ b/encryption/sharedkey_limit.go
@@ -0,0 +1,8 @@
+//go:build !ios && !android
+
+package encryption
+
+// maxSharedKeys bounds the cache so peers that come and go (ephemeral peers get a
+// new key on every registration) cannot grow it for the lifetime of the process.
+// An entry costs about 130 bytes, so a full cache is around 8 MB.
+const maxSharedKeys = 1 << 16
diff --git a/encryption/sharedkey_limit_mobile.go b/encryption/sharedkey_limit_mobile.go
new file mode 100644
index 000000000..f36181f94
--- /dev/null
+++ b/encryption/sharedkey_limit_mobile.go
@@ -0,0 +1,8 @@
+//go:build ios || android
+
+package encryption
+
+// maxSharedKeys is small on mobile, where the process runs under a tight memory
+// limit. A miss only costs a fresh key derivation. An entry costs about 130 bytes,
+// so a full cache is around 130 KB.
+const maxSharedKeys = 1 << 10
diff --git a/encryption/sharedkey_test.go b/encryption/sharedkey_test.go
new file mode 100644
index 000000000..003ccb627
--- /dev/null
+++ b/encryption/sharedkey_test.go
@@ -0,0 +1,184 @@
+package encryption
+
+import (
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+func newKeyPair(t testing.TB) (wgtypes.Key, wgtypes.Key) {
+	t.Helper()
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	return priv, priv.PublicKey()
+}
+
+// The cache must stay wire compatible with peers that use the uncached functions,
+// in both directions.
+func TestSharedKeyCache_InteropWithUncached(t *testing.T) {
+	alicePriv, alicePub := newKeyPair(t)
+	bobPriv, bobPub := newKeyPair(t)
+	alice := NewSharedKeyCache(alicePriv)
+	msg := []byte("offer")
+
+	enc, err := alice.Encrypt(msg, bobPub)
+	require.NoError(t, err)
+	dec, err := Decrypt(enc, alicePub, bobPriv)
+	require.NoError(t, err)
+	assert.Equal(t, msg, dec, "uncached peer must read a cached sender's message")
+
+	enc, err = Encrypt(msg, alicePub, bobPriv)
+	require.NoError(t, err)
+	dec, err = alice.Decrypt(enc, bobPub)
+	require.NoError(t, err)
+	assert.Equal(t, msg, dec, "cached peer must read an uncached sender's message")
+}
+
+// Two messages to the same peer share the derived key but never the nonce, so the
+// ciphertexts differ.
+func TestSharedKeyCache_FreshNoncePerMessage(t *testing.T) {
+	priv, _ := newKeyPair(t)
+	_, peerPub := newKeyPair(t)
+	c := NewSharedKeyCache(priv)
+
+	a, err := c.Encrypt([]byte("same"), peerPub)
+	require.NoError(t, err)
+	b, err := c.Encrypt([]byte("same"), peerPub)
+	require.NoError(t, err)
+	assert.NotEqual(t, a, b, "ciphertexts of identical plaintext must differ")
+	assert.Len(t, c.keys, 1, "the shared key must be derived once per peer")
+}
+
+// A message from one peer must not decrypt under another peer's cached key.
+func TestSharedKeyCache_DoesNotMixPeers(t *testing.T) {
+	alicePriv, alicePub := newKeyPair(t)
+	bobPriv, _ := newKeyPair(t)
+	_, carolPub := newKeyPair(t)
+	alice := NewSharedKeyCache(alicePriv)
+
+	enc, err := Encrypt([]byte("hi"), alicePub, bobPriv)
+	require.NoError(t, err)
+	_, err = alice.Decrypt(enc, carolPub)
+	assert.Error(t, err, "a message from Bob must not open with Carol's key")
+}
+
+func TestSharedKeyCache_RejectsShortMessage(t *testing.T) {
+	priv, _ := newKeyPair(t)
+	_, peerPub := newKeyPair(t)
+	_, err := NewSharedKeyCache(priv).Decrypt(make([]byte, nonceSize-1), peerPub)
+	assert.Error(t, err)
+}
+
+func TestSharedKeyCache_StaysBounded(t *testing.T) {
+	priv, _ := newKeyPair(t)
+	c := NewSharedKeyCache(priv)
+	c.limit = 4
+
+	for i := 0; i < 20; i++ {
+		_, peerPub := newKeyPair(t)
+		_, err := c.Encrypt([]byte("x"), peerPub)
+		require.NoError(t, err)
+		assert.LessOrEqual(t, len(c.keys), c.limit, "cache must not grow past its cap")
+	}
+	assert.Len(t, c.keys, c.limit, "a full cache keeps evicting one entry per new peer")
+	c.Close()
+	assert.Empty(t, c.keys, "Close must drop every entry")
+}
+
+func TestSharedKeyCache_Concurrent(t *testing.T) {
+	alicePriv, alicePub := newKeyPair(t)
+	bobPriv, bobPub := newKeyPair(t)
+	alice := NewSharedKeyCache(alicePriv)
+	bob := NewSharedKeyCache(bobPriv)
+
+	var wg sync.WaitGroup
+	for i := 0; i < 16; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for j := 0; j < 50; j++ {
+				enc, err := alice.Encrypt([]byte("m"), bobPub)
+				if !assert.NoError(t, err) {
+					return
+				}
+				dec, err := bob.Decrypt(enc, alicePub)
+				if !assert.NoError(t, err) || !assert.Equal(t, []byte("m"), dec) {
+					return
+				}
+			}
+		}()
+	}
+	wg.Wait()
+}
+
+func BenchmarkEncryptDecryptUncached(b *testing.B) {
+	alicePriv, alicePub := newKeyPair(b)
+	bobPriv, bobPub := newKeyPair(b)
+	msg := make([]byte, 512)
+
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		enc, err := Encrypt(msg, bobPub, alicePriv)
+		require.NoError(b, err)
+		_, err = Decrypt(enc, alicePub, bobPriv)
+		require.NoError(b, err)
+	}
+}
+
+func BenchmarkEncryptDecryptCached(b *testing.B) {
+	alicePriv, alicePub := newKeyPair(b)
+	bobPriv, bobPub := newKeyPair(b)
+	alice := NewSharedKeyCache(alicePriv)
+	bob := NewSharedKeyCache(bobPriv)
+	msg := make([]byte, 512)
+
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		enc, err := alice.Encrypt(msg, bobPub)
+		require.NoError(b, err)
+		_, err = bob.Decrypt(enc, alicePub)
+		require.NoError(b, err)
+	}
+}
+
+// A forged sender key must not populate the cache: the key of an incoming message
+// is only trusted once the message opens.
+func TestSharedKeyCache_FailedDecryptDoesNotCache(t *testing.T) {
+	alicePriv, alicePub := newKeyPair(t)
+	bobPriv, bobPub := newKeyPair(t)
+	_, forgedPub := newKeyPair(t)
+	alice := NewSharedKeyCache(alicePriv)
+
+	enc, err := Encrypt([]byte("hi"), alicePub, bobPriv)
+	require.NoError(t, err)
+
+	_, err = alice.Decrypt(enc, forgedPub)
+	require.Error(t, err)
+	assert.Empty(t, alice.keys, "a message that fails to open must not add a cache entry")
+
+	_, err = alice.Decrypt(enc, bobPub)
+	require.NoError(t, err)
+	assert.Len(t, alice.keys, 1, "a message that opens caches its sender's key")
+}
+
+// After Close the cache still works but no longer keeps key material.
+func TestSharedKeyCache_ClosedDoesNotRepopulate(t *testing.T) {
+	alicePriv, alicePub := newKeyPair(t)
+	bobPriv, bobPub := newKeyPair(t)
+	alice := NewSharedKeyCache(alicePriv)
+
+	_, err := alice.Encrypt([]byte("x"), bobPub)
+	require.NoError(t, err)
+	alice.Close()
+	assert.Empty(t, alice.keys)
+
+	enc, err := alice.Encrypt([]byte("y"), bobPub)
+	require.NoError(t, err)
+	dec, err := Decrypt(enc, alicePub, bobPriv)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("y"), dec, "a closed cache must still encrypt correctly")
+	assert.Empty(t, alice.keys, "a closed cache must not cache new keys")
+}
diff --git a/encryption/testprotos/generate.sh b/encryption/testprotos/generate.sh
index 0ce6ebdea..ffbc481d6 100755
--- a/encryption/testprotos/generate.sh
+++ b/encryption/testprotos/generate.sh
@@ -1,2 +1,2 @@
-#!/bin/bash
-protoc -I testprotos/ testprotos/testproto.proto --go_out=.
\ No newline at end of file
+#!/usr/bin/env bash
+protoc -I testprotos/ testprotos/testproto.proto --go_out=.
diff --git a/flow/client/client.go b/flow/client/client.go
index 180a4b441..fc07db833 100644
--- a/flow/client/client.go
+++ b/flow/client/client.go
@@ -109,7 +109,7 @@ func (c *GRPCClient) Close() error {
 func (c *GRPCClient) Send(event *proto.FlowEvent) error {
 	c.mu.Lock()
 	stream := c.stream
-	c.mu.Unlock()
+	defer c.mu.Unlock() // stream.Send() is not safe to call concurrently from multiple goroutines
 
 	if stream == nil {
 		return errors.New("stream not initialized")
@@ -146,11 +146,14 @@ func (c *GRPCClient) Receive(ctx context.Context, interval time.Duration, msgHan
 
 		streamStart := time.Now()
 
-		if err := c.receive(stream, msgHandler); err != nil {
+		// receive always returns a non-nil error once the stream breaks;
+		// handleRetryableError decides between reconnecting and exiting
+		// permanently on local context cancellation
+		err = c.receive(stream, msgHandler)
+		if !isContextDone(err) {
 			log.Errorf("receive failed: %v", err)
-			return c.handleRetryableError(err, streamStart, backOff)
 		}
-		return nil
+		return c.handleRetryableError(err, streamStart, backOff)
 	}
 
 	if err := backoff.Retry(operation, backOff); err != nil {
diff --git a/flow/proto/flow.pb.go b/flow/proto/flow.pb.go
index 04e6e3792..710024f0e 100644
--- a/flow/proto/flow.pb.go
+++ b/flow/proto/flow.pb.go
@@ -134,9 +134,11 @@ type FlowEvent struct {
 	// When the event occurred
 	Timestamp *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
 	// Public key of the sending peer
-	PublicKey   []byte      `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
-	FlowFields  *FlowFields `protobuf:"bytes,4,opt,name=flow_fields,json=flowFields,proto3" json:"flow_fields,omitempty"`
-	IsInitiator bool        `protobuf:"varint,5,opt,name=isInitiator,proto3" json:"isInitiator,omitempty"`
+	PublicKey   []byte                 `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	FlowFields  *FlowFields            `protobuf:"bytes,4,opt,name=flow_fields,json=flowFields,proto3" json:"flow_fields,omitempty"`
+	IsInitiator bool                   `protobuf:"varint,5,opt,name=isInitiator,proto3" json:"isInitiator,omitempty"`
+	WindowStart *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=window_start,json=windowStart,proto3" json:"window_start,omitempty"`
+	WindowEnd   *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=window_end,json=windowEnd,proto3" json:"window_end,omitempty"`
 }
 
 func (x *FlowEvent) Reset() {
@@ -206,6 +208,20 @@ func (x *FlowEvent) GetIsInitiator() bool {
 	return false
 }
 
+func (x *FlowEvent) GetWindowStart() *timestamppb.Timestamp {
+	if x != nil {
+		return x.WindowStart
+	}
+	return nil
+}
+
+func (x *FlowEvent) GetWindowEnd() *timestamppb.Timestamp {
+	if x != nil {
+		return x.WindowEnd
+	}
+	return nil
+}
+
 type FlowEventAck struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -284,7 +300,6 @@ type FlowFields struct {
 	// Layer 4 -specific information
 	//
 	// Types that are assignable to ConnectionInfo:
-	//
 	//	*FlowFields_PortInfo
 	//	*FlowFields_IcmpInfo
 	ConnectionInfo isFlowFields_ConnectionInfo `protobuf_oneof:"connection_info"`
@@ -297,6 +312,9 @@ type FlowFields struct {
 	// Resource ID
 	SourceResourceId []byte `protobuf:"bytes,14,opt,name=source_resource_id,json=sourceResourceId,proto3" json:"source_resource_id,omitempty"`
 	DestResourceId   []byte `protobuf:"bytes,15,opt,name=dest_resource_id,json=destResourceId,proto3" json:"dest_resource_id,omitempty"`
+	NumOfStarts      uint64 `protobuf:"varint,16,opt,name=num_of_starts,json=numOfStarts,proto3" json:"num_of_starts,omitempty"`
+	NumOfEnds        uint64 `protobuf:"varint,17,opt,name=num_of_ends,json=numOfEnds,proto3" json:"num_of_ends,omitempty"`
+	NumOfDrops       uint64 `protobuf:"varint,18,opt,name=num_of_drops,json=numOfDrops,proto3" json:"num_of_drops,omitempty"`
 }
 
 func (x *FlowFields) Reset() {
@@ -443,6 +461,27 @@ func (x *FlowFields) GetDestResourceId() []byte {
 	return nil
 }
 
+func (x *FlowFields) GetNumOfStarts() uint64 {
+	if x != nil {
+		return x.NumOfStarts
+	}
+	return 0
+}
+
+func (x *FlowFields) GetNumOfEnds() uint64 {
+	if x != nil {
+		return x.NumOfEnds
+	}
+	return 0
+}
+
+func (x *FlowFields) GetNumOfDrops() uint64 {
+	if x != nil {
+		return x.NumOfDrops
+	}
+	return 0
+}
+
 type isFlowFields_ConnectionInfo interface {
 	isFlowFields_ConnectionInfo()
 }
@@ -579,7 +618,7 @@ var file_flow_proto_rawDesc = []byte{
 	0x0a, 0x0a, 0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x04, 0x66, 0x6c,
 	0x6f, 0x77, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 	0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x22, 0xd4, 0x01, 0x0a, 0x09, 0x46, 0x6c, 0x6f, 0x77, 0x45, 0x76, 0x65, 0x6e,
+	0x6f, 0x74, 0x6f, 0x22, 0xce, 0x02, 0x0a, 0x09, 0x46, 0x6c, 0x6f, 0x77, 0x45, 0x76, 0x65, 0x6e,
 	0x74, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
 	0x01, 0x28, 0x0c, 0x52, 0x07, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x38, 0x0a, 0x09,
 	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
@@ -592,45 +631,59 @@ var file_flow_proto_rawDesc = []byte{
 	0x77, 0x2e, 0x46, 0x6c, 0x6f, 0x77, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x52, 0x0a, 0x66, 0x6c,
 	0x6f, 0x77, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x12, 0x20, 0x0a, 0x0b, 0x69, 0x73, 0x49, 0x6e,
 	0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69,
-	0x73, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x22, 0x4b, 0x0a, 0x0c, 0x46, 0x6c,
-	0x6f, 0x77, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x41, 0x63, 0x6b, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x76,
-	0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x65, 0x76,
-	0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x69, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x69,
-	0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x49, 0x6e,
-	0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x22, 0x9c, 0x04, 0x0a, 0x0a, 0x46, 0x6c, 0x6f, 0x77,
-	0x46, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x12, 0x17, 0x0a, 0x07, 0x66, 0x6c, 0x6f, 0x77, 0x5f, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x66, 0x6c, 0x6f, 0x77, 0x49, 0x64, 0x12,
-	0x1e, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0a, 0x2e,
-	0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12,
-	0x17, 0x0a, 0x07, 0x72, 0x75, 0x6c, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x06, 0x72, 0x75, 0x6c, 0x65, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x09, 0x64, 0x69, 0x72, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0f, 0x2e, 0x66, 0x6c,
-	0x6f, 0x77, 0x2e, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x64, 0x69,
-	0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70,
-	0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70,
-	0x12, 0x17, 0x0a, 0x07, 0x64, 0x65, 0x73, 0x74, 0x5f, 0x69, 0x70, 0x18, 0x07, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x06, 0x64, 0x65, 0x73, 0x74, 0x49, 0x70, 0x12, 0x2d, 0x0a, 0x09, 0x70, 0x6f, 0x72,
-	0x74, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x66,
-	0x6c, 0x6f, 0x77, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x08,
-	0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x2d, 0x0a, 0x09, 0x69, 0x63, 0x6d, 0x70,
-	0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x66, 0x6c,
-	0x6f, 0x77, 0x2e, 0x49, 0x43, 0x4d, 0x50, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x08, 0x69,
-	0x63, 0x6d, 0x70, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x78, 0x5f, 0x70, 0x61,
-	0x63, 0x6b, 0x65, 0x74, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x72, 0x78, 0x50,
-	0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x78, 0x5f, 0x70, 0x61, 0x63,
-	0x6b, 0x65, 0x74, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x78, 0x50, 0x61,
-	0x63, 0x6b, 0x65, 0x74, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x78, 0x5f, 0x62, 0x79, 0x74, 0x65,
-	0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x72, 0x78, 0x42, 0x79, 0x74, 0x65, 0x73,
-	0x12, 0x19, 0x0a, 0x08, 0x74, 0x78, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20, 0x01,
-	0x28, 0x04, 0x52, 0x07, 0x74, 0x78, 0x42, 0x79, 0x74, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69,
-	0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x28, 0x0a, 0x10, 0x64, 0x65, 0x73,
-	0x74, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0f, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x0e, 0x64, 0x65, 0x73, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x49, 0x64, 0x42, 0x11, 0x0a, 0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x73, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x3d, 0x0a, 0x0c, 0x77, 0x69,
+	0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0b, 0x77, 0x69,
+	0x6e, 0x64, 0x6f, 0x77, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x39, 0x0a, 0x0a, 0x77, 0x69, 0x6e,
+	0x64, 0x6f, 0x77, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x77, 0x69, 0x6e, 0x64, 0x6f,
+	0x77, 0x45, 0x6e, 0x64, 0x22, 0x4b, 0x0a, 0x0c, 0x46, 0x6c, 0x6f, 0x77, 0x45, 0x76, 0x65, 0x6e,
+	0x74, 0x41, 0x63, 0x6b, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12,
+	0x20, 0x0a, 0x0b, 0x69, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f,
+	0x72, 0x22, 0x82, 0x05, 0x0a, 0x0a, 0x46, 0x6c, 0x6f, 0x77, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x73,
+	0x12, 0x17, 0x0a, 0x07, 0x66, 0x6c, 0x6f, 0x77, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x06, 0x66, 0x6c, 0x6f, 0x77, 0x49, 0x64, 0x12, 0x1e, 0x0a, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0a, 0x2e, 0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x54,
+	0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x72, 0x75, 0x6c,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x72, 0x75, 0x6c, 0x65,
+	0x49, 0x64, 0x12, 0x2d, 0x0a, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0f, 0x2e, 0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x44, 0x69, 0x72,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1b, 0x0a,
+	0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70, 0x12, 0x17, 0x0a, 0x07, 0x64, 0x65,
+	0x73, 0x74, 0x5f, 0x69, 0x70, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x64, 0x65, 0x73,
+	0x74, 0x49, 0x70, 0x12, 0x2d, 0x0a, 0x09, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x69, 0x6e, 0x66, 0x6f,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x50, 0x6f,
+	0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e,
+	0x66, 0x6f, 0x12, 0x2d, 0x0a, 0x09, 0x69, 0x63, 0x6d, 0x70, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x49, 0x43, 0x4d,
+	0x50, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x08, 0x69, 0x63, 0x6d, 0x70, 0x49, 0x6e, 0x66,
+	0x6f, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x78, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x72, 0x78, 0x50, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73,
+	0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x78, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x18, 0x0b,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x78, 0x50, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x12,
+	0x19, 0x0a, 0x08, 0x72, 0x78, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x07, 0x72, 0x78, 0x42, 0x79, 0x74, 0x65, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x74, 0x78,
+	0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x74, 0x78,
+	0x42, 0x79, 0x74, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x10, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x49, 0x64, 0x12, 0x28, 0x0a, 0x10, 0x64, 0x65, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x64,
+	0x65, 0x73, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x22, 0x0a,
+	0x0d, 0x6e, 0x75, 0x6d, 0x5f, 0x6f, 0x66, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x18, 0x10,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x0b, 0x6e, 0x75, 0x6d, 0x4f, 0x66, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x73, 0x12, 0x1e, 0x0a, 0x0b, 0x6e, 0x75, 0x6d, 0x5f, 0x6f, 0x66, 0x5f, 0x65, 0x6e, 0x64, 0x73,
+	0x18, 0x11, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6e, 0x75, 0x6d, 0x4f, 0x66, 0x45, 0x6e, 0x64,
+	0x73, 0x12, 0x20, 0x0a, 0x0c, 0x6e, 0x75, 0x6d, 0x5f, 0x6f, 0x66, 0x5f, 0x64, 0x72, 0x6f, 0x70,
+	0x73, 0x18, 0x12, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x6e, 0x75, 0x6d, 0x4f, 0x66, 0x44, 0x72,
+	0x6f, 0x70, 0x73, 0x42, 0x11, 0x0a, 0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
 	0x6e, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x22, 0x48, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e,
 	0x66, 0x6f, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x72,
 	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50,
@@ -683,17 +736,19 @@ var file_flow_proto_goTypes = []interface{}{
 var file_flow_proto_depIdxs = []int32{
 	7, // 0: flow.FlowEvent.timestamp:type_name -> google.protobuf.Timestamp
 	4, // 1: flow.FlowEvent.flow_fields:type_name -> flow.FlowFields
-	0, // 2: flow.FlowFields.type:type_name -> flow.Type
-	1, // 3: flow.FlowFields.direction:type_name -> flow.Direction
-	5, // 4: flow.FlowFields.port_info:type_name -> flow.PortInfo
-	6, // 5: flow.FlowFields.icmp_info:type_name -> flow.ICMPInfo
-	2, // 6: flow.FlowService.Events:input_type -> flow.FlowEvent
-	3, // 7: flow.FlowService.Events:output_type -> flow.FlowEventAck
-	7, // [7:8] is the sub-list for method output_type
-	6, // [6:7] is the sub-list for method input_type
-	6, // [6:6] is the sub-list for extension type_name
-	6, // [6:6] is the sub-list for extension extendee
-	0, // [0:6] is the sub-list for field type_name
+	7, // 2: flow.FlowEvent.window_start:type_name -> google.protobuf.Timestamp
+	7, // 3: flow.FlowEvent.window_end:type_name -> google.protobuf.Timestamp
+	0, // 4: flow.FlowFields.type:type_name -> flow.Type
+	1, // 5: flow.FlowFields.direction:type_name -> flow.Direction
+	5, // 6: flow.FlowFields.port_info:type_name -> flow.PortInfo
+	6, // 7: flow.FlowFields.icmp_info:type_name -> flow.ICMPInfo
+	2, // 8: flow.FlowService.Events:input_type -> flow.FlowEvent
+	3, // 9: flow.FlowService.Events:output_type -> flow.FlowEventAck
+	9, // [9:10] is the sub-list for method output_type
+	8, // [8:9] is the sub-list for method input_type
+	8, // [8:8] is the sub-list for extension type_name
+	8, // [8:8] is the sub-list for extension extendee
+	0, // [0:8] is the sub-list for field type_name
 }
 
 func init() { file_flow_proto_init() }
diff --git a/flow/proto/flow.proto b/flow/proto/flow.proto
index ff5c50282..1c9e728d2 100644
--- a/flow/proto/flow.proto
+++ b/flow/proto/flow.proto
@@ -24,6 +24,9 @@ message FlowEvent {
   FlowFields flow_fields = 4;
 
   bool isInitiator = 5;
+
+  google.protobuf.Timestamp window_start = 6;
+  google.protobuf.Timestamp window_end = 7;
 }
 
 message FlowEventAck {
@@ -75,6 +78,9 @@ message FlowFields {
   bytes source_resource_id = 14;
   bytes dest_resource_id = 15;
 
+  uint64 num_of_starts = 16;
+  uint64 num_of_ends = 17;
+  uint64 num_of_drops = 18;
 }
 
 // Flow event types
diff --git a/flow/proto/flow_grpc.pb.go b/flow/proto/flow_grpc.pb.go
index b790f86a2..9ae9702a5 100644
--- a/flow/proto/flow_grpc.pb.go
+++ b/flow/proto/flow_grpc.pb.go
@@ -1,4 +1,8 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v3.21.9
+// source: flow.proto
 
 package proto
 
@@ -11,15 +15,19 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	FlowService_Events_FullMethodName = "/flow.FlowService/Events"
+)
 
 // FlowServiceClient is the client API for FlowService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type FlowServiceClient interface {
 	// Client to receiver streams of events and acknowledgements
-	Events(ctx context.Context, opts ...grpc.CallOption) (FlowService_EventsClient, error)
+	Events(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[FlowEvent, FlowEventAck], error)
 }
 
 type flowServiceClient struct {
@@ -30,54 +38,40 @@ func NewFlowServiceClient(cc grpc.ClientConnInterface) FlowServiceClient {
 	return &flowServiceClient{cc}
 }
 
-func (c *flowServiceClient) Events(ctx context.Context, opts ...grpc.CallOption) (FlowService_EventsClient, error) {
-	stream, err := c.cc.NewStream(ctx, &FlowService_ServiceDesc.Streams[0], "/flow.FlowService/Events", opts...)
+func (c *flowServiceClient) Events(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[FlowEvent, FlowEventAck], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &FlowService_ServiceDesc.Streams[0], FlowService_Events_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &flowServiceEventsClient{stream}
+	x := &grpc.GenericClientStream[FlowEvent, FlowEventAck]{ClientStream: stream}
 	return x, nil
 }
 
-type FlowService_EventsClient interface {
-	Send(*FlowEvent) error
-	Recv() (*FlowEventAck, error)
-	grpc.ClientStream
-}
-
-type flowServiceEventsClient struct {
-	grpc.ClientStream
-}
-
-func (x *flowServiceEventsClient) Send(m *FlowEvent) error {
-	return x.ClientStream.SendMsg(m)
-}
-
-func (x *flowServiceEventsClient) Recv() (*FlowEventAck, error) {
-	m := new(FlowEventAck)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type FlowService_EventsClient = grpc.BidiStreamingClient[FlowEvent, FlowEventAck]
 
 // FlowServiceServer is the server API for FlowService service.
 // All implementations must embed UnimplementedFlowServiceServer
-// for forward compatibility
+// for forward compatibility.
 type FlowServiceServer interface {
 	// Client to receiver streams of events and acknowledgements
-	Events(FlowService_EventsServer) error
+	Events(grpc.BidiStreamingServer[FlowEvent, FlowEventAck]) error
 	mustEmbedUnimplementedFlowServiceServer()
 }
 
-// UnimplementedFlowServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedFlowServiceServer struct {
-}
+// UnimplementedFlowServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedFlowServiceServer struct{}
 
-func (UnimplementedFlowServiceServer) Events(FlowService_EventsServer) error {
-	return status.Errorf(codes.Unimplemented, "method Events not implemented")
+func (UnimplementedFlowServiceServer) Events(grpc.BidiStreamingServer[FlowEvent, FlowEventAck]) error {
+	return status.Error(codes.Unimplemented, "method Events not implemented")
 }
 func (UnimplementedFlowServiceServer) mustEmbedUnimplementedFlowServiceServer() {}
+func (UnimplementedFlowServiceServer) testEmbeddedByValue()                     {}
 
 // UnsafeFlowServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to FlowServiceServer will
@@ -87,34 +81,22 @@ type UnsafeFlowServiceServer interface {
 }
 
 func RegisterFlowServiceServer(s grpc.ServiceRegistrar, srv FlowServiceServer) {
+	// If the following call panics, it indicates UnimplementedFlowServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&FlowService_ServiceDesc, srv)
 }
 
 func _FlowService_Events_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(FlowServiceServer).Events(&flowServiceEventsServer{stream})
+	return srv.(FlowServiceServer).Events(&grpc.GenericServerStream[FlowEvent, FlowEventAck]{ServerStream: stream})
 }
 
-type FlowService_EventsServer interface {
-	Send(*FlowEventAck) error
-	Recv() (*FlowEvent, error)
-	grpc.ServerStream
-}
-
-type flowServiceEventsServer struct {
-	grpc.ServerStream
-}
-
-func (x *flowServiceEventsServer) Send(m *FlowEventAck) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-func (x *flowServiceEventsServer) Recv() (*FlowEvent, error) {
-	m := new(FlowEvent)
-	if err := x.ServerStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type FlowService_EventsServer = grpc.BidiStreamingServer[FlowEvent, FlowEventAck]
 
 // FlowService_ServiceDesc is the grpc.ServiceDesc for FlowService service.
 // It's only intended for direct use with grpc.RegisterService,
diff --git a/flow/proto/generate.sh b/flow/proto/generate.sh
index 6bbf78e61..a031245fd 100755
--- a/flow/proto/generate.sh
+++ b/flow/proto/generate.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 if ! which realpath > /dev/null 2>&1
diff --git a/funding.json b/funding.json
index 6b509a992..34ee9fe46 100644
--- a/funding.json
+++ b/funding.json
@@ -6,7 +6,7 @@
     "name": "NetBird GmbH",
     "email": "hello@netbird.io",
     "phone": "",
-    "description": "NetBird GmbH is a Berlin-based software company specializing in the development of open-source network security solutions. Network security is utterly complex and expensive, accessible only to companies with multi-million dollar IT budgets. In contrast, there are millions of companies left behind. Our mission is to create an advanced network and cybersecurity platform that is both easy-to-use and affordable for teams of all sizes and budgets. By leveraging the open-source strategy and technological advancements, NetBird aims to set the industry standard for connecting and securing IT infrastructure.",
+    "description": "NetBird GmbH is a Berlin-based software company specializing in the development of open source network security solutions. Network security is utterly complex and expensive, accessible only to companies with multi-million dollar IT budgets. In contrast, there are millions of companies left behind. Our mission is to create an advanced network and cybersecurity platform that is both easy-to-use and affordable for teams of all sizes and budgets. By leveraging the open source strategy and technological advancements, NetBird aims to set the industry standard for connecting and securing IT infrastructure.",
     "webpageUrl": {
       "url": "https://github.com/netbirdio"
     }
@@ -15,7 +15,7 @@
     {
       "guid": "netbird",
       "name": "NetBird",
-      "description": "NetBird is a configuration-free peer-to-peer private network and a centralized access control system combined in a single open-source platform. It makes it easy to create secure WireGuard-based private networks for your organization or home.",
+      "description": "NetBird is a configuration-free peer-to-peer private network and a centralized access control system combined in a single open source platform. It makes it easy to create secure WireGuard-based private networks for your organization or home.",
       "webpageUrl": {
         "url": "https://github.com/netbirdio/netbird"
       },
@@ -59,7 +59,7 @@
         "guid": "support-yearly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - Yearly",
-        "description": "This will help us partially cover the yearly cost of maintaining the open-source NetBird project.",
+        "description": "This will help us partially cover the yearly cost of maintaining the open source NetBird project.",
         "amount": 100000,
         "currency": "USD",
         "frequency": "yearly",
@@ -72,7 +72,7 @@
         "guid": "support-one-time-year",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - One Year",
-        "description": "This will help us partially cover the yearly cost of maintaining the open-source NetBird project.",
+        "description": "This will help us partially cover the yearly cost of maintaining the open source NetBird project.",
         "amount": 100000,
         "currency": "USD",
         "frequency": "one-time",
@@ -85,7 +85,7 @@
         "guid": "support-one-time-monthly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - Monthly",
-        "description": "This will help us partially cover the monthly cost of maintaining the open-source NetBird project.",
+        "description": "This will help us partially cover the monthly cost of maintaining the open source NetBird project.",
         "amount": 10000,
         "currency": "USD",
         "frequency": "monthly",
@@ -98,7 +98,7 @@
         "guid": "support-monthly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - One Month",
-        "description": "This will help us partially cover the monthly cost of maintaining the open-source NetBird project.",
+        "description": "This will help us partially cover the monthly cost of maintaining the open source NetBird project.",
         "amount": 10000,
         "currency": "USD",
         "frequency": "monthly",
diff --git a/go.mod b/go.mod
index e1c762607..bc8e5e287 100644
--- a/go.mod
+++ b/go.mod
@@ -1,26 +1,28 @@
 module github.com/netbirdio/netbird
 
-go 1.25.5
+go 1.26.0
 
-toolchain go1.25.11
+// Pin the toolchain to a patch release >= go1.26.2
+// See https://go.dev/issue/77875.
+toolchain go1.26.7
 
 require (
 	cunicu.li/go-rosenpass v0.5.42
 	github.com/cenkalti/backoff/v4 v4.3.0
-	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/golang/protobuf v1.5.4
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/kardianos/service v1.2.3-0.20240613133416-becf2eb62b83
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/gomega v1.27.6
+	github.com/onsi/gomega v1.34.1
 	github.com/rs/cors v1.8.0
 	github.com/sirupsen/logrus v1.9.4
 	github.com/spf13/cobra v1.10.2
-	github.com/spf13/pflag v1.0.9
+	github.com/spf13/pflag v1.0.10
 	github.com/vishvananda/netlink v1.3.1
-	golang.org/x/crypto v0.50.0
-	golang.org/x/sys v0.43.0
+	golang.org/x/crypto v0.55.0
+	golang.org/x/sys v0.47.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	golang.zx2c4.com/wireguard/windows v0.5.3
@@ -29,10 +31,8 @@ require (
 )
 
 require (
-	fyne.io/fyne/v2 v2.7.0
-	fyne.io/systray v1.12.1-0.20260116214250-81f8e1a496f9
-	git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3
 	github.com/DeRuina/timberjack v1.4.2
+	github.com/Microsoft/go-winio v0.6.2
 	github.com/awnumar/memguard v0.23.0
 	github.com/aws/aws-sdk-go-v2 v1.38.3
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1
@@ -40,8 +40,8 @@ require (
 	github.com/aws/aws-sdk-go-v2/credentials v1.18.10
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3
 	github.com/c-robinson/iplib v1.0.3
+	github.com/caarlos0/env/v11 v11.4.1
 	github.com/caddyserver/certmagic v0.21.3
-	github.com/cilium/ebpf v0.19.0
 	github.com/coder/websocket v1.8.14
 	github.com/coreos/go-iptables v0.7.0
 	github.com/coreos/go-oidc/v3 v3.18.0
@@ -52,37 +52,41 @@ require (
 	github.com/dexidp/dex/api/v2 v2.4.0
 	github.com/docker/docker v28.0.1+incompatible
 	github.com/docker/go-connections v0.6.0
-	github.com/ebitengine/purego v0.8.4
+	github.com/ebitengine/purego v0.9.1
 	github.com/eko/gocache/lib/v4 v4.2.0
 	github.com/eko/gocache/store/go_cache/v4 v4.2.2
 	github.com/eko/gocache/store/redis/v4 v4.2.2
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/go-jose/go-jose/v4 v4.1.4
+	github.com/go-ole/go-ole v1.3.0
 	github.com/gobwas/ws v1.4.0
-	github.com/goccy/go-yaml v1.18.0
-	github.com/godbus/dbus/v5 v5.1.0
+	github.com/goccy/go-yaml v1.19.2
+	github.com/godbus/dbus/v5 v5.2.2
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/golang/mock v1.6.0
 	github.com/google/go-cmp v0.7.0
+	github.com/google/go-tpm v0.9.8
 	github.com/google/gopacket v1.1.19
 	github.com/google/nftables v0.3.0
 	github.com/gopacket/gopacket v1.4.0
+	github.com/grafana/pyroscope-go v1.4.2
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.2-0.20240212192251-757544f21357
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2
 	github.com/hashicorp/go-version v1.7.0
-	github.com/jackc/pgx/v5 v5.5.5
+	github.com/jackc/pgx/v5 v5.10.0
 	github.com/libdns/route53 v1.5.0
-	github.com/libp2p/go-nat v0.2.0
 	github.com/libp2p/go-netroute v0.4.0
 	github.com/lrh3321/ipset-go v0.0.0-20250619021614-54a0a98ace81
+	github.com/magefile/mage v1.17.2
 	github.com/mdlayher/socket v0.5.1
 	github.com/mdp/qrterminal/v3 v3.2.1
 	github.com/miekg/dns v1.1.72
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/moby/moby/api v1.54.1
-	github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42
+	github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8
+	github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45
 	github.com/oapi-codegen/runtime v1.1.2
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
@@ -100,13 +104,14 @@ require (
 	github.com/pires/go-proxyproto v0.11.0
 	github.com/pkg/sftp v1.13.9
 	github.com/prometheus/client_golang v1.23.2
-	github.com/quic-go/quic-go v0.55.0
+	github.com/prometheus/client_model v0.6.2
+	github.com/quic-go/quic-go v0.64.0
 	github.com/redis/go-redis/v9 v9.7.3
 	github.com/rs/xid v1.3.0
-	github.com/shirou/gopsutil/v3 v3.24.4
+	github.com/shirou/gopsutil/v4 v4.25.8
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.12.1
 	github.com/testcontainers/testcontainers-go v0.37.0
 	github.com/testcontainers/testcontainers-go/modules/mysql v0.37.0
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.37.0
@@ -115,6 +120,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
+	github.com/wailsapp/wails/v3 v3.0.0-beta.3
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
@@ -125,38 +131,41 @@ require (
 	go.uber.org/mock v0.6.0
 	go.uber.org/zap v1.27.0
 	goauthentik.io/api/v3 v3.2023051.3
-	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
-	golang.org/x/mobile v0.0.0-20251113184115-a159579294ab
-	golang.org/x/mod v0.34.0
-	golang.org/x/net v0.53.0
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
+	golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733
+	golang.org/x/mod v0.39.0
+	golang.org/x/net v0.58.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.20.0
-	golang.org/x/term v0.42.0
+	golang.org/x/sync v0.23.0
+	golang.org/x/term v0.45.0
 	golang.org/x/time v0.15.0
 	google.golang.org/api v0.276.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/mysql v1.5.7
 	gorm.io/driver/postgres v1.5.7
 	gorm.io/driver/sqlite v1.5.7
 	gorm.io/gorm v1.25.12
 	gvisor.dev/gvisor v0.0.0-20260219192049-0f2374377e89
-	howett.net/plist v1.0.1
+	howett.net/plist v1.0.2-0.20250314012144-ee69052608d9
 )
 
 require (
 	cloud.google.com/go/auth v0.20.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	dario.cat/mergo v1.0.1 // indirect
+	dario.cat/mergo v1.0.2 // indirect
 	filippo.io/edwards25519 v1.1.1 // indirect
+	git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3 // indirect
 	github.com/AppsFlyer/go-sundheit v0.6.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Azure/go-ntlmssp v0.1.0 // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.3.0 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/ProtonMail/go-crypto v1.3.0 // indirect
+	github.com/adrg/xdg v0.5.3 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
@@ -175,48 +184,49 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 // indirect
 	github.com/aws/smithy-go v1.23.0 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
+	github.com/basgys/goxml2json v1.1.1-0.20231018121955-e66ee54ceaad // indirect
 	github.com/beevik/etree v1.6.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
+	github.com/buger/jsonparser v1.1.2 // indirect
 	github.com/caddyserver/zerossl v0.1.3 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cilium/ebpf v0.19.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/crowdsecurity/go-cs-lib v0.0.25 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
+	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fredbi/uri v1.1.1 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
-	github.com/fyne-io/gl-js v0.2.0 // indirect
-	github.com/fyne-io/glfw-js v0.3.0 // indirect
-	github.com/fyne-io/image v0.1.1 // indirect
-	github.com/fyne-io/oksvg v0.2.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
-	github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71 // indirect
-	github.com/go-gl/glfw/v3.3/glfw v0.0.0-20240506104042-037f3cc74f2a // indirect
+	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+	github.com/go-git/go-billy/v5 v5.9.0 // indirect
+	github.com/go-git/go-git/v5 v5.19.2 // indirect
 	github.com/go-ldap/ldap/v3 v3.4.13 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-openapi/analysis v0.23.0 // indirect
 	github.com/go-openapi/errors v0.22.2 // indirect
-	github.com/go-openapi/jsonpointer v0.21.1 // indirect
+	github.com/go-openapi/jsonpointer v0.23.2 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/loads v0.22.0 // indirect
 	github.com/go-openapi/spec v0.21.0 // indirect
 	github.com/go-openapi/strfmt v0.23.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-openapi/swag/jsonname v0.26.1 // indirect
 	github.com/go-openapi/validate v0.24.0 // indirect
 	github.com/go-sql-driver/mysql v1.9.3 // indirect
-	github.com/go-text/render v0.2.0 // indirect
-	github.com/go-text/typesetting v0.2.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/go-webauthn/webauthn v0.16.4 // indirect
 	github.com/go-webauthn/x v0.2.3 // indirect
@@ -224,15 +234,17 @@ require (
 	github.com/gobwas/pool v0.2.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/mock v1.6.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/go-tpm v0.9.8 // indirect
+	github.com/google/go-tpm-tools v0.4.9 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
 	github.com/googleapis/gax-go/v2 v2.21.0 // indirect
+	github.com/goreleaser/chglog v0.7.4 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
-	github.com/hack-pad/go-indexeddb v0.3.2 // indirect
-	github.com/hack-pad/safejs v0.1.0 // indirect
+	github.com/grafana/pyroscope-go/godeltaprof v0.1.11 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
@@ -245,27 +257,30 @@ require (
 	github.com/huin/goupnp v1.2.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
-	github.com/jackc/puddle/v2 v2.2.1 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
-	github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade // indirect
+	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 // indirect
 	github.com/kelseyhightower/envconfig v1.4.0 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/kevinburke/ssh_config v1.4.0 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/kr/fs v0.1.0 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lib/pq v1.12.3 // indirect
 	github.com/libdns/libdns v0.2.2 // indirect
 	github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-sqlite3 v1.14.42 // indirect
 	github.com/mdelapenya/tlscert v0.2.0 // indirect
 	github.com/mdlayher/genetlink v1.3.2 // indirect
@@ -283,38 +298,44 @@ require (
 	github.com/moby/term v0.5.2 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect
-	github.com/nicksnyder/go-i18n/v2 v2.5.1 // indirect
 	github.com/nxadm/tail v1.4.11 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
-	github.com/onsi/ginkgo/v2 v2.9.5 // indirect
 	github.com/openbao/openbao/api/v2 v2.5.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pb33f/go-yaml v0.1.1 // indirect
+	github.com/pb33f/jsonpath v0.8.4 // indirect
+	github.com/pb33f/libopenapi v0.41.2
+	github.com/pb33f/libopenapi-validator v0.15.0
+	github.com/pb33f/ordered-map/v2 v2.3.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pion/dtls/v2 v2.2.10 // indirect
 	github.com/pion/dtls/v3 v3.0.9 // indirect
 	github.com/pion/mdns/v2 v2.0.7 // indirect
 	github.com/pion/transport/v2 v2.2.4 // indirect
 	github.com/pion/turn/v4 v4.1.1 // indirect
+	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/pquerna/otp v1.5.0 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/rogpeppe/go-internal v1.16.0 // indirect
 	github.com/russellhaering/goxmldsig v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	github.com/rymdport/portal v0.4.2 // indirect
-	github.com/shirou/gopsutil/v4 v4.25.8 // indirect
-	github.com/shoenig/go-m1cpu v0.2.1 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/spf13/cast v1.7.0 // indirect
-	github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c // indirect
-	github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/skeema/knownhosts v1.3.2 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/viper v1.21.0 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/tinylib/msgp v1.6.3 // indirect
 	github.com/tklauser/go-sysconf v0.3.15 // indirect
 	github.com/tklauser/numcpus v0.10.0 // indirect
@@ -322,8 +343,9 @@ require (
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/yuin/goldmark v1.7.8 // indirect
+	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect
+	gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
 	go.mongodb.org/mongo-driver v1.17.9 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
@@ -331,13 +353,14 @@ require (
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/image v0.33.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
+	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	rsc.io/qr v0.2.0 // indirect
 )
@@ -346,14 +369,21 @@ replace github.com/kardianos/service => github.com/netbirdio/service v0.0.0-2024
 
 replace github.com/getlantern/systray => github.com/netbirdio/systray v0.0.0-20231030152038-ef1ed2a27949
 
-replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a
+replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20261016113635-bd0cb75a3df0
 
 replace github.com/cloudflare/circl => codeberg.org/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6
 
 replace github.com/pion/ice/v4 => github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51
 
-replace github.com/dexidp/dex => github.com/netbirdio/dex v0.244.1-0.20260512110716-8d70ad8647c1
+replace github.com/dexidp/dex => github.com/netbirdio/dex v0.244.1-0.20260716205454-a163de3129e5
 
 replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
+
+replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20261009120932-4e087a8bfd6d
+
+tool (
+	github.com/goreleaser/chglog/cmd/chglog
+	go.uber.org/mock/mockgen
+)
diff --git a/go.sum b/go.sum
index 7b29b7604..9af59daf5 100644
--- a/go.sum
+++ b/go.sum
@@ -9,14 +9,10 @@ codeberg.org/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6 h1:b8xUw3004wk+3ipB
 codeberg.org/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6/go.mod h1:+CauBF6R70Jqcyl8N2hC8pAXYbWkGIezuSbuGLtRhnw=
 cunicu.li/go-rosenpass v0.5.42 h1:fRDsGwCxd7DhDgZI1Pxeo8GtNyq8BESZJ7w2/BGGJtU=
 cunicu.li/go-rosenpass v0.5.42/go.mod h1:YRBeyKOe/gWpSX2kpDUec5p9t0XOLsshTguId5gTGVg=
-dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
-dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 filippo.io/edwards25519 v1.1.1 h1:YpjwWWlNmGIDyXOn8zLzqiD+9TyIlPhGFG96P39uBpw=
 filippo.io/edwards25519 v1.1.1/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-fyne.io/fyne/v2 v2.7.0 h1:GvZSpE3X0liU/fqstInVvRsaboIVpIWQ4/sfjDGIGGQ=
-fyne.io/fyne/v2 v2.7.0/go.mod h1:xClVlrhxl7D+LT+BWYmcrW4Nf+dJTvkhnPgji7spAwE=
-fyne.io/systray v1.12.1-0.20260116214250-81f8e1a496f9 h1:829+77I4TaMrcg9B3wf+gHhdSgoCVEgH2czlPXPbfj4=
-fyne.io/systray v1.12.1-0.20260116214250-81f8e1a496f9/go.mod h1:RVwqP9nYMo7h5zViCBHri2FgjXF7H2cub7MAq4NSoLs=
 git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3 h1:N3IGoHHp9pb6mj1cbXbuaSXV/UMKwmbKLf53nQmtqMA=
 git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3/go.mod h1:QtOLZGz8olr4qH2vWK0QH0w0O4T9fEIjMuWpKUsH7nc=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
@@ -27,25 +23,32 @@ github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEK
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
 github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
-github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
-github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/DeRuina/timberjack v1.4.2 h1:4bKlzhKdsR+2oNkgef9mqb4n11ICow8VK88RfzJPzN8=
 github.com/DeRuina/timberjack v1.4.2/go.mod h1:RLoeQrwrCGIEF8gO5nV5b/gMD0QIy7bzQhBUgpp1EqE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
-github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
+github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
+github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
 github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
+github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
+github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP2+08jFMw88y4klk=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/awnumar/memcall v0.4.0 h1:B7hgZYdfH6Ot1Goaz8jGne/7i8xD4taZie/PNSFZ29g=
@@ -90,10 +93,16 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 h1:YZPjhyaGzhDQEvsffDEcpycq49nl
 github.com/aws/aws-sdk-go-v2/service/sts v1.38.2/go.mod h1:2dIN8qhQfv37BdUYGgEC8Q3tteM3zFxTI1MLO2O3J3c=
 github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE=
 github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
+github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
+github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
+github.com/basgys/goxml2json v1.1.1-0.20231018121955-e66ee54ceaad h1:3swAvbzgfaI6nKuDDU7BiKfZRdF+h2ZwKgMHd8Ha4t8=
+github.com/basgys/goxml2json v1.1.1-0.20231018121955-e66ee54ceaad/go.mod h1:9+nBLYNWkvPcq9ep0owWUsPTLgL9ZXTsZWcCSVGGLJ0=
 github.com/beevik/etree v1.6.0 h1:u8Kwy8pp9D9XeITj2Z0XtA5qqZEmtJtuXZRQi+j03eE=
 github.com/beevik/etree v1.6.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bitly/go-simplejson v0.5.1 h1:xgwPbetQScXt1gh9BmoJ6j9JMr3TElvuIyjR8pgdoow=
+github.com/bitly/go-simplejson v0.5.1/go.mod h1:YOPVLzCfwK14b4Sff3oP1AmGhI9T9Vsg84etUnlyp+Q=
 github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
@@ -101,8 +110,12 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
 github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/buger/jsonparser v1.1.2 h1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=
+github.com/buger/jsonparser v1.1.2/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/c-robinson/iplib v1.0.3 h1:NG0UF0GoEsrC1/vyfX1Lx2Ss7CySWl3KqqXh3q4DdPU=
 github.com/c-robinson/iplib v1.0.3/go.mod h1:i3LuuFL1hRT5gFpBRnEydzw8R6yhGkF4szNDIbF8pgo=
+github.com/caarlos0/env/v11 v11.4.1 h1:fYwH0sWEsBSMPG7t4e/PEfTFzrWrpjyygXyUnWiSwEw=
+github.com/caarlos0/env/v11 v11.4.1/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U=
 github.com/caddyserver/certmagic v0.21.3 h1:pqRRry3yuB4CWBVq9+cUqu+Y6E2z8TswbhNx1AZeYm0=
 github.com/caddyserver/certmagic v0.21.3/go.mod h1:Zq6pklO9nVRl3DIFUw9gVUfXKdpc/0qwTUAQMBlfgtI=
 github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
@@ -140,6 +153,8 @@ github.com/crowdsecurity/go-cs-bouncer v0.0.21 h1:arPz0VtdVSaz+auOSfHythzkZVLyy1
 github.com/crowdsecurity/go-cs-bouncer v0.0.21/go.mod h1:4JiH0XXA4KKnnWThItUpe5+heJHWzsLOSA2IWJqUDBA=
 github.com/crowdsecurity/go-cs-lib v0.0.25 h1:Ov6VPW9yV+OPsbAIQk1iTkEWhwkpaG0v3lrBzeqjzj4=
 github.com/crowdsecurity/go-cs-lib v0.0.25/go.mod h1:X0GMJY2CxdA1S09SpuqIKaWQsvRGxXmecUp9cP599dE=
+github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
+github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -148,32 +163,34 @@ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/r
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
 github.com/docker/docker v28.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
 github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
-github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
+github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/eko/gocache/lib/v4 v4.2.0 h1:MNykyi5Xw+5Wu3+PUrvtOCaKSZM1nUSVftbzmeC7Yuw=
 github.com/eko/gocache/lib/v4 v4.2.0/go.mod h1:7ViVmbU+CzDHzRpmB4SXKyyzyuJ8A3UW3/cszpcqB4M=
 github.com/eko/gocache/store/go_cache/v4 v4.2.2 h1:tAI9nl6TLoJyKG1ujF0CS0n/IgTEMl+NivxtR5R3/hw=
 github.com/eko/gocache/store/go_cache/v4 v4.2.2/go.mod h1:T9zkHokzr8K9EiC7RfMbDg6HSwaV6rv3UdcNu13SGcA=
 github.com/eko/gocache/store/redis/v4 v4.2.2 h1:Thw31fzGuH3WzJywsdbMivOmP550D6JS7GDHhvCJPA0=
 github.com/eko/gocache/store/redis/v4 v4.2.2/go.mod h1:LaTxLKx9TG/YUEybQvPMij++D7PBTIJ4+pzvk0ykz0w=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
-github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
+github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
+github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
+github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fredbi/uri v1.1.1 h1:xZHJC08GZNIUhbP5ImTHnt5Ya0T8FI2VAwI/37kh2Ko=
-github.com/fredbi/uri v1.1.1/go.mod h1:4+DZQ5zBjEwQCDmXW5JdIjz0PUA+yJbvtBv+u+adr5o=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
@@ -181,26 +198,24 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
 github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/fyne-io/gl-js v0.2.0 h1:+EXMLVEa18EfkXBVKhifYB6OGs3HwKO3lUElA0LlAjs=
-github.com/fyne-io/gl-js v0.2.0/go.mod h1:ZcepK8vmOYLu96JoxbCKJy2ybr+g1pTnaBDdl7c3ajI=
-github.com/fyne-io/glfw-js v0.3.0 h1:d8k2+Y7l+zy2pc7wlGRyPfTgZoqDf3AI4G+2zOWhWUk=
-github.com/fyne-io/glfw-js v0.3.0/go.mod h1:Ri6te7rdZtBgBpxLW19uBpp3Dl6K9K/bRaYdJ22G8Jk=
-github.com/fyne-io/image v0.1.1 h1:WH0z4H7qfvNUw5l4p3bC1q70sa5+YWVt6HCj7y4VNyA=
-github.com/fyne-io/image v0.1.1/go.mod h1:xrfYBh6yspc+KjkgdZU/ifUC9sPA5Iv7WYUBzQKK7JM=
-github.com/fyne-io/oksvg v0.2.0 h1:mxcGU2dx6nwjJsSA9PCYZDuoAcsZ/OuJlvg/Q9Njfo8=
-github.com/fyne-io/oksvg v0.2.0/go.mod h1:dJ9oEkPiWhnTFNCmRgEze+YNprJF7YRbpjgpWS4kzoI=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.5.0/go.mod h1:Nd6IXA8m5kNZdNEHMBd93KT+mdY3+bewLgRvmCsR2Do=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71 h1:5BVwOaUSBTlVZowGO6VZGw2H/zl9nrd3eCZfYV+NfQA=
-github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71/go.mod h1:9YTyiznxEY1fVinfM7RvRcjRHbw2xLBJ3AAGIT0I4Nw=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20240506104042-037f3cc74f2a h1:vxnBhFDDT+xzxf1jTJKMKZw3H0swfWk9RpWbBbDK5+0=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20240506104042-037f3cc74f2a/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
+github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
+github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
+github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
+github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e h1:Lf/gRkoycfOBPa42vU2bbgPurFong6zXeFtPoxholzU=
+github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e/go.mod h1:uNVvRXArCGbZ508SxYYTC5v1JWoz2voff5pm25jU1Ok=
 github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
 github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -215,8 +230,8 @@ github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC0
 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
 github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
 github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
-github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic=
-github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
+github.com/go-openapi/jsonpointer v0.23.2 h1:DK7R/3zAt4xTytxNkw7jARGPFI7rkaSsii58n8X45x0=
+github.com/go-openapi/jsonpointer v0.23.2/go.mod h1:noUOckXtq7b4bVkqw0sbHKieq9uEZRN7p6EF/dalc4w=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/loads v0.22.0 h1:ECPGd4jX1U6NApCGG1We+uEozOAvXvJSF4nnwHZ8Aco=
@@ -227,6 +242,10 @@ github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMg
 github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
 github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
 github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
+github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE=
+github.com/go-openapi/swag/jsonname v0.26.1/go.mod h1:OvdW6BoWoj33pTfi7x9vFrgmT+fk7aw0BRwvCE0YOuc=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
 github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
 github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
 github.com/go-playground/locales v0.12.1/go.mod h1:IUMDtCfWo/w/mtMfIE/IG2K+Ey3ygWanZIBtBW0W2TM=
@@ -236,17 +255,12 @@ github.com/go-quicktest/qt v1.101.1-0.20240301121107-c6c8733fa1e6/go.mod h1:p4lG
 github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
 github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
 github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/go-text/render v0.2.0 h1:LBYoTmp5jYiJ4NPqDc2pz17MLmA3wHw1dZSVGcOdeAc=
-github.com/go-text/render v0.2.0/go.mod h1:CkiqfukRGKJA5vZZISkjSYrcdtgKQWRa2HIzvwNN5SU=
-github.com/go-text/typesetting v0.2.1 h1:x0jMOGyO3d1qFAPI0j4GSsh7M0Q3Ypjzr4+CEVg82V8=
-github.com/go-text/typesetting v0.2.1/go.mod h1:mTOxEwasOFpAMBjEQDhdWRckoLLeI/+qrQeBCTGEt6M=
-github.com/go-text/typesetting-utils v0.0.0-20241103174707-87a29e9e6066 h1:qCuYC+94v2xrb1PoS4NIDe7DGYtLnU2wWiQe9a1B1c0=
-github.com/go-text/typesetting-utils v0.0.0-20241103174707-87a29e9e6066/go.mod h1:DDxDdQEnB70R8owOx3LVpEFvpMK9eeH1o2r0yZhFI9o=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-webauthn/webauthn v0.16.4 h1:R9jqR/cYZa7hRquFF7Za/8qoH/K/TIs1/Q/4CyGN+1Q=
@@ -259,16 +273,18 @@ github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
 github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
-github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
-github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
-github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -292,9 +308,7 @@ github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
@@ -302,15 +316,15 @@ github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
 github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
-github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
-github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
+github.com/google/go-tpm-tools v0.4.9 h1:jZEhnE4WRFbomSssBH2gWaIViIHU1gjH1jz76+xC9bI=
+github.com/google/go-tpm-tools v0.4.9/go.mod h1:Omb8zosA8qY9URn1gsrO2i4b6DFqGp29BqNx18V66c4=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/nftables v0.3.0 h1:bkyZ0cbpVeMHXOrtlFc8ISmfVqq5gPJukoYieyVmITg=
 github.com/google/nftables v0.3.0/go.mod h1:BCp9FsrbF1Fn/Yu6CLUc9GGZFw/+hsxfluNXXmxBfRM=
-github.com/google/pprof v0.0.0-20211214055906-6f57359322fd h1:1FjCyPC+syAzJ5/2S8fqdZK1R22vvA0J7JZKcuOIQ7Y=
-github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
+github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 h1:k7nVchz72niMH6YLQNvHSdIE7iqsQxK1P41mySCvssg=
+github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -321,18 +335,22 @@ github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl
 github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=
 github.com/gopacket/gopacket v1.4.0 h1:cr1OlFpzksCkZHNO0eLjaSSOrMQnpPXg0j6qHIY3y2U=
 github.com/gopacket/gopacket v1.4.0/go.mod h1:EpvsxINeehp5qj4YMKMLf2/dekdhKn2IIAO/ZOifS7o=
+github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
+github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
+github.com/goreleaser/chglog v0.7.4 h1:3pnNt/XCrUcAOq+KC91Azlgp5CRv4GHo1nl8Aws7OzI=
+github.com/goreleaser/chglog v0.7.4/go.mod h1:dTVoZZagTz7hHdWaZ9OshHntKiF44HbWIHWxYJQ/h0Y=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
 github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/grafana/pyroscope-go v1.4.2 h1:0LW5HrUJXgGr9zF5gITP/HaFXN9/LsMiwlgVJAK75l0=
+github.com/grafana/pyroscope-go v1.4.2/go.mod h1:Ej13Jr05rRJrjWvrrFhfh6gGYXtfibuukOs3Tl3Y7QQ=
+github.com/grafana/pyroscope-go/godeltaprof v0.1.11 h1:el5LYpXissAiCKZ5/6yjlr6mhYVV6Cp5lahTocxraXM=
+github.com/grafana/pyroscope-go/godeltaprof v0.1.11/go.mod h1:jl1V8M4cWsXciROCPIDDG7CtjSjT/ECbp6eLVuMxYRI=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.2-0.20240212192251-757544f21357 h1:Fkzd8ktnpOR9h47SXHe2AYPwelXLH2GjGsjlAloiWfo=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.2-0.20240212192251-757544f21357/go.mod h1:w9Y7gY31krpLmrVU5ZPG9H7l9fZuRu5/3R3S3FMtVQ4=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
-github.com/hack-pad/go-indexeddb v0.3.2 h1:DTqeJJYc1usa45Q5r52t01KhvlSN02+Oq+tQbSBI91A=
-github.com/hack-pad/go-indexeddb v0.3.2/go.mod h1:QvfTevpDVlkfomY498LhstjwbPW6QC4VC/lxYb0Kom0=
-github.com/hack-pad/safejs v0.1.0 h1:qPS6vjreAqh2amUqj4WNG1zIw7qlRQJ9K10eDKMCnE8=
-github.com/hack-pad/safejs v0.1.0/go.mod h1:HdS+bKF1NrE72VoXZeWzxFOVQVUSqZJAG0xNCnb+Tio=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -368,14 +386,16 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.5.5 h1:amBjrZVmksIdNjxGW/IiIMzxMKZFelXbUoPNb+8sjQw=
-github.com/jackc/pgx/v5 v5.5.5/go.mod h1:ez9gk+OAat140fv9ErkZDYFWmXLfV+++K0uAOiwgm1A=
-github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
-github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
+github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
 github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
 github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
 github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
@@ -388,8 +408,6 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
-github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade h1:FmusiCI1wHw+XQbvL9M+1r/C3SPqKrmBaIOYwVfQoDE=
-github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade/go.mod h1:ZDXo8KHryOWSIqnsb/CiDq7hQUYryCgdVnxbj8tDG7o=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
@@ -403,21 +421,21 @@ github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbd
 github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/jsimonetti/rtnetlink/v2 v2.0.1 h1:xda7qaHDSVOsADNouv7ukSuicKZO7GgVUCXxpaIEIlM=
-github.com/jsimonetti/rtnetlink/v2 v2.0.1/go.mod h1:7MoNYNbb3UaDHtF8udiJo/RH6VsTKP1pqKLUTVCvToE=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 h1:YLvr1eE6cdCqjOe972w/cYF+FjW34v27+9Vo5106B4M=
-github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25/go.mod h1:kLgvv7o6UM+0QSf0QjAse3wReFDsb9qbZJdfexWlrQw=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE=
 github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
+github.com/kevinburke/ssh_config v1.4.0 h1:6xxtP5bZ2E4NF5tuQulISpTO2z8XbtH8cg1PWkxoFkQ=
+github.com/kevinburke/ssh_config v1.4.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
-github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
-github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
 github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
@@ -438,17 +456,18 @@ github.com/libdns/libdns v0.2.2 h1:O6ws7bAfRPaBsgAYt8MDe2HcNBGC29hkZ9MX2eUSX3s=
 github.com/libdns/libdns v0.2.2/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
 github.com/libdns/route53 v1.5.0 h1:2SKdpPFl/qgWsXQvsLNJJAoX7rSxlk7zgoL4jnWdXVA=
 github.com/libdns/route53 v1.5.0/go.mod h1:joT4hKmaTNKHEwb7GmZ65eoDz1whTu7KKYPS8ZqIh6Q=
-github.com/libp2p/go-nat v0.2.0 h1:Tyz+bUFAYqGyJ/ppPPymMGbIgNRH+WqC5QrT5fKrrGk=
-github.com/libp2p/go-nat v0.2.0/go.mod h1:3MJr+GRpRkyT65EpVPBstXLvOlAPzUVlG6Pwg9ohLJk=
 github.com/libp2p/go-netroute v0.4.0 h1:sZZx9hyANYUx9PZyqcgE/E1GUG3iEtTZHUEvdtXT7/Q=
 github.com/libp2p/go-netroute v0.4.0/go.mod h1:Nkd5ShYgSMS5MUKy/MU2T57xFoOKvvLR92Lic48LEyA=
 github.com/lrh3321/ipset-go v0.0.0-20250619021614-54a0a98ace81 h1:J56rFEfUTFT9j9CiRXhi1r8lUJ4W5idG3CiaBZGojNU=
 github.com/lrh3321/ipset-go v0.0.0-20250619021614-54a0a98ace81/go.mod h1:RD8ML/YdXctQ7qbcizZkw5mZ6l8Ogrl1dodBzVJduwI=
-github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae h1:dIZY4ULFcto4tAFlj1FYZl8ztUZ13bdq+PLY+NOfbyI=
 github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae/go.mod h1:ilwx/Dta8jXAgpFYFvSWEMwxmbWXyiUHkd5FwyKhb5k=
+github.com/magefile/mage v1.17.2 h1:fyXVu1eadI8Ap1HCCNgEhJ5McIWiYhLR8uol64ZZc40=
+github.com/magefile/mage v1.17.2/go.mod h1:Yj51kqllmsgFpvvSzgrZPK9WtluG3kUhFaBUVLo4feA=
 github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
 github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/matryer/is v1.4.1 h1:55ehd8zaGABKLXQUe2awZ99BD/PTc2ls+KV/dXphgEQ=
+github.com/matryer/is v1.4.1/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
@@ -504,26 +523,26 @@ github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/netbirdio/dex v0.244.1-0.20260512110716-8d70ad8647c1 h1:4TaYr9O4xX0D2kszeOLclTiCbA3eHq3xWV+9ILJbIYs=
-github.com/netbirdio/dex v0.244.1-0.20260512110716-8d70ad8647c1/go.mod h1:IHH+H8vK2GfqtIt5u/5OdPh18yk0oDHuj2vz5+Goetg=
+github.com/netbirdio/dex v0.244.1-0.20260716205454-a163de3129e5 h1:3PwQv8aR46qN2u16+Dv6udnH3sbVKX5KrGwF35CKSI0=
+github.com/netbirdio/dex v0.244.1-0.20260716205454-a163de3129e5/go.mod h1:IHH+H8vK2GfqtIt5u/5OdPh18yk0oDHuj2vz5+Goetg=
 github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1 h1:neE7z+FPUkldl3faK/Jt+hJK2L+1XfQ1W33TQhU9m88=
 github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1/go.mod h1:awuTyT29CYALpEyET0S307EgNlPWrc7fFKRAyhsO45M=
 github.com/netbirdio/easyjson v0.9.0 h1:6Nw2lghSVuy8RSkAYDhDv1thBVEmfVbKZnV7T7Z6Aus=
 github.com/netbirdio/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8 h1:pBxXEsxcsO3qVUND//5j1kelYlO57x5IrRviNF0+0iA=
+github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8/go.mod h1:mFViabv4PpnoDw9w7W21a7xux6APA4q7KQZRsv4BCl8=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51 h1:Ov4qdafATOgGMB1wbSuh+0aAHcwz9hdvB6VZjh1mVMI=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51/go.mod h1:ZSIbPdBn5hePO8CpF1PekH2SfpTxg1PDhEwtbqZS7R8=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42 h1:F3zS5fT9xzD1OFLfcdAE+3FfyiwjGukF1hvj0jErgs8=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42/go.mod h1:n47r67ZSPgwSmT/Z1o48JjZQW9YJ6m/6Bd/uAXkL3Pg=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e h1:SnDCreUnY+QDxKPueUoNrniMALCu2VFkXTCr/RIZjdg=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e/go.mod h1:n47r67ZSPgwSmT/Z1o48JjZQW9YJ6m/6Bd/uAXkL3Pg=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9axERMVN63dqyFqnvuD+EMJHzM7mNGON8=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
-github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
-github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=
-github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646/go.mod h1:jpp1/29i3P1S/RLdc7JQKbRpFeM1dOBd8T9ki5s+AY8=
-github.com/nicksnyder/go-i18n/v2 v2.5.1 h1:IxtPxYsR9Gp60cGXjfuR/llTqV8aYMsC472zD0D1vHk=
-github.com/nicksnyder/go-i18n/v2 v2.5.1/go.mod h1:DrhgsSDZxoAfvVrBVLXoxZn/pN5TXqaDbq7ju94viiQ=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20261009120932-4e087a8bfd6d h1:DV0FHFhNAaU69JHXKclYQWr/ZJoc2BA/ZpqlnX8l22U=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20261009120932-4e087a8bfd6d/go.mod h1:62UsqQRqanuCbFi6xElIw3/2X+yGF+TKlyiWImA5taU=
+github.com/netbirdio/wireguard-go v0.0.0-20261016113635-bd0cb75a3df0 h1:nCK1YzDybjbAfrx+C2QPmcQ+7jYj4Rcb3FskqTNZEXo=
+github.com/netbirdio/wireguard-go v0.0.0-20261016113635-bd0cb75a3df0/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
@@ -538,12 +557,12 @@ github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q=
-github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3RonqW57k=
+github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
+github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
-github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
+github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
+github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
 github.com/openbao/openbao/api/v2 v2.5.1 h1:Br79D6L20SbAa5P7xqENxmvv8LyI4HoKosPy7klhn4o=
 github.com/openbao/openbao/api/v2 v2.5.1/go.mod h1:Dh5un77tqGgMbmlVEqjqN+8/dMyUohnkaQVg/wXW0Ig=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -556,6 +575,18 @@ github.com/oschwald/maxminddb-golang v1.12.0 h1:9FnTOD0YOhP7DGxGsq4glzpGy5+w7pq5
 github.com/oschwald/maxminddb-golang v1.12.0/go.mod h1:q0Nob5lTCqyQ8WT6FYgS1L7PXKVVbgiymefNwIjPzgY=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
+github.com/pb33f/go-yaml v0.1.1 h1:yWGmhVdwzionRnSc/hEJwcfq6PaZL2QdYzyReXBbX7Q=
+github.com/pb33f/go-yaml v0.1.1/go.mod h1:QvWdkHP5VjFYAeHMQUkaPQqREaQnBNOXmWzAjNrnSdo=
+github.com/pb33f/jsonpath v0.8.4 h1:Yx7fxsKl8scgERL22WhKDs2c6gYNNUonPSWEG8Y194s=
+github.com/pb33f/jsonpath v0.8.4/go.mod h1:eO6mgdhw5RgzCxm/bXTi75VUs0/cCYJzdGjMCCUEI6M=
+github.com/pb33f/libopenapi v0.41.2 h1:7/KNzJJ0o5fC/tYxDYcHjziKfg0bkBpFUfI2UDbChAo=
+github.com/pb33f/libopenapi v0.41.2/go.mod h1:mUldESjO6ownR1TCcywvoYp7e4v/bCdQyiiIqsgWne0=
+github.com/pb33f/libopenapi-validator v0.15.0 h1:5wl7/tpyewqzZ7Y5/M9CZjojlaaK2DYKPZYGIvPq7SI=
+github.com/pb33f/libopenapi-validator v0.15.0/go.mod h1:P52RfZsY/+oWjRL52mpQ8Icwual6rtkJt1qOWdAe4eM=
+github.com/pb33f/ordered-map/v2 v2.3.2 h1:wDyaZ2Pv9QLh64X4utCeD5Zoi9nIv2aW3lwv172O5PQ=
+github.com/pb33f/ordered-map/v2 v2.3.2/go.mod h1:1OhFrXu3OYw3kM+FXF+Ug3ugmmZ9LE8z0JfQMLvtV0w=
+github.com/pb33f/testify v0.1.1 h1:mnHe7uxKt8dyNYEGUspow72VjD264DB5rOJq4bz5tJw=
+github.com/pb33f/testify v0.1.1/go.mod h1:keghMqOLECF1ENzESnfM+cwPcKN5uhTOpvbtjgL6aZg=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203 h1:E7Kmf11E4K7B5hDti2K2NqPb1nlYlGYsu02S1JNd/Bs=
@@ -590,17 +621,16 @@ github.com/pion/turn/v4 v4.1.1 h1:9UnY2HB99tpDyz3cVVZguSxcqkJ1DsTSZ+8TGruh4fc=
 github.com/pion/turn/v4 v4.1.1/go.mod h1:2123tHk1O++vmjI5VSD0awT50NywDAq5A2NNNU4Jjs8=
 github.com/pires/go-proxyproto v0.11.0 h1:gUQpS85X/VJMdUsYyEgyn59uLJvGqPhJV5YvG68wXH4=
 github.com/pires/go-proxyproto v0.11.0/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
+github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU=
+github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
-github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
 github.com/pkg/sftp v1.13.9 h1:4NGkvGudBL7GteO3m6qnaQ4pC0Kvf0onSVc9gR3EWBw=
 github.com/pkg/sftp v1.13.9/go.mod h1:OBN7bVXdstkFFN/gdnHPUb5TE8eb8G1Rp9wCItqjkkA=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
@@ -615,12 +645,14 @@ github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEo
 github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
 github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
 github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
-github.com/quic-go/quic-go v0.55.0 h1:zccPQIqYCXDt5NmcEabyYvOnomjs8Tlwl7tISjJh9Mk=
-github.com/quic-go/quic-go v0.55.0/go.mod h1:DR51ilwU1uE164KuWXhinFcKWGlEjzys2l8zUl5Ss1U=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
+github.com/quic-go/quic-go v0.64.0 h1:dlUpiyp9+7UrbbuhLvV7CJ9F8uoZxXf/vi2h8tkuuoA=
+github.com/quic-go/quic-go v0.64.0/go.mod h1:RAro2j2yN9a9EiPACLHT9IB2NXCvGQmmo/alT0yYI0w=
 github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM=
 github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRltRTZHSvrA=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g=
+github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/rs/cors v1.8.0 h1:P2KMzcFwrPoSjkF1WLRPsp3UMLyql8L4v9hQpVeK5so=
 github.com/rs/cors v1.8.0/go.mod h1:EBwu+T5AvHOcXwvZIkQFjUN6s8Czyqw12GL/Y0tUyRM=
 github.com/rs/xid v1.3.0 h1:6NjYksEUlhurdVehpc7S7dk6DAmcKv8V9gG0FsVN2U4=
@@ -630,43 +662,50 @@ github.com/russellhaering/goxmldsig v1.6.0/go.mod h1:TrnaquDcYxWXfJrOjeMBTX4mLBe
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/rymdport/portal v0.4.2 h1:7jKRSemwlTyVHHrTGgQg7gmNPJs88xkbKcIL3NlcmSU=
-github.com/rymdport/portal v0.4.2/go.mod h1:kFF4jslnJ8pD5uCi17brj/ODlfIidOxlgUDTO5ncnC4=
-github.com/shirou/gopsutil/v3 v3.24.4 h1:dEHgzZXt4LMNm+oYELpzl9YCqV65Yr/6SfrvgRBtXeU=
-github.com/shirou/gopsutil/v3 v3.24.4/go.mod h1:lTd2mdiOspcqLgAnr9/nGi71NkeMpWKdmhuxm9GusH8=
+github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
+github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shirou/gopsutil/v4 v4.25.8 h1:NnAsw9lN7587WHxjJA9ryDnqhJpFH6A+wagYWTOH970=
 github.com/shirou/gopsutil/v4 v4.25.8/go.mod h1:q9QdMmfAOVIw7a+eF86P7ISEU6ka+NLgkUxlopV4RwI=
-github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
-github.com/shoenig/go-m1cpu v0.2.1 h1:yqRB4fvOge2+FyRXFkXqsyMoqPazv14Yyy+iyccT2E4=
-github.com/shoenig/go-m1cpu v0.2.1/go.mod h1:KkDOw6m3ZJQAPHbrzkZki4hnx+pDRR1Lo+ldA56wD5w=
-github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
-github.com/shoenig/test v1.7.0 h1:eWcHtTXa6QLnBvm0jgEabMRN/uJ4DMV3M8xUGgRkZmk=
-github.com/shoenig/test v1.7.0/go.mod h1:UxJ6u/x2v/TNs/LoLxBNJRV9DiwBBKYxXSyczsBHFoI=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
+github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
 github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/skeema/knownhosts v1.3.2 h1:EDL9mgf4NzwMXCTfaxSD/o/a5fxDw/xL9nkU28JjdBg=
+github.com/skeema/knownhosts v1.3.2/go.mod h1:bEg3iQAuw+jyiw+484wwFJoKSLwcfd7fqRy+N0QTiow=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
+github.com/smarty/assertions v1.15.0 h1:cR//PqUBUiQRakZWqBiFFQ9wb8emQGDb0HeGdqGByCY=
+github.com/smarty/assertions v1.15.0/go.mod h1:yABtdzeQs6l1brC900WlRNwj6ZR55d7B+E8C6HtKdec=
+github.com/smartystreets/goconvey v1.8.1 h1:qGjIddxOk4grTu9JPOU31tVfq3cNdBlNa5sSznIX1xY=
+github.com/smartystreets/goconvey v1.8.1/go.mod h1:+/u4qLyY6x1jReYOp7GOM2FSt8aP9CzCZL03bI28W60=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8/go.mod h1:P5HUIBuIWKbyjl083/loAegFkfbFNx5i2qEP4CNbm7E=
-github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
-github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
 github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
-github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c h1:km8GpoQut05eY3GiYWEedbTT0qnSxrCjsVbb7yKY1KE=
-github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c/go.mod h1:cNQ3dwVJtS5Hmnjxy6AgTPd0Inb3pW05ftPSX7NZO7Q=
-github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef h1:Ch6Q+AZUxDBCVqdkI8FSpFyZDtCVBc2VmejdNrm5rRQ=
-github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef/go.mod h1:nXTWP6+gD5+LUJ8krVhhoeHjvHTutPxMYl5SvkcnJNE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
@@ -676,9 +715,10 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/testcontainers/testcontainers-go v0.37.0 h1:L2Qc0vkTw2EHWQ08djon0D2uw7Z/PtHS/QzZZ5Ra/hg=
 github.com/testcontainers/testcontainers-go v0.37.0/go.mod h1:QPzbxZhQ6Bclip9igjLFj6z0hs01bU8lrl2dHQmgFGM=
 github.com/testcontainers/testcontainers-go/modules/mysql v0.37.0 h1:LqUos1oR5iuuzorFnSvxsHNdYdCHB/DfI82CuT58wbI=
@@ -695,10 +735,8 @@ github.com/ti-mo/netfilter v0.5.2 h1:CTjOwFuNNeZ9QPdRXt1MZFLFUf84cKtiQutNauHWd40
 github.com/ti-mo/netfilter v0.5.2/go.mod h1:Btx3AtFiOVdHReTDmP9AE+hlkOcvIy403u7BXXbWZKo=
 github.com/tinylib/msgp v1.6.3 h1:bCSxiTz386UTgyT1i0MSCvdbWjVW+8sG3PjkGsZQt4s=
 github.com/tinylib/msgp v1.6.3/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
-github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
 github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
-github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
 github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
 github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
 github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
@@ -715,12 +753,12 @@ github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
+github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.7.8 h1:iERMLn0/QJeHFhxSt3p6PeN9mGnvIKSpG9YYorDMnic=
-github.com/yuin/goldmark v1.7.8/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zcalusic/sysinfo v1.1.3 h1:u/AVENkuoikKuIZ4sUEJ6iibpmQP6YpGD8SSMCrqAF0=
@@ -731,6 +769,8 @@ github.com/zeebo/blake3 v0.2.3 h1:TFoLXsjeXqRNFxSbk35Dk4YtszE/MQQGK10BH4ptoTg=
 github.com/zeebo/blake3 v0.2.3/go.mod h1:mjJjZpnsyIVtVgTOSpJ9vmRE4wgDeyt2HU3qXvvKCaQ=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
+gitlab.com/digitalxero/go-conventional-commit v1.0.7 h1:8/dO6WWG+98PMhlZowt/YjuiKhqhGlOCwlIV8SqqGh8=
+gitlab.com/digitalxero/go-conventional-commit v1.0.7/go.mod h1:05Xc2BFsSyC5tKhK0y+P3bs0AwUtNuTp+mTpbCU/DZ0=
 go.mongodb.org/mongo-driver v1.17.9 h1:IexDdCuuNJ3BHrELgBlyaH9p60JXAvdzWR128q+U5tU=
 go.mongodb.org/mongo-driver v1.17.9/go.mod h1:LlOhpH5NUEfhxcAwG0UEkMqwYcc4JU18gtCdGudk/tQ=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
@@ -768,28 +808,30 @@ go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 goauthentik.io/api/v3 v3.2023051.3 h1:NebAhD/TeTWNo/9X3/Uj+rM5fG1HaiLOlKTNLQv9Qq4=
 goauthentik.io/api/v3 v3.2023051.3/go.mod h1:nYECml4jGbp/541hj8GcylKQG1gVBsKppHy4+7G8u4U=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
+golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
 golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
-golang.org/x/image v0.33.0 h1:LXRZRnv1+zGd5XBUVRFmYEphyyKJjQjCRiOuAP3sZfQ=
-golang.org/x/image v0.33.0/go.mod h1:DD3OsTYT9chzuzTQt+zMcOlBHgfoKQb1gry8p76Y1sc=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20251113184115-a159579294ab h1:Iqyc+2zr7aGyLuEadIm0KRJP0Wwt+fhlXLa51Fxf1+Q=
-golang.org/x/mobile v0.0.0-20251113184115-a159579294ab/go.mod h1:Eq3Nh/5pFSWug2ohiudJ1iyU59SO78QFuh4qTTN++I0=
+golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733 h1:XKMObIaAElmkdO+4SQh1iCfzwciZHJi1OblnX9BED9k=
+golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733/go.mod h1:jMwjxoDSx9jqhNaZqPnr6nnKzb7cs+Dy1Czk7wdX+R8=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -799,8 +841,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
+golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -810,17 +852,19 @@ golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.13.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
 golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -835,8 +879,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -844,6 +888,7 @@ golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -851,11 +896,14 @@ golang.org/x/sys v0.0.0-20201015000850-e3ed0017c211/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -869,38 +917,40 @@ golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
 golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -914,8 +964,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -964,7 +1014,8 @@ gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI
 gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
+gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
+gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -987,8 +1038,8 @@ gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 gvisor.dev/gvisor v0.0.0-20260219192049-0f2374377e89 h1:mGJaeA61P8dEHTqdvAgc70ZIV3QoUoJcXCRyyjO26OA=
 gvisor.dev/gvisor v0.0.0-20260219192049-0f2374377e89/go.mod h1:QkHjoMIBaYtpVufgwv3keYAbln78mBoCuShZrPrer1Q=
-howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
-howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
+howett.net/plist v1.0.2-0.20250314012144-ee69052608d9 h1:eeH1AIcPvSc0Z25ThsYF+Xoqbn0CI/YnXVYoTLFdGQw=
+howett.net/plist v1.0.2-0.20250314012144-ee69052608d9/go.mod h1:fyFX5Hj5tP1Mpk8obqA9MZgXT416Q5711SDT7dQLTLk=
 pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
 pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
 rsc.io/qr v0.2.0 h1:6vBLea5/NRMVTz8V66gipeLycZMl/+UlFmk8DvqQ6WY=
diff --git a/idp/dex/config.go b/idp/dex/config.go
index 56ed998c2..00b5ce745 100644
--- a/idp/dex/config.go
+++ b/idp/dex/config.go
@@ -308,7 +308,7 @@ func (s *Storage) OpenStorage(logger *slog.Logger) (storage.Storage, error) {
 		if file == "" {
 			return nil, fmt.Errorf("sqlite3 storage requires 'file' config")
 		}
-		return (&sql.SQLite3{File: file}).Open(logger)
+		return newSQLite3(file).Open(logger)
 	case "postgres":
 		dsn, _ := s.Config["dsn"].(string)
 		if dsn == "" {
@@ -613,6 +613,10 @@ func (c *YAMLConfig) ToServerConfig(stor storage.Storage, logger *slog.Logger) s
 		cfg.SupportedResponseTypes = c.OAuth2.ResponseTypes
 	}
 
+	if len(c.OAuth2.GrantTypes) > 0 {
+		cfg.AllowedGrantTypes = c.OAuth2.GrantTypes
+	}
+
 	// Apply expiry settings
 	if c.Expiry.IDTokens != "" {
 		if d, err := parseDuration(c.Expiry.IDTokens); err == nil {
diff --git a/idp/dex/provider.go b/idp/dex/provider.go
index 67aeb995f..95c511c01 100644
--- a/idp/dex/provider.go
+++ b/idp/dex/provider.go
@@ -20,8 +20,7 @@ import (
 	"github.com/dexidp/dex/server"
 	"github.com/dexidp/dex/server/signer"
 	"github.com/dexidp/dex/storage"
-	"github.com/dexidp/dex/storage/sql"
-	jose "github.com/go-jose/go-jose/v4"
+	"github.com/go-jose/go-jose/v4"
 	"github.com/google/uuid"
 	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/crypto/bcrypt"
@@ -41,7 +40,7 @@ type Config struct {
 	GRPCAddr string
 }
 
-const localConnectorID = "local"
+const LocalConnectorID = "local"
 
 // Provider wraps a Dex server
 type Provider struct {
@@ -79,7 +78,7 @@ func NewProvider(ctx context.Context, config *Config) (*Provider, error) {
 
 	// Initialize SQLite storage
 	dbPath := filepath.Join(config.DataDir, "oidc.db")
-	sqliteConfig := &sql.SQLite3{File: dbPath}
+	sqliteConfig := newSQLite3(dbPath)
 	stor, err := sqliteConfig.Open(logger)
 	if err != nil {
 		return nil, fmt.Errorf("failed to open storage: %w", err)
@@ -495,18 +494,60 @@ func (p *Provider) Storage() storage.Storage {
 	return p.storage
 }
 
+// SetClientsMFAChain updates the MFAChain field on OAuth2 clients in Dex storage.
+// Pass a non-empty slice (e.g. []string{"default-totp"}) to enable MFA, or nil to disable it.
+func SetClientsMFAChain(ctx context.Context, st storage.Storage, clientIDs []string, mfaChain []string) error {
+	previousChains := make(map[string][]string, len(clientIDs))
+	for _, clientID := range clientIDs {
+		client, err := st.GetClient(ctx, clientID)
+		if err != nil {
+			return fmt.Errorf("failed to get client %s before MFA chain update: %w", clientID, err)
+		}
+		previousChains[clientID] = cloneMFAChain(client.MFAChain)
+	}
+
+	updatedClientIDs := make([]string, 0, len(clientIDs))
+	for _, clientID := range clientIDs {
+		if err := st.UpdateClient(ctx, clientID, func(old storage.Client) (storage.Client, error) {
+			old.MFAChain = cloneMFAChain(mfaChain)
+			return old, nil
+		}); err != nil {
+			if rollbackErr := rollbackClientsMFAChain(ctx, st, updatedClientIDs, previousChains); rollbackErr != nil {
+				return fmt.Errorf("failed to update MFA chain on client %s: %w (also failed to roll back previous MFA chains: %v)", clientID, err, rollbackErr)
+			}
+			return fmt.Errorf("failed to update MFA chain on client %s: %w", clientID, err)
+		}
+		updatedClientIDs = append(updatedClientIDs, clientID)
+	}
+	return nil
+}
+
+func rollbackClientsMFAChain(ctx context.Context, st storage.Storage, clientIDs []string, previousChains map[string][]string) error {
+	var rollbackErrs []error
+	for i := len(clientIDs) - 1; i >= 0; i-- {
+		clientID := clientIDs[i]
+		previousChain := cloneMFAChain(previousChains[clientID])
+		if err := st.UpdateClient(ctx, clientID, func(old storage.Client) (storage.Client, error) {
+			old.MFAChain = previousChain
+			return old, nil
+		}); err != nil {
+			rollbackErrs = append(rollbackErrs, fmt.Errorf("client %s: %w", clientID, err))
+		}
+	}
+	return errors.Join(rollbackErrs...)
+}
+
+func cloneMFAChain(chain []string) []string {
+	if chain == nil {
+		return nil
+	}
+	return append([]string(nil), chain...)
+}
+
 // SetClientsMFAChain updates the MFAChain field on the dashboard and CLI OAuth2 clients.
 // Pass a non-empty slice (e.g. []string{"default-totp"}) to enable MFA, or nil to disable it.
 func (p *Provider) SetClientsMFAChain(ctx context.Context, clientIDs []string, mfaChain []string) error {
-	for _, clientID := range clientIDs {
-		if err := p.storage.UpdateClient(ctx, clientID, func(old storage.Client) (storage.Client, error) {
-			old.MFAChain = mfaChain
-			return old, nil
-		}); err != nil {
-			return fmt.Errorf("failed to update MFA chain on client %s: %w", clientID, err)
-		}
-	}
-	return nil
+	return SetClientsMFAChain(ctx, p.storage, clientIDs, mfaChain)
 }
 
 // Handler returns the Dex server as an http.Handler for embedding in another server.
@@ -546,7 +587,7 @@ func (p *Provider) CreateUser(ctx context.Context, email, username, password str
 
 	// Encode the user ID in Dex's format: base64(protobuf{user_id, connector_id})
 	// This matches the format Dex uses in JWT tokens
-	encodedID := EncodeDexUserID(userID, localConnectorID)
+	encodedID := EncodeDexUserID(userID, LocalConnectorID)
 	return encodedID, nil
 }
 
@@ -625,7 +666,7 @@ func DecodeDexUserID(encodedID string) (userID, connectorID string, err error) {
 // local password connector.
 func IsLocalUserID(encodedID string) bool {
 	_, connectorID, err := DecodeDexUserID(encodedID)
-	return err == nil && connectorID == localConnectorID
+	return err == nil && connectorID == LocalConnectorID
 }
 
 // GetUser returns a user by email
@@ -696,6 +737,10 @@ func (p *Provider) UpdateUserPassword(ctx context.Context, userID string, oldPas
 		return fmt.Errorf("failed to update password: %w", err)
 	}
 
+	if err := p.storage.DeleteAuthSession(ctx, user.UserID, server.LocalConnector); err != nil && !errors.Is(err, storage.ErrNotFound) {
+		p.logger.Error("failed to revoke local session after password change", "error", err)
+	}
+
 	return nil
 }
 
diff --git a/idp/dex/provider_test.go b/idp/dex/provider_test.go
index 3eb29db97..5e132d544 100644
--- a/idp/dex/provider_test.go
+++ b/idp/dex/provider_test.go
@@ -3,6 +3,8 @@ package dex
 import (
 	"context"
 	"encoding/json"
+	"errors"
+	"io"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
@@ -11,11 +13,44 @@ import (
 	"testing"
 
 	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
 	sqllib "github.com/dexidp/dex/storage/sql"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+type updateFailingStorage struct {
+	storage.Storage
+	failClientID string
+}
+
+func (s *updateFailingStorage) UpdateClient(ctx context.Context, id string, updater func(storage.Client) (storage.Client, error)) error {
+	if id == s.failClientID {
+		return errors.New("forced update failure")
+	}
+	return s.Storage.UpdateClient(ctx, id, updater)
+}
+
+func TestSetClientsMFAChainRollsBackUpdatedClients(t *testing.T) {
+	ctx := context.Background()
+	st := memory.New(slog.New(slog.NewTextHandler(io.Discard, nil)))
+
+	require.NoError(t, st.CreateClient(ctx, storage.Client{ID: "client-1", MFAChain: []string{"old-1"}}))
+	require.NoError(t, st.CreateClient(ctx, storage.Client{ID: "client-2", MFAChain: []string{"old-2"}}))
+
+	err := SetClientsMFAChain(ctx, &updateFailingStorage{Storage: st, failClientID: "client-2"}, []string{"client-1", "client-2"}, []string{"new"})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "failed to update MFA chain on client client-2")
+
+	client1, err := st.GetClient(ctx, "client-1")
+	require.NoError(t, err)
+	require.Equal(t, []string{"old-1"}, client1.MFAChain)
+
+	client2, err := st.GetClient(ctx, "client-2")
+	require.NoError(t, err)
+	require.Equal(t, []string{"old-2"}, client2.MFAChain)
+}
+
 func TestUserCreationFlow(t *testing.T) {
 	ctx := context.Background()
 
@@ -595,3 +630,90 @@ enablePasswordDB: true
 	assert.True(t, cfg.ContinueOnConnectorFailure,
 		"buildDexConfig must set ContinueOnConnectorFailure to true so management starts even if an external IdP is down")
 }
+
+func TestToServerConfig_WiresGrantTypes(t *testing.T) {
+	tmpDir, err := os.MkdirTemp("", "dex-grants-*")
+	require.NoError(t, err)
+	defer os.RemoveAll(tmpDir)
+
+	stor := openTestStorage(t, tmpDir)
+	defer stor.Close()
+
+	logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))
+
+	grants := []string{"authorization_code", "refresh_token"}
+	cfg := &YAMLConfig{Issuer: "http://localhost:5599/oauth2", OAuth2: OAuth2{GrantTypes: grants}}
+	assert.Equal(t, grants, cfg.ToServerConfig(stor, logger).AllowedGrantTypes)
+
+	empty := &YAMLConfig{Issuer: "http://localhost:5599/oauth2"}
+	assert.Empty(t, empty.ToServerConfig(stor, logger).AllowedGrantTypes)
+}
+
+func newDeviceGuardProvider(t *testing.T, grantTypesYAML string) *Provider {
+	t.Helper()
+
+	tmpDir, err := os.MkdirTemp("", "dex-devguard-*")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = os.RemoveAll(tmpDir) })
+
+	yamlContent := `
+issuer: http://localhost:5599/oauth2
+storage:
+  type: sqlite3
+  config:
+    file: ` + filepath.Join(tmpDir, "dex.db") + `
+web:
+  http: 127.0.0.1:5599
+enablePasswordDB: true
+` + grantTypesYAML
+
+	configPath := filepath.Join(tmpDir, "config.yaml")
+	require.NoError(t, os.WriteFile(configPath, []byte(yamlContent), 0644))
+
+	yamlConfig, err := LoadConfig(configPath)
+	require.NoError(t, err)
+
+	provider, err := NewProviderFromYAML(context.Background(), yamlConfig)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = provider.Stop(context.Background()) })
+	return provider
+}
+
+func TestHandler_BlocksDeviceEndpointsWhenDeviceGrantDisabled(t *testing.T) {
+	provider := newDeviceGuardProvider(t, `
+oauth2:
+  grantTypes:
+    - authorization_code
+    - refresh_token
+`)
+
+	devicePaths := []string{
+		"/oauth2/device",
+		"/oauth2/device/code",
+		"/oauth2/device/token",
+		"/oauth2/device/auth/verify_code",
+		"/oauth2/device/callback",
+	}
+	for _, path := range devicePaths {
+		for _, method := range []string{http.MethodGet, http.MethodPost} {
+			req := httptest.NewRequest(method, path, nil)
+			rec := httptest.NewRecorder()
+			provider.Handler().ServeHTTP(rec, req)
+			assert.Equal(t, http.StatusNotFound, rec.Code, "%s %s must be blocked", method, path)
+		}
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/oauth2/.well-known/openid-configuration", nil)
+	rec := httptest.NewRecorder()
+	provider.Handler().ServeHTTP(rec, req)
+	assert.Equal(t, http.StatusOK, rec.Code)
+}
+
+func TestHandler_AllowsDeviceEndpointsWhenGrantsDefault(t *testing.T) {
+	provider := newDeviceGuardProvider(t, "")
+
+	req := httptest.NewRequest(http.MethodPost, "/oauth2/device/code", nil)
+	rec := httptest.NewRecorder()
+	provider.Handler().ServeHTTP(rec, req)
+	assert.NotEqual(t, http.StatusNotFound, rec.Code)
+}
diff --git a/idp/dex/sqlite_cgo.go b/idp/dex/sqlite_cgo.go
new file mode 100644
index 000000000..5de66f647
--- /dev/null
+++ b/idp/dex/sqlite_cgo.go
@@ -0,0 +1,15 @@
+//go:build cgo
+
+package dex
+
+import (
+	sql "github.com/dexidp/dex/storage/sql"
+)
+
+// newSQLite3 builds the dex SQLite3 config. CGO builds use the upstream
+// struct that takes a File path. Non-CGO builds get an empty stub whose
+// Open() returns the dex "SQLite not available" error — correct behaviour
+// for binaries that can't link sqlite3 (e.g. cross-compiled ARM targets).
+func newSQLite3(file string) *sql.SQLite3 {
+	return &sql.SQLite3{File: file}
+}
diff --git a/idp/dex/sqlite_nocgo.go b/idp/dex/sqlite_nocgo.go
new file mode 100644
index 000000000..4def12143
--- /dev/null
+++ b/idp/dex/sqlite_nocgo.go
@@ -0,0 +1,15 @@
+//go:build !cgo
+
+package dex
+
+import (
+	sql "github.com/dexidp/dex/storage/sql"
+)
+
+// newSQLite3 for non-CGO builds. The dex SQLite3 stub has no fields and its
+// Open() returns an error documenting the missing CGO support — correct
+// behaviour for cross-compiled artefacts that never actually run the
+// embedded IdP. The `file` argument is ignored.
+func newSQLite3(_ string) *sql.SQLite3 {
+	return &sql.SQLite3{}
+}
diff --git a/infrastructure_files/configure.sh b/infrastructure_files/configure.sh
index 92252d0b3..ce1a041e6 100755
--- a/infrastructure_files/configure.sh
+++ b/infrastructure_files/configure.sh
@@ -1,14 +1,14 @@
 #!/bin/bash
 set -e
 
-if ! which curl >/dev/null 2>&1; then
+if ! command -v curl >/dev/null 2>&1; then
   echo "This script uses curl fetch OpenID configuration from IDP."
   echo "Please install curl and re-run the script https://curl.se/"
   echo ""
   exit 1
 fi
 
-if ! which jq >/dev/null 2>&1; then
+if ! command -v jq >/dev/null 2>&1; then
   echo "This script uses jq to load OpenID configuration from IDP."
   echo "Please install jq and re-run the script https://stedolan.github.io/jq/"
   echo ""
@@ -18,13 +18,13 @@ fi
 source setup.env
 source base.setup.env
 
-if ! which envsubst >/dev/null 2>&1; then
+if ! command -v envsubst >/dev/null 2>&1; then
   echo "envsubst is needed to run this script"
   if [[ $(uname) == "Darwin" ]]; then
     echo "you can install it with homebrew (https://brew.sh):"
     echo "brew install gettext"
   else
-    if which apt-get >/dev/null 2>&1; then
+    if command -v apt-get >/dev/null 2>&1; then
       echo "you can install it by running"
       echo "apt-get update && apt-get install gettext-base"
     else
diff --git a/infrastructure_files/getting-started-enterprise.sh b/infrastructure_files/getting-started-enterprise.sh
index 135440180..b6565bff1 100755
--- a/infrastructure_files/getting-started-enterprise.sh
+++ b/infrastructure_files/getting-started-enterprise.sh
@@ -1,26 +1,47 @@
 #!/bin/bash
 
-set -e
-set -o pipefail
-
 # NetBird Enterprise — Getting Started
 # Single-node bootstrap for a self-hosted NetBird Enterprise stack with the
 # embedded identity provider. Owner is created via first-login flow.
+# Add features to an existing install with --enable-proxy or --enable-traffic-events.
 
 SED_STRIP_PADDING='s/=//g'
 
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
+STACK_FILES=(.env docker-compose.yml config.yaml)
+
+# Host directory of a custom TLS certificate mounted at /certs, see
+# https://docs.netbird.io/selfhosted/enterprise/getting-started#appendix-using-a-custom-tls-certificate
+CUSTOM_TLS_CERTS=""
+PROXY_TOKEN_ID=""
+
+# Static IP for Traefik inside the compose bridge network. The management
+# server trusts X-Forwarded-* headers from this address only.
+TRAEFIK_IP="172.30.0.10"
+
+TRAEFIK_HEADER_CONFIG='      - "--entrypoints.web.http.aliasHeadersStrategy=delete"
+      - "--entrypoints.websecure.http.aliasHeadersStrategy=delete"'
+
+LICENSE_VERDICT="unknown"
+LICENSE_LOG_LINES=""
+
 check_docker_compose() {
-  if command -v docker-compose &> /dev/null; then
-    echo "docker-compose"
-    return
+  if ! command -v docker &> /dev/null && ! command -v docker-compose &> /dev/null; then
+    echo "Docker is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/engine/install/" > /dev/stderr
+    exit 1
   fi
-  if docker compose --help &> /dev/null; then
+
+  if docker compose version &> /dev/null; then
     echo "docker compose"
     return
   fi
-  echo "docker-compose is not installed or not in PATH. See https://docs.docker.com/engine/install/" > /dev/stderr
+  if command -v docker-compose &> /dev/null && docker-compose version &> /dev/null; then
+    echo "docker-compose"
+    return
+  fi
+
+  echo "Docker Compose is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/compose/install/" > /dev/stderr
   exit 1
 }
 
@@ -29,14 +50,59 @@ check_openssl() {
     echo "openssl is not installed or not in PATH." > /dev/stderr
     exit 1
   fi
+  return
+}
+
+# Only parseable versions can guarantee that aliasHeadersStrategy and its
+# CVE-2026-88004 fix (v3.7.13) are available in the fresh-install compose.
+check_traefik_tag() {
+  local tag="${NETBIRD_TRAEFIK_TAG:-}" ver major minor patch
+  [[ -n "$tag" ]] || return 0
+  ver="${tag#v}"
+  if [[ ! "$ver" =~ ^([0-9]+)\.([0-9]+)(\.([0-9]+))?$ ]]; then
+    die "Cannot verify NETBIRD_TRAEFIK_TAG=$tag. Use a numeric version tag such as v3.7.13 or newer, or unset NETBIRD_TRAEFIK_TAG for the default (v3.7.14)."
+  fi
+  major=$((10#${BASH_REMATCH[1]}))
+  minor=$((10#${BASH_REMATCH[2]}))
+  patch=$((10#${BASH_REMATCH[4]:-0}))
+  if (( major < 3 || (major == 3 && minor < 7) || (major == 3 && minor == 7 && patch < 13) )); then
+    die "NETBIRD_TRAEFIK_TAG=$tag predates aliasHeadersStrategy and its CVE-2026-88004 fix (added in v3.7.12, fixed in v3.7.13), which this installer always enables. Use v3.7.13 or newer, or unset NETBIRD_TRAEFIK_TAG for the default (v3.7.14)."
+  fi
+  return
+}
+
+die() {
+  echo "$1" > /dev/stderr
+  exit 1
+}
+
+# env_get KEY [DEFAULT] prints KEY's value from .env, or DEFAULT if unset.
+env_get() {
+  local value
+  value=$(sed -n "s/^$1=//p" .env | tail -n 1)
+  echo "${value:-$2}"
+  return
+}
+
+# merge_env upserts the KEY=VALUE lines from stdin into .env, in place.
+merge_env() {
+  local merged
+  merged=$(awk -F= 'NR == FNR { v[$1] = $0; o[++n] = $1; next }
+    $1 in v { print v[$1]; delete v[$1]; next }
+    { print }
+    END { for (i = 1; i <= n; i++) if (o[i] in v) print v[o[i]] }' - .env)
+  printf '%s\n' "$merged" > .env
+  return
 }
 
 rand_secret() {
   openssl rand -base64 32 | sed "$SED_STRIP_PADDING"
+  return
 }
 
 rand_b64_key() {
   openssl rand -base64 32
+  return
 }
 
 check_nb_domain() {
@@ -80,7 +146,7 @@ read_nb_domain() {
   if ! check_domain_resolves "$value"; then
     echo "" > /dev/stderr
     echo "Warning: '$value' does not resolve via DNS from this host." > /dev/stderr
-    echo "Caddy will not be able to issue TLS certificates until it does." > /dev/stderr
+    echo "Traefik will not be able to issue TLS certificates until it does." > /dev/stderr
     local confirm=""
     echo -n "Continue anyway? [y/N]: " > /dev/stderr
     read -r confirm < /dev/tty
@@ -90,6 +156,25 @@ read_nb_domain() {
     fi
   fi
   echo "$value"
+  return
+}
+
+read_letsencrypt_email() {
+  if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL:-}" ]]; then
+    echo "$NETBIRD_LETSENCRYPT_EMAIL"
+    return
+  fi
+  local value=""
+  echo "Enter your email for Let's Encrypt certificate notifications." > /dev/stderr
+  echo -n "Email address: " > /dev/stderr
+  read -r value < /dev/tty
+  if [[ -z "$value" ]]; then
+    echo "Email is required for Let's Encrypt." > /dev/stderr
+    read_letsencrypt_email
+    return
+  fi
+  echo "$value"
+  return
 }
 
 read_required() {
@@ -103,6 +188,7 @@ read_required() {
     fi
   done
   echo "$value"
+  return
 }
 
 read_secret() {
@@ -117,6 +203,7 @@ read_secret() {
     fi
   done
   echo "$value"
+  return
 }
 
 # read_yes_no "<prompt>" [<default y|n>]
@@ -139,6 +226,17 @@ read_yes_no() {
     [Yy] | [Yy][Ee][Ss]) echo "yes" ;;
     *) echo "no" ;;
   esac
+  return
+}
+
+read_crowdsec_option() {
+  echo ""
+  echo "CrowdSec:"
+  echo "  Checks client IPs against a community threat intelligence database and"
+  echo "  blocks known malicious sources before they reach services exposed through"
+  echo "  the proxy. Adds a CrowdSec container to the stack."
+  NETBIRD_CROWDSEC=$(read_yes_no "Enable CrowdSec" "n")
+  return
 }
 
 # Gate the install on explicit acceptance of the NetBird On-Premise EULA.
@@ -176,6 +274,7 @@ EOF
     exit 1
   fi
   echo "" > /dev/stderr
+  return
 }
 
 wait_postgres() {
@@ -198,17 +297,193 @@ wait_postgres() {
   done
   echo " done"
   set -e
+  return
+}
+
+wait_for_license_verdict() {
+  local counter=0
+  local logs=""
+
+  echo -n "Waiting for the server to validate the license"
+  while [[ $counter -lt 60 ]]; do
+    logs=$($DOCKER_COMPOSE_COMMAND logs --no-color --tail=all netbird-server 2>/dev/null || true)
+
+    if grep -qi "license invalidated" <<< "$logs"; then
+      echo " rejected"
+      LICENSE_VERDICT="rejected"
+      LICENSE_LOG_LINES=$(grep -i "license" <<< "$logs" | tail -n 5 || true)
+      return 0
+    fi
+
+    if grep -qi "license validated" <<< "$logs"; then
+      echo " ok"
+      LICENSE_VERDICT="ok"
+      return 0
+    fi
+
+    echo -n " ."
+    sleep 2
+    counter=$((counter + 1))
+  done
+
+  echo " no verdict in 120s"
+  LICENSE_VERDICT="unknown"
+  LICENSE_LOG_LINES=$(grep -iE "failed to validate license|error validating license" <<< "$logs" | tail -n 3 || true)
+  return 0
+}
+
+report_license_verdict() {
+  if [[ "$LICENSE_VERDICT" == "ok" ]]; then
+    return 0
+  fi
+
+  if [[ "$LICENSE_VERDICT" == "unknown" ]]; then
+    echo ""
+    echo "  ⚠  The server logged no license verdict within 120s."
+    if [[ -n "$LICENSE_LOG_LINES" ]]; then
+      echo "     It was still reporting validation errors:"
+      while IFS= read -r line; do
+        [[ -n "$line" ]] && echo "     $line"
+      done <<< "$LICENSE_LOG_LINES"
+    fi
+    echo ""
+    echo "     Check the verdict with:"
+    echo ""
+    echo "       $DOCKER_COMPOSE_COMMAND logs netbird-server | grep -i license"
+    return 0
+  fi
+
+  local unreachable="false"
+  if grep -qi "couldn't be validated with the license server" <<< "$LICENSE_LOG_LINES"; then
+    unreachable="true"
+  fi
+
+  echo ""
+  if [[ "$unreachable" == "true" ]]; then
+    echo "  ⚠  The server could not validate the license:"
+  else
+    echo "  ⚠  The server rejected the license key:"
+  fi
+  while IFS= read -r line; do
+    [[ -n "$line" ]] && echo "     $line"
+  done <<< "$LICENSE_LOG_LINES"
+  echo ""
+  echo "     The stack is up, and only the license check did not pass."
+  echo ""
+  if [[ "$unreachable" == "true" ]]; then
+    echo "     The license server could not be reached, so the key itself was"
+    echo "     never checked. Confirm this host has outbound access to the"
+    echo "     license server, then restart:"
+  else
+    echo "     Check the reason the server gave above, verify that"
+    echo "     NETBIRD_LICENSE_KEY in .env matches the key you were issued,"
+    echo "     then restart:"
+  fi
+  echo ""
+  echo "       $DOCKER_COMPOSE_COMMAND up -d"
+  return 0
+}
+
+# up_all_but_proxy skips the proxy, which needs a token from the running server.
+up_all_but_proxy() {
+  local services
+  services=$($DOCKER_COMPOSE_COMMAND config --services | grep -vx proxy)
+  # shellcheck disable=SC2086
+  $DOCKER_COMPOSE_COMMAND up -d $services
+  return
+}
+
+wait_crowdsec() {
+  $DOCKER_COMPOSE_COMMAND up -d crowdsec || return 1
+  for _ in {1..60}; do
+    $DOCKER_COMPOSE_COMMAND exec -T crowdsec cscli lapi status &> /dev/null && return 0
+    sleep 2
+  done
+  return 1
+}
+
+admin_token() {
+  $DOCKER_COMPOSE_COMMAND run --rm --no-deps -T netbird-server admin token "$@" --config /etc/netbird/config.yaml
+  return
+}
+
+# revoke_proxy_token revokes the token this run minted if the proxy never started.
+# On failure the ID is kept, so rollback retries it.
+revoke_proxy_token() {
+  [[ -n "$PROXY_TOKEN_ID" ]] || return 0
+  if admin_token revoke "$PROXY_TOKEN_ID" > /dev/null; then
+    PROXY_TOKEN_ID=""
+    return 0
+  fi
+  echo "Could not revoke the unused proxy token ${PROXY_TOKEN_ID}. Revoke it with:" > /dev/stderr
+  echo "  $DOCKER_COMPOSE_COMMAND run --rm netbird-server admin token revoke ${PROXY_TOKEN_ID} --config /etc/netbird/config.yaml" > /dev/stderr
+  return
+}
+
+# start_proxy mints the proxy token and CrowdSec bouncer key, then starts the proxy.
+start_proxy() {
+  local out token key
+  echo "Creating the proxy access token ..."
+  out=$(admin_token create --name default-proxy) || true
+  token=$(awk '/^Token:/ {print $2}' <<< "$out")
+  PROXY_TOKEN_ID=$(awk '/^Token ID:/ {print $3}' <<< "$out")
+  [[ -n "$token" ]] || die "Could not create the proxy access token. Check the netbird-server logs, then re-run with --enable-proxy."
+
+  if [[ "$NETBIRD_CROWDSEC" == "yes" ]]; then
+    echo "Registering the CrowdSec bouncer ..."
+    if wait_crowdsec; then
+      # "add" fails if an earlier attempt already registered the bouncer.
+      $DOCKER_COMPOSE_COMMAND exec -T crowdsec cscli bouncers delete netbird-proxy &> /dev/null || true
+      key=$($DOCKER_COMPOSE_COMMAND exec -T crowdsec cscli bouncers add netbird-proxy -o raw) || true
+    fi
+    if [[ -z "$key" ]]; then
+      revoke_proxy_token
+      die "Could not register the CrowdSec bouncer. Check the crowdsec logs, then re-run with --enable-proxy."
+    fi
+  fi
+
+  # A stored token marks the proxy as set up, so it is cleared again on failure.
+  {
+    echo "NETBIRD_PROXY_TOKEN=${token}"
+    if [[ -n "$key" ]]; then echo "NETBIRD_CROWDSEC_BOUNCER_KEY=${key}"; fi
+  } | merge_env
+  if ! $DOCKER_COMPOSE_COMMAND up -d proxy; then
+    revoke_proxy_token
+    echo "NETBIRD_PROXY_TOKEN=" | merge_env
+    die "Could not start the proxy. Check the proxy logs, then re-run with --enable-proxy."
+  fi
+  PROXY_TOKEN_ID=""
+  return
+}
+
+print_proxy_notes() {
+  echo ""
+  echo "NetBird Proxy:"
+  echo "  Every domain other than ${NETBIRD_DOMAIN} is passed through to the proxy,"
+  echo "  which issues its own TLS certificates. Point proxy domains at this host:"
+  echo ""
+  echo "    *.${NETBIRD_DOMAIN}  CNAME  ${NETBIRD_DOMAIN}"
+  echo ""
+  echo "  Open 51820/udp (optional) for peer-to-peer proxy connections."
+  if [[ "$NETBIRD_CROWDSEC" == "yes" ]]; then
+    echo "  CrowdSec is running. Enable it per service in the dashboard under Access Control."
+  fi
+  return
 }
 
 init_environment() {
   check_openssl
+  check_traefik_tag
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
 
-  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]] || [[ -f Caddyfile ]]; then
+  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]]; then
     echo "Generated files already exist in $(pwd)."
+    echo "To add the proxy or traffic events to this installation, re-run with"
+    echo "--enable-proxy or --enable-traffic-events."
+    echo ""
     echo "If you want to reinitialize the environment, please remove them first:"
     echo "  $DOCKER_COMPOSE_COMMAND down --volumes # removes all containers and volumes"
-    echo "  rm -f .env docker-compose.yml Caddyfile config.yaml"
+    echo "  rm -rf .env docker-compose.yml config.yaml traefik"
     echo "Be aware this will remove all data from the database."
     exit 1
   fi
@@ -227,20 +502,31 @@ init_environment() {
   echo "  See https://docs.netbird.io/manage/activity/traffic-events-logging"
   NETBIRD_TRAFFIC_FLOW=$(read_yes_no "Enable traffic flow" "n")
 
+  echo ""
+  echo "NetBird Proxy:"
+  echo "  Exposes selected resources from your NetBird network to the internet."
+  echo "  You choose which resources are exposed from the dashboard."
+  NETBIRD_PROXY=$(read_yes_no "Enable the NetBird Proxy" "n")
+  NETBIRD_CROWDSEC="no"
+  if [[ "$NETBIRD_PROXY" == "yes" ]]; then
+    read_crowdsec_option
+  fi
+
   echo ""
   NETBIRD_DOMAIN=$(read_nb_domain)
 
+  echo ""
+  NETBIRD_LETSENCRYPT_EMAIL=$(read_letsencrypt_email)
+
   echo ""
 
   NETBIRD_LICENSE_KEY=$(read_secret "Enter license key (input hidden)")
 
-  GHCR_USERNAME="netbirdExtAccess1"
-  GHCR_TOKEN=$(read_secret "Enter GHCR token (input hidden)")
-
   POSTGRES_USER="netbird"
   POSTGRES_DB="netbird"
   POSTGRES_PASSWORD=$(rand_secret)
   NETBIRD_ENCRYPTION_KEY=$(rand_b64_key)
+  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)
   NETBIRD_RELAY_AUTH_SECRET=$(rand_secret)
 
   POSTGRES_DSN="host=postgres user=${POSTGRES_USER} password=${POSTGRES_PASSWORD} dbname=${POSTGRES_DB} port=5432 sslmode=disable TimeZone=UTC"
@@ -249,24 +535,22 @@ init_environment() {
   echo ""
   echo "Selected:"
   echo "  Traffic flow: ${NETBIRD_TRAFFIC_FLOW}"
+  echo "  Proxy:        ${NETBIRD_PROXY}"
+  echo "  CrowdSec:     ${NETBIRD_CROWDSEC}"
   echo "  Domain:       ${NETBIRD_DOMAIN}"
+  echo "  ACME email:   ${NETBIRD_LETSENCRYPT_EMAIL}"
   echo ""
   echo "Rendering files into $(pwd) ..."
   install -m 600 /dev/null .env
   render_env >> .env
   render_docker_compose > docker-compose.yml
-
-  if [[ -z "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then
-    sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' docker-compose.yml && rm -f docker-compose.yml.bak
+  mkdir -p traefik
+  if [[ "$NETBIRD_PROXY" == "yes" ]]; then
+    render_traefik_proxy > traefik/proxy.yaml
   fi
-  render_caddyfile > Caddyfile
   install -m 600 /dev/null config.yaml
   render_config_yaml >> config.yaml
 
-  echo "Logging in to ghcr.io ..."
-  printf '%s' "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin
-  unset GHCR_TOKEN
-
   echo ""
   echo "Pulling images ..."
   $DOCKER_COMPOSE_COMMAND pull
@@ -279,7 +563,15 @@ init_environment() {
 
   echo ""
   echo "Starting remaining services ..."
-  $DOCKER_COMPOSE_COMMAND up -d
+  up_all_but_proxy
+
+  echo ""
+  wait_for_license_verdict
+
+  if [[ "$NETBIRD_PROXY" == "yes" ]]; then
+    echo ""
+    start_proxy
+  fi
 
   echo ""
   echo "Done."
@@ -288,9 +580,167 @@ init_environment() {
   echo ""
   echo "Open the dashboard in a browser to complete the first-login owner setup."
   echo "All configuration and secrets are stored (mode 600) in $(pwd)/.env"
+  if [[ "$NETBIRD_PROXY" == "yes" ]]; then
+    print_proxy_notes
+  fi
   echo ""
   echo "Tail logs:"
-  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server caddy"
+  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server traefik"
+
+  report_license_verdict
+
+  if [[ "$LICENSE_VERDICT" == "rejected" ]]; then
+    exit 1
+  fi
+  return
+}
+
+# service_block NAME prints a service's definition from the compose file on stdin.
+service_block() {
+  local name="$1"
+  awk -v s="  ${name}:" '$0 == s { p = 1; print; next } p && (/^[^ ]/ || /^  [^ ]/) { exit } p'
+  return
+}
+
+# enable_features adds the proxy and/or traffic events to the install in the
+# current directory, restoring the backed-up files if any step fails.
+enable_features() {
+  local want_proxy="$1" want_flow="$2" f compose
+  DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
+
+  for f in "${STACK_FILES[@]}"; do
+    [[ -f "$f" ]] || die "$f not found in $(pwd). Run this from an existing installation directory."
+  done
+  grep -q '^# Generated by getting-started-enterprise.sh' .env || die ".env was not generated by getting-started-enterprise.sh."
+  # Installs from before the move to Traefik run Caddy and can't be re-rendered.
+  [[ -n "$(env_get NETBIRD_TRAEFIK_IP)" ]] || die "This installation predates the Traefik layout and can't be updated in place."
+
+  NETBIRD_DOMAIN=$(env_get NETBIRD_DOMAIN)
+  NETBIRD_LICENSE_SERVER_BASE_URL=$(env_get NETBIRD_LICENSE_SERVER_BASE_URL)
+  NETBIRD_TRAFFIC_FLOW=$(env_get NETBIRD_TRAFFIC_FLOW_ENABLED no)
+  NETBIRD_PROXY=$(env_get NETBIRD_PROXY_ENABLED no)
+  NETBIRD_CROWDSEC=$(env_get NETBIRD_CROWDSEC_ENABLED no)
+  # A custom certificate counts only once Traefik mounts it and ACME is already gone,
+  # so the re-render never removes a working Let's Encrypt setup.
+  local traefik_block
+  traefik_block=$(service_block traefik < docker-compose.yml)
+  # Enabling features does not upgrade Traefik. Preserve the existing header policy,
+  # including its absence on older releases that do not support these options.
+  TRAEFIK_HEADER_CONFIG=$(printf '%s\n' "$traefik_block" | grep -Ei -- '--entrypoints\.[^.]+\.http\.(alias|underscore)headersstrategy=' || true)
+  if ! grep -q certificatesresolvers <<< "$traefik_block"; then
+    CUSTOM_TLS_CERTS=$(awk '/:\/certs:ro$/ { sub(/^ *- /, ""); sub(/:\/certs:ro$/, ""); print; exit }' <<< "$traefik_block")
+  fi
+
+  if [[ "$want_flow" == "yes" && "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
+    echo "Traffic events are already enabled."
+    want_flow="no"
+  fi
+  # No token means an earlier proxy setup failed, so let it run again.
+  if [[ "$want_proxy" == "yes" && -n "$(env_get NETBIRD_PROXY_TOKEN)" ]]; then
+    echo "The NetBird Proxy is already enabled."
+    want_proxy="no"
+  fi
+  if [[ "$want_flow" == "no" && "$want_proxy" == "no" ]]; then
+    exit 0
+  fi
+
+  if [[ "$want_flow" == "yes" ]]; then
+    NETBIRD_TRAFFIC_FLOW="yes"
+  fi
+  # A retry keeps the CrowdSec choice made at install time.
+  if [[ "$want_proxy" == "yes" && "$NETBIRD_PROXY" != "yes" ]]; then
+    read_crowdsec_option
+  fi
+  if [[ "$want_proxy" == "yes" ]]; then
+    NETBIRD_PROXY="yes"
+  fi
+
+  compose=$(render_docker_compose)
+  echo ""
+  echo "Changes to docker-compose.yml:"
+  printf '%s\n' "$compose" | diff -u docker-compose.yml - || true
+
+  # Lines the new file drops are most likely local edits, so don't default to applying.
+  local lost s restarts="" apply="y"
+  lost=$(printf '%s\n' "$compose" | awk 'NR == FNR { keep[$0]; next } !($0 in keep)' - docker-compose.yml)
+  if [[ -n "$lost" ]]; then
+    echo ""
+    echo "These lines are not in the new docker-compose.yml and will be lost:"
+    printf '%s\n' "$lost"
+    apply="n"
+  fi
+  for s in $($DOCKER_COMPOSE_COMMAND config --services); do
+    if [[ "$(service_block "$s" < docker-compose.yml)" != "$(printf '%s\n' "$compose" | service_block "$s")" ]] \
+      || [[ "$s" == "netbird-server" && "$want_flow" == "yes" ]]; then
+      restarts+=" $s"
+    fi
+  done
+  echo ""
+  if [[ -n "$restarts" ]]; then
+    echo "These services will restart:${restarts}"
+  fi
+  if [[ "$(read_yes_no "Apply these changes?" "$apply")" != "yes" ]]; then
+    echo "Aborted."
+    exit 0
+  fi
+
+  BACKUP_SUFFIX=".bak.$(date -u +%Y%m%d%H%M%S)"
+  for f in "${STACK_FILES[@]}" traefik/proxy.yaml; do
+    if [[ -f "$f" ]]; then cp -p "$f" "$f$BACKUP_SUFFIX"; fi
+  done
+  trap rollback EXIT
+
+  printf '%s\n' "$compose" > docker-compose.yml
+  {
+    echo "NETBIRD_TRAFFIC_FLOW_ENABLED=${NETBIRD_TRAFFIC_FLOW}"
+    echo "NETBIRD_PROXY_ENABLED=${NETBIRD_PROXY}"
+    echo "NETBIRD_CROWDSEC_ENABLED=${NETBIRD_CROWDSEC}"
+    if [[ "$want_flow" == "yes" ]]; then render_env_flow; fi
+    if [[ "$want_proxy" == "yes" ]]; then render_env_proxy; fi
+  } | merge_env
+  if [[ "$want_flow" == "yes" ]] && ! grep -q '^  trafficFlow:' config.yaml; then
+    render_config_flow >> config.yaml
+  fi
+  mkdir -p traefik
+  if [[ "$want_proxy" == "yes" ]]; then
+    render_traefik_proxy > traefik/proxy.yaml
+  fi
+
+  up_all_but_proxy
+  if [[ "$want_flow" == "yes" ]]; then
+    # Compose does not notice changes to the bind-mounted config.yaml.
+    $DOCKER_COMPOSE_COMMAND restart netbird-server
+  fi
+  if [[ "$want_proxy" == "yes" ]]; then
+    start_proxy
+  fi
+  trap - EXIT
+
+  echo ""
+  echo "Done. The previous files are kept with the ${BACKUP_SUFFIX} suffix."
+  if [[ "$want_flow" == "yes" ]]; then
+    echo ""
+    echo "Traffic events still have to be turned on from the dashboard settings."
+    echo "  See https://docs.netbird.io/manage/activity/traffic-events-logging"
+  fi
+  if [[ "$want_proxy" == "yes" ]]; then
+    print_proxy_notes
+  fi
+  return
+}
+
+rollback() {
+  local f
+  echo "" > /dev/stderr
+  echo "Enabling failed. Restoring the previous configuration ..." > /dev/stderr
+  revoke_proxy_token
+  # Files without a backup were created by this run.
+  for f in "${STACK_FILES[@]}" traefik/proxy.yaml; do
+    if [[ -f "$f$BACKUP_SUFFIX" ]]; then cp -p "$f$BACKUP_SUFFIX" "$f"; else rm -f "$f"; fi
+  done
+  $DOCKER_COMPOSE_COMMAND up -d --remove-orphans
+  $DOCKER_COMPOSE_COMMAND restart netbird-server
+  return
 }
 
 # ------------------------------------------------------------------
@@ -307,22 +757,30 @@ NETBIRD_EULA_ACCEPTED=yes
 NETBIRD_EULA_ACCEPTED_AT=${NETBIRD_EULA_ACCEPTED_AT}
 NETBIRD_EULA_URL=${NETBIRD_EULA_URL}
 
-# Features (set by the script; don't edit without re-running)
+# Features (change with --enable-proxy or --enable-traffic-events, not by hand)
 NETBIRD_TRAFFIC_FLOW_ENABLED=${NETBIRD_TRAFFIC_FLOW}
+NETBIRD_PROXY_ENABLED=${NETBIRD_PROXY}
+NETBIRD_CROWDSEC_ENABLED=${NETBIRD_CROWDSEC}
 
 # Domain
 NETBIRD_DOMAIN=${NETBIRD_DOMAIN}
 
+# Reverse proxy (Traefik)
+NETBIRD_LETSENCRYPT_EMAIL=${NETBIRD_LETSENCRYPT_EMAIL}
+NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.7.14}
+NETBIRD_TRAEFIK_IP=${TRAEFIK_IP}
+
 # Image tags. Default to "latest"
 NETBIRD_DASHBOARD_TAG=${NETBIRD_DASHBOARD_TAG:-latest}
 NETBIRD_SERVER_TAG=${NETBIRD_SERVER_TAG:-latest}
 EOF
 
   if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
-    cat <<EOF
-NETBIRD_ENRICHER_TAG=${NETBIRD_ENRICHER_TAG:-latest}
-NETBIRD_RECEIVER_TAG=${NETBIRD_RECEIVER_TAG:-latest}
-EOF
+    render_env_flow
+  fi
+  if [[ "$NETBIRD_PROXY" == "yes" ]]; then
+    printf '\n# NetBird Proxy (token and bouncer key are filled in after startup)\n'
+    render_env_proxy
   fi
 
   cat <<EOF
@@ -356,17 +814,41 @@ NETBIRD_ENCRYPTION_KEY=${NETBIRD_ENCRYPTION_KEY}
 # Dashboard OIDC scopes
 NETBIRD_AUTH_SUPPORTED_SCOPES=${NETBIRD_AUTH_SUPPORTED_SCOPES:-openid profile email groups}
 EOF
+  return
+}
+
+render_env_flow() {
+  echo "NETBIRD_ENRICHER_TAG=${NETBIRD_ENRICHER_TAG:-latest}"
+  echo "NETBIRD_RECEIVER_TAG=${NETBIRD_RECEIVER_TAG:-latest}"
+  return
+}
+
+render_env_proxy() {
+  echo "NETBIRD_PROXY_TAG=${NETBIRD_PROXY_TAG:-latest}"
+  echo "NETBIRD_PROXY_TOKEN="
+  if [[ "$NETBIRD_CROWDSEC" == "yes" ]]; then
+    echo "NETBIRD_CROWDSEC_TAG=${NETBIRD_CROWDSEC_TAG:-v1.8.1}"
+    echo "NETBIRD_CROWDSEC_BOUNCER_KEY="
+  fi
+  return
 }
 
 render_docker_compose() {
-  render_compose_header
-  render_compose_common
-  render_compose_server
-  if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
-    render_compose_flow
-  fi
-  render_compose_postgres
-  render_compose_footer
+  {
+    render_compose_header
+    render_compose_common
+    render_compose_server
+    if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
+      render_compose_flow
+    fi
+    if [[ "$NETBIRD_PROXY" == "yes" ]]; then
+      render_compose_proxy
+    fi
+    render_compose_postgres
+    render_compose_footer
+  } | if [[ -n "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then cat; else sed '/NETBIRD_LICENSE_SERVER_BASE_URL/d'; fi \
+    | if [[ -n "$CUSTOM_TLS_CERTS" ]]; then sed -e '/certificatesresolvers/d' -e '/certresolver/d'; else cat; fi
+  return
 }
 
 render_compose_header() {
@@ -381,30 +863,97 @@ x-default: &default
 
 services:
 EOF
+  return
 }
 
 render_compose_common() {
   cat <<'EOF'
-  caddy:
+  # Reverse proxy with automatic TLS via Let's Encrypt. Routes are declared as
+  # labels on the services below and picked up through the Docker provider.
+  traefik:
     <<: *default
-    image: caddy:2
-    container_name: netbird-caddy
-    networks: [netbird]
-    environment:
-      - CADDY_SECURE_DOMAIN=${NETBIRD_DOMAIN}
+    image: traefik:${NETBIRD_TRAEFIK_TAG}
+    container_name: netbird-traefik
+    networks:
+      netbird:
+        ipv4_address: ${NETBIRD_TRAEFIK_IP}
+    command:
+      # Logging
+      - "--log.level=INFO"
+      - "--accesslog=true"
+      # Docker provider
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.docker.network=netbird"
+      # Entrypoints
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.websecure.allowACMEByPass=true"
+EOF
+  # Installs that predate these options have no header config; don't leave a blank line.
+  if [[ -n "$TRAEFIK_HEADER_CONFIG" ]]; then
+    printf '%s\n' "$TRAEFIK_HEADER_CONFIG"
+  fi
+  cat <<'EOF'
+      # readTimeout bounds the whole request, and gRPC streams / relay WebSockets
+      # never end one; idleTimeout would close the keep-alive connection they
+      # are reused over. Entrypoint-wide is the only scope Traefik offers here.
+      # writeTimeout is left alone: it already defaults to 0.
+      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
+      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
+      # HTTP to HTTPS redirect
+      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+      # Let's Encrypt ACME
+      - "--certificatesresolvers.letsencrypt.acme.email=${NETBIRD_LETSENCRYPT_EMAIL}"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+      # Dynamic config in ./traefik: the proxy transport and an optional custom certificate
+      - "--providers.file.directory=/etc/traefik/dynamic"
     ports:
       - '443:443'
-      - '443:443/udp'
       - '80:80'
     volumes:
-      - netbird_caddy_data:/data
-      - ./Caddyfile:/etc/caddy/Caddyfile
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - netbird_traefik_letsencrypt:/letsencrypt
+      - ./traefik:/etc/traefik/dynamic:ro
+EOF
+  if [[ -n "$CUSTOM_TLS_CERTS" ]]; then
+    echo "      - ${CUSTOM_TLS_CERTS}:/certs:ro"
+  fi
+  cat <<'EOF'
+    labels:
+      - traefik.enable=true
+      # Shared security headers, referenced by every NetBird router below. A
+      # label-declared middleware only exists while its container runs, so this
+      # lives on Traefik itself: declaring it on an app container would drop
+      # every router referencing it whenever that container restarts.
+      - traefik.http.middlewares.nb-security.headers.stsSeconds=3600
+      - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true
+      - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true
+      - traefik.http.middlewares.nb-security.headers.browserXssFilter=true
+      - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin
+      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN
+      # Empty value strips the header. Only the dashboard's nginx sets one; the
+      # server emits none. Do not quote it — "" would send a literal Server: "".
+      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.Server=
 
   dashboard:
     <<: *default
     image: ghcr.io/netbirdio/dashboard-cloud:${NETBIRD_DASHBOARD_TAG}
     container_name: netbird-dashboard
     networks: [netbird]
+    labels:
+      - traefik.enable=true
+      # Dashboard catch-all: lowest priority so every route below wins
+      - traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN}`)
+      - traefik.http.routers.netbird-dashboard.entrypoints=websecure
+      - traefik.http.routers.netbird-dashboard.tls=true
+      - traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-dashboard.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-dashboard.service=dashboard
+      - traefik.http.routers.netbird-dashboard.priority=1
+      - traefik.http.services.dashboard.loadbalancer.server.port=80
     environment:
       - NETBIRD_MGMT_API_ENDPOINT=https://${NETBIRD_DOMAIN}
       - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${NETBIRD_DOMAIN}
@@ -422,6 +971,7 @@ render_compose_common() {
       - LETSENCRYPT_EMAIL=
 
 EOF
+  return
 }
 
 render_compose_server() {
@@ -442,11 +992,34 @@ render_compose_server() {
       - netbird_data:/var/lib/netbird
       - ./config.yaml:/etc/netbird/config.yaml
     command: ["--config", "/etc/netbird/config.yaml"]
+    labels:
+      - traefik.enable=true
+      # Signal + Management gRPC (needs an h2c backend for HTTP/2 cleartext)
+      - traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
+      - traefik.http.routers.netbird-grpc.entrypoints=websecure
+      - traefik.http.routers.netbird-grpc.tls=true
+      - traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-grpc.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-grpc.service=netbird-server-h2c
+      - traefik.http.routers.netbird-grpc.priority=100
+      # Relay WebSocket, management API, and the embedded IdP
+      - traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      - traefik.http.routers.netbird-backend.entrypoints=websecure
+      - traefik.http.routers.netbird-backend.tls=true
+      - traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-backend.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-backend.service=netbird-server
+      - traefik.http.routers.netbird-backend.priority=100
+      # Services
+      - traefik.http.services.netbird-server.loadbalancer.server.port=80
+      - traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80
+      - traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c
     environment:
       - NB_LICENSE_KEY=${NETBIRD_LICENSE_KEY}
       - NETBIRD_LICENSE_SERVER_BASE_URL=${NETBIRD_LICENSE_SERVER_BASE_URL}
 
 EOF
+  return
 }
 
 render_compose_flow() {
@@ -504,8 +1077,85 @@ render_compose_flow() {
       - NB_FLOW_NATS_ENDPOINTS=nats://nats:4222
       - NB_FLOW_NATS_STREAM=traffic-events
       - NB_FLOW_AUTH_SECRET=${NETBIRD_RELAY_AUTH_SECRET}
+    labels:
+      - traefik.enable=true
+      # Flow receiver gRPC (h2c backend)
+      - traefik.http.routers.netbird-flow.rule=Host(`${NETBIRD_DOMAIN}`) && PathPrefix(`/flow.FlowService/`)
+      - traefik.http.routers.netbird-flow.entrypoints=websecure
+      - traefik.http.routers.netbird-flow.tls=true
+      - traefik.http.routers.netbird-flow.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-flow.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-flow.service=netbird-flow-h2c
+      - traefik.http.routers.netbird-flow.priority=100
+      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.port=80
+      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.scheme=h2c
 
 EOF
+  return
+}
+
+render_compose_proxy() {
+  cat <<'EOF'
+  # Traefik passes TLS for every other domain through to the proxy, which issues
+  # its own certificates. PROXY protocol v2 preserves the client IP.
+  proxy:
+    <<: *default
+    image: ghcr.io/netbirdio/reverse-proxy:${NETBIRD_PROXY_TAG}
+    container_name: netbird-proxy
+    networks: [netbird]
+    depends_on:
+      netbird-server:
+        condition: service_started
+    ports:
+      - '51820:51820/udp'
+    volumes:
+      - netbird_proxy_certs:/certs
+    labels:
+      - traefik.enable=true
+      - traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`)
+      - traefik.tcp.routers.proxy-passthrough.entrypoints=websecure
+      - traefik.tcp.routers.proxy-passthrough.tls.passthrough=true
+      - traefik.tcp.routers.proxy-passthrough.service=proxy-tls
+      - traefik.tcp.routers.proxy-passthrough.priority=1
+      - traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443
+      - traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file
+    environment:
+      # Plaintext gRPC over the internal network, not the public address.
+      - NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80
+      - NB_PROXY_ALLOW_INSECURE=true
+      - NB_PROXY_TOKEN=${NETBIRD_PROXY_TOKEN}
+      - NB_PROXY_DOMAIN=${NETBIRD_DOMAIN}
+      - NB_PROXY_ADDRESS=:8443
+      - NB_PROXY_CERTIFICATE_DIRECTORY=/certs
+      - NB_PROXY_ACME_CERTIFICATES=true
+      - NB_PROXY_FORWARDED_PROTO=https
+      - NB_PROXY_PROXY_PROTOCOL=true
+      - NB_PROXY_TRUSTED_PROXIES=${NETBIRD_TRAEFIK_IP}
+EOF
+  if [[ "$NETBIRD_CROWDSEC" == "yes" ]]; then
+    cat <<'EOF'
+      - NB_PROXY_CROWDSEC_API_URL=http://crowdsec:8080
+      - NB_PROXY_CROWDSEC_API_KEY=${NETBIRD_CROWDSEC_BOUNCER_KEY}
+
+  crowdsec:
+    <<: *default
+    image: crowdsecurity/crowdsec:${NETBIRD_CROWDSEC_TAG}
+    container_name: netbird-crowdsec
+    networks: [netbird]
+    environment:
+      - COLLECTIONS=crowdsecurity/linux
+    volumes:
+      - netbird_crowdsec_config:/etc/crowdsec
+      - netbird_crowdsec_data:/var/lib/crowdsec/data
+    healthcheck:
+      test: ["CMD", "cscli", "lapi", "status"]
+      interval: 10s
+      timeout: 5s
+      retries: 15
+EOF
+  fi
+  echo ""
+  return
 }
 
 render_compose_postgres() {
@@ -528,6 +1178,7 @@ render_compose_postgres() {
       - netbird_postgres:/var/lib/postgresql/data
 
 EOF
+  return
 }
 
 render_compose_footer() {
@@ -541,64 +1192,26 @@ EOF
   netbird_enricher:
 EOF
   fi
+  if [[ "$NETBIRD_PROXY" == "yes" ]]; then
+    echo "  netbird_proxy_certs:"
+  fi
+  if [[ "$NETBIRD_CROWDSEC" == "yes" ]]; then
+    printf '  %s:\n' netbird_crowdsec_config netbird_crowdsec_data
+  fi
   cat <<'EOF'
   netbird_postgres:
-  netbird_caddy_data:
+  netbird_traefik_letsencrypt:
 
 networks:
   netbird:
+    name: netbird
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.30.0.0/24
+          gateway: 172.30.0.1
 EOF
-}
-
-render_caddyfile() {
-  cat <<'EOF'
-{
-  servers :80,:443 {
-    protocols h1 h2c h2 h3
-  }
-}
-
-(security_headers) {
-    header * {
-        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
-        X-Content-Type-Options "nosniff"
-        X-Frame-Options "SAMEORIGIN"
-        X-XSS-Protection "1; mode=block"
-        -Server
-        Referrer-Policy strict-origin-when-cross-origin
-    }
-}
-
-:80 {
-    redir https://{$CADDY_SECURE_DOMAIN}{uri} permanent
-}
-
-{$CADDY_SECURE_DOMAIN}:443 {
-    import security_headers
-    # Signal (gRPC over h2c)
-    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-server:80
-    # Management (gRPC over h2c + HTTP)
-    reverse_proxy /management.ManagementService/* h2c://netbird-server:80
-    reverse_proxy /api/* netbird-server:80
-    reverse_proxy /ws-proxy/* netbird-server:80
-    # Embedded IdP (OAuth2 endpoints served by netbird server)
-    reverse_proxy /oauth2/* netbird-server:80
-    # Relay (WebSocket multiplexed on the same port)
-    reverse_proxy /relay* netbird-server:80
-EOF
-
-  if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
-    cat <<'EOF'
-    # Flow receiver (gRPC over h2c)
-    reverse_proxy /flow.FlowService/* h2c://receiver:80
-EOF
-  fi
-
-  cat <<'EOF'
-    # Dashboard
-    reverse_proxy /* dashboard:80
-}
-EOF
+  return
 }
 
 render_config_yaml() {
@@ -616,7 +1229,7 @@ server:
   logLevel: "info"
   logFile: "console"
 
-  # TLS is terminated by Caddy in front; leave this block empty.
+  # TLS is terminated by Traefik in front; leave this block empty.
   tls:
     certFile: ""
     keyFile: ""
@@ -633,12 +1246,23 @@ server:
     issuer: "https://${NETBIRD_DOMAIN}/oauth2"
     localAuthDisabled: false
     signKeyRefreshEnabled: false
+    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"
     dashboardRedirectURIs:
       - "https://${NETBIRD_DOMAIN}/nb-auth"
       - "https://${NETBIRD_DOMAIN}/nb-silent-auth"
     cliRedirectURIs:
       - "http://localhost:53000/"
 
+  # Trust X-Forwarded-* only from the Traefik container's static address. Both
+  # keys must stay in step with the ipv4_address pinned in docker-compose.yml:
+  # trustedPeers restricts which sources may supply forwarded headers. Leaving
+  # it unset trusts all IPv4 and IPv6 sources.
+  reverseProxy:
+    trustedPeers:
+      - "${TRAEFIK_IP}/32"
+    trustedHTTPProxies:
+      - "${TRAEFIK_IP}/32"
+
   store:
     engine: "postgres"
     dsn: "${POSTGRES_DSN}"
@@ -650,14 +1274,70 @@ server:
 EOF
 
   if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
-    cat <<EOF
+    render_config_flow
+  fi
+  return
+}
+
+render_config_flow() {
+  cat <<EOF
 
   trafficFlow:
     enabled: true
     address: "https://${NETBIRD_DOMAIN}:443"
     interval: "60s"
 EOF
-  fi
+  return
 }
 
-init_environment
+render_traefik_proxy() {
+  cat <<'EOF'
+tcp:
+  serversTransports:
+    pp-v2:
+      proxyProtocol:
+        version: 2
+EOF
+  return
+}
+
+usage() {
+  cat <<EOF
+Usage: $0 [--enable-proxy] [--enable-traffic-events]
+
+Without flags, bootstraps a new NetBird Enterprise stack in the current
+directory. With flags, turns the feature on for the existing installation in
+the current directory.
+
+  --enable-proxy           add the NetBird Proxy, optionally with CrowdSec
+  --enable-traffic-events  add traffic events logging (NATS, receiver, enricher)
+  -h, --help               show this help
+EOF
+  return
+}
+
+main() {
+  local enable_proxy="no" enable_flow="no"
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --enable-proxy) enable_proxy="yes" ;;
+      --enable-traffic-events) enable_flow="yes" ;;
+      -h | --help) usage; exit 0 ;;
+      *) usage > /dev/stderr; exit 1 ;;
+    esac
+    shift
+  done
+
+  if [[ "$enable_proxy" == "no" && "$enable_flow" == "no" ]]; then
+    init_environment
+  else
+    enable_features "$enable_proxy" "$enable_flow"
+  fi
+  return
+}
+
+if [[ "${BASH_SOURCE[0]:-$0}" == "$0" ]]; then
+  set -e
+  set -o pipefail
+  main "$@"
+fi
diff --git a/infrastructure_files/getting-started-with-dex.sh b/infrastructure_files/getting-started-with-dex.sh
index 5e605f19c..a9be19eb3 100755
--- a/infrastructure_files/getting-started-with-dex.sh
+++ b/infrastructure_files/getting-started-with-dex.sh
@@ -1,557 +1,19 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
-set -e
+cat >&2 <<'EOF'
+ERROR: This legacy installation script has been retired and no longer runs.
 
-# NetBird Getting Started with Dex IDP
-# This script sets up NetBird with Dex as the identity provider
+Dex support is not deprecated. For new deployments, use getting-started.sh:
 
-# Sed pattern to strip base64 padding characters
-SED_STRIP_PADDING='s/=//g'
+https://docs.netbird.io/selfhosted/selfhosted-quickstart
 
-check_docker_compose() {
-  if command -v docker-compose &> /dev/null
-  then
-      echo "docker-compose"
-      return
-  fi
-  if docker compose --help &> /dev/null
-  then
-      echo "docker compose"
-      return
-  fi
+The current installer includes NetBird's embedded Dex-based identity provider.
+Local users and external identity providers can be managed through the
+NetBird Dashboard:
 
-  echo "docker-compose is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/engine/install/" > /dev/stderr
-  exit 1
-}
+https://docs.netbird.io/selfhosted/identity-providers/local
 
-check_jq() {
-  if ! command -v jq &> /dev/null
-  then
-    echo "jq is not installed or not in PATH, please install with your package manager. e.g. sudo apt install jq" > /dev/stderr
-    exit 1
-  fi
-  return 0
-}
-
-get_main_ip_address() {
-  if [[ "$OSTYPE" == "darwin"* ]]; then
-    interface=$(route -n get default | grep 'interface:' | awk '{print $2}')
-    ip_address=$(ifconfig "$interface" | grep 'inet ' | awk '{print $2}')
-  else
-    interface=$(ip route | grep default | awk '{print $5}' | head -n 1)
-    ip_address=$(ip addr show "$interface" | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)
-  fi
-
-  echo "$ip_address"
-  return 0
-}
-
-check_nb_domain() {
-  DOMAIN=$1
-  if [[ "$DOMAIN-x" == "-x" ]]; then
-    echo "The NETBIRD_DOMAIN variable cannot be empty." > /dev/stderr
-    return 1
-  fi
-
-  if [[ "$DOMAIN" == "netbird.example.com" ]]; then
-    echo "The NETBIRD_DOMAIN cannot be netbird.example.com" > /dev/stderr
-    return 1
-  fi
-  return 0
-}
-
-read_nb_domain() {
-  READ_NETBIRD_DOMAIN=""
-  echo -n "Enter the domain you want to use for NetBird (e.g. netbird.my-domain.com): " > /dev/stderr
-  read -r READ_NETBIRD_DOMAIN < /dev/tty
-  if ! check_nb_domain "$READ_NETBIRD_DOMAIN"; then
-    read_nb_domain
-  fi
-  echo "$READ_NETBIRD_DOMAIN"
-  return 0
-}
-
-get_turn_external_ip() {
-  TURN_EXTERNAL_IP_CONFIG="#external-ip="
-  IP=$(curl -s -4 https://jsonip.com | jq -r '.ip')
-  if [[ "x-$IP" != "x-" ]]; then
-    TURN_EXTERNAL_IP_CONFIG="external-ip=$IP"
-  fi
-  echo "$TURN_EXTERNAL_IP_CONFIG"
-  return 0
-}
-
-wait_dex() {
-  set +e
-  echo -n "Waiting for Dex to become ready (via $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN)"
-  counter=1
-  while true; do
-    # Check Dex through Caddy proxy (also validates TLS is working)
-    if curl -sk -f -o /dev/null "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/.well-known/openid-configuration" 2>/dev/null; then
-      break
-    fi
-    if [[ $counter -eq 60 ]]; then
-      echo ""
-      echo "Taking too long. Checking logs..."
-      $DOCKER_COMPOSE_COMMAND logs --tail=20 caddy
-      $DOCKER_COMPOSE_COMMAND logs --tail=20 dex
-    fi
-    echo -n " ."
-    sleep 2
-    counter=$((counter + 1))
-  done
-  echo " done"
-  set -e
-  return 0
-}
-
-init_environment() {
-  CADDY_SECURE_DOMAIN=""
-  NETBIRD_PORT=80
-  NETBIRD_HTTP_PROTOCOL="http"
-  NETBIRD_RELAY_PROTO="rel"
-  TURN_USER="self"
-  TURN_PASSWORD=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-  NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-  TURN_MIN_PORT=49152
-  TURN_MAX_PORT=65535
-  TURN_EXTERNAL_IP_CONFIG=$(get_turn_external_ip)
-
-  # Generate secrets for Dex
-  DEX_DASHBOARD_CLIENT_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-
-  # Generate admin password
-  NETBIRD_ADMIN_PASSWORD=$(openssl rand -base64 16 | sed "$SED_STRIP_PADDING")
-
-  if ! check_nb_domain "$NETBIRD_DOMAIN"; then
-    NETBIRD_DOMAIN=$(read_nb_domain)
-  fi
-
-  if [[ "$NETBIRD_DOMAIN" == "use-ip" ]]; then
-    NETBIRD_DOMAIN=$(get_main_ip_address)
-  else
-    NETBIRD_PORT=443
-    CADDY_SECURE_DOMAIN=", $NETBIRD_DOMAIN:$NETBIRD_PORT"
-    NETBIRD_HTTP_PROTOCOL="https"
-    NETBIRD_RELAY_PROTO="rels"
-  fi
-
-  check_jq
-
-  DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
-
-  if [[ -f dex.yaml ]]; then
-    echo "Generated files already exist, if you want to reinitialize the environment, please remove them first."
-    echo "You can use the following commands:"
-    echo "  $DOCKER_COMPOSE_COMMAND down --volumes # to remove all containers and volumes"
-    echo "  rm -f docker-compose.yml Caddyfile dex.yaml dashboard.env turnserver.conf management.json relay.env"
-    echo "Be aware that this will remove all data from the database, and you will have to reconfigure the dashboard."
-    exit 1
-  fi
-
-  echo Rendering initial files...
-  render_docker_compose > docker-compose.yml
-  render_caddyfile > Caddyfile
-  render_dex_config > dex.yaml
-  render_dashboard_env > dashboard.env
-  render_management_json > management.json
-  render_turn_server_conf > turnserver.conf
-  render_relay_env > relay.env
-
-  echo -e "\nStarting Dex IDP\n"
-  $DOCKER_COMPOSE_COMMAND up -d caddy dex
-
-  # Wait for Dex to be ready (through caddy proxy)
-  sleep 3
-  wait_dex
-
-  echo -e "\nStarting NetBird services\n"
-  $DOCKER_COMPOSE_COMMAND up -d
-
-  echo -e "\nDone!\n"
-  echo "You can access the NetBird dashboard at $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN"
-  echo ""
-  echo "Login with the following credentials:"
-  install -m 600 /dev/null .env
-  printf 'Email: admin@%s\nPassword: %s\n' \
-      "$NETBIRD_DOMAIN" "$NETBIRD_ADMIN_PASSWORD" >> .env
-  echo "Email: admin@$NETBIRD_DOMAIN"
-  echo "Password: $NETBIRD_ADMIN_PASSWORD"
-  echo ""
-  echo "Dex admin UI is not available (Dex has no built-in UI)."
-  echo "To add more users, edit dex.yaml and restart: $DOCKER_COMPOSE_COMMAND restart dex"
-  return 0
-}
-
-render_caddyfile() {
-  cat <<EOF
-{
-  debug
-  servers :80,:443 {
-    protocols h1 h2c h2 h3
-  }
-}
-
-(security_headers) {
-    header * {
-        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
-        X-Content-Type-Options "nosniff"
-        X-Frame-Options "SAMEORIGIN"
-        X-XSS-Protection "1; mode=block"
-        -Server
-        Referrer-Policy strict-origin-when-cross-origin
-    }
-}
-
-:80${CADDY_SECURE_DOMAIN} {
-    import security_headers
-    # Relay
-    reverse_proxy /relay* relay:80
-    # Signal
-    reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000
-    # Management
-    reverse_proxy /api/* management:80
-    reverse_proxy /management.ManagementService/* h2c://management:80
-    # Dex
-    reverse_proxy /dex/* dex:5556
-    # Dashboard
-    reverse_proxy /* dashboard:80
-}
+This compatibility notice will be removed in NetBird v0.80.
 EOF
-  return 0
-}
 
-render_dex_config() {
-  # Generate bcrypt hash of the admin password
-  # Using a simple approach - htpasswd or python if available
-  ADMIN_PASSWORD_HASH=""
-  if command -v htpasswd &> /dev/null; then
-    ADMIN_PASSWORD_HASH=$(htpasswd -bnBC 10 "" "$NETBIRD_ADMIN_PASSWORD" | tr -d ':\n')
-  elif command -v python3 &> /dev/null; then
-    ADMIN_PASSWORD_HASH=$(python3 -c "import bcrypt; print(bcrypt.hashpw('$NETBIRD_ADMIN_PASSWORD'.encode(), bcrypt.gensalt(rounds=10)).decode())" 2>/dev/null || echo "")
-  fi
-
-  # Fallback to a known hash if we can't generate one
-  if [[ -z "$ADMIN_PASSWORD_HASH" ]]; then
-    # This is hash of "password" - user should change it
-    ADMIN_PASSWORD_HASH='$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W'
-    NETBIRD_ADMIN_PASSWORD="password"
-    echo "Warning: Could not generate password hash. Using default password: password. Please change it in dex.yaml" > /dev/stderr
-  fi
-
-  cat <<EOF
-# Dex configuration for NetBird
-# Generated by getting-started-with-dex.sh
-
-issuer: $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex
-
-storage:
-  type: sqlite3
-  config:
-    file: /var/dex/dex.db
-
-web:
-  http: 0.0.0.0:5556
-
-# gRPC API for user management (used by NetBird IDP manager)
-grpc:
-  addr: 0.0.0.0:5557
-
-oauth2:
-  skipApprovalScreen: true
-
-# Static OAuth2 clients for NetBird
-staticClients:
-  # Dashboard client
-  - id: netbird-dashboard
-    name: NetBird Dashboard
-    secret: $DEX_DASHBOARD_CLIENT_SECRET
-    redirectURIs:
-      - $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth
-      - $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth
-
-  # CLI client (public - uses PKCE)
-  - id: netbird-cli
-    name: NetBird CLI
-    public: true
-    redirectURIs:
-      - http://localhost:53000/
-      - http://localhost:54000/
-
-# Enable password database for static users
-enablePasswordDB: true
-
-# Static users - add more users here as needed
-staticPasswords:
-  - email: "admin@$NETBIRD_DOMAIN"
-    hash: "$ADMIN_PASSWORD_HASH"
-    username: "admin"
-    userID: "$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || echo "admin-user-id-001")"
-
-# Optional: Add external identity provider connectors
-# connectors:
-#   - type: github
-#     id: github
-#     name: GitHub
-#     config:
-#       clientID: \$GITHUB_CLIENT_ID
-#       clientSecret: \$GITHUB_CLIENT_SECRET
-#       redirectURI: $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/callback
-#
-#   - type: ldap
-#     id: ldap
-#     name: LDAP
-#     config:
-#       host: ldap.example.com:636
-#       insecureNoSSL: false
-#       bindDN: cn=admin,dc=example,dc=com
-#       bindPW: admin
-#       userSearch:
-#         baseDN: ou=users,dc=example,dc=com
-#         filter: "(objectClass=person)"
-#         username: uid
-#         idAttr: uid
-#         emailAttr: mail
-#         nameAttr: cn
-EOF
-  return 0
-}
-
-render_turn_server_conf() {
-  cat <<EOF
-listening-port=3478
-$TURN_EXTERNAL_IP_CONFIG
-tls-listening-port=5349
-min-port=$TURN_MIN_PORT
-max-port=$TURN_MAX_PORT
-fingerprint
-lt-cred-mech
-user=$TURN_USER:$TURN_PASSWORD
-realm=wiretrustee.com
-cert=/etc/coturn/certs/cert.pem
-pkey=/etc/coturn/private/privkey.pem
-log-file=stdout
-no-software-attribute
-pidfile="/var/tmp/turnserver.pid"
-no-cli
-EOF
-  return 0
-}
-
-render_management_json() {
-  cat <<EOF
-{
-    "Stuns": [
-        {
-            "Proto": "udp",
-            "URI": "stun:$NETBIRD_DOMAIN:3478"
-        }
-    ],
-    "Relay": {
-        "Addresses": ["$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT"],
-        "CredentialsTTL": "24h",
-        "Secret": "$NETBIRD_RELAY_AUTH_SECRET"
-    },
-    "Signal": {
-        "Proto": "$NETBIRD_HTTP_PROTOCOL",
-        "URI": "$NETBIRD_DOMAIN:$NETBIRD_PORT"
-    },
-    "HttpConfig": {
-        "AuthIssuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex",
-        "AuthAudience": "netbird-dashboard",
-        "OIDCConfigEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/.well-known/openid-configuration"
-    },
-    "IdpManagerConfig": {
-        "ManagerType": "dex",
-        "ClientConfig": {
-            "Issuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex"
-        },
-        "ExtraConfig": {
-            "GRPCAddr": "dex:5557"
-        }
-    },
-    "DeviceAuthorizationFlow": {
-        "Provider": "hosted",
-        "ProviderConfig": {
-            "Audience": "netbird-cli",
-            "ClientID": "netbird-cli",
-            "Scope": "openid profile email offline_access",
-            "DeviceAuthEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/device/code",
-            "TokenEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/token"
-        }
-    },
-    "PKCEAuthorizationFlow": {
-        "ProviderConfig": {
-            "Audience": "netbird-cli",
-            "ClientID": "netbird-cli",
-            "Scope": "openid profile email offline_access",
-            "RedirectURLs": ["http://localhost:53000/", "http://localhost:54000/"]
-        }
-    }
-}
-EOF
-  return 0
-}
-
-render_dashboard_env() {
-  cat <<EOF
-# Endpoints
-NETBIRD_MGMT_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-NETBIRD_MGMT_GRPC_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-# OIDC
-AUTH_AUDIENCE=netbird-dashboard
-AUTH_CLIENT_ID=netbird-dashboard
-AUTH_CLIENT_SECRET=$DEX_DASHBOARD_CLIENT_SECRET
-AUTH_AUTHORITY=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex
-USE_AUTH0=false
-AUTH_SUPPORTED_SCOPES=openid profile email offline_access
-AUTH_REDIRECT_URI=/nb-auth
-AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
-# SSL
-NGINX_SSL_PORT=443
-# Letsencrypt
-LETSENCRYPT_DOMAIN=none
-EOF
-  return 0
-}
-
-render_relay_env() {
-  cat <<EOF
-NB_LOG_LEVEL=info
-NB_LISTEN_ADDRESS=:80
-NB_EXPOSED_ADDRESS=$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT
-NB_AUTH_SECRET=$NETBIRD_RELAY_AUTH_SECRET
-EOF
-  return 0
-}
-
-render_docker_compose() {
-  cat <<EOF
-services:
-  # Caddy reverse proxy
-  caddy:
-    image: caddy
-    container_name: netbird-caddy
-    restart: unless-stopped
-    networks: [netbird]
-    ports:
-      - '443:443'
-      - '443:443/udp'
-      - '80:80'
-    volumes:
-      - netbird_caddy_data:/data
-      - ./Caddyfile:/etc/caddy/Caddyfile
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Dex - identity provider
-  dex:
-    image: ghcr.io/dexidp/dex:v2.38.0
-    container_name: netbird-dex
-    restart: unless-stopped
-    networks: [netbird]
-    volumes:
-      - ./dex.yaml:/etc/dex/config.docker.yaml:ro
-      - netbird_dex_data:/var/dex
-    command: ["dex", "serve", "/etc/dex/config.docker.yaml"]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # UI dashboard
-  dashboard:
-    image: netbirdio/dashboard:latest
-    container_name: netbird-dashboard
-    restart: unless-stopped
-    networks: [netbird]
-    env_file:
-      - ./dashboard.env
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Signal
-  signal:
-    image: netbirdio/signal:latest
-    container_name: netbird-signal
-    restart: unless-stopped
-    networks: [netbird]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Relay
-  relay:
-    image: netbirdio/relay:latest
-    container_name: netbird-relay
-    restart: unless-stopped
-    networks: [netbird]
-    env_file:
-      - ./relay.env
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Management
-  management:
-    image: netbirdio/management:latest
-    container_name: netbird-management
-    restart: unless-stopped
-    networks: [netbird]
-    volumes:
-      - netbird_management:/var/lib/netbird
-      - ./management.json:/etc/netbird/management.json
-    command: [
-      "--port", "80",
-      "--log-file", "console",
-      "--log-level", "info",
-      "--disable-anonymous-metrics=false",
-      "--single-account-mode-domain=netbird.selfhosted",
-      "--dns-domain=netbird.selfhosted",
-      "--idp-sign-key-refresh-enabled",
-    ]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Coturn, AKA TURN server
-  coturn:
-    image: coturn/coturn
-    container_name: netbird-coturn
-    restart: unless-stopped
-    volumes:
-      - ./turnserver.conf:/etc/turnserver.conf:ro
-    network_mode: host
-    command:
-      - -c /etc/turnserver.conf
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-volumes:
-  netbird_caddy_data:
-  netbird_dex_data:
-  netbird_management:
-
-networks:
-  netbird:
-EOF
-  return 0
-}
-
-init_environment
+exit 1
diff --git a/infrastructure_files/getting-started-with-zitadel.sh b/infrastructure_files/getting-started-with-zitadel.sh
index f503cbeac..e026c1dc7 100644
--- a/infrastructure_files/getting-started-with-zitadel.sh
+++ b/infrastructure_files/getting-started-with-zitadel.sh
@@ -1,993 +1,26 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
-set -e
+cat >&2 <<'EOF'
+ERROR: This legacy installation script has been retired and no longer runs.
 
-handle_request_command_status() {
-  PARSED_RESPONSE=$1
-  FUNCTION_NAME=$2
-  RESPONSE=$3
-  if [[ $PARSED_RESPONSE -ne 0 ]]; then
-    echo "ERROR calling $FUNCTION_NAME:" $(echo "$RESPONSE" | jq -r '.message') > /dev/stderr
-    exit 1
-  fi
-}
+Zitadel support and existing Zitadel deployments are not deprecated.
 
-handle_zitadel_request_response() {
-  PARSED_RESPONSE=$1
-  FUNCTION_NAME=$2
-  RESPONSE=$3
-  if [[ $PARSED_RESPONSE == "null" ]]; then
-    echo "ERROR calling $FUNCTION_NAME:" $(echo "$RESPONSE" | jq -r '.message') > /dev/stderr
-    exit 1
-  fi
-  sleep 1
-}
+For new deployments, use getting-started.sh:
 
-check_docker_compose() {
-  if command -v docker-compose &> /dev/null
-  then
-      echo "docker-compose"
-      return
-  fi
-  if docker compose --help &> /dev/null
-  then
-      echo "docker compose"
-      return
-  fi
+https://docs.netbird.io/selfhosted/selfhosted-quickstart
 
-  echo "docker-compose is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/engine/install/" > /dev/stderr
-  exit 1
-}
+The current installer includes NetBird's embedded Dex-based identity provider.
+Zitadel can be added as an external identity provider directly through the
+NetBird Dashboard:
 
-check_jq() {
-  if ! command -v jq &> /dev/null
-  then
-    echo "jq is not installed or not in PATH, please install with your package manager. e.g. sudo apt install jq" > /dev/stderr
-    exit 1
-  fi
-}
+https://docs.netbird.io/selfhosted/identity-providers/zitadel
 
-wait_crdb() {
-  set +e
-  while true; do
-    if $DOCKER_COMPOSE_COMMAND exec -T zdb curl -sf -o /dev/null 'http://localhost:8080/health?ready=1'; then
-      break
-    fi
-    echo -n " ."
-    sleep 5
-  done
-  echo " done"
-  set -e
-}
+Standalone Zitadel and other custom identity-provider deployments remain
+supported through the advanced guide:
 
-init_crdb() {
-  if [[ $ZITADEL_DATABASE == "cockroach" ]]; then
-    echo -e "\nInitializing Zitadel's CockroachDB\n\n"
-    $DOCKER_COMPOSE_COMMAND up -d zdb
-    echo ""
-    # shellcheck disable=SC2028
-    echo -n "Waiting CockroachDB to become ready"
-    wait_crdb
-    $DOCKER_COMPOSE_COMMAND exec -T zdb /bin/bash -c "cp /cockroach/certs/* /zitadel-certs/ && cockroach cert create-client --overwrite --certs-dir /zitadel-certs/ --ca-key /zitadel-certs/ca.key zitadel_user && chown -R 1000:1000 /zitadel-certs/"
-    handle_request_command_status $? "init_crdb failed" ""
-  fi
-}
+https://docs.netbird.io/selfhosted/selfhosted-guide
 
-get_main_ip_address() {
-  if [[ "$OSTYPE" == "darwin"* ]]; then
-    interface=$(route -n get default | grep 'interface:' | awk '{print $2}')
-    ip_address=$(ifconfig "$interface" | grep 'inet ' | awk '{print $2}')
-  else
-    interface=$(ip route | grep default | awk '{print $5}' | head -n 1)
-    ip_address=$(ip addr show "$interface" | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)
-  fi
-
-  echo "$ip_address"
-}
-
-wait_pat() {
-  PAT_PATH=$1
-  set +e
-  while true; do
-    if [[ -f "$PAT_PATH" ]]; then
-      break
-    fi
-    echo -n " ."
-    sleep 1
-  done
-  echo " done"
-  set -e
-}
-
-wait_api() {
-    INSTANCE_URL=$1
-    PAT=$2
-    set +e
-    counter=1
-    while true; do
-      FLAGS="-s"
-      if [[ $counter -eq 45 ]]; then
-        FLAGS="-v"
-        echo ""
-      fi
-
-      curl $FLAGS --fail --connect-timeout 1 -o /dev/null "$INSTANCE_URL/auth/v1/users/me" -H "Authorization: Bearer $PAT"
-      if [[ $? -eq 0 ]]; then
-        break
-      fi
-      if [[ $counter -eq 45 ]]; then
-        echo ""
-        echo "Unable to connect to Zitadel for more than 45s, please check the output above, your firewall rules and the caddy container logs to confirm if there are any issues provisioning TLS certificates"
-      fi
-      echo -n " ."
-      sleep 1
-      counter=$((counter + 1))
-    done
-    echo " done"
-    set -e
-}
-
-create_new_project() {
-  INSTANCE_URL=$1
-  PAT=$2
-  PROJECT_NAME="NETBIRD"
-
-  RESPONSE=$(
-    curl -sS -X POST "$INSTANCE_URL/management/v1/projects" \
-      -H "Authorization: Bearer $PAT" \
-      -H "Content-Type: application/json" \
-      -d '{"name": "'"$PROJECT_NAME"'"}'
-  )
-  PARSED_RESPONSE=$(echo "$RESPONSE" | jq -r '.id')
-  handle_zitadel_request_response "$PARSED_RESPONSE" "create_new_project" "$RESPONSE"
-  echo "$PARSED_RESPONSE"
-}
-
-create_new_application() {
-  INSTANCE_URL=$1
-  PAT=$2
-  APPLICATION_NAME=$3
-  BASE_REDIRECT_URL1=$4
-  BASE_REDIRECT_URL2=$5
-  LOGOUT_URL=$6
-  ZITADEL_DEV_MODE=$7
-  DEVICE_CODE=$8
-
-  if [[ $DEVICE_CODE == "true" ]]; then
-    GRANT_TYPES='["OIDC_GRANT_TYPE_AUTHORIZATION_CODE","OIDC_GRANT_TYPE_DEVICE_CODE","OIDC_GRANT_TYPE_REFRESH_TOKEN"]'
-  else
-    GRANT_TYPES='["OIDC_GRANT_TYPE_AUTHORIZATION_CODE","OIDC_GRANT_TYPE_REFRESH_TOKEN"]'
-  fi
-
-  RESPONSE=$(
-    curl -sS -X POST "$INSTANCE_URL/management/v1/projects/$PROJECT_ID/apps/oidc" \
-      -H "Authorization: Bearer $PAT" \
-      -H "Content-Type: application/json" \
-      -d '{
-    "name": "'"$APPLICATION_NAME"'",
-    "redirectUris": [
-      "'"$BASE_REDIRECT_URL1"'",
-      "'"$BASE_REDIRECT_URL2"'"
-    ],
-    "postLogoutRedirectUris": [
-      "'"$LOGOUT_URL"'"
-    ],
-    "RESPONSETypes": [
-      "OIDC_RESPONSE_TYPE_CODE"
-    ],
-    "grantTypes": '"$GRANT_TYPES"',
-    "appType": "OIDC_APP_TYPE_USER_AGENT",
-    "authMethodType": "OIDC_AUTH_METHOD_TYPE_NONE",
-    "version": "OIDC_VERSION_1_0",
-    "devMode": '"$ZITADEL_DEV_MODE"',
-    "accessTokenType": "OIDC_TOKEN_TYPE_JWT",
-    "accessTokenRoleAssertion": true,
-    "skipNativeAppSuccessPage": true
-  }'
-  )
-
-  PARSED_RESPONSE=$(echo "$RESPONSE" | jq -r '.clientId')
-  handle_zitadel_request_response "$PARSED_RESPONSE" "create_new_application" "$RESPONSE"
-  echo "$PARSED_RESPONSE"
-}
-
-create_service_user() {
-  INSTANCE_URL=$1
-  PAT=$2
-
-  RESPONSE=$(
-    curl -sS -X POST "$INSTANCE_URL/management/v1/users/machine" \
-      -H "Authorization: Bearer $PAT" \
-      -H "Content-Type: application/json" \
-      -d '{
-            "userName": "netbird-service-account",
-            "name": "Netbird Service Account",
-            "description": "Netbird Service Account for IDP management",
-            "accessTokenType": "ACCESS_TOKEN_TYPE_JWT"
-      }'
-  )
-  PARSED_RESPONSE=$(echo "$RESPONSE" | jq -r '.userId')
-  handle_zitadel_request_response "$PARSED_RESPONSE" "create_service_user" "$RESPONSE"
-  echo "$PARSED_RESPONSE"
-}
-
-create_service_user_secret() {
-  INSTANCE_URL=$1
-  PAT=$2
-  USER_ID=$3
-
-  RESPONSE=$(
-    curl -sS -X PUT "$INSTANCE_URL/management/v1/users/$USER_ID/secret" \
-      -H "Authorization: Bearer $PAT" \
-      -H "Content-Type: application/json" \
-      -d '{}'
-  )
-  SERVICE_USER_CLIENT_ID=$(echo "$RESPONSE" | jq -r '.clientId')
-  handle_zitadel_request_response "$SERVICE_USER_CLIENT_ID" "create_service_user_secret_id" "$RESPONSE"
-  SERVICE_USER_CLIENT_SECRET=$(echo "$RESPONSE" | jq -r '.clientSecret')
-  handle_zitadel_request_response "$SERVICE_USER_CLIENT_SECRET" "create_service_user_secret" "$RESPONSE"
-}
-
-add_organization_user_manager() {
-  INSTANCE_URL=$1
-  PAT=$2
-  USER_ID=$3
-
-  RESPONSE=$(
-    curl -sS -X POST "$INSTANCE_URL/management/v1/orgs/me/members" \
-      -H "Authorization: Bearer $PAT" \
-      -H "Content-Type: application/json" \
-      -d '{
-            "userId": "'"$USER_ID"'",
-            "roles": [
-              "ORG_USER_MANAGER"
-            ]
-      }'
-  )
-  PARSED_RESPONSE=$(echo "$RESPONSE" | jq -r '.details.creationDate')
-  handle_zitadel_request_response "$PARSED_RESPONSE" "add_organization_user_manager" "$RESPONSE"
-  echo "$PARSED_RESPONSE"
-}
-
-create_admin_user() {
-    INSTANCE_URL=$1
-    PAT=$2
-    USERNAME=$3
-    PASSWORD=$4
-    RESPONSE=$(
-        curl -sS -X POST "$INSTANCE_URL/management/v1/users/human/_import" \
-          -H "Authorization: Bearer $PAT" \
-          -H "Content-Type: application/json" \
-          -d '{
-                "userName": "'"$USERNAME"'",
-                "profile": {
-                  "firstName": "Zitadel",
-                  "lastName": "Admin"
-                },
-                "email": {
-                  "email": "'"$USERNAME"'",
-                  "isEmailVerified": true
-                },
-                "password": "'"$PASSWORD"'",
-                "passwordChangeRequired": true
-          }'
-      )
-      PARSED_RESPONSE=$(echo "$RESPONSE" | jq -r '.userId')
-      handle_zitadel_request_response "$PARSED_RESPONSE" "create_admin_user" "$RESPONSE"
-      echo "$PARSED_RESPONSE"
-}
-
-add_instance_admin() {
-  INSTANCE_URL=$1
-  PAT=$2
-  USER_ID=$3
-
-  RESPONSE=$(
-    curl -sS -X POST "$INSTANCE_URL/admin/v1/members" \
-      -H "Authorization: Bearer $PAT" \
-      -H "Content-Type: application/json" \
-      -d '{
-            "userId": "'"$USER_ID"'",
-            "roles": [
-              "IAM_OWNER"
-            ]
-      }'
-  )
-  PARSED_RESPONSE=$(echo "$RESPONSE" | jq -r '.details.creationDate')
-  handle_zitadel_request_response "$PARSED_RESPONSE" "add_instance_admin" "$RESPONSE"
-  echo "$PARSED_RESPONSE"
-}
-
-delete_auto_service_user() {
-  INSTANCE_URL=$1
-  PAT=$2
-
-  RESPONSE=$(
-    curl -sS -X GET "$INSTANCE_URL/auth/v1/users/me" \
-      -H "Authorization: Bearer $PAT" \
-      -H "Content-Type: application/json" \
-  )
-  USER_ID=$(echo "$RESPONSE" | jq -r '.user.id')
-  handle_zitadel_request_response "$USER_ID" "delete_auto_service_user_get_user" "$RESPONSE"
-
-  RESPONSE=$(
-      curl -sS -X DELETE "$INSTANCE_URL/admin/v1/members/$USER_ID" \
-        -H "Authorization: Bearer $PAT" \
-        -H "Content-Type: application/json" \
-  )
-  PARSED_RESPONSE=$(echo "$RESPONSE" | jq -r '.details.changeDate')
-  handle_zitadel_request_response "$PARSED_RESPONSE" "delete_auto_service_user_remove_instance_permissions" "$RESPONSE"
-
-  RESPONSE=$(
-      curl -sS -X DELETE "$INSTANCE_URL/management/v1/orgs/me/members/$USER_ID" \
-        -H "Authorization: Bearer $PAT" \
-        -H "Content-Type: application/json" \
-  )
-  PARSED_RESPONSE=$(echo "$RESPONSE" | jq -r '.details.changeDate')
-  handle_zitadel_request_response "$PARSED_RESPONSE" "delete_auto_service_user_remove_org_permissions" "$RESPONSE"
-  echo "$PARSED_RESPONSE"
-}
-
-delete_default_zitadel_admin() {
-  INSTANCE_URL=$1
-  PAT=$2
-
-  # Search for the default zitadel-admin user
-  RESPONSE=$(
-    curl -sS -X POST "$INSTANCE_URL/management/v1/users/_search" \
-      -H "Authorization: Bearer $PAT" \
-      -H "Content-Type: application/json" \
-      -d '{
-        "queries": [
-          {
-            "userNameQuery": {
-              "userName": "zitadel-admin@",
-              "method": "TEXT_QUERY_METHOD_STARTS_WITH"
-            }
-          }
-        ]
-      }'
-  )
-  
-  DEFAULT_ADMIN_ID=$(echo "$RESPONSE" | jq -r '.result[0].id // empty')
-  
-  if [ -n "$DEFAULT_ADMIN_ID" ] && [ "$DEFAULT_ADMIN_ID" != "null" ]; then
-    echo "Found default zitadel-admin user with ID: $DEFAULT_ADMIN_ID"
-
-    RESPONSE=$(
-        curl -sS -X DELETE "$INSTANCE_URL/management/v1/users/$DEFAULT_ADMIN_ID" \
-          -H "Authorization: Bearer $PAT" \
-          -H "Content-Type: application/json" \
-    )
-    PARSED_RESPONSE=$(echo "$RESPONSE" | jq -r '.details.changeDate // "deleted"')
-    handle_zitadel_request_response "$PARSED_RESPONSE" "delete_default_zitadel_admin" "$RESPONSE"
-
-  else
-    echo "Default zitadel-admin user not found: $RESPONSE"
-  fi
-}
-
-init_zitadel() {
-  echo -e "\nInitializing Zitadel with NetBird's applications\n"
-  INSTANCE_URL="$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN"
-
-  TOKEN_PATH=./machinekey/zitadel-admin-sa.token
-
-  echo -n "Waiting for Zitadel's PAT to be created "
-  wait_pat "$TOKEN_PATH"
-  echo "Reading Zitadel PAT"
-  PAT=$(cat $TOKEN_PATH)
-  if [ "$PAT" = "null" ]; then
-    echo "Failed requesting getting Zitadel PAT"
-    exit 1
-  fi
-
-  echo -n "Waiting for Zitadel to become ready "
-  wait_api "$INSTANCE_URL" "$PAT"
-
-  echo "Deleting default zitadel-admin user..."
-  delete_default_zitadel_admin "$INSTANCE_URL" "$PAT"
-
-  #  create the zitadel project
-  echo "Creating new zitadel project"
-  PROJECT_ID=$(create_new_project "$INSTANCE_URL" "$PAT")
-
-  ZITADEL_DEV_MODE=false
-  BASE_REDIRECT_URL=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-  if [[ $NETBIRD_HTTP_PROTOCOL == "http" ]]; then
-    ZITADEL_DEV_MODE=true
-  fi
-
-  # create zitadel spa applications
-  echo "Creating new Zitadel SPA Dashboard application"
-  DASHBOARD_APPLICATION_CLIENT_ID=$(create_new_application "$INSTANCE_URL" "$PAT" "Dashboard" "$BASE_REDIRECT_URL/nb-auth" "$BASE_REDIRECT_URL/nb-silent-auth" "$BASE_REDIRECT_URL/" "$ZITADEL_DEV_MODE" "false")
-
-  echo "Creating new Zitadel SPA Cli application"
-  CLI_APPLICATION_CLIENT_ID=$(create_new_application "$INSTANCE_URL" "$PAT" "Cli" "http://localhost:53000/" "http://localhost:54000/" "http://localhost:53000/" "true" "true")
-
-  MACHINE_USER_ID=$(create_service_user "$INSTANCE_URL" "$PAT")
-
-  SERVICE_USER_CLIENT_ID="null"
-  SERVICE_USER_CLIENT_SECRET="null"
-
-  create_service_user_secret "$INSTANCE_URL" "$PAT" "$MACHINE_USER_ID"
-
-  DATE=$(add_organization_user_manager "$INSTANCE_URL" "$PAT" "$MACHINE_USER_ID")
-
-  ZITADEL_ADMIN_USERNAME="admin@$NETBIRD_DOMAIN"
-  ZITADEL_ADMIN_PASSWORD="$(openssl rand -base64 32 | sed 's/=//g')@"
-
-  HUMAN_USER_ID=$(create_admin_user "$INSTANCE_URL" "$PAT" "$ZITADEL_ADMIN_USERNAME" "$ZITADEL_ADMIN_PASSWORD")
-
-  DATE="null"
-
-  DATE=$(add_instance_admin "$INSTANCE_URL" "$PAT" "$HUMAN_USER_ID")
-
-  DATE="null"
-  DATE=$(delete_auto_service_user "$INSTANCE_URL" "$PAT")
-  if [ "$DATE" = "null" ]; then
-      echo "Failed deleting auto service user"
-      echo "Please remove it manually"
-  fi
-
-  export NETBIRD_AUTH_CLIENT_ID=$DASHBOARD_APPLICATION_CLIENT_ID
-  export NETBIRD_AUTH_CLIENT_ID_CLI=$CLI_APPLICATION_CLIENT_ID
-  export NETBIRD_IDP_MGMT_CLIENT_ID=$SERVICE_USER_CLIENT_ID
-  export NETBIRD_IDP_MGMT_CLIENT_SECRET=$SERVICE_USER_CLIENT_SECRET
-  export ZITADEL_ADMIN_USERNAME
-  export ZITADEL_ADMIN_PASSWORD
-}
-
-check_nb_domain() {
-  DOMAIN=$1
-  if [ "$DOMAIN-x" == "-x" ]; then
-    echo "The NETBIRD_DOMAIN variable cannot be empty." > /dev/stderr
-    return 1
-  fi
-
-  if [ "$DOMAIN" == "netbird.example.com" ]; then
-    echo "The NETBIRD_DOMAIN cannot be netbird.example.com" > /dev/stderr
-    return 1
-  fi
-  return 0
-}
-
-read_nb_domain() {
-  READ_NETBIRD_DOMAIN=""
-  echo -n "Enter the domain you want to use for NetBird (e.g. netbird.my-domain.com): " > /dev/stderr
-  read -r READ_NETBIRD_DOMAIN < /dev/tty
-  if ! check_nb_domain "$READ_NETBIRD_DOMAIN"; then
-    read_nb_domain
-  fi
-  echo "$READ_NETBIRD_DOMAIN"
-}
-
-get_turn_external_ip() {
-  TURN_EXTERNAL_IP_CONFIG="#external-ip="
-  IP=$(curl -s -4 https://jsonip.com | jq -r '.ip')
-  if [[ "x-$IP" != "x-" ]]; then
-    TURN_EXTERNAL_IP_CONFIG="external-ip=$IP"
-  fi
-  echo "$TURN_EXTERNAL_IP_CONFIG"
-}
-
-initEnvironment() {
-  CADDY_SECURE_DOMAIN=""
-  ZITADEL_EXTERNALSECURE="false"
-  ZITADEL_TLS_MODE="disabled"
-  ZITADEL_MASTERKEY="$(openssl rand -base64 32 | head -c 32)"
-  NETBIRD_PORT=80
-  NETBIRD_HTTP_PROTOCOL="http"
-  NETBIRD_RELAY_PROTO="rel"
-  TURN_USER="self"
-  TURN_PASSWORD=$(openssl rand -base64 32 | sed 's/=//g')
-  NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed 's/=//g')
-  TURN_MIN_PORT=49152
-  TURN_MAX_PORT=65535
-  TURN_EXTERNAL_IP_CONFIG=$(get_turn_external_ip)
-
-  if ! check_nb_domain "$NETBIRD_DOMAIN"; then
-    NETBIRD_DOMAIN=$(read_nb_domain)
-  fi
-
-  if [ "$NETBIRD_DOMAIN" == "use-ip" ]; then
-    NETBIRD_DOMAIN=$(get_main_ip_address)
-  else
-    ZITADEL_EXTERNALSECURE="true"
-    ZITADEL_TLS_MODE="external"
-    NETBIRD_PORT=443
-    CADDY_SECURE_DOMAIN=", $NETBIRD_DOMAIN:$NETBIRD_PORT"
-    NETBIRD_HTTP_PROTOCOL="https"
-    NETBIRD_RELAY_PROTO="rels"
-  fi
-
-  if [[ "$OSTYPE" == "darwin"* ]]; then
-      ZIDATE_TOKEN_EXPIRATION_DATE=$(date -u -v+30M "+%Y-%m-%dT%H:%M:%SZ")
-  else
-      ZIDATE_TOKEN_EXPIRATION_DATE=$(date -u -d "+30 minutes" "+%Y-%m-%dT%H:%M:%SZ")
-  fi
-
-  check_jq
-
-  DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
-
-  if [ -f zitadel.env ]; then
-    echo "Generated files already exist, if you want to reinitialize the environment, please remove them first."
-    echo "You can use the following commands:"
-    echo "  $DOCKER_COMPOSE_COMMAND down --volumes # to remove all containers and volumes"
-    echo "  rm -f docker-compose.yml Caddyfile zitadel.env dashboard.env machinekey/zitadel-admin-sa.token turnserver.conf management.json relay.env"
-    echo "Be aware that this will remove all data from the database, and you will have to reconfigure the dashboard."
-    exit 1
-  fi
-
-  if [[ $ZITADEL_DATABASE == "cockroach" ]]; then
-        echo "Use CockroachDB as Zitadel database."
-        ZDB=$(renderDockerComposeCockroachDB)
-        ZITADEL_DB_ENV=$(renderZitadelCockroachDBEnv)
-  else
-      echo "Use Postgres as default Zitadel database."
-      echo "For using CockroachDB please the environment variable 'export ZITADEL_DATABASE=cockroach'."
-      POSTGRES_ROOT_PASSWORD="$(openssl rand -base64 32 | sed 's/=//g')@"
-      POSTGRES_ZITADEL_PASSWORD="$(openssl rand -base64 32 | sed 's/=//g')@"
-      ZDB=$(renderDockerComposePostgres)
-      ZITADEL_DB_ENV=$(renderZitadelPostgresEnv)
-      renderPostgresEnv > zdb.env
-  fi
-
-  echo Rendering initial files...
-  renderDockerCompose > docker-compose.yml
-  renderCaddyfile > Caddyfile
-  renderZitadelEnv > zitadel.env
-  echo "" > dashboard.env
-  echo "" > turnserver.conf
-  echo "" > management.json
-  echo "" > relay.env
-
-  mkdir -p machinekey
-  chmod 777 machinekey
-
-  init_crdb
-
-  echo -e "\nStarting Zitadel IDP for user management\n\n"
-  $DOCKER_COMPOSE_COMMAND up -d caddy zitadel
-  init_zitadel
-
-  echo -e "\nRendering NetBird files...\n"
-  renderTurnServerConf > turnserver.conf
-  renderManagementJson > management.json
-  renderDashboardEnv > dashboard.env
-  renderRelayEnv > relay.env
-
-  echo -e "\nStarting NetBird services\n"
-  $DOCKER_COMPOSE_COMMAND up -d
-  echo -e "\nDone!\n"
-  echo "You can access the NetBird dashboard at $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN"
-  echo "Login with the following credentials:"
-  install -m 600 /dev/null .env
-  printf 'Username: %s\nPassword: %s\n' \
-      "$ZITADEL_ADMIN_USERNAME" "$ZITADEL_ADMIN_PASSWORD" >> .env
-  echo "Username: $ZITADEL_ADMIN_USERNAME"
-  echo "Password: $ZITADEL_ADMIN_PASSWORD"
-}
-
-renderCaddyfile() {
-  cat <<EOF
-{
-  debug
-	servers :80,:443 {
-    protocols h1 h2c h2 h3
-  }
-}
-
-(security_headers) {
-    header * {
-        # enable HSTS
-        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#strict-transport-security-hsts
-        # NOTE: Read carefully how this header works before using it.
-        # If the HSTS header is misconfigured or if there is a problem with
-        # the SSL/TLS certificate being used, legitimate users might be unable
-        # to access the website. For example, if the HSTS header is set to a
-        # very long duration and the SSL/TLS certificate expires or is revoked,
-        # legitimate users might be unable to access the website until
-        # the HSTS header duration has expired.
-        # The recommended value for the max-age is 2 year (63072000 seconds).
-        # But we are using 1 hour (3600 seconds) for testing purposes
-        # and ensure that the website is working properly before setting
-        # to two years.
-
-        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
-
-        # disable clients from sniffing the media type
-        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options
-        X-Content-Type-Options "nosniff"
-
-        # clickjacking protection
-        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options
-        X-Frame-Options "SAMEORIGIN"
-
-        # xss protection
-        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection
-        X-XSS-Protection "1; mode=block"
-
-        # Remove -Server header, which is an information leak
-        # Remove Caddy from Headers
-        -Server
-
-        # keep referrer data off of HTTP connections
-        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#referrer-policy
-        Referrer-Policy strict-origin-when-cross-origin
-    }
-}
-
-:80${CADDY_SECURE_DOMAIN} {
-    import security_headers
-    # relay
-    reverse_proxy /relay* relay:80
-    # Signal
-    reverse_proxy /ws-proxy/signal* signal:80
-    reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000
-    # Management
-    reverse_proxy /api/* management:80
-    reverse_proxy /ws-proxy/management* management:80
-    reverse_proxy /management.ManagementService/* h2c://management:80
-    # Zitadel
-    reverse_proxy /zitadel.admin.v1.AdminService/* h2c://zitadel:8080
-    reverse_proxy /admin/v1/* h2c://zitadel:8080
-    reverse_proxy /zitadel.auth.v1.AuthService/* h2c://zitadel:8080
-    reverse_proxy /auth/v1/* h2c://zitadel:8080
-    reverse_proxy /zitadel.management.v1.ManagementService/* h2c://zitadel:8080
-    reverse_proxy /management/v1/* h2c://zitadel:8080
-    reverse_proxy /zitadel.system.v1.SystemService/* h2c://zitadel:8080
-    reverse_proxy /system/v1/* h2c://zitadel:8080
-    reverse_proxy /assets/v1/* h2c://zitadel:8080
-    reverse_proxy /ui/* h2c://zitadel:8080
-    reverse_proxy /oidc/v1/* h2c://zitadel:8080
-    reverse_proxy /saml/v2/* h2c://zitadel:8080
-    reverse_proxy /oauth/v2/* h2c://zitadel:8080
-    reverse_proxy /.well-known/openid-configuration h2c://zitadel:8080
-    reverse_proxy /openapi/* h2c://zitadel:8080
-    reverse_proxy /debug/* h2c://zitadel:8080
-    reverse_proxy /device/* h2c://zitadel:8080
-    reverse_proxy /device h2c://zitadel:8080
-    reverse_proxy /zitadel.user.v2.UserService/* h2c://zitadel:8080
-    # Dashboard
-    reverse_proxy /* dashboard:80
-}
+This compatibility notice will be removed in NetBird v0.80.
 EOF
-}
 
-renderTurnServerConf() {
-  cat <<EOF
-listening-port=3478
-$TURN_EXTERNAL_IP_CONFIG
-tls-listening-port=5349
-min-port=$TURN_MIN_PORT
-max-port=$TURN_MAX_PORT
-fingerprint
-lt-cred-mech
-user=$TURN_USER:$TURN_PASSWORD
-realm=wiretrustee.com
-cert=/etc/coturn/certs/cert.pem
-pkey=/etc/coturn/private/privkey.pem
-log-file=stdout
-no-software-attribute
-pidfile="/var/tmp/turnserver.pid"
-no-cli
-EOF
-}
-
-renderManagementJson() {
-  cat <<EOF
-{
-    "Stuns": [
-        {
-            "Proto": "udp",
-            "URI": "stun:$NETBIRD_DOMAIN:3478"
-        }
-    ],
-    "Relay": {
-        "Addresses": ["$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT"],
-        "CredentialsTTL": "24h",
-        "Secret": "$NETBIRD_RELAY_AUTH_SECRET"
-    },
-    "Signal": {
-        "Proto": "$NETBIRD_HTTP_PROTOCOL",
-        "URI": "$NETBIRD_DOMAIN:$NETBIRD_PORT"
-    },
-    "HttpConfig": {
-        "AuthIssuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN",
-        "AuthAudience": "$NETBIRD_AUTH_CLIENT_ID",
-        "OIDCConfigEndpoint":"$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/.well-known/openid-configuration"
-    },
-    "IdpManagerConfig": {
-        "ManagerType": "zitadel",
-        "ClientConfig": {
-            "Issuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN",
-            "TokenEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/oauth/v2/token",
-            "ClientID": "$NETBIRD_IDP_MGMT_CLIENT_ID",
-            "ClientSecret": "$NETBIRD_IDP_MGMT_CLIENT_SECRET",
-            "GrantType": "client_credentials"
-        },
-        "ExtraConfig": {
-            "ManagementEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/management/v1"
-        }
-    },
-  "DeviceAuthorizationFlow": {
-      "Provider": "hosted",
-      "ProviderConfig": {
-          "Audience": "$NETBIRD_AUTH_CLIENT_ID_CLI",
-          "ClientID": "$NETBIRD_AUTH_CLIENT_ID_CLI",
-          "Scope": "openid"
-      }
-    },
-    "PKCEAuthorizationFlow": {
-        "ProviderConfig": {
-            "Audience": "$NETBIRD_AUTH_CLIENT_ID_CLI",
-            "ClientID": "$NETBIRD_AUTH_CLIENT_ID_CLI",
-            "Scope": "openid profile email offline_access",
-            "RedirectURLs": ["http://localhost:53000/","http://localhost:54000/"]
-        }
-    }
-}
-EOF
-}
-
-renderDashboardEnv() {
-  cat <<EOF
-# Endpoints
-NETBIRD_MGMT_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-NETBIRD_MGMT_GRPC_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-# OIDC
-AUTH_AUDIENCE=$NETBIRD_AUTH_CLIENT_ID
-AUTH_CLIENT_ID=$NETBIRD_AUTH_CLIENT_ID
-AUTH_AUTHORITY=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-USE_AUTH0=false
-AUTH_SUPPORTED_SCOPES="openid profile email offline_access"
-AUTH_REDIRECT_URI=/nb-auth
-AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
-# SSL
-NGINX_SSL_PORT=443
-# Letsencrypt
-LETSENCRYPT_DOMAIN=none
-EOF
-}
-
-renderZitadelEnv() {
-  cat <<EOF
-ZITADEL_LOG_LEVEL=debug
-ZITADEL_MASTERKEY=$ZITADEL_MASTERKEY
-ZITADEL_EXTERNALSECURE=$ZITADEL_EXTERNALSECURE
-ZITADEL_TLS_ENABLED="false"
-ZITADEL_EXTERNALPORT=$NETBIRD_PORT
-ZITADEL_EXTERNALDOMAIN=$NETBIRD_DOMAIN
-ZITADEL_FIRSTINSTANCE_PATPATH=/machinekey/zitadel-admin-sa.token
-ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME=zitadel-admin-sa
-ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME=Admin
-ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_SCOPES=openid
-ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE=$ZIDATE_TOKEN_EXPIRATION_DATE
-$ZITADEL_DB_ENV
-EOF
-}
-
-renderZitadelCockroachDBEnv() {
-  cat <<EOF
-ZITADEL_DATABASE_COCKROACH_HOST=zdb
-ZITADEL_DATABASE_COCKROACH_USER_USERNAME=zitadel_user
-ZITADEL_DATABASE_COCKROACH_USER_SSL_MODE=verify-full
-ZITADEL_DATABASE_COCKROACH_USER_SSL_ROOTCERT="/zdb-certs/ca.crt"
-ZITADEL_DATABASE_COCKROACH_USER_SSL_CERT="/zdb-certs/client.zitadel_user.crt"
-ZITADEL_DATABASE_COCKROACH_USER_SSL_KEY="/zdb-certs/client.zitadel_user.key"
-ZITADEL_DATABASE_COCKROACH_ADMIN_SSL_MODE=verify-full
-ZITADEL_DATABASE_COCKROACH_ADMIN_SSL_ROOTCERT="/zdb-certs/ca.crt"
-ZITADEL_DATABASE_COCKROACH_ADMIN_SSL_CERT="/zdb-certs/client.root.crt"
-ZITADEL_DATABASE_COCKROACH_ADMIN_SSL_KEY="/zdb-certs/client.root.key"
-EOF
-}
-
-renderZitadelPostgresEnv() {
-  cat <<EOF
-ZITADEL_DATABASE_POSTGRES_HOST=zdb
-ZITADEL_DATABASE_POSTGRES_PORT=5432
-ZITADEL_DATABASE_POSTGRES_DATABASE=zitadel
-ZITADEL_DATABASE_POSTGRES_USER_USERNAME=zitadel
-ZITADEL_DATABASE_POSTGRES_USER_PASSWORD=$POSTGRES_ZITADEL_PASSWORD
-ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE=disable
-ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME=root
-ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD=$POSTGRES_ROOT_PASSWORD
-ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE=disable
-EOF
-}
-
-renderPostgresEnv() {
-  cat <<EOF
-POSTGRES_USER=root
-POSTGRES_PASSWORD=$POSTGRES_ROOT_PASSWORD
-EOF
-}
-
-renderRelayEnv() {
-  cat <<EOF
-NB_LOG_LEVEL=info
-NB_LISTEN_ADDRESS=:80
-NB_EXPOSED_ADDRESS=$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT
-NB_AUTH_SECRET=$NETBIRD_RELAY_AUTH_SECRET
-EOF
-}
-
-renderDockerCompose() {
-  cat <<EOF
-services:
-  # Caddy reverse proxy
-  caddy:
-    image: caddy
-    restart: unless-stopped
-    networks: [ netbird ]
-    ports:
-      - '443:443'
-      - '443:443/udp'
-      - '80:80'
-    volumes:
-      - netbird_caddy_data:/data
-      - ./Caddyfile:/etc/caddy/Caddyfile
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-  # UI dashboard
-  dashboard:
-    image: netbirdio/dashboard:latest
-    restart: unless-stopped
-    networks: [netbird]
-    env_file:
-      - ./dashboard.env
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-  # Signal
-  signal:
-    image: netbirdio/signal:latest
-    restart: unless-stopped
-    networks: [netbird]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-  # Relay
-  relay:
-    image: netbirdio/relay:latest
-    restart: unless-stopped
-    networks: [netbird]
-    env_file:
-      - ./relay.env
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-  # Management
-  management:
-    image: netbirdio/management:latest
-    restart: unless-stopped
-    networks: [netbird]
-    volumes:
-      - netbird_management:/var/lib/netbird
-      - ./management.json:/etc/netbird/management.json
-    command: [
-      "--port", "80",
-      "--log-file", "console",
-      "--log-level", "info",
-      "--disable-anonymous-metrics=false",
-      "--single-account-mode-domain=netbird.selfhosted",
-      "--dns-domain=netbird.selfhosted",
-      "--idp-sign-key-refresh-enabled",
-    ]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-  # Coturn, AKA relay server
-  coturn:
-    image: coturn/coturn
-    restart: unless-stopped
-    #domainname: netbird.relay.selfhosted
-    volumes:
-      - ./turnserver.conf:/etc/turnserver.conf:ro
-    network_mode: host
-    command:
-      - -c /etc/turnserver.conf
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-  # Zitadel - identity provider
-  zitadel:
-    restart: 'always'
-    networks: [netbird]
-    image: 'ghcr.io/zitadel/zitadel:v2.64.1'
-    command: 'start-from-init --masterkeyFromEnv --tlsMode $ZITADEL_TLS_MODE'
-    env_file:
-      - ./zitadel.env
-    depends_on:
-      zdb:
-        condition: 'service_healthy'
-    volumes:
-      - ./machinekey:/machinekey
-      - netbird_zitadel_certs:/zdb-certs:ro
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-$ZDB
-  netbird_zdb_data:
-  netbird_management:
-  netbird_caddy_data:
-  netbird_zitadel_certs:
-
-networks:
-  netbird:
-EOF
-}
-
-renderDockerComposeCockroachDB() {
-  cat <<EOF
-  # CockroachDB for Zitadel
-  zdb:
-    restart: 'always'
-    networks: [netbird]
-    image: 'cockroachdb/cockroach:latest-v23.2'
-    command: 'start-single-node --advertise-addr zdb'
-    volumes:
-      - netbird_zdb_data:/cockroach/cockroach-data
-      - netbird_zdb_certs:/cockroach/certs
-      - netbird_zitadel_certs:/zitadel-certs
-    healthcheck:
-      test: [ "CMD", "curl", "-f", "http://localhost:8080/health?ready=1" ]
-      interval: '10s'
-      timeout: '30s'
-      retries: 5
-      start_period: '20s'
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-volumes:
-  netbird_zdb_certs:
-EOF
-}
-
-renderDockerComposePostgres() {
-  cat <<EOF
-  # Postgres for Zitadel
-  zdb:
-    restart: 'always'
-    networks: [netbird]
-    image: 'postgres:16-alpine'
-    env_file:
-      - ./zdb.env
-    volumes:
-      - netbird_zdb_data:/var/lib/postgresql/data:rw
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready", "-d", "db_prod"]
-      interval: 5s
-      timeout: 60s
-      retries: 10
-      start_period: 5s
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-volumes:
-EOF
-}
-
-initEnvironment
+exit 1
diff --git a/infrastructure_files/getting-started.sh b/infrastructure_files/getting-started.sh
index 837cc42e6..902956199 100755
--- a/infrastructure_files/getting-started.sh
+++ b/infrastructure_files/getting-started.sh
@@ -60,18 +60,21 @@ check_docker_sock_perms() {
 }
 
 check_docker_compose() {
-  if command -v docker-compose &> /dev/null
-  then
-      echo "docker-compose"
-      return
-  fi
-  if docker compose --help &> /dev/null
-  then
-      echo "docker compose"
-      return
+  if ! command -v docker &> /dev/null && ! command -v docker-compose &> /dev/null; then
+    echo "Docker is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/engine/install/" > /dev/stderr
+    exit 1
   fi
 
-  echo "docker-compose is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/engine/install/" > /dev/stderr
+  if docker compose version &> /dev/null; then
+    echo "docker compose"
+    return
+  fi
+  if command -v docker-compose &> /dev/null && docker-compose version &> /dev/null; then
+    echo "docker-compose"
+    return
+  fi
+
+  echo "Docker Compose is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/compose/install/" > /dev/stderr
   exit 1
 }
 
@@ -84,6 +87,27 @@ check_jq() {
   return 0
 }
 
+check_traefik_image() {
+  local image="${TRAEFIK_IMAGE##*/}" major minor patch
+
+  # A version tag cannot establish which release a digest points to.
+  if [[ "$TRAEFIK_IMAGE" == *@* ||
+    ! "$image" =~ ^[^:@]+:v?([0-9]+)(\.([0-9]+)(\.([0-9]+))?)?$ ]]; then
+    echo "Cannot verify TRAEFIK_IMAGE=$TRAEFIK_IMAGE." >&2
+    echo "Use a numeric Traefik version tag (v3.7.13 or newer) without a digest." >&2
+    return 1
+  fi
+  major=$((10#${BASH_REMATCH[1]}))
+  minor=$((10#${BASH_REMATCH[3]:-0}))
+  patch=$((10#${BASH_REMATCH[5]:-0}))
+  if (( major < 3 || (major == 3 && minor < 7) || (major == 3 && minor == 7 && patch < 13) )); then
+    echo "TRAEFIK_IMAGE=$TRAEFIK_IMAGE is incompatible with this configuration." >&2
+    echo "Use Traefik v3.7.13 or newer for aliasHeadersStrategy and its header-sanitization fix." >&2
+    return 1
+  fi
+  return 0
+}
+
 get_main_ip_address() {
   if [[ "$OSTYPE" == "darwin"* ]]; then
     interface=$(route -n get default | grep 'interface:' | awk '{print $2}')
@@ -98,16 +122,90 @@ get_main_ip_address() {
 }
 
 check_nb_domain() {
-  DOMAIN=$1
-  if [[ "$DOMAIN-x" == "-x" ]]; then
+  local domain="$1"
+
+  if [[ -z "$domain" ]]; then
     echo "The NETBIRD_DOMAIN variable cannot be empty." > /dev/stderr
     return 1
   fi
-
-  if [[ "$DOMAIN" == "netbird.example.com" ]]; then
+  if [[ "$domain" == "use-ip" ]]; then
+    return 0
+  fi
+  if [[ "$domain" == "netbird.example.com" ]]; then
     echo "The NETBIRD_DOMAIN cannot be netbird.example.com" > /dev/stderr
     return 1
   fi
+  if [[ "$domain" =~ ^[0-9.]+$ ]]; then
+    echo "'$domain' is an IP address. Use 'use-ip' to install on this host's IP over HTTP, or an FQDN to get a TLS certificate." > /dev/stderr
+    return 1
+  fi
+  if [[ ! "$domain" =~ ^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)+$ ]]; then
+    echo "'$domain' is not a valid FQDN. It needs at least one dot (e.g. netbird.my-domain.com), with no scheme, port or trailing dot." > /dev/stderr
+    return 1
+  fi
+  return 0
+}
+
+check_domain_resolves() {
+  local domain="$1"
+  if command -v getent &> /dev/null && getent hosts "$domain" &> /dev/null; then return 0; fi
+  if command -v host &> /dev/null && host "$domain" &> /dev/null; then return 0; fi
+  if command -v dig &> /dev/null && [[ -n "$(dig +short "$domain" 2>/dev/null)" ]]; then return 0; fi
+  if command -v nslookup &> /dev/null && nslookup "$domain" &> /dev/null; then return 0; fi
+  return 1
+}
+
+# Non-interactive configuration
+# ------------------------------
+# Every prompt below can be pre-answered with an environment variable, so the
+# script runs unattended (cloud-init, CI, Terraform, curl | bash). resolve()
+# is the single place that decides env var vs prompt vs default; the read_*
+# helpers stay pure prompts.
+#
+# Supported env vars:
+#   NETBIRD_DOMAIN                    domain/FQDN (required)
+#   NETBIRD_LETSENCRYPT_EMAIL         ACME email (required for built-in Traefik)
+#   NETBIRD_AGENT_NETWORK             true enables the agent-network preset
+#   NETBIRD_REVERSE_PROXY_TYPE        0-5 (default 0 = built-in Traefik)
+#   NETBIRD_ENABLE_PROXY              true/false (default false)
+#   NETBIRD_ENABLE_CROWDSEC           true/false (default false)
+#   NETBIRD_TRAEFIK_EXTERNAL_NETWORK  external-Traefik network (type 1)
+#   NETBIRD_TRAEFIK_ENTRYPOINT        external-Traefik entrypoint (type 1, default websecure)
+#   NETBIRD_TRAEFIK_CERTRESOLVER      external-Traefik cert resolver (type 1)
+#   NETBIRD_BIND_LOCALHOST_ONLY       true/false (default true, types 2-5)
+#   NETBIRD_EXTERNAL_PROXY_NETWORK    docker network to join (types 2-4)
+#   NETBIRD_TRUSTED_PEERS             reverse proxy address management sees (default: built-in Traefik's IP, empty for types 1-5)
+#   NETBIRD_NON_INTERACTIVE           true forces unattended mode even with a TTY
+
+# tty_available succeeds only when we may prompt: never when the operator has
+# set NETBIRD_NON_INTERACTIVE=true, otherwise only when /dev/tty can actually
+# be opened. A PTY can be attached in automation (CI runners, some
+# provisioners), so the env override is the authoritative signal and the
+# /dev/tty probe is the fallback. /dev/tty is a world-rw device node even with
+# no terminal, so a permission test ([ -r ]) is not enough - we must open it.
+tty_available() {
+  [[ "${NETBIRD_NON_INTERACTIVE:-}" == "true" ]] && return 1
+  { true < /dev/tty; } 2>/dev/null
+}
+
+# resolve ENV_VAR_NAME DEFAULT PROMPT_FN [prompt args...]
+#   env var set and non-empty -> its value
+#   interactive               -> PROMPT_FN "$@" (prompt behavior unchanged)
+#   otherwise                 -> DEFAULT, or abort when DEFAULT is "required"
+resolve() {
+  local env_name="$1" default="$2" prompt_fn="$3"
+  shift 3
+  local env_value="${!env_name:-}"
+  if [[ -n "$env_value" ]]; then
+    echo "$env_value"
+  elif tty_available; then
+    "$prompt_fn" "$@"
+  elif [[ "$default" == "required" ]]; then
+    echo "$env_name is required for a non-interactive install." > /dev/stderr
+    exit 1
+  else
+    echo "$default"
+  fi
   return 0
 }
 
@@ -117,7 +215,22 @@ read_nb_domain() {
   read -r READ_NETBIRD_DOMAIN < /dev/tty
   if ! check_nb_domain "$READ_NETBIRD_DOMAIN"; then
     read_nb_domain
+    return
   fi
+
+  if [[ "$READ_NETBIRD_DOMAIN" != "use-ip" ]] && ! check_domain_resolves "$READ_NETBIRD_DOMAIN"; then
+    local confirm=""
+    echo "" > /dev/stderr
+    echo "Warning: '$READ_NETBIRD_DOMAIN' does not resolve via DNS from this host." > /dev/stderr
+    echo "TLS certificate issuance and client connections will fail until it does." > /dev/stderr
+    echo -n "Continue anyway? [y/N]: " > /dev/stderr
+    read -r confirm < /dev/tty
+    if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
+      read_nb_domain
+      return
+    fi
+  fi
+
   echo "$READ_NETBIRD_DOMAIN"
   return 0
 }
@@ -348,6 +461,7 @@ initialize_default_values() {
   NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
   # Note: DataStoreEncryptionKey must keep base64 padding (=) for Go's base64.StdEncoding
   DATASTORE_ENCRYPTION_KEY=$(openssl rand -base64 32)
+  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)
   NETBIRD_STUN_PORT=3478
 
   # Docker images
@@ -355,8 +469,8 @@ initialize_default_values() {
   # Combined server replaces separate signal, relay, and management containers
   NETBIRD_SERVER_IMAGE=${NETBIRD_SERVER_IMAGE:-"netbirdio/netbird-server:latest"}
   NETBIRD_PROXY_IMAGE=${NETBIRD_PROXY_IMAGE:-"netbirdio/reverse-proxy:latest"}
-  TRAEFIK_IMAGE=${TRAEFIK_IMAGE:-"traefik:v3.6"}
-  CROWDSEC_IMAGE=${CROWDSEC_IMAGE:-"crowdsecurity/crowdsec:v1.7.7"}
+  TRAEFIK_IMAGE=${TRAEFIK_IMAGE:-"traefik:v3.7.14"}
+  CROWDSEC_IMAGE=${CROWDSEC_IMAGE:-"crowdsecurity/crowdsec:v1.8.1"}
   # Reverse proxy configuration
   REVERSE_PROXY_TYPE="0"
   TRAEFIK_EXTERNAL_NETWORK=""
@@ -367,6 +481,8 @@ initialize_default_values() {
   MANAGEMENT_HOST_PORT="8081"  # Combined server port (management + signal + relay)
   BIND_LOCALHOST_ONLY="true"
   EXTERNAL_PROXY_NETWORK=""
+  TRUSTED_PEERS=""             # Address the reverse proxy connects to management from
+
 
   # Traefik static IP within the internal bridge network
   TRAEFIK_IP="172.30.0.10"
@@ -382,8 +498,26 @@ initialize_default_values() {
 }
 
 configure_domain() {
+  # Domain is validated (not a free-form value), so it keeps its own guard
+  # rather than going through resolve(): a valid NETBIRD_DOMAIN is used as-is,
+  # otherwise we prompt, or abort when there is no terminal to prompt on.
+  local prompted="false"
   if ! check_nb_domain "$NETBIRD_DOMAIN"; then
+    if ! tty_available; then
+      if [[ -n "$NETBIRD_DOMAIN" ]]; then
+        echo "NETBIRD_DOMAIN='$NETBIRD_DOMAIN' cannot be used for a non-interactive install." > /dev/stderr
+      else
+        echo "NETBIRD_DOMAIN is required for a non-interactive install." > /dev/stderr
+      fi
+      exit 1
+    fi
     NETBIRD_DOMAIN=$(read_nb_domain)
+    prompted="true"
+  fi
+
+  if [[ "$prompted" == "false" && "$NETBIRD_DOMAIN" != "use-ip" ]] && ! check_domain_resolves "$NETBIRD_DOMAIN"; then
+    echo "Warning: '$NETBIRD_DOMAIN' does not resolve via DNS from this host." > /dev/stderr
+    echo "TLS certificate issuance and client connections will fail until it does." > /dev/stderr
   fi
 
   if [[ "$NETBIRD_DOMAIN" == "use-ip" ]]; then
@@ -409,12 +543,9 @@ apply_agent_network_preset() {
   REVERSE_PROXY_TYPE="0"
   ENABLE_PROXY="true"
   ENABLE_CROWDSEC="false"
+  TRUSTED_PEERS="${NETBIRD_TRUSTED_PEERS:-$TRAEFIK_IP/32}"
 
-  if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL}" ]]; then
-    TRAEFIK_ACME_EMAIL="${NETBIRD_LETSENCRYPT_EMAIL}"
-  else
-    TRAEFIK_ACME_EMAIL=$(read_traefik_acme_email)
-  fi
+  TRAEFIK_ACME_EMAIL=$(resolve NETBIRD_LETSENCRYPT_EMAIL required read_traefik_acme_email)
 
   echo "" > /dev/stderr
   echo "Agent-network preset enabled (NETBIRD_AGENT_NETWORK=true):" > /dev/stderr
@@ -436,37 +567,52 @@ configure_reverse_proxy() {
     return 0
   fi
 
-  # Prompt for reverse proxy type
-  REVERSE_PROXY_TYPE=$(read_reverse_proxy_type)
+  # Reverse proxy type (env NETBIRD_REVERSE_PROXY_TYPE, else prompt, else 0)
+  REVERSE_PROXY_TYPE=$(resolve NETBIRD_REVERSE_PROXY_TYPE 0 read_reverse_proxy_type)
 
   # Handle built-in Traefik prompts (option 0)
   if [[ "$REVERSE_PROXY_TYPE" == "0" ]]; then
-    TRAEFIK_ACME_EMAIL=$(read_traefik_acme_email)
-    ENABLE_PROXY=$(read_enable_proxy)
+    TRAEFIK_ACME_EMAIL=$(resolve NETBIRD_LETSENCRYPT_EMAIL required read_traefik_acme_email)
+    ENABLE_PROXY=$(resolve NETBIRD_ENABLE_PROXY false read_enable_proxy)
     if [[ "$ENABLE_PROXY" == "true" ]]; then
-      ENABLE_CROWDSEC=$(read_enable_crowdsec)
+      ENABLE_CROWDSEC=$(resolve NETBIRD_ENABLE_CROWDSEC false read_enable_crowdsec)
     fi
   fi
 
   # Handle external Traefik-specific prompts (option 1)
   if [[ "$REVERSE_PROXY_TYPE" == "1" ]]; then
-    TRAEFIK_EXTERNAL_NETWORK=$(read_traefik_network)
-    TRAEFIK_ENTRYPOINT=$(read_traefik_entrypoint)
-    TRAEFIK_CERTRESOLVER=$(read_traefik_certresolver)
+    TRAEFIK_EXTERNAL_NETWORK=$(resolve NETBIRD_TRAEFIK_EXTERNAL_NETWORK "" read_traefik_network)
+    TRAEFIK_ENTRYPOINT=$(resolve NETBIRD_TRAEFIK_ENTRYPOINT websecure read_traefik_entrypoint)
+    TRAEFIK_CERTRESOLVER=$(resolve NETBIRD_TRAEFIK_CERTRESOLVER "" read_traefik_certresolver)
   fi
 
   # Handle port binding for external proxy options (2-5)
   if [[ "$REVERSE_PROXY_TYPE" -ge 2 ]]; then
-    BIND_LOCALHOST_ONLY=$(read_port_binding_preference)
+    BIND_LOCALHOST_ONLY=$(resolve NETBIRD_BIND_LOCALHOST_ONLY true read_port_binding_preference)
   fi
 
   # Handle Docker network prompts for external proxies (options 2-4)
   case "$REVERSE_PROXY_TYPE" in
-    2) EXTERNAL_PROXY_NETWORK=$(read_proxy_docker_network "Nginx") ;;
-    3) EXTERNAL_PROXY_NETWORK=$(read_proxy_docker_network "Nginx Proxy Manager") ;;
-    4) EXTERNAL_PROXY_NETWORK=$(read_proxy_docker_network "Caddy") ;;
+    2) EXTERNAL_PROXY_NETWORK=$(resolve NETBIRD_EXTERNAL_PROXY_NETWORK "" read_proxy_docker_network "Nginx") ;;
+    3) EXTERNAL_PROXY_NETWORK=$(resolve NETBIRD_EXTERNAL_PROXY_NETWORK "" read_proxy_docker_network "Nginx Proxy Manager") ;;
+    4) EXTERNAL_PROXY_NETWORK=$(resolve NETBIRD_EXTERNAL_PROXY_NETWORK "" read_proxy_docker_network "Caddy") ;;
     *) ;; # No network prompt for other options
   esac
+
+  # Only the bundled Traefik has an address we know at render time. External proxies
+  # must supply the address their proxy reaches management from.
+  if [[ "$REVERSE_PROXY_TYPE" == "0" ]]; then
+    TRUSTED_PEERS="${NETBIRD_TRUSTED_PEERS:-$TRAEFIK_IP/32}"
+  else
+    TRUSTED_PEERS="${NETBIRD_TRUSTED_PEERS:-}"
+    if [[ -z "$TRUSTED_PEERS" ]]; then
+      echo "" > /dev/stderr
+      echo "Warning: reverseProxy.trustedPeers is unset, so all IPv4 and IPv6 sources" > /dev/stderr
+      echo "are trusted to provide forwarded client-IP headers. Set NETBIRD_TRUSTED_PEERS" > /dev/stderr
+      echo "to your proxy's address (e.g. 172.20.0.5/32) and re-run." > /dev/stderr
+      echo "" > /dev/stderr
+    fi
+  fi
   return 0
 }
 
@@ -488,6 +634,7 @@ generate_configuration_files() {
   # Render docker-compose and proxy config based on selection
   case "$REVERSE_PROXY_TYPE" in
     0)
+      check_traefik_image || return 1
       render_docker_compose_traefik_builtin > docker-compose.yml
       if [[ "$ENABLE_PROXY" == "true" ]]; then
         # Create placeholder proxy.env so docker-compose can validate
@@ -527,7 +674,8 @@ generate_configuration_files() {
 
   # Common files for all configurations
   render_dashboard_env > dashboard.env
-  render_combined_yaml > config.yaml
+  install -m 600 /dev/null config.yaml
+  render_combined_yaml >> config.yaml
   return 0
 }
 
@@ -556,7 +704,7 @@ start_services_and_show_instructions() {
       echo "Creating proxy access token..."
       # Use docker exec with bash to run the token command directly
       PROXY_TOKEN=$($DOCKER_COMPOSE_COMMAND exec -T netbird-server \
-        /go/bin/netbird-server token create --name "default-proxy" --config /etc/netbird/config.yaml 2>/dev/null | grep "^Token:" | awk '{print $2}')
+        /go/bin/netbird-server admin token create --name "default-proxy" --config /etc/netbird/config.yaml 2>/dev/null | grep "^Token:" | awk '{print $2}')
 
       if [[ -z "$PROXY_TOKEN" ]]; then
         echo "ERROR: Failed to create proxy token. Check netbird-server logs." > /dev/stderr
@@ -641,8 +789,13 @@ start_services_and_show_instructions() {
     print_post_setup_instructions
 
     echo ""
-    echo -n "Press Enter when your reverse proxy is configured (or Ctrl+C to exit)... "
-    read -r < /dev/tty
+    if tty_available; then
+      echo -n "Press Enter when your reverse proxy is configured (or Ctrl+C to exit)... "
+      read -r < /dev/tty
+    else
+      echo "Non-interactive mode: starting NetBird containers now. Finish configuring"
+      echo "your reverse proxy using the instructions above so it can reach them."
+    fi
 
     echo -e "$MSG_STARTING_SERVICES"
     $DOCKER_COMPOSE_COMMAND up -d
@@ -781,11 +934,13 @@ services:
       # Docker provider
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=netbird"
+      - "--providers.docker.network=\${COMPOSE_PROJECT_NAME:-}_netbird"
       # Entrypoints
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--entrypoints.websecure.allowACMEByPass=true"
+      - "--entrypoints.web.http.aliasHeadersStrategy=delete"
+      - "--entrypoints.websecure.http.aliasHeadersStrategy=delete"
       # Disable timeouts for long-lived gRPC streams
       - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
       - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0"
@@ -911,6 +1066,7 @@ server:
   auth:
     issuer: "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/oauth2"
     signKeyRefreshEnabled: true
+    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"
     dashboardRedirectURIs:
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth"
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth"
@@ -920,6 +1076,7 @@ server:
   reverseProxy:
     trustedHTTPProxies:
       - "$TRAEFIK_IP/32"
+$(render_trusted_peers)
 
   store:
     engine: "sqlite"
@@ -928,6 +1085,12 @@ EOF
   return 0
 }
 
+render_trusted_peers() {
+  if [[ -n "$TRUSTED_PEERS" ]]; then
+    printf '    trustedPeers:\n      - "%s"' "$TRUSTED_PEERS"
+  fi
+}
+
 render_dashboard_env() {
   cat <<EOF
 # Endpoints
@@ -1340,6 +1503,9 @@ location ~ ^/(relay|ws-proxy/) {
 # Native gRPC (signal + management)
 location ~ ^/(signalexchange\.SignalExchange|management\.ManagementService)/ {
     grpc_pass grpc://${server_addr};
+    # Overwrite rather than pass through: without this the client's own
+    # x-forwarded-for metadata reaches NetBird as the connection IP.
+    grpc_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
     grpc_read_timeout 1d;
     grpc_send_timeout 1d;
     grpc_socket_keepalive on;
@@ -1637,4 +1803,6 @@ print_post_setup_instructions() {
   return 0
 }
 
-init_environment
+if [[ "${BASH_SOURCE[0]:-$0}" == "$0" ]]; then
+  init_environment
+fi
diff --git a/infrastructure_files/management.json.tmpl b/infrastructure_files/management.json.tmpl
index 32f083917..d7832b865 100644
--- a/infrastructure_files/management.json.tmpl
+++ b/infrastructure_files/management.json.tmpl
@@ -34,9 +34,7 @@
     "ReverseProxy": {
         "TrustedHTTPProxies": [],
         "TrustedHTTPProxiesCount": 0,
-        "TrustedPeers": [
-             "0.0.0.0/0"
-        ]
+        "TrustedPeers": []
     },
     "DisableDefaultPolicy": $NETBIRD_MGMT_DISABLE_DEFAULT_POLICY,
     "Datadir": "",
diff --git a/infrastructure_files/migrate-to-enterprise.sh b/infrastructure_files/migrate-to-enterprise.sh
index 8e8a41114..8abde2f68 100755
--- a/infrastructure_files/migrate-to-enterprise.sh
+++ b/infrastructure_files/migrate-to-enterprise.sh
@@ -15,7 +15,17 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
-# To revert:
+# Step 2 is skipped when the deployment already runs on Postgres
+# (server.store.engine: postgres in config.yaml). Nothing is provisioned or
+# migrated in that case and the store config is left exactly as the operator
+# wrote it — the enterprise image reads the same Postgres the community image
+# did. Such a deployment gets the image swap, and can still opt into step 3.
+#
+# If any step fails once the stack has been touched, the script rolls itself
+# back automatically: generated files are removed, the Postgres volume this run
+# created is dropped, and the original deployment is started again.
+#
+# To revert a successful migration:
 #   docker compose down
 #   rm -f docker-compose.override.yml config.yaml.enterprise
 #   # If Postgres migration was done, also restore the SQLite backup printed
@@ -25,18 +35,49 @@ set -o pipefail
 OVERRIDE_FILE="docker-compose.override.yml"
 ENTERPRISE_CONFIG_FILE="config.yaml.enterprise"
 
+# Rollback bookkeeping. ROLLBACK_STATE flips to "armed" the moment the script
+# starts mutating the deployment, and back to "disarmed" once the migration has
+# completed successfully.
+ROLLBACK_STATE="disarmed"
+ENV_EXISTED="unknown"
+# Verdict the server logs about the license key on startup: ok, rejected, or
+# unknown when neither line appeared before the timeout.
+LICENSE_VERDICT="unknown"
+LICENSE_LOG_LINES=""
+ENV_BACKUP=""
+PG_VOLUME_NAME=""
+BACKUP_DIR=""
+
+# Store state. STORE_ENGINE is what the deployment runs on today; when it is
+# already postgres, MIGRATE_POSTGRES stays "no" and nothing is provisioned.
+# POSTGRES_SERVICE is empty when Postgres lives outside this compose project.
+STORE_ENGINE=""
+EXISTING_POSTGRES="no"
+POSTGRES_DSN=""
+POSTGRES_SERVICE=""
+POSTGRES_DEPENDS_CONDITION="service_healthy"
+# Whether this run needs to generate config.yaml.enterprise at all. A pure
+# image swap does not.
+ENTERPRISE_CONFIG="no"
+
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
-  if command -v docker-compose &> /dev/null; then
-    echo "docker-compose"
-    return
+  if ! command -v docker &> /dev/null && ! command -v docker-compose &> /dev/null; then
+    echo "Docker is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/engine/install/" > /dev/stderr
+    exit 1
   fi
-  if docker compose --help &> /dev/null; then
+
+  if docker compose version &> /dev/null; then
     echo "docker compose"
     return
   fi
-  echo "docker-compose is not installed or not in PATH." > /dev/stderr
+  if command -v docker-compose &> /dev/null && docker-compose version &> /dev/null; then
+    echo "docker-compose"
+    return
+  fi
+
+  echo "Docker Compose is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/compose/install/" > /dev/stderr
   exit 1
 }
 
@@ -160,11 +201,11 @@ EOF
 # ---------------------------------------------------------------------------
 
 detect_combined_service() {
-  yq eval '.services | to_entries | map(select(.value.image | test("^netbirdio/netbird-server"))) | .[0].key // ""' "$COMPOSE_FILE"
+  yq eval '.services | to_entries | map(select(.value.image | test("^(ghcr\\.io/)?netbirdio/netbird-server([:@]|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
 }
 
 detect_dashboard_service() {
-  yq eval '.services | to_entries | map(select(.value.image | test("^netbirdio/dashboard"))) | .[0].key // ""' "$COMPOSE_FILE"
+  yq eval '.services | to_entries | map(select(.value.image | test("^(ghcr\\.io/)?netbirdio/dashboard([:@]|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
 }
 
 detect_config_yaml_host_path() {
@@ -179,6 +220,100 @@ detect_exposed_address() {
   yq eval '.server.exposedAddress // ""' "$CONFIG_YAML_HOST"
 }
 
+detect_relay_auth_secret() {
+  local secret=""
+  local external_relay_count
+  external_relay_count=$(yq eval '(.server.relays.addresses // []) | length' "$CONFIG_YAML_HOST")
+
+  if (( external_relay_count > 0 )); then
+    secret=$(yq eval '.server.relays.secret // ""' "$CONFIG_YAML_HOST")
+  fi
+  if [[ -z "$secret" ]] || [[ "$secret" == "null" ]]; then
+    secret=$(yq eval '.server.authSecret // ""' "$CONFIG_YAML_HOST")
+  fi
+
+  printf '%s' "$secret"
+}
+
+# The engine is a config.yaml-only setting — there is no env override for it
+# (combined/cmd/root.go reads it from YAML and derives the env vars), so
+# config.yaml is authoritative. Absent means the sqlite default.
+detect_store_engine() {
+  local engine
+  engine=$(yq eval '.server.store.engine // ""' "$CONFIG_YAML_HOST")
+  if [[ -z "$engine" ]] || [[ "$engine" == "null" ]]; then
+    engine="sqlite"
+  fi
+  echo "$engine" | tr '[:upper:]' '[:lower:]'
+}
+
+detect_store_dsn() {
+  yq eval '.server.store.dsn // ""' "$CONFIG_YAML_HOST"
+}
+
+# config.yaml is where a combined deployment carries its DSN; this only covers
+# hand-rolled installs that keep it in the environment instead.
+detect_store_dsn_from_compose() {
+  # `compose config` re-escapes a literal $ as $$ on the way out, so undo that
+  # to get the value the container actually receives.
+  $DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval "
+    .services[\"$COMBINED_SERVICE\"].environment.NB_STORE_ENGINE_POSTGRES_DSN //
+    .services[\"$COMBINED_SERVICE\"].environment.NETBIRD_STORE_ENGINE_POSTGRES_DSN // \"\"
+  " - 2>/dev/null | sed 's/\$\$/$/g'
+}
+
+# Reads either DSN form: "host=db ..." or "postgres://user:pass@db:5432/name".
+dsn_host() {
+  local dsn="$1"
+  case "$dsn" in
+    *://*) printf '%s' "$dsn" | sed -n 's,^[a-zA-Z+]*://\([^/?]*\).*,\1,p' | sed -e 's,.*@,,' -e 's,:.*,,' ;;
+    *) printf '%s' "$dsn" | sed -n 's/.*[[:space:]]*host=\([^[:space:]]*\).*/\1/p' ;;
+  esac
+}
+
+# flow-enricher is its own container, so a loopback host or a socket path would
+# reach the enricher rather than Postgres. Only flag hosts we can positively
+# identify — an unparseable DSN must not leave the operator with no way forward.
+dsn_host_reachable() {
+  local dsn="$1"
+  case "$(dsn_host "$dsn")" in
+    localhost | 127.* | ::1 | 0.0.0.0 | /*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+# Names the compose service running this deployment's Postgres, for depends_on.
+# Empty means external — the DSN host matched no service. A DSN with no readable
+# host falls back to matching on image.
+detect_postgres_service() {
+  local host
+  host=$(dsn_host "$POSTGRES_DSN")
+  if [[ -n "$host" ]]; then
+    if [[ "$(host="$host" yq eval '.services | has(env(host))' "$COMPOSE_FILE" 2>/dev/null)" == "true" ]]; then
+      echo "$host"
+    fi
+    return
+  fi
+  yq eval '.services | to_entries | map(select(.value.image // "" | test("(^|/)(postgres|postgis|pgvector|timescaledb)(:|@|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
+}
+
+# depends_on: service_healthy is only legal if the service defines a healthcheck.
+detect_postgres_depends_condition() {
+  local tag
+  tag=$(yq eval ".services[\"$POSTGRES_SERVICE\"].healthcheck | tag" "$COMPOSE_FILE" 2>/dev/null)
+  if [[ "$tag" == "!!map" ]]; then
+    echo "service_healthy"
+  else
+    echo "service_started"
+  fi
+}
+
+env_value() {
+  local value="$1"
+  value=$(printf '%s' "$value" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\$/$$/g')
+  printf '"%s"' "$value"
+}
+
 detect_compose_network() {
   local tag
   tag=$(yq eval ".services[\"$COMBINED_SERVICE\"].networks | tag" "$COMPOSE_FILE" 2>/dev/null)
@@ -208,9 +343,6 @@ render_override() {
 # Remove this file (and config.yaml.enterprise if present) to revert.
 
 services:
-  ${DASHBOARD_SERVICE}:
-    image: \${NETBIRD_DASHBOARD_IMAGE:-ghcr.io/netbirdio/dashboard-cloud:latest}
-
   ${COMBINED_SERVICE}:
     image: \${NETBIRD_SERVER_IMAGE:-ghcr.io/netbirdio/netbird-server-cloud:latest}
     environment:
@@ -218,16 +350,30 @@ services:
       NETBIRD_LICENSE_SERVER_BASE_URL: \${NETBIRD_LICENSE_SERVER_BASE_URL}
 EOF
 
+  # An existing Postgres is already wired up by the operator's own compose file,
+  # so only a Postgres this run creates needs a depends_on.
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     cat <<EOF
     depends_on:
-      postgres:
-        condition: service_healthy
+      ${POSTGRES_SERVICE}:
+        condition: ${POSTGRES_DEPENDS_CONDITION}
+EOF
+  fi
+
+  # The server is only pointed at a different config file when this run
+  # generates one. A pure image swap leaves it on its original config.yaml.
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
+    cat <<EOF
     volumes:
       - ./${ENTERPRISE_CONFIG_FILE}:/etc/netbird/config.yaml.enterprise:ro
     command: ["--config", "/etc/netbird/config.yaml.enterprise"]
+EOF
+  fi
 
-  postgres:
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    cat <<EOF
+
+  ${POSTGRES_SERVICE}:
     image: postgres:17
     container_name: netbird-postgres
     restart: unless-stopped
@@ -247,6 +393,14 @@ EOF
   fi
 
   if [[ "$ENABLE_FLOW" == "yes" ]]; then
+    # Nothing to wait on when Postgres is managed outside this compose project.
+    local enricher_depends=""
+    if [[ -n "$POSTGRES_SERVICE" ]]; then
+      enricher_depends="
+      ${POSTGRES_SERVICE}:
+        condition: ${POSTGRES_DEPENDS_CONDITION}"
+    fi
+
     cat <<EOF
 
   nats:
@@ -263,9 +417,7 @@ EOF
     container_name: netbird-flow-enricher
     restart: unless-stopped
     networks: [${COMPOSE_NETWORK}]
-    depends_on:
-      postgres:
-        condition: service_healthy
+    depends_on:${enricher_depends}
       nats:
         condition: service_started
     environment:
@@ -273,10 +425,10 @@ EOF
       NETBIRD_LICENSE_SERVER_BASE_URL: \${NETBIRD_LICENSE_SERVER_BASE_URL}
       NB_DATADIR: /var/lib/netbird
       NB_MANAGEMENT_STORE_ENGINE: postgres
-      NB_MANAGEMENT_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
-      NB_STORE_ENGINE_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+      NB_MANAGEMENT_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
+      NB_STORE_ENGINE_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
       NB_TRAFFIC_EVENT_STORE_ENGINE: postgres
-      NB_TRAFFIC_EVENT_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+      NB_TRAFFIC_EVENT_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
       NB_MANAGEMENT_STORE_KEY: \${NETBIRD_ENCRYPTION_KEY}
       NB_FLOW_ADAPTER_TYPE: nats
       NB_FLOW_NATS_ENDPOINTS: nats://nats:4222
@@ -333,27 +485,41 @@ EOF
   fi
 }
 
-# Build config.yaml.enterprise by yq-editing the operator's existing
-# config.yaml. We don't touch the original file.
+# Build config.yaml.enterprise from the operator's existing config.yaml. We
+# don't touch the original file. Values go through strenv() so a DSN carrying
+# quotes, backslashes or $ cannot break out of the expression.
 render_enterprise_config() {
-  local pg_dsn="host=postgres user=netbird password=${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+  {
+    echo "# Generated by migrate-to-enterprise.sh from ${CONFIG_YAML_HOST}."
+    echo "# The enterprise server is started with --config pointing at this file,"
+    echo "# so later edits to ${CONFIG_YAML_HOST} have no effect until copied here."
+    cat "$CONFIG_YAML_HOST"
+  } > "$ENTERPRISE_CONFIG_FILE"
 
-  yq eval "
-    .server.store.engine = \"postgres\" |
-    .server.store.dsn = \"$pg_dsn\" |
-    .server.activityStore.engine = \"postgres\" |
-    .server.activityStore.dsn = \"$pg_dsn\" |
-    .server.authStore.engine = \"postgres\" |
-    .server.authStore.dsn = \"$pg_dsn\"
-  " "$CONFIG_YAML_HOST" > "$ENTERPRISE_CONFIG_FILE"
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    # Fresh Postgres: point every store section at it. migrate-store carries the
+    # SQLite contents across.
+    POSTGRES_DSN="$POSTGRES_DSN" yq eval -i '
+      .server.store.engine = "postgres" |
+      .server.store.dsn = strenv(POSTGRES_DSN) |
+      .server.activityStore.engine = "postgres" |
+      .server.activityStore.dsn = strenv(POSTGRES_DSN) |
+      .server.authStore.engine = "postgres" |
+      .server.authStore.dsn = strenv(POSTGRES_DSN)
+    ' "$ENTERPRISE_CONFIG_FILE"
+  fi
+  # Otherwise the store config is the operator's and stays untouched.
+  # activityStore and authStore do not inherit from server.store — each falls
+  # back to its own SQLite file under dataDir — so repointing them at Postgres
+  # here would silently strand the existing audit log and the embedded IdP's
+  # users, with no migrate-store run to carry them over.
 
   if [[ "$ENABLE_FLOW" == "yes" ]]; then
-    local flow_addr="${NETBIRD_DOMAIN}"
-    yq eval -i "
+    NETBIRD_DOMAIN="$NETBIRD_DOMAIN" yq eval -i '
       .server.trafficFlow.enabled = true |
-      .server.trafficFlow.address = \"$flow_addr\" |
-      .server.trafficFlow.interval = \"60s\"
-    " "$ENTERPRISE_CONFIG_FILE"
+      .server.trafficFlow.address = strenv(NETBIRD_DOMAIN) |
+      .server.trafficFlow.interval = "60s"
+    ' "$ENTERPRISE_CONFIG_FILE"
   fi
 }
 
@@ -361,7 +527,77 @@ render_enterprise_config() {
 # Execution steps
 # ---------------------------------------------------------------------------
 
-resolve_data_volume() {
+combined_container_id() {
+  $DOCKER_COMPOSE_COMMAND ps -aq "$COMBINED_SERVICE" 2>/dev/null | head -1
+}
+
+container_data_mount() {
+  local container="$1"
+  [[ -n "$container" ]] || return 0
+  docker inspect "$container" --format \
+    '{{range .Mounts}}{{if eq .Destination "/var/lib/netbird"}}{{if .Name}}{{.Name}}{{else}}{{.Source}}{{end}}{{end}}{{end}}' 2>/dev/null
+}
+
+# The name comes from the container, so `-v` cannot invent an empty volume here.
+# 0 = empty, 1 = holds data, 2 = could not determine. A failed listing must not
+# be reported as empty: that would abort a healthy migration over a pull error
+# or an unreadable bind mount.
+data_dir_state() {
+  local src="$1" out
+  if [[ "$src" == /* ]]; then
+    [[ -d "$src" ]] || return 2
+    out=$(ls -A "$src" 2>/dev/null) || return 2
+  else
+    docker volume inspect "$src" &> /dev/null || return 0
+    out=$(docker run --rm -v "${src}:/d:ro" busybox sh -c 'ls -A /d' 2>/dev/null) || return 2
+  fi
+  [[ -z "$out" ]] && return 0
+  return 1
+}
+
+check_data_directory() {
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
+
+  local container
+  container=$(combined_container_id)
+  if [[ -z "$container" ]]; then
+    echo "" > /dev/stderr
+    echo "No container found for service '$COMBINED_SERVICE'." > /dev/stderr
+    echo "The migration backs up the store by copying it out of that container," > /dev/stderr
+    echo "so it has to exist. Start the deployment and re-run:" > /dev/stderr
+    echo "  $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
+    exit 1
+  fi
+
+  local src
+  src=$(container_data_mount "$container")
+  if [[ -z "$src" ]]; then
+    echo "" > /dev/stderr
+    echo "The '$COMBINED_SERVICE' container has nothing mounted at /var/lib/netbird." > /dev/stderr
+    echo "Cannot locate the NetBird store to back it up." > /dev/stderr
+    exit 1
+  fi
+
+  local state=0
+  data_dir_state "$src" || state=$?
+  if [[ $state -eq 0 ]]; then
+    echo "" > /dev/stderr
+    echo "The NetBird data directory is empty:" > /dev/stderr
+    echo "  $src" > /dev/stderr
+    echo "There is nothing to migrate. Check that you are running this from the" > /dev/stderr
+    echo "deployment directory of the NetBird install you mean to migrate." > /dev/stderr
+    exit 1
+  fi
+  if [[ $state -eq 2 ]]; then
+    echo "  ⚠ Could not read $src to confirm it holds data — continuing." > /dev/stderr
+    echo "    The backup step still fails loudly if it turns out to be empty." > /dev/stderr
+  fi
+
+  echo "  Data directory:   $src"
+}
+
+# Only for the Postgres volume, which has no container to read it off yet.
+resolve_compose_volume() {
   local short="$1"
   local actual
   # Resolve project-prefixed volume name from Docker Compose config first.
@@ -391,18 +627,21 @@ resolve_data_volume() {
 backup_sqlite() {
   BACKUP_DIR="$(pwd)/backups/sqlite-pre-enterprise-$(date +%Y%m%d-%H%M%S)"
   mkdir -p "$BACKUP_DIR"
-  local data_volume_actual
-  data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
-  echo "Backing up SQLite store from volume '$data_volume_actual' to $BACKUP_DIR ..."
-  docker run --rm \
-    -v "${data_volume_actual}:/var/lib/netbird:ro" \
-    -v "${BACKUP_DIR}:/backup" \
-    busybox \
-    sh -c 'cp -a /var/lib/netbird/. /backup/ 2>/dev/null || true'
+
+  local container
+  container=$(combined_container_id)
+  if [[ -z "$container" ]]; then
+    echo "  ⚠ No container found for '$COMBINED_SERVICE' — cannot back up the store." > /dev/stderr
+    exit 1
+  fi
+
+  echo "Backing up the NetBird store to $BACKUP_DIR ..."
+  docker cp "${container}:/var/lib/netbird/." "$BACKUP_DIR/"
+
   local copied
   copied=$(find "$BACKUP_DIR" -mindepth 1 | head -1)
   if [[ -z "$copied" ]]; then
-    echo "  ⚠ Backup directory is empty — the volume '$data_volume_actual' didn't contain data. Aborting." > /dev/stderr
+    echo "  ⚠ Backup directory is empty — /var/lib/netbird held no data. Aborting." > /dev/stderr
     exit 1
   fi
   echo "  done"
@@ -414,10 +653,224 @@ run_migrate_store() {
   echo "  done"
 }
 
+# ---------------------------------------------------------------------------
+# Rollback — a failed run must not leave the operator with a stopped stack and
+# half-written artifacts.
+# ---------------------------------------------------------------------------
+
+# Resolve the name Compose would give the Postgres volume before the override
+# exists, so a leftover volume can be spotted up front.
+compose_project_name() {
+  local container project
+  container=$($DOCKER_COMPOSE_COMMAND ps -aq 2>/dev/null | head -1)
+  if [[ -n "$container" ]]; then
+    project=$(docker inspect "$container" \
+      --format '{{index .Config.Labels "com.docker.compose.project"}}' 2>/dev/null)
+    if [[ -n "$project" ]]; then
+      echo "$project"
+      return 0
+    fi
+  fi
+  project=$($DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval '.name // ""' - 2>/dev/null)
+  if [[ -n "$project" ]] && [[ "$project" != "null" ]]; then
+    echo "$project"
+  fi
+  return 0
+}
+
+postgres_volume_name() {
+  local project
+  project=$(compose_project_name)
+  if [[ -n "$project" ]]; then
+    echo "${project}_netbird_postgres"
+  fi
+  return 0
+}
+
+# Postgres skips initdb when its data directory is non-empty, so a volume left
+# behind by an interrupted run would keep the old password and old contents,
+# and migrate-store would fail against it.
+check_stale_postgres_volume() {
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
+
+  PG_VOLUME_NAME=$(postgres_volume_name)
+  if [[ -z "$PG_VOLUME_NAME" ]]; then
+    echo ""
+    echo "  ⚠ Could not determine the Compose project name, so a Postgres volume"
+    echo "    left over from an earlier attempt cannot be checked for. If a"
+    echo "    previous run failed, remove it before continuing:"
+    echo "      docker volume ls | grep netbird_postgres"
+    return 0
+  fi
+  docker volume inspect "$PG_VOLUME_NAME" &> /dev/null || return 0
+
+  echo ""
+  echo "  ⚠  A Postgres volume from an earlier attempt already exists:"
+  echo "       $PG_VOLUME_NAME"
+  echo "     Postgres does not re-initialise a non-empty data directory, so the"
+  echo "     migration would run against stale credentials and stale data."
+  local remove
+  remove=$(read_yes_no "  Remove it and continue?" "y")
+  if [[ "$remove" != "yes" ]]; then
+    echo "" > /dev/stderr
+    echo "Aborted. Remove it manually with: docker volume rm $PG_VOLUME_NAME" > /dev/stderr
+    exit 1
+  fi
+  docker volume rm "$PG_VOLUME_NAME" > /dev/null
+  echo "  Removed."
+}
+
+# Undo whatever this run changed and start the previous deployment again.
+rollback() {
+  ROLLBACK_STATE="done"
+
+  echo ""
+  echo "──────────────────────────────────────────────────────────────────────"
+  echo " Migration failed — restoring the previous deployment"
+  echo "──────────────────────────────────────────────────────────────────────"
+
+  # Resolve while the override is still present; without it Compose no longer
+  # knows about the Postgres volume.
+  local pg_volume="$PG_VOLUME_NAME"
+  if [[ -z "$pg_volume" ]] && [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    pg_volume=$(postgres_volume_name)
+  fi
+
+  echo ""
+  echo "Stopping services ..."
+  $DOCKER_COMPOSE_COMMAND down || true
+
+  echo "Removing generated files ..."
+  rm -f "$OVERRIDE_FILE" "$ENTERPRISE_CONFIG_FILE"
+
+  # Restore .env to exactly what it was, or remove it if this run created it.
+  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
+    mv -f "$ENV_BACKUP" .env || echo "  ⚠ Could not restore .env from $ENV_BACKUP." > /dev/stderr
+  elif [[ "$ENV_EXISTED" == "no" ]]; then
+    rm -f .env || true
+  fi
+
+  # Only ever the volume this run created — never the NetBird data volume.
+  if [[ -n "$pg_volume" ]] && [[ "$pg_volume" != "null" ]]; then
+    echo "Removing Postgres volume $pg_volume ..."
+    docker volume rm "$pg_volume" &> /dev/null || true
+  fi
+
+  echo "Starting the previous deployment ..."
+  if ! $DOCKER_COMPOSE_COMMAND up -d; then
+    echo ""
+    echo "  ⚠ Could not start the previous deployment automatically." > /dev/stderr
+    echo "    Run: $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
+  fi
+
+  echo ""
+  echo "Rolled back. Your docker-compose.yml, config.yaml and the NetBird data"
+  echo "volume were never modified."
+  if [[ -n "$BACKUP_DIR" ]] && [[ -d "$BACKUP_DIR" ]]; then
+    echo "The SQLite backup taken during this run is kept at:"
+    echo "  $BACKUP_DIR"
+  fi
+  echo "──────────────────────────────────────────────────────────────────────"
+}
+
+on_exit() {
+  local code=$?
+  trap - EXIT
+  if [[ $code -ne 0 ]] && [[ "$ROLLBACK_STATE" == "armed" ]]; then
+    rollback
+  fi
+  exit $code
+}
+
 # ---------------------------------------------------------------------------
 # Main
 # ---------------------------------------------------------------------------
 
+# Already on Postgres: there is nothing to provision and nothing to migrate.
+# The enterprise image reads the very same store config the community image
+# did, so step 2 collapses to a no-op and the run is a plain image swap.
+configure_existing_postgres() {
+  EXISTING_POSTGRES="yes"
+  MIGRATE_POSTGRES="no"
+
+  # DSN first — detect_postgres_service prefers the host it names.
+  POSTGRES_DSN=$(detect_store_dsn)
+  if [[ -z "$POSTGRES_DSN" ]] || [[ "$POSTGRES_DSN" == "null" ]]; then
+    POSTGRES_DSN=$(detect_store_dsn_from_compose)
+  fi
+  if [[ "$POSTGRES_DSN" == "null" ]]; then
+    POSTGRES_DSN=""
+  fi
+
+  POSTGRES_SERVICE=$(detect_postgres_service)
+  if [[ -n "$POSTGRES_SERVICE" ]]; then
+    POSTGRES_DEPENDS_CONDITION=$(detect_postgres_depends_condition)
+  fi
+
+  echo "Step 2: Postgres migration not needed — this deployment already runs on"
+  echo "        Postgres. Its store configuration is reused as-is and left"
+  echo "        untouched; no database is created and no data is moved."
+  if [[ -n "$POSTGRES_SERVICE" ]]; then
+    echo "        Postgres service: $POSTGRES_SERVICE (in $COMPOSE_FILE)"
+  else
+    echo "        Postgres service: managed outside $COMPOSE_FILE"
+  fi
+}
+
+configure_sqlite_store() {
+  MIGRATE_POSTGRES=$(read_yes_no "Step 2: Migrate storage from SQLite to Postgres? (recommended)" "n")
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
+
+  # The override would otherwise merge into a service of the same name and
+  # quietly rewrite its image and credentials.
+  local existing
+  existing=$(yq eval '.services | has("postgres")' "$COMPOSE_FILE")
+  if [[ "$existing" == "true" ]]; then
+    echo "" > /dev/stderr
+    echo "$COMPOSE_FILE already defines a service named 'postgres', but config.yaml" > /dev/stderr
+    echo "still has server.store.engine: sqlite. This script would add its own" > /dev/stderr
+    echo "'postgres' service and Compose would merge the two." > /dev/stderr
+    echo "" > /dev/stderr
+    echo "Point server.store.engine at that Postgres yourself, or rename the service," > /dev/stderr
+    echo "then re-run." > /dev/stderr
+    exit 1
+  fi
+
+  echo ""
+  echo "  ⚠  Data will be migrated from SQLite to Postgres. The SQLite store"
+  echo "     will be backed up automatically. To fully revert later, restore"
+  echo "     that backup and delete docker-compose.override.yml +"
+  echo "     config.yaml.enterprise."
+  local confirm
+  confirm=$(read_yes_no "  Continue?" "y")
+  if [[ "$confirm" != "yes" ]]; then
+    MIGRATE_POSTGRES="no"
+    echo "  Skipping Postgres migration."
+    return 0
+  fi
+
+  POSTGRES_PASSWORD=$(rand_password)
+  POSTGRES_SERVICE="postgres"
+  POSTGRES_DEPENDS_CONDITION="service_healthy"
+  POSTGRES_DSN="host=postgres user=netbird password=${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+}
+
+# mysql, or something this script has never seen. Swapping the images is still
+# valid; touching the store is not.
+configure_unsupported_store() {
+  MIGRATE_POSTGRES="no"
+  echo "  ⚠  server.store.engine is '$STORE_ENGINE'. This script only migrates"
+  echo "     SQLite to Postgres, and traffic flow requires Postgres, so both are"
+  echo "     unavailable here. The store configuration will be left untouched."
+  echo ""
+  local proceed
+  proceed=$(read_yes_no "Step 2 skipped. Continue with the image swap only?" "n")
+  if [[ "$proceed" != "yes" ]]; then
+    echo "Aborted."
+    exit 0
+  fi
+}
+
 init_migration() {
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
   check_yq
@@ -446,12 +899,12 @@ init_migration() {
   COMPOSE_NETWORK=$(detect_compose_network)
 
   if [[ -z "$COMBINED_SERVICE" ]]; then
-    echo "Could not find a service running netbirdio/netbird-server* in $COMPOSE_FILE." > /dev/stderr
+    echo "Could not find a service running netbirdio/netbird-server or ghcr.io/netbirdio/netbird-server in $COMPOSE_FILE." > /dev/stderr
     echo "This script targets the community combined-server deployment." > /dev/stderr
     exit 1
   fi
   if [[ -z "$DASHBOARD_SERVICE" ]]; then
-    echo "Could not find a service running netbirdio/dashboard* in $COMPOSE_FILE." > /dev/stderr
+    echo "Could not find a service running netbirdio/dashboard or ghcr.io/netbirdio/dashboard in $COMPOSE_FILE." > /dev/stderr
     exit 1
   fi
   if [[ -z "$CONFIG_YAML_HOST" ]]; then
@@ -467,12 +920,15 @@ init_migration() {
     exit 1
   fi
 
+  STORE_ENGINE=$(detect_store_engine)
+
   echo "Detected existing deployment:"
   echo "  Combined service: $COMBINED_SERVICE"
   echo "  Dashboard:        $DASHBOARD_SERVICE"
   echo "  config.yaml:      $CONFIG_YAML_HOST"
   echo "  Data volume:      $DATA_VOLUME"
   echo "  Network:          $COMPOSE_NETWORK"
+  echo "  Store engine:     $STORE_ENGINE"
   echo ""
 
   require_eula_acceptance
@@ -490,38 +946,24 @@ init_migration() {
   echo ""
   echo "Step 1: Image swap (community → Enterprise). License key required."
   NB_LICENSE_KEY=$(read_secret "  License key")
-  GHCR_USERNAME="netbirdExtAccess1"
-  GHCR_TOKEN=$(read_secret "  GHCR token (input hidden)")
 
-  # Step 2 — optional
+  # Step 2 — what this does depends on what the deployment already stores in.
   echo ""
-  MIGRATE_POSTGRES=$(read_yes_no "Step 2: Migrate storage from SQLite to Postgres? (recommended)" "n")
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    echo ""
-    echo "  ⚠  Data will be migrated from SQLite to Postgres. The SQLite store"
-    echo "     will be backed up automatically. To fully revert later, restore"
-    echo "     that backup and delete docker-compose.override.yml +"
-    echo "     config.yaml.enterprise."
-    local confirm
-    confirm=$(read_yes_no "  Continue?" "y")
-    if [[ "$confirm" != "yes" ]]; then
-      MIGRATE_POSTGRES="no"
-      echo "  Skipping Postgres migration."
-    else
-      POSTGRES_PASSWORD=$(rand_password)
-    fi
-  fi
+  case "$STORE_ENGINE" in
+    postgres) configure_existing_postgres ;;
+    sqlite) configure_sqlite_store ;;
+    *) configure_unsupported_store ;;
+  esac
 
   # Step 3 — optional, only if Postgres is on (flow requires Postgres)
   echo ""
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$EXISTING_POSTGRES" == "yes" ]]; then
     ENABLE_FLOW=$(read_yes_no "Step 3: Enable traffic flow? (requires Postgres)" "n")
     if [[ "$ENABLE_FLOW" == "yes" ]]; then
-      # Auth secret MUST match server.authSecret from config.yaml
-      NB_FLOW_AUTH_SECRET=$(yq eval '.server.authSecret // ""' "$CONFIG_YAML_HOST")
+      NB_FLOW_AUTH_SECRET=$(detect_relay_auth_secret)
       if [[ -z "$NB_FLOW_AUTH_SECRET" ]] || [[ "$NB_FLOW_AUTH_SECRET" == "null" ]]; then
-        echo "Could not read server.authSecret from $CONFIG_YAML_HOST." > /dev/stderr
-        echo "Flow receiver auth must match the combined server's authSecret." > /dev/stderr
+        echo "Could not resolve the Relay auth secret from $CONFIG_YAML_HOST." > /dev/stderr
+        echo "Set server.relays.secret for external Relays or server.authSecret for the local Relay." > /dev/stderr
         exit 1
       fi
 
@@ -538,14 +980,87 @@ init_migration() {
         echo "Could not read server.store.encryptionKey from $CONFIG_YAML_HOST." > /dev/stderr
         exit 1
       fi
+
+      # flow-enricher talks to Postgres directly, so this is the one place an
+      # existing deployment's DSN is actually needed — and the one place a host
+      # that only works from inside the server container shows up.
+      while :; do
+        local dsn_problem=""
+        if [[ -z "$POSTGRES_DSN" ]]; then
+          dsn_problem="No DSN could be read from $CONFIG_YAML_HOST or from the $COMBINED_SERVICE environment."
+        elif ! dsn_host_reachable "$POSTGRES_DSN"; then
+          dsn_problem="Its host '$(dsn_host "$POSTGRES_DSN")' only resolves inside the server container."
+        fi
+        [[ -n "$dsn_problem" ]] || break
+
+        echo ""
+        echo "  The flow enricher reaches Postgres from a container of its own."
+        echo "  $dsn_problem"
+        echo "  Enter a DSN reachable from other containers, or press Ctrl-C to abort."
+        POSTGRES_DSN=$(read_required "  Postgres DSN (host=… user=… password=… dbname=… port=5432 sslmode=disable)")
+      done
+
+      # Only where the operator owns Postgres: a DSN entered above may name a
+      # different host. The sqlite path creates its own service, nothing to find.
+      if [[ "$EXISTING_POSTGRES" == "yes" ]]; then
+        POSTGRES_SERVICE=$(detect_postgres_service)
+        if [[ -n "$POSTGRES_SERVICE" ]]; then
+          POSTGRES_DEPENDS_CONDITION=$(detect_postgres_depends_condition)
+        fi
+      fi
     fi
   else
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
+
+  # config.yaml.enterprise only exists to hold changes; without any there is
+  # nothing to generate and the server keeps running on its own config.yaml.
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$ENABLE_FLOW" == "yes" ]]; then
+    ENTERPRISE_CONFIG="yes"
+  fi
+
+  check_data_directory
+  check_stale_postgres_volume
+}
+
+wait_for_license_verdict() {
+  local counter=0
+  local logs=""
+
+  echo -n "Waiting for the server to validate the license"
+  while [[ $counter -lt 60 ]]; do
+
+    logs=$($DOCKER_COMPOSE_COMMAND logs --no-color --tail=all "$COMBINED_SERVICE" 2>/dev/null || true)
+
+    if grep -qi "license invalidated" <<< "$logs"; then
+      echo " rejected"
+      LICENSE_VERDICT="rejected"
+      LICENSE_LOG_LINES=$(grep -i "license" <<< "$logs" | tail -n 5 || true)
+      return 0
+    fi
+
+    if grep -qi "license validated" <<< "$logs"; then
+      echo " ok"
+      LICENSE_VERDICT="ok"
+      return 0
+    fi
+
+    echo -n " ."
+    sleep 2
+    counter=$((counter + 1))
+  done
+
+  echo " no verdict in 120s"
+  LICENSE_VERDICT="unknown"
+  LICENSE_LOG_LINES=$(grep -iE "failed to validate license|error validating license" <<< "$logs" | tail -n 3 || true)
+  return 0
 }
 
 apply_changes() {
+  # From here on a failure must roll the deployment back.
+  ROLLBACK_STATE="armed"
+
   echo ""
   echo "Writing $OVERRIDE_FILE ..."
   install -m 644 /dev/null "$OVERRIDE_FILE"
@@ -555,7 +1070,7 @@ apply_changes() {
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' "$OVERRIDE_FILE" && rm -f "$OVERRIDE_FILE.bak"
   fi
 
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
     echo "Writing $ENTERPRISE_CONFIG_FILE ..."
     install -m 600 /dev/null "$ENTERPRISE_CONFIG_FILE"
     render_enterprise_config
@@ -566,6 +1081,14 @@ apply_changes() {
   # picks it up automatically.
   echo "Writing .env additions (mode 600) ..."
   local ENV_FILE=".env"
+  # Snapshot the operator's .env so a rollback can restore it byte for byte.
+  if [[ -f "$ENV_FILE" ]]; then
+    ENV_EXISTED="yes"
+    ENV_BACKUP="${ENV_FILE}.pre-enterprise-$(date +%Y%m%d-%H%M%S)"
+    cp -p "$ENV_FILE" "$ENV_BACKUP"
+  else
+    ENV_EXISTED="no"
+  fi
   touch "$ENV_FILE"
   chmod 600 "$ENV_FILE"
   {
@@ -583,27 +1106,30 @@ apply_changes() {
       echo "POSTGRES_PASSWORD=${POSTGRES_PASSWORD}"
     fi
     if [[ "$ENABLE_FLOW" == "yes" ]]; then
+      # Own variable name rather than NB_STORE_ENGINE_POSTGRES_DSN so that a
+      # deployment already setting that one keeps its own value.
+      echo "NB_ENTERPRISE_POSTGRES_DSN=$(env_value "$POSTGRES_DSN")"
       echo "NB_FLOW_AUTH_SECRET=${NB_FLOW_AUTH_SECRET}"
       echo "NETBIRD_ENCRYPTION_KEY=${NETBIRD_ENCRYPTION_KEY}"
     fi
   } >> "$ENV_FILE"
 
-  echo ""
-  echo "Logging in to ghcr.io ..."
-  printf '%s' "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin
-  unset GHCR_TOKEN
-
   echo ""
   echo "Pulling enterprise images ..."
   $DOCKER_COMPOSE_COMMAND pull
 
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     echo ""
-    echo "Stopping existing services (volumes preserved) ..."
-    $DOCKER_COMPOSE_COMMAND down
+    # Stop, but keep the containers: the backup reads the store out of one.
+    echo "Stopping services so the store is quiescent ..."
+    $DOCKER_COMPOSE_COMMAND stop
 
     backup_sqlite
 
+    echo ""
+    echo "Removing stopped containers (volumes preserved) ..."
+    $DOCKER_COMPOSE_COMMAND down
+
     echo ""
     echo "Starting Postgres ..."
     $DOCKER_COMPOSE_COMMAND up -d postgres
@@ -631,8 +1157,59 @@ apply_changes() {
   echo "Bringing up all services ..."
   $DOCKER_COMPOSE_COMMAND up -d
 
+  echo ""
+  wait_for_license_verdict
+
   echo ""
   echo "Migration complete."
+
+  if [[ "$LICENSE_VERDICT" == "rejected" ]]; then
+    local unreachable="false"
+    if grep -qi "couldn't be validated with the license server" <<< "$LICENSE_LOG_LINES"; then
+      unreachable="true"
+    fi
+
+    echo ""
+    if [[ "$unreachable" == "true" ]]; then
+      echo "  ⚠  The server could not validate the license:"
+    else
+      echo "  ⚠  The server rejected the license key:"
+    fi
+    while IFS= read -r line; do
+      [[ -n "$line" ]] && echo "     $line"
+    done <<< "$LICENSE_LOG_LINES"
+    echo ""
+    echo "     The migration itself completed: the images and any migrated data"
+    echo "     are in place, and only the license check did not pass."
+    echo ""
+    if [[ "$unreachable" == "true" ]]; then
+      echo "     The license server could not be reached, so the key itself was"
+      echo "     never checked. Confirm this host has outbound access to the"
+      echo "     license server, then restart:"
+    else
+      echo "     Check the reason the server gave above, verify that"
+      echo "     NB_LICENSE_KEY in .env matches the key you were issued, then"
+      echo "     restart:"
+    fi
+    echo ""
+    echo "       $DOCKER_COMPOSE_COMMAND up -d"
+  elif [[ "$LICENSE_VERDICT" == "unknown" ]]; then
+    echo ""
+    echo "  ⚠  The server logged no license verdict within 120s."
+    if [[ -n "$LICENSE_LOG_LINES" ]]; then
+      echo "     It was still reporting validation errors:"
+      while IFS= read -r line; do
+        [[ -n "$line" ]] && echo "     $line"
+      done <<< "$LICENSE_LOG_LINES"
+    fi
+    echo ""
+    echo "     Check the verdict with:"
+    echo ""
+    echo "       $DOCKER_COMPOSE_COMMAND logs $COMBINED_SERVICE | grep -i license"
+  fi
+
+  # Nothing left to undo.
+  ROLLBACK_STATE="disarmed"
 }
 
 print_summary() {
@@ -641,15 +1218,26 @@ print_summary() {
   echo " Summary"
   echo "──────────────────────────────────────────────────────────────────────"
   echo "  Images:           swapped to enterprise"
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "  Storage:          Postgres (data migrated from SQLite)"
-  [[ "$MIGRATE_POSTGRES" != "yes" ]] && echo "  Storage:          SQLite (unchanged)"
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    echo "  Storage:          Postgres (data migrated from SQLite)"
+  elif [[ "$EXISTING_POSTGRES" == "yes" ]]; then
+    echo "  Storage:          Postgres (pre-existing, configuration unchanged)"
+  else
+    echo "  Storage:          $STORE_ENGINE (unchanged)"
+  fi
   [[ "$ENABLE_FLOW" == "yes" ]] && echo "  Traffic flow:     enabled"
   [[ "$ENABLE_FLOW" != "yes" ]] && echo "  Traffic flow:     disabled"
+  case "$LICENSE_VERDICT" in
+    ok)       echo "  License:          validated by the server" ;;
+    rejected) echo "  License:          REJECTED - see above, the install is not usable yet" ;;
+    *)        echo "  License:          not confirmed (no verdict in the logs yet)" ;;
+  esac
   echo ""
   echo "  Generated files (next to your docker-compose.yml):"
   echo "    $OVERRIDE_FILE"
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
+  [[ "$ENTERPRISE_CONFIG" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
+  [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
   echo ""
   echo " Tail logs:"
@@ -658,19 +1246,31 @@ print_summary() {
   echo "──────────────────────────────────────────────────────────────────────"
   echo " To revert"
   echo "──────────────────────────────────────────────────────────────────────"
-  echo "  $DOCKER_COMPOSE_COMMAND down"
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    # Resolve project-prefixed volume names now (before override is removed).
-    local pg_volume data_volume_actual
-    pg_volume=$(resolve_data_volume "netbird_postgres")
-    data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
-    echo "  # Remove the Postgres volume FIRST, before deleting the override file:"
-    echo "  docker volume rm $pg_volume"
+    # Resolve the project-prefixed volume name now, before the override is gone.
+    local pg_volume
+    pg_volume=$(resolve_compose_volume "netbird_postgres")
+    echo "  # Stop, but keep the containers so the store can be copied back in:"
+    echo "  $DOCKER_COMPOSE_COMMAND stop"
     echo "  # Restore SQLite from the backup created during this run:"
-    echo "  docker run --rm -v ${data_volume_actual}:/var/lib/netbird -v ${BACKUP_DIR}:/backup busybox sh -c 'cp -a /backup/. /var/lib/netbird/'"
+    echo "  docker cp ${BACKUP_DIR}/. \$($DOCKER_COMPOSE_COMMAND ps -aq $COMBINED_SERVICE):/var/lib/netbird/"
+    echo "  $DOCKER_COMPOSE_COMMAND down"
+    echo "  docker volume rm $pg_volume"
+  else
+    echo "  $DOCKER_COMPOSE_COMMAND down"
+  fi
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
+    echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
+  else
+    echo "  rm -f $OVERRIDE_FILE"
+  fi
+  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
+    echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
+  elif [[ "$ENV_EXISTED" == "no" ]]; then
+    echo "  rm -f .env   # created by this run"
+  else
+    echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
   fi
-  echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
-  echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
   echo "  $DOCKER_COMPOSE_COMMAND up -d"
   echo "──────────────────────────────────────────────────────────────────────"
 }
@@ -679,6 +1279,17 @@ print_summary() {
 # Run
 # ---------------------------------------------------------------------------
 
+trap on_exit EXIT
+# Turn signals into a normal exit so the EXIT trap can roll back.
+trap 'exit 130' INT TERM
+
 init_migration
 apply_changes
 print_summary
+
+# A rejected license leaves a migrated but unusable install. Say so in the exit
+# code too, or a wrapper script reads this run as a clean success.
+if [[ "$LICENSE_VERDICT" == "rejected" ]]; then
+  exit 1
+fi
+exit 0
diff --git a/infrastructure_files/migrate.sh b/infrastructure_files/migrate.sh
index 67895fab6..46971a57a 100755
--- a/infrastructure_files/migrate.sh
+++ b/infrastructure_files/migrate.sh
@@ -838,7 +838,7 @@ generate_docker_compose_traefik() {
 services:
   # Traefik reverse proxy (automatic TLS via Let's Encrypt)
   traefik:
-    image: traefik:v3.6
+    image: traefik:v3.7.14
     container_name: netbird-traefik
     restart: unless-stopped
     networks:
@@ -851,11 +851,13 @@ services:
       # Docker provider
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=netbird"
+      - "--providers.docker.network=\${COMPOSE_PROJECT_NAME:-}_netbird"
       # Entrypoints
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--entrypoints.websecure.allowACMEByPass=true"
+      - "--entrypoints.web.http.aliasHeadersStrategy=delete"
+      - "--entrypoints.websecure.http.aliasHeadersStrategy=delete"
       # Disable timeouts for long-lived gRPC streams
       - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
       - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0"
@@ -1283,4 +1285,6 @@ main() {
   return 0
 }
 
-main "$@"
+if [[ "${BASH_SOURCE[0]:-$0}" == "$0" ]]; then
+  main "$@"
+fi
diff --git a/infrastructure_files/observability/grafana/dashboards/client.json b/infrastructure_files/observability/grafana/dashboards/client.json
new file mode 100644
index 000000000..05306a972
--- /dev/null
+++ b/infrastructure_files/observability/grafana/dashboards/client.json
@@ -0,0 +1,1107 @@
+{
+  "__inputs": [
+    {
+      "name": "DS_PROMETHEUS",
+      "label": "Prometheus",
+      "description": "",
+      "type": "datasource",
+      "pluginId": "prometheus",
+      "pluginName": "Prometheus"
+    }
+  ],
+  "__elements": {},
+  "__requires": [
+    {
+      "type": "grafana",
+      "id": "grafana",
+      "name": "Grafana",
+      "version": "11.1.1"
+    },
+    {
+      "type": "datasource",
+      "id": "prometheus",
+      "name": "Prometheus",
+      "version": "1.0.0"
+    },
+    {
+      "type": "panel",
+      "id": "stat",
+      "name": "Stat",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "timeseries",
+      "name": "Time series",
+      "version": ""
+    }
+  ],
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": null,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 1,
+      "panels": [],
+      "title": "Connection state",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": null
+              },
+              {
+                "color": "green",
+                "value": 1
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 0,
+        "y": 1
+      },
+      "id": 2,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "netbird_management_connected{job=~\"$job\",instance=~\"$instance\"}",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Management connected",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": null
+              },
+              {
+                "color": "green",
+                "value": 1
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 6,
+        "y": 1
+      },
+      "id": 3,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "netbird_signal_connected{job=~\"$job\",instance=~\"$instance\"}",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Signal connected",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": null
+              },
+              {
+                "color": "green",
+                "value": 1
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 12,
+        "y": 1
+      },
+      "id": 4,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "netbird_peers{job=~\"$job\",instance=~\"$instance\"}",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Known peers",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": null
+              },
+              {
+                "color": "green",
+                "value": 1
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 6,
+        "x": 18,
+        "y": 1
+      },
+      "id": 5,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(netbird_peers_connected{job=~\"$job\",instance=~\"$instance\"})",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Connected peers",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 8,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 5
+      },
+      "id": 6,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "maxHeight": 600,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "netbird_peers_connected{job=~\"$job\",instance=~\"$instance\"}",
+          "instant": false,
+          "legendFormat": "{{connection_type}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Connected peers by connection type",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 8,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 5
+      },
+      "id": 7,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "maxHeight": 600,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "netbird_peer_latency_seconds{job=~\"$job\",instance=~\"$instance\"}",
+          "instant": false,
+          "legendFormat": "{{peer}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Peer latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 13
+      },
+      "id": 8,
+      "panels": [],
+      "title": "Peer connection establishment",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 8,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 14
+      },
+      "id": 9,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "maxHeight": 600,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.5,sum(increase(netbird_peer_connection_stage_duration_seconds_bucket{job=~\"$job\",instance=~\"$instance\",stage=\"total\"}[$__rate_interval])) by (le,connection_type))",
+          "instant": false,
+          "legendFormat": "{{connection_type}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Connection establishment duration (p50)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 8,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 14
+      },
+      "id": 10,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "maxHeight": 600,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.5,sum(increase(netbird_peer_connection_stage_duration_seconds_bucket{job=~\"$job\",instance=~\"$instance\"}[$__rate_interval])) by (le,stage))",
+          "instant": false,
+          "legendFormat": "{{stage}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Connection establishment stages (p50)",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 22
+      },
+      "id": 11,
+      "panels": [],
+      "title": "Management interactions",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 8,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 8,
+        "x": 0,
+        "y": 23
+      },
+      "id": 12,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "maxHeight": 600,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.5,sum(increase(netbird_sync_duration_seconds_bucket{job=~\"$job\",instance=~\"$instance\"}[$__rate_interval])) by (le))",
+          "instant": false,
+          "legendFormat": "sync",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Sync processing duration (p50)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 8,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 8,
+        "x": 8,
+        "y": 23
+      },
+      "id": 13,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "maxHeight": 600,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.5,sum(increase(netbird_sync_phase_duration_seconds_bucket{job=~\"$job\",instance=~\"$instance\"}[$__rate_interval])) by (le,phase))",
+          "instant": false,
+          "legendFormat": "{{phase}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Sync phase duration (p50)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 8,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 8,
+        "x": 16,
+        "y": 23
+      },
+      "id": 14,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "maxHeight": 600,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.5,sum(increase(netbird_login_duration_seconds_bucket{job=~\"$job\",instance=~\"$instance\"}[$__rate_interval])) by (le,success))",
+          "instant": false,
+          "legendFormat": "success={{success}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Login duration (p50)",
+      "type": "timeseries"
+    }
+  ],
+  "schemaVersion": 39,
+  "tags": [
+    "netbird",
+    "client"
+  ],
+  "templating": {
+    "list": [
+      {
+        "current": {},
+        "hide": 0,
+        "includeAll": false,
+        "multi": false,
+        "name": "datasource",
+        "options": [],
+        "query": "prometheus",
+        "queryValue": "",
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "type": "datasource"
+      },
+      {
+        "current": {},
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(netbird_management_connected,job)",
+        "hide": 0,
+        "includeAll": true,
+        "multi": true,
+        "name": "job",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(netbird_management_connected,job)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      },
+      {
+        "current": {},
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(netbird_management_connected{job=~\"$job\"},instance)",
+        "hide": 0,
+        "includeAll": true,
+        "multi": true,
+        "name": "instance",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(netbird_management_connected{job=~\"$job\"},instance)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-24h",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "browser",
+  "title": "Netbird / Client",
+  "uid": "netbird-client-v001",
+  "version": 1,
+  "weekStart": ""
+}
diff --git a/infrastructure_files/observability/grafana/dashboards/management-enterprise.json b/infrastructure_files/observability/grafana/dashboards/management-enterprise.json
new file mode 100644
index 000000000..481050a02
--- /dev/null
+++ b/infrastructure_files/observability/grafana/dashboards/management-enterprise.json
@@ -0,0 +1,8857 @@
+{
+  "annotations": [
+    {
+      "kind": "AnnotationQuery",
+      "spec": {
+        "builtIn": true,
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "query": {
+          "datasource": {
+            "name": "-- Grafana --"
+          },
+          "group": "grafana",
+          "kind": "DataQuery",
+          "spec": {},
+          "version": "v0"
+        }
+      }
+    },
+    {
+      "kind": "AnnotationQuery",
+      "spec": {
+        "enable": true,
+        "hide": false,
+        "iconColor": "red",
+        "name": "Deployments",
+        "query": {
+          "datasource": {
+            "name": "grafana"
+          },
+          "group": "datasource",
+          "kind": "DataQuery",
+          "spec": {
+            "expr": "",
+            "interval": "",
+            "refId": "Anno",
+            "tags": [],
+            "type": "tags"
+          },
+          "version": "v0"
+        }
+      }
+    }
+  ],
+  "cursorSync": "Crosshair",
+  "editable": true,
+  "elements": {
+    "panel-1": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "exemplar": false,
+                      "expr": "histogram_quantile(0.99, sum by(le) (rate(management_grpc_updatechannel_queue_length_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])))",
+                      "format": "table",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "instant": false,
+                      "legendFormat": "Connected grpc streams",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "p99 of the update-channel queue length: how many network map updates are waiting to be delivered to a peer. The channel buffer is 100 messages - approaching it means updates start getting dropped and peers fall behind.",
+        "id": 1,
+        "links": [],
+        "title": "UpdateChannel Queue length max",
+        "vizConfig": {
+          "group": "stat",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "decimals": 2,
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "blue",
+                      "value": 0
+                    },
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 50
+                    }
+                  ]
+                },
+                "unit": "none"
+              },
+              "overrides": []
+            },
+            "options": {
+              "colorMode": "background",
+              "graphMode": "area",
+              "justifyMode": "auto",
+              "orientation": "auto",
+              "percentChangeColorMode": "standard",
+              "reduceOptions": {
+                "calcs": [
+                  "lastNotNull"
+                ],
+                "fields": "",
+                "values": false
+              },
+              "showPercentChange": false,
+              "textMode": "auto",
+              "wideLayout": true
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-10": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_http_request_duration_ms_total_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\", type=\"read\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "HTTP read duration",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "p95 duration of read API requests (GET/OPTIONS), from the total request duration histogram tagged type=read.",
+        "id": 10,
+        "links": [],
+        "title": "Read HTTP API Requests p95 Duration (GET/OPTIONS)",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": true,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "orange",
+                      "value": 200
+                    }
+                  ]
+                },
+                "unit": "ms"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-11": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(environment) (rate(management_updatechannel_close_one_duration_micro_microseconds_count{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])*60)",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "CloseOne",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "expr": "sum(rate(management_updatechannel_send_duration_micro_count{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval]))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "Send",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum(rate(management_updatechannel_create_duration_micro_count{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval])*60)",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "Create",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "C"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "rate(management_updatechannel_get_all_duration_micro_count{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval])*60",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "GetAll",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "D"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "rate(management_updatechannel_haschannel_duration_micro_count{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval])*60",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "HasChannel",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "E"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "rate(management_updatechannel_close_multiple_channels_count{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval])*60",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "CloseMultiple",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "F"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Rate per minute of update-channel operations: close one, send update, create, get all connected peers, has-channel and close multiple. Together they show how much channel churn an instance is handling.",
+        "id": 11,
+        "links": [],
+        "title": "Update Channel operations",
+        "vizConfig": {
+          "group": "barchart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "fillOpacity": 69,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "lineWidth": 1,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "fieldMinMax": false,
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    }
+                  ]
+                },
+                "unit": "reqpm"
+              },
+              "overrides": []
+            },
+            "options": {
+              "barRadius": 0,
+              "barWidth": 0.97,
+              "fullHighlight": false,
+              "groupWidth": 0.7,
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true,
+                "sortBy": "Mean",
+                "sortDesc": true
+              },
+              "orientation": "auto",
+              "showValue": "auto",
+              "stacking": "normal",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              },
+              "xTickLabelRotation": 0,
+              "xTickLabelSpacing": 100
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-12": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": true,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "rate(management_updatechannel_create_duration_micro_microseconds_count{job=~\"$job\", instance=~\"$instance\", closed=\"true\"}[$__rate_interval])",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "legendFormat": "{{host}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": true,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(environment) (rate(management_updatechannel_create_duration_micro_microseconds_count{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "legendFormat": "{{host}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "__expr__"
+                    },
+                    "group": "__expr__",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "expression": "100-$A/$B*100",
+                      "type": "math"
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "C"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Tracks how often a new peer update channel replaces a channel that was still open (closed=true), i.e. peers reconnecting before management noticed the previous stream was gone. The plotted expression is 100 - recreated/total, so the line drops as recreations rise.",
+        "id": 12,
+        "links": [],
+        "title": "Percentage of Recreated channels",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "axisSoftMax": 100,
+                  "axisSoftMin": 0,
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": true,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    }
+                  ]
+                },
+                "unit": "percent"
+              },
+              "overrides": [
+                {
+                  "matcher": {
+                    "id": "byFrameRefID",
+                    "options": "C"
+                  },
+                  "properties": [
+                    {
+                      "id": "displayName",
+                      "value": "Recreation"
+                    }
+                  ]
+                }
+              ]
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-13": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_updatechannel_close_one_duration_micro_microseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "CloseOne",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_updatechannel_send_duration_micro_microseconds_bucket{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "Send",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_updatechannel_create_duration_micro_microseconds_bucket{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "Create",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "C"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_updatechannel_get_all_duration_micro_microseconds_bucket{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "GetAll",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "D"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_updatechannel_haschannel_duration_micro_microseconds_bucket{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "CloseMultiple",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "E"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_updatechannel_close_multiple_channels_bucket{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "HasChannel",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "F"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "p95 duration of each update-channel operation, in microseconds. These are in-memory operations behind a lock, so growth here means lock contention rather than I/O.",
+        "id": 13,
+        "links": [],
+        "title": "Update Channel methods p95 Duration",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 0,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": true,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "fieldMinMax": false,
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    }
+                  ]
+                },
+                "unit": "µs"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-14": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "exemplar": false,
+                      "expr": "sum(management_grpc_connected_streams_ratio{job=~\"$job\", instance=~\"$instance\"})",
+                      "format": "time_series",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "legendFormat": "Connected grpc streams",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Total number of peers currently holding an open gRPC Sync stream across all management instances (management.grpc.connected.streams). A sudden drop means peers were disconnected and will come back as a Login/Sync reconnect storm.",
+        "id": 14,
+        "links": [],
+        "title": "Connected peers",
+        "vizConfig": {
+          "group": "stat",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "decimals": 2,
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "blue",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 0
+                    },
+                    {
+                      "color": "#EAB839",
+                      "value": 8000
+                    },
+                    {
+                      "color": "green",
+                      "value": 11000
+                    }
+                  ]
+                },
+                "unit": "short"
+              },
+              "overrides": []
+            },
+            "options": {
+              "colorMode": "background",
+              "graphMode": "area",
+              "justifyMode": "auto",
+              "orientation": "auto",
+              "percentChangeColorMode": "standard",
+              "reduceOptions": {
+                "calcs": [
+                  "lastNotNull"
+                ],
+                "fields": "",
+                "values": false
+              },
+              "showPercentChange": true,
+              "textMode": "auto",
+              "wideLayout": true
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-15": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "expr": "management_grpc_connected_streams_ratio{job=~\"$job\", instance=~\"$instance\"}",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "{{host}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "builder",
+                      "expr": "sum by(instance) (management_grpc_connected_streams_ratio{job=~\"$job\", instance=~\"$instance\"})",
+                      "instant": false,
+                      "legendFormat": "Total",
+                      "range": true
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Open peer Sync streams over time, in total per instance (A) and as raw series (B). Steps down mark instance restarts or LB rebalancing; the ramp back up is the reconnect wave.",
+        "id": 15,
+        "links": [],
+        "title": "Connected peers historical",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": true,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    }
+                  ]
+                },
+                "unit": "short"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-16": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_grpc_sync_request_duration_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "GRPC Sync duration",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "p95 duration of the Sync gRPC request - the time management needs to authenticate the peer, build its first network map and open the update channel. Primary latency SLI for peer connects.",
+        "id": 16,
+        "links": [],
+        "title": "gRPC Sync Request p95 Duration",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 200
+                    }
+                  ]
+                },
+                "unit": "ms"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-17": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_grpc_login_request_duration_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "GRPC Login duration",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "p95 duration of the Login gRPC request (peer authentication plus initial configuration and relay credentials). Rises when the IdP, the store or account locking is slow.",
+        "id": 17,
+        "links": [],
+        "title": "gRPC Login Request p95 Duration",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 200
+                    }
+                  ]
+                },
+                "unit": "ms"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-18": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(le) (increase(management_account_get_peer_network_map_duration_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of the time taken to build the network map returned to a single peer, in milliseconds.",
+        "id": 18,
+        "links": [],
+        "title": "GetPeerNetworkMap Latency",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.5,
+                "fill": "dark-orange",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Oranges",
+                "steps": 64
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "ms"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-19": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "exemplar": false,
+                      "expr": "sum by(le) (increase(management_account_network_map_object_count_objects_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "interval": "",
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of the number of objects (peers, routes, firewall rules, DNS entries and so on) in the network maps sent to clients. Large maps make both calculation and serialization more expensive.",
+        "id": 19,
+        "links": [],
+        "title": "NetworkMap Objects",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.5,
+                "fill": "dark-orange",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Oranges",
+                "steps": 64
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 0,
+                "reverse": false,
+                "unit": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-2": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "exemplar": false,
+                      "expr": "sum by(environment) (rate(management_grpc_login_request_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "legendFormat": "login",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "exemplar": false,
+                      "expr": "sum by(environment) (rate(management_grpc_sync_request_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "legendFormat": "sync",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "exemplar": false,
+                      "expr": "sum by(environment) (rate(management_grpc_key_request_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "legendFormat": "get key",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "C"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Rate of the three peer-facing gRPC calls: Login (authenticate, return initial config and relay credentials), Sync (open the update channel and receive network map updates) and GetServerKey (fetch the server WireGuard public key). Elevated Login/Sync rates usually mean peers are reconnecting in a loop.",
+        "id": 2,
+        "links": [],
+        "title": "gRPC Requests",
+        "vizConfig": {
+          "group": "barchart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "fillOpacity": 51,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "lineWidth": 1,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "reqps"
+              },
+              "overrides": []
+            },
+            "options": {
+              "barRadius": 0,
+              "barWidth": 0.97,
+              "fullHighlight": true,
+              "groupWidth": 0.7,
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "orientation": "auto",
+              "showValue": "auto",
+              "stacking": "normal",
+              "text": {},
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              },
+              "xTickLabelRotation": 0,
+              "xTickLabelSpacing": 100
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-20": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(le) (increase(management_updatechannel_tosyncresponse_duration_micro_microseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of the time taken to convert a calculated network map into the gRPC SyncResponse sent to the peer, in microseconds.",
+        "id": 20,
+        "links": [],
+        "title": "To Sync Response",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.5,
+                "fill": "dark-orange",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Oranges",
+                "steps": 64
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "µs"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-23": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "expr": "sum by(le) (increase(management_grpc_sync_request_duration_p95_by_account_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of per-account p95 Sync durations - each sample is one account's p95, flushed every 60s. Shows whether slow Syncs are spread across the fleet or concentrated in a few accounts.",
+        "id": 23,
+        "links": [],
+        "title": "GRPC Sync Latency",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.6,
+                "fill": "dark-red",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Purples",
+                "steps": 128
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "ms"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-24": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(le) (increase(management_grpc_login_request_duration_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of Login gRPC request durations across all peers. The right tail is what a peer experiences on startup; samples beyond 7s are what the high-latency counters in the Debugging row track.",
+        "id": 24,
+        "links": [],
+        "title": "GRPC Login Latency",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.5,
+                "fill": "dark-orange",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Purples",
+                "steps": 128
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "ms"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-25": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "rate(management_grpc_login_request_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "{{host}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "code",
+                      "expr": "sum by(environment) (rate(management_grpc_login_request_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "instant": false,
+                      "legendFormat": "Total",
+                      "range": true
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Rate of Login requests, per instance (A) and in total (B). Login is the most expensive peer call (IdP plus store writes); a sustained high rate means clients are restarting or failing to hold their Sync stream.",
+        "id": 25,
+        "links": [],
+        "title": "gRPC Login Request rate",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 200
+                    }
+                  ]
+                },
+                "unit": "reqps"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-26": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "rate(management_grpc_sync_request_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "{{host}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "code",
+                      "expr": "sum by(environment) (rate(management_grpc_sync_request_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "instant": false,
+                      "legendFormat": "Total",
+                      "range": true
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Rate of Sync requests, per instance (A) and in total (B). Every Sync opens or re-opens a peer update channel, so a spike here is a reconnect storm and predicts CPU spent on network map calculation.",
+        "id": 26,
+        "links": [],
+        "title": "gRPC Sync Request rate",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 200
+                    }
+                  ]
+                },
+                "unit": "reqps"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-27": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(le) (increase(management_grpc_updatechannel_queue_length_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of update-channel queue lengths across all peers. Mass moving to the right shows a growing backlog of undelivered network map updates.",
+        "id": 27,
+        "links": [],
+        "title": "Update Channel heat map",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.5,
+                "fill": "dark-orange",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Greens",
+                "steps": 73
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-29": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(endpoint) (rate(management_http_response_counter_total{job=~\"$job\", instance=~\"$instance\", method=\"GET\", code=~\"^2.+\"}[$__rate_interval])*60) > 10",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "{{endpoint}} > 10",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(environment) (rate(management_http_response_counter_total{job=~\"$job\", instance=~\"$instance\", host=\"$host\", method=\"GET\", code=~\"^2.+\"}[$__rate_interval])*60)",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "Total",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Successful (2xx) GET requests per minute broken down by endpoint, limited to endpoints above 10 rpm. Shows which read endpoints dashboard and API clients hit hardest.",
+        "id": 29,
+        "links": [],
+        "title": "HTTP Read request counter",
+        "vizConfig": {
+          "group": "barchart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "fillOpacity": 80,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "lineWidth": 0,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "fieldMinMax": false,
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "short"
+              },
+              "overrides": []
+            },
+            "options": {
+              "barRadius": 0,
+              "barWidth": 0.97,
+              "fullHighlight": false,
+              "groupWidth": 0.7,
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true,
+                "sortBy": "Mean",
+                "sortDesc": true
+              },
+              "orientation": "auto",
+              "showValue": "auto",
+              "stacking": "normal",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              },
+              "xTickLabelRotation": 0,
+              "xTickLabelSpacing": 100
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-30": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(endpoint) (rate(management_http_response_counter_total{job=~\"$job\", instance=~\"$instance\", method!~\"(GET|OPTIONS)\", code=~\"^2.+\"}[$__rate_interval])*60) > 1",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "{{endpoint}} > 1",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": true,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(environment) (rate(management_http_response_counter_total{job=~\"$job\", instance=~\"$instance\", host=\"$host\", method!~\"(GET|OPTIONS)\", code=~\"^2.+\"}[$__rate_interval])*60)",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "Total",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Successful (2xx) non-GET/OPTIONS requests per minute by endpoint, limited to endpoints above 1 rpm. Writes take account locks and fan out network map updates, so read this together with the Network Map row.",
+        "id": 30,
+        "links": [],
+        "title": "HTTP Write request counter",
+        "vizConfig": {
+          "group": "barchart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "fillOpacity": 80,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "lineWidth": 0,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "fieldMinMax": false,
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "reqpm"
+              },
+              "overrides": []
+            },
+            "options": {
+              "barRadius": 0,
+              "barWidth": 0.97,
+              "fullHighlight": false,
+              "groupWidth": 0.7,
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true,
+                "sortBy": "Last *",
+                "sortDesc": true
+              },
+              "orientation": "auto",
+              "showValue": "auto",
+              "stacking": "normal",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              },
+              "xTickLabelRotation": 0,
+              "xTickLabelSpacing": 100
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-31": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(le) (increase(management_store_persistence_duration_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of how long it takes to save or delete an account in the store (management.store.persistence.duration.ms). Widening buckets point at database write pressure.",
+        "id": 31,
+        "links": [],
+        "title": "Store Persistence latency",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.6,
+                "fill": "dark-red",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Reds",
+                "steps": 128
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "ms"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-32": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(le) (increase(management_store_transaction_duration_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of store transaction execution time. Nearly every API and gRPC call runs through a transaction, so this is the first place to look when latency rises everywhere at once.",
+        "id": 32,
+        "links": [],
+        "title": "Store Transaction latency",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.6,
+                "fill": "dark-red",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Reds",
+                "steps": 128
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "ms"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-33": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(environment) (rate(management_account_peer_meta_update_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])*60)",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "{{endpoint}} > 10",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Rate per minute of peers reporting changed metadata (OS, version, hostname, addresses). Each change persists the peer and can trigger an account peers update.",
+        "id": 33,
+        "links": [],
+        "title": "Peer meta updates counter",
+        "vizConfig": {
+          "group": "barchart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "fillOpacity": 80,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "lineWidth": 0,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "fieldMinMax": false,
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "reqpm"
+              },
+              "overrides": []
+            },
+            "options": {
+              "barRadius": 0,
+              "barWidth": 0.97,
+              "fullHighlight": false,
+              "groupWidth": 0.7,
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true,
+                "sortBy": "Mean",
+                "sortDesc": true
+              },
+              "orientation": "auto",
+              "showValue": "auto",
+              "stacking": "normal",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              },
+              "xTickLabelRotation": 0,
+              "xTickLabelSpacing": 100
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-34": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(environment) (rate(management_grpc_sync_request_blocked_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "GRPC Sync request rate",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Rate of Sync requests rejected because the peer is blocked (login expired, peer disabled or account restricted). A rising line means clients retrying without valid access.",
+        "id": 34,
+        "links": [],
+        "title": "gRPC Sync Request Blocked rate",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 0
+                    }
+                  ]
+                },
+                "unit": "reqps"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-35": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(environment) (rate(management_grpc_login_request_blocked_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "GRPC Login request rate",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Rate of Login requests rejected because the peer is blocked. Persistent volume here is usually expired peer logins retrying in a loop.",
+        "id": 35,
+        "links": [],
+        "title": "gRPC Login Request Blocked rate",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 0
+                    }
+                  ]
+                },
+                "unit": "reqps"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-36": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(le) (increase(management_account_update_account_peers_duration_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of the time taken by an account peers update: preparing the data and pushing a fresh network map to every peer in the account, in milliseconds. Scales with account size.",
+        "id": 36,
+        "links": [],
+        "title": "UpdateAccountPeers Latency",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.5,
+                "fill": "dark-orange",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Oranges",
+                "steps": 64
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "ms"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-37": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(le) (increase(management_updatechannel_calc_networkmap_duration_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of the time taken to calculate one peer's network map, in milliseconds. This is the dominant CPU cost when many peers reconnect at once.",
+        "id": 37,
+        "links": [],
+        "title": "Network Map Calculation",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.5,
+                "fill": "dark-orange",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Oranges",
+                "steps": 64
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "ms"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-39": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(le) (increase(management_updatechannel_calc_posturechecks_duration_micro_microseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of the time taken to evaluate a peer's posture checks while building its network map, in microseconds.",
+        "id": 39,
+        "links": [],
+        "title": "Posture Check Calculation",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.5,
+                "fill": "dark-orange",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Oranges",
+                "steps": 64
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "µs"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-45": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "code",
+                      "exemplar": false,
+                      "expr": "sort_desc(\n  topk(\n    10,\n    sum by (account_id) (\n      increase(management_grpc_login_request_high_latency_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__interval])\n    )\n  )\n)",
+                      "format": "table",
+                      "instant": true,
+                      "legendFormat": "__auto",
+                      "range": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": [
+              {
+                "group": "organize",
+                "kind": "Transformation",
+                "spec": {
+                  "options": {
+                    "excludeByName": {
+                      "Time": true
+                    },
+                    "includeByName": {},
+                    "indexByName": {},
+                    "renameByName": {
+                      "Time": ""
+                    }
+                  }
+                }
+              }
+            ]
+          }
+        },
+        "description": "Top 10 accounts by number of Login requests that exceeded the 7s high-latency threshold.",
+        "id": 45,
+        "links": [],
+        "title": "High Login Latency Ranking (login count per account)",
+        "vizConfig": {
+          "group": "table",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "align": "auto",
+                  "cellOptions": {
+                    "type": "auto"
+                  },
+                  "filterable": false,
+                  "footer": {
+                    "reducers": []
+                  },
+                  "inspect": false,
+                  "tooltip": {
+                    "placement": "auto"
+                  },
+                  "wrapHeaderText": false
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "cellHeight": "sm",
+              "showHeader": true,
+              "sortBy": [
+                {
+                  "desc": false,
+                  "displayName": "Time"
+                }
+              ]
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-46": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "code",
+                      "exemplar": false,
+                      "expr": "sort_desc(\n  topk(\n    10,\n    sum by (account_id) (\n      increase(management_grpc_sync_request_high_latency_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__interval])\n    )\n  )\n)",
+                      "format": "table",
+                      "instant": true,
+                      "legendFormat": "__auto",
+                      "range": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": [
+              {
+                "group": "organize",
+                "kind": "Transformation",
+                "spec": {
+                  "options": {
+                    "excludeByName": {
+                      "Time": true
+                    },
+                    "includeByName": {},
+                    "indexByName": {},
+                    "renameByName": {
+                      "Time": ""
+                    }
+                  }
+                }
+              }
+            ]
+          }
+        },
+        "description": "Top 10 accounts by number of Sync requests that exceeded the 7s high-latency threshold. Use it to find which tenant is behind a latency spike.",
+        "id": 46,
+        "links": [],
+        "title": "High Sync Latency Ranking (sync count per account)",
+        "vizConfig": {
+          "group": "table",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "align": "auto",
+                  "cellOptions": {
+                    "type": "auto"
+                  },
+                  "filterable": false,
+                  "footer": {
+                    "reducers": []
+                  },
+                  "inspect": false,
+                  "tooltip": {
+                    "placement": "auto"
+                  },
+                  "wrapHeaderText": false
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "cellHeight": "sm",
+              "showHeader": true,
+              "sortBy": [
+                {
+                  "desc": false,
+                  "displayName": "Time"
+                }
+              ]
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-47": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "code",
+                      "expr": "count(\n  sum by (account_id) (\n    increase(management_grpc_sync_request_high_latency_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__interval])\n  ) > 1\n)",
+                      "legendFormat": "__auto",
+                      "range": true
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Number of distinct accounts with more than one slow (>7s) Sync in the interval - tells you whether a latency spike is fleet-wide or limited to a few tenants.",
+        "id": 47,
+        "links": [],
+        "title": "Accounts with high Sync latency",
+        "vizConfig": {
+          "group": "gauge",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "barShape": "flat",
+              "barWidthFactor": 0.5,
+              "effects": {
+                "barGlow": false,
+                "centerGlow": false,
+                "gradient": false
+              },
+              "endpointMarker": "point",
+              "minVizHeight": 75,
+              "minVizWidth": 75,
+              "orientation": "auto",
+              "reduceOptions": {
+                "calcs": [
+                  "lastNotNull"
+                ],
+                "fields": "",
+                "values": false
+              },
+              "segmentCount": 1,
+              "segmentSpacing": 0.3,
+              "shape": "gauge",
+              "showThresholdLabels": false,
+              "showThresholdMarkers": true,
+              "sizing": "auto",
+              "sparkline": false,
+              "textMode": "auto"
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-48": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "code",
+                      "expr": "count(\n  sum by (account_id) (\n    increase(management_grpc_login_request_high_latency_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__interval])\n  ) > 1\n)",
+                      "legendFormat": "__auto",
+                      "range": true
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Number of distinct accounts with more than one slow (>7s) Login in the interval.",
+        "id": 48,
+        "links": [],
+        "title": "Accounts with high Login latency",
+        "vizConfig": {
+          "group": "gauge",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "barShape": "flat",
+              "barWidthFactor": 0.5,
+              "effects": {
+                "barGlow": false,
+                "centerGlow": false,
+                "gradient": false
+              },
+              "endpointMarker": "point",
+              "minVizHeight": 75,
+              "minVizWidth": 75,
+              "orientation": "auto",
+              "reduceOptions": {
+                "calcs": [
+                  "lastNotNull"
+                ],
+                "fields": "",
+                "values": false
+              },
+              "segmentCount": 1,
+              "segmentSpacing": 0.3,
+              "shape": "gauge",
+              "showThresholdLabels": false,
+              "showThresholdMarkers": true,
+              "sizing": "auto",
+              "sparkline": false,
+              "textMode": "auto"
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-50": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${logs_datasource}"
+                    },
+                    "group": "loki",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "direction": "backward",
+                      "editorMode": "code",
+                      "expr": "sort_desc(\ntopk(\n    20,\n    sum by (peerID) (\n      count_over_time(\n        {job=\"$log_job\"} |= \"Sync took\" | regexp `peerID:\\s(?P<peerID>[^,\\]]+)` [$__range]\n      )\n    )\n)\n)",
+                      "queryType": "instant"
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": [
+              {
+                "group": "organize",
+                "kind": "Transformation",
+                "spec": {
+                  "options": {
+                    "excludeByName": {
+                      "Time": true
+                    },
+                    "includeByName": {},
+                    "indexByName": {},
+                    "renameByName": {
+                      "Value #A": "number of times ",
+                      "peerID": "peerPubKey"
+                    }
+                  }
+                }
+              }
+            ]
+          }
+        },
+        "description": "Top 20 peers by number of Sync log lines in the selected range, parsed out of the management logs to find individual peers stuck in a reconnect loop. Pick the log stream with the `log stream` variable; the query matches the `Sync took` debug line, so management must run at debug level for this panel to have data.",
+        "id": 50,
+        "links": [],
+        "title": "Highest Syncs by peer key",
+        "vizConfig": {
+          "group": "table",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "align": "auto",
+                  "cellOptions": {
+                    "type": "auto"
+                  },
+                  "filterable": false,
+                  "footer": {
+                    "reducers": []
+                  },
+                  "inspect": false,
+                  "tooltip": {
+                    "placement": "auto"
+                  },
+                  "wrapHeaderText": false
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": [
+                {
+                  "matcher": {
+                    "id": "byName",
+                    "options": "labels"
+                  },
+                  "properties": [
+                    {
+                      "id": "custom.width",
+                      "value": 180
+                    }
+                  ]
+                },
+                {
+                  "matcher": {
+                    "id": "byName",
+                    "options": "peerPubKey"
+                  },
+                  "properties": [
+                    {
+                      "id": "custom.width",
+                      "value": 455
+                    }
+                  ]
+                }
+              ]
+            },
+            "options": {
+              "cellHeight": "sm",
+              "showHeader": true,
+              "sortBy": [
+                {
+                  "desc": true,
+                  "displayName": "number of times "
+                }
+              ]
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-52": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "builder",
+                      "expr": "wsproxy_active_connections{job=~\"$job\", instance=~\"$instance\"}",
+                      "legendFormat": "{{__name__}}",
+                      "range": true
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Currently open WebSocket proxy connections. The wsproxy fronts gRPC for browser-based clients, so this is the number of connected web clients.",
+        "id": 52,
+        "links": [],
+        "title": "Proxy Active Connections",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 0,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "auto",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-53": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "builder",
+                      "expr": "delta(wsproxy_bytes_transferred_total{job=~\"$job\", instance=~\"$instance\"}[$__interval])",
+                      "legendFormat": "{{direction}}",
+                      "range": true
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Bytes transferred through the WebSocket proxy per interval, split by direction.",
+        "id": 53,
+        "links": [],
+        "title": "Proxy Traffic by Direction",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 0,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "auto",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "decbytes"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-54": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "builder",
+                      "expr": "increase(wsproxy_errors_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])",
+                      "legendFormat": "{{error_type}}",
+                      "range": true
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "WebSocket proxy errors grouped by error type - dial failures, read/write errors and protocol issues on browser client connections.",
+        "id": 54,
+        "links": [],
+        "title": "Errors by Type",
+        "vizConfig": {
+          "group": "barchart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "fillOpacity": 80,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "lineWidth": 1,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "barRadius": 0,
+              "barWidth": 0.97,
+              "fullHighlight": false,
+              "groupWidth": 0.7,
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "orientation": "auto",
+              "showValue": "auto",
+              "stacking": "none",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              },
+              "xTickLabelRotation": 0,
+              "xTickLabelSpacing": 0
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-65": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "builder",
+                      "exemplar": false,
+                      "expr": "management_grpc_connected_streams_ratio{job=~\"$job\", instance=~\"$instance\"}",
+                      "instant": true,
+                      "legendFormat": "{{host}}",
+                      "range": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Open peer Sync streams per management instance. Use it to confirm the load balancer spreads streams evenly - a skewed instance carries proportionally more update-channel and network map work.",
+        "id": 65,
+        "links": [],
+        "title": "Connected Peers per Server",
+        "vizConfig": {
+          "group": "gauge",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "barShape": "flat",
+              "barWidthFactor": 0.5,
+              "effects": {
+                "barGlow": false,
+                "centerGlow": false,
+                "gradient": false
+              },
+              "endpointMarker": "point",
+              "minVizHeight": 75,
+              "minVizWidth": 75,
+              "orientation": "auto",
+              "reduceOptions": {
+                "calcs": [
+                  "lastNotNull"
+                ],
+                "fields": "",
+                "values": false
+              },
+              "segmentCount": 1,
+              "segmentSpacing": 0.3,
+              "shape": "gauge",
+              "showThresholdLabels": false,
+              "showThresholdMarkers": true,
+              "sizing": "auto",
+              "sparkline": false,
+              "textMode": "auto"
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-66": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(host) (rate(management_http_response_counter_total{job=~\"$job\", instance=~\"$instance\", method=\"GET\", code=~\"^2.+\"}[$__rate_interval]) * 60)",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "{{host}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Successful GET requests per minute grouped by management instance - read load distribution across the fleet.",
+        "id": 66,
+        "links": [],
+        "title": "HTTP Read request counter",
+        "vizConfig": {
+          "group": "barchart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "fillOpacity": 80,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "lineWidth": 0,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "fieldMinMax": false,
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "short"
+              },
+              "overrides": []
+            },
+            "options": {
+              "barRadius": 0,
+              "barWidth": 0.97,
+              "fullHighlight": false,
+              "groupWidth": 0.7,
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true,
+                "sortBy": "Mean",
+                "sortDesc": true
+              },
+              "orientation": "auto",
+              "showValue": "auto",
+              "stacking": "normal",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              },
+              "xTickLabelRotation": 0,
+              "xTickLabelSpacing": 100
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-67": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(host) (rate(management_http_response_counter_total{job=~\"$job\", instance=~\"$instance\", method!~\"(GET|OPTIONS)\", code=~\"^2.+\"}[$__rate_interval])*60)",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "{{host}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Successful write requests per minute grouped by management instance - write load distribution across the fleet.",
+        "id": 67,
+        "links": [],
+        "title": "HTTP Write request counter",
+        "vizConfig": {
+          "group": "barchart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "fillOpacity": 80,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "lineWidth": 0,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "fieldMinMax": false,
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "reqpm"
+              },
+              "overrides": []
+            },
+            "options": {
+              "barRadius": 0,
+              "barWidth": 0.97,
+              "fullHighlight": false,
+              "groupWidth": 0.7,
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true,
+                "sortBy": "Last *",
+                "sortDesc": true
+              },
+              "orientation": "auto",
+              "showValue": "auto",
+              "stacking": "normal",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              },
+              "xTickLabelRotation": 0,
+              "xTickLabelSpacing": 100
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-7": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_http_request_duration_ms_total_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\", type=\"write\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "HTTP write duration",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "p95 duration of write API requests (PUT/POST/DELETE), tagged type=write. Writes acquire account locks and trigger peer updates, so they are normally slower than reads.",
+        "id": 7,
+        "links": [],
+        "title": "Write HTTP API Requests p95 Duration (PUT/POST/DELETE)",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": true,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 200
+                    }
+                  ]
+                },
+                "unit": "ms"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-74": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(le) (increase(management_pat_usage_distribution_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Distribution of personal access token usage counts, sampled once per minute per token. Mass in the high buckets means a single PAT is hammering the API.",
+        "id": 74,
+        "links": [],
+        "title": "PAT usage counter",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.5,
+                "fill": "dark-orange",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Purples",
+                "steps": 128
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-76": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "exemplar": false,
+                      "expr": "gnatsd_connz_subscriptions{job=~\"$job\", instance=~\"$instance\"}",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": true,
+                      "legendFormat": "{{host}}",
+                      "range": false,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Current subscriptions held by each client connected to NATS (connz). Signal instances subscribe per connected peer, so this tracks how peers are spread across signal nodes.",
+        "id": 76,
+        "links": [],
+        "title": "Subscriptions per node",
+        "vizConfig": {
+          "group": "stat",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "colorMode": "value",
+              "graphMode": "area",
+              "justifyMode": "auto",
+              "orientation": "auto",
+              "percentChangeColorMode": "standard",
+              "reduceOptions": {
+                "calcs": [
+                  "lastNotNull"
+                ],
+                "fields": "",
+                "values": false
+              },
+              "showPercentChange": false,
+              "textMode": "auto",
+              "wideLayout": true
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-77": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "exemplar": false,
+                      "expr": "gnatsd_connz_subscriptions{job=~\"$job\", instance=~\"$instance\"}",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "legendFormat": "{{host}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Subscriptions per connected NATS client over time. Steps mark signal instances restarting and re-subscribing their peers.",
+        "id": 77,
+        "links": [],
+        "title": "Subscriptions per node",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 0,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "auto",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-78": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "expr": "gnatsd_connz_num_connections{job=~\"$job\", instance=~\"$instance\"}",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "{{host}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Number of client connections on each NATS node - effectively how many signal instances are attached to that node.",
+        "id": 78,
+        "links": [],
+        "title": "Signal nodes connected per NATs",
+        "vizConfig": {
+          "group": "stat",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "colorMode": "value",
+              "graphMode": "area",
+              "justifyMode": "auto",
+              "orientation": "auto",
+              "percentChangeColorMode": "standard",
+              "reduceOptions": {
+                "calcs": [
+                  "lastNotNull"
+                ],
+                "fields": "",
+                "values": false
+              },
+              "showPercentChange": false,
+              "textMode": "auto",
+              "wideLayout": true
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-79": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "expr": "sum by(environment) (rate(gnatsd_connz_out_msgs{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Rate of messages NATS delivers out to its clients: the peer signalling throughput flowing through the cluster.",
+        "id": 79,
+        "links": [],
+        "title": "Messages per Second",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 0,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "auto",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "mps"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-8": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_http_request_duration_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "HTTP request duration",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "p95 duration of incoming REST API requests by endpoint and method (management.http.request.duration.ms). Covers dashboard and API clients only - peer traffic is on the gRPC panels.",
+        "id": 8,
+        "links": [],
+        "title": "HTTP API Requests p95 Duration",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": true,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 200
+                    }
+                  ]
+                },
+                "unit": "ms"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-80": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "expr": "sum by(environment) (rate(gnatsd_connz_out_bytes{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Rate of bytes NATS delivers out to its clients - signalling bandwidth, useful next to the message rate to spot unusually large payloads.",
+        "id": 80,
+        "links": [],
+        "title": "Data per Second",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 0,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "auto",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "bytes"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-81": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "expr": "sum by(environment) (increase(gnatsd_varz_slow_consumers{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval]))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Increase of the NATS slow-consumer counter. Anything above zero means a signal node could not read fast enough and NATS dropped its connection, so peers lose signalling until it reconnects.",
+        "id": 81,
+        "links": [],
+        "title": "Slow consumers detected",
+        "vizConfig": {
+          "group": "barchart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "fillOpacity": 80,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "lineWidth": 1,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "decimals": 0,
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "none"
+              },
+              "overrides": []
+            },
+            "options": {
+              "barRadius": 0,
+              "barWidth": 0.97,
+              "fullHighlight": false,
+              "groupWidth": 0.7,
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "orientation": "auto",
+              "showValue": "auto",
+              "stacking": "none",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              },
+              "xTickLabelRotation": 0,
+              "xTickLabelSpacing": 100
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-82": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "expr": "gnatsd_varz_subscriptions{job=~\"$job\", instance=~\"$instance\"}",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "{{host}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Total subscriptions registered on each NATS server (varz). Grows roughly with the number of connected peers.",
+        "id": 82,
+        "links": [],
+        "title": "Total number of NATS subscriptions",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 0,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "auto",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-83": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "process_resident_memory_bytes{job=~\"$job\", instance=~\"$instance\"}",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "{{instance}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Resident memory of the scraped processes. process_resident_memory_bytes is exposed by every Go/Prometheus process, so narrow the job and instance variables to the NATS nodes to read this panel as NATS memory.",
+        "id": 83,
+        "links": [],
+        "title": "NATS memory consumption",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 0,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "auto",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "bytes"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "max",
+                  "min"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-84": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "idelta(management_grpc_sync_request_duration_p95_by_account_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[2m])",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Per-account Sync p95 samples as a heatmap (2m deltas). Use it to spot a handful of large or slow accounts pulling the overall Sync latency up.",
+        "id": 84,
+        "links": [],
+        "title": "GRPC Sync Latency By Account",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.6,
+                "fill": "dark-red",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Purples",
+                "steps": 128
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "ms"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-85": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "idelta(management_grpc_login_request_duration_p95_by_account_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[2m])",
+                      "format": "heatmap",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Per-account Login p95 samples as a heatmap (2m deltas). Highlights accounts whose logins are much slower than the fleet average.",
+        "id": 85,
+        "links": [],
+        "title": "GRPC Login Latency By Account",
+        "vizConfig": {
+          "group": "heatmap",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "scaleDistribution": {
+                    "type": "linear"
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "calculate": false,
+              "cellGap": 1,
+              "color": {
+                "exponent": 0.5,
+                "fill": "dark-orange",
+                "mode": "scheme",
+                "reverse": false,
+                "scale": "exponential",
+                "scheme": "Purples",
+                "steps": 128
+              },
+              "exemplars": {
+                "color": "rgba(255,0,255,0.7)"
+              },
+              "filterValues": {
+                "le": 1e-09
+              },
+              "legend": {
+                "placement": "bottom",
+                "show": true
+              },
+              "rowsFrame": {
+                "layout": "auto"
+              },
+              "tooltip": {
+                "mode": "single",
+                "showColorScale": false,
+                "yHistogram": false
+              },
+              "yAxis": {
+                "axisPlacement": "left",
+                "axisWidth": 60,
+                "decimals": 1,
+                "reverse": false,
+                "unit": "ms"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-86": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_grpc_sync_request_duration_p95_by_account_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "GRPC Sync duration",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "p95 of the per-account Sync p95 distribution - the latency seen by the worst-served accounts rather than by the average request. Diverges from the global p95 when only a few accounts are hurting.",
+        "id": 86,
+        "links": [],
+        "title": "gRPC Sync Request p95 Duration (by Account)",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 500
+                    }
+                  ]
+                },
+                "unit": "ms"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-87": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "histogram_quantile(0.95, sum by(le) (rate(management_grpc_login_request_duration_p95_by_account_ms_milliseconds_bucket{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])))",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "GRPC Login duration",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "p95 of the per-account Login p95 distribution - login latency for the worst-served accounts rather than the average request.",
+        "id": 87,
+        "links": [],
+        "title": "gRPC Login Request p95 Duration  (by Account)",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "thresholds"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 32,
+                  "gradientMode": "hue",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineWidth": 1,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "line"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 200
+                    }
+                  ]
+                },
+                "unit": "ms"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-88": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "exemplar": false,
+                      "expr": "sum by(environment) (increase(management_account_update_account_peers_counter_total{job=~\"$job\", instance=~\"$instance\"}[2m])) / 2",
+                      "format": "time_series",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "interval": "",
+                      "legendFormat": "{{environment}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Account peers updates triggered per minute (2m increase halved). Each trigger recalculates and pushes network maps to every peer in the account.",
+        "id": 88,
+        "links": [],
+        "title": "NetworkMap Triggers Total",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "continuous-BlYlRd",
+                  "seriesBy": "last"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 19,
+                  "gradientMode": "scheme",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "smooth",
+                  "lineStyle": {
+                    "fill": "solid"
+                  },
+                  "lineWidth": 2,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "cpm"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-89": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "exemplar": false,
+                      "expr": "sum by(resource) (increase(management_account_update_account_peers_counter_total{job=~\"$job\", instance=~\"$instance\"}[2m]))",
+                      "format": "time_series",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "interval": "",
+                      "legendFormat": "__auto",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Account peers updates over 2m intervals, grouped by the resource that triggered them - the time series behind the pie chart above.",
+        "id": 89,
+        "links": [],
+        "title": "NetworkMap Triggers By Source",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic",
+                  "seriesBy": "max"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.9,
+                  "drawStyle": "line",
+                  "fillOpacity": 50,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineStyle": {
+                    "fill": "solid"
+                  },
+                  "lineWidth": 2,
+                  "pointSize": 1,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "always",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "normal"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "cpm"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-9": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "sum by(environment) (rate(management_idp_authenticate_request_counter_total{job=~\"$job\", instance=~\"$instance\"}[$__rate_interval])*60)",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "authenticate (mgtm->auth0)",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "rate(management_idp_update_user_meta_counter_total{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$interval])*60",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "update user meta",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "B"
+                }
+              },
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "expr": "rate(management_idp_get_account_counter_total{job=~\"$job\", instance=~\"$instance\", host=\"$host\"}[$__rate_interval])*60",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": false,
+                      "legendFormat": "get account",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "C"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Requests per minute that management sends to the configured identity provider: authenticate (service token refresh), user metadata updates and account lookups. IdP throttling shows up here before it shows up as Login latency.",
+        "id": 9,
+        "links": [],
+        "title": "IdP Requests",
+        "vizConfig": {
+          "group": "barchart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "fillOpacity": 69,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "lineWidth": 1,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    }
+                  ]
+                },
+                "unit": "short"
+              },
+              "overrides": []
+            },
+            "options": {
+              "barRadius": 0,
+              "barWidth": 0.97,
+              "fullHighlight": false,
+              "groupWidth": 0.7,
+              "legend": {
+                "calcs": [
+                  "lastNotNull",
+                  "min",
+                  "mean",
+                  "max"
+                ],
+                "displayMode": "table",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "orientation": "auto",
+              "showValue": "never",
+              "stacking": "normal",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              },
+              "xTickLabelRotation": 0,
+              "xTickLabelSpacing": 100
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-90": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "code",
+                      "exemplar": false,
+                      "expr": "sum by(resource) (increase(management_account_update_account_peers_counter_total{job=~\"$job\", instance=~\"$instance\"}[1h]))",
+                      "instant": true,
+                      "legendFormat": "__auto",
+                      "range": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Account peers updates over the last hour, grouped by the resource that triggered them (policy, group, peer, route, user, network, ...). Shows which kind of configuration change generates the most fan-out work.",
+        "id": 90,
+        "links": [],
+        "title": "NetworkMap Triggers by source in last hour",
+        "vizConfig": {
+          "group": "piechart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "fixedColor": "#73BF69",
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "displayLabels": [
+                "percent"
+              ],
+              "legend": {
+                "displayMode": "list",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "pieType": "donut",
+              "reduceOptions": {
+                "calcs": [
+                  "lastNotNull"
+                ],
+                "fields": "",
+                "values": false
+              },
+              "sort": "desc",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-91": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "editorMode": "builder",
+                      "exemplar": false,
+                      "expr": "sum by(resource) (increase(management_network_map_counter_total{job=~\"$job\", instance=~\"$instance\"}[1h]))",
+                      "instant": true,
+                      "legendFormat": "__auto",
+                      "range": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Network maps computed in the last hour, grouped by the resource whose change triggered the computation.",
+        "id": 91,
+        "links": [],
+        "title": "NetworkMaps by source in last hour",
+        "vizConfig": {
+          "group": "piechart",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "fixedColor": "#73BF69",
+                  "mode": "palette-classic"
+                },
+                "custom": {
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  }
+                }
+              },
+              "overrides": []
+            },
+            "options": {
+              "displayLabels": [
+                "percent"
+              ],
+              "legend": {
+                "displayMode": "list",
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "pieType": "donut",
+              "reduceOptions": {
+                "calcs": [
+                  "lastNotNull"
+                ],
+                "fields": "",
+                "values": false
+              },
+              "sort": "desc",
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-92": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "builder",
+                      "exemplar": false,
+                      "expr": "sum by(environment) (increase(management_network_map_counter_total{job=~\"$job\", instance=~\"$instance\"}[2m])) / 2",
+                      "format": "time_series",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "interval": "",
+                      "legendFormat": "{{environment}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Network maps computed per minute (2m increase halved). One account peers update fans out into one map per peer, so this - not the trigger count - is the real CPU driver.",
+        "id": 92,
+        "links": [],
+        "title": "NetworkMaps Total",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "continuous-BlYlRd",
+                  "seriesBy": "last"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.6,
+                  "drawStyle": "line",
+                  "fillOpacity": 19,
+                  "gradientMode": "scheme",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "smooth",
+                  "lineStyle": {
+                    "fill": "solid"
+                  },
+                  "lineWidth": 2,
+                  "pointSize": 5,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "never",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "cpm"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    },
+    "panel-93": {
+      "kind": "Panel",
+      "spec": {
+        "data": {
+          "kind": "QueryGroup",
+          "spec": {
+            "queries": [
+              {
+                "kind": "PanelQuery",
+                "spec": {
+                  "hidden": false,
+                  "query": {
+                    "datasource": {
+                      "name": "${datasource}"
+                    },
+                    "group": "prometheus",
+                    "kind": "DataQuery",
+                    "spec": {
+                      "disableTextWrap": false,
+                      "editorMode": "code",
+                      "exemplar": false,
+                      "expr": "sum by(resource) (increase(management_network_map_counter_total{job=~\"$job\", instance=~\"$instance\"}[2m])) / 2",
+                      "format": "time_series",
+                      "fullMetaSearch": false,
+                      "includeNullMetadata": true,
+                      "instant": false,
+                      "interval": "",
+                      "legendFormat": "{{resource}}",
+                      "range": true,
+                      "useBackend": false
+                    },
+                    "version": "v0"
+                  },
+                  "refId": "A"
+                }
+              }
+            ],
+            "queryOptions": {},
+            "transformations": []
+          }
+        },
+        "description": "Network maps computed per minute, grouped by the resource that triggered the computation.",
+        "id": 93,
+        "links": [],
+        "title": "NetworkMaps Total By Source",
+        "vizConfig": {
+          "group": "timeseries",
+          "kind": "VizConfig",
+          "spec": {
+            "fieldConfig": {
+              "defaults": {
+                "color": {
+                  "mode": "palette-classic",
+                  "seriesBy": "max"
+                },
+                "custom": {
+                  "axisBorderShow": false,
+                  "axisCenteredZero": false,
+                  "axisColorMode": "text",
+                  "axisLabel": "",
+                  "axisPlacement": "auto",
+                  "barAlignment": 0,
+                  "barWidthFactor": 0.9,
+                  "drawStyle": "line",
+                  "fillOpacity": 0,
+                  "gradientMode": "none",
+                  "hideFrom": {
+                    "legend": false,
+                    "tooltip": false,
+                    "viz": false
+                  },
+                  "insertNulls": false,
+                  "lineInterpolation": "linear",
+                  "lineStyle": {
+                    "fill": "solid"
+                  },
+                  "lineWidth": 1,
+                  "pointSize": 1,
+                  "scaleDistribution": {
+                    "type": "linear"
+                  },
+                  "showPoints": "always",
+                  "showValues": false,
+                  "spanNulls": false,
+                  "stacking": {
+                    "group": "A",
+                    "mode": "none"
+                  },
+                  "thresholdsStyle": {
+                    "mode": "off"
+                  }
+                },
+                "thresholds": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "green",
+                      "value": 0
+                    },
+                    {
+                      "color": "red",
+                      "value": 80
+                    }
+                  ]
+                },
+                "unit": "cpm"
+              },
+              "overrides": []
+            },
+            "options": {
+              "annotations": {
+                "clustering": -1,
+                "multiLane": false
+              },
+              "legend": {
+                "calcs": [],
+                "displayMode": "list",
+                "enableFacetedFilter": false,
+                "overflow": "ellipsis",
+                "placement": "bottom",
+                "showLegend": true
+              },
+              "tooltip": {
+                "hideZeros": false,
+                "mode": "single",
+                "sort": "none"
+              }
+            }
+          },
+          "version": "13.2.0-30616302309"
+        }
+      }
+    }
+  },
+  "layout": {
+    "kind": "RowsLayout",
+    "spec": {
+      "rows": [
+        {
+          "kind": "RowsLayoutRow",
+          "spec": {
+            "collapse": false,
+            "layout": {
+              "kind": "GridLayout",
+              "spec": {
+                "items": [
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-14"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 0
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-65"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 0
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-15"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 8
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-2"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 8
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-23"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 16
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-24"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 16
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-16"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 24
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-17"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 24
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-84"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 32
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-85"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 32
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-86"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 40
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-87"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 40
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-26"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 48
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-25"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 48
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-34"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 56
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-35"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 56
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-31"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 64
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-32"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 64
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-9"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 72
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-8"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 72
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-29"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 80
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-30"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 80
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-66"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 88
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-67"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 88
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-10"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 96
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-7"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 96
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-33"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 104
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-74"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 104
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-11"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 112
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-13"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 112
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-12"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 120
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-1"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 120
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-27"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 128
+                    }
+                  }
+                ]
+              }
+            },
+            "title": "General"
+          }
+        },
+        {
+          "kind": "RowsLayoutRow",
+          "spec": {
+            "collapse": true,
+            "layout": {
+              "kind": "GridLayout",
+              "spec": {
+                "items": [
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-76"
+                      },
+                      "height": 8,
+                      "width": 24,
+                      "x": 0,
+                      "y": 0
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-77"
+                      },
+                      "height": 8,
+                      "width": 24,
+                      "x": 0,
+                      "y": 8
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-78"
+                      },
+                      "height": 8,
+                      "width": 24,
+                      "x": 0,
+                      "y": 16
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-79"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 24
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-80"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 24
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-81"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 32
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-82"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 32
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-83"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 40
+                    }
+                  }
+                ]
+              }
+            },
+            "title": "NATS"
+          }
+        },
+        {
+          "kind": "RowsLayoutRow",
+          "spec": {
+            "collapse": true,
+            "layout": {
+              "kind": "GridLayout",
+              "spec": {
+                "items": [
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-46"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 0
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-45"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 0
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-47"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 8
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-48"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 8
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-50"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 16
+                    }
+                  }
+                ]
+              }
+            },
+            "title": "Debugging"
+          }
+        },
+        {
+          "kind": "RowsLayoutRow",
+          "spec": {
+            "collapse": true,
+            "layout": {
+              "kind": "GridLayout",
+              "spec": {
+                "items": [
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-37"
+                      },
+                      "height": 8,
+                      "width": 23,
+                      "x": 0,
+                      "y": 0
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-20"
+                      },
+                      "height": 8,
+                      "width": 23,
+                      "x": 0,
+                      "y": 8
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-39"
+                      },
+                      "height": 8,
+                      "width": 23,
+                      "x": 0,
+                      "y": 16
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-36"
+                      },
+                      "height": 8,
+                      "width": 23,
+                      "x": 0,
+                      "y": 24
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-18"
+                      },
+                      "height": 8,
+                      "width": 23,
+                      "x": 0,
+                      "y": 32
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-19"
+                      },
+                      "height": 8,
+                      "width": 23,
+                      "x": 0,
+                      "y": 40
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-90"
+                      },
+                      "height": 19,
+                      "width": 6,
+                      "x": 0,
+                      "y": 48
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-88"
+                      },
+                      "height": 10,
+                      "width": 17,
+                      "x": 6,
+                      "y": 48
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-89"
+                      },
+                      "height": 9,
+                      "width": 17,
+                      "x": 6,
+                      "y": 58
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-91"
+                      },
+                      "height": 19,
+                      "width": 6,
+                      "x": 0,
+                      "y": 67
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-92"
+                      },
+                      "height": 10,
+                      "width": 17,
+                      "x": 6,
+                      "y": 67
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-93"
+                      },
+                      "height": 9,
+                      "width": 17,
+                      "x": 6,
+                      "y": 77
+                    }
+                  }
+                ]
+              }
+            },
+            "title": "Network Map"
+          }
+        },
+        {
+          "kind": "RowsLayoutRow",
+          "spec": {
+            "collapse": true,
+            "layout": {
+              "kind": "GridLayout",
+              "spec": {
+                "items": [
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-52"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 0
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-53"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 12,
+                      "y": 0
+                    }
+                  },
+                  {
+                    "kind": "GridLayoutItem",
+                    "spec": {
+                      "element": {
+                        "kind": "ElementReference",
+                        "name": "panel-54"
+                      },
+                      "height": 8,
+                      "width": 12,
+                      "x": 0,
+                      "y": 8
+                    }
+                  }
+                ]
+              }
+            },
+            "title": "Browser Client"
+          }
+        }
+      ]
+    }
+  },
+  "links": [],
+  "liveNow": false,
+  "preload": false,
+  "tags": [],
+  "timeSettings": {
+    "autoRefresh": "auto",
+    "autoRefreshIntervals": [
+      "5s",
+      "10s",
+      "30s",
+      "1m",
+      "5m",
+      "15m",
+      "30m",
+      "1h",
+      "2h",
+      "1d"
+    ],
+    "fiscalYearStartMonth": 0,
+    "from": "now-1h",
+    "hideTimepicker": false,
+    "timezone": "browser",
+    "to": "now"
+  },
+  "title": "Management generic",
+  "variables": [
+    {
+      "kind": "DatasourceVariable",
+      "spec": {
+        "allowCustomValue": true,
+        "current": {
+          "text": "",
+          "value": ""
+        },
+        "description": "Prometheus data source scraping the management metrics.",
+        "hide": "dontHide",
+        "includeAll": false,
+        "label": "Data source",
+        "multi": false,
+        "name": "datasource",
+        "options": [],
+        "pluginId": "prometheus",
+        "refresh": "onDashboardLoad",
+        "regex": "",
+        "skipUrlSync": false
+      }
+    },
+    {
+      "kind": "DatasourceVariable",
+      "spec": {
+        "allowCustomValue": true,
+        "current": {
+          "text": "",
+          "value": ""
+        },
+        "description": "Loki data source holding the management logs.",
+        "hide": "dontHide",
+        "includeAll": false,
+        "label": "Logs data source",
+        "multi": false,
+        "name": "logs_datasource",
+        "options": [],
+        "pluginId": "loki",
+        "refresh": "onDashboardLoad",
+        "regex": "",
+        "skipUrlSync": false
+      }
+    },
+    {
+      "kind": "QueryVariable",
+      "spec": {
+        "allValue": ".*",
+        "allowCustomValue": true,
+        "current": {
+          "text": "All",
+          "value": [
+            "$__all"
+          ]
+        },
+        "definition": "label_values(job)",
+        "description": "Prometheus scrape job(s) exposing the management metrics.",
+        "hide": "dontHide",
+        "includeAll": true,
+        "label": "job",
+        "multi": true,
+        "name": "job",
+        "options": [],
+        "query": {
+          "datasource": {
+            "name": "${datasource}"
+          },
+          "group": "prometheus",
+          "kind": "DataQuery",
+          "spec": {
+            "qryType": 1,
+            "query": "label_values(job)",
+            "refId": "PrometheusVariableQueryEditor-VariableQuery"
+          },
+          "version": "v0"
+        },
+        "refresh": "onDashboardLoad",
+        "regex": "",
+        "regexApplyTo": "value",
+        "skipUrlSync": false,
+        "sort": "alphabeticalAsc"
+      }
+    },
+    {
+      "kind": "QueryVariable",
+      "spec": {
+        "allValue": ".*",
+        "allowCustomValue": true,
+        "current": {
+          "text": "All",
+          "value": [
+            "$__all"
+          ]
+        },
+        "definition": "label_values(up{job=~\"$job\"},instance)",
+        "description": "Instance(s) of the selected job(s). Depends on the job variable.",
+        "hide": "dontHide",
+        "includeAll": true,
+        "label": "instance",
+        "multi": true,
+        "name": "instance",
+        "options": [],
+        "query": {
+          "datasource": {
+            "name": "${datasource}"
+          },
+          "group": "prometheus",
+          "kind": "DataQuery",
+          "spec": {
+            "qryType": 1,
+            "query": "label_values(up{job=~\"$job\"},instance)",
+            "refId": "PrometheusVariableQueryEditor-VariableQuery"
+          },
+          "version": "v0"
+        },
+        "refresh": "onDashboardLoad",
+        "regex": "",
+        "regexApplyTo": "value",
+        "skipUrlSync": false,
+        "sort": "alphabeticalAsc"
+      }
+    },
+    {
+      "kind": "QueryVariable",
+      "spec": {
+        "allowCustomValue": true,
+        "current": {
+          "text": "",
+          "value": ""
+        },
+        "definition": "label_values(job)",
+        "description": "Loki stream carrying the management logs (adjust the label if your setup does not use `job`).",
+        "hide": "dontHide",
+        "includeAll": false,
+        "label": "log stream",
+        "multi": false,
+        "name": "log_job",
+        "options": [],
+        "query": {
+          "datasource": {
+            "name": "${logs_datasource}"
+          },
+          "group": "loki",
+          "kind": "DataQuery",
+          "spec": {
+            "label": "job",
+            "refId": "LokiVariableQueryEditor-VariableQuery",
+            "type": 1
+          },
+          "version": "v0"
+        },
+        "refresh": "onDashboardLoad",
+        "regex": "",
+        "regexApplyTo": "value",
+        "skipUrlSync": false,
+        "sort": "alphabeticalAsc"
+      }
+    },
+    {
+      "kind": "CustomVariable",
+      "spec": {
+        "allValue": "5m",
+        "allowCustomValue": true,
+        "current": {
+          "text": "60s",
+          "value": "60s"
+        },
+        "hide": "dontHide",
+        "includeAll": false,
+        "label": "interval",
+        "multi": false,
+        "name": "interval",
+        "options": [],
+        "query": "5m,60s",
+        "skipUrlSync": false,
+        "valuesFormat": "csv"
+      }
+    },
+    {
+      "kind": "QueryVariable",
+      "spec": {
+        "allowCustomValue": true,
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "definition": "label_values(management_store_query_count_total,method)",
+        "hide": "hideVariable",
+        "includeAll": true,
+        "multi": true,
+        "name": "method",
+        "options": [],
+        "query": {
+          "group": "prometheus",
+          "kind": "DataQuery",
+          "spec": {
+            "qryType": 1,
+            "query": "label_values(management_store_query_count_total,method)",
+            "refId": "PrometheusVariableQueryEditor-VariableQuery"
+          },
+          "version": "v0"
+        },
+        "refresh": "onDashboardLoad",
+        "regex": "",
+        "regexApplyTo": "value",
+        "skipUrlSync": false,
+        "sort": "disabled"
+      }
+    },
+    {
+      "kind": "QueryVariable",
+      "spec": {
+        "allowCustomValue": true,
+        "current": {
+          "text": "All",
+          "value": [
+            "$__all"
+          ]
+        },
+        "definition": "label_values(aws_rds_cpuutilization_average,dimension_DBClusterIdentifier)",
+        "hide": "hideVariable",
+        "includeAll": true,
+        "multi": true,
+        "name": "dimension_DBClusterIdentifier",
+        "options": [],
+        "query": {
+          "datasource": {
+            "name": "${datasource}"
+          },
+          "group": "prometheus",
+          "kind": "DataQuery",
+          "spec": {
+            "qryType": 1,
+            "query": "label_values(aws_rds_cpuutilization_average,dimension_DBClusterIdentifier)",
+            "refId": "PrometheusVariableQueryEditor-VariableQuery"
+          },
+          "version": "v0"
+        },
+        "refresh": "onDashboardLoad",
+        "regex": "",
+        "regexApplyTo": "value",
+        "skipUrlSync": false,
+        "sort": "disabled"
+      }
+    }
+  ]
+}
diff --git a/infrastructure_files/tests/test-getting-started-enterprise.sh b/infrastructure_files/tests/test-getting-started-enterprise.sh
new file mode 100644
index 000000000..9335caf2a
--- /dev/null
+++ b/infrastructure_files/tests/test-getting-started-enterprise.sh
@@ -0,0 +1,96 @@
+#!/bin/bash
+
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source "$script_dir/../getting-started-enterprise.sh"
+
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+cases=0
+
+for errexit in +o -o; do
+  for pipefail in +o -o; do
+    bash -c '
+      set "$1" errexit
+      set "$2" pipefail
+      before_options=$SHELLOPTS
+      source "$3"
+      if [[ "$SHELLOPTS" != "$before_options" ]]; then
+        echo "Sourcing changed shell options: $before_options -> $SHELLOPTS" >&2
+        exit 1
+      fi
+    ' bash "$errexit" "$pipefail" "$script_dir/../getting-started-enterprise.sh"
+  done
+done
+
+assert_tag() {
+  local expected_status="$1" expected_message="$2" actual_status=0
+  shift 2
+  local label="${1-<unset>}"
+
+  # Each call needs its own process because die exits rather than returning.
+  (
+    unset NETBIRD_TRAEFIK_TAG
+    if [[ $# -gt 0 ]]; then
+      NETBIRD_TRAEFIK_TAG="$1"
+    fi
+    check_traefik_tag
+  ) >"$test_dir/stdout" 2>"$test_dir/stderr" || actual_status=$?
+
+  if [[ "$actual_status" != "$expected_status" ]]; then
+    echo "Tag '$label': expected exit $expected_status, got $actual_status" >&2
+    cat "$test_dir/stderr" >&2
+    exit 1
+  fi
+  if [[ -s "$test_dir/stdout" ]]; then
+    echo "Tag '$label': unexpected output on stdout" >&2
+    cat "$test_dir/stdout" >&2
+    exit 1
+  fi
+  if [[ -n "$expected_message" ]]; then
+    if ! grep -Fq "$expected_message" "$test_dir/stderr"; then
+      echo "Tag '$label': expected diagnostic '$expected_message'" >&2
+      cat "$test_dir/stderr" >&2
+      exit 1
+    fi
+  elif [[ -s "$test_dir/stderr" ]]; then
+    echo "Tag '$label': unexpected output on stderr" >&2
+    cat "$test_dir/stderr" >&2
+    exit 1
+  fi
+  cases=$((cases + 1))
+}
+
+# Unset and empty overrides both select the installer's default image.
+assert_tag 0 ""
+assert_tag 0 "" ""
+
+for tag in v3.7.13 3.7.13 v3.7.14 v3.8 3.8 v4.0 v4.0.0 \
+  v03.07.013 v3.08.0 v3.7.019; do
+  assert_tag 0 "" "$tag"
+done
+
+for tag in v2.11.0 v3.6.20 v3.7 3.7 v3.7.11 v3.7.12 3.7.12 \
+  v03.07.012 v3.7.08; do
+  assert_tag 1 "predates aliasHeadersStrategy" "$tag"
+done
+
+for tag in latest custom-build v2 v3 sha256:abcdef v3.7.11-alpine \
+  v3.7.13-alpine v3.7.13-rc1 v3.7.14+custom v3.7.14@sha256:abcdef \
+  3..14 v3.7.14.0 " 3.7.14" $'v3.7.14\n'; do
+  assert_tag 1 "Cannot verify NETBIRD_TRAEFIK_TAG=" "$tag"
+done
+
+# Re-rendering an install that has no header config must not add a blank line
+# to the Traefik command list.
+for header_config in "" "$TRAEFIK_HEADER_CONFIG"; do
+  rendered=$(TRAEFIK_HEADER_CONFIG="$header_config" render_compose_common)
+  if [[ "$(printf '%s\n' "$rendered" | service_block traefik)" == *$'\n\n'* ]]; then
+    echo "Traefik command list has a blank line (header config: '${header_config:-<empty>}')" >&2
+    exit 1
+  fi
+  cases=$((cases + 1))
+done
+
+echo "Passed $cases Traefik tag validation cases."
diff --git a/infrastructure_files/tests/test-getting-started-networks.sh b/infrastructure_files/tests/test-getting-started-networks.sh
new file mode 100644
index 000000000..9283a80bc
--- /dev/null
+++ b/infrastructure_files/tests/test-getting-started-networks.sh
@@ -0,0 +1,54 @@
+#!/bin/bash
+
+set -eo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source "$script_dir/../getting-started.sh"
+compose_command=$(check_docker_compose)
+read -r -a compose <<< "$compose_command"
+
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+mkdir "$test_dir/deployment"
+cd "$test_dir/deployment"
+
+unset COMPOSE_PROJECT_NAME COMPOSE_FILE COMPOSE_ENV_FILES
+# The generator's environment must not bake a project name into the output.
+if [[ "${1:-}" == "--migration" ]]; then
+  COMPOSE_PROJECT_NAME=render-only bash -s -- "$script_dir/../migrate.sh" >/dev/null <<'EOF'
+source "$1"
+INSTALL_DIR=$PWD
+DOMAIN=netbird.test
+generate_dashboard_env
+generate_docker_compose_traefik
+EOF
+else
+  TRAEFIK_IMAGE=traefik:v3.7.14
+  NETBIRD_DOMAIN=netbird.test
+  NETBIRD_AGENT_NETWORK=false
+  initialize_default_values
+  COMPOSE_PROJECT_NAME=render-only generate_configuration_files >/dev/null
+fi
+
+assert_network() {
+  local expected="$1" actual provider
+  shift
+  "${compose[@]}" "$@" config --format json >config.json
+  actual=$(jq -r '.networks.netbird.name' config.json)
+  provider=$(jq -r '.services.traefik.command[] | select(startswith("--providers.docker.network="))' config.json)
+  if [[ "$actual" != "$expected" || "$provider" != "--providers.docker.network=$expected" ]]; then
+    echo "Expected network '$expected'; Compose chose '$actual', Traefik received '$provider'" >&2
+    exit 1
+  fi
+}
+
+assert_network deployment_netbird
+COMPOSE_PROJECT_NAME=env-project assert_network env-project_netbird
+echo 'COMPOSE_PROJECT_NAME=file-project' >.env
+assert_network file-project_netbird
+COMPOSE_PROJECT_NAME=env-project assert_network cli-project_netbird -p cli-project
+: >.env
+echo 'name: config-project' >>docker-compose.yml
+assert_network config-project_netbird
+
+echo "Passed 5 Compose network scoping cases."
diff --git a/infrastructure_files/tests/test-getting-started.sh b/infrastructure_files/tests/test-getting-started.sh
new file mode 100644
index 000000000..0826340e5
--- /dev/null
+++ b/infrastructure_files/tests/test-getting-started.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+
+set -eo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source "$script_dir/../getting-started.sh"
+
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+cases=0
+
+assert_image() {
+  local expected_status="$1" expected_message="$2" image="$3" actual_status=0
+  local case_dir="$test_dir/$cases"
+  mkdir "$case_dir"
+
+  (
+    cd "$case_dir"
+    TRAEFIK_IMAGE="$image"
+    NETBIRD_DOMAIN=netbird.test
+    NETBIRD_AGENT_NETWORK=false
+    initialize_default_values
+    generate_configuration_files
+  ) >"$case_dir/stdout" 2>"$case_dir/stderr" || actual_status=$?
+
+  if [[ "$actual_status" != "$expected_status" ]]; then
+    echo "Image '$image': expected exit $expected_status, got $actual_status" >&2
+    cat "$case_dir/stderr" >&2
+    exit 1
+  fi
+  if [[ "$expected_status" == 0 ]]; then
+    if [[ -s "$case_dir/stderr" ]]; then
+      cat "$case_dir/stderr" >&2
+      exit 1
+    fi
+    for entrypoint in web websecure; do
+      if ! grep -Fq -- "--entrypoints.$entrypoint.http.aliasHeadersStrategy=delete" "$case_dir/docker-compose.yml"; then
+        echo "Image '$image': missing header protection for $entrypoint" >&2
+        exit 1
+      fi
+    done
+    if ! grep -Fxq "    image: ${image:-traefik:v3.7.14}" "$case_dir/docker-compose.yml"; then
+      echo "Image '$image': unexpected rendered image" >&2
+      exit 1
+    fi
+  else
+    if ! grep -Fq "$expected_message" "$case_dir/stderr"; then
+      echo "Image '$image': expected diagnostic '$expected_message'" >&2
+      cat "$case_dir/stderr" >&2
+      exit 1
+    fi
+    if [[ -e "$case_dir/docker-compose.yml" || -e "$case_dir/config.yaml" || -e "$case_dir/dashboard.env" ]]; then
+      echo "Image '$image': generated configuration despite failed validation" >&2
+      exit 1
+    fi
+  fi
+  cases=$((cases + 1))
+}
+
+# An empty override selects the default image.
+assert_image 0 "" ""
+for image in traefik:v3.7.13 traefik:3.7.13 traefik:v3.7.14 traefik:v3.8 \
+  traefik:v4 traefik:v4.0.0 traefik:v03.07.013 traefik:v3.08.0 \
+  registry.example:5000/team/traefik:3.7.13; do
+  assert_image 0 "" "$image"
+done
+
+for tag in v2 v2.11.0 v3 v3.6.20 v3.7 v3.7.11 v3.7.12 v03.07.012 v3.7.08; do
+  assert_image 1 "incompatible with this configuration" "traefik:$tag"
+done
+
+digest="sha256:$(printf '%064d' 0)"
+for image in traefik:latest traefik:custom-build traefik registry.example:5000/traefik \
+  "traefik@$digest" "registry.example:5000/team/traefik@$digest" \
+  "traefik:v3.7.13@$digest" "traefik:latest@$digest" \
+  traefik:v3.7.13-rc1 traefik:v3.7.13-alpine traefik:v3.7.14+custom \
+  traefik:3..14 traefik:v3.7.14.0 traefik:custom:v3.7.14 :v3.7.14 \
+  "traefik: v3.7.14" $'traefik:v3.7.14\n'; do
+  assert_image 1 "Cannot verify TRAEFIK_IMAGE=" "$image"
+done
+
+echo "Passed $cases Traefik image configuration cases."
diff --git a/integration_tests/management/network_map_db/account_settings_test.go b/integration_tests/management/network_map_db/account_settings_test.go
new file mode 100644
index 000000000..d7927aaf1
--- /dev/null
+++ b/integration_tests/management/network_map_db/account_settings_test.go
@@ -0,0 +1,58 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetAccountSettings(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into accounts (id, settings_peer_login_expiration_enabled, settings_peer_login_expiration, settings_peer_inactivity_expiration_enabled,
+                      settings_peer_inactivity_expiration, settings_dns_domain, settings_ipv6_enabled_groups, settings_routing_peer_dns_resolution_enabled,
+                      settings_lazy_connection_enabled, settings_auto_update_version, settings_auto_update_always, settings_metrics_push_enabled)
+		 values('account-3',null,null,null,null,null,null,null,null,null,null,null)`)
+
+	accountSettings, err := conn(t, ctx).GetAccountSettings(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.Equal(t, accountSettings, nmdata.AccountSettingsInfo{
+		PeerLoginExpirationEnabled:      true,
+		PeerLoginExpiration:             86400000000000 * time.Nanosecond,
+		PeerInactivityExpirationEnabled: false,
+		PeerInactivityExpiration:        86400000000000 * time.Nanosecond,
+		DNSDomain:                       "",
+		IPv6EnabledGroups:               []string{"group-one-resource-id"},
+		RoutingPeerDNSResolutionEnabled: false,
+		LazyConnectionEnabled:           false,
+		AutoUpdateVersion:               "disabled",
+		AutoUpdateAlways:                false,
+		MetricsPushEnabled:              false,
+	})
+
+	accountSettings, err = conn(t, ctx).GetAccountSettings(ctx, "account-2")
+	assert.NoError(t, err)
+	assert.Equal(t, accountSettings, nmdata.AccountSettingsInfo{
+		PeerLoginExpirationEnabled:      true,
+		PeerLoginExpiration:             86400000000000 * time.Nanosecond,
+		PeerInactivityExpirationEnabled: false,
+		PeerInactivityExpiration:        86400000000000 * time.Nanosecond,
+		DNSDomain:                       "",
+		IPv6EnabledGroups:               []string{"group-two-resources-id"},
+		RoutingPeerDNSResolutionEnabled: false,
+		LazyConnectionEnabled:           false,
+		AutoUpdateVersion:               "disabled",
+		AutoUpdateAlways:                false,
+		MetricsPushEnabled:              false,
+	})
+
+	accountSettings, err = conn(t, ctx).GetAccountSettings(ctx, "account-3")
+	assert.NoError(t, err)
+	assert.Equal(t, accountSettings, nmdata.AccountSettingsInfo{})
+}
diff --git a/integration_tests/management/network_map_db/base_data.sql b/integration_tests/management/network_map_db/base_data.sql
new file mode 100644
index 000000000..136df00ac
--- /dev/null
+++ b/integration_tests/management/network_map_db/base_data.sql
@@ -0,0 +1,53 @@
+insert into accounts (id, network_identifier, network_net, network_net_v6, network_dns, network_serial,dns_settings_disabled_management_groups,
+                      settings_peer_login_expiration_enabled, settings_peer_login_expiration, settings_peer_inactivity_expiration_enabled,
+                      settings_peer_inactivity_expiration, settings_dns_domain, settings_ipv6_enabled_groups, settings_routing_peer_dns_resolution_enabled,
+                      settings_lazy_connection_enabled, settings_auto_update_version, settings_auto_update_always, settings_metrics_push_enabled)
+VALUES('account-1','network-1','{"IP":"100.103.0.0","Mask":"//8AAA=="}','{"IP":"fdde:e995:fd38:a465::","Mask":"//////////8AAAAAAAAAAA=="}','',1,'["disabled-group-1","disabled-group-2"]',
+       true, 86400000000000, false,
+       86400000000000, null, '["group-one-resource-id"]', false,
+       false, 'disabled', false, false);
+insert into accounts (id, network_identifier, network_net, network_net_v6, network_dns, network_serial,dns_settings_disabled_management_groups,
+                      settings_peer_login_expiration_enabled, settings_peer_login_expiration, settings_peer_inactivity_expiration_enabled,
+                      settings_peer_inactivity_expiration, settings_dns_domain, settings_ipv6_enabled_groups, settings_routing_peer_dns_resolution_enabled,
+                      settings_lazy_connection_enabled, settings_auto_update_version, settings_auto_update_always, settings_metrics_push_enabled)
+VALUES('account-2','network-2','{"IP":"110.0.0.0","Mask":"//8AAA=="}','{"IP":"fddf:e995:fd38:a465::","Mask":"//////////8AAAAAAAAAAA=="}','',2,null,
+       true, 86400000000000, false,
+       86400000000000, null, '["group-two-resources-id"]', false,
+       false, 'disabled', false, false);
+insert into groups (id, account_id, name, resources, public_id) VALUES('group-one-resource-id','account-1','group-1-name', '[{"ID":"host-id-1","Type":"host"}]','group-one-resource-id-public');
+insert into groups (id, account_id, name, resources, public_id) VALUES('group-two-resources-id','account-1','group-2-name', '[{"ID":"subnet-id-1","Type":"subnet"}, {"ID":"host-id-2","Type":"host"}]','group-two-resources-id-public');
+insert into groups (id, account_id, name, resources, public_id) VALUES('group-no-resources-id','account-1','group-3-name', null,'group-no-resources-id-public');
+insert into group_peers (account_id, peer_id, group_id) VALUES('account-1','peer-id-1','group-one-resource-id');
+insert into group_peers (account_id, peer_id, group_id) VALUES('account-1','peer-id-2','group-two-resources-id');
+insert into group_peers (account_id, peer_id, group_id) VALUES('account-1','peer-id-3','group-two-resources-id');
+insert into peers (id, account_id, "key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-1','account-1','key-1','ssh-key-1','peer-1','["extra-peer-1"]','user-id-1',true,true,'2026-08-06 13:25:59.12999','"10.10.10.1"','"fdf4:ba80:6aa5:89f1:44d7:8701:8699:4940"',
+                   false,true,true,'cluster-1.netbird.services',
+                   '0.76.0','linux','26.4.1','6.8.0-134-generic','[{"NetIP":"fe80::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ac"},{"NetIP":"192.168.16.1/20","Mac":"00:15:5d:24:0c:ac"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'DE','Berlin','"46.201.148.187"');
+insert into peers (id,account_id,"key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-2','account-1','key-2','ssh-key-2','peer-2','["extra-peer-2"]','user-id-2',true,true,'2026-08-06 14:25:59.12999','"10.10.100.1"','"fdf5:ba80:6aa5:89f1:44d7:8701:8699:4940"',
+                   false,true,true,'cluster-2.netbird.services',
+                   '0.76.1','linux','26.4.2','6.8.0-135-generic','[{"NetIP":"fe81::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ad"},{"NetIP":"192.168.17.1/20","Mac":"00:15:5d:24:0c:ad"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',0,
+                   'DE','Berlin','"46.201.149.187"');
+insert into peers (id,account_id,"key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-3','account-1','key-3','ssh-key-3','peer-3','["extra-peer-3"]','user-id-3',true,true,'2026-08-06 12:25:59.12999','"10.10.200.1"','"fdf6:ba80:6aa5:89f1:44d7:8701:8699:4940"',
+                   false,true,true,'cluster-3.netbird.services',
+                   '0.76.2','linux','26.4.3','6.8.0-136-generic','[{"NetIP":"fe82::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ae"},{"NetIP":"192.168.18.1/20","Mac":"00:15:5d:24:0c:ae"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'DE','Berlin','"46.201.150.187"');
+
diff --git a/integration_tests/management/network_map_db/dns_settings_test.go b/integration_tests/management/network_map_db/dns_settings_test.go
new file mode 100644
index 000000000..95ac84aed
--- /dev/null
+++ b/integration_tests/management/network_map_db/dns_settings_test.go
@@ -0,0 +1,25 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetDnsSettings(t *testing.T) {
+	ctx := context.TODO()
+
+	settings, err := conn(t, ctx).GetDnsSettings(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.Equal(t, settings, nmdata.DNSSettings{
+		DisabledManagementGroups: []string{"disabled-group-1", "disabled-group-2"},
+	})
+
+	settings, err = conn(t, ctx).GetDnsSettings(ctx, "account-2")
+	assert.NoError(t, err)
+	assert.Equal(t, settings, nmdata.DNSSettings{})
+}
diff --git a/integration_tests/management/network_map_db/dns_test.go b/integration_tests/management/network_map_db/dns_test.go
new file mode 100644
index 000000000..33023061d
--- /dev/null
+++ b/integration_tests/management/network_map_db/dns_test.go
@@ -0,0 +1,80 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"testing"
+
+	"github.com/miekg/dns"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetAppliedZoneCandidatesViaPgxConnection(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into zones (id, account_id, domain, enabled, enable_search_domain, distribution_groups)
+		VALUES('zone-1','account-1','test-1.com',true,true,'["group-one-resource-id"]')`)
+	execQuery(t, ctx,
+		`insert into zones (id, account_id, domain, enabled, enable_search_domain, distribution_groups)
+		VALUES('zone-2','account-1','test-2.com',true,false,'["group-two-resources-id"]')`)
+	execQuery(t, ctx,
+		`insert into zones (id, account_id, domain, enabled, enable_search_domain, distribution_groups)
+		VALUES('zone-3','account-1','test-3.com',false,true,'["group-one-resource-id"]')`)
+	execQuery(t, ctx,
+		`insert into records (id, account_id, zone_id, name, type, ttl, content)
+		VALUES('record-1','account-1','zone-1','test.test-1.com','A',1800,'1.1.1.1')`)
+	execQuery(t, ctx,
+		`insert into records (id, account_id, zone_id, name, type, ttl, content)
+		VALUES('record-2','account-1','zone-1','test2.test-1.com','A',1800,'1.1.1.2')`)
+	execQuery(t, ctx,
+		`insert into records (id, account_id, zone_id, name, type, ttl, content)
+		VALUES('record-3','account-1','zone-1','test3.test-1.com','CNAME',1800,'test4.test-1.com')`)
+	execQuery(t, ctx,
+		`insert into records (id, account_id, zone_id, name, type, ttl, content)
+		VALUES('record-4','account-1','zone-2','test2.test-2.com','CNAME',1800,'test3.test-2.com')`)
+	execQuery(t, ctx,
+		`insert into records (id, account_id, zone_id, name, type, ttl, content)
+		VALUES('record-5','account-1','zone-3','test.test-3.com','A',1800,'1.1.1.3')`)
+
+	zoneCandidates, err := conn(t, ctx).GetAppliedZoneCandidates(ctx, "account-1")
+	assert.NoError(t, err)
+
+	// Zone domains and record names are fully qualified, and the zone is served
+	// non-authoritatively — the account-side builder
+	// (types.buildAppliedZoneCandidates) states the same shape, and both feed the
+	// one client-facing map, so the two have to agree.
+	assert.Contains(t, zoneCandidates, networkmap.AppliedZoneCandidate{
+		DistributionGroups: []string{"group-one-resource-id"},
+		Zone: nmdata.CustomZone{
+			Domain:               "test-1.com.",
+			SearchDomainDisabled: false,
+			NonAuthoritative:     true,
+			Records: []nmdata.SimpleRecord{
+				{Name: "test.test-1.com.", Type: int(dns.TypeA), Class: "IN", TTL: 1800, RData: "1.1.1.1"},
+				{Name: "test2.test-1.com.", Type: int(dns.TypeA), Class: "IN", TTL: 1800, RData: "1.1.1.2"},
+				{Name: "test3.test-1.com.", Type: int(dns.TypeCNAME), Class: "IN", TTL: 1800, RData: "test4.test-1.com."},
+			},
+		},
+	})
+	assert.Contains(t, zoneCandidates, networkmap.AppliedZoneCandidate{
+		DistributionGroups: []string{"group-two-resources-id"},
+		Zone: nmdata.CustomZone{
+			Domain:               "test-2.com.",
+			SearchDomainDisabled: true,
+			NonAuthoritative:     true,
+			Records: []nmdata.SimpleRecord{
+				{Name: "test2.test-2.com.", Type: int(dns.TypeCNAME), Class: "IN", TTL: 1800, RData: "test3.test-2.com."},
+			},
+		},
+	})
+
+	// A zone an admin switched off reaches no peer.
+	for _, candidate := range zoneCandidates {
+		assert.NotEqual(t, "test-3.com.", candidate.Zone.Domain, "disabled zone must not be a candidate")
+		assert.NotEqual(t, "test-3.com", candidate.Zone.Domain, "disabled zone must not be a candidate")
+	}
+}
diff --git a/integration_tests/management/network_map_db/domain_test.go b/integration_tests/management/network_map_db/domain_test.go
new file mode 100644
index 000000000..8434a76c3
--- /dev/null
+++ b/integration_tests/management/network_map_db/domain_test.go
@@ -0,0 +1,39 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetDomains(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into domains (id, account_id, domain, target_cluster)
+		VALUES('domain-1','account-1','test-1.com','target-1.cluster.local')`)
+	execQuery(t, ctx,
+		`insert into domains (id, account_id, domain, target_cluster)
+		VALUES('domain-2','account-1','test-2.com','target-2.cluster.local')`)
+	execQuery(t, ctx,
+		`insert into domains (id, account_id, domain, target_cluster)
+		VALUES('domain-3','account-1',null,null)`)
+
+	domains, err := conn(t, ctx).GetDomains(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.Len(t, domains, 2)
+
+	assert.Contains(t, domains, networkmapdb.Domain{
+		Domain:        sql.NullString{String: "test-1.com", Valid: true},
+		TargetCluster: sql.NullString{String: "target-1.cluster.local", Valid: true},
+	})
+	assert.Contains(t, domains, networkmapdb.Domain{
+		Domain:        sql.NullString{String: "test-2.com", Valid: true},
+		TargetCluster: sql.NullString{String: "target-2.cluster.local", Valid: true},
+	})
+}
diff --git a/integration_tests/management/network_map_db/group_test.go b/integration_tests/management/network_map_db/group_test.go
new file mode 100644
index 000000000..3ccf96eb0
--- /dev/null
+++ b/integration_tests/management/network_map_db/group_test.go
@@ -0,0 +1,54 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetGroups(t *testing.T) {
+	ctx := context.TODO()
+
+	groups, resourceToGroupIdx, err := conn(t, ctx).GetGroups(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.Contains(t,
+		groups,
+		nmdata.Group{ID: "group-one-resource-id", Name: "group-1-name", PublicID: "group-one-resource-id-public", Resources: []nmdata.Resource{{ID: "host-id-1", Type: "host"}}, Peers: []string{"peer-id-1"}},
+	)
+	assert.NotNil(t, resourceToGroupIdx["host-id-1"]["group-one-resource-id"])
+	assert.Contains(t,
+		groups,
+		nmdata.Group{ID: "group-two-resources-id", Name: "group-2-name", PublicID: "group-two-resources-id-public",
+			Resources: []nmdata.Resource{{ID: "subnet-id-1", Type: "subnet"}, {ID: "host-id-2", Type: "host"}},
+			Peers:     []string{"peer-id-2", "peer-id-3"}},
+	)
+	assert.NotNil(t, resourceToGroupIdx["host-id-2"]["group-two-resources-id"])
+	assert.NotNil(t, resourceToGroupIdx["subnet-id-1"]["group-two-resources-id"])
+	assert.Contains(t,
+		groups,
+		nmdata.Group{ID: "group-no-resources-id", Name: "group-3-name", PublicID: "group-no-resources-id-public"})
+}
+
+// Verify handling of empty fields in groups table
+// Verify that group's PublicID gets populated on retrieval
+// TODO (dmitri) PublicID should not be populated with delta updates,
+// which require stable PublicIDs
+func TestGetGroupsWithoutExpectedFields(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		"insert into accounts (id) VALUES('random-id')")
+
+	execQuery(t, ctx,
+		"insert into groups (id, account_id) VALUES('g2-test-group-id-1','random-id')")
+
+	groups, _, err := conn(t, ctx).GetGroups(ctx, "random-id")
+	assert.NoError(t, err)
+	require.Len(t, groups, 1)
+	assert.NotEmpty(t, groups[0].PublicID)
+}
diff --git a/integration_tests/management/network_map_db/main_test.go b/integration_tests/management/network_map_db/main_test.go
new file mode 100644
index 000000000..78c8c8ec8
--- /dev/null
+++ b/integration_tests/management/network_map_db/main_test.go
@@ -0,0 +1,99 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	_ "embed"
+	"os"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	networkmap_pgsql "github.com/netbirdio/netbird/management/internals/network_map_db/pgsql"
+	networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+//go:embed base_data.sql
+var baseData string
+
+var (
+	pgstore     *networkmap_pgsql.PgStore
+	sqlitestore *networkmap_sqlite.SqliteStore
+	engine      string
+)
+
+func TestMain(m *testing.M) {
+	var cleanup func()
+	kind, _ := os.LookupEnv("NETBIRD_STORE_ENGINE")
+	switch kind {
+	case string(types.PostgresStoreEngine):
+		engine = string(types.PostgresStoreEngine)
+		pgstore, cleanup = createPGTestStore(baseData)
+		pgstore.UsingTimeZone(time.UTC)
+	case "", string(types.SqliteStoreEngine):
+		engine = string(types.SqliteStoreEngine)
+		sqlitestore, cleanup = createSqliteTestStore(baseData)
+	default:
+		log.Fatalf("unsupported db '%s' in NETBIRD_STORE_ENGINE env var", kind)
+	}
+
+	code := m.Run()
+
+	cleanup()
+	os.Exit(code)
+}
+
+func conn(t *testing.T, ctx context.Context) networkmapdb.NetworkMapDBStoreConn {
+	t.Helper()
+	switch engine {
+	case string(types.PostgresStoreEngine):
+		c, err := pgstore.Pool.Acquire(ctx)
+		assert.NoError(t, err)
+		return pgstore.UsingConnection(c.Conn())
+	case string(types.SqliteStoreEngine):
+		return sqlitestore.UsingConn()
+	}
+	log.Fatalf("unknown db engine kind %s", engine)
+	return nil
+}
+
+func store(t *testing.T) networkmapdb.NetworkMapDBStore {
+	t.Helper()
+	switch engine {
+	case string(types.PostgresStoreEngine):
+		return pgstore
+	case string(types.SqliteStoreEngine):
+		return sqlitestore
+	}
+	log.Fatalf("unknown db engine kind %s", engine)
+	return nil
+}
+
+func execQuery(t *testing.T, ctx context.Context, q string) {
+	t.Helper()
+	switch engine {
+	case string(types.PostgresStoreEngine):
+		_, err := pgstore.Pool.Exec(ctx, q)
+		assert.NoError(t, err)
+	case string(types.SqliteStoreEngine):
+		_, err := sqlitestore.Db.ExecContext(ctx, q)
+		assert.NoError(t, err)
+	}
+}
+
+// use to parse time in time.RFC3339Nano format
+// returns the time in the UTC time zone
+func mustParseTime(t string) *time.Time {
+	tt, err := time.Parse(time.RFC3339Nano, t)
+	if err != nil {
+		panic(err)
+	}
+
+	utc := tt.UTC()
+	return &utc
+}
diff --git a/integration_tests/management/network_map_db/nameserver_test.go b/integration_tests/management/network_map_db/nameserver_test.go
new file mode 100644
index 000000000..d6243a6e3
--- /dev/null
+++ b/integration_tests/management/network_map_db/nameserver_test.go
@@ -0,0 +1,61 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetNameServerGroups(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into name_server_groups (id, public_id, name, description, name_servers, groups, domains, enabled, search_domains_enabled, "primary", account_id)
+		VALUES('nsgroup-1','nsgroup-1-public','nsgroup-1','nsgroup-1','[{"IP":"192.168.31.2","NSType":1,"Port":53}]','["group-one-resource-id"]','["test-1.com"]',TRUE,FALSE,TRUE,'account-1')`)
+	execQuery(t, ctx,
+		`insert into name_server_groups (id, public_id, name, description, name_servers, groups, domains, enabled, search_domains_enabled,"primary",account_id)
+		VALUES('nsgroup-2','nsgroup-2-public','nsgroup-2','nsgroup-2','[{"IP":"192.168.32.3","NSType":1,"Port":53}]','["group-one-resource-id","group-no-resources-id"]','["test-1.com","test-2.com"]',TRUE,FALSE,TRUE,'account-1')`)
+	execQuery(t, ctx,
+		`insert into name_server_groups (id, public_id, name, description, name_servers, groups, domains, enabled, search_domains_enabled,"primary",account_id)
+		VALUES('nsgroup-3','nsgroup-3-public',null,null,null,null,null,TRUE,FALSE,FALSE,'account-1')`)
+
+	nsgroups, err := conn(t, ctx).GetNameServerGroups(ctx, "account-1")
+	assert.NoError(t, err)
+
+	assert.Contains(t, nsgroups, nmdata.NameServerGroup{
+		ID:                   "nsgroup-1",
+		PublicID:             "nsgroup-1-public",
+		Name:                 "nsgroup-1",
+		Description:          "nsgroup-1",
+		NameServers:          []nmdata.NameServer{{IP: netip.MustParseAddr("192.168.31.2"), NSType: 1, Port: 53}},
+		Groups:               []string{"group-one-resource-id"},
+		Domains:              []string{"test-1.com"},
+		Primary:              true,
+		SearchDomainsEnabled: false,
+		Enabled:              true,
+	})
+	assert.Contains(t, nsgroups, nmdata.NameServerGroup{
+		ID:                   "nsgroup-2",
+		PublicID:             "nsgroup-2-public",
+		Name:                 "nsgroup-2",
+		Description:          "nsgroup-2",
+		NameServers:          []nmdata.NameServer{{IP: netip.MustParseAddr("192.168.32.3"), NSType: 1, Port: 53}},
+		Groups:               []string{"group-one-resource-id", "group-no-resources-id"},
+		Domains:              []string{"test-1.com", "test-2.com"},
+		Primary:              true,
+		SearchDomainsEnabled: false,
+		Enabled:              true,
+	})
+	assert.Contains(t, nsgroups, nmdata.NameServerGroup{
+		ID:                   "nsgroup-3",
+		PublicID:             "nsgroup-3-public",
+		Primary:              false,
+		SearchDomainsEnabled: false,
+		Enabled:              true,
+	})
+}
diff --git a/integration_tests/management/network_map_db/network_map_data.sql b/integration_tests/management/network_map_db/network_map_data.sql
new file mode 100644
index 000000000..d94e2f4aa
--- /dev/null
+++ b/integration_tests/management/network_map_db/network_map_data.sql
@@ -0,0 +1,108 @@
+insert into accounts (id, network_identifier, network_net, network_net_v6, network_dns, network_serial,dns_settings_disabled_management_groups,
+                      settings_peer_login_expiration_enabled, settings_peer_login_expiration, settings_peer_inactivity_expiration_enabled,
+                      settings_peer_inactivity_expiration, settings_dns_domain, settings_ipv6_enabled_groups, settings_routing_peer_dns_resolution_enabled,
+                      settings_lazy_connection_enabled, settings_auto_update_version, settings_auto_update_always, settings_metrics_push_enabled)
+VALUES('account-33','network-331','{"IP":"100.103.0.0","Mask":"//8AAA=="}','{"IP":"fdde:e995:fd38:a465::","Mask":"//////////8AAAAAAAAAAA=="}','',1,'["disabled-group-1","disabled-group-2"]',
+       true, 86400000000000, false,
+       86400000000000, null, '["33-group-one-resource-id"]', false,
+       false, 'disabled', false, false);
+insert into groups (id, account_id, name, resources, public_id) VALUES('33-group-one-resource-id','account-33','group-1-name', '[{"ID":"host-id-1","Type":"host"}]','group-one-resource-id-public');
+insert into groups (id, account_id, name, resources, public_id) VALUES('33-group-two-resources-id','account-33','group-2-name', '[{"ID":"subnet-id-1","Type":"subnet"}, {"ID":"host-id-2","Type":"host"}]','33-group-two-resources-id-public');
+insert into groups (id, account_id, name, resources, public_id) VALUES('33-group-no-resources-id','account-33','group-3-name', null,'33-group-no-resources-id-public');
+insert into group_peers (account_id, peer_id, group_id) VALUES('account-33','peer-id-331','33-group-one-resource-id');
+insert into group_peers (account_id, peer_id, group_id) VALUES('account-33','peer-id-332','33-group-two-resources-id');
+insert into group_peers (account_id, peer_id, group_id) VALUES('account-33','peer-id-333','33-group-two-resources-id');
+insert into peers (id, account_id, "key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-331','account-33','key-331','ssh-key-1','peer-1','["extra-peer-1"]','user-id-1',true,true,'2026-08-06 13:25:59.12999','"10.10.10.1"','"fdf4:ba80:6aa5:89f1:44d7:8701:8699:4940"',
+                   false,true,true,'cluster-1.netbird.services',
+                   '0.76.0','linux','26.4.1','6.8.0-134-generic','[{"NetIP":"fe80::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ac"},{"NetIP":"192.168.16.1/20","Mac":"00:15:5d:24:0c:ac"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'DE','Berlin','"46.201.148.187"');
+insert into peers (id,account_id,"key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-332','account-33','key-332','ssh-key-2','peer-2','["extra-peer-2"]','user-id-2',true,true,'2026-08-06 14:25:59.12999','"10.10.100.1"','"fdf5:ba80:6aa5:89f1:44d7:8701:8699:4940"',
+                   false,true,true,'cluster-2.netbird.services',
+                   '0.76.1','linux','26.4.2','6.8.0-135-generic','[{"NetIP":"fe81::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ad"},{"NetIP":"192.168.17.1/20","Mac":"00:15:5d:24:0c:ad"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',0,
+                   'DE','Berlin','"46.201.149.187"');
+insert into peers (id,account_id,"key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-333','account-33','key-333','ssh-key-3','peer-3','["extra-peer-3"]','user-id-3',true,true,'2026-08-06 12:25:59.12999','"10.10.200.1"','"fdf6:ba80:6aa5:89f1:44d7:8701:8699:4940"',
+                   false,true,true,'cluster-3.netbird.services',
+                   '0.76.2','linux','26.4.3','6.8.0-136-generic','[{"NetIP":"fe82::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ae"},{"NetIP":"192.168.18.1/20","Mac":"00:15:5d:24:0c:ae"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'DE','Berlin','"46.201.150.187"');
+
+insert into zones (id, account_id, domain, enabled, enable_search_domain, distribution_groups)
+		VALUES('zone-331','account-33','test-331.com',true,true,'["33-group-one-resource-id"]');
+insert into zones (id, account_id, domain, enabled, enable_search_domain, distribution_groups)
+		VALUES('zone-332','account-33','disabled-331.com',false,true,'["33-group-one-resource-id"]');
+insert into zones (id, account_id, domain, enabled, enable_search_domain, distribution_groups)
+		VALUES('zone-333','account-33','search-off-331.com',true,false,'["33-group-two-resources-id"]');
+insert into records (id, account_id, zone_id, name, type, ttl, content)
+		VALUES('record-333','account-33','zone-332','test.disabled-331.com','A',1800,'1.1.1.9');
+insert into records (id, account_id, zone_id, name, type, ttl, content)
+		VALUES('record-334','account-33','zone-333','test.search-off-331.com','A',1800,'1.1.1.3');
+insert into records (id, account_id, zone_id, name, type, ttl, content)
+		VALUES('record-335','account-33','zone-333','alias.search-off-331.com','CNAME',1800,'test.search-off-331.com');
+insert into records (id, account_id, zone_id, name, type, ttl, content)
+		VALUES('record-331','account-33','zone-331','test.test-331.com','A',1800,'1.1.1.1');
+insert into records (id, account_id, zone_id, name, type, ttl, content)
+		VALUES('record-332','account-33','zone-331','test2.test-331.com','A',1800,'1.1.1.2');
+
+insert into domains (id, account_id, domain, target_cluster)
+		VALUES('domain-331','account-33','test-331.com','target-1.cluster.local');
+
+insert into name_server_groups (id, public_id, name, description, name_servers, groups, domains, enabled, search_domains_enabled, "primary", account_id)
+		VALUES('nsgroup-331','nsgroup-1-public','nsgroup-1','nsgroup-1','[{"IP":"192.168.31.2","NSType":1,"Port":53}]','["33-group-one-resource-id"]','["test-1.com"]',TRUE,FALSE,TRUE,'account-33');
+insert into name_server_groups (id, public_id, name, description, name_servers, groups, domains, enabled, search_domains_enabled,"primary",account_id)
+		VALUES('nsgroup-332','nsgroup-2-public','nsgroup-2','nsgroup-2','[{"IP":"192.168.32.3","NSType":1,"Port":53}]','["33-group-one-resource-id","33-group-no-resources-id"]','["test-1.com","test-2.com"]',TRUE,FALSE,TRUE,'account-33');
+
+insert into network_resources (id, account_id, network_id, public_id, name, description, type, domain, prefix, enabled)
+		VALUES('net-resource-331','account-33','network-331','net-resource-public-1','network-resource-1','network-resource-1','subnet','','"10.0.0.0/16"',TRUE);
+insert into network_resources (id, account_id, network_id, public_id, name, description, type, domain, prefix, enabled)
+		VALUES('net-resource-332','account-33','network-332','net-resource-public-2','network-resource-2','network-resource-2','domain','test.com','',TRUE);
+
+insert into network_routers (id, account_id, public_id, peer, network_id, masquerade, metric, enabled, peer_groups)
+		VALUES('test-nr-id-331','account-33','public-id-1','peer-id-331','network-id-1',TRUE,999,TRUE,'["33-group-one-resource-id"]');
+insert into network_routers (id, account_id, public_id, peer, network_id, masquerade, metric, enabled, peer_groups)
+		VALUES('test-nr-id-332','account-33','public-id-2','','network-id-2',TRUE,333,TRUE,'["33-group-two-resources-id","33-group-no-resources-id"]');
+
+insert into networks (id, account_id, public_id) VALUES('network-331','account-33','network-1-public');
+insert into networks (id, account_id, public_id) VALUES('network-332','account-33','network-2-public');
+
+insert into policies (id, public_id, account_id, enabled, source_posture_checks)
+		 values('policy-331','policy-1-public','account-33',true,'["posture-checks-1","posture-checks-2"]');
+insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
+		                           source_resource, destination_resource, ports, port_ranges,
+								   authorized_groups, authorized_user)
+		 values('policy-331-rule-1','policy-331',true,'accept','tcp',true,'["33-group-one-resource-id","33-group-two-resources-id"]','["33-group-one-resource-id","33-group-two-resources-id"]',
+		        '{"ID":"host-id-1","Type":"host"}','{"ID":"domain-331","Type":"domain"}','["8080","8443"]', '[{"Start":8080,"End":8090}]',
+				'{"33-group-one-resource-id":["user-1", "user-2"]}','user-3');
+
+insert into posture_checks (id, account_id, public_id, checks)
+		VALUES('posturecheck-331','account-33','posturecheck-1-public',
+		'{"NBVersionCheck":{"MinVersion":"0.25.0"},
+		  "OSVersionCheck":{"Darwin":{"MinVersion":"12.0"}},
+		  "GeoLocationCheck":{"Locations":[{"CountryCode":"FI","CityName":""}],"Action":"allow"},
+		  "PeerNetworkRangeCheck":{"Action":"deny","Ranges":["192.168.0.1/24"]}}');
+
+insert into routes (id, account_id, public_id, network, domains, keep_route, net_id, description,
+	                         peer, peer_groups, network_type, masquerade, metric, enabled, 
+	                         groups, access_control_groups, skip_auto_apply)
+		VALUES('route-331','account-33','route-1-public','"172.0.0.0/16"','["test-1.com"]',true,'route-331-net-id','route-1',
+		        'peer-id-331','["33-group-one-resource-id"]',1,true,9999,true,
+				'["33-group-one-resource-id"]','["33-group-one-resource-id"]',false);
+
+insert into services (id, account_id, enabled, private, access_groups, proxy_cluster, domain)
+		 values('service-331','account-33',true,true,'["33-group-one-resource-id"]','test-1.com','test-332.com');
diff --git a/integration_tests/management/network_map_db/network_map_data_golden.json b/integration_tests/management/network_map_db/network_map_data_golden.json
new file mode 100644
index 000000000..3265e5181
--- /dev/null
+++ b/integration_tests/management/network_map_db/network_map_data_golden.json
@@ -0,0 +1,559 @@
+{
+  "Peers": {
+    "peer-id-331": {
+      "ID": "peer-id-331",
+      "Key": "key-331",
+      "SSHKey": "ssh-key-1",
+      "DNSLabel": "peer-1",
+      "UserID": "user-id-1",
+      "SSHEnabled": true,
+      "LoginExpirationEnabled": true,
+      "LastLogin": "2026-08-06T13:25:59.12999Z",
+      "IP": "10.10.10.1",
+      "IPv6": "fdf4:ba80:6aa5:89f1:44d7:8701:8699:4940",
+      "RequiresApproval": false,
+      "Connected": true,
+      "ExtraDNSLabels": [
+        "extra-peer-1"
+      ],
+      "Meta": {
+        "WtVersion": "0.76.0",
+        "GoOS": "linux",
+        "OSVersion": "26.4.1",
+        "KernelVersion": "6.8.0-134-generic",
+        "NetworkAddresses": [
+          {
+            "NetIP": "fe80::8b4c:973f:a76b:3771/64"
+          },
+          {
+            "NetIP": "192.168.16.1/20"
+          }
+        ],
+        "Files": [
+          {
+            "Path": "/usr/bin/netbird",
+            "ProcessIsRunning": false
+          }
+        ],
+        "Certificates": null,
+        "Capabilities": [
+          1,
+          2
+        ],
+        "Flags": {
+          "ServerSSHAllowed": true,
+          "DisableIPv6": false
+        },
+        "SyncMessageVersion": 1
+      },
+      "ProxyMeta": {
+        "Embedded": true,
+        "Cluster": "cluster-1.netbird.services"
+      },
+      "Location": {
+        "CountryCode": "DE",
+        "CityName": "Berlin",
+        "ConnectionIP": "46.201.148.187"
+      }
+    },
+    "peer-id-332": {
+      "ID": "peer-id-332",
+      "Key": "key-332",
+      "SSHKey": "ssh-key-2",
+      "DNSLabel": "peer-2",
+      "UserID": "user-id-2",
+      "SSHEnabled": true,
+      "LoginExpirationEnabled": true,
+      "LastLogin": "2026-08-06T14:25:59.12999Z",
+      "IP": "10.10.100.1",
+      "IPv6": "fdf5:ba80:6aa5:89f1:44d7:8701:8699:4940",
+      "RequiresApproval": false,
+      "Connected": true,
+      "ExtraDNSLabels": [
+        "extra-peer-2"
+      ],
+      "Meta": {
+        "WtVersion": "0.76.1",
+        "GoOS": "linux",
+        "OSVersion": "26.4.2",
+        "KernelVersion": "6.8.0-135-generic",
+        "NetworkAddresses": [
+          {
+            "NetIP": "fe81::8b4c:973f:a76b:3771/64"
+          },
+          {
+            "NetIP": "192.168.17.1/20"
+          }
+        ],
+        "Files": [
+          {
+            "Path": "/usr/bin/netbird",
+            "ProcessIsRunning": false
+          }
+        ],
+        "Certificates": null,
+        "Capabilities": [
+          1,
+          2
+        ],
+        "Flags": {
+          "ServerSSHAllowed": true,
+          "DisableIPv6": false
+        },
+        "SyncMessageVersion": 0
+      },
+      "ProxyMeta": {
+        "Embedded": true,
+        "Cluster": "cluster-2.netbird.services"
+      },
+      "Location": {
+        "CountryCode": "DE",
+        "CityName": "Berlin",
+        "ConnectionIP": "46.201.149.187"
+      }
+    },
+    "peer-id-333": {
+      "ID": "peer-id-333",
+      "Key": "key-333",
+      "SSHKey": "ssh-key-3",
+      "DNSLabel": "peer-3",
+      "UserID": "user-id-3",
+      "SSHEnabled": true,
+      "LoginExpirationEnabled": true,
+      "LastLogin": "2026-08-06T12:25:59.12999Z",
+      "IP": "10.10.200.1",
+      "IPv6": "fdf6:ba80:6aa5:89f1:44d7:8701:8699:4940",
+      "RequiresApproval": false,
+      "Connected": true,
+      "ExtraDNSLabels": [
+        "extra-peer-3"
+      ],
+      "Meta": {
+        "WtVersion": "0.76.2",
+        "GoOS": "linux",
+        "OSVersion": "26.4.3",
+        "KernelVersion": "6.8.0-136-generic",
+        "NetworkAddresses": [
+          {
+            "NetIP": "fe82::8b4c:973f:a76b:3771/64"
+          },
+          {
+            "NetIP": "192.168.18.1/20"
+          }
+        ],
+        "Files": [
+          {
+            "Path": "/usr/bin/netbird",
+            "ProcessIsRunning": false
+          }
+        ],
+        "Certificates": null,
+        "Capabilities": [
+          1,
+          2
+        ],
+        "Flags": {
+          "ServerSSHAllowed": true,
+          "DisableIPv6": false
+        },
+        "SyncMessageVersion": 1
+      },
+      "ProxyMeta": {
+        "Embedded": true,
+        "Cluster": "cluster-3.netbird.services"
+      },
+      "Location": {
+        "CountryCode": "DE",
+        "CityName": "Berlin",
+        "ConnectionIP": "46.201.150.187"
+      }
+    }
+  },
+  "Groups": {
+    "33-group-no-resources-id": {
+      "ID": "33-group-no-resources-id",
+      "Name": "group-3-name",
+      "PublicID": "33-group-no-resources-id-public",
+      "Peers": null,
+      "Resources": null
+    },
+    "33-group-one-resource-id": {
+      "ID": "33-group-one-resource-id",
+      "Name": "group-1-name",
+      "PublicID": "group-one-resource-id-public",
+      "Peers": [
+        "peer-id-331"
+      ],
+      "Resources": [
+        {
+          "ID": "host-id-1",
+          "Type": "host"
+        }
+      ]
+    },
+    "33-group-two-resources-id": {
+      "ID": "33-group-two-resources-id",
+      "Name": "group-2-name",
+      "PublicID": "33-group-two-resources-id-public",
+      "Peers": [
+        "peer-id-332",
+        "peer-id-333"
+      ],
+      "Resources": [
+        {
+          "ID": "subnet-id-1",
+          "Type": "subnet"
+        },
+        {
+          "ID": "host-id-2",
+          "Type": "host"
+        }
+      ]
+    }
+  },
+  "Policies": [
+    {
+      "ID": "policy-331",
+      "PublicID": "policy-1-public",
+      "Enabled": true,
+      "SourcePostureChecks": [
+        "posture-checks-1",
+        "posture-checks-2"
+      ],
+      "Rules": [
+        {
+          "ID": "policy-331",
+          "PolicyID": "policy-331",
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Bidirectional": true,
+          "Sources": [
+            "33-group-one-resource-id",
+            "33-group-two-resources-id"
+          ],
+          "Destinations": [
+            "33-group-one-resource-id",
+            "33-group-two-resources-id"
+          ],
+          "SourceResource": {
+            "ID": "host-id-1",
+            "Type": "host"
+          },
+          "DestinationResource": {
+            "ID": "domain-331",
+            "Type": "domain"
+          },
+          "Ports": [
+            "8080",
+            "8443"
+          ],
+          "PortRanges": [
+            {
+              "Start": 8080,
+              "End": 8090
+            }
+          ],
+          "AuthorizedGroups": {
+            "33-group-one-resource-id": [
+              "user-1",
+              "user-2"
+            ]
+          },
+          "AuthorizedUser": "user-3"
+        }
+      ]
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "route-331",
+      "AccountID": "account-33",
+      "PublicID": "route-1-public",
+      "Network": "172.0.0.0/16",
+      "Domains": [
+        "test-1.com"
+      ],
+      "KeepRoute": true,
+      "NetID": "route-331-net-id",
+      "Description": "route-1",
+      "Peer": "peer-id-331",
+      "PeerID": "peer-id-331",
+      "PeerGroups": [
+        "33-group-one-resource-id"
+      ],
+      "NetworkType": 1,
+      "Masquerade": true,
+      "Metric": 9999,
+      "Enabled": true,
+      "Groups": [
+        "33-group-one-resource-id"
+      ],
+      "AccessControlGroups": [
+        "33-group-one-resource-id"
+      ],
+      "SkipAutoApply": false
+    }
+  ],
+  "NameServerGroups": [
+    {
+      "ID": "nsgroup-331",
+      "PublicID": "nsgroup-1-public",
+      "Name": "nsgroup-1",
+      "Description": "nsgroup-1",
+      "NameServers": [
+        {
+          "IP": "192.168.31.2",
+          "NSType": 1,
+          "Port": 53
+        }
+      ],
+      "Groups": [
+        "33-group-one-resource-id"
+      ],
+      "Primary": true,
+      "Domains": [
+        "test-1.com"
+      ],
+      "Enabled": true,
+      "SearchDomainsEnabled": false
+    },
+    {
+      "ID": "nsgroup-332",
+      "PublicID": "nsgroup-2-public",
+      "Name": "nsgroup-2",
+      "Description": "nsgroup-2",
+      "NameServers": [
+        {
+          "IP": "192.168.32.3",
+          "NSType": 1,
+          "Port": 53
+        }
+      ],
+      "Groups": [
+        "33-group-one-resource-id",
+        "33-group-no-resources-id"
+      ],
+      "Primary": true,
+      "Domains": [
+        "test-1.com",
+        "test-2.com"
+      ],
+      "Enabled": true,
+      "SearchDomainsEnabled": false
+    }
+  ],
+  "NetworkResources": [
+    {
+      "ID": "net-resource-331",
+      "NetworkID": "network-331",
+      "AccountID": "account-33",
+      "PublicID": "net-resource-public-1",
+      "Name": "network-resource-1",
+      "Description": "network-resource-1",
+      "Type": "subnet",
+      "Address": "",
+      "Domain": "",
+      "Prefix": "10.0.0.0/16",
+      "Enabled": true
+    },
+    {
+      "ID": "net-resource-332",
+      "NetworkID": "network-332",
+      "AccountID": "account-33",
+      "PublicID": "net-resource-public-2",
+      "Name": "network-resource-2",
+      "Description": "network-resource-2",
+      "Type": "domain",
+      "Address": "",
+      "Domain": "test.com",
+      "Prefix": "",
+      "Enabled": true
+    }
+  ],
+  "Network": {
+    "Identifier": "network-331",
+    "Net": {
+      "IP": "100.103.0.0",
+      "Mask": "//8AAA=="
+    },
+    "NetV6": {
+      "IP": "fdde:e995:fd38:a465::",
+      "Mask": "//////////8AAAAAAAAAAA=="
+    },
+    "Dns": "",
+    "Serial": 1
+  },
+  "DNSSettings": {
+    "DisabledManagementGroups": [
+      "disabled-group-1",
+      "disabled-group-2"
+    ]
+  },
+  "AccountSettings": {
+    "PeerLoginExpirationEnabled": true,
+    "PeerLoginExpiration": 86400000000000,
+    "PeerInactivityExpirationEnabled": false,
+    "PeerInactivityExpiration": 86400000000000,
+    "DNSDomain": "",
+    "IPv6EnabledGroups": [
+      "33-group-one-resource-id"
+    ],
+    "RoutingPeerDNSResolutionEnabled": false,
+    "LazyConnectionEnabled": false,
+    "AutoUpdateVersion": "disabled",
+    "AutoUpdateAlways": false,
+    "MetricsPushEnabled": false
+  },
+  "PostureChecks": {
+    "posturecheck-331": {
+      "ID": "posturecheck-331",
+      "Checks": {
+        "NBVersionCheck": {
+          "MinVersion": "0.25.0"
+        },
+        "OSVersionCheck": {
+          "Android": null,
+          "Darwin": {
+            "MinVersion": "12.0"
+          },
+          "Ios": null,
+          "Linux": null,
+          "Windows": null
+        },
+        "GeoLocationCheck": {
+          "Locations": [
+            {
+              "CountryCode": "FI",
+              "CityName": ""
+            }
+          ],
+          "Action": "allow"
+        },
+        "PeerNetworkRangeCheck": {
+          "Action": "deny",
+          "Ranges": [
+            "192.168.0.1/24"
+          ]
+        },
+        "ProcessCheck": null,
+        "CertificateCheck": null
+      }
+    }
+  },
+  "PostureValidation": null,
+  "AllowedUserIDs": {},
+  "NetworkXIDToPublicID": {
+    "network-331": "network-1-public",
+    "network-332": "network-2-public"
+  },
+  "PostureCheckXIDToPublicID": {
+    "posturecheck-331": "posturecheck-1-public"
+  },
+  "ValidatedPeers": {
+    "peer-id-1": {},
+    "peer-id-2": {},
+    "peer-id-3": {}
+  },
+  "ResourcePolicies": {},
+  "Routers": {
+    "network-id-1": {
+      "peer-id-331": {
+        "PublicID": "public-id-1",
+        "PeerGroups": [
+          "33-group-one-resource-id"
+        ],
+        "Masquerade": true,
+        "Metric": 999,
+        "Enabled": true
+      }
+    },
+    "network-id-2": {
+      "peer-id-332": {
+        "PublicID": "public-id-2",
+        "PeerGroups": [
+          "33-group-two-resources-id",
+          "33-group-no-resources-id"
+        ],
+        "Masquerade": true,
+        "Metric": 333,
+        "Enabled": true
+      },
+      "peer-id-333": {
+        "PublicID": "public-id-2",
+        "PeerGroups": [
+          "33-group-two-resources-id",
+          "33-group-no-resources-id"
+        ],
+        "Masquerade": true,
+        "Metric": 333,
+        "Enabled": true
+      }
+    }
+  },
+  "GroupIDToUserIDs": {},
+  "DNSDomain": "",
+  "ProxyTargetedDomainResourceIDs": {},
+  "AppliedZoneCandidates": [
+    {
+      "DistributionGroups": [
+        "33-group-one-resource-id"
+      ],
+      "Zone": {
+        "Domain": "test-331.com.",
+        "Records": [
+          {
+            "Name": "test.test-331.com.",
+            "Type": 1,
+            "Class": "IN",
+            "TTL": 1800,
+            "RData": "1.1.1.1"
+          },
+          {
+            "Name": "test2.test-331.com.",
+            "Type": 1,
+            "Class": "IN",
+            "TTL": 1800,
+            "RData": "1.1.1.2"
+          }
+        ],
+        "SearchDomainDisabled": false,
+        "NonAuthoritative": true
+      }
+    },
+    {
+      "DistributionGroups": [
+        "33-group-two-resources-id"
+      ],
+      "Zone": {
+        "Domain": "search-off-331.com.",
+        "Records": [
+          {
+            "Name": "test.search-off-331.com.",
+            "Type": 1,
+            "Class": "IN",
+            "TTL": 1800,
+            "RData": "1.1.1.3"
+          },
+          {
+            "Name": "alias.search-off-331.com.",
+            "Type": 5,
+            "Class": "IN",
+            "TTL": 1800,
+            "RData": "test.search-off-331.com."
+          }
+        ],
+        "SearchDomainDisabled": true,
+        "NonAuthoritative": true
+      }
+    }
+  ],
+  "PrivateServiceCandidates": null,
+  "Services": null,
+  "Domains": [
+    {
+      "Domain": "test-331.com",
+      "TargetCluster": "target-1.cluster.local"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/integration_tests/management/network_map_db/network_map_data_test.go b/integration_tests/management/network_map_db/network_map_data_test.go
new file mode 100644
index 000000000..00c0ec03f
--- /dev/null
+++ b/integration_tests/management/network_map_db/network_map_data_test.go
@@ -0,0 +1,74 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	_ "embed"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
+	"github.com/netbirdio/netbird/management/server/settings"
+	"github.com/netbirdio/netbird/management/server/types"
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
+)
+
+//go:embed network_map_data.sql
+var nmapData string
+
+//go:embed network_map_data_golden.json
+var goldenNMap string
+
+const EnvUpdateGoldenData = "NMAP_UPDATE_GOLDEN_DATA"
+
+func TestGetNetworkMapData(t *testing.T) {
+	ctx := context.TODO()
+
+	// The two mocks are generated by different mock frameworks, so each needs a
+	// controller of its own kind.
+	extraSettingsManager := settings.NewMockManager(gomock.NewController(t))
+	extraSettingsManager.EXPECT().GetExtraSettings(gomock.Any(), gomock.Any()).Return(&types.ExtraSettings{}, nil)
+
+	peerValidators := integrated_validator.NewMockIntegratedValidator(gomock.NewController(t))
+	peerValidators.EXPECT().GetValidatedPeers(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(
+		map[string]struct{}{
+			"peer-id-1": {},
+			"peer-id-2": {},
+			"peer-id-3": {},
+		}, nil)
+
+	storeImpl := networkmapdb.NetworkMapDBStoreImpl{
+		Store:                   store(t),
+		ExtraSettingsManager:    extraSettingsManager,
+		IntegratedPeerValidator: peerValidators,
+	}
+
+	for _, query := range strings.Split(nmapData, ";") {
+		if err := store(t).Exec(ctx, query); err != nil {
+			log.Fatalf("error initializing nmap test: %s", err.Error())
+		}
+	}
+
+	nmap, err := storeImpl.GetNetworkMapData(ctx, "account-33")
+	assert.NoError(t, err)
+
+	serializedNMap, err := json.MarshalIndent(nmap, "", "  ")
+	assert.NoError(t, err)
+
+	if _, ok := os.LookupEnv(EnvUpdateGoldenData); ok {
+		_, filename, _, _ := runtime.Caller(0)
+		tosavepath := filepath.Join(filepath.Dir(filename), "network_map_data_golden.json")
+		err = os.WriteFile(tosavepath, serializedNMap, 0644)
+		assert.NoError(t, err)
+		goldenNMap = string(serializedNMap)
+	}
+	assert.Equal(t, goldenNMap, string(serializedNMap))
+}
diff --git a/integration_tests/management/network_map_db/network_resource_test.go b/integration_tests/management/network_map_db/network_resource_test.go
new file mode 100644
index 000000000..4325ed3ba
--- /dev/null
+++ b/integration_tests/management/network_map_db/network_resource_test.go
@@ -0,0 +1,65 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetNetworkResources(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into network_resources (id, account_id, network_id, public_id, name, description, type, domain, prefix, enabled)
+		VALUES('net-resource-1','account-1','network-1','net-resource-public-1','network-resource-1','network-resource-1','subnet','','"10.0.0.0/16"',TRUE)`)
+	execQuery(t, ctx,
+		`insert into network_resources (id, account_id, network_id, public_id, name, description, type, domain, prefix, enabled)
+		VALUES('net-resource-2','account-1','network-2','net-resource-public-2','network-resource-2','network-resource-2','domain','test.com','',TRUE)`)
+	execQuery(t, ctx,
+		`insert into network_resources (id, account_id, network_id, public_id, name, description, type, domain, prefix, enabled)
+		VALUES('net-resource-3','account-1','network-3','net-resource-public-3','network-resource-3','network-resource-3','host','','"10.0.0.1/32"',TRUE)`)
+
+	resources, err := conn(t, ctx).GetNetworkResources(ctx, "account-1")
+	assert.NoError(t, err)
+
+	assert.Contains(t, resources, nmdata.NetworkResource{
+		ID:          "net-resource-1",
+		AccountID:   "account-1",
+		NetworkID:   "network-1",
+		PublicID:    "net-resource-public-1",
+		Name:        "network-resource-1",
+		Description: "network-resource-1",
+		Type:        "subnet",
+		Domain:      "",
+		Prefix:      netip.MustParsePrefix("10.0.0.0/16"),
+		Enabled:     true,
+	})
+	assert.Contains(t, resources, nmdata.NetworkResource{
+		ID:          "net-resource-2",
+		AccountID:   "account-1",
+		NetworkID:   "network-2",
+		PublicID:    "net-resource-public-2",
+		Name:        "network-resource-2",
+		Description: "network-resource-2",
+		Type:        "domain",
+		Domain:      "test.com",
+		Enabled:     true,
+	})
+	assert.Contains(t, resources, nmdata.NetworkResource{
+		ID:          "net-resource-3",
+		AccountID:   "account-1",
+		NetworkID:   "network-3",
+		PublicID:    "net-resource-public-3",
+		Name:        "network-resource-3",
+		Description: "network-resource-3",
+		Type:        "host",
+		Domain:      "",
+		Prefix:      netip.MustParsePrefix("10.0.0.1/32"),
+		Enabled:     true,
+	})
+}
diff --git a/integration_tests/management/network_map_db/network_router_test.go b/integration_tests/management/network_map_db/network_router_test.go
new file mode 100644
index 000000000..2baf146a7
--- /dev/null
+++ b/integration_tests/management/network_map_db/network_router_test.go
@@ -0,0 +1,45 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetNetworkRouters(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into network_routers (id, account_id, public_id, peer, network_id, masquerade, metric, enabled, peer_groups)
+		VALUES('test-nr-id-1','account-1','public-id-1','peer-id-1','network-id-1',TRUE,999,TRUE,'["group-one-resource-id"]')`)
+	execQuery(t, ctx,
+		`insert into network_routers (id, account_id, public_id, peer, network_id, masquerade, metric, enabled, peer_groups)
+		VALUES('test-nr-id-2','account-1','public-id-2','','network-id-2',TRUE,333,TRUE,'["group-two-resources-id","group-no-resources-id"]')`)
+	// empty peer_groups
+	execQuery(t, ctx,
+		`insert into network_routers (id, account_id, public_id, peer, network_id, masquerade, metric, enabled, peer_groups)
+		VALUES('test-nr-id-3','account-1','public-id-3','peer-id-3','network-id-3',TRUE,999,TRUE,'[]')`)
+	// nil peer_groups
+	execQuery(t, ctx,
+		`insert into network_routers (id, account_id, public_id, peer, network_id, masquerade, metric, enabled, peer_groups)
+		VALUES('test-nr-id-4','account-1','public-id-4','peer-id-4','network-id-4',TRUE,999,TRUE,null)`)
+
+	routers, err := conn(t, ctx).GetNetworkRouters(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.NotEmpty(t, routers)
+
+	assert.Equal(t, routers["network-id-1"],
+		map[string]*nmdata.NetworkRouter{"peer-id-1": {PublicID: "public-id-1", Masquerade: true, Metric: 999, Enabled: true, PeerGroups: []string{"group-one-resource-id"}}})
+	assert.Equal(t, routers["network-id-2"],
+		map[string]*nmdata.NetworkRouter{
+			"peer-id-2": {PublicID: "public-id-2", Masquerade: true, Metric: 333, Enabled: true, PeerGroups: []string{"group-two-resources-id", "group-no-resources-id"}},
+			"peer-id-3": {PublicID: "public-id-2", Masquerade: true, Metric: 333, Enabled: true, PeerGroups: []string{"group-two-resources-id", "group-no-resources-id"}}})
+	assert.Equal(t, routers["network-id-3"],
+		map[string]*nmdata.NetworkRouter{"peer-id-3": {PublicID: "public-id-3", Masquerade: true, Metric: 999, Enabled: true, PeerGroups: []string{}}})
+	assert.Equal(t, routers["network-id-4"],
+		map[string]*nmdata.NetworkRouter{"peer-id-4": {PublicID: "public-id-4", Masquerade: true, Metric: 999, Enabled: true, PeerGroups: nil}})
+}
diff --git a/integration_tests/management/network_map_db/network_test.go b/integration_tests/management/network_map_db/network_test.go
new file mode 100644
index 000000000..fbccee504
--- /dev/null
+++ b/integration_tests/management/network_map_db/network_test.go
@@ -0,0 +1,56 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetNetwork(t *testing.T) {
+	ctx := context.TODO()
+
+	network, err := conn(t, ctx).GetNetwork(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.Equal(t, network, nmdata.Network{
+		Identifier: "network-1",
+		Net:        mustParseCIDR("100.103.0.0/16"),
+		NetV6:      mustParseCIDR("fdde:e995:fd38:a465::/64"),
+		Serial:     1,
+	})
+
+	network, err = conn(t, ctx).GetNetwork(ctx, "account-2")
+	assert.NoError(t, err)
+	assert.Equal(t, network, nmdata.Network{
+		Identifier: "network-2",
+		Net:        mustParseCIDR("110.0.0.0/16"),
+		NetV6:      mustParseCIDR("fddf:e995:fd38:a465::/64"),
+		Serial:     2,
+	})
+}
+
+func mustParseCIDR(s string) net.IPNet {
+	var toret net.IPNet
+
+	_, net, err := net.ParseCIDR(s)
+	if err != nil {
+		panic(err)
+	}
+
+	jn, err := json.Marshal(net)
+	if err != nil {
+		panic(err)
+	}
+
+	err = json.Unmarshal(jn, &toret)
+	if err != nil {
+		panic(err)
+	}
+
+	return toret
+}
diff --git a/integration_tests/management/network_map_db/networks_test.go b/integration_tests/management/network_map_db/networks_test.go
new file mode 100644
index 000000000..5af771522
--- /dev/null
+++ b/integration_tests/management/network_map_db/networks_test.go
@@ -0,0 +1,26 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetNetworks(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into networks (id, account_id, public_id) VALUES('network-1','account-1','network-1-public')`)
+	execQuery(t, ctx,
+		`insert into networks (id, account_id, public_id) VALUES('network-2','account-1','network-2-public')`)
+
+	networksIdx, err := conn(t, ctx).GetNetworkXIDToPublicIdMap(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.Equal(t, networksIdx, map[string]string{
+		"network-1": "network-1-public",
+		"network-2": "network-2-public",
+	})
+}
diff --git a/integration_tests/management/network_map_db/peer_test.go b/integration_tests/management/network_map_db/peer_test.go
new file mode 100644
index 000000000..cf2d7928f
--- /dev/null
+++ b/integration_tests/management/network_map_db/peer_test.go
@@ -0,0 +1,169 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetPeers(t *testing.T) {
+	ctx := context.TODO()
+
+	peers, clusterToPeersIdx, err := conn(t, ctx).GetPeers(ctx, "account-1")
+	assert.NoError(t, err)
+
+	// shouldn't be returned in the index, as it's not connected
+	execQuery(t, ctx,
+		`insert into peers (id,account_id,"key",ssh_key,proxy_meta_embedded,peer_status_connected)
+		 values('peer-4','account-1','key-4','ssh-key-4',true,false)`)
+	// shouldn't be returned in the index as it doesn't have cluster set
+	execQuery(t, ctx,
+		`insert into peers (id,account_id,"key",ssh_key,proxy_meta_embedded,peer_status_connected)
+		 values('peer-5','account-1','key-5','ssh-key-5',false,true)`)
+
+	peer1 := nmdata.Peer{
+		ID:                     "peer-id-1",
+		Key:                    "key-1",
+		SSHKey:                 "ssh-key-1",
+		DNSLabel:               "peer-1",
+		ExtraDNSLabels:         []string{"extra-peer-1"},
+		UserID:                 "user-id-1",
+		SSHEnabled:             true,
+		LoginExpirationEnabled: true,
+		LastLogin:              mustParseTime("2026-08-06T13:25:59.12999+00:00"),
+		IP:                     netip.MustParseAddr("10.10.10.1"),
+		IPv6:                   netip.MustParseAddr("fdf4:ba80:6aa5:89f1:44d7:8701:8699:4940"),
+		RequiresApproval:       false,
+		Connected:              true,
+		Meta: nmdata.PeerSystemMeta{
+			WtVersion:     "0.76.0",
+			GoOS:          "linux",
+			OSVersion:     "26.4.1",
+			KernelVersion: "6.8.0-134-generic",
+			NetworkAddresses: []nmdata.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("fe80::8b4c:973f:a76b:3771/64")},
+				{NetIP: netip.MustParsePrefix("192.168.16.1/20")},
+			},
+			Files: []nmdata.File{
+				{Path: "/usr/bin/netbird", ProcessIsRunning: false},
+			},
+			Capabilities: []int32{1, 2},
+			Flags: nmdata.Flags{
+				ServerSSHAllowed: true,
+				DisableIPv6:      false,
+			},
+			SyncMessageVersion: 1,
+		},
+		ProxyMeta: nmdata.ProxyMeta{
+			Embedded: true,
+			Cluster:  "cluster-1.netbird.services",
+		},
+		Location: nmdata.PeerLocation{
+			CountryCode:  "DE",
+			CityName:     "Berlin",
+			ConnectionIP: net.ParseIP("46.201.148.187"),
+		},
+	}
+	peer2 := nmdata.Peer{
+		ID:                     "peer-id-2",
+		Key:                    "key-2",
+		SSHKey:                 "ssh-key-2",
+		DNSLabel:               "peer-2",
+		ExtraDNSLabels:         []string{"extra-peer-2"},
+		UserID:                 "user-id-2",
+		SSHEnabled:             true,
+		LoginExpirationEnabled: true,
+		LastLogin:              mustParseTime("2026-08-06T14:25:59.12999+00:00"),
+		IP:                     netip.MustParseAddr("10.10.100.1"),
+		IPv6:                   netip.MustParseAddr("fdf5:ba80:6aa5:89f1:44d7:8701:8699:4940"),
+		RequiresApproval:       false,
+		Connected:              true,
+		Meta: nmdata.PeerSystemMeta{
+			WtVersion:     "0.76.1",
+			GoOS:          "linux",
+			OSVersion:     "26.4.2",
+			KernelVersion: "6.8.0-135-generic",
+			NetworkAddresses: []nmdata.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("fe81::8b4c:973f:a76b:3771/64")},
+				{NetIP: netip.MustParsePrefix("192.168.17.1/20")},
+			},
+			Files: []nmdata.File{
+				{Path: "/usr/bin/netbird", ProcessIsRunning: false},
+			},
+			Capabilities: []int32{1, 2},
+			Flags: nmdata.Flags{
+				ServerSSHAllowed: true,
+				DisableIPv6:      false,
+			},
+			SyncMessageVersion: 0,
+		},
+		ProxyMeta: nmdata.ProxyMeta{
+			Embedded: true,
+			Cluster:  "cluster-2.netbird.services",
+		},
+		Location: nmdata.PeerLocation{
+			CountryCode:  "DE",
+			CityName:     "Berlin",
+			ConnectionIP: net.ParseIP("46.201.149.187"),
+		},
+	}
+	peer3 := nmdata.Peer{
+		ID:                     "peer-id-3",
+		Key:                    "key-3",
+		SSHKey:                 "ssh-key-3",
+		DNSLabel:               "peer-3",
+		ExtraDNSLabels:         []string{"extra-peer-3"},
+		UserID:                 "user-id-3",
+		SSHEnabled:             true,
+		LoginExpirationEnabled: true,
+		LastLogin:              mustParseTime("2026-08-06T12:25:59.12999+00:00"),
+		IP:                     netip.MustParseAddr("10.10.200.1"),
+		IPv6:                   netip.MustParseAddr("fdf6:ba80:6aa5:89f1:44d7:8701:8699:4940"),
+		RequiresApproval:       false,
+		Connected:              true,
+		Meta: nmdata.PeerSystemMeta{
+			WtVersion:     "0.76.2",
+			GoOS:          "linux",
+			OSVersion:     "26.4.3",
+			KernelVersion: "6.8.0-136-generic",
+			NetworkAddresses: []nmdata.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("fe82::8b4c:973f:a76b:3771/64")},
+				{NetIP: netip.MustParsePrefix("192.168.18.1/20")},
+			},
+			Files: []nmdata.File{
+				{Path: "/usr/bin/netbird", ProcessIsRunning: false},
+			},
+			Capabilities: []int32{1, 2},
+			Flags: nmdata.Flags{
+				ServerSSHAllowed: true,
+				DisableIPv6:      false,
+			},
+			SyncMessageVersion: 1,
+		},
+		ProxyMeta: nmdata.ProxyMeta{
+			Embedded: true,
+			Cluster:  "cluster-3.netbird.services",
+		},
+		Location: nmdata.PeerLocation{
+			CountryCode:  "DE",
+			CityName:     "Berlin",
+			ConnectionIP: net.ParseIP("46.201.150.187"),
+		},
+	}
+
+	assert.Contains(t, peers, peer1)
+	assert.Contains(t, peers, peer2)
+	assert.Contains(t, peers, peer3)
+
+	assert.Equal(t, clusterToPeersIdx, map[string][]*nmdata.Peer{
+		"cluster-1.netbird.services": {&peer1},
+		"cluster-2.netbird.services": {&peer2},
+		"cluster-3.netbird.services": {&peer3},
+	})
+}
diff --git a/integration_tests/management/network_map_db/pg_test_store.go b/integration_tests/management/network_map_db/pg_test_store.go
new file mode 100644
index 000000000..1710747b5
--- /dev/null
+++ b/integration_tests/management/network_map_db/pg_test_store.go
@@ -0,0 +1,121 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/google/uuid"
+	networkmap_pgsql "github.com/netbirdio/netbird/management/internals/network_map_db/pgsql"
+	gormstore "github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/testutil"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+)
+
+func createPGTestStore(baseData string) (*networkmap_pgsql.PgStore, func()) {
+	_, tmpdsn, err := testutil.CreatePostgresTestContainer()
+	if err != nil {
+		log.Fatalf("error starting postres container %v", err)
+	}
+
+	var db *gorm.DB
+	for i := range 5 {
+		db, err = gorm.Open(postgres.Open(tmpdsn), &gorm.Config{})
+
+		if err == nil {
+			break
+		}
+
+		if i < 5 {
+			waitTime := time.Duration(100*(i+1)) * time.Millisecond
+			time.Sleep(waitTime)
+			continue
+		}
+
+		log.Fatalf("error connecting to postres db %v", err)
+	}
+
+	var cleanup func()
+	dsn, cleanup, err := createRandomDB(tmpdsn, db)
+	sqlDB, _ := db.DB()
+	if sqlDB != nil {
+		sqlDB.Close()
+	}
+	if err != nil {
+		log.Fatalf("error creating postres db %v", err)
+	}
+
+	_, err = gormstore.NewPostgresqlStoreForTests(context.TODO(), dsn, nil, false)
+	if err != nil {
+		log.Fatalf("error running migrations %v", err)
+	}
+
+	ctx := context.TODO()
+	pgstore, err := networkmap_pgsql.NewPostgresqlStore(ctx, dsn)
+	if err != nil {
+		log.Fatal("error creating postgres store %w", err)
+	}
+
+	for _, query := range strings.Split(baseData, ";") {
+		if _, err := pgstore.Pool.Exec(ctx, query); err != nil {
+			log.Fatalf("error initializing db: %s", err.Error())
+		}
+	}
+
+	return pgstore, cleanup
+}
+
+func createRandomDB(dsn string, db *gorm.DB) (string, func(), error) {
+	dbName := fmt.Sprintf("test_db_%s", strings.ReplaceAll(uuid.New().String(), "-", "_"))
+
+	if err := db.Exec(fmt.Sprintf("CREATE DATABASE %s", dbName)).Error; err != nil {
+		return "", nil, fmt.Errorf("failed to create database: %v", err)
+	}
+
+	originalDSN := dsn
+
+	cleanup := func() {
+		var dropDB *gorm.DB
+		var err error
+
+		dropDB, err = gorm.Open(postgres.Open(originalDSN), &gorm.Config{
+			SkipDefaultTransaction: true,
+			PrepareStmt:            false,
+		})
+		if err != nil {
+			log.Errorf("failed to connect for dropping database %s: %v", dbName, err)
+			return
+		}
+		defer func() {
+			if sqlDB, _ := dropDB.DB(); sqlDB != nil {
+				sqlDB.Close()
+			}
+		}()
+
+		if sqlDB, _ := dropDB.DB(); sqlDB != nil {
+			sqlDB.SetMaxOpenConns(1)
+			sqlDB.SetMaxIdleConns(0)
+			sqlDB.SetConnMaxLifetime(time.Second)
+		}
+
+		err = dropDB.Exec(fmt.Sprintf("DROP DATABASE IF EXISTS %s WITH (FORCE)", dbName)).Error
+
+		if err != nil {
+			log.Errorf("failed to drop database %s: %v", dbName, err)
+		}
+	}
+
+	return replaceDBName(dsn, dbName), cleanup, nil
+}
+
+func replaceDBName(dsn, newDBName string) string {
+	re := regexp.MustCompile(`(?P<pre>[:/@])(?P<dbname>[^/?]+)(?P<post>\?|$)`)
+	return re.ReplaceAllString(dsn, `${pre}`+newDBName+`${post}`)
+}
diff --git a/integration_tests/management/network_map_db/policy_test.go b/integration_tests/management/network_map_db/policy_test.go
new file mode 100644
index 000000000..1f4c543da
--- /dev/null
+++ b/integration_tests/management/network_map_db/policy_test.go
@@ -0,0 +1,146 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetPolicies(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into policies (id, public_id, account_id, enabled, source_posture_checks)
+		 values('policy-1','policy-1-public','account-1',true,'["posture-checks-1","posture-checks-2"]')`)
+	execQuery(t, ctx,
+		`insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
+		                           source_resource, destination_resource, ports, port_ranges,
+								   authorized_groups, authorized_user)
+		 values('policy-1-rule-1','policy-1',true,'accept','tcp',true,'["group-one-resource-id","group-two-resources-id"]','["group-one-resource-id","group-two-resources-id"]',
+		        '{"ID":"host-id-1","Type":"host"}','{"ID":"domain-1","Type":"domain"}','["8080","8443"]', '[{"Start":8080,"End":8090}]',
+				'{"group-one-resource-id":["user-1", "user-2"]}','user-3')`)
+	execQuery(t, ctx,
+		`insert into policies (id, public_id, account_id, enabled, source_posture_checks)
+		 values('policy-2','policy-2-public','account-1',true,'["posture-checks-3","posture-checks-4"]')`)
+	execQuery(t, ctx,
+		`insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
+		                           source_resource, destination_resource, ports, port_ranges,
+								   authorized_groups, authorized_user)
+		 values('policy-2-rule-1','policy-2',true,'accept','tcp',true,'["group-one-resource-id"]','["group-two-resources-id"]',
+		        '{"ID":"host-id-3","Type":"host"}','{"ID":"domain-3","Type":"domain"}','["8080","8443"]', '[{"Start":8080,"End":8090}]',
+				'{"group-one-resource-id":["user-6", "user-7"]}','user-8')`)
+	// policy with a rule with null fields
+	execQuery(t, ctx,
+		`insert into policies (id, public_id, account_id, enabled, source_posture_checks)
+		 values('policy-3','policy-3-public','account-1',true,null)`)
+	execQuery(t, ctx,
+		`insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
+		                           source_resource, destination_resource, ports, port_ranges,
+								   authorized_groups, authorized_user)
+		 values('policy-3-rule-1','policy-3',true,null,null,null,null,null,null,null,null,null,null,null)`)
+	// policy with a disabled rule, destination resource and groups should not be in indexes
+	execQuery(t, ctx,
+		`insert into policies (id, public_id, account_id, enabled, source_posture_checks)
+		 values('policy-4','policy-4-public','account-1',true,null)`)
+	execQuery(t, ctx,
+		`insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
+		                           source_resource, destination_resource, ports, port_ranges,
+								   authorized_groups, authorized_user)
+		 values('policy-4-rule-1','policy-4',false,null,null,null,null,'["group-two-resources-id"]',
+		        null,'{"ID":"domain-3","Type":"domain"}',null,null,null,null)`)
+
+	policies, policyToDestinationResourceIdx, policyToDestinationGroupIdx, err := conn(t, ctx).GetPolicies(ctx, "account-1")
+	assert.NoError(t, err)
+
+	assert.Contains(t, policies, nmdata.Policy{
+		ID:                  "policy-1",
+		PublicID:            "policy-1-public",
+		Enabled:             true,
+		SourcePostureChecks: []string{"posture-checks-1", "posture-checks-2"},
+		Rules: []*nmdata.PolicyRule{
+			{
+				ID:                  "policy-1",
+				PolicyID:            "policy-1",
+				Enabled:             true,
+				Action:              "accept",
+				Protocol:            "tcp",
+				Bidirectional:       true,
+				Sources:             []string{"group-one-resource-id", "group-two-resources-id"},
+				Destinations:        []string{"group-one-resource-id", "group-two-resources-id"},
+				SourceResource:      nmdata.Resource{ID: "host-id-1", Type: "host"},
+				DestinationResource: nmdata.Resource{ID: "domain-1", Type: "domain"},
+				Ports:               []string{"8080", "8443"},
+				PortRanges:          []nmdata.RulePortRange{{Start: 8080, End: 8090}},
+				AuthorizedGroups:    map[string][]string{"group-one-resource-id": {"user-1", "user-2"}},
+				AuthorizedUser:      "user-3",
+			},
+		},
+	})
+
+	assert.Contains(t, policies, nmdata.Policy{
+		ID:                  "policy-2",
+		PublicID:            "policy-2-public",
+		Enabled:             true,
+		SourcePostureChecks: []string{"posture-checks-3", "posture-checks-4"},
+		Rules: []*nmdata.PolicyRule{
+			{
+				ID:                  "policy-2",
+				PolicyID:            "policy-2",
+				Enabled:             true,
+				Action:              "accept",
+				Protocol:            "tcp",
+				Bidirectional:       true,
+				Sources:             []string{"group-one-resource-id"},
+				Destinations:        []string{"group-two-resources-id"},
+				SourceResource:      nmdata.Resource{ID: "host-id-3", Type: "host"},
+				DestinationResource: nmdata.Resource{ID: "domain-3", Type: "domain"},
+				Ports:               []string{"8080", "8443"},
+				PortRanges:          []nmdata.RulePortRange{{Start: 8080, End: 8090}},
+				AuthorizedGroups:    map[string][]string{"group-one-resource-id": {"user-6", "user-7"}},
+				AuthorizedUser:      "user-8",
+			},
+		},
+	})
+
+	assert.Contains(t, policies, nmdata.Policy{
+		ID:                  "policy-3",
+		PublicID:            "policy-3-public",
+		Enabled:             true,
+		SourcePostureChecks: nil,
+		Rules: []*nmdata.PolicyRule{
+			{
+				ID:       "policy-3",
+				PolicyID: "policy-3",
+				Enabled:  true,
+			},
+		},
+	})
+	assert.Contains(t, policies, nmdata.Policy{
+		ID:                  "policy-4",
+		PublicID:            "policy-4-public",
+		Enabled:             true,
+		SourcePostureChecks: nil,
+		Rules: []*nmdata.PolicyRule{
+			{
+				ID:                  "policy-4",
+				PolicyID:            "policy-4",
+				Enabled:             false,
+				Destinations:        []string{"group-two-resources-id"},
+				DestinationResource: nmdata.Resource{ID: "domain-3", Type: "domain"},
+			},
+		},
+	})
+
+	assert.Equal(t, policyToDestinationGroupIdx, map[string]map[string]any{
+		"policy-1": {"group-one-resource-id": struct{}{}, "group-two-resources-id": struct{}{}},
+		"policy-2": {"group-two-resources-id": struct{}{}},
+	})
+	assert.Equal(t, policyToDestinationResourceIdx, map[string]map[string]any{
+		"policy-1": {"domain-1": struct{}{}},
+		"policy-2": {"domain-3": struct{}{}},
+	})
+}
diff --git a/integration_tests/management/network_map_db/posture_test.go b/integration_tests/management/network_map_db/posture_test.go
new file mode 100644
index 000000000..2b4bb3f3d
--- /dev/null
+++ b/integration_tests/management/network_map_db/posture_test.go
@@ -0,0 +1,61 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetPostureChecks(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into posture_checks (id, account_id, public_id, checks)
+		VALUES('posturecheck-1','account-1','posturecheck-1-public',
+		'{"NBVersionCheck":{"MinVersion":"0.25.0"},
+		  "OSVersionCheck":{"Darwin":{"MinVersion":"12.0"}},
+		  "GeoLocationCheck":{"Locations":[{"CountryCode":"FI","CityName":""}],"Action":"allow"},
+		  "PeerNetworkRangeCheck":{"Action":"deny","Ranges":["192.168.0.1/24"]}}')`)
+
+	execQuery(t, ctx,
+		`insert into posture_checks (id, account_id, public_id, checks)
+		VALUES('posturecheck-2','account-1','posturecheck-2-public',
+		'{"NBVersionCheck":{"MinVersion":"0.25.0"},
+		  "OSVersionCheck":{"Android":{"MinVersion":"0"}},
+		  "GeoLocationCheck":{"Locations":[{"CountryCode":"US","CityName":"Harker Heights"}],"Action":"allow"},
+		  "PeerNetworkRangeCheck":{"Action":"allow","Ranges":["0.0.0.0/0"]}}')`)
+	execQuery(t, ctx,
+		`insert into posture_checks (id, account_id, public_id, checks)
+		VALUES('posturecheck-3','account-1','posturecheck-3-public', null)`)
+
+	postureChecks, idToPublicIDIdx, err := conn(t, ctx).GetPostureChecks(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.Equal(t, idToPublicIDIdx, map[string]string{
+		"posturecheck-1": "posturecheck-1-public",
+		"posturecheck-2": "posturecheck-2-public",
+		"posturecheck-3": "posturecheck-3-public",
+	})
+	assert.Contains(t, postureChecks, nmdata.PostureChecks{
+		ID: "posturecheck-1",
+		Checks: nmdata.ChecksDefinition{
+			NBVersionCheck:        &nmdata.NBVersionCheck{MinVersion: "0.25.0"},
+			OSVersionCheck:        &nmdata.OSVersionCheck{Darwin: &nmdata.MinVersionCheck{MinVersion: "12.0"}},
+			GeoLocationCheck:      &nmdata.GeoLocationCheck{Locations: []nmdata.GeoLocation{{CountryCode: "FI"}}, Action: "allow"},
+			PeerNetworkRangeCheck: &nmdata.PeerNetworkRangeCheck{Action: "deny", Ranges: []netip.Prefix{netip.MustParsePrefix("192.168.0.1/24")}},
+		}})
+	assert.Contains(t, postureChecks, nmdata.PostureChecks{
+		ID: "posturecheck-2",
+		Checks: nmdata.ChecksDefinition{
+			NBVersionCheck:        &nmdata.NBVersionCheck{MinVersion: "0.25.0"},
+			OSVersionCheck:        &nmdata.OSVersionCheck{Android: &nmdata.MinVersionCheck{MinVersion: "0"}},
+			GeoLocationCheck:      &nmdata.GeoLocationCheck{Locations: []nmdata.GeoLocation{{CountryCode: "US", CityName: "Harker Heights"}}, Action: "allow"},
+			PeerNetworkRangeCheck: &nmdata.PeerNetworkRangeCheck{Action: "allow", Ranges: []netip.Prefix{netip.MustParsePrefix("0.0.0.0/0")}},
+		}})
+	assert.Contains(t, postureChecks, nmdata.PostureChecks{
+		ID: "posturecheck-3"})
+}
diff --git a/integration_tests/management/network_map_db/route_test.go b/integration_tests/management/network_map_db/route_test.go
new file mode 100644
index 000000000..12e9302f9
--- /dev/null
+++ b/integration_tests/management/network_map_db/route_test.go
@@ -0,0 +1,87 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetRoutes(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into routes (id, account_id, public_id, network, domains, keep_route, net_id, description,
+	                         peer, peer_groups, network_type, masquerade, metric, enabled, 
+	                         groups, access_control_groups, skip_auto_apply)
+		VALUES('route-1','account-1','route-1-public','"172.0.0.0/16"','["test-1.com"]',true,'route-1-net-id','route-1',
+		        'peer-id-1','["group-one-resource-id"]',1,true,9999,true,
+				'["group-one-resource-id"]','["group-one-resource-id"]',false)`)
+	execQuery(t, ctx,
+		`insert into routes (id, account_id, public_id, network, domains, keep_route, net_id, description,
+	                         peer, peer_groups, network_type, masquerade, metric, enabled, 
+	                         groups, access_control_groups, skip_auto_apply)
+		VALUES('route-2','account-1','route-2-public','"172.10.0.0/16"','["test-1.com","test-2.com"]',true,'route-2-net-id','route-2',
+		        'peer-id-2','["group-two-resources-id"]',1,true,9999,true,
+				'["group-two-resources-id"]','["group-two-resources-id"]',false)`)
+	execQuery(t, ctx,
+		`insert into routes (id, account_id, public_id, network, domains, keep_route, net_id, description,
+	                         peer, peer_groups, network_type, masquerade, metric, enabled, 
+	                         groups, access_control_groups, skip_auto_apply)
+		VALUES('route-3','account-1','route-3-public',null,null,null,null,'route-3',
+		        null,null,null,null,null,null,null,null,null)`)
+
+	routes, err := conn(t, ctx).GetRoutes(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.Contains(t, routes, nmdata.Route{
+		ID:                  "route-1",
+		AccountID:           "account-1",
+		PublicID:            "route-1-public",
+		Network:             netip.MustParsePrefix("172.0.0.0/16"),
+		Domains:             domain.List{"test-1.com"},
+		KeepRoute:           true,
+		NetID:               "route-1-net-id",
+		Description:         "route-1",
+		Peer:                "peer-id-1",
+		PeerID:              "peer-id-1",
+		PeerGroups:          []string{"group-one-resource-id"},
+		NetworkType:         1,
+		Masquerade:          true,
+		Metric:              9999,
+		Enabled:             true,
+		Groups:              []string{"group-one-resource-id"},
+		AccessControlGroups: []string{"group-one-resource-id"},
+		SkipAutoApply:       false,
+	})
+	assert.Contains(t, routes, nmdata.Route{
+		ID:                  "route-2",
+		AccountID:           "account-1",
+		PublicID:            "route-2-public",
+		Network:             netip.MustParsePrefix("172.10.0.0/16"),
+		Domains:             domain.List{"test-1.com", "test-2.com"},
+		KeepRoute:           true,
+		NetID:               "route-2-net-id",
+		Description:         "route-2",
+		Peer:                "peer-id-2",
+		PeerID:              "peer-id-2",
+		PeerGroups:          []string{"group-two-resources-id"},
+		NetworkType:         1,
+		Masquerade:          true,
+		Metric:              9999,
+		Enabled:             true,
+		Groups:              []string{"group-two-resources-id"},
+		AccessControlGroups: []string{"group-two-resources-id"},
+		SkipAutoApply:       false,
+	})
+	assert.Contains(t, routes, nmdata.Route{
+		ID:          "route-3",
+		AccountID:   "account-1",
+		PublicID:    "route-3-public",
+		Description: "route-3",
+	})
+}
diff --git a/integration_tests/management/network_map_db/service_test.go b/integration_tests/management/network_map_db/service_test.go
new file mode 100644
index 000000000..effc7a707
--- /dev/null
+++ b/integration_tests/management/network_map_db/service_test.go
@@ -0,0 +1,109 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+)
+
+func TestGetPrivateServices(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into services (id, account_id, enabled, private, access_groups, proxy_cluster, domain)
+		 values('service-1','account-1',true,true,'["group-one-resource-id"]','test-1.com','test-2.com')`)
+	execQuery(t, ctx,
+		`insert into services (id, account_id, enabled, private, access_groups, proxy_cluster, domain)
+		 values('service-2','account-1',true,true,'["group-one-resource-id","group-two-resources-id"]','test-3.com','test-4.com')`)
+	execQuery(t, ctx,
+		`insert into services (id, account_id, enabled, private, access_groups, proxy_cluster, domain)
+		 values('service-3','account-1',null,null,null,null,null)`)
+
+	services, err := conn(t, ctx).GetPrivateServices(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.Contains(t, services, networkmapdb.Service{
+		Enabled:      sql.NullBool{Bool: true, Valid: true},
+		Private:      sql.NullBool{Bool: true, Valid: true},
+		AccessGroups: []string{"group-one-resource-id"},
+		ProxyCluster: sql.NullString{String: "test-1.com", Valid: true},
+		Domain:       sql.NullString{String: "test-2.com", Valid: true},
+	})
+	assert.Contains(t, services, networkmapdb.Service{
+		Enabled:      sql.NullBool{Bool: true, Valid: true},
+		Private:      sql.NullBool{Bool: true, Valid: true},
+		AccessGroups: []string{"group-one-resource-id", "group-two-resources-id"},
+		ProxyCluster: sql.NullString{String: "test-3.com", Valid: true},
+		Domain:       sql.NullString{String: "test-4.com", Valid: true},
+	})
+	assert.Contains(t, services, networkmapdb.Service{
+		Enabled:      sql.NullBool{Bool: false, Valid: false},
+		Private:      sql.NullBool{Bool: false, Valid: false},
+		AccessGroups: []string{},
+		ProxyCluster: sql.NullString{String: "", Valid: false},
+		Domain:       sql.NullString{String: "", Valid: false},
+	})
+}
+
+func TestGetProxyTargetedDomainResourceIDs(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into services (id, account_id, enabled, terminated)
+		 values('service-4','account-1',true,false)`)
+	execQuery(t, ctx,
+		`insert into targets (target_id, account_id, service_id, enabled, target_type)
+		 values('target-1','account-1','service-4',true,'domain')`)
+	// id shouldn't be returned as the taget_type is not "domain"
+	execQuery(t, ctx,
+		`insert into targets (target_id, account_id, service_id, enabled, target_type)
+		 values('target-2','account-1','service-4',true,'cluster')`)
+	// id shouldn't be included as the target is disabled
+	execQuery(t, ctx,
+		`insert into targets (target_id, account_id, service_id, enabled, target_type)
+		 values('target-3','account-1','service-4',false,'domain')`)
+	// id shouldn't be included as the service is disabled
+	execQuery(t, ctx,
+		`insert into services (id, account_id, enabled, terminated)
+		 values('service-5','account-1',false,false)`)
+	execQuery(t, ctx,
+		`insert into targets (target_id, account_id, service_id, enabled, target_type)
+		 values('target-4','account-1','service-5',false,'domain')`)
+	// id shouldn't be included as the service is terminated (explicitly)
+	execQuery(t, ctx,
+		`insert into services (id, account_id, enabled, terminated)
+		 values('service-6','account-1',true,true)`)
+	execQuery(t, ctx,
+		`insert into targets (target_id, account_id, service_id, enabled, target_type)
+		 values('target-5','account-1','service-6',true,'domain')`)
+	// id shouldn't be included as the service is terminated (implicitly)
+	execQuery(t, ctx,
+		`insert into services (id, account_id, enabled, terminated)
+		 values('service-7','account-1',true,null)`)
+	execQuery(t, ctx,
+		`insert into targets (target_id, account_id, service_id, enabled, target_type)
+		 values('target-6','account-1','service-7',true,'domain')`)
+	execQuery(t, ctx,
+		`insert into services (id, account_id, enabled, terminated)
+		 values('service-8','account-1',true,false)`)
+	execQuery(t, ctx,
+		`insert into targets (target_id, account_id, service_id, enabled, target_type)
+		 values('target-7','account-1','service-8',true,'domain')`)
+	// id shouldn't be returned as the taget_id is null
+	execQuery(t, ctx,
+		`insert into targets (target_id, account_id, service_id, enabled, target_type)
+		 values(null,'account-1','service-4',true,'cluster')`)
+
+	servtargetedDomains, err := conn(t, ctx).GetProxyTargetedDomainResourceIDs(ctx, "account-1")
+	assert.NoError(t, err)
+	assert.Equal(t, servtargetedDomains, map[string]struct{}{
+		"target-1": {},
+		"target-6": {},
+		"target-7": {},
+	})
+}
diff --git a/integration_tests/management/network_map_db/sqlite_test_store.go b/integration_tests/management/network_map_db/sqlite_test_store.go
new file mode 100644
index 000000000..622ac1c83
--- /dev/null
+++ b/integration_tests/management/network_map_db/sqlite_test_store.go
@@ -0,0 +1,52 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"fmt"
+	"runtime"
+	"strings"
+
+	networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite"
+	nbdb "github.com/netbirdio/netbird/management/internals/shared/db"
+	gormstore "github.com/netbirdio/netbird/management/server/store"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func createSqliteTestStore(baseData string) (*networkmap_sqlite.SqliteStore, func()) {
+	storeSqliteFileName := ":memory:"
+	storeStr := fmt.Sprintf("%s?cache=shared", storeSqliteFileName)
+	if runtime.GOOS == "windows" {
+		// Vo avoid `The process cannot access the file because it is being used by another process` on Windows
+		storeStr = storeSqliteFileName
+	}
+
+	db, err := gorm.Open(sqlite.Open(storeStr), &gorm.Config{})
+	if err != nil {
+		log.Fatalf("error initializing db: %s", err.Error())
+	}
+	conn, err := nbdb.NewConn(context.TODO(), db, nbdb.SqliteStoreEngine, nil)
+	if err != nil {
+		log.Fatalf("error initializing db: %s", err.Error())
+	}
+	_, err = gormstore.NewSqlStore(context.TODO(), conn, nil, false)
+	if err != nil {
+		log.Fatalf("error initializing db: %s", err.Error())
+	}
+
+	sqldb, err := db.DB()
+	if err != nil {
+		log.Fatalf("error initializing db: %s", err.Error())
+
+	}
+	for _, query := range strings.Split(baseData, ";") {
+		if _, err := sqldb.Exec(query); err != nil {
+			log.Fatalf("error initializing db: %s", err.Error())
+		}
+	}
+
+	return &networkmap_sqlite.SqliteStore{Db: sqldb}, func() {}
+}
diff --git a/integration_tests/management/network_map_db/user_test.go b/integration_tests/management/network_map_db/user_test.go
new file mode 100644
index 000000000..fce1833d3
--- /dev/null
+++ b/integration_tests/management/network_map_db/user_test.go
@@ -0,0 +1,67 @@
+//go:build integration
+
+package networkmap_pgsql
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetAllowedUsers(t *testing.T) {
+	ctx := context.TODO()
+
+	execQuery(t, ctx,
+		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
+		VALUES('user-1','user-1','account-1','["group-one-resource-id"]',false,false)`)
+	execQuery(t, ctx,
+		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
+		VALUES('user-2','user-2','account-1','["group-one-resource-id","group-two-resources-id"]',false,false)`)
+	execQuery(t, ctx,
+		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
+		VALUES('user-3','user-3','account-1','["group-two-resources-id"]',false,false)`)
+	// empty auto_groups; shouldn't error out
+	execQuery(t, ctx,
+		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
+		VALUES('user-31','user-31','account-1','[]',false,false)`)
+	// null auto_groups; shouldn't error out
+	execQuery(t, ctx,
+		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
+		VALUES('user-32','user-32','account-1',null,false,false)`)
+	// shouldn't be included as it's blocked
+	execQuery(t, ctx,
+		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
+		VALUES('user-4','user-4','account-1','["group-two-resources-id"]',true,false)`)
+	// shouldn't be included as it's a service_user
+	execQuery(t, ctx,
+		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
+		VALUES('user-5','user-5','account-1','["group-two-resources-id"]',false,true)`)
+	execQuery(t, ctx,
+		`insert into groups (id, name, account_id)
+		VALUES('all-group-1','All','account-1')`)
+	execQuery(t, ctx,
+		`insert into groups (id, name, account_id)
+		VALUES('all-group-2','All','account-1')`)
+	execQuery(t, ctx,
+		`insert into groups (id, name, account_id)
+		VALUES('all-group-3','All','account-1')`)
+
+	userIdx, groupIdToUserIds, err := conn(t, ctx).GetAllowedUsers(ctx, "account-1")
+	assert.NoError(t, err)
+
+	assert.Equal(t, userIdx, map[string]struct{}{
+		"user-1":  {},
+		"user-2":  {},
+		"user-3":  {},
+		"user-31": {},
+		"user-32": {},
+	})
+	assert.Equal(t, groupIdToUserIds, map[string][]string{
+		"group-one-resource-id":  {"user-1", "user-2"},
+		"group-two-resources-id": {"user-2", "user-3"},
+		"all-group-1":            {"user-1", "user-2", "user-3", "user-31", "user-32"},
+		"all-group-2":            {"user-1", "user-2", "user-3", "user-31", "user-32"},
+		"all-group-3":            {"user-1", "user-2", "user-3", "user-31", "user-32"},
+	})
+}
diff --git a/magefiles/magefile.go b/magefiles/magefile.go
new file mode 100644
index 000000000..34ab3c08f
--- /dev/null
+++ b/magefiles/magefile.go
@@ -0,0 +1,10 @@
+//mage:multiline
+
+// Set the general description you want to have displayed with mage -l here.
+package main
+
+// mg contains helpful utility functions, like Deps
+
+// Default target to run when none is specified
+// If not set, running mage will list available targets
+//var Default = Integrationtest.All
diff --git a/magefiles/openapi.go b/magefiles/openapi.go
new file mode 100644
index 000000000..e590b3ddf
--- /dev/null
+++ b/magefiles/openapi.go
@@ -0,0 +1,31 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/magefile/mage/mg"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+)
+
+var apiPath = filepath.Join("shared", "management", "http", "apiv1alpha1")
+
+type Openapi mg.Namespace
+
+func (Openapi) GenerateV1Bindings(generateflags *string) error {
+	bundle, model, err := apiv1alpha1.GenerateV1ApiBindings(apiv1alpha1.ApiPath)
+	if err != nil {
+		return err
+	}
+	err = os.WriteFile(filepath.Join(apiPath, "bundle.yaml"), bundle, 0644) //nolint:gosec
+	if err != nil {
+		return err
+	}
+
+	generated, err := apiv1alpha1.GenerateV1Schema(model)
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(filepath.Join(apiPath, "types.gen.go"), generated.Source, 0644) //nolint:gosec
+}
diff --git a/magefiles/test.go b/magefiles/test.go
new file mode 100644
index 000000000..2d08e8e01
--- /dev/null
+++ b/magefiles/test.go
@@ -0,0 +1,74 @@
+package main
+
+import (
+	"errors"
+	"strings"
+
+	"github.com/magefile/mage/mg"
+	"github.com/magefile/mage/sh"
+)
+
+var defaultcli = []string{"test", "-tags=integration", "-timeout=20m"}
+
+type Integrationtest mg.Namespace
+
+func (i Integrationtest) All(gotestflags *string) error {
+	var errs []error
+	if err := i.Api(gotestflags); err != nil {
+		errs = append(errs, err)
+	}
+	if err := i.NmapDb(gotestflags); err != nil {
+		errs = append(errs, err)
+	}
+	if len(errs) > 0 {
+		return errors.Join(errs...)
+	}
+	return nil
+}
+
+func (Integrationtest) NmapDb(gotestflags *string) error {
+	cli := defaultcli
+	if gotestflags != nil {
+		cli = append(cli, strings.Split(*gotestflags, " ")...)
+	}
+	cli = append(cli, "./integration_tests/management/network_map_db/...")
+
+	return sh.RunV("go", cli...)
+}
+
+func (Integrationtest) NmapDbPostgres(gotestflags *string) error {
+	cli := defaultcli
+	if gotestflags != nil {
+		cli = append(cli, strings.Split(*gotestflags, " ")...)
+	}
+	cli = append(cli, "./integration_tests/management/network_map_db/...")
+
+	return sh.RunWithV(map[string]string{"NETBIRD_STORE_ENGINE": "postgres"}, "go", cli...)
+}
+
+func (Integrationtest) NmapDbSqlite(gotestflags *string) error {
+	cli := defaultcli
+	if gotestflags != nil {
+		cli = append(cli, strings.Split(*gotestflags, " ")...)
+	}
+	cli = append(cli, "./integration_tests/management/network_map_db/...")
+	return sh.RunWithV(map[string]string{"NETBIRD_STORE_ENGINE": "sqlite"}, "go", cli...)
+}
+
+func (Integrationtest) RegenerateNmapGoldenData(gotestflags *string) error {
+	cli := defaultcli
+	if gotestflags != nil {
+		cli = append(cli, strings.Split(*gotestflags, " ")...)
+	}
+	cli = append(cli, "./integration_tests/management/network_map_db/...")
+	return sh.RunWithV(map[string]string{"NMAP_UPDATE_GOLDEN_DATA": "true", "NETBIRD_STORE_ENGINE": "sqlite"}, "go", cli...)
+}
+
+func (Integrationtest) Api(gotestflags *string) error {
+	cli := defaultcli
+	if gotestflags != nil {
+		cli = append(cli, strings.Split(*gotestflags, " ")...)
+	}
+	cli = append(cli, "./management/server/http/...")
+	return sh.RunV("go", cli...)
+}
diff --git a/management/Dockerfile.multistage b/management/Dockerfile.multistage
index 619f84615..5d037f1b1 100644
--- a/management/Dockerfile.multistage
+++ b/management/Dockerfile.multistage
@@ -1,4 +1,4 @@
-FROM golang:1.25-bookworm AS builder
+FROM golang:1.26.7-bookworm AS builder
 WORKDIR /app
 
 # Install build dependencies
diff --git a/management/Dockerfile.ubi b/management/Dockerfile.ubi
new file mode 100644
index 000000000..628d1a086
--- /dev/null
+++ b/management/Dockerfile.ubi
@@ -0,0 +1,33 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-management" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Management" \
+      description="NetBird Management is the control plane of a NetBird network and serves its REST and gRPC APIs."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-mgmt /go/bin/netbird-mgmt
+COPY licenses/ /licenses/
+# Only the data directory shares the root group for arbitrary non-root UIDs.
+# Runtime-created keys and databases retain the application's restrictive modes.
+RUN mkdir -p /var/lib/netbird /etc/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+USER 1000:0
+ENV HOME=/var/lib/netbird
+# Runtimes such as OpenShift and Podman reserve ports below 1024 for root, so
+# --port defaults to 8080 here. With --letsencrypt-domain, forward public 443
+# to --port and set --letsencrypt-listen-address to empty, so the main listener
+# answers the TLS-ALPN challenges. 33073 is the legacy gRPC port.
+EXPOSE 8080 33073
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/go/bin/netbird-mgmt", "management"]
+CMD ["--port", "8080", "--log-file", "console"]
diff --git a/management/cmd/admin.go b/management/cmd/admin.go
new file mode 100644
index 000000000..e5c0f6ac9
--- /dev/null
+++ b/management/cmd/admin.go
@@ -0,0 +1,177 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"path"
+	"path/filepath"
+
+	"github.com/dexidp/dex/storage"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	"github.com/netbirdio/netbird/formatter/hook"
+	admincmd "github.com/netbirdio/netbird/management/cmd/admin"
+	tokencmd "github.com/netbirdio/netbird/management/cmd/token"
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	"github.com/netbirdio/netbird/management/server/activity"
+	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/util"
+)
+
+var adminDatadir string
+
+// newAdminCommands creates the admin command tree with management-specific resource openers.
+func newAdminCommands() *cobra.Command {
+	cmd := admincmd.NewCommands(admincmd.Openers{
+		Resources: withAdminResources,
+		Store:     withAdminStoreOnly,
+		IDP:       withAdminIDPOnly,
+	})
+	cmd.PersistentFlags().StringVar(&adminDatadir, "datadir", "", "Override the data directory from config (used for store.db and the default idp.db)")
+	return cmd
+}
+
+func newLegacyTokenCommand() *cobra.Command {
+	cmd := tokencmd.NewCommands(tokencmd.StoreOpener(withAdminStoreOnly))
+	cmd.Deprecated = "use 'admin token' instead"
+	cmd.PersistentFlags().StringVar(&nbconfig.MgmtConfigPath, "config", defaultMgmtConfig, "Netbird config file location")
+	return cmd
+}
+
+// withAdminResources initializes logging, loads config, opens the management store
+// and embedded IdP storage, and calls fn.
+func withAdminResources(cmd *cobra.Command, fn func(ctx context.Context, resources admincmd.Resources) error) error {
+	return withAdminConfig(cmd, true, func(ctx context.Context, config *nbconfig.Config, datadir string) error {
+		managementStore, err := openAdminStore(ctx, config, datadir)
+		if err != nil {
+			return err
+		}
+		defer admincmd.CloseStore(ctx, managementStore)
+
+		idpStorage, idpStorageFile, err := admincmd.OpenIDPStorage(config)
+		if err != nil {
+			return err
+		}
+		defer admincmd.CloseIDPStorage(idpStorage)
+
+		eventStore, esErr := openAdminEventStore(ctx, config, datadir)
+		if esErr != nil {
+			_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Warning: audit events will not be recorded: %v\n", esErr)
+		}
+		if eventStore != nil {
+			defer func() {
+				if err := eventStore.Close(ctx); err != nil {
+					log.Debugf("close activity event store: %v", err)
+				}
+			}()
+		}
+
+		return fn(ctx, admincmd.Resources{Store: managementStore, IDPStorage: idpStorage, IDPStorageFile: idpStorageFile, EventStore: eventStore})
+	})
+}
+
+// withAdminStoreOnly opens only the management store for admin subcommands that do not
+// need embedded IdP storage.
+func withAdminStoreOnly(cmd *cobra.Command, fn func(ctx context.Context, s store.Store) error) error {
+	return withAdminConfig(cmd, false, func(ctx context.Context, config *nbconfig.Config, datadir string) error {
+		managementStore, err := openAdminStore(ctx, config, datadir)
+		if err != nil {
+			return err
+		}
+		defer admincmd.CloseStore(ctx, managementStore)
+
+		return fn(ctx, managementStore)
+	})
+}
+
+func withAdminIDPOnly(cmd *cobra.Command, fn func(ctx context.Context, idpStorage storage.Storage, storageFile string) error) error {
+	return withAdminConfig(cmd, true, func(ctx context.Context, config *nbconfig.Config, _ string) error {
+		idpStorage, idpStorageFile, err := admincmd.OpenIDPStorage(config)
+		if err != nil {
+			return err
+		}
+		defer admincmd.CloseIDPStorage(idpStorage)
+
+		return fn(ctx, idpStorage, idpStorageFile)
+	})
+}
+
+func withAdminConfig(cmd *cobra.Command, applyIDPDefaults bool, fn func(ctx context.Context, config *nbconfig.Config, datadir string) error) error {
+	if err := util.InitLog("error", "console"); err != nil {
+		return fmt.Errorf("init log: %w", err)
+	}
+
+	ctx := context.WithValue(cmd.Context(), hook.ExecutionContextKey, hook.SystemSource) //nolint:staticcheck
+
+	config, datadir, err := loadAdminMgmtConfig(ctx, applyIDPDefaults)
+	if err != nil {
+		return fmt.Errorf("load config: %w", err)
+	}
+
+	return fn(ctx, config, datadir)
+}
+
+func loadAdminMgmtConfig(ctx context.Context, applyIDPDefaults bool) (*nbconfig.Config, string, error) {
+	config := &nbconfig.Config{}
+	if _, err := util.ReadJsonWithEnvSub(nbconfig.MgmtConfigPath, config); err != nil {
+		return nil, "", err
+	}
+
+	if applyIDPDefaults {
+		if err := ApplyEmbeddedIdPConfig(ctx, config); err != nil {
+			return nil, "", err
+		}
+	}
+
+	datadir := config.Datadir
+	applyAdminDatadirOverride(config, &datadir)
+	return config, datadir, nil
+}
+
+func applyAdminDatadirOverride(config *nbconfig.Config, datadir *string) {
+	if adminDatadir == "" {
+		return
+	}
+
+	oldDatadir := *datadir
+	*datadir = adminDatadir
+	if config.EmbeddedIdP != nil && config.EmbeddedIdP.Storage.Type == "sqlite3" && isDefaultIDPStorageFile(config.EmbeddedIdP.Storage.Config.File, oldDatadir) {
+		config.EmbeddedIdP.Storage.Config.File = filepath.Join(*datadir, "idp.db")
+	}
+}
+
+func isDefaultIDPStorageFile(file, datadir string) bool {
+	if file == "" {
+		return true
+	}
+	defaultFile := filepath.Join(datadir, "idp.db")
+	legacyDefaultFile := path.Join(datadir, "idp.db")
+	legacySlashDefaultFile := path.Join(filepath.ToSlash(datadir), "idp.db")
+	return filepath.Clean(file) == filepath.Clean(defaultFile) ||
+		file == legacyDefaultFile ||
+		filepath.ToSlash(file) == legacySlashDefaultFile
+}
+
+func openAdminStore(ctx context.Context, config *nbconfig.Config, datadir string) (store.Store, error) {
+	managementStore, err := store.NewStore(ctx, config.StoreConfig.Engine, datadir, nil, true)
+	if err != nil {
+		return nil, fmt.Errorf("create store: %w", err)
+	}
+	return managementStore, nil
+}
+
+func openAdminEventStore(ctx context.Context, config *nbconfig.Config, datadir string) (activity.Store, error) {
+	if config.DataStoreEncryptionKey == "" {
+		return nil, fmt.Errorf("data store encryption key is not configured")
+	}
+	eventStore, err := activitystore.NewSqlStore(ctx, datadir, config.DataStoreEncryptionKey)
+	if err != nil {
+		return nil, fmt.Errorf("open activity event store: %w", err)
+	}
+	if eventStore == nil {
+		return nil, fmt.Errorf("open activity event store: returned nil store")
+	}
+	return eventStore, nil
+}
diff --git a/management/cmd/admin/admin.go b/management/cmd/admin/admin.go
new file mode 100644
index 000000000..bd56af39b
--- /dev/null
+++ b/management/cmd/admin/admin.go
@@ -0,0 +1,577 @@
+// Package admincmd provides reusable cobra commands for self-hosted administrator helpers.
+// Both the management and combined binaries use these commands, each providing
+// their own opener to handle config loading and storage initialization.
+package admincmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/dexidp/dex/storage"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/netbirdio/netbird/formatter/hook"
+	nbdex "github.com/netbirdio/netbird/idp/dex"
+	"github.com/netbirdio/netbird/management/cmd/proxy"
+	"github.com/netbirdio/netbird/management/cmd/token"
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	"github.com/netbirdio/netbird/management/server"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/idp"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// Resources contains the storages required by the admin commands.
+type Resources struct {
+	Store          store.Store
+	IDPStorage     storage.Storage
+	IDPStorageFile string
+	EventStore     activity.Store
+}
+
+// Opener initializes command resources from the command context and calls fn.
+type Opener func(cmd *cobra.Command, fn func(ctx context.Context, resources Resources) error) error
+
+// StoreOpener initializes only the management store from the command context and calls fn.
+type StoreOpener func(cmd *cobra.Command, fn func(ctx context.Context, s store.Store) error) error
+
+// IDPOpener initializes only the embedded IdP storage from the command context and calls fn.
+type IDPOpener func(cmd *cobra.Command, fn func(ctx context.Context, idpStorage storage.Storage, storageFile string) error) error
+
+// Openers contains the resource openers needed by the admin command tree.
+type Openers struct {
+	Resources Opener
+	Store     StoreOpener
+	IDP       IDPOpener
+}
+
+type userSelector struct {
+	email  string
+	userID string
+}
+
+func (s userSelector) normalized() userSelector {
+	return userSelector{
+		email:  strings.TrimSpace(s.email),
+		userID: strings.TrimSpace(s.userID),
+	}
+}
+
+func (s userSelector) validate() error {
+	s = s.normalized()
+	if (s.email == "") == (s.userID == "") {
+		return fmt.Errorf("provide exactly one of --email or --user-id")
+	}
+	return nil
+}
+
+// NewCommands creates the admin command tree with the given resource openers.
+func NewCommands(openers Openers) *cobra.Command {
+	adminCmd := &cobra.Command{
+		Use:   "admin",
+		Short: "Self-hosted administrator helpers",
+		Long:  "Administrative helpers for self-hosted deployments using the embedded identity provider.",
+	}
+
+	userCmd := &cobra.Command{
+		Use:   "user",
+		Short: "Manage local embedded IdP users",
+	}
+
+	var passwordSelector userSelector
+	var password string
+	var passwordFile string
+	passwordCmd := &cobra.Command{
+		Use:     "change-password (--email email | --user-id id) (--password password | --password-file path)",
+		Aliases: []string{"set-password"},
+		Short:   "Change a local user's password",
+		Args:    cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			if err := passwordSelector.validate(); err != nil {
+				return err
+			}
+			newPassword, err := resolvePasswordInput(cmd, password, passwordFile)
+			if err != nil {
+				return err
+			}
+			return openers.IDP(cmd, func(ctx context.Context, idpStorage storage.Storage, storageFile string) error {
+				return runChangePassword(ctx, idpStorage, cmd.OutOrStdout(), passwordSelector, newPassword, storageFile)
+			})
+		},
+	}
+	addUserSelectorFlags(passwordCmd, &passwordSelector)
+	passwordCmd.Flags().StringVar(&password, "password", "", "New password for the user")
+	passwordCmd.Flags().StringVar(&passwordFile, "password-file", "", "Read new password from file ('-' for stdin)")
+
+	var resetSelector userSelector
+	resetMFACmd := &cobra.Command{
+		Use:   "reset-mfa (--email email | --user-id id)",
+		Short: "Reset a local user's MFA enrollment",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			if err := resetSelector.validate(); err != nil {
+				return err
+			}
+			return openers.IDP(cmd, func(ctx context.Context, idpStorage storage.Storage, storageFile string) error {
+				return runResetMFA(ctx, idpStorage, cmd.OutOrStdout(), resetSelector, storageFile)
+			})
+		},
+	}
+	addUserSelectorFlags(resetMFACmd, &resetSelector)
+
+	userCmd.AddCommand(passwordCmd, resetMFACmd)
+
+	mfaCmd := &cobra.Command{
+		Use:   "mfa",
+		Short: "Manage local MFA for embedded IdP users",
+	}
+
+	enableCmd := &cobra.Command{
+		Use:   "enable",
+		Short: "Enable MFA for local embedded IdP users",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			return openers.Resources(cmd, func(ctx context.Context, resources Resources) error {
+				return runSetMFAEnabled(ctx, resources, cmd.OutOrStdout(), true)
+			})
+		},
+	}
+
+	disableCmd := &cobra.Command{
+		Use:   "disable",
+		Short: "Disable MFA for local embedded IdP users",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			return openers.Resources(cmd, func(ctx context.Context, resources Resources) error {
+				return runSetMFAEnabled(ctx, resources, cmd.OutOrStdout(), false)
+			})
+		},
+	}
+
+	statusCmd := &cobra.Command{
+		Use:   "status",
+		Short: "Show local MFA status",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			return openers.Resources(cmd, func(ctx context.Context, resources Resources) error {
+				return runMFAStatus(ctx, resources, cmd.OutOrStdout())
+			})
+		},
+	}
+
+	mfaCmd.AddCommand(enableCmd, disableCmd, statusCmd)
+	adminCmd.AddCommand(userCmd, mfaCmd)
+	if openers.Store != nil {
+		adminCmd.AddCommand(tokencmd.NewCommands(tokencmd.StoreOpener(openers.Store)))
+		adminCmd.AddCommand(proxycmd.NewCommands(proxycmd.StoreOpener(openers.Store)))
+	}
+	return adminCmd
+}
+
+// OpenEmbeddedIDPStorage opens the Dex storage configured for the embedded IdP.
+func OpenEmbeddedIDPStorage(cfg *idp.EmbeddedIdPConfig) (storage.Storage, error) {
+	if cfg == nil || !cfg.Enabled {
+		return nil, fmt.Errorf("admin commands require the embedded IdP to be enabled")
+	}
+
+	yamlConfig, err := cfg.ToYAMLConfig()
+	if err != nil {
+		return nil, fmt.Errorf("build embedded IdP config: %w", err)
+	}
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	st, err := yamlConfig.Storage.OpenStorage(logger)
+	if err != nil {
+		return nil, fmt.Errorf("open embedded IdP storage: %w", err)
+	}
+	return st, nil
+}
+
+// CloseStore closes the management store and logs cleanup errors at debug level.
+func CloseStore(ctx context.Context, s store.Store) {
+	if s == nil {
+		return
+	}
+	if err := s.Close(ctx); err != nil {
+		log.Debugf("close store: %v", err)
+	}
+}
+
+// OpenIDPStorage opens embedded IdP storage and returns its sqlite file path when applicable.
+func OpenIDPStorage(config *nbconfig.Config) (storage.Storage, string, error) {
+	if config == nil {
+		return nil, "", fmt.Errorf("management config is required")
+	}
+	idpStorage, err := OpenEmbeddedIDPStorage(config.EmbeddedIdP)
+	if err != nil {
+		return nil, "", err
+	}
+	return idpStorage, embeddedIDPStorageFile(config), nil
+}
+
+func embeddedIDPStorageFile(config *nbconfig.Config) string {
+	if config.EmbeddedIdP == nil || config.EmbeddedIdP.Storage.Type != "sqlite3" {
+		return ""
+	}
+	return config.EmbeddedIdP.Storage.Config.File
+}
+
+// CloseIDPStorage closes embedded IdP storage and logs cleanup errors at debug level.
+func CloseIDPStorage(s storage.Storage) {
+	if s == nil {
+		return
+	}
+	if err := s.Close(); err != nil {
+		log.Debugf("close embedded IdP storage: %v", err)
+	}
+}
+
+func addUserSelectorFlags(cmd *cobra.Command, selector *userSelector) {
+	cmd.Flags().StringVar(&selector.email, "email", "", "User email")
+	cmd.Flags().StringVar(&selector.userID, "user-id", "", "User ID")
+}
+
+func resolvePasswordInput(cmd *cobra.Command, password, passwordFile string) (string, error) {
+	if password != "" && passwordFile != "" {
+		return "", fmt.Errorf("provide only one of --password or --password-file")
+	}
+	if passwordFile == "" {
+		return password, nil
+	}
+
+	var data []byte
+	var err error
+	if passwordFile == "-" {
+		data, err = io.ReadAll(cmd.InOrStdin())
+	} else {
+		data, err = os.ReadFile(passwordFile)
+	}
+	if err != nil {
+		return "", fmt.Errorf("read password: %w", err)
+	}
+	return strings.TrimRight(string(data), "\r\n"), nil
+}
+
+func runChangePassword(ctx context.Context, idpStorage storage.Storage, w io.Writer, selector userSelector, password string, idpStorageFile string) error {
+	if idpStorage == nil {
+		return fmt.Errorf("embedded IdP storage is required")
+	}
+	selector = selector.normalized()
+	if err := selector.validate(); err != nil {
+		return err
+	}
+	if password == "" {
+		return fmt.Errorf("password is required")
+	}
+	if err := server.ValidatePassword(password); err != nil {
+		return fmt.Errorf("invalid password: %w", err)
+	}
+
+	user, err := findLocalUser(ctx, idpStorage, selector, idpStorageFile)
+	if err != nil {
+		return err
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return fmt.Errorf("hash password: %w", err)
+	}
+
+	if err := idpStorage.UpdatePassword(ctx, user.Email, func(old storage.Password) (storage.Password, error) {
+		old.Hash = hash
+		return old, nil
+	}); err != nil {
+		return fmt.Errorf("update password for %s: %w", user.Email, err)
+	}
+
+	if err := deleteLocalAuthSession(ctx, idpStorage, user.UserID); err != nil {
+		return err
+	}
+
+	_, _ = fmt.Fprintf(w, "Password updated for %s.\n", user.Email)
+	return nil
+}
+
+func runResetMFA(ctx context.Context, idpStorage storage.Storage, w io.Writer, selector userSelector, idpStorageFile string) error {
+	if idpStorage == nil {
+		return fmt.Errorf("embedded IdP storage is required")
+	}
+	selector = selector.normalized()
+	if err := selector.validate(); err != nil {
+		return err
+	}
+
+	user, err := findLocalUser(ctx, idpStorage, selector, idpStorageFile)
+	if err != nil {
+		return err
+	}
+
+	reset := false
+	err = idpStorage.UpdateUserIdentity(ctx, user.UserID, idp.LocalConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+		reset = reset || len(old.MFASecrets) > 0 || len(old.WebAuthnCredentials) > 0
+		old.MFASecrets = map[string]*storage.MFASecret{}
+		old.WebAuthnCredentials = map[string][]storage.WebAuthnCredential{}
+		return old, nil
+	})
+	if errors.Is(err, storage.ErrNotFound) {
+		if err := deleteLocalAuthSession(ctx, idpStorage, user.UserID); err != nil {
+			return err
+		}
+		_, _ = fmt.Fprintf(w, "No MFA enrollment found for %s.\n", user.Email)
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("reset MFA for %s: %w", user.Email, err)
+	}
+
+	if err := deleteLocalAuthSession(ctx, idpStorage, user.UserID); err != nil {
+		return err
+	}
+
+	if reset {
+		_, _ = fmt.Fprintf(w, "MFA reset for %s. The user will re-enroll at next login.\n", user.Email)
+	} else {
+		_, _ = fmt.Fprintf(w, "No MFA enrollment found for %s.\n", user.Email)
+	}
+	return nil
+}
+
+func runSetMFAEnabled(ctx context.Context, resources Resources, w io.Writer, enabled bool) error {
+	if resources.Store == nil {
+		return fmt.Errorf("management store is required")
+	}
+	if resources.IDPStorage == nil {
+		return fmt.Errorf("embedded IdP storage is required")
+	}
+
+	accountID, settings, err := getSingleAccountSettings(ctx, resources.Store)
+	if err != nil {
+		return err
+	}
+
+	oldEnabled := settings.LocalMfaEnabled
+	newSettings := settings.Copy()
+	newSettings.LocalMfaEnabled = enabled
+
+	if err := setIDPClientsMFA(ctx, resources.IDPStorage, enabled); err != nil {
+		return err
+	}
+
+	if err := resources.Store.SaveAccountSettings(ctx, accountID, newSettings); err != nil {
+		if rollbackErr := setIDPClientsMFA(ctx, resources.IDPStorage, oldEnabled); rollbackErr != nil {
+			return fmt.Errorf("save local MFA account setting: %w (also failed to roll back embedded IdP MFA state: %v)", err, rollbackErr)
+		}
+		return fmt.Errorf("save local MFA account setting: %w", err)
+	}
+
+	if err := storeMFAActivity(ctx, resources.EventStore, accountID, enabled); err != nil {
+		_, _ = fmt.Fprintf(w, "Warning: failed to record audit event: %v\n", err)
+	}
+
+	state := "disabled"
+	if enabled {
+		state = "enabled"
+	}
+	_, _ = fmt.Fprintf(w, "Local MFA %s.\n", state)
+	return nil
+}
+
+func runMFAStatus(ctx context.Context, resources Resources, w io.Writer) error {
+	if resources.Store == nil {
+		return fmt.Errorf("management store is required")
+	}
+	if resources.IDPStorage == nil {
+		return fmt.Errorf("embedded IdP storage is required")
+	}
+
+	_, settings, err := getSingleAccountSettings(ctx, resources.Store)
+	if err != nil {
+		return err
+	}
+	accountStatus := "disabled"
+	if settings.LocalMfaEnabled {
+		accountStatus = "enabled"
+	}
+
+	clientStatus, err := idpClientsMFAStatus(ctx, resources.IDPStorage)
+	if err != nil {
+		return err
+	}
+
+	_, _ = fmt.Fprintf(w, "Account setting: %s\n", accountStatus)
+	_, _ = fmt.Fprintf(w, "Embedded IdP clients: %s\n", clientStatus)
+	return nil
+}
+
+func getSingleAccountSettings(ctx context.Context, s store.Store) (string, *types.Settings, error) {
+	count, err := s.GetAccountsCounter(ctx)
+	if err != nil {
+		return "", nil, fmt.Errorf("count accounts: %w", err)
+	}
+	if count != 1 {
+		return "", nil, fmt.Errorf("expected exactly one account, got %d; local MFA is supported only in single-account embedded IdP deployments", count)
+	}
+
+	accountID, err := s.GetAnyAccountID(ctx)
+	if err != nil {
+		return "", nil, fmt.Errorf("get account ID: %w", err)
+	}
+
+	settings, err := s.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return "", nil, fmt.Errorf("get account settings: %w", err)
+	}
+	if settings == nil {
+		settings = &types.Settings{}
+	}
+	return accountID, settings, nil
+}
+
+func storeMFAActivity(ctx context.Context, eventStore activity.Store, accountID string, enabled bool) error {
+	if eventStore == nil {
+		return nil
+	}
+	event := activity.AccountLocalMfaDisabled
+	if enabled {
+		event = activity.AccountLocalMfaEnabled
+	}
+	_, err := eventStore.Save(ctx, &activity.Event{
+		Timestamp:   time.Now().UTC(),
+		Activity:    event,
+		InitiatorID: string(hook.SystemSource),
+		TargetID:    accountID,
+		AccountID:   accountID,
+	})
+	if err != nil {
+		return fmt.Errorf("save local MFA audit event: %w", err)
+	}
+	return nil
+}
+
+func findLocalUser(ctx context.Context, idpStorage storage.Storage, selector userSelector, idpStorageFile string) (storage.Password, error) {
+	selector = selector.normalized()
+	if err := selector.validate(); err != nil {
+		return storage.Password{}, err
+	}
+
+	if selector.email != "" {
+		user, err := idpStorage.GetPassword(ctx, selector.email)
+		if errors.Is(err, storage.ErrNotFound) {
+			if empty, listErr := localUsersEmpty(ctx, idpStorage); listErr != nil {
+				return storage.Password{}, listErr
+			} else if empty {
+				return storage.Password{}, noLocalUsersError(idpStorageFile)
+			}
+			return storage.Password{}, fmt.Errorf("local user with email %q not found", selector.email)
+		}
+		if err != nil {
+			return storage.Password{}, fmt.Errorf("get local user by email %q: %w", selector.email, err)
+		}
+		return user, nil
+	}
+
+	rawUserID := selector.userID
+	if decodedUserID, _, err := nbdex.DecodeDexUserID(selector.userID); err == nil && decodedUserID != "" {
+		rawUserID = decodedUserID
+	}
+
+	users, err := idpStorage.ListPasswords(ctx)
+	if err != nil {
+		return storage.Password{}, fmt.Errorf("list local users: %w", err)
+	}
+	for _, user := range users {
+		if user.UserID == rawUserID || user.UserID == selector.userID {
+			return user, nil
+		}
+	}
+
+	if len(users) == 0 {
+		return storage.Password{}, noLocalUsersError(idpStorageFile)
+	}
+
+	return storage.Password{}, fmt.Errorf("local user with ID %q not found", selector.userID)
+}
+
+func localUsersEmpty(ctx context.Context, idpStorage storage.Storage) (bool, error) {
+	users, err := idpStorage.ListPasswords(ctx)
+	if err != nil {
+		return false, fmt.Errorf("list local users: %w", err)
+	}
+	return len(users) == 0, nil
+}
+
+func noLocalUsersError(idpStorageFile string) error {
+	location := ""
+	if idpStorageFile != "" {
+		location = fmt.Sprintf(" (%s)", idpStorageFile)
+	}
+	return fmt.Errorf("no local users exist in the embedded IdP storage%s; the management server may never have started with this config, or --datadir points at the wrong location", location)
+}
+
+func deleteLocalAuthSession(ctx context.Context, idpStorage storage.Storage, userID string) error {
+	err := idpStorage.DeleteAuthSession(ctx, userID, idp.LocalConnectorID)
+	if err == nil || errors.Is(err, storage.ErrNotFound) {
+		return nil
+	}
+	return fmt.Errorf("delete local auth session for user %s: %w", userID, err)
+}
+
+func setIDPClientsMFA(ctx context.Context, idpStorage storage.Storage, enabled bool) error {
+	var mfaChain []string
+	if enabled {
+		mfaChain = []string{idp.DefaultTOTPAuthenticatorID}
+	}
+
+	clientIDs := []string{idp.StaticClientCLI, idp.StaticClientDashboard}
+	if err := nbdex.SetClientsMFAChain(ctx, idpStorage, clientIDs, mfaChain); err != nil {
+		if errors.Is(err, storage.ErrNotFound) {
+			return fmt.Errorf("embedded IdP client not found; start the management server once before toggling MFA: %w", err)
+		}
+		return fmt.Errorf("update MFA chain on embedded IdP clients: %w", err)
+	}
+	return nil
+}
+
+func idpClientsMFAStatus(ctx context.Context, idpStorage storage.Storage) (string, error) {
+	clientIDs := []string{idp.StaticClientCLI, idp.StaticClientDashboard}
+	enabledCount := 0
+	for _, clientID := range clientIDs {
+		client, err := idpStorage.GetClient(ctx, clientID)
+		if errors.Is(err, storage.ErrNotFound) {
+			return "unknown", fmt.Errorf("embedded IdP client %q not found", clientID)
+		}
+		if err != nil {
+			return "unknown", fmt.Errorf("get embedded IdP client %q: %w", clientID, err)
+		}
+		if hasAuthenticator(client.MFAChain, idp.DefaultTOTPAuthenticatorID) {
+			enabledCount++
+		}
+	}
+
+	switch enabledCount {
+	case 0:
+		return "disabled", nil
+	case len(clientIDs):
+		return "enabled", nil
+	default:
+		return "partially enabled", nil
+	}
+}
+
+func hasAuthenticator(chain []string, authenticatorID string) bool {
+	for _, id := range chain {
+		if id == authenticatorID {
+			return true
+		}
+	}
+	return false
+}
diff --git a/management/cmd/admin/admin_test.go b/management/cmd/admin/admin_test.go
new file mode 100644
index 000000000..dd1b8ed06
--- /dev/null
+++ b/management/cmd/admin/admin_test.go
@@ -0,0 +1,250 @@
+package admincmd
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"log/slog"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/bcrypt"
+
+	nbdex "github.com/netbirdio/netbird/idp/dex"
+	"github.com/netbirdio/netbird/management/server/idp"
+	mgmtstore "github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+func newTestIDPStorage(t *testing.T) storage.Storage {
+	t.Helper()
+
+	st := memory.New(slog.New(slog.NewTextHandler(io.Discard, nil)))
+	hash, err := bcrypt.GenerateFromPassword([]byte("OldPass1!"), bcrypt.DefaultCost)
+	require.NoError(t, err)
+
+	require.NoError(t, st.CreatePassword(context.Background(), storage.Password{
+		Email:    "user@example.com",
+		Username: "User",
+		UserID:   "user-1",
+		Hash:     hash,
+	}))
+	require.NoError(t, st.CreateUserIdentity(context.Background(), storage.UserIdentity{
+		UserID:      "user-1",
+		ConnectorID: idp.LocalConnectorID,
+		MFASecrets: map[string]*storage.MFASecret{
+			idp.DefaultTOTPAuthenticatorID: {
+				AuthenticatorID: idp.DefaultTOTPAuthenticatorID,
+				Type:            "TOTP",
+				Secret:          "otpauth://totp/NetBird:user@example.com?secret=ABC",
+				Confirmed:       true,
+				CreatedAt:       time.Now(),
+			},
+		},
+		WebAuthnCredentials: map[string][]storage.WebAuthnCredential{
+			"webauthn": {{CredentialID: []byte("credential")}},
+		},
+	}))
+	require.NoError(t, st.CreateAuthSession(context.Background(), storage.AuthSession{
+		UserID:      "user-1",
+		ConnectorID: idp.LocalConnectorID,
+		Nonce:       "nonce",
+	}))
+	require.NoError(t, st.CreateClient(context.Background(), storage.Client{ID: idp.StaticClientCLI, Name: "CLI"}))
+	require.NoError(t, st.CreateClient(context.Background(), storage.Client{ID: idp.StaticClientDashboard, Name: "Dashboard"}))
+
+	return st
+}
+
+func TestRunChangePassword(t *testing.T) {
+	ctx := context.Background()
+	st := newTestIDPStorage(t)
+	var out bytes.Buffer
+
+	err := runChangePassword(ctx, st, &out, userSelector{email: "user@example.com"}, "NewPass1!", "")
+	require.NoError(t, err)
+	require.Contains(t, out.String(), "Password updated")
+
+	user, err := st.GetPassword(ctx, "user@example.com")
+	require.NoError(t, err)
+	require.NoError(t, bcrypt.CompareHashAndPassword(user.Hash, []byte("NewPass1!")))
+
+	_, err = st.GetAuthSession(ctx, "user-1", idp.LocalConnectorID)
+	require.ErrorIs(t, err, storage.ErrNotFound)
+}
+
+func TestRunChangePasswordValidatesPassword(t *testing.T) {
+	st := newTestIDPStorage(t)
+	err := runChangePassword(context.Background(), st, io.Discard, userSelector{email: "user@example.com"}, "short", "")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "invalid password")
+}
+
+func TestRunResetMFA(t *testing.T) {
+	ctx := context.Background()
+	st := newTestIDPStorage(t)
+	var out bytes.Buffer
+
+	encodedUserID := nbdex.EncodeDexUserID("user-1", idp.LocalConnectorID)
+	err := runResetMFA(ctx, st, &out, userSelector{userID: encodedUserID}, "")
+	require.NoError(t, err)
+	require.Contains(t, out.String(), "MFA reset")
+
+	identity, err := st.GetUserIdentity(ctx, "user-1", idp.LocalConnectorID)
+	require.NoError(t, err)
+	require.Empty(t, identity.MFASecrets)
+	require.Empty(t, identity.WebAuthnCredentials)
+
+	_, err = st.GetAuthSession(ctx, "user-1", idp.LocalConnectorID)
+	require.ErrorIs(t, err, storage.ErrNotFound)
+}
+
+func TestRunResetMFAWithoutEnrollment(t *testing.T) {
+	ctx := context.Background()
+	st := newTestIDPStorage(t)
+	require.NoError(t, st.UpdateUserIdentity(ctx, "user-1", idp.LocalConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+		old.MFASecrets = nil
+		old.WebAuthnCredentials = nil
+		return old, nil
+	}))
+
+	var out bytes.Buffer
+	err := runResetMFA(ctx, st, &out, userSelector{email: "user@example.com"}, "")
+	require.NoError(t, err)
+	require.Contains(t, out.String(), "No MFA enrollment found")
+}
+
+func TestSetIDPClientsMFA(t *testing.T) {
+	ctx := context.Background()
+	st := newTestIDPStorage(t)
+
+	require.NoError(t, setIDPClientsMFA(ctx, st, true))
+	status, err := idpClientsMFAStatus(ctx, st)
+	require.NoError(t, err)
+	require.Equal(t, "enabled", status)
+
+	require.NoError(t, setIDPClientsMFA(ctx, st, false))
+	status, err = idpClientsMFAStatus(ctx, st)
+	require.NoError(t, err)
+	require.Equal(t, "disabled", status)
+}
+
+func newTestManagementStore(t *testing.T, localMFAEnabled bool) mgmtstore.Store {
+	t.Helper()
+	ctx := context.Background()
+	st, err := mgmtstore.NewStore(ctx, types.SqliteStoreEngine, t.TempDir(), nil, false)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, st.Close(ctx)) })
+	require.NoError(t, st.SaveAccount(ctx, &types.Account{
+		Id:       "account-1",
+		Settings: &types.Settings{LocalMfaEnabled: localMFAEnabled},
+	}))
+	return st
+}
+
+func TestRunSetMFAEnabledDoesNotSaveWhenIDPUpdateFails(t *testing.T) {
+	ctx := context.Background()
+	managementStore := newTestManagementStore(t, false)
+	idpStorage := memory.New(slog.New(slog.NewTextHandler(io.Discard, nil)))
+
+	err := runSetMFAEnabled(ctx, Resources{Store: managementStore, IDPStorage: idpStorage}, io.Discard, true)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "embedded IdP client")
+
+	settings, err := managementStore.GetAccountSettings(ctx, mgmtstore.LockingStrengthNone, "account-1")
+	require.NoError(t, err)
+	require.False(t, settings.LocalMfaEnabled)
+}
+
+func TestRunSetMFAEnabledUpdatesSettingsAfterIDP(t *testing.T) {
+	ctx := context.Background()
+	managementStore := newTestManagementStore(t, false)
+	idpStorage := newTestIDPStorage(t)
+
+	err := runSetMFAEnabled(ctx, Resources{Store: managementStore, IDPStorage: idpStorage}, io.Discard, true)
+	require.NoError(t, err)
+
+	settings, err := managementStore.GetAccountSettings(ctx, mgmtstore.LockingStrengthNone, "account-1")
+	require.NoError(t, err)
+	require.True(t, settings.LocalMfaEnabled)
+	clientStatus, err := idpClientsMFAStatus(ctx, idpStorage)
+	require.NoError(t, err)
+	require.Equal(t, "enabled", clientStatus)
+}
+
+func TestRunSetMFAEnabledSucceedsWithNilEventStore(t *testing.T) {
+	ctx := context.Background()
+	managementStore := newTestManagementStore(t, false)
+	idpStorage := newTestIDPStorage(t)
+	var out bytes.Buffer
+	var err error
+
+	require.NotPanics(t, func() {
+		err = runSetMFAEnabled(ctx, Resources{Store: managementStore, IDPStorage: idpStorage, EventStore: nil}, &out, true)
+	})
+	require.NoError(t, err)
+	require.Contains(t, out.String(), "Local MFA enabled")
+
+	settings, err := managementStore.GetAccountSettings(ctx, mgmtstore.LockingStrengthNone, "account-1")
+	require.NoError(t, err)
+	require.True(t, settings.LocalMfaEnabled)
+}
+
+func TestUserSelectorValidate(t *testing.T) {
+	require.NoError(t, userSelector{email: " user@example.com "}.validate())
+	require.NoError(t, userSelector{userID: "user-1"}.validate())
+	require.Error(t, userSelector{}.validate())
+	require.Error(t, userSelector{email: "user@example.com", userID: "user-1"}.validate())
+}
+
+func TestFindLocalUserNotFound(t *testing.T) {
+	st := newTestIDPStorage(t)
+	_, err := findLocalUser(context.Background(), st, userSelector{email: "missing@example.com"}, "")
+	require.Error(t, err)
+	require.True(t, strings.Contains(err.Error(), "not found"))
+}
+
+func TestFindLocalUserZeroUsersIncludesStoragePath(t *testing.T) {
+	st := memory.New(slog.New(slog.NewTextHandler(io.Discard, nil)))
+	_, err := findLocalUser(context.Background(), st, userSelector{email: "missing@example.com"}, "/var/lib/netbird/idp.db")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "no local users exist")
+	require.Contains(t, err.Error(), "/var/lib/netbird/idp.db")
+}
+
+func TestUserCommandValidatesSelectorBeforeOpeningStorage(t *testing.T) {
+	opened := false
+	cmd := NewCommands(Openers{
+		IDP: func(cmd *cobra.Command, fn func(ctx context.Context, idpStorage storage.Storage, storageFile string) error) error {
+			opened = true
+			return nil
+		},
+	})
+	cmd.SetArgs([]string{"user", "change-password", "--password", "NewPass1!"})
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "provide exactly one")
+	require.False(t, opened)
+}
+
+func TestResolvePasswordInputFromStdin(t *testing.T) {
+	cmd := &cobra.Command{}
+	cmd.SetIn(strings.NewReader("NewPass1!\n"))
+
+	password, err := resolvePasswordInput(cmd, "", "-")
+	require.NoError(t, err)
+	require.Equal(t, "NewPass1!", password)
+}
+
+func TestResolvePasswordInputRejectsMultipleSources(t *testing.T) {
+	_, err := resolvePasswordInput(&cobra.Command{}, "NewPass1!", "-")
+	require.Error(t, err)
+}
diff --git a/management/cmd/admin_config_test.go b/management/cmd/admin_config_test.go
new file mode 100644
index 000000000..6da8580a8
--- /dev/null
+++ b/management/cmd/admin_config_test.go
@@ -0,0 +1,80 @@
+package cmd
+
+import (
+	"context"
+	"path"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	"github.com/netbirdio/netbird/management/server/idp"
+)
+
+func TestApplyAdminDatadirOverrideRelocatesDefaultIDPStorage(t *testing.T) {
+	oldDatadir := filepath.Join(t.TempDir(), "old")
+	newDatadir := filepath.Join(t.TempDir(), "new")
+
+	for _, defaultFile := range []string{
+		"",
+		filepath.Join(oldDatadir, "idp.db"),
+		path.Join(oldDatadir, "idp.db"),
+	} {
+		t.Run(defaultFile, func(t *testing.T) {
+			cfg := &nbconfig.Config{
+				EmbeddedIdP: &idp.EmbeddedIdPConfig{
+					Enabled: true,
+					Storage: idp.EmbeddedStorageConfig{
+						Type: "sqlite3",
+						Config: idp.EmbeddedStorageTypeConfig{
+							File: defaultFile,
+						},
+					},
+				},
+			}
+			datadir := oldDatadir
+			oldAdminDatadir := adminDatadir
+			adminDatadir = newDatadir
+			t.Cleanup(func() { adminDatadir = oldAdminDatadir })
+
+			applyAdminDatadirOverride(cfg, &datadir)
+
+			require.Equal(t, newDatadir, datadir)
+			require.Equal(t, filepath.Join(newDatadir, "idp.db"), cfg.EmbeddedIdP.Storage.Config.File)
+		})
+	}
+}
+
+func TestOpenAdminEventStoreMissingEncryptionKeyReturnsNilInterface(t *testing.T) {
+	eventStore, err := openAdminEventStore(context.Background(), &nbconfig.Config{}, t.TempDir())
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "encryption key")
+	require.Nil(t, eventStore)
+}
+
+func TestApplyAdminDatadirOverrideKeepsExplicitIDPStorage(t *testing.T) {
+	oldDatadir := filepath.Join(t.TempDir(), "old")
+	newDatadir := filepath.Join(t.TempDir(), "new")
+	explicitFile := filepath.Join(t.TempDir(), "custom-idp.db")
+	cfg := &nbconfig.Config{
+		EmbeddedIdP: &idp.EmbeddedIdPConfig{
+			Enabled: true,
+			Storage: idp.EmbeddedStorageConfig{
+				Type: "sqlite3",
+				Config: idp.EmbeddedStorageTypeConfig{
+					File: explicitFile,
+				},
+			},
+		},
+	}
+	datadir := oldDatadir
+	oldAdminDatadir := adminDatadir
+	adminDatadir = newDatadir
+	t.Cleanup(func() { adminDatadir = oldAdminDatadir })
+
+	applyAdminDatadirOverride(cfg, &datadir)
+
+	require.Equal(t, newDatadir, datadir)
+	require.Equal(t, explicitFile, cfg.EmbeddedIdP.Storage.Config.File)
+}
diff --git a/management/cmd/management.go b/management/cmd/management.go
index 27d8055e7..8723d309e 100644
--- a/management/cmd/management.go
+++ b/management/cmd/management.go
@@ -13,6 +13,7 @@ import (
 	"os"
 	"os/signal"
 	"path"
+	"path/filepath"
 	"strings"
 	"syscall"
 
@@ -22,9 +23,11 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 
 	"github.com/netbirdio/netbird/formatter/hook"
+	agentnetworkpricing "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	"github.com/netbirdio/netbird/management/internals/server"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/grpc"
 	"github.com/netbirdio/netbird/util"
 	"github.com/netbirdio/netbird/util/crypt"
 )
@@ -110,6 +113,29 @@ var (
 				mgmtSingleAccModeDomain = ""
 			}
 
+			// Load the management-side LLM pricing defaults file: an
+			// explicitly configured path is required to load (a typo must
+			// fail startup — the operator believes those rates are live);
+			// otherwise <datadir>/defaults_llm_pricing.yaml is probed and
+			// may be absent (compiled-in defaults serve). A relative path
+			// is resolved against the datadir so a bare filename lands
+			// alongside the store. Either way the path stays watched: the
+			// reloader picks up edits — and the file appearing later —
+			// without a restart.
+			pricingPath := config.AgentNetwork.PricingDefaultsFile
+			pricingRequired := pricingPath != ""
+			if !pricingRequired {
+				pricingPath = agentnetworkpricing.DefaultFileName
+			}
+			if !filepath.IsAbs(pricingPath) {
+				pricingPath = filepath.Join(config.Datadir, pricingPath)
+			}
+			log.Infof("loading agent-network pricing defaults from %s (required: %v)", pricingPath, pricingRequired)
+			if err := agentnetworkpricing.LoadFile(pricingPath, pricingRequired); err != nil {
+				return fmt.Errorf("load agent-network pricing defaults: %v", err)
+			}
+			agentnetworkpricing.StartReloader(ctx, agentnetworkpricing.ReloadInterval)
+
 			srv := newServer(&server.Config{
 				NbConfig:                    config,
 				DNSDomain:                   dnsDomain,
@@ -117,6 +143,7 @@ var (
 				MgmtPort:                    mgmtPort,
 				MgmtMetricsPort:             mgmtMetricsPort,
 				DisableLegacyManagementPort: disableLegacyManagementPort,
+				LetsEncryptListenAddress:    mgmtLetsencryptListen,
 				DisableMetrics:              disableMetrics,
 				DisableGeoliteUpdate:        disableGeoliteUpdate,
 				UserDeleteFromIDPEnabled:    userDeleteFromIDPEnabled,
@@ -153,8 +180,20 @@ func LoadMgmtConfig(ctx context.Context, mgmtConfigPath string) (*nbconfig.Confi
 
 	ApplyCommandLineOverrides(loadedConfig)
 
+	err := grpc.ValidateSyncMessageVersion(loadedConfig.HighestSupportedSyncMessageVersion)
+	if err != nil {
+		return nil, err
+	}
+
+	for account, version := range loadedConfig.PerAccountHighestSupportedSyncMessageVersion {
+		err := grpc.ValidateSyncMessageVersion(&version)
+		if err != nil {
+			return nil, fmt.Errorf("unrecognized sync message version for account %s, %w", account, err)
+		}
+	}
+
 	// Apply EmbeddedIdP config to HttpConfig if embedded IdP is enabled
-	err := ApplyEmbeddedIdPConfig(ctx, loadedConfig)
+	err = ApplyEmbeddedIdPConfig(ctx, loadedConfig)
 	if err != nil {
 		return nil, err
 	}
@@ -175,17 +214,27 @@ func LoadMgmtConfig(ctx context.Context, mgmtConfigPath string) (*nbconfig.Confi
 // ApplyCommandLineOverrides applies command-line flag overrides to the config
 func ApplyCommandLineOverrides(cfg *nbconfig.Config) {
 	if mgmtLetsencryptDomain != "" {
-		cfg.HttpConfig.LetsEncryptDomain = mgmtLetsencryptDomain
+		ensureHttpConfig(cfg).LetsEncryptDomain = mgmtLetsencryptDomain
 	}
 	if mgmtDataDir != "" {
 		cfg.Datadir = mgmtDataDir
 	}
 	if certKey != "" && certFile != "" {
-		cfg.HttpConfig.CertFile = certFile
-		cfg.HttpConfig.CertKey = certKey
+		httpConfig := ensureHttpConfig(cfg)
+		httpConfig.CertFile = certFile
+		httpConfig.CertKey = certKey
 	}
 }
 
+// ensureHttpConfig creates the HttpConfig section only when a flag writes to
+// it, since the embedded IdP warns about any HttpConfig it finds.
+func ensureHttpConfig(cfg *nbconfig.Config) *nbconfig.HttpServerConfig {
+	if cfg.HttpConfig == nil {
+		cfg.HttpConfig = &nbconfig.HttpServerConfig{}
+	}
+	return cfg.HttpConfig
+}
+
 // ApplyEmbeddedIdPConfig populates HttpConfig and EmbeddedIdP storage from config when embedded IdP is enabled.
 // This allows users to only specify EmbeddedIdP config without duplicating values in HttpConfig.
 func ApplyEmbeddedIdPConfig(ctx context.Context, cfg *nbconfig.Config) error {
@@ -198,6 +247,9 @@ func ApplyEmbeddedIdPConfig(ctx context.Context, cfg *nbconfig.Config) error {
 		// Embedded IdP requires single account mode - multiple account mode is not supported
 		return fmt.Errorf("embedded IdP requires single account mode; multiple account mode is not supported with embedded IdP. Please remove --disable-single-account-mode flag")
 	}
+	if mgmtSingleAccModeDomain == "" {
+		return fmt.Errorf("embedded IdP requires single account mode; --single-account-mode-domain must not be empty")
+	}
 	// Enable user deletion from IDP by default if EmbeddedIdP is enabled
 	userDeleteFromIDPEnabled = true
 
@@ -209,7 +261,7 @@ func ApplyEmbeddedIdPConfig(ctx context.Context, cfg *nbconfig.Config) error {
 		cfg.EmbeddedIdP.Storage.Type = "sqlite3"
 	}
 	if cfg.EmbeddedIdP.Storage.Config.File == "" && cfg.Datadir != "" {
-		cfg.EmbeddedIdP.Storage.Config.File = path.Join(cfg.Datadir, "idp.db")
+		cfg.EmbeddedIdP.Storage.Config.File = filepath.Join(cfg.Datadir, "idp.db")
 	}
 
 	issuer := cfg.EmbeddedIdP.Issuer
@@ -322,6 +374,9 @@ func LogConfigInfo(cfg *nbconfig.Config) {
 	if cfg.Relay != nil {
 		log.Infof("Relay addresses: %v", cfg.Relay.Addresses)
 	}
+	if cfg.Signal != nil {
+		log.Infof("Signal addresses: %v", cfg.Signal.URI)
+	}
 }
 
 // EnsureEncryptionKey generates and saves a DataStoreEncryptionKey if not set
diff --git a/management/cmd/management_test.go b/management/cmd/management_test.go
index f0c89dd3f..bf386e4ba 100644
--- a/management/cmd/management_test.go
+++ b/management/cmd/management_test.go
@@ -4,6 +4,13 @@ import (
 	"context"
 	"os"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	"github.com/netbirdio/netbird/management/server/idp"
+	"github.com/netbirdio/netbird/shared/management/grpc"
 )
 
 const (
@@ -20,34 +27,114 @@ const (
 		"AuthAudience": "https://stageapp/",
 		"AuthIssuer": "https://something.eu.auth0.com/",
 		"OIDCConfigEndpoint": "https://something.eu.auth0.com/.well-known/openid-configuration"
+	  },
+	  "HighestSupportedSyncMessageVersion": 1,
+	  "PerAccountHighestSupportedSyncMessageVersion": {
+	    "1": 0,
+		"2": 1
 	  }
 	}`
 )
 
-func Test_loadMgmtConfig(t *testing.T) {
-	tmpFile, err := createConfig()
-	if err != nil {
-		t.Fatalf("failed to create config: %s", err)
-	}
+func Test_LoadMgmtConfig(t *testing.T) {
+	tmpFile, err := createConfig(exampleConfig)
+	assert.NoError(t, err)
 
 	cfg, err := LoadMgmtConfig(context.Background(), tmpFile)
-	if err != nil {
-		t.Fatalf("failed to load management config: %s", err)
-	}
-	if cfg.Relay == nil {
-		t.Fatalf("config is nil")
-	}
-	if len(cfg.Relay.Addresses) == 0 {
-		t.Fatalf("relay address is empty")
-	}
+	assert.NoError(t, err)
+	assert.NotEmpty(t, cfg.Relay)
+	assert.NotEmpty(t, cfg.Relay.Addresses)
+	assert.Equal(t, int(grpc.ComponentNetworkMap), *cfg.HighestSupportedSyncMessageVersion)
+	assert.Equal(t, map[string]int{"1": int(grpc.Base), "2": int(grpc.ComponentNetworkMap)}, cfg.PerAccountHighestSupportedSyncMessageVersion)
 }
 
-func createConfig() (string, error) {
+func Test_LoadMgmtConfig_Empty(t *testing.T) {
+	tmpFile, err := createConfig(`{
+		"HttpConfig": {
+			"AuthAudience": "https://stageapp/",
+			"AuthIssuer": "https://something.eu.auth0.com/",
+			"OIDCConfigEndpoint": "https://something.eu.auth0.com/.well-known/openid-configuration"
+		}
+	}`)
+	assert.NoError(t, err)
+
+	cfg, err := LoadMgmtConfig(context.Background(), tmpFile)
+	assert.NoError(t, err)
+	assert.Nil(t, cfg.HighestSupportedSyncMessageVersion)
+	assert.Nil(t, cfg.PerAccountHighestSupportedSyncMessageVersion)
+}
+
+func TestApplyEmbeddedIdPConfigRequiresSingleAccountDomain(t *testing.T) {
+	previousDomain := mgmtSingleAccModeDomain
+	previousDisabled := disableSingleAccMode
+	t.Cleanup(func() {
+		mgmtSingleAccModeDomain = previousDomain
+		disableSingleAccMode = previousDisabled
+	})
+
+	mgmtSingleAccModeDomain = ""
+	disableSingleAccMode = false
+	cfg := &nbconfig.Config{
+		EmbeddedIdP: &idp.EmbeddedIdPConfig{Enabled: true},
+	}
+	require.ErrorContains(t, ApplyEmbeddedIdPConfig(context.Background(), cfg), "embedded IdP requires single account mode")
+}
+
+// A config without an HttpConfig section is valid with the embedded IdP, so the
+// TLS flags must not assume the section exists.
+func TestApplyCommandLineOverridesWithoutHttpConfig(t *testing.T) {
+	previousDomain, previousCertFile, previousCertKey := mgmtLetsencryptDomain, certFile, certKey
+	t.Cleanup(func() {
+		mgmtLetsencryptDomain, certFile, certKey = previousDomain, previousCertFile, previousCertKey
+	})
+
+	tests := []struct {
+		name     string
+		domain   string
+		certFile string
+		certKey  string
+		want     nbconfig.HttpServerConfig
+	}{
+		{
+			name:   "letsencrypt domain",
+			domain: "mgmt.example.com",
+			want:   nbconfig.HttpServerConfig{LetsEncryptDomain: "mgmt.example.com"},
+		},
+		{
+			name:     "certificate files",
+			certFile: "/etc/netbird/tls/tls.crt",
+			certKey:  "/etc/netbird/tls/tls.key",
+			want:     nbconfig.HttpServerConfig{CertFile: "/etc/netbird/tls/tls.crt", CertKey: "/etc/netbird/tls/tls.key"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mgmtLetsencryptDomain, certFile, certKey = tt.domain, tt.certFile, tt.certKey
+			cfg := &nbconfig.Config{}
+
+			ApplyCommandLineOverrides(cfg)
+
+			require.NotNil(t, cfg.HttpConfig, "HttpConfig should be created for the TLS flags")
+			assert.Equal(t, tt.want, *cfg.HttpConfig, "HttpConfig should carry only the flag values")
+		})
+	}
+
+	t.Run("no TLS flags", func(t *testing.T) {
+		mgmtLetsencryptDomain, certFile, certKey = "", "", ""
+		cfg := &nbconfig.Config{}
+
+		ApplyCommandLineOverrides(cfg)
+
+		assert.Nil(t, cfg.HttpConfig, "HttpConfig should stay unset so the embedded IdP does not warn about it")
+	})
+}
+
+func createConfig(config string) (string, error) {
 	tmpfile, err := os.CreateTemp("", "config.json")
 	if err != nil {
 		return "", err
 	}
-	_, err = tmpfile.Write([]byte(exampleConfig))
+	_, err = tmpfile.Write([]byte(config))
 	if err != nil {
 		return "", err
 	}
diff --git a/management/cmd/proxy/proxy.go b/management/cmd/proxy/proxy.go
new file mode 100644
index 000000000..1186c8d61
--- /dev/null
+++ b/management/cmd/proxy/proxy.go
@@ -0,0 +1,160 @@
+// Package proxycmd provides reusable cobra commands for managing reverse proxy instances.
+// Both the management and combined binaries use these commands, each providing
+// their own StoreOpener to handle config loading and store initialization.
+package proxycmd
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"strings"
+	"text/tabwriter"
+	"unicode"
+
+	"github.com/spf13/cobra"
+
+	rpproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// StoreOpener initializes a store from the command context and calls fn.
+type StoreOpener func(cmd *cobra.Command, fn func(ctx context.Context, s store.Store) error) error
+
+const disconnectAllConfirmation = "disconnect all proxies"
+
+// NewCommands creates the proxy command tree with the given store opener.
+// Returns the parent "proxy" command with the disconnect-all subcommand.
+func NewCommands(opener StoreOpener) *cobra.Command {
+	var dryRun bool
+	var force bool
+
+	proxyCmd := &cobra.Command{
+		Use:   "proxy",
+		Short: "Manage reverse proxy instances",
+		Long:  "Commands for inspecting and repairing the reverse proxy instances registered with the management server.",
+	}
+
+	disconnectAllCmd := &cobra.Command{
+		Use:   "disconnect-all",
+		Short: "Force-mark all reverse proxy instances as disconnected",
+		Long: "Lists all reverse proxy instances and force-marks them as disconnected, regardless of their session state. " +
+			"Use this to repair stale connection state, e.g. after an unclean management server shutdown. " +
+			"By default, it asks for manual confirmation before changing state. Use --dry-run to preview without changing state, or --force to skip confirmation. " +
+			"Run during a maintenance window; affected live proxies may stay hidden until their next heartbeat or reconnect/re-register.",
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			return opener(cmd, func(ctx context.Context, s store.Store) error {
+				return runDisconnectAll(ctx, s, cmd.OutOrStdout(), cmd.InOrStdin(), dryRun, force)
+			})
+		},
+	}
+	disconnectAllCmd.Flags().BoolVar(&dryRun, "dry-run", false, "List reverse proxy instances that would be disconnected without changing state")
+	disconnectAllCmd.Flags().BoolVar(&force, "force", false, "Skip the confirmation prompt and apply the repair")
+
+	proxyCmd.AddCommand(disconnectAllCmd)
+	return proxyCmd
+}
+
+func runDisconnectAll(ctx context.Context, s store.Store, out io.Writer, in io.Reader, dryRun, force bool) error {
+	proxies, err := s.GetAllProxies(ctx)
+	if err != nil {
+		return fmt.Errorf("list proxies: %w", err)
+	}
+
+	if len(proxies) == 0 {
+		_, _ = fmt.Fprintln(out, "No reverse proxy instances found.")
+		return nil
+	}
+
+	toDisconnect := 0
+	w := tabwriter.NewWriter(out, 0, 0, 2, ' ', 0)
+	_, _ = fmt.Fprintln(w, "ID\tCLUSTER\tIP\tVERSION\tACCOUNT\tSTATUS\tLAST SEEN")
+	_, _ = fmt.Fprintln(w, "--\t-------\t--\t-------\t-------\t------\t---------")
+
+	for _, p := range proxies {
+		if p.Status != rpproxy.StatusDisconnected {
+			toDisconnect++
+		}
+
+		account := "-"
+		if p.AccountID != nil {
+			account = *p.AccountID
+		}
+		version := "-"
+		if p.Version != "" {
+			version = sanitizeReportedValue(p.Version)
+		}
+
+		_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\n",
+			sanitizeReportedValue(p.ID),
+			p.ClusterAddress,
+			p.IPAddress,
+			version,
+			account,
+			p.Status,
+			p.LastSeen.Format("2006-01-02 15:04:05"),
+		)
+	}
+	if err := w.Flush(); err != nil {
+		return fmt.Errorf("write proxy list: %w", err)
+	}
+
+	if dryRun {
+		_, _ = fmt.Fprintf(out, "\nDry run: would force-mark %d of %d reverse proxy instance(s) as disconnected.\n", toDisconnect, len(proxies))
+		return nil
+	}
+
+	if !force {
+		confirmed, err := confirmDisconnectAll(out, in)
+		if err != nil {
+			return err
+		}
+		if !confirmed {
+			_, _ = fmt.Fprintln(out, "Aborted. No reverse proxy instances were changed.")
+			return nil
+		}
+	}
+
+	disconnected, err := s.DisconnectAllProxies(ctx)
+	if err != nil {
+		return fmt.Errorf("disconnect proxies: %w", err)
+	}
+
+	_, _ = fmt.Fprintf(out, "\nForce-marked %d of %d reverse proxy instance(s) as disconnected.\n", disconnected, len(proxies))
+	return nil
+}
+
+func confirmDisconnectAll(out io.Writer, in io.Reader) (bool, error) {
+	if in == nil {
+		in = strings.NewReader("")
+	}
+
+	_, _ = fmt.Fprintln(out, "\nWARNING: This command changes stored reverse proxy state for every non-disconnected instance.")
+	_, _ = fmt.Fprintln(out, "Run it during a maintenance window; affected live proxies may stay hidden until "+
+		"their next heartbeat or reconnect/re-register.")
+	_, _ = fmt.Fprintf(out, "Type %q to continue: ", disconnectAllConfirmation)
+
+	scanner := bufio.NewScanner(in)
+	if !scanner.Scan() {
+		if err := scanner.Err(); err != nil {
+			return false, fmt.Errorf("read confirmation: %w", err)
+		}
+		return false, nil
+	}
+
+	return strings.EqualFold(strings.TrimSpace(scanner.Text()), disconnectAllConfirmation), nil
+}
+
+// sanitizeReportedValue replaces non-printable characters in a value the proxy
+// reports about itself. Both the id and the version arrive unvalidated over
+// gRPC, so a tab would forge a column, a carriage return or ANSI escape would
+// redraw the operator's terminal, and U+202E would reverse the rest of the line.
+func sanitizeReportedValue(s string) string {
+	return strings.Map(func(r rune) rune {
+		if unicode.IsPrint(r) {
+			return r
+		}
+		return '\uFFFD'
+	}, s)
+}
diff --git a/management/cmd/proxy/proxy_test.go b/management/cmd/proxy/proxy_test.go
new file mode 100644
index 000000000..6e3cd0c01
--- /dev/null
+++ b/management/cmd/proxy/proxy_test.go
@@ -0,0 +1,219 @@
+package proxycmd
+
+import (
+	"bytes"
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/require"
+
+	rpproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+func newTestStore(t *testing.T) store.Store {
+	t.Helper()
+
+	s, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	return s
+}
+
+func seedProxies(t *testing.T, ctx context.Context, s store.Store) {
+	t.Helper()
+
+	accountID := "account-1"
+	alreadyDisconnectedAt := time.Now().Add(-time.Hour)
+	seed := []*rpproxy.Proxy{
+		{
+			ID:             "proxy-1",
+			SessionID:      "session-1",
+			ClusterAddress: "cluster-a.example.com",
+			IPAddress:      "10.0.0.1",
+			Version:        "0.60.0",
+			LastSeen:       time.Now(),
+			Status:         rpproxy.StatusConnected,
+		},
+		{
+			ID:             "proxy-2",
+			SessionID:      "session-2",
+			ClusterAddress: "cluster-b.example.com",
+			IPAddress:      "10.0.0.2",
+			AccountID:      &accountID,
+			LastSeen:       time.Now(),
+			Status:         rpproxy.StatusConnected,
+		},
+		{
+			ID:             "proxy-3",
+			SessionID:      "session-3",
+			ClusterAddress: "cluster-a.example.com",
+			IPAddress:      "10.0.0.3",
+			LastSeen:       time.Now().Add(-time.Hour),
+			Status:         rpproxy.StatusDisconnected,
+			DisconnectedAt: &alreadyDisconnectedAt,
+		},
+	}
+	for _, p := range seed {
+		require.NoError(t, s.SaveProxy(ctx, p))
+	}
+}
+
+func proxiesByID(t *testing.T, ctx context.Context, s store.Store) map[string]*rpproxy.Proxy {
+	t.Helper()
+
+	proxies, err := s.GetAllProxies(ctx)
+	require.NoError(t, err)
+	require.Len(t, proxies, 3)
+
+	byID := make(map[string]*rpproxy.Proxy, len(proxies))
+	for _, p := range proxies {
+		byID[p.ID] = p
+	}
+	return byID
+}
+
+func TestRunDisconnectAllWithConfirmation(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+	seedProxies(t, ctx, s)
+
+	var out bytes.Buffer
+	require.NoError(t, runDisconnectAll(ctx, s, &out, strings.NewReader(disconnectAllConfirmation+"\n"), false, false))
+
+	output := out.String()
+	require.Contains(t, output, "proxy-1")
+	require.Contains(t, output, "proxy-2")
+	require.Contains(t, output, "proxy-3")
+	require.Contains(t, output, "cluster-a.example.com")
+	require.Contains(t, output, "0.60.0")
+	require.Contains(t, output, "account-1")
+	require.Contains(t, output, "Type \"disconnect all proxies\" to continue")
+	require.Contains(t, output, "Force-marked 2 of 3 reverse proxy instance(s) as disconnected.")
+
+	for _, p := range proxiesByID(t, ctx, s) {
+		require.Equal(t, rpproxy.StatusDisconnected, p.Status, "proxy %s should be disconnected", p.ID)
+		require.NotNil(t, p.DisconnectedAt, "proxy %s should have a disconnected timestamp", p.ID)
+	}
+}
+
+func TestRunDisconnectAllForceSkipsConfirmation(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+	seedProxies(t, ctx, s)
+
+	var out bytes.Buffer
+	require.NoError(t, runDisconnectAll(ctx, s, &out, strings.NewReader(""), false, true))
+
+	output := out.String()
+	require.NotContains(t, output, "Type \"disconnect all proxies\" to continue")
+	require.Contains(t, output, "Force-marked 2 of 3 reverse proxy instance(s) as disconnected.")
+}
+
+func TestRunDisconnectAllAbortLeavesProxiesUnchanged(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+	seedProxies(t, ctx, s)
+
+	var out bytes.Buffer
+	require.NoError(t, runDisconnectAll(ctx, s, &out, strings.NewReader("no\n"), false, false))
+
+	output := out.String()
+	require.Contains(t, output, "Type \"disconnect all proxies\" to continue")
+	require.Contains(t, output, "Aborted. No reverse proxy instances were changed.")
+
+	byID := proxiesByID(t, ctx, s)
+	require.Equal(t, rpproxy.StatusConnected, byID["proxy-1"].Status)
+	require.Equal(t, rpproxy.StatusConnected, byID["proxy-2"].Status)
+	require.Equal(t, rpproxy.StatusDisconnected, byID["proxy-3"].Status)
+}
+
+func TestRunDisconnectAllDryRunLeavesProxiesUnchanged(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+	seedProxies(t, ctx, s)
+
+	var out bytes.Buffer
+	require.NoError(t, runDisconnectAll(ctx, s, &out, strings.NewReader(""), true, false))
+
+	output := out.String()
+	require.Contains(t, output, "Dry run: would force-mark 2 of 3 reverse proxy instance(s) as disconnected.")
+	require.NotContains(t, output, "Type \"disconnect all proxies\" to continue")
+
+	byID := proxiesByID(t, ctx, s)
+	require.Equal(t, rpproxy.StatusConnected, byID["proxy-1"].Status)
+	require.Equal(t, rpproxy.StatusConnected, byID["proxy-2"].Status)
+	require.Equal(t, rpproxy.StatusDisconnected, byID["proxy-3"].Status)
+}
+
+func TestNewCommandsDisconnectAllDryRun(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+	seedProxies(t, ctx, s)
+
+	opened := false
+	cmd := NewCommands(func(cmd *cobra.Command, fn func(ctx context.Context, s store.Store) error) error {
+		opened = true
+		return fn(cmd.Context(), s)
+	})
+
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	cmd.SetIn(strings.NewReader(""))
+	cmd.SetArgs([]string{"disconnect-all", "--dry-run"})
+
+	require.NoError(t, cmd.ExecuteContext(ctx))
+	require.True(t, opened)
+	require.Contains(t, out.String(), "Dry run: would force-mark 2 of 3 reverse proxy instance(s) as disconnected.")
+}
+
+func TestRunDisconnectAllEmpty(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+
+	var out bytes.Buffer
+	require.NoError(t, runDisconnectAll(ctx, s, &out, strings.NewReader(""), false, false))
+	require.Contains(t, out.String(), "No reverse proxy instances found.")
+}
+
+func TestRunDisconnectAllEscapesProxyReportedFields(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+
+	// A proxy reports its own id and version on connect, so both reach this
+	// listing unvalidated. Carriage returns, tabs and ANSI escapes would let
+	// a malicious proxy redraw the table or forge a row on the operator's
+	// terminal; U+202E would reverse the rendering of the rest of the line.
+	require.NoError(t, s.SaveProxy(ctx, &rpproxy.Proxy{
+		ID:             "proxy-\r\x1b[2Kevil",
+		SessionID:      "session-1",
+		ClusterAddress: "cluster-a.example.com",
+		IPAddress:      "10.0.0.1",
+		Version:        "0.60.0\tfake\rcolumn\u202e",
+		LastSeen:       time.Now(),
+		Status:         rpproxy.StatusConnected,
+	}))
+
+	var out bytes.Buffer
+	require.NoError(t, runDisconnectAll(ctx, s, &out, strings.NewReader(disconnectAllConfirmation+"\n"), true, false))
+
+	output := out.String()
+	for _, forbidden := range []string{"\r", "\x1b", "\u202e"} {
+		require.NotContains(t, output, forbidden, "listing must not carry proxy-reported control characters")
+	}
+	// The table has one data row; a smuggled tab would add a phantom column.
+	var dataRow string
+	for _, line := range strings.Split(output, "\n") {
+		if strings.Contains(line, "evil") {
+			dataRow = line
+		}
+	}
+	require.NotEmpty(t, dataRow, "listing should still show the proxy row")
+	require.NotContains(t, dataRow, "\t", "tabwriter output should not carry a smuggled column separator")
+	require.Contains(t, dataRow, "0.60.0", "the printable part of the version should survive")
+}
diff --git a/management/cmd/root.go b/management/cmd/root.go
index fc43d315d..466ee133f 100644
--- a/management/cmd/root.go
+++ b/management/cmd/root.go
@@ -29,6 +29,7 @@ var (
 	mgmtMetricsPort             int
 	disableLegacyManagementPort bool
 	mgmtLetsencryptDomain       string
+	mgmtLetsencryptListen       string
 	mgmtSingleAccModeDomain     string
 	certFile                    string
 	certKey                     string
@@ -54,6 +55,15 @@ func Execute() error {
 	return rootCmd.Execute()
 }
 
+// Customize hands the fully built root command to fn so an embedding binary
+// can extend or adjust the command tree — most commonly attaching its own
+// subcommands next to (or under) the built-in ones — before calling Execute.
+// The root command is constructed in this package's init, so Customize may be
+// called from the embedding binary's main at any point before Execute.
+func Customize(fn func(root *cobra.Command)) {
+	fn(rootCmd)
+}
+
 func init() {
 	mgmtCmd.Flags().IntVar(&mgmtPort, "port", 80, "server port to listen on (defaults to 443 if TLS is enabled, 80 otherwise")
 	mgmtCmd.Flags().BoolVar(&disableLegacyManagementPort, "disable-legacy-port", false, "disabling the old legacy port (33073)")
@@ -61,6 +71,7 @@ func init() {
 	mgmtCmd.Flags().StringVar(&mgmtDataDir, "datadir", defaultMgmtDataDir, "server data directory location")
 	mgmtCmd.Flags().StringVar(&nbconfig.MgmtConfigPath, "config", defaultMgmtConfig, "Netbird config file location. Config params specified via command line (e.g. datadir) have a precedence over configuration from this file")
 	mgmtCmd.Flags().StringVar(&mgmtLetsencryptDomain, "letsencrypt-domain", "", "a domain to issue Let's Encrypt certificate for. Enables TLS using Let's Encrypt. Will fetch and renew certificate, and run the server with TLS")
+	mgmtCmd.Flags().StringVar(&mgmtLetsencryptListen, "letsencrypt-listen-address", ":443", "address of the separate Let's Encrypt challenge listener, used when --port is not 443. Set it empty when public port 443 is forwarded to --port, which answers the challenges itself")
 	mgmtCmd.Flags().StringVar(&mgmtSingleAccModeDomain, "single-account-mode-domain", defaultSingleAccModeDomain, "Enables single account mode. This means that all the users will be under the same account grouped by the specified domain. If the installation has more than one account, the property is ineffective. Enabled by default with the default domain "+defaultSingleAccModeDomain)
 	mgmtCmd.Flags().BoolVar(&disableSingleAccMode, "disable-single-account-mode", false, "If set to true, disables single account mode. The --single-account-mode-domain property will be ignored and every new user will have a separate NetBird account.")
 	mgmtCmd.Flags().StringVar(&certFile, "cert-file", "", "Location of your SSL certificate. Can be used when you have an existing certificate and don't want a new certificate be generated automatically. If letsencrypt-domain is specified this property has no effect")
@@ -83,7 +94,8 @@ func init() {
 
 	rootCmd.AddCommand(migrationCmd)
 
-	tc := newTokenCommands()
-	tc.PersistentFlags().StringVar(&nbconfig.MgmtConfigPath, "config", defaultMgmtConfig, "Netbird config file location")
-	rootCmd.AddCommand(tc)
+	ac := newAdminCommands()
+	ac.PersistentFlags().StringVar(&nbconfig.MgmtConfigPath, "config", defaultMgmtConfig, "Netbird config file location")
+	rootCmd.AddCommand(ac)
+	rootCmd.AddCommand(newLegacyTokenCommand())
 }
diff --git a/management/cmd/root_test.go b/management/cmd/root_test.go
new file mode 100644
index 000000000..826fd2d50
--- /dev/null
+++ b/management/cmd/root_test.go
@@ -0,0 +1,42 @@
+package cmd
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+// TestCustomize verifies an embedding binary can extend the command tree: a
+// top-level command attached through the hook, and a subcommand attached under
+// the built-in admin group, are both resolvable exactly as Execute would
+// resolve them.
+func TestCustomize(t *testing.T) {
+	topLevel := &cobra.Command{Use: "some-extra", RunE: func(*cobra.Command, []string) error { return nil }}
+	nested := &cobra.Command{Use: "cluster", RunE: func(*cobra.Command, []string) error { return nil }}
+
+	Customize(func(root *cobra.Command) {
+		root.AddCommand(topLevel)
+		for _, c := range root.Commands() {
+			if c.Name() == "admin" {
+				c.AddCommand(nested)
+				return
+			}
+		}
+		t.Fatal("admin command not found in the root tree")
+	})
+	t.Cleanup(func() {
+		rootCmd.RemoveCommand(topLevel)
+		for _, c := range rootCmd.Commands() {
+			if c.Name() == "admin" {
+				c.RemoveCommand(nested)
+			}
+		}
+	})
+
+	if found, _, err := rootCmd.Find([]string{"some-extra"}); err != nil || found != topLevel {
+		t.Fatalf("top-level command not resolvable: found=%v err=%v", found, err)
+	}
+	if found, _, err := rootCmd.Find([]string{"admin", "cluster"}); err != nil || found != nested {
+		t.Fatalf("nested admin subcommand not resolvable: found=%v err=%v", found, err)
+	}
+}
diff --git a/management/cmd/token.go b/management/cmd/token.go
deleted file mode 100644
index 67af1a5f5..000000000
--- a/management/cmd/token.go
+++ /dev/null
@@ -1,55 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-
-	"github.com/netbirdio/netbird/formatter/hook"
-	tokencmd "github.com/netbirdio/netbird/management/cmd/token"
-	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/util"
-)
-
-var tokenDatadir string
-
-// newTokenCommands creates the token command tree with management-specific store opener.
-func newTokenCommands() *cobra.Command {
-	cmd := tokencmd.NewCommands(withTokenStore)
-	cmd.PersistentFlags().StringVar(&tokenDatadir, "datadir", "", "Override the data directory from config (where store.db is located)")
-	return cmd
-}
-
-// withTokenStore initializes logging, loads config, opens the store, and calls fn.
-func withTokenStore(cmd *cobra.Command, fn func(ctx context.Context, s store.Store) error) error {
-	if err := util.InitLog("error", "console"); err != nil {
-		return fmt.Errorf("init log: %w", err)
-	}
-
-	ctx := context.WithValue(cmd.Context(), hook.ExecutionContextKey, hook.SystemSource) //nolint:staticcheck
-
-	config, err := LoadMgmtConfig(ctx, nbconfig.MgmtConfigPath)
-	if err != nil {
-		return fmt.Errorf("load config: %w", err)
-	}
-
-	datadir := config.Datadir
-	if tokenDatadir != "" {
-		datadir = tokenDatadir
-	}
-
-	s, err := store.NewStore(ctx, config.StoreConfig.Engine, datadir, nil, true)
-	if err != nil {
-		return fmt.Errorf("create store: %w", err)
-	}
-	defer func() {
-		if err := s.Close(ctx); err != nil {
-			log.Debugf("close store: %v", err)
-		}
-	}()
-
-	return fn(ctx, s)
-}
diff --git a/management/internals/controllers/network_map/controller/controller.go b/management/internals/controllers/network_map/controller/controller.go
index f1b1832d2..9b8471c1b 100644
--- a/management/internals/controllers/network_map/controller/controller.go
+++ b/management/internals/controllers/network_map/controller/controller.go
@@ -18,23 +18,29 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
 	"github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/internals/shared/requestbuffer"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/types"
+	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
 	"github.com/netbirdio/netbird/util"
 	"github.com/netbirdio/netbird/version"
 )
 
+const defaultNetworkMapDataBufferInterval = 100 * time.Millisecond
+
 type Controller struct {
 	repo    Repository
 	metrics *metrics
@@ -53,9 +59,14 @@ type Controller struct {
 
 	requestBuffer account.RequestBuffer
 
-	proxyController port_forwarding.Controller
-
 	integratedPeerValidator integrated_validator.IntegratedValidator
+
+	serverSupportedSyncMessageVersion sharedgrpc.SyncMessageVersion
+
+	perAccountServerSupportedSyncMessageVersions map[string]sharedgrpc.SyncMessageVersion
+
+	nmdataStore  *networkmapdb.NetworkMapDBStoreImpl
+	nmdataBuffer *requestbuffer.Buffer[*networkmap.NetworkMapData]
 }
 
 type bufferUpdate struct {
@@ -73,13 +84,13 @@ type bufferAffectedUpdate struct {
 
 var _ network_map.Controller = (*Controller)(nil)
 
-func NewController(ctx context.Context, store store.Store, metrics telemetry.AppMetrics, peersUpdateManager network_map.PeersUpdateManager, requestBuffer account.RequestBuffer, integratedPeerValidator integrated_validator.IntegratedValidator, settingsManager settings.Manager, dnsDomain string, proxyController port_forwarding.Controller, ephemeralPeersManager ephemeral.Manager, config *config.Config) *Controller {
+func NewController(ctx context.Context, store store.Store, metrics telemetry.AppMetrics, peersUpdateManager network_map.PeersUpdateManager, requestBuffer account.RequestBuffer, integratedPeerValidator integrated_validator.IntegratedValidator, settingsManager settings.Manager, dnsDomain string, ephemeralPeersManager ephemeral.Manager, config *config.Config, nmdataStore *networkmapdb.NetworkMapDBStoreImpl) *Controller {
 	nMetrics, err := newMetrics(metrics.UpdateChannelMetrics())
 	if err != nil {
 		log.Fatal(fmt.Errorf("error creating metrics: %w", err))
 	}
 
-	return &Controller{
+	c := &Controller{
 		repo:                    newRepository(store),
 		metrics:                 nMetrics,
 		accountManagerMetrics:   metrics.AccountManagerMetrics(),
@@ -90,9 +101,19 @@ func NewController(ctx context.Context, store store.Store, metrics telemetry.App
 		dnsDomain:               dnsDomain,
 		config:                  config,
 
-		proxyController:       proxyController,
-		EphemeralPeersManager: ephemeralPeersManager,
+		EphemeralPeersManager:                        ephemeralPeersManager,
+		serverSupportedSyncMessageVersion:            sharedgrpc.SyncMessageVersionFromConfig(config.HighestSupportedSyncMessageVersion),
+		perAccountServerSupportedSyncMessageVersions: sharedgrpc.SyncMessageVersionsFromMap(config.PerAccountHighestSupportedSyncMessageVersion),
+		nmdataStore: nmdataStore,
 	}
+
+	if nmdataStore != nil {
+		interval := requestbuffer.Interval(ctx, "NB_NETWORK_MAP_DATA_BUFFER_INTERVAL", defaultNetworkMapDataBufferInterval)
+		log.WithContext(ctx).Infof("set network map data request buffer interval to %s", interval)
+		c.nmdataBuffer = requestbuffer.New(ctx, "network map data request buffer", interval, c.fetchNetworkMapData)
+	}
+
+	return c
 }
 
 func (c *Controller) OnPeerConnected(ctx context.Context, accountID string, peerID string) (chan *network_map.UpdateMessage, error) {
@@ -106,24 +127,30 @@ func (c *Controller) OnPeerConnected(ctx context.Context, accountID string, peer
 	return c.peersUpdateManager.CreateChannel(ctx, peerID), nil
 }
 
-func (c *Controller) OnPeerDisconnected(ctx context.Context, accountID string, peerID string) {
-	c.peersUpdateManager.CloseChannel(ctx, peerID)
+// OnPeerDisconnected closes the session's updates channel and schedules an ephemeral peer for
+// cleanup. It returns false without touching anything when a newer session owns the peer. A nil
+// session closes any registered channel.
+func (c *Controller) OnPeerDisconnected(ctx context.Context, accountID string, peerID string, session chan *network_map.UpdateMessage) bool {
+	if !c.peersUpdateManager.CloseSessionChannel(ctx, peerID, session) {
+		return false
+	}
 	peer, err := c.repo.GetPeerByID(ctx, accountID, peerID)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get peer %s: %v", peerID, err)
-		return
+		return true
 	}
 	c.EphemeralPeersManager.OnPeerDisconnected(ctx, peer)
+	return true
 }
 
 // injectAllProxyPolicies prepares an account for the per-peer network-map
 // computation. It prepends the in-memory agent-network services synthesised
-// from the account's current provider/policy state to account.Services so
-// the existing InjectProxyPolicies + injectPrivateServicePolicies walks pick
-// them up alongside persisted reverse-proxy services. Synthesised services
-// are never persisted; the account is loaded fresh per cycle so re-prepending
-// is safe and idempotent. Accounts without agent-network providers get an
-// empty synth slice — no behaviour change.
+// from the account's current provider/policy state to account.Services, so the
+// twin store built from the account carries them alongside the persisted
+// reverse-proxy services and synthesises their ACLs. Synthesised services are
+// never persisted; the account is loaded fresh per cycle so re-prepending is
+// safe and idempotent. Accounts without agent-network providers get an empty
+// synth slice — no behaviour change.
 func (c *Controller) injectAllProxyPolicies(ctx context.Context, account *types.Account) {
 	synth, err := c.repo.SynthesizeAgentNetworkServices(ctx, account.Id)
 	if err != nil {
@@ -131,7 +158,26 @@ func (c *Controller) injectAllProxyPolicies(ctx context.Context, account *types.
 	} else if len(synth) > 0 {
 		account.Services = append(synth, account.Services...)
 	}
-	account.InjectProxyPolicies(ctx)
+}
+
+// proxyServicesFromRepo is the store-path counterpart of
+// injectAllProxyPolicies: the network-map store reads the policies table, which
+// never holds the proxy ACLs, so the twin gets the services they are
+// synthesised from — the synthesised agent-network ones first, exactly as the
+// account path orders them.
+func (c *Controller) proxyServicesFromRepo(ctx context.Context, accountID string) []*nmdata.Service {
+	persisted, err := c.repo.GetAccountServices(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to get services for account %s: %v", accountID, err)
+		return nil
+	}
+
+	synth, err := c.repo.SynthesizeAgentNetworkServices(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Warnf("synthesise agent-network services for account %s: %v", accountID, err)
+	}
+
+	return types.TwinServices(append(synth, persisted...))
 }
 
 func (c *Controller) CountStreams() int {
@@ -140,6 +186,11 @@ func (c *Controller) CountStreams() int {
 
 func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) error {
 	log.WithContext(ctx).Tracef("updating peers for account %s from %s", accountID, util.GetCallerName())
+
+	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
+		return c.sendUpdateAccountPeersFromData(ctx, accountID, reason, nmData)
+	}
+
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get account: %v", err)
@@ -160,7 +211,7 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 		return nil
 	}
 
-	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
 	if err != nil {
 		return fmt.Errorf("failed to get validate peers: %v", err)
 	}
@@ -169,6 +220,7 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	semaphore := make(chan struct{}, 10)
 
 	c.injectAllProxyPolicies(ctx, account)
+	account.PrecomputePostureValidation(ctx)
 	dnsCache := &cache.DNSConfigCache{}
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
@@ -176,12 +228,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMapsAll(ctx, accountID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return fmt.Errorf("failed to get proxy network maps: %v", err)
-	}
-
 	extraSetting, err := c.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get flow enabled status: %v", err)
@@ -222,18 +268,45 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 			c.metrics.CountCalcPostureChecksDuration(time.Since(start))
 			start = time.Now()
 
-			remotePeerNetworkMap := account.GetPeerNetworkMapFromComponents(ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
+			peerGroups := account.GetPeerGroups(p.ID)
+			var update *proto.SyncResponse
+
+			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
+				c.perAccountOrGlobalSupportedSyncMessageVersions(accountID),
+				sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion))
+
+			log.WithContext(ctx).
+				WithFields(log.Fields{
+					"sync_message_version":        commonSyncMessageVersion,
+					"server_sync_message_version": c.perAccountOrGlobalSupportedSyncMessageVersions(peer.AccountID),
+					"peer_sync_message_version":   sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion),
+				}).Debug("common highest sync message version")
+
+			if commonSyncMessageVersion == sharedgrpc.ComponentNetworkMap {
+				components := account.GetPeerNetworkMapComponents(
+					ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
+
+				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
+
+				start = time.Now()
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
+
+				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
+					Update:      update,
+					MessageType: network_map.MessageTypeNetworkMap,
+				})
+
+				return
+			}
+
+			nmap := account.GetPeerNetworkMapFromComponents(
+				ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
 			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
-			proxyNetworkMap, ok := proxyNetworkMaps[p.ID]
-			if ok {
-				remotePeerNetworkMap.Merge(proxyNetworkMap)
-			}
-
-			peerGroups := account.GetPeerGroups(p.ID)
 			start = time.Now()
-			update := grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, remotePeerNetworkMap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
 
 			c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -251,6 +324,285 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	return nil
 }
 
+// sendUpdateAccountPeersFromData is the account-free variant of
+// sendUpdateAccountPeers: everything is computed from the network-map DB
+// store's twin data; only extra settings and validated peers are resolved at
+// runtime. Proxy network maps and policy injection, private-service zones,
+// group-to-user SSH mappings and forced routing-peer DNS resolution have no
+// DB-backed source yet and are omitted.
+func (c *Controller) sendUpdateAccountPeersFromData(ctx context.Context, accountID string, reason types.UpdateReason, nmData *networkmap.NetworkMapData) error {
+	peersToUpdate := c.connectedPeersFromData(nmData, nil)
+	if len(peersToUpdate) == 0 {
+		return nil
+	}
+	return c.sendUpdatesFromData(ctx, accountID, nmData, peersToUpdate, &reason)
+}
+
+// sendUpdateForAffectedPeersFromData is the account-free variant of
+// sendUpdateForAffectedPeers.
+func (c *Controller) sendUpdateForAffectedPeersFromData(ctx context.Context, accountID string, peerIDs []string, nmData *networkmap.NetworkMapData) error {
+	if len(peerIDs) == 0 {
+		log.WithContext(ctx).Tracef("sendUpdateForAffectedPeersFromData: no affected peers")
+		return nil
+	}
+
+	peersToUpdate := c.connectedPeersFromData(nmData, peerIDs)
+	if len(peersToUpdate) == 0 {
+		log.WithContext(ctx).Tracef("sendUpdateForAffectedPeersFromData: no peers to update (affected peers not found in data or no channels)")
+		return nil
+	}
+
+	log.WithContext(ctx).Tracef("sendUpdateForAffectedPeersFromData: sending network map to %d connected peers", len(peersToUpdate))
+
+	return c.sendUpdatesFromData(ctx, accountID, nmData, peersToUpdate, nil)
+}
+
+// connectedPeersFromData returns the peers with an open update channel. An
+// empty affected list means all peers; a non-empty list restricts the result
+// to those peer IDs.
+func (c *Controller) connectedPeersFromData(nmData *networkmap.NetworkMapData, affected []string) []*nmdata.Peer {
+	if len(affected) == 0 {
+		result := make([]*nmdata.Peer, 0, len(nmData.Peers))
+		for _, peer := range nmData.Peers {
+			if c.peersUpdateManager.HasChannel(peer.ID) {
+				result = append(result, peer)
+			}
+		}
+		return result
+	}
+
+	result := make([]*nmdata.Peer, 0, len(affected))
+	for _, peerID := range affected {
+		peer := nmData.Peers[peerID]
+		if peer == nil {
+			continue
+		}
+		if c.peersUpdateManager.HasChannel(peerID) {
+			result = append(result, peer)
+		}
+	}
+	return result
+}
+
+func (c *Controller) sendUpdatesFromData(ctx context.Context, accountID string, nmData *networkmap.NetworkMapData, peersToUpdate []*nmdata.Peer, reason *types.UpdateReason) error {
+	globalStart := time.Now()
+
+	extraSettings, err := c.settingsManager.GetExtraSettings(ctx, accountID)
+	if err != nil {
+		return fmt.Errorf("failed to get flow enabled status: %v", err)
+	}
+
+	dnsCache := &cache.DNSConfigCache{}
+	dnsDomain := c.getDNSDomainFromData(nmData.AccountSettings)
+	peersCustomZone := networkmap.PeersCustomZone(ctx, accountID, dnsDomain, nmData.Peers, IPv6AllowedPeersFromData(nmData))
+
+	dnsFwdPort := ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
+
+	var wg sync.WaitGroup
+	semaphore := make(chan struct{}, 10)
+
+	for _, peer := range peersToUpdate {
+		if reason != nil && c.accountManagerMetrics != nil {
+			c.accountManagerMetrics.CountNmapTriggered(string(reason.Resource), string(reason.Operation))
+		}
+
+		wg.Add(1)
+		semaphore <- struct{}{}
+		go func(p *nmdata.Peer) {
+			defer wg.Done()
+			defer func() { <-semaphore }()
+
+			start := time.Now()
+
+			postureChecks := peerPostureChecksFromData(nmData, p.ID)
+
+			c.metrics.CountCalcPostureChecksDuration(time.Since(start))
+			start = time.Now()
+
+			peerGroups := maps.Keys(nmData.GetPeerGroups(p.ID))
+			var update *proto.SyncResponse
+
+			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
+				c.perAccountOrGlobalSupportedSyncMessageVersions(accountID),
+				sharedgrpc.SyncMessageVersionFromConfig(&p.Meta.SyncMessageVersion))
+
+			log.WithContext(ctx).
+				WithFields(log.Fields{
+					"sync_message_version":        commonSyncMessageVersion,
+					"server_sync_message_version": c.perAccountOrGlobalSupportedSyncMessageVersions(accountID),
+					"peer_sync_message_version":   sharedgrpc.SyncMessageVersionFromConfig(&p.Meta.SyncMessageVersion),
+				}).Debug("common highest sync message version")
+
+			if commonSyncMessageVersion == sharedgrpc.ComponentNetworkMap {
+				components := nmData.GetPeerNetworkMapComponents(p.ID, peersCustomZone)
+
+				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
+
+				start = time.Now()
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, dnsDomain, postureChecks, nmData.AccountSettings, extraSettings, peerGroups, dnsFwdPort)
+				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
+
+				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
+					Update:      update,
+					MessageType: network_map.MessageTypeNetworkMap,
+				})
+
+				return
+			}
+
+			nmap := NetworkMapFromData(ctx, nmData, p.ID, peersCustomZone, c.accountManagerMetrics)
+
+			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
+
+			start = time.Now()
+			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, nmap, dnsDomain, postureChecks, dnsCache, nmData.AccountSettings, extraSettings, peerGroups, dnsFwdPort)
+			c.metrics.CountToSyncResponseDuration(time.Since(start))
+
+			c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
+				Update:      update,
+				MessageType: network_map.MessageTypeNetworkMap,
+			})
+		}(peer)
+	}
+
+	wg.Wait()
+	if c.accountManagerMetrics != nil {
+		c.accountManagerMetrics.CountUpdateAccountPeersDuration(time.Since(globalStart))
+	}
+
+	return nil
+}
+
+func (c *Controller) getNetworkMapData(ctx context.Context, accountID string) *networkmap.NetworkMapData {
+	if c.nmdataBuffer == nil {
+		return nil
+	}
+
+	nmData, err := c.nmdataBuffer.Get(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to get network map data for account %s, falling back to account-based computation: %v", accountID, err)
+		return nil
+	}
+
+	return nmData
+}
+
+// fetchNetworkMapData reads the twin once per buffer window. Its result is
+// shared by every waiter of that window, so the mutating steps run here, before
+// it is handed out: the twin the callers see is read-only. Injected proxy
+// policies carry no posture checks, so precomputing after the injection yields
+// the same validation as precomputing before it.
+func (c *Controller) fetchNetworkMapData(ctx context.Context, accountID string) (*networkmap.NetworkMapData, error) {
+	nmData, err := c.nmdataStore.GetNetworkMapData(ctx, accountID)
+	if err != nil {
+		return nil, err
+	}
+
+	nmData.Services = c.proxyServicesFromRepo(ctx, accountID)
+	nmData.BuildPrivateServiceCandidates()
+	nmData.InjectProxyPolicies()
+	nmData.PrecomputePostureValidation()
+
+	return nmData, nil
+}
+
+func (c *Controller) getDNSDomainFromData(settings *nmdata.AccountSettingsInfo) string {
+	if settings == nil || settings.DNSDomain == "" {
+		return c.dnsDomain
+	}
+	return settings.DNSDomain
+}
+
+func IPv6AllowedPeersFromData(nmData *networkmap.NetworkMapData) map[string]struct{} {
+	result := make(map[string]struct{})
+	// An account with no IPv6-enabled group runs no overlay at all, so the
+	// embedded-proxy carve-out below has nothing to reach and stays shut.
+	if nmData.AccountSettings == nil || len(nmData.AccountSettings.IPv6EnabledGroups) == 0 {
+		return result
+	}
+	for _, groupID := range nmData.AccountSettings.IPv6EnabledGroups {
+		group := nmData.Groups[groupID]
+		if group == nil {
+			continue
+		}
+		for _, peerID := range group.Peers {
+			result[peerID] = struct{}{}
+		}
+	}
+	for id, p := range nmData.Peers {
+		if p != nil && p.ProxyMeta.Embedded {
+			result[id] = struct{}{}
+		}
+	}
+	return result
+}
+
+func NetworkMapFromData(ctx context.Context, nmData *networkmap.NetworkMapData, peerID string, peersCustomZone nmdata.CustomZone, metrics *telemetry.AccountManagerMetrics) *types.NetworkMap {
+	start := time.Now()
+
+	components := nmData.GetPeerNetworkMapComponents(peerID, peersCustomZone)
+	if components.IsEmpty() {
+		return &types.NetworkMap{Network: components.Network}
+	}
+	nm := types.CalculateNetworkMapFromComponents(ctx, components)
+
+	if metrics != nil {
+		objectCount := int64(len(nm.Peers) + len(nm.OfflinePeers) + len(nm.Routes) + len(nm.FirewallRules) + len(nm.RoutesFirewallRules))
+		metrics.CountNetworkMapObjects(objectCount)
+		metrics.CountGetPeerNetworkMapDuration(time.Since(start))
+	}
+
+	return nm
+}
+
+// peerPostureChecksFromData mirrors getPeerPostureChecks on the twin store.
+func peerPostureChecksFromData(nmData *networkmap.NetworkMapData, peerID string) []*nmdata.PostureChecks {
+	if len(nmData.PostureChecks) == 0 {
+		return nil
+	}
+
+	peerPostureChecks := make(map[string]*nmdata.PostureChecks)
+	for _, policy := range nmData.Policies {
+		if policy == nil || !policy.Enabled || len(policy.SourcePostureChecks) == 0 {
+			continue
+		}
+		if !isPeerInPolicySourcesFromData(nmData, peerID, policy) {
+			continue
+		}
+		for _, checkID := range policy.SourcePostureChecks {
+			if twin := nmData.PostureChecks[checkID]; twin != nil {
+				peerPostureChecks[checkID] = twin
+			}
+		}
+	}
+
+	return maps.Values(peerPostureChecks)
+}
+
+func isPeerInPolicySourcesFromData(nmData *networkmap.NetworkMapData, peerID string, policy *nmdata.Policy) bool {
+	for _, rule := range policy.Rules {
+		if rule == nil || !rule.Enabled {
+			continue
+		}
+		if rule.SourceResource.Type == string(types.ResourceTypePeer) && rule.SourceResource.ID == peerID {
+			return true
+		}
+		for _, groupID := range rule.Sources {
+			if group := nmData.Groups[groupID]; group != nil && slices.Contains(group.Peers, peerID) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func (c *Controller) perAccountOrGlobalSupportedSyncMessageVersions(accountId string) sharedgrpc.SyncMessageVersion {
+	if perAccount, ok := c.perAccountServerSupportedSyncMessageVersions[accountId]; ok {
+		return perAccount
+	}
+	return c.serverSupportedSyncMessageVersion
+}
+
 // UpdatePeers updates all peers that belong to an account.
 // Should be called when changes have to be synced to peers.
 func (c *Controller) UpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) error {
@@ -276,6 +628,10 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 		return nil
 	}
 
+	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
+		return c.sendUpdateForAffectedPeersFromData(ctx, accountID, peerIDs, nmData)
+	}
+
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get account: %v", err)
@@ -291,7 +647,7 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 
 	log.WithContext(ctx).Tracef("sendUpdateForAffectedPeers: sending network map to %d connected peers", len(peersToUpdate))
 
-	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
 	if err != nil {
 		return fmt.Errorf("failed to get validate peers: %v", err)
 	}
@@ -308,6 +664,7 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 	// network map that omitted the synth DNS zone, and the agent kept
 	// resolving against the stale or absent record.
 	c.injectAllProxyPolicies(ctx, account)
+	account.PrecomputePostureValidation(ctx)
 	dnsCache := &cache.DNSConfigCache{}
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
@@ -315,12 +672,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMapsAll(ctx, accountID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return fmt.Errorf("failed to get proxy network maps: %v", err)
-	}
-
 	extraSetting, err := c.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get flow enabled status: %v", err)
@@ -352,18 +703,45 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 			c.metrics.CountCalcPostureChecksDuration(time.Since(start))
 			start = time.Now()
 
-			remotePeerNetworkMap := account.GetPeerNetworkMapFromComponents(ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
+			peerGroups := account.GetPeerGroups(p.ID)
+			var update *proto.SyncResponse
+
+			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
+				c.perAccountOrGlobalSupportedSyncMessageVersions(accountID),
+				sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion))
+
+			log.WithContext(ctx).
+				WithFields(log.Fields{
+					"sync_message_version":        commonSyncMessageVersion,
+					"server_sync_message_version": c.perAccountOrGlobalSupportedSyncMessageVersions(peer.AccountID),
+					"peer_sync_message_version":   sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion),
+				}).Debug("common highest sync message version")
+
+			if commonSyncMessageVersion == sharedgrpc.ComponentNetworkMap {
+				components := account.GetPeerNetworkMapComponents(
+					ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
+
+				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
+
+				start = time.Now()
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
+
+				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
+					Update:      update,
+					MessageType: network_map.MessageTypeNetworkMap,
+				})
+
+				return
+			}
+
+			nmap := account.GetPeerNetworkMapFromComponents(
+				ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
 			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
-			proxyNetworkMap, ok := proxyNetworkMaps[p.ID]
-			if ok {
-				remotePeerNetworkMap.Merge(proxyNetworkMap)
-			}
-
-			peerGroups := account.GetPeerGroups(p.ID)
 			start = time.Now()
-			update := grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, remotePeerNetworkMap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
 
 			c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -420,7 +798,7 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		return fmt.Errorf("peer %s doesn't exists in account %s", peerId, accountId)
 	}
 
-	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
 	if err != nil {
 		return fmt.Errorf("failed to get validated peers: %v", err)
 	}
@@ -439,25 +817,12 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		return fmt.Errorf("failed to get posture checks for peer %s: %v", peerId, err)
 	}
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peer.ID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return err
-	}
-
 	accountZones, err := c.repo.GetAccountZones(ctx, account.Id)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get account zones: %v", err)
 		return err
 	}
 
-	remotePeerNetworkMap := account.GetPeerNetworkMapFromComponents(ctx, peerId, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
-
-	proxyNetworkMap, ok := proxyNetworkMaps[peer.ID]
-	if ok {
-		remotePeerNetworkMap.Merge(proxyNetworkMap)
-	}
-
 	extraSettings, err := c.settingsManager.GetExtraSettings(ctx, peer.AccountID)
 	if err != nil {
 		return fmt.Errorf("failed to get extra settings: %v", err)
@@ -466,7 +831,38 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 	peerGroups := account.GetPeerGroups(peerId)
 	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
 
-	update := grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, peer, nil, nil, remotePeerNetworkMap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSettings, maps.Keys(peerGroups), dnsFwdPort)
+	var update *proto.SyncResponse
+
+	commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
+		c.perAccountOrGlobalSupportedSyncMessageVersions(accountId),
+		sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion))
+
+	log.WithContext(ctx).
+		WithFields(log.Fields{
+			"sync_message_version":        commonSyncMessageVersion,
+			"server_sync_message_version": c.perAccountOrGlobalSupportedSyncMessageVersions(peer.AccountID),
+			"peer_sync_message_version":   sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion),
+		}).Debug("common highest sync message version")
+
+	if commonSyncMessageVersion == sharedgrpc.ComponentNetworkMap {
+		components := account.GetPeerNetworkMapComponents(
+			ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
+
+		update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort)
+
+		c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
+			Update:      update,
+			MessageType: network_map.MessageTypeNetworkMap,
+		})
+
+		return nil
+	}
+
+	nmap := account.GetPeerNetworkMapFromComponents(
+		ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
+
+	update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort)
+
 	c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
 		Update:      update,
 		MessageType: network_map.MessageTypeNetworkMap,
@@ -513,6 +909,77 @@ func (c *Controller) BufferUpdateAccountPeers(ctx context.Context, accountID str
 	return nil
 }
 
+// GetValidatedPeerWithComponents is the components-format counterpart of
+// GetValidatedPeerWithMap. It returns raw NetworkMapComponents for capable
+// peers, which the gRPC layer encodes into the wire envelope. Callers must
+// gate on capability themselves before dispatching here — this method does
+// NOT branch on it.
+func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, peer *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
+	if isRequiresApproval {
+		network, err := c.repo.GetAccountNetwork(ctx, accountID)
+		if err != nil {
+			return nil, nil, nil, 0, err
+		}
+		return peer, &types.NetworkMapComponents{Network: types.TwinNetwork(network)}, nil, 0, nil
+	}
+
+	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
+		return c.getValidatedPeerWithComponentsFromData(ctx, accountID, peer, nmData)
+	}
+
+	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
+	if err != nil {
+		return nil, nil, nil, 0, err
+	}
+
+	// it's possible that the peer gets deleted between the call to "sendInitialSync()" and here, bail out in this case
+	if _, ok := account.Peers[peer.ID]; !ok {
+		return nil, nil, nil, 0, fmt.Errorf("peer '%s' no longer exists", peer.ID)
+	}
+
+	c.injectAllProxyPolicies(ctx, account)
+
+	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
+	if err != nil {
+		return nil, nil, nil, 0, err
+	}
+
+	postureChecks, err := c.getPeerPostureChecks(account, peer.ID)
+	if err != nil {
+		return nil, nil, nil, 0, err
+	}
+
+	accountZones, err := c.repo.GetAccountZones(ctx, account.Id)
+	if err != nil {
+		return nil, nil, nil, 0, err
+	}
+
+	dnsDomain := c.GetDNSDomain(account.Settings)
+	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
+
+	resourcePolicies := account.GetResourcePoliciesMap()
+	routers := account.GetResourceRoutersMap()
+	groupIDToUserIDs := account.GetActiveGroupUsers()
+	components := account.GetPeerNetworkMapComponents(ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
+	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
+
+	return peer, components, postureChecks, dnsFwdPort, nil
+}
+
+// getValidatedPeerWithComponentsFromData is the account-free variant of
+// GetValidatedPeerWithComponents.
+func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context, accountID string, peer *nbpeer.Peer, nmData *networkmap.NetworkMapData) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
+	postureChecks := peerPostureChecksFromData(nmData, peer.ID)
+
+	dnsDomain := c.getDNSDomainFromData(nmData.AccountSettings)
+	peersCustomZone := networkmap.PeersCustomZone(ctx, accountID, dnsDomain, nmData.Peers, IPv6AllowedPeersFromData(nmData))
+
+	components := nmData.GetPeerNetworkMapComponents(peer.ID, peersCustomZone)
+	dnsFwdPort := ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
+
+	return peer, components, postureChecks, dnsFwdPort, nil
+}
+
 // BufferUpdateAffectedPeers accumulates peer IDs and flushes them after the buffer interval.
 func (c *Controller) BufferUpdateAffectedPeers(ctx context.Context, accountID string, peerIDs []string, reason types.UpdateReason) error {
 	if len(peerIDs) == 0 {
@@ -611,7 +1078,7 @@ func (b *bufferAffectedUpdate) setTimer(d time.Duration, f func()) {
 	b.next.Reset(d)
 }
 
-func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID string, peerID string) (*types.NetworkMap, []*posture.Checks, int64, error) {
+func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID string, peerID string) (*types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
 	if isRequiresApproval {
 		network, err := c.repo.GetAccountNetwork(ctx, accountID)
 		if err != nil {
@@ -619,11 +1086,15 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 		}
 
 		emptyMap := &types.NetworkMap{
-			Network: network.Copy(),
+			Network: types.TwinNetwork(network),
 		}
 		return emptyMap, nil, 0, nil
 	}
 
+	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
+		return c.getValidatedPeerWithMapFromData(ctx, accountID, peerID, nmData)
+	}
+
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
 	if err != nil {
 		return nil, nil, 0, err
@@ -631,7 +1102,7 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 
 	c.injectAllProxyPolicies(ctx, account)
 
-	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
 	if err != nil {
 		return nil, nil, 0, err
 	}
@@ -650,27 +1121,31 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peerID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, nil, 0, err
-	}
-
 	resourcePolicies := account.GetResourcePoliciesMap()
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 	networkMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
-	proxyNetworkMap, ok := proxyNetworkMaps[peerID]
-	if ok {
-		networkMap.Merge(proxyNetworkMap)
-	}
-
 	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
 
 	return networkMap, postureChecks, dnsFwdPort, nil
 }
 
+// getValidatedPeerWithMapFromData is the account-free variant of
+// GetValidatedPeerWithMap. The proxy network map fragment is omitted like on
+// the other nmdata paths.
+func (c *Controller) getValidatedPeerWithMapFromData(ctx context.Context, accountID string, peerID string, nmData *networkmap.NetworkMapData) (*types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
+	postureChecks := peerPostureChecksFromData(nmData, peerID)
+
+	dnsDomain := c.getDNSDomainFromData(nmData.AccountSettings)
+	peersCustomZone := networkmap.PeersCustomZone(ctx, accountID, dnsDomain, nmData.Peers, IPv6AllowedPeersFromData(nmData))
+
+	networkMap := NetworkMapFromData(ctx, nmData, peerID, peersCustomZone, c.accountManagerMetrics)
+	dnsFwdPort := ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
+
+	return networkMap, postureChecks, dnsFwdPort, nil
+}
+
 // GetDNSDomain returns the configured dnsDomain
 func (c *Controller) GetDNSDomain(settings *types.Settings) string {
 	if settings == nil {
@@ -684,7 +1159,7 @@ func (c *Controller) GetDNSDomain(settings *types.Settings) string {
 }
 
 // getPeerPostureChecks returns the posture checks applied for a given peer.
-func (c *Controller) getPeerPostureChecks(account *types.Account, peerID string) ([]*posture.Checks, error) {
+func (c *Controller) getPeerPostureChecks(account *types.Account, peerID string) ([]*nmdata.PostureChecks, error) {
 	peerPostureChecks := make(map[string]*posture.Checks)
 
 	if len(account.PostureChecks) == 0 {
@@ -701,7 +1176,7 @@ func (c *Controller) getPeerPostureChecks(account *types.Account, peerID string)
 		}
 	}
 
-	return maps.Values(peerPostureChecks), nil
+	return types.TwinPostureChecksList(maps.Values(peerPostureChecks)), nil
 }
 
 func (c *Controller) StartWarmup(ctx context.Context) {
@@ -733,20 +1208,36 @@ func (c *Controller) StartWarmup(ctx context.Context) {
 // computeForwarderPort checks if all peers in the account have updated to a specific version or newer.
 // If all peers have the required version, it returns the new well-known port (22054), otherwise returns 0.
 func computeForwarderPort(peers []*nbpeer.Peer, requiredVersion string) int64 {
-	if len(peers) == 0 {
+	versions := make([]string, 0, len(peers))
+	for _, peer := range peers {
+		versions = append(versions, peer.Meta.WtVersion)
+	}
+	return computeForwarderPortFromVersions(versions, requiredVersion)
+}
+
+func ComputeForwarderPortFromData(peers map[string]*nmdata.Peer, requiredVersion string) int64 {
+	versions := make([]string, 0, len(peers))
+	for _, peer := range peers {
+		versions = append(versions, peer.Meta.WtVersion)
+	}
+	return computeForwarderPortFromVersions(versions, requiredVersion)
+}
+
+func computeForwarderPortFromVersions(wtVersions []string, requiredVersion string) int64 {
+	if len(wtVersions) == 0 {
 		return int64(network_map.OldForwarderPort)
 	}
 
 	reqVer := semver.Canonical(requiredVersion)
 
 	// Check if all peers have the required version or newer
-	for _, peer := range peers {
+	for _, wtVersion := range wtVersions {
 
 		// Development version is always supported
-		if version.IsDevelopmentVersion(peer.Meta.WtVersion) {
+		if version.IsDevelopmentVersion(wtVersion) {
 			continue
 		}
-		peerVersion := semver.Canonical("v" + peer.Meta.WtVersion)
+		peerVersion := semver.Canonical("v" + wtVersion)
 		if peerVersion == "" {
 			// If any peer doesn't have version info, return 0
 			return int64(network_map.OldForwarderPort)
@@ -764,7 +1255,7 @@ func computeForwarderPort(peers []*nbpeer.Peer, requiredVersion string) int64 {
 
 // addPolicyPostureChecks adds posture checks from a policy to the peer posture checks map if the peer is in the policy's source groups.
 func addPolicyPostureChecks(account *types.Account, peerID string, policy *types.Policy, peerPostureChecks map[string]*posture.Checks) error {
-	isInGroup, err := isPeerInPolicySourceGroups(account, peerID, policy)
+	isInGroup, err := isPeerInPolicySources(account, peerID, policy)
 	if err != nil {
 		return err
 	}
@@ -784,13 +1275,17 @@ func addPolicyPostureChecks(account *types.Account, peerID string, policy *types
 	return nil
 }
 
-// isPeerInPolicySourceGroups checks if a peer is present in any of the policy rule source groups.
-func isPeerInPolicySourceGroups(account *types.Account, peerID string, policy *types.Policy) (bool, error) {
+// isPeerInPolicySources checks if a peer is a source of the policy, directly or through a source group.
+func isPeerInPolicySources(account *types.Account, peerID string, policy *types.Policy) (bool, error) {
 	for _, rule := range policy.Rules {
 		if !rule.Enabled {
 			continue
 		}
 
+		if rule.SourceResource.Type == types.ResourceTypePeer && rule.SourceResource.ID == peerID {
+			return true, nil
+		}
+
 		for _, sourceGroup := range rule.Sources {
 			group := account.GetGroup(sourceGroup)
 			if group == nil {
@@ -847,7 +1342,7 @@ func (c *Controller) OnPeersDeleted(ctx context.Context, accountID string, peerI
 					FirewallRules:        []*proto.FirewallRule{},
 					FirewallRulesIsEmpty: true,
 					DNSConfig: &proto.DNSConfig{
-						ForwarderPort: dnsFwdPort,
+						ForwarderPort: dnsFwdPort, //nolint:staticcheck
 					},
 				},
 			},
@@ -880,7 +1375,12 @@ func (c *Controller) GetNetworkMap(ctx context.Context, peerID string) (*types.N
 		groups[groupID] = group.Peers
 	}
 
-	validatedPeers, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	extraSettings, err := c.settingsManager.GetExtraSettings(ctx, account.Id)
+	if err != nil {
+		return nil, err
+	}
+
+	validatedPeers, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), extraSettings)
 	if err != nil {
 		return nil, err
 	}
@@ -894,23 +1394,12 @@ func (c *Controller) GetNetworkMap(ctx context.Context, peerID string) (*types.N
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peerID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, err
-	}
-
 	c.injectAllProxyPolicies(ctx, account)
 	resourcePolicies := account.GetResourcePoliciesMap()
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 	networkMap := account.GetPeerNetworkMapFromComponents(ctx, peer.ID, peersCustomZone, accountZones, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
 
-	proxyNetworkMap, ok := proxyNetworkMaps[peer.ID]
-	if ok {
-		networkMap.Merge(proxyNetworkMap)
-	}
-
 	return networkMap, nil
 }
 
diff --git a/management/internals/controllers/network_map/controller/controller_disconnect_test.go b/management/internals/controllers/network_map/controller/controller_disconnect_test.go
new file mode 100644
index 000000000..ed1a217d9
--- /dev/null
+++ b/management/internals/controllers/network_map/controller/controller_disconnect_test.go
@@ -0,0 +1,78 @@
+package controller
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+)
+
+type recordingEphemeralManager struct {
+	disconnected []string
+}
+
+func (r *recordingEphemeralManager) LoadInitialPeers(context.Context)              {}
+func (r *recordingEphemeralManager) Stop()                                         {}
+func (r *recordingEphemeralManager) OnPeerConnected(context.Context, *nbpeer.Peer) {}
+func (r *recordingEphemeralManager) OnPeerDisconnected(_ context.Context, peer *nbpeer.Peer) {
+	r.disconnected = append(r.disconnected, peer.ID)
+}
+
+func TestOnPeerDisconnected_OwnSession(t *testing.T) {
+	ctx := context.Background()
+	repo := NewMockRepository(gomock.NewController(t))
+	ephemeralManager := &recordingEphemeralManager{}
+	updateManager := update_channel.NewPeersUpdateManager(nil)
+	c := Controller{repo: repo, peersUpdateManager: updateManager, EphemeralPeersManager: ephemeralManager}
+
+	session := updateManager.CreateChannel(ctx, "peer-1")
+	repo.EXPECT().GetPeerByID(gomock.Any(), "account-1", "peer-1").Return(&nbpeer.Peer{ID: "peer-1", Ephemeral: true}, nil)
+
+	require.True(t, c.OnPeerDisconnected(ctx, "account-1", "peer-1", session))
+	assert.False(t, updateManager.HasChannel("peer-1"))
+	assert.Equal(t, []string{"peer-1"}, ephemeralManager.disconnected)
+}
+
+func TestOnPeerDisconnected_NilSessionClosesOlderChannel(t *testing.T) {
+	ctx := context.Background()
+	repo := NewMockRepository(gomock.NewController(t))
+	ephemeralManager := &recordingEphemeralManager{}
+	updateManager := update_channel.NewPeersUpdateManager(nil)
+	c := Controller{repo: repo, peersUpdateManager: updateManager, EphemeralPeersManager: ephemeralManager}
+
+	older := updateManager.CreateChannel(ctx, "peer-1")
+	repo.EXPECT().GetPeerByID(gomock.Any(), "account-1", "peer-1").Return(&nbpeer.Peer{ID: "peer-1", Ephemeral: true}, nil)
+
+	require.True(t, c.OnPeerDisconnected(ctx, "account-1", "peer-1", nil))
+	assert.False(t, updateManager.HasChannel("peer-1"))
+	_, open := <-older
+	assert.False(t, open, "older channel must be closed")
+	assert.Equal(t, []string{"peer-1"}, ephemeralManager.disconnected)
+}
+
+func TestOnPeerDisconnected_NewerSessionOwnsPeer(t *testing.T) {
+	ctx := context.Background()
+	ephemeralManager := &recordingEphemeralManager{}
+	updateManager := update_channel.NewPeersUpdateManager(nil)
+	c := Controller{repo: NewMockRepository(gomock.NewController(t)), peersUpdateManager: updateManager, EphemeralPeersManager: ephemeralManager}
+
+	stale := updateManager.CreateChannel(ctx, "peer-1")
+	current := updateManager.CreateChannel(ctx, "peer-1")
+
+	require.False(t, c.OnPeerDisconnected(ctx, "account-1", "peer-1", stale))
+	require.True(t, updateManager.HasChannel("peer-1"))
+	updateManager.SendUpdate(ctx, "peer-1", &network_map.UpdateMessage{})
+	select {
+	case _, open := <-current:
+		assert.True(t, open, "newer session channel must stay open")
+	default:
+		t.Fatal("newer session channel did not receive the update")
+	}
+	assert.Empty(t, ephemeralManager.disconnected, "a live peer must not be scheduled for ephemeral cleanup")
+}
diff --git a/management/internals/controllers/network_map/controller/controller_test.go b/management/internals/controllers/network_map/controller/controller_test.go
index 90e7b6e18..74e2553d6 100644
--- a/management/internals/controllers/network_map/controller/controller_test.go
+++ b/management/internals/controllers/network_map/controller/controller_test.go
@@ -1,10 +1,15 @@
 package controller
 
 import (
+	"context"
 	"testing"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 )
 
 func TestComputeForwarderPort(t *testing.T) {
@@ -107,3 +112,21 @@ func TestComputeForwarderPort(t *testing.T) {
 		t.Errorf("Expected %d for peers with unknown version, got %d", network_map.OldForwarderPort, result)
 	}
 }
+
+func TestGetValidatedPeerWithComponents_DeletedPeer(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockrequestBuffer := account.NewMockRequestBuffer(ctrl)
+
+	c := Controller{
+		requestBuffer: mockrequestBuffer,
+	}
+
+	mockrequestBuffer.EXPECT().GetAccountWithBackpressure(gomock.Any(), gomock.Any()).Return(&types.Account{}, nil)
+	peer, components, posturechecks, dnsforwardPort, err := c.GetValidatedPeerWithComponents(context.TODO(), false, "test-account-id", &nbpeer.Peer{ID: "test-peer-id"})
+
+	assert.Nil(t, peer)
+	assert.Nil(t, components)
+	assert.Nil(t, posturechecks)
+	assert.Equal(t, int64(0), dnsforwardPort)
+	assert.NotNil(t, err)
+}
diff --git a/management/internals/controllers/network_map/controller/ipv6_allowed_test.go b/management/internals/controllers/network_map/controller/ipv6_allowed_test.go
new file mode 100644
index 000000000..c80f3b734
--- /dev/null
+++ b/management/internals/controllers/network_map/controller/ipv6_allowed_test.go
@@ -0,0 +1,47 @@
+package controller
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+// The account-side builder (types.Account.peerIPv6AllowedSet) is the reference:
+// an account with no IPv6-enabled group runs no IPv6 overlay at all, embedded
+// proxy peers included — see TestPeerIPv6AllowedEmbeddedProxy. Both builders
+// gate the same AAAA records, so the store-backed one has to agree.
+func TestIPv6AllowedPeersFromData(t *testing.T) {
+	data := func(enabledGroups []string) *networkmap.NetworkMapData {
+		return &networkmap.NetworkMapData{
+			AccountSettings: &nmdata.AccountSettingsInfo{IPv6EnabledGroups: enabledGroups},
+			Peers: map[string]*nmdata.Peer{
+				"peer1":  {ID: "peer1"},
+				"lonely": {ID: "lonely"},
+				"proxy":  {ID: "proxy", ProxyMeta: nmdata.ProxyMeta{Embedded: true, Cluster: "netbird.test"}},
+			},
+			Groups: map[string]*nmdata.Group{
+				"group-devs": {ID: "group-devs", Peers: []string{"peer1"}},
+			},
+		}
+	}
+
+	t.Run("embedded proxy allowed when any v6 group exists, without group membership", func(t *testing.T) {
+		allowed := IPv6AllowedPeersFromData(data([]string{"group-devs"}))
+		assert.Contains(t, allowed, "proxy", "embedded proxy participates in v6 overlay")
+		assert.Contains(t, allowed, "peer1", "regular peer in enabled group still allowed")
+	})
+
+	t.Run("embedded proxy denied when no v6 group enabled", func(t *testing.T) {
+		allowed := IPv6AllowedPeersFromData(data(nil))
+		assert.NotContains(t, allowed, "proxy", "v6 disabled account-wide denies embedded proxies too")
+		assert.Empty(t, allowed, "no peer participates in the v6 overlay")
+	})
+
+	t.Run("non-embedded peer outside any enabled group is not pulled in", func(t *testing.T) {
+		allowed := IPv6AllowedPeersFromData(data([]string{"group-devs"}))
+		assert.NotContains(t, allowed, "lonely", "embedded-proxy bypass must not leak to regular peers")
+	})
+}
diff --git a/management/internals/controllers/network_map/controller/posture_twin_test.go b/management/internals/controllers/network_map/controller/posture_twin_test.go
new file mode 100644
index 000000000..98e0991d0
--- /dev/null
+++ b/management/internals/controllers/network_map/controller/posture_twin_test.go
@@ -0,0 +1,68 @@
+package controller
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/types"
+)
+
+func postureSelectionData(policies ...*nmdata.Policy) *networkmap.NetworkMapData {
+	return &networkmap.NetworkMapData{
+		Groups:   map[string]*nmdata.Group{"g-src": {ID: "g-src", Peers: []string{"peer-group"}}},
+		Policies: policies,
+		PostureChecks: map[string]*nmdata.PostureChecks{
+			"pc1": {ID: "pc1", Checks: nmdata.ChecksDefinition{NBVersionCheck: &nmdata.NBVersionCheck{MinVersion: "0.30.0"}}},
+		},
+	}
+}
+
+func gatedPolicy(id string, rule *nmdata.PolicyRule, checkIDs ...string) *nmdata.Policy {
+	return &nmdata.Policy{ID: id, Enabled: true, SourcePostureChecks: checkIDs, Rules: []*nmdata.PolicyRule{rule}}
+}
+
+func checkIDs(checks []*nmdata.PostureChecks) []string {
+	ids := make([]string, 0, len(checks))
+	for _, c := range checks {
+		ids = append(ids, c.ID)
+	}
+	return ids
+}
+
+func TestPeerPostureChecksFromData_SelectsPolicySourcePeers(t *testing.T) {
+	groupRule := &nmdata.PolicyRule{ID: "r-group", Enabled: true, Sources: []string{"g-src"}, Destinations: []string{"g-dst"}}
+	directRule := &nmdata.PolicyRule{ID: "r-direct", Enabled: true, SourceResource: nmdata.Resource{ID: "peer-direct", Type: string(types.ResourceTypePeer)}, Destinations: []string{"g-dst"}}
+
+	t.Run("source group member and direct source peer both get the checks", func(t *testing.T) {
+		nmData := postureSelectionData(gatedPolicy("p1", groupRule, "pc1"), gatedPolicy("p2", directRule, "pc1"))
+
+		assert.Equal(t, []string{"pc1"}, checkIDs(peerPostureChecksFromData(nmData, "peer-group")))
+		assert.Equal(t, []string{"pc1"}, checkIDs(peerPostureChecksFromData(nmData, "peer-direct")))
+		assert.Empty(t, peerPostureChecksFromData(nmData, "peer-elsewhere"))
+	})
+
+	t.Run("source resource of a non-peer type never matches a peer", func(t *testing.T) {
+		hostRule := &nmdata.PolicyRule{ID: "r-host", Enabled: true, SourceResource: nmdata.Resource{ID: "peer-direct", Type: string(types.ResourceTypeHost)}, Destinations: []string{"g-dst"}}
+		nmData := postureSelectionData(gatedPolicy("p1", hostRule, "pc1"))
+
+		assert.Empty(t, peerPostureChecksFromData(nmData, "peer-direct"))
+	})
+
+	t.Run("same check through two policies is returned once", func(t *testing.T) {
+		nmData := postureSelectionData(gatedPolicy("p1", groupRule, "pc1"), gatedPolicy("p2", groupRule, "pc1"))
+
+		assert.Equal(t, []string{"pc1"}, checkIDs(peerPostureChecksFromData(nmData, "peer-group")))
+	})
+
+	t.Run("disabled policy, disabled rule and dangling check are ignored", func(t *testing.T) {
+		disabledPolicy := gatedPolicy("p-off", groupRule, "pc1")
+		disabledPolicy.Enabled = false
+		disabledRule := &nmdata.PolicyRule{ID: "r-off", Enabled: false, Sources: []string{"g-src"}}
+		nmData := postureSelectionData(disabledPolicy, gatedPolicy("p-rule-off", disabledRule, "pc1"), gatedPolicy("p-dangling", groupRule, "pc-missing"))
+
+		assert.Empty(t, peerPostureChecksFromData(nmData, "peer-group"))
+	})
+}
diff --git a/management/internals/controllers/network_map/controller/repository.go b/management/internals/controllers/network_map/controller/repository.go
index c0fcefc7d..c11af0b69 100644
--- a/management/internals/controllers/network_map/controller/repository.go
+++ b/management/internals/controllers/network_map/controller/repository.go
@@ -3,14 +3,16 @@ package controller
 import (
 	"context"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
 )
 
+//go:generate go tool mockgen -source=./repository.go -package=controller -destination=repository_mock.go
+
 type Repository interface {
 	GetAccountNetwork(ctx context.Context, accountID string) (*types.Network, error)
 	GetAccountPeers(ctx context.Context, accountID string) ([]*peer.Peer, error)
@@ -22,6 +24,7 @@ type Repository interface {
 	// services synthesised from the account's agent-network provider/policy
 	// state. Empty for accounts without agent-network providers.
 	SynthesizeAgentNetworkServices(ctx context.Context, accountID string) ([]*service.Service, error)
+	GetAccountServices(ctx context.Context, accountID string) ([]*service.Service, error)
 }
 
 type repository struct {
@@ -41,7 +44,7 @@ func (r *repository) GetAccountNetwork(ctx context.Context, accountID string) (*
 }
 
 func (r *repository) GetAccountPeers(ctx context.Context, accountID string) ([]*peer.Peer, error) {
-	return r.store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	return r.store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 }
 
 func (r *repository) GetAccountByPeerID(ctx context.Context, peerID string) (*types.Account, error) {
@@ -60,6 +63,10 @@ func (r *repository) SynthesizeAgentNetworkServices(ctx context.Context, account
 	return agentnetwork.SynthesizeServices(ctx, r.store, accountID)
 }
 
+func (r *repository) GetAccountServices(ctx context.Context, accountID string) ([]*service.Service, error) {
+	return r.store.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
+}
+
 func (r *repository) GetAccountZones(ctx context.Context, accountID string) ([]*zones.Zone, error) {
 	return r.store.GetAccountZones(ctx, store.LockingStrengthNone, accountID)
 }
diff --git a/management/internals/controllers/network_map/controller/repository_mock.go b/management/internals/controllers/network_map/controller/repository_mock.go
new file mode 100644
index 000000000..9c6b1af4c
--- /dev/null
+++ b/management/internals/controllers/network_map/controller/repository_mock.go
@@ -0,0 +1,165 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./repository.go
+//
+// Generated by this command:
+//
+//	mockgen -source=./repository.go -package=controller -destination=repository_mock.go
+//
+
+// Package controller is a generated GoMock package.
+package controller
+
+import (
+	context "context"
+	reflect "reflect"
+
+	service "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	zones "github.com/netbirdio/netbird/management/internals/modules/zones"
+	peer "github.com/netbirdio/netbird/management/server/peer"
+	types "github.com/netbirdio/netbird/management/server/types"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockRepository is a mock of Repository interface.
+type MockRepository struct {
+	ctrl     *gomock.Controller
+	recorder *MockRepositoryMockRecorder
+	isgomock struct{}
+}
+
+// MockRepositoryMockRecorder is the mock recorder for MockRepository.
+type MockRepositoryMockRecorder struct {
+	mock *MockRepository
+}
+
+// NewMockRepository creates a new mock instance.
+func NewMockRepository(ctrl *gomock.Controller) *MockRepository {
+	mock := &MockRepository{ctrl: ctrl}
+	mock.recorder = &MockRepositoryMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockRepository) EXPECT() *MockRepositoryMockRecorder {
+	return m.recorder
+}
+
+// GetAccountByPeerID mocks base method.
+func (m *MockRepository) GetAccountByPeerID(ctx context.Context, peerID string) (*types.Account, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountByPeerID", ctx, peerID)
+	ret0, _ := ret[0].(*types.Account)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountByPeerID indicates an expected call of GetAccountByPeerID.
+func (mr *MockRepositoryMockRecorder) GetAccountByPeerID(ctx, peerID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountByPeerID", reflect.TypeOf((*MockRepository)(nil).GetAccountByPeerID), ctx, peerID)
+}
+
+// GetAccountNetwork mocks base method.
+func (m *MockRepository) GetAccountNetwork(ctx context.Context, accountID string) (*types.Network, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountNetwork", ctx, accountID)
+	ret0, _ := ret[0].(*types.Network)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountNetwork indicates an expected call of GetAccountNetwork.
+func (mr *MockRepositoryMockRecorder) GetAccountNetwork(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountNetwork", reflect.TypeOf((*MockRepository)(nil).GetAccountNetwork), ctx, accountID)
+}
+
+// GetAccountPeers mocks base method.
+func (m *MockRepository) GetAccountPeers(ctx context.Context, accountID string) ([]*peer.Peer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountPeers", ctx, accountID)
+	ret0, _ := ret[0].([]*peer.Peer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountPeers indicates an expected call of GetAccountPeers.
+func (mr *MockRepositoryMockRecorder) GetAccountPeers(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeers", reflect.TypeOf((*MockRepository)(nil).GetAccountPeers), ctx, accountID)
+}
+
+// GetAccountServices mocks base method.
+func (m *MockRepository) GetAccountServices(ctx context.Context, accountID string) ([]*service.Service, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountServices", ctx, accountID)
+	ret0, _ := ret[0].([]*service.Service)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountServices indicates an expected call of GetAccountServices.
+func (mr *MockRepositoryMockRecorder) GetAccountServices(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountServices", reflect.TypeOf((*MockRepository)(nil).GetAccountServices), ctx, accountID)
+}
+
+// GetAccountZones mocks base method.
+func (m *MockRepository) GetAccountZones(ctx context.Context, accountID string) ([]*zones.Zone, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountZones", ctx, accountID)
+	ret0, _ := ret[0].([]*zones.Zone)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountZones indicates an expected call of GetAccountZones.
+func (mr *MockRepositoryMockRecorder) GetAccountZones(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountZones", reflect.TypeOf((*MockRepository)(nil).GetAccountZones), ctx, accountID)
+}
+
+// GetPeerByID mocks base method.
+func (m *MockRepository) GetPeerByID(ctx context.Context, accountID, peerID string) (*peer.Peer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetPeerByID", ctx, accountID, peerID)
+	ret0, _ := ret[0].(*peer.Peer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetPeerByID indicates an expected call of GetPeerByID.
+func (mr *MockRepositoryMockRecorder) GetPeerByID(ctx, accountID, peerID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerByID", reflect.TypeOf((*MockRepository)(nil).GetPeerByID), ctx, accountID, peerID)
+}
+
+// GetPeersByIDs mocks base method.
+func (m *MockRepository) GetPeersByIDs(ctx context.Context, accountID string, peerIDs []string) (map[string]*peer.Peer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetPeersByIDs", ctx, accountID, peerIDs)
+	ret0, _ := ret[0].(map[string]*peer.Peer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetPeersByIDs indicates an expected call of GetPeersByIDs.
+func (mr *MockRepositoryMockRecorder) GetPeersByIDs(ctx, accountID, peerIDs any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeersByIDs", reflect.TypeOf((*MockRepository)(nil).GetPeersByIDs), ctx, accountID, peerIDs)
+}
+
+// SynthesizeAgentNetworkServices mocks base method.
+func (m *MockRepository) SynthesizeAgentNetworkServices(ctx context.Context, accountID string) ([]*service.Service, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SynthesizeAgentNetworkServices", ctx, accountID)
+	ret0, _ := ret[0].([]*service.Service)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// SynthesizeAgentNetworkServices indicates an expected call of SynthesizeAgentNetworkServices.
+func (mr *MockRepositoryMockRecorder) SynthesizeAgentNetworkServices(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SynthesizeAgentNetworkServices", reflect.TypeOf((*MockRepository)(nil).SynthesizeAgentNetworkServices), ctx, accountID)
+}
diff --git a/management/internals/controllers/network_map/interface.go b/management/internals/controllers/network_map/interface.go
index 14b12aba6..89345fd58 100644
--- a/management/internals/controllers/network_map/interface.go
+++ b/management/internals/controllers/network_map/interface.go
@@ -1,14 +1,14 @@
 package network_map
 
-//go:generate go run go.uber.org/mock/mockgen -package network_map -destination=interface_mock.go -source=./interface.go -build_flags=-mod=mod
+//go:generate go tool mockgen -package network_map -destination=interface_mock.go -source=./interface.go -build_flags=-mod=mod
 
 import (
 	"context"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 const (
@@ -23,7 +23,8 @@ type Controller interface {
 	BufferUpdateAffectedPeers(ctx context.Context, accountID string, peerIDs []string, reason types.UpdateReason) error
 	UpdateAccountPeer(ctx context.Context, accountId string, peerId string) error
 	BufferUpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) error
-	GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID string, peerID string) (*types.NetworkMap, []*posture.Checks, int64, error)
+	GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID string, peerID string) (*types.NetworkMap, []*nmdata.PostureChecks, int64, error)
+	GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error)
 	GetDNSDomain(settings *types.Settings) string
 	StartWarmup(context.Context)
 	GetNetworkMap(ctx context.Context, peerID string) (*types.NetworkMap, error)
@@ -34,7 +35,10 @@ type Controller interface {
 	OnPeersDeleted(ctx context.Context, accountID string, peerIDs []string, affectedPeerIDs []string) error
 	DisconnectPeers(ctx context.Context, accountId string, peerIDs []string)
 	OnPeerConnected(ctx context.Context, accountID string, peerID string) (chan *UpdateMessage, error)
-	OnPeerDisconnected(ctx context.Context, accountID string, peerID string)
+	// OnPeerDisconnected tears down the stream state of the peer's session, identified by its
+	// updates channel. It returns false and leaves everything untouched when a newer session
+	// owns the peer. A nil session is the newest session and tears down any registered channel.
+	OnPeerDisconnected(ctx context.Context, accountID string, peerID string, session chan *UpdateMessage) bool
 
 	TrackEphemeralPeer(ctx context.Context, peer *nbpeer.Peer)
 }
diff --git a/management/internals/controllers/network_map/interface_mock.go b/management/internals/controllers/network_map/interface_mock.go
index bfff32e6f..f79b93019 100644
--- a/management/internals/controllers/network_map/interface_mock.go
+++ b/management/internals/controllers/network_map/interface_mock.go
@@ -1,9 +1,9 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: management/internals/controllers/network_map/interface.go
+// Source: ./interface.go
 //
 // Generated by this command:
 //
-//	mockgen -package network_map -destination=management/internals/controllers/network_map/interface_mock.go -source=management/internals/controllers/network_map/interface.go -build_flags=-mod=mod
+//	mockgen -package network_map -destination=interface_mock.go -source=./interface.go -build_flags=-mod=mod
 //
 
 // Package network_map is a generated GoMock package.
@@ -14,8 +14,8 @@ import (
 	reflect "reflect"
 
 	peer "github.com/netbirdio/netbird/management/server/peer"
-	posture "github.com/netbirdio/netbird/management/server/posture"
 	types "github.com/netbirdio/netbird/management/server/types"
+	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	gomock "go.uber.org/mock/gomock"
 )
 
@@ -126,12 +126,30 @@ func (mr *MockControllerMockRecorder) GetNetworkMap(ctx, peerID any) *gomock.Cal
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkMap", reflect.TypeOf((*MockController)(nil).GetNetworkMap), ctx, peerID)
 }
 
+// GetValidatedPeerWithComponents mocks base method.
+func (m *MockController) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *peer.Peer) (*peer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetValidatedPeerWithComponents", ctx, isRequiresApproval, accountID, p)
+	ret0, _ := ret[0].(*peer.Peer)
+	ret1, _ := ret[1].(*types.NetworkMapComponents)
+	ret2, _ := ret[2].([]*nmdata.PostureChecks)
+	ret3, _ := ret[3].(int64)
+	ret4, _ := ret[4].(error)
+	return ret0, ret1, ret2, ret3, ret4
+}
+
+// GetValidatedPeerWithComponents indicates an expected call of GetValidatedPeerWithComponents.
+func (mr *MockControllerMockRecorder) GetValidatedPeerWithComponents(ctx, isRequiresApproval, accountID, p any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetValidatedPeerWithComponents", reflect.TypeOf((*MockController)(nil).GetValidatedPeerWithComponents), ctx, isRequiresApproval, accountID, p)
+}
+
 // GetValidatedPeerWithMap mocks base method.
-func (m *MockController) GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID string, peerID string) (*types.NetworkMap, []*posture.Checks, int64, error) {
+func (m *MockController) GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID, peerID string) (*types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetValidatedPeerWithMap", ctx, isRequiresApproval, accountID, peerID)
 	ret0, _ := ret[0].(*types.NetworkMap)
-	ret1, _ := ret[1].([]*posture.Checks)
+	ret1, _ := ret[1].([]*nmdata.PostureChecks)
 	ret2, _ := ret[2].(int64)
 	ret3, _ := ret[3].(error)
 	return ret0, ret1, ret2, ret3
@@ -159,19 +177,21 @@ func (mr *MockControllerMockRecorder) OnPeerConnected(ctx, accountID, peerID any
 }
 
 // OnPeerDisconnected mocks base method.
-func (m *MockController) OnPeerDisconnected(ctx context.Context, accountID, peerID string) {
+func (m *MockController) OnPeerDisconnected(ctx context.Context, accountID, peerID string, session chan *UpdateMessage) bool {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "OnPeerDisconnected", ctx, accountID, peerID)
+	ret := m.ctrl.Call(m, "OnPeerDisconnected", ctx, accountID, peerID, session)
+	ret0, _ := ret[0].(bool)
+	return ret0
 }
 
 // OnPeerDisconnected indicates an expected call of OnPeerDisconnected.
-func (mr *MockControllerMockRecorder) OnPeerDisconnected(ctx, accountID, peerID any) *gomock.Call {
+func (mr *MockControllerMockRecorder) OnPeerDisconnected(ctx, accountID, peerID, session any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnPeerDisconnected", reflect.TypeOf((*MockController)(nil).OnPeerDisconnected), ctx, accountID, peerID)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnPeerDisconnected", reflect.TypeOf((*MockController)(nil).OnPeerDisconnected), ctx, accountID, peerID, session)
 }
 
 // OnPeersAdded mocks base method.
-func (m *MockController) OnPeersAdded(ctx context.Context, accountID string, peerIDs []string, affectedPeerIDs []string) error {
+func (m *MockController) OnPeersAdded(ctx context.Context, accountID string, peerIDs, affectedPeerIDs []string) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "OnPeersAdded", ctx, accountID, peerIDs, affectedPeerIDs)
 	ret0, _ := ret[0].(error)
@@ -185,7 +205,7 @@ func (mr *MockControllerMockRecorder) OnPeersAdded(ctx, accountID, peerIDs, affe
 }
 
 // OnPeersDeleted mocks base method.
-func (m *MockController) OnPeersDeleted(ctx context.Context, accountID string, peerIDs []string, affectedPeerIDs []string) error {
+func (m *MockController) OnPeersDeleted(ctx context.Context, accountID string, peerIDs, affectedPeerIDs []string) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "OnPeersDeleted", ctx, accountID, peerIDs, affectedPeerIDs)
 	ret0, _ := ret[0].(error)
@@ -199,7 +219,7 @@ func (mr *MockControllerMockRecorder) OnPeersDeleted(ctx, accountID, peerIDs, af
 }
 
 // OnPeersUpdated mocks base method.
-func (m *MockController) OnPeersUpdated(ctx context.Context, accountId string, peerIDs []string, affectedPeerIDs []string) error {
+func (m *MockController) OnPeersUpdated(ctx context.Context, accountId string, peerIDs, affectedPeerIDs []string) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "OnPeersUpdated", ctx, accountId, peerIDs, affectedPeerIDs)
 	ret0, _ := ret[0].(error)
diff --git a/management/internals/controllers/network_map/nmaptest/canonicalize.go b/management/internals/controllers/network_map/nmaptest/canonicalize.go
new file mode 100644
index 000000000..643105b89
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/canonicalize.go
@@ -0,0 +1,369 @@
+package nmaptest
+
+import (
+	"bytes"
+	"cmp"
+	"fmt"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// normalizeIDSpace replaces policy and route identifiers with positional
+// placeholders so a comparison can reach everything else.
+//
+// This exists only because the envelope round-trip currently substitutes each
+// internal xid with the object's public id, which is a tracked defect and not a
+// licence to differ: those identifiers reach the server again inside flow
+// events, which resolve them by internal id, so the substitution silently
+// breaks flow attribution for component-format peers. TestIDSpaceMatches
+// asserts the equality that must eventually hold; this erasure keeps the other
+// 40-odd cases reporting on semantics meanwhile. When the id space is unified,
+// delete this and the calls to it — every case should still pass.
+//
+// Cardinality and cross-references survive the erasure: two rules under one
+// policy still share a token and a route firewall rule still points at its
+// route, so a path that drops a policy, merges two policies, or misattributes a
+// rule to the wrong route still fails.
+func normalizeIDSpace(nm *proto.NetworkMap) {
+	if nm == nil {
+		return
+	}
+	policies := newTokenizer("policy")
+	routes := newTokenizer("route")
+
+	for _, i := range orderBy(nm.Routes, routeKeyWithoutID) {
+		nm.Routes[i].ID = routes.get(nm.Routes[i].ID)
+	}
+	for _, i := range orderBy(nm.FirewallRules, firewallKeyWithoutPolicy) {
+		r := nm.FirewallRules[i]
+		if len(r.PolicyID) > 0 {
+			r.PolicyID = []byte(policies.get(string(r.PolicyID)))
+		}
+	}
+	for _, i := range orderBy(nm.RoutesFirewallRules, routeFirewallKeyWithoutIDs) {
+		r := nm.RoutesFirewallRules[i]
+		if len(r.PolicyID) > 0 {
+			r.PolicyID = []byte(policies.get(string(r.PolicyID)))
+		}
+		r.RouteID = routes.get(r.RouteID)
+	}
+}
+
+// tokenizer maps identifiers to positional placeholders in order of first use.
+type tokenizer struct {
+	prefix string
+	seen   map[string]string
+}
+
+func newTokenizer(prefix string) *tokenizer {
+	return &tokenizer{prefix: prefix, seen: make(map[string]string)}
+}
+
+func (t *tokenizer) get(id string) string {
+	if id == "" {
+		return ""
+	}
+	if tok, ok := t.seen[id]; ok {
+		return tok
+	}
+	tok := fmt.Sprintf("%s#%d", t.prefix, len(t.seen))
+	t.seen[id] = tok
+	return tok
+}
+
+// orderBy returns indices sorted by key, so placeholder numbering does not
+// depend on the identifiers being erased.
+func orderBy[T any](items []T, key func(T) string) []int {
+	idx := make([]int, len(items))
+	for i := range idx {
+		idx[i] = i
+	}
+	sort.SliceStable(idx, func(a, b int) bool { return key(items[idx[a]]) < key(items[idx[b]]) })
+	return idx
+}
+
+func routeKeyWithoutID(r *proto.Route) string {
+	if r == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s|%s|%s|%d|%d|%t|%t|%v",
+		r.Network, r.NetID, r.Peer, r.Metric, r.NetworkType, r.Masquerade, r.KeepRoute, r.Domains)
+}
+
+func firewallKeyWithoutPolicy(r *proto.FirewallRule) string {
+	if r == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s|%d|%d|%d|%s|%s|%v",
+		r.PeerIP, r.Direction, r.Action, r.Protocol, r.Port, portInfoKey(r.PortInfo), r.SourcePrefixes) //nolint:staticcheck
+}
+
+func routeFirewallKeyWithoutIDs(r *proto.RouteFirewallRule) string {
+	if r == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s|%d|%d|%s|%v|%v|%t|%d",
+		r.Destination, r.Protocol, r.Action, portInfoKey(r.PortInfo), r.Domains, r.SourceRanges, r.IsDynamic, r.CustomProtocol)
+}
+
+// canonicalize sorts every repeated field of the NetworkMap by a stable key.
+// The producing paths iterate Go maps while building these slices, so order
+// can differ between runs even when the content is identical; comparing
+// without this reports noise.
+func canonicalize(nm *proto.NetworkMap) {
+	if nm == nil {
+		return
+	}
+	slices.SortFunc(nm.RemotePeers, cmpRemotePeer)
+	slices.SortFunc(nm.OfflinePeers, cmpRemotePeer)
+	slices.SortFunc(nm.Routes, cmpRoute)
+	slices.SortFunc(nm.FirewallRules, cmpFirewallRule)
+	slices.SortFunc(nm.RoutesFirewallRules, cmpRouteFirewallRule)
+
+	for _, r := range nm.FirewallRules {
+		slices.SortFunc(r.SourcePrefixes, bytes.Compare)
+	}
+	for _, r := range nm.RoutesFirewallRules {
+		slices.Sort(r.SourceRanges)
+	}
+	canonicalizeDNSConfig(nm.DNSConfig)
+	canonicalizeSSHAuth(nm.SshAuth)
+}
+
+func canonicalizeDNSConfig(d *proto.DNSConfig) {
+	if d == nil {
+		return
+	}
+	for _, g := range d.NameServerGroups {
+		if g == nil {
+			continue
+		}
+		slices.Sort(g.Domains)
+		slices.SortFunc(g.NameServers, func(a, b *proto.NameServer) int {
+			if a == nil || b == nil {
+				return boolCmp(a == nil, b == nil)
+			}
+			if c := cmp.Compare(a.IP, b.IP); c != 0 {
+				return c
+			}
+			if c := cmp.Compare(a.Port, b.Port); c != 0 {
+				return c
+			}
+			return cmp.Compare(a.NSType, b.NSType)
+		})
+	}
+	slices.SortFunc(d.NameServerGroups, func(a, b *proto.NameServerGroup) int {
+		return cmp.Compare(nsgKey(a), nsgKey(b))
+	})
+	for _, z := range d.CustomZones {
+		if z == nil {
+			continue
+		}
+		slices.SortFunc(z.Records, cmpSimpleRecord)
+	}
+	slices.SortFunc(d.CustomZones, func(a, b *proto.CustomZone) int {
+		if a == nil || b == nil {
+			return boolCmp(a == nil, b == nil)
+		}
+		return cmp.Compare(a.Domain, b.Domain)
+	})
+}
+
+// canonicalizeSSHAuth sorts AuthorizedUsers and re-keys MachineUsers.Indexes
+// against the new ordering, preserving which machine user maps to which hashes.
+func canonicalizeSSHAuth(s *proto.SSHAuth) {
+	if s == nil || len(s.AuthorizedUsers) == 0 {
+		return
+	}
+	type hashed struct {
+		bytes []byte
+		old   uint32
+	}
+	entries := make([]hashed, len(s.AuthorizedUsers))
+	for i, b := range s.AuthorizedUsers {
+		entries[i] = hashed{bytes: b, old: uint32(i)}
+	}
+	slices.SortFunc(entries, func(a, b hashed) int { return bytes.Compare(a.bytes, b.bytes) })
+
+	remap := make(map[uint32]uint32, len(entries))
+	sorted := make([][]byte, len(entries))
+	for newIdx, e := range entries {
+		remap[e.old] = uint32(newIdx)
+		sorted[newIdx] = e.bytes
+	}
+	s.AuthorizedUsers = sorted
+
+	for _, mu := range s.MachineUsers {
+		if mu == nil {
+			continue
+		}
+		for i, oldIdx := range mu.Indexes {
+			if newIdx, ok := remap[oldIdx]; ok {
+				mu.Indexes[i] = newIdx
+			}
+		}
+		slices.Sort(mu.Indexes)
+	}
+}
+
+func boolCmp(a, b bool) int {
+	if a == b {
+		return 0
+	}
+	if a {
+		return 1
+	}
+	return -1
+}
+
+func nsgKey(g *proto.NameServerGroup) string {
+	if g == nil {
+		return ""
+	}
+	var parts []string
+	for _, ns := range g.NameServers {
+		if ns == nil {
+			continue
+		}
+		parts = append(parts, ns.IP+":"+strconv.FormatInt(ns.Port, 10)+":"+strconv.FormatInt(ns.NSType, 10))
+	}
+	slices.Sort(parts)
+	key := strings.Join(parts, ",")
+	domains := append([]string(nil), g.Domains...)
+	slices.Sort(domains)
+	key += "|" + strings.Join(domains, "|")
+	if g.Primary {
+		key += "|P"
+	}
+	if g.SearchDomainsEnabled {
+		key += "|S"
+	}
+	return key
+}
+
+func cmpSimpleRecord(a, b *proto.SimpleRecord) int {
+	if a == nil || b == nil {
+		return boolCmp(a == nil, b == nil)
+	}
+	if c := cmp.Compare(a.Name, b.Name); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Type, b.Type); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Class, b.Class); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.RData, b.RData); c != 0 {
+		return c
+	}
+	return cmp.Compare(a.TTL, b.TTL)
+}
+
+func cmpRemotePeer(a, b *proto.RemotePeerConfig) int {
+	if a == nil || b == nil {
+		return boolCmp(a == nil, b == nil)
+	}
+	return cmp.Compare(a.WgPubKey, b.WgPubKey)
+}
+
+func cmpRoute(a, b *proto.Route) int {
+	if a == nil || b == nil {
+		return boolCmp(a == nil, b == nil)
+	}
+	if c := cmp.Compare(a.ID, b.ID); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.NetID, b.NetID); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Network, b.Network); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Peer, b.Peer); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Metric, b.Metric); c != 0 {
+		return c
+	}
+	return slices.Compare(a.Domains, b.Domains)
+}
+
+func cmpFirewallRule(a, b *proto.FirewallRule) int {
+	if a == nil || b == nil {
+		return boolCmp(a == nil, b == nil)
+	}
+	if c := bytes.Compare(a.PolicyID, b.PolicyID); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.PeerIP, b.PeerIP); c != 0 { //nolint:staticcheck
+		return c
+	}
+	if c := cmp.Compare(int32(a.Direction), int32(b.Direction)); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(int32(a.Action), int32(b.Action)); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Port, b.Port); c != 0 {
+		return c
+	}
+	return cmp.Compare(portInfoKey(a.PortInfo), portInfoKey(b.PortInfo))
+}
+
+func cmpRouteFirewallRule(a, b *proto.RouteFirewallRule) int {
+	if a == nil || b == nil {
+		return boolCmp(a == nil, b == nil)
+	}
+	if c := bytes.Compare(a.PolicyID, b.PolicyID); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.RouteID, b.RouteID); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Destination, b.Destination); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(portInfoKey(a.PortInfo), portInfoKey(b.PortInfo)); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(int32(a.Action), int32(b.Action)); c != 0 {
+		return c
+	}
+	if c := slices.Compare(a.Domains, b.Domains); c != 0 {
+		return c
+	}
+	if c := slices.Compare(a.SourceRanges, b.SourceRanges); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.CustomProtocol, b.CustomProtocol); c != 0 {
+		return c
+	}
+	return boolCmp(a.IsDynamic, b.IsDynamic)
+}
+
+func portInfoKey(pi *proto.PortInfo) string {
+	if pi == nil {
+		return ""
+	}
+	switch sel := pi.PortSelection.(type) {
+	case *proto.PortInfo_Port:
+		return "P" + strconv.FormatUint(uint64(sel.Port), 10)
+	case *proto.PortInfo_Range_:
+		if sel.Range == nil {
+			return "R"
+		}
+		return "R" + strconv.FormatUint(uint64(sel.Range.Start), 10) + "-" + strconv.FormatUint(uint64(sel.Range.End), 10)
+	}
+	return ""
+}
diff --git a/management/internals/controllers/network_map/nmaptest/fixture.go b/management/internals/controllers/network_map/nmaptest/fixture.go
new file mode 100644
index 000000000..d56285f95
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/fixture.go
@@ -0,0 +1,218 @@
+package nmaptest
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net"
+	"os"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+// LoadNetworkMapData reads a fixture holding the NetworkMapData the store
+// would return for one account. Unknown fields are rejected so fixture typos
+// fail loudly instead of silently testing a default.
+func LoadNetworkMapData(path string) (*networkmap.NetworkMapData, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("open fixture: %w", err)
+	}
+	defer f.Close()
+
+	dec := json.NewDecoder(f)
+	dec.DisallowUnknownFields()
+	var nmData networkmap.NetworkMapData
+	if err := dec.Decode(&nmData); err != nil {
+		return nil, fmt.Errorf("decode fixture %s: %w", path, err)
+	}
+	return &nmData, nil
+}
+
+var defaultNetworkNet = func() net.IPNet {
+	_, ipnet, err := net.ParseCIDR("100.64.0.0/10")
+	if err != nil {
+		panic(err)
+	}
+	return *ipnet
+}()
+
+// applyFixtureDefaults fills the boilerplate a fixture may omit. Map-keyed
+// objects inherit their key as ID, peers get a deterministic WG-shaped key
+// and their ID as DNS label, PublicIDs default to the internal ID (the
+// envelope encoder puts public IDs on the wire and silently degrades on
+// empty ones), and a nil ValidatedPeers validates every peer — production
+// fills it through the integrated validator, not the store.
+func applyFixtureDefaults(nmData *networkmap.NetworkMapData) {
+	if nmData.Network == nil {
+		nmData.Network = &nmdata.Network{}
+	}
+	if nmData.Network.Identifier == "" {
+		nmData.Network.Identifier = "network"
+	}
+	if nmData.Network.Net.IP == nil {
+		nmData.Network.Net = defaultNetworkNet
+	}
+	if nmData.AccountSettings == nil {
+		nmData.AccountSettings = &nmdata.AccountSettingsInfo{}
+	}
+	if nmData.DNSSettings == nil {
+		nmData.DNSSettings = &nmdata.DNSSettings{}
+	}
+
+	for id, p := range nmData.Peers {
+		if p == nil {
+			continue
+		}
+		if p.ID == "" {
+			p.ID = id
+		}
+		if p.Key == "" {
+			p.Key = derivedWgKey(p.ID)
+		}
+		if p.DNSLabel == "" {
+			p.DNSLabel = p.ID
+		}
+	}
+
+	for id, g := range nmData.Groups {
+		if g == nil {
+			continue
+		}
+		if g.ID == "" {
+			g.ID = id
+		}
+		if g.Name == "" {
+			g.Name = g.ID
+		}
+		if g.PublicID == "" {
+			g.PublicID = g.ID
+		}
+	}
+
+	for _, policy := range nmData.Policies {
+		defaultPolicyIDs(policy)
+	}
+	resolveResourcePolicyRefs(nmData)
+
+	for _, r := range nmData.Routes {
+		if r != nil && r.PublicID == "" {
+			r.PublicID = r.ID
+		}
+	}
+	for _, nsg := range nmData.NameServerGroups {
+		if nsg != nil && nsg.PublicID == "" {
+			nsg.PublicID = nsg.ID
+		}
+	}
+	for _, res := range nmData.NetworkResources {
+		if res == nil {
+			continue
+		}
+		if res.PublicID == "" {
+			res.PublicID = res.ID
+		}
+		defaultXIDMapping(&nmData.NetworkXIDToPublicID, res.NetworkID)
+	}
+	for networkID, routers := range nmData.Routers {
+		defaultXIDMapping(&nmData.NetworkXIDToPublicID, networkID)
+		for _, router := range routers {
+			if router != nil && router.PublicID == "" {
+				router.PublicID = networkID
+			}
+		}
+	}
+
+	for id, pc := range nmData.PostureChecks {
+		if pc == nil {
+			continue
+		}
+		if pc.ID == "" {
+			pc.ID = id
+		}
+		defaultXIDMapping(&nmData.PostureCheckXIDToPublicID, pc.ID)
+	}
+
+	if nmData.ValidatedPeers == nil {
+		nmData.ValidatedPeers = make(map[string]struct{}, len(nmData.Peers))
+		for id := range nmData.Peers {
+			nmData.ValidatedPeers[id] = struct{}{}
+		}
+	}
+}
+
+// resolveResourcePolicyRefs lets a fixture name an account policy by ID in
+// ResourcePolicies — {"ID": "pol-x"} with no rules — instead of repeating it.
+// The real store puts the same policy pointer in both places, which is what
+// resolving the reference reproduces.
+func resolveResourcePolicyRefs(nmData *networkmap.NetworkMapData) {
+	byID := make(map[string]*nmdata.Policy, len(nmData.Policies))
+	for _, policy := range nmData.Policies {
+		if policy != nil && policy.ID != "" {
+			byID[policy.ID] = policy
+		}
+	}
+
+	for _, policies := range nmData.ResourcePolicies {
+		for i, policy := range policies {
+			if policy == nil {
+				continue
+			}
+			if len(policy.Rules) == 0 {
+				if full, ok := byID[policy.ID]; ok {
+					policies[i] = full
+					continue
+				}
+			}
+			defaultPolicyIDs(policy)
+		}
+	}
+}
+
+func defaultPolicyIDs(policy *nmdata.Policy) {
+	if policy == nil {
+		return
+	}
+	if policy.PublicID == "" {
+		policy.PublicID = policy.ID
+	}
+	for i, rule := range policy.Rules {
+		if rule == nil {
+			continue
+		}
+		if rule.PolicyID == "" {
+			rule.PolicyID = policy.ID
+		}
+		if rule.ID == "" {
+			// Production gives a rule its policy's id (management/server/policy.go:205,
+			// "when policy can contain multiple rules, need refactor"), so a
+			// single-rule policy — the only shape the product can create today —
+			// must be modelled that way or the wire ids come out unrealistic.
+			rule.ID = policy.ID
+			if len(policy.Rules) > 1 {
+				rule.ID = fmt.Sprintf("%s-rule-%d", policy.ID, i)
+			}
+		}
+	}
+}
+
+func defaultXIDMapping(m *map[string]string, id string) {
+	if id == "" {
+		return
+	}
+	if *m == nil {
+		*m = make(map[string]string)
+	}
+	if _, ok := (*m)[id]; !ok {
+		(*m)[id] = id
+	}
+}
+
+// derivedWgKey returns a deterministic base64 key of 32 bytes, valid for the
+// envelope decoder's WG-key identity.
+func derivedWgKey(peerID string) string {
+	sum := sha256.Sum256([]byte(peerID))
+	return base64.StdEncoding.EncodeToString(sum[:])
+}
diff --git a/management/internals/controllers/network_map/nmaptest/golden_test.go b/management/internals/controllers/network_map/nmaptest/golden_test.go
new file mode 100644
index 000000000..75c0d57d2
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/golden_test.go
@@ -0,0 +1,12 @@
+package nmaptest_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/nmaptest"
+)
+
+func TestNetworkMapGolden(t *testing.T) {
+	nmaptest.RunGoldenDir(t, filepath.Join("testdata", "cases"))
+}
diff --git a/management/internals/controllers/network_map/nmaptest/legacyaccount.go b/management/internals/controllers/network_map/nmaptest/legacyaccount.go
new file mode 100644
index 000000000..007eadfdd
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/legacyaccount.go
@@ -0,0 +1,546 @@
+package nmaptest
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/require"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/posture"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/management/server/types/legacynmap"
+	nbroute "github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+	sharedtypes "github.com/netbirdio/netbird/shared/management/types"
+)
+
+// legacyInput is the account and the four derived arguments main's computation
+// took alongside it. The controller resolved them from the account before
+// calling; the twin carries them as fields, so the fixture is the source for
+// both halves.
+type legacyInput struct {
+	account          *types.Account
+	accountZones     []*zones.Zone
+	validatedPeers   map[string]struct{}
+	resourcePolicies map[string][]*types.Policy
+	routers          map[string]map[string]*routerTypes.NetworkRouter
+	groupIDToUserIDs map[string][]string
+}
+
+// legacyInputFromData rebuilds the Account the fixture stands for. A fixture is
+// the value the store returns, and the store's twins carry exactly the state
+// the computation reads, so inverting them reproduces the account main would
+// have loaded — which is what lets one expectation measure all three paths.
+//
+// The inverse is only defined for what a twin carries: fields the builders drop
+// (peer names, policy descriptions, user records behind AllowedUserIDs) come
+// back as the zero value or a minimal stand-in, because no path reads them.
+func legacyInputFromData(accountID string, nmData *networkmap.NetworkMapData) legacyInput {
+	account := &types.Account{
+		Id:               accountID,
+		Network:          accountNetwork(nmData.Network),
+		Settings:         accountSettings(nmData.AccountSettings),
+		DNSSettings:      types.DNSSettings{DisabledManagementGroups: nmData.DNSSettings.DisabledManagementGroups},
+		Peers:            make(map[string]*nbpeer.Peer, len(nmData.Peers)),
+		Groups:           make(map[string]*types.Group, len(nmData.Groups)),
+		Policies:         make([]*types.Policy, 0, len(nmData.Policies)),
+		Routes:           make(map[nbroute.ID]*nbroute.Route, len(nmData.Routes)),
+		NameServerGroups: make(map[string]*nbdns.NameServerGroup, len(nmData.NameServerGroups)),
+		NetworkResources: make([]*resourceTypes.NetworkResource, 0, len(nmData.NetworkResources)),
+		PostureChecks:    make([]*posture.Checks, 0, len(nmData.PostureChecks)),
+		Users:            make(map[string]*types.User, len(nmData.AllowedUserIDs)),
+		Services:         accountServices(nmData.Services),
+	}
+
+	for id, p := range nmData.Peers {
+		account.Peers[id] = accountPeer(id, p)
+	}
+	for id, g := range nmData.Groups {
+		account.Groups[id] = accountGroup(id, g)
+	}
+
+	policiesByID := make(map[string]*types.Policy, len(nmData.Policies))
+	for _, p := range nmData.Policies {
+		policy := accountPolicy(p)
+		if policy == nil {
+			continue
+		}
+		account.Policies = append(account.Policies, policy)
+		policiesByID[policy.ID] = policy
+	}
+
+	for _, r := range nmData.Routes {
+		route := accountRoute(r)
+		if route != nil {
+			account.Routes[route.ID] = route
+		}
+	}
+	for _, nsg := range nmData.NameServerGroups {
+		group := accountNSG(nsg)
+		if group != nil {
+			account.NameServerGroups[group.ID] = group
+		}
+	}
+	for _, res := range nmData.NetworkResources {
+		if resource := accountNetworkResource(res); resource != nil {
+			account.NetworkResources = append(account.NetworkResources, resource)
+		}
+	}
+	for id, pc := range nmData.PostureChecks {
+		if check := accountPostureChecks(id, pc, nmData.PostureCheckXIDToPublicID[id]); check != nil {
+			account.PostureChecks = append(account.PostureChecks, check)
+		}
+	}
+	for xid, publicID := range nmData.NetworkXIDToPublicID {
+		account.Networks = append(account.Networks, &networkTypes.Network{ID: xid, PublicID: publicID})
+	}
+	// The twin keeps only the ids of the users a peer may be shared with; the
+	// legacy side derives the same set from the account's user records, so a
+	// bare non-blocked regular user per id is enough.
+	for userID := range nmData.AllowedUserIDs {
+		account.Users[userID] = &types.User{Id: userID}
+	}
+
+	// Main's network-map controller synthesised the reverse-proxy ACLs onto the
+	// account and only then derived the resource-policy map, so the frozen copy
+	// has to be fed in that order to stand for what main produced.
+	account.Policies = append(account.Policies, legacynmap.SynthesizeProxyPolicies(account)...)
+
+	return legacyInput{
+		account:          account,
+		accountZones:     accountZones(nmData.AppliedZoneCandidates),
+		validatedPeers:   nmData.ValidatedPeers,
+		resourcePolicies: account.GetResourcePoliciesMap(),
+		routers:          accountRouters(nmData.Routers),
+		groupIDToUserIDs: nmData.GroupIDToUserIDs,
+	}
+}
+
+// computeLegacy runs the fixture through main's frozen path and its own proto
+// encoder, the one comparison surface the three modes share.
+func computeLegacy(t *testing.T, ctx context.Context, legacy legacyInput, peerID string, zone nmdata.CustomZone, dnsDomain string, dnsFwdPort int64) *proto.NetworkMap {
+	t.Helper()
+
+	require.NotNil(t, legacy.account, "legacy mode needs an account rebuilt from the fixture")
+	peer := legacy.account.Peers[peerID]
+	require.NotNil(t, peer, "target peer %q not in rebuilt account", peerID)
+
+	nm := legacynmap.GetPeerNetworkMapFromComponents(
+		legacy.account, ctx, peerID, legacyCustomZone(zone), legacy.accountZones, legacy.validatedPeers,
+		legacy.resourcePolicies, legacy.routers, nil, legacy.groupIDToUserIDs,
+	)
+	require.NotNil(t, nm, "legacy path returned no network map for peer %q", peerID)
+
+	return legacynmap.ToProtoNetworkMap(
+		ctx, peer, nm, dnsDomain, legacy.account.Settings, nil, &cache.DNSConfigCache{}, dnsFwdPort,
+	)
+}
+
+// legacyCustomZone converts the peers custom zone the runner computes once for
+// every mode into the shape main's path took.
+func legacyCustomZone(z nmdata.CustomZone) nbdns.CustomZone {
+	zoneRecords := make([]nbdns.SimpleRecord, 0, len(z.Records))
+	for _, r := range z.Records {
+		zoneRecords = append(zoneRecords, nbdns.SimpleRecord{
+			Name:  r.Name,
+			Type:  r.Type,
+			Class: r.Class,
+			TTL:   r.TTL,
+			RData: r.RData,
+		})
+	}
+	return nbdns.CustomZone{
+		Domain:               z.Domain,
+		Records:              zoneRecords,
+		SearchDomainDisabled: z.SearchDomainDisabled,
+		NonAuthoritative:     z.NonAuthoritative,
+	}
+}
+
+func accountNetwork(n *nmdata.Network) *types.Network {
+	if n == nil {
+		return nil
+	}
+	return &types.Network{
+		Identifier: n.Identifier,
+		Net:        n.Net,
+		NetV6:      n.NetV6,
+		Dns:        n.Dns,
+		Serial:     uint64(n.Serial),
+	}
+}
+
+func accountSettings(s *nmdata.AccountSettingsInfo) *types.Settings {
+	if s == nil {
+		return nil
+	}
+	return &types.Settings{
+		PeerLoginExpirationEnabled:      s.PeerLoginExpirationEnabled,
+		PeerLoginExpiration:             s.PeerLoginExpiration,
+		PeerInactivityExpirationEnabled: s.PeerInactivityExpirationEnabled,
+		PeerInactivityExpiration:        s.PeerInactivityExpiration,
+		DNSDomain:                       s.DNSDomain,
+		IPv6EnabledGroups:               s.IPv6EnabledGroups,
+		RoutingPeerDNSResolutionEnabled: s.RoutingPeerDNSResolutionEnabled,
+		LazyConnectionEnabled:           s.LazyConnectionEnabled,
+		AutoUpdateVersion:               s.AutoUpdateVersion,
+		AutoUpdateAlways:                s.AutoUpdateAlways,
+		MetricsPushEnabled:              s.MetricsPushEnabled,
+	}
+}
+
+func accountPeer(id string, p *nmdata.Peer) *nbpeer.Peer {
+	if p == nil {
+		return nil
+	}
+	networkAddresses := make([]nbpeer.NetworkAddress, 0, len(p.Meta.NetworkAddresses))
+	for _, na := range p.Meta.NetworkAddresses {
+		networkAddresses = append(networkAddresses, nbpeer.NetworkAddress{NetIP: na.NetIP})
+	}
+	files := make([]nbpeer.File, 0, len(p.Meta.Files))
+	for _, f := range p.Meta.Files {
+		files = append(files, nbpeer.File{Path: f.Path, ProcessIsRunning: f.ProcessIsRunning})
+	}
+	return &nbpeer.Peer{
+		ID:                     id,
+		Key:                    p.Key,
+		SSHKey:                 p.SSHKey,
+		DNSLabel:               p.DNSLabel,
+		UserID:                 p.UserID,
+		SSHEnabled:             p.SSHEnabled,
+		LoginExpirationEnabled: p.LoginExpirationEnabled,
+		LastLogin:              p.LastLogin,
+		IP:                     p.IP,
+		IPv6:                   p.IPv6,
+		ExtraDNSLabels:         p.ExtraDNSLabels,
+		ProxyMeta:              nbpeer.ProxyMeta{Embedded: p.ProxyMeta.Embedded, Cluster: p.ProxyMeta.Cluster},
+		// Connected is what SynthesizePrivateServiceZones gates its records on,
+		// and a fixture peer stands for a peer the store returned, so it is one
+		// the account would have reported connected.
+		Status: &nbpeer.PeerStatus{RequiresApproval: p.RequiresApproval, Connected: true},
+		Meta: nbpeer.PeerSystemMeta{
+			WtVersion:          p.Meta.WtVersion,
+			GoOS:               p.Meta.GoOS,
+			OSVersion:          p.Meta.OSVersion,
+			KernelVersion:      p.Meta.KernelVersion,
+			NetworkAddresses:   networkAddresses,
+			Files:              files,
+			Capabilities:       p.Meta.Capabilities,
+			SyncMessageVersion: p.Meta.SyncMessageVersion,
+			Flags: nbpeer.Flags{
+				ServerSSHAllowed: p.Meta.Flags.ServerSSHAllowed,
+				DisableIPv6:      p.Meta.Flags.DisableIPv6,
+			},
+		},
+		Location: nbpeer.Location{
+			CountryCode:  p.Location.CountryCode,
+			CityName:     p.Location.CityName,
+			ConnectionIP: p.Location.ConnectionIP,
+		},
+	}
+}
+
+func accountGroup(id string, g *nmdata.Group) *types.Group {
+	if g == nil {
+		return nil
+	}
+	return &types.Group{
+		ID:       id,
+		Name:     g.Name,
+		PublicID: g.PublicID,
+		Peers:    g.Peers,
+	}
+}
+
+func accountPolicy(p *nmdata.Policy) *types.Policy {
+	if p == nil {
+		return nil
+	}
+	rules := make([]*types.PolicyRule, 0, len(p.Rules))
+	for _, r := range p.Rules {
+		if r == nil {
+			continue
+		}
+		var portRanges []sharedtypes.RulePortRange
+		if r.PortRanges != nil {
+			portRanges = make([]sharedtypes.RulePortRange, len(r.PortRanges))
+			for i, pr := range r.PortRanges {
+				portRanges[i] = sharedtypes.RulePortRange{Start: pr.Start, End: pr.End}
+			}
+		}
+		rules = append(rules, &types.PolicyRule{
+			ID:                  r.ID,
+			PolicyID:            r.PolicyID,
+			Enabled:             r.Enabled,
+			Action:              sharedtypes.PolicyTrafficActionType(r.Action),
+			Protocol:            sharedtypes.PolicyRuleProtocolType(r.Protocol),
+			Bidirectional:       r.Bidirectional,
+			Sources:             r.Sources,
+			Destinations:        r.Destinations,
+			SourceResource:      types.Resource{ID: r.SourceResource.ID, Type: sharedtypes.ResourceType(r.SourceResource.Type)},
+			DestinationResource: types.Resource{ID: r.DestinationResource.ID, Type: sharedtypes.ResourceType(r.DestinationResource.Type)},
+			Ports:               r.Ports,
+			PortRanges:          portRanges,
+			AuthorizedGroups:    r.AuthorizedGroups,
+			AuthorizedUser:      r.AuthorizedUser,
+		})
+	}
+	return &types.Policy{
+		ID:                  p.ID,
+		PublicID:            p.PublicID,
+		Enabled:             p.Enabled,
+		SourcePostureChecks: p.SourcePostureChecks,
+		Rules:               rules,
+	}
+}
+
+func accountRoute(r *nmdata.Route) *nbroute.Route {
+	if r == nil {
+		return nil
+	}
+	return &nbroute.Route{
+		ID:                  nbroute.ID(r.ID),
+		AccountID:           r.AccountID,
+		PublicID:            r.PublicID,
+		Network:             r.Network,
+		Domains:             r.Domains,
+		KeepRoute:           r.KeepRoute,
+		NetID:               nbroute.NetID(r.NetID),
+		Description:         r.Description,
+		Peer:                r.Peer,
+		PeerID:              r.PeerID,
+		PeerGroups:          r.PeerGroups,
+		NetworkType:         nbroute.NetworkType(r.NetworkType),
+		Masquerade:          r.Masquerade,
+		Metric:              r.Metric,
+		Enabled:             r.Enabled,
+		Groups:              r.Groups,
+		AccessControlGroups: r.AccessControlGroups,
+		SkipAutoApply:       r.SkipAutoApply,
+	}
+}
+
+func accountNSG(n *nmdata.NameServerGroup) *nbdns.NameServerGroup {
+	if n == nil {
+		return nil
+	}
+	nameServers := make([]nbdns.NameServer, 0, len(n.NameServers))
+	for _, ns := range n.NameServers {
+		nameServers = append(nameServers, nbdns.NameServer{
+			IP:     ns.IP,
+			NSType: nbdns.NameServerType(ns.NSType),
+			Port:   ns.Port,
+		})
+	}
+	return &nbdns.NameServerGroup{
+		ID:                   n.ID,
+		PublicID:             n.PublicID,
+		Name:                 n.Name,
+		Description:          n.Description,
+		NameServers:          nameServers,
+		Groups:               n.Groups,
+		Primary:              n.Primary,
+		Domains:              n.Domains,
+		Enabled:              n.Enabled,
+		SearchDomainsEnabled: n.SearchDomainsEnabled,
+	}
+}
+
+func accountNetworkResource(r *nmdata.NetworkResource) *resourceTypes.NetworkResource {
+	if r == nil {
+		return nil
+	}
+	return &resourceTypes.NetworkResource{
+		ID:          r.ID,
+		NetworkID:   r.NetworkID,
+		AccountID:   r.AccountID,
+		PublicID:    r.PublicID,
+		Name:        r.Name,
+		Description: r.Description,
+		Type:        resourceTypes.NetworkResourceType(r.Type),
+		Address:     r.Address,
+		Domain:      r.Domain,
+		Prefix:      r.Prefix,
+		Enabled:     r.Enabled,
+	}
+}
+
+func accountPostureChecks(id string, pc *nmdata.PostureChecks, publicID string) *posture.Checks {
+	if pc == nil {
+		return nil
+	}
+	out := &posture.Checks{ID: id, PublicID: publicID}
+	def := pc.Checks
+	if def.NBVersionCheck != nil {
+		out.Checks.NBVersionCheck = &posture.NBVersionCheck{MinVersion: def.NBVersionCheck.MinVersion}
+	}
+	if def.OSVersionCheck != nil {
+		oc := &posture.OSVersionCheck{}
+		if def.OSVersionCheck.Android != nil {
+			oc.Android = &posture.MinVersionCheck{MinVersion: def.OSVersionCheck.Android.MinVersion}
+		}
+		if def.OSVersionCheck.Darwin != nil {
+			oc.Darwin = &posture.MinVersionCheck{MinVersion: def.OSVersionCheck.Darwin.MinVersion}
+		}
+		if def.OSVersionCheck.Ios != nil {
+			oc.Ios = &posture.MinVersionCheck{MinVersion: def.OSVersionCheck.Ios.MinVersion}
+		}
+		if def.OSVersionCheck.Linux != nil {
+			oc.Linux = &posture.MinKernelVersionCheck{MinKernelVersion: def.OSVersionCheck.Linux.MinKernelVersion}
+		}
+		if def.OSVersionCheck.Windows != nil {
+			oc.Windows = &posture.MinKernelVersionCheck{MinKernelVersion: def.OSVersionCheck.Windows.MinKernelVersion}
+		}
+		out.Checks.OSVersionCheck = oc
+	}
+	if def.GeoLocationCheck != nil {
+		gc := &posture.GeoLocationCheck{Action: def.GeoLocationCheck.Action}
+		for _, loc := range def.GeoLocationCheck.Locations {
+			gc.Locations = append(gc.Locations, posture.Location{CountryCode: loc.CountryCode, CityName: loc.CityName})
+		}
+		out.Checks.GeoLocationCheck = gc
+	}
+	if def.PeerNetworkRangeCheck != nil {
+		out.Checks.PeerNetworkRangeCheck = &posture.PeerNetworkRangeCheck{
+			Action: def.PeerNetworkRangeCheck.Action,
+			Ranges: def.PeerNetworkRangeCheck.Ranges,
+		}
+	}
+	if def.ProcessCheck != nil {
+		procs := make([]posture.Process, 0, len(def.ProcessCheck.Processes))
+		for _, p := range def.ProcessCheck.Processes {
+			procs = append(procs, posture.Process{LinuxPath: p.LinuxPath, MacPath: p.MacPath, WindowsPath: p.WindowsPath})
+		}
+		out.Checks.ProcessCheck = &posture.ProcessCheck{Processes: procs}
+	}
+	if def.CertificateCheck != nil {
+		out.Checks.CertificateCheck = &posture.CertificateCheck{CACertificates: def.CertificateCheck.CACertificates}
+	}
+	return out
+}
+
+func accountServices(services []*nmdata.Service) []*service.Service {
+	if len(services) == 0 {
+		return nil
+	}
+	out := make([]*service.Service, 0, len(services))
+	for _, svc := range services {
+		if svc == nil {
+			continue
+		}
+		targets := make([]*service.Target, 0, len(svc.Targets))
+		for _, t := range svc.Targets {
+			if t == nil {
+				continue
+			}
+			target := &service.Target{
+				Enabled:    t.Enabled,
+				Port:       t.Port,
+				Protocol:   t.Protocol,
+				TargetId:   t.TargetID,
+				TargetType: service.TargetType(t.TargetType),
+			}
+			if t.Path != "" {
+				path := t.Path
+				target.Path = &path
+			}
+			targets = append(targets, target)
+		}
+		out = append(out, &service.Service{
+			ID:           svc.ID,
+			Enabled:      svc.Enabled,
+			Private:      svc.Private,
+			Mode:         svc.Mode,
+			ProxyCluster: svc.ProxyCluster,
+			AccessGroups: svc.AccessGroups,
+			Targets:      targets,
+		})
+	}
+	return out
+}
+
+// accountZones inverts buildAppliedZoneCandidates. Records come back with the
+// record type the builder mapped them from; a candidate only ever carries the
+// three types it converts.
+func accountZones(candidates []networkmap.AppliedZoneCandidate) []*zones.Zone {
+	if len(candidates) == 0 {
+		return nil
+	}
+	out := make([]*zones.Zone, 0, len(candidates))
+	for _, candidate := range candidates {
+		zoneRecords := make([]*records.Record, 0, len(candidate.Zone.Records))
+		for _, r := range candidate.Zone.Records {
+			recordType, ok := zoneRecordType(r.Type)
+			if !ok {
+				continue
+			}
+			zoneRecords = append(zoneRecords, &records.Record{
+				Name:    strings.TrimSuffix(r.Name, "."),
+				Type:    recordType,
+				Content: r.RData,
+				TTL:     r.TTL,
+			})
+		}
+		out = append(out, &zones.Zone{
+			ID:                 candidate.Zone.Domain,
+			Domain:             strings.TrimSuffix(candidate.Zone.Domain, "."),
+			Enabled:            true,
+			EnableSearchDomain: !candidate.Zone.SearchDomainDisabled,
+			DistributionGroups: candidate.DistributionGroups,
+			Records:            zoneRecords,
+		})
+	}
+	return out
+}
+
+func zoneRecordType(recordType int) (records.RecordType, bool) {
+	switch uint16(recordType) {
+	case dns.TypeA:
+		return records.RecordTypeA, true
+	case dns.TypeAAAA:
+		return records.RecordTypeAAAA, true
+	case dns.TypeCNAME:
+		return records.RecordTypeCNAME, true
+	default:
+		return "", false
+	}
+}
+
+func accountRouters(routers map[string]map[string]*nmdata.NetworkRouter) map[string]map[string]*routerTypes.NetworkRouter {
+	if len(routers) == 0 {
+		return nil
+	}
+	out := make(map[string]map[string]*routerTypes.NetworkRouter, len(routers))
+	for networkID, inner := range routers {
+		converted := make(map[string]*routerTypes.NetworkRouter, len(inner))
+		for peerID, router := range inner {
+			if router == nil {
+				continue
+			}
+			converted[peerID] = &routerTypes.NetworkRouter{
+				NetworkID:  networkID,
+				PublicID:   router.PublicID,
+				Peer:       peerID,
+				PeerGroups: router.PeerGroups,
+				Masquerade: router.Masquerade,
+				Metric:     router.Metric,
+				Enabled:    router.Enabled,
+			}
+		}
+		out[networkID] = converted
+	}
+	return out
+}
diff --git a/management/internals/controllers/network_map/nmaptest/runner.go b/management/internals/controllers/network_map/nmaptest/runner.go
new file mode 100644
index 000000000..b6fc81df6
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/runner.go
@@ -0,0 +1,333 @@
+// Package nmaptest measures network map generation on the dedicated store
+// path against committed expectations. A case stands in for the store load
+// with a NetworkMapData fixture — the value NetworkMapDBStoreImpl returns for
+// one account — then runs the production per-peer pipeline the controller
+// uses, PeersCustomZone → GetPeerNetworkMapComponents → proto conversion, in
+// both wire shapes: the full map (grpc.ToSyncResponse) and the component
+// envelope expanded client-side (grpc.ToComponentSyncResponse →
+// networkmap.EnvelopeToNetworkMap). A third mode inverts the fixture back into
+// the Account it stands for and runs main's frozen path over it (legacynmap),
+// so every case is pinned to what main shipped as well.
+//
+// The expectation files are the point of the framework. They state what the
+// output should be, so a failing case means the code disagrees with the
+// expectation and the answer is normally to fix the code; an expectation
+// changes only through a deliberate reviewed edit. Nothing in this package
+// writes to testdata — there is no flag that records current behaviour into an
+// expectation, because that is how a defect becomes the baseline. Cases whose
+// expectation encodes correct behaviour the code does not yet deliver stay red
+// on purpose.
+//
+// A case lives in testdata/cases/<name>/ as case.json (manifest: description,
+// peers, optional accountID, dnsDomain, modes), nmdata.json (the fixture the
+// mocked store returns, using Go field names; zero values may be omitted and
+// applyFixtureDefaults fills the boilerplate) and golden/<peerID>.json.
+//
+// There is ONE expectation per peer, shared by every mode, because all three
+// must arrive at the same client-facing map. Full and envelope are not even
+// different computations — CalculateNetworkMapFromComponents is
+// components.Calculate and both assemble the proto with the same encode
+// helpers — so the only variable between them is what the envelope round-trip
+// did in transit, and a difference there is a round-trip fidelity defect.
+// Legacy is a different computation, main's, reached from a rebuilt account;
+// a difference there is this tree having drifted from what main shipped.
+// Results are canonicalized before comparison, since repeated proto fields
+// come from map iteration.
+package nmaptest
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/exp/maps"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// Mode selects the wire shape a case is verified through. Both end in a
+// *proto.NetworkMap, the one comparison surface shared by every path.
+type Mode string
+
+const (
+	// ModeFull is the legacy wire shape: the server runs Calculate and sends
+	// the expanded map (grpc.ToSyncResponse).
+	ModeFull Mode = "full"
+	// ModeEnvelope is the component wire shape: the server encodes components
+	// into a NetworkMapEnvelope (grpc.ToComponentSyncResponse) and the map is
+	// expanded the way the client engine does (networkmap.EnvelopeToNetworkMap).
+	ModeEnvelope Mode = "envelope"
+	// ModeLegacy is main's frozen path: the fixture is inverted back into the
+	// Account it stands for and run through legacynmap, the copy of what main
+	// shipped. It is the outside measurement — the other two modes share this
+	// tree's computation, so only this one can catch the whole tree drifting.
+	ModeLegacy Mode = "legacy"
+
+	defaultAccountID = "account"
+	defaultDNSDomain = "netbird.test"
+)
+
+var defaultModes = []Mode{ModeFull, ModeEnvelope, ModeLegacy}
+
+// Case is one nmap-generation scenario: store data for a single account, the
+// peers whose network maps are computed, and the directory holding one expected
+// *proto.NetworkMap per peer — shared by every mode.
+type Case struct {
+	Name      string
+	AccountID string
+	DNSDomain string
+	Peers     []string
+	Modes     []Mode
+	Data      *networkmap.NetworkMapData
+	GoldenDir string
+}
+
+type manifest struct {
+	Description string
+	AccountID   string
+	DNSDomain   string
+	Peers       []string
+	Modes       []Mode
+}
+
+// RunGoldenDir discovers and runs every fixture case under dir. A case is a
+// directory containing case.json (manifest), nmdata.json (store fixture) and
+// golden/<peerID>.json (expected proto.NetworkMap, protojson).
+func RunGoldenDir(t *testing.T, dir string) {
+	t.Helper()
+
+	entries, err := os.ReadDir(dir)
+	require.NoError(t, err, "read cases dir")
+
+	ran := 0
+	for _, entry := range entries {
+		if !entry.IsDir() || strings.HasPrefix(entry.Name(), ".") {
+			continue
+		}
+		caseDir := filepath.Join(dir, entry.Name())
+		c, err := loadCase(caseDir)
+		require.NoError(t, err, "load case %s", entry.Name())
+		ran++
+		t.Run(entry.Name(), func(t *testing.T) {
+			RunCase(t, c)
+		})
+	}
+	require.NotZero(t, ran, "no cases found under %s", dir)
+}
+
+func loadCase(caseDir string) (Case, error) {
+	raw, err := os.ReadFile(filepath.Join(caseDir, "case.json"))
+	if err != nil {
+		return Case{}, fmt.Errorf("read manifest: %w", err)
+	}
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	var m manifest
+	if err := dec.Decode(&m); err != nil {
+		return Case{}, fmt.Errorf("decode manifest: %w", err)
+	}
+
+	data, err := LoadNetworkMapData(filepath.Join(caseDir, "nmdata.json"))
+	if err != nil {
+		return Case{}, err
+	}
+
+	return Case{
+		Name:      filepath.Base(caseDir),
+		AccountID: m.AccountID,
+		DNSDomain: m.DNSDomain,
+		Peers:     m.Peers,
+		Modes:     m.Modes,
+		Data:      data,
+		GoldenDir: filepath.Join(caseDir, "golden"),
+	}, nil
+}
+
+// RunCase computes each target peer's network map through every enabled mode
+// and compares the canonicalized result against the peer's expectation file.
+// It mirrors the controller's store path: fill fixture defaults, precompute
+// posture validation once, then run the per-peer pipeline.
+func RunCase(t *testing.T, c Case) {
+	t.Helper()
+
+	require.NotNil(t, c.Data, "case %s: Data is required", c.Name)
+	require.NotEmpty(t, c.Peers, "case %s: Peers is required", c.Name)
+	require.NotEmpty(t, c.GoldenDir, "case %s: GoldenDir is required", c.Name)
+	if c.AccountID == "" {
+		c.AccountID = defaultAccountID
+	}
+	if c.DNSDomain == "" {
+		c.DNSDomain = defaultDNSDomain
+	}
+	if len(c.Modes) == 0 {
+		c.Modes = defaultModes
+	}
+
+	ctx := context.Background()
+	nmData := c.Data
+	applyFixtureDefaults(nmData)
+	nmData.BuildPrivateServiceCandidates()
+	nmData.PrecomputePostureValidation()
+
+	dnsDomain := c.DNSDomain
+	if nmData.AccountSettings.DNSDomain != "" {
+		dnsDomain = nmData.AccountSettings.DNSDomain
+	}
+
+	zone := networkmap.PeersCustomZone(ctx, c.AccountID, dnsDomain, nmData.Peers, controller.IPv6AllowedPeersFromData(nmData))
+	dnsFwdPort := controller.ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
+
+	for _, mode := range c.Modes {
+		if mode == ModeEnvelope {
+			requireEnvelopeSafeKeys(t, nmData, c.Name)
+			break
+		}
+	}
+
+	// Built before any mode runs: the first per-peer computation injects the
+	// synthesised proxy ACLs into the twin's policies, and the legacy side
+	// synthesises its own, so inverting a twin that already carries them would
+	// hand the legacy path each ACL twice.
+	var legacy legacyInput
+	if slices.Contains(c.Modes, ModeLegacy) {
+		legacy = legacyInputFromData(c.AccountID, nmData)
+	}
+
+	for _, peerID := range c.Peers {
+		peer := nmData.Peers[peerID]
+		require.NotNil(t, peer, "case %s: target peer %q not in fixture", c.Name, peerID)
+
+		for _, mode := range c.Modes {
+			t.Run(peerID+"/"+string(mode), func(t *testing.T) {
+				got := computeMode(t, ctx, mode, nmData, peerID, zone, dnsDomain, dnsFwdPort, legacy)
+				canonicalize(got)
+				compareGolden(t, filepath.Join(c.GoldenDir, peerID+".json"), got, mode)
+			})
+		}
+	}
+}
+
+// computeMode produces the peer's proto.NetworkMap the way the controller does
+// for that wire shape.
+func computeMode(t *testing.T, ctx context.Context, mode Mode, nmData *networkmap.NetworkMapData,
+	peerID string, zone nmdata.CustomZone, dnsDomain string, dnsFwdPort int64, legacy legacyInput) *proto.NetworkMap {
+	t.Helper()
+
+	peer := nmData.Peers[peerID]
+	require.NotNil(t, peer, "target peer %q not in fixture", peerID)
+
+	switch mode {
+	case ModeLegacy:
+		return computeLegacy(t, ctx, legacy, peerID, zone, dnsDomain, dnsFwdPort)
+	case ModeFull:
+		nmap := controller.NetworkMapFromData(ctx, nmData, peerID, zone, nil)
+		return mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, peer, nil, nil, nmap, dnsDomain, nil,
+			&cache.DNSConfigCache{}, nmData.AccountSettings, nil, nil, dnsFwdPort).NetworkMap
+	case ModeEnvelope:
+		components := nmData.GetPeerNetworkMapComponents(peerID, zone)
+		peerGroups := maps.Keys(nmData.GetPeerGroups(peerID))
+		resp := mgmtgrpc.ToComponentSyncResponse(ctx, nil, nil, nil, peer, nil, nil, components,
+			dnsDomain, nil, nmData.AccountSettings, nil, peerGroups, dnsFwdPort)
+		res, err := networkmap.EnvelopeToNetworkMap(ctx, resp.NetworkMapEnvelope, peer.Key, dnsDomain, false)
+		require.NoError(t, err, "expand envelope")
+		return res.NetworkMap
+	default:
+		t.Fatalf("unknown mode %q", mode)
+		return nil
+	}
+}
+
+// requireEnvelopeSafeKeys fails fast on peer keys the envelope decoder would
+// silently drop: it re-keys peers by base64 of the raw 32-byte WG public key.
+func requireEnvelopeSafeKeys(t *testing.T, nmData *networkmap.NetworkMapData, caseName string) {
+	t.Helper()
+	for id, p := range nmData.Peers {
+		if p == nil {
+			continue
+		}
+		raw, err := base64.StdEncoding.DecodeString(p.Key)
+		if err != nil || len(raw) != 32 {
+			t.Fatalf("case %s: peer %q Key must be base64 of 32 bytes for mode %q (the envelope decoder drops it otherwise); use a real WireGuard public key or restrict the case to mode %q",
+				caseName, id, ModeEnvelope, ModeFull)
+		}
+	}
+}
+
+// compareGolden measures got against the committed expectation file. One
+// expectation serves every mode, because the modes run the same computation and
+// must therefore agree. The expectation is the authority: a mismatch means the
+// code does not produce what this case says it should, so it is reported as a
+// failure and not quietly absorbed.
+//
+// The full and legacy modes are compared verbatim, identifiers included, so the
+// expectation pins real ids and stays readable. The envelope mode has
+// identifiers erased on both sides first, because it currently rewrites them —
+// a tracked defect that TestIDSpaceMatches asserts against on its own, so it
+// does not have to drown out every other case here.
+// Nothing here writes to testdata. Expectation files are authored by hand and
+// only ever change through a reviewed edit, so there is no mode in which a run
+// can create or replace one. When a file is missing the computed map is printed
+// for the author to read and, if it is genuinely correct, save deliberately.
+func compareGolden(t *testing.T, path string, got *proto.NetworkMap, mode Mode) {
+	t.Helper()
+
+	if mode == ModeEnvelope {
+		normalizeIDSpace(got)
+		canonicalize(got)
+	}
+
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		rendered, mErr := renderNetworkMap(got)
+		require.NoError(t, mErr)
+		t.Fatalf("no expectation file %s: %v\nThis case has nothing to measure against — write the "+
+			"proto.NetworkMap this peer should receive. Mode %s currently produces:\n%s\nRead it before "+
+			"saving any of it: if the code is wrong, so is this.", path, err, mode, rendered)
+	}
+	want := &proto.NetworkMap{}
+	require.NoError(t, protojson.Unmarshal(raw, want), "parse expectation %s", path)
+	canonicalize(want)
+	if mode == ModeEnvelope {
+		normalizeIDSpace(want)
+		canonicalize(want)
+	}
+
+	if diff := cmp.Diff(want, got, protocmp.Transform()); diff != "" {
+		t.Errorf("mode %s does not produce what %s expects (-want +got):\n%s\n"+
+			"Every mode has to deliver the same client-facing map for the same account state. "+
+			"The expectation file is the committed statement of correct output — fix the code, or change the "+
+			"expectation deliberately if the intended behaviour really moved.", mode, path, diff)
+	}
+}
+
+// renderNetworkMap renders stable protojson: protojson output whitespace is
+// deliberately unstable, so it is reformatted through json.Indent.
+func renderNetworkMap(nm *proto.NetworkMap) ([]byte, error) {
+	raw, err := protojson.Marshal(nm)
+	if err != nil {
+		return nil, err
+	}
+	var buf bytes.Buffer
+	if err := json.Indent(&buf, raw, "", "  "); err != nil {
+		return nil, err
+	}
+	buf.WriteByte('\n')
+	return buf.Bytes(), nil
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/case.json
new file mode 100644
index 000000000..4747e9640
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/case.json
@@ -0,0 +1,7 @@
+{
+  "description": "Two groups joined by one allow-all policy; peer-c has SSH enabled so the legacy-SSH path fills SshAuth from AllowedUserIDs.",
+  "peers": [
+    "peer-a",
+    "peer-c"
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/golden/peer-a.json
new file mode 100644
index 000000000..e2b69276c
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/golden/peer-a.json
@@ -0,0 +1,65 @@
+{
+  "Serial": "5",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "4deEImv8zGvsyBmmfC2G0eQkbyMzyGuz/YK7pcYETwM=",
+      "allowedIps": [
+        "100.64.0.3/32"
+      ],
+      "sshConfig": {
+        "sshPubKey": "c3NoLXBlZXItYw=="
+      },
+      "fqdn": "peer-c.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-c.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.3",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLWFsbA=="
+    },
+    {
+      "PeerIP": "100.64.0.3",
+      "Direction": "OUT",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLWFsbA=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/golden/peer-c.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/golden/peer-c.json
new file mode 100644
index 000000000..4c358b163
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/golden/peer-c.json
@@ -0,0 +1,102 @@
+{
+  "Serial": "5",
+  "peerConfig": {
+    "address": "100.64.0.3/10",
+    "sshConfig": {
+      "sshEnabled": true
+    },
+    "fqdn": "peer-c.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
+      "allowedIps": [
+        "100.64.0.2/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-b.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          },
+          {
+            "Name": "peer-c.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLWFsbA=="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLWFsbA=="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLWFsbA=="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Direction": "OUT",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLWFsbA=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub",
+    "AuthorizedUsers": [
+      "u9dHvAXZJKiXITuwP9jD/A=="
+    ],
+    "machineUsers": {
+      "*": {
+        "indexes": [
+          0
+        ]
+      }
+    }
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/nmdata.json
new file mode 100644
index 000000000..7d78e5c61
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/nmdata.json
@@ -0,0 +1,31 @@
+{
+  "Network": {"Serial": 5},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-c": {"IP": "100.64.0.3", "SSHEnabled": true, "SSHKey": "ssh-peer-c", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a", "peer-b"]},
+    "grp-ops": {"Peers": ["peer-c"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-all",
+      "PublicID": "pol-all-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "all",
+          "Bidirectional": true,
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-ops"]
+        }
+      ]
+    }
+  ],
+  "AllowedUserIDs": {"user-ops": {}}
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/case.json
new file mode 100644
index 000000000..e4c46c63d
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/case.json
@@ -0,0 +1,7 @@
+{
+  "description": "Nameserver group and applied custom zones distributed to grp-dev; peer-a (with an extra DNS label) receives them, peer-c is outside that group and receives only the zone distributed to grp-ops. Zone flags travel per zone: both grp-dev zones are match-only (NonAuthoritative), only search-off.internal. disables the search domain, and the built-in peer zone stays authoritative.",
+  "peers": [
+    "peer-a",
+    "peer-c"
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/golden/peer-a.json
new file mode 100644
index 000000000..f06a19d9d
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/golden/peer-a.json
@@ -0,0 +1,115 @@
+{
+  "Serial": "8",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
+      "allowedIps": [
+        "100.64.0.2/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-b.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "NameServerGroups": [
+      {
+        "NameServers": [
+          {
+            "IP": "8.8.8.8",
+            "Port": "53"
+          }
+        ],
+        "Primary": true
+      }
+    ],
+    "CustomZones": [
+      {
+        "Domain": "corp.internal.",
+        "NonAuthoritative": true,
+        "Records": [
+          {
+            "Name": "db.corp.internal.",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "10.10.0.5"
+          }
+        ]
+      },
+      {
+        "Domain": "search-off.internal.",
+        "SearchDomainDisabled": true,
+        "NonAuthoritative": true,
+        "Records": [
+          {
+            "Name": "alias.search-off.internal.",
+            "Type": "5",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "app.search-off.internal."
+          },
+          {
+            "Name": "app.search-off.internal.",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "10.10.0.6"
+          }
+        ]
+      },
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          },
+          {
+            "Name": "www.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.2",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLW1lc2g="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Direction": "OUT",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLW1lc2g="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/golden/peer-c.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/golden/peer-c.json
new file mode 100644
index 000000000..7e04dca40
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/golden/peer-c.json
@@ -0,0 +1,47 @@
+{
+  "Serial": "8",
+  "peerConfig": {
+    "address": "100.64.0.3/10",
+    "sshConfig": {},
+    "fqdn": "peer-c.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-c.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          }
+        ]
+      },
+      {
+        "Domain": "ops-only.internal.",
+        "NonAuthoritative": true,
+        "Records": [
+          {
+            "Name": "tool.ops-only.internal.",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "10.10.0.7"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/nmdata.json
new file mode 100644
index 000000000..b9741ef16
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/nmdata.json
@@ -0,0 +1,74 @@
+{
+  "Network": {"Serial": 8},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "ExtraDNSLabels": ["www"], "Meta": {"WtVersion": "0.60.0"}},
+    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-c": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a", "peer-b"]},
+    "grp-ops": {"Peers": ["peer-c"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-mesh",
+      "PublicID": "pol-mesh-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "all",
+          "Bidirectional": true,
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-dev"]
+        }
+      ]
+    }
+  ],
+  "NameServerGroups": [
+    {
+      "ID": "nsg-1",
+      "Name": "dns-primary",
+      "NameServers": [{"IP": "8.8.8.8", "Port": 53}],
+      "Groups": ["grp-dev"],
+      "Primary": true,
+      "Enabled": true
+    }
+  ],
+  "AppliedZoneCandidates": [
+    {
+      "DistributionGroups": ["grp-dev"],
+      "Zone": {
+        "Domain": "corp.internal.",
+        "NonAuthoritative": true,
+        "Records": [
+          {"Name": "db.corp.internal.", "Type": 1, "Class": "IN", "TTL": 300, "RData": "10.10.0.5"}
+        ]
+      }
+    },
+    {
+      "DistributionGroups": ["grp-dev"],
+      "Zone": {
+        "Domain": "search-off.internal.",
+        "NonAuthoritative": true,
+        "SearchDomainDisabled": true,
+        "Records": [
+          {"Name": "app.search-off.internal.", "Type": 1, "Class": "IN", "TTL": 300, "RData": "10.10.0.6"},
+          {"Name": "alias.search-off.internal.", "Type": 5, "Class": "IN", "TTL": 300, "RData": "app.search-off.internal."}
+        ]
+      }
+    },
+    {
+      "DistributionGroups": ["grp-ops"],
+      "Zone": {
+        "Domain": "ops-only.internal.",
+        "NonAuthoritative": true,
+        "Records": [
+          {"Name": "tool.ops-only.internal.", "Type": 1, "Class": "IN", "TTL": 300, "RData": "10.10.0.7"}
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/case.json
new file mode 100644
index 000000000..a5776d0e7
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Domain network resource: the route carries the domain list and the 192.0.2.0/32 placeholder network with NetworkType 3 (dynamic), and peer-r's route firewall rules must be marked dynamic and repeat the domain. Two ports on the policy must produce one rule per port. A domain resource contributes no DNS custom zone of its own — resolution happens through the routing peer's forwarder.",
+  "peers": ["peer-a", "peer-r"]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/golden/peer-a.json
new file mode 100644
index 000000000..f83e7a2f2
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/golden/peer-a.json
@@ -0,0 +1,59 @@
+{
+  "Serial": "22",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "allowedIps": [
+        "100.64.0.9/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-domain:peer-r",
+      "Network": "192.0.2.0/32",
+      "NetworkType": "3",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "app-domain",
+      "Domains": [
+        "app.internal"
+      ],
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/golden/peer-r.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/golden/peer-r.json
new file mode 100644
index 000000000..41ae3dd33
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/golden/peer-r.json
@@ -0,0 +1,92 @@
+{
+  "Serial": "22",
+  "peerConfig": {
+    "address": "100.64.0.9/10",
+    "sshConfig": {},
+    "fqdn": "peer-r.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-domain:peer-r",
+      "Network": "192.0.2.0/32",
+      "NetworkType": "3",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "app-domain",
+      "Domains": [
+        "app.internal"
+      ],
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRules": [
+    {
+      "sourceRanges": [
+        "100.64.0.1/32"
+      ],
+      "destination": "192.0.2.0/32",
+      "protocol": "TCP",
+      "portInfo": {
+        "port": 443
+      },
+      "isDynamic": true,
+      "domains": [
+        "app.internal"
+      ],
+      "PolicyID": "cG9sLWFwcA==",
+      "RouteID": "res-domain:peer-r"
+    },
+    {
+      "sourceRanges": [
+        "100.64.0.1/32"
+      ],
+      "destination": "192.0.2.0/32",
+      "protocol": "TCP",
+      "portInfo": {
+        "port": 80
+      },
+      "isDynamic": true,
+      "domains": [
+        "app.internal"
+      ],
+      "PolicyID": "cG9sLWFwcA==",
+      "RouteID": "res-domain:peer-r"
+    }
+  ],
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/nmdata.json
new file mode 100644
index 000000000..db6dc8eda
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/nmdata.json
@@ -0,0 +1,43 @@
+{
+  "Network": {"Serial": 22},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-app",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["80", "443"],
+          "Sources": ["grp-dev"],
+          "DestinationResource": {"ID": "res-domain", "Type": "domain"}
+        }
+      ]
+    }
+  ],
+  "ResourcePolicies": {"res-domain": [{"ID": "pol-app"}]},
+  "NetworkResources": [
+    {
+      "ID": "res-domain",
+      "NetworkID": "net-1",
+      "Name": "app-domain",
+      "Type": "domain",
+      "Domain": "app.internal",
+      "Enabled": true
+    }
+  ],
+  "Routers": {
+    "net-1": {
+      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
+    }
+  }
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/case.json
new file mode 100644
index 000000000..fa1e5c24b
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Host network resource (single /32) behind one directly-assigned router. peer-a is in the resource policy's source group and must receive one route to 10.10.0.7/32 via peer-r with KeepRoute set and NetID taken from the resource name; peer-r as the router must receive the same route plus a route firewall rule whose SourceRanges are the policy's source peers. A client never gets route firewall rules.",
+  "peers": ["peer-a", "peer-r"]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/golden/peer-a.json
new file mode 100644
index 000000000..8bf83f20e
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/golden/peer-a.json
@@ -0,0 +1,56 @@
+{
+  "Serial": "20",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "allowedIps": [
+        "100.64.0.9/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-host:peer-r",
+      "Network": "10.10.0.7/32",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "web-host",
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/golden/peer-r.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/golden/peer-r.json
new file mode 100644
index 000000000..ef3b5a6c8
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/golden/peer-r.json
@@ -0,0 +1,69 @@
+{
+  "Serial": "20",
+  "peerConfig": {
+    "address": "100.64.0.9/10",
+    "sshConfig": {},
+    "fqdn": "peer-r.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-host:peer-r",
+      "Network": "10.10.0.7/32",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "web-host",
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRules": [
+    {
+      "sourceRanges": [
+        "100.64.0.1/32"
+      ],
+      "destination": "10.10.0.7/32",
+      "protocol": "TCP",
+      "portInfo": {
+        "port": 443
+      },
+      "PolicyID": "cG9sLXdlYg==",
+      "RouteID": "res-host:peer-r"
+    }
+  ],
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/nmdata.json
new file mode 100644
index 000000000..fdd35a439
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/nmdata.json
@@ -0,0 +1,43 @@
+{
+  "Network": {"Serial": 20},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-web",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["443"],
+          "Sources": ["grp-dev"],
+          "DestinationResource": {"ID": "res-host", "Type": "host"}
+        }
+      ]
+    }
+  ],
+  "ResourcePolicies": {"res-host": [{"ID": "pol-web"}]},
+  "NetworkResources": [
+    {
+      "ID": "res-host",
+      "NetworkID": "net-1",
+      "Name": "web-host",
+      "Type": "host",
+      "Prefix": "10.10.0.7/32",
+      "Enabled": true
+    }
+  ],
+  "Routers": {
+    "net-1": {
+      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
+    }
+  }
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/case.json
new file mode 100644
index 000000000..ca54a4b81
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "A disabled resource with a valid policy and router must leave no trace: no routes and no route firewall rules for either the client or the router. Disabling a resource is the switch that revokes access without deleting the policy.",
+  "peers": ["peer-a", "peer-r"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/golden/peer-a.json
new file mode 100644
index 000000000..a4f5a92bb
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/golden/peer-a.json
@@ -0,0 +1,34 @@
+{
+  "Serial": "25",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/golden/peer-r.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/golden/peer-r.json
new file mode 100644
index 000000000..b83cfdff6
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/golden/peer-r.json
@@ -0,0 +1,34 @@
+{
+  "Serial": "25",
+  "peerConfig": {
+    "address": "100.64.0.9/10",
+    "sshConfig": {},
+    "fqdn": "peer-r.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/nmdata.json
new file mode 100644
index 000000000..43e00a2db
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/nmdata.json
@@ -0,0 +1,42 @@
+{
+  "Network": {"Serial": 25},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-off-resource",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["443"],
+          "Sources": ["grp-dev"],
+          "DestinationResource": {"ID": "res-disabled", "Type": "subnet"}
+        }
+      ]
+    }
+  ],
+  "ResourcePolicies": {"res-disabled": [{"ID": "pol-off-resource"}]},
+  "NetworkResources": [
+    {
+      "ID": "res-disabled",
+      "NetworkID": "net-1",
+      "Name": "disabled-subnet",
+      "Type": "subnet",
+      "Prefix": "10.50.0.0/24"
+    }
+  ],
+  "Routers": {
+    "net-1": {
+      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
+    }
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/case.json
new file mode 100644
index 000000000..494ac0fce
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "An enabled resource with a healthy router but no policy granting access to it must produce nothing anywhere: no route for the client and none for the router either, since access to a resource is only ever created by a policy. The router also gets no route firewall rules despite being a routing peer for the network.",
+  "peers": ["peer-a", "peer-r"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/golden/peer-a.json
new file mode 100644
index 000000000..32f9cf35e
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/golden/peer-a.json
@@ -0,0 +1,34 @@
+{
+  "Serial": "24",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/golden/peer-r.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/golden/peer-r.json
new file mode 100644
index 000000000..a97eac9a3
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/golden/peer-r.json
@@ -0,0 +1,34 @@
+{
+  "Serial": "24",
+  "peerConfig": {
+    "address": "100.64.0.9/10",
+    "sshConfig": {},
+    "fqdn": "peer-r.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/nmdata.json
new file mode 100644
index 000000000..a3bbf299a
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/nmdata.json
@@ -0,0 +1,26 @@
+{
+  "Network": {"Serial": 24},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]}
+  },
+  "NetworkResources": [
+    {
+      "ID": "res-orphan",
+      "NetworkID": "net-1",
+      "Name": "orphan-subnet",
+      "Type": "subnet",
+      "Prefix": "10.40.0.0/24",
+      "Enabled": true
+    }
+  ],
+  "Routers": {
+    "net-1": {
+      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
+    }
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/case.json
new file mode 100644
index 000000000..2922a5deb
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "A DISABLED policy granting access to a network resource must grant nothing: no route to 10.90.0.0/24 for peer-a and none for the router either, exactly as if the policy were absent. THE FULL EXPECTATION CURRENTLY FAILS, and should: resource-policy selection never checks policy.Enabled (networkmapcompute.go and networkmap_components.go both test only nil/len(Rules)/Rules[0]), so the legacy path still hands out the route — access survives disabling the policy. The envelope path happens to be correct because the encoder drops disabled policies from the wire. Fix the compute path, do not weaken this expectation.",
+  "peers": ["peer-a", "peer-r"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/golden/peer-a.json
new file mode 100644
index 000000000..92ba75b1e
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/golden/peer-a.json
@@ -0,0 +1,34 @@
+{
+  "Serial": "39",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/golden/peer-r.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/golden/peer-r.json
new file mode 100644
index 000000000..8c27320ee
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/golden/peer-r.json
@@ -0,0 +1,34 @@
+{
+  "Serial": "39",
+  "peerConfig": {
+    "address": "100.64.0.9/10",
+    "sshConfig": {},
+    "fqdn": "peer-r.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/nmdata.json
new file mode 100644
index 000000000..be7251712
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/nmdata.json
@@ -0,0 +1,42 @@
+{
+  "Network": {"Serial": 39},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-revoked",
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["5432"],
+          "Sources": ["grp-dev"],
+          "DestinationResource": {"ID": "res-db", "Type": "subnet"}
+        }
+      ]
+    }
+  ],
+  "ResourcePolicies": {"res-db": [{"ID": "pol-revoked"}]},
+  "NetworkResources": [
+    {
+      "ID": "res-db",
+      "NetworkID": "net-1",
+      "Name": "db-subnet",
+      "Type": "subnet",
+      "Prefix": "10.90.0.0/24",
+      "Enabled": true
+    }
+  ],
+  "Routers": {
+    "net-1": {
+      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
+    }
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/case.json
new file mode 100644
index 000000000..de1027d48
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "The routing peer for the resource is not in ValidatedPeers — an unapproved peer, which the integrated validator withholds. peer-a must therefore receive no route through it and must not see it as a peer at all: traffic may not be routed through a peer the account has not approved. THE ENVELOPE EXPECTATION CURRENTLY FAILS, and should: component selection puts every routing peer into RouterPeers without checking validation, the encoder indexes them into the envelope's peer table, and the client decoder puts every peer it finds back into its peer map, so the unapproved router reappears client-side with a working route. The full path drops it correctly. Fix the component/encoder path, do not weaken this expectation.",
+  "peers": ["peer-a"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/golden/peer-a.json
new file mode 100644
index 000000000..2554fc08c
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/golden/peer-a.json
@@ -0,0 +1,34 @@
+{
+  "Serial": "40",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/nmdata.json
new file mode 100644
index 000000000..98ba94471
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/nmdata.json
@@ -0,0 +1,44 @@
+{
+  "Network": {"Serial": 40},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "ValidatedPeers": {"peer-a": {}},
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-db",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["5432"],
+          "Sources": ["grp-dev"],
+          "DestinationResource": {"ID": "res-db", "Type": "subnet"}
+        }
+      ]
+    }
+  ],
+  "ResourcePolicies": {"res-db": [{"ID": "pol-db"}]},
+  "NetworkResources": [
+    {
+      "ID": "res-db",
+      "NetworkID": "net-1",
+      "Name": "db-subnet",
+      "Type": "subnet",
+      "Prefix": "10.100.0.0/24",
+      "Enabled": true
+    }
+  ],
+  "Routers": {
+    "net-1": {
+      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
+    }
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/case.json
new file mode 100644
index 000000000..8ec63c816
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Routing peer group: one router record assigned to a peer group, which the store expands into one entry per member peer sharing the router's settings. peer-a must receive one route per routing peer — same NetID and destination, different route ID and peer — which is what gives the client an HA pair to choose between. Each router must receive only its own route, never its sibling's, plus its own route firewall rule.",
+  "peers": ["peer-a", "peer-r1", "peer-r2"]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-a.json
new file mode 100644
index 000000000..020c34835
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-a.json
@@ -0,0 +1,75 @@
+{
+  "Serial": "23",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "Iu6Lj1HqDXfgDh5RppHCRI6RO3lMlZBCndRNrdS7QUI=",
+      "allowedIps": [
+        "100.64.0.11/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r1.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "YC6sbWtvpB2d6W/XqsNIV9crsrXBoVDdwmhCoszjCps=",
+      "allowedIps": [
+        "100.64.0.12/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r2.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-ha:peer-r1",
+      "Network": "10.30.0.0/24",
+      "NetworkType": "1",
+      "Peer": "Iu6Lj1HqDXfgDh5RppHCRI6RO3lMlZBCndRNrdS7QUI=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "ha-subnet",
+      "keepRoute": true
+    },
+    {
+      "ID": "res-ha:peer-r2",
+      "Network": "10.30.0.0/24",
+      "NetworkType": "1",
+      "Peer": "YC6sbWtvpB2d6W/XqsNIV9crsrXBoVDdwmhCoszjCps=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "ha-subnet",
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-r1.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-r1.json
new file mode 100644
index 000000000..e42214ca8
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-r1.json
@@ -0,0 +1,69 @@
+{
+  "Serial": "23",
+  "peerConfig": {
+    "address": "100.64.0.11/10",
+    "sshConfig": {},
+    "fqdn": "peer-r1.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-ha:peer-r1",
+      "Network": "10.30.0.0/24",
+      "NetworkType": "1",
+      "Peer": "Iu6Lj1HqDXfgDh5RppHCRI6RO3lMlZBCndRNrdS7QUI=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "ha-subnet",
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-r1.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.11"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRules": [
+    {
+      "sourceRanges": [
+        "100.64.0.1/32"
+      ],
+      "destination": "10.30.0.0/24",
+      "protocol": "TCP",
+      "portInfo": {
+        "port": 5432
+      },
+      "PolicyID": "cG9sLWhh",
+      "RouteID": "res-ha:peer-r1"
+    }
+  ],
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-r2.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-r2.json
new file mode 100644
index 000000000..2560742fb
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-r2.json
@@ -0,0 +1,69 @@
+{
+  "Serial": "23",
+  "peerConfig": {
+    "address": "100.64.0.12/10",
+    "sshConfig": {},
+    "fqdn": "peer-r2.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-ha:peer-r2",
+      "Network": "10.30.0.0/24",
+      "NetworkType": "1",
+      "Peer": "YC6sbWtvpB2d6W/XqsNIV9crsrXBoVDdwmhCoszjCps=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "ha-subnet",
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-r2.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.12"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRules": [
+    {
+      "sourceRanges": [
+        "100.64.0.1/32"
+      ],
+      "destination": "10.30.0.0/24",
+      "protocol": "TCP",
+      "portInfo": {
+        "port": 5432
+      },
+      "PolicyID": "cG9sLWhh",
+      "RouteID": "res-ha:peer-r2"
+    }
+  ],
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/nmdata.json
new file mode 100644
index 000000000..03937cb14
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/nmdata.json
@@ -0,0 +1,46 @@
+{
+  "Network": {"Serial": 23},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r1": {"IP": "100.64.0.11", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r2": {"IP": "100.64.0.12", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]},
+    "grp-routers": {"Peers": ["peer-r1", "peer-r2"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-ha",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["5432"],
+          "Sources": ["grp-dev"],
+          "DestinationResource": {"ID": "res-ha", "Type": "subnet"}
+        }
+      ]
+    }
+  ],
+  "ResourcePolicies": {"res-ha": [{"ID": "pol-ha"}]},
+  "NetworkResources": [
+    {
+      "ID": "res-ha",
+      "NetworkID": "net-ha",
+      "Name": "ha-subnet",
+      "Type": "subnet",
+      "Prefix": "10.30.0.0/24",
+      "Enabled": true
+    }
+  ],
+  "Routers": {
+    "net-ha": {
+      "peer-r1": {"PublicID": "router-ha", "PeerGroups": ["grp-routers"], "Masquerade": true, "Metric": 9999, "Enabled": true},
+      "peer-r2": {"PublicID": "router-ha", "PeerGroups": ["grp-routers"], "Masquerade": true, "Metric": 9999, "Enabled": true}
+    }
+  }
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/case.json
new file mode 100644
index 000000000..16cfedf34
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Subnet network resource behind one directly-assigned router, with masquerade off and a non-default metric so both reach the wire verbatim, and an all-protocol policy from a two-peer source group. peer-r's route firewall rule must list both source peers; peer-b confirms a second client in the same group gets its own identical route.",
+  "peers": ["peer-a", "peer-b", "peer-r"]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-a.json
new file mode 100644
index 000000000..a5bc8f880
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-a.json
@@ -0,0 +1,55 @@
+{
+  "Serial": "21",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "allowedIps": [
+        "100.64.0.9/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-subnet:peer-r",
+      "Network": "10.20.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "500",
+      "NetID": "office-subnet",
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-b.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-b.json
new file mode 100644
index 000000000..01c31edf6
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-b.json
@@ -0,0 +1,55 @@
+{
+  "Serial": "21",
+  "peerConfig": {
+    "address": "100.64.0.2/10",
+    "sshConfig": {},
+    "fqdn": "peer-b.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "allowedIps": [
+        "100.64.0.9/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-subnet:peer-r",
+      "Network": "10.20.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "500",
+      "NetID": "office-subnet",
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-r.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-r.json
new file mode 100644
index 000000000..39a29125d
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-r.json
@@ -0,0 +1,76 @@
+{
+  "Serial": "21",
+  "peerConfig": {
+    "address": "100.64.0.9/10",
+    "sshConfig": {},
+    "fqdn": "peer-r.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
+      "allowedIps": [
+        "100.64.0.2/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-b.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-subnet:peer-r",
+      "Network": "10.20.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "500",
+      "NetID": "office-subnet",
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRules": [
+    {
+      "sourceRanges": [
+        "100.64.0.1/32",
+        "100.64.0.2/32"
+      ],
+      "destination": "10.20.0.0/24",
+      "protocol": "ALL",
+      "portInfo": {},
+      "PolicyID": "cG9sLXN1Ym5ldA==",
+      "RouteID": "res-subnet:peer-r"
+    }
+  ],
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/nmdata.json
new file mode 100644
index 000000000..ba27f494c
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/nmdata.json
@@ -0,0 +1,43 @@
+{
+  "Network": {"Serial": 21},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a", "peer-b"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-subnet",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "all",
+          "Sources": ["grp-dev"],
+          "DestinationResource": {"ID": "res-subnet", "Type": "subnet"}
+        }
+      ]
+    }
+  ],
+  "ResourcePolicies": {"res-subnet": [{"ID": "pol-subnet"}]},
+  "NetworkResources": [
+    {
+      "ID": "res-subnet",
+      "NetworkID": "net-1",
+      "Name": "office-subnet",
+      "Type": "subnet",
+      "Prefix": "10.20.0.0/24",
+      "Enabled": true
+    }
+  ],
+  "Routers": {
+    "net-1": {
+      "peer-r": {"PublicID": "router-direct", "Metric": 500, "Enabled": true}
+    }
+  }
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/case.json
new file mode 100644
index 000000000..cdf31c413
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/case.json
@@ -0,0 +1,5 @@
+{
+  "description": "A peer named directly as a rule source or destination is subject to approval exactly like a group member: unvalidated peer-b is neither a source for peer-c nor a destination for peer-a, while the validated direct source peer-a reaches peer-c. Legacy mode is excluded: the frozen legacynmap copy still carries the direct-peer bypass.",
+  "peers": ["peer-a", "peer-c"],
+  "modes": ["full", "envelope"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/golden/peer-a.json
new file mode 100644
index 000000000..e0605525f
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/golden/peer-a.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "22",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "4deEImv8zGvsyBmmfC2G0eQkbyMzyGuz/YK7pcYETwM=",
+      "allowedIps": [
+        "100.64.0.3/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-c.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-c.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.3",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRpcmVjdC1vaw=="
+    },
+    {
+      "PeerIP": "100.64.0.3",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRpcmVjdC1vaw=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/golden/peer-c.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/golden/peer-c.json
new file mode 100644
index 000000000..f2b3e9357
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/golden/peer-c.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "22",
+  "peerConfig": {
+    "address": "100.64.0.3/10",
+    "sshConfig": {},
+    "fqdn": "peer-c.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-c.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRpcmVjdC1vaw=="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRpcmVjdC1vaw=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/nmdata.json
new file mode 100644
index 000000000..283df304c
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-direct-peer-unvalidated/nmdata.json
@@ -0,0 +1,63 @@
+{
+  "Network": {"Serial": 22},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-c": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "ValidatedPeers": {"peer-a": {}, "peer-c": {}},
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]},
+    "grp-ops": {"Peers": ["peer-c"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-direct-ok",
+      "PublicID": "pol-direct-ok-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["443"],
+          "Bidirectional": true,
+          "SourceResource": {"ID": "peer-a", "Type": "peer"},
+          "Destinations": ["grp-ops"]
+        }
+      ]
+    },
+    {
+      "ID": "pol-src-unval",
+      "PublicID": "pol-src-unval-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["8443"],
+          "Bidirectional": true,
+          "SourceResource": {"ID": "peer-b", "Type": "peer"},
+          "Destinations": ["grp-ops"]
+        }
+      ]
+    },
+    {
+      "ID": "pol-dst-unval",
+      "PublicID": "pol-dst-unval-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["9443"],
+          "Bidirectional": true,
+          "Sources": ["grp-dev"],
+          "DestinationResource": {"ID": "peer-b", "Type": "peer"}
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/case.json
new file mode 100644
index 000000000..39c477b9f
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Direct peer-to-peer policy via Source/DestinationResource of type peer, no groups involved; peer-a and peer-b see each other, bystander peer-c sees nobody.",
+  "peers": ["peer-a", "peer-b", "peer-c"]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-a.json
new file mode 100644
index 000000000..4d59c33bb
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-a.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "15",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
+      "allowedIps": [
+        "100.64.0.2/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-b.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.2",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRpcmVjdA=="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRpcmVjdA=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-b.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-b.json
new file mode 100644
index 000000000..59b4bd24c
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-b.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "15",
+  "peerConfig": {
+    "address": "100.64.0.2/10",
+    "sshConfig": {},
+    "fqdn": "peer-b.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRpcmVjdA=="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRpcmVjdA=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-c.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-c.json
new file mode 100644
index 000000000..9ff24ce1a
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-c.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "15",
+  "peerConfig": {
+    "address": "100.64.0.3/10",
+    "sshConfig": {},
+    "fqdn": "peer-c.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-c.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/nmdata.json
new file mode 100644
index 000000000..f3ee4d163
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/nmdata.json
@@ -0,0 +1,26 @@
+{
+  "Network": {"Serial": 15},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-c": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Policies": [
+    {
+      "ID": "pol-direct",
+      "PublicID": "pol-direct-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["443"],
+          "Bidirectional": true,
+          "SourceResource": {"ID": "peer-a", "Type": "peer"},
+          "DestinationResource": {"ID": "peer-b", "Type": "peer"}
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/case.json
new file mode 100644
index 000000000..a0eccba20
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "One-way udp/514 plus bidirectional tcp port-range 1000-2000 between the same groups; a disabled policy and a policy whose only rule is disabled must leave no trace.",
+  "peers": ["peer-a", "peer-srv"]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/golden/peer-a.json
new file mode 100644
index 000000000..5a2276d96
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/golden/peer-a.json
@@ -0,0 +1,81 @@
+{
+  "Serial": "14",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "jEboa3bOv65XRbq8+8JuagiwWz+mM7Fc5MUfBQbOf6Y=",
+      "allowedIps": [
+        "100.64.0.10/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.10",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 1000,
+          "end": 2000
+        }
+      },
+      "PolicyID": "cG9sLXJhbmdl"
+    },
+    {
+      "PeerIP": "100.64.0.10",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 1000,
+          "end": 2000
+        }
+      },
+      "PolicyID": "cG9sLXJhbmdl"
+    },
+    {
+      "PeerIP": "100.64.0.10",
+      "Direction": "OUT",
+      "Protocol": "UDP",
+      "Port": "514",
+      "PolicyID": "cG9sLXN5c2xvZw=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/golden/peer-srv.json
new file mode 100644
index 000000000..6a89148f5
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/golden/peer-srv.json
@@ -0,0 +1,80 @@
+{
+  "Serial": "14",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 1000,
+          "end": 2000
+        }
+      },
+      "PolicyID": "cG9sLXJhbmdl"
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 1000,
+          "end": 2000
+        }
+      },
+      "PolicyID": "cG9sLXJhbmdl"
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "UDP",
+      "Port": "514",
+      "PolicyID": "cG9sLXN5c2xvZw=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/nmdata.json
new file mode 100644
index 000000000..f1262a0d7
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/nmdata.json
@@ -0,0 +1,74 @@
+{
+  "Network": {"Serial": 14},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]},
+    "grp-svc": {"Peers": ["peer-srv"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-syslog",
+      "PublicID": "pol-syslog-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "udp",
+          "Ports": ["514"],
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-svc"]
+        }
+      ]
+    },
+    {
+      "ID": "pol-range",
+      "PublicID": "pol-range-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "PortRanges": [{"Start": 1000, "End": 2000}],
+          "Bidirectional": true,
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-svc"]
+        }
+      ]
+    },
+    {
+      "ID": "pol-off",
+      "PublicID": "pol-off-pub",
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["9999"],
+          "Bidirectional": true,
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-svc"]
+        }
+      ]
+    },
+    {
+      "ID": "pol-rule-off",
+      "PublicID": "pol-rule-off-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Action": "accept",
+          "Protocol": "udp",
+          "Ports": ["1111"],
+          "Bidirectional": true,
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-svc"]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/case.json
new file mode 100644
index 000000000..3307e0afe
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Posture checks gate a policy's sources only, never its destinations. peer-srv-old would fail the version check, but it sits in the destination group, so peer-client must still receive it alongside peer-srv-new, and peer-srv-old must still receive peer-client. This asymmetry is deliberate in the compute path — destination peers are resolved with no posture checks passed in — and it is worth pinning because it is easy to assume a posture check protects both ends.",
+  "peers": ["peer-client", "peer-srv-old"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/golden/peer-client.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/golden/peer-client.json
new file mode 100644
index 000000000..73182932b
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/golden/peer-client.json
@@ -0,0 +1,93 @@
+{
+  "Serial": "37",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-client.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "MdeD+cDSnurizeZ/Zd7rEdIhs9VZViEnutUwkodqb1s=",
+      "allowedIps": [
+        "100.64.0.12/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv-new.netbird.test",
+      "agentVersion": "1.0.0"
+    },
+    {
+      "wgPubKey": "ph1eqUTlSeLQ6V9zLEUpck25m5K5sOQq+AHY879HZME=",
+      "allowedIps": [
+        "100.64.0.11/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv-old.netbird.test",
+      "agentVersion": "0.30.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-client.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv-new.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.12"
+          },
+          {
+            "Name": "peer-srv-old.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.11"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.11",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRlc3Q="
+    },
+    {
+      "PeerIP": "100.64.0.11",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRlc3Q="
+    },
+    {
+      "PeerIP": "100.64.0.12",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRlc3Q="
+    },
+    {
+      "PeerIP": "100.64.0.12",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRlc3Q="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/golden/peer-srv-old.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/golden/peer-srv-old.json
new file mode 100644
index 000000000..8d1ad4feb
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/golden/peer-srv-old.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "37",
+  "peerConfig": {
+    "address": "100.64.0.11/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv-old.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "tKxuKEYQFPR8lCpcfVWBKVX0vGFKYXtTtFjXhoiu5zc=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-client.netbird.test",
+      "agentVersion": "1.0.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-client.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv-old.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.11"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRlc3Q="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRlc3Q="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/nmdata.json
new file mode 100644
index 000000000..ca5ece21a
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-destination-not-gated/nmdata.json
@@ -0,0 +1,33 @@
+{
+  "Network": {"Serial": 37},
+  "Peers": {
+    "peer-client": {"IP": "100.64.0.1", "Meta": {"WtVersion": "1.0.0"}},
+    "peer-srv-old": {"IP": "100.64.0.11", "Meta": {"WtVersion": "0.30.0"}},
+    "peer-srv-new": {"IP": "100.64.0.12", "Meta": {"WtVersion": "1.0.0"}}
+  },
+  "Groups": {
+    "grp-clients": {"Peers": ["peer-client"]},
+    "grp-srv": {"Peers": ["peer-srv-old", "peer-srv-new"]}
+  },
+  "PostureChecks": {
+    "chk-version": {"Checks": {"NBVersionCheck": {"MinVersion": "0.45.0"}}}
+  },
+  "Policies": [
+    {
+      "ID": "pol-dest",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-version"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["443"],
+          "Bidirectional": true,
+          "Sources": ["grp-clients"],
+          "Destinations": ["grp-srv"]
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/case.json
new file mode 100644
index 000000000..8d7460721
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/case.json
@@ -0,0 +1,5 @@
+{
+  "description": "A peer named directly as a rule source is gated by the policy's posture checks exactly like a group member: peer-b (0.40.0) fails the 0.45.0 minimum, so it gets no connectivity and peer-c must not see it, while the compliant direct source peer-a reaches peer-c. Legacy mode is excluded: the frozen legacynmap copy still carries the direct-peer bypass.",
+  "peers": ["peer-b", "peer-c"],
+  "modes": ["full", "envelope"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/golden/peer-b.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/golden/peer-b.json
new file mode 100644
index 000000000..240358e40
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/golden/peer-b.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "21",
+  "peerConfig": {
+    "address": "100.64.0.2/10",
+    "sshConfig": {},
+    "fqdn": "peer-b.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/golden/peer-c.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/golden/peer-c.json
new file mode 100644
index 000000000..85573ed35
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/golden/peer-c.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "21",
+  "peerConfig": {
+    "address": "100.64.0.3/10",
+    "sshConfig": {},
+    "fqdn": "peer-c.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-c.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRpcmVjdC1vaw=="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWRpcmVjdC1vaw=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/nmdata.json
new file mode 100644
index 000000000..e6b99bfdd
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-direct-source/nmdata.json
@@ -0,0 +1,51 @@
+{
+  "Network": {"Serial": 21},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.40.0"}},
+    "peer-c": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-ops": {"Peers": ["peer-c"]}
+  },
+  "PostureChecks": {
+    "chk-ver": {"Checks": {"NBVersionCheck": {"MinVersion": "0.45.0"}}}
+  },
+  "PostureCheckXIDToPublicID": {"chk-ver": "chk-ver-pub"},
+  "Policies": [
+    {
+      "ID": "pol-direct-ok",
+      "PublicID": "pol-direct-ok-pub",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-ver"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["443"],
+          "Bidirectional": true,
+          "SourceResource": {"ID": "peer-a", "Type": "peer"},
+          "Destinations": ["grp-ops"]
+        }
+      ]
+    },
+    {
+      "ID": "pol-direct-denied",
+      "PublicID": "pol-direct-denied-pub",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-ver"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["8443"],
+          "Bidirectional": true,
+          "SourceResource": {"ID": "peer-b", "Type": "peer"},
+          "Destinations": ["grp-ops"]
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/case.json
new file mode 100644
index 000000000..a661fa53e
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/case.json
@@ -0,0 +1,7 @@
+{
+  "description": "Source-side NB-version posture check: peer-b (0.40.0) fails the 0.45.0 minimum, so peer-c must not see it and peer-b itself gets no policy connectivity.",
+  "peers": [
+    "peer-b",
+    "peer-c"
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/golden/peer-b.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/golden/peer-b.json
new file mode 100644
index 000000000..201be294f
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/golden/peer-b.json
@@ -0,0 +1,34 @@
+{
+  "Serial": "6",
+  "peerConfig": {
+    "address": "100.64.0.2/10",
+    "sshConfig": {},
+    "fqdn": "peer-b.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/golden/peer-c.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/golden/peer-c.json
new file mode 100644
index 000000000..009d00490
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/golden/peer-c.json
@@ -0,0 +1,65 @@
+{
+  "Serial": "6",
+  "peerConfig": {
+    "address": "100.64.0.3/10",
+    "sshConfig": {},
+    "fqdn": "peer-c.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-c.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWdhdGVk"
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWdhdGVk"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/nmdata.json
new file mode 100644
index 000000000..4962e8b6a
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-gated/nmdata.json
@@ -0,0 +1,36 @@
+{
+  "Network": {"Serial": 6},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.40.0"}},
+    "peer-c": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a", "peer-b"]},
+    "grp-ops": {"Peers": ["peer-c"]}
+  },
+  "PostureChecks": {
+    "chk-ver": {"Checks": {"NBVersionCheck": {"MinVersion": "0.45.0"}}}
+  },
+  "PostureCheckXIDToPublicID": {"chk-ver": "chk-ver-pub"},
+  "Policies": [
+    {
+      "ID": "pol-gated",
+      "PublicID": "pol-gated-pub",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-ver"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Bidirectional": true,
+          "Ports": ["443"],
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-ops"]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/case.json
new file mode 100644
index 000000000..9f7f86860
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Geo location posture check in allow mode. An entry naming only a country matches the whole country, so peer-de passes; an entry naming a city must match that city exactly, so peer-us-ny passes while peer-us-bos does not. peer-fr matches nothing and fails. peer-nowhere has no location at all, which the check reports as an error, and an errored check denies — so it fails too.",
+  "peers": ["peer-srv", "peer-de", "peer-us-bos", "peer-nowhere"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-de.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-de.json
new file mode 100644
index 000000000..9a07139fe
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-de.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "31",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-de.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "jEboa3bOv65XRbq8+8JuagiwWz+mM7Fc5MUfBQbOf6Y=",
+      "allowedIps": [
+        "100.64.0.10/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-de.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.10",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWdlbw=="
+    },
+    {
+      "PeerIP": "100.64.0.10",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWdlbw=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-nowhere.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-nowhere.json
new file mode 100644
index 000000000..aed97a69f
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-nowhere.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "31",
+  "peerConfig": {
+    "address": "100.64.0.5/10",
+    "sshConfig": {},
+    "fqdn": "peer-nowhere.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-nowhere.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.5"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-srv.json
new file mode 100644
index 000000000..9f3fcb1ba
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-srv.json
@@ -0,0 +1,93 @@
+{
+  "Serial": "31",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "9nwvdE0wik6Fcs8Tw6WBnmOqGZmzdiTR4VZAdRBOJF4=",
+      "allowedIps": [
+        "100.64.0.2/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-us-ny.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "s/f5frZqT3DT1o9QCuhA14Pj5GUa4JUsF4M3twrprmk=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-de.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-de.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          },
+          {
+            "Name": "peer-us-ny.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWdlbw=="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWdlbw=="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWdlbw=="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWdlbw=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-us-bos.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-us-bos.json
new file mode 100644
index 000000000..624666c36
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/golden/peer-us-bos.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "31",
+  "peerConfig": {
+    "address": "100.64.0.3/10",
+    "sshConfig": {},
+    "fqdn": "peer-us-bos.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-us-bos.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/nmdata.json
new file mode 100644
index 000000000..b92840266
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-allow/nmdata.json
@@ -0,0 +1,46 @@
+{
+  "Network": {"Serial": 31},
+  "Peers": {
+    "peer-de": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}, "Location": {"CountryCode": "DE", "CityName": "Berlin"}},
+    "peer-us-ny": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}, "Location": {"CountryCode": "US", "CityName": "New York"}},
+    "peer-us-bos": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0"}, "Location": {"CountryCode": "US", "CityName": "Boston"}},
+    "peer-fr": {"IP": "100.64.0.4", "Meta": {"WtVersion": "0.60.0"}, "Location": {"CountryCode": "FR", "CityName": "Paris"}},
+    "peer-nowhere": {"IP": "100.64.0.5", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-clients": {"Peers": ["peer-de", "peer-us-ny", "peer-us-bos", "peer-fr", "peer-nowhere"]},
+    "grp-srv": {"Peers": ["peer-srv"]}
+  },
+  "PostureChecks": {
+    "chk-geo": {
+      "Checks": {
+        "GeoLocationCheck": {
+          "Action": "allow",
+          "Locations": [
+            {"CountryCode": "DE"},
+            {"CountryCode": "US", "CityName": "New York"}
+          ]
+        }
+      }
+    }
+  },
+  "Policies": [
+    {
+      "ID": "pol-geo",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-geo"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["443"],
+          "Bidirectional": true,
+          "Sources": ["grp-clients"],
+          "Destinations": ["grp-srv"]
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/case.json
new file mode 100644
index 000000000..f234b5280
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Geo location posture check in deny mode: matching the list rejects, not matching passes, so peer-ru is excluded and peer-de is admitted. peer-nowhere has no location and fails here as well — a missing location is an error and errors deny in both modes, so deny mode is not a way to admit peers whose location is unknown.",
+  "peers": ["peer-srv", "peer-ru", "peer-nowhere"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/golden/peer-nowhere.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/golden/peer-nowhere.json
new file mode 100644
index 000000000..e73b77d9e
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/golden/peer-nowhere.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "32",
+  "peerConfig": {
+    "address": "100.64.0.3/10",
+    "sshConfig": {},
+    "fqdn": "peer-nowhere.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-nowhere.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/golden/peer-ru.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/golden/peer-ru.json
new file mode 100644
index 000000000..721267f37
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/golden/peer-ru.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "32",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-ru.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-ru.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/golden/peer-srv.json
new file mode 100644
index 000000000..93883369e
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/golden/peer-srv.json
@@ -0,0 +1,62 @@
+{
+  "Serial": "32",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "s/f5frZqT3DT1o9QCuhA14Pj5GUa4JUsF4M3twrprmk=",
+      "allowedIps": [
+        "100.64.0.2/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-de.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-de.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.2",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLWdlby1kZW55"
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Direction": "OUT",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLWdlby1kZW55"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/nmdata.json
new file mode 100644
index 000000000..5edc50a38
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-geo-deny/nmdata.json
@@ -0,0 +1,40 @@
+{
+  "Network": {"Serial": 32},
+  "Peers": {
+    "peer-ru": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}, "Location": {"CountryCode": "RU", "CityName": "Moscow"}},
+    "peer-de": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}, "Location": {"CountryCode": "DE", "CityName": "Berlin"}},
+    "peer-nowhere": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-clients": {"Peers": ["peer-ru", "peer-de", "peer-nowhere"]},
+    "grp-srv": {"Peers": ["peer-srv"]}
+  },
+  "PostureChecks": {
+    "chk-geo-deny": {
+      "Checks": {
+        "GeoLocationCheck": {
+          "Action": "deny",
+          "Locations": [{"CountryCode": "RU"}]
+        }
+      }
+    }
+  },
+  "Policies": [
+    {
+      "ID": "pol-geo-deny",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-geo-deny"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "all",
+          "Bidirectional": true,
+          "Sources": ["grp-clients"],
+          "Destinations": ["grp-srv"]
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/case.json
new file mode 100644
index 000000000..c0eab5408
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "One posture check bundle holding two different checks. All checks in a bundle must pass, so only peer-both is admitted: peer-badgeo satisfies the version rule and peer-badversion satisfies the location rule, and each is still rejected on the other. This pins the AND semantics of a bundle rather than any-of.",
+  "peers": ["peer-srv", "peer-both", "peer-badgeo"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/golden/peer-badgeo.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/golden/peer-badgeo.json
new file mode 100644
index 000000000..6a6272909
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/golden/peer-badgeo.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "35",
+  "peerConfig": {
+    "address": "100.64.0.2/10",
+    "sshConfig": {},
+    "fqdn": "peer-badgeo.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-badgeo.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/golden/peer-both.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/golden/peer-both.json
new file mode 100644
index 000000000..7e18e7cb8
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/golden/peer-both.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "35",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-both.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "jEboa3bOv65XRbq8+8JuagiwWz+mM7Fc5MUfBQbOf6Y=",
+      "allowedIps": [
+        "100.64.0.10/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv.netbird.test",
+      "agentVersion": "1.0.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-both.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.10",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWNvbWJv"
+    },
+    {
+      "PeerIP": "100.64.0.10",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWNvbWJv"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/golden/peer-srv.json
new file mode 100644
index 000000000..e91e8f777
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/golden/peer-srv.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "35",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "ilmSCJoVLTTY/Am7or8ES8R0hL/OdfE2FDK197pxc5o=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-both.netbird.test",
+      "agentVersion": "1.0.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-both.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWNvbWJv"
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLWNvbWJv"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/nmdata.json
new file mode 100644
index 000000000..fbf7a5f1e
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-multiple-checks/nmdata.json
@@ -0,0 +1,42 @@
+{
+  "Network": {"Serial": 35},
+  "Peers": {
+    "peer-both": {"IP": "100.64.0.1", "Meta": {"WtVersion": "1.0.0"}, "Location": {"CountryCode": "DE", "CityName": "Berlin"}},
+    "peer-badgeo": {"IP": "100.64.0.2", "Meta": {"WtVersion": "1.0.0"}, "Location": {"CountryCode": "FR", "CityName": "Paris"}},
+    "peer-badversion": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.30.0"}, "Location": {"CountryCode": "DE", "CityName": "Berlin"}},
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "1.0.0"}}
+  },
+  "Groups": {
+    "grp-clients": {"Peers": ["peer-both", "peer-badgeo", "peer-badversion"]},
+    "grp-srv": {"Peers": ["peer-srv"]}
+  },
+  "PostureChecks": {
+    "chk-combo": {
+      "Checks": {
+        "NBVersionCheck": {"MinVersion": "0.45.0"},
+        "GeoLocationCheck": {
+          "Action": "allow",
+          "Locations": [{"CountryCode": "DE"}]
+        }
+      }
+    }
+  },
+  "Policies": [
+    {
+      "ID": "pol-combo",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-combo"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["443"],
+          "Bidirectional": true,
+          "Sources": ["grp-clients"],
+          "Destinations": ["grp-srv"]
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/case.json
new file mode 100644
index 000000000..d10bfc9ae
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Peer network range posture check in allow mode over 192.168.0.0/16. peer-office passes on its reported interface network, and peer-by-connip passes on the address it connected from, which the check folds in as a single-host prefix — so either source of address information can satisfy it. peer-remote is outside the range and peer-noaddr reports no address at all, which errors and therefore denies. Note this policy is tcp/22 without the peer's SSH flag, so no authorized users appear.",
+  "peers": ["peer-srv", "peer-office", "peer-by-connip", "peer-remote"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-by-connip.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-by-connip.json
new file mode 100644
index 000000000..c9cb3ed0a
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-by-connip.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "33",
+  "peerConfig": {
+    "address": "100.64.0.3/10",
+    "sshConfig": {},
+    "fqdn": "peer-by-connip.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "jEboa3bOv65XRbq8+8JuagiwWz+mM7Fc5MUfBQbOf6Y=",
+      "allowedIps": [
+        "100.64.0.10/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-by-connip.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.10",
+      "Protocol": "TCP",
+      "Port": "22",
+      "PolicyID": "cG9sLXJhbmdl"
+    },
+    {
+      "PeerIP": "100.64.0.10",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "22",
+      "PolicyID": "cG9sLXJhbmdl"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-office.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-office.json
new file mode 100644
index 000000000..1b9834d12
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-office.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "33",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-office.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "jEboa3bOv65XRbq8+8JuagiwWz+mM7Fc5MUfBQbOf6Y=",
+      "allowedIps": [
+        "100.64.0.10/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-office.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.10",
+      "Protocol": "TCP",
+      "Port": "22",
+      "PolicyID": "cG9sLXJhbmdl"
+    },
+    {
+      "PeerIP": "100.64.0.10",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "22",
+      "PolicyID": "cG9sLXJhbmdl"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-remote.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-remote.json
new file mode 100644
index 000000000..134a0aff2
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-remote.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "33",
+  "peerConfig": {
+    "address": "100.64.0.2/10",
+    "sshConfig": {},
+    "fqdn": "peer-remote.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-remote.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-srv.json
new file mode 100644
index 000000000..a8499e031
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/golden/peer-srv.json
@@ -0,0 +1,93 @@
+{
+  "Serial": "33",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "2Za6YHlJPJPv3hG/vDvdT0emXqIQADX9+wE8F1ZsgHU=",
+      "allowedIps": [
+        "100.64.0.3/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-by-connip.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "iVuRGJEIX4iqqF3zV01cxAEgyjXW3X4rrMoal6iA4fc=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-office.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-by-connip.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          },
+          {
+            "Name": "peer-office.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "22",
+      "PolicyID": "cG9sLXJhbmdl"
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "22",
+      "PolicyID": "cG9sLXJhbmdl"
+    },
+    {
+      "PeerIP": "100.64.0.3",
+      "Protocol": "TCP",
+      "Port": "22",
+      "PolicyID": "cG9sLXJhbmdl"
+    },
+    {
+      "PeerIP": "100.64.0.3",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "22",
+      "PolicyID": "cG9sLXJhbmdl"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/nmdata.json
new file mode 100644
index 000000000..a258e855d
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-network-range/nmdata.json
@@ -0,0 +1,42 @@
+{
+  "Network": {"Serial": 33},
+  "Peers": {
+    "peer-office": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0", "NetworkAddresses": [{"NetIP": "192.168.1.10/24"}]}},
+    "peer-remote": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0", "NetworkAddresses": [{"NetIP": "10.0.0.5/8"}]}},
+    "peer-by-connip": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0"}, "Location": {"ConnectionIP": "192.168.5.5"}},
+    "peer-noaddr": {"IP": "100.64.0.4", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-clients": {"Peers": ["peer-office", "peer-remote", "peer-by-connip", "peer-noaddr"]},
+    "grp-srv": {"Peers": ["peer-srv"]}
+  },
+  "PostureChecks": {
+    "chk-range": {
+      "Checks": {
+        "PeerNetworkRangeCheck": {
+          "Action": "allow",
+          "Ranges": ["192.168.0.0/16"]
+        }
+      }
+    }
+  },
+  "Policies": [
+    {
+      "ID": "pol-range",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-range"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["22"],
+          "Bidirectional": true,
+          "Sources": ["grp-clients"],
+          "Destinations": ["grp-srv"]
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/case.json
new file mode 100644
index 000000000..b23a187d4
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "OS version posture check with per-OS minimums. peer-srv must see only the peers that satisfy their own platform's rule: the Linux peer on kernel 6.1 (the check compares the part before the first dash) and the macOS peer on 14.2. The old Linux and macOS peers fail. peer-win fails too even though its version looks modern, because the check defines no Windows minimum and a platform with no rule configured is treated as failing, not as unrestricted — a surprising rule worth freezing. Each rejected peer also loses its own view of peer-srv, since the policy is its only connectivity.",
+  "peers": ["peer-srv", "peer-lin-ok", "peer-lin-old", "peer-win"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-lin-ok.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-lin-ok.json
new file mode 100644
index 000000000..f299b9fcf
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-lin-ok.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "30",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-lin-ok.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "jEboa3bOv65XRbq8+8JuagiwWz+mM7Fc5MUfBQbOf6Y=",
+      "allowedIps": [
+        "100.64.0.10/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-lin-ok.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.10",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLW9z"
+    },
+    {
+      "PeerIP": "100.64.0.10",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLW9z"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-lin-old.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-lin-old.json
new file mode 100644
index 000000000..c0a5412fa
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-lin-old.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "30",
+  "peerConfig": {
+    "address": "100.64.0.2/10",
+    "sshConfig": {},
+    "fqdn": "peer-lin-old.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-lin-old.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-srv.json
new file mode 100644
index 000000000..91883d20b
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-srv.json
@@ -0,0 +1,93 @@
+{
+  "Serial": "30",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "XpdB4aptfFjgsQOHfEO65dNozY8R7EIw3/alAnXjl+k=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-lin-ok.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "gRO02HiaHUKq2xTbYJhPsmGj06bK0HGU2tgL0pKB2yQ=",
+      "allowedIps": [
+        "100.64.0.3/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-mac-ok.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-lin-ok.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-mac-ok.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLW9z"
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLW9z"
+    },
+    {
+      "PeerIP": "100.64.0.3",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLW9z"
+    },
+    {
+      "PeerIP": "100.64.0.3",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "443",
+      "PolicyID": "cG9sLW9z"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-win.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-win.json
new file mode 100644
index 000000000..0b0cafb26
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/golden/peer-win.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "30",
+  "peerConfig": {
+    "address": "100.64.0.5/10",
+    "sshConfig": {},
+    "fqdn": "peer-win.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-win.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.5"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/nmdata.json
new file mode 100644
index 000000000..018c0cc21
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-os-version/nmdata.json
@@ -0,0 +1,43 @@
+{
+  "Network": {"Serial": 30},
+  "Peers": {
+    "peer-lin-ok": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0", "GoOS": "linux", "KernelVersion": "6.1.0-arch1"}},
+    "peer-lin-old": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0", "GoOS": "linux", "KernelVersion": "5.4.0-generic"}},
+    "peer-mac-ok": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0", "GoOS": "darwin", "OSVersion": "14.2"}},
+    "peer-mac-old": {"IP": "100.64.0.4", "Meta": {"WtVersion": "0.60.0", "GoOS": "darwin", "OSVersion": "12.0"}},
+    "peer-win": {"IP": "100.64.0.5", "Meta": {"WtVersion": "0.60.0", "GoOS": "windows", "KernelVersion": "10.0.19045"}},
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0", "GoOS": "linux", "KernelVersion": "6.1.0-arch1"}}
+  },
+  "Groups": {
+    "grp-clients": {"Peers": ["peer-lin-ok", "peer-lin-old", "peer-mac-ok", "peer-mac-old", "peer-win"]},
+    "grp-srv": {"Peers": ["peer-srv"]}
+  },
+  "PostureChecks": {
+    "chk-os": {
+      "Checks": {
+        "OSVersionCheck": {
+          "Linux": {"MinKernelVersion": "6.0.0"},
+          "Darwin": {"MinVersion": "13.0"}
+        }
+      }
+    }
+  },
+  "Policies": [
+    {
+      "ID": "pol-os",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-os"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["443"],
+          "Bidirectional": true,
+          "Sources": ["grp-clients"],
+          "Destinations": ["grp-srv"]
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/case.json
new file mode 100644
index 000000000..b730389a6
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Process posture check, which picks the path for the peer's own platform. peer-lin-running and peer-mac-running each have their platform's process running and pass. peer-lin-stopped reports the same file but not running, so it fails — presence of the binary is not enough. peer-bsd runs an unsupported operating system, which the check reports as an error, and errors deny.",
+  "peers": ["peer-srv", "peer-lin-running", "peer-lin-stopped", "peer-bsd"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-bsd.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-bsd.json
new file mode 100644
index 000000000..f75459d39
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-bsd.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "34",
+  "peerConfig": {
+    "address": "100.64.0.4/10",
+    "sshConfig": {},
+    "fqdn": "peer-bsd.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-bsd.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.4"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-lin-running.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-lin-running.json
new file mode 100644
index 000000000..ddfa39472
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-lin-running.json
@@ -0,0 +1,62 @@
+{
+  "Serial": "34",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-lin-running.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "jEboa3bOv65XRbq8+8JuagiwWz+mM7Fc5MUfBQbOf6Y=",
+      "allowedIps": [
+        "100.64.0.10/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-lin-running.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.10",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLXByb2M="
+    },
+    {
+      "PeerIP": "100.64.0.10",
+      "Direction": "OUT",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLXByb2M="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-lin-stopped.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-lin-stopped.json
new file mode 100644
index 000000000..828a933f7
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-lin-stopped.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "34",
+  "peerConfig": {
+    "address": "100.64.0.2/10",
+    "sshConfig": {},
+    "fqdn": "peer-lin-stopped.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-lin-stopped.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-srv.json
new file mode 100644
index 000000000..6eb409623
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/golden/peer-srv.json
@@ -0,0 +1,89 @@
+{
+  "Serial": "34",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "d9LCTf7vwqctprOKyF95j17uPWpRjEeirHfB75RIGlk=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-lin-running.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "rgP4xt50GcHp7fFgBoSt8yz5bp5AnOAVHMmOd+rTbR4=",
+      "allowedIps": [
+        "100.64.0.3/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-mac-running.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-lin-running.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-mac-running.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.3"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLXByb2M="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLXByb2M="
+    },
+    {
+      "PeerIP": "100.64.0.3",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLXByb2M="
+    },
+    {
+      "PeerIP": "100.64.0.3",
+      "Direction": "OUT",
+      "Protocol": "ALL",
+      "PolicyID": "cG9sLXByb2M="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/nmdata.json
new file mode 100644
index 000000000..b112e2235
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-process/nmdata.json
@@ -0,0 +1,70 @@
+{
+  "Network": {"Serial": 34},
+  "Peers": {
+    "peer-lin-running": {
+      "IP": "100.64.0.1",
+      "Meta": {
+        "WtVersion": "0.60.0",
+        "GoOS": "linux",
+        "Files": [{"Path": "/usr/bin/agent", "ProcessIsRunning": true}]
+      }
+    },
+    "peer-lin-stopped": {
+      "IP": "100.64.0.2",
+      "Meta": {
+        "WtVersion": "0.60.0",
+        "GoOS": "linux",
+        "Files": [{"Path": "/usr/bin/agent"}]
+      }
+    },
+    "peer-mac-running": {
+      "IP": "100.64.0.3",
+      "Meta": {
+        "WtVersion": "0.60.0",
+        "GoOS": "darwin",
+        "Files": [{"Path": "/Applications/Agent.app", "ProcessIsRunning": true}]
+      }
+    },
+    "peer-bsd": {
+      "IP": "100.64.0.4",
+      "Meta": {
+        "WtVersion": "0.60.0",
+        "GoOS": "freebsd",
+        "Files": [{"Path": "/usr/bin/agent", "ProcessIsRunning": true}]
+      }
+    },
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0", "GoOS": "linux"}}
+  },
+  "Groups": {
+    "grp-clients": {"Peers": ["peer-lin-running", "peer-lin-stopped", "peer-mac-running", "peer-bsd"]},
+    "grp-srv": {"Peers": ["peer-srv"]}
+  },
+  "PostureChecks": {
+    "chk-proc": {
+      "Checks": {
+        "ProcessCheck": {
+          "Processes": [
+            {"LinuxPath": "/usr/bin/agent", "MacPath": "/Applications/Agent.app"}
+          ]
+        }
+      }
+    }
+  },
+  "Policies": [
+    {
+      "ID": "pol-proc",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-proc"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "all",
+          "Bidirectional": true,
+          "Sources": ["grp-clients"],
+          "Destinations": ["grp-srv"]
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/case.json
new file mode 100644
index 000000000..b30b06243
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Posture check on a policy granting access to a network resource. peer-ok must receive the route to the resource through peer-r, while peer-bad fails the version check and must receive no route at all. The router's route firewall rule must narrow its SourceRanges to peer-ok's address only — a peer rejected by posture must not be permitted through the routing peer either, which is the enforcement that actually matters.",
+  "peers": ["peer-ok", "peer-bad", "peer-r"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/golden/peer-bad.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/golden/peer-bad.json
new file mode 100644
index 000000000..b1aa1a494
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/golden/peer-bad.json
@@ -0,0 +1,34 @@
+{
+  "Serial": "38",
+  "peerConfig": {
+    "address": "100.64.0.2/10",
+    "sshConfig": {},
+    "fqdn": "peer-bad.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-bad.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/golden/peer-ok.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/golden/peer-ok.json
new file mode 100644
index 000000000..6aa688eef
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/golden/peer-ok.json
@@ -0,0 +1,56 @@
+{
+  "Serial": "38",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-ok.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "allowedIps": [
+        "100.64.0.9/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r.netbird.test",
+      "agentVersion": "1.0.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-db:peer-r",
+      "Network": "10.80.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "db-subnet",
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-ok.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/golden/peer-r.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/golden/peer-r.json
new file mode 100644
index 000000000..192304ca6
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/golden/peer-r.json
@@ -0,0 +1,69 @@
+{
+  "Serial": "38",
+  "peerConfig": {
+    "address": "100.64.0.9/10",
+    "sshConfig": {},
+    "fqdn": "peer-r.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "XPXITqbev8jVtIkumbPt5vpohe2OHWvhNGO3z2mgcxM=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-ok.netbird.test",
+      "agentVersion": "1.0.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-db:peer-r",
+      "Network": "10.80.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "db-subnet",
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRules": [
+    {
+      "sourceRanges": [
+        "100.64.0.1/32"
+      ],
+      "destination": "10.80.0.0/24",
+      "protocol": "TCP",
+      "portInfo": {
+        "port": 5432
+      },
+      "PolicyID": "cG9sLXJlcw==",
+      "RouteID": "res-db:peer-r"
+    }
+  ],
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/nmdata.json
new file mode 100644
index 000000000..840c5a7f8
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-resource-policy/nmdata.json
@@ -0,0 +1,48 @@
+{
+  "Network": {"Serial": 38},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-ok": {"IP": "100.64.0.1", "Meta": {"WtVersion": "1.0.0"}},
+    "peer-bad": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.30.0"}},
+    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "1.0.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-ok", "peer-bad"]}
+  },
+  "PostureChecks": {
+    "chk-version": {"Checks": {"NBVersionCheck": {"MinVersion": "0.45.0"}}}
+  },
+  "Policies": [
+    {
+      "ID": "pol-res",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-version"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["5432"],
+          "Sources": ["grp-dev"],
+          "DestinationResource": {"ID": "res-db", "Type": "subnet"}
+        }
+      ]
+    }
+  ],
+  "ResourcePolicies": {"res-db": [{"ID": "pol-res"}]},
+  "NetworkResources": [
+    {
+      "ID": "res-db",
+      "NetworkID": "net-1",
+      "Name": "db-subnet",
+      "Type": "subnet",
+      "Prefix": "10.80.0.0/24",
+      "Enabled": true
+    }
+  ],
+  "Routers": {
+    "net-1": {
+      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
+    }
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/case.json
new file mode 100644
index 000000000..203b89533
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "The same peer under two policies carrying different posture checks. peer-x is on an old agent version but in an allowed country, so the version-gated policy rejects it while the location-gated one admits it: it must reach peer-srv-b on 8443 and not peer-srv-a at all. Failing one policy's check must not leak into another policy's decision. peer-srv-a correspondingly sees nobody, peer-srv-b sees peer-x.",
+  "peers": ["peer-x", "peer-srv-a", "peer-srv-b"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/golden/peer-srv-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/golden/peer-srv-a.json
new file mode 100644
index 000000000..8008db39c
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/golden/peer-srv-a.json
@@ -0,0 +1,33 @@
+{
+  "Serial": "36",
+  "peerConfig": {
+    "address": "100.64.0.11/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv-a.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeersIsEmpty": true,
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-srv-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.11"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/golden/peer-srv-b.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/golden/peer-srv-b.json
new file mode 100644
index 000000000..c7bc45742
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/golden/peer-srv-b.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "36",
+  "peerConfig": {
+    "address": "100.64.0.12/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv-b.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "N1oKwtIwXdTDF0HdKDss0gPhxkqz+/Z/91734QZVCng=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-x.netbird.test",
+      "agentVersion": "0.40.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-srv-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.12"
+          },
+          {
+            "Name": "peer-x.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "8443",
+      "PolicyID": "cG9sLWxlbmllbnQ="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "8443",
+      "PolicyID": "cG9sLWxlbmllbnQ="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/golden/peer-x.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/golden/peer-x.json
new file mode 100644
index 000000000..461454233
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/golden/peer-x.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "36",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-x.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "fT/Mb0QBqXGx2q06gXqizvlXp5uz+ErGCaKmCEXVbMk=",
+      "allowedIps": [
+        "100.64.0.12/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv-b.netbird.test",
+      "agentVersion": "1.0.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-srv-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.12"
+          },
+          {
+            "Name": "peer-x.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "5353"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.12",
+      "Protocol": "TCP",
+      "Port": "8443",
+      "PolicyID": "cG9sLWxlbmllbnQ="
+    },
+    {
+      "PeerIP": "100.64.0.12",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "8443",
+      "PolicyID": "cG9sLWxlbmllbnQ="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/nmdata.json
new file mode 100644
index 000000000..2e0512194
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/posture-two-policies/nmdata.json
@@ -0,0 +1,55 @@
+{
+  "Network": {"Serial": 36},
+  "Peers": {
+    "peer-x": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.40.0"}, "Location": {"CountryCode": "DE", "CityName": "Berlin"}},
+    "peer-srv-a": {"IP": "100.64.0.11", "Meta": {"WtVersion": "1.0.0"}},
+    "peer-srv-b": {"IP": "100.64.0.12", "Meta": {"WtVersion": "1.0.0"}}
+  },
+  "Groups": {
+    "grp-clients": {"Peers": ["peer-x"]},
+    "grp-srv-a": {"Peers": ["peer-srv-a"]},
+    "grp-srv-b": {"Peers": ["peer-srv-b"]}
+  },
+  "PostureChecks": {
+    "chk-version": {"Checks": {"NBVersionCheck": {"MinVersion": "0.45.0"}}},
+    "chk-geo": {
+      "Checks": {
+        "GeoLocationCheck": {"Action": "allow", "Locations": [{"CountryCode": "DE"}]}
+      }
+    }
+  },
+  "Policies": [
+    {
+      "ID": "pol-strict",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-version"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["443"],
+          "Bidirectional": true,
+          "Sources": ["grp-clients"],
+          "Destinations": ["grp-srv-a"]
+        }
+      ]
+    },
+    {
+      "ID": "pol-lenient",
+      "Enabled": true,
+      "SourcePostureChecks": ["chk-geo"],
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["8443"],
+          "Bidirectional": true,
+          "Sources": ["grp-clients"],
+          "Destinations": ["grp-srv-b"]
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/case.json
new file mode 100644
index 000000000..5f9e98ea7
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/case.json
@@ -0,0 +1,7 @@
+{
+  "description": "A reverse-proxy service targeting a domain network resource. The synthesised proxy-access ACL is a resource policy too: on the account path the resource-policy map was built after injection, so the routing peer must carry a route firewall rule sourced from the proxy peer for the resource's domain. The store reads the policies table and ResourcePolicies never holds it, so only the synthesis puts it there.",
+  "peers": [
+    "router-peer",
+    "proxy-peer"
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/golden/proxy-peer.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/golden/proxy-peer.json
new file mode 100644
index 000000000..a9e74061f
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/golden/proxy-peer.json
@@ -0,0 +1,60 @@
+{
+  "Serial": "32",
+  "peerConfig": {
+    "address": "100.64.0.99/10",
+    "sshConfig": {},
+    "fqdn": "proxy-peer.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "4IuEBozN3DjkJXkJtBp/9Ekkr0zkfucwk9gqxWhV1hE=",
+      "allowedIps": [
+        "100.64.0.9/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "router-peer.netbird.test",
+      "lazyState": "LazyStateLazy",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-domain:router-peer",
+      "Network": "192.0.2.0/32",
+      "NetworkType": "3",
+      "Peer": "4IuEBozN3DjkJXkJtBp/9Ekkr0zkfucwk9gqxWhV1hE=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "app-domain",
+      "Domains": [
+        "app.internal"
+      ],
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "proxy-peer.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.99"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/golden/router-peer.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/golden/router-peer.json
new file mode 100644
index 000000000..d0bb48a3b
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/golden/router-peer.json
@@ -0,0 +1,80 @@
+{
+  "Serial": "32",
+  "peerConfig": {
+    "address": "100.64.0.9/10",
+    "sshConfig": {},
+    "fqdn": "router-peer.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "MgrwmZOHFZ+i0SXrfbBOcATxBAQsWKllrGL/32GvlxY=",
+      "allowedIps": [
+        "100.64.0.99/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "proxy-peer.netbird.test",
+      "lazyState": "LazyStateLazy",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-domain:router-peer",
+      "Network": "192.0.2.0/32",
+      "NetworkType": "3",
+      "Peer": "4IuEBozN3DjkJXkJtBp/9Ekkr0zkfucwk9gqxWhV1hE=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "app-domain",
+      "Domains": [
+        "app.internal"
+      ],
+      "keepRoute": true
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "router-peer.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "firewallRulesIsEmpty": true,
+  "routesFirewallRules": [
+    {
+      "sourceRanges": [
+        "100.64.0.99/32"
+      ],
+      "destination": "192.0.2.0/32",
+      "protocol": "TCP",
+      "portInfo": {
+        "range": {
+          "start": 443,
+          "end": 443
+        }
+      },
+      "isDynamic": true,
+      "domains": [
+        "app.internal"
+      ],
+      "PolicyID": "cHJveHktYWNjZXNzLXN2Yy0xLXByb3h5LXBlZXIt",
+      "RouteID": "res-domain:router-peer"
+    }
+  ],
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/nmdata.json
new file mode 100644
index 000000000..cbf729d9f
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-domain-resource/nmdata.json
@@ -0,0 +1,44 @@
+{
+  "Network": {"Serial": 32},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "router-peer": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}},
+    "proxy-peer": {
+      "IP": "100.64.0.99",
+      "Meta": {"WtVersion": "0.60.0"},
+      "ProxyMeta": {"Embedded": true, "Cluster": "eu.proxy.netbird.io"}
+    }
+  },
+  "NetworkResources": [
+    {
+      "ID": "res-domain",
+      "NetworkID": "net-1",
+      "Name": "app-domain",
+      "Type": "domain",
+      "Domain": "app.internal",
+      "Enabled": true
+    }
+  ],
+  "Routers": {
+    "net-1": {
+      "router-peer": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
+    }
+  },
+  "ProxyTargetedDomainResourceIDs": {"res-domain": {}},
+  "Services": [
+    {
+      "ID": "svc-1",
+      "Enabled": true,
+      "Mode": "http",
+      "ProxyCluster": "eu.proxy.netbird.io",
+      "Targets": [
+        {
+          "Enabled": true,
+          "Protocol": "https",
+          "TargetID": "res-domain",
+          "TargetType": "domain"
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/case.json
new file mode 100644
index 000000000..d8450505f
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/case.json
@@ -0,0 +1,7 @@
+{
+  "description": "A reverse-proxy service targeting a peer. The proxy-access ACL is synthesised from Services, never loaded from the policies table, and is what lets the cluster's embedded proxy peer reach the target on the target's port: proxy-peer gets an OUT rule to app-peer on TCP 8080 and app-peer the matching IN rule. Without the synthesis both maps are empty of each other.",
+  "peers": [
+    "proxy-peer",
+    "app-peer"
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/golden/app-peer.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/golden/app-peer.json
new file mode 100644
index 000000000..0e71a62ba
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/golden/app-peer.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "30",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {},
+    "fqdn": "app-peer.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "MgrwmZOHFZ+i0SXrfbBOcATxBAQsWKllrGL/32GvlxY=",
+      "allowedIps": [
+        "100.64.0.99/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "proxy-peer.netbird.test",
+      "lazyState": "LazyStateLazy",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "app-peer.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          },
+          {
+            "Name": "proxy-peer.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.99"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.99",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 8080,
+          "end": 8080
+        }
+      },
+      "PolicyID": "cHJveHktYWNjZXNzLXN2Yy0xLXByb3h5LXBlZXIt"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/golden/proxy-peer.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/golden/proxy-peer.json
new file mode 100644
index 000000000..4c6053319
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/golden/proxy-peer.json
@@ -0,0 +1,65 @@
+{
+  "Serial": "30",
+  "peerConfig": {
+    "address": "100.64.0.99/10",
+    "sshConfig": {},
+    "fqdn": "proxy-peer.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "/wFxrqMtMwWNZak/f0UDddUkCZMTmxNuiuk4/RGGNcY=",
+      "allowedIps": [
+        "100.64.0.10/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "app-peer.netbird.test",
+      "lazyState": "LazyStateLazy",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "app-peer.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          },
+          {
+            "Name": "proxy-peer.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.99"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.10",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 8080,
+          "end": 8080
+        }
+      },
+      "PolicyID": "cHJveHktYWNjZXNzLXN2Yy0xLXByb3h5LXBlZXIt"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/nmdata.json
new file mode 100644
index 000000000..b4645fb90
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-peer-target/nmdata.json
@@ -0,0 +1,29 @@
+{
+  "Network": {"Serial": 30},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "proxy-peer": {
+      "IP": "100.64.0.99",
+      "Meta": {"WtVersion": "0.60.0"},
+      "ProxyMeta": {"Embedded": true, "Cluster": "eu.proxy.netbird.io"}
+    },
+    "app-peer": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Services": [
+    {
+      "ID": "svc-1",
+      "Enabled": true,
+      "Mode": "http",
+      "ProxyCluster": "eu.proxy.netbird.io",
+      "Targets": [
+        {
+          "Enabled": true,
+          "Port": 8080,
+          "Protocol": "http",
+          "TargetID": "app-peer",
+          "TargetType": "peer"
+        }
+      ]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/case.json
new file mode 100644
index 000000000..8ef26f4cc
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/case.json
@@ -0,0 +1,7 @@
+{
+  "description": "A private reverse-proxy service. The private-access ACL is synthesised from Services, never loaded from the policies table, and is what lets the service's AccessGroups reach the cluster's embedded proxy peer on TCP 80 and 443: user-peer gets OUT rules on both ports and proxy-peer the matching IN rules. Without the synthesis both maps are empty of each other.",
+  "peers": [
+    "user-peer",
+    "proxy-peer"
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/golden/proxy-peer.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/golden/proxy-peer.json
new file mode 100644
index 000000000..7022f0c70
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/golden/proxy-peer.json
@@ -0,0 +1,75 @@
+{
+  "Serial": "31",
+  "peerConfig": {
+    "address": "100.64.0.99/10",
+    "sshConfig": {},
+    "fqdn": "proxy-peer.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "v19TN/CymWAs/WppcLjz3atM+t4ySNdImGtoPu4wnT8=",
+      "allowedIps": [
+        "100.64.0.10/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "user-peer.netbird.test",
+      "lazyState": "LazyStateLazy",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "proxy-peer.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.99"
+          },
+          {
+            "Name": "user-peer.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.10",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 443,
+          "end": 443
+        }
+      },
+      "PolicyID": "cHJpdmF0ZS1hY2Nlc3Mtc3ZjLTEtcHJveHktcGVlcg=="
+    },
+    {
+      "PeerIP": "100.64.0.10",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 80,
+          "end": 80
+        }
+      },
+      "PolicyID": "cHJpdmF0ZS1hY2Nlc3Mtc3ZjLTEtcHJveHktcGVlcg=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/golden/user-peer.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/golden/user-peer.json
new file mode 100644
index 000000000..7197abf22
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/golden/user-peer.json
@@ -0,0 +1,77 @@
+{
+  "Serial": "31",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {},
+    "fqdn": "user-peer.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "MgrwmZOHFZ+i0SXrfbBOcATxBAQsWKllrGL/32GvlxY=",
+      "allowedIps": [
+        "100.64.0.99/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "proxy-peer.netbird.test",
+      "lazyState": "LazyStateLazy",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "proxy-peer.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.99"
+          },
+          {
+            "Name": "user-peer.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.99",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 443,
+          "end": 443
+        }
+      },
+      "PolicyID": "cHJpdmF0ZS1hY2Nlc3Mtc3ZjLTEtcHJveHktcGVlcg=="
+    },
+    {
+      "PeerIP": "100.64.0.99",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 80,
+          "end": 80
+        }
+      },
+      "PolicyID": "cHJpdmF0ZS1hY2Nlc3Mtc3ZjLTEtcHJveHktcGVlcg=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/nmdata.json
new file mode 100644
index 000000000..066849bd4
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/proxy-service-private-access/nmdata.json
@@ -0,0 +1,26 @@
+{
+  "Network": {"Serial": 31},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "user-peer": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0"}},
+    "other-peer": {"IP": "100.64.0.11", "Meta": {"WtVersion": "0.60.0"}},
+    "proxy-peer": {
+      "IP": "100.64.0.99",
+      "Meta": {"WtVersion": "0.60.0"},
+      "ProxyMeta": {"Embedded": true, "Cluster": "eu.proxy.netbird.io"}
+    }
+  },
+  "Groups": {
+    "grp-admins": {"Peers": ["user-peer"]}
+  },
+  "Services": [
+    {
+      "ID": "svc-1",
+      "Enabled": true,
+      "Private": true,
+      "Mode": "http",
+      "ProxyCluster": "eu.proxy.netbird.io",
+      "AccessGroups": ["grp-admins", "grp-deleted"]
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/case.json
new file mode 100644
index 000000000..8d99a239c
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Classic route with access control groups: instead of the wide-open default permit, peer-r's route firewall rule must be narrowed to the policy that targets the ACL group — protocol and port from that rule, SourceRanges limited to the two source peers. peer-a still receives the route itself.",
+  "peers": ["peer-a", "peer-r"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/golden/peer-a.json
new file mode 100644
index 000000000..c52aecce9
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/golden/peer-a.json
@@ -0,0 +1,76 @@
+{
+  "Serial": "27",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "allowedIps": [
+        "100.64.0.9/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "rt-acl",
+      "Network": "10.70.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "db-net"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.9",
+      "Protocol": "TCP",
+      "Port": "3306",
+      "PolicyID": "cG9sLWFjbA=="
+    },
+    {
+      "PeerIP": "100.64.0.9",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "3306",
+      "PolicyID": "cG9sLWFjbA=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/golden/peer-r.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/golden/peer-r.json
new file mode 100644
index 000000000..cc03ef08c
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/golden/peer-r.json
@@ -0,0 +1,119 @@
+{
+  "Serial": "27",
+  "peerConfig": {
+    "address": "100.64.0.9/10",
+    "sshConfig": {},
+    "fqdn": "peer-r.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
+      "allowedIps": [
+        "100.64.0.2/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-b.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "rt-acl",
+      "Network": "10.70.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "db-net"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          },
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "3306",
+      "PolicyID": "cG9sLWFjbA=="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "3306",
+      "PolicyID": "cG9sLWFjbA=="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Protocol": "TCP",
+      "Port": "3306",
+      "PolicyID": "cG9sLWFjbA=="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "3306",
+      "PolicyID": "cG9sLWFjbA=="
+    }
+  ],
+  "routesFirewallRules": [
+    {
+      "sourceRanges": [
+        "100.64.0.1/32",
+        "100.64.0.2/32"
+      ],
+      "destination": "10.70.0.0/24",
+      "protocol": "TCP",
+      "portInfo": {
+        "port": 3306
+      },
+      "PolicyID": "cG9sLWFjbA==",
+      "RouteID": "rt-acl"
+    }
+  ],
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/nmdata.json
new file mode 100644
index 000000000..d7bfd0d08
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-access-control-groups/nmdata.json
@@ -0,0 +1,45 @@
+{
+  "Network": {"Serial": 27},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a", "peer-b"]},
+    "grp-acl": {"Peers": ["peer-r"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-acl",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["3306"],
+          "Bidirectional": true,
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-acl"]
+        }
+      ]
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "rt-acl",
+      "NetID": "db-net",
+      "Network": "10.70.0.0/24",
+      "NetworkType": 1,
+      "Peer": "peer-r",
+      "PeerID": "peer-r",
+      "Groups": ["grp-dev"],
+      "AccessControlGroups": ["grp-acl"],
+      "Metric": 9999,
+      "Masquerade": true,
+      "Enabled": true
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/case.json
new file mode 100644
index 000000000..52d45346a
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "Classic route served by a peer group instead of one peer: each routing peer's copy takes the route id with its own peer id appended and drops the PeerGroups field, and the distribution group's peer-a must receive both copies as an HA pair. Each router receives only its own copy plus a default-permit route firewall rule, because the route carries no access control groups. A policy connecting the two groups is required — route distribution follows peers the target may already talk to.",
+  "peers": ["peer-a", "peer-r1"]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/golden/peer-a.json
new file mode 100644
index 000000000..fd9e32274
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/golden/peer-a.json
@@ -0,0 +1,114 @@
+{
+  "Serial": "26",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "Iu6Lj1HqDXfgDh5RppHCRI6RO3lMlZBCndRNrdS7QUI=",
+      "allowedIps": [
+        "100.64.0.11/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r1.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "YC6sbWtvpB2d6W/XqsNIV9crsrXBoVDdwmhCoszjCps=",
+      "allowedIps": [
+        "100.64.0.12/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r2.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "rt-ha:peer-r1",
+      "Network": "10.60.0.0/24",
+      "NetworkType": "1",
+      "Peer": "Iu6Lj1HqDXfgDh5RppHCRI6RO3lMlZBCndRNrdS7QUI=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "ha-net"
+    },
+    {
+      "ID": "rt-ha:peer-r2",
+      "Network": "10.60.0.0/24",
+      "NetworkType": "1",
+      "Peer": "YC6sbWtvpB2d6W/XqsNIV9crsrXBoVDdwmhCoszjCps=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "ha-net"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-r1.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.11"
+          },
+          {
+            "Name": "peer-r2.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.12"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.11",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    },
+    {
+      "PeerIP": "100.64.0.11",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    },
+    {
+      "PeerIP": "100.64.0.12",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    },
+    {
+      "PeerIP": "100.64.0.12",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/golden/peer-r1.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/golden/peer-r1.json
new file mode 100644
index 000000000..bd8bdecd0
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/golden/peer-r1.json
@@ -0,0 +1,93 @@
+{
+  "Serial": "26",
+  "peerConfig": {
+    "address": "100.64.0.11/10",
+    "sshConfig": {},
+    "fqdn": "peer-r1.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "rt-ha:peer-r1",
+      "Network": "10.60.0.0/24",
+      "NetworkType": "1",
+      "Peer": "Iu6Lj1HqDXfgDh5RppHCRI6RO3lMlZBCndRNrdS7QUI=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "ha-net"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-r1.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.11"
+          },
+          {
+            "Name": "peer-r2.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.12"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    }
+  ],
+  "routesFirewallRules": [
+    {
+      "sourceRanges": [
+        "0.0.0.0/0"
+      ],
+      "destination": "10.60.0.0/24",
+      "protocol": "ALL",
+      "portInfo": {},
+      "RouteID": "rt-ha:peer-r1"
+    }
+  ],
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/nmdata.json
new file mode 100644
index 000000000..8b81a585f
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/route-peer-groups-ha/nmdata.json
@@ -0,0 +1,43 @@
+{
+  "Network": {"Serial": 26},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r1": {"IP": "100.64.0.11", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r2": {"IP": "100.64.0.12", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]},
+    "grp-routers": {"Peers": ["peer-r1", "peer-r2"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-conn",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["8080"],
+          "Bidirectional": true,
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-routers"]
+        }
+      ]
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "rt-ha",
+      "NetID": "ha-net",
+      "Network": "10.60.0.0/24",
+      "NetworkType": 1,
+      "PeerGroups": ["grp-routers"],
+      "Groups": ["grp-dev"],
+      "Metric": 9999,
+      "Masquerade": true,
+      "Enabled": true
+    }
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/case.json
new file mode 100644
index 000000000..a94d3653f
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/case.json
@@ -0,0 +1,7 @@
+{
+  "description": "Classic route distributed to grp-dev plus a network resource behind router peer-r with a resource policy; peer-a gets routes and route firewall rules, peer-r gets the routing-peer view.",
+  "peers": [
+    "peer-a",
+    "peer-r"
+  ]
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/golden/peer-a.json
new file mode 100644
index 000000000..9426bd846
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/golden/peer-a.json
@@ -0,0 +1,86 @@
+{
+  "Serial": "7",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "allowedIps": [
+        "100.64.0.9/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-r.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-db:peer-r",
+      "Network": "10.10.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "db",
+      "keepRoute": true
+    },
+    {
+      "ID": "rt-1",
+      "Network": "10.20.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "office-net"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.9",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    },
+    {
+      "PeerIP": "100.64.0.9",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/golden/peer-r.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/golden/peer-r.json
new file mode 100644
index 000000000..e5971796d
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/golden/peer-r.json
@@ -0,0 +1,138 @@
+{
+  "Serial": "7",
+  "peerConfig": {
+    "address": "100.64.0.9/10",
+    "sshConfig": {},
+    "fqdn": "peer-r.netbird.test",
+    "RoutingPeerDnsResolutionEnabled": true,
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
+      "allowedIps": [
+        "100.64.0.2/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-b.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "Routes": [
+    {
+      "ID": "res-db:peer-r",
+      "Network": "10.10.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "db",
+      "keepRoute": true
+    },
+    {
+      "ID": "rt-1",
+      "Network": "10.20.0.0/24",
+      "NetworkType": "1",
+      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
+      "Metric": "9999",
+      "Masquerade": true,
+      "NetID": "office-net"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          },
+          {
+            "Name": "peer-r.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.9"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "8080",
+      "PolicyID": "cG9sLWNvbm4="
+    }
+  ],
+  "routesFirewallRules": [
+    {
+      "sourceRanges": [
+        "0.0.0.0/0"
+      ],
+      "destination": "10.20.0.0/24",
+      "protocol": "ALL",
+      "portInfo": {},
+      "RouteID": "rt-1"
+    },
+    {
+      "sourceRanges": [
+        "100.64.0.1/32",
+        "100.64.0.2/32"
+      ],
+      "destination": "10.10.0.0/24",
+      "protocol": "TCP",
+      "portInfo": {
+        "port": 5432
+      },
+      "PolicyID": "cG9sLWRi",
+      "RouteID": "res-db:peer-r"
+    }
+  ],
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/nmdata.json
new file mode 100644
index 000000000..795047f50
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/routes-resources/nmdata.json
@@ -0,0 +1,97 @@
+{
+  "Network": {"Serial": 7},
+  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a", "peer-b"]},
+    "grp-routers": {"Peers": ["peer-r"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-conn",
+      "PublicID": "pol-conn-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Bidirectional": true,
+          "Ports": ["8080"],
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-routers"]
+        }
+      ]
+    },
+    {
+      "ID": "pol-db",
+      "PublicID": "pol-db-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["5432"],
+          "Sources": ["grp-dev"],
+          "DestinationResource": {"ID": "res-db", "Type": "subnet"}
+        }
+      ]
+    }
+  ],
+  "ResourcePolicies": {
+    "res-db": [
+      {
+        "ID": "pol-db",
+        "PublicID": "pol-db-pub",
+        "Enabled": true,
+        "Rules": [
+          {
+            "Enabled": true,
+            "Action": "accept",
+            "Protocol": "tcp",
+            "Ports": ["5432"],
+            "Sources": ["grp-dev"],
+            "DestinationResource": {"ID": "res-db", "Type": "subnet"}
+          }
+        ]
+      }
+    ]
+  },
+  "Routes": [
+    {
+      "ID": "rt-1",
+      "PublicID": "rt-1-pub",
+      "NetID": "office-net",
+      "Network": "10.20.0.0/24",
+      "NetworkType": 1,
+      "Peer": "peer-r",
+      "PeerID": "peer-r",
+      "Metric": 9999,
+      "Masquerade": true,
+      "Enabled": true,
+      "Groups": ["grp-dev"]
+    }
+  ],
+  "NetworkResources": [
+    {
+      "ID": "res-db",
+      "PublicID": "res-db-pub",
+      "NetworkID": "net-1",
+      "Name": "db",
+      "Type": "subnet",
+      "Prefix": "10.10.0.0/24",
+      "Enabled": true
+    }
+  ],
+  "Routers": {
+    "net-1": {
+      "peer-r": {"Masquerade": true, "Metric": 9999, "Enabled": true}
+    }
+  },
+  "NetworkXIDToPublicID": {"net-1": "net-1-pub"}
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/case.json
new file mode 100644
index 000000000..78ac576d9
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "netbird-ssh with AuthorizedGroups: grp-admins members may log in as root, grp-oncall (empty local-user list) as any machine user; peer-srv must receive both mappings in SshAuth, clients get plain TCP firewall rules. THE ENVELOPE EXPECTATION CURRENTLY FAILS, and should: encodeAuthorizedGroups/encodeGroupIDToUserIDs translate group keys via components.Groups, which never holds user-only groups, so the wire loses every authorized user while PeerConfig still reports sshEnabled — the peer runs sshd and denies every login. Pre-existing on main since PR #6711, not a regression. Fix the encoder, do not weaken this expectation.",
+  "peers": ["peer-srv", "peer-a"]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/golden/peer-a.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/golden/peer-a.json
new file mode 100644
index 000000000..6560bc74d
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/golden/peer-a.json
@@ -0,0 +1,63 @@
+{
+  "Serial": "10",
+  "peerConfig": {
+    "address": "100.64.0.1/10",
+    "sshConfig": {},
+    "fqdn": "peer-a.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "jEboa3bOv65XRbq8+8JuagiwWz+mM7Fc5MUfBQbOf6Y=",
+      "allowedIps": [
+        "100.64.0.10/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-srv.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.10",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 22022,
+          "end": 22022
+        }
+      },
+      "PolicyID": "cG9sLXNzaA=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/golden/peer-srv.json
new file mode 100644
index 000000000..0a66bcbf0
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/golden/peer-srv.json
@@ -0,0 +1,109 @@
+{
+  "Serial": "10",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {
+      "sshEnabled": true
+    },
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
+      "allowedIps": [
+        "100.64.0.2/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-b.netbird.test",
+      "agentVersion": "0.60.0"
+    },
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-b.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.2"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 22022,
+          "end": 22022
+        }
+      },
+      "PolicyID": "cG9sLXNzaA=="
+    },
+    {
+      "PeerIP": "100.64.0.2",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 22022,
+          "end": 22022
+        }
+      },
+      "PolicyID": "cG9sLXNzaA=="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub",
+    "AuthorizedUsers": [
+      "CF6q+CJTtcJE8MVIcpPyOw==",
+      "zSsmm7BAxWD/EuunyETFXA==",
+      "0M0MizUGgS6HAaJa0LjGKQ=="
+    ],
+    "machineUsers": {
+      "*": {
+        "indexes": [
+          2
+        ]
+      },
+      "root": {
+        "indexes": [
+          0,
+          1
+        ]
+      }
+    }
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/nmdata.json
new file mode 100644
index 000000000..de0788ac9
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-groups/nmdata.json
@@ -0,0 +1,37 @@
+{
+  "Network": {"Serial": 10},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a", "peer-b"]},
+    "grp-srv": {"Peers": ["peer-srv"]}
+  },
+  "GroupIDToUserIDs": {
+    "grp-admins": ["user-x", "user-y"],
+    "grp-oncall": ["user-z"]
+  },
+  "Policies": [
+    {
+      "ID": "pol-ssh",
+      "PublicID": "pol-ssh-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "netbird-ssh",
+          "PortRanges": [{"Start": 22022, "End": 22022}],
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-srv"],
+          "AuthorizedGroups": {
+            "grp-admins": ["root"],
+            "grp-oncall": []
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-user/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-user/case.json
new file mode 100644
index 000000000..e4799638e
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-user/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "netbird-ssh with a single AuthorizedUser: peer-srv's SshAuth maps the wildcard machine user to exactly user-solo.",
+  "peers": ["peer-srv"]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-user/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-user/golden/peer-srv.json
new file mode 100644
index 000000000..dde0d4014
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-user/golden/peer-srv.json
@@ -0,0 +1,74 @@
+{
+  "Serial": "11",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {
+      "sshEnabled": true
+    },
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 22022,
+          "end": 22022
+        }
+      },
+      "PolicyID": "cG9sLXNzaC11c2Vy"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub",
+    "AuthorizedUsers": [
+      "/6cwl49UgLozU42NCr0RUA=="
+    ],
+    "machineUsers": {
+      "*": {
+        "indexes": [
+          0
+        ]
+      }
+    }
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-user/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-user/nmdata.json
new file mode 100644
index 000000000..1c92329a8
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-authorized-user/nmdata.json
@@ -0,0 +1,29 @@
+{
+  "Network": {"Serial": 11},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]},
+    "grp-srv": {"Peers": ["peer-srv"]}
+  },
+  "Policies": [
+    {
+      "ID": "pol-ssh-user",
+      "PublicID": "pol-ssh-user-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "netbird-ssh",
+          "PortRanges": [{"Start": 22022, "End": 22022}],
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-srv"],
+          "AuthorizedUser": "user-solo"
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-fallback-allowed-users/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-fallback-allowed-users/case.json
new file mode 100644
index 000000000..8d4fb6c1a
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-fallback-allowed-users/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "netbird-ssh with neither AuthorizedGroups nor AuthorizedUser falls back to the account AllowedUserIDs under the wildcard machine user — and works with the peer's own SSHEnabled left off, unlike legacy SSH.",
+  "peers": ["peer-srv"]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-fallback-allowed-users/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-fallback-allowed-users/golden/peer-srv.json
new file mode 100644
index 000000000..e63768a95
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-fallback-allowed-users/golden/peer-srv.json
@@ -0,0 +1,76 @@
+{
+  "Serial": "12",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {
+      "sshEnabled": true
+    },
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "PortInfo": {
+        "range": {
+          "start": 22022,
+          "end": 22022
+        }
+      },
+      "PolicyID": "cG9sLXNzaC1hbnk="
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub",
+    "AuthorizedUsers": [
+      "O8fBfcakRSAM4gX+YBNe+w==",
+      "1vwcS03btOdBRX0dhz0NRg=="
+    ],
+    "machineUsers": {
+      "*": {
+        "indexes": [
+          0,
+          1
+        ]
+      }
+    }
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-fallback-allowed-users/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-fallback-allowed-users/nmdata.json
new file mode 100644
index 000000000..97bfe3342
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-fallback-allowed-users/nmdata.json
@@ -0,0 +1,29 @@
+{
+  "Network": {"Serial": 12},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]},
+    "grp-srv": {"Peers": ["peer-srv"]}
+  },
+  "AllowedUserIDs": {"user-1": {}, "user-2": {}},
+  "Policies": [
+    {
+      "ID": "pol-ssh-any",
+      "PublicID": "pol-ssh-any-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "netbird-ssh",
+          "PortRanges": [{"Start": 22022, "End": 22022}],
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-srv"]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-legacy-disabled/case.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-legacy-disabled/case.json
new file mode 100644
index 000000000..1427fbd19
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-legacy-disabled/case.json
@@ -0,0 +1,4 @@
+{
+  "description": "A tcp/22 policy implies legacy SSH only when the destination peer has SSHEnabled; here it does not, so peer-srv gets the firewall rules but no authorized users.",
+  "peers": ["peer-srv"]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-legacy-disabled/golden/peer-srv.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-legacy-disabled/golden/peer-srv.json
new file mode 100644
index 000000000..1ab6d4697
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-legacy-disabled/golden/peer-srv.json
@@ -0,0 +1,64 @@
+{
+  "Serial": "13",
+  "peerConfig": {
+    "address": "100.64.0.10/10",
+    "sshConfig": {},
+    "fqdn": "peer-srv.netbird.test",
+    "autoUpdate": {}
+  },
+  "remotePeers": [
+    {
+      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
+      "allowedIps": [
+        "100.64.0.1/32"
+      ],
+      "sshConfig": {},
+      "fqdn": "peer-a.netbird.test",
+      "agentVersion": "0.60.0"
+    }
+  ],
+  "DNSConfig": {
+    "ServiceEnable": true,
+    "CustomZones": [
+      {
+        "Domain": "netbird.test.",
+        "Records": [
+          {
+            "Name": "peer-a.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.1"
+          },
+          {
+            "Name": "peer-srv.netbird.test",
+            "Type": "1",
+            "Class": "IN",
+            "TTL": "300",
+            "RData": "100.64.0.10"
+          }
+        ]
+      }
+    ],
+    "ForwarderPort": "22054"
+  },
+  "FirewallRules": [
+    {
+      "PeerIP": "100.64.0.1",
+      "Protocol": "TCP",
+      "Port": "22",
+      "PolicyID": "cG9sLXRjcDIy"
+    },
+    {
+      "PeerIP": "100.64.0.1",
+      "Direction": "OUT",
+      "Protocol": "TCP",
+      "Port": "22",
+      "PolicyID": "cG9sLXRjcDIy"
+    }
+  ],
+  "routesFirewallRulesIsEmpty": true,
+  "sshAuth": {
+    "UserIDClaim": "sub"
+  }
+}
diff --git a/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-legacy-disabled/nmdata.json b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-legacy-disabled/nmdata.json
new file mode 100644
index 000000000..f00d0f06e
--- /dev/null
+++ b/management/internals/controllers/network_map/nmaptest/testdata/cases/ssh-legacy-disabled/nmdata.json
@@ -0,0 +1,30 @@
+{
+  "Network": {"Serial": 13},
+  "Peers": {
+    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
+    "peer-srv": {"IP": "100.64.0.10", "Meta": {"WtVersion": "0.60.0"}}
+  },
+  "Groups": {
+    "grp-dev": {"Peers": ["peer-a"]},
+    "grp-srv": {"Peers": ["peer-srv"]}
+  },
+  "AllowedUserIDs": {"user-1": {}},
+  "Policies": [
+    {
+      "ID": "pol-tcp22",
+      "PublicID": "pol-tcp22-pub",
+      "Enabled": true,
+      "Rules": [
+        {
+          "Enabled": true,
+          "Action": "accept",
+          "Protocol": "tcp",
+          "Ports": ["22"],
+          "Bidirectional": true,
+          "Sources": ["grp-dev"],
+          "Destinations": ["grp-srv"]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/management/internals/controllers/network_map/update_channel.go b/management/internals/controllers/network_map/update_channel.go
index 0b085b85f..e61432069 100644
--- a/management/internals/controllers/network_map/update_channel.go
+++ b/management/internals/controllers/network_map/update_channel.go
@@ -6,6 +6,10 @@ type PeersUpdateManager interface {
 	SendUpdate(ctx context.Context, peerID string, update *UpdateMessage)
 	CreateChannel(ctx context.Context, peerID string) chan *UpdateMessage
 	CloseChannel(ctx context.Context, peerID string)
+	// CloseSessionChannel closes the peer's channel and returns true, unless a channel of
+	// another session is registered, in which case it returns false and closes nothing.
+	// A nil session is the newest session and closes any registered channel.
+	CloseSessionChannel(ctx context.Context, peerID string, session chan *UpdateMessage) bool
 	CountStreams() int
 	HasChannel(peerID string) bool
 	CloseChannels(ctx context.Context, peerIDs []string)
diff --git a/management/internals/controllers/network_map/update_channel/updatechannel.go b/management/internals/controllers/network_map/update_channel/updatechannel.go
index 91627bf15..a8e29afa0 100644
--- a/management/internals/controllers/network_map/update_channel/updatechannel.go
+++ b/management/internals/controllers/network_map/update_channel/updatechannel.go
@@ -133,6 +133,30 @@ func (p *PeersUpdateManager) CloseChannel(ctx context.Context, peerID string) {
 	p.closeChannel(ctx, peerID)
 }
 
+// CloseSessionChannel closes the peer's updates channel only while it is still session's channel.
+// It returns false when a newer stream has registered a different channel, which the stale
+// session must leave to its new owner. A nil session belongs to a stream that failed before
+// registering its own channel; it is the newest session and closes any channel still registered.
+func (p *PeersUpdateManager) CloseSessionChannel(ctx context.Context, peerID string, session chan *network_map.UpdateMessage) bool {
+	start := time.Now()
+
+	p.channelsMux.Lock()
+	defer func() {
+		p.channelsMux.Unlock()
+		if p.metrics != nil {
+			p.metrics.UpdateChannelMetrics().CountCloseChannelDuration(time.Since(start))
+		}
+	}()
+
+	if channel, ok := p.peerChannels[peerID]; ok && session != nil && channel != session {
+		log.WithContext(ctx).Debugf("skipped closing updates channel: peer %s is owned by a newer session", peerID)
+		return false
+	}
+
+	p.closeChannel(ctx, peerID)
+	return true
+}
+
 // GetAllConnectedPeers returns a copy of the connected peers map
 func (p *PeersUpdateManager) GetAllConnectedPeers() map[string]struct{} {
 	start := time.Now()
diff --git a/management/internals/controllers/network_map/update_channel/updatechannel_test.go b/management/internals/controllers/network_map/update_channel/updatechannel_test.go
index c73baf81f..bceefecf3 100644
--- a/management/internals/controllers/network_map/update_channel/updatechannel_test.go
+++ b/management/internals/controllers/network_map/update_channel/updatechannel_test.go
@@ -5,6 +5,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
@@ -84,3 +87,55 @@ func TestCloseChannel(t *testing.T) {
 		t.Error("Error closing the channel")
 	}
 }
+
+func TestCloseSessionChannel(t *testing.T) {
+	ctx := context.Background()
+	const peer = "test-close-session"
+
+	t.Run("own channel is closed", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		session := peersUpdater.CreateChannel(ctx, peer)
+
+		require.True(t, peersUpdater.CloseSessionChannel(ctx, peer, session))
+		assert.False(t, peersUpdater.HasChannel(peer))
+		_, open := <-session
+		assert.False(t, open, "own channel must be closed")
+	})
+
+	t.Run("newer session channel is kept", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		stale := peersUpdater.CreateChannel(ctx, peer)
+		current := peersUpdater.CreateChannel(ctx, peer)
+
+		require.False(t, peersUpdater.CloseSessionChannel(ctx, peer, stale))
+		require.True(t, peersUpdater.HasChannel(peer))
+		assert.Equal(t, current, peersUpdater.peerChannels[peer])
+
+		peersUpdater.SendUpdate(ctx, peer, &network_map.UpdateMessage{})
+		select {
+		case _, open := <-current:
+			assert.True(t, open, "newer session channel must stay open")
+		default:
+			t.Fatal("newer session channel did not receive the update")
+		}
+	})
+
+	t.Run("no registered channel", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		session := peersUpdater.CreateChannel(ctx, peer)
+		peersUpdater.CloseChannel(ctx, peer)
+
+		assert.True(t, peersUpdater.CloseSessionChannel(ctx, peer, session))
+		assert.True(t, peersUpdater.CloseSessionChannel(ctx, peer, nil))
+	})
+
+	t.Run("nil session closes the registered channel", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		current := peersUpdater.CreateChannel(ctx, peer)
+
+		require.True(t, peersUpdater.CloseSessionChannel(ctx, peer, nil))
+		assert.False(t, peersUpdater.HasChannel(peer))
+		_, open := <-current
+		assert.False(t, open, "registered channel must be closed")
+	})
+}
diff --git a/management/internals/modules/agentnetwork/accesslog_cleanup_realstore_test.go b/management/internals/modules/agentnetwork/accesslog_cleanup_realstore_test.go
new file mode 100644
index 000000000..0e294a560
--- /dev/null
+++ b/management/internals/modules/agentnetwork/accesslog_cleanup_realstore_test.go
@@ -0,0 +1,76 @@
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+)
+
+// TestCleanupAccessLogs_RealStore_DeletedAccount covers a deleted account's access logs.
+// The sweep is driven by settings rows, which go with the account, so without a fallback
+// those logs would never expire. They get the default retention instead. A live account
+// can delete its own settings row, so "no settings" must not be mistaken for "deleted":
+// that account's logs are left alone, as are those of an account that keeps logs forever.
+func TestCleanupAccessLogs_RealStore_DeletedAccount(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	const (
+		deletedAccountID    = "acc-deleted"
+		keepAccountID       = "acc-keep-forever"
+		noSettingsAccountID = "acc-live-no-settings"
+	)
+	old := time.Now().UTC().AddDate(0, 0, -(types.DefaultAccessLogRetentionDays + 10))
+	recent := time.Now().UTC().AddDate(0, 0, -1)
+
+	require.NoError(t, s.SaveAccount(ctx, &nbtypes.Account{Id: keepAccountID}))
+	require.NoError(t, s.SaveAccount(ctx, &nbtypes.Account{Id: noSettingsAccountID}))
+
+	keepSettings := types.DefaultSettings(keepAccountID)
+	keepSettings.Domain = "keep.gw.example.com"
+	keepSettings.AccessLogRetentionDays = 0
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, keepSettings))
+
+	mkLog := func(id, accountID string, ts time.Time) {
+		t.Helper()
+		entry := &types.AgentNetworkAccessLog{
+			ID: id, AccountID: accountID, ServiceID: "svc", Timestamp: ts, StatusCode: 200, Model: "gpt-4o",
+		}
+		groups := []types.AgentNetworkAccessLogGroup{{LogID: id, GroupID: "grp-eng", AccountID: accountID}}
+		require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, entry, groups))
+	}
+	mkLog("deleted-old", deletedAccountID, old)
+	mkLog("deleted-recent", deletedAccountID, recent)
+	mkLog("keep-old", keepAccountID, old)
+	mkLog("no-settings-old", noSettingsAccountID, old)
+
+	m := &managerImpl{store: s}
+	m.cleanupAccessLogsOnce(ctx)
+
+	logIDs := func(accountID string) []string {
+		t.Helper()
+		logs, _, err := s.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, accountID,
+			types.AgentNetworkAccessLogFilter{Page: 1, PageSize: 50})
+		require.NoError(t, err)
+		ids := make([]string, 0, len(logs))
+		for _, l := range logs {
+			ids = append(ids, l.ID)
+		}
+		return ids
+	}
+	assert.Equal(t, []string{"deleted-recent"}, logIDs(deletedAccountID),
+		"a deleted account should have logs past the default retention swept")
+	assert.Equal(t, []string{"keep-old"}, logIDs(keepAccountID),
+		"an account with retention disabled should keep its old logs")
+	assert.Equal(t, []string{"no-settings-old"}, logIDs(noSettingsAccountID),
+		"a live account without a settings row should keep its old logs")
+}
diff --git a/management/internals/modules/agentnetwork/accesslog_ingest.go b/management/internals/modules/agentnetwork/accesslog_ingest.go
index 59e53efa2..ecc1780f3 100644
--- a/management/internals/modules/agentnetwork/accesslog_ingest.go
+++ b/management/internals/modules/agentnetwork/accesslog_ingest.go
@@ -18,21 +18,26 @@ import (
 // contract between the proxy and management; management flattens them into
 // queryable columns. Keep in sync with the proxy side.
 const (
-	metaKeyProvider           = "llm.provider"
-	metaKeyModel              = "llm.model"
-	metaKeyResolvedProviderID = "llm.resolved_provider_id"
-	metaKeySelectedPolicyID   = "llm.selected_policy_id"
-	metaKeyPolicyDecision     = "llm_policy.decision"
-	metaKeyPolicyReason       = "llm_policy.reason"
-	metaKeyInputTokens        = "llm.input_tokens"  //nolint:gosec // metadata key name, not a credential
-	metaKeyOutputTokens       = "llm.output_tokens" //nolint:gosec // metadata key name, not a credential
-	metaKeyTotalTokens        = "llm.total_tokens"  //nolint:gosec // metadata key name, not a credential
-	metaKeyCostUSDTotal       = "cost.usd_total"
-	metaKeyStream             = "llm.stream"
-	metaKeySessionID          = "llm.session_id"
-	metaKeyAuthorisingGroups  = "llm.authorising_groups"
-	metaKeyRequestPrompt      = "llm.request_prompt"
-	metaKeyResponseCompletion = "llm.response_completion"
+	metaKeyProvider            = "llm.provider"
+	metaKeyModel               = "llm.model"
+	metaKeyResolvedProviderID  = "llm.resolved_provider_id"
+	metaKeySelectedPolicyID    = "llm.selected_policy_id"
+	metaKeyPolicyDecision      = "llm_policy.decision"
+	metaKeyPolicyReason        = "llm_policy.reason"
+	metaKeyInputTokens         = "llm.input_tokens"          //nolint:gosec // metadata key name, not a credential
+	metaKeyOutputTokens        = "llm.output_tokens"         //nolint:gosec // metadata key name, not a credential
+	metaKeyTotalTokens         = "llm.total_tokens"          //nolint:gosec // metadata key name, not a credential
+	metaKeyCachedInputTokens   = "llm.cached_input_tokens"   //nolint:gosec // metadata key name, not a credential
+	metaKeyCacheCreationTokens = "llm.cache_creation_tokens" //nolint:gosec // metadata key name, not a credential
+	metaKeyCostUSDInput        = "cost.usd_input"
+	metaKeyCostUSDCachedInput  = "cost.usd_cached_input"
+	metaKeyCostUSDCacheCreate  = "cost.usd_cache_creation"
+	metaKeyCostUSDOutput       = "cost.usd_output"
+	metaKeyStream              = "llm.stream"
+	metaKeySessionID           = "llm.session_id"
+	metaKeyAuthorisingGroups   = "llm.authorising_groups"
+	metaKeyRequestPrompt       = "llm.request_prompt"
+	metaKeyResponseCompletion  = "llm.response_completion"
 )
 
 // IngestAccessLog flattens the metadata-bearing reverse-proxy access-log entry
@@ -108,20 +113,25 @@ func flattenAccessLog(e *accesslogs.AccessLogEntry) (*types.AgentNetworkAccessLo
 		BytesUpload:   e.BytesUpload,
 		BytesDownload: e.BytesDownload,
 
-		Provider:           meta[metaKeyProvider],
-		Model:              meta[metaKeyModel],
-		SessionID:          meta[metaKeySessionID],
-		ResolvedProviderID: meta[metaKeyResolvedProviderID],
-		SelectedPolicyID:   meta[metaKeySelectedPolicyID],
-		Decision:           meta[metaKeyPolicyDecision],
-		DenyReason:         meta[metaKeyPolicyReason],
-		InputTokens:        parseMetaInt(meta, metaKeyInputTokens),
-		OutputTokens:       parseMetaInt(meta, metaKeyOutputTokens),
-		TotalTokens:        parseMetaInt(meta, metaKeyTotalTokens),
-		CostUSD:            parseMetaFloat(meta, metaKeyCostUSDTotal),
-		Stream:             parseMetaBool(meta, metaKeyStream),
-		RequestPrompt:      meta[metaKeyRequestPrompt],
-		ResponseCompletion: meta[metaKeyResponseCompletion],
+		Provider:             meta[metaKeyProvider],
+		Model:                meta[metaKeyModel],
+		SessionID:            meta[metaKeySessionID],
+		ResolvedProviderID:   meta[metaKeyResolvedProviderID],
+		SelectedPolicyID:     meta[metaKeySelectedPolicyID],
+		Decision:             meta[metaKeyPolicyDecision],
+		DenyReason:           meta[metaKeyPolicyReason],
+		InputTokens:          parseMetaInt(meta, metaKeyInputTokens),
+		OutputTokens:         parseMetaInt(meta, metaKeyOutputTokens),
+		TotalTokens:          parseMetaInt(meta, metaKeyTotalTokens),
+		CachedInputTokens:    parseMetaInt(meta, metaKeyCachedInputTokens),
+		CacheCreationTokens:  parseMetaInt(meta, metaKeyCacheCreationTokens),
+		InputCostUSD:         parseMetaFloat(meta, metaKeyCostUSDInput),
+		CachedInputCostUSD:   parseMetaFloat(meta, metaKeyCostUSDCachedInput),
+		CacheCreationCostUSD: parseMetaFloat(meta, metaKeyCostUSDCacheCreate),
+		OutputCostUSD:        parseMetaFloat(meta, metaKeyCostUSDOutput),
+		Stream:               parseMetaBool(meta, metaKeyStream),
+		RequestPrompt:        meta[metaKeyRequestPrompt],
+		ResponseCompletion:   meta[metaKeyResponseCompletion],
 	}
 
 	var groups []types.AgentNetworkAccessLogGroup
@@ -140,18 +150,23 @@ func flattenAccessLog(e *accesslogs.AccessLogEntry) (*types.AgentNetworkAccessLo
 // log's ID so the two correlate.
 func usageFromFlattenedLog(e *types.AgentNetworkAccessLog, groups []types.AgentNetworkAccessLogGroup) (*types.AgentNetworkUsage, []types.AgentNetworkUsageGroup) {
 	usage := &types.AgentNetworkUsage{
-		ID:                 e.ID,
-		AccountID:          e.AccountID,
-		Timestamp:          e.Timestamp,
-		UserID:             e.UserID,
-		ResolvedProviderID: e.ResolvedProviderID,
-		Provider:           e.Provider,
-		Model:              e.Model,
-		SessionID:          e.SessionID,
-		InputTokens:        e.InputTokens,
-		OutputTokens:       e.OutputTokens,
-		TotalTokens:        e.TotalTokens,
-		CostUSD:            e.CostUSD,
+		ID:                   e.ID,
+		AccountID:            e.AccountID,
+		Timestamp:            e.Timestamp,
+		UserID:               e.UserID,
+		ResolvedProviderID:   e.ResolvedProviderID,
+		Provider:             e.Provider,
+		Model:                e.Model,
+		SessionID:            e.SessionID,
+		InputTokens:          e.InputTokens,
+		OutputTokens:         e.OutputTokens,
+		TotalTokens:          e.TotalTokens,
+		CachedInputTokens:    e.CachedInputTokens,
+		CacheCreationTokens:  e.CacheCreationTokens,
+		InputCostUSD:         e.InputCostUSD,
+		CachedInputCostUSD:   e.CachedInputCostUSD,
+		CacheCreationCostUSD: e.CacheCreationCostUSD,
+		OutputCostUSD:        e.OutputCostUSD,
 	}
 
 	usageGroups := make([]types.AgentNetworkUsageGroup, 0, len(groups))
diff --git a/management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go b/management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go
index 431ce680e..cd81cfbe4 100644
--- a/management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go
+++ b/management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go
@@ -28,17 +28,22 @@ func newIngestTestEntry() *accesslogs.AccessLogEntry {
 		UserId:       "user-1",
 		AgentNetwork: true,
 		Metadata: map[string]string{
-			metaKeyProvider:           "openai",
-			metaKeyModel:              "gpt-5.4",
-			metaKeyResolvedProviderID: "prov-1",
-			metaKeySessionID:          "sess-1",
-			metaKeyInputTokens:        "100",
-			metaKeyOutputTokens:       "50",
-			metaKeyTotalTokens:        "150",
-			metaKeyCostUSDTotal:       "0.0123",
-			metaKeyStream:             "true",
-			metaKeyRequestPrompt:      "hello",
-			metaKeyResponseCompletion: "world",
+			metaKeyProvider:            "openai",
+			metaKeyModel:               "gpt-5.4",
+			metaKeyResolvedProviderID:  "prov-1",
+			metaKeySessionID:           "sess-1",
+			metaKeyInputTokens:         "100",
+			metaKeyOutputTokens:        "50",
+			metaKeyTotalTokens:         "1174",
+			metaKeyCachedInputTokens:   "256",
+			metaKeyCacheCreationTokens: "768",
+			metaKeyCostUSDInput:        "0.0071",
+			metaKeyCostUSDCachedInput:  "0.0009",
+			metaKeyCostUSDCacheCreate:  "0.0020",
+			metaKeyCostUSDOutput:       "0.0023",
+			metaKeyStream:              "true",
+			metaKeyRequestPrompt:       "hello",
+			metaKeyResponseCompletion:  "world",
 			// repeated id must be de-duplicated before the group rows insert.
 			metaKeyAuthorisingGroups: "grp-eng,grp-eng,grp-ops",
 		},
@@ -65,7 +70,19 @@ func TestIngestAccessLog_RealStore_LogCollectionOff(t *testing.T) {
 	require.Len(t, usage, 1, "usage row must be written even with log collection off")
 	assert.Equal(t, int64(100), usage[0].InputTokens, "input tokens must round-trip from metadata")
 	assert.Equal(t, int64(50), usage[0].OutputTokens, "output tokens must round-trip from metadata")
-	assert.InDelta(t, 0.0123, usage[0].CostUSD, 1e-9, "cost must round-trip from metadata")
+	assert.Equal(t, int64(256), usage[0].CachedInputTokens, "cache-read tokens must round-trip from metadata")
+	assert.Equal(t, int64(768), usage[0].CacheCreationTokens, "cache-write tokens must round-trip from metadata")
+	// The per-bucket breakdown is the only cost state stored, and must survive
+	// the write/read cycle as real columns — usage rows are the only cost
+	// record for accounts with log collection off, so a dropped column here
+	// loses the split permanently.
+	assert.InDelta(t, 0.0071, usage[0].InputCostUSD, 1e-9, "input cost must round-trip from metadata")
+	assert.InDelta(t, 0.0009, usage[0].CachedInputCostUSD, 1e-9, "cache-read cost must round-trip from metadata")
+	assert.InDelta(t, 0.0020, usage[0].CacheCreationCostUSD, 1e-9, "cache-write cost must round-trip from metadata")
+	assert.InDelta(t, 0.0023, usage[0].OutputCostUSD, 1e-9, "output cost must round-trip from metadata")
+	// Aggregates are derived from the stored columns, never stored themselves.
+	assert.InDelta(t, 0.0123, usage[0].TotalCostUSD(), 1e-9, "total is derived from the stored buckets")
+	assert.InDelta(t, 0.0029, usage[0].CacheCostUSD(), 1e-9, "cache cost is derived from the two cache buckets")
 
 	logs, _, err := s.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, testAccountID, types.AgentNetworkAccessLogFilter{})
 	require.NoError(t, err)
@@ -96,6 +113,14 @@ func TestIngestAccessLog_RealStore_LogCollectionOn(t *testing.T) {
 	require.Equal(t, int64(1), total, "exactly one access-log row expected")
 	require.Len(t, logs, 1, "full access-log row must be written when log collection is on")
 	assert.Equal(t, "gpt-5.4", logs[0].Model, "model must flatten from metadata")
+	assert.Equal(t, int64(256), logs[0].CachedInputTokens, "cache-read tokens must flatten from metadata")
+	assert.Equal(t, int64(768), logs[0].CacheCreationTokens, "cache-write tokens must flatten from metadata")
+	assert.InDelta(t, 0.0029, logs[0].CacheCostUSD(), 1e-9, "cache cost is derived from the two cache buckets")
+	assert.InDelta(t, 0.0123, logs[0].TotalCostUSD(), 1e-9, "total is derived from the stored buckets")
+	assert.InDelta(t, 0.0071, logs[0].InputCostUSD, 1e-9, "input cost must flatten from metadata")
+	assert.InDelta(t, 0.0009, logs[0].CachedInputCostUSD, 1e-9, "cache-read cost must flatten from metadata")
+	assert.InDelta(t, 0.0020, logs[0].CacheCreationCostUSD, 1e-9, "cache-write cost must flatten from metadata")
+	assert.InDelta(t, 0.0023, logs[0].OutputCostUSD, 1e-9, "output cost must flatten from metadata")
 	assert.Equal(t, "hello", logs[0].RequestPrompt, "prompt must be retained when log collection is on")
 	assert.Equal(t, "world", logs[0].ResponseCompletion, "completion must be retained when log collection is on")
 	assert.True(t, logs[0].Stream, "stream flag must flatten from metadata")
diff --git a/management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go b/management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go
index 7d53d7547..94518c2f7 100644
--- a/management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go
+++ b/management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go
@@ -38,7 +38,7 @@ func accessLogRow(id, sessionID string, ts time.Time, opts ...func(*types.AgentN
 		InputTokens:        100,
 		OutputTokens:       50,
 		TotalTokens:        150,
-		CostUSD:            0.01,
+		InputCostUSD:       0.01,
 	}
 	for _, o := range opts {
 		o(e)
@@ -74,7 +74,7 @@ func withTokens(in, out, total int64, cost float64) func(*types.AgentNetworkAcce
 		e.InputTokens = in
 		e.OutputTokens = out
 		e.TotalTokens = total
-		e.CostUSD = cost
+		e.InputCostUSD = cost
 	}
 }
 
@@ -155,7 +155,7 @@ func TestAccessLogSessions_FoldAndAggregate(t *testing.T) {
 	assert.Equal(t, int64(310), a.InputTokens, "input tokens summed")
 	assert.Equal(t, int64(135), a.OutputTokens, "output tokens summed")
 	assert.Equal(t, int64(445), a.TotalTokens, "total tokens summed")
-	assert.InDelta(t, 0.031, a.CostUSD, 1e-9, "cost summed")
+	assert.InDelta(t, 0.031, a.TotalCostUSD(), 1e-9, "cost summed")
 	assert.Equal(t, "deny", a.Decision, "any deny makes the session a deny")
 	assert.ElementsMatch(t, []string{"openai", "anthropic"}, a.Providers, "distinct providers")
 	assert.ElementsMatch(t, []string{"gpt-5.4", "claude-haiku-4-5"}, a.Models, "distinct models")
diff --git a/management/internals/modules/agentnetwork/agent_config.go b/management/internals/modules/agentnetwork/agent_config.go
new file mode 100644
index 000000000..902652479
--- /dev/null
+++ b/management/internals/modules/agentnetwork/agent_config.go
@@ -0,0 +1,300 @@
+package agentnetwork
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// GetAgentConfigForUser returns the Agent Network setup the calling user's
+// groups authorize. It deliberately performs no role permission check:
+// the result is scoped to the caller's own groups, which is strictly
+// tighter than any role gate, so every authenticated user (any role) may
+// read it. The group source matches enforcement: the proxy authorizes
+// each Agent Network request against the calling user's groups as well —
+// session validation resolves them from the same user record's
+// auto-groups — so this answer and the proxy's verdict are computed from
+// the same memberships.
+func (m *managerImpl) GetAgentConfigForUser(ctx context.Context, accountID, userID string) (*types.AgentConfig, error) {
+	user, err := m.store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+	if err != nil {
+		return nil, fmt.Errorf("get user: %w", err)
+	}
+	return m.agentConfigForGroups(ctx, accountID, user.AutoGroups)
+}
+
+// agentConfigForGroups computes the effective Agent Network setup for
+// a set of caller groups: the account endpoint plus, per authorized
+// provider, the effective model set. It mirrors what the proxy enforces
+// at request time — the policy filter matches filterApplicablePolicies,
+// the model logic matches policyPermitsModel, and orphan providers
+// (enabled but referenced by no applicable policy) are omitted just like
+// the router synthesizer omits them — so the answer never advertises
+// anything the proxy would refuse.
+//
+// Configured tracks the account, not the caller: once the account has an
+// endpoint every member gets it, with Providers empty for those no policy
+// covers yet. The dashboard shows each user the same connection config
+// regardless of role, and an empty provider list tells them to ask for
+// access. Only the account having no Agent Network at all reads as not
+// configured. Providers stays caller-scoped either way — the endpoint on
+// its own authorizes nothing, and the proxy still refuses every request
+// no policy permits.
+func (m *managerImpl) agentConfigForGroups(ctx context.Context, accountID string, groupIDs []string) (*types.AgentConfig, error) {
+	notConfigured := &types.AgentConfig{Providers: []types.AgentConfigProvider{}}
+
+	settings, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	switch {
+	case err == nil:
+	case isNotFound(err):
+		return notConfigured, nil
+	default:
+		return nil, fmt.Errorf("get agent network settings: %w", err)
+	}
+	if settings.Endpoint() == "" {
+		return notConfigured, nil
+	}
+
+	authorized, applicable, err := m.authorizedProvidersForGroups(ctx, accountID, groupIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	out := &types.AgentConfig{
+		Configured: true,
+		Endpoint:   "https://" + settings.Endpoint(),
+		Providers:  make([]types.AgentConfigProvider, 0, len(authorized)),
+	}
+	if len(authorized) == 0 {
+		return out, nil
+	}
+
+	var guardrailsByID map[string]*types.Guardrail
+	if anyPolicyHasGuardrails(applicable) {
+		guardrailsByID, err = m.loadGuardrailsByID(ctx, accountID)
+		if err != nil {
+			return nil, err
+		}
+	}
+	for _, p := range authorized {
+		allAllowed, models := effectiveModelsForProvider(p, policiesForProvider(applicable, p.ID), guardrailsByID)
+		flavor := ""
+		if entry, ok := catalog.Lookup(p.ProviderID); ok {
+			flavor = entry.ParserID
+		}
+		out.Providers = append(out.Providers, types.AgentConfigProvider{
+			Name:             p.Name,
+			CatalogID:        p.ProviderID,
+			APIFlavor:        flavor,
+			AllModelsAllowed: allAllowed,
+			Models:           models,
+		})
+	}
+	return out, nil
+}
+
+// authorizedProvidersForGroups returns the enabled providers referenced
+// by at least one enabled policy whose source groups intersect groupIDs —
+// the providers the caller's own policies authorize — in created_at order
+// with ID tiebreak, the same deterministic order the router synthesizer
+// presents. The applicable policies come back alongside so callers that
+// need per-provider policy context (the setup's model computation) don't
+// re-filter. Both the self-service setup answer and the caller-scoped
+// provider list are built from this selection, so what the dashboard
+// offers and what the proxy enforces never diverge.
+func (m *managerImpl) authorizedProvidersForGroups(ctx context.Context, accountID string, groupIDs []string) ([]*types.Provider, []*types.Policy, error) {
+	policies, err := m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, nil, fmt.Errorf("list account policies: %w", err)
+	}
+	applicable := filterPoliciesByGroups(policies, groupIDs)
+	if len(applicable) == 0 {
+		return nil, nil, nil
+	}
+
+	providers, err := m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, nil, fmt.Errorf("list account providers: %w", err)
+	}
+
+	// filterEnabledProviders carries the enabled filter and the
+	// created_at/ID order shared with the router synthesizer.
+	enabled := filterEnabledProviders(providers)
+	authorized := make([]*types.Provider, 0, len(enabled))
+	for _, p := range enabled {
+		if len(policiesForProvider(applicable, p.ID)) == 0 {
+			continue
+		}
+		authorized = append(authorized, p)
+	}
+	return authorized, applicable, nil
+}
+
+// filterPoliciesByGroups returns the enabled policies whose SourceGroups
+// intersect the caller's groups. Same group matching as
+// filterApplicablePolicies, without the per-provider filter — the setup
+// answer spans every provider the caller can reach.
+func filterPoliciesByGroups(policies []*types.Policy, groupIDs []string) []*types.Policy {
+	groupSet := make(map[string]struct{}, len(groupIDs))
+	for _, g := range groupIDs {
+		if g != "" {
+			groupSet[g] = struct{}{}
+		}
+	}
+	out := make([]*types.Policy, 0, len(policies))
+	for _, p := range policies {
+		if p == nil || !p.Enabled {
+			continue
+		}
+		if !anyGroupMatches(p.SourceGroups, groupSet) {
+			continue
+		}
+		out = append(out, p)
+	}
+	return out
+}
+
+// policiesForProvider returns the subset of policies targeting the
+// provider, order preserved.
+func policiesForProvider(policies []*types.Policy, providerID string) []*types.Policy {
+	out := make([]*types.Policy, 0, len(policies))
+	for _, p := range policies {
+		if sliceContains(p.DestinationProviderIDs, providerID) {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// effectiveModelsForProvider derives the caller's effective model set for
+// one provider from the applicable policies that target it, mirroring
+// policyPermitsModel: a policy with no allowlist-enabled guardrail is
+// unrestricted, and one unrestricted policy makes the whole provider
+// unrestricted (the proxy would admit any model through it). Otherwise
+// the union of the policies' allowlists applies, intersected with the
+// provider's declared models when the operator declared any — the router
+// only claims declared models, so an allowlisted-but-undeclared model is
+// unreachable and must not be advertised. With no declared models the
+// router claims every model, so the allowlist union stands alone.
+// Allowlist entries and declared ids both compare through the canonical
+// id the proxy's parser emits, so an allowlist may hold either form: the
+// raw declared id the dashboard's picker copies from the provider, or
+// the stripped id the parser matches at request time.
+func effectiveModelsForProvider(provider *types.Provider, policies []*types.Policy, guardrailsByID map[string]*types.Guardrail) (bool, []string) {
+	restricted := true
+	union := make([]string, 0)
+	seen := make(map[string]struct{})
+	for _, p := range policies {
+		policyRestricted := false
+		for _, gID := range p.GuardrailIDs {
+			g, ok := guardrailsByID[gID]
+			if !ok || g == nil || !g.Checks.ModelAllowlist.Enabled {
+				continue
+			}
+			policyRestricted = true
+			for _, model := range g.Checks.ModelAllowlist.Models {
+				key := canonicalModelKey(provider.ProviderID, model)
+				if key == "" {
+					continue
+				}
+				if _, dup := seen[key]; dup {
+					continue
+				}
+				seen[key] = struct{}{}
+				union = append(union, key)
+			}
+		}
+		if !policyRestricted {
+			restricted = false
+		}
+	}
+
+	declared := declaredModelIDs(provider)
+	if !restricted {
+		return true, declared
+	}
+	if len(provider.Models) == 0 {
+		// No operator declaration: the router claims every model, so the
+		// allowlist union is the effective set as-is.
+		return false, union
+	}
+	out := make([]string, 0, len(declared))
+	for _, id := range declared {
+		// Compare through the canonical id the proxy's parser emits — a
+		// Bedrock declaration may carry the region/version form
+		// ("eu.anthropic.claude-...-v1:0") that the parser strips at
+		// request time, and the raw forms would never intersect. The
+		// declared id itself is what gets advertised, matching the
+		// router's route claim.
+		if _, ok := seen[canonicalModelKey(provider.ProviderID, id)]; ok {
+			out = append(out, id)
+		}
+	}
+	return false, out
+}
+
+// canonicalModelKey builds the compare key for a model id: lowercased,
+// trimmed, and canonicalized through the provider-aware normalization the
+// proxy's parser applies. Lowercase/trim comes FIRST — the path-style
+// strippers anchor on a lowercase id's tail, so a trailing space or a
+// case-variant geography/version would otherwise survive into the key.
+func canonicalModelKey(catalogProviderID, id string) string {
+	return normaliseModelID(normalizePricingModelID(catalogProviderID, normaliseModelID(id)))
+}
+
+// providerModelsByID maps effective model ids (as effectiveModelsForProvider
+// returns them) back onto the operator's declared entries, keeping the
+// declared casing and prices. With no operator declaration the ids are the
+// allowlist union and have no declared entry to map to, so bare entries are
+// synthesized — the router claims every model in that case, so those ids are
+// reachable and belong in the answer.
+func providerModelsByID(provider *types.Provider, ids []string) []types.ProviderModel {
+	if len(provider.Models) == 0 {
+		out := make([]types.ProviderModel, 0, len(ids))
+		for _, id := range ids {
+			out = append(out, types.ProviderModel{ID: id})
+		}
+		return out
+	}
+	keep := make(map[string]struct{}, len(ids))
+	for _, id := range ids {
+		keep[normaliseModelID(id)] = struct{}{}
+	}
+	out := make([]types.ProviderModel, 0, len(ids))
+	for _, m := range provider.Models {
+		if _, ok := keep[normaliseModelID(m.ID)]; ok {
+			out = append(out, m)
+		}
+	}
+	return out
+}
+
+// declaredModelIDs returns the models a provider exposes: the operator's
+// curated list when present, otherwise the catalog entry's models (an
+// empty operator list means "all catalog models"). Gateway/custom catalog
+// entries declare no models, so the result may be empty.
+func declaredModelIDs(provider *types.Provider) []string {
+	if ids := providerModelIDs(provider); len(ids) > 0 {
+		return ids
+	}
+	entry, ok := catalog.Lookup(provider.ProviderID)
+	if !ok {
+		return []string{}
+	}
+	out := make([]string, 0, len(entry.Models))
+	for _, m := range entry.Models {
+		if m.ID != "" {
+			out = append(out, m.ID)
+		}
+	}
+	return out
+}
+
+// GetAgentConfigForUser on the mock manager reports "not configured" so tests
+// that don't care about setup still compile.
+func (*mockManager) GetAgentConfigForUser(_ context.Context, _, _ string) (*types.AgentConfig, error) {
+	return &types.AgentConfig{Providers: []types.AgentConfigProvider{}}, nil
+}
diff --git a/management/internals/modules/agentnetwork/agent_config_realstore_test.go b/management/internals/modules/agentnetwork/agent_config_realstore_test.go
new file mode 100644
index 000000000..2fd541fad
--- /dev/null
+++ b/management/internals/modules/agentnetwork/agent_config_realstore_test.go
@@ -0,0 +1,406 @@
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+)
+
+// These tests drive the effective-setup computation through the real
+// sqlite store, mirroring the policyselect realstore suite: assert on
+// observable answers (configured / providers / models), not on which
+// store methods get called. The computation must agree with what the
+// proxy enforces — policy filtering matches filterApplicablePolicies,
+// model logic matches policyPermitsModel, and orphan providers are
+// omitted like the router synthesizer omits them.
+
+func newAgentConfigTestMgr(t *testing.T) (*managerImpl, store.Store) {
+	t.Helper()
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	t.Cleanup(cleanup)
+	return &managerImpl{store: s}, s
+}
+
+// newSetupTestGuardrail returns an allowlist-enabled guardrail.
+func newSetupTestGuardrail(id string, models ...string) *types.Guardrail {
+	return &types.Guardrail{
+		ID:        id,
+		AccountID: testAccountID,
+		Name:      "allowlist " + id,
+		Checks: types.GuardrailChecks{
+			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: models},
+		},
+	}
+}
+
+func TestAgentConfig_RealStore_NoSettingsRow(t *testing.T) {
+	mgr, _ := newAgentConfigTestMgr(t)
+
+	setup, err := mgr.agentConfigForGroups(context.Background(), testAccountID, []string{"grp-eng"})
+	require.NoError(t, err)
+	assert.False(t, setup.Configured, "account without settings must read as not configured")
+	assert.Empty(t, setup.Endpoint)
+	assert.Empty(t, setup.Providers)
+}
+
+func TestAgentConfig_RealStore_NoApplicablePolicy(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-other"})
+	require.NoError(t, err)
+	assert.True(t, setup.Configured, "the account is set up, so every member reads as configured")
+	assert.Equal(t, "https://"+testEndpoint, setup.Endpoint, "every member gets the same connection config")
+	assert.Empty(t, setup.Providers, "a caller no policy covers is authorized for nothing")
+}
+
+func TestAgentConfig_RealStore_UnrestrictedPolicyListsDeclaredModels(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-eng"})
+	require.NoError(t, err)
+	assert.True(t, setup.Configured)
+	assert.Equal(t, "https://"+testEndpoint, setup.Endpoint)
+	require.Len(t, setup.Providers, 1)
+	p := setup.Providers[0]
+	assert.Equal(t, "OpenAI", p.Name)
+	assert.Equal(t, "openai_api", p.CatalogID)
+	assert.Equal(t, "openai", p.APIFlavor)
+	assert.True(t, p.AllModelsAllowed, "policy without allowlist guardrail is unrestricted")
+	assert.Equal(t, []string{"gpt-5.4"}, p.Models, "declared models listed as a courtesy")
+}
+
+func TestAgentConfig_RealStore_AllowlistIntersectsDeclaredModels(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	provider.Models = []types.ProviderModel{{ID: "gpt-5.4"}, {ID: "gpt-4o"}}
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	// Allowlist admits gpt-5.4 (declared, odd casing/spacing) and gpt-4.1
+	// (NOT declared — the router would never route it, so it must not be
+	// advertised).
+	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", " GPT-5.4 ", "gpt-4.1")))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
+
+	setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-eng"})
+	require.NoError(t, err)
+	require.Len(t, setup.Providers, 1)
+	p := setup.Providers[0]
+	assert.False(t, p.AllModelsAllowed)
+	assert.Equal(t, []string{"gpt-5.4"}, p.Models, "allowlist ∩ declared, in declared order and casing")
+}
+
+func TestAgentConfig_RealStore_AllowlistMatchesBedrockDeclaredIDsCanonically(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	// A Bedrock operator typically declares the region/version form the
+	// vendor lists, while the allowlist holds the canonical id the proxy's
+	// parser emits at request time. The intersection must compare through
+	// the same normalization the parser applies, and the declared (raw)
+	// id is what gets advertised — it is what the router claims.
+	provider := newSynthTestProvider()
+	provider.ProviderID = "bedrock_api"
+	provider.Name = "Bedrock"
+	provider.Models = []types.ProviderModel{
+		{ID: "eu.anthropic.claude-sonnet-4-5-20250929-v1:0"},
+		{ID: "eu.amazon.nova-pro-v1:0"},
+	}
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "anthropic.claude-sonnet-4-5")))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
+
+	setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-eng"})
+	require.NoError(t, err)
+	require.Len(t, setup.Providers, 1)
+	p := setup.Providers[0]
+	assert.False(t, p.AllModelsAllowed)
+	assert.Equal(t, []string{"eu.anthropic.claude-sonnet-4-5-20250929-v1:0"}, p.Models,
+		"the allowlisted canonical id must admit the declared region/version form, and only it")
+}
+
+func TestAgentConfig_RealStore_AllowlistHoldsRawDeclaredIDs(t *testing.T) {
+	// The dashboard's allowlist picker copies the provider's declared ids
+	// verbatim, so for path-style providers the allowlist carries the
+	// region/version form rather than the canonical id the parser emits.
+	// Both forms must admit the declared model.
+	cases := []struct {
+		name      string
+		catalogID string
+		declared  string
+		allowlist string
+	}{
+		{"bedrock", "bedrock_api", "eu.anthropic.claude-sonnet-4-5-20250929-v1:0", ""},
+		{"vertex", "vertex_ai_api", "claude-sonnet-4-5@20250929", ""},
+		// The geography/version strippers anchor on a lowercase tail, so a
+		// case-variant entry must be lowercased before canonicalization or
+		// the prefix and suffix survive into the compare key.
+		{"bedrock-case-variant", "bedrock_api", "eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
+			" EU.Anthropic.Claude-Sonnet-4-5-20250929-V1:0 "},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			mgr, s := newAgentConfigTestMgr(t)
+			ctx := context.Background()
+
+			allowlisted := tc.allowlist
+			if allowlisted == "" {
+				allowlisted = tc.declared
+			}
+			require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+			provider := newSynthTestProvider()
+			provider.ProviderID = tc.catalogID
+			provider.Name = tc.name
+			provider.Models = []types.ProviderModel{{ID: tc.declared}}
+			require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+			require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", allowlisted)))
+			require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
+
+			setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-eng"})
+			require.NoError(t, err)
+			require.Len(t, setup.Providers, 1)
+			p := setup.Providers[0]
+			assert.False(t, p.AllModelsAllowed)
+			assert.Equal(t, []string{tc.declared}, p.Models,
+				"an allowlist holding the raw declared id must admit that declared model")
+		})
+	}
+}
+
+func TestAgentConfig_RealStore_UnrestrictedPolicyWinsOverRestricted(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "gpt-5.4")))
+	restricted := newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, restricted))
+	open := newSynthTestPolicy(provider.ID, "grp-eng", "")
+	open.ID = "pol-2"
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, open))
+
+	setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-eng"})
+	require.NoError(t, err)
+	require.Len(t, setup.Providers, 1)
+	assert.True(t, setup.Providers[0].AllModelsAllowed,
+		"one applicable policy without an allowlist makes the provider unrestricted — the proxy would admit any model through it")
+}
+
+func TestAgentConfig_RealStore_AllowlistUnionAcrossPolicies(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	provider.Models = []types.ProviderModel{{ID: "gpt-5.4"}, {ID: "gpt-4o"}, {ID: "o4-mini"}}
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "gpt-5.4")))
+	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-2", "gpt-4o")))
+	p1 := newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p1))
+	p2 := newSynthTestPolicy(provider.ID, "grp-eng", "guard-2")
+	p2.ID = "pol-2"
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p2))
+
+	setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-eng"})
+	require.NoError(t, err)
+	require.Len(t, setup.Providers, 1)
+	p := setup.Providers[0]
+	assert.False(t, p.AllModelsAllowed)
+	assert.ElementsMatch(t, []string{"gpt-5.4", "gpt-4o"}, p.Models, "union of allowlists across applicable policies")
+}
+
+func TestAgentConfig_RealStore_OrphanAndDisabledProvidersOmitted(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	// Orphan: enabled but referenced by no policy.
+	orphan := newSynthTestProvider()
+	orphan.ID = "prov-orphan"
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, orphan))
+	// Disabled but referenced by an applicable policy.
+	disabled := newSynthTestProvider()
+	disabled.ID = "prov-disabled"
+	disabled.Enabled = false
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, disabled))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(disabled.ID, "grp-eng", "")))
+
+	setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-eng"})
+	require.NoError(t, err)
+	assert.True(t, setup.Configured)
+	assert.Empty(t, setup.Providers, "neither an orphan nor a disabled provider is reachable for the caller")
+}
+
+func TestAgentConfig_RealStore_DisabledPolicyIgnored(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
+	policy.Enabled = false
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
+
+	setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-eng"})
+	require.NoError(t, err)
+	assert.True(t, setup.Configured)
+	assert.Empty(t, setup.Providers, "a disabled policy authorizes nothing")
+}
+
+func TestAgentConfig_RealStore_UndeclaredModelsUseAllowlistAsIs(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	// Gateway-style provider: no declared models — the router claims every
+	// model, so the allowlist union is the effective set on its own.
+	provider := newSynthTestProvider()
+	provider.ProviderID = "litellm_proxy"
+	provider.Name = "LiteLLM"
+	provider.Models = nil
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "claude-sonnet-4-5")))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
+
+	setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-eng"})
+	require.NoError(t, err)
+	require.Len(t, setup.Providers, 1)
+	p := setup.Providers[0]
+	assert.False(t, p.AllModelsAllowed)
+	assert.Equal(t, []string{"claude-sonnet-4-5"}, p.Models)
+}
+
+func TestAgentConfig_RealStore_ProvidersInCreatedAtOrder(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	newer := newSynthTestProvider()
+	newer.ID = "prov-newer"
+	newer.Name = "Newer"
+	newer.CreatedAt = time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC)
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, newer))
+	older := newSynthTestProvider()
+	older.ID = "prov-older"
+	older.Name = "Older"
+	older.CreatedAt = time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, older))
+
+	policy := newSynthTestPolicy(newer.ID, "grp-eng", "")
+	policy.DestinationProviderIDs = []string{newer.ID, older.ID}
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
+
+	setup, err := mgr.agentConfigForGroups(ctx, testAccountID, []string{"grp-eng"})
+	require.NoError(t, err)
+	require.Len(t, setup.Providers, 2)
+	assert.Equal(t, "Older", setup.Providers[0].Name)
+	assert.Equal(t, "Newer", setup.Providers[1].Name)
+}
+
+// TestGetAgentConfigForUser_RealStore pins the self-service entry point: the
+// user's group memberships (AutoGroups — the same groups the user's peers
+// carry) scope the providers, while the account's endpoint reaches every
+// member — a user outside every policy gets the config with nothing
+// authorized in it.
+func TestGetAgentConfigForUser_RealStore(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	// users.account_id is a foreign key into accounts, enforced on
+	// MySQL/Postgres, so the account row must exist before its users.
+	require.NoError(t, s.SaveAccount(ctx, &nbtypes.Account{Id: testAccountID}))
+	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
+		Id: "user-in", AccountID: testAccountID, Role: nbtypes.UserRoleUser, AutoGroups: []string{"grp-eng"},
+	}))
+	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
+		Id: "user-out", AccountID: testAccountID, Role: nbtypes.UserRoleUser, AutoGroups: []string{"grp-other"},
+	}))
+
+	setupIn, err := mgr.GetAgentConfigForUser(ctx, testAccountID, "user-in")
+	require.NoError(t, err)
+	assert.True(t, setupIn.Configured)
+	require.Len(t, setupIn.Providers, 1)
+
+	setupOut, err := mgr.GetAgentConfigForUser(ctx, testAccountID, "user-out")
+	require.NoError(t, err)
+	assert.True(t, setupOut.Configured, "the account is set up, so the user reads as configured")
+	assert.Equal(t, "https://"+testEndpoint, setupOut.Endpoint)
+	assert.Empty(t, setupOut.Providers, "user outside the policy's source groups is authorized for nothing")
+}
+
+// TestGetUsageOverview_RealStore_SelfScoped pins the self-scope fallback:
+// a caller without the account-wide usage grant gets the same aggregation
+// the admin overview serves, but only ever their own rows — a user_id
+// filter for someone else must be overridden, not honored, and never
+// denied. A caller holding the grant keeps the account-wide view.
+func TestGetUsageOverview_RealStore_SelfScoped(t *testing.T) {
+	mgr, s := newAgentConfigTestMgr(t)
+	mgr.permissionsManager = permissions.NewManager(s)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	require.NoError(t, s.SaveAccount(ctx, &nbtypes.Account{Id: testAccountID}))
+	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
+		Id: "user-a", AccountID: testAccountID, Role: nbtypes.UserRoleUser,
+	}))
+	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
+		Id: "admin", AccountID: testAccountID, Role: nbtypes.UserRoleAdmin,
+	}))
+
+	own1 := newIngestTestEntry()
+	own1.ID, own1.UserId = "log-own-1", "user-a"
+	own2 := newIngestTestEntry()
+	own2.ID, own2.UserId = "log-own-2", "user-a"
+	other := newIngestTestEntry()
+	other.ID, other.UserId = "log-other", "user-b"
+	for _, e := range []*accesslogs.AccessLogEntry{own1, own2, other} {
+		require.NoError(t, IngestAccessLog(ctx, s, e))
+	}
+
+	otherID := "user-b"
+	filter := types.AgentNetworkAccessLogFilter{UserID: &otherID}
+	buckets, err := mgr.GetUsageOverview(ctx, testAccountID, "user-a", filter, types.ParseUsageGranularity(""))
+	require.NoError(t, err)
+	require.Len(t, buckets, 1, "same-day rows aggregate into one daily bucket")
+	assert.Equal(t, int64(200), buckets[0].InputTokens, "only the caller's two rows count — the foreign user_id filter is overridden")
+	assert.Equal(t, int64(100), buckets[0].OutputTokens)
+
+	adminBuckets, err := mgr.GetUsageOverview(ctx, testAccountID, "admin", types.AgentNetworkAccessLogFilter{}, types.ParseUsageGranularity(""))
+	require.NoError(t, err)
+	require.Len(t, adminBuckets, 1)
+	assert.Equal(t, int64(300), adminBuckets[0].InputTokens, "the account-wide grant keeps the unscoped view")
+}
diff --git a/management/internals/modules/agentnetwork/catalog/catalog.go b/management/internals/modules/agentnetwork/catalog/catalog.go
index 962b30250..b58743798 100644
--- a/management/internals/modules/agentnetwork/catalog/catalog.go
+++ b/management/internals/modules/agentnetwork/catalog/catalog.go
@@ -7,12 +7,28 @@ package catalog
 import "github.com/netbirdio/netbird/shared/management/http/api"
 
 // Model is the in-memory representation of a catalog model.
+//
+// The three cache rates mirror the proxy cost meter's Entry semantics
+// (USD per 1k tokens; 0 = no rate configured, that bucket bills at
+// InputPer1k):
+//   - CachedInputPer1k: OpenAI-shape rate for cached prompt tokens
+//     (a SUBSET of input tokens). Typically 0.1-0.5x input.
+//   - CacheReadPer1k / CacheCreationPer1k: Anthropic-shape rates for
+//     the two ADDITIVE prompt-cache buckets. Typically 0.1x / 1.25x
+//     input.
+//
+// The catalog is the single default-pricing source: the agentnetwork
+// pricing package folds these models into per-surface tables that the
+// synthesizer ships to the proxy's cost_meter.
 type Model struct {
-	ID            string
-	Label         string
-	InputPer1k    float64
-	OutputPer1k   float64
-	ContextWindow int
+	ID                 string
+	Label              string
+	InputPer1k         float64
+	OutputPer1k        float64
+	CachedInputPer1k   float64
+	CacheReadPer1k     float64
+	CacheCreationPer1k float64
+	ContextWindow      int
 }
 
 // ProviderKind groups catalog entries for UI presentation. The split
@@ -65,6 +81,21 @@ type Provider struct {
 	// surface — the proxy middleware then falls back to URL sniffing
 	// or skips request-side enrichment.
 	ParserID string
+	// RouterVendors declares every parser surface a gateway route can serve.
+	// Leave empty for single-surface providers, where ParserID remains the
+	// router discriminator for backward compatibility.
+	RouterVendors []string
+	// PricingSurfaces names the cost-meter pricing surfaces this
+	// provider's Models are priced under ("openai", "anthropic",
+	// "bedrock" — the llm.Parser surface the request parser stamps as
+	// llm.provider at billing time). NOT derivable from ParserID:
+	// bedrock_api and vertex_ai_api leave ParserID empty (URL-sniffed)
+	// yet price under "bedrock" / "anthropic", and kimi_api serves two
+	// body shapes so it prices under both. Nil for gateway/custom
+	// entries, which declare no models. Same (surface, model) pair
+	// contributed by two providers must carry identical rates — the
+	// pricing package's tests enforce that.
+	PricingSurfaces []string
 	// IdentityInjection, when non-nil, instructs the proxy to stamp
 	// the caller's NetBird identity onto upstream requests under the
 	// configured header names. Used for gateways like LiteLLM that
@@ -86,8 +117,63 @@ type Provider struct {
 	// upstream provider + credentials on Portkey's hosted side).
 	ExtraHeaders []ExtraHeader
 	Models       []Model
+	// Discovery, when non-nil, describes how to ask this vendor which
+	// models the operator's own credential can actually reach, so the
+	// provider form can offer a live list instead of only the hand-curated
+	// Models above. Nil entries keep free-text entry.
+	Discovery *Discovery
 }
 
+// ListingShape names the response envelope a vendor returns its model
+// listing in. Every vendor invented its own, and none of them can be
+// guessed from the request, so the catalog states it.
+type ListingShape string
+
+const (
+	// ShapeOpenAIData is {"data":[{"id":…}]} — OpenAI, and Anthropic, which
+	// adopted the same envelope.
+	ShapeOpenAIData ListingShape = "openai_data"
+	// ShapeBedrockInferenceProfiles is
+	// {"inferenceProfileSummaries":[{"inferenceProfileId":…}]}. The ids carry
+	// the region prefix that makes them invocable, which is exactly what an
+	// operator cannot reconstruct by hand.
+	ShapeBedrockInferenceProfiles ListingShape = "bedrock_inference_profiles"
+	// ShapeVertexPublisherModels is {"publisherModels":[{"name":…}]}, where
+	// name is a resource path and the invocable id is its last segment joined
+	// to a separate versionId field.
+	ShapeVertexPublisherModels ListingShape = "vertex_publisher_models"
+)
+
+// Discovery describes one vendor's model-listing endpoint.
+//
+// Host is deliberately separate from the provider record's upstream URL:
+// Bedrock serves listings from the control plane (bedrock.<region>) while
+// inference must go to the runtime host (bedrock-runtime.<region>), so the
+// two cannot be the same value. Empty Host means "use the record's own
+// upstream", which is right for every vendor that serves both from one host.
+//
+// The regionPlaceholder in Host is substituted from the provider record's
+// region. Deriving the discovery host from the catalog rather than accepting
+// one from the caller is also what keeps this from being an open proxy: the
+// only hosts management will dial are the ones written here.
+type Discovery struct {
+	Host            string
+	Path            string
+	Query           string
+	Shape           ListingShape
+	// ExactModelsOnly omits wildcard patterns from listings when NetBird's
+	// provider model rows cannot represent the vendor's matching semantics.
+	ExactModelsOnly bool
+	// Headers are static headers the vendor requires beyond the credential
+	// (Anthropic versions its API through one and rejects a request without
+	// it). The auth header itself comes from AuthHeaderName/Template.
+	Headers map[string]string
+}
+
+// RegionPlaceholder is replaced in Discovery.Host by the provider record's
+// configured region.
+const RegionPlaceholder = "<region>"
+
 // ExtraHeader names a single optional per-provider routing/config
 // header. Catalog declares N of these per provider type; the operator
 // fills any subset on the provider record (see Provider.ExtraValues).
@@ -197,6 +283,12 @@ type JSONMetadataInjection struct {
 	// enforces a 128-char limit per value; oversized values are
 	// truncated rather than failing the request. 0 disables the cap.
 	MaxValueLength int
+	// Sanitize, when true, replaces characters outside the destination's
+	// accepted set with '_' before emitting each value. AWS Bedrock's
+	// X-Amzn-Bedrock-Request-Metadata restricts values to a limited character
+	// class, so unsanitized group display names (e.g. containing spaces) would
+	// make Bedrock reject the request with 400.
+	Sanitize bool
 }
 
 // providers is the canonical list of supported Agent Network providers.
@@ -212,7 +304,12 @@ var providers = []Provider{
 		AuthHeaderTemplate: "Bearer ${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#10A37F",
-		ParserID:           "openai",
+		Discovery: &Discovery{
+			Path:  "/v1/models",
+			Shape: ShapeOpenAIData,
+		},
+		ParserID:        "openai",
+		PricingSurfaces: []string{"openai"},
 		// Pricing + context windows cross-checked against LiteLLM's
 		// model_prices_and_context_window.json. Notable corrections from
 		// earlier values: o4-mini repriced from $4/$16 to $1.10/$4.40
@@ -220,20 +317,20 @@ var providers = []Provider{
 		// family context windows split between 1.05M for full-size
 		// models and 272K for mini/nano/codex variants.
 		Models: []Model{
-			{ID: "gpt-5.5", Label: "GPT-5.5", InputPer1k: 0.005, OutputPer1k: 0.030, ContextWindow: 1050000},
-			{ID: "gpt-5.5-pro", Label: "GPT-5.5 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, ContextWindow: 1050000},
-			{ID: "gpt-5.4", Label: "GPT-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015, ContextWindow: 1050000},
-			{ID: "gpt-5.4-pro", Label: "GPT-5.4 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, ContextWindow: 1050000},
-			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini", InputPer1k: 0.00075, OutputPer1k: 0.0045, ContextWindow: 272000},
-			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano", InputPer1k: 0.0002, OutputPer1k: 0.00125, ContextWindow: 272000},
-			{ID: "gpt-5.3-codex", Label: "GPT-5.3 Codex", InputPer1k: 0.00175, OutputPer1k: 0.014, ContextWindow: 272000},
-			{ID: "gpt-5.3-chat-latest", Label: "GPT-5.3 Chat", InputPer1k: 0.00175, OutputPer1k: 0.014, ContextWindow: 128000},
-			{ID: "o4-mini", Label: "o4-mini", InputPer1k: 0.0011, OutputPer1k: 0.0044, ContextWindow: 200000},
-			{ID: "gpt-4.1", Label: "GPT-4.1", InputPer1k: 0.002, OutputPer1k: 0.008, ContextWindow: 1047576},
-			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini", InputPer1k: 0.0004, OutputPer1k: 0.0016, ContextWindow: 1047576},
-			{ID: "gpt-4.1-nano", Label: "GPT-4.1 nano", InputPer1k: 0.0001, OutputPer1k: 0.0004, ContextWindow: 1047576},
-			{ID: "gpt-4o", Label: "GPT-4o", InputPer1k: 0.0025, OutputPer1k: 0.010, ContextWindow: 128000},
-			{ID: "gpt-4o-mini", Label: "GPT-4o mini", InputPer1k: 0.00015, OutputPer1k: 0.0006, ContextWindow: 128000},
+			{ID: "gpt-5.5", Label: "GPT-5.5", InputPer1k: 0.005, OutputPer1k: 0.030, CachedInputPer1k: 0.0005, ContextWindow: 1050000},
+			{ID: "gpt-5.5-pro", Label: "GPT-5.5 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, CachedInputPer1k: 0.003, ContextWindow: 1050000},
+			{ID: "gpt-5.4", Label: "GPT-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015, CachedInputPer1k: 0.00025, ContextWindow: 1050000},
+			{ID: "gpt-5.4-pro", Label: "GPT-5.4 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, CachedInputPer1k: 0.003, ContextWindow: 1050000},
+			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini", InputPer1k: 0.00075, OutputPer1k: 0.0045, CachedInputPer1k: 0.000075, ContextWindow: 272000},
+			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano", InputPer1k: 0.0002, OutputPer1k: 0.00125, CachedInputPer1k: 0.00002, ContextWindow: 272000},
+			{ID: "gpt-5.3-codex", Label: "GPT-5.3 Codex", InputPer1k: 0.00175, OutputPer1k: 0.014, CachedInputPer1k: 0.000175, ContextWindow: 272000},
+			{ID: "gpt-5.3-chat-latest", Label: "GPT-5.3 Chat", InputPer1k: 0.00175, OutputPer1k: 0.014, CachedInputPer1k: 0.000175, ContextWindow: 128000},
+			{ID: "o4-mini", Label: "o4-mini", InputPer1k: 0.0011, OutputPer1k: 0.0044, CachedInputPer1k: 0.000275, ContextWindow: 200000},
+			{ID: "gpt-4.1", Label: "GPT-4.1", InputPer1k: 0.002, OutputPer1k: 0.008, CachedInputPer1k: 0.0005, ContextWindow: 1047576},
+			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini", InputPer1k: 0.0004, OutputPer1k: 0.0016, CachedInputPer1k: 0.0001, ContextWindow: 1047576},
+			{ID: "gpt-4.1-nano", Label: "GPT-4.1 nano", InputPer1k: 0.0001, OutputPer1k: 0.0004, CachedInputPer1k: 0.000025, ContextWindow: 1047576},
+			{ID: "gpt-4o", Label: "GPT-4o", InputPer1k: 0.0025, OutputPer1k: 0.010, CachedInputPer1k: 0.00125, ContextWindow: 128000},
+			{ID: "gpt-4o-mini", Label: "GPT-4o mini", InputPer1k: 0.00015, OutputPer1k: 0.0006, CachedInputPer1k: 0.000075, ContextWindow: 128000},
 			{ID: "gpt-4-turbo", Label: "GPT-4 Turbo", InputPer1k: 0.01, OutputPer1k: 0.03, ContextWindow: 128000},
 			{ID: "gpt-3.5-turbo", Label: "GPT-3.5 Turbo", InputPer1k: 0.0005, OutputPer1k: 0.0015, ContextWindow: 16385},
 			{ID: "text-embedding-3-large", Label: "text-embedding-3-large", InputPer1k: 0.00013, OutputPer1k: 0, ContextWindow: 8191},
@@ -250,7 +347,18 @@ var providers = []Provider{
 		AuthHeaderTemplate: "${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#D97757",
-		ParserID:           "anthropic",
+		Discovery: &Discovery{
+			Path: "/v1/models",
+			// The default page is short and a picker wants the whole
+			// catalogue in one call.
+			Query: "limit=1000",
+			Shape: ShapeOpenAIData,
+			// Anthropic versions its API through a header and refuses a
+			// request that omits it, listing included.
+			Headers: map[string]string{"anthropic-version": "2023-06-01"},
+		},
+		ParserID:        "anthropic",
+		PricingSurfaces: []string{"anthropic"},
 		// Per Anthropic's current model lineup. Pricing in USD per 1k
 		// tokens. Context windows: 4.6+ family is 1M; Haiku 4.5 stays at
 		// 200K. claude-3-7-sonnet and claude-3-5-haiku retired
@@ -261,14 +369,16 @@ var providers = []Provider{
 		// account to be on >= 30-day data retention or all requests
 		// 400.
 		Models: []Model{
-			{ID: "claude-fable-5", Label: "Claude Fable 5", InputPer1k: 0.010, OutputPer1k: 0.050, ContextWindow: 1000000},
-			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
-			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
-			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
-			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (deprecated, retires 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
-			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
-			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
-			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
+			{ID: "claude-opus-5", Label: "Claude Opus 5", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "claude-sonnet-5", Label: "Claude Sonnet 5", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
+			{ID: "claude-fable-5", Label: "Claude Fable 5", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
+			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (deprecated, retires 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, CacheReadPer1k: 0.0015, CacheCreationPer1k: 0.01875, ContextWindow: 200000},
+			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
+			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 200000},
+			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5", InputPer1k: 0.001, OutputPer1k: 0.005, CacheReadPer1k: 0.0001, CacheCreationPer1k: 0.00125, ContextWindow: 200000},
 		},
 	},
 	{
@@ -282,18 +392,19 @@ var providers = []Provider{
 		DefaultContentType: "application/json",
 		BrandColor:         "#0078D4",
 		ParserID:           "openai",
+		PricingSurfaces:    []string{"openai"},
 		// Mirrors openai_api pricing — Azure resells OpenAI models at the
 		// same per-token rates, just under different deployment names.
 		Models: []Model{
-			{ID: "gpt-5.5", Label: "GPT-5.5 (Azure)", InputPer1k: 0.005, OutputPer1k: 0.030, ContextWindow: 1050000},
-			{ID: "gpt-5.4", Label: "GPT-5.4 (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.015, ContextWindow: 1050000},
-			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini (Azure)", InputPer1k: 0.00075, OutputPer1k: 0.0045, ContextWindow: 272000},
-			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano (Azure)", InputPer1k: 0.0002, OutputPer1k: 0.00125, ContextWindow: 272000},
-			{ID: "o4-mini", Label: "o4-mini (Azure)", InputPer1k: 0.0011, OutputPer1k: 0.0044, ContextWindow: 200000},
-			{ID: "gpt-4.1", Label: "GPT-4.1 (Azure)", InputPer1k: 0.002, OutputPer1k: 0.008, ContextWindow: 1047576},
-			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini (Azure)", InputPer1k: 0.0004, OutputPer1k: 0.0016, ContextWindow: 1047576},
-			{ID: "gpt-4o", Label: "GPT-4o (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.010, ContextWindow: 128000},
-			{ID: "gpt-4o-mini", Label: "GPT-4o mini (Azure)", InputPer1k: 0.00015, OutputPer1k: 0.0006, ContextWindow: 128000},
+			{ID: "gpt-5.5", Label: "GPT-5.5 (Azure)", InputPer1k: 0.005, OutputPer1k: 0.030, CachedInputPer1k: 0.0005, ContextWindow: 1050000},
+			{ID: "gpt-5.4", Label: "GPT-5.4 (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.015, CachedInputPer1k: 0.00025, ContextWindow: 1050000},
+			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini (Azure)", InputPer1k: 0.00075, OutputPer1k: 0.0045, CachedInputPer1k: 0.000075, ContextWindow: 272000},
+			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano (Azure)", InputPer1k: 0.0002, OutputPer1k: 0.00125, CachedInputPer1k: 0.00002, ContextWindow: 272000},
+			{ID: "o4-mini", Label: "o4-mini (Azure)", InputPer1k: 0.0011, OutputPer1k: 0.0044, CachedInputPer1k: 0.000275, ContextWindow: 200000},
+			{ID: "gpt-4.1", Label: "GPT-4.1 (Azure)", InputPer1k: 0.002, OutputPer1k: 0.008, CachedInputPer1k: 0.0005, ContextWindow: 1047576},
+			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini (Azure)", InputPer1k: 0.0004, OutputPer1k: 0.0016, CachedInputPer1k: 0.0001, ContextWindow: 1047576},
+			{ID: "gpt-4o", Label: "GPT-4o (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.010, CachedInputPer1k: 0.00125, ContextWindow: 128000},
+			{ID: "gpt-4o-mini", Label: "GPT-4o mini (Azure)", InputPer1k: 0.00015, OutputPer1k: 0.0006, CachedInputPer1k: 0.000075, ContextWindow: 128000},
 			{ID: "gpt-35-turbo", Label: "GPT-3.5 Turbo (Azure)", InputPer1k: 0.0005, OutputPer1k: 0.0015, ContextWindow: 16385},
 		},
 	},
@@ -307,6 +418,25 @@ var providers = []Provider{
 		AuthHeaderTemplate: "Bearer ${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#FF9900",
+		// Listings come from the CONTROL PLANE, not the runtime host in
+		// DefaultHost above: ListInferenceProfiles is not an operation
+		// bedrock-runtime implements, and answers <UnknownOperationException/>
+		// there. Inference has to go to the runtime host, so the two hosts
+		// genuinely differ and Discovery.Host carries the difference.
+		//
+		// Inference profiles rather than foundation models because the profile
+		// id is the invocable one: it carries the region prefix (eu., us.,
+		// global.) that AWS requires and that cannot be derived from the
+		// configured region — an eu-central-1 account legitimately holds
+		// global.* profiles.
+		Discovery: &Discovery{
+			Host:  "bedrock." + RegionPlaceholder + ".amazonaws.com",
+			Path:  "/inference-profiles",
+			Shape: ShapeBedrockInferenceProfiles,
+		},
+		// ParserID stays empty (path-style dispatch via IsBedrockPathStyle);
+		// the request parser meters these under the "bedrock" surface.
+		PricingSurfaces: []string{"bedrock"},
 		// Anthropic models on Bedrock take the anthropic.* prefix and
 		// follow the same lineup / pricing as the first-party Anthropic
 		// catalog entry above. claude-3-7-sonnet and claude-3-5-haiku
@@ -316,19 +446,33 @@ var providers = []Provider{
 		// Llama 3.3 70B entry kept unchanged — LiteLLM tracks only
 		// per-region Llama 3 entries; standalone 3.3 not yet listed.
 		Models: []Model{
-			{ID: "anthropic.claude-opus-4-8", Label: "Claude Opus 4.8 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
-			{ID: "anthropic.claude-opus-4-7", Label: "Claude Opus 4.7 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
-			{ID: "anthropic.claude-opus-4-6", Label: "Claude Opus 4.6 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
-			{ID: "anthropic.claude-opus-4-1", Label: "Claude Opus 4.1 (Bedrock, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
-			{ID: "anthropic.claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
-			{ID: "anthropic.claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
-			{ID: "anthropic.claude-haiku-4-5", Label: "Claude Haiku 4.5 (Bedrock)", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
+			{ID: "anthropic.claude-opus-5", Label: "Claude Opus 5 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "anthropic.claude-sonnet-5", Label: "Claude Sonnet 5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-8", Label: "Claude Opus 4.8 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-7", Label: "Claude Opus 4.7 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-6", Label: "Claude Opus 4.6 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-1", Label: "Claude Opus 4.1 (Bedrock, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, CacheReadPer1k: 0.0015, CacheCreationPer1k: 0.01875, ContextWindow: 200000},
+			{ID: "anthropic.claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
+			{ID: "anthropic.claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 200000},
+			{ID: "anthropic.claude-haiku-4-5", Label: "Claude Haiku 4.5 (Bedrock)", InputPer1k: 0.001, OutputPer1k: 0.005, CacheReadPer1k: 0.0001, CacheCreationPer1k: 0.00125, ContextWindow: 200000},
 			{ID: "meta.llama3-3-70b-instruct", Label: "Llama 3.3 70B (Bedrock)", InputPer1k: 0.00072, OutputPer1k: 0.00072, ContextWindow: 128000},
 			{ID: "amazon.nova-2-lite", Label: "Amazon Nova 2 Lite (Bedrock, preview)", InputPer1k: 0.0003, OutputPer1k: 0.0025, ContextWindow: 1000000},
 			{ID: "amazon.nova-pro", Label: "Amazon Nova Pro (Bedrock)", InputPer1k: 0.0008, OutputPer1k: 0.0032, ContextWindow: 300000},
 			{ID: "amazon.nova-lite", Label: "Amazon Nova Lite (Bedrock)", InputPer1k: 0.00006, OutputPer1k: 0.00024, ContextWindow: 300000},
 			{ID: "amazon.nova-micro", Label: "Amazon Nova Micro (Bedrock)", InputPer1k: 0.000035, OutputPer1k: 0.00014, ContextWindow: 128000},
 		},
+		// Bedrock accepts a cost-allocation metadata header; stamp the caller's
+		// user + authorizing group so spend can be attributed in AWS Cost
+		// Management. Sanitized because Bedrock restricts the value character set.
+		IdentityInjection: &IdentityInjection{
+			JSONMetadata: &JSONMetadataInjection{
+				Header:         "X-Amzn-Bedrock-Request-Metadata",
+				UserKey:        "user",
+				GroupsKey:      "group",
+				MaxValueLength: 256,
+				Sanitize:       true,
+			},
+		},
 	},
 	{
 		ID:                 "vertex_ai_api",
@@ -340,6 +484,19 @@ var providers = []Provider{
 		AuthHeaderTemplate: "Bearer ${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#4285F4",
+		// Only the v1beta1 publisher listing answers: the v1 form and the
+		// project-scoped form under BOTH versions return 404. That means the
+		// list is publisher-global — it cannot say which models this project
+		// has enabled — so it is offered as a suggestion beside the catalog
+		// rather than replacing it. See the discovery e2e for the probes.
+		Discovery: &Discovery{
+			Path:  "/v1beta1/publishers/anthropic/models",
+			Shape: ShapeVertexPublisherModels,
+		},
+		// ParserID stays empty (path-style dispatch via IsVertexPathStyle);
+		// Anthropic-on-Vertex requests are metered under the "anthropic"
+		// surface with the bare, unversioned model id.
+		PricingSurfaces: []string{"anthropic"},
 		// Vertex carries the model in the URL path and authenticates with a
 		// service-account-minted OAuth token (api_key = "keyfile::<base64 SA>").
 		// Only Anthropic-on-Vertex is metered today: the request parser maps the
@@ -351,14 +508,16 @@ var providers = []Provider{
 		// exists — the router denies unmeterable publishers rather than forward
 		// them uncounted.
 		Models: []Model{
-			{ID: "claude-fable-5", Label: "Claude Fable 5 (Vertex)", InputPer1k: 0.010, OutputPer1k: 0.050, ContextWindow: 1000000},
-			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
-			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
-			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
-			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (Vertex, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
-			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
-			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
-			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5 (Vertex)", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
+			{ID: "claude-opus-5", Label: "Claude Opus 5 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "claude-sonnet-5", Label: "Claude Sonnet 5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
+			{ID: "claude-fable-5", Label: "Claude Fable 5 (Vertex)", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
+			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (Vertex, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, CacheReadPer1k: 0.0015, CacheCreationPer1k: 0.01875, ContextWindow: 200000},
+			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
+			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 200000},
+			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5 (Vertex)", InputPer1k: 0.001, OutputPer1k: 0.005, CacheReadPer1k: 0.0001, CacheCreationPer1k: 0.00125, ContextWindow: 200000},
 		},
 	},
 	{
@@ -372,6 +531,7 @@ var providers = []Provider{
 		DefaultContentType: "application/json",
 		BrandColor:         "#FF7000",
 		ParserID:           "openai",
+		PricingSurfaces:    []string{"openai"},
 		// Pricing + context windows cross-checked against LiteLLM. Key
 		// gotchas the marketing page hides:
 		//   - `mistral-medium-latest` aliases to Medium 3.1 ($0.40/$2),
@@ -402,6 +562,58 @@ var providers = []Provider{
 			{ID: "mistral-embed", Label: "Mistral Embed", InputPer1k: 0.0001, OutputPer1k: 0, ContextWindow: 8192},
 		},
 	},
+	{
+		ID:                 "kimi_api",
+		Kind:               KindProvider,
+		Name:               "Kimi (Moonshot AI) API",
+		Description:        "Kimi K3 / K2 models via the Moonshot AI platform",
+		DefaultHost:        "api.moonshot.ai",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#1A1A2E",
+		// ParserID empty on purpose: Moonshot serves two body shapes on
+		// the same host and key, and the proxy's URL sniffer dispatches
+		// both (same pattern as Bifrost). /v1/chat/completions matches
+		// OpenAIParser; the Anthropic-compatible endpoint the official
+		// Claude Code guide uses (/anthropic/v1/messages) contains
+		// "/v1/messages" and matches AnthropicParser. Pinning "openai"
+		// here would misparse the Claude Code path — the primary way
+		// teams consume Kimi for coding today. Both endpoints accept the
+		// same Moonshot key via Authorization: Bearer (Claude Code's
+		// ANTHROPIC_AUTH_TOKEN rides that header too).
+		//
+		// api.moonshot.ai is the international platform; mainland-China
+		// accounts live on api.moonshot.cn with separate billing —
+		// operators there override the host on the provider record. The
+		// kimi.com subscription coding endpoint (api.kimi.com/coding,
+		// model id "k3") is account-bound seat licensing rather than a
+		// meterable platform key, so it's deliberately not the default.
+		ParserID: "",
+		// Both body shapes are metered: /v1/chat/completions under
+		// "openai", /anthropic/v1/messages under "anthropic" — so the
+		// K3 entry is priced on both surfaces.
+		PricingSurfaces: []string{"openai", "anthropic"},
+		// Pricing per Moonshot's platform rates at K3 launch (July 2026):
+		// $3/$15 per MTok with $0.30 cached input, flat across the 1M-token
+		// window. kimi-k3 is the ONLY model the platform serves newer
+		// accounts — K2-era ids (kimi-k2-thinking) and even the kimi-latest
+		// alias return resource_not_found_error, verified live 2026-07-21 —
+		// so it's the only catalog entry. Grandfathered accounts with K2
+		// access can still type those ids on the provider's model rows.
+		// The consumer app's "K3 Swarm Max" mode is not an API SKU, so it
+		// doesn't appear here.
+		Models: []Model{
+			// Carries both cache shapes: Moonshot reports cache hits
+			// OpenAI-style on /v1/chat/completions (CachedInputPer1k)
+			// and Anthropic-style on /anthropic/v1/messages
+			// (CacheReadPer1k) — $0.30/MTok either way. Each surface's
+			// cost formula reads only its own field, so the superset
+			// entry prices both endpoints correctly. No cache-creation
+			// rate published; writes bill at the input rate.
+			{ID: "kimi-k3", Label: "Kimi K3", InputPer1k: 0.003, OutputPer1k: 0.015, CachedInputPer1k: 0.0003, CacheReadPer1k: 0.0003, ContextWindow: 1000000},
+		},
+	},
 	{
 		ID:                 "litellm_proxy",
 		Kind:               KindGateway,
@@ -429,6 +641,34 @@ var providers = []Provider{
 		},
 		Models: []Model{},
 	},
+	{
+		ID:                 "agentgateway",
+		Kind:               KindGateway,
+		Name:               "agentgateway",
+		Description:        "Bring your own agentgateway with trusted NetBird identity stamped on every request",
+		DefaultHost:        "",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#8023C3",
+		// Agentgateway accepts both OpenAI and Anthropic request shapes.
+		// Leave ParserID empty so the proxy detects the shape from the URL.
+		ParserID:        "",
+		RouterVendors:   []string{"openai", "anthropic"},
+		PricingSurfaces: []string{"openai", "anthropic"},
+		Discovery: &Discovery{
+			Path:            "/v1/models",
+			Shape:           ShapeOpenAIData,
+			ExactModelsOnly: true,
+		},
+		IdentityInjection: &IdentityInjection{
+			HeaderPair: &HeaderPairInjection{
+				EndUserIDHeader: "x-netbird-user-id",
+				TagsHeader:      "x-netbird-groups",
+			},
+		},
+		Models: []Model{},
+	},
 	{
 		ID:          "portkey",
 		Kind:        KindGateway,
@@ -699,13 +939,28 @@ func IsBedrockPathStyle(providerID string) bool {
 func (p Provider) ToAPIResponse() api.AgentNetworkCatalogProvider {
 	models := make([]api.AgentNetworkCatalogModel, 0, len(p.Models))
 	for _, m := range p.Models {
-		models = append(models, api.AgentNetworkCatalogModel{
+		am := api.AgentNetworkCatalogModel{
 			Id:            m.ID,
 			Label:         m.Label,
 			InputPer1k:    m.InputPer1k,
 			OutputPer1k:   m.OutputPer1k,
 			ContextWindow: m.ContextWindow,
-		})
+		}
+		// Cache rates are emitted only when configured so the dashboard
+		// can prefill them; 0 stays off the wire (absent = no rate).
+		if m.CachedInputPer1k > 0 {
+			v := m.CachedInputPer1k
+			am.CachedInputPer1k = &v
+		}
+		if m.CacheReadPer1k > 0 {
+			v := m.CacheReadPer1k
+			am.CacheReadPer1k = &v
+		}
+		if m.CacheCreationPer1k > 0 {
+			v := m.CacheCreationPer1k
+			am.CacheCreationPer1k = &v
+		}
+		models = append(models, am)
 	}
 	kind := api.AgentNetworkCatalogProviderKindProvider
 	switch p.Kind {
@@ -725,6 +980,10 @@ func (p Provider) ToAPIResponse() api.AgentNetworkCatalogProvider {
 		BrandColor:         p.BrandColor,
 		Models:             models,
 	}
+	if len(p.PricingSurfaces) > 0 {
+		surfaces := append([]string(nil), p.PricingSurfaces...)
+		resp.PricingSurfaces = &surfaces
+	}
 	if len(p.ExtraHeaders) > 0 {
 		extras := make([]api.AgentNetworkCatalogExtraHeader, 0, len(p.ExtraHeaders))
 		for _, h := range p.ExtraHeaders {
diff --git a/management/internals/modules/agentnetwork/catalog/catalog_test.go b/management/internals/modules/agentnetwork/catalog/catalog_test.go
new file mode 100644
index 000000000..8abd3a312
--- /dev/null
+++ b/management/internals/modules/agentnetwork/catalog/catalog_test.go
@@ -0,0 +1,86 @@
+package catalog
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestClaudeLineupSelectable pins the models Claude Code resolves to by
+// default. A model absent from the lineup can't be ticked on a provider
+// record, so llm_router denies it as not-routable and the operator has no
+// way to authorise the client's own default.
+func TestClaudeLineupSelectable(t *testing.T) {
+	for providerID, wanted := range map[string][]string{
+		"anthropic_api": {"claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5"},
+		"bedrock_api":   {"anthropic.claude-opus-5", "anthropic.claude-sonnet-5", "anthropic.claude-haiku-4-5"},
+		"vertex_ai_api": {"claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5"},
+	} {
+		provider, ok := Lookup(providerID)
+		require.True(t, ok, "catalog must define %s", providerID)
+
+		selectable := make(map[string]Model, len(provider.Models))
+		for _, m := range provider.Models {
+			selectable[m.ID] = m
+		}
+		for _, id := range wanted {
+			model, found := selectable[id]
+			require.True(t, found, "%s must offer %s", providerID, id)
+			assert.NotEmpty(t, model.Label, "%s/%s needs a label for the picker", providerID, id)
+			assert.Positive(t, model.InputPer1k, "%s/%s needs an input rate", providerID, id)
+			assert.Positive(t, model.OutputPer1k, "%s/%s needs an output rate", providerID, id)
+			assert.Positive(t, model.ContextWindow, "%s/%s needs a context window", providerID, id)
+		}
+	}
+}
+
+func TestAgentgatewayCatalogEntry(t *testing.T) {
+	entry, ok := Lookup("agentgateway")
+	require.True(t, ok, "agentgateway must be available in the provider catalog")
+
+	assert.Equal(t, KindGateway, entry.Kind, "agentgateway must be grouped with AI gateways")
+	assert.Empty(t, entry.DefaultHost, "operators must provide their agentgateway proxy URL")
+	assert.Equal(t, "Authorization", entry.AuthHeaderName)
+	assert.Equal(t, "Bearer ${API_KEY}", entry.AuthHeaderTemplate)
+	assert.Equal(t, "application/json", entry.DefaultContentType)
+	assert.Empty(t, entry.ParserID, "URL detection must select the OpenAI or Anthropic parser")
+	assert.Equal(t, []string{"openai", "anthropic"}, entry.RouterVendors,
+		"agentgateway must accept both parser surfaces")
+	assert.Equal(t, []string{"openai", "anthropic"}, entry.PricingSurfaces,
+		"agentgateway models can use either pricing surface")
+	assert.Empty(t, entry.Models, "an empty model list makes agentgateway a catch-all route")
+	require.NotNil(t, entry.Discovery)
+	assert.Empty(t, entry.Discovery.Host, "discovery must use the configured proxy URL")
+	assert.Equal(t, "/v1/models", entry.Discovery.Path)
+	assert.Equal(t, ShapeOpenAIData, entry.Discovery.Shape)
+	assert.True(t, entry.Discovery.ExactModelsOnly,
+		"wildcard model semantics are not supported by NetBird")
+
+	require.NotNil(t, entry.IdentityInjection)
+	require.NotNil(t, entry.IdentityInjection.HeaderPair)
+	assert.Nil(t, entry.IdentityInjection.JSONMetadata)
+	assert.False(t, entry.IdentityInjection.HeaderPair.Customizable,
+		"NetBird identity header names are part of the integration contract")
+	assert.Equal(t, "x-netbird-user-id", entry.IdentityInjection.HeaderPair.EndUserIDHeader)
+	assert.Equal(t, "x-netbird-groups", entry.IdentityInjection.HeaderPair.TagsHeader)
+	assert.False(t, entry.IdentityInjection.HeaderPair.EndUserIDInBody)
+	assert.False(t, entry.IdentityInjection.HeaderPair.TagsInBody)
+}
+
+func TestAgentgatewayCatalogAPIResponse(t *testing.T) {
+	entry, ok := Lookup("agentgateway")
+	require.True(t, ok)
+
+	resp := entry.ToAPIResponse()
+	assert.Equal(t, "agentgateway", resp.Id)
+	assert.Equal(t, api.AgentNetworkCatalogProviderKindGateway, resp.Kind)
+	assert.Empty(t, resp.Models)
+	require.NotNil(t, resp.IdentityInjection)
+	require.NotNil(t, resp.IdentityInjection.HeaderPair)
+	assert.False(t, resp.IdentityInjection.HeaderPair.Customizable)
+	assert.Equal(t, "x-netbird-user-id", resp.IdentityInjection.HeaderPair.EndUserIdHeader)
+	assert.Equal(t, "x-netbird-groups", resp.IdentityInjection.HeaderPair.TagsHeader)
+}
diff --git a/management/internals/modules/agentnetwork/credentialcheck.go b/management/internals/modules/agentnetwork/credentialcheck.go
new file mode 100644
index 000000000..a4787d019
--- /dev/null
+++ b/management/internals/modules/agentnetwork/credentialcheck.go
@@ -0,0 +1,135 @@
+package agentnetwork
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/modeldiscovery"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// ModelLister is the vendor-facing half of the credential check.
+// modeldiscovery.Client is the only production implementation; it is an
+// interface because the check runs on a write path, so without a seam every
+// test that saves a provider would reach a vendor to do it.
+type ModelLister interface {
+	Fetch(ctx context.Context, req modeldiscovery.Request) ([]modeldiscovery.Model, error)
+}
+
+// checkProviderCredential refuses a record whose upstream or credential the
+// vendor will not accept.
+//
+// It reuses the discovery Fetch rather than a lighter status probe so it
+// exercises the path the model picker takes: a URL answering 200 with a login
+// page fails here instead of producing an empty picker later.
+func (m *managerImpl) checkProviderCredential(ctx context.Context, provider *types.Provider) error {
+	// A record that asks the proxy to skip certificate verification is one this
+	// check cannot speak for. Discovery verifies certificates, so a self-hosted
+	// endpoint behind a self-signed one would be refused for a reason the
+	// operator already told us to ignore — a lockout of exactly the setup the
+	// flag exists for. Sending the credential over a connection management
+	// declines to verify is the other way out, and a worse one.
+	if provider.SkipTLSVerification {
+		log.WithContext(ctx).Debugf("agent network provider %s not credential-checked: tls verification is disabled for it", provider.ProviderID)
+		return nil
+	}
+
+	_, err := m.modelDiscovery.Fetch(ctx, modeldiscovery.Request{
+		CatalogID:   provider.ProviderID,
+		UpstreamURL: provider.UpstreamURL,
+		APIKey:      provider.APIKey,
+	})
+	if err == nil {
+		return nil
+	}
+
+	message, blocking := credentialCheckFailure(err)
+	if !blocking {
+		log.WithContext(ctx).Debugf("agent network provider %s not credential-checked: %v", provider.ProviderID, err)
+		return nil
+	}
+
+	// WriteError logs only what we return, and that carries no status code,
+	// so the vendor's number is recorded here or nowhere.
+	log.WithContext(ctx).Infof("agent network provider %s failed its credential check: %v", provider.ProviderID, err)
+
+	return status.Errorf(status.InvalidArgument, "%s", message)
+}
+
+// discoveryFailure renders a failed model listing for the operator who pressed
+// the button. Every outcome here is something they did or configured — a key
+// the vendor refused, an upstream that does not answer — so it owes them the
+// same sentence a refused save gives, not the generic 500 an unclassified
+// error turns into.
+//
+// ErrNoDiscovery and ErrInvalidRequest pass through untouched: the handler
+// already maps them, and "this provider has no listing endpoint" is a fact
+// about the catalog rather than a failure to report as one.
+func discoveryFailure(ctx context.Context, catalogID string, err error) error {
+	if errors.Is(err, modeldiscovery.ErrNoDiscovery) || errors.Is(err, modeldiscovery.ErrInvalidRequest) {
+		return err
+	}
+
+	message, _ := credentialCheckFailure(err)
+	if message == "" {
+		return err
+	}
+
+	// The operator's message carries no status code, so the vendor's number is
+	// recorded here or nowhere.
+	log.WithContext(ctx).Infof("agent network model discovery for %s failed: %v", catalogID, err)
+
+	return status.Errorf(status.InvalidArgument, "%s", message)
+}
+
+// credentialCheckFailure renders a discovery failure as the sentence the
+// provider form shows, and reports whether it should block the write.
+//
+// The strings survive WriteError lowercasing them, and never echo the
+// operator's URL: paths are case-sensitive, so an echoed URL comes back
+// altered and describes something they did not type.
+func credentialCheckFailure(err error) (message string, blocking bool) {
+	// Not checkable. The record may be perfectly good and we have no way to
+	// ask, so reporting a failure would be a guess.
+	switch {
+	case errors.Is(err, modeldiscovery.ErrNoDiscovery),
+		errors.Is(err, modeldiscovery.ErrNoDiscoveryHost),
+		errors.Is(err, modeldiscovery.ErrPrivateHost):
+		return "", false
+	}
+
+	var vendor *modeldiscovery.VendorStatusError
+	if errors.As(err, &vendor) {
+		switch vendor.Status {
+		case http.StatusUnauthorized, http.StatusForbidden:
+			return "the provider rejected the credential", true
+		case http.StatusNotFound, http.StatusMethodNotAllowed:
+			return "the upstream url did not answer a model listing", true
+		default:
+			// 5xx and 429 included: an outage still leaves the record
+			// unverified, which is what this refuses to save.
+			return "the provider returned an error", true
+		}
+	}
+
+	var unreachable *modeldiscovery.UnreachableError
+	if errors.As(err, &unreachable) {
+		if reason := unreachable.Reason(); reason != "" {
+			return "the upstream url could not be reached: " + reason, true
+		}
+		return "the upstream url could not be reached", true
+	}
+
+	if errors.Is(err, modeldiscovery.ErrUnparseableListing) {
+		return "the upstream url answered, but not with a model listing", true
+	}
+
+	// Ours rather than the vendor's — a request this code built badly, or a
+	// catalog entry that does not match its parser. Still unverified, so it
+	// still blocks.
+	return "the provider could not be checked", true
+}
diff --git a/management/internals/modules/agentnetwork/credentialcheck_test.go b/management/internals/modules/agentnetwork/credentialcheck_test.go
new file mode 100644
index 000000000..8bc8f0b58
--- /dev/null
+++ b/management/internals/modules/agentnetwork/credentialcheck_test.go
@@ -0,0 +1,605 @@
+package agentnetwork
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"syscall"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/modeldiscovery"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// stubLister stands in for the vendor on the write path. It records what it
+// was asked so a test can assert not only that the check ran, but that it ran
+// against the right upstream and the right credential — and, for an edit that
+// touches neither, that it did not run at all.
+type stubLister struct {
+	err      error
+	requests []modeldiscovery.Request
+}
+
+func (s *stubLister) Fetch(_ context.Context, req modeldiscovery.Request) ([]modeldiscovery.Model, error) {
+	s.requests = append(s.requests, req)
+	if s.err != nil {
+		return nil, s.err
+	}
+	return []modeldiscovery.Model{{ID: "a-model", PricingKnown: true}}, nil
+}
+
+func (s *stubLister) calls() int { return len(s.requests) }
+
+func (s *stubLister) only(t *testing.T) modeldiscovery.Request {
+	t.Helper()
+	require.Len(t, s.requests, 1, "the vendor must be asked exactly once")
+	return s.requests[0]
+}
+
+// TestCredentialCheckFailure_SeparatesTheUrlFromTheCredential is the contract
+// the provider form is written against: an operator gets told which of the two
+// fields they have to look at, and the message says so without a status code
+// and without echoing the URL back at them.
+func TestCredentialCheckFailure_SeparatesTheUrlFromTheCredential(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want string
+	}{
+		{
+			name: "401 is the credential",
+			err:  &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 401},
+			want: "the provider rejected the credential",
+		},
+		{
+			name: "403 is the credential",
+			err:  &modeldiscovery.VendorStatusError{Provider: "Bedrock", Status: 403},
+			want: "the provider rejected the credential",
+		},
+		{
+			// The host authenticated us fine and then said it has no such
+			// endpoint, which is the URL being wrong rather than the key.
+			name: "404 is the url",
+			err:  &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 404},
+			want: "the upstream url did not answer a model listing",
+		},
+		{
+			name: "405 is the url",
+			err:  &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 405},
+			want: "the upstream url did not answer a model listing",
+		},
+		{
+			name: "500 is the vendor",
+			err:  &modeldiscovery.VendorStatusError{Provider: "Anthropic", Status: 500},
+			want: "the provider returned an error",
+		},
+		{
+			name: "503 is the vendor",
+			err:  &modeldiscovery.VendorStatusError{Provider: "Anthropic", Status: 503},
+			want: "the provider returned an error",
+		},
+		{
+			name: "429 is the vendor",
+			err:  &modeldiscovery.VendorStatusError{Provider: "Anthropic", Status: 429},
+			want: "the provider returned an error",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, blocking := credentialCheckFailure(tc.err)
+			require.True(t, blocking, "a vendor refusal must block the write")
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
+
+// TestCredentialCheckFailure_NamesTheTransportFault covers the failures that
+// never reached the vendor. The distinction inside them is worth keeping: a
+// refused connection is a wrong port and an unknown host is a wrong hostname,
+// and an operator staring at a URL they believe in needs to be told which.
+func TestCredentialCheckFailure_NamesTheTransportFault(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want string
+	}{
+		{
+			name: "unknown host",
+			err:  &net.DNSError{Err: "no such host", Name: "api.example.com", IsNotFound: true},
+			want: "the upstream url could not be reached: no such host",
+		},
+		{
+			name: "dns failure that is not a missing name",
+			err:  &net.DNSError{Err: "server misbehaving", Name: "api.example.com"},
+			want: "the upstream url could not be reached: dns lookup failed",
+		},
+		{
+			name: "connection refused",
+			err:  &net.OpError{Op: "dial", Net: "tcp", Err: syscall.ECONNREFUSED},
+			want: "the upstream url could not be reached: connection refused",
+		},
+		{
+			name: "host unreachable",
+			err:  &net.OpError{Op: "dial", Net: "tcp", Err: syscall.EHOSTUNREACH},
+			want: "the upstream url could not be reached: host unreachable",
+		},
+		{
+			name: "timeout",
+			err:  fmt.Errorf("dial: %w", os.ErrDeadlineExceeded),
+			want: "the upstream url could not be reached: connection timed out",
+		},
+		{
+			name: "context deadline",
+			err:  fmt.Errorf("dial: %w", context.DeadlineExceeded),
+			want: "the upstream url could not be reached: connection timed out",
+		},
+		{
+			name: "untrusted certificate",
+			err:  &tls.CertificateVerificationError{},
+			want: "the upstream url could not be reached: tls certificate not trusted",
+		},
+		{
+			name: "plaintext service on an https url",
+			err:  tls.RecordHeaderError{Msg: "first record does not look like a TLS handshake"},
+			want: "the upstream url could not be reached: not a tls endpoint",
+		},
+		{
+			// Nothing we recognise. Better to say only that it could not be
+			// reached than to paste a Go error into the provider form.
+			name: "cause we do not recognise",
+			err:  errors.New("something went sideways"),
+			want: "the upstream url could not be reached",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			wrapped := &modeldiscovery.UnreachableError{Provider: "OpenAI", Err: tc.err}
+			got, blocking := credentialCheckFailure(wrapped)
+			require.True(t, blocking, "an unreachable upstream must block the write")
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
+
+// TestCredentialCheckFailure_AnAnsweringUrlThatIsNotTheApi covers the case a
+// status probe would wave through: the host is up, the credential was accepted
+// or not required, and the body is a login page. Reusing the discovery parser
+// for the check is what catches it.
+func TestCredentialCheckFailure_AnAnsweringUrlThatIsNotTheApi(t *testing.T) {
+	err := fmt.Errorf("%w: decode model listing: unexpected token", modeldiscovery.ErrUnparseableListing)
+
+	got, blocking := credentialCheckFailure(err)
+	require.True(t, blocking)
+	require.Equal(t, "the upstream url answered, but not with a model listing", got)
+}
+
+// TestCredentialCheckFailure_WhatCannotBeCheckedIsNotAFailure pins the
+// difference between "this record is wrong" and "we have no way to ask". A
+// gateway with no listing endpoint, a Bedrock record pointed at a proxy, and a
+// self-hosted endpoint the proxy reaches through the tunnel are all legitimate
+// providers. Blocking them would make the feature a lockout.
+func TestCredentialCheckFailure_WhatCannotBeCheckedIsNotAFailure(t *testing.T) {
+	cases := map[string]error{
+		"no listing endpoint": modeldiscovery.ErrNoDiscovery,
+		"no derivable host":   fmt.Errorf("%w: %w: bedrock", modeldiscovery.ErrInvalidRequest, modeldiscovery.ErrNoDiscoveryHost),
+		"private upstream":    fmt.Errorf("%w: %w: 10.0.0.5", modeldiscovery.ErrInvalidRequest, modeldiscovery.ErrPrivateHost),
+	}
+
+	for name, err := range cases {
+		t.Run(name, func(t *testing.T) {
+			message, blocking := credentialCheckFailure(err)
+			require.False(t, blocking, "a provider we cannot check must still save")
+			require.Empty(t, message)
+		})
+	}
+}
+
+// TestCredentialCheckFailure_AnUnrecognisedFailureStillBlocks covers a fault of
+// ours rather than the vendor's — a malformed request this code built, or a
+// catalog entry whose parser does not match its endpoint. The record went
+// unverified either way, and silently saving what we could not check is the
+// thing this feature exists to prevent.
+func TestCredentialCheckFailure_AnUnrecognisedFailureStillBlocks(t *testing.T) {
+	message, blocking := credentialCheckFailure(errors.New("no parser for listing shape \"\""))
+	require.True(t, blocking)
+	require.Equal(t, "the provider could not be checked", message)
+}
+
+// newCheckedProvider returns a record shaped the way the handler guarantees
+// one: a known catalog id, a public upstream and a key.
+func newCheckedProvider(accountID string) *types.Provider {
+	provider := types.NewProvider(accountID)
+	provider.ProviderID = "openai_api"
+	provider.Name = "openai"
+	provider.UpstreamURL = "https://api.openai.com"
+	provider.APIKey = "sk-good"
+	provider.Enabled = true
+	return provider
+}
+
+// TestCreateProvider_RefusesARecordTheVendorRejects is the whole point of the
+// feature: a key with a character missing used to save cleanly and surface
+// minutes later as a failed request with nothing pointing back at the record.
+func TestCreateProvider_RefusesARecordTheVendorRejects(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.vendor.err = &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 401}
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	_, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
+
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "the provider rejected the credential")
+
+	var sErr *status.Error
+	require.ErrorAs(t, err, &sErr)
+	require.Equal(t, status.InvalidArgument, sErr.Type(), "the refusal must reach the caller as a 422")
+
+	stored, err := f.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "account1")
+	require.NoError(t, err)
+	require.Empty(t, stored, "a record that failed its check must not be written")
+}
+
+// TestCreateProvider_ChecksTheCredentialItWasGiven pins what the vendor is
+// asked with, since a check run against the wrong upstream or a stale key
+// would pass while proving nothing.
+func TestCreateProvider_ChecksTheCredentialItWasGiven(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	_, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
+	require.NoError(t, err)
+
+	asked := f.vendor.only(t)
+	require.Equal(t, "openai_api", asked.CatalogID)
+	require.Equal(t, "https://api.openai.com", asked.UpstreamURL)
+	require.Equal(t, "sk-good", asked.APIKey)
+}
+
+// TestUpdateProvider_AUrlOnlyChangeIsCheckedAgainstTheStoredKey covers the
+// case that shaped where the check sits. The key never returns to the browser,
+// so an operator editing only the URL has none to offer — the stored one is
+// the only credential there is, and the new URL still has to be proven with
+// it.
+func TestUpdateProvider_AUrlOnlyChangeIsCheckedAgainstTheStoredKey(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
+	require.NoError(t, err)
+	f.vendor.requests = nil
+
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Update, true)
+	edit := newCheckedProvider("account1")
+	edit.ID = created.ID
+	edit.UpstreamURL = "https://gateway.example.com"
+	edit.APIKey = "" // the form sends no key when it was not retyped
+
+	_, err = f.manager.UpdateProvider(ctx, "user1", edit)
+	require.NoError(t, err)
+
+	asked := f.vendor.only(t)
+	require.Equal(t, "https://gateway.example.com", asked.UpstreamURL, "the new url must be what gets tested")
+	require.Equal(t, "sk-good", asked.APIKey, "and the stored key must be what tests it")
+}
+
+// TestUpdateProvider_AFailedRotationLeavesTheWorkingKeyInPlace is the
+// half-applied state the check must never produce: refusing the new key while
+// having already replaced the old one would take the provider down.
+func TestUpdateProvider_AFailedRotationLeavesTheWorkingKeyInPlace(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
+	require.NoError(t, err)
+
+	f.vendor.err = &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 403}
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Update, true)
+	rotation := newCheckedProvider("account1")
+	rotation.ID = created.ID
+	rotation.APIKey = "sk-typo"
+
+	_, err = f.manager.UpdateProvider(ctx, "user1", rotation)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "the provider rejected the credential")
+
+	stored, err := f.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, "account1", created.ID)
+	require.NoError(t, err)
+	require.Equal(t, "sk-good", stored.APIKey, "the rejected key must not have replaced the working one")
+}
+
+// TestUpdateProvider_AnEditTouchingNeitherFieldAsksNoVendor keeps renames,
+// model rows and price edits off the vendor's doorstep. They have nothing new
+// to prove, and making them wait on a vendor — or fail because one is having a
+// bad day — would be a tax on edits that carry no risk.
+func TestUpdateProvider_AnEditTouchingNeitherFieldAsksNoVendor(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
+	require.NoError(t, err)
+	f.vendor.requests = nil
+	// Any call at all now would fail the update, which is what makes the
+	// assertion below load-bearing rather than decorative.
+	f.vendor.err = &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 500}
+
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Update, true)
+	rename := newCheckedProvider("account1")
+	rename.ID = created.ID
+	rename.Name = "openai-renamed"
+	rename.APIKey = ""
+
+	_, err = f.manager.UpdateProvider(ctx, "user1", rename)
+	require.NoError(t, err, "an edit that changes neither url nor key must not be checked")
+	require.Zero(t, f.vendor.calls(), "and must not reach the vendor at all")
+}
+
+// TestCreateProvider_AProviderWeCannotCheckStillSaves covers the eleven
+// catalog entries with no listing endpoint, a Bedrock record behind a proxy,
+// and a self-hosted endpoint on a private network. None of those are evidence
+// the record is wrong, and refusing them would make this a lockout.
+func TestCreateProvider_AProviderWeCannotCheckStillSaves(t *testing.T) {
+	cases := map[string]error{
+		"gateway with no listing endpoint": modeldiscovery.ErrNoDiscovery,
+		"bedrock behind a proxy":           fmt.Errorf("%w: %w", modeldiscovery.ErrInvalidRequest, modeldiscovery.ErrNoDiscoveryHost),
+		"self-hosted on a private network": fmt.Errorf("%w: %w", modeldiscovery.ErrInvalidRequest, modeldiscovery.ErrPrivateHost),
+	}
+
+	for name, vendorErr := range cases {
+		t.Run(name, func(t *testing.T) {
+			ctx := context.Background()
+			f := newBootstrapFixture(t)
+			f.vendor.err = vendorErr
+			f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+			created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
+			require.NoError(t, err)
+			require.NotNil(t, created)
+
+			stored, err := f.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "account1")
+			require.NoError(t, err)
+			require.Len(t, stored, 1, "a provider we cannot check must still be written")
+		})
+	}
+}
+
+// TestDiscoveryFailure_TellsTheOperatorWhatWentWrong covers the button, not the
+// save. Pressing "Load models from provider" against a bad key used to answer
+// "internal server error", which names neither the thing that failed nor
+// anything the operator could act on — every outcome here is their key or their
+// URL.
+func TestDiscoveryFailure_TellsTheOperatorWhatWentWrong(t *testing.T) {
+	cases := map[string]struct {
+		err  error
+		want string
+	}{
+		"refused credential": {
+			err:  &modeldiscovery.VendorStatusError{Provider: "Bedrock", Status: 403},
+			want: "the provider rejected the credential",
+		},
+		"upstream that is not the api": {
+			err:  &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 404},
+			want: "the upstream url did not answer a model listing",
+		},
+		"upstream that does not resolve": {
+			err: &modeldiscovery.UnreachableError{
+				Provider: "OpenAI",
+				Err:      &net.DNSError{Err: "no such host", Name: "api.example.com", IsNotFound: true},
+			},
+			want: "the upstream url could not be reached: no such host",
+		},
+		"vendor having a bad day": {
+			err:  &modeldiscovery.VendorStatusError{Provider: "Anthropic", Status: 503},
+			want: "the provider returned an error",
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			err := discoveryFailure(context.Background(), "openai_api", tc.err)
+			require.EqualError(t, err, tc.want)
+
+			var sErr *status.Error
+			require.ErrorAs(t, err, &sErr)
+			require.Equal(t, status.InvalidArgument, sErr.Type(),
+				"a failure the operator caused must not read as a server fault")
+		})
+	}
+}
+
+// TestDiscoveryFailure_LeavesTheCatalogFactsAlone keeps the two outcomes the
+// handler already maps. A provider with no listing endpoint is a fact about the
+// catalog entry, and the caller falls back to the catalog's own models rather
+// than showing an error at all — rewriting it as a refusal would turn a normal
+// path into one.
+func TestDiscoveryFailure_LeavesTheCatalogFactsAlone(t *testing.T) {
+	for name, err := range map[string]error{
+		"no listing endpoint": modeldiscovery.ErrNoDiscovery,
+		"bad request":         fmt.Errorf("%w: unknown catalog provider", modeldiscovery.ErrInvalidRequest),
+	} {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, err, discoveryFailure(context.Background(), "openai_api", err),
+				"the handler's own mapping must still see the original error")
+		})
+	}
+}
+
+// TestDiscoverProviderModels_SurfacesTheVendorRefusal drives the manager rather
+// than the classifier, so a future refactor that stops translating on this path
+// fails here rather than silently going back to 500s.
+func TestDiscoverProviderModels_SurfacesTheVendorRefusal(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.vendor.err = &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 401}
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	_, err := f.manager.DiscoverProviderModels(ctx, "account1", "user1", modeldiscovery.Request{
+		CatalogID:   "openai_api",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-wrong",
+	}, "")
+
+	require.EqualError(t, err, "the provider rejected the credential")
+}
+
+// TestDiscoverProviderModels_ListsAgainstTheUrlOnTheForm covers the edit the
+// operator cannot otherwise make: the upstream has been retyped and the
+// credential has not, because the API never returned it to be retyped. Naming
+// the record supplies the key; the request supplies the URL under test.
+func TestDiscoverProviderModels_ListsAgainstTheUrlOnTheForm(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	// Twice: the create, and the listing, which is gated on Create too.
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
+	require.NoError(t, err)
+	f.vendor.requests = nil
+
+	_, err = f.manager.DiscoverProviderModels(ctx, "account1", "user1", modeldiscovery.Request{
+		CatalogID:   "openai_api",
+		UpstreamURL: "https://gateway.example.com",
+	}, created.ID)
+	require.NoError(t, err)
+
+	asked := f.vendor.only(t)
+	require.Equal(t, "https://gateway.example.com", asked.UpstreamURL, "the typed url must be the one listed against")
+	require.Equal(t, "sk-good", asked.APIKey, "and the stored key must be what lists it")
+}
+
+// TestDiscoverProviderModels_FallsBackToTheStoredUrl keeps the plain refresh
+// working: a request naming only the record still reaches the saved upstream.
+func TestDiscoverProviderModels_FallsBackToTheStoredUrl(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
+	require.NoError(t, err)
+	stored := f.vendor.only(t).UpstreamURL
+	f.vendor.requests = nil
+
+	_, err = f.manager.DiscoverProviderModels(ctx, "account1", "user1", modeldiscovery.Request{
+		CatalogID: "openai_api",
+	}, created.ID)
+	require.NoError(t, err)
+
+	require.Equal(t, stored, f.vendor.only(t).UpstreamURL)
+}
+
+// TestUpdateProvider_MovingARecordToAnotherVendorIsChecked covers the edit that
+// changes neither field the vendor judges and still invalidates both. The
+// catalog entry decides which vendor is asked and under which auth header, so
+// the unchanged credential is now being offered somewhere it has never been
+// accepted.
+func TestUpdateProvider_MovingARecordToAnotherVendorIsChecked(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
+	require.NoError(t, err)
+	f.vendor.requests = nil
+
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Update, true)
+	edit := newCheckedProvider("account1")
+	edit.ID = created.ID
+	edit.ProviderID = "anthropic_api"
+	edit.APIKey = ""
+
+	_, err = f.manager.UpdateProvider(ctx, "user1", edit)
+	require.NoError(t, err)
+
+	require.Equal(t, "anthropic_api", f.vendor.only(t).CatalogID,
+		"the new vendor is the one that has to accept the key")
+}
+
+// TestCreateProvider_ASkipTlsRecordIsNotCheckedAgainstItsCertificate covers the
+// lockout the check would otherwise be: the flag exists for a self-hosted
+// endpoint behind a certificate nothing public can verify, and discovery
+// verifies certificates. Refusing the save would reject the record for the one
+// reason the operator already declared they accept.
+func TestCreateProvider_ASkipTlsRecordIsNotCheckedAgainstItsCertificate(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.vendor.err = &modeldiscovery.UnreachableError{
+		Provider: "OpenAI",
+		Err:      &tls.CertificateVerificationError{},
+	}
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	provider := newCheckedProvider("account1")
+	provider.SkipTLSVerification = true
+
+	created, err := f.manager.CreateProvider(ctx, "user1", provider)
+	require.NoError(t, err, "a record we were told not to verify must still save")
+	require.NotEmpty(t, created.ID)
+	require.Zero(t, f.vendor.calls(), "and the vendor must not be asked at all")
+}
+
+// TestCreateProvider_TheStoredKeyIsTheOneThatWasChecked pins the two halves to
+// one value. The vendor call trims the credential before building its auth
+// header; the synthesiser substitutes the stored one verbatim. A key pasted
+// with surrounding whitespace would otherwise pass its check and then fail
+// every request the provider serves.
+func TestCreateProvider_TheStoredKeyIsTheOneThatWasChecked(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	provider := newCheckedProvider("account1")
+	provider.APIKey = "  sk-good\n"
+
+	created, err := f.manager.CreateProvider(ctx, "user1", provider)
+	require.NoError(t, err)
+
+	require.Equal(t, "sk-good", f.vendor.only(t).APIKey, "the vendor is asked about the trimmed key")
+
+	stored, err := f.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, "account1", created.ID)
+	require.NoError(t, err)
+	require.Equal(t, "sk-good", stored.APIKey, "and that is the one the proxy will send")
+}
+
+// TestUpdateProvider_TurningTlsVerificationBackOnChecksTheRecord covers the
+// hole the skip-TLS exemption opens on its own. Such a record is stored without
+// ever being checked, so the moment verification is switched back on is the
+// first moment it can be checked at all — and none of the three fields the
+// re-check usually watches has to move for that to happen.
+func TestUpdateProvider_TurningTlsVerificationBackOnChecksTheRecord(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	unchecked := newCheckedProvider("account1")
+	unchecked.SkipTLSVerification = true
+	created, err := f.manager.CreateProvider(ctx, "user1", unchecked)
+	require.NoError(t, err)
+	require.Zero(t, f.vendor.calls(), "the create was exempt")
+
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Update, true)
+	edit := newCheckedProvider("account1")
+	edit.ID = created.ID
+	edit.APIKey = ""
+	edit.SkipTLSVerification = false
+
+	_, err = f.manager.UpdateProvider(ctx, "user1", edit)
+	require.NoError(t, err)
+	require.Equal(t, 1, f.vendor.calls(), "switching verification on must check what was never checked")
+}
diff --git a/management/internals/modules/agentnetwork/handlers/agent_config_handler.go b/management/internals/modules/agentnetwork/handlers/agent_config_handler.go
new file mode 100644
index 000000000..0d6c45110
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/agent_config_handler.go
@@ -0,0 +1,56 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+)
+
+// addAgentConfigEndpoints registers the self-service agent-config route.
+// It is available to every authenticated user regardless of role: the
+// providers in the response are scoped strictly to the caller, which is
+// tighter than any role gate could be. The caller's own usage and requests are served by
+// the regular usage/logs endpoints, which self-scope for callers without
+// the account-wide grants.
+func (h *handler) addAgentConfigEndpoints(router *mux.Router) {
+	router.HandleFunc("/agent-network/agent-config", h.getAgentConfig).Methods("GET", "OPTIONS")
+}
+
+func (h *handler) getAgentConfig(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	setup, err := h.manager.GetAgentConfigForUser(r.Context(), userAuth.AccountId, userAuth.UserId)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, agentConfigToAPI(setup))
+}
+
+func agentConfigToAPI(setup *types.AgentConfig) api.AgentNetworkAgentConfig {
+	providers := make([]api.AgentNetworkAgentConfigProvider, 0, len(setup.Providers))
+	for _, p := range setup.Providers {
+		providers = append(providers, api.AgentNetworkAgentConfigProvider{
+			Name:             p.Name,
+			CatalogId:        p.CatalogID,
+			ApiFlavor:        p.APIFlavor,
+			AllModelsAllowed: p.AllModelsAllowed,
+			Models:           p.Models,
+		})
+	}
+	return api.AgentNetworkAgentConfig{
+		Configured: setup.Configured,
+		Endpoint:   setup.Endpoint,
+		Providers:  providers,
+	}
+}
diff --git a/management/internals/modules/agentnetwork/handlers/budget_handler_test.go b/management/internals/modules/agentnetwork/handlers/budget_handler_test.go
index 4038761c5..3a7709461 100644
--- a/management/internals/modules/agentnetwork/handlers/budget_handler_test.go
+++ b/management/internals/modules/agentnetwork/handlers/budget_handler_test.go
@@ -102,8 +102,8 @@ func TestSettingsHandler_GetExposesCollectionToggles(t *testing.T) {
 
 	require.NoError(t, f.store.SaveAgentNetworkSettings(context.Background(), &agentNetworkTypes.Settings{
 		AccountID:              testAccountID,
-		Cluster:                "eu.proxy.netbird.io",
-		Subdomain:              "violet",
+		Domain:                 "violet.eu.proxy.netbird.io",
+		ProxyAddress:           "eu.proxy.netbird.io",
 		EnableLogCollection:    true,
 		EnablePromptCollection: true,
 		RedactPii:              false,
diff --git a/management/internals/modules/agentnetwork/handlers/handlers_test.go b/management/internals/modules/agentnetwork/handlers/handlers_test.go
index 27ebea5dd..2b2f3b8a3 100644
--- a/management/internals/modules/agentnetwork/handlers/handlers_test.go
+++ b/management/internals/modules/agentnetwork/handlers/handlers_test.go
@@ -9,14 +9,17 @@ import (
 	"runtime"
 	"strings"
 	"testing"
+	"time"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/gorilla/mux"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	rpproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/management/server/account"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -28,6 +31,9 @@ import (
 const (
 	testAccountID = "acc-1"
 	testUserID    = "user-bob"
+	// testClusterAddress is the shared proxy cluster the settings tests pin
+	// their gateway to; the fixture seeds a connected private-capable proxy for it.
+	testClusterAddress = "eu.proxy.netbird.io"
 )
 
 // agentNetworkHandlerFixture builds a real agentnetwork.Manager with
@@ -61,10 +67,29 @@ func newAgentNetworkHandlerFixture(t *testing.T) *agentNetworkHandlerFixture {
 		Return(true, context.Background(), nil).
 		AnyTimes()
 
-	manager := agentnetwork.NewManager(st, perms, nil, nil)
+	// Swallow activity events so the mutation paths (create/update/delete)
+	// are exercisable through the HTTP layer.
+	accounts := account.NewMockManager(ctrl)
+	accounts.EXPECT().
+		StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
+		AnyTimes()
+	accounts.EXPECT().
+		UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).
+		AnyTimes()
+
+	manager := agentnetwork.NewManager(st, perms, accounts, nil)
 	h := &handler{manager: manager}
 
+	// The labeled bootstrap validates its proxy_address against the live
+	// clusters, so seed the shared cluster these tests pin to as a real,
+	// private-capable one — the wire-shape assertions then run through the
+	// validated path rather than the "nothing connected yet" carve-out.
+	seedSharedPrivateCluster(t, st, testClusterAddress)
+
 	router := mux.NewRouter()
+	router.HandleFunc("/agent-network/providers", h.createProvider).Methods("POST")
+	router.HandleFunc("/agent-network/providers/{providerId}", h.getProvider).Methods("GET")
+	router.HandleFunc("/agent-network/providers/{providerId}", h.updateProvider).Methods("PUT")
 	h.addPolicyEndpoints(router)
 	h.addConsumptionEndpoints(router)
 	h.addBudgetRuleEndpoints(router)
@@ -254,3 +279,21 @@ func TestConsumptionHandler_PopulatedAccountListsRows(t *testing.T) {
 	assert.Equal(t, groupRow.WindowStartUtc, userRow.WindowStartUtc,
 		"rows recorded in the same window must share the aligned window_start_utc")
 }
+
+// seedSharedPrivateCluster registers a connected, NetBird-operated proxy
+// with private capabilities (the `private` capability) so
+// clusterAddr is a cluster any account may pin its agent-network gateway to.
+func seedSharedPrivateCluster(t *testing.T, st store.Store, clusterAddr string) {
+	t.Helper()
+	private := true
+	now := time.Now().UTC()
+	require.NoError(t, st.SaveProxy(context.Background(), &rpproxy.Proxy{
+		ID:             "shared-proxy-" + clusterAddr,
+		SessionID:      "shared-session",
+		ClusterAddress: clusterAddr,
+		LastSeen:       now,
+		ConnectedAt:    &now,
+		Status:         rpproxy.StatusConnected,
+		Capabilities:   rpproxy.Capabilities{Private: &private},
+	}), "seeding the shared proxy cluster must succeed")
+}
diff --git a/management/internals/modules/agentnetwork/handlers/model_discovery_handler_test.go b/management/internals/modules/agentnetwork/handlers/model_discovery_handler_test.go
new file mode 100644
index 000000000..389c2ae50
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/model_discovery_handler_test.go
@@ -0,0 +1,178 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/modeldiscovery"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// discoveryManagerStub records what the handler asked for and returns a canned
+// answer. The Manager interface is embedded rather than implemented: only the
+// one method is reachable from this handler, and a call to any other should
+// fail loudly rather than silently return a zero value.
+type discoveryManagerStub struct {
+	agentnetwork.Manager
+
+	gotReq      modeldiscovery.Request
+	gotRecordID string
+	models      []modeldiscovery.Model
+	err         error
+}
+
+func (s *discoveryManagerStub) DiscoverProviderModels(
+	_ context.Context, _, _ string, req modeldiscovery.Request, recordID string,
+) ([]modeldiscovery.Model, error) {
+	s.gotReq = req
+	s.gotRecordID = recordID
+	return s.models, s.err
+}
+
+// postDiscovery drives the handler with an authenticated request.
+func postDiscovery(t *testing.T, stub *discoveryManagerStub, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	h := &handler{manager: stub}
+
+	req := httptest.NewRequest(http.MethodPost, "/agent-network/catalog/providers/models", strings.NewReader(body))
+	req = req.WithContext(nbcontext.SetUserAuthInContext(req.Context(), auth.UserAuth{
+		AccountId: "acc-1",
+		UserId:    "user-1",
+	}))
+
+	rec := httptest.NewRecorder()
+	h.discoverProviderModels(rec, req)
+	return rec
+}
+
+func TestDiscoverModelsReturnsTheVendorList(t *testing.T) {
+	stub := &discoveryManagerStub{models: []modeldiscovery.Model{
+		{ID: "eu.anthropic.claude-haiku-4-5-20251001-v1:0", Label: "EU Claude Haiku 4.5", PricingKnown: true},
+		{ID: "global.cohere.embed-v4:0", Label: "Global Cohere Embed v4"},
+		// A vendor that supplies no display name at all. Bedrock does for
+		// every profile, but the OpenAI listing carries none.
+		{ID: "gpt-4o-mini", PricingKnown: true},
+	}}
+
+	rec := postDiscovery(t, stub, `{
+		"catalog_provider_id":"bedrock_api",
+		"upstream_url":"https://bedrock-runtime.eu-central-1.amazonaws.com",
+		"api_key":"aws-bearer"
+	}`)
+	require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
+
+	var out api.AgentNetworkModelDiscoveryResponse
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &out))
+	require.Len(t, out.Models, 3)
+
+	assert.Equal(t, "eu.anthropic.claude-haiku-4-5-20251001-v1:0", out.Models[0].Id)
+	assert.True(t, out.Models[0].PricingKnown)
+	// An unpriced model must say so rather than arriving indistinguishable
+	// from a priced one: registering it silently would meter at zero.
+	assert.False(t, out.Models[1].PricingKnown)
+
+	require.NotNil(t, out.Models[0].Label, "the vendor supplied a display name")
+	assert.Equal(t, "EU Claude Haiku 4.5", *out.Models[0].Label)
+	// A vendor that supplies no name must omit the key rather than send an
+	// empty string: the dashboard falls back to the id on absence, and would
+	// render a blank row for "".
+	assert.Nil(t, out.Models[2].Label, "an absent label must not serialize")
+	assert.NotContains(t, rec.Body.String(), `"label":""`)
+
+	assert.Equal(t, "bedrock_api", stub.gotReq.CatalogID)
+	assert.Equal(t, "aws-bearer", stub.gotReq.APIKey)
+	// The upstream is what the region is read back out of for Bedrock, so
+	// losing it here would break discovery for every regional provider.
+	assert.Equal(t, "https://bedrock-runtime.eu-central-1.amazonaws.com", stub.gotReq.UpstreamURL)
+	assert.Empty(t, stub.gotRecordID)
+}
+
+func TestDiscoverModelsUsesAStoredRecordWithoutAKey(t *testing.T) {
+	stub := &discoveryManagerStub{}
+
+	rec := postDiscovery(t, stub, `{"catalog_provider_id":"openai_api","provider_id":"prov-42"}`)
+	require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
+
+	// The dashboard refreshes a saved provider's list without ever holding
+	// the credential, so the record id has to reach the manager.
+	assert.Equal(t, "prov-42", stub.gotRecordID)
+	assert.Empty(t, stub.gotReq.APIKey)
+}
+
+// TestDiscoverModelsRefusesMixedCredentials covers the case where a caller
+// names a saved provider AND supplies a key. Accepting it would run an
+// arbitrary credential under the identity of a record the caller may only be
+// permitted to read.
+func TestDiscoverModelsRefusesMixedCredentials(t *testing.T) {
+	stub := &discoveryManagerStub{}
+
+	rec := postDiscovery(t, stub, `{
+		"catalog_provider_id":"openai_api",
+		"provider_id":"prov-42",
+		"api_key":"sk-attacker"
+	}`)
+	assert.Equal(t, http.StatusBadRequest, rec.Code)
+	assert.Empty(t, stub.gotRecordID, "the request must be refused before it reaches the manager")
+}
+
+// TestDiscoverModelsReportsNoDiscoveryDistinctly matters because the caller
+// falls back to the catalog's own model list on this outcome. Collapsing it
+// into a generic 500 would turn "this provider has no listing endpoint" into
+// "something went wrong", and the form would show an error instead of a list.
+func TestDiscoverModelsReportsNoDiscoveryDistinctly(t *testing.T) {
+	stub := &discoveryManagerStub{err: modeldiscovery.ErrNoDiscovery}
+
+	rec := postDiscovery(t, stub, `{"catalog_provider_id":"litellm_proxy","upstream_url":"https://gw.example.com","api_key":"sk"}`)
+	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code)
+}
+
+// TestDiscoverModelsTrimsTheCatalogID pins that the id the emptiness check
+// accepts is the id the manager receives. A padded value that clears the check
+// but reaches the catalog untrimmed misses the lookup, and the operator is told
+// their provider does not exist.
+func TestDiscoverModelsTrimsTheCatalogID(t *testing.T) {
+	stub := &discoveryManagerStub{}
+
+	rec := postDiscovery(t, stub, `{"catalog_provider_id":"  openai_api  ","api_key":"sk"}`)
+	require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
+	assert.Equal(t, "openai_api", stub.gotReq.CatalogID)
+}
+
+// TestDiscoverModelsReportsCallerInputAsBadRequest covers the other half of the
+// error mapping. These failures are all reachable from a well-formed request
+// with a bad field value, so answering 500 both misinforms the operator and
+// puts their typo into the server's error rate.
+func TestDiscoverModelsReportsCallerInputAsBadRequest(t *testing.T) {
+	stub := &discoveryManagerStub{
+		err: fmt.Errorf("%w: unknown catalog provider %q", modeldiscovery.ErrInvalidRequest, "nope"),
+	}
+
+	rec := postDiscovery(t, stub, `{"catalog_provider_id":"nope","api_key":"sk"}`)
+	assert.Equal(t, http.StatusBadRequest, rec.Code)
+	assert.Contains(t, rec.Body.String(), "unknown catalog provider")
+}
+
+func TestDiscoverModelsRejectsMalformedRequests(t *testing.T) {
+	for name, body := range map[string]string{
+		"not json":               `{`,
+		"no catalog provider":    `{"api_key":"sk"}`,
+		"blank catalog provider": `{"catalog_provider_id":"   ","api_key":"sk"}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			stub := &discoveryManagerStub{}
+			rec := postDiscovery(t, stub, body)
+			assert.Equal(t, http.StatusBadRequest, rec.Code)
+		})
+	}
+}
diff --git a/management/internals/modules/agentnetwork/handlers/providers_handler.go b/management/internals/modules/agentnetwork/handlers/providers_handler.go
index 13da137d5..81a6d6eb0 100644
--- a/management/internals/modules/agentnetwork/handlers/providers_handler.go
+++ b/management/internals/modules/agentnetwork/handlers/providers_handler.go
@@ -7,6 +7,8 @@ package handlers
 
 import (
 	"encoding/json"
+	"errors"
+	"math"
 	"net/http"
 	"net/url"
 	"strings"
@@ -15,6 +17,8 @@ import (
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/modeldiscovery"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -30,6 +34,7 @@ type handler struct {
 func RegisterEndpoints(manager agentnetwork.Manager, router *mux.Router) {
 	h := &handler{manager: manager}
 	router.HandleFunc("/agent-network/catalog/providers", h.getCatalogProviders).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/catalog/providers/models", h.discoverProviderModels).Methods("POST", "OPTIONS")
 	router.HandleFunc("/agent-network/providers", h.getAllProviders).Methods("GET", "OPTIONS")
 	router.HandleFunc("/agent-network/providers", h.createProvider).Methods("POST", "OPTIONS")
 	router.HandleFunc("/agent-network/providers/{providerId}", h.getProvider).Methods("GET", "OPTIONS")
@@ -41,6 +46,7 @@ func RegisterEndpoints(manager agentnetwork.Manager, router *mux.Router) {
 	h.addConsumptionEndpoints(router)
 	h.addAccessLogEndpoints(router)
 	h.addBudgetRuleEndpoints(router)
+	h.addAgentConfigEndpoints(router)
 }
 
 func (h *handler) getCatalogProviders(w http.ResponseWriter, r *http.Request) {
@@ -52,11 +58,137 @@ func (h *handler) getCatalogProviders(w http.ResponseWriter, r *http.Request) {
 	entries := catalog.All()
 	out := make([]api.AgentNetworkCatalogProvider, 0, len(entries))
 	for _, e := range entries {
-		out = append(out, e.ToAPIResponse())
+		resp := e.ToAPIResponse()
+		applyDefaultPricing(e, &resp)
+		out = append(out, resp)
 	}
 	util.WriteJSONObject(r.Context(), w, out)
 }
 
+// discoverProviderModels asks the vendor which models the operator's own
+// credential can reach, so the provider form can offer a live list rather than
+// only the static catalog.
+func (h *handler) discoverProviderModels(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	var body api.AgentNetworkModelDiscoveryRequest
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		util.WriteErrorResponse("invalid json", http.StatusBadRequest, w)
+		return
+	}
+	// Trimmed once and carried, not trimmed for the emptiness test and then
+	// discarded: a padded " openai_api " would clear the check here and miss
+	// the catalog lookup, reporting the provider as unknown.
+	catalogID := strings.TrimSpace(body.CatalogProviderId)
+	if catalogID == "" {
+		util.WriteErrorResponse("catalog_provider_id is required", http.StatusBadRequest, w)
+		return
+	}
+
+	recordID := strValue(body.ProviderId)
+	req := modeldiscovery.Request{
+		CatalogID:   catalogID,
+		UpstreamURL: strValue(body.UpstreamUrl),
+		APIKey:      strValue(body.ApiKey),
+	}
+	// One source of credential or the other, never a mix: taking a key from
+	// the request while addressing a saved record would let a caller run an
+	// arbitrary credential against a provider they can only read.
+	if recordID != "" && req.APIKey != "" {
+		util.WriteErrorResponse("provide either provider_id or api_key, not both", http.StatusBadRequest, w)
+		return
+	}
+
+	models, err := h.manager.DiscoverProviderModels(r.Context(), userAuth.AccountId, userAuth.UserId, req, recordID)
+	if err != nil {
+		// A provider with no listing endpoint is a fact about the catalog
+		// entry, not a failure: the caller falls back to the catalog's own
+		// models, so it must be able to tell the two apart.
+		if errors.Is(err, modeldiscovery.ErrNoDiscovery) {
+			util.WriteErrorResponse(err.Error(), http.StatusUnprocessableEntity, w)
+			return
+		}
+		// An unknown provider, an unusable upstream, a missing region or a
+		// missing key are all things the caller sent, reachable from a
+		// well-formed request. Reporting them as 500 tells the operator the
+		// server broke and buries genuine faults in the error rate.
+		if errors.Is(err, modeldiscovery.ErrInvalidRequest) {
+			util.WriteErrorResponse(err.Error(), http.StatusBadRequest, w)
+			return
+		}
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	out := api.AgentNetworkModelDiscoveryResponse{Models: make([]api.AgentNetworkDiscoveredModel, 0, len(models))}
+	for _, m := range models {
+		entry := api.AgentNetworkDiscoveredModel{
+			Id:           m.ID,
+			PricingKnown: m.PricingKnown,
+			// Sent even when zero: the form prefills every discovered model as
+			// an editable row, and an unpriced one is shown at zero and flagged
+			// rather than left out.
+			InputPer1k:  m.InputPer1k,
+			OutputPer1k: m.OutputPer1k,
+			// Cache rates stay absent when unset, matching the catalog
+			// response — a zero would read as "free", not "not applicable".
+			CachedInputPer1k:   positiveRatePtr(m.CachedInputPer1k),
+			CacheReadPer1k:     positiveRatePtr(m.CacheReadPer1k),
+			CacheCreationPer1k: positiveRatePtr(m.CacheCreationPer1k),
+		}
+		if m.Label != "" {
+			label := m.Label
+			entry.Label = &label
+		}
+		out.Models = append(out.Models, entry)
+	}
+	util.WriteJSONObject(r.Context(), w, out)
+}
+
+// strValue reads an optional string field, treating absent as empty.
+func strValue(v *string) string {
+	if v == nil {
+		return ""
+	}
+	return strings.TrimSpace(*v)
+}
+
+// applyDefaultPricing overwrites the catalog response's model rates with
+// the LIVE default pricing table, which may differ from the compiled-in
+// catalog rates when the operator provides a defaults_llm_pricing.yaml.
+// This keeps the dashboard's model-row prefill identical to what the
+// proxy will actually bill — the same table the synthesizer ships.
+func applyDefaultPricing(cp catalog.Provider, resp *api.AgentNetworkCatalogProvider) {
+	if len(cp.PricingSurfaces) == 0 {
+		return
+	}
+	for i := range resp.Models {
+		m := &resp.Models[i]
+		e, ok := pricing.LookupDefault(cp.PricingSurfaces, m.Id)
+		if !ok {
+			continue
+		}
+		m.InputPer1k = e.InputPer1k
+		m.OutputPer1k = e.OutputPer1k
+		m.CachedInputPer1k = positiveRatePtr(e.CachedInputPer1k)
+		m.CacheReadPer1k = positiveRatePtr(e.CacheReadPer1k)
+		m.CacheCreationPer1k = positiveRatePtr(e.CacheCreationPer1k)
+	}
+}
+
+// positiveRatePtr renders a cache rate for the API: absent (nil) when
+// unset, matching the catalog response convention.
+func positiveRatePtr(v float64) *float64 {
+	if v <= 0 {
+		return nil
+	}
+	return &v
+}
+
 func (h *handler) getAllProviders(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -119,12 +251,7 @@ func (h *handler) createProvider(w http.ResponseWriter, r *http.Request) {
 	provider := types.NewProvider(userAuth.AccountId)
 	provider.FromAPIRequest(&req)
 
-	bootstrapCluster := ""
-	if req.BootstrapCluster != nil {
-		bootstrapCluster = *req.BootstrapCluster
-	}
-
-	created, err := h.manager.CreateProvider(r.Context(), userAuth.UserId, provider, bootstrapCluster)
+	created, err := h.manager.CreateProvider(r.Context(), userAuth.UserId, provider)
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -213,5 +340,46 @@ func validate(req *api.AgentNetworkProviderRequest, requireAPIKey bool) error {
 	if requireAPIKey && (req.ApiKey == nil || strings.TrimSpace(*req.ApiKey) == "") {
 		return status.Errorf(status.InvalidArgument, "api_key is required")
 	}
+	// An update omits api_key to keep the stored credential. A key that is
+	// present but blank is not that: Provider.FromAPIRequest drops it exactly
+	// as if it were absent, so a rotation the operator believes they performed
+	// would answer 200 having changed nothing. Refuse it here, where the
+	// request still carries the difference between absent and blank.
+	if req.ApiKey != nil && strings.TrimSpace(*req.ApiKey) == "" {
+		return status.Errorf(status.InvalidArgument, "api_key must be omitted to keep the stored credential rather than sent blank")
+	}
+	if req.Models != nil {
+		for i, m := range *req.Models {
+			if err := validateModel(i, m); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// validateModel is the single ingress guard for operator-entered pricing:
+// these rates are synthesized into the proxy's cost_meter config verbatim,
+// and a negative or non-finite rate there would poison every cost the
+// proxy records, so reject at the API boundary.
+func validateModel(i int, m api.AgentNetworkProviderModel) error {
+	if strings.TrimSpace(m.Id) == "" {
+		return status.Errorf(status.InvalidArgument, "models[%d]: id is required", i)
+	}
+	rates := map[string]*float64{
+		"input_per_1k":          &m.InputPer1k,
+		"output_per_1k":         &m.OutputPer1k,
+		"cached_input_per_1k":   m.CachedInputPer1k,
+		"cache_read_per_1k":     m.CacheReadPer1k,
+		"cache_creation_per_1k": m.CacheCreationPer1k,
+	}
+	for field, v := range rates {
+		if v == nil {
+			continue
+		}
+		if *v < 0 || math.IsNaN(*v) || math.IsInf(*v, 0) {
+			return status.Errorf(status.InvalidArgument, "models[%d] (%s): %s must be a finite, non-negative USD rate", i, m.Id, field)
+		}
+	}
 	return nil
 }
diff --git a/management/internals/modules/agentnetwork/handlers/providers_handler_test.go b/management/internals/modules/agentnetwork/handlers/providers_handler_test.go
new file mode 100644
index 000000000..033de3b8a
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/providers_handler_test.go
@@ -0,0 +1,138 @@
+package handlers
+
+import (
+	"encoding/json"
+	"math"
+	nethttp "net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+func f(v float64) *float64 { return &v }
+
+// TestValidate_ModelRates guards the single ingress point for operator-entered
+// pricing. These rates flow verbatim into the proxy's cost_meter config at
+// synthesis time; the proxy treats a bad rate as a chain-build failure, so
+// rejecting here is what keeps an account's gateway from going down.
+func TestValidate_ModelRates(t *testing.T) {
+	base := func(models ...api.AgentNetworkProviderModel) *api.AgentNetworkProviderRequest {
+		key := "sk-test"
+		return &api.AgentNetworkProviderRequest{
+			ProviderId:  "openai_api",
+			Name:        "OpenAI",
+			UpstreamUrl: "https://api.openai.com",
+			ApiKey:      &key,
+			Models:      &models,
+		}
+	}
+
+	valid := api.AgentNetworkProviderModel{
+		Id: "gpt-4o", InputPer1k: 0.0025, OutputPer1k: 0.01,
+		CachedInputPer1k: f(0.00125),
+	}
+	require.NoError(t, validate(base(valid), true), "finite non-negative rates must pass")
+
+	zeroRates := api.AgentNetworkProviderModel{Id: "self-hosted-llama", InputPer1k: 0, OutputPer1k: 0}
+	require.NoError(t, validate(base(zeroRates), true), "explicit zero prices are allowed (free / self-hosted models)")
+
+	cases := map[string]api.AgentNetworkProviderModel{
+		"empty id":           {Id: "  ", InputPer1k: 0.001, OutputPer1k: 0.002},
+		"negative input":     {Id: "m", InputPer1k: -0.001, OutputPer1k: 0.002},
+		"negative output":    {Id: "m", InputPer1k: 0.001, OutputPer1k: -0.002},
+		"NaN input":          {Id: "m", InputPer1k: math.NaN(), OutputPer1k: 0.002},
+		"Inf output":         {Id: "m", InputPer1k: 0.001, OutputPer1k: math.Inf(1)},
+		"negative cached":    {Id: "m", InputPer1k: 0.001, OutputPer1k: 0.002, CachedInputPer1k: f(-1)},
+		"NaN cache read":     {Id: "m", InputPer1k: 0.001, OutputPer1k: 0.002, CacheReadPer1k: f(math.NaN())},
+		"Inf cache creation": {Id: "m", InputPer1k: 0.001, OutputPer1k: 0.002, CacheCreationPer1k: f(math.Inf(-1))},
+	}
+	for name, m := range cases {
+		assert.Error(t, validate(base(m), true), "case %q must be rejected", name)
+	}
+}
+
+// TestValidate_ABlankApiKeyIsNotTheSameAsAnOmittedOne covers the one shape the
+// manager's own guard cannot see. Provider.FromAPIRequest assigns the key only
+// when it trims to something, so a request carrying "   " arrives at
+// UpdateProvider indistinguishable from one that omitted it — the stored
+// credential is kept and the write answers 200, telling an operator who thinks
+// they just rotated a key that it worked.
+//
+// The request still knows the difference, so the refusal belongs here.
+func TestValidate_ABlankApiKeyIsNotTheSameAsAnOmittedOne(t *testing.T) {
+	req := func(key *string) *api.AgentNetworkProviderRequest {
+		return &api.AgentNetworkProviderRequest{
+			ProviderId:  "openai_api",
+			Name:        "OpenAI",
+			UpstreamUrl: "https://api.openai.com",
+			ApiKey:      key,
+		}
+	}
+
+	blank := "   "
+	err := validate(req(&blank), false)
+	require.Error(t, err, "a blank api_key on update must not be read as 'keep what is stored'")
+	assert.Contains(t, err.Error(), "api_key")
+
+	require.NoError(t, validate(req(nil), false), "an omitted api_key is how an update keeps the stored credential")
+
+	// Create already refuses this, and keeps its own message: a caller who sent
+	// no usable key is told the field is required rather than being told how to
+	// preserve a credential that does not exist yet.
+	err = validate(req(&blank), true)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "api_key is required")
+}
+
+// TestProviderHandler_UpdateReplacesFullState pins the update contract shared
+// with the other PUT endpoints: the request replaces the provider's mutable
+// state, so optional fields absent from the JSON land as their zero values.
+// The two exceptions are server-side: the api_key (a secret — omitted means
+// "not rotated") and the session keypair, both preserved by the manager. The
+// identity headers stay on the wire as explicit empty strings so a cleared
+// value round-trips.
+func TestProviderHandler_UpdateReplacesFullState(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	// A private upstream: the save-time credential check leaves it unchecked
+	// rather than spending "sk-test" against the real api.openai.com, which
+	// the vendor refuses.
+	create := `{
+        "provider_id": "openai_api",
+        "name": "openai",
+        "upstream_url": "https://10.255.255.1",
+        "api_key": "sk-test",
+        "enabled": true,
+        "metadata_disabled": true,
+        "skip_tls_verification": true,
+        "extra_values": {"x-portkey-config": "pc-prod-3f2a"},
+        "identity_header_user_id": "x-bf-dim-netbird_user_id",
+        "models": [{"id": "gpt-4o", "input_per_1k": 0.0025, "output_per_1k": 0.01}]
+    }`
+	rec := f.do(t, nethttp.MethodPost, "/agent-network/providers", create)
+	require.Equal(t, nethttp.StatusOK, rec.Code, "create must succeed: %s", rec.Body.String())
+
+	var created api.AgentNetworkProvider
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &created))
+
+	// Minimal update: only the required fields, no api_key. Everything
+	// optional must land as its zero value.
+	update := `{"provider_id": "openai_api", "name": "openai-renamed", "upstream_url": "https://10.255.255.1", "enabled": true}`
+	rec = f.do(t, nethttp.MethodPut, "/agent-network/providers/"+created.Id, update)
+	require.Equal(t, nethttp.StatusOK, rec.Code, "update without api_key must succeed (key is preserved): %s", rec.Body.String())
+
+	var updated api.AgentNetworkProvider
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &updated))
+	assert.Equal(t, "openai-renamed", updated.Name, "sent field must apply")
+	assert.True(t, updated.Enabled, "sent field must apply")
+	assert.False(t, updated.MetadataDisabled, "omitted metadata_disabled must land as false — PUT replaces the full state")
+	assert.False(t, updated.SkipTlsVerification, "omitted skip_tls_verification must land as false")
+	assert.Nil(t, updated.ExtraValues, "omitted extra_values must be cleared")
+	assert.Equal(t, "", updated.IdentityHeaderUserId, "omitted identity header must be cleared yet stay on the wire")
+	assert.Empty(t, updated.Models, "omitted models must be cleared")
+	assert.Contains(t, rec.Body.String(), `"identity_header_user_id":""`,
+		"cleared identity header must round-trip as an explicit empty string")
+}
diff --git a/management/internals/modules/agentnetwork/handlers/settings_handler.go b/management/internals/modules/agentnetwork/handlers/settings_handler.go
index c65efad0f..0a365f9ce 100644
--- a/management/internals/modules/agentnetwork/handlers/settings_handler.go
+++ b/management/internals/modules/agentnetwork/handlers/settings_handler.go
@@ -2,7 +2,6 @@ package handlers
 
 import (
 	"encoding/json"
-	"errors"
 	"net/http"
 
 	"github.com/gorilla/mux"
@@ -11,19 +10,62 @@ import (
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/http/util"
-	"github.com/netbirdio/netbird/shared/management/status"
 )
 
-// addSettingsEndpoints registers the Agent Network settings routes. The
-// settings row is bootstrapped server-side on first provider create; GET reads
-// it and PUT updates the mutable collection toggles (cluster/subdomain stay
-// immutable).
+// addSettingsEndpoints registers the Agent Network settings routes. POST
+// bootstraps the settings row, assigning the account's immutable endpoint;
+// GET reads it (defaults with an empty endpoint before bootstrap); PUT
+// carries every field, replacing the mutable collection toggles and rejecting
+// any change to the identity fields; DELETE removes the row — guarded so it
+// stays a bootstrap-repair operation — releasing the endpoint for a fresh
+// bootstrap.
 func (h *handler) addSettingsEndpoints(router *mux.Router) {
 	router.HandleFunc("/agent-network/settings", h.getSettings).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/settings", h.createSettings).Methods("POST", "OPTIONS")
 	router.HandleFunc("/agent-network/settings", h.updateSettings).Methods("PUT", "OPTIONS")
+	router.HandleFunc("/agent-network/settings", h.deleteSettings).Methods("DELETE", "OPTIONS")
 }
 
-// updateSettings applies the collection toggles to the account's settings row.
+// createSettings bootstraps the account's settings row. Exactly one of
+// proxy_address (labeled endpoint; the server allocates the label) and
+// endpoint (self-addressed, claimed verbatim) must be provided; optional
+// collection toggles ride along with defaults for omitted fields.
+func (h *handler) createSettings(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	var req api.AgentNetworkSettingsCreateRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	settings := types.DefaultSettings(userAuth.AccountId)
+	settings.FromAPICreateRequest(&req)
+
+	proxyAddress := ""
+	if req.ProxyAddress != nil {
+		proxyAddress = *req.ProxyAddress
+	}
+	endpoint := ""
+	if req.Endpoint != nil {
+		endpoint = *req.Endpoint
+	}
+
+	created, err := h.manager.CreateSettings(r.Context(), userAuth.UserId, settings, proxyAddress, endpoint)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
+}
+
+// updateSettings replaces the mutable settings fields on the account's row.
+// A request carrying a cluster bootstraps the row when the account doesn't
+// have one yet.
 func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -48,11 +90,27 @@ func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
 }
 
-// getSettings returns the account's agent-network settings. The settings
-// row is bootstrapped on first provider create, so freshly-onboarded
-// accounts have nothing to read. Rather than 404-ing in that case (which
-// the dashboard would have to special-case), return a JSON null with 200
-// so consumers can branch on the body alone.
+// deleteSettings removes the account's settings row, releasing the endpoint.
+// The manager refuses (412) while providers exist or a proxy is actively
+// serving the endpoint; a later POST bootstraps fresh, allocating a new
+// endpoint.
+func (h *handler) deleteSettings(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	if err := h.manager.DeleteSettings(r.Context(), userAuth.AccountId, userAuth.UserId); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
+}
+
+// getSettings returns the account's agent-network settings. Accounts that
+// haven't been bootstrapped yet read as the defaults with an empty cluster,
+// subdomain and endpoint; the manager synthesises that view.
 func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -62,11 +120,6 @@ func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 
 	settings, err := h.manager.GetSettings(r.Context(), userAuth.AccountId, userAuth.UserId)
 	if err != nil {
-		var sErr *status.Error
-		if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
-			util.WriteJSONObject(r.Context(), w, nil)
-			return
-		}
 		util.WriteError(r.Context(), err, w)
 		return
 	}
diff --git a/management/internals/modules/agentnetwork/handlers/settings_handler_test.go b/management/internals/modules/agentnetwork/handlers/settings_handler_test.go
new file mode 100644
index 000000000..400208e1c
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/settings_handler_test.go
@@ -0,0 +1,395 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestSettingsHandler_GetUnbootstrappedReturnsDefaults pins the settings-read
+// convention shared with the account and DNS settings endpoints: settings
+// always read as a JSON object. Before bootstrap that object carries the
+// defaults with an empty endpoint/proxy_address (the "not bootstrapped"
+// signal) and no timestamps — never a 404 and never the legacy null body.
+func TestSettingsHandler_GetUnbootstrappedReturnsDefaults(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code,
+		"unbootstrapped account must read as 200 with defaults: got %d body=%s", rec.Code, rec.Body.String())
+	require.NotEqual(t, "null", trimSpace(rec.Body.String()),
+		"the legacy 200+null shape must not come back")
+
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Empty(t, got.Endpoint, "endpoint must be empty until bootstrapped")
+	assert.Empty(t, got.ProxyAddress, "proxy address must be empty until bootstrapped")
+	assert.False(t, got.Dedicated, "an unbootstrapped account has no serving shape")
+	assert.True(t, got.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
+	assert.False(t, got.EnablePromptCollection, "defaults must show prompt collection off")
+	assert.False(t, got.RedactPii, "defaults must show redaction off")
+	require.NotNil(t, got.AccessLogRetentionDays)
+	assert.Equal(t, 30, *got.AccessLogRetentionDays, "defaults must show the bootstrap retention")
+	assert.Nil(t, got.CreatedAt, "no timestamps before a row exists")
+	assert.Nil(t, got.UpdatedAt, "no timestamps before a row exists")
+}
+
+// TestSettingsHandler_PostBootstrapsLabeled covers the labeled bootstrap
+// shape: a POST carrying a proxy_address allocates a label beneath it, so the
+// endpoint hangs one label under the shared cluster's address and the pin is
+// not dedicated. Toggles riding along apply; omitted ones keep defaults.
+func TestSettingsHandler_PostBootstrapsLabeled(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPost, "/agent-network/settings",
+		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true, "access_log_retention_days": 14}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Equal(t, "eu.proxy.netbird.io", got.ProxyAddress, "proxy address must be pinned from the request")
+	require.NotEmpty(t, got.Endpoint, "endpoint must be allocated at bootstrap")
+	assert.True(t, strings.HasSuffix(got.Endpoint, ".eu.proxy.netbird.io"),
+		"labeled endpoint must hang off the proxy address: %s", got.Endpoint)
+	label := strings.TrimSuffix(got.Endpoint, ".eu.proxy.netbird.io")
+	assert.NotContains(t, label, ".", "the allocated label must be a single DNS label: %s", label)
+	assert.False(t, got.Dedicated, "a labeled pin is not dedicated")
+	assert.True(t, got.EnableLogCollection, "omitted toggle must keep its default")
+	assert.True(t, got.EnablePromptCollection, "toggle from the bootstrap request must apply")
+	require.NotNil(t, got.AccessLogRetentionDays)
+	assert.Equal(t, 14, *got.AccessLogRetentionDays, "retention from the bootstrap request must apply")
+	assert.NotNil(t, got.CreatedAt, "a persisted row carries timestamps")
+
+	// The row is now readable via GET.
+	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code, "GET after bootstrap must succeed")
+	var read api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &read))
+	assert.Equal(t, got.Endpoint, read.Endpoint, "GET must return the bootstrapped endpoint")
+}
+
+// TestSettingsHandler_PostBootstrapsSelfAddressed covers the dedicated shape:
+// a POST carrying an endpoint claims the hostname verbatim, the proxy address
+// equals it, and the pin reads as dedicated. The claim is legitimate before
+// any proxy declares the address (address-first).
+func TestSettingsHandler_PostBootstrapsSelfAddressed(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPost, "/agent-network/settings",
+		`{"endpoint": "Brave-Otter.Gateway.Example.com"}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Equal(t, "brave-otter.gateway.example.com", got.Endpoint,
+		"endpoint must be claimed verbatim, lowercased")
+	assert.Equal(t, got.Endpoint, got.ProxyAddress, "self-addressed: the proxy address is the endpoint")
+	assert.True(t, got.Dedicated, "a self-addressed pin is dedicated")
+	assert.True(t, got.EnableLogCollection, "omitted toggles must keep their defaults")
+}
+
+// TestSettingsHandler_PostRequiresExactlyOneIdentityField pins the request
+// contract: proxy_address and endpoint are mutually exclusive and one is
+// required — both or neither is a validation error, not a guess.
+func TestSettingsHandler_PostRequiresExactlyOneIdentityField(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPost, "/agent-network/settings", `{}`)
+	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
+		"empty POST must be rejected: got %d body=%s", rec.Code, rec.Body.String())
+
+	rec = f.do(t, http.MethodPost, "/agent-network/settings",
+		`{"proxy_address": "eu.proxy.netbird.io", "endpoint": "brave-otter.gateway.example.com"}`)
+	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
+		"POST with both identity fields must be rejected: got %d body=%s", rec.Code, rec.Body.String())
+}
+
+// TestSettingsHandler_PostRejectsMalformedHostnames pins per-write input
+// validation: shapes canonicalization cannot repair — trailing dots, embedded
+// whitespace, empty labels — are rejected with a validation error instead of
+// landing in an immutable column.
+func TestSettingsHandler_PostRejectsMalformedHostnames(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	for name, body := range map[string]string{
+		"trailing dot":     `{"endpoint": "gateway.example.com."}`,
+		"leading dot":      `{"endpoint": ".gateway.example.com"}`,
+		"inner whitespace": `{"endpoint": "gate way.example.com"}`,
+		"empty label":      `{"proxy_address": "eu..proxy.netbird.io"}`,
+	} {
+		rec := f.do(t, http.MethodPost, "/agent-network/settings", body)
+		assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
+			"%s must be rejected: got %d body=%s", name, rec.Code, rec.Body.String())
+	}
+}
+
+// TestSettingsHandler_PostConflictsOnSecondBootstrap pins that bootstrap is a
+// one-time create: a second POST returns 409 and leaves the row untouched.
+func TestSettingsHandler_PostConflictsOnSecondBootstrap(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPost, "/agent-network/settings", `{"proxy_address": "eu.proxy.netbird.io"}`)
+	require.Equal(t, http.StatusOK, rec.Code, "first bootstrap must succeed: %s", rec.Body.String())
+	var first api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &first))
+
+	rec = f.do(t, http.MethodPost, "/agent-network/settings", `{"proxy_address": "us.proxy.netbird.io"}`)
+	assert.Equal(t, http.StatusConflict, rec.Code,
+		"second bootstrap must 409: got %d body=%s", rec.Code, rec.Body.String())
+
+	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code)
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Equal(t, first.Endpoint, got.Endpoint, "the original endpoint must survive the rejected bootstrap")
+	assert.Equal(t, first.ProxyAddress, got.ProxyAddress, "the original proxy address must survive")
+}
+
+// TestSettingsHandler_PutBeforeBootstrapIs404 pins that a PUT cannot conjure a
+// settings row out of nothing — bootstrap is the explicit POST — and the
+// error points the caller there.
+func TestSettingsHandler_PutBeforeBootstrapIs404(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false}`)
+	assert.Equal(t, http.StatusNotFound, rec.Code,
+		"PUT on an unbootstrapped account must 404: got %d body=%s", rec.Code, rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "/api/agent-network/settings",
+		"the error must point the caller at the bootstrap POST: %s", rec.Body.String())
+}
+
+// TestSettingsHandler_PutReplacesMutableFields pins the update contract shared
+// with the other PUT endpoints: the request carries every field, replacing the
+// mutable ones. The identity fields ride along as a required echo of the
+// assigned values — compared, never written — so the endpoint and proxy
+// address survive every accepted update.
+func TestSettingsHandler_PutReplacesMutableFields(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPost, "/agent-network/settings",
+		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true, "redact_pii": true, "access_log_retention_days": 14}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+
+	var before api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
+
+	rec = f.do(t, http.MethodPut, "/agent-network/settings", fmt.Sprintf(
+		`{"endpoint": %q, "proxy_address": %q, "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false, "access_log_retention_days": 7}`,
+		before.Endpoint, before.ProxyAddress))
+	require.Equal(t, http.StatusOK, rec.Code, "update PUT must succeed: %s", rec.Body.String())
+
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.True(t, got.EnableLogCollection, "sent toggle must apply")
+	assert.False(t, got.EnablePromptCollection, "sent toggle must apply")
+	assert.False(t, got.RedactPii, "sent toggle must apply")
+	require.NotNil(t, got.AccessLogRetentionDays)
+	assert.Equal(t, 7, *got.AccessLogRetentionDays, "sent retention must apply")
+	assert.Equal(t, before.Endpoint, got.Endpoint, "endpoint must survive updates untouched")
+	assert.Equal(t, before.ProxyAddress, got.ProxyAddress, "proxy address must survive updates untouched")
+}
+
+// TestSettingsHandler_PutRejectsChangedIdentity pins the immutability contract:
+// the PUT carries the identity fields like every other field, but they are an
+// echo — a request carrying a different endpoint or proxy address is rejected
+// as a validation error and the row is left untouched. The comparison is
+// lenient about casing (the stored values are normalized lowercase), so a
+// client replaying a GET response with different casing is not rejected.
+func TestSettingsHandler_PutRejectsChangedIdentity(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPost, "/agent-network/settings",
+		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+	var before api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
+
+	for name, body := range map[string]string{
+		"changed endpoint": fmt.Sprintf(
+			`{"endpoint": "other.gateway.example.com", "proxy_address": %q, "enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false, "access_log_retention_days": 30}`,
+			before.ProxyAddress),
+		"changed proxy_address": fmt.Sprintf(
+			`{"endpoint": %q, "proxy_address": "us.proxy.netbird.io", "enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false, "access_log_retention_days": 30}`,
+			before.Endpoint),
+		"omitted identity": `{"enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false, "access_log_retention_days": 30}`,
+	} {
+		rec = f.do(t, http.MethodPut, "/agent-network/settings", body)
+		assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
+			"%s must be rejected: got %d body=%s", name, rec.Code, rec.Body.String())
+	}
+
+	// The rejected updates must not have applied anything — toggles included.
+	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code)
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Equal(t, before.Endpoint, got.Endpoint, "rejected PUT must not change the endpoint")
+	assert.Equal(t, before.ProxyAddress, got.ProxyAddress, "rejected PUT must not change the proxy address")
+	assert.True(t, got.EnablePromptCollection, "rejected PUT must not apply its toggles")
+
+	// An uppercased echo of the assigned values still names the same host and
+	// must be accepted.
+	rec = f.do(t, http.MethodPut, "/agent-network/settings", fmt.Sprintf(
+		`{"endpoint": %q, "proxy_address": %q, "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": false, "access_log_retention_days": 30}`,
+		strings.ToUpper(before.Endpoint), strings.ToUpper(before.ProxyAddress)))
+	assert.Equal(t, http.StatusOK, rec.Code,
+		"an uppercased identity echo must be accepted: got %d body=%s", rec.Code, rec.Body.String())
+}
+
+// TestSettingsHandler_PutOmittedRetentionLandsAsZero documents a residual the
+// required-ness of access_log_retention_days does not remove. Marking the field
+// required changes the generated client type from *int to int, so a generated
+// client cannot omit it — but nothing validates OpenAPI required-ness at
+// runtime, so a hand-rolled body without the field still decodes as 0, which
+// the API documents as "keep indefinitely".
+//
+// That is the same latitude the three booleans already have, so it is left
+// consistent rather than special-cased. This test exists to make the gap
+// explicit: if request validation is ever added, this expectation is what
+// changes.
+func TestSettingsHandler_PutOmittedRetentionLandsAsZero(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPost, "/agent-network/settings",
+		`{"proxy_address": "eu.proxy.netbird.io", "access_log_retention_days": 14}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+	var before api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
+
+	rec = f.do(t, http.MethodPut, "/agent-network/settings", fmt.Sprintf(
+		`{"endpoint": %q, "proxy_address": %q, "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`,
+		before.Endpoint, before.ProxyAddress))
+	require.Equal(t, http.StatusOK, rec.Code, "update PUT must succeed: %s", rec.Body.String())
+
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	require.NotNil(t, got.AccessLogRetentionDays)
+	assert.Equal(t, 0, *got.AccessLogRetentionDays,
+		"a non-conforming body that omits retention still replaces it with the zero value")
+}
+
+// TestSettingsHandler_DeleteBeforeBootstrapIs404 pins that DELETE on an
+// account with no settings row is a 404, mirroring the PUT.
+func TestSettingsHandler_DeleteBeforeBootstrapIs404(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodDelete, "/agent-network/settings", "")
+	assert.Equal(t, http.StatusNotFound, rec.Code,
+		"DELETE on an unbootstrapped account must 404: got %d body=%s", rec.Code, rec.Body.String())
+}
+
+// TestSettingsHandler_DeleteBlockedByProviders pins the first delete guard:
+// while any provider exists for the account, the delete is refused with 412
+// and the row survives. Providers route through the endpoint — the guard
+// keeps DELETE a bootstrap-repair operation rather than a way to abandon a
+// configured gateway.
+func TestSettingsHandler_DeleteBlockedByProviders(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPost, "/agent-network/settings", `{"proxy_address": "eu.proxy.netbird.io"}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+	var before api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
+
+	f.seedProvider(t, "prov-guard")
+
+	rec = f.do(t, http.MethodDelete, "/agent-network/settings", "")
+	assert.Equal(t, http.StatusPreconditionFailed, rec.Code,
+		"delete with a provider present must be refused: got %d body=%s", rec.Code, rec.Body.String())
+
+	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code)
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Equal(t, before.Endpoint, got.Endpoint, "the refused delete must leave the row intact")
+}
+
+// TestSettingsHandler_DeleteBlockedByActiveProxy pins the second delete
+// guard: while a proxy is actively serving the endpoint — an active proxy
+// row declaring the endpoint hostname as its cluster address, the dedicated
+// shape — the delete is refused with 412. A proxy that has disconnected no
+// longer blocks: the guard is about a live serving path, not history.
+//
+// The proxy declares its address with mixed casing on purpose: Connect
+// stores the declared address verbatim while the settings row is normalized
+// lowercase, and hostnames are case-insensitive, so the guard must match
+// across the casing difference rather than be sidestepped by it.
+func TestSettingsHandler_DeleteBlockedByActiveProxy(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	const endpoint = "gw.dedicated.example.com"
+	rec := f.do(t, http.MethodPost, "/agent-network/settings", fmt.Sprintf(`{"endpoint": %q}`, endpoint))
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+
+	now := time.Now()
+	accountID := testAccountID
+	proxyRow := &rpproxy.Proxy{
+		ID:             "proxy-guard",
+		SessionID:      "sess-1",
+		ClusterAddress: "GW.Dedicated.Example.Com",
+		AccountID:      &accountID,
+		LastSeen:       now,
+		ConnectedAt:    &now,
+		Status:         rpproxy.StatusConnected,
+	}
+	require.NoError(t, f.store.SaveProxy(context.Background(), proxyRow))
+
+	rec = f.do(t, http.MethodDelete, "/agent-network/settings", "")
+	assert.Equal(t, http.StatusPreconditionFailed, rec.Code,
+		"delete with an active proxy at the endpoint must be refused: got %d body=%s", rec.Code, rec.Body.String())
+
+	// Once the proxy disconnects it no longer serves the endpoint, so the
+	// delete goes through.
+	require.NoError(t, f.store.DisconnectProxy(context.Background(), proxyRow.ID, proxyRow.SessionID))
+	rec = f.do(t, http.MethodDelete, "/agent-network/settings", "")
+	assert.Equal(t, http.StatusOK, rec.Code,
+		"delete after the proxy disconnected must succeed: got %d body=%s", rec.Code, rec.Body.String())
+}
+
+// TestSettingsHandler_DeleteReleasesEndpointForFreshBootstrap pins the
+// full-reset semantic that gives replace-on-change clients (e.g. Terraform's
+// RequiresReplace) a real path: with both guards clear the delete succeeds,
+// the account reads as the defaults again, and a fresh bootstrap draws a
+// fresh label. The released hostname is not reserved — a fresh draw may even
+// legitimately re-pick it — so the assertions check the new row's shape, not
+// that the label differs.
+func TestSettingsHandler_DeleteReleasesEndpointForFreshBootstrap(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPost, "/agent-network/settings",
+		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+
+	rec = f.do(t, http.MethodDelete, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code,
+		"delete with both guards clear must succeed: got %d body=%s", rec.Code, rec.Body.String())
+
+	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code)
+	var after api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &after))
+	assert.Empty(t, after.Endpoint, "a deleted account must read as unbootstrapped defaults")
+	assert.False(t, after.EnablePromptCollection, "the deleted row's toggles must not linger")
+
+	rec = f.do(t, http.MethodPost, "/agent-network/settings", `{"proxy_address": "eu.proxy.netbird.io"}`)
+	require.Equal(t, http.StatusOK, rec.Code, "re-bootstrap after delete must succeed: %s", rec.Body.String())
+	var second api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &second))
+	require.NotEmpty(t, second.Endpoint, "the fresh bootstrap must allocate an endpoint")
+	assert.True(t, strings.HasSuffix(second.Endpoint, ".eu.proxy.netbird.io"),
+		"the fresh endpoint must hang beneath the requested proxy address: %s", second.Endpoint)
+	assert.False(t, second.EnablePromptCollection,
+		"the fresh row must carry bootstrap defaults, not the deleted row's toggles")
+	assert.NotNil(t, second.CreatedAt, "the fresh row is persisted and carries timestamps")
+}
diff --git a/management/internals/modules/agentnetwork/labelgen/adjectives.go b/management/internals/modules/agentnetwork/labelgen/adjectives.go
new file mode 100644
index 000000000..5058c2f1c
--- /dev/null
+++ b/management/internals/modules/agentnetwork/labelgen/adjectives.go
@@ -0,0 +1,37 @@
+package labelgen
+
+// adjectives is the descriptor half of a generated label. It pairs with the
+// noun pool in words.go to form `<adjective>-<noun>` labels, and is kept
+// separate because words.go is almost entirely nouns — drawing both halves
+// from it produced unreadable pairs like "millet-hammock". Entries are
+// lowercase ASCII, 4-12 chars, free of hyphens and digits, screened for
+// offensive/brand/region-specific terms, and disjoint from the noun pool
+// (enforced by TestAdjectives_AreDisjointFromNouns).
+var adjectives = []string{
+	"able", "active", "adept", "agile", "airy", "alert", "amiable", "ample",
+	"ancient", "ardent", "artful", "astute", "balmy", "blithe", "bold", "bonny",
+	"brave", "breezy", "brisk", "bubbly", "buoyant", "bushy", "candid", "canny",
+	"cheery", "chilly", "chipper", "chunky", "civil", "classic", "clever", "comely",
+	"compact", "cordial", "cosmic", "courtly", "crafty", "creamy", "crisp", "cuddly",
+	"curious", "dainty", "dapper", "daring", "dashing", "deft", "dewy", "diligent",
+	"downy", "dreamy", "dulcet", "durable", "dusky", "eager", "earnest", "earthy",
+	"easy", "elated", "elegant", "epic", "fabled", "faithful", "fancy", "fearless",
+	"feisty", "fervent", "fleet", "fluffy", "fond", "frisky", "frosty", "gallant",
+	"genial", "genteel", "gentle", "giddy", "gilded", "glad", "glassy", "gleaming",
+	"glossy", "graceful", "grand", "grainy", "hale", "hardy", "hearty", "hefty",
+	"honest", "hopeful", "humble", "hushed", "immense", "jaunty", "jolly", "jovial",
+	"joyful", "jubilant", "keen", "kindly", "kindred", "lanky", "leafy", "limber",
+	"lively", "lofty", "loyal", "lucent", "lucid", "luminous", "lush", "maroon",
+	"mellow", "merry", "mighty", "mindful", "mirthful", "misty", "modest", "muted",
+	"nifty", "nimble", "noble", "patient", "peaceful", "pearly", "peppy", "perky",
+	"petite", "placid", "playful", "pleasant", "plucky", "plush", "polite", "posh",
+	"prancing", "pristine", "prompt", "proud", "prudent", "quaint", "quick", "quirky",
+	"radiant", "ready", "regal", "restful", "robust", "rosy", "ruddy", "rugged",
+	"sandy", "satin", "saucy", "savvy", "sedate", "serene", "shady", "shiny",
+	"silken", "silky", "sincere", "sleek", "slender", "smart", "smooth", "snappy",
+	"snug", "soaring", "sparkly", "spiffy", "spirited", "sprightly", "spry", "stalwart",
+	"stately", "steady", "sterling", "stoic", "stormy", "stout", "sturdy", "sunlit",
+	"supple", "svelte", "tawny", "tender", "tidy", "timeless", "trusty", "upbeat",
+	"urbane", "valiant", "vast", "vernal", "vibrant", "vintage", "whimsy", "willing",
+	"windy", "winsome", "wintry", "witty", "worthy", "zesty", "zippy",
+}
diff --git a/management/internals/modules/agentnetwork/labelgen/labelgen.go b/management/internals/modules/agentnetwork/labelgen/labelgen.go
index b45ff4ea8..bd5b0129d 100644
--- a/management/internals/modules/agentnetwork/labelgen/labelgen.go
+++ b/management/internals/modules/agentnetwork/labelgen/labelgen.go
@@ -3,9 +3,10 @@ package labelgen
 
 import (
 	"fmt"
-	"math/rand"
 	"sort"
 	"sync"
+
+	"github.com/netbirdio/netbird/management/server/util"
 )
 
 // pickAttempts caps the random retries before falling back to the
@@ -40,16 +41,15 @@ func uniqueWords() []string {
 // PickUnique selects a label not already in `taken`. It tries up to
 // pickAttempts random picks; on exhaustion it scans the deduplicated
 // wordlist for any remaining free entry, and if none is left appends
-// `-<fallbackSuffix>` to a deterministic word and returns. The caller
-// is responsible for seeding rng (math/rand).
-func PickUnique(rng *rand.Rand, taken map[string]struct{}, fallbackSuffix string) string {
+// `-<fallbackSuffix>` to a random word and returns.
+func PickUnique(taken map[string]struct{}, fallbackSuffix string) string {
 	pool := uniqueWords()
 	if len(pool) == 0 {
 		return fallbackSuffix
 	}
 
 	for i := 0; i < pickAttempts; i++ {
-		w := pool[rng.Intn(len(pool))]
+		w := pool[util.RandIntn(len(pool))]
 		if _, ok := taken[w]; !ok {
 			return w
 		}
@@ -61,6 +61,23 @@ func PickUnique(rng *rand.Rand, taken map[string]struct{}, fallbackSuffix string
 		}
 	}
 
-	w := pool[rng.Intn(len(pool))]
+	w := pool[util.RandIntn(len(pool))]
 	return fmt.Sprintf("%s-%s", w, fallbackSuffix)
 }
+
+// PickTuple returns an adjective-noun label such as "brave-otter". It is still
+// a single DNS label.
+//
+// Unlike PickUnique it takes no `taken` set and has no fallback suffix. The
+// noun pool holds 857 entries, which is ample per cluster but a hard ceiling
+// once labels must be unique across one shared zone; pairing an adjective with
+// a noun spans len(adjectives) * 857 instead. Uniqueness is enforced by a
+// database constraint and retried by the caller, rather than guessed from a
+// pre-read set that a concurrent allocation can invalidate.
+func PickTuple() string {
+	nouns := uniqueWords()
+	if len(nouns) == 0 || len(adjectives) == 0 {
+		return ""
+	}
+	return adjectives[util.RandIntn(len(adjectives))] + "-" + nouns[util.RandIntn(len(nouns))]
+}
diff --git a/management/internals/modules/agentnetwork/labelgen/labelgen_test.go b/management/internals/modules/agentnetwork/labelgen/labelgen_test.go
index f03a3501d..dda0f09ba 100644
--- a/management/internals/modules/agentnetwork/labelgen/labelgen_test.go
+++ b/management/internals/modules/agentnetwork/labelgen/labelgen_test.go
@@ -1,7 +1,7 @@
 package labelgen
 
 import (
-	"math/rand"
+	"slices"
 	"strings"
 	"testing"
 
@@ -9,19 +9,12 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// TestPickUnique_DeterministicWithSeededRng locks the property the
-// caller relies on: same seed + same taken set → same pick. Without
-// that, the bootstrap flow can't reproduce a label across retries.
-func TestPickUnique_DeterministicWithSeededRng(t *testing.T) {
-	taken := map[string]struct{}{}
+// TestPickUnique_ReturnsWordFromPool confirms a pick against an empty
+// taken set is always drawn verbatim from the wordlist.
+func TestPickUnique_ReturnsWordFromPool(t *testing.T) {
+	got := PickUnique(map[string]struct{}{}, "abcd")
 
-	rngA := rand.New(rand.NewSource(42))
-	rngB := rand.New(rand.NewSource(42))
-
-	a := PickUnique(rngA, taken, "abcd")
-	b := PickUnique(rngB, taken, "abcd")
-
-	assert.Equal(t, a, b, "Same seed and taken set must produce identical pick")
+	assert.True(t, slices.Contains(uniqueWords(), got), "Pick %q must be drawn from the wordlist", got)
 }
 
 // TestPickUnique_AvoidsTakenWordsWhenMostAreReserved seeds taken with
@@ -46,8 +39,7 @@ func TestPickUnique_AvoidsTakenWordsWhenMostAreReserved(t *testing.T) {
 		taken[w] = struct{}{}
 	}
 
-	rng := rand.New(rand.NewSource(7))
-	got := PickUnique(rng, taken, "abcd")
+	got := PickUnique(taken, "abcd")
 
 	_, isFree := free[got]
 	assert.True(t, isFree, "PickUnique must return one of the free words; got %q", got)
@@ -65,8 +57,7 @@ func TestPickUnique_FallsBackWhenAllReserved(t *testing.T) {
 		taken[w] = struct{}{}
 	}
 
-	rng := rand.New(rand.NewSource(99))
-	got := PickUnique(rng, taken, "abcd")
+	got := PickUnique(taken, "abcd")
 
 	assert.True(t, strings.HasSuffix(got, "-abcd"), "Exhausted pool must produce <word>-<suffix>; got %q", got)
 
@@ -99,3 +90,72 @@ func TestUniqueWords_DropsDuplicates(t *testing.T) {
 	}
 	assert.GreaterOrEqual(t, len(pool), 500, "Pool must contain at least 500 unique words")
 }
+
+// TestPickTuple_ShapeAndPoolMembership locks the wire-visible shape: an
+// adjective and a noun, each from its own pool, joined by a single hyphen so
+// the result stays one DNS label.
+func TestPickTuple_ShapeAndPoolMembership(t *testing.T) {
+	nouns := uniqueWords()
+	inNouns := make(map[string]struct{}, len(nouns))
+	for _, w := range nouns {
+		inNouns[w] = struct{}{}
+	}
+	inAdjectives := make(map[string]struct{}, len(adjectives))
+	for _, a := range adjectives {
+		inAdjectives[a] = struct{}{}
+	}
+
+	for i := 0; i < 200; i++ {
+		got := PickTuple()
+
+		parts := strings.Split(got, "-")
+		require.Len(t, parts, 2, "PickTuple must produce exactly two hyphen-joined words; got %q", got)
+
+		_, adjOK := inAdjectives[parts[0]]
+		assert.True(t, adjOK, "First half must be an adjective; %q not in adjectives (from %q)", parts[0], got)
+		_, nounOK := inNouns[parts[1]]
+		assert.True(t, nounOK, "Second half must be a noun; %q not in words (from %q)", parts[1], got)
+
+		assert.LessOrEqual(t, len(got), 63, "Label must fit a DNS label; got %q (%d chars)", got, len(got))
+	}
+}
+
+// TestAdjectives_AreDisjointFromNouns keeps the namespace a clean product and
+// prevents nonsense like "azure-azure": a handful of the noun pool's entries
+// are adjectival, and any overlap would let the same word land on both sides.
+func TestAdjectives_AreDisjointFromNouns(t *testing.T) {
+	nouns := make(map[string]struct{}, len(uniqueWords()))
+	for _, w := range uniqueWords() {
+		nouns[w] = struct{}{}
+	}
+	for _, a := range adjectives {
+		_, clash := nouns[a]
+		assert.False(t, clash, "Adjective %q also appears in the noun pool; remove it from one list", a)
+	}
+}
+
+// TestAdjectives_AreDNSSafeAndDeduplicated mirrors the curation contract stated
+// in words.go: lowercase ASCII, 4-12 chars, no digits or hyphens, no repeats.
+func TestAdjectives_AreDNSSafeAndDeduplicated(t *testing.T) {
+	seen := make(map[string]struct{}, len(adjectives))
+	for _, a := range adjectives {
+		_, dup := seen[a]
+		assert.False(t, dup, "Duplicate adjective %q", a)
+		seen[a] = struct{}{}
+
+		assert.Regexp(t, `^[a-z]{4,12}$`, a, "Adjective %q must be 4-12 lowercase ASCII letters", a)
+	}
+	assert.Greater(t, len(adjectives), 150, "Adjective pool too small to give a useful namespace")
+}
+
+// TestPickTuple_SpansALargeNamespace guards the reason we moved to tuples: a
+// single-word pool caps the GLOBAL namespace at 857. Drawing many tuples must
+// yield overwhelmingly distinct values.
+func TestPickTuple_SpansALargeNamespace(t *testing.T) {
+	seen := make(map[string]struct{}, 2000)
+	for i := 0; i < 2000; i++ {
+		seen[PickTuple()] = struct{}{}
+	}
+	assert.Greater(t, len(seen), 1900,
+		"2000 draws should be nearly all distinct across a ~200k namespace; got %d unique", len(seen))
+}
diff --git a/management/internals/modules/agentnetwork/manager.go b/management/internals/modules/agentnetwork/manager.go
index d88e0d77c..71ff53214 100644
--- a/management/internals/modules/agentnetwork/manager.go
+++ b/management/internals/modules/agentnetwork/manager.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"math/rand"
 	"slices"
 	"strings"
 	"sync"
@@ -13,6 +12,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/labelgen"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/modeldiscovery"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
@@ -22,7 +22,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -48,9 +47,10 @@ func ensureSessionKeys(p *types.Provider) error {
 type Manager interface {
 	GetAllProviders(ctx context.Context, accountID, userID string) ([]*types.Provider, error)
 	GetProvider(ctx context.Context, accountID, userID, providerID string) (*types.Provider, error)
-	CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error)
+	CreateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error)
 	UpdateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error)
 	DeleteProvider(ctx context.Context, accountID, userID, providerID string) error
+	DiscoverProviderModels(ctx context.Context, accountID, userID string, req modeldiscovery.Request, recordID string) ([]modeldiscovery.Model, error)
 
 	GetAllPolicies(ctx context.Context, accountID, userID string) ([]*types.Policy, error)
 	GetPolicy(ctx context.Context, accountID, userID, policyID string) (*types.Policy, error)
@@ -71,27 +71,44 @@ type Manager interface {
 	DeleteBudgetRule(ctx context.Context, accountID, userID, ruleID string) error
 
 	GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error)
+	CreateSettings(ctx context.Context, userID string, settings *types.Settings, proxyAddress, endpoint string) (*types.Settings, error)
 	UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error)
+	DeleteSettings(ctx context.Context, accountID, userID string) error
 
 	ListConsumption(ctx context.Context, accountID, userID string) ([]*types.Consumption, error)
 	ListAccessLogs(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error)
 	ListAccessLogSessions(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error)
 	GetUsageOverview(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter, granularity types.UsageGranularity) ([]*types.AgentNetworkUsageBucket, error)
 	StartAccessLogCleanup(ctx context.Context, cleanupIntervalHours int)
+	// RemoveAccountGateway drops the account's gateway mappings from the
+	// proxies. It runs as an account deletion hook.
+	RemoveAccountGateway(ctx context.Context, accountID string) error
 	RecordConsumption(ctx context.Context, accountID string, kind types.ConsumptionDimension, dimID string, windowSeconds, tokensIn, tokensOut int64, costUSD float64) error
 	RecordAccountBudgetUsage(ctx context.Context, accountID, userID string, groupIDs []string, tokensIn, tokensOut int64, costUSD float64) error
 	RecordUsage(ctx context.Context, in RecordUsageInput) error
 	SelectPolicyForRequest(ctx context.Context, in PolicySelectionInput) (*PolicySelectionResult, error)
+
+	// GetAgentConfigForUser backs the self-service agent-config endpoint.
+	// Caller-scoped, so it skips the role permission gate; see
+	// the implementation. The caller's own usage and requests come
+	// through GetUsageOverview / ListAccessLogs, which self-scope when
+	// the account-wide grant is missing.
+	GetAgentConfigForUser(ctx context.Context, accountID, userID string) (*types.AgentConfig, error)
 }
 
 // PolicySelectionInput is the per-request selection envelope. The
 // proxy populates it from CapturedData (account, user, groups) plus
-// the provider llm_router resolved.
+// the provider llm_router resolved and the model it extracted.
 type PolicySelectionInput struct {
 	AccountID  string
 	UserID     string
 	GroupIDs   []string
 	ProviderID string
+	// Model is the already-normalised upstream model id the proxy extracted
+	// (parser strips Bedrock region/version, Vertex @version), so a
+	// case-insensitive compare suffices. Empty = undetermined → not permitted
+	// (fail closed).
+	Model string
 }
 
 // PolicySelectionResult names the policy that "pays" for this request
@@ -117,17 +134,35 @@ type managerImpl struct {
 	permissionsManager permissions.Manager
 	proxyController    proxy.Controller
 
-	// reconcileCache holds the last set of synthesised proxy mappings
-	// per account so reconcile can emit precise Create/Update/Delete
-	// updates instead of a full re-push on every mutation. Keyed by
-	// accountID, then by synthesised service ID.
-	reconcileMu    sync.Mutex
-	reconcileCache map[string]map[string]*proto.ProxyMapping
+	// modelDiscovery queries vendors for the models a credential can reach.
+	// An interface rather than the concrete client because it is now on a
+	// write path: the credential check runs inside CreateProvider and
+	// UpdateProvider, so every test that saves a provider would otherwise
+	// reach a vendor over the network to do it.
+	//
+	// One instance serves every request for the process's lifetime, so its
+	// fields must stay read-only after construction: lazy initialisation
+	// inside Fetch or httpClient would race across request goroutines.
+	modelDiscovery ModelLister
 
-	// labelRngMu guards labelRng. PickUnique consumes math/rand.Source
-	// state; concurrent provider creates would otherwise race.
-	labelRngMu sync.Mutex
-	labelRng   *rand.Rand
+	// reconcileCache holds the last set of synthesised proxy mappings
+	// per account, each paired with the proxy that served it, so a change
+	// of serving proxy can be diffed without re-deriving it.
+	reconcileMu    sync.Mutex
+	reconcileCache map[string]map[string]syntheticMapping
+}
+
+// ManagerOption replaces a manager dependency at construction. Production
+// passes none; each option exists for something a test cannot let run for
+// real.
+type ManagerOption func(*managerImpl)
+
+// WithModelLister replaces the vendor call behind the provider credential
+// check. A test that saves a provider needs this — the check runs inside
+// CreateProvider and UpdateProvider, so the write path reaches a vendor
+// without it.
+func WithModelLister(lister ModelLister) ManagerOption {
+	return func(m *managerImpl) { m.modelDiscovery = lister }
 }
 
 // NewManager constructs the persistent Agent Network manager. The
@@ -140,37 +175,200 @@ func NewManager(
 	permissionsManager permissions.Manager,
 	accountManager account.Manager,
 	proxyController proxy.Controller,
+	opts ...ManagerOption,
 ) Manager {
-	return &managerImpl{
+	m := &managerImpl{
 		store:              store,
 		accountManager:     accountManager,
 		permissionsManager: permissionsManager,
 		proxyController:    proxyController,
-		reconcileCache:     make(map[string]map[string]*proto.ProxyMapping),
-		labelRng:           rand.New(rand.NewSource(time.Now().UnixNano())),
+		modelDiscovery:     &modeldiscovery.Client{},
+		reconcileCache:     make(map[string]map[string]syntheticMapping),
 	}
+	for _, opt := range opts {
+		opt(m)
+	}
+	return m
 }
 
+// GetAllProviders returns the account's providers for callers holding the
+// providers read grant (connection config redacted unless they can also
+// update). A caller without the grant self-scopes instead of being denied
+// — mirroring the usage and log endpoints: they get the providers their
+// own policies authorize, redacted to the display surface, which is what
+// feeds the dashboard's provider filter for plain users.
 func (m *managerImpl) GetAllProviders(ctx context.Context, accountID, userID string) ([]*types.Provider, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Read)
+	if err != nil {
+		return nil, status.NewPermissionValidationError(err)
+	}
+	if !ok {
+		return m.callerScopedProviders(ctx, accountID, userID)
+	}
+	providers, err := m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
 		return nil, err
 	}
-	return m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
+	return m.redactProvidersForViewer(ctx, accountID, userID, providers)
 }
 
+// GetProvider self-scopes like GetAllProviders: a caller without the read
+// grant may fetch a provider their own policies authorize (redacted), and
+// gets the same not-found answer for any other id — an out-of-scope
+// provider must be indistinguishable from a nonexistent one.
 func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, providerID string) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Read)
+	if err != nil {
+		return nil, status.NewPermissionValidationError(err)
+	}
+	if !ok {
+		scoped, err := m.callerScopedProviders(ctx, accountID, userID)
+		if err != nil {
+			return nil, err
+		}
+		for _, p := range scoped {
+			if p.ID == providerID {
+				return p, nil
+			}
+		}
+		return nil, status.NewAgentNetworkProviderNotFoundError(providerID)
+	}
+	provider, err := m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, providerID)
+	if err != nil {
 		return nil, err
 	}
-	return m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, providerID)
+	redacted, err := m.redactProvidersForViewer(ctx, accountID, userID, []*types.Provider{provider})
+	if err != nil {
+		return nil, err
+	}
+	return redacted[0], nil
 }
 
-// CreateProvider persists a new provider for the account. bootstrapCluster
-// is used only when the per-account agent-network Settings row hasn't
-// been created yet; otherwise it is ignored (the cluster is pinned on
-// Settings and every provider in the account routes through it).
-func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, provider.AccountID, userID, operations.Create); err != nil {
+// callerScopedProviders returns the providers the caller's own policies
+// authorize — the same selection the self-service setup answer and the
+// proxy's routing derive from — each reduced to the display surface. No
+// role permission is needed: the answer is scoped strictly to the caller,
+// and a caller outside every policy gets an empty list, indistinguishable
+// from an account with nothing configured.
+func (m *managerImpl) callerScopedProviders(ctx context.Context, accountID, userID string) ([]*types.Provider, error) {
+	user, err := m.store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+	if err != nil {
+		return nil, fmt.Errorf("get user: %w", err)
+	}
+	authorized, applicable, err := m.authorizedProvidersForGroups(ctx, accountID, user.AutoGroups)
+	if err != nil {
+		return nil, err
+	}
+	var guardrailsByID map[string]*types.Guardrail
+	if anyPolicyHasGuardrails(applicable) {
+		guardrailsByID, err = m.loadGuardrailsByID(ctx, accountID)
+		if err != nil {
+			return nil, err
+		}
+	}
+	out := make([]*types.Provider, 0, len(authorized))
+	for _, p := range authorized {
+		r := p.RedactedForViewer()
+		// The model list follows the same effective computation the setup
+		// answer and the proxy use: allowlist-restricted callers see only
+		// the models their guardrails permit, and an unrestricted policy
+		// on a provider without an operator declaration surfaces the
+		// catalog models, matching the setup response — so the dashboard's
+		// model filter never offers a model the caller's own requests
+		// could not use, and never comes up empty when the setup page
+		// lists models. Grant holders keep the full declared lists —
+		// their usage view spans everyone's requests.
+		_, effective := effectiveModelsForProvider(p, policiesForProvider(applicable, p.ID), guardrailsByID)
+		r.Models = providerModelsByID(p, effective)
+		out = append(out, r)
+	}
+	return out, nil
+}
+
+// redactProvidersForViewer strips the connection configuration from
+// providers handed to a caller who holds only the read grant on
+// agent_network.providers. Update is the managing signal: a role that can
+// edit a provider sees its config in the edit form anyway, while a
+// read-only role (usage_viewer) only needs the display surface the usage
+// filters resolve against — upstream URLs and operator-supplied header
+// values are not part of that. Validation errors fail closed.
+func (m *managerImpl) redactProvidersForViewer(ctx context.Context, accountID, userID string, providers []*types.Provider) ([]*types.Provider, error) {
+	canManage, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Update)
+	if err != nil {
+		return nil, status.NewPermissionValidationError(err)
+	}
+	if canManage {
+		return providers, nil
+	}
+	out := make([]*types.Provider, 0, len(providers))
+	for _, p := range providers {
+		if p == nil {
+			out = append(out, nil)
+			continue
+		}
+		out = append(out, p.RedactedForViewer())
+	}
+	return out, nil
+}
+
+// DiscoverProviderModels asks the vendor which models a credential can reach.
+//
+// recordID, when set, names an existing provider whose stored credential is
+// used instead of the one in req — so the dashboard can refresh the list
+// without ever holding the key. An upstream in req overrides the stored one,
+// which is what lets a form list against a URL the operator has typed but not
+// saved yet, using the credential they cannot retype.
+//
+// Gated on Create rather than Read: this spends the operator's credential
+// against a third party, which is not something a read-only role should be
+// able to make the server do. That one check also covers reading the stored
+// record — Create is strictly stronger than Read here, and the lookup is
+// scoped to accountID, so another account's record is never reachable.
+func (m *managerImpl) DiscoverProviderModels(ctx context.Context, accountID, userID string, req modeldiscovery.Request, recordID string) ([]modeldiscovery.Model, error) {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Create); err != nil {
+		return nil, err
+	}
+
+	if recordID != "" {
+		record, err := m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, recordID)
+		if err != nil {
+			return nil, err
+		}
+		// The catalog id comes from the stored record too: letting the caller
+		// name a different one would run a provider's credential against
+		// whichever vendor endpoint they picked.
+		req.CatalogID = record.ProviderID
+		req.APIKey = record.APIKey
+		// The upstream is the one field the caller may override, so that a URL
+		// typed into the form can be listed against before it is saved.
+		//
+		// It sends the stored credential to a host the caller named, which is
+		// a capability they already have: the same permission set updates the
+		// record's upstream, and that write runs this same check against
+		// whatever it is pointed at. What it would not otherwise be is silent,
+		// since the write leaves an activity event behind — so the override is
+		// recorded here.
+		if strings.TrimSpace(req.UpstreamURL) == "" {
+			req.UpstreamURL = record.UpstreamURL
+		} else if req.UpstreamURL != record.UpstreamURL {
+			log.WithContext(ctx).Infof("agent network provider %s listed against caller-supplied upstream %s by user %s",
+				recordID, req.UpstreamURL, userID)
+		}
+	}
+
+	models, err := m.modelDiscovery.Fetch(ctx, req)
+	if err != nil {
+		return nil, discoveryFailure(ctx, req.CatalogID, err)
+	}
+	return models, nil
+}
+
+// CreateProvider persists a new provider for the account. Providers have no
+// settings side effects: the account's endpoint is bootstrapped separately and
+// explicitly via CreateSettings, and every provider in the account routes
+// through it.
+func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error) {
+	if err := m.requirePermission(ctx, provider.AccountID, userID, modules.AgentNetworkProviders, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -180,6 +378,18 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 	if strings.TrimSpace(provider.APIKey) == "" {
 		return nil, status.Errorf(status.InvalidArgument, "api_key is required when creating an agent network provider")
 	}
+	// Stored as it will be sent. The vendor call below trims the key before
+	// building the auth header while the synthesiser substitutes the stored
+	// value verbatim, so a key pasted with surrounding whitespace would pass
+	// its check and then fail every request the provider serves.
+	provider.APIKey = strings.TrimSpace(provider.APIKey)
+
+	// Before anything is persisted: a record whose upstream or credential does
+	// not work is rejected here rather than discovered later as a failed
+	// request with nothing pointing back at it.
+	if err := m.checkProviderCredential(ctx, provider); err != nil {
+		return nil, err
+	}
 
 	if provider.ID == "" {
 		fresh := types.NewProvider(provider.AccountID)
@@ -196,16 +406,6 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 		return nil, fmt.Errorf("save agent network provider: %w", err)
 	}
 
-	if strings.TrimSpace(bootstrapCluster) != "" {
-		if _, err := m.bootstrapSettingsIfNeeded(ctx, provider.AccountID, bootstrapCluster); err != nil {
-			// The provider create has already succeeded; logging the
-			// bootstrap miss matches the plan's PoC behaviour. The synth
-			// path treats a missing settings row as a no-op, and the next
-			// provider create retries the bootstrap.
-			log.WithContext(ctx).Debugf("agent-network bootstrap settings for account %s on cluster %s: %v", provider.AccountID, bootstrapCluster, err)
-		}
-	}
-
 	m.accountManager.StoreEvent(ctx, userID, provider.ID, provider.AccountID, activity.AgentNetworkProviderCreated, provider.EventMeta())
 	m.reconcile(ctx, provider.AccountID)
 
@@ -213,7 +413,7 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 }
 
 func (m *managerImpl) UpdateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, provider.AccountID, userID, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, provider.AccountID, userID, modules.AgentNetworkProviders, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -225,11 +425,47 @@ func (m *managerImpl) UpdateProvider(ctx context.Context, userID string, provide
 	// Preserve the API key if the caller didn't rotate it. A
 	// whitespace-only value is treated as "not rotated" rather than a
 	// real key, but it must not silently overwrite a valid stored key.
-	if provider.APIKey == "" {
-		provider.APIKey = existing.APIKey
-	} else if strings.TrimSpace(provider.APIKey) == "" {
+	switch trimmed := strings.TrimSpace(provider.APIKey); {
+	case provider.APIKey == "":
+		// Trimmed on the way through: a record stored before keys were
+		// normalised carries whitespace the proxy still sends, and an edit
+		// that preserves the key is the occasion to repair it. Doing so makes
+		// the comparison below see a change, which is correct — that key has
+		// never been tested in the form it is about to be sent in.
+		provider.APIKey = strings.TrimSpace(existing.APIKey)
+	case trimmed == "":
 		return nil, status.Errorf(status.InvalidArgument, "api_key must be non-blank when rotating an agent network provider")
+	default:
+		// See CreateProvider: the key is stored in the form the proxy will
+		// send, so the check below tests what the provider will actually use.
+		provider.APIKey = trimmed
 	}
+
+	// Only the fields the vendor would judge are worth a round-trip. This same
+	// call carries renames, model rows and price edits, and none of those
+	// should wait on a vendor — or be refused because one is having a bad day.
+	//
+	// The catalog entry counts as one of them: it decides which vendor is
+	// asked, under which auth header, so moving a record from one to another
+	// sends an unchanged credential somewhere it has never been accepted.
+	//
+	// The comparison runs after the merge above, so an update that changes only
+	// the URL reads as unchanged on the key and is checked against the stored
+	// one, which is the only credential the operator has to offer here.
+	//
+	// Turning TLS verification back on is the fourth: the record was stored
+	// unchecked precisely because that flag was set, so this is the first
+	// moment it can be checked at all, and nothing else about it need change
+	// for that to be true.
+	if provider.UpstreamURL != existing.UpstreamURL ||
+		provider.APIKey != existing.APIKey ||
+		provider.ProviderID != existing.ProviderID ||
+		(existing.SkipTLSVerification && !provider.SkipTLSVerification) {
+		if err := m.checkProviderCredential(ctx, provider); err != nil {
+			return nil, err
+		}
+	}
+
 	// Always preserve the session keypair across updates so existing
 	// session cookies stay valid. The keys are server-managed and
 	// never surfaced through the API.
@@ -252,7 +488,7 @@ func (m *managerImpl) UpdateProvider(ctx context.Context, userID string, provide
 }
 
 func (m *managerImpl) DeleteProvider(ctx context.Context, accountID, userID, providerID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Delete); err != nil {
 		return err
 	}
 
@@ -301,21 +537,21 @@ func pluralize(n int, singular, plural string) string {
 }
 
 func (m *managerImpl) GetAllPolicies(ctx context.Context, accountID, userID string) ([]*types.Policy, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetPolicy(ctx context.Context, accountID, userID, policyID string) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkPolicyByID(ctx, store.LockingStrengthNone, accountID, policyID)
 }
 
 func (m *managerImpl) CreatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, policy.AccountID, userID, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, policy.AccountID, userID, modules.AgentNetworkPolicies, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -341,7 +577,7 @@ func (m *managerImpl) CreatePolicy(ctx context.Context, userID string, policy *t
 }
 
 func (m *managerImpl) UpdatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, policy.AccountID, userID, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, policy.AccountID, userID, modules.AgentNetworkPolicies, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -368,7 +604,7 @@ func (m *managerImpl) UpdatePolicy(ctx context.Context, userID string, policy *t
 }
 
 func (m *managerImpl) DeletePolicy(ctx context.Context, accountID, userID, policyID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Delete); err != nil {
 		return err
 	}
 
@@ -388,21 +624,21 @@ func (m *managerImpl) DeletePolicy(ctx context.Context, accountID, userID, polic
 }
 
 func (m *managerImpl) GetAllGuardrails(ctx context.Context, accountID, userID string) ([]*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetGuardrail(ctx context.Context, accountID, userID, guardrailID string) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkGuardrailByID(ctx, store.LockingStrengthNone, accountID, guardrailID)
 }
 
 func (m *managerImpl) CreateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, guardrail.AccountID, userID, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, guardrail.AccountID, userID, modules.AgentNetworkGuardrails, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -424,7 +660,7 @@ func (m *managerImpl) CreateGuardrail(ctx context.Context, userID string, guardr
 }
 
 func (m *managerImpl) UpdateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, guardrail.AccountID, userID, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, guardrail.AccountID, userID, modules.AgentNetworkGuardrails, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -447,7 +683,7 @@ func (m *managerImpl) UpdateGuardrail(ctx context.Context, userID string, guardr
 }
 
 func (m *managerImpl) DeleteGuardrail(ctx context.Context, accountID, userID, guardrailID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Delete); err != nil {
 		return err
 	}
 
@@ -468,7 +704,7 @@ func (m *managerImpl) DeleteGuardrail(ctx context.Context, accountID, userID, gu
 
 // GetAllBudgetRules returns every account-level budget rule for the account.
 func (m *managerImpl) GetAllBudgetRules(ctx context.Context, accountID, userID string) ([]*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkBudgetRules(ctx, store.LockingStrengthNone, accountID)
@@ -476,7 +712,7 @@ func (m *managerImpl) GetAllBudgetRules(ctx context.Context, accountID, userID s
 
 // GetBudgetRule returns a single account-level budget rule.
 func (m *managerImpl) GetBudgetRule(ctx context.Context, accountID, userID, ruleID string) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkBudgetRuleByID(ctx, store.LockingStrengthNone, accountID, ruleID)
@@ -486,7 +722,7 @@ func (m *managerImpl) GetBudgetRule(ctx context.Context, accountID, userID, rule
 // enforced at request time (CheckLLMPolicyLimits), not baked into the synth
 // proxy config, so no reconcile is needed.
 func (m *managerImpl) CreateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, rule.AccountID, userID, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, rule.AccountID, userID, modules.AgentNetworkBudgets, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -508,7 +744,7 @@ func (m *managerImpl) CreateBudgetRule(ctx context.Context, userID string, rule
 
 // UpdateBudgetRule updates an existing account-level budget rule.
 func (m *managerImpl) UpdateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, rule.AccountID, userID, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, rule.AccountID, userID, modules.AgentNetworkBudgets, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -531,7 +767,7 @@ func (m *managerImpl) UpdateBudgetRule(ctx context.Context, userID string, rule
 
 // DeleteBudgetRule removes an account-level budget rule.
 func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, ruleID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Delete); err != nil {
 		return err
 	}
 
@@ -549,40 +785,152 @@ func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, r
 	return nil
 }
 
-// UpdateSettings applies the mutable account-level settings — the collection
-// toggles — onto the existing row. Cluster and Subdomain are immutable and are
-// preserved from the persisted row regardless of the input. Because the
-// collection toggles change the synthesised service config (prompt-capture
-// gating, access-log emission), a reconcile is triggered so the proxy and peer
-// network maps converge on the new state.
+// UpdateSettings replaces the mutable account-level settings — the collection
+// toggles and retention — on the account's row. The identity fields (Domain,
+// ProxyAddress) are assigned at bootstrap (CreateSettings) and immutable: the
+// request carries them, matching the PUT convention of every other endpoint,
+// but they are only compared against the stored row — a request carrying
+// different values is rejected, and the stored values are never overwritten.
+// When the account has no settings row yet the update fails with NotFound.
+// Because the collection toggles change the synthesised service config
+// (prompt-capture gating, access-log emission), a reconcile is triggered so
+// the proxy and peer network maps converge on the new state.
 func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error) {
-	if err := m.requirePermission(ctx, settings.AccountID, userID, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Update); err != nil {
 		return nil, err
 	}
 
-	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
+	// The row lock from LockingStrengthUpdate only holds for the duration of
+	// the surrounding transaction, so the read and the save must share one —
+	// otherwise concurrent PUTs could interleave between them.
+	var updated *types.Settings
+	err := m.store.ExecuteInTransaction(ctx, func(tx store.Store) error {
+		existing, err := tx.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
+		switch {
+		case err == nil:
+		case isNotFound(err):
+			return status.Errorf(status.NotFound, "agent network settings have not been bootstrapped yet; POST /api/agent-network/settings to bootstrap them")
+		default:
+			return fmt.Errorf("get agent network settings: %w", err)
+		}
+
+		// The identity echo is compared leniently (trimmed, case-insensitive):
+		// the stored values are normalized lowercase, and a client replaying a
+		// GET response must never be rejected over casing it didn't choose.
+		if !hostnamesEquivalent(settings.Domain, existing.Domain) {
+			return status.Errorf(status.InvalidArgument, "endpoint is immutable: it must match the assigned endpoint %q; delete the settings to release it and bootstrap again", existing.Domain)
+		}
+		if !hostnamesEquivalent(settings.ProxyAddress, existing.ProxyAddress) {
+			return status.Errorf(status.InvalidArgument, "proxy_address is immutable: it must match the assigned proxy address %q; delete the settings to release it and bootstrap again", existing.ProxyAddress)
+		}
+
+		existing.EnableLogCollection = settings.EnableLogCollection
+		existing.EnablePromptCollection = settings.EnablePromptCollection
+		existing.RedactPii = settings.RedactPii
+		existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
+		existing.UpdatedAt = time.Now().UTC()
+
+		if err := tx.SaveAgentNetworkSettings(ctx, existing); err != nil {
+			return fmt.Errorf("save agent network settings: %w", err)
+		}
+		updated = existing
+		return nil
+	})
 	if err != nil {
-		return nil, fmt.Errorf("get agent network settings: %w", err)
-	}
-
-	existing.EnableLogCollection = settings.EnableLogCollection
-	existing.EnablePromptCollection = settings.EnablePromptCollection
-	existing.RedactPii = settings.RedactPii
-	existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
-	existing.UpdatedAt = time.Now().UTC()
-
-	if err := m.store.SaveAgentNetworkSettings(ctx, existing); err != nil {
-		return nil, fmt.Errorf("save agent network settings: %w", err)
+		return nil, err
 	}
 
 	m.accountManager.StoreEvent(ctx, userID, settings.AccountID, settings.AccountID, activity.AgentNetworkSettingsUpdated, map[string]any{
-		"log_collection":    existing.EnableLogCollection,
-		"prompt_collection": existing.EnablePromptCollection,
-		"redact_pii":        existing.RedactPii,
+		"log_collection":    updated.EnableLogCollection,
+		"prompt_collection": updated.EnablePromptCollection,
+		"redact_pii":        updated.RedactPii,
 	})
 	m.reconcile(ctx, settings.AccountID)
 
-	return existing, nil
+	return updated, nil
+}
+
+// hostnamesEquivalent reports whether a caller-supplied hostname names the
+// same host as a stored (normalized, lowercase) one: equal after trimming and
+// case folding. No structural validation — an arbitrary mismatch and a
+// malformed value are both simply "not the assigned value".
+func hostnamesEquivalent(supplied, stored string) bool {
+	return strings.EqualFold(strings.TrimSpace(supplied), stored)
+}
+
+// DeleteSettings removes the account's settings row, releasing the endpoint.
+// Two guards make this a bootstrap-repair operation rather than a way to tear
+// down a serving gateway, both re-checked under the row lock:
+//
+//   - No Agent Network providers may exist for the account. Providers route
+//     through the endpoint; delete them first.
+//   - No proxy may be actively serving the endpoint — that is, no active proxy
+//     declares the endpoint hostname as its cluster address. This is the
+//     dedicated (self-addressed) shape's guard: the proxy at the address IS
+//     this account's gateway. A labeled endpoint hangs beneath a shared
+//     cluster's address, and with the account's providers already gone the
+//     shared proxy serves nothing of the account's, so the parent cluster
+//     being up does not block the delete.
+//
+// Bootstrapping again after a delete allocates fresh — the released hostname
+// is not reserved. That full-reset semantic is what gives clients that model
+// immutability as replace-on-change (e.g. Terraform's RequiresReplace) a real
+// path: tear down providers, delete, re-create.
+func (m *managerImpl) DeleteSettings(ctx context.Context, accountID, userID string) error {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Delete); err != nil {
+		return err
+	}
+
+	var deleted *types.Settings
+	err := m.store.ExecuteInTransaction(ctx, func(tx store.Store) error {
+		existing, err := tx.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, accountID)
+		switch {
+		case err == nil:
+		case isNotFound(err):
+			return status.Errorf(status.NotFound, "agent network settings have not been bootstrapped yet; there is nothing to delete")
+		default:
+			return fmt.Errorf("get agent network settings: %w", err)
+		}
+
+		providers, err := tx.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
+		if err != nil {
+			return fmt.Errorf("get agent network providers: %w", err)
+		}
+		if len(providers) > 0 {
+			return status.Errorf(status.PreconditionFailed, "agent network settings cannot be deleted while %d provider(s) exist; delete the providers first", len(providers))
+		}
+
+		serving, err := tx.HasActiveProxyAtClusterAddress(ctx, existing.Domain)
+		if err != nil {
+			return fmt.Errorf("check for a proxy serving the endpoint: %w", err)
+		}
+		if serving {
+			return status.Errorf(status.PreconditionFailed, "agent network settings cannot be deleted while a proxy is actively serving the endpoint %q", existing.Domain)
+		}
+
+		if err := tx.DeleteAgentNetworkSettings(ctx, accountID); err != nil {
+			return fmt.Errorf("delete agent network settings: %w", err)
+		}
+		deleted = existing
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, accountID, accountID, activity.AgentNetworkSettingsDeleted, map[string]any{
+		"endpoint":      deleted.Domain,
+		"proxy_address": deleted.ProxyAddress,
+	})
+	m.reconcile(ctx, accountID)
+
+	return nil
+}
+
+// isNotFound reports whether err is a status.NotFound error.
+func isNotFound(err error) bool {
+	var sErr *status.Error
+	return errors.As(err, &sErr) && sErr.Type() == status.NotFound
 }
 
 // validateProviderRefs ensures every destination provider id refers to a
@@ -606,81 +954,339 @@ func (m *managerImpl) validateProviderRefs(ctx context.Context, accountID string
 	return nil
 }
 
-// GetSettings returns the agent-network settings row for the account.
-// Returns the underlying status.NotFound when no row has been
-// bootstrapped yet (i.e. the account has no providers).
+// GetSettings returns the agent-network settings row for the account. When no
+// row has been bootstrapped yet, the defaults are returned (without
+// persisting) with cluster and subdomain empty — settings always read as an
+// object, like the account and DNS settings endpoints.
 func (m *managerImpl) GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Read); err != nil {
+		return nil, err
+	}
+	settings, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	switch {
+	case err == nil:
+		return settings, nil
+	case isNotFound(err):
+		return types.DefaultSettings(accountID), nil
+	default:
 		return nil, err
 	}
-	return m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 }
 
-// bootstrapSettingsIfNeeded creates the per-account agent-network
-// settings row when missing. The cluster comes from the create-time
-// hint the dashboard sends (auto-picked from the active cluster list);
-// the subdomain is picked from the curated wordlist avoiding
-// collisions on the same cluster. Idempotent: if a row already exists
-// it is returned untouched and the hint is ignored.
-func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID, providerCluster string) (*types.Settings, error) {
-	if accountID == "" {
-		return nil, fmt.Errorf("bootstrap settings: account id is required")
+// maxDomainAllocationAttempts bounds the label search when bootstrapping a
+// labeled endpoint. Package-level (rather than function-local) so tests can
+// assert on the exhaustion path without duplicating the literal.
+const maxDomainAllocationAttempts = 10
+
+// CreateSettings bootstraps the per-account settings row, assigning the
+// account's immutable endpoint. Exactly one of proxyAddress and endpoint must
+// be non-empty: proxyAddress allocates a labeled endpoint one label beneath
+// the given cluster address; endpoint claims the given hostname verbatim as a
+// self-addressed (dedicated) endpoint — a legitimate claim before any proxy
+// declares the address (address-first). settings carries the account ID and
+// the initial collection toggles; its identity fields are assigned here.
+func (m *managerImpl) CreateSettings(ctx context.Context, userID string, settings *types.Settings, proxyAddress, endpoint string) (*types.Settings, error) {
+	if settings == nil || settings.AccountID == "" {
+		return nil, status.Errorf(status.InvalidArgument, "account id is required")
 	}
-	if strings.TrimSpace(providerCluster) == "" {
-		return nil, fmt.Errorf("bootstrap settings: provider cluster is required")
+	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Create); err != nil {
+		return nil, err
 	}
 
-	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	if err == nil {
-		return existing, nil
+	hasProxyAddress := strings.TrimSpace(proxyAddress) != ""
+	hasEndpoint := strings.TrimSpace(endpoint) != ""
+	if hasProxyAddress == hasEndpoint {
+		return nil, status.Errorf(status.InvalidArgument, "exactly one of proxy_address and endpoint is required")
 	}
-	var sErr *status.Error
-	if !errors.As(err, &sErr) || sErr.Type() != status.NotFound {
+
+	// Fail fast on an existing row for a clean 409; the insert below stays
+	// the authority against concurrent bootstraps (the primary key wins).
+	if _, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, settings.AccountID); err == nil {
+		return nil, status.Errorf(status.AlreadyExists, "agent network settings already bootstrapped for account %s", settings.AccountID)
+	} else if !isNotFound(err) {
 		return nil, fmt.Errorf("get agent network settings: %w", err)
 	}
 
-	siblings, err := m.store.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, providerCluster)
-	if err != nil {
-		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
-	}
-	taken := make(map[string]struct{}, len(siblings))
-	for _, s := range siblings {
-		taken[s.Subdomain] = struct{}{}
-	}
-
-	suffix := accountID
-	if len(suffix) > 4 {
-		suffix = suffix[:4]
-	}
-
-	m.labelRngMu.Lock()
-	subdomain := labelgen.PickUnique(m.labelRng, taken, suffix)
-	m.labelRngMu.Unlock()
-
 	now := time.Now().UTC()
-	settings := &types.Settings{
-		AccountID: accountID,
-		Cluster:   providerCluster,
-		Subdomain: subdomain,
-		// Logs on by default; usage is collected regardless. Retention bounds
-		// how long full log rows are kept.
-		EnableLogCollection:    true,
-		AccessLogRetentionDays: types.DefaultAccessLogRetentionDays,
-		CreatedAt:              now,
-		UpdatedAt:              now,
+	settings.CreatedAt = now
+	settings.UpdatedAt = now
+
+	var err error
+	if hasEndpoint {
+		err = m.bootstrapSelfAddressed(ctx, settings, endpoint)
+	} else {
+		err = m.bootstrapLabeled(ctx, settings, proxyAddress)
 	}
-	if err := m.store.SaveAgentNetworkSettings(ctx, settings); err != nil {
-		return nil, fmt.Errorf("save agent network settings: %w", err)
+	if err != nil {
+		return nil, err
 	}
+
+	m.accountManager.StoreEvent(ctx, userID, settings.AccountID, settings.AccountID, activity.AgentNetworkSettingsUpdated, map[string]any{
+		"bootstrapped": true,
+		"endpoint":     settings.Domain,
+		"dedicated":    settings.Dedicated(),
+	})
+	m.reconcile(ctx, settings.AccountID)
+
 	return settings, nil
 }
 
+// bootstrapSelfAddressed claims the given hostname as the account's endpoint,
+// served only by a proxy declaring exactly that address (Domain ==
+// ProxyAddress). The domain unique index is the arbiter of availability.
+func (m *managerImpl) bootstrapSelfAddressed(ctx context.Context, settings *types.Settings, endpoint string) error {
+	hostname, err := types.NormalizeHostname(endpoint)
+	if err != nil {
+		return status.Errorf(status.InvalidArgument, "invalid endpoint: %s", err)
+	}
+	if err := m.requireHostNotForeign(ctx, settings.AccountID, hostname); err != nil {
+		return err
+	}
+	// Another account's labeled pin beneath this hostname makes it their
+	// cluster: a proxy serving them there would never serve this endpoint.
+	// The domain unique index already arbitrates two endpoints on one name.
+	if err := m.requireNotClaimedByOtherAccount(ctx, settings.AccountID, hostname, m.store.HasGatewayClusterPinnedByOtherAccount); err != nil {
+		return err
+	}
+	if err := m.validateGatewayCluster(ctx, settings.AccountID, hostname); err != nil {
+		return err
+	}
+
+	settings.Domain = hostname
+	settings.ProxyAddress = hostname
+	if err := m.store.CreateAgentNetworkSettings(ctx, settings); err != nil {
+		if isUniqueConstraintError(err) {
+			// The violation is either the account primary key (a concurrent
+			// bootstrap for the same account won) or the domain index
+			// (another account holds the hostname). Distinguish by re-read.
+			if _, getErr := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, settings.AccountID); getErr == nil {
+				return status.Errorf(status.AlreadyExists, "agent network settings already bootstrapped for account %s", settings.AccountID)
+			}
+			return status.Errorf(status.AlreadyExists, "endpoint %s is already taken", hostname)
+		}
+		return fmt.Errorf("create agent network settings: %w", err)
+	}
+	return nil
+}
+
+// validateGatewayCluster rejects a bootstrap pinned to a cluster that cannot
+// serve the account's gateway — a labeled endpoint beneath the cluster and a
+// self-addressed one on the very address a proxy declares alike, since the
+// service behind either is the same private one.
+//
+// The synthesised gateway service is unconditionally private
+// (buildAccountService): agents reach it over the WireGuard tunnel and are
+// authorised by ValidateTunnelPeer against the policies' source groups, and
+// its single target is the cluster itself with DirectUpstream. Only a cluster
+// with private capabilities can serve that. Management reports it per cluster
+// as the `private` capability, the same flag the dashboard renders as
+// supports_private when it gates NetBird-only services.
+//
+// Without this check the bootstrap happily pins to any cluster the caller
+// names, including one without private capabilities — and the endpoint it
+// allocates is immutable, so the account is left with a dead gateway that only
+// a DeleteSettings/re-bootstrap can undo.
+//
+// Whether management knows the cluster is decided on the proxy rows
+// themselves, never on how fresh their heartbeats are: a cluster's rows
+// outlive its proxies' liveness (only the stale-proxy reaper removes them), so
+// a cluster that exists stays judged as one. Judging on liveness instead would
+// make the same centralised cluster pass or fail depending on whether its
+// proxies happened to have heartbeated in the last couple of minutes.
+//
+// The single opening left is a cluster management holds no proxy row for at
+// all: pinning ahead of a proxy's first connection is a legitimate order — the
+// dedicated path claims an address the same way, before any proxy declares it.
+func (m *managerImpl) validateGatewayCluster(ctx context.Context, accountID, clusterAddr string) error {
+	declared, err := m.accountClusterSpellings(ctx, accountID, clusterAddr)
+	if err != nil {
+		return err
+	}
+	if len(declared) == 0 {
+		// No proxy has ever declared this address: an address-first pin.
+		return nil
+	}
+
+	// A cluster management knows has to prove it can serve the gateway, and
+	// only a live proxy reporting the capability proves that. Both an explicit false and an
+	// unreported capability (nothing live in the cluster, or proxies predating
+	// capability reporting) fail here: unusable and unproven are the same
+	// answer for a decision that cannot be revisited later.
+	//
+	// The capability is read per declared spelling and taken as any-true, the
+	// same way it aggregates over a cluster's proxies: the store matches
+	// cluster_address exactly, so a host two proxies spelled differently must
+	// not come back unproven just because it was asked about under one of them.
+	for _, address := range declared {
+		if private := m.store.GetClusterSupportsPrivate(ctx, address); private != nil && *private {
+			return nil
+		}
+	}
+
+	return status.Errorf(status.InvalidArgument,
+		"proxy cluster %s has no private capabilities: the agent network gateway requires a reverse proxy cluster "+
+			"with private capabilities", clusterAddr)
+}
+
+// accountClusterSpellings returns every proxy cluster address in the account's
+// view — its own (BYOP) clusters plus the shared ones — that names the same
+// host as clusterAddr. Empty means management holds no proxy row for that host
+// in this account's view.
+//
+// A proxy declares its cluster address as the operator spelled it, so identity
+// is compared on the normalised form rather than byte-equal — an in-memory pass
+// over the account's clusters, not a query. What comes back is the stored
+// spelling, because the capability lookup matches cluster_address exactly and
+// would silently find nothing under a spelling the store never held. The
+// cluster listing is not gated on heartbeats, so this answer does not change
+// while a cluster's proxies are merely offline.
+func (m *managerImpl) accountClusterSpellings(ctx context.Context, accountID, clusterAddr string) ([]string, error) {
+	clusters, err := m.store.GetProxyClusters(ctx, accountID)
+	if err != nil {
+		return nil, fmt.Errorf("list proxy clusters: %w", err)
+	}
+
+	var spellings []string
+	for _, cluster := range clusters {
+		normalized, err := types.NormalizeHostname(cluster.Address)
+		if err != nil {
+			// An address declared in a shape we cannot normalise is not one an
+			// endpoint can be allocated beneath.
+			log.WithContext(ctx).Debugf("skipping unusable proxy cluster address %q: %s", cluster.Address, err)
+			continue
+		}
+		if normalized == clusterAddr {
+			spellings = append(spellings, cluster.Address)
+		}
+	}
+	return spellings, nil
+}
+
+// bootstrapLabeled allocates a labeled endpoint one label beneath the given
+// cluster address: Domain = <label>.<proxyAddress>, served by whichever proxy
+// declares the parent. Labels are adjective-noun tuples; a candidate is
+// checked by read and the domain unique index stays the authority, so a
+// concurrent allocation of the same tuple surfaces as a unique violation and
+// another tuple is drawn.
+func (m *managerImpl) bootstrapLabeled(ctx context.Context, settings *types.Settings, proxyAddress string) error {
+	parent, err := types.NormalizeHostname(proxyAddress)
+	if err != nil {
+		return status.Errorf(status.InvalidArgument, "invalid proxy_address: %s", err)
+	}
+	if err := m.requireHostNotForeign(ctx, settings.AccountID, parent); err != nil {
+		return err
+	}
+	// Another account's endpoint at this exact hostname means the proxy that
+	// declares it is theirs, so nothing would serve a label beneath it. Other
+	// accounts' labeled pins under the same cluster are not asked about: a
+	// shared cluster carries many of them by design.
+	if err := m.requireNotClaimedByOtherAccount(ctx, settings.AccountID, parent, m.store.HasGatewayEndpointByOtherAccount); err != nil {
+		return err
+	}
+
+	if err := m.validateGatewayCluster(ctx, settings.AccountID, parent); err != nil {
+		return err
+	}
+
+	for attempt := 1; attempt <= maxDomainAllocationAttempts; attempt++ {
+		label := labelgen.PickTuple()
+		if label == "" {
+			// Only reachable if either word pool were emptied. An empty label
+			// would produce a broken endpoint like ".example.com", so fail
+			// loudly rather than looping or inserting.
+			return fmt.Errorf("allocate agent network endpoint for account %s: label generator returned an empty label", settings.AccountID)
+		}
+
+		candidate, err := types.NormalizeHostname(label + "." + parent)
+		if err != nil {
+			return status.Errorf(status.InvalidArgument, "proxy_address leaves no room for a label: %s", err)
+		}
+
+		_, err = m.store.GetAgentNetworkSettingsByDomain(ctx, store.LockingStrengthNone, candidate)
+		if err == nil {
+			log.WithContext(ctx).Tracef("agent-network endpoint %q taken, retrying (attempt %d/%d)", candidate, attempt, maxDomainAllocationAttempts)
+			continue
+		}
+		if !isNotFound(err) {
+			return fmt.Errorf("check agent network endpoint availability: %w", err)
+		}
+
+		settings.Domain = candidate
+		settings.ProxyAddress = parent
+		if err := m.store.CreateAgentNetworkSettings(ctx, settings); err != nil {
+			if isUniqueConstraintError(err) {
+				// A concurrent bootstrap for the same account may have won on
+				// the primary key — return the conflict. A lost race on the
+				// domain index just means the tuple was taken between the
+				// read and the insert: draw another.
+				if _, getErr := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, settings.AccountID); getErr == nil {
+					return status.Errorf(status.AlreadyExists, "agent network settings already bootstrapped for account %s", settings.AccountID)
+				}
+				log.WithContext(ctx).Tracef("agent-network endpoint %q lost an allocation race, retrying (attempt %d/%d)", candidate, attempt, maxDomainAllocationAttempts)
+				continue
+			}
+			return fmt.Errorf("create agent network settings: %w", err)
+		}
+		return nil
+	}
+
+	return fmt.Errorf("allocate agent network endpoint for account %s: %d attempts exhausted", settings.AccountID, maxDomainAllocationAttempts)
+}
+
+// requireHostNotForeign refuses to pin the account's gateway onto a host that
+// another account's proxy declares. The pin's proxy_address is what selects
+// the proxy that serves the endpoint, and an account-scoped proxy only ever
+// receives its own account's mappings, so such a pin could never be served —
+// and the endpoint it assigns is immutable. Shared proxies are not foreign, and
+// a host no proxy has declared stays pinnable: claiming the address before the
+// proxy's first connection is the documented order.
+func (m *managerImpl) requireHostNotForeign(ctx context.Context, accountID, host string) error {
+	foreign, err := m.store.HasForeignAccountProxyAtHost(ctx, host, accountID)
+	if err != nil {
+		return fmt.Errorf("check proxy host ownership: %w", err)
+	}
+	if foreign {
+		return errHostNotAvailable(host)
+	}
+	return nil
+}
+
+// requireNotClaimedByOtherAccount refuses the pin when another account's
+// gateway settings already claim the host in the shape claimed answers for.
+func (m *managerImpl) requireNotClaimedByOtherAccount(ctx context.Context, accountID, host string, claimed func(context.Context, string, string) (bool, error)) error {
+	taken, err := claimed(ctx, host, accountID)
+	if err != nil {
+		return fmt.Errorf("check agent network gateway claims at host: %w", err)
+	}
+	if taken {
+		return errHostNotAvailable(host)
+	}
+	return nil
+}
+
+func errHostNotAvailable(host string) error {
+	return status.Errorf(status.InvalidArgument, "proxy cluster %s is not available to this account", host)
+}
+
+// isUniqueConstraintError reports whether err is a database unique-constraint
+// violation, matched on the driver message because CreateAgentNetworkSettings
+// deliberately returns the driver error unwrapped.
+func isUniqueConstraintError(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := err.Error()
+	return strings.Contains(msg, "(SQLSTATE 23505)") || // postgres
+		strings.Contains(msg, "Error 1062 (23000)") || // mysql
+		strings.Contains(msg, "UNIQUE constraint failed") // sqlite
+}
+
 // ListConsumption returns every consumption row recorded for the
 // account, ordered window-newest-first. Backs the dashboard's basic
 // counter view; permission gate is the same Read role that gates
 // every other agent-network surface.
 func (m *managerImpl) ListConsumption(ctx context.Context, accountID, userID string) ([]*types.Consumption, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkUsage, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.ListAgentNetworkConsumption(ctx, store.LockingStrengthNone, accountID)
@@ -688,8 +1294,11 @@ func (m *managerImpl) ListConsumption(ctx context.Context, accountID, userID str
 
 // ListAccessLogs returns a paginated, server-side-filtered page of
 // agent-network access logs plus the total count matching the filter.
+// Callers without the account-wide logs grant get a self-scoped page —
+// only their own requests — instead of a denial.
 func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	filter, err := m.scopeFilterToCaller(ctx, accountID, userID, modules.AgentNetworkLogs, filter)
+	if err != nil {
 		return nil, 0, err
 	}
 	return m.store.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, accountID, filter)
@@ -697,18 +1306,23 @@ func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID stri
 
 // ListAccessLogSessions returns a paginated, server-side-filtered page of
 // agent-network access logs grouped by session, plus the total number of
-// sessions matching the filter.
+// sessions matching the filter. Self-scoped like ListAccessLogs for
+// callers without the account-wide logs grant.
 func (m *managerImpl) ListAccessLogSessions(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	filter, err := m.scopeFilterToCaller(ctx, accountID, userID, modules.AgentNetworkLogs, filter)
+	if err != nil {
 		return nil, 0, err
 	}
 	return m.store.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, accountID, filter)
 }
 
 // GetUsageOverview returns the filtered usage rows aggregated into time buckets
-// at the requested granularity, oldest-first.
+// at the requested granularity, oldest-first. Callers without the
+// account-wide usage grant get their own rows aggregated instead of a
+// denial, so the dashboard serves "my usage" from the same endpoint.
 func (m *managerImpl) GetUsageOverview(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter, granularity types.UsageGranularity) ([]*types.AgentNetworkUsageBucket, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	filter, err := m.scopeFilterToCaller(ctx, accountID, userID, modules.AgentNetworkUsage, filter)
+	if err != nil {
 		return nil, err
 	}
 	rows, err := m.store.GetAgentNetworkUsageRows(ctx, store.LockingStrengthNone, accountID, filter)
@@ -718,10 +1332,29 @@ func (m *managerImpl) GetUsageOverview(ctx context.Context, accountID, userID st
 	return types.AggregateUsageByGranularity(rows, granularity), nil
 }
 
+// scopeFilterToCaller applies the account-wide read gate for module and,
+// when the caller lacks the grant, pins the filter to the caller instead
+// of denying: their own user id replaces any requested one and group
+// filters are dropped. A caller may always see their own rows — strictly
+// tighter than any role gate — which is what lets every authenticated
+// user read their usage and requests through the regular endpoints.
+// Validation errors (not denials) still fail closed.
+func (m *managerImpl) scopeFilterToCaller(ctx context.Context, accountID, userID string, module modules.Module, filter types.AgentNetworkAccessLogFilter) (types.AgentNetworkAccessLogFilter, error) {
+	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, module, operations.Read)
+	if err != nil {
+		return filter, status.NewPermissionValidationError(err)
+	}
+	if !ok {
+		filter.UserID = &userID
+		filter.GroupIDs = nil
+	}
+	return filter, nil
+}
+
 // StartAccessLogCleanup launches a background sweep that periodically deletes
 // each account's agent-network access-log rows older than that account's
-// AccessLogRetentionDays. Usage records are never swept. A non-positive
-// interval defaults to 24h.
+// AccessLogRetentionDays, and the consumption counters of deleted accounts.
+// Usage records are never swept. A non-positive interval defaults to 24h.
 func (m *managerImpl) StartAccessLogCleanup(ctx context.Context, cleanupIntervalHours int) {
 	if cleanupIntervalHours <= 0 {
 		cleanupIntervalHours = 24
@@ -732,21 +1365,40 @@ func (m *managerImpl) StartAccessLogCleanup(ctx context.Context, cleanupInterval
 		ticker := time.NewTicker(interval)
 		defer ticker.Stop()
 
-		m.cleanupAccessLogsOnce(ctx) // run once on startup
+		m.cleanupOnce(ctx) // run once on startup
 		for {
 			select {
 			case <-ctx.Done():
 				return
 			case <-ticker.C:
-				m.cleanupAccessLogsOnce(ctx)
+				m.cleanupOnce(ctx)
 			}
 		}
 	}()
 }
 
+func (m *managerImpl) cleanupOnce(ctx context.Context) {
+	m.cleanupAccessLogsOnce(ctx)
+	m.cleanupDeletedAccountConsumption(ctx)
+}
+
+// cleanupDeletedAccountConsumption deletes the consumption counters of accounts
+// that no longer exist. Best-effort: a failure is logged and retried next sweep.
+func (m *managerImpl) cleanupDeletedAccountConsumption(ctx context.Context) {
+	deleted, err := m.store.DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx)
+	if err != nil {
+		log.WithContext(ctx).Warnf("agent-network consumption cleanup: %v", err)
+		return
+	}
+	if deleted > 0 {
+		log.WithContext(ctx).Infof("agent-network consumption cleanup: deleted %d counters of deleted accounts", deleted)
+	}
+}
+
 // cleanupAccessLogsOnce sweeps every account's expired access-log rows against
-// its configured retention. Best-effort: a per-account failure is logged and
-// the sweep continues.
+// its configured retention. Deleted accounts, whose settings rows went with
+// them, get the default retention. Best-effort: a per-account failure is
+// logged and the sweep continues.
 func (m *managerImpl) cleanupAccessLogsOnce(ctx context.Context) {
 	settings, err := m.store.GetAllAgentNetworkSettings(ctx, store.LockingStrengthNone)
 	if err != nil {
@@ -754,18 +1406,31 @@ func (m *managerImpl) cleanupAccessLogsOnce(ctx context.Context) {
 		return
 	}
 	for _, s := range settings {
-		if s.AccessLogRetentionDays <= 0 {
-			continue // keep indefinitely
-		}
-		cutoff := time.Now().UTC().AddDate(0, 0, -s.AccessLogRetentionDays)
-		deleted, err := m.store.DeleteOldAgentNetworkAccessLogs(ctx, s.AccountID, cutoff)
-		if err != nil {
-			log.WithContext(ctx).Warnf("agent-network access-log cleanup for account %s: %v", s.AccountID, err)
-			continue
-		}
-		if deleted > 0 {
-			log.WithContext(ctx).Infof("agent-network access-log cleanup: deleted %d rows for account %s (retention %d days)", deleted, s.AccountID, s.AccessLogRetentionDays)
-		}
+		m.cleanupAccountAccessLogs(ctx, s.AccountID, s.AccessLogRetentionDays)
+	}
+
+	deleted, err := m.store.GetDeletedAccountIDsWithAgentNetworkAccessLogs(ctx)
+	if err != nil {
+		log.WithContext(ctx).Errorf("agent-network access-log cleanup: list deleted accounts: %v", err)
+		return
+	}
+	for _, accountID := range deleted {
+		m.cleanupAccountAccessLogs(ctx, accountID, types.DefaultAccessLogRetentionDays)
+	}
+}
+
+func (m *managerImpl) cleanupAccountAccessLogs(ctx context.Context, accountID string, retentionDays int) {
+	if retentionDays <= 0 {
+		return // keep indefinitely
+	}
+	cutoff := time.Now().UTC().AddDate(0, 0, -retentionDays)
+	deleted, err := m.store.DeleteOldAgentNetworkAccessLogs(ctx, accountID, cutoff)
+	if err != nil {
+		log.WithContext(ctx).Warnf("agent-network access-log cleanup for account %s: %v", accountID, err)
+		return
+	}
+	if deleted > 0 {
+		log.WithContext(ctx).Infof("agent-network access-log cleanup: deleted %d rows for account %s (retention %d days)", deleted, accountID, retentionDays)
 	}
 }
 
@@ -782,8 +1447,8 @@ func (m *managerImpl) RecordConsumption(ctx context.Context, accountID string, k
 	return m.store.IncrementAgentNetworkConsumption(ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
 }
 
-func (m *managerImpl) requirePermission(ctx context.Context, accountID, userID string, op operations.Operation) error {
-	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.AgentNetwork, op)
+func (m *managerImpl) requirePermission(ctx context.Context, accountID, userID string, module modules.Module, op operations.Operation) error {
+	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, module, op)
 	if err != nil {
 		return status.NewPermissionValidationError(err)
 	}
@@ -804,11 +1469,15 @@ func (*mockManager) GetAllProviders(_ context.Context, _, _ string) ([]*types.Pr
 	return []*types.Provider{}, nil
 }
 
+func (*mockManager) DiscoverProviderModels(_ context.Context, _, _ string, _ modeldiscovery.Request, _ string) ([]modeldiscovery.Model, error) {
+	return nil, nil
+}
+
 func (*mockManager) GetProvider(_ context.Context, _, _, _ string) (*types.Provider, error) {
 	return &types.Provider{}, nil
 }
 
-func (*mockManager) CreateProvider(_ context.Context, _ string, p *types.Provider, _ string) (*types.Provider, error) {
+func (*mockManager) CreateProvider(_ context.Context, _ string, p *types.Provider) (*types.Provider, error) {
 	return p, nil
 }
 
@@ -872,14 +1541,27 @@ func (*mockManager) UpdateBudgetRule(_ context.Context, _ string, r *types.Accou
 
 func (*mockManager) DeleteBudgetRule(_ context.Context, _, _, _ string) error { return nil }
 
-func (*mockManager) GetSettings(_ context.Context, _, _ string) (*types.Settings, error) {
-	return nil, status.Errorf(status.NotFound, "agent network settings not found")
+func (*mockManager) GetSettings(_ context.Context, accountID, _ string) (*types.Settings, error) {
+	return types.DefaultSettings(accountID), nil
+}
+
+func (*mockManager) CreateSettings(_ context.Context, _ string, s *types.Settings, proxyAddress, endpoint string) (*types.Settings, error) {
+	if endpoint != "" {
+		s.Domain = endpoint
+		s.ProxyAddress = endpoint
+	} else {
+		s.Domain = "mock." + proxyAddress
+		s.ProxyAddress = proxyAddress
+	}
+	return s, nil
 }
 
 func (*mockManager) UpdateSettings(_ context.Context, _ string, s *types.Settings) (*types.Settings, error) {
 	return s, nil
 }
 
+func (*mockManager) DeleteSettings(_ context.Context, _, _ string) error { return nil }
+
 func (*mockManager) ListConsumption(_ context.Context, _, _ string) ([]*types.Consumption, error) {
 	return nil, nil
 }
@@ -898,6 +1580,8 @@ func (*mockManager) GetUsageOverview(_ context.Context, _, _ string, _ types.Age
 
 func (*mockManager) StartAccessLogCleanup(_ context.Context, _ int) {}
 
+func (*mockManager) RemoveAccountGateway(_ context.Context, _ string) error { return nil }
+
 func (*mockManager) RecordConsumption(_ context.Context, _ string, _ types.ConsumptionDimension, _ string, _, _, _ int64, _ float64) error {
 	return nil
 }
diff --git a/management/internals/modules/agentnetwork/modeldiscovery/discovery.go b/management/internals/modules/agentnetwork/modeldiscovery/discovery.go
new file mode 100644
index 000000000..d9779a084
--- /dev/null
+++ b/management/internals/modules/agentnetwork/modeldiscovery/discovery.go
@@ -0,0 +1,521 @@
+// Package modeldiscovery asks a vendor which models an operator's own
+// credential can reach, so the provider form can offer a live list instead of
+// only the catalog's hand-curated one.
+//
+// The catalog cannot know two things that matter. It goes stale — its entries
+// carry comments tracking which models a vendor retired on which date — and it
+// cannot see an account: which OpenAI models an org is entitled to, which
+// Bedrock inference profiles a given account and region hold, which Vertex
+// models a project has enabled. Those are exactly the facts an operator needs
+// when filling in a provider record, and only the vendor has them.
+//
+// The vendor is authoritative for the model ID. The catalog remains
+// authoritative for pricing, and a discovered model the catalog cannot price
+// is reported as such rather than silently registered at a rate of zero.
+package modeldiscovery
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strings"
+	"syscall"
+	"time"
+
+	"golang.org/x/oauth2/google"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
+)
+
+const (
+	// fetchTimeout bounds one vendor call end to end. A listing is a single
+	// small GET; anything slower is a vendor problem and the operator is
+	// waiting on a form.
+	fetchTimeout = 8 * time.Second
+	// maxListingBytes bounds the response we will buffer. The largest real
+	// listing observed is Bedrock's foundation-model catalogue at ~70KB, so
+	// this is a wide margin over anything legitimate.
+	maxListingBytes = 2 << 20
+	// gcpScope matches the scope llm_router mints Vertex tokens under, so a
+	// credential that works for discovery works for inference too.
+	gcpScope = "https://www.googleapis.com/auth/cloud-platform"
+	// vertexKeyfilePrefix marks an api_key that is a base64 service-account
+	// JSON key rather than a bearer token.
+	vertexKeyfilePrefix = "keyfile::"
+)
+
+// ErrNoDiscovery is returned for a catalog entry that declares no listing
+// endpoint. The caller should fall back to the catalog list plus free-text
+// entry rather than treating this as a failure.
+var ErrNoDiscovery = errors.New("provider has no model-discovery endpoint")
+
+// ErrInvalidRequest marks a discovery failure caused by the caller's own input
+// rather than by the vendor or by this server. Every one of these is reachable
+// from a well-formed request carrying a bad field value, so the handler owes
+// the caller a 400 — a 500 would both misinform them and bury real server
+// faults in the error rate.
+var ErrInvalidRequest = errors.New("invalid discovery request")
+
+// Model is one discovered model.
+type Model struct {
+	// ID is the identifier to register on the provider record, in the form the
+	// vendor issues it. For Bedrock that is the region-prefixed inference
+	// profile id, which is the only form AWS accepts at invoke time.
+	ID string
+	// Label is the vendor's display name where it supplies one.
+	Label string
+	// PricingKnown reports whether the shipped pricing table can price this
+	// model. False means the operator must set rates, or the request would
+	// meter at zero.
+	PricingKnown bool
+	// The rates below are the defaults for this model, taken from the same
+	// table the proxy bills with, so the form prefills exactly what a request
+	// would cost. All zero when PricingKnown is false — an unpriced model is
+	// offered at zero and flagged, rather than withheld: the vendor says the
+	// credential can reach it, and refusing to show it would hide a model the
+	// operator genuinely has.
+	InputPer1k         float64
+	OutputPer1k        float64
+	CachedInputPer1k   float64
+	CacheReadPer1k     float64
+	CacheCreationPer1k float64
+}
+
+// Request identifies which vendor to ask and with what credential.
+type Request struct {
+	// CatalogID selects the catalog entry, which supplies the endpoint, the
+	// auth header and the response shape. The caller never supplies those.
+	CatalogID string
+	// UpstreamURL is the provider record's configured upstream. It is used
+	// only when the catalog entry declares no discovery host of its own.
+	UpstreamURL string
+	// Region substitutes the catalog host's <region> placeholder.
+	Region string
+	// APIKey is the operator's credential, exactly as stored on the record.
+	APIKey string
+}
+
+// Client fetches model listings. The zero value is usable; Resolver and
+// HTTPClient exist so tests can drive it against a local server.
+type Client struct {
+	HTTPClient *http.Client
+	// Resolver looks up the host for the SSRF check. Nil uses the default.
+	Resolver *net.Resolver
+	// AllowPrivateHosts disables the private-address guard. Only tests set it:
+	// their server is on loopback, which is precisely what the guard blocks.
+	AllowPrivateHosts bool
+}
+
+// Fetch returns the models the credential can reach.
+func (c *Client) Fetch(ctx context.Context, req Request) ([]Model, error) {
+	entry, ok := catalog.Lookup(req.CatalogID)
+	if !ok {
+		return nil, fmt.Errorf("%w: unknown catalog provider %q", ErrInvalidRequest, req.CatalogID)
+	}
+	if entry.Discovery == nil {
+		return nil, ErrNoDiscovery
+	}
+
+	// One deadline over the whole operation. Both host lookups and the request
+	// itself run under it, so a vendor cannot be slow twice, and a caller that
+	// gives up is not left waiting on a resolver.
+	ctx, cancel := context.WithTimeout(ctx, fetchTimeout)
+	defer cancel()
+
+	// An entry with a listing host of its own answers from somewhere other
+	// than the upstream on the record — Bedrock lists from the control plane
+	// and infers on the runtime host. Reaching the listing therefore proves
+	// nothing about the host requests will actually go to, so that one is
+	// checked separately or not at all.
+	if entry.Discovery.Host != "" {
+		if err := c.checkUpstreamHost(ctx, entry, req.UpstreamURL); err != nil {
+			return nil, err
+		}
+	}
+
+	endpoint, err := c.discoveryURL(ctx, entry, req)
+	if err != nil {
+		return nil, err
+	}
+
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("build discovery request: %w", err)
+	}
+	if err := applyAuth(httpReq, entry, req.APIKey); err != nil {
+		return nil, err
+	}
+	for name, value := range entry.Discovery.Headers {
+		httpReq.Header.Set(name, value)
+	}
+	httpReq.Header.Set("Accept", "application/json")
+
+	resp, err := c.httpClient().Do(httpReq)
+	if err != nil {
+		return nil, &UnreachableError{Provider: entry.Name, Err: err}
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxListingBytes))
+	if err != nil {
+		return nil, fmt.Errorf("read %s listing: %w", entry.Name, err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		// Surface the vendor's own status. An operator whose key lacks a scope
+		// needs to see 403 rather than a generic failure.
+		return nil, &VendorStatusError{Provider: entry.Name, Status: resp.StatusCode}
+	}
+
+	ids, err := parseListing(entry.Discovery.Shape, body)
+	if err != nil {
+		return nil, err
+	}
+	return decorate(entry, ids), nil
+}
+
+// discoveryURL builds the listing URL and refuses one that does not point at a
+// public host.
+//
+// The path, query and (for Bedrock) the host all come from the catalog rather
+// than from the caller, so the only operator-controlled part is the host of an
+// entry whose listing lives on its own upstream. That still has to be checked:
+// management holds credentials for every provider, and an upstream pointed at
+// an internal address would turn this endpoint into a probe of the management
+// server's own network.
+func (c *Client) discoveryURL(ctx context.Context, entry catalog.Provider, req Request) (string, error) {
+	host := entry.Discovery.Host
+	if host == "" {
+		parsed, err := url.Parse(strings.TrimSpace(req.UpstreamURL))
+		if err != nil || parsed.Host == "" {
+			// The URL is left out of the message on purpose: it reaches the
+			// operator through an endpoint that does not lowercase it, but the
+			// rest of this feature's copy never echoes what they typed, and one
+			// path that does is the one that ends up quoted in a bug report.
+			return "", fmt.Errorf("%w: the provider upstream is not a usable URL", ErrInvalidRequest)
+		}
+		host = parsed.Host
+	}
+	if strings.Contains(host, catalog.RegionPlaceholder) {
+		region := strings.TrimSpace(req.Region)
+		if region == "" {
+			// A provider record carries no region field: the region lives
+			// inside the upstream host the operator already configured, so
+			// read it back out rather than asking them for it twice.
+			region = RegionFromUpstream(entry, req.UpstreamURL)
+		}
+		if region == "" {
+			return "", fmt.Errorf("%w: %w: %s discovery needs a region, and none could be read from the provider upstream",
+				ErrInvalidRequest, ErrNoDiscoveryHost, entry.Name)
+		}
+		host = strings.ReplaceAll(host, catalog.RegionPlaceholder, region)
+	}
+
+	target := &url.URL{Scheme: "https", Host: host, Path: entry.Discovery.Path, RawQuery: entry.Discovery.Query}
+	if err := c.classifyHost(ctx, entry, target.Hostname()); err != nil {
+		return "", err
+	}
+	return target.String(), nil
+}
+
+// checkUpstreamHost verifies the host the operator configured, for entries
+// whose listing lives elsewhere and so cannot vouch for it.
+//
+// A name that does not resolve is the record being wrong. One that resolves
+// privately is not: an upstream behind a proxy is a supported configuration,
+// and ErrPrivateHost carries that difference on to the caller, which treats it
+// as unverifiable rather than as a failure.
+func (c *Client) checkUpstreamHost(ctx context.Context, entry catalog.Provider, upstreamURL string) error {
+	parsed, err := url.Parse(strings.TrimSpace(upstreamURL))
+	if err != nil || parsed.Hostname() == "" {
+		return fmt.Errorf("%w: the provider upstream is not a usable URL", ErrInvalidRequest)
+	}
+	return c.classifyHost(ctx, entry, parsed.Hostname())
+}
+
+// classifyHost renders a failed host check as the two outcomes the caller
+// distinguishes. A host that refuses to resolve is the commonest way for an
+// upstream to be wrong and has to arrive as unreachable rather than as an
+// unclassified fault. ErrPrivateHost means something else entirely — not a bad
+// host, one we decline to dial.
+func (c *Client) classifyHost(ctx context.Context, entry catalog.Provider, host string) error {
+	err := c.checkPublicHost(ctx, host)
+	if err == nil || errors.Is(err, ErrPrivateHost) {
+		return err
+	}
+	return &UnreachableError{Provider: entry.Name, Err: err}
+}
+
+// RegionFromUpstream recovers the region an operator embedded in the provider
+// upstream, by matching it against the catalog's own host template. Bedrock's
+// template is "bedrock-runtime.<region>.amazonaws.com" and Vertex's is
+// "<region>-aiplatform.googleapis.com", so the region is whatever sits between
+// the fixed halves. Returns empty when the upstream does not match the
+// template, which is the case for a custom or proxied endpoint.
+func RegionFromUpstream(entry catalog.Provider, upstreamURL string) string {
+	prefix, suffix, found := strings.Cut(entry.DefaultHost, catalog.RegionPlaceholder)
+	if !found {
+		return ""
+	}
+	parsed, err := url.Parse(strings.TrimSpace(upstreamURL))
+	if err != nil {
+		return ""
+	}
+	host := parsed.Hostname()
+	if host == "" {
+		// A bare host with no scheme parses as a path, not a host.
+		host = strings.TrimSpace(upstreamURL)
+	}
+	// The two halves must not overlap. "bedrock-runtime.amazonaws.com" carries
+	// both of Bedrock's — it is the regionless endpoint — and satisfies both
+	// checks above while leaving nothing between them, so slicing it would
+	// panic on an inverted range rather than report "no region here".
+	if !strings.HasPrefix(host, prefix) || !strings.HasSuffix(host, suffix) ||
+		len(host) < len(prefix)+len(suffix) {
+		return ""
+	}
+	region := host[len(prefix) : len(host)-len(suffix)]
+	if region == "" || strings.Contains(region, ".") {
+		return ""
+	}
+	return region
+}
+
+// checkPublicHost refuses hosts that resolve to an address the management
+// server should never be asked to reach on an operator's behalf.
+func (c *Client) checkPublicHost(ctx context.Context, host string) error {
+	if c.AllowPrivateHosts {
+		return nil
+	}
+	if host == "" {
+		return errors.New("discovery host is empty")
+	}
+	resolver := c.Resolver
+	if resolver == nil {
+		resolver = net.DefaultResolver
+	}
+	addrs, err := resolver.LookupNetIP(ctx, "ip", host)
+	if err != nil {
+		return fmt.Errorf("resolve discovery host %q: %w", host, err)
+	}
+	// Every address must be public: a name that resolves to one public and one
+	// loopback address is still a way to reach loopback.
+	for _, addr := range addrs {
+		if !isPublic(addr) {
+			return fmt.Errorf("%w: %w: discovery host %q resolves to a non-public address", ErrInvalidRequest, ErrPrivateHost, host)
+		}
+	}
+	return nil
+}
+
+// isPublic reports whether an address is one we are willing to dial.
+func isPublic(addr netip.Addr) bool {
+	addr = addr.Unmap()
+	switch {
+	case !addr.IsValid(),
+		addr.IsLoopback(),
+		addr.IsPrivate(),
+		addr.IsLinkLocalUnicast(),
+		addr.IsLinkLocalMulticast(),
+		addr.IsInterfaceLocalMulticast(),
+		addr.IsMulticast(),
+		addr.IsUnspecified():
+		return false
+	}
+	// 100.64.0.0/10 (carrier NAT) is where NetBird's own overlay addresses
+	// live, so it is emphatically not somewhere to send a provider credential.
+	if addr.Is4() {
+		b := addr.As4()
+		if b[0] == 100 && b[1] >= 64 && b[1] <= 127 {
+			return false
+		}
+	}
+	return true
+}
+
+// applyAuth sets the credential header the catalog entry declares. A Vertex
+// service-account key is exchanged for an OAuth token first, the same way the
+// proxy does at request time.
+func applyAuth(req *http.Request, entry catalog.Provider, apiKey string) error {
+	key := strings.TrimSpace(apiKey)
+	if key == "" {
+		return fmt.Errorf("%w: %s discovery needs an API key", ErrInvalidRequest, entry.Name)
+	}
+	if rest, ok := strings.CutPrefix(key, vertexKeyfilePrefix); ok {
+		token, err := mintGCPToken(req.Context(), rest)
+		if err != nil {
+			return err
+		}
+		key = token
+	}
+	name := entry.AuthHeaderName
+	if name == "" {
+		name = "Authorization"
+	}
+	template := entry.AuthHeaderTemplate
+	if template == "" {
+		template = "${API_KEY}"
+	}
+	req.Header.Set(name, strings.ReplaceAll(template, "${API_KEY}", key))
+	return nil
+}
+
+// mintGCPToken exchanges a base64 service-account key for an access token.
+func mintGCPToken(ctx context.Context, saKeyB64 string) (string, error) {
+	jsonKey, err := base64.StdEncoding.DecodeString(strings.TrimSpace(saKeyB64))
+	if err != nil {
+		return "", fmt.Errorf("decode service-account key: %w", err)
+	}
+	conf, err := google.JWTConfigFromJSON(jsonKey, gcpScope)
+	if err != nil {
+		return "", fmt.Errorf("parse service-account key: %w", err)
+	}
+	tok, err := conf.TokenSource(ctx).Token()
+	if err != nil {
+		return "", fmt.Errorf("mint gcp token: %w", err)
+	}
+	return tok.AccessToken, nil
+}
+
+// decorate turns raw vendor ids into the models the caller renders, attaching
+// the rates the request would actually be billed at.
+//
+// Rates come from the live default pricing table rather than the compiled-in
+// catalog, because that is the table the synthesiser ships to the proxy: an
+// operator running a defaults_llm_pricing.yaml would otherwise be shown one
+// price in the form and charged another. It is also the same lookup the catalog
+// endpoint prefills from, so a model reached by either route prices identically.
+func decorate(entry catalog.Provider, ids []listedModel) []Model {
+	out := make([]Model, 0, len(ids))
+	seen := make(map[string]struct{}, len(ids))
+	for _, listed := range ids {
+		if listed.id == "" {
+			continue
+		}
+		if entry.Discovery.ExactModelsOnly && strings.Contains(listed.id, "*") {
+			continue
+		}
+		if _, dup := seen[listed.id]; dup {
+			continue
+		}
+		seen[listed.id] = struct{}{}
+
+		// The table keys pricing by the normalised id while the vendor issues
+		// the wire form, so normalise before looking it up — otherwise every
+		// Bedrock profile would report unpriced.
+		model := Model{ID: listed.id, Label: listed.label}
+		if rate, known := pricing.LookupDefault(entry.PricingSurfaces, normalizeForPricing(entry.ID, listed.id)); known {
+			model.PricingKnown = true
+			model.InputPer1k = rate.InputPer1k
+			model.OutputPer1k = rate.OutputPer1k
+			model.CachedInputPer1k = rate.CachedInputPer1k
+			model.CacheReadPer1k = rate.CacheReadPer1k
+			model.CacheCreationPer1k = rate.CacheCreationPer1k
+		}
+		out = append(out, model)
+	}
+	return out
+}
+
+// refuseRedirect is the redirect policy every discovery request runs under. A
+// redirect is a way to move the request to a host checkPublicHost never saw,
+// so none are followed.
+func refuseRedirect(*http.Request, []*http.Request) error {
+	return http.ErrUseLastResponse
+}
+
+func (c *Client) httpClient() *http.Client {
+	if c.HTTPClient != nil {
+		if c.HTTPClient.CheckRedirect != nil {
+			return c.HTTPClient
+		}
+		// An injected client that states no policy still gets ours: the
+		// no-redirect guarantee should not depend on the caller remembering it.
+		//
+		// Copied rather than assigned into: one Client is shared by every
+		// request for the process's lifetime, so writing to its fields here
+		// would race across request goroutines. The copy shares the Transport,
+		// which is safe for concurrent use by design.
+		clone := *c.HTTPClient
+		clone.CheckRedirect = refuseRedirect
+		return &clone
+	}
+	transport := guardedTransport
+	if c.AllowPrivateHosts {
+		transport = http.DefaultTransport
+	}
+	return &http.Client{
+		Timeout:       fetchTimeout,
+		Transport:     transport,
+		CheckRedirect: refuseRedirect,
+	}
+}
+
+// guardedTransport dials only addresses isPublic accepts.
+//
+// checkPublicHost resolves the host itself, and the transport then resolves it
+// again when it dials — two lookups of a name whose owner chooses the answers.
+// A record that returns a public address to the first and 127.0.0.1 to the
+// second passes the guard and reaches loopback anyway, which is the whole of
+// DNS rebinding. Re-checking at the socket closes that window: whatever the
+// second lookup returned is what Control is handed, and an address the guard
+// refuses never gets connected.
+//
+// Shared package-wide rather than built per Fetch so connections and their
+// pool survive between calls; the guard holds no state.
+var guardedTransport = newGuardedTransport()
+
+func newGuardedTransport() http.RoundTripper {
+	base, ok := http.DefaultTransport.(*http.Transport)
+	if !ok {
+		// Something replaced the default transport. Fall back to it rather
+		// than dropping its behaviour, and rely on checkPublicHost alone.
+		return http.DefaultTransport
+	}
+	// Cloned so proxy settings, TLS defaults and timeouts come from the
+	// standard transport rather than being restated here.
+	transport := base.Clone()
+	dialer := &net.Dialer{
+		Timeout:   fetchTimeout,
+		KeepAlive: 30 * time.Second,
+		Control: func(_, address string, _ syscall.RawConn) error {
+			return guardDialAddress(address)
+		},
+	}
+	transport.DialContext = dialer.DialContext
+	return transport
+}
+
+// guardDialAddress refuses a resolved socket address the discovery client has
+// no business connecting to. Control hands it over post-resolution and
+// pre-connect, once per address the dialer tries, so a name with several A
+// records is checked at each one.
+func guardDialAddress(address string) error {
+	host, _, err := net.SplitHostPort(address)
+	if err != nil {
+		return fmt.Errorf("discovery dial address %q is unreadable", address)
+	}
+	addr, err := netip.ParseAddr(host)
+	if err != nil {
+		// Control is documented to receive a resolved address; anything else
+		// is a state we cannot vet, so it does not get dialled.
+		return fmt.Errorf("discovery dial address %q is not an IP", host)
+	}
+	if !isPublic(addr) {
+		// Deliberately not ErrPrivateHost, which means "this upstream is on a
+		// private network, so we cannot check it" and lets a save through
+		// unchecked. checkPublicHost has already cleared the target by the
+		// time anything is dialled, so an address refused here is not the
+		// operator's upstream: it is a rebinding attempt, or an HTTP proxy in
+		// the path. Neither may quietly skip the check — one is hostile, and
+		// the other would silently disable this on every provider.
+		return fmt.Errorf("discovery refused to dial non-public address %s", addr)
+	}
+	return nil
+}
diff --git a/management/internals/modules/agentnetwork/modeldiscovery/discovery_test.go b/management/internals/modules/agentnetwork/modeldiscovery/discovery_test.go
new file mode 100644
index 000000000..62b34e754
--- /dev/null
+++ b/management/internals/modules/agentnetwork/modeldiscovery/discovery_test.go
@@ -0,0 +1,678 @@
+package modeldiscovery
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
+)
+
+// stubTransport answers every request with one canned response and records the
+// request it was given, so a test can assert on the URL and headers the client
+// built without a network round trip.
+type stubTransport struct {
+	status int
+	body   string
+	got    *http.Request
+}
+
+func (s *stubTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	s.got = req
+	status := s.status
+	if status == 0 {
+		status = http.StatusOK
+	}
+	return &http.Response{
+		StatusCode: status,
+		Body:       io.NopCloser(strings.NewReader(s.body)),
+		Header:     http.Header{"Content-Type": []string{"application/json"}},
+		Request:    req,
+	}, nil
+}
+
+// newStubClient returns a client that never leaves the process. The host guard
+// is disabled because it would otherwise resolve the vendor's real name, which
+// would make these tests depend on DNS.
+func newStubClient(status int, body string) (*Client, *stubTransport) {
+	tr := &stubTransport{status: status, body: body}
+	return &Client{
+		HTTPClient:        &http.Client{Transport: tr},
+		AllowPrivateHosts: true,
+	}, tr
+}
+
+// The payloads below are trimmed from what the vendors actually returned in
+// the discovery e2e, rather than invented, so a parser that only works against
+// an idealised shape fails here.
+
+const openAIListing = `{"object":"list","data":[
+  {"id":"gpt-4o-mini","object":"model","created":1721172741,"owned_by":"system"},
+  {"id":"gpt-4o","object":"model","created":1715367049,"owned_by":"system"}
+]}`
+
+const agentgatewayListing = `{"object":"list","data":[
+  {"id":"gpt-4o-mini","object":"model","created":1785166485,"owned_by":"openai"},
+  {"id":"claude-haiku-4-5","object":"model","created":1785166485,"owned_by":"anthropic"},
+  {"id":"openai/*","object":"model","created":1785166485,"owned_by":"openai"},
+  {"id":"*-latest","object":"model","created":1785166485,"owned_by":"openai"}
+]}`
+
+const anthropicListing = `{"data":[
+  {"type":"model","id":"claude-haiku-4-5-20251001","display_name":"Claude Haiku 4.5"},
+  {"type":"model","id":"claude-sonnet-4-6","display_name":"Claude Sonnet 4.6"}
+],"has_more":false}`
+
+const bedrockListing = `{"inferenceProfileSummaries":[
+  {"inferenceProfileId":"eu.anthropic.claude-haiku-4-5-20251001-v1:0",
+   "inferenceProfileName":"EU Anthropic Claude Haiku 4.5","status":"ACTIVE","type":"SYSTEM_DEFINED"},
+  {"inferenceProfileId":"global.cohere.embed-v4:0",
+   "inferenceProfileName":"Global Cohere Embed v4","status":"ACTIVE","type":"SYSTEM_DEFINED"},
+  {"inferenceProfileId":"eu.meta.llama3-2-1b-instruct-v1:0",
+   "inferenceProfileName":"EU Meta Llama 3.2 1B","status":"INACTIVE","type":"SYSTEM_DEFINED"}
+]}`
+
+const vertexListing = `{"publisherModels":[
+  {"name":"publishers/anthropic/models/claude-3-opus","versionId":"20240229","launchStage":"GA"},
+  {"name":"publishers/anthropic/models/claude-sonnet-4-5","versionId":"20250929","launchStage":"GA"}
+]}`
+
+func TestFetchOpenAIListing(t *testing.T) {
+	cl, tr := newStubClient(http.StatusOK, openAIListing)
+
+	models, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "openai_api",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-test",
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, "https://api.openai.com/v1/models", tr.got.URL.String())
+	assert.Equal(t, "Bearer sk-test", tr.got.Header.Get("Authorization"),
+		"the credential must be injected through the catalog's auth template")
+	assert.Equal(t, []string{"gpt-4o-mini", "gpt-4o"}, ids(models))
+	for _, m := range models {
+		assert.True(t, m.PricingKnown, "both models are in the shipped catalog: %s", m.ID)
+	}
+}
+
+func TestFetchAgentgatewayListing(t *testing.T) {
+	cl, tr := newStubClient(http.StatusOK, agentgatewayListing)
+
+	models, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "agentgateway",
+		UpstreamURL: "https://gateway.example.com",
+		APIKey:      "virtual-key",
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, "https://gateway.example.com/v1/models", tr.got.URL.String())
+	assert.Equal(t, "Bearer virtual-key", tr.got.Header.Get("Authorization"),
+		"agentgateway model discovery must use the configured virtual key")
+	assert.Equal(t, []string{"gpt-4o-mini", "claude-haiku-4-5"}, ids(models),
+		"model patterns must not be offered as exact NetBird authorization rows")
+	for _, m := range models {
+		assert.True(t, m.PricingKnown, "known upstream model must use NetBird catalog pricing: %s", m.ID)
+	}
+}
+
+func TestFetchAnthropicSendsTheVersionHeader(t *testing.T) {
+	cl, tr := newStubClient(http.StatusOK, anthropicListing)
+
+	models, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "anthropic_api",
+		UpstreamURL: "https://api.anthropic.com",
+		APIKey:      "sk-ant-test",
+	})
+	require.NoError(t, err)
+
+	// Anthropic rejects a request without the version header, so a listing
+	// that reached us at all proves it was sent — but assert it, because the
+	// failure mode otherwise only shows up against the live API.
+	assert.Equal(t, "2023-06-01", tr.got.Header.Get("anthropic-version"))
+	assert.Equal(t, "sk-ant-test", tr.got.Header.Get("x-api-key"),
+		"Anthropic takes a bare key under its own header, not a Bearer token")
+	assert.Equal(t, "limit=1000", tr.got.URL.RawQuery)
+
+	assert.Equal(t, []string{"claude-haiku-4-5-20251001", "claude-sonnet-4-6"}, ids(models))
+	assert.Equal(t, "Claude Haiku 4.5", models[0].Label)
+}
+
+func TestFetchBedrockUsesTheControlPlaneAndKeepsWireIDs(t *testing.T) {
+	cl, tr := newStubClient(http.StatusOK, bedrockListing)
+
+	models, err := cl.Fetch(context.Background(), Request{
+		CatalogID: "bedrock_api",
+		// The record's upstream is the RUNTIME host, which does not serve
+		// listings. The catalog's own discovery host must win over it.
+		UpstreamURL: "https://bedrock-runtime.eu-central-1.amazonaws.com",
+		Region:      "eu-central-1",
+		APIKey:      "aws-bearer",
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, "https://bedrock.eu-central-1.amazonaws.com/inference-profiles",
+		tr.got.URL.String(), "listings come from the control plane, not the runtime host")
+
+	// Region-prefixed ids verbatim: the prefix is what makes them invocable
+	// and it cannot be reconstructed — global.* alongside eu.* is exactly the
+	// case that defeats deriving it from the configured region.
+	assert.Equal(t, []string{
+		"eu.anthropic.claude-haiku-4-5-20251001-v1:0",
+		"global.cohere.embed-v4:0",
+	}, ids(models), "an INACTIVE profile must not be offered")
+
+	assert.True(t, models[0].PricingKnown,
+		"the catalog prices anthropic.claude-haiku-4-5, which this id normalises to")
+	assert.False(t, models[1].PricingKnown,
+		"cohere embed is not in the shipped Bedrock catalog, so the operator must price it")
+
+	// The rates travel with the model, so the form can prefill an editable row
+	// rather than making the operator look every price up by hand.
+	assert.Positive(t, models[0].InputPer1k, "a priced model must carry its input rate")
+	assert.Positive(t, models[0].OutputPer1k, "a priced model must carry its output rate")
+	// An unpriced model is offered at zero and flagged, not withheld: the
+	// vendor says the credential can reach it.
+	assert.Zero(t, models[1].InputPer1k)
+	assert.Zero(t, models[1].OutputPer1k)
+}
+
+// TestDiscoveredRatesMatchTheCatalogEndpoint pins the two prefill paths to one
+// table. The provider form fills a model row either from the catalog response
+// or from a discovery response, and an operator who switches between them must
+// not see the price change — both must equal what the proxy will bill.
+func TestDiscoveredRatesMatchTheCatalogEndpoint(t *testing.T) {
+	cl, _ := newStubClient(http.StatusOK, openAIListing)
+
+	models, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "openai_api",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-test",
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, models)
+
+	entry, ok := catalog.Lookup("openai_api")
+	require.True(t, ok)
+
+	for _, m := range models {
+		want, known := pricing.LookupDefault(entry.PricingSurfaces, m.ID)
+		require.True(t, known, "%s should be priced by the default table", m.ID)
+		assert.Equal(t, want.InputPer1k, m.InputPer1k, "input rate for %s", m.ID)
+		assert.Equal(t, want.OutputPer1k, m.OutputPer1k, "output rate for %s", m.ID)
+		assert.Equal(t, want.CachedInputPer1k, m.CachedInputPer1k, "cached-input rate for %s", m.ID)
+	}
+}
+
+func TestFetchVertexJoinsNameAndVersion(t *testing.T) {
+	cl, _ := newStubClient(http.StatusOK, vertexListing)
+
+	models, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "vertex_ai_api",
+		UpstreamURL: "https://us-east5-aiplatform.googleapis.com",
+		Region:      "us-east5",
+		APIKey:      "ya29.test-token",
+	})
+	require.NoError(t, err)
+
+	// Vertex addresses a model as "<id>@<version>" on rawPredict, and splits
+	// those across two fields in the listing.
+	assert.Equal(t, []string{"claude-3-opus@20240229", "claude-sonnet-4-5@20250929"}, ids(models))
+	assert.Equal(t, "claude-3-opus", models[0].Label)
+}
+
+func TestFetchSurfacesTheVendorStatus(t *testing.T) {
+	cl, _ := newStubClient(http.StatusForbidden, `{"error":{"message":"no access"}}`)
+
+	_, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "openai_api",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-test",
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "403",
+		"an operator whose key lacks access needs to see which status the vendor returned")
+}
+
+func TestFetchRejectsAProviderWithoutDiscovery(t *testing.T) {
+	cl, _ := newStubClient(http.StatusOK, openAIListing)
+
+	_, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "litellm_proxy",
+		UpstreamURL: "https://gateway.example.com",
+		APIKey:      "sk-test",
+	})
+	assert.ErrorIs(t, err, ErrNoDiscovery,
+		"a gateway with no listing endpoint must be distinguishable from a failure, so the caller can fall back")
+}
+
+func TestFetchRequiresACredential(t *testing.T) {
+	cl, _ := newStubClient(http.StatusOK, openAIListing)
+
+	_, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "openai_api",
+		UpstreamURL: "https://api.openai.com",
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "API key")
+}
+
+func TestDiscoveryURLNeedsARegionWhenTheHostTemplatesOne(t *testing.T) {
+	cl, _ := newStubClient(http.StatusOK, bedrockListing)
+
+	// An upstream that matches no catalog template — a proxy in front of
+	// Bedrock, say — leaves nothing to read the region from. Refusing beats
+	// guessing: an unsubstituted placeholder would dial a host that does not
+	// exist, and a guessed region would dial the wrong account's endpoint.
+	_, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "bedrock_api",
+		UpstreamURL: "https://bedrock.internal-proxy.example.com",
+		APIKey:      "aws-bearer",
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "region")
+}
+
+// TestHostGuardRejectsNonPublicAddresses is the SSRF guard. Management holds a
+// credential for every provider, so an upstream pointed at an internal address
+// would turn discovery into a way to probe — and hand a token to — the
+// management server's own network.
+func TestHostGuardRejectsNonPublicAddresses(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		addr string
+		want bool
+	}{
+		{"loopback v4", "127.0.0.1", false},
+		{"loopback v6", "::1", false},
+		{"private 10/8", "10.0.0.5", false},
+		{"private 172.16/12", "172.16.4.1", false},
+		{"private 192.168/16", "192.168.1.1", false},
+		{"link-local", "169.254.169.254", false}, // cloud metadata
+		{"unspecified", "0.0.0.0", false},
+		{"multicast", "224.0.0.1", false},
+		{"netbird overlay 100.64/10", "100.90.1.2", false},
+		{"v4-mapped loopback", "::ffff:127.0.0.1", false},
+		{"public v4", "1.1.1.1", true},
+		{"public v6", "2606:4700:4700::1111", true},
+		{"just outside CGNAT", "100.128.0.1", true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			addr, err := netip.ParseAddr(tc.addr)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, isPublic(addr))
+		})
+	}
+}
+
+func TestHostGuardResolvesAndRejectsLocalhost(t *testing.T) {
+	cl := &Client{}
+	err := cl.checkPublicHost(context.Background(), "localhost")
+	require.Error(t, err, "a name resolving to loopback must be refused, not just a literal address")
+	assert.Contains(t, err.Error(), "non-public")
+}
+
+// TestRedirectsAreNotFollowed covers a gap the other tests leave open: they all
+// inject an HTTPClient, which bypasses httpClient() and therefore the redirect
+// policy entirely. The policy is a security control — a 302 moves the request
+// to a host checkPublicHost never resolved — so it needs a test that goes
+// through the constructor the manager actually uses.
+func TestRedirectsAreNotFollowed(t *testing.T) {
+	var hits int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits++
+		http.Redirect(w, r, "http://169.254.169.254/latest/meta-data/", http.StatusFound)
+	}))
+	t.Cleanup(srv.Close)
+
+	for name, cl := range map[string]*Client{
+		// The production shape: no injected client at all.
+		"default client": {AllowPrivateHosts: true},
+		// An injected client that states no policy must inherit ours rather
+		// than silently chasing the redirect.
+		"injected client with no policy": {
+			AllowPrivateHosts: true,
+			HTTPClient:        &http.Client{},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			hits = 0
+			req, err := http.NewRequest(http.MethodGet, srv.URL, nil)
+			require.NoError(t, err)
+
+			resp, err := cl.httpClient().Do(req)
+			require.NoError(t, err)
+			t.Cleanup(func() { _ = resp.Body.Close() })
+
+			assert.Equal(t, http.StatusFound, resp.StatusCode,
+				"the redirect must be surfaced, not followed to an unchecked host")
+			assert.Equal(t, 1, hits, "exactly one request must leave the client")
+		})
+	}
+}
+
+// TestInjectedClientKeepsItsOwnRedirectPolicy pins that the default above is a
+// default, not an override, and that supplying it does not mutate the caller's
+// client — one Client is shared across every request, so a write here would
+// race.
+func TestInjectedClientKeepsItsOwnRedirectPolicy(t *testing.T) {
+	own := func(*http.Request, []*http.Request) error { return nil }
+	injected := &http.Client{CheckRedirect: own}
+	cl := &Client{HTTPClient: injected}
+
+	assert.Same(t, injected, cl.httpClient(),
+		"a client that states a policy must be handed back untouched")
+
+	bare := &http.Client{}
+	cl = &Client{HTTPClient: bare}
+	require.NotSame(t, bare, cl.httpClient(), "the policy must be applied to a copy")
+	assert.Nil(t, bare.CheckRedirect, "the caller's client must not be written to")
+}
+
+// TestDialGuardRejectsRebindingToANonPublicAddress covers the window between
+// the two DNS lookups. checkPublicHost resolves the host, then the transport
+// resolves it again to dial; a name whose owner answers the first with a public
+// address and the second with 127.0.0.1 would otherwise pass the guard and
+// still reach loopback. The dial-time check sees whatever the second lookup
+// actually returned.
+func TestDialGuardRejectsRebindingToANonPublicAddress(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		address string
+		wantErr string
+	}{
+		{"loopback", "127.0.0.1:443", "non-public"},
+		{"cloud metadata", "169.254.169.254:80", "non-public"},
+		{"rfc1918", "10.1.2.3:443", "non-public"},
+		{"netbird overlay", "100.90.1.2:443", "non-public"},
+		{"loopback v6", "[::1]:443", "non-public"},
+		{"unresolved name", "evil.example.com:443", "not an IP"},
+		{"no port", "1.1.1.1", "unreadable"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := guardDialAddress(tc.address)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tc.wantErr)
+		})
+	}
+
+	assert.NoError(t, guardDialAddress("1.1.1.1:443"), "a public address must still be dialled")
+	assert.NoError(t, guardDialAddress("[2606:4700:4700::1111]:443"))
+}
+
+// TestDialGuardIsInstalledOnTheDefaultClient pins the wiring rather than the
+// guard: a correct guard nothing calls protects nothing.
+func TestDialGuardIsInstalledOnTheDefaultClient(t *testing.T) {
+	cl := &Client{}
+	transport, ok := cl.httpClient().Transport.(*http.Transport)
+	require.True(t, ok, "the default discovery client must carry the guarded transport")
+	require.NotNil(t, transport.DialContext, "the guarded transport must dial through the guard")
+
+	_, err := transport.DialContext(context.Background(), "tcp", "127.0.0.1:9")
+	require.Error(t, err, "the guard must refuse loopback even when the caller dials it directly")
+	assert.Contains(t, err.Error(), "non-public")
+
+	// Tests point the client at a loopback server on purpose, so the opt-out
+	// has to reach the dialer too.
+	relaxed := &Client{AllowPrivateHosts: true}
+	assert.Equal(t, http.DefaultTransport, relaxed.httpClient().Transport)
+}
+
+// TestCallerInputFailuresAreMarkedInvalid keeps the handler's 400 mapping
+// honest: it branches on this sentinel, so an unmarked caller-input failure
+// silently becomes a 500.
+func TestCallerInputFailuresAreMarkedInvalid(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		req  Request
+	}{
+		{"unknown provider", Request{CatalogID: "not_a_provider", APIKey: "k"}},
+		{"unusable upstream", Request{CatalogID: "openai_api", UpstreamURL: "://", APIKey: "k"}},
+		{"missing api key", Request{CatalogID: "openai_api", UpstreamURL: "https://api.openai.com"}},
+		{"no region to read", Request{
+			CatalogID:   "bedrock_api",
+			UpstreamURL: "https://bedrock-runtime.amazonaws.com",
+			APIKey:      "aws-bearer",
+		}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			cl, _ := newStubClient(http.StatusOK, openAIListing)
+			_, err := cl.Fetch(context.Background(), tc.req)
+			require.Error(t, err)
+			assert.ErrorIs(t, err, ErrInvalidRequest)
+		})
+	}
+}
+
+// TestEveryDiscoveryEntryHasAParser keeps the catalog and the parser table from
+// drifting: adding a Discovery block with a shape nothing parses would fail
+// only at runtime, in front of an operator.
+func TestEveryDiscoveryEntryHasAParser(t *testing.T) {
+	for _, entry := range catalog.All() {
+		if entry.Discovery == nil {
+			continue
+		}
+		t.Run(entry.ID, func(t *testing.T) {
+			assert.NotEmpty(t, entry.Discovery.Path, "a discovery entry needs a path")
+			_, err := parseListing(entry.Discovery.Shape, []byte(`{}`))
+			assert.NoError(t, err, "shape %q has no parser", entry.Discovery.Shape)
+		})
+	}
+}
+
+func ids(models []Model) []string {
+	out := make([]string, 0, len(models))
+	for _, m := range models {
+		out = append(out, m.ID)
+	}
+	return out
+}
+
+// TestRegionIsReadBackFromTheUpstream covers the reason the API takes no
+// region field: a provider record has none, and the operator already encoded
+// it in the upstream host when they configured inference.
+func TestRegionIsReadBackFromTheUpstream(t *testing.T) {
+	cl, tr := newStubClient(http.StatusOK, bedrockListing)
+
+	_, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "bedrock_api",
+		UpstreamURL: "https://bedrock-runtime.us-west-2.amazonaws.com",
+		APIKey:      "aws-bearer",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "bedrock.us-west-2.amazonaws.com", tr.got.URL.Host)
+}
+
+func TestRegionFromUpstream(t *testing.T) {
+	bedrock, ok := catalog.Lookup("bedrock_api")
+	require.True(t, ok)
+	vertex, ok := catalog.Lookup("vertex_ai_api")
+	require.True(t, ok)
+
+	for _, tc := range []struct {
+		name     string
+		entry    catalog.Provider
+		upstream string
+		want     string
+	}{
+		{"bedrock runtime host", bedrock, "https://bedrock-runtime.eu-central-1.amazonaws.com", "eu-central-1"},
+		{"bedrock without scheme", bedrock, "bedrock-runtime.ap-south-1.amazonaws.com", "ap-south-1"},
+		{"vertex regional host", vertex, "https://us-east5-aiplatform.googleapis.com", "us-east5"},
+		// A proxied or self-hosted upstream matches no template, and guessing
+		// a region from it would build a URL pointing somewhere arbitrary.
+		{"unrelated upstream", bedrock, "https://llm.internal.example.com", ""},
+		{"vertex global host has no region segment", vertex, "https://aiplatform.googleapis.com", ""},
+		// Bedrock's regionless endpoint carries both halves of the template at
+		// once, with nothing between them. It has to read as "no region here"
+		// rather than as an inverted slice range.
+		{"bedrock regionless endpoint", bedrock, "https://bedrock-runtime.amazonaws.com", ""},
+		{"bedrock regionless without scheme", bedrock, "bedrock-runtime.amazonaws.com", ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, RegionFromUpstream(tc.entry, tc.upstream))
+		})
+	}
+}
+
+// bedrockGeoListing carries profiles from geographies the original prefix list
+// did not name. Every one reduces to a catalog key, so every one must arrive
+// priced — an unstripped geography is what made a real account's listing come
+// back almost entirely at zero.
+const bedrockGeoListing = `{"inferenceProfileSummaries":[
+  {"inferenceProfileId":"jp.anthropic.claude-sonnet-5-20260514-v1:0",
+   "inferenceProfileName":"JP Anthropic Claude Sonnet 5","status":"ACTIVE","type":"SYSTEM_DEFINED"},
+  {"inferenceProfileId":"au.anthropic.claude-haiku-4-5-20251001-v1:0",
+   "inferenceProfileName":"AU Anthropic Claude Haiku 4.5","status":"ACTIVE","type":"SYSTEM_DEFINED"},
+  {"inferenceProfileId":"us-gov.anthropic.claude-sonnet-5-20260514-v1:0",
+   "inferenceProfileName":"GovCloud Anthropic Claude Sonnet 5","status":"ACTIVE","type":"SYSTEM_DEFINED"}
+]}`
+
+func TestBedrockProfilesFromAnyGeographyArrivePriced(t *testing.T) {
+	cl, _ := newStubClient(http.StatusOK, bedrockGeoListing)
+
+	models, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "bedrock_api",
+		UpstreamURL: "https://bedrock-runtime.eu-central-1.amazonaws.com",
+		APIKey:      "aws-token",
+	})
+	require.NoError(t, err)
+	require.Len(t, models, 3)
+
+	for _, m := range models {
+		assert.True(t, m.PricingKnown, "%s must resolve to a catalog rate", m.ID)
+		assert.Greater(t, m.InputPer1k, 0.0, "input rate for %s", m.ID)
+		assert.Greater(t, m.OutputPer1k, 0.0, "output rate for %s", m.ID)
+		assert.Greater(t, m.CacheReadPer1k, 0.0, "cache-read rate for %s", m.ID)
+	}
+
+	// The wire id is preserved whatever the pricing key reduced to: it is the
+	// only form that works at invoke time.
+	assert.Equal(t, "jp.anthropic.claude-sonnet-5-20260514-v1:0", models[0].ID)
+}
+
+// TestFetch_AHostThatWillNotResolveIsUnreachable closes a gap the live suite
+// found. The SSRF guard resolves the host before any request is built, so a
+// name that does not resolve fails there rather than at the transport — and
+// that error used to reach the caller unclassified. A wrong hostname is the
+// commonest way for an upstream to be wrong, so it has to arrive as
+// "unreachable" and not as an unrecognised fault.
+func TestFetch_AHostThatWillNotResolveIsUnreachable(t *testing.T) {
+	// A resolver whose dial always fails, so the lookup errors without the
+	// test depending on real DNS.
+	refusing := &net.Resolver{
+		PreferGo: true,
+		Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
+			return nil, errors.New("resolver unavailable")
+		},
+	}
+	client := &Client{Resolver: refusing}
+
+	_, err := client.Fetch(context.Background(), Request{
+		CatalogID:   "openai_api",
+		UpstreamURL: "https://not-a-real-vendor-host.example.invalid",
+		APIKey:      "sk-test",
+	})
+
+	require.Error(t, err)
+	var unreachable *UnreachableError
+	require.ErrorAs(t, err, &unreachable, "a host that will not resolve must classify as unreachable")
+	require.NotErrorIs(t, err, ErrPrivateHost, "it is not a host we declined to dial")
+}
+
+// TestFetch_AProxyInThePathDoesNotSilentlyDisableTheCheck pins a fail-open the
+// dial-time guard can produce. checkPublicHost clears the target before
+// anything is dialled, so a private address refused at the socket is never the
+// operator's upstream — it is a rebinding attempt, or an HTTP proxy the
+// management server egresses through. Reporting either as ErrPrivateHost would
+// read as "this provider cannot be checked" and let every save through
+// unchecked, which is how a proxied deployment would install this feature and
+// have it quietly do nothing.
+func TestFetch_AProxyInThePathDoesNotSilentlyDisableTheCheck(t *testing.T) {
+	// A transport that refuses at the socket exactly as the guard does, with a
+	// loopback address standing in for the proxy the dial went to.
+	// AllowPrivateHosts short-circuits the resolve-stage check only; the
+	// injected transport below is still what the request goes through. Without
+	// it this test resolves api.openai.com for real, and on a runner with no
+	// egress that lookup fails as an UnreachableError too — so it would pass
+	// while never reaching the socket guard it is named for.
+	client := &Client{AllowPrivateHosts: true, HTTPClient: &http.Client{
+		Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
+			return nil, guardDialAddress("127.0.0.1:38599")
+		}),
+		CheckRedirect: refuseRedirect,
+	}}
+
+	_, err := client.Fetch(context.Background(), Request{
+		CatalogID:   "openai_api",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-test",
+	})
+
+	require.Error(t, err)
+	require.NotErrorIs(t, err, ErrPrivateHost,
+		"a refusal at the socket must not read as an upstream we cannot check")
+	var unreachable *UnreachableError
+	require.ErrorAs(t, err, &unreachable, "it is the vendor we failed to reach")
+}
+
+// roundTripFunc adapts a function to http.RoundTripper.
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+// TestFetch_TheUpstreamIsCheckedWhenTheListingCannotVouchForIt covers the hole
+// a separate listing host leaves. Bedrock lists from the control plane, so a
+// record whose runtime upstream does not exist reaches a perfectly good
+// listing and saves — the requests it then serves go nowhere.
+//
+// Both halves matter. A runtime host that cannot be resolved is the record
+// being wrong, and blocks. A proxied one resolves and only leaves the region
+// underivable, which stays the unverifiable outcome it already was.
+func TestFetch_TheUpstreamIsCheckedWhenTheListingCannotVouchForIt(t *testing.T) {
+	refusing := &net.Resolver{
+		PreferGo: true,
+		Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
+			return nil, errors.New("resolver unavailable")
+		},
+	}
+	client := &Client{Resolver: refusing}
+
+	_, err := client.Fetch(context.Background(), Request{
+		CatalogID: "bedrock_api",
+		// Matches no catalog template, so nothing here reaches the control
+		// plane the listing comes from: without its own check this upstream
+		// was never contacted at all.
+		UpstreamURL: "https://bedrock.typo.example.invalid",
+		APIKey:      "aws-bearer",
+	})
+
+	require.Error(t, err)
+	var unreachable *UnreachableError
+	require.ErrorAs(t, err, &unreachable, "a runtime host that will not resolve must block the save")
+}
+
+// TestFetch_AListingHostOfItsOwnDoesNotReachThroughTheUpstream keeps the check
+// above from reading the operator's upstream as the place to list from.
+func TestFetch_AListingHostOfItsOwnDoesNotReachThroughTheUpstream(t *testing.T) {
+	cl, tr := newStubClient(http.StatusOK, bedrockListing)
+
+	_, err := cl.Fetch(context.Background(), Request{
+		CatalogID:   "bedrock_api",
+		UpstreamURL: "https://bedrock-runtime.eu-central-1.amazonaws.com",
+		APIKey:      "aws-bearer",
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, "bedrock.eu-central-1.amazonaws.com", tr.got.URL.Host,
+		"checking the runtime host must not turn it into the listing host")
+}
diff --git a/management/internals/modules/agentnetwork/modeldiscovery/failure.go b/management/internals/modules/agentnetwork/modeldiscovery/failure.go
new file mode 100644
index 000000000..41e4bfb56
--- /dev/null
+++ b/management/internals/modules/agentnetwork/modeldiscovery/failure.go
@@ -0,0 +1,114 @@
+package modeldiscovery
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"syscall"
+)
+
+// Fetch serves two callers with different needs: the model picker, which only
+// needs to know it failed, and the provider credential check, which has to
+// tell an operator whether the URL or the key is at fault. Each failure
+// carries a type so the second does not have to branch on a message.
+
+// VendorStatusError reports a listing answered with something other than 200.
+// Only the vendor's own code separates a refused credential (401, 403) from a
+// URL that does not serve this API (404, 405) from an unwell vendor (5xx).
+type VendorStatusError struct {
+	Provider string
+	Status   int
+}
+
+func (e *VendorStatusError) Error() string {
+	return fmt.Sprintf("%s returned %d for its model listing", e.Provider, e.Status)
+}
+
+// UnreachableError reports that the request never reached the vendor: the
+// name did not resolve, the connection was refused, TLS failed, or it timed
+// out. Nothing was authenticated, so only the URL is implicated.
+type UnreachableError struct {
+	Provider string
+	Err      error
+}
+
+func (e *UnreachableError) Error() string {
+	return fmt.Sprintf("reach %s: %v", e.Provider, e.Err)
+}
+
+func (e *UnreachableError) Unwrap() error { return e.Err }
+
+// Reason names the transport failure in words an operator can act on: a wrong
+// port and a wrong hostname fail differently and are worth telling apart.
+// Empty means unrecognised, and the caller should say only that the host could
+// not be reached rather than paste a Go error into the UI.
+func (e *UnreachableError) Reason() string {
+	err := e.Err
+
+	var dns *net.DNSError
+	if errors.As(err, &dns) {
+		if dns.IsNotFound {
+			return "no such host"
+		}
+		// Named apart from the dial timeout below. A resolver that never
+		// answered and an upstream that never answered send an operator to
+		// different places, and the generic "connection timed out" would
+		// describe a connection that was never attempted.
+		if dns.IsTimeout {
+			return "dns lookup timed out"
+		}
+		return "dns lookup failed"
+	}
+
+	// Timeouts are checked before the syscall cases: a dial that times out is
+	// reported as a net.OpError wrapping a timeout, and the operator needs to
+	// hear "timed out" rather than the syscall underneath it.
+	if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, os.ErrDeadlineExceeded) {
+		return "connection timed out"
+	}
+	var netErr net.Error
+	if errors.As(err, &netErr) && netErr.Timeout() {
+		return "connection timed out"
+	}
+
+	if errors.Is(err, syscall.ECONNREFUSED) {
+		return "connection refused"
+	}
+	if errors.Is(err, syscall.EHOSTUNREACH) || errors.Is(err, syscall.ENETUNREACH) {
+		return "host unreachable"
+	}
+
+	var certErr *tls.CertificateVerificationError
+	if errors.As(err, &certErr) {
+		return "tls certificate not trusted"
+	}
+	var recordErr tls.RecordHeaderError
+	if errors.As(err, &recordErr) {
+		return "not a tls endpoint"
+	}
+
+	return ""
+}
+
+// ErrUnparseableListing marks a 200 whose body is not a listing in the shape
+// the catalog declared. Distinct from a status refusal: the host answered and
+// authenticated fine, it is just not the API — a login page, say.
+var ErrUnparseableListing = errors.New("response is not a model listing")
+
+// ErrNoDiscoveryHost marks a provider whose listing host cannot be derived
+// from the record: Bedrock's control-plane host comes from the region in the
+// upstream, so a proxied endpoint leaves nowhere to send it, and inventing one
+// would spend the credential somewhere never configured.
+//
+// Wraps ErrInvalidRequest so the discovery endpoint still answers 400, while a
+// credential check can read it as "cannot be checked" rather than "broken".
+var ErrNoDiscoveryHost = errors.New("provider has no derivable discovery host")
+
+// ErrPrivateHost marks an upstream resolving somewhere management will not
+// dial. A self-hosted endpoint on a private network is a legitimate provider
+// the proxy reaches through the tunnel, so this means the check cannot run,
+// not that the record is wrong.
+var ErrPrivateHost = errors.New("discovery host is not publicly routable")
diff --git a/management/internals/modules/agentnetwork/modeldiscovery/parse.go b/management/internals/modules/agentnetwork/modeldiscovery/parse.go
new file mode 100644
index 000000000..67a10bf36
--- /dev/null
+++ b/management/internals/modules/agentnetwork/modeldiscovery/parse.go
@@ -0,0 +1,134 @@
+package modeldiscovery
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+	sharedllm "github.com/netbirdio/netbird/shared/llm"
+)
+
+// listedModel is one entry lifted out of a vendor listing before the catalog
+// is consulted about it.
+type listedModel struct {
+	id    string
+	label string
+}
+
+// parseListing extracts model ids from a vendor listing. Each vendor invented
+// its own envelope, and the shape is declared by the catalog rather than
+// sniffed, so a vendor that changes shape fails loudly instead of silently
+// returning nothing.
+func parseListing(shape catalog.ListingShape, body []byte) ([]listedModel, error) {
+	switch shape {
+	case catalog.ShapeOpenAIData:
+		return parseOpenAIData(body)
+	case catalog.ShapeBedrockInferenceProfiles:
+		return parseBedrockInferenceProfiles(body)
+	case catalog.ShapeVertexPublisherModels:
+		return parseVertexPublisherModels(body)
+	default:
+		return nil, fmt.Errorf("no parser for listing shape %q", shape)
+	}
+}
+
+// parseOpenAIData reads {"data":[{"id":…}]}, which OpenAI defined and
+// Anthropic adopted. Anthropic additionally supplies display_name.
+func parseOpenAIData(body []byte) ([]listedModel, error) {
+	var doc struct {
+		Data []struct {
+			ID          string `json:"id"`
+			DisplayName string `json:"display_name"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(body, &doc); err != nil {
+		return nil, fmt.Errorf("%w: decode model listing: %w", ErrUnparseableListing, err)
+	}
+	out := make([]listedModel, 0, len(doc.Data))
+	for _, entry := range doc.Data {
+		out = append(out, listedModel{id: entry.ID, label: entry.DisplayName})
+	}
+	return out, nil
+}
+
+// parseBedrockInferenceProfiles reads
+// {"inferenceProfileSummaries":[{"inferenceProfileId":…}]}.
+//
+// The profile id is taken verbatim because its region prefix (eu., us.,
+// global.) is what makes it invocable, and it is not derivable from the
+// configured region — an account in one region legitimately holds global.*
+// profiles alongside its regional ones.
+//
+// Only ACTIVE profiles are offered: AWS reports others, and registering one
+// would produce a model that routes inside NetBird and fails at AWS.
+func parseBedrockInferenceProfiles(body []byte) ([]listedModel, error) {
+	var doc struct {
+		Summaries []struct {
+			ID     string `json:"inferenceProfileId"`
+			Name   string `json:"inferenceProfileName"`
+			Status string `json:"status"`
+		} `json:"inferenceProfileSummaries"`
+	}
+	if err := json.Unmarshal(body, &doc); err != nil {
+		return nil, fmt.Errorf("%w: decode inference-profile listing: %w", ErrUnparseableListing, err)
+	}
+	out := make([]listedModel, 0, len(doc.Summaries))
+	for _, entry := range doc.Summaries {
+		if entry.Status != "" && !strings.EqualFold(entry.Status, "ACTIVE") {
+			continue
+		}
+		out = append(out, listedModel{id: entry.ID, label: entry.Name})
+	}
+	return out, nil
+}
+
+// parseVertexPublisherModels reads {"publisherModels":[{"name":…}]}, where
+// name is a resource path ("publishers/anthropic/models/claude-3-opus") and
+// the version lives in a separate field.
+//
+// Vertex addresses a model as "<id>@<version>" on the rawPredict path, so the
+// two are joined here: reporting the bare name would hand the operator an id
+// that looks usable and is not.
+func parseVertexPublisherModels(body []byte) ([]listedModel, error) {
+	var doc struct {
+		Models []struct {
+			Name      string `json:"name"`
+			VersionID string `json:"versionId"`
+		} `json:"publisherModels"`
+	}
+	if err := json.Unmarshal(body, &doc); err != nil {
+		return nil, fmt.Errorf("%w: decode publisher-model listing: %w", ErrUnparseableListing, err)
+	}
+	out := make([]listedModel, 0, len(doc.Models))
+	for _, entry := range doc.Models {
+		id := entry.Name
+		if slash := strings.LastIndex(id, "/"); slash >= 0 {
+			id = id[slash+1:]
+		}
+		if id == "" {
+			continue
+		}
+		label := id
+		if entry.VersionID != "" {
+			id += "@" + entry.VersionID
+		}
+		out = append(out, listedModel{id: id, label: label})
+	}
+	return out, nil
+}
+
+// normalizeForPricing maps a vendor's wire id onto the key the catalog prices
+// it under. It mirrors the synthesiser's normalizePricingModelID: the two must
+// agree, or a model reported here as priced would meter at the default rate
+// instead of the operator's.
+func normalizeForPricing(catalogProviderID, modelID string) string {
+	switch {
+	case catalog.IsBedrockPathStyle(catalogProviderID):
+		return sharedllm.NormalizeBedrockModel(modelID)
+	case catalog.IsVertexPathStyle(catalogProviderID):
+		return sharedllm.NormalizeVertexModel(modelID)
+	default:
+		return modelID
+	}
+}
diff --git a/management/internals/modules/agentnetwork/policyselect.go b/management/internals/modules/agentnetwork/policyselect.go
index 9203a1910..7d21d7bc9 100644
--- a/management/internals/modules/agentnetwork/policyselect.go
+++ b/management/internals/modules/agentnetwork/policyselect.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"math"
 	"sort"
+	"strings"
 	"time"
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
@@ -35,6 +36,10 @@ const (
 	denyCodeAccountTokenCapExceeded = "llm_account.token_cap_exceeded"
 	//nolint:gosec // account deny code label, not a credential
 	denyCodeAccountBudgetCapExceeded = "llm_account.budget_cap_exceeded"
+	// denyCodeModelBlocked is returned when policies govern the request's
+	// (provider, caller-groups) but none permits the model. Matches the proxy
+	// guardrail's code so both layers surface the same label.
+	denyCodeModelBlocked = "llm_policy.model_blocked"
 )
 
 // consumptionCache holds the consumption counters prefetched for one
@@ -159,6 +164,14 @@ func (m *managerImpl) SelectPolicyForRequest(ctx context.Context, in PolicySelec
 	}
 	candidates := filterApplicablePolicies(policies, in)
 
+	candidates, denied, err := m.applyModelGate(ctx, in, candidates)
+	if err != nil {
+		return nil, err
+	}
+	if denied != nil {
+		return denied, nil
+	}
+
 	// Prefetch every consumption counter the ceiling + candidate policies will
 	// read, in a single store round-trip, then score against the cache.
 	cache, err := m.prefetchConsumption(ctx, in, rules, candidates, now)
@@ -250,6 +263,169 @@ func filterApplicablePolicies(policies []*types.Policy, in PolicySelectionInput)
 	return out
 }
 
+// anyPolicyHasGuardrails reports whether any policy references at least one
+// guardrail, so the selector can skip loading guardrails when none do.
+func anyPolicyHasGuardrails(policies []*types.Policy) bool {
+	for _, p := range policies {
+		if p != nil && len(p.GuardrailIDs) > 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// applyModelGate is the model-allowlist gate scoped to the matched policies:
+// it keeps the candidates whose guardrails permit the model (none enabled =
+// unrestricted) and returns a deny result when policies apply but none
+// permits it. The guardrail load is skipped when no candidate references a
+// guardrail, and the provider's catalog id — which picks the model-id
+// normalizer — is resolved only when a candidate actually restricts models:
+// with no enabled allowlist every candidate is unrestricted, and a
+// provider-store failure must not fail a request the gate would have waved
+// through.
+func (m *managerImpl) applyModelGate(ctx context.Context, in PolicySelectionInput, candidates []*types.Policy) ([]*types.Policy, *PolicySelectionResult, error) {
+	if len(candidates) == 0 || !anyPolicyHasGuardrails(candidates) {
+		return candidates, nil, nil
+	}
+	guardrailsByID, err := m.loadGuardrailsByID(ctx, in.AccountID)
+	if err != nil {
+		return nil, nil, err
+	}
+	if !anyEnabledModelAllowlist(candidates, guardrailsByID) {
+		return candidates, nil, nil
+	}
+	catalogID, err := m.providerCatalogID(ctx, in.AccountID, in.ProviderID)
+	if err != nil {
+		return nil, nil, err
+	}
+	permitted := filterModelPermittedPolicies(candidates, guardrailsByID, in.Model, catalogID)
+	if len(permitted) == 0 {
+		return nil, &PolicySelectionResult{
+			Allow:      false,
+			DenyCode:   denyCodeModelBlocked,
+			DenyReason: modelBlockedReason(in.Model),
+		}, nil
+	}
+	return permitted, nil, nil
+}
+
+// anyEnabledModelAllowlist reports whether any policy references a guardrail
+// whose model allowlist is enabled — the only case the model gate restricts
+// anything. Disabled allowlists, stale guardrail references, and guardrails
+// carrying only other checks all leave every candidate unrestricted.
+func anyEnabledModelAllowlist(policies []*types.Policy, byID map[string]*types.Guardrail) bool {
+	for _, p := range policies {
+		if p == nil {
+			continue
+		}
+		for _, gID := range p.GuardrailIDs {
+			if g, ok := byID[gID]; ok && g != nil && g.Checks.ModelAllowlist.Enabled {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// loadGuardrailsByID loads the account's guardrails indexed by ID. Used by the
+// model-allowlist gate to resolve each candidate policy's attached guardrails.
+func (m *managerImpl) loadGuardrailsByID(ctx context.Context, accountID string) (map[string]*types.Guardrail, error) {
+	guardrails, err := m.store.GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, fmt.Errorf("list account guardrails: %w", err)
+	}
+	byID := make(map[string]*types.Guardrail, len(guardrails))
+	for _, g := range guardrails {
+		if g != nil {
+			byID[g.ID] = g
+		}
+	}
+	return byID, nil
+}
+
+// providerCatalogID resolves a provider record id to its catalog provider
+// id, the key the model-id normalizers are picked by. A missing provider
+// resolves to the empty catalog id — the compare then runs verbatim-only,
+// which can never widen an allowlist — while a store failure propagates
+// rather than degrading a security decision.
+func (m *managerImpl) providerCatalogID(ctx context.Context, accountID, providerID string) (string, error) {
+	if providerID == "" {
+		return "", nil
+	}
+	provider, err := m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, providerID)
+	switch {
+	case err == nil:
+		return provider.ProviderID, nil
+	case isNotFound(err):
+		return "", nil
+	default:
+		return "", fmt.Errorf("get provider: %w", err)
+	}
+}
+
+// filterModelPermittedPolicies returns the subset of policies whose guardrails
+// permit the model on the provider with the given catalog id. Order is
+// preserved so downstream scoring is unaffected.
+func filterModelPermittedPolicies(policies []*types.Policy, byID map[string]*types.Guardrail, model, catalogProviderID string) []*types.Policy {
+	out := make([]*types.Policy, 0, len(policies))
+	for _, p := range policies {
+		if policyPermitsModel(p, byID, model, catalogProviderID) {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// policyPermitsModel reports whether a policy permits the model. No
+// allowlist-enabled guardrail = unrestricted (permits any, incl. empty);
+// otherwise the model must be in the union of its allowlists, so an
+// empty/undetermined model fails closed. An entry matches on its own
+// normalised form or, for a path-style provider, its canonical form: the
+// parser emits the canonical id for path-routed requests, while an
+// allowlist may hold the raw declared id the dashboard's picker copies
+// from the provider. The catalog id picks the normalizer, so a plain
+// provider's entries always compare verbatim.
+func policyPermitsModel(p *types.Policy, byID map[string]*types.Guardrail, model, catalogProviderID string) bool {
+	if p == nil {
+		return false
+	}
+	wanted := normaliseModelID(model)
+	restricted := false
+	for _, gID := range p.GuardrailIDs {
+		g, ok := byID[gID]
+		if !ok || g == nil || !g.Checks.ModelAllowlist.Enabled {
+			continue
+		}
+		restricted = true
+		if wanted == "" {
+			continue
+		}
+		for _, allowed := range g.Checks.ModelAllowlist.Models {
+			if normaliseModelID(allowed) == wanted || canonicalModelKey(catalogProviderID, allowed) == wanted {
+				return true
+			}
+		}
+	}
+	return !restricted
+}
+
+// normaliseModelID lowercases and trims a model identifier so the allowlist
+// compare is case-insensitive and trim-tolerant. Mirrors the proxy guardrail's
+// normaliseModel so both layers agree on what "same model" means.
+func normaliseModelID(model string) string {
+	return strings.ToLower(strings.TrimSpace(model))
+}
+
+// modelBlockedReason builds the human-readable deny reason for a model-allowlist
+// rejection. The model is quoted when known; an undetermined model is reported
+// as such so the access log distinguishes "wrong model" from "no model".
+func modelBlockedReason(model string) string {
+	if normaliseModelID(model) == "" {
+		return "request model could not be determined for the policy allowlist"
+	}
+	return fmt.Sprintf("model %q is not permitted by any applicable policy allowlist", model)
+}
+
 // candidate is the per-policy intermediate the selector ranks. A
 // policy that's been exhausted on any enabled cap never makes it
 // into this slice; the selector's deny envelope carries the latest
diff --git a/management/internals/modules/agentnetwork/policyselect_model_test.go b/management/internals/modules/agentnetwork/policyselect_model_test.go
new file mode 100644
index 000000000..c70816b98
--- /dev/null
+++ b/management/internals/modules/agentnetwork/policyselect_model_test.go
@@ -0,0 +1,509 @@
+package agentnetwork
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// guardedPolicy builds an enabled, uncapped policy that authorises sourceGroups
+// to reach providerID under the given guardrails. Uncapped keeps the selector's
+// headroom scoring trivial so these tests isolate the model-allowlist gate.
+func guardedPolicy(id, account string, sourceGroups []string, providerID string, guardrailIDs ...string) *types.Policy {
+	return &types.Policy{
+		ID:                     id,
+		AccountID:              account,
+		Enabled:                true,
+		SourceGroups:           sourceGroups,
+		DestinationProviderIDs: []string{providerID},
+		GuardrailIDs:           guardrailIDs,
+		CreatedAt:              time.Now().UTC(),
+	}
+}
+
+// allowlistGuardrail builds a guardrail whose model allowlist is enabled and
+// carries the given models.
+func allowlistGuardrail(id, account string, models ...string) *types.Guardrail {
+	return &types.Guardrail{
+		ID:        id,
+		AccountID: account,
+		Checks: types.GuardrailChecks{
+			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: models},
+		},
+	}
+}
+
+func expectPolicies(mockStore *store.MockStore, account string, policies ...*types.Policy) {
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), account).
+		Return(policies, nil)
+}
+
+func expectGuardrails(mockStore *store.MockStore, account string, guardrails ...*types.Guardrail) {
+	mockStore.EXPECT().
+		GetAccountAgentNetworkGuardrails(gomock.Any(), gomock.Any(), account).
+		Return(guardrails, nil)
+}
+
+// expectProviderCatalog resolves the destination provider to the given
+// catalog provider id, which picks the model-id normalizer the allowlist
+// gate compares through. AnyTimes: the lookup runs only when the guardrail
+// gate is reached.
+func expectProviderCatalog(mockStore *store.MockStore, account, providerID, catalog string) {
+	mockStore.EXPECT().
+		GetAgentNetworkProviderByID(gomock.Any(), gomock.Any(), account, providerID).
+		Return(&types.Provider{ID: providerID, AccountID: account, ProviderID: catalog}, nil).
+		AnyTimes()
+}
+
+// TestSelectPolicy_ModelBlockedByAllowlist proves the authoritative allowlist
+// decision: a policy authorises the (provider, group) but restricts the model,
+// and the requested model isn't on the list, so the request is denied.
+func TestSelectPolicy_ModelBlockedByAllowlist(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o"))
+	expectProviderCatalog(mockStore, "acc-1", "prov-1", "openai_api")
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4",
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "a model outside the only applicable policy's allowlist must be denied")
+	assert.Equal(t, denyCodeModelBlocked, res.DenyCode, "deny code must be model_blocked")
+	assert.NotEmpty(t, res.DenyReason, "deny reason must be populated")
+}
+
+// TestSelectPolicy_ModelAllowedByAllowlist is the allow counterpart: the model
+// is on the applicable policy's allowlist, so selection proceeds normally.
+func TestSelectPolicy_ModelAllowedByAllowlist(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o", "claude-opus-4"))
+	expectProviderCatalog(mockStore, "acc-1", "prov-1", "openai_api")
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "a model on the applicable policy's allowlist must be allowed")
+	assert.Equal(t, "pol-A", res.SelectedPolicyID)
+}
+
+// TestSelectPolicy_CaseInsensitiveModelMatch proves the compare tolerates case
+// and surrounding whitespace, matching the proxy guardrail's normalisation.
+func TestSelectPolicy_CaseInsensitiveModelMatch(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "  GPT-4o  "))
+	expectProviderCatalog(mockStore, "acc-1", "prov-1", "openai_api")
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "gpt-4o",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "case/whitespace variants must match the allowlist entry")
+}
+
+// TestSelectPolicy_UnguardedPolicyIsUnrestricted is the false-deny fix: when two
+// policies authorise the same (provider, group) and one has no guardrail, that
+// policy makes the request unrestricted — not caught by the other's allowlist.
+func TestSelectPolicy_UnguardedPolicyIsUnrestricted(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	restricted := guardedPolicy("pol-restricted", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	open := guardedPolicy("pol-open", "acc-1", []string{"grp-eng"}, "prov-1") // no guardrail
+	expectPolicies(mockStore, "acc-1", restricted, open)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o"))
+	expectProviderCatalog(mockStore, "acc-1", "prov-1", "openai_api")
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "an un-guardrailed policy for the same (provider, group) must leave the request unrestricted")
+	assert.Equal(t, "pol-open", res.SelectedPolicyID, "the unrestricted policy must be the one that pays")
+}
+
+// TestSelectPolicy_AllowlistDoesNotLeakAcrossGroups is the false-allow fix: a
+// model allowlisted only for grp-b must not be usable by a grp-a caller. The
+// selector considers only policies applicable to the caller's groups.
+func TestSelectPolicy_AllowlistDoesNotLeakAcrossGroups(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	polA := guardedPolicy("pol-a", "acc-1", []string{"grp-a"}, "prov-1", "g-a")
+	polB := guardedPolicy("pol-b", "acc-1", []string{"grp-b"}, "prov-1", "g-b")
+	expectPolicies(mockStore, "acc-1", polA, polB)
+	expectGuardrails(mockStore, "acc-1",
+		allowlistGuardrail("g-a", "acc-1", "gpt-4o"),
+		allowlistGuardrail("g-b", "acc-1", "claude-opus-4"),
+	)
+	expectProviderCatalog(mockStore, "acc-1", "prov-1", "openai_api")
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-a"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4", // only allowed for grp-b
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "grp-b's allowlisted model must not leak to a grp-a caller")
+	assert.Equal(t, denyCodeModelBlocked, res.DenyCode)
+}
+
+// TestSelectPolicy_UndeterminedModelFailsClosed proves the fail-closed contract
+// mirrors the proxy: with a restricted applicable policy and an empty model
+// (e.g. a path-routed shape the parser couldn't map), the request is denied.
+func TestSelectPolicy_UndeterminedModelFailsClosed(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o"))
+	expectProviderCatalog(mockStore, "acc-1", "prov-1", "openai_api")
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "", // undetermined
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "an undetermined model must fail closed against a restricted policy")
+	assert.Equal(t, denyCodeModelBlocked, res.DenyCode)
+}
+
+// TestSelectPolicy_DisabledAllowlistDoesNotRestrict proves a guardrail whose
+// model allowlist is disabled imposes no model restriction, even though the
+// policy references it.
+func TestSelectPolicy_DisabledAllowlistDoesNotRestrict(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	disabled := &types.Guardrail{
+		ID:        "g-1",
+		AccountID: "acc-1",
+		Checks: types.GuardrailChecks{
+			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: false, Models: []string{"gpt-4o"}},
+		},
+	}
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", disabled)
+	// Deliberately no provider expectation: with no enabled allowlist the
+	// gate must skip the catalog-id lookup entirely.
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "anything-goes",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "a disabled allowlist must not restrict the model")
+	assert.Equal(t, "pol-A", res.SelectedPolicyID)
+}
+
+// TestSelectPolicy_UnionAcrossPolicyGuardrails proves a policy with multiple
+// allowlist guardrails permits the union of their models (not just the first).
+func TestSelectPolicy_UnionAcrossPolicyGuardrails(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1", "g-2")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1",
+		allowlistGuardrail("g-1", "acc-1", "gpt-4o"),
+		allowlistGuardrail("g-2", "acc-1", "claude-opus-4"),
+	)
+	expectProviderCatalog(mockStore, "acc-1", "prov-1", "openai_api")
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4", // only in the second guardrail's list
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "a model in any of the policy's allowlist guardrails must be permitted")
+	assert.Equal(t, "pol-A", res.SelectedPolicyID)
+}
+
+// TestSelectPolicy_GuardrailLookupErrorPropagates proves a store failure while
+// resolving the candidate policies' guardrails surfaces as an error, not a
+// silent allow/deny.
+func TestSelectPolicy_GuardrailLookupErrorPropagates(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkGuardrails(gomock.Any(), gomock.Any(), "acc-1").
+		Return(nil, errors.New("store unavailable"))
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "gpt-4o",
+	})
+	require.Error(t, err, "a guardrail-lookup failure must surface as an error")
+	assert.Nil(t, res)
+}
+
+// TestSelectPolicy_MissingGuardrailReferenceTreatedAsUnrestricted proves a
+// policy referencing a guardrail ID absent from the account's set (a stale
+// reference) imposes no model restriction — same as no guardrail.
+func TestSelectPolicy_MissingGuardrailReferenceTreatedAsUnrestricted(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-missing")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1")
+	// Deliberately no provider expectation: an orphaned guardrail reference
+	// restricts nothing, so the gate must skip the catalog-id lookup.
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "anything-goes",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "an orphaned guardrail reference must not restrict the model")
+	assert.Equal(t, "pol-A", res.SelectedPolicyID)
+}
+
+// TestSelectPolicy_PartialCandidatesPermittedAfterModelFilter proves the model
+// gate narrows candidates before cap scoring: the permitting policy is selected
+// even though the blocked one has a larger, more attractive cap.
+func TestSelectPolicy_PartialCandidatesPermittedAfterModelFilter(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	polBig := guardedPolicy("pol-big", "acc-1", []string{"grp-eng"}, "prov-1", "g-restrict")
+	polBig.Limits = types.PolicyLimits{
+		TokenLimit: types.PolicyTokenLimit{Enabled: true, GroupCap: 1_000_000, WindowSeconds: 3600},
+	}
+	polSmall := guardedPolicy("pol-small", "acc-1", []string{"grp-eng"}, "prov-1", "g-permit")
+	polSmall.Limits = types.PolicyLimits{
+		TokenLimit: types.PolicyTokenLimit{Enabled: true, GroupCap: 100, WindowSeconds: 3600},
+	}
+	expectPolicies(mockStore, "acc-1", polBig, polSmall)
+	expectGuardrails(mockStore, "acc-1",
+		allowlistGuardrail("g-restrict", "acc-1", "gpt-4o"),
+		allowlistGuardrail("g-permit", "acc-1", "claude-opus-4"),
+	)
+	expectProviderCatalog(mockStore, "acc-1", "prov-1", "openai_api")
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4", // only pol-small's guardrail permits this
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow)
+	assert.Equal(t, "pol-small", res.SelectedPolicyID,
+		"the model filter must exclude pol-big before cap scoring")
+}
+
+// TestSelectPolicy_RawDeclaredAllowlistPermitsCanonicalModel proves an
+// allowlist holding the raw vendor-issued id — the form the dashboard's
+// picker copies from a provider's declared models — permits the request:
+// the parser emits the path-style canonical id, so the entry must match
+// through the same canonicalization.
+func TestSelectPolicy_RawDeclaredAllowlistPermitsCanonicalModel(t *testing.T) {
+	cases := []struct {
+		name    string
+		catalog string
+		entry   string
+		request string
+	}{
+		{"bedrock raw region/version form", "bedrock_api", "eu.anthropic.claude-sonnet-4-5-20250929-v1:0", "anthropic.claude-sonnet-4-5"},
+		{"vertex raw @version form", "vertex_ai_api", "claude-sonnet-4-5@20250929", "claude-sonnet-4-5"},
+		{"vertex raw dated @version form", "vertex_ai_api", "gpt-4o@2024-08-06", "gpt-4o"},
+		{"bedrock raw form with case and whitespace", "bedrock_api", " EU.Anthropic.Claude-Sonnet-4-5-20250929-V1:0 ", "anthropic.claude-sonnet-4-5"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			mgr, mockStore := newSelectorMgr(t, ctrl)
+
+			policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+			expectPolicies(mockStore, "acc-1", policy)
+			expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", tc.entry))
+			expectProviderCatalog(mockStore, "acc-1", "prov-1", tc.catalog)
+			expectConsumptionBatch(mockStore, nil)
+
+			res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+				AccountID:  "acc-1",
+				UserID:     "user-1",
+				GroupIDs:   []string{"grp-eng"},
+				ProviderID: "prov-1",
+				Model:      tc.request,
+			})
+			require.NoError(t, err)
+			assert.True(t, res.Allow, "the raw declared allowlist entry must permit its canonical model")
+			assert.Equal(t, "pol-A", res.SelectedPolicyID)
+		})
+	}
+
+	// A model outside the allowlist stays denied under the same entry shape.
+	t.Run("unrelated canonical model stays denied", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		mgr, mockStore := newSelectorMgr(t, ctrl)
+
+		policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+		expectPolicies(mockStore, "acc-1", policy)
+		expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "eu.anthropic.claude-sonnet-4-5-20250929-v1:0"))
+		expectProviderCatalog(mockStore, "acc-1", "prov-1", "bedrock_api")
+
+		res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+			AccountID:  "acc-1",
+			UserID:     "user-1",
+			GroupIDs:   []string{"grp-eng"},
+			ProviderID: "prov-1",
+			Model:      "anthropic.claude-opus-4-8",
+		})
+		require.NoError(t, err)
+		assert.False(t, res.Allow, "a model the allowlist never names must stay denied")
+		assert.Equal(t, denyCodeModelBlocked, res.DenyCode)
+	})
+}
+
+// TestSelectPolicy_PlainProviderEntriesStayVerbatim proves the canonical-form
+// compare never relaxes an allowlist on a body-routed provider: its catalog
+// id selects no normalizer, so a suffix that would be stripped under Bedrock
+// ("-v2") or Vertex ("@...") stays part of the entry and must NOT also admit
+// the stripped id — on this provider that is a different model.
+func TestSelectPolicy_PlainProviderEntriesStayVerbatim(t *testing.T) {
+	cases := []struct {
+		name    string
+		entry   string
+		request string
+	}{
+		{"a -vN suffix is not a Bedrock version tag here", "claude-3-5-sonnet-v2", "claude-3-5-sonnet"},
+		{"an @word suffix is not a Vertex version tag here", "custom-model@team", "custom-model"},
+		{"an @digits suffix is not a Vertex version tag here", "custom-model@2024", "custom-model"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			mgr, mockStore := newSelectorMgr(t, ctrl)
+
+			policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+			expectPolicies(mockStore, "acc-1", policy)
+			expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", tc.entry))
+			expectProviderCatalog(mockStore, "acc-1", "prov-1", "openai_api")
+
+			res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+				AccountID:  "acc-1",
+				UserID:     "user-1",
+				GroupIDs:   []string{"grp-eng"},
+				ProviderID: "prov-1",
+				Model:      tc.request,
+			})
+			require.NoError(t, err)
+			assert.False(t, res.Allow, "a plain provider's allowlist entry must not widen to its stripped form")
+			assert.Equal(t, denyCodeModelBlocked, res.DenyCode)
+		})
+	}
+}
+
+// TestSelectPolicy_MissingProviderRecordComparesVerbatim proves a provider the
+// store no longer holds degrades to the verbatim-only compare — the raw entry
+// still matches itself, and nothing widens — rather than erroring or guessing
+// a normalizer.
+func TestSelectPolicy_MissingProviderRecordComparesVerbatim(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "eu.anthropic.claude-sonnet-4-5-20250929-v1:0"))
+	mockStore.EXPECT().
+		GetAgentNetworkProviderByID(gomock.Any(), gomock.Any(), "acc-1", "prov-1").
+		Return(nil, status.Errorf(status.NotFound, "provider not found")).
+		AnyTimes()
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "anthropic.claude-sonnet-4-5",
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "without the provider record the compare runs verbatim and must not widen")
+	assert.Equal(t, denyCodeModelBlocked, res.DenyCode)
+}
+
+// TestSelectPolicy_ProviderLookupErrorPropagates proves a store failure while
+// resolving the provider's catalog id surfaces as an error — the model gate is
+// a security decision and must not silently degrade.
+func TestSelectPolicy_ProviderLookupErrorPropagates(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o"))
+	mockStore.EXPECT().
+		GetAgentNetworkProviderByID(gomock.Any(), gomock.Any(), "acc-1", "prov-1").
+		Return(nil, errors.New("store unavailable"))
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "gpt-4o",
+	})
+	require.Error(t, err, "a provider-lookup failure must surface as an error")
+	assert.Nil(t, res)
+}
diff --git a/management/internals/modules/agentnetwork/policyselect_test.go b/management/internals/modules/agentnetwork/policyselect_test.go
index dd7687fe1..9ca548344 100644
--- a/management/internals/modules/agentnetwork/policyselect_test.go
+++ b/management/internals/modules/agentnetwork/policyselect_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
diff --git a/management/internals/modules/agentnetwork/pricing/defaults.go b/management/internals/modules/agentnetwork/pricing/defaults.go
new file mode 100644
index 000000000..315cfe208
--- /dev/null
+++ b/management/internals/modules/agentnetwork/pricing/defaults.go
@@ -0,0 +1,150 @@
+// Package pricing builds the default LLM pricing table the synthesizer
+// ships to the proxy's cost_meter middleware. The catalog is the single
+// source of default rates: every catalog provider's models are folded
+// into the pricing surfaces the provider declares (PricingSurfaces),
+// then a small supplemental list adds priced-but-not-operator-selectable
+// entries. Management is the sole pricing authority — the proxy carries
+// no embedded price list and bills exclusively from the table it is
+// sent.
+//go:generate go run gen.go
+
+package pricing
+
+import (
+	"sync"
+	"sync/atomic"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+)
+
+// Entry is a single model's pricing in USD per 1k tokens. This struct IS
+// the wire shape: the synthesizer marshals it verbatim into cost_meter's
+// ConfigJSON, and the proxy unmarshals the same field names.
+//
+// A zero rate means "no rate configured" — the proxy bills that cache
+// bucket at InputPer1k (identical semantics to the retired proxy-embedded
+// table). CachedInputPer1k is the OpenAI shape (cached prompt tokens are
+// a subset of input); CacheReadPer1k / CacheCreationPer1k are the
+// Anthropic shape (additive buckets).
+type Entry struct {
+	InputPer1k         float64 `json:"input_per_1k"`
+	OutputPer1k        float64 `json:"output_per_1k"`
+	CachedInputPer1k   float64 `json:"cached_input_per_1k,omitempty"`
+	CacheReadPer1k     float64 `json:"cache_read_per_1k,omitempty"`
+	CacheCreationPer1k float64 `json:"cache_creation_per_1k,omitempty"`
+}
+
+// supplementalDefaults are (surface, model) entries that are priced but
+// deliberately not operator-selectable in the catalog. Each carries a
+// reason; when one of these models joins a catalog lineup, delete the
+// row here — the collision test fails loudly if the rates ever disagree.
+var supplementalDefaults = map[string]map[string]Entry{
+	"openai": {
+		// GPT-5 (2025) family — kept for gateway requests using the
+		// unsuffixed ids; the dashboard offers only the 5.x lineup.
+		"gpt-5":      {InputPer1k: 0.00125, OutputPer1k: 0.01, CachedInputPer1k: 0.000125},
+		"gpt-5-mini": {InputPer1k: 0.00025, OutputPer1k: 0.002, CachedInputPer1k: 0.000025},
+		"gpt-5-nano": {InputPer1k: 0.00005, OutputPer1k: 0.0004, CachedInputPer1k: 0.000005},
+	},
+	"anthropic": {
+		// "kimi-k3[1m]" is the 1M-context alias some Claude Code guides
+		// configure against Moonshot's Anthropic-compatible endpoint;
+		// priced identically to kimi-k3 so those requests aren't skipped.
+		"kimi-k3[1m]": {InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003},
+	},
+}
+
+var (
+	compiledOnce  sync.Once
+	compiledTable map[string]map[string]Entry
+	// mergedTable holds the current live table when a pricing defaults
+	// file is loaded: the file merged entry-whole over the compiled-in
+	// base. Nil while no file is loaded (or after the file is removed),
+	// in which case the compiled-in table serves. Swapped atomically by
+	// the file loader/reloader; readers never block.
+	mergedTable atomic.Pointer[map[string]map[string]Entry]
+)
+
+// DefaultTable returns the current default pricing table keyed
+// surface -> model -> Entry: the management-side defaults file (see
+// LoadFile / StartReloader) when one is loaded, merged over the
+// compiled-in catalog table, which alone serves as the fallback when no
+// file exists. The snapshot may change between calls as the file is
+// re-read — consumers (the synthesizer on every reconcile, the catalog
+// endpoint on every request) pick up fresh rates automatically. Callers
+// must not mutate the returned maps.
+func DefaultTable() map[string]map[string]Entry {
+	if t := mergedTable.Load(); t != nil {
+		return *t
+	}
+	return compiledBase()
+}
+
+// compiledBase returns the compiled-in table (catalog + supplementals),
+// built once.
+func compiledBase() map[string]map[string]Entry {
+	compiledOnce.Do(func() {
+		compiledTable = buildDefaultTable()
+	})
+	return compiledTable
+}
+
+func buildDefaultTable() map[string]map[string]Entry {
+	out := make(map[string]map[string]Entry)
+	for _, p := range catalog.All() {
+		for _, surface := range p.PricingSurfaces {
+			inner, ok := out[surface]
+			if !ok {
+				inner = make(map[string]Entry)
+				out[surface] = inner
+			}
+			for _, m := range p.Models {
+				// First writer wins; providers contributing the same
+				// (surface, model) must agree on rates — enforced by
+				// TestDefaultTable_NoConflictingContributions.
+				if _, dup := inner[m.ID]; dup {
+					continue
+				}
+				inner[m.ID] = entryFromCatalogModel(m)
+			}
+		}
+	}
+	for surface, models := range supplementalDefaults {
+		inner, ok := out[surface]
+		if !ok {
+			inner = make(map[string]Entry)
+			out[surface] = inner
+		}
+		for id, e := range models {
+			if _, dup := inner[id]; dup {
+				continue
+			}
+			inner[id] = e
+		}
+	}
+	return out
+}
+
+func entryFromCatalogModel(m catalog.Model) Entry {
+	return Entry{
+		InputPer1k:         m.InputPer1k,
+		OutputPer1k:        m.OutputPer1k,
+		CachedInputPer1k:   m.CachedInputPer1k,
+		CacheReadPer1k:     m.CacheReadPer1k,
+		CacheCreationPer1k: m.CacheCreationPer1k,
+	}
+}
+
+// LookupDefault returns the default entry for model on the first of the
+// given surfaces that prices it. Used by the synthesizer to seed a
+// per-provider entry with default cache rates before overlaying the
+// operator's stored prices.
+func LookupDefault(surfaces []string, model string) (Entry, bool) {
+	table := DefaultTable()
+	for _, s := range surfaces {
+		if e, ok := table[s][model]; ok {
+			return e, true
+		}
+	}
+	return Entry{}, false
+}
diff --git a/proxy/internal/llm/pricing/defaults_pricing.yaml b/management/internals/modules/agentnetwork/pricing/defaults_llm_pricing.example.yaml
similarity index 64%
rename from proxy/internal/llm/pricing/defaults_pricing.yaml
rename to management/internals/modules/agentnetwork/pricing/defaults_llm_pricing.example.yaml
index cd5c64fbf..78830ae3c 100644
--- a/proxy/internal/llm/pricing/defaults_pricing.yaml
+++ b/management/internals/modules/agentnetwork/pricing/defaults_llm_pricing.example.yaml
@@ -1,83 +1,186 @@
-# Embedded default pricing for llm_observability. Compiled into the proxy
-# binary via go:embed in pricing.go; cost annotation works out of the box
-# without any operator action.
+# Default LLM pricing used by NetBird's Agent Network cost metering.
+# GENERATED from the management catalog — do not edit this file in the
+# repository; regenerate with:
 #
-# Operators override entries by dropping a pricing.yaml into --plugin-data-dir
-# (or whichever basename is given via params.pricing_path). The override file
-# only needs entries the operator wants to change; missing entries fall
-# through to these defaults.
+#   go generate ./management/internals/modules/agentnetwork/pricing
 #
-# Values are USD per 1_000 tokens. Public list prices drift; ship a fresh
-# binary or override individual entries via the override file as needed.
+# Operators: copy this file to <datadir>/defaults_llm_pricing.yaml (or
+# any path configured via management.json:
 #
-# Optional cache fields:
-#   cached_input_per_1k    OpenAI: rate for prompt_tokens_details.cached_tokens
-#                          (a SUBSET of prompt_tokens). Typically 0.5x input.
-#                          Absent → cached portion bills at input_per_1k.
-#   cache_read_per_1k      Anthropic: rate for cache_read_input_tokens
-#                          (ADDITIVE to input_tokens). Typically 0.1x input.
-#                          Absent → cache reads bill at input_per_1k.
-#   cache_creation_per_1k  Anthropic: rate for cache_creation_input_tokens
-#                          (ADDITIVE to input_tokens). Typically 1.25x input.
-#                          Absent → cache writes bill at input_per_1k.
+#   { "AgentNetwork": { "PricingDefaultsFile": "/path/defaults_llm_pricing.yaml" } }
+#
+# ) and adjust the entries you want to change. Management re-reads the
+# file periodically (mtime poll, every minute): the live table feeds the
+# proxies' cost metering and the dashboard's model-price prefill, so
+# edits apply without a restart. Your file only needs the entries you
+# want to change — but each entry REPLACES the built-in entry for that
+# surface+model whole, so repeat the cache rates you want to keep.
+# Unknown fields and negative or non-finite rates are rejected: at
+# startup that fails boot (for an explicitly configured path); at
+# runtime the previous table is kept and a warning is logged. Deleting
+# the file reverts to the built-in defaults below.
+#
+# Top-level keys are pricing surfaces — the parser shape requests are
+# metered under: "openai" (also Azure, Mistral, and OpenAI-compatible
+# gateways), "anthropic" (also Anthropic-on-Vertex), "bedrock"
+# (normalized ids, e.g. anthropic.claude-sonnet-4-5). Model keys must be
+# the normalized id the proxy meters (version/region suffixes stripped).
+#
+# Values are USD per 1_000 tokens. Optional cache fields:
+#   cached_input_per_1k    OpenAI shape: rate for cached prompt tokens
+#                          (a SUBSET of input tokens). Absent -> cached
+#                          portion bills at input_per_1k.
+#   cache_read_per_1k      Anthropic shape: rate for cache_read tokens
+#                          (ADDITIVE to input). Absent -> input rate.
+#   cache_creation_per_1k  Anthropic shape: rate for cache_creation
+#                          tokens (ADDITIVE to input). Absent -> input
+#                          rate.
+
+anthropic:
+  claude-fable-5:
+    input_per_1k: 0.01
+    output_per_1k: 0.05
+    cache_read_per_1k: 0.001
+    cache_creation_per_1k: 0.0125
+  claude-haiku-4-5:
+    input_per_1k: 0.001
+    output_per_1k: 0.005
+    cache_read_per_1k: 0.0001
+    cache_creation_per_1k: 0.00125
+  claude-opus-4-1:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+    cache_read_per_1k: 0.0015
+    cache_creation_per_1k: 0.01875
+  claude-opus-4-6:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-7:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-8:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-5:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  claude-sonnet-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  kimi-k3:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cached_input_per_1k: 0.0003
+    cache_read_per_1k: 0.0003
+  "kimi-k3[1m]":
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+
+bedrock:
+  amazon.nova-2-lite:
+    input_per_1k: 0.0003
+    output_per_1k: 0.0025
+  amazon.nova-lite:
+    input_per_1k: 0.00006
+    output_per_1k: 0.00024
+  amazon.nova-micro:
+    input_per_1k: 0.000035
+    output_per_1k: 0.00014
+  amazon.nova-pro:
+    input_per_1k: 0.0008
+    output_per_1k: 0.0032
+  anthropic.claude-haiku-4-5:
+    input_per_1k: 0.001
+    output_per_1k: 0.005
+    cache_read_per_1k: 0.0001
+    cache_creation_per_1k: 0.00125
+  anthropic.claude-opus-4-1:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+    cache_read_per_1k: 0.0015
+    cache_creation_per_1k: 0.01875
+  anthropic.claude-opus-4-6:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-7:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-8:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-5:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  anthropic.claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  anthropic.claude-sonnet-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  meta.llama3-3-70b-instruct:
+    input_per_1k: 0.00072
+    output_per_1k: 0.00072
 
 openai:
-  # OpenAI + OpenAI-compatible providers (openai_api, azure_openai_api,
-  # mistral_api, and the openai-parser gateways) all emit llm.provider="openai",
-  # so their models are priced here. Kept in sync with the management catalog;
-  # rates cross-checked against LiteLLM model_prices_and_context_window.json.
-
-  # GPT-5.x family — cache reads 10% of input (0.1x).
-  gpt-5.5:
-    input_per_1k: 0.005
-    output_per_1k: 0.03
-    cached_input_per_1k: 0.0005
-  gpt-5.5-pro:
-    input_per_1k: 0.03
-    output_per_1k: 0.18
-    cached_input_per_1k: 0.003
-  gpt-5.4:
-    input_per_1k: 0.0025
-    output_per_1k: 0.015
-    cached_input_per_1k: 0.00025
-  gpt-5.4-pro:
-    input_per_1k: 0.03
-    output_per_1k: 0.18
-    cached_input_per_1k: 0.003
-  gpt-5.4-mini:
-    input_per_1k: 0.00075
-    output_per_1k: 0.0045
-    cached_input_per_1k: 0.000075
-  gpt-5.4-nano:
-    input_per_1k: 0.0002
-    output_per_1k: 0.00125
-    cached_input_per_1k: 0.00002
-  gpt-5.3-codex:
-    input_per_1k: 0.00175
-    output_per_1k: 0.014
-    cached_input_per_1k: 0.000175
-  gpt-5.3-chat-latest:
-    input_per_1k: 0.00175
-    output_per_1k: 0.014
-    cached_input_per_1k: 0.000175
-  # GPT-5 (2025) family — kept for gateway requests using the unsuffixed ids.
-  gpt-5:
-    input_per_1k: 0.00125
-    output_per_1k: 0.01
-    cached_input_per_1k: 0.000125
-  gpt-5-mini:
-    input_per_1k: 0.00025
+  codestral-2508:
+    input_per_1k: 0.0003
+    output_per_1k: 0.0009
+  codestral-latest:
+    input_per_1k: 0.001
+    output_per_1k: 0.003
+  devstral-medium-latest:
+    input_per_1k: 0.0004
     output_per_1k: 0.002
-    cached_input_per_1k: 0.000025
-  gpt-5-nano:
-    input_per_1k: 0.00005
-    output_per_1k: 0.0004
-    cached_input_per_1k: 0.000005
-  o4-mini:
-    input_per_1k: 0.0011
-    output_per_1k: 0.0044
-    cached_input_per_1k: 0.000275
-  # GPT-4.1 family — cache reads 25% of input.
+  devstral-small-latest:
+    input_per_1k: 0.0001
+    output_per_1k: 0.0003
+  gpt-3.5-turbo:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  gpt-35-turbo:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  gpt-4-turbo:
+    input_per_1k: 0.01
+    output_per_1k: 0.03
   gpt-4.1:
     input_per_1k: 0.002
     output_per_1k: 0.008
@@ -90,7 +193,6 @@ openai:
     input_per_1k: 0.0001
     output_per_1k: 0.0004
     cached_input_per_1k: 0.000025
-  # GPT-4o family — cache reads 50% of input (0.5x).
   gpt-4o:
     input_per_1k: 0.0025
     output_per_1k: 0.01
@@ -99,166 +201,92 @@ openai:
     input_per_1k: 0.00015
     output_per_1k: 0.0006
     cached_input_per_1k: 0.000075
-  # Older GPT — no prompt caching.
-  gpt-4-turbo:
-    input_per_1k: 0.01
-    output_per_1k: 0.03
-  gpt-3.5-turbo:
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  gpt-35-turbo: # Azure deployment alias of gpt-3.5-turbo
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  # Embeddings — no caching, no output tokens.
-  text-embedding-3-large:
-    input_per_1k: 0.00013
-    output_per_1k: 0
-  text-embedding-3-small:
-    input_per_1k: 0.00002
-    output_per_1k: 0
-
-  # Mistral (mistral_api) — routed via the openai parser; no prompt caching.
-  mistral-large-latest:
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  mistral-medium-latest:
-    input_per_1k: 0.0004
+  gpt-5:
+    input_per_1k: 0.00125
+    output_per_1k: 0.01
+    cached_input_per_1k: 0.000125
+  gpt-5-mini:
+    input_per_1k: 0.00025
     output_per_1k: 0.002
-  mistral-medium-3-5:
-    input_per_1k: 0.0015
-    output_per_1k: 0.0075
-  mistral-small-latest:
-    input_per_1k: 0.00006
-    output_per_1k: 0.00018
+    cached_input_per_1k: 0.000025
+  gpt-5-nano:
+    input_per_1k: 0.00005
+    output_per_1k: 0.0004
+    cached_input_per_1k: 0.000005
+  gpt-5.3-chat-latest:
+    input_per_1k: 0.00175
+    output_per_1k: 0.014
+    cached_input_per_1k: 0.000175
+  gpt-5.3-codex:
+    input_per_1k: 0.00175
+    output_per_1k: 0.014
+    cached_input_per_1k: 0.000175
+  gpt-5.4:
+    input_per_1k: 0.0025
+    output_per_1k: 0.015
+    cached_input_per_1k: 0.00025
+  gpt-5.4-mini:
+    input_per_1k: 0.00075
+    output_per_1k: 0.0045
+    cached_input_per_1k: 0.000075
+  gpt-5.4-nano:
+    input_per_1k: 0.0002
+    output_per_1k: 0.00125
+    cached_input_per_1k: 0.00002
+  gpt-5.4-pro:
+    input_per_1k: 0.03
+    output_per_1k: 0.18
+    cached_input_per_1k: 0.003
+  gpt-5.5:
+    input_per_1k: 0.005
+    output_per_1k: 0.03
+    cached_input_per_1k: 0.0005
+  gpt-5.5-pro:
+    input_per_1k: 0.03
+    output_per_1k: 0.18
+    cached_input_per_1k: 0.003
+  kimi-k3:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cached_input_per_1k: 0.0003
+    cache_read_per_1k: 0.0003
   magistral-medium-latest:
     input_per_1k: 0.002
     output_per_1k: 0.005
   magistral-small-latest:
     input_per_1k: 0.0005
     output_per_1k: 0.0015
-  devstral-medium-latest:
-    input_per_1k: 0.0004
-    output_per_1k: 0.002
-  devstral-small-latest:
-    input_per_1k: 0.0001
-    output_per_1k: 0.0003
-  codestral-2508:
-    input_per_1k: 0.0003
-    output_per_1k: 0.0009
-  codestral-latest:
-    input_per_1k: 0.001
-    output_per_1k: 0.003
   ministral-3-14b-2512:
     input_per_1k: 0.0002
     output_per_1k: 0.0002
-  ministral-8b-latest:
-    input_per_1k: 0.00015
-    output_per_1k: 0.00015
   ministral-3-3b-2512:
     input_per_1k: 0.0001
     output_per_1k: 0.0001
+  ministral-8b-latest:
+    input_per_1k: 0.00015
+    output_per_1k: 0.00015
   mistral-embed:
     input_per_1k: 0.0001
     output_per_1k: 0
-
-anthropic:
-  # Claude 4.x family — cache reads ≈10% of input, cache writes ≈125% of input.
-  # Pricing source: Anthropic's current published rates per million tokens,
-  # divided by 1000 for the per-1k figures stored here.
-  claude-fable-5:
-    input_per_1k: 0.010
-    output_per_1k: 0.050
-    cache_read_per_1k: 0.001
-    cache_creation_per_1k: 0.0125
-  claude-opus-4-8:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-opus-4-7:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-opus-4-6:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-opus-4-1:
-    input_per_1k: 0.015
-    output_per_1k: 0.075
-    cache_read_per_1k: 0.0015
-    cache_creation_per_1k: 0.01875
-  claude-sonnet-4-6:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  claude-sonnet-4-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  claude-haiku-4-5:
-    input_per_1k: 0.001
-    output_per_1k: 0.005
-    cache_read_per_1k: 0.0001
-    cache_creation_per_1k: 0.00125
-
-bedrock:
-  # AWS Bedrock model ids, normalised by the request parser (cross-region
-  # inference-profile prefix + version/throughput suffix stripped), e.g.
-  # eu.anthropic.claude-sonnet-4-5-20250929-v1:0 -> anthropic.claude-sonnet-4-5.
-  # Anthropic-on-Bedrock keeps the additive cache buckets (read ≈0.1x input,
-  # write ≈1.25x input); Nova / Llama report no cache, so cost is input+output.
-  anthropic.claude-opus-4-8:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-opus-4-7:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-opus-4-6:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-opus-4-1:
-    input_per_1k: 0.015
-    output_per_1k: 0.075
-    cache_read_per_1k: 0.0015
-    cache_creation_per_1k: 0.01875
-  anthropic.claude-sonnet-4-6:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  anthropic.claude-sonnet-4-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  anthropic.claude-haiku-4-5:
-    input_per_1k: 0.001
-    output_per_1k: 0.005
-    cache_read_per_1k: 0.0001
-    cache_creation_per_1k: 0.00125
-  meta.llama3-3-70b-instruct:
-    input_per_1k: 0.00072
-    output_per_1k: 0.00072
-  amazon.nova-2-lite:
-    input_per_1k: 0.0003
-    output_per_1k: 0.0025
-  amazon.nova-pro:
-    input_per_1k: 0.0008
-    output_per_1k: 0.0032
-  amazon.nova-lite:
+  mistral-large-latest:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  mistral-medium-3-5:
+    input_per_1k: 0.0015
+    output_per_1k: 0.0075
+  mistral-medium-latest:
+    input_per_1k: 0.0004
+    output_per_1k: 0.002
+  mistral-small-latest:
     input_per_1k: 0.00006
-    output_per_1k: 0.00024
-  amazon.nova-micro:
-    input_per_1k: 0.000035
-    output_per_1k: 0.00014
+    output_per_1k: 0.00018
+  o4-mini:
+    input_per_1k: 0.0011
+    output_per_1k: 0.0044
+    cached_input_per_1k: 0.000275
+  text-embedding-3-large:
+    input_per_1k: 0.00013
+    output_per_1k: 0
+  text-embedding-3-small:
+    input_per_1k: 0.00002
+    output_per_1k: 0
diff --git a/management/internals/modules/agentnetwork/pricing/defaults_test.go b/management/internals/modules/agentnetwork/pricing/defaults_test.go
new file mode 100644
index 000000000..04b6de550
--- /dev/null
+++ b/management/internals/modules/agentnetwork/pricing/defaults_test.go
@@ -0,0 +1,150 @@
+package pricing
+
+import (
+	"math"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+)
+
+// TestDefaultTable_CoversEveryCatalogModel replaces the proxy's old
+// hand-maintained coverage list: because the table is built FROM the
+// catalog, drift is impossible by construction — this test guards the
+// fold itself (every catalog model of every surfaced provider resolves,
+// with exactly the catalog's rates).
+func TestDefaultTable_CoversEveryCatalogModel(t *testing.T) {
+	table := DefaultTable()
+	for _, p := range catalog.All() {
+		if len(p.PricingSurfaces) == 0 {
+			assert.Empty(t, p.Models, "catalog entry %s declares models but no pricing surfaces — those models would never be priced", p.ID)
+			continue
+		}
+		for _, surface := range p.PricingSurfaces {
+			byModel, ok := table[surface]
+			require.True(t, ok, "surface %q (provider %s) missing from default table", surface, p.ID)
+			for _, m := range p.Models {
+				e, ok := byModel[m.ID]
+				require.True(t, ok, "%s/%s (provider %s) missing from default table", surface, m.ID, p.ID)
+				assert.Equal(t, m.InputPer1k, e.InputPer1k, "%s/%s input rate", surface, m.ID)
+				assert.Equal(t, m.OutputPer1k, e.OutputPer1k, "%s/%s output rate", surface, m.ID)
+			}
+		}
+	}
+}
+
+// TestDefaultTable_NoConflictingContributions enforces the collision rule
+// documented on catalog.Provider.PricingSurfaces: when two catalog
+// providers contribute the same (surface, model) pair — azure/vertex
+// mirroring openai/anthropic, kimi on both surfaces — their rates must be
+// identical, because the surface-keyed table can only hold one entry.
+// If a provider ever diverges (e.g. Azure reprices a model), this fails
+// and the divergence must move to per-provider-record pricing.
+func TestDefaultTable_NoConflictingContributions(t *testing.T) {
+	type contribution struct {
+		providerID string
+		entry      Entry
+	}
+	seen := map[string]map[string]contribution{}
+	for _, p := range catalog.All() {
+		for _, surface := range p.PricingSurfaces {
+			if seen[surface] == nil {
+				seen[surface] = map[string]contribution{}
+			}
+			for _, m := range p.Models {
+				e := entryFromCatalogModel(m)
+				if prev, dup := seen[surface][m.ID]; dup {
+					assert.Equal(t, prev.entry, e,
+						"%s/%s: %s and %s contribute different rates", surface, m.ID, prev.providerID, p.ID)
+					continue
+				}
+				seen[surface][m.ID] = contribution{providerID: p.ID, entry: e}
+			}
+		}
+	}
+	// Supplemental entries must never shadow a catalog-contributed model —
+	// they exist precisely because the catalog does NOT list them.
+	for surface, models := range supplementalDefaults {
+		for id := range models {
+			_, fromCatalog := seen[surface][id]
+			assert.False(t, fromCatalog, "supplemental %s/%s is now in the catalog — delete the supplemental row", surface, id)
+		}
+	}
+}
+
+// TestDefaultTable_AllRatesFiniteNonNegative mirrors the proxy-side
+// NewTable validation so a bad catalog edit is caught here, at unit-test
+// time, rather than as a chain-build failure on every proxy.
+func TestDefaultTable_AllRatesFiniteNonNegative(t *testing.T) {
+	for surface, models := range DefaultTable() {
+		for id, e := range models {
+			for field, v := range map[string]float64{
+				"input":          e.InputPer1k,
+				"output":         e.OutputPer1k,
+				"cached_input":   e.CachedInputPer1k,
+				"cache_read":     e.CacheReadPer1k,
+				"cache_creation": e.CacheCreationPer1k,
+			} {
+				assert.False(t, v < 0 || math.IsNaN(v) || math.IsInf(v, 0),
+					"%s/%s: %s rate %v must be finite and non-negative", surface, id, field, v)
+			}
+		}
+	}
+}
+
+// TestDefaultTable_PinnedRates pins rates that previously drifted or are
+// easy to mis-enter (carried over from the proxy's retired
+// defaults_coverage_test), plus the supplemental entries.
+func TestDefaultTable_PinnedRates(t *testing.T) {
+	table := DefaultTable()
+
+	gpt54 := table["openai"]["gpt-5.4"]
+	assert.InDelta(t, 0.0025, gpt54.InputPer1k, 1e-9, "gpt-5.4 input")
+	assert.InDelta(t, 0.015, gpt54.OutputPer1k, 1e-9, "gpt-5.4 output")
+	assert.InDelta(t, 0.00025, gpt54.CachedInputPer1k, 1e-9, "gpt-5.4 cached input")
+
+	sonnet := table["bedrock"]["anthropic.claude-sonnet-4-5"]
+	assert.InDelta(t, 0.003, sonnet.InputPer1k, 1e-9, "bedrock sonnet-4-5 input")
+	assert.InDelta(t, 0.015, sonnet.OutputPer1k, 1e-9, "bedrock sonnet-4-5 output")
+	assert.InDelta(t, 0.0003, sonnet.CacheReadPer1k, 1e-9, "bedrock sonnet-4-5 cache read")
+	assert.InDelta(t, 0.00375, sonnet.CacheCreationPer1k, 1e-9, "bedrock sonnet-4-5 cache creation")
+
+	// Vertex Claude prices under "anthropic" with the bare id.
+	fable := table["anthropic"]["claude-fable-5"]
+	assert.InDelta(t, 0.010, fable.InputPer1k, 1e-9, "claude-fable-5 input")
+	assert.InDelta(t, 0.0125, fable.CacheCreationPer1k, 1e-9, "claude-fable-5 cache creation")
+
+	// Every id below must stay priced whichever source provides it: the
+	// catalog lineup for the current Claude 5 family, supplementalDefaults
+	// for the ids the dashboard deliberately doesn't offer.
+	for surface, ids := range map[string][]string{
+		"openai":    {"gpt-5", "gpt-5-mini", "gpt-5-nano"},
+		"anthropic": {"claude-opus-5", "claude-sonnet-5", "kimi-k3[1m]", "kimi-k3"},
+		"bedrock":   {"anthropic.claude-opus-5", "anthropic.claude-sonnet-5"},
+	} {
+		for _, id := range ids {
+			_, ok := table[surface][id]
+			assert.True(t, ok, "%s/%s must be priced", surface, id)
+		}
+	}
+
+	// Embeddings bill input-only — output stays zero.
+	emb := table["openai"]["text-embedding-3-large"]
+	assert.Zero(t, emb.OutputPer1k, "embedding output rate must be zero")
+	assert.Positive(t, emb.InputPer1k, "embedding input rate must be set")
+}
+
+func TestLookupDefault_SurfaceOrder(t *testing.T) {
+	// kimi-k3 exists on both surfaces; first surface in the slice wins.
+	e, ok := LookupDefault([]string{"openai", "anthropic"}, "kimi-k3")
+	require.True(t, ok)
+	assert.InDelta(t, 0.003, e.InputPer1k, 1e-9)
+
+	_, ok = LookupDefault([]string{"bedrock"}, "gpt-4o")
+	assert.False(t, ok, "gpt-4o is not a bedrock model")
+
+	_, ok = LookupDefault(nil, "gpt-4o")
+	assert.False(t, ok, "no surfaces, no match")
+}
diff --git a/management/internals/modules/agentnetwork/pricing/exampleyaml.go b/management/internals/modules/agentnetwork/pricing/exampleyaml.go
new file mode 100644
index 000000000..6217928d6
--- /dev/null
+++ b/management/internals/modules/agentnetwork/pricing/exampleyaml.go
@@ -0,0 +1,109 @@
+package pricing
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strconv"
+)
+
+// MarshalDefaultsYAML renders the built-in default pricing table (catalog
+// + supplementals, WITHOUT any operator override) as the YAML schema
+// LoadOverrideFile consumes. It backs the generated
+// defaults_llm_pricing.example.yaml so operators start from a file that
+// matches the compiled-in rates exactly; a golden test keeps the two in
+// sync. Output is deterministic (sorted surfaces and models).
+func MarshalDefaultsYAML() []byte {
+	var b bytes.Buffer
+	b.WriteString(exampleHeader)
+
+	table := buildDefaultTable()
+	surfaces := make([]string, 0, len(table))
+	for s := range table {
+		surfaces = append(surfaces, s)
+	}
+	sort.Strings(surfaces)
+
+	for _, surface := range surfaces {
+		fmt.Fprintf(&b, "\n%s:\n", surface)
+		models := table[surface]
+		ids := make([]string, 0, len(models))
+		for id := range models {
+			ids = append(ids, id)
+		}
+		sort.Strings(ids)
+		for _, id := range ids {
+			e := models[id]
+			fmt.Fprintf(&b, "  %s:\n", yamlKey(id))
+			fmt.Fprintf(&b, "    input_per_1k: %s\n", rate(e.InputPer1k))
+			fmt.Fprintf(&b, "    output_per_1k: %s\n", rate(e.OutputPer1k))
+			if e.CachedInputPer1k > 0 {
+				fmt.Fprintf(&b, "    cached_input_per_1k: %s\n", rate(e.CachedInputPer1k))
+			}
+			if e.CacheReadPer1k > 0 {
+				fmt.Fprintf(&b, "    cache_read_per_1k: %s\n", rate(e.CacheReadPer1k))
+			}
+			if e.CacheCreationPer1k > 0 {
+				fmt.Fprintf(&b, "    cache_creation_per_1k: %s\n", rate(e.CacheCreationPer1k))
+			}
+		}
+	}
+	return b.Bytes()
+}
+
+// rate renders a USD-per-1k rate without float noise ("0.00015", not
+// "0.000150000000...").
+func rate(v float64) string {
+	return strconv.FormatFloat(v, 'f', -1, 64)
+}
+
+// yamlKey quotes model ids that YAML would otherwise misparse (e.g.
+// "kimi-k3[1m]" starts a flow sequence unquoted).
+func yamlKey(id string) string {
+	for _, r := range id {
+		switch r {
+		case '[', ']', '{', '}', ':', '#', ',', '&', '*', '!', '|', '>', '\'', '"', '%', '@', '`':
+			return strconv.Quote(id)
+		}
+	}
+	return id
+}
+
+const exampleHeader = `# Default LLM pricing used by NetBird's Agent Network cost metering.
+# GENERATED from the management catalog — do not edit this file in the
+# repository; regenerate with:
+#
+#   go generate ./management/internals/modules/agentnetwork/pricing
+#
+# Operators: copy this file to <datadir>/defaults_llm_pricing.yaml (or
+# any path configured via management.json:
+#
+#   { "AgentNetwork": { "PricingDefaultsFile": "/path/defaults_llm_pricing.yaml" } }
+#
+# ) and adjust the entries you want to change. Management re-reads the
+# file periodically (mtime poll, every minute): the live table feeds the
+# proxies' cost metering and the dashboard's model-price prefill, so
+# edits apply without a restart. Your file only needs the entries you
+# want to change — but each entry REPLACES the built-in entry for that
+# surface+model whole, so repeat the cache rates you want to keep.
+# Unknown fields and negative or non-finite rates are rejected: at
+# startup that fails boot (for an explicitly configured path); at
+# runtime the previous table is kept and a warning is logged. Deleting
+# the file reverts to the built-in defaults below.
+#
+# Top-level keys are pricing surfaces — the parser shape requests are
+# metered under: "openai" (also Azure, Mistral, and OpenAI-compatible
+# gateways), "anthropic" (also Anthropic-on-Vertex), "bedrock"
+# (normalized ids, e.g. anthropic.claude-sonnet-4-5). Model keys must be
+# the normalized id the proxy meters (version/region suffixes stripped).
+#
+# Values are USD per 1_000 tokens. Optional cache fields:
+#   cached_input_per_1k    OpenAI shape: rate for cached prompt tokens
+#                          (a SUBSET of input tokens). Absent -> cached
+#                          portion bills at input_per_1k.
+#   cache_read_per_1k      Anthropic shape: rate for cache_read tokens
+#                          (ADDITIVE to input). Absent -> input rate.
+#   cache_creation_per_1k  Anthropic shape: rate for cache_creation
+#                          tokens (ADDITIVE to input). Absent -> input
+#                          rate.
+`
diff --git a/management/internals/modules/agentnetwork/pricing/gen.go b/management/internals/modules/agentnetwork/pricing/gen.go
new file mode 100644
index 000000000..c799ab87c
--- /dev/null
+++ b/management/internals/modules/agentnetwork/pricing/gen.go
@@ -0,0 +1,20 @@
+//go:build ignore
+
+// Regenerates defaults_llm_pricing.example.yaml from the compiled-in
+// default pricing table. Run via:
+//
+//	go generate ./management/internals/modules/agentnetwork/pricing
+package main
+
+import (
+	"log"
+	"os"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
+)
+
+func main() {
+	if err := os.WriteFile("defaults_llm_pricing.example.yaml", pricing.MarshalDefaultsYAML(), 0o644); err != nil {
+		log.Fatalf("write defaults_llm_pricing.example.yaml: %v", err)
+	}
+}
diff --git a/management/internals/modules/agentnetwork/pricing/override.go b/management/internals/modules/agentnetwork/pricing/override.go
new file mode 100644
index 000000000..07677dbaa
--- /dev/null
+++ b/management/internals/modules/agentnetwork/pricing/override.go
@@ -0,0 +1,249 @@
+package pricing
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"math"
+	"os"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"gopkg.in/yaml.v3"
+)
+
+// DefaultFileName is the basename probed under management's datadir when
+// AgentNetwork.PricingDefaultsFile doesn't configure an explicit path.
+const DefaultFileName = "defaults_llm_pricing.yaml"
+
+// ReloadInterval is the cadence at which the pricing file's mtime is
+// polled for changes.
+const ReloadInterval = time.Minute
+
+// maxFileBytes bounds the pricing file read so a misconfigured path
+// (pointed at a huge file) cannot exhaust process memory.
+const maxFileBytes = 4 << 20
+
+// pricingFile mirrors the on-disk YAML schema — the same schema the
+// proxy's retired embedded defaults_pricing.yaml used, so files written
+// for it keep working. Keys are pricing surfaces ("openai", "anthropic",
+// "bedrock"); nested keys are normalized model ids.
+type pricingFile map[string]map[string]struct {
+	InputPer1k         float64 `yaml:"input_per_1k"`
+	OutputPer1k        float64 `yaml:"output_per_1k"`
+	CachedInputPer1k   float64 `yaml:"cached_input_per_1k"`
+	CacheReadPer1k     float64 `yaml:"cache_read_per_1k"`
+	CacheCreationPer1k float64 `yaml:"cache_creation_per_1k"`
+}
+
+// fileState tracks the watched pricing file across reloads.
+var fileState struct {
+	mu    sync.Mutex
+	path  string
+	mtime int64
+}
+
+// LoadFile loads the management-side pricing defaults file and makes it
+// the live table (merged entry-whole over the compiled-in fallback; see
+// DefaultTable). The path stays registered for the periodic reloader, so
+// later edits — or the file (re)appearing after deletion — are picked up
+// without a restart.
+//
+// required governs the missing-file case: true for an explicitly
+// configured path (a typo must fail startup rather than silently bill
+// with built-ins the operator believes they replaced), false for the
+// conventional <datadir>/defaults_llm_pricing.yaml probe (absent file =
+// compiled-in defaults, still watched in case it appears). A file that
+// exists but is malformed is always an error at load time.
+func LoadFile(path string, required bool) error {
+	if path == "" {
+		return nil
+	}
+	fileState.mu.Lock()
+	fileState.path = path
+	fileState.mu.Unlock()
+
+	table, mtime, err := readFile(path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) && !required {
+			log.Infof("agent-network pricing defaults file %s not present; serving built-in defaults", path)
+			return nil
+		}
+		return err
+	}
+	storeFileTable(table, mtime)
+	log.Infof("agent-network pricing defaults loaded from %s", path)
+	return nil
+}
+
+// StartReloader launches the periodic mtime-poll goroutine for the file
+// registered by LoadFile. Runtime failures are lenient — a parse error
+// keeps the previously loaded table and logs a warning; a deleted file
+// reverts to the compiled-in defaults — so a mid-edit save can never
+// take pricing down. Returns immediately when no path was registered.
+func StartReloader(ctx context.Context, interval time.Duration) {
+	fileState.mu.Lock()
+	path := fileState.path
+	fileState.mu.Unlock()
+	if path == "" {
+		return
+	}
+	if interval <= 0 {
+		interval = ReloadInterval
+	}
+	go func() {
+		t := time.NewTicker(interval)
+		defer t.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				reload()
+			}
+		}
+	}()
+}
+
+// reload performs one mtime check + reload cycle.
+func reload() {
+	fileState.mu.Lock()
+	path, lastMtime := fileState.path, fileState.mtime
+	fileState.mu.Unlock()
+
+	log.Debugf("agent-network pricing defaults reload: checking %s for changes", path)
+
+	st, err := os.Stat(path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			// File removed (or not yet created): serve compiled-in
+			// defaults and reset mtime so a future (re)appearance loads.
+			if mergedTable.Swap(nil) != nil {
+				log.Warnf("agent-network pricing defaults file %s removed; reverting to built-in defaults", path)
+			}
+			setMtime(0)
+			return
+		}
+		log.Warnf("agent-network pricing defaults reload: stat %s: %v", path, err)
+		return
+	}
+	if st.ModTime().UnixNano() == lastMtime {
+		log.Debugf("agent-network pricing defaults %s unchanged since last check", path)
+		return
+	}
+
+	table, mtime, err := readFile(path)
+	if err != nil {
+		// Keep the previously loaded table — never blank prices because
+		// an operator saved mid-edit.
+		log.Warnf("agent-network pricing defaults reload failed for %s (keeping previous table): %v", path, err)
+		return
+	}
+	storeFileTable(table, mtime)
+	log.Infof("agent-network pricing defaults reloaded from %s", path)
+}
+
+func readFile(path string) (map[string]map[string]Entry, int64, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, 0, fmt.Errorf("open pricing defaults %s: %w", path, err)
+	}
+	defer func() { _ = f.Close() }()
+
+	st, err := f.Stat()
+	if err != nil {
+		return nil, 0, fmt.Errorf("stat pricing defaults %s: %w", path, err)
+	}
+	data, err := io.ReadAll(io.LimitReader(f, maxFileBytes+1))
+	if err != nil {
+		return nil, 0, fmt.Errorf("read pricing defaults %s: %w", path, err)
+	}
+	if len(data) > maxFileBytes {
+		return nil, 0, fmt.Errorf("pricing defaults %s exceeds %d bytes", path, maxFileBytes)
+	}
+	table, err := parsePricingYAML(data)
+	if err != nil {
+		return nil, 0, fmt.Errorf("parse pricing defaults %s: %w", path, err)
+	}
+	return table, st.ModTime().UnixNano(), nil
+}
+
+// storeFileTable merges the parsed file over the compiled-in base and
+// publishes the result as the live table. File entries replace the
+// built-in entry for the same (surface, model) whole — they are not
+// field-merged — and surfaces/models the file doesn't mention keep the
+// built-in rates, so a partial file only needs the entries it changes.
+func storeFileTable(table map[string]map[string]Entry, mtime int64) {
+	base := compiledBase()
+	merged := make(map[string]map[string]Entry, len(base)+len(table))
+	for surface, models := range base {
+		inner := make(map[string]Entry, len(models))
+		for id, e := range models {
+			inner[id] = e
+		}
+		merged[surface] = inner
+	}
+	for surface, models := range table {
+		inner, ok := merged[surface]
+		if !ok {
+			inner = make(map[string]Entry, len(models))
+			merged[surface] = inner
+		}
+		for id, e := range models {
+			inner[id] = e
+		}
+	}
+	mergedTable.Store(&merged)
+	setMtime(mtime)
+}
+
+func setMtime(v int64) {
+	fileState.mu.Lock()
+	fileState.mtime = v
+	fileState.mu.Unlock()
+}
+
+// parsePricingYAML decodes and validates the pricing YAML. Unknown
+// fields are rejected (typos surface instead of silently pricing at 0)
+// and every rate must be a finite, non-negative USD amount — the same
+// constraints the HTTP API enforces on operator per-provider prices.
+func parsePricingYAML(data []byte) (map[string]map[string]Entry, error) {
+	dec := yaml.NewDecoder(bytes.NewReader(data))
+	dec.KnownFields(true)
+
+	var raw pricingFile
+	if err := dec.Decode(&raw); err != nil && !errors.Is(err, io.EOF) {
+		return nil, fmt.Errorf("decode yaml: %w", err)
+	}
+
+	out := make(map[string]map[string]Entry, len(raw))
+	for surface, models := range raw {
+		inner := make(map[string]Entry, len(models))
+		for model, e := range models {
+			for field, v := range map[string]float64{
+				"input_per_1k":          e.InputPer1k,
+				"output_per_1k":         e.OutputPer1k,
+				"cached_input_per_1k":   e.CachedInputPer1k,
+				"cache_read_per_1k":     e.CacheReadPer1k,
+				"cache_creation_per_1k": e.CacheCreationPer1k,
+			} {
+				if v < 0 || math.IsNaN(v) || math.IsInf(v, 0) {
+					return nil, fmt.Errorf("%s/%s: %s must be a finite, non-negative rate, got %v", surface, model, field, v)
+				}
+			}
+			inner[model] = Entry{
+				InputPer1k:         e.InputPer1k,
+				OutputPer1k:        e.OutputPer1k,
+				CachedInputPer1k:   e.CachedInputPer1k,
+				CacheReadPer1k:     e.CacheReadPer1k,
+				CacheCreationPer1k: e.CacheCreationPer1k,
+			}
+		}
+		out[surface] = inner
+	}
+	return out, nil
+}
diff --git a/management/internals/modules/agentnetwork/pricing/override_test.go b/management/internals/modules/agentnetwork/pricing/override_test.go
new file mode 100644
index 000000000..86031fc58
--- /dev/null
+++ b/management/internals/modules/agentnetwork/pricing/override_test.go
@@ -0,0 +1,173 @@
+package pricing
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// resetFileState snapshots and restores the package-level file state so
+// tests stay order-independent.
+func resetFileState(t *testing.T) {
+	t.Helper()
+	prevMerged := mergedTable.Load()
+	fileState.mu.Lock()
+	prevPath, prevMtime := fileState.path, fileState.mtime
+	fileState.mu.Unlock()
+	t.Cleanup(func() {
+		mergedTable.Store(prevMerged)
+		fileState.mu.Lock()
+		fileState.path, fileState.mtime = prevPath, prevMtime
+		fileState.mu.Unlock()
+	})
+}
+
+func writePricing(t *testing.T, path, yml string) {
+	t.Helper()
+	require.NoError(t, os.WriteFile(path, []byte(yml), 0o600))
+}
+
+func TestLoadFile_MergesOverCompiledDefaults(t *testing.T) {
+	resetFileState(t)
+	path := filepath.Join(t.TempDir(), DefaultFileName)
+	writePricing(t, path, `
+openai:
+  # Reprice a built-in model. The entry replaces the built-in WHOLE:
+  # omitting the cache rate here drops the built-in 0.00125 discount.
+  gpt-4o:
+    input_per_1k: 0.9
+    output_per_1k: 1.8
+  # A model NetBird doesn't know at all.
+  my-private-ft:
+    input_per_1k: 0.01
+    output_per_1k: 0.02
+    cached_input_per_1k: 0.005
+gemini:
+  gemini-pro:
+    input_per_1k: 0.00125
+    output_per_1k: 0.005
+`)
+	require.NoError(t, LoadFile(path, true))
+	table := DefaultTable()
+
+	gpt4o := table["openai"]["gpt-4o"]
+	assert.InDelta(t, 0.9, gpt4o.InputPer1k, 1e-9, "file rate replaces the compiled-in rate")
+	assert.Zero(t, gpt4o.CachedInputPer1k, "entries replace whole — omitted cache rate is dropped, not inherited")
+
+	ft := table["openai"]["my-private-ft"]
+	assert.InDelta(t, 0.005, ft.CachedInputPer1k, 1e-9, "unknown models are added to the surface")
+	_, ok := table["gemini"]["gemini-pro"]
+	assert.True(t, ok, "a surface the catalog doesn't declare can be added")
+
+	// Untouched entries keep compiled-in rates (catalog, other surface,
+	// supplemental).
+	assert.InDelta(t, 0.00015, table["openai"]["gpt-4o-mini"].InputPer1k, 1e-9, "unlisted model keeps compiled rate")
+	assert.InDelta(t, 0.003, table["anthropic"]["claude-sonnet-4-5"].InputPer1k, 1e-9, "unlisted surface untouched")
+	assert.InDelta(t, 0.00125, table["openai"]["gpt-5"].InputPer1k, 1e-9, "supplemental entries untouched")
+
+	// The synthesizer-facing lookup reads the live table too.
+	e, ok := LookupDefault([]string{"openai"}, "gpt-4o")
+	require.True(t, ok)
+	assert.InDelta(t, 0.9, e.InputPer1k, 1e-9, "LookupDefault serves the file-backed rate")
+}
+
+func TestLoadFile_MissingPath(t *testing.T) {
+	resetFileState(t)
+	missing := filepath.Join(t.TempDir(), DefaultFileName)
+
+	require.Error(t, LoadFile(missing, true),
+		"explicitly configured path that doesn't exist must fail startup")
+
+	require.NoError(t, LoadFile(missing, false),
+		"conventional datadir probe tolerates an absent file (compiled-in defaults serve)")
+	assert.Nil(t, mergedTable.Load(), "no file, no merged table")
+	fileState.mu.Lock()
+	path := fileState.path
+	fileState.mu.Unlock()
+	assert.Equal(t, missing, path, "the path stays registered so the reloader picks the file up when it appears")
+}
+
+func TestLoadFile_RejectsInvalid(t *testing.T) {
+	resetFileState(t)
+	dir := t.TempDir()
+	cases := map[string]string{
+		"unknown field (typo)": "openai:\n  gpt-4o:\n    input_per1k: 0.1\n",
+		"negative rate":        "openai:\n  gpt-4o:\n    input_per_1k: -0.1\n",
+		"non-numeric rate":     "openai:\n  gpt-4o:\n    input_per_1k: cheap\n",
+		"not a mapping":        "- just\n- a\n- list\n",
+	}
+	for name, yml := range cases {
+		path := filepath.Join(dir, DefaultFileName)
+		writePricing(t, path, yml)
+		assert.Error(t, LoadFile(path, true), "case %q must be rejected", name)
+	}
+}
+
+// TestReload_LifeCycle drives the reloader's single-shot reload through
+// its full lifecycle: file edit picked up on mtime change, a broken save
+// keeps the previous table, and file removal reverts to the compiled-in
+// defaults (then a re-created file loads again).
+func TestReload_LifeCycle(t *testing.T) {
+	resetFileState(t)
+	path := filepath.Join(t.TempDir(), DefaultFileName)
+	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: 0.5\n    output_per_1k: 1\n")
+	require.NoError(t, LoadFile(path, true))
+	require.InDelta(t, 0.5, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9)
+
+	// Edit: new mtime, new rates.
+	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: 0.7\n    output_per_1k: 1.4\n")
+	bumpMtime(t, path)
+	reload()
+	assert.InDelta(t, 0.7, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9, "edit must be picked up")
+
+	// Broken save: previous table survives.
+	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: -1\n")
+	bumpMtime(t, path)
+	reload()
+	assert.InDelta(t, 0.7, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9,
+		"a malformed save must keep the previously loaded table, never blank prices")
+
+	// Removal: compiled-in defaults serve again.
+	require.NoError(t, os.Remove(path))
+	reload()
+	assert.InDelta(t, 0.0025, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9,
+		"file removal reverts to the compiled-in rate")
+
+	// Re-created file loads without a restart.
+	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: 0.9\n    output_per_1k: 1.8\n")
+	bumpMtime(t, path)
+	reload()
+	assert.InDelta(t, 0.9, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9,
+		"a file appearing after removal (or after a missing-probe boot) must load")
+}
+
+// bumpMtime pushes the file's mtime forward past the previously recorded
+// value — timestamps can otherwise collide within the test's timescale.
+func bumpMtime(t *testing.T, path string) {
+	t.Helper()
+	st, err := os.Stat(path)
+	require.NoError(t, err)
+	next := st.ModTime().Add(2 * 1e9)
+	require.NoError(t, os.Chtimes(path, next, next))
+}
+
+// TestExampleYAML_InSyncWithBuiltins is the golden guard for
+// defaults_llm_pricing.example.yaml: the shipped example must stay
+// byte-identical to what the compiled-in table renders (catalog edits
+// require `go generate ./management/internals/modules/agentnetwork/pricing`)
+// and must round-trip through the same parser operators' files go
+// through, reproducing the compiled-in table exactly.
+func TestExampleYAML_InSyncWithBuiltins(t *testing.T) {
+	onDisk, err := os.ReadFile("defaults_llm_pricing.example.yaml")
+	require.NoError(t, err, "example file must exist next to the package")
+	require.Equal(t, string(MarshalDefaultsYAML()), string(onDisk),
+		"defaults_llm_pricing.example.yaml is stale — run: go generate ./management/internals/modules/agentnetwork/pricing")
+
+	parsed, err := parsePricingYAML(onDisk)
+	require.NoError(t, err, "the example must be a valid pricing defaults file")
+	assert.Equal(t, buildDefaultTable(), parsed,
+		"parsing the example must reproduce the compiled-in table exactly")
+}
diff --git a/management/internals/modules/agentnetwork/provider_redaction_test.go b/management/internals/modules/agentnetwork/provider_redaction_test.go
new file mode 100644
index 000000000..d6a749fb9
--- /dev/null
+++ b/management/internals/modules/agentnetwork/provider_redaction_test.go
@@ -0,0 +1,289 @@
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// These tests pin the provider read surface per grant: a caller holding
+// providers read together with update (managers) gets the full record,
+// while read-only viewers (usage_viewer) get the display surface only —
+// connection configuration is redacted before it reaches the wire layer.
+
+func TestGetAllProviders_RedactsConnectionConfigForReadOnlyViewer(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+
+	saved := newSynthTestProvider()
+	saved.ExtraValues = map[string]string{"x-portkey-config": "cfg-123"}
+	saved.IdentityHeaderUserID = "X-User"
+	saved.IdentityHeaderGroups = "X-Groups"
+	saved.SkipTLSVerification = true
+	require.NoError(t, f.store.SaveAgentNetworkProvider(ctx, saved))
+
+	f.expectPermission(testAccountID, "viewer", modules.AgentNetworkProviders, operations.Read, true)
+	f.expectPermission(testAccountID, "viewer", modules.AgentNetworkProviders, operations.Update, false)
+
+	providers, err := f.manager.GetAllProviders(ctx, testAccountID, "viewer")
+	require.NoError(t, err)
+	require.Len(t, providers, 1)
+	p := providers[0]
+	assert.Equal(t, saved.ID, p.ID, "identity survives redaction")
+	assert.Equal(t, saved.Name, p.Name)
+	assert.Equal(t, saved.ProviderID, p.ProviderID)
+	assert.Equal(t, saved.Models, p.Models, "the model list backs the usage filters and stays")
+	assert.True(t, p.Enabled)
+	assert.Empty(t, p.UpstreamURL, "upstream URL is connection config")
+	assert.Empty(t, p.ExtraValues, "operator-typed header values are connection config")
+	assert.Empty(t, p.IdentityHeaderUserID)
+	assert.Empty(t, p.IdentityHeaderGroups)
+	assert.False(t, p.SkipTLSVerification)
+	assert.Empty(t, p.APIKey)
+	assert.Empty(t, p.SessionPrivateKey)
+
+	stored, err := f.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, testAccountID, saved.ID)
+	require.NoError(t, err)
+	assert.NotEmpty(t, stored.UpstreamURL, "redaction must not write back to the store")
+}
+
+func TestGetProvider_FullConfigForManagingCaller(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+
+	saved := newSynthTestProvider()
+	saved.ExtraValues = map[string]string{"x-portkey-config": "cfg-123"}
+	require.NoError(t, f.store.SaveAgentNetworkProvider(ctx, saved))
+
+	f.expectPermission(testAccountID, "admin", modules.AgentNetworkProviders, operations.Read, true)
+	f.expectPermission(testAccountID, "admin", modules.AgentNetworkProviders, operations.Update, true)
+
+	p, err := f.manager.GetProvider(ctx, testAccountID, "admin", saved.ID)
+	require.NoError(t, err)
+	assert.Equal(t, saved.UpstreamURL, p.UpstreamURL, "a caller who can edit the provider sees its config")
+	assert.Equal(t, saved.ExtraValues, p.ExtraValues)
+}
+
+func TestGetProvider_RedactsForReadOnlyViewer(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+
+	saved := newSynthTestProvider()
+	require.NoError(t, f.store.SaveAgentNetworkProvider(ctx, saved))
+
+	f.expectPermission(testAccountID, "viewer", modules.AgentNetworkProviders, operations.Read, true)
+	f.expectPermission(testAccountID, "viewer", modules.AgentNetworkProviders, operations.Update, false)
+
+	p, err := f.manager.GetProvider(ctx, testAccountID, "viewer", saved.ID)
+	require.NoError(t, err)
+	assert.Equal(t, saved.ID, p.ID)
+	assert.Empty(t, p.UpstreamURL)
+}
+
+// The self-scope tests drive the real permissions manager over the real
+// store, so role resolution is the production one: a plain user holds no
+// providers grant and must fall back to the caller-scoped list — the same
+// selection the self-service setup answer derives from — while an admin
+// keeps the account-wide view with full config.
+
+// newSelfScopeStore seeds the account and its users only, so each test
+// declares exactly the providers and policies it asserts on — the store
+// rejects re-saving a policy id on MySQL, so tests never overwrite each
+// other's rows.
+func newSelfScopeStore(t *testing.T) (*managerImpl, store.Store) {
+	t.Helper()
+	mgr, s := newAgentConfigTestMgr(t)
+	mgr.permissionsManager = permissions.NewManager(s)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAccount(ctx, &nbtypes.Account{Id: testAccountID}))
+	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
+		Id: "user-a", AccountID: testAccountID, Role: nbtypes.UserRoleUser, AutoGroups: []string{"grp-eng"},
+	}))
+	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
+		Id: "user-out", AccountID: testAccountID, Role: nbtypes.UserRoleUser,
+	}))
+	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
+		Id: "admin", AccountID: testAccountID, Role: nbtypes.UserRoleAdmin,
+	}))
+	return mgr, s
+}
+
+func newSelfScopeProvidersFixture(t *testing.T) (*managerImpl, store.Store) {
+	t.Helper()
+	mgr, s := newSelfScopeStore(t)
+	ctx := context.Background()
+
+	granted := newSynthTestProvider()
+	granted.ID = "prov-granted"
+	granted.Name = "Granted"
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, granted))
+
+	other := newSynthTestProvider()
+	other.ID = "prov-other"
+	other.Name = "Other"
+	other.CreatedAt = granted.CreatedAt.Add(time.Hour)
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, other))
+
+	disabled := newSynthTestProvider()
+	disabled.ID = "prov-disabled"
+	disabled.Name = "Disabled"
+	disabled.Enabled = false
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, disabled))
+
+	// user-a's group authorizes the granted and the disabled provider; the
+	// disabled one must still not surface (the proxy never routes it).
+	policy := newSynthTestPolicy(granted.ID, "grp-eng", "")
+	policy.DestinationProviderIDs = []string{granted.ID, disabled.ID}
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
+
+	return mgr, s
+}
+
+func TestGetAllProviders_SelfScopedForPlainUser(t *testing.T) {
+	ctx := context.Background()
+	mgr, _ := newSelfScopeProvidersFixture(t)
+
+	scoped, err := mgr.GetAllProviders(ctx, testAccountID, "user-a")
+	require.NoError(t, err, "a caller without the read grant self-scopes instead of being denied")
+	require.Len(t, scoped, 1)
+	assert.Equal(t, "prov-granted", scoped[0].ID)
+	assert.Empty(t, scoped[0].UpstreamURL, "the caller-scoped list is the redacted display surface")
+	assert.NotEmpty(t, scoped[0].Models, "model list backs the dashboard filters")
+
+	empty, err := mgr.GetAllProviders(ctx, testAccountID, "user-out")
+	require.NoError(t, err)
+	assert.Empty(t, empty, "a caller outside every policy gets an empty list, not an error")
+
+	all, err := mgr.GetAllProviders(ctx, testAccountID, "admin")
+	require.NoError(t, err)
+	assert.Len(t, all, 3, "grant holders keep the account-wide list, disabled providers included")
+	for _, p := range all {
+		if p.ID == "prov-granted" {
+			assert.NotEmpty(t, p.UpstreamURL, "a managing caller sees the connection config")
+		}
+	}
+}
+
+func TestGetProvider_SelfScopedForPlainUser(t *testing.T) {
+	ctx := context.Background()
+	mgr, _ := newSelfScopeProvidersFixture(t)
+
+	p, err := mgr.GetProvider(ctx, testAccountID, "user-a", "prov-granted")
+	require.NoError(t, err)
+	assert.Equal(t, "prov-granted", p.ID)
+	assert.Empty(t, p.UpstreamURL)
+
+	assertNotFound := func(id string) {
+		t.Helper()
+		_, err := mgr.GetProvider(ctx, testAccountID, "user-a", id)
+		require.Error(t, err)
+		var sErr *status.Error
+		require.ErrorAs(t, err, &sErr)
+		assert.Equal(t, status.NotFound, sErr.Type(),
+			"out-of-scope and nonexistent providers must be indistinguishable")
+	}
+	assertNotFound("prov-other")
+	assertNotFound("prov-disabled")
+	assertNotFound("prov-does-not-exist")
+}
+
+func TestGetAllProviders_SelfScopedModelsFollowGuardrails(t *testing.T) {
+	ctx := context.Background()
+	mgr, s := newSelfScopeStore(t)
+
+	// A provider declaring two models, restricted by an allowlist admitting
+	// one declared model plus one the operator never declared (unreachable —
+	// the router only claims declared models, so it must not surface).
+	granted := newSynthTestProvider()
+	granted.ID = "prov-models"
+	granted.Name = "Granted"
+	granted.Models = []types.ProviderModel{
+		{ID: "gpt-5.4", InputPer1k: 0.004, OutputPer1k: 0.02},
+		{ID: "gpt-4o", InputPer1k: 0.0025, OutputPer1k: 0.01},
+	}
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, granted))
+	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-models", "gpt-5.4", "gpt-undeclared")))
+	policy := newSynthTestPolicy(granted.ID, "grp-eng", "guard-models")
+	policy.ID = "pol-guard-models"
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
+
+	scoped, err := mgr.GetAllProviders(ctx, testAccountID, "user-a")
+	require.NoError(t, err)
+	require.Len(t, scoped, 1)
+	require.Len(t, scoped[0].Models, 1,
+		"the self-scoped model list is the effective set: allowlist ∩ declared")
+	assert.Equal(t, "gpt-5.4", scoped[0].Models[0].ID)
+	assert.Equal(t, 0.004, scoped[0].Models[0].InputPer1k, "declared entry survives, prices included")
+
+	all, err := mgr.GetAllProviders(ctx, testAccountID, "admin")
+	require.NoError(t, err)
+	for _, p := range all {
+		if p.ID == granted.ID {
+			assert.Len(t, p.Models, 2,
+				"grant holders keep the full declared list — their usage view spans everyone's requests")
+		}
+	}
+}
+
+func TestGetAllProviders_SelfScopedAllowlistWithoutDeclaredModels(t *testing.T) {
+	ctx := context.Background()
+	mgr, s := newSelfScopeStore(t)
+
+	// No operator declaration: the router claims every model, so the
+	// allowlist union is the effective set and comes back as bare entries.
+	granted := newSynthTestProvider()
+	granted.ID = "prov-bare"
+	granted.Name = "Granted"
+	granted.Models = nil
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, granted))
+	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-bare", "gpt-5.4")))
+	policy := newSynthTestPolicy(granted.ID, "grp-eng", "guard-bare")
+	policy.ID = "pol-guard-bare"
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
+
+	scoped, err := mgr.GetAllProviders(ctx, testAccountID, "user-a")
+	require.NoError(t, err)
+	require.Len(t, scoped, 1)
+	require.Len(t, scoped[0].Models, 1)
+	assert.Equal(t, "gpt-5.4", scoped[0].Models[0].ID)
+}
+
+func TestGetAllProviders_SelfScopedUnrestrictedFallsBackToCatalogModels(t *testing.T) {
+	ctx := context.Background()
+	mgr, s := newSelfScopeStore(t)
+
+	// Unrestricted policy on a provider without an operator declaration:
+	// the setup answer advertises the catalog models, and the scoped
+	// provider list must match so the model filter is never emptier than
+	// the setup page.
+	granted := newSynthTestProvider()
+	granted.ID = "prov-catalog"
+	granted.Name = "Granted"
+	granted.Models = nil
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, granted))
+	policy := newSynthTestPolicy(granted.ID, "grp-eng", "")
+	policy.ID = "pol-catalog"
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
+
+	scoped, err := mgr.GetAllProviders(ctx, testAccountID, "user-a")
+	require.NoError(t, err)
+	require.Len(t, scoped, 1)
+	require.NotEmpty(t, scoped[0].Models, "catalog models back the filter when the operator declared none")
+	ids := make([]string, 0, len(scoped[0].Models))
+	for _, m := range scoped[0].Models {
+		ids = append(ids, m.ID)
+	}
+	assert.Equal(t, declaredModelIDs(granted), ids, "the scoped list mirrors the setup answer's declared/catalog set")
+}
diff --git a/management/internals/modules/agentnetwork/reconcile.go b/management/internals/modules/agentnetwork/reconcile.go
index 319553ebc..20d0bb42a 100644
--- a/management/internals/modules/agentnetwork/reconcile.go
+++ b/management/internals/modules/agentnetwork/reconcile.go
@@ -2,14 +2,27 @@ package agentnetwork
 
 import (
 	"context"
+	"fmt"
 
 	log "github.com/sirupsen/logrus"
+	goproto "google.golang.org/protobuf/proto"
 
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
+// syntheticMapping pairs a synthesised proxy mapping with the address of the
+// proxy that serves it. The cluster is recorded rather than derived from the
+// mapping's domain: ProxyMapping does not carry it, and the previous derivation
+// -- everything after the first DNS label -- is wrong whenever the service's
+// domain is not one label under its proxy's address, which silently addressed
+// updates to a cluster no proxy declares.
+type syntheticMapping struct {
+	mapping *proto.ProxyMapping
+	cluster string
+}
+
 // reconcile recomputes the synthesised reverse-proxy services for an
 // account, diffs them against the previously-synthesised set in the
 // in-memory cache, and emits Create / Update / Delete proxy mappings
@@ -45,18 +58,21 @@ func (m *managerImpl) reconcile(ctx context.Context, accountID string) {
 	}
 
 	oidcCfg := m.proxyController.GetOIDCValidationConfig()
-	current := make(map[string]*proto.ProxyMapping, len(services))
+	current := make(map[string]syntheticMapping, len(services))
 	for _, svc := range services {
 		if svc == nil || svc.ID == "" {
 			continue
 		}
-		current[svc.ID] = svc.ToProtoMapping(rpservice.Update, "", oidcCfg)
+		current[svc.ID] = syntheticMapping{
+			mapping: svc.ToProtoMapping(rpservice.Update, "", oidcCfg),
+			cluster: svc.ProxyCluster,
+		}
 	}
 
 	m.reconcileMu.Lock()
 	previous := m.reconcileCache[accountID]
 	if previous == nil {
-		previous = make(map[string]*proto.ProxyMapping)
+		previous = make(map[string]syntheticMapping)
 	}
 
 	creates, updates, deletes := diffMappings(previous, current)
@@ -67,34 +83,84 @@ func (m *managerImpl) reconcile(ctx context.Context, accountID string) {
 	}
 	m.reconcileMu.Unlock()
 
-	for _, mapping := range creates {
-		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
-	}
-	for _, mapping := range updates {
-		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
-	}
-	for _, mapping := range deletes {
-		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
+	m.sendMappings(ctx, accountID, creates, proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED)
+	m.sendMappings(ctx, accountID, updates, proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED)
+	m.sendMappings(ctx, accountID, deletes, proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED)
+}
+
+// sendMappings sends each entry as updateType. It sends a copy: the entries'
+// mappings are shared with reconcileCache, which another reconcile or
+// RemoveAccountGateway may be reading, so they are never written.
+func (m *managerImpl) sendMappings(ctx context.Context, accountID string, entries []syntheticMapping, updateType proto.ProxyMappingUpdateType) {
+	for _, entry := range entries {
+		update := goproto.Clone(entry.mapping).(*proto.ProxyMapping)
+		update.Type = updateType
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, update, entry.cluster)
 	}
 }
 
-// diffMappings classifies the previous→current transition for a
-// single account into Create / Update / Delete sets.
+// RemoveAccountGateway tells the proxies to drop every mapping of the account's
+// gateway, so a deleted account's proxy config, provider API keys included, does
+// not linger in proxy memory until the next resync. It is an account deletion
+// hook: it runs before the account's data is removed, the last point at which
+// the mappings can be synthesised from the store. The cache alone would miss
+// them, since it is per instance and empty after a restart. If the deletion
+// then fails, the gateway stays down until the account's next change reconciles
+// it back.
+func (m *managerImpl) RemoveAccountGateway(ctx context.Context, accountID string) error {
+	if m.proxyController == nil {
+		return nil
+	}
+
+	services, err := SynthesizeServices(ctx, m.store, accountID)
+	if err != nil {
+		return fmt.Errorf("synthesise agent network services: %w", err)
+	}
+	oidcCfg := m.proxyController.GetOIDCValidationConfig()
+	removed := make(map[string]syntheticMapping, len(services))
+	for _, svc := range services {
+		if svc == nil || svc.ID == "" {
+			continue
+		}
+		removed[svc.ID] = syntheticMapping{
+			mapping: svc.ToProtoMapping(rpservice.Delete, "", oidcCfg),
+			cluster: svc.ProxyCluster,
+		}
+	}
+
+	m.reconcileMu.Lock()
+	for id, entry := range m.reconcileCache[accountID] {
+		if _, ok := removed[id]; !ok {
+			removed[id] = entry
+		}
+	}
+	delete(m.reconcileCache, accountID)
+	m.reconcileMu.Unlock()
+
+	entries := make([]syntheticMapping, 0, len(removed))
+	for _, entry := range removed {
+		entries = append(entries, entry)
+	}
+	m.sendMappings(ctx, accountID, entries, proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED)
+	return nil
+}
+
+// diffMappings classifies the previous→current transition for a single
+// account into Create / Update / Delete sets.
 //
-// Cluster moves (current.cluster != previous.cluster) are surfaced as
-// a Delete on the old cluster + Create on the new — handled by
-// emitting both a delete (on previous mapping) and a create (on the
-// current mapping) for that service ID.
-func diffMappings(previous, current map[string]*proto.ProxyMapping) (creates, updates, deletes []*proto.ProxyMapping) {
+// A change of serving proxy for the same service ID is surfaced as a Delete
+// addressed to the old proxy plus a Create addressed to the new one, so the
+// mapping actually moves. Comparing the recorded cluster is what makes that
+// detectable: with a placement-free endpoint the mapping's domain is identical
+// before and after the move, so nothing about the mapping itself reveals it.
+func diffMappings(previous, current map[string]syntheticMapping) (creates, updates, deletes []syntheticMapping) {
 	for id, cur := range current {
 		prev, existed := previous[id]
 		switch {
 		case !existed:
 			creates = append(creates, cur)
-		case prev.GetDomain() == "" || cur.GetAccountId() == prev.GetAccountId() && currentClusterChanged(prev, cur):
+		case prev.mapping.GetDomain() == "" ||
+			cur.mapping.GetAccountId() == prev.mapping.GetAccountId() && prev.cluster != cur.cluster:
 			deletes = append(deletes, prev)
 			creates = append(creates, cur)
 		default:
@@ -108,24 +174,3 @@ func diffMappings(previous, current map[string]*proto.ProxyMapping) (creates, up
 	}
 	return creates, updates, deletes
 }
-
-func currentClusterChanged(prev, cur *proto.ProxyMapping) bool {
-	return clusterFromMapping(prev) != clusterFromMapping(cur)
-}
-
-// clusterFromMapping returns the cluster the mapping should be sent
-// to. ProxyMapping doesn't carry the cluster directly, so we rely on
-// the synthesised service's domain (`<slug>.<cluster>`) and split on
-// the first '.'.
-func clusterFromMapping(m *proto.ProxyMapping) string {
-	if m == nil {
-		return ""
-	}
-	domain := m.GetDomain()
-	for i := 0; i < len(domain); i++ {
-		if domain[i] == '.' {
-			return domain[i+1:]
-		}
-	}
-	return ""
-}
diff --git a/management/internals/modules/agentnetwork/reconcile_test.go b/management/internals/modules/agentnetwork/reconcile_test.go
index 0855f0dc1..2cfea9828 100644
--- a/management/internals/modules/agentnetwork/reconcile_test.go
+++ b/management/internals/modules/agentnetwork/reconcile_test.go
@@ -2,9 +2,11 @@ package agentnetwork
 
 import (
 	"context"
+	"sync"
+	"sync/atomic"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -12,6 +14,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 func newReconcileMgr(t *testing.T, ctrl *gomock.Controller) (*managerImpl, *store.MockStore, *proxy.MockController) {
@@ -21,7 +24,7 @@ func newReconcileMgr(t *testing.T, ctrl *gomock.Controller) (*managerImpl, *stor
 	return &managerImpl{
 		store:           mockStore,
 		proxyController: mockProxy,
-		reconcileCache:  make(map[string]map[string]*proto.ProxyMapping),
+		reconcileCache:  make(map[string]map[string]syntheticMapping),
 	}, mockStore, mockProxy
 }
 
@@ -52,9 +55,9 @@ func newReconcileTestPolicy(providerID, sourceGroupID string) *types.Policy {
 
 func newReconcileTestSettings() *types.Settings {
 	return &types.Settings{
-		AccountID: "acct-1",
-		Cluster:   "eu.proxy.netbird.io",
-		Subdomain: "violet",
+		AccountID:    "acct-1",
+		Domain:       "violet.eu.proxy.netbird.io",
+		ProxyAddress: "eu.proxy.netbird.io",
 	}
 }
 
@@ -196,7 +199,7 @@ func TestReconcile_PolicyRemoved_EmitsDelete(t *testing.T) {
 func TestReconcile_NilProxyController_NoOp(t *testing.T) {
 	ctx := context.Background()
 	mgr := &managerImpl{
-		reconcileCache: make(map[string]map[string]*proto.ProxyMapping),
+		reconcileCache: make(map[string]map[string]syntheticMapping),
 	}
 	// Must not panic; must not query the store.
 	mgr.reconcile(ctx, "acct-1")
@@ -212,21 +215,229 @@ func TestReconcile_EmptyAccountID_NoOp(t *testing.T) {
 	mgr.reconcile(ctx, "")
 }
 
-func TestClusterFromMapping(t *testing.T) {
-	tests := []struct {
-		name   string
-		domain string
-		want   string
-	}{
-		{"simple", "openai.eu.proxy.netbird.io", "eu.proxy.netbird.io"},
-		{"deeply nested", "a.b.c.d", "b.c.d"},
-		{"no dot", "openai", ""},
-		{"empty", "", ""},
+// TestDiffMappings_ServingProxyChange — when the proxy serving an account
+// changes, the same service ID must be deleted on the old proxy and created on
+// the new one. The cluster cannot be recovered from the mapping's domain: with a
+// placement-free endpoint the domain does not change at all when the serving
+// proxy does, so a domain-derived cluster sees no change and emits a plain
+// update, addressed to a proxy that does not exist.
+func TestDiffMappings_ServingProxyChange(t *testing.T) {
+	previous := map[string]syntheticMapping{
+		"svc-1": {
+			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "brave-otter.gateway.example.com"},
+			cluster: "proxy.example.com",
+		},
 	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := clusterFromMapping(&proto.ProxyMapping{Domain: tt.domain})
-			assert.Equal(t, tt.want, got)
-		})
+	current := map[string]syntheticMapping{
+		"svc-1": {
+			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "brave-otter.gateway.example.com"},
+			cluster: "brave-otter.gateway.example.com",
+		},
+	}
+
+	creates, updates, deletes := diffMappings(previous, current)
+
+	if assert.Len(t, deletes, 1, "the old proxy must be told to drop the mapping") {
+		assert.Equal(t, "proxy.example.com", deletes[0].cluster)
+	}
+	if assert.Len(t, creates, 1, "the new proxy must be told to add it") {
+		assert.Equal(t, "brave-otter.gateway.example.com", creates[0].cluster)
+	}
+	assert.Empty(t, updates, "a serving-proxy move is a delete plus a create, not an update")
+}
+
+// TestDiffMappings_UnchangedClusterIsAnUpdate keeps the ordinary path: same
+// service, same proxy, changed contents.
+func TestDiffMappings_UnchangedClusterIsAnUpdate(t *testing.T) {
+	previous := map[string]syntheticMapping{
+		"svc-1": {
+			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "otter.proxy.example.com"},
+			cluster: "proxy.example.com",
+		},
+	}
+	current := map[string]syntheticMapping{
+		"svc-1": {
+			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "otter.proxy.example.com"},
+			cluster: "proxy.example.com",
+		},
+	}
+
+	creates, updates, deletes := diffMappings(previous, current)
+
+	assert.Empty(t, creates)
+	assert.Empty(t, deletes)
+	if assert.Len(t, updates, 1) {
+		assert.Equal(t, "proxy.example.com", updates[0].cluster)
 	}
 }
+
+// TestDiffMappings_RemovedServiceIsDeletedOnItsOwnCluster — a service that has
+// gone away is deleted on the cluster it was last served by, which is recorded
+// rather than re-derived.
+func TestDiffMappings_RemovedServiceIsDeletedOnItsOwnCluster(t *testing.T) {
+	previous := map[string]syntheticMapping{
+		"svc-1": {
+			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "brave-otter.gateway.example.com"},
+			cluster: "brave-otter.gateway.example.com",
+		},
+	}
+
+	creates, updates, deletes := diffMappings(previous, map[string]syntheticMapping{})
+
+	assert.Empty(t, creates)
+	assert.Empty(t, updates)
+	if assert.Len(t, deletes, 1) {
+		assert.Equal(t, "brave-otter.gateway.example.com", deletes[0].cluster)
+	}
+}
+
+// TestRemoveAccountGateway_EmitsRemovedFromStore — account deletion runs on an
+// instance that may never have reconciled the account, so its cache is empty.
+// The mappings are synthesised from the store, still intact before the delete,
+// and each is sent as REMOVED to the cluster that serves it.
+func TestRemoveAccountGateway_EmitsRemovedFromStore(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, mockProxy := newReconcileMgr(t, ctrl)
+	provider := newReconcileTestProvider()
+	policy := newReconcileTestPolicy(provider.ID, "grp-eng")
+
+	expectReconcileSynthInputs(mockStore, ctx, []*types.Provider{provider}, []*types.Policy{policy}, []*types.Guardrail{})
+	mockProxy.EXPECT().GetOIDCValidationConfig().Return(proxy.OIDCValidationConfig{})
+
+	var sent []*proto.ProxyMapping
+	mockProxy.EXPECT().
+		SendServiceUpdateToCluster(ctx, "acct-1", gomock.Any(), "eu.proxy.netbird.io").
+		Do(func(_ context.Context, _ string, m *proto.ProxyMapping, _ string) {
+			sent = append(sent, m)
+		})
+
+	require.NoError(t, mgr.RemoveAccountGateway(ctx, "acct-1"))
+
+	require.Len(t, sent, 1, "the account's one gateway mapping must be removed")
+	assert.Equal(t, proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED, sent[0].Type, "the update must be a removal")
+	assert.Equal(t, "agent-net-svc-acct-1", sent[0].Id, "the removal must name the account's gateway service")
+}
+
+// TestRemoveAccountGateway_AlsoRemovesCachedMappings — a mapping this instance
+// last sent but the store no longer synthesises (here, one on another cluster)
+// is removed too, and the account's cache entry is cleared.
+func TestRemoveAccountGateway_AlsoRemovesCachedMappings(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, mockProxy := newReconcileMgr(t, ctrl)
+	mgr.reconcileCache["acct-1"] = map[string]syntheticMapping{
+		"stale-svc": {mapping: &proto.ProxyMapping{Id: "stale-svc"}, cluster: "us.proxy.netbird.io"},
+	}
+
+	// Settings but no providers: the store synthesises nothing.
+	mockStore.EXPECT().
+		GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "acct-1").
+		Return(newReconcileTestSettings(), nil)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "acct-1").
+		Return([]*types.Provider{}, nil)
+	mockProxy.EXPECT().GetOIDCValidationConfig().Return(proxy.OIDCValidationConfig{})
+
+	var sent []*proto.ProxyMapping
+	mockProxy.EXPECT().
+		SendServiceUpdateToCluster(ctx, "acct-1", gomock.Any(), "us.proxy.netbird.io").
+		Do(func(_ context.Context, _ string, m *proto.ProxyMapping, _ string) {
+			sent = append(sent, m)
+		})
+
+	require.NoError(t, mgr.RemoveAccountGateway(ctx, "acct-1"))
+
+	require.Len(t, sent, 1, "the cached mapping must be removed from its own cluster")
+	assert.Equal(t, "stale-svc", sent[0].Id)
+	assert.Equal(t, proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED, sent[0].Type)
+	mgr.reconcileMu.Lock()
+	_, present := mgr.reconcileCache["acct-1"]
+	mgr.reconcileMu.Unlock()
+	assert.False(t, present, "the deleted account's cache entry must be cleared")
+}
+
+// TestRemoveAccountGateway_SynthFailureAbortsDeletion — if the mappings cannot
+// be read, nothing is sent and the error is returned, which as an account
+// deletion hook keeps the account rather than leaving its gateway running.
+func TestRemoveAccountGateway_SynthFailureAbortsDeletion(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, _ := newReconcileMgr(t, ctrl)
+	mockStore.EXPECT().
+		GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "acct-1").
+		Return(nil, status.Errorf(status.Internal, "store unavailable"))
+
+	assert.Error(t, mgr.RemoveAccountGateway(ctx, "acct-1"), "a failed synthesis must fail the hook")
+}
+
+func TestRemoveAccountGateway_NilProxyController_NoOp(t *testing.T) {
+	mgr := &managerImpl{reconcileCache: make(map[string]map[string]syntheticMapping)}
+	// Must not panic and must not query the store.
+	assert.NoError(t, mgr.RemoveAccountGateway(context.Background(), "acct-1"))
+}
+
+// TestReconcile_ConcurrentWithGatewayChanges — while an account's gateway
+// flaps (its policy is removed and re-added between reads), concurrent
+// reconciles and RemoveAccountGateway share the cached mappings: one caches a
+// mapping and sends it, another finds it gone and sends its removal. Run under
+// -race: neither path may write a cached mapping, only copies of it.
+func TestReconcile_ConcurrentWithGatewayChanges(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, mockProxy := newReconcileMgr(t, ctrl)
+	// gomock serialises every call on the controller's mutex, which would give
+	// the race detector the ordering the code under test lacks. The sends go
+	// through a fake that takes no lock.
+	mgr.proxyController = unsyncedSender{MockController: mockProxy}
+	provider := newReconcileTestProvider()
+	policy := newReconcileTestPolicy(provider.ID, "grp-eng")
+
+	var reads atomic.Int64
+	mockStore.EXPECT().GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "acct-1").Return(newReconcileTestSettings(), nil).AnyTimes()
+	mockStore.EXPECT().GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "acct-1").Return([]*types.Provider{provider}, nil).AnyTimes()
+	mockStore.EXPECT().GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, "acct-1").
+		DoAndReturn(func(context.Context, store.LockingStrength, string) ([]*types.Policy, error) {
+			if reads.Add(1)%2 == 0 {
+				return []*types.Policy{}, nil
+			}
+			return []*types.Policy{policy}, nil
+		}).AnyTimes()
+	mockStore.EXPECT().GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, "acct-1").Return([]*types.Guardrail{}, nil).AnyTimes()
+
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func(remove bool) {
+			defer wg.Done()
+			for j := 0; j < 50; j++ {
+				if remove && j%10 == 0 {
+					_ = mgr.RemoveAccountGateway(ctx, "acct-1")
+					continue
+				}
+				mgr.reconcile(ctx, "acct-1")
+			}
+		}(i == 0)
+	}
+	wg.Wait()
+}
+
+// unsyncedSender answers the calls reconcile makes on every pass without any
+// locking, so concurrent callers are not ordered by the fake itself.
+type unsyncedSender struct {
+	*proxy.MockController
+}
+
+func (unsyncedSender) GetOIDCValidationConfig() proxy.OIDCValidationConfig {
+	return proxy.OIDCValidationConfig{}
+}
+
+func (unsyncedSender) SendServiceUpdateToCluster(context.Context, string, *proto.ProxyMapping, string) {}
diff --git a/management/internals/modules/agentnetwork/settings_bootstrap_test.go b/management/internals/modules/agentnetwork/settings_bootstrap_test.go
new file mode 100644
index 000000000..08a5c51a1
--- /dev/null
+++ b/management/internals/modules/agentnetwork/settings_bootstrap_test.go
@@ -0,0 +1,563 @@
+package agentnetwork
+
+import (
+	"context"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// bootstrapFixture wires a real sqlite store to a gomock permissions manager
+// so tests can grant or deny the settings permission per case.
+type bootstrapFixture struct {
+	manager Manager
+	store   store.Store
+	perms   *permissions.MockManager
+	// vendor stands in for the provider credential check's vendor call, which
+	// runs on every provider write. Without it these tests would reach a real
+	// vendor to save a record.
+	vendor *stubLister
+}
+
+func newBootstrapFixture(t *testing.T) *bootstrapFixture {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		t.Skip("sqlite store not properly supported on Windows yet")
+	}
+	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
+
+	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err, "test store setup must succeed")
+	t.Cleanup(cleanUp)
+
+	ctrl := gomock.NewController(t)
+	perms := permissions.NewMockManager(ctrl)
+
+	accounts := account.NewMockManager(ctrl)
+	accounts.EXPECT().StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	accounts.EXPECT().UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	accounts.EXPECT().BufferUpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+
+	vendor := &stubLister{}
+	return &bootstrapFixture{
+		manager: NewManager(st, perms, accounts, nil, WithModelLister(vendor)),
+		store:   st,
+		perms:   perms,
+		vendor:  vendor,
+	}
+}
+
+func (f *bootstrapFixture) expectPermission(accountID, userID string, module modules.Module, op operations.Operation, allowed bool) {
+	f.perms.EXPECT().
+		ValidateUserPermissions(gomock.Any(), accountID, userID, module, op).
+		Return(allowed, context.Background(), nil)
+}
+
+func (f *bootstrapFixture) createSettings(ctx context.Context, accountID, userID, proxyAddress, endpoint string) (*types.Settings, error) {
+	return f.manager.CreateSettings(ctx, userID, types.DefaultSettings(accountID), proxyAddress, endpoint)
+}
+
+func ptrTo[T any](v T) *T { return &v }
+
+// seedProxy registers a proxy in clusterAddr, heartbeating now, so the labeled
+// bootstrap path has a real cluster to validate against. accountID empty makes
+// it a shared (NetBird-operated) cluster; private mirrors the capability an
+// proxy with private capabilities reports, nil an unreported one.
+func (f *bootstrapFixture) seedProxy(t *testing.T, proxyID, accountID, clusterAddr string, private *bool) {
+	t.Helper()
+	f.seedProxyAt(t, proxyID, accountID, clusterAddr, private, time.Now().UTC())
+}
+
+// seedProxyAt is seedProxy with an explicit last-seen, for cases that need a
+// proxy whose heartbeat has aged past the active window while its row (and so
+// its cluster) is still on record.
+func (f *bootstrapFixture) seedProxyAt(t *testing.T, proxyID, accountID, clusterAddr string, private *bool, lastSeen time.Time) {
+	t.Helper()
+	p := &proxy.Proxy{
+		ID:             proxyID,
+		ClusterAddress: clusterAddr,
+		Status:         proxy.StatusConnected,
+		LastSeen:       lastSeen,
+		Capabilities:   proxy.Capabilities{Private: private},
+	}
+	if accountID != "" {
+		p.AccountID = &accountID
+	}
+	require.NoError(t, f.store.SaveProxy(context.Background(), p), "seeding a proxy must succeed")
+}
+
+// seedPrivateCluster is the common case: a shared cluster with a connected
+// proxy that has private capabilities, which is what a bootstrap requires.
+func (f *bootstrapFixture) seedPrivateCluster(t *testing.T, clusterAddr string) {
+	t.Helper()
+	f.seedProxy(t, "proxy-"+clusterAddr, "", clusterAddr, ptrTo(true))
+}
+
+// requireForeignClusterRefusal asserts the refusal a pin onto another
+// account's host gets, and that it left no row behind.
+func (f *bootstrapFixture) requireForeignClusterRefusal(t *testing.T, err error, accountID string) {
+	t.Helper()
+	require.Error(t, err, "another account's host must be refused")
+	var sErr *status.Error
+	require.ErrorAs(t, err, &sErr)
+	assert.Equal(t, status.InvalidArgument, sErr.Type(), "rejection must be a validation error")
+	assert.Contains(t, err.Error(), "not available to this account",
+		"the error must say the host is not the account's to use")
+
+	_, err = f.store.GetAgentNetworkSettings(context.Background(), store.LockingStrengthNone, accountID)
+	assert.Error(t, err, "no row may be left behind by a rejected bootstrap")
+}
+
+// TestCreateSettingsRequiresPermission pins the gate: bootstrap assigns the
+// account's immutable endpoint, a settings write requiring the settings
+// Create permission — and a denial leaves no row behind.
+func TestCreateSettingsRequiresPermission(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, false)
+
+	_, err := f.createSettings(ctx, "account1", "user1", "cluster1.example.com", "")
+	require.Error(t, err, "bootstrap without the settings permission must fail")
+	var sErr *status.Error
+	require.ErrorAs(t, err, &sErr)
+	assert.Equal(t, status.PermissionDenied, sErr.Type(), "denial should surface as permission denied")
+
+	_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+	assert.Error(t, err, "settings row must not be created when bootstrap is denied")
+}
+
+// TestCreateSettingsLabeled pins the labeled shape: the server allocates an
+// adjective-noun label beneath the proxy address, the pin is not dedicated,
+// and the domain records the full endpoint hostname.
+func TestCreateSettingsLabeled(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.seedPrivateCluster(t, "cluster1.example.com")
+	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+	created, err := f.createSettings(ctx, "account1", "user1", "Cluster1.Example.com", "")
+	require.NoError(t, err, "labeled bootstrap must succeed")
+	assert.Equal(t, "cluster1.example.com", created.ProxyAddress, "proxy address must be pinned lowercased")
+	require.True(t, strings.HasSuffix(created.Domain, ".cluster1.example.com"),
+		"domain must hang one label beneath the proxy address: %s", created.Domain)
+	label := strings.TrimSuffix(created.Domain, ".cluster1.example.com")
+	assert.NotContains(t, label, ".", "the allocated label must be a single DNS label: %s", label)
+	assert.False(t, created.Dedicated(), "a labeled pin is not dedicated")
+	assert.Equal(t, created.Domain, created.Endpoint(), "the endpoint is the domain column")
+
+	stored, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+	require.NoError(t, err, "bootstrap must persist the row")
+	assert.Equal(t, created.Domain, stored.Domain)
+	assert.Equal(t, created.ProxyAddress, stored.ProxyAddress)
+}
+
+// TestCreateSettingsSelfAddressed pins the dedicated shape: the endpoint is
+// claimed verbatim (normalized), Domain == ProxyAddress, and the claim
+// succeeds with no proxy declaring the address yet (address-first).
+func TestCreateSettingsSelfAddressed(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+	created, err := f.createSettings(ctx, "account1", "user1", "", "Brave-Otter.GW.Example.com")
+	require.NoError(t, err, "self-addressed bootstrap must succeed")
+	assert.Equal(t, "brave-otter.gw.example.com", created.Domain, "endpoint must be claimed lowercased")
+	assert.Equal(t, created.Domain, created.ProxyAddress, "self-addressed: proxy address is the endpoint")
+	assert.True(t, created.Dedicated(), "a self-addressed pin is dedicated")
+}
+
+// TestCreateSettingsIdentityFieldValidation pins the request contract: exactly
+// one of proxyAddress and endpoint, and both must be well-formed hostnames.
+func TestCreateSettingsIdentityFieldValidation(t *testing.T) {
+	ctx := context.Background()
+
+	cases := map[string]struct {
+		proxyAddress string
+		endpoint     string
+	}{
+		"neither":               {"", ""},
+		"both":                  {"cluster1.example.com", "gw.example.com"},
+		"trailing dot endpoint": {"", "gw.example.com."},
+		"leading dot endpoint":  {"", ".gw.example.com"},
+		"whitespace inside":     {"", "g w.example.com"},
+		"empty label in parent": {"eu..example.com", ""},
+		"hyphen-edged label":    {"", "-gw.example.com"},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			f := newBootstrapFixture(t)
+			f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+			_, err := f.createSettings(ctx, "account1", "user1", tc.proxyAddress, tc.endpoint)
+			require.Error(t, err, "invalid identity input must be rejected")
+			var sErr *status.Error
+			require.ErrorAs(t, err, &sErr)
+			assert.Equal(t, status.InvalidArgument, sErr.Type(), "rejection must be a validation error")
+
+			_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+			assert.Error(t, err, "no row may be left behind by a rejected bootstrap")
+		})
+	}
+}
+
+// TestCreateSettingsConflictsOnSecondBootstrap pins that bootstrap is a
+// one-time create per account: a second call is a conflict, whatever shape it
+// asks for, and the original row survives untouched.
+func TestCreateSettingsConflictsOnSecondBootstrap(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.seedPrivateCluster(t, "cluster1.example.com")
+	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+	first, err := f.createSettings(ctx, "account1", "user1", "cluster1.example.com", "")
+	require.NoError(t, err)
+
+	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+	_, err = f.createSettings(ctx, "account1", "user1", "", "other.example.com")
+	require.Error(t, err, "second bootstrap must fail")
+	var sErr *status.Error
+	require.ErrorAs(t, err, &sErr)
+	assert.Equal(t, status.AlreadyExists, sErr.Type(), "second bootstrap must surface as a conflict")
+
+	stored, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+	require.NoError(t, err)
+	assert.Equal(t, first.Domain, stored.Domain, "the original endpoint must survive the rejected bootstrap")
+}
+
+// TestCreateSettingsEndpointTaken pins global hostname uniqueness: a hostname
+// held by one account cannot be claimed by another, in either direction —
+// self-addressed onto self-addressed, or self-addressed onto an allocated
+// labeled endpoint.
+func TestCreateSettingsEndpointTaken(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+
+	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+	first, err := f.createSettings(ctx, "account1", "user1", "", "gw.example.com")
+	require.NoError(t, err)
+
+	f.expectPermission("account2", "user2", modules.AgentNetworkSettings, operations.Create, true)
+	_, err = f.createSettings(ctx, "account2", "user2", "", "gw.example.com")
+	require.Error(t, err, "a taken hostname must be refused")
+	var sErr *status.Error
+	require.ErrorAs(t, err, &sErr)
+	assert.Equal(t, status.AlreadyExists, sErr.Type(), "the refusal must surface as a conflict")
+
+	f.expectPermission("account3", "user3", modules.AgentNetworkSettings, operations.Create, true)
+	_, err = f.createSettings(ctx, "account3", "user3", "", first.Domain)
+	require.Error(t, err, "claiming another account's endpoint must be refused")
+}
+
+// TestCreateProviderHasNoSettingsSideEffects pins the decoupling: provider
+// create needs only the providers permission (gomock fails the test on any
+// settings-permission call) and never creates a settings row.
+func TestCreateProviderHasNoSettingsSideEffects(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+	provider := types.NewProvider("account1")
+	provider.ProviderID = "openai_api"
+	provider.Name = "openai"
+	provider.UpstreamURL = "https://api.openai.com"
+	provider.APIKey = "sk-test"
+	provider.Enabled = true
+
+	created, err := f.manager.CreateProvider(ctx, "user1", provider)
+	require.NoError(t, err, "provider create must succeed on the providers permission alone")
+	require.NotNil(t, created)
+
+	_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+	assert.Error(t, err, "provider create must not conjure a settings row")
+}
+
+// TestCreateSettingsRejectsOfflineCluster is the guard against deciding on
+// heartbeat freshness. A centralised cluster is refused while its proxies are
+// live; the same cluster must stay refused once they stop heartbeating, which
+// takes only a couple of minutes (proxyActiveThreshold). Judging on liveness
+// would turn "wait for the proxy to go quiet" into a way to pin the account's
+// immutable endpoint to a cluster that can never serve it.
+func TestCreateSettingsRejectsOfflineCluster(t *testing.T) {
+	ctx := context.Background()
+	notPrivate := false
+
+	cases := map[string]*bool{
+		"centralised proxy gone quiet": &notPrivate,
+		// A cluster that could serve the gateway still has to have something
+		// live in it to prove so at bootstrap: refusing is the safe direction
+		// (reconnect the proxy and retry) where accepting is permanent.
+		"private proxy gone quiet": ptrTo(true),
+	}
+	for name, private := range cases {
+		t.Run(name, func(t *testing.T) {
+			f := newBootstrapFixture(t)
+			f.seedProxyAt(t, "proxy1", "", "offline.example.com", private,
+				time.Now().UTC().Add(-time.Hour))
+			f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+			_, err := f.createSettings(ctx, "account1", "user1", "offline.example.com", "")
+			require.Error(t, err, "a known cluster with nothing live in it must be rejected")
+			var sErr *status.Error
+			require.ErrorAs(t, err, &sErr)
+			assert.Equal(t, status.InvalidArgument, sErr.Type(), "rejection must be a validation error")
+			assert.Contains(t, err.Error(), "private capabilities",
+				"the error must say private capabilities are what is missing")
+
+			_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+			assert.Error(t, err, "no row may be left behind by a rejected bootstrap")
+		})
+	}
+}
+
+// TestCreateSettingsRequiresPrivateCluster pins the capability gate: the
+// synthesised gateway service is always private, so a live cluster whose
+// proxies lack private capabilities cannot serve it and must not
+// become the account's immutable endpoint.
+func TestCreateSettingsRequiresPrivateCluster(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	notPrivate := false
+	f.seedProxy(t, "proxy1", "", "central.example.com", &notPrivate)
+	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+	_, err := f.createSettings(ctx, "account1", "user1", "central.example.com", "")
+	require.Error(t, err, "a cluster without private capabilities must be rejected")
+	var sErr *status.Error
+	require.ErrorAs(t, err, &sErr)
+	assert.Equal(t, status.InvalidArgument, sErr.Type(), "rejection must be a validation error")
+	assert.Contains(t, err.Error(), "private capabilities", "the error must name what the cluster is missing")
+
+	_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+	assert.Error(t, err, "no row may be left behind by a rejected bootstrap")
+}
+
+// TestCreateSettingsAcceptsOwnPrivateCluster pins the BYOP happy path: the
+// account's own cluster with a connected private-capable proxy is a valid pin.
+func TestCreateSettingsAcceptsOwnPrivateCluster(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.seedProxy(t, "proxy1", "account1", "byop.account1.example.com", ptrTo(true))
+	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+	created, err := f.createSettings(ctx, "account1", "user1", "byop.account1.example.com", "")
+	require.NoError(t, err, "the account's own private cluster must be accepted")
+	assert.Equal(t, "byop.account1.example.com", created.ProxyAddress)
+}
+
+// TestCreateSettingsMatchesClusterCasing pins that a cluster spelled with
+// capitals in the store is still recognised as the same cluster the normalised
+// proxy_address names, in both directions: a private cluster is accepted and a
+// centralised one is refused, whatever the casing. The comparison is in memory
+// over the account's cluster list; the capability lookup is still asked under
+// the spelling the store actually holds, which is what an exact match needs.
+func TestCreateSettingsMatchesClusterCasing(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("own private cluster is found", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.seedProxy(t, "proxy1", "", "EU.Proxy.Example.com", ptrTo(true))
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+		created, err := f.createSettings(ctx, "account1", "user1", "eu.proxy.example.com", "")
+		require.NoError(t, err, "a private cluster declared with capitals must still be accepted")
+		assert.Equal(t, "eu.proxy.example.com", created.ProxyAddress)
+	})
+
+	t.Run("non-private cluster is still refused", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.seedProxy(t, "proxy1", "", "Central.Example.com", ptrTo(false))
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+		_, err := f.createSettings(ctx, "account1", "user1", "central.example.com", "")
+		require.Error(t, err, "casing must not become a way past the capability check")
+		assert.Contains(t, err.Error(), "private capabilities")
+	})
+}
+
+// TestCreateSettingsRejectsForeignCluster pins tenant consistency on the pin:
+// an account may not pin its gateway onto a host another account's proxy
+// declares. That proxy only ever receives its own account's mappings, so the
+// pin could never be served, and the endpoint it assigns is immutable.
+// Ownership is decided on the proxy rows, not on heartbeat freshness — a
+// cluster whose proxies are merely offline is still somebody's — and on the
+// normalised host, since proxies declare their address as the operator
+// spelled it.
+func TestCreateSettingsRejectsForeignCluster(t *testing.T) {
+	ctx := context.Background()
+
+	cases := map[string]struct {
+		spelling string
+		lastSeen time.Time
+	}{
+		"live":            {"byop.account2.example.com", time.Now().UTC()},
+		"offline":         {"byop.account2.example.com", time.Now().UTC().Add(-time.Hour)},
+		"spelled in caps": {"BYOP.Account2.Example.com", time.Now().UTC()},
+	}
+	for name, tc := range cases {
+		t.Run("labeled "+name, func(t *testing.T) {
+			f := newBootstrapFixture(t)
+			f.seedProxyAt(t, "proxy1", "account2", tc.spelling, ptrTo(true), tc.lastSeen)
+			f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+			_, err := f.createSettings(ctx, "account1", "user1", "byop.account2.example.com", "")
+			f.requireForeignClusterRefusal(t, err, "account1")
+		})
+		t.Run("self-addressed "+name, func(t *testing.T) {
+			f := newBootstrapFixture(t)
+			f.seedProxyAt(t, "proxy1", "account2", tc.spelling, ptrTo(true), tc.lastSeen)
+			f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+			_, err := f.createSettings(ctx, "account1", "user1", "", "byop.account2.example.com")
+			f.requireForeignClusterRefusal(t, err, "account1")
+		})
+	}
+}
+
+// TestCreateSettingsSharedClusterStaysPinnable pins the constraint the
+// ownership check must respect: a shared (NetBird-operated) cluster is not
+// anybody's, so any number of accounts pin their gateways to it — including
+// an account that also runs a proxy of its own elsewhere.
+func TestCreateSettingsSharedClusterStaysPinnable(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.seedProxy(t, "shared", "", "eu.proxy.netbird.io", ptrTo(true))
+	f.seedProxy(t, "own", "account1", "byop.account1.example.com", ptrTo(true))
+
+	for _, account := range []string{"account1", "account2"} {
+		f.expectPermission(account, "user", modules.AgentNetworkSettings, operations.Create, true)
+		created, err := f.createSettings(ctx, account, "user", "eu.proxy.netbird.io", "")
+		require.NoError(t, err, "a shared cluster must stay pinnable by %s", account)
+		assert.Equal(t, "eu.proxy.netbird.io", created.ProxyAddress)
+	}
+}
+
+// TestCreateSettingsOwnClusterIsPinnable is the BYOP order in both directions:
+// the account's own proxy is not a competing claim, whether the pin is labeled
+// beneath its cluster or self-addressed onto the very host it declares.
+func TestCreateSettingsOwnClusterIsPinnable(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("labeled", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.seedProxy(t, "own", "account1", "byop.account1.example.com", ptrTo(true))
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+		created, err := f.createSettings(ctx, "account1", "user1", "byop.account1.example.com", "")
+		require.NoError(t, err, "the account's own cluster must be pinnable")
+		assert.True(t, strings.HasSuffix(created.Domain, ".byop.account1.example.com"))
+	})
+	t.Run("self-addressed", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.seedProxy(t, "own", "account1", "gw.account1.example.com", ptrTo(true))
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+		created, err := f.createSettings(ctx, "account1", "user1", "", "gw.account1.example.com")
+		require.NoError(t, err, "the host the account's own proxy declares must be pinnable")
+		assert.Equal(t, "gw.account1.example.com", created.ProxyAddress)
+	})
+}
+
+// TestCreateSettingsUnknownHostIsPinnable pins the address-first order: a host
+// no proxy has ever declared is nobody's, so the pin goes through and the
+// proxy is deployed after.
+func TestCreateSettingsUnknownHostIsPinnable(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+	created, err := f.createSettings(ctx, "account1", "user1", "future.example.com", "")
+	require.NoError(t, err, "a host no proxy has declared must stay pinnable")
+	assert.Equal(t, "future.example.com", created.ProxyAddress)
+}
+
+// TestCreateSettingsRejectsHostAnotherAccountPinned covers claims made by pins
+// rather than proxies, which the proxy-row check cannot see. A labeled pin
+// beneath a host makes that host the other account's cluster, so a
+// self-addressed endpoint on it would never be served; a self-addressed
+// endpoint on a host makes the proxy declaring it theirs, so a label beneath
+// it would never be served either. Neither is a shared-cluster shape: many
+// labeled pins under one cluster are asked about in neither direction.
+func TestCreateSettingsRejectsHostAnotherAccountPinned(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("self-addressed onto another account's cluster", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account2", "user2", modules.AgentNetworkSettings, operations.Create, true)
+		_, err := f.createSettings(ctx, "account2", "user2", "gw.example.com", "")
+		require.NoError(t, err, "account2's labeled pin beneath the host must go through first")
+
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+		_, err = f.createSettings(ctx, "account1", "user1", "", "gw.example.com")
+		f.requireForeignClusterRefusal(t, err, "account1")
+	})
+
+	t.Run("labeled beneath another account's endpoint", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account2", "user2", modules.AgentNetworkSettings, operations.Create, true)
+		_, err := f.createSettings(ctx, "account2", "user2", "", "gw.example.com")
+		require.NoError(t, err, "account2's self-addressed endpoint must go through first")
+
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+		_, err = f.createSettings(ctx, "account1", "user1", "gw.example.com", "")
+		f.requireForeignClusterRefusal(t, err, "account1")
+	})
+
+	t.Run("labeled beside another account's labeled pin stays allowed", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		for _, account := range []string{"account1", "account2"} {
+			f.expectPermission(account, "user", modules.AgentNetworkSettings, operations.Create, true)
+			_, err := f.createSettings(ctx, account, "user", "eu.proxy.netbird.io", "")
+			require.NoError(t, err, "labeled pins under one cluster are the shared-cluster shape and must not refuse each other")
+		}
+	})
+}
+
+// TestCreateSettingsSelfAddressedRequiresPrivateCluster pins that the
+// capability gate applies to a self-addressed endpoint too: the service behind
+// it is the same private one, so a proxy that already declares the hostname
+// must have private capabilities, whether the account's own or a shared cluster's. A
+// hostname no proxy declares yet stays claimable (TestCreateSettingsSelfAddressed).
+func TestCreateSettingsSelfAddressedRequiresPrivateCluster(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("centralised proxy at the hostname is refused", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.seedProxy(t, "central", "", "gw.example.com", ptrTo(false))
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+		_, err := f.createSettings(ctx, "account1", "user1", "", "gw.example.com")
+		require.Error(t, err, "a self-addressed endpoint on a centralised proxy can never be served")
+		var sErr *status.Error
+		require.ErrorAs(t, err, &sErr)
+		assert.Equal(t, status.InvalidArgument, sErr.Type())
+		assert.Contains(t, err.Error(), "private capabilities")
+
+		_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+		assert.Error(t, err, "no row may be left behind by a rejected bootstrap")
+	})
+
+	t.Run("private proxy at the hostname is accepted", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.seedProxy(t, "private", "", "gw.example.com", ptrTo(true))
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+		created, err := f.createSettings(ctx, "account1", "user1", "", "gw.example.com")
+		require.NoError(t, err)
+		assert.Equal(t, "gw.example.com", created.ProxyAddress)
+	})
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer.go b/management/internals/modules/agentnetwork/synthesizer.go
index 74ac91845..212ec7f84 100644
--- a/management/internals/modules/agentnetwork/synthesizer.go
+++ b/management/internals/modules/agentnetwork/synthesizer.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/modeldiscovery"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
@@ -89,7 +90,7 @@ func SynthesizeServicesForCluster(ctx context.Context, s store.Store, clusterAdd
 		return nil, nil
 	}
 
-	settingsRows, err := s.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, clusterAddr)
+	settingsRows, err := s.GetAgentNetworkSettingsByProxyAddress(ctx, store.LockingStrengthNone, clusterAddr)
 	if err != nil {
 		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
 	}
@@ -116,53 +117,41 @@ func SynthesizeServicesForCluster(ctx context.Context, s store.Store, clusterAdd
 }
 
 // SynthesizeServiceForDomain resolves a single agent-network service by its
-// public endpoint domain. It lists the (few) settings rows on the domain's
-// cluster, matches the one whose endpoint equals the domain, and synthesises
-// only that account — avoiding full per-account synthesis for every tenant on
-// the cluster, which is what auth/session paths previously paid. Returns nil
-// (no error) when no account owns the domain.
+// public endpoint domain — a point query on the settings domain unique index,
+// then synthesis of just that account. Returns nil (no error) when no account
+// owns the domain.
 func SynthesizeServiceForDomain(ctx context.Context, s store.Store, domain string) (*rpservice.Service, error) {
-	domain = strings.TrimSpace(domain)
-	cluster := clusterFromDomain(domain)
-	if domain != "" && cluster != "" {
-		settingsRows, err := s.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, cluster)
-		if err != nil {
-			return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
+	domain = strings.ToLower(strings.TrimSpace(domain))
+	if domain == "" {
+		return nil, nil //nolint:nilnil // optional lookup: no account owns the domain
+	}
+
+	settings, err := s.GetAgentNetworkSettingsByDomain(ctx, store.LockingStrengthNone, domain)
+	if err != nil {
+		if isNotFound(err) {
+			return nil, nil //nolint:nilnil // optional lookup: no account owns the domain
 		}
-		for _, settings := range settingsRows {
-			if settings == nil || settings.Endpoint() != domain {
-				continue
-			}
-			services, serr := SynthesizeServices(ctx, s, settings.AccountID)
-			if serr != nil {
-				return nil, serr
-			}
-			for _, svc := range services {
-				if svc != nil && svc.Domain == domain {
-					return svc, nil
-				}
-			}
-			break
+		return nil, fmt.Errorf("get agent network settings by domain: %w", err)
+	}
+
+	services, err := SynthesizeServices(ctx, s, settings.AccountID)
+	if err != nil {
+		return nil, err
+	}
+	for _, svc := range services {
+		if svc != nil && svc.Domain == domain {
+			return svc, nil
 		}
 	}
 	return nil, nil //nolint:nilnil // optional lookup: no account owns the domain
 }
 
-// clusterFromDomain returns the cluster portion of an endpoint domain (every
-// label after the first).
-func clusterFromDomain(domain string) string {
-	if i := strings.IndexByte(domain, '.'); i >= 0 {
-		return domain[i+1:]
-	}
-	return ""
-}
-
 // SynthesizeServices builds the in-memory reverse-proxy service that
 // fronts the account's agent-network gateway. Returns nil when the
 // account has no settings row, no enabled providers, or no enabled
 // policies — in any of those cases there's nothing useful to expose.
 //
-// One service per (account, settings.Cluster) is emitted. The router
+// One service per (account, settings.ProxyAddress) is emitted. The router
 // middleware encodes a denormalised model→provider routing table
 // (auth headers + decrypted API keys baked in); the policy_check
 // middleware encodes per-provider authorised group IDs derived from
@@ -175,7 +164,7 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 	if err != nil {
 		return nil, err
 	}
-	if !ok || strings.TrimSpace(settings.Cluster) == "" {
+	if !ok || strings.TrimSpace(settings.ProxyAddress) == "" {
 		return nil, nil
 	}
 
@@ -222,8 +211,21 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 	}
 
 	groupIndex := indexProviderGroups(enabledPolicies)
+	catalogByProvider := catalogIDsByProvider(enabledProviders)
 
-	routerCfgJSON, err := buildRouterConfigJSON(enabledProviders, groupIndex)
+	// The proxy guardrail is a per-provider fail-closed backstop; the
+	// authoritative per-policy/group decision is management's
+	// SelectPolicyForRequest. A provider lands in that map only when every
+	// authorising policy restricts models.
+	providerAllowlists := buildProviderAllowlists(enabledPolicies, guardrailsByID, catalogByProvider)
+
+	// Discovery gets the finer view: per policy rather than flattened per
+	// provider, so a listing can be bounded to what the calling groups may
+	// actually use instead of the union across everyone who reaches the
+	// provider.
+	modelPolicies := buildModelPolicies(enabledPolicies, guardrailsByID, catalogByProvider)
+
+	routerCfgJSON, err := buildRouterConfigJSON(enabledProviders, groupIndex, modelPolicies)
 	if err != nil {
 		return nil, err
 	}
@@ -233,9 +235,14 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 		return nil, err
 	}
 
+	costMeterJSON, err := buildCostMeterConfigJSON(enabledProviders, groupIndex)
+	if err != nil {
+		return nil, err
+	}
+
 	mergedGuardrails := mergeGuardrails(enabledPolicies, guardrailsByID)
 	applyAccountCollectionControls(&mergedGuardrails, settings)
-	guardrailJSON, err := marshalGuardrailConfig(mergedGuardrails)
+	guardrailJSON, err := marshalGuardrailConfig(providerAllowlists, mergedGuardrails.PromptCapture)
 	if err != nil {
 		return nil, err
 	}
@@ -243,7 +250,7 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 	// Use the merged decision (account settings OR policy-required redaction),
 	// not the raw account flag, so a policy that mandates PII redaction is
 	// honored by the capture parsers even when the account toggle is off.
-	middlewares := buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, mergedGuardrails.PromptCapture.RedactPii, mergedGuardrails.PromptCapture.Enabled)
+	middlewares := buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, costMeterJSON, mergedGuardrails.PromptCapture.RedactPii, mergedGuardrails.PromptCapture.Enabled)
 
 	priv, pub, err := pickServiceSessionKeys(enabledProviders)
 	if err != nil {
@@ -346,6 +353,7 @@ type routerConfig struct {
 type routerProviderRoute struct {
 	ID              string   `json:"id"`
 	Vendor          string   `json:"vendor,omitempty"`
+	Vendors         []string `json:"vendors,omitempty"`
 	Models          []string `json:"models"`
 	UpstreamScheme  string   `json:"upstream_scheme"`
 	UpstreamHost    string   `json:"upstream_host"`
@@ -353,6 +361,11 @@ type routerProviderRoute struct {
 	AuthHeaderName  string   `json:"auth_header_name"`
 	AuthHeaderValue string   `json:"auth_header_value"`
 	AllowedGroupIDs []string `json:"allowed_group_ids,omitempty"`
+	// ModelPolicies is one entry per enabled policy authorising this provider,
+	// carrying that policy's source groups and the models it permits. The
+	// router bounds a model listing with it, so a provider two groups reach
+	// under different allowlists offers each only its own.
+	ModelPolicies []routerModelPolicy `json:"model_policies,omitempty"`
 	// Vertex marks a Google Vertex AI provider, whose requests carry the
 	// model in the URL path. The router selects it by path, bypassing the
 	// model/vendor table.
@@ -370,6 +383,9 @@ type routerProviderRoute struct {
 	// proxy dials this provider's upstream. For self-hosted / internal gateways
 	// behind a private or self-signed certificate.
 	SkipTLSVerify bool `json:"skip_tls_verify,omitempty"`
+	// DiscoveryHost, when set, is the host serving this provider's model
+	// listing, for a vendor that does not serve it from the inference host.
+	DiscoveryHost string `json:"discovery_host,omitempty"`
 }
 
 // indexProviderGroups walks the enabled policies and returns, per
@@ -424,7 +440,7 @@ func indexProviderGroups(policies []*types.Policy) map[string][]string {
 // path-prefix tiebreak. Providers no enabled policy authorises
 // (orphans) are intentionally OMITTED so the router never observes a
 // route with an empty ACL.
-func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]string) ([]byte, error) {
+func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]string, modelPolicies map[string][]routerModelPolicy) ([]byte, error) {
 	cfg := routerConfig{Providers: make([]routerProviderRoute, 0, len(providers))}
 	for _, p := range providers {
 		groups, hasPolicy := groupIndex[p.ID]
@@ -437,6 +453,9 @@ func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]
 		if err != nil {
 			return nil, fmt.Errorf("router config for provider %s: %w", p.ID, err)
 		}
+		// Lookup rather than assume: an unknown provider id yields the zero
+		// entry, which declares no discovery and so contributes nothing.
+		catalogEntry, _ := catalog.Lookup(p.ProviderID)
 		headerName, headerValue, gcpSAKeyB64, err := providerAuthHeader(p)
 		if err != nil {
 			return nil, err
@@ -444,6 +463,7 @@ func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]
 		cfg.Providers = append(cfg.Providers, routerProviderRoute{
 			ID:                      p.ID,
 			Vendor:                  providerVendor(p),
+			Vendors:                 providerVendors(p),
 			Models:                  providerModelIDs(p),
 			UpstreamScheme:          scheme,
 			UpstreamHost:            host,
@@ -451,10 +471,12 @@ func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]
 			AuthHeaderName:          headerName,
 			AuthHeaderValue:         headerValue,
 			AllowedGroupIDs:         groups,
+			ModelPolicies:           modelPolicies[p.ID],
 			Vertex:                  catalog.IsVertexPathStyle(p.ProviderID),
 			Bedrock:                 catalog.IsBedrockPathStyle(p.ProviderID),
 			GCPServiceAccountKeyB64: gcpSAKeyB64,
 			SkipTLSVerify:           p.SkipTLSVerification,
+			DiscoveryHost:           discoveryHost(catalogEntry, p.UpstreamURL),
 		})
 	}
 	out, err := json.Marshal(cfg)
@@ -464,6 +486,33 @@ func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]
 	return out, nil
 }
 
+// discoveryHost returns the host serving this provider's model listing when it
+// differs from the inference host, and empty when the two are the same — which
+// is true of every vendor but Bedrock, whose ListInferenceProfiles is a control
+// plane operation on bedrock.<region> while InvokeModel must go to
+// bedrock-runtime.<region>. One provider record therefore needs two hosts.
+//
+// The catalog declares the listing host; the region is recovered from the
+// upstream the operator configured, since a provider record carries no region
+// field. An upstream matching no catalog template yields empty rather than a
+// guess: a proxied or self-hosted Bedrock endpoint may serve both from one
+// place, and inventing a host would send the credential somewhere the operator
+// never configured.
+func discoveryHost(entry catalog.Provider, upstreamURL string) string {
+	if entry.Discovery == nil || entry.Discovery.Host == "" {
+		return ""
+	}
+	host := entry.Discovery.Host
+	if !strings.Contains(host, catalog.RegionPlaceholder) {
+		return host
+	}
+	region := modeldiscovery.RegionFromUpstream(entry, upstreamURL)
+	if region == "" {
+		return ""
+	}
+	return strings.ReplaceAll(host, catalog.RegionPlaceholder, region)
+}
+
 // providerVendor returns the parser surface ("openai", "anthropic", …)
 // the provider speaks, sourced from its catalog entry's ParserID. The
 // router uses it to keep a request the parser tagged with a vendor on a
@@ -479,6 +528,17 @@ func providerVendor(p *types.Provider) string {
 	return entry.ParserID
 }
 
+// providerVendors returns the parser surfaces a multi-surface gateway route
+// accepts. Single-surface providers keep using the singular vendor field so
+// existing proxy versions and configurations retain their wire shape.
+func providerVendors(p *types.Provider) []string {
+	entry, ok := catalog.Lookup(p.ProviderID)
+	if !ok || len(entry.RouterVendors) == 0 {
+		return nil
+	}
+	return append([]string(nil), entry.RouterVendors...)
+}
+
 // providerModelIDs returns the model identifiers exposed by the
 // provider, deduplicated and in the operator's declared order. Empty
 // slice when no models are configured — the router treats that as
@@ -540,6 +600,7 @@ type identityInjectJSONMetadata struct {
 	UserKey        string `json:"user_key,omitempty"`
 	GroupsKey      string `json:"groups_key,omitempty"`
 	MaxValueLength int    `json:"max_value_length,omitempty"`
+	Sanitize       bool   `json:"sanitize,omitempty"`
 }
 
 // buildIdentityInjectConfigJSON walks the enabled providers and emits
@@ -583,9 +644,11 @@ func buildIdentityInjectConfigJSON(providers []*types.Provider, groupIndex map[s
 func buildIdentityInjectRule(p *types.Provider, entry catalog.Provider) (identityInjectProvider, bool) {
 	rule := identityInjectProvider{ProviderID: p.ID}
 	// Identity-stamping shape (one of HeaderPair / JSONMetadata). Skip the
-	// shape silently when the catalog entry doesn't declare one — extras
-	// can still apply, see below.
-	if entry.IdentityInjection != nil {
+	// shape silently when the catalog entry doesn't declare one, or when the
+	// operator disabled metadata for this provider — extras can still apply,
+	// see below. MetadataDisabled suppresses only the identity dimensions
+	// (user + authorizing group), not the catalog's routing ExtraHeaders.
+	if !p.MetadataDisabled && entry.IdentityInjection != nil {
 		switch {
 		case entry.IdentityInjection.HeaderPair != nil:
 			rule.HeaderPair = buildIdentityHeaderPair(p, entry.IdentityInjection.HeaderPair)
@@ -651,6 +714,7 @@ func buildIdentityJSONMetadata(p *types.Provider, jm *catalog.JSONMetadataInject
 		UserKey:        userKey,
 		GroupsKey:      groupsKey,
 		MaxValueLength: jm.MaxValueLength,
+		Sanitize:       jm.Sanitize,
 	}
 }
 
@@ -691,7 +755,7 @@ func buildIdentityExtraHeaders(p *types.Provider, extras []catalog.ExtraHeader)
 // requests bound for gateways like LiteLLM that key budgets and
 // attribution off request headers. CanMutate is required so its
 // HeadersAdd / HeadersRemove pass the framework's mutation gate.
-func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON []byte, redactPii, capturePromptContent bool) []rpservice.MiddlewareConfig {
+func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, costMeterJSON []byte, redactPii, capturePromptContent bool) []rpservice.MiddlewareConfig {
 	// Both parsers receive an explicit capture flag derived from the account's
 	// enable_prompt_collection toggle; nil/unset would default to the legacy
 	// "always emit" behavior in the middleware, which is precisely what we
@@ -760,10 +824,13 @@ func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON []byt
 			ConfigJSON: []byte("{}"),
 		},
 		{
+			// Carries the full pricing table (defaults + per-provider
+			// operator prices) so the proxy bills without an embedded
+			// price list; see buildCostMeterConfigJSON.
 			ID:         middlewareIDCostMeter,
 			Enabled:    true,
 			Slot:       rpservice.MiddlewareSlotOnResponse,
-			ConfigJSON: []byte("{}"),
+			ConfigJSON: costMeterJSON,
 		},
 		{
 			ID:         middlewareIDLLMResponseParser,
@@ -776,10 +843,12 @@ func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON []byt
 
 // guardrailConfig is the JSON shape the proxy-side llm_guardrail
 // middleware expects. Mirrors the proxy registration documented in
-// the management→proxy contract.
+// the management→proxy contract. provider_allowlists is keyed by the
+// resolved provider id llm_router stamps; a provider absent from the map is
+// unrestricted at the proxy layer.
 type guardrailConfig struct {
-	ModelAllowlist []string               `json:"model_allowlist,omitempty"`
-	PromptCapture  guardrailPromptCapture `json:"prompt_capture"`
+	ProviderAllowlists map[string][]string    `json:"provider_allowlists,omitempty"`
+	PromptCapture      guardrailPromptCapture `json:"prompt_capture"`
 }
 
 type guardrailPromptCapture struct {
@@ -824,13 +893,10 @@ func applyAccountCollectionControls(merged *MergedGuardrails, settings *types.Se
 	merged.PromptCapture.RedactPii = settings.RedactPii || merged.PromptCapture.RedactPii
 }
 
-func marshalGuardrailConfig(merged MergedGuardrails) ([]byte, error) {
+func marshalGuardrailConfig(providerAllowlists map[string][]string, capture MergedPromptCapture) ([]byte, error) {
 	cfg := guardrailConfig{
-		ModelAllowlist: merged.ModelAllowlist,
-		PromptCapture: guardrailPromptCapture{
-			Enabled:   merged.PromptCapture.Enabled,
-			RedactPii: merged.PromptCapture.RedactPii,
-		},
+		ProviderAllowlists: providerAllowlists,
+		PromptCapture:      guardrailPromptCapture(capture),
 	}
 	out, err := json.Marshal(cfg)
 	if err != nil {
@@ -839,6 +905,117 @@ func marshalGuardrailConfig(merged MergedGuardrails) ([]byte, error) {
 	return out, nil
 }
 
+// buildProviderAllowlists returns the proxy's per-provider backstop: a provider
+// is included only when every authorising policy restricts models (their union);
+// if any leaves it unrestricted it is omitted, so management decides per group.
+// Entries carry their provider-specific canonical form alongside the verbatim
+// one, resolved through catalogByProvider.
+func buildProviderAllowlists(policies []*types.Policy, byID map[string]*types.Guardrail, catalogByProvider map[string]string) map[string][]string {
+	type providerAcc struct {
+		models          map[string]struct{}
+		anyUnrestricted bool
+	}
+	accs := make(map[string]*providerAcc)
+	for _, p := range policies {
+		if p == nil {
+			continue
+		}
+		restricted, models := policyModelAllowlist(p, byID)
+		for _, providerID := range p.DestinationProviderIDs {
+			if providerID == "" {
+				continue
+			}
+			acc, ok := accs[providerID]
+			if !ok {
+				acc = &providerAcc{models: make(map[string]struct{})}
+				accs[providerID] = acc
+			}
+			if !restricted {
+				acc.anyUnrestricted = true
+				continue
+			}
+			for _, m := range expandModelsForProvider(models, catalogByProvider[providerID]) {
+				acc.models[m] = struct{}{}
+			}
+		}
+	}
+	out := make(map[string][]string, len(accs))
+	for providerID, acc := range accs {
+		if acc.anyUnrestricted {
+			continue
+		}
+		models := make([]string, 0, len(acc.models))
+		for m := range acc.models {
+			models = append(models, m)
+		}
+		sort.Strings(models)
+		out[providerID] = models
+	}
+	return out
+}
+
+// policyModelAllowlist reports whether a policy restricts models (has an
+// allowlist-enabled guardrail) and the union of allowed models, verbatim.
+// Consumers expand the entries per destination provider with
+// expandModelsForProvider — the canonical form is provider-specific — and
+// the proxy factory lowercases/trims them at decode time.
+func policyModelAllowlist(p *types.Policy, byID map[string]*types.Guardrail) (bool, []string) {
+	restricted := false
+	var models []string
+	for _, gID := range p.GuardrailIDs {
+		g, ok := byID[gID]
+		if !ok || g == nil || !g.Checks.ModelAllowlist.Enabled {
+			continue
+		}
+		restricted = true
+		for _, m := range g.Checks.ModelAllowlist.Models {
+			if m != "" {
+				models = append(models, m)
+			}
+		}
+	}
+	return restricted, models
+}
+
+// expandModelsForProvider returns the allowlist entries for one destination
+// provider: each entry verbatim plus, when it differs, its canonical form
+// under that provider's catalog id — the id the proxy's parser emits at
+// request time — deduplicated. The proxy-side compares (guardrail backstop,
+// per-group router rules) then admit an allowlist however the operator
+// wrote it, raw declared id or canonical, while a plain provider's entries
+// stay verbatim and can never widen.
+func expandModelsForProvider(models []string, catalogProviderID string) []string {
+	out := make([]string, 0, len(models))
+	seen := make(map[string]struct{}, len(models))
+	add := func(m string) {
+		if m == "" {
+			return
+		}
+		if _, dup := seen[m]; dup {
+			return
+		}
+		seen[m] = struct{}{}
+		out = append(out, m)
+	}
+	for _, m := range models {
+		add(m)
+		add(canonicalModelKey(catalogProviderID, m))
+	}
+	return out
+}
+
+// catalogIDsByProvider indexes providers' catalog ids by provider record id,
+// the lookup the per-provider allowlist expansion keys the normalizer on.
+func catalogIDsByProvider(providers []*types.Provider) map[string]string {
+	out := make(map[string]string, len(providers))
+	for _, p := range providers {
+		if p != nil {
+			out[p.ID] = p.ProviderID
+		}
+	}
+	return out
+}
+
 // buildAccountService composes the per-account gateway Service. The
 // target carries the noop placeholder URL — the router middleware
 // rewrites every request to the matched provider's upstream before the
@@ -850,7 +1027,7 @@ func buildAccountService(
 	middlewares []rpservice.MiddlewareConfig,
 	sessionPriv, sessionPub string,
 ) *rpservice.Service {
-	cluster := settings.Cluster
+	cluster := settings.ProxyAddress
 	domain := settings.Endpoint()
 	serviceID := SynthesizedServiceIDPrefix + accountID
 
@@ -982,38 +1159,11 @@ func unionSourceGroups(policies []*types.Policy) []string {
 	return out
 }
 
-// MergedGuardrails is the JSON shape passed to the proxy via the
-// guardrail middleware's config_json. Mirrors the proxy-side
-// expectations and is intentionally distinct from
-// types.GuardrailChecks so we can evolve either side independently.
+// MergedGuardrails is the synthesiser's fold target. Only prompt capture is
+// merged here — the model allowlist is emitted per-provider, and
+// token/budget/retention moved onto Policy.Limits and account Settings.
 type MergedGuardrails struct {
-	ModelAllowlist []string            `json:"model_allowlist,omitempty"`
-	TokenLimits    MergedTokenLimits   `json:"token_limits"`
-	Budget         MergedBudget        `json:"budget"`
-	PromptCapture  MergedPromptCapture `json:"prompt_capture"`
-	Retention      MergedRetention     `json:"retention"`
-}
-
-type MergedTokenLimits struct {
-	Hourly  *MergedTokenWindow `json:"hourly,omitempty"`
-	Daily   *MergedTokenWindow `json:"daily,omitempty"`
-	Monthly *MergedTokenWindow `json:"monthly,omitempty"`
-}
-
-type MergedTokenWindow struct {
-	MaxInputTokens  int `json:"max_input_tokens,omitempty"`
-	MaxOutputTokens int `json:"max_output_tokens,omitempty"`
-}
-
-type MergedBudget struct {
-	Hourly  *MergedBudgetWindow `json:"hourly,omitempty"`
-	Daily   *MergedBudgetWindow `json:"daily,omitempty"`
-	Monthly *MergedBudgetWindow `json:"monthly,omitempty"`
-}
-
-type MergedBudgetWindow struct {
-	SoftCapUSD float64 `json:"soft_cap_usd,omitempty"`
-	HardCapUSD float64 `json:"hard_cap_usd,omitempty"`
+	PromptCapture MergedPromptCapture
 }
 
 type MergedPromptCapture struct {
@@ -1021,64 +1171,31 @@ type MergedPromptCapture struct {
 	RedactPii bool `json:"redact_pii"`
 }
 
-type MergedRetention struct {
-	Enabled bool `json:"enabled"`
-	Days    int  `json:"days"`
-}
-
-// mergeGuardrails computes the effective guardrail spec applied at the
-// proxy, given the referencing policies and the account's guardrail
-// catalogue. Policy enabled-ness is the caller's responsibility — only
-// enabled policies should be passed in.
+// mergeGuardrails folds the referencing policies' guardrails into the
+// prompt-capture decision only. The model allowlist is enforced per-policy/group
+// in management and shipped per-provider; token/budget/retention live off
+// guardrails now.
 //
-// Merge rules:
-//   - Model allowlist:   union of allowlists across policies that enable it.
-//   - Token / Budget:    most-restrictive (min of non-zero caps) per window.
-//   - Prompt capture:    enabled if any policy enables it; redact_pii sticks
-//     if any enabling policy turns it on.
-//   - Retention:         enabled if any enables it; smallest non-zero days wins.
+// Merge rule — prompt capture: enabled if any policy enables it; redact_pii
+// sticks if any enabling policy turns it on.
 func mergeGuardrails(policies []*types.Policy, byID map[string]*types.Guardrail) MergedGuardrails {
 	merged := MergedGuardrails{}
-	allowlist := make(map[string]struct{})
-	allowlistEnabled := false
-
 	for _, policy := range policies {
 		for _, gID := range policy.GuardrailIDs {
 			g, ok := byID[gID]
 			if !ok || g == nil {
 				continue
 			}
-			mergeGuardrail(g, &merged, allowlist, &allowlistEnabled)
+			mergeGuardrail(g, &merged)
 		}
 	}
-
-	if allowlistEnabled {
-		merged.ModelAllowlist = make([]string, 0, len(allowlist))
-		for m := range allowlist {
-			merged.ModelAllowlist = append(merged.ModelAllowlist, m)
-		}
-		sort.Strings(merged.ModelAllowlist)
-	}
 	return merged
 }
 
-// mergeGuardrail folds a single guardrail's enabled checks into the
-// running merge: model-allowlist models join the shared set (and flip
-// allowlistEnabled), and prompt-capture / redact-pii stick once any
-// enabling guardrail turns them on.
-//
-// TokenLimits, Budget, and Retention have moved off guardrails — token
-// and budget caps now live on the Policy itself (Policy.Limits) and
-// retention moves to account-level Settings — so they are not merged here.
-func mergeGuardrail(g *types.Guardrail, merged *MergedGuardrails, allowlist map[string]struct{}, allowlistEnabled *bool) {
-	if g.Checks.ModelAllowlist.Enabled {
-		*allowlistEnabled = true
-		for _, m := range g.Checks.ModelAllowlist.Models {
-			if m != "" {
-				allowlist[m] = struct{}{}
-			}
-		}
-	}
+// mergeGuardrail folds a single guardrail's prompt-capture settings into the
+// running merge: enabled / redact-pii stick once any enabling guardrail turns
+// them on.
+func mergeGuardrail(g *types.Guardrail, merged *MergedGuardrails) {
 	if g.Checks.PromptCapture.Enabled {
 		merged.PromptCapture.Enabled = true
 		if g.Checks.PromptCapture.RedactPii {
@@ -1086,3 +1203,48 @@ func mergeGuardrail(g *types.Guardrail, merged *MergedGuardrails, allowlist map[
 		}
 	}
 }
+
+// routerModelPolicy mirrors the router's ModelPolicyRule: one authorising
+// policy's source groups plus the models it permits. Models is nil for a
+// policy that sets no model allowlist, which lifts the restriction for the
+// groups it binds — so nil and empty must survive the round trip distinctly.
+type routerModelPolicy struct {
+	GroupIDs []string `json:"group_ids"`
+	Models   []string `json:"models"`
+}
+
+// buildModelPolicies indexes, per provider, one rule for each enabled policy
+// authorising it: the policy's source groups and the models its guardrail
+// permits.
+//
+// This is deliberately finer than buildProviderAllowlists, which flattens the
+// same inputs into one list per provider for the proxy's fail-closed guardrail.
+// A flattened list cannot answer "what may THIS caller see", so a provider two
+// teams reach under different allowlists would offer each team the other's
+// models — a picker full of entries the next request refuses. Keeping the
+// source groups alongside the models lets the router answer it at request time,
+// where it knows the caller's groups.
+func buildModelPolicies(policies []*types.Policy, byID map[string]*types.Guardrail, catalogByProvider map[string]string) map[string][]routerModelPolicy {
+	out := make(map[string][]routerModelPolicy)
+	for _, p := range policies {
+		if p == nil || len(p.SourceGroups) == 0 {
+			continue
+		}
+		restricted, models := policyModelAllowlist(p, byID)
+		for _, providerID := range p.DestinationProviderIDs {
+			if providerID == "" {
+				continue
+			}
+			rule := routerModelPolicy{GroupIDs: append([]string(nil), p.SourceGroups...)}
+			if restricted {
+				// Never nil when restricted: an allowlist permitting nothing
+				// must stay distinguishable from no allowlist at all. The
+				// expansion is per provider — the canonical form of an entry
+				// depends on the destination's catalog id.
+				rule.Models = append([]string{}, expandModelsForProvider(models, catalogByProvider[providerID])...)
+			}
+			out[providerID] = append(out[providerID], rule)
+		}
+	}
+	return out
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer_guardrail_realstore_test.go b/management/internals/modules/agentnetwork/synthesizer_guardrail_realstore_test.go
index 8ed4910da..8b13f78ac 100644
--- a/management/internals/modules/agentnetwork/synthesizer_guardrail_realstore_test.go
+++ b/management/internals/modules/agentnetwork/synthesizer_guardrail_realstore_test.go
@@ -81,8 +81,8 @@ func TestSynthesizeServices_RealStore_PromptCaptureAccountIsSoleControl(t *testi
 	require.Len(t, services, 1)
 
 	cfg := decodeServiceGuardrailConfig(t, services[0])
-	assert.Equal(t, []string{"gpt-5.4"}, cfg.ModelAllowlist,
-		"model allowlist is a pure policy guardrail and must always reach the config")
+	assert.Equal(t, map[string][]string{"prov-1": {"gpt-5.4"}}, cfg.ProviderAllowlists,
+		"model allowlist is a pure policy guardrail and must reach the per-provider config")
 	assert.False(t, cfg.PromptCapture.Enabled,
 		"prompt capture must be off when the account toggle is off, even with a capture-enabled guardrail")
 }
@@ -172,7 +172,7 @@ func TestSynthesizeServices_RealStore_NoGuardrail_CaptureOff(t *testing.T) {
 	require.Len(t, services, 1, "exactly one synth service expected")
 
 	cfg := decodeServiceGuardrailConfig(t, services[0])
-	assert.Empty(t, cfg.ModelAllowlist, "no guardrail → no allowlist")
+	assert.Empty(t, cfg.ProviderAllowlists, "no guardrail → provider unrestricted (absent from map)")
 	assert.False(t, cfg.PromptCapture.Enabled, "no guardrail → prompt capture off by default")
 	assert.False(t, cfg.PromptCapture.RedactPii, "no guardrail → redact off by default")
 }
diff --git a/management/internals/modules/agentnetwork/synthesizer_pricing.go b/management/internals/modules/agentnetwork/synthesizer_pricing.go
new file mode 100644
index 000000000..6d57ffaef
--- /dev/null
+++ b/management/internals/modules/agentnetwork/synthesizer_pricing.go
@@ -0,0 +1,131 @@
+package agentnetwork
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	sharedllm "github.com/netbirdio/netbird/shared/llm"
+)
+
+// costMeterConfig is the JSON shape the proxy-side cost_meter middleware
+// expects (mirror-type pattern, same as routerConfig). The top-level
+// "pricing" wrapper is the feature-detection signal: an old proxy's config
+// struct ignores it as an unknown field, and a new proxy treats its
+// absence as "old management" (skips every cost computation and warns).
+type costMeterConfig struct {
+	Pricing *costMeterPricing `json:"pricing,omitempty"`
+}
+
+// costMeterPricing carries the full pricing table:
+//   - Defaults: surface ("openai"/"anthropic"/"bedrock") -> normalized
+//     model id -> rates. The full default table ships to every account —
+//     it is small (~10 KB) and keeps gateway-style providers (which
+//     enumerate no models) priced for every catalog model.
+//   - Providers: provider record id (matched against the
+//     llm.resolved_provider_id metadata llm_router stamps) -> normalized
+//     model id -> rates. Entries are fully materialized here at synth
+//     time — default cache rates already folded in — so the proxy does
+//     two map lookups and no merging.
+type costMeterPricing struct {
+	Defaults  map[string]map[string]pricing.Entry `json:"defaults,omitempty"`
+	Providers map[string]map[string]pricing.Entry `json:"providers,omitempty"`
+}
+
+// buildCostMeterConfigJSON assembles the cost_meter middleware config
+// from the default pricing table plus the operator's stored per-provider
+// model prices. Same orphan rule as the router: a provider no enabled
+// policy authorises is unreachable, so its prices are not shipped.
+//
+// Overlay semantics per model row:
+//   - The row's model id is normalized exactly the way the proxy's
+//     request parser normalizes the ids it meters (bedrock ARN/region/
+//     version stripping, vertex "@version" stripping), so the per-record
+//     lookup key compares equal to llm.model at billing time.
+//   - The entry starts from the default entry for that model (when one
+//     exists) to inherit cache rates the operator didn't state.
+//   - Operator input/output overlay verbatim — including an explicit 0,
+//     which prices the model as free (self-hosted / internal endpoints)
+//     rather than silently reverting to list price.
+//   - Cache-rate pointers overlay only when non-nil: nil means "inherit
+//     the default", an explicit 0 means "no discount, bill this bucket
+//     at the input rate".
+func buildCostMeterConfigJSON(providers []*types.Provider, groupIndex map[string][]string) ([]byte, error) {
+	cfg := costMeterConfig{Pricing: &costMeterPricing{
+		Defaults: pricing.DefaultTable(),
+	}}
+
+	perRecord := make(map[string]map[string]pricing.Entry)
+	for _, p := range providers {
+		if _, hasPolicy := groupIndex[p.ID]; !hasPolicy {
+			// Orphan: unreachable via the router, so unpriceable.
+			continue
+		}
+		if len(p.Models) == 0 {
+			// Gateway-style "claim every model" provider: the defaults
+			// table is its price list.
+			continue
+		}
+		entry, _ := catalog.Lookup(p.ProviderID)
+		models := make(map[string]pricing.Entry, len(p.Models))
+		for _, m := range p.Models {
+			id := normalizePricingModelID(p.ProviderID, m.ID)
+			if id == "" {
+				continue
+			}
+			if _, dup := models[id]; dup {
+				// First occurrence wins on post-normalization duplicates,
+				// matching providerModelIDs' dedup order for routing.
+				continue
+			}
+			models[id] = materializeEntry(entry.PricingSurfaces, id, m)
+		}
+		if len(models) > 0 {
+			perRecord[p.ID] = models
+		}
+	}
+	if len(perRecord) > 0 {
+		cfg.Pricing.Providers = perRecord
+	}
+
+	out, err := json.Marshal(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("marshal cost_meter middleware config: %w", err)
+	}
+	return out, nil
+}
+
+// normalizePricingModelID maps an operator-entered model id onto the
+// normalized id the proxy's request parser emits as llm.model — the key
+// the cost meter looks up at billing time.
+func normalizePricingModelID(catalogProviderID, modelID string) string {
+	switch {
+	case catalog.IsBedrockPathStyle(catalogProviderID):
+		return sharedllm.NormalizeBedrockModel(modelID)
+	case catalog.IsVertexPathStyle(catalogProviderID):
+		return sharedllm.NormalizeVertexModel(modelID)
+	default:
+		return modelID
+	}
+}
+
+// materializeEntry folds the default entry for (surfaces, model) — when
+// one exists — under the operator's stored prices, producing the fully
+// materialized wire entry.
+func materializeEntry(surfaces []string, normalizedID string, m types.ProviderModel) pricing.Entry {
+	e, _ := pricing.LookupDefault(surfaces, normalizedID) // zero Entry on miss
+	e.InputPer1k = m.InputPer1k
+	e.OutputPer1k = m.OutputPer1k
+	if m.CachedInputPer1k != nil {
+		e.CachedInputPer1k = *m.CachedInputPer1k
+	}
+	if m.CacheReadPer1k != nil {
+		e.CacheReadPer1k = *m.CacheReadPer1k
+	}
+	if m.CacheCreationPer1k != nil {
+		e.CacheCreationPer1k = *m.CacheCreationPer1k
+	}
+	return e
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer_pricing_test.go b/management/internals/modules/agentnetwork/synthesizer_pricing_test.go
new file mode 100644
index 000000000..e82f2ef05
--- /dev/null
+++ b/management/internals/modules/agentnetwork/synthesizer_pricing_test.go
@@ -0,0 +1,139 @@
+package agentnetwork
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+)
+
+func fptr(v float64) *float64 { return &v }
+
+func decodeCostMeterConfig(t *testing.T, raw []byte) costMeterConfig {
+	t.Helper()
+	var cfg costMeterConfig
+	require.NoError(t, json.Unmarshal(raw, &cfg), "cost meter config must round-trip")
+	require.NotNil(t, cfg.Pricing, "pricing wrapper must be present")
+	return cfg
+}
+
+// TestBuildCostMeterConfig_BedrockModelNormalization: the operator may
+// paste region-prefixed, versioned, or ARN-wrapped Bedrock ids; the
+// per-record map must be keyed by the normalized id the request parser
+// emits as llm.model, or the lookup never hits at billing time.
+func TestBuildCostMeterConfig_BedrockModelNormalization(t *testing.T) {
+	bedrock := &types.Provider{
+		ID:         "prov-bedrock",
+		ProviderID: "bedrock_api",
+		Enabled:    true,
+		Models: []types.ProviderModel{
+			{ID: "eu.anthropic.claude-sonnet-4-5-20250929-v1:0", InputPer1k: 0.0033, OutputPer1k: 0.0165},
+			// Post-normalization duplicate of the row above under a
+			// different regional spelling — first occurrence wins.
+			{ID: "us.anthropic.claude-sonnet-4-5-20250929-v1:0", InputPer1k: 9.9, OutputPer1k: 9.9},
+		},
+	}
+	raw, err := buildCostMeterConfigJSON([]*types.Provider{bedrock}, map[string][]string{"prov-bedrock": {"grp"}})
+	require.NoError(t, err)
+	cfg := decodeCostMeterConfig(t, raw)
+
+	models := cfg.Pricing.Providers["prov-bedrock"]
+	require.Len(t, models, 1, "both spellings normalize to one model; first row wins")
+	e, ok := models["anthropic.claude-sonnet-4-5"]
+	require.True(t, ok, "key must be the normalized id the parser emits, not the operator's raw spelling")
+	assert.InDelta(t, 0.0033, e.InputPer1k, 1e-9, "first row's rate wins the dedup")
+	assert.InDelta(t, 0.0003, e.CacheReadPer1k, 1e-9, "cache read inherited from the bedrock default entry")
+	assert.InDelta(t, 0.00375, e.CacheCreationPer1k, 1e-9, "cache creation inherited from the bedrock default entry")
+}
+
+// TestBuildCostMeterConfig_CacheRateNilVsZero pins the pointer semantics:
+// nil inherits the default cache rate, explicit 0 clears it (that bucket
+// bills at the input rate on the proxy).
+func TestBuildCostMeterConfig_CacheRateNilVsZero(t *testing.T) {
+	p := &types.Provider{
+		ID:         "prov-oai",
+		ProviderID: "openai_api",
+		Enabled:    true,
+		Models: []types.ProviderModel{
+			{ID: "gpt-4o", InputPer1k: 0.002, OutputPer1k: 0.008},                                    // nil → inherit 0.00125
+			{ID: "gpt-4o-mini", InputPer1k: 0.0001, OutputPer1k: 0.0005, CachedInputPer1k: fptr(0)},  // explicit 0 → no discount
+			{ID: "my-custom-ft", InputPer1k: 0.01, OutputPer1k: 0.02, CachedInputPer1k: fptr(0.005)}, // unknown model, explicit rate
+		},
+	}
+	raw, err := buildCostMeterConfigJSON([]*types.Provider{p}, map[string][]string{"prov-oai": {"grp"}})
+	require.NoError(t, err)
+	cfg := decodeCostMeterConfig(t, raw)
+	models := cfg.Pricing.Providers["prov-oai"]
+
+	assert.InDelta(t, 0.00125, models["gpt-4o"].CachedInputPer1k, 1e-9, "nil cache pointer inherits the default rate")
+	assert.Zero(t, models["gpt-4o-mini"].CachedInputPer1k, "explicit 0 overrides the default (0.000075) — bucket bills at input rate")
+	custom := models["my-custom-ft"]
+	assert.InDelta(t, 0.005, custom.CachedInputPer1k, 1e-9, "unknown model keeps the operator's explicit cache rate")
+	assert.Zero(t, custom.CacheReadPer1k, "no default to inherit for a model outside the catalog")
+}
+
+// TestBuildCostMeterConfig_OrphanAndGatewayProviders: an orphan (no
+// authorising policy) is unreachable so its prices must not ship; a
+// gateway with no model rows relies on the defaults table and gets no
+// per-record entry.
+func TestBuildCostMeterConfig_OrphanAndGatewayProviders(t *testing.T) {
+	orphan := &types.Provider{
+		ID:         "prov-orphan",
+		ProviderID: "openai_api",
+		Enabled:    true,
+		Models:     []types.ProviderModel{{ID: "gpt-4o", InputPer1k: 1, OutputPer1k: 1}},
+	}
+	gateway := &types.Provider{
+		ID:         "prov-litellm",
+		ProviderID: "litellm_proxy",
+		Enabled:    true,
+		Models:     []types.ProviderModel{},
+	}
+	raw, err := buildCostMeterConfigJSON(
+		[]*types.Provider{orphan, gateway},
+		map[string][]string{"prov-litellm": {"grp"}}, // orphan has no policy
+	)
+	require.NoError(t, err)
+	cfg := decodeCostMeterConfig(t, raw)
+
+	assert.NotContains(t, cfg.Pricing.Providers, "prov-orphan", "orphan provider prices must not ship")
+	assert.NotContains(t, cfg.Pricing.Providers, "prov-litellm", "empty-models gateway needs no per-record entry")
+	assert.NotEmpty(t, cfg.Pricing.Defaults["openai"], "defaults still ship so the gateway's catalog-model traffic is priced")
+}
+
+// TestBuildCostMeterConfig_BedrockGeographyOutsideTheOriginalFour is the
+// accounting half of the geography bug. The docs tell operators to register a
+// Bedrock id exactly as AWS issues it, region prefix included, and the cost
+// meter keys its table by the normalized form. While the geography was matched
+// against a list of four, a profile issued anywhere else kept its prefix,
+// missed the catalog entry it was meant to inherit from, and billed with a
+// zero entry underneath the operator's own rates — so every cache bucket
+// metered free and a model priced only by catalog defaults metered at nothing
+// at all.
+func TestBuildCostMeterConfig_BedrockGeographyOutsideTheOriginalFour(t *testing.T) {
+	for _, geo := range []string{"jp", "au", "ca", "sa", "us-gov"} {
+		t.Run(geo, func(t *testing.T) {
+			bedrock := &types.Provider{
+				ID:         "prov-bedrock",
+				ProviderID: "bedrock_api",
+				Enabled:    true,
+				Models: []types.ProviderModel{
+					{ID: geo + ".anthropic.claude-sonnet-5-20260514-v1:0", InputPer1k: 0.003, OutputPer1k: 0.015},
+				},
+			}
+			raw, err := buildCostMeterConfigJSON([]*types.Provider{bedrock}, map[string][]string{"prov-bedrock": {"grp"}})
+			require.NoError(t, err)
+			cfg := decodeCostMeterConfig(t, raw)
+
+			e, ok := cfg.Pricing.Providers["prov-bedrock"]["anthropic.claude-sonnet-5"]
+			require.True(t, ok, "a %s profile must key by the same normalized id the parser emits", geo)
+			assert.InDelta(t, 0.0003, e.CacheReadPer1k, 1e-9,
+				"cache read must be inherited from the bedrock default entry, not left at zero")
+			assert.InDelta(t, 0.00375, e.CacheCreationPer1k, 1e-9,
+				"cache creation must be inherited from the bedrock default entry, not left at zero")
+		})
+	}
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go b/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go
new file mode 100644
index 000000000..22833ec10
--- /dev/null
+++ b/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go
@@ -0,0 +1,232 @@
+package agentnetwork
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+)
+
+// policyForProviders builds an enabled policy authorising the given providers
+// under the given guardrails (both optional). Groups are irrelevant to
+// buildProviderAllowlists, which keys purely on destination provider.
+func policyForProviders(id string, guardrailIDs []string, providerIDs ...string) *types.Policy {
+	return &types.Policy{
+		ID:                     id,
+		Enabled:                true,
+		DestinationProviderIDs: providerIDs,
+		GuardrailIDs:           guardrailIDs,
+	}
+}
+
+func TestBuildProviderAllowlists(t *testing.T) {
+	byID := map[string]*types.Guardrail{
+		"g-4o":       allowlistGuardrail("g-4o", "acc-1", "gpt-4o"),
+		"g-opus":     allowlistGuardrail("g-opus", "acc-1", "claude-opus-4"),
+		"g-disabled": {ID: "g-disabled", Checks: types.GuardrailChecks{ModelAllowlist: types.GuardrailModelAllowlist{Enabled: false, Models: []string{"gpt-4o"}}}},
+	}
+
+	t.Run("all authorising policies restrict yields per-provider union", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-4o"}, "prov-x"),
+			policyForProviders("p2", []string{"g-opus"}, "prov-x"),
+		}
+		got := buildProviderAllowlists(policies, byID, nil)
+		assert.Equal(t, map[string][]string{"prov-x": {"claude-opus-4", "gpt-4o"}}, got,
+			"a provider every policy restricts carries the sorted union of their models")
+	})
+
+	t.Run("any un-guardrailed policy leaves the provider unrestricted (omitted)", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-4o"}, "prov-x"),
+			policyForProviders("p2", nil, "prov-x"), // no guardrail
+		}
+		got := buildProviderAllowlists(policies, byID, nil)
+		assert.NotContains(t, got, "prov-x",
+			"a provider reachable by an un-guardrailed policy must be omitted so the proxy treats it as unrestricted")
+	})
+
+	t.Run("a disabled allowlist counts as unrestricted", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-disabled"}, "prov-x"),
+		}
+		got := buildProviderAllowlists(policies, byID, nil)
+		assert.NotContains(t, got, "prov-x",
+			"a policy whose only guardrail has a disabled allowlist is unrestricted")
+	})
+
+	t.Run("providers are isolated from one another", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-4o"}, "prov-x"),
+			policyForProviders("p2", []string{"g-opus"}, "prov-y"),
+		}
+		got := buildProviderAllowlists(policies, byID, nil)
+		assert.Equal(t, []string{"gpt-4o"}, got["prov-x"], "prov-x keeps only its own model")
+		assert.Equal(t, []string{"claude-opus-4"}, got["prov-y"], "prov-y keeps only its own model")
+	})
+
+	t.Run("one policy authorising two providers restricts both", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-4o"}, "prov-x", "prov-y"),
+		}
+		got := buildProviderAllowlists(policies, byID, nil)
+		assert.Equal(t, []string{"gpt-4o"}, got["prov-x"])
+		assert.Equal(t, []string{"gpt-4o"}, got["prov-y"])
+	})
+
+	t.Run("union across a single policy's guardrails", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-4o", "g-opus"}, "prov-x"),
+		}
+		got := buildProviderAllowlists(policies, byID, nil)
+		assert.ElementsMatch(t, []string{"claude-opus-4", "gpt-4o"}, got["prov-x"],
+			"a policy's own multiple allowlist guardrails union together")
+	})
+
+	t.Run("an enabled allowlist with no models denies everything", func(t *testing.T) {
+		empty := map[string]*types.Guardrail{"g-empty": allowlistGuardrail("g-empty", "acc-1")}
+		got := buildProviderAllowlists([]*types.Policy{
+			policyForProviders("p1", []string{"g-empty"}, "prov-x"),
+		}, empty, nil)
+		assert.Equal(t, map[string][]string{"prov-x": {}}, got,
+			"an enabled-but-empty allowlist is restricted with an empty set, not unrestricted")
+	})
+}
+
+// policyForGroups builds an enabled policy binding the given source groups to
+// the given providers under an optional guardrail.
+func policyForGroups(id string, groups []string, guardrailIDs []string, providerIDs ...string) *types.Policy {
+	return &types.Policy{
+		ID:                     id,
+		Enabled:                true,
+		SourceGroups:           groups,
+		DestinationProviderIDs: providerIDs,
+		GuardrailIDs:           guardrailIDs,
+	}
+}
+
+// TestBuildModelPolicies covers the finer index discovery needs. Where
+// buildProviderAllowlists flattens every authorising policy into one list per
+// provider — enough for a fail-closed backstop, but blind to who is asking —
+// this keeps each policy's source groups beside its models so the router can
+// bound a listing to the calling groups.
+func TestBuildModelPolicies(t *testing.T) {
+	byID := map[string]*types.Guardrail{
+		"g-4o":       allowlistGuardrail("g-4o", "acc-1", "gpt-4o"),
+		"g-opus":     allowlistGuardrail("g-opus", "acc-1", "claude-opus-4"),
+		"g-disabled": {ID: "g-disabled", Checks: types.GuardrailChecks{ModelAllowlist: types.GuardrailModelAllowlist{Enabled: false, Models: []string{"gpt-4o"}}}},
+	}
+
+	t.Run("each policy keeps its own groups and models", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForGroups("p1", []string{"grp-eng"}, []string{"g-4o"}, "prov-x"),
+			policyForGroups("p2", []string{"grp-sales"}, []string{"g-opus"}, "prov-x"),
+		}
+		got := buildModelPolicies(policies, byID, nil)
+		assert.Equal(t, []routerModelPolicy{
+			{GroupIDs: []string{"grp-eng"}, Models: []string{"gpt-4o"}},
+			{GroupIDs: []string{"grp-sales"}, Models: []string{"claude-opus-4"}},
+		}, got["prov-x"],
+			"the two policies must stay separable so neither group is offered the other's models")
+	})
+
+	t.Run("an unrestricted policy carries nil models", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForGroups("p1", []string{"grp-eng"}, []string{"g-4o"}, "prov-x"),
+			policyForGroups("p2", []string{"grp-admin"}, nil, "prov-x"),
+		}
+		got := buildModelPolicies(policies, byID, nil)
+		assert.Nil(t, got["prov-x"][1].Models,
+			"no allowlist must reach the router as nil, which lifts the restriction for its groups")
+	})
+
+	t.Run("a disabled allowlist is not a restriction", func(t *testing.T) {
+		policies := []*types.Policy{policyForGroups("p1", []string{"grp-eng"}, []string{"g-disabled"}, "prov-x")}
+		got := buildModelPolicies(policies, byID, nil)
+		assert.Nil(t, got["prov-x"][0].Models,
+			"a guardrail with the allowlist check off restricts nothing")
+	})
+
+	t.Run("an enabled allowlist with no models permits nothing", func(t *testing.T) {
+		byIDEmpty := map[string]*types.Guardrail{
+			"g-empty": {ID: "g-empty", Checks: types.GuardrailChecks{ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true}}},
+		}
+		policies := []*types.Policy{policyForGroups("p1", []string{"grp-eng"}, []string{"g-empty"}, "prov-x")}
+		got := buildModelPolicies(policies, byIDEmpty, nil)
+		require.NotNil(t, got["prov-x"][0].Models,
+			"an empty allowlist must not arrive as nil — that would read as unrestricted")
+		assert.Empty(t, got["prov-x"][0].Models)
+	})
+
+	t.Run("a policy binding no groups is skipped", func(t *testing.T) {
+		policies := []*types.Policy{policyForGroups("p1", nil, []string{"g-4o"}, "prov-x")}
+		assert.Empty(t, buildModelPolicies(policies, byID, nil),
+			"a policy with no source groups authorises nobody, so it bounds nobody's listing")
+	})
+}
+
+// TestSynthesizedAllowlists_ExpandDeclaredIDsPerProvider proves the
+// synthesized allowlists carry the canonical form alongside a raw declared
+// entry — under the destination provider's own catalog id, never another's —
+// so the proxy-side compares (guardrail backstop, per-group router rules)
+// admit the allowlist however the operator wrote it, while a plain provider's
+// "-vN"- or "@"-suffixed entries stay verbatim and cannot widen.
+func TestSynthesizedAllowlists_ExpandDeclaredIDsPerProvider(t *testing.T) {
+	byID := map[string]*types.Guardrail{
+		"g-raw": allowlistGuardrail("g-raw", "acc-1",
+			"eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
+			"claude-sonnet-4-5@20250929",
+			"gpt-4o"),
+	}
+	catalogByProvider := map[string]string{
+		"prov-bedrock": "bedrock_api",
+		"prov-vertex":  "vertex_ai_api",
+		"prov-plain":   "openai_api",
+	}
+	policies := []*types.Policy{
+		policyForGroups("p1", []string{"grp-eng"}, []string{"g-raw"},
+			"prov-bedrock", "prov-vertex", "prov-plain"),
+	}
+
+	t.Run("guardrail backstop expands under each provider's own normalizer", func(t *testing.T) {
+		got := buildProviderAllowlists(policies, byID, catalogByProvider)
+		assert.ElementsMatch(t, []string{
+			"eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
+			"anthropic.claude-sonnet-4-5",
+			"claude-sonnet-4-5@20250929",
+			"gpt-4o",
+		}, got["prov-bedrock"],
+			"the Bedrock destination strips geography/version, but must not apply Vertex's @-strip")
+		assert.ElementsMatch(t, []string{
+			"eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
+			"claude-sonnet-4-5@20250929",
+			"claude-sonnet-4-5",
+			"gpt-4o",
+		}, got["prov-vertex"],
+			"the Vertex destination strips @version, but must not apply Bedrock's suffix strip")
+		assert.ElementsMatch(t, []string{
+			"eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
+			"claude-sonnet-4-5@20250929",
+			"gpt-4o",
+		}, got["prov-plain"],
+			"a body-routed provider keeps every entry verbatim — no alternate can widen it")
+	})
+
+	t.Run("router model rules expand the same way", func(t *testing.T) {
+		got := buildModelPolicies(policies, byID, catalogByProvider)
+		require.Len(t, got["prov-bedrock"], 1)
+		assert.Contains(t, got["prov-bedrock"][0].Models, "anthropic.claude-sonnet-4-5")
+		assert.NotContains(t, got["prov-bedrock"][0].Models, "claude-sonnet-4-5")
+		require.Len(t, got["prov-vertex"], 1)
+		assert.Contains(t, got["prov-vertex"][0].Models, "claude-sonnet-4-5")
+		assert.NotContains(t, got["prov-vertex"][0].Models, "anthropic.claude-sonnet-4-5")
+		require.Len(t, got["prov-plain"], 1)
+		assert.ElementsMatch(t, []string{
+			"eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
+			"claude-sonnet-4-5@20250929",
+			"gpt-4o",
+		}, got["prov-plain"][0].Models)
+	})
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer_realstore_test.go b/management/internals/modules/agentnetwork/synthesizer_realstore_test.go
index 1e07c0e81..33351fd7f 100644
--- a/management/internals/modules/agentnetwork/synthesizer_realstore_test.go
+++ b/management/internals/modules/agentnetwork/synthesizer_realstore_test.go
@@ -147,7 +147,7 @@ func TestReconcile_RealStore_PushesPrivateAfterStatusToggle(t *testing.T) {
 		store:           s,
 		accountManager:  noopAccountManager{},
 		proxyController: ctrl,
-		reconcileCache:  make(map[string]map[string]*proto.ProxyMapping),
+		reconcileCache:  make(map[string]map[string]syntheticMapping),
 	}
 
 	m.reconcile(ctx, testAccountID) // initial, provider enabled
diff --git a/management/internals/modules/agentnetwork/synthesizer_test.go b/management/internals/modules/agentnetwork/synthesizer_test.go
index 9d55bddf1..6aeafadbd 100644
--- a/management/internals/modules/agentnetwork/synthesizer_test.go
+++ b/management/internals/modules/agentnetwork/synthesizer_test.go
@@ -6,10 +6,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -19,28 +20,30 @@ import (
 const (
 	testAccountID = "acct-1"
 	testCluster   = "eu.proxy.netbird.io"
-	testSubdomain = "violet"
 	testEndpoint  = "violet.eu.proxy.netbird.io"
 )
 
 func newSynthTestSettings() *types.Settings {
 	return &types.Settings{
-		AccountID: testAccountID,
-		Cluster:   testCluster,
-		Subdomain: testSubdomain,
+		AccountID:    testAccountID,
+		Domain:       testEndpoint,
+		ProxyAddress: testCluster,
 	}
 }
 
 func newSynthTestProvider() *types.Provider {
 	return &types.Provider{
-		ID:                "prov-1",
-		AccountID:         testAccountID,
-		ProviderID:        "openai_api",
-		Name:              "OpenAI",
-		UpstreamURL:       "https://api.openai.com",
-		APIKey:            "sk-test-key",
-		Enabled:           true,
-		Models:            []types.ProviderModel{{ID: "gpt-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015}},
+		ID:          "prov-1",
+		AccountID:   testAccountID,
+		ProviderID:  "openai_api",
+		Name:        "OpenAI",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-test-key",
+		Enabled:     true,
+		// Prices deliberately differ from the catalog's gpt-5.4 rates
+		// (0.0025/0.015) so pricing tests can prove the operator's
+		// stored price overlays the catalog default.
+		Models:            []types.ProviderModel{{ID: "gpt-5.4", InputPer1k: 0.004, OutputPer1k: 0.02}},
 		SessionPrivateKey: "test-priv-key",
 		SessionPublicKey:  "test-pub-key",
 		CreatedAt:         time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
@@ -214,7 +217,27 @@ func TestSynthesizeServices_HappyPath(t *testing.T) {
 
 	assert.Equal(t, middlewareIDCostMeter, mws[6].ID, "seventh middleware is the cost meter")
 	assert.Equal(t, rpservice.MiddlewareSlotOnResponse, mws[6].Slot, "cost meter runs on_response")
-	assert.Equal(t, []byte("{}"), mws[6].ConfigJSON, "cost meter carries an explicit empty config")
+
+	var costCfg costMeterConfig
+	require.NoError(t, json.Unmarshal(mws[6].ConfigJSON, &costCfg), "cost meter config must unmarshal")
+	require.NotNil(t, costCfg.Pricing, "cost meter config must carry the pricing table — its absence tells the proxy management predates config-delivered pricing")
+
+	gpt4o, ok := costCfg.Pricing.Defaults["openai"]["gpt-4o"]
+	require.True(t, ok, "the full default table ships regardless of the account's providers")
+	assert.InDelta(t, 0.0025, gpt4o.InputPer1k, 1e-9, "default gpt-4o input rate comes from the catalog")
+
+	openaiPrices, ok := costCfg.Pricing.Providers[openai.ID]
+	require.True(t, ok, "operator-priced provider must have a per-record entry")
+	gpt54, ok := openaiPrices["gpt-5.4"]
+	require.True(t, ok, "operator's model row keys the per-record map")
+	assert.InDelta(t, 0.004, gpt54.InputPer1k, 1e-9, "operator input price overlays the catalog default (0.0025)")
+	assert.InDelta(t, 0.02, gpt54.OutputPer1k, 1e-9, "operator output price overlays the catalog default (0.015)")
+	assert.InDelta(t, 0.00025, gpt54.CachedInputPer1k, 1e-9, "cache rate the operator didn't state is inherited from the default entry")
+
+	opus, ok := costCfg.Pricing.Providers[anthropic.ID]["claude-opus-4-7"]
+	require.True(t, ok, "anthropic's model row keys its per-record map")
+	assert.Zero(t, opus.InputPer1k, "operator-stored zero prices ship verbatim — an explicit $0 model bills as free, it does not revert to list price")
+	assert.InDelta(t, 0.0005, opus.CacheReadPer1k, 1e-9, "cache rates still inherit from the default entry")
 
 	assert.Equal(t, middlewareIDLLMResponseParser, mws[7].ID, "eighth middleware is the response parser")
 	assert.Equal(t, rpservice.MiddlewareSlotOnResponse, mws[7].Slot, "response parser runs on_response")
@@ -474,6 +497,55 @@ func TestSynthesizeServices_IdentityInject_LiteLLM(t *testing.T) {
 	assert.Equal(t, "x-litellm-tags", entry.HeaderPair.TagsHeader)
 }
 
+func TestBuildIdentityInjectConfigJSON_Agentgateway(t *testing.T) {
+	provider := &types.Provider{
+		ID:         "prov-agentgateway",
+		ProviderID: "agentgateway",
+	}
+
+	raw, err := buildIdentityInjectConfigJSON(
+		[]*types.Provider{provider},
+		map[string][]string{provider.ID: []string{"grp-eng"}},
+	)
+	require.NoError(t, err)
+
+	var cfg identityInjectConfig
+	require.NoError(t, json.Unmarshal(raw, &cfg))
+	require.Len(t, cfg.Providers, 1)
+
+	rule := cfg.Providers[0]
+	assert.Equal(t, provider.ID, rule.ProviderID)
+	require.NotNil(t, rule.HeaderPair)
+	assert.Nil(t, rule.JSONMetadata)
+	assert.Equal(t, "x-netbird-user-id", rule.HeaderPair.EndUserIDHeader)
+	assert.Equal(t, "x-netbird-groups", rule.HeaderPair.TagsHeader)
+	assert.False(t, rule.HeaderPair.EndUserIDInBody)
+	assert.False(t, rule.HeaderPair.TagsInBody)
+}
+
+func TestBuildRouterConfigJSON_AgentgatewayVendors(t *testing.T) {
+	provider := &types.Provider{
+		ID:          "prov-agentgateway",
+		ProviderID:  "agentgateway",
+		UpstreamURL: "https://gateway.example.com",
+		APIKey:      "virtual-key",
+	}
+
+	raw, err := buildRouterConfigJSON(
+		[]*types.Provider{provider},
+		map[string][]string{provider.ID: {"grp-eng"}},
+		nil,
+	)
+	require.NoError(t, err)
+
+	var cfg routerConfig
+	require.NoError(t, json.Unmarshal(raw, &cfg))
+	require.Len(t, cfg.Providers, 1)
+	assert.Empty(t, cfg.Providers[0].Vendor,
+		"the singular vendor remains empty for a multi-surface gateway")
+	assert.Equal(t, []string{"openai", "anthropic"}, cfg.Providers[0].Vendors)
+}
+
 // TestSynthesizeServices_IdentityInject_Bifrost_OperatorOverrides
 // covers the customizable HeaderPair contract. The Bifrost catalog
 // entry sets HeaderPair.Customizable=true with x-bf-dim-* defaults
@@ -698,6 +770,94 @@ func TestSynthesizeServices_IdentityInject_Portkey_NotCustomizable(t *testing.T)
 		"same fixed-schema guarantee for the groups dimension")
 }
 
+// TestSynthesizeServices_IdentityInject_Bedrock pins Bedrock's cost-allocation
+// metadata: a JSONMetadata shape emitting X-Amzn-Bedrock-Request-Metadata with
+// the reserved user/group keys, sanitized to Bedrock's accepted charset.
+func TestSynthesizeServices_IdentityInject_Bedrock(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	br := newSynthTestProvider()
+	br.ID = "prov-bedrock"
+	br.ProviderID = "bedrock_api"
+	br.UpstreamURL = "https://bedrock-runtime.us-east-1.amazonaws.com"
+	br.APIKey = "bedrock-bearer"
+	br.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(br.ID, "grp-eng", "")
+	policy.ID = "pol-bedrock"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{br},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	var injectCfg identityInjectConfig
+	for _, m := range services[0].Targets[0].Options.Middlewares {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1)
+	entry := injectCfg.Providers[0]
+	require.NotNil(t, entry.JSONMetadata, "Bedrock uses the JSONMetadata shape for cost-allocation metadata")
+	assert.Nil(t, entry.HeaderPair, "shapes are mutually exclusive")
+	assert.Equal(t, "X-Amzn-Bedrock-Request-Metadata", entry.JSONMetadata.Header,
+		"the caller identity lands in Bedrock's cost-allocation metadata header")
+	assert.Equal(t, "user", entry.JSONMetadata.UserKey)
+	assert.Equal(t, "group", entry.JSONMetadata.GroupsKey)
+	assert.True(t, entry.JSONMetadata.Sanitize,
+		"Bedrock restricts the metadata value charset, so values must be sanitized")
+}
+
+// TestSynthesizeServices_MetadataDisabled_SuppressesInjection verifies the
+// per-provider opt-out: a provider with MetadataDisabled set emits no
+// identity-inject entry (Bedrock has no catalog ExtraHeaders, so the whole
+// entry is dropped).
+func TestSynthesizeServices_MetadataDisabled_SuppressesInjection(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	br := newSynthTestProvider()
+	br.ID = "prov-bedrock"
+	br.ProviderID = "bedrock_api"
+	br.UpstreamURL = "https://bedrock-runtime.us-east-1.amazonaws.com"
+	br.APIKey = "bedrock-bearer"
+	br.MetadataDisabled = true
+	br.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(br.ID, "grp-eng", "")
+	policy.ID = "pol-bedrock"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{br},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	var injectCfg identityInjectConfig
+	for _, m := range services[0].Targets[0].Options.Middlewares {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	assert.Empty(t, injectCfg.Providers,
+		"metadata_disabled must drop the provider's identity-inject entry")
+}
+
 // TestSynthesizeServices_IdentityInject_Vercel pins Vercel AI
 // Gateway's wiring: HeaderPair shape with fixed wire names dictated
 // by Vercel's Custom Reporting API (ai-reporting-user /
@@ -943,8 +1103,12 @@ func TestSynthesizeServices_GuardrailMerge_AllowlistUnion_LimitsRestrictive(t *t
 
 	var cfg guardrailConfig
 	require.NoError(t, json.Unmarshal(guardrailJSON, &cfg), "guardrail config must unmarshal cleanly")
-	assert.ElementsMatch(t, []string{"gpt-5.4-mini", "gpt-5.4-pro"}, cfg.ModelAllowlist,
-		"model allowlist union must keep both models")
+	// Both policies restrict the same provider, so the per-provider backstop
+	// carries the union of their models — a coarse gate that management's
+	// per-policy/group check narrows; it only blocks models outside the union
+	// when management is down.
+	assert.ElementsMatch(t, []string{"gpt-5.4-mini", "gpt-5.4-pro"}, cfg.ProviderAllowlists["prov-1"],
+		"per-provider allowlist union must keep both models")
 }
 
 func TestSynthesizeServices_BackfillsMissingSessionKeys(t *testing.T) {
@@ -1131,3 +1295,57 @@ func TestSynthesizeServices_EmptyAPIKey_FailsClosed(t *testing.T) {
 	require.Error(t, err, "synthesis must refuse a provider with no api key")
 	assert.Contains(t, err.Error(), "no api key", "error must surface the missing credential")
 }
+
+// TestDiscoveryHost pins which providers get a separate listing host. Getting
+// this wrong in either direction is costly: a missing host leaves Bedrock
+// discovery 404ing at AWS, and a host on the wrong provider would send that
+// provider's listing — and its credential — somewhere the operator never
+// configured.
+func TestDiscoveryHost(t *testing.T) {
+	entry := func(id string) catalog.Provider {
+		p, ok := catalog.Lookup(id)
+		require.True(t, ok, "catalog entry %s must exist", id)
+		return p
+	}
+
+	for _, tc := range []struct {
+		name     string
+		entry    catalog.Provider
+		upstream string
+		want     string
+	}{
+		{
+			// ListInferenceProfiles is a control-plane operation; the runtime
+			// host answers <UnknownOperationException/> for it.
+			name:  "bedrock splits the listing off the runtime host",
+			entry: entry("bedrock_api"), upstream: "https://bedrock-runtime.eu-central-1.amazonaws.com",
+			want: "bedrock.eu-central-1.amazonaws.com",
+		},
+		{
+			name:  "bedrock in another region",
+			entry: entry("bedrock_api"), upstream: "https://bedrock-runtime.us-west-2.amazonaws.com",
+			want: "bedrock.us-west-2.amazonaws.com",
+		},
+		{
+			// A proxied Bedrock endpoint may well serve both from one place,
+			// and there is no region to read back out of it.
+			name:  "proxied bedrock upstream yields no discovery host",
+			entry: entry("bedrock_api"), upstream: "https://bedrock.internal.example.com",
+			want: "",
+		},
+		{
+			name:  "openai serves its listing from the same host",
+			entry: entry("openai_api"), upstream: "https://api.openai.com",
+			want: "",
+		},
+		{
+			name:  "vertex serves its listing from the same host",
+			entry: entry("vertex_ai_api"), upstream: "https://us-east5-aiplatform.googleapis.com",
+			want: "",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, discoveryHost(tc.entry, tc.upstream))
+		})
+	}
+}
diff --git a/management/internals/modules/agentnetwork/types/accesslog.go b/management/internals/modules/agentnetwork/types/accesslog.go
index 92b8bc358..cde7be7de 100644
--- a/management/internals/modules/agentnetwork/types/accesslog.go
+++ b/management/internals/modules/agentnetwork/types/accesslog.go
@@ -41,8 +41,24 @@ type AgentNetworkAccessLog struct {
 	InputTokens        int64
 	OutputTokens       int64
 	TotalTokens        int64
-	CostUSD            float64
-	Stream             bool
+	// Prompt-cache buckets: read + write token counts.
+	CachedInputTokens   int64
+	CacheCreationTokens int64
+	// Per-bucket cost breakdown — one column per token bucket the provider
+	// bills separately. These four are the only cost state stored: the total
+	// and the cache portion are derived on read (TotalCostUSD / CacheCostUSD)
+	// rather than stored alongside, so a stored aggregate can never drift out
+	// of step with the components it summarises.
+	//
+	// default:0 matters on upgrade: these columns are ALTER TABLE ADD COLUMN
+	// on an existing table, and without it every historical row holds NULL —
+	// which a raw SUM()/scan into float64 can't read. The default backfills
+	// them as 0, so pre-upgrade rows report an unknown split, not an error.
+	InputCostUSD         float64 `gorm:"not null;default:0"`
+	CachedInputCostUSD   float64 `gorm:"not null;default:0"`
+	CacheCreationCostUSD float64 `gorm:"not null;default:0"`
+	OutputCostUSD        float64 `gorm:"not null;default:0"`
+	Stream               bool
 
 	// Prompt capture. Only populated when prompt collection is enabled
 	// (account master switch AND policy guardrail). Heavy free text.
@@ -60,19 +76,44 @@ type AgentNetworkAccessLog struct {
 // the reverse-proxy AccessLogEntry table.
 func (AgentNetworkAccessLog) TableName() string { return "agent_network_access_log" }
 
+// CostUSDSQLExpr is the SQL sum of the per-bucket cost columns — the total cost
+// of a row. Used wherever a query has to sort or aggregate on total cost now
+// that no cost_usd column is stored. Plain arithmetic over NOT NULL columns, so
+// it stays portable across SQLite and Postgres.
+const CostUSDSQLExpr = "(input_cost_usd + cached_input_cost_usd + cache_creation_cost_usd + output_cost_usd)"
+
+// TotalCostUSD is the request's total cost: the sum of the four per-bucket
+// costs. Derived rather than stored so it cannot disagree with the breakdown.
+func (a *AgentNetworkAccessLog) TotalCostUSD() float64 {
+	return a.InputCostUSD + a.CachedInputCostUSD + a.CacheCreationCostUSD + a.OutputCostUSD
+}
+
+// CacheCostUSD is the portion of the total billed for prompt-cache buckets:
+// cache reads plus cache writes.
+func (a *AgentNetworkAccessLog) CacheCostUSD() float64 {
+	return a.CachedInputCostUSD + a.CacheCreationCostUSD
+}
+
 // ToAPIResponse renders the flattened entry as the API representation.
 func (a *AgentNetworkAccessLog) ToAPIResponse() api.AgentNetworkAccessLog {
 	out := api.AgentNetworkAccessLog{
-		Id:           a.ID,
-		ServiceId:    a.ServiceID,
-		Timestamp:    a.Timestamp,
-		StatusCode:   a.StatusCode,
-		DurationMs:   int(a.Duration.Milliseconds()),
-		InputTokens:  a.InputTokens,
-		OutputTokens: a.OutputTokens,
-		TotalTokens:  a.TotalTokens,
-		CostUsd:      a.CostUSD,
-		Stream:       &a.Stream,
+		Id:                   a.ID,
+		ServiceId:            a.ServiceID,
+		Timestamp:            a.Timestamp,
+		StatusCode:           a.StatusCode,
+		DurationMs:           int(a.Duration.Milliseconds()),
+		InputTokens:          a.InputTokens,
+		OutputTokens:         a.OutputTokens,
+		TotalTokens:          a.TotalTokens,
+		CachedInputTokens:    a.CachedInputTokens,
+		CacheCreationTokens:  a.CacheCreationTokens,
+		InputCostUsd:         a.InputCostUSD,
+		CachedInputCostUsd:   a.CachedInputCostUSD,
+		CacheCreationCostUsd: a.CacheCreationCostUSD,
+		OutputCostUsd:        a.OutputCostUSD,
+		CostUsd:              a.TotalCostUSD(),
+		CacheCostUsd:         a.CacheCostUSD(),
+		Stream:               &a.Stream,
 	}
 
 	out.UserId = strPtr(a.UserID)
@@ -112,20 +153,36 @@ func strPtr(s string) *string {
 // summary plus its ordered entries. Assembled in Go from a page of entries — it
 // is not a stored table.
 type AgentNetworkAccessLogSession struct {
-	SessionID    string // empty for a session-less (singleton) request
-	UserID       string
-	GroupIDs     []string // union of the entries' authorising groups
-	StartedAt    time.Time
-	EndedAt      time.Time
-	RequestCount int
-	InputTokens  int64
-	OutputTokens int64
-	TotalTokens  int64
-	CostUSD      float64
-	Providers    []string // distinct vendors seen in the session
-	Models       []string // distinct models seen in the session
-	Decision     string   // "deny" if any entry was denied, else "allow"
-	Entries      []*AgentNetworkAccessLog
+	SessionID            string // empty for a session-less (singleton) request
+	UserID               string
+	GroupIDs             []string // union of the entries' authorising groups
+	StartedAt            time.Time
+	EndedAt              time.Time
+	RequestCount         int
+	InputTokens          int64
+	OutputTokens         int64
+	TotalTokens          int64
+	CachedInputTokens    int64
+	CacheCreationTokens  int64
+	InputCostUSD         float64
+	CachedInputCostUSD   float64
+	CacheCreationCostUSD float64
+	OutputCostUSD        float64
+	Providers            []string // distinct vendors seen in the session
+	Models               []string // distinct models seen in the session
+	Decision             string   // "deny" if any entry was denied, else "allow"
+	Entries              []*AgentNetworkAccessLog
+}
+
+// TotalCostUSD is the session's total cost: the sum of the four per-bucket
+// costs accumulated across its entries.
+func (sess *AgentNetworkAccessLogSession) TotalCostUSD() float64 {
+	return sess.InputCostUSD + sess.CachedInputCostUSD + sess.CacheCreationCostUSD + sess.OutputCostUSD
+}
+
+// CacheCostUSD is the session's prompt-cache spend: cache reads plus writes.
+func (sess *AgentNetworkAccessLogSession) CacheCostUSD() float64 {
+	return sess.CachedInputCostUSD + sess.CacheCreationCostUSD
 }
 
 // sessionKey is the grouping key for an entry: its session id, or — when the
@@ -205,7 +262,12 @@ func (sess *AgentNetworkAccessLogSession) foldEntry(sk *sessionSeen, e *AgentNet
 	sess.InputTokens += e.InputTokens
 	sess.OutputTokens += e.OutputTokens
 	sess.TotalTokens += e.TotalTokens
-	sess.CostUSD += e.CostUSD
+	sess.CachedInputTokens += e.CachedInputTokens
+	sess.CacheCreationTokens += e.CacheCreationTokens
+	sess.InputCostUSD += e.InputCostUSD
+	sess.CachedInputCostUSD += e.CachedInputCostUSD
+	sess.CacheCreationCostUSD += e.CacheCreationCostUSD
+	sess.OutputCostUSD += e.OutputCostUSD
 	if e.Timestamp.Before(sess.StartedAt) {
 		sess.StartedAt = e.Timestamp
 	}
@@ -248,15 +310,22 @@ func (sess *AgentNetworkAccessLogSession) ToAPIResponse() api.AgentNetworkAccess
 	}
 
 	out := api.AgentNetworkAccessLogSession{
-		StartedAt:    sess.StartedAt,
-		EndedAt:      sess.EndedAt,
-		RequestCount: sess.RequestCount,
-		InputTokens:  sess.InputTokens,
-		OutputTokens: sess.OutputTokens,
-		TotalTokens:  sess.TotalTokens,
-		CostUsd:      sess.CostUSD,
-		Decision:     sess.Decision,
-		Entries:      entries,
+		StartedAt:            sess.StartedAt,
+		EndedAt:              sess.EndedAt,
+		RequestCount:         sess.RequestCount,
+		InputTokens:          sess.InputTokens,
+		OutputTokens:         sess.OutputTokens,
+		TotalTokens:          sess.TotalTokens,
+		CachedInputTokens:    sess.CachedInputTokens,
+		CacheCreationTokens:  sess.CacheCreationTokens,
+		InputCostUsd:         sess.InputCostUSD,
+		CachedInputCostUsd:   sess.CachedInputCostUSD,
+		CacheCreationCostUsd: sess.CacheCreationCostUSD,
+		OutputCostUsd:        sess.OutputCostUSD,
+		CostUsd:              sess.TotalCostUSD(),
+		CacheCostUsd:         sess.CacheCostUSD(),
+		Decision:             sess.Decision,
+		Entries:              entries,
 	}
 	out.SessionId = strPtr(sess.SessionID)
 	out.UserId = strPtr(sess.UserID)
diff --git a/management/internals/modules/agentnetwork/types/accesslogfilter.go b/management/internals/modules/agentnetwork/types/accesslogfilter.go
index d571a87b6..d35516ffa 100644
--- a/management/internals/modules/agentnetwork/types/accesslogfilter.go
+++ b/management/internals/modules/agentnetwork/types/accesslogfilter.go
@@ -54,7 +54,7 @@ var accessLogSortFields = map[string]string{
 	"provider":     "provider",
 	"status_code":  "status_code",
 	"duration":     "duration",
-	"cost_usd":     "cost_usd",
+	"cost_usd":     CostUSDSQLExpr,
 	"total_tokens": "total_tokens",
 	"user_id":      "user_id",
 	"decision":     "decision",
@@ -70,7 +70,7 @@ var accessLogSortFields = map[string]string{
 var sessionSortExprs = map[string]string{ //nolint:gosec // G101 false positive: "total_tokens" sort key, not a credential
 	"timestamp":     "MAX(timestamp)",
 	"started_at":    "MIN(timestamp)",
-	"cost_usd":      "SUM(cost_usd)",
+	"cost_usd":      "SUM" + CostUSDSQLExpr,
 	"total_tokens":  "SUM(total_tokens)",
 	"duration":      "SUM(duration)",
 	"request_count": "COUNT(*)",
diff --git a/management/internals/modules/agentnetwork/types/agent_config.go b/management/internals/modules/agentnetwork/types/agent_config.go
new file mode 100644
index 000000000..a154efed3
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/agent_config.go
@@ -0,0 +1,42 @@
+package types
+
+// AgentConfig is the caller-scoped answer to "what may this caller
+// use on the Agent Network?" — the account's proxy endpoint plus the
+// providers and models the caller's groups authorize. It intentionally
+// carries display metadata only: no keys, no upstream URLs, no policy or
+// guardrail structure, and no hint of providers the caller cannot reach.
+type AgentConfig struct {
+	// Configured is false only when the account has no Agent Network set
+	// up. A caller no policy covers yet still reads as configured, with an
+	// empty Providers list: every member gets the same connection config,
+	// and the empty list is what tells them to ask for access.
+	Configured bool
+	// Endpoint is the account's proxy base URL
+	// ("https://<subdomain>.<cluster>"), reachable over the NetBird tunnel
+	// only. Empty when Configured is false. Handing it to a member the
+	// policies do not cover authorizes nothing on its own — the proxy
+	// still refuses every request no policy permits.
+	Endpoint string
+	// Providers lists the providers at least one applicable policy
+	// authorizes for the caller, in the account's created_at order.
+	Providers []AgentConfigProvider
+}
+
+// AgentConfigProvider is one authorized provider in an AgentConfig.
+type AgentConfigProvider struct {
+	// Name is the operator-assigned label, e.g. "Bedrock prod".
+	Name string
+	// CatalogID names the catalog entry, e.g. "anthropic_api".
+	CatalogID string
+	// APIFlavor is the request-body shape the provider speaks — the
+	// catalog entry's parser id ("anthropic", "openai"); empty when the
+	// proxy dispatches the provider by URL path instead.
+	APIFlavor string
+	// AllModelsAllowed is true when no model allowlist restricts this
+	// provider for the caller. Models then lists the declared/catalog
+	// models as a courtesy (possibly none for gateway-style providers).
+	AllModelsAllowed bool
+	// Models is the effective model allowlist for the caller, or the
+	// declared/catalog models when AllModelsAllowed is true.
+	Models []string
+}
diff --git a/management/internals/modules/agentnetwork/types/cost_test.go b/management/internals/modules/agentnetwork/types/cost_test.go
new file mode 100644
index 000000000..9194ef4a3
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/cost_test.go
@@ -0,0 +1,124 @@
+package types
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// costRow builds an access-log entry carrying only a cost breakdown — the rest
+// of the row is irrelevant to the summation identities under test.
+func costRow(id, session string, ts time.Time, in, cachedIn, cacheCreate, out float64) *AgentNetworkAccessLog {
+	return &AgentNetworkAccessLog{
+		ID:                   id,
+		SessionID:            session,
+		Timestamp:            ts,
+		InputCostUSD:         in,
+		CachedInputCostUSD:   cachedIn,
+		CacheCreationCostUSD: cacheCreate,
+		OutputCostUSD:        out,
+	}
+}
+
+// TestAPIResponse_CostComponentsSumToAggregates is the contract a client adding
+// up an API response depends on: within a single rendered object, the four
+// per-bucket fields sum to cost_usd, and the two cache fields sum to
+// cache_cost_usd. Uses rates that are not exactly representable in binary
+// floating point, so the identity is checked against real arithmetic rather
+// than round numbers.
+func TestAPIResponse_CostComponentsSumToAggregates(t *testing.T) {
+	row := costRow("r1", "s1", time.Now(), 0.000768, 0.0002304, 0.00192, 0.003)
+
+	api := row.ToAPIResponse()
+	assert.InDelta(t, api.InputCostUsd+api.CachedInputCostUsd+api.CacheCreationCostUsd+api.OutputCostUsd,
+		api.CostUsd, 1e-12, "rendered buckets must sum to the rendered cost_usd")
+	assert.InDelta(t, api.CachedInputCostUsd+api.CacheCreationCostUsd, api.CacheCostUsd, 1e-12,
+		"rendered cache buckets must sum to the rendered cache_cost_usd")
+	assert.InDelta(t, 0.0059184, api.CostUsd, 1e-12, "total is the exact sum, not a separately rounded figure")
+	assert.InDelta(t, 0.0021504, api.CacheCostUsd, 1e-12, "cache cost is the exact sum of the two cache buckets")
+}
+
+// TestSessionSummary_SumsMatchSummedEntries proves a session summary equals the
+// sum of the entries it renders: a client that adds up the entries itself must
+// land on the same number the summary reports, per bucket and in total.
+func TestSessionSummary_SumsMatchSummedEntries(t *testing.T) {
+	base := time.Date(2026, 5, 5, 10, 0, 0, 0, time.UTC)
+	entries := []*AgentNetworkAccessLog{
+		costRow("r1", "s1", base, 0.000768, 0.0002304, 0.00192, 0.003),
+		costRow("r2", "s1", base.Add(time.Minute), 0.000625, 0.0009375, 0, 0.005),
+		costRow("r3", "s1", base.Add(2*time.Minute), 0.0000016, 0, 0, 0.0000032),
+	}
+
+	sessions := FoldAccessLogSessions([]string{"s1"}, entries)
+	require.Len(t, sessions, 1)
+	sess := sessions[0].ToAPIResponse()
+
+	var wantInput, wantCachedInput, wantCacheCreation, wantOutput float64
+	for _, e := range entries {
+		wantInput += e.InputCostUSD
+		wantCachedInput += e.CachedInputCostUSD
+		wantCacheCreation += e.CacheCreationCostUSD
+		wantOutput += e.OutputCostUSD
+	}
+
+	assert.InDelta(t, wantInput, sess.InputCostUsd, 1e-12, "session input cost is the sum of its entries")
+	assert.InDelta(t, wantCachedInput, sess.CachedInputCostUsd, 1e-12, "session cache-read cost is the sum of its entries")
+	assert.InDelta(t, wantCacheCreation, sess.CacheCreationCostUsd, 1e-12, "session cache-write cost is the sum of its entries")
+	assert.InDelta(t, wantOutput, sess.OutputCostUsd, 1e-12, "session output cost is the sum of its entries")
+	assert.InDelta(t, wantInput+wantCachedInput+wantCacheCreation+wantOutput, sess.CostUsd, 1e-12,
+		"session total equals the summed entry buckets")
+
+	// Summing the rendered entries must give the same answer as reading the
+	// summary — the property a UI relies on when it totals a table itself.
+	var fromEntries float64
+	for _, e := range sess.Entries {
+		fromEntries += e.CostUsd
+	}
+	assert.InDelta(t, sess.CostUsd, fromEntries, 1e-12, "summary total must match the summed rendered entries")
+
+	// The sub-microdollar row must still contribute; it would vanish under
+	// 6-decimal quantisation.
+	assert.Greater(t, sess.InputCostUsd, 0.001393, "small-cost rows must not be quantised away")
+}
+
+// TestUsageBuckets_SumsMatchSummedRows proves the same identity one level up:
+// a usage bucket equals the sum of the ledger rows folded into it, and the
+// buckets together equal the whole range.
+func TestUsageBuckets_SumsMatchSummedRows(t *testing.T) {
+	day1 := time.Date(2026, 5, 5, 9, 0, 0, 0, time.UTC)
+	day2 := time.Date(2026, 5, 6, 9, 0, 0, 0, time.UTC)
+	rows := []*AgentNetworkUsage{
+		{ID: "u1", Timestamp: day1, InputCostUSD: 0.000768, CachedInputCostUSD: 0.0002304, CacheCreationCostUSD: 0.00192, OutputCostUSD: 0.003},
+		{ID: "u2", Timestamp: day1.Add(time.Hour), InputCostUSD: 0.000625, CachedInputCostUSD: 0.0009375, OutputCostUSD: 0.005},
+		{ID: "u3", Timestamp: day2, InputCostUSD: 0.0000016, OutputCostUSD: 0.0000032},
+	}
+
+	buckets := AggregateUsageByGranularity(rows, UsageGranularityDay)
+	require.Len(t, buckets, 2, "two distinct days expected")
+
+	var total, cache float64
+	for _, b := range buckets {
+		api := b.ToAPIResponse()
+		assert.InDelta(t, api.InputCostUsd+api.CachedInputCostUsd+api.CacheCreationCostUsd+api.OutputCostUsd,
+			api.CostUsd, 1e-12, "each bucket's components must sum to its cost_usd")
+		total += api.CostUsd
+		cache += api.CacheCostUsd
+	}
+
+	var wantTotal, wantCache float64
+	for _, r := range rows {
+		wantTotal += r.TotalCostUSD()
+		wantCache += r.CacheCostUSD()
+	}
+	assert.InDelta(t, wantTotal, total, 1e-12, "buckets must sum to the total across all ledger rows")
+	assert.InDelta(t, wantCache, cache, 1e-12, "buckets must sum to the cache spend across all ledger rows")
+
+	// A month bucket over the same rows must total identically — regrouping
+	// changes the partition, never the sum.
+	monthly := AggregateUsageByGranularity(rows, UsageGranularityMonth)
+	require.Len(t, monthly, 1)
+	assert.InDelta(t, wantTotal, monthly[0].ToAPIResponse().CostUsd, 1e-12,
+		"re-bucketing at a different granularity must preserve the total")
+}
diff --git a/management/internals/modules/agentnetwork/types/provider.go b/management/internals/modules/agentnetwork/types/provider.go
index 2e3195481..145c63791 100644
--- a/management/internals/modules/agentnetwork/types/provider.go
+++ b/management/internals/modules/agentnetwork/types/provider.go
@@ -14,10 +14,24 @@ import (
 // ProviderModel is one row in the provider's models list. The operator
 // pins the per-1k input/output price for cost tracking; ID is the
 // model identifier the upstream provider expects on the wire.
+//
+// The three cache rates are pointers because absence is meaningful: nil
+// means "inherit NetBird's default rate for this model" (folded in at
+// synthesis time), while an explicit 0 means "no discount — bill this
+// cache bucket at the input rate".
 type ProviderModel struct {
 	ID          string  `json:"id"`
 	InputPer1k  float64 `json:"input_per_1k"`
 	OutputPer1k float64 `json:"output_per_1k"`
+	// CachedInputPer1k is the OpenAI-shape rate for cached prompt tokens
+	// (a subset of input tokens).
+	CachedInputPer1k *float64 `json:"cached_input_per_1k,omitempty"`
+	// CacheReadPer1k is the Anthropic-shape rate for cache-read tokens
+	// (additive to input tokens).
+	CacheReadPer1k *float64 `json:"cache_read_per_1k,omitempty"`
+	// CacheCreationPer1k is the Anthropic-shape rate for cache-creation
+	// tokens (additive to input tokens).
+	CacheCreationPer1k *float64 `json:"cache_creation_per_1k,omitempty"`
 }
 
 // Provider is an Agent Network AI provider record persisted per account.
@@ -51,6 +65,12 @@ type Provider struct {
 	// private or self-signed certificate. The synthesiser propagates it into
 	// the router route so the proxy dials that provider's upstream insecurely.
 	SkipTLSVerification bool `gorm:"column:skip_tls_verification"`
+	// MetadataDisabled suppresses identity metadata injection for this provider.
+	// Metadata (the caller's user + authorizing group) is injected by default;
+	// when true the synthesiser omits the provider's identity-inject shape, so no
+	// user/group headers (e.g. Bedrock's X-Amzn-Bedrock-Request-Metadata) are
+	// stamped. Catalog ExtraHeaders (routing config) are unaffected.
+	MetadataDisabled bool `gorm:"column:metadata_disabled"`
 	// SessionPrivateKey + SessionPublicKey are the ed25519 keypair the
 	// synthesised reverse-proxy service uses to sign / verify session
 	// JWTs after a successful OIDC handshake. Generated once on
@@ -122,9 +142,12 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 	if req.Models != nil {
 		for _, m := range *req.Models {
 			p.Models = append(p.Models, ProviderModel{
-				ID:          m.Id,
-				InputPer1k:  m.InputPer1k,
-				OutputPer1k: m.OutputPer1k,
+				ID:                 m.Id,
+				InputPer1k:         m.InputPer1k,
+				OutputPer1k:        m.OutputPer1k,
+				CachedInputPer1k:   copyFloatPtr(m.CachedInputPer1k),
+				CacheReadPer1k:     copyFloatPtr(m.CacheReadPer1k),
+				CacheCreationPer1k: copyFloatPtr(m.CacheCreationPer1k),
 			})
 		}
 	}
@@ -137,10 +160,11 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 	if req.SkipTlsVerification != nil {
 		p.SkipTLSVerification = *req.SkipTlsVerification
 	}
+	if req.MetadataDisabled != nil {
+		p.MetadataDisabled = *req.MetadataDisabled
+	}
 	// Identity-header overrides for catalogs flagged Customizable.
-	// nil pointer = "field omitted on the wire" → leave the stored
-	// value untouched (per the openapi description). Empty string is
-	// an explicit clear that disables stamping for this dimension.
+	// Empty or omitted disables stamping for this dimension.
 	if req.IdentityHeaderUserId != nil {
 		p.IdentityHeaderUserID = strings.TrimSpace(*req.IdentityHeaderUserId)
 	}
@@ -151,27 +175,55 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 
 // ToAPIResponse renders the provider as the API representation. The API
 // key is intentionally never surfaced.
+// RedactedForViewer returns a copy with the connection configuration
+// blanked: upstream URL, operator-typed extra header values, identity
+// header names, the TLS-verification override, and (defence in depth —
+// they never reach the wire anyway) the sealed credentials. Read-only
+// viewers such as usage_viewer only need the display surface — id,
+// catalog id, name, enabled state, and the model list the usage filters
+// resolve against — so their responses carry nothing about how the
+// operator connects to the vendor.
+func (p *Provider) RedactedForViewer() *Provider {
+	c := *p
+	c.UpstreamURL = ""
+	c.APIKey = ""
+	c.ExtraValues = nil
+	c.IdentityHeaderUserID = ""
+	c.IdentityHeaderGroups = ""
+	c.SkipTLSVerification = false
+	c.SessionPrivateKey = ""
+	return &c
+}
+
 func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	models := make([]api.AgentNetworkProviderModel, 0, len(p.Models))
 	for _, m := range p.Models {
 		models = append(models, api.AgentNetworkProviderModel{
-			Id:          m.ID,
-			InputPer1k:  m.InputPer1k,
-			OutputPer1k: m.OutputPer1k,
+			Id:                 m.ID,
+			InputPer1k:         m.InputPer1k,
+			OutputPer1k:        m.OutputPer1k,
+			CachedInputPer1k:   copyFloatPtr(m.CachedInputPer1k),
+			CacheReadPer1k:     copyFloatPtr(m.CacheReadPer1k),
+			CacheCreationPer1k: copyFloatPtr(m.CacheCreationPer1k),
 		})
 	}
 	created := p.CreatedAt
 	updated := p.UpdatedAt
 	resp := &api.AgentNetworkProvider{
-		Id:                  p.ID,
-		ProviderId:          p.ProviderID,
-		Name:                p.Name,
-		UpstreamUrl:         p.UpstreamURL,
-		Models:              models,
-		Enabled:             p.Enabled,
-		SkipTlsVerification: p.SkipTLSVerification,
-		CreatedAt:           &created,
-		UpdatedAt:           &updated,
+		Id:          p.ID,
+		ProviderId:  p.ProviderID,
+		Name:        p.Name,
+		UpstreamUrl: p.UpstreamURL,
+		Models:      models,
+		// Always present on the wire so an explicitly cleared header
+		// round-trips as "" instead of vanishing from the response.
+		IdentityHeaderUserId: p.IdentityHeaderUserID,
+		IdentityHeaderGroups: p.IdentityHeaderGroups,
+		Enabled:              p.Enabled,
+		SkipTlsVerification:  p.SkipTLSVerification,
+		MetadataDisabled:     p.MetadataDisabled,
+		CreatedAt:            &created,
+		UpdatedAt:            &updated,
 	}
 	if len(p.ExtraValues) > 0 {
 		out := make(map[string]string, len(p.ExtraValues))
@@ -180,22 +232,30 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 		}
 		resp.ExtraValues = &out
 	}
-	if p.IdentityHeaderUserID != "" {
-		v := p.IdentityHeaderUserID
-		resp.IdentityHeaderUserId = &v
-	}
-	if p.IdentityHeaderGroups != "" {
-		v := p.IdentityHeaderGroups
-		resp.IdentityHeaderGroups = &v
-	}
 	return resp
 }
 
+// copyFloatPtr returns a fresh pointer to the same value, or nil. Keeps
+// stored models and API payloads from aliasing each other's rate fields.
+func copyFloatPtr(v *float64) *float64 {
+	if v == nil {
+		return nil
+	}
+	out := *v
+	return &out
+}
+
 // Copy returns a deep copy of the provider.
 func (p *Provider) Copy() *Provider {
 	clone := *p
 	if p.Models != nil {
-		clone.Models = append([]ProviderModel(nil), p.Models...)
+		clone.Models = make([]ProviderModel, len(p.Models))
+		for i, m := range p.Models {
+			m.CachedInputPer1k = copyFloatPtr(m.CachedInputPer1k)
+			m.CacheReadPer1k = copyFloatPtr(m.CacheReadPer1k)
+			m.CacheCreationPer1k = copyFloatPtr(m.CacheCreationPer1k)
+			clone.Models[i] = m
+		}
 	}
 	if p.ExtraValues != nil {
 		clone.ExtraValues = make(map[string]string, len(p.ExtraValues))
diff --git a/management/internals/modules/agentnetwork/types/provider_test.go b/management/internals/modules/agentnetwork/types/provider_test.go
index 1195499e7..fd553ece2 100644
--- a/management/internals/modules/agentnetwork/types/provider_test.go
+++ b/management/internals/modules/agentnetwork/types/provider_test.go
@@ -42,3 +42,76 @@ func TestProvider_SkipTLSVerification_RoundTrip(t *testing.T) {
 	assert.False(t, p.SkipTLSVerification, "explicit false must clear skip_tls_verification")
 	assert.False(t, p.ToAPIResponse().SkipTlsVerification, "response must reflect the cleared value")
 }
+
+// TestProvider_MetadataDisabled_RoundTrip covers the request→provider→response
+// mapping of metadata_disabled, with the same update semantics: nil preserves,
+// explicit false clears.
+func TestProvider_MetadataDisabled_RoundTrip(t *testing.T) {
+	enable := true
+	disable := false
+
+	base := func() *api.AgentNetworkProviderRequest {
+		return &api.AgentNetworkProviderRequest{
+			ProviderId:  "bedrock_api",
+			Name:        "bedrock",
+			UpstreamUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
+		}
+	}
+
+	p := NewProvider("acc-1")
+
+	req := base()
+	req.MetadataDisabled = &enable
+	p.FromAPIRequest(req)
+	assert.True(t, p.MetadataDisabled, "create with metadata_disabled=true must set the field")
+	assert.True(t, p.ToAPIResponse().MetadataDisabled, "response must surface metadata_disabled")
+
+	// Omitting the field on update leaves the stored value untouched.
+	p.FromAPIRequest(base())
+	assert.True(t, p.MetadataDisabled, "omitting metadata_disabled on update must preserve it")
+
+	// Explicit false clears it (re-enables metadata).
+	req = base()
+	req.MetadataDisabled = &disable
+	p.FromAPIRequest(req)
+	assert.False(t, p.MetadataDisabled, "explicit false must clear metadata_disabled")
+	assert.False(t, p.ToAPIResponse().MetadataDisabled, "response must reflect the cleared value")
+}
+
+// TestProvider_IdentityHeaders_AlwaysOnWire pins that the identity header
+// fields are always present in the API response — an explicitly cleared
+// ("") header must round-trip as "" rather than vanish, so API consumers
+// (e.g. the Terraform provider) never observe a value other than the one
+// they wrote.
+func TestProvider_IdentityHeaders_AlwaysOnWire(t *testing.T) {
+	set := "x-bf-dim-netbird_user_id"
+	empty := ""
+
+	base := func() *api.AgentNetworkProviderRequest {
+		return &api.AgentNetworkProviderRequest{
+			ProviderId:  "custom",
+			Name:        "bifrost",
+			UpstreamUrl: "https://bifrost.internal",
+		}
+	}
+
+	p := NewProvider("acc-1")
+	resp := p.ToAPIResponse()
+	assert.Equal(t, "", resp.IdentityHeaderUserId, "unset header must surface as empty string, not be omitted")
+	assert.Equal(t, "", resp.IdentityHeaderGroups, "unset header must surface as empty string, not be omitted")
+
+	req := base()
+	req.IdentityHeaderUserId = &set
+	p.FromAPIRequest(req)
+	assert.Equal(t, set, p.ToAPIResponse().IdentityHeaderUserId, "configured header must round-trip")
+
+	// Omitting the field preserves it.
+	p.FromAPIRequest(base())
+	assert.Equal(t, set, p.ToAPIResponse().IdentityHeaderUserId, "omitted header must preserve the stored value")
+
+	// An explicit "" clears it AND stays visible on the wire.
+	req = base()
+	req.IdentityHeaderUserId = &empty
+	p.FromAPIRequest(req)
+	assert.Equal(t, "", p.ToAPIResponse().IdentityHeaderUserId, "cleared header must round-trip as empty string")
+}
diff --git a/management/internals/modules/agentnetwork/types/settings.go b/management/internals/modules/agentnetwork/types/settings.go
index d61d9deff..70ecc5f70 100644
--- a/management/internals/modules/agentnetwork/types/settings.go
+++ b/management/internals/modules/agentnetwork/types/settings.go
@@ -1,6 +1,8 @@
 package types
 
 import (
+	"fmt"
+	"strings"
 	"time"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -11,13 +13,23 @@ import (
 // the long-term aggregate and are retained independently.
 const DefaultAccessLogRetentionDays = 30
 
-// Settings is the per-account agent-network configuration row. One
-// row per account. Cluster + Subdomain are immutable once written and
-// produce the public endpoint agents call (`<subdomain>.<cluster>`).
+// Settings is the per-account agent-network configuration row. One row per
+// account. Domain and ProxyAddress are assigned at bootstrap and immutable
+// thereafter; a persisted row is always fully allocated — there is no "row
+// exists, endpoint pending" state.
 type Settings struct {
 	AccountID string `gorm:"primaryKey"`
-	Cluster   string
-	Subdomain string `gorm:"index:idx_agent_network_settings_cluster_subdomain"`
+
+	// Domain is the gateway endpoint hostname agents call. Globally unique
+	// across accounts. Sized explicitly because MySQL cannot index an
+	// unbounded TEXT column; 255 covers the RFC 1035 253-octet bound.
+	Domain string `gorm:"type:varchar(255);uniqueIndex:idx_agent_network_settings_domain"`
+
+	// ProxyAddress is the declared cluster address of the proxy serving this
+	// account's gateway. Either equal to Domain — a proxy dedicated to this
+	// account, declaring the tenant's own hostname — or Domain's immediate
+	// parent, with the endpoint one label beneath it on a shared cluster.
+	ProxyAddress string `gorm:"type:varchar(255);index:idx_agent_network_settings_proxy_address"`
 
 	// Account-level collection controls sourced by the synthesizer.
 	// EnableLogCollection gates the per-request access-log trail and defaults
@@ -42,37 +54,139 @@ type Settings struct {
 // schema cohesive.
 func (Settings) TableName() string { return "agent_network_settings" }
 
-// Endpoint returns the bare hostname agents reach this account at:
-// `<subdomain>.<cluster>`.
-func (s *Settings) Endpoint() string {
-	return s.Subdomain + "." + s.Cluster
+// DefaultSettings returns the settings an account observes before its row is
+// bootstrapped: log collection on with the default retention, everything else
+// off, and no domain or proxy address assigned yet. Bootstrap persists exactly
+// these values plus the assigned domain and proxy address, so the
+// pre-bootstrap read and the freshly bootstrapped row agree.
+func DefaultSettings(accountID string) *Settings {
+	return &Settings{
+		AccountID:              accountID,
+		EnableLogCollection:    true,
+		AccessLogRetentionDays: DefaultAccessLogRetentionDays,
+	}
 }
 
-// ToAPIResponse renders the settings as the API representation.
+// Endpoint returns the bare hostname agents reach this account at — the
+// Domain column. Empty until the row is bootstrapped.
+func (s *Settings) Endpoint() string { return s.Domain }
+
+// Dedicated reports whether the account's gateway is served by a proxy
+// dedicated to it — the self-addressed shape, where the serving proxy declares
+// the endpoint hostname itself. The alternative (labeled) shape has the
+// endpoint one label beneath a shared cluster's address.
+func (s *Settings) Dedicated() bool { return s.Domain != "" && s.Domain == s.ProxyAddress }
+
+// ToAPIResponse renders the settings as the API representation. The
+// timestamps are omitted while zero — a default (not yet bootstrapped) view
+// has no persisted row to date.
 func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
-	created := s.CreatedAt
-	updated := s.UpdatedAt
 	retention := s.AccessLogRetentionDays
-	return &api.AgentNetworkSettings{
-		Cluster:                s.Cluster,
-		Subdomain:              s.Subdomain,
+	resp := &api.AgentNetworkSettings{
 		Endpoint:               s.Endpoint(),
+		ProxyAddress:           s.ProxyAddress,
+		Dedicated:              s.Dedicated(),
 		EnableLogCollection:    s.EnableLogCollection,
 		EnablePromptCollection: s.EnablePromptCollection,
 		RedactPii:              s.RedactPii,
 		AccessLogRetentionDays: &retention,
-		CreatedAt:              &created,
-		UpdatedAt:              &updated,
 	}
+	if !s.CreatedAt.IsZero() {
+		created := s.CreatedAt
+		resp.CreatedAt = &created
+	}
+	if !s.UpdatedAt.IsZero() {
+		updated := s.UpdatedAt
+		resp.UpdatedAt = &updated
+	}
+	return resp
 }
 
-// FromAPIRequest applies the mutable settings fields from the request. Cluster
-// and Subdomain are immutable and intentionally not touched here.
+// FromAPIRequest applies the update request onto the receiver: every mutable
+// field is replaced with the request value, and the identity fields (Domain,
+// ProxyAddress) carry the request's echo of the assigned values. The identity
+// fields are never written to the stored row — UpdateSettings compares them
+// against it and rejects the request when they differ, so PUT keeps the
+// house convention of requiring every field while the endpoint and proxy
+// address stay immutable.
+//
+// Every field is required by the schema, so none is presence-sensitive.
+// AccessLogRetentionDays in particular must stay required: the caller receives
+// a zero-valued Settings, and UpdateSettings copies each field onto the stored
+// row unconditionally, so an omitted value would be written as 0 — which the
+// API documents as "keep indefinitely". Making retention optional would
+// therefore let a client silently maximise log retention by leaving it out.
 func (s *Settings) FromAPIRequest(req *api.AgentNetworkSettingsRequest) {
+	s.Domain = req.Endpoint
+	s.ProxyAddress = req.ProxyAddress
 	s.EnableLogCollection = req.EnableLogCollection
 	s.EnablePromptCollection = req.EnablePromptCollection
 	s.RedactPii = req.RedactPii
+	s.AccessLogRetentionDays = req.AccessLogRetentionDays
+}
+
+// FromAPICreateRequest applies the optional collection toggles of a bootstrap
+// request onto the receiver (typically DefaultSettings), leaving defaults in
+// place for omitted fields. The identity fields are resolved by the manager
+// from the request's proxy_address / endpoint, not copied here.
+func (s *Settings) FromAPICreateRequest(req *api.AgentNetworkSettingsCreateRequest) {
+	if req.EnableLogCollection != nil {
+		s.EnableLogCollection = *req.EnableLogCollection
+	}
+	if req.EnablePromptCollection != nil {
+		s.EnablePromptCollection = *req.EnablePromptCollection
+	}
+	if req.RedactPii != nil {
+		s.RedactPii = *req.RedactPii
+	}
 	if req.AccessLogRetentionDays != nil {
 		s.AccessLogRetentionDays = *req.AccessLogRetentionDays
 	}
 }
+
+// maxHostnameLength is the RFC 1035 bound on a full domain name.
+const maxHostnameLength = 253
+
+// NormalizeHostname lowercases and trims a caller-supplied hostname and
+// validates its shape: non-empty DNS labels of letters, digits and inner
+// hyphens, joined by single dots, within length bounds. Shapes that
+// canonicalization cannot repair — leading/trailing dots, empty labels,
+// whitespace inside the name — are rejected rather than guessed at, because
+// the value lands in an immutable column.
+func NormalizeHostname(raw string) (string, error) {
+	hostname := strings.ToLower(strings.TrimSpace(raw))
+	if hostname == "" {
+		return "", fmt.Errorf("hostname is empty")
+	}
+	if len(hostname) > maxHostnameLength {
+		return "", fmt.Errorf("hostname exceeds %d characters", maxHostnameLength)
+	}
+	for _, label := range strings.Split(hostname, ".") {
+		if err := validateHostnameLabel(label); err != nil {
+			return "", fmt.Errorf("invalid hostname %q: %w", hostname, err)
+		}
+	}
+	return hostname, nil
+}
+
+func validateHostnameLabel(label string) error {
+	if label == "" {
+		return fmt.Errorf("empty label (leading, trailing or doubled dot)")
+	}
+	if len(label) > 63 {
+		return fmt.Errorf("label %q exceeds 63 characters", label)
+	}
+	if label[0] == '-' || label[len(label)-1] == '-' {
+		return fmt.Errorf("label %q must not start or end with a hyphen", label)
+	}
+	for _, r := range label {
+		switch {
+		case r >= 'a' && r <= 'z':
+		case r >= '0' && r <= '9':
+		case r == '-':
+		default:
+			return fmt.Errorf("label %q contains invalid character %q", label, r)
+		}
+	}
+	return nil
+}
diff --git a/management/internals/modules/agentnetwork/types/usage.go b/management/internals/modules/agentnetwork/types/usage.go
index dd01d4300..658fa8e59 100644
--- a/management/internals/modules/agentnetwork/types/usage.go
+++ b/management/internals/modules/agentnetwork/types/usage.go
@@ -25,8 +25,19 @@ type AgentNetworkUsage struct {
 	InputTokens        int64
 	OutputTokens       int64
 	TotalTokens        int64
-	CostUSD            float64
-	CreatedAt          time.Time
+	// Prompt-cache buckets: read + write token counts.
+	CachedInputTokens   int64
+	CacheCreationTokens int64
+	// Per-bucket cost breakdown, mirroring AgentNetworkAccessLog — the only
+	// cost state stored; total and cache portion are derived on read. Kept on
+	// the usage ledger too so spend can be attributed per bucket even for
+	// accounts with log collection turned off. See AgentNetworkAccessLog for
+	// why the columns carry a zero default.
+	InputCostUSD         float64 `gorm:"not null;default:0"`
+	CachedInputCostUSD   float64 `gorm:"not null;default:0"`
+	CacheCreationCostUSD float64 `gorm:"not null;default:0"`
+	OutputCostUSD        float64 `gorm:"not null;default:0"`
+	CreatedAt            time.Time
 }
 
 // TableName keeps usage records in their own stripped table. Named
@@ -34,6 +45,17 @@ type AgentNetworkUsage struct {
 // agent_network_usage table in a shared database.
 func (AgentNetworkUsage) TableName() string { return "agent_network_request_usage" }
 
+// TotalCostUSD is the request's total cost: the sum of the four per-bucket
+// costs. Derived rather than stored so it cannot disagree with the breakdown.
+func (u *AgentNetworkUsage) TotalCostUSD() float64 {
+	return u.InputCostUSD + u.CachedInputCostUSD + u.CacheCreationCostUSD + u.OutputCostUSD
+}
+
+// CacheCostUSD is the portion of the total billed for prompt-cache buckets.
+func (u *AgentNetworkUsage) CacheCostUSD() float64 {
+	return u.CachedInputCostUSD + u.CacheCreationCostUSD
+}
+
 // AgentNetworkUsageGroup is the normalised many-to-many row linking a usage
 // record to one authorising group, mirroring AgentNetworkAccessLogGroup so the
 // usage overview can filter by group with a `group_id IN (...)` join.
diff --git a/management/internals/modules/agentnetwork/types/usageoverview.go b/management/internals/modules/agentnetwork/types/usageoverview.go
index 658832bec..81e02c6b8 100644
--- a/management/internals/modules/agentnetwork/types/usageoverview.go
+++ b/management/internals/modules/agentnetwork/types/usageoverview.go
@@ -33,21 +33,45 @@ func ParseUsageGranularity(s string) UsageGranularity {
 // AgentNetworkUsageBucket is one aggregated usage time bucket. PeriodStart is
 // the UTC start of the bucket as YYYY-MM-DD.
 type AgentNetworkUsageBucket struct {
-	PeriodStart  string
-	InputTokens  int64
-	OutputTokens int64
-	TotalTokens  int64
-	CostUSD      float64
+	PeriodStart          string
+	InputTokens          int64
+	OutputTokens         int64
+	TotalTokens          int64
+	CachedInputTokens    int64
+	CacheCreationTokens  int64
+	InputCostUSD         float64
+	CachedInputCostUSD   float64
+	CacheCreationCostUSD float64
+	OutputCostUSD        float64
+}
+
+// TotalCostUSD is the bucket's total spend: the sum of the four per-bucket
+// costs. Derived rather than accumulated separately so it cannot disagree with
+// the components.
+func (b *AgentNetworkUsageBucket) TotalCostUSD() float64 {
+	return b.InputCostUSD + b.CachedInputCostUSD + b.CacheCreationCostUSD + b.OutputCostUSD
+}
+
+// CacheCostUSD is the bucket's prompt-cache spend: cache reads plus writes.
+func (b *AgentNetworkUsageBucket) CacheCostUSD() float64 {
+	return b.CachedInputCostUSD + b.CacheCreationCostUSD
 }
 
 // ToAPIResponse renders the bucket as the API representation.
 func (b *AgentNetworkUsageBucket) ToAPIResponse() api.AgentNetworkUsageBucket {
 	return api.AgentNetworkUsageBucket{
-		PeriodStart:  b.PeriodStart,
-		InputTokens:  b.InputTokens,
-		OutputTokens: b.OutputTokens,
-		TotalTokens:  b.TotalTokens,
-		CostUsd:      b.CostUSD,
+		PeriodStart:          b.PeriodStart,
+		InputTokens:          b.InputTokens,
+		OutputTokens:         b.OutputTokens,
+		TotalTokens:          b.TotalTokens,
+		CachedInputTokens:    b.CachedInputTokens,
+		CacheCreationTokens:  b.CacheCreationTokens,
+		InputCostUsd:         b.InputCostUSD,
+		CachedInputCostUsd:   b.CachedInputCostUSD,
+		CacheCreationCostUsd: b.CacheCreationCostUSD,
+		OutputCostUsd:        b.OutputCostUSD,
+		CostUsd:              b.TotalCostUSD(),
+		CacheCostUsd:         b.CacheCostUSD(),
 	}
 }
 
@@ -84,7 +108,12 @@ func AggregateUsageByGranularity(rows []*AgentNetworkUsage, g UsageGranularity)
 		b.InputTokens += r.InputTokens
 		b.OutputTokens += r.OutputTokens
 		b.TotalTokens += r.TotalTokens
-		b.CostUSD += r.CostUSD
+		b.CachedInputTokens += r.CachedInputTokens
+		b.CacheCreationTokens += r.CacheCreationTokens
+		b.InputCostUSD += r.InputCostUSD
+		b.CachedInputCostUSD += r.CachedInputCostUSD
+		b.CacheCreationCostUSD += r.CacheCreationCostUSD
+		b.OutputCostUSD += r.OutputCostUSD
 	}
 
 	out := make([]*AgentNetworkUsageBucket, 0, len(byPeriod))
diff --git a/management/internals/modules/agentnetwork/wire_shape_test.go b/management/internals/modules/agentnetwork/wire_shape_test.go
index b574ab3e1..c8877731e 100644
--- a/management/internals/modules/agentnetwork/wire_shape_test.go
+++ b/management/internals/modules/agentnetwork/wire_shape_test.go
@@ -5,7 +5,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -103,6 +103,12 @@ func TestSynthesizedService_WireShape(t *testing.T) {
 
 	assert.Equal(t, middlewareIDCostMeter, mws[6].GetId(), "seventh middleware id")
 	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[6].GetSlot(), "cost meter slot")
+	var costCfg costMeterConfig
+	require.NoError(t, json.Unmarshal(mws[6].GetConfigJson(), &costCfg), "cost meter config JSON must decode from the wire")
+	require.NotNil(t, costCfg.Pricing, "the pricing table must travel on the wire — the proxy has no embedded price list to fall back to")
+	assert.NotEmpty(t, costCfg.Pricing.Defaults["openai"], "default table rides in every mapping")
+	assert.NotEmpty(t, costCfg.Pricing.Defaults["anthropic"], "default table covers all surfaces")
+	assert.NotEmpty(t, costCfg.Pricing.Defaults["bedrock"], "default table covers all surfaces")
 
 	assert.Equal(t, middlewareIDLLMResponseParser, mws[7].GetId(), "eighth middleware id")
 	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[7].GetSlot(), "response parser slot")
diff --git a/management/internals/modules/peers/ephemeral/manager/ephemeral.go b/management/internals/modules/peers/ephemeral/manager/ephemeral.go
index 0f902ea70..7867d6579 100644
--- a/management/internals/modules/peers/ephemeral/manager/ephemeral.go
+++ b/management/internals/modules/peers/ephemeral/manager/ephemeral.go
@@ -215,7 +215,7 @@ func (e *EphemeralManager) cleanup(ctx context.Context) {
 	}
 
 	for accountID, peerIDs := range peerIDsPerAccount {
-		log.WithContext(ctx).Tracef("cleanup: deleting %d ephemeral peers for account %s", len(peerIDs), accountID)
+		log.WithContext(ctx).Debugf("cleanup: deleting %d ephemeral peers for account %s: %s", len(peerIDs), accountID, peerIDs)
 		err := e.peersManager.DeletePeers(ctx, accountID, peerIDs, activity.SystemInitiator, true)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to delete ephemeral peers: %s", err)
diff --git a/management/internals/modules/peers/ephemeral/manager/ephemeral_test.go b/management/internals/modules/peers/ephemeral/manager/ephemeral_test.go
index 314e84501..1b64c447a 100644
--- a/management/internals/modules/peers/ephemeral/manager/ephemeral_test.go
+++ b/management/internals/modules/peers/ephemeral/manager/ephemeral_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 
diff --git a/management/internals/modules/peers/manager.go b/management/internals/modules/peers/manager.go
index 239d6b09c..6f9705efe 100644
--- a/management/internals/modules/peers/manager.go
+++ b/management/internals/modules/peers/manager.go
@@ -1,6 +1,6 @@
 package peers
 
-//go:generate go run github.com/golang/mock/mockgen -package peers -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
+//go:generate go tool mockgen -package peers -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
 
 import (
 	"context"
@@ -28,8 +28,8 @@ import (
 type Manager interface {
 	GetPeer(ctx context.Context, accountID, userID, peerID string) (*peer.Peer, error)
 	GetPeerAccountID(ctx context.Context, peerID string) (string, error)
-	GetAllPeers(ctx context.Context, accountID, userID string) ([]*peer.Peer, error)
 	GetPeersByGroupIDs(ctx context.Context, accountID string, groupsIDs []string) ([]*peer.Peer, error)
+	GetPeersPaginated(ctx context.Context, accountID, userID string, pagination store.PaginationState, filters store.PeerFilters, sorting store.PeerSorting) ([]*peer.Peer, int, error)
 	DeletePeers(ctx context.Context, accountID string, peerIDs []string, userID string, checkConnected bool) error
 	SetNetworkMapController(networkMapController network_map.Controller)
 	SetIntegratedPeerValidator(integratedPeerValidator integrated_validator.IntegratedValidator)
@@ -51,8 +51,7 @@ type managerImpl struct {
 	permissionsManager      permissions.Manager
 	integratedPeerValidator integrated_validator.IntegratedValidator
 	accountManager          account.Manager
-
-	networkMapController network_map.Controller
+	networkMapController    network_map.Controller
 }
 
 func NewManager(store store.Store, permissionsManager permissions.Manager) Manager {
@@ -87,19 +86,6 @@ func (m *managerImpl) GetPeer(ctx context.Context, accountID, userID, peerID str
 	return m.store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peerID)
 }
 
-func (m *managerImpl) GetAllPeers(ctx context.Context, accountID, userID string) ([]*peer.Peer, error) {
-	allowed, ctx, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Peers, operations.Read)
-	if err != nil {
-		return nil, fmt.Errorf("failed to validate user permissions: %w", err)
-	}
-
-	if !allowed {
-		return m.store.GetUserPeers(ctx, store.LockingStrengthNone, accountID, userID)
-	}
-
-	return m.store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
-}
-
 func (m *managerImpl) GetPeerAccountID(ctx context.Context, peerID string) (string, error) {
 	return m.store.GetAccountIDByPeerID(ctx, store.LockingStrengthNone, peerID)
 }
@@ -108,6 +94,35 @@ func (m *managerImpl) GetPeersByGroupIDs(ctx context.Context, accountID string,
 	return m.store.GetPeersByGroupIDs(ctx, accountID, groupsIDs)
 }
 
+func (m *managerImpl) GetPeersPaginated(ctx context.Context, accountID, userID string, pagination store.PaginationState, filters store.PeerFilters, sorting store.PeerSorting) ([]*peer.Peer, int, error) {
+	user, err := m.store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	allowed, ctx, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Peers, operations.Read)
+	if err != nil {
+		return nil, 0, status.NewPermissionValidationError(err)
+	}
+
+	if allowed {
+		return m.store.GetAccountPeersPaginated(ctx, store.LockingStrengthNone, accountID, pagination, filters, sorting)
+	}
+
+	settings, err := m.store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, 0, fmt.Errorf("failed to get account settings: %w", err)
+	}
+
+	if user.IsRestrictable() && settings.RegularUsersViewBlocked {
+		return []*peer.Peer{}, 0, nil
+	}
+
+	peers, err := m.store.GetUserPeers(ctx, store.LockingStrengthNone, accountID, userID)
+
+	return peers, len(peers), err
+}
+
 // GetPeerByTunnelIP delegates to the store's indexed lookup.
 func (m *managerImpl) GetPeerByTunnelIP(ctx context.Context, accountID string, ip net.IP) (*peer.Peer, error) {
 	return m.store.GetPeerByIP(ctx, store.LockingStrengthNone, accountID, ip)
@@ -184,6 +199,8 @@ func (m *managerImpl) DeletePeers(ctx context.Context, accountID string, peerIDs
 				return err
 			}
 
+			log.WithContext(ctx).Debugf("DeletePeers: deleted peer %s", peerID)
+
 			if !(peer.ProxyMeta.Embedded || peer.Meta.KernelVersion == "wasm") {
 				eventsToStore = append(eventsToStore, func() {
 					m.accountManager.StoreEvent(ctx, userID, peer.ID, accountID, activity.PeerRemovedByUser, peer.EventMeta(dnsDomain))
@@ -224,30 +241,6 @@ func (m *managerImpl) CreateProxyPeer(ctx context.Context, accountID string, pee
 		return nil
 	}
 
-	// Dedupe stale embedded peer records for the same (account, cluster).
-	// The proxy generates a fresh WireGuard keypair on every startup
-	// (proxy/internal/roundtrip/netbird.go), so without this sweep the
-	// prior embedded peer would linger forever — holding its CGNAT IP
-	// allocation, polluting other peers' rosters, and (most visibly)
-	// leaving the synth DNS pointing at the dead address. The
-	// (account, cluster) tuple identifies "the embedded peer for this
-	// proxy instance at this cluster"; any record matching that tuple
-	// with a different pubkey is by definition stale and must go.
-	staleIDs, err := m.findStaleEmbeddedProxyPeers(ctx, accountID, cluster, peerKey)
-	if err != nil {
-		return fmt.Errorf("scan for stale embedded proxy peers: %w", err)
-	}
-	if len(staleIDs) > 0 {
-		// userID="" + checkConnected=false: the deletion is initiated
-		// by management itself on behalf of the freshly-registering
-		// proxy, not by an end user; the stale peer may still be
-		// marked Connected from its prior session, but its session is
-		// dead by definition (its key no longer exists).
-		if err := m.DeletePeers(ctx, accountID, staleIDs, "", false); err != nil {
-			return fmt.Errorf("delete stale embedded proxy peers %v: %w", staleIDs, err)
-		}
-	}
-
 	name := fmt.Sprintf("proxy-%s", xid.New().String())
 	newPeer := &peer.Peer{
 		Ephemeral: true,
@@ -273,29 +266,3 @@ func (m *managerImpl) CreateProxyPeer(ctx context.Context, accountID string, pee
 
 	return nil
 }
-
-// findStaleEmbeddedProxyPeers returns the peer IDs of embedded proxy peer
-// records in accountID that target the same cluster but carry a different
-// WireGuard pubkey than the freshly-registering one. Used by CreateProxyPeer
-// to garbage-collect stale records left behind when the proxy restarts with a
-// regenerated keypair.
-func (m *managerImpl) findStaleEmbeddedProxyPeers(ctx context.Context, accountID, cluster, newKey string) ([]string, error) {
-	account, err := m.store.GetAccount(ctx, accountID)
-	if err != nil {
-		return nil, err
-	}
-	var stale []string
-	for _, p := range account.Peers {
-		if p == nil || !p.ProxyMeta.Embedded {
-			continue
-		}
-		if p.ProxyMeta.Cluster != cluster {
-			continue
-		}
-		if p.Key == newKey {
-			continue
-		}
-		stale = append(stale, p.ID)
-	}
-	return stale, nil
-}
diff --git a/management/internals/modules/peers/manager_mock.go b/management/internals/modules/peers/manager_mock.go
index 3836ac909..ee97ba308 100644
--- a/management/internals/modules/peers/manager_mock.go
+++ b/management/internals/modules/peers/manager_mock.go
@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: ./manager.go
+//
+// Generated by this command:
+//
+//	mockgen -package peers -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
+//
 
 // Package peers is a generated GoMock package.
 package peers
@@ -9,18 +14,20 @@ import (
 	net "net"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
 	network_map "github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	account "github.com/netbirdio/netbird/management/server/account"
 	integrated_validator "github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
 	peer "github.com/netbirdio/netbird/management/server/peer"
+	store "github.com/netbirdio/netbird/management/server/store"
 	types "github.com/netbirdio/netbird/management/server/types"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockManager is a mock of Manager interface.
 type MockManager struct {
 	ctrl     *gomock.Controller
 	recorder *MockManagerMockRecorder
+	isgomock struct{}
 }
 
 // MockManagerMockRecorder is the mock recorder for MockManager.
@@ -49,7 +56,7 @@ func (m *MockManager) CreateProxyPeer(ctx context.Context, accountID, peerKey, c
 }
 
 // CreateProxyPeer indicates an expected call of CreateProxyPeer.
-func (mr *MockManagerMockRecorder) CreateProxyPeer(ctx, accountID, peerKey, cluster interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateProxyPeer(ctx, accountID, peerKey, cluster any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateProxyPeer", reflect.TypeOf((*MockManager)(nil).CreateProxyPeer), ctx, accountID, peerKey, cluster)
 }
@@ -63,26 +70,11 @@ func (m *MockManager) DeletePeers(ctx context.Context, accountID string, peerIDs
 }
 
 // DeletePeers indicates an expected call of DeletePeers.
-func (mr *MockManagerMockRecorder) DeletePeers(ctx, accountID, peerIDs, userID, checkConnected interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeletePeers(ctx, accountID, peerIDs, userID, checkConnected any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePeers", reflect.TypeOf((*MockManager)(nil).DeletePeers), ctx, accountID, peerIDs, userID, checkConnected)
 }
 
-// GetAllPeers mocks base method.
-func (m *MockManager) GetAllPeers(ctx context.Context, accountID, userID string) ([]*peer.Peer, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAllPeers", ctx, accountID, userID)
-	ret0, _ := ret[0].([]*peer.Peer)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAllPeers indicates an expected call of GetAllPeers.
-func (mr *MockManagerMockRecorder) GetAllPeers(ctx, accountID, userID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllPeers", reflect.TypeOf((*MockManager)(nil).GetAllPeers), ctx, accountID, userID)
-}
-
 // GetPeer mocks base method.
 func (m *MockManager) GetPeer(ctx context.Context, accountID, userID, peerID string) (*peer.Peer, error) {
 	m.ctrl.T.Helper()
@@ -93,7 +85,7 @@ func (m *MockManager) GetPeer(ctx context.Context, accountID, userID, peerID str
 }
 
 // GetPeer indicates an expected call of GetPeer.
-func (mr *MockManagerMockRecorder) GetPeer(ctx, accountID, userID, peerID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeer(ctx, accountID, userID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeer", reflect.TypeOf((*MockManager)(nil).GetPeer), ctx, accountID, userID, peerID)
 }
@@ -108,7 +100,7 @@ func (m *MockManager) GetPeerAccountID(ctx context.Context, peerID string) (stri
 }
 
 // GetPeerAccountID indicates an expected call of GetPeerAccountID.
-func (mr *MockManagerMockRecorder) GetPeerAccountID(ctx, peerID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeerAccountID(ctx, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerAccountID", reflect.TypeOf((*MockManager)(nil).GetPeerAccountID), ctx, peerID)
 }
@@ -123,7 +115,7 @@ func (m *MockManager) GetPeerByTunnelIP(ctx context.Context, accountID string, i
 }
 
 // GetPeerByTunnelIP indicates an expected call of GetPeerByTunnelIP.
-func (mr *MockManagerMockRecorder) GetPeerByTunnelIP(ctx, accountID, ip interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeerByTunnelIP(ctx, accountID, ip any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerByTunnelIP", reflect.TypeOf((*MockManager)(nil).GetPeerByTunnelIP), ctx, accountID, ip)
 }
@@ -138,7 +130,7 @@ func (m *MockManager) GetPeerID(ctx context.Context, peerKey string) (string, er
 }
 
 // GetPeerID indicates an expected call of GetPeerID.
-func (mr *MockManagerMockRecorder) GetPeerID(ctx, peerKey interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeerID(ctx, peerKey any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerID", reflect.TypeOf((*MockManager)(nil).GetPeerID), ctx, peerKey)
 }
@@ -154,7 +146,7 @@ func (m *MockManager) GetPeerWithGroups(ctx context.Context, accountID, peerID s
 }
 
 // GetPeerWithGroups indicates an expected call of GetPeerWithGroups.
-func (mr *MockManagerMockRecorder) GetPeerWithGroups(ctx, accountID, peerID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeerWithGroups(ctx, accountID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerWithGroups", reflect.TypeOf((*MockManager)(nil).GetPeerWithGroups), ctx, accountID, peerID)
 }
@@ -169,11 +161,27 @@ func (m *MockManager) GetPeersByGroupIDs(ctx context.Context, accountID string,
 }
 
 // GetPeersByGroupIDs indicates an expected call of GetPeersByGroupIDs.
-func (mr *MockManagerMockRecorder) GetPeersByGroupIDs(ctx, accountID, groupsIDs interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeersByGroupIDs(ctx, accountID, groupsIDs any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeersByGroupIDs", reflect.TypeOf((*MockManager)(nil).GetPeersByGroupIDs), ctx, accountID, groupsIDs)
 }
 
+// GetPeersPaginated mocks base method.
+func (m *MockManager) GetPeersPaginated(ctx context.Context, accountID, userID string, pagination store.PaginationState, filters store.PeerFilters, sorting store.PeerSorting) ([]*peer.Peer, int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetPeersPaginated", ctx, accountID, userID, pagination, filters, sorting)
+	ret0, _ := ret[0].([]*peer.Peer)
+	ret1, _ := ret[1].(int)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetPeersPaginated indicates an expected call of GetPeersPaginated.
+func (mr *MockManagerMockRecorder) GetPeersPaginated(ctx, accountID, userID, pagination, filters, sorting any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeersPaginated", reflect.TypeOf((*MockManager)(nil).GetPeersPaginated), ctx, accountID, userID, pagination, filters, sorting)
+}
+
 // SetAccountManager mocks base method.
 func (m *MockManager) SetAccountManager(accountManager account.Manager) {
 	m.ctrl.T.Helper()
@@ -181,7 +189,7 @@ func (m *MockManager) SetAccountManager(accountManager account.Manager) {
 }
 
 // SetAccountManager indicates an expected call of SetAccountManager.
-func (mr *MockManagerMockRecorder) SetAccountManager(accountManager interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SetAccountManager(accountManager any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetAccountManager", reflect.TypeOf((*MockManager)(nil).SetAccountManager), accountManager)
 }
@@ -193,7 +201,7 @@ func (m *MockManager) SetIntegratedPeerValidator(integratedPeerValidator integra
 }
 
 // SetIntegratedPeerValidator indicates an expected call of SetIntegratedPeerValidator.
-func (mr *MockManagerMockRecorder) SetIntegratedPeerValidator(integratedPeerValidator interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SetIntegratedPeerValidator(integratedPeerValidator any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetIntegratedPeerValidator", reflect.TypeOf((*MockManager)(nil).SetIntegratedPeerValidator), integratedPeerValidator)
 }
@@ -205,7 +213,7 @@ func (m *MockManager) SetNetworkMapController(networkMapController network_map.C
 }
 
 // SetNetworkMapController indicates an expected call of SetNetworkMapController.
-func (mr *MockManagerMockRecorder) SetNetworkMapController(networkMapController interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SetNetworkMapController(networkMapController any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetNetworkMapController", reflect.TypeOf((*MockManager)(nil).SetNetworkMapController), networkMapController)
 }
diff --git a/management/internals/modules/peers/manager_test.go b/management/internals/modules/peers/manager_test.go
new file mode 100644
index 000000000..2645276b7
--- /dev/null
+++ b/management/internals/modules/peers/manager_test.go
@@ -0,0 +1,197 @@
+package peers
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/stretchr/testify/assert"
+
+	"go.uber.org/mock/gomock"
+)
+
+func TestManager_GetPeersPaginated_HappyPath(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	// GetUserByUserID
+	// GetAccountPeersPaginated
+	// GetAccountSettings
+	// GetUserPeers
+	mockStore := store.NewMockStore(ctrl)
+	// ValidateUserPermissions
+	permissionsManager := permissions.NewMockManager(ctrl)
+
+	m := NewManager(mockStore, permissionsManager)
+
+	mockStore.EXPECT().GetUserByUserID(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-user")).Times(1).
+		Return(&types.User{
+			Id: "test-user",
+		}, nil)
+	permissionsManager.EXPECT().ValidateUserPermissions(gomock.Any(), gomock.Eq("test-account"), gomock.Eq("test-user"), gomock.Eq(modules.Peers), gomock.Eq(operations.Read)).Times(1).
+		Return(true, context.Background(), nil)
+	mockStore.EXPECT().GetAccountPeersPaginated(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-account"),
+		gomock.Eq(store.PaginationState{Page: 11, PageSize: 111}), gomock.Eq(store.PeerFilters{UserId: "test-user"}),
+		gomock.Eq(store.PeerSorting{Fields: []store.PeerSortingKey{{Field: store.PeerSortByName, Order: store.DescOrderBy}}})).Times(1).
+		Return([]*peer.Peer{{ID: "test-peer"}}, 10, nil)
+
+	peers, total, err := m.GetPeersPaginated(context.Background(), "test-account", "test-user",
+		store.PaginationState{Page: 11, PageSize: 111}, store.PeerFilters{UserId: "test-user"},
+		store.PeerSorting{Fields: []store.PeerSortingKey{{Field: store.PeerSortByName, Order: store.DescOrderBy}}})
+
+	assert.Equal(t, []*peer.Peer{{ID: "test-peer"}}, peers)
+	assert.Equal(t, 10, total)
+	assert.NoError(t, err)
+}
+
+func TestManager_GetPeersPaginated_GetUserWithError(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockStore := store.NewMockStore(ctrl)
+	permissionsManager := permissions.NewMockManager(ctrl)
+
+	m := NewManager(mockStore, permissionsManager)
+
+	mockStore.EXPECT().GetUserByUserID(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-user")).Times(1).
+		Return(nil, fmt.Errorf("boom!"))
+
+	_, total, err := m.GetPeersPaginated(context.Background(), "test-account", "test-user",
+		store.PaginationState{Page: 11, PageSize: 111}, store.PeerFilters{UserId: "test-user"},
+		store.PeerSorting{Fields: []store.PeerSortingKey{{Field: store.PeerSortByName, Order: store.DescOrderBy}}})
+
+	assert.Equal(t, 0, total)
+	assert.ErrorContains(t, err, "boom!")
+}
+
+func TestManager_GetPeersPaginated_NoPermission(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockStore := store.NewMockStore(ctrl)
+	permissionsManager := permissions.NewMockManager(ctrl)
+
+	m := NewManager(mockStore, permissionsManager)
+
+	mockStore.EXPECT().GetUserByUserID(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-user")).Times(1).
+		Return(&types.User{
+			Id: "test-user",
+		}, nil)
+	permissionsManager.EXPECT().ValidateUserPermissions(gomock.Any(), gomock.Eq("test-account"), gomock.Eq("test-user"), gomock.Eq(modules.Peers), gomock.Eq(operations.Read)).Times(1).
+		Return(false, context.Background(), nil)
+	mockStore.EXPECT().GetAccountSettings(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-account")).Times(1).
+		Return(&types.Settings{RegularUsersViewBlocked: false}, nil)
+	mockStore.EXPECT().GetUserPeers(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-account"), gomock.Eq("test-user")).Times(1).
+		Return([]*peer.Peer{{ID: "test-peer"}}, nil)
+
+	peers, total, err := m.GetPeersPaginated(context.Background(), "test-account", "test-user",
+		store.PaginationState{Page: 11, PageSize: 111}, store.PeerFilters{UserId: "test-user"},
+		store.PeerSorting{Fields: []store.PeerSortingKey{{Field: store.PeerSortByName, Order: store.DescOrderBy}}})
+
+	assert.Equal(t, []*peer.Peer{{ID: "test-peer"}}, peers)
+	assert.Equal(t, 1, total)
+	assert.NoError(t, err)
+}
+
+func TestManager_GetPeersPaginated_NoPermission_GetUserPeers_WithError(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockStore := store.NewMockStore(ctrl)
+	permissionsManager := permissions.NewMockManager(ctrl)
+
+	m := NewManager(mockStore, permissionsManager)
+
+	mockStore.EXPECT().GetUserByUserID(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-user")).Times(1).
+		Return(&types.User{
+			Id: "test-user",
+		}, nil)
+	permissionsManager.EXPECT().ValidateUserPermissions(gomock.Any(), gomock.Eq("test-account"), gomock.Eq("test-user"), gomock.Eq(modules.Peers), gomock.Eq(operations.Read)).Times(1).
+		Return(false, context.Background(), nil)
+	mockStore.EXPECT().GetAccountSettings(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-account")).Times(1).
+		Return(&types.Settings{RegularUsersViewBlocked: false}, nil)
+	mockStore.EXPECT().GetUserPeers(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-account"), gomock.Eq("test-user")).Times(1).
+		Return(nil, fmt.Errorf("boom!"))
+
+	_, total, err := m.GetPeersPaginated(context.Background(), "test-account", "test-user",
+		store.PaginationState{Page: 11, PageSize: 111}, store.PeerFilters{UserId: "test-user"},
+		store.PeerSorting{Fields: []store.PeerSortingKey{{Field: store.PeerSortByName, Order: store.DescOrderBy}}})
+
+	assert.Equal(t, 0, total)
+	assert.ErrorContains(t, err, "boom!")
+}
+
+func TestManager_GetPeersPaginated_GetAccountSettings_WithError(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockStore := store.NewMockStore(ctrl)
+	permissionsManager := permissions.NewMockManager(ctrl)
+
+	m := NewManager(mockStore, permissionsManager)
+
+	mockStore.EXPECT().GetUserByUserID(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-user")).Times(1).
+		Return(&types.User{
+			Id: "test-user",
+		}, nil)
+	permissionsManager.EXPECT().ValidateUserPermissions(gomock.Any(), gomock.Eq("test-account"), gomock.Eq("test-user"), gomock.Eq(modules.Peers), gomock.Eq(operations.Read)).Times(1).
+		Return(false, context.Background(), nil)
+	mockStore.EXPECT().GetAccountSettings(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-account")).Times(1).
+		Return(nil, fmt.Errorf("boom!"))
+
+	_, total, err := m.GetPeersPaginated(context.Background(), "test-account", "test-user",
+		store.PaginationState{Page: 11, PageSize: 111}, store.PeerFilters{UserId: "test-user"},
+		store.PeerSorting{Fields: []store.PeerSortingKey{{Field: store.PeerSortByName, Order: store.DescOrderBy}}})
+
+	assert.Equal(t, 0, total)
+	assert.ErrorContains(t, err, "boom!")
+}
+func TestManager_GetPeersPaginated_NoPermission_User_IsRestrictable_ViewUnblocked(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockStore := store.NewMockStore(ctrl)
+	permissionsManager := permissions.NewMockManager(ctrl)
+
+	m := NewManager(mockStore, permissionsManager)
+
+	mockStore.EXPECT().GetUserByUserID(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-user")).Times(1).
+		Return(&types.User{
+			Id:   "test-user",
+			Role: types.UserRoleUser,
+		}, nil)
+	permissionsManager.EXPECT().ValidateUserPermissions(gomock.Any(), gomock.Eq("test-account"), gomock.Eq("test-user"), gomock.Eq(modules.Peers), gomock.Eq(operations.Read)).Times(1).
+		Return(false, context.Background(), nil)
+	mockStore.EXPECT().GetAccountSettings(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-account")).Times(1).
+		Return(&types.Settings{RegularUsersViewBlocked: false}, nil)
+	mockStore.EXPECT().GetUserPeers(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-account"), gomock.Eq("test-user")).Times(1).
+		Return([]*peer.Peer{{ID: "test-peer"}}, nil)
+
+	peers, total, err := m.GetPeersPaginated(context.Background(), "test-account", "test-user",
+		store.PaginationState{Page: 11, PageSize: 111}, store.PeerFilters{UserId: "test-user"},
+		store.PeerSorting{Fields: []store.PeerSortingKey{{Field: store.PeerSortByName, Order: store.DescOrderBy}}})
+
+	assert.Equal(t, []*peer.Peer{{ID: "test-peer"}}, peers)
+	assert.Equal(t, 1, total)
+	assert.NoError(t, err)
+}
+
+func TestManager_GetPeersPaginated_NoPermission_User_IsRestrictable_ViewBlocked(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockStore := store.NewMockStore(ctrl)
+	permissionsManager := permissions.NewMockManager(ctrl)
+
+	m := NewManager(mockStore, permissionsManager)
+
+	mockStore.EXPECT().GetUserByUserID(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-user")).Times(1).
+		Return(&types.User{
+			Id:   "test-user",
+			Role: types.UserRoleUser,
+		}, nil)
+	permissionsManager.EXPECT().ValidateUserPermissions(gomock.Any(), gomock.Eq("test-account"), gomock.Eq("test-user"), gomock.Eq(modules.Peers), gomock.Eq(operations.Read)).Times(1).
+		Return(false, context.Background(), nil)
+	mockStore.EXPECT().GetAccountSettings(gomock.Any(), gomock.Eq(store.LockingStrengthNone), gomock.Eq("test-account")).Times(1).
+		Return(&types.Settings{RegularUsersViewBlocked: true}, nil)
+
+	peers, total, err := m.GetPeersPaginated(context.Background(), "test-account", "test-user",
+		store.PaginationState{Page: 11, PageSize: 111}, store.PeerFilters{UserId: "test-user"},
+		store.PeerSorting{Fields: []store.PeerSortingKey{{Field: store.PeerSortByName, Order: store.DescOrderBy}}})
+
+	assert.Equal(t, make([]*peer.Peer, 0), peers)
+	assert.Equal(t, 0, total)
+	assert.NoError(t, err)
+}
diff --git a/management/internals/modules/reverseproxy/accesslogs/manager/manager.go b/management/internals/modules/reverseproxy/accesslogs/manager/manager.go
index 4b24adaa1..d22cdb980 100644
--- a/management/internals/modules/reverseproxy/accesslogs/manager/manager.go
+++ b/management/internals/modules/reverseproxy/accesslogs/manager/manager.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
@@ -18,14 +19,16 @@ import (
 )
 
 type managerImpl struct {
+	repo               accesslogs.Repository
 	store              store.Store
 	permissionsManager permissions.Manager
 	geo                geolocation.Geolocation
 	cleanupCancel      context.CancelFunc
 }
 
-func NewManager(store store.Store, permissionsManager permissions.Manager, geo geolocation.Geolocation) accesslogs.Manager {
+func NewManager(repo accesslogs.Repository, store store.Store, permissionsManager permissions.Manager, geo geolocation.Geolocation) accesslogs.Manager {
 	return &managerImpl{
+		repo:               repo,
 		store:              store,
 		permissionsManager: permissionsManager,
 		geo:                geo,
@@ -54,7 +57,7 @@ func (m *managerImpl) SaveAccessLog(ctx context.Context, logEntry *accesslogs.Ac
 		}
 	}
 
-	if err := m.store.CreateAccessLog(ctx, logEntry); err != nil {
+	if err := m.repo.Create(ctx, logEntry); err != nil {
 		log.WithContext(ctx).WithFields(log.Fields{
 			"service_id": logEntry.ServiceID,
 			"method":     logEntry.Method,
@@ -82,7 +85,7 @@ func (m *managerImpl) GetAllAccessLogs(ctx context.Context, accountID, userID st
 		log.WithContext(ctx).Warnf("failed to resolve user filters: %v", err)
 	}
 
-	logs, totalCount, err := m.store.GetAccountAccessLogs(ctx, store.LockingStrengthNone, accountID, *filter)
+	logs, totalCount, err := m.repo.ListByAccount(ctx, db.LockingStrengthNone, accountID, *filter)
 	if err != nil {
 		return nil, 0, err
 	}
@@ -98,7 +101,7 @@ func (m *managerImpl) CleanupOldAccessLogs(ctx context.Context, retentionDays in
 	}
 
 	cutoffTime := time.Now().AddDate(0, 0, -retentionDays)
-	deletedCount, err := m.store.DeleteOldAccessLogs(ctx, cutoffTime)
+	deletedCount, err := m.repo.DeleteOlderThan(ctx, cutoffTime)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to cleanup old access logs: %v", err)
 		return 0, err
diff --git a/management/internals/modules/reverseproxy/accesslogs/manager/manager_test.go b/management/internals/modules/reverseproxy/accesslogs/manager/manager_test.go
index 11bf60829..83dab7df6 100644
--- a/management/internals/modules/reverseproxy/accesslogs/manager/manager_test.go
+++ b/management/internals/modules/reverseproxy/accesslogs/manager/manager_test.go
@@ -5,27 +5,27 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
-	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 )
 
 func TestCleanupOldAccessLogs(t *testing.T) {
 	tests := []struct {
 		name          string
 		retentionDays int
-		setupMock     func(*store.MockStore)
+		setupMock     func(*accesslogs.MockRepository)
 		expectedCount int64
 		expectedError bool
 	}{
 		{
 			name:          "cleanup logs older than retention period",
 			retentionDays: 30,
-			setupMock: func(mockStore *store.MockStore) {
-				mockStore.EXPECT().
-					DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+			setupMock: func(mockRepo *accesslogs.MockRepository) {
+				mockRepo.EXPECT().
+					DeleteOlderThan(gomock.Any(), gomock.Any()).
 					DoAndReturn(func(ctx context.Context, olderThan time.Time) (int64, error) {
 						expectedCutoff := time.Now().AddDate(0, 0, -30)
 						timeDiff := olderThan.Sub(expectedCutoff)
@@ -41,9 +41,9 @@ func TestCleanupOldAccessLogs(t *testing.T) {
 		{
 			name:          "no logs to cleanup",
 			retentionDays: 30,
-			setupMock: func(mockStore *store.MockStore) {
-				mockStore.EXPECT().
-					DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+			setupMock: func(mockRepo *accesslogs.MockRepository) {
+				mockRepo.EXPECT().
+					DeleteOlderThan(gomock.Any(), gomock.Any()).
 					Return(int64(0), nil)
 			},
 			expectedCount: 0,
@@ -52,8 +52,8 @@ func TestCleanupOldAccessLogs(t *testing.T) {
 		{
 			name:          "zero retention days skips cleanup",
 			retentionDays: 0,
-			setupMock: func(mockStore *store.MockStore) {
-				// No expectations - DeleteOldAccessLogs should not be called
+			setupMock: func(mockRepo *accesslogs.MockRepository) {
+				// No expectations - DeleteOlderThan should not be called
 			},
 			expectedCount: 0,
 			expectedError: false,
@@ -61,8 +61,8 @@ func TestCleanupOldAccessLogs(t *testing.T) {
 		{
 			name:          "negative retention days skips cleanup",
 			retentionDays: -10,
-			setupMock: func(mockStore *store.MockStore) {
-				// No expectations - DeleteOldAccessLogs should not be called
+			setupMock: func(mockRepo *accesslogs.MockRepository) {
+				// No expectations - DeleteOlderThan should not be called
 			},
 			expectedCount: 0,
 			expectedError: false,
@@ -74,11 +74,11 @@ func TestCleanupOldAccessLogs(t *testing.T) {
 			ctrl := gomock.NewController(t)
 			defer ctrl.Finish()
 
-			mockStore := store.NewMockStore(ctrl)
-			tt.setupMock(mockStore)
+			mockRepo := accesslogs.NewMockRepository(ctrl)
+			tt.setupMock(mockRepo)
 
 			manager := &managerImpl{
-				store: mockStore,
+				repo: mockRepo,
 			}
 
 			ctx := context.Background()
@@ -98,10 +98,10 @@ func TestCleanupWithExactBoundary(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
-	mockStore := store.NewMockStore(ctrl)
+	mockRepo := accesslogs.NewMockRepository(ctrl)
 
-	mockStore.EXPECT().
-		DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+	mockRepo.EXPECT().
+		DeleteOlderThan(gomock.Any(), gomock.Any()).
 		DoAndReturn(func(ctx context.Context, olderThan time.Time) (int64, error) {
 			expectedCutoff := time.Now().AddDate(0, 0, -30)
 			timeDiff := olderThan.Sub(expectedCutoff)
@@ -110,7 +110,7 @@ func TestCleanupWithExactBoundary(t *testing.T) {
 		})
 
 	manager := &managerImpl{
-		store: mockStore,
+		repo: mockRepo,
 	}
 
 	ctx := context.Background()
@@ -125,11 +125,11 @@ func TestStartPeriodicCleanup(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		defer ctrl.Finish()
 
-		mockStore := store.NewMockStore(ctrl)
+		mockRepo := accesslogs.NewMockRepository(ctrl)
 		// No expectations - cleanup should not run
 
 		manager := &managerImpl{
-			store: mockStore,
+			repo: mockRepo,
 		}
 
 		ctx, cancel := context.WithCancel(context.Background())
@@ -139,22 +139,22 @@ func TestStartPeriodicCleanup(t *testing.T) {
 
 		time.Sleep(100 * time.Millisecond)
 
-		// If DeleteOldAccessLogs was called, the test will fail due to unexpected call
+		// If DeleteOlderThan was called, the test will fail due to unexpected call
 	})
 
 	t.Run("periodic cleanup runs immediately on start", func(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		defer ctrl.Finish()
 
-		mockStore := store.NewMockStore(ctrl)
+		mockRepo := accesslogs.NewMockRepository(ctrl)
 
-		mockStore.EXPECT().
-			DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+		mockRepo.EXPECT().
+			DeleteOlderThan(gomock.Any(), gomock.Any()).
 			Return(int64(2), nil).
 			Times(1)
 
 		manager := &managerImpl{
-			store: mockStore,
+			repo: mockRepo,
 		}
 
 		ctx, cancel := context.WithCancel(context.Background())
@@ -171,15 +171,15 @@ func TestStartPeriodicCleanup(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		defer ctrl.Finish()
 
-		mockStore := store.NewMockStore(ctrl)
+		mockRepo := accesslogs.NewMockRepository(ctrl)
 
-		mockStore.EXPECT().
-			DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+		mockRepo.EXPECT().
+			DeleteOlderThan(gomock.Any(), gomock.Any()).
 			Return(int64(1), nil).
 			Times(1)
 
 		manager := &managerImpl{
-			store: mockStore,
+			repo: mockRepo,
 		}
 
 		ctx, cancel := context.WithCancel(context.Background())
@@ -198,15 +198,15 @@ func TestStartPeriodicCleanup(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		defer ctrl.Finish()
 
-		mockStore := store.NewMockStore(ctrl)
+		mockRepo := accesslogs.NewMockRepository(ctrl)
 
-		mockStore.EXPECT().
-			DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+		mockRepo.EXPECT().
+			DeleteOlderThan(gomock.Any(), gomock.Any()).
 			Return(int64(0), nil).
 			Times(1)
 
 		manager := &managerImpl{
-			store: mockStore,
+			repo: mockRepo,
 		}
 
 		ctx, cancel := context.WithCancel(context.Background())
@@ -223,15 +223,15 @@ func TestStartPeriodicCleanup(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		defer ctrl.Finish()
 
-		mockStore := store.NewMockStore(ctrl)
+		mockRepo := accesslogs.NewMockRepository(ctrl)
 
-		mockStore.EXPECT().
-			DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+		mockRepo.EXPECT().
+			DeleteOlderThan(gomock.Any(), gomock.Any()).
 			Return(int64(3), nil).
 			Times(1)
 
 		manager := &managerImpl{
-			store: mockStore,
+			repo: mockRepo,
 		}
 
 		ctx, cancel := context.WithCancel(context.Background())
@@ -249,15 +249,15 @@ func TestStopPeriodicCleanup(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
-	mockStore := store.NewMockStore(ctrl)
+	mockRepo := accesslogs.NewMockRepository(ctrl)
 
-	mockStore.EXPECT().
-		DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+	mockRepo.EXPECT().
+		DeleteOlderThan(gomock.Any(), gomock.Any()).
 		Return(int64(1), nil).
 		Times(1)
 
 	manager := &managerImpl{
-		store: mockStore,
+		repo: mockRepo,
 	}
 
 	ctx := context.Background()
diff --git a/management/internals/modules/reverseproxy/accesslogs/manager/repository.go b/management/internals/modules/reverseproxy/accesslogs/manager/repository.go
new file mode 100644
index 000000000..105696ab7
--- /dev/null
+++ b/management/internals/modules/reverseproxy/accesslogs/manager/repository.go
@@ -0,0 +1,135 @@
+package manager
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+type sqlRepository struct {
+	conn *db.Conn
+	db   *gorm.DB
+}
+
+// NewRepository returns the access log repository backed by conn.
+func NewRepository(conn *db.Conn) accesslogs.Repository {
+	return &sqlRepository{conn: conn, db: conn.DB(nil)}
+}
+
+func (r *sqlRepository) WithTx(tx *db.Tx) accesslogs.Repository {
+	return &sqlRepository{conn: r.conn, db: r.conn.DB(tx)}
+}
+
+func (r *sqlRepository) Create(ctx context.Context, entry *accesslogs.AccessLogEntry) error {
+	if err := r.db.Create(entry).Error; err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{
+			"service_id": entry.ServiceID,
+			"method":     entry.Method,
+			"host":       entry.Host,
+			"path":       entry.Path,
+		}).Errorf("failed to create access log entry in store: %v", err)
+		return status.Errorf(status.Internal, "failed to create access log entry in store")
+	}
+	return nil
+}
+
+// ListByAccount returns one page of an account's access logs together with the
+// total number of entries matching the filter.
+func (r *sqlRepository) ListByAccount(ctx context.Context, lockStrength db.LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error) {
+	var totalCount int64
+	countQuery := applyFilters(r.db.Model(&accesslogs.AccessLogEntry{}).Where("account_id = ?", accountID), filter)
+	if err := countQuery.Count(&totalCount).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to count access logs: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to count access logs")
+	}
+
+	query := applyFilters(r.db.Where("account_id = ?", accountID), filter)
+	sortOrder := strings.ToUpper(filter.GetSortOrder())
+	for _, column := range strings.Split(filter.GetSortColumn(), ",") {
+		if column = strings.TrimSpace(column); column != "" {
+			query = query.Order(column + " " + sortOrder)
+		}
+	}
+	query = query.Limit(filter.GetLimit()).Offset(filter.GetOffset())
+	if lockStrength != db.LockingStrengthNone {
+		query = query.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var logs []*accesslogs.AccessLogEntry
+	if err := query.Find(&logs).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get access logs from store: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to get access logs from store")
+	}
+
+	return logs, totalCount, nil
+}
+
+func (r *sqlRepository) DeleteOlderThan(ctx context.Context, olderThan time.Time) (int64, error) {
+	result := r.db.Where("timestamp < ?", olderThan).Delete(&accesslogs.AccessLogEntry{})
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete old access logs: %v", result.Error)
+		return 0, status.Errorf(status.Internal, "failed to delete old access logs")
+	}
+	return result.RowsAffected, nil
+}
+
+func applyFilters(query *gorm.DB, filter accesslogs.AccessLogFilter) *gorm.DB {
+	if filter.Search != nil {
+		searchPattern := "%" + *filter.Search + "%"
+		query = query.Where(
+			"id LIKE ? OR location_connection_ip LIKE ? OR host LIKE ? OR path LIKE ? OR CONCAT(host, path) LIKE ? OR user_id IN (SELECT id FROM users WHERE email LIKE ? OR name LIKE ?)",
+			searchPattern, searchPattern, searchPattern, searchPattern, searchPattern, searchPattern, searchPattern,
+		)
+	}
+
+	if filter.SourceIP != nil {
+		query = query.Where("location_connection_ip = ?", *filter.SourceIP)
+	}
+
+	if filter.Host != nil {
+		query = query.Where("host = ?", *filter.Host)
+	}
+
+	if filter.Path != nil {
+		query = query.Where("path LIKE ?", "%"+*filter.Path+"%")
+	}
+
+	if filter.UserID != nil {
+		query = query.Where("user_id = ?", *filter.UserID)
+	}
+
+	if filter.Method != nil {
+		query = query.Where("method = ?", *filter.Method)
+	}
+
+	if filter.Status != nil {
+		switch *filter.Status {
+		case "success":
+			query = query.Where("(status_code >= ? AND status_code < ?)", 200, 400)
+		case "failed":
+			query = query.Where("((status_code >= ? AND status_code < ?) OR status_code >= ?)", 100, 200, 400)
+		}
+	}
+
+	if filter.StatusCode != nil {
+		query = query.Where("status_code = ?", *filter.StatusCode)
+	}
+
+	if filter.StartDate != nil {
+		query = query.Where("timestamp >= ?", *filter.StartDate)
+	}
+
+	if filter.EndDate != nil {
+		query = query.Where("timestamp <= ?", *filter.EndDate)
+	}
+
+	return query
+}
diff --git a/management/internals/modules/reverseproxy/accesslogs/manager/repository_test.go b/management/internals/modules/reverseproxy/accesslogs/manager/repository_test.go
new file mode 100644
index 000000000..9931cc27c
--- /dev/null
+++ b/management/internals/modules/reverseproxy/accesslogs/manager/repository_test.go
@@ -0,0 +1,125 @@
+package manager
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+	"github.com/netbirdio/netbird/management/internals/shared/db/dbtest"
+)
+
+func newTestRepository(t *testing.T) (accesslogs.Repository, *db.Conn) {
+	conn := dbtest.NewConn(t, &accesslogs.AccessLogEntry{})
+	return NewRepository(conn), conn
+}
+
+func newEntry(id, accountID, method string, age time.Duration) *accesslogs.AccessLogEntry {
+	return &accesslogs.AccessLogEntry{
+		ID:         id,
+		AccountID:  accountID,
+		Method:     method,
+		Host:       "app.example.com",
+		Path:       "/",
+		StatusCode: 200,
+		Timestamp:  time.Now().Add(-age),
+	}
+}
+
+func TestSqlRepository_ListByAccount(t *testing.T) {
+	repo, _ := newTestRepository(t)
+	ctx := context.Background()
+	for _, entry := range []*accesslogs.AccessLogEntry{
+		newEntry("a1", "acc-a", "GET", 3*time.Hour),
+		newEntry("a2", "acc-a", "POST", 2*time.Hour),
+		newEntry("a3", "acc-a", "GET", time.Hour),
+		newEntry("b1", "acc-b", "GET", time.Hour),
+	} {
+		require.NoError(t, repo.Create(ctx, entry))
+	}
+
+	logs, total, err := repo.ListByAccount(ctx, db.LockingStrengthNone, "acc-a", accesslogs.AccessLogFilter{Page: 1, PageSize: 2})
+	require.NoError(t, err)
+	assert.EqualValues(t, 3, total)
+	require.Len(t, logs, 2)
+	assert.Equal(t, "a3", logs[0].ID)
+	assert.Equal(t, "a2", logs[1].ID)
+
+	method := "GET"
+	logs, total, err = repo.ListByAccount(ctx, db.LockingStrengthNone, "acc-a", accesslogs.AccessLogFilter{Page: 1, PageSize: 10, Method: &method, SortOrder: "asc"})
+	require.NoError(t, err)
+	assert.EqualValues(t, 2, total)
+	require.Len(t, logs, 2)
+	assert.Equal(t, "a1", logs[0].ID)
+	assert.Equal(t, "a3", logs[1].ID)
+}
+
+func TestSqlRepository_DeleteOlderThan(t *testing.T) {
+	repo, _ := newTestRepository(t)
+	ctx := context.Background()
+	require.NoError(t, repo.Create(ctx, newEntry("old", "acc", "GET", 48*time.Hour)))
+	require.NoError(t, repo.Create(ctx, newEntry("new", "acc", "GET", time.Hour)))
+
+	deleted, err := repo.DeleteOlderThan(ctx, time.Now().Add(-24*time.Hour))
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, deleted)
+
+	logs, total, err := repo.ListByAccount(ctx, db.LockingStrengthNone, "acc", accesslogs.AccessLogFilter{Page: 1, PageSize: 10})
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, total)
+	require.Len(t, logs, 1)
+	assert.Equal(t, "new", logs[0].ID)
+}
+
+func TestSqlRepository_CreateInsideTransactionRollsBack(t *testing.T) {
+	repo, conn := newTestRepository(t)
+	ctx := context.Background()
+	failure := errors.New("abort")
+
+	err := conn.RunInTx(ctx, func(tx *db.Tx) error {
+		txRepo := repo.WithTx(tx)
+		require.NoError(t, txRepo.Create(ctx, newEntry("tx", "acc", "GET", 0)))
+		_, total, err := txRepo.ListByAccount(ctx, db.LockingStrengthNone, "acc", accesslogs.AccessLogFilter{Page: 1, PageSize: 10})
+		require.NoError(t, err)
+		assert.EqualValues(t, 1, total)
+		return failure
+	})
+	require.ErrorIs(t, err, failure)
+
+	_, total, err := repo.ListByAccount(ctx, db.LockingStrengthNone, "acc", accesslogs.AccessLogFilter{Page: 1, PageSize: 10})
+	require.NoError(t, err)
+	assert.Zero(t, total)
+}
+
+func TestSqlRepository_ListByAccount_StatusFilter(t *testing.T) {
+	repo, _ := newTestRepository(t)
+	ctx := context.Background()
+	statusCodes := map[string]int{"l4": 0, "info": 101, "ok": 200, "notfound": 404}
+	for id, code := range statusCodes {
+		entry := newEntry(id, "acc", "GET", time.Hour)
+		entry.StatusCode = code
+		require.NoError(t, repo.Create(ctx, entry))
+	}
+	foreign := newEntry("foreign", "other", "GET", time.Hour)
+	foreign.StatusCode = 500
+	require.NoError(t, repo.Create(ctx, foreign))
+
+	listIDs := func(status string) []string {
+		logs, total, err := repo.ListByAccount(ctx, db.LockingStrengthNone, "acc", accesslogs.AccessLogFilter{Page: 1, PageSize: 10, Status: &status, SortBy: "status_code", SortOrder: "asc"})
+		require.NoError(t, err)
+		require.EqualValues(t, len(logs), total)
+		ids := make([]string, 0, len(logs))
+		for _, entry := range logs {
+			ids = append(ids, entry.ID)
+		}
+		return ids
+	}
+
+	assert.Equal(t, []string{"info", "notfound"}, listIDs("failed"))
+	assert.Equal(t, []string{"ok"}, listIDs("success"))
+}
diff --git a/management/internals/modules/reverseproxy/accesslogs/repository.go b/management/internals/modules/reverseproxy/accesslogs/repository.go
new file mode 100644
index 000000000..5945f454c
--- /dev/null
+++ b/management/internals/modules/reverseproxy/accesslogs/repository.go
@@ -0,0 +1,18 @@
+package accesslogs
+
+import (
+	"context"
+	"time"
+
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+)
+
+//go:generate go tool mockgen -package accesslogs -destination=repository_mock.go -source=./repository.go -build_flags=-mod=mod
+
+// Repository persists reverse proxy access log entries.
+type Repository interface {
+	WithTx(tx *db.Tx) Repository
+	Create(ctx context.Context, entry *AccessLogEntry) error
+	ListByAccount(ctx context.Context, lockStrength db.LockingStrength, accountID string, filter AccessLogFilter) ([]*AccessLogEntry, int64, error)
+	DeleteOlderThan(ctx context.Context, olderThan time.Time) (int64, error)
+}
diff --git a/management/internals/modules/reverseproxy/accesslogs/repository_mock.go b/management/internals/modules/reverseproxy/accesslogs/repository_mock.go
new file mode 100644
index 000000000..7fbb05b7f
--- /dev/null
+++ b/management/internals/modules/reverseproxy/accesslogs/repository_mock.go
@@ -0,0 +1,102 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./repository.go
+//
+// Generated by this command:
+//
+//	mockgen -package accesslogs -destination=repository_mock.go -source=./repository.go -build_flags=-mod=mod
+//
+
+// Package accesslogs is a generated GoMock package.
+package accesslogs
+
+import (
+	context "context"
+	reflect "reflect"
+	time "time"
+
+	db "github.com/netbirdio/netbird/management/internals/shared/db"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockRepository is a mock of Repository interface.
+type MockRepository struct {
+	ctrl     *gomock.Controller
+	recorder *MockRepositoryMockRecorder
+	isgomock struct{}
+}
+
+// MockRepositoryMockRecorder is the mock recorder for MockRepository.
+type MockRepositoryMockRecorder struct {
+	mock *MockRepository
+}
+
+// NewMockRepository creates a new mock instance.
+func NewMockRepository(ctrl *gomock.Controller) *MockRepository {
+	mock := &MockRepository{ctrl: ctrl}
+	mock.recorder = &MockRepositoryMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockRepository) EXPECT() *MockRepositoryMockRecorder {
+	return m.recorder
+}
+
+// Create mocks base method.
+func (m *MockRepository) Create(ctx context.Context, entry *AccessLogEntry) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Create", ctx, entry)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Create indicates an expected call of Create.
+func (mr *MockRepositoryMockRecorder) Create(ctx, entry any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Create", reflect.TypeOf((*MockRepository)(nil).Create), ctx, entry)
+}
+
+// DeleteOlderThan mocks base method.
+func (m *MockRepository) DeleteOlderThan(ctx context.Context, olderThan time.Time) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteOlderThan", ctx, olderThan)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DeleteOlderThan indicates an expected call of DeleteOlderThan.
+func (mr *MockRepositoryMockRecorder) DeleteOlderThan(ctx, olderThan any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOlderThan", reflect.TypeOf((*MockRepository)(nil).DeleteOlderThan), ctx, olderThan)
+}
+
+// ListByAccount mocks base method.
+func (m *MockRepository) ListByAccount(ctx context.Context, lockStrength db.LockingStrength, accountID string, filter AccessLogFilter) ([]*AccessLogEntry, int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListByAccount", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*AccessLogEntry)
+	ret1, _ := ret[1].(int64)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// ListByAccount indicates an expected call of ListByAccount.
+func (mr *MockRepositoryMockRecorder) ListByAccount(ctx, lockStrength, accountID, filter any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListByAccount", reflect.TypeOf((*MockRepository)(nil).ListByAccount), ctx, lockStrength, accountID, filter)
+}
+
+// WithTx mocks base method.
+func (m *MockRepository) WithTx(tx *db.Tx) Repository {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WithTx", tx)
+	ret0, _ := ret[0].(Repository)
+	return ret0
+}
+
+// WithTx indicates an expected call of WithTx.
+func (mr *MockRepositoryMockRecorder) WithTx(tx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WithTx", reflect.TypeOf((*MockRepository)(nil).WithTx), tx)
+}
diff --git a/management/internals/modules/reverseproxy/activity/interface.go b/management/internals/modules/reverseproxy/activity/interface.go
new file mode 100644
index 000000000..e2e682dad
--- /dev/null
+++ b/management/internals/modules/reverseproxy/activity/interface.go
@@ -0,0 +1,25 @@
+// Package activity records that a principal used a reverse proxy service, so
+// that activity accounting counts people and devices which reach services
+// through the proxy but never touch the dashboard or the management API.
+package activity
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// Manager records reverse proxy usage against the timestamps activity
+// accounting reads. Both methods are best effort from the caller's point of
+// view: a lost record is corrected by the next request, and no authorization
+// decision reads them back.
+type Manager interface {
+	// RecordUserLogin records a completed SSO sign-in to a proxied service.
+	// Service users have no interactive login and are ignored.
+	RecordUserLogin(ctx context.Context, accountID string, user *types.User) error
+	// RecordPeerSeen records that a peer reached a private service over the
+	// mesh, which is what lets its owner count as active. Peers activity
+	// accounting excludes, and peers already seen recently, are ignored.
+	RecordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) error
+}
diff --git a/management/internals/modules/reverseproxy/activity/manager/manager.go b/management/internals/modules/reverseproxy/activity/manager/manager.go
new file mode 100644
index 000000000..978604fa0
--- /dev/null
+++ b/management/internals/modules/reverseproxy/activity/manager/manager.go
@@ -0,0 +1,66 @@
+package manager
+
+import (
+	"context"
+	"time"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// peerSeenInterval is how stale a peer's LastSeen must be before reaching a
+// private service refreshes it. Positive tunnel validations are cached on the
+// proxy for five minutes, so without a floor a busy peer would rewrite its row
+// behind every request; an hour still sits well inside the window activity
+// accounting asks about.
+const peerSeenInterval = time.Hour
+
+type managerImpl struct {
+	store store.Store
+}
+
+// NewManager returns the activity manager backed by the management store.
+func NewManager(store store.Store) activity.Manager {
+	return &managerImpl{store: store}
+}
+
+// RecordUserLogin stamps the login the same way the dashboard and device login
+// paths do, so a person who only ever reaches proxied services still has a
+// login on record.
+func (m *managerImpl) RecordUserLogin(ctx context.Context, accountID string, user *types.User) error {
+	if user == nil || user.IsServiceUser {
+		return nil
+	}
+
+	return m.store.SaveUserLastLogin(ctx, accountID, user.Id, time.Now().UTC())
+}
+
+// RecordPeerSeen stamps LastSeen, the column a peer activates its owner
+// through. The peer the caller already holds answers the throttle without a
+// query, so a peer seen inside the interval costs nothing to skip; the same
+// cutoff goes to the store, which enforces it inside the UPDATE so concurrent
+// requests for one peer cannot each write off their own stale read.
+func (m *managerImpl) RecordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) error {
+	if peer == nil || !countsTowardActivity(peer) {
+		return nil
+	}
+
+	staleBefore := time.Now().UTC().Add(-peerSeenInterval)
+	if peer.Status != nil && peer.Status.LastSeen.After(staleBefore) {
+		return nil
+	}
+
+	_, err := m.store.RefreshPeerLastSeen(ctx, accountID, peer.ID, staleBefore)
+
+	return err
+}
+
+// countsTowardActivity reports whether the peer represents a device a person
+// actually runs. Embedded proxy peers are infrastructure and browser (WASM)
+// clients are ephemeral sessions, so activity accounting ignores both and a
+// write for them could never count.
+func countsTowardActivity(peer *peer.Peer) bool {
+	return !peer.ProxyMeta.Embedded && peer.Meta.KernelVersion != "wasm"
+}
diff --git a/management/internals/modules/reverseproxy/activity/manager/manager_test.go b/management/internals/modules/reverseproxy/activity/manager/manager_test.go
new file mode 100644
index 000000000..c89bce0a1
--- /dev/null
+++ b/management/internals/modules/reverseproxy/activity/manager/manager_test.go
@@ -0,0 +1,149 @@
+package manager
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// recordingStore captures the two writes the activity manager makes. The
+// embedded interface satisfies the rest and panics if anything else is called,
+// which keeps the manager honest about its surface.
+type recordingStore struct {
+	store.Store
+	logins []loginWrite
+	seen   []seenWrite
+}
+
+type loginWrite struct {
+	accountID string
+	userID    string
+	at        time.Time
+}
+
+type seenWrite struct {
+	accountID   string
+	peerID      string
+	staleBefore time.Time
+}
+
+func (s *recordingStore) SaveUserLastLogin(_ context.Context, accountID, userID string, lastLogin time.Time) error {
+	s.logins = append(s.logins, loginWrite{accountID: accountID, userID: userID, at: lastLogin})
+	return nil
+}
+
+func (s *recordingStore) RefreshPeerLastSeen(_ context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
+	s.seen = append(s.seen, seenWrite{accountID: accountID, peerID: peerID, staleBefore: staleBefore})
+	return true, nil
+}
+
+func TestRecordUserLogin(t *testing.T) {
+	tests := []struct {
+		name        string
+		user        *types.User
+		expectWrite bool
+	}{
+		{
+			name:        "regular user is recorded",
+			user:        &types.User{Id: "user1", AccountID: "account1"},
+			expectWrite: true,
+		},
+		{
+			// Activity accounting never counts service users, so a row for one
+			// would be noise.
+			name:        "service user is ignored",
+			user:        &types.User{Id: "svc1", AccountID: "account1", IsServiceUser: true},
+			expectWrite: false,
+		},
+		{
+			name:        "missing user is ignored",
+			user:        nil,
+			expectWrite: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := &recordingStore{}
+			require.NoError(t, NewManager(st).RecordUserLogin(context.Background(), "account1", tt.user))
+
+			if !tt.expectWrite {
+				assert.Empty(t, st.logins, "no login should have been recorded")
+				return
+			}
+
+			require.Len(t, st.logins, 1, "exactly one login should have been recorded")
+			assert.Equal(t, "account1", st.logins[0].accountID, "login must be recorded against the service account")
+			assert.Equal(t, tt.user.Id, st.logins[0].userID, "login must be recorded against the signing-in user")
+			assert.Equal(t, time.UTC, st.logins[0].at.Location(), "timestamps are written in UTC")
+			assert.WithinDuration(t, time.Now().UTC(), st.logins[0].at, time.Minute, "login should be stamped now")
+		})
+	}
+}
+
+func TestRecordPeerSeen(t *testing.T) {
+	tests := []struct {
+		name        string
+		peer        *peer.Peer
+		expectWrite bool
+	}{
+		{
+			name:        "peer seen long ago is recorded",
+			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+			expectWrite: true,
+		},
+		{
+			name:        "peer never seen is recorded",
+			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{}},
+			expectWrite: true,
+		},
+		{
+			// The throttle. The caller already holds the peer, so skipping a
+			// recently seen one costs nothing.
+			name:        "peer seen inside the interval is skipped",
+			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-10 * time.Minute)}},
+			expectWrite: false,
+		},
+		{
+			name:        "embedded proxy peer is skipped",
+			peer:        &peer.Peer{ID: "peer1", ProxyMeta: peer.ProxyMeta{Embedded: true}, Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+			expectWrite: false,
+		},
+		{
+			name:        "browser client is skipped",
+			peer:        &peer.Peer{ID: "peer1", Meta: peer.PeerSystemMeta{KernelVersion: "wasm"}, Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+			expectWrite: false,
+		},
+		{
+			name:        "missing peer is ignored",
+			peer:        nil,
+			expectWrite: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := &recordingStore{}
+			require.NoError(t, NewManager(st).RecordPeerSeen(context.Background(), "account1", tt.peer))
+
+			if !tt.expectWrite {
+				assert.Empty(t, st.seen, "no activity should have been recorded")
+				return
+			}
+
+			require.Len(t, st.seen, 1, "exactly one activity write should have been recorded")
+			assert.Equal(t, "account1", st.seen[0].accountID, "activity must be recorded against the service account")
+			assert.Equal(t, tt.peer.ID, st.seen[0].peerID, "activity must be recorded against the calling peer")
+			assert.Equal(t, time.UTC, st.seen[0].staleBefore.Location(), "cutoffs are passed in UTC")
+			assert.WithinDuration(t, time.Now().UTC().Add(-peerSeenInterval), st.seen[0].staleBefore, time.Minute,
+				"the store must enforce the same interval the local check applies")
+		})
+	}
+}
diff --git a/management/internals/modules/reverseproxy/domain/domain.go b/management/internals/modules/reverseproxy/domain/domain.go
index 08d7ad19b..74583c55f 100644
--- a/management/internals/modules/reverseproxy/domain/domain.go
+++ b/management/internals/modules/reverseproxy/domain/domain.go
@@ -1,5 +1,13 @@
 package domain
 
+import "time"
+
+// ValidationTTL is the time available to validate a custom domain registration.
+const ValidationTTL = 48 * time.Hour
+
+// ID identifies a custom domain registration.
+type ID string
+
 type Type string
 
 const (
@@ -8,12 +16,13 @@ const (
 )
 
 type Domain struct {
-	ID            string `gorm:"unique;primaryKey;autoIncrement"`
-	Domain        string `gorm:"unique"` // Domain records must be unique, this avoids domain reuse across accounts.
-	AccountID     string `gorm:"index"`
-	TargetCluster string // The proxy cluster this domain should be validated against
-	Type          Type   `gorm:"-"`
-	Validated     bool
+	ID                  string `gorm:"unique;primaryKey;autoIncrement"`
+	Domain              string `gorm:"unique"` // Domain records must be unique, this avoids domain reuse across accounts.
+	AccountID           string `gorm:"index"`
+	TargetCluster       string // The proxy cluster this domain should be validated against
+	Type                Type   `gorm:"-"`
+	Validated           bool
+	ValidationExpiresAt *time.Time `gorm:"index"`
 	// SupportsCustomPorts is populated at query time for free domains from the
 	// proxy cluster capabilities. Not persisted.
 	SupportsCustomPorts *bool `gorm:"-"`
@@ -36,7 +45,12 @@ func (d *Domain) EventMeta() map[string]any {
 	}
 }
 
+// Copy returns a copy with an independent validation deadline.
 func (d *Domain) Copy() *Domain {
 	dCopy := *d
+	if d.ValidationExpiresAt != nil {
+		expiresAt := *d.ValidationExpiresAt
+		dCopy.ValidationExpiresAt = &expiresAt
+	}
 	return &dCopy
 }
diff --git a/management/internals/modules/reverseproxy/domain/interface.go b/management/internals/modules/reverseproxy/domain/interface.go
index a4bba5841..c729fb7b0 100644
--- a/management/internals/modules/reverseproxy/domain/interface.go
+++ b/management/internals/modules/reverseproxy/domain/interface.go
@@ -8,6 +8,6 @@ type Manager interface {
 	GetDomains(ctx context.Context, accountID, userID string) ([]*Domain, error)
 	CreateDomain(ctx context.Context, accountID, userID, domainName, targetCluster string) (*Domain, error)
 	DeleteDomain(ctx context.Context, accountID, userID, domainID string) error
-	ValidateDomain(ctx context.Context, accountID, userID, domainID string)
+	ValidateDomain(ctx context.Context, accountID, userID, domainID string) error
 	GetClusterDomains() []string
 }
diff --git a/management/internals/modules/reverseproxy/domain/manager/api.go b/management/internals/modules/reverseproxy/domain/manager/api.go
index f01329010..ec5daf7d6 100644
--- a/management/internals/modules/reverseproxy/domain/manager/api.go
+++ b/management/internals/modules/reverseproxy/domain/manager/api.go
@@ -134,7 +134,10 @@ func (h *handler) triggerCustomDomainValidation(w http.ResponseWriter, r *http.R
 		return
 	}
 
-	go h.manager.ValidateDomain(r.Context(), userAuth.AccountId, userAuth.UserId, domainID)
+	if err := h.manager.ValidateDomain(r.Context(), userAuth.AccountId, userAuth.UserId, domainID); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
 
-	w.WriteHeader(http.StatusAccepted)
+	w.WriteHeader(http.StatusNoContent)
 }
diff --git a/management/internals/modules/reverseproxy/domain/manager/deletion_test.go b/management/internals/modules/reverseproxy/domain/manager/deletion_test.go
new file mode 100644
index 000000000..b47a2bca0
--- /dev/null
+++ b/management/internals/modules/reverseproxy/domain/manager/deletion_test.go
@@ -0,0 +1,80 @@
+package manager
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/activity"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/auth"
+)
+
+func TestDeleteDomain_ServiceDependencies(t *testing.T) {
+	for _, tt := range []struct {
+		name        string
+		domainName  string
+		serviceHost string
+		accountID   string
+		enabled     bool
+		protected   bool
+	}{
+		{"exact", "example.com", "example.com", accountA, true, true},
+		{"subdomain", "example.com", "deep.app.example.com", accountA, true, true},
+		{"disabled", "example.com", "app.example.com", accountA, false, true},
+		// A service is authorized by its own account's registration, so another
+		// account's service under this namespace is not a dependency of it.
+		{"other account", "example.com", "app.example.com", accountB, true, false},
+		{"case and trailing dot", "example.com", "APP.EXAMPLE.COM.", accountA, true, true},
+		{"suffix boundary", "example.com", "notexample.com", accountA, true, false},
+		{"literal underscore", "a_b.example.com", "app.a_b.example.com", accountA, true, true},
+		{"underscore wildcard", "a_b.example.com", "app.axb.example.com", accountA, true, false},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			env := setupDomainTest(t)
+			events := captureDomainEvents(env)
+			d, err := env.store.CreateCustomDomain(ctx, accountA, tt.domainName, testCluster, true)
+			require.NoError(t, err)
+			svc := &rpservice.Service{
+				ID: "dependent", AccountID: tt.accountID, Domain: tt.serviceHost,
+				Enabled: tt.enabled, ProxyCluster: testCluster,
+			}
+			require.NoError(t, env.store.CreateService(ctx, svc))
+			router := mux.NewRouter()
+			RegisterEndpoints(router, env.manager)
+			deleteDomain := func() *httptest.ResponseRecorder {
+				req := httptest.NewRequest(http.MethodDelete, "/domains/"+d.ID, nil)
+				req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{AccountId: accountA, UserId: accountAUser})
+				response := httptest.NewRecorder()
+				router.ServeHTTP(response, req)
+				return response
+			}
+
+			response := deleteDomain()
+			if tt.protected {
+				require.Equal(t, http.StatusPreconditionFailed, response.Code, "dependent services must block deletion: %s", response.Body.String())
+				assert.NotContains(t, response.Body.String(), tt.accountID, "the error must not reveal the service's account")
+				assert.NotNil(t, storedDomain(t, env.store, accountA, d.Domain), "the namespace must remain reserved")
+				assert.Empty(t, events.get(), "rejected deletion must not emit DomainDeleted")
+				stored, err := env.store.GetServiceByID(ctx, nbstore.LockingStrengthNone, tt.accountID, svc.ID)
+				require.NoError(t, err)
+				assert.Equal(t, svc.Enabled, stored.Enabled, "rejected deletion must preserve the service")
+				require.NoError(t, env.store.DeleteService(ctx, tt.accountID, svc.ID))
+				response = deleteDomain()
+			}
+			require.Equal(t, http.StatusNoContent, response.Code, "deletion must succeed without dependencies: %s", response.Body.String())
+			assert.Nil(t, storedDomain(t, env.store, accountA, d.Domain), "the registration must be deleted")
+			captured := events.get()
+			require.Len(t, captured, 1, "only successful deletion may emit an event")
+			assert.Equal(t, activity.DomainDeleted, captured[0].Activity, "the event must describe the successful deletion")
+		})
+	}
+}
diff --git a/management/internals/modules/reverseproxy/domain/manager/domain_test.go b/management/internals/modules/reverseproxy/domain/manager/domain_test.go
index 523920a99..38d5a923b 100644
--- a/management/internals/modules/reverseproxy/domain/manager/domain_test.go
+++ b/management/internals/modules/reverseproxy/domain/manager/domain_test.go
@@ -66,8 +66,8 @@ func TestExtractClusterFromFreeDomain(t *testing.T) {
 
 func TestExtractClusterFromCustomDomains(t *testing.T) {
 	customDomains := []*domain.Domain{
-		{Domain: "example.com", TargetCluster: "eu1.proxy.netbird.io"},
-		{Domain: "proxy.corp.io", TargetCluster: "us1.proxy.netbird.io"},
+		{Domain: "example.com", TargetCluster: "eu1.proxy.netbird.io", Validated: true},
+		{Domain: "proxy.corp.io", TargetCluster: "us1.proxy.netbird.io", Validated: true},
 	}
 
 	tests := []struct {
@@ -120,19 +120,49 @@ func TestExtractClusterFromCustomDomains(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			cluster, ok := extractClusterFromCustomDomains(tc.domain, customDomains)
-			assert.Equal(t, tc.wantOK, ok)
-			if ok {
-				assert.Equal(t, tc.wantVal, cluster)
+			cluster, match := extractClusterFromCustomDomains(tc.domain, customDomains)
+			if !tc.wantOK {
+				assert.Equal(t, customDomainNoMatch, match, "unrelated domain should not match any custom domain")
+				return
 			}
+			assert.Equal(t, customDomainValidated, match, "validated custom domain should resolve a cluster")
+			assert.Equal(t, tc.wantVal, cluster)
 		})
 	}
 }
 
+// An unvalidated row must never yield a cluster: the account has not shown it
+// controls the name, so no service may be bound to it.
+func TestExtractClusterFromCustomDomains_UnvalidatedDomainRefused(t *testing.T) {
+	customDomains := []*domain.Domain{
+		{Domain: "example.com", TargetCluster: "eu1.proxy.netbird.io", Validated: false},
+	}
+
+	for _, serviceDomain := range []string{"example.com", "app.example.com"} {
+		t.Run(serviceDomain, func(t *testing.T) {
+			cluster, match := extractClusterFromCustomDomains(serviceDomain, customDomains)
+			assert.Equal(t, customDomainUnvalidated, match, "unvalidated row must be reported as such")
+			assert.Empty(t, cluster, "unvalidated row must not resolve a cluster")
+		})
+	}
+}
+
+// A more specific unvalidated row must not shadow a validated parent domain.
+func TestExtractClusterFromCustomDomains_ValidatedParentWinsOverUnvalidatedChild(t *testing.T) {
+	customDomains := []*domain.Domain{
+		{Domain: "example.com", TargetCluster: "cluster-generic", Validated: true},
+		{Domain: "app.example.com", TargetCluster: "cluster-app", Validated: false},
+	}
+
+	cluster, match := extractClusterFromCustomDomains("app.example.com", customDomains)
+	assert.Equal(t, customDomainValidated, match)
+	assert.Equal(t, "cluster-generic", cluster, "validated parent domain should provide the cluster")
+}
+
 func TestExtractClusterFromCustomDomains_OverlappingDomains(t *testing.T) {
 	customDomains := []*domain.Domain{
-		{Domain: "example.com", TargetCluster: "cluster-generic"},
-		{Domain: "app.example.com", TargetCluster: "cluster-app"},
+		{Domain: "example.com", TargetCluster: "cluster-generic", Validated: true},
+		{Domain: "app.example.com", TargetCluster: "cluster-app", Validated: true},
 	}
 
 	tests := []struct {
@@ -164,8 +194,8 @@ func TestExtractClusterFromCustomDomains_OverlappingDomains(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			cluster, ok := extractClusterFromCustomDomains(tc.domain, customDomains)
-			assert.True(t, ok)
+			cluster, match := extractClusterFromCustomDomains(tc.domain, customDomains)
+			assert.Equal(t, customDomainValidated, match)
 			assert.Equal(t, tc.wantVal, cluster)
 		})
 	}
diff --git a/management/internals/modules/reverseproxy/domain/manager/expiration.go b/management/internals/modules/reverseproxy/domain/manager/expiration.go
new file mode 100644
index 000000000..381e3ca51
--- /dev/null
+++ b/management/internals/modules/reverseproxy/domain/manager/expiration.go
@@ -0,0 +1,73 @@
+package manager
+
+import (
+	"context"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	"github.com/netbirdio/netbird/management/server/activity"
+)
+
+const (
+	validationCleanupInterval = 60 * time.Minute
+	validationCleanupBatch    = 100
+)
+
+// RunValidationCleanup removes expired registrations on startup and hourly until cancellation.
+func (m Manager) RunValidationCleanup(ctx context.Context) {
+	ticker := time.NewTicker(validationCleanupInterval)
+	defer ticker.Stop()
+	for {
+		m.cleanupExpiredDomains(ctx, time.Now().UTC())
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+	}
+}
+
+func (m Manager) cleanupExpiredDomains(ctx context.Context, now time.Time) {
+	var afterID domain.ID
+	for ctx.Err() == nil {
+		domains, err := m.store.GetExpiredCustomDomains(ctx, now, afterID, validationCleanupBatch)
+		if err != nil {
+			if ctx.Err() == nil {
+				log.WithContext(ctx).WithError(err).Error("list expired custom domain registrations")
+			}
+			return
+		}
+		for _, d := range domains {
+			if ctx.Err() != nil {
+				return
+			}
+			m.deleteExpiredDomain(ctx, d, now)
+			afterID = domain.ID(d.ID)
+		}
+		if len(domains) < validationCleanupBatch {
+			return
+		}
+	}
+}
+
+func (m Manager) deleteExpiredDomain(ctx context.Context, d *domain.Domain, now time.Time) {
+	deleted, err := m.store.DeleteExpiredCustomDomain(ctx, d, now)
+	if err != nil {
+		if ctx.Err() == nil {
+			log.WithContext(ctx).WithFields(log.Fields{"accountID": d.AccountID, "domainID": d.ID}).
+				WithError(err).Warn("could not expire custom domain registration")
+		}
+		return
+	}
+	if !deleted {
+		return
+	}
+	meta := d.EventMeta()
+	if d.ValidationExpiresAt != nil {
+		meta["validation_expires_at"] = d.ValidationExpiresAt.UTC().Format(time.RFC3339)
+	}
+	m.accountManager.StoreEvent(ctx, activity.SystemInitiator, d.ID, d.AccountID,
+		activity.CustomDomainValidationExpired, meta)
+}
diff --git a/management/internals/modules/reverseproxy/domain/manager/expiration_test.go b/management/internals/modules/reverseproxy/domain/manager/expiration_test.go
new file mode 100644
index 000000000..3a3bd6e92
--- /dev/null
+++ b/management/internals/modules/reverseproxy/domain/manager/expiration_test.go
@@ -0,0 +1,276 @@
+package manager
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/mock_server"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
+)
+
+func TestValidateDomain_ExpiredRegistration(t *testing.T) {
+	env := setupDomainTest(t)
+	ctx := context.Background()
+	d, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "expired.example.com", testCluster)
+	require.NoError(t, err)
+	expiresAt := time.Now().Add(-time.Second)
+	db := env.store.(*nbstore.SqlStore).GetDB()
+	require.NoError(t, db.Model(&domain.Domain{}).Where("id = ?", d.ID).
+		Update("validation_expires_at", expiresAt).Error)
+	env.resolver.set("validation.expired.example.com", testCluster)
+
+	assert.Error(t, env.manager.ValidateDomain(ctx, accountA, accountAUser, d.ID), "an expired registration must be refused")
+
+	stored := storedDomain(t, env.store, accountA, d.Domain)
+	require.NotNil(t, stored)
+	assert.False(t, stored.Validated, "an expired registration must not become usable before cleanup runs")
+}
+
+func TestCreateDomain_ValidationDeadline(t *testing.T) {
+	env := setupClockDomainTest(t)
+	synctest.Test(t, func(t *testing.T) {
+		ctx := context.Background()
+		createdAt := time.Now().UTC()
+		d, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "pending.example.com", testCluster)
+		require.NoError(t, err)
+		require.NotNil(t, d.ValidationExpiresAt)
+		assert.Equal(t, createdAt.Add(48*time.Hour), *d.ValidationExpiresAt, "new registrations get 48 hours")
+
+		time.Sleep(time.Hour)
+		assert.Error(t, env.manager.ValidateDomain(ctx, accountA, accountAUser, d.ID), "a missing CNAME must fail validation")
+		stored := storedDomain(t, env.store, accountA, d.Domain)
+		require.NotNil(t, stored)
+		require.NotNil(t, stored.ValidationExpiresAt)
+		assert.WithinDuration(t, *d.ValidationExpiresAt, *stored.ValidationExpiresAt, 0, "failed validation must not extend the deadline")
+	})
+}
+
+func TestCleanupExpiredDomains_Boundaries(t *testing.T) {
+	env := setupDomainTest(t)
+	events := captureDomainEvents(env)
+	ctx := context.Background()
+	now := time.Now().UTC().Truncate(time.Second)
+	tests := []struct {
+		name      string
+		expiresAt time.Time
+		validated bool
+		deleted   bool
+	}{
+		{"expired", now.Add(-time.Second), false, true},
+		{"deadline", now, false, true},
+		{"pending", now.Add(time.Second), false, false},
+		{"validated", now.Add(-time.Hour), true, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			d := createExpiringDomain(t, env, tt.name+".example.com", tt.expiresAt)
+			if tt.validated {
+				require.NoError(t, env.store.(*nbstore.SqlStore).GetDB().Model(d).Update("validated", true).Error)
+			}
+			env.manager.cleanupExpiredDomains(ctx, now)
+			stored := storedDomain(t, env.store, accountA, d.Domain)
+			if !tt.deleted {
+				assert.NotNil(t, stored, "pending and validated registrations must survive cleanup")
+				return
+			}
+			assert.Nil(t, stored, "expired unused registrations must be removed")
+			replacement, err := env.manager.CreateDomain(ctx, accountB, accountBUser, d.Domain, testCluster)
+			require.NoError(t, err)
+			assert.NotEqual(t, d.ID, replacement.ID, "the released name must receive a fresh registration")
+			assert.False(t, replacement.Validated, "the new account must validate its own registration")
+		})
+	}
+	got := events.get()
+	require.Len(t, got, 2, "only successful expiration deletions emit events")
+	for _, event := range got {
+		assert.Equal(t, activity.CustomDomainValidationExpired, event.Activity, "use the requested expiration event")
+		assert.Equal(t, activity.SystemInitiator, event.InitiatorID, "cleanup is attributed to the system")
+		assert.Equal(t, accountA, event.AccountID, "expiration belongs to the original account")
+		assert.NotEmpty(t, event.TargetID, "retain the deleted domain ID")
+		assert.NotEmpty(t, event.Meta["domain"], "retain the deleted domain name")
+		assert.NotEmpty(t, event.Meta["validation_expires_at"], "include the validation deadline")
+	}
+}
+
+func TestCleanupExpiredDomains_ContinuesPastProtectedBatch(t *testing.T) {
+	env := setupDomainTest(t)
+	ctx := context.Background()
+	now := time.Now().UTC()
+	for i := range validationCleanupBatch {
+		d := createExpiringDomain(t, env, fmt.Sprintf("protected-%d.example.com", i), now.Add(-time.Hour))
+		require.NoError(t, env.store.CreateService(ctx, &rpservice.Service{
+			ID: fmt.Sprintf("service-%d", i), AccountID: accountA, Domain: "app." + d.Domain,
+		}))
+	}
+	unprotected := createExpiringDomain(t, env, "unused.example.com", now.Add(-time.Hour))
+	env.manager.cleanupExpiredDomains(ctx, now)
+	assert.Nil(t, storedDomain(t, env.store, accountA, unprotected.Domain), "protected registrations must not starve later batches")
+	remaining, err := env.store.ListCustomDomains(ctx, accountA)
+	require.NoError(t, err)
+	assert.Len(t, remaining, validationCleanupBatch, "all registrations with dependent services must survive")
+}
+
+func TestCleanupExpiredDomains_ConcurrentWorkers(t *testing.T) {
+	env := setupDomainTest(t)
+	events := captureDomainEvents(env)
+	now := time.Now().UTC()
+	d := createExpiringDomain(t, env, "concurrent.example.com", now.Add(-time.Hour))
+	var workers sync.WaitGroup
+	for range 2 {
+		workers.Go(func() { env.manager.cleanupExpiredDomains(context.Background(), now) })
+	}
+	workers.Wait()
+	assert.Nil(t, storedDomain(t, env.store, accountA, d.Domain), "one worker must remove the expired registration")
+	assert.Len(t, events.get(), 1, "only the worker that deletes the row may emit the event")
+}
+
+func TestRunValidationCleanup_HourlyAndRestart(t *testing.T) {
+	env := setupClockDomainTest(t)
+	synctest.Test(t, func(t *testing.T) {
+		events := captureDomainEvents(env)
+		now := time.Now().UTC()
+		startup := createExpiringDomain(t, env, "startup.example.com", now.Add(-time.Hour))
+		hourly := createExpiringDomain(t, env, "hourly.example.com", now.Add(time.Minute))
+		ctx, cancel := context.WithCancel(context.Background())
+		done := make(chan struct{})
+		go func() {
+			defer close(done)
+			env.manager.RunValidationCleanup(ctx)
+		}()
+		synctest.Wait()
+		assert.Nil(t, storedDomain(t, env.store, accountA, startup.Domain), "startup must collect overdue registrations")
+		time.Sleep(59 * time.Minute)
+		synctest.Wait()
+		assert.NotNil(t, storedDomain(t, env.store, accountA, hourly.Domain), "cleanup must wait for the 60-minute interval")
+		time.Sleep(time.Minute)
+		synctest.Wait()
+		assert.Nil(t, storedDomain(t, env.store, accountA, hourly.Domain), "the hourly scan must collect expired registrations")
+		cancel()
+		<-done
+
+		offline := createExpiringDomain(t, env, "offline.example.com", time.Now().UTC().Add(time.Minute))
+		time.Sleep(2 * time.Hour)
+		assert.NotNil(t, storedDomain(t, env.store, accountA, offline.Domain), "a stopped worker must not continue deleting")
+		ctx, cancel = context.WithCancel(context.Background())
+		done = make(chan struct{})
+		go func() {
+			defer close(done)
+			env.manager.RunValidationCleanup(ctx)
+		}()
+		synctest.Wait()
+		assert.Nil(t, storedDomain(t, env.store, accountA, offline.Domain), "restart must use the persisted deadline")
+		cancel()
+		<-done
+		assert.Len(t, events.get(), 3, "each deletion should emit an expiration event")
+	})
+}
+
+type blockingDomainResolver struct {
+	started chan struct{}
+	release chan struct{}
+}
+
+func (r blockingDomainResolver) LookupCNAME(context.Context, string) (string, error) {
+	close(r.started)
+	<-r.release
+	return testCluster + ".", nil
+}
+
+func TestValidateDomain_DeadlinePassesDuringLookup(t *testing.T) {
+	for _, cleanup := range []bool{false, true} {
+		t.Run(fmt.Sprintf("cleanup=%t", cleanup), func(t *testing.T) {
+			env := setupClockDomainTest(t)
+			synctest.Test(t, func(t *testing.T) {
+				events := captureDomainEvents(env)
+				ctx := context.Background()
+				d, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "late.example.com", testCluster)
+				require.NoError(t, err)
+				resolver := blockingDomainResolver{started: make(chan struct{}), release: make(chan struct{})}
+				env.manager.validator.Resolver = resolver
+				done := make(chan struct{})
+				var validateErr error
+				go func() {
+					defer close(done)
+					validateErr = env.manager.ValidateDomain(ctx, accountA, accountAUser, d.ID)
+				}()
+				<-resolver.started
+				time.Sleep(48 * time.Hour)
+				if cleanup {
+					env.manager.cleanupExpiredDomains(ctx, time.Now().UTC())
+					_, err = env.store.CreateCustomDomain(ctx, accountB, d.Domain, testCluster, false)
+					require.NoError(t, err)
+				}
+				close(resolver.release)
+				<-done
+				assert.Error(t, validateErr, "a validation finishing after the deadline must be refused")
+				owner := accountA
+				if cleanup {
+					assert.Nil(t, storedDomain(t, env.store, accountA, d.Domain), "late validation must not restore the old claim")
+					owner = accountB
+				}
+				stored := storedDomain(t, env.store, owner, d.Domain)
+				require.NotNil(t, stored)
+				assert.False(t, stored.Validated, "late validation must not validate either claim")
+				for _, event := range events.get() {
+					assert.NotEqual(t, activity.DomainValidated, event.Activity, "a rejected write must not emit a validation event")
+				}
+			})
+		})
+	}
+}
+
+func setupClockDomainTest(t *testing.T) *domainTestEnv {
+	t.Helper()
+	// Network driver watchers cannot share cancellation channels across synctest bubbles.
+	// Store boundary and concurrency tests still exercise the selected database engine.
+	t.Setenv("NETBIRD_STORE_ENGINE", "sqlite")
+	return setupDomainTest(t)
+}
+
+func createExpiringDomain(t *testing.T, env *domainTestEnv, name string, expiresAt time.Time) *domain.Domain {
+	t.Helper()
+	d, err := env.store.CreateCustomDomain(context.Background(), accountA, name, testCluster, false)
+	require.NoError(t, err)
+	require.NoError(t, env.store.(*nbstore.SqlStore).GetDB().Model(d).Update("validation_expires_at", expiresAt).Error)
+	d.ValidationExpiresAt = &expiresAt
+	return d
+}
+
+type domainEvents struct {
+	mu     sync.Mutex
+	events []*activity.Event
+}
+
+func captureDomainEvents(env *domainTestEnv) *domainEvents {
+	events := &domainEvents{}
+	env.manager.accountManager = &mock_server.MockAccountManager{
+		StoreEventFunc: func(_ context.Context, initiator, target, account string, code activity.ActivityDescriber, meta map[string]any) {
+			if code == activity.DomainAdded {
+				return
+			}
+			events.mu.Lock()
+			defer events.mu.Unlock()
+			events.events = append(events.events, &activity.Event{
+				InitiatorID: initiator, TargetID: target, AccountID: account,
+				Activity: code.(activity.Activity), Meta: meta,
+			})
+		},
+	}
+	return events
+}
+
+func (e *domainEvents) get() []*activity.Event {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return append([]*activity.Event(nil), e.events...)
+}
diff --git a/management/internals/modules/reverseproxy/domain/manager/manager.go b/management/internals/modules/reverseproxy/domain/manager/manager.go
index 3c0f0d73b..f92ed8201 100644
--- a/management/internals/modules/reverseproxy/domain/manager/manager.go
+++ b/management/internals/modules/reverseproxy/domain/manager/manager.go
@@ -2,31 +2,40 @@ package manager
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"strings"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 
+	agentnetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
+	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 type store interface {
 	GetAccount(ctx context.Context, accountID string) (*types.Account, error)
+	GetAgentNetworkSettings(ctx context.Context, lockStrength nbstore.LockingStrength, accountID string) (*agentnetworkTypes.Settings, error)
 
 	GetCustomDomain(ctx context.Context, accountID string, domainID string) (*domain.Domain, error)
+	GetCustomDomainByName(ctx context.Context, domainName string) (*domain.Domain, error)
 	ListFreeDomains(ctx context.Context, accountID string) ([]string, error)
 	ListCustomDomains(ctx context.Context, accountID string) ([]*domain.Domain, error)
 	CreateCustomDomain(ctx context.Context, accountID string, domainName string, targetCluster string, validated bool) (*domain.Domain, error)
 	UpdateCustomDomain(ctx context.Context, accountID string, d *domain.Domain) (*domain.Domain, error)
 	DeleteCustomDomain(ctx context.Context, accountID string, domainID string) error
+	GetExpiredCustomDomains(ctx context.Context, now time.Time, afterID domain.ID, limit int) ([]*domain.Domain, error)
+	DeleteExpiredCustomDomain(ctx context.Context, d *domain.Domain, now time.Time) (bool, error)
 }
 
 type proxyManager interface {
@@ -101,12 +110,13 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 	// Add custom domains.
 	for _, d := range domains {
 		cd := &domain.Domain{
-			ID:            d.ID,
-			Domain:        d.Domain,
-			AccountID:     accountID,
-			TargetCluster: d.TargetCluster,
-			Type:          domain.TypeCustom,
-			Validated:     d.Validated,
+			ID:                  d.ID,
+			Domain:              d.Domain,
+			AccountID:           accountID,
+			TargetCluster:       d.TargetCluster,
+			Type:                domain.TypeCustom,
+			Validated:           d.Validated,
+			ValidationExpiresAt: d.ValidationExpiresAt,
 		}
 		if d.TargetCluster != "" {
 			cd.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, d.TargetCluster)
@@ -121,6 +131,7 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 	return ret, nil
 }
 
+// CreateDomain registers a normalized custom domain and attempts DNS validation.
 func (m Manager) CreateDomain(ctx context.Context, accountID, userID, domainName, targetCluster string) (*domain.Domain, error) {
 	ok, ctx, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Services, operations.Create)
 	if err != nil {
@@ -130,6 +141,15 @@ func (m Manager) CreateDomain(ctx context.Context, accountID, userID, domainName
 		return nil, status.NewPermissionDeniedError()
 	}
 
+	parsed, err := nbdomain.FromString(strings.TrimSuffix(domainName, "."))
+	if err != nil {
+		return nil, status.Errorf(status.InvalidArgument, "invalid domain: %v", err)
+	}
+	domainName = parsed.PunycodeString()
+	if !nbdomain.IsValidDomainNoWildcard(domainName) {
+		return nil, status.Errorf(status.InvalidArgument, "invalid domain format")
+	}
+
 	// Verify the target cluster is in the available clusters for this account
 	allowList, err := m.getClusterAllowList(ctx, accountID)
 	if err != nil {
@@ -146,6 +166,10 @@ func (m Manager) CreateDomain(ctx context.Context, accountID, userID, domainName
 		return nil, fmt.Errorf("target cluster %s is not available", targetCluster)
 	}
 
+	if err := m.checkDomainAvailable(ctx, domainName); err != nil {
+		return nil, err
+	}
+
 	// Attempt an initial validation against the specified cluster only
 	var validated bool
 	if m.validator.IsValid(ctx, domainName, []string{targetCluster}) {
@@ -162,6 +186,23 @@ func (m Manager) CreateDomain(ctx context.Context, accountID, userID, domainName
 	return d, nil
 }
 
+// checkDomainAvailable reports whether the domain is free to claim. The unique
+// index on the column is the real guard; this turns the violation into a
+// conflict the caller can act on instead of a database error, and says nothing
+// about which account holds the domain.
+func (m Manager) checkDomainAvailable(ctx context.Context, domainName string) error {
+	_, err := m.store.GetCustomDomainByName(ctx, domainName)
+	if err == nil {
+		return status.Errorf(status.AlreadyExists, "domain %s is already registered", domainName)
+	}
+
+	if sErr, ok := status.FromError(err); ok && sErr.Type() == status.NotFound {
+		return nil
+	}
+
+	return fmt.Errorf("look up domain: %w", err)
+}
+
 func (m Manager) DeleteDomain(ctx context.Context, accountID, userID, domainID string) error {
 	ok, ctx, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Services, operations.Delete)
 	if err != nil {
@@ -186,20 +227,19 @@ func (m Manager) DeleteDomain(ctx context.Context, accountID, userID, domainID s
 	return nil
 }
 
-func (m Manager) ValidateDomain(ctx context.Context, accountID, userID, domainID string) {
-	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Services, operations.Create)
+// validationTimeout bounds the DNS check so it ends, and reports why, before a proxy in
+// front of management times the request out.
+const validationTimeout = 10 * time.Second
+
+// ValidateDomain checks the domain's validation CNAME and marks it validated. A failure
+// the user can act on is returned as PreconditionFailed carrying the reason.
+func (m Manager) ValidateDomain(ctx context.Context, accountID, userID, domainID string) error {
+	ok, ctx, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Services, operations.Create)
 	if err != nil {
-		log.WithFields(log.Fields{
-			"accountID": accountID,
-			"domainID":  domainID,
-		}).WithError(err).Error("validate domain")
-		return
+		return status.NewPermissionValidationError(err)
 	}
 	if !ok {
-		log.WithFields(log.Fields{
-			"accountID": accountID,
-			"domainID":  domainID,
-		}).WithError(err).Error("validate domain")
+		return status.NewPermissionDeniedError()
 	}
 
 	log.WithFields(log.Fields{
@@ -207,24 +247,23 @@ func (m Manager) ValidateDomain(ctx context.Context, accountID, userID, domainID
 		"domainID":  domainID,
 	}).Info("starting domain validation")
 
-	d, err := m.store.GetCustomDomain(context.Background(), accountID, domainID)
+	d, err := m.store.GetCustomDomain(ctx, accountID, domainID)
 	if err != nil {
-		log.WithFields(log.Fields{
-			"accountID": accountID,
-			"domainID":  domainID,
-		}).WithError(err).Error("get custom domain from store")
-		return
+		return fmt.Errorf("get domain from store: %w", err)
+	}
+	if d.Validated {
+		return nil
+	}
+	if d.ValidationExpiresAt == nil || !time.Now().Before(*d.ValidationExpiresAt) {
+		return validationFailed(domain.NewValidationError(domain.ValidationReasonExpired,
+			"custom domain %s validation window has expired; delete and add the domain again", d.Domain))
 	}
 
 	// Validate only against the domain's target cluster
 	targetCluster := d.TargetCluster
 	if targetCluster == "" {
-		log.WithFields(log.Fields{
-			"accountID": accountID,
-			"domainID":  domainID,
-			"domain":    d.Domain,
-		}).Warn("domain has no target cluster set, skipping validation")
-		return
+		return validationFailed(domain.NewValidationError(domain.ValidationReasonNoTargetCluster,
+			"custom domain %s has no target cluster", d.Domain))
 	}
 
 	log.WithFields(log.Fields{
@@ -234,31 +273,35 @@ func (m Manager) ValidateDomain(ctx context.Context, accountID, userID, domainID
 		"targetCluster": targetCluster,
 	}).Info("validating domain against target cluster")
 
-	if m.validator.IsValid(context.Background(), d.Domain, []string{targetCluster}) {
-		log.WithFields(log.Fields{
-			"accountID": accountID,
-			"domainID":  domainID,
-			"domain":    d.Domain,
-		}).Info("domain validated successfully")
+	lookupCtx, cancel := context.WithTimeout(ctx, validationTimeout)
+	_, err = m.validator.Validate(lookupCtx, d.Domain, []string{targetCluster})
+	cancel()
+	if err == nil {
 		d.Validated = true
-		if _, err := m.store.UpdateCustomDomain(context.Background(), accountID, d); err != nil {
-			log.WithFields(log.Fields{
-				"accountID": accountID,
-				"domainID":  domainID,
-				"domain":    d.Domain,
-			}).WithError(err).Error("update custom domain in store")
-			return
+		if _, err := m.store.UpdateCustomDomain(ctx, accountID, d); err != nil {
+			// A concurrent request may have validated the domain first.
+			if current, getErr := m.store.GetCustomDomain(ctx, accountID, domainID); getErr == nil && current.Validated {
+				return nil
+			}
+			return fmt.Errorf("update domain in store: %w", err)
 		}
+		log.WithFields(log.Fields{"accountID": accountID, "domainID": domainID}).
+			Info("custom domain validated successfully")
 
-		m.accountManager.StoreEvent(context.Background(), userID, domainID, accountID, activity.DomainValidated, d.EventMeta())
-	} else {
-		log.WithFields(log.Fields{
-			"accountID":     accountID,
-			"domainID":      domainID,
-			"domain":        d.Domain,
-			"targetCluster": targetCluster,
-		}).Warn("domain validation failed - CNAME does not match target cluster")
+		m.accountManager.StoreEvent(ctx, userID, domainID, accountID, activity.DomainValidated, d.EventMeta())
+		return nil
 	}
+
+	return validationFailed(err)
+}
+
+// validationFailed shows a classified failure to the user and keeps anything else internal.
+func validationFailed(err error) error {
+	var vErr *domain.ValidationError
+	if errors.As(err, &vErr) {
+		return status.Errorf(status.PreconditionFailed, "%s", vErr.Message)
+	}
+	return fmt.Errorf("validate domain: %w", err)
 }
 
 // GetClusterDomains returns a list of proxy cluster domains.
@@ -294,14 +337,37 @@ func (m Manager) DeriveClusterFromDomain(ctx context.Context, accountID, domain
 		return "", fmt.Errorf("list custom domains: %w", err)
 	}
 
-	targetCluster, valid := extractClusterFromCustomDomains(domain, customDomains)
-	if valid {
+	targetCluster, match := extractClusterFromCustomDomains(domain, customDomains)
+	switch match {
+	case customDomainValidated:
 		return targetCluster, nil
+	case customDomainUnvalidated:
+		return "", status.Errorf(status.PreconditionFailed, "domain %s is not validated", domain)
 	}
 
 	return "", fmt.Errorf("domain %s does not match any available proxy cluster", domain)
 }
 
+// ValidateServiceDomain holds custom domain authorization through a service write transaction.
+func (m Manager) ValidateServiceDomain(ctx context.Context, tx nbstore.Store, accountID, serviceDomain, cluster string) error {
+	if _, ok := ExtractClusterFromFreeDomain(serviceDomain, []string{cluster}); ok {
+		return nil
+	}
+	name, err := nbdomain.FromString(serviceDomain)
+	if err != nil {
+		return status.Errorf(status.InvalidArgument, "invalid service domain: %v", err)
+	}
+	customDomains, err := tx.LockCustomDomains(ctx, accountID, name)
+	if err != nil {
+		return err
+	}
+	target, match := extractClusterFromCustomDomains(serviceDomain, customDomains)
+	if match != customDomainValidated || target != cluster {
+		return status.Errorf(status.PreconditionFailed, "custom domain authorization changed; retry the service operation")
+	}
+	return nil
+}
+
 func (m Manager) getClusterAllowList(ctx context.Context, accountID string) ([]string, error) {
 	byopAddresses, err := m.proxyManager.GetActiveClusterAddressesForAccount(ctx, accountID)
 	if err != nil {
@@ -311,17 +377,21 @@ func (m Manager) getClusterAllowList(ctx context.Context, accountID string) ([]s
 	if err != nil {
 		return nil, fmt.Errorf("get public cluster addresses: %w", err)
 	}
+	reserved, err := m.reservedGatewayAddress(ctx, accountID)
+	if err != nil {
+		return nil, err
+	}
 	seen := make(map[string]struct{}, len(byopAddresses)+len(publicAddresses))
 	merged := make([]string, 0, len(byopAddresses)+len(publicAddresses))
 	for _, addr := range byopAddresses {
-		if _, ok := seen[addr]; ok {
+		if _, ok := seen[addr]; ok || addr == reserved {
 			continue
 		}
 		seen[addr] = struct{}{}
 		merged = append(merged, addr)
 	}
 	for _, addr := range publicAddresses {
-		if _, ok := seen[addr]; ok {
+		if _, ok := seen[addr]; ok || addr == reserved {
 			continue
 		}
 		seen[addr] = struct{}{}
@@ -330,19 +400,71 @@ func (m Manager) getClusterAllowList(ctx context.Context, accountID string) ([]s
 	return merged, nil
 }
 
-func extractClusterFromCustomDomains(serviceDomain string, customDomains []*domain.Domain) (string, bool) {
+// reservedGatewayAddress returns the account's agent-network gateway address
+// when its settings pin is self-addressed — a proxy dedicated to serving
+// exactly the gateway. Dropping that address from the cluster allow list keeps
+// it from being offered as a cluster for ordinary services, and because the
+// free-domain suffix match is depth-independent, dropping the address rejects
+// every name beneath it as well as the bare one. Only the account's own
+// gateway address can ever appear in its allow list (another tenant's gateway
+// proxy is account-scoped to them), so this single-address exclusion is
+// sufficient. Returns "" when the account has no settings row or a labeled
+// (shared-cluster) pin.
+func (m Manager) reservedGatewayAddress(ctx context.Context, accountID string) (string, error) {
+	settings, err := m.store.GetAgentNetworkSettings(ctx, nbstore.LockingStrengthNone, accountID)
+	if err != nil {
+		var sErr *status.Error
+		if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
+			return "", nil
+		}
+		return "", fmt.Errorf("get agent network settings: %w", err)
+	}
+	if settings == nil || !settings.Dedicated() {
+		return "", nil
+	}
+	return settings.ProxyAddress, nil
+}
+
+// customDomainMatch describes how a service domain relates to the account's
+// custom domain rows.
+type customDomainMatch int
+
+const (
+	customDomainNoMatch customDomainMatch = iota
+	customDomainUnvalidated
+	customDomainValidated
+)
+
+// extractClusterFromCustomDomains finds the longest custom domain covering the
+// service domain and reports its target cluster. Only a validated row yields a
+// cluster: until the CNAME check has passed the account has not shown it
+// controls the name, so no traffic may be routed for it.
+func extractClusterFromCustomDomains(serviceDomain string, customDomains []*domain.Domain) (string, customDomainMatch) {
 	bestCluster := ""
 	bestLen := -1
+	matched := false
 	for _, cd := range customDomains {
 		if serviceDomain != cd.Domain && !strings.HasSuffix(serviceDomain, "."+cd.Domain) {
 			continue
 		}
+		matched = true
+		if !cd.Validated {
+			continue
+		}
 		if l := len(cd.Domain); l > bestLen {
 			bestLen = l
 			bestCluster = cd.TargetCluster
 		}
 	}
-	return bestCluster, bestLen >= 0
+
+	switch {
+	case bestLen >= 0:
+		return bestCluster, customDomainValidated
+	case matched:
+		return "", customDomainUnvalidated
+	default:
+		return "", customDomainNoMatch
+	}
 }
 
 // ExtractClusterFromFreeDomain extracts the cluster address from a free domain.
diff --git a/management/internals/modules/reverseproxy/domain/manager/manager_realstore_test.go b/management/internals/modules/reverseproxy/domain/manager/manager_realstore_test.go
new file mode 100644
index 000000000..dfb999fbd
--- /dev/null
+++ b/management/internals/modules/reverseproxy/domain/manager/manager_realstore_test.go
@@ -0,0 +1,321 @@
+package manager
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/metric/noop"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/mock_server"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const (
+	testCluster    = "eu.proxy.test"
+	accountA       = "account-a"
+	accountAUser   = "account-a-admin"
+	accountB       = "account-b"
+	accountBUser   = "account-b-admin"
+	accountAMember = "account-a-member"
+)
+
+// stubResolver answers CNAME lookups from a table the test controls, so a
+// domain can point at the cluster or nowhere without touching a real resolver.
+type stubResolver struct {
+	mu     sync.Mutex
+	cnames map[string]string
+}
+
+func (r *stubResolver) LookupCNAME(_ context.Context, host string) (string, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	cname, ok := r.cnames[host]
+	if !ok {
+		return "", fmt.Errorf("lookup %s: no such host", host)
+	}
+	return cname + ".", nil
+}
+
+func (r *stubResolver) set(host, cname string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.cnames[host] = cname
+}
+
+type domainTestEnv struct {
+	manager  Manager
+	store    nbstore.Store
+	resolver *stubResolver
+}
+
+// setupDomainTest builds the domain manager on a real SQLite store with two
+// accounts and one active public proxy cluster.
+func setupDomainTest(t *testing.T) *domainTestEnv {
+	t.Helper()
+
+	ctx := context.Background()
+	testStore, cleanup, err := nbstore.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	for accountID, userID := range map[string]string{accountA: accountAUser, accountB: accountBUser} {
+		users := map[string]*types.User{
+			userID: {
+				Id:        userID,
+				AccountID: accountID,
+				Role:      types.UserRoleAdmin,
+			},
+		}
+		if accountID == accountA {
+			// A real member of the account whose role denies Services:Create, so
+			// permission denial is exercised as ok=false rather than as a lookup
+			// error for a user who is not in the account at all.
+			users[accountAMember] = &types.User{
+				Id:        accountAMember,
+				AccountID: accountID,
+				Role:      types.UserRoleUser,
+			}
+		}
+
+		require.NoError(t, testStore.SaveAccount(ctx, &types.Account{
+			Id:        accountID,
+			CreatedBy: userID,
+			Settings:  &types.Settings{},
+			Users:     users,
+		}))
+	}
+
+	proxyMgr, err := proxymanager.NewManager(testStore, noop.NewMeterProvider().Meter(""))
+	require.NoError(t, err)
+
+	_, err = proxyMgr.Connect(ctx, "proxy-1", "session-1", testCluster, "127.0.0.1", "", nil, nil)
+	require.NoError(t, err)
+
+	resolver := &stubResolver{cnames: make(map[string]string)}
+
+	mgr := Manager{
+		store:              testStore,
+		proxyManager:       proxyMgr,
+		validator:          domain.Validator{Resolver: resolver},
+		permissionsManager: permissions.NewManager(testStore),
+		accountManager: &mock_server.MockAccountManager{
+			StoreEventFunc: func(context.Context, string, string, string, activity.ActivityDescriber, map[string]any) {},
+		},
+	}
+
+	return &domainTestEnv{manager: mgr, store: testStore, resolver: resolver}
+}
+
+// storedDomain reads a domain row back through the store so assertions are made
+// on what was persisted rather than on the value the manager returned.
+func storedDomain(t *testing.T, s nbstore.Store, accountID, domainName string) *domain.Domain {
+	t.Helper()
+
+	domains, err := s.ListCustomDomains(context.Background(), accountID)
+	require.NoError(t, err)
+	for _, d := range domains {
+		if d.Domain == domainName {
+			return d
+		}
+	}
+	return nil
+}
+
+// A domain whose CNAME check fails is stored unvalidated and must not resolve a
+// cluster, which is what service creation gates on.
+func TestCreateDomain_FailedLookupIsNotServable(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "apps.example.com", testCluster)
+	require.NoError(t, err)
+	assert.False(t, created.Validated, "a domain whose CNAME lookup fails must not be created validated")
+
+	stored := storedDomain(t, env.store, accountA, "apps.example.com")
+	require.NotNil(t, stored, "domain row should exist")
+	assert.False(t, stored.Validated, "persisted row must be unvalidated")
+
+	cluster, err := env.manager.DeriveClusterFromDomain(ctx, accountA, "apps.example.com")
+	require.Error(t, err, "an unvalidated domain must not resolve a cluster")
+	assert.Empty(t, cluster)
+	assert.Contains(t, err.Error(), "not validated", "error should tell the caller what to fix")
+
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "error should be a typed status error")
+	assert.Equal(t, status.PreconditionFailed, sErr.Type())
+
+	_, err = env.manager.DeriveClusterFromDomain(ctx, accountA, "sub.apps.example.com")
+	assert.Error(t, err, "subdomains of an unvalidated custom domain are not servable either")
+}
+
+// A second account claiming a registered domain gets a clean conflict, not a
+// database error surfaced as a 500.
+func TestCreateDomain_DuplicateIsAConflict(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	_, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "shared.example.com", testCluster)
+	require.NoError(t, err)
+
+	_, err = env.manager.CreateDomain(ctx, accountB, accountBUser, "shared.example.com", testCluster)
+	require.Error(t, err)
+
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "conflict must be a typed status error, not a raw database error")
+	assert.Equal(t, status.AlreadyExists, sErr.Type(), "conflict should map to 409, not 500")
+	assert.NotContains(t, sErr.Message, accountA, "the response must not reveal the holding account")
+
+	assert.Nil(t, storedDomain(t, env.store, accountB, "shared.example.com"), "no row should be written on conflict")
+}
+
+// The same account re-adding one of its own domains is a conflict too.
+func TestCreateDomain_SameAccountDuplicateIsAConflict(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	_, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "dup.example.com", testCluster)
+	require.NoError(t, err)
+
+	_, err = env.manager.CreateDomain(ctx, accountA, accountAUser, "dup.example.com", testCluster)
+	require.Error(t, err)
+
+	sErr, ok := status.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, status.AlreadyExists, sErr.Type())
+}
+
+// The negative control: a validated domain still derives its cluster, for the
+// bare name and for subdomains, exactly as before.
+func TestCreateDomain_ValidatedDomainDerivesCluster(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+	env.resolver.set("validation.valid.example.com", testCluster)
+
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "valid.example.com", testCluster)
+	require.NoError(t, err)
+	require.True(t, created.Validated, "a matching CNAME should validate on create")
+
+	cluster, err := env.manager.DeriveClusterFromDomain(ctx, accountA, "valid.example.com")
+	require.NoError(t, err)
+	assert.Equal(t, testCluster, cluster)
+
+	cluster, err = env.manager.DeriveClusterFromDomain(ctx, accountA, "app.valid.example.com")
+	require.NoError(t, err)
+	assert.Equal(t, testCluster, cluster, "subdomains of a validated custom domain resolve too")
+}
+
+// Validating a domain flips the gate: the same lookup that failed before now
+// resolves a cluster.
+func TestValidateDomain_UnlocksClusterDerivation(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "later.example.com", testCluster)
+	require.NoError(t, err)
+	require.False(t, created.Validated)
+
+	_, err = env.manager.DeriveClusterFromDomain(ctx, accountA, "later.example.com")
+	require.Error(t, err)
+
+	env.resolver.set("validation.later.example.com", testCluster)
+	require.NoError(t, env.manager.ValidateDomain(ctx, accountA, accountAUser, created.ID))
+
+	require.True(t, storedDomain(t, env.store, accountA, "later.example.com").Validated)
+
+	cluster, err := env.manager.DeriveClusterFromDomain(ctx, accountA, "later.example.com")
+	require.NoError(t, err)
+	assert.Equal(t, testCluster, cluster)
+}
+
+// Free cluster domains are unaffected by the custom domain gate.
+func TestDeriveClusterFromDomain_FreeDomainUnaffected(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	cluster, err := env.manager.DeriveClusterFromDomain(ctx, accountA, "myapp.abc123."+testCluster)
+	require.NoError(t, err)
+	assert.Equal(t, testCluster, cluster)
+}
+
+// The manager pre-check exists to turn a conflict into a 409, but the unique
+// index on the column is what actually guarantees the domain is claimed once.
+//
+// Two requests can clear the pre-check concurrently and race to the insert.
+// Inserting twice through the store reaches the same code path the loser of
+// that race takes, without the nondeterminism of driving it from goroutines,
+// and the loser must still see a conflict rather than an internal error.
+func TestStore_DuplicateDomainRejectedByIndexAsConflict(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	_, err := env.store.CreateCustomDomain(ctx, accountA, "indexed.example.com", testCluster, false)
+	require.NoError(t, err)
+
+	_, err = env.store.CreateCustomDomain(ctx, accountB, "indexed.example.com", testCluster, false)
+	require.Error(t, err, "the unique index must reject the same domain in a second account")
+
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "the losing insert must return a typed status error")
+	assert.Equal(t, status.AlreadyExists, sErr.Type(), "a lost race is a 409, not a 500")
+}
+
+// Validation is what decides whether a domain routes traffic, so a caller
+// without permission to it must not be able to flip the flag. The check logged
+// the denial and then carried on, which was inert while nothing read Validated
+// and is not once cluster derivation gates on it.
+func TestValidateDomain_PermissionDeniedDoesNotValidate(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "guarded.example.com", testCluster)
+	require.NoError(t, err)
+	require.False(t, created.Validated)
+
+	// The CNAME is in place, so the only thing standing between this caller and
+	// a validated domain is the permission check.
+	env.resolver.set("validation.guarded.example.com", testCluster)
+
+	assert.Error(t, env.manager.ValidateDomain(ctx, accountA, accountAMember, created.ID), "a caller without permission must be refused")
+
+	stored := storedDomain(t, env.store, accountA, "guarded.example.com")
+	require.NotNil(t, stored)
+	assert.False(t, stored.Validated, "a caller without permission must not validate the domain")
+
+	_, err = env.manager.DeriveClusterFromDomain(ctx, accountA, "guarded.example.com")
+	assert.Error(t, err, "the domain must still be unservable")
+}
+
+// A validation finishing after deletion must reject the stale write, without
+// restoring the registration or reporting successful validation.
+func TestUpdateCustomDomain_DoesNotResurrectDeletedDomain(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "racy.example.com", testCluster)
+	require.NoError(t, err)
+
+	stale := storedDomain(t, env.store, accountA, "racy.example.com")
+	require.NotNil(t, stale)
+
+	require.NoError(t, env.manager.DeleteDomain(ctx, accountA, accountAUser, created.ID))
+	require.Nil(t, storedDomain(t, env.store, accountA, "racy.example.com"), "the domain should be gone")
+
+	// What an in-flight validation would write once its CNAME check succeeded.
+	stale.Validated = true
+	_, err = env.store.UpdateCustomDomain(ctx, accountA, stale)
+	require.Error(t, err, "a deleted registration must reject a late validation")
+
+	assert.Nil(t, storedDomain(t, env.store, accountA, "racy.example.com"),
+		"a late validation write must not recreate a deleted domain")
+}
diff --git a/management/internals/modules/reverseproxy/domain/manager/manager_test.go b/management/internals/modules/reverseproxy/domain/manager/manager_test.go
index 53a8dedae..1ca690130 100644
--- a/management/internals/modules/reverseproxy/domain/manager/manager_test.go
+++ b/management/internals/modules/reverseproxy/domain/manager/manager_test.go
@@ -4,9 +4,16 @@ import (
 	"context"
 	"errors"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	agentnetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 type mockProxyManager struct {
@@ -55,7 +62,7 @@ func TestGetClusterAllowList_BYOPMergedWithPublic(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{proxyManager: pm}
+	mgr := Manager{store: &stubStore{}, proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"byop.example.com", "eu.proxy.netbird.io"}, result)
@@ -71,7 +78,7 @@ func TestGetClusterAllowList_DeduplicatesBYOPAndPublic(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{proxyManager: pm}
+	mgr := Manager{store: &stubStore{}, proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"shared.example.com", "byop.example.com", "eu.proxy.netbird.io"}, result)
@@ -87,7 +94,7 @@ func TestGetClusterAllowList_NoBYOP_FallbackToShared(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{proxyManager: pm}
+	mgr := Manager{store: &stubStore{}, proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"eu.proxy.netbird.io", "us.proxy.netbird.io"}, result)
@@ -100,7 +107,7 @@ func TestGetClusterAllowList_BYOPError_ReturnsError(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{proxyManager: pm}
+	mgr := Manager{store: &stubStore{}, proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.Error(t, err)
 	assert.Nil(t, result)
@@ -117,7 +124,7 @@ func TestGetClusterAllowList_PublicError_ReturnsError(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{proxyManager: pm}
+	mgr := Manager{store: &stubStore{}, proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.Error(t, err)
 	assert.Nil(t, result)
@@ -134,7 +141,7 @@ func TestGetClusterAllowList_BYOPEmptySlice_FallbackToShared(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{proxyManager: pm}
+	mgr := Manager{store: &stubStore{}, proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"eu.proxy.netbird.io"}, result)
@@ -150,8 +157,150 @@ func TestGetClusterAllowList_PublicEmpty_BYOPOnly(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{proxyManager: pm}
+	mgr := Manager{store: &stubStore{}, proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"byop.example.com"}, result)
 }
+
+// stubStore satisfies the manager's narrow store interface for allow-list
+// tests. Only the agent-network settings lookup participates; the default (a
+// nil func) reads as "no settings row", the state most accounts are in.
+type stubStore struct {
+	getAgentNetworkSettingsFunc func(ctx context.Context, accountID string) (*agentnetworkTypes.Settings, error)
+}
+
+func (s *stubStore) GetAccount(context.Context, string) (*types.Account, error) {
+	panic("not used in allow-list tests")
+}
+
+func (s *stubStore) GetAgentNetworkSettings(ctx context.Context, _ nbstore.LockingStrength, accountID string) (*agentnetworkTypes.Settings, error) {
+	if s.getAgentNetworkSettingsFunc != nil {
+		return s.getAgentNetworkSettingsFunc(ctx, accountID)
+	}
+	return nil, status.Errorf(status.NotFound, "agent network settings for account %s not found", accountID)
+}
+
+func (s *stubStore) GetCustomDomain(context.Context, string, string) (*domain.Domain, error) {
+	panic("not used in allow-list tests")
+}
+
+func (s *stubStore) GetCustomDomainByName(context.Context, string) (*domain.Domain, error) {
+	panic("not used in allow-list tests")
+}
+
+func (s *stubStore) ListFreeDomains(context.Context, string) ([]string, error) {
+	panic("not used in allow-list tests")
+}
+
+func (s *stubStore) ListCustomDomains(context.Context, string) ([]*domain.Domain, error) {
+	panic("not used in allow-list tests")
+}
+
+func (s *stubStore) CreateCustomDomain(context.Context, string, string, string, bool) (*domain.Domain, error) {
+	panic("not used in allow-list tests")
+}
+
+func (s *stubStore) UpdateCustomDomain(context.Context, string, *domain.Domain) (*domain.Domain, error) {
+	panic("not used in allow-list tests")
+}
+
+func (s *stubStore) DeleteCustomDomain(context.Context, string, string) error {
+	panic("not used in allow-list tests")
+}
+
+func (s *stubStore) GetExpiredCustomDomains(context.Context, time.Time, domain.ID, int) ([]*domain.Domain, error) {
+	panic("not used in allow-list tests")
+}
+
+func (s *stubStore) DeleteExpiredCustomDomain(context.Context, *domain.Domain, time.Time) (bool, error) {
+	panic("not used in allow-list tests")
+}
+
+// TestGetClusterAllowList_DedicatedGatewayAddressExcluded pins invariant (B)'s
+// chokepoint: a self-addressed settings pin reserves the account's gateway
+// address, so it is dropped from the allow list — which, because the
+// free-domain suffix match is depth-independent, rejects every name beneath
+// it as well as the bare one. Other addresses are unaffected.
+func TestGetClusterAllowList_DedicatedGatewayAddressExcluded(t *testing.T) {
+	pm := &mockProxyManager{
+		getActiveClusterAddressesForAccountFunc: func(_ context.Context, _ string) ([]string, error) {
+			return []string{"brave-otter.gateway.example.com", "byop.example.com"}, nil
+		},
+		getActiveClusterAddressesFunc: func(_ context.Context) ([]string, error) {
+			return []string{"eu.proxy.netbird.io"}, nil
+		},
+	}
+	st := &stubStore{
+		getAgentNetworkSettingsFunc: func(_ context.Context, accountID string) (*agentnetworkTypes.Settings, error) {
+			assert.Equal(t, "acc-123", accountID,
+				"the exclusion must look up the requesting account's own settings")
+			return &agentnetworkTypes.Settings{
+				AccountID:    accountID,
+				Domain:       "brave-otter.gateway.example.com",
+				ProxyAddress: "brave-otter.gateway.example.com",
+			}, nil
+		},
+	}
+
+	mgr := Manager{store: st, proxyManager: pm}
+	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"byop.example.com", "eu.proxy.netbird.io"}, result,
+		"the dedicated gateway address must be reserved from cluster selection")
+}
+
+// TestGetClusterAllowList_LabeledPinDoesNotExclude pins the counterpart: a
+// labeled pin means the gateway rides on a shared cluster serving ordinary
+// services too, so nothing is reserved.
+func TestGetClusterAllowList_LabeledPinDoesNotExclude(t *testing.T) {
+	pm := &mockProxyManager{
+		getActiveClusterAddressesForAccountFunc: func(_ context.Context, _ string) ([]string, error) {
+			return []string{"byop.example.com"}, nil
+		},
+		getActiveClusterAddressesFunc: func(_ context.Context) ([]string, error) {
+			return []string{"eu.proxy.netbird.io"}, nil
+		},
+	}
+	st := &stubStore{
+		getAgentNetworkSettingsFunc: func(_ context.Context, accountID string) (*agentnetworkTypes.Settings, error) {
+			return &agentnetworkTypes.Settings{
+				AccountID:    accountID,
+				Domain:       "violet.eu.proxy.netbird.io",
+				ProxyAddress: "eu.proxy.netbird.io",
+			}, nil
+		},
+	}
+
+	mgr := Manager{store: st, proxyManager: pm}
+	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"byop.example.com", "eu.proxy.netbird.io"}, result,
+		"a labeled pin reserves nothing")
+}
+
+// TestGetClusterAllowList_SettingsLookupError_ReturnsError pins that a store
+// outage is surfaced rather than silently treated as "nothing reserved" —
+// failing open here would offer a reserved gateway address for ordinary
+// services.
+func TestGetClusterAllowList_SettingsLookupError_ReturnsError(t *testing.T) {
+	pm := &mockProxyManager{
+		getActiveClusterAddressesForAccountFunc: func(_ context.Context, _ string) ([]string, error) {
+			return []string{"byop.example.com"}, nil
+		},
+		getActiveClusterAddressesFunc: func(_ context.Context) ([]string, error) {
+			return []string{"eu.proxy.netbird.io"}, nil
+		},
+	}
+	st := &stubStore{
+		getAgentNetworkSettingsFunc: func(_ context.Context, _ string) (*agentnetworkTypes.Settings, error) {
+			return nil, status.Errorf(status.Internal, "store outage")
+		},
+	}
+
+	mgr := Manager{store: st, proxyManager: pm}
+	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
+	require.Error(t, err)
+	assert.Nil(t, result)
+	assert.Contains(t, err.Error(), "agent network settings")
+}
diff --git a/management/internals/modules/reverseproxy/domain/manager/normalization_test.go b/management/internals/modules/reverseproxy/domain/manager/normalization_test.go
new file mode 100644
index 000000000..810454c57
--- /dev/null
+++ b/management/internals/modules/reverseproxy/domain/manager/normalization_test.go
@@ -0,0 +1,83 @@
+package manager
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestCreateDomain_NormalizesName(t *testing.T) {
+	for _, tt := range []struct {
+		name      string
+		input     string
+		canonical string
+	}{
+		{"mixed case", "Apps.Example.COM", "apps.example.com"},
+		{"unicode", "münchen.example.com", "xn--mnchen-3ya.example.com"},
+		{"trailing dot", "apps.example.com.", "apps.example.com"},
+		{"underscore", "My_App.example.com", "my_app.example.com"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			env := setupDomainTest(t)
+			env.resolver.set("validation."+tt.canonical, testCluster)
+
+			created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, tt.input, testCluster)
+			require.NoError(t, err)
+			assert.Equal(t, tt.canonical, created.Domain, "the response must use the normalized name")
+			assert.True(t, created.Validated, "the CNAME lookup must use the normalized name")
+			stored, err := env.store.GetCustomDomain(ctx, accountA, created.ID)
+			require.NoError(t, err)
+			assert.Equal(t, tt.canonical, stored.Domain, "the database must retain the normalized name")
+
+			_, err = env.manager.CreateDomain(ctx, accountB, accountBUser, tt.canonical, testCluster)
+			require.Error(t, err)
+			sErr, ok := status.FromError(err)
+			require.True(t, ok, "an equivalent name must return a typed conflict")
+			assert.Equal(t, status.AlreadyExists, sErr.Type(), "normalization must precede the availability check")
+		})
+	}
+}
+
+func TestCreateDomain_NormalizedNameCanValidateLater(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+	created, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "Apps.Example.COM.", testCluster)
+	require.NoError(t, err)
+	require.False(t, created.Validated, "a missing CNAME must leave the normalized registration pending")
+
+	env.resolver.set("validation.apps.example.com", testCluster)
+	require.NoError(t, env.manager.ValidateDomain(ctx, accountA, accountAUser, created.ID))
+	stored, err := env.store.GetCustomDomain(ctx, accountA, created.ID)
+	require.NoError(t, err)
+	assert.Equal(t, "apps.example.com", stored.Domain, "retrying validation must retain the normalized name")
+	assert.True(t, stored.Validated, "later validation must look up the normalized name")
+}
+
+func TestCreateDomain_RejectsInvalidName(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+	for _, name := range []string{
+		"", ".", "app..example.com", "app.example.com..", "-app.example.com",
+		"app%.example.com", "app!.example.com", "*.example.com", "app example.com",
+		"https://example.com", strings.Repeat("a", 64) + ".example.com",
+	} {
+		t.Run(name, func(t *testing.T) {
+			// A matching DNS response must not make a malformed name acceptable.
+			env.resolver.set("validation."+name, testCluster)
+			_, err := env.manager.CreateDomain(ctx, accountA, accountAUser, name, testCluster)
+			require.Error(t, err)
+			sErr, ok := status.FromError(err)
+			require.True(t, ok, "invalid names must return a typed client error")
+			assert.Equal(t, status.InvalidArgument, sErr.Type(), "malformed names must be rejected before storage")
+		})
+	}
+	stored, err := env.store.ListCustomDomains(ctx, accountA)
+	require.NoError(t, err)
+	assert.Empty(t, stored, "invalid registration attempts must not reserve any names")
+}
diff --git a/management/internals/modules/reverseproxy/domain/manager/validation_test.go b/management/internals/modules/reverseproxy/domain/manager/validation_test.go
new file mode 100644
index 000000000..b7800c6f5
--- /dev/null
+++ b/management/internals/modules/reverseproxy/domain/manager/validation_test.go
@@ -0,0 +1,151 @@
+package manager
+
+import (
+	"context"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// The validator tests cover each DNS outcome. These cover what the manager adds on top:
+// the status type the API turns into a response code, and the checks before the lookup.
+func TestValidateDomain_ReturnsReason(t *testing.T) {
+	ctx := context.Background()
+	tests := []struct {
+		name    string
+		setup   func(t *testing.T, env *domainTestEnv, d *domain.Domain)
+		user    string
+		want    status.Type
+		message string
+	}{
+		{
+			name: "cname mismatch",
+			setup: func(_ *testing.T, env *domainTestEnv, d *domain.Domain) {
+				env.resolver.set("validation."+d.Domain, "other.example.net")
+			},
+			want:    status.PreconditionFailed,
+			message: "CNAME record validation.test.example.com points to other.example.net; point it to " + testCluster,
+		},
+		{
+			name: "expired window",
+			setup: func(t *testing.T, env *domainTestEnv, d *domain.Domain) {
+				setDomainColumn(t, env, d, "validation_expires_at", time.Now().Add(-time.Second))
+			},
+			want:    status.PreconditionFailed,
+			message: "custom domain test.example.com validation window has expired; delete and add the domain again",
+		},
+		{
+			name: "no target cluster",
+			setup: func(t *testing.T, env *domainTestEnv, d *domain.Domain) {
+				setDomainColumn(t, env, d, "target_cluster", "")
+			},
+			want:    status.PreconditionFailed,
+			message: "custom domain test.example.com has no target cluster",
+		},
+		{
+			name: "permission denied",
+			setup: func(_ *testing.T, env *domainTestEnv, d *domain.Domain) {
+				env.resolver.set("validation."+d.Domain, testCluster)
+			},
+			user: accountAMember,
+			want: status.PermissionDenied,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			env := setupDomainTest(t)
+			d, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "test.example.com", testCluster)
+			require.NoError(t, err)
+			tt.setup(t, env, d)
+			user := accountAUser
+			if tt.user != "" {
+				user = tt.user
+			}
+
+			err = env.manager.ValidateDomain(ctx, accountA, user, d.ID)
+			sErr, ok := status.FromError(err)
+			require.True(t, ok, "expected a status error, got %v", err)
+			assert.Equal(t, tt.want, sErr.Type(), "status type")
+			if tt.message != "" {
+				assert.Equal(t, tt.message, sErr.Message, "user-facing message")
+			}
+			assert.False(t, storedDomain(t, env.store, accountA, d.Domain).Validated, "a failed check must not validate the domain")
+		})
+	}
+}
+
+func TestValidateDomain_SuccessIsIdempotent(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+	d, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "ok.example.com", testCluster)
+	require.NoError(t, err)
+	env.resolver.set("validation.ok.example.com", testCluster)
+
+	require.NoError(t, env.manager.ValidateDomain(ctx, accountA, accountAUser, d.ID))
+	assert.True(t, storedDomain(t, env.store, accountA, d.Domain).Validated, "domain should be validated")
+	assert.NoError(t, env.manager.ValidateDomain(ctx, accountA, accountAUser, d.ID), "an already validated domain is a success")
+}
+
+func setDomainColumn(t *testing.T, env *domainTestEnv, d *domain.Domain, column string, value any) {
+	t.Helper()
+	db := env.store.(*nbstore.SqlStore).GetDB()
+	require.NoError(t, db.Model(&domain.Domain{}).Where("id = ?", d.ID).Update(column, value).Error)
+}
+
+// Two verify requests can both read the domain as pending. The one that loses the store
+// update must still report success when the other one validated the domain.
+func TestValidateDomain_ConcurrentValidationSucceeds(t *testing.T) {
+	ctx := context.Background()
+	env := setupDomainTest(t)
+	d, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "twice.example.com", testCluster)
+	require.NoError(t, err)
+	resolver := blockingDomainResolver{started: make(chan struct{}), release: make(chan struct{})}
+	env.manager.validator.Resolver = resolver
+
+	done := make(chan error, 1)
+	go func() {
+		done <- env.manager.ValidateDomain(ctx, accountA, accountAUser, d.ID)
+	}()
+	<-resolver.started
+	// The other request completes while this one is still looking up the CNAME.
+	setDomainColumn(t, env, d, "validated", true)
+	close(resolver.release)
+
+	assert.NoError(t, <-done, "a domain validated by a concurrent request is a success")
+}
+
+// hangingResolver never answers, so only a deadline on the context ends the lookup.
+type hangingResolver struct{}
+
+func (hangingResolver) LookupCNAME(ctx context.Context, _ string) (string, error) {
+	<-ctx.Done()
+	return "", ctx.Err()
+}
+
+// A lookup that hangs must end on the validation timeout and still report the reason,
+// rather than leaving the request to whatever timeout sits in front of management.
+func TestValidateDomain_LookupTimeout(t *testing.T) {
+	env := setupClockDomainTest(t)
+	synctest.Test(t, func(t *testing.T) {
+		ctx := context.Background()
+		d, err := env.manager.CreateDomain(ctx, accountA, accountAUser, "slow.example.com", testCluster)
+		require.NoError(t, err)
+		env.manager.validator.Resolver = hangingResolver{}
+
+		start := time.Now()
+		err = env.manager.ValidateDomain(ctx, accountA, accountAUser, d.ID)
+		sErr, ok := status.FromError(err)
+		require.True(t, ok, "expected a status error, got %v", err)
+		assert.Equal(t, status.PreconditionFailed, sErr.Type(), "status type")
+		assert.Equal(t, "DNS lookup for validation.slow.example.com failed; retry the validation", sErr.Message, "user-facing message")
+		assert.Equal(t, validationTimeout, time.Since(start), "the lookup must end on the validation timeout")
+	})
+}
diff --git a/management/internals/modules/reverseproxy/domain/validator.go b/management/internals/modules/reverseproxy/domain/validator.go
index 9c23c1192..e8d1ea3d0 100644
--- a/management/internals/modules/reverseproxy/domain/validator.go
+++ b/management/internals/modules/reverseproxy/domain/validator.go
@@ -2,6 +2,8 @@ package domain
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"net"
 	"strings"
 
@@ -16,6 +18,33 @@ type Validator struct {
 	Resolver resolver
 }
 
+// ValidationReason classifies why a custom domain failed validation.
+type ValidationReason string
+
+const (
+	ValidationReasonCNAMENotFound   ValidationReason = "cname_not_found"
+	ValidationReasonCNAMEMismatch   ValidationReason = "cname_mismatch"
+	ValidationReasonLookupFailed    ValidationReason = "lookup_failed"
+	ValidationReasonExpired         ValidationReason = "validation_expired"
+	ValidationReasonNoTargetCluster ValidationReason = "no_target_cluster"
+)
+
+// ValidationError is a validation failure whose message is safe to show to the user.
+type ValidationError struct {
+	Reason  ValidationReason
+	Message string
+}
+
+// Error returns the user-facing message.
+func (e *ValidationError) Error() string {
+	return e.Message
+}
+
+// NewValidationError returns a ValidationError with a formatted message.
+func NewValidationError(reason ValidationReason, format string, args ...any) *ValidationError {
+	return &ValidationError{Reason: reason, Message: fmt.Sprintf(format, args...)}
+}
+
 // NewValidator initializes a validator with a specific DNS Resolver.
 // If a Validator is used without specifying a Resolver, then it will
 // use the net.DefaultResolver.
@@ -39,6 +68,13 @@ func (v *Validator) IsValid(ctx context.Context, domain string, accept []string)
 // ValidateWithCluster validates a custom domain and returns the matched cluster address.
 // Returns the cluster address and true if valid, or empty string and false if invalid.
 func (v *Validator) ValidateWithCluster(ctx context.Context, domain string, accept []string) (string, bool) {
+	cluster, err := v.Validate(ctx, domain, accept)
+	return cluster, err == nil
+}
+
+// Validate validates a custom domain and returns the matched cluster address.
+// On failure it returns a *ValidationError whose message is safe to show to the user.
+func (v *Validator) Validate(ctx context.Context, domain string, accept []string) (string, error) {
 	if v.Resolver == nil {
 		v.Resolver = net.DefaultResolver
 	}
@@ -56,10 +92,19 @@ func (v *Validator) ValidateWithCluster(ctx context.Context, domain string, acce
 			"domain":       domain,
 			"lookupDomain": lookupDomain,
 		}).WithError(err).Warn("CNAME lookup failed for domain validation")
-		return "", false
+		// Never forward the resolver error: its text includes the resolver address.
+		var dnsErr *net.DNSError
+		if errors.As(err, &dnsErr) && dnsErr.IsNotFound {
+			return "", cnameNotFound(lookupDomain, accept)
+		}
+		return "", NewValidationError(ValidationReasonLookupFailed, "DNS lookup for %s failed; retry the validation", lookupDomain)
 	}
 
 	nakedCNAME := strings.TrimSuffix(cname, ".")
+	// A name without a CNAME record resolves to itself.
+	if strings.EqualFold(nakedCNAME, lookupDomain) {
+		return "", cnameNotFound(lookupDomain, accept)
+	}
 	log.WithFields(log.Fields{
 		"domain":     domain,
 		"cname":      cname,
@@ -69,13 +114,13 @@ func (v *Validator) ValidateWithCluster(ctx context.Context, domain string, acce
 
 	for _, acceptDomain := range accept {
 		normalizedAccept := strings.TrimSuffix(acceptDomain, ".")
-		if nakedCNAME == normalizedAccept {
+		if strings.EqualFold(nakedCNAME, normalizedAccept) {
 			log.WithFields(log.Fields{
 				"domain":  domain,
 				"cname":   nakedCNAME,
 				"cluster": acceptDomain,
 			}).Info("domain CNAME matched cluster")
-			return acceptDomain, true
+			return acceptDomain, nil
 		}
 	}
 
@@ -84,5 +129,11 @@ func (v *Validator) ValidateWithCluster(ctx context.Context, domain string, acce
 		"cname":      nakedCNAME,
 		"acceptList": accept,
 	}).Warn("domain CNAME does not match any accepted cluster")
-	return "", false
+	return "", NewValidationError(ValidationReasonCNAMEMismatch, "CNAME record %s points to %s; point it to %s",
+		lookupDomain, nakedCNAME, strings.Join(accept, ", "))
+}
+
+func cnameNotFound(lookupDomain string, accept []string) *ValidationError {
+	return NewValidationError(ValidationReasonCNAMENotFound, "no CNAME record found for %s; point it to %s",
+		lookupDomain, strings.Join(accept, ", "))
 }
diff --git a/management/internals/modules/reverseproxy/domain/validator_test.go b/management/internals/modules/reverseproxy/domain/validator_test.go
index 1f9583728..8d47bca32 100644
--- a/management/internals/modules/reverseproxy/domain/validator_test.go
+++ b/management/internals/modules/reverseproxy/domain/validator_test.go
@@ -2,6 +2,8 @@ package domain_test
 
 import (
 	"context"
+	"errors"
+	"net"
 	"testing"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
@@ -36,6 +38,12 @@ func TestIsValid(t *testing.T) {
 			accept:   []string{"bar.example.com"},
 			expect:   false,
 		},
+		"match in other case": {
+			resolver: resolver{"Bar.Example.COM."},
+			domain:   "foo.example.com",
+			accept:   []string{"bar.example.com"},
+			expect:   true,
+		},
 		"accept trailing dot": {
 			resolver: resolver{"bar.example.com."},
 			domain:   "foo.example.com",
@@ -54,3 +62,61 @@ func TestIsValid(t *testing.T) {
 		})
 	}
 }
+
+type errResolver struct {
+	err error
+}
+
+func (r errResolver) LookupCNAME(context.Context, string) (string, error) {
+	return "", r.err
+}
+
+func TestValidate_Reason(t *testing.T) {
+	const notFound = "no CNAME record found for validation.foo.example.com; point it to eu.proxy.example.com"
+	tests := map[string]struct {
+		resolver interface {
+			LookupCNAME(context.Context, string) (string, error)
+		}
+		reason  domain.ValidationReason
+		message string
+	}{
+		"mismatch": {
+			resolver: resolver{"other.example.net."},
+			reason:   domain.ValidationReasonCNAMEMismatch,
+			message:  "CNAME record validation.foo.example.com points to other.example.net; point it to eu.proxy.example.com",
+		},
+		"no cname resolves to itself": {
+			resolver: resolver{"validation.foo.example.com."},
+			reason:   domain.ValidationReasonCNAMENotFound,
+			message:  notFound,
+		},
+		"no cname resolves to itself in other case": {
+			resolver: resolver{"Validation.Foo.example.com."},
+			reason:   domain.ValidationReasonCNAMENotFound,
+			message:  notFound,
+		},
+		"not found": {
+			resolver: errResolver{&net.DNSError{Err: "no such host", Name: "validation.foo.example.com", Server: "10.0.0.2:53", IsNotFound: true}},
+			reason:   domain.ValidationReasonCNAMENotFound,
+			message:  notFound,
+		},
+		"other error is not forwarded": {
+			resolver: errResolver{errors.New("dial udp 10.0.0.2:53: connect: network is unreachable")},
+			reason:   domain.ValidationReasonLookupFailed,
+			message:  "DNS lookup for validation.foo.example.com failed; retry the validation",
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			_, err := domain.NewValidator(test.resolver).Validate(t.Context(), "foo.example.com", []string{"eu.proxy.example.com"})
+			var vErr *domain.ValidationError
+			if !errors.As(err, &vErr) {
+				t.Fatalf("expected a *domain.ValidationError, got %v", err)
+			}
+			if vErr.Reason != test.reason || vErr.Message != test.message {
+				t.Errorf("expect %q %q, actual %q %q", test.reason, test.message, vErr.Reason, vErr.Message)
+			}
+		})
+	}
+}
diff --git a/management/internals/modules/reverseproxy/proxy/manager.go b/management/internals/modules/reverseproxy/proxy/manager.go
index 22f1007ec..9350ad9b9 100644
--- a/management/internals/modules/reverseproxy/proxy/manager.go
+++ b/management/internals/modules/reverseproxy/proxy/manager.go
@@ -1,6 +1,6 @@
 package proxy
 
-//go:generate go run github.com/golang/mock/mockgen -package proxy -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
+//go:generate go tool mockgen -package proxy -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
 
 import (
 	"context"
@@ -11,7 +11,7 @@ import (
 
 // Manager defines the interface for proxy operations
 type Manager interface {
-	Connect(ctx context.Context, proxyID, sessionID, clusterAddress, ipAddress string, accountID *string, capabilities *Capabilities) (*Proxy, error)
+	Connect(ctx context.Context, proxyID, sessionID, clusterAddress, ipAddress, version string, accountID *string, capabilities *Capabilities) (*Proxy, error)
 	Disconnect(ctx context.Context, proxyID, sessionID string) error
 	Heartbeat(ctx context.Context, p *Proxy) error
 	GetActiveClusterAddresses(ctx context.Context) ([]string, error)
@@ -20,6 +20,8 @@ type Manager interface {
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
+	ClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsSessionCode(ctx context.Context, clusterAddr string) bool
 	CleanupStale(ctx context.Context, inactivityDuration time.Duration) error
 	GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error)
 	CountAccountProxies(ctx context.Context, accountID string) (int64, error)
diff --git a/management/internals/modules/reverseproxy/proxy/manager/controller.go b/management/internals/modules/reverseproxy/proxy/manager/controller.go
index e5b3e9886..0e5064f63 100644
--- a/management/internals/modules/reverseproxy/proxy/manager/controller.go
+++ b/management/internals/modules/reverseproxy/proxy/manager/controller.go
@@ -36,7 +36,7 @@ func NewGRPCController(proxyGRPCServer *nbgrpc.ProxyServiceServer, meter metric.
 // SendServiceUpdateToCluster sends a service update to a specific proxy cluster.
 func (c *GRPCController) SendServiceUpdateToCluster(ctx context.Context, accountID string, update *proto.ProxyMapping, clusterAddr string) {
 	c.proxyGRPCServer.SendServiceUpdateToCluster(ctx, update, clusterAddr)
-	c.metrics.IncrementServiceUpdateSendCount(clusterAddr)
+	c.metrics.IncrementServiceUpdateSendCount()
 }
 
 // GetOIDCValidationConfig returns the OIDC validation configuration from the gRPC server.
@@ -53,7 +53,7 @@ func (c *GRPCController) RegisterProxyToCluster(ctx context.Context, clusterAddr
 	proxySet.(*sync.Map).Store(proxyID, struct{}{})
 	log.WithContext(ctx).Debugf("Registered proxy %s to cluster %s", proxyID, clusterAddr)
 
-	c.metrics.IncrementProxyConnectionCount(clusterAddr)
+	c.metrics.IncrementProxyConnectionCount()
 
 	return nil
 }
@@ -67,7 +67,7 @@ func (c *GRPCController) UnregisterProxyFromCluster(ctx context.Context, cluster
 		proxySet.(*sync.Map).Delete(proxyID)
 		log.WithContext(ctx).Debugf("Unregistered proxy %s from cluster %s", proxyID, clusterAddr)
 
-		c.metrics.DecrementProxyConnectionCount(clusterAddr)
+		c.metrics.DecrementProxyConnectionCount()
 	}
 	return nil
 }
diff --git a/management/internals/modules/reverseproxy/proxy/manager/manager.go b/management/internals/modules/reverseproxy/proxy/manager/manager.go
index 943766004..5a95ea94a 100644
--- a/management/internals/modules/reverseproxy/proxy/manager/manager.go
+++ b/management/internals/modules/reverseproxy/proxy/manager/manager.go
@@ -8,6 +8,7 @@ import (
 	"go.opentelemetry.io/otel/metric"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	nbversion "github.com/netbirdio/netbird/version"
 )
 
 // store defines the interface for proxy persistence operations
@@ -22,6 +23,8 @@ type store interface {
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
+	GetClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool
+	GetActiveProxyVersions(ctx context.Context, clusterAddr string) ([]string, error)
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error)
 	CountProxiesByAccountID(ctx context.Context, accountID string) (int64, error)
@@ -29,6 +32,8 @@ type store interface {
 	DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error
 }
 
+const minSessionCodeVersion = "0.81.0"
+
 // Manager handles all proxy operations
 type Manager struct {
 	store   store
@@ -50,7 +55,7 @@ func NewManager(store store, meter metric.Meter) (*Manager, error) {
 
 // Connect registers a new proxy connection in the database.
 // capabilities may be nil for old proxies that do not report them.
-func (m *Manager) Connect(ctx context.Context, proxyID, sessionID, clusterAddress, ipAddress string, accountID *string, capabilities *proxy.Capabilities) (*proxy.Proxy, error) {
+func (m *Manager) Connect(ctx context.Context, proxyID, sessionID, clusterAddress, ipAddress, version string, accountID *string, capabilities *proxy.Capabilities) (*proxy.Proxy, error) {
 	now := time.Now()
 	var caps proxy.Capabilities
 	if capabilities != nil {
@@ -61,6 +66,7 @@ func (m *Manager) Connect(ctx context.Context, proxyID, sessionID, clusterAddres
 		SessionID:      sessionID,
 		ClusterAddress: clusterAddress,
 		IPAddress:      ipAddress,
+		Version:        truncateVersion(version),
 		AccountID:      accountID,
 		LastSeen:       now,
 		ConnectedAt:    &now,
@@ -78,6 +84,7 @@ func (m *Manager) Connect(ctx context.Context, proxyID, sessionID, clusterAddres
 		"sessionID":      sessionID,
 		"clusterAddress": clusterAddress,
 		"ipAddress":      ipAddress,
+		"version":        p.Version,
 	}).Info("proxy connected")
 
 	return p, nil
@@ -143,6 +150,27 @@ func (m Manager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string)
 	return m.store.GetClusterSupportsPrivate(ctx, clusterAddr)
 }
 
+// ClusterAllProxiesPrivate reports whether every active proxy claims the private capability (nil = unreported).
+func (m Manager) ClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool {
+	return m.store.GetClusterAllProxiesPrivate(ctx, clusterAddr)
+}
+
+// ClusterSupportsSessionCode reports whether all active proxies support session codes.
+func (m Manager) ClusterSupportsSessionCode(ctx context.Context, clusterAddr string) bool {
+	versions, err := m.store.GetActiveProxyVersions(ctx, clusterAddr)
+	if err != nil || len(versions) == 0 {
+		return false
+	}
+
+	for _, version := range versions {
+		if supported, err := nbversion.MeetsMinVersion(minSessionCodeVersion, version); err != nil || !supported {
+			return false
+		}
+	}
+
+	return true
+}
+
 // CleanupStale removes proxies that haven't sent heartbeat in the specified duration
 func (m *Manager) CleanupStale(ctx context.Context, inactivityDuration time.Duration) error {
 	if err := m.store.CleanupStaleProxies(ctx, inactivityDuration); err != nil {
@@ -184,3 +212,13 @@ func (m *Manager) DeleteAccountCluster(ctx context.Context, clusterAddress, acco
 	}
 	return nil
 }
+
+// truncateVersion cuts a proxy-reported version to the column width so an
+// oversized value cannot fail the save and block the connect.
+func truncateVersion(version string) string {
+	runes := []rune(version)
+	if len(runes) <= proxy.MaxVersionLength {
+		return version
+	}
+	return string(runes[:proxy.MaxVersionLength])
+}
diff --git a/management/internals/modules/reverseproxy/proxy/manager/manager_test.go b/management/internals/modules/reverseproxy/proxy/manager/manager_test.go
index 5c44470a3..56806613a 100644
--- a/management/internals/modules/reverseproxy/proxy/manager/manager_test.go
+++ b/management/internals/modules/reverseproxy/proxy/manager/manager_test.go
@@ -4,8 +4,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 	"testing"
 	"time"
+	"unicode/utf8"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -20,6 +22,7 @@ type mockStore struct {
 	updateProxyHeartbeatFunc                 func(ctx context.Context, p *proxy.Proxy) error
 	getActiveProxyClusterAddressesFunc       func(ctx context.Context) ([]string, error)
 	getActiveProxyClusterAddressesForAccFunc func(ctx context.Context, accountID string) ([]string, error)
+	getActiveProxyVersionsFunc               func(ctx context.Context, clusterAddress string) ([]string, error)
 	cleanupStaleProxiesFunc                  func(ctx context.Context, d time.Duration) error
 	getProxyByAccountIDFunc                  func(ctx context.Context, accountID string) (*proxy.Proxy, error)
 	countProxiesByAccountIDFunc              func(ctx context.Context, accountID string) (int64, error)
@@ -102,6 +105,15 @@ func (m *mockStore) GetClusterSupportsCrowdSec(_ context.Context, _ string) *boo
 func (m *mockStore) GetClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }
+func (m *mockStore) GetClusterAllProxiesPrivate(_ context.Context, _ string) *bool {
+	return nil
+}
+func (m *mockStore) GetActiveProxyVersions(ctx context.Context, clusterAddress string) ([]string, error) {
+	if m.getActiveProxyVersionsFunc != nil {
+		return m.getActiveProxyVersionsFunc(ctx, clusterAddress)
+	}
+	return nil, nil
+}
 
 func newTestManager(s store) *Manager {
 	meter := noop.NewMeterProvider().Meter("test")
@@ -112,6 +124,34 @@ func newTestManager(s store) *Manager {
 	return m
 }
 
+func TestClusterSupportsSessionCode(t *testing.T) {
+	tests := []struct {
+		name     string
+		versions []string
+		storeErr error
+		want     bool
+	}{
+		{name: "all supported", versions: []string{"0.81.0", "0.81.2"}, want: true},
+		{name: "one old proxy", versions: []string{"0.81.0", "0.80.0"}},
+		{name: "missing version", versions: []string{"0.81.0", ""}},
+		{name: "no active proxies"},
+		{name: "store error", storeErr: errors.New("db error")},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := &mockStore{
+				getActiveProxyVersionsFunc: func(_ context.Context, _ string) ([]string, error) {
+					return tt.versions, tt.storeErr
+				},
+			}
+
+			got := newTestManager(s).ClusterSupportsSessionCode(context.Background(), "cluster.example.com")
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
 func TestConnect_WithAccountID(t *testing.T) {
 	accountID := "acc-123"
 
@@ -124,7 +164,7 @@ func TestConnect_WithAccountID(t *testing.T) {
 	}
 
 	mgr := newTestManager(s)
-	_, err := mgr.Connect(context.Background(), "proxy-1", "session-1", "cluster.example.com", "10.0.0.1", &accountID, nil)
+	_, err := mgr.Connect(context.Background(), "proxy-1", "session-1", "cluster.example.com", "10.0.0.1", "0.60.0", &accountID, nil)
 	require.NoError(t, err)
 
 	require.NotNil(t, savedProxy)
@@ -132,6 +172,7 @@ func TestConnect_WithAccountID(t *testing.T) {
 	assert.Equal(t, "session-1", savedProxy.SessionID)
 	assert.Equal(t, "cluster.example.com", savedProxy.ClusterAddress)
 	assert.Equal(t, "10.0.0.1", savedProxy.IPAddress)
+	assert.Equal(t, "0.60.0", savedProxy.Version, "reported proxy version should be stored")
 	assert.Equal(t, &accountID, savedProxy.AccountID)
 	assert.Equal(t, proxy.StatusConnected, savedProxy.Status)
 	assert.NotNil(t, savedProxy.ConnectedAt)
@@ -147,7 +188,7 @@ func TestConnect_WithoutAccountID(t *testing.T) {
 	}
 
 	mgr := newTestManager(s)
-	_, err := mgr.Connect(context.Background(), "proxy-1", "session-1", "eu.proxy.netbird.io", "10.0.0.1", nil, nil)
+	_, err := mgr.Connect(context.Background(), "proxy-1", "session-1", "eu.proxy.netbird.io", "10.0.0.1", "", nil, nil)
 	require.NoError(t, err)
 
 	require.NotNil(t, savedProxy)
@@ -155,6 +196,29 @@ func TestConnect_WithoutAccountID(t *testing.T) {
 	assert.Equal(t, proxy.StatusConnected, savedProxy.Status)
 }
 
+func TestConnect_TruncatesOversizedVersion(t *testing.T) {
+	var savedProxy *proxy.Proxy
+	s := &mockStore{
+		saveProxyFunc: func(_ context.Context, p *proxy.Proxy) error {
+			savedProxy = p
+			return nil
+		},
+	}
+
+	// Multi-byte runes make sure the cut counts characters, as varchar does,
+	// and never splits a rune into invalid UTF-8.
+	version := strings.Repeat("ü", proxy.MaxVersionLength+10)
+
+	mgr := newTestManager(s)
+	_, err := mgr.Connect(context.Background(), "proxy-1", "session-1", "cluster.example.com", "10.0.0.1", version, nil, nil)
+	require.NoError(t, err)
+
+	require.NotNil(t, savedProxy)
+	assert.Equal(t, proxy.MaxVersionLength, utf8.RuneCountInString(savedProxy.Version), "stored version should be cut to the column width")
+	assert.True(t, utf8.ValidString(savedProxy.Version), "stored version should remain valid UTF-8")
+	assert.True(t, strings.HasPrefix(version, savedProxy.Version), "stored version should be a prefix of the reported one")
+}
+
 func TestConnect_StoreError(t *testing.T) {
 	s := &mockStore{
 		saveProxyFunc: func(_ context.Context, _ *proxy.Proxy) error {
@@ -163,7 +227,7 @@ func TestConnect_StoreError(t *testing.T) {
 	}
 
 	mgr := newTestManager(s)
-	_, err := mgr.Connect(context.Background(), "proxy-1", "session-1", "cluster.example.com", "10.0.0.1", nil, nil)
+	_, err := mgr.Connect(context.Background(), "proxy-1", "session-1", "cluster.example.com", "10.0.0.1", "", nil, nil)
 	assert.Error(t, err)
 }
 
diff --git a/management/internals/modules/reverseproxy/proxy/manager/metrics.go b/management/internals/modules/reverseproxy/proxy/manager/metrics.go
index 2b402cead..f7fd385cb 100644
--- a/management/internals/modules/reverseproxy/proxy/manager/metrics.go
+++ b/management/internals/modules/reverseproxy/proxy/manager/metrics.go
@@ -3,7 +3,6 @@ package manager
 import (
 	"context"
 
-	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/metric"
 )
 
@@ -48,25 +47,16 @@ func newMetrics(meter metric.Meter) (*metrics, error) {
 	}, nil
 }
 
-func (m *metrics) IncrementProxyConnectionCount(clusterAddr string) {
-	m.proxyConnectionCount.Add(context.Background(), 1,
-		metric.WithAttributes(
-			attribute.String("cluster", clusterAddr),
-		))
+func (m *metrics) IncrementProxyConnectionCount() {
+	m.proxyConnectionCount.Add(context.Background(), 1)
 }
 
-func (m *metrics) DecrementProxyConnectionCount(clusterAddr string) {
-	m.proxyConnectionCount.Add(context.Background(), -1,
-		metric.WithAttributes(
-			attribute.String("cluster", clusterAddr),
-		))
+func (m *metrics) DecrementProxyConnectionCount() {
+	m.proxyConnectionCount.Add(context.Background(), -1)
 }
 
-func (m *metrics) IncrementServiceUpdateSendCount(clusterAddr string) {
-	m.serviceUpdateSendCount.Add(context.Background(), 1,
-		metric.WithAttributes(
-			attribute.String("cluster", clusterAddr),
-		))
+func (m *metrics) IncrementServiceUpdateSendCount() {
+	m.serviceUpdateSendCount.Add(context.Background(), 1)
 }
 
 func (m *metrics) IncrementProxyHeartbeatCount() {
diff --git a/management/internals/modules/reverseproxy/proxy/manager_mock.go b/management/internals/modules/reverseproxy/proxy/manager_mock.go
index d2be46c9f..5f3404096 100644
--- a/management/internals/modules/reverseproxy/proxy/manager_mock.go
+++ b/management/internals/modules/reverseproxy/proxy/manager_mock.go
@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: ./manager.go
+//
+// Generated by this command:
+//
+//	mockgen -package proxy -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
+//
 
 // Package proxy is a generated GoMock package.
 package proxy
@@ -9,14 +14,15 @@ import (
 	reflect "reflect"
 	time "time"
 
-	gomock "github.com/golang/mock/gomock"
 	proto "github.com/netbirdio/netbird/shared/management/proto"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockManager is a mock of Manager interface.
 type MockManager struct {
 	ctrl     *gomock.Controller
 	recorder *MockManagerMockRecorder
+	isgomock struct{}
 }
 
 // MockManagerMockRecorder is the mock recorder for MockManager.
@@ -45,23 +51,23 @@ func (m *MockManager) CleanupStale(ctx context.Context, inactivityDuration time.
 }
 
 // CleanupStale indicates an expected call of CleanupStale.
-func (mr *MockManagerMockRecorder) CleanupStale(ctx, inactivityDuration interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CleanupStale(ctx, inactivityDuration any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupStale", reflect.TypeOf((*MockManager)(nil).CleanupStale), ctx, inactivityDuration)
 }
 
-// ClusterSupportsCustomPorts mocks base method.
-func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
+// ClusterAllProxiesPrivate mocks base method.
+func (m *MockManager) ClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
+	ret := m.ctrl.Call(m, "ClusterAllProxiesPrivate", ctx, clusterAddr)
 	ret0, _ := ret[0].(*bool)
 	return ret0
 }
 
-// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
-func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
+// ClusterAllProxiesPrivate indicates an expected call of ClusterAllProxiesPrivate.
+func (mr *MockManagerMockRecorder) ClusterAllProxiesPrivate(ctx, clusterAddr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterAllProxiesPrivate", reflect.TypeOf((*MockManager)(nil).ClusterAllProxiesPrivate), ctx, clusterAddr)
 }
 
 // ClusterRequireSubdomain mocks base method.
@@ -73,7 +79,7 @@ func (m *MockManager) ClusterRequireSubdomain(ctx context.Context, clusterAddr s
 }
 
 // ClusterRequireSubdomain indicates an expected call of ClusterRequireSubdomain.
-func (mr *MockManagerMockRecorder) ClusterRequireSubdomain(ctx, clusterAddr interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ClusterRequireSubdomain(ctx, clusterAddr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterRequireSubdomain", reflect.TypeOf((*MockManager)(nil).ClusterRequireSubdomain), ctx, clusterAddr)
 }
@@ -87,11 +93,25 @@ func (m *MockManager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr s
 }
 
 // ClusterSupportsCrowdSec indicates an expected call of ClusterSupportsCrowdSec.
-func (mr *MockManagerMockRecorder) ClusterSupportsCrowdSec(ctx, clusterAddr interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ClusterSupportsCrowdSec(ctx, clusterAddr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCrowdSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCrowdSec), ctx, clusterAddr)
 }
 
+// ClusterSupportsCustomPorts mocks base method.
+func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
+func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
+}
+
 // ClusterSupportsPrivate mocks base method.
 func (m *MockManager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -101,24 +121,67 @@ func (m *MockManager) ClusterSupportsPrivate(ctx context.Context, clusterAddr st
 }
 
 // ClusterSupportsPrivate indicates an expected call of ClusterSupportsPrivate.
-func (mr *MockManagerMockRecorder) ClusterSupportsPrivate(ctx, clusterAddr interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ClusterSupportsPrivate(ctx, clusterAddr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsPrivate", reflect.TypeOf((*MockManager)(nil).ClusterSupportsPrivate), ctx, clusterAddr)
 }
 
-// Connect mocks base method.
-func (m *MockManager) Connect(ctx context.Context, proxyID, sessionID, clusterAddress, ipAddress string, accountID *string, capabilities *Capabilities) (*Proxy, error) {
+// ClusterSupportsSessionCode mocks base method.
+func (m *MockManager) ClusterSupportsSessionCode(ctx context.Context, clusterAddr string) bool {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Connect", ctx, proxyID, sessionID, clusterAddress, ipAddress, accountID, capabilities)
+	ret := m.ctrl.Call(m, "ClusterSupportsSessionCode", ctx, clusterAddr)
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// ClusterSupportsSessionCode indicates an expected call of ClusterSupportsSessionCode.
+func (mr *MockManagerMockRecorder) ClusterSupportsSessionCode(ctx, clusterAddr any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsSessionCode", reflect.TypeOf((*MockManager)(nil).ClusterSupportsSessionCode), ctx, clusterAddr)
+}
+
+// Connect mocks base method.
+func (m *MockManager) Connect(ctx context.Context, proxyID, sessionID, clusterAddress, ipAddress, version string, accountID *string, capabilities *Capabilities) (*Proxy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Connect", ctx, proxyID, sessionID, clusterAddress, ipAddress, version, accountID, capabilities)
 	ret0, _ := ret[0].(*Proxy)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // Connect indicates an expected call of Connect.
-func (mr *MockManagerMockRecorder) Connect(ctx, proxyID, sessionID, clusterAddress, ipAddress, accountID, capabilities interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) Connect(ctx, proxyID, sessionID, clusterAddress, ipAddress, version, accountID, capabilities any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Connect", reflect.TypeOf((*MockManager)(nil).Connect), ctx, proxyID, sessionID, clusterAddress, ipAddress, accountID, capabilities)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Connect", reflect.TypeOf((*MockManager)(nil).Connect), ctx, proxyID, sessionID, clusterAddress, ipAddress, version, accountID, capabilities)
+}
+
+// CountAccountProxies mocks base method.
+func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CountAccountProxies indicates an expected call of CountAccountProxies.
+func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
+}
+
+// DeleteAccountCluster mocks base method.
+func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
+func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
 }
 
 // Disconnect mocks base method.
@@ -130,11 +193,26 @@ func (m *MockManager) Disconnect(ctx context.Context, proxyID, sessionID string)
 }
 
 // Disconnect indicates an expected call of Disconnect.
-func (mr *MockManagerMockRecorder) Disconnect(ctx, proxyID, sessionID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) Disconnect(ctx, proxyID, sessionID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Disconnect", reflect.TypeOf((*MockManager)(nil).Disconnect), ctx, proxyID, sessionID)
 }
 
+// GetAccountProxy mocks base method.
+func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
+	ret0, _ := ret[0].(*Proxy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountProxy indicates an expected call of GetAccountProxy.
+func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
+}
+
 // GetActiveClusterAddresses mocks base method.
 func (m *MockManager) GetActiveClusterAddresses(ctx context.Context) ([]string, error) {
 	m.ctrl.T.Helper()
@@ -145,11 +223,12 @@ func (m *MockManager) GetActiveClusterAddresses(ctx context.Context) ([]string,
 }
 
 // GetActiveClusterAddresses indicates an expected call of GetActiveClusterAddresses.
-func (mr *MockManagerMockRecorder) GetActiveClusterAddresses(ctx interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetActiveClusterAddresses(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddresses", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddresses), ctx)
 }
 
+// GetActiveClusterAddressesForAccount mocks base method.
 func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, accountID string) ([]string, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetActiveClusterAddressesForAccount", ctx, accountID)
@@ -158,7 +237,8 @@ func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, a
 	return ret0, ret1
 }
 
-func (mr *MockManagerMockRecorder) GetActiveClusterAddressesForAccount(ctx, accountID interface{}) *gomock.Call {
+// GetActiveClusterAddressesForAccount indicates an expected call of GetActiveClusterAddressesForAccount.
+func (mr *MockManagerMockRecorder) GetActiveClusterAddressesForAccount(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddressesForAccount", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddressesForAccount), ctx, accountID)
 }
@@ -172,41 +252,11 @@ func (m *MockManager) Heartbeat(ctx context.Context, p *Proxy) error {
 }
 
 // Heartbeat indicates an expected call of Heartbeat.
-func (mr *MockManagerMockRecorder) Heartbeat(ctx, p interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) Heartbeat(ctx, p any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Heartbeat", reflect.TypeOf((*MockManager)(nil).Heartbeat), ctx, p)
 }
 
-// GetAccountProxy mocks base method.
-func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
-	ret0, _ := ret[0].(*Proxy)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountProxy indicates an expected call of GetAccountProxy.
-func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
-}
-
-// CountAccountProxies mocks base method.
-func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
-	ret0, _ := ret[0].(int64)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// CountAccountProxies indicates an expected call of CountAccountProxies.
-func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
-}
-
 // IsClusterAddressAvailable mocks base method.
 func (m *MockManager) IsClusterAddressAvailable(ctx context.Context, clusterAddress, accountID string) (bool, error) {
 	m.ctrl.T.Helper()
@@ -217,29 +267,16 @@ func (m *MockManager) IsClusterAddressAvailable(ctx context.Context, clusterAddr
 }
 
 // IsClusterAddressAvailable indicates an expected call of IsClusterAddressAvailable.
-func (mr *MockManagerMockRecorder) IsClusterAddressAvailable(ctx, clusterAddress, accountID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) IsClusterAddressAvailable(ctx, clusterAddress, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsClusterAddressAvailable", reflect.TypeOf((*MockManager)(nil).IsClusterAddressAvailable), ctx, clusterAddress, accountID)
 }
 
-// DeleteAccountCluster mocks base method.
-func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
-func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
-}
-
 // MockController is a mock of Controller interface.
 type MockController struct {
 	ctrl     *gomock.Controller
 	recorder *MockControllerMockRecorder
+	isgomock struct{}
 }
 
 // MockControllerMockRecorder is the mock recorder for MockController.
@@ -282,7 +319,7 @@ func (m *MockController) GetProxiesForCluster(clusterAddr string) []string {
 }
 
 // GetProxiesForCluster indicates an expected call of GetProxiesForCluster.
-func (mr *MockControllerMockRecorder) GetProxiesForCluster(clusterAddr interface{}) *gomock.Call {
+func (mr *MockControllerMockRecorder) GetProxiesForCluster(clusterAddr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetProxiesForCluster", reflect.TypeOf((*MockController)(nil).GetProxiesForCluster), clusterAddr)
 }
@@ -296,7 +333,7 @@ func (m *MockController) RegisterProxyToCluster(ctx context.Context, clusterAddr
 }
 
 // RegisterProxyToCluster indicates an expected call of RegisterProxyToCluster.
-func (mr *MockControllerMockRecorder) RegisterProxyToCluster(ctx, clusterAddr, proxyID interface{}) *gomock.Call {
+func (mr *MockControllerMockRecorder) RegisterProxyToCluster(ctx, clusterAddr, proxyID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RegisterProxyToCluster", reflect.TypeOf((*MockController)(nil).RegisterProxyToCluster), ctx, clusterAddr, proxyID)
 }
@@ -308,7 +345,7 @@ func (m *MockController) SendServiceUpdateToCluster(ctx context.Context, account
 }
 
 // SendServiceUpdateToCluster indicates an expected call of SendServiceUpdateToCluster.
-func (mr *MockControllerMockRecorder) SendServiceUpdateToCluster(ctx, accountID, update, clusterAddr interface{}) *gomock.Call {
+func (mr *MockControllerMockRecorder) SendServiceUpdateToCluster(ctx, accountID, update, clusterAddr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SendServiceUpdateToCluster", reflect.TypeOf((*MockController)(nil).SendServiceUpdateToCluster), ctx, accountID, update, clusterAddr)
 }
@@ -322,7 +359,7 @@ func (m *MockController) UnregisterProxyFromCluster(ctx context.Context, cluster
 }
 
 // UnregisterProxyFromCluster indicates an expected call of UnregisterProxyFromCluster.
-func (mr *MockControllerMockRecorder) UnregisterProxyFromCluster(ctx, clusterAddr, proxyID interface{}) *gomock.Call {
+func (mr *MockControllerMockRecorder) UnregisterProxyFromCluster(ctx, clusterAddr, proxyID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UnregisterProxyFromCluster", reflect.TypeOf((*MockController)(nil).UnregisterProxyFromCluster), ctx, clusterAddr, proxyID)
 }
diff --git a/management/internals/modules/reverseproxy/proxy/proxy.go b/management/internals/modules/reverseproxy/proxy/proxy.go
index 4404b0d24..fdecc5bfd 100644
--- a/management/internals/modules/reverseproxy/proxy/proxy.go
+++ b/management/internals/modules/reverseproxy/proxy/proxy.go
@@ -9,6 +9,9 @@ const (
 	StatusDisconnected = "disconnected"
 )
 
+// MaxVersionLength is the width of the Version column, in characters.
+const MaxVersionLength = 255
+
 // Capabilities describes what a proxy can handle, as reported via gRPC.
 // Nil fields mean the proxy never reported this capability.
 type Capabilities struct {
@@ -31,6 +34,7 @@ type Proxy struct {
 	SessionID      string    `gorm:"type:varchar(36)"`
 	ClusterAddress string    `gorm:"type:varchar(255);not null;index:idx_proxy_cluster_status"`
 	IPAddress      string    `gorm:"type:varchar(45)"`
+	Version        string    `gorm:"type:varchar(255)"`
 	AccountID      *string   `gorm:"type:varchar(255);index:idx_proxy_account_id"`
 	LastSeen       time.Time `gorm:"not null;index:idx_proxy_last_seen"`
 	ConnectedAt    *time.Time
diff --git a/management/internals/modules/reverseproxy/proxytoken/handler.go b/management/internals/modules/reverseproxy/proxytoken/handler.go
index ed098a6dd..d8578db4c 100644
--- a/management/internals/modules/reverseproxy/proxytoken/handler.go
+++ b/management/internals/modules/reverseproxy/proxytoken/handler.go
@@ -1,6 +1,7 @@
 package proxytoken
 
 import (
+	"context"
 	"encoding/json"
 	"net/http"
 	"time"
@@ -18,13 +19,29 @@ import (
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
+// RevocationGuard vetoes the tenant-facing revocation of a proxy access
+// token. Implementations are supplied by integrations; none is installed by
+// default, so every token the caller's account owns may be revoked. It is
+// consulted after the ownership check and before the token is revoked. A
+// returned status error is written with util.WriteError: its type selects the
+// HTTP status and its message is shown to the caller, so it must not carry
+// internal detail. Any other error is reported as a generic internal error.
+type RevocationGuard interface {
+	CheckProxyAccessTokenRevocation(ctx context.Context, token *types.ProxyAccessToken) error
+}
+
 type handler struct {
 	store              store.Store
 	permissionsManager permissions.Manager
+	// revocationGuard vetoes revocations. Optional — when nil every owned
+	// token may be revoked.
+	revocationGuard RevocationGuard
 }
 
-func RegisterEndpoints(s store.Store, permissionsManager permissions.Manager, router *mux.Router) {
-	h := &handler{store: s, permissionsManager: permissionsManager}
+// RegisterEndpoints registers the proxy token endpoints. revocationGuard is
+// optional; pass nil for no revocation policy.
+func RegisterEndpoints(s store.Store, permissionsManager permissions.Manager, revocationGuard RevocationGuard, router *mux.Router) {
+	h := &handler{store: s, permissionsManager: permissionsManager, revocationGuard: revocationGuard}
 	router.HandleFunc("/reverse-proxies/proxy-tokens", h.listTokens).Methods("GET", "OPTIONS")
 	router.HandleFunc("/reverse-proxies/proxy-tokens", h.createToken).Methods("POST", "OPTIONS")
 	router.HandleFunc("/reverse-proxies/proxy-tokens/{tokenId}", h.revokeToken).Methods("DELETE", "OPTIONS")
@@ -154,6 +171,13 @@ func (h *handler) revokeToken(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if h.revocationGuard != nil {
+		if err := h.revocationGuard.CheckProxyAccessTokenRevocation(ctx, token); err != nil {
+			util.WriteError(ctx, err, w)
+			return
+		}
+	}
+
 	if err := h.store.RevokeProxyAccessToken(ctx, tokenID); err != nil {
 		util.WriteErrorResponse("failed to revoke token", http.StatusInternalServerError, w)
 		return
diff --git a/management/internals/modules/reverseproxy/proxytoken/handler_test.go b/management/internals/modules/reverseproxy/proxytoken/handler_test.go
index a5b5713c6..da37261c4 100644
--- a/management/internals/modules/reverseproxy/proxytoken/handler_test.go
+++ b/management/internals/modules/reverseproxy/proxytoken/handler_test.go
@@ -4,12 +4,13 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/gorilla/mux"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -22,6 +23,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/auth"
 	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 func authContext(accountID, userID string) context.Context {
@@ -273,3 +275,152 @@ func TestRevokeToken_ManagementWideToken(t *testing.T) {
 	h.revokeToken(w, req)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
+
+type revocationGuardFunc func(ctx context.Context, token *types.ProxyAccessToken) error
+
+func (f revocationGuardFunc) CheckProxyAccessTokenRevocation(ctx context.Context, token *types.ProxyAccessToken) error {
+	return f(ctx, token)
+}
+
+func TestRevokeToken_GuardRefuses(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	accountID := "acc-123"
+
+	// No RevokeProxyAccessToken expectation: a refused revocation must not
+	// reach the store.
+	mockStore := store.NewMockStore(ctrl)
+	mockStore.EXPECT().GetProxyAccessTokenByID(gomock.Any(), store.LockingStrengthNone, "tok-1").Return(&types.ProxyAccessToken{
+		ID:        "tok-1",
+		AccountID: &accountID,
+	}, nil)
+
+	permsMgr := permissions.NewMockManager(ctrl)
+	permsMgr.EXPECT().ValidateUserPermissions(gomock.Any(), accountID, "user-1", modules.Services, operations.Delete).Return(true, context.Background(), nil)
+
+	var checked *types.ProxyAccessToken
+	h := &handler{
+		store:              mockStore,
+		permissionsManager: permsMgr,
+		revocationGuard: revocationGuardFunc(func(_ context.Context, token *types.ProxyAccessToken) error {
+			checked = token
+			return status.Errorf(status.PreconditionFailed, "token is in use")
+		}),
+	}
+
+	req := httptest.NewRequest("DELETE", "/reverse-proxies/proxy-tokens/tok-1", nil)
+	req = req.WithContext(authContext(accountID, "user-1"))
+	req = mux.SetURLVars(req, map[string]string{"tokenId": "tok-1"})
+	w := httptest.NewRecorder()
+
+	h.revokeToken(w, req)
+	assert.Equal(t, http.StatusPreconditionFailed, w.Code)
+	assert.Contains(t, w.Body.String(), "token is in use")
+	require.NotNil(t, checked)
+	assert.Equal(t, "tok-1", checked.ID)
+}
+
+func TestRevokeToken_GuardAllows(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	accountID := "acc-123"
+
+	mockStore := store.NewMockStore(ctrl)
+	mockStore.EXPECT().GetProxyAccessTokenByID(gomock.Any(), store.LockingStrengthNone, "tok-1").Return(&types.ProxyAccessToken{
+		ID:        "tok-1",
+		AccountID: &accountID,
+	}, nil)
+	mockStore.EXPECT().RevokeProxyAccessToken(gomock.Any(), "tok-1").Return(nil)
+
+	permsMgr := permissions.NewMockManager(ctrl)
+	permsMgr.EXPECT().ValidateUserPermissions(gomock.Any(), accountID, "user-1", modules.Services, operations.Delete).Return(true, context.Background(), nil)
+
+	h := &handler{
+		store:              mockStore,
+		permissionsManager: permsMgr,
+		revocationGuard: revocationGuardFunc(func(context.Context, *types.ProxyAccessToken) error {
+			return nil
+		}),
+	}
+
+	req := httptest.NewRequest("DELETE", "/reverse-proxies/proxy-tokens/tok-1", nil)
+	req = req.WithContext(authContext(accountID, "user-1"))
+	req = mux.SetURLVars(req, map[string]string{"tokenId": "tok-1"})
+	w := httptest.NewRecorder()
+
+	h.revokeToken(w, req)
+	assert.Equal(t, http.StatusOK, w.Code)
+}
+
+func TestRevokeToken_GuardFailure(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	accountID := "acc-123"
+
+	// No RevokeProxyAccessToken expectation: a guard that cannot decide must
+	// not let the revocation through.
+	mockStore := store.NewMockStore(ctrl)
+	mockStore.EXPECT().GetProxyAccessTokenByID(gomock.Any(), store.LockingStrengthNone, "tok-1").Return(&types.ProxyAccessToken{
+		ID:        "tok-1",
+		AccountID: &accountID,
+	}, nil)
+
+	permsMgr := permissions.NewMockManager(ctrl)
+	permsMgr.EXPECT().ValidateUserPermissions(gomock.Any(), accountID, "user-1", modules.Services, operations.Delete).Return(true, context.Background(), nil)
+
+	h := &handler{
+		store:              mockStore,
+		permissionsManager: permsMgr,
+		revocationGuard: revocationGuardFunc(func(context.Context, *types.ProxyAccessToken) error {
+			return errors.New("connection refused")
+		}),
+	}
+
+	req := httptest.NewRequest("DELETE", "/reverse-proxies/proxy-tokens/tok-1", nil)
+	req = req.WithContext(authContext(accountID, "user-1"))
+	req = mux.SetURLVars(req, map[string]string{"tokenId": "tok-1"})
+	w := httptest.NewRecorder()
+
+	h.revokeToken(w, req)
+	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Contains(t, w.Body.String(), "internal server error")
+	assert.NotContains(t, w.Body.String(), "connection refused")
+}
+
+func TestRevokeToken_GuardNotConsultedForForeignToken(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	otherAccount := "acc-other"
+
+	mockStore := store.NewMockStore(ctrl)
+	mockStore.EXPECT().GetProxyAccessTokenByID(gomock.Any(), store.LockingStrengthNone, "tok-1").Return(&types.ProxyAccessToken{
+		ID:        "tok-1",
+		AccountID: &otherAccount,
+	}, nil)
+
+	permsMgr := permissions.NewMockManager(ctrl)
+	permsMgr.EXPECT().ValidateUserPermissions(gomock.Any(), "acc-123", "user-1", modules.Services, operations.Delete).Return(true, context.Background(), nil)
+
+	// A foreign token must read as not found, not reveal through the guard's
+	// answer that it belongs to some account's managed proxy.
+	h := &handler{
+		store:              mockStore,
+		permissionsManager: permsMgr,
+		revocationGuard: revocationGuardFunc(func(context.Context, *types.ProxyAccessToken) error {
+			t.Fatal("guard consulted for a token the caller does not own")
+			return nil
+		}),
+	}
+
+	req := httptest.NewRequest("DELETE", "/reverse-proxies/proxy-tokens/tok-1", nil)
+	req = req.WithContext(authContext("acc-123", "user-1"))
+	req = mux.SetURLVars(req, map[string]string{"tokenId": "tok-1"})
+	w := httptest.NewRecorder()
+
+	h.revokeToken(w, req)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
diff --git a/management/internals/modules/reverseproxy/service/interface.go b/management/internals/modules/reverseproxy/service/interface.go
index dddf6ae8a..10d93294a 100644
--- a/management/internals/modules/reverseproxy/service/interface.go
+++ b/management/internals/modules/reverseproxy/service/interface.go
@@ -1,6 +1,6 @@
 package service
 
-//go:generate go run github.com/golang/mock/mockgen -package service -destination=interface_mock.go -source=./interface.go -build_flags=-mod=mod
+//go:generate go tool mockgen -package service -destination=interface_mock.go -source=./interface.go -build_flags=-mod=mod
 
 import (
 	"context"
diff --git a/management/internals/modules/reverseproxy/service/interface_mock.go b/management/internals/modules/reverseproxy/service/interface_mock.go
index 24963fe30..6b60f2af1 100644
--- a/management/internals/modules/reverseproxy/service/interface_mock.go
+++ b/management/internals/modules/reverseproxy/service/interface_mock.go
@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: ./interface.go
+//
+// Generated by this command:
+//
+//	mockgen -package service -destination=interface_mock.go -source=./interface.go -build_flags=-mod=mod
+//
 
 // Package service is a generated GoMock package.
 package service
@@ -8,14 +13,15 @@ import (
 	context "context"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
 	proxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockManager is a mock of Manager interface.
 type MockManager struct {
 	ctrl     *gomock.Controller
 	recorder *MockManagerMockRecorder
+	isgomock struct{}
 }
 
 // MockManagerMockRecorder is the mock recorder for MockManager.
@@ -45,7 +51,7 @@ func (m *MockManager) CreateService(ctx context.Context, accountID, userID strin
 }
 
 // CreateService indicates an expected call of CreateService.
-func (mr *MockManagerMockRecorder) CreateService(ctx, accountID, userID, service interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateService(ctx, accountID, userID, service any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateService", reflect.TypeOf((*MockManager)(nil).CreateService), ctx, accountID, userID, service)
 }
@@ -60,7 +66,7 @@ func (m *MockManager) CreateServiceFromPeer(ctx context.Context, accountID, peer
 }
 
 // CreateServiceFromPeer indicates an expected call of CreateServiceFromPeer.
-func (mr *MockManagerMockRecorder) CreateServiceFromPeer(ctx, accountID, peerID, req interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateServiceFromPeer(ctx, accountID, peerID, req any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateServiceFromPeer", reflect.TypeOf((*MockManager)(nil).CreateServiceFromPeer), ctx, accountID, peerID, req)
 }
@@ -74,7 +80,7 @@ func (m *MockManager) DeleteAccountCluster(ctx context.Context, accountID, userI
 }
 
 // DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
-func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, accountID, userID, clusterAddress interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, accountID, userID, clusterAddress any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, accountID, userID, clusterAddress)
 }
@@ -88,7 +94,7 @@ func (m *MockManager) DeleteAllServices(ctx context.Context, accountID, userID s
 }
 
 // DeleteAllServices indicates an expected call of DeleteAllServices.
-func (mr *MockManagerMockRecorder) DeleteAllServices(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteAllServices(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAllServices", reflect.TypeOf((*MockManager)(nil).DeleteAllServices), ctx, accountID, userID)
 }
@@ -102,7 +108,7 @@ func (m *MockManager) DeleteService(ctx context.Context, accountID, userID, serv
 }
 
 // DeleteService indicates an expected call of DeleteService.
-func (mr *MockManagerMockRecorder) DeleteService(ctx, accountID, userID, serviceID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteService(ctx, accountID, userID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteService", reflect.TypeOf((*MockManager)(nil).DeleteService), ctx, accountID, userID, serviceID)
 }
@@ -117,7 +123,7 @@ func (m *MockManager) GetAccountServices(ctx context.Context, accountID string)
 }
 
 // GetAccountServices indicates an expected call of GetAccountServices.
-func (mr *MockManagerMockRecorder) GetAccountServices(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAccountServices(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountServices", reflect.TypeOf((*MockManager)(nil).GetAccountServices), ctx, accountID)
 }
@@ -132,7 +138,7 @@ func (m *MockManager) GetAllServices(ctx context.Context, accountID, userID stri
 }
 
 // GetAllServices indicates an expected call of GetAllServices.
-func (mr *MockManagerMockRecorder) GetAllServices(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAllServices(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllServices", reflect.TypeOf((*MockManager)(nil).GetAllServices), ctx, accountID, userID)
 }
@@ -147,7 +153,7 @@ func (m *MockManager) GetClusters(ctx context.Context, accountID, userID string)
 }
 
 // GetClusters indicates an expected call of GetClusters.
-func (mr *MockManagerMockRecorder) GetClusters(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetClusters(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusters", reflect.TypeOf((*MockManager)(nil).GetClusters), ctx, accountID, userID)
 }
@@ -162,7 +168,7 @@ func (m *MockManager) GetGlobalServices(ctx context.Context) ([]*Service, error)
 }
 
 // GetGlobalServices indicates an expected call of GetGlobalServices.
-func (mr *MockManagerMockRecorder) GetGlobalServices(ctx interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetGlobalServices(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGlobalServices", reflect.TypeOf((*MockManager)(nil).GetGlobalServices), ctx)
 }
@@ -177,7 +183,7 @@ func (m *MockManager) GetService(ctx context.Context, accountID, userID, service
 }
 
 // GetService indicates an expected call of GetService.
-func (mr *MockManagerMockRecorder) GetService(ctx, accountID, userID, serviceID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetService(ctx, accountID, userID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetService", reflect.TypeOf((*MockManager)(nil).GetService), ctx, accountID, userID, serviceID)
 }
@@ -192,7 +198,7 @@ func (m *MockManager) GetServiceByDomain(ctx context.Context, domain string) (*S
 }
 
 // GetServiceByDomain indicates an expected call of GetServiceByDomain.
-func (mr *MockManagerMockRecorder) GetServiceByDomain(ctx, domain interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetServiceByDomain(ctx, domain any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServiceByDomain", reflect.TypeOf((*MockManager)(nil).GetServiceByDomain), ctx, domain)
 }
@@ -207,7 +213,7 @@ func (m *MockManager) GetServiceByID(ctx context.Context, accountID, serviceID s
 }
 
 // GetServiceByID indicates an expected call of GetServiceByID.
-func (mr *MockManagerMockRecorder) GetServiceByID(ctx, accountID, serviceID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetServiceByID(ctx, accountID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServiceByID", reflect.TypeOf((*MockManager)(nil).GetServiceByID), ctx, accountID, serviceID)
 }
@@ -222,7 +228,7 @@ func (m *MockManager) GetServiceIDByTargetID(ctx context.Context, accountID, res
 }
 
 // GetServiceIDByTargetID indicates an expected call of GetServiceIDByTargetID.
-func (mr *MockManagerMockRecorder) GetServiceIDByTargetID(ctx, accountID, resourceID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetServiceIDByTargetID(ctx, accountID, resourceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServiceIDByTargetID", reflect.TypeOf((*MockManager)(nil).GetServiceIDByTargetID), ctx, accountID, resourceID)
 }
@@ -236,7 +242,7 @@ func (m *MockManager) ReloadAllServicesForAccount(ctx context.Context, accountID
 }
 
 // ReloadAllServicesForAccount indicates an expected call of ReloadAllServicesForAccount.
-func (mr *MockManagerMockRecorder) ReloadAllServicesForAccount(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ReloadAllServicesForAccount(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReloadAllServicesForAccount", reflect.TypeOf((*MockManager)(nil).ReloadAllServicesForAccount), ctx, accountID)
 }
@@ -250,7 +256,7 @@ func (m *MockManager) ReloadService(ctx context.Context, accountID, serviceID st
 }
 
 // ReloadService indicates an expected call of ReloadService.
-func (mr *MockManagerMockRecorder) ReloadService(ctx, accountID, serviceID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ReloadService(ctx, accountID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReloadService", reflect.TypeOf((*MockManager)(nil).ReloadService), ctx, accountID, serviceID)
 }
@@ -264,7 +270,7 @@ func (m *MockManager) RenewServiceFromPeer(ctx context.Context, accountID, peerI
 }
 
 // RenewServiceFromPeer indicates an expected call of RenewServiceFromPeer.
-func (mr *MockManagerMockRecorder) RenewServiceFromPeer(ctx, accountID, peerID, serviceID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) RenewServiceFromPeer(ctx, accountID, peerID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RenewServiceFromPeer", reflect.TypeOf((*MockManager)(nil).RenewServiceFromPeer), ctx, accountID, peerID, serviceID)
 }
@@ -278,7 +284,7 @@ func (m *MockManager) SetCertificateIssuedAt(ctx context.Context, accountID, ser
 }
 
 // SetCertificateIssuedAt indicates an expected call of SetCertificateIssuedAt.
-func (mr *MockManagerMockRecorder) SetCertificateIssuedAt(ctx, accountID, serviceID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SetCertificateIssuedAt(ctx, accountID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetCertificateIssuedAt", reflect.TypeOf((*MockManager)(nil).SetCertificateIssuedAt), ctx, accountID, serviceID)
 }
@@ -292,7 +298,7 @@ func (m *MockManager) SetStatus(ctx context.Context, accountID, serviceID string
 }
 
 // SetStatus indicates an expected call of SetStatus.
-func (mr *MockManagerMockRecorder) SetStatus(ctx, accountID, serviceID, status interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SetStatus(ctx, accountID, serviceID, status any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetStatus", reflect.TypeOf((*MockManager)(nil).SetStatus), ctx, accountID, serviceID, status)
 }
@@ -304,7 +310,7 @@ func (m *MockManager) StartExposeReaper(ctx context.Context) {
 }
 
 // StartExposeReaper indicates an expected call of StartExposeReaper.
-func (mr *MockManagerMockRecorder) StartExposeReaper(ctx interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) StartExposeReaper(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "StartExposeReaper", reflect.TypeOf((*MockManager)(nil).StartExposeReaper), ctx)
 }
@@ -318,7 +324,7 @@ func (m *MockManager) StopServiceFromPeer(ctx context.Context, accountID, peerID
 }
 
 // StopServiceFromPeer indicates an expected call of StopServiceFromPeer.
-func (mr *MockManagerMockRecorder) StopServiceFromPeer(ctx, accountID, peerID, serviceID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) StopServiceFromPeer(ctx, accountID, peerID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "StopServiceFromPeer", reflect.TypeOf((*MockManager)(nil).StopServiceFromPeer), ctx, accountID, peerID, serviceID)
 }
@@ -333,7 +339,7 @@ func (m *MockManager) UpdateService(ctx context.Context, accountID, userID strin
 }
 
 // UpdateService indicates an expected call of UpdateService.
-func (mr *MockManagerMockRecorder) UpdateService(ctx, accountID, userID, service interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateService(ctx, accountID, userID, service any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateService", reflect.TypeOf((*MockManager)(nil).UpdateService), ctx, accountID, userID, service)
 }
diff --git a/management/internals/modules/reverseproxy/service/manager/domain_validation_test.go b/management/internals/modules/reverseproxy/service/manager/domain_validation_test.go
new file mode 100644
index 000000000..f491d01c3
--- /dev/null
+++ b/management/internals/modules/reverseproxy/service/manager/domain_validation_test.go
@@ -0,0 +1,177 @@
+package manager
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/metric/noop"
+
+	domainmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
+	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/mock_server"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const validationTestCluster = "eu.proxy.test"
+
+// withRealDomainManager swaps the stub cluster deriver for the real domain
+// manager backed by the same store, so service creation is gated by the actual
+// domain rows rather than by a test double that always agrees.
+func withRealDomainManager(t *testing.T, mgr *Manager, testStore store.Store) {
+	t.Helper()
+
+	ctx := context.Background()
+	proxyMgr, err := proxymanager.NewManager(testStore, noop.NewMeterProvider().Meter(""))
+	require.NoError(t, err)
+
+	_, err = proxyMgr.Connect(ctx, "proxy-1", "session-1", validationTestCluster, "127.0.0.1", "", nil, nil)
+	require.NoError(t, err)
+
+	accountMgr := &mock_server.MockAccountManager{
+		StoreEventFunc: func(context.Context, string, string, string, activity.ActivityDescriber, map[string]any) {},
+	}
+	mgr.clusterDeriver = domainmanager.NewManager(testStore, proxyMgr, permissions.NewManager(testStore), accountMgr)
+}
+
+func newTestService(domain string) *rpservice.Service {
+	return &rpservice.Service{
+		Name:    "test-service",
+		Domain:  domain,
+		Enabled: true,
+		Mode:    rpservice.ModeHTTP,
+		Targets: []*rpservice.Target{{
+			Host:       "10.0.0.1",
+			Port:       8080,
+			Protocol:   "http",
+			TargetId:   testPeerID,
+			TargetType: "peer",
+			Enabled:    true,
+		}},
+	}
+}
+
+// A service must not bind to a domain the account has not validated, and
+// nothing may be persisted for the attempt.
+func TestCreateService_RefusesUnvalidatedDomain(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupIntegrationTest(t)
+	withRealDomainManager(t, mgr, testStore)
+
+	_, err := testStore.CreateCustomDomain(ctx, testAccountID, "unproven.example.com", validationTestCluster, false)
+	require.NoError(t, err)
+
+	_, err = mgr.CreateService(ctx, testAccountID, testUserID, newTestService("unproven.example.com"))
+	require.Error(t, err, "an unvalidated domain must not bind a service")
+	assert.Contains(t, err.Error(), "not validated", "the API error should name the actual problem")
+
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "error should be a typed status error")
+	assert.Equal(t, status.PreconditionFailed, sErr.Type())
+
+	services, err := testStore.GetAccountServices(ctx, store.LockingStrengthNone, testAccountID)
+	require.NoError(t, err)
+	assert.Empty(t, services, "no service row should be written for a refused domain")
+}
+
+// The negative control: a validated domain still binds a service and derives
+// its cluster exactly as before.
+func TestCreateService_ValidatedDomainBindsService(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupIntegrationTest(t)
+	withRealDomainManager(t, mgr, testStore)
+
+	_, err := testStore.CreateCustomDomain(ctx, testAccountID, "proven.example.com", validationTestCluster, true)
+	require.NoError(t, err)
+
+	created, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.proven.example.com"))
+	require.NoError(t, err)
+	assert.Equal(t, validationTestCluster, created.ProxyCluster, "service should bind to the domain's target cluster")
+
+	services, err := testStore.GetAccountServices(ctx, store.LockingStrengthNone, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1, "the service should be persisted")
+	assert.Equal(t, "app.proven.example.com", services[0].Domain)
+}
+
+// An update must not be a way around the creation gate: moving a live service
+// onto an unvalidated domain has to fail rather than silently keep the old
+// cluster and start serving the new hostname.
+func TestUpdateService_RefusesMoveToUnvalidatedDomain(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupIntegrationTest(t)
+	withRealDomainManager(t, mgr, testStore)
+
+	_, err := testStore.CreateCustomDomain(ctx, testAccountID, "proven.example.com", validationTestCluster, true)
+	require.NoError(t, err)
+	_, err = testStore.CreateCustomDomain(ctx, testAccountID, "unproven.example.com", validationTestCluster, false)
+	require.NoError(t, err)
+
+	created, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.proven.example.com"))
+	require.NoError(t, err)
+
+	moved := *created
+	moved.Domain = "app.unproven.example.com"
+	_, err = mgr.UpdateService(ctx, testAccountID, testUserID, &moved)
+	require.Error(t, err, "moving to an unvalidated domain must fail")
+	assert.Contains(t, err.Error(), "not validated")
+
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, created.ID)
+	require.NoError(t, err)
+	assert.Equal(t, "app.proven.example.com", stored.Domain, "the service must keep its original domain")
+}
+
+func TestCreateService_DomainDeletedBeforeWrite(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupIntegrationTest(t)
+	withRealDomainManager(t, mgr, testStore)
+
+	d, err := testStore.CreateCustomDomain(ctx, testAccountID, "proven.example.com", validationTestCluster, true)
+	require.NoError(t, err)
+	svc := newTestService("app.proven.example.com")
+	require.NoError(t, mgr.initializeServiceForCreate(ctx, testAccountID, svc))
+
+	// Delete after the initial authorization check, before the service transaction starts.
+	require.NoError(t, testStore.DeleteCustomDomain(ctx, testAccountID, d.ID))
+	err = mgr.persistNewService(ctx, testAccountID, svc)
+	require.Error(t, err, "an earlier validation result must not authorize a deleted registration")
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "the caller must receive a typed precondition error")
+	assert.Equal(t, status.PreconditionFailed, sErr.Type(), "the service must require current domain authorization")
+	services, err := testStore.GetAccountServices(ctx, store.LockingStrengthNone, testAccountID)
+	require.NoError(t, err)
+	assert.Empty(t, services, "the failed write must not leave a service")
+}
+
+func TestUpdateService_DomainDeletedBeforeWrite(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupIntegrationTest(t)
+	withRealDomainManager(t, mgr, testStore)
+	_, err := testStore.CreateCustomDomain(ctx, testAccountID, "original.example.com", validationTestCluster, true)
+	require.NoError(t, err)
+	d, err := testStore.CreateCustomDomain(ctx, testAccountID, "destination.example.com", validationTestCluster, true)
+	require.NoError(t, err)
+	svc, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.original.example.com"))
+	require.NoError(t, err)
+	moved := svc.Copy()
+	moved.Domain = "app.destination.example.com"
+	cluster, err := mgr.resolveEffectiveCluster(ctx, testAccountID, moved)
+	require.NoError(t, err)
+
+	require.NoError(t, testStore.DeleteCustomDomain(ctx, testAccountID, d.ID))
+	err = testStore.ExecuteInTransaction(ctx, func(tx store.Store) error {
+		return mgr.executeServiceUpdate(ctx, tx, testAccountID, moved, &serviceUpdateInfo{}, nil, cluster)
+	})
+	require.Error(t, err, "a domain deleted after cluster resolution must reject the update")
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "the caller must receive a typed precondition error")
+	assert.Equal(t, status.PreconditionFailed, sErr.Type(), "the move must require current domain authorization")
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, svc.ID)
+	require.NoError(t, err)
+	assert.Equal(t, svc.Domain, stored.Domain, "the service must retain its authorized domain")
+}
diff --git a/management/internals/modules/reverseproxy/service/manager/l4_port_test.go b/management/internals/modules/reverseproxy/service/manager/l4_port_test.go
index c218291ef..a44e759c4 100644
--- a/management/internals/modules/reverseproxy/service/manager/l4_port_test.go
+++ b/management/internals/modules/reverseproxy/service/manager/l4_port_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
diff --git a/management/internals/modules/reverseproxy/service/manager/manager.go b/management/internals/modules/reverseproxy/service/manager/manager.go
index 365fbab40..ebb52c74b 100644
--- a/management/internals/modules/reverseproxy/service/manager/manager.go
+++ b/management/internals/modules/reverseproxy/service/manager/manager.go
@@ -2,6 +2,7 @@ package manager
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"math/rand/v2"
 	"net"
@@ -74,6 +75,7 @@ const unknownHostPlaceholder = "unknown"
 // ClusterDeriver derives the proxy cluster from a domain.
 type ClusterDeriver interface {
 	DeriveClusterFromDomain(ctx context.Context, accountID, domain string) (string, error)
+	ValidateServiceDomain(ctx context.Context, tx store.Store, accountID, domain, cluster string) error
 	GetClusterDomains() []string
 }
 
@@ -83,6 +85,7 @@ type CapabilityProvider interface {
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
+	ClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
 type Manager struct {
@@ -331,7 +334,17 @@ func (m *Manager) persistNewService(ctx context.Context, accountID string, svc *
 		return err
 	}
 
+	if err := m.validatePrivateClusterTargets(ctx, svc.Targets, svc.ProxyCluster); err != nil {
+		return err
+	}
+
 	return m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		if err := validateTargetAccessControl(svc); err != nil {
+			return err
+		}
+		if err := m.validateServiceDomain(ctx, transaction, accountID, svc, svc.ProxyCluster); err != nil {
+			return err
+		}
 		if svc.Domain != "" {
 			if err := m.checkDomainAvailable(ctx, transaction, svc.Domain, ""); err != nil {
 				return err
@@ -365,6 +378,43 @@ func (m *Manager) clusterCustomPorts(ctx context.Context, svc *service.Service)
 	return m.capabilities.ClusterSupportsCustomPorts(ctx, svc.ProxyCluster)
 }
 
+// validatePrivateClusterTargets rejects cluster and direct upstream targets unless
+// every active proxy in the service's cluster reports the private capability. The
+// mapping reaches all proxies in the cluster, so one non-private proxy would serve
+// these targets too. An unreported capability is treated as unsupported. Must be
+// called outside a transaction, like clusterCustomPorts.
+func (m *Manager) validatePrivateClusterTargets(ctx context.Context, targets []*service.Target, cluster string) error {
+	target := firstPrivateClusterTarget(targets)
+	if target == nil {
+		return nil
+	}
+
+	if private := m.capabilities.ClusterAllProxiesPrivate(ctx, cluster); private != nil && *private {
+		return nil
+	}
+
+	if target.TargetType == service.TargetTypeCluster {
+		return status.Errorf(status.InvalidArgument,
+			"target_type %q requires a proxy cluster with private mode enabled, cluster %s does not support it",
+			service.TargetTypeCluster, cluster)
+	}
+	return status.Errorf(status.InvalidArgument,
+		"direct_upstream requires a proxy cluster with private mode enabled, cluster %s does not support it", cluster)
+}
+
+// firstPrivateClusterTarget returns the first target that only a private cluster may serve.
+func firstPrivateClusterTarget(targets []*service.Target) *service.Target {
+	for _, target := range targets {
+		if target == nil {
+			continue
+		}
+		if target.TargetType == service.TargetTypeCluster || target.Options.DirectUpstream {
+			return target
+		}
+	}
+	return nil
+}
+
 // ensureL4Port auto-assigns a listen port when needed and validates cluster support.
 // customPorts must be pre-computed via clusterCustomPorts before entering a transaction.
 func (m *Manager) ensureL4Port(ctx context.Context, tx store.Store, svc *service.Service, customPorts *bool, serviceUpdate bool) error {
@@ -460,7 +510,14 @@ func (m *Manager) persistNewEphemeralService(ctx context.Context, accountID, pee
 		return err
 	}
 
+	if err := m.validatePrivateClusterTargets(ctx, svc.Targets, svc.ProxyCluster); err != nil {
+		return err
+	}
+
 	return m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		if err := m.validateServiceDomain(ctx, transaction, accountID, svc, svc.ProxyCluster); err != nil {
+			return err
+		}
 		if err := m.validateEphemeralPreconditions(ctx, transaction, accountID, peerID, svc); err != nil {
 			return err
 		}
@@ -577,6 +634,10 @@ func (m *Manager) persistServiceUpdate(ctx context.Context, accountID string, se
 		return nil, err
 	}
 
+	if err := m.validatePrivateClusterTargets(ctx, service.Targets, effectiveCluster); err != nil {
+		return nil, err
+	}
+
 	// Validate subdomain requirement *before* the transaction: the underlying
 	// capability lookup talks to the main DB pool, and SQLite's single-connection
 	// pool would self-deadlock if this ran while the tx already held the only
@@ -606,19 +667,25 @@ func (m *Manager) resolveEffectiveCluster(ctx context.Context, accountID string,
 		return existing.ProxyCluster, nil
 	}
 
-	if m.clusterDeriver != nil {
-		derived, err := m.clusterDeriver.DeriveClusterFromDomain(ctx, accountID, svc.Domain)
-		if err != nil {
-			log.WithError(err).Warnf("could not derive cluster from domain %s", svc.Domain)
-		} else {
-			return derived, nil
-		}
+	if m.clusterDeriver == nil {
+		return existing.ProxyCluster, nil
 	}
 
-	return existing.ProxyCluster, nil
+	// Falling back to the old cluster here would let an update move a service
+	// onto a domain the account has not validated, bypassing the check that
+	// creation makes.
+	derived, err := m.clusterDeriver.DeriveClusterFromDomain(ctx, accountID, svc.Domain)
+	if err != nil {
+		return "", status.Errorf(status.PreconditionFailed, "could not derive cluster from domain %s: %v", svc.Domain, err)
+	}
+
+	return derived, nil
 }
 
 func (m *Manager) executeServiceUpdate(ctx context.Context, transaction store.Store, accountID string, service *service.Service, updateInfo *serviceUpdateInfo, customPorts *bool, effectiveCluster string) error {
+	if err := m.validateServiceDomain(ctx, transaction, accountID, service, effectiveCluster); err != nil {
+		return err
+	}
 	existingService, err := transaction.GetServiceByID(ctx, store.LockingStrengthUpdate, accountID, service.ID)
 	if err != nil {
 		return err
@@ -644,6 +711,12 @@ func (m *Manager) executeServiceUpdate(ctx context.Context, transaction store.St
 	}
 
 	m.preserveExistingAuthSecrets(service, existingService)
+	if err := preserveTargetAccessActions(service, existingService); err != nil {
+		return err
+	}
+	if err := validateTargetAccessControl(service); err != nil {
+		return err
+	}
 	if err := validateHeaderAuthValues(service.Auth.HeaderAuths); err != nil {
 		return err
 	}
@@ -674,6 +747,75 @@ func (m *Manager) executeServiceUpdate(ctx context.Context, transaction store.St
 	return nil
 }
 
+func (m *Manager) validateServiceDomain(ctx context.Context, tx store.Store, accountID string, svc *service.Service, cluster string) error {
+	if m.clusterDeriver == nil {
+		return nil
+	}
+	return m.clusterDeriver.ValidateServiceDomain(ctx, tx, accountID, svc.Domain, cluster)
+}
+
+func validateTargetAccessControl(svc *service.Service) error {
+	if !svc.HasTargetAccessControl() {
+		return nil
+	}
+	// Legacy requests may acquire an existing action during the update merge.
+	if err := svc.Validate(); err != nil {
+		return status.Errorf(status.InvalidArgument, "%s", err)
+	}
+	return nil
+}
+
+func preserveTargetAccessActions(updated, existing *service.Service) error {
+	if !existing.HasTargetAccessControl() {
+		return nil
+	}
+	if slices.ContainsFunc(updated.Targets, func(target *service.Target) bool {
+		return target == nil
+	}) {
+		return status.Errorf(status.InvalidArgument, "target must not be nil")
+	}
+	if len(updated.Targets) > 0 && !slices.ContainsFunc(updated.Targets, func(target *service.Target) bool {
+		return !target.AccessActionProvided
+	}) {
+		return nil
+	}
+	byPath := make(map[string]*service.Target, len(existing.Targets))
+	for _, target := range existing.Targets {
+		location := effectiveTargetPath(target)
+		if _, duplicate := byPath[location]; duplicate {
+			return status.Errorf(status.InvalidArgument,
+				"cannot preserve target access control for duplicate location %q", location)
+		}
+		byPath[location] = target
+	}
+	actionsProvided := false
+	for _, target := range updated.Targets {
+		actionsProvided = actionsProvided || target.AccessActionProvided
+		location := effectiveTargetPath(target)
+		if previous := byPath[location]; previous != nil && !target.AccessActionProvided {
+			target.AccessAction = previous.AccessAction
+		}
+		delete(byPath, location)
+	}
+	if actionsProvided {
+		return nil
+	}
+	for location, target := range byPath {
+		if target.AccessAction != "" && target.AccessAction != service.TargetAccessActionInherit {
+			return status.Errorf(status.InvalidArgument,
+				"include access_action when removing or changing controlled target location %q", location)
+		}
+	}
+	return nil
+}
+
+func effectiveTargetPath(target *service.Target) string {
+	if target.Path == nil || *target.Path == "" {
+		return "/"
+	}
+	return *target.Path
+}
+
 // validateL4PortDiffOnClusterDiff checks if custom L4 ports are configured and validates port changes across clusters.
 // It ensures no port changes if custom ports are unsupported for a given cluster and protocol mode.
 // Returns an error if validation fails, otherwise returns nil.
@@ -1009,15 +1151,16 @@ func (m *Manager) ReloadAllServicesForAccount(ctx context.Context, accountID str
 
 	oidcCfg := m.proxyController.GetOIDCValidationConfig()
 
+	var errs []error
 	for _, s := range services {
-		err = m.replaceHostByLookup(ctx, accountID, s)
-		if err != nil {
-			return fmt.Errorf("failed to replace host by lookup for service %s: %w", s.ID, err)
+		if err := m.replaceHostByLookup(ctx, accountID, s); err != nil {
+			errs = append(errs, fmt.Errorf("replace host by lookup for service %s: %w", s.ID, err))
+			continue
 		}
 		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, s.ToProtoMapping(service.Update, "", oidcCfg), s.ProxyCluster)
 	}
 
-	return nil
+	return errors.Join(errs...)
 }
 
 func (m *Manager) GetGlobalServices(ctx context.Context) ([]*service.Service, error) {
diff --git a/management/internals/modules/reverseproxy/service/manager/manager_test.go b/management/internals/modules/reverseproxy/service/manager/manager_test.go
index 29a117921..f9273d594 100644
--- a/management/internals/modules/reverseproxy/service/manager/manager_test.go
+++ b/management/internals/modules/reverseproxy/service/manager/manager_test.go
@@ -7,11 +7,10 @@ import (
 	"testing"
 	"time"
 
-	cachestore "github.com/eko/gocache/lib/v4/store"
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel/metric/noop"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
@@ -28,10 +27,11 @@ import (
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
-func testCacheStore(t *testing.T) cachestore.StoreInterface {
+func testCacheStore(t *testing.T) nbcache.Store {
 	t.Helper()
 	s, err := nbcache.NewStore(context.Background(), 30*time.Minute, 10*time.Minute, 100)
 	require.NoError(t, err)
@@ -295,6 +295,7 @@ func TestPersistNewService(t *testing.T) {
 		assert.Equal(t, status.AlreadyExists, sErr.Type())
 	})
 }
+
 func TestPreserveExistingAuthSecrets(t *testing.T) {
 	mgr := &Manager{}
 
@@ -433,8 +434,8 @@ func TestDeletePeerService_SourcePeerValidation(t *testing.T) {
 	newProxyServer := func(t *testing.T) *nbgrpc.ProxyServiceServer {
 		t.Helper()
 		tokenStore := nbgrpc.NewOneTimeTokenStore(context.Background(), testCacheStore(t))
-		pkceStore := nbgrpc.NewPKCEVerifierStore(context.Background(), testCacheStore(t))
-		srv := nbgrpc.NewProxyServiceServer(nil, tokenStore, pkceStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
+		singleUseStore := nbgrpc.NewSingleUseStore(context.Background(), testCacheStore(t))
+		srv := nbgrpc.NewProxyServiceServer(nil, tokenStore, singleUseStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
 		return srv
 	}
 
@@ -655,6 +656,10 @@ func (d *testClusterDeriver) GetClusterDomains() []string {
 	return d.domains
 }
 
+func (d *testClusterDeriver) ValidateServiceDomain(context.Context, store.Store, string, string, string) error {
+	return nil
+}
+
 const (
 	testAccountID = "test-account"
 	testPeerID    = "test-peer-1"
@@ -722,8 +727,8 @@ func setupIntegrationTest(t *testing.T) (*Manager, store.Store) {
 	}
 
 	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, testCacheStore(t))
-	proxySrv := nbgrpc.NewProxyServiceServer(nil, tokenStore, pkceStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, testCacheStore(t))
+	proxySrv := nbgrpc.NewProxyServiceServer(nil, tokenStore, singleUseStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
 
 	proxyController, err := proxymanager.NewGRPCController(proxySrv, noop.NewMeterProvider().Meter(""))
 	require.NoError(t, err)
@@ -1146,8 +1151,8 @@ func TestDeleteService_DeletesTargets(t *testing.T) {
 	mockAcct := account.NewMockManager(ctrl)
 
 	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, testCacheStore(t))
-	proxySrv := nbgrpc.NewProxyServiceServer(nil, tokenStore, pkceStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, testCacheStore(t))
+	proxySrv := nbgrpc.NewProxyServiceServer(nil, tokenStore, singleUseStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
 
 	proxyController, err := proxymanager.NewGRPCController(proxySrv, noop.NewMeterProvider().Meter(""))
 	require.NoError(t, err)
@@ -1477,3 +1482,42 @@ func TestReplaceHostByLookup_SkipsClusterTarget(t *testing.T) {
 	require.NoError(t, mgr.replaceHostByLookup(ctx, accountID, svc), "cluster target must not trigger peer/resource lookup")
 	assert.Equal(t, "127.0.0.1", svc.Targets[0].Host, "operator-supplied host must be preserved for cluster target")
 }
+
+func TestReloadAllServicesForAccount_ContinuesAfterFailedService(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	mockStore := store.NewMockStore(ctrl)
+	proxyController := proxy.NewMockController(ctrl)
+	accountID := "test-account"
+
+	broken := &rpservice.Service{
+		ID:           "svc-broken",
+		AccountID:    accountID,
+		ProxyCluster: "eu.proxy.netbird.io",
+		Targets:      []*rpservice.Target{{TargetId: "x", TargetType: "unknown"}},
+	}
+	healthy := &rpservice.Service{
+		ID:           "svc-healthy",
+		AccountID:    accountID,
+		ProxyCluster: "eu.proxy.netbird.io",
+		Targets:      []*rpservice.Target{{TargetId: "peer-1", TargetType: rpservice.TargetTypePeer, Host: "100.64.0.1", Protocol: "http", Port: 8080, Enabled: true}},
+	}
+
+	mockStore.EXPECT().GetAccountServices(ctx, store.LockingStrengthNone, accountID).Return([]*rpservice.Service{broken, healthy}, nil)
+	mockStore.EXPECT().GetPeerByID(ctx, store.LockingStrengthNone, accountID, "peer-1").
+		Return(&nbpeer.Peer{ID: "peer-1", IP: netip.MustParseAddr("100.70.0.9")}, nil)
+	proxyController.EXPECT().GetOIDCValidationConfig().Return(proxy.OIDCValidationConfig{})
+	proxyController.EXPECT().SendServiceUpdateToCluster(ctx, accountID, gomock.Any(), "eu.proxy.netbird.io").
+		Do(func(_ context.Context, _ string, mapping *proto.ProxyMapping, _ string) {
+			assert.Equal(t, "svc-healthy", mapping.GetId())
+			require.Len(t, mapping.GetPath(), 1)
+			assert.Contains(t, mapping.GetPath()[0].GetTarget(), "100.70.0.9", "mapping must carry the peer's current IP")
+		})
+
+	mgr := &Manager{store: mockStore, proxyController: proxyController}
+
+	err := mgr.ReloadAllServicesForAccount(ctx, accountID)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "svc-broken")
+	assert.NotContains(t, err.Error(), "svc-healthy")
+}
diff --git a/management/internals/modules/reverseproxy/service/manager/private_cluster_test.go b/management/internals/modules/reverseproxy/service/manager/private_cluster_test.go
new file mode 100644
index 000000000..1f507294e
--- /dev/null
+++ b/management/internals/modules/reverseproxy/service/manager/private_cluster_test.go
@@ -0,0 +1,218 @@
+package manager
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/metric/noop"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// setupPrivateClusterTest wires the real proxy manager as the capability
+// provider and connects one proxy to testCluster reporting the given private
+// capability. A nil private connects no proxy, so the capability is unreported.
+func setupPrivateClusterTest(t *testing.T, private *bool) (*Manager, store.Store) {
+	t.Helper()
+
+	mgr, testStore := setupIntegrationTest(t)
+
+	proxyMgr, err := proxymanager.NewManager(testStore, noop.NewMeterProvider().Meter(""))
+	require.NoError(t, err)
+	mgr.capabilities = proxyMgr
+
+	if private != nil {
+		connectTestProxy(t, proxyMgr, "proxy-1", &proxy.Capabilities{Private: private})
+	}
+
+	return mgr, testStore
+}
+
+func connectTestProxy(t *testing.T, proxyMgr *proxymanager.Manager, proxyID string, caps *proxy.Capabilities) {
+	t.Helper()
+	_, err := proxyMgr.Connect(context.Background(), proxyID, "session-"+proxyID, testCluster, "127.0.0.1", "", nil, caps)
+	require.NoError(t, err)
+}
+
+func clusterTarget() *rpservice.Target {
+	return &rpservice.Target{
+		TargetId:   testCluster,
+		TargetType: rpservice.TargetTypeCluster,
+		Host:       "backend.lan",
+		Port:       8080,
+		Protocol:   "http",
+		Enabled:    true,
+		Options:    rpservice.TargetOptions{DirectUpstream: true},
+	}
+}
+
+func directUpstreamPeerTarget() *rpservice.Target {
+	return &rpservice.Target{
+		TargetId:   testPeerID,
+		TargetType: rpservice.TargetTypePeer,
+		Host:       "backend.lan",
+		Port:       8080,
+		Protocol:   "http",
+		Enabled:    true,
+		Options:    rpservice.TargetOptions{DirectUpstream: true},
+	}
+}
+
+func TestCreateService_PrivateClusterTargets(t *testing.T) {
+	tests := []struct {
+		name    string
+		private *bool
+		target  *rpservice.Target
+		wantErr string
+	}{
+		{name: "cluster target on private cluster", private: boolPtr(true), target: clusterTarget()},
+		{name: "direct upstream on private cluster", private: boolPtr(true), target: directUpstreamPeerTarget()},
+		{name: "cluster target on non-private cluster", private: boolPtr(false), target: clusterTarget(), wantErr: `target_type "cluster" requires a proxy cluster with private mode enabled`},
+		{name: "direct upstream on non-private cluster", private: boolPtr(false), target: directUpstreamPeerTarget(), wantErr: "direct_upstream requires a proxy cluster with private mode enabled"},
+		{name: "cluster target with unreported capability", private: nil, target: clusterTarget(), wantErr: `target_type "cluster" requires a proxy cluster with private mode enabled`},
+		{name: "direct upstream with unreported capability", private: nil, target: directUpstreamPeerTarget(), wantErr: "direct_upstream requires a proxy cluster with private mode enabled"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			mgr, testStore := setupPrivateClusterTest(t, tc.private)
+
+			svc := newTestService("app.test.netbird.io")
+			svc.Targets = []*rpservice.Target{tc.target}
+
+			_, err := mgr.CreateService(ctx, testAccountID, testUserID, svc)
+
+			services, listErr := testStore.GetAccountServices(ctx, store.LockingStrengthNone, testAccountID)
+			require.NoError(t, listErr)
+
+			if tc.wantErr == "" {
+				require.NoError(t, err)
+				assert.Len(t, services, 1, "the service should be persisted")
+				return
+			}
+
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tc.wantErr)
+			sErr, ok := status.FromError(err)
+			require.True(t, ok, "the caller must receive a typed error")
+			assert.Equal(t, status.InvalidArgument, sErr.Type(), "the rejection should be an invalid argument")
+			assert.Empty(t, services, "a rejected service must not be persisted")
+		})
+	}
+}
+
+// A cluster where only some proxies run in private mode must not accept these
+// targets: the mapping is delivered to every proxy in the cluster, so the
+// non-private ones would serve the target from their host network as well.
+func TestCreateService_MixedClusterRejectsPrivateTargets(t *testing.T) {
+	tests := []struct {
+		name       string
+		secondCaps *proxy.Capabilities
+	}{
+		{name: "second proxy reports not private", secondCaps: &proxy.Capabilities{Private: boolPtr(false)}},
+		{name: "second proxy predates capability reporting", secondCaps: nil},
+	}
+
+	for _, tc := range tests {
+		for _, target := range []*rpservice.Target{clusterTarget(), directUpstreamPeerTarget()} {
+			t.Run(tc.name+"/"+string(target.TargetType), func(t *testing.T) {
+				ctx := context.Background()
+				mgr, testStore := setupPrivateClusterTest(t, boolPtr(true))
+				connectTestProxy(t, mgr.capabilities.(*proxymanager.Manager), "proxy-2", tc.secondCaps)
+
+				svc := newTestService("app.test.netbird.io")
+				svc.Targets = []*rpservice.Target{target}
+
+				_, err := mgr.CreateService(ctx, testAccountID, testUserID, svc)
+				require.Error(t, err, "a cluster with a non-private proxy must not accept the target")
+				assert.Contains(t, err.Error(), "requires a proxy cluster with private mode enabled")
+
+				services, err := testStore.GetAccountServices(ctx, store.LockingStrengthNone, testAccountID)
+				require.NoError(t, err)
+				assert.Empty(t, services, "a rejected service must not be persisted")
+			})
+		}
+	}
+}
+
+func TestCreateService_RegularTargetIgnoresPrivateCapability(t *testing.T) {
+	ctx := context.Background()
+	mgr, _ := setupPrivateClusterTest(t, boolPtr(false))
+
+	_, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.test.netbird.io"))
+	require.NoError(t, err, "a peer target without direct upstream must not need a private cluster")
+}
+
+func TestUpdateService_PrivateClusterTargets(t *testing.T) {
+	tests := []struct {
+		name    string
+		target  *rpservice.Target
+		wantErr string
+	}{
+		{name: "switch to cluster target", target: clusterTarget(), wantErr: `target_type "cluster" requires a proxy cluster with private mode enabled`},
+		{name: "enable direct upstream", target: directUpstreamPeerTarget(), wantErr: "direct_upstream requires a proxy cluster with private mode enabled"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			mgr, testStore := setupPrivateClusterTest(t, boolPtr(false))
+
+			created, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.test.netbird.io"))
+			require.NoError(t, err)
+
+			updated := newTestService("app.test.netbird.io")
+			updated.ID = created.ID
+			updated.AccountID = testAccountID
+			updated.Targets = []*rpservice.Target{tc.target}
+
+			_, err = mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tc.wantErr)
+
+			stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, created.ID)
+			require.NoError(t, err)
+			require.Len(t, stored.Targets, 1)
+			assert.Equal(t, rpservice.TargetTypePeer, stored.Targets[0].TargetType, "the stored target must be unchanged")
+			assert.False(t, stored.Targets[0].Options.DirectUpstream, "the stored target must keep direct upstream disabled")
+		})
+	}
+}
+
+func TestUpdateService_PrivateClusterAllowsClusterTarget(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupPrivateClusterTest(t, boolPtr(true))
+
+	created, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.test.netbird.io"))
+	require.NoError(t, err)
+
+	updated := newTestService("app.test.netbird.io")
+	updated.ID = created.ID
+	updated.AccountID = testAccountID
+	updated.Targets = []*rpservice.Target{clusterTarget()}
+
+	_, err = mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.NoError(t, err)
+
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, created.ID)
+	require.NoError(t, err)
+	require.Len(t, stored.Targets, 1)
+	assert.Equal(t, rpservice.TargetTypeCluster, stored.Targets[0].TargetType, "the cluster target should be stored")
+}
+
+func TestValidatePrivateClusterTargets_NoLookupWithoutPrivateTargets(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	// No ClusterAllProxiesPrivate expectation: a lookup would fail the test.
+	mgr := &Manager{capabilities: proxy.NewMockManager(ctrl)}
+
+	targets := []*rpservice.Target{{TargetId: testPeerID, TargetType: rpservice.TargetTypePeer}}
+	require.NoError(t, mgr.validatePrivateClusterTargets(context.Background(), targets, testCluster))
+}
diff --git a/management/internals/modules/reverseproxy/service/manager/target_access_test.go b/management/internals/modules/reverseproxy/service/manager/target_access_test.go
new file mode 100644
index 000000000..e87d0c64c
--- /dev/null
+++ b/management/internals/modules/reverseproxy/service/manager/target_access_test.go
@@ -0,0 +1,196 @@
+package manager
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+func TestCreateServiceTargetAccessWithoutActiveProxies(t *testing.T) {
+	for _, action := range []rpservice.TargetAccessAction{
+		rpservice.TargetAccessActionBlock,
+		rpservice.TargetAccessActionBypass,
+	} {
+		t.Run(string(action), func(t *testing.T) {
+			ctx := context.Background()
+			mgr, testStore, _ := setupL4Test(t, nil)
+			svc := &rpservice.Service{
+				Name: "target access", Domain: "target.test.netbird.io", Mode: rpservice.ModeHTTP,
+				Enabled: true,
+				Targets: []*rpservice.Target{{
+					AccountID: testAccountID, TargetId: testPeerID,
+					TargetType: rpservice.TargetTypePeer, Protocol: "http", Port: 8080,
+					Enabled: true, AccessAction: action,
+				}},
+			}
+			created, err := mgr.CreateService(ctx, testAccountID, testUserID, svc)
+			require.NoError(t, err)
+			stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, created.ID)
+			require.NoError(t, err)
+			require.Len(t, stored.Targets, 1)
+			assert.Equal(t, action, stored.Targets[0].AccessAction,
+				"accepted target actions must survive persistence")
+		})
+	}
+}
+
+func TestUpdateServicePreservesOmittedTargetAccessAction(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore, _ := setupL4Test(t, nil)
+	existing := seedService(t, testStore, "protected", "http", "target.test.netbird.io", testCluster, 0)
+	existing.Targets[0].AccessAction = rpservice.TargetAccessActionBlock
+	require.NoError(t, testStore.UpdateService(ctx, existing))
+
+	updated := existing.Copy()
+	updated.Name = "renamed by an older client"
+	updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+	updated.Targets[0].AccessActionProvided = false
+	rootPath := "/"
+	updated.Targets[0].Path = &rootPath
+	_, err := mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.NoError(t, err)
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+	require.NoError(t, err)
+	assert.Equal(t, updated.Name, stored.Name, "legacy updates must still apply unrelated edits")
+	assert.Equal(t, rpservice.TargetAccessActionBlock, stored.Targets[0].AccessAction,
+		"an omitted action must preserve the stored block across equivalent root locations")
+
+	emptyPath := ""
+	updated.Targets[0].Path = &emptyPath
+	updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+	_, err = mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.NoError(t, err)
+	stored, err = testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+	require.NoError(t, err)
+	assert.Equal(t, rpservice.TargetAccessActionBlock, stored.Targets[0].AccessAction,
+		"an older client's empty root location must preserve the stored block")
+
+	updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+	updated.Targets[0].AccessActionProvided = true
+	_, err = mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.NoError(t, err)
+	stored, err = testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+	require.NoError(t, err)
+	assert.Equal(t, rpservice.TargetAccessActionInherit, stored.Targets[0].AccessAction,
+		"explicit inherit must clear the stored target block")
+}
+
+func TestUpdateServiceActivatesPreservedTargetAccess(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore, _ := setupL4Test(t, nil)
+	existing := seedService(t, testStore, "protected", "http", "target.test.netbird.io", testCluster, 0)
+	existing.Enabled = false
+	existing.Targets[0].AccessAction = rpservice.TargetAccessActionBlock
+	require.NoError(t, testStore.UpdateService(ctx, existing))
+
+	updated := existing.Copy()
+	updated.Enabled = true
+	updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+	updated.Targets[0].AccessActionProvided = false
+	_, err := mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.NoError(t, err)
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+	require.NoError(t, err)
+	assert.True(t, stored.Enabled, "activating target access must not require an active proxy")
+	assert.Equal(t, rpservice.TargetAccessActionBlock, stored.Targets[0].AccessAction,
+		"activation must retain an omitted stored access action")
+}
+
+func TestUpdateServiceValidatesPreservedTargetAccess(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore, _ := setupL4Test(t, nil)
+	existing := seedService(t, testStore, "public", "http", "target.test.netbird.io", testCluster, 0)
+	existing.Targets[0].AccessAction = rpservice.TargetAccessActionBypass
+	require.NoError(t, testStore.UpdateService(ctx, existing))
+
+	updated := existing.Copy()
+	updated.Private = true
+	updated.AccessGroups = []string{testGroupID}
+	updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+	updated.Targets[0].AccessActionProvided = false
+	_, err := mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.ErrorContains(t, err, "bypass access_action is not supported for private services")
+
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+	require.NoError(t, err)
+	assert.False(t, stored.Private, "an invalid preserved bypass must prevent the private-service update")
+	assert.Equal(t, rpservice.TargetAccessActionBypass, stored.Targets[0].AccessAction,
+		"a rejected update must retain the existing target action")
+}
+
+func TestUpdateServiceLegacyClientCannotRemoveControlledPath(t *testing.T) {
+	for _, operation := range []string{"rename", "delete"} {
+		t.Run(operation, func(t *testing.T) {
+			ctx := context.Background()
+			mgr, testStore, _ := setupL4Test(t, nil)
+			existing := seedService(t, testStore, "protected", "http", "target.test.netbird.io", testCluster, 0)
+			blockedPath := "/blocked"
+			existing.Targets = append(existing.Targets, &rpservice.Target{
+				AccountID: testAccountID, TargetId: testPeerID, TargetType: rpservice.TargetTypePeer,
+				Protocol: "http", Port: 8080, Enabled: true, Path: &blockedPath,
+				AccessAction: rpservice.TargetAccessActionBlock,
+			})
+			require.NoError(t, testStore.UpdateService(ctx, existing))
+
+			updated := existing.Copy()
+			updated.Targets[1].AccessAction = rpservice.TargetAccessActionInherit
+			if operation == "rename" {
+				renamedPath := "/renamed"
+				updated.Targets[1].Path = &renamedPath
+			} else {
+				updated.Targets = updated.Targets[:1]
+			}
+			_, err := mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+			require.Error(t, err)
+			stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+			require.NoError(t, err)
+			require.Len(t, stored.Targets, 2, "a legacy structural edit must retain the controlled target")
+			var blocked *rpservice.Target
+			for _, target := range stored.Targets {
+				if effectiveTargetPath(target) == blockedPath {
+					blocked = target
+				}
+			}
+			require.NotNil(t, blocked, "the original controlled location must still exist")
+			assert.Equal(t, rpservice.TargetAccessActionBlock, blocked.AccessAction,
+				"a rejected legacy edit must not erase the block action")
+
+			updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+			updated.Targets[0].AccessActionProvided = true
+			_, err = mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+			require.NoError(t, err)
+			stored, err = testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+			require.NoError(t, err)
+			assert.False(t, stored.HasTargetAccessControl(),
+				"a feature-aware client must be able to intentionally remove or rename the controlled path")
+		})
+	}
+}
+
+func TestPreserveTargetAccessActionsExplicitUpdate(t *testing.T) {
+	existing := &rpservice.Service{Targets: []*rpservice.Target{
+		{Enabled: true, AccessAction: rpservice.TargetAccessActionBlock},
+		{Enabled: false, AccessAction: rpservice.TargetAccessActionInherit},
+	}}
+	updated := &rpservice.Service{Targets: []*rpservice.Target{
+		{Enabled: true, AccessAction: rpservice.TargetAccessActionBypass, AccessActionProvided: true},
+		{Enabled: false, AccessAction: rpservice.TargetAccessActionInherit, AccessActionProvided: true},
+	}}
+	require.NoError(t, preserveTargetAccessActions(updated, existing))
+	assert.Equal(t, rpservice.TargetAccessActionBypass, updated.Targets[0].AccessAction,
+		"explicit actions must not need an ambiguous location-based legacy merge")
+
+	updated.Targets[0].AccessActionProvided = false
+	assert.Error(t, preserveTargetAccessActions(updated, existing),
+		"an omitted action must be rejected when its stored location is ambiguous")
+
+	existing.Targets = existing.Targets[:1]
+	updated.Targets = nil
+	assert.Error(t, preserveTargetAccessActions(updated, existing),
+		"an empty target list must not count as an explicit removal of the stored block")
+}
diff --git a/management/internals/modules/reverseproxy/service/service.go b/management/internals/modules/reverseproxy/service/service.go
index b6438abde..de47f1239 100644
--- a/management/internals/modules/reverseproxy/service/service.go
+++ b/management/internals/modules/reverseproxy/service/service.go
@@ -55,6 +55,8 @@ const (
 	SourceEphemeral = "ephemeral"
 )
 
+var ErrUnsupportedIPAddressUpstreamHost = errors.New("unsupported ip address for a direct upstream host")
+
 type TargetOptions struct {
 	SkipTLSVerify      bool              `json:"skip_tls_verify"`
 	RequestTimeout     time.Duration     `json:"request_timeout,omitempty"`
@@ -114,18 +116,20 @@ type MiddlewareConfig struct {
 }
 
 type Target struct {
-	ID            uint          `gorm:"primaryKey" json:"-"`
-	AccountID     string        `gorm:"index:idx_target_account;not null" json:"-"`
-	ServiceID     string        `gorm:"index:idx_service_targets;not null" json:"-"`
-	Path          *string       `json:"path,omitempty"`
-	Host          string        `json:"host"`
-	Port          uint16        `gorm:"index:idx_target_port" json:"port"`
-	Protocol      string        `gorm:"index:idx_target_protocol" json:"protocol"`
-	TargetId      string        `gorm:"index:idx_target_id" json:"target_id"`
-	TargetType    TargetType    `gorm:"index:idx_target_type" json:"target_type"`
-	Enabled       bool          `gorm:"index:idx_target_enabled" json:"enabled"`
-	Options       TargetOptions `gorm:"embedded" json:"options"`
-	ProxyProtocol bool          `json:"proxy_protocol"`
+	ID                   uint               `gorm:"primaryKey" json:"-"`
+	AccountID            string             `gorm:"index:idx_target_account;not null" json:"-"`
+	ServiceID            string             `gorm:"index:idx_service_targets;not null" json:"-"`
+	Path                 *string            `json:"path,omitempty"`
+	Host                 string             `json:"host"`
+	Port                 uint16             `gorm:"index:idx_target_port" json:"port"`
+	Protocol             string             `gorm:"index:idx_target_protocol" json:"protocol"`
+	TargetId             string             `gorm:"index:idx_target_id" json:"target_id"`
+	TargetType           TargetType         `gorm:"index:idx_target_type" json:"target_type"`
+	Enabled              bool               `gorm:"index:idx_target_enabled" json:"enabled"`
+	AccessAction         TargetAccessAction `gorm:"type:varchar(16);not null;default:'inherit'" json:"access_action"`
+	AccessActionProvided bool               `gorm:"-" json:"-"`
+	Options              TargetOptions      `gorm:"embedded" json:"options"`
+	ProxyProtocol        bool               `json:"proxy_protocol"`
 }
 
 type PasswordAuthConfig struct {
@@ -307,14 +311,16 @@ func (s *Service) ToAPIResponse() *api.Service {
 	// Convert internal targets to API targets
 	apiTargets := make([]api.ServiceTarget, 0, len(s.Targets))
 	for _, target := range s.Targets {
+		accessAction := api.ServiceTargetAccessAction(target.effectiveAccessAction())
 		st := api.ServiceTarget{
-			Path:       target.Path,
-			Host:       &target.Host,
-			Port:       int(target.Port),
-			Protocol:   api.ServiceTargetProtocol(target.Protocol),
-			TargetId:   target.TargetId,
-			TargetType: api.ServiceTargetTargetType(target.TargetType),
-			Enabled:    target.Enabled && !s.Terminated,
+			Path:         target.Path,
+			Host:         &target.Host,
+			Port:         int(target.Port),
+			Protocol:     api.ServiceTargetProtocol(target.Protocol),
+			TargetId:     target.TargetId,
+			TargetType:   api.ServiceTargetTargetType(target.TargetType),
+			Enabled:      target.Enabled && !s.Terminated,
+			AccessAction: &accessAction,
 		}
 		opts := targetOptionsToAPI(target.Options)
 		if opts == nil {
@@ -388,6 +394,7 @@ func (s *Service) ToProtoMapping(operation Operation, authToken string, oidcConf
 
 	if s.Auth.BearerAuth != nil && s.Auth.BearerAuth.Enabled {
 		auth.Oidc = true
+		auth.AllowedGroupIds = append([]string(nil), s.Auth.BearerAuth.DistributionGroups...)
 	}
 
 	for _, h := range s.Auth.HeaderAuths {
@@ -460,8 +467,9 @@ func (s *Service) buildPathMappings() []*proto.PathMapping {
 		}
 
 		pm := &proto.PathMapping{
-			Path:   path,
-			Target: targetURL.String(),
+			Path:         path,
+			Target:       targetURL.String(),
+			AccessAction: targetAccessActionToProto(target.effectiveAccessAction()),
 		}
 		pm.Options = targetOptionsToProto(target.Options)
 		pathMappings = append(pathMappings, pm)
@@ -724,13 +732,18 @@ func targetsFromAPI(accountID string, apiTargetsPtr *[]api.ServiceTarget) ([]*Ta
 	targets := make([]*Target, 0, len(apiTargets))
 	for i, apiTarget := range apiTargets {
 		target := &Target{
-			AccountID:  accountID,
-			Path:       apiTarget.Path,
-			Port:       uint16(apiTarget.Port), //nolint:gosec // validated by API layer
-			Protocol:   string(apiTarget.Protocol),
-			TargetId:   apiTarget.TargetId,
-			TargetType: TargetType(apiTarget.TargetType),
-			Enabled:    apiTarget.Enabled,
+			AccountID:    accountID,
+			Path:         apiTarget.Path,
+			Port:         uint16(apiTarget.Port), //nolint:gosec // validated by API layer
+			Protocol:     string(apiTarget.Protocol),
+			TargetId:     apiTarget.TargetId,
+			TargetType:   TargetType(apiTarget.TargetType),
+			Enabled:      apiTarget.Enabled,
+			AccessAction: TargetAccessActionInherit,
+		}
+		if apiTarget.AccessAction != nil {
+			target.AccessAction = TargetAccessAction(*apiTarget.AccessAction)
+			target.AccessActionProvided = true
 		}
 		if apiTarget.Host != nil {
 			target.Host = *apiTarget.Host
@@ -950,38 +963,95 @@ func (s *Service) validateTLSMode() error {
 }
 
 func (s *Service) validateHTTPTargets() error {
+	strictPaths := false
 	for i, target := range s.Targets {
-		switch target.TargetType {
-		case TargetTypePeer, TargetTypeHost, TargetTypeDomain:
-			// Host is normally overwritten by replaceHostByLookup with the
-			// resolved peer IP / resource address; operator-supplied values
-			// are honored only when DirectUpstream is set. Validate the
-			// override here so misconfigured hosts fail fast at API time.
-			if err := validateDirectUpstreamHost(i, target); err != nil {
-				return err
-			}
-		case TargetTypeSubnet:
-			if target.Host == "" {
-				return fmt.Errorf("target %d has empty host but target_type is %q", i, target.TargetType)
-			}
-		case TargetTypeCluster:
-			if err := validateClusterTarget(i, target); err != nil {
-				return err
-			}
-		default:
-			return fmt.Errorf("target %d has invalid target_type %q", i, target.TargetType)
-		}
-		if target.TargetId == "" {
-			return fmt.Errorf("target %d has empty target_id", i)
-		}
-		if target.ProxyProtocol {
-			return fmt.Errorf("target %d: proxy_protocol is not supported for HTTP services", i)
-		}
-		if err := validateTargetOptions(i, &target.Options); err != nil {
+		if err := s.validateHTTPTarget(i, target); err != nil {
 			return err
 		}
+		if target.Enabled && target.effectiveAccessAction() != TargetAccessActionInherit {
+			strictPaths = true
+		}
+	}
+	if !strictPaths {
+		return nil
 	}
 
+	paths := make(map[string]int, len(s.Targets))
+	for i, target := range s.Targets {
+		if !target.Enabled {
+			continue
+		}
+		normalizedPath := normalizedTargetPath(target.Path)
+		if previous, ok := paths[normalizedPath]; ok {
+			return fmt.Errorf("targets %d and %d have duplicate path %q", previous, i, normalizedPath)
+		}
+		paths[normalizedPath] = i
+	}
+
+	return nil
+}
+
+func (s *Service) validateHTTPTarget(idx int, target *Target) error {
+	if target == nil {
+		return fmt.Errorf("target %d is nil", idx)
+	}
+	if err := validateTargetAccessAction(idx, target, s.Private); err != nil {
+		return err
+	}
+	switch target.TargetType {
+	case TargetTypePeer, TargetTypeHost, TargetTypeDomain:
+		// Host is normally overwritten by replaceHostByLookup with the
+		// resolved peer IP / resource address; operator-supplied values
+		// are honored only when DirectUpstream is set. Validate the
+		// override here so misconfigured hosts fail fast at API time.
+		if err := validateDirectUpstreamHost(idx, target); err != nil {
+			return err
+		}
+	case TargetTypeSubnet:
+		if err := validateSubnetTarget(idx, target); err != nil {
+			return err
+		}
+	case TargetTypeCluster:
+		if err := validateClusterTarget(idx, target); err != nil {
+			return err
+		}
+	default:
+		return fmt.Errorf("target %d has invalid target_type %q", idx, target.TargetType)
+	}
+	if target.TargetId == "" {
+		return fmt.Errorf("target %d has empty target_id", idx)
+	}
+	if target.ProxyProtocol {
+		return fmt.Errorf("target %d: proxy_protocol is not supported for HTTP services", idx)
+	}
+	return validateTargetOptions(idx, &target.Options)
+}
+
+func validateSubnetTarget(idx int, target *Target) error {
+	host := strings.TrimSpace(target.Host)
+	if host == "" {
+		return fmt.Errorf("target %d has empty host but target_type is %q", idx, target.TargetType)
+	}
+	if strings.ContainsAny(host, " \t/") {
+		return fmt.Errorf("target %d: host %q contains invalid characters", idx, host)
+	}
+	if _, _, err := net.SplitHostPort(host); err == nil {
+		return fmt.Errorf("target %d: host %q must not include a port (set target.port instead)", idx, host)
+	}
+	noBrackets := strings.TrimSuffix(strings.TrimPrefix(host, "["), "]")
+	maybeip, err := netip.ParseAddr(noBrackets)
+	if err != nil { // not an ip
+		return nil //nolint:nilerr
+	}
+	if maybeip.Zone() != "" {
+		return fmt.Errorf("invalid direct upstream host ip %s %w", maybeip.String(), ErrUnsupportedIPAddressUpstreamHost)
+	}
+	if !target.Options.DirectUpstream {
+		return nil
+	}
+	if maybeip.IsLoopback() || maybeip.IsMulticast() || maybeip.IsLinkLocalUnicast() {
+		return fmt.Errorf("invalid direct upstream host ip %s %w", maybeip.String(), ErrUnsupportedIPAddressUpstreamHost)
+	}
 	return nil
 }
 
@@ -1019,14 +1089,33 @@ func validateDirectUpstreamHost(idx int, target *Target) error {
 	if _, _, err := net.SplitHostPort(host); err == nil {
 		return fmt.Errorf("target %d: host %q must not include a port (set target.port instead)", idx, host)
 	}
+	noBrackets := strings.TrimSuffix(strings.TrimPrefix(host, "["), "]")
+	maybeip, err := netip.ParseAddr(noBrackets)
+	if err != nil { // not an ip
+		return nil //nolint:nilerr
+	}
+	if maybeip.Zone() != "" || maybeip.IsLoopback() || maybeip.IsMulticast() || maybeip.IsLinkLocalUnicast() {
+		return fmt.Errorf("invalid direct upstream host ip %s %w", maybeip.String(), ErrUnsupportedIPAddressUpstreamHost)
+	}
+
 	return nil
 }
 
 func (s *Service) validateL4Target(target *Target) error {
+	if target == nil {
+		return errors.New("target 0 is nil")
+	}
 	// L4 services have a single target; per-target disable is meaningless
 	// (use the service-level Enabled flag instead). Force it on so that
 	// buildPathMappings always includes the target in the proto.
 	target.Enabled = true
+	action, err := validatedTargetAccessAction(0, target)
+	if err != nil {
+		return err
+	}
+	if action != TargetAccessActionInherit {
+		return errors.New("access_action is only supported for HTTP services")
+	}
 
 	if target.TargetId == "" {
 		return errors.New("target_id is required for L4 services")
diff --git a/management/internals/modules/reverseproxy/service/service_test.go b/management/internals/modules/reverseproxy/service/service_test.go
index a149ac609..756a5a915 100644
--- a/management/internals/modules/reverseproxy/service/service_test.go
+++ b/management/internals/modules/reverseproxy/service/service_test.go
@@ -62,9 +62,11 @@ func TestValidate_InvalidTargetType(t *testing.T) {
 
 func TestValidate_ResourceTarget(t *testing.T) {
 	rp := validProxy()
+	resourcePath := "/resource"
 	rp.Targets = append(rp.Targets, &Target{
 		TargetId:   "resource-1",
 		TargetType: TargetTypeHost,
+		Path:       &resourcePath,
 		Host:       "example.org",
 		Port:       443,
 		Protocol:   "https",
@@ -73,6 +75,232 @@ func TestValidate_ResourceTarget(t *testing.T) {
 	require.NoError(t, rp.Validate())
 }
 
+func TestValidateTargetAccessAction(t *testing.T) {
+	t.Run("valid actions", func(t *testing.T) {
+		for _, action := range []TargetAccessAction{
+			TargetAccessActionInherit,
+			TargetAccessActionBypass,
+			TargetAccessActionBlock,
+		} {
+			rp := validProxy()
+			rp.Targets[0].AccessAction = action
+			require.NoError(t, rp.Validate(), "action %q should be valid", action)
+		}
+	})
+
+	t.Run("unknown action", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets[0].AccessAction = "allow"
+		assert.ErrorContains(t, rp.Validate(), `unknown access_action "allow"`)
+	})
+
+	t.Run("explicit empty action", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets[0].AccessActionProvided = true
+		assert.ErrorContains(t, rp.Validate(), `unknown access_action ""`)
+	})
+
+	t.Run("private bypass", func(t *testing.T) {
+		rp := validProxy()
+		rp.Private = true
+		rp.AccessGroups = []string{"group-1"}
+		rp.Targets[0].AccessAction = TargetAccessActionBypass
+		assert.ErrorContains(t, rp.Validate(), "not supported for private services")
+	})
+
+	t.Run("Agent Network bypass", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets[0].AccessAction = TargetAccessActionBypass
+		rp.Targets[0].Options.AgentNetwork = true
+		assert.ErrorContains(t, rp.Validate(), "not supported for Agent Network targets")
+	})
+
+	t.Run("block remains available to private services", func(t *testing.T) {
+		rp := validProxy()
+		rp.Private = true
+		rp.AccessGroups = []string{"group-1"}
+		rp.Targets[0].AccessAction = TargetAccessActionBlock
+		require.NoError(t, rp.Validate())
+	})
+
+	t.Run("non HTTP service", func(t *testing.T) {
+		rp := validProxy()
+		rp.Mode = ModeTCP
+		rp.ListenPort = 8080
+		rp.Targets[0].Protocol = TargetProtoTCP
+		rp.Targets[0].AccessAction = TargetAccessActionBlock
+		assert.ErrorContains(t, rp.Validate(), "only supported for HTTP services")
+	})
+
+	t.Run("nil non HTTP target", func(t *testing.T) {
+		rp := validProxy()
+		rp.Mode = ModeTCP
+		rp.ListenPort = 8080
+		rp.Targets[0] = nil
+		assert.ErrorContains(t, rp.Validate(), "target 0 is nil")
+	})
+}
+
+func TestValidateTargetAccessActionPath(t *testing.T) {
+	for _, value := range []string{"api", "/api/../admin", "/api/./admin", "/api//admin", "/api%2Fadmin", `/api\admin`, "/api?x=1", "/api#fragment", "/api;admin", "/api/\x00"} {
+		t.Run(fmt.Sprintf("path_%q", value), func(t *testing.T) {
+			rp := validProxy()
+			rp.Targets[0].Path = &value
+			rp.Targets[0].AccessAction = TargetAccessActionBypass
+			assert.ErrorContains(t, rp.Validate(), "access_action path")
+		})
+	}
+
+	t.Run("nil path is canonical root", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets[0].AccessAction = TargetAccessActionBlock
+		require.NoError(t, rp.Validate())
+	})
+
+	t.Run("empty path is legacy root", func(t *testing.T) {
+		value := ""
+		rp := validProxy()
+		rp.Targets[0].Path = &value
+		rp.Targets[0].AccessAction = TargetAccessActionBlock
+		require.NoError(t, rp.Validate())
+	})
+
+	t.Run("trailing slash is a distinct valid prefix", func(t *testing.T) {
+		value := "/api/"
+		rp := validProxy()
+		rp.Targets[0].Path = &value
+		rp.Targets[0].AccessAction = TargetAccessActionBypass
+		require.NoError(t, rp.Validate())
+	})
+}
+
+func TestValidateDuplicateEnabledTargetPaths(t *testing.T) {
+	emptyPath := ""
+	rootPath := "/"
+	rootAliases := []struct {
+		name string
+		path *string
+	}{
+		{name: "nil", path: nil},
+		{name: "empty", path: &emptyPath},
+		{name: "slash", path: &rootPath},
+	}
+
+	for _, alias := range rootAliases {
+		t.Run("legacy all-inherit "+alias.name, func(t *testing.T) {
+			rp := validProxy()
+			rp.Targets = append(rp.Targets, &Target{
+				TargetId:   "peer-2",
+				TargetType: TargetTypePeer,
+				Path:       alias.path,
+				Host:       "10.0.0.2",
+				Port:       443,
+				Protocol:   TargetProtoHTTPS,
+				Enabled:    true,
+			})
+			require.NoError(t, rp.Validate(), "legacy all-inherit path and protocol twins must remain valid")
+		})
+
+		t.Run("access-controlled "+alias.name, func(t *testing.T) {
+			rp := validProxy()
+			rp.Targets = append(rp.Targets, &Target{
+				TargetId:     "peer-2",
+				TargetType:   TargetTypePeer,
+				Path:         alias.path,
+				Host:         "10.0.0.2",
+				Port:         80,
+				Protocol:     TargetProtoHTTP,
+				Enabled:      true,
+				AccessAction: TargetAccessActionBlock,
+			})
+			assert.ErrorContains(t, rp.Validate(), `duplicate path "/"`)
+		})
+	}
+
+	t.Run("access action elsewhere enables strict paths", func(t *testing.T) {
+		publicPath := "/public"
+		rp := validProxy()
+		rp.Targets = append(rp.Targets,
+			&Target{
+				TargetId:   "peer-2",
+				TargetType: TargetTypePeer,
+				Host:       "10.0.0.2",
+				Port:       80,
+				Protocol:   TargetProtoHTTP,
+				Enabled:    true,
+			},
+			&Target{
+				TargetId:     "peer-3",
+				TargetType:   TargetTypePeer,
+				Path:         &publicPath,
+				Host:         "10.0.0.3",
+				Port:         80,
+				Protocol:     TargetProtoHTTP,
+				Enabled:      true,
+				AccessAction: TargetAccessActionBypass,
+			},
+		)
+		assert.ErrorContains(t, rp.Validate(), `duplicate path "/"`)
+	})
+
+	t.Run("disabled action preserves legacy validation", func(t *testing.T) {
+		publicPath := "/public"
+		rp := validProxy()
+		rp.Targets = append(rp.Targets,
+			&Target{
+				TargetId:   "peer-2",
+				TargetType: TargetTypePeer,
+				Host:       "10.0.0.2",
+				Port:       80,
+				Protocol:   TargetProtoHTTP,
+				Enabled:    true,
+			},
+			&Target{
+				TargetId:     "peer-3",
+				TargetType:   TargetTypePeer,
+				Path:         &publicPath,
+				Host:         "10.0.0.3",
+				Port:         80,
+				Protocol:     TargetProtoHTTP,
+				Enabled:      false,
+				AccessAction: TargetAccessActionBlock,
+			},
+		)
+		require.NoError(t, rp.Validate())
+	})
+
+	t.Run("disabled target does not collide", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets = append(rp.Targets, &Target{
+			TargetId:   "peer-2",
+			TargetType: TargetTypePeer,
+			Host:       "10.0.0.2",
+			Port:       80,
+			Protocol:   TargetProtoHTTP,
+			Enabled:    false,
+		})
+		require.NoError(t, rp.Validate())
+	})
+
+	t.Run("trailing slash remains distinct", func(t *testing.T) {
+		apiPath := "/api"
+		apiSlashPath := "/api/"
+		rp := validProxy()
+		rp.Targets[0].Path = &apiPath
+		rp.Targets = append(rp.Targets, &Target{
+			TargetId:     "peer-2",
+			TargetType:   TargetTypePeer,
+			Path:         &apiSlashPath,
+			Host:         "10.0.0.2",
+			Port:         80,
+			Protocol:     TargetProtoHTTP,
+			Enabled:      true,
+			AccessAction: TargetAccessActionBlock,
+		})
+		require.NoError(t, rp.Validate())
+	})
+}
+
 func TestValidate_MultipleTargetsOneInvalid(t *testing.T) {
 	rp := validProxy()
 	rp.Targets = append(rp.Targets, &Target{
@@ -216,6 +444,64 @@ func TestValidateTargetOptions_CustomHeaders(t *testing.T) {
 	})
 }
 
+func TestValidate_DirectUpstreamHost(t *testing.T) {
+	target := Target{TargetId: "id-1", TargetType: TargetTypePeer, Host: "10.0.0.1", Port: 80, Protocol: "http", Enabled: true, Options: TargetOptions{DirectUpstream: true}}
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "127.0.0.2")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.NotNil(t, validateDirectUpstreamHost(0, targetWithHost(&target, "127.0.0.2:80")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "::1")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "::1%lo0")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "[::1]")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.NotNil(t, validateDirectUpstreamHost(0, targetWithHost(&target, "[::1]:80")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "[::1%lo0]")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.NotNil(t, validateDirectUpstreamHost(0, targetWithHost(&target, "[::1%lo0]:80")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "169.254.100.100")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "fe80::1")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "[fe80::1]")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "224.100.100.100")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "ff00::ffff")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateDirectUpstreamHost(0, targetWithHost(&target, "[ff00::ffff]")), ErrUnsupportedIPAddressUpstreamHost)
+
+	// empty host
+	assert.Nil(t, validateDirectUpstreamHost(0, &Target{Options: TargetOptions{DirectUpstream: true}, Host: "   "}))
+	// host with a space
+	assert.NotNil(t, validateDirectUpstreamHost(0, &Target{Options: TargetOptions{DirectUpstream: true}, Host: "with space"}))
+	// host with a tab
+	assert.NotNil(t, validateDirectUpstreamHost(0, &Target{Options: TargetOptions{DirectUpstream: true}, Host: "with\ttab"}))
+	// host with a slash
+	assert.NotNil(t, validateDirectUpstreamHost(0, &Target{Options: TargetOptions{DirectUpstream: true}, Host: "with/slash"}))
+}
+
+func TestValidate_ValidateSubnetTarget(t *testing.T) {
+	target := Target{TargetId: "id-1", TargetType: TargetTypeSubnet, Host: "10.0.0.1", Port: 80, Protocol: "http", Enabled: true, Options: TargetOptions{DirectUpstream: true}}
+	assert.ErrorIs(t, validateSubnetTarget(0, targetWithHost(&target, "127.0.0.2")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.NotNil(t, validateSubnetTarget(0, targetWithHost(&target, "127.0.0.2:80")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateSubnetTarget(0, targetWithHost(&target, "::1")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.NotNil(t, validateSubnetTarget(0, targetWithHost(&target, "[::1]:80")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateSubnetTarget(0, targetWithHost(&target, "::1%lo0")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateSubnetTarget(0, targetWithHost(&target, "[::1%lo0]")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.NotNil(t, validateSubnetTarget(0, targetWithHost(&target, "[::1%lo0]:80")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateSubnetTarget(0, targetWithHost(&target, "169.254.100.100")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateSubnetTarget(0, targetWithHost(&target, "fe80::1")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateSubnetTarget(0, targetWithHost(&target, "[fe80::1]")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateSubnetTarget(0, targetWithHost(&target, "224.100.100.100")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateSubnetTarget(0, targetWithHost(&target, "ff00::ffff")), ErrUnsupportedIPAddressUpstreamHost)
+	assert.ErrorIs(t, validateSubnetTarget(0, targetWithHost(&target, "[ff00::ffff]")), ErrUnsupportedIPAddressUpstreamHost)
+
+	// empty host
+	assert.NotNil(t, validateSubnetTarget(0, &Target{Options: TargetOptions{DirectUpstream: true}, Host: "   "}))
+	// host with a space
+	assert.NotNil(t, validateSubnetTarget(0, &Target{Options: TargetOptions{DirectUpstream: true}, Host: "with space"}))
+	// host with a tab
+	assert.NotNil(t, validateSubnetTarget(0, &Target{Options: TargetOptions{DirectUpstream: true}, Host: "with\ttab"}))
+	// host with a slash
+	assert.NotNil(t, validateSubnetTarget(0, &Target{Options: TargetOptions{DirectUpstream: true}, Host: "with/slash"}))
+}
+
+func targetWithHost(t *Target, host string) *Target {
+	t.Host = host
+	return t
+}
+
 func TestToProtoMapping_TargetOptions(t *testing.T) {
 	rp := &Service{
 		ID:        "svc-1",
@@ -250,6 +536,128 @@ func TestToProtoMapping_TargetOptions(t *testing.T) {
 	assert.Equal(t, int64(30), opts.RequestTimeout.Seconds)
 }
 
+func TestTargetAccessActionConversions(t *testing.T) {
+	t.Run("API presence", func(t *testing.T) {
+		bypass := api.ServiceTargetAccessActionBypass
+		empty := api.ServiceTargetAccessAction("")
+		apiTargets := []api.ServiceTarget{
+			{
+				TargetId:   "peer-1",
+				TargetType: api.ServiceTargetTargetTypePeer,
+				Protocol:   api.ServiceTargetProtocolHttp,
+				Port:       80,
+				Enabled:    true,
+			},
+			{
+				TargetId:     "peer-2",
+				TargetType:   api.ServiceTargetTargetTypePeer,
+				Protocol:     api.ServiceTargetProtocolHttp,
+				Port:         80,
+				Enabled:      true,
+				AccessAction: &bypass,
+			},
+			{
+				TargetId:     "peer-3",
+				TargetType:   api.ServiceTargetTargetTypePeer,
+				Protocol:     api.ServiceTargetProtocolHttp,
+				Port:         80,
+				Enabled:      true,
+				AccessAction: &empty,
+			},
+		}
+
+		targets, err := targetsFromAPI("account-1", &apiTargets)
+		require.NoError(t, err)
+		require.Len(t, targets, 3)
+		assert.Equal(t, TargetAccessActionInherit, targets[0].AccessAction)
+		assert.False(t, targets[0].AccessActionProvided)
+		assert.Equal(t, TargetAccessActionBypass, targets[1].AccessAction)
+		assert.True(t, targets[1].AccessActionProvided)
+		assert.Empty(t, targets[2].AccessAction)
+		assert.True(t, targets[2].AccessActionProvided)
+
+		rp := &Service{Name: "test", Domain: "example.com", Targets: []*Target{targets[2]}}
+		assert.ErrorContains(t, rp.Validate(), `unknown access_action ""`)
+	})
+
+	t.Run("API response", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets[0].AccessAction = TargetAccessActionBlock
+		response := rp.ToAPIResponse()
+		require.Len(t, response.Targets, 1)
+		require.NotNil(t, response.Targets[0].AccessAction)
+		assert.Equal(t, api.ServiceTargetAccessActionBlock, *response.Targets[0].AccessAction)
+	})
+
+	t.Run("proto mapping", func(t *testing.T) {
+		root := "/"
+		bypassPath := "/bypass"
+		blockPath := "/block"
+		rp := &Service{
+			ID:        "svc-1",
+			AccountID: "acc-1",
+			Domain:    "example.com",
+			Targets: []*Target{
+				{Path: &root, Host: "10.0.0.1", Port: 80, Protocol: TargetProtoHTTP, Enabled: true},
+				{Path: &bypassPath, Host: "10.0.0.1", Port: 80, Protocol: TargetProtoHTTP, Enabled: true, AccessAction: TargetAccessActionBypass},
+				{Path: &blockPath, Host: "10.0.0.1", Port: 80, Protocol: TargetProtoHTTP, Enabled: true, AccessAction: TargetAccessActionBlock},
+			},
+		}
+
+		mapping := rp.ToProtoMapping(Create, "token", proxy.OIDCValidationConfig{})
+		require.Len(t, mapping.Path, 3)
+		assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT, mapping.Path[0].GetAccessAction())
+		assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS, mapping.Path[1].GetAccessAction())
+		assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK, mapping.Path[2].GetAccessAction())
+	})
+}
+
+func TestHasTargetAccessControl(t *testing.T) {
+	rp := validProxy()
+	assert.False(t, rp.HasTargetAccessControl())
+
+	rp.Targets[0].AccessAction = TargetAccessActionBypass
+	assert.True(t, rp.HasTargetAccessControl())
+}
+
+// TestToProtoMapping_AllowedGroupIds covers the list the proxy gates session
+// cookies on: without it the proxy can only check a cookie's signature, which
+// makes a token minted for a user outside the groups a bearer credential.
+func TestToProtoMapping_AllowedGroupIds(t *testing.T) {
+	t.Run("distribution groups reach the proxy", func(t *testing.T) {
+		rp := &Service{
+			ID:        "svc-1",
+			AccountID: "acc-1",
+			Domain:    "example.com",
+			Auth: AuthConfig{
+				BearerAuth: &BearerAuthConfig{
+					Enabled:            true,
+					DistributionGroups: []string{"grp-1", "grp-2"},
+				},
+			},
+		}
+		pm := rp.ToProtoMapping(Create, "token", proxy.OIDCValidationConfig{})
+
+		assert.True(t, pm.GetAuth().GetOidc())
+		assert.Equal(t, []string{"grp-1", "grp-2"}, pm.GetAuth().GetAllowedGroupIds())
+	})
+
+	t.Run("a service open to the account carries no groups", func(t *testing.T) {
+		rp := &Service{
+			ID:        "svc-1",
+			AccountID: "acc-1",
+			Domain:    "example.com",
+			Auth: AuthConfig{
+				BearerAuth: &BearerAuthConfig{Enabled: true},
+			},
+		}
+		pm := rp.ToProtoMapping(Create, "token", proxy.OIDCValidationConfig{})
+
+		assert.True(t, pm.GetAuth().GetOidc())
+		assert.Empty(t, pm.GetAuth().GetAllowedGroupIds(), "an empty list must not restrict access")
+	})
+}
+
 func TestToProtoMapping_NoOptionsWhenDefault(t *testing.T) {
 	rp := &Service{
 		ID:        "svc-1",
diff --git a/management/internals/modules/reverseproxy/service/target_access.go b/management/internals/modules/reverseproxy/service/target_access.go
new file mode 100644
index 000000000..bd2d717fe
--- /dev/null
+++ b/management/internals/modules/reverseproxy/service/target_access.go
@@ -0,0 +1,115 @@
+package service
+
+import (
+	"fmt"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// TargetAccessAction controls authentication for a selected HTTP target.
+type TargetAccessAction string
+
+const (
+	TargetAccessActionInherit TargetAccessAction = "inherit"
+	TargetAccessActionBypass  TargetAccessAction = "bypass"
+	TargetAccessActionBlock   TargetAccessAction = "block"
+)
+
+func (t *Target) effectiveAccessAction() TargetAccessAction {
+	if t.AccessAction == "" {
+		return TargetAccessActionInherit
+	}
+	return t.AccessAction
+}
+
+func targetAccessActionToProto(action TargetAccessAction) proto.TargetAccessAction {
+	switch action {
+	case TargetAccessActionInherit:
+		return proto.TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT
+	case TargetAccessActionBypass:
+		return proto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS
+	case TargetAccessActionBlock:
+		return proto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK
+	default:
+		return proto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK
+	}
+}
+
+// HasTargetAccessControl reports whether any target overrides service authentication.
+func (s *Service) HasTargetAccessControl() bool {
+	for _, target := range s.Targets {
+		if target != nil && target.effectiveAccessAction() != TargetAccessActionInherit {
+			return true
+		}
+	}
+	return false
+}
+
+func validateTargetAccessAction(idx int, target *Target, private bool) error {
+	action, err := validatedTargetAccessAction(idx, target)
+	if err != nil {
+		return err
+	}
+	if action == TargetAccessActionBypass {
+		if private {
+			return fmt.Errorf("target %d: bypass access_action is not supported for private services", idx)
+		}
+		if target.Options.AgentNetwork {
+			return fmt.Errorf("target %d: bypass access_action is not supported for Agent Network targets", idx)
+		}
+	}
+
+	if action == TargetAccessActionInherit {
+		return nil
+	}
+	return validateAccessActionPath(idx, target.Path)
+}
+
+func validatedTargetAccessAction(idx int, target *Target) (TargetAccessAction, error) {
+	if target.AccessActionProvided && target.AccessAction == "" {
+		return "", fmt.Errorf("target %d: unknown access_action %q", idx, target.AccessAction)
+	}
+	action := target.effectiveAccessAction()
+	switch action {
+	case TargetAccessActionInherit, TargetAccessActionBypass, TargetAccessActionBlock:
+		return action, nil
+	default:
+		return "", fmt.Errorf("target %d: unknown access_action %q", idx, target.AccessAction)
+	}
+}
+
+func normalizedTargetPath(configured *string) string {
+	if configured == nil || *configured == "" {
+		return "/"
+	}
+	return *configured
+}
+
+func validateAccessActionPath(idx int, configured *string) error {
+	if configured == nil {
+		return nil
+	}
+	value := *configured
+	if value == "" {
+		return nil
+	}
+	if !strings.HasPrefix(value, "/") {
+		return fmt.Errorf("target %d: access_action path %q must start with /", idx, value)
+	}
+	if !utf8.ValidString(value) || strings.ContainsAny(value, "%\\?#;") || strings.IndexFunc(value, unicode.IsControl) >= 0 {
+		return fmt.Errorf("target %d: access_action path %q contains invalid characters", idx, value)
+	}
+	segments := strings.Split(strings.TrimPrefix(value, "/"), "/")
+	for i, segment := range segments {
+		if segment == "." || segment == ".." {
+			return fmt.Errorf("target %d: access_action path %q is not canonical", idx, value)
+		}
+		if segment == "" && value != "/" && i != len(segments)-1 {
+			return fmt.Errorf("target %d: access_action path %q is not canonical", idx, value)
+		}
+	}
+	return nil
+}
diff --git a/management/internals/modules/zones/manager/manager.go b/management/internals/modules/zones/manager/manager.go
index d5348d3d0..6f6ba6c40 100644
--- a/management/internals/modules/zones/manager/manager.go
+++ b/management/internals/modules/zones/manager/manager.go
@@ -3,15 +3,16 @@ package manager
 import (
 	"context"
 	"fmt"
+	"slices"
 
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -69,6 +70,9 @@ func (m *managerImpl) CreateZone(ctx context.Context, accountID, userID string,
 	}
 
 	zone = zones.NewZone(accountID, zone.Name, zone.Domain, zone.Enabled, zone.EnableSearchDomain, zone.DistributionGroups)
+	var snap *affectedpeers.Snapshot
+	change := affectedpeers.Change{DistributionGroupIDs: zone.DistributionGroups}
+
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		existingZone, err := transaction.GetZoneByDomain(ctx, accountID, zone.Domain)
 		if err != nil {
@@ -88,7 +92,15 @@ func (m *managerImpl) CreateZone(ctx context.Context, accountID, userID string,
 		}
 
 		if err = transaction.CreateZone(ctx, zone); err != nil {
-			return fmt.Errorf("failed to create zone: %w", err)
+			return fmt.Errorf("create zone: %w", err)
+		}
+
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
+		if err = transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
+			return fmt.Errorf("increment network serial: %w", err)
 		}
 
 		return nil
@@ -99,6 +111,8 @@ func (m *managerImpl) CreateZone(ctx context.Context, accountID, userID string,
 
 	m.accountManager.StoreEvent(ctx, userID, zone.ID, accountID, activity.DNSZoneCreated, zone.EventMeta())
 
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
+
 	return zone, nil
 }
 
@@ -111,21 +125,26 @@ func (m *managerImpl) UpdateZone(ctx context.Context, accountID, userID string,
 		return nil, status.NewPermissionDeniedError()
 	}
 
-	zone, err := m.store.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, updatedZone.ID)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get zone: %w", err)
-	}
-
-	if zone.Domain != updatedZone.Domain {
-		return nil, status.Errorf(status.InvalidArgument, "zone domain cannot be updated")
-	}
-
-	zone.Name = updatedZone.Name
-	zone.Enabled = updatedZone.Enabled
-	zone.EnableSearchDomain = updatedZone.EnableSearchDomain
-	zone.DistributionGroups = updatedZone.DistributionGroups
+	var zone *zones.Zone
+	var snap *affectedpeers.Snapshot
+	var change affectedpeers.Change
 
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		zone, err = transaction.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, updatedZone.ID)
+		if err != nil {
+			return fmt.Errorf("get zone: %w", err)
+		}
+
+		if zone.Domain != updatedZone.Domain {
+			return status.Errorf(status.InvalidArgument, "zone domain cannot be updated")
+		}
+
+		oldGroups := zone.DistributionGroups
+		zone.Name = updatedZone.Name
+		zone.Enabled = updatedZone.Enabled
+		zone.EnableSearchDomain = updatedZone.EnableSearchDomain
+		zone.DistributionGroups = updatedZone.DistributionGroups
+
 		for _, groupID := range zone.DistributionGroups {
 			_, err = transaction.GetGroupByID(ctx, store.LockingStrengthNone, accountID, groupID)
 			if err != nil {
@@ -134,7 +153,16 @@ func (m *managerImpl) UpdateZone(ctx context.Context, accountID, userID string,
 		}
 
 		if err = transaction.UpdateZone(ctx, zone); err != nil {
-			return fmt.Errorf("failed to update zone: %w", err)
+			return fmt.Errorf("update zone: %w", err)
+		}
+
+		change = affectedpeers.Change{DistributionGroupIDs: slices.Concat(zone.DistributionGroups, oldGroups)}
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
+		if err = transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
+			return fmt.Errorf("increment network serial: %w", err)
 		}
 
 		return nil
@@ -145,7 +173,7 @@ func (m *managerImpl) UpdateZone(ctx context.Context, accountID, userID string,
 
 	m.accountManager.StoreEvent(ctx, userID, zone.ID, accountID, activity.DNSZoneUpdated, zone.EventMeta())
 
-	go m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceZone, Operation: types.UpdateOperationUpdate})
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
 
 	return zone, nil
 }
@@ -159,13 +187,23 @@ func (m *managerImpl) DeleteZone(ctx context.Context, accountID, userID, zoneID
 		return status.NewPermissionDeniedError()
 	}
 
-	zone, err := m.store.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, zoneID)
-	if err != nil {
-		return fmt.Errorf("failed to get zone: %w", err)
-	}
-
+	var zone *zones.Zone
+	var snap *affectedpeers.Snapshot
+	var change affectedpeers.Change
 	var eventsToStore []func()
+
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		zone, err = transaction.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, zoneID)
+		if err != nil {
+			return fmt.Errorf("get zone: %w", err)
+		}
+
+		// Load before delete: the post-delete state no longer references the groups.
+		change = affectedpeers.Change{DistributionGroupIDs: zone.DistributionGroups}
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
 		records, err := transaction.GetZoneDNSRecords(ctx, store.LockingStrengthNone, accountID, zoneID)
 		if err != nil {
 			return fmt.Errorf("failed to get records: %w", err)
@@ -207,7 +245,7 @@ func (m *managerImpl) DeleteZone(ctx context.Context, accountID, userID, zoneID
 		event()
 	}
 
-	go m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceZone, Operation: types.UpdateOperationDelete})
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
 
 	return nil
 }
diff --git a/management/internals/modules/zones/manager/manager_test.go b/management/internals/modules/zones/manager/manager_test.go
index 29e7e8677..f6f1743ce 100644
--- a/management/internals/modules/zones/manager/manager_test.go
+++ b/management/internals/modules/zones/manager/manager_test.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
diff --git a/management/internals/modules/zones/records/manager/manager.go b/management/internals/modules/zones/records/manager/manager.go
index b041aca30..16839c1b4 100644
--- a/management/internals/modules/zones/records/manager/manager.go
+++ b/management/internals/modules/zones/records/manager/manager.go
@@ -9,11 +9,11 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -65,6 +65,8 @@ func (m *managerImpl) CreateRecord(ctx context.Context, accountID, userID, zoneI
 	}
 
 	var zone *zones.Zone
+	var snap *affectedpeers.Snapshot
+	var change affectedpeers.Change
 
 	record = records.NewRecord(accountID, zoneID, record.Name, record.Type, record.Content, record.TTL)
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
@@ -82,6 +84,11 @@ func (m *managerImpl) CreateRecord(ctx context.Context, accountID, userID, zoneI
 			return fmt.Errorf("failed to create dns record: %w", err)
 		}
 
+		change = affectedpeers.Change{DistributionGroupIDs: zone.DistributionGroups}
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
 		err = transaction.IncrementNetworkSerial(ctx, accountID)
 		if err != nil {
 			return fmt.Errorf("failed to increment network serial: %w", err)
@@ -96,7 +103,7 @@ func (m *managerImpl) CreateRecord(ctx context.Context, accountID, userID, zoneI
 	meta := record.EventMeta(zone.ID, zone.Name)
 	m.accountManager.StoreEvent(ctx, userID, record.ID, accountID, activity.DNSRecordCreated, meta)
 
-	go m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceZoneRecord, Operation: types.UpdateOperationCreate})
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
 
 	return record, nil
 }
@@ -112,6 +119,8 @@ func (m *managerImpl) UpdateRecord(ctx context.Context, accountID, userID, zoneI
 
 	var zone *zones.Zone
 	var record *records.Record
+	var snap *affectedpeers.Snapshot
+	var change affectedpeers.Change
 
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		zone, err = transaction.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, zoneID)
@@ -141,6 +150,11 @@ func (m *managerImpl) UpdateRecord(ctx context.Context, accountID, userID, zoneI
 			return fmt.Errorf("failed to update dns record: %w", err)
 		}
 
+		change = affectedpeers.Change{DistributionGroupIDs: zone.DistributionGroups}
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
 		err = transaction.IncrementNetworkSerial(ctx, accountID)
 		if err != nil {
 			return fmt.Errorf("failed to increment network serial: %w", err)
@@ -155,7 +169,7 @@ func (m *managerImpl) UpdateRecord(ctx context.Context, accountID, userID, zoneI
 	meta := record.EventMeta(zone.ID, zone.Name)
 	m.accountManager.StoreEvent(ctx, userID, record.ID, accountID, activity.DNSRecordUpdated, meta)
 
-	go m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceZoneRecord, Operation: types.UpdateOperationUpdate})
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
 
 	return record, nil
 }
@@ -171,6 +185,8 @@ func (m *managerImpl) DeleteRecord(ctx context.Context, accountID, userID, zoneI
 
 	var record *records.Record
 	var zone *zones.Zone
+	var snap *affectedpeers.Snapshot
+	var change affectedpeers.Change
 
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		zone, err = transaction.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, zoneID)
@@ -188,6 +204,11 @@ func (m *managerImpl) DeleteRecord(ctx context.Context, accountID, userID, zoneI
 			return fmt.Errorf("failed to delete dns record: %w", err)
 		}
 
+		change = affectedpeers.Change{DistributionGroupIDs: zone.DistributionGroups}
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
 		err = transaction.IncrementNetworkSerial(ctx, accountID)
 		if err != nil {
 			return fmt.Errorf("failed to increment network serial: %w", err)
@@ -202,7 +223,7 @@ func (m *managerImpl) DeleteRecord(ctx context.Context, accountID, userID, zoneI
 	meta := record.EventMeta(zone.ID, zone.Name)
 	m.accountManager.StoreEvent(ctx, userID, recordID, accountID, activity.DNSRecordDeleted, meta)
 
-	go m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceZoneRecord, Operation: types.UpdateOperationDelete})
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
 
 	return nil
 }
diff --git a/management/internals/modules/zones/records/manager/manager_test.go b/management/internals/modules/zones/records/manager/manager_test.go
index a5f48c4a9..e5ed26509 100644
--- a/management/internals/modules/zones/records/manager/manager_test.go
+++ b/management/internals/modules/zones/records/manager/manager_test.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
diff --git a/management/internals/network_map_db/factory/db_store.go b/management/internals/network_map_db/factory/db_store.go
new file mode 100644
index 000000000..3eea0ae69
--- /dev/null
+++ b/management/internals/network_map_db/factory/db_store.go
@@ -0,0 +1,76 @@
+package networkmapdbfactory
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	networkmap_pgsql "github.com/netbirdio/netbird/management/internals/network_map_db/pgsql"
+	networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite"
+	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
+	"github.com/netbirdio/netbird/management/server/settings"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	log "github.com/sirupsen/logrus"
+)
+
+const storeSqliteFileName = "store.db"
+
+var ErrNotSupportedStoreEngine = errors.New("unsupported store engine")
+
+func NewNetworkMapDBStore(
+	ctx context.Context,
+	kind types.Engine,
+	dataDir string,
+	integratedPeerValidator integrated_validator.IntegratedValidator,
+	extraSettingsManager settings.Manager) (*networkmapdb.NetworkMapDBStoreImpl, error) {
+	switch kind {
+	case types.SqliteStoreEngine:
+		log.WithContext(ctx).Info("networkmap store is using SQLite")
+		storeFile := storeSqliteFileName
+		if envFile, ok := os.LookupEnv("NB_STORE_ENGINE_SQLITE_FILE"); ok && envFile != "" {
+			storeFile = envFile
+		}
+		store, err := networkmap_sqlite.NewSqliteStore(storeFile, dataDir)
+		if err != nil {
+			return nil, err
+		}
+		return &networkmapdb.NetworkMapDBStoreImpl{
+			Store:                   store,
+			IntegratedPeerValidator: integratedPeerValidator,
+			ExtraSettingsManager:    extraSettingsManager,
+		}, nil
+	case types.PostgresStoreEngine:
+		log.WithContext(ctx).Info("using Postgres store engine")
+		dsn, err := mustLookupDsnEnv()
+		if err != nil {
+			return nil, err
+		}
+
+		store, err := networkmap_pgsql.NewPostgresqlStore(ctx, dsn)
+		if err != nil {
+			return nil, err
+		}
+
+		return &networkmapdb.NetworkMapDBStoreImpl{
+			Store:                   store,
+			IntegratedPeerValidator: integratedPeerValidator,
+			ExtraSettingsManager:    extraSettingsManager,
+		}, nil
+	}
+
+	return nil, fmt.Errorf("networkmap store doesn't support engine %s, %w", kind, ErrNotSupportedStoreEngine)
+}
+
+func mustLookupDsnEnv() (string, error) {
+	if v, ok := os.LookupEnv(store.PostgresDsnEnv); ok {
+		return v, nil
+	}
+	if v, ok := os.LookupEnv(store.PostgresDsnEnvLegacy); ok {
+		return v, nil
+	}
+
+	return "", fmt.Errorf("%s env var must be set when using postgres networkmap store", store.PostgresDsnEnv)
+}
diff --git a/management/internals/network_map_db/network_map_data.go b/management/internals/network_map_db/network_map_data.go
new file mode 100644
index 000000000..1e83bfb34
--- /dev/null
+++ b/management/internals/network_map_db/network_map_data.go
@@ -0,0 +1,182 @@
+package networkmapdb
+
+import (
+	"context"
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+func (s *NetworkMapDBStoreImpl) GetNetworkMapData(ctx context.Context, accountId string) (*networkmap.NetworkMapData, error) {
+	tx, err := s.Store.BeginTx(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	acctSettings, err := tx.GetAccountSettings(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get account settings: %w", err))
+	}
+	dnsZones, err := tx.GetAppliedZoneCandidates(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get applied zone candidates: %w", err))
+	}
+	groups, resourceToGroupIdx, err := tx.GetGroups(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get groups: %w", err))
+	}
+	nsGroups, err := tx.GetNameServerGroups(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get nameserver groups: %w", err))
+	}
+	networkResources, err := tx.GetNetworkResources(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get network resources: %w", err))
+	}
+	routers, err := tx.GetNetworkRouters(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get network routers: %w", err))
+	}
+	network, err := tx.GetNetwork(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get network: %w", err))
+	}
+	peers, _, err := tx.GetPeers(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get peers: %w", err))
+	}
+	policies, policyToDestinationResourceIdx, policyToDestinationGroupIdx, err := tx.GetPolicies(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get policies: %w", err))
+	}
+	postureChecks, postureCheckXIDToPublicID, err := tx.GetPostureChecks(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get posture checks: %w", err))
+	}
+	routes, err := tx.GetRoutes(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get routes: %w", err))
+	}
+	networkXIDToPublicID, err := tx.GetNetworkXIDToPublicIdMap(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get network xid to public id map: %w", err))
+	}
+	allowedUserIds, groupsToUserIds, err := tx.GetAllowedUsers(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get allowed users: %w", err))
+	}
+	dnsSettings, err := tx.GetDnsSettings(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get dns settings: %w", err))
+	}
+	domains, err := tx.GetDomains(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, err)
+	}
+	proxyTargetedDomainResourceIDs, err := tx.GetProxyTargetedDomainResourceIDs(ctx, accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get proxy targeted domain resources: %w", err))
+	}
+
+	if err = tx.CommitTx(ctx); err != nil {
+		log.WithContext(ctx).Warnf("failed to commit network map read transaction: %v", err)
+	}
+
+	resourcePolicies := buildResourcePolicies(
+		networkResources, policies, resourceToGroupIdx, policyToDestinationResourceIdx, policyToDestinationGroupIdx)
+
+	toret := networkmap.NetworkMapData{
+		AccountSettings:                &acctSettings,
+		DNSSettings:                    &dnsSettings,
+		Network:                        &network,
+		Peers:                          toMap(peers, func(p nmdata.Peer) string { return p.ID }),
+		Groups:                         toMap(groups, func(g nmdata.Group) string { return g.ID }),
+		Policies:                       toSliceOfPtrs(policies),
+		ResourcePolicies:               resourcePolicies,
+		Routes:                         toSliceOfPtrs(routes),
+		Routers:                        routers,
+		NameServerGroups:               toSliceOfPtrs(nsGroups),
+		NetworkResources:               toSliceOfPtrs(networkResources),
+		PostureChecks:                  toMap(postureChecks, func(pc nmdata.PostureChecks) string { return pc.ID }),
+		AllowedUserIDs:                 allowedUserIds,
+		GroupIDToUserIDs:               groupsToUserIds,
+		NetworkXIDToPublicID:           networkXIDToPublicID, // TODO (dmitri) maybe we can switch to public ids everywhere?
+		AppliedZoneCandidates:          dnsZones,
+		Domains:                        TwinProxyDomains(domains),
+		PostureCheckXIDToPublicID:      postureCheckXIDToPublicID,
+		ProxyTargetedDomainResourceIDs: proxyTargetedDomainResourceIDs,
+	}
+
+	extraSettings, err := s.ExtraSettingsManager.GetExtraSettings(ctx, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	toret.ValidatedPeers, err = s.IntegratedPeerValidator.GetValidatedPeers(ctx, accountId, maps.Values(toret.Groups), maps.Values(toret.Peers), extraSettings)
+	if err != nil {
+		return nil, err
+	}
+
+	return &toret, nil
+}
+
+func rollbackAndReturnError(ctx context.Context, tx NetworkMapDBStoreConn, err error) (*networkmap.NetworkMapData, error) {
+	if errr := tx.RollbackTx(ctx); errr != nil {
+		log.WithContext(ctx).Warnf("failed to rollback network map read transaction: %v", errr)
+	}
+	return nil, err
+}
+
+func toMap[T any](all []T, id func(t T) string) map[string]*T {
+	toret := make(map[string]*T, len(all))
+	for _, t := range all {
+		toret[id(t)] = &t
+	}
+	return toret
+}
+
+func toSliceOfPtrs[T any](all []T) []*T {
+	toret := make([]*T, 0, len(all))
+	for _, t := range all {
+		toret = append(toret, &t)
+	}
+	return toret
+}
+
+func buildResourcePolicies(networkResources []nmdata.NetworkResource,
+	policies []nmdata.Policy,
+	resourceToGroupIdx map[string]map[string]any,
+	policyToDestinationResourceIdx map[string]map[string]any,
+	policyToDestinationGroupIdx map[string]map[string]any) map[string][]*nmdata.Policy {
+
+	resourcePolicies := make(map[string][]*nmdata.Policy)
+	for _, resource := range networkResources {
+		if !resource.Enabled {
+			continue
+		}
+		networkResourceGroups := resourceToGroupIdx[resource.ID]
+		for _, policy := range policies {
+			if !policy.Enabled {
+				continue
+			}
+			if _, ok := policyToDestinationResourceIdx[policy.ID][resource.ID]; ok {
+				resourcePolicies[resource.ID] = append(resourcePolicies[resource.ID], &policy) // TODO (dmitri) maybe use public id?
+				continue
+			}
+			if groupIds, ok := policyToDestinationGroupIdx[policy.ID]; ok {
+				for networkResourceGroup := range networkResourceGroups {
+					if _, ok := groupIds[networkResourceGroup]; ok {
+						resourcePolicies[resource.ID] = append(resourcePolicies[resource.ID], &policy)
+						break
+					}
+				}
+			}
+		}
+	}
+
+	return resourcePolicies
+}
diff --git a/management/internals/network_map_db/network_map_data_test.go b/management/internals/network_map_db/network_map_data_test.go
new file mode 100644
index 000000000..2b694f5bc
--- /dev/null
+++ b/management/internals/network_map_db/network_map_data_test.go
@@ -0,0 +1,158 @@
+package networkmapdb
+
+import (
+	"testing"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/stretchr/testify/assert"
+)
+
+// disabled network resource shouldn't be in the resulting map
+func TestBuildResourcePolicies_DisabledNetworkResource(t *testing.T) {
+	networkResources := []nmdata.NetworkResource{
+		{ID: "net-res-1", Enabled: false},
+	}
+	policies := []nmdata.Policy{
+		{ID: "policy-1", Enabled: true},
+	}
+	resourceToGroupIdx := map[string]map[string]any{}
+	policyToDestinationResourceIdx := map[string]map[string]any{
+		"policy-1": {
+			"net-res-1": struct{}{},
+			"net-res-3": struct{}{},
+		},
+	}
+	policyToDestinationGroupIdx := map[string]map[string]any{}
+
+	assert.Empty(t, buildResourcePolicies(
+		networkResources, policies, resourceToGroupIdx, policyToDestinationResourceIdx, policyToDestinationGroupIdx))
+}
+
+// disabled policy shouldn't be in the resulting map
+func TestBuildResourcePolicies_DisabledPolicy(t *testing.T) {
+	networkResources := []nmdata.NetworkResource{
+		{ID: "net-res-1", Enabled: true},
+	}
+	policies := []nmdata.Policy{
+		{ID: "policy-1", Enabled: false},
+	}
+	resourceToGroupIdx := map[string]map[string]any{}
+	policyToDestinationResourceIdx := map[string]map[string]any{
+		"policy-1": {
+			"net-res-1": struct{}{},
+			"net-res-3": struct{}{},
+		},
+	}
+	policyToDestinationGroupIdx := map[string]map[string]any{}
+
+	assert.Empty(t, buildResourcePolicies(
+		networkResources, policies, resourceToGroupIdx, policyToDestinationResourceIdx, policyToDestinationGroupIdx))
+}
+
+// build ResourcePolicies via PolicyToDestinationResourceIdx only
+func TestBuildResourcePolicies_ViaPolicyToDestinationResourceIdx(t *testing.T) {
+	networkResources := []nmdata.NetworkResource{
+		{ID: "net-res-1", Enabled: true},
+		{ID: "net-res-2", Enabled: true},
+		{ID: "net-res-3", Enabled: true},
+	}
+	policies := []nmdata.Policy{
+		{ID: "policy-1", Enabled: true},
+		{ID: "policy-2", Enabled: true},
+		{ID: "policy-3", Enabled: true},
+	}
+	resourceToGroupIdx := map[string]map[string]any{}
+	policyToDestinationResourceIdx := map[string]map[string]any{
+		"policy-1": {
+			"net-res-1": struct{}{},
+			"net-res-3": struct{}{},
+		},
+		"policy-2": {
+			"net-res-2": struct{}{},
+		},
+		"policy-3": {
+			"net-res-1": struct{}{},
+			"net-res-2": struct{}{},
+		},
+	}
+	policyToDestinationGroupIdx := map[string]map[string]any{}
+
+	resourceToPolicies := buildResourcePolicies(
+		networkResources, policies, resourceToGroupIdx, policyToDestinationResourceIdx, policyToDestinationGroupIdx)
+
+	assert.Equal(t, map[string][]*nmdata.Policy{
+		"net-res-1": {
+			{ID: "policy-1", Enabled: true},
+			{ID: "policy-3", Enabled: true},
+		},
+		"net-res-2": {
+			{ID: "policy-2", Enabled: true},
+			{ID: "policy-3", Enabled: true},
+		},
+		"net-res-3": {
+			{ID: "policy-1", Enabled: true},
+		},
+	}, resourceToPolicies)
+}
+
+// build ResourcePolicies via PolicyToDestinationGroupIdx only
+func TestBuildResourcePolicies_ViaPolicyToDestinationGroupIdx(t *testing.T) {
+	networkResources := []nmdata.NetworkResource{
+		{ID: "net-res-1", Enabled: true},
+		{ID: "net-res-2", Enabled: true},
+		{ID: "net-res-3", Enabled: true},
+	}
+	policies := []nmdata.Policy{
+		{ID: "policy-1", Enabled: true},
+		{ID: "policy-2", Enabled: true},
+		{ID: "policy-3", Enabled: true},
+	}
+	resourceToGroupIdx := map[string]map[string]any{
+		"net-res-1": {
+			"group-1": struct{}{},
+			"group-2": struct{}{},
+		},
+		"net-res-2": {
+			"group-2": struct{}{},
+			"group-3": struct{}{},
+		},
+		"net-res-3": {
+			"group-3": struct{}{},
+			"group-4": struct{}{},
+		},
+	}
+	policyToDestinationResourceIdx := map[string]map[string]any{}
+	policyToDestinationGroupIdx := map[string]map[string]any{
+		"policy-1": {
+			"group-1": struct{}{},
+			"group-2": struct{}{},
+		},
+		"policy-2": {
+			"group-1": struct{}{},
+			"group-4": struct{}{},
+		},
+		"policy-3": {
+			"group-1": struct{}{},
+			"group-3": struct{}{},
+		},
+	}
+
+	resourceToPolicies := buildResourcePolicies(
+		networkResources, policies, resourceToGroupIdx, policyToDestinationResourceIdx, policyToDestinationGroupIdx)
+
+	assert.Equal(t, map[string][]*nmdata.Policy{
+		"net-res-1": {
+			{ID: "policy-1", Enabled: true},
+			{ID: "policy-2", Enabled: true},
+			{ID: "policy-3", Enabled: true},
+		},
+		"net-res-2": {
+			{ID: "policy-1", Enabled: true},
+			{ID: "policy-3", Enabled: true},
+		},
+		"net-res-3": {
+			{ID: "policy-2", Enabled: true},
+			{ID: "policy-3", Enabled: true},
+		},
+	}, resourceToPolicies)
+}
diff --git a/management/internals/network_map_db/pgsql/account_settings.go b/management/internals/network_map_db/pgsql/account_settings.go
new file mode 100644
index 000000000..cd5a36e35
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/account_settings.go
@@ -0,0 +1,61 @@
+package networkmap_pgsql
+
+import (
+	"context"
+	"encoding/json"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetAccountSettingsQuery = `
+	select settings_peer_login_expiration_enabled as peer_login_expiration_enabled,
+	settings_peer_login_expiration as peer_login_expiration,
+	settings_peer_inactivity_expiration_enabled as peer_inactivity_expiration_enabled,
+	settings_peer_inactivity_expiration as peer_inactivity_expiration,
+	settings_dns_domain as dns_domain,
+	settings_ipv6_enabled_groups as ipv6_enabled_groups,
+	settings_routing_peer_dns_resolution_enabled as routing_peer_dns_resolution_enabled,
+	settings_lazy_connection_enabled as lazy_connection_enabled,
+	settings_auto_update_version as auto_update_version,
+	settings_auto_update_always as auto_update_always,
+	settings_metrics_push_enabled as metrics_push_enabled
+	from accounts
+	where id=$1
+	`
+)
+
+func (pgc *PgStoreConn) GetAccountSettings(ctx context.Context, accountId string) (nmdata.AccountSettingsInfo, error) {
+	rows, err := pgc.Conn.Query(ctx, GetAccountSettingsQuery, accountId)
+	if err != nil {
+		return nmdata.AccountSettingsInfo{}, err
+	}
+
+	settings, err := pgx.CollectOneRow(rows, pgx.RowToStructByName[networkmapdb.Account])
+	if err != nil {
+		return nmdata.AccountSettingsInfo{}, err
+	}
+
+	settingsInfo := nmdata.AccountSettingsInfo{
+		PeerLoginExpirationEnabled:      settings.PeerLoginExpirationEnabled.Bool,
+		PeerLoginExpiration:             time.Duration(settings.PeerLoginExpiration.Int64),
+		PeerInactivityExpirationEnabled: settings.PeerInactivityExpirationEnabled.Bool,
+		PeerInactivityExpiration:        time.Duration(settings.PeerInactivityExpiration.Int64),
+		DNSDomain:                       settings.DNSDomain.String,
+		RoutingPeerDNSResolutionEnabled: settings.RoutingPeerDNSResolutionEnabled.Bool,
+		LazyConnectionEnabled:           settings.LazyConnectionEnabled.Bool,
+		AutoUpdateVersion:               settings.AutoUpdateVersion.String,
+		AutoUpdateAlways:                settings.AutoUpdateAlways.Bool,
+		MetricsPushEnabled:              settings.MetricsPushEnabled.Bool,
+	}
+	if settings.IPv6EnabledGroups != nil {
+		if err := json.Unmarshal(settings.IPv6EnabledGroups, &settingsInfo.IPv6EnabledGroups); err != nil {
+			return nmdata.AccountSettingsInfo{}, err
+		}
+	}
+
+	return settingsInfo, nil
+}
diff --git a/management/internals/network_map_db/pgsql/dns.go b/management/internals/network_map_db/pgsql/dns.go
new file mode 100644
index 000000000..46ef0ddfa
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/dns.go
@@ -0,0 +1,34 @@
+package networkmap_pgsql
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+)
+
+const (
+	GetAccountZonesQuery = `
+	select zones.id as id, domain, not enable_search_domain as search_domain_disabled, distribution_groups,
+	r.name as record_name, r.type as record_type, 'IN' record_class, r.ttl as record_ttl, r.content as record_rdata
+	from zones
+	left join records as r on r.zone_id = zones.id
+	where zones.account_id=$1 and zones.enabled
+	order by zones.id
+	`
+)
+
+func (pgc *PgStoreConn) GetAppliedZoneCandidates(ctx context.Context, accountId string) ([]networkmap.AppliedZoneCandidate, error) {
+	rows, err := pgc.Conn.Query(ctx, GetAccountZonesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	zones, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkmapdb.Zone])
+	if err != nil {
+		return nil, err
+	}
+
+	return networkmapdb.ZonesToAppliedZoneCandidates(zones)
+}
diff --git a/management/internals/network_map_db/pgsql/dns_settings.go b/management/internals/network_map_db/pgsql/dns_settings.go
new file mode 100644
index 000000000..aec44e0f2
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/dns_settings.go
@@ -0,0 +1,45 @@
+package networkmap_pgsql
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetDnsSettingsQuery = `
+	select dns_settings_disabled_management_groups
+	from accounts
+	where id=$1
+	`
+)
+
+func (pgc *PgStoreConn) GetDnsSettings(ctx context.Context, accountId string) (nmdata.DNSSettings, error) {
+	rows, err := pgc.Conn.Query(ctx, GetDnsSettingsQuery, accountId)
+	if err != nil {
+		return nmdata.DNSSettings{}, err
+	}
+
+	return pgx.CollectOneRow(rows, rowToDnsSettings)
+}
+
+func rowToDnsSettings(row pgx.CollectableRow) (nmdata.DNSSettings, error) {
+	var value nmdata.DNSSettings
+	var settings json.RawMessage
+
+	if err := row.Scan(&settings); err != nil {
+		return value, err
+	}
+
+	if settings == nil {
+		return nmdata.DNSSettings{}, nil
+	}
+
+	if err := json.Unmarshal(settings, &value.DisabledManagementGroups); err != nil {
+		return value, err
+	}
+
+	return value, nil
+}
diff --git a/management/internals/network_map_db/pgsql/domain.go b/management/internals/network_map_db/pgsql/domain.go
new file mode 100644
index 000000000..8730007c5
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/domain.go
@@ -0,0 +1,25 @@
+package networkmap_pgsql
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+)
+
+const (
+	GetDomainsQuery = `
+	select domain, target_cluster
+	from domains
+	where account_id=$1 and domain<>'' and target_cluster<>''
+	`
+)
+
+func (pgc *PgStoreConn) GetDomains(ctx context.Context, accountId string) ([]networkmapdb.Domain, error) {
+	rows, err := pgc.Conn.Query(ctx, GetDomainsQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	return pgx.CollectRows(rows, pgx.RowToStructByName[networkmapdb.Domain])
+}
diff --git a/management/internals/network_map_db/pgsql/group.go b/management/internals/network_map_db/pgsql/group.go
new file mode 100644
index 000000000..874e743a5
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/group.go
@@ -0,0 +1,64 @@
+package networkmap_pgsql
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"reflect"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetGroupsQuery = `
+	select id, name, public_id, resources,
+	(
+	  select array_agg(group_peers.peer_id)
+      from group_peers
+	  where group_peers.group_id = groups.id and group_peers.account_id=$1
+	) as peers
+	from groups where account_id=$1
+	`
+)
+
+// we also return a resource-to-group index.
+// an alternative is to add json indexes, query this directly. Not sure how expensive
+// json indexes are. TODO (dmitri) verify and maybe change the implementation here.
+func (pgc *PgStoreConn) GetGroups(ctx context.Context, accountId string) ([]nmdata.Group, map[string]map[string]any, error) {
+	rows, err := pgc.Conn.Query(ctx, GetGroupsQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	groups, err := pgx.CollectRows(rows, pgx.RowToStructByName[group])
+	toret := make([]nmdata.Group, 0, len(groups))
+	resourceToGroupIdx := make(map[string]map[string]any)
+
+	for _, g := range groups {
+		dg := nmdata.Group{}
+		err := networkmapdb.FromSqlTypesToSharedTypes(
+			reflect.ValueOf(&g), reflect.ValueOf(&dg))
+		if err != nil {
+			return nil, nil, err
+		}
+		toret = append(toret, dg)
+		for _, resource := range dg.Resources {
+			if _, ok := resourceToGroupIdx[resource.ID]; !ok {
+				resourceToGroupIdx[resource.ID] = make(map[string]any)
+			}
+			resourceToGroupIdx[resource.ID][g.ID] = struct{}{}
+		}
+	}
+
+	return toret, resourceToGroupIdx, err
+}
+
+type group struct {
+	ID        string
+	Name      sql.NullString
+	PublicID  sql.NullString
+	Resources json.RawMessage
+	Peers     []string
+}
diff --git a/management/internals/network_map_db/pgsql/nameserver.go b/management/internals/network_map_db/pgsql/nameserver.go
new file mode 100644
index 000000000..12f215edb
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/nameserver.go
@@ -0,0 +1,31 @@
+package networkmap_pgsql
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetNameserversQuery = `
+	select id, public_id, name, description, name_servers, groups, "primary", domains, enabled, search_domains_enabled
+	from name_server_groups
+	where account_id=$1
+	`
+)
+
+func (pgc *PgStoreConn) GetNameServerGroups(ctx context.Context, accountId string) ([]nmdata.NameServerGroup, error) {
+	rows, err := pgc.Conn.Query(ctx, GetNameserversQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	nsgroups, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkmapdb.NameserverGroup])
+	if err != nil {
+		return nil, err
+	}
+
+	return networkmapdb.ConvertAllToSharedTypes[networkmapdb.NameserverGroup, nmdata.NameServerGroup](nsgroups)
+}
diff --git a/management/internals/network_map_db/pgsql/network.go b/management/internals/network_map_db/pgsql/network.go
new file mode 100644
index 000000000..5d7d33bcc
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/network.go
@@ -0,0 +1,39 @@
+package networkmap_pgsql
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetNetworkQuery = `
+	select network_identifier as identifier, network_net as net, network_net_v6 as net_v6, network_dns as dns, network_serial as serial
+	from accounts
+	where id=$1
+	`
+)
+
+func (pgc *PgStoreConn) GetNetwork(ctx context.Context, accountId string) (nmdata.Network, error) {
+	rows, err := pgc.Conn.Query(ctx, GetNetworkQuery, accountId)
+	if err != nil {
+		return nmdata.Network{}, err
+	}
+
+	n, err := pgx.CollectOneRow(rows, pgx.RowToStructByName[networkmapdb.AccountNetwork])
+	if err != nil {
+		return nmdata.Network{}, err
+	}
+
+	toret := nmdata.Network{}
+	err = networkmapdb.FromSqlTypesToSharedTypes(
+		reflect.ValueOf(&n), reflect.ValueOf(&toret))
+	if err != nil {
+		return nmdata.Network{}, err
+	}
+
+	return toret, nil
+}
diff --git a/management/internals/network_map_db/pgsql/network_resource.go b/management/internals/network_map_db/pgsql/network_resource.go
new file mode 100644
index 000000000..48c9b0611
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/network_resource.go
@@ -0,0 +1,31 @@
+package networkmap_pgsql
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetNetworkResourcesQuery = `
+	select id, network_id, account_id, public_id, name, description, type, domain, prefix, enabled
+	from network_resources
+	where account_id=$1
+	`
+)
+
+func (pgc *PgStoreConn) GetNetworkResources(ctx context.Context, accountId string) ([]nmdata.NetworkResource, error) {
+	rows, err := pgc.Conn.Query(ctx, GetNetworkResourcesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	netresorces, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkmapdb.Networkresource])
+	if err != nil {
+		return nil, err
+	}
+
+	return networkmapdb.ConvertAllToSharedTypes[networkmapdb.Networkresource, nmdata.NetworkResource](netresorces)
+}
diff --git a/management/internals/network_map_db/pgsql/network_router.go b/management/internals/network_map_db/pgsql/network_router.go
new file mode 100644
index 000000000..42d5e3b28
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/network_router.go
@@ -0,0 +1,80 @@
+package networkmap_pgsql
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"reflect"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetNetworkRouterQuery = `
+	select public_id, peer, network_id, masquerade, metric, enabled, peer_groups,
+	(
+	  select array_agg(group_peers.peer_id)
+	  from group_peers
+	  where group_peers.account_id=$1 and group_peers.group_id in (select json_array_elements_text(peer_groups::json))
+	) as peers_via_groups
+	from network_routers
+	where account_id=$1
+	`
+)
+
+func (pgc *PgStoreConn) GetNetworkRouters(ctx context.Context, accountId string) (map[string]map[string]*nmdata.NetworkRouter, error) {
+	rows, err := pgc.Conn.Query(ctx, GetNetworkRouterQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	routers, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkrouter])
+	if err != nil {
+		return nil, err
+	}
+
+	toret := make(map[string]map[string]*nmdata.NetworkRouter)
+	for _, router := range routers {
+		if !router.Enabled.Bool {
+			continue
+		}
+
+		networkId := router.NetworkID.String
+		if networkId == "" {
+			return nil, fmt.Errorf("router with public_id %s doesn't have network_id set", router.PublicID.String)
+		}
+
+		nmdatarouter := nmdata.NetworkRouter{}
+		err := networkmapdb.FromSqlTypesToSharedTypes(reflect.ValueOf(&router), reflect.ValueOf(&nmdatarouter))
+		if err != nil {
+			return nil, err
+		}
+
+		if toret[networkId] == nil {
+			toret[networkId] = make(map[string]*nmdata.NetworkRouter)
+		}
+		if router.Peer.String != "" {
+			toret[networkId][router.Peer.String] = &nmdatarouter
+			continue
+		}
+		for _, peerId := range router.PeersViaGroups {
+			toret[networkId][peerId] = &nmdatarouter
+		}
+	}
+
+	return toret, nil
+}
+
+type networkrouter struct {
+	PublicID       sql.NullString
+	NetworkID      sql.NullString `nmap:"skip"`
+	Peer           sql.NullString `nmap:"skip"`
+	PeerGroups     json.RawMessage
+	PeersViaGroups []string `nmap:"skip"`
+	Masquerade     sql.NullBool
+	Metric         sql.NullInt64
+	Enabled        sql.NullBool
+}
diff --git a/management/internals/network_map_db/pgsql/networks.go b/management/internals/network_map_db/pgsql/networks.go
new file mode 100644
index 000000000..306356972
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/networks.go
@@ -0,0 +1,36 @@
+package networkmap_pgsql
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+)
+
+const (
+	GetNetworksQuery = `
+	select id, public_id
+	from networks where account_id=$1
+	`
+)
+
+func (pgc *PgStoreConn) GetNetworkXIDToPublicIdMap(ctx context.Context, accountId string) (map[string]string, error) {
+	rows, err := pgc.Conn.Query(ctx, GetNetworksQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	networks, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkmapdb.Network])
+	if err != nil {
+		return nil, err
+	}
+
+	toret := make(map[string]string)
+	for _, n := range networks {
+		if n.PublicID.Valid {
+			toret[n.ID] = n.PublicID.String
+		}
+	}
+
+	return toret, nil
+}
diff --git a/management/internals/network_map_db/pgsql/peer.go b/management/internals/network_map_db/pgsql/peer.go
new file mode 100644
index 000000000..108ad2a5e
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/peer.go
@@ -0,0 +1,34 @@
+package networkmap_pgsql
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetPeersQuery = `
+	select id, key, ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
+	meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files, meta_certificates, meta_capabilities, meta_flags, meta_sync_message_version,
+	location_country_code, location_city_name, location_connection_ip
+	from peers
+	where account_id = $1
+	`
+)
+
+func (pgc *PgStoreConn) GetPeers(ctx context.Context, accountId string) ([]nmdata.Peer, map[string][]*nmdata.Peer, error) {
+	rows, err := pgc.Conn.Query(ctx, GetPeersQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	peers, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkmapdb.Peer])
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return networkmapdb.ConvertToNmdataPeers(peers)
+}
diff --git a/management/internals/network_map_db/pgsql/pg_store.go b/management/internals/network_map_db/pgsql/pg_store.go
new file mode 100644
index 000000000..0cae610f8
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/pg_store.go
@@ -0,0 +1,128 @@
+package networkmap_pgsql
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/jackc/pgx/v5/pgxpool"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+)
+
+const (
+	pgMaxConnections    = 30
+	pgMinConnections    = 1
+	pgMaxConnLifetime   = 60 * time.Minute
+	pgHealthCheckPeriod = 1 * time.Minute
+)
+
+var _ networkmapdb.NetworkMapDBStore = &PgStore{}
+
+type PgStore struct {
+	Pool     *pgxpool.Pool
+	Location *time.Location
+}
+
+type PgStoreConn struct {
+	Conn pgInterface
+}
+
+type pgInterface interface {
+	Query(ctx context.Context, sql string, args ...any) (pgx.Rows, error)
+	Exec(ctx context.Context, sql string, arguments ...any) (pgconn.CommandTag, error)
+}
+
+var _ networkmapdb.NetworkMapDBStoreConn = &PgStoreConn{}
+
+func NewPostgresqlStore(ctx context.Context, dsn string) (*PgStore, error) {
+	pool, err := connectToPgDb(ctx, dsn)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PgStore{Pool: pool}, nil
+}
+
+// This is used to control the timezone timestamps returned in.
+// By default pgx returns timestamps in the local timezone,
+// which may not be desirable.
+// use .UsingTimeZone(time.UTC) to return timestamps in UTC TZ
+func (p *PgStore) UsingTimeZone(location *time.Location) {
+	p.Location = location
+}
+
+func (p *PgStore) UsingConnection(c *pgx.Conn) networkmapdb.NetworkMapDBStoreConn {
+	if p.Location != nil {
+		c.TypeMap().RegisterType(&pgtype.Type{
+			Name:  "timestamptz",
+			OID:   pgtype.TimestamptzOID,
+			Codec: &pgtype.TimestamptzCodec{ScanLocation: time.UTC},
+		})
+	}
+
+	return &PgStoreConn{Conn: c}
+}
+
+func (p *PgStore) Exec(ctx context.Context, query string, args ...any) error {
+	_, err := p.Pool.Exec(ctx, query, args...)
+	return err
+}
+
+func (p *PgStore) BeginTx(ctx context.Context) (networkmapdb.NetworkMapDBStoreConn, error) {
+	tx, err := p.Pool.BeginTx(ctx, pgx.TxOptions{IsoLevel: pgx.RepeatableRead, AccessMode: pgx.ReadOnly})
+	if err != nil {
+		return nil, err
+	}
+	if p.Location != nil {
+		tx.Conn().TypeMap().RegisterType(&pgtype.Type{
+			Name:  "timestamptz",
+			OID:   pgtype.TimestamptzOID,
+			Codec: &pgtype.TimestamptzCodec{ScanLocation: time.UTC},
+		})
+	}
+	return &PgStoreConn{Conn: tx}, nil
+}
+
+func (c *PgStoreConn) RollbackTx(ctx context.Context) error {
+	tx, ok := c.Conn.(pgx.Tx)
+	if !ok {
+		return fmt.Errorf("expected an pgx.Tx got %s", reflect.TypeOf(c.Conn).Kind())
+	}
+	return tx.Rollback(ctx)
+}
+
+func (c *PgStoreConn) CommitTx(ctx context.Context) error {
+	tx, ok := c.Conn.(pgx.Tx)
+	if !ok {
+		return fmt.Errorf("expected an sql.Tx got %s", reflect.TypeOf(c.Conn).Kind())
+	}
+	return tx.Commit(ctx)
+}
+
+func connectToPgDb(ctx context.Context, dsn string) (*pgxpool.Pool, error) {
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse database config: %w", err)
+	}
+
+	config.MaxConns = pgMaxConnections
+	config.MinConns = pgMinConnections
+	config.MaxConnLifetime = pgMaxConnLifetime
+	config.HealthCheckPeriod = pgHealthCheckPeriod
+
+	pool, err := pgxpool.NewWithConfig(ctx, config)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create connection pool: %w", err)
+	}
+
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("unable to ping database: %w", err)
+	}
+
+	return pool, nil
+}
diff --git a/management/internals/network_map_db/pgsql/policy.go b/management/internals/network_map_db/pgsql/policy.go
new file mode 100644
index 000000000..45927d7a2
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/policy.go
@@ -0,0 +1,34 @@
+package networkmap_pgsql
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetPoliciesQuery = `
+	select p.id, p.public_id, p.enabled, p.source_posture_checks, pr.enabled as rule_enabled, pr.action, pr.protocol, pr.bidirectional, 
+	pr.sources, pr.destinations, pr.source_resource, pr.destination_resource, pr.ports, pr.port_ranges,
+	pr.authorized_groups, pr.authorized_user
+	from policies as p
+	left join policy_rules as pr on p.id = pr.policy_id 
+	where account_id=$1
+	`
+)
+
+func (pgc *PgStoreConn) GetPolicies(ctx context.Context, accountId string) ([]nmdata.Policy, map[string]map[string]any, map[string]map[string]any, error) {
+	rows, err := pgc.Conn.Query(ctx, GetPoliciesQuery, accountId)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	policies, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkmapdb.Policy])
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	return networkmapdb.ConvertToNmdataPolicy(policies)
+}
diff --git a/management/internals/network_map_db/pgsql/posture.go b/management/internals/network_map_db/pgsql/posture.go
new file mode 100644
index 000000000..aedfec2a5
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/posture.go
@@ -0,0 +1,44 @@
+package networkmap_pgsql
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetPostureChecksQuery = `
+	select id, public_id, checks
+	from posture_checks
+	where account_id=$1
+	`
+)
+
+func (pgc *PgStoreConn) GetPostureChecks(ctx context.Context, accountId string) ([]nmdata.PostureChecks, map[string]string, error) {
+	rows, err := pgc.Conn.Query(ctx, GetPostureChecksQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	checks, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkmapdb.PostureChecks])
+	if err != nil {
+		return nil, nil, err
+	}
+
+	toret := make([]nmdata.PostureChecks, 0, len(checks))
+	idToPublicIDIdx := make(map[string]string)
+	for _, c := range checks {
+		checks := nmdata.PostureChecks{}
+		err := networkmapdb.FromSqlTypesToSharedTypes(reflect.ValueOf(&c), reflect.ValueOf(&checks))
+		if err != nil {
+			return nil, nil, err
+		}
+		toret = append(toret, checks)
+		idToPublicIDIdx[checks.ID] = c.PublicID.String
+	}
+
+	return toret, idToPublicIDIdx, nil
+}
diff --git a/management/internals/network_map_db/pgsql/route.go b/management/internals/network_map_db/pgsql/route.go
new file mode 100644
index 000000000..4f9a16c0e
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/route.go
@@ -0,0 +1,33 @@
+package networkmap_pgsql
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetRoutesQuery = `
+	select id, account_id, public_id, network, domains, keep_route, net_id, description,
+	peer, peer as peer_id, peer_groups, network_type, masquerade, metric, enabled, 
+	groups, access_control_groups, skip_auto_apply
+	from routes
+	where account_id=$1
+	`
+)
+
+func (pgc *PgStoreConn) GetRoutes(ctx context.Context, accountId string) ([]nmdata.Route, error) {
+	rows, err := pgc.Conn.Query(ctx, GetRoutesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	routes, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkmapdb.Route])
+	if err != nil {
+		return nil, err
+	}
+
+	return networkmapdb.ConvertAllToSharedTypes[networkmapdb.Route, nmdata.Route](routes)
+}
diff --git a/management/internals/network_map_db/pgsql/service.go b/management/internals/network_map_db/pgsql/service.go
new file mode 100644
index 000000000..5d82046be
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/service.go
@@ -0,0 +1,51 @@
+package networkmap_pgsql
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+)
+
+const (
+	GetServicesQuery = `
+	select enabled, private, array (select json_array_elements_text(access_groups::json)) as access_groups, proxy_cluster, domain
+	from services
+	where account_id=$1
+	`
+
+	GetProxyTargetedDomainResourcesQuery = `
+	select t.target_id
+	from targets as t
+	join services as s on s.id = t.service_id
+	where s.account_id=$1 and s.enabled and not coalesce(s.terminated, false)
+	and t.enabled and t.target_type='domain' and t.target_id is not null
+	`
+)
+
+func (pgc *PgStoreConn) GetPrivateServices(ctx context.Context, accountId string) ([]networkmapdb.Service, error) {
+	rows, err := pgc.Conn.Query(ctx, GetServicesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	return pgx.CollectRows(rows, pgx.RowToStructByName[networkmapdb.Service])
+}
+
+func (pgc *PgStoreConn) GetProxyTargetedDomainResourceIDs(ctx context.Context, accountId string) (map[string]struct{}, error) {
+	rows, err := pgc.Conn.Query(ctx, GetProxyTargetedDomainResourcesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	ids, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		return nil, err
+	}
+
+	toret := make(map[string]struct{}, len(ids))
+	for _, id := range ids {
+		toret[id] = struct{}{}
+	}
+	return toret, nil
+}
diff --git a/management/internals/network_map_db/pgsql/user.go b/management/internals/network_map_db/pgsql/user.go
new file mode 100644
index 000000000..9e22c3575
--- /dev/null
+++ b/management/internals/network_map_db/pgsql/user.go
@@ -0,0 +1,60 @@
+package networkmap_pgsql
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+)
+
+const (
+	GetAllowedUserIdsQuery = `
+	select id, array (select json_array_elements_text(auto_groups::json)) as auto_groups
+	from users
+	where account_id=$1 and not blocked and not is_service_user
+	`
+
+	GetAllGroupIdQuery = `
+	select array_agg(id) from groups
+	where account_id=$1 and name='All'
+	`
+)
+
+func (pgc *PgStoreConn) GetAllowedUsers(ctx context.Context, accountId string) (map[string]struct{}, map[string][]string, error) {
+	rows, err := pgc.Conn.Query(ctx, GetAllowedUserIdsQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	users, err := pgx.CollectRows(rows, pgx.RowToStructByName[user])
+	if err != nil {
+		return nil, nil, err
+	}
+
+	rows, err = pgc.Conn.Query(ctx, GetAllGroupIdQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+	allGroupIds, err := pgx.CollectOneRow(rows, pgx.RowTo[[]string])
+	if err != nil {
+		return nil, nil, err
+	}
+
+	userIdIdx := make(map[string]struct{})
+	groupIdToUserIds := make(map[string][]string)
+	for _, user := range users {
+		userIdIdx[user.ID] = struct{}{}
+		for _, groupId := range user.AutoGroups {
+			groupIdToUserIds[groupId] = append(groupIdToUserIds[groupId], user.ID)
+		}
+		for _, allgid := range allGroupIds {
+			groupIdToUserIds[allgid] = append(groupIdToUserIds[allgid], user.ID)
+		}
+	}
+
+	return userIdIdx, groupIdToUserIds, nil
+}
+
+type user struct {
+	ID         string
+	AutoGroups []string
+}
diff --git a/management/internals/network_map_db/shared_types.go b/management/internals/network_map_db/shared_types.go
new file mode 100644
index 000000000..dc065073c
--- /dev/null
+++ b/management/internals/network_map_db/shared_types.go
@@ -0,0 +1,493 @@
+package networkmapdb
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+
+	"github.com/miekg/dns"
+	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
+	"github.com/netbirdio/netbird/management/server/settings"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+var ErrDnsUnsupportedRecordType = errors.New("unsupported record type")
+
+type NetworkMapDBStore interface { //nolint:revive // established name across the codebase
+	BeginTx(ctx context.Context) (NetworkMapDBStoreConn, error)
+	Exec(ctx context.Context, query string, args ...any) error
+}
+
+type NetworkMapDBStoreConn interface { //nolint:revive // established name across the codebase
+	GetGroups(ctx context.Context, accountId string) ([]nmdata.Group, map[string]map[string]any, error)
+	GetDomains(ctx context.Context, accountId string) ([]Domain, error)
+	GetPeers(ctx context.Context, accountId string) ([]nmdata.Peer, map[string][]*nmdata.Peer, error)
+	GetPolicies(ctx context.Context, accountId string) ([]nmdata.Policy, map[string]map[string]any, map[string]map[string]any, error)
+	GetRoutes(ctx context.Context, accountId string) ([]nmdata.Route, error)
+	GetNameServerGroups(ctx context.Context, accountId string) ([]nmdata.NameServerGroup, error)
+	GetNetworkResources(ctx context.Context, accountId string) ([]nmdata.NetworkResource, error)
+	GetNetworkRouters(ctx context.Context, accountId string) (map[string]map[string]*nmdata.NetworkRouter, error)
+	GetNetwork(ctx context.Context, accountId string) (nmdata.Network, error)
+	GetAppliedZoneCandidates(ctx context.Context, accountId string) ([]networkmap.AppliedZoneCandidate, error)
+	GetAccountSettings(ctx context.Context, accountId string) (nmdata.AccountSettingsInfo, error)
+	GetPostureChecks(ctx context.Context, accountId string) ([]nmdata.PostureChecks, map[string]string, error)
+	GetAllowedUsers(ctx context.Context, accountId string) (map[string]struct{}, map[string][]string, error)
+	GetDnsSettings(ctx context.Context, accountId string) (nmdata.DNSSettings, error)
+	GetNetworkXIDToPublicIdMap(ctx context.Context, accountId string) (map[string]string, error)
+	GetPrivateServices(ctx context.Context, accountId string) ([]Service, error)
+	GetProxyTargetedDomainResourceIDs(ctx context.Context, accountId string) (map[string]struct{}, error)
+
+	CommitTx(ctx context.Context) error
+	RollbackTx(ctx context.Context) error
+}
+
+type NetworkMapDBStoreImpl struct { //nolint:revive // established name across the codebase
+	Store                   NetworkMapDBStore
+	IntegratedPeerValidator integrated_validator.IntegratedValidator
+	ExtraSettingsManager    settings.Manager
+}
+
+// The order of fields in these structs is important.
+// Mapping of results of sqlite queries relies on the order
+// of the fields in these structs, when a query or a struct changes,
+// corresponding changes must be made to its counterpart.
+
+type Account struct {
+	PeerLoginExpirationEnabled      sql.NullBool
+	PeerLoginExpiration             sql.NullInt64
+	PeerInactivityExpirationEnabled sql.NullBool
+	PeerInactivityExpiration        sql.NullInt64
+	DNSDomain                       sql.NullString
+	IPv6EnabledGroups               []byte `nmap:"json"`
+	RoutingPeerDNSResolutionEnabled sql.NullBool
+	LazyConnectionEnabled           sql.NullBool
+	AutoUpdateVersion               sql.NullString
+	AutoUpdateAlways                sql.NullBool
+	MetricsPushEnabled              sql.NullBool
+}
+
+type Domain struct {
+	Domain        sql.NullString
+	TargetCluster sql.NullString
+}
+
+type Service struct {
+	Enabled      sql.NullBool
+	Private      sql.NullBool
+	AccessGroups []string
+	ProxyCluster sql.NullString
+	Domain       sql.NullString
+}
+
+type Zone struct {
+	Id                   string `nmap:"skip"`
+	Domain               sql.NullString
+	SearchDomainDisabled sql.NullBool
+	DistributionGroups   []byte         `nmap:"skip,json"`
+	RecordName           sql.NullString `nmap:"skip"`
+	RecordType           sql.NullString `nmap:"skip"`
+	RecordClass          sql.NullString `nmap:"skip"`
+	RecordTTL            sql.NullInt64  `nmap:"skip"`
+	RecordRData          sql.NullString `nmap:"skip"`
+}
+
+type NameserverGroup struct {
+	ID                   string
+	PublicID             sql.NullString
+	Name                 sql.NullString
+	Description          sql.NullString
+	NameServers          []byte `nmap:"json"`
+	Groups               []byte `nmap:"json"`
+	Primary              sql.NullBool
+	Domains              []byte `nmap:"json"`
+	Enabled              sql.NullBool
+	SearchDomainsEnabled sql.NullBool
+}
+
+type Networkresource struct {
+	ID          string
+	NetworkID   sql.NullString
+	AccountID   sql.NullString
+	PublicID    sql.NullString
+	Name        sql.NullString
+	Description sql.NullString
+	Type        sql.NullString
+	Domain      sql.NullString
+	Prefix      []byte `nmap:"json"`
+	Enabled     sql.NullBool
+}
+
+type AccountNetwork struct {
+	Identifier sql.NullString
+	Net        []byte `nmap:"json"`
+	NetV6      []byte `nmap:"json"`
+	Dns        sql.NullString
+	Serial     sql.NullInt64
+}
+
+type Network struct {
+	ID       string
+	PublicID sql.NullString
+}
+
+type Policy struct {
+	ID                  string
+	PublicID            sql.NullString
+	Enabled             sql.NullBool
+	SourcePostureChecks []byte         `nmap:"json"`
+	RuleEnabled         sql.NullBool   `nmap:"skip"`
+	Action              sql.NullString `nmap:"skip"`
+	Protocol            sql.NullString `nmap:"skip"`
+	Bidirectional       sql.NullBool   `nmap:"skip"`
+	Sources             []byte         `nmap:"skip,json"`
+	Destinations        []byte         `nmap:"skip,json"`
+	SourceResource      []byte         `nmap:"skip,json"`
+	DestinationResource []byte         `nmap:"skip,json"`
+	Ports               []byte         `nmap:"skip,json"`
+	PortRanges          []byte         `nmap:"skip,json"`
+	AuthorizedGroups    []byte         `nmap:"skip,json"`
+	AuthorizedUser      sql.NullString `nmap:"skip"`
+}
+
+// Depending on db interface LastLogin contains time in different formats:
+// for sqlite/sql.NullTime the time in UTC
+// for pgx the time is in the local timezone
+// TODO add support for creating struct fields from denormalized fields
+type Peer struct {
+	ID                         string
+	Key                        sql.NullString
+	SSHKey                     sql.NullString
+	DNSLabel                   sql.NullString
+	ExtraDNSLabels             []byte `nmap:"json"`
+	UserID                     sql.NullString
+	SSHEnabled                 sql.NullBool
+	LoginExpirationEnabled     sql.NullBool
+	LastLogin                  sql.NullTime
+	IP                         []byte         `nmap:"json"`
+	IPv6                       []byte         `nmap:"json"`
+	PeerStatusRequiresApproval sql.NullBool   `nmap:"map_to:RequiresApproval"`
+	PeerStatusConnected        sql.NullBool   `nmap:"skip"`
+	ProxyMetaEmbedded          sql.NullBool   `nmap:"skip"`
+	ProxyMetaCluster           sql.NullString `nmap:"skip"`
+	MetaWtVersion              sql.NullString `nmap:"skip"`
+	MetaGoOS                   sql.NullString `nmap:"skip"`
+	MetaOSVersion              sql.NullString `nmap:"skip"`
+	MetaKernelVersion          sql.NullString `nmap:"skip"`
+	MetaNetworkAddresses       []byte         `nmap:"skip,json"`
+	MetaFiles                  []byte         `nmap:"skip,json"`
+	MetaCertificates           []byte         `nmap:"skip,json"`
+	MetaCapabilities           []byte         `nmap:"skip,json"`
+	MetaFlags                  []byte         `nmap:"skip,json"`
+	MetaSyncMessageVersion     sql.NullInt64  `nmap:"skip"`
+	LocationCountryCode        sql.NullString `nmap:"skip"`
+	LocationCityName           sql.NullString `nmap:"skip"`
+	LocationConnectionIp       []byte         `nmap:"skip,json"`
+}
+
+type PostureChecks struct {
+	ID       string
+	PublicID sql.NullString `nmap:"skip"`
+	Checks   []byte         `nmap:"json"`
+}
+
+type Route struct {
+	ID                  string
+	AccountID           sql.NullString
+	PublicID            sql.NullString
+	Network             []byte `nmap:"json"`
+	Domains             []byte `nmap:"json"`
+	KeepRoute           sql.NullBool
+	NetID               sql.NullString
+	Description         sql.NullString
+	Peer                sql.NullString
+	PeerID              sql.NullString
+	PeerGroups          []byte `nmap:"json"`
+	NetworkType         sql.NullInt64
+	Masquerade          sql.NullBool
+	Metric              sql.NullInt64
+	Enabled             sql.NullBool
+	Groups              []byte `nmap:"json"`
+	AccessControlGroups []byte `nmap:"json"`
+	SkipAutoApply       sql.NullBool
+}
+
+func RecordTypeAndRdata(t, rdata string) (int, string, error) {
+	switch t {
+	case "A":
+		return int(dns.TypeA), rdata, nil
+	case "AAAA":
+		return int(dns.TypeAAAA), rdata, nil
+	case "CNAME":
+		return int(dns.TypeCNAME), dns.Fqdn(rdata), nil
+	default:
+		return 0, "", fmt.Errorf("record type: %s %w", t, ErrDnsUnsupportedRecordType)
+	}
+}
+
+func ZonesToAppliedZoneCandidates(zones []Zone) ([]networkmap.AppliedZoneCandidate, error) {
+	toret := make([]networkmap.AppliedZoneCandidate, 0, len(zones))
+	currentZoneId := ""
+	for _, z := range zones {
+		if !z.RecordType.Valid {
+			continue
+		}
+
+		zone := nmdata.CustomZone{}
+		err := FromSqlTypesToSharedTypes(
+			reflect.ValueOf(&z), reflect.ValueOf(&zone))
+		if err != nil {
+			return nil, err
+		}
+
+		var distributionGroups []string
+		if err := json.Unmarshal(z.DistributionGroups, &distributionGroups); err != nil {
+			return nil, err
+		}
+
+		if z.Id != currentZoneId {
+			// The account-side builder (types.buildAppliedZoneCandidates) states
+			// the shape of an applied zone: names fully qualified, served
+			// non-authoritatively. Both builders feed the same client-facing map,
+			// so this one has to produce the same value.
+			zone.Domain = dns.Fqdn(zone.Domain)
+			zone.NonAuthoritative = true
+			zone.Records = []nmdata.SimpleRecord{}
+			toret = append(toret, AppliedZoneCandidateFromZone(zone, distributionGroups))
+			currentZoneId = z.Id
+		}
+
+		rtype, rdata, err := RecordTypeAndRdata(z.RecordType.String, z.RecordRData.String)
+		if err != nil {
+			if errors.Is(err, ErrDnsUnsupportedRecordType) {
+				continue
+			}
+			return nil, err
+		}
+
+		lastZone := &toret[len(toret)-1]
+		lastZone.Zone.Records = append(lastZone.Zone.Records, nmdata.SimpleRecord{
+			Name:  dns.Fqdn(z.RecordName.String),
+			Class: z.RecordClass.String,
+			TTL:   int(z.RecordTTL.Int64),
+			RData: rdata,
+			Type:  rtype,
+		})
+	}
+	return toret, nil
+}
+
+func AppliedZoneCandidateFromZone(z nmdata.CustomZone, distributionGroups []string) networkmap.AppliedZoneCandidate {
+	return networkmap.AppliedZoneCandidate{
+		DistributionGroups: distributionGroups,
+		Zone:               z,
+	}
+}
+
+func ConvertToNmdataPeers(peers []Peer) ([]nmdata.Peer, map[string][]*nmdata.Peer, error) {
+	toret := make([]nmdata.Peer, 0, len(peers))
+	clusterToPeerIdx := make(map[string][]*nmdata.Peer)
+	for _, p := range peers {
+		dp := nmdata.Peer{}
+		err := FromSqlTypesToSharedTypes(
+			reflect.ValueOf(&p), reflect.ValueOf(&dp))
+		if err != nil {
+			return nil, nil, err
+		}
+
+		if p.ProxyMetaEmbedded.Valid {
+			dp.ProxyMeta.Embedded = p.ProxyMetaEmbedded.Bool
+		}
+		dp.ProxyMeta.Cluster = p.ProxyMetaCluster.String
+		// This is only used to build private service candidates, not connected peers are skipped
+		dp.Connected = p.PeerStatusConnected.Bool
+		if dp.ProxyMeta.Embedded && p.PeerStatusConnected.Bool {
+			clusterToPeerIdx[p.ProxyMetaCluster.String] = append(clusterToPeerIdx[p.ProxyMetaCluster.String], &dp)
+		}
+		if p.MetaWtVersion.Valid {
+			dp.Meta.WtVersion = p.MetaWtVersion.String
+		}
+		if p.MetaSyncMessageVersion.Valid {
+			dp.Meta.SyncMessageVersion = int(p.MetaSyncMessageVersion.Int64)
+		}
+		if p.MetaGoOS.Valid {
+			dp.Meta.GoOS = p.MetaGoOS.String
+		}
+		if p.MetaOSVersion.Valid {
+			dp.Meta.OSVersion = p.MetaOSVersion.String
+		}
+		if p.MetaKernelVersion.Valid {
+			dp.Meta.KernelVersion = p.MetaKernelVersion.String
+		}
+		if p.LocationCountryCode.Valid {
+			dp.Location.CountryCode = p.LocationCountryCode.String
+		}
+		if p.LocationCityName.Valid {
+			dp.Location.CityName = p.LocationCityName.String
+		}
+		if p.LocationConnectionIp != nil {
+			err := json.Unmarshal(p.LocationConnectionIp, &dp.Location.ConnectionIP)
+			if err != nil {
+				return toret, nil, err
+			}
+		}
+		if p.MetaFiles != nil {
+			err := json.Unmarshal(p.MetaFiles, &dp.Meta.Files)
+			if err != nil {
+				return toret, nil, err
+			}
+		}
+		if p.MetaCertificates != nil {
+			err := json.Unmarshal(p.MetaCertificates, &dp.Meta.Certificates)
+			if err != nil {
+				return toret, nil, err
+			}
+		}
+		if p.MetaCapabilities != nil {
+			err := json.Unmarshal(p.MetaCapabilities, &dp.Meta.Capabilities)
+			if err != nil {
+				return toret, nil, err
+			}
+		}
+		if p.MetaFlags != nil {
+			err := json.Unmarshal(p.MetaFlags, &dp.Meta.Flags)
+			if err != nil {
+				return toret, nil, err
+			}
+		}
+		if p.MetaNetworkAddresses != nil {
+			err := json.Unmarshal(p.MetaNetworkAddresses, &dp.Meta.NetworkAddresses)
+			if err != nil {
+				return toret, nil, err
+			}
+		}
+
+		toret = append(toret, dp)
+	}
+
+	return toret, clusterToPeerIdx, nil
+}
+
+func ConvertToNmdataPolicy(policies []Policy) ([]nmdata.Policy, map[string]map[string]any, map[string]map[string]any, error) {
+	toret := make([]nmdata.Policy, 0, len(policies))
+	policyToDestinationResourceIdx := make(map[string]map[string]any) // policy id to destination resource id
+	policyToDestinationGroupIdx := make(map[string]map[string]any)    // policy id to destination group id
+	for _, p := range policies {
+		policy := nmdata.Policy{}
+		err := FromSqlTypesToSharedTypes(
+			reflect.ValueOf(&p), reflect.ValueOf(&policy))
+		if err != nil {
+			return nil, nil, nil, err
+		}
+
+		var policyRule *nmdata.PolicyRule
+		pr := func() *nmdata.PolicyRule {
+			if policyRule != nil {
+				return policyRule
+			}
+
+			policyRule = &nmdata.PolicyRule{}
+			return policyRule
+		}
+
+		if p.RuleEnabled.Valid {
+			pr().Enabled = p.RuleEnabled.Bool
+		}
+		if p.Action.Valid {
+			pr().Action = p.Action.String
+		}
+		if p.Protocol.Valid {
+			pr().Protocol = p.Protocol.String
+		}
+		if p.Bidirectional.Valid {
+			pr().Bidirectional = p.Bidirectional.Bool
+		}
+		if len(p.Sources) > 0 {
+			err := json.Unmarshal([]byte(p.Sources), &pr().Sources)
+			if err != nil {
+				return toret, nil, nil, err
+			}
+		}
+		if len(p.Destinations) > 0 {
+			err := json.Unmarshal([]byte(p.Destinations), &pr().Destinations)
+			if err != nil {
+				return toret, nil, nil, err
+			}
+
+			if p.RuleEnabled.Valid && p.RuleEnabled.Bool {
+				for _, dst := range pr().Destinations {
+					if _, ok := policyToDestinationGroupIdx[p.ID]; !ok {
+						policyToDestinationGroupIdx[p.ID] = make(map[string]any)
+					}
+					policyToDestinationGroupIdx[p.ID][dst] = struct{}{}
+				}
+			}
+		}
+		if len(p.SourceResource) > 0 {
+			err := json.Unmarshal([]byte(p.SourceResource), &pr().SourceResource)
+			if err != nil {
+				return toret, nil, nil, err
+			}
+		}
+		if len(p.DestinationResource) > 0 {
+			err := json.Unmarshal([]byte(p.DestinationResource), &pr().DestinationResource)
+			if err != nil {
+				return toret, nil, nil, err
+			}
+
+			if p.RuleEnabled.Valid && p.RuleEnabled.Bool {
+				if _, ok := policyToDestinationResourceIdx[p.ID]; !ok {
+					policyToDestinationResourceIdx[p.ID] = make(map[string]any)
+				}
+				policyToDestinationResourceIdx[p.ID][pr().DestinationResource.ID] = struct{}{}
+			}
+		}
+		if len(p.Ports) > 0 {
+			err := json.Unmarshal([]byte(p.Ports), &pr().Ports)
+			if err != nil {
+				return toret, nil, nil, err
+			}
+		}
+		if len(p.PortRanges) > 0 {
+			err := json.Unmarshal([]byte(p.PortRanges), &pr().PortRanges)
+			if err != nil {
+				return toret, nil, nil, err
+			}
+		}
+		if len(p.AuthorizedGroups) > 0 {
+			err := json.Unmarshal([]byte(p.AuthorizedGroups), &pr().AuthorizedGroups)
+			if err != nil {
+				return toret, nil, nil, err
+			}
+		}
+		if p.AuthorizedUser.Valid {
+			pr().AuthorizedUser = p.AuthorizedUser.String
+		}
+
+		if policyRule != nil {
+			policyRule.ID = p.ID
+			policyRule.PolicyID = p.ID
+			policy.Rules = []*nmdata.PolicyRule{policyRule}
+		}
+
+		toret = append(toret, policy)
+	}
+
+	return toret, policyToDestinationResourceIdx, policyToDestinationGroupIdx, nil
+}
+
+// TwinProxyDomains converts registered reverse-proxy domain rows to their slim
+// twins, so private-service zone apex resolution runs on the twin.
+func TwinProxyDomains(domains []Domain) []nmdata.ProxyDomain {
+	if len(domains) == 0 {
+		return nil
+	}
+	out := make([]nmdata.ProxyDomain, 0, len(domains))
+	for _, d := range domains {
+		out = append(out, nmdata.ProxyDomain{Domain: d.Domain.String, TargetCluster: d.TargetCluster.String})
+	}
+	return out
+}
diff --git a/management/internals/network_map_db/shared_types_test.go b/management/internals/network_map_db/shared_types_test.go
new file mode 100644
index 000000000..34b69d265
--- /dev/null
+++ b/management/internals/network_map_db/shared_types_test.go
@@ -0,0 +1,60 @@
+package networkmapdb
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRecordTypeAndRdata(t *testing.T) {
+	var tests = []struct {
+		recordType         string
+		expectedRecordType int
+		rdata              string
+		expectedRdata      string
+		expectedErr        error
+	}{
+		{recordType: "A", expectedRecordType: 1, rdata: "test.com", expectedRdata: "test.com", expectedErr: nil},
+		{recordType: "AAAA", expectedRecordType: 28, rdata: "test.com", expectedRdata: "test.com", expectedErr: nil},
+		{recordType: "CNAME", expectedRecordType: 5, rdata: "test.com", expectedRdata: "test.com.", expectedErr: nil},
+		{recordType: "CNAME", expectedRecordType: 5, rdata: "test.com.", expectedRdata: "test.com.", expectedErr: nil},
+		{recordType: "TypeMX", expectedErr: ErrDnsUnsupportedRecordType},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.recordType, func(t *testing.T) {
+			recordType, rdata, err := RecordTypeAndRdata(tt.recordType, tt.rdata)
+
+			if tt.expectedErr != nil {
+				assert.ErrorIs(t, err, ErrDnsUnsupportedRecordType)
+				return
+			}
+
+			assert.NoError(t, err)
+			assert.Equal(t, recordType, tt.expectedRecordType)
+			assert.Equal(t, rdata, tt.expectedRdata)
+		})
+	}
+}
+
+// TestConvertToNmdataPeers_CarriesTheVerifiedCertificates: the certificate posture check is
+// evaluated on the chains stored in the peer meta, so a peer loaded through this path with
+// its certificates dropped would silently fail every certificate check.
+func TestConvertToNmdataPeers_CarriesTheVerifiedCertificates(t *testing.T) {
+	peers, _, err := ConvertToNmdataPeers([]Peer{
+		{MetaCertificates: []byte(`["-----BEGIN CERTIFICATE-----\nleaf\n-----END CERTIFICATE-----\n","chain-2"]`)},
+		{},
+	})
+
+	require.NoError(t, err)
+	require.Len(t, peers, 2)
+	assert.Equal(t, []string{"-----BEGIN CERTIFICATE-----\nleaf\n-----END CERTIFICATE-----\n", "chain-2"}, peers[0].Meta.Certificates)
+	assert.Empty(t, peers[1].Meta.Certificates, "a peer that proved nothing has no certificates")
+}
+
+func TestConvertToNmdataPeers_RejectsMalformedCertificates(t *testing.T) {
+	_, _, err := ConvertToNmdataPeers([]Peer{{MetaCertificates: []byte(`{"not":"a list"}`)}})
+
+	assert.Error(t, err, "a stored value that is not a list of chains must not load as no certificates")
+}
diff --git a/management/internals/network_map_db/sql_type_conversion_test.go b/management/internals/network_map_db/sql_type_conversion_test.go
new file mode 100644
index 000000000..77dab93a8
--- /dev/null
+++ b/management/internals/network_map_db/sql_type_conversion_test.go
@@ -0,0 +1,253 @@
+package networkmapdb
+
+import (
+	"database/sql"
+	"encoding/json"
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNullStringSupport(t *testing.T) {
+	src := withNullString{Name: sql.NullString{String: "string", Valid: true}}
+	dst := withString{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, withString{Name: "string"}, dst)
+
+	src = withNullString{Name: sql.NullString{Valid: false}}
+	dst = withString{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, withString{Name: ""}, dst)
+}
+
+func TestNullBoolSupport(t *testing.T) {
+	src := withNullBool{TrueOrFalse: sql.NullBool{Bool: true, Valid: true}}
+	dst := withBool{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, withBool{TrueOrFalse: true}, dst)
+
+}
+
+func TestRawJsonSupport(t *testing.T) {
+	jb, _ := json.Marshal(embeddedS{Name: "blob-name", SomeField: 1})
+	src := withRawJson{Blob: json.RawMessage(jb)}
+	dst := fromJson{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, fromJson{Blob: embeddedS{Name: "blob-name", SomeField: 1}}, dst)
+
+	src1 := withRawJson{}
+	dst1 := fromJson{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src1), reflect.ValueOf(&dst1)))
+	assert.Equal(t, fromJson{}, dst1)
+}
+
+func TestShouldSkipTag(t *testing.T) {
+	src5 := withSkipTag{Field: "shouldskip"}
+	dst5 := emptySkipTagTarget{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src5), reflect.ValueOf(&dst5)))
+	assert.Equal(t, emptySkipTagTarget{}, dst5)
+
+}
+
+func TestMapToTag(t *testing.T) {
+	src6 := withMapToTag{Field: "fieldvalue"}
+	dst6 := mapToTagTarget{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src6), reflect.ValueOf(&dst6)))
+	assert.Equal(t, mapToTagTarget{AnotherField: "fieldvalue"}, dst6)
+}
+
+func TestNullableInt64Support(t *testing.T) {
+	src := withInt64{Field: sql.NullInt64{Int64: int64(1), Valid: true}}
+	dst := int64Target{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, int64Target{Field: 1}, dst)
+}
+
+func TestNullableTimeSupport(t *testing.T) {
+	now := time.Now()
+	src := withNullableTime{Field: sql.NullTime{Time: now, Valid: true}}
+	dst := nullableTimeTarget{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, nullableTimeTarget{Field: now}, dst)
+}
+
+func TestNullableTimePointerSupport(t *testing.T) {
+	now := time.Now()
+	src := withNullableTime{Field: sql.NullTime{Time: now, Valid: true}}
+	dst := nullableTimePointerTarget{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, nullableTimePointerTarget{Field: &now}, dst)
+}
+
+func TestStringSLiceSupport(t *testing.T) {
+	src := withStringSlice{Field: []string{"one"}}
+	dst := withStringSlice{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, withStringSlice{Field: []string{"one"}}, dst)
+}
+
+func TestNullStringSLiceSupport(t *testing.T) {
+	src := withStringSlice{}
+	dst := withStringSlice{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, withStringSlice{}, dst)
+}
+
+func TestWithMultipleFields(t *testing.T) {
+	now := time.Now()
+	src := withMultipleFields{
+		Field1: sql.NullString{String: "aaa", Valid: true},
+		Field2: sql.NullBool{Bool: true, Valid: true},
+		Field3: sql.NullTime{Time: now, Valid: true},
+		Field4: sql.NullInt64{Int64: 1, Valid: true},
+		Field5: "another",
+	}
+	dst := multipleFieldsTarget{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, multipleFieldsTarget{
+		Field1: "aaa",
+		Field2: true,
+		Field3: now,
+		Field4: 1,
+		Field5: "another",
+	}, dst)
+}
+
+func TestEmptyPublicIdsFilled(t *testing.T) {
+	src := withEmptyPublicIds{}
+	dst := emptyPublicIdTarget{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.NotEmpty(t, dst.PublicID)
+	assert.NotEmpty(t, dst.PublicId)
+}
+
+// only []byte and []uint8 slices with "json" tag are being parsed
+func TestByteSliceSupport(t *testing.T) {
+	src := withByteSlice{
+		Field: []byte("[\"one\",\"two\",\"three\"]"),
+	}
+	dst := byteSliceTarget{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, []string{"one", "two", "three"}, dst.Field)
+}
+
+func TestUint8SliceSupport(t *testing.T) {
+	src := withUint8Slice{
+		Field: []uint8("[\"one\",\"two\",\"three\"]"),
+	}
+	dst := uint8SliceTarget{}
+	assert.NoError(t, FromSqlTypesToSharedTypes(reflect.ValueOf(&src), reflect.ValueOf(&dst)))
+	assert.Equal(t, []string{"one", "two", "three"}, dst.Field)
+}
+
+type withNullString struct {
+	Name sql.NullString
+}
+
+type withString struct {
+	Name string
+}
+
+type withMultipleFields struct {
+	Field1 sql.NullString
+	Field2 sql.NullBool
+	Field3 sql.NullTime
+	Field4 sql.NullInt64
+	Field5 string
+}
+
+type multipleFieldsTarget struct {
+	Field1 string
+	Field2 bool
+	Field3 time.Time
+	Field4 int64
+	Field5 string
+}
+
+type withNullBool struct {
+	TrueOrFalse sql.NullBool
+}
+
+type withBool struct {
+	TrueOrFalse bool
+}
+
+type withRawJson struct {
+	Blob json.RawMessage
+}
+
+type embeddedS struct {
+	Name      string
+	SomeField int
+}
+type fromJson struct {
+	Blob embeddedS
+}
+
+type withSkipTag struct {
+	Field string `nmap:"skip"`
+}
+
+type emptySkipTagTarget struct {
+	Field string
+}
+
+type withMapToTag struct {
+	Field string `nmap:"map_to:AnotherField"`
+}
+
+type mapToTagTarget struct {
+	AnotherField string
+}
+
+type withInt64 struct {
+	Field sql.NullInt64
+}
+
+type int64Target struct {
+	Field int
+}
+
+type withNullableTime struct {
+	Field sql.NullTime
+}
+
+type nullableTimeTarget struct {
+	Field time.Time
+}
+
+type nullableTimePointerTarget struct {
+	Field *time.Time
+}
+
+type withStringSlice struct {
+	Field []string
+}
+
+type withEmptyPublicIds struct {
+	PublicID sql.NullString
+	PublicId sql.NullString
+}
+
+type emptyPublicIdTarget struct {
+	PublicID string
+	PublicId string
+}
+
+type withByteSlice struct {
+	Field []byte `nmap:"json"`
+}
+
+type byteSliceTarget struct {
+	Field []string
+}
+
+type withUint8Slice struct {
+	Field []byte `nmap:"json"`
+}
+
+type uint8SliceTarget struct {
+	Field []string
+}
diff --git a/management/internals/network_map_db/sqlite/account_setting.go b/management/internals/network_map_db/sqlite/account_setting.go
new file mode 100644
index 000000000..9a1a152fe
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/account_setting.go
@@ -0,0 +1,47 @@
+package networkmap_sqlite
+
+import (
+	"context"
+	"reflect"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetAccountSettingsQuery = `
+	select settings_peer_login_expiration_enabled as peer_login_expiration_enabled,
+	settings_peer_login_expiration as peer_login_expiration,
+	settings_peer_inactivity_expiration_enabled as peer_inactivity_expiration_enabled,
+	settings_peer_inactivity_expiration as peer_inactivity_expiration,
+	settings_dns_domain as dns_domain,
+	settings_ipv6_enabled_groups as ipv6_enabled_groups,
+	settings_routing_peer_dns_resolution_enabled as routing_peer_dns_resolution_enabled,
+	settings_lazy_connection_enabled as lazy_connection_enabled,
+	settings_auto_update_version as auto_update_version,
+	settings_auto_update_always as auto_update_always,
+	settings_metrics_push_enabled as metrics_push_enabled
+	from accounts
+	where id=?
+	`
+)
+
+func (sc *SqliteStoreConn) GetAccountSettings(ctx context.Context, accountId string) (nmdata.AccountSettingsInfo, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetAccountSettingsQuery, accountId)
+	if err != nil {
+		return nmdata.AccountSettingsInfo{}, err
+	}
+
+	a, err := CollectOneRowForSqlite[networkmapdb.Account](rows)
+	if err != nil {
+		return nmdata.AccountSettingsInfo{}, err
+	}
+
+	settingsInfo := nmdata.AccountSettingsInfo{}
+	err = networkmapdb.FromSqlTypesToSharedTypes(reflect.ValueOf(&a), reflect.ValueOf(&settingsInfo))
+	if err != nil {
+		return nmdata.AccountSettingsInfo{}, err
+	}
+
+	return settingsInfo, nil
+}
diff --git a/management/internals/network_map_db/sqlite/dns.go b/management/internals/network_map_db/sqlite/dns.go
new file mode 100644
index 000000000..dd2cb3758
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/dns.go
@@ -0,0 +1,32 @@
+package networkmap_sqlite
+
+import (
+	"context"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+)
+
+const (
+	GetAccountZonesQuery = `
+	select zones.id as id, domain, not enable_search_domain as search_domain_disabled, distribution_groups,
+	r.name as record_name, r.type as record_type, 'IN' record_class, r.ttl as record_ttl, r.content as record_rdata
+	from zones
+	left join records as r on r.zone_id = zones.id
+	where zones.account_id=? and zones.enabled
+	`
+)
+
+func (sc *SqliteStoreConn) GetAppliedZoneCandidates(ctx context.Context, accountId string) ([]networkmap.AppliedZoneCandidate, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetAccountZonesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	zones, err := CollectRowsForSqlite[networkmapdb.Zone](rows)
+	if err != nil {
+		return nil, err
+	}
+
+	return networkmapdb.ZonesToAppliedZoneCandidates(zones)
+}
diff --git a/management/internals/network_map_db/sqlite/dns_setting.go b/management/internals/network_map_db/sqlite/dns_setting.go
new file mode 100644
index 000000000..7c6e9e7eb
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/dns_setting.go
@@ -0,0 +1,42 @@
+package networkmap_sqlite
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetDnsSettingsQuery = `
+	select dns_settings_disabled_management_groups
+	from accounts
+	where id=?
+	`
+)
+
+func (sc *SqliteStoreConn) GetDnsSettings(ctx context.Context, accountId string) (nmdata.DNSSettings, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetDnsSettingsQuery, accountId)
+	if err != nil {
+		return nmdata.DNSSettings{}, err
+	}
+	defer rows.Close()
+
+	var value nmdata.DNSSettings
+	var settings []byte
+
+	rows.Next()
+	if err := rows.Scan(&settings); err != nil {
+		return value, err
+	}
+
+	if settings == nil {
+		return nmdata.DNSSettings{}, nil
+	}
+
+	if err := json.Unmarshal(settings, &value.DisabledManagementGroups); err != nil {
+		return value, err
+	}
+
+	return value, nil
+}
diff --git a/management/internals/network_map_db/sqlite/domain.go b/management/internals/network_map_db/sqlite/domain.go
new file mode 100644
index 000000000..572977c3b
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/domain.go
@@ -0,0 +1,24 @@
+package networkmap_sqlite
+
+import (
+	"context"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+)
+
+const (
+	GetDomainsQuery = `
+	select domain, target_cluster
+	from domains
+	where account_id=? and domain<>'' and target_cluster<>''
+	`
+)
+
+func (sc *SqliteStoreConn) GetDomains(ctx context.Context, accountId string) ([]networkmapdb.Domain, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetDomainsQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	return CollectRowsForSqlite[networkmapdb.Domain](rows)
+}
diff --git a/management/internals/network_map_db/sqlite/group.go b/management/internals/network_map_db/sqlite/group.go
new file mode 100644
index 000000000..c324d0d29
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/group.go
@@ -0,0 +1,70 @@
+package networkmap_sqlite
+
+import (
+	"context"
+	"database/sql"
+	"reflect"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetGroupsQuery = `
+	select groups.id, groups.name, groups.public_id, groups.resources, gp.peer_id
+	from groups 
+	left join group_peers gp on gp.group_id=groups.id and gp.account_id=?
+	where groups.account_id=?
+	`
+)
+
+// we also return a resource-to-group index.
+// an alternative is to add json indexes, query this directly. Not sure how expensive
+// json indexes are. TODO (dmitri) verify and maybe change the implementation here.
+func (sc *SqliteStoreConn) GetGroups(ctx context.Context, accountId string) ([]nmdata.Group, map[string]map[string]any, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetGroupsQuery, accountId, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	groups, err := CollectRowsForSqlite[group](rows)
+
+	toret := make([]nmdata.Group, 0, len(groups))
+	resourceToGroupIdx := make(map[string]map[string]any)
+
+	for _, g := range groups {
+		if len(toret) > 0 && toret[len(toret)-1].ID == g.ID && g.PeerID.Valid {
+			toret[len(toret)-1].Peers = append(toret[len(toret)-1].Peers, g.PeerID.String)
+			continue
+		}
+
+		dg := nmdata.Group{}
+		err := networkmapdb.FromSqlTypesToSharedTypes(
+			reflect.ValueOf(&g), reflect.ValueOf(&dg))
+		if err != nil {
+			return nil, nil, err
+		}
+
+		if g.PeerID.Valid {
+			dg.Peers = append(dg.Peers, g.PeerID.String)
+		}
+		toret = append(toret, dg)
+
+		for _, resource := range dg.Resources {
+			if _, ok := resourceToGroupIdx[resource.ID]; !ok {
+				resourceToGroupIdx[resource.ID] = make(map[string]any)
+			}
+			resourceToGroupIdx[resource.ID][g.ID] = struct{}{}
+		}
+	}
+
+	return toret, resourceToGroupIdx, err
+}
+
+type group struct {
+	ID        string
+	Name      sql.NullString
+	PublicID  sql.NullString
+	Resources []byte         `nmap:"json"`
+	PeerID    sql.NullString `nmap:"skip"`
+}
diff --git a/management/internals/network_map_db/sqlite/nameserver.go b/management/internals/network_map_db/sqlite/nameserver.go
new file mode 100644
index 000000000..618e1a1f3
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/nameserver.go
@@ -0,0 +1,30 @@
+package networkmap_sqlite
+
+import (
+	"context"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetNameserversQuery = `
+	select id, public_id, name, description, name_servers, groups, "primary", domains, enabled, search_domains_enabled
+	from name_server_groups
+	where account_id=?
+	`
+)
+
+func (sc *SqliteStoreConn) GetNameServerGroups(ctx context.Context, accountId string) ([]nmdata.NameServerGroup, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetNameserversQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	nsgroups, err := CollectRowsForSqlite[networkmapdb.NameserverGroup](rows)
+	if err != nil {
+		return nil, err
+	}
+
+	return networkmapdb.ConvertAllToSharedTypes[networkmapdb.NameserverGroup, nmdata.NameServerGroup](nsgroups)
+}
diff --git a/management/internals/network_map_db/sqlite/network.go b/management/internals/network_map_db/sqlite/network.go
new file mode 100644
index 000000000..3fa85ecdf
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/network.go
@@ -0,0 +1,38 @@
+package networkmap_sqlite
+
+import (
+	"context"
+	"reflect"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetNetworkQuery = `
+	select network_identifier as identifier, network_net as net, network_net_v6 as net_v6, network_dns as dns, network_serial as serial
+	from accounts
+	where id=?
+	`
+)
+
+func (sc *SqliteStoreConn) GetNetwork(ctx context.Context, accountId string) (nmdata.Network, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetNetworkQuery, accountId)
+	if err != nil {
+		return nmdata.Network{}, err
+	}
+
+	n, err := CollectOneRowForSqlite[networkmapdb.AccountNetwork](rows)
+	if err != nil {
+		return nmdata.Network{}, err
+	}
+
+	toret := nmdata.Network{}
+	err = networkmapdb.FromSqlTypesToSharedTypes(
+		reflect.ValueOf(&n), reflect.ValueOf(&toret))
+	if err != nil {
+		return nmdata.Network{}, err
+	}
+
+	return toret, nil
+}
diff --git a/management/internals/network_map_db/sqlite/network_resource.go b/management/internals/network_map_db/sqlite/network_resource.go
new file mode 100644
index 000000000..1d98a12e9
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/network_resource.go
@@ -0,0 +1,30 @@
+package networkmap_sqlite
+
+import (
+	"context"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetNetworkResourcesQuery = `
+	select id, network_id, account_id, public_id, name, description, type, domain, prefix, enabled
+	from network_resources
+	where account_id=?
+	`
+)
+
+func (sc *SqliteStoreConn) GetNetworkResources(ctx context.Context, accountId string) ([]nmdata.NetworkResource, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetNetworkResourcesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	netresorces, err := CollectRowsForSqlite[networkmapdb.Networkresource](rows)
+	if err != nil {
+		return nil, err
+	}
+
+	return networkmapdb.ConvertAllToSharedTypes[networkmapdb.Networkresource, nmdata.NetworkResource](netresorces)
+}
diff --git a/management/internals/network_map_db/sqlite/network_router.go b/management/internals/network_map_db/sqlite/network_router.go
new file mode 100644
index 000000000..9fb0fde7e
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/network_router.go
@@ -0,0 +1,76 @@
+package networkmap_sqlite
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"reflect"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	// Outer join: a groupless router must survive.
+	GetNetworkRouterQuery = `
+	select public_id, peer, network_id, masquerade, metric, enabled, peer_groups, group_peers.peer_id
+	from network_routers
+	left join json_each(network_routers.peer_groups) on true
+	left join group_peers on group_peers.account_id=? and group_peers.group_id=json_each.value
+	where network_routers.account_id=?
+	`
+)
+
+func (sc *SqliteStoreConn) GetNetworkRouters(ctx context.Context, accountId string) (map[string]map[string]*nmdata.NetworkRouter, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetNetworkRouterQuery, accountId, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	routers, err := CollectRowsForSqlite[networkrouter](rows)
+	if err != nil {
+		return nil, err
+	}
+
+	toret := make(map[string]map[string]*nmdata.NetworkRouter)
+	for _, router := range routers {
+		if !router.Enabled.Bool {
+			continue
+		}
+
+		networkId := router.NetworkID.String
+		if networkId == "" {
+			return nil, fmt.Errorf("router with public_id %s doesn't have network_id set", router.PublicID.String)
+		}
+
+		nmdatarouter := nmdata.NetworkRouter{}
+		err := networkmapdb.FromSqlTypesToSharedTypes(reflect.ValueOf(&router), reflect.ValueOf(&nmdatarouter))
+		if err != nil {
+			return nil, err
+		}
+
+		if toret[networkId] == nil {
+			toret[networkId] = make(map[string]*nmdata.NetworkRouter)
+		}
+		if router.Peer.String != "" {
+			toret[networkId][router.Peer.String] = &nmdatarouter
+			continue
+		}
+		if router.PeerViaGroups.String != "" {
+			toret[networkId][router.PeerViaGroups.String] = &nmdatarouter
+		}
+	}
+
+	return toret, nil
+}
+
+type networkrouter struct {
+	PublicID      sql.NullString
+	Peer          sql.NullString `nmap:"skip"`
+	NetworkID     sql.NullString `nmap:"skip"`
+	Masquerade    sql.NullBool
+	Metric        sql.NullInt64
+	Enabled       sql.NullBool
+	PeerGroups    []byte         `nmap:"json"`
+	PeerViaGroups sql.NullString `nmap:"skip"`
+}
diff --git a/management/internals/network_map_db/sqlite/networks.go b/management/internals/network_map_db/sqlite/networks.go
new file mode 100644
index 000000000..e19336846
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/networks.go
@@ -0,0 +1,35 @@
+package networkmap_sqlite
+
+import (
+	"context"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+)
+
+const (
+	GetNetworksQuery = `
+	select id, public_id
+	from networks where account_id=?
+	`
+)
+
+func (sc *SqliteStoreConn) GetNetworkXIDToPublicIdMap(ctx context.Context, accountId string) (map[string]string, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetNetworksQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	networks, err := CollectRowsForSqlite[networkmapdb.Network](rows)
+	if err != nil {
+		return nil, err
+	}
+
+	toret := make(map[string]string)
+	for _, n := range networks {
+		if n.PublicID.Valid {
+			toret[n.ID] = n.PublicID.String
+		}
+	}
+
+	return toret, nil
+}
diff --git a/management/internals/network_map_db/sqlite/peer.go b/management/internals/network_map_db/sqlite/peer.go
new file mode 100644
index 000000000..c4570658d
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/peer.go
@@ -0,0 +1,33 @@
+package networkmap_sqlite
+
+import (
+	"context"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetPeersQuery = `
+	select id, key, ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
+	meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files, meta_certificates, meta_capabilities, meta_flags, meta_sync_message_version,
+	location_country_code, location_city_name, location_connection_ip
+	from peers
+	where account_id = ?
+	`
+)
+
+func (sc *SqliteStoreConn) GetPeers(ctx context.Context, accountId string) ([]nmdata.Peer, map[string][]*nmdata.Peer, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetPeersQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	peers, err := CollectRowsForSqlite[networkmapdb.Peer](rows)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return networkmapdb.ConvertToNmdataPeers(peers)
+}
diff --git a/management/internals/network_map_db/sqlite/policy.go b/management/internals/network_map_db/sqlite/policy.go
new file mode 100644
index 000000000..1a11f6e20
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/policy.go
@@ -0,0 +1,33 @@
+package networkmap_sqlite
+
+import (
+	"context"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetPoliciesQuery = `
+	select p.id, p.public_id, p.enabled, p.source_posture_checks, pr.enabled as rule_enabled, pr.action, pr.protocol, pr.bidirectional, 
+	pr.sources, pr.destinations, pr.source_resource, pr.destination_resource, pr.ports, pr.port_ranges,
+	pr.authorized_groups, pr.authorized_user
+	from policies as p
+	left join policy_rules as pr on p.id = pr.policy_id 
+	where account_id=?
+	`
+)
+
+func (sc *SqliteStoreConn) GetPolicies(ctx context.Context, accountId string) ([]nmdata.Policy, map[string]map[string]any, map[string]map[string]any, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetPoliciesQuery, accountId)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	policies, err := CollectRowsForSqlite[networkmapdb.Policy](rows)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	return networkmapdb.ConvertToNmdataPolicy(policies)
+}
diff --git a/management/internals/network_map_db/sqlite/posture.go b/management/internals/network_map_db/sqlite/posture.go
new file mode 100644
index 000000000..6caee6e79
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/posture.go
@@ -0,0 +1,43 @@
+package networkmap_sqlite
+
+import (
+	"context"
+	"reflect"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetPostureChecksQuery = `
+	select id, public_id, checks
+	from posture_checks
+	where account_id=?
+	`
+)
+
+func (sc *SqliteStoreConn) GetPostureChecks(ctx context.Context, accountId string) ([]nmdata.PostureChecks, map[string]string, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetPostureChecksQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	checks, err := CollectRowsForSqlite[networkmapdb.PostureChecks](rows)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	toret := make([]nmdata.PostureChecks, 0, len(checks))
+	idToPublicIDIdx := make(map[string]string)
+	for _, c := range checks {
+		checks := nmdata.PostureChecks{}
+		err := networkmapdb.FromSqlTypesToSharedTypes(reflect.ValueOf(&c), reflect.ValueOf(&checks))
+		if err != nil {
+			return nil, nil, err
+		}
+		toret = append(toret, checks)
+		idToPublicIDIdx[checks.ID] = c.PublicID.String
+	}
+
+	return toret, idToPublicIDIdx, nil
+}
diff --git a/management/internals/network_map_db/sqlite/route.go b/management/internals/network_map_db/sqlite/route.go
new file mode 100644
index 000000000..58b3eca55
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/route.go
@@ -0,0 +1,32 @@
+package networkmap_sqlite
+
+import (
+	"context"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	GetRoutesQuery = `
+	select id, account_id, public_id, network, domains, keep_route, net_id, description,
+	peer, peer as peer_id, peer_groups, network_type, masquerade, metric, enabled, 
+	groups, access_control_groups, skip_auto_apply
+	from routes
+	where account_id=?
+	`
+)
+
+func (sc *SqliteStoreConn) GetRoutes(ctx context.Context, accountId string) ([]nmdata.Route, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetRoutesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	routes, err := CollectRowsForSqlite[networkmapdb.Route](rows)
+	if err != nil {
+		return nil, err
+	}
+
+	return networkmapdb.ConvertAllToSharedTypes[networkmapdb.Route, nmdata.Route](routes)
+}
diff --git a/management/internals/network_map_db/sqlite/service.go b/management/internals/network_map_db/sqlite/service.go
new file mode 100644
index 000000000..5d25f69e5
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/service.go
@@ -0,0 +1,89 @@
+package networkmap_sqlite
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+)
+
+const (
+	GetServicesQuery = `
+	select enabled, private, access_groups, proxy_cluster, domain
+	from services
+	where account_id=?
+	`
+
+	GetProxyTargetedDomainResourcesQuery = `
+	select t.target_id
+	from targets as t
+	join services as s on s.id = t.service_id
+	where s.account_id=? and s.enabled and not coalesce(s.terminated, false)
+	and t.enabled and t.target_type='domain' and t.target_id is not null
+	`
+)
+
+func (sc *SqliteStoreConn) GetPrivateServices(ctx context.Context, accountId string) ([]networkmapdb.Service, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetServicesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	services, err := CollectRowsForSqlite[service](rows)
+	if err != nil {
+		return nil, err
+	}
+
+	toret := make([]networkmapdb.Service, 0, len(services))
+	for _, service := range services {
+		acg := []string{}
+		if service.AccessGroups != nil {
+			if err := json.Unmarshal(service.AccessGroups, &acg); err != nil {
+				return nil, err
+			}
+		}
+		s := networkmapdb.Service{
+			Enabled:      service.Enabled,
+			Private:      service.Private,
+			AccessGroups: acg,
+			ProxyCluster: service.ProxyCluster,
+			Domain:       service.Domain,
+		}
+
+		toret = append(toret, s)
+	}
+	return toret, nil
+}
+
+func (sc *SqliteStoreConn) GetProxyTargetedDomainResourceIDs(ctx context.Context, accountId string) (map[string]struct{}, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetProxyTargetedDomainResourcesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	toret := make(map[string]struct{})
+	for rows.Next() {
+		var id string
+		err := rows.Scan(&id)
+		if err != nil {
+			return nil, err
+		}
+		toret[id] = struct{}{}
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	return toret, nil
+}
+
+type service struct {
+	Enabled      sql.NullBool
+	Private      sql.NullBool
+	AccessGroups []byte
+	ProxyCluster sql.NullString
+	Domain       sql.NullString
+}
diff --git a/management/internals/network_map_db/sqlite/sqlite_store.go b/management/internals/network_map_db/sqlite/sqlite_store.go
new file mode 100644
index 000000000..14abf80bc
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/sqlite_store.go
@@ -0,0 +1,148 @@
+package networkmap_sqlite
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"strings"
+
+	"database/sql"
+
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+)
+
+var ErrNoRows = errors.New("no rows in result set")
+
+type SqliteStore struct {
+	Db *sql.DB
+}
+
+type sqliteInterface interface {
+	QueryContext(ctx context.Context, query string, args ...any) (*sql.Rows, error)
+	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
+}
+
+type SqliteStoreConn struct {
+	Conn sqliteInterface
+}
+
+func NewSqliteStore(storeFile, dataDir string) (*SqliteStore, error) {
+	dbfile := storeFile
+	if envFile, ok := os.LookupEnv("NB_STORE_ENGINE_SQLITE_FILE"); ok && envFile != "" {
+		dbfile = envFile
+	}
+
+	// Separate file path from any SQLite URI query parameters (e.g., "store.db?mode=rwc")
+	filePath, query, hasQuery := strings.Cut(dbfile, "?")
+
+	connStr := filePath
+	if filePath != ":memory:" && !filepath.IsAbs(filePath) {
+		connStr = filepath.Join(dataDir, filePath)
+	}
+
+	// Compose query parameters. User-provided ?_busy_timeout (or its mattn alias
+	// ?_timeout) overrides our default; otherwise inject 30s so SQLite waits at
+	// most that long on a lock instead of blocking the only Go-side connection.
+	// mattn/go-sqlite3 applies PRAGMA from the DSN on every fresh connection, so
+	// the value survives ConnMaxIdleTime/ConnMaxLifetime recycling. cache=shared
+	// stays the default on non-Windows for the same reason as before.
+	parsed, _ := url.ParseQuery(query)
+	var defaults []string
+	if parsed.Get("_busy_timeout") == "" && parsed.Get("_timeout") == "" {
+		defaults = append(defaults, "_busy_timeout=30000")
+	}
+	if !hasQuery && runtime.GOOS != "windows" {
+		// To avoid `The process cannot access the file because it is being used by another process` on Windows
+		defaults = append(defaults, "cache=shared")
+	}
+	parts := defaults
+	if hasQuery {
+		parts = append(parts, query)
+	}
+	if len(parts) > 0 {
+		connStr += "?" + strings.Join(parts, "&")
+	}
+
+	db, err := sql.Open("sqlite3", connStr)
+	if err != nil {
+		return nil, err
+	}
+
+	return &SqliteStore{Db: db}, nil
+}
+
+func (s *SqliteStore) BeginTx(ctx context.Context) (networkmapdb.NetworkMapDBStoreConn, error) {
+	tx, err := s.Db.BeginTx(ctx, &sql.TxOptions{ReadOnly: true, Isolation: sql.LevelRepeatableRead})
+	if err != nil {
+		return nil, err
+	}
+	return &SqliteStoreConn{Conn: tx}, nil
+}
+
+func (s *SqliteStore) Exec(_ context.Context, query string, args ...any) error {
+	_, err := s.Db.Exec(query, args...)
+	return err
+}
+
+func (sc *SqliteStoreConn) RollbackTx(ctx context.Context) error {
+	tx, ok := sc.Conn.(*sql.Tx)
+	if !ok {
+		return fmt.Errorf("expected an sql.Tx got %s", reflect.TypeOf(sc.Conn).Kind())
+	}
+	return tx.Rollback()
+}
+
+func (sc *SqliteStoreConn) CommitTx(ctx context.Context) error {
+	tx, ok := sc.Conn.(*sql.Tx)
+	if !ok {
+		return fmt.Errorf("expected an sql.Tx got %s", reflect.TypeOf(sc.Conn).Kind())
+	}
+	return tx.Commit()
+}
+
+func (s *SqliteStore) UsingConn() *SqliteStoreConn {
+	return &SqliteStoreConn{Conn: s.Db}
+}
+
+func CollectOneRowForSqlite[T any](rows *sql.Rows) (T, error) {
+	defer rows.Close()
+	var r T
+
+	if !rows.Next() {
+		if err := rows.Err(); err != nil {
+			return r, err
+		}
+		return r, ErrNoRows
+	}
+	err := rows.Scan(networkmapdb.StructFields(&r)...)
+	if err != nil {
+		return r, err
+	}
+
+	return r, nil
+}
+
+func CollectRowsForSqlite[T any](rows *sql.Rows) ([]T, error) {
+	defer rows.Close()
+	toret := make([]T, 0)
+
+	for rows.Next() {
+		var r T
+		err := rows.Scan(networkmapdb.StructFields(&r)...)
+		if err != nil {
+			return nil, err
+		}
+		toret = append(toret, r)
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	return toret, nil
+}
diff --git a/management/internals/network_map_db/sqlite/user.go b/management/internals/network_map_db/sqlite/user.go
new file mode 100644
index 000000000..23c46bf76
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/user.go
@@ -0,0 +1,87 @@
+package networkmap_sqlite
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+)
+
+const (
+	GetAllowedUserIdsQuery = `
+	select id, auto_groups
+	from users
+	where account_id=? and not blocked and not is_service_user
+	`
+
+	GetAllGroupIdQuery = `
+	select id from groups
+	where account_id=? and name='All'
+	`
+)
+
+func (sc *SqliteStoreConn) GetAllowedUsers(ctx context.Context, accountId string) (map[string]struct{}, map[string][]string, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetAllowedUserIdsQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	users, err := CollectRowsForSqlite[user](rows)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	rows, err = sc.Conn.QueryContext(ctx, GetAllGroupIdQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+	allGroupIds, err := collectAllGroupIds(rows)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	userIdIdx := make(map[string]struct{})
+	groupIdToUserIds := make(map[string][]string)
+	for _, user := range users {
+		for _, allgid := range allGroupIds {
+			groupIdToUserIds[allgid] = append(groupIdToUserIds[allgid], user.ID)
+		}
+		userIdIdx[user.ID] = struct{}{}
+		autogroups := make([]string, 0)
+		if user.AutoGroups == nil {
+			continue
+		}
+		if err := json.Unmarshal(user.AutoGroups, &autogroups); err != nil {
+			return nil, nil, err
+		}
+		for _, groupId := range autogroups {
+			groupIdToUserIds[groupId] = append(groupIdToUserIds[groupId], user.ID)
+		}
+	}
+
+	return userIdIdx, groupIdToUserIds, nil
+}
+
+func collectAllGroupIds(rows *sql.Rows) ([]string, error) {
+	defer rows.Close()
+	var toret []string
+
+	for rows.Next() {
+		var id string
+		err := rows.Scan(&id)
+		if err != nil {
+			return nil, err
+		}
+		toret = append(toret, id)
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	return toret, nil
+}
+
+type user struct {
+	ID         string
+	AutoGroups []byte
+}
diff --git a/management/internals/network_map_db/struct_helpers.go b/management/internals/network_map_db/struct_helpers.go
new file mode 100644
index 000000000..1719662fd
--- /dev/null
+++ b/management/internals/network_map_db/struct_helpers.go
@@ -0,0 +1,157 @@
+package networkmapdb
+
+import (
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"reflect"
+	"strings"
+
+	"github.com/rs/xid"
+)
+
+var ErrNoRows = errors.New("no rows in result set")
+
+const (
+	NMAP_STRUCT_TAG = "nmap"
+	NMAP_SKIP       = "skip"
+	NMAP_MAP_TO     = "map_to"
+	NMAP_JSON       = "json"
+)
+
+type fieldTag struct {
+	Key   string
+	Value string
+}
+
+func tagFromString(t string) fieldTag {
+	kv := strings.Split(t, ":")
+	if len(kv) == 1 {
+		return fieldTag{Key: strings.TrimSpace(kv[0])}
+	}
+	return fieldTag{Key: strings.TrimSpace(kv[0]), Value: strings.TrimSpace(kv[1])}
+}
+
+func FromSqlTypesToSharedTypes(src reflect.Value, dst reflect.Value) error {
+	typ := src.Elem().Type()
+
+	for i := 0; i < typ.NumField(); i++ {
+		f := typ.Field(i)
+
+		fieldTags := make(map[string]string)
+		if v := f.Tag.Get(NMAP_STRUCT_TAG); v != "" {
+			for _, t := range strings.Split(v, ",") {
+				kv := tagFromString(t)
+				fieldTags[kv.Key] = kv.Value
+			}
+		}
+		if _, ok := fieldTags[NMAP_SKIP]; ok {
+			continue
+		}
+		if f.PkgPath != "" { // skip unexported fields
+			continue
+		}
+		dstFieldName := f.Name
+		if override, ok := fieldTags[NMAP_MAP_TO]; ok {
+			dstFieldName = override
+		}
+
+		dstField := dst.Elem().FieldByName(dstFieldName)
+		if !dstField.IsValid() {
+			return errors.New("unsupported type in destination field: " + dstFieldName)
+		}
+
+		srcField := src.Elem().Field(i)
+		srcFieldType := srcField.Type().String()
+		switch srcFieldType {
+		case "string":
+			s := srcField.Interface().(string)
+			dstField.SetString(s)
+		case "sql.NullString":
+			s := srcField.Interface().(sql.NullString)
+			if s.Valid {
+				dstField.SetString(s.String)
+			}
+			if (dstFieldName == "PublicId" || dstFieldName == "PublicID") && s.String == "" {
+				dstField.SetString(xid.New().String()) // TODO (dmitri) this needs to be removed to support delta updates
+			}
+		case "sql.NullTime":
+			s := srcField.Interface().(sql.NullTime)
+			if s.Valid {
+				if dstField.Kind() == reflect.Ptr {
+					t := reflect.ValueOf(&s.Time).Elem()
+					dstField.Set(t.Addr())
+				} else {
+					dstField.Set(reflect.ValueOf(s.Time))
+				}
+			}
+		case "sql.NullBool":
+			s := srcField.Interface().(sql.NullBool)
+			if s.Valid {
+				dstField.SetBool(s.Bool)
+			}
+		case "sql.NullInt64":
+			s := srcField.Interface().(sql.NullInt64)
+			if s.Valid {
+				dstField.SetInt(s.Int64)
+			}
+		case "json.RawMessage":
+			s := srcField.Interface().(json.RawMessage)
+			if len(s) == 0 {
+				continue
+			}
+			if err := json.Unmarshal(s, dstField.Addr().Interface()); err != nil {
+				return err
+			}
+		case "[]byte", "[]uint8":
+			s := srcField.Interface().([]byte)
+			if _, ok := fieldTags[NMAP_JSON]; !ok || len(s) == 0 {
+				continue
+			}
+			if err := json.Unmarshal(s, dstField.Addr().Interface()); err != nil {
+				return err
+			}
+		case "[]string":
+			if srcField.IsNil() {
+				continue
+			}
+			dstv := reflect.MakeSlice(dstField.Type(), srcField.Len(), srcField.Cap())
+			reflect.Copy(dstv, srcField)
+			dstField.Set(dstv)
+		}
+	}
+
+	return nil
+}
+
+func StructFields(s any) []any {
+	src := reflect.ValueOf(s)
+	toret := make([]any, 0)
+	typ := src.Elem().Type()
+
+	for i := 0; i < typ.NumField(); i++ {
+		f := typ.Field(i)
+		if f.PkgPath != "" { // skip unexported fields
+			continue
+		}
+
+		srcField := src.Elem().Field(i)
+		toret = append(toret, srcField.Addr().Interface())
+	}
+
+	return toret
+}
+
+func ConvertAllToSharedTypes[T any, T1 any](allsrc []T) ([]T1, error) {
+	toret := make([]T1, 0, len(allsrc))
+	for _, src := range allsrc {
+		var dst T1
+		err := FromSqlTypesToSharedTypes(
+			reflect.ValueOf(&src), reflect.ValueOf(&dst))
+		if err != nil {
+			return nil, err
+		}
+		toret = append(toret, dst)
+	}
+	return toret, nil
+}
diff --git a/management/internals/server/boot.go b/management/internals/server/boot.go
index 1c78af9d0..e466005fe 100644
--- a/management/internals/server/boot.go
+++ b/management/internals/server/boot.go
@@ -5,6 +5,7 @@ package server
 import (
 	"context"
 	"crypto/tls"
+	"errors"
 	"net/http"
 	"net/netip"
 	"slices"
@@ -20,17 +21,22 @@ import (
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/keepalive"
 
-	cachestore "github.com/eko/gocache/lib/v4/store"
-
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/formatter/hook"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
+	proxyactivity "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
+	proxyactivitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	networkmapdbfactory "github.com/netbirdio/netbird/management/internals/network_map_db/factory"
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
 	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbhttp "github.com/netbirdio/netbird/management/server/http"
@@ -39,10 +45,14 @@ import (
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	mgmtProto "github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 	"github.com/netbirdio/netbird/util/crypt"
 )
 
-const apiPrefix = "/api"
+const (
+	apiPrefix   = "/api"
+	apiV1Prefix = "/api/v1alpha1"
+)
 
 var (
 	kaep = keepalive.EnforcementPolicy{
@@ -70,8 +80,8 @@ func (s *BaseServer) Metrics() telemetry.AppMetrics {
 
 // CacheStore returns a shared cache store backed by Redis or in-memory depending on the environment.
 // All consumers should reuse this store to avoid creating multiple Redis connections.
-func (s *BaseServer) CacheStore() cachestore.StoreInterface {
-	return Create(s, func() cachestore.StoreInterface {
+func (s *BaseServer) CacheStore() nbcache.Store {
+	return Create(s, func() nbcache.Store {
 		cs, err := nbcache.NewStore(context.Background(), nbcache.DefaultStoreMaxTimeout, nbcache.DefaultStoreCleanupInterval, nbcache.DefaultStoreMaxConn)
 		if err != nil {
 			log.Fatalf("failed to create shared cache store: %v", err)
@@ -80,9 +90,20 @@ func (s *BaseServer) CacheStore() cachestore.StoreInterface {
 	})
 }
 
+// DBConn opens the database connection shared by the store and the domain repositories.
+func (s *BaseServer) DBConn() *db.Conn {
+	return Create(s, func() *db.Conn {
+		conn, err := store.OpenConn(context.Background(), s.Config.StoreConfig.Engine, s.Config.Datadir)
+		if err != nil {
+			log.Fatalf("failed to open database connection: %v", err)
+		}
+		return conn
+	})
+}
+
 func (s *BaseServer) Store() store.Store {
 	return Create(s, func() store.Store {
-		store, err := store.NewStore(context.Background(), s.Config.StoreConfig.Engine, s.Config.Datadir, s.Metrics(), false)
+		store, err := store.NewSqlStore(context.Background(), s.DBConn(), s.Metrics(), false)
 		if err != nil {
 			log.Fatalf("failed to create store: %v", err)
 		}
@@ -99,6 +120,27 @@ func (s *BaseServer) Store() store.Store {
 	})
 }
 
+// TODO dmitri: move all validation checks (e.g. config+env vars) from runtime to base server creation
+// this way we don't need to spread defensive checks throughout the codebase
+func (s *BaseServer) NetworkMapStore() *networkmapdb.NetworkMapDBStoreImpl {
+	return Create(s, func() *networkmapdb.NetworkMapDBStoreImpl {
+		store, err := networkmapdbfactory.NewNetworkMapDBStore(
+			context.Background(),
+			s.Config.StoreConfig.Engine,
+			s.Config.Datadir,
+			s.IntegratedValidator(),
+			s.SettingsManager(),
+		)
+		// networkmap db store supports postgres and sqlite backends only
+		// for other backends a fallback is used, so NotSupportedStoreEngineError
+		// is not a fatal error
+		if err != nil && !errors.Is(err, networkmapdbfactory.ErrNotSupportedStoreEngine) {
+			log.Fatalf("failed to create network map store: %v", err)
+		}
+		return store
+	})
+}
+
 func (s *BaseServer) EventStore() activity.Store {
 	return Create(s, func() activity.Store {
 		var err error
@@ -121,13 +163,31 @@ func (s *BaseServer) EventStore() activity.Store {
 }
 
 func (s *BaseServer) APIHandler() http.Handler {
-	return Create(s, func() http.Handler {
-		httpAPIHandler, err := nbhttp.NewAPIHandler(context.Background(), s.Router(), s.AccountManager(), s.NetworksManager(), s.ResourcesManager(), s.RoutesManager(), s.GroupsManager(), s.GeoLocationManager(), s.AuthManager(), s.Metrics(), s.PermissionsManager(), s.SettingsManager(), s.ZonesManager(), s.RecordsManager(), s.NetworkMapController(), s.IdpManager(), s.ServiceManager(), s.ReverseProxyDomainManager(), s.AccessLogsManager(), s.ReverseProxyGRPCServer(), s.Config.ReverseProxy.TrustedHTTPProxies, s.RateLimiter(), s.IsValidChildAccount, s.AgentNetworkManager())
+	_ = CreateNamed(s, "http_v1api", func() http.Handler {
+		apiv1Router := s.ApiV1Router()
+		_, err := v1alpha1.NewAPIV1Handler(context.Background(), apiv1Router, s.AccountManager(), s.PeersManager(), s.NetworkMapController(), s.PermissionsManager())
 		if err != nil {
 			log.Fatalf("failed to create API handler: %v", err)
 		}
-		return httpAPIHandler
+
+		return apiv1Router
 	})
+
+	_ = CreateNamed(s, "http_v0api", func() http.Handler {
+		apiRouter := s.ApiRouter()
+		_, err := nbhttp.NewAPIHandler(
+			context.Background(), apiRouter, s.AccountManager(), s.NetworksManager(), s.ResourcesManager(), s.RoutesManager(),
+			s.GroupsManager(), s.GeoLocationManager(), s.PermissionsManager(), s.SettingsManager(), s.ZonesManager(),
+			s.RecordsManager(), s.NetworkMapController(), s.IdpManager(), s.ServiceManager(), s.ReverseProxyDomainManager(),
+			s.AccessLogsManager(), s.ReverseProxyGRPCServer(), s.Config.ReverseProxy.TrustedHTTPProxies,
+			s.AgentNetworkManager(), nil)
+		if err != nil {
+			log.Fatalf("failed to create API handler: %v", err)
+		}
+		return apiRouter
+	})
+
+	return s.Router()
 }
 
 // IDPHandler returns the HTTP handler for the embedded IdP (Dex), or nil if
@@ -140,16 +200,35 @@ func (s *BaseServer) IDPHandler() http.Handler {
 	return cors.AllowAll().Handler(embeddedIdP.Handler())
 }
 
+// Router returns the root HTTP router with the shared API middleware applied.
 func (s *BaseServer) Router() *mux.Router {
 	return Create(s, func() *mux.Router {
-		return mux.NewRouter().PathPrefix(apiPrefix).Subrouter()
+		router := mux.NewRouter()
+		router.Use(middleware.BuildMiddleware(s.RateLimiter(), s.AuthManager(), s.AccountManager(), s.Metrics())...)
+		return router
 	})
 }
 
-func (s *BaseServer) RateLimiter() *middleware.APIRateLimiter {
-	return Create(s, func() *middleware.APIRateLimiter {
-		cfg, enabled := middleware.RateLimiterConfigFromEnv()
-		limiter := middleware.NewAPIRateLimiter(cfg)
+// ApiV1Router returns the subrouter for the versioned API under apiV1Prefix.
+func (s *BaseServer) ApiV1Router() *mux.Router {
+	return CreateNamed(s, "apiv1_router", func() *mux.Router {
+		return s.Router().PathPrefix(apiV1Prefix).Subrouter()
+	})
+}
+
+// ApiRouter returns the subrouter for the unversioned API under apiPrefix.
+func (s *BaseServer) ApiRouter() *mux.Router {
+	return CreateNamed(s, "apiv0_router", func() *mux.Router {
+		// The nested versioned prefix must be registered before the broader apiPrefix.
+		s.ApiV1Router()
+		return s.Router().PathPrefix(apiPrefix).Subrouter()
+	})
+}
+
+func (s *BaseServer) RateLimiter() *ratelimit.APIRateLimiter {
+	return Create(s, func() *ratelimit.APIRateLimiter {
+		cfg, enabled := ratelimit.RateLimiterConfigFromEnv()
+		limiter := ratelimit.NewAPIRateLimiter(cfg)
 		limiter.SetEnabled(enabled)
 		return limiter
 	})
@@ -157,24 +236,7 @@ func (s *BaseServer) RateLimiter() *middleware.APIRateLimiter {
 
 func (s *BaseServer) GRPCServer() *grpc.Server {
 	return Create(s, func() *grpc.Server {
-		trustedPeers := s.Config.ReverseProxy.TrustedPeers
-		defaultTrustedPeers := []netip.Prefix{netip.MustParsePrefix("0.0.0.0/0"), netip.MustParsePrefix("::/0")}
-		if len(trustedPeers) == 0 || slices.Equal[[]netip.Prefix](trustedPeers, defaultTrustedPeers) {
-			log.WithContext(context.Background()).Warn("TrustedPeers are configured to default value '0.0.0.0/0', '::/0'. This allows connection IP spoofing.")
-			trustedPeers = defaultTrustedPeers
-		}
-		trustedHTTPProxies := s.Config.ReverseProxy.TrustedHTTPProxies
-		trustedProxiesCount := s.Config.ReverseProxy.TrustedHTTPProxiesCount
-		if len(trustedHTTPProxies) > 0 && trustedProxiesCount > 0 {
-			log.WithContext(context.Background()).Warn("TrustedHTTPProxies and TrustedHTTPProxiesCount both are configured. " +
-				"This is not recommended way to extract X-Forwarded-For. Consider using one of these options.")
-		}
-		realipOpts := []realip.Option{
-			realip.WithTrustedPeers(trustedPeers),
-			realip.WithTrustedProxies(trustedHTTPProxies),
-			realip.WithTrustedProxiesCount(trustedProxiesCount),
-			realip.WithHeaders([]string{realip.XForwardedFor, realip.XRealIp}),
-		}
+		realipOpts := realIPOptions(s.Config.ReverseProxy)
 		proxyUnary, proxyStream, proxyAuthClose := nbgrpc.NewProxyAuthInterceptors(s.Store())
 		s.proxyAuthClose = proxyAuthClose
 		gRPCOpts := []grpc.ServerOption{
@@ -184,6 +246,10 @@ func (s *BaseServer) GRPCServer() *grpc.Server {
 			grpc.ChainStreamInterceptor(realip.StreamServerInterceptorOpts(realipOpts...), streamInterceptor, proxyStream),
 		}
 
+		// Append interceptors contributed by registered gRPC extensions. These
+		// run after the built-in chain (ChainUnaryInterceptor is additive).
+		gRPCOpts = appendExtensionInterceptors(gRPCOpts, s.grpcExtensions)
+
 		if s.Config.HttpConfig.LetsEncryptDomain != "" {
 			certManager, err := encryption.CreateCertManager(s.Config.Datadir, s.Config.HttpConfig.LetsEncryptDomain)
 			if err != nil {
@@ -215,15 +281,19 @@ func (s *BaseServer) GRPCServer() *grpc.Server {
 		mgmtProto.RegisterProxyServiceServer(gRPCAPIHandler, s.ReverseProxyGRPCServer())
 		log.Info("ProxyService registered on gRPC server")
 
+		// Register services contributed by external modules via the extension seam.
+		registerExtensions(gRPCAPIHandler, s.grpcExtensions)
+
 		return gRPCAPIHandler
 	})
 }
 
 func (s *BaseServer) ReverseProxyGRPCServer() *nbgrpc.ProxyServiceServer {
 	return Create(s, func() *nbgrpc.ProxyServiceServer {
-		proxyService := nbgrpc.NewProxyServiceServer(s.AccessLogsManager(), s.ProxyTokenStore(), s.PKCEVerifierStore(), s.proxyOIDCConfig(), s.PeersManager(), s.UsersManager(), s.IdpManager(), s.ProxyManager(), s.Store())
+		proxyService := nbgrpc.NewProxyServiceServer(s.AccessLogsManager(), s.ProxyTokenStore(), s.SingleUseStore(), s.proxyOIDCConfig(), s.PeersManager(), s.UsersManager(), s.IdpManager(), s.ProxyManager(), s.Store())
 		s.AfterInit(func(s *BaseServer) {
 			proxyService.SetServiceManager(s.ServiceManager())
+			proxyService.SetActivityManager(s.ProxyActivityManager())
 			proxyService.SetProxyController(s.ServiceProxyController())
 			proxyService.SetAgentNetworkSynthesizer(newAgentNetworkSynthesizer(s.Store()))
 			proxyService.SetAgentNetworkLimitsService(s.AgentNetworkManager())
@@ -277,15 +347,22 @@ func (s *BaseServer) ProxyTokenStore() *nbgrpc.OneTimeTokenStore {
 	})
 }
 
-func (s *BaseServer) PKCEVerifierStore() *nbgrpc.PKCEVerifierStore {
-	return Create(s, func() *nbgrpc.PKCEVerifierStore {
-		return nbgrpc.NewPKCEVerifierStore(context.Background(), s.CacheStore())
+func (s *BaseServer) SingleUseStore() *nbgrpc.SingleUseStore {
+	return Create(s, func() *nbgrpc.SingleUseStore {
+		return nbgrpc.NewSingleUseStore(context.Background(), s.CacheStore())
+	})
+}
+
+// ProxyActivityManager records reverse proxy usage for activity accounting.
+func (s *BaseServer) ProxyActivityManager() proxyactivity.Manager {
+	return Create(s, func() proxyactivity.Manager {
+		return proxyactivitymanager.NewManager(s.Store())
 	})
 }
 
 func (s *BaseServer) AccessLogsManager() accesslogs.Manager {
 	return Create(s, func() accesslogs.Manager {
-		accessLogManager := accesslogsmanager.NewManager(s.Store(), s.PermissionsManager(), s.GeoLocationManager())
+		accessLogManager := accesslogsmanager.NewManager(accesslogsmanager.NewRepository(s.DBConn()), s.Store(), s.PermissionsManager(), s.GeoLocationManager())
 		accessLogManager.StartPeriodicCleanup(
 			context.Background(),
 			s.Config.ReverseProxy.AccessLogRetentionDays,
@@ -295,7 +372,7 @@ func (s *BaseServer) AccessLogsManager() accesslogs.Manager {
 	})
 }
 
-func loadTLSConfig(certFile string, certKey string) (*tls.Config, error) {
+func loadTLSConfig(certFile, certKey string) (*tls.Config, error) {
 	// Load server's certificate and private key
 	serverCert, err := tls.LoadX509KeyPair(certFile, certKey)
 	if err != nil {
@@ -342,3 +419,37 @@ func streamInterceptor(
 	wrapped.WrappedContext = context.WithValue(ctx, nbContext.RequestIDKey, reqID)
 	return handler(srv, wrapped)
 }
+
+// realIPOptions builds the real-IP middleware options.
+//
+// Empty TrustedPeers trusts all IPv4 and IPv6 sources. Configure TrustedPeers
+// with the reverse proxy address or network.
+//
+// X-Forwarded-For takes precedence over X-Real-IP.
+func realIPOptions(cfg nbconfig.ReverseProxy) []realip.Option {
+	trustedPeers := cfg.TrustedPeers
+	if len(trustedPeers) == 0 {
+		trustedPeers = []netip.Prefix{
+			netip.MustParsePrefix("0.0.0.0/0"),
+			netip.MustParsePrefix("::/0"),
+		}
+	}
+	if idx := slices.IndexFunc(trustedPeers, func(p netip.Prefix) bool { return p.Bits() == 0 }); idx >= 0 {
+		log.WithContext(context.Background()).Warnf("TrustedPeers contains the default route %s, which trusts "+
+			"X-Forwarded-For from every client and allows connection IP spoofing. Set TrustedPeers to the address "+
+			"of your reverse proxy.", trustedPeers[idx])
+	}
+	if cfg.TrustedHTTPProxiesCount > 0 {
+		log.WithContext(context.Background()).Warn(
+			"TrustedHTTPProxiesCount skips X-Forwarded-For entries by position before TrustedHTTPProxies filters by address. " +
+				"An incorrect count may skip the real client IP and produce an incorrect source address.",
+		)
+	}
+
+	return []realip.Option{
+		realip.WithTrustedPeers(trustedPeers),
+		realip.WithTrustedProxies(cfg.TrustedHTTPProxies),
+		realip.WithTrustedProxiesCount(cfg.TrustedHTTPProxiesCount),
+		realip.WithHeaders([]string{realip.XForwardedFor, realip.XRealIp}),
+	}
+}
diff --git a/management/internals/server/config/config.go b/management/internals/server/config/config.go
index fb9c842b7..dc60ed822 100644
--- a/management/internals/server/config/config.go
+++ b/management/internals/server/config/config.go
@@ -55,12 +55,18 @@ type Config struct {
 
 	ReverseProxy ReverseProxy
 
+	AgentNetwork AgentNetwork
+
 	// disable default all-to-all policy
 	DisableDefaultPolicy bool
 
 	// EmbeddedIdP contains configuration for the embedded Dex OIDC provider.
 	// When set, Dex will be embedded in the management server and serve requests at /oauth2/
 	EmbeddedIdP *idp.EmbeddedIdPConfig
+
+	HighestSupportedSyncMessageVersion *int
+
+	PerAccountHighestSupportedSyncMessageVersion map[string]int
 }
 
 // GetAuthAudiences returns the audience from the http config and device authorization flow config
@@ -181,6 +187,25 @@ type StoreConfig struct {
 	Engine types.Engine
 }
 
+// AgentNetwork contains agent-network (LLM gateway) configuration.
+type AgentNetwork struct {
+	// PricingDefaultsFile is the path to the YAML file holding the default
+	// LLM pricing table (defaults_llm_pricing.yaml). A relative path is
+	// resolved against <Datadir>, so a bare filename lands alongside the
+	// store. Empty falls back to probing <Datadir>/defaults_llm_pricing.yaml;
+	// with no file present the compiled-in defaults serve. Schema: surface ("openai"/"anthropic"/
+	// "bedrock") -> model -> rates in USD per 1k tokens (input_per_1k,
+	// output_per_1k, and the optional cached_input_per_1k /
+	// cache_read_per_1k / cache_creation_per_1k). File entries replace the
+	// compiled-in entry for the same surface+model whole; everything else
+	// keeps the compiled-in rates. The file is re-read periodically (mtime
+	// poll), and the live table feeds both the synthesizer (what proxies
+	// bill with) and the dashboard's catalog endpoint (what model rows
+	// prefill with). An explicitly configured path that fails to load
+	// fails startup; runtime reload errors keep the previous table.
+	PricingDefaultsFile string
+}
+
 // ReverseProxy contains reverse proxy configuration in front of management.
 type ReverseProxy struct {
 	// TrustedHTTPProxies represents a list of trusted HTTP proxies by their IP prefixes.
diff --git a/management/internals/server/controllers.go b/management/internals/server/controllers.go
index 1b2556809..d9c8ee9d8 100644
--- a/management/internals/server/controllers.go
+++ b/management/internals/server/controllers.go
@@ -5,8 +5,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/management-integrations/integrations"
-
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
 
@@ -20,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/auth"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
 )
@@ -52,12 +49,6 @@ func (s *BaseServer) IntegratedValidator() integrated_validator.IntegratedValida
 	})
 }
 
-func (s *BaseServer) ProxyController() port_forwarding.Controller {
-	return Create(s, func() port_forwarding.Controller {
-		return integrations.NewController(s.Store())
-	})
-}
-
 func (s *BaseServer) SecretsManager() grpc.SecretsManager {
 	return Create(s, func() grpc.SecretsManager {
 		secretsManager, err := grpc.NewTimeBasedAuthSecretsManager(s.PeersUpdateManager(), s.Config.TURNConfig, s.Config.Relay, s.SettingsManager(), s.GroupsManager())
@@ -123,7 +114,7 @@ func (s *BaseServer) EphemeralManager() ephemeral.Manager {
 
 func (s *BaseServer) NetworkMapController() network_map.Controller {
 	return Create(s, func() network_map.Controller {
-		return nmapcontroller.NewController(context.Background(), s.Store(), s.Metrics(), s.PeersUpdateManager(), s.AccountRequestBuffer(), s.IntegratedValidator(), s.SettingsManager(), s.DNSDomain(), s.ProxyController(), s.EphemeralManager(), s.Config)
+		return nmapcontroller.NewController(context.Background(), s.Store(), s.Metrics(), s.PeersUpdateManager(), s.AccountRequestBuffer(), s.IntegratedValidator(), s.SettingsManager(), s.DNSDomain(), s.EphemeralManager(), s.Config, s.NetworkMapStore())
 	})
 }
 
diff --git a/management/internals/server/grpc_extension.go b/management/internals/server/grpc_extension.go
new file mode 100644
index 000000000..3f257c75e
--- /dev/null
+++ b/management/internals/server/grpc_extension.go
@@ -0,0 +1,74 @@
+package server
+
+import (
+	"context"
+
+	"google.golang.org/grpc"
+)
+
+// GRPCExtension bundles an external module's contribution to the management
+// gRPC server: the registration of one or more services onto the shared
+// grpc.Server, any server-wide interceptors those services require, and an
+// optional shutdown hook. It is a generic extension point with no knowledge of
+// any specific service.
+type GRPCExtension struct {
+	// Register is invoked with the shared grpc.Server (as a ServiceRegistrar)
+	// after the built-in services are registered. It may register any number of
+	// services. May be nil.
+	Register func(grpc.ServiceRegistrar)
+	// UnaryInterceptors are appended to the server's unary interceptor chain,
+	// running after the built-in interceptors. May be empty.
+	UnaryInterceptors []grpc.UnaryServerInterceptor
+	// StreamInterceptors are appended to the server's stream interceptor chain,
+	// running after the built-in interceptors. May be empty.
+	StreamInterceptors []grpc.StreamServerInterceptor
+	// Shutdown, if non-nil, is called once during Stop() with the context
+	// governing server shutdown, which carries a deadline. The hook MUST
+	// return promptly and MUST abandon its work once that context is
+	// cancelled or expires: it runs before the rest of Stop()'s cleanup
+	// (store, event store, embedded IdP) and before Stop() itself checks the
+	// context's deadline, so a hook that ignores the context will delay all
+	// of that cleanup and prevent Stop() from returning on time. May be nil.
+	Shutdown func(ctx context.Context)
+}
+
+// RegisterGRPCExtension registers a gRPC extension. Call before the gRPC server
+// is first built (i.e. before Start); registrations after that have no effect.
+func (s *BaseServer) RegisterGRPCExtension(ext GRPCExtension) {
+	s.grpcExtensions = append(s.grpcExtensions, ext)
+}
+
+// appendExtensionInterceptors appends each extension's interceptors to the gRPC
+// server options as additional chained interceptors. grpc.ChainUnaryInterceptor
+// and grpc.ChainStreamInterceptor are additive, so the returned options run the
+// extension interceptors after any interceptors already present in opts.
+func appendExtensionInterceptors(opts []grpc.ServerOption, exts []GRPCExtension) []grpc.ServerOption {
+	for _, ext := range exts {
+		if len(ext.UnaryInterceptors) > 0 {
+			opts = append(opts, grpc.ChainUnaryInterceptor(ext.UnaryInterceptors...))
+		}
+		if len(ext.StreamInterceptors) > 0 {
+			opts = append(opts, grpc.ChainStreamInterceptor(ext.StreamInterceptors...))
+		}
+	}
+	return opts
+}
+
+// registerExtensions registers each extension's services onto reg.
+func registerExtensions(reg grpc.ServiceRegistrar, exts []GRPCExtension) {
+	for _, ext := range exts {
+		if ext.Register != nil {
+			ext.Register(reg)
+		}
+	}
+}
+
+// runExtensionShutdownHooks calls each extension's shutdown hook, if set,
+// passing ctx through so hooks can honor its deadline/cancellation.
+func runExtensionShutdownHooks(ctx context.Context, exts []GRPCExtension) {
+	for _, ext := range exts {
+		if ext.Shutdown != nil {
+			ext.Shutdown(ctx)
+		}
+	}
+}
diff --git a/management/internals/server/grpc_extension_test.go b/management/internals/server/grpc_extension_test.go
new file mode 100644
index 000000000..8f444ca72
--- /dev/null
+++ b/management/internals/server/grpc_extension_test.go
@@ -0,0 +1,160 @@
+package server
+
+import (
+	"context"
+	"net"
+	"sync/atomic"
+	"testing"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/health"
+	healthgrpc "google.golang.org/grpc/health/grpc_health_v1"
+	"google.golang.org/grpc/test/bufconn"
+)
+
+// Test that an extension's interceptors and service registration are actually
+// wired onto a real in-process gRPC server via the helpers, and that shutdown
+// hooks run. This validates the load-bearing assumption that
+// grpc.ChainUnaryInterceptor is additive (extension interceptors run in
+// addition to any base chain).
+func TestGRPCExtensionAppliedToServer(t *testing.T) {
+	var unaryCalls atomic.Int32
+	var streamShutdownCalled atomic.Bool
+
+	ext := GRPCExtension{
+		Register: func(reg grpc.ServiceRegistrar) {
+			healthgrpc.RegisterHealthServer(reg, health.NewServer())
+		},
+		UnaryInterceptors: []grpc.UnaryServerInterceptor{
+			func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+				unaryCalls.Add(1)
+				return handler(ctx, req)
+			},
+		},
+		Shutdown: func(ctx context.Context) { streamShutdownCalled.Store(true) },
+	}
+	exts := []GRPCExtension{ext}
+
+	// Base options mimic GRPCServer(): a pre-existing chain the extension appends to.
+	var baseUnaryCalls atomic.Int32
+	opts := []grpc.ServerOption{
+		grpc.ChainUnaryInterceptor(func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+			baseUnaryCalls.Add(1)
+			return handler(ctx, req)
+		}),
+	}
+	opts = appendExtensionInterceptors(opts, exts)
+
+	srv := grpc.NewServer(opts...)
+	registerExtensions(srv, exts)
+
+	lis := bufconn.Listen(1024 * 1024)
+	go func() { _ = srv.Serve(lis) }()
+	t.Cleanup(srv.Stop)
+
+	conn, err := grpc.NewClient("passthrough:///bufnet",
+		grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) { return lis.DialContext(ctx) }),
+		grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+
+	_, err = healthgrpc.NewHealthClient(conn).Check(context.Background(), &healthgrpc.HealthCheckRequest{})
+	if err != nil {
+		t.Fatalf("health check via extension-registered service failed: %v", err)
+	}
+	if baseUnaryCalls.Load() != 1 {
+		t.Errorf("base interceptor calls = %d, want 1 (base chain must be preserved)", baseUnaryCalls.Load())
+	}
+	if unaryCalls.Load() != 1 {
+		t.Errorf("extension interceptor calls = %d, want 1", unaryCalls.Load())
+	}
+
+	runExtensionShutdownHooks(context.Background(), exts)
+	if !streamShutdownCalled.Load() {
+		t.Error("extension shutdown hook was not called")
+	}
+}
+
+// TestGRPCExtensionShutdownHookReceivesCallerContext asserts that each hook receives
+// a non-nil context and that it is the very same context the caller passed
+// in, so hooks can rely on values/deadlines placed on it by Stop().
+func TestGRPCExtensionShutdownHookReceivesCallerContext(t *testing.T) {
+	type sentinelKey struct{}
+	want := "shutdown-ctx-sentinel"
+	ctx := context.WithValue(context.Background(), sentinelKey{}, want)
+
+	var called bool
+	ext := GRPCExtension{
+		Shutdown: func(hookCtx context.Context) {
+			called = true
+			if hookCtx == nil {
+				t.Fatal("hook received a nil context")
+			}
+			got, _ := hookCtx.Value(sentinelKey{}).(string)
+			if got != want {
+				t.Errorf("hook context sentinel = %q, want %q (not the caller's context)", got, want)
+			}
+		},
+	}
+
+	runExtensionShutdownHooks(ctx, []GRPCExtension{ext})
+	if !called {
+		t.Fatal("shutdown hook was not called")
+	}
+}
+
+// TestGRPCExtensionShutdownHookObservesCancellation documents, by test, that
+// hooks can honor cancellation/deadlines: a hook given an already-cancelled
+// context must see ctx.Err() != nil and a closed Done() channel.
+func TestGRPCExtensionShutdownHookObservesCancellation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	var called bool
+	ext := GRPCExtension{
+		Shutdown: func(hookCtx context.Context) {
+			called = true
+			if hookCtx.Err() == nil {
+				t.Error("hook context Err() = nil, want non-nil for a cancelled context")
+			}
+			select {
+			case <-hookCtx.Done():
+			default:
+				t.Error("hook context Done() channel is not closed for a cancelled context")
+			}
+		},
+	}
+
+	runExtensionShutdownHooks(ctx, []GRPCExtension{ext})
+	if !called {
+		t.Fatal("shutdown hook was not called")
+	}
+}
+
+// TestGRPCExtensionShutdownHookNilSkipped asserts that an extension
+// with a nil Shutdown hook is skipped without panicking, and that hooks for
+// other extensions still run.
+func TestGRPCExtensionShutdownHookNilSkipped(t *testing.T) {
+	var called atomic.Bool
+	exts := []GRPCExtension{
+		{Shutdown: nil},
+		{Shutdown: func(context.Context) { called.Store(true) }},
+	}
+
+	runExtensionShutdownHooks(context.Background(), exts)
+	if !called.Load() {
+		t.Error("shutdown hook for non-nil extension was not called")
+	}
+}
+
+func TestRegisterGRPCExtensionAccumulates(t *testing.T) {
+	s := &BaseServer{}
+	s.RegisterGRPCExtension(GRPCExtension{})
+	s.RegisterGRPCExtension(GRPCExtension{})
+	if len(s.grpcExtensions) != 2 {
+		t.Fatalf("grpcExtensions len = %d, want 2", len(s.grpcExtensions))
+	}
+}
diff --git a/management/internals/server/modules.go b/management/internals/server/modules.go
index 6b1365f3b..3379becf6 100644
--- a/management/internals/server/modules.go
+++ b/management/internals/server/modules.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/netbirdio/management-integrations/integrations"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -20,7 +21,6 @@ import (
 	recordsManager "github.com/netbirdio/netbird/management/internals/modules/zones/records/manager"
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/account"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/idp"
@@ -96,13 +96,14 @@ func (s *BaseServer) PeersManager() peers.Manager {
 
 func (s *BaseServer) AccountManager() account.Manager {
 	return Create(s, func() account.Manager {
-		accountManager, err := server.BuildManager(context.Background(), s.Config, s.Store(), s.NetworkMapController(), s.JobManager(), s.IdpManager(), s.mgmtSingleAccModeDomain, s.EventStore(), s.GeoLocationManager(), s.userDeleteFromIDPEnabled, s.IntegratedValidator(), s.Metrics(), s.ProxyController(), s.SettingsManager(), s.PermissionsManager(), s.Config.DisableDefaultPolicy, s.CacheStore())
+		accountManager, err := server.BuildManager(context.Background(), s.Config, s.Store(), s.NetworkMapController(), s.JobManager(), s.IdpManager(), s.mgmtSingleAccModeDomain, s.EventStore(), s.GeoLocationManager(), s.userDeleteFromIDPEnabled, s.IntegratedValidator(), s.Metrics(), s.SettingsManager(), s.PermissionsManager(), s.Config.DisableDefaultPolicy, s.CacheStore())
 		if err != nil {
 			log.Fatalf("failed to create account service: %v", err)
 		}
 
 		s.AfterInit(func(s *BaseServer) {
 			accountManager.SetServiceManager(s.ServiceManager())
+			accountManager.AddAccountDeletionHook(s.AgentNetworkManager().RemoveAccountGateway)
 		})
 
 		return accountManager
@@ -247,7 +248,3 @@ func (s *BaseServer) ReverseProxyDomainManager() *manager.Manager {
 		return &m
 	})
 }
-
-func (s *BaseServer) IsValidChildAccount(_ context.Context, _, _, _ string) bool {
-	return false
-}
diff --git a/management/internals/server/realip_test.go b/management/internals/server/realip_test.go
new file mode 100644
index 000000000..ef6b3123d
--- /dev/null
+++ b/management/internals/server/realip_test.go
@@ -0,0 +1,179 @@
+package server
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/realip"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+)
+
+const (
+	realIPProbeMethod       = "/netbird.test.RealIPProbe/Probe"
+	realIPProbeStreamMethod = "/netbird.test.RealIPProbe/ProbeStream"
+)
+
+// realIPProbe records the real IP the middleware derived for each call.
+type realIPProbe struct {
+	got chan string
+}
+
+func (p *realIPProbe) record(ctx context.Context) {
+	addr, _ := realip.FromContext(ctx)
+	p.got <- addr.String()
+}
+
+func (p *realIPProbe) wait(t *testing.T) string {
+	t.Helper()
+
+	select {
+	case got := <-p.got:
+		return got
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for probe")
+		return ""
+	}
+}
+
+func startProbeServer(t *testing.T, cfg nbconfig.ReverseProxy) (*grpc.ClientConn, *realIPProbe) {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	probe := &realIPProbe{got: make(chan string, 1)}
+	opts := realIPOptions(cfg)
+	srv := grpc.NewServer(
+		grpc.ChainUnaryInterceptor(realip.UnaryServerInterceptorOpts(opts...)),
+		grpc.ChainStreamInterceptor(realip.StreamServerInterceptorOpts(opts...)),
+	)
+	srv.RegisterService(&grpc.ServiceDesc{
+		ServiceName: "netbird.test.RealIPProbe",
+		HandlerType: (*any)(nil),
+		Methods: []grpc.MethodDesc{{
+			MethodName: "Probe",
+			Handler: func(_ any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
+				req := new(emptypb.Empty)
+				if err := dec(req); err != nil {
+					return nil, err
+				}
+				handler := func(ctx context.Context, _ any) (any, error) {
+					probe.record(ctx)
+					return &emptypb.Empty{}, nil
+				}
+				if interceptor == nil {
+					return handler(ctx, req)
+				}
+				return interceptor(ctx, req, &grpc.UnaryServerInfo{FullMethod: realIPProbeMethod}, handler)
+			},
+		}},
+		Streams: []grpc.StreamDesc{{
+			StreamName:    "ProbeStream",
+			ServerStreams: true,
+			Handler: func(_ any, stream grpc.ServerStream) error {
+				probe.record(stream.Context())
+				return nil
+			},
+		}},
+	}, probe)
+
+	go func() { _ = srv.Serve(listener) }()
+	t.Cleanup(srv.Stop)
+
+	conn, err := grpc.NewClient(listener.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	return conn, probe
+}
+
+func callUnary(t *testing.T, conn *grpc.ClientConn, probe *realIPProbe, kv ...string) string {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ctx = metadata.AppendToOutgoingContext(ctx, kv...)
+	require.NoError(t, conn.Invoke(ctx, realIPProbeMethod, &emptypb.Empty{}, &emptypb.Empty{}))
+
+	return probe.wait(t)
+}
+
+func callStream(t *testing.T, conn *grpc.ClientConn, probe *realIPProbe, kv ...string) string {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ctx = metadata.AppendToOutgoingContext(ctx, kv...)
+	desc := &grpc.StreamDesc{StreamName: "ProbeStream", ServerStreams: true}
+	stream, err := conn.NewStream(ctx, desc, realIPProbeStreamMethod)
+	require.NoError(t, err)
+	require.NoError(t, stream.CloseSend())
+	require.ErrorIs(t, stream.RecvMsg(&emptypb.Empty{}), io.EOF)
+
+	return probe.wait(t)
+}
+
+func assertRealIP(t *testing.T, cfg nbconfig.ReverseProxy, want string, kv ...string) {
+	t.Helper()
+
+	conn, probe := startProbeServer(t, cfg)
+	t.Run("unary", func(t *testing.T) {
+		assert.Equal(t, want, callUnary(t, conn, probe, kv...))
+	})
+	t.Run("stream", func(t *testing.T) {
+		assert.Equal(t, want, callStream(t, conn, probe, kv...))
+	})
+}
+
+func TestRealIPDefaultTrustsForwardedHeaders(t *testing.T) {
+	assertRealIP(t, nbconfig.ReverseProxy{}, "203.0.113.44",
+		realip.XForwardedFor, "203.0.113.44",
+		realip.XRealIp, "203.0.113.44",
+	)
+}
+
+func TestRealIPUntrustedPeerIgnoresForwardedHeaders(t *testing.T) {
+	cfg := nbconfig.ReverseProxy{TrustedPeers: []netip.Prefix{netip.MustParsePrefix("10.9.8.7/32")}}
+
+	assertRealIP(t, cfg, "127.0.0.1",
+		realip.XForwardedFor, "203.0.113.44",
+		realip.XRealIp, "203.0.113.44",
+	)
+}
+
+func TestRealIPTrustedPeerHonoursForwardedHeaders(t *testing.T) {
+	cfg := nbconfig.ReverseProxy{TrustedPeers: []netip.Prefix{netip.MustParsePrefix("127.0.0.1/32")}}
+
+	assertRealIP(t, cfg, "203.0.113.44",
+		realip.XForwardedFor, "203.0.113.44",
+		realip.XRealIp, "203.0.113.44",
+	)
+}
+
+func TestRealIPReadsXRealIPWhenProxyCountSkipsForwardedFor(t *testing.T) {
+	cfg := nbconfig.ReverseProxy{
+		TrustedPeers:            []netip.Prefix{netip.MustParsePrefix("127.0.0.1/32")},
+		TrustedHTTPProxiesCount: 1,
+	}
+
+	t.Run("no X-Forwarded-For", func(t *testing.T) {
+		assertRealIP(t, cfg, "203.0.113.44", realip.XRealIp, "203.0.113.44")
+	})
+	t.Run("single-entry X-Forwarded-For", func(t *testing.T) {
+		assertRealIP(t, cfg, "198.51.100.7",
+			realip.XForwardedFor, "203.0.113.44",
+			realip.XRealIp, "198.51.100.7",
+		)
+	})
+}
diff --git a/management/internals/server/server.go b/management/internals/server/server.go
index 9411073ac..c95092d70 100644
--- a/management/internals/server/server.go
+++ b/management/internals/server/server.go
@@ -15,7 +15,7 @@ import (
 	"go.opentelemetry.io/otel/metric"
 	"golang.org/x/crypto/acme/autocert"
 	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c"
+	"golang.org/x/net/http2/h2c" //nolint:staticcheck
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/encryption"
@@ -23,6 +23,8 @@ import (
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/metrics"
 	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/lifecycle"
+	"github.com/netbirdio/netbird/shared/profiling"
 	"github.com/netbirdio/netbird/util/wsproxy"
 	wsproxyserver "github.com/netbirdio/netbird/util/wsproxy/server"
 	"github.com/netbirdio/netbird/version"
@@ -36,6 +38,8 @@ const (
 	DefaultSelfHostedDomain = "netbird.selfhosted"
 
 	ContainerKeyBaseServer = "baseServer"
+
+	applicationName = "management"
 )
 
 type Server interface {
@@ -64,17 +68,29 @@ type BaseServer struct {
 	mgmtMetricsPort             int
 	mgmtPort                    int
 	disableLegacyManagementPort bool
+	letsEncryptListenAddress    string
 	autoResolveDomains          bool
 
-	proxyAuthClose func()
+	proxyAuthClose    func()
+	domainCleanupStop func()
+
+	// grpcExtensions holds additional gRPC services, interceptors, and shutdown
+	// hooks registered by external modules via RegisterGRPCExtension. Populated
+	// during boot (single-threaded), consumed by GRPCServer() and Stop().
+	grpcExtensions []GRPCExtension
 
 	listener    net.Listener
+	tlsConfig   *tls.Config
 	certManager *autocert.Manager
 	update      *version.Update
+	// certListener serves Let's Encrypt challenges when mgmtPort is not 443.
+	certListener net.Listener
 
 	errCh  chan error
 	wg     sync.WaitGroup
 	cancel context.CancelFunc
+
+	lifecycle.StopHandlers
 }
 
 // Config holds the configuration parameters for creating a new server
@@ -89,6 +105,10 @@ type Config struct {
 	DisableGeoliteUpdate        bool
 	UserDeleteFromIDPEnabled    bool
 	AutoResolveDomains          bool
+	TLSConfig                   *tls.Config
+	// LetsEncryptListenAddress is the separate Let's Encrypt challenge listener
+	// used when MgmtPort is not 443. Empty disables it.
+	LetsEncryptListenAddress string
 }
 
 // NewServer initializes and configures a new Server instance
@@ -103,11 +123,16 @@ func NewServer(cfg *Config) *BaseServer {
 		userDeleteFromIDPEnabled:    cfg.UserDeleteFromIDPEnabled,
 		mgmtPort:                    cfg.MgmtPort,
 		disableLegacyManagementPort: cfg.DisableLegacyManagementPort,
+		letsEncryptListenAddress:    cfg.LetsEncryptListenAddress,
 		mgmtMetricsPort:             cfg.MgmtMetricsPort,
 		autoResolveDomains:          cfg.AutoResolveDomains,
+		tlsConfig:                   cfg.TLSConfig,
 	}
 	s.container[ContainerKeyBaseServer] = s
 
+	stopProfiling := profiling.Start(applicationName)
+	s.OnStop(stopProfiling)
+
 	return s
 }
 
@@ -117,6 +142,14 @@ func (s *BaseServer) AfterInit(fn func(s *BaseServer)) {
 
 // Start begins listening for HTTP requests on the configured address
 func (s *BaseServer) Start(ctx context.Context) error {
+	if err := s.start(ctx); err != nil {
+		s.RunStopHandlers()
+		return err
+	}
+	return nil
+}
+
+func (s *BaseServer) start(ctx context.Context) error {
 	srvCtx, cancel := context.WithCancel(ctx)
 	s.cancel = cancel
 	s.errCh = make(chan error, 4)
@@ -134,21 +167,9 @@ func (s *BaseServer) Start(ctx context.Context) error {
 	}
 	s.EphemeralManager().LoadInitialPeers(srvCtx)
 
-	var tlsConfig *tls.Config
-	tlsEnabled := false
-	if s.Config.HttpConfig.LetsEncryptDomain != "" {
-		s.certManager, err = encryption.CreateCertManager(s.Config.Datadir, s.Config.HttpConfig.LetsEncryptDomain)
-		if err != nil {
-			return fmt.Errorf("failed creating LetsEncrypt cert manager: %v", err)
-		}
-		tlsEnabled = true
-	} else if s.Config.HttpConfig.CertFile != "" && s.Config.HttpConfig.CertKey != "" {
-		tlsConfig, err = loadTLSConfig(s.Config.HttpConfig.CertFile, s.Config.HttpConfig.CertKey)
-		if err != nil {
-			log.WithContext(srvCtx).Errorf("cannot load TLS credentials: %v", err)
-			return err
-		}
-		tlsEnabled = true
+	tlsEnabled, err := s.setupTLS(srvCtx)
+	if err != nil {
+		return err
 	}
 
 	installationID, err := getInstallationID(srvCtx, s.Store())
@@ -196,22 +217,21 @@ func (s *BaseServer) Start(ctx context.Context) error {
 	rootHandler := s.handlerFunc(srvCtx, s.GRPCServer(), s.APIHandler(), s.IDPHandler(), s.Metrics().GetMeter())
 	switch {
 	case s.certManager != nil:
-		// a call to certManager.Listener() always creates a new listener so we do it once
-		cml := s.certManager.Listener()
 		if s.mgmtPort == 443 {
 			// CertManager, HTTP and gRPC API all on the same port
 			rootHandler = s.certManager.HTTPHandler(rootHandler)
-			s.listener = cml
+			s.listener = s.certManager.Listener()
 		} else {
 			s.listener, err = tls.Listen("tcp", fmt.Sprintf(":%d", s.mgmtPort), s.certManager.TLSConfig())
 			if err != nil {
 				return fmt.Errorf("failed creating TLS listener on port %d: %v", s.mgmtPort, err)
 			}
-			log.WithContext(ctx).Infof("running HTTP server (LetsEncrypt challenge handler): %s", cml.Addr().String())
-			s.serveHTTP(ctx, cml, s.certManager.HTTPHandler(nil))
+			if err := s.serveLetsEncryptChallenges(ctx); err != nil {
+				return err
+			}
 		}
-	case tlsConfig != nil:
-		s.listener, err = tls.Listen("tcp", fmt.Sprintf(":%d", s.mgmtPort), tlsConfig)
+	case s.tlsConfig != nil:
+		s.listener, err = tls.Listen("tcp", fmt.Sprintf(":%d", s.mgmtPort), s.tlsConfig)
 		if err != nil {
 			return fmt.Errorf("failed creating TLS listener on port %d: %v", s.mgmtPort, err)
 		}
@@ -231,14 +251,60 @@ func (s *BaseServer) Start(ctx context.Context) error {
 	s.update.SetOnUpdateListener(func() {
 		log.WithContext(ctx).Infof("your management version, \"%s\", is outdated, a new management version is available. Learn more here: https://github.com/netbirdio/netbird/releases", version.NetbirdVersion())
 	})
+	s.startDomainCleanup(srvCtx)
 
 	return nil
 }
+func (s *BaseServer) startDomainCleanup(ctx context.Context) {
+	if s.domainCleanupStop != nil {
+		return
+	}
+	mgr := s.ReverseProxyDomainManager()
+	ctx, cancel := context.WithCancel(ctx)
+	done := make(chan struct{})
+	s.domainCleanupStop = func() {
+		cancel()
+		<-done
+	}
+	go func() {
+		defer close(done)
+		mgr.RunValidationCleanup(ctx)
+	}()
+}
+
+// setupTLS resolves the listener's TLS source: an injected config wins over the HttpConfig certificate settings
+func (s *BaseServer) setupTLS(ctx context.Context) (bool, error) {
+	switch {
+	case s.tlsConfig != nil:
+		return true, nil
+	case s.Config.HttpConfig.LetsEncryptDomain != "":
+		certManager, err := encryption.CreateCertManager(s.Config.Datadir, s.Config.HttpConfig.LetsEncryptDomain)
+		if err != nil {
+			return false, fmt.Errorf("failed creating LetsEncrypt cert manager: %v", err)
+		}
+		s.certManager = certManager
+		return true, nil
+	case s.Config.HttpConfig.CertFile != "" && s.Config.HttpConfig.CertKey != "":
+		tlsConfig, err := loadTLSConfig(s.Config.HttpConfig.CertFile, s.Config.HttpConfig.CertKey)
+		if err != nil {
+			log.WithContext(ctx).Errorf("cannot load TLS credentials: %v", err)
+			return false, err
+		}
+		s.tlsConfig = tlsConfig
+		return true, nil
+	default:
+		return false, nil
+	}
+}
 
 // Stop attempts a graceful shutdown, waiting up to 5 seconds for active connections to finish
 func (s *BaseServer) Stop() error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
+	defer s.RunStopHandlers()
+	if s.domainCleanupStop != nil {
+		s.domainCleanupStop()
+	}
 
 	s.IntegratedValidator().Stop(ctx)
 	if s.GeoLocationManager() != nil {
@@ -249,14 +315,15 @@ func (s *BaseServer) Stop() error {
 	if s.listener != nil {
 		_ = s.listener.Close()
 	}
-	if s.certManager != nil {
-		_ = s.certManager.Listener().Close()
+	if s.certListener != nil {
+		_ = s.certListener.Close()
 	}
 	s.GRPCServer().Stop()
 	if s.proxyAuthClose != nil {
 		s.proxyAuthClose()
 		s.proxyAuthClose = nil
 	}
+	runExtensionShutdownHooks(ctx, s.grpcExtensions)
 	_ = s.Store().Close(ctx)
 	_ = s.EventStore().Close(ctx)
 	if s.update != nil {
@@ -268,7 +335,11 @@ func (s *BaseServer) Stop() error {
 	}
 
 	select {
-	case <-s.Errors():
+	case err := <-s.Errors():
+		if err != nil {
+			log.WithContext(ctx).Infof("stopped Management Service: %v", err)
+			return nil
+		}
 		log.WithContext(ctx).Infof("stopped Management Service")
 		return nil
 	case <-ctx.Done():
@@ -355,6 +426,26 @@ func (s *BaseServer) serveGRPC(ctx context.Context, grpcServer *grpc.Server, por
 	return listener, nil
 }
 
+// serveLetsEncryptChallenges starts the separate Let's Encrypt challenge listener
+// unless it is disabled. The main TLS listener uses the cert manager's TLS
+// config, so it still answers TLS-ALPN-01 challenges when public port 443 is
+// forwarded to it.
+func (s *BaseServer) serveLetsEncryptChallenges(ctx context.Context) error {
+	if s.letsEncryptListenAddress == "" {
+		log.WithContext(ctx).Infof("LetsEncrypt challenge server disabled, challenges are answered on port %d", s.mgmtPort)
+		return nil
+	}
+
+	cml, err := tls.Listen("tcp", s.letsEncryptListenAddress, s.certManager.TLSConfig())
+	if err != nil {
+		return fmt.Errorf("create LetsEncrypt challenge listener on %s: %w", s.letsEncryptListenAddress, err)
+	}
+	s.certListener = cml
+	log.WithContext(ctx).Infof("running HTTP server (LetsEncrypt challenge handler): %s", cml.Addr().String())
+	s.serveHTTP(ctx, cml, s.certManager.HTTPHandler(nil))
+	return nil
+}
+
 func (s *BaseServer) serveHTTP(ctx context.Context, httpListener net.Listener, handler http.Handler) {
 	s.wg.Add(1)
 	go func() {
@@ -382,6 +473,7 @@ func (s *BaseServer) serveGRPCWithHTTP(ctx context.Context, listener net.Listene
 			// the following magic is needed to support HTTP2 without TLS
 			// and still share a single port between gRPC and HTTP APIs
 			h1s := &http.Server{
+				//nolint:staticcheck // h2c also handles the HTTP/1 Upgrade mechanism, which http.Server's UnencryptedHTTP2 does not
 				Handler: h2c.NewHandler(handler, &http2.Server{}),
 			}
 			err = h1s.Serve(listener)
diff --git a/management/internals/server/server_letsencrypt_test.go b/management/internals/server/server_letsencrypt_test.go
new file mode 100644
index 000000000..0827d5e5d
--- /dev/null
+++ b/management/internals/server/server_letsencrypt_test.go
@@ -0,0 +1,55 @@
+package server
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/acme/autocert"
+
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+)
+
+func newLetsEncryptTestServer(address string) *BaseServer {
+	srv := NewServer(&Config{NbConfig: &nbconfig.Config{}, MgmtPort: 8443, LetsEncryptListenAddress: address})
+	srv.certManager = &autocert.Manager{}
+	return srv
+}
+
+func TestServeLetsEncryptChallenges_Disabled(t *testing.T) {
+	srv := newLetsEncryptTestServer("")
+
+	require.NoError(t, srv.serveLetsEncryptChallenges(context.Background()))
+	require.Nil(t, srv.certListener, "no challenge listener should be created when the address is empty")
+}
+
+func TestServeLetsEncryptChallenges_CustomAddress(t *testing.T) {
+	srv := newLetsEncryptTestServer("127.0.0.1:0")
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(func() {
+		cancel()
+		if srv.certListener != nil {
+			_ = srv.certListener.Close()
+		}
+		srv.wg.Wait()
+	})
+
+	require.NoError(t, srv.serveLetsEncryptChallenges(ctx))
+	require.NotNil(t, srv.certListener, "challenge listener should be created on the configured address")
+
+	conn, err := net.DialTimeout("tcp", srv.certListener.Addr().String(), time.Second)
+	require.NoError(t, err)
+	require.NoError(t, conn.Close())
+}
+
+func TestServeLetsEncryptChallenges_BindFailure(t *testing.T) {
+	occupied, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = occupied.Close() })
+	srv := newLetsEncryptTestServer(occupied.Addr().String())
+
+	require.Error(t, srv.serveLetsEncryptChallenges(context.Background()))
+	require.Nil(t, srv.certListener, "no challenge listener should be stored when the bind fails")
+}
diff --git a/management/internals/server/server_resolve_domains_test.go b/management/internals/server/server_resolve_domains_test.go
index ba9eb3f74..b34369655 100644
--- a/management/internals/server/server_resolve_domains_test.go
+++ b/management/internals/server/server_resolve_domains_test.go
@@ -5,7 +5,7 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/require"
 
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
diff --git a/management/internals/shared/db/conn.go b/management/internals/shared/db/conn.go
new file mode 100644
index 000000000..8edaa1e4e
--- /dev/null
+++ b/management/internals/shared/db/conn.go
@@ -0,0 +1,121 @@
+package db
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"runtime"
+	"strconv"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+)
+
+const (
+	defaultTransactionTimeout = 5 * time.Minute
+	connMaxLifetime           = time.Hour
+	connMaxIdleTime           = 3 * time.Minute
+)
+
+// TxMetrics receives the duration of every committed top-level transaction.
+type TxMetrics interface {
+	CountTransactionDuration(duration time.Duration)
+}
+
+// Conn is the database connection shared by all repositories: one gorm handle,
+// the pgx pool of a Postgres deployment and the engine they talk to.
+type Conn struct {
+	db        *gorm.DB
+	pool      *pgxpool.Pool
+	engine    Engine
+	txTimeout time.Duration
+	metrics   TxMetrics
+}
+
+// NewConn takes ownership of an open gorm handle and pool once it returns
+// without error, applying the connection limits and transaction timeout
+// configured through the environment.
+func NewConn(ctx context.Context, gormDB *gorm.DB, engine Engine, pool *pgxpool.Pool) (*Conn, error) {
+	sqlDB, err := gormDB.DB()
+	if err != nil {
+		return nil, err
+	}
+
+	txTimeout := defaultTransactionTimeout
+	if v := os.Getenv("NB_STORE_TRANSACTION_TIMEOUT"); v != "" {
+		if parsed, err := time.ParseDuration(v); err == nil {
+			txTimeout = parsed
+		}
+	}
+	log.WithContext(ctx).Infof("Setting transaction timeout to %v", txTimeout)
+
+	conns := runtime.NumCPU()
+	configuredConns, err := strconv.Atoi(os.Getenv("NB_SQL_MAX_OPEN_CONNS"))
+	connsConfigured := err == nil
+	if connsConfigured {
+		conns = configuredConns
+	}
+	if engine == SqliteStoreEngine {
+		if connsConfigured {
+			log.WithContext(ctx).Warnf("setting NB_SQL_MAX_OPEN_CONNS is not supported for sqlite, using default value 1")
+		}
+		conns = 1
+	}
+
+	sqlDB.SetMaxOpenConns(conns)
+	sqlDB.SetMaxIdleConns(conns)
+	sqlDB.SetConnMaxLifetime(connMaxLifetime)
+	sqlDB.SetConnMaxIdleTime(connMaxIdleTime)
+
+	log.WithContext(ctx).Infof("Set max open db connections to %d, max idle to %d, max lifetime to %v, max idle time to %v",
+		conns, conns, connMaxLifetime, connMaxIdleTime)
+
+	return &Conn{db: gormDB, pool: pool, engine: engine, txTimeout: txTimeout}, nil
+}
+
+// DB returns the handle a query must run on: the transaction when tx is set,
+// otherwise the shared connection.
+func (c *Conn) DB(tx *Tx) *gorm.DB {
+	if tx != nil {
+		return tx.db
+	}
+	return c.db
+}
+
+// Pool returns the pgx pool for read paths that bypass gorm. It is nil on
+// engines other than Postgres and inside a transaction, where the pool would
+// not see the uncommitted writes.
+func (c *Conn) Pool(tx *Tx) *pgxpool.Pool {
+	if tx != nil {
+		return nil
+	}
+	return c.pool
+}
+
+func (c *Conn) Engine() Engine {
+	return c.engine
+}
+
+// SetTxMetrics registers the sink that receives transaction durations.
+func (c *Conn) SetTxMetrics(metrics TxMetrics) {
+	c.metrics = metrics
+}
+
+// AutoMigrate creates or updates the tables of the given models.
+func (c *Conn) AutoMigrate(models ...any) error {
+	return c.db.AutoMigrate(models...)
+}
+
+// Close releases the gorm connection and the pgx pool.
+func (c *Conn) Close() error {
+	if c.pool != nil {
+		c.pool.Close()
+	}
+	sqlDB, err := c.db.DB()
+	if err != nil {
+		return fmt.Errorf("get db: %w", err)
+	}
+	return sqlDB.Close()
+}
diff --git a/management/internals/shared/db/conn_test.go b/management/internals/shared/db/conn_test.go
new file mode 100644
index 000000000..4f1a234b2
--- /dev/null
+++ b/management/internals/shared/db/conn_test.go
@@ -0,0 +1,148 @@
+package db
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+type testRow struct {
+	ID   uint `gorm:"primaryKey"`
+	Name string
+}
+
+func openTestConn(t *testing.T) *Conn {
+	t.Helper()
+	conn, err := OpenSqliteFile(context.Background(), t.TempDir(), SqliteFileName)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, conn.Close()) })
+	require.NoError(t, conn.AutoMigrate(&testRow{}))
+	return conn
+}
+
+func countRows(t *testing.T, conn *Conn) int64 {
+	t.Helper()
+	var count int64
+	require.NoError(t, conn.DB(nil).Model(&testRow{}).Count(&count).Error)
+	return count
+}
+
+func TestNewConn_ReadsTransactionTimeoutFromEnv(t *testing.T) {
+	t.Setenv("NB_STORE_TRANSACTION_TIMEOUT", "1s")
+	conn := openTestConn(t)
+	assert.Equal(t, time.Second, conn.txTimeout)
+	assert.Equal(t, SqliteStoreEngine, conn.Engine())
+}
+
+func TestRunInTx_CommitsOnSuccess(t *testing.T) {
+	conn := openTestConn(t)
+
+	err := conn.RunInTx(context.Background(), func(tx *Tx) error {
+		return conn.DB(tx).Create(&testRow{Name: "a"}).Error
+	})
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, countRows(t, conn))
+}
+
+func TestRunInTx_RollsBackOnError(t *testing.T) {
+	conn := openTestConn(t)
+	failure := errors.New("boom")
+
+	err := conn.RunInTx(context.Background(), func(tx *Tx) error {
+		require.NoError(t, conn.DB(tx).Create(&testRow{Name: "a"}).Error)
+		return failure
+	})
+	require.ErrorIs(t, err, failure)
+	assert.EqualValues(t, 0, countRows(t, conn))
+}
+
+func TestRunInTx_RollsBackOnPanic(t *testing.T) {
+	conn := openTestConn(t)
+
+	require.Panics(t, func() {
+		_ = conn.RunInTx(context.Background(), func(tx *Tx) error {
+			require.NoError(t, conn.DB(tx).Create(&testRow{Name: "a"}).Error)
+			panic("boom")
+		})
+	})
+	assert.EqualValues(t, 0, countRows(t, conn))
+}
+
+func TestRunInTx_FailsWhenTimeoutExceeded(t *testing.T) {
+	t.Setenv("NB_STORE_TRANSACTION_TIMEOUT", "50ms")
+	conn := openTestConn(t)
+
+	err := conn.RunInTx(context.Background(), func(tx *Tx) error {
+		time.Sleep(100 * time.Millisecond)
+		return conn.DB(tx).Create(&testRow{Name: "a"}).Error
+	})
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.EqualValues(t, 0, countRows(t, conn))
+}
+
+func TestRunInTx_ReportsDurationToMetrics(t *testing.T) {
+	conn := openTestConn(t)
+	metrics := &recordingMetrics{}
+	conn.SetTxMetrics(metrics)
+
+	require.NoError(t, conn.RunInTx(context.Background(), func(*Tx) error { return nil }))
+	assert.Equal(t, 1, metrics.calls)
+}
+
+func TestConn_DBSelectsTransactionHandle(t *testing.T) {
+	conn := openTestConn(t)
+	assert.Same(t, conn.db, conn.DB(nil))
+
+	err := conn.RunInTx(context.Background(), func(tx *Tx) error {
+		assert.Same(t, tx.db, conn.DB(tx))
+		assert.NotSame(t, conn.db, conn.DB(tx))
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestConn_PoolIsUnavailableInsideTransaction(t *testing.T) {
+	conn := openTestConn(t)
+	conn.pool = &pgxpool.Pool{}
+	defer func() { conn.pool = nil }()
+
+	assert.Same(t, conn.pool, conn.Pool(nil))
+	err := conn.RunInTx(context.Background(), func(tx *Tx) error {
+		assert.Nil(t, conn.Pool(tx))
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+type recordingMetrics struct {
+	calls int
+}
+
+func (m *recordingMetrics) CountTransactionDuration(time.Duration) {
+	m.calls++
+}
+
+func TestNewConn_MaxOpenConnsFromEnv(t *testing.T) {
+	t.Setenv("NB_SQL_MAX_OPEN_CONNS", "7")
+
+	gormDB, err := gorm.Open(sqlite.Open(filepath.Join(t.TempDir(), "store.db")), GormConfig())
+	require.NoError(t, err)
+	conn, err := NewConn(context.Background(), gormDB, PostgresStoreEngine, nil)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	sqlDB, err := conn.DB(nil).DB()
+	require.NoError(t, err)
+	assert.Equal(t, 7, sqlDB.Stats().MaxOpenConnections)
+
+	sqliteDB, err := openTestConn(t).DB(nil).DB()
+	require.NoError(t, err)
+	assert.Equal(t, 1, sqliteDB.Stats().MaxOpenConnections)
+}
diff --git a/management/internals/shared/db/dbtest/dbtest.go b/management/internals/shared/db/dbtest/dbtest.go
new file mode 100644
index 000000000..0f0fe0356
--- /dev/null
+++ b/management/internals/shared/db/dbtest/dbtest.go
@@ -0,0 +1,23 @@
+package dbtest
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+)
+
+// NewConn opens a fresh SQLite database in a temporary directory, migrates the
+// given models and closes the connection when the test ends. It ignores
+// NB_STORE_ENGINE_SQLITE_FILE, so a developer's configured database is never
+// touched, and is safe to call from parallel tests.
+func NewConn(t testing.TB, models ...any) *db.Conn {
+	t.Helper()
+	conn, err := db.OpenSqliteFile(context.Background(), t.TempDir(), db.SqliteFileName)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	require.NoError(t, conn.AutoMigrate(models...))
+	return conn
+}
diff --git a/management/internals/shared/db/dbtest/dbtest_test.go b/management/internals/shared/db/dbtest/dbtest_test.go
new file mode 100644
index 000000000..3f8566876
--- /dev/null
+++ b/management/internals/shared/db/dbtest/dbtest_test.go
@@ -0,0 +1,31 @@
+package dbtest
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+)
+
+func TestNewConn_IgnoresSqliteFileOverride(t *testing.T) {
+	override := filepath.Join(t.TempDir(), "configured.db")
+	t.Setenv("NB_STORE_ENGINE_SQLITE_FILE", override)
+
+	conn := NewConn(t)
+
+	assert.Equal(t, db.SqliteStoreEngine, conn.Engine())
+	_, err := os.Stat(override)
+	require.ErrorIs(t, err, os.ErrNotExist)
+}
+
+func TestNewConn_Parallel(t *testing.T) {
+	t.Parallel()
+
+	conn := NewConn(t)
+
+	assert.Equal(t, db.SqliteStoreEngine, conn.Engine())
+}
diff --git a/management/internals/shared/db/engine.go b/management/internals/shared/db/engine.go
new file mode 100644
index 000000000..02a3f5570
--- /dev/null
+++ b/management/internals/shared/db/engine.go
@@ -0,0 +1,10 @@
+package db
+
+// Engine identifies the SQL engine behind a Conn.
+type Engine string
+
+const (
+	SqliteStoreEngine   Engine = "sqlite"
+	PostgresStoreEngine Engine = "postgres"
+	MysqlStoreEngine    Engine = "mysql"
+)
diff --git a/management/internals/shared/db/lock.go b/management/internals/shared/db/lock.go
new file mode 100644
index 000000000..bf6fc9b5a
--- /dev/null
+++ b/management/internals/shared/db/lock.go
@@ -0,0 +1,12 @@
+package db
+
+// LockingStrength is the row lock a query holds until its transaction ends.
+type LockingStrength string
+
+const (
+	LockingStrengthUpdate      LockingStrength = "UPDATE"
+	LockingStrengthShare       LockingStrength = "SHARE"
+	LockingStrengthNoKeyUpdate LockingStrength = "NO KEY UPDATE"
+	LockingStrengthKeyShare    LockingStrength = "KEY SHARE"
+	LockingStrengthNone        LockingStrength = "NONE"
+)
diff --git a/management/internals/shared/db/open.go b/management/internals/shared/db/open.go
new file mode 100644
index 000000000..48a7bf330
--- /dev/null
+++ b/management/internals/shared/db/open.go
@@ -0,0 +1,176 @@
+package db
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	"gorm.io/driver/mysql"
+	"gorm.io/driver/postgres"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+// SqliteFileName is the default SQLite database file inside the data directory.
+const SqliteFileName = "store.db"
+
+// PoolConfig sizes the pgx pool a Postgres deployment uses for the read paths
+// that bypass gorm.
+type PoolConfig struct {
+	MaxConns          int32
+	MinConns          int32
+	MaxConnLifetime   time.Duration
+	HealthCheckPeriod time.Duration
+}
+
+var DefaultPoolConfig = PoolConfig{
+	MaxConns:          30,
+	MinConns:          1,
+	MaxConnLifetime:   60 * time.Minute,
+	HealthCheckPeriod: time.Minute,
+}
+
+// GormConfig is the configuration every engine is opened with.
+func GormConfig() *gorm.Config {
+	return &gorm.Config{
+		Logger:          logger.Default.LogMode(logger.Silent),
+		CreateBatchSize: 400,
+	}
+}
+
+// OpenSqlite opens the SQLite database in dataDir, or the file named by
+// NB_STORE_ENGINE_SQLITE_FILE.
+func OpenSqlite(ctx context.Context, dataDir string) (*Conn, error) {
+	storeFile := SqliteFileName
+	if envFile, ok := os.LookupEnv("NB_STORE_ENGINE_SQLITE_FILE"); ok && envFile != "" {
+		storeFile = envFile
+	}
+	return OpenSqliteFile(ctx, dataDir, storeFile)
+}
+
+// OpenSqliteFile opens the SQLite database storeFile, resolved against dataDir
+// when relative. storeFile may carry SQLite URI query parameters.
+func OpenSqliteFile(ctx context.Context, dataDir, storeFile string) (*Conn, error) {
+	// Separate file path from any SQLite URI query parameters (e.g., "store.db?mode=rwc")
+	filePath, query, hasQuery := strings.Cut(storeFile, "?")
+
+	connStr := filePath
+	if !filepath.IsAbs(filePath) {
+		connStr = filepath.Join(dataDir, filePath)
+	}
+
+	// Compose query parameters. User-provided ?_busy_timeout (or its mattn alias
+	// ?_timeout) overrides our default; otherwise inject 30s so SQLite waits at
+	// most that long on a lock instead of blocking the only Go-side connection.
+	// mattn/go-sqlite3 applies PRAGMA from the DSN on every fresh connection, so
+	// the value survives ConnMaxIdleTime/ConnMaxLifetime recycling. cache=shared
+	// stays the default on non-Windows for the same reason as before.
+	parsed, _ := url.ParseQuery(query)
+	var defaults []string
+	if parsed.Get("_busy_timeout") == "" && parsed.Get("_timeout") == "" {
+		defaults = append(defaults, "_busy_timeout=30000")
+	}
+	if !hasQuery && runtime.GOOS != "windows" {
+		// To avoid `The process cannot access the file because it is being used by another process` on Windows
+		defaults = append(defaults, "cache=shared")
+	}
+	parts := defaults
+	if hasQuery {
+		parts = append(parts, query)
+	}
+	if len(parts) > 0 {
+		connStr += "?" + strings.Join(parts, "&")
+	}
+
+	gormDB, err := gorm.Open(sqlite.Open(connStr), GormConfig())
+	if err != nil {
+		return nil, err
+	}
+	conn, err := NewConn(ctx, gormDB, SqliteStoreEngine, nil)
+	if err != nil {
+		closeGorm(gormDB)
+		return nil, err
+	}
+	return conn, nil
+}
+
+// OpenPostgres opens a Postgres database through gorm and a pgx pool sized by pool.
+func OpenPostgres(ctx context.Context, dsn string, pool PoolConfig) (*Conn, error) {
+	gormDB, err := gorm.Open(postgres.Open(dsn), GormConfig())
+	if err != nil {
+		return nil, err
+	}
+	pgxPool, err := newPgxPool(ctx, dsn, pool)
+	if err != nil {
+		closeGorm(gormDB)
+		return nil, err
+	}
+	conn, err := NewConn(ctx, gormDB, PostgresStoreEngine, pgxPool)
+	if err != nil {
+		pgxPool.Close()
+		closeGorm(gormDB)
+		return nil, err
+	}
+	return conn, nil
+}
+
+// MysqlDSN adds the connection parameters every MySQL handle needs, keeping
+// the options already present in dsn.
+func MysqlDSN(dsn string) string {
+	separator := "?"
+	if strings.Contains(dsn, "?") {
+		separator = "&"
+	}
+	return dsn + separator + "charset=utf8&parseTime=True&loc=Local"
+}
+
+// OpenMysql opens a MySQL database through gorm.
+func OpenMysql(ctx context.Context, dsn string) (*Conn, error) {
+	gormDB, err := gorm.Open(mysql.Open(MysqlDSN(dsn)), GormConfig())
+	if err != nil {
+		return nil, err
+	}
+	conn, err := NewConn(ctx, gormDB, MysqlStoreEngine, nil)
+	if err != nil {
+		closeGorm(gormDB)
+		return nil, err
+	}
+	return conn, nil
+}
+
+func newPgxPool(ctx context.Context, dsn string, cfg PoolConfig) (*pgxpool.Pool, error) {
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse database config: %w", err)
+	}
+
+	config.MaxConns = cfg.MaxConns
+	config.MinConns = cfg.MinConns
+	config.MaxConnLifetime = cfg.MaxConnLifetime
+	config.HealthCheckPeriod = cfg.HealthCheckPeriod
+
+	pool, err := pgxpool.NewWithConfig(ctx, config)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create connection pool: %w", err)
+	}
+
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("unable to ping database: %w", err)
+	}
+
+	return pool, nil
+}
+
+func closeGorm(gormDB *gorm.DB) {
+	if sqlDB, err := gormDB.DB(); err == nil {
+		_ = sqlDB.Close()
+	}
+}
diff --git a/management/internals/shared/db/open_test.go b/management/internals/shared/db/open_test.go
new file mode 100644
index 000000000..e6b506b78
--- /dev/null
+++ b/management/internals/shared/db/open_test.go
@@ -0,0 +1,12 @@
+package db
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMysqlDSN(t *testing.T) {
+	assert.Equal(t, "user:pw@tcp(host:3306)/db?charset=utf8&parseTime=True&loc=Local", MysqlDSN("user:pw@tcp(host:3306)/db"))
+	assert.Equal(t, "user:pw@tcp(host:3306)/db?tls=true&charset=utf8&parseTime=True&loc=Local", MysqlDSN("user:pw@tcp(host:3306)/db?tls=true"))
+}
diff --git a/management/internals/shared/db/transaction.go b/management/internals/shared/db/transaction.go
new file mode 100644
index 000000000..9699aaee6
--- /dev/null
+++ b/management/internals/shared/db/transaction.go
@@ -0,0 +1,105 @@
+package db
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"runtime/debug"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+)
+
+// Tx is an open transaction handed to repository calls; nil means autocommit.
+type Tx struct {
+	db *gorm.DB
+}
+
+// RunInTx runs fn in one transaction that commits when fn returns nil and rolls
+// back otherwise, bounded by the configured transaction timeout.
+func (c *Conn) RunInTx(ctx context.Context, fn func(tx *Tx) error) error {
+	timeoutCtx, cancel := context.WithTimeout(ctx, c.txTimeout)
+	defer cancel()
+
+	startTime := time.Now()
+	tx := c.db.WithContext(timeoutCtx).Begin()
+	if tx.Error != nil {
+		return tx.Error
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+			panic(r)
+		}
+	}()
+
+	if err := c.applyStatementTimeouts(tx); err != nil {
+		tx.Rollback()
+		return err
+	}
+
+	err := c.withForeignKeyChecksDisabled(tx, func() error {
+		return fn(&Tx{db: tx})
+	})
+	if err != nil {
+		tx.Rollback()
+		c.logIfTimedOut(ctx, timeoutCtx, err, "transaction", startTime)
+		return err
+	}
+
+	if err := tx.Commit().Error; err != nil {
+		c.logIfTimedOut(ctx, timeoutCtx, err, "transaction commit", startTime)
+		return err
+	}
+
+	log.WithContext(ctx).Tracef("transaction took %v", time.Since(startTime))
+	if c.metrics != nil {
+		c.metrics.CountTransactionDuration(time.Since(startTime))
+	}
+	return nil
+}
+
+func (c *Conn) applyStatementTimeouts(tx *gorm.DB) error {
+	if c.engine != PostgresStoreEngine {
+		return nil
+	}
+	if err := tx.Exec("SET LOCAL statement_timeout = '1min'").Error; err != nil {
+		return fmt.Errorf("failed to set statement timeout: %w", err)
+	}
+	if err := tx.Exec("SET LOCAL lock_timeout = '1min'").Error; err != nil {
+		return fmt.Errorf("failed to set lock timeout: %w", err)
+	}
+	return nil
+}
+
+// withForeignKeyChecksDisabled runs fn with MySQL's FK checks off, which avoids
+// deadlocks on MySQL and Aurora without needing SUPER privilege. The setting is
+// session-scoped and survives a rollback, so it is turned back on whenever fn
+// returns or panics; otherwise the pooled connection would keep it disabled.
+func (c *Conn) withForeignKeyChecksDisabled(tx *gorm.DB, fn func() error) (err error) {
+	if c.engine != MysqlStoreEngine {
+		return fn()
+	}
+	if err := tx.Exec("SET FOREIGN_KEY_CHECKS = 0").Error; err != nil {
+		return fmt.Errorf("failed to disable FK checks: %w", err)
+	}
+	defer func() {
+		restoreErr := tx.Exec("SET FOREIGN_KEY_CHECKS = 1").Error
+		if restoreErr == nil {
+			return
+		}
+		if err == nil {
+			err = fmt.Errorf("failed to re-enable FK checks: %w", restoreErr)
+			return
+		}
+		log.WithContext(tx.Statement.Context).Warnf("failed to re-enable FK checks after failed transaction: %v", restoreErr)
+	}()
+	return fn()
+}
+
+func (c *Conn) logIfTimedOut(ctx, timeoutCtx context.Context, err error, phase string, startTime time.Time) {
+	if errors.Is(err, context.DeadlineExceeded) || errors.Is(timeoutCtx.Err(), context.DeadlineExceeded) {
+		log.WithContext(ctx).Warnf("%s exceeded %s timeout after %v, stack: %s", phase, c.txTimeout, time.Since(startTime), debug.Stack())
+	}
+}
diff --git a/management/internals/shared/grpc/certposture.go b/management/internals/shared/grpc/certposture.go
new file mode 100644
index 000000000..d3d8f08be
--- /dev/null
+++ b/management/internals/shared/grpc/certposture.go
@@ -0,0 +1,88 @@
+package grpc
+
+import (
+	"context"
+	"crypto/sha256"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const certChallengeKeyDomain = "netbird-cert-challenge-key"
+
+// newCertChallenger derives the nonce secret from the data store encryption key:
+// generated once, written back to the configuration, and read by every instance, so a
+// nonce stays verifiable across a restart and between instances.
+//
+// Where none is configured it falls back to the server's WireGuard key, which is
+// regenerated per process. Unpredictable is the property that has to hold either way: a
+// peer that could guess the secret would mint future windows' nonces, sign them while
+// its key is present, and keep passing after it is gone.
+func newCertChallenger(encryptionKey string, serverKey wgtypes.Key) *certposture.Challenger {
+	secret := []byte(encryptionKey)
+	if len(secret) == 0 {
+		log.Warnf("no data store encryption key, deriving certificate challenges from the ephemeral server key: peers will be rejected once per restart and across instances")
+		secret = serverKey[:]
+	}
+
+	h := sha256.New()
+	h.Write([]byte(certChallengeKeyDomain))
+	h.Write(secret)
+	return certposture.NewChallenger(h.Sum(nil))
+}
+
+// stampCertificateChallenges fills the per-peer nonce into every certificate challenge
+// right before the response is encrypted for that peer, reporting whether it issued one.
+//
+// On a sync stream the answer registers the peer for renewal. A nonce is stateless, but
+// the renewal that keeps it fresh is local: only the instance holding a peer's stream
+// can push to it, so an instance renews exactly the peers it streams nonces to.
+func stampCertificateChallenges(checks []*proto.Checks, challenger *certposture.Challenger, peerKey wgtypes.Key) bool {
+	var nonce []byte
+	for _, check := range checks {
+		challenge := check.GetCertificateChallenge()
+		if challenge == nil {
+			continue
+		}
+		if nonce == nil {
+			nonce = challenger.Nonce(peerKey[:], time.Now())
+		}
+		challenge.Nonce = nonce
+	}
+	return nonce != nil
+}
+
+// verifiedCertificates turns the peer's proofs into PEM chains for its meta. Possession
+// (nonce + signature) is verified here; trust against a check's CAs is evaluated by the
+// posture check itself. Each proof stands for its own key, so an invalid one is dropped
+// without the others: a user store answering with an unusable key must not cost the
+// device the machine certificate it proved.
+func (s *Server) verifiedCertificates(ctx context.Context, peerKey wgtypes.Key, proofs []*proto.CertificateProof) []string {
+	if len(proofs) == 0 {
+		return nil
+	}
+
+	now := time.Now()
+	chains := make([]string, 0, len(proofs))
+	for _, p := range proofs {
+		chain, err := s.challenger.Verify(certposture.Proof{
+			Nonce:     p.GetNonce(),
+			Chain:     p.GetChain(),
+			SigAlg:    p.GetSigAlg(),
+			Signature: p.GetSignature(),
+		}, peerKey[:], now)
+		if err != nil {
+			log.WithContext(ctx).Warnf("dropping a certificate proof of peer %s: %v", peerKey, err)
+			continue
+		}
+		chains = append(chains, certposture.EncodeChainPEM(chain))
+	}
+	if len(chains) == 0 {
+		return nil
+	}
+	return chains
+}
diff --git a/management/internals/shared/grpc/certposture_test.go b/management/internals/shared/grpc/certposture_test.go
new file mode 100644
index 000000000..e713c9aac
--- /dev/null
+++ b/management/internals/shared/grpc/certposture_test.go
@@ -0,0 +1,91 @@
+package grpc
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestCertificateChallenge_StampAndVerifyRoundTrip(t *testing.T) {
+	const encryptionKey = "data-store-encryption-key"
+	challenger := newCertChallenger(encryptionKey, generateKey(t))
+	peerKey := generateKey(t).PublicKey()
+	ca := certtest.NewCA(t, "corp-root")
+	ctx := context.Background()
+
+	checks := toProtocolChecks(ctx, []*nmdata.PostureChecks{{
+		ID:     "cert-check",
+		Checks: nmdata.ChecksDefinition{CertificateCheck: &nmdata.CertificateCheck{CACertificates: []string{ca.PEM}}},
+	}})
+	require.Len(t, checks, 1)
+	require.Equal(t, []string{ca.PEM}, checks[0].GetCertificateChallenge().GetCaCertificates())
+	require.Empty(t, checks[0].GetCertificateChallenge().GetNonce())
+
+	stampCertificateChallenges(checks, challenger, peerKey)
+	nonce := checks[0].GetCertificateChallenge().GetNonce()
+	require.NotEmpty(t, nonce)
+
+	deviceKey := certtest.ECDSAKey(t)
+	leaf := ca.Issue(t, deviceKey, "device")
+	sigAlg, sig, err := certposture.Sign(deviceKey, nonce, peerKey[:])
+	require.NoError(t, err)
+	proofs := []*proto.CertificateProof{{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: sigAlg, Signature: sig}}
+
+	s := &Server{challenger: challenger}
+
+	chains := s.verifiedCertificates(ctx, peerKey, proofs)
+	require.Len(t, chains, 1)
+	assert.True(t, certposture.ChainMatchesCAs(chains[0], []string{ca.PEM}, time.Now()))
+
+	t.Run("proof replayed by another peer is rejected", func(t *testing.T) {
+		assert.Nil(t, s.verifiedCertificates(ctx, generateKey(t).PublicKey(), proofs))
+	})
+	t.Run("nonce from another deployment's secret is rejected", func(t *testing.T) {
+		other := &Server{challenger: newCertChallenger("a-different-encryption-key", generateKey(t))}
+		assert.Nil(t, other.verifiedCertificates(ctx, peerKey, proofs))
+	})
+	t.Run("a second instance with the same encryption key accepts it", func(t *testing.T) {
+		// The point of deriving from the stored key: another instance, with its own
+		// freshly generated WireGuard key, verifies what this one issued. This is also
+		// what a restart looks like, and it used to reject.
+		peer := &Server{challenger: newCertChallenger(encryptionKey, generateKey(t))}
+		assert.Len(t, peer.verifiedCertificates(ctx, peerKey, proofs), 1)
+	})
+	t.Run("an invalid proof is dropped without the valid ones", func(t *testing.T) {
+		// A device proving its machine certificate while a user store answers with a key
+		// it cannot use must keep the machine certificate.
+		bad := &proto.CertificateProof{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: sigAlg, Signature: []byte("junk")}
+		chains := s.verifiedCertificates(ctx, peerKey, append([]*proto.CertificateProof{bad}, proofs...))
+		require.Len(t, chains, 1, "the valid proof survives the invalid one")
+		assert.True(t, certposture.ChainMatchesCAs(chains[0], []string{ca.PEM}, time.Now()))
+	})
+	t.Run("only invalid proofs yield no certificates", func(t *testing.T) {
+		bad := &proto.CertificateProof{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: sigAlg, Signature: []byte("junk")}
+		assert.Empty(t, s.verifiedCertificates(ctx, peerKey, []*proto.CertificateProof{bad}))
+	})
+	t.Run("no proofs yields no certificates", func(t *testing.T) {
+		assert.Nil(t, s.verifiedCertificates(ctx, peerKey, nil))
+	})
+}
+
+func TestStampCertificateChallenges_SkipsFileOnlyChecks(t *testing.T) {
+	checks := []*proto.Checks{{Files: []string{"/bin/agent"}}}
+	stampCertificateChallenges(checks, newCertChallenger("key", generateKey(t)), generateKey(t).PublicKey())
+	assert.Nil(t, checks[0].GetCertificateChallenge())
+}
+
+func generateKey(t *testing.T) wgtypes.Key {
+	t.Helper()
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	return key
+}
diff --git a/management/internals/shared/grpc/components_encoder.go b/management/internals/shared/grpc/components_encoder.go
new file mode 100644
index 000000000..a4516be52
--- /dev/null
+++ b/management/internals/shared/grpc/components_encoder.go
@@ -0,0 +1,813 @@
+package grpc
+
+import (
+	"encoding/base64"
+	"strconv"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// wgKeyRawLen is the raw byte length of a WireGuard public key.
+const wgKeyRawLen = 32
+
+// ComponentsEnvelopeInput bundles the data the component-format encoder needs.
+// The envelope is fully self-contained — every field needed by the client's
+// local Calculate() comes from the components struct itself. The only
+// externally-supplied data is the receiving peer's PeerConfig (which is
+// computed alongside the components in the network_map controller and reused
+// from the legacy proto path) and the dns_domain string.
+type ComponentsEnvelopeInput struct {
+	Components       *types.NetworkMapComponents
+	PeerConfig       *proto.PeerConfig
+	DNSDomain        string
+	DNSForwarderPort int64
+	// UserIDClaim is the OIDC claim name the client should embed in
+	// SshAuth.UserIDClaim when reconstructing the NetworkMap. Empty value
+	// is OK — client treats empty as "no SshAuth to build".
+	UserIDClaim string
+}
+
+// EncodeNetworkMapEnvelope converts NetworkMapComponents into the component
+// wire envelope. The encoder is intentionally non-deterministic: it iterates
+// Go maps in their native (random) order. Indexes inside the envelope
+// (peer_indexes, source_group_ids, agent_version_idx, router_peer_indexes)
+// are self-consistent within a single encode, so the decoder reconstructs
+// the same typed objects regardless of emit order. Tests that need to
+// compare envelopes do so semantically via proto round-trip + canonicalize,
+// not byte-equal.
+//
+// Callers must NOT concatenate or merge envelopes from different encodes —
+// index spaces are local to a single envelope.
+func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvelope {
+	c := in.Components
+
+	// Graceful degrade when components is nil — matches the legacy path's
+	// behaviour for missing/unvalidated peers (return a NetworkMap with only
+	// Network populated). The receiver gets an envelope it can decode
+	// without crashing; AccountSettings stays non-nil so client-side
+	// dereferences are safe.
+	if c.IsEmpty() {
+		// Match legacy missing-peer minimum: a NetworkMap with only Network
+		// populated. The receiver gets enough to bootstrap (Network
+		// identifier, dns_domain, account_settings) and the peer itself.
+		return &proto.NetworkMapEnvelope{
+			Payload: &proto.NetworkMapEnvelope_Full{
+				Full: &proto.NetworkMapComponentsFull{
+					Serial:     networkSerial(c.Network),
+					Network:    toAccountNetwork(c.Network),
+					PeerConfig: in.PeerConfig,
+					// components.Peers always contains the target peer
+					Peers:            []*proto.PeerCompact{toPeerCompact(c.Peers[c.PeerID])},
+					DnsDomain:        in.DNSDomain,
+					DnsForwarderPort: in.DNSForwarderPort,
+					UserIdClaim:      in.UserIDClaim,
+					AccountSettings:  &proto.AccountSettingsCompact{},
+				},
+			},
+		}
+	}
+
+	// Phase 1: build dedup tables. Every routing peer (in c.RouterPeers) and
+	// every regular peer (in c.Peers) must be indexed before any encoder
+	// looks up indexes via e.peerOrder — otherwise routes / routers_map for
+	// peers that exist only in c.RouterPeers would silently lose their
+	// peer_index reference.
+	enc := newComponentEncoder(c)
+	enc.indexAllPeers()
+	routerIdxs := enc.indexRouterPeers(c.RouterPeers)
+	enc.indexAllNetworkResources()
+
+	// Phase 2: gather every policy that any consumer references (peer-pair
+	// policies + resource-only policies) so encodeResourcePoliciesMap can
+	// translate every *Policy pointer to a wire index.
+	allPolicies := unionPolicies(c.Policies, c.ResourcePoliciesMap)
+	policies := enc.encodePolicies(allPolicies)
+
+	// Phase 3: emit. Order of struct field expressions no longer matters:
+	// every encoder either reads from the dedup tables or works on
+	// independent input.
+	full := &proto.NetworkMapComponentsFull{
+		Serial:              networkSerial(c.Network),
+		PeerConfig:          in.PeerConfig,
+		Network:             toAccountNetwork(c.Network),
+		AccountSettings:     toAccountSettingsCompact(c.AccountSettings),
+		DnsForwarderPort:    in.DNSForwarderPort,
+		UserIdClaim:         in.UserIDClaim,
+		DnsSettings:         enc.encodeDNSSettings(c.DNSSettings),
+		DnsDomain:           in.DNSDomain,
+		CustomZoneDomain:    c.CustomZoneDomain,
+		Peers:               enc.peers,
+		RouterPeerIndexes:   routerIdxs,
+		Policies:            policies,
+		Groups:              enc.encodeGroups(),
+		Routes:              enc.encodeRoutes(c.Routes),
+		NameserverGroups:    enc.encodeNameServerGroups(c.NameServerGroups),
+		AllDnsRecords:       encodeSimpleRecords(c.AllDNSRecords),
+		AccountZones:        encodeCustomZones(c.AccountZones),
+		NetworkResources:    enc.encodeNetworkResources(c.NetworkResources),
+		RoutersMap:          enc.encodeRoutersMap(c.RoutersMap),
+		ResourcePoliciesMap: enc.encodeResourcePoliciesMap(c.ResourcePoliciesMap),
+		GroupIdToUserIds:    enc.encodeGroupIDToUserIDs(c.GroupIDToUserIDs),
+		AllowedUserIds:      stringSetToSlice(c.AllowedUserIDs),
+		PostureFailedPeers:  enc.encodePostureFailedPeers(c.PostureFailedPeers),
+	}
+
+	return &proto.NetworkMapEnvelope{
+		Payload: &proto.NetworkMapEnvelope_Full{Full: full},
+	}
+}
+
+// networkSerial returns c.Network.CurrentSerial() with a nil guard. The
+// production path always populates c.Network, but the encoder is exported
+// and a hand-built components struct may omit it.
+func networkSerial(n *nmdata.Network) uint64 {
+	if n == nil {
+		return 0
+	}
+	return n.CurrentSerial()
+}
+
+type componentEncoder struct {
+	components *types.NetworkMapComponents
+
+	peerOrder map[string]uint32
+	peers     []*proto.PeerCompact
+
+	networkIdToPublicId map[string]string
+}
+
+func newComponentEncoder(c *types.NetworkMapComponents) *componentEncoder {
+	return &componentEncoder{
+		components:          c,
+		peerOrder:           make(map[string]uint32, len(c.Peers)),
+		peers:               make([]*proto.PeerCompact, 0, len(c.Peers)),
+		networkIdToPublicId: make(map[string]string),
+	}
+}
+
+func (e *componentEncoder) indexAllPeers() {
+	for _, p := range e.components.Peers {
+		if p == nil {
+			continue
+		}
+		e.appendPeer(p)
+	}
+}
+
+func (e *componentEncoder) appendPeer(p *nmdata.Peer) uint32 {
+	if idx, ok := e.peerOrder[p.ID]; ok {
+		return idx
+	}
+	idx := uint32(len(e.peers))
+	e.peerOrder[p.ID] = idx
+	e.peers = append(e.peers, toPeerCompact(p))
+	return idx
+}
+
+// indexRouterPeers ensures every router peer is in the peer dedup table and
+// returns their wire indexes for the RouterPeerIndexes field. Must run before
+// any encoder that resolves peer ids via e.peerOrder.
+func (e *componentEncoder) indexRouterPeers(routers map[string]*nmdata.Peer) []uint32 {
+	if len(routers) == 0 {
+		return nil
+	}
+	out := make([]uint32, 0, len(routers))
+	for _, p := range routers {
+		if p == nil {
+			continue
+		}
+		out = append(out, e.appendPeer(p))
+	}
+	return out
+}
+
+func (e *componentEncoder) indexAllNetworkResources() {
+	for _, r := range e.components.NetworkResources {
+		if !r.Enabled {
+			continue
+		}
+		e.networkIdToPublicId[r.ID] = r.PublicID
+	}
+}
+
+func (e *componentEncoder) encodeGroups() []*proto.GroupCompact {
+	if len(e.components.Groups) == 0 {
+		return nil
+	}
+
+	out := make([]*proto.GroupCompact, 0, len(e.components.Groups))
+	for _, g := range e.components.Groups {
+		peerIdxs := make([]uint32, 0, len(g.Peers))
+		for _, peerID := range g.Peers {
+			if idx, ok := e.peerOrder[peerID]; ok {
+				peerIdxs = append(peerIdxs, idx)
+			}
+		}
+
+		groupCompactResources := func() []*proto.ResourceCompact {
+			var toret []*proto.ResourceCompact
+			for _, r := range g.Resources {
+				if pr := e.resourceToProto(r); pr != nil {
+					toret = append(toret, pr)
+				}
+			}
+			return toret
+		}
+
+		out = append(out, &proto.GroupCompact{
+			Id:          g.PublicID,
+			PeerIndexes: peerIdxs,
+			IsAll:       g.IsGroupAll(),
+			Resources:   groupCompactResources(),
+		})
+	}
+	return out
+}
+
+// encodePolicies flattens Policy{Rules} → []PolicyCompact. Returns the wire
+// list and a map from policy pointer to the indexes of its emitted rules in
+// that list — used by encodeResourcePoliciesMap to translate
+// ResourcePoliciesMap[resourceID][]*Policy into wire-side indexes.
+func (e *componentEncoder) encodePolicies(policies []*nmdata.Policy) []*proto.PolicyCompact {
+	if len(policies) == 0 {
+		return nil
+	}
+
+	out := make([]*proto.PolicyCompact, 0, len(policies))
+
+	for _, pol := range policies {
+		if !pol.Enabled {
+			continue
+		}
+		for _, r := range pol.Rules {
+			if r == nil || !r.Enabled {
+				continue
+			}
+			out = append(out, e.encodePolicyRule(pol, r))
+		}
+	}
+	return out
+}
+
+// encodePolicyRule maps a single PolicyRule under pol to a PolicyCompact entry.
+func (e *componentEncoder) encodePolicyRule(pol *nmdata.Policy, r *nmdata.PolicyRule) *proto.PolicyCompact {
+	return &proto.PolicyCompact{
+		Id:                    pol.PublicID,
+		Action:                networkmap.GetProtoAction(string(r.Action)),
+		Protocol:              networkmap.GetProtoProtocol(string(r.Protocol)),
+		Bidirectional:         r.Bidirectional,
+		Ports:                 portsToUint32(r.Ports),
+		PortRanges:            portRangesToProto(r.PortRanges),
+		SourceGroupIds:        e.groupPublicXids(r.Sources),
+		DestinationGroupIds:   e.groupPublicXids(r.Destinations),
+		AuthorizedUser:        r.AuthorizedUser,
+		AuthorizedGroups:      e.encodeAuthorizedGroups(r.AuthorizedGroups),
+		SourceResource:        e.resourceToProto(r.SourceResource),
+		DestinationResource:   e.resourceToProto(r.DestinationResource),
+		SourcePostureCheckIds: e.postureCheckSeqs(pol.SourcePostureChecks),
+	}
+}
+
+// groupPublicXids maps the xid group IDs in src to their public xids,
+// dropping any group with invalid public xid.
+func (e *componentEncoder) groupPublicXids(src []string) []string {
+	if len(src) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(src))
+	for _, gid := range src {
+		if id, ok := e.groupPublicXid(gid); ok {
+			out = append(out, id)
+		}
+	}
+	return out
+}
+
+// unionPolicies merges c.Policies with every policy referenced by
+// c.ResourcePoliciesMap, deduplicating by pointer identity. Resource-only
+// policies (relevant to a NetworkResource but not to peer-pair traffic)
+// only live in ResourcePoliciesMap; without this union step they'd be lost
+// from the wire and the client's resource-policy lookup would come back
+// empty.
+func unionPolicies(policies []*nmdata.Policy, resourcePolicies map[string][]*nmdata.Policy) []*nmdata.Policy {
+	// Fast path: non-router peers have no resource-only policies, so the
+	// "union" is identical to `policies`. Skip the dedup map allocation.
+	if len(resourcePolicies) == 0 {
+		return policies
+	}
+	seen := make(map[string]struct{}, len(policies))
+	out := make([]*nmdata.Policy, 0, len(policies))
+	for _, p := range policies {
+		if p == nil {
+			continue
+		}
+		if _, ok := seen[p.ID]; ok {
+			continue
+		}
+		seen[p.ID] = struct{}{}
+		out = append(out, p)
+	}
+	for _, list := range resourcePolicies {
+		for _, p := range list {
+			if p == nil {
+				continue
+			}
+			if _, ok := seen[p.ID]; ok {
+				continue
+			}
+			seen[p.ID] = struct{}{}
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// encodeAuthorizedGroups translates rule.AuthorizedGroups (map keyed by
+// group xid → local-user names) to the wire form (map keyed by
+// authorizedGroupKey → UserNameList).
+func (e *componentEncoder) encodeAuthorizedGroups(m map[string][]string) map[string]*proto.UserNameList {
+	if len(m) == 0 {
+		return nil
+	}
+	out := make(map[string]*proto.UserNameList, len(m))
+	for groupID, names := range m {
+		id, ok := e.authorizedGroupKey(groupID)
+		if !ok {
+			continue
+		}
+		out[id] = &proto.UserNameList{Names: names}
+	}
+	return out
+}
+
+// authorizedGroupKey resolves the wire key for a group that grants SSH access.
+// These are user groups: they hold no peers, so nothing puts them in
+// components.Groups and groupPublicXid cannot see them. Dropping them the way a
+// missing source/destination group is dropped would strip every authorized user
+// from the envelope while PeerConfig still reports SSH enabled, leaving the peer
+// running sshd with nobody able to log in — so the id is passed through instead.
+// AuthorizedGroups and GroupIDToUserIDs are only ever used against each other,
+// on both sides of the wire, so they just have to agree.
+func (e *componentEncoder) authorizedGroupKey(groupID string) (string, bool) {
+	if groupID == "" {
+		return "", false
+	}
+	if id, ok := e.groupPublicXid(groupID); ok {
+		return id, true
+	}
+	return groupID, true
+}
+
+func (e *componentEncoder) groupPublicXid(groupID string) (string, bool) {
+	g, ok := e.components.Groups[groupID]
+	if !ok {
+		return "", false
+	}
+	return g.PublicID, true
+}
+
+// resourceToProto translates types.Resource for the wire. For peer-typed
+// resources the peer id is converted to a peer index into the envelope's
+// peers array. For other resource types only the type string is shipped
+// today (Calculate's resource-typed rule path consults SourceResource only
+// for "peer" — other types fall through to group-based lookup).
+func (e *componentEncoder) resourceToProto(r nmdata.Resource) *proto.ResourceCompact {
+	if !types.ResourceType(r.Type).Valid() || r.ID == "" {
+		return nil
+	}
+
+	out := &proto.ResourceCompact{Type: r.Type}
+
+	if r.Type == string(types.ResourceTypePeer) {
+		idx, ok := e.peerOrder[r.ID]
+		if !ok {
+			return nil
+		}
+		out.PeerIndexSet = true
+		out.PeerIndex = idx
+		return out
+	}
+
+	publicID, ok := e.networkIdToPublicId[r.ID]
+	if !ok {
+		return nil
+	}
+	out.Id = publicID
+
+	return out
+}
+
+// postureCheckSeqs translates a slice of posture-check xids to their
+// public xids. Unresolvable xids are silently dropped — matches how group/peer
+// references handle the same case.
+func (e *componentEncoder) postureCheckSeqs(xids []string) []string {
+	if len(xids) == 0 || len(e.components.PostureCheckXIDToPublicID) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(xids))
+	for _, xid := range xids {
+		if seq, ok := e.components.PostureCheckXIDToPublicID[xid]; ok {
+			out = append(out, seq)
+		}
+	}
+	return out
+}
+
+// networkSeq translates a Network xid to its public id using
+// the NetworkMapComponents.NetworkXIDToPublicID lookup. Returns (0,false) when
+// the xid isn't known — callers decide whether to skip the parent record.
+func (e *componentEncoder) networkPublicId(xid string) (string, bool) {
+	if xid == "" {
+		return "", false
+	}
+	id, ok := e.components.NetworkXIDToPublicID[xid]
+	if !ok {
+		return "", false
+	}
+	return id, true
+}
+
+func (e *componentEncoder) encodeDNSSettings(s *nmdata.DNSSettings) *proto.DNSSettingsCompact {
+	if s == nil || len(s.DisabledManagementGroups) == 0 {
+		return nil
+	}
+	out := &proto.DNSSettingsCompact{
+		DisabledManagementGroupIds: make([]string, 0, len(s.DisabledManagementGroups)),
+	}
+	for _, gid := range s.DisabledManagementGroups {
+		if id, ok := e.groupPublicXid(gid); ok {
+			out.DisabledManagementGroupIds = append(out.DisabledManagementGroupIds, id)
+		}
+	}
+	return out
+}
+
+func (e *componentEncoder) encodeRoutes(routes []*nmdata.Route) []*proto.RouteRaw {
+	if len(routes) == 0 {
+		return nil
+	}
+	out := make([]*proto.RouteRaw, 0, len(routes))
+	for _, r := range routes {
+		if r == nil {
+			continue
+		}
+		rr := &proto.RouteRaw{
+			Id:                    r.PublicID,
+			NetId:                 string(r.NetID),
+			Description:           r.Description,
+			KeepRoute:             r.KeepRoute,
+			NetworkType:           int32(r.NetworkType),
+			Masquerade:            r.Masquerade,
+			Metric:                int32(r.Metric),
+			Enabled:               r.Enabled,
+			SkipAutoApply:         r.SkipAutoApply,
+			Domains:               r.Domains.ToPunycodeList(),
+			GroupIds:              e.groupPublicXids(r.Groups),
+			AccessControlGroupIds: e.groupPublicXids(r.AccessControlGroups),
+			PeerGroupIds:          e.groupPublicXids(r.PeerGroups),
+		}
+		if r.Network.IsValid() {
+			rr.NetworkCidr = r.Network.String()
+		}
+		if r.Peer != "" {
+			if idx, ok := e.peerOrder[r.Peer]; ok {
+				rr.PeerIndexSet = true
+				rr.PeerIndex = idx
+			}
+		}
+		out = append(out, rr)
+	}
+	return out
+}
+
+func (e *componentEncoder) encodeNameServerGroups(nsgs []*nmdata.NameServerGroup) []*proto.NameServerGroupRaw {
+	if len(nsgs) == 0 {
+		return nil
+	}
+	out := make([]*proto.NameServerGroupRaw, 0, len(nsgs))
+	for _, nsg := range nsgs {
+		if nsg == nil {
+			continue
+		}
+		entry := &proto.NameServerGroupRaw{
+			Id:                   nsg.PublicID,
+			Nameservers:          encodeNameServers(nsg.NameServers),
+			GroupIds:             e.groupPublicXids(nsg.Groups),
+			Primary:              nsg.Primary,
+			Domains:              nsg.Domains,
+			Enabled:              nsg.Enabled,
+			SearchDomainsEnabled: nsg.SearchDomainsEnabled,
+		}
+		out = append(out, entry)
+	}
+	return out
+}
+
+func encodeNameServers(servers []nmdata.NameServer) []*proto.NameServer {
+	if len(servers) == 0 {
+		return nil
+	}
+	out := make([]*proto.NameServer, 0, len(servers))
+	for _, s := range servers {
+		out = append(out, &proto.NameServer{
+			IP:     s.IP.String(),
+			NSType: int64(s.NSType),
+			Port:   int64(s.Port),
+		})
+	}
+	return out
+}
+
+func encodeSimpleRecords(records []nmdata.SimpleRecord) []*proto.SimpleRecord {
+	if len(records) == 0 {
+		return nil
+	}
+	out := make([]*proto.SimpleRecord, 0, len(records))
+	for _, r := range records {
+		out = append(out, &proto.SimpleRecord{
+			Name:  r.Name,
+			Type:  int64(r.Type),
+			Class: r.Class,
+			TTL:   int64(r.TTL),
+			RData: r.RData,
+		})
+	}
+	return out
+}
+
+func encodeCustomZones(zones []nmdata.CustomZone) []*proto.CustomZone {
+	if len(zones) == 0 {
+		return nil
+	}
+	out := make([]*proto.CustomZone, 0, len(zones))
+	for _, z := range zones {
+		out = append(out, &proto.CustomZone{
+			Domain:               z.Domain,
+			Records:              encodeSimpleRecords(z.Records),
+			SearchDomainDisabled: z.SearchDomainDisabled,
+			NonAuthoritative:     z.NonAuthoritative,
+		})
+	}
+	return out
+}
+
+func (e *componentEncoder) encodeNetworkResources(resources []*nmdata.NetworkResource) []*proto.NetworkResourceRaw {
+	if len(resources) == 0 {
+		return nil
+	}
+	out := make([]*proto.NetworkResourceRaw, 0, len(resources))
+	for _, r := range resources {
+		if r == nil {
+			continue
+		}
+		entry := &proto.NetworkResourceRaw{
+			Id:          r.PublicID,
+			Name:        r.Name,
+			Description: r.Description,
+			Type:        string(r.Type),
+			Address:     r.Address,
+			DomainValue: r.Domain,
+			Enabled:     r.Enabled,
+		}
+		if id, ok := e.networkPublicId(r.NetworkID); ok {
+			entry.NetworkSeq = id
+		}
+		if r.Prefix.IsValid() {
+			entry.PrefixCidr = r.Prefix.String()
+		}
+		out = append(out, entry)
+	}
+	return out
+}
+
+func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*nmdata.NetworkRouter) map[string]*proto.NetworkRouterList {
+	if len(routersMap) == 0 {
+		return nil
+	}
+	out := make(map[string]*proto.NetworkRouterList, len(routersMap))
+	for networkXID, routers := range routersMap {
+		if len(routers) == 0 {
+			continue
+		}
+		id, ok := e.networkPublicId(networkXID)
+		if !ok {
+			continue
+		}
+		entries := make([]*proto.NetworkRouterEntry, 0, len(routers))
+		for peerID, r := range routers {
+			if r == nil {
+				continue
+			}
+			entry := &proto.NetworkRouterEntry{
+				Id:           r.PublicID,
+				PeerGroupIds: e.groupPublicXids(r.PeerGroups),
+				Masquerade:   r.Masquerade,
+				Metric:       int32(r.Metric),
+				Enabled:      r.Enabled,
+			}
+			if idx, ok := e.peerOrder[peerID]; ok {
+				entry.PeerIndexSet = true
+				entry.PeerIndex = idx
+			}
+			entries = append(entries, entry)
+		}
+		out[id] = &proto.NetworkRouterList{Entries: entries}
+	}
+	return out
+}
+
+func (e *componentEncoder) encodeResourcePoliciesMap(rpm map[string][]*nmdata.Policy) map[string]*proto.PolicyIds {
+	if len(rpm) == 0 {
+		return nil
+	}
+	// resourceXIDToPublicID is local to one encode — built from components.NetworkResources
+	// (small slice). Network resources without seq id are dropped, matching how
+	// other components-without-seq are silently filtered.
+	resourceXIDToPublicID := make(map[string]string, len(e.components.NetworkResources))
+	for _, r := range e.components.NetworkResources {
+		if r != nil {
+			resourceXIDToPublicID[r.ID] = r.PublicID
+		}
+	}
+	out := make(map[string]*proto.PolicyIds, len(rpm))
+	for resourceXID, policies := range rpm {
+		resId, ok := resourceXIDToPublicID[resourceXID]
+		if !ok {
+			continue
+		}
+		ids := make([]string, 0, len(policies))
+		for _, pol := range policies {
+			if pol == nil {
+				continue
+			}
+			ids = append(ids, pol.PublicID)
+		}
+		if len(ids) == 0 {
+			continue
+		}
+		out[resId] = &proto.PolicyIds{Ids: ids}
+	}
+	return out
+}
+
+func (e *componentEncoder) encodeGroupIDToUserIDs(m map[string][]string) map[string]*proto.UserIDList {
+	if len(m) == 0 {
+		return nil
+	}
+	out := make(map[string]*proto.UserIDList, len(m))
+	for groupID, userIDs := range m {
+		id, ok := e.authorizedGroupKey(groupID)
+		if !ok || len(userIDs) == 0 {
+			continue
+		}
+		out[id] = &proto.UserIDList{UserIds: userIDs}
+	}
+	return out
+}
+
+func stringSetToSlice(s map[string]struct{}) []string {
+	if len(s) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(s))
+	for k := range s {
+		out = append(out, k)
+	}
+	return out
+}
+
+func (e *componentEncoder) encodePostureFailedPeers(m map[string]map[string]struct{}) map[string]*proto.PeerIndexSet {
+	if len(m) == 0 {
+		return nil
+	}
+	out := make(map[string]*proto.PeerIndexSet, len(m))
+	for checkXID, failedPeerIDs := range m {
+		id, ok := e.components.PostureCheckXIDToPublicID[checkXID]
+		if !ok {
+			continue
+		}
+		idxs := make([]uint32, 0, len(failedPeerIDs))
+		for peerID := range failedPeerIDs {
+			if idx, ok := e.peerOrder[peerID]; ok {
+				idxs = append(idxs, idx)
+			}
+		}
+		if len(idxs) == 0 {
+			continue
+		}
+		out[id] = &proto.PeerIndexSet{PeerIndexes: idxs}
+	}
+	return out
+}
+
+// toAccountSettingsCompact always returns a non-nil message — the client
+// dereferences it unconditionally during Calculate(), so a nil here would
+// crash the receiver. A missing types.AccountSettingsInfo on the server
+// (which shouldn't happen in production but the encoder is exported)
+// degrades to login_expiration_enabled = false, which makes
+// LoginExpired() return false for every peer.
+func toAccountSettingsCompact(s *nmdata.AccountSettingsInfo) *proto.AccountSettingsCompact {
+	if s == nil {
+		return &proto.AccountSettingsCompact{}
+	}
+	return &proto.AccountSettingsCompact{
+		PeerLoginExpirationEnabled: s.PeerLoginExpirationEnabled,
+		PeerLoginExpirationNs:      int64(s.PeerLoginExpiration),
+	}
+}
+
+func toAccountNetwork(n *nmdata.Network) *proto.AccountNetwork {
+	if n == nil {
+		return nil
+	}
+	out := &proto.AccountNetwork{
+		Identifier: n.Identifier,
+		NetCidr:    n.Net.String(),
+		Dns:        n.Dns,
+		Serial:     n.CurrentSerial(),
+	}
+	if len(n.NetV6.IP) > 0 {
+		out.NetV6Cidr = n.NetV6.String()
+	}
+	return out
+}
+
+func toPeerCompact(p *nmdata.Peer) *proto.PeerCompact {
+	pc := &proto.PeerCompact{
+		WgPubKey:               decodeWgKey(p.Key),
+		SshPubKey:              []byte(p.SSHKey),
+		DnsLabel:               p.DNSLabel,
+		AgentVersion:           p.Meta.WtVersion,
+		AddedWithSsoLogin:      p.UserID != "",
+		LoginExpirationEnabled: p.LoginExpirationEnabled,
+		SshEnabled:             p.SSHEnabled,
+		SupportsIpv6:           p.SupportsIPv6(),
+		SupportsSourcePrefixes: p.SupportsSourcePrefixes(),
+		ServerSshAllowed:       p.Meta.Flags.ServerSSHAllowed,
+		ProxyEmbedded:          p.ProxyMeta.Embedded,
+	}
+	if p.LastLogin != nil {
+		pc.LastLoginUnixNano = p.LastLogin.UnixNano()
+	}
+	switch {
+	case !p.IP.IsValid():
+		// leave Ip nil
+	case p.IP.Is4() || p.IP.Is4In6():
+		ip := p.IP.Unmap().As4()
+		pc.Ip = ip[:]
+	default:
+		ip := p.IP.As16()
+		pc.Ip = ip[:]
+	}
+	if p.IPv6.IsValid() {
+		ip := p.IPv6.As16()
+		pc.Ipv6 = ip[:]
+	}
+	return pc
+}
+
+// decodeWgKey returns the raw 32 bytes of a base64-encoded WireGuard public
+// key, or nil for an empty / malformed key.
+func decodeWgKey(s string) []byte {
+	if s == "" {
+		return nil
+	}
+	out := make([]byte, wgKeyRawLen)
+	n, err := base64.StdEncoding.Decode(out, []byte(s))
+	if err != nil || n != wgKeyRawLen {
+		return nil
+	}
+	return out
+}
+
+func portsToUint32(ports []string) []uint32 {
+	if len(ports) == 0 {
+		return nil
+	}
+	out := make([]uint32, 0, len(ports))
+	for _, p := range ports {
+		v, err := strconv.ParseUint(p, 10, 16)
+		if err != nil {
+			continue
+		}
+		out = append(out, uint32(v))
+	}
+	return out
+}
+
+func portRangesToProto(ranges []nmdata.RulePortRange) []*proto.PortInfo_Range {
+	if len(ranges) == 0 {
+		return nil
+	}
+	out := make([]*proto.PortInfo_Range, 0, len(ranges))
+	for _, r := range ranges {
+		out = append(out, &proto.PortInfo_Range{
+			Start: uint32(r.Start),
+			End:   uint32(r.End),
+		})
+	}
+	return out
+}
diff --git a/management/internals/shared/grpc/components_encoder_test.go b/management/internals/shared/grpc/components_encoder_test.go
new file mode 100644
index 000000000..a6421af11
--- /dev/null
+++ b/management/internals/shared/grpc/components_encoder_test.go
@@ -0,0 +1,760 @@
+package grpc
+
+import (
+	"bytes"
+	"cmp"
+	"net"
+	"net/netip"
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	goproto "google.golang.org/protobuf/proto"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const testWgKeyA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopq="
+const testWgKeyB = "BBCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopq="
+const testWgKeyC = "CBCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopq="
+
+// canonicalize rewrites a NetworkMapComponentsFull in place into a canonical
+// form: peers reordered by wg_pub_key, with the rest of the message rewritten
+// to reference the new peer indexes. Groups, policies, and router indexes are
+// also sorted. After canonicalize, two envelopes built from the same logical
+// input compare byte-equal via proto.Equal.
+//
+// This lives on the test side — the encoder itself emits in map-iteration
+// order. Test-side normalization is the contract for "two encodes are
+// equivalent".
+func canonicalize(full *proto.NetworkMapComponentsFull) {
+	if full == nil {
+		return
+	}
+
+	type peerEntry struct {
+		peer   *proto.PeerCompact
+		oldIdx uint32
+	}
+	entries := make([]peerEntry, len(full.Peers))
+	for i, p := range full.Peers {
+		entries[i] = peerEntry{peer: p, oldIdx: uint32(i)}
+	}
+	// DnsLabel is unique per peer; it tiebreaks on equal WgPubKey (e.g. both
+	// nil from malformed keys, or both empty for placeholders).
+	slices.SortFunc(entries, func(a, b peerEntry) int {
+		if c := bytes.Compare(a.peer.WgPubKey, b.peer.WgPubKey); c != 0 {
+			return c
+		}
+		return cmp.Compare(a.peer.DnsLabel, b.peer.DnsLabel)
+	})
+
+	remap := make(map[uint32]uint32, len(entries))
+	newPeers := make([]*proto.PeerCompact, len(entries))
+	for newIdx, e := range entries {
+		remap[e.oldIdx] = uint32(newIdx)
+		newPeers[newIdx] = e.peer
+	}
+	full.Peers = newPeers
+
+	full.RouterPeerIndexes = remapAndSort(full.RouterPeerIndexes, remap)
+	for _, g := range full.Groups {
+		g.PeerIndexes = remapAndSort(g.PeerIndexes, remap)
+	}
+	slices.SortFunc(full.Groups, func(a, b *proto.GroupCompact) int { return cmp.Compare(a.Id, b.Id) })
+
+	for _, r := range full.Routes {
+		if r.PeerIndexSet {
+			if newIdx, ok := remap[r.PeerIndex]; ok {
+				r.PeerIndex = newIdx
+			}
+		}
+		slices.Sort(r.GroupIds)
+		slices.Sort(r.AccessControlGroupIds)
+		slices.Sort(r.PeerGroupIds)
+	}
+	slices.SortFunc(full.Routes, func(a, b *proto.RouteRaw) int { return cmp.Compare(a.Id, b.Id) })
+
+	for _, list := range full.RoutersMap {
+		for _, entry := range list.Entries {
+			if entry.PeerIndexSet {
+				if newIdx, ok := remap[entry.PeerIndex]; ok {
+					entry.PeerIndex = newIdx
+				}
+			}
+			slices.Sort(entry.PeerGroupIds)
+		}
+		slices.SortFunc(list.Entries, func(a, b *proto.NetworkRouterEntry) int { return cmp.Compare(a.Id, b.Id) })
+	}
+
+	for _, set := range full.PostureFailedPeers {
+		set.PeerIndexes = remapAndSort(set.PeerIndexes, remap)
+	}
+
+	for _, p := range full.Policies {
+		slices.Sort(p.SourceGroupIds)
+		slices.Sort(p.DestinationGroupIds)
+	}
+	// Sort policies by (Id, source_group_ids, destination_group_ids) so that
+	// multiple PolicyCompact entries sharing the same Id (one per rule, when
+	// a Policy has multiple rules) still get a deterministic order. After
+	// sorting we remap indexes in ResourcePoliciesMap.
+	policyOldOrder := make(map[*proto.PolicyCompact]uint32, len(full.Policies))
+	for i, p := range full.Policies {
+		policyOldOrder[p] = uint32(i)
+	}
+	slices.SortFunc(full.Policies, func(a, b *proto.PolicyCompact) int {
+		if c := cmp.Compare(a.Id, b.Id); c != 0 {
+			return c
+		}
+		if c := slices.Compare(a.SourceGroupIds, b.SourceGroupIds); c != 0 {
+			return c
+		}
+		return slices.Compare(a.DestinationGroupIds, b.DestinationGroupIds)
+	})
+	policyRemap := make(map[uint32]uint32, len(full.Policies))
+	for newIdx, p := range full.Policies {
+		policyRemap[policyOldOrder[p]] = uint32(newIdx)
+	}
+	for _, idxs := range full.ResourcePoliciesMap {
+		slices.Sort(idxs.Ids)
+	}
+	for _, list := range full.GroupIdToUserIds {
+		slices.Sort(list.UserIds)
+	}
+	slices.Sort(full.AllowedUserIds)
+}
+
+func remapAndSort(idxs []uint32, remap map[uint32]uint32) []uint32 {
+	out := make([]uint32, 0, len(idxs))
+	for _, i := range idxs {
+		if newIdx, ok := remap[i]; ok {
+			out = append(out, newIdx)
+		}
+	}
+	slices.Sort(out)
+	return out
+}
+
+// envelopesEquivalent decodes both envelopes, canonicalizes them, and reports
+// whether they're proto.Equal. Use instead of byte-comparing marshaled output:
+// the encoder is intentionally non-deterministic.
+func envelopesEquivalent(a, b *proto.NetworkMapEnvelope) bool {
+	canonicalize(a.GetFull())
+	canonicalize(b.GetFull())
+	return goproto.Equal(a, b)
+}
+
+func newTestComponents() *types.NetworkMapComponents {
+	peerA := &nmdata.Peer{
+		ID:       "peer-a",
+		Key:      testWgKeyA,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 1}),
+		DNSLabel: "peera",
+		SSHKey:   "ssh-a",
+		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	}
+	peerB := &nmdata.Peer{
+		ID:       "peer-b",
+		Key:      testWgKeyB,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 2}),
+		IPv6:     netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}),
+		DNSLabel: "peerb",
+		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.25.0"},
+	}
+	peerC := &nmdata.Peer{
+		ID:       "peer-c",
+		Key:      testWgKeyC,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 3}),
+		DNSLabel: "peerc",
+		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	}
+
+	return &types.NetworkMapComponents{
+		PeerID: "peer-a",
+		Network: &nmdata.Network{
+			Identifier: "net-test",
+			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
+			Serial:     7,
+		},
+		AccountSettings: &nmdata.AccountSettingsInfo{
+			PeerLoginExpirationEnabled: true,
+			PeerLoginExpiration:        2 * time.Hour,
+		},
+		Peers: map[string]*nmdata.Peer{
+			"peer-a": peerA,
+			"peer-b": peerB,
+			"peer-c": peerC,
+		},
+		Groups: map[string]*nmdata.Group{
+			"group-src": {PublicID: "1", Name: "Src", Peers: []string{"peer-a"}},
+			"group-dst": {PublicID: "2", Name: "Dst", Peers: []string{"peer-b", "peer-c"}},
+		},
+		Policies: []*nmdata.Policy{
+			{
+				ID:       "pol-1",
+				PublicID: "10",
+				Enabled:  true,
+				Rules: []*nmdata.PolicyRule{{
+					ID: "rule-1", Enabled: true, Action: string(types.PolicyTrafficActionAccept),
+					Protocol: string(types.PolicyRuleProtocolTCP), Bidirectional: true,
+					Ports:        []string{"22", "80"},
+					PortRanges:   []nmdata.RulePortRange{{Start: 8000, End: 8100}},
+					Sources:      []string{"group-src"},
+					Destinations: []string{"group-dst"},
+				}},
+			},
+		},
+		RouterPeers: map[string]*nmdata.Peer{"peer-c": peerC},
+	}
+}
+
+func TestEncodeNetworkMapEnvelope_Basic(t *testing.T) {
+	c := newTestComponents()
+	env := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
+		Components: c,
+		DNSDomain:  "netbird.cloud",
+	})
+
+	require.NotNil(t, env)
+	full := env.GetFull()
+	require.NotNil(t, full, "envelope must contain Full payload")
+
+	assert.EqualValues(t, 7, full.Serial)
+	assert.Equal(t, "netbird.cloud", full.DnsDomain)
+
+	require.NotNil(t, full.Network)
+	assert.Equal(t, "net-test", full.Network.Identifier)
+	assert.Equal(t, "100.64.0.0/10", full.Network.NetCidr)
+
+	require.NotNil(t, full.AccountSettings)
+	assert.True(t, full.AccountSettings.PeerLoginExpirationEnabled)
+	assert.EqualValues(t, (2 * time.Hour).Nanoseconds(), full.AccountSettings.PeerLoginExpirationNs)
+
+	require.Len(t, full.Peers, 3)
+	byLabel := map[string]*proto.PeerCompact{}
+	for _, p := range full.Peers {
+		assert.Len(t, p.WgPubKey, 32, "wg key must be raw 32 bytes")
+		assert.Len(t, p.Ip, 4, "ipv4 must be raw 4 bytes")
+		byLabel[p.DnsLabel] = p
+	}
+	assert.Len(t, byLabel["peerb"].Ipv6, 16, "peer-b has ipv6 → 16 bytes")
+}
+
+func TestEncodeNetworkMapEnvelope_RepeatEncodesEquivalent(t *testing.T) {
+	c := newTestComponents()
+
+	expected := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c})
+
+	// Hammer it 100 times — Go map iteration is randomized per call, so each
+	// run produces different wire bytes, but the canonicalized form must
+	// match.
+	for i := 0; i < 100; i++ {
+		got := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c})
+		require.True(t, envelopesEquivalent(expected, got),
+			"encode #%d must be semantically equivalent to first encode", i)
+	}
+}
+
+func TestEncodeNetworkMapEnvelope_ConcurrentEncodesEquivalent(t *testing.T) {
+	c := newTestComponents()
+
+	expected := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c})
+
+	const goroutines = 50
+	var wg sync.WaitGroup
+	wg.Add(goroutines)
+	results := make([]*proto.NetworkMapEnvelope, goroutines)
+	for i := 0; i < goroutines; i++ {
+		i := i
+		go func() {
+			defer wg.Done()
+			results[i] = EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c})
+		}()
+	}
+	wg.Wait()
+
+	for i, got := range results {
+		require.NotNil(t, got, "goroutine %d returned nil", i)
+		require.True(t, envelopesEquivalent(expected, got),
+			"goroutine %d produced inequivalent envelope", i)
+	}
+}
+
+func TestEncodeNetworkMapEnvelope_GroupsByAccountPublicId(t *testing.T) {
+	c := newTestComponents()
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Len(t, full.Groups, 2)
+
+	groupByID := map[string]*proto.GroupCompact{}
+	for _, g := range full.Groups {
+		groupByID[g.Id] = g
+	}
+	require.Contains(t, groupByID, "1")
+	require.Contains(t, groupByID, "2")
+	assert.Len(t, groupByID["1"].PeerIndexes, 1)
+	assert.Len(t, groupByID["2"].PeerIndexes, 2)
+}
+
+func TestEncodePolicy(t *testing.T) {
+	encoder := componentEncoder{peerOrder: map[string]uint32{"peerId": uint32(1234)}, networkIdToPublicId: map[string]string{"domain": "publicDomain", "host": "publicHost", "subnet": "publicSubnet"}}
+	assert.Equal(t,
+		encoder.resourceToProto(nmdata.Resource{Type: "peer", ID: "peerId"}),
+		&proto.ResourceCompact{Type: "peer", PeerIndexSet: true, PeerIndex: uint32(1234)})
+	// verify invalid peer id results in nil
+	assert.Nil(t,
+		encoder.resourceToProto(nmdata.Resource{Type: "peer", ID: "boom"}))
+	assert.Equal(t,
+		encoder.resourceToProto(nmdata.Resource{Type: "domain", ID: "domain"}),
+		&proto.ResourceCompact{Type: "domain", Id: "publicDomain"})
+	assert.Equal(t,
+		encoder.resourceToProto(nmdata.Resource{Type: "host", ID: "host"}),
+		&proto.ResourceCompact{Type: "host", Id: "publicHost"})
+	assert.Equal(t,
+		encoder.resourceToProto(nmdata.Resource{Type: "subnet", ID: "subnet"}),
+		&proto.ResourceCompact{Type: "subnet", Id: "publicSubnet"})
+	// verify invalid resource type results in nil
+	assert.Nil(t,
+		encoder.resourceToProto(nmdata.Resource{Type: "boom", ID: "boom"}))
+	// verify invalid networkresource id results in nil
+	assert.Nil(t,
+		encoder.resourceToProto(nmdata.Resource{Type: "host", ID: "boom"}))
+}
+
+func TestEncodeNetworkMapEnvelope_PolicyExpansion(t *testing.T) {
+	c := newTestComponents()
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Len(t, full.Policies, 1)
+	pc := full.Policies[0]
+	assert.EqualValues(t, "10", pc.Id)
+	assert.Equal(t, proto.RuleAction_ACCEPT, pc.Action)
+	assert.Equal(t, proto.RuleProtocol_TCP, pc.Protocol)
+	assert.True(t, pc.Bidirectional)
+	assert.Equal(t, []uint32{22, 80}, pc.Ports)
+	require.Len(t, pc.PortRanges, 1)
+	assert.EqualValues(t, 8000, pc.PortRanges[0].Start)
+	assert.EqualValues(t, 8100, pc.PortRanges[0].End)
+	assert.Equal(t, []string{"1"}, pc.SourceGroupIds)
+	assert.Equal(t, []string{"2"}, pc.DestinationGroupIds)
+}
+
+func TestEncodeNetworkMapEnvelope_RouterIndexes(t *testing.T) {
+	c := newTestComponents()
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Len(t, full.RouterPeerIndexes, 1)
+	idx := full.RouterPeerIndexes[0]
+	require.Less(t, int(idx), len(full.Peers))
+	assert.Equal(t, "peerc", full.Peers[idx].DnsLabel)
+}
+
+func TestEncodeNetworkMapEnvelope_DisabledPolicySkipped(t *testing.T) {
+	c := newTestComponents()
+	c.Policies[0].Enabled = false
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	assert.Empty(t, full.Policies)
+}
+
+func TestEncodeNetworkMapEnvelope_TwoPeersSameMalformedKey(t *testing.T) {
+	// Both peers have nil WgPubKey after decode; canonicalize must still
+	// produce a stable order using DnsLabel as a tiebreaker, so 100 encodes
+	// canonicalize identically.
+	c := newTestComponents()
+	c.Peers["peer-a"].Key = "garbage-a-!!!"
+	c.Peers["peer-b"].Key = "garbage-b-!!!"
+
+	expected := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c})
+	for i := 0; i < 100; i++ {
+		got := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c})
+		require.True(t, envelopesEquivalent(expected, got),
+			"encode #%d with two same-key peers must canonicalize equivalently", i)
+	}
+}
+
+func TestEncodeNetworkMapEnvelope_MalformedWgKey(t *testing.T) {
+	c := newTestComponents()
+	c.Peers["peer-a"].Key = "not-base64-!!!"
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Len(t, full.Peers, 3)
+
+	var byLabel = map[string]*proto.PeerCompact{}
+	for _, p := range full.Peers {
+		byLabel[p.DnsLabel] = p
+	}
+	assert.Nil(t, byLabel["peera"].WgPubKey, "peer with malformed key encodes nil WgPubKey")
+	assert.Len(t, byLabel["peerb"].WgPubKey, 32, "other peers retain their key")
+}
+
+func TestEncodeNetworkMapEnvelope_IPv6OnlyPeer(t *testing.T) {
+	c := newTestComponents()
+	v6Only := &nmdata.Peer{
+		ID:       "peer-v6",
+		Key:      testWgKeyA,
+		IPv6:     netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9}),
+		DNSLabel: "peerv6",
+		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	}
+	c.Peers["peer-v6"] = v6Only
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	var found *proto.PeerCompact
+	for _, p := range full.Peers {
+		if p.DnsLabel == "peerv6" {
+			found = p
+		}
+	}
+	require.NotNil(t, found, "ipv6-only peer must be present")
+	assert.Empty(t, found.Ip, "no IPv4 address → empty Ip")
+	assert.Len(t, found.Ipv6, 16)
+}
+
+func TestEncodeNetworkMapEnvelope_PeerWithoutIP(t *testing.T) {
+	c := newTestComponents()
+	c.Peers["peer-noip"] = &nmdata.Peer{
+		ID:       "peer-noip",
+		Key:      testWgKeyA,
+		DNSLabel: "peernoip",
+		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	}
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	var found *proto.PeerCompact
+	for _, p := range full.Peers {
+		if p.DnsLabel == "peernoip" {
+			found = p
+		}
+	}
+	require.NotNil(t, found)
+	assert.Empty(t, found.Ip)
+	assert.Empty(t, found.Ipv6)
+}
+
+func TestEncodeNetworkMapEnvelope_EmptyInput(t *testing.T) {
+	c := &types.NetworkMapComponents{
+		Network: &nmdata.Network{Identifier: "x", Net: net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)}},
+	}
+
+	env := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c})
+
+	full := env.GetFull()
+	require.NotNil(t, full)
+	assert.Empty(t, full.Peers)
+	assert.Empty(t, full.Groups)
+	assert.Empty(t, full.Policies)
+	assert.Empty(t, full.RouterPeerIndexes)
+	require.NotNil(t, full.AccountSettings, "AccountSettingsCompact must always be emitted (client dereferences it unconditionally)")
+}
+
+func TestEncodeNetworkMapEnvelope_PeerLoginExpirationFields(t *testing.T) {
+	c := newTestComponents()
+	now := time.Date(2024, 1, 2, 3, 4, 5, 0, time.UTC)
+	c.Peers["peer-a"].UserID = "user-1"
+	c.Peers["peer-a"].LoginExpirationEnabled = true
+	c.Peers["peer-a"].LastLogin = &now
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	var pa *proto.PeerCompact
+	for _, p := range full.Peers {
+		if p.DnsLabel == "peera" {
+			pa = p
+		}
+	}
+	require.NotNil(t, pa)
+	assert.True(t, pa.AddedWithSsoLogin)
+	assert.True(t, pa.LoginExpirationEnabled)
+	assert.Equal(t, now.UnixNano(), pa.LastLoginUnixNano)
+
+	// peer-b has no UserID and no LastLogin → all fields zero-value.
+	var pb *proto.PeerCompact
+	for _, p := range full.Peers {
+		if p.DnsLabel == "peerb" {
+			pb = p
+		}
+	}
+	require.NotNil(t, pb)
+	assert.False(t, pb.AddedWithSsoLogin)
+	assert.False(t, pb.LoginExpirationEnabled)
+	assert.Zero(t, pb.LastLoginUnixNano)
+}
+
+func TestEncodeNetworkMapEnvelope_RoutesRoundTrip(t *testing.T) {
+	c := newTestComponents()
+	c.Routes = []*nmdata.Route{
+		{
+			ID:                  "route-peer",
+			PublicID:            "100",
+			NetID:               "net-A",
+			Description:         "via peer-c",
+			Network:             netip.MustParsePrefix("10.0.0.0/16"),
+			Peer:                "peer-c", // peer ID, not WG key
+			Groups:              []string{"group-src"},
+			AccessControlGroups: []string{"group-dst"},
+			Enabled:             true,
+		},
+		{
+			ID:         "route-peergroup",
+			PublicID:   "101",
+			NetID:      "net-B",
+			Network:    netip.MustParsePrefix("10.1.0.0/16"),
+			PeerGroups: []string{"group-src", "group-dst"},
+			Enabled:    true,
+		},
+	}
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Len(t, full.Routes, 2)
+	byNetID := map[string]*proto.RouteRaw{}
+	for _, r := range full.Routes {
+		byNetID[r.NetId] = r
+	}
+
+	r1 := byNetID["net-A"]
+	require.NotNil(t, r1)
+	assert.True(t, r1.PeerIndexSet, "route with peer must set peer_index_set")
+	require.Less(t, int(r1.PeerIndex), len(full.Peers))
+	assert.Equal(t, "peerc", full.Peers[r1.PeerIndex].DnsLabel)
+	assert.Equal(t, []string{"1"}, r1.GroupIds, "group-src has AccountSeqID 1")
+	assert.Equal(t, []string{"2"}, r1.AccessControlGroupIds, "group-dst has AccountSeqID 2")
+	assert.Empty(t, r1.PeerGroupIds)
+
+	r2 := byNetID["net-B"]
+	require.NotNil(t, r2)
+	assert.False(t, r2.PeerIndexSet, "route with peer_groups must NOT set peer_index_set")
+	assert.ElementsMatch(t, []string{"1", "2"}, r2.PeerGroupIds)
+}
+
+func TestEncodeNetworkMapEnvelope_RouteWithMissingPeerLeavesIndexUnset(t *testing.T) {
+	c := newTestComponents()
+	c.Routes = []*nmdata.Route{{
+		ID:       "route-x",
+		PublicID: "100",
+		Peer:     "peer-not-in-components",
+		Network:  netip.MustParsePrefix("10.0.0.0/16"),
+		Enabled:  true,
+	}}
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Len(t, full.Routes, 1)
+	assert.False(t, full.Routes[0].PeerIndexSet,
+		"missing peer reference must not pretend to point at peer index 0")
+}
+
+func TestEncodeNetworkMapEnvelope_ResourceOnlyPolicyShippedAndIndexed(t *testing.T) {
+	c := newTestComponents()
+	// Policy that exists ONLY in ResourcePoliciesMap, not in c.Policies. This
+	// is the I1 case — without unionPolicies the encoder would silently
+	// drop it from the wire.
+	resourceOnlyPolicy := &nmdata.Policy{
+		ID: "pol-resource", PublicID: "99", Enabled: true,
+		Rules: []*nmdata.PolicyRule{{
+			ID: "rule-r", Enabled: true, Action: string(types.PolicyTrafficActionAccept),
+			Protocol:     string(types.PolicyRuleProtocolTCP),
+			Sources:      []string{"group-src"},
+			Destinations: []string{"group-dst"},
+		}},
+	}
+	c.ResourcePoliciesMap = map[string][]*nmdata.Policy{
+		"resource-x": {c.Policies[0], resourceOnlyPolicy}, // shared + resource-only
+	}
+	// Resource must appear in components.NetworkResources with a seq id —
+	// encoder uses that to translate the xid map key to uint32.
+	c.NetworkResources = []*nmdata.NetworkResource{
+		{ID: "resource-x", PublicID: "77", Name: "res-x", Enabled: true},
+	}
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Len(t, full.Policies, 2, "encoded policies must include both peer-traffic and resource-only")
+
+	policyByID := map[string]*proto.PolicyCompact{}
+	policyIds := make([]string, 0)
+	for _, p := range full.Policies {
+		policyByID[p.Id] = p
+		policyIds = append(policyIds, p.Id)
+	}
+	require.Contains(t, policyByID, "10", "original peer-traffic policy id 10")
+	require.Contains(t, policyByID, "99", "resource-only policy id 99")
+
+	require.Contains(t, full.ResourcePoliciesMap, "77")
+	ids := full.ResourcePoliciesMap["77"].Ids
+	require.Len(t, ids, 2)
+	assert.ElementsMatch(t, policyIds, ids,
+		"resource policies map must reference both wire policy indexes")
+}
+
+func TestEncodeNetworkMapEnvelope_NameServerGroups(t *testing.T) {
+	c := newTestComponents()
+	c.NameServerGroups = []*nmdata.NameServerGroup{{
+		ID: "nsg-1", PublicID: "50", Name: "Main", Description: "primary",
+		NameServers: []nmdata.NameServer{{
+			IP: netip.MustParseAddr("8.8.8.8"), NSType: int(nbdns.UDPNameServerType), Port: 53,
+		}},
+		Groups:  []string{"group-src", "group-not-persisted"},
+		Primary: true, Enabled: true,
+		Domains: []string{"corp.example"},
+	}}
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Len(t, full.NameserverGroups, 1)
+	nsg := full.NameserverGroups[0]
+	assert.EqualValues(t, "50", nsg.Id)
+	assert.True(t, nsg.Primary)
+	require.Len(t, nsg.Nameservers, 1)
+	assert.Equal(t, "8.8.8.8", nsg.Nameservers[0].IP)
+	assert.Equal(t, []string{"1"}, nsg.GroupIds)
+}
+
+func TestEncodeNetworkMapEnvelope_PostureFailedPeers(t *testing.T) {
+	c := newTestComponents()
+	c.PostureCheckXIDToPublicID = map[string]string{"check-1": "33"}
+	c.PostureFailedPeers = map[string]map[string]struct{}{
+		"check-1": {
+			"peer-a":              {},
+			"peer-b":              {},
+			"peer-not-in-account": {},
+		},
+	}
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Contains(t, full.PostureFailedPeers, "33")
+	idxs := full.PostureFailedPeers["33"].PeerIndexes
+	assert.Len(t, idxs, 2, "missing peer is silently dropped (filterPostureFailedPeers guarantees presence in real data)")
+}
+
+func TestEncodeNetworkMapEnvelope_RoutersMap(t *testing.T) {
+	c := newTestComponents()
+	c.NetworkXIDToPublicID = map[string]string{"net-1": "5"}
+	c.RoutersMap = map[string]map[string]*nmdata.NetworkRouter{
+		"net-1": {
+			"peer-c": {
+				PublicID:   "200",
+				Masquerade: true, Metric: 10, Enabled: true,
+			},
+		},
+	}
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Contains(t, full.RoutersMap, "5")
+	entries := full.RoutersMap["5"].Entries
+	require.Len(t, entries, 1)
+	e := entries[0]
+	assert.EqualValues(t, "200", e.Id)
+	assert.True(t, e.PeerIndexSet)
+	require.Less(t, int(e.PeerIndex), len(full.Peers))
+	assert.Equal(t, "peerc", full.Peers[e.PeerIndex].DnsLabel)
+	assert.True(t, e.Masquerade)
+	assert.EqualValues(t, 10, e.Metric)
+	assert.True(t, e.Enabled)
+}
+
+func TestEncodeNetworkMapEnvelope_RouterPeerNotInComponentsPeers(t *testing.T) {
+	// Router peer in c.RouterPeers but NOT in c.Peers (validation may have
+	// filtered it). indexRouterPeers runs before encodeRoutersMap, so the
+	// peer_index reference must still resolve.
+	c := newTestComponents()
+	delete(c.Peers, "peer-c")
+	routerPeer := &nmdata.Peer{
+		ID: "peer-c", Key: testWgKeyC, IP: netip.AddrFrom4([4]byte{100, 64, 0, 3}),
+		DNSLabel: "peerc", Meta: nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	}
+	c.RouterPeers = map[string]*nmdata.Peer{"peer-c": routerPeer}
+	c.NetworkXIDToPublicID = map[string]string{"net-1": "5"}
+	c.RoutersMap = map[string]map[string]*nmdata.NetworkRouter{
+		"net-1": {"peer-c": {PublicID: "1", Enabled: true}},
+	}
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Contains(t, full.RoutersMap, "5")
+	require.Len(t, full.RoutersMap["5"].Entries, 1)
+	e := full.RoutersMap["5"].Entries[0]
+	assert.True(t, e.PeerIndexSet, "router peer must be indexed even when not in c.Peers")
+}
+
+func TestEncodeNetworkMapEnvelope_GroupIDToUserIDs(t *testing.T) {
+	c := newTestComponents()
+	c.GroupIDToUserIDs = map[string][]string{
+		"group-src":   {"user-1", "user-2"},
+		"group-users": {"user-4"},
+	}
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.Len(t, full.GroupIdToUserIds, 2,
+		"a peer group is keyed by its public id, and a user group — which never appears in "+
+			"components.Groups — keeps its own id rather than being dropped, or the peer would "+
+			"receive no authorized SSH users at all")
+	require.Contains(t, full.GroupIdToUserIds, "1")
+	assert.ElementsMatch(t, []string{"user-1", "user-2"}, full.GroupIdToUserIds["1"].UserIds)
+	require.Contains(t, full.GroupIdToUserIds, "group-users")
+	assert.ElementsMatch(t, []string{"user-4"}, full.GroupIdToUserIds["group-users"].UserIds)
+}
+
+func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
+	// nil Components → minimal envelope, no crash. Matches the legacy
+	// behaviour for missing/unvalidated peers.
+	env := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
+		Components: emptyNetworkMapComponents(),
+		DNSDomain:  "netbird.cloud",
+	})
+
+	require.NotNil(t, env)
+	full := env.GetFull()
+	require.NotNil(t, full)
+	require.NotNil(t, full.AccountSettings, "AccountSettings must always be non-nil")
+	assert.Equal(t, "netbird.cloud", full.DnsDomain)
+	assert.Len(t, full.Peers, 1)
+	assert.Empty(t, full.Policies)
+	require.NotNil(t, full.Network, "client runs Calculate() over the envelope and dereferences Network unconditionally; a nil here would crash the receiver")
+	assert.Equal(t, "net-empty", full.Network.Identifier)
+	assert.Equal(t, uint64(9), full.Serial)
+}
+
+func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
+	c := &types.NetworkMapComponents{
+		Network: &nmdata.Network{Identifier: "x", Net: net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)}},
+		// AccountSettings deliberately nil
+	}
+
+	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
+
+	require.NotNil(t, full.AccountSettings, "client dereferences AccountSettings unconditionally during Calculate(); a nil here would crash the receiver")
+	assert.False(t, full.AccountSettings.PeerLoginExpirationEnabled)
+	assert.Zero(t, full.AccountSettings.PeerLoginExpirationNs)
+}
+
+func emptyNetworkMapComponents() *types.NetworkMapComponents {
+	return types.EmptyNetworkMapComponents(
+		&types.NetworkMapComponents{
+			PeerID: "peer-id", Peers: map[string]*nmdata.Peer{"peer-id": {}},
+			Network: &nmdata.Network{
+				Identifier: "net-empty",
+				Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
+				Serial:     9,
+			},
+		},
+	)
+}
diff --git a/management/internals/shared/grpc/components_envelope_response.go b/management/internals/shared/grpc/components_envelope_response.go
new file mode 100644
index 000000000..cbf9bb477
--- /dev/null
+++ b/management/internals/shared/grpc/components_envelope_response.go
@@ -0,0 +1,156 @@
+package grpc
+
+import (
+	"context"
+
+	integrationsConfig "github.com/netbirdio/management-integrations/integrations/config"
+
+	"github.com/netbirdio/netbird/client/ssh/auth"
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	"github.com/netbirdio/netbird/management/server/types"
+	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
+	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// ToComponentSyncResponse builds a SyncResponse carrying the compact
+// NetworkMapEnvelope for capability-aware peers. The legacy proto.NetworkMap
+// field is intentionally left empty — capable peers ignore it and the
+// envelope alone is the authoritative wire shape.
+//
+// PeerConfig is computed once server-side using the receiving peer's own
+// account-level network metadata. EnableSSH inside PeerConfig is left at
+// peer.SSHEnabled (the peer's local setting); account-policy-driven SSH is
+// computed by the client from the envelope's GroupIDToUserIDs / AllowedUserIDs
+// inside Calculate(), so the SshConfig.SshEnabled bit may flip true on the
+// client even though the server-side PeerConfig reports false.
+func ToComponentSyncResponse(
+	ctx context.Context,
+	config *nbconfig.Config,
+	httpConfig *nbconfig.HttpServerConfig,
+	deviceFlowConfig *nbconfig.DeviceAuthorizationFlow,
+	peer *nmdata.Peer,
+	turnCredentials *Token,
+	relayCredentials *Token,
+	components *types.NetworkMapComponents,
+	dnsName string,
+	checks []*nmdata.PostureChecks,
+	settings *nmdata.AccountSettingsInfo,
+	extraSettings *types.ExtraSettings,
+	peerGroups []string,
+	dnsFwdPort int64,
+) *proto.SyncResponse {
+	//
+	// 'component' parameter is expected to never be nil
+	// 'peer' parameter is expected to never be nil
+	//
+	// TODO (dmitri) consider using invariants?
+	//
+	enableSSH := computeSSHEnabledForPeer(components, peer)
+	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH, components.ForceRoutingPeerDNSResolution)
+
+	userIDClaim := auth.DefaultUserIDClaim
+	if httpConfig != nil && httpConfig.AuthUserIDClaim != "" {
+		userIDClaim = httpConfig.AuthUserIDClaim
+	}
+
+	envelope := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
+		Components:       components,
+		PeerConfig:       peerConfig,
+		DNSDomain:        dnsName,
+		DNSForwarderPort: dnsFwdPort,
+		UserIDClaim:      userIDClaim,
+	})
+
+	resp := &proto.SyncResponse{
+		PeerConfig:         peerConfig,
+		NetworkMapEnvelope: envelope,
+		Checks:             toProtocolChecks(ctx, checks),
+		Version:            int32(sharedgrpc.ComponentNetworkMap),
+	}
+
+	nbConfig := toNetbirdConfig(config, turnCredentials, relayCredentials, extraSettings, settings)
+	resp.NetbirdConfig = integrationsConfig.ExtendNetBirdConfig(peer.ID, peerGroups, nbConfig, extraSettings)
+
+	// settings == nil → field stays nil → "no info in this snapshot", client
+	// preserves the deadline it already had. settings non-nil → emit either a
+	// valid deadline or the explicit-zero "disabled" sentinel via
+	// encodeSessionExpiresAt.
+	if settings != nil {
+		resp.SessionExpiresAt = encodeSessionExpiresAt(
+			peer.SessionExpiresAt(settings.PeerLoginExpirationEnabled, settings.PeerLoginExpiration),
+		)
+	}
+
+	return resp
+}
+
+// computeSSHEnabledForPeer mirrors the SSH-server-activation bit that
+// Calculate() folds into NetworkMap.EnableSSH. Components-format peers
+// receive a freshly-computed PeerConfig.SshConfig.SshEnabled at sync time;
+// without this helper the field would be incorrectly false for any peer
+// that's the destination of an SSH-enabling policy without having
+// peer.SSHEnabled set locally.
+//
+// Mirrors the two activation paths Calculate() uses:
+//  1. Explicit: rule.Protocol == NetbirdSSH and peer is in the rule's
+//     destinations.
+//  2. Legacy implicit: rule covers TCP/22 or TCP/22022 (or ALL), peer is in
+//     destinations, AND the peer has SSHEnabled set locally — this is the
+//     "allow-all/TCP-22 implies SSH activation for SSH-capable peers" path.
+//
+// The full SSH AuthorizedUsers map is still produced by the client when it
+// runs Calculate() over the envelope.
+func computeSSHEnabledForPeer(c *types.NetworkMapComponents, peer *nmdata.Peer) bool {
+	if c == nil || peer == nil {
+		return false
+	}
+	// Mirror Calculate's `getAllPeersFromGroups` invariant: target peer must
+	// exist in c.Peers, otherwise no rule applies to it.
+	if _, ok := c.Peers[peer.ID]; !ok {
+		return false
+	}
+	for _, policy := range c.Policies {
+		if policy == nil || !policy.Enabled {
+			continue
+		}
+		for _, rule := range policy.Rules {
+			if ruleEnablesSSHForPeer(c, rule, peer) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// ruleEnablesSSHForPeer returns true when rule is active, targets peer, and
+// either explicitly authorises SSH or covers the legacy TCP/22 path while the
+// peer itself has SSH enabled locally.
+func ruleEnablesSSHForPeer(c *types.NetworkMapComponents, rule *nmdata.PolicyRule, peer *nmdata.Peer) bool {
+	if rule == nil || !rule.Enabled {
+		return false
+	}
+	if !peerInDestinations(c, rule, peer.ID) {
+		return false
+	}
+	if rule.Protocol == string(types.PolicyRuleProtocolNetbirdSSH) {
+		return true
+	}
+	return peer.SSHEnabled && nmdata.PolicyRuleImpliesLegacySSH(rule)
+}
+
+// peerInDestinations reports whether peerID is in any of rule.Destinations'
+// groups (or matches DestinationResource if it's a peer-typed resource —
+// for non-peer types Calculate falls through to group lookup, so we mirror
+// that exactly to avoid silent divergence).
+func peerInDestinations(c *types.NetworkMapComponents, rule *nmdata.PolicyRule, peerID string) bool {
+	if rule.DestinationResource.Type == string(types.ResourceTypePeer) && rule.DestinationResource.ID != "" {
+		return rule.DestinationResource.ID == peerID
+	}
+	for _, groupID := range rule.Destinations {
+		if c.IsPeerInGroup(peerID, groupID) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/management/internals/shared/grpc/components_envelope_response_test.go b/management/internals/shared/grpc/components_envelope_response_test.go
new file mode 100644
index 000000000..039cb73f4
--- /dev/null
+++ b/management/internals/shared/grpc/components_envelope_response_test.go
@@ -0,0 +1,183 @@
+package grpc
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+// TestComputeSSHEnabledForPeer covers both Calculate-mirroring branches:
+// explicit NetbirdSSH protocol, and the legacy implicit case where a
+// TCP/22 (or 22022 / ALL / port-range-covering-22) rule activates SSH when
+// the destination peer has SSHEnabled=true locally.
+func TestComputeSSHEnabledForPeer(t *testing.T) {
+	const targetPeerID = "target"
+	const targetGroupID = "g_dst"
+
+	mkComponents := func(rule *nmdata.PolicyRule, sshEnabled bool) (*types.NetworkMapComponents, *nmdata.Peer) {
+		peer := &nmdata.Peer{ID: targetPeerID, SSHEnabled: sshEnabled}
+		return &types.NetworkMapComponents{
+			Peers:  map[string]*nmdata.Peer{targetPeerID: peer},
+			Groups: map[string]*nmdata.Group{targetGroupID: {Name: "dst", Peers: []string{targetPeerID}}},
+			Policies: []*nmdata.Policy{{
+				ID:      "p",
+				Enabled: true,
+				Rules:   []*nmdata.PolicyRule{rule},
+			}},
+		}, peer
+	}
+
+	cases := []struct {
+		name        string
+		peerSSH     bool
+		rule        nmdata.PolicyRule
+		wantEnabled bool
+	}{
+		{
+			name:    "explicit-netbird-ssh-activates-regardless-of-peer-ssh",
+			peerSSH: false,
+			rule: nmdata.PolicyRule{
+				Enabled: true, Protocol: string(types.PolicyRuleProtocolNetbirdSSH),
+				Destinations: []string{targetGroupID},
+			},
+			wantEnabled: true,
+		},
+		{
+			name:    "implicit-tcp-22-with-peer-ssh",
+			peerSSH: true,
+			rule: nmdata.PolicyRule{
+				Enabled: true, Protocol: string(types.PolicyRuleProtocolTCP), Ports: []string{"22"},
+				Destinations: []string{targetGroupID},
+			},
+			wantEnabled: true,
+		},
+		{
+			name:    "implicit-tcp-22-without-peer-ssh-disabled",
+			peerSSH: false,
+			rule: nmdata.PolicyRule{
+				Enabled: true, Protocol: string(types.PolicyRuleProtocolTCP), Ports: []string{"22"},
+				Destinations: []string{targetGroupID},
+			},
+			wantEnabled: false,
+		},
+		{
+			name:    "implicit-tcp-22022-with-peer-ssh",
+			peerSSH: true,
+			rule: nmdata.PolicyRule{
+				Enabled: true, Protocol: string(types.PolicyRuleProtocolTCP), Ports: []string{"22022"},
+				Destinations: []string{targetGroupID},
+			},
+			wantEnabled: true,
+		},
+		{
+			name:    "implicit-all-protocol-with-peer-ssh",
+			peerSSH: true,
+			rule: nmdata.PolicyRule{
+				Enabled: true, Protocol: string(types.PolicyRuleProtocolALL),
+				Destinations: []string{targetGroupID},
+			},
+			wantEnabled: true,
+		},
+		{
+			name:    "implicit-port-range-covers-22",
+			peerSSH: true,
+			rule: nmdata.PolicyRule{
+				Enabled:      true,
+				Protocol:     string(types.PolicyRuleProtocolTCP),
+				PortRanges:   []nmdata.RulePortRange{{Start: 20, End: 30}},
+				Destinations: []string{targetGroupID},
+			},
+			wantEnabled: true,
+		},
+		{
+			name:    "tcp-80-no-ssh",
+			peerSSH: true,
+			rule: nmdata.PolicyRule{
+				Enabled: true, Protocol: string(types.PolicyRuleProtocolTCP), Ports: []string{"80"},
+				Destinations: []string{targetGroupID},
+			},
+			wantEnabled: false,
+		},
+		{
+			name:    "disabled-rule-skipped",
+			peerSSH: true,
+			rule: nmdata.PolicyRule{
+				Enabled: false, Protocol: string(types.PolicyRuleProtocolNetbirdSSH),
+				Destinations: []string{targetGroupID},
+			},
+			wantEnabled: false,
+		},
+		{
+			name:    "peer-not-in-destinations",
+			peerSSH: true,
+			rule: nmdata.PolicyRule{
+				Enabled: true, Protocol: string(types.PolicyRuleProtocolNetbirdSSH),
+				Destinations: []string{"g_other"}, // target not in this group
+			},
+			wantEnabled: false,
+		},
+		{
+			name:    "peer-typed-destination-resource-matches",
+			peerSSH: false,
+			rule: nmdata.PolicyRule{
+				Enabled:             true,
+				Protocol:            string(types.PolicyRuleProtocolNetbirdSSH),
+				DestinationResource: nmdata.Resource{ID: targetPeerID, Type: string(types.ResourceTypePeer)},
+			},
+			wantEnabled: true,
+		},
+		{
+			name:    "non-peer-destination-resource-falls-through-to-groups",
+			peerSSH: false,
+			rule: nmdata.PolicyRule{
+				Enabled:             true,
+				Protocol:            string(types.PolicyRuleProtocolNetbirdSSH),
+				DestinationResource: nmdata.Resource{ID: targetPeerID, Type: "host"}, // wrong type
+				Destinations:        []string{targetGroupID},                         // saved by group fallback
+			},
+			wantEnabled: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			c, peer := mkComponents(&tc.rule, tc.peerSSH)
+			got := computeSSHEnabledForPeer(c, peer)
+			assert.Equal(t, tc.wantEnabled, got)
+		})
+	}
+}
+
+// TestComputeSSHEnabledForPeer_TargetMissingFromComponents covers the
+// belt-and-suspenders presence guard mirroring Calculate's
+// getAllPeersFromGroups invariant.
+func TestComputeSSHEnabledForPeer_TargetMissingFromComponents(t *testing.T) {
+	peer := &nmdata.Peer{ID: "missing", SSHEnabled: true}
+	c := &types.NetworkMapComponents{
+		Peers: map[string]*nmdata.Peer{}, // target peer NOT present
+		Groups: map[string]*nmdata.Group{
+			"g": {Peers: []string{"missing"}},
+		},
+		Policies: []*nmdata.Policy{{
+			ID: "p", Enabled: true,
+			Rules: []*nmdata.PolicyRule{{
+				Enabled: true, Protocol: string(types.PolicyRuleProtocolNetbirdSSH),
+				Destinations: []string{"g"},
+			}},
+		}},
+	}
+	assert.False(t, computeSSHEnabledForPeer(c, peer),
+		"missing target peer must short-circuit to false, not consult policies")
+}
+
+// TestComputeSSHEnabledForPeer_NilInputs guards the cheap nil-checks at
+// function entry — Calculate doesn't accept nil either, but the helper is
+// exported indirectly via ToComponentSyncResponse and may receive nil
+// components on graceful-degrade paths.
+func TestComputeSSHEnabledForPeer_NilInputs(t *testing.T) {
+	assert.False(t, computeSSHEnabledForPeer(nil, &nmdata.Peer{ID: "x"}))
+	assert.False(t, computeSSHEnabledForPeer(&types.NetworkMapComponents{}, nil))
+}
diff --git a/management/internals/shared/grpc/conversion.go b/management/internals/shared/grpc/conversion.go
index bdb4c8cf4..908118aff 100644
--- a/management/internals/shared/grpc/conversion.go
+++ b/management/internals/shared/grpc/conversion.go
@@ -10,24 +10,19 @@ import (
 
 	"github.com/hashicorp/go-version"
 	nbversion "github.com/netbirdio/netbird/version"
-	log "github.com/sirupsen/logrus"
-	goproto "google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	integrationsConfig "github.com/netbirdio/management-integrations/integrations/config"
 
 	"github.com/netbirdio/netbird/client/ssh/auth"
 
-	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/types"
-	nbroute "github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/netiputil"
-	"github.com/netbirdio/netbird/shared/sshauth"
 )
 
 const (
@@ -51,7 +46,7 @@ func init() {
 // nil when no server config is set (the fan-out network-map path) because clients treat any
 // non-nil config as authoritative: a config without a relay section is interpreted as relay
 // disabled and wipes the clients' relay URLs.
-func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken *Token, extraSettings *types.ExtraSettings, settings *types.Settings) *proto.NetbirdConfig {
+func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken *Token, extraSettings *types.ExtraSettings, settings *nmdata.AccountSettingsInfo) *proto.NetbirdConfig {
 	if config == nil {
 		return nil
 	}
@@ -123,7 +118,7 @@ func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken
 	return nbConfig
 }
 
-func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, settings *types.Settings, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool) *proto.PeerConfig {
+func toPeerConfig(peer *nmdata.Peer, network *nmdata.Network, dnsName string, settings *nmdata.AccountSettingsInfo, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool, forceRoutingPeerDNS bool) *proto.PeerConfig {
 	netmask, _ := network.Net.Mask.Size()
 	fqdn := peer.FQDN(dnsName)
 
@@ -139,7 +134,7 @@ func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, set
 		Address:                         fmt.Sprintf("%s/%d", peer.IP.String(), netmask),
 		SshConfig:                       sshConfig,
 		Fqdn:                            fqdn,
-		RoutingPeerDnsResolutionEnabled: settings.RoutingPeerDNSResolutionEnabled,
+		RoutingPeerDnsResolutionEnabled: settings.RoutingPeerDNSResolutionEnabled || peer.ProxyMeta.Embedded || forceRoutingPeerDNS,
 		LazyConnectionEnabled:           settings.LazyConnectionEnabled,
 		AutoUpdate: &proto.AutoUpdateSettings{
 			Version:      settings.AutoUpdateVersion,
@@ -158,20 +153,21 @@ func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, set
 	return peerConfig
 }
 
-func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, peer *nbpeer.Peer, turnCredentials *Token, relayCredentials *Token, networkMap *types.NetworkMap, dnsName string, checks []*posture.Checks, dnsCache *cache.DNSConfigCache, settings *types.Settings, extraSettings *types.ExtraSettings, peerGroups []string, dnsFwdPort int64) *proto.SyncResponse {
+func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, peer *nmdata.Peer, turnCredentials *Token, relayCredentials *Token, networkMap *types.NetworkMap, dnsName string, checks []*nmdata.PostureChecks, dnsCache *cache.DNSConfigCache, settings *nmdata.AccountSettingsInfo, extraSettings *types.ExtraSettings, peerGroups []string, dnsFwdPort int64) *proto.SyncResponse {
 	// IPv6 data in AllowedIPs and SourcePrefixes wildcard expansion depends on
 	// whether the target peer supports IPv6. Routes and firewall rules are already
 	// filtered at the source (network map builder).
 	includeIPv6 := peer.SupportsIPv6() && peer.IPv6.IsValid()
 	useSourcePrefixes := peer.SupportsSourcePrefixes()
+	localIsProxy := peer.ProxyMeta.Embedded
 
 	response := &proto.SyncResponse{
-		PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH),
+		PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH, networkMap.ForceRoutingPeerDNSResolution),
 		NetworkMap: &proto.NetworkMap{
 			Serial:     networkMap.Network.CurrentSerial(),
-			Routes:     toProtocolRoutes(networkMap.Routes),
-			DNSConfig:  toProtocolDNSConfig(networkMap.DNSConfig, dnsCache, dnsFwdPort),
-			PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH),
+			Routes:     networkmap.ToProtocolRoutes(networkMap.Routes),
+			DNSConfig:  networkmap.ToProtocolDNSConfig(networkMap.DNSConfig, dnsCache, dnsFwdPort),
+			PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH, networkMap.ForceRoutingPeerDNSResolution),
 		},
 		Checks: toProtocolChecks(ctx, checks),
 	}
@@ -183,7 +179,7 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	response.NetworkMap.PeerConfig = response.PeerConfig
 
 	remotePeers := make([]*proto.RemotePeerConfig, 0, len(networkMap.Peers)+len(networkMap.OfflinePeers))
-	remotePeers = appendRemotePeerConfig(remotePeers, networkMap.Peers, dnsName, includeIPv6)
+	remotePeers = networkmap.AppendRemotePeerConfig(remotePeers, networkMap.Peers, dnsName, includeIPv6, localIsProxy)
 
 	if !shouldSkipSendingDeprecatedRemotePeers(peer.Meta.WtVersion) {
 		response.RemotePeers = remotePeers
@@ -193,26 +189,18 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	response.RemotePeersIsEmpty = len(remotePeers) == 0
 	response.NetworkMap.RemotePeersIsEmpty = response.RemotePeersIsEmpty
 
-	response.NetworkMap.OfflinePeers = appendRemotePeerConfig(nil, networkMap.OfflinePeers, dnsName, includeIPv6)
+	response.NetworkMap.OfflinePeers = networkmap.AppendRemotePeerConfig(nil, networkMap.OfflinePeers, dnsName, includeIPv6, localIsProxy)
 
-	firewallRules := toProtocolFirewallRules(networkMap.FirewallRules, includeIPv6, useSourcePrefixes)
+	firewallRules := networkmap.ToProtocolFirewallRules(networkMap.FirewallRules, includeIPv6, useSourcePrefixes)
 	response.NetworkMap.FirewallRules = firewallRules
 	response.NetworkMap.FirewallRulesIsEmpty = len(firewallRules) == 0
 
-	routesFirewallRules := toProtocolRoutesFirewallRules(networkMap.RoutesFirewallRules)
+	routesFirewallRules := networkmap.ToProtocolRoutesFirewallRules(networkMap.RoutesFirewallRules)
 	response.NetworkMap.RoutesFirewallRules = routesFirewallRules
 	response.NetworkMap.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
 
-	if networkMap.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(networkMap.ForwardingRules))
-		for _, rule := range networkMap.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		response.NetworkMap.ForwardingRules = forwardingRules
-	}
-
 	if networkMap.AuthorizedUsers != nil {
-		hashedUsers, machineUsers := buildAuthorizedUsersProto(ctx, networkMap.AuthorizedUsers)
+		hashedUsers, machineUsers := networkmap.BuildAuthorizedUsersProto(ctx, networkMap.AuthorizedUsers)
 		userIDClaim := auth.DefaultUserIDClaim
 		if httpConfig != nil && httpConfig.AuthUserIDClaim != "" {
 			userIDClaim = httpConfig.AuthUserIDClaim
@@ -252,33 +240,6 @@ func encodeSessionExpiresAt(deadline time.Time) *timestamppb.Timestamp {
 	return timestamppb.New(deadline)
 }
 
-func buildAuthorizedUsersProto(ctx context.Context, authorizedUsers map[string]map[string]struct{}) ([][]byte, map[string]*proto.MachineUserIndexes) {
-	userIDToIndex := make(map[string]uint32)
-	var hashedUsers [][]byte
-	machineUsers := make(map[string]*proto.MachineUserIndexes, len(authorizedUsers))
-
-	for machineUser, users := range authorizedUsers {
-		indexes := make([]uint32, 0, len(users))
-		for userID := range users {
-			idx, exists := userIDToIndex[userID]
-			if !exists {
-				hash, err := sshauth.HashUserID(userID)
-				if err != nil {
-					log.WithContext(ctx).Errorf("failed to hash user id %s: %v", userID, err)
-					continue
-				}
-				idx = uint32(len(hashedUsers))
-				userIDToIndex[userID] = idx
-				hashedUsers = append(hashedUsers, hash[:])
-			}
-			indexes = append(indexes, idx)
-		}
-		machineUsers[machineUser] = &proto.MachineUserIndexes{Indexes: indexes}
-	}
-
-	return hashedUsers, machineUsers
-}
-
 func shouldSkipSendingDeprecatedRemotePeers(peerVersion string) bool {
 	if nbversion.IsDevelopmentVersion(peerVersion) {
 		return true
@@ -292,51 +253,6 @@ func shouldSkipSendingDeprecatedRemotePeers(peerVersion string) bool {
 	return precomputedDeprecatedRemotePeersConstraint.Check(peerNBVersion)
 }
 
-func appendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*nbpeer.Peer, dnsName string, includeIPv6 bool) []*proto.RemotePeerConfig {
-	for _, rPeer := range peers {
-		allowedIPs := []string{rPeer.IP.String() + "/32"}
-		if includeIPv6 && rPeer.IPv6.IsValid() {
-			allowedIPs = append(allowedIPs, rPeer.IPv6.String()+"/128")
-		}
-		dst = append(dst, &proto.RemotePeerConfig{
-			WgPubKey:     rPeer.Key,
-			AllowedIps:   allowedIPs,
-			SshConfig:    &proto.SSHConfig{SshPubKey: []byte(rPeer.SSHKey)},
-			Fqdn:         rPeer.FQDN(dnsName),
-			AgentVersion: rPeer.Meta.WtVersion,
-		})
-	}
-	return dst
-}
-
-// toProtocolDNSConfig converts nbdns.Config to proto.DNSConfig using the cache
-func toProtocolDNSConfig(update nbdns.Config, cache *cache.DNSConfigCache, forwardPort int64) *proto.DNSConfig {
-	protoUpdate := &proto.DNSConfig{
-		ServiceEnable:    update.ServiceEnable,
-		CustomZones:      make([]*proto.CustomZone, 0, len(update.CustomZones)),
-		NameServerGroups: make([]*proto.NameServerGroup, 0, len(update.NameServerGroups)),
-		ForwarderPort:    forwardPort,
-	}
-
-	for _, zone := range update.CustomZones {
-		protoZone := convertToProtoCustomZone(zone)
-		protoUpdate.CustomZones = append(protoUpdate.CustomZones, protoZone)
-	}
-
-	for _, nsGroup := range update.NameServerGroups {
-		cacheKey := nsGroup.ID
-		if cachedGroup, exists := cache.GetNameServerGroup(cacheKey); exists {
-			protoUpdate.NameServerGroups = append(protoUpdate.NameServerGroups, cachedGroup)
-		} else {
-			protoGroup := convertToProtoNameServerGroup(nsGroup)
-			cache.SetNameServerGroup(cacheKey, protoGroup)
-			protoUpdate.NameServerGroups = append(protoUpdate.NameServerGroups, protoGroup)
-		}
-	}
-
-	return protoUpdate
-}
-
 func ToResponseProto(configProto nbconfig.Protocol) proto.HostConfig_Protocol {
 	switch configProto {
 	case nbconfig.UDP:
@@ -354,203 +270,6 @@ func ToResponseProto(configProto nbconfig.Protocol) proto.HostConfig_Protocol {
 	}
 }
 
-func toProtocolRoutes(routes []*nbroute.Route) []*proto.Route {
-	protoRoutes := make([]*proto.Route, 0, len(routes))
-	for _, r := range routes {
-		protoRoutes = append(protoRoutes, toProtocolRoute(r))
-	}
-	return protoRoutes
-}
-
-func toProtocolRoute(route *nbroute.Route) *proto.Route {
-	return &proto.Route{
-		ID:            string(route.ID),
-		NetID:         string(route.NetID),
-		Network:       route.Network.String(),
-		Domains:       route.Domains.ToPunycodeList(),
-		NetworkType:   int64(route.NetworkType),
-		Peer:          route.Peer,
-		Metric:        int64(route.Metric),
-		Masquerade:    route.Masquerade,
-		KeepRoute:     route.KeepRoute,
-		SkipAutoApply: route.SkipAutoApply,
-	}
-}
-
-// toProtocolFirewallRules converts the firewall rules to the protocol firewall rules.
-// When useSourcePrefixes is true, the compact SourcePrefixes field is populated
-// alongside the deprecated PeerIP for forward compatibility.
-// Wildcard rules ("0.0.0.0") are expanded into separate v4 and v6 SourcePrefixes
-// when includeIPv6 is true.
-func toProtocolFirewallRules(rules []*types.FirewallRule, includeIPv6, useSourcePrefixes bool) []*proto.FirewallRule {
-	result := make([]*proto.FirewallRule, 0, len(rules))
-	for i := range rules {
-		rule := rules[i]
-
-		fwRule := &proto.FirewallRule{
-			PolicyID:  []byte(rule.PolicyID),
-			PeerIP:    rule.PeerIP, //nolint:staticcheck // populated for backward compatibility
-			Direction: getProtoDirection(rule.Direction),
-			Action:    getProtoAction(rule.Action),
-			Protocol:  getProtoProtocol(rule.Protocol),
-			Port:      rule.Port,
-		}
-
-		if useSourcePrefixes && rule.PeerIP != "" {
-			result = append(result, populateSourcePrefixes(fwRule, rule, includeIPv6)...)
-		}
-
-		if shouldUsePortRange(fwRule) {
-			fwRule.PortInfo = rule.PortRange.ToProto()
-		}
-
-		result = append(result, fwRule)
-	}
-	return result
-}
-
-// populateSourcePrefixes sets SourcePrefixes on fwRule and returns any
-// additional rules needed (e.g. a v6 wildcard clone when the peer IP is unspecified).
-func populateSourcePrefixes(fwRule *proto.FirewallRule, rule *types.FirewallRule, includeIPv6 bool) []*proto.FirewallRule {
-	addr, err := netip.ParseAddr(rule.PeerIP)
-	if err != nil {
-		return nil
-	}
-
-	if !addr.IsUnspecified() {
-		fwRule.SourcePrefixes = [][]byte{netiputil.EncodeAddr(addr.Unmap())}
-		return nil
-	}
-
-	// IPv4Unspecified/0 is always valid, error is impossible.
-	v4Wildcard, _ := netiputil.EncodePrefix(netip.PrefixFrom(netip.IPv4Unspecified(), 0))
-	fwRule.SourcePrefixes = [][]byte{v4Wildcard}
-
-	if !includeIPv6 {
-		return nil
-	}
-
-	v6Rule := goproto.Clone(fwRule).(*proto.FirewallRule)
-	v6Rule.PeerIP = "::" //nolint:staticcheck // populated for backward compatibility
-	// IPv6Unspecified/0 is always valid, error is impossible.
-	v6Wildcard, _ := netiputil.EncodePrefix(netip.PrefixFrom(netip.IPv6Unspecified(), 0))
-	v6Rule.SourcePrefixes = [][]byte{v6Wildcard}
-	if shouldUsePortRange(v6Rule) {
-		v6Rule.PortInfo = rule.PortRange.ToProto()
-	}
-	return []*proto.FirewallRule{v6Rule}
-}
-
-// getProtoDirection converts the direction to proto.RuleDirection.
-func getProtoDirection(direction int) proto.RuleDirection {
-	if direction == types.FirewallRuleDirectionOUT {
-		return proto.RuleDirection_OUT
-	}
-	return proto.RuleDirection_IN
-}
-
-func toProtocolRoutesFirewallRules(rules []*types.RouteFirewallRule) []*proto.RouteFirewallRule {
-	result := make([]*proto.RouteFirewallRule, len(rules))
-	for i := range rules {
-		rule := rules[i]
-		result[i] = &proto.RouteFirewallRule{
-			SourceRanges: rule.SourceRanges,
-			Action:       getProtoAction(rule.Action),
-			Destination:  rule.Destination,
-			Protocol:     getProtoProtocol(rule.Protocol),
-			PortInfo:     getProtoPortInfo(rule),
-			IsDynamic:    rule.IsDynamic,
-			Domains:      rule.Domains.ToPunycodeList(),
-			PolicyID:     []byte(rule.PolicyID),
-			RouteID:      string(rule.RouteID),
-		}
-	}
-
-	return result
-}
-
-// getProtoAction converts the action to proto.RuleAction.
-func getProtoAction(action string) proto.RuleAction {
-	if action == string(types.PolicyTrafficActionDrop) {
-		return proto.RuleAction_DROP
-	}
-	return proto.RuleAction_ACCEPT
-}
-
-// getProtoProtocol converts the protocol to proto.RuleProtocol.
-func getProtoProtocol(protocol string) proto.RuleProtocol {
-	switch types.PolicyRuleProtocolType(protocol) {
-	case types.PolicyRuleProtocolALL:
-		return proto.RuleProtocol_ALL
-	case types.PolicyRuleProtocolTCP:
-		return proto.RuleProtocol_TCP
-	case types.PolicyRuleProtocolUDP:
-		return proto.RuleProtocol_UDP
-	case types.PolicyRuleProtocolICMP:
-		return proto.RuleProtocol_ICMP
-	default:
-		return proto.RuleProtocol_UNKNOWN
-	}
-}
-
-// getProtoPortInfo converts the port info to proto.PortInfo.
-func getProtoPortInfo(rule *types.RouteFirewallRule) *proto.PortInfo {
-	var portInfo proto.PortInfo
-	if rule.Port != 0 {
-		portInfo.PortSelection = &proto.PortInfo_Port{Port: uint32(rule.Port)}
-	} else if portRange := rule.PortRange; portRange.Start != 0 && portRange.End != 0 {
-		portInfo.PortSelection = &proto.PortInfo_Range_{
-			Range: &proto.PortInfo_Range{
-				Start: uint32(portRange.Start),
-				End:   uint32(portRange.End),
-			},
-		}
-	}
-	return &portInfo
-}
-
-func shouldUsePortRange(rule *proto.FirewallRule) bool {
-	return rule.Port == "" && (rule.Protocol == proto.RuleProtocol_UDP || rule.Protocol == proto.RuleProtocol_TCP)
-}
-
-// Helper function to convert nbdns.CustomZone to proto.CustomZone
-func convertToProtoCustomZone(zone nbdns.CustomZone) *proto.CustomZone {
-	protoZone := &proto.CustomZone{
-		Domain:               zone.Domain,
-		Records:              make([]*proto.SimpleRecord, 0, len(zone.Records)),
-		SearchDomainDisabled: zone.SearchDomainDisabled,
-		NonAuthoritative:     zone.NonAuthoritative,
-	}
-	for _, record := range zone.Records {
-		protoZone.Records = append(protoZone.Records, &proto.SimpleRecord{
-			Name:  record.Name,
-			Type:  int64(record.Type),
-			Class: record.Class,
-			TTL:   int64(record.TTL),
-			RData: record.RData,
-		})
-	}
-	return protoZone
-}
-
-// Helper function to convert nbdns.NameServerGroup to proto.NameServerGroup
-func convertToProtoNameServerGroup(nsGroup *nbdns.NameServerGroup) *proto.NameServerGroup {
-	protoGroup := &proto.NameServerGroup{
-		Primary:              nsGroup.Primary,
-		Domains:              nsGroup.Domains,
-		SearchDomainsEnabled: nsGroup.SearchDomainsEnabled,
-		NameServers:          make([]*proto.NameServer, 0, len(nsGroup.NameServers)),
-	}
-	for _, ns := range nsGroup.NameServers {
-		protoGroup.NameServers = append(protoGroup.NameServers, &proto.NameServer{
-			IP:     ns.IP.String(),
-			Port:   int64(ns.Port),
-			NSType: int64(ns.NSType),
-		})
-	}
-	return protoGroup
-}
-
 // buildJWTConfig constructs JWT configuration for SSH servers from management server config
 func buildJWTConfig(config *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow) *proto.JWTConfig {
 	if config == nil || config.AuthAudience == "" {
@@ -584,7 +303,7 @@ func buildJWTConfig(config *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfi
 
 	return &proto.JWTConfig{
 		Issuer:       issuer,
-		Audience:     audience,
+		Audience:     audience, //nolint:staticcheck
 		Audiences:    audiences,
 		KeysLocation: keysLocation,
 	}
diff --git a/management/internals/shared/grpc/conversion_test.go b/management/internals/shared/grpc/conversion_test.go
index c81bef25c..559699d8c 100644
--- a/management/internals/shared/grpc/conversion_test.go
+++ b/management/internals/shared/grpc/conversion_test.go
@@ -2,6 +2,7 @@ package grpc
 
 import (
 	"fmt"
+	"net"
 	"net/netip"
 	"reflect"
 	"testing"
@@ -14,7 +15,9 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
 )
 
 func TestToProtocolDNSConfigWithCache(t *testing.T) {
@@ -64,13 +67,13 @@ func TestToProtocolDNSConfigWithCache(t *testing.T) {
 	}
 
 	// First run with config1
-	result1 := toProtocolDNSConfig(config1, &cache, int64(network_map.DnsForwarderPort))
+	result1 := networkmap.ToProtocolDNSConfig(config1, &cache, int64(network_map.DnsForwarderPort))
 
 	// Second run with config2
-	result2 := toProtocolDNSConfig(config2, &cache, int64(network_map.DnsForwarderPort))
+	result2 := networkmap.ToProtocolDNSConfig(config2, &cache, int64(network_map.DnsForwarderPort))
 
 	// Third run with config1 again
-	result3 := toProtocolDNSConfig(config1, &cache, int64(network_map.DnsForwarderPort))
+	result3 := networkmap.ToProtocolDNSConfig(config1, &cache, int64(network_map.DnsForwarderPort))
 
 	// Verify that result1 and result3 are identical
 	if !reflect.DeepEqual(result1, result3) {
@@ -102,15 +105,14 @@ func BenchmarkToProtocolDNSConfig(b *testing.B) {
 
 			b.ResetTimer()
 			for i := 0; i < b.N; i++ {
-				toProtocolDNSConfig(testData, cache, int64(network_map.DnsForwarderPort))
+				networkmap.ToProtocolDNSConfig(testData, cache, int64(network_map.DnsForwarderPort))
 			}
 		})
 
 		b.Run(fmt.Sprintf("WithoutCache-Size%d", size), func(b *testing.B) {
 			b.ResetTimer()
 			for i := 0; i < b.N; i++ {
-				cache := &cache.DNSConfigCache{}
-				toProtocolDNSConfig(testData, cache, int64(network_map.DnsForwarderPort))
+				networkmap.ToProtocolDNSConfig(testData, nil, int64(network_map.DnsForwarderPort))
 			}
 		})
 	}
@@ -276,7 +278,7 @@ func TestToNetbirdConfig_RelayInvariant(t *testing.T) {
 	settings := &types.Settings{MetricsPushEnabled: true}
 
 	t.Run("nil server config returns nil config", func(t *testing.T) {
-		nbCfg := toNetbirdConfig(nil, nil, nil, nil, settings)
+		nbCfg := toNetbirdConfig(nil, nil, nil, nil, types.TwinAccountSettings(settings))
 		assert.Nil(t, nbCfg, "fan-out updates must not carry a partial NetbirdConfig even when settings are present")
 	})
 
@@ -291,7 +293,7 @@ func TestToNetbirdConfig_RelayInvariant(t *testing.T) {
 		}
 		relayToken := &Token{Payload: "token-payload", Signature: "token-signature"}
 
-		nbCfg := toNetbirdConfig(cfg, nil, relayToken, nil, settings)
+		nbCfg := toNetbirdConfig(cfg, nil, relayToken, nil, types.TwinAccountSettings(settings))
 		require.NotNil(t, nbCfg)
 		require.NotNil(t, nbCfg.Relay, "non-nil NetbirdConfig must include the relay section")
 		assert.Equal(t, cfg.Relay.Addresses, nbCfg.Relay.Urls, "relay URLs should match the server config")
@@ -301,3 +303,35 @@ func TestToNetbirdConfig_RelayInvariant(t *testing.T) {
 		assert.True(t, nbCfg.Metrics.Enabled, "metrics flag should carry the settings value")
 	})
 }
+
+func TestToPeerConfig_RoutingPeerDNSResolution(t *testing.T) {
+	network := &types.Network{Net: net.IPNet{IP: net.IPv4(100, 0, 0, 0), Mask: net.CIDRMask(8, 32)}}
+
+	newPeer := func(embedded bool) *nbpeer.Peer {
+		p := &nbpeer.Peer{IP: netip.MustParseAddr("100.0.0.1")}
+		p.ProxyMeta.Embedded = embedded
+		return p
+	}
+
+	tests := []struct {
+		name        string
+		globalFlag  bool
+		embedded    bool
+		forceParam  bool
+		wantEnabled bool
+	}{
+		{name: "global off, regular peer, no force", wantEnabled: false},
+		{name: "global on wins", globalFlag: true, wantEnabled: true},
+		{name: "embedded proxy peer forced", embedded: true, wantEnabled: true},
+		{name: "routing peer forced via param", forceParam: true, wantEnabled: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			settings := &types.Settings{RoutingPeerDNSResolutionEnabled: tt.globalFlag}
+			cfg := toPeerConfig(types.TwinPeer(newPeer(tt.embedded)), types.TwinNetwork(network), "netbird.selfhosted", types.TwinAccountSettings(settings), nil, nil, false, tt.forceParam)
+			assert.Equal(t, tt.wantEnabled, cfg.RoutingPeerDnsResolutionEnabled,
+				"RoutingPeerDnsResolutionEnabled should reflect global || embedded || forced")
+		})
+	}
+}
diff --git a/management/internals/shared/grpc/loginfilter.go b/management/internals/shared/grpc/loginfilter.go
index cc69b7d6e..01ae67cc3 100644
--- a/management/internals/shared/grpc/loginfilter.go
+++ b/management/internals/shared/grpc/loginfilter.go
@@ -14,6 +14,7 @@ const (
 	baseBlockDuration = 10 * time.Minute // Duration for which a peer is banned after exceeding the reconnection limit
 	reconnLimitForBan = 30               // Number of reconnections within the reconnTreshold that triggers a ban
 	metaChangeLimit   = 5                // Number of reconnections with different metadata that triggers a ban of one peer
+	maxBanLevel       = 6                // Highest ban level; the ban duration doubles per level up to this one
 )
 
 type lfConfig struct {
@@ -21,6 +22,7 @@ type lfConfig struct {
 	baseBlockDuration time.Duration
 	reconnLimitForBan int
 	metaChangeLimit   int
+	maxBanLevel       int
 }
 
 func initCfg() *lfConfig {
@@ -29,6 +31,7 @@ func initCfg() *lfConfig {
 		baseBlockDuration: baseBlockDuration,
 		reconnLimitForBan: reconnLimitForBan,
 		metaChangeLimit:   metaChangeLimit,
+		maxBanLevel:       maxBanLevel,
 	}
 }
 
@@ -102,11 +105,18 @@ func (l *loginFilter) addLogin(wgPubKey string, metaHash uint64) {
 		return
 	}
 
-	if state.isBanned && now.After(state.banExpiresAt) {
+	if state.isBanned {
+		if now.Before(state.banExpiresAt) {
+			return
+		}
 		state.isBanned = false
 	}
 
-	if state.banLevel > 0 && now.Sub(state.lastSeen) > (2*l.cfg.baseBlockDuration) {
+	quietSince := state.lastSeen
+	if state.banExpiresAt.After(quietSince) {
+		quietSince = state.banExpiresAt
+	}
+	if state.banLevel > 0 && now.Sub(quietSince) > (2*l.cfg.baseBlockDuration) {
 		state.banLevel = 0
 	}
 
@@ -124,10 +134,17 @@ func (l *loginFilter) addLogin(wgPubKey string, metaHash uint64) {
 		return
 	}
 
+	if now.Sub(state.sessionStart) >= l.cfg.reconnThreshold {
+		state.sessionStart = now
+		state.sessionCounter = 0
+	}
+
 	state.sessionCounter++
-	if state.sessionCounter > l.cfg.reconnLimitForBan && now.Sub(state.sessionStart) < l.cfg.reconnThreshold {
+	if state.sessionCounter > l.cfg.reconnLimitForBan {
 		state.isBanned = true
-		state.banLevel++
+		if state.banLevel < l.cfg.maxBanLevel {
+			state.banLevel++
+		}
 
 		backoffFactor := math.Pow(2, float64(state.banLevel-1))
 		duration := time.Duration(float64(l.cfg.baseBlockDuration) * backoffFactor)
diff --git a/management/internals/shared/grpc/loginfilter_test.go b/management/internals/shared/grpc/loginfilter_test.go
index d9df26420..edc256550 100644
--- a/management/internals/shared/grpc/loginfilter_test.go
+++ b/management/internals/shared/grpc/loginfilter_test.go
@@ -20,6 +20,7 @@ func testAdvancedCfg() *lfConfig {
 		baseBlockDuration: 100 * time.Millisecond,
 		reconnLimitForBan: 3,
 		metaChangeLimit:   2,
+		maxBanLevel:       3,
 	}
 }
 
@@ -157,6 +158,187 @@ func (s *LoginFilterTestSuite) TestMetaChangeIsAllowedAfterWindowResets() {
 	s.Equal(1, s.filter.logged[pubKey].metaChangeCounter, "meta change counter should reset")
 }
 
+func (s *LoginFilterTestSuite) TestReconnectStormAfterQuietPeriodTriggersBan() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+
+	s.filter.addLogin(pubKey, meta)
+	s.Require().Contains(s.filter.logged, pubKey)
+	s.filter.logged[pubKey].sessionStart = time.Now().Add(-(s.filter.cfg.reconnThreshold + time.Second))
+
+	s.filter.addLogin(pubKey, meta)
+	s.Equal(1, s.filter.logged[pubKey].sessionCounter, "expired window should restart the count")
+
+	for i := 1; i < limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+	s.True(s.filter.allowLogin(pubKey, meta))
+	s.False(s.filter.logged[pubKey].isBanned)
+
+	s.filter.addLogin(pubKey, meta)
+
+	s.False(s.filter.allowLogin(pubKey, meta))
+	s.True(s.filter.logged[pubKey].isBanned)
+}
+
+func (s *LoginFilterTestSuite) TestReconnectStormAfterBanExpiresTriggersBanAgain() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+	s.Require().Contains(s.filter.logged, pubKey)
+	s.Require().True(s.filter.logged[pubKey].isBanned)
+
+	expired := time.Now().Add(-(s.filter.cfg.baseBlockDuration + time.Second))
+	s.filter.logged[pubKey].banExpiresAt = expired
+	s.filter.logged[pubKey].sessionStart = expired
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+
+	s.True(s.filter.logged[pubKey].isBanned)
+	s.Equal(2, s.filter.logged[pubKey].banLevel)
+}
+
+func (s *LoginFilterTestSuite) TestSlowReconnectsAcrossWindowsDoNotBan() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+
+	for i := 0; i < limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+	s.Require().Contains(s.filter.logged, pubKey)
+	s.filter.logged[pubKey].sessionStart = time.Now().Add(-(s.filter.cfg.reconnThreshold + time.Second))
+
+	for i := 0; i < limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+
+	s.True(s.filter.allowLogin(pubKey, meta))
+	s.False(s.filter.logged[pubKey].isBanned)
+}
+
+func (s *LoginFilterTestSuite) TestBanLevelEscalatesWhenStormResumesRightAfterBan() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+	banTime := time.Now().Add(-3 * s.filter.cfg.baseBlockDuration)
+
+	s.filter.logged[pubKey] = &peerState{
+		currentHash:  meta,
+		isBanned:     true,
+		banLevel:     1,
+		banExpiresAt: time.Now().Add(-time.Millisecond),
+		sessionStart: banTime,
+		lastSeen:     banTime,
+	}
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+
+	s.True(s.filter.logged[pubKey].isBanned)
+	s.Equal(2, s.filter.logged[pubKey].banLevel)
+}
+
+func (s *LoginFilterTestSuite) TestBanLevelResetsAfterQuietPeriodFollowingBan() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	quiet := 2*s.filter.cfg.baseBlockDuration + time.Second
+
+	s.filter.logged[pubKey] = &peerState{
+		currentHash:  meta,
+		banLevel:     2,
+		banExpiresAt: time.Now().Add(-s.filter.cfg.baseBlockDuration),
+		lastSeen:     time.Now().Add(-2 * quiet),
+	}
+
+	s.filter.addLogin(pubKey, meta)
+	s.Equal(2, s.filter.logged[pubKey].banLevel, "ban ended more recently than the quiet period")
+
+	s.filter.logged[pubKey].banExpiresAt = time.Now().Add(-quiet)
+	s.filter.logged[pubKey].lastSeen = time.Now().Add(-2 * quiet)
+
+	s.filter.addLogin(pubKey, meta)
+	s.Equal(0, s.filter.logged[pubKey].banLevel)
+}
+
+func (s *LoginFilterTestSuite) TestBanDurationIsCappedAtMaxLevel() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+	maxLevel := s.filter.cfg.maxBanLevel
+
+	s.filter.logged[pubKey] = &peerState{
+		currentHash:  meta,
+		banLevel:     maxLevel,
+		sessionStart: time.Now(),
+		lastSeen:     time.Now(),
+	}
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+
+	s.True(s.filter.logged[pubKey].isBanned)
+	s.Equal(maxLevel, s.filter.logged[pubKey].banLevel)
+	expected := s.filter.cfg.baseBlockDuration << (maxLevel - 1)
+	s.InDelta(expected, s.filter.logged[pubKey].banExpiresAt.Sub(s.filter.logged[pubKey].lastSeen), float64(time.Millisecond))
+}
+
+func (s *LoginFilterTestSuite) TestEstablishedPeerReconnectingOnceIsAllowed() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	longAgo := time.Now().Add(-time.Hour)
+
+	s.filter.logged[pubKey] = &peerState{
+		currentHash:           meta,
+		sessionCounter:        1,
+		sessionStart:          longAgo,
+		lastSeen:              longAgo,
+		metaChangeWindowStart: longAgo,
+		metaChangeCounter:     1,
+	}
+
+	s.True(s.filter.allowLogin(pubKey, meta))
+	s.filter.addLogin(pubKey, meta)
+
+	s.True(s.filter.allowLogin(pubKey, meta))
+	s.False(s.filter.logged[pubKey].isBanned)
+	s.Equal(1, s.filter.logged[pubKey].sessionCounter)
+}
+
+func (s *LoginFilterTestSuite) TestLoginsDuringActiveBanDoNotExtendIt() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+	s.Require().Contains(s.filter.logged, pubKey)
+	s.Require().True(s.filter.logged[pubKey].isBanned)
+	expiresAt := time.Now().Add(time.Hour)
+	s.filter.logged[pubKey].banExpiresAt = expiresAt
+	lastSeen := s.filter.logged[pubKey].lastSeen
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+
+	s.True(s.filter.logged[pubKey].isBanned)
+	s.Equal(1, s.filter.logged[pubKey].banLevel)
+	s.Equal(expiresAt, s.filter.logged[pubKey].banExpiresAt)
+	s.Equal(lastSeen, s.filter.logged[pubKey].lastSeen)
+	s.Equal(0, s.filter.logged[pubKey].sessionCounter)
+}
+
 func BenchmarkHashingMethods(b *testing.B) {
 	meta := nbpeer.PeerSystemMeta{
 		WtVersion:          "1.25.1",
diff --git a/management/internals/shared/grpc/peer_meta_test.go b/management/internals/shared/grpc/peer_meta_test.go
new file mode 100644
index 000000000..c6336ff1b
--- /dev/null
+++ b/management/internals/shared/grpc/peer_meta_test.go
@@ -0,0 +1,45 @@
+package grpc
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestExtractPeerMeta_RemovesNulAndInvalidUTF8(t *testing.T) {
+	meta := extractPeerMeta(context.Background(), &proto.PeerSystemMeta{
+		Hostname:        "host\x00name",
+		OS:              "\x00\x00\x00\x00\x00\x00s",
+		OSVersion:       "11\xff",
+		SysSerialNumber: "SN\x00\x00",
+		Environment:     &proto.Environment{Cloud: "\x00aws"},
+		NetworkAddresses: []*proto.NetworkAddress{
+			{NetIP: "192.168.0.1/24", Mac: "e0:d5\x00"},
+		},
+		Files: []*proto.File{{Path: "C:\\x\x00.exe"}},
+	})
+
+	assert.Equal(t, "hostname", meta.Hostname)
+	assert.Equal(t, "s", meta.OS)
+	assert.Equal(t, "11", meta.OSVersion)
+	assert.Equal(t, "SN", meta.SystemSerialNumber)
+	assert.Equal(t, "aws", meta.Environment.Cloud)
+	assert.Equal(t, "e0:d5", meta.NetworkAddresses[0].Mac)
+	assert.Equal(t, "C:\\x.exe", meta.Files[0].Path)
+}
+
+func TestCleanClientString(t *testing.T) {
+	tests := map[string]string{
+		"":                    "",
+		"\x00\x00":            "",
+		"Wïndows":             "Wïndows",
+		"ssh-ed25519 AAA\x00": "ssh-ed25519 AAA",
+		"bad\xc3\x28utf8":     "bad(utf8",
+	}
+	for in, want := range tests {
+		assert.Equal(t, want, cleanClientString(in), "input %q", in)
+	}
+}
diff --git a/management/internals/shared/grpc/peer_update_handler.go b/management/internals/shared/grpc/peer_update_handler.go
new file mode 100644
index 000000000..5037083c1
--- /dev/null
+++ b/management/internals/shared/grpc/peer_update_handler.go
@@ -0,0 +1,148 @@
+package grpc
+
+import (
+	"context"
+	"time"
+
+	"github.com/netbirdio/netbird/encryption"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/telemetry"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func PeerUpdateHandlerFactory(
+	peerKey wgtypes.Key,
+	updates chan *network_map.UpdateMessage,
+	secretsManager SecretsManager,
+	challenger *certposture.Challenger,
+	onChallengeStamped func(),
+	srv proto.ManagementService_SyncServer,
+	cleanupfunc func()) *PeerUpdateHandler {
+	return &PeerUpdateHandler{
+		peerKey:            peerKey,
+		updates:            updates,
+		secretsManager:     secretsManager,
+		challenger:         challenger,
+		onChallengeStamped: onChallengeStamped,
+		srv:                srv,
+		encrypter:          encryption.DefaultEncrypter{},
+		debouncer:          NewUpdateDebouncer(1000 * time.Millisecond),
+		cleanupFunc:        cleanupfunc,
+	}
+}
+
+// PeerUpdateHandler sends updates to the connected peer until the updates channel is closed.
+// It implements a backpressure mechanism that sends the first update immediately,
+// then debounces subsequent rapid updates, ensuring only the latest update is sent
+// after a quiet period.
+type PeerUpdateHandler struct {
+	peerKey        wgtypes.Key
+	updates        chan *network_map.UpdateMessage
+	appMetrics     telemetry.AppMetrics
+	secretsManager SecretsManager
+	challenger     *certposture.Challenger
+	// onChallengeStamped registers the account for renewal. Every push reaches this
+	// path, including the ones a REST update on another instance broadcasts, which is
+	// what lets an instance pick up an account whose peers never reconnect.
+	onChallengeStamped func()
+	srv                syncSender
+	encrypter          encryption.Encrypter
+	debouncer          Debouncer
+	cleanupFunc        func()
+}
+
+func (pu *PeerUpdateHandler) WithMetrics(appMetrics telemetry.AppMetrics) *PeerUpdateHandler {
+	pu.appMetrics = appMetrics
+	return pu
+}
+
+//go:generate go tool mockgen -source=./peer_update_handler.go -destination=./sync_sender_mock.go -package=grpc
+type syncSender interface {
+	Send(*proto.EncryptedMessage) error
+	Context() context.Context
+}
+
+func (pu *PeerUpdateHandler) HandleUpdates(ctx context.Context) error {
+	log.WithContext(ctx).Tracef("starting to handle updates for peer %s", pu.peerKey.String())
+
+	defer pu.debouncer.Stop()
+
+	for {
+		select {
+		// condition when there are some updates
+		// todo set the updates channel size to 1
+		case update, open := <-pu.updates:
+			if pu.appMetrics != nil {
+				pu.appMetrics.GRPCMetrics().UpdateChannelQueueLength(len(pu.updates) + 1)
+			}
+
+			if !open {
+				log.WithContext(ctx).Debugf("updates channel for peer %s was closed", pu.peerKey.String())
+				pu.cleanupFunc()
+				return nil
+			}
+
+			log.WithContext(ctx).Tracef("received an update for peer %s", pu.peerKey.String())
+			if pu.debouncer.ProcessUpdate(update) {
+				// Send immediately (first update or after quiet period)
+				if err := pu.SendUpdate(ctx, update); err != nil {
+					log.WithContext(ctx).Debugf("error while sending an update to peer %s: %v", pu.peerKey.String(), err)
+					return err
+				}
+			}
+
+		// Timer expired - quiet period reached, send pending updates if any
+		case <-pu.debouncer.TimerChannel():
+			pendingUpdates := pu.debouncer.GetPendingUpdates()
+			if len(pendingUpdates) == 0 {
+				continue
+			}
+			log.WithContext(ctx).Debugf("sending %d debounced update(s) for peer %s", len(pendingUpdates), pu.peerKey.String())
+			for _, pendingUpdate := range pendingUpdates {
+				if err := pu.SendUpdate(ctx, pendingUpdate); err != nil {
+					log.WithContext(ctx).Debugf("error while sending an update to peer %s: %v", pu.peerKey.String(), err)
+					return err
+				}
+			}
+
+		// condition when client <-> server connection has been terminated
+		case <-pu.srv.Context().Done():
+			// happens when connection drops, e.g. client disconnects
+			log.WithContext(ctx).Debugf("stream of peer %s has been closed", pu.peerKey.String())
+			pu.cleanupFunc()
+			return pu.srv.Context().Err()
+		}
+	}
+}
+
+func (pu *PeerUpdateHandler) SendUpdate(ctx context.Context, update *network_map.UpdateMessage) error {
+	key, err := pu.secretsManager.GetWGKey()
+	if err != nil {
+		pu.cleanupFunc()
+		return status.Errorf(codes.Internal, "failed processing update message")
+	}
+
+	if stampCertificateChallenges(update.Update.GetChecks(), pu.challenger, pu.peerKey) && pu.onChallengeStamped != nil {
+		pu.onChallengeStamped()
+	}
+	encryptedResp, err := pu.encrypter.EncryptMessage(pu.peerKey, key, update.Update)
+	if err != nil {
+		pu.cleanupFunc()
+		return status.Errorf(codes.Internal, "failed processing update message")
+	}
+	err = pu.srv.Send(&proto.EncryptedMessage{
+		WgPubKey: key.PublicKey().String(),
+		Body:     encryptedResp,
+	})
+	if err != nil {
+		pu.cleanupFunc()
+		return status.Errorf(codes.Internal, "failed sending update message")
+	}
+	log.WithContext(ctx).Tracef("sent an update to peer %s", pu.peerKey.String())
+	return nil
+}
diff --git a/management/internals/shared/grpc/peer_update_handler_test.go b/management/internals/shared/grpc/peer_update_handler_test.go
new file mode 100644
index 000000000..02de49c47
--- /dev/null
+++ b/management/internals/shared/grpc/peer_update_handler_test.go
@@ -0,0 +1,155 @@
+package grpc
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	pb "github.com/golang/protobuf/proto" //nolint
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+func TestSendPeerUpdates_FirstUpdate(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	secretsManager := NewMockSecretsManager(ctrl)
+	updateDebouncer := NewMockDebouncer(ctrl)
+	syncSender := NewMocksyncSender(ctrl)
+
+	pu := PeerUpdateHandler{
+		peerKey:        mustGenerateKey(t),
+		updates:        make(chan *network_map.UpdateMessage),
+		secretsManager: secretsManager,
+		encrypter:      testEncrypter{},
+		debouncer:      updateDebouncer,
+		srv:            syncSender,
+		cleanupFunc:    func() {},
+	}
+
+	msg := network_map.UpdateMessage{
+		Update: &proto.SyncResponse{Version: 1},
+	}
+
+	timeCh := make(chan time.Time)
+	srvCtx := context.TODO()
+	srvKey := mustGenerateKey(t)
+	// mock a first update, should send it right away
+	updateDebouncer.EXPECT().ProcessUpdate(gomock.Eq(&msg)).Return(true)
+	updateDebouncer.EXPECT().TimerChannel().AnyTimes().Return(timeCh)
+	syncSender.EXPECT().Context().AnyTimes().Return(srvCtx)
+	secretsManager.EXPECT().GetWGKey().Return(srvKey, nil)
+	syncSender.EXPECT().Send(pbMatcher{x: &proto.EncryptedMessage{WgPubKey: srvKey.PublicKey().String(), Body: mustMarshal(t, &msg)}})
+	updateDebouncer.EXPECT().Stop()
+
+	var wg sync.WaitGroup
+	wg.Go(func() { pu.HandleUpdates(context.TODO()) }) //nolint:errcheck
+	pu.updates <- &msg
+	close(pu.updates)
+	wg.Wait()
+}
+
+func TestSendPeerUpdates_TimerUpdate(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	secretsManager := NewMockSecretsManager(ctrl)
+	updateDebouncer := NewMockDebouncer(ctrl)
+	syncSender := NewMocksyncSender(ctrl)
+
+	pu := PeerUpdateHandler{
+		peerKey:        mustGenerateKey(t),
+		updates:        make(chan *network_map.UpdateMessage),
+		secretsManager: secretsManager,
+		encrypter:      testEncrypter{},
+		debouncer:      updateDebouncer,
+		srv:            syncSender,
+		cleanupFunc:    func() {},
+	}
+
+	msg := network_map.UpdateMessage{
+		Update: &proto.SyncResponse{Version: 1},
+	}
+
+	timeCh := make(chan time.Time)
+	srvCtx := context.TODO()
+	srvKey := mustGenerateKey(t)
+	updateDebouncer.EXPECT().GetPendingUpdates().Return([]*network_map.UpdateMessage{&msg})
+	updateDebouncer.EXPECT().TimerChannel().AnyTimes().Return(timeCh)
+	syncSender.EXPECT().Context().AnyTimes().Return(srvCtx)
+	secretsManager.EXPECT().GetWGKey().Return(srvKey, nil)
+	syncSender.EXPECT().Send(pbMatcher{x: &proto.EncryptedMessage{WgPubKey: srvKey.PublicKey().String(), Body: mustMarshal(t, &msg)}})
+	updateDebouncer.EXPECT().Stop()
+
+	var wg sync.WaitGroup
+	wg.Go(func() { pu.HandleUpdates(context.TODO()) }) //nolint:errcheck
+	timeCh <- time.Now()
+	close(pu.updates)
+	wg.Wait()
+}
+
+func TestSendPeerUpdates_ServerContextDone(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	secretsManager := NewMockSecretsManager(ctrl)
+	updateDebouncer := NewMockDebouncer(ctrl)
+	syncSender := NewMocksyncSender(ctrl)
+
+	pu := PeerUpdateHandler{
+		peerKey:        mustGenerateKey(t),
+		updates:        make(chan *network_map.UpdateMessage),
+		secretsManager: secretsManager,
+		encrypter:      testEncrypter{},
+		debouncer:      updateDebouncer,
+		srv:            syncSender,
+		cleanupFunc:    func() {},
+	}
+
+	timeCh := make(chan time.Time)
+	srvCtx, cancel := context.WithCancel(context.TODO())
+	updateDebouncer.EXPECT().TimerChannel().AnyTimes().Return(timeCh)
+	syncSender.EXPECT().Context().AnyTimes().Return(srvCtx)
+	updateDebouncer.EXPECT().Stop()
+
+	var wg sync.WaitGroup
+	wg.Go(func() { pu.HandleUpdates(context.TODO()) }) //nolint:errcheck
+	cancel()
+	wg.Wait()
+}
+
+func mustGenerateKey(t *testing.T) wgtypes.Key {
+	t.Helper()
+	k, err := wgtypes.GenerateKey()
+	assert.NoError(t, err)
+	return k
+}
+
+func mustMarshal(t *testing.T, msg *network_map.UpdateMessage) []byte {
+	t.Helper()
+	r, err := pb.Marshal(msg.Update)
+	assert.NoError(t, err)
+	return r
+}
+
+type testEncrypter struct{}
+
+func (testEncrypter) EncryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, message pb.Message) ([]byte, error) {
+	return pb.Marshal(message)
+}
+
+type pbMatcher struct {
+	x pb.Message
+}
+
+func (pbm pbMatcher) Matches(x any) bool {
+	msg, ok := x.(pb.Message)
+	if !ok {
+		return false
+	}
+	return pb.Equal(pbm.x, msg)
+}
+
+func (pbm pbMatcher) String() string {
+	return fmt.Sprintf("is equal to %s (%T)", pbm.x, pbm.x)
+}
diff --git a/management/internals/shared/grpc/pkce_flow_test.go b/management/internals/shared/grpc/pkce_flow_test.go
new file mode 100644
index 000000000..8724bacd8
--- /dev/null
+++ b/management/internals/shared/grpc/pkce_flow_test.go
@@ -0,0 +1,87 @@
+package grpc
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/client/common"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestApplySessionExtendFlowPolicy(t *testing.T) {
+	tests := []struct {
+		name               string
+		flow               *proto.PKCEAuthorizationFlow
+		sessionExtend      bool
+		disablePromptLogin bool
+		loginFlag          uint32
+	}{
+		{
+			name: "extend replaces max_age=0 so login_hint is honoured",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: false,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagPromptLogin),
+		},
+		{
+			name: "extend replaces the none flag so the extend is not silent",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: false,
+					LoginFlag:          uint32(common.LoginFlagNone),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagPromptLogin),
+		},
+		{
+			name: "extend respects DisablePromptLogin",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: true,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: true,
+			loginFlag:          uint32(common.LoginFlagMaxAge0),
+		},
+		{
+			name: "login keeps the configured flow untouched",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: false,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      false,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagMaxAge0),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			applySessionExtendFlowPolicy(tc.flow, tc.sessionExtend)
+			cfg := tc.flow.GetProviderConfig()
+			assert.Equal(t, tc.disablePromptLogin, cfg.GetDisablePromptLogin())
+			assert.Equal(t, tc.loginFlag, cfg.GetLoginFlag())
+		})
+	}
+}
+
+// A provider config is not guaranteed to be present on the response; clearing
+// the flag must not panic when the validator returned an empty flow.
+func TestApplySessionExtendFlowPolicyWithoutProviderConfig(t *testing.T) {
+	assert.NotPanics(t, func() {
+		applySessionExtendFlowPolicy(&proto.PKCEAuthorizationFlow{}, true)
+		applySessionExtendFlowPolicy(nil, true)
+	})
+}
diff --git a/management/internals/shared/grpc/pkce_verifier.go b/management/internals/shared/grpc/pkce_verifier.go
deleted file mode 100644
index a1325256c..000000000
--- a/management/internals/shared/grpc/pkce_verifier.go
+++ /dev/null
@@ -1,54 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	"github.com/eko/gocache/lib/v4/cache"
-	"github.com/eko/gocache/lib/v4/store"
-	log "github.com/sirupsen/logrus"
-)
-
-// PKCEVerifierStore manages PKCE verifiers for OAuth flows.
-// Supports both in-memory and Redis storage via NB_IDP_CACHE_REDIS_ADDRESS env var.
-type PKCEVerifierStore struct {
-	cache *cache.Cache[string]
-	ctx   context.Context
-}
-
-// NewPKCEVerifierStore creates a PKCE verifier store using the provided shared cache store.
-func NewPKCEVerifierStore(ctx context.Context, cacheStore store.StoreInterface) *PKCEVerifierStore {
-	return &PKCEVerifierStore{
-		cache: cache.New[string](cacheStore),
-		ctx:   ctx,
-	}
-}
-
-// Store saves a PKCE verifier associated with an OAuth state parameter.
-// The verifier is stored with the specified TTL and will be automatically deleted after expiration.
-func (s *PKCEVerifierStore) Store(state, verifier string, ttl time.Duration) error {
-	if err := s.cache.Set(s.ctx, state, verifier, store.WithExpiration(ttl)); err != nil {
-		return fmt.Errorf("failed to store PKCE verifier: %w", err)
-	}
-
-	log.Debugf("Stored PKCE verifier for state (expires in %s)", ttl)
-	return nil
-}
-
-// LoadAndDelete retrieves and removes a PKCE verifier for the given state.
-// Returns the verifier and true if found, or empty string and false if not found.
-// This enforces single-use semantics for PKCE verifiers.
-func (s *PKCEVerifierStore) LoadAndDelete(state string) (string, bool) {
-	verifier, err := s.cache.Get(s.ctx, state)
-	if err != nil {
-		log.Debugf("PKCE verifier not found for state")
-		return "", false
-	}
-
-	if err := s.cache.Delete(s.ctx, state); err != nil {
-		log.Warnf("Failed to delete PKCE verifier for state: %v", err)
-	}
-
-	return verifier, true
-}
diff --git a/management/internals/shared/grpc/proxy.go b/management/internals/shared/grpc/proxy.go
index 0dfa24bc4..439ff1dba 100644
--- a/management/internals/shared/grpc/proxy.go
+++ b/management/internals/shared/grpc/proxy.go
@@ -27,20 +27,20 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	"github.com/netbirdio/netbird/shared/management/domain"
-
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/management/server/users"
 	proxyauth "github.com/netbirdio/netbird/proxy/auth"
 	"github.com/netbirdio/netbird/shared/hash/argon2id"
+	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	nbstatus "github.com/netbirdio/netbird/shared/management/status"
 )
@@ -61,6 +61,17 @@ type ProxyTokenChecker interface {
 	IsProxyAccessTokenValid(ctx context.Context, tokenID string) (bool, error)
 }
 
+// ProxyConnectAuthorizer authorizes a proxy's claim to the cluster address it
+// declares at connect time. Implementations are supplied by integrations; none
+// is installed by default, so every well-formed claim is authorized — the
+// declared address is otherwise only checked for availability. token is nil
+// when the connection carries no proxy access token. A returned status error
+// is sent to the proxy unchanged; any other error is wrapped as
+// PermissionDenied.
+type ProxyConnectAuthorizer interface {
+	AuthorizeProxyConnect(ctx context.Context, token *types.ProxyAccessToken, proxyID, address string) error
+}
+
 // ProxyServiceServer implements the ProxyService gRPC server
 // AgentNetworkSynthesizer produces in-memory reverse-proxy services from
 // Agent Network provider/policy state for the proxy snapshot path; synthesised
@@ -90,7 +101,8 @@ type ProxyServiceServer struct {
 
 	mu sync.RWMutex
 	// Manager for reverse proxy operations
-	serviceManager rpservice.Manager
+	serviceManager   rpservice.Manager
+	credentialLimits credentialVerificationLimiter
 	// agentNetworkSynth produces synthesised reverse-proxy services from
 	// Agent Network state. Optional — when nil the snapshot path only ships
 	// persisted services.
@@ -99,6 +111,9 @@ type ProxyServiceServer struct {
 	// and the post-flight consumption write (RecordLLMUsage). Optional — when
 	// nil both RPCs return Unimplemented.
 	agentNetworkLimits AgentNetworkLimitsService
+	// connectAuthorizer authorizes address claims at proxy connect time.
+	// Optional — when nil every well-formed claim is authorized.
+	connectAuthorizer ProxyConnectAuthorizer
 	// ProxyController for service updates and cluster management
 	proxyController proxy.Controller
 
@@ -114,6 +129,9 @@ type ProxyServiceServer struct {
 	// Manager for IdP-enriched user data (may be nil when no IdP is configured)
 	idpManager idp.Manager
 
+	// Manager that records reverse proxy usage for activity accounting
+	activityManager activity.Manager
+
 	// Store for one-time authentication tokens
 	tokenStore *OneTimeTokenStore
 
@@ -123,8 +141,8 @@ type ProxyServiceServer struct {
 	// OIDC configuration for proxy authentication
 	oidcConfig ProxyOIDCConfig
 
-	// Store for PKCE verifiers
-	pkceVerifierStore *PKCEVerifierStore
+	// singleUseStore backs both PKCE verifiers and OIDC session exchange codes.
+	singleUseStore *SingleUseStore
 
 	// tokenTTL is the lifetime of one-time tokens generated for proxy
 	// authentication. Defaults to defaultProxyTokenTTL when zero.
@@ -134,15 +152,28 @@ type ProxyServiceServer struct {
 	// initial snapshot delivery. Configurable via NB_PROXY_SNAPSHOT_BATCH_SIZE.
 	snapshotBatchSize int
 
+	// snapshotAckTimeout bounds the wait for each snapshot batch ack.
+	// Defaults to defaultSnapshotAckTimeout when zero.
+	snapshotAckTimeout time.Duration
+
 	cancel context.CancelFunc
 }
 
 const pkceVerifierTTL = 10 * time.Minute
 
+const sessionCodeTTL = 60 * time.Second
+
+const sessionCodeCacheNamespace = "proxy:session"
+
+// The signed nonce binds the handoff mode without changing the state format.
+const sessionCodeNoncePrefix = "code."
+
 const defaultProxyTokenTTL = 5 * time.Minute
 
 const defaultSnapshotBatchSize = 500
 
+const defaultSnapshotAckTimeout = 5 * time.Minute
+
 func snapshotBatchSizeFromEnv() int {
 	if v := os.Getenv("NB_PROXY_SNAPSHOT_BATCH_SIZE"); v != "" {
 		if n, err := strconv.Atoi(v); err == nil && n > 0 {
@@ -160,6 +191,14 @@ func (s *ProxyServiceServer) proxyTokenTTL() time.Duration {
 	return defaultProxyTokenTTL
 }
 
+// snapshotAckWait returns the configured snapshot ack timeout or the default when unset.
+func (s *ProxyServiceServer) snapshotAckWait() time.Duration {
+	if s.snapshotAckTimeout > 0 {
+		return s.snapshotAckTimeout
+	}
+	return defaultSnapshotAckTimeout
+}
+
 // proxyConnection represents a connected proxy
 type proxyConnection struct {
 	proxyID      string
@@ -189,13 +228,13 @@ func enforceAccountScope(ctx context.Context, requestAccountID string) error {
 }
 
 // NewProxyServiceServer creates a new proxy service server.
-func NewProxyServiceServer(accessLogMgr accesslogs.Manager, tokenStore *OneTimeTokenStore, pkceStore *PKCEVerifierStore, oidcConfig ProxyOIDCConfig, peersManager peers.Manager, usersManager users.Manager, idpManager idp.Manager, proxyMgr proxy.Manager, tokenChecker ProxyTokenChecker) *ProxyServiceServer {
+func NewProxyServiceServer(accessLogMgr accesslogs.Manager, tokenStore *OneTimeTokenStore, singleUseStore *SingleUseStore, oidcConfig ProxyOIDCConfig, peersManager peers.Manager, usersManager users.Manager, idpManager idp.Manager, proxyMgr proxy.Manager, tokenChecker ProxyTokenChecker) *ProxyServiceServer {
 	ctx, cancel := context.WithCancel(context.Background())
 	s := &ProxyServiceServer{
 		accessLogManager:  accessLogMgr,
 		oidcConfig:        oidcConfig,
 		tokenStore:        tokenStore,
-		pkceVerifierStore: pkceStore,
+		singleUseStore:    singleUseStore,
 		peersManager:      peersManager,
 		usersManager:      usersManager,
 		idpManager:        idpManager,
@@ -224,9 +263,10 @@ func (s *ProxyServiceServer) cleanupStaleProxies(ctx context.Context) {
 	}
 }
 
-// Close stops background goroutines.
+// Close stops background goroutines and releases credential verification state.
 func (s *ProxyServiceServer) Close() {
 	s.cancel()
+	s.credentialLimits.close()
 }
 
 // SetServiceManager sets the service manager. Must be called before serving.
@@ -236,6 +276,13 @@ func (s *ProxyServiceServer) SetServiceManager(manager rpservice.Manager) {
 	s.serviceManager = manager
 }
 
+// SetActivityManager wires the manager that records reverse proxy usage.
+func (s *ProxyServiceServer) SetActivityManager(manager activity.Manager) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.activityManager = manager
+}
+
 // SetAgentNetworkSynthesizer wires the agent-network service synthesiser.
 // Optional — when nil the snapshot path skips agent-network synthesis. The
 // modules layer injects this after both the proxy server and the agent-network
@@ -262,6 +309,33 @@ func (s *ProxyServiceServer) agentNetworkSynthesizer() AgentNetworkSynthesizer {
 	return s.agentNetworkSynth
 }
 
+// SetProxyConnectAuthorizer wires the connect-time address-claim authorizer.
+// Optional — when nil (the default) every well-formed claim is authorized,
+// which is the behavior without the hook. The modules layer injects this
+// after the proxy server is constructed, like the other setters.
+func (s *ProxyServiceServer) SetProxyConnectAuthorizer(authorizer ProxyConnectAuthorizer) {
+	s.mu.Lock()
+	s.connectAuthorizer = authorizer
+	s.mu.Unlock()
+}
+
+// proxyConnectAuthorizer returns the connect authorizer under read lock.
+func (s *ProxyServiceServer) proxyConnectAuthorizer() ProxyConnectAuthorizer {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.connectAuthorizer
+}
+
+// GenerateSessionCode creates a single-use code for the given session token.
+func (s *ProxyServiceServer) GenerateSessionCode(sessionToken string) (code string, ok bool) {
+	code, err := s.singleUseStore.Generate(sessionCodeCacheNamespace, sessionToken, sessionCodeTTL)
+	if err != nil {
+		log.WithError(err).Error("failed to generate proxy session code")
+		return "", false
+	}
+	return code, true
+}
+
 // CheckLLMPolicyLimits is the pre-flight policy gate the proxy calls before
 // forwarding an LLM request upstream. Delegates to the agent-network selector,
 // which scores applicable policies by remaining headroom and returns the
@@ -285,6 +359,7 @@ func (s *ProxyServiceServer) CheckLLMPolicyLimits(ctx context.Context, req *prot
 		UserID:     req.GetUserId(),
 		GroupIDs:   req.GetGroupIds(),
 		ProviderID: req.GetProviderId(),
+		Model:      req.GetModel(),
 	})
 	if err != nil {
 		log.WithContext(ctx).Errorf("select policy for request: %v", err)
@@ -369,6 +444,7 @@ func (s *ProxyServiceServer) SetProxyController(proxyController proxy.Controller
 type proxyConnectParams struct {
 	proxyID      string
 	address      string
+	version      string
 	capabilities *proto.ProxyCapabilities
 }
 
@@ -379,6 +455,7 @@ func (s *ProxyServiceServer) GetMappingUpdate(req *proto.GetMappingUpdateRequest
 		return err
 	}
 	params.capabilities = req.GetCapabilities()
+	params.version = req.GetVersion()
 
 	conn, proxyRecord, err := s.registerProxyConnection(stream.Context(), params, &proxyConnection{
 		stream: stream,
@@ -412,6 +489,7 @@ func (s *ProxyServiceServer) SyncMappings(stream proto.ProxyService_SyncMappings
 		return err
 	}
 	params.capabilities = init.GetCapabilities()
+	params.version = init.GetVersion()
 
 	conn, proxyRecord, err := s.registerProxyConnection(stream.Context(), params, &proxyConnection{
 		syncStream: stream,
@@ -420,7 +498,7 @@ func (s *ProxyServiceServer) SyncMappings(stream proto.ProxyService_SyncMappings
 		return err
 	}
 
-	if err := s.sendSnapshotSync(stream.Context(), conn, stream); err != nil {
+	if err := s.sendSnapshotSync(conn.ctx, conn, stream); err != nil {
 		s.cleanupFailedSnapshot(stream.Context(), conn)
 		return fmt.Errorf("send snapshot to proxy %s: %w", params.proxyID, err)
 	}
@@ -445,8 +523,9 @@ func recvSyncInit(stream proto.ProxyService_SyncMappingsServer) (*proto.SyncMapp
 	return init, nil
 }
 
-// validateProxyConnect validates the proxy ID and address, and checks cluster
-// address availability for account-scoped tokens.
+// validateProxyConnect validates the proxy ID and address, checks cluster
+// address availability for account-scoped tokens, and finally consults the
+// connect authorizer (when installed) on the address claim.
 func (s *ProxyServiceServer) validateProxyConnect(proxyID, address string, ctx context.Context) (proxyConnectParams, error) {
 	if proxyID == "" {
 		return proxyConnectParams{}, status.Errorf(codes.InvalidArgument, "proxy_id is required")
@@ -466,6 +545,19 @@ func (s *ProxyServiceServer) validateProxyConnect(proxyID, address string, ctx c
 		}
 	}
 
+	// The authorizer runs last, outside the account-scoped branch, so it also
+	// sees management-wide and token-less connects. PermissionDenied keeps an
+	// authorization rejection distinguishable from the AlreadyExists address
+	// conflict above in proxy logs.
+	if authorizer := s.proxyConnectAuthorizer(); authorizer != nil {
+		if err := authorizer.AuthorizeProxyConnect(ctx, token, proxyID, address); err != nil {
+			if _, ok := status.FromError(err); ok {
+				return proxyConnectParams{}, err
+			}
+			return proxyConnectParams{}, status.Errorf(codes.PermissionDenied, "proxy connect not authorized: %v", err)
+		}
+	}
+
 	return proxyConnectParams{proxyID: proxyID, address: address}, nil
 }
 
@@ -509,7 +601,7 @@ func (s *ProxyServiceServer) registerProxyConnection(ctx context.Context, params
 		}
 	}
 
-	proxyRecord, err := s.proxyManager.Connect(ctx, params.proxyID, sessionID, params.address, peerInfo, accountID, caps)
+	proxyRecord, err := s.proxyManager.Connect(ctx, params.proxyID, sessionID, params.address, peerInfo, params.version, accountID, caps)
 	if err != nil {
 		cancel()
 		if accountID != nil {
@@ -608,11 +700,11 @@ func (s *ProxyServiceServer) disconnectProxy(conn *proxyConnection) {
 	if err := s.proxyController.UnregisterProxyFromCluster(context.Background(), conn.address, conn.proxyID); err != nil {
 		log.Warnf("Failed to unregister proxy %s from cluster: %v", conn.proxyID, err)
 	}
+	conn.cancel()
 	if err := s.proxyManager.Disconnect(context.Background(), conn.proxyID, conn.sessionID); err != nil {
 		log.Warnf("Failed to mark proxy %s as disconnected: %v", conn.proxyID, err)
 	}
 
-	conn.cancel()
 	log.Infof("Proxy %s session %s disconnected", conn.proxyID, conn.sessionID)
 }
 
@@ -650,7 +742,7 @@ func (s *ProxyServiceServer) sendSnapshotSync(ctx context.Context, conn *proxyCo
 			return fmt.Errorf("send snapshot batch: %w", err)
 		}
 
-		if err := waitForAck(stream); err != nil {
+		if err := waitForAck(ctx, stream, s.snapshotAckWait()); err != nil {
 			return err
 		}
 	}
@@ -662,7 +754,7 @@ func (s *ProxyServiceServer) sendSnapshotSync(ctx context.Context, conn *proxyCo
 			return fmt.Errorf("send snapshot completion: %w", err)
 		}
 
-		if err := waitForAck(stream); err != nil {
+		if err := waitForAck(ctx, stream, s.snapshotAckWait()); err != nil {
 			return err
 		}
 	}
@@ -670,15 +762,38 @@ func (s *ProxyServiceServer) sendSnapshotSync(ctx context.Context, conn *proxyCo
 	return nil
 }
 
-func waitForAck(stream proto.ProxyService_SyncMappingsServer) error {
-	msg, err := stream.Recv()
-	if err != nil {
-		return fmt.Errorf("receive ack: %w", err)
+// waitForAck waits for the proxy to ack a snapshot batch. It gives up when ctx
+// is canceled or no ack arrives within timeout, since a proxy that abandoned the
+// stream without closing it would otherwise block the handler indefinitely.
+func waitForAck(ctx context.Context, stream proto.ProxyService_SyncMappingsServer, timeout time.Duration) error {
+	type recvResult struct {
+		msg *proto.SyncMappingsRequest
+		err error
 	}
-	if msg.GetAck() == nil {
-		return fmt.Errorf("expected ack, got %T", msg.GetMsg())
+	// Recv returns once the handler exits and gRPC tears the stream down.
+	result := make(chan recvResult, 1)
+	go func() {
+		msg, err := stream.Recv()
+		result <- recvResult{msg: msg, err: err}
+	}()
+
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+
+	select {
+	case r := <-result:
+		if r.err != nil {
+			return fmt.Errorf("receive ack: %w", r.err)
+		}
+		if r.msg.GetAck() == nil {
+			return fmt.Errorf("expected ack, got %T", r.msg.GetMsg())
+		}
+		return nil
+	case <-ctx.Done():
+		return fmt.Errorf("wait for ack: %w", ctx.Err())
+	case <-timer.C:
+		return fmt.Errorf("no ack within %s", timeout)
 	}
-	return nil
 }
 
 // heartbeat updates the proxy's last_seen timestamp every minute and
@@ -1166,6 +1281,7 @@ func shallowCloneMapping(m *proto.ProxyMapping) *proto.ProxyMapping {
 	}
 }
 
+// Authenticate verifies service credentials and issues a session token.
 func (s *ProxyServiceServer) Authenticate(ctx context.Context, req *proto.AuthenticateRequest) (*proto.AuthenticateResponse, error) {
 	if err := enforceAccountScope(ctx, req.GetAccountId()); err != nil {
 		return nil, err
@@ -1177,6 +1293,14 @@ func (s *ProxyServiceServer) Authenticate(ctx context.Context, req *proto.Authen
 		return nil, status.Errorf(codes.FailedPrecondition, "get service from store: %v", err)
 	}
 
+	switch req.GetRequest().(type) {
+	case *proto.AuthenticateRequest_Pin, *proto.AuthenticateRequest_Password:
+		key := credentialVerificationKey{accountID: credentialAccountID(service.AccountID), serviceID: credentialServiceID(service.ID)}
+		if err := s.credentialLimits.allow(key); err != nil {
+			return nil, err
+		}
+	}
+
 	authenticated, userId, method := s.authenticateRequest(ctx, req, service)
 
 	// Non-OIDC schemes (PIN/Password/Header) authenticate against per-service
@@ -1254,7 +1378,7 @@ func (s *ProxyServiceServer) authenticateHeader(ctx context.Context, serviceID s
 			lastErr = err
 			continue
 		}
-		return true, "header-user", proxyauth.MethodHeader
+		return true, proxyauth.HeaderUserID, proxyauth.MethodHeader
 	}
 
 	if lastErr != nil {
@@ -1465,18 +1589,20 @@ func (s *ProxyServiceServer) GetOIDCURL(ctx context.Context, req *proto.GetOIDCU
 		log.WithContext(ctx).Errorf("failed to get account services: %v", err)
 		return nil, status.Errorf(codes.FailedPrecondition, "get account services: %v", err)
 	}
-	var found bool
+	var matchedService *rpservice.Service
 	for _, service := range services {
 		if service.Domain == redirectURL.Hostname() {
-			found = true
+			matchedService = service
 			break
 		}
 	}
-	if !found {
+	if matchedService == nil {
 		log.WithContext(ctx).Debugf("OIDC redirect URL %q does not match any service domain", redirectURL.Hostname())
 		return nil, status.Errorf(codes.FailedPrecondition, "service not found in store")
 	}
 
+	useSessionCode := s.proxyManager.ClusterSupportsSessionCode(ctx, matchedService.ProxyCluster)
+
 	provider, err := oidc.NewProvider(ctx, s.oidcConfig.Issuer)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to create OIDC provider: %v", err)
@@ -1496,15 +1622,18 @@ func (s *ProxyServiceServer) GetOIDCURL(ctx context.Context, req *proto.GetOIDCU
 		return nil, status.Errorf(codes.Internal, "generate nonce: %v", err)
 	}
 	nonceB64 := base64.URLEncoding.EncodeToString(nonce)
+	if useSessionCode {
+		nonceB64 = sessionCodeNoncePrefix + nonceB64
+	}
 
 	// Using an HMAC here to avoid redirection state being modified.
-	// State format: base64(redirectURL)|nonce|hmac(redirectURL|nonce)
+	// State format: base64(redirectURL)|[code.]nonce|hmac(redirectURL|nonce)
 	payload := redirectURL.String() + "|" + nonceB64
 	hmacSum := s.generateHMAC(payload)
 	state := fmt.Sprintf("%s|%s|%s", base64.URLEncoding.EncodeToString([]byte(redirectURL.String())), nonceB64, hmacSum)
 
 	codeVerifier := oauth2.GenerateVerifier()
-	if err := s.pkceVerifierStore.Store(state, codeVerifier, pkceVerifierTTL); err != nil {
+	if err := s.singleUseStore.Store(state, codeVerifier, pkceVerifierTTL); err != nil {
 		log.WithContext(ctx).Errorf("failed to store PKCE verifier: %v", err)
 		return nil, status.Errorf(codes.Internal, "store PKCE verifier: %v", err)
 	}
@@ -1541,15 +1670,12 @@ func (s *ProxyServiceServer) generateHMAC(input string) string {
 	return hex.EncodeToString(mac.Sum(nil))
 }
 
-// ValidateState validates the state parameter from an OAuth callback.
-// Returns the original redirect URL if valid, or an error if invalid.
-// The HMAC is verified before consuming the PKCE verifier to prevent
-// an attacker from invalidating a legitimate user's auth flow.
-func (s *ProxyServiceServer) ValidateState(state string) (verifier, redirectURL string, err error) {
-	// State format: base64(redirectURL)|nonce|hmac(redirectURL|nonce)
+// ValidateState validates and consumes an OIDC state.
+func (s *ProxyServiceServer) ValidateState(state string) (verifier, redirectURL string, useSessionCode bool, err error) {
+	// State format: base64(redirectURL)|[code.]nonce|hmac(redirectURL|nonce)
 	parts := strings.Split(state, "|")
 	if len(parts) != 3 {
-		return "", "", errors.New("invalid state format")
+		return "", "", false, errors.New("invalid state format")
 	}
 
 	encodedURL := parts[0]
@@ -1558,7 +1684,7 @@ func (s *ProxyServiceServer) ValidateState(state string) (verifier, redirectURL
 
 	redirectURLBytes, err := base64.URLEncoding.DecodeString(encodedURL)
 	if err != nil {
-		return "", "", fmt.Errorf("invalid state encoding: %w", err)
+		return "", "", false, fmt.Errorf("invalid state encoding: %w", err)
 	}
 	redirectURL = string(redirectURLBytes)
 
@@ -1566,21 +1692,115 @@ func (s *ProxyServiceServer) ValidateState(state string) (verifier, redirectURL
 	expectedHMAC := s.generateHMAC(payload)
 
 	if !hmac.Equal([]byte(providedHMAC), []byte(expectedHMAC)) {
-		return "", "", errors.New("invalid state signature")
+		return "", "", false, errors.New("invalid state signature")
 	}
+	useSessionCode = strings.HasPrefix(nonce, sessionCodeNoncePrefix)
 
 	// Consume the PKCE verifier only after HMAC validation passes.
-	verifier, ok := s.pkceVerifierStore.LoadAndDelete(state)
+	verifier, ok := s.singleUseStore.LoadAndDelete(state)
 	if !ok {
-		return "", "", errors.New("no verifier for state")
+		return "", "", false, errors.New("no verifier for state")
 	}
 
-	return verifier, redirectURL, nil
+	return verifier, redirectURL, useSessionCode, nil
+}
+
+// Denied reasons reported to the proxy when access is refused because of the
+// account status of the user behind the request.
+const (
+	deniedReasonPendingApproval = "pending_approval"
+	deniedReasonUserBlocked     = "user_blocked"
+	deniedReasonUserNotFound    = "user_not_found"
+)
+
+var (
+	// ErrUserPendingApproval reports a user whose account still awaits approval
+	// by an administrator and may therefore not hold a proxy session.
+	ErrUserPendingApproval = errors.New("user pending approval")
+
+	// ErrUserBlocked reports a blocked user, who may not hold a proxy session.
+	ErrUserBlocked = errors.New("user blocked")
+
+	// ErrUserNotInGroup reports a user outside the service's distribution
+	// groups, who may not hold a proxy session for it.
+	ErrUserNotInGroup = errors.New("user not in allowed groups")
+
+	errUserUnresolved = errors.New("user could not be resolved")
+)
+
+// checkUserStatus reports whether the user's account status permits reverse
+// proxy access, returning the denied reason for the proxy access log together
+// with the sentinel error callers match on. A user awaiting approval is stored
+// as both pending and blocked, so the pending state is reported first: it is
+// the one an administrator can act on.
+func checkUserStatus(user *types.User) (string, error) {
+	switch {
+	case user == nil:
+		return deniedReasonUserNotFound, errUserUnresolved
+	case user.PendingApproval:
+		return deniedReasonPendingApproval, ErrUserPendingApproval
+	case user.IsBlocked():
+		return deniedReasonUserBlocked, ErrUserBlocked
+	default:
+		return "", nil
+	}
+}
+
+// userStatusDeniedReason returns the denied reason for callers that report a
+// decision rather than an error, and an empty string when the user may proceed.
+func userStatusDeniedReason(user *types.User) string {
+	reason, _ := checkUserStatus(user)
+	return reason
+}
+
+// sameAccount reports whether a user belongs to a service's account. An empty
+// identifier on either side never matches: two unset accounts must not compare
+// equal into a grant.
+func sameAccount(userAccountID, serviceAccountID string) bool {
+	return userAccountID != "" && serviceAccountID != "" && userAccountID == serviceAccountID
+}
+
+// resolveUserEmail returns the user's stored email, else the email claim of
+// an already validated session token, else the IdP's email. The claim was
+// resolved the same way when the token was signed, so reusing it saves the
+// IdP round-trip on every validation. An IdP failure yields an empty string.
+func (s *ProxyServiceServer) resolveUserEmail(ctx context.Context, accountID string, user *types.User, tokenEmail string) string {
+	if user.Email != "" {
+		return user.Email
+	}
+	if tokenEmail != "" {
+		return tokenEmail
+	}
+	return s.idpEmail(ctx, accountID, user.Id)
+}
+
+// idpEmail looks up a user's email at the IdP, scoped to the given account.
+// It returns an empty string when no IdP is configured, the lookup fails or
+// the IdP knows no email for the user.
+func (s *ProxyServiceServer) idpEmail(ctx context.Context, accountID, userID string) string {
+	if s.idpManager == nil {
+		return ""
+	}
+
+	userData, err := s.idpManager.GetUserDataByID(ctx, userID, idp.AppMetadata{WTAccountID: accountID})
+	if err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{"user_id": userID, "error": err.Error()}).Debug("IdP email lookup failed; using stored identity")
+		return ""
+	}
+	if userData == nil {
+		return ""
+	}
+
+	return userData.Email
 }
 
 // GenerateSessionToken creates a signed session JWT for the given domain and
 // user. The user's group memberships are embedded in the token so policy-aware
 // middlewares on the proxy can authorise without an extra management round-trip.
+// A user the store cannot resolve, whose account is pending approval or blocked,
+// or who is outside the service's distribution groups, gets no token at all: the
+// token is a bearer credential for the service, so authorisation has to run
+// before it is signed rather than only when the proxy presents it back.
 func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, userID string, method proxyauth.Method) (string, error) {
 	service, err := s.getServiceByDomain(ctx, domain)
 	if err != nil {
@@ -1591,31 +1811,70 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 		return "", fmt.Errorf("no session key configured for domain: %s", domain)
 	}
 
-	var (
-		email      string
-		groupIDs   []string
-		groupNames []string
-	)
-	if s.usersManager != nil {
-		user, userGroups, uerr := s.usersManager.GetUserWithGroups(ctx, userID)
-		if uerr != nil {
-			log.WithContext(ctx).Debugf("session token mint: lookup user %s: %v", userID, uerr)
-		} else if user != nil {
-			email = user.Email
-			groupIDs, groupNames = pairGroupIDsAndNames(userGroups)
-		}
+	if s.usersManager == nil {
+		return "", errors.New("users manager not configured")
 	}
 
-	return sessionkey.SignToken(
+	user, userGroups, err := s.usersManager.GetUserWithGroups(ctx, userID)
+	if err != nil {
+		return "", fmt.Errorf("get user %s: %w", userID, err)
+	}
+
+	if user == nil {
+		return "", fmt.Errorf("get user %s: %w", userID, errUserUnresolved)
+	}
+
+	// Bind the OIDC identity to the service's account before signing anything
+	// with that service's session key. The proxy validates an installed cookie
+	// locally against the service public key, so a token minted for a user of
+	// another account would be honoured without a management round-trip.
+	if !sameAccount(user.AccountID, service.AccountID) {
+		return "", fmt.Errorf("user %s does not belong to the service account", userID)
+	}
+
+	if _, err := checkUserStatus(user); err != nil {
+		return "", fmt.Errorf("session token for user %s: %w", userID, err)
+	}
+
+	if err := s.checkGroupAccess(service, user); err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{
+			"domain":  domain,
+			"user_id": userID,
+		}).Debug("GenerateSessionToken: user not in the service's distribution groups")
+		return "", fmt.Errorf("session token for user %s: %w", userID, ErrUserNotInGroup)
+	}
+
+	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
+
+	token, err := sessionkey.SignToken(
 		service.SessionPrivateKey,
 		userID,
-		email,
+		s.resolveUserEmail(ctx, service.AccountID, user, ""),
 		domain,
 		method,
 		groupIDs,
 		groupNames,
 		proxyauth.DefaultSessionExpiry,
 	)
+	if err != nil {
+		return "", err
+	}
+
+	s.recordUserLogin(ctx, service.AccountID, user)
+
+	return token, nil
+}
+
+// recordUserLogin hands the sign-in to the activity manager. The RPC must not
+// fail on it, so the error is logged and dropped here rather than returned.
+func (s *ProxyServiceServer) recordUserLogin(ctx context.Context, accountID string, user *types.User) {
+	if s.activityManager == nil {
+		return
+	}
+
+	if err := s.activityManager.RecordUserLogin(ctx, accountID, user); err != nil {
+		log.WithContext(ctx).Debugf("record proxy login for user %s: %v", user.Id, err)
+	}
 }
 
 // ValidateUserGroupAccess checks if a user has access to a service.
@@ -1627,6 +1886,10 @@ func (s *ProxyServiceServer) ValidateUserGroupAccess(ctx context.Context, domain
 		return fmt.Errorf("user not found: %s", userID)
 	}
 
+	if _, err := checkUserStatus(user); err != nil {
+		return fmt.Errorf("user %s denied access to domain %s: %w", userID, domain, err)
+	}
+
 	service, err := s.getAccountServiceByDomain(ctx, user.AccountID, domain)
 	if err != nil {
 		return err
@@ -1678,13 +1941,23 @@ func (s *ProxyServiceServer) getAccountServiceByDomain(ctx context.Context, acco
 // ValidateSession validates a session token and checks if the user has access to the domain.
 func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.ValidateSessionRequest) (*proto.ValidateSessionResponse, error) {
 	domain := req.GetDomain()
-	sessionToken := req.GetSessionToken()
+	sessionToken := req.GetSessionToken() //nolint:staticcheck
+
+	// A one-time code from the OIDC callback is redeemed here for the durable
+	// token, so the token never travels in a redirect URL. The redeemed token
+	// is returned to the proxy (mintedToken) to install as the session cookie.
+	mintedToken := ""
+	if code := req.GetSessionCode(); code != "" {
+		redeemed, found := s.singleUseStore.LoadAndDelete(singleUseCacheKey(sessionCodeCacheNamespace, code))
+		if !found {
+			return deniedSessionResponse("invalid or expired session code"), nil
+		}
+		sessionToken = redeemed
+		mintedToken = redeemed
+	}
 
 	if domain == "" || sessionToken == "" {
-		return &proto.ValidateSessionResponse{
-			Valid:        false,
-			DeniedReason: "missing domain or session_token",
-		}, nil
+		return deniedSessionResponse("missing domain or session_token"), nil
 	}
 
 	service, err := s.getServiceByDomain(ctx, domain)
@@ -1694,83 +1967,50 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 			"error":  err.Error(),
 		}).Debug("ValidateSession: service not found")
 		//nolint:nilerr
-		return &proto.ValidateSessionResponse{
-			Valid:        false,
-			DeniedReason: "service_not_found",
-		}, nil
+		return deniedSessionResponse("service_not_found"), nil
 	}
 
 	if err := enforceAccountScope(ctx, service.AccountID); err != nil {
 		return nil, err
 	}
 
-	pubKeyBytes, err := base64.StdEncoding.DecodeString(service.SessionPublicKey)
-	if err != nil {
-		log.WithFields(log.Fields{
-			"domain": domain,
-			"error":  err.Error(),
-		}).Error("ValidateSession: decode public key")
-		//nolint:nilerr
-		return &proto.ValidateSessionResponse{
-			Valid:        false,
-			DeniedReason: "invalid_service_config",
-		}, nil
-	}
-
-	userID, _, _, _, _, err := proxyauth.ValidateSessionJWT(sessionToken, domain, pubKeyBytes)
-	if err != nil {
-		log.WithFields(log.Fields{
-			"domain": domain,
-			"error":  err.Error(),
-		}).Debug("ValidateSession: invalid session token")
-		//nolint:nilerr
-		return &proto.ValidateSessionResponse{
-			Valid:        false,
-			DeniedReason: "invalid_token",
-		}, nil
+	userID, tokenEmail, reason := sessionTokenSubject(domain, service, sessionToken)
+	if reason != "" {
+		return deniedSessionResponse(reason), nil
 	}
 
 	user, userGroups, err := s.usersManager.GetUserWithGroups(ctx, userID)
-	if err != nil {
+	if err != nil || user == nil {
 		log.WithFields(log.Fields{
 			"domain":  domain,
 			"user_id": userID,
-			"error":   err.Error(),
+			"error":   err,
 		}).Debug("ValidateSession: user not found")
 		//nolint:nilerr
-		return &proto.ValidateSessionResponse{
-			Valid:        false,
-			DeniedReason: "user_not_found",
-		}, nil
+		return deniedSessionResponse(deniedReasonUserNotFound), nil
 	}
 
-	if user.AccountID != service.AccountID {
+	// A user from another account gets a bare response: none of their identity
+	// belongs in an answer to a proxy serving a different account.
+	if !sameAccount(user.AccountID, service.AccountID) {
 		log.WithFields(log.Fields{
 			"domain":          domain,
 			"user_id":         userID,
 			"user_account":    user.AccountID,
 			"service_account": service.AccountID,
 		}).Debug("ValidateSession: user account mismatch")
-		//nolint:nilerr
-		return &proto.ValidateSessionResponse{
-			Valid:        false,
-			DeniedReason: "account_mismatch",
-		}, nil
+		return deniedSessionResponse("account_mismatch"), nil
 	}
 
-	if err := s.checkGroupAccess(service, user); err != nil {
-		log.WithFields(log.Fields{
-			"domain":  domain,
-			"user_id": userID,
-			"error":   err.Error(),
-		}).Debug("ValidateSession: access denied")
-		groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
-		//nolint:nilerr
+	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
+	userEmail := s.resolveUserEmail(ctx, service.AccountID, user, tokenEmail)
+
+	if reason := s.accountUserDeniedReason(domain, service, user); reason != "" {
 		return &proto.ValidateSessionResponse{
 			Valid:          false,
 			UserId:         user.Id,
-			UserEmail:      user.Email,
-			DeniedReason:   "not_in_group",
+			UserEmail:      userEmail,
+			DeniedReason:   reason,
 			PeerGroupIds:   groupIDs,
 			PeerGroupNames: groupNames,
 		}, nil
@@ -1779,19 +2019,79 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 	log.WithFields(log.Fields{
 		"domain":  domain,
 		"user_id": userID,
-		"email":   user.Email,
+		"email":   userEmail,
 	}).Debug("ValidateSession: access granted")
 
-	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
 	return &proto.ValidateSessionResponse{
 		Valid:          true,
 		UserId:         user.Id,
-		UserEmail:      user.Email,
+		UserEmail:      userEmail,
 		PeerGroupIds:   groupIDs,
 		PeerGroupNames: groupNames,
+		SessionToken:   mintedToken,
 	}, nil
 }
 
+// deniedSessionResponse builds a denial that carries no identity, for the
+// checks that run before a user of this service's account is resolved.
+func deniedSessionResponse(reason string) *proto.ValidateSessionResponse {
+	return &proto.ValidateSessionResponse{
+		Valid:        false,
+		DeniedReason: reason,
+	}
+}
+
+// sessionTokenSubject verifies the session token against the service's session
+// key and returns the user and email it was minted for, or the reason it
+// cannot be trusted.
+func sessionTokenSubject(domain string, service *rpservice.Service, sessionToken string) (userID, email, deniedReason string) {
+	pubKeyBytes, err := base64.StdEncoding.DecodeString(service.SessionPublicKey)
+	if err != nil {
+		log.WithFields(log.Fields{
+			"domain": domain,
+			"error":  err.Error(),
+		}).Error("ValidateSession: decode public key")
+		return "", "", "invalid_service_config"
+	}
+
+	userID, email, _, _, _, err = proxyauth.ValidateSessionJWT(sessionToken, domain, pubKeyBytes)
+	if err != nil {
+		log.WithFields(log.Fields{
+			"domain": domain,
+			"error":  err.Error(),
+		}).Debug("ValidateSession: invalid session token")
+		return "", "", "invalid_token"
+	}
+
+	return userID, email, ""
+}
+
+// accountUserDeniedReason gates a user of the service's own account, returning
+// an empty string when access is granted. Account status comes before group
+// membership: a user awaiting approval or blocked has no access regardless of
+// the groups they were auto-assigned.
+func (s *ProxyServiceServer) accountUserDeniedReason(domain string, service *rpservice.Service, user *types.User) string {
+	if reason := userStatusDeniedReason(user); reason != "" {
+		log.WithFields(log.Fields{
+			"domain":  domain,
+			"user_id": user.Id,
+			"reason":  reason,
+		}).Debug("ValidateSession: user status denies access")
+		return reason
+	}
+
+	if err := s.checkGroupAccess(service, user); err != nil {
+		log.WithFields(log.Fields{
+			"domain":  domain,
+			"user_id": user.Id,
+			"error":   err.Error(),
+		}).Debug("ValidateSession: access denied")
+		return "not_in_group"
+	}
+
+	return ""
+}
+
 func (s *ProxyServiceServer) getServiceByDomain(ctx context.Context, domain string) (*rpservice.Service, error) {
 	service, err := s.serviceManager.GetServiceByDomain(ctx, domain)
 	if err == nil {
@@ -1906,7 +2206,20 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 	}
 
 	groupIDs, groupNames := pairGroupIDsAndNames(peerGroups)
-	principalID, displayIdentity := s.getTunnelPeerInfo(ctx, domain, service, peer)
+	owner := s.resolvePeerOwner(ctx, peer, service.AccountID)
+	principalID, displayIdentity := s.getTunnelPeerInfo(ctx, domain, service, peer, owner)
+
+	if reason := peerOwnerDeniedReason(peer, owner); reason != "" {
+		log.WithFields(log.Fields{"domain": domain, "peer_id": peer.ID, "user_id": peer.UserID, "reason": reason}).Debug("ValidateTunnelPeer: owner status denies access")
+		return &proto.ValidateTunnelPeerResponse{
+			Valid:          false,
+			UserId:         principalID,
+			UserEmail:      displayIdentity,
+			DeniedReason:   reason,
+			PeerGroupIds:   groupIDs,
+			PeerGroupNames: groupNames,
+		}, nil
+	}
 
 	if err := checkPeerGroupAccess(service, groupIDs); err != nil {
 		log.WithFields(log.Fields{"domain": domain, "peer_id": peer.ID, "error": err.Error()}).Debug("ValidateTunnelPeer: access denied")
@@ -1926,6 +2239,8 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 		return nil, err
 	}
 
+	s.recordPeerSeen(ctx, service.AccountID, peer)
+
 	log.WithFields(log.Fields{
 		"domain":       domain,
 		"tunnel_ip":    tunnelIPStr,
@@ -1943,9 +2258,67 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 	}, nil
 }
 
+// recordPeerSeen hands the mesh request to the activity manager. The RPC must
+// not fail on it, so the error is logged and dropped here rather than returned.
+func (s *ProxyServiceServer) recordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) {
+	if s.activityManager == nil {
+		return
+	}
+
+	if err := s.activityManager.RecordPeerSeen(ctx, accountID, peer); err != nil {
+		log.WithContext(ctx).Debugf("record proxy activity for peer %s: %v", peer.ID, err)
+	}
+}
+
+// resolvePeerOwner returns the user a peer is linked to, once per request so
+// the status gate and the identity resolution below share a single lookup.
+// Unlinked peers (machine agents) have no owner. A lookup that fails returns
+// nil rather than an error: both callers treat an unresolved owner the same
+// way, and neither may trust one it could not read.
+func (s *ProxyServiceServer) resolvePeerOwner(ctx context.Context, peer *peer.Peer, accountID string) *types.User {
+	if peer.UserID == "" {
+		return nil
+	}
+
+	user, err := s.usersManager.GetUser(ctx, peer.UserID)
+	if err != nil {
+		log.WithContext(ctx).Debugf("ValidateTunnelPeer: look up owner %s of peer %s: %v", peer.UserID, peer.ID, err)
+		return nil
+	}
+
+	// The lookup is by user ID alone, so a peer row pointing outside the
+	// service's account would otherwise resolve a foreign user. Leave the owner
+	// unresolved instead: the gate denies it, and neither the response nor the
+	// minted token carries an identity from another account.
+	if !sameAccount(user.AccountID, accountID) {
+		log.WithContext(ctx).Debugf("ValidateTunnelPeer: owner %s of peer %s belongs to another account", peer.UserID, peer.ID)
+		return nil
+	}
+
+	return user
+}
+
+// peerOwnerDeniedReason gates the mesh fast-path on the account status of the
+// peer's owning user, so a user blocked after registering a peer loses
+// mesh-origin access too. Unlinked peers (machine agents) have no owner to gate
+// on and stay first-class callers. An owner the store cannot resolve denies:
+// an unavailable lookup must not grant access.
+func peerOwnerDeniedReason(peer *peer.Peer, owner *types.User) string {
+	if peer.UserID == "" {
+		return ""
+	}
+
+	if owner == nil {
+		return deniedReasonUserNotFound
+	}
+
+	return userStatusDeniedReason(owner)
+}
+
 // getTunnelPeerInfo returns the principal ID and display name for a peer, e.g. a
-// user or peer ID, and peer name or user email.
-func (s *ProxyServiceServer) getTunnelPeerInfo(ctx context.Context, domain string, service *rpservice.Service, peer *peer.Peer) (string, string) {
+// user or peer ID, and peer name or user email. owner is the already-resolved
+// user the peer is linked to, or nil.
+func (s *ProxyServiceServer) getTunnelPeerInfo(ctx context.Context, domain string, service *rpservice.Service, peer *peer.Peer, owner *types.User) (string, string) {
 	// Resolve the principal: when the peer is linked to a user, the human is the
 	// principal so multiple peers owned by the same user share a single
 	// identity. Unlinked peers (machine agents) are their own principal keyed on
@@ -1962,21 +2335,17 @@ func (s *ProxyServiceServer) getTunnelPeerInfo(ctx context.Context, domain strin
 	principalID := peer.UserID
 	displayIdentity := peer.Name
 	// Stored column first (cheap, but often empty for OIDC-provisioned users).
-	if user, uerr := s.usersManager.GetUser(ctx, peer.UserID); uerr == nil && user != nil {
-		principalID = user.Id
-		if user.Email != "" {
-			displayIdentity = user.Email
+	if owner != nil {
+		principalID = owner.Id
+		if owner.Email != "" {
+			displayIdentity = owner.Email
 		}
 	}
 	// IdP enrichment wins when available — the stored email column is a
 	// best-effort cache and is frequently empty for OIDC users. Enrichment
 	// failures must never fail the RPC; we simply keep the stored/peer identity.
-	if s.idpManager != nil {
-		if ud, uerr := s.idpManager.GetUserDataByID(ctx, peer.UserID, idp.AppMetadata{WTAccountID: service.AccountID}); uerr == nil && ud != nil && ud.Email != "" {
-			displayIdentity = ud.Email
-		} else if uerr != nil {
-			log.WithFields(log.Fields{"domain": domain, "user_id": peer.UserID, "error": uerr.Error()}).Debug("ValidateTunnelPeer: IdP user enrichment failed; using stored/peer identity")
-		}
+	if email := s.idpEmail(ctx, service.AccountID, peer.UserID); email != "" {
+		displayIdentity = email
 	}
 
 	return principalID, displayIdentity
diff --git a/management/internals/shared/grpc/proxy_connect_authorizer_test.go b/management/internals/shared/grpc/proxy_connect_authorizer_test.go
new file mode 100644
index 000000000..a2c52296f
--- /dev/null
+++ b/management/internals/shared/grpc/proxy_connect_authorizer_test.go
@@ -0,0 +1,168 @@
+package grpc
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+	"google.golang.org/grpc/codes"
+	grpcstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// capturingAuthorizer records the arguments of the last AuthorizeProxyConnect
+// call and returns a fixed error.
+type capturingAuthorizer struct {
+	called  int
+	token   *types.ProxyAccessToken
+	proxyID string
+	address string
+	err     error
+}
+
+func (a *capturingAuthorizer) AuthorizeProxyConnect(_ context.Context, token *types.ProxyAccessToken, proxyID, address string) error {
+	a.called++
+	a.token = token
+	a.proxyID = proxyID
+	a.address = address
+	return a.err
+}
+
+// authorizerServer builds a ProxyServiceServer whose proxy manager reports
+// every cluster address as available, so the authorizer is the only thing
+// standing between a claim and success.
+func authorizerServer(t *testing.T) *ProxyServiceServer {
+	t.Helper()
+	ctrl := gomock.NewController(t)
+	mgr := proxy.NewMockManager(ctrl)
+	mgr.EXPECT().IsClusterAddressAvailable(gomock.Any(), gomock.Any(), gomock.Any()).Return(true, nil).AnyTimes()
+	return &ProxyServiceServer{proxyManager: mgr}
+}
+
+// TestValidateProxyConnect_NilAuthorizerUnchanged guards the no-behavior-change
+// claim: with no authorizer installed — the OSS default — a well-formed claim
+// succeeds and malformed input is rejected exactly as before the hook existed.
+func TestValidateProxyConnect_NilAuthorizerUnchanged(t *testing.T) {
+	s := authorizerServer(t)
+
+	params, err := s.validateProxyConnect("proxy-1", "cluster.example.com", scopedCtx("acc-1"))
+	require.NoError(t, err)
+	assert.Equal(t, "proxy-1", params.proxyID)
+	assert.Equal(t, "cluster.example.com", params.address)
+
+	_, err = s.validateProxyConnect("", "cluster.example.com", scopedCtx("acc-1"))
+	require.Error(t, err)
+	st, ok := grpcstatus.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, codes.InvalidArgument, st.Code(), "missing proxy_id must stay InvalidArgument")
+
+	_, err = s.validateProxyConnect("proxy-1", "not a hostname", scopedCtx("acc-1"))
+	require.Error(t, err)
+	st, ok = grpcstatus.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, codes.InvalidArgument, st.Code(), "invalid address must stay InvalidArgument")
+}
+
+// TestValidateProxyConnect_AuthorizerReceivesClaim pins the hook contract: the
+// authorizer sees the presented token and the claimed proxy ID and address,
+// and an authorized claim proceeds.
+func TestValidateProxyConnect_AuthorizerReceivesClaim(t *testing.T) {
+	s := authorizerServer(t)
+	auth := &capturingAuthorizer{}
+	s.SetProxyConnectAuthorizer(auth)
+
+	params, err := s.validateProxyConnect("proxy-1", "cluster.example.com", scopedCtx("acc-1"))
+	require.NoError(t, err)
+	assert.Equal(t, "cluster.example.com", params.address)
+
+	require.Equal(t, 1, auth.called, "authorizer must be consulted exactly once per connect")
+	assert.Equal(t, "proxy-1", auth.proxyID)
+	assert.Equal(t, "cluster.example.com", auth.address)
+	require.NotNil(t, auth.token, "the presented token must be handed to the authorizer")
+	require.NotNil(t, auth.token.AccountID)
+	assert.Equal(t, "acc-1", *auth.token.AccountID)
+}
+
+// TestValidateProxyConnect_PlainErrorBecomesPermissionDenied pins the error
+// mapping: a non-status error from the authorizer surfaces as
+// PermissionDenied — distinguishable from the AlreadyExists used for address
+// conflicts — and the claim does not proceed even though the address itself
+// was available.
+func TestValidateProxyConnect_PlainErrorBecomesPermissionDenied(t *testing.T) {
+	s := authorizerServer(t)
+	s.SetProxyConnectAuthorizer(&capturingAuthorizer{err: errors.New("not the assigned credential")})
+
+	_, err := s.validateProxyConnect("proxy-1", "cluster.example.com", scopedCtx("acc-1"))
+	require.Error(t, err)
+	st, ok := grpcstatus.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, codes.PermissionDenied, st.Code())
+	assert.Contains(t, st.Message(), "not the assigned credential", "the authorizer's reason must survive into the status message")
+}
+
+// TestValidateProxyConnect_StatusErrorPassesThrough pins that an authorizer
+// which chooses its own status code is not second-guessed.
+func TestValidateProxyConnect_StatusErrorPassesThrough(t *testing.T) {
+	s := authorizerServer(t)
+	s.SetProxyConnectAuthorizer(&capturingAuthorizer{
+		err: grpcstatus.Errorf(codes.ResourceExhausted, "try later"),
+	})
+
+	_, err := s.validateProxyConnect("proxy-1", "cluster.example.com", scopedCtx("acc-1"))
+	require.Error(t, err)
+	st, ok := grpcstatus.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, codes.ResourceExhausted, st.Code(), "a status error must pass through unchanged")
+	assert.Equal(t, "try later", st.Message())
+}
+
+// TestValidateProxyConnect_AuthorizerSeesGlobalAndTokenlessConnects pins the
+// call-site placement: the authorizer sits outside the account-scoped branch,
+// so management-wide tokens (AccountID == nil) and connections without any
+// token are also presented to it rather than bypassing policy.
+func TestValidateProxyConnect_AuthorizerSeesGlobalAndTokenlessConnects(t *testing.T) {
+	s := &ProxyServiceServer{} // no proxy manager: neither path may reach the availability check
+
+	auth := &capturingAuthorizer{}
+	s.SetProxyConnectAuthorizer(auth)
+
+	_, err := s.validateProxyConnect("proxy-1", "cluster.example.com", globalCtx())
+	require.NoError(t, err)
+	require.Equal(t, 1, auth.called, "a management-wide token must still be presented to the authorizer")
+	require.NotNil(t, auth.token)
+	assert.Nil(t, auth.token.AccountID)
+
+	_, err = s.validateProxyConnect("proxy-1", "cluster.example.com", context.Background())
+	require.NoError(t, err)
+	require.Equal(t, 2, auth.called, "a token-less connect must still be presented to the authorizer")
+	assert.Nil(t, auth.token, "no token in context must surface as a nil token, not a zero value")
+}
+
+// TestValidateProxyConnect_AuthorizerRunsLast pins the ordering: input
+// validation and the availability check precede policy, so the authorizer is
+// never consulted about a claim that is malformed or already rejected.
+func TestValidateProxyConnect_AuthorizerRunsLast(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr := proxy.NewMockManager(ctrl)
+	mgr.EXPECT().IsClusterAddressAvailable(gomock.Any(), gomock.Any(), gomock.Any()).Return(false, nil)
+	s := &ProxyServiceServer{proxyManager: mgr}
+
+	auth := &capturingAuthorizer{}
+	s.SetProxyConnectAuthorizer(auth)
+
+	_, err := s.validateProxyConnect("proxy-1", "not a hostname", scopedCtx("acc-1"))
+	require.Error(t, err)
+	assert.Zero(t, auth.called, "a malformed address must be rejected before policy runs")
+
+	_, err = s.validateProxyConnect("proxy-1", "cluster.example.com", scopedCtx("acc-1"))
+	require.Error(t, err)
+	st, ok := grpcstatus.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, codes.AlreadyExists, st.Code(), "an address conflict must keep its own status")
+	assert.Zero(t, auth.called, "a conflicting address must be rejected before policy runs")
+}
diff --git a/management/internals/shared/grpc/proxy_connect_version_test.go b/management/internals/shared/grpc/proxy_connect_version_test.go
new file mode 100644
index 000000000..e2fc49a38
--- /dev/null
+++ b/management/internals/shared/grpc/proxy_connect_version_test.go
@@ -0,0 +1,93 @@
+package grpc
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const (
+	versionTestProxyID = "proxy-a"
+	versionTestCluster = "cluster.example.com"
+	versionTestVersion = "0.60.0"
+)
+
+// hangupStream cancels its context on the first Send, emulating a proxy that
+// disconnects right after receiving the initial snapshot. The legacy stream
+// carries no proxy-to-management messages, so this is the only way for
+// GetMappingUpdate to return.
+type hangupStream struct {
+	recordingStream
+	ctx    context.Context
+	cancel context.CancelFunc
+}
+
+func (s *hangupStream) Send(m *proto.GetMappingUpdateResponse) error {
+	s.cancel()
+	return s.recordingStream.Send(m)
+}
+
+func (s *hangupStream) Context() context.Context { return s.ctx }
+
+// newVersionTestServer wires a server whose proxy manager only accepts a
+// Connect carrying versionTestVersion, so a dropped or mangled version fails
+// the test as an unexpected call.
+func newVersionTestServer(t *testing.T) *ProxyServiceServer {
+	t.Helper()
+	ctrl := gomock.NewController(t)
+
+	svcMgr := rpservice.NewMockManager(ctrl)
+	svcMgr.EXPECT().GetGlobalServices(gomock.Any()).Return(nil, nil)
+
+	proxyMgr := proxy.NewMockManager(ctrl)
+	proxyMgr.EXPECT().
+		Connect(gomock.Any(), versionTestProxyID, gomock.Any(), versionTestCluster, gomock.Any(), versionTestVersion, gomock.Any(), gomock.Any()).
+		Return(&proxy.Proxy{ID: versionTestProxyID, Version: versionTestVersion}, nil)
+	proxyMgr.EXPECT().Disconnect(gomock.Any(), versionTestProxyID, gomock.Any()).Return(nil)
+
+	s := newSnapshotTestServer(t, 10)
+	s.serviceManager = svcMgr
+	s.proxyManager = proxyMgr
+	return s
+}
+
+func TestSyncMappings_ForwardsProxyVersion(t *testing.T) {
+	s := newVersionTestServer(t)
+
+	// The init carries the version, the ack acknowledges the empty snapshot,
+	// and the exhausted fake stream then ends the RPC.
+	stream := &syncRecordingStream{
+		recvMsgs: []*proto.SyncMappingsRequest{
+			{Msg: &proto.SyncMappingsRequest_Init{Init: &proto.SyncMappingsInit{
+				ProxyId: versionTestProxyID,
+				Address: versionTestCluster,
+				Version: versionTestVersion,
+			}}},
+			ackMsg(),
+		},
+	}
+
+	err := s.SyncMappings(stream)
+	require.ErrorContains(t, err, "no more recv messages")
+}
+
+func TestGetMappingUpdate_ForwardsProxyVersion(t *testing.T) {
+	s := newVersionTestServer(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	stream := &hangupStream{ctx: ctx, cancel: cancel}
+
+	err := s.GetMappingUpdate(&proto.GetMappingUpdateRequest{
+		ProxyId: versionTestProxyID,
+		Address: versionTestCluster,
+		Version: versionTestVersion,
+	}, stream)
+	require.ErrorIs(t, err, context.Canceled)
+}
diff --git a/management/internals/shared/grpc/proxy_credential_limiter.go b/management/internals/shared/grpc/proxy_credential_limiter.go
new file mode 100644
index 000000000..2a3a02347
--- /dev/null
+++ b/management/internals/shared/grpc/proxy_credential_limiter.go
@@ -0,0 +1,101 @@
+package grpc
+
+import (
+	"sync"
+	"time"
+
+	"golang.org/x/time/rate"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/durationpb"
+)
+
+const (
+	credentialVerificationInterval        = 6 * time.Second
+	credentialVerificationBurst           = 5
+	credentialVerificationMaxServices     = 4096
+	credentialVerificationIdleTimeout     = 15 * time.Minute
+	credentialVerificationCleanupInterval = time.Minute
+)
+
+type credentialAccountID string
+type credentialServiceID string
+
+type credentialVerificationKey struct {
+	accountID credentialAccountID
+	serviceID credentialServiceID
+}
+
+type credentialVerificationBudget struct {
+	limiter  *rate.Limiter
+	lastUsed time.Time
+}
+
+// The zero value is ready to use. Budgets are local to this Management process;
+// proxy replicas reaching this process share a service's verification budget.
+type credentialVerificationLimiter struct {
+	mu          sync.Mutex
+	now         func() time.Time
+	services    map[credentialVerificationKey]*credentialVerificationBudget
+	nextCleanup time.Time
+	closed      bool
+}
+
+func (l *credentialVerificationLimiter) allow(key credentialVerificationKey) error {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.closed {
+		return status.Error(codes.Unavailable, "credential verification is closed")
+	}
+	now := time.Now()
+	if l.now != nil {
+		now = l.now()
+	}
+	l.cleanup(now)
+	budget := l.services[key]
+	if budget == nil {
+		if len(l.services) >= credentialVerificationMaxServices {
+			return credentialVerificationThrottled(credentialVerificationCleanupInterval)
+		}
+		if l.services == nil {
+			l.services = make(map[credentialVerificationKey]*credentialVerificationBudget)
+		}
+		budget = &credentialVerificationBudget{limiter: rate.NewLimiter(rate.Every(credentialVerificationInterval), credentialVerificationBurst)}
+		l.services[key] = budget
+	}
+	budget.lastUsed = now
+	if budget.limiter.AllowN(now, 1) {
+		return nil
+	}
+	delay := max(time.Nanosecond, time.Duration((1-budget.limiter.TokensAt(now))*float64(credentialVerificationInterval)))
+	return credentialVerificationThrottled(delay)
+}
+
+func (l *credentialVerificationLimiter) cleanup(now time.Time) {
+	if now.Before(l.nextCleanup) {
+		return
+	}
+	l.nextCleanup = now.Add(credentialVerificationCleanupInterval)
+	for key, budget := range l.services {
+		if now.Sub(budget.lastUsed) >= credentialVerificationIdleTimeout {
+			delete(l.services, key)
+		}
+	}
+}
+
+func (l *credentialVerificationLimiter) close() {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.closed = true
+	l.services = nil
+}
+
+func credentialVerificationThrottled(delay time.Duration) error {
+	s := status.New(codes.ResourceExhausted, "too many credential verification attempts")
+	withRetry, err := s.WithDetails(&errdetails.RetryInfo{RetryDelay: durationpb.New(delay)})
+	if err != nil {
+		return s.Err()
+	}
+	return withRetry.Err()
+}
diff --git a/management/internals/shared/grpc/proxy_credential_limiter_test.go b/management/internals/shared/grpc/proxy_credential_limiter_test.go
new file mode 100644
index 000000000..565b14889
--- /dev/null
+++ b/management/internals/shared/grpc/proxy_credential_limiter_test.go
@@ -0,0 +1,79 @@
+package grpc
+
+import (
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func TestCredentialVerificationRefillAndIsolation(t *testing.T) {
+	now := time.Now()
+	l := credentialVerificationLimiter{now: func() time.Time { return now }}
+	key := credentialVerificationKey{accountID: "account", serviceID: "service"}
+	for range credentialVerificationBurst {
+		require.NoError(t, l.allow(key))
+	}
+	err := l.allow(key)
+	require.Equal(t, codes.ResourceExhausted, status.Code(err), "the burst must be bounded")
+	now = now.Add(3 * time.Second)
+	err = l.allow(key)
+	require.Equal(t, codes.ResourceExhausted, status.Code(err), "a partially refilled token must not permit a check")
+	details := status.Convert(err).Details()
+	require.Len(t, details, 1, "throttling must provide RetryInfo")
+	retry, ok := details[0].(*errdetails.RetryInfo)
+	require.True(t, ok, "retry details must use the standard message")
+	assert.Equal(t, 3*time.Second, retry.RetryDelay.AsDuration(), "retry hint must reflect time until the next check")
+	now = now.Add(3 * time.Second)
+	require.NoError(t, l.allow(key))
+	assert.Equal(t, codes.ResourceExhausted, status.Code(l.allow(key)), "only one check must refill every six seconds")
+	require.NoError(t, l.allow(credentialVerificationKey{accountID: "other-account", serviceID: key.serviceID}))
+	require.NoError(t, l.allow(credentialVerificationKey{accountID: key.accountID, serviceID: "other-service"}))
+}
+
+func TestCredentialVerificationCapacityAndExpiry(t *testing.T) {
+	now := time.Now()
+	l := credentialVerificationLimiter{now: func() time.Time { return now }}
+	for i := range credentialVerificationMaxServices {
+		require.NoError(t, l.allow(credentialVerificationKey{accountID: "account", serviceID: credentialServiceID(strconv.Itoa(i))}))
+	}
+	key := credentialVerificationKey{accountID: "account", serviceID: "new-service"}
+	assert.Equal(t, codes.ResourceExhausted, status.Code(l.allow(key)), "capacity exhaustion must deny new checks")
+	now = now.Add(credentialVerificationIdleTimeout)
+	for range credentialVerificationBurst {
+		require.NoError(t, l.allow(key))
+	}
+	assert.Equal(t, codes.ResourceExhausted, status.Code(l.allow(key)), "expiry must retain the normal burst bound")
+}
+
+func TestCredentialVerificationConcurrentChecksAndClose(t *testing.T) {
+	var l credentialVerificationLimiter
+	key := credentialVerificationKey{accountID: "account", serviceID: "service"}
+	var admitted atomic.Int32
+	var wg sync.WaitGroup
+	for range 100 {
+		wg.Go(func() {
+			if err := l.allow(key); err == nil {
+				admitted.Add(1)
+			} else {
+				assert.Equal(t, codes.ResourceExhausted, status.Code(err), "excess checks must be throttled")
+			}
+		})
+	}
+	wg.Wait()
+	assert.EqualValues(t, credentialVerificationBurst, admitted.Load(), "concurrent checks must share the burst")
+	for range 10 {
+		wg.Go(l.close)
+		wg.Go(func() { assert.Error(t, l.allow(key)) })
+	}
+	wg.Wait()
+	assert.Empty(t, l.services, "closing must release retained budgets")
+	assert.Equal(t, codes.Unavailable, status.Code(l.allow(key)), "checks after close must fail closed")
+}
diff --git a/management/internals/shared/grpc/proxy_credentials.md b/management/internals/shared/grpc/proxy_credentials.md
new file mode 100644
index 000000000..1caf432e5
--- /dev/null
+++ b/management/internals/shared/grpc/proxy_credentials.md
@@ -0,0 +1,18 @@
+# Reverse proxy credential verification
+
+The `ProxyService.Authenticate` RPC limits PIN and password checks before
+verifying their Argon2 hashes. Both methods share one budget per account and
+service: a burst of five checks, replenishing one check every six seconds
+(ten per minute). Successful and failed checks consume the budget. Account
+scope and service lookup run before the limiter.
+
+Excess checks receive gRPC `ResourceExhausted` with a standard `RetryInfo` delay.
+Updated proxies translate it to HTTP 429 and `Retry-After`. Older proxies show
+an authentication-service error but cannot bypass the Management limit.
+
+Budgets are held in memory per Management process and reset on restart. Proxy
+replicas reaching the same Management process share its budgets. Multiple
+Management processes have independent budgets; this is not a cluster-wide
+limit. At most 4,096 service budgets are retained, with idle entries expiring
+after fifteen minutes. Capacity exhaustion denies new checks until entries
+expire. Closing the server releases the retained state.
diff --git a/management/internals/shared/grpc/proxy_credentials_test.go b/management/internals/shared/grpc/proxy_credentials_test.go
new file mode 100644
index 000000000..2e144bd69
--- /dev/null
+++ b/management/internals/shared/grpc/proxy_credentials_test.go
@@ -0,0 +1,131 @@
+package grpc_test
+
+import (
+	"context"
+	"net"
+	"net/netip"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	servicemanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service/manager"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
+	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func credentialServer(t *testing.T) (*nbgrpc.ProxyServiceServer, context.Context, grpc.UnaryServerInterceptor) {
+	t.Helper()
+	ctx := context.Background()
+	s, err := store.NewStore(ctx, types.SqliteStoreEngine, t.TempDir(), nil, false)
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, s.Close(ctx)) })
+	require.NoError(t, s.SaveAccount(ctx, &types.Account{Id: "account"}))
+	keys, err := sessionkey.GenerateKeyPair()
+	require.NoError(t, err)
+	for _, id := range []string{"service", "other-service"} {
+		svc := &service.Service{
+			ID: id, AccountID: "account", Name: id, Domain: id + ".example.com",
+			Enabled: true, SessionPrivateKey: keys.PrivateKey, SessionPublicKey: keys.PublicKey,
+			Auth: service.AuthConfig{
+				PinAuth:      &service.PINAuthConfig{Enabled: true, Pin: "842716"},
+				PasswordAuth: &service.PasswordAuthConfig{Enabled: true, Password: "test-password"},
+			},
+		}
+		require.NoError(t, svc.Auth.HashSecrets())
+		require.NoError(t, s.CreateService(ctx, svc))
+	}
+	account := "account"
+	token, err := types.CreateNewProxyAccessToken("test proxy", time.Hour, &account, "admin")
+	require.NoError(t, err)
+	require.NoError(t, s.SaveProxyAccessToken(ctx, &token.ProxyAccessToken))
+	ctx = metadata.NewIncomingContext(ctx, metadata.Pairs("authorization", "Bearer "+string(token.PlainToken)))
+	ctx = peer.NewContext(ctx, &peer.Peer{Addr: net.TCPAddrFromAddrPort(netip.MustParseAddrPort("192.0.2.1:443"))})
+	server := nbgrpc.NewProxyServiceServer(nil, nil, nil, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
+	t.Cleanup(server.Close)
+	server.SetServiceManager(servicemanager.NewManager(s, nil, nil, nil, nil, nil))
+	interceptor, _, closeInterceptor := nbgrpc.NewProxyAuthInterceptors(s)
+	t.Cleanup(closeInterceptor)
+	return server, ctx, interceptor
+}
+
+func TestAuthenticateCredentialRateLimit(t *testing.T) {
+	server, ctx, interceptor := credentialServer(t)
+	authenticate := func(req *proto.AuthenticateRequest) (*proto.AuthenticateResponse, error) {
+		response, err := interceptor(ctx, req, &grpc.UnaryServerInfo{FullMethod: "/management.ProxyService/Authenticate"}, func(ctx context.Context, req any) (any, error) {
+			return server.Authenticate(ctx, req.(*proto.AuthenticateRequest))
+		})
+		if err != nil {
+			return nil, err
+		}
+		return response.(*proto.AuthenticateResponse), nil
+	}
+	for i := range 5 {
+		req := &proto.AuthenticateRequest{AccountId: "account", Id: "service"}
+		if i%2 == 0 {
+			req.Request = &proto.AuthenticateRequest_Pin{Pin: &proto.PinRequest{Pin: "000000"}}
+		} else {
+			req.Request = &proto.AuthenticateRequest_Password{Password: &proto.PasswordRequest{Password: "wrong-password"}}
+		}
+		resp, err := authenticate(req)
+		require.NoError(t, err)
+		assert.False(t, resp.GetSuccess(), "incorrect PINs and passwords must be denied")
+		assert.Empty(t, resp.GetSessionToken(), "incorrect credentials must not issue a token")
+	}
+	req := &proto.AuthenticateRequest{AccountId: "account", Id: "service", Request: &proto.AuthenticateRequest_Pin{Pin: &proto.PinRequest{Pin: "842716"}}}
+	resp, err := authenticate(req)
+	assert.Nil(t, resp, "a throttled verification must not return a session")
+	require.Equal(t, codes.ResourceExhausted, status.Code(err), "PIN and password checks must share a service budget even with a valid proxy token")
+	details := status.Convert(err).Details()
+	require.Len(t, details, 1, "throttled responses must include a retry hint")
+	retry, ok := details[0].(*errdetails.RetryInfo)
+	require.True(t, ok, "the hint must use the standard RetryInfo message")
+	assert.Positive(t, retry.RetryDelay.AsDuration(), "the retry delay must be positive")
+	assert.LessOrEqual(t, retry.RetryDelay.AsDuration(), 6*time.Second, "the service must replenish one verification every six seconds")
+	req.AccountId = "another-account"
+	_, err = authenticate(req)
+	assert.Equal(t, codes.PermissionDenied, status.Code(err), "account scope must still be enforced before throttling")
+	req.AccountId = "account"
+	req.Id = "other-service"
+	resp, err = authenticate(req)
+	require.NoError(t, err)
+	assert.True(t, resp.GetSuccess(), "one service's throttle must not block another service")
+	assert.NotEmpty(t, resp.GetSessionToken(), "valid credentials on another service must issue a session")
+}
+
+func TestAuthenticateCredentialConcurrentLimit(t *testing.T) {
+	server, _, _ := credentialServer(t)
+	req := &proto.AuthenticateRequest{AccountId: "account", Id: "service", Request: &proto.AuthenticateRequest_Pin{Pin: &proto.PinRequest{Pin: "000000"}}}
+	var checked, throttled atomic.Int32
+	var wg sync.WaitGroup
+	for range 20 {
+		wg.Go(func() {
+			resp, err := server.Authenticate(context.Background(), req)
+			switch status.Code(err) {
+			case codes.OK:
+				checked.Add(1)
+				assert.False(t, resp.GetSuccess(), "incorrect credentials must be denied")
+			case codes.ResourceExhausted:
+				throttled.Add(1)
+			default:
+				assert.NoError(t, err)
+			}
+		})
+	}
+	wg.Wait()
+	assert.EqualValues(t, 5, checked.Load(), "only the burst budget may reach concurrent credential verification")
+	assert.EqualValues(t, 15, throttled.Load(), "excess concurrent checks must be throttled")
+}
diff --git a/management/internals/shared/grpc/proxy_group_access_test.go b/management/internals/shared/grpc/proxy_group_access_test.go
index 532cb7cc3..5f0c31eb6 100644
--- a/management/internals/shared/grpc/proxy_group_access_test.go
+++ b/management/internals/shared/grpc/proxy_group_access_test.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -119,11 +120,13 @@ func (m *mockReverseProxyManager) GetClusters(_ context.Context, _, _ string) ([
 }
 
 type mockUsersManager struct {
-	users map[string]*types.User
-	err   error
+	users        map[string]*types.User
+	err          error
+	getUserCalls int
 }
 
 func (m *mockUsersManager) GetUser(ctx context.Context, userID string) (*types.User, error) {
+	m.getUserCalls++
 	if m.err != nil {
 		return nil, m.err
 	}
@@ -153,6 +156,27 @@ type mockTunnelPeersManager struct {
 	groupsErr error
 }
 
+// mockActivityManager records what the RPC handed to the activity manager. The
+// policy (throttling, exclusions) is the manager's and is tested there; these
+// tests only pin which requests reach it.
+type mockActivityManager struct {
+	seenMarks []seenMark
+}
+
+type seenMark struct {
+	accountID string
+	peerID    string
+}
+
+func (m *mockActivityManager) RecordUserLogin(_ context.Context, _ string, _ *types.User) error {
+	return nil
+}
+
+func (m *mockActivityManager) RecordPeerSeen(_ context.Context, accountID string, peer *peer.Peer) error {
+	m.seenMarks = append(m.seenMarks, seenMark{accountID: accountID, peerID: peer.ID})
+	return nil
+}
+
 func (m *mockTunnelPeersManager) GetPeerByTunnelIP(_ context.Context, _ string, _ net.IP) (*peer.Peer, error) {
 	return m.peer, m.peerErr
 }
@@ -350,6 +374,64 @@ func TestValidateUserGroupAccess(t *testing.T) {
 			},
 			expectErr: false,
 		},
+		{
+			name:   "user pending approval denied despite group membership",
+			domain: "app.example.com",
+			userID: "user1",
+			proxiesByAccount: map[string][]*service.Service{
+				"account1": {{
+					Domain:    "app.example.com",
+					AccountID: "account1",
+					Auth: service.AuthConfig{
+						BearerAuth: &service.BearerAuthConfig{
+							Enabled:            true,
+							DistributionGroups: []string{"group1"},
+						},
+					},
+				}},
+			},
+			users: map[string]*types.User{
+				// The approval flow stores a pending user as blocked as well.
+				"user1": {Id: "user1", AccountID: "account1", AutoGroups: []string{"group1"}, Blocked: true, PendingApproval: true},
+			},
+			expectErr:    true,
+			expectErrMsg: "user pending approval",
+		},
+		{
+			name:   "blocked user denied despite group membership",
+			domain: "app.example.com",
+			userID: "user1",
+			proxiesByAccount: map[string][]*service.Service{
+				"account1": {{
+					Domain:    "app.example.com",
+					AccountID: "account1",
+					Auth: service.AuthConfig{
+						BearerAuth: &service.BearerAuthConfig{
+							Enabled:            true,
+							DistributionGroups: []string{"group1"},
+						},
+					},
+				}},
+			},
+			users: map[string]*types.User{
+				"user1": {Id: "user1", AccountID: "account1", AutoGroups: []string{"group1"}, Blocked: true},
+			},
+			expectErr:    true,
+			expectErrMsg: "user blocked",
+		},
+		{
+			name:   "blocked user denied on a service with no auth configured",
+			domain: "app.example.com",
+			userID: "user1",
+			proxiesByAccount: map[string][]*service.Service{
+				"account1": {{Domain: "app.example.com", AccountID: "account1", Auth: service.AuthConfig{}}},
+			},
+			users: map[string]*types.User{
+				"user1": {Id: "user1", AccountID: "account1", Blocked: true},
+			},
+			expectErr:    true,
+			expectErrMsg: "user blocked",
+		},
 		{
 			name:             "proxy manager error",
 			domain:           "app.example.com",
@@ -421,17 +503,18 @@ func TestValidateTunnelPeerUserEmailEnrichment(t *testing.T) {
 	storedUserNoEmail := map[string]*types.User{userID: {Id: userID, AccountID: accountID, Email: ""}}
 
 	tests := []struct {
-		name         string
-		peerUserID   string
-		storedUsers  map[string]*types.User
-		storedErr    error
-		noIdP        bool
-		idpEmail     string
-		idpHasData   bool
-		idpErr       error
-		expectEmail  string
-		expectUserID string
-		expectIdPHit bool
+		name               string
+		peerUserID         string
+		storedUsers        map[string]*types.User
+		storedErr          error
+		noIdP              bool
+		idpEmail           string
+		idpHasData         bool
+		idpErr             error
+		expectEmail        string
+		expectUserID       string
+		expectIdPHit       bool
+		expectDeniedReason string
 	}{
 		{
 			name:         "idp email wins over stored email",
@@ -490,14 +573,17 @@ func TestValidateTunnelPeerUserEmailEnrichment(t *testing.T) {
 			expectIdPHit: true,
 		},
 		{
-			name:         "idp email when stored user missing keeps peer.UserID as principal",
-			peerUserID:   userID,
-			storedUsers:  map[string]*types.User{},
-			idpEmail:     "idp@example.com",
-			idpHasData:   true,
-			expectEmail:  "idp@example.com",
-			expectUserID: userID,
-			expectIdPHit: true,
+			// The identity still resolves from the IdP, but an owner the store
+			// cannot resolve denies the fast-path rather than granting it.
+			name:               "idp email when stored user missing keeps peer.UserID as principal",
+			peerUserID:         userID,
+			storedUsers:        map[string]*types.User{},
+			idpEmail:           "idp@example.com",
+			idpHasData:         true,
+			expectEmail:        "idp@example.com",
+			expectUserID:       userID,
+			expectIdPHit:       true,
+			expectDeniedReason: deniedReasonUserNotFound,
 		},
 		{
 			name:         "unlinked peer uses peer name and never consults idp",
@@ -545,9 +631,13 @@ func TestValidateTunnelPeerUserEmailEnrichment(t *testing.T) {
 
 			require.NoError(t, err)
 			require.NotNil(t, resp)
-			assert.True(t, resp.GetValid(), "expected access granted")
+			assert.Equal(t, tt.expectDeniedReason == "", resp.GetValid(), "unexpected access decision")
+			assert.Equal(t, tt.expectDeniedReason, resp.GetDeniedReason(), "unexpected denied reason")
 			assert.Equal(t, tt.expectEmail, resp.GetUserEmail())
 			assert.Equal(t, tt.expectUserID, resp.GetUserId())
+			if tt.expectDeniedReason != "" {
+				assert.Empty(t, resp.GetSessionToken(), "a denied peer must not receive a session token")
+			}
 
 			if idpMock != nil {
 				if tt.expectIdPHit {
@@ -562,6 +652,193 @@ func TestValidateTunnelPeerUserEmailEnrichment(t *testing.T) {
 	}
 }
 
+// TestDeniedReasonValues pins the wire values of the account status denied
+// reasons. The proxy logs them and operators filter access logs on them, so a
+// rename is a breaking change rather than an internal detail.
+// TestSameAccount pins the fail-closed behaviour of the account binding: an
+// unset account on either side must never compare equal into a grant.
+func TestSameAccount(t *testing.T) {
+	assert.True(t, sameAccount("account1", "account1"), "matching accounts should bind")
+	assert.False(t, sameAccount("account1", "account2"), "different accounts must not bind")
+	assert.False(t, sameAccount("", ""), "two unset accounts must not bind")
+	assert.False(t, sameAccount("account1", ""), "an unset service account must not bind")
+	assert.False(t, sameAccount("", "account1"), "an unset user account must not bind")
+}
+
+func TestDeniedReasonValues(t *testing.T) {
+	assert.Equal(t, "pending_approval", deniedReasonPendingApproval, "pending approval denied reason wire value")
+	assert.Equal(t, "user_blocked", deniedReasonUserBlocked, "blocked user denied reason wire value")
+	assert.Equal(t, "user_not_found", deniedReasonUserNotFound, "unresolved user denied reason wire value")
+}
+
+// TestValidateTunnelPeerOwnerStatus verifies that the mesh fast-path gates on
+// the account status of the peer's owning user. A peer whose owner was blocked
+// after the peer registered must lose access, while an unlinked machine peer
+// keeps it.
+func TestValidateTunnelPeerOwnerStatus(t *testing.T) {
+	const (
+		domain    = "app.example.com"
+		accountID = "account1"
+		peerID    = "peer1"
+		peerName  = "peer-display-name"
+		userID    = "user1"
+	)
+
+	tests := []struct {
+		name               string
+		peerUserID         string
+		owner              *types.User
+		expectDeniedReason string
+		expectEmail        string
+	}{
+		{
+			name:       "active owner allowed",
+			peerUserID: userID,
+			owner:      &types.User{Id: userID, AccountID: accountID, Email: "user@example.com"},
+		},
+		{
+			name:               "owner pending approval denied",
+			peerUserID:         userID,
+			owner:              &types.User{Id: userID, AccountID: accountID, Email: "user@example.com", Blocked: true, PendingApproval: true},
+			expectDeniedReason: deniedReasonPendingApproval,
+		},
+		{
+			name:               "owner blocked after registering the peer denied",
+			peerUserID:         userID,
+			owner:              &types.User{Id: userID, AccountID: accountID, Email: "user@example.com", Blocked: true},
+			expectDeniedReason: deniedReasonUserBlocked,
+		},
+		{
+			name:       "unlinked machine peer stays allowed",
+			peerUserID: "",
+			owner:      &types.User{Id: userID, AccountID: accountID, Blocked: true},
+		},
+		{
+			// The user lookup is not account-scoped, so a peer row pointing at
+			// another account's user must not resolve into an owner: the peer is
+			// denied and the foreign email never reaches the response.
+			name:               "owner in another account denied and not disclosed",
+			peerUserID:         userID,
+			owner:              &types.User{Id: userID, AccountID: "otherAccount", Email: "foreign@example.com"},
+			expectDeniedReason: deniedReasonUserNotFound,
+			expectEmail:        peerName,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			svc := &service.Service{Domain: domain, AccountID: accountID}
+			usersManager := &mockUsersManager{users: map[string]*types.User{userID: tt.owner}}
+			server := &ProxyServiceServer{
+				serviceManager: &mockReverseProxyManager{
+					proxiesByAccount: map[string][]*service.Service{accountID: {svc}},
+				},
+				peersManager: &mockTunnelPeersManager{
+					peer: &peer.Peer{ID: peerID, Name: peerName, UserID: tt.peerUserID},
+				},
+				usersManager: usersManager,
+			}
+
+			resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
+				Domain:   domain,
+				TunnelIp: "100.64.0.1",
+			})
+
+			require.NoError(t, err)
+			require.NotNil(t, resp)
+			assert.Equal(t, tt.expectDeniedReason, resp.GetDeniedReason(), "unexpected denied reason")
+			assert.Equal(t, tt.expectDeniedReason == "", resp.GetValid(), "unexpected access decision")
+			if tt.expectDeniedReason != "" {
+				assert.Empty(t, resp.GetSessionToken(), "a denied peer must not receive a session token")
+			}
+
+			if tt.expectEmail != "" {
+				assert.Equal(t, tt.expectEmail, resp.GetUserEmail(), "unexpected identity on the response")
+			}
+
+			// The status gate and the identity resolution share one lookup;
+			// an unlinked peer has no owner to look up at all.
+			wantLookups := 1
+			if tt.peerUserID == "" {
+				wantLookups = 0
+			}
+			assert.Equal(t, wantLookups, usersManager.getUserCalls, "owner must be resolved exactly once per request")
+		})
+	}
+}
+
+// TestValidateTunnelPeerRecordsActivity pins that a granted mesh request is
+// handed to the activity manager. Which of those the manager then writes is its
+// own decision, covered by its tests.
+func TestValidateTunnelPeerRecordsActivity(t *testing.T) {
+	const (
+		domain    = "app.example.com"
+		accountID = "account1"
+		peerID    = "peer1"
+	)
+
+	activityManager := &mockActivityManager{}
+	server := &ProxyServiceServer{
+		activityManager: activityManager,
+		serviceManager: &mockReverseProxyManager{
+			proxiesByAccount: map[string][]*service.Service{
+				accountID: {{Domain: domain, AccountID: accountID}},
+			},
+		},
+		peersManager: &mockTunnelPeersManager{
+			peer: &peer.Peer{ID: peerID, Name: "agent", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+		},
+		usersManager: &mockUsersManager{users: map[string]*types.User{}},
+	}
+
+	resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
+		Domain:   domain,
+		TunnelIp: "100.64.0.1",
+	})
+
+	require.NoError(t, err)
+	require.True(t, resp.GetValid(), "peer should be granted access")
+
+	require.Len(t, activityManager.seenMarks, 1, "a granted peer should reach the activity manager once")
+	assert.Equal(t, accountID, activityManager.seenMarks[0].accountID, "activity must be attributed to the service account")
+	assert.Equal(t, peerID, activityManager.seenMarks[0].peerID, "activity must be attributed to the calling peer")
+}
+
+// TestValidateTunnelPeerDeniedRecordsNoActivity keeps the write on the granted
+// path only: a refused peer is not evidence its owner was active.
+func TestValidateTunnelPeerDeniedRecordsNoActivity(t *testing.T) {
+	const (
+		domain    = "app.example.com"
+		accountID = "account1"
+	)
+
+	activityManager := &mockActivityManager{}
+	server := &ProxyServiceServer{
+		activityManager: activityManager,
+		serviceManager: &mockReverseProxyManager{
+			proxiesByAccount: map[string][]*service.Service{
+				accountID: {{Domain: domain, AccountID: accountID}},
+			},
+		},
+		peersManager: &mockTunnelPeersManager{
+			peer: &peer.Peer{ID: "peer1", Name: "agent", UserID: "user1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+		},
+		// The owner is blocked, so the tunnel gate denies before the mint.
+		usersManager: &mockUsersManager{users: map[string]*types.User{
+			"user1": {Id: "user1", AccountID: accountID, Blocked: true},
+		}},
+	}
+
+	resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
+		Domain:   domain,
+		TunnelIp: "100.64.0.1",
+	})
+
+	require.NoError(t, err)
+	require.False(t, resp.GetValid(), "blocked owner should be denied")
+	assert.Empty(t, activityManager.seenMarks, "a denied peer must not be marked seen")
+}
+
 func TestGetAccountProxyByDomain(t *testing.T) {
 	tests := []struct {
 		name             string
diff --git a/management/internals/shared/grpc/proxy_llm_policy_limits_test.go b/management/internals/shared/grpc/proxy_llm_policy_limits_test.go
new file mode 100644
index 000000000..c293c39ea
--- /dev/null
+++ b/management/internals/shared/grpc/proxy_llm_policy_limits_test.go
@@ -0,0 +1,138 @@
+package grpc
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	grpcstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// fakeAgentNetworkLimits records the PolicySelectionInput it was invoked with
+// and returns a pre-programmed result, so tests can assert what the handler
+// forwards to the selector.
+type fakeAgentNetworkLimits struct {
+	gotInput agentnetwork.PolicySelectionInput
+	result   *agentnetwork.PolicySelectionResult
+	err      error
+}
+
+func (f *fakeAgentNetworkLimits) SelectPolicyForRequest(_ context.Context, in agentnetwork.PolicySelectionInput) (*agentnetwork.PolicySelectionResult, error) {
+	f.gotInput = in
+	if f.err != nil {
+		return nil, f.err
+	}
+	return f.result, nil
+}
+
+func (f *fakeAgentNetworkLimits) RecordUsage(_ context.Context, _ agentnetwork.RecordUsageInput) error {
+	return nil
+}
+
+// TestCheckLLMPolicyLimits_ForwardsModelToSelector proves the wiring added here:
+// the model the proxy extracted must reach the selector's Model unchanged,
+// alongside the account/user/group/provider fields.
+func TestCheckLLMPolicyLimits_ForwardsModelToSelector(t *testing.T) {
+	fake := &fakeAgentNetworkLimits{result: &agentnetwork.PolicySelectionResult{Allow: true, SelectedPolicyID: "pol-1"}}
+	s := &ProxyServiceServer{}
+	s.SetAgentNetworkLimitsService(fake)
+
+	req := &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  "acc-1",
+		UserId:     "user-1",
+		GroupIds:   []string{"grp-a", "grp-b"},
+		ProviderId: "prov-1",
+		Model:      "claude-opus-4",
+	}
+
+	resp, err := s.CheckLLMPolicyLimits(context.Background(), req)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	assert.Equal(t, "acc-1", fake.gotInput.AccountID)
+	assert.Equal(t, "user-1", fake.gotInput.UserID)
+	assert.Equal(t, []string{"grp-a", "grp-b"}, fake.gotInput.GroupIDs)
+	assert.Equal(t, "prov-1", fake.gotInput.ProviderID)
+	assert.Equal(t, "claude-opus-4", fake.gotInput.Model,
+		"the request's model must be forwarded to the selector")
+}
+
+// TestCheckLLMPolicyLimits_EmptyModelForwardedAsEmpty proves an undetermined
+// model (empty string) is forwarded as-is; the selector decides how to treat it.
+func TestCheckLLMPolicyLimits_EmptyModelForwardedAsEmpty(t *testing.T) {
+	fake := &fakeAgentNetworkLimits{result: &agentnetwork.PolicySelectionResult{Allow: true}}
+	s := &ProxyServiceServer{}
+	s.SetAgentNetworkLimitsService(fake)
+
+	req := &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  "acc-1",
+		ProviderId: "prov-1",
+	}
+
+	_, err := s.CheckLLMPolicyLimits(context.Background(), req)
+	require.NoError(t, err)
+	assert.Equal(t, "", fake.gotInput.Model, "an absent model must be forwarded as empty, not fabricated")
+}
+
+// TestCheckLLMPolicyLimits_DenyResponseCarriesModelBlockedCode proves the deny
+// envelope surfaces the model-allowlist deny code + reason through the response.
+func TestCheckLLMPolicyLimits_DenyResponseCarriesModelBlockedCode(t *testing.T) {
+	fake := &fakeAgentNetworkLimits{result: &agentnetwork.PolicySelectionResult{
+		Allow:      false,
+		DenyCode:   "llm_policy.model_blocked",
+		DenyReason: `model "claude-opus-4" is not permitted by any applicable policy allowlist`,
+	}}
+	s := &ProxyServiceServer{}
+	s.SetAgentNetworkLimitsService(fake)
+
+	resp, err := s.CheckLLMPolicyLimits(context.Background(), &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  "acc-1",
+		ProviderId: "prov-1",
+		Model:      "claude-opus-4",
+	})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	assert.Equal(t, "deny", resp.Decision)
+	assert.Equal(t, "llm_policy.model_blocked", resp.DenyCode)
+	assert.NotEmpty(t, resp.DenyReason)
+	assert.Empty(t, resp.SelectedPolicyId, "a denied request must carry no selected policy")
+}
+
+// TestCheckLLMPolicyLimits_SelectorErrorSurfacesAsInternal proves a selector
+// failure surfaces as an Internal gRPC error rather than a silent allow.
+func TestCheckLLMPolicyLimits_SelectorErrorSurfacesAsInternal(t *testing.T) {
+	fake := &fakeAgentNetworkLimits{err: errors.New("boom")}
+	s := &ProxyServiceServer{}
+	s.SetAgentNetworkLimitsService(fake)
+
+	_, err := s.CheckLLMPolicyLimits(context.Background(), &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  "acc-1",
+		ProviderId: "prov-1",
+		Model:      "gpt-4o",
+	})
+	require.Error(t, err)
+	st, ok := grpcstatus.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, codes.Internal, st.Code(), "selector errors must never fail open on the hot path")
+}
+
+// TestCheckLLMPolicyLimits_UnconfiguredServiceReturnsUnimplemented locks the
+// fallback: with no limits service wired the RPC returns Unimplemented.
+func TestCheckLLMPolicyLimits_UnconfiguredServiceReturnsUnimplemented(t *testing.T) {
+	s := &ProxyServiceServer{}
+
+	_, err := s.CheckLLMPolicyLimits(context.Background(), &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  "acc-1",
+		ProviderId: "prov-1",
+	})
+	require.Error(t, err)
+	st, ok := grpcstatus.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, codes.Unimplemented, st.Code())
+}
diff --git a/management/internals/shared/grpc/proxy_snapshot_test.go b/management/internals/shared/grpc/proxy_snapshot_test.go
index 68d2ecfd1..684a984d2 100644
--- a/management/internals/shared/grpc/proxy_snapshot_test.go
+++ b/management/internals/shared/grpc/proxy_snapshot_test.go
@@ -6,9 +6,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/metadata"
 
diff --git a/management/internals/shared/grpc/proxy_test.go b/management/internals/shared/grpc/proxy_test.go
index 0379edc6d..1e718a2c4 100644
--- a/management/internals/shared/grpc/proxy_test.go
+++ b/management/internals/shared/grpc/proxy_test.go
@@ -9,7 +9,6 @@ import (
 	"testing"
 	"time"
 
-	cachestore "github.com/eko/gocache/lib/v4/store"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc/codes"
@@ -21,7 +20,7 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-func testCacheStore(t *testing.T) cachestore.StoreInterface {
+func testCacheStore(t *testing.T) nbcache.Store {
 	t.Helper()
 	s, err := nbcache.NewStore(context.Background(), 30*time.Minute, 10*time.Minute, 100)
 	require.NoError(t, err)
@@ -130,11 +129,11 @@ func drainEmpty(ch chan *proto.GetMappingUpdateResponse) bool {
 func TestSendServiceUpdateToCluster_UniqueTokensPerProxy(t *testing.T) {
 	ctx := context.Background()
 	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
-		tokenStore:        tokenStore,
-		pkceVerifierStore: pkceStore,
+		tokenStore:     tokenStore,
+		singleUseStore: singleUseStore,
 	}
 	s.SetProxyController(newTestProxyController())
 
@@ -187,11 +186,11 @@ func TestSendServiceUpdateToCluster_UniqueTokensPerProxy(t *testing.T) {
 func TestSendServiceUpdateToCluster_DeleteNoToken(t *testing.T) {
 	ctx := context.Background()
 	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
-		tokenStore:        tokenStore,
-		pkceVerifierStore: pkceStore,
+		tokenStore:     tokenStore,
+		singleUseStore: singleUseStore,
 	}
 	s.SetProxyController(newTestProxyController())
 
@@ -221,11 +220,11 @@ func TestSendServiceUpdateToCluster_DeleteNoToken(t *testing.T) {
 func TestSendServiceUpdate_UniqueTokensPerProxy(t *testing.T) {
 	ctx := context.Background()
 	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
-		tokenStore:        tokenStore,
-		pkceVerifierStore: pkceStore,
+		tokenStore:     tokenStore,
+		singleUseStore: singleUseStore,
 	}
 	s.SetProxyController(newTestProxyController())
 
@@ -273,13 +272,13 @@ func generateState(s *ProxyServiceServer, redirectURL string) string {
 
 func TestOAuthState_NeverTheSame(t *testing.T) {
 	ctx := context.Background()
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
 		oidcConfig: ProxyOIDCConfig{
 			HMACKey: []byte("test-hmac-key"),
 		},
-		pkceVerifierStore: pkceStore,
+		singleUseStore: singleUseStore,
 	}
 
 	redirectURL := "https://app.example.com/callback"
@@ -301,20 +300,20 @@ func TestOAuthState_NeverTheSame(t *testing.T) {
 
 func TestValidateState_RejectsOldTwoPartFormat(t *testing.T) {
 	ctx := context.Background()
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
 		oidcConfig: ProxyOIDCConfig{
 			HMACKey: []byte("test-hmac-key"),
 		},
-		pkceVerifierStore: pkceStore,
+		singleUseStore: singleUseStore,
 	}
 
 	// Old format had only 2 parts: base64(url)|hmac
-	err := s.pkceVerifierStore.Store("base64url|hmac", "test", 10*time.Minute)
+	err := s.singleUseStore.Store("base64url|hmac", "test", 10*time.Minute)
 	require.NoError(t, err)
 
-	_, _, err = s.ValidateState("base64url|hmac")
+	_, _, _, err = s.ValidateState("base64url|hmac")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid state format")
 }
@@ -373,24 +372,48 @@ func TestEnforceAccountScope_AllowsNoTokenInContext(t *testing.T) {
 
 func TestValidateState_RejectsInvalidHMAC(t *testing.T) {
 	ctx := context.Background()
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
 		oidcConfig: ProxyOIDCConfig{
 			HMACKey: []byte("test-hmac-key"),
 		},
-		pkceVerifierStore: pkceStore,
+		singleUseStore: singleUseStore,
 	}
 
 	// Store with tampered HMAC
-	err := s.pkceVerifierStore.Store("dGVzdA==|nonce|wrong-hmac", "test", 10*time.Minute)
+	err := s.singleUseStore.Store("dGVzdA==|nonce|wrong-hmac", "test", 10*time.Minute)
 	require.NoError(t, err)
 
-	_, _, err = s.ValidateState("dGVzdA==|nonce|wrong-hmac")
+	_, _, _, err = s.ValidateState("dGVzdA==|nonce|wrong-hmac")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid state signature")
 }
 
+func TestSessionCodeCannotConsumeOIDCState(t *testing.T) {
+	const verifier = "pkce-verifier"
+
+	store := NewSingleUseStore(context.Background(), testCacheStore(t))
+	server := &ProxyServiceServer{
+		oidcConfig: ProxyOIDCConfig{
+			HMACKey: []byte("test-hmac-key"),
+		},
+		singleUseStore: store,
+	}
+	state := generateState(server, "https://service.example.com/callback")
+	require.NoError(t, store.Store(state, verifier, time.Minute))
+
+	response, err := server.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		SessionCode: state,
+	})
+	require.NoError(t, err)
+	assert.False(t, response.GetValid())
+
+	gotVerifier, _, _, err := server.ValidateState(state)
+	require.NoError(t, err)
+	assert.Equal(t, verifier, gotVerifier)
+}
+
 func TestSendServiceUpdateToCluster_FiltersOnCapability(t *testing.T) {
 	tokenStore := NewOneTimeTokenStore(context.Background(), testCacheStore(t))
 
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index fa06687d0..b48a86d55 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -25,6 +25,7 @@ import (
 	"google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/shared/management/client/common"
+	"github.com/netbirdio/netbird/shared/management/grpc"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
@@ -41,10 +42,11 @@ import (
 	"github.com/netbirdio/netbird/management/server/auth"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	internalStatus "github.com/netbirdio/netbird/shared/management/status"
 )
@@ -69,6 +71,7 @@ type Server struct {
 	peerLocks      sync.Map
 	authManager    auth.Manager
 	sessionStore   *auth.SessionStore
+	challenger     *certposture.Challenger
 
 	logBlockedPeers          bool
 	blockPeersWithSameConfig bool
@@ -130,7 +133,13 @@ func NewServer(
 		}
 	}
 
+	serverKey, err := secretsManager.GetWGKey()
+	if err != nil {
+		return nil, fmt.Errorf("get server WireGuard key: %w", err)
+	}
+
 	return &Server{
+		challenger:               newCertChallenger(config.DataStoreEncryptionKey, serverKey),
 		jobManager:               jobManager,
 		accountManager:           accountManager,
 		settingsManager:          settingsManager,
@@ -245,17 +254,10 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 	realIP := getRealIP(ctx)
 	sRealIP := realIP.String()
 	peerMeta := extractPeerMeta(ctx, syncReq.GetMeta())
-	userID, err := s.accountManager.GetUserIDByPeerKey(ctx, peerKey.String())
-	if err != nil {
-		s.syncSem.Add(-1)
-		if errStatus, ok := internalStatus.FromError(err); ok && errStatus.Type() == internalStatus.NotFound {
-			return status.Errorf(codes.PermissionDenied, "peer is not registered")
-		}
-		return mapError(ctx, err)
-	}
+	peerMeta.Certificates = s.verifiedCertificates(ctx, peerKey, syncReq.GetMeta().GetCertificateProofs())
 
 	metahashed := metaHash(peerMeta)
-	if userID == "" && !s.loginFilter.allowLogin(peerKey.String(), metahashed) {
+	if !s.loginFilter.allowLogin(peerKey.String(), metahashed) {
 		if s.appMetrics != nil {
 			s.appMetrics.GRPCMetrics().CountSyncRequestBlocked()
 		}
@@ -316,11 +318,12 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 		return mapError(ctx, err)
 	}
 
-	err = s.sendInitialSync(ctx, peerKey, peer, netMap, postureChecks, srv, dnsFwdPort)
+	trackChallenge := func() { s.accountManager.TrackCertificateChallenges(ctx, accountID, peer.ID, syncStart) }
+	err = s.sendInitialSync(ctx, peerKey, peer, netMap, postureChecks, srv, dnsFwdPort, trackChallenge)
 	if err != nil {
 		log.WithContext(ctx).Debugf("error while sending initial sync for %s: %v", peerKey.String(), err)
 		s.syncSem.Add(-1)
-		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart)
+		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart, nil)
 		return err
 	}
 
@@ -328,7 +331,7 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 	if err != nil {
 		log.WithContext(ctx).Debugf("error while notify peer connected for %s: %v", peerKey.String(), err)
 		s.syncSem.Add(-1)
-		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart)
+		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart, nil)
 		return err
 	}
 
@@ -344,7 +347,10 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 
 	s.syncSem.Add(-1)
 
-	return s.handleUpdates(ctx, accountID, peerKey, peer, updates, srv, syncStart)
+	return PeerUpdateHandlerFactory(peerKey, updates, s.secretsManager, s.challenger,
+		trackChallenge,
+		srv, func() { s.cancelPeerRoutines(ctx, accountID, peer, syncStart, updates) }).
+		WithMetrics(s.appMetrics).HandleUpdates(ctx)
 }
 
 func (s *Server) handleHandshake(ctx context.Context, srv proto.ManagementService_JobServer) (wgtypes.Key, error) {
@@ -389,7 +395,7 @@ func (s *Server) startResponseReceiver(ctx context.Context, srv proto.Management
 
 func (s *Server) sendJobsLoop(ctx context.Context, accountID string, peerKey wgtypes.Key, peer *nbpeer.Peer, updates *job.Channel, srv proto.ManagementService_JobServer) error {
 	// todo figure out better error handling strategy
-	defer s.jobManager.CloseChannel(ctx, accountID, peer.ID)
+	defer s.jobManager.CloseChannel(ctx, accountID, peer.ID, updates)
 
 	for {
 		event, err := updates.Event(ctx)
@@ -411,91 +417,6 @@ func (s *Server) sendJobsLoop(ctx context.Context, accountID string, peerKey wgt
 	}
 }
 
-// handleUpdates sends updates to the connected peer until the updates channel is closed.
-// It implements a backpressure mechanism that sends the first update immediately,
-// then debounces subsequent rapid updates, ensuring only the latest update is sent
-// after a quiet period.
-func (s *Server) handleUpdates(ctx context.Context, accountID string, peerKey wgtypes.Key, peer *nbpeer.Peer, updates chan *network_map.UpdateMessage, srv proto.ManagementService_SyncServer, streamStartTime time.Time) error {
-	log.WithContext(ctx).Tracef("starting to handle updates for peer %s", peerKey.String())
-
-	// Create a debouncer for this peer connection
-	debouncer := NewUpdateDebouncer(1000 * time.Millisecond)
-	defer debouncer.Stop()
-
-	for {
-		select {
-		// condition when there are some updates
-		// todo set the updates channel size to 1
-		case update, open := <-updates:
-			if s.appMetrics != nil {
-				s.appMetrics.GRPCMetrics().UpdateChannelQueueLength(len(updates) + 1)
-			}
-
-			if !open {
-				log.WithContext(ctx).Debugf("updates channel for peer %s was closed", peerKey.String())
-				s.cancelPeerRoutines(ctx, accountID, peer, streamStartTime)
-				return nil
-			}
-
-			log.WithContext(ctx).Tracef("received an update for peer %s", peerKey.String())
-			if debouncer.ProcessUpdate(update) {
-				// Send immediately (first update or after quiet period)
-				if err := s.sendUpdate(ctx, accountID, peerKey, peer, update, srv, streamStartTime); err != nil {
-					log.WithContext(ctx).Debugf("error while sending an update to peer %s: %v", peerKey.String(), err)
-					return err
-				}
-			}
-
-		// Timer expired - quiet period reached, send pending updates if any
-		case <-debouncer.TimerChannel():
-			pendingUpdates := debouncer.GetPendingUpdates()
-			if len(pendingUpdates) == 0 {
-				continue
-			}
-			log.WithContext(ctx).Debugf("sending %d debounced update(s) for peer %s", len(pendingUpdates), peerKey.String())
-			for _, pendingUpdate := range pendingUpdates {
-				if err := s.sendUpdate(ctx, accountID, peerKey, peer, pendingUpdate, srv, streamStartTime); err != nil {
-					log.WithContext(ctx).Debugf("error while sending an update to peer %s: %v", peerKey.String(), err)
-					return err
-				}
-			}
-
-		// condition when client <-> server connection has been terminated
-		case <-srv.Context().Done():
-			// happens when connection drops, e.g. client disconnects
-			log.WithContext(ctx).Debugf("stream of peer %s has been closed", peerKey.String())
-			s.cancelPeerRoutines(ctx, accountID, peer, streamStartTime)
-			return srv.Context().Err()
-		}
-	}
-}
-
-// sendUpdate encrypts the update message using the peer key and the server's wireguard key,
-// then sends the encrypted message to the connected peer via the sync server.
-func (s *Server) sendUpdate(ctx context.Context, accountID string, peerKey wgtypes.Key, peer *nbpeer.Peer, update *network_map.UpdateMessage, srv proto.ManagementService_SyncServer, streamStartTime time.Time) error {
-	key, err := s.secretsManager.GetWGKey()
-	if err != nil {
-		s.cancelPeerRoutines(ctx, accountID, peer, streamStartTime)
-		return status.Errorf(codes.Internal, "failed processing update message")
-	}
-
-	encryptedResp, err := encryption.EncryptMessage(peerKey, key, update.Update)
-	if err != nil {
-		s.cancelPeerRoutines(ctx, accountID, peer, streamStartTime)
-		return status.Errorf(codes.Internal, "failed processing update message")
-	}
-	err = srv.Send(&proto.EncryptedMessage{
-		WgPubKey: key.PublicKey().String(),
-		Body:     encryptedResp,
-	})
-	if err != nil {
-		s.cancelPeerRoutines(ctx, accountID, peer, streamStartTime)
-		return status.Errorf(codes.Internal, "failed sending update message")
-	}
-	log.WithContext(ctx).Tracef("sent an update to peer %s", peerKey.String())
-	return nil
-}
-
 // sendJob encrypts the update message using the peer key and the server's wireguard key,
 // then sends the encrypted message to the connected peer via the sync server.
 func (s *Server) sendJob(ctx context.Context, peerKey wgtypes.Key, job *job.Event, srv proto.ManagementService_JobServer) error {
@@ -521,21 +442,28 @@ func (s *Server) sendJob(ctx context.Context, peerKey wgtypes.Key, job *job.Even
 	return nil
 }
 
-func (s *Server) cancelPeerRoutines(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time) {
+func (s *Server) cancelPeerRoutines(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time, session chan *network_map.UpdateMessage) {
 	uncanceledCTX := context.WithoutCancel(ctx)
 	unlock := s.acquirePeerLockByUID(uncanceledCTX, peer.Key)
 	defer unlock()
 
-	s.cancelPeerRoutinesWithoutLock(uncanceledCTX, accountID, peer, streamStartTime)
+	s.cancelPeerRoutinesWithoutLock(uncanceledCTX, accountID, peer, streamStartTime, session)
 }
 
-func (s *Server) cancelPeerRoutinesWithoutLock(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time) {
+// cancelPeerRoutinesWithoutLock tears down the stream of the session identified by streamStartTime
+// and its updates channel. A nil session means the stream failed before it registered a channel;
+// the controller then closes any channel still registered.
+func (s *Server) cancelPeerRoutinesWithoutLock(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time, session chan *network_map.UpdateMessage) {
 	err := s.accountManager.OnPeerDisconnected(ctx, accountID, peer.Key, streamStartTime)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to disconnect peer %s properly: %v", peer.Key, err)
 	}
-	s.networkMapController.OnPeerDisconnected(ctx, accountID, peer.ID)
+	if !s.networkMapController.OnPeerDisconnected(ctx, accountID, peer.ID, session) {
+		log.WithContext(ctx).Debugf("skipped peer routines teardown for %s: a newer session owns the peer", peer.Key)
+		return
+	}
 	s.secretsManager.CancelRefresh(peer.ID)
+	s.accountManager.UntrackCertificateChallenges(accountID, peer.ID, streamStartTime)
 
 	log.WithContext(ctx).Debugf("peer %s has been disconnected", peer.Key)
 }
@@ -625,9 +553,9 @@ func extractPeerMeta(ctx context.Context, meta *proto.PeerSystemMeta) nbpeer.Pee
 		return nbpeer.PeerSystemMeta{}
 	}
 
-	osVersion := meta.GetOSVersion()
+	osVersion := cleanClientString(meta.GetOSVersion())
 	if osVersion == "" {
-		osVersion = meta.GetCore()
+		osVersion = cleanClientString(meta.GetCore())
 	}
 
 	networkAddresses := make([]nbpeer.NetworkAddress, 0, len(meta.GetNetworkAddresses()))
@@ -639,41 +567,42 @@ func extractPeerMeta(ctx context.Context, meta *proto.PeerSystemMeta) nbpeer.Pee
 		}
 		networkAddresses = append(networkAddresses, nbpeer.NetworkAddress{
 			NetIP: netAddr,
-			Mac:   addr.GetMac(),
+			Mac:   cleanClientString(addr.GetMac()),
 		})
 	}
 
 	files := make([]nbpeer.File, 0, len(meta.GetFiles()))
 	for _, file := range meta.GetFiles() {
 		files = append(files, nbpeer.File{
-			Path:             file.GetPath(),
+			Path:             cleanClientString(file.GetPath()),
 			Exist:            file.GetExist(),
 			ProcessIsRunning: file.GetProcessIsRunning(),
 		})
 	}
 
 	return nbpeer.PeerSystemMeta{
-		Hostname:           meta.GetHostname(),
-		GoOS:               meta.GetGoOS(),
-		Kernel:             meta.GetKernel(),
-		Platform:           meta.GetPlatform(),
-		OS:                 meta.GetOS(),
+		Hostname:           cleanClientString(meta.GetHostname()),
+		GoOS:               cleanClientString(meta.GetGoOS()),
+		Kernel:             cleanClientString(meta.GetKernel()),
+		Platform:           cleanClientString(meta.GetPlatform()),
+		OS:                 cleanClientString(meta.GetOS()),
 		OSVersion:          osVersion,
-		WtVersion:          meta.GetNetbirdVersion(),
-		UIVersion:          meta.GetUiVersion(),
-		KernelVersion:      meta.GetKernelVersion(),
+		WtVersion:          cleanClientString(meta.GetNetbirdVersion()),
+		UIVersion:          cleanClientString(meta.GetUiVersion()),
+		KernelVersion:      cleanClientString(meta.GetKernelVersion()),
 		NetworkAddresses:   networkAddresses,
-		SystemSerialNumber: meta.GetSysSerialNumber(),
-		SystemProductName:  meta.GetSysProductName(),
-		SystemManufacturer: meta.GetSysManufacturer(),
+		SystemSerialNumber: cleanClientString(meta.GetSysSerialNumber()),
+		SystemProductName:  cleanClientString(meta.GetSysProductName()),
+		SystemManufacturer: cleanClientString(meta.GetSysManufacturer()),
 		Environment: nbpeer.Environment{
-			Cloud:    meta.GetEnvironment().GetCloud(),
-			Platform: meta.GetEnvironment().GetPlatform(),
+			Cloud:    cleanClientString(meta.GetEnvironment().GetCloud()),
+			Platform: cleanClientString(meta.GetEnvironment().GetPlatform()),
 		},
 		Flags: nbpeer.Flags{
 			RosenpassEnabled:      meta.GetFlags().GetRosenpassEnabled(),
 			RosenpassPermissive:   meta.GetFlags().GetRosenpassPermissive(),
 			ServerSSHAllowed:      meta.GetFlags().GetServerSSHAllowed(),
+			RemoteJobsAllowed:     meta.GetFlags().GetRemoteJobsAllowed(),
 			DisableClientRoutes:   meta.GetFlags().GetDisableClientRoutes(),
 			DisableServerRoutes:   meta.GetFlags().GetDisableServerRoutes(),
 			DisableDNS:            meta.GetFlags().GetDisableDNS(),
@@ -683,11 +612,17 @@ func extractPeerMeta(ctx context.Context, meta *proto.PeerSystemMeta) nbpeer.Pee
 			LazyConnectionEnabled: meta.GetFlags().GetLazyConnectionEnabled(),
 			DisableIPv6:           meta.GetFlags().GetDisableIPv6(),
 		},
-		Files:        files,
-		Capabilities: capabilitiesToInt32(meta.GetCapabilities()),
+		Files:              files,
+		Capabilities:       capabilitiesToInt32(meta.GetCapabilities()),
+		SyncMessageVersion: int(meta.GetSyncMessageVersion()),
 	}
 }
 
+// cleanClientString removes NUL bytes and invalid UTF-8 from a client-reported string, which Postgres rejects in text columns.
+func cleanClientString(s string) string {
+	return strings.ToValidUTF8(strings.ReplaceAll(s, "\x00", ""), "")
+}
+
 func capabilitiesToInt32(caps []proto.PeerCapability) []int32 {
 	result := make([]int32, len(caps))
 	for i, c := range caps {
@@ -732,6 +667,7 @@ func (s *Server) Login(ctx context.Context, req *proto.EncryptedMessage) (*proto
 	}
 
 	peerMeta := extractPeerMeta(ctx, loginReq.GetMeta())
+	peerMeta.Certificates = s.verifiedCertificates(ctx, peerKey, loginReq.GetMeta().GetCertificateProofs())
 	metahashed := metaHash(peerMeta)
 	if !s.loginFilter.allowLogin(peerKey.String(), metahashed) {
 		if s.logBlockedPeers {
@@ -780,7 +716,7 @@ func (s *Server) Login(ctx context.Context, req *proto.EncryptedMessage) (*proto
 
 	peer, network, postureChecks, enableSSH, err := s.accountManager.LoginPeer(ctx, types.PeerLogin{
 		WireGuardPubKey: peerKey.String(),
-		SSHKey:          string(sshKey),
+		SSHKey:          cleanClientString(string(sshKey)),
 		Meta:            peerMeta,
 		UserID:          userID,
 		SetupKey:        loginReq.GetSetupKey(),
@@ -808,6 +744,8 @@ func (s *Server) Login(ctx context.Context, req *proto.EncryptedMessage) (*proto
 		return nil, status.Errorf(codes.Internal, "failed logging in peer")
 	}
 
+	// Renewal is tracked by the sync stream that follows, on whichever instance it lands.
+	stampCertificateChallenges(loginResp.Checks, s.challenger, peerKey)
 	encryptedResp, err := encryption.EncryptMessage(peerKey, key, loginResp)
 	if err != nil {
 		log.WithContext(ctx).Warnf("failed encrypting peer %s message", peer.ID)
@@ -899,7 +837,7 @@ func (s *Server) ExtendAuthSession(ctx context.Context, req *proto.EncryptedMess
 	}, nil
 }
 
-func (s *Server) prepareLoginResponse(ctx context.Context, peer *nbpeer.Peer, network *types.Network, postureChecks []*posture.Checks, enableSSH bool) (*proto.LoginResponse, error) {
+func (s *Server) prepareLoginResponse(ctx context.Context, peer *nbpeer.Peer, network *types.Network, postureChecks []*nmdata.PostureChecks, enableSSH bool) (*proto.LoginResponse, error) {
 	var relayToken *Token
 	var err error
 	if s.config.Relay != nil && len(s.config.Relay.Addresses) > 0 {
@@ -917,8 +855,8 @@ func (s *Server) prepareLoginResponse(ctx context.Context, peer *nbpeer.Peer, ne
 
 	// if peer has reached this point then it has logged in
 	loginResp := &proto.LoginResponse{
-		NetbirdConfig: toNetbirdConfig(s.config, nil, relayToken, nil, settings),
-		PeerConfig:    toPeerConfig(peer, network, s.networkMapController.GetDNSDomain(settings), settings, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH),
+		NetbirdConfig: toNetbirdConfig(s.config, nil, relayToken, nil, types.TwinAccountSettings(settings)),
+		PeerConfig:    toPeerConfig(types.TwinPeer(peer), types.TwinNetwork(network), s.networkMapController.GetDNSDomain(settings), types.TwinAccountSettings(settings), s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH, false),
 		Checks:        toProtocolChecks(ctx, postureChecks),
 	}
 
@@ -987,7 +925,7 @@ func (s *Server) IsHealthy(ctx context.Context, req *proto.Empty) (*proto.Empty,
 }
 
 // sendInitialSync sends initial proto.SyncResponse to the peer requesting synchronization
-func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer *nbpeer.Peer, networkMap *types.NetworkMap, postureChecks []*posture.Checks, srv proto.ManagementService_SyncServer, dnsFwdPort int64) error {
+func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer *nbpeer.Peer, networkMap *types.NetworkMap, postureChecks []*nmdata.PostureChecks, srv proto.ManagementService_SyncServer, dnsFwdPort int64, onChallengeStamped func()) error {
 	var err error
 	var turnToken *Token
 
@@ -1016,13 +954,52 @@ func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer
 		return status.Errorf(codes.Internal, "failed to get peer groups %s", err)
 	}
 
-	plainResp := ToSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, peer, turnToken, relayToken, networkMap, s.networkMapController.GetDNSDomain(settings), postureChecks, nil, settings, settings.Extra, peerGroups, dnsFwdPort)
+	dnsName := s.networkMapController.GetDNSDomain(settings)
+
+	var plainResp *proto.SyncResponse
+
+	commonSyncMessageVersion := grpc.HighestCommonSyncMessageVersion(
+		s.perAccountOrGlobalSyncMessageVersions(peer.AccountID),
+		grpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion))
+
+	log.WithContext(ctx).
+		WithFields(log.Fields{
+			"sync_message_version":        commonSyncMessageVersion,
+			"server_sync_message_version": s.perAccountOrGlobalSyncMessageVersions(peer.AccountID),
+			"peer_sync_message_version":   grpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion),
+		}).Debug("common highest sync message version")
+
+	if commonSyncMessageVersion == grpc.ComponentNetworkMap {
+		// Capable peer: discard the legacy NetworkMap that SyncAndMarkPeer
+		// computed and recompute the raw components instead. This wastes one
+		// Calculate() call per initial-sync — the component-based wire
+		// format is what the peer actually consumes. The streaming path
+		// (network_map.Controller.UpdateAccountPeers) skips this duplication
+		// because it dispatches by capability before computing.
+		//
+		// TODO: refactor SyncPeer / SyncAndMarkPeer / their mocks + manager
+		// interfaces to return PeerNetworkMapResult so the initial-sync path
+		// stops doing duplicate work. Deferred until the client-side
+		// decoder lands and there's a real deployment of capability=3 peers
+		// worth optimizing for.
+		freshPeer, components, freshPostureChecks, freshDnsFwdPort, err := s.networkMapController.GetValidatedPeerWithComponents(ctx, false, peer.AccountID, peer)
+		if err != nil {
+			log.WithContext(ctx).Errorf("failed to build components for peer %s on initial sync: %v", peer.ID, err)
+			return status.Errorf(codes.Internal, "failed to build initial sync envelope")
+		}
+		plainResp = ToComponentSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(freshPeer), turnToken, relayToken, components, dnsName, freshPostureChecks, types.TwinAccountSettings(settings), settings.Extra, peerGroups, freshDnsFwdPort)
+	} else {
+		plainResp = ToSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(peer), turnToken, relayToken, networkMap, dnsName, postureChecks, nil, types.TwinAccountSettings(settings), settings.Extra, peerGroups, dnsFwdPort)
+	}
 
 	key, err := s.secretsManager.GetWGKey()
 	if err != nil {
 		return status.Errorf(codes.Internal, "failed getting server key")
 	}
 
+	if stampCertificateChallenges(plainResp.Checks, s.challenger, peerKey) {
+		onChallengeStamped()
+	}
 	encryptedResp, err := encryption.EncryptMessage(peerKey, key, plainResp)
 	if err != nil {
 		return status.Errorf(codes.Internal, "error handling request")
@@ -1041,6 +1018,13 @@ func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer
 	return nil
 }
 
+func (s *Server) perAccountOrGlobalSyncMessageVersions(accountId string) grpc.SyncMessageVersion {
+	if version, ok := s.config.PerAccountHighestSupportedSyncMessageVersion[accountId]; ok {
+		return grpc.SyncMessageVersionFromConfig(&version)
+	}
+	return grpc.SyncMessageVersionFromConfig(s.config.HighestSupportedSyncMessageVersion)
+}
+
 // GetDeviceAuthorizationFlow returns a device authorization flow information
 // This is used for initiating an Oauth 2 device authorization grant flow
 // which will be used by our clients to Login
@@ -1094,7 +1078,7 @@ func (s *Server) GetDeviceAuthorizationFlow(ctx context.Context, req *proto.Encr
 			Provider: proto.DeviceAuthorizationFlowProvider(provider),
 			ProviderConfig: &proto.ProviderConfig{
 				ClientID:           s.config.DeviceAuthorizationFlow.ProviderConfig.ClientID,
-				ClientSecret:       s.config.DeviceAuthorizationFlow.ProviderConfig.ClientSecret,
+				ClientSecret:       s.config.DeviceAuthorizationFlow.ProviderConfig.ClientSecret, //nolint:staticcheck
 				Domain:             s.config.DeviceAuthorizationFlow.ProviderConfig.Domain,
 				Audience:           s.config.DeviceAuthorizationFlow.ProviderConfig.Audience,
 				DeviceAuthEndpoint: s.config.DeviceAuthorizationFlow.ProviderConfig.DeviceAuthEndpoint,
@@ -1134,7 +1118,8 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 		return nil, status.Errorf(codes.Internal, "failed to get server key")
 	}
 
-	err = encryption.DecryptMessage(peerKey, key, req.Body, &proto.PKCEAuthorizationFlowRequest{})
+	flowReq := &proto.PKCEAuthorizationFlowRequest{}
+	err = encryption.DecryptMessage(peerKey, key, req.Body, flowReq)
 	if err != nil {
 		errMSG := fmt.Sprintf("error while decrypting peer's message with Wireguard public key %s.", req.WgPubKey)
 		log.WithContext(ctx).Warn(errMSG)
@@ -1165,7 +1150,7 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 			ProviderConfig: &proto.ProviderConfig{
 				Audience:              s.config.PKCEAuthorizationFlow.ProviderConfig.Audience,
 				ClientID:              s.config.PKCEAuthorizationFlow.ProviderConfig.ClientID,
-				ClientSecret:          s.config.PKCEAuthorizationFlow.ProviderConfig.ClientSecret,
+				ClientSecret:          s.config.PKCEAuthorizationFlow.ProviderConfig.ClientSecret, //nolint:staticcheck
 				TokenEndpoint:         s.config.PKCEAuthorizationFlow.ProviderConfig.TokenEndpoint,
 				AuthorizationEndpoint: s.config.PKCEAuthorizationFlow.ProviderConfig.AuthorizationEndpoint,
 				Scope:                 s.config.PKCEAuthorizationFlow.ProviderConfig.Scope,
@@ -1178,6 +1163,7 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 	}
 
 	flowInfoResp := s.integratedPeerValidator.ValidateFlowResponse(ctx, peerKey.String(), initInfoFlow)
+	applySessionExtendFlowPolicy(flowInfoResp, flowReq.GetSessionExtend())
 
 	encryptedResp, err := encryption.EncryptMessage(peerKey, key, flowInfoResp)
 	if err != nil {
@@ -1190,6 +1176,40 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 	}, nil
 }
 
+// applySessionExtendFlowPolicy forces a prompt=login flow for a session extend.
+//
+// An extend renews the session of one specific peer, so its token has to come
+// from the account that peer is registered under. A flow that does not prompt
+// leaves the choice to the IdP, which answers a silent authorization from any
+// session it already holds — not necessarily this peer's account when several
+// are signed in, and login_hint is a suggestion the IdP may ignore. The token
+// then fails the jwt.UserID == peer.UserID check in ExtendAuthSession, and the
+// user is given no opportunity to pick a different account.
+//
+// LoginFlagPromptLogin rather than max_age=0: both re-authenticate, but with
+// prompt=login the IdP honours login_hint and offers the peer's own account,
+// whereas max_age=0 leaves the user to find it among every account signed in.
+//
+// DisablePromptLogin is left alone. It is set for IdPs that break on
+// prompt=login — Authentik triggers a double authentication, and social logins
+// fail outright — so overriding it would trade a recoverable session extend for
+// a login that cannot complete at all. Those deployments keep the silent flow
+// and, with several accounts signed in, an extend answered from the wrong one
+// still fails the user match.
+//
+// Called after ValidateFlowResponse so that a per-peer override cannot reinstate
+// the silent flow for an extend.
+func applySessionExtendFlowPolicy(flow *proto.PKCEAuthorizationFlow, sessionExtend bool) {
+	if !sessionExtend {
+		return
+	}
+	cfg := flow.GetProviderConfig()
+	if cfg == nil || cfg.GetDisablePromptLogin() {
+		return
+	}
+	cfg.LoginFlag = uint32(common.LoginFlagPromptLogin)
+}
+
 // SyncMeta endpoint is used to synchronize peer's system metadata and notifies the connected,
 // peer's under the same account of any updates.
 func (s *Server) SyncMeta(ctx context.Context, req *proto.EncryptedMessage) (*proto.Empty, error) {
@@ -1209,7 +1229,9 @@ func (s *Server) SyncMeta(ctx context.Context, req *proto.EncryptedMessage) (*pr
 		return nil, msg
 	}
 
-	err = s.accountManager.SyncPeerMeta(ctx, peerKey.String(), extractPeerMeta(ctx, syncMetaReq.GetMeta()), realIP)
+	peerMeta := extractPeerMeta(ctx, syncMetaReq.GetMeta())
+	peerMeta.Certificates = s.verifiedCertificates(ctx, peerKey, syncMetaReq.GetMeta().GetCertificateProofs())
+	err = s.accountManager.SyncPeerMeta(ctx, peerKey.String(), peerMeta, realIP)
 	if err != nil {
 		return nil, mapError(ctx, err)
 	}
@@ -1255,7 +1277,7 @@ func (s *Server) Logout(ctx context.Context, req *proto.EncryptedMessage) (*prot
 }
 
 // toProtocolChecks converts posture checks to protocol checks.
-func toProtocolChecks(ctx context.Context, postureChecks []*posture.Checks) []*proto.Checks {
+func toProtocolChecks(ctx context.Context, postureChecks []*nmdata.PostureChecks) []*proto.Checks {
 	protoChecks := make([]*proto.Checks, 0, len(postureChecks))
 	for _, postureCheck := range postureChecks {
 		check := toProtocolCheck(postureCheck)
@@ -1267,8 +1289,8 @@ func toProtocolChecks(ctx context.Context, postureChecks []*posture.Checks) []*p
 	return protoChecks
 }
 
-// toProtocolCheck converts a posture.Checks to a proto.Checks.
-func toProtocolCheck(postureCheck *posture.Checks) *proto.Checks {
+// toProtocolCheck converts posture checks to a proto.Checks.
+func toProtocolCheck(postureCheck *nmdata.PostureChecks) *proto.Checks {
 	protoCheck := &proto.Checks{}
 
 	if check := postureCheck.Checks.ProcessCheck; check != nil {
@@ -1285,7 +1307,11 @@ func toProtocolCheck(postureCheck *posture.Checks) *proto.Checks {
 		}
 	}
 
-	if len(protoCheck.Files) == 0 {
+	if check := postureCheck.Checks.CertificateCheck; check != nil {
+		protoCheck.CertificateChallenge = &proto.CertificateChallenge{CaCertificates: check.CACertificates}
+	}
+
+	if len(protoCheck.Files) == 0 && protoCheck.CertificateChallenge == nil {
 		return nil
 	}
 
diff --git a/management/internals/shared/grpc/server_disconnect_test.go b/management/internals/shared/grpc/server_disconnect_test.go
new file mode 100644
index 000000000..7d186b715
--- /dev/null
+++ b/management/internals/shared/grpc/server_disconnect_test.go
@@ -0,0 +1,51 @@
+package grpc
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+)
+
+func TestCancelPeerRoutines_SessionOwnership(t *testing.T) {
+	peer := &nbpeer.Peer{ID: "peer-1", Key: "peer-key"}
+	streamStart := time.Unix(1700000000, 0)
+	session := make(chan *network_map.UpdateMessage)
+
+	tests := []struct {
+		name          string
+		session       chan *network_map.UpdateMessage
+		ownsPeer      bool
+		cancelRefresh bool
+	}{
+		{name: "owning session tears everything down", session: session, ownsPeer: true, cancelRefresh: true},
+		{name: "stale session keeps the newer session's refresh", session: session, ownsPeer: false, cancelRefresh: false},
+		{name: "failed sync without a channel closes the older session", session: nil, ownsPeer: true, cancelRefresh: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			accountManager := account.NewMockManager(ctrl)
+			controller := network_map.NewMockController(ctrl)
+			secretsManager := NewMockSecretsManager(ctrl)
+			s := &Server{accountManager: accountManager, networkMapController: controller, secretsManager: secretsManager}
+
+			accountManager.EXPECT().OnPeerDisconnected(gomock.Any(), "account-1", peer.Key, streamStart).Return(nil)
+			controller.EXPECT().OnPeerDisconnected(gomock.Any(), "account-1", peer.ID, tt.session).Return(tt.ownsPeer)
+			if tt.cancelRefresh {
+				secretsManager.EXPECT().CancelRefresh(peer.ID)
+				// The stream's challenge renewal ends with it; a stale session leaves the
+				// newer one's alone.
+				accountManager.EXPECT().UntrackCertificateChallenges("account-1", peer.ID, streamStart)
+			}
+
+			s.cancelPeerRoutines(context.Background(), "account-1", peer, streamStart, tt.session)
+		})
+	}
+}
diff --git a/management/internals/shared/grpc/single_use.go b/management/internals/shared/grpc/single_use.go
new file mode 100644
index 000000000..467ee6020
--- /dev/null
+++ b/management/internals/shared/grpc/single_use.go
@@ -0,0 +1,67 @@
+package grpc
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"time"
+
+	"github.com/eko/gocache/lib/v4/store"
+	log "github.com/sirupsen/logrus"
+
+	nbcache "github.com/netbirdio/netbird/management/server/cache"
+)
+
+// SingleUseStore stores short-lived values that can be retrieved only once.
+type SingleUseStore struct {
+	cache nbcache.Store
+	ctx   context.Context
+}
+
+// NewSingleUseStore creates a single-use value store over the shared cache.
+func NewSingleUseStore(ctx context.Context, cacheStore nbcache.Store) *SingleUseStore {
+	return &SingleUseStore{
+		cache: cacheStore,
+		ctx:   ctx,
+	}
+}
+
+// Store saves value under key with the given TTL, after which it is evicted.
+func (s *SingleUseStore) Store(key, value string, ttl time.Duration) error {
+	if err := s.cache.Set(s.ctx, key, value, store.WithExpiration(ttl)); err != nil {
+		return fmt.Errorf("store single-use value: %w", err)
+	}
+	return nil
+}
+
+// Generate stores a value under a namespaced random key and returns the random key.
+func (s *SingleUseStore) Generate(namespace, value string, ttl time.Duration) (string, error) {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", fmt.Errorf("generate single-use key: %w", err)
+	}
+
+	key := base64.RawURLEncoding.EncodeToString(buf)
+	if err := s.Store(singleUseCacheKey(namespace, key), value, ttl); err != nil {
+		return "", err
+	}
+	return key, nil
+}
+
+func singleUseCacheKey(namespace, key string) string {
+	return namespace + ":" + key
+}
+
+// LoadAndDelete retrieves and removes the value for a key.
+func (s *SingleUseStore) LoadAndDelete(key string) (string, bool) {
+	value, found, err := s.cache.GetDel(s.ctx, key)
+	if err != nil {
+		log.Warnf("failed to consume single-use value: %v", err)
+		return "", false
+	}
+	if !found {
+		return "", false
+	}
+	return value, true
+}
diff --git a/management/internals/shared/grpc/single_use_test.go b/management/internals/shared/grpc/single_use_test.go
new file mode 100644
index 000000000..8243ca43b
--- /dev/null
+++ b/management/internals/shared/grpc/single_use_test.go
@@ -0,0 +1,122 @@
+package grpc
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+func TestSingleUseStoreLoadAndDelete(t *testing.T) {
+	const (
+		state    = "state"
+		verifier = "verifier"
+		attempts = 64
+	)
+
+	t.Run("exactly one concurrent caller consumes the verifier", func(t *testing.T) {
+		store := NewSingleUseStore(context.Background(), testCacheStore(t))
+		if err := store.Store(state, verifier, time.Minute); err != nil {
+			t.Fatalf("couldn't store PKCE verifier: %s", err)
+		}
+
+		start := make(chan struct{})
+		type result struct {
+			verifier string
+			found    bool
+		}
+		results := make(chan result, attempts)
+		for range attempts {
+			go func() {
+				<-start
+				verifier, found := store.LoadAndDelete(state)
+				results <- result{verifier: verifier, found: found}
+			}()
+		}
+		close(start)
+
+		winners := 0
+		for range attempts {
+			result := <-results
+			if result.found {
+				winners++
+				if result.verifier != verifier {
+					t.Fatalf("unexpected verifier: got %q, expected %q", result.verifier, verifier)
+				}
+			}
+		}
+		if winners != 1 {
+			t.Fatalf("expected exactly one PKCE verifier consumer, got %d", winners)
+		}
+	})
+
+	t.Run("replayed state is rejected", func(t *testing.T) {
+		store := NewSingleUseStore(context.Background(), testCacheStore(t))
+		if err := store.Store(state, verifier, time.Minute); err != nil {
+			t.Fatalf("couldn't store PKCE verifier: %s", err)
+		}
+
+		if got, found := store.LoadAndDelete(state); !found || got != verifier {
+			t.Fatalf("first load should return the verifier, got %q, found %t", got, found)
+		}
+		if got, found := store.LoadAndDelete(state); found {
+			t.Fatalf("replayed state should not resolve, got %q", got)
+		}
+	})
+
+	t.Run("unknown state is rejected", func(t *testing.T) {
+		store := NewSingleUseStore(context.Background(), testCacheStore(t))
+
+		if got, found := store.LoadAndDelete("never-stored"); found {
+			t.Fatalf("unknown state should not resolve, got %q", got)
+		}
+	})
+
+	t.Run("expired verifier is rejected", func(t *testing.T) {
+		store := NewSingleUseStore(context.Background(), testCacheStore(t))
+		if err := store.Store(state, verifier, 50*time.Millisecond); err != nil {
+			t.Fatalf("couldn't store PKCE verifier: %s", err)
+		}
+
+		time.Sleep(100 * time.Millisecond)
+		if got, found := store.LoadAndDelete(state); found {
+			t.Fatalf("expired verifier should not resolve, got %q", got)
+		}
+	})
+}
+
+func TestSingleUseStore_GenerateAndConsumeOnce(t *testing.T) {
+	const namespace = "test"
+	s := NewSingleUseStore(context.Background(), testCacheStore(t))
+
+	key, err := s.Generate(namespace, "the-value", time.Minute)
+	if err != nil {
+		t.Fatalf("generate: %v", err)
+	}
+	if key == "" || key == "the-value" {
+		t.Fatalf("unexpected key %q", key)
+	}
+
+	value, found := s.LoadAndDelete(singleUseCacheKey(namespace, key))
+	if !found || value != "the-value" {
+		t.Fatalf("expected to load the stored value, got %q found=%v", value, found)
+	}
+
+	if _, found := s.LoadAndDelete(singleUseCacheKey(namespace, key)); found {
+		t.Fatal("value must be consumed on first LoadAndDelete")
+	}
+}
+
+func TestSingleUseStore_GenerateUniqueKeys(t *testing.T) {
+	s := NewSingleUseStore(context.Background(), testCacheStore(t))
+	a, err := s.Generate("test", "v", time.Minute)
+	if err != nil {
+		t.Fatalf("generate a: %v", err)
+	}
+	b, err := s.Generate("test", "v", time.Minute)
+	if err != nil {
+		t.Fatalf("generate b: %v", err)
+	}
+	if a == b {
+		t.Fatal("generated keys must be distinct")
+	}
+}
diff --git a/management/internals/shared/grpc/sync_mappings_test.go b/management/internals/shared/grpc/sync_mappings_test.go
index 97f6183bb..753142ea0 100644
--- a/management/internals/shared/grpc/sync_mappings_test.go
+++ b/management/internals/shared/grpc/sync_mappings_test.go
@@ -7,9 +7,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/metadata"
 
@@ -409,3 +409,75 @@ func TestConnectionSendResponse_RoutesToLegacyStream(t *testing.T) {
 	require.Len(t, stream.messages, 1)
 	assert.Equal(t, "svc-2", stream.messages[0].Mapping[0].Id)
 }
+
+// blockingSyncStream is a ProxyService_SyncMappingsServer whose Recv blocks
+// until the test ends, like a proxy that stopped acking without closing the stream.
+type blockingSyncStream struct {
+	grpc.ServerStream
+	done chan struct{}
+}
+
+func (s *blockingSyncStream) Recv() (*proto.SyncMappingsRequest, error) {
+	<-s.done
+	return nil, context.Canceled
+}
+
+func (s *blockingSyncStream) Send(*proto.SyncMappingsResponse) error { return nil }
+
+func newBlockingSyncStream(t *testing.T) *blockingSyncStream {
+	t.Helper()
+	s := &blockingSyncStream{done: make(chan struct{})}
+	t.Cleanup(func() { close(s.done) })
+	return s
+}
+
+func TestWaitForAck_Ack(t *testing.T) {
+	stream := &syncRecordingStream{recvMsgs: []*proto.SyncMappingsRequest{ackMsg()}}
+
+	require.NoError(t, waitForAck(context.Background(), stream, time.Second))
+}
+
+func TestWaitForAck_UnexpectedMessage(t *testing.T) {
+	stream := &syncRecordingStream{recvMsgs: []*proto.SyncMappingsRequest{
+		{Msg: &proto.SyncMappingsRequest_Init{Init: &proto.SyncMappingsInit{}}},
+	}}
+
+	assert.ErrorContains(t, waitForAck(context.Background(), stream, time.Second), "expected ack")
+}
+
+func TestWaitForAck_TimesOutWhenProxyStopsAcking(t *testing.T) {
+	stream := newBlockingSyncStream(t)
+
+	start := time.Now()
+	err := waitForAck(context.Background(), stream, 50*time.Millisecond)
+
+	assert.ErrorContains(t, err, "no ack within")
+	assert.Less(t, time.Since(start), time.Second)
+}
+
+func TestWaitForAck_ReturnsWhenConnectionCanceled(t *testing.T) {
+	stream := newBlockingSyncStream(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	assert.ErrorIs(t, waitForAck(ctx, stream, time.Minute), context.Canceled)
+}
+
+func TestSendSnapshotSync_GivesUpWhenProxyStopsAcking(t *testing.T) {
+	const cluster = "cluster.example.com"
+
+	ctrl := gomock.NewController(t)
+	mgr := rpservice.NewMockManager(ctrl)
+	mgr.EXPECT().GetGlobalServices(gomock.Any()).Return(makeServices(1, cluster), nil)
+
+	s := newSnapshotTestServer(t, 10)
+	s.serviceManager = mgr
+	s.snapshotAckTimeout = 50 * time.Millisecond
+
+	stream := newBlockingSyncStream(t)
+	conn := &proxyConnection{proxyID: "proxy-a", address: cluster, syncStream: stream}
+
+	err := s.sendSnapshotSync(context.Background(), conn, stream)
+
+	assert.ErrorContains(t, err, "no ack within")
+}
diff --git a/management/internals/shared/grpc/sync_sender_mock.go b/management/internals/shared/grpc/sync_sender_mock.go
new file mode 100644
index 000000000..3d1696f59
--- /dev/null
+++ b/management/internals/shared/grpc/sync_sender_mock.go
@@ -0,0 +1,70 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./peer_update_handler.go
+//
+// Generated by this command:
+//
+//	mockgen -source=./peer_update_handler.go -destination=./sync_sender_mock.go -package=grpc
+//
+
+// Package grpc is a generated GoMock package.
+package grpc
+
+import (
+	context "context"
+	reflect "reflect"
+
+	proto "github.com/netbirdio/netbird/shared/management/proto"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MocksyncSender is a mock of syncSender interface.
+type MocksyncSender struct {
+	ctrl     *gomock.Controller
+	recorder *MocksyncSenderMockRecorder
+	isgomock struct{}
+}
+
+// MocksyncSenderMockRecorder is the mock recorder for MocksyncSender.
+type MocksyncSenderMockRecorder struct {
+	mock *MocksyncSender
+}
+
+// NewMocksyncSender creates a new mock instance.
+func NewMocksyncSender(ctrl *gomock.Controller) *MocksyncSender {
+	mock := &MocksyncSender{ctrl: ctrl}
+	mock.recorder = &MocksyncSenderMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MocksyncSender) EXPECT() *MocksyncSenderMockRecorder {
+	return m.recorder
+}
+
+// Context mocks base method.
+func (m *MocksyncSender) Context() context.Context {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Context")
+	ret0, _ := ret[0].(context.Context)
+	return ret0
+}
+
+// Context indicates an expected call of Context.
+func (mr *MocksyncSenderMockRecorder) Context() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Context", reflect.TypeOf((*MocksyncSender)(nil).Context))
+}
+
+// Send mocks base method.
+func (m *MocksyncSender) Send(arg0 *proto.EncryptedMessage) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Send", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Send indicates an expected call of Send.
+func (mr *MocksyncSenderMockRecorder) Send(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Send", reflect.TypeOf((*MocksyncSender)(nil).Send), arg0)
+}
diff --git a/management/internals/shared/grpc/token_mgr.go b/management/internals/shared/grpc/token_mgr.go
index 65e58ad41..4dab5007f 100644
--- a/management/internals/shared/grpc/token_mgr.go
+++ b/management/internals/shared/grpc/token_mgr.go
@@ -25,6 +25,8 @@ import (
 const defaultDuration = 12 * time.Hour
 
 // SecretsManager used to manage TURN and relay secrets
+//
+//go:generate go tool mockgen -source=./token_mgr.go -destination=./token_mgr_mock.go -package=grpc
 type SecretsManager interface {
 	GenerateTurnToken() (*Token, error)
 	GenerateRelayToken() (*Token, error)
@@ -161,6 +163,8 @@ func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountI
 		m.turnCancelMap[peerID] = turnCancel
 		go m.refreshTURNTokens(ctx, accountID, peerID, turnCancel)
 		log.WithContext(ctx).Debugf("starting TURN refresh for %s", peerID)
+	} else {
+		log.WithContext(ctx).Debugf("no TURN configuration, skipping TURN refresh for %s", peerID)
 	}
 
 	if m.relayCfg != nil {
@@ -168,6 +172,8 @@ func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountI
 		m.relayCancelMap[peerID] = relayCancel
 		go m.refreshRelayTokens(ctx, accountID, peerID, relayCancel)
 		log.WithContext(ctx).Tracef("starting relay refresh for %s", peerID)
+	} else {
+		log.WithContext(ctx).Tracef("no relay configuration, skipping relay refresh for %s", peerID)
 	}
 }
 
diff --git a/management/internals/shared/grpc/token_mgr_mock.go b/management/internals/shared/grpc/token_mgr_mock.go
new file mode 100644
index 000000000..e7dde4e3a
--- /dev/null
+++ b/management/internals/shared/grpc/token_mgr_mock.go
@@ -0,0 +1,111 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./token_mgr.go
+//
+// Generated by this command:
+//
+//	mockgen -source=./token_mgr.go -destination=./token_mgr_mock.go -package=grpc
+//
+
+// Package grpc is a generated GoMock package.
+package grpc
+
+import (
+	context "context"
+	reflect "reflect"
+
+	gomock "go.uber.org/mock/gomock"
+	wgtypes "golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// MockSecretsManager is a mock of SecretsManager interface.
+type MockSecretsManager struct {
+	ctrl     *gomock.Controller
+	recorder *MockSecretsManagerMockRecorder
+	isgomock struct{}
+}
+
+// MockSecretsManagerMockRecorder is the mock recorder for MockSecretsManager.
+type MockSecretsManagerMockRecorder struct {
+	mock *MockSecretsManager
+}
+
+// NewMockSecretsManager creates a new mock instance.
+func NewMockSecretsManager(ctrl *gomock.Controller) *MockSecretsManager {
+	mock := &MockSecretsManager{ctrl: ctrl}
+	mock.recorder = &MockSecretsManagerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSecretsManager) EXPECT() *MockSecretsManagerMockRecorder {
+	return m.recorder
+}
+
+// CancelRefresh mocks base method.
+func (m *MockSecretsManager) CancelRefresh(peerKey string) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "CancelRefresh", peerKey)
+}
+
+// CancelRefresh indicates an expected call of CancelRefresh.
+func (mr *MockSecretsManagerMockRecorder) CancelRefresh(peerKey any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CancelRefresh", reflect.TypeOf((*MockSecretsManager)(nil).CancelRefresh), peerKey)
+}
+
+// GenerateRelayToken mocks base method.
+func (m *MockSecretsManager) GenerateRelayToken() (*Token, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GenerateRelayToken")
+	ret0, _ := ret[0].(*Token)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GenerateRelayToken indicates an expected call of GenerateRelayToken.
+func (mr *MockSecretsManagerMockRecorder) GenerateRelayToken() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateRelayToken", reflect.TypeOf((*MockSecretsManager)(nil).GenerateRelayToken))
+}
+
+// GenerateTurnToken mocks base method.
+func (m *MockSecretsManager) GenerateTurnToken() (*Token, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GenerateTurnToken")
+	ret0, _ := ret[0].(*Token)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GenerateTurnToken indicates an expected call of GenerateTurnToken.
+func (mr *MockSecretsManagerMockRecorder) GenerateTurnToken() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateTurnToken", reflect.TypeOf((*MockSecretsManager)(nil).GenerateTurnToken))
+}
+
+// GetWGKey mocks base method.
+func (m *MockSecretsManager) GetWGKey() (wgtypes.Key, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetWGKey")
+	ret0, _ := ret[0].(wgtypes.Key)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetWGKey indicates an expected call of GetWGKey.
+func (mr *MockSecretsManagerMockRecorder) GetWGKey() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWGKey", reflect.TypeOf((*MockSecretsManager)(nil).GetWGKey))
+}
+
+// SetupRefresh mocks base method.
+func (m *MockSecretsManager) SetupRefresh(ctx context.Context, accountID, peerKey string) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetupRefresh", ctx, accountID, peerKey)
+}
+
+// SetupRefresh indicates an expected call of SetupRefresh.
+func (mr *MockSecretsManagerMockRecorder) SetupRefresh(ctx, accountID, peerKey any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetupRefresh", reflect.TypeOf((*MockSecretsManager)(nil).SetupRefresh), ctx, accountID, peerKey)
+}
diff --git a/management/internals/shared/grpc/token_mgr_test.go b/management/internals/shared/grpc/token_mgr_test.go
index 98eb66fb5..0856e7a43 100644
--- a/management/internals/shared/grpc/token_mgr_test.go
+++ b/management/internals/shared/grpc/token_mgr_test.go
@@ -10,8 +10,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
diff --git a/management/internals/shared/grpc/update_debouncer.go b/management/internals/shared/grpc/update_debouncer.go
index 8af9c2656..9483007c6 100644
--- a/management/internals/shared/grpc/update_debouncer.go
+++ b/management/internals/shared/grpc/update_debouncer.go
@@ -6,6 +6,14 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 )
 
+//go:generate go tool mockgen -source=./update_debouncer.go -destination=./update_debouncer_mock.go -package=grpc
+type Debouncer interface {
+	Stop()
+	TimerChannel() <-chan time.Time
+	ProcessUpdate(update *network_map.UpdateMessage) bool
+	GetPendingUpdates() []*network_map.UpdateMessage
+}
+
 // UpdateDebouncer implements a backpressure mechanism that:
 // - Sends the first update immediately
 // - Coalesces rapid subsequent network map updates (only latest matters)
diff --git a/management/internals/shared/grpc/update_debouncer_mock.go b/management/internals/shared/grpc/update_debouncer_mock.go
new file mode 100644
index 000000000..4dff632b7
--- /dev/null
+++ b/management/internals/shared/grpc/update_debouncer_mock.go
@@ -0,0 +1,96 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./update_debouncer.go
+//
+// Generated by this command:
+//
+//	mockgen -source=./update_debouncer.go -destination=./update_debouncer_mock.go -package=grpc
+//
+
+// Package grpc is a generated GoMock package.
+package grpc
+
+import (
+	reflect "reflect"
+	time "time"
+
+	network_map "github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockDebouncer is a mock of Debouncer interface.
+type MockDebouncer struct {
+	ctrl     *gomock.Controller
+	recorder *MockDebouncerMockRecorder
+	isgomock struct{}
+}
+
+// MockDebouncerMockRecorder is the mock recorder for MockDebouncer.
+type MockDebouncerMockRecorder struct {
+	mock *MockDebouncer
+}
+
+// NewMockDebouncer creates a new mock instance.
+func NewMockDebouncer(ctrl *gomock.Controller) *MockDebouncer {
+	mock := &MockDebouncer{ctrl: ctrl}
+	mock.recorder = &MockDebouncerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockDebouncer) EXPECT() *MockDebouncerMockRecorder {
+	return m.recorder
+}
+
+// GetPendingUpdates mocks base method.
+func (m *MockDebouncer) GetPendingUpdates() []*network_map.UpdateMessage {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetPendingUpdates")
+	ret0, _ := ret[0].([]*network_map.UpdateMessage)
+	return ret0
+}
+
+// GetPendingUpdates indicates an expected call of GetPendingUpdates.
+func (mr *MockDebouncerMockRecorder) GetPendingUpdates() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPendingUpdates", reflect.TypeOf((*MockDebouncer)(nil).GetPendingUpdates))
+}
+
+// ProcessUpdate mocks base method.
+func (m *MockDebouncer) ProcessUpdate(update *network_map.UpdateMessage) bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ProcessUpdate", update)
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// ProcessUpdate indicates an expected call of ProcessUpdate.
+func (mr *MockDebouncerMockRecorder) ProcessUpdate(update any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ProcessUpdate", reflect.TypeOf((*MockDebouncer)(nil).ProcessUpdate), update)
+}
+
+// Stop mocks base method.
+func (m *MockDebouncer) Stop() {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Stop")
+}
+
+// Stop indicates an expected call of Stop.
+func (mr *MockDebouncerMockRecorder) Stop() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Stop", reflect.TypeOf((*MockDebouncer)(nil).Stop))
+}
+
+// TimerChannel mocks base method.
+func (m *MockDebouncer) TimerChannel() <-chan time.Time {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "TimerChannel")
+	ret0, _ := ret[0].(<-chan time.Time)
+	return ret0
+}
+
+// TimerChannel indicates an expected call of TimerChannel.
+func (mr *MockDebouncerMockRecorder) TimerChannel() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TimerChannel", reflect.TypeOf((*MockDebouncer)(nil).TimerChannel))
+}
diff --git a/management/internals/shared/grpc/validate_session_test.go b/management/internals/shared/grpc/validate_session_test.go
index d649102a1..429639be6 100644
--- a/management/internals/shared/grpc/validate_session_test.go
+++ b/management/internals/shared/grpc/validate_session_test.go
@@ -1,5 +1,3 @@
-//go:build integration
-
 package grpc
 
 import (
@@ -7,6 +5,7 @@ import (
 	"crypto/ed25519"
 	"crypto/rand"
 	"encoding/base64"
+	"errors"
 	"testing"
 	"time"
 
@@ -40,12 +39,13 @@ func setupValidateSessionTest(t *testing.T) *validateSessionTestSetup {
 	proxyManager := &testValidateSessionProxyManager{}
 
 	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
-	proxyService := NewProxyServiceServer(nil, tokenStore, pkceStore, ProxyOIDCConfig{}, nil, usersManager, nil, proxyManager, nil)
+	proxyService := NewProxyServiceServer(nil, tokenStore, singleUseStore, ProxyOIDCConfig{}, nil, usersManager, nil, proxyManager, nil)
 	proxyService.SetServiceManager(serviceManager)
 
 	createTestProxies(t, ctx, testStore)
+	createStatusTestUsers(t, ctx, testStore)
 
 	return &validateSessionTestSetup{
 		proxyService: proxyService,
@@ -91,6 +91,82 @@ func createTestProxies(t *testing.T, ctx context.Context, testStore store.Store)
 		},
 	}
 	require.NoError(t, testStore.CreateService(ctx, restrictedProxy))
+
+	// Distributed to the account's "All" group, the configuration that hands a
+	// service to every user in the account.
+	allUsersProxy := &service.Service{
+		ID:                "allUsersProxyId",
+		AccountID:         "testAccountId",
+		Name:              "All Users Proxy",
+		Domain:            "all-users-proxy.example.com",
+		Enabled:           true,
+		SessionPrivateKey: privKey,
+		SessionPublicKey:  pubKey,
+		Auth: service.AuthConfig{
+			BearerAuth: &service.BearerAuthConfig{
+				Enabled:            true,
+				DistributionGroups: []string{allUsersGroupID},
+			},
+		},
+	}
+	require.NoError(t, testStore.CreateService(ctx, allUsersProxy))
+}
+
+const (
+	allUsersGroupID   = "allUsersGroupId"
+	pendingUserID     = "pendingUserId"
+	blockedUserID     = "blockedUserId"
+	pendingAllUsersID = "pendingAllUsersUserId"
+)
+
+// createStatusTestUsers adds the users whose account status must keep them out
+// of a proxy session. A user awaiting approval is persisted as both blocked and
+// pending approval, the way the approval flow stores one.
+func createStatusTestUsers(t *testing.T, ctx context.Context, testStore store.Store) {
+	t.Helper()
+
+	require.NoError(t, testStore.CreateGroup(ctx, &types.Group{
+		ID:        allUsersGroupID,
+		AccountID: "testAccountId",
+		Name:      "All",
+		Issued:    types.GroupIssuedAPI,
+	}))
+
+	users := []*types.User{
+		{
+			Id:              pendingUserID,
+			AccountID:       "testAccountId",
+			Role:            types.UserRoleUser,
+			AutoGroups:      []string{"allowedGroupId"},
+			Blocked:         true,
+			PendingApproval: true,
+			Issued:          "api",
+			CreatedAt:       time.Now(),
+		},
+		{
+			Id:              pendingAllUsersID,
+			AccountID:       "testAccountId",
+			Role:            types.UserRoleUser,
+			AutoGroups:      []string{allUsersGroupID},
+			Blocked:         true,
+			PendingApproval: true,
+			Issued:          "api",
+			CreatedAt:       time.Now(),
+		},
+		{
+			Id:              blockedUserID,
+			AccountID:       "testAccountId",
+			Role:            types.UserRoleUser,
+			AutoGroups:      []string{"allowedGroupId"},
+			Blocked:         true,
+			PendingApproval: false,
+			Issued:          "api",
+			CreatedAt:       time.Now(),
+		},
+	}
+	for _, user := range users {
+		require.NoError(t, testStore.SaveUser(ctx, user))
+	}
 }
 
 func generateSessionKeyPair(t *testing.T) (string, string) {
@@ -102,7 +178,12 @@ func generateSessionKeyPair(t *testing.T) (string, string) {
 
 func createSessionToken(t *testing.T, privKeyB64, userID, domain string) string {
 	t.Helper()
-	token, err := sessionkey.SignToken(privKeyB64, userID, "", domain, auth.MethodOIDC, nil, nil, time.Hour)
+	return createSessionTokenWithEmail(t, privKeyB64, userID, "", domain)
+}
+
+func createSessionTokenWithEmail(t *testing.T, privKeyB64, userID, email, domain string) string {
+	t.Helper()
+	token, err := sessionkey.SignToken(privKeyB64, userID, email, domain, auth.MethodOIDC, nil, nil, time.Hour)
 	require.NoError(t, err)
 	return token
 }
@@ -118,7 +199,7 @@ func TestValidateSession_UserAllowed(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -139,7 +220,7 @@ func TestValidateSession_UserNotInAllowedGroup(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -149,6 +230,114 @@ func TestValidateSession_UserNotInAllowedGroup(t *testing.T) {
 	assert.Empty(t, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the resolved user's actual (empty) memberships on denial")
 }
 
+// TestValidateSession_PendingApprovalUserDenied covers a user who is a member of
+// the service's distribution group but is still waiting for an administrator to
+// approve the account. Group membership alone must not open the service.
+func TestValidateSession_PendingApprovalUserDenied(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	proxy, err := setup.store.GetServiceByID(context.Background(), store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
+	require.NoError(t, err)
+
+	token := createSessionToken(t, proxy.SessionPrivateKey, pendingUserID, "restricted-proxy.example.com")
+
+	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		Domain:       "restricted-proxy.example.com",
+		SessionToken: token, //nolint:staticcheck
+	})
+
+	require.NoError(t, err)
+	assert.False(t, resp.Valid, "User pending approval should be denied")
+	assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason, "Denied reason should name the pending approval state")
+	assert.Equal(t, pendingUserID, resp.UserId, "Denial should identify the user it applies to")
+	assert.Equal(t, []string{"allowedGroupId"}, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the resolved user's group memberships on denial")
+	assert.Equal(t, []string{"Allowed Group"}, resp.GetPeerGroupNames(), "PeerGroupNames must pair with PeerGroupIds on denial")
+}
+
+// TestValidateSession_PendingApprovalUserInAllUsersGroupDenied covers the same
+// user against a service distributed to the account's "All" group, where every
+// user of the account is a member by default.
+func TestValidateSession_PendingApprovalUserInAllUsersGroupDenied(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	proxy, err := setup.store.GetServiceByID(context.Background(), store.LockingStrengthNone, "testAccountId", "allUsersProxyId")
+	require.NoError(t, err)
+
+	token := createSessionToken(t, proxy.SessionPrivateKey, pendingAllUsersID, "all-users-proxy.example.com")
+
+	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		Domain:       "all-users-proxy.example.com",
+		SessionToken: token, //nolint:staticcheck
+	})
+
+	require.NoError(t, err)
+	assert.False(t, resp.Valid, "User pending approval should be denied even in the All Users group")
+	assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason, "Denied reason should name the pending approval state")
+	assert.Equal(t, pendingAllUsersID, resp.UserId, "Denial should identify the user it applies to")
+	assert.Equal(t, []string{allUsersGroupID}, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the resolved user's group memberships on denial")
+}
+
+// TestValidateSession_BlockedUserDenied covers a user blocked after having been
+// approved, so PendingApproval is false and only the blocked flag is set.
+func TestValidateSession_BlockedUserDenied(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	proxy, err := setup.store.GetServiceByID(context.Background(), store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
+	require.NoError(t, err)
+
+	token := createSessionToken(t, proxy.SessionPrivateKey, blockedUserID, "restricted-proxy.example.com")
+
+	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		Domain:       "restricted-proxy.example.com",
+		SessionToken: token, //nolint:staticcheck
+	})
+
+	require.NoError(t, err)
+	assert.False(t, resp.Valid, "Blocked user should be denied")
+	assert.Equal(t, deniedReasonUserBlocked, resp.DeniedReason, "Denied reason should name the blocked state")
+	assert.Equal(t, blockedUserID, resp.UserId, "Denial should identify the user it applies to")
+}
+
+// TestValidateSession_UserAllowedAfterApproval walks the same session token
+// through the approval transition: denied while pending, allowed once an
+// administrator clears both flags.
+func TestValidateSession_UserAllowedAfterApproval(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+
+	proxy, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
+	require.NoError(t, err)
+
+	token := createSessionToken(t, proxy.SessionPrivateKey, pendingUserID, "restricted-proxy.example.com")
+	req := &proto.ValidateSessionRequest{
+		Domain:       "restricted-proxy.example.com",
+		SessionToken: token, //nolint:staticcheck,
+	}
+
+	resp, err := setup.proxyService.ValidateSession(ctx, req)
+	require.NoError(t, err)
+	require.False(t, resp.Valid, "User pending approval should be denied before approval")
+	assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason, "Denied reason should name the pending approval state")
+
+	user, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, pendingUserID)
+	require.NoError(t, err)
+	user.PendingApproval = false
+	user.Blocked = false
+	require.NoError(t, setup.store.SaveUser(ctx, user))
+
+	resp, err = setup.proxyService.ValidateSession(ctx, req)
+	require.NoError(t, err)
+	assert.True(t, resp.Valid, "Approved user should be allowed access")
+	assert.Empty(t, resp.DeniedReason)
+	assert.Equal(t, pendingUserID, resp.UserId, "Approved user should be identified in the response")
+	assert.Equal(t, []string{"allowedGroupId"}, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the approved user's group memberships")
+}
+
 func TestValidateSession_UserInDifferentAccount(t *testing.T) {
 	setup := setupValidateSessionTest(t)
 	defer setup.cleanup()
@@ -160,7 +349,7 @@ func TestValidateSession_UserInDifferentAccount(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -179,7 +368,7 @@ func TestValidateSession_UserNotFound(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -198,7 +387,7 @@ func TestValidateSession_ProxyNotFound(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "unknown-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -212,7 +401,7 @@ func TestValidateSession_InvalidToken(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: "invalid-token",
+		SessionToken: "invalid-token", //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -225,7 +414,7 @@ func TestValidateSession_MissingDomain(t *testing.T) {
 	defer setup.cleanup()
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
-		SessionToken: "some-token",
+		SessionToken: "some-token", //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -246,6 +435,57 @@ func TestValidateSession_MissingToken(t *testing.T) {
 	assert.Contains(t, resp.DeniedReason, "missing")
 }
 
+// TestGenerateSessionToken_UserNotInAllowedGroupGetsNoToken is the regression
+// guard for the group-authorisation bypass: the callback used to hand a signed
+// token to a user the service denies, and the proxy honoured that token as soon
+// as the user moved it into the nb_session cookie themselves. Authorisation has
+// to run before the token is signed.
+func TestGenerateSessionToken_UserNotInAllowedGroupGetsNoToken(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	token, err := setup.proxyService.GenerateSessionToken(context.Background(), "restricted-proxy.example.com", "nonGroupUserId", auth.MethodOIDC)
+
+	require.Error(t, err, "a user outside the distribution groups must not receive a token")
+	assert.ErrorIs(t, err, ErrUserNotInGroup, "the callback maps this sentinel onto the access denied page")
+	assert.Empty(t, token, "no token may reach the browser")
+}
+
+func TestGenerateSessionToken_UserInAllowedGroupGetsTokenWithGroups(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+	svc, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
+	require.NoError(t, err)
+
+	token, err := setup.proxyService.GenerateSessionToken(ctx, "restricted-proxy.example.com", "allowedUserId", auth.MethodOIDC)
+	require.NoError(t, err)
+	require.NotEmpty(t, token)
+
+	pubKey, err := base64.StdEncoding.DecodeString(svc.SessionPublicKey)
+	require.NoError(t, err)
+
+	userID, _, method, groups, _, err := auth.ValidateSessionJWT(token, "restricted-proxy.example.com", pubKey)
+	require.NoError(t, err)
+	assert.Equal(t, "allowedUserId", userID)
+	assert.Equal(t, auth.MethodOIDC.String(), method)
+	assert.Equal(t, []string{"allowedGroupId"}, groups, "the proxy gates the cookie on this claim, so it must carry the matched group")
+}
+
+// TestGenerateSessionToken_UnrestrictedServiceAllowsAnyAccountUser keeps the new
+// gate scoped: a service without distribution groups is open to every user of
+// its account, as before.
+func TestGenerateSessionToken_UnrestrictedServiceAllowsAnyAccountUser(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	token, err := setup.proxyService.GenerateSessionToken(context.Background(), "test-proxy.example.com", "nonGroupUserId", auth.MethodOIDC)
+
+	require.NoError(t, err, "an unrestricted service must keep working for any user of the account")
+	assert.NotEmpty(t, token)
+}
+
 type testValidateSessionServiceManager struct {
 	store store.Store
 }
@@ -255,15 +495,15 @@ func (m *testValidateSessionServiceManager) GetAllServices(_ context.Context, _,
 }
 
 func (m *testValidateSessionServiceManager) GetService(_ context.Context, _, _, _ string) (*service.Service, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) CreateService(_ context.Context, _, _ string, _ *service.Service) (*service.Service, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) UpdateService(_ context.Context, _, _ string, _ *service.Service) (*service.Service, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) DeleteService(_ context.Context, _, _, _ string) error {
@@ -307,7 +547,7 @@ func (m *testValidateSessionServiceManager) GetServiceIDByTargetID(_ context.Con
 }
 
 func (m *testValidateSessionServiceManager) CreateServiceFromPeer(_ context.Context, _, _ string, _ *service.ExposeServiceRequest) (*service.ExposeServiceResponse, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) RenewServiceFromPeer(_ context.Context, _, _, _ string) error {
@@ -334,8 +574,8 @@ func (m *testValidateSessionServiceManager) DeleteAccountCluster(_ context.Conte
 
 type testValidateSessionProxyManager struct{}
 
-func (m *testValidateSessionProxyManager) Connect(_ context.Context, _, _, _, _ string, _ *string, _ *proxy.Capabilities) (*proxy.Proxy, error) {
-	return nil, nil
+func (m *testValidateSessionProxyManager) Connect(_ context.Context, _, _, _, _, _ string, _ *string, _ *proxy.Capabilities) (*proxy.Proxy, error) {
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionProxyManager) Disconnect(_ context.Context, _, _ string) error {
@@ -367,7 +607,7 @@ func (m *testValidateSessionProxyManager) CleanupStale(_ context.Context, _ time
 }
 
 func (m *testValidateSessionProxyManager) GetAccountProxy(_ context.Context, _ string) (*proxy.Proxy, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionProxyManager) CountAccountProxies(_ context.Context, _ string) (int64, error) {
@@ -398,6 +638,14 @@ func (m *testValidateSessionProxyManager) ClusterSupportsPrivate(_ context.Conte
 	return nil
 }
 
+func (m *testValidateSessionProxyManager) ClusterAllProxiesPrivate(_ context.Context, _ string) *bool {
+	return nil
+}
+
+func (m *testValidateSessionProxyManager) ClusterSupportsSessionCode(_ context.Context, _ string) bool {
+	return false
+}
+
 type testValidateSessionUsersManager struct {
 	store store.Store
 }
@@ -426,3 +674,169 @@ func (m *testValidateSessionUsersManager) GetUserWithGroups(ctx context.Context,
 	}
 	return user, groups, nil
 }
+
+func TestValidateSession_RedeemsSessionCode(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	proxy, err := setup.store.GetServiceByID(context.Background(), store.LockingStrengthNone, "testAccountId", "testProxyId")
+	require.NoError(t, err)
+
+	token := createSessionToken(t, proxy.SessionPrivateKey, "allowedUserId", "test-proxy.example.com")
+	code, ok := setup.proxyService.GenerateSessionCode(token)
+	require.True(t, ok)
+	require.NotEqual(t, token, code, "code must not be the token itself")
+
+	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		Domain:      "test-proxy.example.com",
+		SessionCode: code,
+	})
+	require.NoError(t, err)
+	assert.True(t, resp.Valid, "redeemed code should authorize the user")
+	assert.Equal(t, "allowedUserId", resp.UserId)
+	assert.Equal(t, token, resp.GetSessionToken(), "response must carry the durable token for the cookie")
+
+	// Single-use: the same code must not redeem again.
+	resp2, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		Domain:      "test-proxy.example.com",
+		SessionCode: code,
+	})
+	require.NoError(t, err)
+	assert.False(t, resp2.Valid, "a consumed code must be rejected")
+	assert.Empty(t, resp2.GetSessionToken())
+}
+
+func TestValidateSession_InvalidSessionCode(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		Domain:      "test-proxy.example.com",
+		SessionCode: "does-not-exist",
+	})
+	require.NoError(t, err)
+	assert.False(t, resp.Valid)
+	assert.Empty(t, resp.GetSessionToken())
+}
+
+// TestGenerateSessionToken_EmailFallsBackToIdP covers users whose stored email
+// column is empty: the token's email claim comes from the IdP so the proxy can
+// still stamp X-NetBird-User.
+func TestGenerateSessionToken_EmailFallsBackToIdP(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+	svc, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
+	require.NoError(t, err)
+
+	idpMock := &mockTunnelIdpManager{email: "idp@example.com", hasData: true}
+	setup.proxyService.idpManager = idpMock
+
+	token, err := setup.proxyService.GenerateSessionToken(ctx, "restricted-proxy.example.com", "allowedUserId", auth.MethodOIDC)
+	require.NoError(t, err)
+
+	pubKey, err := base64.StdEncoding.DecodeString(svc.SessionPublicKey)
+	require.NoError(t, err)
+
+	_, email, _, _, _, err := auth.ValidateSessionJWT(token, "restricted-proxy.example.com", pubKey)
+	require.NoError(t, err)
+	assert.Equal(t, "idp@example.com", email)
+	require.Len(t, idpMock.gotMeta, 1)
+	assert.Equal(t, "testAccountId", idpMock.gotMeta[0].WTAccountID, "IdP lookup must be scoped to the service's account")
+}
+
+// TestGenerateSessionToken_IdPFailureStillIssuesToken pins the fail-soft
+// behaviour: an unreachable IdP costs the email claim, not the login.
+func TestGenerateSessionToken_IdPFailureStillIssuesToken(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+	svc, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
+	require.NoError(t, err)
+
+	setup.proxyService.idpManager = &mockTunnelIdpManager{err: errors.New("idp down")}
+
+	token, err := setup.proxyService.GenerateSessionToken(ctx, "restricted-proxy.example.com", "allowedUserId", auth.MethodOIDC)
+	require.NoError(t, err)
+
+	pubKey, err := base64.StdEncoding.DecodeString(svc.SessionPublicKey)
+	require.NoError(t, err)
+
+	userID, email, _, _, _, err := auth.ValidateSessionJWT(token, "restricted-proxy.example.com", pubKey)
+	require.NoError(t, err)
+	assert.Equal(t, "allowedUserId", userID)
+	assert.Empty(t, email)
+}
+
+func TestValidateSession_EmailResolution(t *testing.T) {
+	tests := []struct {
+		name        string
+		storedEmail string
+		tokenEmail  string
+		idp         *mockTunnelIdpManager
+		expectEmail string
+		expectCalls int
+	}{
+		{
+			name:        "stored email wins without IdP call",
+			storedEmail: "stored@example.com",
+			tokenEmail:  "claim@example.com",
+			idp:         &mockTunnelIdpManager{email: "idp@example.com", hasData: true},
+			expectEmail: "stored@example.com",
+		},
+		{
+			name:        "token email claim is reused without IdP call",
+			tokenEmail:  "claim@example.com",
+			idp:         &mockTunnelIdpManager{email: "idp@example.com", hasData: true},
+			expectEmail: "claim@example.com",
+		},
+		{
+			name:        "empty stored email and claim fall back to IdP",
+			idp:         &mockTunnelIdpManager{email: "idp@example.com", hasData: true},
+			expectEmail: "idp@example.com",
+			expectCalls: 1,
+		},
+		{
+			name:        "IdP error leaves email empty but session valid",
+			idp:         &mockTunnelIdpManager{err: errors.New("idp down")},
+			expectCalls: 1,
+		},
+		{
+			name:        "IdP without data leaves email empty",
+			idp:         &mockTunnelIdpManager{},
+			expectCalls: 1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setup := setupValidateSessionTest(t)
+			defer setup.cleanup()
+
+			ctx := context.Background()
+			user, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
+			require.NoError(t, err)
+			user.Email = tt.storedEmail
+			require.NoError(t, setup.store.SaveUser(ctx, user))
+
+			setup.proxyService.idpManager = tt.idp
+
+			svc, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "testProxyId")
+			require.NoError(t, err)
+			token := createSessionTokenWithEmail(t, svc.SessionPrivateKey, "allowedUserId", tt.tokenEmail, "test-proxy.example.com")
+			code, ok := setup.proxyService.GenerateSessionCode(token)
+			require.True(t, ok)
+
+			resp, err := setup.proxyService.ValidateSession(ctx, &proto.ValidateSessionRequest{
+				Domain:      "test-proxy.example.com",
+				SessionCode: code,
+			})
+			require.NoError(t, err)
+			assert.True(t, resp.GetValid())
+			assert.Equal(t, tt.expectEmail, resp.GetUserEmail())
+			assert.Equal(t, tt.expectCalls, tt.idp.gotCalls)
+		})
+	}
+}
diff --git a/management/internals/shared/requestbuffer/buffer.go b/management/internals/shared/requestbuffer/buffer.go
new file mode 100644
index 000000000..c3823776c
--- /dev/null
+++ b/management/internals/shared/requestbuffer/buffer.go
@@ -0,0 +1,102 @@
+// Package requestbuffer coalesces concurrent reads of the same expensive
+// resource into a single fetch.
+package requestbuffer
+
+import (
+	"context"
+	"os"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// FetchFunc reads the resource identified by key.
+type FetchFunc[T any] func(ctx context.Context, key string) (T, error)
+
+// Buffer batches requests per key: the first request opens a window, every
+// request arriving within it joins the batch, and a single fetch serves them
+// all. The fetch starts only after the window closed, so a caller never
+// observes data read before its own request.
+type Buffer[T any] struct {
+	ctx      context.Context
+	name     string
+	fetch    FetchFunc[T]
+	interval time.Duration
+
+	mu      sync.Mutex
+	waiting map[string][]chan result[T]
+}
+
+type result[T any] struct {
+	value T
+	err   error
+}
+
+// New returns a Buffer serving batched requests through fetch. ctx bounds the
+// fetches, not the callers, and must outlive them.
+func New[T any](ctx context.Context, name string, interval time.Duration, fetch FetchFunc[T]) *Buffer[T] {
+	return &Buffer[T]{
+		ctx:      ctx,
+		name:     name,
+		fetch:    fetch,
+		interval: interval,
+		waiting:  make(map[string][]chan result[T]),
+	}
+}
+
+// Get returns the value for key, sharing one fetch with the other callers of
+// the current batch. The value is shared as is, so callers must treat it as
+// read-only unless the fetch hands out copies.
+func (b *Buffer[T]) Get(ctx context.Context, key string) (T, error) {
+	ch := make(chan result[T], 1)
+
+	b.mu.Lock()
+	b.waiting[key] = append(b.waiting[key], ch)
+	first := len(b.waiting[key]) == 1
+	b.mu.Unlock()
+
+	if first {
+		time.AfterFunc(b.interval, func() { b.flush(key) })
+	}
+
+	select {
+	case res := <-ch:
+		return res.value, res.err
+	case <-ctx.Done():
+		var zero T
+		return zero, ctx.Err()
+	}
+}
+
+func (b *Buffer[T]) flush(key string) {
+	b.mu.Lock()
+	waiting := b.waiting[key]
+	delete(b.waiting, key)
+	b.mu.Unlock()
+
+	if len(waiting) == 0 {
+		return
+	}
+
+	start := time.Now()
+	value, err := b.fetch(b.ctx, key)
+	log.WithContext(b.ctx).Tracef("%s: fetched %s for %d waiters in %s", b.name, key, len(waiting), time.Since(start))
+
+	for _, ch := range waiting {
+		ch <- result[T]{value: value, err: err}
+	}
+}
+
+// Interval reads a buffer interval from envVar, falling back to def.
+func Interval(ctx context.Context, envVar string, def time.Duration) time.Duration {
+	value := os.Getenv(envVar)
+	interval, err := time.ParseDuration(value)
+	if err != nil {
+		if value != "" {
+			log.WithContext(ctx).Warnf("failed to parse %s: %s", envVar, err)
+		}
+		return def
+	}
+	return interval
+}
diff --git a/management/internals/shared/requestbuffer/buffer_test.go b/management/internals/shared/requestbuffer/buffer_test.go
new file mode 100644
index 000000000..9e356145e
--- /dev/null
+++ b/management/internals/shared/requestbuffer/buffer_test.go
@@ -0,0 +1,106 @@
+package requestbuffer
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBufferCoalescesConcurrentRequests(t *testing.T) {
+	var fetches atomic.Int32
+	buffer := New(context.Background(), "test", 50*time.Millisecond,
+		func(ctx context.Context, key string) (string, error) {
+			fetches.Add(1)
+			return key, nil
+		})
+
+	var wg sync.WaitGroup
+	for range 10 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			value, err := buffer.Get(context.Background(), "account")
+			assert.NoError(t, err)
+			assert.Equal(t, "account", value)
+		}()
+	}
+	wg.Wait()
+
+	assert.Equal(t, int32(1), fetches.Load())
+}
+
+func TestBufferSeparatesKeys(t *testing.T) {
+	keys := make(chan string, 2)
+	buffer := New(context.Background(), "test", 10*time.Millisecond,
+		func(ctx context.Context, key string) (string, error) {
+			keys <- key
+			return key, nil
+		})
+
+	var wg sync.WaitGroup
+	for _, key := range []string{"a", "b"} {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_, err := buffer.Get(context.Background(), key)
+			assert.NoError(t, err)
+		}()
+	}
+	wg.Wait()
+	close(keys)
+
+	var fetched []string
+	for key := range keys {
+		fetched = append(fetched, key)
+	}
+	assert.ElementsMatch(t, []string{"a", "b"}, fetched)
+}
+
+func TestBufferFetchesAfterRequest(t *testing.T) {
+	var version atomic.Int32
+	buffer := New(context.Background(), "test", 10*time.Millisecond,
+		func(ctx context.Context, key string) (int32, error) {
+			return version.Load(), nil
+		})
+
+	first, err := buffer.Get(context.Background(), "account")
+	require.NoError(t, err)
+	assert.Equal(t, int32(0), first)
+
+	version.Store(1)
+
+	second, err := buffer.Get(context.Background(), "account")
+	require.NoError(t, err)
+	assert.Equal(t, int32(1), second)
+}
+
+func TestBufferPropagatesError(t *testing.T) {
+	fetchErr := errors.New("fetch failed")
+	buffer := New(context.Background(), "test", 10*time.Millisecond,
+		func(ctx context.Context, key string) (*int, error) {
+			return nil, fetchErr
+		})
+
+	value, err := buffer.Get(context.Background(), "account")
+	assert.ErrorIs(t, err, fetchErr)
+	assert.Nil(t, value)
+}
+
+func TestBufferHonorsCallerContext(t *testing.T) {
+	buffer := New(context.Background(), "test", time.Minute,
+		func(ctx context.Context, key string) (string, error) {
+			return key, nil
+		})
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
+	defer cancel()
+
+	_, err := buffer.Get(ctx, "account")
+	assert.ErrorIs(t, err, context.DeadlineExceeded)
+}
diff --git a/management/main.go b/management/main.go
index ff8482f97..a19b741a9 100644
--- a/management/main.go
+++ b/management/main.go
@@ -1,19 +1,24 @@
 package main
 
 import (
-	"log"
 	"net/http"
 	// nolint:gosec
 	_ "net/http/pprof"
 	"os"
 
+	log "github.com/sirupsen/logrus"
+
 	"github.com/netbirdio/netbird/management/cmd"
 )
 
 func main() {
-	go func() {
-		log.Println(http.ListenAndServe("localhost:6060", nil))
-	}()
+	if pprofAddr := os.Getenv("NB_PPROF_ADDR"); pprofAddr != "" {
+		log.Infof("pprof enabled, listening on: %s", pprofAddr)
+		go func() {
+			log.Println(http.ListenAndServe(pprofAddr, nil))
+		}()
+	}
+
 	if err := cmd.Execute(); err != nil {
 		os.Exit(1)
 	}
diff --git a/management/server/account.go b/management/server/account.go
index 9d2759cb7..59991a4e4 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"math/rand"
 	"net"
 	"net/netip"
 	"os"
@@ -15,10 +14,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
-	"github.com/netbirdio/netbird/management/server/job"
-	"github.com/netbirdio/netbird/shared/auth"
-
 	cacheStore "github.com/eko/gocache/lib/v4/store"
 	"github.com/eko/gocache/store/redis/v4"
 	"github.com/rs/xid"
@@ -30,15 +25,17 @@ import (
 	"github.com/netbirdio/netbird/formatter/hook"
 	"github.com/netbirdio/netbird/idp/dex"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
+	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
@@ -50,7 +47,9 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/auth"
 	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -63,7 +62,7 @@ const (
 type userLoggedInOnce bool
 
 func cacheEntryExpiration() time.Duration {
-	r := rand.Intn(int(nbcache.DefaultIDPCacheExpirationMax.Milliseconds()-nbcache.DefaultIDPCacheExpirationMin.Milliseconds())) + int(nbcache.DefaultIDPCacheExpirationMin.Milliseconds())
+	r := util.RandIntn(int(nbcache.DefaultIDPCacheExpirationMax.Milliseconds()-nbcache.DefaultIDPCacheExpirationMin.Milliseconds())) + int(nbcache.DefaultIDPCacheExpirationMin.Milliseconds())
 	return time.Duration(r) * time.Millisecond
 }
 
@@ -84,7 +83,6 @@ type DefaultAccountManager struct {
 
 	requestBuffer *AccountRequestBuffer
 
-	proxyController port_forwarding.Controller
 	settingsManager settings.Manager
 	serviceManager  service.Manager
 
@@ -102,6 +100,8 @@ type DefaultAccountManager struct {
 
 	peerInactivityExpiry Scheduler
 
+	certChallenges *certChallengeRefresher
+
 	// userDeleteFromIDPEnabled allows to delete user from IDP when user is deleted from account
 	userDeleteFromIDPEnabled bool
 
@@ -112,6 +112,9 @@ type DefaultAccountManager struct {
 	permissionsManager permissions.Manager
 
 	disableDefaultPolicy bool
+
+	deletionHooksMu sync.RWMutex
+	deletionHooks   []account.DeletionHook
 }
 
 var _ account.Manager = (*DefaultAccountManager)(nil)
@@ -120,6 +123,32 @@ func (am *DefaultAccountManager) SetServiceManager(serviceManager service.Manage
 	am.serviceManager = serviceManager
 }
 
+// AddAccountDeletionHook registers hook to run on every account deletion. Hooks run in
+// registration order, and the first one to fail stops the rest and aborts the deletion.
+// It panics on a nil hook: dropping one silently would skip that hook's cleanup on every
+// deletion, so the wiring bug surfaces at startup instead.
+func (am *DefaultAccountManager) AddAccountDeletionHook(hook account.DeletionHook) {
+	if hook == nil {
+		panic("nil account deletion hook")
+	}
+	am.deletionHooksMu.Lock()
+	defer am.deletionHooksMu.Unlock()
+	am.deletionHooks = append(am.deletionHooks, hook)
+}
+
+func (am *DefaultAccountManager) runAccountDeletionHooks(ctx context.Context, accountID string) error {
+	am.deletionHooksMu.RLock()
+	hooks := slices.Clone(am.deletionHooks)
+	am.deletionHooksMu.RUnlock()
+
+	for _, hook := range hooks {
+		if err := hook(ctx, accountID); err != nil {
+			return fmt.Errorf("account deletion hook: %w", err)
+		}
+	}
+	return nil
+}
+
 func isUniqueConstraintError(err error) bool {
 	switch {
 	case strings.Contains(err.Error(), "(SQLSTATE 23505)"),
@@ -196,7 +225,6 @@ func BuildManager(
 	userDeleteFromIDPEnabled bool,
 	integratedPeerValidator integrated_validator.IntegratedValidator,
 	metrics telemetry.AppMetrics,
-	proxyController port_forwarding.Controller,
 	settingsManager settings.Manager,
 	permissionsManager permissions.Manager,
 	disableDefaultPolicy bool,
@@ -224,12 +252,13 @@ func BuildManager(
 		integratedPeerValidator:  integratedPeerValidator,
 		metrics:                  metrics,
 		requestBuffer:            NewAccountRequestBuffer(ctx, store),
-		proxyController:          proxyController,
 		settingsManager:          settingsManager,
 		permissionsManager:       permissionsManager,
 		disableDefaultPolicy:     disableDefaultPolicy,
 	}
 
+	am.certChallenges = newCertChallengeRefresher(am.refreshCertificateChallenges)
+
 	am.networkMapController.StartWarmup(ctx)
 
 	accountsCounter, err := store.GetAccountsCounter(ctx)
@@ -237,6 +266,10 @@ func BuildManager(
 		log.WithContext(ctx).Error(err)
 	}
 
+	if IsEmbeddedIdp(idpManager) && accountsCounter > 1 {
+		log.WithContext(ctx).Warnf("embedded IdP requires a single account, found %d", accountsCounter)
+	}
+
 	// enable single account mode only if configured by user and number of existing accounts is not grater than 1
 	am.singleAccountMode = singleAccountModeDomain != "" && accountsCounter <= 1
 	if am.singleAccountMode {
@@ -267,6 +300,10 @@ func BuildManager(
 		am.onPeersInvalidated(ctx, accountID, peerIDs)
 	})
 
+	// Started last: a manager that fails to build is never returned, so nothing would
+	// stop its refresher.
+	am.certChallenges.Start(ctx)
+
 	return am, nil
 }
 
@@ -301,6 +338,9 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 	var groupChangesAffectPeers bool
 	var reloadReverseProxy bool
 	var effectiveOldNetworkRange netip.Prefix
+	var ipv6Changed bool
+	var ipv6Snap *affectedpeers.Snapshot
+	var ipv6Change affectedpeers.Change
 
 	err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		var groupsUpdated bool
@@ -346,10 +386,10 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 		}
 
 		if ipv6SettingsChanged(oldSettings, newSettings) {
-			if err = am.updatePeerIPv6Addresses(ctx, transaction, accountID, newSettings); err != nil {
+			if ipv6Change, err = am.applyIPv6SettingsChange(ctx, transaction, accountID, oldSettings, newSettings); err != nil {
 				return err
 			}
-			updateAccountPeers = true
+			ipv6Changed = true
 		}
 
 		if oldSettings.RoutingPeerDNSResolutionEnabled != newSettings.RoutingPeerDNSResolutionEnabled ||
@@ -386,12 +426,20 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 			return err
 		}
 
-		if updateAccountPeers || groupsUpdated {
+		if updateAccountPeers || groupsUpdated || ipv6Changed {
 			if err = transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
 				return err
 			}
 		}
 
+		// A full account refresh already covers the IPv6 change, so the affected-peers
+		// snapshot is only needed when nothing account-wide changed.
+		if ipv6Changed && !updateAccountPeers && !groupChangesAffectPeers {
+			if ipv6Snap, err = affectedpeers.Load(ctx, transaction, accountID, ipv6Change); err != nil {
+				return fmt.Errorf("load affected peers: %w", err)
+			}
+		}
+
 		return nil
 	})
 	if err != nil {
@@ -411,6 +459,7 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 	am.handleAutoUpdateAlwaysSettings(ctx, oldSettings, newSettings, userID, accountID)
 	am.handlePeerExposeSettings(ctx, oldSettings, newSettings, userID, accountID)
 	am.handleMetricsPushSettings(ctx, oldSettings, newSettings, userID, accountID)
+	am.handlePeerHostnameCollisionSettings(ctx, oldSettings, newSettings, userID, accountID)
 	if err = am.handleInactivityExpirationSettings(ctx, oldSettings, newSettings, userID, accountID); err != nil {
 		return nil, err
 	}
@@ -453,13 +502,34 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 		}
 	}
 
-	if updateAccountPeers || extraSettingsChanged || groupChangesAffectPeers {
-		go am.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceAccountSettings, Operation: types.UpdateOperationUpdate})
+	switch {
+	case updateAccountPeers || extraSettingsChanged || groupChangesAffectPeers:
+		go am.UpdateAccountPeers(context.WithoutCancel(ctx), accountID, types.UpdateReason{Resource: types.UpdateResourceAccountSettings, Operation: types.UpdateOperationUpdate})
+	case ipv6Snap != nil:
+		am.ExpandAndUpdateAffected(ctx, accountID, ipv6Snap, ipv6Change)
 	}
 
 	return newSettings, nil
 }
 
+// applyIPv6SettingsChange reconciles peer IPv6 addresses for new IPv6 settings and
+// returns the affected-peers change: peers whose address changed refresh together
+// with every peer that reaches them. On a range change every peer holding an address
+// also refreshes itself, since its interface prefix comes from the account range even
+// when its address stays inside the new one.
+func (am *DefaultAccountManager) applyIPv6SettingsChange(ctx context.Context, transaction store.Store, accountID string, oldSettings, newSettings *types.Settings) (affectedpeers.Change, error) {
+	result, err := am.updatePeerIPv6Addresses(ctx, transaction, accountID, newSettings)
+	if err != nil {
+		return affectedpeers.Change{}, err
+	}
+
+	change := affectedpeers.Change{ChangedPeerIDs: result.changed}
+	if oldSettings.NetworkRangeV6 != newSettings.NetworkRangeV6 {
+		change.OutputPeerIDs = result.withIPv6
+	}
+	return change, nil
+}
+
 func ipv6SettingsChanged(old, updated *types.Settings) bool {
 	if old.NetworkRangeV6 != updated.NetworkRangeV6 {
 		return true
@@ -575,6 +645,16 @@ func (am *DefaultAccountManager) handleMetricsPushSettings(ctx context.Context,
 	}
 }
 
+func (am *DefaultAccountManager) handlePeerHostnameCollisionSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
+	if oldSettings.PeerHostnameCollisionRejected != newSettings.PeerHostnameCollisionRejected {
+		if newSettings.PeerHostnameCollisionRejected {
+			am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountPeerHostnameCollisionRejectionEnabled, nil)
+		} else {
+			am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountPeerHostnameCollisionRejectionDisabled, nil)
+		}
+	}
+}
+
 func (am *DefaultAccountManager) handlePeerLoginExpirationSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
 	if oldSettings.PeerLoginExpirationEnabled != newSettings.PeerLoginExpirationEnabled {
 		event := activity.AccountPeerLoginExpirationEnabled
@@ -690,7 +770,12 @@ func (am *DefaultAccountManager) peerLoginExpirationJob(ctx context.Context, acc
 		ctx = context.WithValue(ctx, hook.ExecutionContextKey, fmt.Sprintf("%s-PEER-EXPIRATION", hook.SystemSource))
 
 		expiredPeers, err := am.getExpiredPeers(ctx, accountID)
+		if isNotFound(err) {
+			log.WithContext(ctx).Debugf("account %s not found, stopping peer login expiration job", accountID)
+			return 0, false
+		}
 		if err != nil {
+			log.WithContext(ctx).Errorf("failed getting expired peers for account %s: %v", accountID, err)
 			return peerSchedulerRetryInterval, true
 		}
 
@@ -715,8 +800,10 @@ func (am *DefaultAccountManager) schedulePeerLoginExpiration(ctx context.Context
 		log.WithContext(ctx).Tracef("peer login expiration job for account %s is already scheduled", accountID)
 		return
 	}
+	// The job outlives the request that arms it, so it must not inherit the request's cancellation.
+	jobCtx := context.WithoutCancel(ctx)
 	if nextRun, ok := am.getNextPeerExpiration(ctx, accountID); ok {
-		go am.peerLoginExpiry.Schedule(ctx, nextRun, accountID, am.peerLoginExpirationJob(ctx, accountID))
+		go am.peerLoginExpiry.Schedule(jobCtx, nextRun, accountID, am.peerLoginExpirationJob(jobCtx, accountID))
 	}
 }
 
@@ -724,8 +811,12 @@ func (am *DefaultAccountManager) schedulePeerLoginExpiration(ctx context.Context
 func (am *DefaultAccountManager) peerInactivityExpirationJob(ctx context.Context, accountID string) func() (time.Duration, bool) {
 	return func() (time.Duration, bool) {
 		inactivePeers, err := am.getInactivePeers(ctx, accountID)
+		if isNotFound(err) {
+			log.WithContext(ctx).Debugf("account %s not found, stopping peer inactivity expiration job", accountID)
+			return 0, false
+		}
 		if err != nil {
-			log.WithContext(ctx).Errorf("failed getting inactive peers for account %s", accountID)
+			log.WithContext(ctx).Errorf("failed getting inactive peers for account %s: %v", accountID, err)
 			return peerSchedulerRetryInterval, true
 		}
 
@@ -745,11 +836,20 @@ func (am *DefaultAccountManager) peerInactivityExpirationJob(ctx context.Context
 	}
 }
 
+func isNotFound(err error) bool {
+	if err == nil {
+		return false
+	}
+	sErr, ok := status.FromError(err)
+	return ok && sErr.Type() == status.NotFound
+}
+
 // checkAndSchedulePeerInactivityExpiration periodically checks for inactive peers to end their sessions
 func (am *DefaultAccountManager) checkAndSchedulePeerInactivityExpiration(ctx context.Context, accountID string) {
 	am.peerInactivityExpiry.Cancel(ctx, []string{accountID})
+	jobCtx := context.WithoutCancel(ctx)
 	if nextRun, ok := am.getNextInactivePeerExpiration(ctx, accountID); ok {
-		go am.peerInactivityExpiry.Schedule(ctx, nextRun, accountID, am.peerInactivityExpirationJob(ctx, accountID))
+		go am.peerInactivityExpiry.Schedule(jobCtx, nextRun, accountID, am.peerInactivityExpirationJob(jobCtx, accountID))
 	}
 }
 
@@ -882,6 +982,10 @@ func (am *DefaultAccountManager) DeleteAccount(ctx context.Context, accountID, u
 		return status.Errorf(status.Internal, "failed to build user infos for account %s: %v", accountID, err)
 	}
 
+	if err = am.runAccountDeletionHooks(ctx, accountID); err != nil {
+		return err
+	}
+
 	if err = am.deleteAccountUsers(ctx, accountID, userID, account.Users, userInfosMap); err != nil {
 		return err
 	}
@@ -891,8 +995,9 @@ func (am *DefaultAccountManager) DeleteAccount(ctx context.Context, accountID, u
 		log.WithContext(ctx).Errorf("failed deleting account %s. error: %s", accountID, err)
 		return err
 	}
-	// cancel peer login expiry job
 	am.peerLoginExpiry.Cancel(ctx, []string{account.Id})
+	am.peerInactivityExpiry.Cancel(ctx, []string{account.Id})
+	am.certChallenges.Forget(account.Id)
 
 	meta := map[string]any{"account_id": account.Id, "domain": account.Domain, "created_at": account.CreatedAt}
 	am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountDeleted, meta)
@@ -1549,10 +1654,6 @@ func (am *DefaultAccountManager) GetAccountIDFromUserAuth(ctx context.Context, u
 		return "", "", status.Errorf(status.NotFound, "user %s not found", userAuth.UserId)
 	}
 
-	if userAuth.IsChild {
-		return accountID, user.Id, nil
-	}
-
 	ctx, err = am.permissionsManager.ValidateAccountAccess(ctx, accountID, user, false)
 	if err != nil {
 		return "", "", err
@@ -1591,7 +1692,10 @@ func (am *DefaultAccountManager) updateUserAuthWithSingleMode(ctx context.Contex
 	if err != nil {
 		return err
 	}
-	userAuth.Domain = domain
+	// Keep the configured single account domain when the existing account has none
+	if domain != "" {
+		userAuth.Domain = domain
+	}
 
 	log.WithContext(ctx).Debugf("overriding JWT Domain and DomainCategory claims since single account mode is enabled")
 	return nil
@@ -1601,10 +1705,10 @@ func (am *DefaultAccountManager) updateUserAuthWithSingleMode(ctx context.Contex
 // and propagates changes to peers if group propagation is enabled.
 // requires userAuth to have been ValidateAndParseToken and EnsureUserAccessByJWTGroups by the AuthManager
 func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth auth.UserAuth) error {
-	// Child accounts and PAT-authenticated requests do not sync JWT groups.
+	// PAT-authenticated requests do not sync JWT groups.
 	// Embedded-Dex local users also skip sync because local password authentication
 	// does not provide external IdP group claims.
-	if userAuth.IsChild || userAuth.IsPAT || dex.IsLocalUserID(userAuth.UserId) {
+	if userAuth.IsPAT || dex.IsLocalUserID(userAuth.UserId) {
 		return nil
 	}
 
@@ -1626,6 +1730,8 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 	var removeOldGroups []string
 	var hasChanges bool
 	var user *types.User
+	var change affectedpeers.Change
+	var snap *affectedpeers.Snapshot
 	err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		user, err = transaction.GetUserByUserID(ctx, store.LockingStrengthNone, userAuth.UserId)
 		if err != nil {
@@ -1648,6 +1754,10 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 			return nil
 		}
 
+		for _, g := range newGroupsToCreate {
+			g.PublicID = xid.New().String()
+		}
+
 		if err = transaction.CreateGroups(ctx, userAuth.AccountId, newGroupsToCreate); err != nil {
 			return fmt.Errorf("error saving groups: %w", err)
 		}
@@ -1660,14 +1770,25 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 			return fmt.Errorf("error saving user: %w", err)
 		}
 
+		allGroupChanges := slices.Concat(addNewGroups, removeOldGroups)
+		// The user's auto-groups changed, so the SSH rules authorizing them ship a new
+		// group -> user mapping even when no peer moves between groups.
+		change.UserGroupIDs = allGroupChanges
+
+		// The user's peers are the changed entity in every scenario the sync can
+		// produce — group membership, IPv6 assignment, SSH mappings — so they refresh
+		// together with every peer they can connect to, like on a regular peer update.
+		userPeers, err := transaction.GetUserPeers(ctx, store.LockingStrengthNone, userAuth.AccountId, userAuth.UserId)
+		if err != nil {
+			return fmt.Errorf("error getting user peers: %w", err)
+		}
+		for _, peer := range userPeers {
+			change.ChangedPeerIDs = append(change.ChangedPeerIDs, peer.ID)
+		}
+
 		// Propagate changes to peers if group propagation is enabled
 		if settings.GroupsPropagationEnabled {
-			peers, err := transaction.GetUserPeers(ctx, store.LockingStrengthNone, userAuth.AccountId, userAuth.UserId)
-			if err != nil {
-				return fmt.Errorf("error getting user peers: %w", err)
-			}
-
-			for _, peer := range peers {
+			for _, peer := range userPeers {
 				for _, g := range addNewGroups {
 					if err := transaction.AddPeerToGroup(ctx, userAuth.AccountId, peer.ID, g); err != nil {
 						return fmt.Errorf("error adding peer %s to group %s: %w", peer.ID, g, err)
@@ -1680,16 +1801,23 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 				}
 			}
 
-			allGroupChanges := slices.Concat(addNewGroups, removeOldGroups)
-			if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges); err != nil {
+			change.LinkGroups = allGroupChanges
+
+			ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges)
+			if err != nil {
 				return fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 			}
+			change.ChangedPeerIDs = append(change.ChangedPeerIDs, ipv6Changed...)
 
 			if err = transaction.IncrementNetworkSerial(ctx, userAuth.AccountId); err != nil {
 				return fmt.Errorf("error incrementing network serial: %w", err)
 			}
 		}
 
+		if snap, err = affectedpeers.Load(ctx, transaction, userAuth.AccountId, change); err != nil {
+			return err
+		}
+
 		return nil
 	})
 	if err != nil {
@@ -1726,20 +1854,17 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 		}
 	}
 
-	removedGroupAffectsPeers, err := areGroupChangesAffectPeers(ctx, am.Store, userAuth.AccountId, removeOldGroups)
-	if err != nil {
-		return err
-	}
-
-	newGroupsAffectsPeers, err := areGroupChangesAffectPeers(ctx, am.Store, userAuth.AccountId, addNewGroups)
-	if err != nil {
-		return err
-	}
-
-	if removedGroupAffectsPeers || newGroupsAffectsPeers {
-		log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating account peers", userAuth.UserId)
-		am.BufferUpdateAccountPeers(ctx, userAuth.AccountId, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate})
-	}
+	log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating affected peers", userAuth.UserId)
+	bgCtx := context.WithoutCancel(ctx)
+	go func() {
+		affectedPeerIDs := snap.Expand(bgCtx, userAuth.AccountId, change)
+		if len(affectedPeerIDs) == 0 {
+			return
+		}
+		if err := am.networkMapController.BufferUpdateAffectedPeers(bgCtx, userAuth.AccountId, affectedPeerIDs, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate}); err != nil {
+			log.WithContext(bgCtx).Errorf("failed to update affected peers after JWT group sync for account %s: %v", userAuth.AccountId, err)
+		}
+	}()
 
 	return nil
 }
@@ -1762,8 +1887,6 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 // Existing user + Existing account + Existing Indexed Domain -> Nothing changes
 //
 // Existing user + Existing account + Existing domain reclassified Domain as private -> Nothing changes (index domain)
-//
-// UserAuth IsChild -> checks that account exists
 func (am *DefaultAccountManager) getAccountIDWithAuthorizationClaims(ctx context.Context, userAuth auth.UserAuth) (string, error) {
 	log.WithContext(ctx).Tracef("getting account with authorization claims. User ID: \"%s\", Account ID: \"%s\", Domain: \"%s\", Domain Category: \"%s\"",
 		userAuth.UserId, userAuth.AccountId, userAuth.Domain, userAuth.DomainCategory)
@@ -1772,14 +1895,6 @@ func (am *DefaultAccountManager) getAccountIDWithAuthorizationClaims(ctx context
 		return "", errors.New(emptyUserID)
 	}
 
-	if userAuth.IsChild {
-		exists, err := am.Store.AccountExists(ctx, store.LockingStrengthNone, userAuth.AccountId)
-		if err != nil || !exists {
-			return "", err
-		}
-		return userAuth.AccountId, nil
-	}
-
 	if userAuth.DomainCategory != types.PrivateCategory || !isDomainValid(userAuth.Domain) {
 		return am.GetAccountIDByUserID(ctx, userAuth)
 	}
@@ -1817,6 +1932,7 @@ func (am *DefaultAccountManager) getAccountIDWithAuthorizationClaims(ctx context
 
 	return am.addNewPrivateAccount(ctx, domainAccountID, userAuth)
 }
+
 func (am *DefaultAccountManager) getPrivateDomainWithGlobalLock(ctx context.Context, domain string) (string, context.CancelFunc, error) {
 	domainAccountID, err := am.Store.GetAccountIDByPrivateDomain(ctx, store.LockingStrengthNone, domain)
 	if handleNotFound(err) != nil {
@@ -1900,7 +2016,7 @@ func domainIsUpToDate(domain string, domainCategory string, userAuth auth.UserAu
 // derived from syncTime (the moment the gRPC stream opened). Any
 // concurrent stream that started earlier loses the optimistic-lock race
 // in MarkPeerConnected and bails without writing.
-func (am *DefaultAccountManager) SyncAndMarkPeer(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error) {
+func (am *DefaultAccountManager) SyncAndMarkPeer(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*nbpeer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
 	peer, netMap, postureChecks, dnsfwdPort, err := am.SyncPeer(ctx, types.PeerSync{WireGuardPubKey: peerPubKey, Meta: meta, RealIP: realIP}, accountID)
 	if err != nil {
 		return nil, nil, nil, 0, fmt.Errorf("error syncing peer: %w", err)
@@ -2271,7 +2387,8 @@ func (am *DefaultAccountManager) propagateUserGroupMemberships(ctx context.Conte
 		return false, false, err
 	}
 
-	if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, updatedGroups); err != nil {
+	ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, updatedGroups)
+	if err != nil {
 		return false, false, fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 	}
 
@@ -2280,7 +2397,7 @@ func (am *DefaultAccountManager) propagateUserGroupMemberships(ctx context.Conte
 		return false, false, fmt.Errorf("error checking if group changes affect peers: %w", err)
 	}
 
-	return len(updatedGroups) > 0, peersAffected, nil
+	return len(updatedGroups) > 0, peersAffected || len(ipv6Changed) > 0, nil
 }
 
 // propagateAutoGroupsForUsers adds each user's peers to their AutoGroups where not already present.
@@ -2328,7 +2445,7 @@ func (am *DefaultAccountManager) reallocateAccountPeerIPs(ctx context.Context, t
 		return err
 	}
 
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "")
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "", "")
 	if err != nil {
 		return err
 	}
@@ -2365,7 +2482,7 @@ func (am *DefaultAccountManager) reallocateAccountPeerIPs(ctx context.Context, t
 // v6 address get one allocated. When disabled, all v6 addresses are cleared.
 // When the v6 range changes, all v6 addresses are reallocated.
 func (am *DefaultAccountManager) checkIPv6Collision(ctx context.Context, transaction store.Store, accountID, peerID string, newIPv6 netip.Addr) error {
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "")
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "", "")
 	if err != nil {
 		return fmt.Errorf("get peers: %w", err)
 	}
@@ -2377,73 +2494,89 @@ func (am *DefaultAccountManager) checkIPv6Collision(ctx context.Context, transac
 	return nil
 }
 
-func (am *DefaultAccountManager) updatePeerIPv6Addresses(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings) error {
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "")
+// ipv6Reassignment reports the outcome of an IPv6 address reconciliation.
+type ipv6Reassignment struct {
+	// changed are the peers whose IPv6 address was assigned, removed or reallocated.
+	changed []string
+	// withIPv6 are all peers holding an IPv6 address after the reconciliation.
+	withIPv6 []string
+}
+
+func (am *DefaultAccountManager) updatePeerIPv6Addresses(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings) (ipv6Reassignment, error) {
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "", "")
 	if err != nil {
-		return fmt.Errorf("get peers: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("get peers: %w", err)
 	}
 
 	network, err := transaction.GetAccountNetwork(ctx, store.LockingStrengthUpdate, accountID)
 	if err != nil {
-		return fmt.Errorf("get network: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("get network: %w", err)
 	}
 
 	if err := am.ensureIPv6Subnet(ctx, transaction, accountID, settings, network); err != nil {
-		return err
+		return ipv6Reassignment{}, err
 	}
 
 	allowedPeers, err := am.buildIPv6AllowedPeers(ctx, transaction, accountID, settings)
 	if err != nil {
-		return err
+		return ipv6Reassignment{}, err
 	}
 
 	v6Prefix, err := netip.ParsePrefix(network.NetV6.String())
 	if err != nil {
-		return fmt.Errorf("parse IPv6 prefix: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("parse IPv6 prefix: %w", err)
 	}
 
-	if err := am.assignPeerIPv6Addresses(ctx, transaction, accountID, peers, network, allowedPeers, v6Prefix); err != nil {
-		return err
+	changed, err := am.assignPeerIPv6Addresses(ctx, transaction, accountID, peers, network, allowedPeers, v6Prefix)
+	if err != nil {
+		return ipv6Reassignment{}, err
 	}
 
-	log.WithContext(ctx).Infof("updated IPv6 addresses for %d peers in account %s (groups=%d)",
-		len(peers), accountID, len(settings.IPv6EnabledGroups))
+	result := ipv6Reassignment{changed: changed}
+	for _, peer := range peers {
+		if peer.IPv6.IsValid() {
+			result.withIPv6 = append(result.withIPv6, peer.ID)
+		}
+	}
 
-	return nil
+	log.WithContext(ctx).Infof("updated IPv6 addresses for %d of %d peers in account %s (groups=%d)",
+		len(changed), len(peers), accountID, len(settings.IPv6EnabledGroups))
+
+	return result, nil
 }
 
 // reconcileIPv6ForGroupChanges checks whether the given group IDs overlap with
 // the account's IPv6EnabledGroups. If they do, it runs a full IPv6 address
 // reconciliation so that peers gaining or losing membership in an IPv6-enabled
-// group get their addresses assigned or removed.
-func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) error {
+// group get their addresses assigned or removed. It returns the peers whose IPv6
+// address changed, which callers pass as changed peers so every peer that can
+// reach them refreshes.
+func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) ([]string, error) {
 	settings, err := transaction.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
 	if err != nil {
-		return fmt.Errorf("get account settings: %w", err)
+		return nil, fmt.Errorf("get account settings: %w", err)
 	}
 
-	if len(settings.IPv6EnabledGroups) == 0 {
-		return nil
+	if !ipv6ReconcileNeeded(settings, groupIDs) {
+		return nil, nil
 	}
 
-	enabledSet := make(map[string]struct{}, len(settings.IPv6EnabledGroups))
-	for _, gid := range settings.IPv6EnabledGroups {
-		enabledSet[gid] = struct{}{}
+	result, err := am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
+	if err != nil {
+		return nil, err
 	}
+	return result.changed, nil
+}
 
-	affected := false
-	for _, gid := range groupIDs {
-		if _, ok := enabledSet[gid]; ok {
-			affected = true
-			break
+// ipv6ReconcileNeeded reports whether changes to the given groups trigger an IPv6
+// reconciliation.
+func ipv6ReconcileNeeded(settings *types.Settings, groupIDs []string) bool {
+	for _, groupID := range groupIDs {
+		if slices.Contains(settings.IPv6EnabledGroups, groupID) {
+			return true
 		}
 	}
-
-	if !affected {
-		return nil
-	}
-
-	return am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
+	return false
 }
 
 func (am *DefaultAccountManager) ensureIPv6Subnet(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings, network *types.Network) error {
@@ -2455,8 +2588,7 @@ func (am *DefaultAccountManager) ensureIPv6Subnet(ctx context.Context, transacti
 		return transaction.UpdateAccountNetworkV6(ctx, accountID, network.NetV6)
 	}
 	if network.NetV6.IP == nil {
-		r := rand.New(rand.NewSource(time.Now().UnixNano()))
-		network.NetV6 = types.AllocateIPv6Subnet(r)
+		network.NetV6 = types.AllocateIPv6Subnet()
 
 		// Sync settings to match the allocated subnet so SaveAccountSettings persists it.
 		ones, _ := network.NetV6.Mask.Size()
@@ -2472,7 +2604,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 	ctx context.Context, transaction store.Store, accountID string,
 	peers []*nbpeer.Peer, network *types.Network,
 	allowedPeers map[string]struct{}, v6Prefix netip.Prefix,
-) error {
+) ([]string, error) {
 	takenV6 := make(map[netip.Addr]struct{})
 	for _, peer := range peers {
 		if _, ok := allowedPeers[peer.ID]; ok && peer.IPv6.IsValid() && network.NetV6.Contains(peer.IPv6.AsSlice()) {
@@ -2480,6 +2612,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		}
 	}
 
+	var changed []string
 	for _, peer := range peers {
 		_, allowed := allowedPeers[peer.ID]
 		oldIPv6 := peer.IPv6
@@ -2489,7 +2622,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		} else if !peer.IPv6.IsValid() || !network.NetV6.Contains(peer.IPv6.AsSlice()) {
 			newIP, err := allocateIPv6WithRetry(v6Prefix, takenV6, peer.ID)
 			if err != nil {
-				return err
+				return nil, err
 			}
 			peer.IPv6 = newIP
 		}
@@ -2499,10 +2632,11 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		}
 
 		if err := transaction.SavePeer(ctx, accountID, peer); err != nil {
-			return fmt.Errorf("save peer %s: %w", peer.ID, err)
+			return nil, fmt.Errorf("save peer %s: %w", peer.ID, err)
 		}
+		changed = append(changed, peer.ID)
 	}
-	return nil
+	return changed, nil
 }
 
 func allocateIPv6WithRetry(prefix netip.Prefix, taken map[netip.Addr]struct{}, peerID string) (netip.Addr, error) {
@@ -2546,7 +2680,7 @@ func (am *DefaultAccountManager) buildIPv6AllowedPeers(ctx context.Context, tran
 
 	// Embedded proxy peers sit outside regular group membership but must
 	// participate in any v6-enabled overlay to reach v6-only peers.
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	if err != nil {
 		return nil, fmt.Errorf("get peers: %w", err)
 	}
@@ -2563,6 +2697,14 @@ func (am *DefaultAccountManager) validateIPForUpdate(account *types.Account, pee
 		return status.Errorf(status.InvalidArgument, "IP %s is not within the account network range %s", newIP.String(), account.Network.Net.String())
 	}
 
+	prefix, err := netip.ParsePrefix(account.Network.Net.String())
+	if err != nil {
+		return fmt.Errorf("parse account network %s: %w", account.Network.Net.String(), err)
+	}
+	if types.IsReservedPeerIP(prefix, newIP) {
+		return status.Errorf(status.InvalidArgument, "IP %s is reserved in the account network range %s", newIP.String(), account.Network.Net.String())
+	}
+
 	for _, peer := range peers {
 		if peer.ID != peerID && peer.IP == newIP {
 			return status.Errorf(status.InvalidArgument, "IP %s is already assigned to peer %s", newIP.String(), peer.ID)
@@ -2586,6 +2728,8 @@ func (am *DefaultAccountManager) UpdatePeerIP(ctx context.Context, accountID, us
 	}
 
 	if updateNetworkMap {
+		am.reloadServicesTargetingPeer(ctx, accountID, peerID)
+
 		peer, err := am.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peerID)
 		if err != nil {
 			return err
@@ -2600,6 +2744,19 @@ func (am *DefaultAccountManager) UpdatePeerIP(ctx context.Context, accountID, us
 	return nil
 }
 
+// reloadServicesTargetingPeer resends the account's reverse proxy services unless none of them targets the peer.
+func (am *DefaultAccountManager) reloadServicesTargetingPeer(ctx context.Context, accountID, peerID string) {
+	serviceID, err := am.serviceManager.GetServiceIDByTargetID(ctx, accountID, peerID)
+	if err != nil {
+		log.WithContext(ctx).Warnf("failed to look up services targeting peer %s, reloading all: %v", peerID, err)
+	} else if serviceID == "" {
+		return
+	}
+	if err := am.serviceManager.ReloadAllServicesForAccount(ctx, accountID); err != nil {
+		log.WithContext(ctx).Warnf("failed to reload services for account %s: %v", accountID, err)
+	}
+}
+
 func (am *DefaultAccountManager) updatePeerIPInTransaction(ctx context.Context, accountID, userID, peerID string, newIP netip.Addr) (bool, error) {
 	var updateNetworkMap bool
 	err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
@@ -2617,7 +2774,7 @@ func (am *DefaultAccountManager) updatePeerIPInTransaction(ctx context.Context,
 			return nil
 		}
 
-		peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "")
+		peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "", "")
 		if err != nil {
 			return fmt.Errorf("get account peers: %w", err)
 		}
diff --git a/management/server/account/deletion_hook.go b/management/server/account/deletion_hook.go
new file mode 100644
index 000000000..17c817444
--- /dev/null
+++ b/management/server/account/deletion_hook.go
@@ -0,0 +1,14 @@
+package account
+
+import "context"
+
+// DeletionHook runs when an account is deleted, after the caller's permission to delete
+// it has been checked and before any of its users or data are removed. It lets code that
+// keeps per-account state outside the store tear that state down while the account still
+// exists.
+//
+// A hook that returns an error aborts the deletion and the account is kept. The caller
+// sees the error, so a hook that wants a specific response returns a status error. A
+// retried deletion runs every hook again, and a later step can still fail after the hooks
+// succeed, so a hook must be idempotent and must tolerate the account surviving it.
+type DeletionHook func(ctx context.Context, accountID string) error
diff --git a/management/server/account/manager.go b/management/server/account/manager.go
index 1e738c274..15fe11241 100644
--- a/management/server/account/manager.go
+++ b/management/server/account/manager.go
@@ -1,6 +1,6 @@
 package account
 
-//go:generate go run github.com/golang/mock/mockgen -package account -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
+//go:generate go tool mockgen -package account -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
 
 import (
 	"context"
@@ -23,6 +23,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/users"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 type ExternalCacheManager nbcache.UserDataCache
@@ -61,8 +62,10 @@ type Manager interface {
 	GetUserByID(ctx context.Context, id string) (*types.User, error)
 	GetUserFromUserAuth(ctx context.Context, userAuth auth.UserAuth) (*types.User, error)
 	ListUsers(ctx context.Context, accountID string) ([]*types.User, error)
-	GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error)
+	GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error)
 	MarkPeerConnected(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64, nmap *types.NetworkMap) error
+	TrackCertificateChallenges(ctx context.Context, accountID, peerID string, streamStart time.Time)
+	UntrackCertificateChallenges(accountID, peerID string, streamStart time.Time)
 	MarkPeerDisconnected(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64) error
 	DeletePeer(ctx context.Context, accountID, peerID, userID string) error
 	UpdatePeer(ctx context.Context, accountID, userID string, p *nbpeer.Peer) (*nbpeer.Peer, error)
@@ -70,7 +73,7 @@ type Manager interface {
 	UpdatePeerIPv6(ctx context.Context, accountID, userID, peerID string, newIPv6 netip.Addr) error
 	GetNetworkMap(ctx context.Context, peerID string) (*types.NetworkMap, error)
 	GetPeerNetwork(ctx context.Context, peerID string) (*types.Network, error)
-	AddPeer(ctx context.Context, accountID, setupKey, userID string, p *nbpeer.Peer, temporary bool) (*nbpeer.Peer, *types.Network, []*posture.Checks, bool, error)
+	AddPeer(ctx context.Context, accountID, setupKey, userID string, p *nbpeer.Peer, temporary bool) (*nbpeer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error)
 	CreatePAT(ctx context.Context, accountID string, initiatorUserID string, targetUserID string, tokenName string, expiresIn int) (*types.PersonalAccessTokenGenerated, error)
 	DeletePAT(ctx context.Context, accountID string, initiatorUserID string, targetUserID string, tokenID string) error
 	GetPAT(ctx context.Context, accountID string, initiatorUserID string, targetUserID string, tokenID string) (*types.PersonalAccessToken, error)
@@ -109,9 +112,9 @@ type Manager interface {
 	GetPeer(ctx context.Context, accountID, peerID, userID string) (*nbpeer.Peer, error)
 	UpdateAccountSettings(ctx context.Context, accountID, userID string, newSettings *types.Settings) (*types.Settings, error)
 	UpdateAccountOnboarding(ctx context.Context, accountID, userID string, newOnboarding *types.AccountOnboarding) (*types.AccountOnboarding, error)
-	LoginPeer(ctx context.Context, login types.PeerLogin) (*nbpeer.Peer, *types.Network, []*posture.Checks, bool, error)                    // used by peer gRPC API
-	ExtendPeerSession(ctx context.Context, peerPubKey, userID string) (time.Time, error)                                                    // used by peer gRPC API for ExtendAuthSession
-	SyncPeer(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error) // used by peer gRPC API
+	LoginPeer(ctx context.Context, login types.PeerLogin) (*nbpeer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error)                    // used by peer gRPC API
+	ExtendPeerSession(ctx context.Context, peerPubKey, userID string) (time.Time, error)                                                          // used by peer gRPC API for ExtendAuthSession
+	SyncPeer(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) // used by peer gRPC API
 	GetExternalCacheManager() ExternalCacheManager
 	GetPostureChecks(ctx context.Context, accountID, postureChecksID, userID string) (*posture.Checks, error)
 	SavePostureChecks(ctx context.Context, accountID, userID string, postureChecks *posture.Checks, create bool) (*posture.Checks, error)
@@ -121,7 +124,7 @@ type Manager interface {
 	UpdateIntegratedValidator(ctx context.Context, accountID, userID, validator string, groups []string) error
 	GroupValidation(ctx context.Context, accountId string, groups []string) (bool, error)
 	GetValidatedPeers(ctx context.Context, accountID string) (map[string]struct{}, map[string]string, error)
-	SyncAndMarkPeer(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error)
+	SyncAndMarkPeer(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*nbpeer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error)
 	OnPeerDisconnected(ctx context.Context, accountID string, peerPubKey string, streamStartTime time.Time) error
 	SyncPeerMeta(ctx context.Context, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP) error
 	FindExistingPostureCheck(accountID string, checks *posture.ChecksDefinition) (*posture.Checks, error)
diff --git a/management/server/account/manager_mock.go b/management/server/account/manager_mock.go
index 274e4c683..b3868f2e2 100644
--- a/management/server/account/manager_mock.go
+++ b/management/server/account/manager_mock.go
@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: ./manager.go
+//
+// Generated by this command:
+//
+//	mockgen -package account -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
+//
 
 // Package account is a generated GoMock package.
 package account
@@ -11,7 +16,6 @@ import (
 	reflect "reflect"
 	time "time"
 
-	gomock "github.com/golang/mock/gomock"
 	dns "github.com/netbirdio/netbird/dns"
 	service "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	activity "github.com/netbirdio/netbird/management/server/activity"
@@ -25,12 +29,15 @@ import (
 	route "github.com/netbirdio/netbird/route"
 	auth "github.com/netbirdio/netbird/shared/auth"
 	domain "github.com/netbirdio/netbird/shared/management/domain"
+	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockManager is a mock of Manager interface.
 type MockManager struct {
 	ctrl     *gomock.Controller
 	recorder *MockManagerMockRecorder
+	isgomock struct{}
 }
 
 // MockManagerMockRecorder is the mock recorder for MockManager.
@@ -59,7 +66,7 @@ func (m *MockManager) AcceptUserInvite(ctx context.Context, token, password stri
 }
 
 // AcceptUserInvite indicates an expected call of AcceptUserInvite.
-func (mr *MockManagerMockRecorder) AcceptUserInvite(ctx, token, password interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) AcceptUserInvite(ctx, token, password any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AcceptUserInvite", reflect.TypeOf((*MockManager)(nil).AcceptUserInvite), ctx, token, password)
 }
@@ -74,25 +81,25 @@ func (m *MockManager) AccountExists(ctx context.Context, accountID string) (bool
 }
 
 // AccountExists indicates an expected call of AccountExists.
-func (mr *MockManagerMockRecorder) AccountExists(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) AccountExists(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AccountExists", reflect.TypeOf((*MockManager)(nil).AccountExists), ctx, accountID)
 }
 
 // AddPeer mocks base method.
-func (m *MockManager) AddPeer(ctx context.Context, accountID, setupKey, userID string, p *peer.Peer, temporary bool) (*peer.Peer, *types.Network, []*posture.Checks, bool, error) {
+func (m *MockManager) AddPeer(ctx context.Context, accountID, setupKey, userID string, p *peer.Peer, temporary bool) (*peer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "AddPeer", ctx, accountID, setupKey, userID, p, temporary)
 	ret0, _ := ret[0].(*peer.Peer)
 	ret1, _ := ret[1].(*types.Network)
-	ret2, _ := ret[2].([]*posture.Checks)
+	ret2, _ := ret[2].([]*nmdata.PostureChecks)
 	ret3, _ := ret[3].(bool)
 	ret4, _ := ret[4].(error)
 	return ret0, ret1, ret2, ret3, ret4
 }
 
 // AddPeer indicates an expected call of AddPeer.
-func (mr *MockManagerMockRecorder) AddPeer(ctx, accountID, setupKey, userID, p, temporary interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) AddPeer(ctx, accountID, setupKey, userID, p, temporary any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddPeer", reflect.TypeOf((*MockManager)(nil).AddPeer), ctx, accountID, setupKey, userID, p, temporary)
 }
@@ -107,7 +114,7 @@ func (m *MockManager) ApproveUser(ctx context.Context, accountID, initiatorUserI
 }
 
 // ApproveUser indicates an expected call of ApproveUser.
-func (mr *MockManagerMockRecorder) ApproveUser(ctx, accountID, initiatorUserID, targetUserID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ApproveUser(ctx, accountID, initiatorUserID, targetUserID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ApproveUser", reflect.TypeOf((*MockManager)(nil).ApproveUser), ctx, accountID, initiatorUserID, targetUserID)
 }
@@ -119,7 +126,7 @@ func (m *MockManager) BufferUpdateAccountPeers(ctx context.Context, accountID st
 }
 
 // BufferUpdateAccountPeers indicates an expected call of BufferUpdateAccountPeers.
-func (mr *MockManagerMockRecorder) BufferUpdateAccountPeers(ctx, accountID, reason interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) BufferUpdateAccountPeers(ctx, accountID, reason any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BufferUpdateAccountPeers", reflect.TypeOf((*MockManager)(nil).BufferUpdateAccountPeers), ctx, accountID, reason)
 }
@@ -134,7 +141,7 @@ func (m *MockManager) BuildUserInfosForAccount(ctx context.Context, accountID, i
 }
 
 // BuildUserInfosForAccount indicates an expected call of BuildUserInfosForAccount.
-func (mr *MockManagerMockRecorder) BuildUserInfosForAccount(ctx, accountID, initiatorUserID, accountUsers interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) BuildUserInfosForAccount(ctx, accountID, initiatorUserID, accountUsers any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BuildUserInfosForAccount", reflect.TypeOf((*MockManager)(nil).BuildUserInfosForAccount), ctx, accountID, initiatorUserID, accountUsers)
 }
@@ -148,7 +155,7 @@ func (m *MockManager) CreateGroup(ctx context.Context, accountID, userID string,
 }
 
 // CreateGroup indicates an expected call of CreateGroup.
-func (mr *MockManagerMockRecorder) CreateGroup(ctx, accountID, userID, group interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateGroup(ctx, accountID, userID, group any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateGroup", reflect.TypeOf((*MockManager)(nil).CreateGroup), ctx, accountID, userID, group)
 }
@@ -162,24 +169,24 @@ func (m *MockManager) CreateGroups(ctx context.Context, accountID, userID string
 }
 
 // CreateGroups indicates an expected call of CreateGroups.
-func (mr *MockManagerMockRecorder) CreateGroups(ctx, accountID, userID, newGroups interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateGroups(ctx, accountID, userID, newGroups any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateGroups", reflect.TypeOf((*MockManager)(nil).CreateGroups), ctx, accountID, userID, newGroups)
 }
 
 // CreateIdentityProvider mocks base method.
-func (m *MockManager) CreateIdentityProvider(ctx context.Context, accountID, userID string, idp *types.IdentityProvider) (*types.IdentityProvider, error) {
+func (m *MockManager) CreateIdentityProvider(ctx context.Context, accountID, userID string, arg3 *types.IdentityProvider) (*types.IdentityProvider, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateIdentityProvider", ctx, accountID, userID, idp)
+	ret := m.ctrl.Call(m, "CreateIdentityProvider", ctx, accountID, userID, arg3)
 	ret0, _ := ret[0].(*types.IdentityProvider)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // CreateIdentityProvider indicates an expected call of CreateIdentityProvider.
-func (mr *MockManagerMockRecorder) CreateIdentityProvider(ctx, accountID, userID, idp interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateIdentityProvider(ctx, accountID, userID, arg3 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateIdentityProvider", reflect.TypeOf((*MockManager)(nil).CreateIdentityProvider), ctx, accountID, userID, idp)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateIdentityProvider", reflect.TypeOf((*MockManager)(nil).CreateIdentityProvider), ctx, accountID, userID, arg3)
 }
 
 // CreateNameServerGroup mocks base method.
@@ -192,7 +199,7 @@ func (m *MockManager) CreateNameServerGroup(ctx context.Context, accountID, name
 }
 
 // CreateNameServerGroup indicates an expected call of CreateNameServerGroup.
-func (mr *MockManagerMockRecorder) CreateNameServerGroup(ctx, accountID, name, description, nameServerList, groups, primary, domains, enabled, userID, searchDomainsEnabled interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateNameServerGroup(ctx, accountID, name, description, nameServerList, groups, primary, domains, enabled, userID, searchDomainsEnabled any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateNameServerGroup", reflect.TypeOf((*MockManager)(nil).CreateNameServerGroup), ctx, accountID, name, description, nameServerList, groups, primary, domains, enabled, userID, searchDomainsEnabled)
 }
@@ -207,7 +214,7 @@ func (m *MockManager) CreatePAT(ctx context.Context, accountID, initiatorUserID,
 }
 
 // CreatePAT indicates an expected call of CreatePAT.
-func (mr *MockManagerMockRecorder) CreatePAT(ctx, accountID, initiatorUserID, targetUserID, tokenName, expiresIn interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreatePAT(ctx, accountID, initiatorUserID, targetUserID, tokenName, expiresIn any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreatePAT", reflect.TypeOf((*MockManager)(nil).CreatePAT), ctx, accountID, initiatorUserID, targetUserID, tokenName, expiresIn)
 }
@@ -221,7 +228,7 @@ func (m *MockManager) CreatePeerJob(ctx context.Context, accountID, peerID, user
 }
 
 // CreatePeerJob indicates an expected call of CreatePeerJob.
-func (mr *MockManagerMockRecorder) CreatePeerJob(ctx, accountID, peerID, userID, job interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreatePeerJob(ctx, accountID, peerID, userID, job any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreatePeerJob", reflect.TypeOf((*MockManager)(nil).CreatePeerJob), ctx, accountID, peerID, userID, job)
 }
@@ -236,7 +243,7 @@ func (m *MockManager) CreateRoute(ctx context.Context, accountID string, prefix
 }
 
 // CreateRoute indicates an expected call of CreateRoute.
-func (mr *MockManagerMockRecorder) CreateRoute(ctx, accountID, prefix, networkType, domains, peerID, peerGroupIDs, description, netID, masquerade, metric, groups, accessControlGroupIDs, enabled, userID, keepRoute, skipAutoApply interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateRoute(ctx, accountID, prefix, networkType, domains, peerID, peerGroupIDs, description, netID, masquerade, metric, groups, accessControlGroupIDs, enabled, userID, keepRoute, skipAutoApply any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateRoute", reflect.TypeOf((*MockManager)(nil).CreateRoute), ctx, accountID, prefix, networkType, domains, peerID, peerGroupIDs, description, netID, masquerade, metric, groups, accessControlGroupIDs, enabled, userID, keepRoute, skipAutoApply)
 }
@@ -251,7 +258,7 @@ func (m *MockManager) CreateSetupKey(ctx context.Context, accountID, keyName str
 }
 
 // CreateSetupKey indicates an expected call of CreateSetupKey.
-func (mr *MockManagerMockRecorder) CreateSetupKey(ctx, accountID, keyName, keyType, expiresIn, autoGroups, usageLimit, userID, ephemeral, allowExtraDNSLabels interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateSetupKey(ctx, accountID, keyName, keyType, expiresIn, autoGroups, usageLimit, userID, ephemeral, allowExtraDNSLabels any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateSetupKey", reflect.TypeOf((*MockManager)(nil).CreateSetupKey), ctx, accountID, keyName, keyType, expiresIn, autoGroups, usageLimit, userID, ephemeral, allowExtraDNSLabels)
 }
@@ -266,7 +273,7 @@ func (m *MockManager) CreateUser(ctx context.Context, accountID, initiatorUserID
 }
 
 // CreateUser indicates an expected call of CreateUser.
-func (mr *MockManagerMockRecorder) CreateUser(ctx, accountID, initiatorUserID, key interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateUser(ctx, accountID, initiatorUserID, key any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateUser", reflect.TypeOf((*MockManager)(nil).CreateUser), ctx, accountID, initiatorUserID, key)
 }
@@ -281,7 +288,7 @@ func (m *MockManager) CreateUserInvite(ctx context.Context, accountID, initiator
 }
 
 // CreateUserInvite indicates an expected call of CreateUserInvite.
-func (mr *MockManagerMockRecorder) CreateUserInvite(ctx, accountID, initiatorUserID, invite, expiresIn interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) CreateUserInvite(ctx, accountID, initiatorUserID, invite, expiresIn any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateUserInvite", reflect.TypeOf((*MockManager)(nil).CreateUserInvite), ctx, accountID, initiatorUserID, invite, expiresIn)
 }
@@ -295,7 +302,7 @@ func (m *MockManager) DeleteAccount(ctx context.Context, accountID, userID strin
 }
 
 // DeleteAccount indicates an expected call of DeleteAccount.
-func (mr *MockManagerMockRecorder) DeleteAccount(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteAccount(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccount", reflect.TypeOf((*MockManager)(nil).DeleteAccount), ctx, accountID, userID)
 }
@@ -309,7 +316,7 @@ func (m *MockManager) DeleteGroup(ctx context.Context, accountId, userId, groupI
 }
 
 // DeleteGroup indicates an expected call of DeleteGroup.
-func (mr *MockManagerMockRecorder) DeleteGroup(ctx, accountId, userId, groupID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteGroup(ctx, accountId, userId, groupID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteGroup", reflect.TypeOf((*MockManager)(nil).DeleteGroup), ctx, accountId, userId, groupID)
 }
@@ -323,7 +330,7 @@ func (m *MockManager) DeleteGroups(ctx context.Context, accountId, userId string
 }
 
 // DeleteGroups indicates an expected call of DeleteGroups.
-func (mr *MockManagerMockRecorder) DeleteGroups(ctx, accountId, userId, groupIDs interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteGroups(ctx, accountId, userId, groupIDs any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteGroups", reflect.TypeOf((*MockManager)(nil).DeleteGroups), ctx, accountId, userId, groupIDs)
 }
@@ -337,7 +344,7 @@ func (m *MockManager) DeleteIdentityProvider(ctx context.Context, accountID, idp
 }
 
 // DeleteIdentityProvider indicates an expected call of DeleteIdentityProvider.
-func (mr *MockManagerMockRecorder) DeleteIdentityProvider(ctx, accountID, idpID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteIdentityProvider(ctx, accountID, idpID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteIdentityProvider", reflect.TypeOf((*MockManager)(nil).DeleteIdentityProvider), ctx, accountID, idpID, userID)
 }
@@ -351,7 +358,7 @@ func (m *MockManager) DeleteNameServerGroup(ctx context.Context, accountID, nsGr
 }
 
 // DeleteNameServerGroup indicates an expected call of DeleteNameServerGroup.
-func (mr *MockManagerMockRecorder) DeleteNameServerGroup(ctx, accountID, nsGroupID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteNameServerGroup(ctx, accountID, nsGroupID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteNameServerGroup", reflect.TypeOf((*MockManager)(nil).DeleteNameServerGroup), ctx, accountID, nsGroupID, userID)
 }
@@ -365,7 +372,7 @@ func (m *MockManager) DeletePAT(ctx context.Context, accountID, initiatorUserID,
 }
 
 // DeletePAT indicates an expected call of DeletePAT.
-func (mr *MockManagerMockRecorder) DeletePAT(ctx, accountID, initiatorUserID, targetUserID, tokenID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeletePAT(ctx, accountID, initiatorUserID, targetUserID, tokenID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePAT", reflect.TypeOf((*MockManager)(nil).DeletePAT), ctx, accountID, initiatorUserID, targetUserID, tokenID)
 }
@@ -379,7 +386,7 @@ func (m *MockManager) DeletePeer(ctx context.Context, accountID, peerID, userID
 }
 
 // DeletePeer indicates an expected call of DeletePeer.
-func (mr *MockManagerMockRecorder) DeletePeer(ctx, accountID, peerID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeletePeer(ctx, accountID, peerID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePeer", reflect.TypeOf((*MockManager)(nil).DeletePeer), ctx, accountID, peerID, userID)
 }
@@ -393,7 +400,7 @@ func (m *MockManager) DeletePolicy(ctx context.Context, accountID, policyID, use
 }
 
 // DeletePolicy indicates an expected call of DeletePolicy.
-func (mr *MockManagerMockRecorder) DeletePolicy(ctx, accountID, policyID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeletePolicy(ctx, accountID, policyID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePolicy", reflect.TypeOf((*MockManager)(nil).DeletePolicy), ctx, accountID, policyID, userID)
 }
@@ -407,7 +414,7 @@ func (m *MockManager) DeletePostureChecks(ctx context.Context, accountID, postur
 }
 
 // DeletePostureChecks indicates an expected call of DeletePostureChecks.
-func (mr *MockManagerMockRecorder) DeletePostureChecks(ctx, accountID, postureChecksID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeletePostureChecks(ctx, accountID, postureChecksID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePostureChecks", reflect.TypeOf((*MockManager)(nil).DeletePostureChecks), ctx, accountID, postureChecksID, userID)
 }
@@ -421,7 +428,7 @@ func (m *MockManager) DeleteRegularUsers(ctx context.Context, accountID, initiat
 }
 
 // DeleteRegularUsers indicates an expected call of DeleteRegularUsers.
-func (mr *MockManagerMockRecorder) DeleteRegularUsers(ctx, accountID, initiatorUserID, targetUserIDs, userInfos interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteRegularUsers(ctx, accountID, initiatorUserID, targetUserIDs, userInfos any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteRegularUsers", reflect.TypeOf((*MockManager)(nil).DeleteRegularUsers), ctx, accountID, initiatorUserID, targetUserIDs, userInfos)
 }
@@ -435,7 +442,7 @@ func (m *MockManager) DeleteRoute(ctx context.Context, accountID string, routeID
 }
 
 // DeleteRoute indicates an expected call of DeleteRoute.
-func (mr *MockManagerMockRecorder) DeleteRoute(ctx, accountID, routeID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteRoute(ctx, accountID, routeID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteRoute", reflect.TypeOf((*MockManager)(nil).DeleteRoute), ctx, accountID, routeID, userID)
 }
@@ -449,7 +456,7 @@ func (m *MockManager) DeleteSetupKey(ctx context.Context, accountID, userID, key
 }
 
 // DeleteSetupKey indicates an expected call of DeleteSetupKey.
-func (mr *MockManagerMockRecorder) DeleteSetupKey(ctx, accountID, userID, keyID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteSetupKey(ctx, accountID, userID, keyID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteSetupKey", reflect.TypeOf((*MockManager)(nil).DeleteSetupKey), ctx, accountID, userID, keyID)
 }
@@ -463,7 +470,7 @@ func (m *MockManager) DeleteUser(ctx context.Context, accountID, initiatorUserID
 }
 
 // DeleteUser indicates an expected call of DeleteUser.
-func (mr *MockManagerMockRecorder) DeleteUser(ctx, accountID, initiatorUserID, targetUserID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteUser(ctx, accountID, initiatorUserID, targetUserID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteUser", reflect.TypeOf((*MockManager)(nil).DeleteUser), ctx, accountID, initiatorUserID, targetUserID)
 }
@@ -477,11 +484,38 @@ func (m *MockManager) DeleteUserInvite(ctx context.Context, accountID, initiator
 }
 
 // DeleteUserInvite indicates an expected call of DeleteUserInvite.
-func (mr *MockManagerMockRecorder) DeleteUserInvite(ctx, accountID, initiatorUserID, inviteID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) DeleteUserInvite(ctx, accountID, initiatorUserID, inviteID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteUserInvite", reflect.TypeOf((*MockManager)(nil).DeleteUserInvite), ctx, accountID, initiatorUserID, inviteID)
 }
 
+// ExpandAndUpdateAffected mocks base method.
+func (m *MockManager) ExpandAndUpdateAffected(ctx context.Context, accountID string, snap *affectedpeers.Snapshot, change affectedpeers.Change) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "ExpandAndUpdateAffected", ctx, accountID, snap, change)
+}
+
+// ExpandAndUpdateAffected indicates an expected call of ExpandAndUpdateAffected.
+func (mr *MockManagerMockRecorder) ExpandAndUpdateAffected(ctx, accountID, snap, change any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ExpandAndUpdateAffected", reflect.TypeOf((*MockManager)(nil).ExpandAndUpdateAffected), ctx, accountID, snap, change)
+}
+
+// ExtendPeerSession mocks base method.
+func (m *MockManager) ExtendPeerSession(ctx context.Context, peerPubKey, userID string) (time.Time, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ExtendPeerSession", ctx, peerPubKey, userID)
+	ret0, _ := ret[0].(time.Time)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ExtendPeerSession indicates an expected call of ExtendPeerSession.
+func (mr *MockManagerMockRecorder) ExtendPeerSession(ctx, peerPubKey, userID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ExtendPeerSession", reflect.TypeOf((*MockManager)(nil).ExtendPeerSession), ctx, peerPubKey, userID)
+}
+
 // FindExistingPostureCheck mocks base method.
 func (m *MockManager) FindExistingPostureCheck(accountID string, checks *posture.ChecksDefinition) (*posture.Checks, error) {
 	m.ctrl.T.Helper()
@@ -492,7 +526,7 @@ func (m *MockManager) FindExistingPostureCheck(accountID string, checks *posture
 }
 
 // FindExistingPostureCheck indicates an expected call of FindExistingPostureCheck.
-func (mr *MockManagerMockRecorder) FindExistingPostureCheck(accountID, checks interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) FindExistingPostureCheck(accountID, checks any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FindExistingPostureCheck", reflect.TypeOf((*MockManager)(nil).FindExistingPostureCheck), accountID, checks)
 }
@@ -507,7 +541,7 @@ func (m *MockManager) GetAccount(ctx context.Context, accountID string) (*types.
 }
 
 // GetAccount indicates an expected call of GetAccount.
-func (mr *MockManagerMockRecorder) GetAccount(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAccount(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccount", reflect.TypeOf((*MockManager)(nil).GetAccount), ctx, accountID)
 }
@@ -522,7 +556,7 @@ func (m *MockManager) GetAccountByID(ctx context.Context, accountID, userID stri
 }
 
 // GetAccountByID indicates an expected call of GetAccountByID.
-func (mr *MockManagerMockRecorder) GetAccountByID(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAccountByID(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountByID", reflect.TypeOf((*MockManager)(nil).GetAccountByID), ctx, accountID, userID)
 }
@@ -537,7 +571,7 @@ func (m *MockManager) GetAccountIDByUserID(ctx context.Context, userAuth auth.Us
 }
 
 // GetAccountIDByUserID indicates an expected call of GetAccountIDByUserID.
-func (mr *MockManagerMockRecorder) GetAccountIDByUserID(ctx, userAuth interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAccountIDByUserID(ctx, userAuth any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountIDByUserID", reflect.TypeOf((*MockManager)(nil).GetAccountIDByUserID), ctx, userAuth)
 }
@@ -552,7 +586,7 @@ func (m *MockManager) GetAccountIDForPeerKey(ctx context.Context, peerKey string
 }
 
 // GetAccountIDForPeerKey indicates an expected call of GetAccountIDForPeerKey.
-func (mr *MockManagerMockRecorder) GetAccountIDForPeerKey(ctx, peerKey interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAccountIDForPeerKey(ctx, peerKey any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountIDForPeerKey", reflect.TypeOf((*MockManager)(nil).GetAccountIDForPeerKey), ctx, peerKey)
 }
@@ -568,7 +602,7 @@ func (m *MockManager) GetAccountIDFromUserAuth(ctx context.Context, userAuth aut
 }
 
 // GetAccountIDFromUserAuth indicates an expected call of GetAccountIDFromUserAuth.
-func (mr *MockManagerMockRecorder) GetAccountIDFromUserAuth(ctx, userAuth interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAccountIDFromUserAuth(ctx, userAuth any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountIDFromUserAuth", reflect.TypeOf((*MockManager)(nil).GetAccountIDFromUserAuth), ctx, userAuth)
 }
@@ -583,7 +617,7 @@ func (m *MockManager) GetAccountMeta(ctx context.Context, accountID, userID stri
 }
 
 // GetAccountMeta indicates an expected call of GetAccountMeta.
-func (mr *MockManagerMockRecorder) GetAccountMeta(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAccountMeta(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountMeta", reflect.TypeOf((*MockManager)(nil).GetAccountMeta), ctx, accountID, userID)
 }
@@ -598,7 +632,7 @@ func (m *MockManager) GetAccountOnboarding(ctx context.Context, accountID, userI
 }
 
 // GetAccountOnboarding indicates an expected call of GetAccountOnboarding.
-func (mr *MockManagerMockRecorder) GetAccountOnboarding(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAccountOnboarding(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountOnboarding", reflect.TypeOf((*MockManager)(nil).GetAccountOnboarding), ctx, accountID, userID)
 }
@@ -613,7 +647,7 @@ func (m *MockManager) GetAccountSettings(ctx context.Context, accountID, userID
 }
 
 // GetAccountSettings indicates an expected call of GetAccountSettings.
-func (mr *MockManagerMockRecorder) GetAccountSettings(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAccountSettings(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountSettings", reflect.TypeOf((*MockManager)(nil).GetAccountSettings), ctx, accountID, userID)
 }
@@ -628,7 +662,7 @@ func (m *MockManager) GetAllGroups(ctx context.Context, accountID, userID string
 }
 
 // GetAllGroups indicates an expected call of GetAllGroups.
-func (mr *MockManagerMockRecorder) GetAllGroups(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAllGroups(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllGroups", reflect.TypeOf((*MockManager)(nil).GetAllGroups), ctx, accountID, userID)
 }
@@ -643,7 +677,7 @@ func (m *MockManager) GetAllPATs(ctx context.Context, accountID, initiatorUserID
 }
 
 // GetAllPATs indicates an expected call of GetAllPATs.
-func (mr *MockManagerMockRecorder) GetAllPATs(ctx, accountID, initiatorUserID, targetUserID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAllPATs(ctx, accountID, initiatorUserID, targetUserID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllPATs", reflect.TypeOf((*MockManager)(nil).GetAllPATs), ctx, accountID, initiatorUserID, targetUserID)
 }
@@ -658,7 +692,7 @@ func (m *MockManager) GetAllPeerJobs(ctx context.Context, accountID, userID, pee
 }
 
 // GetAllPeerJobs indicates an expected call of GetAllPeerJobs.
-func (mr *MockManagerMockRecorder) GetAllPeerJobs(ctx, accountID, userID, peerID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetAllPeerJobs(ctx, accountID, userID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllPeerJobs", reflect.TypeOf((*MockManager)(nil).GetAllPeerJobs), ctx, accountID, userID, peerID)
 }
@@ -673,7 +707,7 @@ func (m *MockManager) GetCurrentUserInfo(ctx context.Context, userAuth auth.User
 }
 
 // GetCurrentUserInfo indicates an expected call of GetCurrentUserInfo.
-func (mr *MockManagerMockRecorder) GetCurrentUserInfo(ctx, userAuth interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetCurrentUserInfo(ctx, userAuth any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCurrentUserInfo", reflect.TypeOf((*MockManager)(nil).GetCurrentUserInfo), ctx, userAuth)
 }
@@ -688,7 +722,7 @@ func (m *MockManager) GetDNSSettings(ctx context.Context, accountID, userID stri
 }
 
 // GetDNSSettings indicates an expected call of GetDNSSettings.
-func (mr *MockManagerMockRecorder) GetDNSSettings(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetDNSSettings(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetDNSSettings", reflect.TypeOf((*MockManager)(nil).GetDNSSettings), ctx, accountID, userID)
 }
@@ -703,7 +737,7 @@ func (m *MockManager) GetEvents(ctx context.Context, accountID, userID string) (
 }
 
 // GetEvents indicates an expected call of GetEvents.
-func (mr *MockManagerMockRecorder) GetEvents(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetEvents(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetEvents", reflect.TypeOf((*MockManager)(nil).GetEvents), ctx, accountID, userID)
 }
@@ -732,7 +766,7 @@ func (m *MockManager) GetGroup(ctx context.Context, accountId, groupID, userID s
 }
 
 // GetGroup indicates an expected call of GetGroup.
-func (mr *MockManagerMockRecorder) GetGroup(ctx, accountId, groupID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetGroup(ctx, accountId, groupID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGroup", reflect.TypeOf((*MockManager)(nil).GetGroup), ctx, accountId, groupID, userID)
 }
@@ -747,7 +781,7 @@ func (m *MockManager) GetGroupByName(ctx context.Context, groupName, accountID,
 }
 
 // GetGroupByName indicates an expected call of GetGroupByName.
-func (mr *MockManagerMockRecorder) GetGroupByName(ctx, groupName, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetGroupByName(ctx, groupName, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGroupByName", reflect.TypeOf((*MockManager)(nil).GetGroupByName), ctx, groupName, accountID, userID)
 }
@@ -762,7 +796,7 @@ func (m *MockManager) GetIdentityProvider(ctx context.Context, accountID, idpID,
 }
 
 // GetIdentityProvider indicates an expected call of GetIdentityProvider.
-func (mr *MockManagerMockRecorder) GetIdentityProvider(ctx, accountID, idpID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetIdentityProvider(ctx, accountID, idpID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetIdentityProvider", reflect.TypeOf((*MockManager)(nil).GetIdentityProvider), ctx, accountID, idpID, userID)
 }
@@ -777,7 +811,7 @@ func (m *MockManager) GetIdentityProviders(ctx context.Context, accountID, userI
 }
 
 // GetIdentityProviders indicates an expected call of GetIdentityProviders.
-func (mr *MockManagerMockRecorder) GetIdentityProviders(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetIdentityProviders(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetIdentityProviders", reflect.TypeOf((*MockManager)(nil).GetIdentityProviders), ctx, accountID, userID)
 }
@@ -806,7 +840,7 @@ func (m *MockManager) GetNameServerGroup(ctx context.Context, accountID, userID,
 }
 
 // GetNameServerGroup indicates an expected call of GetNameServerGroup.
-func (mr *MockManagerMockRecorder) GetNameServerGroup(ctx, accountID, userID, nsGroupID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetNameServerGroup(ctx, accountID, userID, nsGroupID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNameServerGroup", reflect.TypeOf((*MockManager)(nil).GetNameServerGroup), ctx, accountID, userID, nsGroupID)
 }
@@ -821,15 +855,15 @@ func (m *MockManager) GetNetworkMap(ctx context.Context, peerID string) (*types.
 }
 
 // GetNetworkMap indicates an expected call of GetNetworkMap.
-func (mr *MockManagerMockRecorder) GetNetworkMap(ctx, peerID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetNetworkMap(ctx, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkMap", reflect.TypeOf((*MockManager)(nil).GetNetworkMap), ctx, peerID)
 }
 
 // GetOrCreateAccountByPrivateDomain mocks base method.
-func (m *MockManager) GetOrCreateAccountByPrivateDomain(ctx context.Context, initiatorId, domain string) (*types.Account, bool, error) {
+func (m *MockManager) GetOrCreateAccountByPrivateDomain(ctx context.Context, initiatorId, arg2 string) (*types.Account, bool, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetOrCreateAccountByPrivateDomain", ctx, initiatorId, domain)
+	ret := m.ctrl.Call(m, "GetOrCreateAccountByPrivateDomain", ctx, initiatorId, arg2)
 	ret0, _ := ret[0].(*types.Account)
 	ret1, _ := ret[1].(bool)
 	ret2, _ := ret[2].(error)
@@ -837,9 +871,9 @@ func (m *MockManager) GetOrCreateAccountByPrivateDomain(ctx context.Context, ini
 }
 
 // GetOrCreateAccountByPrivateDomain indicates an expected call of GetOrCreateAccountByPrivateDomain.
-func (mr *MockManagerMockRecorder) GetOrCreateAccountByPrivateDomain(ctx, initiatorId, domain interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetOrCreateAccountByPrivateDomain(ctx, initiatorId, arg2 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOrCreateAccountByPrivateDomain", reflect.TypeOf((*MockManager)(nil).GetOrCreateAccountByPrivateDomain), ctx, initiatorId, domain)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOrCreateAccountByPrivateDomain", reflect.TypeOf((*MockManager)(nil).GetOrCreateAccountByPrivateDomain), ctx, initiatorId, arg2)
 }
 
 // GetOrCreateAccountByUser mocks base method.
@@ -852,7 +886,7 @@ func (m *MockManager) GetOrCreateAccountByUser(ctx context.Context, userAuth aut
 }
 
 // GetOrCreateAccountByUser indicates an expected call of GetOrCreateAccountByUser.
-func (mr *MockManagerMockRecorder) GetOrCreateAccountByUser(ctx, userAuth interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetOrCreateAccountByUser(ctx, userAuth any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOrCreateAccountByUser", reflect.TypeOf((*MockManager)(nil).GetOrCreateAccountByUser), ctx, userAuth)
 }
@@ -867,7 +901,7 @@ func (m *MockManager) GetOwnerInfo(ctx context.Context, accountId string) (*type
 }
 
 // GetOwnerInfo indicates an expected call of GetOwnerInfo.
-func (mr *MockManagerMockRecorder) GetOwnerInfo(ctx, accountId interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetOwnerInfo(ctx, accountId any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOwnerInfo", reflect.TypeOf((*MockManager)(nil).GetOwnerInfo), ctx, accountId)
 }
@@ -882,7 +916,7 @@ func (m *MockManager) GetPAT(ctx context.Context, accountID, initiatorUserID, ta
 }
 
 // GetPAT indicates an expected call of GetPAT.
-func (mr *MockManagerMockRecorder) GetPAT(ctx, accountID, initiatorUserID, targetUserID, tokenID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPAT(ctx, accountID, initiatorUserID, targetUserID, tokenID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPAT", reflect.TypeOf((*MockManager)(nil).GetPAT), ctx, accountID, initiatorUserID, targetUserID, tokenID)
 }
@@ -897,7 +931,7 @@ func (m *MockManager) GetPeer(ctx context.Context, accountID, peerID, userID str
 }
 
 // GetPeer indicates an expected call of GetPeer.
-func (mr *MockManagerMockRecorder) GetPeer(ctx, accountID, peerID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeer(ctx, accountID, peerID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeer", reflect.TypeOf((*MockManager)(nil).GetPeer), ctx, accountID, peerID, userID)
 }
@@ -912,7 +946,7 @@ func (m *MockManager) GetPeerGroups(ctx context.Context, accountID, peerID strin
 }
 
 // GetPeerGroups indicates an expected call of GetPeerGroups.
-func (mr *MockManagerMockRecorder) GetPeerGroups(ctx, accountID, peerID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeerGroups(ctx, accountID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerGroups", reflect.TypeOf((*MockManager)(nil).GetPeerGroups), ctx, accountID, peerID)
 }
@@ -927,7 +961,7 @@ func (m *MockManager) GetPeerJobByID(ctx context.Context, accountID, userID, pee
 }
 
 // GetPeerJobByID indicates an expected call of GetPeerJobByID.
-func (mr *MockManagerMockRecorder) GetPeerJobByID(ctx, accountID, userID, peerID, jobID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeerJobByID(ctx, accountID, userID, peerID, jobID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerJobByID", reflect.TypeOf((*MockManager)(nil).GetPeerJobByID), ctx, accountID, userID, peerID, jobID)
 }
@@ -942,24 +976,24 @@ func (m *MockManager) GetPeerNetwork(ctx context.Context, peerID string) (*types
 }
 
 // GetPeerNetwork indicates an expected call of GetPeerNetwork.
-func (mr *MockManagerMockRecorder) GetPeerNetwork(ctx, peerID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeerNetwork(ctx, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerNetwork", reflect.TypeOf((*MockManager)(nil).GetPeerNetwork), ctx, peerID)
 }
 
 // GetPeers mocks base method.
-func (m *MockManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*peer.Peer, error) {
+func (m *MockManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*peer.Peer, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetPeers", ctx, accountID, userID, nameFilter, ipFilter)
+	ret := m.ctrl.Call(m, "GetPeers", ctx, accountID, userID, nameFilter, ipFilter, macFilter)
 	ret0, _ := ret[0].([]*peer.Peer)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPeers indicates an expected call of GetPeers.
-func (mr *MockManagerMockRecorder) GetPeers(ctx, accountID, userID, nameFilter, ipFilter interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeers(ctx, accountID, userID, nameFilter, ipFilter, macFilter any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeers", reflect.TypeOf((*MockManager)(nil).GetPeers), ctx, accountID, userID, nameFilter, ipFilter)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeers", reflect.TypeOf((*MockManager)(nil).GetPeers), ctx, accountID, userID, nameFilter, ipFilter, macFilter)
 }
 
 // GetPolicy mocks base method.
@@ -972,7 +1006,7 @@ func (m *MockManager) GetPolicy(ctx context.Context, accountID, policyID, userID
 }
 
 // GetPolicy indicates an expected call of GetPolicy.
-func (mr *MockManagerMockRecorder) GetPolicy(ctx, accountID, policyID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPolicy(ctx, accountID, policyID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPolicy", reflect.TypeOf((*MockManager)(nil).GetPolicy), ctx, accountID, policyID, userID)
 }
@@ -987,7 +1021,7 @@ func (m *MockManager) GetPostureChecks(ctx context.Context, accountID, postureCh
 }
 
 // GetPostureChecks indicates an expected call of GetPostureChecks.
-func (mr *MockManagerMockRecorder) GetPostureChecks(ctx, accountID, postureChecksID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPostureChecks(ctx, accountID, postureChecksID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPostureChecks", reflect.TypeOf((*MockManager)(nil).GetPostureChecks), ctx, accountID, postureChecksID, userID)
 }
@@ -1002,7 +1036,7 @@ func (m *MockManager) GetRoute(ctx context.Context, accountID string, routeID ro
 }
 
 // GetRoute indicates an expected call of GetRoute.
-func (mr *MockManagerMockRecorder) GetRoute(ctx, accountID, routeID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetRoute(ctx, accountID, routeID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRoute", reflect.TypeOf((*MockManager)(nil).GetRoute), ctx, accountID, routeID, userID)
 }
@@ -1017,7 +1051,7 @@ func (m *MockManager) GetSetupKey(ctx context.Context, accountID, userID, keyID
 }
 
 // GetSetupKey indicates an expected call of GetSetupKey.
-func (mr *MockManagerMockRecorder) GetSetupKey(ctx, accountID, userID, keyID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetSetupKey(ctx, accountID, userID, keyID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetSetupKey", reflect.TypeOf((*MockManager)(nil).GetSetupKey), ctx, accountID, userID, keyID)
 }
@@ -1046,7 +1080,7 @@ func (m *MockManager) GetUserByID(ctx context.Context, id string) (*types.User,
 }
 
 // GetUserByID indicates an expected call of GetUserByID.
-func (mr *MockManagerMockRecorder) GetUserByID(ctx, id interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetUserByID(ctx, id any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserByID", reflect.TypeOf((*MockManager)(nil).GetUserByID), ctx, id)
 }
@@ -1061,7 +1095,7 @@ func (m *MockManager) GetUserFromUserAuth(ctx context.Context, userAuth auth.Use
 }
 
 // GetUserFromUserAuth indicates an expected call of GetUserFromUserAuth.
-func (mr *MockManagerMockRecorder) GetUserFromUserAuth(ctx, userAuth interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetUserFromUserAuth(ctx, userAuth any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserFromUserAuth", reflect.TypeOf((*MockManager)(nil).GetUserFromUserAuth), ctx, userAuth)
 }
@@ -1076,7 +1110,7 @@ func (m *MockManager) GetUserIDByPeerKey(ctx context.Context, peerKey string) (s
 }
 
 // GetUserIDByPeerKey indicates an expected call of GetUserIDByPeerKey.
-func (mr *MockManagerMockRecorder) GetUserIDByPeerKey(ctx, peerKey interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetUserIDByPeerKey(ctx, peerKey any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserIDByPeerKey", reflect.TypeOf((*MockManager)(nil).GetUserIDByPeerKey), ctx, peerKey)
 }
@@ -1091,7 +1125,7 @@ func (m *MockManager) GetUserInviteInfo(ctx context.Context, token string) (*typ
 }
 
 // GetUserInviteInfo indicates an expected call of GetUserInviteInfo.
-func (mr *MockManagerMockRecorder) GetUserInviteInfo(ctx, token interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetUserInviteInfo(ctx, token any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserInviteInfo", reflect.TypeOf((*MockManager)(nil).GetUserInviteInfo), ctx, token)
 }
@@ -1106,7 +1140,7 @@ func (m *MockManager) GetUsersFromAccount(ctx context.Context, accountID, userID
 }
 
 // GetUsersFromAccount indicates an expected call of GetUsersFromAccount.
-func (mr *MockManagerMockRecorder) GetUsersFromAccount(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetUsersFromAccount(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUsersFromAccount", reflect.TypeOf((*MockManager)(nil).GetUsersFromAccount), ctx, accountID, userID)
 }
@@ -1122,7 +1156,7 @@ func (m *MockManager) GetValidatedPeers(ctx context.Context, accountID string) (
 }
 
 // GetValidatedPeers indicates an expected call of GetValidatedPeers.
-func (mr *MockManagerMockRecorder) GetValidatedPeers(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetValidatedPeers(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetValidatedPeers", reflect.TypeOf((*MockManager)(nil).GetValidatedPeers), ctx, accountID)
 }
@@ -1136,7 +1170,7 @@ func (m *MockManager) GroupAddPeer(ctx context.Context, accountId, groupID, peer
 }
 
 // GroupAddPeer indicates an expected call of GroupAddPeer.
-func (mr *MockManagerMockRecorder) GroupAddPeer(ctx, accountId, groupID, peerID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GroupAddPeer(ctx, accountId, groupID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GroupAddPeer", reflect.TypeOf((*MockManager)(nil).GroupAddPeer), ctx, accountId, groupID, peerID)
 }
@@ -1150,7 +1184,7 @@ func (m *MockManager) GroupDeletePeer(ctx context.Context, accountId, groupID, p
 }
 
 // GroupDeletePeer indicates an expected call of GroupDeletePeer.
-func (mr *MockManagerMockRecorder) GroupDeletePeer(ctx, accountId, groupID, peerID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GroupDeletePeer(ctx, accountId, groupID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GroupDeletePeer", reflect.TypeOf((*MockManager)(nil).GroupDeletePeer), ctx, accountId, groupID, peerID)
 }
@@ -1165,7 +1199,7 @@ func (m *MockManager) GroupValidation(ctx context.Context, accountId string, gro
 }
 
 // GroupValidation indicates an expected call of GroupValidation.
-func (mr *MockManagerMockRecorder) GroupValidation(ctx, accountId, groups interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GroupValidation(ctx, accountId, groups any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GroupValidation", reflect.TypeOf((*MockManager)(nil).GroupValidation), ctx, accountId, groups)
 }
@@ -1179,7 +1213,7 @@ func (m *MockManager) InviteUser(ctx context.Context, accountID, initiatorUserID
 }
 
 // InviteUser indicates an expected call of InviteUser.
-func (mr *MockManagerMockRecorder) InviteUser(ctx, accountID, initiatorUserID, targetUserID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) InviteUser(ctx, accountID, initiatorUserID, targetUserID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InviteUser", reflect.TypeOf((*MockManager)(nil).InviteUser), ctx, accountID, initiatorUserID, targetUserID)
 }
@@ -1194,7 +1228,7 @@ func (m *MockManager) ListNameServerGroups(ctx context.Context, accountID, userI
 }
 
 // ListNameServerGroups indicates an expected call of ListNameServerGroups.
-func (mr *MockManagerMockRecorder) ListNameServerGroups(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ListNameServerGroups(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListNameServerGroups", reflect.TypeOf((*MockManager)(nil).ListNameServerGroups), ctx, accountID, userID)
 }
@@ -1209,7 +1243,7 @@ func (m *MockManager) ListPolicies(ctx context.Context, accountID, userID string
 }
 
 // ListPolicies indicates an expected call of ListPolicies.
-func (mr *MockManagerMockRecorder) ListPolicies(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ListPolicies(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListPolicies", reflect.TypeOf((*MockManager)(nil).ListPolicies), ctx, accountID, userID)
 }
@@ -1224,7 +1258,7 @@ func (m *MockManager) ListPostureChecks(ctx context.Context, accountID, userID s
 }
 
 // ListPostureChecks indicates an expected call of ListPostureChecks.
-func (mr *MockManagerMockRecorder) ListPostureChecks(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ListPostureChecks(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListPostureChecks", reflect.TypeOf((*MockManager)(nil).ListPostureChecks), ctx, accountID, userID)
 }
@@ -1239,7 +1273,7 @@ func (m *MockManager) ListRoutes(ctx context.Context, accountID, userID string)
 }
 
 // ListRoutes indicates an expected call of ListRoutes.
-func (mr *MockManagerMockRecorder) ListRoutes(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ListRoutes(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListRoutes", reflect.TypeOf((*MockManager)(nil).ListRoutes), ctx, accountID, userID)
 }
@@ -1254,7 +1288,7 @@ func (m *MockManager) ListSetupKeys(ctx context.Context, accountID, userID strin
 }
 
 // ListSetupKeys indicates an expected call of ListSetupKeys.
-func (mr *MockManagerMockRecorder) ListSetupKeys(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ListSetupKeys(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListSetupKeys", reflect.TypeOf((*MockManager)(nil).ListSetupKeys), ctx, accountID, userID)
 }
@@ -1269,7 +1303,7 @@ func (m *MockManager) ListUserInvites(ctx context.Context, accountID, initiatorU
 }
 
 // ListUserInvites indicates an expected call of ListUserInvites.
-func (mr *MockManagerMockRecorder) ListUserInvites(ctx, accountID, initiatorUserID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ListUserInvites(ctx, accountID, initiatorUserID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListUserInvites", reflect.TypeOf((*MockManager)(nil).ListUserInvites), ctx, accountID, initiatorUserID)
 }
@@ -1284,46 +1318,31 @@ func (m *MockManager) ListUsers(ctx context.Context, accountID string) ([]*types
 }
 
 // ListUsers indicates an expected call of ListUsers.
-func (mr *MockManagerMockRecorder) ListUsers(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ListUsers(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListUsers", reflect.TypeOf((*MockManager)(nil).ListUsers), ctx, accountID)
 }
 
 // LoginPeer mocks base method.
-func (m *MockManager) LoginPeer(ctx context.Context, login types.PeerLogin) (*peer.Peer, *types.Network, []*posture.Checks, bool, error) {
+func (m *MockManager) LoginPeer(ctx context.Context, login types.PeerLogin) (*peer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "LoginPeer", ctx, login)
 	ret0, _ := ret[0].(*peer.Peer)
 	ret1, _ := ret[1].(*types.Network)
-	ret2, _ := ret[2].([]*posture.Checks)
+	ret2, _ := ret[2].([]*nmdata.PostureChecks)
 	ret3, _ := ret[3].(bool)
 	ret4, _ := ret[4].(error)
 	return ret0, ret1, ret2, ret3, ret4
 }
 
 // LoginPeer indicates an expected call of LoginPeer.
-func (mr *MockManagerMockRecorder) LoginPeer(ctx, login interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) LoginPeer(ctx, login any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LoginPeer", reflect.TypeOf((*MockManager)(nil).LoginPeer), ctx, login)
 }
 
-// ExtendPeerSession mocks base method.
-func (m *MockManager) ExtendPeerSession(ctx context.Context, peerPubKey, userID string) (time.Time, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ExtendPeerSession", ctx, peerPubKey, userID)
-	ret0, _ := ret[0].(time.Time)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// ExtendPeerSession indicates an expected call of ExtendPeerSession.
-func (mr *MockManagerMockRecorder) ExtendPeerSession(ctx, peerPubKey, userID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ExtendPeerSession", reflect.TypeOf((*MockManager)(nil).ExtendPeerSession), ctx, peerPubKey, userID)
-}
-
 // MarkPeerConnected mocks base method.
-func (m *MockManager) MarkPeerConnected(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64, nmap *types.NetworkMap) error {
+func (m *MockManager) MarkPeerConnected(ctx context.Context, peerKey, accountID string, sessionStartedAt int64, nmap *types.NetworkMap) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "MarkPeerConnected", ctx, peerKey, accountID, sessionStartedAt, nmap)
 	ret0, _ := ret[0].(error)
@@ -1331,13 +1350,13 @@ func (m *MockManager) MarkPeerConnected(ctx context.Context, peerKey string, acc
 }
 
 // MarkPeerConnected indicates an expected call of MarkPeerConnected.
-func (mr *MockManagerMockRecorder) MarkPeerConnected(ctx, peerKey, accountID, sessionStartedAt, nmap interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) MarkPeerConnected(ctx, peerKey, accountID, sessionStartedAt, nmap any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkPeerConnected", reflect.TypeOf((*MockManager)(nil).MarkPeerConnected), ctx, peerKey, accountID, sessionStartedAt, nmap)
 }
 
 // MarkPeerDisconnected mocks base method.
-func (m *MockManager) MarkPeerDisconnected(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64) error {
+func (m *MockManager) MarkPeerDisconnected(ctx context.Context, peerKey, accountID string, sessionStartedAt int64) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "MarkPeerDisconnected", ctx, peerKey, accountID, sessionStartedAt)
 	ret0, _ := ret[0].(error)
@@ -1345,7 +1364,7 @@ func (m *MockManager) MarkPeerDisconnected(ctx context.Context, peerKey string,
 }
 
 // MarkPeerDisconnected indicates an expected call of MarkPeerDisconnected.
-func (mr *MockManagerMockRecorder) MarkPeerDisconnected(ctx, peerKey, accountID, sessionStartedAt interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) MarkPeerDisconnected(ctx, peerKey, accountID, sessionStartedAt any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkPeerDisconnected", reflect.TypeOf((*MockManager)(nil).MarkPeerDisconnected), ctx, peerKey, accountID, sessionStartedAt)
 }
@@ -1359,7 +1378,7 @@ func (m *MockManager) OnPeerDisconnected(ctx context.Context, accountID, peerPub
 }
 
 // OnPeerDisconnected indicates an expected call of OnPeerDisconnected.
-func (mr *MockManagerMockRecorder) OnPeerDisconnected(ctx, accountID, peerPubKey, streamStartTime interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) OnPeerDisconnected(ctx, accountID, peerPubKey, streamStartTime any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnPeerDisconnected", reflect.TypeOf((*MockManager)(nil).OnPeerDisconnected), ctx, accountID, peerPubKey, streamStartTime)
 }
@@ -1374,7 +1393,7 @@ func (m *MockManager) RegenerateUserInvite(ctx context.Context, accountID, initi
 }
 
 // RegenerateUserInvite indicates an expected call of RegenerateUserInvite.
-func (mr *MockManagerMockRecorder) RegenerateUserInvite(ctx, accountID, initiatorUserID, inviteID, expiresIn interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) RegenerateUserInvite(ctx, accountID, initiatorUserID, inviteID, expiresIn any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RegenerateUserInvite", reflect.TypeOf((*MockManager)(nil).RegenerateUserInvite), ctx, accountID, initiatorUserID, inviteID, expiresIn)
 }
@@ -1388,7 +1407,7 @@ func (m *MockManager) RejectUser(ctx context.Context, accountID, initiatorUserID
 }
 
 // RejectUser indicates an expected call of RejectUser.
-func (mr *MockManagerMockRecorder) RejectUser(ctx, accountID, initiatorUserID, targetUserID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) RejectUser(ctx, accountID, initiatorUserID, targetUserID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RejectUser", reflect.TypeOf((*MockManager)(nil).RejectUser), ctx, accountID, initiatorUserID, targetUserID)
 }
@@ -1402,7 +1421,7 @@ func (m *MockManager) SaveDNSSettings(ctx context.Context, accountID, userID str
 }
 
 // SaveDNSSettings indicates an expected call of SaveDNSSettings.
-func (mr *MockManagerMockRecorder) SaveDNSSettings(ctx, accountID, userID, dnsSettingsToSave interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SaveDNSSettings(ctx, accountID, userID, dnsSettingsToSave any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveDNSSettings", reflect.TypeOf((*MockManager)(nil).SaveDNSSettings), ctx, accountID, userID, dnsSettingsToSave)
 }
@@ -1416,7 +1435,7 @@ func (m *MockManager) SaveNameServerGroup(ctx context.Context, accountID, userID
 }
 
 // SaveNameServerGroup indicates an expected call of SaveNameServerGroup.
-func (mr *MockManagerMockRecorder) SaveNameServerGroup(ctx, accountID, userID, nsGroupToSave interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SaveNameServerGroup(ctx, accountID, userID, nsGroupToSave any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveNameServerGroup", reflect.TypeOf((*MockManager)(nil).SaveNameServerGroup), ctx, accountID, userID, nsGroupToSave)
 }
@@ -1431,7 +1450,7 @@ func (m *MockManager) SaveOrAddUser(ctx context.Context, accountID, initiatorUse
 }
 
 // SaveOrAddUser indicates an expected call of SaveOrAddUser.
-func (mr *MockManagerMockRecorder) SaveOrAddUser(ctx, accountID, initiatorUserID, update, addIfNotExists interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SaveOrAddUser(ctx, accountID, initiatorUserID, update, addIfNotExists any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveOrAddUser", reflect.TypeOf((*MockManager)(nil).SaveOrAddUser), ctx, accountID, initiatorUserID, update, addIfNotExists)
 }
@@ -1446,7 +1465,7 @@ func (m *MockManager) SaveOrAddUsers(ctx context.Context, accountID, initiatorUs
 }
 
 // SaveOrAddUsers indicates an expected call of SaveOrAddUsers.
-func (mr *MockManagerMockRecorder) SaveOrAddUsers(ctx, accountID, initiatorUserID, updates, addIfNotExists interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SaveOrAddUsers(ctx, accountID, initiatorUserID, updates, addIfNotExists any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveOrAddUsers", reflect.TypeOf((*MockManager)(nil).SaveOrAddUsers), ctx, accountID, initiatorUserID, updates, addIfNotExists)
 }
@@ -1461,7 +1480,7 @@ func (m *MockManager) SavePolicy(ctx context.Context, accountID, userID string,
 }
 
 // SavePolicy indicates an expected call of SavePolicy.
-func (mr *MockManagerMockRecorder) SavePolicy(ctx, accountID, userID, policy, create interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SavePolicy(ctx, accountID, userID, policy, create any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SavePolicy", reflect.TypeOf((*MockManager)(nil).SavePolicy), ctx, accountID, userID, policy, create)
 }
@@ -1476,23 +1495,23 @@ func (m *MockManager) SavePostureChecks(ctx context.Context, accountID, userID s
 }
 
 // SavePostureChecks indicates an expected call of SavePostureChecks.
-func (mr *MockManagerMockRecorder) SavePostureChecks(ctx, accountID, userID, postureChecks, create interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SavePostureChecks(ctx, accountID, userID, postureChecks, create any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SavePostureChecks", reflect.TypeOf((*MockManager)(nil).SavePostureChecks), ctx, accountID, userID, postureChecks, create)
 }
 
 // SaveRoute mocks base method.
-func (m *MockManager) SaveRoute(ctx context.Context, accountID, userID string, route *route.Route) error {
+func (m *MockManager) SaveRoute(ctx context.Context, accountID, userID string, arg3 *route.Route) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveRoute", ctx, accountID, userID, route)
+	ret := m.ctrl.Call(m, "SaveRoute", ctx, accountID, userID, arg3)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // SaveRoute indicates an expected call of SaveRoute.
-func (mr *MockManagerMockRecorder) SaveRoute(ctx, accountID, userID, route interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SaveRoute(ctx, accountID, userID, arg3 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveRoute", reflect.TypeOf((*MockManager)(nil).SaveRoute), ctx, accountID, userID, route)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveRoute", reflect.TypeOf((*MockManager)(nil).SaveRoute), ctx, accountID, userID, arg3)
 }
 
 // SaveSetupKey mocks base method.
@@ -1505,7 +1524,7 @@ func (m *MockManager) SaveSetupKey(ctx context.Context, accountID string, key *t
 }
 
 // SaveSetupKey indicates an expected call of SaveSetupKey.
-func (mr *MockManagerMockRecorder) SaveSetupKey(ctx, accountID, key, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SaveSetupKey(ctx, accountID, key, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveSetupKey", reflect.TypeOf((*MockManager)(nil).SaveSetupKey), ctx, accountID, key, userID)
 }
@@ -1520,7 +1539,7 @@ func (m *MockManager) SaveUser(ctx context.Context, accountID, initiatorUserID s
 }
 
 // SaveUser indicates an expected call of SaveUser.
-func (mr *MockManagerMockRecorder) SaveUser(ctx, accountID, initiatorUserID, update interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SaveUser(ctx, accountID, initiatorUserID, update any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveUser", reflect.TypeOf((*MockManager)(nil).SaveUser), ctx, accountID, initiatorUserID, update)
 }
@@ -1532,7 +1551,7 @@ func (m *MockManager) SetServiceManager(serviceManager service.Manager) {
 }
 
 // SetServiceManager indicates an expected call of SetServiceManager.
-func (mr *MockManagerMockRecorder) SetServiceManager(serviceManager interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SetServiceManager(serviceManager any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetServiceManager", reflect.TypeOf((*MockManager)(nil).SetServiceManager), serviceManager)
 }
@@ -1544,43 +1563,43 @@ func (m *MockManager) StoreEvent(ctx context.Context, initiatorID, targetID, acc
 }
 
 // StoreEvent indicates an expected call of StoreEvent.
-func (mr *MockManagerMockRecorder) StoreEvent(ctx, initiatorID, targetID, accountID, activityID, meta interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) StoreEvent(ctx, initiatorID, targetID, accountID, activityID, meta any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "StoreEvent", reflect.TypeOf((*MockManager)(nil).StoreEvent), ctx, initiatorID, targetID, accountID, activityID, meta)
 }
 
 // SyncAndMarkPeer mocks base method.
-func (m *MockManager) SyncAndMarkPeer(ctx context.Context, accountID, peerPubKey string, meta peer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*peer.Peer, *types.NetworkMap, []*posture.Checks, int64, error) {
+func (m *MockManager) SyncAndMarkPeer(ctx context.Context, accountID, peerPubKey string, meta peer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*peer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SyncAndMarkPeer", ctx, accountID, peerPubKey, meta, realIP, syncTime)
 	ret0, _ := ret[0].(*peer.Peer)
 	ret1, _ := ret[1].(*types.NetworkMap)
-	ret2, _ := ret[2].([]*posture.Checks)
+	ret2, _ := ret[2].([]*nmdata.PostureChecks)
 	ret3, _ := ret[3].(int64)
 	ret4, _ := ret[4].(error)
 	return ret0, ret1, ret2, ret3, ret4
 }
 
 // SyncAndMarkPeer indicates an expected call of SyncAndMarkPeer.
-func (mr *MockManagerMockRecorder) SyncAndMarkPeer(ctx, accountID, peerPubKey, meta, realIP, syncTime interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SyncAndMarkPeer(ctx, accountID, peerPubKey, meta, realIP, syncTime any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SyncAndMarkPeer", reflect.TypeOf((*MockManager)(nil).SyncAndMarkPeer), ctx, accountID, peerPubKey, meta, realIP, syncTime)
 }
 
 // SyncPeer mocks base method.
-func (m *MockManager) SyncPeer(ctx context.Context, sync types.PeerSync, accountID string) (*peer.Peer, *types.NetworkMap, []*posture.Checks, int64, error) {
+func (m *MockManager) SyncPeer(ctx context.Context, sync types.PeerSync, accountID string) (*peer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SyncPeer", ctx, sync, accountID)
 	ret0, _ := ret[0].(*peer.Peer)
 	ret1, _ := ret[1].(*types.NetworkMap)
-	ret2, _ := ret[2].([]*posture.Checks)
+	ret2, _ := ret[2].([]*nmdata.PostureChecks)
 	ret3, _ := ret[3].(int64)
 	ret4, _ := ret[4].(error)
 	return ret0, ret1, ret2, ret3, ret4
 }
 
 // SyncPeer indicates an expected call of SyncPeer.
-func (mr *MockManagerMockRecorder) SyncPeer(ctx, sync, accountID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SyncPeer(ctx, sync, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SyncPeer", reflect.TypeOf((*MockManager)(nil).SyncPeer), ctx, sync, accountID)
 }
@@ -1594,7 +1613,7 @@ func (m *MockManager) SyncPeerMeta(ctx context.Context, peerPubKey string, meta
 }
 
 // SyncPeerMeta indicates an expected call of SyncPeerMeta.
-func (mr *MockManagerMockRecorder) SyncPeerMeta(ctx, peerPubKey, meta, realIP interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SyncPeerMeta(ctx, peerPubKey, meta, realIP any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SyncPeerMeta", reflect.TypeOf((*MockManager)(nil).SyncPeerMeta), ctx, peerPubKey, meta, realIP)
 }
@@ -1608,11 +1627,35 @@ func (m *MockManager) SyncUserJWTGroups(ctx context.Context, userAuth auth.UserA
 }
 
 // SyncUserJWTGroups indicates an expected call of SyncUserJWTGroups.
-func (mr *MockManagerMockRecorder) SyncUserJWTGroups(ctx, userAuth interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SyncUserJWTGroups(ctx, userAuth any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SyncUserJWTGroups", reflect.TypeOf((*MockManager)(nil).SyncUserJWTGroups), ctx, userAuth)
 }
 
+// TrackCertificateChallenges mocks base method.
+func (m *MockManager) TrackCertificateChallenges(ctx context.Context, accountID, peerID string, streamStart time.Time) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "TrackCertificateChallenges", ctx, accountID, peerID, streamStart)
+}
+
+// TrackCertificateChallenges indicates an expected call of TrackCertificateChallenges.
+func (mr *MockManagerMockRecorder) TrackCertificateChallenges(ctx, accountID, peerID, streamStart any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TrackCertificateChallenges", reflect.TypeOf((*MockManager)(nil).TrackCertificateChallenges), ctx, accountID, peerID, streamStart)
+}
+
+// UntrackCertificateChallenges mocks base method.
+func (m *MockManager) UntrackCertificateChallenges(accountID, peerID string, streamStart time.Time) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "UntrackCertificateChallenges", accountID, peerID, streamStart)
+}
+
+// UntrackCertificateChallenges indicates an expected call of UntrackCertificateChallenges.
+func (mr *MockManagerMockRecorder) UntrackCertificateChallenges(accountID, peerID, streamStart any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UntrackCertificateChallenges", reflect.TypeOf((*MockManager)(nil).UntrackCertificateChallenges), accountID, peerID, streamStart)
+}
+
 // UpdateAccountOnboarding mocks base method.
 func (m *MockManager) UpdateAccountOnboarding(ctx context.Context, accountID, userID string, newOnboarding *types.AccountOnboarding) (*types.AccountOnboarding, error) {
 	m.ctrl.T.Helper()
@@ -1623,7 +1666,7 @@ func (m *MockManager) UpdateAccountOnboarding(ctx context.Context, accountID, us
 }
 
 // UpdateAccountOnboarding indicates an expected call of UpdateAccountOnboarding.
-func (mr *MockManagerMockRecorder) UpdateAccountOnboarding(ctx, accountID, userID, newOnboarding interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateAccountOnboarding(ctx, accountID, userID, newOnboarding any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateAccountOnboarding", reflect.TypeOf((*MockManager)(nil).UpdateAccountOnboarding), ctx, accountID, userID, newOnboarding)
 }
@@ -1635,23 +1678,11 @@ func (m *MockManager) UpdateAccountPeers(ctx context.Context, accountID string,
 }
 
 // UpdateAccountPeers indicates an expected call of UpdateAccountPeers.
-func (mr *MockManagerMockRecorder) UpdateAccountPeers(ctx, accountID, reason interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateAccountPeers(ctx, accountID, reason any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateAccountPeers", reflect.TypeOf((*MockManager)(nil).UpdateAccountPeers), ctx, accountID, reason)
 }
 
-// ExpandAndUpdateAffected mocks base method.
-func (m *MockManager) ExpandAndUpdateAffected(ctx context.Context, accountID string, snap *affectedpeers.Snapshot, change affectedpeers.Change) {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "ExpandAndUpdateAffected", ctx, accountID, snap, change)
-}
-
-// ExpandAndUpdateAffected indicates an expected call of ExpandAndUpdateAffected.
-func (mr *MockManagerMockRecorder) ExpandAndUpdateAffected(ctx, accountID, snap, change interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ExpandAndUpdateAffected", reflect.TypeOf((*MockManager)(nil).ExpandAndUpdateAffected), ctx, accountID, snap, change)
-}
-
 // UpdateAccountSettings mocks base method.
 func (m *MockManager) UpdateAccountSettings(ctx context.Context, accountID, userID string, newSettings *types.Settings) (*types.Settings, error) {
 	m.ctrl.T.Helper()
@@ -1662,7 +1693,7 @@ func (m *MockManager) UpdateAccountSettings(ctx context.Context, accountID, user
 }
 
 // UpdateAccountSettings indicates an expected call of UpdateAccountSettings.
-func (mr *MockManagerMockRecorder) UpdateAccountSettings(ctx, accountID, userID, newSettings interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateAccountSettings(ctx, accountID, userID, newSettings any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateAccountSettings", reflect.TypeOf((*MockManager)(nil).UpdateAccountSettings), ctx, accountID, userID, newSettings)
 }
@@ -1676,7 +1707,7 @@ func (m *MockManager) UpdateGroup(ctx context.Context, accountID, userID string,
 }
 
 // UpdateGroup indicates an expected call of UpdateGroup.
-func (mr *MockManagerMockRecorder) UpdateGroup(ctx, accountID, userID, group interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateGroup(ctx, accountID, userID, group any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateGroup", reflect.TypeOf((*MockManager)(nil).UpdateGroup), ctx, accountID, userID, group)
 }
@@ -1690,24 +1721,24 @@ func (m *MockManager) UpdateGroups(ctx context.Context, accountID, userID string
 }
 
 // UpdateGroups indicates an expected call of UpdateGroups.
-func (mr *MockManagerMockRecorder) UpdateGroups(ctx, accountID, userID, newGroups interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateGroups(ctx, accountID, userID, newGroups any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateGroups", reflect.TypeOf((*MockManager)(nil).UpdateGroups), ctx, accountID, userID, newGroups)
 }
 
 // UpdateIdentityProvider mocks base method.
-func (m *MockManager) UpdateIdentityProvider(ctx context.Context, accountID, idpID, userID string, idp *types.IdentityProvider) (*types.IdentityProvider, error) {
+func (m *MockManager) UpdateIdentityProvider(ctx context.Context, accountID, idpID, userID string, arg4 *types.IdentityProvider) (*types.IdentityProvider, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateIdentityProvider", ctx, accountID, idpID, userID, idp)
+	ret := m.ctrl.Call(m, "UpdateIdentityProvider", ctx, accountID, idpID, userID, arg4)
 	ret0, _ := ret[0].(*types.IdentityProvider)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // UpdateIdentityProvider indicates an expected call of UpdateIdentityProvider.
-func (mr *MockManagerMockRecorder) UpdateIdentityProvider(ctx, accountID, idpID, userID, idp interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateIdentityProvider(ctx, accountID, idpID, userID, arg4 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateIdentityProvider", reflect.TypeOf((*MockManager)(nil).UpdateIdentityProvider), ctx, accountID, idpID, userID, idp)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateIdentityProvider", reflect.TypeOf((*MockManager)(nil).UpdateIdentityProvider), ctx, accountID, idpID, userID, arg4)
 }
 
 // UpdateIntegratedValidator mocks base method.
@@ -1719,7 +1750,7 @@ func (m *MockManager) UpdateIntegratedValidator(ctx context.Context, accountID,
 }
 
 // UpdateIntegratedValidator indicates an expected call of UpdateIntegratedValidator.
-func (mr *MockManagerMockRecorder) UpdateIntegratedValidator(ctx, accountID, userID, validator, groups interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateIntegratedValidator(ctx, accountID, userID, validator, groups any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateIntegratedValidator", reflect.TypeOf((*MockManager)(nil).UpdateIntegratedValidator), ctx, accountID, userID, validator, groups)
 }
@@ -1734,7 +1765,7 @@ func (m *MockManager) UpdatePeer(ctx context.Context, accountID, userID string,
 }
 
 // UpdatePeer indicates an expected call of UpdatePeer.
-func (mr *MockManagerMockRecorder) UpdatePeer(ctx, accountID, userID, p interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdatePeer(ctx, accountID, userID, p any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdatePeer", reflect.TypeOf((*MockManager)(nil).UpdatePeer), ctx, accountID, userID, p)
 }
@@ -1748,11 +1779,12 @@ func (m *MockManager) UpdatePeerIP(ctx context.Context, accountID, userID, peerI
 }
 
 // UpdatePeerIP indicates an expected call of UpdatePeerIP.
-func (mr *MockManagerMockRecorder) UpdatePeerIP(ctx, accountID, userID, peerID, newIP interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdatePeerIP(ctx, accountID, userID, peerID, newIP any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdatePeerIP", reflect.TypeOf((*MockManager)(nil).UpdatePeerIP), ctx, accountID, userID, peerID, newIP)
 }
 
+// UpdatePeerIPv6 mocks base method.
 func (m *MockManager) UpdatePeerIPv6(ctx context.Context, accountID, userID, peerID string, newIPv6 netip.Addr) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "UpdatePeerIPv6", ctx, accountID, userID, peerID, newIPv6)
@@ -1760,7 +1792,8 @@ func (m *MockManager) UpdatePeerIPv6(ctx context.Context, accountID, userID, pee
 	return ret0
 }
 
-func (mr *MockManagerMockRecorder) UpdatePeerIPv6(ctx, accountID, userID, peerID, newIPv6 interface{}) *gomock.Call {
+// UpdatePeerIPv6 indicates an expected call of UpdatePeerIPv6.
+func (mr *MockManagerMockRecorder) UpdatePeerIPv6(ctx, accountID, userID, peerID, newIPv6 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdatePeerIPv6", reflect.TypeOf((*MockManager)(nil).UpdatePeerIPv6), ctx, accountID, userID, peerID, newIPv6)
 }
@@ -1774,7 +1807,7 @@ func (m *MockManager) UpdateToPrimaryAccount(ctx context.Context, accountId stri
 }
 
 // UpdateToPrimaryAccount indicates an expected call of UpdateToPrimaryAccount.
-func (mr *MockManagerMockRecorder) UpdateToPrimaryAccount(ctx, accountId interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateToPrimaryAccount(ctx, accountId any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateToPrimaryAccount", reflect.TypeOf((*MockManager)(nil).UpdateToPrimaryAccount), ctx, accountId)
 }
@@ -1788,7 +1821,7 @@ func (m *MockManager) UpdateUserPassword(ctx context.Context, accountID, current
 }
 
 // UpdateUserPassword indicates an expected call of UpdateUserPassword.
-func (mr *MockManagerMockRecorder) UpdateUserPassword(ctx, accountID, currentUserID, targetUserID, oldPassword, newPassword interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateUserPassword(ctx, accountID, currentUserID, targetUserID, oldPassword, newPassword any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateUserPassword", reflect.TypeOf((*MockManager)(nil).UpdateUserPassword), ctx, accountID, currentUserID, targetUserID, oldPassword, newPassword)
 }
diff --git a/management/server/account/request_buffer.go b/management/server/account/request_buffer.go
index eced1929f..3f91996eb 100644
--- a/management/server/account/request_buffer.go
+++ b/management/server/account/request_buffer.go
@@ -6,6 +6,8 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 )
 
+//go:generate go tool mockgen -package=account -source=./request_buffer.go -destination=request_buffer_mock.go
+
 type RequestBuffer interface {
 	GetAccountWithBackpressure(ctx context.Context, accountID string) (*types.Account, error)
 }
diff --git a/management/server/account/request_buffer_mock.go b/management/server/account/request_buffer_mock.go
new file mode 100644
index 000000000..b48ef2700
--- /dev/null
+++ b/management/server/account/request_buffer_mock.go
@@ -0,0 +1,57 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./request_buffer.go
+//
+// Generated by this command:
+//
+//	mockgen -package=account -source=./request_buffer.go -destination=request_buffer_mock.go
+//
+
+// Package account is a generated GoMock package.
+package account
+
+import (
+	context "context"
+	reflect "reflect"
+
+	types "github.com/netbirdio/netbird/management/server/types"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockRequestBuffer is a mock of RequestBuffer interface.
+type MockRequestBuffer struct {
+	ctrl     *gomock.Controller
+	recorder *MockRequestBufferMockRecorder
+	isgomock struct{}
+}
+
+// MockRequestBufferMockRecorder is the mock recorder for MockRequestBuffer.
+type MockRequestBufferMockRecorder struct {
+	mock *MockRequestBuffer
+}
+
+// NewMockRequestBuffer creates a new mock instance.
+func NewMockRequestBuffer(ctrl *gomock.Controller) *MockRequestBuffer {
+	mock := &MockRequestBuffer{ctrl: ctrl}
+	mock.recorder = &MockRequestBufferMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockRequestBuffer) EXPECT() *MockRequestBufferMockRecorder {
+	return m.recorder
+}
+
+// GetAccountWithBackpressure mocks base method.
+func (m *MockRequestBuffer) GetAccountWithBackpressure(ctx context.Context, accountID string) (*types.Account, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountWithBackpressure", ctx, accountID)
+	ret0, _ := ret[0].(*types.Account)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountWithBackpressure indicates an expected call of GetAccountWithBackpressure.
+func (mr *MockRequestBufferMockRecorder) GetAccountWithBackpressure(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountWithBackpressure", reflect.TypeOf((*MockRequestBuffer)(nil).GetAccountWithBackpressure), ctx, accountID)
+}
diff --git a/management/server/account_request_buffer.go b/management/server/account_request_buffer.go
index e1672c2d0..792099431 100644
--- a/management/server/account_request_buffer.go
+++ b/management/server/account_request_buffer.go
@@ -2,117 +2,38 @@ package server
 
 import (
 	"context"
-	"os"
-	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/management/internals/shared/requestbuffer"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
 )
 
-// AccountRequest holds the result channel to return the requested account.
-type AccountRequest struct {
-	AccountID  string
-	ResultChan chan *AccountResult
-}
-
-// AccountResult holds the account data or an error.
-type AccountResult struct {
-	Account *types.Account
-	Err     error
-}
+const defaultAccountBufferInterval = 100 * time.Millisecond
 
 type AccountRequestBuffer struct {
-	store               store.Store
-	getAccountRequests  map[string][]*AccountRequest
-	mu                  sync.Mutex
-	getAccountRequestCh chan *AccountRequest
-	bufferInterval      time.Duration
+	buffer *requestbuffer.Buffer[*types.Account]
 }
 
 func NewAccountRequestBuffer(ctx context.Context, store store.Store) *AccountRequestBuffer {
-	bufferIntervalStr := os.Getenv("NB_GET_ACCOUNT_BUFFER_INTERVAL")
-	bufferInterval, err := time.ParseDuration(bufferIntervalStr)
-	if err != nil {
-		if bufferIntervalStr != "" {
-			log.WithContext(ctx).Warnf("failed to parse account request buffer interval: %s", err)
-		}
-		bufferInterval = 100 * time.Millisecond
+	interval := requestbuffer.Interval(ctx, "NB_GET_ACCOUNT_BUFFER_INTERVAL", defaultAccountBufferInterval)
+	log.WithContext(ctx).Infof("set account request buffer interval to %s", interval)
+
+	return &AccountRequestBuffer{
+		buffer: requestbuffer.New(ctx, "account request buffer", interval, store.GetAccount),
 	}
-
-	log.WithContext(ctx).Infof("set account request buffer interval to %s", bufferInterval)
-
-	ac := AccountRequestBuffer{
-		store:               store,
-		getAccountRequests:  make(map[string][]*AccountRequest),
-		getAccountRequestCh: make(chan *AccountRequest),
-		bufferInterval:      bufferInterval,
-	}
-
-	go ac.processGetAccountRequests(ctx)
-
-	return &ac
 }
+
 func (ac *AccountRequestBuffer) GetAccountWithBackpressure(ctx context.Context, accountID string) (*types.Account, error) {
-	req := &AccountRequest{
-		AccountID:  accountID,
-		ResultChan: make(chan *AccountResult, 1),
+	account, err := ac.buffer.Get(ctx, accountID)
+	if err != nil || account == nil {
+		return account, err
 	}
 
-	log.WithContext(ctx).Tracef("requesting account %s with backpressure", accountID)
-	startTime := time.Now()
-	ac.getAccountRequestCh <- req
-
-	result := <-req.ResultChan
-	log.WithContext(ctx).Tracef("got account with backpressure after %s", time.Since(startTime))
-	return result.Account, result.Err
-}
-
-func (ac *AccountRequestBuffer) processGetAccountBatch(ctx context.Context, accountID string) {
-	ac.mu.Lock()
-	requests := ac.getAccountRequests[accountID]
-	delete(ac.getAccountRequests, accountID)
-	ac.mu.Unlock()
-
-	if len(requests) == 0 {
-		return
-	}
-
-	startTime := time.Now()
-	account, err := ac.store.GetAccount(ctx, accountID)
-	log.WithContext(ctx).Tracef("getting account %s in batch took %s", accountID, time.Since(startTime))
-	result := &AccountResult{Account: account, Err: err}
-
-	for _, req := range requests {
-		if account != nil {
-			// Shallow copy the account so each goroutine gets its own struct value.
-			// This prevents data races when callers mutate fields like Policies.
-			accountCopy := *account
-			req.ResultChan <- &AccountResult{Account: &accountCopy, Err: err}
-		} else {
-			req.ResultChan <- result
-		}
-		close(req.ResultChan)
-	}
-}
-
-func (ac *AccountRequestBuffer) processGetAccountRequests(ctx context.Context) {
-	for {
-		select {
-		case req := <-ac.getAccountRequestCh:
-			ac.mu.Lock()
-			ac.getAccountRequests[req.AccountID] = append(ac.getAccountRequests[req.AccountID], req)
-			if len(ac.getAccountRequests[req.AccountID]) == 1 {
-				go func(ctx context.Context, accountID string) {
-					time.Sleep(ac.bufferInterval)
-					ac.processGetAccountBatch(ctx, accountID)
-				}(ctx, req.AccountID)
-			}
-			ac.mu.Unlock()
-		case <-ctx.Done():
-			return
-		}
-	}
+	// Shallow copy the account so each caller gets its own struct value.
+	// This prevents data races when callers mutate fields like Policies.
+	accountCopy := *account
+	return &accountCopy, nil
 }
diff --git a/management/server/account_test.go b/management/server/account_test.go
index 585e267d5..ef7525961 100644
--- a/management/server/account_test.go
+++ b/management/server/account_test.go
@@ -3,6 +3,7 @@ package server
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -10,16 +11,18 @@ import (
 	"os"
 	"reflect"
 	"strconv"
+	"strings"
 	"sync"
 	"testing"
+	"testing/synctest"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/prometheus/client_golang/prometheus/push"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel/metric/noop"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
@@ -37,6 +40,9 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	reverseproxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service/manager"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	networkmapdbfactory "github.com/netbirdio/netbird/management/internals/network_map_db/factory"
+	networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	nbAccount "github.com/netbirdio/netbird/management/server/account"
@@ -44,7 +50,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -955,6 +960,101 @@ func TestAccountManager_DeleteAccount(t *testing.T) {
 	assert.Len(t, pats, 0)
 }
 
+func TestAccountManager_DeleteAccount_RunsDeletionHooks(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	ownerID := "account_creator"
+	account, err := createAccount(manager, "test_account", ownerID, "")
+	require.NoError(t, err)
+
+	// Each hook records its call and checks the account is still in the store, which is
+	// the point of running before deletion: a hook must be able to read what it cleans up.
+	var calls []string
+	hook := func(name string) nbAccount.DeletionHook {
+		return func(ctx context.Context, accountID string) error {
+			calls = append(calls, name+":"+accountID)
+			_, err := manager.Store.GetAccount(ctx, accountID)
+			assert.NoError(t, err, "account should still exist while hook %s runs", name)
+			return nil
+		}
+	}
+	manager.AddAccountDeletionHook(hook("first"))
+	manager.AddAccountDeletionHook(hook("second"))
+
+	require.NoError(t, manager.DeleteAccount(context.Background(), account.Id, ownerID))
+
+	assert.Equal(t, []string{"first:" + account.Id, "second:" + account.Id}, calls,
+		"hooks should run once each, in registration order, with the deleted account's ID")
+	_, err = manager.Store.GetAccount(context.Background(), account.Id)
+	assert.Error(t, err, "account should be deleted after the hooks succeed")
+}
+
+func TestAccountManager_DeleteAccount_DeletionHookErrorAbortsDeletion(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	ownerID := "account_creator"
+	account, err := createAccount(manager, "test_account", ownerID, "")
+	require.NoError(t, err)
+
+	manager.AddAccountDeletionHook(func(context.Context, string) error {
+		return status.Errorf(status.PreconditionFailed, "teardown refused")
+	})
+	secondCalled := false
+	manager.AddAccountDeletionHook(func(context.Context, string) error {
+		secondCalled = true
+		return nil
+	})
+
+	err = manager.DeleteAccount(context.Background(), account.Id, ownerID)
+	require.Error(t, err)
+
+	// The hook's status type has to survive the wrapping, since the HTTP layer maps it
+	// to the response code.
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "error should carry the hook's status error, got %v", err)
+	assert.Equal(t, status.PreconditionFailed, sErr.Type(), "status type should be the hook's")
+	assert.False(t, secondCalled, "hooks after a failing one should not run")
+
+	_, err = manager.Store.GetAccount(context.Background(), account.Id)
+	assert.NoError(t, err, "account should survive a failing hook")
+	_, err = manager.Store.GetUserByUserID(context.Background(), store.LockingStrengthNone, ownerID)
+	assert.NoError(t, err, "account owner should survive a failing hook")
+}
+
+func TestAccountManager_AddAccountDeletionHook_RejectsNil(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	assert.PanicsWithValue(t, "nil account deletion hook", func() {
+		manager.AddAccountDeletionHook(nil)
+	}, "registering a nil hook should panic instead of breaking a later deletion")
+}
+
+func TestAccountManager_DeleteAccount_DeletionHooksSkippedWithoutPermission(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	ownerID := "account_creator"
+	account, err := createAccount(manager, "test_account", ownerID, "")
+	require.NoError(t, err)
+
+	adminID := "regular_admin"
+	account.Users[adminID] = types.NewAdminUser(adminID)
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	called := false
+	manager.AddAccountDeletionHook(func(context.Context, string) error {
+		called = true
+		return nil
+	})
+
+	err = manager.DeleteAccount(context.Background(), account.Id, adminID)
+	require.Error(t, err, "only the owner may delete the account")
+	assert.False(t, called, "hooks should not run for a caller who may not delete the account")
+}
+
 func BenchmarkTest_GetAccountWithclaims(b *testing.B) {
 	claims := auth.UserAuth{
 		Domain:         "example.com",
@@ -1199,7 +1299,9 @@ func TestAccountManager_AddPeerWithUserID(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
-	testAccountManager_NetworkUpdates_SaveGroup(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_SaveGroup(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
@@ -1232,6 +1334,8 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1254,7 +1358,9 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeletePolicy(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeletePolicy(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
@@ -1263,13 +1369,7 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
-	// Ensure that we do not receive an update message before the policy is deleted
-	time.Sleep(time.Second)
-	select {
-	case <-updMsg:
-		t.Logf("received addPeer update message before policy deletion")
-	default:
-	}
+	settleAffectedUpdates(updMsg)
 
 	wg := sync.WaitGroup{}
 	wg.Add(1)
@@ -1292,7 +1392,9 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
-	testAccountManager_NetworkUpdates_SavePolicy(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_SavePolicy(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
@@ -1312,6 +1414,8 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1345,7 +1449,9 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeletePeer(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeletePeer(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
@@ -1384,6 +1490,8 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1405,7 +1513,9 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeleteGroup(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeleteGroup(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
@@ -1452,6 +1562,8 @@ func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
 		}
 	}
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1757,6 +1869,7 @@ func TestAccount_Copy(t *testing.T) {
 				AccountID: "account1",
 			},
 		},
+		PostureValidation: map[string]map[string]bool{"1": {"1": true}},
 	}
 	err := hasNilField(account)
 	if err != nil {
@@ -1916,6 +2029,154 @@ func TestDefaultAccountManager_MarkPeerConnected_PeerLoginExpiration(t *testing.
 	}
 }
 
+func TestDefaultAccountManager_SchedulePeerLoginExpiration_IncludesOfflinePeers(t *testing.T) {
+	manager, updateManager, err := createManager(t)
+	require.NoError(t, err, "unable to create account manager")
+
+	accountID, err := manager.GetAccountIDByUserID(context.Background(), auth.UserAuth{UserId: userID})
+	require.NoError(t, err, "unable to create an account")
+
+	connectedKey, offlineKey := addExpiringPeers(t, manager)
+	_, err = manager.UpdateAccountSettings(context.Background(), accountID, userID, &types.Settings{
+		PeerLoginExpiration:        time.Hour,
+		PeerLoginExpirationEnabled: true,
+		Extra:                      &types.ExtraSettings{},
+	})
+	require.NoError(t, err, "expecting to update account settings successfully but got error")
+	manager.peerLoginExpiry.CancelAll(context.Background())
+
+	// The connected peer logged in just now, so a job computed from connected peers alone
+	// would be armed for an hour. The offline peer's login expires in two seconds; a
+	// reconnect of that peer must not have to wait for the connected peer's tick.
+	now := time.Now().UTC()
+	setPeerLogin(t, manager, accountID, connectedKey, true, now)
+	setPeerLogin(t, manager, accountID, offlineKey, false, now.Add(-time.Hour+2*time.Second))
+
+	offlinePeer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, offlineKey)
+	require.NoError(t, err)
+	updateManager.CreateChannel(context.Background(), offlinePeer.ID)
+
+	manager.peerLoginExpiry = NewDefaultScheduler()
+	t.Cleanup(func() { manager.peerLoginExpiry.CancelAll(context.Background()) })
+	manager.schedulePeerLoginExpiration(context.Background(), accountID)
+
+	// The flag is committed per peer before the disconnect fans out, so wait for both.
+	require.Eventually(t, func() bool {
+		peer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, offlineKey)
+		return err == nil && peer.Status.LoginExpired && !updateManager.HasChannel(offlinePeer.ID)
+	}, 10*time.Second, 100*time.Millisecond, "offline peer should be expired and disconnected at its own deadline")
+
+	connectedPeer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, connectedKey)
+	require.NoError(t, err)
+	assert.False(t, connectedPeer.Status.LoginExpired, "connected peer with a fresh login must not expire")
+}
+
+func TestDefaultAccountManager_SchedulePeerLoginExpiration_DetachesRequestContext(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err, "unable to create account manager")
+
+	accountID, err := manager.GetAccountIDByUserID(context.Background(), auth.UserAuth{UserId: userID})
+	require.NoError(t, err, "unable to create an account")
+	connectedKey, _ := addExpiringPeers(t, manager)
+	setPeerLogin(t, manager, accountID, connectedKey, true, time.Now().UTC())
+
+	scheduled := make(chan context.Context, 1)
+	manager.peerLoginExpiry = &MockScheduler{
+		IsSchedulerRunningFunc: func(string) bool { return false },
+		ScheduleFunc: func(ctx context.Context, _ time.Duration, _ string, _ func() (time.Duration, bool)) {
+			scheduled <- ctx
+		},
+	}
+
+	requestCtx, cancel := context.WithCancel(context.Background())
+	manager.schedulePeerLoginExpiration(requestCtx, accountID)
+	cancel()
+
+	select {
+	case jobCtx := <-scheduled:
+		assert.NoError(t, jobCtx.Err(), "the expiration job must outlive the request that armed it")
+	case <-time.After(time.Second):
+		t.Fatal("timeout while waiting for the job to be scheduled")
+	}
+}
+
+func TestDefaultAccountManager_ExpireAndUpdatePeers_SkipsPeerThatLoggedInAgain(t *testing.T) {
+	manager, updateManager, err := createManager(t)
+	require.NoError(t, err, "unable to create account manager")
+
+	accountID, err := manager.GetAccountIDByUserID(context.Background(), auth.UserAuth{UserId: userID})
+	require.NoError(t, err, "unable to create an account")
+
+	reloggedKey, staleKey := addExpiringPeers(t, manager)
+	_, err = manager.UpdateAccountSettings(context.Background(), accountID, userID, &types.Settings{
+		PeerLoginExpiration:        time.Hour,
+		PeerLoginExpirationEnabled: true,
+		Extra:                      &types.ExtraSettings{},
+	})
+	require.NoError(t, err, "expecting to update account settings successfully but got error")
+	manager.peerLoginExpiry.CancelAll(context.Background())
+
+	expiredLogin := time.Now().UTC().Add(-2 * time.Hour)
+	setPeerLogin(t, manager, accountID, reloggedKey, true, expiredLogin)
+	setPeerLogin(t, manager, accountID, staleKey, true, expiredLogin)
+
+	expiredPeers, err := manager.getExpiredPeers(context.Background(), accountID)
+	require.NoError(t, err)
+	require.Len(t, expiredPeers, 2, "both peers should be due for expiration")
+
+	// The job holds the candidate list while one peer completes a fresh login, which
+	// moves its deadline into the future and must win over the stale candidate entry.
+	setPeerLogin(t, manager, accountID, reloggedKey, true, time.Now().UTC())
+
+	reloggedPeer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, reloggedKey)
+	require.NoError(t, err)
+	stalePeer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, staleKey)
+	require.NoError(t, err)
+	updateManager.CreateChannel(context.Background(), reloggedPeer.ID)
+	updateManager.CreateChannel(context.Background(), stalePeer.ID)
+
+	err = manager.expireAndUpdatePeers(context.Background(), accountID, expiredPeers, peerExpirationSessionExpired)
+	require.NoError(t, err)
+
+	reloggedPeer, err = manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, reloggedKey)
+	require.NoError(t, err)
+	assert.False(t, reloggedPeer.Status.LoginExpired, "a peer that logged in again must not be flagged from the stale candidate list")
+	assert.True(t, reloggedPeer.Status.Connected, "the re-logged peer must keep its connected status")
+	assert.True(t, updateManager.HasChannel(reloggedPeer.ID), "the re-logged peer's update channel must stay open")
+
+	stalePeer, err = manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, staleKey)
+	require.NoError(t, err)
+	assert.True(t, stalePeer.Status.LoginExpired, "a peer that is still due must be flagged")
+	assert.False(t, updateManager.HasChannel(stalePeer.ID), "the expired peer's update channel must be closed")
+}
+
+// addExpiringPeers registers two SSO peers with login expiration enabled and returns their public keys.
+func addExpiringPeers(t *testing.T, manager *DefaultAccountManager) (string, string) {
+	t.Helper()
+	keys := make([]string, 0, 2)
+	for _, hostname := range []string{"connected-peer", "offline-peer"} {
+		key, err := wgtypes.GenerateKey()
+		require.NoError(t, err, "unable to generate WireGuard key")
+		_, _, _, _, err = manager.AddPeer(context.Background(), "", "", userID, &nbpeer.Peer{
+			Key:                    key.PublicKey().String(),
+			Meta:                   nbpeer.PeerSystemMeta{Hostname: hostname},
+			LoginExpirationEnabled: true,
+		}, false)
+		require.NoError(t, err, "unable to add peer")
+		keys = append(keys, key.PublicKey().String())
+	}
+	return keys[0], keys[1]
+}
+
+func setPeerLogin(t *testing.T, manager *DefaultAccountManager, accountID, peerKey string, connected bool, lastLogin time.Time) {
+	t.Helper()
+	peer, err := manager.Store.GetPeerByPeerPubKey(context.Background(), store.LockingStrengthNone, peerKey)
+	require.NoError(t, err)
+	peer.Status.Connected = connected
+	peer.LastLogin = &lastLogin
+	require.NoError(t, manager.Store.SavePeer(context.Background(), accountID, peer))
+}
+
 func TestDefaultAccountManager_MarkPeerDisconnected_SchedulesInactivityExpiration(t *testing.T) {
 	manager, _, err := createManager(t)
 	require.NoError(t, err, "unable to create account manager")
@@ -2310,7 +2571,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_PeerApproval(t *testing.T)
 	_, err = manager.UpdateAccountSettings(ctx, accountID, userID, newSettings)
 	require.NoError(t, err)
 
-	accountPeers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	accountPeers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 
 	for _, peer := range accountPeers {
@@ -2698,7 +2959,7 @@ func TestAccount_GetNextPeerExpiration(t *testing.T) {
 			expectedNextExpiration: time.Duration(0),
 		},
 		{
-			name: "No connected peers, no expiration",
+			name: "Offline peer with expiration, return expiration",
 			peers: map[string]*nbpeer.Peer{
 				"peer-1": {
 					Status: &nbpeer.PeerStatus{
@@ -2717,8 +2978,33 @@ func TestAccount_GetNextPeerExpiration(t *testing.T) {
 			},
 			expiration:             time.Second,
 			expirationEnabled:      false,
-			expectedNextRun:        false,
-			expectedNextExpiration: time.Duration(0),
+			expectedNextRun:        true,
+			expectedNextExpiration: time.Second,
+		},
+		{
+			name: "Offline peer with the earliest deadline defines the next run",
+			peers: map[string]*nbpeer.Peer{
+				"peer-1": {
+					Status: &nbpeer.PeerStatus{
+						Connected: true,
+					},
+					LoginExpirationEnabled: true,
+					LastLogin:              util.ToPtr(time.Now().UTC()),
+					UserID:                 userID,
+				},
+				"peer-2": {
+					Status: &nbpeer.PeerStatus{
+						Connected: false,
+					},
+					LoginExpirationEnabled: true,
+					LastLogin:              util.ToPtr(time.Now().UTC().Add(-50 * time.Minute)),
+					UserID:                 userID,
+				},
+			},
+			expiration:             time.Hour,
+			expirationEnabled:      true,
+			expectedNextRun:        true,
+			expectedNextExpiration: 10 * time.Minute,
 		},
 		{
 			name: "Connected peers with disabled expiration, no expiration",
@@ -3170,6 +3456,16 @@ func TestAccount_SetJWTGroups(t *testing.T) {
 		user, err := manager.Store.GetUserByUserID(context.Background(), store.LockingStrengthNone, "user2")
 		assert.NoError(t, err, "unable to get user")
 		assert.Len(t, user.AutoGroups, 1, "new group should be added")
+
+		var newJWTGroup *types.Group
+		for _, g := range groups {
+			if g.Name == "group3" {
+				newJWTGroup = g
+				break
+			}
+		}
+		require.NotNil(t, newJWTGroup, "JIT-created JWT group not found")
+		assert.NotEqual(t, "", newJWTGroup.PublicID, "JIT-created JWT group must have a non-empty PublicID")
 	})
 
 	t.Run("remove all JWT groups when list is empty", func(t *testing.T) {
@@ -3282,13 +3578,36 @@ func createManager(t testing.TB) (*DefaultAccountManager, *update_channel.PeersU
 	if err != nil {
 		return nil, nil, err
 	}
-	eventStore := &activity.InMemoryEventStore{}
+	return buildTestManager(t, store, nil)
+}
 
-	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
-	if err != nil {
-		return nil, nil, err
+// createManagerWithNetworkMapStore builds a manager whose network map controller
+// reads the twin (nmdata) store, the production path on sqlite and postgres.
+func createManagerWithNetworkMapStore(t testing.TB) (*DefaultAccountManager, *update_channel.PeersUpdateManager) {
+	t.Helper()
+
+	if engine := os.Getenv("NETBIRD_STORE_ENGINE"); engine != "" && !strings.EqualFold(engine, string(types.SqliteStoreEngine)) {
+		t.Skipf("network map store test needs the sqlite engine, got %s", engine)
 	}
 
+	dataDir := t.TempDir()
+	store, err := createStoreAt(t, dataDir)
+	require.NoError(t, err)
+
+	nmdataStore, err := networkmapdbfactory.NewNetworkMapDBStore(context.Background(), types.SqliteStoreEngine, dataDir, MockIntegratedValidator{}, newSettingsMockManager(t))
+	require.NoError(t, err)
+	sqliteStore, ok := nmdataStore.Store.(*networkmap_sqlite.SqliteStore)
+	require.True(t, ok, "network map store is %T, want *networkmap_sqlite.SqliteStore", nmdataStore.Store)
+	t.Cleanup(func() { assert.NoError(t, sqliteStore.Db.Close()) })
+
+	manager, updateManager, err := buildTestManager(t, store, nmdataStore)
+	require.NoError(t, err)
+	return manager, updateManager
+}
+
+func newSettingsMockManager(t testing.TB) *settings.MockManager {
+	t.Helper()
+
 	ctrl := gomock.NewController(t)
 	t.Cleanup(ctrl.Finish)
 
@@ -3301,6 +3620,29 @@ func createManager(t testing.TB) (*DefaultAccountManager, *update_channel.PeersU
 		UpdateExtraSettings(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
 		Return(false, nil).
 		AnyTimes()
+	return settingsMockManager
+}
+
+func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb.NetworkMapDBStoreImpl) (*DefaultAccountManager, *update_channel.PeersUpdateManager, error) {
+	t.Helper()
+
+	eventStore := &activity.InMemoryEventStore{}
+
+	// Everything built here watches this context; cancelling it on cleanup stops
+	// the metrics flushers, caches and controllers instead of leaking them for
+	// the rest of the package run.
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	metrics, err := telemetry.NewDefaultAppMetrics(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	ctrl := gomock.NewController(t)
+	t.Cleanup(ctrl.Finish)
+
+	settingsMockManager := newSettingsMockManager(t)
 
 	permissionsManager := permissions.NewManager(store)
 	peersManager := peers.NewManager(store, permissionsManager)
@@ -3311,22 +3653,24 @@ func createManager(t testing.TB) (*DefaultAccountManager, *update_channel.PeersU
 		Return(nil).
 		AnyTimes()
 
-	ctx := context.Background()
-
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
+	// The go-cache janitor only stops via a GC finalizer and would outlive synctest bubbles.
+	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100)
 	if err != nil {
 		return nil, nil, err
 	}
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{})
-	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nmdataStore)
+	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
+	cacheManager := manager.cacheManager
+	t.Cleanup(func() { assert.NoError(t, cacheManager.Close()) })
 
 	proxyGrpcServer := nbgrpc.NewProxyServiceServer(nil, nil, nil, nbgrpc.ProxyOIDCConfig{}, peersManager, nil, nil, proxyManager, nil)
+	t.Cleanup(proxyGrpcServer.Close)
 	proxyController, err := proxymanager.NewGRPCController(proxyGrpcServer, noop.Meter{})
 	if err != nil {
 		return nil, nil, err
@@ -3338,7 +3682,11 @@ func createManager(t testing.TB) (*DefaultAccountManager, *update_channel.PeersU
 
 func createStore(t testing.TB) (store.Store, error) {
 	t.Helper()
-	dataDir := t.TempDir()
+	return createStoreAt(t, t.TempDir())
+}
+
+func createStoreAt(t testing.TB, dataDir string) (store.Store, error) {
+	t.Helper()
 	store, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", dataDir)
 	if err != nil {
 		return nil, err
@@ -3416,6 +3764,33 @@ func setupNetworkMapTest(t *testing.T) (*DefaultAccountManager, *update_channel.
 // when the channel delivers.
 const peerUpdateTimeout = 5 * time.Second
 
+// peerUpdateSettleTime bounds how far settleAffectedUpdates advances the fake clock. It must exceed
+// the account request and peer update buffer intervals.
+const peerUpdateSettleTime = time.Second
+
+// runPeerUpdateTest runs f inside synctest.Test, so the peer update helpers observe every background
+// goroutine of the test, and lets the updates still in flight when f returns finish before the bubble
+// ends, since the bubble's clock stops with it.
+func runPeerUpdateTest(t *testing.T, f func(t *testing.T)) {
+	synctest.Test(t, func(t *testing.T) {
+		defer settleAffectedUpdates()
+		f(t)
+	})
+}
+
+// settleAffectedUpdates runs the synctest bubble's fake clock past every update buffer interval until
+// all goroutines are blocked, then discards the updates already delivered to chans, so the next
+// assertion only observes updates from the action under test. It must be called inside synctest.Test.
+func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) {
+	time.Sleep(peerUpdateSettleTime)
+	synctest.Wait()
+	for _, ch := range chans {
+		for len(ch) > 0 {
+			<-ch
+		}
+	}
+}
+
 func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) {
 	for {
 		select {
@@ -3429,6 +3804,19 @@ func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) {
 	}
 }
 
+// step runs f as one named stage of a test inside synctest.Test, which forbids t.Run, and names the
+// stage when it fails the test. Stages share t, so a fatal failure ends the remaining stages as well.
+func step(t *testing.T, name string, f func(t *testing.T)) {
+	t.Helper()
+	failedBefore := t.Failed()
+	defer func() {
+		if !failedBefore && t.Failed() {
+			t.Logf("step %q failed", name)
+		}
+	}()
+	f(t)
+}
+
 func peerShouldNotReceiveUpdate(t *testing.T, updateMessage <-chan *network_map.UpdateMessage) {
 	t.Helper()
 	select {
@@ -4066,6 +4454,27 @@ func TestDefaultAccountManager_UpdatePeerIP(t *testing.T) {
 		assert.Contains(t, err.Error(), "not within the account network range", "error should mention network range")
 	})
 
+	t.Run("update peer IP to reserved address should fail", func(t *testing.T) {
+		account, err := manager.Store.GetAccount(context.Background(), accountID)
+		require.NoError(t, err, "unable to get account")
+
+		network := account.Network.Net
+		broadcast := make(net.IP, len(network.IP.To4()))
+		for i := range broadcast {
+			broadcast[i] = network.IP.To4()[i] | ^network.Mask[i]
+		}
+		broadcastIP, ok := netip.AddrFromSlice(broadcast)
+		require.True(t, ok, "unable to parse broadcast IP")
+		networkIP, ok := netip.AddrFromSlice(network.IP.To4())
+		require.True(t, ok, "unable to parse network IP")
+
+		for _, reserved := range []netip.Addr{networkIP, broadcastIP.Prev(), broadcastIP} {
+			err = manager.UpdatePeerIP(context.Background(), accountID, userID, peer1.ID, reserved)
+			require.Error(t, err, "should fail for reserved IP %s", reserved)
+			assert.Contains(t, err.Error(), "is reserved", "error should mention reserved IP")
+		}
+	})
+
 	t.Run("update peer IP with invalid peer ID should fail", func(t *testing.T) {
 		newAddr := netip.MustParseAddr("100.64.0.101")
 		err := manager.UpdatePeerIP(context.Background(), accountID, userID, "invalid-peer-id", newAddr)
@@ -4073,6 +4482,86 @@ func TestDefaultAccountManager_UpdatePeerIP(t *testing.T) {
 	})
 }
 
+func TestDefaultAccountManager_UpdatePeerIP_ReloadsTargetingServices(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err, "unable to create account manager")
+
+	ctx := context.Background()
+	accountID, err := manager.GetAccountIDByUserID(ctx, auth.UserAuth{UserId: userID})
+	require.NoError(t, err, "unable to create an account")
+
+	key, err := wgtypes.GenerateKey()
+	require.NoError(t, err, "unable to generate WireGuard key")
+	peer, _, _, _, err := manager.AddPeer(ctx, "", "", userID, &nbpeer.Peer{
+		Key:  key.PublicKey().String(),
+		Meta: nbpeer.PeerSystemMeta{Hostname: "proxied-peer"},
+	}, false)
+	require.NoError(t, err, "unable to add peer")
+
+	account, err := manager.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err, "unable to get account")
+	network := netip.MustParsePrefix(account.Network.Net.String())
+
+	t.Run("targeted peer reloads services", func(t *testing.T) {
+		serviceManager := service.NewMockManager(gomock.NewController(t))
+		manager.SetServiceManager(serviceManager)
+		serviceManager.EXPECT().GetServiceIDByTargetID(gomock.Any(), accountID, peer.ID).Return("svc-1", nil)
+		serviceManager.EXPECT().ReloadAllServicesForAccount(gomock.Any(), accountID).Return(nil)
+
+		current, err := manager.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peer.ID)
+		require.NoError(t, err)
+		newIP, err := types.AllocatePeerIP(network, []netip.Addr{current.IP})
+		require.NoError(t, err)
+		require.NoError(t, manager.UpdatePeerIP(ctx, accountID, userID, peer.ID, newIP))
+	})
+
+	t.Run("untargeted peer skips reload", func(t *testing.T) {
+		serviceManager := service.NewMockManager(gomock.NewController(t))
+		manager.SetServiceManager(serviceManager)
+		serviceManager.EXPECT().GetServiceIDByTargetID(gomock.Any(), accountID, peer.ID).Return("", nil)
+
+		current, err := manager.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peer.ID)
+		require.NoError(t, err)
+		newIP, err := types.AllocatePeerIP(network, []netip.Addr{current.IP})
+		require.NoError(t, err)
+		require.NoError(t, manager.UpdatePeerIP(ctx, accountID, userID, peer.ID, newIP))
+	})
+
+	t.Run("lookup failure reloads services", func(t *testing.T) {
+		serviceManager := service.NewMockManager(gomock.NewController(t))
+		manager.SetServiceManager(serviceManager)
+		serviceManager.EXPECT().GetServiceIDByTargetID(gomock.Any(), accountID, peer.ID).Return("", errors.New("store unavailable"))
+		serviceManager.EXPECT().ReloadAllServicesForAccount(gomock.Any(), accountID).Return(nil)
+
+		current, err := manager.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peer.ID)
+		require.NoError(t, err)
+		newIP, err := types.AllocatePeerIP(network, []netip.Addr{current.IP})
+		require.NoError(t, err)
+		require.NoError(t, manager.UpdatePeerIP(ctx, accountID, userID, peer.ID, newIP))
+	})
+
+	t.Run("network map notification failure still reloads services", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		serviceManager := service.NewMockManager(ctrl)
+		manager.SetServiceManager(serviceManager)
+		serviceManager.EXPECT().GetServiceIDByTargetID(gomock.Any(), accountID, peer.ID).Return("svc-1", nil)
+		serviceManager.EXPECT().ReloadAllServicesForAccount(gomock.Any(), accountID).Return(nil)
+
+		originalController := manager.networkMapController
+		t.Cleanup(func() { manager.networkMapController = originalController })
+		networkMapController := network_map.NewMockController(ctrl)
+		networkMapController.EXPECT().GetDNSDomain(gomock.Any()).Return("netbird.cloud").AnyTimes()
+		networkMapController.EXPECT().OnPeersUpdated(gomock.Any(), accountID, []string{peer.ID}, gomock.Any()).Return(errors.New("notify failed"))
+		manager.networkMapController = networkMapController
+
+		current, err := manager.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peer.ID)
+		require.NoError(t, err)
+		newIP, err := types.AllocatePeerIP(network, []netip.Addr{current.IP})
+		require.NoError(t, err)
+		require.Error(t, manager.UpdatePeerIP(ctx, accountID, userID, peer.ID, newIP))
+	})
+}
+
 func TestAddNewUserToDomainAccountWithApproval(t *testing.T) {
 	manager, _, err := createManager(t)
 	if err != nil {
@@ -4230,7 +4719,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	require.Len(t, peers, len(before))
 	for _, p := range peers {
@@ -4248,7 +4737,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.Equal(t, before[p.ID], p.IP, "peer %s IP should not change for host-bit-set equivalent range", p.ID)
@@ -4262,14 +4751,14 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.Equal(t, before[p.ID], p.IP, "peer %s IP should not change when NetworkRange omitted", p.ID)
 	}
 
 	// Sanity: an actually different range still triggers reallocation.
-	newRange := netip.MustParsePrefix("100.99.0.0/16")
+	newRange := netip.MustParsePrefix("100.60.0.0/16")
 	_, err = manager.UpdateAccountSettings(ctx, account.Id, userID, &types.Settings{
 		PeerLoginExpirationEnabled: true,
 		PeerLoginExpiration:        types.DefaultPeerLoginExpiration,
@@ -4278,7 +4767,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.True(t, newRange.Contains(p.IP), "peer %s should be in new range %s, got %s", p.ID, newRange, p.IP)
@@ -4296,7 +4785,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	require.NoError(t, err)
 	require.NotEmpty(t, settings.IPv6EnabledGroups, "new account should have IPv6 enabled for All group")
 
-	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.True(t, p.IPv6.IsValid(), "peer %s should have IPv6 with All group enabled", p.ID)
@@ -4324,7 +4813,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	assert.Equal(t, []string{partialGroup.ID}, updatedSettings.IPv6EnabledGroups)
 
 	// peer1 and peer2 should have IPv6; peer3 should not.
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	peerMap := make(map[string]*nbpeer.Peer, len(peers))
 	for _, p := range peers {
@@ -4344,7 +4833,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	require.NoError(t, err)
 	assert.Empty(t, updatedSettings.IPv6EnabledGroups)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.False(t, p.IPv6.IsValid(), "peer %s should have no IPv6 when groups cleared", p.ID)
@@ -4359,7 +4848,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	peerMap = make(map[string]*nbpeer.Peer, len(peers))
 	for _, p := range peers {
@@ -4501,3 +4990,27 @@ func TestUpdateUserAuthWithSingleMode(t *testing.T) {
 		assert.Contains(t, err.Error(), "query failed")
 	})
 }
+
+func TestDefaultAccountManager_ExpirationJobsStopForDeletedAccount(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err, "unable to create account manager")
+
+	ctx := context.Background()
+	accountID, err := manager.GetAccountIDByUserID(ctx, auth.UserAuth{UserId: userID})
+	require.NoError(t, err, "unable to create an account")
+
+	account, err := manager.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err, "unable to get account")
+	require.NoError(t, manager.Store.DeleteAccount(ctx, account), "unable to delete account")
+
+	jobs := map[string]func() (time.Duration, bool){
+		"login":      manager.peerLoginExpirationJob(ctx, accountID),
+		"inactivity": manager.peerInactivityExpirationJob(ctx, accountID),
+	}
+	for name, job := range jobs {
+		t.Run(name, func(t *testing.T) {
+			_, reschedule := job()
+			assert.False(t, reschedule, "job must not reschedule for a deleted account")
+		})
+	}
+}
diff --git a/management/server/activity/codes.go b/management/server/activity/codes.go
index eaa638fac..11c309ef4 100644
--- a/management/server/activity/codes.go
+++ b/management/server/activity/codes.go
@@ -281,6 +281,17 @@ const (
 	// AccountMetricsPushDisabled indicates that a user disabled metrics push for the account
 	AccountMetricsPushDisabled Activity = 141
 
+	// AgentNetworkSettingsDeleted indicates that a user deleted the Agent Network account settings, releasing the endpoint
+	AgentNetworkSettingsDeleted Activity = 142
+
+	// CustomDomainValidationExpired indicates that an unvalidated domain registration expired.
+	CustomDomainValidationExpired Activity = 143
+
+	// AccountPeerHostnameCollisionRejectionEnabled indicates that a user enabled rejecting peer hostname collisions for the account
+	AccountPeerHostnameCollisionRejectionEnabled Activity = 144
+	// AccountPeerHostnameCollisionRejectionDisabled indicates that a user disabled rejecting peer hostname collisions for the account
+	AccountPeerHostnameCollisionRejectionDisabled Activity = 145
+
 	AccountDeleted Activity = 99999
 )
 
@@ -453,13 +464,17 @@ var activityMap = map[Activity]Code{
 	AgentNetworkBudgetRuleDeleted: {"Agent Network budget rule deleted", "agent_network.budget_rule.delete"},
 
 	AgentNetworkSettingsUpdated: {"Agent Network settings updated", "agent_network.settings.update"},
+	AgentNetworkSettingsDeleted: {"Agent Network settings deleted", "agent_network.settings.delete"},
 
-	AccountMetricsPushEnabled:  {"Account metrics push enabled", "account.setting.metrics.push.enable"},
-	AccountMetricsPushDisabled: {"Account metrics push disabled", "account.setting.metrics.push.disable"},
+	AccountMetricsPushEnabled:                     {"Account metrics push enabled", "account.setting.metrics.push.enable"},
+	AccountMetricsPushDisabled:                    {"Account metrics push disabled", "account.setting.metrics.push.disable"},
+	AccountPeerHostnameCollisionRejectionEnabled:  {"Account peer hostname collision rejection enabled", "account.setting.peer.hostname.collision.rejection.enable"},
+	AccountPeerHostnameCollisionRejectionDisabled: {"Account peer hostname collision rejection disabled", "account.setting.peer.hostname.collision.rejection.disable"},
 
-	DomainAdded:     {"Domain added", "domain.add"},
-	DomainDeleted:   {"Domain deleted", "domain.delete"},
-	DomainValidated: {"Domain validated", "domain.validate"},
+	DomainAdded:                   {"Domain added", "domain.add"},
+	DomainDeleted:                 {"Domain deleted", "domain.delete"},
+	DomainValidated:               {"Domain validated", "domain.validate"},
+	CustomDomainValidationExpired: {"Unvalidated domain registration expired", "domain.validation.expire"},
 }
 
 // StringCode returns a string code of the activity
diff --git a/management/server/activity/store/sql_store.go b/management/server/activity/store/sql_store.go
index 73e8e295c..5b0f23dd0 100644
--- a/management/server/activity/store/sql_store.go
+++ b/management/server/activity/store/sql_store.go
@@ -165,16 +165,16 @@ func (store *Store) Get(ctx context.Context, accountID string, offset, limit int
 	return store.processResult(ctx, events)
 }
 
-// Save an event in the SQLite events table end encrypt the "email" element in meta map
-func (store *Store) Save(_ context.Context, event *activity.Event) (*activity.Event, error) {
+// Save persists an activity event and encrypts deleted user details using the caller's context.
+func (store *Store) Save(ctx context.Context, event *activity.Event) (*activity.Event, error) {
 	eventCopy := event.Copy()
-	meta, err := store.saveDeletedUserEmailAndNameInEncrypted(eventCopy)
+	meta, err := store.saveDeletedUserEmailAndNameInEncrypted(ctx, eventCopy)
 	if err != nil {
 		return nil, err
 	}
 	eventCopy.Meta = meta
 
-	if err = store.db.Create(eventCopy).Error; err != nil {
+	if err = store.db.WithContext(ctx).Create(eventCopy).Error; err != nil {
 		return nil, err
 	}
 
@@ -183,7 +183,7 @@ func (store *Store) Save(_ context.Context, event *activity.Event) (*activity.Ev
 
 // saveDeletedUserEmailAndNameInEncrypted if the meta contains email and name then store it in encrypted way and delete
 // this item from meta map
-func (store *Store) saveDeletedUserEmailAndNameInEncrypted(event *activity.Event) (map[string]any, error) {
+func (store *Store) saveDeletedUserEmailAndNameInEncrypted(ctx context.Context, event *activity.Event) (map[string]any, error) {
 	email, ok := event.Meta["email"]
 	if !ok {
 		return event.Meta, nil
@@ -211,7 +211,7 @@ func (store *Store) saveDeletedUserEmailAndNameInEncrypted(event *activity.Event
 	}
 	deletedUser.Name = encryptedName
 
-	err = store.db.Clauses(clause.OnConflict{
+	err = store.db.WithContext(ctx).Clauses(clause.OnConflict{
 		Columns:   []clause.Column{{Name: "id"}},
 		DoUpdates: clause.AssignmentColumns([]string{"email", "name"}),
 	}).Create(deletedUser).Error
diff --git a/management/server/activity/store/sql_store_test.go b/management/server/activity/store/sql_store_test.go
index d723f1623..0a68858e4 100644
--- a/management/server/activity/store/sql_store_test.go
+++ b/management/server/activity/store/sql_store_test.go
@@ -7,11 +7,49 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/util/crypt"
 )
 
+func TestSave_CancellationWhileWaitingForConnection(t *testing.T) {
+	t.Setenv(storeEngineEnv, "sqlite")
+	key, err := crypt.GenerateKey()
+	require.NoError(t, err)
+	store, err := NewSqlStore(context.Background(), t.TempDir(), key)
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, store.Close(context.Background())) })
+	db, err := store.db.DB()
+	require.NoError(t, err)
+	conn, err := db.Conn(context.Background())
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	result := make(chan error, 1)
+	go func() {
+		_, err := store.Save(ctx, &activity.Event{
+			Timestamp: time.Now().UTC(), Activity: activity.CustomDomainValidationExpired,
+			AccountID: "account-id", TargetID: "domain-id", InitiatorID: activity.SystemInitiator,
+		})
+		result <- err
+	}()
+	select {
+	case err := <-result:
+		assert.ErrorIs(t, err, context.DeadlineExceeded)
+		require.NoError(t, conn.Close())
+	case <-time.After(time.Second):
+		// Release the connection so a regression cannot leave the writer running.
+		require.NoError(t, conn.Close())
+		assert.ErrorIs(t, <-result, context.DeadlineExceeded)
+		t.Error("activity writes must stop waiting when their deadline expires")
+	}
+	events, err := store.Get(context.Background(), "account-id", 0, 10, true)
+	require.NoError(t, err)
+	assert.Empty(t, events, "a timed-out write must not persist after the connection is released")
+}
+
 func TestNewSqlStore(t *testing.T) {
 	dataDir := t.TempDir()
 	key, _ := crypt.GenerateKey()
diff --git a/management/server/affected_peers_ipv6_test.go b/management/server/affected_peers_ipv6_test.go
new file mode 100644
index 000000000..c64360016
--- /dev/null
+++ b/management/server/affected_peers_ipv6_test.go
@@ -0,0 +1,243 @@
+package server
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+const (
+	ipv6GroupA = "ipv6-grp-a"
+	ipv6GroupB = "ipv6-grp-b"
+	ipv6GroupC = "ipv6-grp-c"
+	ipv6GroupD = "ipv6-grp-d"
+)
+
+// ipv6AffectedTest holds three peers: peer1 in group A, peer2 in group B, peer3 in
+// group C, with a single A<->B policy. peer3 is unrelated to peer1 and peer2. Group D
+// is empty and referenced by nothing.
+type ipv6AffectedTest struct {
+	manager                   *DefaultAccountManager
+	accountID                 string
+	peer1, peer2, peer3       *nbpeer.Peer
+	updMsg1, updMsg2, updMsg3 <-chan *network_map.UpdateMessage
+}
+
+func setupIPv6AffectedTest(t *testing.T, ipv6Groups []string) *ipv6AffectedTest {
+	t.Helper()
+
+	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	ctx := context.Background()
+	accountID := account.Id
+
+	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	for _, p := range policies {
+		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+	}
+
+	for _, g := range []*types.Group{
+		{ID: ipv6GroupA, Name: "IPv6-A", Peers: []string{peer1.ID}},
+		{ID: ipv6GroupB, Name: "IPv6-B", Peers: []string{peer2.ID}},
+		{ID: ipv6GroupC, Name: "IPv6-C", Peers: []string{peer3.ID}},
+		{ID: ipv6GroupD, Name: "IPv6-D"},
+	} {
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, g))
+	}
+
+	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+		Enabled: true,
+		Rules: []*types.PolicyRule{{
+			Enabled:       true,
+			Sources:       []string{ipv6GroupA},
+			Destinations:  []string{ipv6GroupB},
+			Bidirectional: true,
+			Action:        types.PolicyTrafficActionAccept,
+		}},
+	}, true)
+	require.NoError(t, err)
+
+	// New accounts enable IPv6 for the All group; start from the requested groups.
+	updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = ipv6Groups
+	})
+
+	tc := &ipv6AffectedTest{
+		manager:   manager,
+		accountID: accountID,
+		peer1:     peer1,
+		peer2:     peer2,
+		peer3:     peer3,
+	}
+	tc.updMsg1 = updateManager.CreateChannel(ctx, peer1.ID)
+	tc.updMsg2 = updateManager.CreateChannel(ctx, peer2.ID)
+	tc.updMsg3 = updateManager.CreateChannel(ctx, peer3.ID)
+	t.Cleanup(func() {
+		updateManager.CloseChannel(ctx, peer1.ID)
+		updateManager.CloseChannel(ctx, peer2.ID)
+		updateManager.CloseChannel(ctx, peer3.ID)
+	})
+
+	// The setup changes above dispatch asynchronously and can land after the
+	// channels open, so drop them before the test acts.
+	drainPeerUpdates(tc.updMsg1)
+	drainPeerUpdates(tc.updMsg2)
+	drainPeerUpdates(tc.updMsg3)
+
+	return tc
+}
+
+// updateIPv6TestSettings applies mutate to a copy of the current settings, so only
+// the mutated fields differ from what is stored.
+func updateIPv6TestSettings(t *testing.T, manager *DefaultAccountManager, accountID string, mutate func(*types.Settings)) {
+	t.Helper()
+	ctx := context.Background()
+
+	current, err := manager.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+
+	updated := current.Copy()
+	mutate(updated)
+
+	_, err = manager.UpdateAccountSettings(ctx, accountID, userID, updated)
+	require.NoError(t, err)
+}
+
+func (tc *ipv6AffectedTest) peerIPv6(t *testing.T, peerID string) netip.Addr {
+	t.Helper()
+	peer, err := tc.manager.Store.GetPeerByID(context.Background(), store.LockingStrengthNone, tc.accountID, peerID)
+	require.NoError(t, err)
+	return peer.IPv6
+}
+
+func TestAffectedPeers_IPv6GroupEnabled_RefreshesOnlyReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{ipv6GroupA}
+	})
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv6GroupDisabled_RefreshesOnlyReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupA})
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should start with an IPv6 address")
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{}
+	})
+	require.False(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should lose its IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+// Widening the IPv6 range keeps peer addresses, but each holder's interface prefix
+// comes from the range, so holders refresh while peers that only reach them do not.
+func TestAffectedPeers_IPv6RangeWidened_RefreshesAddressHolders(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupA})
+	oldIPv6 := tc.peerIPv6(t, tc.peer1.ID)
+	require.True(t, oldIPv6.IsValid(), "peer1 should start with an IPv6 address")
+
+	// The range is allocated on the account network; settings may leave it empty.
+	network, err := tc.manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, tc.accountID)
+	require.NoError(t, err)
+	current := prefixFromIPNet(network.NetV6)
+	require.True(t, current.IsValid(), "account should have an IPv6 range")
+	widened := netip.PrefixFrom(current.Addr(), current.Bits()-8).Masked()
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.NetworkRangeV6 = widened
+	})
+	require.Equal(t, oldIPv6, tc.peerIPv6(t, tc.peer1.ID), "peer1 should keep its address inside the widened range")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldNotReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv4RangeChange_RefreshesWholeAccount(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.NetworkRange = netip.MustParsePrefix("100.70.0.0/16")
+	})
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv6WithAccountWideChange_RefreshesWholeAccount(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{ipv6GroupA}
+		s.LazyConnectionEnabled = !s.LazyConnectionEnabled
+	})
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldReceiveUpdate(t, tc.updMsg3)
+}
+
+// Joining an IPv6-enabled group that no policy references gives peer1 an address.
+// peer2 reaches peer1 through group A, not through the joined group, and must still
+// learn the new address.
+func TestAffectedPeers_GroupAddPeerIPv6_RefreshesPeersReachingThroughOtherGroups(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+
+	require.NoError(t, tc.manager.GroupAddPeer(context.Background(), tc.accountID, ipv6GroupD, tc.peer1.ID))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_UpdateGroupIPv6_RefreshesPeersReachingThroughOtherGroups(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+
+	require.NoError(t, tc.manager.UpdateGroup(context.Background(), tc.accountID, userID, &types.Group{
+		ID:    ipv6GroupD,
+		Name:  "IPv6-D",
+		Peers: []string{tc.peer1.ID},
+	}))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+// Deleting an IPv6-enabled group removes its members' addresses after the
+// pre-delete snapshot was taken.
+func TestAffectedPeers_DeleteIPv6Group_RefreshesFormerMembersAndReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+	ctx := context.Background()
+
+	require.NoError(t, tc.manager.GroupAddPeer(ctx, tc.accountID, ipv6GroupD, tc.peer1.ID))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+	drainPeerUpdates(tc.updMsg1)
+	drainPeerUpdates(tc.updMsg2)
+	drainPeerUpdates(tc.updMsg3)
+
+	require.NoError(t, tc.manager.DeleteGroup(ctx, tc.accountID, userID, ipv6GroupD))
+	require.False(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should lose its IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
diff --git a/management/server/affected_peers_jwt_test.go b/management/server/affected_peers_jwt_test.go
new file mode 100644
index 000000000..0b0eba1c4
--- /dev/null
+++ b/management/server/affected_peers_jwt_test.go
@@ -0,0 +1,179 @@
+package server
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/management/server/affectedpeers"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/auth"
+)
+
+// A user's auto-group change refreshes the destinations of the SSH rules authorizing
+// that group — they carry the group -> user mapping — even though no peer moved
+// between groups.
+func TestAffectedPeers_UserGroupChange_RefreshesSSHAuthorizedDestinations(t *testing.T) {
+	manager, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
+	ctx := context.Background()
+
+	_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+		Enabled: true,
+		Rules: []*types.PolicyRule{
+			{
+				Enabled:          true,
+				Sources:          []string{groupIDs[0]},
+				Destinations:     []string{groupIDs[1]},
+				Protocol:         types.PolicyRuleProtocolNetbirdSSH,
+				Action:           types.PolicyTrafficActionAccept,
+				AuthorizedGroups: map[string][]string{groupIDs[3]: {"root"}},
+			},
+		},
+	}, true)
+	require.NoError(t, err)
+
+	result := resolveAffected(t, s, accountID, affectedpeers.Change{UserGroupIDs: []string{groupIDs[3]}})
+	assert.ElementsMatch(t, []string{peerIDs[1]}, result,
+		"only the SSH rule's destination peers carry the changed group -> user mapping")
+
+	result = resolveAffected(t, s, accountID, affectedpeers.Change{UserGroupIDs: []string{groupIDs[4]}})
+	assert.Empty(t, result, "a group no SSH rule authorizes affects nobody")
+}
+
+// Creating, blocking or unblocking a user changes the account's allowed-user set, which
+// reaches only the destinations of the SSH rules that ship it.
+func TestAffectedPeers_AllowedUsersChange_RefreshesSSHDestinations(t *testing.T) {
+	manager, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
+	ctx := context.Background()
+
+	// Ships the allowed-user set: an SSH rule naming no groups and no user.
+	_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+		Enabled: true,
+		Rules: []*types.PolicyRule{{
+			Enabled:      true,
+			Sources:      []string{groupIDs[0]},
+			Destinations: []string{groupIDs[1]},
+			Protocol:     types.PolicyRuleProtocolNetbirdSSH,
+			Action:       types.PolicyTrafficActionAccept,
+		}},
+	}, true)
+	require.NoError(t, err)
+
+	// Does not ship it: an SSH rule that authorizes a specific group.
+	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+		Enabled: true,
+		Rules: []*types.PolicyRule{{
+			Enabled:          true,
+			Sources:          []string{groupIDs[2]},
+			Destinations:     []string{groupIDs[3]},
+			Protocol:         types.PolicyRuleProtocolNetbirdSSH,
+			Action:           types.PolicyTrafficActionAccept,
+			AuthorizedGroups: map[string][]string{groupIDs[0]: {"root"}},
+		}},
+	}, true)
+	require.NoError(t, err)
+
+	result := resolveAffected(t, s, accountID, affectedpeers.Change{AllowedUsersChanged: true})
+	assert.ElementsMatch(t, []string{peerIDs[1]}, result,
+		"only the destinations of the rule shipping the allowed-user set refresh")
+}
+
+// TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated verifies that a JWT
+// auto-group change updates only the user's peers and the peers linked to the changed
+// group through policies, instead of fanning out to the whole account.
+func TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated(t *testing.T) {
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
+
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+		userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
+			Key:  key.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
+		}, false)
+		require.NoError(t, err)
+
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+		}
+
+		account, err = manager.Store.GetAccount(ctx, accountID)
+		require.NoError(t, err)
+		account.Settings.JWTGroupsEnabled = true
+		account.Settings.JWTGroupsClaimName = "groups"
+		account.Settings.GroupsPropagationEnabled = true
+		require.NoError(t, manager.Store.SaveAccount(ctx, account))
+
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
+
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"jwt-grp"},
+					Destinations:  []string{"jwt-dest"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		updUser := updateManager.CreateChannel(ctx, userPeer.ID)
+		upd2 := updateManager.CreateChannel(ctx, peer2.ID)
+		upd3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, userPeer.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		userAuth := auth.UserAuth{
+			AccountId: accountID,
+			UserId:    userID,
+			Groups:    []string{"jwt-linked"},
+		}
+
+		step(t, "adding JWT group updates only linked peers", func(t *testing.T) {
+			settleAffectedUpdates(updUser, upd2, upd3)
+
+			require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+
+			peerShouldReceiveUpdate(t, updUser)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+			require.NoError(t, err)
+			assert.Contains(t, user.AutoGroups, "jwt-grp")
+		})
+
+		step(t, "removing JWT group updates only linked peers", func(t *testing.T) {
+			drainPeerUpdates(updUser)
+			drainPeerUpdates(upd2)
+			drainPeerUpdates(upd3)
+
+			userAuth.Groups = nil
+			require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+
+			peerShouldReceiveUpdate(t, updUser)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+			require.NoError(t, err)
+			assert.NotContains(t, user.AutoGroups, "jwt-grp")
+		})
+	})
+}
diff --git a/management/server/affected_peers_oldstate_test.go b/management/server/affected_peers_oldstate_test.go
index bcb78a660..bfc0a51b9 100644
--- a/management/server/affected_peers_oldstate_test.go
+++ b/management/server/affected_peers_oldstate_test.go
@@ -24,120 +24,124 @@ import (
 // detaching one of them must still refresh that group's policy source peers, even
 // though the post-update resource no longer maps to it.
 func TestAffectedPeers_E2E_UpdateResource_DetachGroup_RefreshesOldGroupSources(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	// A second resource group + a second source group/peer that reaches the
-	// resource only through that second group.
-	const detachGroupID = "rs-detach-grp"
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"}))
+		// A second resource group + a second source group/peer that reaches the
+		// resource only through that second group.
+		const detachGroupID = "rs-detach-grp"
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"}))
 
-	const secondSourceGroupID = "rs-source-grp-2"
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
-		ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
-	}))
+		const secondSourceGroupID = "rs-source-grp-2"
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
+			ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
+		}))
 
-	resourcesManager, _, _ := s.managers()
+		resourcesManager, _, _ := s.managers()
 
-	// Attach the resource to the detach group as well: now in [resourceGroup, detachGroup].
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID, detachGroupID},
-		Enabled:   true,
+		// Attach the resource to the detach group as well: now in [resourceGroup, detachGroup].
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID, detachGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		// Policy granting the second source group access via the detach group.
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true)
+		require.NoError(t, err)
+
+		secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
+		t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) })
+		settleAffectedUpdates(secondSrcCh)
+
+		done := make(chan struct{})
+		go func() {
+			// Detaching the resource from detachGroup removes the second source's
+			// access; that source peer must be refreshed even though the post-update
+			// resource no longer maps to detachGroup.
+			peerShouldReceiveUpdate(t, secondSrcCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID}, // detached detachGroup
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer")
+		}
 	})
-	require.NoError(t, err)
-
-	// Policy granting the second source group access via the detach group.
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true)
-	require.NoError(t, err)
-
-	secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
-	t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) })
-	settleAffectedUpdates(secondSrcCh)
-
-	done := make(chan struct{})
-	go func() {
-		// Detaching the resource from detachGroup removes the second source's
-		// access; that source peer must be refreshed even though the post-update
-		// resource no longer maps to detachGroup.
-		peerShouldReceiveUpdate(t, secondSrcCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID}, // detached detachGroup
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer")
-	}
 }
 
 // TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer:
 // changing router.Peer within the same network must still refresh the OLD routing
 // peer, which loses its routing role.
 func TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	_, routersManager, _ := s.managers()
+		_, routersManager, _ := s.managers()
 
-	routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID)
-	require.NoError(t, err)
-	require.Len(t, routers, 1)
-	router := routers[0]
-	oldRoutingPeer := router.Peer
-	require.NotEmpty(t, oldRoutingPeer)
+		routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID)
+		require.NoError(t, err)
+		require.Len(t, routers, 1)
+		router := routers[0]
+		oldRoutingPeer := router.Peer
+		require.NotEmpty(t, oldRoutingPeer)
 
-	// A new peer to become the routing peer in place of the old one.
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		// A new peer to become the routing peer in place of the old one.
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
 
-	oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer)
-	t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) })
-	settleAffectedUpdates(oldCh)
+		oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer)
+		t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) })
+		settleAffectedUpdates(oldCh)
 
-	done := make(chan struct{})
-	go func() {
-		// The old routing peer stops serving the resource and must be refreshed.
-		peerShouldReceiveUpdate(t, oldCh)
-		close(done)
-	}()
+		done := make(chan struct{})
+		go func() {
+			// The old routing peer stops serving the resource and must be refreshed.
+			peerShouldReceiveUpdate(t, oldCh)
+			close(done)
+		}()
 
-	_, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{
-		ID:         router.ID,
-		NetworkID:  s.networkID,
-		AccountID:  s.accountID,
-		Peer:       newRoutingPeer.ID, // repoint within the same network
-		Masquerade: true,
-		Metric:     9999,
-		Enabled:    true,
+		_, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{
+			ID:         router.ID,
+			NetworkID:  s.networkID,
+			AccountID:  s.accountID,
+			Peer:       newRoutingPeer.ID, // repoint within the same network
+			Masquerade: true,
+			Metric:     9999,
+			Enabled:    true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: re-pointing the router peer did not refresh the old routing peer")
+		}
 	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: re-pointing the router peer did not refresh the old routing peer")
-	}
 }
diff --git a/management/server/affected_peers_property_test.go b/management/server/affected_peers_property_test.go
index f393465bc..b64aeb813 100644
--- a/management/server/affected_peers_property_test.go
+++ b/management/server/affected_peers_property_test.go
@@ -27,8 +27,6 @@ func allPeerMaps(t *testing.T, manager *DefaultAccountManager, accountID string)
 	account, err := manager.Store.GetAccount(ctx, accountID)
 	require.NoError(t, err)
 
-	account.InjectProxyPolicies(ctx)
-
 	validated := make(map[string]struct{}, len(account.Peers))
 	for id := range account.Peers {
 		validated[id] = struct{}{}
diff --git a/management/server/affected_peers_router_paths_test.go b/management/server/affected_peers_router_paths_test.go
index 5d83367fd..185c03ddb 100644
--- a/management/server/affected_peers_router_paths_test.go
+++ b/management/server/affected_peers_router_paths_test.go
@@ -12,6 +12,7 @@ import (
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	"github.com/netbirdio/netbird/management/server/posture"
+	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
 )
 
@@ -145,7 +146,7 @@ func TestAffectedPeers_GroupAddResource_RefreshesRoutingPeer(t *testing.T) {
 	assert.NotContains(t, affected, s.unrelatedPeerID, "unrelated peer must not be affected")
 }
 
-func (s *routerScenario) createPostureCheckGatedPolicy(t *testing.T, ctx context.Context) string {
+func (s *routerScenario) createPostureCheckGatedPolicy(t *testing.T, ctx context.Context, policy *types.Policy) string {
 	t.Helper()
 
 	check, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
@@ -156,7 +157,6 @@ func (s *routerScenario) createPostureCheckGatedPolicy(t *testing.T, ctx context
 	}, true)
 	require.NoError(t, err)
 
-	policy := peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
 	policy.SourcePostureChecks = []string{check.ID}
 	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, true)
 	require.NoError(t, err)
@@ -165,148 +165,154 @@ func (s *routerScenario) createPostureCheckGatedPolicy(t *testing.T, ctx context
 }
 
 func TestAffectedPeers_E2E_SavePostureCheck_RefreshesRoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	checkID := s.createPostureCheckGatedPolicy(t, ctx)
+		checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID))
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
+			ID:   checkID,
+			Name: "rs-min-version",
+			Checks: posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"},
+			},
+		}, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: editing a posture check did not refresh source + routing peers")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
-		ID:   checkID,
-		Name: "rs-min-version",
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"},
-		},
-	}, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: editing a posture check did not refresh source + routing peers")
-	}
 }
 
 func TestAffectedPeers_E2E_UpdateResource_DestinationResourcePolicy_RefreshesSourcePeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
 
-	resourcesManager, _, _ := s.managers()
+		resourcesManager, _, _ := s.managers()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/25",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/25",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer")
-	}
 }
 
 // A disabled sibling router routes to nobody, so updating a resource on its network
 // must NOT refresh its peer (the enabled router carries the bridge instead).
 func TestAffectedPeers_E2E_UpdateResource_DisabledSiblingRouterNotBridged(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	resourcesManager, routersManager, _ := s.managers()
+		resourcesManager, routersManager, _ := s.managers()
 
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	_, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{
-		NetworkID:  s.networkID,
-		AccountID:  s.accountID,
-		Peer:       disabledRouterPeer.ID,
-		Masquerade: true,
-		Metric:     9000,
-		Enabled:    false,
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		_, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{
+			NetworkID:  s.networkID,
+			AccountID:  s.accountID,
+			Peer:       disabledRouterPeer.ID,
+			Masquerade: true,
+			Metric:     9000,
+			Enabled:    false,
+		})
+		require.NoError(t, err)
+
+		disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID)
+		enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(disabledCh, enabledCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, enabledCh)
+			peerShouldNotReceiveUpdate(t, disabledCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/25",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout")
+		}
 	})
-	require.NoError(t, err)
-
-	disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID)
-	enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-	})
-
-	settleAffectedUpdates(disabledCh, enabledCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, enabledCh)
-		peerShouldNotReceiveUpdate(t, disabledCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/25",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout")
-	}
 }
 
 func TestAffectedPeers_GroupChange_RouterInOtherNetworkNotAffected(t *testing.T) {
@@ -338,3 +344,65 @@ func TestAffectedPeers_PeerChange_RouterInOtherNetworkNotAffected(t *testing.T)
 	assert.NotContains(t, affected, second.routerPeerID,
 		"a router in an unrelated network must not be affected by a source-peer change for another resource")
 }
+
+// TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer drives the customer path
+// on the twin store: the source peer's metadata flips a posture verdict on sync,
+// and the routing peer serving the gated resource must be refreshed in both
+// directions. Without the flip detection the deny direction takes the nmap
+// shortcut (the denied peer's map holds no router) and the allow direction
+// depends on which meta field moved, leaving the routers with a stale map.
+func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) {
+	runPeerUpdateTest(t, func(t *testing.T) {
+		runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
+			return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
+		})
+	})
+}
+
+// TestAffectedPeers_E2E_PostureFlip_DirectSourcePeer_RefreshesRoutingPeer is the same
+// scenario with the source peer named directly in the rule: it must receive its posture
+// checks and have its flips detected exactly like a group member.
+func TestAffectedPeers_E2E_PostureFlip_DirectSourcePeer_RefreshesRoutingPeer(t *testing.T) {
+	runPeerUpdateTest(t, func(t *testing.T) {
+		runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
+			return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID)
+		})
+	})
+}
+
+func runPostureFlipRefreshesRoutingPeer(t *testing.T, policyFor func(s *routerScenario) *types.Policy) {
+	t.Helper()
+
+	manager, updateManager := createManagerWithNetworkMapStore(t)
+	s := buildRouterScenario(t, manager, updateManager, true)
+	ctx := context.Background()
+
+	s.createPostureCheckGatedPolicy(t, ctx, policyFor(s))
+
+	source, err := s.manager.Store.GetPeerByID(ctx, store.LockingStrengthNone, s.accountID, s.sourcePeerID)
+	require.NoError(t, err)
+
+	syncWithVersion := func(version string) {
+		meta := source.Meta
+		meta.WtVersion = version
+		_, _, _, _, err := s.manager.SyncPeer(ctx, types.PeerSync{WireGuardPubKey: source.Key, Meta: meta}, s.accountID)
+		require.NoError(t, err)
+	}
+	syncWithVersion("0.31.0")
+
+	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+	t.Cleanup(func() {
+		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+	})
+	settleAffectedUpdates(routerCh, unrelatedCh)
+
+	syncWithVersion("0.29.0")
+	peerShouldReceiveUpdate(t, routerCh)
+	peerShouldNotReceiveUpdate(t, unrelatedCh)
+
+	syncWithVersion("0.31.0")
+	peerShouldReceiveUpdate(t, routerCh)
+	peerShouldNotReceiveUpdate(t, unrelatedCh)
+}
diff --git a/management/server/affected_peers_router_test.go b/management/server/affected_peers_router_test.go
index cc9df0a6a..e2bdff4ad 100644
--- a/management/server/affected_peers_router_test.go
+++ b/management/server/affected_peers_router_test.go
@@ -8,7 +8,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
 	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	"github.com/netbirdio/netbird/management/server/groups"
@@ -60,6 +59,12 @@ func setupRouterScenario(t *testing.T, directRouterPeer bool) *routerScenario {
 	manager, updateManager, err := createManager(t)
 	require.NoError(t, err)
 
+	return buildRouterScenario(t, manager, updateManager, directRouterPeer)
+}
+
+func buildRouterScenario(t *testing.T, manager *DefaultAccountManager, updateManager *update_channel.PeersUpdateManager, directRouterPeer bool) *routerScenario {
+	t.Helper()
+
 	ctx := context.Background()
 
 	account, err := createAccount(manager, "router_scenario", userID, "")
@@ -167,6 +172,23 @@ func peerToResourcePolicyByGroup(sourceGroupID, resourceGroupID string) *types.P
 	}
 }
 
+// peerToResourcePolicyByPeer builds a policy naming the source peer directly via
+// SourceResource rather than through a group.
+func peerToResourcePolicyByPeer(sourcePeerID, resourceGroupID string) *types.Policy {
+	return &types.Policy{
+		Enabled: true,
+		Name:    "peer-to-resource-by-peer",
+		Rules: []*types.PolicyRule{
+			{
+				Enabled:        true,
+				SourceResource: types.Resource{ID: sourcePeerID, Type: types.ResourceTypePeer},
+				Destinations:   []string{resourceGroupID},
+				Action:         types.PolicyTrafficActionAccept,
+			},
+		},
+	}
+}
+
 // peerToResourcePolicyByResource builds a policy referencing the resource
 // directly via DestinationResource rather than its group.
 func peerToResourcePolicyByResource(sourceGroupID, resourceID string) *types.Policy {
@@ -297,190 +319,189 @@ func TestAffectedPeers_PolicyToResource_UnrelatedPeerNotAffected(t *testing.T) {
 }
 
 func TestAffectedPeers_ResourceSideBridgesToRoutingPeer_DirectRouter(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	// A pre-existing policy grants the source group access to the resource.
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		// A pre-existing policy grants the source group access to the resource.
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	// Drive an update through the resource manager and assert the routing peer
-	// is among the affected set by observing the channel. This path walks
-	// policies whose destinations reference the resource's groups, folds in the
-	// source groups, and loads the network's routers, so it reaches both the
-	// source peer and the routing peer.
-	permissionsManager := permissions.NewManager(s.manager.Store)
-	groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager)
-	rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager)
+		// Drive an update through the resource manager and assert the routing peer
+		// is among the affected set by observing the channel. This path walks
+		// policies whose destinations reference the resource's groups, folds in the
+		// source groups, and loads the network's routers, so it reaches both the
+		// source peer and the routing peer.
+		permissionsManager := permissions.NewManager(s.manager.Store)
+		groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager)
+		rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: resource update did not refresh source peer + routing peer")
+		}
 	})
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: resource update did not refresh source peer + routing peer")
-	}
-}
-
-// settleAffectedUpdates waits for in-flight async updates to arrive, then drains
-// every given channel so subsequent assertions start from a clean slate.
-//
-// Setup (CreateNetwork/CreateResource/CreateRouter) fires async UpdateAffectedPeers
-// goroutines; draining first means the assertion only observes updates from the
-// action under test, not setup stragglers.
-func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) {
-	time.Sleep(300 * time.Millisecond)
-	for _, ch := range chans {
-		drainPeerUpdates(ch)
-	}
 }
 
 func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_DirectRouter(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: creating peer->resource policy did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: creating peer->resource policy did not refresh the routing peer")
-	}
 }
 
 func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_RouterPeerGroups(t *testing.T) {
-	s := setupRouterScenario(t, false)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, false)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create")
-	}
 }
 
 func TestAffectedPeers_E2E_DestResource_RoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: routing peer not refreshed when policy targets DestinationResource")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: routing peer not refreshed when policy targets DestinationResource")
-	}
 }
 
 func TestAffectedPeers_E2E_DeletePolicy_RoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID))
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: deleting peer->resource policy did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID))
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: deleting peer->resource policy did not refresh the routing peer")
-	}
 }
 
 func (s *routerScenario) managers() (resources.Manager, routers.Manager, networks.Manager) {
@@ -549,113 +570,119 @@ func (s *routerScenario) addSecondTopology(t *testing.T, suffix string) secondTo
 }
 
 func TestAffectedPeers_E2E_UpdatePolicy_BothRoutingPeers(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	second := s.addSecondTopology(t, "b")
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		second := s.addSecondTopology(t, "b")
+		ctx := context.Background()
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, second.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, second.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerACh, routerBCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerACh)
+			peerShouldReceiveUpdate(t, routerBCh)
+			close(done)
+		}()
+
+		policy.Rules[0].Destinations = []string{second.resourceGroupID}
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: re-pointing the policy destination did not refresh both routing peers")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerACh, routerBCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerACh)
-		peerShouldReceiveUpdate(t, routerBCh)
-		close(done)
-	}()
-
-	policy.Rules[0].Destinations = []string{second.resourceGroupID}
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: re-pointing the policy destination did not refresh both routing peers")
-	}
 }
 
 func TestAffectedPeers_E2E_UpdatePolicy_AddSource(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	const secondSourceGroupID = "rs-source-grp-2"
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
-		ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
-	}))
+		const secondSourceGroupID = "rs-source-grp-2"
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
+			ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
+		}))
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, secondSourcePeer.ID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, secondSourcePeer.ID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(newSrcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, newSrcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID}
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: adding a source group did not refresh the new source peer + routing peer")
+		}
 	})
-
-	settleAffectedUpdates(newSrcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, newSrcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID}
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: adding a source group did not refresh the new source peer + routing peer")
-	}
 }
 
 func TestAffectedPeers_E2E_DestResource_RouterPeerGroups(t *testing.T) {
-	s := setupRouterScenario(t, false)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, false)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer")
-	}
 }
 
 func TestAffectedPeers_AllRoutingPeers_Network(t *testing.T) {
diff --git a/management/server/affected_peers_test.go b/management/server/affected_peers_test.go
index 235128693..90408f70a 100644
--- a/management/server/affected_peers_test.go
+++ b/management/server/affected_peers_test.go
@@ -955,73 +955,77 @@ func TestAffectedPeers_IsolatedRouteAndPolicy(t *testing.T) {
 }
 
 func TestAffectedPeers_GroupUpdateOnlyAffectsLinkedPeers(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "ap-grpA", Name: "AP-A", Peers: []string{peer1.ID}},
-		{ID: "ap-grpB", Name: "AP-B", Peers: []string{peer2.ID}},
-		{ID: "ap-grpC", Name: "AP-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"ap-grpA"},
-				Destinations:  []string{"ap-grpB"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	result := manager.resolveAffectedPeersForPeerChanges(ctx, manager.Store, accountID, []string{peer1.ID})
-	assert.ElementsMatch(t, []string{peer1.ID, peer2.ID}, result)
-
-	t.Run("group change updates all peers in policy groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
-			ID:    "ap-grpA",
-			Name:  "AP-A",
-			Peers: []string{peer1.ID, peer3.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "ap-grpA", Name: "AP-A", Peers: []string{peer1.ID}},
+			{ID: "ap-grpB", Name: "AP-B", Peers: []string{peer2.ID}},
+			{ID: "ap-grpC", Name: "AP-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"ap-grpA"},
+					Destinations:  []string{"ap-grpB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		result := manager.resolveAffectedPeersForPeerChanges(ctx, manager.Store, accountID, []string{peer1.ID})
+		assert.ElementsMatch(t, []string{peer1.ID, peer2.ID}, result)
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "group change updates all peers in policy groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "ap-grpA",
+				Name:  "AP-A",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
@@ -1037,243 +1041,259 @@ func TestAffectedPeers_UnlinkedPeerChange_RefreshesSelfOnly(t *testing.T) {
 // TestAffectedPeers_PolicyChange_UnrelatedPeerNoUpdate verifies that creating/deleting a
 // policy only sends updates to peers in the policy's groups, not to unrelated peers.
 func TestAffectedPeers_PolicyChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "pol-grpA", Name: "Pol-A", Peers: []string{peer1.ID}},
-		{ID: "pol-grpB", Name: "Pol-B", Peers: []string{peer2.ID}},
-		{ID: "pol-grpC", Name: "Pol-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("create policy only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"pol-grpA"},
-					Destinations:  []string{"pol-grpB"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
-			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "pol-grpA", Name: "Pol-A", Peers: []string{peer1.ID}},
+			{ID: "pol-grpB", Name: "Pol-B", Peers: []string{peer2.ID}},
+			{ID: "pol-grpC", Name: "Pol-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "create policy only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"pol-grpA"},
+						Destinations:  []string{"pol-grpB"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_RouteChange_UnrelatedPeerNoUpdate verifies that creating a route
 // only sends updates to peers in the route's groups, not to unrelated peers.
 func TestAffectedPeers_RouteChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "rt-grpA", Name: "Rt-A", Peers: []string{peer1.ID}},
-		{ID: "rt-grpB", Name: "Rt-B", Peers: []string{peer2.ID}},
-		{ID: "rt-grpC", Name: "Rt-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("create route only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(ctx, accountID,
-			netip.MustParsePrefix("10.10.0.0/24"),
-			route.IPv4Network,
-			nil,
-			"",
-			[]string{"rt-grpA"},
-			"test route",
-			"routenoaffect",
-			false,
-			9999,
-			[]string{"rt-grpB"},
-			nil,
-			true,
-			userID,
-			false,
-			false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "rt-grpA", Name: "Rt-A", Peers: []string{peer1.ID}},
+			{ID: "rt-grpB", Name: "Rt-B", Peers: []string{peer2.ID}},
+			{ID: "rt-grpC", Name: "Rt-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "create route only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(ctx, accountID,
+				netip.MustParsePrefix("10.10.0.0/24"),
+				route.IPv4Network,
+				nil,
+				"",
+				[]string{"rt-grpA"},
+				"test route",
+				"routenoaffect",
+				false,
+				9999,
+				[]string{"rt-grpB"},
+				nil,
+				true,
+				userID,
+				false,
+				false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_NameServerChange_UnrelatedPeerNoUpdate verifies that creating a
 // nameserver group only sends updates to peers in its groups, not to unrelated peers.
 func TestAffectedPeers_NameServerChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "ns-grpA", Name: "NS-A", Peers: []string{peer1.ID}},
-		{ID: "ns-grpB", Name: "NS-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("create nameserver group only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		_, err := manager.CreateNameServerGroup(ctx, accountID, "ns-unrelated", "NS Unrelated",
-			[]nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"ns-grpA"},
-			true, nil, true, userID, false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "ns-grpA", Name: "NS-A", Peers: []string{peer1.ID}},
+			{ID: "ns-grpB", Name: "NS-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "create nameserver group only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			_, err := manager.CreateNameServerGroup(ctx, accountID, "ns-unrelated", "NS Unrelated",
+				[]nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"ns-grpA"},
+				true, nil, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate verifies that changing DNS
 // settings only sends updates to peers in the affected groups, not to unrelated peers.
 func TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "dns-grpA", Name: "DNS-A", Peers: []string{peer1.ID}},
-		{ID: "dns-grpB", Name: "DNS-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("dns settings change only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(ctx, accountID, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"dns-grpA"},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "dns-grpA", Name: "DNS-A", Peers: []string{peer1.ID}},
+			{ID: "dns-grpB", Name: "DNS-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "dns settings change only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(ctx, accountID, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"dns-grpA"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
@@ -1281,429 +1301,451 @@ func TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate(t *testing.T) {
 // updating a group that is NOT referenced by any policy/route/ns/dns should not send
 // updates to any peer.
 func TestAffectedPeers_UnlinkedGroupChange_NoUpdateIntegration(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
+		}
 
-	err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
-		ID:    "unlinked-grp",
-		Name:  "Unlinked",
-		Peers: []string{peer1.ID},
-	})
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("updating unlinked group sends no peer updates", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+		err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
 			ID:    "unlinked-grp",
 			Name:  "Unlinked",
-			Peers: []string{peer1.ID, peer2.ID},
+			Peers: []string{peer1.ID},
 		})
-		assert.NoError(t, err)
+		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
-		}
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "updating unlinked group sends no peer updates", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "unlinked-grp",
+				Name:  "Unlinked",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_NetworkRouterUnlinkedPeerNoUpdate: a network router with peer
 // groups updates only those groups' peers (and resource policy sources), not others.
 func TestAffectedPeers_NetworkRouterUnlinkedPeerNoUpdate(t *testing.T) {
-	// Delete the default policy before adding peers so AddPeer schedules no async
-	// update that races with the test.
-	manager, updateManager, err := createManager(t)
-	require.NoError(t, err)
-
-	ctx := context.Background()
-
-	account, err := createAccount(manager, "nr_test_account", userID, "")
-	require.NoError(t, err)
-	accountID := account.Id
-
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		// Delete the default policy before adding peers so AddPeer schedules no async
+		// update that races with the test.
+		manager, updateManager, err := createManager(t)
 		require.NoError(t, err)
-	}
 
-	setupKey, err := manager.CreateSetupKey(ctx, accountID, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
+		ctx := context.Background()
 
-	peer1 := addPeerToAccount(t, manager, accountID, setupKey.Key)
-	peer2 := addPeerToAccount(t, manager, accountID, setupKey.Key)
-	peer3 := addPeerToAccount(t, manager, accountID, setupKey.Key)
-
-	for _, g := range []*types.Group{
-		{ID: "nr-grpA", Name: "NR-A", Peers: []string{peer1.ID}},
-		{ID: "nr-grpB", Name: "NR-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
+		account, err := createAccount(manager, "nr_test_account", userID, "")
 		require.NoError(t, err)
-	}
+		accountID := account.Id
 
-	net1 := &networkTypes.Network{
-		ID:        "nr-net-test",
-		AccountID: accountID,
-		Name:      "nr-test-network",
-	}
-	err = manager.Store.SaveNetwork(ctx, net1)
-	require.NoError(t, err)
-
-	err = manager.Store.CreateNetworkRouter(ctx, &routerTypes.NetworkRouter{
-		ID:         "nr-router-test",
-		NetworkID:  net1.ID,
-		AccountID:  accountID,
-		PeerGroups: []string{"nr-grpA"},
-		Enabled:    true,
-	})
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("network router group change only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err = manager.UpdateGroup(ctx, accountID, userID, &types.Group{
-			ID:    "nr-grpA",
-			Name:  "NR-A",
-			Peers: []string{peer1.ID, peer3.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		setupKey, err := manager.CreateSetupKey(ctx, accountID, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+
+		peer1 := addPeerToAccount(t, manager, accountID, setupKey.Key)
+		peer2 := addPeerToAccount(t, manager, accountID, setupKey.Key)
+		peer3 := addPeerToAccount(t, manager, accountID, setupKey.Key)
+
+		for _, g := range []*types.Group{
+			{ID: "nr-grpA", Name: "NR-A", Peers: []string{peer1.ID}},
+			{ID: "nr-grpB", Name: "NR-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		net1 := &networkTypes.Network{
+			ID:        "nr-net-test",
+			AccountID: accountID,
+			Name:      "nr-test-network",
+		}
+		err = manager.Store.SaveNetwork(ctx, net1)
+		require.NoError(t, err)
+
+		err = manager.Store.CreateNetworkRouter(ctx, &routerTypes.NetworkRouter{
+			ID:         "nr-router-test",
+			NetworkID:  net1.ID,
+			AccountID:  accountID,
+			PeerGroups: []string{"nr-grpA"},
+			Enabled:    true,
+		})
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "network router group change only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "nr-grpA",
+				Name:  "NR-A",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_IsolatedEntitiesOnlyAffectTheirPeers: with a policy (peer1<->peer2)
 // and a separate route (peer3), changing one entity's groups affects only its peers.
 func TestAffectedPeers_IsolatedEntitiesOnlyAffectTheirPeers(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "iso-grpA", Name: "ISO-A", Peers: []string{peer1.ID}},
-		{ID: "iso-grpB", Name: "ISO-B", Peers: []string{peer2.ID}},
-		{ID: "iso-grpC", Name: "ISO-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"iso-grpA"},
-				Destinations:  []string{"iso-grpB"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	_, err = manager.CreateRoute(ctx, accountID,
-		netip.MustParsePrefix("10.20.0.0/24"),
-		route.IPv4Network,
-		nil,
-		"",
-		[]string{"iso-grpC"},
-		"isolated route",
-		"isonet2",
-		false,
-		9999,
-		[]string{"iso-grpC"},
-		nil,
-		true,
-		userID,
-		false,
-		false,
-	)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	// The setup policy/route above dispatch affected-peer updates asynchronously;
-	// drain any in-flight ones so the assertions only observe the UpdateGroup below.
-	settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
-
-	t.Run("policy group change does not affect route-only peer", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
-			ID:    "iso-grpA",
-			Name:  "ISO-A-updated",
-			Peers: []string{peer1.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "iso-grpA", Name: "ISO-A", Peers: []string{peer1.ID}},
+			{ID: "iso-grpB", Name: "ISO-B", Peers: []string{peer2.ID}},
+			{ID: "iso-grpC", Name: "ISO-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"iso-grpA"},
+					Destinations:  []string{"iso-grpB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		_, err = manager.CreateRoute(ctx, accountID,
+			netip.MustParsePrefix("10.20.0.0/24"),
+			route.IPv4Network,
+			nil,
+			"",
+			[]string{"iso-grpC"},
+			"isolated route",
+			"isonet2",
+			false,
+			9999,
+			[]string{"iso-grpC"},
+			nil,
+			true,
+			userID,
+			false,
+			false,
+		)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		// The setup policy/route above dispatch affected-peer updates asynchronously;
+		// drain any in-flight ones so the assertions only observe the UpdateGroup below.
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "policy group change does not affect route-only peer", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "iso-grpA",
+				Name:  "ISO-A-updated",
+				Peers: []string{peer1.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DeleteRoute_UnrelatedPeerNoUpdate verifies that deleting a route
 // only sends updates to peers in the route's groups.
 func TestAffectedPeers_DeleteRoute_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "del-rt-grpA", Name: "Del-Rt-A", Peers: []string{peer1.ID}},
-		{ID: "del-rt-grpB", Name: "Del-Rt-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	newRoute, err := manager.CreateRoute(ctx, accountID,
-		netip.MustParsePrefix("10.30.0.0/24"),
-		route.IPv4Network,
-		nil,
-		"",
-		[]string{"del-rt-grpA"},
-		"deletable route",
-		"delnet",
-		false,
-		9999,
-		[]string{"del-rt-grpB"},
-		nil,
-		true,
-		userID,
-		false,
-		false,
-	)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("delete route only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.DeleteRoute(ctx, accountID, newRoute.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "del-rt-grpA", Name: "Del-Rt-A", Peers: []string{peer1.ID}},
+			{ID: "del-rt-grpB", Name: "Del-Rt-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		newRoute, err := manager.CreateRoute(ctx, accountID,
+			netip.MustParsePrefix("10.30.0.0/24"),
+			route.IPv4Network,
+			nil,
+			"",
+			[]string{"del-rt-grpA"},
+			"deletable route",
+			"delnet",
+			false,
+			9999,
+			[]string{"del-rt-grpB"},
+			nil,
+			true,
+			userID,
+			false,
+			false,
+		)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "delete route only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.DeleteRoute(ctx, accountID, newRoute.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DeletePolicy_UnrelatedPeerNoUpdate verifies that deleting a policy
 // only sends updates to peers in the policy's groups.
 func TestAffectedPeers_DeletePolicy_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "del-pol-grpA", Name: "Del-Pol-A", Peers: []string{peer1.ID}},
-		{ID: "del-pol-grpB", Name: "Del-Pol-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	policy, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"del-pol-grpA"},
-				Destinations:  []string{"del-pol-grpB"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("delete policy only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(ctx, accountID, policy.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "del-pol-grpA", Name: "Del-Pol-A", Peers: []string{peer1.ID}},
+			{ID: "del-pol-grpB", Name: "Del-Pol-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		policy, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"del-pol-grpA"},
+					Destinations:  []string{"del-pol-grpB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "delete policy only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(ctx, accountID, policy.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DeleteNameServer_UnrelatedPeerNoUpdate verifies that deleting a
 // nameserver group only sends updates to peers in its groups.
 func TestAffectedPeers_DeleteNameServer_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
-		ID:    "del-ns-grpA",
-		Name:  "Del-NS-A",
-		Peers: []string{peer1.ID},
-	})
-	require.NoError(t, err)
-
-	nsGroup, err := manager.CreateNameServerGroup(ctx, accountID, "del-ns", "Del NS",
-		[]nbdns.NameServer{{
-			IP:     netip.MustParseAddr("8.8.4.4"),
-			NSType: nbdns.UDPNameServerType,
-			Port:   nbdns.DefaultDNSPort,
-		}},
-		[]string{"del-ns-grpA"},
-		true, nil, true, userID, false,
-	)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("delete nameserver group only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.DeleteNameServerGroup(ctx, accountID, nsGroup.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
+			ID:    "del-ns-grpA",
+			Name:  "Del-NS-A",
+			Peers: []string{peer1.ID},
+		})
+		require.NoError(t, err)
+
+		nsGroup, err := manager.CreateNameServerGroup(ctx, accountID, "del-ns", "Del NS",
+			[]nbdns.NameServer{{
+				IP:     netip.MustParseAddr("8.8.4.4"),
+				NSType: nbdns.UDPNameServerType,
+				Port:   nbdns.DefaultDNSPort,
+			}},
+			[]string{"del-ns-grpA"},
+			true, nil, true, userID, false,
+		)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "delete nameserver group only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.DeleteNameServerGroup(ctx, accountID, nsGroup.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
diff --git a/management/server/affected_peers_user_test.go b/management/server/affected_peers_user_test.go
new file mode 100644
index 000000000..3f4658de4
--- /dev/null
+++ b/management/server/affected_peers_user_test.go
@@ -0,0 +1,168 @@
+package server
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/management/server/activity"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// A user update refreshes only the peers its auto-group change reaches, and a user
+// update that changes no group membership refreshes nobody.
+func TestAffectedPeers_SaveUser_OnlyAffectedPeersUpdated(t *testing.T) {
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
+
+		const targetUserID = "target-user"
+		require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
+			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+		}))
+
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+		targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
+			Key:  key.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
+		}, false)
+		require.NoError(t, err)
+
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+		}
+
+		account, err = manager.Store.GetAccount(ctx, accountID)
+		require.NoError(t, err)
+		account.Settings.GroupsPropagationEnabled = true
+		require.NoError(t, manager.Store.SaveAccount(ctx, account))
+
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
+
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"ug-linked"},
+					Destinations:  []string{"ug-dest"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
+		upd2 := updateManager.CreateChannel(ctx, peer2.ID)
+		upd3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, targetPeer.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		step(t, "auto group change updates only linked peers", func(t *testing.T) {
+			settleAffectedUpdates(updTarget, upd2, upd3)
+
+			_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked"},
+			})
+			require.NoError(t, err)
+
+			peerShouldReceiveUpdate(t, updTarget)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+		})
+
+		step(t, "update without group changes refreshes nobody", func(t *testing.T) {
+			drainPeerUpdates(updTarget)
+			drainPeerUpdates(upd2)
+			drainPeerUpdates(upd3)
+
+			_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			peerShouldNotReceiveUpdate(t, updTarget)
+			peerShouldNotReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+			require.NoError(t, err)
+			assert.Equal(t, "renamed", user.Name)
+		})
+
+		step(t, "auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
+
+			require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))// Apply through the settings API so the reconciliation that strips the other
+		// peers' addresses happens here, leaving the target as the only peer the
+		// user update reassigns.
+		updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) {
+			s.IPv6EnabledGroups = []string{"ug-v6"}
+		})
+
+			settleAffectedUpdates(updTarget, upd2, upd3)
+
+			_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			// The reassigned peer refreshes with everyone it can reach: peer2 via the
+			// policy, but not peer3, which shares no group or policy with it.
+			peerShouldReceiveUpdate(t, updTarget)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+		})
+
+		step(t, "unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
+			// An SSH rule that authorizes no group of its own ships the account's
+			// allowed-user set to its destinations, so those are the peers an unblock
+			// reaches — not the whole account.
+			_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{{
+					Enabled:      true,
+					Sources:      []string{"ug-linked"},
+					Destinations: []string{"ug-dest"},
+					Protocol:     types.PolicyRuleProtocolNetbirdSSH,
+					Action:       types.PolicyTrafficActionAccept,
+				}},
+			}, true)
+			require.NoError(t, err)
+
+			blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+			require.NoError(t, err)
+			blocked.Blocked = true
+			require.NoError(t, manager.Store.SaveUser(ctx, blocked))
+
+			settleAffectedUpdates(updTarget, upd2, upd3)
+
+			// Same auto-groups as the previous subtest left them, so no group change and
+			// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
+			_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+		})
+	})
+}
diff --git a/management/server/affected_peers_zone_test.go b/management/server/affected_peers_zone_test.go
new file mode 100644
index 000000000..4d622325c
--- /dev/null
+++ b/management/server/affected_peers_zone_test.go
@@ -0,0 +1,145 @@
+package server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	"github.com/netbirdio/netbird/management/server/affectedpeers"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+const affectedZoneDomain = "zone.test"
+
+// createAffectedZone stores a zone distributed to the given groups, optionally with
+// one A record so the network map actually ships it.
+func createAffectedZone(t *testing.T, s store.Store, accountID, domain string, enabled, withRecord bool, groups []string) *zones.Zone {
+	t.Helper()
+	ctx := context.Background()
+
+	zone := zones.NewZone(accountID, domain, domain, enabled, false, groups)
+	require.NoError(t, s.CreateZone(ctx, zone))
+
+	if withRecord {
+		record := records.NewRecord(accountID, zone.ID, "host."+domain, records.RecordTypeA, "10.0.0.1", 300)
+		require.NoError(t, s.CreateDNSRecord(ctx, record))
+	}
+
+	return zone
+}
+
+func TestCollectGroupChange_ZoneLinked(t *testing.T) {
+	_, s, accountID, _, groupIDs := setupAffectedPeersTest(t)
+	ctx := context.Background()
+
+	createAffectedZone(t, s, accountID, affectedZoneDomain, true, true, []string{groupIDs[0]})
+
+	groups, _ := collectGroupChangeAffectedGroups(ctx, s, accountID, []string{groupIDs[0]})
+	assert.Contains(t, groups, groupIDs[0], "group distributed a zone should be affected by its own change")
+
+	groups, _ = collectGroupChangeAffectedGroups(ctx, s, accountID, []string{groupIDs[1]})
+	assert.Empty(t, groups, "group not referenced by any zone should not be affected")
+}
+
+func TestCollectGroupChange_UnshippedZoneNotLinked(t *testing.T) {
+	_, s, accountID, _, groupIDs := setupAffectedPeersTest(t)
+	ctx := context.Background()
+
+	// Disabled zone and zone without records are never shipped by the network map.
+	createAffectedZone(t, s, accountID, "disabled."+affectedZoneDomain, false, true, []string{groupIDs[0]})
+	createAffectedZone(t, s, accountID, "empty."+affectedZoneDomain, true, false, []string{groupIDs[1]})
+
+	groups, _ := collectGroupChangeAffectedGroups(ctx, s, accountID, []string{groupIDs[0], groupIDs[1]})
+	assert.Empty(t, groups, "groups referenced only by unshipped zones should not be affected")
+}
+
+func TestResolveAffectedPeers_ZoneGroupMembershipChange(t *testing.T) {
+	_, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
+
+	createAffectedZone(t, s, accountID, affectedZoneDomain, true, true, []string{groupIDs[0]})
+
+	// Same change shape UpdateGroup builds: the group changed as a whole and peer1
+	// left it, so peer1 must refresh to drop the zone.
+	change := affectedpeers.Change{
+		ChangedGroupIDs:     []string{groupIDs[0]},
+		RemovedPeersByGroup: map[string][]string{groupIDs[0]: {peerIDs[1]}},
+	}
+
+	result := resolveAffected(t, s, accountID, change)
+	assert.ElementsMatch(t, []string{peerIDs[0], peerIDs[1]}, result, "current and removed members of the zone group should be affected")
+}
+
+func TestResolveAffectedPeers_ZoneDistributionChange(t *testing.T) {
+	_, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
+
+	// Zone create/update/delete passes old and new distribution groups.
+	change := affectedpeers.Change{DistributionGroupIDs: []string{groupIDs[0], groupIDs[2]}}
+
+	result := resolveAffected(t, s, accountID, change)
+	assert.ElementsMatch(t, []string{peerIDs[0], peerIDs[2]}, result, "only members of the distribution groups should be affected")
+}
+
+// TestAffectedPeers_ZoneGroupUpdate_NewMemberReceivesZone verifies that adding a peer
+// to a group referenced only by a zone pushes the zone to the new member and leaves
+// unrelated peers alone.
+func TestAffectedPeers_ZoneGroupUpdate_NewMemberReceivesZone(t *testing.T) {
+	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	ctx := context.Background()
+	accountID := account.Id
+
+	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	for _, p := range policies {
+		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+	}
+
+	zoneGroup := &types.Group{ID: "zone-grp", Name: "ZoneGroup", Peers: []string{peer1.ID}}
+	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, zoneGroup))
+
+	createAffectedZone(t, manager.Store, accountID, affectedZoneDomain, true, true, []string{zoneGroup.ID})
+
+	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+	t.Cleanup(func() {
+		updateManager.CloseChannel(ctx, peer1.ID)
+		updateManager.CloseChannel(ctx, peer2.ID)
+		updateManager.CloseChannel(ctx, peer3.ID)
+	})
+
+	zoneGroup.Peers = []string{peer1.ID, peer2.ID}
+	require.NoError(t, manager.UpdateGroup(ctx, accountID, userID, zoneGroup))
+
+	peerShouldReceiveUpdate(t, updMsg1)
+	msg := receivePeerUpdate(t, updMsg2)
+	assert.True(t, syncHasCustomZone(msg, affectedZoneDomain+"."), "new zone group member should receive the zone")
+	peerShouldNotReceiveUpdate(t, updMsg3)
+}
+
+func receivePeerUpdate(t *testing.T, ch <-chan *network_map.UpdateMessage) *network_map.UpdateMessage {
+	t.Helper()
+	select {
+	case msg := <-ch:
+		require.NotNil(t, msg, "update message should not be nil")
+		return msg
+	case <-time.After(peerUpdateTimeout):
+		require.FailNow(t, "timed out waiting for update message")
+		return nil
+	}
+}
+
+func syncHasCustomZone(msg *network_map.UpdateMessage, domain string) bool {
+	for _, zone := range msg.Update.GetNetworkMap().GetDNSConfig().GetCustomZones() {
+		if zone.GetDomain() == domain {
+			return true
+		}
+	}
+	return false
+}
diff --git a/management/server/affectedpeers/resolver.go b/management/server/affectedpeers/resolver.go
index 16a795539..f6946639d 100644
--- a/management/server/affectedpeers/resolver.go
+++ b/management/server/affectedpeers/resolver.go
@@ -18,9 +18,11 @@ import (
 	"context"
 
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -49,6 +51,7 @@ type Snapshot struct {
 	policies       []*types.Policy
 	routes         []*route.Route
 	nsGroups       []*nbdns.NameServerGroup
+	zones          []*zones.Zone
 	dnsSettings    *types.DNSSettings
 	routers        []*routerTypes.NetworkRouter
 	resources      []*resourceTypes.NetworkResource
@@ -83,7 +86,7 @@ func (snap *Snapshot) loadCollections(ctx context.Context, s store.Store, accoun
 	hasGroupOrPeerChange := len(c.ChangedGroupIDs) > 0 || len(c.ChangedPeerIDs) > 0 || len(c.LinkGroups) > 0 || len(c.Resources) > 0
 	hasNetworkObject := len(c.Routers) > 0 || len(c.Resources) > 0 || len(c.Networks) > 0
 	// the resource<->router bridge can fire for any of these
-	needsRoutersResources := hasGroupOrPeerChange || len(c.PostureCheckIDs) > 0 || len(c.Policies) > 0 || hasNetworkObject
+	needsRoutersResources := hasGroupOrPeerChange || len(c.PostureCheckIDs) > 0 || len(c.Policies) > 0 || hasNetworkObject || len(c.UserGroupIDs) > 0 || c.AllowedUsersChanged
 
 	if needsRoutersResources {
 		if err := snap.loadPolicyRoutersResources(ctx, s, accountID); err != nil {
@@ -126,12 +129,15 @@ func (snap *Snapshot) loadRoutesAndProxy(ctx context.Context, s store.Store, acc
 	return snap.loadProxyServices(ctx, s, accountID)
 }
 
-// loadDNS loads the nameserver groups and account DNS settings.
+// loadDNS loads the nameserver groups, custom DNS zones and account DNS settings.
 func (snap *Snapshot) loadDNS(ctx context.Context, s store.Store, accountID string) error {
 	var err error
 	if snap.nsGroups, err = s.GetAccountNameServerGroups(ctx, store.LockingStrengthNone, accountID); err != nil {
 		return err
 	}
+	if snap.zones, err = s.GetAccountZones(ctx, store.LockingStrengthNone, accountID); err != nil {
+		return err
+	}
 	snap.dnsSettings, err = s.GetAccountDNSSettings(ctx, store.LockingStrengthNone, accountID)
 	return err
 }
@@ -219,6 +225,18 @@ type Change struct {
 	// (correct when the peer's own attributes changed, e.g. IP/status).
 	OutputPeerIDs []string
 
+	// UserGroupIDs are groups whose USER membership changed (a user's auto-groups),
+	// as opposed to their peer membership. Peers ship the group -> user mapping only
+	// for the groups an SSH rule authorizes, so these refresh the destinations of the
+	// SSH rules authorizing them — independently of any peer moving between groups.
+	UserGroupIDs []string
+
+	// AllowedUsersChanged marks a change to the set of users allowed to open SSH
+	// sessions — a user was created, blocked or unblocked. That set is account-wide,
+	// and peers receive it through the SSH rules that name no group or user of their
+	// own, so those rules' destinations refresh.
+	AllowedUsersChanged bool
+
 	// LinkGroups are groups used ONLY to match policies/routes/routers and walk to the
 	// OPPOSITE side — they are never expanded to their own members. Use this when a
 	// peer's group membership changed: pass the peer in ChangedPeerIDs and its
@@ -240,6 +258,8 @@ func (c Change) isEmpty() bool {
 		len(c.Resources) == 0 &&
 		len(c.Networks) == 0 &&
 		len(c.PostureCheckIDs) == 0 &&
+		len(c.UserGroupIDs) == 0 &&
+		!c.AllowedUsersChanged &&
 		len(c.DistributionGroupIDs) == 0 &&
 		len(c.RemovedPeersByGroup) == 0 &&
 		len(c.LinkGroups) == 0 &&
@@ -247,10 +267,10 @@ func (c Change) isEmpty() bool {
 }
 
 // Expand returns the deduplicated affected peer IDs from the preloaded Snapshot,
-// no store access. Run after the producing tx commits. Logs the full walk at
-// trace level for diagnosing a miscalculation.
+// no store access. Run after the producing tx commits. A nil Snapshot expands to
+// nothing. Logs the full walk at trace level for diagnosing a miscalculation.
 func (snap *Snapshot) Expand(ctx context.Context, accountID string, c Change) []string {
-	if c.isEmpty() {
+	if snap == nil || c.isEmpty() {
 		return nil
 	}
 	r := newResolver(ctx, snap, accountID, c)
@@ -342,7 +362,7 @@ func (s policySide) opposite() policySide {
 //   - a changed router/resource/network sits on a NETWORK -> fold the SOURCE side of
 //     the policies whose destination reaches it (and the routers it implies).
 //
-// Routes, nameserver groups, DNS and embedded-proxy services distribute to their own
+// Routes, nameserver groups, DNS zones, DNS and embedded-proxy services distribute to their own
 // member peers, outside the policy graph, and are folded here too.
 func (r *resolver) walk() {
 	for _, policy := range r.bothSidesPolicies() {
@@ -354,11 +374,15 @@ func (r *resolver) walk() {
 		r.collectFromPolicies()
 		r.collectFromRoutes()
 		r.collectFromNameServers()
+		r.collectFromZones()
 		r.collectFromDNSSettings()
 		r.collectFromNetworkRouters()
 		r.collectFromProxyServices()
 	}
 
+	r.collectFromSSHAuthorizedGroups()
+	r.collectFromAllowedUsers()
+
 	r.collectFromChangedRoutes(r.change.Routes)
 	r.collectFromChangedRouters(r.change.Routers)
 	r.collectFromChangedResources(r.change.Resources)
@@ -811,6 +835,78 @@ func (r *resolver) collectFromNameServers() {
 	}
 }
 
+// collectFromZones folds the distribution groups of the custom DNS zones that
+// reference a linked group. Like nameserver groups, a zone has no opposite side, so
+// only a whole-group change folds its groups. Zones the network map does not ship
+// (disabled or without records) are skipped.
+func (r *resolver) collectFromZones() {
+	if len(r.linkGroups) == 0 {
+		return
+	}
+	for _, zone := range r.snap.zones {
+		if !zone.Enabled || len(zone.Records) == 0 {
+			continue
+		}
+		if anyInSet(zone.DistributionGroups, r.linkGroups) {
+			log.WithContext(r.ctx).Tracef("collectFromZones: zone %s references a linked group -> folding its groups %v (outputGroups only)", zone.ID, zone.DistributionGroups)
+			r.foldOutputGroups(zone.DistributionGroups)
+		}
+	}
+}
+
+// collectFromSSHAuthorizedGroups folds the destinations of the enabled SSH rules that
+// authorize a group whose user membership changed. Those destination peers carry the
+// group -> user mapping for the groups they authorize, so they refresh even when no
+// peer moved between groups.
+func (r *resolver) collectFromSSHAuthorizedGroups() {
+	if len(r.change.UserGroupIDs) == 0 {
+		return
+	}
+
+	changed := toSet(r.change.UserGroupIDs)
+	for _, policy := range r.policies() {
+		for _, rule := range policy.Rules {
+			if !rule.Enabled || rule.Protocol != types.PolicyRuleProtocolNetbirdSSH {
+				continue
+			}
+			if !anyInSet(maps.Keys(rule.AuthorizedGroups), changed) {
+				continue
+			}
+			log.WithContext(r.ctx).Tracef("collectFromSSHAuthorizedGroups: rule %s authorizes a changed user group -> folding its destinations", rule.ID)
+			r.foldPolicySideForRule(policy, rule, sideDestination)
+		}
+	}
+}
+
+// collectFromAllowedUsers folds the destinations of the rules that make a peer carry
+// the account's allowed-user set, for a change to who is in that set.
+func (r *resolver) collectFromAllowedUsers() {
+	if !r.change.AllowedUsersChanged {
+		return
+	}
+
+	for _, policy := range r.policies() {
+		for _, rule := range policy.Rules {
+			if !rule.Enabled || !ruleShipsAllowedUsers(rule) {
+				continue
+			}
+			log.WithContext(r.ctx).Tracef("collectFromAllowedUsers: rule %s ships the allowed-user set -> folding its destinations", rule.ID)
+			r.foldPolicySideForRule(policy, rule, sideDestination)
+		}
+	}
+}
+
+// ruleShipsAllowedUsers reports whether a rule makes its destination peers carry the
+// account's allowed-user set. It mirrors the network map's SSH requirements except for
+// the destination peer's own SSH flag, which the snapshot does not hold — so it folds a
+// superset and never misses a peer.
+func ruleShipsAllowedUsers(rule *types.PolicyRule) bool {
+	if rule.Protocol == types.PolicyRuleProtocolNetbirdSSH {
+		return len(rule.AuthorizedGroups) == 0 && rule.AuthorizedUser == ""
+	}
+	return types.PolicyRuleImpliesLegacySSH(rule)
+}
+
 func (r *resolver) collectFromDNSSettings() {
 	if len(r.linkGroups) == 0 || r.snap.dnsSettings == nil {
 		return
diff --git a/management/server/affectedpeers/resolver_test.go b/management/server/affectedpeers/resolver_test.go
index fe6ada347..d7858b82c 100644
--- a/management/server/affectedpeers/resolver_test.go
+++ b/management/server/affectedpeers/resolver_test.go
@@ -1,6 +1,7 @@
 package affectedpeers
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -77,6 +78,11 @@ func TestPolicyGroupsAndPeers_NonPeerResource(t *testing.T) {
 	assert.Empty(t, peers, "domain resource type should not produce direct peer IDs")
 }
 
+func TestExpand_NilSnapshot(t *testing.T) {
+	var snap *Snapshot
+	assert.Nil(t, snap.Expand(context.Background(), "acc", Change{ChangedGroupIDs: []string{"g"}}))
+}
+
 func TestChangeIsEmpty(t *testing.T) {
 	assert.True(t, Change{}.isEmpty())
 	assert.False(t, Change{ChangedGroupIDs: []string{"g"}}.isEmpty())
@@ -85,6 +91,8 @@ func TestChangeIsEmpty(t *testing.T) {
 	assert.False(t, Change{Resources: []*resourceTypes.NetworkResource{{ID: "r"}}}.isEmpty())
 	assert.False(t, Change{Networks: []*networkTypes.Network{{ID: "n"}}}.isEmpty())
 	assert.False(t, Change{PostureCheckIDs: []string{"pc"}}.isEmpty())
+	assert.False(t, Change{UserGroupIDs: []string{"g"}}.isEmpty())
+	assert.False(t, Change{AllowedUsersChanged: true}.isEmpty())
 }
 
 func TestPolicyReferencesPostureChecks(t *testing.T) {
diff --git a/management/server/agentnetwork_budgetrule_realstack_test.go b/management/server/agentnetwork_budgetrule_realstack_test.go
index d17f2e26a..2bf654b41 100644
--- a/management/server/agentnetwork_budgetrule_realstack_test.go
+++ b/management/server/agentnetwork_budgetrule_realstack_test.go
@@ -68,7 +68,10 @@ func TestAgentNetwork_BudgetRuleCRUD_RealManager(t *testing.T) {
 
 // TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection is the
 // GC-1 guard for UpdateSettings: it must apply the collection toggles while
-// preserving the immutable Cluster/Subdomain pinned at bootstrap.
+// preserving the immutable Domain/ProxyAddress assigned at bootstrap. The
+// request echoes the identity fields back — the PUT convention every other
+// endpoint follows — and a request echoing anything else is rejected outright
+// rather than quietly ignored.
 func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err, "createManager must succeed")
@@ -84,43 +87,85 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 
 	mgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
 
-	// Creating a provider bootstraps the settings row (cluster + subdomain).
+	// Bootstrap is an explicit settings create; providers have no settings
+	// side effects anymore.
+	seedPrivateProxyCluster(t, am.Store, clusterAddr)
+	before, err := mgr.CreateSettings(ctx, adminUserID, agenttypes.DefaultSettings(accountID), clusterAddr, "")
+	require.NoError(t, err, "CreateSettings must bootstrap the row")
+	require.Equal(t, clusterAddr, before.ProxyAddress, "proxy address pinned at bootstrap")
+	require.NotEmpty(t, before.Domain, "endpoint allocated at bootstrap")
+	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
+
 	_, err = mgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
-		AccountID:   accountID,
-		ProviderID:  "openai_api",
-		Name:        "openai",
-		UpstreamURL: "https://api.openai.com",
+		AccountID:  accountID,
+		ProviderID: "openai_api",
+		Name:       "openai",
+		// A private address: the save-time credential check leaves it
+		// unchecked rather than spending a dummy key against the real
+		// api.openai.com, which the vendor refuses and which would make
+		// this test depend on the runner having egress.
+		UpstreamURL: "https://10.255.255.1",
 		APIKey:      "sk-test",
 		Enabled:     true,
 		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
-	}, clusterAddr)
-	require.NoError(t, err, "CreateProvider must bootstrap settings")
+	})
+	require.NoError(t, err, "CreateProvider must succeed")
 
-	before, err := mgr.GetSettings(ctx, accountID, adminUserID)
-	require.NoError(t, err, "GetSettings must succeed after bootstrap")
-	require.Equal(t, clusterAddr, before.Cluster, "cluster pinned at bootstrap")
-	require.NotEmpty(t, before.Subdomain, "subdomain pinned at bootstrap")
-	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
-
-	// Attempt to flip toggles AND smuggle a different cluster/subdomain — the
-	// immutable fields must be ignored.
+	// Flipping the toggles works when the request echoes the assigned
+	// identity. Retention is echoed too: UpdateSettings takes it verbatim, so
+	// omitting it would zero the account's retention.
 	updated, err := mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
 		AccountID:              accountID,
-		Cluster:                "attacker.cluster",
-		Subdomain:              "evil",
+		Domain:                 before.Domain,
+		ProxyAddress:           before.ProxyAddress,
 		EnableLogCollection:    true,
 		EnablePromptCollection: true,
 		RedactPii:              true,
+		AccessLogRetentionDays: before.AccessLogRetentionDays,
 	})
 	require.NoError(t, err, "UpdateSettings must succeed")
-	assert.Equal(t, before.Cluster, updated.Cluster, "cluster is immutable and must be preserved")
-	assert.Equal(t, before.Subdomain, updated.Subdomain, "subdomain is immutable and must be preserved")
+	assert.Equal(t, before.Domain, updated.Domain, "domain is immutable and must be preserved")
+	assert.Equal(t, before.ProxyAddress, updated.ProxyAddress, "proxy address is immutable and must be preserved")
 	assert.True(t, updated.EnableLogCollection, "log collection toggle must apply")
 	assert.True(t, updated.EnablePromptCollection, "prompt collection toggle must apply")
 	assert.True(t, updated.RedactPii, "redact toggle must apply")
+	assert.Equal(t, before.AccessLogRetentionDays, updated.AccessLogRetentionDays, "echoed retention must survive")
+
+	// Neither identity field can be smuggled into the row: a hand-rolled
+	// Settings value carrying a different endpoint or proxy address is
+	// rejected, not silently ignored.
+	for _, tc := range []struct {
+		name         string
+		domain       string
+		proxyAddress string
+	}{
+		{name: "foreign endpoint", domain: "evil.example.com", proxyAddress: before.ProxyAddress},
+		{name: "foreign proxy address", domain: before.Domain, proxyAddress: "attacker.cluster"},
+		{name: "empty identity echo", domain: "", proxyAddress: ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
+				AccountID:              accountID,
+				Domain:                 tc.domain,
+				ProxyAddress:           tc.proxyAddress,
+				EnableLogCollection:    false,
+				EnablePromptCollection: false,
+				RedactPii:              false,
+				AccessLogRetentionDays: before.AccessLogRetentionDays,
+			})
+			assert.Error(t, err, "a mismatched identity echo must be rejected")
+			assert.ErrorContains(t, err, "immutable", "the rejection must name the immutability rule")
+		})
+	}
+
+	// The rejected updates left the row exactly as the accepted one wrote it.
+	afterRejects, err := mgr.GetSettings(ctx, accountID, adminUserID)
+	require.NoError(t, err, "GetSettings must succeed")
+	assert.True(t, afterRejects.EnablePromptCollection, "a rejected update must not roll back the accepted toggles")
 
 	reloaded, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 	require.NoError(t, err)
-	assert.Equal(t, before.Cluster, reloaded.Cluster, "persisted cluster unchanged")
+	assert.Equal(t, before.Domain, reloaded.Domain, "persisted domain unchanged")
+	assert.Equal(t, before.ProxyAddress, reloaded.ProxyAddress, "persisted proxy address unchanged")
 	assert.True(t, reloaded.EnablePromptCollection, "persisted prompt collection toggled on")
 }
diff --git a/management/server/agentnetwork_proxypeer_restart_test.go b/management/server/agentnetwork_proxypeer_restart_test.go
deleted file mode 100644
index 1e4b8d016..000000000
--- a/management/server/agentnetwork_proxypeer_restart_test.go
+++ /dev/null
@@ -1,199 +0,0 @@
-package server
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/peers"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
-	agenttypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/permissions"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// TestAgentNetwork_ProxyRestart_PropagatesNewPeerAndDropsStale is the no-mock
-// regression guard for the bug the user reported: restarting the proxy creates
-// a fresh embedded peer with a NEW WireGuard public key (the proxy generates
-// the keypair on every startup at proxy/internal/roundtrip/netbird.go:312).
-// The PRIOR embedded peer record is never deleted on management, so the
-// account accumulates a stale peer holding a stale CGNAT IP. Other peers
-// in the account either keep routing to the dead IP, or — if synth DNS
-// picks the wrong record — never see the new IP at all.
-//
-// What this test exercises (no mocks):
-//   - real SQLite test store
-//   - real DefaultAccountManager, network-map controller, peer-update channels
-//   - real peers.Manager.CreateProxyPeer path (the very method the proxy
-//     invokes over gRPC on every startup)
-//   - real agentnetwork.Manager + synth chain so the client receives a
-//     concrete DNS record that must point at the LATEST proxy peer.
-//
-// Pre-fix expected behavior (red): two embedded peers exist after the
-// "restart"; the synth DNS record points at the stale one; the client
-// receives an update reflecting the new peer but the old one lingers.
-// Post-fix expected behavior (green): exactly one embedded peer exists
-// after restart (with the new key) AND the client's network map carries
-// the synth DNS pointing at that new peer's CGNAT IP.
-func TestAgentNetwork_ProxyRestart_PropagatesNewPeerAndDropsStale(t *testing.T) {
-	am, updateManager, err := createManager(t)
-	require.NoError(t, err, "createManager must succeed")
-	ctx := context.Background()
-
-	const (
-		accountID   = "an-restart-acct"
-		adminUserID = "an-restart-admin"
-		groupAID    = "an-restart-grp-A"
-		clusterAddr = "eu.proxy.netbird.io"
-		clientKey   = "BhRPtynAAYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
-		// Two different proxy pubkeys — the "before" and "after" of a
-		// proxy-process restart with fresh-keypair generation.
-		proxyKey1 = "Aaaaa1aaaaYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
-		proxyKey2 = "Bbbbb2bbbbYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
-	)
-
-	// --- Account scaffold ---
-	account := newAccountWithId(ctx, accountID, adminUserID, "an-restart.test", "", "", false)
-	require.NoError(t, am.Store.SaveAccount(ctx, account))
-
-	clientPeer := &nbpeer.Peer{
-		Key:      clientKey,
-		Name:     "an-restart-client",
-		DNSLabel: "an-restart-client",
-		Meta:     nbpeer.PeerSystemMeta{Hostname: "an-restart-client", GoOS: "linux", WtVersion: "development"},
-	}
-	addedClient, _, _, _, err := am.AddPeer(ctx, "", "", adminUserID, clientPeer, false)
-	require.NoError(t, err, "AddPeer for client must succeed")
-	require.NoError(t, am.MarkPeerConnected(ctx, clientKey, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
-		"MarkPeerConnected for the client peer must succeed (affected-peer fan-out skips disconnected peers)")
-
-	// Place the client in group A so the synth policy reaches it.
-	account, err = am.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Groups[groupAID] = &types.Group{ID: groupAID, Name: "groupA", Peers: []string{addedClient.ID}}
-	require.NoError(t, am.Store.SaveAccount(ctx, account), "SaveAccount must persist group A")
-
-	// --- Real peers + agent-network managers ---
-	permMgr := permissions.NewManager(am.Store)
-	peersMgr := peers.NewManager(am.Store, permMgr)
-	peersMgr.SetAccountManager(am)
-	peersMgr.SetNetworkMapController(am.networkMapController)
-	agentMgr := agentnetwork.NewManager(am.Store, permMgr, am, nil)
-
-	// Subscribe BEFORE any state-mutating call so we don't lose the update
-	// that contains the synth DNS record.
-	clientCh := updateManager.CreateChannel(ctx, addedClient.ID)
-	t.Cleanup(func() { updateManager.CloseChannel(ctx, addedClient.ID) })
-	drain(clientCh)
-
-	// --- First proxy startup: register peer key K1, then mark it
-	// connected. In production the proxy follows CreateProxyPeer with the
-	// regular sync stream which lands on MarkPeerConnected; the synth DNS
-	// path filters out peers that aren't Connected (types/account.go:323),
-	// so without this step no DNS record would be emitted.
-	require.NoError(t, peersMgr.CreateProxyPeer(ctx, accountID, proxyKey1, clusterAddr),
-		"first CreateProxyPeer (proxy startup) must succeed")
-
-	peer1ID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey1)
-	require.NoError(t, err, "proxy peer for K1 must be persisted after CreateProxyPeer")
-	require.NotEmpty(t, peer1ID)
-
-	require.NoError(t, am.MarkPeerConnected(ctx, proxyKey1, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
-		"MarkPeerConnected for K1 must succeed")
-
-	account, err = am.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	proxyIP1 := account.Peers[peer1ID].IP.String()
-	require.NotEmpty(t, proxyIP1, "K1 must have an assigned overlay IP")
-
-	// --- Provider + policy. CreateProvider / CreatePolicy trigger the
-	// agentnetwork reconcile which runs UpdateAccountPeers; the resulting
-	// NetworkMap delivered to the client carries the synth DNS record
-	// pointing at K1's IP. ---
-	provider, err := agentMgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
-		AccountID:   accountID,
-		ProviderID:  "openai_api",
-		Name:        "openai-test",
-		UpstreamURL: "https://api.openai.com",
-		APIKey:      "sk-test-key",
-		Enabled:     true,
-		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
-	}, clusterAddr)
-	require.NoError(t, err, "CreateProvider must succeed")
-
-	_, err = agentMgr.CreatePolicy(ctx, adminUserID, &agenttypes.Policy{
-		AccountID:              accountID,
-		Name:                   "p1",
-		Enabled:                true,
-		SourceGroups:           []string{groupAID},
-		DestinationProviderIDs: []string{provider.ID},
-	})
-	require.NoError(t, err, "CreatePolicy must succeed")
-
-	settings, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	fqdn := settings.Endpoint()
-
-	rdata1 := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
-	require.Equal(t, proxyIP1, rdata1,
-		"client must receive a synth DNS record pointing at K1's overlay IP after the synth path runs")
-	drain(clientCh)
-
-	// --- Proxy restart: NEW keypair K2, same account, same cluster ---
-	require.NoError(t, peersMgr.CreateProxyPeer(ctx, accountID, proxyKey2, clusterAddr),
-		"second CreateProxyPeer (proxy restart with fresh keypair) must succeed")
-
-	peer2ID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey2)
-	require.NoError(t, err, "proxy peer for K2 must be persisted after restart")
-	require.NotEmpty(t, peer2ID)
-
-	require.NoError(t, am.MarkPeerConnected(ctx, proxyKey2, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
-		"MarkPeerConnected for K2 must succeed")
-
-	// In production the agent's sync stream pulls a fresh NetworkMap as
-	// part of its normal reconcile cadence; in this isolated test
-	// MarkPeerConnected's affected-peer fan-out can race the channel-side
-	// buffer in a way that swallows the synth-DNS-bearing update before
-	// our await reads it. Trigger an explicit account-wide fan-out so the
-	// assertion below tests what production actually delivers, not the
-	// in-test buffer race.
-	am.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourcePeer, Operation: types.UpdateOperationUpdate})
-
-	account, err = am.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	proxyIP2 := account.Peers[peer2ID].IP.String()
-	require.NotEmpty(t, proxyIP2, "K2 must have an assigned overlay IP")
-	require.NotEqual(t, proxyIP1, proxyIP2, "K2 must get a different overlay IP than K1 (sanity)")
-
-	// CRITICAL ASSERTION 1: K1 must no longer be in the store. The SqlStore
-	// returns ("", nil) for a missing key rather than NotFound, so assert
-	// on the returned ID being empty.
-	staleID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey1)
-	require.NoError(t, err, "GetPeerIDByKey for a missing peer must not error")
-	assert.Empty(t, staleID,
-		"stale embedded proxy peer K1 must be removed when a new embedded peer registers for the same (account, cluster); pre-fix this assertion fails because management never cleans up the prior peer record")
-
-	// CRITICAL ASSERTION 2: exactly one embedded proxy peer remains, and it
-	// is K2.
-	account, err = am.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	embeddedKeys := []string{}
-	for _, p := range account.Peers {
-		if p.ProxyMeta.Embedded {
-			embeddedKeys = append(embeddedKeys, p.Key)
-		}
-	}
-	assert.Equal(t, []string{proxyKey2}, embeddedKeys,
-		"after a proxy restart exactly one embedded proxy peer should remain — the one with the new key K2")
-
-	// CRITICAL ASSERTION 3: the synth DNS record the client receives now
-	// points at K2's IP, not K1's.
-	rdata2 := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
-	assert.Equal(t, proxyIP2, rdata2,
-		"after proxy restart, the client's synth DNS record must point at the NEW embedded peer's IP, not the stale K1 IP")
-}
diff --git a/management/server/agentnetwork_realstack_test.go b/management/server/agentnetwork_realstack_test.go
index e7855c575..5fb92e04f 100644
--- a/management/server/agentnetwork_realstack_test.go
+++ b/management/server/agentnetwork_realstack_test.go
@@ -13,6 +13,7 @@ import (
 	networkmap "github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	agenttypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	rpproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -92,15 +93,28 @@ func TestAgentNetwork_ProviderCRUD_FansOutToProxyAndClientPeers(t *testing.T) {
 	// UpdateAccountPeers, which is the path under test.
 	agentMgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
 
+	seedPrivateProxyCluster(t, am.Store, clusterAddr)
+	_, err = agentMgr.CreateSettings(ctx, adminUserID, agenttypes.DefaultSettings(accountID), clusterAddr, "")
+	require.NoError(t, err, "CreateSettings must bootstrap the endpoint")
+	// The bootstrap itself reconciles and queues updates on both channels;
+	// drain them so the fan-out assertions below can only be satisfied by the
+	// operation under test, not by this leftover.
+	drain(clientCh)
+	drain(proxyCh)
+
 	provider, err := agentMgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
-		AccountID:   accountID,
-		ProviderID:  "openai_api",
-		Name:        "openai-test",
-		UpstreamURL: "https://api.openai.com",
+		AccountID:  accountID,
+		ProviderID: "openai_api",
+		Name:       "openai-test",
+		// A private address: the save-time credential check leaves it
+		// unchecked rather than spending a dummy key against the real
+		// api.openai.com, which the vendor refuses and which would make
+		// this test depend on the runner having egress.
+		UpstreamURL: "https://10.255.255.1",
 		APIKey:      "sk-test-key",
 		Enabled:     true,
 		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
-	}, clusterAddr)
+	})
 	require.NoError(t, err, "CreateProvider must succeed")
 
 	policy, err := agentMgr.CreatePolicy(ctx, adminUserID, &agenttypes.Policy{
@@ -210,3 +224,22 @@ func synthZoneRData(sync *nbproto.SyncResponse, clusterAddr, fqdn string) string
 	}
 	return ""
 }
+
+// seedPrivateProxyCluster registers a connected proxy with private capabilities in a
+// netbird client for clusterAddr, matching what a real deployment looks like
+// when the account bootstraps: the agent-network gateway service is always
+// private, so its cluster has to be one that can serve private services.
+func seedPrivateProxyCluster(t *testing.T, st store.Store, clusterAddr string) {
+	t.Helper()
+	private := true
+	now := time.Now().UTC()
+	require.NoError(t, st.SaveProxy(context.Background(), &rpproxy.Proxy{
+		ID:             "agent-net-proxy-" + clusterAddr,
+		SessionID:      "agent-net-session",
+		ClusterAddress: clusterAddr,
+		LastSeen:       now,
+		ConnectedAt:    &now,
+		Status:         rpproxy.StatusConnected,
+		Capabilities:   rpproxy.Capabilities{Private: &private},
+	}), "seeding the proxy cluster must succeed")
+}
diff --git a/management/server/api/v1alpha1/groups/helpers.go b/management/server/api/v1alpha1/groups/helpers.go
new file mode 100644
index 000000000..4b15fc9ec
--- /dev/null
+++ b/management/server/api/v1alpha1/groups/helpers.go
@@ -0,0 +1,38 @@
+package groups
+
+import (
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+)
+
+func ToGroupsInfoMap(groups []*types.Group, idCount int) map[string][]apiv1alpha1.GroupMinimum {
+	groupsInfoMap := make(map[string][]apiv1alpha1.GroupMinimum, idCount)
+	groupsChecked := make(map[string]struct{}, len(groups)) // not sure why this is needed (left over from old implementation)
+	for _, group := range groups {
+		_, ok := groupsChecked[group.ID]
+		if ok {
+			continue
+		}
+
+		groupsChecked[group.ID] = struct{}{}
+		for _, pk := range group.Peers {
+			info := apiv1alpha1.GroupMinimum{
+				Id:             group.ID,
+				Name:           group.Name,
+				PeersCount:     len(group.Peers),
+				ResourcesCount: len(group.Resources),
+			}
+			groupsInfoMap[pk] = append(groupsInfoMap[pk], info)
+		}
+		for _, rk := range group.Resources {
+			info := apiv1alpha1.GroupMinimum{
+				Id:             group.ID,
+				Name:           group.Name,
+				PeersCount:     len(group.Peers),
+				ResourcesCount: len(group.Resources),
+			}
+			groupsInfoMap[rk.ID] = append(groupsInfoMap[rk.ID], info)
+		}
+	}
+	return groupsInfoMap
+}
diff --git a/management/server/api/v1alpha1/handler.go b/management/server/api/v1alpha1/handler.go
new file mode 100644
index 000000000..21b9bbcec
--- /dev/null
+++ b/management/server/api/v1alpha1/handler.go
@@ -0,0 +1,40 @@
+package v1alpha1
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+
+	"github.com/netbirdio/netbird/management/server/permissions"
+
+	peersmodule "github.com/netbirdio/netbird/management/internals/modules/peers"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/peers"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/users"
+)
+
+func NewAPIV1Handler(
+	ctx context.Context,
+	router *mux.Router,
+	accountManager account.Manager,
+	peerManager peersmodule.Manager,
+	networkMapController network_map.Controller,
+	permissionsManager permissions.Manager) (http.Handler, error) {
+
+	v1validatorMiddleware, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+	if err != nil {
+		return nil, err
+	}
+
+	router.Use(v1validatorMiddleware.Handler)
+
+	peersHandler := peers.NewHandler(accountManager, peerManager, networkMapController, permissionsManager)
+	_ = peersHandler.WithEndpointsForRouter(router)
+
+	usersHandler := users.NewHandler(accountManager)
+	return usersHandler.WithEndpointsForRouter(router), nil
+}
diff --git a/management/server/api/v1alpha1/peers/peers_handler.go b/management/server/api/v1alpha1/peers/peers_handler.go
new file mode 100644
index 000000000..50841858c
--- /dev/null
+++ b/management/server/api/v1alpha1/peers/peers_handler.go
@@ -0,0 +1,488 @@
+package peers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/gorilla/mux"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/modules/peers"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/groups"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+type Handler struct {
+	accountManager       account.Manager
+	permissionsManager   permissions.Manager
+	networkMapController network_map.Controller
+	peersManager         peers.Manager
+}
+
+// NewHandler creates a new peers Handler
+func NewHandler(accountManager account.Manager, peerManager peers.Manager, networkMapController network_map.Controller, permissionsManager permissions.Manager) *Handler {
+	return &Handler{
+		accountManager:       accountManager,
+		peersManager:         peerManager,
+		networkMapController: networkMapController,
+		permissionsManager:   permissionsManager,
+	}
+}
+
+func (h *Handler) WithEndpointsForRouter(router *mux.Router) *mux.Router {
+	router.HandleFunc("/peers", h.GetAllPeers).Methods("GET", "OPTIONS")
+	router.HandleFunc("/peers/{peerId}", h.HandlePeer).Methods("GET", "PUT", "DELETE", "OPTIONS")
+	return router
+}
+
+func (h *Handler) getPeer(ctx context.Context, accountID, peerID, userID string, w http.ResponseWriter) {
+	peer, err := h.accountManager.GetPeer(ctx, accountID, peerID, userID)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	if peer.ProxyMeta.Embedded {
+		util.WriteError(ctx, status.Errorf(status.InvalidArgument, "not allowed to read peer"), w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(ctx, accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	grps, _ := h.accountManager.GetPeerGroups(ctx, accountID, peerID)
+	grpsInfoMap := groups.ToGroupsInfoMap(grps, 0)
+
+	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to list approved peers: %v", err)
+		util.WriteError(ctx, fmt.Errorf("internal error"), w)
+		return
+	}
+
+	_, valid := validPeers[peer.ID]
+	reason := invalidPeers[peer.ID]
+
+	util.WriteJSONObject(ctx, w, toSinglePeerResponse(peer, grpsInfoMap[peerID], dnsDomain, valid, reason))
+}
+
+func (h *Handler) updatePeer(ctx context.Context, accountID, userID, peerID string, w http.ResponseWriter, r *http.Request) {
+	req := &apiv1alpha1.PeerRequest{}
+	err := json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	update := &nbpeer.Peer{
+		ID:                          peerID,
+		SSHEnabled:                  req.SshEnabled,
+		Name:                        req.Name,
+		LoginExpirationEnabled:      req.LoginExpirationEnabled,
+		InactivityExpirationEnabled: req.InactivityExpirationEnabled,
+	}
+
+	if req.ApprovalRequired != nil {
+		// todo: looks like that we reset all status property, is it right?
+		update.Status = &nbpeer.PeerStatus{
+			RequiresApproval: *req.ApprovalRequired,
+		}
+	}
+
+	if req.Ip != nil {
+		addr, err := netip.ParseAddr(*req.Ip)
+		if err != nil {
+			util.WriteError(ctx, status.Errorf(status.InvalidArgument, "invalid IP address %s: %v", *req.Ip, err), w)
+			return
+		}
+
+		if err = h.accountManager.UpdatePeerIP(ctx, accountID, userID, peerID, addr); err != nil {
+			util.WriteError(ctx, err, w)
+			return
+		}
+	}
+
+	if req.Ipv6 != nil {
+		v6Addr, err := parseIPv6(req.Ipv6)
+		if err != nil {
+			util.WriteError(ctx, status.Errorf(status.InvalidArgument, "%v", err), w)
+			return
+		}
+		if err = h.accountManager.UpdatePeerIPv6(ctx, accountID, userID, peerID, v6Addr); err != nil {
+			util.WriteError(ctx, err, w)
+			return
+		}
+	}
+
+	peer, err := h.accountManager.UpdatePeer(ctx, accountID, userID, update)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(ctx, accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	peerGroups, err := h.accountManager.GetPeerGroups(ctx, accountID, peer.ID)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	grpsInfoMap := groups.ToGroupsInfoMap(peerGroups, 0)
+
+	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to get validated peers: %v", err)
+		util.WriteError(ctx, fmt.Errorf("internal error"), w)
+		return
+	}
+
+	_, valid := validPeers[peer.ID]
+	reason := invalidPeers[peer.ID]
+
+	util.WriteJSONObject(r.Context(), w, toSinglePeerResponse(peer, grpsInfoMap[peerID], dnsDomain, valid, reason))
+}
+
+func (h *Handler) deletePeer(ctx context.Context, accountID, userID string, peerID string, w http.ResponseWriter) {
+	err := h.accountManager.DeletePeer(ctx, accountID, peerID, userID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to delete peer: %v", err)
+		util.WriteError(ctx, err, w)
+		return
+	}
+	util.WriteJSONObject(ctx, w, util.EmptyObject{})
+}
+
+// HandlePeer handles all peer requests for GET, PUT and DELETE operations
+func (h *Handler) HandlePeer(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	peerID := vars["peerId"]
+	if len(peerID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid peer ID"), w)
+		return
+	}
+
+	switch r.Method {
+	case http.MethodDelete:
+		h.deletePeer(r.Context(), accountID, userID, peerID, w)
+		return
+	case http.MethodGet:
+		h.getPeer(r.Context(), accountID, peerID, userID, w)
+		return
+	case http.MethodPut:
+		h.updatePeer(r.Context(), accountID, userID, peerID, w, r)
+		return
+	default:
+		util.WriteError(r.Context(), status.Errorf(status.NotFound, "unknown METHOD"), w)
+	}
+}
+
+// GetAllPeers returns a list of all peers associated with a provided account
+func (h *Handler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	pagination, err := paginationFromQuery(r.URL.Query())
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("error parsing query: %v", err)
+		util.WriteError(r.Context(), &status.Error{ErrorType: status.InvalidArgument, Message: err.Error()}, w)
+		return
+	}
+
+	filters, err := filtersFromQuery(r.URL.Query())
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("error parsing query: %v", err)
+		util.WriteError(r.Context(), &status.Error{ErrorType: status.InvalidArgument, Message: err.Error()}, w)
+		return
+	}
+
+	sorting, err := sortingOrderFromQuery(r.URL.Query())
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("error parsing query: %v", err)
+		util.WriteError(r.Context(), &status.Error{ErrorType: status.InvalidArgument, Message: err.Error()}, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+
+	peers, peerCount, err := h.peersManager.GetPeersPaginated(r.Context(), accountID, userID, pagination, filters, sorting)
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("error getting peers: %v", err)
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(r.Context(), accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	grps, _ := h.accountManager.GetAllGroups(r.Context(), accountID, userID)
+
+	grpsInfoMap := groups.ToGroupsInfoMap(grps, len(peers))
+	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(r.Context(), accountID)
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("failed to get validated peers: %v", err)
+		util.WriteError(r.Context(), fmt.Errorf("internal error"), w)
+		return
+	}
+
+	respBody := apiv1alpha1.PeerBatch{Peers: make([]apiv1alpha1.Peer, 0, len(peers))}
+	for _, peer := range peers {
+		_, valid := validPeers[peer.ID]
+		reason := invalidPeers[peer.ID]
+
+		respBody.Peers = append(respBody.Peers, *toSinglePeerResponse(peer, grpsInfoMap[peer.ID], dnsDomain, valid, reason))
+	}
+	respBody.Page = pagination.Page
+	respBody.PageSize = pagination.PageSize
+	respBody.PeerCount = peerCount
+
+	util.WriteJSONObject(r.Context(), w, respBody)
+}
+
+func filtersFromQuery(v url.Values) (store.PeerFilters, error) {
+	connected, err := parseBool(v.Get("connected"))
+	if err != nil {
+		return store.PeerFilters{}, err
+	}
+
+	approvalRequired, err := parseBool(v.Get("approval_required"))
+	if err != nil {
+		return store.PeerFilters{}, err
+	}
+
+	var isServer *bool
+	if v.Get("kind") != "" {
+		isServer = new(v.Get("kind") == "server")
+		if *isServer && v.Get("user_id") != "" {
+			return store.PeerFilters{}, fmt.Errorf("incompatible filters: kind == server and a non-empty user_id")
+		}
+	}
+	return store.PeerFilters{
+		UserId:           v.Get("user_id"),
+		GroupIds:         v["group_ids"],
+		Connected:        connected,
+		ApprovalRequired: approvalRequired,
+		Os:               v["os"],
+		IP:               v.Get("ip"),
+		MAC:              v.Get("mac"),
+		Name:             v.Get("name"),
+		Hostname:         v.Get("hostname"),
+		IsServer:         isServer,
+		PeersIds:         v["peer_ids"],
+	}, nil
+}
+
+func parseBool(maybeBool string) (*bool, error) {
+	if maybeBool == "" {
+		return nil, nil //nolint:nilnil
+	}
+
+	parsed, err := strconv.ParseBool(maybeBool)
+	if err != nil {
+		return nil, err
+	}
+
+	return new(parsed), nil
+}
+
+func paginationFromQuery(v url.Values) (store.PaginationState, error) {
+	page, err := strconv.Atoi(v.Get("page"))
+	if err != nil {
+		return store.PaginationState{}, err
+	}
+
+	pageSize, err := strconv.Atoi(v.Get("page_size"))
+	if err != nil {
+		return store.PaginationState{}, err
+	}
+
+	return store.PaginationState{
+		Page:     page,
+		PageSize: pageSize,
+	}, nil
+}
+
+func sortingOrderFromQuery(v url.Values) (store.PeerSorting, error) {
+	toret := store.PeerSorting{}
+	sortby, ok := v["sort_by"]
+	if !ok {
+		return toret, nil
+	}
+
+	for i := 0; i < len(sortby); {
+		// ascending sorting order by default
+		sortkey := store.PeerSortingKey{Order: store.AscOrderBy}
+		field, order := parseFieldAndOrder(sortby[i])
+
+		switch field {
+		case "name":
+			sortkey.Field = store.PeerSortByName
+		case "last_seen":
+			sortkey.Field = store.PeerSortByLastSeen
+		case "version":
+			sortkey.Field = store.PeerSortByVersion
+		default:
+			return toret, fmt.Errorf("unable to parse sorting order '%s'", sortby)
+		}
+
+		switch order {
+		case "asc", "":
+			// nop, already set
+		case "desc":
+			sortkey.Order = store.DescOrderBy
+		default:
+			return store.PeerSorting{}, fmt.Errorf("unable to parse sorting order '%s'", sortby)
+		}
+
+		toret.Fields = append(toret.Fields, sortkey)
+		i++
+	}
+
+	return toret, nil
+}
+
+func parseFieldAndOrder(fieldOrder string) (string, string) {
+	maybeFieldAndOrder := strings.SplitN(fieldOrder, ",", 2)
+	if len(maybeFieldAndOrder) == 2 {
+		return strings.TrimSpace(maybeFieldAndOrder[0]), strings.TrimSpace(maybeFieldAndOrder[1])
+	}
+	return strings.TrimSpace(maybeFieldAndOrder[0]), ""
+}
+
+func parseIPv6(s *string) (netip.Addr, error) {
+	if s == nil {
+		return netip.Addr{}, fmt.Errorf("IPv6 address is nil")
+	}
+	addr, err := netip.ParseAddr(*s)
+	if err != nil {
+		return netip.Addr{}, fmt.Errorf("invalid IPv6 address %s: %w", *s, err)
+	}
+	addr = addr.Unmap()
+	if !addr.Is6() {
+		return netip.Addr{}, fmt.Errorf("address %s is not IPv6", *s)
+	}
+	return addr, nil
+}
+
+func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []apiv1alpha1.GroupMinimum, dnsDomain string, approved bool, reason string) *apiv1alpha1.Peer {
+	osVersion := peer.Meta.OSVersion
+	if osVersion == "" {
+		osVersion = peer.Meta.Core
+	}
+
+	apiPeer := &apiv1alpha1.Peer{
+		PeerMinimum: apiv1alpha1.PeerMinimum{
+			Id:   peer.ID,
+			Name: peer.Name,
+		},
+		CreatedAt:                   peer.CreatedAt,
+		Ip:                          peer.IP.String(),
+		Ipv6:                        peerIPv6String(peer),
+		ConnectionIp:                peer.Location.ConnectionIP.String(),
+		Connected:                   peer.Status.Connected,
+		LastSeen:                    peer.Status.LastSeen,
+		Os:                          fmt.Sprintf("%s %s", peer.Meta.OS, osVersion),
+		KernelVersion:               peer.Meta.KernelVersion,
+		GeonameId:                   int(peer.Location.GeoNameID),
+		Version:                     peer.Meta.WtVersion,
+		Groups:                      groupsInfo,
+		SshEnabled:                  peer.SSHEnabled,
+		Hostname:                    peer.Meta.Hostname,
+		UserId:                      peer.UserID,
+		UiVersion:                   peer.Meta.UIVersion,
+		DnsLabel:                    fqdn(peer, dnsDomain),
+		ExtraDnsLabels:              fqdnList(peer.ExtraDNSLabels, dnsDomain),
+		LoginExpirationEnabled:      peer.LoginExpirationEnabled,
+		LastLogin:                   peer.GetLastLogin(),
+		LoginExpired:                peer.Status.LoginExpired,
+		ApprovalRequired:            !approved,
+		CountryCode:                 apiv1alpha1.CountryCode(peer.Location.CountryCode),
+		CityName:                    apiv1alpha1.CityName(peer.Location.CityName),
+		SerialNumber:                peer.Meta.SystemSerialNumber,
+		InactivityExpirationEnabled: peer.InactivityExpirationEnabled,
+		Ephemeral:                   peer.Ephemeral,
+		LocalFlags: &apiv1alpha1.PeerLocalFlags{
+			BlockInbound:          &peer.Meta.Flags.BlockInbound,
+			BlockLanAccess:        &peer.Meta.Flags.BlockLANAccess,
+			DisableClientRoutes:   &peer.Meta.Flags.DisableClientRoutes,
+			DisableDns:            &peer.Meta.Flags.DisableDNS,
+			DisableFirewall:       &peer.Meta.Flags.DisableFirewall,
+			DisableServerRoutes:   &peer.Meta.Flags.DisableServerRoutes,
+			LazyConnectionEnabled: &peer.Meta.Flags.LazyConnectionEnabled,
+			RosenpassEnabled:      &peer.Meta.Flags.RosenpassEnabled,
+			RosenpassPermissive:   &peer.Meta.Flags.RosenpassPermissive,
+			ServerSshAllowed:      &peer.Meta.Flags.ServerSSHAllowed,
+			RemoteJobsAllowed:     &peer.Meta.Flags.RemoteJobsAllowed,
+		},
+	}
+
+	if !approved {
+		apiPeer.DisapprovalReason = &reason
+	}
+
+	return apiPeer
+}
+
+func fqdn(peer *nbpeer.Peer, dnsDomain string) string {
+	fqdn := peer.FQDN(dnsDomain)
+	if fqdn == "" {
+		return peer.DNSLabel
+	} else {
+		return fqdn
+	}
+}
+func fqdnList(extraLabels []string, dnsDomain string) []string {
+	fqdnList := make([]string, 0, len(extraLabels))
+	for _, label := range extraLabels {
+		fqdn := fmt.Sprintf("%s.%s", label, dnsDomain)
+		fqdnList = append(fqdnList, fqdn)
+	}
+	return fqdnList
+}
+
+func peerIPv6String(peer *nbpeer.Peer) *string {
+	if !peer.IPv6.IsValid() {
+		return nil
+	}
+	s := peer.IPv6.String()
+	return &s
+}
diff --git a/management/server/api/v1alpha1/peers/peers_handler_pagination_test.go b/management/server/api/v1alpha1/peers/peers_handler_pagination_test.go
new file mode 100644
index 000000000..4d1449a14
--- /dev/null
+++ b/management/server/api/v1alpha1/peers/peers_handler_pagination_test.go
@@ -0,0 +1,191 @@
+package peers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	peersmodule "github.com/netbirdio/netbird/management/internals/modules/peers"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
+)
+
+func TestGetPeersPagination(t *testing.T) {
+	peer := &nbpeer.Peer{
+		ID:     testPeerID,
+		Status: &nbpeer.PeerStatus{Connected: true},
+		Meta:   nbpeer.PeerSystemMeta{},
+	}
+
+	tt := []struct {
+		name            string
+		expectedStatus  int
+		requestPath     string
+		setExpectations func(p *Handler)
+	}{
+		{
+			name:           "GetPeers default paging, filtering, and sorting",
+			requestPath:    "/peers",
+			expectedStatus: http.StatusOK,
+			setExpectations: func(p *Handler) {
+				p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(),
+					gomock.Eq(store.PaginationState{Page: 1, PageSize: 100}), gomock.Any(), gomock.Any()).Return(make([]*nbpeer.Peer, 0), 0, nil).AnyTimes()
+			},
+		},
+		{
+			name:           "GetPeers paging",
+			requestPath:    "/peers?page=10&page_size=250",
+			expectedStatus: http.StatusOK,
+			setExpectations: func(p *Handler) {
+				p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(),
+					gomock.Eq(store.PaginationState{Page: 10, PageSize: 250}),
+					gomock.Any(), gomock.Any()).Return(make([]*nbpeer.Peer, 0), 0, nil).AnyTimes()
+			},
+		},
+		{
+			name:            "GetPeers paging with invalid page",
+			requestPath:     "/peers?page=aaa&page_size=250",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers paging with invalid page size",
+			requestPath:     "/peers?page=10&page_size=aaa",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:           "GetPeers filtering all valid params",
+			requestPath:    "/peers?user_id=test-user&group_ids=1&group_ids=2&group_ids=3&group_ids=4&peer_ids=peer-1&peer_ids=peer-2&connected=true&approval_required=false&os=linux&os=windows&os=darwin&os=android&os=ios&os=js&ip=10.10.10.10&mac=00:11:22:33:44:55&name=test&hostname=test-host&kind=user_device",
+			expectedStatus: http.StatusOK,
+			setExpectations: func(p *Handler) {
+				p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(),
+					gomock.Eq(store.PaginationState{Page: 1, PageSize: 100}),
+					gomock.Eq(store.PeerFilters{
+						UserId:           "test-user",
+						GroupIds:         []string{"1", "2", "3", "4"},
+						Connected:        new(true),
+						ApprovalRequired: new(false),
+						Os:               []string{"linux", "windows", "darwin", "android", "ios", "js"},
+						IP:               "10.10.10.10",
+						MAC:              "00:11:22:33:44:55",
+						Name:             "test",
+						Hostname:         "test-host",
+						IsServer:         new(false),
+						PeersIds:         []string{"peer-1", "peer-2"},
+					}),
+					gomock.Any()).Return(make([]*nbpeer.Peer, 0), 0, nil).AnyTimes()
+			},
+		},
+		{
+			name:           "GetPeers filtering with kind server",
+			requestPath:    "/peers?kind=server",
+			expectedStatus: http.StatusOK,
+			setExpectations: func(p *Handler) {
+				p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(),
+					gomock.Eq(store.PaginationState{Page: 1, PageSize: 100}),
+					gomock.Eq(store.PeerFilters{IsServer: new(true)}),
+					gomock.Any()).Return(make([]*nbpeer.Peer, 0), 0, nil).AnyTimes()
+			},
+		},
+		{
+			name:            "GetPeers filtering with invalid connected value",
+			requestPath:     "/peers?connected=aaa",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers filtering with invalid approval_required value",
+			requestPath:     "/peers?approval_required=aaa",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers filtering with invalid os value",
+			requestPath:     "/peers?os=nosuchos",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers filtering with invalid kind value",
+			requestPath:     "/peers?kind=nosuchkind",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers filtering with conflicting user_id and kind",
+			requestPath:     "/peers?user_id=test-user&kind=server",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:           "GetPeers sorting preserves field ordering",
+			requestPath:    "/peers?sort_by=last_seen&sort_by=name&sort_by=version",
+			expectedStatus: http.StatusOK,
+			setExpectations: func(p *Handler) {
+				p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(),
+					gomock.Eq(store.PaginationState{Page: 1, PageSize: 100}),
+					gomock.Any(),
+					gomock.Eq(store.PeerSorting{
+						Fields: []store.PeerSortingKey{
+							{Field: store.PeerSortByLastSeen, Order: store.AscOrderBy},
+							{Field: store.PeerSortByName, Order: store.AscOrderBy},
+							{Field: store.PeerSortByVersion, Order: store.AscOrderBy},
+						},
+					})).Return(make([]*nbpeer.Peer, 0), 0, nil).AnyTimes()
+			},
+		},
+		{
+			name:            "GetPeers sorting with invalid field",
+			requestPath:     "/peers?sort_by=nosuchfield,asc",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers sorting with invalid field",
+			requestPath:     "/peers?sort_by=nosuchfield,asc",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers sorting with invalid sorting order",
+			requestPath:     "/peers?sort_by=name,nosuchorder&sort_by=version",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			p := initTestMetaData(t, peer)
+
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(http.MethodGet, tc.requestPath, nil)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    "admin_user",
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+			router = p.WithEndpointsForRouter(router)
+
+			tc.setExpectations(p)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			assert.Equal(t, tc.expectedStatus, recorder.Code)
+		})
+	}
+}
diff --git a/management/server/api/v1alpha1/peers/peers_handler_test.go b/management/server/api/v1alpha1/peers/peers_handler_test.go
new file mode 100644
index 000000000..af7b31d10
--- /dev/null
+++ b/management/server/api/v1alpha1/peers/peers_handler_test.go
@@ -0,0 +1,527 @@
+package peers
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"go.uber.org/mock/gomock"
+	"golang.org/x/exp/maps"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	peersmodule "github.com/netbirdio/netbird/management/internals/modules/peers"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/mock_server"
+)
+
+const (
+	testPeerID                = "test_peer"
+	noUpdateChannelTestPeerID = "no-update-channel"
+
+	adminUser   = "admin_user"
+	regularUser = "regular_user"
+	serviceUser = "service_user"
+)
+
+func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
+
+	peersMap := make(map[string]*nbpeer.Peer)
+	for _, peer := range peers {
+		peersMap[peer.ID] = peer.Copy()
+	}
+
+	policy := &types.Policy{
+		ID:        "policy",
+		AccountID: "test_id",
+		Name:      "policy",
+		Enabled:   true,
+		Rules: []*types.PolicyRule{
+			{
+				ID:            "rule",
+				Name:          "rule",
+				Enabled:       true,
+				Action:        "accept",
+				Destinations:  []string{"group1"},
+				Sources:       []string{"group1"},
+				Bidirectional: true,
+				Protocol:      "all",
+				Ports:         []string{"80"},
+			},
+		},
+	}
+
+	srvUser := types.NewRegularUser(serviceUser, "", "")
+	srvUser.IsServiceUser = true
+
+	account := &types.Account{
+		Id:     "test_id",
+		Domain: "hotmail.com",
+		Peers:  peersMap,
+		Users: map[string]*types.User{
+			adminUser:   types.NewAdminUser(adminUser),
+			regularUser: types.NewRegularUser(regularUser, "", ""),
+			serviceUser: srvUser,
+		},
+		Groups: map[string]*types.Group{
+			"group1": {
+				ID:        "group1",
+				AccountID: "test_id",
+				Name:      "group1",
+				Issued:    "api",
+				Peers:     maps.Keys(peersMap),
+			},
+		},
+		Settings: &types.Settings{
+			PeerLoginExpirationEnabled: true,
+			PeerLoginExpiration:        time.Hour,
+		},
+		Policies: []*types.Policy{policy},
+		Network: &types.Network{
+			Identifier: "ciclqisab2ss43jdn8q0",
+			Net: net.IPNet{
+				IP:   net.ParseIP("100.67.0.0"),
+				Mask: net.IPv4Mask(255, 255, 0, 0),
+			},
+			Serial: 51,
+		},
+	}
+
+	ctrl := gomock.NewController(t)
+
+	networkMapController := network_map.NewMockController(ctrl)
+	networkMapController.EXPECT().
+		GetDNSDomain(gomock.Any()).
+		Return("domain").
+		AnyTimes()
+
+	ctrl2 := gomock.NewController(t)
+	permissionsManager := permissions.NewMockManager(ctrl2)
+	permissionsManager.EXPECT().ValidateAccountAccess(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(context.Background(), nil).AnyTimes()
+	permissionsManager.EXPECT().
+		ValidateUserPermissions(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Eq(modules.Peers), gomock.Eq(operations.Read)).
+		DoAndReturn(func(ctx context.Context, accountID, userID string, module modules.Module, operation operations.Operation) (bool, context.Context, error) {
+			user, ok := account.Users[userID]
+			if !ok {
+				return false, ctx, fmt.Errorf("user not found")
+			}
+			return user.HasAdminPower() || user.IsServiceUser, ctx, nil
+		}).
+		AnyTimes()
+
+	peerManager := peersmodule.NewMockManager(ctrl2)
+
+	return &Handler{
+		peersManager: peerManager,
+		accountManager: &mock_server.MockAccountManager{
+			UpdatePeerFunc: func(_ context.Context, accountID, userID string, update *nbpeer.Peer) (*nbpeer.Peer, error) {
+				var p *nbpeer.Peer
+				for _, peer := range peers {
+					if update.ID == peer.ID {
+						p = peer.Copy()
+						break
+					}
+				}
+				p.SSHEnabled = update.SSHEnabled
+				p.LoginExpirationEnabled = update.LoginExpirationEnabled
+				p.Name = update.Name
+				return p, nil
+			},
+			UpdatePeerIPFunc: func(_ context.Context, accountID, userID, peerID string, newIP netip.Addr) error {
+				for _, peer := range peers {
+					if peer.ID == peerID {
+						peer.IP = newIP
+						return nil
+					}
+				}
+				return fmt.Errorf("peer not found")
+			},
+			GetPeerFunc: func(_ context.Context, accountID, peerID, userID string) (*nbpeer.Peer, error) {
+				var p *nbpeer.Peer
+				for _, peer := range peers {
+					if peerID == peer.ID {
+						p = peer.Copy()
+						break
+					}
+				}
+				return p, nil
+			},
+			GetUserByIDFunc: func(ctx context.Context, id string) (*types.User, error) {
+				switch id {
+				case adminUser:
+					return account.Users[adminUser], nil
+				case regularUser:
+					return account.Users[regularUser], nil
+				case serviceUser:
+					return account.Users[serviceUser], nil
+				default:
+					return nil, fmt.Errorf("user not found")
+				}
+			},
+			GetPeersFunc: func(_ context.Context, accountID, userID string, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, int, error) {
+				return peers, len(peers), nil
+			},
+			GetPeerGroupsFunc: func(ctx context.Context, accountID, peerID string) ([]*types.Group, error) {
+				peersID := make([]string, len(peers))
+				for _, peer := range peers {
+					peersID = append(peersID, peer.ID)
+				}
+				return []*types.Group{
+					{
+						ID:        "group1",
+						AccountID: accountID,
+						Name:      "group1",
+						Issued:    "api",
+						Peers:     peersID,
+					},
+				}, nil
+			},
+			GetDNSDomainFunc: func(settings *types.Settings) string {
+				return "netbird.selfhosted"
+			},
+			GetAccountFunc: func(ctx context.Context, accountID string) (*types.Account, error) {
+				return account, nil
+			},
+			GetAccountByIDFunc: func(ctx context.Context, accountID string, userID string) (*types.Account, error) {
+				return account, nil
+			},
+			HasConnectedChannelFunc: func(peerID string) bool {
+				statuses := make(map[string]struct{})
+				for _, peer := range peers {
+					if peer.ID == noUpdateChannelTestPeerID {
+						break
+					}
+					statuses[peer.ID] = struct{}{}
+				}
+				_, ok := statuses[peerID]
+				return ok
+			},
+			GetAccountSettingsFunc: func(ctx context.Context, accountID string, userID string) (*types.Settings, error) {
+				return account.Settings, nil
+			},
+		},
+		networkMapController: networkMapController,
+		permissionsManager:   permissionsManager,
+	}
+}
+
+func TestGetPeer(t *testing.T) {
+
+	peer := &nbpeer.Peer{
+		ID:                     testPeerID,
+		Key:                    "key",
+		IP:                     netip.MustParseAddr("100.64.0.1"),
+		IPv6:                   netip.MustParseAddr("fd00::1"),
+		Status:                 &nbpeer.PeerStatus{Connected: true},
+		Name:                   "PeerName",
+		LoginExpirationEnabled: false,
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname:           "hostname",
+			GoOS:               "GoOS",
+			Kernel:             "kernel",
+			Core:               "core",
+			Platform:           "platform",
+			OS:                 "OS",
+			WtVersion:          "development",
+			SystemSerialNumber: "C02XJ0J0JGH7",
+		},
+	}
+
+	peer1 := peer.Copy()
+	peer1.ID = noUpdateChannelTestPeerID
+
+	expectedUpdatedPeer := peer.Copy()
+	expectedUpdatedPeer.LoginExpirationEnabled = true
+	expectedUpdatedPeer.SSHEnabled = true
+	expectedUpdatedPeer.Name = "New Name"
+
+	expectedPeer1 := peer1.Copy()
+	expectedPeer1.Status.Connected = false
+
+	tt := []struct {
+		name           string
+		expectedStatus int
+		requestType    string
+		requestPath    string
+		contentType    string
+		requestBody    io.Reader
+		expectedPeer   *nbpeer.Peer
+	}{
+		{
+			name:           "GetPeer with update channel",
+			requestType:    http.MethodGet,
+			requestPath:    "/peers/" + testPeerID,
+			expectedStatus: http.StatusOK,
+			expectedPeer:   peer,
+		},
+		{
+			name:           "PutPeer",
+			requestType:    http.MethodPut,
+			requestPath:    "/peers/" + testPeerID,
+			contentType:    "application/json",
+			expectedStatus: http.StatusOK,
+			requestBody:    bytes.NewBufferString("{\"login_expiration_enabled\":true,\"name\":\"New Name\",\"ssh_enabled\":true, \"inactivity_expiration_enabled\":true}"),
+			expectedPeer:   expectedUpdatedPeer,
+		},
+	}
+
+	p := initTestMetaData(t, peer, peer1)
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    "admin_user",
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+			if tc.contentType != "" {
+				req.Header.Set("Content-Type", tc.contentType)
+			}
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = p.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			if status := recorder.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, http.StatusOK)
+			}
+
+			content, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("I don't know what I expected; %v", err)
+			}
+
+			var got apiv1alpha1.Peer
+			err = json.Unmarshal(content, &got)
+			if err != nil {
+				t.Fatalf("Sent content is not in correct json format; %v", err)
+			}
+
+			assert.Equal(t, tc.expectedPeer.Name, got.Name)
+			assert.Equal(t, tc.expectedPeer.Meta.WtVersion, got.Version)
+			assert.Equal(t, tc.expectedPeer.IP.String(), got.Ip)
+			assert.Equal(t, "OS core", got.Os)
+			assert.Equal(t, tc.expectedPeer.LoginExpirationEnabled, got.LoginExpirationEnabled)
+			assert.Equal(t, tc.expectedPeer.SSHEnabled, got.SshEnabled)
+			assert.Equal(t, tc.expectedPeer.Status.Connected, got.Connected)
+			assert.Equal(t, tc.expectedPeer.Meta.SystemSerialNumber, got.SerialNumber)
+		})
+	}
+}
+
+func TestGetPeers(t *testing.T) {
+	peer := &nbpeer.Peer{
+		ID:                     testPeerID,
+		Key:                    "key",
+		IP:                     netip.MustParseAddr("100.64.0.1"),
+		IPv6:                   netip.MustParseAddr("fd00::1"),
+		Status:                 &nbpeer.PeerStatus{Connected: true},
+		Name:                   "PeerName",
+		LoginExpirationEnabled: false,
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname:           "hostname",
+			GoOS:               "GoOS",
+			Kernel:             "kernel",
+			Core:               "core",
+			Platform:           "platform",
+			OS:                 "OS",
+			WtVersion:          "development",
+			SystemSerialNumber: "C02XJ0J0JGH7",
+		},
+	}
+
+	peer1 := peer.Copy()
+	peer1.ID = noUpdateChannelTestPeerID
+
+	tt := []struct {
+		name           string
+		expectedStatus int
+		requestType    string
+		requestPath    string
+		contentType    string
+		expectedPeer   *nbpeer.Peer
+	}{
+		{
+			name:           "GetPeersMetaData",
+			requestType:    http.MethodGet,
+			requestPath:    "/peers",
+			expectedStatus: http.StatusOK,
+			expectedPeer:   peer,
+		},
+	}
+
+	p := initTestMetaData(t, peer, peer1)
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, nil)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    "admin_user",
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+			if tc.contentType != "" {
+				req.Header.Set("Content-Type", tc.contentType)
+			}
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = p.WithEndpointsForRouter(router)
+
+			p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
+				Return([]*nbpeer.Peer{peer, peer1}, 2, nil)
+
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			if status := recorder.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, http.StatusOK)
+			}
+
+			content, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("I don't know what I expected; %v", err)
+			}
+
+			var got *apiv1alpha1.Peer
+			respBody := apiv1alpha1.PeerBatch{}
+			err = json.Unmarshal(content, &respBody)
+			if err != nil {
+				t.Fatalf("Sent content is not in correct json format; %v", err)
+			}
+
+			assert.Equal(t, respBody.Page, 1)
+			assert.Equal(t, respBody.PageSize, 100)
+			assert.Equal(t, respBody.PeerCount, 2)
+			assert.Equal(t, len(respBody.Peers), 2)
+
+			for _, peer := range respBody.Peers {
+				if peer.Id == testPeerID {
+					got = &peer
+				}
+			}
+
+			assert.Equal(t, tc.expectedPeer.Name, got.Name)
+			assert.Equal(t, tc.expectedPeer.Meta.WtVersion, got.Version)
+			assert.Equal(t, tc.expectedPeer.IP.String(), got.Ip)
+			assert.Equal(t, "OS core", got.Os)
+			assert.Equal(t, tc.expectedPeer.LoginExpirationEnabled, got.LoginExpirationEnabled)
+			assert.Equal(t, tc.expectedPeer.SSHEnabled, got.SshEnabled)
+			assert.Equal(t, tc.expectedPeer.Status.Connected, got.Connected)
+			assert.Equal(t, tc.expectedPeer.Meta.SystemSerialNumber, got.SerialNumber)
+		})
+	}
+}
+
+func TestPeersHandlerUpdatePeerIP(t *testing.T) {
+	testPeer := &nbpeer.Peer{
+		ID:                     testPeerID,
+		Key:                    "key",
+		IP:                     netip.MustParseAddr("100.64.0.1"),
+		IPv6:                   netip.MustParseAddr("fd00::1"),
+		Status:                 &nbpeer.PeerStatus{Connected: false, LastSeen: time.Now()},
+		Name:                   "test-host@netbird.io",
+		LoginExpirationEnabled: false,
+		UserID:                 regularUser,
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname: "test-host@netbird.io",
+			Core:     "22.04",
+		},
+	}
+
+	p := initTestMetaData(t, testPeer)
+
+	tt := []struct {
+		name           string
+		peerID         string
+		requestBody    string
+		callerUserID   string
+		expectedStatus int
+		expectedIP     string
+	}{
+		{
+			name:           "update peer IP successfully",
+			peerID:         testPeerID,
+			requestBody:    `{"name":"test", "ssh_enabled":true, "login_expiration_enabled":true, "inactivity_expiration_enabled":true, "ip": "100.64.0.100"}`,
+			callerUserID:   adminUser,
+			expectedStatus: http.StatusOK,
+			expectedIP:     "100.64.0.100",
+		},
+		{
+			name:           "update peer IP with invalid IP",
+			peerID:         testPeerID,
+			requestBody:    `{"name":"test", "ssh_enabled":true, "login_expiration_enabled":true, "inactivity_expiration_enabled":true, "ip": "invalid-ip"}`,
+			callerUserID:   adminUser,
+			expectedStatus: http.StatusUnprocessableEntity,
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPut, fmt.Sprintf("/peers/%s", tc.peerID), bytes.NewBuffer([]byte(tc.requestBody)))
+			req.Header.Set("Content-Type", "application/json")
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    tc.callerUserID,
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+
+			rr := httptest.NewRecorder()
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = p.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			assert.Equal(t, tc.expectedStatus, rr.Code)
+
+			if tc.expectedStatus == http.StatusOK && tc.expectedIP != "" {
+				var updatedPeer apiv1alpha1.Peer
+				err := json.Unmarshal(rr.Body.Bytes(), &updatedPeer)
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedIP, updatedPeer.Ip)
+			}
+		})
+	}
+}
diff --git a/management/server/api/v1alpha1/users/users_handler.go b/management/server/api/v1alpha1/users/users_handler.go
new file mode 100644
index 000000000..2322e87fd
--- /dev/null
+++ b/management/server/api/v1alpha1/users/users_handler.go
@@ -0,0 +1,275 @@
+package users
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+
+	"github.com/gorilla/mux"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+)
+
+type Handler struct {
+	accountManager account.Manager
+}
+
+func NewHandler(accountManager account.Manager) *Handler {
+	return &Handler{
+		accountManager: accountManager,
+	}
+}
+
+func (h *Handler) WithEndpointsForRouter(router *mux.Router) *mux.Router {
+	router.HandleFunc("/users", h.getAllUsers).Methods("GET", "OPTIONS")
+	router.HandleFunc("/users", h.createUser).Methods("POST", "OPTIONS")
+	router.HandleFunc("/users/{userId}", h.updateUser).Methods("PUT", "OPTIONS")
+	router.HandleFunc("/users/{userId}", h.deleteUser).Methods("DELETE", "OPTIONS")
+	return router
+}
+
+// updateUser is a PUT requests to update User data
+func (h *Handler) updateUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	targetUserID := vars["userId"]
+	if len(targetUserID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user ID"), w)
+		return
+	}
+
+	existingUser, err := h.accountManager.GetUserByID(r.Context(), targetUserID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	req := &apiv1alpha1.UserRequest{}
+	err = json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if req.AutoGroups == nil {
+		util.WriteErrorResponse("auto_groups field can't be absent", http.StatusBadRequest, w)
+		return
+	}
+
+	userRole := types.StrRoleToUserRole(req.Role)
+	if userRole == types.UserRoleUnknown {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user role"), w)
+		return
+	}
+
+	newUser, err := h.accountManager.SaveUser(r.Context(), accountID, userID, &types.User{
+		Id:                   targetUserID,
+		Role:                 userRole,
+		AutoGroups:           req.AutoGroups,
+		Blocked:              req.IsBlocked,
+		Issued:               existingUser.Issued,
+		IntegrationReference: existingUser.IntegrationReference,
+	})
+
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, toUserResponse(newUser, userID))
+}
+
+// deleteUser is a DELETE request to delete a user
+func (h *Handler) deleteUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	targetUserID := vars["userId"]
+	if len(targetUserID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user ID"), w)
+		return
+	}
+
+	err = h.accountManager.DeleteUser(r.Context(), accountID, userID, targetUserID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
+}
+
+// createUser creates a User in the system with a status "invited" (effectively this is a user invite).
+func (h *Handler) createUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+
+	req := &apiv1alpha1.UserCreateRequest{}
+	err = json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if types.StrRoleToUserRole(req.Role) == types.UserRoleUnknown {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "unknown user role %s", req.Role), w)
+		return
+	}
+
+	email := ""
+	if req.Email != nil {
+		email = *req.Email
+	}
+
+	name := ""
+	if req.Name != nil {
+		name = *req.Name
+	}
+
+	newUser, err := h.accountManager.CreateUser(r.Context(), accountID, userID, &types.UserInfo{
+		Email:         email,
+		Name:          name,
+		Role:          req.Role,
+		AutoGroups:    req.AutoGroups,
+		IsServiceUser: req.IsServiceUser,
+		Issued:        types.UserIssuedAPI,
+	})
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, toUserResponse(newUser, userID))
+}
+
+// getAllUsers returns a list of users of the account this user belongs to.
+// It also gathers additional user data (like email and name) from the IDP manager.
+func (h *Handler) getAllUsers(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	data, err := h.accountManager.GetUsersFromAccount(r.Context(), accountID, userID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	serviceUser := r.URL.Query().Get("service_user")
+
+	users := make([]*apiv1alpha1.User, 0)
+	for _, d := range data {
+		if d.NonDeletable {
+			continue
+		}
+		if serviceUser == "" {
+			users = append(users, toUserResponse(d, userID))
+			continue
+		}
+
+		includeServiceUser, err := strconv.ParseBool(serviceUser)
+		log.WithContext(r.Context()).Tracef("Should include service user: %v", includeServiceUser)
+		if err != nil {
+			util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid service_user query parameter"), w)
+			return
+		}
+		if includeServiceUser == d.IsServiceUser {
+			users = append(users, toUserResponse(d, userID))
+		}
+	}
+
+	util.WriteJSONObject(r.Context(), w, users)
+}
+
+func toUserResponse(user *types.UserInfo, currenUserID string) *apiv1alpha1.User {
+	autoGroups := user.AutoGroups
+	if autoGroups == nil {
+		autoGroups = []string{}
+	}
+
+	var userStatus apiv1alpha1.UserStatus
+	switch user.Status {
+	case "active":
+		userStatus = apiv1alpha1.UserStatusActive
+	case "invited":
+		userStatus = apiv1alpha1.UserStatusInvited
+	default:
+		userStatus = apiv1alpha1.UserStatusBlocked
+	}
+
+	if user.IsBlocked {
+		userStatus = apiv1alpha1.UserStatusBlocked
+	}
+
+	isCurrent := user.ID == currenUserID
+
+	var password *string
+	if user.Password != "" {
+		password = &user.Password
+	}
+
+	var idpID *string
+	if user.IdPID != "" {
+		idpID = &user.IdPID
+	}
+
+	return &apiv1alpha1.User{
+		Id:              user.ID,
+		Name:            user.Name,
+		Email:           user.Email,
+		Role:            user.Role,
+		AutoGroups:      autoGroups,
+		Status:          userStatus,
+		IsCurrent:       &isCurrent,
+		IsServiceUser:   &user.IsServiceUser,
+		IsBlocked:       user.IsBlocked,
+		LastLogin:       &user.LastLogin,
+		Issued:          &user.Issued,
+		PendingApproval: user.PendingApproval,
+		Password:        password,
+		IdpId:           idpID,
+	}
+}
diff --git a/management/server/api/v1alpha1/users/users_handler_test.go b/management/server/api/v1alpha1/users/users_handler_test.go
new file mode 100644
index 000000000..13fc806d5
--- /dev/null
+++ b/management/server/api/v1alpha1/users/users_handler_test.go
@@ -0,0 +1,452 @@
+package users
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/management/server/mock_server"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const (
+	existingAccountID         = "existingAccountID"
+	notFoundAccountID         = "notFoundAccountID"
+	testDomain                = "hotmail.com"
+	existingUserID            = "existingUserID"
+	notFoundUserID            = "notFoundUserID"
+	serviceUserID             = "serviceUserID"
+	nonDeletableServiceUserID = "nonDeletableServiceUserID"
+	regularUserID             = "regularUserID"
+)
+
+var usersTestAccount = &types.Account{
+	Id:     existingAccountID,
+	Domain: testDomain,
+	Users: map[string]*types.User{
+		existingUserID: {
+			Id:            existingUserID,
+			Role:          "admin",
+			IsServiceUser: false,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		regularUserID: {
+			Id:            regularUserID,
+			Role:          "user",
+			IsServiceUser: false,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		serviceUserID: {
+			Id:            serviceUserID,
+			Role:          "user",
+			IsServiceUser: true,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		nonDeletableServiceUserID: {
+			Id:            nonDeletableServiceUserID,
+			Role:          "admin",
+			IsServiceUser: true,
+			NonDeletable:  true,
+			Issued:        types.UserIssuedIntegration,
+		},
+	},
+}
+
+func initUsersTestData() *Handler {
+	return &Handler{
+		accountManager: &mock_server.MockAccountManager{
+			GetUserByIDFunc: func(ctx context.Context, id string) (*types.User, error) {
+				return usersTestAccount.Users[id], nil
+			},
+			GetUsersFromAccountFunc: func(_ context.Context, accountID, userID string) (map[string]*types.UserInfo, error) {
+				usersInfos := make(map[string]*types.UserInfo)
+				for _, v := range usersTestAccount.Users {
+					usersInfos[v.Id] = &types.UserInfo{
+						ID:            v.Id,
+						Role:          string(v.Role),
+						Name:          "",
+						Email:         "",
+						IsServiceUser: v.IsServiceUser,
+						NonDeletable:  v.NonDeletable,
+						Issued:        v.Issued,
+					}
+				}
+				return usersInfos, nil
+			},
+			CreateUserFunc: func(_ context.Context, accountID, userID string, key *types.UserInfo) (*types.UserInfo, error) {
+				if userID != existingUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", userID)
+				}
+				return key, nil
+			},
+			DeleteUserFunc: func(_ context.Context, accountID string, initiatorUserID string, targetUserID string) error {
+				if targetUserID == notFoundUserID {
+					return status.Errorf(status.NotFound, "user with ID %s does not exists", targetUserID)
+				}
+				if !usersTestAccount.Users[targetUserID].IsServiceUser {
+					return status.Errorf(status.PermissionDenied, "user with ID %s is not a service user and can not be deleted", targetUserID)
+				}
+				return nil
+			},
+			SaveUserFunc: func(_ context.Context, accountID, userID string, update *types.User) (*types.UserInfo, error) {
+				if update.Id == notFoundUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", update.Id)
+				}
+
+				if userID != existingUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", userID)
+				}
+
+				info, err := update.Copy().ToUserInfo(nil)
+				if err != nil {
+					return nil, err
+				}
+				return info, nil
+			},
+		},
+	}
+}
+
+func TestGetUsers(t *testing.T) {
+	tt := []struct {
+		name            string
+		expectedStatus  int
+		requestType     string
+		requestPath     string
+		expectedUserIDs []string
+	}{
+		{name: "getAllUsers", requestType: http.MethodGet, requestPath: "/users", expectedStatus: http.StatusOK, expectedUserIDs: []string{existingUserID, regularUserID, serviceUserID}},
+		{name: "GetOnlyServiceUsers", requestType: http.MethodGet, requestPath: "/users?service_user=true", expectedStatus: http.StatusOK, expectedUserIDs: []string{serviceUserID}},
+		{name: "GetOnlyRegularUsers", requestType: http.MethodGet, requestPath: "/users?service_user=false", expectedStatus: http.StatusOK, expectedUserIDs: []string{existingUserID, regularUserID}},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, nil)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			content, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("I don't know what I expected; %v", err)
+			}
+
+			if status := recorder.Code; status != tc.expectedStatus {
+				t.Errorf("handler returned wrong status code: got %v want %v, content: %s",
+					status, tc.expectedStatus, string(content))
+				return
+			}
+
+			respBody := []*types.UserInfo{}
+			err = json.Unmarshal(content, &respBody)
+			if err != nil {
+				t.Fatalf("Sent content is not in correct json format; %v", err)
+			}
+
+			assert.Equal(t, len(respBody), len(tc.expectedUserIDs))
+			for _, v := range respBody {
+				assert.Contains(t, tc.expectedUserIDs, v.ID)
+				assert.Equal(t, v.ID, usersTestAccount.Users[v.ID].Id)
+				assert.Equal(t, v.Role, string(usersTestAccount.Users[v.ID].Role))
+				assert.Equal(t, v.IsServiceUser, usersTestAccount.Users[v.ID].IsServiceUser)
+				assert.Equal(t, v.Issued, usersTestAccount.Users[v.ID].Issued)
+			}
+		})
+	}
+}
+
+func TestUpdateUser(t *testing.T) {
+	tt := []struct {
+		name                  string
+		expectedStatusCode    int
+		requestType           string
+		requestPath           string
+		requestBody           io.Reader
+		expectedUserID        string
+		expectedRole          string
+		expectedStatus        string
+		expectedBlocked       bool
+		expectedIsServiceUser bool
+		expectedGroups        []string
+	}{
+		{
+			name:               "Update_Block_User",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    true,
+			expectedRole:       "user",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_1"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"user\",\"auto_groups\":[\"group_1\"],\"is_service_user\":false, \"is_blocked\": true}"),
+		},
+		{
+			name:               "Update_Change_Role_To_Admin",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_1"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"auto_groups\":[\"group_1\"],\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+		{
+			name:               "Update_Groups",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_2", "group_3"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"auto_groups\":[\"group_3\", \"group_2\"],\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+		{
+			name:               "Should_Fail_Because_AutoGroups_Is_Absent",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusUnprocessableEntity,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_2", "group_3"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			req.Header.Set("Content-Type", "application/json")
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			if status := recorder.Code; status != tc.expectedStatusCode {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, http.StatusOK)
+			}
+
+			if tc.expectedStatusCode == 200 {
+
+				content, err := io.ReadAll(res.Body)
+				if err != nil {
+					t.Fatalf("I don't know what I expected; %v", err)
+				}
+
+				respBody := &apiv1alpha1.User{}
+				err = json.Unmarshal(content, &respBody)
+				if err != nil {
+					t.Fatalf("response content is not in correct json format; %v", err)
+				}
+
+				assert.Equal(t, tc.expectedUserID, respBody.Id)
+				assert.Equal(t, tc.expectedRole, respBody.Role)
+				assert.Equal(t, tc.expectedIsServiceUser, *respBody.IsServiceUser)
+				assert.Equal(t, tc.expectedBlocked, respBody.IsBlocked)
+				assert.Len(t, respBody.AutoGroups, len(tc.expectedGroups))
+
+				for _, expectedGroup := range tc.expectedGroups {
+					exists := false
+					for _, actualGroup := range respBody.AutoGroups {
+						if expectedGroup == actualGroup {
+							exists = true
+						}
+					}
+					assert.True(t, exists, fmt.Sprintf("group %s not found in the response", expectedGroup))
+				}
+			}
+		})
+	}
+}
+
+func TestCreateUser(t *testing.T) {
+	name := "name"
+	email := "email"
+	serviceUserToAdd := apiv1alpha1.UserCreateRequest{
+		AutoGroups:    []string{},
+		Email:         nil,
+		IsServiceUser: true,
+		Name:          &name,
+		Role:          "admin",
+	}
+	serviceUserString, err := json.Marshal(serviceUserToAdd)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	regularUserToAdd := apiv1alpha1.UserCreateRequest{
+		AutoGroups:    []string{},
+		Email:         &email,
+		IsServiceUser: true,
+		Name:          &name,
+		Role:          "admin",
+	}
+	regularUserString, err := json.Marshal(regularUserToAdd)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tt := []struct {
+		name           string
+		expectedStatus int
+		requestType    string
+		requestPath    string
+		requestBody    io.Reader
+		expectedResult []*types.User
+	}{
+		{name: "CreateServiceUser", requestType: http.MethodPost, requestPath: "/users", expectedStatus: http.StatusOK, requestBody: bytes.NewBuffer(serviceUserString)},
+		// right now creation is blocked in AC middleware, will be refactored in the future
+		{name: "CreateRegularUser", requestType: http.MethodPost, requestPath: "/users", expectedStatus: http.StatusOK, requestBody: bytes.NewBuffer(regularUserString)},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			rr := httptest.NewRecorder()
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+			req.Header.Set("Content-Type", "application/json")
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			res := rr.Result()
+			defer res.Body.Close()
+
+			if status := rr.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, tc.expectedStatus)
+			}
+		})
+	}
+}
+
+func TestDeleteUser(t *testing.T) {
+	tt := []struct {
+		name           string
+		expectedStatus int
+		expectedBody   bool
+		requestType    string
+		requestPath    string
+		requestVars    map[string]string
+		requestBody    io.Reader
+	}{
+		{
+			name:           "Delete Regular User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + regularUserID,
+			requestVars:    map[string]string{"userId": regularUserID},
+			expectedStatus: http.StatusForbidden,
+		},
+		{
+			name:           "Delete Service User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + serviceUserID,
+			requestVars:    map[string]string{"userId": serviceUserID},
+			expectedStatus: http.StatusOK,
+		},
+		{
+			name:           "Delete Not Existing User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + notFoundUserID,
+			requestVars:    map[string]string{"userId": notFoundUserID},
+			expectedStatus: http.StatusNotFound,
+		},
+	}
+
+	userHandler := initUsersTestData()
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, nil)
+			req = mux.SetURLVars(req, tc.requestVars)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+			rr := httptest.NewRecorder()
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			res := rr.Result()
+			defer res.Body.Close()
+
+			if status := rr.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, tc.expectedStatus)
+			}
+		})
+	}
+}
diff --git a/management/server/auth/manager.go b/management/server/auth/manager.go
index 9498789f2..7064c094f 100644
--- a/management/server/auth/manager.go
+++ b/management/server/auth/manager.go
@@ -75,10 +75,10 @@ func (m *manager) ValidateAndParseToken(ctx context.Context, value string) (auth
 }
 
 func (m *manager) EnsureUserAccessByJWTGroups(ctx context.Context, userAuth auth.UserAuth, token *jwt.Token) (auth.UserAuth, error) {
-	// Child accounts and PAT-authenticated requests do not use JWT group access checks.
+	// PAT-authenticated requests do not use JWT group access checks.
 	// Embedded-Dex local users also skip them because local password authentication
 	// does not provide external IdP group claims.
-	if userAuth.IsChild || userAuth.IsPAT || dex.IsLocalUserID(userAuth.UserId) {
+	if userAuth.IsPAT || dex.IsLocalUserID(userAuth.UserId) {
 		return userAuth, nil
 	}
 
diff --git a/management/server/auth/session.go b/management/server/auth/session.go
index 7621a1c10..2f1b97975 100644
--- a/management/server/auth/session.go
+++ b/management/server/auth/session.go
@@ -3,13 +3,12 @@ package auth
 import (
 	"context"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
-
-	"github.com/eko/gocache/lib/v4/cache"
-	"github.com/eko/gocache/lib/v4/store"
 )
 
 const (
@@ -22,12 +21,17 @@ var (
 	ErrTokenExpired     = errors.New("JWT expired")
 )
 
-type SessionStore struct {
-	cache *cache.Cache[string]
+// TokenCache atomically records used JWTs until their expiration.
+type TokenCache interface {
+	SetNX(ctx context.Context, key, value string, ttl time.Duration) (bool, error)
 }
 
-func NewSessionStore(cacheStore store.StoreInterface) *SessionStore {
-	return &SessionStore{cache: cache.New[string](cacheStore)}
+type SessionStore struct {
+	cache TokenCache
+}
+
+func NewSessionStore(cacheStore TokenCache) *SessionStore {
+	return &SessionStore{cache: cacheStore}
 }
 
 // RegisterToken records a JWT until its exp time and rejects reuse.
@@ -38,24 +42,34 @@ func (s *SessionStore) RegisterToken(ctx context.Context, token string, expiresA
 	}
 
 	key := usedTokenKeyPrefix + hashToken(token)
-	_, err := s.cache.Get(ctx, key)
-	if err == nil {
+	created, err := s.cache.SetNX(ctx, key, usedTokenMarker, ttl)
+	if err != nil {
+		return fmt.Errorf("store used token entry: %w", err)
+	}
+	if !created {
 		return ErrTokenAlreadyUsed
 	}
 
-	var notFound *store.NotFound
-	if !errors.As(err, &notFound) {
-		return fmt.Errorf("failed to lookup used token entry: %w", err)
-	}
-
-	if err := s.cache.Set(ctx, key, usedTokenMarker, store.WithExpiration(ttl)); err != nil {
-		return fmt.Errorf("failed to store used token entry: %w", err)
-	}
-
 	return nil
 }
 
 func hashToken(token string) string {
-	sum := sha256.Sum256([]byte(token))
+	sum := sha256.Sum256([]byte(canonicalizeToken(token)))
 	return hex.EncodeToString(sum[:])
 }
+
+// canonicalizeToken re-encodes the JWT signature segment so noncanonical
+// spellings of the same signature map to one stable cache key.
+func canonicalizeToken(token string) string {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return token
+	}
+
+	sig, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return token
+	}
+
+	return parts[0] + "." + parts[1] + "." + base64.RawURLEncoding.EncodeToString(sig)
+}
diff --git a/management/server/auth/session_test.go b/management/server/auth/session_test.go
index 3a7d85f4c..425e3143d 100644
--- a/management/server/auth/session_test.go
+++ b/management/server/auth/session_test.go
@@ -2,9 +2,15 @@ package auth
 
 import (
 	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"errors"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -38,6 +44,39 @@ func TestSessionStore_RegisterSameTokenTwiceIsRejected(t *testing.T) {
 	assert.ErrorIs(t, err, ErrTokenAlreadyUsed)
 }
 
+func TestSessionStore_ConcurrentRegistrationAllowsOneCaller(t *testing.T) {
+	s := newTestSessionStore(t)
+	ctx := context.Background()
+	const attempts = 100
+
+	start := make(chan struct{})
+	results := make(chan error, attempts)
+	for range attempts {
+		go func() {
+			<-start
+			results <- s.RegisterToken(ctx, "token", time.Now().Add(time.Hour))
+		}()
+	}
+	close(start)
+
+	succeeded := 0
+	alreadyUsed := 0
+	for range attempts {
+		err := <-results
+		switch {
+		case err == nil:
+			succeeded++
+		case errors.Is(err, ErrTokenAlreadyUsed):
+			alreadyUsed++
+		default:
+			require.NoError(t, err, "concurrent registration returned an unexpected error")
+		}
+	}
+
+	assert.Equal(t, 1, succeeded, "exactly one concurrent caller should register the token")
+	assert.Equal(t, attempts-1, alreadyUsed, "every other caller should be rejected as already used")
+}
+
 func TestSessionStore_RegisterDifferentTokensAreIndependent(t *testing.T) {
 	s := newTestSessionStore(t)
 	ctx := context.Background()
@@ -72,6 +111,23 @@ func TestSessionStore_EntryEvictsAtTTLAndAllowsReRegistration(t *testing.T) {
 	require.NoError(t, s.RegisterToken(ctx, token, time.Now().Add(time.Hour)))
 }
 
+type failingTokenCache struct {
+	err error
+}
+
+func (f failingTokenCache) SetNX(context.Context, string, string, time.Duration) (bool, error) {
+	return false, f.err
+}
+
+func TestSessionStore_CacheErrorIsReturned(t *testing.T) {
+	cacheErr := errors.New("cache unavailable")
+	s := NewSessionStore(failingTokenCache{err: cacheErr})
+
+	err := s.RegisterToken(context.Background(), "token", time.Now().Add(time.Hour))
+	require.Error(t, err, "cache failure should be surfaced to the caller")
+	assert.ErrorIs(t, err, cacheErr, "cache error should be wrapped, not replaced")
+}
+
 func TestHashToken_StableAndDoesNotLeak(t *testing.T) {
 	a := hashToken("tokenA")
 	b := hashToken("tokenB")
@@ -80,3 +136,49 @@ func TestHashToken_StableAndDoesNotLeak(t *testing.T) {
 	assert.Len(t, a, 64, "sha256 hex must be 64 chars")
 	assert.NotContains(t, a, "tokenA", "raw token must not appear in hash")
 }
+
+func TestSessionStore_NoncanonicalSpellingIsRejectedAsReplay(t *testing.T) {
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
+		"sub": "user",
+		"exp": time.Now().Add(time.Hour).Unix(),
+	})
+	canonical, err := token.SignedString(privateKey)
+	require.NoError(t, err)
+
+	parts := strings.Split(canonical, ".")
+	require.Len(t, parts, 3)
+
+	// A 256-byte RSA signature (256 mod 3 == 1) leaves unused bits in the final
+	// base64url character; flip one without changing the decoded signature.
+	const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
+	last := strings.IndexByte(alphabet, parts[2][len(parts[2])-1])
+	require.GreaterOrEqual(t, last, 0)
+	require.Equal(t, 0, last&3, "unexpected canonical RSA signature encoding")
+
+	equivalentSig := parts[2][:len(parts[2])-1] + string(alphabet[last|1])
+	equivalent := parts[0] + "." + parts[1] + "." + equivalentSig
+	require.NotEqual(t, canonical, equivalent, "spellings must differ as strings")
+
+	// Same decoded signature bytes, so they verify as the same JWT.
+	canonicalSig, err := base64.RawURLEncoding.DecodeString(parts[2])
+	require.NoError(t, err)
+	altSig, err := base64.RawURLEncoding.DecodeString(equivalentSig)
+	require.NoError(t, err)
+	require.Equal(t, canonicalSig, altSig, "spellings must decode to identical signature bytes")
+
+	// The replay-cache key must be identical for both spellings.
+	assert.Equal(t, hashToken(canonical), hashToken(equivalent),
+		"noncanonical spelling must map to the same replay-cache key")
+
+	s := newTestSessionStore(t)
+	ctx := context.Background()
+	exp := time.Now().Add(time.Hour)
+
+	require.NoError(t, s.RegisterToken(ctx, canonical, exp), "first claim should succeed")
+	err = s.RegisterToken(ctx, equivalent, exp)
+	require.Error(t, err, "alternate spelling must be treated as a replay")
+	assert.ErrorIs(t, err, ErrTokenAlreadyUsed)
+}
diff --git a/management/server/cache/idp.go b/management/server/cache/idp.go
index 6ec42e217..ec2684d6f 100644
--- a/management/server/cache/idp.go
+++ b/management/server/cache/idp.go
@@ -88,7 +88,8 @@ func NewUserDataCache(store store.StoreInterface) *UserDataCacheImpl {
 
 // AccountUserDataCache wraps the basic Get, Set and Delete methods for []*idp.UserData objects.
 type AccountUserDataCache struct {
-	cache Marshaler
+	cache    Marshaler
+	loadable *cache.LoadableCache[any]
 }
 
 func (a *AccountUserDataCache) Get(ctx context.Context, key string) ([]*idp.UserData, error) {
@@ -127,13 +128,18 @@ func (a *AccountUserDataCache) Delete(ctx context.Context, key string) error {
 	return a.cache.Delete(ctx, key)
 }
 
+// Close stops the goroutine that stores loaded values. The cache must not be used afterwards.
+func (a *AccountUserDataCache) Close() error {
+	return a.loadable.Close()
+}
+
 // NewAccountUserDataCache creates a new AccountUserDataCache object.
 func NewAccountUserDataCache(loadableFunc cache.LoadFunction[any], store store.StoreInterface) *AccountUserDataCache {
 	simpleCache := cache.New[any](store)
 	loadable := cache.NewLoadable[any](loadableFunc, simpleCache)
 	if store.GetType() == redis.RedisType {
 		m := marshaler.New(loadable)
-		return &AccountUserDataCache{cache: m}
+		return &AccountUserDataCache{cache: m, loadable: loadable}
 	}
-	return &AccountUserDataCache{cache: &marshalerWraper{loadable}}
+	return &AccountUserDataCache{cache: &marshalerWraper{loadable}, loadable: loadable}
 }
diff --git a/management/server/cache/memory.go b/management/server/cache/memory.go
new file mode 100644
index 000000000..f140f3ec8
--- /dev/null
+++ b/management/server/cache/memory.go
@@ -0,0 +1,57 @@
+package cache
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/eko/gocache/lib/v4/store"
+	gocachestore "github.com/eko/gocache/store/go_cache/v4"
+	gocache "github.com/patrickmn/go-cache"
+)
+
+type goCacheStore struct {
+	store.StoreInterface
+	client *gocache.Cache
+	mu     sync.Mutex
+}
+
+func newMemoryStore(maxTimeout, cleanupInterval time.Duration) Store {
+	client := gocache.New(maxTimeout, cleanupInterval)
+	return &goCacheStore{
+		StoreInterface: gocachestore.NewGoCache(client),
+		client:         client,
+	}
+}
+
+func (s *goCacheStore) SetNX(_ context.Context, key, value string, ttl time.Duration) (bool, error) {
+	// Add only returns an error when a non-expired entry already exists.
+	if err := s.client.Add(key, value, ttl); err != nil {
+		return false, nil //nolint:nilerr
+	}
+	return true, nil
+}
+
+// GetDel reads the value under key and removes it. go-cache has no native read-and-delete
+// and releases its own lock between the two calls, so mu holds the pair together and no
+// value is consumed twice.
+//
+// Writes do not take mu: a Set landing mid-pair is lost, since GetDel returns the prior
+// value and deletes the new one. Callers must write a consumed key only once.
+func (s *goCacheStore) GetDel(_ context.Context, key string) (string, bool, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	value, found := s.client.Get(key)
+	if !found {
+		return "", false, nil
+	}
+	s.client.Delete(key)
+
+	str, ok := value.(string)
+	if !ok {
+		return "", false, fmt.Errorf("cached value is %T, not a string", value)
+	}
+	return str, true, nil
+}
diff --git a/management/server/cache/memory_test.go b/management/server/cache/memory_test.go
new file mode 100644
index 000000000..363504921
--- /dev/null
+++ b/management/server/cache/memory_test.go
@@ -0,0 +1,76 @@
+package cache_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/cache"
+)
+
+func TestMemoryStore(t *testing.T) {
+	memStore, err := cache.NewStore(context.Background(), 100*time.Millisecond, 300*time.Millisecond, 100)
+	require.NoError(t, err, "couldn't create memory store")
+
+	ctx := context.Background()
+	key, value := "testing", "tested"
+	err = memStore.Set(ctx, key, value)
+	assert.NoError(t, err, "couldn't set testing data")
+
+	result, err := memStore.Get(ctx, key)
+	assert.NoError(t, err, "couldn't get testing data")
+	assert.Equal(t, value, result, "value returned doesn't match testing data")
+
+	created, err := memStore.SetNX(ctx, "conditional", value, 100*time.Millisecond)
+	require.NoError(t, err, "couldn't conditionally set testing data")
+	require.True(t, created, "first conditional set should create the entry")
+
+	created, err = memStore.SetNX(ctx, "conditional", value, 100*time.Millisecond)
+	require.NoError(t, err, "couldn't conditionally check testing data")
+	require.False(t, created, "second conditional set should not replace the entry")
+
+	// test expiration
+	time.Sleep(300 * time.Millisecond)
+	_, err = memStore.Get(ctx, key)
+	assert.Error(t, err, "value should not be found")
+}
+
+func TestMemoryStoreGetDel(t *testing.T) {
+	ctx := context.Background()
+	newStore := func(t *testing.T) cache.Store {
+		t.Helper()
+		memStore, err := cache.NewStore(ctx, time.Minute, time.Minute, 100)
+		require.NoError(t, err, "couldn't create memory store")
+
+		return memStore
+	}
+
+	const (
+		key   = "consume"
+		value = "verifier"
+	)
+
+	t.Run("exactly one concurrent caller consumes the key", func(t *testing.T) {
+		memStore := newStore(t)
+		require.NoError(t, memStore.Set(ctx, key, value), "couldn't set testing data")
+
+		assertGetDelConsumedOnce(ctx, t, []cache.Store{memStore}, key, value)
+		assertGetDelMisses(ctx, t, memStore, key)
+	})
+
+	t.Run("missing key is not an error", func(t *testing.T) {
+		assertGetDelMisses(ctx, t, newStore(t), "never-set")
+	})
+
+	t.Run("expired key is not found", func(t *testing.T) {
+		memStore := newStore(t)
+		_, err := memStore.SetNX(ctx, key, value, 50*time.Millisecond)
+		require.NoError(t, err, "couldn't set testing data")
+
+		time.Sleep(100 * time.Millisecond)
+		assertGetDelMisses(ctx, t, memStore, key)
+	})
+}
diff --git a/management/server/cache/redis.go b/management/server/cache/redis.go
new file mode 100644
index 000000000..0cd921c92
--- /dev/null
+++ b/management/server/cache/redis.go
@@ -0,0 +1,63 @@
+package cache
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"time"
+
+	"github.com/eko/gocache/lib/v4/store"
+	redisstore "github.com/eko/gocache/store/redis/v4"
+	"github.com/redis/go-redis/v9"
+	log "github.com/sirupsen/logrus"
+)
+
+type redisStore struct {
+	store.StoreInterface
+	client *redis.Client
+}
+
+func getRedisStore(ctx context.Context, redisEnvAddr string, maxConn int) (Store, error) {
+	options, err := redis.ParseURL(redisEnvAddr)
+	if err != nil {
+		return nil, fmt.Errorf("parsing redis cache url: %s", err)
+	}
+
+	options.MaxIdleConns = int(math.Ceil(float64(maxConn) * 0.5)) // 50% of max conns
+	options.MinIdleConns = int(math.Ceil(float64(maxConn) * 0.1)) // 10% of max conns
+	options.MaxActiveConns = maxConn
+	options.ConnMaxIdleTime = 30 * time.Minute
+	options.ConnMaxLifetime = 0
+	options.PoolTimeout = 10 * time.Second
+	redisClient := redis.NewClient(options)
+	subCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
+	defer cancel()
+
+	_, err = redisClient.Ping(subCtx).Result()
+	if err != nil {
+		return nil, err
+	}
+
+	log.WithContext(subCtx).Infof("using redis cache at %s", redisEnvAddr)
+
+	return &redisStore{
+		StoreInterface: redisstore.NewRedis(redisClient),
+		client:         redisClient,
+	}, nil
+}
+
+func (s *redisStore) SetNX(ctx context.Context, key, value string, ttl time.Duration) (bool, error) {
+	return s.client.SetNX(ctx, key, value, ttl).Result()
+}
+
+func (s *redisStore) GetDel(ctx context.Context, key string) (string, bool, error) {
+	value, err := s.client.GetDel(ctx, key).Result()
+	if errors.Is(err, redis.Nil) {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, err
+	}
+	return value, true, nil
+}
diff --git a/management/server/cache/redis_test.go b/management/server/cache/redis_test.go
new file mode 100644
index 000000000..994ec7490
--- /dev/null
+++ b/management/server/cache/redis_test.go
@@ -0,0 +1,153 @@
+package cache_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/eko/gocache/lib/v4/store"
+	"github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	testcontainersredis "github.com/testcontainers/testcontainers-go/modules/redis"
+
+	"github.com/netbirdio/netbird/management/server/cache"
+)
+
+func startRedis(t *testing.T) string {
+	t.Helper()
+
+	ctx := context.Background()
+	redisContainer, err := testcontainersredis.Run(ctx, "redis:7")
+	require.NoError(t, err, "couldn't start redis container")
+
+	t.Cleanup(func() {
+		if err := redisContainer.Terminate(ctx); err != nil {
+			t.Logf("failed to terminate container: %s", err)
+		}
+	})
+
+	redisURL, err := redisContainer.ConnectionString(ctx)
+	require.NoError(t, err, "couldn't get connection string")
+
+	t.Setenv(cache.RedisStoreEnvVar, redisURL)
+	return redisURL
+}
+
+func newRedisStore(t *testing.T) cache.Store {
+	t.Helper()
+
+	redisStore, err := cache.NewStore(context.Background(), 100*time.Millisecond, 300*time.Millisecond, 100)
+	require.NoError(t, err)
+
+	return redisStore
+}
+
+func TestRedisStoreConnectionFailure(t *testing.T) {
+	t.Setenv(cache.RedisStoreEnvVar, "redis://127.0.0.1:6379")
+	_, err := cache.NewStore(context.Background(), 10*time.Millisecond, 30*time.Millisecond, 100)
+	require.Error(t, err, "getting redis cache store should return error")
+}
+
+func TestRedisStoreConnectionSuccess(t *testing.T) {
+	ctx := context.Background()
+	redisURL := startRedis(t)
+	redisStore := newRedisStore(t)
+
+	key, value := "testing", "tested"
+	err := redisStore.Set(ctx, key, value, store.WithExpiration(100*time.Millisecond))
+	assert.NoError(t, err, "couldn't set testing data")
+
+	result, err := redisStore.Get(ctx, key)
+	assert.NoError(t, err, "couldn't get testing data")
+	assert.Equal(t, value, result, "value returned doesn't match testing data")
+
+	options, err := redis.ParseURL(redisURL)
+	require.NoError(t, err, "parsing redis cache url")
+
+	redisClient := redis.NewClient(options)
+	r, err := redisClient.Get(ctx, key).Result()
+	assert.NoError(t, err, "couldn't get testing data from redis")
+	assert.Equal(t, value, r, "value returned from redis doesn't match testing data")
+
+	// test expiration
+	time.Sleep(300 * time.Millisecond)
+	_, err = redisStore.Get(ctx, key)
+	assert.Error(t, err, "value should not be found")
+}
+
+func TestRedisStoreSetNX(t *testing.T) {
+	ctx := context.Background()
+	redisURL := startRedis(t)
+	redisStore, secondRedisStore := newRedisStore(t), newRedisStore(t)
+
+	const (
+		key   = "conditional"
+		value = "tested"
+	)
+
+	start := make(chan struct{})
+	type setResult struct {
+		created bool
+		err     error
+	}
+	results := make(chan setResult, 2)
+	for _, cacheStore := range []cache.Store{redisStore, secondRedisStore} {
+		go func() {
+			<-start
+			created, err := cacheStore.SetNX(ctx, key, value, time.Minute)
+			results <- setResult{created: created, err: err}
+		}()
+	}
+	close(start)
+
+	created := 0
+	for range 2 {
+		result := <-results
+		require.NoError(t, result.err, "conditional redis set failed")
+		if result.created {
+			created++
+		}
+	}
+	require.Equal(t, 1, created, "expected exactly one redis client to create the entry")
+
+	options, err := redis.ParseURL(redisURL)
+	require.NoError(t, err, "parsing redis cache url")
+
+	ttl, err := redis.NewClient(options).PTTL(ctx, key).Result()
+	require.NoError(t, err, "couldn't read entry TTL")
+	require.Positive(t, ttl, "created entry should have a positive TTL")
+}
+
+func TestRedisStoreGetDel(t *testing.T) {
+	ctx := context.Background()
+	startRedis(t)
+	redisStore, secondRedisStore := newRedisStore(t), newRedisStore(t)
+
+	const (
+		key   = "consume"
+		value = "verifier"
+	)
+
+	t.Run("exactly one caller across independent clients consumes the key", func(t *testing.T) {
+		// A generous TTL: the key is consumed explicitly, so expiry racing the
+		// concurrent callers would only make the test flaky on a loaded runner.
+		err := redisStore.Set(ctx, key, value, store.WithExpiration(time.Minute))
+		require.NoError(t, err, "couldn't set value to consume")
+
+		assertGetDelConsumedOnce(ctx, t, []cache.Store{redisStore, secondRedisStore}, key, value)
+		assertGetDelMisses(ctx, t, secondRedisStore, key)
+	})
+
+	t.Run("missing key is not an error", func(t *testing.T) {
+		assertGetDelMisses(ctx, t, redisStore, "never-set")
+	})
+
+	t.Run("expired key is not found", func(t *testing.T) {
+		err := redisStore.Set(ctx, key, value, store.WithExpiration(50*time.Millisecond))
+		require.NoError(t, err, "couldn't set value to consume")
+
+		time.Sleep(100 * time.Millisecond)
+		assertGetDelMisses(ctx, t, redisStore, key)
+	})
+}
diff --git a/management/server/cache/store.go b/management/server/cache/store.go
index 2ca8e8603..a0c093e5d 100644
--- a/management/server/cache/store.go
+++ b/management/server/cache/store.go
@@ -2,17 +2,10 @@ package cache
 
 import (
 	"context"
-	"fmt"
-	"math"
 	"os"
 	"time"
 
 	"github.com/eko/gocache/lib/v4/store"
-	gocache_store "github.com/eko/gocache/store/go_cache/v4"
-	redis_store "github.com/eko/gocache/store/redis/v4"
-	gocache "github.com/patrickmn/go-cache"
-	"github.com/redis/go-redis/v9"
-	log "github.com/sirupsen/logrus"
 )
 
 // RedisStoreEnvVar is the environment variable that determines if a redis store should be used.
@@ -31,15 +24,23 @@ const (
 	DefaultStoreMaxConn = 1000
 )
 
+// Store extends the shared cache interface with conditional and consuming operations.
+type Store interface {
+	store.StoreInterface
+	// SetNX stores a value with a TTL only when the key does not exist.
+	SetNX(ctx context.Context, key, value string, ttl time.Duration) (bool, error)
+	// GetDel reads a value and removes it, so only one caller can consume a key.
+	GetDel(ctx context.Context, key string) (value string, found bool, err error)
+}
+
 // NewStore creates a new cache store with the given max timeout and cleanup interval. It checks for the environment Variable RedisStoreEnvVar
 // to determine if a redis store should be used. If the environment variable is set, it will attempt to connect to the redis store.
-func NewStore(ctx context.Context, maxTimeout, cleanupInterval time.Duration, maxConn int) (store.StoreInterface, error) {
+func NewStore(ctx context.Context, maxTimeout, cleanupInterval time.Duration, maxConn int) (Store, error) {
 	redisAddr := GetAddrFromEnv()
 	if redisAddr != "" {
 		return getRedisStore(ctx, redisAddr, maxConn)
 	}
-	goc := gocache.New(maxTimeout, cleanupInterval)
-	return gocache_store.NewGoCache(goc), nil
+	return newMemoryStore(maxTimeout, cleanupInterval), nil
 }
 
 // GetAddrFromEnv returns the redis address from the environment variable RedisStoreEnvVar or its legacy counterpart.
@@ -50,29 +51,3 @@ func GetAddrFromEnv() string {
 	}
 	return addr
 }
-
-func getRedisStore(ctx context.Context, redisEnvAddr string, maxConn int) (store.StoreInterface, error) {
-	options, err := redis.ParseURL(redisEnvAddr)
-	if err != nil {
-		return nil, fmt.Errorf("parsing redis cache url: %s", err)
-	}
-
-	options.MaxIdleConns = int(math.Ceil(float64(maxConn) * 0.5)) // 50% of max conns
-	options.MinIdleConns = int(math.Ceil(float64(maxConn) * 0.1)) // 10% of max conns
-	options.MaxActiveConns = maxConn
-	options.ConnMaxIdleTime = 30 * time.Minute
-	options.ConnMaxLifetime = 0
-	options.PoolTimeout = 10 * time.Second
-	redisClient := redis.NewClient(options)
-	subCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
-	defer cancel()
-
-	_, err = redisClient.Ping(subCtx).Result()
-	if err != nil {
-		return nil, err
-	}
-
-	log.WithContext(subCtx).Infof("using redis cache at %s", redisEnvAddr)
-
-	return redis_store.NewRedis(redisClient), nil
-}
diff --git a/management/server/cache/store_test.go b/management/server/cache/store_test.go
index b869170f0..a59be8393 100644
--- a/management/server/cache/store_test.go
+++ b/management/server/cache/store_test.go
@@ -3,101 +3,53 @@ package cache_test
 import (
 	"context"
 	"testing"
-	"time"
 
-	"github.com/eko/gocache/lib/v4/store"
-	"github.com/redis/go-redis/v9"
-	testcontainersredis "github.com/testcontainers/testcontainers-go/modules/redis"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/server/cache"
 )
 
-func TestMemoryStore(t *testing.T) {
-	memStore, err := cache.NewStore(context.Background(), 100*time.Millisecond, 300*time.Millisecond, 100)
-	if err != nil {
-		t.Fatalf("couldn't create memory store: %s", err)
-	}
-	ctx := context.Background()
-	key, value := "testing", "tested"
-	err = memStore.Set(ctx, key, value)
-	if err != nil {
-		t.Errorf("couldn't set testing data: %s", err)
-	}
-	result, err := memStore.Get(ctx, key)
-	if err != nil {
-		t.Errorf("couldn't get testing data: %s", err)
-	}
-	if value != result.(string) {
-		t.Errorf("value returned doesn't match testing data, got %s, expected %s", result, value)
-	}
-	// test expiration
-	time.Sleep(300 * time.Millisecond)
-	_, err = memStore.Get(ctx, key)
-	if err == nil {
-		t.Error("value should not be found")
-	}
-}
+func assertGetDelConsumedOnce(ctx context.Context, t *testing.T, stores []cache.Store, key, value string) {
+	t.Helper()
 
-func TestRedisStoreConnectionFailure(t *testing.T) {
-	t.Setenv(cache.RedisStoreEnvVar, "redis://127.0.0.1:6379")
-	_, err := cache.NewStore(context.Background(), 10*time.Millisecond, 30*time.Millisecond, 100)
-	if err == nil {
-		t.Fatal("getting redis cache store should return error")
-	}
-}
+	const getDelAttempts = 64
 
-func TestRedisStoreConnectionSuccess(t *testing.T) {
-	ctx := context.Background()
-	redisContainer, err := testcontainersredis.Run(ctx, "redis:7")
-	if err != nil {
-		t.Fatalf("couldn't start redis container: %s", err)
+	type getDelResult struct {
+		value string
+		found bool
+		err   error
 	}
-	defer func() {
-		if err := redisContainer.Terminate(ctx); err != nil {
-			t.Logf("failed to terminate container: %s", err)
+
+	start := make(chan struct{})
+	results := make(chan getDelResult, getDelAttempts)
+	for i := range getDelAttempts {
+		cacheStore := stores[i%len(stores)]
+		go func() {
+			<-start
+			value, found, err := cacheStore.GetDel(ctx, key)
+			results <- getDelResult{value: value, found: found, err: err}
+		}()
+	}
+	close(start)
+
+	consumers := 0
+	for range getDelAttempts {
+		result := <-results
+		require.NoError(t, result.err, "concurrent GetDel failed")
+		if !result.found {
+			continue
 		}
-	}()
-	redisURL, err := redisContainer.ConnectionString(ctx)
-	if err != nil {
-		t.Fatalf("couldn't get connection string: %s", err)
-	}
-
-	t.Setenv(cache.RedisStoreEnvVar, redisURL)
-	redisStore, err := cache.NewStore(context.Background(), 100*time.Millisecond, 300*time.Millisecond, 100)
-	if err != nil {
-		t.Fatalf("couldn't create redis store: %s", err)
-	}
-
-	key, value := "testing", "tested"
-	err = redisStore.Set(ctx, key, value, store.WithExpiration(100*time.Millisecond))
-	if err != nil {
-		t.Errorf("couldn't set testing data: %s", err)
-	}
-	result, err := redisStore.Get(ctx, key)
-	if err != nil {
-		t.Errorf("couldn't get testing data: %s", err)
-	}
-	if value != result.(string) {
-		t.Errorf("value returned doesn't match testing data, got %s, expected %s", result, value)
-	}
-
-	options, err := redis.ParseURL(redisURL)
-	if err != nil {
-		t.Errorf("parsing redis cache url: %s", err)
-	}
-
-	redisClient := redis.NewClient(options)
-	r, e := redisClient.Get(ctx, key).Result()
-	if e != nil {
-		t.Errorf("couldn't get testing data from redis: %s", e)
-	}
-	if value != r {
-		t.Errorf("value returned from redis doesn't match testing data, got %s, expected %s", r, value)
-	}
-	// test expiration
-	time.Sleep(300 * time.Millisecond)
-	_, err = redisStore.Get(ctx, key)
-	if err == nil {
-		t.Error("value should not be found")
+		consumers++
+		require.Equal(t, value, result.value, "consumed value doesn't match testing data")
 	}
+	require.Equal(t, 1, consumers, "expected exactly one consumer")
+}
+
+func assertGetDelMisses(ctx context.Context, t *testing.T, cacheStore cache.Store, key string) {
+	t.Helper()
+
+	value, found, err := cacheStore.GetDel(ctx, key)
+	require.NoError(t, err, "GetDel on a missing key should not error")
+	require.False(t, found, "GetDel should not find key %q, got value %q", key, value)
+	require.Empty(t, value, "GetDel should return an empty value when not found")
 }
diff --git a/management/server/certificate_challenge.go b/management/server/certificate_challenge.go
new file mode 100644
index 000000000..a63748727
--- /dev/null
+++ b/management/server/certificate_challenge.go
@@ -0,0 +1,344 @@
+package server
+
+import (
+	"context"
+	"encoding/binary"
+	"hash/fnv"
+	"maps"
+	"slices"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+const (
+	minCertChallengeTick = time.Second
+	maxCertChallengeTick = 15 * time.Minute
+
+	maxCertChallengeRefresh = 30 * time.Second
+)
+
+// certChallengePeriod is how often an account whose policies carry a certificate
+// posture check is pushed a fresh challenge. A nonce stays valid through the window
+// after its own, so one issued at the very end of a window lives only one window. A
+// third of that leaves a missed run well clear of the edge, where a half would put it
+// exactly on it.
+func certChallengePeriod() time.Duration {
+	return certposture.EffectiveWindow() / 3
+}
+
+// certChallengeTick is how often the refresher looks for accounts that are due. It is
+// derived from the period rather than fixed, so shortening the challenge window for a
+// test shortens this with it; the bounds keep a tiny window from spinning and a normal
+// one from checking less often than is useful.
+func certChallengeTick(period time.Duration) time.Duration {
+	return min(max(period/10, minCertChallengeTick), maxCertChallengeTick)
+}
+
+// certChallengeRefresh is how long one account's refresh is given before it is
+// abandoned. Resolving the target peers reads the store and accounts are swept one
+// after another, so an unbounded refresh lets one wedged read starve all the others.
+func certChallengeRefresh(tick time.Duration) time.Duration {
+	return min(tick, maxCertChallengeRefresh)
+}
+
+// certChallengeRefresher pushes a fresh certificate challenge to the peers connected to
+// this instance that answer one, from a single goroutine.
+//
+// A nonce only reaches a peer attached to a network map, and a quiet account sends no
+// map, so without this the peer eventually re-sends an expired nonce, has its whole
+// proof set rejected, and silently leaves the policies the check gates.
+//
+// Each instance renews only the peers whose sync stream it holds, so a peer is renewed
+// once however many instances run, and an account is dropped as soon as none of its
+// peers here answers a challenge.
+type certChallengeRefresher struct {
+	mu       sync.Mutex
+	accounts map[string]*certChallengeAccount
+	// refreshing holds the accounts whose refresh is running, and whether Track was
+	// called for one meanwhile, which makes its refresh's verdict stale.
+	refreshing map[string]bool
+
+	period  time.Duration
+	tick    time.Duration
+	timeout time.Duration
+	now     func() time.Time
+	// refresh pushes an update to those of peerIDs that answer a certificate challenge,
+	// and reports whether any of them does.
+	refresh func(ctx context.Context, accountID string, peerIDs []string) bool
+}
+
+// certChallengeAccount is one account's renewal schedule and the peers it covers, each
+// with the start of the sync stream it was stamped on.
+type certChallengeAccount struct {
+	due   time.Time
+	peers map[string]time.Time
+}
+
+// certChallengeDue is an account handed out for refresh, with its peers at that moment.
+type certChallengeDue struct {
+	accountID string
+	peerIDs   []string
+}
+
+func newCertChallengeRefresher(refresh func(ctx context.Context, accountID string, peerIDs []string) bool) *certChallengeRefresher {
+	period := certChallengePeriod()
+	tick := certChallengeTick(period)
+	return &certChallengeRefresher{
+		accounts:   map[string]*certChallengeAccount{},
+		refreshing: map[string]bool{},
+		period:     period,
+		tick:       tick,
+		timeout:    certChallengeRefresh(tick),
+		now:        time.Now,
+		refresh:    refresh,
+	}
+}
+
+// Start runs the refresh loop until ctx is done.
+func (r *certChallengeRefresher) Start(ctx context.Context) {
+	go r.run(ctx)
+}
+
+// Track renews the challenge of peerID, which was stamped one on the sync stream that
+// started at streamStart. An account seen for the first time has its first run spread
+// over one period, so that a global window rollover does not fan out to every account in
+// the same moment; an account already tracked keeps its schedule. A stamp from an older
+// stream than the one recorded for the peer is ignored.
+func (r *certChallengeRefresher) Track(ctx context.Context, accountID, peerID string, streamStart time.Time) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if _, ok := r.refreshing[accountID]; ok {
+		r.refreshing[accountID] = true
+	}
+	account, ok := r.accounts[accountID]
+	if !ok {
+		account = &certChallengeAccount{
+			due:   r.now().Add(offsetWithin(accountID, r.period)),
+			peers: map[string]time.Time{},
+		}
+		r.accounts[accountID] = account
+		log.WithContext(ctx).Debugf("tracking certificate challenge refresh for account %s", accountID)
+	}
+	if started, ok := account.peers[peerID]; ok && streamStart.Before(started) {
+		return
+	}
+	account.peers[peerID] = streamStart
+}
+
+// Untrack stops renewing peerID once the sync stream that started at streamStart ends.
+// A newer stream of the same peer keeps it tracked. The account is dropped with its
+// last peer.
+func (r *certChallengeRefresher) Untrack(accountID, peerID string, streamStart time.Time) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	account, ok := r.accounts[accountID]
+	if !ok {
+		return
+	}
+	if started, ok := account.peers[peerID]; !ok || !started.Equal(streamStart) {
+		return
+	}
+	delete(account.peers, peerID)
+	if len(account.peers) == 0 {
+		delete(r.accounts, accountID)
+	}
+}
+
+// Forget stops refreshing accountID.
+func (r *certChallengeRefresher) Forget(accountID string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	delete(r.accounts, accountID)
+}
+
+func (r *certChallengeRefresher) tracked(accountID string) bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	_, ok := r.accounts[accountID]
+	return ok
+}
+
+func (r *certChallengeRefresher) run(ctx context.Context) {
+	ticker := time.NewTicker(r.tick)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			for _, due := range r.takeDue() {
+				r.finish(due.accountID, r.refreshOne(ctx, due))
+			}
+		}
+	}
+}
+
+// refreshOne refreshes a single account under the refresh deadline. A refresh that runs
+// out of time reports the account as still wanting challenges, since a deadline says
+// nothing about the account's posture checks; the next sweep tries again.
+func (r *certChallengeRefresher) refreshOne(ctx context.Context, due certChallengeDue) bool {
+	ctx, cancel := context.WithTimeout(ctx, r.timeout)
+	defer cancel()
+	return r.refresh(ctx, due.accountID, due.peerIDs)
+}
+
+// finish records the outcome of an account's refresh. An account none of whose peers
+// answers a challenge any more is dropped, unless one was tracked again while the
+// refresh ran: the refresh may have read the store before a certificate check was added.
+// A dropped peer is tracked again the next time it is stamped a challenge.
+func (r *certChallengeRefresher) finish(accountID string, wanted bool) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	retracked := r.refreshing[accountID]
+	delete(r.refreshing, accountID)
+	if !wanted && !retracked {
+		delete(r.accounts, accountID)
+	}
+}
+
+// takeDue returns the accounts due now and books their next run straight away, so a
+// slow refresh cannot make an account fall due twice, and so the refresh itself runs
+// without the lock.
+func (r *certChallengeRefresher) takeDue() []certChallengeDue {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	now := r.now()
+	var due []certChallengeDue
+	for accountID, account := range r.accounts {
+		if account.due.After(now) {
+			continue
+		}
+		due = append(due, certChallengeDue{accountID: accountID, peerIDs: slices.Collect(maps.Keys(account.peers))})
+		account.due = now.Add(r.period)
+		r.refreshing[accountID] = false
+	}
+	return due
+}
+
+// offsetWithin maps a key to a stable duration in [0, period).
+func offsetWithin(key string, period time.Duration) time.Duration {
+	h := fnv.New64a()
+	//nolint:errcheck // hash.Write never returns an error
+	h.Write([]byte(key))
+	return time.Duration(binary.BigEndian.Uint64(h.Sum(nil)) % uint64(period))
+}
+
+// refreshCertificateChallenges pushes an update to those of peerIDs that answer a
+// certificate challenge, so each is stamped with a nonce for the current window. It
+// reports whether any of them answers one.
+func (am *DefaultAccountManager) refreshCertificateChallenges(ctx context.Context, accountID string, peerIDs []string) bool {
+	targets, err := am.certificateChallengeTargets(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Debugf("cannot resolve the certificate challenge targets of account %s: %v", accountID, err)
+		// Keep the account tracked: a store error now says nothing about its checks.
+		return true
+	}
+	peerIDs = slices.DeleteFunc(peerIDs, func(id string) bool { return !slices.Contains(targets, id) })
+	if len(peerIDs) == 0 {
+		log.WithContext(ctx).Debugf("no peer of account %s on this instance answers a certificate challenge, stopping challenge refresh", accountID)
+		return false
+	}
+
+	log.WithContext(ctx).Debugf("refreshing certificate challenges for %d peers of account %s", len(peerIDs), accountID)
+	reason := types.UpdateReason{Resource: types.UpdateResourcePostureCheck, Operation: types.UpdateOperationRefresh}
+	if err := am.networkMapController.BufferUpdateAffectedPeers(ctx, accountID, peerIDs, reason); err != nil {
+		log.WithContext(ctx).Warnf("failed refreshing certificate challenges for account %s: %v", accountID, err)
+	}
+	return true
+}
+
+// certificateChallengeTargets returns the peers that are sent a certificate challenge.
+// Only those peers hold a nonce, so pushing to the whole account would wake every peer
+// that never uses the feature.
+//
+// It is the inverse of processPeerPostureChecks, which decides the same thing one peer
+// at a time; TestCertificateChallengeTargets_MatchesThePerPeerRule holds them together.
+func (am *DefaultAccountManager) certificateChallengeTargets(ctx context.Context, accountID string) ([]string, error) {
+	certCheckIDs, err := am.certificatePostureCheckIDs(ctx, accountID)
+	if err != nil {
+		return nil, err
+	}
+	if len(certCheckIDs) == 0 {
+		return nil, nil
+	}
+
+	policies, err := am.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, err
+	}
+	groups, err := am.Store.GetAccountGroups(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, err
+	}
+	groupPeers := make(map[string][]string, len(groups))
+	for _, g := range groups {
+		groupPeers[g.ID] = g.Peers
+	}
+
+	return certificateChallengeTargets(policies, groupPeers, certCheckIDs), nil
+}
+
+// certificateChallengeTargets collects the source peers of every enabled policy whose
+// posture checks include a certificate check.
+func certificateChallengeTargets(policies []*types.Policy, groupPeers map[string][]string, certCheckIDs map[string]struct{}) []string {
+	targets := map[string]struct{}{}
+	for _, policy := range policies {
+		if !policy.Enabled || !slices.ContainsFunc(policy.SourcePostureChecks, func(id string) bool {
+			_, ok := certCheckIDs[id]
+			return ok
+		}) {
+			continue
+		}
+		for _, rule := range policy.Rules {
+			if !rule.Enabled {
+				continue
+			}
+			if rule.SourceResource.Type == types.ResourceTypePeer && rule.SourceResource.ID != "" {
+				targets[rule.SourceResource.ID] = struct{}{}
+			}
+			for _, groupID := range rule.Sources {
+				for _, peerID := range groupPeers[groupID] {
+					targets[peerID] = struct{}{}
+				}
+			}
+		}
+	}
+	return slices.Collect(maps.Keys(targets))
+}
+
+// certificatePostureCheckIDs returns the IDs of the account's posture checks that ask a
+// peer to prove a certificate.
+func (am *DefaultAccountManager) certificatePostureCheckIDs(ctx context.Context, accountID string) (map[string]struct{}, error) {
+	checks, err := am.Store.GetAccountPostureChecks(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, err
+	}
+	ids := map[string]struct{}{}
+	for _, check := range checks {
+		if check.Checks.CertificateCheck != nil {
+			ids[check.ID] = struct{}{}
+		}
+	}
+	return ids, nil
+}
+
+// TrackCertificateChallenges starts renewing the certificate challenge of a peer that was
+// stamped one on the sync stream started at streamStart. It is called on every stamped
+// update, so it has to stay cheap: no store access, just a map the refresher sweeps.
+func (am *DefaultAccountManager) TrackCertificateChallenges(ctx context.Context, accountID, peerID string, streamStart time.Time) {
+	am.certChallenges.Track(ctx, accountID, peerID, streamStart)
+}
+
+// UntrackCertificateChallenges stops renewing the certificate challenge of a peer whose
+// sync stream started at streamStart has ended.
+func (am *DefaultAccountManager) UntrackCertificateChallenges(accountID, peerID string, streamStart time.Time) {
+	am.certChallenges.Untrack(accountID, peerID, streamStart)
+}
diff --git a/management/server/certificate_challenge_test.go b/management/server/certificate_challenge_test.go
new file mode 100644
index 000000000..52887d872
--- /dev/null
+++ b/management/server/certificate_challenge_test.go
@@ -0,0 +1,493 @@
+package server
+
+import (
+	"context"
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// fakeClock lets a test drive the refresher's schedule without waiting for it.
+type fakeClock struct {
+	mu sync.Mutex
+	at time.Time
+}
+
+func (c *fakeClock) Now() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.at
+}
+
+func (c *fakeClock) Advance(d time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.at = c.at.Add(d)
+}
+
+// scheduleRefresher builds a refresher on a clock the test drives and never starts its
+// loop, so the schedule can be checked by calling takeDue directly.
+func scheduleRefresher(refresh func(accountID string) bool) (*certChallengeRefresher, *fakeClock) {
+	clock := &fakeClock{at: time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)}
+	r := newCertChallengeRefresher(func(_ context.Context, accountID string, _ []string) bool {
+		return refresh(accountID)
+	})
+	r.now = clock.Now
+	return r, clock
+}
+
+// runningRefresher builds a refresher whose period and tick are short enough to observe
+// in a test, and starts its loop.
+func runningRefresher(t *testing.T, refresh func(accountID string) bool) *certChallengeRefresher {
+	t.Helper()
+	r := newCertChallengeRefresher(func(_ context.Context, accountID string, _ []string) bool {
+		return refresh(accountID)
+	})
+	r.period = 10 * time.Millisecond
+	r.tick = time.Millisecond
+	r.Start(t.Context())
+	return r
+}
+
+// streamStart is the start of the sync stream the tests' peers are stamped on.
+var streamStart = time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)
+
+// track tracks one peer of accountID, as a stamped sync stream does.
+func track(r *certChallengeRefresher, accountID string) {
+	r.Track(context.Background(), accountID, accountID+"-peer", streamStart)
+}
+
+// dueAccounts returns the IDs of the accounts takeDue hands out.
+func dueAccounts(r *certChallengeRefresher) []string {
+	var ids []string
+	for _, due := range r.takeDue() {
+		ids = append(ids, due.accountID)
+	}
+	return ids
+}
+
+func (r *certChallengeRefresher) dueAt(accountID string) time.Time {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.accounts[accountID].due
+}
+
+func TestCertChallengePeriod_LeavesRoomForAMissedRun(t *testing.T) {
+	// A nonce issued at the very end of a window is accepted for that window and the
+	// next one only, so the shortest life a peer can be handed is one window. Renewing
+	// has to stay clear of that edge even when a run is missed.
+	assert.Less(t, 2*certChallengePeriod(), certposture.EffectiveWindow(),
+		"a missed refresh must still leave the peer's nonce valid, with margin")
+}
+
+func TestCertChallengeTick_FollowsTheWindow(t *testing.T) {
+	// An end-to-end test shortens the challenge window to watch a renewal happen. The
+	// tick has to come down with it, or the refresher would still be looking for due
+	// accounts every quarter of an hour and never renew anything in time.
+	short := certChallengeTick(30 * time.Second)
+	assert.Less(t, short, 30*time.Second, "the tick must be shorter than the period it serves")
+	assert.GreaterOrEqual(t, short, minCertChallengeTick, "the tick must not spin")
+
+	assert.Equal(t, maxCertChallengeTick, certChallengeTick(24*time.Hour),
+		"a long period must not stretch the tick without bound")
+	assert.Equal(t, minCertChallengeTick, certChallengeTick(time.Millisecond),
+		"a tiny period must not drive the tick below its floor")
+}
+
+func TestCertChallengeRefresher_SpreadsAccountsOverThePeriod(t *testing.T) {
+	// Every account on an instance shares the same global challenge window, so a
+	// restart arms them all at once. The offset is what keeps them from fanning out
+	// to their peers in the same moment.
+	r, clock := scheduleRefresher(func(string) bool { return true })
+
+	ids := []string{"account-a", "account-b", "account-c", "account-d", "account-e", "account-f"}
+	for _, id := range ids {
+		track(r, id)
+	}
+
+	start := clock.Now()
+	offsets := map[time.Duration]bool{}
+	for _, id := range ids {
+		offset := r.dueAt(id).Sub(start)
+		assert.GreaterOrEqual(t, offset, time.Duration(0), "account %s is due in the past", id)
+		assert.Less(t, offset, r.period, "account %s is due beyond one period", id)
+		offsets[offset] = true
+	}
+	assert.Greater(t, len(offsets), 1, "all accounts were given the same offset, which defeats the spreading")
+}
+
+func TestCertChallengeOffset_IsStablePerAccount(t *testing.T) {
+	assert.Equal(t, offsetWithin("account-a", certChallengePeriod()), offsetWithin("account-a", certChallengePeriod()),
+		"the same account must keep its slot across restarts")
+	assert.NotEqual(t, offsetWithin("account-a", certChallengePeriod()), offsetWithin("account-b", certChallengePeriod()),
+		"two accounts must not share a slot")
+}
+
+func TestCertChallengeRefresher_RenewsOncePerPeriod(t *testing.T) {
+	r, clock := scheduleRefresher(func(string) bool { return true })
+	track(r, "account-a")
+
+	assert.Empty(t, r.takeDue(), "an account just tracked is not due before its offset elapses")
+
+	clock.Advance(r.period)
+	assert.Equal(t, []string{"account-a"}, dueAccounts(r), "the account is due once its offset has elapsed")
+
+	clock.Advance(r.period / 2)
+	assert.Empty(t, r.takeDue(), "the next run is booked a full period out")
+
+	clock.Advance(r.period / 2)
+	assert.Equal(t, []string{"account-a"}, dueAccounts(r), "the account is due again one period later")
+}
+
+func TestCertChallengeRefresher_BooksTheNextRunBeforeRefreshing(t *testing.T) {
+	// takeDue reserves the next run while it holds the lock, so a refresh that outlives
+	// a tick cannot have the same account handed out twice.
+	r, clock := scheduleRefresher(func(string) bool { return true })
+	track(r, "account-a")
+	clock.Advance(r.period)
+
+	require.Len(t, r.takeDue(), 1, "the account is due")
+	assert.Empty(t, r.takeDue(), "a second pass at the same instant must not hand out the account again")
+}
+
+func TestCertChallengeRefresher_TrackIsIdempotent(t *testing.T) {
+	r, clock := scheduleRefresher(func(string) bool { return true })
+
+	track(r, "account-a")
+	first := r.dueAt("account-a")
+
+	clock.Advance(certChallengePeriod())
+	track(r, "account-a")
+
+	assert.Equal(t, first, r.dueAt("account-a"), "re-tracking must not push the next run further out")
+}
+
+func TestCertChallengeRefresher_RefreshesATrackedAccount(t *testing.T) {
+	refreshed := make(chan string, 4)
+	r := runningRefresher(t, func(accountID string) bool {
+		select {
+		case refreshed <- accountID:
+		default:
+		}
+		return true
+	})
+	track(r, "account-a")
+
+	select {
+	case got := <-refreshed:
+		assert.Equal(t, "account-a", got)
+	case <-time.After(3 * time.Second):
+		t.Fatal("a tracked account was never refreshed")
+	}
+	assert.True(t, r.tracked("account-a"), "an account that still wants challenges stays tracked")
+}
+
+func TestCertChallengeRefresher_DropsAnAccountThatNoLongerWantsChallenges(t *testing.T) {
+	var mu sync.Mutex
+	var calls int
+
+	r := runningRefresher(t, func(string) bool {
+		mu.Lock()
+		defer mu.Unlock()
+		calls++
+		return false
+	})
+	track(r, "account-a")
+
+	require.Eventually(t, func() bool { return !r.tracked("account-a") }, 3*time.Second, time.Millisecond,
+		"an account whose refresh reports it no longer wants challenges must be dropped")
+
+	time.Sleep(20 * r.tick)
+	mu.Lock()
+	defer mu.Unlock()
+	assert.Equal(t, 1, calls, "the account must not be refreshed again after being dropped")
+}
+
+func TestCertChallengeRefresher_RefreshesWithoutHoldingTheLock(t *testing.T) {
+	// The refresh fans out to every peer of the account, so holding the lock across it
+	// would stall every peer that connects meanwhile. Calling back into the refresher
+	// from inside the refresh deadlocks if the loop still holds it.
+	reentered := make(chan bool, 1)
+	var once sync.Once
+
+	r := newCertChallengeRefresher(nil)
+	r.period = 10 * time.Millisecond
+	r.tick = time.Millisecond
+	r.refresh = func(_ context.Context, accountID string, _ []string) bool {
+		once.Do(func() {
+			answered := make(chan bool, 1)
+			go func() { answered <- r.tracked(accountID) }()
+			select {
+			case got := <-answered:
+				reentered <- got
+			case <-time.After(2 * time.Second):
+				reentered <- false
+			}
+		})
+		return true
+	}
+	r.Start(t.Context())
+	track(r, "account-a")
+
+	select {
+	case ok := <-reentered:
+		assert.True(t, ok, "the refresher was not reachable while a refresh was in flight")
+	case <-time.After(5 * time.Second):
+		t.Fatal("the refresh never ran")
+	}
+}
+
+// TestCertificateChallengeTargets_MatchesThePerPeerRule holds the renewal to the same
+// rule management uses when it hands out the challenge. The refresher asks "which peers
+// get one", processPeerPostureChecks asks "does this peer get one", and the two have to
+// answer identically: a peer the refresher forgets stops being renewed and silently
+// falls out of its policies, which is the failure the refresher exists to prevent.
+func TestCertificateChallengeTargets_MatchesThePerPeerRule(t *testing.T) {
+	const certCheck, osCheck = "check-cert", "check-os"
+	certCheckIDs := map[string]struct{}{certCheck: {}}
+
+	groupPeers := map[string][]string{
+		"g-devs":    {"p1", "p2"},
+		"g-servers": {"p3"},
+		"g-empty":   {},
+		"g-mixed":   {"p2", "p4"},
+	}
+	peerGroups := map[string][]string{
+		"p1": {"g-devs"},
+		"p2": {"g-devs", "g-mixed"},
+		"p3": {"g-servers"},
+		"p4": {"g-mixed"},
+		"p5": {},
+	}
+
+	policies := []*types.Policy{
+		{
+			ID: "gated", Enabled: true, SourcePostureChecks: []string{certCheck},
+			Rules: []*types.PolicyRule{{Enabled: true, Sources: []string{"g-devs"}}},
+		},
+		{
+			// A disabled policy hands out nothing.
+			ID: "disabled-policy", Enabled: false, SourcePostureChecks: []string{certCheck},
+			Rules: []*types.PolicyRule{{Enabled: true, Sources: []string{"g-servers"}}},
+		},
+		{
+			// A disabled rule inside an enabled policy likewise.
+			ID: "disabled-rule", Enabled: true, SourcePostureChecks: []string{certCheck},
+			Rules: []*types.PolicyRule{{Enabled: false, Sources: []string{"g-servers"}}},
+		},
+		{
+			// Gated on something other than a certificate: no nonce to renew.
+			ID: "other-check", Enabled: true, SourcePostureChecks: []string{osCheck},
+			Rules: []*types.PolicyRule{{Enabled: true, Sources: []string{"g-mixed"}}},
+		},
+		{
+			// A peer named directly rather than through a group.
+			ID: "by-resource", Enabled: true, SourcePostureChecks: []string{osCheck, certCheck},
+			Rules: []*types.PolicyRule{{
+				Enabled:        true,
+				SourceResource: types.Resource{Type: types.ResourceTypePeer, ID: "p4"},
+			}},
+		},
+		{
+			// Destinations are never filtered, so being one earns no challenge.
+			ID: "as-destination", Enabled: true, SourcePostureChecks: []string{certCheck},
+			Rules: []*types.PolicyRule{{Enabled: true, Sources: []string{"g-empty"}, Destinations: []string{"g-servers"}}},
+		},
+	}
+
+	got := certificateChallengeTargets(policies, groupPeers, certCheckIDs)
+
+	// The same question, asked one peer at a time the way the gRPC layer asks it.
+	var want []string
+	for peerID, groupIDs := range peerGroups {
+		for _, policy := range policies {
+			if !policy.Enabled {
+				continue
+			}
+			ids := processPeerPostureChecks(policy, peerID, groupIDs)
+			if slices.ContainsFunc(ids, func(id string) bool { _, ok := certCheckIDs[id]; return ok }) {
+				want = append(want, peerID)
+				break
+			}
+		}
+	}
+
+	slices.Sort(got)
+	slices.Sort(want)
+	assert.Equal(t, want, got, "the peers the refresher renews must be exactly the peers that are sent a challenge")
+	assert.Equal(t, []string{"p1", "p2", "p4"}, got, "p3 is only reachable through disabled rules, p5 is in no source group")
+}
+
+func TestCertChallengeRefresher_StopsWithItsContext(t *testing.T) {
+	// BuildManager hands the loop the manager's context. A refresher that detached from
+	// it could never be stopped: it would keep sweeping after the server it belongs to
+	// is gone, and leak a goroutine per manager a test builds.
+	var mu sync.Mutex
+	var calls int
+
+	r := newCertChallengeRefresher(func(_ context.Context, _ string, _ []string) bool {
+		mu.Lock()
+		defer mu.Unlock()
+		calls++
+		return true
+	})
+	r.period = time.Millisecond
+	r.tick = time.Millisecond
+
+	ctx, cancel := context.WithCancel(context.Background())
+	r.Start(ctx)
+	track(r, "account-a")
+
+	require.Eventually(t, func() bool {
+		mu.Lock()
+		defer mu.Unlock()
+		return calls > 0
+	}, 3*time.Second, time.Millisecond, "the refresher never ran")
+
+	cancel()
+	time.Sleep(20 * r.tick)
+	mu.Lock()
+	afterCancel := calls
+	mu.Unlock()
+
+	time.Sleep(20 * r.tick)
+	mu.Lock()
+	defer mu.Unlock()
+	assert.Equal(t, afterCancel, calls, "the refresher kept sweeping after its context was cancelled")
+}
+
+func TestCertChallengeRefresh_StaysWithinTheSweep(t *testing.T) {
+	assert.Equal(t, maxCertChallengeRefresh, certChallengeRefresh(time.Hour),
+		"a long tick must not grant a store read minutes")
+	assert.Equal(t, time.Second, certChallengeRefresh(time.Second),
+		"a short tick must bound the refresh to itself, so the sweep keeps its cadence")
+}
+
+func TestCertChallengeRefresher_AbandonsAWedgedAccount(t *testing.T) {
+	// Accounts are swept one after another and resolving the targets reads the store, so
+	// an account whose read never returns would hold up every other account on the
+	// instance for as long as the process lives.
+	entered := make(chan struct{}, 1)
+	refreshed := make(chan string, 4)
+
+	r := newCertChallengeRefresher(func(ctx context.Context, accountID string, _ []string) bool {
+		if accountID == "account-wedged" {
+			select {
+			case entered <- struct{}{}:
+			default:
+			}
+			<-ctx.Done()
+			return true
+		}
+		select {
+		case refreshed <- accountID:
+		default:
+		}
+		return true
+	})
+	r.period = 10 * time.Millisecond
+	r.tick = time.Millisecond
+	r.timeout = 20 * time.Millisecond
+	r.Start(t.Context())
+
+	track(r, "account-wedged")
+	select {
+	case <-entered:
+	case <-time.After(3 * time.Second):
+		t.Fatal("the wedged account was never refreshed")
+	}
+
+	// Tracked only once the sweep is already stuck, so reaching it proves the deadline
+	// released the loop rather than the map happening to hand this one out first.
+	track(r, "account-healthy")
+	select {
+	case got := <-refreshed:
+		assert.Equal(t, "account-healthy", got)
+	case <-time.After(3 * time.Second):
+		t.Fatal("a healthy account was never refreshed from behind a wedged one")
+	}
+}
+
+// TestCertChallengeRefresher_KeepsAnAccountTrackedDuringItsRefresh: a refresh reads the
+// store before an admin adds a certificate check; the push that follows the change
+// tracks the account again. The refresh then reports the account as not wanting
+// challenges, which is stale, and must not untrack it.
+func TestCertChallengeRefresher_KeepsAnAccountTrackedDuringItsRefresh(t *testing.T) {
+	r, clock := scheduleRefresher(func(string) bool { return false })
+	track(r, "account-a")
+	clock.Advance(r.period)
+	require.Equal(t, []string{"account-a"}, dueAccounts(r), "the account is due")
+
+	track(r, "account-a")
+	r.finish("account-a", false)
+	assert.True(t, r.tracked("account-a"), "an account tracked again during its refresh stays tracked")
+
+	clock.Advance(r.period)
+	require.Equal(t, []string{"account-a"}, dueAccounts(r), "the account is due again")
+	r.finish("account-a", false)
+	assert.False(t, r.tracked("account-a"), "an account nobody tracked again is dropped once it no longer wants challenges")
+}
+
+// TestCertChallengeRefresher_RenewsOnlyThePeersStreamedHere: every instance runs its
+// own refresher, and a push fans out to all of them, so an instance must hand out only
+// the peers whose sync stream it holds. Otherwise each peer is pushed once per instance.
+func TestCertChallengeRefresher_RenewsOnlyThePeersStreamedHere(t *testing.T) {
+	r, clock := scheduleRefresher(func(string) bool { return true })
+	r.Track(context.Background(), "account-a", "peer-1", streamStart)
+	r.Track(context.Background(), "account-a", "peer-2", streamStart)
+	clock.Advance(r.period)
+
+	due := r.takeDue()
+	require.Len(t, due, 1, "the account is due")
+	assert.ElementsMatch(t, []string{"peer-1", "peer-2"}, due[0].peerIDs, "only the peers tracked here are renewed")
+}
+
+// TestCertChallengeRefresher_DropsAnAccountWithItsLastPeer: an instance whose peers of an
+// account have all disconnected has nobody left to renew, and must not keep sweeping it.
+func TestCertChallengeRefresher_DropsAnAccountWithItsLastPeer(t *testing.T) {
+	r, _ := scheduleRefresher(func(string) bool { return true })
+	r.Track(context.Background(), "account-a", "peer-1", streamStart)
+	r.Track(context.Background(), "account-a", "peer-2", streamStart)
+
+	r.Untrack("account-a", "peer-1", streamStart)
+	assert.True(t, r.tracked("account-a"), "the account stays tracked while a peer is still streamed here")
+
+	r.Untrack("account-a", "peer-2", streamStart)
+	assert.False(t, r.tracked("account-a"), "the account is dropped with its last peer")
+}
+
+// TestCertChallengeRefresher_StaleStreamKeepsTheNewerOne: a peer that reconnects to the
+// same instance opens its new stream before the old one is torn down. The old stream's
+// teardown must not untrack the peer the new stream is renewing.
+func TestCertChallengeRefresher_StaleStreamKeepsTheNewerOne(t *testing.T) {
+	r, _ := scheduleRefresher(func(string) bool { return true })
+	newer := streamStart.Add(time.Minute)
+	r.Track(context.Background(), "account-a", "peer-1", streamStart)
+	r.Track(context.Background(), "account-a", "peer-1", newer)
+
+	r.Untrack("account-a", "peer-1", streamStart)
+	assert.True(t, r.tracked("account-a"), "the stale stream's teardown must leave the newer stream tracked")
+
+	r.Untrack("account-a", "peer-1", newer)
+	assert.False(t, r.tracked("account-a"), "the newer stream's teardown untracks the peer")
+}
+
+// TestCertChallengeRefresher_LateStampFromAStaleStream: the old stream of a reconnected
+// peer can still deliver a stamped update after the new stream started. Its Track must
+// not take the peer over, or the old stream's teardown would untrack the live one.
+func TestCertChallengeRefresher_LateStampFromAStaleStream(t *testing.T) {
+	r, _ := scheduleRefresher(func(string) bool { return true })
+	newer := streamStart.Add(time.Minute)
+	r.Track(context.Background(), "account-a", "peer-1", newer)
+
+	r.Track(context.Background(), "account-a", "peer-1", streamStart)
+	r.Untrack("account-a", "peer-1", streamStart)
+	assert.True(t, r.tracked("account-a"), "a late stamp from the stale stream must leave the newer stream tracked")
+}
diff --git a/management/server/dns_test.go b/management/server/dns_test.go
index 8917902d9..bd1b4c923 100644
--- a/management/server/dns_test.go
+++ b/management/server/dns_test.go
@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -16,7 +16,6 @@ import (
 	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -234,9 +233,9 @@ func createDNSManager(t *testing.T) (*DefaultAccountManager, error) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{})
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 }
 
 func createDNSStore(t *testing.T) (store.Store, error) {
@@ -363,163 +362,167 @@ func initTestDNSAccount(t *testing.T, am *DefaultAccountManager) (*types.Account
 }
 
 func TestDNSAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-	})
-	assert.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates
-	t.Run("saving dns setting with unused groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA"},
+		err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
 		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Creating DNS settings with groups that have no peers should not update account peers or send peer update
-	t.Run("creating dns setting with unused groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr(peer1.IP.String()),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupB"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Creating DNS settings with groups that have peers should update account peers and send peer update
-	t.Run("creating dns setting with used groups", func(t *testing.T) {
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
 		})
-		assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates
+		step(t, "saving dns setting with unused groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr(peer1.IP.String()),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupA"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA"},
+			})
+			assert.NoError(t, err)
 
-	// Saving DNS settings with groups that have peers should update account peers and send peer update
-	t.Run("saving dns setting with used groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA", "groupB"},
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Creating DNS settings with groups that have no peers should not update account peers or send peer update
+		step(t, "creating dns setting with unused groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Removing group with no peers from DNS settings  should not trigger updates to account peers or send peer updates
-	t.Run("removing group with no peers from dns settings", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr(peer1.IP.String()),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupB"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA"},
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Creating DNS settings with groups that have peers should update account peers and send peer update
+		step(t, "creating dns setting with used groups", func(t *testing.T) {
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
 
-	// Removing group with peers from DNS settings should trigger updates to account peers and send peer updates
-	t.Run("removing group with peers from dns settings", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{},
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr(peer1.IP.String()),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupA"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Saving DNS settings with groups that have peers should update account peers and send peer update
+		step(t, "saving dns setting with used groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA", "groupB"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Removing group with no peers from DNS settings  should not trigger updates to account peers or send peer updates
+		step(t, "removing group with no peers from dns settings", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Removing group with peers from DNS settings should trigger updates to account peers and send peer updates
+		step(t, "removing group with peers from dns settings", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
diff --git a/management/server/event.go b/management/server/event.go
index 4211f2dda..2b1ac4987 100644
--- a/management/server/event.go
+++ b/management/server/event.go
@@ -61,23 +61,34 @@ func (am *DefaultAccountManager) GetEvents(ctx context.Context, accountID, userI
 	return filtered, nil
 }
 
+// StoreEvent records an activity, waiting for expiration events before cleanup can stop.
 func (am *DefaultAccountManager) StoreEvent(ctx context.Context, initiatorID, targetID, accountID string, activityID activity.ActivityDescriber, meta map[string]any) {
-	if isEnabled() {
-		go func() {
-			_, err := am.eventStore.Save(ctx, &activity.Event{
-				Timestamp:   time.Now().UTC(),
-				Activity:    activityID.(activity.Activity),
-				InitiatorID: initiatorID,
-				TargetID:    targetID,
-				AccountID:   accountID,
-				Meta:        meta,
-			})
-			if err != nil {
-				// todo add metric
-				log.WithContext(ctx).Errorf("received an error while storing an activity event, error: %s", err)
-			}
-		}()
+	if !isEnabled() {
+		return
 	}
+	eventStore := am.eventStore
+	save := func(ctx context.Context) {
+		_, err := eventStore.Save(ctx, &activity.Event{
+			Timestamp:   time.Now().UTC(),
+			Activity:    activityID.(activity.Activity),
+			InitiatorID: initiatorID,
+			TargetID:    targetID,
+			AccountID:   accountID,
+			Meta:        meta,
+		})
+		if err != nil {
+			log.WithContext(ctx).Errorf("received an error while storing an activity event, error: %s", err)
+		}
+	}
+	if activityID == activity.CustomDomainValidationExpired {
+		// The domain is already deleted; shutdown must allow its audit write to finish.
+		ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
+		defer cancel()
+		save(ctx)
+		return
+	}
+	// Request cancellation must not discard the audit record of a completed operation.
+	go save(context.WithoutCancel(ctx))
 }
 
 type eventUserInfo struct {
diff --git a/management/server/event_test.go b/management/server/event_test.go
index 420e69866..6fb3f437f 100644
--- a/management/server/event_test.go
+++ b/management/server/event_test.go
@@ -6,10 +6,52 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/server/activity"
+	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/util/crypt"
 )
 
+func TestStoreEvent_CanceledContext(t *testing.T) {
+	t.Setenv("NB_EVENT_ACTIVITY_LOG_ENABLED", "true")
+	t.Setenv("NB_ACTIVITY_EVENT_STORE_ENGINE", "sqlite")
+	for _, code := range []activity.Activity{activity.CustomDomainValidationExpired, activity.DomainAdded} {
+		t.Run(code.StringCode(), func(t *testing.T) {
+			dir := t.TempDir()
+			key, err := crypt.GenerateKey()
+			require.NoError(t, err)
+			eventStore, err := activitystore.NewSqlStore(context.Background(), dir, key)
+			require.NoError(t, err)
+			t.Cleanup(func() { assert.NoError(t, eventStore.Close(context.Background())) })
+			manager := &DefaultAccountManager{eventStore: eventStore}
+			ctx, cancel := context.WithCancel(context.Background())
+			cancel()
+
+			// The operation already succeeded when shutdown or the request cancels its context.
+			manager.StoreEvent(ctx, activity.SystemInitiator, "domain-id", "account-id",
+				code, map[string]any{"domain": "expired.example.com"})
+			if code != activity.CustomDomainValidationExpired {
+				require.Eventually(t, func() bool {
+					events, err := eventStore.Get(context.Background(), "account-id", 0, 10, true)
+					return err == nil && len(events) == 1
+				}, time.Second, time.Millisecond, "asynchronous events must survive request cancellation")
+			}
+			require.NoError(t, eventStore.Close(context.Background()))
+
+			reopened, err := activitystore.NewSqlStore(context.Background(), dir, key)
+			require.NoError(t, err)
+			t.Cleanup(func() { assert.NoError(t, reopened.Close(context.Background())) })
+			events, err := reopened.Get(context.Background(), "account-id", 0, 10, true)
+			require.NoError(t, err)
+			require.Len(t, events, 1, "the event must be persisted before shutdown closes the store")
+			assert.Equal(t, code, events[0].Activity, "persist the requested activity")
+			assert.Equal(t, "domain-id", events[0].TargetID, "retain the registration ID")
+			assert.Equal(t, "expired.example.com", events[0].Meta["domain"], "retain the domain name")
+		})
+	}
+}
+
 func generateAndStoreEvents(t *testing.T, manager *DefaultAccountManager, typ activity.Activity, initiatorID, targetID,
 	accountID string, count int) {
 	t.Helper()
diff --git a/management/server/geolocation/database.go b/management/server/geolocation/database.go
index 97ab398fb..71106d5cd 100644
--- a/management/server/geolocation/database.go
+++ b/management/server/geolocation/database.go
@@ -3,6 +3,7 @@ package geolocation
 import (
 	"context"
 	"encoding/csv"
+	"fmt"
 	"io"
 	"os"
 	"path"
@@ -21,6 +22,8 @@ const (
 	geoLiteCitySha256ZipURL = "https://pkgs.netbird.io/geolocation-dbs/GeoLite2-City-CSV/download?suffix=zip.sha256"
 	geoLiteCityMMDB         = "GeoLite2-City.mmdb"
 	geoLiteCityCSV          = "GeoLite2-City-Locations-en.csv"
+
+	geonamesCsvFields = 14
 )
 
 // loadGeolocationDatabases loads the MaxMind databases.
@@ -160,6 +163,10 @@ func loadGeonamesCsv(filepath string) ([]GeoNames, error) {
 		if index == 0 {
 			continue
 		}
+		if len(record) < geonamesCsvFields {
+			return nil, fmt.Errorf("geonames csv record %d has %d fields, want at least %d", index, len(record), geonamesCsvFields)
+		}
+
 		geoNameID, err := strconv.Atoi(record[0])
 		if err != nil {
 			return nil, err
diff --git a/management/server/geolocation/geolocation.go b/management/server/geolocation/geolocation.go
index 0af3ce2f6..b8a064a33 100644
--- a/management/server/geolocation/geolocation.go
+++ b/management/server/geolocation/geolocation.go
@@ -242,7 +242,11 @@ func getDatabaseFilename(ctx context.Context, databaseURL string, filenamePatter
 	// strip suffixes that may be nested, such as .tar.gz
 	basename := strings.SplitN(filename, ".", 2)[0]
 	// get date version from basename
-	date := strings.SplitN(basename, "_", 2)[1]
+	parts := strings.SplitN(basename, "_", 2)
+	if len(parts) < 2 || parts[1] == "" {
+		return "", fmt.Errorf("unexpected database filename %q: missing date suffix", filename)
+	}
+	date := parts[1]
 	// format db as "GeoLite2-Cities-{maxmind|geonames}_{DATE}.{mmdb|db}"
 	databaseFilename := filepath.Base(strings.Replace(filenamePattern, "*", date, 1))
 
diff --git a/management/server/geolocation/utils.go b/management/server/geolocation/utils.go
index 5104b0a08..0c4a66407 100644
--- a/management/server/geolocation/utils.go
+++ b/management/server/geolocation/utils.go
@@ -184,7 +184,12 @@ func getFilenameFromURL(url string) (string, error) {
 
 	defer resp.Body.Close()
 
-	_, params, err := mime.ParseMediaType(resp.Header["Content-Disposition"][0])
+	contentDisposition := resp.Header.Get("Content-Disposition")
+	if contentDisposition == "" {
+		return "", fmt.Errorf("no Content-Disposition header in response from %s", url)
+	}
+
+	_, params, err := mime.ParseMediaType(contentDisposition)
 	if err != nil {
 		return "", err
 	}
diff --git a/management/server/group.go b/management/server/group.go
index 460b51274..3cd31f152 100644
--- a/management/server/group.go
+++ b/management/server/group.go
@@ -10,6 +10,8 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -93,14 +95,14 @@ func (am *DefaultAccountManager) CreateGroup(ctx context.Context, accountID, use
 		events := am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
 		eventsToStore = append(eventsToStore, events...)
 
+		newGroup.PublicID = xid.New().String()
+
 		if err := transaction.CreateGroup(ctx, newGroup); err != nil {
 			return status.Errorf(status.Internal, "failed to create group: %v", err)
 		}
 
-		for _, peerID := range newGroup.Peers {
-			if err := transaction.AddPeerToGroup(ctx, accountID, peerID, newGroup.ID); err != nil {
-				return status.Errorf(status.Internal, "failed to add peer %s to group %s: %v", peerID, newGroup.ID, err)
-			}
+		if err = syncGroupMembership(ctx, transaction, accountID, newGroup.ID, newGroup.Peers, nil); err != nil {
+			return err
 		}
 
 		snap, err = affectedpeers.Load(ctx, transaction, accountID, change)
@@ -158,13 +160,17 @@ func (am *DefaultAccountManager) UpdateGroup(ctx context.Context, accountID, use
 			return err
 		}
 
+		newGroup.PublicID = oldGroup.PublicID
+
 		if err = transaction.UpdateGroup(ctx, newGroup); err != nil {
 			return err
 		}
 
-		if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID})
+		if err != nil {
 			return err
 		}
+		change.ChangedPeerIDs = ipv6Changed
 
 		// A membership change does not alter which entities reference the group, so
 		// the dependency walk runs once against the post-change snapshot. The new
@@ -194,6 +200,9 @@ func (am *DefaultAccountManager) UpdateGroup(ctx context.Context, accountID, use
 
 // syncGroupMembership applies the peer membership delta for a group within a transaction.
 func syncGroupMembership(ctx context.Context, transaction store.Store, accountID, groupID string, peersToAdd, peersToRemove []string) error {
+	if err := validateGroupPeers(ctx, transaction, accountID, peersToAdd); err != nil {
+		return err
+	}
 	for _, peerID := range peersToAdd {
 		if err := transaction.AddPeerToGroup(ctx, accountID, peerID, groupID); err != nil {
 			return status.Errorf(status.Internal, "failed to add peer %s to group %s: %v", peerID, groupID, err)
@@ -207,6 +216,25 @@ func syncGroupMembership(ctx context.Context, transaction store.Store, accountID
 	return nil
 }
 
+func validateGroupPeers(ctx context.Context, transaction store.Store, accountID string, peerIDs []string) error {
+	if len(peerIDs) == 0 {
+		return nil
+	}
+
+	peers, err := transaction.GetPeersByIDs(ctx, store.LockingStrengthNone, accountID, peerIDs)
+	if err != nil {
+		return err
+	}
+
+	for _, peerID := range peerIDs {
+		if _, ok := peers[peerID]; !ok {
+			return status.Errorf(status.InvalidArgument, "peer with ID %s not found", peerID)
+		}
+	}
+
+	return nil
+}
+
 // CreateGroups adds new groups to the account.
 // Note: This function does not acquire the global lock.
 // It is the caller's responsibility to ensure proper locking is in place before invoking this method.
@@ -221,20 +249,22 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 	}
 
 	var eventsToStore []func()
-	var snaps []*affectedpeers.Snapshot
-	var changes []affectedpeers.Change
+	affected := make(affectedPeerSet)
 
 	var globalErr error
 	createdCount := 0
 	for _, newGroup := range groups {
 		change := affectedpeers.Change{ChangedGroupIDs: []string{newGroup.ID}}
 		var snap *affectedpeers.Snapshot
+		var events []func()
 		err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 			if err = validateNewGroup(ctx, transaction, accountID, newGroup); err != nil {
 				return err
 			}
 
 			newGroup.AccountID = accountID
+			newGroup.PublicID = xid.New().String()
+			events = am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
 
 			if err = transaction.CreateGroup(ctx, newGroup); err != nil {
 				return err
@@ -245,14 +275,11 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 				return err
 			}
 
-			events := am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
-			eventsToStore = append(eventsToStore, events...)
-
 			snap, err = affectedpeers.Load(ctx, transaction, accountID, change)
 			return err
 		})
 		if err != nil {
-			log.WithContext(ctx).Errorf("failed to update group %s: %v", newGroup.ID, err)
+			log.WithContext(ctx).Errorf("failed to create group %s: %v", newGroup.ID, err)
 			if createdCount == 0 {
 				return err
 			}
@@ -261,15 +288,15 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 			continue
 		}
 		createdCount++
-		snaps = append(snaps, snap)
-		changes = append(changes, change)
+		affected.add(snap.Expand(ctx, accountID, change))
+		eventsToStore = append(eventsToStore, events...)
 	}
 
 	for _, storeEvent := range eventsToStore {
 		storeEvent()
 	}
 
-	go am.dispatchAffected(ctx, accountID, snaps, changes)
+	go am.dispatchAffectedPeerIDs(ctx, accountID, affected.ids())
 
 	return globalErr
 }
@@ -288,13 +315,12 @@ func (am *DefaultAccountManager) UpdateGroups(ctx context.Context, accountID, us
 	}
 
 	var eventsToStore []func()
-	var snaps []*affectedpeers.Snapshot
-	var changes []affectedpeers.Change
+	affected := make(affectedPeerSet)
 
 	var globalErr error
 	for _, newGroup := range groups {
 		change := affectedpeers.Change{ChangedGroupIDs: []string{newGroup.ID}}
-		events, snap, err := am.updateSingleGroup(ctx, accountID, userID, newGroup, change)
+		events, snap, change, err := am.updateSingleGroup(ctx, accountID, userID, newGroup, change)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to update group %s: %v", newGroup.ID, err)
 			if len(groups) == 1 {
@@ -304,20 +330,19 @@ func (am *DefaultAccountManager) UpdateGroups(ctx context.Context, accountID, us
 			continue
 		}
 		eventsToStore = append(eventsToStore, events...)
-		snaps = append(snaps, snap)
-		changes = append(changes, change)
+		affected.add(snap.Expand(ctx, accountID, change))
 	}
 
 	for _, storeEvent := range eventsToStore {
 		storeEvent()
 	}
 
-	go am.dispatchAffected(ctx, accountID, snaps, changes)
+	go am.dispatchAffectedPeerIDs(ctx, accountID, affected.ids())
 
 	return globalErr
 }
 
-func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountID, userID string, newGroup *types.Group, change affectedpeers.Change) ([]func(), *affectedpeers.Snapshot, error) {
+func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountID, userID string, newGroup *types.Group, change affectedpeers.Change) ([]func(), *affectedpeers.Snapshot, affectedpeers.Change, error) {
 	var events []func()
 	var snap *affectedpeers.Snapshot
 	err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
@@ -327,25 +352,32 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 
 		newGroup.AccountID = accountID
 
+		oldGroup, err := transaction.GetGroupByID(ctx, store.LockingStrengthNone, accountID, newGroup.ID)
+		if err != nil {
+			return err
+		}
+		newGroup.PublicID = oldGroup.PublicID
+
+		events = am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
+
 		if err := transaction.UpdateGroup(ctx, newGroup); err != nil {
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID})
+		if err != nil {
 			return err
 		}
+		change.ChangedPeerIDs = ipv6Changed
 
 		if err := transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
 			return err
 		}
 
-		events = am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
-
-		var err error
 		snap, err = affectedpeers.Load(ctx, transaction, accountID, change)
 		return err
 	})
-	return events, snap, err
+	return events, snap, change, err
 }
 
 // prepareGroupEvents prepares a list of event functions to be stored.
@@ -448,8 +480,8 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 	var allErrors error
 	var groupIDsToDelete []string
 	var deletedGroups []*types.Group
-	var snap *affectedpeers.Snapshot
-	var change affectedpeers.Change
+	var snap, ipv6Snap *affectedpeers.Snapshot
+	var change, ipv6Change affectedpeers.Change
 
 	extraSettings, err := am.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
@@ -478,10 +510,20 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 			return err
 		}
 
-		if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, groupIDsToDelete); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, groupIDsToDelete)
+		if err != nil {
 			return err
 		}
 
+		// Members of a deleted IPv6-enabled group lose their address, which the
+		// pre-delete snapshot cannot see, so they are resolved post-delete.
+		if len(ipv6Changed) > 0 {
+			ipv6Change = affectedpeers.Change{ChangedPeerIDs: ipv6Changed}
+			if ipv6Snap, err = affectedpeers.Load(ctx, transaction, accountID, ipv6Change); err != nil {
+				return err
+			}
+		}
+
 		return transaction.IncrementNetworkSerial(ctx, accountID)
 	})
 	if err != nil {
@@ -492,7 +534,10 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 		am.StoreEvent(ctx, userID, group.ID, accountID, activity.GroupDeleted, group.EventMeta())
 	}
 
-	am.ExpandAndUpdateAffected(ctx, accountID, snap, change)
+	affected := make(affectedPeerSet)
+	affected.add(snap.Expand(ctx, accountID, change))
+	affected.add(ipv6Snap.Expand(ctx, accountID, ipv6Change))
+	go am.dispatchAffectedPeerIDs(ctx, accountID, affected.ids())
 
 	return allErrors
 }
@@ -528,15 +573,18 @@ func (am *DefaultAccountManager) GroupAddPeer(ctx context.Context, accountID, gr
 	change := affectedpeers.Change{OutputPeerIDs: []string{peerID}, LinkGroups: []string{groupID}}
 
 	err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
-		if err := transaction.AddPeerToGroup(ctx, accountID, peerID, groupID); err != nil {
+		if err := syncGroupMembership(ctx, transaction, accountID, groupID, []string{peerID}, nil); err != nil {
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID})
+		if err != nil {
 			return err
 		}
+		// A peer whose IPv6 address changed is visible to every peer that reaches it
+		// through any of its groups, not only through this one.
+		change.ChangedPeerIDs = ipv6Changed
 
-		var err error
 		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
 			return err
 		}
@@ -602,11 +650,14 @@ func (am *DefaultAccountManager) GroupDeletePeer(ctx context.Context, accountID,
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID})
+		if err != nil {
 			return err
 		}
+		// A peer whose IPv6 address changed is visible to every peer that reaches it
+		// through any of its groups, not only through this one.
+		change.ChangedPeerIDs = ipv6Changed
 
-		var err error
 		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
 			return err
 		}
@@ -734,6 +785,22 @@ func validateDeleteGroup(ctx context.Context, transaction store.Store, group *ty
 		return &GroupLinkError{"network router", linkedRouter.ID}
 	}
 
+	if isLinked, linkedService := isGroupLinkedToReverseProxyService(ctx, transaction, group.AccountID, group.ID); isLinked {
+		return &GroupLinkError{"reverse proxy service", linkedService.Domain}
+	}
+
+	if isLinked, linkedPolicy := isGroupLinkedToAgentNetworkPolicy(ctx, transaction, group.AccountID, group.ID); isLinked {
+		return &GroupLinkError{"agent network policy", linkedPolicy.Name}
+	}
+
+	isLinked, linkedRule, err := isGroupLinkedToAgentNetworkBudgetRule(ctx, transaction, group.AccountID, group.ID)
+	if err != nil {
+		return status.Errorf(status.Internal, "failed to check agent network budget rules")
+	}
+	if isLinked {
+		return &GroupLinkError{"agent network budget rule", linkedRule.Name}
+	}
+
 	return checkGroupLinkedToSettings(ctx, transaction, group)
 }
 
@@ -865,6 +932,66 @@ func isGroupLinkedToNetworkRouter(ctx context.Context, transaction store.Store,
 	return false, nil
 }
 
+// isGroupLinkedToReverseProxyService checks if a group is used as an access group
+// of a private reverse proxy service or as a bearer-auth distribution group.
+func isGroupLinkedToReverseProxyService(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *service.Service) {
+	services, err := transaction.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("error retrieving reverse proxy services while checking group linkage: %v", err)
+		return false, nil
+	}
+
+	for _, svc := range services {
+		if svc.Private && slices.Contains(svc.AccessGroups, groupID) {
+			return true, svc
+		}
+		if svc.Auth.BearerAuth != nil && svc.Auth.BearerAuth.Enabled && slices.Contains(svc.Auth.BearerAuth.DistributionGroups, groupID) {
+			return true, svc
+		}
+	}
+	return false, nil
+}
+
+// isGroupLinkedToAgentNetworkPolicy checks if a group is used as a source group by any
+// agent network policy in the account.
+func isGroupLinkedToAgentNetworkPolicy(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *agentNetworkTypes.Policy) {
+	policies, err := transaction.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("error retrieving agent network policies while checking group linkage: %v", err)
+		return false, nil
+	}
+
+	for _, policy := range policies {
+		if policy == nil {
+			continue
+		}
+		if slices.Contains(policy.SourceGroups, groupID) {
+			return true, policy
+		}
+	}
+	return false, nil
+}
+
+// isGroupLinkedToAgentNetworkBudgetRule checks if a group is a target of any
+// account-level agent network budget rule.
+func isGroupLinkedToAgentNetworkBudgetRule(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *agentNetworkTypes.AccountBudgetRule, error) {
+	rules, err := transaction.GetAccountAgentNetworkBudgetRules(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("error retrieving agent network budget rules while checking group linkage: %v", err)
+		return false, nil, err
+	}
+
+	for _, rule := range rules {
+		if rule == nil {
+			continue
+		}
+		if slices.Contains(rule.TargetGroups, groupID) {
+			return true, rule, nil
+		}
+	}
+	return false, nil, nil
+}
+
 // areGroupChangesAffectPeers checks if any changes to the specified groups will affect peers.
 // It fetches each collection once and checks all groupIDs against them in memory.
 func areGroupChangesAffectPeers(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) (bool, error) {
diff --git a/management/server/group_ipv6_test.go b/management/server/group_ipv6_test.go
index dfb436060..2679aa7c2 100644
--- a/management/server/group_ipv6_test.go
+++ b/management/server/group_ipv6_test.go
@@ -2,7 +2,6 @@ package server
 
 import (
 	"context"
-	"math/rand"
 	"testing"
 	"time"
 
@@ -28,7 +27,7 @@ func TestGroupIPv6Assignment(t *testing.T) {
 	require.NoError(t, err)
 
 	// Allocate IPv6 subnet for the account
-	account.Network.NetV6 = types.AllocateIPv6Subnet(rand.New(rand.NewSource(time.Now().UnixNano())))
+	account.Network.NetV6 = types.AllocateIPv6Subnet()
 	require.NoError(t, am.Store.SaveAccount(ctx, account))
 
 	// Create setup key
diff --git a/management/server/group_test.go b/management/server/group_test.go
index 22fda2671..9bcebfd34 100644
--- a/management/server/group_test.go
+++ b/management/server/group_test.go
@@ -11,16 +11,20 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -74,6 +78,42 @@ func TestDefaultAccountManager_CreateGroup(t *testing.T) {
 	}
 }
 
+func TestDefaultAccountManager_BatchGroupChangesStoreEvents(t *testing.T) {
+	t.Setenv("NB_EVENT_ACTIVITY_LOG_ENABLED", "true")
+
+	am, _, err := createManager(t)
+	require.NoError(t, err)
+
+	_, account, err := initTestGroupAccount(am)
+	require.NoError(t, err)
+
+	group := &types.Group{ID: "grp-batch", Name: "Batch group", Issued: types.GroupIssuedAPI}
+	err = am.CreateGroups(context.Background(), account.Id, groupAdminUserID, []*types.Group{group})
+	require.NoError(t, err)
+
+	renamed := &types.Group{ID: group.ID, Name: "Batch group renamed", Issued: types.GroupIssuedAPI}
+	err = am.UpdateGroups(context.Background(), account.Id, groupAdminUserID, []*types.Group{renamed})
+	require.NoError(t, err)
+
+	hasEvent := func(code activity.Activity) bool {
+		events, err := am.eventStore.Get(context.Background(), account.Id, 0, 100, true)
+		if err != nil {
+			return false
+		}
+		for _, event := range events {
+			if event.Activity == code && event.TargetID == group.ID {
+				return true
+			}
+		}
+		return false
+	}
+
+	assert.Eventually(t, func() bool { return hasEvent(activity.GroupCreated) }, time.Second, 10*time.Millisecond,
+		"CreateGroups should store a group created event")
+	assert.Eventually(t, func() bool { return hasEvent(activity.GroupUpdated) }, time.Second, 10*time.Millisecond,
+		"UpdateGroups should store a group updated event on rename")
+}
+
 func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 	am, _, err := createManager(t)
 	if err != nil {
@@ -125,6 +165,26 @@ func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 			"grp-for-integration",
 			"only service users with admin power can delete integration group",
 		},
+		{
+			"agent network policy",
+			"grp-for-agent-network-policy",
+			"agent network policy",
+		},
+		{
+			"agent network budget rule",
+			"grp-for-agent-network-budget-rule",
+			"agent network budget rule",
+		},
+		{
+			"reverse proxy private service access group",
+			"grp-for-rp-private",
+			"reverse proxy service",
+		},
+		{
+			"reverse proxy bearer distribution group",
+			"grp-for-rp-bearer",
+			"reverse proxy service",
+		},
 	}
 
 	for _, testCase := range testCases {
@@ -135,6 +195,16 @@ func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 				return
 			}
 
+			group, getErr := am.GetGroup(context.Background(), account.Id, testCase.groupID, groupAdminUserID)
+			if getErr != nil {
+				t.Errorf("group %s should still exist after failed deletion: %s", testCase.groupID, getErr)
+				return
+			}
+			if group == nil {
+				t.Errorf("group %s was deleted despite the failed deletion", testCase.groupID)
+				return
+			}
+
 			var sErr *status.Error
 			if errors.As(err, &sErr) {
 				if sErr.Message != testCase.expectedReason {
@@ -218,6 +288,23 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 			groupIDs:        []string{"grp-for-integration"},
 			expectedReasons: []string{"only service users with admin power can delete integration group"},
 		},
+		{
+			name:            "agent network policy",
+			groupIDs:        []string{"grp-for-agent-network-policy"},
+			expectedReasons: []string{"agent network policy"},
+		},
+		{
+			name:               "agent network budget rule",
+			groupIDs:           []string{"grp-for-agent-network-budget-rule"},
+			expectedReasons:    []string{"agent network budget rule"},
+			expectedNotDeleted: []string{"grp-for-agent-network-budget-rule"},
+		},
+		{
+			name:               "reverse proxy services",
+			groupIDs:           []string{"grp-for-rp-private", "grp-for-rp-bearer"},
+			expectedReasons:    []string{"reverse proxy service", "reverse proxy service"},
+			expectedNotDeleted: []string{"grp-for-rp-private", "grp-for-rp-bearer"},
+		},
 		{
 			name:            "successfully delete multiple groups",
 			groupIDs:        []string{"group-1", "group-2"},
@@ -285,6 +372,65 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 	}
 }
 
+func TestDefaultAccountManager_DeleteGroupUnlinkedFromReverseProxyService(t *testing.T) {
+	am, _, err := createManager(t)
+	require.NoError(t, err, "Failed to create account manager")
+
+	_, account, err := initTestGroupAccount(am)
+	require.NoError(t, err, "Failed to init testing account")
+
+	deletableGroups := []*types.Group{
+		{
+			ID:        "grp-rp-bearer-disabled",
+			AccountID: account.Id,
+			Name:      "Group only in a disabled bearer auth",
+			Issued:    types.GroupIssuedAPI,
+			Peers:     make([]string, 0),
+		},
+		{
+			ID:        "grp-rp-nonprivate-access",
+			AccountID: account.Id,
+			Name:      "Group only in a non-private service's access groups",
+			Issued:    types.GroupIssuedAPI,
+			Peers:     make([]string, 0),
+		},
+	}
+	for _, group := range deletableGroups {
+		require.NoError(t, am.CreateGroup(context.Background(), account.Id, groupAdminUserID, group))
+	}
+
+	// Disabled bearer auth and stale access groups on a non-private service
+	// are inert configuration and must not block group deletion.
+	services := []*rpservice.Service{
+		{
+			ID:        "rp-svc-bearer-disabled",
+			AccountID: account.Id,
+			Domain:    "bearer-disabled.services.example.com",
+			Auth: rpservice.AuthConfig{
+				BearerAuth: &rpservice.BearerAuthConfig{
+					Enabled:            false,
+					DistributionGroups: []string{"grp-rp-bearer-disabled"},
+				},
+			},
+		},
+		{
+			ID:           "rp-svc-nonprivate-access",
+			AccountID:    account.Id,
+			Domain:       "nonprivate.services.example.com",
+			Private:      false,
+			AccessGroups: []string{"grp-rp-nonprivate-access"},
+		},
+	}
+	for _, svc := range services {
+		require.NoError(t, am.Store.CreateService(context.Background(), svc))
+	}
+
+	for _, group := range deletableGroups {
+		err = am.DeleteGroup(context.Background(), account.Id, groupAdminUserID, group.ID)
+		assert.NoError(t, err, "group %s is not referenced by an active reverse proxy gate and should be deletable", group.ID)
+	}
+}
+
 func TestDefaultAccountManager_DeleteGroupLinkedToFlowGroup(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err)
@@ -406,6 +552,38 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		Peers:     make([]string, 0),
 	}
 
+	groupForAgentNetworkPolicy := &types.Group{
+		ID:        "grp-for-agent-network-policy",
+		AccountID: "account-id",
+		Name:      "Group for agent network policies",
+		Issued:    types.GroupIssuedAPI,
+		Peers:     make([]string, 0),
+	}
+
+	groupForAgentNetworkBudgetRule := &types.Group{
+		ID:        "grp-for-agent-network-budget-rule",
+		AccountID: "account-id",
+		Name:      "Group for agent network budget rules",
+		Issued:    types.GroupIssuedAPI,
+		Peers:     make([]string, 0),
+	}
+
+	groupForRPPrivate := &types.Group{
+		ID:        "grp-for-rp-private",
+		AccountID: "account-id",
+		Name:      "Group for private reverse proxy service",
+		Issued:    types.GroupIssuedAPI,
+		Peers:     make([]string, 0),
+	}
+
+	groupForRPBearer := &types.Group{
+		ID:        "grp-for-rp-bearer",
+		AccountID: "account-id",
+		Name:      "Group for bearer reverse proxy service",
+		Issued:    types.GroupIssuedAPI,
+		Peers:     make([]string, 0),
+	}
+
 	routeResource := &route.Route{
 		ID:     "example route",
 		Groups: []string{groupForRoute.ID},
@@ -461,6 +639,81 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForSetupKeys)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForUsers)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForIntegration)
+	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForAgentNetworkPolicy)
+	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForAgentNetworkBudgetRule)
+	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPPrivate)
+	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPBearer)
+
+	agentNetworkPolicy := &agentNetworkTypes.Policy{
+		ID:           "example agent network policy",
+		AccountID:    accountID,
+		Name:         "Example agent network policy",
+		Enabled:      true,
+		SourceGroups: []string{groupForAgentNetworkPolicy.ID},
+	}
+	if err := am.Store.SaveAgentNetworkPolicy(context.Background(), agentNetworkPolicy); err != nil {
+		return nil, nil, err
+	}
+
+	budgetRuleDecoy := agentNetworkTypes.NewAccountBudgetRule(accountID)
+	budgetRuleDecoy.Name = "Unrelated agent network budget rule"
+	budgetRuleDecoy.TargetGroups = []string{"unrelated-group"}
+	if err := am.Store.SaveAgentNetworkBudgetRule(context.Background(), budgetRuleDecoy); err != nil {
+		return nil, nil, err
+	}
+
+	budgetRule := agentNetworkTypes.NewAccountBudgetRule(accountID)
+	budgetRule.Name = "Example agent network budget rule"
+	budgetRule.TargetGroups = []string{groupForAgentNetworkBudgetRule.ID}
+	if err := am.Store.SaveAgentNetworkBudgetRule(context.Background(), budgetRule); err != nil {
+		return nil, nil, err
+	}
+
+	// The decoy services are created first so the linkage check has to scan
+	// past services that do not reference the groups under test.
+	rpServices := []*rpservice.Service{
+		{
+			ID:           "rp-svc-private-decoy",
+			AccountID:    accountID,
+			Domain:       "private-decoy.services.example.com",
+			Private:      true,
+			AccessGroups: []string{"unrelated-group"},
+		},
+		{
+			ID:        "rp-svc-bearer-decoy",
+			AccountID: accountID,
+			Domain:    "bearer-decoy.services.example.com",
+			Auth: rpservice.AuthConfig{
+				BearerAuth: &rpservice.BearerAuthConfig{
+					Enabled:            true,
+					DistributionGroups: []string{"unrelated-group"},
+				},
+			},
+		},
+		{
+			ID:           "rp-svc-private",
+			AccountID:    accountID,
+			Domain:       "private.services.example.com",
+			Private:      true,
+			AccessGroups: []string{groupForRPPrivate.ID},
+		},
+		{
+			ID:        "rp-svc-bearer",
+			AccountID: accountID,
+			Domain:    "bearer.services.example.com",
+			Auth: rpservice.AuthConfig{
+				BearerAuth: &rpservice.BearerAuthConfig{
+					Enabled:            true,
+					DistributionGroups: []string{groupForRPBearer.ID},
+				},
+			},
+		},
+	}
+	for _, svc := range rpServices {
+		if err := am.Store.CreateService(context.Background(), svc); err != nil {
+			return nil, nil, err
+		}
+	}
 
 	acc, err := am.Store.GetAccount(context.Background(), account.Id)
 	if err != nil {
@@ -470,342 +723,368 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 }
 
 func TestGroupAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1.ID, peer3.ID},
-		},
-		{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupE",
-			Name:  "GroupE",
-			Peers: []string{peer2.ID},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Saving a group that is not linked to any resource should not update account peers
-	t.Run("saving unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{peer1.ID, peer2.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Adding a peer to a group that is not linked to any resource should not update account peers
-	// and not send peer update
-	t.Run("adding peer to unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Removing a peer from a group that is not linked to any resource should not update account peers
-	// and not send peer update
-	t.Run("removing peer from unliked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Deleting group should not update account peers and not send peer update
-	t.Run("deleting group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB")
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// adding a group to policy
-	_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
+		g := []*types.Group{
 			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1.ID, peer3.ID},
+			},
+			{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupE",
+				Name:  "GroupE",
+				Peers: []string{peer2.ID},
 			},
-		},
-	}, true)
-	assert.NoError(t, err)
-
-	// Saving a group linked to policy should update account peers and send peer update
-	t.Run("saving linked group to policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
 		}
-	})
-
-	// adding peer to a used group should update account peers and send peer update
-	t.Run("adding peer to linked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
-	})
 
-	// removing peer from a linked group should update account peers and send peer update
-	t.Run("removing peer from linked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-		err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID)
+		// Saving a group that is not linked to any resource should not update account peers
+		step(t, "saving unlinked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Adding a peer to a group that is not linked to any resource should not update account peers
+		// and not send peer update
+		step(t, "adding peer to unlinked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Removing a peer from a group that is not linked to any resource should not update account peers
+		// and not send peer update
+		step(t, "removing peer from unliked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting group should not update account peers and not send peer update
+		step(t, "deleting group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB")
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// adding a group to policy
+		_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"groupA"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Saving a group linked to policy should update account peers and send peer update
+		step(t, "saving linked group to policy", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-	// Saving a group linked to name server group should update account peers and send peer update
-	t.Run("saving group linked to name server group", func(t *testing.T) {
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupC"},
-			true, nil, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
 
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1.ID, peer3.ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// adding peer to a used group should update account peers and send peer update
+		step(t, "adding peer to linked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Saving a group linked to route should update account peers and send peer update
-	t.Run("saving group linked to route", func(t *testing.T) {
-		newRoute := route.Route{
-			ID:          "route",
-			Network:     netip.MustParsePrefix("192.168.0.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupA"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupC"},
-		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
+			err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID)
+			assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// removing peer from a linked group should update account peers and send peer update
+		step(t, "removing peer from linked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Saving a group linked to dns settings should update account peers and send peer update
-	t.Run("saving group linked to dns settings", func(t *testing.T) {
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupD"},
+			err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving a group linked to name server group should update account peers and send peer update
+		step(t, "saving group linked to name server group", func(t *testing.T) {
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupC"},
+				true, nil, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{peer1.ID},
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Saving a group linked to route should update account peers and send peer update
+		step(t, "saving group linked to route", func(t *testing.T) {
+			newRoute := route.Route{
+				ID:          "route",
+				Network:     netip.MustParsePrefix("192.168.0.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupA"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupC"},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
 
-	// Saving a group linked to network router should update account peers and send peer update
-	t.Run("saving group linked to network router", func(t *testing.T) {
-		permissionsManager := permissions.NewManager(manager.Store)
-		groupsManager := groups.NewManager(manager.Store, permissionsManager, manager)
-		resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager)
-		routersManager := routers.NewManager(manager.Store, permissionsManager, manager)
-		networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager)
+			settleAffectedUpdates(updMsg)
 
-		network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{
-			ID:          "network_test",
-			AccountID:   account.Id,
-			Name:        "network_test",
-			Description: "",
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		require.NoError(t, err)
 
-		_, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{
-			ID:         "router_test",
-			NetworkID:  network.ID,
-			AccountID:  account.Id,
-			PeerGroups: []string{"groupE"},
-			Masquerade: true,
-			Metric:     9999,
-			Enabled:    true,
+		// Saving a group linked to dns settings should update account peers and send peer update
+		step(t, "saving group linked to dns settings", func(t *testing.T) {
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupD"},
+			})
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{peer1.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving a group linked to network router should update account peers and send peer update
+		step(t, "saving group linked to network router", func(t *testing.T) {
+			permissionsManager := permissions.NewManager(manager.Store)
+			groupsManager := groups.NewManager(manager.Store, permissionsManager, manager)
+			resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager)
+			routersManager := routers.NewManager(manager.Store, permissionsManager, manager)
+			networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupE",
-			Name:  "GroupE",
-			Peers: []string{peer2.ID, peer3.ID},
+			network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{
+				ID:          "network_test",
+				AccountID:   account.Id,
+				Name:        "network_test",
+				Description: "",
+			})
+			require.NoError(t, err)
+
+			_, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{
+				ID:         "router_test",
+				NetworkID:  network.ID,
+				AccountID:  account.Id,
+				PeerGroups: []string{"groupE"},
+				Masquerade: true,
+				Metric:     9999,
+				Enabled:    true,
+			})
+			require.NoError(t, err)
+
+			resource, err := resourcesManager.CreateResource(context.Background(), userID, &resourceTypes.NetworkResource{
+				AccountID: account.Id,
+				NetworkID: network.ID,
+				Name:      "resource_test",
+				Address:   "10.20.30.0/24",
+				Enabled:   true,
+			})
+			require.NoError(t, err)
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, peerToResourcePolicyByResource("groupA", resource.ID), true)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupE",
+				Name:  "GroupE",
+				Peers: []string{peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
 	})
 }
 
@@ -843,7 +1122,6 @@ func Test_AddPeerToGroup(t *testing.T) {
 				errs <- fmt.Errorf("AddPeer failed for peer %d: %w", i, err)
 				return
 			}
-
 		}(i)
 	}
 	startTime := time.Now()
@@ -900,7 +1178,6 @@ func Test_AddPeerToAll(t *testing.T) {
 				errs <- fmt.Errorf("AddPeer failed for peer %d: %w", i, err)
 				return
 			}
-
 		}(i)
 	}
 	startTime := time.Now()
@@ -1065,3 +1342,180 @@ func Test_IncrementNetworkSerial(t *testing.T) {
 
 	assert.Equal(t, totalPeers, int(account.Network.Serial), "Expected %d serial increases in account %s, got %d", totalPeers, accountID, account.Network.Serial)
 }
+
+func TestDefaultAccountManager_GroupPeersMustBelongToAccount(t *testing.T) {
+	manager, _, account, peer1, _, _ := setupNetworkMapTest(t)
+
+	otherAccount, err := createAccount(manager, "other_account", "other_user", "")
+	require.NoError(t, err)
+
+	foreignPeer := &peer2.Peer{
+		ID:        "foreign-peer",
+		AccountID: otherAccount.Id,
+		Key:       "foreign-key",
+		DNSLabel:  "foreign-peer",
+		IP:        uint32ToIP(1),
+	}
+	require.NoError(t, manager.Store.AddPeerToAccount(context.Background(), foreignPeer))
+
+	assertRejected := func(t *testing.T, err error) {
+		t.Helper()
+		require.Error(t, err)
+		s, ok := status.FromError(err)
+		require.True(t, ok, "expected status error, got %v", err)
+		assert.Equal(t, status.InvalidArgument, s.Type(), "peer outside the account should be rejected as invalid argument")
+	}
+
+	t.Run("create rejects foreign peer", func(t *testing.T) {
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			Name:   "foreign",
+			Issued: types.GroupIssuedAPI,
+			Peers:  []string{peer1.ID, foreignPeer.ID},
+		})
+		assertRejected(t, err)
+
+		_, err = manager.Store.GetGroupByName(context.Background(), store.LockingStrengthNone, account.Id, "foreign")
+		assert.Error(t, err, "rejected create must not persist the group")
+	})
+
+	t.Run("update rejects foreign and unknown peers", func(t *testing.T) {
+		group := &types.Group{ID: "own", Name: "own", Issued: types.GroupIssuedAPI, Peers: []string{peer1.ID}}
+		require.NoError(t, manager.CreateGroup(context.Background(), account.Id, userID, group))
+
+		group.Peers = []string{peer1.ID, foreignPeer.ID}
+		assertRejected(t, manager.UpdateGroup(context.Background(), account.Id, userID, group))
+
+		group.Peers = []string{peer1.ID, "does-not-exist"}
+		assertRejected(t, manager.UpdateGroup(context.Background(), account.Id, userID, group))
+
+		stored, err := manager.Store.GetGroupByID(context.Background(), store.LockingStrengthNone, account.Id, group.ID)
+		require.NoError(t, err)
+		assert.Equal(t, []string{peer1.ID}, stored.Peers, "rejected updates must not change membership")
+	})
+
+	t.Run("update tolerates and drops pre-existing dangling members", func(t *testing.T) {
+		group := &types.Group{ID: "polluted", Name: "polluted", Issued: types.GroupIssuedAPI, Peers: []string{peer1.ID}}
+		require.NoError(t, manager.CreateGroup(context.Background(), account.Id, userID, group))
+		require.NoError(t, manager.Store.AddPeerToGroup(context.Background(), account.Id, foreignPeer.ID, group.ID))
+
+		group.Peers = []string{peer1.ID, foreignPeer.ID}
+		assert.NoError(t, manager.UpdateGroup(context.Background(), account.Id, userID, group), "keeping an existing member must not be rejected")
+
+		group.Peers = []string{peer1.ID}
+		require.NoError(t, manager.UpdateGroup(context.Background(), account.Id, userID, group))
+
+		stored, err := manager.Store.GetGroupByID(context.Background(), store.LockingStrengthNone, account.Id, group.ID)
+		require.NoError(t, err)
+		assert.Equal(t, []string{peer1.ID}, stored.Peers, "dangling member should be removed once omitted")
+	})
+
+	t.Run("direct add rejects foreign and unknown peers", func(t *testing.T) {
+		group := &types.Group{ID: "direct", Name: "direct", Issued: types.GroupIssuedAPI, Peers: []string{peer1.ID}}
+		require.NoError(t, manager.CreateGroup(context.Background(), account.Id, userID, group))
+
+		assertRejected(t, manager.GroupAddPeer(context.Background(), account.Id, group.ID, foreignPeer.ID))
+		assertRejected(t, manager.GroupAddPeer(context.Background(), account.Id, group.ID, "does-not-exist"))
+
+		stored, err := manager.Store.GetGroupByID(context.Background(), store.LockingStrengthNone, account.Id, group.ID)
+		require.NoError(t, err)
+		assert.Equal(t, []string{peer1.ID}, stored.Peers, "rejected direct adds must not change membership")
+	})
+}
+
+func TestGroupsBatchAccountPeersUpdate(t *testing.T) {
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+
+		for _, group := range []*types.Group{
+			{ID: "groupA", Name: "GroupA", Peers: []string{peer1.ID, peer2.ID}},
+			{ID: "groupB", Name: "GroupB", Peers: []string{peer3.ID}},
+		} {
+			require.NoError(t, manager.CreateGroup(context.Background(), account.Id, userID, group))
+		}
+
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
+
+		step(t, "creating unlinked groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
+				{ID: "groupC", Name: "GroupC", Peers: []string{peer1.ID}},
+				{ID: "groupD", Name: "GroupD"},
+			})
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"groupB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		step(t, "updating a batch with a linked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroups(context.Background(), account.Id, userID, []*types.Group{
+				{ID: "groupD", Name: "GroupD renamed"},
+				{ID: "groupB", Name: "GroupB renamed"},
+			})
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		step(t, "updating a batch where one item fails", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroups(context.Background(), account.Id, userID, []*types.Group{
+				{ID: "missing", Name: "Missing"},
+				{ID: "groupB", Name: "GroupB"},
+			})
+			require.Error(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+	})
+}
diff --git a/management/server/groups/manager.go b/management/server/groups/manager.go
index c9a877d6f..893be1e5a 100644
--- a/management/server/groups/manager.go
+++ b/management/server/groups/manager.go
@@ -109,7 +109,7 @@ func (m *managerImpl) AddResourceToGroupInTransaction(ctx context.Context, trans
 	}
 
 	event := func() {
-		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceAddedToGroup, group.EventMetaResource(networkResource))
+		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceAddedToGroup, group.EventMetaResource(types.TwinNetworkResource(networkResource)))
 	}
 
 	return event, nil
@@ -133,7 +133,7 @@ func (m *managerImpl) RemoveResourceFromGroupInTransaction(ctx context.Context,
 	}
 
 	event := func() {
-		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceRemovedFromGroup, group.EventMetaResource(networkResource))
+		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceRemovedFromGroup, group.EventMetaResource(types.TwinNetworkResource(networkResource)))
 	}
 
 	return event, nil
diff --git a/management/server/http/handler.go b/management/server/http/handler.go
index a57f44b3c..12aaadbb5 100644
--- a/management/server/http/handler.go
+++ b/management/server/http/handler.go
@@ -7,8 +7,6 @@ import (
 	"net/netip"
 
 	"github.com/gorilla/mux"
-	"github.com/rs/cors"
-	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
 
@@ -36,7 +34,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/http/handlers/proxy"
 
-	"github.com/netbirdio/netbird/management/server/auth"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	nbgroups "github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/http/handlers/accounts"
@@ -51,17 +48,20 @@ import (
 	"github.com/netbirdio/netbird/management/server/http/handlers/routes"
 	"github.com/netbirdio/netbird/management/server/http/handlers/setup_keys"
 	"github.com/netbirdio/netbird/management/server/http/handlers/users"
-	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/http/middleware/bypass"
 	nbinstance "github.com/netbirdio/netbird/management/server/instance"
 	nbnetworks "github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
-	"github.com/netbirdio/netbird/management/server/telemetry"
 )
 
 // NewAPIHandler creates the Management service HTTP API handler registering all the available endpoints.
-func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager account.Manager, networksManager nbnetworks.Manager, resourceManager resources.Manager, routerManager routers.Manager, groupsManager nbgroups.Manager, LocationManager geolocation.Geolocation, authManager auth.Manager, appMetrics telemetry.AppMetrics, permissionsManager permissions.Manager, settingsManager settings.Manager, zManager zones.Manager, rManager records.Manager, networkMapController network_map.Controller, idpManager idpmanager.Manager, serviceManager service.Manager, reverseProxyDomainManager *manager.Manager, reverseProxyAccessLogsManager accesslogs.Manager, proxyGRPCServer *nbgrpc.ProxyServiceServer, trustedHTTPProxies []netip.Prefix, rateLimiter *middleware.APIRateLimiter, isValidChildAccount middleware.IsValidChildAccountFunc, agentNetworkManager agentnetwork.Manager) (http.Handler, error) {
+func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager account.Manager, networksManager nbnetworks.Manager,
+	resourceManager resources.Manager, routerManager routers.Manager, groupsManager nbgroups.Manager, LocationManager geolocation.Geolocation,
+	permissionsManager permissions.Manager, settingsManager settings.Manager, zManager zones.Manager, rManager records.Manager,
+	networkMapController network_map.Controller, idpManager idpmanager.Manager, serviceManager service.Manager,
+	reverseProxyDomainManager *manager.Manager, reverseProxyAccessLogsManager accesslogs.Manager, proxyGRPCServer *nbgrpc.ProxyServiceServer,
+	trustedHTTPProxies []netip.Prefix, agentNetworkManager agentnetwork.Manager, proxyTokenRevocationGuard proxytoken.RevocationGuard) (http.Handler, error) {
 
 	// Register bypass paths for unauthenticated endpoints
 	if err := bypass.AddBypassPath("/api/instance"); err != nil {
@@ -82,28 +82,6 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 		return nil, fmt.Errorf("failed to add bypass path: %w", err)
 	}
 
-	if rateLimiter == nil {
-		log.Warn("NewAPIHandler: nil rate limiter, rate limiting disabled")
-		rateLimiter = middleware.NewAPIRateLimiter(nil)
-		rateLimiter.SetEnabled(false)
-	}
-
-	authMiddleware := middleware.NewAuthMiddleware(
-		authManager,
-		accountManager.GetAccountIDFromUserAuth,
-		accountManager.SyncUserJWTGroups,
-		accountManager.GetUserFromUserAuth,
-		rateLimiter,
-		appMetrics.GetMeter(),
-		isValidChildAccount,
-	)
-
-	corsMiddleware := cors.AllowAll()
-
-	metricsMiddleware := appMetrics.HTTPMiddleware()
-
-	router.Use(metricsMiddleware.Handler, corsMiddleware.Handler, authMiddleware.Handler)
-
 	instanceManager, err := nbinstance.NewManager(ctx, accountManager.GetStore(), idpManager)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create instance manager: %w", err)
@@ -135,7 +113,7 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 		reverseproxymanager.RegisterEndpoints(serviceManager, *reverseProxyDomainManager, reverseProxyAccessLogsManager, permissionsManager, router)
 	}
 
-	proxytoken.RegisterEndpoints(accountManager.GetStore(), permissionsManager, router)
+	proxytoken.RegisterEndpoints(accountManager.GetStore(), permissionsManager, proxyTokenRevocationGuard, router)
 
 	// Register OAuth callback handler for proxy authentication
 	if proxyGRPCServer != nil {
diff --git a/management/server/http/handlers/accounts/accounts_handler.go b/management/server/http/handlers/accounts/accounts_handler.go
index d4342bf57..797815685 100644
--- a/management/server/http/handlers/accounts/accounts_handler.go
+++ b/management/server/http/handlers/accounts/accounts_handler.go
@@ -127,7 +127,7 @@ func (h *handler) validateNetworkRange(ctx context.Context, accountID, userID st
 }
 
 func (h *handler) validateCapacity(ctx context.Context, accountID, userID string, prefix netip.Prefix) error {
-	peers, err := h.accountManager.GetPeers(ctx, accountID, userID, "", "")
+	peers, err := h.accountManager.GetPeers(ctx, accountID, userID, "", "", "")
 	if err != nil {
 		return status.Errorf(status.Internal, "get peer count: %v", err)
 	}
@@ -152,7 +152,7 @@ func calculateMaxHosts(prefix netip.Prefix) int64 {
 
 	maxHosts := int64(1) << hostBits
 	if prefix.Addr().Is4() {
-		maxHosts -= 2 // network and broadcast addresses
+		maxHosts -= 3 // network, client DNS resolver and broadcast addresses
 	}
 
 	return maxHosts
@@ -286,6 +286,24 @@ func (h *handler) updateAccountRequestSettings(req api.PutApiAccountsAccountIdJS
 	if req.Settings.MetricsPushEnabled != nil {
 		returnSettings.MetricsPushEnabled = *req.Settings.MetricsPushEnabled
 	}
+	if req.Settings.PeerHostnameCollisionRejected != nil {
+		returnSettings.PeerHostnameCollisionRejected = *req.Settings.PeerHostnameCollisionRejected
+	}
+	if req.Settings.AgentNetworkOnly != nil {
+		returnSettings.AgentNetworkOnly = *req.Settings.AgentNetworkOnly
+	}
+	if req.Settings.DashboardFeatures != nil {
+		returnSettings.DashboardFeatures = &types.DashboardFeatures{
+			AgentNetwork: req.Settings.DashboardFeatures.AgentNetwork,
+		}
+	}
+
+	if returnSettings.AgentNetworkOnly &&
+		(returnSettings.DashboardFeatures == nil ||
+			returnSettings.DashboardFeatures.AgentNetwork == nil ||
+			!*returnSettings.DashboardFeatures.AgentNetwork) {
+		return nil, status.Errorf(status.InvalidArgument, "agent network only mode requires dashboard_features.agent_network to be enabled")
+	}
 
 	return returnSettings, nil
 }
@@ -417,6 +435,8 @@ func toAccountResponse(accountID string, settings *types.Settings, meta *types.A
 		AutoUpdateAlways:                &settings.AutoUpdateAlways,
 		Ipv6EnabledGroups:               &settings.IPv6EnabledGroups,
 		MetricsPushEnabled:              &settings.MetricsPushEnabled,
+		PeerHostnameCollisionRejected:   &settings.PeerHostnameCollisionRejected,
+		AgentNetworkOnly:                &settings.AgentNetworkOnly,
 		EmbeddedIdpEnabled:              &settings.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               &settings.LocalAuthDisabled,
 		LocalMfaEnabled:                 &settings.LocalMfaEnabled,
@@ -430,6 +450,11 @@ func toAccountResponse(accountID string, settings *types.Settings, meta *types.A
 		networkRangeV6Str := settings.NetworkRangeV6.String()
 		apiSettings.NetworkRangeV6 = &networkRangeV6Str
 	}
+	if settings.DashboardFeatures != nil {
+		apiSettings.DashboardFeatures = &api.AccountDashboardFeatures{
+			AgentNetwork: settings.DashboardFeatures.AgentNetwork,
+		}
+	}
 
 	apiOnboarding := api.AccountOnboarding{
 		OnboardingFlowPending: onboarding.OnboardingFlowPending,
diff --git a/management/server/http/handlers/accounts/accounts_handler_test.go b/management/server/http/handlers/accounts/accounts_handler_test.go
index df89fde9a..588258003 100644
--- a/management/server/http/handlers/accounts/accounts_handler_test.go
+++ b/management/server/http/handlers/accounts/accounts_handler_test.go
@@ -12,9 +12,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/gorilla/mux"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/management/server/mock_server"
@@ -130,6 +130,8 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -158,6 +160,8 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -186,6 +190,8 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr("latest"),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -214,6 +220,8 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -242,6 +250,8 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -270,6 +280,113 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
+				AgentNetworkOnly:                br(false),
+				EmbeddedIdpEnabled:              br(false),
+				LocalAuthDisabled:               br(false),
+				LocalMfaEnabled:                 br(false),
+			},
+			expectedArray: false,
+			expectedID:    accountID,
+		},
+		{
+			name:           "PutAccount OK enabling agent_network_only",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true,\"dashboard_features\": {\"agent_network\": true}},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusOK,
+			expectedSettings: api.AccountSettings{
+				PeerLoginExpiration:             15552000,
+				PeerLoginExpirationEnabled:      true,
+				GroupsPropagationEnabled:        br(false),
+				JwtGroupsClaimName:              sr(""),
+				JwtGroupsEnabled:                br(false),
+				JwtAllowGroups:                  &[]string{},
+				RegularUsersViewBlocked:         false,
+				RoutingPeerDnsResolutionEnabled: br(false),
+				LazyConnectionEnabled:           br(false),
+				DnsDomain:                       sr(""),
+				AutoUpdateAlways:                br(false),
+				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
+				AgentNetworkOnly:                br(true),
+				DashboardFeatures: &api.AccountDashboardFeatures{
+					AgentNetwork: br(true),
+				},
+				EmbeddedIdpEnabled: br(false),
+				LocalAuthDisabled:  br(false),
+				LocalMfaEnabled:    br(false),
+			},
+			expectedArray: false,
+			expectedID:    accountID,
+		},
+		{
+			name:           "PutAccount fails enabling agent_network_only without dashboard_features",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusUnprocessableEntity,
+			expectedArray:  false,
+		},
+		{
+			name:           "PutAccount OK setting dashboard_features agent_network",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"dashboard_features\": {\"agent_network\": true}},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusOK,
+			expectedSettings: api.AccountSettings{
+				PeerLoginExpiration:             15552000,
+				PeerLoginExpirationEnabled:      true,
+				GroupsPropagationEnabled:        br(false),
+				JwtGroupsClaimName:              sr(""),
+				JwtGroupsEnabled:                br(false),
+				JwtAllowGroups:                  &[]string{},
+				RegularUsersViewBlocked:         false,
+				RoutingPeerDnsResolutionEnabled: br(false),
+				LazyConnectionEnabled:           br(false),
+				DnsDomain:                       sr(""),
+				AutoUpdateAlways:                br(false),
+				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
+				AgentNetworkOnly:                br(false),
+				DashboardFeatures: &api.AccountDashboardFeatures{
+					AgentNetwork: br(true),
+				},
+				EmbeddedIdpEnabled: br(false),
+				LocalAuthDisabled:  br(false),
+				LocalMfaEnabled:    br(false),
+			},
+			expectedArray: false,
+			expectedID:    accountID,
+		},
+		{
+			name:           "PutAccount OK disabling agent_network_only again",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": false},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusOK,
+			expectedSettings: api.AccountSettings{
+				PeerLoginExpiration:             15552000,
+				PeerLoginExpirationEnabled:      true,
+				GroupsPropagationEnabled:        br(false),
+				JwtGroupsClaimName:              sr(""),
+				JwtGroupsEnabled:                br(false),
+				JwtAllowGroups:                  &[]string{},
+				RegularUsersViewBlocked:         false,
+				RoutingPeerDnsResolutionEnabled: br(false),
+				LazyConnectionEnabled:           br(false),
+				DnsDomain:                       sr(""),
+				AutoUpdateAlways:                br(false),
+				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -361,9 +478,9 @@ func TestCalculateMaxHosts(t *testing.T) {
 		prefix string
 		min    int64
 	}{
-		{"v4 /24", "100.64.0.0/24", 254},
-		{"v4 /16", "100.64.0.0/16", 65534},
-		{"v4 /28", "100.64.0.0/28", 14},
+		{"v4 /24", "100.64.0.0/24", 253},
+		{"v4 /16", "100.64.0.0/16", 65533},
+		{"v4 /28", "100.64.0.0/28", 13},
 		{"v6 /64", "fd00::/64", math.MaxInt64},
 		{"v6 /120", "fd00::/120", 256},
 		{"v6 /112", "fd00::/112", 65536},
diff --git a/management/server/http/handlers/groups/groups_handler.go b/management/server/http/handlers/groups/groups_handler.go
index f8d161a87..1a7753a57 100644
--- a/management/server/http/handlers/groups/groups_handler.go
+++ b/management/server/http/handlers/groups/groups_handler.go
@@ -58,7 +58,7 @@ func (h *handler) getAllGroups(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+		accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 		if err != nil {
 			util.WriteError(r.Context(), err, w)
 			return
@@ -77,7 +77,7 @@ func (h *handler) getAllGroups(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -148,13 +148,10 @@ func (h *handler) updateGroup(w http.ResponseWriter, r *http.Request) {
 		peers = *req.Peers
 	}
 
-	resources := make([]types.Resource, 0)
-	if req.Resources != nil {
-		for _, res := range *req.Resources {
-			resource := types.Resource{}
-			resource.FromAPIRequest(&res)
-			resources = append(resources, resource)
-		}
+	resources, err := resourcesFromAPIRequest(req.Resources)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
 	}
 
 	group := types.Group{
@@ -172,7 +169,7 @@ func (h *handler) updateGroup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -210,13 +207,10 @@ func (h *handler) createGroup(w http.ResponseWriter, r *http.Request) {
 		peers = *req.Peers
 	}
 
-	resources := make([]types.Resource, 0)
-	if req.Resources != nil {
-		for _, res := range *req.Resources {
-			resource := types.Resource{}
-			resource.FromAPIRequest(&res)
-			resources = append(resources, resource)
-		}
+	resources, err := resourcesFromAPIRequest(req.Resources)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
 	}
 
 	group := types.Group{
@@ -232,7 +226,7 @@ func (h *handler) createGroup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -293,7 +287,7 @@ func (h *handler) getGroup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -335,11 +329,30 @@ func toGroupResponse(peers []*nbpeer.Peer, group *types.Group) *api.Group {
 	gr.PeersCount = len(gr.Peers)
 
 	for _, res := range group.Resources {
-		resResp := res.ToAPIResponse()
-		gr.Resources = append(gr.Resources, *resResp)
+		if resResp := res.ToAPIResponse(); resResp != nil {
+			gr.Resources = append(gr.Resources, *resResp)
+		}
 	}
 
 	gr.ResourcesCount = len(gr.Resources)
 
 	return &gr
 }
+
+func resourcesFromAPIRequest(req *[]api.Resource) ([]types.Resource, error) {
+	resources := make([]types.Resource, 0)
+	if req == nil {
+		return resources, nil
+	}
+
+	for _, res := range *req {
+		if res.Id == "" || !types.ResourceType(res.Type).Valid() {
+			return nil, status.Errorf(status.InvalidArgument, "resource id shouldn't be empty and type must be one of: peer, domain, host, subnet")
+		}
+		resource := types.Resource{}
+		resource.FromAPIRequest(&res)
+		resources = append(resources, resource)
+	}
+
+	return resources, nil
+}
diff --git a/management/server/http/handlers/groups/groups_handler_test.go b/management/server/http/handlers/groups/groups_handler_test.go
index 57e238630..f61131da0 100644
--- a/management/server/http/handlers/groups/groups_handler_test.go
+++ b/management/server/http/handlers/groups/groups_handler_test.go
@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/netip"
 	"net/http/httptest"
+	"net/netip"
 	"strings"
 	"testing"
 
@@ -78,8 +78,8 @@ func initGroupTestData(initGroups ...*types.Group) *handler {
 
 				return nil, status.Errorf(status.NotFound, "unknown group name")
 			},
-			GetPeersFunc: func(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
-				return maps.Values(TestPeers), nil
+			GetPeersFunc: func(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, int, error) {
+				return maps.Values(TestPeers), len(maps.Values(TestPeers)), nil
 			},
 			DeleteGroupFunc: func(_ context.Context, accountID, userId, groupID string) error {
 				if groupID == "linked-grp" {
@@ -208,6 +208,33 @@ func TestWriteGroup(t *testing.T) {
 			expectedStatus: http.StatusUnprocessableEntity,
 			expectedBody:   false,
 		},
+		{
+			name:        "Write Group POST Empty Resource",
+			requestType: http.MethodPost,
+			requestPath: "/api/groups",
+			requestBody: bytes.NewBuffer(
+				[]byte(`{"name":"With Resource","resources":[{}]}`)),
+			expectedStatus: http.StatusUnprocessableEntity,
+			expectedBody:   false,
+		},
+		{
+			name:        "Write Group PUT Empty Resource",
+			requestType: http.MethodPut,
+			requestPath: "/api/groups/id-existed",
+			requestBody: bytes.NewBuffer(
+				[]byte(`{"name":"With Resource","resources":[{"id":"","type":"host"}]}`)),
+			expectedStatus: http.StatusUnprocessableEntity,
+			expectedBody:   false,
+		},
+		{
+			name:        "Write Group POST Unknown Resource Type",
+			requestType: http.MethodPost,
+			requestPath: "/api/groups",
+			requestBody: bytes.NewBuffer(
+				[]byte(`{"name":"With Resource","resources":[{"id":"res-1","type":"banana"}]}`)),
+			expectedStatus: http.StatusUnprocessableEntity,
+			expectedBody:   false,
+		},
 		{
 			name:        "Write Group PUT OK",
 			requestType: http.MethodPut,
@@ -376,6 +403,20 @@ func TestGetAllGroups(t *testing.T) {
 	}
 }
 
+func TestToGroupResponseSkipsEmptyResource(t *testing.T) {
+	group := &types.Group{
+		ID:        "id-resources",
+		Name:      "Resources",
+		Issued:    types.GroupIssuedAPI,
+		Resources: []types.Resource{{}, {ID: "res-1", Type: types.ResourceTypeHost}},
+	}
+
+	got := toGroupResponse(nil, group)
+
+	assert.Equal(t, 1, got.ResourcesCount)
+	assert.Equal(t, []api.Resource{{Id: "res-1", Type: api.ResourceType(types.ResourceTypeHost)}}, got.Resources)
+}
+
 func TestDeleteGroup(t *testing.T) {
 	tt := []struct {
 		name           string
diff --git a/management/server/http/handlers/instance/instance_handler_test.go b/management/server/http/handlers/instance/instance_handler_test.go
index 711e01964..ba59497fa 100644
--- a/management/server/http/handlers/instance/instance_handler_test.go
+++ b/management/server/http/handlers/instance/instance_handler_test.go
@@ -10,7 +10,7 @@ import (
 	"net/mail"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/gorilla/mux"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/management/server/http/handlers/peers/peers_handler.go b/management/server/http/handlers/peers/peers_handler.go
index 310f90653..8a9bf1f70 100644
--- a/management/server/http/handlers/peers/peers_handler.go
+++ b/management/server/http/handlers/peers/peers_handler.go
@@ -317,10 +317,11 @@ func (h *Handler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
 
 	nameFilter := r.URL.Query().Get("name")
 	ipFilter := r.URL.Query().Get("ip")
+	macFilter := r.URL.Query().Get("mac")
 
 	accountID, userID := userAuth.AccountId, userAuth.UserId
 
-	peers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, nameFilter, ipFilter)
+	peers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, nameFilter, ipFilter, macFilter)
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -446,7 +447,7 @@ func (h *Handler) GetAccessiblePeers(w http.ResponseWriter, r *http.Request) {
 
 	netMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, dns.CustomZone{}, nil, validPeers, account.GetResourcePoliciesMap(), account.GetResourceRoutersMap(), nil, account.GetActiveGroupUsers())
 
-	util.WriteJSONObject(ctx, w, toAccessiblePeers(netMap, dnsDomain))
+	util.WriteJSONObject(ctx, w, toAccessiblePeers(account.Peers, netMap, dnsDomain))
 }
 
 func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request) {
@@ -534,14 +535,21 @@ func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request)
 	util.WriteJSONObject(r.Context(), w, resp)
 }
 
-func toAccessiblePeers(netMap *types.NetworkMap, dnsDomain string) []api.AccessiblePeer {
+// toAccessiblePeers resolves the twin peers in netMap back to the full account
+// peers (by ID) so the API response keeps Status/Name/OS/GeoNameID, which the
+// slim netmap twins intentionally don't carry.
+func toAccessiblePeers(accountPeers map[string]*nbpeer.Peer, netMap *types.NetworkMap, dnsDomain string) []api.AccessiblePeer {
 	accessiblePeers := make([]api.AccessiblePeer, 0, len(netMap.Peers)+len(netMap.OfflinePeers))
+	appendByID := func(id string) {
+		if p, ok := accountPeers[id]; ok && p != nil {
+			accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(p, dnsDomain))
+		}
+	}
 	for _, p := range netMap.Peers {
-		accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(p, dnsDomain))
+		appendByID(p.ID)
 	}
-
 	for _, p := range netMap.OfflinePeers {
-		accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(p, dnsDomain))
+		appendByID(p.ID)
 	}
 
 	return accessiblePeers
@@ -564,6 +572,17 @@ func peerToAccessiblePeer(peer *nbpeer.Peer, dnsDomain string) api.AccessiblePee
 	}
 }
 
+func toNetworkAddresses(addrs []nbpeer.NetworkAddress) *[]api.NetworkAddress {
+	if len(addrs) == 0 {
+		return nil
+	}
+	out := make([]api.NetworkAddress, 0, len(addrs))
+	for _, a := range addrs {
+		out = append(out, api.NetworkAddress{NetIp: a.NetIP.String(), Mac: a.Mac})
+	}
+	return &out
+}
+
 func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsDomain string, approved bool, reason string) *api.Peer {
 	osVersion := peer.Meta.OSVersion
 	if osVersion == "" {
@@ -576,6 +595,7 @@ func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsD
 		Name:                        peer.Name,
 		Ip:                          peer.IP.String(),
 		Ipv6:                        peerIPv6String(peer),
+		NetworkAddresses:            toNetworkAddresses(peer.Meta.NetworkAddresses),
 		ConnectionIp:                peer.Location.ConnectionIP.String(),
 		Connected:                   peer.Status.Connected,
 		LastSeen:                    peer.Status.LastSeen,
@@ -610,6 +630,7 @@ func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsD
 			RosenpassEnabled:      &peer.Meta.Flags.RosenpassEnabled,
 			RosenpassPermissive:   &peer.Meta.Flags.RosenpassPermissive,
 			ServerSshAllowed:      &peer.Meta.Flags.ServerSSHAllowed,
+			RemoteJobsAllowed:     &peer.Meta.Flags.RemoteJobsAllowed,
 		},
 	}
 
@@ -631,6 +652,7 @@ func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dn
 		Name:                        peer.Name,
 		Ip:                          peer.IP.String(),
 		Ipv6:                        peerIPv6String(peer),
+		NetworkAddresses:            toNetworkAddresses(peer.Meta.NetworkAddresses),
 		ConnectionIp:                peer.Location.ConnectionIP.String(),
 		Connected:                   peer.Status.Connected,
 		LastSeen:                    peer.Status.LastSeen,
@@ -665,6 +687,7 @@ func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dn
 			RosenpassEnabled:      &peer.Meta.Flags.RosenpassEnabled,
 			RosenpassPermissive:   &peer.Meta.Flags.RosenpassPermissive,
 			ServerSshAllowed:      &peer.Meta.Flags.ServerSSHAllowed,
+			RemoteJobsAllowed:     &peer.Meta.Flags.RemoteJobsAllowed,
 		},
 	}
 }
diff --git a/management/server/http/handlers/peers/peers_handler_test.go b/management/server/http/handlers/peers/peers_handler_test.go
index 047213879..558a6d1bd 100644
--- a/management/server/http/handlers/peers/peers_handler_test.go
+++ b/management/server/http/handlers/peers/peers_handler_test.go
@@ -13,9 +13,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/gorilla/mux"
-	ugomock "go.uber.org/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"golang.org/x/exp/maps"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
@@ -106,7 +105,7 @@ func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
 		},
 	}
 
-	ctrl := ugomock.NewController(t)
+	ctrl := gomock.NewController(t)
 
 	networkMapController := network_map.NewMockController(ctrl)
 	networkMapController.EXPECT().
@@ -174,8 +173,8 @@ func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
 					return nil, fmt.Errorf("user not found")
 				}
 			},
-			GetPeersFunc: func(_ context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
-				return peers, nil
+			GetPeersFunc: func(_ context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, int, error) {
+				return peers, len(peers), nil
 			},
 			GetPeerGroupsFunc: func(ctx context.Context, accountID, peerID string) ([]*types.Group, error) {
 				peersID := make([]string, len(peers))
@@ -365,6 +364,50 @@ func TestGetPeers(t *testing.T) {
 	}
 }
 
+func TestPeerResponseNetworkAddresses(t *testing.T) {
+	tests := []struct {
+		name      string
+		addresses []nbpeer.NetworkAddress
+		wantJSON  string
+	}{
+		{name: "not reported"},
+		{name: "empty", addresses: []nbpeer.NetworkAddress{}},
+		{
+			name: "multiple interfaces",
+			addresses: []nbpeer.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.0.11/24"), Mac: "00:93:37:bd:83:0f"},
+				{NetIP: netip.MustParsePrefix("2001:db8::123/64"), Mac: "00:93:37:bd:83:10"},
+			},
+			wantJSON: `[{"net_ip":"192.168.0.11/24","mac":"00:93:37:bd:83:0f"},{"net_ip":"2001:db8::123/64","mac":"00:93:37:bd:83:10"}]`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peer := &nbpeer.Peer{
+				Status: &nbpeer.PeerStatus{},
+				Meta:   nbpeer.PeerSystemMeta{NetworkAddresses: tt.addresses},
+			}
+			responses := map[string]any{
+				"single peer": toSinglePeerResponse(peer, nil, "example.com", true, ""),
+				"peer list":   toPeerListItemResponse(peer, nil, "example.com", 0),
+			}
+			for name, response := range responses {
+				t.Run(name, func(t *testing.T) {
+					body, err := json.Marshal(response)
+					require.NoError(t, err)
+					var fields map[string]json.RawMessage
+					require.NoError(t, json.Unmarshal(body, &fields))
+					if tt.wantJSON == "" {
+						assert.NotContains(t, fields, "network_addresses", "unreported interfaces should be omitted")
+						return
+					}
+					assert.JSONEq(t, tt.wantJSON, string(fields["network_addresses"]), "response should preserve interface addresses and MACs")
+				})
+			}
+		})
+	}
+}
+
 func TestGetAccessiblePeers(t *testing.T) {
 	peer1 := &nbpeer.Peer{
 		ID:                     "peer1",
diff --git a/management/server/http/handlers/policies/geolocation_handler_test.go b/management/server/http/handlers/policies/geolocation_handler_test.go
index f5723b8fc..42b98734b 100644
--- a/management/server/http/handlers/policies/geolocation_handler_test.go
+++ b/management/server/http/handlers/policies/geolocation_handler_test.go
@@ -10,7 +10,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/gorilla/mux"
 	"github.com/stretchr/testify/assert"
 
diff --git a/management/server/http/handlers/proxy/auth.go b/management/server/http/handlers/proxy/auth.go
index 0120fad0e..133236401 100644
--- a/management/server/http/handlers/proxy/auth.go
+++ b/management/server/http/handlers/proxy/auth.go
@@ -2,6 +2,7 @@ package proxy
 
 import (
 	"context"
+	"errors"
 	"net"
 	"net/http"
 	"net/netip"
@@ -15,21 +16,21 @@ import (
 	"golang.org/x/oauth2"
 
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
-	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 // AuthCallbackHandler handles OAuth callbacks for proxy authentication.
 type AuthCallbackHandler struct {
 	proxyService   *nbgrpc.ProxyServiceServer
-	rateLimiter    *middleware.APIRateLimiter
+	rateLimiter    *ratelimit.APIRateLimiter
 	trustedProxies []netip.Prefix
 }
 
 // NewAuthCallbackHandler creates a new OAuth callback handler.
 func NewAuthCallbackHandler(proxyService *nbgrpc.ProxyServiceServer, trustedProxies []netip.Prefix) *AuthCallbackHandler {
-	rateLimiterConfig := &middleware.RateLimiterConfig{
+	rateLimiterConfig := &ratelimit.RateLimiterConfig{
 		RequestsPerMinute: 10,
 		Burst:             15,
 		CleanupInterval:   5 * time.Minute,
@@ -38,7 +39,7 @@ func NewAuthCallbackHandler(proxyService *nbgrpc.ProxyServiceServer, trustedProx
 
 	return &AuthCallbackHandler{
 		proxyService:   proxyService,
-		rateLimiter:    middleware.NewAPIRateLimiter(rateLimiterConfig),
+		rateLimiter:    ratelimit.NewAPIRateLimiter(rateLimiterConfig),
 		trustedProxies: trustedProxies,
 	}
 }
@@ -58,7 +59,7 @@ func (h *AuthCallbackHandler) handleCallback(w http.ResponseWriter, r *http.Requ
 
 	state := r.URL.Query().Get("state")
 
-	codeVerifier, originalURL, err := h.proxyService.ValidateState(state)
+	codeVerifier, originalURL, useSessionCode, err := h.proxyService.ValidateState(state)
 	if err != nil {
 		log.WithError(err).Error("OAuth callback state validation failed")
 		http.Error(w, "Invalid state parameter", http.StatusBadRequest)
@@ -99,16 +100,17 @@ func (h *AuthCallbackHandler) handleCallback(w http.ResponseWriter, r *http.Requ
 		return
 	}
 
-	// Group validation is performed by the proxy via ValidateSession gRPC call.
-	// This allows the proxy to show 403 pages directly without redirect dance.
-
+	// GenerateSessionToken applies the service's group and account-status gates,
+	// so a user without access never receives a token. The proxy re-checks the
+	// installed cookie against the service's allowed groups, and renders the
+	// denial page from the error carried back in the redirect.
 	sessionToken, err := h.proxyService.GenerateSessionToken(r.Context(), redirectURL.Hostname(), userID, auth.MethodOIDC)
 	if err != nil {
 		log.WithError(err).Error("Failed to create session token")
 		redirectURL.Scheme = "https"
 		query := redirectURL.Query()
 		query.Set("error", "access_denied")
-		query.Set("error_description", "Service configuration error")
+		query.Set("error_description", sessionTokenErrorDescription(err))
 		redirectURL.RawQuery = query.Encode()
 		http.Redirect(w, r, redirectURL.String(), http.StatusFound)
 		return
@@ -117,13 +119,39 @@ func (h *AuthCallbackHandler) handleCallback(w http.ResponseWriter, r *http.Requ
 	redirectURL.Scheme = "https"
 
 	query := redirectURL.Query()
-	query.Set("session_token", sessionToken)
+	if useSessionCode {
+		code, ok := h.proxyService.GenerateSessionCode(sessionToken)
+		if !ok {
+			http.Error(w, "Failed to create session", http.StatusInternalServerError)
+			return
+		}
+		query.Set(auth.SessionCodeQueryParam, code)
+	} else {
+		query.Set(auth.SessionTokenQueryParam, sessionToken)
+	}
 	redirectURL.RawQuery = query.Encode()
 
-	log.WithField("redirect", redirectURL.Host).Debug("OAuth callback: redirecting user with session token")
+	log.WithField("redirect", redirectURL.Host).Debug("OAuth callback: redirecting user to proxy")
 	http.Redirect(w, r, redirectURL.String(), http.StatusFound)
 }
 
+// sessionTokenErrorDescription maps a session token failure to the text the
+// proxy renders on its access denied page. Account status denials get a message
+// the user can act on, while everything else stays generic so a lookup or
+// signing failure does not describe management internals to the browser.
+func sessionTokenErrorDescription(err error) string {
+	if errors.Is(err, nbgrpc.ErrUserPendingApproval) {
+		return "Your account is pending approval by an administrator"
+	}
+	if errors.Is(err, nbgrpc.ErrUserBlocked) {
+		return "Your account is blocked"
+	}
+	if errors.Is(err, nbgrpc.ErrUserNotInGroup) {
+		return "You are not authorized to access this service"
+	}
+	return "Service configuration error"
+}
+
 func extractUserIDFromToken(ctx context.Context, provider *oidc.Provider, config nbgrpc.ProxyOIDCConfig, token *oauth2.Token) string {
 	rawIDToken, ok := token.Extra("id_token").(string)
 	if !ok {
diff --git a/management/server/http/handlers/proxy/auth_callback_integration_test.go b/management/server/http/handlers/proxy/auth_callback_integration_test.go
index a24857066..862d5d5f2 100644
--- a/management/server/http/handlers/proxy/auth_callback_integration_test.go
+++ b/management/server/http/handlers/proxy/auth_callback_integration_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	activitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	nbproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
@@ -180,6 +181,10 @@ func (m *testAccessLogManager) GetAllAccessLogs(_ context.Context, _, _ string,
 }
 
 func setupAuthCallbackTest(t *testing.T) *testSetup {
+	return setupAuthCallbackTestWithProxyManager(t, testSessionCodeManager{})
+}
+
+func setupAuthCallbackTestWithProxyManager(t *testing.T, proxyManager nbproxy.Manager) *testSetup {
 	t.Helper()
 
 	ctx := context.Background()
@@ -196,7 +201,7 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	require.NoError(t, err)
 
 	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, cacheStore)
 
 	usersManager := users.NewManager(testStore)
 
@@ -211,16 +216,17 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	proxyService := nbgrpc.NewProxyServiceServer(
 		&testAccessLogManager{},
 		tokenStore,
-		pkceStore,
+		singleUseStore,
 		oidcConfig,
 		nil,
 		usersManager,
 		nil,
-		nil,
+		proxyManager,
 		nil,
 	)
 
 	proxyService.SetServiceManager(&testServiceManager{store: testStore})
+	proxyService.SetActivityManager(activitymanager.NewManager(testStore))
 
 	handler := NewAuthCallbackHandler(proxyService, nil)
 
@@ -240,6 +246,15 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	}
 }
 
+type testSessionCodeManager struct {
+	nbproxy.Manager
+	supported bool
+}
+
+func (m testSessionCodeManager) ClusterSupportsSessionCode(_ context.Context, _ string) bool {
+	return m.supported
+}
+
 func createTestReverseProxies(t *testing.T, ctx context.Context, testStore store.Store) {
 	t.Helper()
 
@@ -250,10 +265,11 @@ func createTestReverseProxies(t *testing.T, ctx context.Context, testStore store
 	privKey := base64.StdEncoding.EncodeToString(priv)
 
 	testProxy := &service.Service{
-		ID:        "testProxyId",
-		AccountID: "testAccountId",
-		Name:      "Test Proxy",
-		Domain:    "test-proxy.example.com",
+		ID:           "testProxyId",
+		AccountID:    "testAccountId",
+		Name:         "Test Proxy",
+		Domain:       "test-proxy.example.com",
+		ProxyCluster: "cluster.example.com",
 		Targets: []*service.Target{{
 			Path:       strPtr("/"),
 			Host:       "localhost",
@@ -360,6 +376,51 @@ func createTestAccountsAndUsers(t *testing.T, ctx context.Context, testStore sto
 		Issued:     "api",
 	}
 	require.NoError(t, testStore.SaveUser(ctx, allowedUser))
+
+	// A second tenant, whose users must never be issued a token signed with
+	// the first tenant's service session key.
+	otherAccount := &types.Account{
+		Id:                     "otherAccountId",
+		Domain:                 "other.com",
+		DomainCategory:         "private",
+		IsDomainPrimaryAccount: true,
+		CreatedAt:              time.Now(),
+	}
+	require.NoError(t, testStore.SaveAccount(ctx, otherAccount))
+
+	otherAccountUser := &types.User{
+		Id:        "otherAccountUserId",
+		AccountID: "otherAccountId",
+		Role:      types.UserRoleUser,
+		CreatedAt: time.Now(),
+		Issued:    "api",
+	}
+	require.NoError(t, testStore.SaveUser(ctx, otherAccountUser))
+
+	// A user awaiting approval is stored as blocked and pending approval, and
+	// carries the same group membership as the approved one.
+	pendingUser := &types.User{
+		Id:              "pendingUserId",
+		AccountID:       "testAccountId",
+		Role:            types.UserRoleUser,
+		AutoGroups:      []string{"allowedGroupId"},
+		Blocked:         true,
+		PendingApproval: true,
+		CreatedAt:       time.Now(),
+		Issued:          "api",
+	}
+	require.NoError(t, testStore.SaveUser(ctx, pendingUser))
+
+	blockedUser := &types.User{
+		Id:         "blockedUserId",
+		AccountID:  "testAccountId",
+		Role:       types.UserRoleUser,
+		AutoGroups: []string{"allowedGroupId"},
+		Blocked:    true,
+		CreatedAt:  time.Now(),
+		Issued:     "api",
+	}
+	require.NoError(t, testStore.SaveUser(ctx, blockedUser))
 }
 
 // testServiceManager is a minimal implementation for testing.
@@ -465,29 +526,163 @@ func createTestState(t *testing.T, ps *nbgrpc.ProxyServiceServer, redirectURL st
 }
 
 func TestAuthCallback_UserAllowedToLogin(t *testing.T) {
+	tests := []struct {
+		name        string
+		manager     nbproxy.Manager
+		wantParam   string
+		absentParam string
+	}{
+		{name: "legacy proxy", manager: testSessionCodeManager{}, wantParam: "session_token", absentParam: "nb_session_code"},
+		{name: "compatible proxy", manager: testSessionCodeManager{supported: true}, wantParam: "nb_session_code", absentParam: "session_token"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setup := setupAuthCallbackTestWithProxyManager(t, tt.manager)
+			defer setup.cleanup()
+
+			setup.oidcServer.tokenSubject = "allowedUserId"
+			state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+			req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
+			rec := httptest.NewRecorder()
+			setup.router.ServeHTTP(rec, req)
+			require.Equal(t, http.StatusFound, rec.Code)
+
+			location, err := url.Parse(rec.Header().Get("Location"))
+			require.NoError(t, err)
+			require.Equal(t, "test-proxy.example.com", location.Host)
+			require.NotEmpty(t, location.Query().Get(tt.wantParam))
+			require.Empty(t, location.Query().Get(tt.absentParam))
+			require.Empty(t, location.Query().Get("error"))
+
+			if tt.wantParam == "nb_session_code" {
+				code := location.Query().Get("nb_session_code")
+				response, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+					Domain:      location.Hostname(),
+					SessionCode: code,
+				})
+				require.NoError(t, err)
+				require.True(t, response.GetValid())
+				require.NotEmpty(t, response.GetSessionToken())
+				require.NotEqual(t, code, response.GetSessionToken())
+
+				replayed, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+					Domain:      location.Hostname(),
+					SessionCode: code,
+				})
+				require.NoError(t, err)
+				require.False(t, replayed.GetValid())
+				require.Empty(t, replayed.GetSessionToken())
+			}
+		})
+	}
+}
+
+// TestAuthCallback_UserDeniedByAccountStatus asserts that a user whose account
+// is pending approval or blocked never receives a session token from the OIDC
+// callback, and that the redirect carries a description the proxy can render.
+// TestAuthCallback_RecordsUserLogin drives the real OIDC callback and asserts
+// the login lands on the user row. That timestamp is what activity accounting
+// reads, and it is the only signal that can ever count someone who reaches
+// proxy-protected services from a browser and never opens the dashboard.
+func TestAuthCallback_RecordsUserLogin(t *testing.T) {
 	setup := setupAuthCallbackTest(t)
 	defer setup.cleanup()
 
-	setup.oidcServer.tokenSubject = "allowedUserId"
+	ctx := context.Background()
 
+	before, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
+	require.NoError(t, err)
+	require.Nil(t, before.LastLogin, "fixture user starts with no login on record")
+
+	setup.oidcServer.tokenSubject = "allowedUserId"
 	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
 
 	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
 	rec := httptest.NewRecorder()
-
 	setup.router.ServeHTTP(rec, req)
-
 	require.Equal(t, http.StatusFound, rec.Code)
 
-	location := rec.Header().Get("Location")
-	require.NotEmpty(t, location)
-
-	parsedLocation, err := url.Parse(location)
+	after, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
 	require.NoError(t, err)
+	require.NotNil(t, after.LastLogin, "a completed proxy SSO login must be recorded on the user")
+	require.WithinDuration(t, time.Now().UTC(), after.LastLogin.UTC(), time.Minute, "login should be stamped at sign-in time")
+}
 
-	require.Equal(t, "test-proxy.example.com", parsedLocation.Host)
-	require.NotEmpty(t, parsedLocation.Query().Get("session_token"), "Should include session token")
-	require.Empty(t, parsedLocation.Query().Get("error"), "Should not have error parameter")
+// TestAuthCallback_DeniedUserLoginNotRecorded keeps the write on the granted
+// path: a refused sign-in is not a login.
+func TestAuthCallback_DeniedUserLoginNotRecorded(t *testing.T) {
+	setup := setupAuthCallbackTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+
+	setup.oidcServer.tokenSubject = "blockedUserId"
+	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+
+	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
+	rec := httptest.NewRecorder()
+	setup.router.ServeHTTP(rec, req)
+	require.Equal(t, http.StatusFound, rec.Code)
+
+	after, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "blockedUserId")
+	require.NoError(t, err)
+	require.Nil(t, after.LastLogin, "a denied user must not be recorded as having logged in")
+}
+
+func TestAuthCallback_UserDeniedByAccountStatus(t *testing.T) {
+	tests := []struct {
+		name            string
+		subject         string
+		expectErrorDesc string
+	}{
+		{
+			name:            "pending approval",
+			subject:         "pendingUserId",
+			expectErrorDesc: "Your account is pending approval by an administrator",
+		},
+		{
+			name:            "blocked",
+			subject:         "blockedUserId",
+			expectErrorDesc: "Your account is blocked",
+		},
+		{
+			name:            "unknown to management",
+			subject:         "userMissingFromStoreId",
+			expectErrorDesc: "Service configuration error",
+		},
+		{
+			// The account topology stays out of the browser-visible message.
+			name:            "belongs to another account",
+			subject:         "otherAccountUserId",
+			expectErrorDesc: "Service configuration error",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setup := setupAuthCallbackTest(t)
+			defer setup.cleanup()
+
+			setup.oidcServer.tokenSubject = tt.subject
+
+			state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+
+			req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
+			rec := httptest.NewRecorder()
+
+			setup.router.ServeHTTP(rec, req)
+
+			require.Equal(t, http.StatusFound, rec.Code)
+
+			parsedLocation, err := url.Parse(rec.Header().Get("Location"))
+			require.NoError(t, err)
+
+			require.Empty(t, parsedLocation.Query().Get("session_token"), "Denied user must not receive a session token")
+			require.Equal(t, "access_denied", parsedLocation.Query().Get("error"))
+			require.Equal(t, tt.expectErrorDesc, parsedLocation.Query().Get("error_description"))
+		})
+	}
 }
 
 func TestAuthCallback_ProxyNotFound(t *testing.T) {
diff --git a/management/server/http/handlers/setup_keys/setupkeys_handler.go b/management/server/http/handlers/setup_keys/setupkeys_handler.go
index d267b6eea..bb498f46b 100644
--- a/management/server/http/handlers/setup_keys/setupkeys_handler.go
+++ b/management/server/http/handlers/setup_keys/setupkeys_handler.go
@@ -64,6 +64,19 @@ func (h *handler) createSetupKey(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// A one-off key can be used once, and GenerateSetupKey pins its usage limit
+	// at 1 whatever the request says. Silently overriding a caller that asked
+	// for a different number leaves them holding a key that does not do what
+	// they configured, and no way to find out except by using it. Only values
+	// above 1 are refused: usage_limit is a required field with no null, so 0
+	// cannot be told apart from a caller that has nothing to say about it.
+	if types.SetupKeyType(req.Type) == types.SetupKeyOneOff && req.UsageLimit > 1 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument,
+			"usage_limit %d is not valid for a one-off setup key, which can be used once; use type reusable for a key that can be used more than once",
+			req.UsageLimit), w)
+		return
+	}
+
 	expiresIn := time.Duration(req.ExpiresIn) * time.Second
 
 	if expiresIn < 0 {
diff --git a/management/server/http/handlers/setup_keys/setupkeys_handler_test.go b/management/server/http/handlers/setup_keys/setupkeys_handler_test.go
index b137b6dd1..a9cfd4bd3 100644
--- a/management/server/http/handlers/setup_keys/setupkeys_handler_test.go
+++ b/management/server/http/handlers/setup_keys/setupkeys_handler_test.go
@@ -134,6 +134,40 @@ func TestSetupKeysHandlers(t *testing.T) {
 			expectedBody:     true,
 			expectedSetupKey: expectedNewKey,
 		},
+		{
+			// A one-off key is used once. Asking for more used to be accepted
+			// and then quietly reduced to 1.
+			name:        "Create One-Off Setup Key With Conflicting Usage Limit",
+			requestType: http.MethodPost,
+			requestPath: "/api/setup-keys",
+			requestBody: bytes.NewBuffer(
+				[]byte(fmt.Sprintf("{\"name\":\"%s\",\"type\":\"one-off\",\"expires_in\":86400,\"usage_limit\":5}", newSetupKeyName))),
+			expectedStatus: http.StatusUnprocessableEntity,
+			expectedBody:   false,
+		},
+		{
+			// 0 is what a caller sends when it has nothing to say about the
+			// usage limit, since the field is required and has no null, so it
+			// has to keep working.
+			name:        "Create One-Off Setup Key Without Usage Limit",
+			requestType: http.MethodPost,
+			requestPath: "/api/setup-keys",
+			requestBody: bytes.NewBuffer(
+				[]byte(fmt.Sprintf("{\"name\":\"%s\",\"type\":\"one-off\",\"expires_in\":86400,\"usage_limit\":0}", newSetupKeyName))),
+			expectedStatus: http.StatusOK,
+			expectedBody:   false,
+		},
+		{
+			// Only one-off keys are constrained; a reusable key means what it
+			// says.
+			name:        "Create Reusable Setup Key With Usage Limit",
+			requestType: http.MethodPost,
+			requestPath: "/api/setup-keys",
+			requestBody: bytes.NewBuffer(
+				[]byte(fmt.Sprintf("{\"name\":\"%s\",\"type\":\"reusable\",\"expires_in\":86400,\"usage_limit\":5}", newSetupKeyName))),
+			expectedStatus: http.StatusOK,
+			expectedBody:   false,
+		},
 		{
 			name:        "Update Setup Key",
 			requestType: http.MethodPut,
diff --git a/management/server/http/handlers/users/invites_handler.go b/management/server/http/handlers/users/invites_handler.go
index 0f0f57c29..d96e58bde 100644
--- a/management/server/http/handlers/users/invites_handler.go
+++ b/management/server/http/handlers/users/invites_handler.go
@@ -11,15 +11,15 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/account"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/http/util"
 	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 // publicInviteRateLimiter limits public invite requests by IP address to prevent brute-force attacks
-var publicInviteRateLimiter = middleware.NewAPIRateLimiter(&middleware.RateLimiterConfig{
+var publicInviteRateLimiter = ratelimit.NewAPIRateLimiter(&ratelimit.RateLimiterConfig{
 	RequestsPerMinute: 10, // 10 attempts per minute per IP
 	Burst:             5,  // Allow burst of 5 requests
 	CleanupInterval:   10 * time.Minute,
diff --git a/management/server/http/middleware/auth_middleware.go b/management/server/http/middleware/auth_middleware.go
index ba8c66241..7c21b6a55 100644
--- a/management/server/http/middleware/auth_middleware.go
+++ b/management/server/http/middleware/auth_middleware.go
@@ -18,6 +18,7 @@ import (
 	"github.com/netbirdio/netbird/shared/auth"
 	"github.com/netbirdio/netbird/shared/management/http/util"
 	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 type EnsureAccountFunc func(ctx context.Context, userAuth auth.UserAuth) (string, string, error)
@@ -25,17 +26,14 @@ type SyncUserJWTGroupsFunc func(ctx context.Context, userAuth auth.UserAuth) err
 
 type GetUserFromUserAuthFunc func(ctx context.Context, userAuth auth.UserAuth) (*types.User, error)
 
-type IsValidChildAccountFunc func(ctx context.Context, userID, accountID, childAccountID string) bool
-
 // AuthMiddleware middleware to verify personal access tokens (PAT) and JWT tokens
 type AuthMiddleware struct {
 	authManager         serverauth.Manager
 	ensureAccount       EnsureAccountFunc
 	getUserFromUserAuth GetUserFromUserAuthFunc
 	syncUserJWTGroups   SyncUserJWTGroupsFunc
-	rateLimiter         *APIRateLimiter
+	rateLimiter         *ratelimit.APIRateLimiter
 	patUsageTracker     *PATUsageTracker
-	isValidChildAccount IsValidChildAccountFunc
 }
 
 // NewAuthMiddleware instance constructor
@@ -44,9 +42,8 @@ func NewAuthMiddleware(
 	ensureAccount EnsureAccountFunc,
 	syncUserJWTGroups SyncUserJWTGroupsFunc,
 	getUserFromUserAuth GetUserFromUserAuthFunc,
-	rateLimiter *APIRateLimiter,
+	rateLimiter *ratelimit.APIRateLimiter,
 	meter metric.Meter,
-	isValidChildAccount IsValidChildAccountFunc,
 ) *AuthMiddleware {
 	var patUsageTracker *PATUsageTracker
 	if meter != nil {
@@ -64,7 +61,6 @@ func NewAuthMiddleware(
 		getUserFromUserAuth: getUserFromUserAuth,
 		rateLimiter:         rateLimiter,
 		patUsageTracker:     patUsageTracker,
-		isValidChildAccount: isValidChildAccount,
 	}
 }
 
@@ -126,13 +122,6 @@ func (m *AuthMiddleware) checkJWTFromRequest(r *http.Request, authHeaderParts []
 		return err
 	}
 
-	if impersonate, ok := r.URL.Query()["account"]; ok && len(impersonate) == 1 {
-		if m.isValidChildAccount(ctx, userAuth.UserId, userAuth.AccountId, impersonate[0]) {
-			userAuth.AccountId = impersonate[0]
-			userAuth.IsChild = true
-		}
-	}
-
 	// Email is now extracted in ToUserAuth (from claims or userinfo endpoint)
 	// Available as userAuth.Email
 
@@ -209,13 +198,6 @@ func (m *AuthMiddleware) checkPATFromRequest(r *http.Request, authHeaderParts []
 		IsPAT:          true,
 	}
 
-	if impersonate, ok := r.URL.Query()["account"]; ok && len(impersonate) == 1 {
-		if m.isValidChildAccount(r.Context(), userAuth.UserId, userAuth.AccountId, impersonate[0]) {
-			userAuth.AccountId = impersonate[0]
-			userAuth.IsChild = true
-		}
-	}
-
 	// propagates ctx change to upstream middleware
 	*r = *nbcontext.SetUserAuthInRequest(r, userAuth)
 	return nil
diff --git a/management/server/http/middleware/auth_middleware_test.go b/management/server/http/middleware/auth_middleware_test.go
index a34554660..9e60af1fa 100644
--- a/management/server/http/middleware/auth_middleware_test.go
+++ b/management/server/http/middleware/auth_middleware_test.go
@@ -18,6 +18,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/util"
 	nbauth "github.com/netbirdio/netbird/shared/auth"
 	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 const (
@@ -103,7 +104,7 @@ func mockMarkPATUsed(_ context.Context, token string) error {
 }
 
 func mockEnsureUserAccessByJWTGroups(_ context.Context, userAuth nbauth.UserAuth, token *jwt.Token) (nbauth.UserAuth, error) {
-	if userAuth.IsChild || userAuth.IsPAT {
+	if userAuth.IsPAT {
 		return userAuth, nil
 	}
 
@@ -196,7 +197,7 @@ func TestAuthMiddleware_Handler(t *testing.T) {
 		GetPATInfoFunc:                  mockGetAccountInfoFromPAT,
 	}
 
-	disabledLimiter := NewAPIRateLimiter(nil)
+	disabledLimiter := ratelimit.NewAPIRateLimiter(nil)
 	disabledLimiter.SetEnabled(false)
 	authMiddleware := NewAuthMiddleware(
 		mockAuth,
@@ -211,7 +212,6 @@ func TestAuthMiddleware_Handler(t *testing.T) {
 		},
 		disabledLimiter,
 		nil,
-		func(_ context.Context, _, _, _ string) bool { return false },
 	)
 
 	handlerToTest := authMiddleware.Handler(nextHandler)
@@ -260,7 +260,7 @@ func TestAuthMiddleware_SyncUserJWTGroupsDetachedFromRequestCancellation(t *test
 		GetPATInfoFunc:                  mockGetAccountInfoFromPAT,
 	}
 
-	disabledLimiter := NewAPIRateLimiter(nil)
+	disabledLimiter := ratelimit.NewAPIRateLimiter(nil)
 	disabledLimiter.SetEnabled(false)
 
 	authMiddleware := NewAuthMiddleware(
@@ -278,7 +278,6 @@ func TestAuthMiddleware_SyncUserJWTGroupsDetachedFromRequestCancellation(t *test
 		},
 		disabledLimiter,
 		nil,
-		func(_ context.Context, _, _, _ string) bool { return false },
 	)
 
 	handlerToTest := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
@@ -311,7 +310,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 
 	t.Run("PAT Token Rate Limiting - Burst Works", func(t *testing.T) {
 		// Configure rate limiter: 10 requests per minute with burst of 5
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 10,
 			Burst:             5,
 			CleanupInterval:   5 * time.Minute,
@@ -329,9 +328,8 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -364,7 +362,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 
 	t.Run("PAT Token Rate Limiting - Rate Limit Enforced", func(t *testing.T) {
 		// Configure very low rate limit: 1 request per minute
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 1,
 			Burst:             1,
 			CleanupInterval:   5 * time.Minute,
@@ -382,9 +380,8 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -408,7 +405,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 
 	t.Run("Bearer Token Not Rate Limited", func(t *testing.T) {
 		// Configure strict rate limit
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 1,
 			Burst:             1,
 			CleanupInterval:   5 * time.Minute,
@@ -426,9 +423,8 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -453,7 +449,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 
 	t.Run("PAT Token Rate Limiting Per Token", func(t *testing.T) {
 		// Configure rate limiter
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 1,
 			Burst:             1,
 			CleanupInterval:   5 * time.Minute,
@@ -471,9 +467,8 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -518,7 +513,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 
 	t.Run("Rate Limiter Cleanup", func(t *testing.T) {
 		// Configure rate limiter with short cleanup interval and TTL for testing
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 60,
 			Burst:             1,
 			CleanupInterval:   100 * time.Millisecond,
@@ -536,9 +531,8 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -578,7 +572,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 	})
 
 	t.Run("Terraform User Agent Not Rate Limited", func(t *testing.T) {
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 1,
 			Burst:             1,
 			CleanupInterval:   5 * time.Minute,
@@ -596,9 +590,8 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -634,7 +627,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 	})
 
 	t.Run("Non-Terraform User Agent With PAT Is Rate Limited", func(t *testing.T) {
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 1,
 			Burst:             1,
 			CleanupInterval:   5 * time.Minute,
@@ -652,9 +645,8 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -740,7 +732,7 @@ func TestAuthMiddleware_Handler_Child(t *testing.T) {
 		GetPATInfoFunc:                  mockGetAccountInfoFromPAT,
 	}
 
-	disabledLimiter := NewAPIRateLimiter(nil)
+	disabledLimiter := ratelimit.NewAPIRateLimiter(nil)
 	disabledLimiter.SetEnabled(false)
 	authMiddleware := NewAuthMiddleware(
 		mockAuth,
@@ -755,7 +747,6 @@ func TestAuthMiddleware_Handler_Child(t *testing.T) {
 		},
 		disabledLimiter,
 		nil,
-		func(_ context.Context, _, _, _ string) bool { return false },
 	)
 
 	for _, tc := range tt {
diff --git a/management/server/http/middleware/middleware_factory.go b/management/server/http/middleware/middleware_factory.go
new file mode 100644
index 000000000..5346301ea
--- /dev/null
+++ b/management/server/http/middleware/middleware_factory.go
@@ -0,0 +1,34 @@
+package middleware
+
+import (
+	"github.com/gorilla/mux"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/auth"
+	"github.com/netbirdio/netbird/management/server/telemetry"
+	"github.com/netbirdio/netbird/shared/ratelimit"
+	"github.com/rs/cors"
+	log "github.com/sirupsen/logrus"
+)
+
+func BuildMiddleware(rateLimiter *ratelimit.APIRateLimiter, authManager auth.Manager, accountManager account.Manager, metrics telemetry.AppMetrics) []mux.MiddlewareFunc {
+	toret := make([]mux.MiddlewareFunc, 0)
+
+	toret = append(toret, metrics.HTTPMiddleware().Handler)
+	toret = append(toret, cors.AllowAll().Handler)
+
+	if rateLimiter == nil {
+		log.Warn("NewAPIHandler: nil rate limiter, rate limiting disabled")
+		rateLimiter = ratelimit.NewAPIRateLimiter(nil)
+		rateLimiter.SetEnabled(false)
+	}
+	toret = append(toret, NewAuthMiddleware(
+		authManager,
+		accountManager.GetAccountIDFromUserAuth,
+		accountManager.SyncUserJWTGroups,
+		accountManager.GetUserFromUserAuth,
+		rateLimiter,
+		metrics.GetMeter(),
+	).Handler)
+
+	return toret
+}
diff --git a/management/server/http/testing/integration/events_handler_integration_test.go b/management/server/http/testing/integration/events_handler_integration_test.go
index 6611b60ee..a051aabcd 100644
--- a/management/server/http/testing/integration/events_handler_integration_test.go
+++ b/management/server/http/testing/integration/events_handler_integration_test.go
@@ -3,6 +3,7 @@
 package integration
 
 import (
+	"context"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -10,6 +11,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools/channel"
@@ -34,7 +36,7 @@ func Test_Events_GetAll(t *testing.T) {
 
 	for _, user := range users {
 		t.Run(user.name+" - Get all events", func(t *testing.T) {
-			apiHandler, _, _ := channel.BuildApiBlackBoxWithDBState(t, "../testdata/events.sql", nil, false)
+			apiHandler, accountManager, _ := channel.BuildApiBlackBoxWithDBState(t, "../testdata/events.sql", nil, false)
 
 			// First, perform a mutation to generate an event (create a group as admin)
 			groupBody, err := json.Marshal(&api.GroupRequest{Name: "eventTestGroup"})
@@ -44,7 +46,14 @@ func Test_Events_GetAll(t *testing.T) {
 			createReq := testing_tools.BuildRequest(t, groupBody, http.MethodPost, "/api/groups", testing_tools.TestAdminId)
 			createRecorder := httptest.NewRecorder()
 			apiHandler.ServeHTTP(createRecorder, createReq)
-			assert.Equal(t, http.StatusOK, createRecorder.Code, "Failed to create group to generate event")
+			require.Equal(t, http.StatusOK, createRecorder.Code, "Failed to create group to generate event")
+
+			// Group creation returns before its asynchronous audit write finishes.
+			require.EventuallyWithT(t, func(c *assert.CollectT) {
+				events, err := accountManager.GetEvents(context.Background(), testing_tools.TestAccountId, testing_tools.TestAdminId)
+				assert.NoError(c, err)
+				assert.NotEmpty(c, events, "wait for the group creation event before checking permissions")
+			}, time.Second, 10*time.Millisecond)
 
 			// Now query events
 			req := testing_tools.BuildRequest(t, []byte{}, http.MethodGet, "/api/events", user.userId)
diff --git a/management/server/http/testing/integration/setupkeys_handler_integration_test.go b/management/server/http/testing/integration/setupkeys_handler_integration_test.go
index 0d3aaac82..21ad9d347 100644
--- a/management/server/http/testing/integration/setupkeys_handler_integration_test.go
+++ b/management/server/http/testing/integration/setupkeys_handler_integration_test.go
@@ -136,7 +136,10 @@ func Test_SetupKeys_Create(t *testing.T) {
 			},
 		},
 		{
-			name:        "Create Setup Key as on-off with more than one usage",
+			// The key used to be created anyway, with its usage limit quietly
+			// reduced to 1, so the caller was told a key they had not asked for
+			// was what they asked for.
+			name:        "Create Setup Key as one-off with more than one usage",
 			requestType: http.MethodPost,
 			requestPath: "/api/setup-keys",
 			requestBody: &api.CreateSetupKeyRequest{
@@ -146,23 +149,7 @@ func Test_SetupKeys_Create(t *testing.T) {
 				Type:       "one-off",
 				UsageLimit: 3,
 			},
-			expectedStatus: http.StatusOK,
-			expectedResponse: &api.SetupKey{
-				AutoGroups: []string{},
-				Ephemeral:  false,
-				Expires:    time.Time{},
-				Id:         "",
-				Key:        "",
-				LastUsed:   time.Time{},
-				Name:       testing_tools.NewKeyName,
-				Revoked:    false,
-				State:      "valid",
-				Type:       "one-off",
-				UpdatedAt:  time.Now(),
-				UsageLimit: 1,
-				UsedTimes:  0,
-				Valid:      true,
-			},
+			expectedStatus: http.StatusUnprocessableEntity,
 		},
 		{
 			name:        "Create Setup Key with expiration in the past",
diff --git a/management/server/http/testing/testing_tools/channel/channel.go b/management/server/http/testing/testing_tools/channel/channel.go
index 8b05b2ddf..88ab70b9c 100644
--- a/management/server/http/testing/testing_tools/channel/channel.go
+++ b/management/server/http/testing/testing_tools/channel/channel.go
@@ -29,7 +29,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 
 	"github.com/netbirdio/netbird/management/server"
@@ -40,32 +39,41 @@ import (
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/groups"
 	http2 "github.com/netbirdio/netbird/management/server/http"
+	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
-	"github.com/netbirdio/netbird/management/server/store"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/users"
 	"github.com/netbirdio/netbird/shared/auth"
 )
 
 func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPeerUpdate *network_map.UpdateMessage, validateUpdate bool) (http.Handler, account.Manager, chan struct{}) {
-	store, cleanup, err := store.NewTestStoreFromSQL(context.Background(), sqlFile, t.TempDir())
+	store, cleanup, err := nbstore.NewTestStoreFromSQL(context.Background(), sqlFile, t.TempDir())
 	if err != nil {
 		t.Fatalf("Failed to create test store: %v", err)
 	}
 	t.Cleanup(cleanup)
 
-	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
+	// Bound the background loops these managers start (account request buffer,
+	// telemetry P95 flushers, PAT usage tracker, API rate limiter, proxy service
+	// cleanup, cache janitors, DB connection pools) to the test's lifetime. On
+	// context.Background() they never stop and accumulate across the package,
+	// exhausting DB connections until the suite hits the 20m test timeout.
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	metrics, err := telemetry.NewDefaultAppMetrics(ctx)
 	if err != nil {
 		t.Fatalf("Failed to create metrics: %v", err)
 	}
 
 	peersUpdateManager := update_channel.NewPeersUpdateManager(nil)
-	updMsg := peersUpdateManager.CreateChannel(context.Background(), testing_tools.TestPeerId)
+	updMsg := peersUpdateManager.CreateChannel(ctx, testing_tools.TestPeerId)
 	done := make(chan struct{})
 	if validateUpdate {
 		go func() {
@@ -80,7 +88,6 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 
 	geoMock := &geolocation.Mock{}
 	validatorMock := server.MockIntegratedValidator{}
-	proxyController := integrations.NewController(store)
 	userManager := users.NewManager(store)
 	permissionsManager := permissions.NewManager(store)
 	settingsManager := settings.NewManager(store, userManager, integrations.NewManager(&activity.InMemoryEventStore{}), permissionsManager, settings.IdpConfig{})
@@ -88,29 +95,31 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 
 	jobManager := job.NewJobManager(nil, store, peersManager)
 
-	ctx := context.Background()
-
 	cacheStore, err := nbcache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
 	if err != nil {
 		t.Fatalf("Failed to create cache store: %v", err)
 	}
 
 	requestBuffer := server.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{})
-	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
+	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, settingsManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		t.Fatalf("Failed to create manager: %v", err)
 	}
 
-	accessLogsManager := accesslogsmanager.NewManager(store, permissionsManager, nil)
+	accessLogsManager := accesslogsmanager.NewManager(accesslogsmanager.NewRepository(store.(*nbstore.SqlStore).Conn()), store, permissionsManager, nil)
 	proxyTokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceverifierStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, cacheStore)
 	noopMeter := noop.NewMeterProvider().Meter("")
 	proxyMgr, err := proxymanager.NewManager(store, noopMeter)
 	if err != nil {
 		t.Fatalf("Failed to create proxy manager: %v", err)
 	}
-	proxyServiceServer := nbgrpc.NewProxyServiceServer(accessLogsManager, proxyTokenStore, pkceverifierStore, nbgrpc.ProxyOIDCConfig{}, peersManager, userManager, nil, proxyMgr, nil)
+	proxyServiceServer := nbgrpc.NewProxyServiceServer(accessLogsManager, proxyTokenStore, singleUseStore, nbgrpc.ProxyOIDCConfig{}, peersManager, userManager, nil, proxyMgr, nil)
+	// NewProxyServiceServer starts cleanupStaleProxies on a context it derives
+	// from context.Background(), independent of the cancellable ctx above;
+	// Close() cancels it so the goroutine does not outlive the test.
+	t.Cleanup(proxyServiceServer.Close)
 	domainManager := manager.NewManager(store, proxyMgr, permissionsManager, am)
 	serviceProxyController, err := proxymanager.NewGRPCController(proxyServiceServer, noopMeter)
 	if err != nil {
@@ -137,7 +146,10 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 	zoneRecordsManager := recordsManager.NewManager(store, am, permissionsManager)
 
 	apiRouter := mux.NewRouter().PathPrefix("/api").Subrouter()
-	apiHandler, err := http2.NewAPIHandler(context.Background(), apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager, geoMock, authManagerMock, metrics, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager, networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil, nil)
+	apiRouter.Use(middleware.BuildMiddleware(nil, authManagerMock, am, metrics)...)
+	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager,
+		groupsManager, geoMock, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager,
+		networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil)
 	if err != nil {
 		t.Fatalf("Failed to create API handler: %v", err)
 	}
@@ -194,23 +206,30 @@ func PeerShouldNotReceiveAnyUpdate(t testing_tools.TB, updateMessage <-chan *net
 // BuildApiBlackBoxWithDBStateAndPeerChannel creates the API handler and returns
 // the peer update channel directly so tests can verify updates inline.
 func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile string) (http.Handler, account.Manager, <-chan *network_map.UpdateMessage) {
-	store, cleanup, err := store.NewTestStoreFromSQL(context.Background(), sqlFile, t.TempDir())
+	store, cleanup, err := nbstore.NewTestStoreFromSQL(context.Background(), sqlFile, t.TempDir())
 	if err != nil {
 		t.Fatalf("Failed to create test store: %v", err)
 	}
 	t.Cleanup(cleanup)
 
-	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
+	// Bound the background loops these managers start (account request buffer,
+	// telemetry P95 flushers, PAT usage tracker, API rate limiter, proxy service
+	// cleanup, cache janitors, DB connection pools) to the test's lifetime. On
+	// context.Background() they never stop and accumulate across the package,
+	// exhausting DB connections until the suite hits the 20m test timeout.
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	metrics, err := telemetry.NewDefaultAppMetrics(ctx)
 	if err != nil {
 		t.Fatalf("Failed to create metrics: %v", err)
 	}
 
 	peersUpdateManager := update_channel.NewPeersUpdateManager(nil)
-	updMsg := peersUpdateManager.CreateChannel(context.Background(), testing_tools.TestPeerId)
+	updMsg := peersUpdateManager.CreateChannel(ctx, testing_tools.TestPeerId)
 
 	geoMock := &geolocation.Mock{}
 	validatorMock := server.MockIntegratedValidator{}
-	proxyController := integrations.NewController(store)
 	userManager := users.NewManager(store)
 	permissionsManager := permissions.NewManager(store)
 	settingsManager := settings.NewManager(store, userManager, integrations.NewManager(&activity.InMemoryEventStore{}), permissionsManager, settings.IdpConfig{})
@@ -218,29 +237,31 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 
 	jobManager := job.NewJobManager(nil, store, peersManager)
 
-	ctx := context.Background()
-
 	cacheStore, err := nbcache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
 	if err != nil {
 		t.Fatalf("Failed to create cache store: %v", err)
 	}
 
 	requestBuffer := server.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{})
-	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
+	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, settingsManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		t.Fatalf("Failed to create manager: %v", err)
 	}
 
-	accessLogsManager := accesslogsmanager.NewManager(store, permissionsManager, nil)
+	accessLogsManager := accesslogsmanager.NewManager(accesslogsmanager.NewRepository(store.(*nbstore.SqlStore).Conn()), store, permissionsManager, nil)
 	proxyTokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceverifierStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, cacheStore)
 	noopMeter := noop.NewMeterProvider().Meter("")
 	proxyMgr, err := proxymanager.NewManager(store, noopMeter)
 	if err != nil {
 		t.Fatalf("Failed to create proxy manager: %v", err)
 	}
-	proxyServiceServer := nbgrpc.NewProxyServiceServer(accessLogsManager, proxyTokenStore, pkceverifierStore, nbgrpc.ProxyOIDCConfig{}, peersManager, userManager, nil, proxyMgr, nil)
+	proxyServiceServer := nbgrpc.NewProxyServiceServer(accessLogsManager, proxyTokenStore, singleUseStore, nbgrpc.ProxyOIDCConfig{}, peersManager, userManager, nil, proxyMgr, nil)
+	// NewProxyServiceServer starts cleanupStaleProxies on a context it derives
+	// from context.Background(), independent of the cancellable ctx above;
+	// Close() cancels it so the goroutine does not outlive the test.
+	t.Cleanup(proxyServiceServer.Close)
 	domainManager := manager.NewManager(store, proxyMgr, permissionsManager, am)
 	serviceProxyController, err := proxymanager.NewGRPCController(proxyServiceServer, noopMeter)
 	if err != nil {
@@ -267,7 +288,10 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 	zoneRecordsManager := recordsManager.NewManager(store, am, permissionsManager)
 
 	apiRouter := mux.NewRouter().PathPrefix("/api").Subrouter()
-	apiHandler, err := http2.NewAPIHandler(context.Background(), apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager, geoMock, authManagerMock, metrics, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager, networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil, nil)
+	apiRouter.Use(middleware.BuildMiddleware(nil, authManagerMock, am, metrics)...)
+	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager,
+		geoMock, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager,
+		networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil)
 	if err != nil {
 		t.Fatalf("Failed to create API handler: %v", err)
 	}
diff --git a/management/server/identity_provider.go b/management/server/identity_provider.go
index 86bbcd893..764d8598b 100644
--- a/management/server/identity_provider.go
+++ b/management/server/identity_provider.go
@@ -23,6 +23,9 @@ import (
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
+// maxDiscoveryDocumentSize caps the discovery document read at 1 MiB. Providers serve a few kilobytes.
+const maxDiscoveryDocumentSize = 1 << 20
+
 // oidcProviderJSON represents the OpenID Connect discovery document
 type oidcProviderJSON struct {
 	Issuer string `json:"issuer"`
@@ -35,6 +38,10 @@ func validateOIDCIssuer(ctx context.Context, issuer string) error {
 
 	httpClient := &http.Client{
 		Timeout: 10 * time.Second,
+		// An issuer that redirects its own discovery document is misconfigured.
+		CheckRedirect: func(*http.Request, []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
 	}
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, wellKnown, nil)
@@ -48,22 +55,22 @@ func validateOIDCIssuer(ctx context.Context, issuer string) error {
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return fmt.Errorf("%w: unable to read response body: %v", types.ErrIdentityProviderIssuerUnreachable, err)
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("%w: %s", types.ErrIdentityProviderIssuerUnreachable, resp.Status)
 	}
 
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("%w: %s: %s", types.ErrIdentityProviderIssuerUnreachable, resp.Status, body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxDiscoveryDocumentSize+1))
+	if err != nil || len(body) > maxDiscoveryDocumentSize {
+		return fmt.Errorf("%w: failed to decode provider discovery object", types.ErrIdentityProviderIssuerUnreachable)
 	}
 
 	var p oidcProviderJSON
 	if err := json.Unmarshal(body, &p); err != nil {
-		return fmt.Errorf("%w: failed to decode provider discovery object: %v", types.ErrIdentityProviderIssuerUnreachable, err)
+		return fmt.Errorf("%w: failed to decode provider discovery object", types.ErrIdentityProviderIssuerUnreachable)
 	}
 
 	if p.Issuer != issuer {
-		return fmt.Errorf("%w: expected %q got %q", types.ErrIdentityProviderIssuerMismatch, issuer, p.Issuer)
+		return fmt.Errorf("%w: %q", types.ErrIdentityProviderIssuerMismatch, issuer)
 	}
 
 	return nil
@@ -151,15 +158,15 @@ func (am *DefaultAccountManager) CreateIdentityProvider(ctx context.Context, acc
 		return nil, status.NewPermissionDeniedError()
 	}
 
-	if err := validateIdentityProviderConfig(ctx, idpConfig); err != nil {
-		return nil, err
-	}
-
 	embeddedManager, ok := am.idpManager.(*idp.EmbeddedIdPManager)
 	if !ok {
 		return nil, status.Errorf(status.Internal, "identity provider management requires embedded IdP")
 	}
 
+	if err := validateIdentityProviderConfig(ctx, idpConfig); err != nil {
+		return nil, err
+	}
+
 	// Generate ID if not provided
 	if idpConfig.ID == "" {
 		idpConfig.ID = generateIdentityProviderID(idpConfig.Type)
@@ -188,15 +195,15 @@ func (am *DefaultAccountManager) UpdateIdentityProvider(ctx context.Context, acc
 		return nil, status.NewPermissionDeniedError()
 	}
 
-	if err := validateIdentityProviderConfig(ctx, idpConfig); err != nil {
-		return nil, err
-	}
-
 	embeddedManager, ok := am.idpManager.(*idp.EmbeddedIdPManager)
 	if !ok {
 		return nil, status.Errorf(status.Internal, "identity provider management requires embedded IdP")
 	}
 
+	if err := validateIdentityProviderConfig(ctx, idpConfig); err != nil {
+		return nil, err
+	}
+
 	idpConfig.ID = idpID
 	idpConfig.AccountID = accountID
 
diff --git a/management/server/identity_provider_test.go b/management/server/identity_provider_test.go
index d51254c55..bb576a71f 100644
--- a/management/server/identity_provider_test.go
+++ b/management/server/identity_provider_test.go
@@ -7,12 +7,13 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
@@ -22,7 +23,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -34,6 +34,20 @@ import (
 
 func createManagerWithEmbeddedIdP(t testing.TB) (*DefaultAccountManager, *update_channel.PeersUpdateManager, error) {
 	t.Helper()
+	return createManagerWithEmbeddedIdPMode(t, "netbird.selfhosted")
+}
+
+func createManagerWithEmbeddedIdPMode(t testing.TB, singleAccountModeDomain string) (*DefaultAccountManager, *update_channel.PeersUpdateManager, error) {
+	t.Helper()
+	return createManagerWithEmbeddedIdPModeAndSetup(t, singleAccountModeDomain, nil)
+}
+
+func createManagerWithEmbeddedIdPModeAndSetup(
+	t testing.TB,
+	singleAccountModeDomain string,
+	setupStore func(context.Context, store.Store) error,
+) (*DefaultAccountManager, *update_channel.PeersUpdateManager, error) {
+	t.Helper()
 
 	ctx := context.Background()
 
@@ -43,6 +57,11 @@ func createManagerWithEmbeddedIdP(t testing.TB) (*DefaultAccountManager, *update
 		return nil, nil, err
 	}
 	t.Cleanup(cleanUp)
+	if setupStore != nil {
+		if err := setupStore(ctx, testStore); err != nil {
+			return nil, nil, err
+		}
+	}
 
 	// Create embedded IdP manager
 	embeddedConfig := &idp.EmbeddedIdPConfig{
@@ -92,8 +111,8 @@ func createManagerWithEmbeddedIdP(t testing.TB) (*DefaultAccountManager, *update
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, testStore)
-	networkMapController := controller.NewController(ctx, testStore, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(testStore, peersManager), &config.Config{})
-	manager, err := BuildManager(ctx, &config.Config{}, testStore, networkMapController, job.NewJobManager(nil, testStore, peersManager), idpManager, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, testStore, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(testStore, peersManager), &config.Config{}, nil)
+	manager, err := BuildManager(ctx, &config.Config{}, testStore, networkMapController, job.NewJobManager(nil, testStore, peersManager), idpManager, singleAccountModeDomain, eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -102,7 +121,7 @@ func createManagerWithEmbeddedIdP(t testing.TB) (*DefaultAccountManager, *update
 }
 
 func TestDefaultAccountManager_CreateIdentityProvider_Validation(t *testing.T) {
-	manager, _, err := createManager(t)
+	manager, _, err := createManagerWithEmbeddedIdP(t)
 	require.NoError(t, err)
 
 	userID := "testingUser"
@@ -196,8 +215,25 @@ func TestDefaultAccountManager_GetIdentityProvider_NotFound(t *testing.T) {
 	assert.Contains(t, err.Error(), "not found")
 }
 
+func TestUpdateUserAuthWithSingleModeKeepsConfiguredDomain(t *testing.T) {
+	ctx := context.Background()
+	manager, _, err := createManagerWithEmbeddedIdPModeAndSetup(t, "netbird.selfhosted", func(ctx context.Context, testStore store.Store) error {
+		// An account with no domain, as left behind by an IdP that emitted no domain claims.
+		return testStore.SaveAccount(ctx, newAccountWithId(ctx, "account-1", "user-1", "", "", "", false))
+	})
+	require.NoError(t, err)
+	require.True(t, manager.singleAccountMode)
+
+	userAuth := auth.UserAuth{UserId: "user-2"}
+	require.NoError(t, manager.updateUserAuthWithSingleMode(ctx, &userAuth))
+
+	assert.Equal(t, "netbird.selfhosted", userAuth.Domain,
+		"An empty account domain must not clear the configured single account domain")
+	assert.Equal(t, types.PrivateCategory, userAuth.DomainCategory)
+}
+
 func TestDefaultAccountManager_UpdateIdentityProvider_Validation(t *testing.T) {
-	manager, _, err := createManager(t)
+	manager, _, err := createManagerWithEmbeddedIdP(t)
 	require.NoError(t, err)
 
 	userID := "testingUser"
@@ -319,3 +355,45 @@ func TestValidateOIDCIssuer_TrailingSlash(t *testing.T) {
 	require.Error(t, err)
 	assert.True(t, errors.Is(err, types.ErrIdentityProviderIssuerMismatch))
 }
+
+func TestValidateOIDCIssuer_DoesNotFollowRedirects(t *testing.T) {
+	var reached bool
+	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusForbidden)
+	}))
+	t.Cleanup(target.Close)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, target.URL+"/redirect-target", http.StatusFound)
+	}))
+	t.Cleanup(srv.Close)
+
+	err := validateOIDCIssuer(context.Background(), srv.URL)
+	require.Error(t, err)
+	assert.False(t, reached, "Redirects are not followed")
+}
+
+func TestValidateOIDCIssuer_BoundsResponseSize(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"issuer":"` + strings.Repeat("a", maxDiscoveryDocumentSize) + `"}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	err := validateOIDCIssuer(context.Background(), srv.URL)
+	require.ErrorIs(t, err, types.ErrIdentityProviderIssuerUnreachable)
+	assert.NotErrorIs(t, err, types.ErrIdentityProviderIssuerMismatch)
+}
+
+func TestValidateOIDCIssuer_RejectsTrailingContent(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"issuer":"http://` + r.Host + `"} {"issuer":"second"}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	err := validateOIDCIssuer(context.Background(), srv.URL)
+	require.ErrorIs(t, err, types.ErrIdentityProviderIssuerUnreachable,
+		"Content after the first object is not a valid discovery document")
+}
diff --git a/management/server/idp/auth0.go b/management/server/idp/auth0.go
index 7d3837190..4d6ef5859 100644
--- a/management/server/idp/auth0.go
+++ b/management/server/idp/auth0.go
@@ -132,13 +132,7 @@ type ConnectionOptions struct {
 
 // NewAuth0Manager creates a new instance of the Auth0Manager
 func NewAuth0Manager(config Auth0ClientConfig, appMetrics telemetry.AppMetrics) (*Auth0Manager, error) {
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   idpTimeout(),
-		Transport: httpTransport,
-	}
+	httpClient := newHTTPClient()
 
 	helper := JsonParser{}
 
diff --git a/management/server/idp/authentik.go b/management/server/idp/authentik.go
index ebd79b715..9ab884bc7 100644
--- a/management/server/idp/authentik.go
+++ b/management/server/idp/authentik.go
@@ -49,13 +49,7 @@ type AuthentikCredentials struct {
 
 // NewAuthentikManager creates a new instance of the AuthentikManager.
 func NewAuthentikManager(config AuthentikClientConfig, appMetrics telemetry.AppMetrics) (*AuthentikManager, error) {
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   idpTimeout(),
-		Transport: httpTransport,
-	}
+	httpClient := newHTTPClient()
 
 	helper := JsonParser{}
 
diff --git a/management/server/idp/azure.go b/management/server/idp/azure.go
index 320ca7a83..6640ef6d0 100644
--- a/management/server/idp/azure.go
+++ b/management/server/idp/azure.go
@@ -54,13 +54,7 @@ type azureProfile map[string]any
 
 // NewAzureManager creates a new instance of the AzureManager.
 func NewAzureManager(config AzureClientConfig, appMetrics telemetry.AppMetrics) (*AzureManager, error) {
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   idpTimeout(),
-		Transport: httpTransport,
-	}
+	httpClient := newHTTPClient()
 
 	helper := JsonParser{}
 
diff --git a/management/server/idp/dex.go b/management/server/idp/dex.go
index 0cac246e1..7d25c6ed0 100644
--- a/management/server/idp/dex.go
+++ b/management/server/idp/dex.go
@@ -4,10 +4,8 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
-	"net/http"
 	"strings"
 	"sync"
-	"time"
 
 	"github.com/dexidp/dex/api/v2"
 	log "github.com/sirupsen/logrus"
@@ -44,13 +42,7 @@ func NewDexManager(config DexClientConfig, appMetrics telemetry.AppMetrics) (*De
 		return nil, fmt.Errorf("dex IdP configuration is incomplete, GRPCAddr is missing")
 	}
 
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   10 * time.Second,
-		Transport: httpTransport,
-	}
+	httpClient := newHTTPClient()
 	helper := JsonParser{}
 
 	return &DexManager{
diff --git a/management/server/idp/embedded.go b/management/server/idp/embedded.go
index 821e6ff55..b045d6ad6 100644
--- a/management/server/idp/embedded.go
+++ b/management/server/idp/embedded.go
@@ -21,8 +21,11 @@ import (
 )
 
 const (
-	staticClientDashboard         = "netbird-dashboard"
-	staticClientCLI               = "netbird-cli"
+	StaticClientDashboard      = "netbird-dashboard"
+	StaticClientCLI            = "netbird-cli"
+	DefaultTOTPAuthenticatorID = "default-totp"
+	LocalConnectorID           = dex.LocalConnectorID
+
 	defaultCLIRedirectURL1        = "http://localhost:53000/"
 	defaultCLIRedirectURL2        = "http://localhost:54000/"
 	defaultScopes                 = "openid profile email groups"
@@ -76,6 +79,9 @@ type EmbeddedIdPConfig struct {
 	DashboardPostLogoutRedirectURIs []string
 	// StaticConnectors are additional connectors to seed during initialization
 	StaticConnectors []dex.Connector
+	// GrantTypes restricts allowed OAuth2 grants; empty means all (Dex default). Omit the
+	// device_code grant to disable the device flow; keep authorization_code and refresh_token.
+	GrantTypes []string
 }
 
 // EmbeddedStorageConfig holds storage configuration for the embedded IdP.
@@ -175,6 +181,7 @@ func (c *EmbeddedIdPConfig) ToYAMLConfig() (*dex.YAMLConfig, error) {
 		},
 		OAuth2: dex.OAuth2{
 			SkipApprovalScreen: true,
+			GrantTypes:         c.GrantTypes,
 		},
 		Frontend: dex.Frontend{
 			Issuer: "NetBird",
@@ -185,14 +192,14 @@ func (c *EmbeddedIdPConfig) ToYAMLConfig() (*dex.YAMLConfig, error) {
 		EnablePasswordDB: true,
 		StaticClients: []storage.Client{
 			{
-				ID:                     staticClientDashboard,
+				ID:                     StaticClientDashboard,
 				Name:                   "NetBird Dashboard",
 				Public:                 true,
 				RedirectURIs:           redirectURIs,
 				PostLogoutRedirectURIs: sanitizePostLogoutRedirectURIs(dashboardPostLogoutRedirectURIs),
 			},
 			{
-				ID:           staticClientCLI,
+				ID:           StaticClientCLI,
 				Name:         "NetBird CLI",
 				Public:       true,
 				RedirectURIs: redirectURIs,
@@ -254,13 +261,13 @@ func sanitizePostLogoutRedirectURIs(uris []string) []string {
 
 func configureMFA(cfg *dex.YAMLConfig, sessionMaxLifetime, sessionIdleTimeout string, rememberMe bool, sessionCookieEncryptionKey string) error {
 	cfg.MFA.Authenticators = []dex.MFAAuthenticator{{
-		ID: "default-totp",
+		ID: DefaultTOTPAuthenticatorID,
 		// Has to be caps otherwise it will fail
 		Type: "TOTP",
 		Config: map[string]interface{}{
 			"issuer": "NetBird",
 		},
-		ConnectorTypes: []string{"local"},
+		ConnectorTypes: []string{LocalConnectorID},
 	}}
 
 	if sessionMaxLifetime == "" {
@@ -736,7 +743,7 @@ func (m *EmbeddedIdPManager) GetDefaultScopes() string {
 
 // GetCLIClientID returns the client ID for CLI authentication.
 func (m *EmbeddedIdPManager) GetCLIClientID() string {
-	return staticClientCLI
+	return StaticClientCLI
 }
 
 // GetCLIRedirectURLs returns the redirect URLs configured for the CLI client.
@@ -775,7 +782,7 @@ func (m *EmbeddedIdPManager) GetLocalKeysLocation() string {
 
 // GetClientIDs returns the OAuth2 client IDs configured for this provider.
 func (m *EmbeddedIdPManager) GetClientIDs() []string {
-	return []string{staticClientDashboard, staticClientCLI}
+	return []string{StaticClientDashboard, StaticClientCLI}
 }
 
 // GetUserIDClaim returns the JWT claim name used for user identification.
@@ -792,11 +799,11 @@ func (m *EmbeddedIdPManager) IsLocalAuthDisabled() bool {
 func (m *EmbeddedIdPManager) SetMFAEnabled(ctx context.Context, enabled bool) error {
 	var mfaChain []string
 	if enabled {
-		mfaChain = []string{"default-totp"}
+		mfaChain = []string{DefaultTOTPAuthenticatorID}
 	}
 	if err := m.provider.SetClientsMFAChain(ctx, []string{
-		staticClientCLI,
-		staticClientDashboard,
+		StaticClientCLI,
+		StaticClientDashboard,
 	}, mfaChain); err != nil {
 		return fmt.Errorf("failed to set MFA enabled=%v: %w", enabled, err)
 	}
diff --git a/management/server/idp/embedded_test.go b/management/server/idp/embedded_test.go
index 91cd27aee..cf3fcf7ff 100644
--- a/management/server/idp/embedded_test.go
+++ b/management/server/idp/embedded_test.go
@@ -331,7 +331,7 @@ func TestEmbeddedIdPConfig_ToYAMLConfig_IncludesDeviceCallbackRedirectURI(t *tes
 
 	var cliRedirectURIs []string
 	for _, client := range yamlConfig.StaticClients {
-		if client.ID == staticClientCLI {
+		if client.ID == StaticClientCLI {
 			cliRedirectURIs = client.RedirectURIs
 			break
 		}
diff --git a/management/server/idp/google_workspace.go b/management/server/idp/google_workspace.go
index dadbfd83e..ff58e7772 100644
--- a/management/server/idp/google_workspace.go
+++ b/management/server/idp/google_workspace.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
-	"net/http"
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/oauth2/google"
@@ -44,13 +43,7 @@ func (gc *GoogleWorkspaceCredentials) Authenticate(_ context.Context) (JWTToken,
 
 // NewGoogleWorkspaceManager creates a new instance of the GoogleWorkspaceManager.
 func NewGoogleWorkspaceManager(ctx context.Context, config GoogleWorkspaceClientConfig, appMetrics telemetry.AppMetrics) (*GoogleWorkspaceManager, error) {
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   idpTimeout(),
-		Transport: httpTransport,
-	}
+	httpClient := newHTTPClient()
 
 	helper := JsonParser{}
 
diff --git a/management/server/idp/jumpcloud.go b/management/server/idp/jumpcloud.go
index f0dec3a9b..ac547e4a1 100644
--- a/management/server/idp/jumpcloud.go
+++ b/management/server/idp/jumpcloud.go
@@ -58,13 +58,7 @@ type JumpCloudCredentials struct {
 
 // NewJumpCloudManager creates a new instance of the JumpCloudManager.
 func NewJumpCloudManager(config JumpCloudClientConfig, appMetrics telemetry.AppMetrics) (*JumpCloudManager, error) {
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   idpTimeout(),
-		Transport: httpTransport,
-	}
+	httpClient := newHTTPClient()
 
 	helper := JsonParser{}
 
diff --git a/management/server/idp/keycloak.go b/management/server/idp/keycloak.go
index 1cf26394f..9c01fcee2 100644
--- a/management/server/idp/keycloak.go
+++ b/management/server/idp/keycloak.go
@@ -59,13 +59,7 @@ type keycloakProfile struct {
 
 // NewKeycloakManager creates a new instance of the KeycloakManager.
 func NewKeycloakManager(config KeycloakClientConfig, appMetrics telemetry.AppMetrics) (*KeycloakManager, error) {
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   idpTimeout(),
-		Transport: httpTransport,
-	}
+	httpClient := newHTTPClient()
 
 	helper := JsonParser{}
 
diff --git a/management/server/idp/migration/migration.go b/management/server/idp/migration/migration.go
index 01cadb86d..bec0de84c 100644
--- a/management/server/idp/migration/migration.go
+++ b/management/server/idp/migration/migration.go
@@ -10,6 +10,8 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"regexp"
+	"strings"
 
 	log "github.com/sirupsen/logrus"
 
@@ -25,8 +27,10 @@ type Server interface {
 	EventStore() EventStore // may return nil
 }
 
-const idpSeedInfoKey = "IDP_SEED_INFO"
-const dryRunEnvKey = "NB_IDP_MIGRATION_DRY_RUN"
+const (
+	idpSeedInfoKey = "IDP_SEED_INFO"
+	dryRunEnvKey   = "NB_IDP_MIGRATION_DRY_RUN"
+)
 
 func isDryRun() bool {
 	return os.Getenv(dryRunEnvKey) == "true"
@@ -233,3 +237,163 @@ func PopulateUserInfo(s Server, idpManager idp.Manager, dryRun bool) error {
 
 	return nil
 }
+
+const DefaultSingleAccountDomain = "netbird.selfhosted"
+
+var (
+	ErrMultipleAccounts = errors.New("the embedded IdP supports a single account only")
+	ErrUnusableDomain   = errors.New("domain cannot be resolved in single account mode")
+	ErrDomainConflict   = errors.New("requested domain conflicts with the account domain")
+)
+
+var resolvableDomainRegexp = regexp.MustCompile(`^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$`)
+
+// RequireSingleAccount refuses to migrate an instance that holds more than one account.
+func RequireSingleAccount(s Server) error {
+	accountsCounter, err := s.Store().GetAccountsCounter(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to count accounts: %w", err)
+	}
+
+	if accountsCounter > 1 {
+		return errMultipleAccounts(accountsCounter)
+	}
+
+	return nil
+}
+
+func errMultipleAccounts(accountsCounter int64) error {
+	return fmt.Errorf("%w: this instance has %d accounts. Identity provider connectors are stored without "+
+		"an account scope, so every account would share and be able to manage the same connectors. "+
+		"Consolidate this instance to a single account, or keep using an external IdP, before migrating",
+		ErrMultipleAccounts, accountsCounter)
+}
+
+func NormalizeSingleAccountDomain(singleAccountDomain string) (string, error) {
+	if singleAccountDomain == "" {
+		singleAccountDomain = DefaultSingleAccountDomain
+	}
+
+	singleAccountDomain = strings.ToLower(singleAccountDomain)
+	if !resolvableDomainRegexp.MatchString(singleAccountDomain) {
+		return "", fmt.Errorf("%w: %q must contain at least one dot and only lowercase letters, digits and "+
+			"hyphens, otherwise users cannot join the existing account", ErrUnusableDomain, singleAccountDomain)
+	}
+
+	return singleAccountDomain, nil
+}
+
+// resolveAccountDomain picks the domain the account should end up with. The account keeps a usable
+// domain of its own, the configured one only fills a blank. Anything else is a conflict to report.
+func resolveAccountDomain(accountID, accountDomain, singleAccountDomain string, requested bool) (string, error) {
+	accountDomain = strings.ToLower(accountDomain)
+
+	if accountDomain == "" {
+		return singleAccountDomain, nil
+	}
+
+	if !resolvableDomainRegexp.MatchString(accountDomain) {
+		return "", fmt.Errorf("%w: account %s has domain %q, which must contain at least one dot and only "+
+			"lowercase letters, digits and hyphens. Correct the account domain before migrating",
+			ErrUnusableDomain, accountID, accountDomain)
+	}
+
+	if requested && accountDomain != singleAccountDomain {
+		return "", fmt.Errorf("%w: account %s already uses domain %q but %q was requested. Re-run without "+
+			"--single-account-mode-domain to keep %q, or correct the account domain first",
+			ErrDomainConflict, accountID, accountDomain, singleAccountDomain, accountDomain)
+	}
+
+	return accountDomain, nil
+}
+
+// EnsureSingleAccountDomain gives the remaining account the domain attributes single account mode
+// resolves against, so users can still join it after the migration.
+func EnsureSingleAccountDomain(s Server, singleAccountDomain string) error {
+	plan, err := planSingleAccountDomain(s, singleAccountDomain)
+	if err != nil {
+		return err
+	}
+	if plan.skip {
+		return nil
+	}
+
+	if isDryRun() {
+		log.Infof("[DRY RUN] would set account %s domain to %q, category to %q and mark it as the primary domain account "+
+			"(currently domain=%q primary=%v)", plan.accountID, plan.domain, types.PrivateCategory,
+			plan.currentDomain, plan.isPrimary)
+		return nil
+	}
+
+	if err := s.Store().UpdateAccountDomainAttributes(context.Background(), plan.accountID, plan.domain,
+		types.PrivateCategory, true); err != nil {
+		return fmt.Errorf("failed to update domain attributes of account %s: %w", plan.accountID, err)
+	}
+
+	log.Infof("account %s now resolves in single account mode with domain %q", plan.accountID, plan.domain)
+	return nil
+}
+
+// CheckSingleAccountDomain reports whether EnsureSingleAccountDomain would succeed, without writing.
+func CheckSingleAccountDomain(s Server, singleAccountDomain string) error {
+	_, err := planSingleAccountDomain(s, singleAccountDomain)
+	return err
+}
+
+type singleAccountDomainPlan struct {
+	accountID     string
+	domain        string
+	currentDomain string
+	isPrimary     bool
+	skip          bool
+}
+
+// planSingleAccountDomain decides what the account's domain attributes should become. It reads
+// only, so it can run both as a preflight and as the first half of the update.
+func planSingleAccountDomain(s Server, singleAccountDomain string) (singleAccountDomainPlan, error) {
+	ctx := context.Background()
+
+	// An empty value means the operator did not pick a domain, so the default is only a fallback.
+	requested := singleAccountDomain != ""
+
+	singleAccountDomain, err := NormalizeSingleAccountDomain(singleAccountDomain)
+	if err != nil {
+		return singleAccountDomainPlan{}, err
+	}
+
+	accountsCounter, err := s.Store().GetAccountsCounter(ctx)
+	if err != nil {
+		return singleAccountDomainPlan{}, fmt.Errorf("failed to count accounts: %w", err)
+	}
+	// The count is checked again here: it is read long after RequireSingleAccount, and marking an
+	// arbitrary account as the primary one for the domain would be wrong.
+	switch {
+	case accountsCounter == 0:
+		log.Info("no accounts yet, nothing to prepare for single account mode")
+		return singleAccountDomainPlan{skip: true}, nil
+	case accountsCounter > 1:
+		return singleAccountDomainPlan{}, errMultipleAccounts(accountsCounter)
+	}
+
+	accountID, err := s.Store().GetAnyAccountID(ctx)
+	if err != nil {
+		return singleAccountDomainPlan{}, fmt.Errorf("failed to get the existing account: %w", err)
+	}
+
+	isPrimary, accountDomain, err := s.Store().IsPrimaryAccount(ctx, accountID)
+	if err != nil {
+		return singleAccountDomainPlan{}, fmt.Errorf("failed to read domain attributes of account %s: %w", accountID, err)
+	}
+
+	domain, err := resolveAccountDomain(accountID, accountDomain, singleAccountDomain, requested)
+	if err != nil {
+		return singleAccountDomainPlan{}, err
+	}
+
+	return singleAccountDomainPlan{
+		accountID:     accountID,
+		domain:        domain,
+		currentDomain: accountDomain,
+		isPrimary:     isPrimary,
+	}, nil
+}
diff --git a/management/server/idp/migration/migration_test.go b/management/server/idp/migration/migration_test.go
index 2ff71347e..f6a436015 100644
--- a/management/server/idp/migration/migration_test.go
+++ b/management/server/idp/migration/migration_test.go
@@ -24,6 +24,17 @@ type testStore struct {
 	checkSchemaFunc    func(checks []SchemaCheck) []SchemaError
 	updateCalls        []updateUserIDCall
 	updateInfoCalls    []updateUserInfoCall
+
+	accountsCounter int64
+	accounts        map[string]*types.Account
+	domainAttrCalls []domainAttrCall
+}
+
+type domainAttrCall struct {
+	AccountID string
+	Domain    string
+	Category  string
+	IsPrimary bool
 }
 
 type updateUserIDCall struct {
@@ -38,6 +49,35 @@ type updateUserInfoCall struct {
 	Name   string
 }
 
+func (s *testStore) GetAccountsCounter(context.Context) (int64, error) {
+	return s.accountsCounter, nil
+}
+
+func (s *testStore) GetAnyAccountID(context.Context) (string, error) {
+	for id := range s.accounts {
+		return id, nil
+	}
+	return "", fmt.Errorf("no accounts")
+}
+
+func (s *testStore) IsPrimaryAccount(_ context.Context, accountID string) (bool, string, error) {
+	account, ok := s.accounts[accountID]
+	if !ok {
+		return false, "", fmt.Errorf("account %s not found", accountID)
+	}
+	return account.IsDomainPrimaryAccount, account.Domain, nil
+}
+
+func (s *testStore) UpdateAccountDomainAttributes(_ context.Context, accountID, domain, category string, isPrimaryDomain bool) error {
+	s.domainAttrCalls = append(s.domainAttrCalls, domainAttrCall{accountID, domain, category, isPrimaryDomain})
+	if account, ok := s.accounts[accountID]; ok {
+		account.Domain = domain
+		account.DomainCategory = category
+		account.IsDomainPrimaryAccount = isPrimaryDomain
+	}
+	return nil
+}
+
 func (s *testStore) ListUsers(ctx context.Context) ([]*types.User, error) {
 	return s.listUsersFunc(ctx)
 }
@@ -826,3 +866,212 @@ func TestCheckSchema_MockStore(t *testing.T) {
 		assert.Equal(t, "email", errs[0].Column)
 	})
 }
+
+func TestRequireSingleAccount(t *testing.T) {
+	tests := []struct {
+		name      string
+		accounts  int64
+		expectErr bool
+	}{
+		{name: "fresh install", accounts: 0},
+		{name: "single account", accounts: 1},
+		{name: "multiple accounts", accounts: 3, expectErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			srv := &testServer{store: &testStore{accountsCounter: tt.accounts}}
+
+			err := RequireSingleAccount(srv)
+			if !tt.expectErr {
+				require.NoError(t, err)
+				return
+			}
+
+			require.Error(t, err)
+			assert.ErrorIs(t, err, ErrMultipleAccounts)
+		})
+	}
+}
+
+func TestEnsureSingleAccountDomain(t *testing.T) {
+	tests := []struct {
+		name            string
+		account         *types.Account
+		requestedDomain string
+		expectedDomain  string
+	}{
+		{
+			name:           "account migrated from an IdP without domain claims",
+			account:        &types.Account{Id: "account-1"},
+			expectedDomain: DefaultSingleAccountDomain,
+		},
+		{
+			name:            "requested domain is applied to an account without one",
+			account:         &types.Account{Id: "account-1"},
+			requestedDomain: "corp.example.com",
+			expectedDomain:  "corp.example.com",
+		},
+		{
+			name:           "account keeps its own domain",
+			account:        &types.Account{Id: "account-1", Domain: "acme.com"},
+			expectedDomain: "acme.com",
+		},
+		{
+			name:            "requesting the domain the account already has is not a conflict",
+			account:         &types.Account{Id: "account-1", Domain: "acme.com"},
+			requestedDomain: "acme.com",
+			expectedDomain:  "acme.com",
+		},
+		{
+			name: "already resolvable account is rewritten with the same values",
+			account: &types.Account{
+				Id:                     "account-1",
+				Domain:                 "acme.com",
+				DomainCategory:         types.PrivateCategory,
+				IsDomainPrimaryAccount: true,
+			},
+			expectedDomain: "acme.com",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := &testStore{
+				accountsCounter: 1,
+				accounts:        map[string]*types.Account{tt.account.Id: tt.account},
+			}
+
+			require.NoError(t, EnsureSingleAccountDomain(&testServer{store: store}, tt.requestedDomain))
+
+			require.Len(t, store.domainAttrCalls, 1)
+			assert.Equal(t, domainAttrCall{
+				AccountID: tt.account.Id,
+				Domain:    tt.expectedDomain,
+				Category:  types.PrivateCategory,
+				IsPrimary: true,
+			}, store.domainAttrCalls[0])
+		})
+	}
+}
+
+func TestEnsureSingleAccountDomainDryRun(t *testing.T) {
+	t.Setenv(dryRunEnvKey, "true")
+
+	store := &testStore{
+		accountsCounter: 1,
+		accounts:        map[string]*types.Account{"account-1": {Id: "account-1"}},
+	}
+
+	require.NoError(t, EnsureSingleAccountDomain(&testServer{store: store}, ""))
+	assert.Empty(t, store.domainAttrCalls, "Dry run must not write anything")
+}
+
+func TestEnsureSingleAccountDomainRejectsUnresolvableDomains(t *testing.T) {
+	t.Run("account domain that cannot resolve is reported", func(t *testing.T) {
+		account := &types.Account{Id: "account-1", Domain: "corp"}
+		store := &testStore{
+			accountsCounter: 1,
+			accounts:        map[string]*types.Account{account.Id: account},
+		}
+
+		err := EnsureSingleAccountDomain(&testServer{store: store}, "")
+		require.Error(t, err)
+		assert.ErrorIs(t, err, ErrUnusableDomain)
+		assert.Empty(t, store.domainAttrCalls, "A broken account domain must not be replaced silently")
+	})
+
+	t.Run("requested domain conflicting with the account domain is reported", func(t *testing.T) {
+		account := &types.Account{Id: "account-1", Domain: "acme.com"}
+		store := &testStore{
+			accountsCounter: 1,
+			accounts:        map[string]*types.Account{account.Id: account},
+		}
+
+		err := EnsureSingleAccountDomain(&testServer{store: store}, "corp.example.com")
+		require.Error(t, err)
+		assert.ErrorIs(t, err, ErrDomainConflict)
+		assert.Empty(t, store.domainAttrCalls, "A conflict must not overwrite the account domain")
+	})
+
+	t.Run("configured domain that cannot resolve is rejected", func(t *testing.T) {
+		store := &testStore{
+			accountsCounter: 1,
+			accounts:        map[string]*types.Account{"account-1": {Id: "account-1"}},
+		}
+
+		err := EnsureSingleAccountDomain(&testServer{store: store}, "corp")
+		require.Error(t, err)
+		assert.ErrorIs(t, err, ErrUnusableDomain)
+		assert.Empty(t, store.domainAttrCalls)
+	})
+
+	t.Run("account appearing after the preflight is rejected", func(t *testing.T) {
+		store := &testStore{
+			accountsCounter: 2,
+			accounts: map[string]*types.Account{
+				"account-1": {Id: "account-1"},
+				"account-2": {Id: "account-2"},
+			},
+		}
+
+		err := EnsureSingleAccountDomain(&testServer{store: store}, "")
+		require.Error(t, err)
+		assert.ErrorIs(t, err, ErrMultipleAccounts)
+		assert.Empty(t, store.domainAttrCalls, "No account may be marked primary when several exist")
+	})
+
+	t.Run("fresh install with no accounts is a no-op", func(t *testing.T) {
+		store := &testStore{accountsCounter: 0, accounts: map[string]*types.Account{}}
+
+		require.NoError(t, EnsureSingleAccountDomain(&testServer{store: store}, ""))
+		assert.Empty(t, store.domainAttrCalls)
+	})
+}
+
+func TestCheckSingleAccountDomain(t *testing.T) {
+	tests := []struct {
+		name      string
+		account   *types.Account
+		requested string
+		expectErr error
+	}{
+		{
+			name:    "usable account domain passes",
+			account: &types.Account{Id: "account-1", Domain: "acme.com"},
+		},
+		{
+			name:    "empty account domain passes",
+			account: &types.Account{Id: "account-1"},
+		},
+		{
+			name:      "unresolvable account domain fails",
+			account:   &types.Account{Id: "account-1", Domain: "corp"},
+			expectErr: ErrUnusableDomain,
+		},
+		{
+			name:      "conflicting request fails",
+			account:   &types.Account{Id: "account-1", Domain: "acme.com"},
+			requested: "corp.example.com",
+			expectErr: ErrDomainConflict,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := &testStore{
+				accountsCounter: 1,
+				accounts:        map[string]*types.Account{tt.account.Id: tt.account},
+			}
+
+			err := CheckSingleAccountDomain(&testServer{store: store}, tt.requested)
+			if tt.expectErr == nil {
+				require.NoError(t, err)
+			} else {
+				require.ErrorIs(t, err, tt.expectErr)
+			}
+
+			assert.Empty(t, store.domainAttrCalls, "The preflight must not write anything")
+		})
+	}
+}
diff --git a/management/server/idp/migration/store.go b/management/server/idp/migration/store.go
index e7cc54a41..868597a1d 100644
--- a/management/server/idp/migration/store.go
+++ b/management/server/idp/migration/store.go
@@ -60,6 +60,20 @@ type Store interface {
 	// CheckSchema verifies that all tables and columns required by the migration
 	// exist in the database. Returns a list of problems; an empty slice means OK.
 	CheckSchema(checks []SchemaCheck) []SchemaError
+
+	// GetAccountsCounter returns the total number of accounts in the store.
+	GetAccountsCounter(ctx context.Context) (int64, error)
+
+	// GetAnyAccountID returns the ID of one of the existing accounts.
+	GetAnyAccountID(ctx context.Context) (string, error)
+
+	// IsPrimaryAccount returns whether the account is the primary account for its domain,
+	// along with that domain.
+	IsPrimaryAccount(ctx context.Context, accountID string) (bool, string, error)
+
+	// UpdateAccountDomainAttributes sets the domain, domain category and primary
+	// domain flag of an account.
+	UpdateAccountDomainAttributes(ctx context.Context, accountID string, domain string, category string, isPrimaryDomain bool) error
 }
 
 // RequiredEventSchema lists all tables and columns that the migration tool needs
diff --git a/management/server/idp/okta.go b/management/server/idp/okta.go
index 07f0d8008..90bcd05a9 100644
--- a/management/server/idp/okta.go
+++ b/management/server/idp/okta.go
@@ -40,13 +40,7 @@ type OktaCredentials struct {
 
 // NewOktaManager creates a new instance of the OktaManager.
 func NewOktaManager(config OktaClientConfig, appMetrics telemetry.AppMetrics) (*OktaManager, error) {
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   idpTimeout(),
-		Transport: httpTransport,
-	}
+	httpClient := newHTTPClient()
 
 	helper := JsonParser{}
 	config.Issuer = baseURL(config.Issuer)
diff --git a/management/server/idp/pocketid.go b/management/server/idp/pocketid.go
index fc338b86b..b340bfe5f 100644
--- a/management/server/idp/pocketid.go
+++ b/management/server/idp/pocketid.go
@@ -83,13 +83,7 @@ type pocketIdUserGroupDto struct {
 }
 
 func NewPocketIdManager(config PocketIdClientConfig, appMetrics telemetry.AppMetrics) (*PocketIdManager, error) {
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   idpTimeout(),
-		Transport: httpTransport,
-	}
+	httpClient := newHTTPClient()
 
 	helper := JsonParser{}
 
diff --git a/management/server/idp/util.go b/management/server/idp/util.go
index ed82fb9e3..be59edba7 100644
--- a/management/server/idp/util.go
+++ b/management/server/idp/util.go
@@ -2,11 +2,14 @@ package idp
 
 import (
 	"encoding/json"
-	"math/rand"
+	"errors"
+	"net/http"
 	"net/url"
 	"os"
 	"strings"
 	"time"
+
+	"github.com/netbirdio/netbird/management/server/util"
 )
 
 var (
@@ -33,31 +36,32 @@ func GeneratePassword(passwordLength, minSpecialChar, minNum, minUpperCase int)
 
 	//Set special character
 	for i := 0; i < minSpecialChar; i++ {
-		random := rand.Intn(len(specialCharSet))
+		random := util.RandIntn(len(specialCharSet))
 		password.WriteString(string(specialCharSet[random]))
 	}
 
 	//Set numeric
 	for i := 0; i < minNum; i++ {
-		random := rand.Intn(len(numberSet))
+		random := util.RandIntn(len(numberSet))
 		password.WriteString(string(numberSet[random]))
 	}
 
 	//Set uppercase
 	for i := 0; i < minUpperCase; i++ {
-		random := rand.Intn(len(upperCharSet))
+		random := util.RandIntn(len(upperCharSet))
 		password.WriteString(string(upperCharSet[random]))
 	}
 
 	remainingLength := passwordLength - minSpecialChar - minNum - minUpperCase
 	for i := 0; i < remainingLength; i++ {
-		random := rand.Intn(len(allCharSet))
+		random := util.RandIntn(len(allCharSet))
 		password.WriteString(string(allCharSet[random]))
 	}
 	inRune := []rune(password.String())
-	rand.Shuffle(len(inRune), func(i, j int) {
+	for i := len(inRune) - 1; i > 0; i-- {
+		j := util.RandIntn(i + 1)
 		inRune[i], inRune[j] = inRune[j], inRune[i]
-	})
+	}
 	return string(inRune)
 }
 
@@ -79,6 +83,23 @@ const (
 	defaultTimeout = 10 * time.Second
 )
 
+// errRedirectRefused is returned instead of http.ErrUseLastResponse so the
+// client closes the redirect response rather than handing it back unread.
+var errRedirectRefused = errors.New("redirect refused")
+
+func newHTTPClient() *http.Client {
+	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
+	httpTransport.MaxIdleConns = 5
+
+	return &http.Client{
+		Timeout:   idpTimeout(),
+		Transport: httpTransport,
+		CheckRedirect: func(*http.Request, []*http.Request) error {
+			return errRedirectRefused
+		},
+	}
+}
+
 // idpTimeout returns a timeout value for the IDP
 func idpTimeout() time.Duration {
 	timeoutStr, ok := os.LookupEnv(idpTimeoutEnv)
diff --git a/management/server/idp/zitadel.go b/management/server/idp/zitadel.go
index 320f0c131..fdc59915d 100644
--- a/management/server/idp/zitadel.go
+++ b/management/server/idp/zitadel.go
@@ -160,13 +160,7 @@ func verifyJWTConfig(config ZitadelClientConfig) error {
 
 // NewZitadelManager creates a new instance of the ZitadelManager.
 func NewZitadelManager(config ZitadelClientConfig, appMetrics telemetry.AppMetrics) (*ZitadelManager, error) {
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   idpTimeout(),
-		Transport: httpTransport,
-	}
+	httpClient := newHTTPClient()
 
 	helper := JsonParser{}
 
diff --git a/management/server/instance/setup_service_test.go b/management/server/instance/setup_service_test.go
index 12ec7d0fa..af3a91b75 100644
--- a/management/server/instance/setup_service_test.go
+++ b/management/server/instance/setup_service_test.go
@@ -5,7 +5,7 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
diff --git a/management/server/integrated_validator.go b/management/server/integrated_validator.go
index 69ea668ad..5928a8ed2 100644
--- a/management/server/integrated_validator.go
+++ b/management/server/integrated_validator.go
@@ -11,6 +11,7 @@ import (
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 // UpdateIntegratedValidator updates the integrated validator groups for a specified account.
@@ -99,7 +100,7 @@ func (am *DefaultAccountManager) GetValidatedPeers(ctx context.Context, accountI
 		return nil, nil, err
 	}
 
-	peers, err = am.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = am.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	if err != nil {
 		return nil, nil, err
 	}
@@ -109,7 +110,7 @@ func (am *DefaultAccountManager) GetValidatedPeers(ctx context.Context, accountI
 		return nil, nil, err
 	}
 
-	validPeers, err := am.integratedPeerValidator.GetValidatedPeers(ctx, accountID, groups, peers, settings.Extra)
+	validPeers, err := am.integratedPeerValidator.GetValidatedPeers(ctx, accountID, types.TwinGroups(groups), types.TwinPeers(peers), settings.Extra)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -138,7 +139,7 @@ func (a MockIntegratedValidator) ValidatePeer(_ context.Context, update *nbpeer.
 	return update, false, nil
 }
 
-func (a MockIntegratedValidator) GetValidatedPeers(_ context.Context, accountID string, groups []*types.Group, peers []*nbpeer.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error) {
+func (a MockIntegratedValidator) GetValidatedPeers(_ context.Context, accountID string, groups []*nmdata.Group, peers []*nmdata.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error) {
 	validatedPeers := make(map[string]struct{})
 	for _, peer := range peers {
 		validatedPeers[peer.ID] = struct{}{}
diff --git a/management/server/integrations/integrated_validator/integrated_validator_mock.go b/management/server/integrations/integrated_validator/integrated_validator_mock.go
new file mode 100644
index 000000000..73178a869
--- /dev/null
+++ b/management/server/integrations/integrated_validator/integrated_validator_mock.go
@@ -0,0 +1,187 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./interface.go
+//
+// Generated by this command:
+//
+//	mockgen -package integrated_validator -destination=integrated_validator_mock.go -source=./interface.go -build_flags=-mod=mod
+//
+
+// Package integrated_validator is a generated GoMock package.
+package integrated_validator
+
+import (
+	context "context"
+	reflect "reflect"
+
+	peer "github.com/netbirdio/netbird/management/server/peer"
+	types "github.com/netbirdio/netbird/management/server/types"
+	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	proto "github.com/netbirdio/netbird/shared/management/proto"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockIntegratedValidator is a mock of IntegratedValidator interface.
+type MockIntegratedValidator struct {
+	ctrl     *gomock.Controller
+	recorder *MockIntegratedValidatorMockRecorder
+	isgomock struct{}
+}
+
+// MockIntegratedValidatorMockRecorder is the mock recorder for MockIntegratedValidator.
+type MockIntegratedValidatorMockRecorder struct {
+	mock *MockIntegratedValidator
+}
+
+// NewMockIntegratedValidator creates a new mock instance.
+func NewMockIntegratedValidator(ctrl *gomock.Controller) *MockIntegratedValidator {
+	mock := &MockIntegratedValidator{ctrl: ctrl}
+	mock.recorder = &MockIntegratedValidatorMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockIntegratedValidator) EXPECT() *MockIntegratedValidatorMockRecorder {
+	return m.recorder
+}
+
+// GetInvalidPeers mocks base method.
+func (m *MockIntegratedValidator) GetInvalidPeers(ctx context.Context, accountID string, extraSettings *types.ExtraSettings) (map[string]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetInvalidPeers", ctx, accountID, extraSettings)
+	ret0, _ := ret[0].(map[string]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetInvalidPeers indicates an expected call of GetInvalidPeers.
+func (mr *MockIntegratedValidatorMockRecorder) GetInvalidPeers(ctx, accountID, extraSettings any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetInvalidPeers", reflect.TypeOf((*MockIntegratedValidator)(nil).GetInvalidPeers), ctx, accountID, extraSettings)
+}
+
+// GetValidatedPeers mocks base method.
+func (m *MockIntegratedValidator) GetValidatedPeers(ctx context.Context, accountID string, groups []*nmdata.Group, peers []*nmdata.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetValidatedPeers", ctx, accountID, groups, peers, extraSettings)
+	ret0, _ := ret[0].(map[string]struct{})
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetValidatedPeers indicates an expected call of GetValidatedPeers.
+func (mr *MockIntegratedValidatorMockRecorder) GetValidatedPeers(ctx, accountID, groups, peers, extraSettings any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetValidatedPeers", reflect.TypeOf((*MockIntegratedValidator)(nil).GetValidatedPeers), ctx, accountID, groups, peers, extraSettings)
+}
+
+// IsNotValidPeer mocks base method.
+func (m *MockIntegratedValidator) IsNotValidPeer(ctx context.Context, accountID string, arg2 *peer.Peer, peersGroup []string, extraSettings *types.ExtraSettings) (bool, bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IsNotValidPeer", ctx, accountID, arg2, peersGroup, extraSettings)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(bool)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// IsNotValidPeer indicates an expected call of IsNotValidPeer.
+func (mr *MockIntegratedValidatorMockRecorder) IsNotValidPeer(ctx, accountID, arg2, peersGroup, extraSettings any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsNotValidPeer", reflect.TypeOf((*MockIntegratedValidator)(nil).IsNotValidPeer), ctx, accountID, arg2, peersGroup, extraSettings)
+}
+
+// PeerDeleted mocks base method.
+func (m *MockIntegratedValidator) PeerDeleted(ctx context.Context, accountID, peerID string, extraSettings *types.ExtraSettings) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PeerDeleted", ctx, accountID, peerID, extraSettings)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// PeerDeleted indicates an expected call of PeerDeleted.
+func (mr *MockIntegratedValidatorMockRecorder) PeerDeleted(ctx, accountID, peerID, extraSettings any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PeerDeleted", reflect.TypeOf((*MockIntegratedValidator)(nil).PeerDeleted), ctx, accountID, peerID, extraSettings)
+}
+
+// PreparePeer mocks base method.
+func (m *MockIntegratedValidator) PreparePeer(ctx context.Context, accountID string, p *peer.Peer, peersGroup []string, extraSettings *types.ExtraSettings, temporary bool) *peer.Peer {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PreparePeer", ctx, accountID, p, peersGroup, extraSettings, temporary)
+	ret0, _ := ret[0].(*peer.Peer)
+	return ret0
+}
+
+// PreparePeer indicates an expected call of PreparePeer.
+func (mr *MockIntegratedValidatorMockRecorder) PreparePeer(ctx, accountID, p, peersGroup, extraSettings, temporary any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PreparePeer", reflect.TypeOf((*MockIntegratedValidator)(nil).PreparePeer), ctx, accountID, p, peersGroup, extraSettings, temporary)
+}
+
+// SetPeerInvalidationListener mocks base method.
+func (m *MockIntegratedValidator) SetPeerInvalidationListener(fn func(string, []string)) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetPeerInvalidationListener", fn)
+}
+
+// SetPeerInvalidationListener indicates an expected call of SetPeerInvalidationListener.
+func (mr *MockIntegratedValidatorMockRecorder) SetPeerInvalidationListener(fn any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetPeerInvalidationListener", reflect.TypeOf((*MockIntegratedValidator)(nil).SetPeerInvalidationListener), fn)
+}
+
+// Stop mocks base method.
+func (m *MockIntegratedValidator) Stop(ctx context.Context) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Stop", ctx)
+}
+
+// Stop indicates an expected call of Stop.
+func (mr *MockIntegratedValidatorMockRecorder) Stop(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Stop", reflect.TypeOf((*MockIntegratedValidator)(nil).Stop), ctx)
+}
+
+// ValidateExtraSettings mocks base method.
+func (m *MockIntegratedValidator) ValidateExtraSettings(ctx context.Context, newExtraSettings, oldExtraSettings *types.ExtraSettings, userID, accountID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ValidateExtraSettings", ctx, newExtraSettings, oldExtraSettings, userID, accountID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// ValidateExtraSettings indicates an expected call of ValidateExtraSettings.
+func (mr *MockIntegratedValidatorMockRecorder) ValidateExtraSettings(ctx, newExtraSettings, oldExtraSettings, userID, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateExtraSettings", reflect.TypeOf((*MockIntegratedValidator)(nil).ValidateExtraSettings), ctx, newExtraSettings, oldExtraSettings, userID, accountID)
+}
+
+// ValidateFlowResponse mocks base method.
+func (m *MockIntegratedValidator) ValidateFlowResponse(ctx context.Context, peerKey string, flowResponse *proto.PKCEAuthorizationFlow) *proto.PKCEAuthorizationFlow {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ValidateFlowResponse", ctx, peerKey, flowResponse)
+	ret0, _ := ret[0].(*proto.PKCEAuthorizationFlow)
+	return ret0
+}
+
+// ValidateFlowResponse indicates an expected call of ValidateFlowResponse.
+func (mr *MockIntegratedValidatorMockRecorder) ValidateFlowResponse(ctx, peerKey, flowResponse any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateFlowResponse", reflect.TypeOf((*MockIntegratedValidator)(nil).ValidateFlowResponse), ctx, peerKey, flowResponse)
+}
+
+// ValidatePeer mocks base method.
+func (m *MockIntegratedValidator) ValidatePeer(ctx context.Context, update, p *peer.Peer, userID, accountID, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*peer.Peer, bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ValidatePeer", ctx, update, p, userID, accountID, dnsDomain, peersGroup, extraSettings)
+	ret0, _ := ret[0].(*peer.Peer)
+	ret1, _ := ret[1].(bool)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// ValidatePeer indicates an expected call of ValidatePeer.
+func (mr *MockIntegratedValidatorMockRecorder) ValidatePeer(ctx, update, p, userID, accountID, dnsDomain, peersGroup, extraSettings any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidatePeer", reflect.TypeOf((*MockIntegratedValidator)(nil).ValidatePeer), ctx, update, p, userID, accountID, dnsDomain, peersGroup, extraSettings)
+}
diff --git a/management/server/integrations/integrated_validator/interface.go b/management/server/integrations/integrated_validator/interface.go
index 326fbfaf0..dc3332177 100644
--- a/management/server/integrations/integrated_validator/interface.go
+++ b/management/server/integrations/integrated_validator/interface.go
@@ -5,16 +5,19 @@ import (
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
+//go:generate go tool mockgen -package integrated_validator -destination=integrated_validator_mock.go -source=./interface.go -build_flags=-mod=mod
+
 // IntegratedValidator interface exists to avoid the circle dependencies
 type IntegratedValidator interface {
 	ValidateExtraSettings(ctx context.Context, newExtraSettings *types.ExtraSettings, oldExtraSettings *types.ExtraSettings, userID string, accountID string) error
-	ValidatePeer(ctx context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error)
-	PreparePeer(ctx context.Context, accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *types.ExtraSettings, temporary bool) *nbpeer.Peer
+	ValidatePeer(ctx context.Context, update *nbpeer.Peer, p *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error)
+	PreparePeer(ctx context.Context, accountID string, p *nbpeer.Peer, peersGroup []string, extraSettings *types.ExtraSettings, temporary bool) *nbpeer.Peer
 	IsNotValidPeer(ctx context.Context, accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *types.ExtraSettings) (bool, bool, error)
-	GetValidatedPeers(ctx context.Context, accountID string, groups []*types.Group, peers []*nbpeer.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error)
+	GetValidatedPeers(ctx context.Context, accountID string, groups []*nmdata.Group, peers []*nmdata.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error)
 	GetInvalidPeers(ctx context.Context, accountID string, extraSettings *types.ExtraSettings) (map[string]string, error)
 	PeerDeleted(ctx context.Context, accountID, peerID string, extraSettings *types.ExtraSettings) error
 	SetPeerInvalidationListener(fn func(accountID string, peerIDs []string))
diff --git a/management/server/integrations/integrated_validator/validator/validator.go b/management/server/integrations/integrated_validator/validator/validator.go
index db1d34373..33199c065 100644
--- a/management/server/integrations/integrated_validator/validator/validator.go
+++ b/management/server/integrations/integrated_validator/validator/validator.go
@@ -10,6 +10,7 @@ import (
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -35,7 +36,7 @@ func (v *IntegratedValidatorImpl) IsNotValidPeer(_ context.Context, _ string, _
 	return false, false, nil
 }
 
-func (v *IntegratedValidatorImpl) GetValidatedPeers(_ context.Context, _ string, _ []*types.Group, peers []*nbpeer.Peer, _ *types.ExtraSettings) (map[string]struct{}, error) {
+func (v *IntegratedValidatorImpl) GetValidatedPeers(_ context.Context, _ string, _ []*nmdata.Group, peers []*nmdata.Peer, _ *types.ExtraSettings) (map[string]struct{}, error) {
 	validatedPeers := make(map[string]struct{})
 	for _, p := range peers {
 		validatedPeers[p.ID] = struct{}{}
diff --git a/management/server/integrations/port_forwarding/controller.go b/management/server/integrations/port_forwarding/controller.go
deleted file mode 100644
index f2ce81839..000000000
--- a/management/server/integrations/port_forwarding/controller.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package port_forwarding
-
-import (
-	"context"
-
-	"github.com/netbirdio/netbird/management/server/peer"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-)
-
-type Controller interface {
-	SendUpdate(ctx context.Context, accountID string, affectedProxyID string, affectedPeerIDs []string, accountPeers map[string]*peer.Peer)
-	GetProxyNetworkMaps(ctx context.Context, accountID, peerID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error)
-	GetProxyNetworkMapsAll(ctx context.Context, accountID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error)
-	IsPeerInIngressPorts(ctx context.Context, accountID, peerID string) (bool, error)
-}
-
-type ControllerMock struct {
-}
-
-func NewControllerMock() *ControllerMock {
-	return &ControllerMock{}
-}
-
-func (c *ControllerMock) SendUpdate(ctx context.Context, accountID string, affectedProxyID string, affectedPeerIDs []string, accountPeers map[string]*peer.Peer) {
-	// noop
-}
-
-func (c *ControllerMock) GetProxyNetworkMaps(ctx context.Context, accountID, peerID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error) {
-	return make(map[string]*nbtypes.NetworkMap), nil
-}
-
-func (c *ControllerMock) GetProxyNetworkMapsAll(ctx context.Context, accountID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error) {
-	return make(map[string]*nbtypes.NetworkMap), nil
-}
-
-func (c *ControllerMock) IsPeerInIngressPorts(ctx context.Context, accountID, peerID string) (bool, error) {
-	return false, nil
-}
diff --git a/management/server/job/manager.go b/management/server/job/manager.go
index 0b183ac39..323d1e639 100644
--- a/management/server/job/manager.go
+++ b/management/server/job/manager.go
@@ -57,6 +57,7 @@ func (jm *Manager) CreateJobChannel(ctx context.Context, accountID, peerID strin
 	if ch, ok := jm.jobChannels[peerID]; ok {
 		ch.Close()
 		delete(jm.jobChannels, peerID)
+		jm.failPendingLocked(ctx, accountID, peerID, "Pending job cleanup: job stream replaced by a newer stream")
 	}
 
 	ch := NewChannel()
@@ -127,24 +128,35 @@ func (jm *Manager) HandleResponse(ctx context.Context, resp *proto.JobResponse,
 	return nil
 }
 
-// CloseChannel closes a peer’s channel and cleans up its jobs
-func (jm *Manager) CloseChannel(ctx context.Context, accountID, peerID string) {
+// CloseChannel closes the peer's job channel session and fails its pending jobs. It does nothing
+// when a newer job stream has registered a different channel for the peer.
+func (jm *Manager) CloseChannel(ctx context.Context, accountID, peerID string, session *Channel) {
 	jm.mu.Lock()
 	defer jm.mu.Unlock()
 
 	if ch, ok := jm.jobChannels[peerID]; ok {
+		if ch != session {
+			log.WithContext(ctx).Debugf("skipped closing job channel: peer %s is owned by a newer job stream", peerID)
+			return
+		}
 		ch.Close()
 		delete(jm.jobChannels, peerID)
 	}
 
+	jm.failPendingLocked(ctx, accountID, peerID, "Time out peer disconnected")
+}
+
+// failPendingLocked marks the peer's pending jobs as failed and drops them from memory. The caller
+// must hold jm.mu.
+func (jm *Manager) failPendingLocked(ctx context.Context, accountID, peerID, reason string) {
 	for jobID, ev := range jm.pending {
-		if ev.PeerID == peerID {
-			// if the client disconnect and there is pending job then mark it as failed
-			if err := jm.Store.MarkPendingJobsAsFailed(ctx, accountID, peerID, jobID, "Time out peer disconnected"); err != nil {
-				log.WithContext(ctx).Errorf("failed to mark pending jobs as failed: %v", err)
-			}
-			delete(jm.pending, jobID)
+		if ev.PeerID != peerID {
+			continue
 		}
+		if err := jm.Store.MarkPendingJobsAsFailed(ctx, accountID, peerID, jobID, reason); err != nil {
+			log.WithContext(ctx).Errorf("failed to mark pending jobs as failed: %v", err)
+		}
+		delete(jm.pending, jobID)
 	}
 }
 
diff --git a/management/server/job/manager_test.go b/management/server/job/manager_test.go
new file mode 100644
index 000000000..4919ae869
--- /dev/null
+++ b/management/server/job/manager_test.go
@@ -0,0 +1,78 @@
+package job
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+func TestCloseChannel_OwnSession(t *testing.T) {
+	ctx := context.Background()
+	mockStore := store.NewMockStore(gomock.NewController(t))
+	jm := NewJobManager(nil, mockStore, nil)
+
+	session := NewChannel()
+	jm.jobChannels["peer-1"] = session
+	jm.pending["job-1"] = &Event{PeerID: "peer-1"}
+	jm.pending["job-2"] = &Event{PeerID: "peer-2"}
+
+	mockStore.EXPECT().MarkPendingJobsAsFailed(gomock.Any(), "account-1", "peer-1", "job-1", gomock.Any()).Return(nil)
+
+	jm.CloseChannel(ctx, "account-1", "peer-1", session)
+
+	assert.False(t, jm.IsPeerConnected("peer-1"))
+	_, err := session.Event(ctx)
+	assert.ErrorIs(t, err, ErrJobChannelClosed)
+	assert.NotContains(t, jm.pending, "job-1")
+	assert.Contains(t, jm.pending, "job-2", "jobs of other peers must be kept")
+}
+
+func TestCloseChannel_NewerSessionOwnsPeer(t *testing.T) {
+	ctx := context.Background()
+	jm := NewJobManager(nil, store.NewMockStore(gomock.NewController(t)), nil)
+
+	stale := NewChannel()
+	current := NewChannel()
+	jm.jobChannels["peer-1"] = current
+	jm.pending["job-1"] = &Event{PeerID: "peer-1"}
+
+	jm.CloseChannel(ctx, "account-1", "peer-1", stale)
+
+	require.True(t, jm.IsPeerConnected("peer-1"))
+	assert.Contains(t, jm.pending, "job-1", "jobs served by the newer stream must not be failed")
+
+	event := &Event{PeerID: "peer-1"}
+	require.NoError(t, current.AddEvent(ctx, time.Second, event))
+	got, err := current.Event(ctx)
+	require.NoError(t, err, "newer session channel must stay open")
+	assert.Equal(t, event, got)
+}
+
+func TestCreateJobChannel_ReplacesSessionAndDropsItsPendingJobs(t *testing.T) {
+	ctx := context.Background()
+	mockStore := store.NewMockStore(gomock.NewController(t))
+	jm := NewJobManager(nil, mockStore, nil)
+
+	stale := NewChannel()
+	jm.jobChannels["peer-1"] = stale
+	jm.pending["job-1"] = &Event{PeerID: "peer-1"}
+	jm.pending["job-2"] = &Event{PeerID: "peer-2"}
+
+	mockStore.EXPECT().MarkAllPendingJobsAsFailed(gomock.Any(), "account-1", "peer-1", gomock.Any()).Return(nil)
+	mockStore.EXPECT().MarkPendingJobsAsFailed(gomock.Any(), "account-1", "peer-1", "job-1", "Pending job cleanup: job stream replaced by a newer stream").Return(nil)
+
+	current := jm.CreateJobChannel(ctx, "account-1", "peer-1")
+
+	require.NotSame(t, stale, current)
+	_, err := stale.Event(ctx)
+	assert.ErrorIs(t, err, ErrJobChannelClosed, "replaced channel must be closed")
+	assert.True(t, jm.IsPeerConnected("peer-1"))
+	assert.False(t, jm.IsPeerHasPendingJobs("peer-1"), "jobs of the replaced stream must be dropped")
+	assert.Contains(t, jm.pending, "job-2", "jobs of other peers must be kept")
+}
diff --git a/management/server/management_proto_test.go b/management/server/management_proto_test.go
index 45d4ab8c9..4e21ea7a3 100644
--- a/management/server/management_proto_test.go
+++ b/management/server/management_proto_test.go
@@ -12,9 +12,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -31,7 +31,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -376,9 +375,9 @@ func startManagementForTest(t *testing.T, testFile string, config *config.Config
 		return nil, nil, "", cleanup, err
 	}
 
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeralMgr, config)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeralMgr, config, nil)
 	accountManager, err := BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "",
-		eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+		eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 
 	if err != nil {
 		cleanup()
diff --git a/management/server/management_test.go b/management/server/management_test.go
index f1d49193c..4d27e6edc 100644
--- a/management/server/management_test.go
+++ b/management/server/management_test.go
@@ -10,10 +10,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	pb "github.com/golang/protobuf/proto" //nolint
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -30,7 +30,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -216,7 +215,7 @@ func startServer(
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := server.NewAccountRequestBuffer(ctx, str)
-	networkMapController := controller.NewController(ctx, str, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(str, peers.NewManager(str, permissionsManager)), config)
+	networkMapController := controller.NewController(ctx, str, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(str, peers.NewManager(str, permissionsManager)), config, nil)
 
 	accountManager, err := server.BuildManager(
 		context.Background(),
@@ -231,7 +230,6 @@ func startServer(
 		false,
 		server.MockIntegratedValidator{},
 		metrics,
-		port_forwarding.NewControllerMock(),
 		settingsMockManager,
 		permissionsManager,
 		false,
diff --git a/management/server/migration/migration.go b/management/server/migration/migration.go
index 7a51cc200..6d8ed90cc 100644
--- a/management/server/migration/migration.go
+++ b/management/server/migration/migration.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
+	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
@@ -635,3 +636,128 @@ func RemoveDuplicatePeerKeys(ctx context.Context, db *gorm.DB) error {
 
 	return nil
 }
+
+func BackfillPublicIDs[T any](ctx context.Context, db *gorm.DB) error {
+	var model T
+
+	if !db.Migrator().HasTable(&model) {
+		log.WithContext(ctx).Debugf("Table for %T does not exist, no backfill needed", model)
+		return nil
+	}
+
+	stmt := &gorm.Statement{DB: db}
+	err := stmt.Parse(&model)
+	if err != nil {
+		return fmt.Errorf("parse model: %w", err)
+	}
+	tableName := stmt.Schema.Table
+
+	if err := db.Transaction(func(tx *gorm.DB) error {
+		if !tx.Migrator().HasColumn(&model, "public_id") {
+			log.WithContext(ctx).Infof("Column public_id does not exist in table %s, adding it", tableName)
+			if err := tx.Migrator().AddColumn(&model, "public_id"); err != nil {
+				return fmt.Errorf("add column public_id: %w", err)
+			}
+		}
+
+		var rows []map[string]any
+		if err := tx.Table(tableName).Select("id", "public_id").Where("public_id IS NULL").Or("public_id = ''").Find(&rows).Error; err != nil {
+			return fmt.Errorf("failed to find rows with empty public_id: %w", err)
+		}
+
+		if len(rows) == 0 {
+			log.WithContext(ctx).Infof("No rows with empty public_id found in table %s, no migration needed", tableName)
+			return nil
+		}
+
+		for _, row := range rows {
+			if err := tx.Table(tableName).Where("id = ?", row["id"]).Update("public_id", xid.New().String()).Error; err != nil {
+				return fmt.Errorf("failed to update row with id %v: %w", row["id"], err)
+			}
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	log.WithContext(ctx).Infof("Backfill of empty public_id in table %s completed", tableName)
+	return nil
+}
+
+// FoldCostAggregatesIntoBuckets migrates a per-request cost table from the old
+// "stored aggregate" shape (cost_usd + cache_cost_usd columns) to the per-bucket
+// breakdown, where the total and cache portion are derived on read instead.
+//
+// The fold preserves both aggregates exactly for historical rows: the cache
+// total moves into cached_input_cost_usd and the remainder into
+// input_cost_usd, so a row's derived total and cache cost still match what it
+// reported before the upgrade. The finer split is genuinely unknown for those
+// rows — the old schema never recorded a read/write or input/output division —
+// so it is lumped rather than guessed; only rows written after the upgrade
+// carry a true four-way split.
+//
+// Dropping the columns before folding would zero every historical row's cost,
+// so the update runs first and the drop only happens once it succeeds. A table
+// with no cost_usd column has already been migrated (or was created fresh) and
+// is skipped.
+func FoldCostAggregatesIntoBuckets[T any](ctx context.Context, db *gorm.DB) error {
+	var model T
+
+	if !db.Migrator().HasTable(&model) {
+		log.WithContext(ctx).Debugf("table for %T does not exist, no cost-bucket migration needed", model)
+		return nil
+	}
+	if !db.Migrator().HasColumn(&model, "cost_usd") {
+		log.WithContext(ctx).Debugf("table for %T has no cost_usd column, cost buckets already migrated", model)
+		return nil
+	}
+
+	stmt := &gorm.Statement{DB: db}
+	if err := stmt.Parse(&model); err != nil {
+		return fmt.Errorf("parse model schema: %w", err)
+	}
+	tableName := stmt.Schema.Table
+
+	// COALESCE guards rows whose new columns were added as NULL by an earlier
+	// AutoMigrate run that predates the NOT NULL default.
+	hasCacheColumn := db.Migrator().HasColumn(&model, "cache_cost_usd")
+	cacheExpr := "0"
+	if hasCacheColumn {
+		cacheExpr = "COALESCE(cache_cost_usd, 0)"
+	}
+
+	if err := db.Transaction(func(tx *gorm.DB) error {
+		// Only touch rows that carry a legacy total and no breakdown yet, so
+		// the migration is idempotent and never overwrites a true split.
+		update := fmt.Sprintf(`UPDATE %s
+			SET input_cost_usd = COALESCE(cost_usd, 0) - %s,
+			    cached_input_cost_usd = %s,
+			    cache_creation_cost_usd = 0,
+			    output_cost_usd = 0
+			WHERE COALESCE(cost_usd, 0) <> 0
+			  AND COALESCE(input_cost_usd, 0) = 0
+			  AND COALESCE(cached_input_cost_usd, 0) = 0
+			  AND COALESCE(cache_creation_cost_usd, 0) = 0
+			  AND COALESCE(output_cost_usd, 0) = 0`, tableName, cacheExpr, cacheExpr)
+		res := tx.Exec(update)
+		if res.Error != nil {
+			return fmt.Errorf("fold legacy cost aggregates in %s: %w", tableName, res.Error)
+		}
+		log.WithContext(ctx).Infof("folded legacy cost aggregates into per-bucket columns for %d rows in table %s", res.RowsAffected, tableName)
+
+		if err := tx.Migrator().DropColumn(&model, "cost_usd"); err != nil {
+			return fmt.Errorf("drop cost_usd from %s: %w", tableName, err)
+		}
+		if hasCacheColumn {
+			if err := tx.Migrator().DropColumn(&model, "cache_cost_usd"); err != nil {
+				return fmt.Errorf("drop cache_cost_usd from %s: %w", tableName, err)
+			}
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	log.WithContext(ctx).Infof("migration of stored cost aggregates to per-bucket columns in table %s completed", tableName)
+	return nil
+}
diff --git a/management/server/migration/migration_agentnetwork.go b/management/server/migration/migration_agentnetwork.go
new file mode 100644
index 000000000..c6cda56c2
--- /dev/null
+++ b/management/server/migration/migration_agentnetwork.go
@@ -0,0 +1,112 @@
+package migration
+
+import (
+	"context"
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+)
+
+// agentNetworkSettingsMigration is a local view of the agent_network_settings
+// table spanning both the legacy identity columns (cluster, subdomain) and
+// their replacement (domain, proxy_address), so the migrator can address all
+// four during the reshape without importing the current model.
+type agentNetworkSettingsMigration struct {
+	AccountID    string `gorm:"primaryKey"`
+	Cluster      string
+	Subdomain    string
+	Domain       string `gorm:"type:varchar(255)"`
+	ProxyAddress string `gorm:"type:varchar(255)"`
+}
+
+func (agentNetworkSettingsMigration) TableName() string { return "agent_network_settings" }
+
+// MigrateAgentNetworkSettingsToDomain reshapes agent_network_settings from the
+// legacy (cluster, subdomain) identity columns to (domain, proxy_address):
+// domain becomes `<subdomain>.<cluster>` — the endpoint hostname the old
+// columns derived — and proxy_address becomes the cluster address, preserving
+// which proxy serves the account. Runs before AutoMigrate, which then creates
+// the unique index on the freshly backfilled domain column.
+//
+// A legacy row missing either half cannot be given an endpoint; the old
+// bootstrap always wrote both, so such a row indicates corruption and the
+// migration fails loudly rather than leaving an empty domain to collide with
+// the unique index confusingly.
+//
+// The transaction is real only on sqlite and postgres, where DDL is
+// transactional. MySQL implicitly commits around every ALTER TABLE, so there
+// each step stands alone; what makes an interrupted run resumable on MySQL is
+// that every step is guarded by the schema state it changes — the entry check
+// fires while either legacy column remains, the adds skip existing columns,
+// the backfill and its loud-failure check run only while the legacy cluster
+// column exists (they provably completed before any drop), and each drop
+// skips what is already gone.
+func MigrateAgentNetworkSettingsToDomain(ctx context.Context, db *gorm.DB) error {
+	model := &agentNetworkSettingsMigration{}
+	migrator := db.Migrator()
+
+	if !migrator.HasTable(model) {
+		return nil
+	}
+	hasCluster := migrator.HasColumn(model, "cluster")
+	if !hasCluster && !migrator.HasColumn(model, "subdomain") {
+		// Fresh schema or already migrated — nothing to reshape.
+		return nil
+	}
+
+	return db.Transaction(func(tx *gorm.DB) error {
+		txMigrator := tx.Migrator()
+		for _, field := range []string{"Domain", "ProxyAddress"} {
+			if !txMigrator.HasColumn(model, field) {
+				if err := txMigrator.AddColumn(model, field); err != nil {
+					return fmt.Errorf("add %s column to agent_network_settings: %w", field, err)
+				}
+			}
+		}
+
+		if hasCluster {
+			concat := "subdomain || '.' || cluster"
+			if tx.Name() == "mysql" {
+				concat = "CONCAT(subdomain, '.', cluster)"
+			}
+			res := tx.Exec(fmt.Sprintf(
+				"UPDATE agent_network_settings SET domain = %s, proxy_address = cluster WHERE (domain IS NULL OR domain = '') AND cluster <> '' AND subdomain <> ''",
+				concat,
+			))
+			if res.Error != nil {
+				return fmt.Errorf("backfill agent_network_settings domain: %w", res.Error)
+			}
+
+			var unmigratable int64
+			if err := tx.Model(model).Where("domain IS NULL OR domain = ''").Count(&unmigratable).Error; err != nil {
+				return fmt.Errorf("count unmigratable agent_network_settings rows: %w", err)
+			}
+			if unmigratable > 0 {
+				return fmt.Errorf(
+					"%d agent_network_settings row(s) have no cluster/subdomain to derive an endpoint from; resolve them manually before upgrading",
+					unmigratable,
+				)
+			}
+
+			if res.RowsAffected > 0 {
+				log.WithContext(ctx).Infof("migrated %d agent_network_settings row(s) to domain/proxy_address", res.RowsAffected)
+			}
+		}
+
+		if txMigrator.HasIndex(model, "idx_agent_network_settings_cluster_subdomain") {
+			if err := txMigrator.DropIndex(model, "idx_agent_network_settings_cluster_subdomain"); err != nil {
+				return fmt.Errorf("drop legacy agent_network_settings index: %w", err)
+			}
+		}
+		for _, field := range []string{"Cluster", "Subdomain"} {
+			if txMigrator.HasColumn(model, field) {
+				if err := txMigrator.DropColumn(model, field); err != nil {
+					return fmt.Errorf("drop legacy agent_network_settings column %s: %w", field, err)
+				}
+			}
+		}
+
+		return nil
+	})
+}
diff --git a/management/server/migration/migration_custom_domain.go b/management/server/migration/migration_custom_domain.go
new file mode 100644
index 000000000..bac784358
--- /dev/null
+++ b/management/server/migration/migration_custom_domain.go
@@ -0,0 +1,22 @@
+package migration
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"gorm.io/gorm"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+)
+
+// MigrateCustomDomainValidationExpiry gives existing pending registrations a validation window.
+func MigrateCustomDomainValidationExpiry(ctx context.Context, db *gorm.DB) error {
+	result := db.WithContext(ctx).Model(&domain.Domain{}).
+		Where("validated = ? AND validation_expires_at IS NULL", false).
+		Update("validation_expires_at", time.Now().UTC().Add(domain.ValidationTTL))
+	if result.Error != nil {
+		return fmt.Errorf("backfill custom domain validation expiry: %w", result.Error)
+	}
+	return nil
+}
diff --git a/management/server/migration/migration_custom_domain_test.go b/management/server/migration/migration_custom_domain_test.go
new file mode 100644
index 000000000..facf23c9f
--- /dev/null
+++ b/management/server/migration/migration_custom_domain_test.go
@@ -0,0 +1,44 @@
+package migration_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	"github.com/netbirdio/netbird/management/server/migration"
+)
+
+func TestMigrateCustomDomainValidationExpiry(t *testing.T) {
+	db := setupDatabase(t)
+	require.NoError(t, db.AutoMigrate(&domain.Domain{}))
+	t.Cleanup(func() { require.NoError(t, db.Migrator().DropTable(&domain.Domain{})) })
+	ctx := context.Background()
+	existingDeadline := time.Now().UTC().Add(time.Hour).Truncate(time.Second)
+	rows := []domain.Domain{
+		{ID: "legacy", Domain: "legacy.example.com"},
+		{ID: "validated", Domain: "validated.example.com", Validated: true},
+		{ID: "pending", Domain: "pending.example.com", ValidationExpiresAt: &existingDeadline},
+	}
+	require.NoError(t, db.Create(&rows).Error)
+	before := time.Now().UTC()
+	require.NoError(t, migration.MigrateCustomDomainValidationExpiry(ctx, db))
+	after := time.Now().UTC()
+	var migrated domain.Domain
+	require.NoError(t, db.First(&migrated, "id = ?", "legacy").Error)
+	require.NotNil(t, migrated.ValidationExpiresAt)
+	assert.WithinRange(t, *migrated.ValidationExpiresAt, before.Truncate(time.Millisecond).Add(48*time.Hour), after.Add(48*time.Hour+time.Millisecond), "legacy pending registrations get a full window")
+	deadline := *migrated.ValidationExpiresAt
+	require.NoError(t, migration.MigrateCustomDomainValidationExpiry(ctx, db))
+	require.NoError(t, db.First(&migrated, "id = ?", "legacy").Error)
+	assert.Equal(t, deadline, *migrated.ValidationExpiresAt, "repeated migration must not extend the deadline")
+	var validated, pending domain.Domain
+	require.NoError(t, db.First(&validated, "id = ?", "validated").Error)
+	require.NoError(t, db.First(&pending, "id = ?", "pending").Error)
+	assert.Nil(t, validated.ValidationExpiresAt, "validated domains do not acquire an expiry")
+	require.NotNil(t, pending.ValidationExpiresAt)
+	assert.WithinDuration(t, existingDeadline, *pending.ValidationExpiresAt, 0, "existing deadlines must be preserved")
+}
diff --git a/management/server/migration/migration_test.go b/management/server/migration/migration_test.go
index cc97c2dff..868332fdf 100644
--- a/management/server/migration/migration_test.go
+++ b/management/server/migration/migration_test.go
@@ -16,6 +16,7 @@ import (
 	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
 
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/server/migration"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/testutil"
@@ -639,3 +640,221 @@ func TestCleanupOrphanedResources_SkipsWhenForeignKeyExists(t *testing.T) {
 	db.Model(&testChildWithFK{}).Count(&count)
 	assert.Equal(t, int64(2), count, "Both rows should survive — migration must skip when FK constraint exists")
 }
+
+// legacyCostRow is the pre-breakdown shape of the usage table: cost was stored
+// as a total plus a cache portion, with no per-bucket columns. Used to build a
+// realistic pre-upgrade table for the fold migration to run against.
+type legacyCostRow struct {
+	ID           string `gorm:"primaryKey"`
+	AccountID    string
+	Model        string
+	CostUSD      float64
+	CacheCostUSD float64
+}
+
+func (legacyCostRow) TableName() string { return "agent_network_request_usage" }
+
+// TestFoldCostAggregatesIntoBuckets_PreservesHistoricalCost covers the upgrade
+// path: a table written under the old schema must come out with its per-row
+// total and cache cost unchanged, because dropping cost_usd without folding it
+// forward would silently zero every historical row's spend.
+func TestFoldCostAggregatesIntoBuckets_PreservesHistoricalCost(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	// setupDatabase hands back a process-shared database, so start from a clean
+	// table rather than inheriting rows from another test.
+	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.AgentNetworkUsage{}))
+
+	require.NoError(t, db.AutoMigrate(&legacyCostRow{}), "legacy table must be created")
+	require.NoError(t, db.Create(&legacyCostRow{
+		ID: "u1", AccountID: "acct-1", Model: "claude-sonnet-4-6", CostUSD: 0.0123, CacheCostUSD: 0.0029,
+	}).Error)
+	require.NoError(t, db.Create(&legacyCostRow{
+		ID: "u2", AccountID: "acct-1", Model: "gpt-4o", CostUSD: 0.5, CacheCostUSD: 0,
+	}).Error)
+	// A zero-cost row (denied / unpriced request) must stay zero, not be touched.
+	require.NoError(t, db.Create(&legacyCostRow{ID: "u3", AccountID: "acct-1", Model: "gw/unpriced"}).Error)
+
+	// AutoMigrate adds the per-bucket columns alongside the legacy ones, exactly
+	// as a real upgrade does before the post-auto migrations run.
+	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.AgentNetworkUsage{}), "new columns must be added")
+
+	require.NoError(t, migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db))
+
+	assert.False(t, db.Migrator().HasColumn(&agentNetworkTypes.AgentNetworkUsage{}, "cost_usd"),
+		"legacy cost_usd column must be dropped once folded")
+	assert.False(t, db.Migrator().HasColumn(&agentNetworkTypes.AgentNetworkUsage{}, "cache_cost_usd"),
+		"legacy cache_cost_usd column must be dropped once folded")
+
+	var rows []*agentNetworkTypes.AgentNetworkUsage
+	require.NoError(t, db.Order("id").Find(&rows).Error)
+	require.Len(t, rows, 3)
+
+	// u1: total and cache portion both preserved; the read/write and
+	// input/output splits are unknowable for a legacy row, so the cache total
+	// lands on cached_input and the remainder on input.
+	assert.InDelta(t, 0.0123, rows[0].TotalCostUSD(), 1e-9, "historical total must survive the fold")
+	assert.InDelta(t, 0.0029, rows[0].CacheCostUSD(), 1e-9, "historical cache cost must survive the fold")
+	assert.InDelta(t, 0.0094, rows[0].InputCostUSD, 1e-9, "non-cache remainder lands on input")
+	assert.InDelta(t, 0.0029, rows[0].CachedInputCostUSD, 1e-9, "legacy cache total lands on cached input")
+	assert.Zero(t, rows[0].CacheCreationCostUSD, "legacy rows carry no read/write split to recover")
+	assert.Zero(t, rows[0].OutputCostUSD, "legacy rows carry no input/output split to recover")
+
+	// u2: no cache spend — the whole total is the non-cache remainder.
+	assert.InDelta(t, 0.5, rows[1].TotalCostUSD(), 1e-9, "cache-free historical total must survive")
+	assert.Zero(t, rows[1].CacheCostUSD(), "a cache-free row must stay cache-free")
+
+	// u3: zero stays zero rather than being rewritten.
+	assert.Zero(t, rows[2].TotalCostUSD(), "an unpriced row must remain unpriced")
+}
+
+// TestFoldCostAggregatesIntoBuckets_SkipsAlreadyMigrated proves the migration is
+// safe to re-run: with no legacy column present it is a no-op that leaves a
+// true four-way split untouched.
+func TestFoldCostAggregatesIntoBuckets_SkipsAlreadyMigrated(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.AgentNetworkUsage{}))
+
+	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.AgentNetworkUsage{}))
+	// Timestamp must be set explicitly: a zero time.Time serialises as
+	// '0000-00-00 00:00:00', which MySQL rejects under strict mode.
+	require.NoError(t, db.Create(&agentNetworkTypes.AgentNetworkUsage{
+		ID: "u1", AccountID: "acct-1", Model: "claude-sonnet-4-6",
+		Timestamp:    time.Date(2026, 5, 5, 9, 0, 0, 0, time.UTC),
+		InputCostUSD: 0.001, CachedInputCostUSD: 0.002, CacheCreationCostUSD: 0.003, OutputCostUSD: 0.004,
+	}).Error)
+
+	require.NoError(t, migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db),
+		"running against an already-migrated table must be a no-op, not an error")
+
+	var row agentNetworkTypes.AgentNetworkUsage
+	require.NoError(t, db.First(&row, "id = ?", "u1").Error)
+	assert.InDelta(t, 0.001, row.InputCostUSD, 1e-9, "a true split must not be rewritten")
+	assert.InDelta(t, 0.002, row.CachedInputCostUSD, 1e-9)
+	assert.InDelta(t, 0.003, row.CacheCreationCostUSD, 1e-9)
+	assert.InDelta(t, 0.004, row.OutputCostUSD, 1e-9)
+	assert.InDelta(t, 0.01, row.TotalCostUSD(), 1e-9, "derived total sums the four buckets")
+}
+
+// legacyAgentNetworkSettings is the pre-reshape schema: identity carried as
+// (cluster, subdomain) instead of (domain, proxy_address).
+type legacyAgentNetworkSettings struct {
+	AccountID           string `gorm:"primaryKey"`
+	Cluster             string
+	Subdomain           string
+	EnableLogCollection bool
+}
+
+func (legacyAgentNetworkSettings) TableName() string { return "agent_network_settings" }
+
+// TestMigrateAgentNetworkSettingsToDomain_BackfillsAndDropsLegacyColumns pins
+// the reshape: domain becomes `<subdomain>.<cluster>`, proxy_address becomes
+// the cluster, the legacy columns are dropped, and non-identity fields ride
+// through untouched.
+func TestMigrateAgentNetworkSettingsToDomain_BackfillsAndDropsLegacyColumns(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	require.NoError(t, db.Migrator().DropTable(&legacyAgentNetworkSettings{}))
+	require.NoError(t, db.AutoMigrate(&legacyAgentNetworkSettings{}))
+	require.NoError(t, db.Create(&legacyAgentNetworkSettings{
+		AccountID: "acct-1", Cluster: "eu.proxy.netbird.io", Subdomain: "violet", EnableLogCollection: true,
+	}).Error)
+	require.NoError(t, db.Create(&legacyAgentNetworkSettings{
+		AccountID: "acct-2", Cluster: "us.proxy.netbird.io", Subdomain: "violet",
+	}).Error)
+
+	require.NoError(t, migration.MigrateAgentNetworkSettingsToDomain(ctx, db))
+	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.Settings{}),
+		"AutoMigrate must create the domain unique index over the backfilled values")
+
+	var one, two agentNetworkTypes.Settings
+	require.NoError(t, db.First(&one, "account_id = ?", "acct-1").Error)
+	assert.Equal(t, "violet.eu.proxy.netbird.io", one.Domain, "domain must combine subdomain and cluster")
+	assert.Equal(t, "eu.proxy.netbird.io", one.ProxyAddress, "proxy address must carry the cluster")
+	assert.True(t, one.EnableLogCollection, "non-identity fields must ride through")
+	require.NoError(t, db.First(&two, "account_id = ?", "acct-2").Error)
+	assert.Equal(t, "violet.us.proxy.netbird.io", two.Domain,
+		"duplicate labels on different clusters are distinct hostnames and must both survive")
+
+	migrator := db.Migrator()
+	assert.False(t, migrator.HasColumn(&legacyAgentNetworkSettings{}, "cluster"), "legacy cluster column must be dropped")
+	assert.False(t, migrator.HasColumn(&legacyAgentNetworkSettings{}, "subdomain"), "legacy subdomain column must be dropped")
+}
+
+// TestMigrateAgentNetworkSettingsToDomain_SkipsAlreadyMigrated proves the
+// migration is safe to re-run: with no legacy column present it is a no-op.
+func TestMigrateAgentNetworkSettingsToDomain_SkipsAlreadyMigrated(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.Settings{}))
+	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.Settings{}))
+	require.NoError(t, db.Create(&agentNetworkTypes.Settings{
+		AccountID: "acct-1", Domain: "gw.example.com", ProxyAddress: "gw.example.com",
+	}).Error)
+
+	require.NoError(t, migration.MigrateAgentNetworkSettingsToDomain(ctx, db),
+		"running against an already-migrated table must be a no-op, not an error")
+
+	var row agentNetworkTypes.Settings
+	require.NoError(t, db.First(&row, "account_id = ?", "acct-1").Error)
+	assert.Equal(t, "gw.example.com", row.Domain, "migrated rows must be untouched")
+}
+
+// TestMigrateAgentNetworkSettingsToDomain_FailsOnUnmigratableRow pins the
+// loud-failure contract: a legacy row missing its identity halves cannot be
+// given an endpoint, and silently leaving an empty domain would collide with
+// the unique index confusingly later.
+func TestMigrateAgentNetworkSettingsToDomain_FailsOnUnmigratableRow(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	require.NoError(t, db.Migrator().DropTable(&legacyAgentNetworkSettings{}))
+	require.NoError(t, db.AutoMigrate(&legacyAgentNetworkSettings{}))
+	require.NoError(t, db.Create(&legacyAgentNetworkSettings{
+		AccountID: "acct-broken", Cluster: "", Subdomain: "",
+	}).Error)
+
+	err := migration.MigrateAgentNetworkSettingsToDomain(ctx, db)
+	require.Error(t, err, "a row with no identity to derive an endpoint from must fail the migration")
+	assert.Contains(t, err.Error(), "resolve them manually", "the error must tell the operator what to do")
+}
+
+// partialAgentNetworkSettings models the one non-atomic state a MySQL run can
+// be interrupted in: DDL auto-commits there, so a crash between the two legacy
+// column drops leaves subdomain behind while cluster (and the completed
+// backfill) are already committed.
+type partialAgentNetworkSettings struct {
+	AccountID    string `gorm:"primaryKey"`
+	Subdomain    string
+	Domain       string `gorm:"type:varchar(255)"`
+	ProxyAddress string `gorm:"type:varchar(255)"`
+}
+
+func (partialAgentNetworkSettings) TableName() string { return "agent_network_settings" }
+
+// TestMigrateAgentNetworkSettingsToDomain_ResumesAfterPartialDrop pins MySQL
+// resumability: a rerun over the interrupted state must remove the leftover
+// subdomain column without re-running the backfill (the cluster column that
+// feeds it is gone) and without touching the migrated values.
+func TestMigrateAgentNetworkSettingsToDomain_ResumesAfterPartialDrop(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	require.NoError(t, db.Migrator().DropTable(&partialAgentNetworkSettings{}))
+	require.NoError(t, db.AutoMigrate(&partialAgentNetworkSettings{}))
+	require.NoError(t, db.Create(&partialAgentNetworkSettings{
+		AccountID: "acct-1", Subdomain: "violet",
+		Domain: "violet.eu.proxy.netbird.io", ProxyAddress: "eu.proxy.netbird.io",
+	}).Error)
+
+	require.NoError(t, migration.MigrateAgentNetworkSettingsToDomain(ctx, db),
+		"a rerun over a partially-dropped schema must resume, not error")
+
+	migrator := db.Migrator()
+	assert.False(t, migrator.HasColumn(&partialAgentNetworkSettings{}, "subdomain"),
+		"the leftover legacy column must be dropped on resume")
+
+	var row agentNetworkTypes.Settings
+	require.NoError(t, db.First(&row, "account_id = ?", "acct-1").Error)
+	assert.Equal(t, "violet.eu.proxy.netbird.io", row.Domain, "migrated values must be untouched")
+	assert.Equal(t, "eu.proxy.netbird.io", row.ProxyAddress, "migrated values must be untouched")
+}
diff --git a/management/server/mock_server/account_mock.go b/management/server/mock_server/account_mock.go
index 071e3771b..50d18ca9b 100644
--- a/management/server/mock_server/account_mock.go
+++ b/management/server/mock_server/account_mock.go
@@ -24,6 +24,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/users"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 var _ account.Manager = (*MockAccountManager)(nil)
@@ -38,14 +39,14 @@ type MockAccountManager struct {
 	GetAccountIDByUserIdFunc              func(ctx context.Context, userAuth auth.UserAuth) (string, error)
 	GetUserFromUserAuthFunc               func(ctx context.Context, userAuth auth.UserAuth) (*types.User, error)
 	ListUsersFunc                         func(ctx context.Context, accountID string) ([]*types.User, error)
-	GetPeersFunc                          func(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error)
+	GetPeersFunc                          func(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, int, error)
 	MarkPeerConnectedFunc                 func(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64, nmap *types.NetworkMap) error
 	MarkPeerDisconnectedFunc              func(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64) error
-	SyncAndMarkPeerFunc                   func(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error)
+	SyncAndMarkPeerFunc                   func(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*nbpeer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error)
 	DeletePeerFunc                        func(ctx context.Context, accountID, peerKey, userID string) error
 	GetNetworkMapFunc                     func(ctx context.Context, peerKey string) (*types.NetworkMap, error)
 	GetPeerNetworkFunc                    func(ctx context.Context, peerKey string) (*types.Network, error)
-	AddPeerFunc                           func(ctx context.Context, accountID string, setupKey string, userId string, peer *nbpeer.Peer, temporary bool) (*nbpeer.Peer, *types.Network, []*posture.Checks, bool, error)
+	AddPeerFunc                           func(ctx context.Context, accountID string, setupKey string, userId string, peer *nbpeer.Peer, temporary bool) (*nbpeer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error)
 	GetGroupFunc                          func(ctx context.Context, accountID, groupID, userID string) (*types.Group, error)
 	GetAllGroupsFunc                      func(ctx context.Context, accountID, userID string) ([]*types.Group, error)
 	GetGroupByNameFunc                    func(ctx context.Context, groupName, accountID, userID string) (*types.Group, error)
@@ -98,9 +99,9 @@ type MockAccountManager struct {
 	SaveDNSSettingsFunc                   func(ctx context.Context, accountID, userID string, dnsSettingsToSave *types.DNSSettings) error
 	GetPeerFunc                           func(ctx context.Context, accountID, peerID, userID string) (*nbpeer.Peer, error)
 	UpdateAccountSettingsFunc             func(ctx context.Context, accountID, userID string, newSettings *types.Settings) (*types.Settings, error)
-	LoginPeerFunc                         func(ctx context.Context, login types.PeerLogin) (*nbpeer.Peer, *types.Network, []*posture.Checks, bool, error)
+	LoginPeerFunc                         func(ctx context.Context, login types.PeerLogin) (*nbpeer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error)
 	ExtendPeerSessionFunc                 func(ctx context.Context, peerPubKey, userID string) (time.Time, error)
-	SyncPeerFunc                          func(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error)
+	SyncPeerFunc                          func(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error)
 	InviteUserFunc                        func(ctx context.Context, accountID string, initiatorUserID string, targetUserEmail string) error
 	ApproveUserFunc                       func(ctx context.Context, accountID, initiatorUserID, targetUserID string) (*types.UserInfo, error)
 	RejectUserFunc                        func(ctx context.Context, accountID, initiatorUserID, targetUserID string) error
@@ -132,6 +133,7 @@ type MockAccountManager struct {
 	GetOrCreateAccountByPrivateDomainFunc func(ctx context.Context, initiatorId, domain string) (*types.Account, bool, error)
 
 	AllowSyncFunc                  func(string, uint64) bool
+	TrackCertificateChallengesFunc func(ctx context.Context, accountID, peerID string, streamStart time.Time)
 	UpdateAccountPeersFunc         func(ctx context.Context, accountID string, reason types.UpdateReason)
 	ExpandAndUpdateAffectedFunc    func(ctx context.Context, accountID string, snap *affectedpeers.Snapshot, change affectedpeers.Change)
 	BufferUpdateAccountPeersFunc   func(ctx context.Context, accountID string, reason types.UpdateReason)
@@ -205,6 +207,16 @@ func (am *MockAccountManager) UpdateGroups(ctx context.Context, accountID, userI
 	return status.Errorf(codes.Unimplemented, "method UpdateGroups is not implemented")
 }
 
+// TrackCertificateChallenges mocks TrackCertificateChallenges of the account manager.
+func (am *MockAccountManager) TrackCertificateChallenges(ctx context.Context, accountID, peerID string, streamStart time.Time) {
+	if am.TrackCertificateChallengesFunc != nil {
+		am.TrackCertificateChallengesFunc(ctx, accountID, peerID, streamStart)
+	}
+}
+
+// UntrackCertificateChallenges mocks UntrackCertificateChallenges of the account manager.
+func (am *MockAccountManager) UntrackCertificateChallenges(string, string, time.Time) {}
+
 func (am *MockAccountManager) UpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) {
 	if am.UpdateAccountPeersFunc != nil {
 		am.UpdateAccountPeersFunc(ctx, accountID, reason)
@@ -230,7 +242,7 @@ func (am *MockAccountManager) DeleteSetupKey(ctx context.Context, accountID, use
 	return status.Errorf(codes.Unimplemented, "method DeleteSetupKey is not implemented")
 }
 
-func (am *MockAccountManager) SyncAndMarkPeer(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error) {
+func (am *MockAccountManager) SyncAndMarkPeer(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*nbpeer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
 	if am.SyncAndMarkPeerFunc != nil {
 		return am.SyncAndMarkPeerFunc(ctx, accountID, peerPubKey, meta, realIP, syncTime)
 	}
@@ -424,7 +436,7 @@ func (am *MockAccountManager) AddPeer(
 	userId string,
 	peer *nbpeer.Peer,
 	temporary bool,
-) (*nbpeer.Peer, *types.Network, []*posture.Checks, bool, error) {
+) (*nbpeer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error) {
 	if am.AddPeerFunc != nil {
 		return am.AddPeerFunc(ctx, accountID, setupKey, userId, peer, temporary)
 	}
@@ -806,9 +818,10 @@ func (am *MockAccountManager) GetAccountIDFromUserAuth(ctx context.Context, user
 }
 
 // GetPeers mocks GetPeers of the AccountManager interface
-func (am *MockAccountManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
+func (am *MockAccountManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
 	if am.GetPeersFunc != nil {
-		return am.GetPeersFunc(ctx, accountID, userID, nameFilter, ipFilter)
+		peers, _, err := am.GetPeersFunc(ctx, accountID, userID, nameFilter, ipFilter, macFilter)
+		return peers, err
 	}
 	return nil, status.Errorf(codes.Unimplemented, "method GetPeers is not implemented")
 }
@@ -862,7 +875,7 @@ func (am *MockAccountManager) UpdateAccountSettings(ctx context.Context, account
 }
 
 // LoginPeer mocks LoginPeer of the AccountManager interface
-func (am *MockAccountManager) LoginPeer(ctx context.Context, login types.PeerLogin) (*nbpeer.Peer, *types.Network, []*posture.Checks, bool, error) {
+func (am *MockAccountManager) LoginPeer(ctx context.Context, login types.PeerLogin) (*nbpeer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error) {
 	if am.LoginPeerFunc != nil {
 		return am.LoginPeerFunc(ctx, login)
 	}
@@ -878,7 +891,7 @@ func (am *MockAccountManager) ExtendPeerSession(ctx context.Context, peerPubKey,
 }
 
 // SyncPeer mocks SyncPeer of the AccountManager interface
-func (am *MockAccountManager) SyncPeer(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error) {
+func (am *MockAccountManager) SyncPeer(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
 	if am.SyncPeerFunc != nil {
 		return am.SyncPeerFunc(ctx, sync, accountID)
 	}
diff --git a/management/server/mock_server/management_server_mock.go b/management/server/mock_server/management_server_mock.go
index 45049f1fe..cd219b8a9 100644
--- a/management/server/mock_server/management_server_mock.go
+++ b/management/server/mock_server/management_server_mock.go
@@ -13,7 +13,7 @@ type ManagementServiceServerMock struct {
 	proto.UnimplementedManagementServiceServer
 
 	LoginFunc                      func(context.Context, *proto.EncryptedMessage) (*proto.EncryptedMessage, error)
-	SyncFunc                       func(*proto.EncryptedMessage, proto.ManagementService_SyncServer)
+	SyncFunc                       func(*proto.EncryptedMessage, proto.ManagementService_SyncServer) error
 	GetServerKeyFunc               func(context.Context, *proto.Empty) (*proto.ServerKeyResponse, error)
 	IsHealthyFunc                  func(context.Context, *proto.Empty) (*proto.Empty, error)
 	GetDeviceAuthorizationFlowFunc func(ctx context.Context, req *proto.EncryptedMessage) (*proto.EncryptedMessage, error)
@@ -30,7 +30,7 @@ func (m ManagementServiceServerMock) Login(ctx context.Context, req *proto.Encry
 
 func (m ManagementServiceServerMock) Sync(msg *proto.EncryptedMessage, sync proto.ManagementService_SyncServer) error {
 	if m.SyncFunc != nil {
-		return m.Sync(msg, sync)
+		return m.SyncFunc(msg, sync)
 	}
 	return status.Errorf(codes.Unimplemented, "method Sync not implemented")
 }
diff --git a/management/server/nameserver.go b/management/server/nameserver.go
index b9cebf726..0a4c2291e 100644
--- a/management/server/nameserver.go
+++ b/management/server/nameserver.go
@@ -67,6 +67,8 @@ func (am *DefaultAccountManager) CreateNameServerGroup(ctx context.Context, acco
 			return err
 		}
 
+		newNSGroup.PublicID = xid.New().String()
+
 		if err = transaction.SaveNameServerGroup(ctx, newNSGroup); err != nil {
 			return err
 		}
@@ -116,6 +118,8 @@ func (am *DefaultAccountManager) SaveNameServerGroup(ctx context.Context, accoun
 			return err
 		}
 
+		nsGroupToSave.PublicID = oldNSGroup.PublicID
+
 		if err = transaction.SaveNameServerGroup(ctx, nsGroupToSave); err != nil {
 			return err
 		}
diff --git a/management/server/nameserver_test.go b/management/server/nameserver_test.go
index e13b0bb19..1e24390be 100644
--- a/management/server/nameserver_test.go
+++ b/management/server/nameserver_test.go
@@ -6,9 +6,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -803,9 +802,9 @@ func createNSManager(t *testing.T) (*DefaultAccountManager, error) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{})
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 }
 
 func createNSStore(t *testing.T) (store.Store, error) {
@@ -966,147 +965,151 @@ func TestValidateDomain(t *testing.T) {
 }
 
 func TestNameServerAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	var newNameServerGroupA *nbdns.NameServerGroup
-	var newNameServerGroupB *nbdns.NameServerGroup
+		var newNameServerGroupA *nbdns.NameServerGroup
+		var newNameServerGroupB *nbdns.NameServerGroup
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{},
-	})
-	assert.NoError(t, err)
-
-	err = manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupB",
-		Name:  "GroupB",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	assert.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Creating a nameserver group with a distribution group no peers should not update account peers
-	// and not send peer update
-	t.Run("creating nameserver group with distribution group no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		newNameServerGroupA, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroupA", "nsGroupA", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupA"},
-			true, []string{}, true, userID, false,
-		)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// saving a nameserver group with a distribution group with no peers should not update account peers
-	// and not send peer update
-	t.Run("saving nameserver group with distribution group no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupA)
+		err = manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupB",
+			Name:  "GroupB",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// Creating a nameserver group with a distribution group no peers should update account peers and send peer update
-	t.Run("creating nameserver group with distribution group has peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating a nameserver group with a distribution group no peers should not update account peers
+		// and not send peer update
+		step(t, "creating nameserver group with distribution group no peers", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		newNameServerGroupB, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroupB", "nsGroupB", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupB"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			newNameServerGroupA, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroupA", "nsGroupA", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupA"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-	// saving a nameserver group with a distribution group with peers should update account peers and send peer update
-	t.Run("saving nameserver group with distribution group has peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		newNameServerGroupB.NameServers = []nbdns.NameServer{
-			{
-				IP:     netip.MustParseAddr("1.1.1.2"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			},
-			{
-				IP:     netip.MustParseAddr("8.8.8.8"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			},
-		}
-		err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupB)
-		assert.NoError(t, err)
+		// saving a nameserver group with a distribution group with no peers should not update account peers
+		// and not send peer update
+		step(t, "saving nameserver group with distribution group no peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupA)
+			assert.NoError(t, err)
 
-	// Deleting a nameserver group should update account peers and send peer update
-	t.Run("deleting nameserver group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		err = manager.DeleteNameServerGroup(context.Background(), account.Id, newNameServerGroupB.ID, userID)
-		assert.NoError(t, err)
+		// Creating a nameserver group with a distribution group no peers should update account peers and send peer update
+		step(t, "creating nameserver group with distribution group has peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+			newNameServerGroupB, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroupB", "nsGroupB", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupB"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// saving a nameserver group with a distribution group with peers should update account peers and send peer update
+		step(t, "saving nameserver group with distribution group has peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			newNameServerGroupB.NameServers = []nbdns.NameServer{
+				{
+					IP:     netip.MustParseAddr("1.1.1.2"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				},
+				{
+					IP:     netip.MustParseAddr("8.8.8.8"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				},
+			}
+			err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupB)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting a nameserver group should update account peers and send peer update
+		step(t, "deleting nameserver group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeleteNameServerGroup(context.Background(), account.Id, newNameServerGroupB.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
diff --git a/management/server/networks/manager.go b/management/server/networks/manager.go
index d572502fd..fc03fff9f 100644
--- a/management/server/networks/manager.go
+++ b/management/server/networks/manager.go
@@ -71,9 +71,16 @@ func (m *managerImpl) CreateNetwork(ctx context.Context, userID string, network
 
 	network.ID = xid.New().String()
 
-	err = m.store.SaveNetwork(ctx, network)
+	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		network.PublicID = xid.New().String()
+
+		if err := transaction.SaveNetwork(ctx, network); err != nil {
+			return fmt.Errorf("failed to save network: %w", err)
+		}
+		return nil
+	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to save network: %w", err)
+		return nil, err
 	}
 
 	m.accountManager.StoreEvent(ctx, userID, network.ID, network.AccountID, activity.NetworkCreated, network.EventMeta())
@@ -102,14 +109,25 @@ func (m *managerImpl) UpdateNetwork(ctx context.Context, userID string, network
 		return nil, status.NewPermissionDeniedError()
 	}
 
-	_, err = m.store.GetNetworkByID(ctx, store.LockingStrengthUpdate, network.AccountID, network.ID)
+	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		existing, err := transaction.GetNetworkByID(ctx, store.LockingStrengthUpdate, network.AccountID, network.ID)
+		if err != nil {
+			return fmt.Errorf("failed to get network: %w", err)
+		}
+		network.PublicID = existing.PublicID
+
+		if err := transaction.SaveNetwork(ctx, network); err != nil {
+			return fmt.Errorf("failed to save network: %w", err)
+		}
+		return nil
+	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to get network: %w", err)
+		return nil, err
 	}
 
 	m.accountManager.StoreEvent(ctx, userID, network.ID, network.AccountID, activity.NetworkUpdated, network.EventMeta())
 
-	return network, m.store.SaveNetwork(ctx, network)
+	return network, nil
 }
 
 func (m *managerImpl) DeleteNetwork(ctx context.Context, accountID, userID, networkID string) error {
diff --git a/management/server/networks/manager_test.go b/management/server/networks/manager_test.go
index 24d5f49b7..b5fb1c72d 100644
--- a/management/server/networks/manager_test.go
+++ b/management/server/networks/manager_test.go
@@ -255,3 +255,73 @@ func Test_UpdateNetworkFailsWithPermissionDenied(t *testing.T) {
 	require.Error(t, err)
 	require.Nil(t, updatedNetwork)
 }
+
+// Test_CreateNetworkAllocatesSeqID verifies that CreateNetwork sets a
+// non-zero AccountSeqID on the persisted network (allocated through the
+// account_seq_counters table).
+func Test_CreateNetworkSetsPublicId(t *testing.T) {
+	ctx := context.Background()
+	const accountID = "testAccountId"
+	const userID = "testAdminId"
+
+	s, cleanUp, err := store.NewTestStoreFromSQL(ctx, "../testdata/networks.sql", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanUp)
+
+	am := mock_server.MockAccountManager{}
+	permissionsManager := permissions.NewManager(s)
+	groupsManager := groups.NewManagerMock()
+	routerManager := routers.NewManagerMock()
+	resourcesManager := resources.NewManager(s, permissionsManager, groupsManager, &am, nil)
+	manager := NewManager(s, permissionsManager, resourcesManager, routerManager, &am)
+
+	created, err := manager.CreateNetwork(ctx, userID, &types.Network{
+		AccountID: accountID,
+		Name:      "seq-allocation-test",
+	})
+	require.NoError(t, err)
+	require.NotEqual(t, "", created.PublicID, "CreateNetwork must allocate a non-zero AccountSeqID")
+}
+
+// Test_UpdateNetworkPreservesSeqID verifies UpdateNetwork does not reset
+// AccountSeqID even when the caller passes a zero value (the shape REST
+// handlers produce because the field is `json:"-"`).
+func Test_UpdateNetworkPreservesPublicId(t *testing.T) {
+	ctx := context.Background()
+	const accountID = "testAccountId"
+	const userID = "testAdminId"
+
+	s, cleanUp, err := store.NewTestStoreFromSQL(ctx, "../testdata/networks.sql", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanUp)
+
+	am := mock_server.MockAccountManager{}
+	permissionsManager := permissions.NewManager(s)
+	groupsManager := groups.NewManagerMock()
+	routerManager := routers.NewManagerMock()
+	resourcesManager := resources.NewManager(s, permissionsManager, groupsManager, &am, nil)
+	manager := NewManager(s, permissionsManager, resourcesManager, routerManager, &am)
+
+	created, err := manager.CreateNetwork(ctx, userID, &types.Network{
+		AccountID: accountID,
+		Name:      "seq-preserve-original",
+	})
+	require.NoError(t, err)
+	originalPublicId := created.PublicID
+	require.NotZero(t, originalPublicId)
+
+	update := &types.Network{
+		AccountID: accountID,
+		ID:        created.ID,
+		Name:      "seq-preserve-renamed",
+	}
+	require.Equal(t, "", update.PublicID, "incoming struct must mirror an HTTP handler shape")
+
+	_, err = manager.UpdateNetwork(ctx, userID, update)
+	require.NoError(t, err)
+
+	got, err := manager.GetNetwork(ctx, accountID, userID, created.ID)
+	require.NoError(t, err)
+	require.Equal(t, originalPublicId, got.PublicID, "PublicID must survive UpdateNetwork")
+	require.Equal(t, "seq-preserve-renamed", got.Name)
+}
diff --git a/management/server/networks/resources/manager.go b/management/server/networks/resources/manager.go
index 6c427ce62..001af4d83 100644
--- a/management/server/networks/resources/manager.go
+++ b/management/server/networks/resources/manager.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
@@ -146,6 +147,8 @@ func (m *managerImpl) createResourceInTransaction(ctx context.Context, transacti
 		return nil, nil, fmt.Errorf("failed to get network: %w", err)
 	}
 
+	resource.PublicID = xid.New().String()
+
 	if err = transaction.SaveNetworkResource(ctx, resource); err != nil {
 		return nil, nil, fmt.Errorf("failed to save network resource: %w", err)
 	}
@@ -245,6 +248,7 @@ func (m *managerImpl) UpdateResource(ctx context.Context, userID string, resourc
 		if err != nil {
 			return fmt.Errorf("failed to get network resource: %w", err)
 		}
+		resource.PublicID = oldResource.PublicID
 
 		oldGroups, err := m.groupsManager.GetResourceGroupsInTransaction(ctx, transaction, store.LockingStrengthNone, resource.AccountID, resource.ID)
 		if err != nil {
diff --git a/management/server/networks/resources/manager_test.go b/management/server/networks/resources/manager_test.go
index c6d8e7bcc..bd9dd84dd 100644
--- a/management/server/networks/resources/manager_test.go
+++ b/management/server/networks/resources/manager_test.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/require"
 
 	reverseproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
diff --git a/management/server/networks/resources/types/resource.go b/management/server/networks/resources/types/resource.go
index 1fa908393..bb33e00eb 100644
--- a/management/server/networks/resources/types/resource.go
+++ b/management/server/networks/resources/types/resource.go
@@ -32,6 +32,7 @@ type NetworkResource struct {
 	ID          string `gorm:"primaryKey"`
 	NetworkID   string `gorm:"index"`
 	AccountID   string `gorm:"index"`
+	PublicID    string `json:"-" gorm:"index"`
 	Name        string
 	Description string
 	Type        NetworkResourceType
@@ -96,6 +97,7 @@ func (n *NetworkResource) Copy() *NetworkResource {
 		ID:          n.ID,
 		AccountID:   n.AccountID,
 		NetworkID:   n.NetworkID,
+		PublicID:    n.PublicID,
 		Name:        n.Name,
 		Description: n.Description,
 		Type:        n.Type,
diff --git a/management/server/networks/routers/manager.go b/management/server/networks/routers/manager.go
index cff387a7c..f72716579 100644
--- a/management/server/networks/routers/manager.go
+++ b/management/server/networks/routers/manager.go
@@ -104,6 +104,8 @@ func (m *managerImpl) CreateRouter(ctx context.Context, userID string, router *t
 
 		router.ID = xid.New().String()
 
+		router.PublicID = xid.New().String()
+
 		err = transaction.CreateNetworkRouter(ctx, router)
 		if err != nil {
 			return fmt.Errorf("failed to create network router: %w", err)
@@ -199,6 +201,11 @@ func (m *managerImpl) updateRouterInTransaction(ctx context.Context, transaction
 		return nil, nil, affectedpeers.Change{}, status.NewRouterNotPartOfNetworkError(router.ID, router.NetworkID)
 	}
 
+	// Preserve PublicID from the existing router so the upstream
+	// UpdateNetworkRouter (which does Updates(router) with Select("*"))
+	// doesn't clobber it with the request's zero value.
+	router.PublicID = existing.PublicID
+
 	if err = transaction.UpdateNetworkRouter(ctx, router); err != nil {
 		return nil, nil, affectedpeers.Change{}, fmt.Errorf("failed to update network router: %w", err)
 	}
diff --git a/management/server/networks/routers/types/router.go b/management/server/networks/routers/types/router.go
index 1293a9934..189d7f792 100644
--- a/management/server/networks/routers/types/router.go
+++ b/management/server/networks/routers/types/router.go
@@ -13,6 +13,7 @@ type NetworkRouter struct {
 	ID         string `gorm:"primaryKey"`
 	NetworkID  string `gorm:"index"`
 	AccountID  string `gorm:"index"`
+	PublicID   string `json:"-"`
 	Peer       string
 	PeerGroups []string `gorm:"serializer:json"`
 	Masquerade bool
@@ -81,6 +82,7 @@ func (n *NetworkRouter) Copy() *NetworkRouter {
 		ID:         n.ID,
 		NetworkID:  n.NetworkID,
 		AccountID:  n.AccountID,
+		PublicID:   n.PublicID,
 		Peer:       n.Peer,
 		PeerGroups: n.PeerGroups,
 		Masquerade: n.Masquerade,
diff --git a/management/server/networks/types/network.go b/management/server/networks/types/network.go
index 69d596f8b..6f7381bff 100644
--- a/management/server/networks/types/network.go
+++ b/management/server/networks/types/network.go
@@ -7,8 +7,11 @@ import (
 )
 
 type Network struct {
-	ID          string `gorm:"primaryKey"`
-	AccountID   string `gorm:"index"`
+	ID        string `gorm:"primaryKey"`
+	AccountID string `gorm:"index"`
+
+	PublicID string `json:"-"`
+
 	Name        string
 	Description string
 }
@@ -41,11 +44,12 @@ func (n *Network) FromAPIRequest(req *api.NetworkRequest) {
 	}
 }
 
-// Copy returns a copy of a posture checks.
+// Copy returns a copy of a network.
 func (n *Network) Copy() *Network {
 	return &Network{
 		ID:          n.ID,
 		AccountID:   n.AccountID,
+		PublicID:    n.PublicID,
 		Name:        n.Name,
 		Description: n.Description,
 	}
diff --git a/management/server/peer.go b/management/server/peer.go
index 32bf9feea..aa3abcb86 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/sha256"
 	b64 "encoding/base64"
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -14,6 +15,7 @@ import (
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
+	"gorm.io/gorm"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/server/idp"
@@ -21,8 +23,8 @@ import (
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 
-	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
 
@@ -47,7 +49,7 @@ const (
 
 // GetPeers returns peers visible to the user within an account.
 // Users with "peers:read" see all peers. Otherwise, users see only their own peers, or none if restricted by account settings.
-func (am *DefaultAccountManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
+func (am *DefaultAccountManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
 	user, err := am.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
 	if err != nil {
 		return nil, err
@@ -59,7 +61,7 @@ func (am *DefaultAccountManager) GetPeers(ctx context.Context, accountID, userID
 	}
 
 	if allowed {
-		return am.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, nameFilter, ipFilter)
+		return am.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, nameFilter, ipFilter, macFilter)
 	}
 
 	settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
@@ -71,7 +73,9 @@ func (am *DefaultAccountManager) GetPeers(ctx context.Context, accountID, userID
 		return []*nbpeer.Peer{}, nil
 	}
 
-	return am.Store.GetUserPeers(ctx, store.LockingStrengthNone, accountID, userID)
+	peers, err := am.Store.GetUserPeers(ctx, store.LockingStrengthNone, accountID, userID)
+
+	return peers, err
 }
 
 // MarkPeerConnected marks a peer as connected with optimistic-locked
@@ -106,11 +110,13 @@ func (am *DefaultAccountManager) MarkPeerConnected(ctx context.Context, peerPubK
 	}
 	if !updated {
 		am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusConnect, telemetry.PeerStatusStale)
-		log.WithContext(ctx).Tracef("peer %s already has a newer session in store, skipping connect", peer.ID)
+		log.WithContext(ctx).Debugf("peer %s already has a newer session in store, skipping connect", peer.ID)
 		return nil
 	}
 	am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusConnect, telemetry.PeerStatusApplied)
 
+	log.WithContext(ctx).Debugf("mark peer %s connected", peer.ID)
+
 	if err = am.schedulePeerExpirations(ctx, accountID, peer); err != nil {
 		return err
 	}
@@ -180,12 +186,14 @@ func (am *DefaultAccountManager) MarkPeerDisconnected(ctx context.Context, peerP
 	}
 	if !updated {
 		am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusDisconnect, telemetry.PeerStatusStale)
-		log.WithContext(ctx).Tracef("peer %s session token mismatch on disconnect (token=%d), skipping",
+		log.WithContext(ctx).Debugf("peer %s session token mismatch on disconnect (token=%d), skipping",
 			peer.ID, sessionStartedAt)
 		return nil
 	}
 	am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusDisconnect, telemetry.PeerStatusApplied)
 
+	log.WithContext(ctx).Debugf("mark peer %s disconnected", peer.ID)
+
 	// Symmetric with MarkPeerConnected: when an embedded proxy peer goes
 	// offline, refresh the peers that had synthesized records pointing at
 	// it so they pull the stale entries instead of waiting out TTL.
@@ -284,19 +292,34 @@ func (am *DefaultAccountManager) UpdatePeer(ctx context.Context, accountID, user
 			var newLabel string
 
 			newLabel, err = nbdns.GetParsedDomainLabel(update.Name)
-			if err != nil {
-				newLabel = ""
-			} else {
-				_, err := transaction.GetPeerIdByLabel(ctx, store.LockingStrengthNone, accountID, newLabel)
-				if err == nil {
-					newLabel = ""
-				}
-			}
-
-			if newLabel == "" {
-				newLabel, err = getPeerIPDNSLabel(peer.IP, update.Name)
+			if settings.PeerHostnameCollisionRejected {
 				if err != nil {
-					return fmt.Errorf("failed to get free DNS label: %w", err)
+					return status.Errorf(status.InvalidArgument, "invalid peer name: %v", err)
+				}
+				if newLabel != peer.DNSLabel {
+					taken, err := peerLabelTaken(ctx, transaction, accountID, newLabel)
+					if err != nil {
+						return err
+					}
+					if taken {
+						return errPeerHostnameInUse(update.Name)
+					}
+				}
+			} else {
+				if err != nil {
+					newLabel = ""
+				} else {
+					_, err := transaction.GetPeerIdByLabel(ctx, store.LockingStrengthNone, accountID, newLabel)
+					if err == nil {
+						newLabel = ""
+					}
+				}
+
+				if newLabel == "" {
+					newLabel, err = getPeerIPDNSLabel(peer.IP, update.Name)
+					if err != nil {
+						return fmt.Errorf("failed to get free DNS label: %w", err)
+					}
 				}
 			}
 			peer.Name = update.Name
@@ -332,6 +355,9 @@ func (am *DefaultAccountManager) UpdatePeer(ctx context.Context, accountID, user
 		return transaction.SavePeer(ctx, accountID, peer)
 	})
 	if err != nil {
+		if peerLabelChanged && isUniqueConstraintError(err) {
+			return nil, errPeerHostnameInUse(peer.Name)
+		}
 		return nil, err
 	}
 
@@ -401,7 +427,7 @@ func (am *DefaultAccountManager) CreatePeerJob(ctx context.Context, accountID, p
 		return status.NewPeerNotPartOfAccountError()
 	}
 
-	meetMinVer, err := posture.MeetsMinVersion(remoteJobsMinVer, p.Meta.WtVersion)
+	meetMinVer, err := version.MeetsMinVersion(remoteJobsMinVer, p.Meta.WtVersion)
 	if !version.IsDevelopmentVersion(p.Meta.WtVersion) && (!meetMinVer || err != nil) {
 		return status.Errorf(status.PreconditionFailed, "peer version %s does not meet the minimum required version %s for remote jobs", p.Meta.WtVersion, remoteJobsMinVer)
 	}
@@ -706,11 +732,11 @@ func (am *DefaultAccountManager) handleUserAddedPeer(ctx context.Context, accoun
 func (am *DefaultAccountManager) handleSetupKeyAddedPeer(ctx context.Context, encodedHashedKey string, peer *nbpeer.Peer, opEvent *activity.Event, config *peerAddAuthConfig) error {
 	sk, err := am.Store.GetSetupKeyBySecret(ctx, store.LockingStrengthNone, encodedHashedKey)
 	if err != nil {
-		return status.Errorf(status.NotFound, "couldn't add peer: setup key is invalid")
+		return err
 	}
 
 	if !sk.IsValid() {
-		return status.Errorf(status.NotFound, "couldn't add peer: setup key is invalid")
+		return status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 	}
 
 	if !sk.AllowExtraDNSLabels && len(peer.ExtraDNSLabels) > 0 {
@@ -736,7 +762,7 @@ func (am *DefaultAccountManager) handleSetupKeyAddedPeer(ctx context.Context, en
 // to it. We also add the User ID to the peer metadata to identify registrant. If no userID provided, then fail with status.PermissionDenied
 // Each new Peer will be assigned a new next net.IP from the Account.Network and Account.Network.LastIP will be updated (IP's are not reused).
 // The peer property is just a placeholder for the Peer properties to pass further
-func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKey, userID string, peer *nbpeer.Peer, temporary bool) (*nbpeer.Peer, *types.Network, []*posture.Checks, bool, error) {
+func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKey, userID string, peer *nbpeer.Peer, temporary bool) (*nbpeer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error) {
 	if setupKey == "" && userID == "" && !peer.ProxyMeta.Embedded {
 		// no auth method provided => reject access
 		return nil, nil, nil, false, status.ErrNoAuthMethodProvided
@@ -828,6 +854,14 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 		return nil, nil, nil, false, fmt.Errorf("failed getting network: %w", err)
 	}
 
+	hostLabel, err := nbdns.GetParsedDomainLabel(peer.Meta.Hostname)
+	if err != nil {
+		return nil, nil, nil, false, status.Errorf(status.InvalidArgument, "invalid peer hostname: %v", err)
+	}
+	rejectLabelCollision := settings.PeerHostnameCollisionRejected
+	labelTaken := false
+
+	var insertErr error
 	maxAttempts := 10
 	for attempt := 1; attempt <= maxAttempts; attempt++ {
 		netPrefix, err := netip.ParsePrefix(network.Net.String())
@@ -839,17 +873,12 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 			return nil, nil, nil, false, fmt.Errorf("failed to get free IP: %w", err)
 		}
 
-		var freeLabel string
-		if ephemeral || attempt > 1 {
+		freeLabel := hostLabel
+		if !rejectLabelCollision && (ephemeral || labelTaken) {
 			freeLabel, err = getPeerIPDNSLabel(freeIP, peer.Meta.Hostname)
 			if err != nil {
 				return nil, nil, nil, false, fmt.Errorf("failed to get free DNS label: %w", err)
 			}
-		} else {
-			freeLabel, err = nbdns.GetParsedDomainLabel(peer.Meta.Hostname)
-			if err != nil {
-				return nil, nil, nil, false, fmt.Errorf("failed to get free DNS label: %w", err)
-			}
 		}
 		newPeer.DNSLabel = freeLabel
 		newPeer.IP = freeIP
@@ -880,7 +909,7 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 			}
 		}
 
-		err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		insertErr = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 			err = transaction.AddPeerToAccount(ctx, newPeer)
 			if err != nil {
 				return err
@@ -911,12 +940,12 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 			case addedBySetupKey:
 				sk, err := transaction.GetSetupKeyBySecret(ctx, store.LockingStrengthUpdate, encodedHashedKey)
 				if err != nil {
-					return fmt.Errorf("failed to get setup key: %w", err)
+					return err
 				}
 
 				// we validate at the end to not block the setup key for too long
 				if !sk.IsValid() {
-					return status.Errorf(status.PreconditionFailed, "couldn't add peer: setup key is invalid")
+					return status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 				}
 
 				err = transaction.IncrementSetupKeyUsage(ctx, peerAddConfig.SetupKeyID)
@@ -938,16 +967,28 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 			log.WithContext(ctx).Debugf("Peer %s added to account %s", newPeer.ID, accountID)
 			return nil
 		})
-		if err == nil {
+		if insertErr == nil {
 			break
 		}
 
-		if isUniqueConstraintError(err) {
-			log.WithContext(ctx).WithFields(log.Fields{"dns_label": freeLabel, "ip": freeIP}).Tracef("Failed to add peer in attempt %d, retrying: %v", attempt, err)
+		if isUniqueConstraintError(insertErr) {
+			if freeLabel == hostLabel {
+				labelTaken, err = peerLabelTaken(ctx, am.Store, accountID, hostLabel)
+				if err != nil {
+					return nil, nil, nil, false, err
+				}
+				if labelTaken && rejectLabelCollision {
+					return nil, nil, nil, false, errPeerHostnameInUse(peer.Meta.Hostname)
+				}
+			}
+			log.WithContext(ctx).WithFields(log.Fields{"dns_label": freeLabel, "ip": freeIP}).Tracef("Failed to add peer in attempt %d, retrying: %v", attempt, insertErr)
 			continue
 		}
 
-		return nil, nil, nil, false, fmt.Errorf("failed to add peer to database: %w", err)
+		return nil, nil, nil, false, fmt.Errorf("failed to add peer to database: %w", insertErr)
+	}
+	if insertErr != nil {
+		return nil, nil, nil, false, fmt.Errorf("add peer after %d attempts: %w", maxAttempts, insertErr)
 	}
 	if newPeer == nil {
 		return nil, nil, nil, false, fmt.Errorf("new peer is nil")
@@ -981,6 +1022,24 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 	return newPeer, network, postureChecks, enableSSH, nil
 }
 
+// peerLabelTaken reports whether a peer of the account already uses the DNS label.
+func peerLabelTaken(ctx context.Context, s store.Store, accountID, label string) (bool, error) {
+	_, err := s.GetPeerIdByLabel(ctx, store.LockingStrengthNone, accountID, label)
+	switch {
+	case err == nil:
+		return true, nil
+	case errors.Is(err, gorm.ErrRecordNotFound):
+		return false, nil
+	default:
+		return false, fmt.Errorf("check peer DNS label: %w", err)
+	}
+}
+
+// errPeerHostnameInUse is a PermissionDenied error because the client treats only that gRPC code as a permanent login failure instead of retrying.
+func errPeerHostnameInUse(hostname string) error {
+	return status.Errorf(status.PermissionDenied, "peer with hostname %q is already registered", hostname)
+}
+
 func getPeerIPDNSLabel(ip netip.Addr, peerHostName string) (string, error) {
 	if !ip.Is4() {
 		return "", fmt.Errorf("DNS label generation requires an IPv4 address, got %s", ip)
@@ -996,7 +1055,7 @@ func getPeerIPDNSLabel(ip netip.Addr, peerHostName string) (string, error) {
 }
 
 // SyncPeer checks whether peer is eligible for receiving NetworkMap (authenticated) and returns its NetworkMap if eligible
-func (am *DefaultAccountManager) SyncPeer(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error) {
+func (am *DefaultAccountManager) SyncPeer(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
 	var peer *nbpeer.Peer
 	var ipv6CapabilityChanged bool
 	var metaDiff nbpeer.MetaDiff
@@ -1060,7 +1119,7 @@ func (am *DefaultAccountManager) SyncPeer(ctx context.Context, sync types.PeerSy
 		return nil, nil, nil, 0, err
 	}
 
-	metaDiffAffectsPosture := posture.AffectsPosture(ctx, &metaDiff, resPostureChecks)
+	metaDiffAffectsPosture := metaDiffAffectsPosture(&metaDiff, resPostureChecks)
 	if requiresPeerUpdate(ctx, isStatusChanged, sync.UpdateAccountPeers, ipv6CapabilityChanged, metaDiffAffectsPosture, metaDiff.VersionChanged(), metaDiff.HostnameChanged()) {
 		changedPeerIDs := []string{peer.ID}
 		affectedPeerIDs := am.syncPeerAffectedPeers(ctx, accountID, peer.ID, nmap, peerNotValid, metaDiffAffectsPosture)
@@ -1072,6 +1131,14 @@ func (am *DefaultAccountManager) SyncPeer(ctx context.Context, sync types.PeerSy
 	return peer, nmap, resPostureChecks, dnsFwdPort, nil
 }
 
+// metaDiffAffectsPosture reports whether the meta change flips the verdict of any of
+// the peer's posture checks, replaying them against the old and new state.
+func metaDiffAffectsPosture(diff *nbpeer.MetaDiff, checks []*nmdata.PostureChecks) bool {
+	oldPeer := types.TwinPeer(&nbpeer.Peer{Meta: diff.OldMeta, Location: diff.OldLocation})
+	newPeer := types.TwinPeer(&nbpeer.Peer{Meta: diff.NewMeta, Location: diff.NewLocation})
+	return nmdata.PostureVerdictChanged(checks, oldPeer, newPeer)
+}
+
 func requiresPeerUpdate(ctx context.Context, isStatusChanged, updateAccountPeers, ipv6CapabilityChanged, metaDiffAffectsPosture, versionChanged, hostname bool) bool {
 	var reason string
 	switch {
@@ -1123,7 +1190,7 @@ func (am *DefaultAccountManager) markConnectedAffectedPeers(ctx context.Context,
 	return affectedPeerIDsFromNetworkMap(nmap, peerID)
 }
 
-func (am *DefaultAccountManager) handlePeerLoginNotFound(ctx context.Context, login types.PeerLogin, err error) (*nbpeer.Peer, *types.Network, []*posture.Checks, bool, error) {
+func (am *DefaultAccountManager) handlePeerLoginNotFound(ctx context.Context, login types.PeerLogin, err error) (*nbpeer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error) {
 	if errStatus, ok := status.FromError(err); ok && errStatus.Type() == status.NotFound {
 		// we couldn't find this peer by its public key which can mean that peer hasn't been registered yet.
 		// Try registering it.
@@ -1144,7 +1211,7 @@ func (am *DefaultAccountManager) handlePeerLoginNotFound(ctx context.Context, lo
 
 // LoginPeer logs in or registers a peer.
 // If peer doesn't exist the function checks whether a setup key or a user is present and registers a new peer if so.
-func (am *DefaultAccountManager) LoginPeer(ctx context.Context, login types.PeerLogin) (*nbpeer.Peer, *types.Network, []*posture.Checks, bool, error) {
+func (am *DefaultAccountManager) LoginPeer(ctx context.Context, login types.PeerLogin) (*nbpeer.Peer, *types.Network, []*nmdata.PostureChecks, bool, error) {
 	accountID, err := am.Store.GetAccountIDByPeerPubKey(ctx, login.WireGuardPubKey)
 	if err != nil {
 		return am.handlePeerLoginNotFound(ctx, login, err)
@@ -1317,7 +1384,7 @@ func (am *DefaultAccountManager) ExtendPeerSession(ctx context.Context, peerPubK
 
 // getPeerLoginInfo computes the login/register response data (network, posture
 // checks, SSH) from the store without building the peer's full network map.
-func getPeerLoginInfo(ctx context.Context, transaction store.Store, accountID string, peer *nbpeer.Peer, isValid bool) (*types.Network, []*posture.Checks, bool, error) {
+func getPeerLoginInfo(ctx context.Context, transaction store.Store, accountID string, peer *nbpeer.Peer, isValid bool) (*types.Network, []*nmdata.PostureChecks, bool, error) {
 	network, err := transaction.GetAccountNetwork(ctx, store.LockingStrengthNone, accountID)
 	if err != nil {
 		return nil, nil, false, fmt.Errorf("get account network: %w", err)
@@ -1337,7 +1404,7 @@ func getPeerLoginInfo(ctx context.Context, transaction store.Store, accountID st
 		return nil, nil, false, err
 	}
 
-	postureChecks, err := getPeerPostureChecks(ctx, transaction, accountID, peerGroupIDs, policies)
+	postureChecks, err := getPeerPostureChecks(ctx, transaction, accountID, peer.ID, peerGroupIDs, policies)
 	if err != nil {
 		return nil, nil, false, err
 	}
@@ -1359,7 +1426,7 @@ func isPeerSSHEnabled(ctx context.Context, peer *nbpeer.Peer, policies []*types.
 }
 
 // getPeerPostureChecks returns the posture checks for the peer.
-func getPeerPostureChecks(ctx context.Context, transaction store.Store, accountID string, peerGroupIDs []string, policies []*types.Policy) ([]*posture.Checks, error) {
+func getPeerPostureChecks(ctx context.Context, transaction store.Store, accountID, peerID string, peerGroupIDs []string, policies []*types.Policy) ([]*nmdata.PostureChecks, error) {
 	if len(policies) == 0 {
 		return nil, nil
 	}
@@ -1371,7 +1438,7 @@ func getPeerPostureChecks(ctx context.Context, transaction store.Store, accountI
 			continue
 		}
 
-		postureChecksIDs := processPeerPostureChecks(policy, peerGroupIDs)
+		postureChecksIDs := processPeerPostureChecks(policy, peerID, peerGroupIDs)
 		peerPostureChecksIDs = append(peerPostureChecksIDs, postureChecksIDs...)
 	}
 
@@ -1380,16 +1447,20 @@ func getPeerPostureChecks(ctx context.Context, transaction store.Store, accountI
 		return nil, err
 	}
 
-	return maps.Values(peerPostureChecks), nil
+	return types.TwinPostureChecksList(maps.Values(peerPostureChecks)), nil
 }
 
-// processPeerPostureChecks checks if the peer is in the source group of the policy and returns the posture checks.
-func processPeerPostureChecks(policy *types.Policy, peerGroupIDs []string) []string {
+// processPeerPostureChecks returns the policy's posture checks when the peer is a source of the policy, directly or through a source group.
+func processPeerPostureChecks(policy *types.Policy, peerID string, peerGroupIDs []string) []string {
 	for _, rule := range policy.Rules {
 		if !rule.Enabled {
 			continue
 		}
 
+		if rule.SourceResource.Type == types.ResourceTypePeer && rule.SourceResource.ID == peerID {
+			return policy.SourcePostureChecks
+		}
+
 		for _, sourceGroup := range rule.Sources {
 			if slices.Contains(peerGroupIDs, sourceGroup) {
 				return policy.SourcePostureChecks
@@ -1478,9 +1549,12 @@ func checkAuth(ctx context.Context, loginUserID string, peer *nbpeer.Peer) error
 
 func peerLoginExpired(ctx context.Context, peer *nbpeer.Peer, settings *types.Settings) bool {
 	expired, expiresIn := peer.LoginExpired(settings.PeerLoginExpiration)
-	expired = settings.PeerLoginExpirationEnabled && expired
-	if expired || peer.Status.LoginExpired {
-		log.WithContext(ctx).Debugf("peer's %s login expired %v ago", peer.ID, expiresIn)
+	if settings.PeerLoginExpirationEnabled && expired {
+		log.WithContext(ctx).Debugf("peer's %s login expired %v ago", peer.ID, -expiresIn)
+		return true
+	}
+	if peer.Status.LoginExpired {
+		log.WithContext(ctx).Debugf("peer's %s login is marked as expired", peer.ID)
 		return true
 	}
 	return false
@@ -1524,30 +1598,20 @@ func (am *DefaultAccountManager) UpdateAccountPeers(ctx context.Context, account
 // ExpandAndUpdateAffected expands a Snapshot (loaded INSIDE the now-committed
 // transaction) into the affected peers and dispatches the network-map refresh.
 // Pure in-memory work plus dispatch, so it runs AFTER commit — the fan-out walk
-// never holds the write lock, over the consistent in-tx snapshot. Exported so the
-// networks sub-package managers (which hold only account.Manager) share it.
+// never holds the write lock, over the consistent in-tx snapshot. The walk runs
+// before the dispatch goroutine starts, so the snapshot is released on return.
+// Exported so the networks sub-package managers (which hold only account.Manager)
+// share it.
 func (am *DefaultAccountManager) ExpandAndUpdateAffected(ctx context.Context, accountID string, snap *affectedpeers.Snapshot, change affectedpeers.Change) {
-	go am.dispatchAffected(ctx, accountID, []*affectedpeers.Snapshot{snap}, []affectedpeers.Change{change})
+	go am.dispatchAffectedPeerIDs(ctx, accountID, snap.Expand(ctx, accountID, change))
 }
 
-// dispatchAffected expands one or more (snapshot, change) pairs — collected across
-// one or several transactions — unions their affected peers, and dispatches a
-// single network-map refresh. Each snapshot must already be loaded inside its
-// transaction; this runs AFTER commit (pure in-memory + dispatch). It is spawned
-// in a goroutine that outlives the request, so it detaches from the request
-// context's cancellation up front.
-func (am *DefaultAccountManager) dispatchAffected(ctx context.Context, accountID string, snaps []*affectedpeers.Snapshot, changes []affectedpeers.Change) {
+// dispatchAffectedPeerIDs dispatches a single network-map refresh for already
+// expanded affected peer IDs. It may run in a goroutine that outlives the
+// request, so it detaches from the request context's cancellation up front.
+func (am *DefaultAccountManager) dispatchAffectedPeerIDs(ctx context.Context, accountID string, affectedPeerIDs []string) {
 	ctx = context.WithoutCancel(ctx)
 
-	var lists [][]string
-	for i, snap := range snaps {
-		if snap == nil {
-			continue
-		}
-		lists = append(lists, snap.Expand(ctx, accountID, changes[i]))
-	}
-
-	affectedPeerIDs := unionStrings(lists...)
 	if len(affectedPeerIDs) == 0 {
 		log.WithContext(ctx).Tracef("no affected peers for account %s", accountID)
 		return
@@ -1557,21 +1621,19 @@ func (am *DefaultAccountManager) dispatchAffected(ctx context.Context, accountID
 	_ = am.networkMapController.UpdateAffectedPeers(ctx, accountID, affectedPeerIDs)
 }
 
-// unionStrings concatenates the given string lists into one deduplicated slice,
-// preserving first-occurrence order.
-func unionStrings(lists ...[]string) []string {
-	seen := make(map[string]struct{})
-	var out []string
-	for _, list := range lists {
-		for _, id := range list {
-			if _, ok := seen[id]; ok {
-				continue
-			}
-			seen[id] = struct{}{}
-			out = append(out, id)
-		}
+// affectedPeerSet collects the affected peer IDs of several snapshot expansions,
+// deduplicating as they are added so it stays bounded by the account's peers
+// however many items a batch has.
+type affectedPeerSet map[string]struct{}
+
+func (s affectedPeerSet) add(peerIDs []string) {
+	for _, id := range peerIDs {
+		s[id] = struct{}{}
 	}
-	return out
+}
+
+func (s affectedPeerSet) ids() []string {
+	return maps.Keys(s)
 }
 
 // affectedPeerIDsFromNetworkMap returns the peer IDs referenced by a peer's
@@ -1584,7 +1646,7 @@ func affectedPeerIDsFromNetworkMap(nmap *types.NetworkMap, selfPeerID string) []
 	}
 	seen := make(map[string]struct{}, len(nmap.Peers)+len(nmap.OfflinePeers))
 	ids := make([]string, 0, len(nmap.Peers)+len(nmap.OfflinePeers))
-	add := func(peers []*nbpeer.Peer) {
+	add := func(peers []*nmdata.Peer) {
 		for _, p := range peers {
 			if p == nil || p.ID == "" || p.ID == selfPeerID {
 				continue
@@ -1627,7 +1689,9 @@ func (am *DefaultAccountManager) UpdateAccountPeer(ctx context.Context, accountI
 
 // getNextPeerExpiration returns the minimum duration in which the next peer of the account will expire if it was found.
 // If there is no peer that expires this function returns false and a duration of 0.
-// This function only considers peers that haven't been expired yet and that are connected.
+// This function only considers peers that haven't been expired yet. Offline peers count too:
+// a running job is never re-armed on connect, so a peer that reconnects with an old login
+// must already be part of the scheduled run.
 func (am *DefaultAccountManager) getNextPeerExpiration(ctx context.Context, accountID string) (time.Duration, bool) {
 	peersWithExpiry, err := am.Store.GetAccountPeersWithExpiration(ctx, store.LockingStrengthNone, accountID)
 	if err != nil {
@@ -1640,6 +1704,9 @@ func (am *DefaultAccountManager) getNextPeerExpiration(ctx context.Context, acco
 	}
 
 	settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	if isNotFound(err) {
+		return 0, false
+	}
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get account settings: %v", err)
 		return peerSchedulerRetryInterval, true
@@ -1647,8 +1714,7 @@ func (am *DefaultAccountManager) getNextPeerExpiration(ctx context.Context, acco
 
 	var nextExpiry *time.Duration
 	for _, peer := range peersWithExpiry {
-		// consider only connected peers because others will require login on connecting to the management server
-		if peer.Status.LoginExpired || !peer.Status.Connected {
+		if peer.Status.LoginExpired {
 			continue
 		}
 		_, duration := peer.LoginExpired(settings.PeerLoginExpiration)
@@ -1684,6 +1750,9 @@ func (am *DefaultAccountManager) getNextInactivePeerExpiration(ctx context.Conte
 	}
 
 	settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	if isNotFound(err) {
+		return 0, false
+	}
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get account settings: %v", err)
 		return peerSchedulerRetryInterval, true
@@ -1819,15 +1888,6 @@ func deletePeers(ctx context.Context, am *DefaultAccountManager, transaction sto
 
 // validatePeerDelete checks if the peer can be deleted.
 func (am *DefaultAccountManager) validatePeerDelete(ctx context.Context, transaction store.Store, accountId, peerId string) error {
-	linkedInIngressPorts, err := am.proxyController.IsPeerInIngressPorts(ctx, accountId, peerId)
-	if err != nil {
-		return err
-	}
-
-	if linkedInIngressPorts {
-		return status.Errorf(status.PreconditionFailed, "peer is linked to ingress ports: %s", peerId)
-	}
-
 	linked, router := isPeerLinkedToNetworkRouter(ctx, transaction, accountId, peerId)
 	if linked {
 		return status.Errorf(status.PreconditionFailed, "peer is linked to a network router: %s", router.ID)
diff --git a/management/server/peer/peer.go b/management/server/peer/peer.go
index 3110cd9c1..5ed19f239 100644
--- a/management/server/peer/peer.go
+++ b/management/server/peer/peer.go
@@ -13,12 +13,14 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 // Peer capability constants mirror the proto enum values.
 const (
-	PeerCapabilitySourcePrefixes int32 = 1
-	PeerCapabilityIPv6Overlay    int32 = 2
+	PeerCapabilitySourcePrefixes      = nmdata.PeerCapabilitySourcePrefixes
+	PeerCapabilityIPv6Overlay         = nmdata.PeerCapabilityIPv6Overlay
+	PeerCapabilityComponentNetworkMap = nmdata.PeerCapabilityComponentNetworkMap
 )
 
 // Peer represents a machine connected to the network.
@@ -140,6 +142,7 @@ type Flags struct {
 	RosenpassEnabled    bool
 	RosenpassPermissive bool
 	ServerSSHAllowed    bool
+	RemoteJobsAllowed   bool
 
 	DisableClientRoutes bool
 	DisableServerRoutes bool
@@ -171,7 +174,9 @@ type PeerSystemMeta struct { //nolint:revive
 	Environment        Environment `gorm:"serializer:json"`
 	Flags              Flags       `gorm:"serializer:json"`
 	Files              []File      `gorm:"serializer:json"`
+	Certificates       []string    `gorm:"serializer:json"`
 	Capabilities       []int32     `gorm:"serializer:json"`
+	SyncMessageVersion int
 }
 
 func (p PeerSystemMeta) isEqual(other PeerSystemMeta) bool {
@@ -195,7 +200,8 @@ func (p PeerSystemMeta) isEmpty() bool {
 		p.SystemManufacturer == "" &&
 		p.Environment.Cloud == "" &&
 		p.Environment.Platform == "" &&
-		len(p.Files) == 0
+		len(p.Files) == 0 &&
+		len(p.Certificates) == 0
 }
 
 // AddedWithSSOLogin indicates whether this peer has been added with an SSO login by a user.
@@ -218,6 +224,14 @@ func (p *Peer) SupportsSourcePrefixes() bool {
 	return p.HasCapability(PeerCapabilitySourcePrefixes)
 }
 
+// SupportsComponentNetworkMap reports whether the peer assembles its
+// NetworkMap from server-shipped components instead of consuming a fully
+// expanded NetworkMap. Determines whether the network_map controller skips
+// Calculate() server-side and emits the components envelope.
+func (p *Peer) SupportsComponentNetworkMap() bool {
+	return p.HasCapability(PeerCapabilityComponentNetworkMap)
+}
+
 func capabilitiesEqual(a, b []int32) bool {
 	if len(a) != len(b) {
 		return false
@@ -406,6 +420,12 @@ func diffMeta(oldMeta, newMeta PeerSystemMeta, oldLocation, newLocation Location
 	if !sameMultiset(oldMeta.Files, newMeta.Files) {
 		add("files", fmt.Sprintf("%v", oldMeta.Files), fmt.Sprintf("%v", newMeta.Files))
 	}
+	if !sameMultiset(oldMeta.Certificates, newMeta.Certificates) {
+		add("certificates", len(oldMeta.Certificates), len(newMeta.Certificates))
+	}
+	if oldMeta.SyncMessageVersion != newMeta.SyncMessageVersion {
+		add("sync_meta_version", fmt.Sprintf("%d", oldMeta.SyncMessageVersion), fmt.Sprintf("%d", newMeta.SyncMessageVersion))
+	}
 
 	if !oldLocation.equal(newLocation) {
 		add("connection_ip", oldLocation.ConnectionIP, newLocation.ConnectionIP)
@@ -559,6 +579,7 @@ func (f Flags) isEqual(other Flags) bool {
 	return f.RosenpassEnabled == other.RosenpassEnabled &&
 		f.RosenpassPermissive == other.RosenpassPermissive &&
 		f.ServerSSHAllowed == other.ServerSSHAllowed &&
+		f.RemoteJobsAllowed == other.RemoteJobsAllowed &&
 		f.DisableClientRoutes == other.DisableClientRoutes &&
 		f.DisableServerRoutes == other.DisableServerRoutes &&
 		f.DisableDNS == other.DisableDNS &&
diff --git a/management/server/peer_posture_test.go b/management/server/peer_posture_test.go
new file mode 100644
index 000000000..88662e2fa
--- /dev/null
+++ b/management/server/peer_posture_test.go
@@ -0,0 +1,203 @@
+package server
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/posture"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+func diffFrom(oldMeta, newMeta nbpeer.PeerSystemMeta, oldLoc, newLoc nbpeer.Location) *nbpeer.MetaDiff {
+	return &nbpeer.MetaDiff{
+		OldMeta:     oldMeta,
+		NewMeta:     newMeta,
+		OldLocation: oldLoc,
+		NewLocation: newLoc,
+	}
+}
+
+func postureBundle(def nmdata.ChecksDefinition) []*nmdata.PostureChecks {
+	return []*nmdata.PostureChecks{{Checks: def}}
+}
+
+func TestMetaDiffAffectsPosture_NBVersion(t *testing.T) {
+	c := postureBundle(nmdata.ChecksDefinition{NBVersionCheck: &nmdata.NBVersionCheck{MinVersion: "1.2.0"}})
+
+	tests := []struct {
+		name           string
+		oldVer, newVer string
+		want           bool
+	}{
+		{"both above min, no flip", "1.3.0", "1.4.0", false},
+		{"both below min, no flip", "1.0.0", "1.1.0", false},
+		{"crosses up below->above", "1.1.0", "1.3.0", true},
+		{"crosses down above->below", "1.3.0", "1.1.0", true},
+		{"unparsable old only -> flip", "garbage", "1.3.0", true},
+		{"unparsable both -> no flip", "garbage", "junk", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			diff := diffFrom(
+				nbpeer.PeerSystemMeta{WtVersion: tt.oldVer},
+				nbpeer.PeerSystemMeta{WtVersion: tt.newVer},
+				nbpeer.Location{}, nbpeer.Location{},
+			)
+			assert.Equal(t, tt.want, metaDiffAffectsPosture(diff, c))
+		})
+	}
+}
+
+func TestMetaDiffAffectsPosture_OSVersion_KernelBumpWithinMin(t *testing.T) {
+	c := postureBundle(nmdata.ChecksDefinition{OSVersionCheck: &nmdata.OSVersionCheck{
+		Linux: &nmdata.MinKernelVersionCheck{MinKernelVersion: "5.0.0"},
+	}})
+
+	withinMin := diffFrom(
+		nbpeer.PeerSystemMeta{GoOS: "linux", KernelVersion: "5.10.0-arch1"},
+		nbpeer.PeerSystemMeta{GoOS: "linux", KernelVersion: "5.15.0-arch2"},
+		nbpeer.Location{}, nbpeer.Location{},
+	)
+	assert.False(t, metaDiffAffectsPosture(withinMin, c))
+
+	crossesDown := diffFrom(
+		nbpeer.PeerSystemMeta{GoOS: "linux", KernelVersion: "5.10.0-arch1"},
+		nbpeer.PeerSystemMeta{GoOS: "linux", KernelVersion: "4.19.0-arch1"},
+		nbpeer.Location{}, nbpeer.Location{},
+	)
+	assert.True(t, metaDiffAffectsPosture(crossesDown, c))
+}
+
+func TestMetaDiffAffectsPosture_OSVersion_GoOSSwitchFlipsVerdict(t *testing.T) {
+	c := postureBundle(nmdata.ChecksDefinition{OSVersionCheck: &nmdata.OSVersionCheck{
+		Linux: &nmdata.MinKernelVersionCheck{MinKernelVersion: "6.0.0"},
+	}})
+
+	diff := diffFrom(
+		nbpeer.PeerSystemMeta{GoOS: "freebsd"},
+		nbpeer.PeerSystemMeta{GoOS: "linux", KernelVersion: "4.19.0"},
+		nbpeer.Location{}, nbpeer.Location{},
+	)
+	assert.True(t, metaDiffAffectsPosture(diff, c))
+}
+
+func TestMetaDiffAffectsPosture_Process_GoOSSwitchFlipsVerdict(t *testing.T) {
+	c := postureBundle(nmdata.ChecksDefinition{ProcessCheck: &nmdata.ProcessCheck{
+		Processes: []nmdata.Process{{LinuxPath: "/usr/bin/foo"}},
+	}})
+
+	files := []nbpeer.File{{Path: "/usr/bin/foo", ProcessIsRunning: true}}
+	diff := diffFrom(
+		nbpeer.PeerSystemMeta{GoOS: "linux", Files: files},
+		nbpeer.PeerSystemMeta{GoOS: "windows", Files: files},
+		nbpeer.Location{}, nbpeer.Location{},
+	)
+	assert.True(t, metaDiffAffectsPosture(diff, c))
+}
+
+func TestMetaDiffAffectsPosture_Process_UnrelatedFileChange(t *testing.T) {
+	c := postureBundle(nmdata.ChecksDefinition{ProcessCheck: &nmdata.ProcessCheck{
+		Processes: []nmdata.Process{{LinuxPath: "/usr/bin/foo"}},
+	}})
+
+	diff := diffFrom(
+		nbpeer.PeerSystemMeta{GoOS: "linux", Files: []nbpeer.File{
+			{Path: "/usr/bin/foo", ProcessIsRunning: true},
+		}},
+		nbpeer.PeerSystemMeta{GoOS: "linux", Files: []nbpeer.File{
+			{Path: "/usr/bin/foo", ProcessIsRunning: true},
+			{Path: "/usr/bin/bar", ProcessIsRunning: true},
+		}},
+		nbpeer.Location{}, nbpeer.Location{},
+	)
+	assert.False(t, metaDiffAffectsPosture(diff, c))
+}
+
+func TestMetaDiffAffectsPosture_GeoLocation(t *testing.T) {
+	c := postureBundle(nmdata.ChecksDefinition{GeoLocationCheck: &nmdata.GeoLocationCheck{
+		Action:    posture.CheckActionAllow,
+		Locations: []nmdata.GeoLocation{{CountryCode: "DE"}},
+	}})
+
+	stayAllowed := diffFrom(
+		nbpeer.PeerSystemMeta{}, nbpeer.PeerSystemMeta{},
+		nbpeer.Location{CountryCode: "DE", CityName: "Berlin"},
+		nbpeer.Location{CountryCode: "DE", CityName: "Munich"},
+	)
+	assert.False(t, metaDiffAffectsPosture(stayAllowed, c))
+
+	moveOut := diffFrom(
+		nbpeer.PeerSystemMeta{}, nbpeer.PeerSystemMeta{},
+		nbpeer.Location{CountryCode: "DE"},
+		nbpeer.Location{CountryCode: "FR"},
+	)
+	assert.True(t, metaDiffAffectsPosture(moveOut, c))
+}
+
+func TestMetaDiffAffectsPosture_PeerNetworkRange_ConnectionIP(t *testing.T) {
+	c := postureBundle(nmdata.ChecksDefinition{PeerNetworkRangeCheck: &nmdata.PeerNetworkRangeCheck{
+		Action: posture.CheckActionAllow,
+		Ranges: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+	}})
+
+	movesOutOfRange := diffFrom(
+		nbpeer.PeerSystemMeta{}, nbpeer.PeerSystemMeta{},
+		nbpeer.Location{ConnectionIP: net.ParseIP("10.1.2.3")},
+		nbpeer.Location{ConnectionIP: net.ParseIP("8.8.8.8")},
+	)
+	assert.True(t, metaDiffAffectsPosture(movesOutOfRange, c))
+
+	staysInRange := diffFrom(
+		nbpeer.PeerSystemMeta{}, nbpeer.PeerSystemMeta{},
+		nbpeer.Location{ConnectionIP: net.ParseIP("10.1.2.3")},
+		nbpeer.Location{ConnectionIP: net.ParseIP("10.9.9.9")},
+	)
+	assert.False(t, metaDiffAffectsPosture(staysInRange, c))
+}
+
+func TestMetaDiffAffectsPosture_IrrelevantFieldChange(t *testing.T) {
+	c := postureBundle(nmdata.ChecksDefinition{
+		NBVersionCheck:   &nmdata.NBVersionCheck{MinVersion: "1.0.0"},
+		GeoLocationCheck: &nmdata.GeoLocationCheck{Action: posture.CheckActionAllow, Locations: []nmdata.GeoLocation{{CountryCode: "DE"}}},
+	})
+
+	diff := diffFrom(
+		nbpeer.PeerSystemMeta{Hostname: "old", WtVersion: "1.5.0"},
+		nbpeer.PeerSystemMeta{Hostname: "new", WtVersion: "1.5.0"},
+		nbpeer.Location{CountryCode: "DE"}, nbpeer.Location{CountryCode: "DE"},
+	)
+	assert.False(t, metaDiffAffectsPosture(diff, c))
+}
+
+func TestMetaDiffAffectsPosture_NoChecks(t *testing.T) {
+	diff := diffFrom(
+		nbpeer.PeerSystemMeta{WtVersion: "1.0.0"},
+		nbpeer.PeerSystemMeta{WtVersion: "2.0.0"},
+		nbpeer.Location{}, nbpeer.Location{},
+	)
+	assert.False(t, metaDiffAffectsPosture(diff, nil))
+}
+
+func TestProcessPeerPostureChecks(t *testing.T) {
+	policy := &types.Policy{
+		Enabled:             true,
+		SourcePostureChecks: []string{"pc1"},
+		Rules: []*types.PolicyRule{
+			{Enabled: false, Sources: []string{"g-disabled"}, SourceResource: types.Resource{ID: "peer-disabled", Type: types.ResourceTypePeer}},
+			{Enabled: true, Sources: []string{"g-src"}, Destinations: []string{"g-dst"}},
+			{Enabled: true, SourceResource: types.Resource{ID: "peer-direct", Type: types.ResourceTypePeer}, Destinations: []string{"g-dst"}},
+			{Enabled: true, SourceResource: types.Resource{ID: "peer-as-host", Type: types.ResourceTypeHost}, Destinations: []string{"g-dst"}},
+		},
+	}
+
+	assert.Equal(t, []string{"pc1"}, processPeerPostureChecks(policy, "peer-in-group", []string{"g-src"}), "source group member")
+	assert.Equal(t, []string{"pc1"}, processPeerPostureChecks(policy, "peer-direct", nil), "direct source peer")
+	assert.Empty(t, processPeerPostureChecks(policy, "peer-elsewhere", []string{"g-dst"}), "destination-only peer")
+	assert.Empty(t, processPeerPostureChecks(policy, "peer-disabled", []string{"g-disabled"}), "disabled rule")
+	assert.Empty(t, processPeerPostureChecks(policy, "peer-as-host", nil), "source resource of a non-peer type")
+}
diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index d471a1302..691630a3b 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -4,10 +4,14 @@ import (
 	"context"
 	"crypto/sha256"
 	b64 "encoding/base64"
+	"encoding/json"
 	"fmt"
 	"io"
 	"net"
+	"net/http"
+	"net/http/httptest"
 	"net/netip"
+	"net/url"
 	"os"
 	"runtime"
 	"strconv"
@@ -16,11 +20,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.org/x/exp/maps"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
@@ -33,12 +37,14 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/internals/shared/grpc"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	peershandler "github.com/netbirdio/netbird/management/server/http/handlers/peers"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/status"
 
 	"github.com/netbirdio/netbird/management/server/util"
@@ -57,6 +63,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -717,19 +724,83 @@ func TestDefaultAccountManager_GetPeers(t *testing.T) {
 				return
 			}
 
-			peers, err := manager.GetPeers(context.Background(), accountID, someUser, "", "")
+			peers, err := manager.GetPeers(context.Background(), accountID, someUser, "", "", "")
 			if err != nil {
 				t.Fatal(err)
 				return
 			}
 			assert.NotNil(t, peers)
-
 			assert.Len(t, peers, testCase.expectedPeerCount)
 
 		})
 	}
 }
 
+func TestDefaultAccountManager_GetPeers_FilterByMac(t *testing.T) {
+	ctx := context.Background()
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+	account := newAccountWithId(ctx, "mac-account", "mac-admin", "", "", "", false)
+	account.Peers["matching"] = &nbpeer.Peer{
+		ID: "matching", Key: "matching-key", Name: "laptop", DNSLabel: "laptop",
+		IP: netip.MustParseAddr("100.64.0.10"), Status: &nbpeer.PeerStatus{LastSeen: time.Now()},
+		Meta: nbpeer.PeerSystemMeta{NetworkAddresses: []nbpeer.NetworkAddress{
+			{NetIP: netip.MustParsePrefix("192.168.0.11/24"), Mac: "00:93:37:bd:83:0f"},
+			{NetIP: netip.MustParsePrefix("192.168.1.11/24"), Mac: "aa:bb:cc:dd:ee:ff"},
+		}},
+	}
+	account.Peers["other"] = &nbpeer.Peer{
+		ID: "other", Key: "other-key", Name: "desktop", DNSLabel: "desktop",
+		IP: netip.MustParseAddr("100.64.0.20"), Status: &nbpeer.PeerStatus{LastSeen: time.Now()},
+	}
+	require.NoError(t, manager.Store.SaveAccount(ctx, account))
+	otherAccount := newAccountWithId(ctx, "other-account", "other-admin", "", "", "", false)
+	otherPeer := account.Peers["matching"].Copy()
+	otherPeer.ID, otherPeer.Key = "outside-account", "outside-key"
+	otherAccount.Peers[otherPeer.ID] = otherPeer
+	require.NoError(t, manager.Store.SaveAccount(ctx, otherAccount))
+	handler := peershandler.NewHandler(manager, manager.networkMapController, manager.permissionsManager)
+
+	tests := []struct {
+		name, nameFilter, ipFilter, macFilter string
+		wantIDs                               []string
+	}{
+		{name: "no filter", wantIDs: []string{"matching", "other"}},
+		{name: "full MAC", macFilter: "00:93:37:bd:83:0f", wantIDs: []string{"matching"}},
+		{name: "partial MAC", macFilter: "93:37:bd", wantIDs: []string{"matching"}},
+		{name: "second interface", macFilter: "aa:bb:cc:dd:ee:ff", wantIDs: []string{"matching"}},
+		{name: "unknown MAC", macFilter: "11:22:33:44:55:66"},
+		{name: "combined filters", nameFilter: "laptop", ipFilter: "100.64.0.10", macFilter: "00:93:37", wantIDs: []string{"matching"}},
+		{name: "name mismatch", nameFilter: "desktop", macFilter: "00:93:37"},
+		{name: "IP mismatch", ipFilter: "100.64.0.20", macFilter: "00:93:37"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peers, err := manager.GetPeers(ctx, account.Id, "mac-admin", tt.nameFilter, tt.ipFilter, tt.macFilter)
+			require.NoError(t, err)
+			ids := make([]string, 0, len(peers))
+			for _, peer := range peers {
+				ids = append(ids, peer.ID)
+			}
+			assert.ElementsMatch(t, tt.wantIDs, ids, "filters should return only matching peers in the account")
+
+			query := url.Values{"name": {tt.nameFilter}, "ip": {tt.ipFilter}, "mac": {tt.macFilter}}
+			req := httptest.NewRequest(http.MethodGet, "/api/peers?"+query.Encode(), nil)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{AccountId: account.Id, UserId: "mac-admin"})
+			recorder := httptest.NewRecorder()
+			handler.GetAllPeers(recorder, req)
+			require.Equal(t, http.StatusOK, recorder.Code, "peer listing should succeed: %s", recorder.Body.String())
+			var response []api.PeerBatch
+			require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &response))
+			responseIDs := make([]string, 0, len(response))
+			for _, peer := range response {
+				responseIDs = append(responseIDs, peer.Id)
+			}
+			assert.ElementsMatch(t, tt.wantIDs, responseIDs, "HTTP query filters should reach the store")
+		})
+	}
+}
+
 func setupTestAccountManager(b testing.TB, peers int, groups int) (*DefaultAccountManager, *update_channel.PeersUpdateManager, string, string, error) {
 	b.Helper()
 
@@ -933,7 +1004,7 @@ func BenchmarkGetPeers(b *testing.B) {
 
 			b.ResetTimer()
 			for i := 0; i < b.N; i++ {
-				_, err := manager.GetPeers(context.Background(), accountID, userID, "", "")
+				_, err := manager.GetPeers(context.Background(), accountID, userID, "", "", "")
 				if err != nil {
 					b.Fatalf("GetPeers failed: %v", err)
 				}
@@ -1091,22 +1162,22 @@ func TestToSyncResponse(t *testing.T) {
 		Signature: "turn-pass",
 	}
 	networkMap := &types.NetworkMap{
-		Network: &types.Network{Net: *ipnet, Serial: 1000},
-		Peers: []*nbpeer.Peer{{
+		Network: &nmdata.Network{Net: *ipnet, Serial: 1000},
+		Peers: []*nmdata.Peer{{
 			IP:         netip.MustParseAddr("192.168.1.2"),
 			IPv6:       netip.MustParseAddr("fd00::2"),
 			Key:        "peer2-key",
 			DNSLabel:   "peer2",
 			SSHEnabled: true,
 			SSHKey:     "peer2-ssh-key"}},
-		OfflinePeers: []*nbpeer.Peer{{
+		OfflinePeers: []*nmdata.Peer{{
 			IP:         netip.MustParseAddr("192.168.1.3"),
 			IPv6:       netip.MustParseAddr("fd00::3"),
 			Key:        "peer3-key",
 			DNSLabel:   "peer3",
 			SSHEnabled: true,
 			SSHKey:     "peer3-ssh-key"}},
-		Routes: []*nbroute.Route{
+		Routes: []*nmdata.Route{
 			{
 				ID:          "route1",
 				Network:     netip.MustParsePrefix("10.0.0.0/24"),
@@ -1153,34 +1224,20 @@ func TestToSyncResponse(t *testing.T) {
 		FirewallRules: []*types.FirewallRule{
 			{PeerIP: "192.168.1.2", Direction: types.FirewallRuleDirectionIN, Action: string(types.PolicyTrafficActionAccept), Protocol: string(types.PolicyRuleProtocolTCP), Port: "80"},
 		},
-		ForwardingRules: []*types.ForwardingRule{
-			{
-				RuleProtocol: "tcp",
-				DestinationPorts: types.RulePortRange{
-					Start: 1000,
-					End:   2000,
-				},
-				TranslatedAddress: net.IPv4(192, 168, 1, 2),
-				TranslatedPorts: types.RulePortRange{
-					Start: 11000,
-					End:   12000,
-				},
-			},
-		},
 	}
 	dnsName := "example.com"
-	checks := []*posture.Checks{
+	checks := []*nmdata.PostureChecks{
 		{
-			Checks: posture.ChecksDefinition{
-				ProcessCheck: &posture.ProcessCheck{
-					Processes: []posture.Process{{LinuxPath: "/usr/bin/netbird"}},
+			Checks: nmdata.ChecksDefinition{
+				ProcessCheck: &nmdata.ProcessCheck{
+					Processes: []nmdata.Process{{LinuxPath: "/usr/bin/netbird"}},
 				},
 			},
 		},
 	}
 	dnsCache := &cache.DNSConfigCache{}
 	accountSettings := &types.Settings{RoutingPeerDNSResolutionEnabled: true}
-	response := grpc.ToSyncResponse(context.Background(), config, config.HttpConfig, config.DeviceAuthorizationFlow, peer, turnRelayToken, turnRelayToken, networkMap, dnsName, checks, dnsCache, accountSettings, nil, []string{}, int64(dnsForwarderPort))
+	response := grpc.ToSyncResponse(context.Background(), config, config.HttpConfig, config.DeviceAuthorizationFlow, types.TwinPeer(peer), turnRelayToken, turnRelayToken, networkMap, dnsName, checks, dnsCache, types.TwinAccountSettings(accountSettings), nil, []string{}, int64(dnsForwarderPort))
 
 	assert.NotNil(t, response)
 	// assert peer config
@@ -1261,14 +1318,6 @@ func TestToSyncResponse(t *testing.T) {
 	// assert posture checks
 	assert.Equal(t, 1, len(response.Checks))
 	assert.Equal(t, "/usr/bin/netbird", response.Checks[0].Files[0])
-	// assert network map ForwardingRules
-	assert.Equal(t, 1, len(response.NetworkMap.ForwardingRules))
-	assert.Equal(t, proto.RuleProtocol_TCP, response.NetworkMap.ForwardingRules[0].Protocol)
-	assert.Equal(t, uint32(1000), response.NetworkMap.ForwardingRules[0].DestinationPort.GetRange().Start)
-	assert.Equal(t, uint32(2000), response.NetworkMap.ForwardingRules[0].DestinationPort.GetRange().End)
-	assert.Equal(t, net.IPv4(192, 168, 1, 2).To4(), net.IP(response.NetworkMap.ForwardingRules[0].TranslatedAddress))
-	assert.Equal(t, uint32(11000), response.NetworkMap.ForwardingRules[0].TranslatedPort.GetRange().Start)
-	assert.Equal(t, uint32(12000), response.NetworkMap.ForwardingRules[0].TranslatedPort.GetRange().End)
 }
 
 func Test_RegisterPeerByUser(t *testing.T) {
@@ -1300,9 +1349,9 @@ func Test_RegisterPeerByUser(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{})
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1391,9 +1440,9 @@ func Test_RegisterPeerBySetupKey(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{})
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1445,7 +1494,7 @@ func Test_RegisterPeerBySetupKey(t *testing.T) {
 			name:                      "Absent setup key",
 			existingSetupKeyID:        "AAAAAAAA-38F5-4553-B31E-DD66C696CEBB",
 			expectAddPeerError:        true,
-			errorType:                 status.NotFound,
+			errorType:                 status.PermissionDenied,
 			expectedErrorMsgSubstring: "couldn't add peer: setup key is invalid",
 		},
 	}
@@ -1550,9 +1599,9 @@ func Test_RegisterPeerRollbackOnFailure(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{})
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1635,9 +1684,9 @@ func Test_LoginPeer(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{})
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1771,374 +1820,336 @@ func Test_LoginPeer(t *testing.T) {
 }
 
 func TestPeerAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.DeletePolicy(context.Background(), account.Id, account.Policies[0].ID, userID)
-	require.NoError(t, err)
-
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err = manager.CreateGroup(context.Background(), account.Id, userID, group)
-		require.NoError(t, err)
-	}
-
-	// create a user with auto groups
-	_, err = manager.SaveOrAddUsers(context.Background(), account.Id, userID, []*types.User{
-		{
-			Id:         "regularUser1",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupA"},
-		},
-		{
-			Id:         "regularUser2",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupB"},
-		},
-		{
-			Id:         "regularUser3",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupC"},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	var peer4 *nbpeer.Peer
-	var peer5 *nbpeer.Peer
-	var peer6 *nbpeer.Peer
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Updating not expired peer and peer expiration is enabled should not update account peers and not send peer update
-	t.Run("updating not expired peer and peer expiration is enabled", func(t *testing.T) {
-		t.Skip("Currently all updates will trigger a network map")
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.UpdatePeer(context.Background(), account.Id, userID, peer2)
+		err := manager.DeletePolicy(context.Background(), account.Id, account.Policies[0].ID, userID)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
+			},
 		}
-	})
-
-	// Adding peer to unlinked group should not update account peers and not send peer update
-	t.Run("adding peer to unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
-
-		expectedPeerKey := key.PublicKey().String()
-		peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
-			Key:  expectedPeerKey,
-			Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Deleting peer with unlinked group should not update account peers and not send peer update
-	t.Run("deleting peer with unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating peer label should update account peers and send peer update
-	t.Run("updating peer label", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		peer1.Name = "peer-1"
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	t.Run("validator requires update", func(t *testing.T) {
-		requireUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
-			return update, true, nil
+		for _, group := range g {
+			err = manager.CreateGroup(context.Background(), account.Id, userID, group)
+			require.NoError(t, err)
 		}
 
-		manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireUpdateFunc}
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	t.Run("validator requires no update", func(t *testing.T) {
-		t.Skip("Currently all updates will trigger a network map")
-
-		requireNoUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
-			return update, false, nil
-		}
-
-		manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireNoUpdateFunc}
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Adding peer to group linked with policy should update account peers and send peer update
-	t.Run("adding peer to group linked with policy", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupA"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+		// create a user with auto groups
+		_, err = manager.SaveOrAddUsers(context.Background(), account.Id, userID, []*types.User{
+			{
+				Id:         "regularUser1",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupA"},
+			},
+			{
+				Id:         "regularUser2",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupB"},
+			},
+			{
+				Id:         "regularUser3",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupC"},
 			},
 		}, true)
 		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		var peer4 *nbpeer.Peer
+		var peer5 *nbpeer.Peer
+		var peer6 *nbpeer.Peer
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-		expectedPeerKey := key.PublicKey().String()
-		peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+		// Adding peer to unlinked group should not update account peers and not send peer update
+		step(t, "adding peer to unlinked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
 
-	// Deleting peer with linked group to policy should update account peers and send peer update
-	t.Run("deleting peer with linked group to policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			expectedPeerKey := key.PublicKey().String()
+			peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
+				Key:  expectedPeerKey,
+				Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Deleting peer with unlinked group should not update account peers and not send peer update
+		step(t, "deleting peer with unlinked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// drain any buffered updates from previous subtests
-	drainPeerUpdates(updMsg)
+			err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
+			require.NoError(t, err)
 
-	// Adding peer to group linked with route should update peers in that group, not unrelated peers
-	t.Run("adding peer to group linked with route", func(t *testing.T) {
-		route := nbroute.Route{
-			ID:          "testingRoute1",
-			Network:     netip.MustParsePrefix("100.65.250.202/32"),
-			NetID:       "superNet",
-			NetworkType: nbroute.IPv4Network,
-			PeerGroups:  []string{"groupB"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupB"},
-		}
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
+		// Updating peer label should update account peers and send peer update
+		step(t, "updating peer label", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			peer1.Name = "peer-1"
+			_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
+			require.NoError(t, err)
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		expectedPeerKey := key.PublicKey().String()
-		peer5, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+		step(t, "validator requires update", func(t *testing.T) {
+			requireUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
+				return update, true, nil
+			}
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireUpdateFunc}
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Deleting peer with linked group to route should update peers in that group, not unrelated peers
-	t.Run("deleting peer with linked group to route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer5.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Adding peer to group linked with policy should update account peers and send peer update
+		step(t, "adding peer to group linked with policy", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupA"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			require.NoError(t, err)
 
-	// Adding peer to group linked with name server group should update peers in that group, not unrelated peers
-	t.Run("adding peer to group linked with name server group", func(t *testing.T) {
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupC"},
-			true, []string{}, true, userID, false,
-		)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+			expectedPeerKey := key.PublicKey().String()
+			peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
 
-		expectedPeerKey := key.PublicKey().String()
-		peer6, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser3", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Deleting peer with linked group to policy should update account peers and send peer update
+		step(t, "deleting peer with linked group to policy", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Deleting peer with linked group to name server group should update peers in that group, not unrelated peers
-	t.Run("deleting peer with linked group to route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer6.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
+		// drain any buffered updates from previous subtests
+		drainPeerUpdates(updMsg)
+
+		// Adding peer to group linked with route should update peers in that group, not unrelated peers
+		step(t, "adding peer to group linked with route", func(t *testing.T) {
+			route := nbroute.Route{
+				ID:          "testingRoute1",
+				Network:     netip.MustParsePrefix("100.65.250.202/32"),
+				NetID:       "superNet",
+				NetworkType: nbroute.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupB"},
+			}
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
+
+			expectedPeerKey := key.PublicKey().String()
+			peer5, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting peer with linked group to route should update peers in that group, not unrelated peers
+		step(t, "deleting peer with linked group to route", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeletePeer(context.Background(), account.Id, peer5.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Adding peer to group linked with name server group should update peers in that group, not unrelated peers
+		step(t, "adding peer to group linked with name server group", func(t *testing.T) {
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupC"},
+				true, []string{}, true, userID, false,
+			)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
+
+			expectedPeerKey := key.PublicKey().String()
+			peer6, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser3", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting peer with linked group to name server group should update peers in that group, not unrelated peers
+		step(t, "deleting peer with linked group to name server group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeletePeer(context.Background(), account.Id, peer6.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 	})
 }
 
@@ -2630,6 +2641,8 @@ func TestHandleSetupKeyAddedPeer(t *testing.T) {
 
 		err = manager.handleSetupKeyAddedPeer(context.Background(), encodedHashedKey, peer, opEvent, config)
 		require.Error(t, err)
+		require.IsType(t, &status.Error{}, err)
+		require.Equal(t, err.(*status.Error).ErrorType, status.PermissionDenied)
 		assert.Contains(t, err.Error(), "setup key is invalid")
 	})
 
@@ -2650,6 +2663,8 @@ func TestHandleSetupKeyAddedPeer(t *testing.T) {
 
 		err = manager.handleSetupKeyAddedPeer(context.Background(), encodedHashedKey, peer, opEvent, config)
 		require.Error(t, err)
+		require.IsType(t, &status.Error{}, err)
+		require.Equal(t, err.(*status.Error).ErrorType, status.PermissionDenied)
 		assert.Contains(t, err.Error(), "setup key is invalid")
 	})
 
@@ -2786,45 +2801,47 @@ func TestPeerWillHaveIPv6(t *testing.T) {
 // flipping --disable-ipv6) without bumping its WtVersion, other account peers
 // receive a fresh network map so their AAAA records for it become unstale.
 func TestSyncPeer_IPv6CapabilityChangePropagates(t *testing.T) {
-	manager, updateManager, _, peer1, peer2, _ := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, _, peer1, peer2, _ := setupNetworkMapTest(t)
 
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// Drain any initial updates from setup.
-	drain := func() {
-		for {
-			select {
-			case <-updMsg:
-			case <-time.After(200 * time.Millisecond):
-				return
+		// Drain any initial updates from setup.
+		drain := func() {
+			for {
+				select {
+				case <-updMsg:
+				case <-time.After(200 * time.Millisecond):
+					return
+				}
 			}
 		}
-	}
-	drain()
+		drain()
 
-	t.Run("no propagation when capabilities are unchanged", func(t *testing.T) {
-		_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
-			WireGuardPubKey: peer2.Key,
-			Meta:            peer2.Meta,
-		}, peer2.AccountID)
-		require.NoError(t, err)
-		peerShouldNotReceiveUpdate(t, updMsg)
-	})
+		step(t, "no propagation when capabilities are unchanged", func(t *testing.T) {
+			_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
+				WireGuardPubKey: peer2.Key,
+				Meta:            peer2.Meta,
+			}, peer2.AccountID)
+			require.NoError(t, err)
+			peerShouldNotReceiveUpdate(t, updMsg)
+		})
 
-	t.Run("propagation when IPv6 capability is added", func(t *testing.T) {
-		newMeta := peer2.Meta
-		newMeta.Capabilities = append([]int32{}, peer2.Meta.Capabilities...)
-		newMeta.Capabilities = append(newMeta.Capabilities, nbpeer.PeerCapabilityIPv6Overlay)
+		step(t, "propagation when IPv6 capability is added", func(t *testing.T) {
+			newMeta := peer2.Meta
+			newMeta.Capabilities = append([]int32{}, peer2.Meta.Capabilities...)
+			newMeta.Capabilities = append(newMeta.Capabilities, nbpeer.PeerCapabilityIPv6Overlay)
 
-		_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
-			WireGuardPubKey: peer2.Key,
-			Meta:            newMeta,
-		}, peer2.AccountID)
-		require.NoError(t, err)
-		peerShouldReceiveUpdate(t, updMsg)
+			_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
+				WireGuardPubKey: peer2.Key,
+				Meta:            newMeta,
+			}, peer2.AccountID)
+			require.NoError(t, err)
+			peerShouldReceiveUpdate(t, updMsg)
+		})
 	})
 }
 
@@ -3032,3 +3049,214 @@ func TestResolvePeerLocation(t *testing.T) {
 		})
 	}
 }
+
+func TestAddPeer_HostnameCollisionRejected(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	account := newAccountWithId(context.Background(), "test-account", "owner", "", "", "", false)
+	account.Settings.PeerHostnameCollisionRejected = true
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	setupKey, err := manager.CreateSetupKey(context.Background(), account.Id, "key", types.SetupKeyReusable, time.Hour, nil, 100, "owner", false, false)
+	require.NoError(t, err)
+	ephemeralKey, err := manager.CreateSetupKey(context.Background(), account.Id, "ephemeral", types.SetupKeyReusable, time.Hour, nil, 100, "owner", true, false)
+	require.NoError(t, err)
+
+	addPeer := func(hostname, key string) (*nbpeer.Peer, error) {
+		wgKey, err := wgtypes.GenerateKey()
+		require.NoError(t, err)
+		peer := &nbpeer.Peer{
+			Key:  wgKey.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: hostname, OS: "linux"},
+		}
+		added, _, _, _, err := manager.AddPeer(context.Background(), "", key, "", peer, false)
+		return added, err
+	}
+
+	first, err := addPeer("my-host", setupKey.Key)
+	require.NoError(t, err)
+	assert.Equal(t, "my-host", first.DNSLabel)
+
+	_, err = addPeer("My-Host", setupKey.Key)
+	require.Error(t, err)
+	e, ok := status.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, status.PermissionDenied, e.Type())
+
+	other, err := addPeer("other-host", setupKey.Key)
+	require.NoError(t, err)
+	assert.Equal(t, "other-host", other.DNSLabel)
+
+	_, err = addPeer("my-host", ephemeralKey.Key)
+	require.Error(t, err)
+	e, ok = status.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, status.PermissionDenied, e.Type())
+
+	ephemeral, err := addPeer("ephemeral-host", ephemeralKey.Key)
+	require.NoError(t, err)
+	assert.Equal(t, "ephemeral-host", ephemeral.DNSLabel)
+
+	account.Settings.PeerHostnameCollisionRejected = false
+	require.NoError(t, manager.Store.SaveAccountSettings(context.Background(), account.Id, account.Settings))
+
+	suffixed, err := addPeer("my-host", setupKey.Key)
+	require.NoError(t, err)
+	assert.True(t, strings.HasPrefix(suffixed.DNSLabel, "my-host-"))
+}
+
+func TestUpdatePeer_HostnameCollisionRejected(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	account := newAccountWithId(context.Background(), "test-account", "owner", "", "", "", false)
+	account.Settings.PeerHostnameCollisionRejected = true
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	addPeer := func(hostname string) *nbpeer.Peer {
+		wgKey, err := wgtypes.GenerateKey()
+		require.NoError(t, err)
+		added, _, _, _, err := manager.AddPeer(context.Background(), "", "", "owner", &nbpeer.Peer{
+			Key:  wgKey.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: hostname, OS: "linux"},
+		}, false)
+		require.NoError(t, err)
+		return added
+	}
+	first := addPeer("web-server")
+	second := addPeer("old-name")
+
+	update := second.Copy()
+	update.Name = "Web-Server"
+	_, err = manager.UpdatePeer(context.Background(), account.Id, "owner", update)
+	require.Error(t, err)
+	e, ok := status.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, status.PermissionDenied, e.Type())
+
+	update = second.Copy()
+	update.Name = "api-server.example.com"
+	updated, err := manager.UpdatePeer(context.Background(), account.Id, "owner", update)
+	require.NoError(t, err)
+	assert.Equal(t, "api-server", updated.DNSLabel)
+
+	update = first.Copy()
+	update.Name = "WEB-SERVER"
+	updated, err = manager.UpdatePeer(context.Background(), account.Id, "owner", update)
+	require.NoError(t, err, "renaming to a different spelling of the own label must not collide with itself")
+	assert.Equal(t, "web-server", updated.DNSLabel)
+}
+
+func TestAddPeer_HostnameCollisionRejectedConcurrent(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	account := newAccountWithId(context.Background(), "test-account", "owner", "", "", "", false)
+	account.Settings.PeerHostnameCollisionRejected = true
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	setupKey, err := manager.CreateSetupKey(context.Background(), account.Id, "key", types.SetupKeyReusable, time.Hour, nil, 100, "owner", false, false)
+	require.NoError(t, err)
+
+	const attempts = 20
+	start := make(chan struct{})
+	errs := make(chan error, attempts)
+	var wg sync.WaitGroup
+	for i := 0; i < attempts; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			wgKey, err := wgtypes.GenerateKey()
+			if err != nil {
+				errs <- err
+				return
+			}
+			<-start
+			_, _, _, _, err = manager.AddPeer(context.Background(), "", setupKey.Key, "", &nbpeer.Peer{
+				Key:  wgKey.PublicKey().String(),
+				Meta: nbpeer.PeerSystemMeta{Hostname: "same-host", OS: "linux"},
+			}, false)
+			errs <- err
+		}()
+	}
+	close(start)
+	wg.Wait()
+	close(errs)
+
+	succeeded := 0
+	for err := range errs {
+		if err == nil {
+			succeeded++
+			continue
+		}
+		e, ok := status.FromError(err)
+		require.True(t, ok, "unexpected error: %v", err)
+		assert.Equal(t, status.PermissionDenied, e.Type(), "unexpected error: %v", err)
+	}
+	assert.Equal(t, 1, succeeded)
+
+	peers, err := manager.Store.GetAccountPeers(context.Background(), store.LockingStrengthNone, account.Id, "", "", "")
+	require.NoError(t, err)
+	require.Len(t, peers, 1)
+	assert.Equal(t, "same-host", peers[0].DNSLabel)
+}
+
+func TestAddPeer_IPCollisionKeepsLabel(t *testing.T) {
+	for _, rejectCollision := range []bool{false, true} {
+		t.Run(fmt.Sprintf("collision rejected %t", rejectCollision), func(t *testing.T) {
+			manager, _, err := createManager(t)
+			require.NoError(t, err)
+
+			account := newAccountWithId(context.Background(), "test-account", "owner", "", "", "", false)
+			account.Settings.PeerHostnameCollisionRejected = rejectCollision
+			_, smallNet, err := net.ParseCIDR("100.64.0.0/26")
+			require.NoError(t, err)
+			account.Network.Net = *smallNet
+			require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+			const totalPeers = 20
+			for i := 0; i < totalPeers; i++ {
+				wgKey, err := wgtypes.GenerateKey()
+				require.NoError(t, err)
+				hostname := fmt.Sprintf("host-%d", i)
+				added, _, _, _, err := manager.AddPeer(context.Background(), "", "", "owner", &nbpeer.Peer{
+					Key:  wgKey.PublicKey().String(),
+					Meta: nbpeer.PeerSystemMeta{Hostname: hostname, OS: "linux"},
+				}, false)
+				require.NoError(t, err)
+				assert.Equal(t, hostname, added.DNSLabel, "an IP collision must not change the DNS label")
+			}
+		})
+	}
+}
+
+func TestAddPeer_ExhaustedIPAllocationFails(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	account := newAccountWithId(context.Background(), "test-account", "owner", "", "", "", false)
+	_, tinyNet, err := net.ParseCIDR("100.64.0.0/30")
+	require.NoError(t, err)
+	account.Network.Net = *tinyNet
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	addPeer := func(hostname string) error {
+		wgKey, err := wgtypes.GenerateKey()
+		require.NoError(t, err)
+		_, _, _, _, err = manager.AddPeer(context.Background(), "", "", "owner", &nbpeer.Peer{
+			Key:  wgKey.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: hostname, OS: "linux"},
+		}, false)
+		return err
+	}
+	require.NoError(t, addPeer("host-1"))
+
+	err = addPeer("host-2")
+	require.Error(t, err, "no free IP left, registration must fail")
+
+	peers, err := manager.Store.GetAccountPeers(context.Background(), store.LockingStrengthNone, account.Id, "", "", "")
+	require.NoError(t, err)
+	require.Len(t, peers, 1)
+	assert.Equal(t, netip.MustParseAddr("100.64.0.1"), peers[0].IP)
+}
diff --git a/management/server/permissions/agent_network_roles_test.go b/management/server/permissions/agent_network_roles_test.go
new file mode 100644
index 000000000..f5ad2000d
--- /dev/null
+++ b/management/server/permissions/agent_network_roles_test.go
@@ -0,0 +1,140 @@
+package permissions
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/permissions/roles"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+var allOps = []operations.Operation{operations.Read, operations.Create, operations.Update, operations.Delete}
+
+// TestAgentNetworkAdminRole pins the delegated-admin contract: full control
+// over the whole agent_network area (parent grant cascades to every
+// submodule), read-only on the account objects needed to build policies,
+// and nothing else in the account.
+func TestAgentNetworkAdminRole(t *testing.T) {
+	manager := NewManager(nil)
+	ctx := context.Background()
+
+	role, ok := roles.RolesMap[types.UserRoleAgentNetworkAdmin]
+	require.True(t, ok, "agent_network_admin must exist in RolesMap")
+
+	agentNetworkModules := []modules.Module{
+		modules.AgentNetwork,
+		modules.AgentNetworkProviders,
+		modules.AgentNetworkPolicies,
+		modules.AgentNetworkGuardrails,
+		modules.AgentNetworkBudgets,
+		modules.AgentNetworkUsage,
+		modules.AgentNetworkLogs,
+		modules.AgentNetworkSettings,
+	}
+	for _, m := range agentNetworkModules {
+		for _, op := range allOps {
+			assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
+				"agent_network_admin must have %s on %s", op, m)
+		}
+	}
+
+	// Settings read rides along because GET /api/accounts (which the
+	// dashboard needs to boot) validates it, like network_admin.
+	for _, m := range []modules.Module{modules.Users, modules.Groups, modules.Peers, modules.Accounts, modules.Settings} {
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, operations.Read),
+			"agent_network_admin must read %s to build policies and load the dashboard", m)
+		for _, op := range []operations.Operation{operations.Create, operations.Update, operations.Delete} {
+			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
+				"agent_network_admin must not have %s on %s", op, m)
+		}
+	}
+
+	for _, m := range []modules.Module{modules.Networks, modules.Dns, modules.SetupKeys, modules.Routes} {
+		for _, op := range allOps {
+			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
+				"agent_network_admin must not have %s on %s", op, m)
+		}
+	}
+}
+
+// TestUsageViewerRole pins the read-only usage role: read on the aggregated
+// usage overview and the account-wide request-level logs, plus read-only on
+// the resources their filters and display columns resolve against (users,
+// groups, peers, the provider list) — no policies, guardrails, budgets, or
+// settings, nothing else in the account.
+func TestUsageViewerRole(t *testing.T) {
+	manager := NewManager(nil)
+	ctx := context.Background()
+
+	role, ok := roles.RolesMap[types.UserRoleUsageViewer]
+	require.True(t, ok, "usage_viewer must exist in RolesMap")
+
+	readOnly := []modules.Module{
+		modules.AgentNetworkUsage,
+		modules.AgentNetworkLogs,
+		modules.AgentNetworkProviders,
+		modules.Users,
+		modules.Groups,
+		modules.Peers,
+	}
+	for _, m := range readOnly {
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, operations.Read),
+			"usage_viewer must read %s for the usage and log views and their filters", m)
+		for _, op := range []operations.Operation{operations.Create, operations.Update, operations.Delete} {
+			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
+				"usage_viewer must not have %s on %s", op, m)
+		}
+	}
+
+	denied := []modules.Module{
+		modules.AgentNetwork,
+		modules.AgentNetworkPolicies,
+		modules.AgentNetworkGuardrails,
+		modules.AgentNetworkBudgets,
+		modules.AgentNetworkSettings,
+		modules.Networks,
+		modules.SetupKeys,
+	}
+	for _, m := range denied {
+		for _, op := range allOps {
+			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
+				"usage_viewer must not have %s on %s", op, m)
+		}
+	}
+}
+
+// TestBillingAdminRoleResolves pins that billing_admin has a proper entry
+// in the permission map. Its plan/seat/invoice permissions are enforced
+// outside this map; management-side it carries the regular User baseline
+// instead of failing role resolution.
+func TestBillingAdminRoleResolves(t *testing.T) {
+	manager := NewManager(nil)
+	ctx := context.Background()
+
+	role, ok := roles.RolesMap[types.UserRoleBillingAdmin]
+	require.True(t, ok, "billing_admin must exist in RolesMap")
+
+	permissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleBillingAdmin)
+	require.NoError(t, err, "billing_admin role must resolve")
+	require.NotEmpty(t, permissions)
+
+	for _, m := range []modules.Module{modules.AgentNetwork, modules.Networks, modules.Users, modules.Peers} {
+		for _, op := range allOps {
+			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
+				"billing_admin must not have %s on %s", op, m)
+		}
+	}
+}
+
+// TestNewRolesParse pins the API role strings, which are permanent once
+// released.
+func TestNewRolesParse(t *testing.T) {
+	assert.Equal(t, types.UserRoleAgentNetworkAdmin, types.StrRoleToUserRole("agent_network_admin"))
+	assert.Equal(t, types.UserRoleUsageViewer, types.StrRoleToUserRole("usage_viewer"))
+	assert.Equal(t, types.UserRoleBillingAdmin, types.StrRoleToUserRole("billing_admin"))
+}
diff --git a/management/server/permissions/manager.go b/management/server/permissions/manager.go
index 995f234d8..90166acbd 100644
--- a/management/server/permissions/manager.go
+++ b/management/server/permissions/manager.go
@@ -1,6 +1,6 @@
 package permissions
 
-//go:generate go run github.com/golang/mock/mockgen -package permissions -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
+//go:generate go tool mockgen -package permissions -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
 
 import (
 	"context"
@@ -82,6 +82,9 @@ func (m *managerImpl) ValidateUserPermissions(
 	return m.ValidateRoleModuleAccess(ctx, accountID, role, module, operation), ctxEnriched, nil
 }
 
+// ValidateRoleModuleAccess resolves an operation against the role's explicit
+// grant for the module, then the grant for its parent module when the module
+// is a dotted submodule, and finally the role's AutoAllowNew default.
 func (m *managerImpl) ValidateRoleModuleAccess(
 	ctx context.Context,
 	accountID string,
@@ -89,7 +92,7 @@ func (m *managerImpl) ValidateRoleModuleAccess(
 	module modules.Module,
 	operation operations.Operation,
 ) bool {
-	if permissions, ok := role.Permissions[module]; ok {
+	if permissions, ok := lookupModulePermissions(role, module); ok {
 		if allowed, exists := permissions[operation]; exists {
 			return allowed
 		}
@@ -100,6 +103,21 @@ func (m *managerImpl) ValidateRoleModuleAccess(
 	return role.AutoAllowNew[operation]
 }
 
+// lookupModulePermissions returns the role's explicit permission set for the
+// module, falling back to the parent module's set for dotted submodules. The
+// second return reports whether any explicit set was found.
+func lookupModulePermissions(role roles.RolePermissions, module modules.Module) (map[operations.Operation]bool, bool) {
+	if permissions, ok := role.Permissions[module]; ok {
+		return permissions, true
+	}
+	if parent, hasParent := module.Parent(); hasParent {
+		if permissions, ok := role.Permissions[parent]; ok {
+			return permissions, true
+		}
+	}
+	return nil, false
+}
+
 func (m *managerImpl) ValidateAccountAccess(ctx context.Context, accountID string, user *types.User, allowOwnerAndAdmin bool) (context.Context, error) {
 	if user.AccountID != accountID {
 		return ctx, status.NewUserNotPartOfAccountError()
@@ -119,7 +137,7 @@ func (m *managerImpl) GetPermissionsByRole(ctx context.Context, role types.UserR
 	permissions := roles.Permissions{}
 
 	for k := range modules.All {
-		if rolePermissions, ok := roleMap.Permissions[k]; ok {
+		if rolePermissions, ok := lookupModulePermissions(roleMap, k); ok {
 			permissions[k] = rolePermissions
 			continue
 		}
diff --git a/management/server/permissions/manager_mock.go b/management/server/permissions/manager_mock.go
index 934e33398..251e456d4 100644
--- a/management/server/permissions/manager_mock.go
+++ b/management/server/permissions/manager_mock.go
@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: ./manager.go
+//
+// Generated by this command:
+//
+//	mockgen -package permissions -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
+//
 
 // Package permissions is a generated GoMock package.
 package permissions
@@ -8,18 +13,19 @@ import (
 	context "context"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
 	account "github.com/netbirdio/netbird/management/server/account"
 	modules "github.com/netbirdio/netbird/management/server/permissions/modules"
 	operations "github.com/netbirdio/netbird/management/server/permissions/operations"
 	roles "github.com/netbirdio/netbird/management/server/permissions/roles"
 	types "github.com/netbirdio/netbird/management/server/types"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockManager is a mock of Manager interface.
 type MockManager struct {
 	ctrl     *gomock.Controller
 	recorder *MockManagerMockRecorder
+	isgomock struct{}
 }
 
 // MockManagerMockRecorder is the mock recorder for MockManager.
@@ -49,7 +55,7 @@ func (m *MockManager) GetPermissionsByRole(ctx context.Context, role types.UserR
 }
 
 // GetPermissionsByRole indicates an expected call of GetPermissionsByRole.
-func (mr *MockManagerMockRecorder) GetPermissionsByRole(ctx, role interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPermissionsByRole(ctx, role any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPermissionsByRole", reflect.TypeOf((*MockManager)(nil).GetPermissionsByRole), ctx, role)
 }
@@ -61,7 +67,7 @@ func (m *MockManager) SetAccountManager(accountManager account.Manager) {
 }
 
 // SetAccountManager indicates an expected call of SetAccountManager.
-func (mr *MockManagerMockRecorder) SetAccountManager(accountManager interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) SetAccountManager(accountManager any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetAccountManager", reflect.TypeOf((*MockManager)(nil).SetAccountManager), accountManager)
 }
@@ -76,7 +82,7 @@ func (m *MockManager) ValidateAccountAccess(ctx context.Context, accountID strin
 }
 
 // ValidateAccountAccess indicates an expected call of ValidateAccountAccess.
-func (mr *MockManagerMockRecorder) ValidateAccountAccess(ctx, accountID, user, allowOwnerAndAdmin interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ValidateAccountAccess(ctx, accountID, user, allowOwnerAndAdmin any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateAccountAccess", reflect.TypeOf((*MockManager)(nil).ValidateAccountAccess), ctx, accountID, user, allowOwnerAndAdmin)
 }
@@ -90,7 +96,7 @@ func (m *MockManager) ValidateRoleModuleAccess(ctx context.Context, accountID st
 }
 
 // ValidateRoleModuleAccess indicates an expected call of ValidateRoleModuleAccess.
-func (mr *MockManagerMockRecorder) ValidateRoleModuleAccess(ctx, accountID, role, module, operation interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ValidateRoleModuleAccess(ctx, accountID, role, module, operation any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateRoleModuleAccess", reflect.TypeOf((*MockManager)(nil).ValidateRoleModuleAccess), ctx, accountID, role, module, operation)
 }
@@ -106,7 +112,7 @@ func (m *MockManager) ValidateUserPermissions(ctx context.Context, accountID, us
 }
 
 // ValidateUserPermissions indicates an expected call of ValidateUserPermissions.
-func (mr *MockManagerMockRecorder) ValidateUserPermissions(ctx, accountID, userID, module, operation interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) ValidateUserPermissions(ctx, accountID, userID, module, operation any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateUserPermissions", reflect.TypeOf((*MockManager)(nil).ValidateUserPermissions), ctx, accountID, userID, module, operation)
 }
diff --git a/management/server/permissions/manager_test.go b/management/server/permissions/manager_test.go
new file mode 100644
index 000000000..345212f43
--- /dev/null
+++ b/management/server/permissions/manager_test.go
@@ -0,0 +1,139 @@
+package permissions
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/permissions/roles"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+func TestValidateRoleModuleAccessSubmoduleCascade(t *testing.T) {
+	manager := NewManager(nil)
+	ctx := context.Background()
+
+	fullAccess := map[operations.Operation]bool{
+		operations.Read:   true,
+		operations.Create: true,
+		operations.Update: true,
+		operations.Delete: true,
+	}
+	readOnly := map[operations.Operation]bool{
+		operations.Read:   true,
+		operations.Create: false,
+		operations.Update: false,
+		operations.Delete: false,
+	}
+	denyAll := map[operations.Operation]bool{
+		operations.Read:   false,
+		operations.Create: false,
+		operations.Update: false,
+		operations.Delete: false,
+	}
+
+	t.Run("parent grant covers submodules", func(t *testing.T) {
+		role := roles.RolePermissions{
+			AutoAllowNew: denyAll,
+			Permissions:  roles.Permissions{modules.AgentNetwork: fullAccess},
+		}
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Create),
+			"parent full grant should allow create on a submodule")
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkLogs, operations.Read),
+			"parent full grant should allow read on a submodule")
+	})
+
+	t.Run("submodule grant does not leak to parent or siblings", func(t *testing.T) {
+		role := roles.RolePermissions{
+			AutoAllowNew: denyAll,
+			Permissions:  roles.Permissions{modules.AgentNetworkUsage: readOnly},
+		}
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Read),
+			"explicit submodule read should be allowed")
+		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Create),
+			"read-only submodule grant should not allow create")
+		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetwork, operations.Read),
+			"submodule grant should not grant the parent module")
+		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Read),
+			"submodule grant should not grant a sibling submodule")
+	})
+
+	t.Run("explicit submodule entry wins over parent grant", func(t *testing.T) {
+		role := roles.RolePermissions{
+			AutoAllowNew: denyAll,
+			Permissions: roles.Permissions{
+				modules.AgentNetwork:     fullAccess,
+				modules.AgentNetworkLogs: denyAll,
+			},
+		}
+		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkLogs, operations.Read),
+			"explicit submodule deny should override the parent grant")
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Read),
+			"sibling submodules should still resolve through the parent grant")
+	})
+
+	t.Run("auto allow applies when neither submodule nor parent is granted", func(t *testing.T) {
+		role := roles.RolePermissions{
+			AutoAllowNew: readOnly,
+		}
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Read),
+			"auto-allow read should apply to submodules")
+		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Delete),
+			"auto-allow should not grant unlisted operations")
+	})
+}
+
+// TestExistingRolesKeepAgentNetworkBehaviorOnSubmodules pins the behavior the
+// submodule split must not change: every built-in role resolves the new
+// submodules exactly as it resolved the agent_network module before.
+func TestExistingRolesKeepAgentNetworkBehaviorOnSubmodules(t *testing.T) {
+	manager := NewManager(nil)
+	ctx := context.Background()
+
+	submodules := []modules.Module{
+		modules.AgentNetworkProviders,
+		modules.AgentNetworkPolicies,
+		modules.AgentNetworkGuardrails,
+		modules.AgentNetworkBudgets,
+		modules.AgentNetworkUsage,
+		modules.AgentNetworkLogs,
+		modules.AgentNetworkSettings,
+	}
+	allOperations := []operations.Operation{operations.Read, operations.Create, operations.Update, operations.Delete}
+
+	for _, role := range []types.UserRole{types.UserRoleOwner, types.UserRoleAdmin, types.UserRoleAuditor, types.UserRoleNetworkAdmin, types.UserRoleUser} {
+		rolePermissions, ok := roles.RolesMap[role]
+		require.True(t, ok, "role %s must exist in RolesMap", role)
+
+		for _, sub := range submodules {
+			for _, op := range allOperations {
+				expected := manager.ValidateRoleModuleAccess(ctx, "account", rolePermissions, modules.AgentNetwork, op)
+				actual := manager.ValidateRoleModuleAccess(ctx, "account", rolePermissions, sub, op)
+				assert.Equal(t, expected, actual, "role %s: %s on %s should match the agent_network module", role, op, sub)
+			}
+		}
+	}
+}
+
+func TestGetPermissionsByRoleIncludesSubmodules(t *testing.T) {
+	manager := NewManager(nil)
+	ctx := context.Background()
+
+	permissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleAuditor)
+	require.NoError(t, err, "auditor role must resolve")
+
+	usage, ok := permissions[modules.AgentNetworkUsage]
+	require.True(t, ok, "permissions map should contain the usage submodule")
+	assert.True(t, usage[operations.Read], "auditor should read the usage submodule")
+	assert.False(t, usage[operations.Update], "auditor should not update the usage submodule")
+
+	adminPermissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleAdmin)
+	require.NoError(t, err, "admin role must resolve")
+	providers, ok := adminPermissions[modules.AgentNetworkProviders]
+	require.True(t, ok, "permissions map should contain the providers submodule")
+	assert.True(t, providers[operations.Delete], "admin should delete on the providers submodule")
+}
diff --git a/management/server/permissions/modules/module.go b/management/server/permissions/modules/module.go
index a3a9c554d..8a2a1a52d 100644
--- a/management/server/permissions/modules/module.go
+++ b/management/server/permissions/modules/module.go
@@ -1,5 +1,7 @@
 package modules
 
+import "strings"
+
 type Module string
 
 const (
@@ -20,6 +22,17 @@ const (
 	IdentityProviders Module = "identity_providers"
 	Services          Module = "services"
 	AgentNetwork      Module = "agent_network"
+
+	// Agent Network submodules. A role may grant one of these directly
+	// or grant the AgentNetwork parent, which covers all of them (see
+	// permissions.Manager cascade resolution).
+	AgentNetworkProviders  Module = "agent_network.providers"
+	AgentNetworkPolicies   Module = "agent_network.policies"
+	AgentNetworkGuardrails Module = "agent_network.guardrails"
+	AgentNetworkBudgets    Module = "agent_network.budgets"
+	AgentNetworkUsage      Module = "agent_network.usage"
+	AgentNetworkLogs       Module = "agent_network.logs"
+	AgentNetworkSettings   Module = "agent_network.settings"
 )
 
 var All = map[Module]struct{}{
@@ -40,4 +53,21 @@ var All = map[Module]struct{}{
 	IdentityProviders: {},
 	Services:          {},
 	AgentNetwork:      {},
+
+	AgentNetworkProviders:  {},
+	AgentNetworkPolicies:   {},
+	AgentNetworkGuardrails: {},
+	AgentNetworkBudgets:    {},
+	AgentNetworkUsage:      {},
+	AgentNetworkLogs:       {},
+	AgentNetworkSettings:   {},
+}
+
+// Parent returns the module owning a dotted submodule name and true, or the
+// module itself and false when it has no parent.
+func (m Module) Parent() (Module, bool) {
+	if i := strings.IndexByte(string(m), '.'); i > 0 {
+		return Module(string(m)[:i]), true
+	}
+	return m, false
 }
diff --git a/management/server/permissions/roles/agent_network_admin.go b/management/server/permissions/roles/agent_network_admin.go
new file mode 100644
index 000000000..0f48500ec
--- /dev/null
+++ b/management/server/permissions/roles/agent_network_admin.go
@@ -0,0 +1,62 @@
+package roles
+
+import (
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// AgentNetworkAdmin is the delegated administrator for the Agent Network
+// area: full control over providers, policies, guardrails, budgets, usage,
+// logs, and its settings, plus read-only visibility into the account
+// objects needed to build policies (users, groups, peers) and the account
+// settings/meta read the dashboard needs to boot (GET /api/accounts
+// validates Settings read, same as network_admin). Nothing else in the
+// account is visible.
+var AgentNetworkAdmin = RolePermissions{
+	Role: types.UserRoleAgentNetworkAdmin,
+	AutoAllowNew: map[operations.Operation]bool{
+		operations.Read:   false,
+		operations.Create: false,
+		operations.Update: false,
+		operations.Delete: false,
+	},
+	Permissions: Permissions{
+		modules.AgentNetwork: {
+			operations.Read:   true,
+			operations.Create: true,
+			operations.Update: true,
+			operations.Delete: true,
+		},
+		modules.Users: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+		modules.Groups: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+		modules.Peers: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+		modules.Accounts: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+		modules.Settings: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+	},
+}
diff --git a/management/server/permissions/roles/billing_admin.go b/management/server/permissions/roles/billing_admin.go
new file mode 100644
index 000000000..22597b587
--- /dev/null
+++ b/management/server/permissions/roles/billing_admin.go
@@ -0,0 +1,20 @@
+package roles
+
+import (
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// BillingAdmin manages plans, seats, and invoices, which are enforced
+// outside this permission map (NetBird Cloud). Management-side it carries
+// the regular User baseline; the explicit entry keeps role resolution from
+// failing with a role-not-found error.
+var BillingAdmin = RolePermissions{
+	Role: types.UserRoleBillingAdmin,
+	AutoAllowNew: map[operations.Operation]bool{
+		operations.Read:   false,
+		operations.Create: false,
+		operations.Update: false,
+		operations.Delete: false,
+	},
+}
diff --git a/management/server/permissions/roles/role_permissions.go b/management/server/permissions/roles/role_permissions.go
index 754e568f5..517f07ff3 100644
--- a/management/server/permissions/roles/role_permissions.go
+++ b/management/server/permissions/roles/role_permissions.go
@@ -15,9 +15,12 @@ type RolePermissions struct {
 type Permissions map[modules.Module]map[operations.Operation]bool
 
 var RolesMap = map[types.UserRole]RolePermissions{
-	types.UserRoleOwner:        Owner,
-	types.UserRoleAdmin:        Admin,
-	types.UserRoleUser:         User,
-	types.UserRoleAuditor:      Auditor,
-	types.UserRoleNetworkAdmin: NetworkAdmin,
+	types.UserRoleOwner:             Owner,
+	types.UserRoleAdmin:             Admin,
+	types.UserRoleUser:              User,
+	types.UserRoleAuditor:           Auditor,
+	types.UserRoleNetworkAdmin:      NetworkAdmin,
+	types.UserRoleAgentNetworkAdmin: AgentNetworkAdmin,
+	types.UserRoleUsageViewer:       UsageViewer,
+	types.UserRoleBillingAdmin:      BillingAdmin,
 }
diff --git a/management/server/permissions/roles/usage_viewer.go b/management/server/permissions/roles/usage_viewer.go
new file mode 100644
index 000000000..ab35a24db
--- /dev/null
+++ b/management/server/permissions/roles/usage_viewer.go
@@ -0,0 +1,65 @@
+package roles
+
+import (
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// UsageViewer is the regular User baseline plus read access to the
+// aggregated Agent Network usage and cost overview and to the account-wide
+// request-level access logs (which can contain captured prompts), and
+// read-only access to the resources the usage and log filters and display
+// columns resolve against: users and groups (identity filters and name
+// resolution), peers (agent principals in the caller column), and the
+// provider list (provider and model filter options — the manager redacts
+// connection config such as upstream URLs and operator-supplied header
+// values for callers holding read without update). It sees no policies,
+// guardrails, budgets, or Agent Network settings.
+var UsageViewer = RolePermissions{
+	Role: types.UserRoleUsageViewer,
+	AutoAllowNew: map[operations.Operation]bool{
+		operations.Read:   false,
+		operations.Create: false,
+		operations.Update: false,
+		operations.Delete: false,
+	},
+	Permissions: Permissions{
+		modules.AgentNetworkUsage: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+		modules.AgentNetworkLogs: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+		modules.AgentNetworkProviders: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+		modules.Users: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+		modules.Groups: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+		modules.Peers: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
+	},
+}
diff --git a/management/server/policy.go b/management/server/policy.go
index 187c879cb..30b101aae 100644
--- a/management/server/policy.go
+++ b/management/server/policy.go
@@ -67,10 +67,13 @@ func (am *DefaultAccountManager) SavePolicy(ctx context.Context, accountID, user
 
 			action = activity.PolicyUpdated
 
+			policy.PublicID = existingPolicy.PublicID
+
 			if err = transaction.SavePolicy(ctx, policy); err != nil {
 				return err
 			}
 		} else {
+			policy.PublicID = xid.New().String()
 			if err = transaction.CreatePolicy(ctx, policy); err != nil {
 				return err
 			}
diff --git a/management/server/policy_test.go b/management/server/policy_test.go
index 6fb573b9e..7607a7567 100644
--- a/management/server/policy_test.go
+++ b/management/server/policy_test.go
@@ -1135,287 +1135,291 @@ func sortFunc() func(a *types.FirewallRule, b *types.FirewallRule) int {
 }
 
 func TestPolicyAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{peer1.ID, peer2.ID},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	var policyWithGroupRulesNoPeers *types.Policy
-	var policyWithDestinationPeersOnly *types.Policy
-	var policyWithSourceAndDestinationPeers *types.Policy
-	var err error
-
-	// Saving policy with rule groups with no peers should not update account's peers and not send peer update
-	t.Run("saving policy with rule groups with no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithGroupRulesNoPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupB"},
-					Destinations:  []string{"groupC"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer3.ID},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Saving policy with source group containing peers, but destination group without peers should
-	// update account's peers and send peer update
-	t.Run("saving policy where source has peers but destination does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupB"},
-					Protocol:      types.PolicyRuleProtocolTCP,
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Saving policy with destination group containing peers, but source group without peers should
-	// update account's peers and send peer update
-	t.Run("saving policy where destination has peers but source does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithDestinationPeersOnly, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupC"},
-					Destinations:  []string{"groupD"},
-					Bidirectional: true,
-					Protocol:      types.PolicyRuleProtocolTCP,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Saving policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("saving policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupD"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{peer1.ID, peer2.ID},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
 		}
-	})
-
-	// Disabling policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("disabling policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Enabled = false
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating disabled policy with destination and source groups containing peers should still update account's peers
-	// because affected peer resolution does not filter by policy enabled state
-	t.Run("updating disabled policy with source and destination groups with peers", func(t *testing.T) {
-		drainPeerUpdates(updMsg)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Description = "updated description"
-		policyWithSourceAndDestinationPeers.Rules[0].Destinations = []string{"groupA"}
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Enabling policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("enabling policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Enabled = true
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting policy should trigger account peers update and send peer update
-	t.Run("deleting policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithSourceAndDestinationPeers.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
 
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
+
+		var policyWithGroupRulesNoPeers *types.Policy
+		var policyWithDestinationPeersOnly *types.Policy
+		var policyWithSourceAndDestinationPeers *types.Policy
+		var err error
+
+		// Saving policy with rule groups with no peers should not update account's peers and not send peer update
+		step(t, "saving policy with rule groups with no peers", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithGroupRulesNoPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupC"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Saving policy with source group containing peers, but destination group without peers should
+		// update account's peers and send peer update
+		step(t, "saving policy where source has peers but destination does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupB"},
+						Protocol:      types.PolicyRuleProtocolTCP,
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Saving policy with destination group containing peers, but source group without peers should
+		// update account's peers and send peer update
+		step(t, "saving policy where destination has peers but source does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithDestinationPeersOnly, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupC"},
+						Destinations:  []string{"groupD"},
+						Bidirectional: true,
+						Protocol:      types.PolicyRuleProtocolTCP,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Saving policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "saving policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupD"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Disabling policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "disabling policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Enabled = false
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating disabled policy with destination and source groups containing peers should still update account's peers
+		// because affected peer resolution does not filter by policy enabled state
+		step(t, "updating disabled policy with source and destination groups with peers", func(t *testing.T) {
+			drainPeerUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Description = "updated description"
+			policyWithSourceAndDestinationPeers.Rules[0].Destinations = []string{"groupA"}
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Enabling policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "enabling policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Enabled = true
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting policy should trigger account peers update and send peer update
+		step(t, "deleting policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithSourceAndDestinationPeers.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+
+		})
+
+		// Deleting policy with destination group containing peers, but source group without peers should
+		// update account's peers and send peer update
+		step(t, "deleting policy where destination has peers but source does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithDestinationPeersOnly.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting policy with no peers in groups should not update account's peers and not send peer update
+		step(t, "deleting policy with no peers in groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithGroupRulesNoPeers.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
 	})
-
-	// Deleting policy with destination group containing peers, but source group without peers should
-	// update account's peers and send peer update
-	t.Run("deleting policy where destination has peers but source does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithDestinationPeersOnly.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting policy with no peers in groups should not update account's peers and not send peer update
-	t.Run("deleting policy with no peers in groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithGroupRulesNoPeers.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
 }
diff --git a/management/server/posture/affects_posture_test.go b/management/server/posture/affects_posture_test.go
deleted file mode 100644
index 6aa54d892..000000000
--- a/management/server/posture/affects_posture_test.go
+++ /dev/null
@@ -1,202 +0,0 @@
-package posture
-
-import (
-	"context"
-	"net"
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-)
-
-// diffFrom builds a MetaDiff from the old/new snapshots AffectsPosture replays against.
-func diffFrom(oldMeta, newMeta nbpeer.PeerSystemMeta, oldLoc, newLoc nbpeer.Location) *nbpeer.MetaDiff {
-	return &nbpeer.MetaDiff{
-		OldMeta:     oldMeta,
-		NewMeta:     newMeta,
-		OldLocation: oldLoc,
-		NewLocation: newLoc,
-	}
-}
-
-func checks(def ChecksDefinition) []*Checks {
-	return []*Checks{{Checks: def}}
-}
-
-func TestAffectsPosture_NilDiff(t *testing.T) {
-	assert.False(t, AffectsPosture(context.Background(), nil, checks(ChecksDefinition{
-		NBVersionCheck: &NBVersionCheck{MinVersion: "1.0.0"},
-	})))
-}
-
-func TestAffectsPosture_NBVersion(t *testing.T) {
-	c := checks(ChecksDefinition{NBVersionCheck: &NBVersionCheck{MinVersion: "1.2.0"}})
-
-	tests := []struct {
-		name           string
-		oldVer, newVer string
-		want           bool
-	}{
-		{"both above min, no flip", "1.3.0", "1.4.0", false},
-		{"both below min, no flip", "1.0.0", "1.1.0", false},
-		{"crosses up below->above", "1.1.0", "1.3.0", true},
-		{"crosses down above->below", "1.3.0", "1.1.0", true},
-		{"unparsable old only -> flip", "garbage", "1.3.0", true},
-		{"unparsable both -> no flip", "garbage", "junk", false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			diff := diffFrom(
-				nbpeer.PeerSystemMeta{WtVersion: tt.oldVer},
-				nbpeer.PeerSystemMeta{WtVersion: tt.newVer},
-				nbpeer.Location{}, nbpeer.Location{},
-			)
-			assert.Equal(t, tt.want, AffectsPosture(context.Background(), diff, c))
-		})
-	}
-}
-
-func TestAffectsPosture_OSVersion_KernelBumpWithinMin(t *testing.T) {
-	c := checks(ChecksDefinition{OSVersionCheck: &OSVersionCheck{
-		Linux: &MinKernelVersionCheck{MinKernelVersion: "5.0.0"},
-	}})
-
-	// Kernel moves but stays above the minimum: verdict stays pass -> not affected.
-	withinMin := diffFrom(
-		nbpeer.PeerSystemMeta{GoOS: "linux", KernelVersion: "5.10.0-arch1"},
-		nbpeer.PeerSystemMeta{GoOS: "linux", KernelVersion: "5.15.0-arch2"},
-		nbpeer.Location{}, nbpeer.Location{},
-	)
-	assert.False(t, AffectsPosture(context.Background(), withinMin, c))
-
-	// Kernel drops below the minimum: verdict flips pass -> fail -> affected.
-	crossesDown := diffFrom(
-		nbpeer.PeerSystemMeta{GoOS: "linux", KernelVersion: "5.10.0-arch1"},
-		nbpeer.PeerSystemMeta{GoOS: "linux", KernelVersion: "4.19.0-arch1"},
-		nbpeer.Location{}, nbpeer.Location{},
-	)
-	assert.True(t, AffectsPosture(context.Background(), crossesDown, c))
-}
-
-func TestAffectsPosture_OSVersion_GoOSSwitchFlipsVerdict(t *testing.T) {
-	// Only Linux is constrained. An OS outside the switch (freebsd) passes; switching to a
-	// failing linux kernel flips the verdict pass -> fail.
-	c := checks(ChecksDefinition{OSVersionCheck: &OSVersionCheck{
-		Linux: &MinKernelVersionCheck{MinKernelVersion: "6.0.0"},
-	}})
-
-	diff := diffFrom(
-		nbpeer.PeerSystemMeta{GoOS: "freebsd"},
-		nbpeer.PeerSystemMeta{GoOS: "linux", KernelVersion: "4.19.0"},
-		nbpeer.Location{}, nbpeer.Location{},
-	)
-	assert.True(t, AffectsPosture(context.Background(), diff, c))
-}
-
-func TestAffectsPosture_Process_GoOSSwitchFlipsVerdict(t *testing.T) {
-	// Process runs at a linux path. Switching GoOS to windows (no WindowsPath configured)
-	// flips the verdict.
-	c := checks(ChecksDefinition{ProcessCheck: &ProcessCheck{
-		Processes: []Process{{LinuxPath: "/usr/bin/foo"}},
-	}})
-
-	files := []nbpeer.File{{Path: "/usr/bin/foo", ProcessIsRunning: true}}
-	diff := diffFrom(
-		nbpeer.PeerSystemMeta{GoOS: "linux", Files: files},
-		nbpeer.PeerSystemMeta{GoOS: "windows", Files: files},
-		nbpeer.Location{}, nbpeer.Location{},
-	)
-	assert.True(t, AffectsPosture(context.Background(), diff, c))
-}
-
-func TestAffectsPosture_Process_UnrelatedFileChange(t *testing.T) {
-	// A tracked process stays running while an unrelated file is added: the verdict does
-	// not move, so posture is not affected.
-	c := checks(ChecksDefinition{ProcessCheck: &ProcessCheck{
-		Processes: []Process{{LinuxPath: "/usr/bin/foo"}},
-	}})
-
-	diff := diffFrom(
-		nbpeer.PeerSystemMeta{GoOS: "linux", Files: []nbpeer.File{
-			{Path: "/usr/bin/foo", ProcessIsRunning: true},
-		}},
-		nbpeer.PeerSystemMeta{GoOS: "linux", Files: []nbpeer.File{
-			{Path: "/usr/bin/foo", ProcessIsRunning: true},
-			{Path: "/usr/bin/bar", ProcessIsRunning: true},
-		}},
-		nbpeer.Location{}, nbpeer.Location{},
-	)
-	assert.False(t, AffectsPosture(context.Background(), diff, c))
-}
-
-func TestAffectsPosture_GeoLocation(t *testing.T) {
-	c := checks(ChecksDefinition{GeoLocationCheck: &GeoLocationCheck{
-		Action:    CheckActionAllow,
-		Locations: []Location{{CountryCode: "DE"}},
-	}})
-
-	// Moving within allowed countries keeps the verdict; moving out flips it.
-	stayAllowed := diffFrom(
-		nbpeer.PeerSystemMeta{}, nbpeer.PeerSystemMeta{},
-		nbpeer.Location{CountryCode: "DE", CityName: "Berlin"},
-		nbpeer.Location{CountryCode: "DE", CityName: "Munich"},
-	)
-	assert.False(t, AffectsPosture(context.Background(), stayAllowed, c))
-
-	moveOut := diffFrom(
-		nbpeer.PeerSystemMeta{}, nbpeer.PeerSystemMeta{},
-		nbpeer.Location{CountryCode: "DE"},
-		nbpeer.Location{CountryCode: "FR"},
-	)
-	assert.True(t, AffectsPosture(context.Background(), moveOut, c))
-}
-
-func TestAffectsPosture_PeerNetworkRange_ConnectionIP(t *testing.T) {
-	// The check reads the connection IP. Moving out of the allowed range flips the verdict;
-	// moving within it does not.
-	_, allowed, _ := net.ParseCIDR("10.0.0.0/8")
-	c := checks(ChecksDefinition{PeerNetworkRangeCheck: &PeerNetworkRangeCheck{
-		Action: CheckActionAllow,
-		Ranges: []netip.Prefix{netip.MustParsePrefix(allowed.String())},
-	}})
-
-	movesOutOfRange := diffFrom(
-		nbpeer.PeerSystemMeta{}, nbpeer.PeerSystemMeta{},
-		nbpeer.Location{ConnectionIP: net.ParseIP("10.1.2.3")},
-		nbpeer.Location{ConnectionIP: net.ParseIP("8.8.8.8")},
-	)
-	assert.True(t, AffectsPosture(context.Background(), movesOutOfRange, c))
-
-	staysInRange := diffFrom(
-		nbpeer.PeerSystemMeta{}, nbpeer.PeerSystemMeta{},
-		nbpeer.Location{ConnectionIP: net.ParseIP("10.1.2.3")},
-		nbpeer.Location{ConnectionIP: net.ParseIP("10.9.9.9")},
-	)
-	assert.False(t, AffectsPosture(context.Background(), staysInRange, c))
-}
-
-func TestAffectsPosture_IrrelevantFieldChange(t *testing.T) {
-	// Hostname changes but no check reads it: not affected even with checks present.
-	c := checks(ChecksDefinition{
-		NBVersionCheck:   &NBVersionCheck{MinVersion: "1.0.0"},
-		GeoLocationCheck: &GeoLocationCheck{Action: CheckActionAllow, Locations: []Location{{CountryCode: "DE"}}},
-	})
-
-	diff := diffFrom(
-		nbpeer.PeerSystemMeta{Hostname: "old", WtVersion: "1.5.0"},
-		nbpeer.PeerSystemMeta{Hostname: "new", WtVersion: "1.5.0"},
-		nbpeer.Location{CountryCode: "DE"}, nbpeer.Location{CountryCode: "DE"},
-	)
-	assert.False(t, AffectsPosture(context.Background(), diff, c))
-}
-
-func TestAffectsPosture_NoChecks(t *testing.T) {
-	diff := diffFrom(
-		nbpeer.PeerSystemMeta{WtVersion: "1.0.0"},
-		nbpeer.PeerSystemMeta{WtVersion: "2.0.0"},
-		nbpeer.Location{}, nbpeer.Location{},
-	)
-	assert.False(t, AffectsPosture(context.Background(), diff, nil))
-}
diff --git a/management/server/posture/certificate.go b/management/server/posture/certificate.go
new file mode 100644
index 000000000..cae1e8a56
--- /dev/null
+++ b/management/server/posture/certificate.go
@@ -0,0 +1,36 @@
+package posture
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// CertificateCheck passes when the peer holds a certificate, proven at meta ingestion,
+// that chains to one of the configured PEM encoded CA certificates.
+type CertificateCheck struct {
+	CACertificates []string
+}
+
+var _ Check = (*CertificateCheck)(nil)
+
+func (c *CertificateCheck) Check(_ context.Context, peer nbpeer.Peer) (bool, error) {
+	return certposture.AnyChainMatchesCAs(peer.Meta.Certificates, c.CACertificates, time.Now()), nil
+}
+
+func (c *CertificateCheck) Name() string {
+	return CertificateCheckName
+}
+
+func (c *CertificateCheck) Validate() error {
+	if len(c.CACertificates) == 0 {
+		return fmt.Errorf("%s ca certificates shouldn't be empty", c.Name())
+	}
+	if _, err := certposture.ParseCAs(c.CACertificates); err != nil {
+		return fmt.Errorf("%s: %w", c.Name(), err)
+	}
+	return nil
+}
diff --git a/management/server/posture/certificate_test.go b/management/server/posture/certificate_test.go
new file mode 100644
index 000000000..8d79fac82
--- /dev/null
+++ b/management/server/posture/certificate_test.go
@@ -0,0 +1,68 @@
+package posture
+
+import (
+	"context"
+	"crypto/x509"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+func TestCertificateCheck_Check(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	otherCA := certtest.NewCA(t, "other-root")
+	chain := certposture.EncodeChainPEM([]*x509.Certificate{ca.Issue(t, certtest.ECDSAKey(t), "device")})
+
+	tests := []struct {
+		name         string
+		certificates []string
+		cas          []string
+		want         bool
+	}{
+		{"chains to configured CA", []string{chain}, []string{ca.PEM}, true},
+		{"one of several CAs matches", []string{chain}, []string{otherCA.PEM, ca.PEM}, true},
+		{"unrelated CA", []string{chain}, []string{otherCA.PEM}, false},
+		{"no certificates proven", nil, []string{ca.PEM}, false},
+		{"garbage entry does not hide a valid one", []string{"garbage", chain}, []string{ca.PEM}, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := CertificateCheck{CACertificates: tt.cas}
+			got, err := check.Check(context.Background(), peer.Peer{Meta: peer.PeerSystemMeta{Certificates: tt.certificates}})
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestCertificateCheck_Validate(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+
+	assert.Error(t, (&CertificateCheck{}).Validate())
+	assert.Error(t, (&CertificateCheck{CACertificates: []string{"not a pem"}}).Validate())
+	assert.NoError(t, (&CertificateCheck{CACertificates: []string{ca.PEM}}).Validate())
+}
+
+func TestChecks_CertificateCheckRegistered(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	checks := &Checks{Name: "cert", Checks: ChecksDefinition{CertificateCheck: &CertificateCheck{CACertificates: []string{ca.PEM}}}}
+
+	require.NoError(t, checks.Validate())
+	require.Len(t, checks.GetChecks(), 1)
+	assert.Equal(t, CertificateCheckName, checks.GetChecks()[0].Name())
+
+	copied := checks.Copy()
+	checks.Checks.CertificateCheck.CACertificates[0] = "mutated"
+	assert.Equal(t, ca.PEM, copied.Checks.CertificateCheck.CACertificates[0])
+
+	api := checks.ToAPIResponse()
+	require.NotNil(t, api.Checks.CertificateCheck)
+	roundTrip, err := NewChecksFromAPIPostureCheck(*api)
+	require.NoError(t, err)
+	assert.Equal(t, checks.Checks.CertificateCheck.CACertificates, roundTrip.Checks.CertificateCheck.CACertificates)
+}
diff --git a/management/server/posture/checks.go b/management/server/posture/checks.go
index 23ae4efa9..b8b1b6f60 100644
--- a/management/server/posture/checks.go
+++ b/management/server/posture/checks.go
@@ -7,7 +7,6 @@ import (
 	"regexp"
 
 	"github.com/hashicorp/go-version"
-	log "github.com/sirupsen/logrus"
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -20,6 +19,7 @@ const (
 	GeoLocationCheckName      = "GeoLocationCheck"
 	PeerNetworkRangeCheckName = "PeerNetworkRangeCheck"
 	ProcessCheckName          = "ProcessCheck"
+	CertificateCheckName      = "CertificateCheck"
 
 	CheckActionAllow string = "allow"
 	CheckActionDeny  string = "deny"
@@ -49,50 +49,12 @@ type Checks struct {
 	// AccountID is a reference to the Account that this object belongs
 	AccountID string `json:"-" gorm:"index"`
 
+	PublicID string `json:"-"`
+
 	// Checks is a set of objects that perform the actual checks
 	Checks ChecksDefinition `gorm:"serializer:json"`
 }
 
-// AffectsPosture reports whether the change in diff flips the verdict of any check. It
-// replays each check against the peer's old and new state and compares verdicts, so a
-// change that moves a field but stays the right side of a threshold (e.g. a kernel bump
-// still above the minimum) does not force a re-evaluation. See verdictChanged for how an
-// evaluation error counts.
-func AffectsPosture(ctx context.Context, diff *nbpeer.MetaDiff, checks []*Checks) bool {
-	if diff == nil {
-		return false
-	}
-
-	oldPeer := nbpeer.Peer{Meta: diff.OldMeta, Location: diff.OldLocation}
-	newPeer := nbpeer.Peer{Meta: diff.NewMeta, Location: diff.NewLocation}
-
-	for _, c := range checks {
-		for _, check := range c.GetChecks() {
-			if verdictChanged(ctx, check, oldPeer, newPeer) {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// verdictChanged replays check against old and new state and reports whether the verdict
-// differs. Like callers, it treats an evaluation error as deny: two errors are the same
-// verdict (no change), an error on one side only is a flip.
-func verdictChanged(ctx context.Context, check Check, oldPeer, newPeer nbpeer.Peer) bool {
-	oldPass, oldErr := check.Check(ctx, oldPeer)
-	newPass, newErr := check.Check(ctx, newPeer)
-
-	oldVerdict := oldPass && (oldErr == nil)
-	newVerdict := newPass && (newErr == nil)
-	changed := oldVerdict != newVerdict
-
-	log.WithContext(ctx).Tracef("posture check %s replay: verdict %t -> %t (changed=%t), errs: %v -> %v",
-		check.Name(), oldVerdict, newVerdict, changed, oldErr, newErr)
-
-	return changed
-}
-
 // ChecksDefinition contains definition of actual check
 type ChecksDefinition struct {
 	NBVersionCheck        *NBVersionCheck        `json:",omitempty"`
@@ -100,6 +62,7 @@ type ChecksDefinition struct {
 	GeoLocationCheck      *GeoLocationCheck      `json:",omitempty"`
 	PeerNetworkRangeCheck *PeerNetworkRangeCheck `json:",omitempty"`
 	ProcessCheck          *ProcessCheck          `json:",omitempty"`
+	CertificateCheck      *CertificateCheck      `json:",omitempty"`
 }
 
 // Copy returns a copy of a checks definition.
@@ -152,6 +115,12 @@ func (cd ChecksDefinition) Copy() ChecksDefinition {
 		}
 		copy(cdCopy.ProcessCheck.Processes, processCheck.Processes)
 	}
+	if cd.CertificateCheck != nil {
+		cdCopy.CertificateCheck = &CertificateCheck{
+			CACertificates: make([]string, len(cd.CertificateCheck.CACertificates)),
+		}
+		copy(cdCopy.CertificateCheck.CACertificates, cd.CertificateCheck.CACertificates)
+	}
 	return cdCopy
 }
 
@@ -167,6 +136,7 @@ func (pc *Checks) Copy() *Checks {
 		Name:        pc.Name,
 		Description: pc.Description,
 		AccountID:   pc.AccountID,
+		PublicID:    pc.PublicID,
 		Checks:      pc.Checks.Copy(),
 	}
 	return checks
@@ -195,6 +165,9 @@ func (pc *Checks) GetChecks() []Check {
 	if pc.Checks.ProcessCheck != nil {
 		checks = append(checks, pc.Checks.ProcessCheck)
 	}
+	if pc.Checks.CertificateCheck != nil {
+		checks = append(checks, pc.Checks.CertificateCheck)
+	}
 	return checks
 }
 
@@ -250,6 +223,10 @@ func buildPostureCheck(postureChecksID string, name string, description string,
 		postureChecks.Checks.ProcessCheck = toProcessCheck(processCheck)
 	}
 
+	if certificateCheck := checks.CertificateCheck; certificateCheck != nil {
+		postureChecks.Checks.CertificateCheck = &CertificateCheck{CACertificates: certificateCheck.CaCertificates}
+	}
+
 	return &postureChecks, nil
 }
 
@@ -284,6 +261,10 @@ func (pc *Checks) ToAPIResponse() *api.PostureCheck {
 		checks.ProcessCheck = toProcessCheckResponse(pc.Checks.ProcessCheck)
 	}
 
+	if pc.Checks.CertificateCheck != nil {
+		checks.CertificateCheck = &api.CertificateCheck{CaCertificates: pc.Checks.CertificateCheck.CACertificates}
+	}
+
 	return &api.PostureCheck{
 		Id:          pc.ID,
 		Name:        pc.Name,
diff --git a/management/server/posture/nb_version.go b/management/server/posture/nb_version.go
index 6e4757021..3cace3b5f 100644
--- a/management/server/posture/nb_version.go
+++ b/management/server/posture/nb_version.go
@@ -3,11 +3,9 @@ package posture
 import (
 	"context"
 	"fmt"
-	"strings"
-
-	"github.com/hashicorp/go-version"
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	nbversion "github.com/netbirdio/netbird/version"
 )
 
 type NBVersionCheck struct {
@@ -16,14 +14,8 @@ type NBVersionCheck struct {
 
 var _ Check = (*NBVersionCheck)(nil)
 
-// sanitizeVersion removes anything after the pre-release tag (e.g., "-dev", "-alpha", etc.)
-func sanitizeVersion(version string) string {
-	parts := strings.Split(version, "-")
-	return parts[0]
-}
-
 func (n *NBVersionCheck) Check(ctx context.Context, peer nbpeer.Peer) (bool, error) {
-	meetsMin, err := MeetsMinVersion(n.MinVersion, peer.Meta.WtVersion)
+	meetsMin, err := nbversion.MeetsMinVersion(n.MinVersion, peer.Meta.WtVersion)
 	if err != nil {
 		return false, err
 	}
@@ -48,21 +40,3 @@ func (n *NBVersionCheck) Validate() error {
 	}
 	return nil
 }
-
-// MeetsMinVersion checks if the peer's version meets or exceeds the minimum required version
-func MeetsMinVersion(minVer, peerVer string) (bool, error) {
-	peerVer = sanitizeVersion(peerVer)
-	minVer = sanitizeVersion(minVer)
-
-	peerNBVer, err := version.NewVersion(peerVer)
-	if err != nil {
-		return false, err
-	}
-
-	constraints, err := version.NewConstraint(">= " + minVer)
-	if err != nil {
-		return false, err
-	}
-
-	return constraints.Check(peerNBVer), nil
-}
diff --git a/management/server/posture/nb_version_test.go b/management/server/posture/nb_version_test.go
index d3478afc2..1bf485453 100644
--- a/management/server/posture/nb_version_test.go
+++ b/management/server/posture/nb_version_test.go
@@ -139,68 +139,3 @@ func TestNBVersionCheck_Validate(t *testing.T) {
 		})
 	}
 }
-
-func TestMeetsMinVersion(t *testing.T) {
-	tests := []struct {
-		name    string
-		minVer  string
-		peerVer string
-		want    bool
-		wantErr bool
-	}{
-		{
-			name:    "Peer version greater than min version",
-			minVer:  "0.26.0",
-			peerVer: "0.60.1",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version equals min version",
-			minVer:  "1.0.0",
-			peerVer: "1.0.0",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version less than min version",
-			minVer:  "1.0.0",
-			peerVer: "0.9.9",
-			want:    false,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version with pre-release tag greater than min version",
-			minVer:  "1.0.0",
-			peerVer: "1.0.1-alpha",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Invalid peer version format",
-			minVer:  "1.0.0",
-			peerVer: "dev",
-			want:    false,
-			wantErr: true,
-		},
-		{
-			name:    "Invalid min version format",
-			minVer:  "invalid.version",
-			peerVer: "1.0.0",
-			want:    false,
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := MeetsMinVersion(tt.minVer, tt.peerVer)
-			if tt.wantErr {
-				assert.Error(t, err)
-			} else {
-				assert.NoError(t, err)
-			}
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}
diff --git a/management/server/posture_checks.go b/management/server/posture_checks.go
index 1d962438c..081226866 100644
--- a/management/server/posture_checks.go
+++ b/management/server/posture_checks.go
@@ -52,7 +52,15 @@ func (am *DefaultAccountManager) SavePostureChecks(ctx context.Context, accountI
 		}
 
 		if isUpdate {
+			existing, err := transaction.GetPostureChecksByID(ctx, store.LockingStrengthNone, accountID, postureChecks.ID)
+			if err != nil {
+				return err
+			}
+			postureChecks.PublicID = existing.PublicID
+
 			action = activity.PostureCheckUpdated
+		} else {
+			postureChecks.PublicID = xid.New().String()
 		}
 
 		postureChecks.AccountID = accountID
diff --git a/management/server/posture_checks_test.go b/management/server/posture_checks_test.go
index abf0b3237..601294eda 100644
--- a/management/server/posture_checks_test.go
+++ b/management/server/posture_checks_test.go
@@ -123,324 +123,334 @@ func initTestPostureChecksAccount(am *DefaultAccountManager) (*types.Account, er
 }
 
 func TestPostureCheckAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	postureCheckA := &posture.Checks{
-		Name:      "postureCheckA",
-		AccountID: account.Id,
-		Checks: posture.ChecksDefinition{
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
-				},
-			},
-		},
-	}
-	postureCheckA, err := manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckA, true)
-	require.NoError(t, err)
-
-	postureCheckB := &posture.Checks{
-		Name:      "postureCheckB",
-		AccountID: account.Id,
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.28.0",
-			},
-		},
-	}
-
-	// Saving unused posture check should not update account peers and not send peer update
-	t.Run("saving unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating unused posture check should not update account peers and not send peer update
-	t.Run("updating unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
-		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
+		g := []*types.Group{
 			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
 			},
-		},
-		SourcePostureChecks: []string{postureCheckB.ID},
-	}
-
-	// Linking posture check to policy should trigger update account peers and send peer update
-	t.Run("linking posture check to policy with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policy, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating linked posture checks should update account peers and send peer update
-	t.Run("updating linked to posture check with peers", func(t *testing.T) {
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
 			},
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
-				},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
 			},
 		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
-	})
 
-	// Removing posture check from policy should trigger account peers update and send peer update
-	t.Run("removing posture check from policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policy.SourcePostureChecks = []string{}
-		_, err := manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting unused posture check should not trigger account peers update and not send peer update
-	t.Run("deleting unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePostureChecks(context.Background(), account.Id, postureCheckA.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-	assert.NoError(t, err)
-
-	// Updating linked posture check to policy with no peers should not trigger account peers update and not send peer update
-	t.Run("updating linked posture check to policy with no peers", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupB"},
-					Destinations:  []string{"groupC"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
-			},
-			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
-		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating linked posture check to policy where destination has peers but source does not
-	// should trigger account peers update and send peer update
-	t.Run("updating linked posture check to policy where destination has peers but source does not", func(t *testing.T) {
-		updMsg1 := updateManager.CreateChannel(context.Background(), peer2.ID)
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 		t.Cleanup(func() {
-			updateManager.CloseChannel(context.Background(), peer2.ID)
+			updateManager.CloseChannel(context.Background(), peer1.ID)
 		})
 
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+		postureCheckA := &posture.Checks{
+			Name:      "postureCheckA",
+			AccountID: account.Id,
+			Checks: posture.ChecksDefinition{
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
+					},
+				},
+			},
+		}
+		postureCheckA, err := manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckA, true)
+		require.NoError(t, err)
+
+		postureCheckB := &posture.Checks{
+			Name:      "postureCheckB",
+			AccountID: account.Id,
+			Checks: posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.28.0",
+				},
+			},
+		}
+
+		// Saving unused posture check should not update account peers and not send peer update
+		step(t, "saving unused posture check", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Updating unused posture check should not update account peers and not send peer update
+		step(t, "updating unused posture check", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		policy := &types.Policy{
 			Enabled: true,
 			Rules: []*types.PolicyRule{
 				{
 					Enabled:       true,
-					Sources:       []string{"groupB"},
+					Sources:       []string{"groupA"},
 					Destinations:  []string{"groupA"},
 					Bidirectional: true,
 					Action:        types.PolicyTrafficActionAccept,
 				},
 			},
 			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
 		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Linking posture check to policy should trigger update account peers and send peer update
+		step(t, "linking posture check to policy with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Updating linked client posture check to policy where source has peers but destination does not,
-	// should trigger account peers update and send peer update
-	t.Run("updating linked posture check to policy where source has peers but destination does not", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupB"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
+			policy, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating linked posture checks should update account peers and send peer update
+		step(t, "updating linked to posture check with peers", func(t *testing.T) {
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
 				},
-			},
-			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{
-						LinuxPath: "/usr/bin/netbird",
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
 					},
 				},
-			},
-		}
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Removing posture check from policy should trigger account peers update and send peer update
+		step(t, "removing posture check from policy", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policy.SourcePostureChecks = []string{}
+			_, err := manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting unused posture check should not trigger account peers update and not send peer update
+		step(t, "deleting unused posture check", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePostureChecks(context.Background(), account.Id, postureCheckA.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
 		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Updating linked posture check to policy with no peers should not trigger account peers update and not send peer update
+		step(t, "updating linked posture check to policy with no peers", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupC"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Updating linked posture check to policy where destination has peers but source does not
+		// should trigger account peers update and send peer update
+		step(t, "updating linked posture check to policy where destination has peers but source does not", func(t *testing.T) {
+			updMsg1 := updateManager.CreateChannel(context.Background(), peer2.ID)
+			t.Cleanup(func() {
+				updateManager.CloseChannel(context.Background(), peer2.ID)
+			})
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupA"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg, updMsg1)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating linked client posture check to policy where source has peers but destination does not,
+		// should trigger account peers update and send peer update
+		step(t, "updating linked posture check to policy where source has peers but destination does not", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupB"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{
+							LinuxPath: "/usr/bin/netbird",
+						},
+					},
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 
@@ -563,3 +573,61 @@ func TestArePostureCheckChangesAffectPeers(t *testing.T) {
 		assert.Empty(t, directPeerIDs)
 	})
 }
+
+// TestSavePostureChecks_AllocatesSeqIDOnCreate verifies that the create path
+// (no incoming ID) allocates a non-zero AccountSeqID via the
+// account_seq_counters table.
+func TestSavePostureChecks_AllocatesSeqIDOnCreate(t *testing.T) {
+	am, _, err := createManager(t)
+	require.NoError(t, err)
+
+	account, err := initTestPostureChecksAccount(am)
+	require.NoError(t, err)
+
+	created, err := am.SavePostureChecks(context.Background(), account.Id, adminUserID, &posture.Checks{
+		Name: "seq-allocation-test",
+		Checks: posture.ChecksDefinition{
+			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.26.0"},
+		},
+	}, true)
+	require.NoError(t, err)
+	require.NotEqual(t, "", created.PublicID, "SavePostureChecks on create must create PublicID")
+}
+
+// TestSavePostureChecks_PreservesSeqIDOnUpdate verifies the update path does
+// not reset AccountSeqID even when the caller passes a zero value (REST
+// handler shape, because the field is `json:"-"`).
+func TestSavePostureChecks_PreservesSeqIDOnUpdate(t *testing.T) {
+	am, _, err := createManager(t)
+	require.NoError(t, err)
+
+	account, err := initTestPostureChecksAccount(am)
+	require.NoError(t, err)
+
+	created, err := am.SavePostureChecks(context.Background(), account.Id, adminUserID, &posture.Checks{
+		Name: "seq-preserve-original",
+		Checks: posture.ChecksDefinition{
+			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.26.0"},
+		},
+	}, true)
+	require.NoError(t, err)
+	originalPublicID := created.PublicID
+	require.NotEqual(t, "", originalPublicID)
+
+	update := &posture.Checks{
+		ID:   created.ID,
+		Name: "seq-preserve-renamed",
+		Checks: posture.ChecksDefinition{
+			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.27.0"},
+		},
+	}
+	require.Equal(t, "", update.PublicID, "incoming struct must mirror an HTTP handler shape")
+
+	_, err = am.SavePostureChecks(context.Background(), account.Id, adminUserID, update, false)
+	require.NoError(t, err)
+
+	got, err := am.GetPostureChecks(context.Background(), account.Id, created.ID, adminUserID)
+	require.NoError(t, err)
+	require.Equal(t, originalPublicID, got.PublicID, "PublicID must survive SavePostureChecks update")
+	require.Equal(t, "seq-preserve-renamed", got.Name)
+}
diff --git a/management/server/route.go b/management/server/route.go
index 08e1489b2..5a55bf2b3 100644
--- a/management/server/route.go
+++ b/management/server/route.go
@@ -175,6 +175,8 @@ func (am *DefaultAccountManager) CreateRoute(ctx context.Context, accountID stri
 			return err
 		}
 
+		newRoute.PublicID = xid.New().String()
+
 		if err = transaction.SaveRoute(ctx, newRoute); err != nil {
 			return err
 		}
@@ -222,6 +224,7 @@ func (am *DefaultAccountManager) SaveRoute(ctx context.Context, accountID, userI
 		}
 
 		routeToSave.AccountID = accountID
+		routeToSave.PublicID = oldRoute.PublicID
 
 		if err = transaction.SaveRoute(ctx, routeToSave); err != nil {
 			return err
diff --git a/management/server/route_test.go b/management/server/route_test.go
index 5ae18c253..d4bfa417e 100644
--- a/management/server/route_test.go
+++ b/management/server/route_test.go
@@ -6,10 +6,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/rs/xid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -1201,7 +1200,7 @@ func TestGetNetworkMap_RouteSync(t *testing.T) {
 	peer1Routes, err := am.GetNetworkMap(context.Background(), peer1ID)
 	require.NoError(t, err)
 	require.Len(t, peer1Routes.Routes, 1, "we should receive one route for peer1")
-	require.True(t, expectedRoute.Equal(peer1Routes.Routes[0]), "received route should be equal")
+	require.True(t, types.TwinRoute(expectedRoute).Equal(peer1Routes.Routes[0]), "received route should be equal")
 
 	peer2Routes, err := am.GetNetworkMap(context.Background(), peer2ID)
 	require.NoError(t, err)
@@ -1262,7 +1261,10 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 	}
 	eventStore := &activity.InMemoryEventStore{}
 
-	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	metrics, err := telemetry.NewDefaultAppMetrics(ctx)
 	require.NoError(t, err)
 
 	ctrl := gomock.NewController(t)
@@ -1290,21 +1292,22 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 	permissionsManager := permissions.NewManager(store)
 	peersManager := peers.NewManager(store, permissionsManager)
 
-	ctx := context.Background()
-
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
+	// A go-cache janitor only stops through a GC finalizer, which would leave synctest bubbles with a goroutine that never exits.
+	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100)
 	if err != nil {
 		return nil, nil, err
 	}
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{})
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(ctx, nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
+	cacheManager := am.cacheManager
+	t.Cleanup(func() { _ = cacheManager.Close() })
 	return am, updateManager, nil
 }
 
@@ -1893,265 +1896,269 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {
 }
 
 func TestRouteAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, err := createRouterManager(t)
-	require.NoError(t, err, "failed to create account manager")
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, err := createRouterManager(t)
+		require.NoError(t, err, "failed to create account manager")
 
-	account, err := initTestRouteAccount(t, manager)
-	require.NoError(t, err, "failed to init testing account")
+		account, err := initTestRouteAccount(t, manager)
+		require.NoError(t, err, "failed to init testing account")
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err = manager.CreateGroup(context.Background(), account.Id, userID, group)
-		require.NoError(t, err, "failed to create group %s", group.Name)
-	}
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
+			},
+		}
+		for _, group := range g {
+			err = manager.CreateGroup(context.Background(), account.Id, userID, group)
+			require.NoError(t, err, "failed to create group %s", group.Name)
+		}
 
-	updMsg := updateManager.CreateChannel(context.Background(), peer1ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1ID)
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1ID)
+		})
 
-	// Creating a route with no routing peer and no peers in PeerGroups or Groups should not update account peers and not send peer update
-	t.Run("creating route no routing peer and no peers in groups", func(t *testing.T) {
-		route := route.Route{
-			ID:          "testingRoute1",
-			Network:     netip.MustParsePrefix("100.65.250.202/32"),
+		// Creating a route with no routing peer and no peers in PeerGroups or Groups should not update account peers and not send peer update
+		step(t, "creating route no routing peer and no peers in groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			route := route.Route{
+				ID:          "testingRoute1",
+				Network:     netip.MustParsePrefix("100.65.250.202/32"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupA"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupA"},
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+
+		})
+
+		// Creating a route with no routing peer and having peers in groups that don't include peer1 should not send peer1 an update
+		step(t, "creating a route with peers in  PeerGroups and Groups", func(t *testing.T) {
+			drainPeerUpdates(updMsg)
+
+			route := route.Route{
+				ID:          "testingRoute2",
+				Network:     netip.MustParsePrefix("192.0.2.0/32"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{routeGroup3},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{routeGroup3},
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+
+		})
+
+		baseRoute := route.Route{
+			ID:          "testingRoute3",
+			Network:     netip.MustParsePrefix("192.168.0.0/16"),
 			NetID:       "superNet",
 			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupA"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupA"},
-		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-
-	})
-
-	// Creating a route with no routing peer and having peers in groups that don't include peer1 should not send peer1 an update
-	t.Run("creating a route with peers in  PeerGroups and Groups", func(t *testing.T) {
-		drainPeerUpdates(updMsg)
-
-		route := route.Route{
-			ID:          "testingRoute2",
-			Network:     netip.MustParsePrefix("192.0.2.0/32"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{routeGroup3},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{routeGroup3},
-		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-
-	})
-
-	baseRoute := route.Route{
-		ID:          "testingRoute3",
-		Network:     netip.MustParsePrefix("192.168.0.0/16"),
-		NetID:       "superNet",
-		NetworkType: route.IPv4Network,
-		Peer:        peer1ID,
-		Description: "super",
-		Masquerade:  false,
-		Metric:      9999,
-		Enabled:     true,
-		Groups:      []string{routeGroup1},
-	}
-
-	// Creating route should update account peers and send peer update
-	t.Run("creating route with a routing peer", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		newRoute, err := manager.CreateRoute(
-			context.Background(), account.Id, baseRoute.Network, baseRoute.NetworkType, baseRoute.Domains, baseRoute.Peer,
-			baseRoute.PeerGroups, baseRoute.Description, baseRoute.NetID, baseRoute.Masquerade, baseRoute.Metric,
-			baseRoute.Groups, []string{}, true, userID, baseRoute.KeepRoute, !baseRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
-		baseRoute = *newRoute
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating the route should update account peers and send peer update when there is peers in group
-	t.Run("updating route", func(t *testing.T) {
-		baseRoute.Groups = []string{routeGroup1, routeGroup2}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveRoute(context.Background(), account.Id, userID, &baseRoute)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting the route should update account peers and send peer update
-	t.Run("deleting route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeleteRoute(context.Background(), account.Id, baseRoute.ID, userID)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Adding peer to route peer groups that do not have any peers should update account peers and send peer update
-	t.Run("adding peer to route peer groups that do not have any peers", func(t *testing.T) {
-		newRoute := route.Route{
-			Network:     netip.MustParsePrefix("192.168.12.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupB"},
+			Peer:        peer1ID,
 			Description: "super",
 			Masquerade:  false,
 			Metric:      9999,
 			Enabled:     true,
 			Groups:      []string{routeGroup1},
 		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating route should update account peers and send peer update
+		step(t, "creating route with a routing peer", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{peer1ID},
+			newRoute, err := manager.CreateRoute(
+				context.Background(), account.Id, baseRoute.Network, baseRoute.NetworkType, baseRoute.Domains, baseRoute.Peer,
+				baseRoute.PeerGroups, baseRoute.Description, baseRoute.NetID, baseRoute.Masquerade, baseRoute.Metric,
+				baseRoute.Groups, []string{}, true, userID, baseRoute.KeepRoute, !baseRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+			baseRoute = *newRoute
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Updating the route should update account peers and send peer update when there is peers in group
+		step(t, "updating route", func(t *testing.T) {
+			baseRoute.Groups = []string{routeGroup1, routeGroup2}
 
-	// Adding peer to route groups that do not have any peers should update account peers and send peer update
-	t.Run("adding peer to route groups that do not have any peers", func(t *testing.T) {
-		newRoute := route.Route{
-			Network:     netip.MustParsePrefix("192.168.13.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupB"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupC"},
-		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err := manager.SaveRoute(context.Background(), account.Id, userID, &baseRoute)
+			require.NoError(t, err)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Deleting the route should update account peers and send peer update
+		step(t, "deleting route", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeleteRoute(context.Background(), account.Id, baseRoute.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Adding peer to route peer groups that do not have any peers should update account peers and send peer update
+		step(t, "adding peer to route peer groups that do not have any peers", func(t *testing.T) {
+			newRoute := route.Route{
+				Network:     netip.MustParsePrefix("192.168.12.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{routeGroup1},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{peer1ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Adding peer to route groups that do not have any peers should update account peers and send peer update
+		step(t, "adding peer to route groups that do not have any peers", func(t *testing.T) {
+			newRoute := route.Route{
+				Network:     netip.MustParsePrefix("192.168.13.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupC"},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 
diff --git a/management/server/scheduler.go b/management/server/scheduler.go
index b61643295..1daea4295 100644
--- a/management/server/scheduler.go
+++ b/management/server/scheduler.go
@@ -117,6 +117,7 @@ func (wm *DefaultScheduler) Schedule(ctx context.Context, in time.Duration, ID s
 	}
 
 	ticker := time.NewTicker(in)
+	period := in
 
 	wm.jobs[ID] = cancel
 	log.WithContext(ctx).Debugf("scheduled a job %s to run in %s. There are %d total jobs scheduled.", ID, in.String(), len(wm.jobs))
@@ -136,14 +137,18 @@ func (wm *DefaultScheduler) Schedule(ctx context.Context, in time.Duration, ID s
 				if !reschedule {
 					wm.mu.Lock()
 					defer wm.mu.Unlock()
-					delete(wm.jobs, ID)
+					// A Cancel during job() may have registered a replacement under this ID.
+					if current, ok := wm.jobs[ID]; ok && current == cancel {
+						delete(wm.jobs, ID)
+					}
 					log.WithContext(ctx).Debugf("job %s is not scheduled to run again", ID)
 					ticker.Stop()
 					return
 				}
 				// we need this comparison to avoid resetting the ticker with the same duration and missing the current elapsesed time
-				if runIn != in {
+				if runIn != period {
 					ticker.Reset(runIn)
+					period = runIn
 				}
 			case <-cancel:
 				log.WithContext(ctx).Debugf("job %s was canceled, stopping timer", ID)
diff --git a/management/server/scheduler_test.go b/management/server/scheduler_test.go
index e3af551ad..9dd13ce6b 100644
--- a/management/server/scheduler_test.go
+++ b/management/server/scheduler_test.go
@@ -6,10 +6,12 @@ import (
 	"math/rand"
 	"runtime"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestScheduler_Performance(t *testing.T) {
@@ -150,3 +152,90 @@ func TestScheduler_Schedule(t *testing.T) {
 	scheduler.cancel(context.Background(), jobID)
 
 }
+
+func TestScheduler_Schedule_ResetsTickerAfterReturningInitialInterval(t *testing.T) {
+	jobID := "test-scheduler-job-2"
+	scheduler := NewDefaultScheduler()
+	defer scheduler.Cancel(context.Background(), []string{jobID})
+
+	initial := 30 * time.Millisecond
+	stretched := 400 * time.Millisecond
+	runs := make(chan time.Time, 3)
+	count := 0
+	// The first run stretches the period; the second returns the initial interval again,
+	// which must shrink the period back instead of keeping the stretched one.
+	job := func() (nextRunIn time.Duration, reschedule bool) {
+		count++
+		runs <- time.Now()
+		switch count {
+		case 1:
+			return stretched, true
+		case 2:
+			return initial, true
+		default:
+			return 0, false
+		}
+	}
+	scheduler.Schedule(context.Background(), initial, jobID, job)
+
+	var stamps []time.Time
+	for len(stamps) < 3 {
+		select {
+		case ts := <-runs:
+			stamps = append(stamps, ts)
+		case <-time.After(2 * time.Second):
+			t.Fatalf("timed out after %d runs", len(stamps))
+		}
+	}
+	assert.Less(t, stamps[2].Sub(stamps[1]), stretched/2, "returning the initial interval must reset the stretched ticker")
+}
+
+func TestScheduler_Schedule_StaleCompletionKeepsReplacement(t *testing.T) {
+	jobID := "test-scheduler-job-3"
+	scheduler := NewDefaultScheduler()
+	defer scheduler.Cancel(context.Background(), []string{jobID})
+
+	started := make(chan struct{})
+	release := make(chan struct{})
+	staleJob := func() (nextRunIn time.Duration, reschedule bool) {
+		close(started)
+		<-release
+		return 0, false
+	}
+	scheduler.Schedule(context.Background(), 10*time.Millisecond, jobID, staleJob)
+	select {
+	case <-started:
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for the first job to start")
+	}
+
+	// Cancel the job while it is still executing and register a replacement under the
+	// same ID, as the expiration paths do on a settings change.
+	scheduler.Cancel(context.Background(), []string{jobID})
+	var replacementRuns atomic.Int32
+	scheduler.Schedule(context.Background(), 20*time.Millisecond, jobID, func() (nextRunIn time.Duration, reschedule bool) {
+		replacementRuns.Add(1)
+		return 20 * time.Millisecond, true
+	})
+	require.True(t, scheduler.IsSchedulerRunning(jobID), "replacement must be registered")
+
+	// The stale job now completes without rescheduling; its cleanup must leave the
+	// replacement's entry in place.
+	close(release)
+	assert.Never(t, func() bool { return !scheduler.IsSchedulerRunning(jobID) }, 200*time.Millisecond, 10*time.Millisecond,
+		"stale completion must not drop the replacement job")
+
+	var duplicateRuns atomic.Int32
+	scheduler.Schedule(context.Background(), 10*time.Millisecond, jobID, func() (nextRunIn time.Duration, reschedule bool) {
+		duplicateRuns.Add(1)
+		return 10 * time.Millisecond, true
+	})
+	assert.Never(t, func() bool { return duplicateRuns.Load() > 0 }, 100*time.Millisecond, 10*time.Millisecond,
+		"a duplicate schedule must be refused while the replacement is registered")
+
+	scheduler.Cancel(context.Background(), []string{jobID})
+	assert.False(t, scheduler.IsSchedulerRunning(jobID), "cancel must find and remove the replacement")
+	runsAfterCancel := replacementRuns.Load()
+	assert.Never(t, func() bool { return replacementRuns.Load() > runsAfterCancel+1 }, 150*time.Millisecond, 10*time.Millisecond,
+		"the replacement must stop after cancel")
+}
diff --git a/management/server/settings/manager.go b/management/server/settings/manager.go
index f84739193..dc5b46471 100644
--- a/management/server/settings/manager.go
+++ b/management/server/settings/manager.go
@@ -1,6 +1,6 @@
 package settings
 
-//go:generate go run github.com/golang/mock/mockgen -package settings -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
+//go:generate go tool mockgen -package settings -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
 
 import (
 	"context"
diff --git a/management/server/settings/manager_mock.go b/management/server/settings/manager_mock.go
index 4bedb2cf7..59b321875 100644
--- a/management/server/settings/manager_mock.go
+++ b/management/server/settings/manager_mock.go
@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: ./manager.go
+//
+// Generated by this command:
+//
+//	mockgen -package settings -destination=manager_mock.go -source=./manager.go -build_flags=-mod=mod
+//
 
 // Package settings is a generated GoMock package.
 package settings
@@ -9,15 +14,16 @@ import (
 	netip "net/netip"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
 	extra_settings "github.com/netbirdio/netbird/management/server/integrations/extra_settings"
 	types "github.com/netbirdio/netbird/management/server/types"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockManager is a mock of Manager interface.
 type MockManager struct {
 	ctrl     *gomock.Controller
 	recorder *MockManagerMockRecorder
+	isgomock struct{}
 }
 
 // MockManagerMockRecorder is the mock recorder for MockManager.
@@ -37,6 +43,22 @@ func (m *MockManager) EXPECT() *MockManagerMockRecorder {
 	return m.recorder
 }
 
+// GetEffectiveNetworkRanges mocks base method.
+func (m *MockManager) GetEffectiveNetworkRanges(ctx context.Context, accountID string) (netip.Prefix, netip.Prefix, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetEffectiveNetworkRanges", ctx, accountID)
+	ret0, _ := ret[0].(netip.Prefix)
+	ret1, _ := ret[1].(netip.Prefix)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetEffectiveNetworkRanges indicates an expected call of GetEffectiveNetworkRanges.
+func (mr *MockManagerMockRecorder) GetEffectiveNetworkRanges(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetEffectiveNetworkRanges", reflect.TypeOf((*MockManager)(nil).GetEffectiveNetworkRanges), ctx, accountID)
+}
+
 // GetExtraSettings mocks base method.
 func (m *MockManager) GetExtraSettings(ctx context.Context, accountID string) (*types.ExtraSettings, error) {
 	m.ctrl.T.Helper()
@@ -47,7 +69,7 @@ func (m *MockManager) GetExtraSettings(ctx context.Context, accountID string) (*
 }
 
 // GetExtraSettings indicates an expected call of GetExtraSettings.
-func (mr *MockManagerMockRecorder) GetExtraSettings(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetExtraSettings(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetExtraSettings", reflect.TypeOf((*MockManager)(nil).GetExtraSettings), ctx, accountID)
 }
@@ -76,7 +98,7 @@ func (m *MockManager) GetSettings(ctx context.Context, accountID, userID string)
 }
 
 // GetSettings indicates an expected call of GetSettings.
-func (mr *MockManagerMockRecorder) GetSettings(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetSettings(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetSettings", reflect.TypeOf((*MockManager)(nil).GetSettings), ctx, accountID, userID)
 }
@@ -91,23 +113,7 @@ func (m *MockManager) UpdateExtraSettings(ctx context.Context, accountID, userID
 }
 
 // UpdateExtraSettings indicates an expected call of UpdateExtraSettings.
-func (mr *MockManagerMockRecorder) UpdateExtraSettings(ctx, accountID, userID, extraSettings interface{}) *gomock.Call {
+func (mr *MockManagerMockRecorder) UpdateExtraSettings(ctx, accountID, userID, extraSettings any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateExtraSettings", reflect.TypeOf((*MockManager)(nil).UpdateExtraSettings), ctx, accountID, userID, extraSettings)
 }
-
-// GetEffectiveNetworkRanges mocks base method.
-func (m *MockManager) GetEffectiveNetworkRanges(ctx context.Context, accountID string) (netip.Prefix, netip.Prefix, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetEffectiveNetworkRanges", ctx, accountID)
-	ret0, _ := ret[0].(netip.Prefix)
-	ret1, _ := ret[1].(netip.Prefix)
-	ret2, _ := ret[2].(error)
-	return ret0, ret1, ret2
-}
-
-// GetEffectiveNetworkRanges indicates an expected call of GetEffectiveNetworkRanges.
-func (mr *MockManagerMockRecorder) GetEffectiveNetworkRanges(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetEffectiveNetworkRanges", reflect.TypeOf((*MockManager)(nil).GetEffectiveNetworkRanges), ctx, accountID)
-}
diff --git a/management/server/setupkey_test.go b/management/server/setupkey_test.go
index 2d43ea28b..87959113d 100644
--- a/management/server/setupkey_test.go
+++ b/management/server/setupkey_test.go
@@ -397,75 +397,77 @@ func TestSetupKey_Copy(t *testing.T) {
 }
 
 func TestSetupKeyAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	assert.NoError(t, err)
-
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"group"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}
-	_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-	require.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// The setup policy above dispatches affected-peer updates asynchronously; drain
-	// any in-flight ones so the assertions only observe the setup-key operations.
-	settleAffectedUpdates(updMsg)
-
-	var setupKey *types.SetupKey
-
-	// Creating setup key should not update account peers and not send peer update
-	t.Run("creating setup key", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		setupKey, err = manager.CreateSetupKey(context.Background(), account.Id, "key1", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+		policy := &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"group"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
 		}
-	})
-
-	// Saving setup key should not update account peers and not send peer update
-	t.Run("saving setup key", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SaveSetupKey(context.Background(), account.Id, setupKey, userID)
+		_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
+
+		// The setup policy above dispatches affected-peer updates asynchronously; drain
+		// any in-flight ones so the assertions only observe the setup-key operations.
+		settleAffectedUpdates(updMsg)
+
+		var setupKey *types.SetupKey
+
+		// Creating setup key should not update account peers and not send peer update
+		step(t, "creating setup key", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			setupKey, err = manager.CreateSetupKey(context.Background(), account.Id, "key1", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Saving setup key should not update account peers and not send peer update
+		step(t, "saving setup key", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SaveSetupKey(context.Background(), account.Id, setupKey, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 	})
 }
 
diff --git a/management/server/store/sql_store.go b/management/server/store/sql_store.go
index 69efe65f1..b705ba0a2 100644
--- a/management/server/store/sql_store.go
+++ b/management/server/store/sql_store.go
@@ -2,42 +2,23 @@ package store
 
 import (
 	"context"
-	"database/sql"
-	"encoding/json"
-	"errors"
 	"fmt"
-	"net"
-	"net/netip"
-	"net/url"
-	"os"
-	"path/filepath"
-	"runtime"
-	"runtime/debug"
-	"strconv"
-	"strings"
 	"sync"
 	"time"
 
-	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
-	"gorm.io/driver/mysql"
-	"gorm.io/driver/postgres"
-	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
-	"gorm.io/gorm/clause"
-	"gorm.io/gorm/logger"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
-
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -45,92 +26,58 @@ import (
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/route"
-	"github.com/netbirdio/netbird/shared/management/status"
 	"github.com/netbirdio/netbird/util/crypt"
 )
 
 const (
-	storeSqliteFileName            = "store.db"
 	idQueryCondition               = "id = ?"
 	keyQueryCondition              = "key = ?"
 	mysqlKeyQueryCondition         = "`key` = ?"
 	accountAndIDQueryCondition     = "account_id = ? and id = ?"
+	accountAndAnyIDQueryCondition  = "account_id = ? and (id = ? or public_id = ?)"
 	accountAndPeerIDQueryCondition = "account_id = ? and peer_id = ?"
 	accountAndIDsQueryCondition    = "account_id = ? AND id IN ?"
 	accountIDCondition             = "account_id = ?"
 	peerNotFoundFMT                = "peer %s not found"
-
-	pgMaxConnections    = 30
-	pgMinConnections    = 1
-	pgMaxConnLifetime   = 60 * time.Minute
-	pgHealthCheckPeriod = 1 * time.Minute
 )
 
+var testPoolConfig = db.PoolConfig{
+	MaxConns:          5,
+	MinConns:          1,
+	MaxConnLifetime:   30 * time.Second,
+	HealthCheckPeriod: 10 * time.Second,
+}
+
 // SqlStore represents an account storage backed by a Sql DB persisted to disk
 type SqlStore struct {
-	db                 *gorm.DB
-	globalAccountLock  sync.Mutex
-	metrics            telemetry.AppMetrics
-	installationPK     int
-	storeEngine        types.Engine
-	pool               *pgxpool.Pool
-	fieldEncrypt       *crypt.FieldEncrypt
-	transactionTimeout time.Duration
-}
-
-type installation struct {
-	ID                  uint `gorm:"primaryKey"`
-	InstallationIDValue string
+	conn              *db.Conn
+	db                *gorm.DB
+	tx                *db.Tx
+	globalAccountLock sync.Mutex
+	metrics           telemetry.AppMetrics
+	installationPK    int
+	fieldEncrypt      *crypt.FieldEncrypt
 }
 
 type migrationFunc func(*gorm.DB) error
 
-// NewSqlStore creates a new SqlStore instance.
-func NewSqlStore(ctx context.Context, db *gorm.DB, storeEngine types.Engine, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
-	sql, err := db.DB()
-	if err != nil {
-		return nil, err
+// NewSqlStore creates a new SqlStore instance on top of an open connection.
+func NewSqlStore(ctx context.Context, conn *db.Conn, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
+	if metrics != nil {
+		conn.SetTxMetrics(metrics.StoreMetrics())
 	}
-
-	conns, err := strconv.Atoi(os.Getenv("NB_SQL_MAX_OPEN_CONNS"))
-	if err != nil {
-		conns = runtime.NumCPU()
-	}
-
-	transactionTimeout := 5 * time.Minute
-	if v := os.Getenv("NB_STORE_TRANSACTION_TIMEOUT"); v != "" {
-		if parsed, err := time.ParseDuration(v); err == nil {
-			transactionTimeout = parsed
-		}
-	}
-	log.WithContext(ctx).Infof("Setting transaction timeout to %v", transactionTimeout)
-
-	if storeEngine == types.SqliteStoreEngine {
-		if err == nil {
-			log.WithContext(ctx).Warnf("setting NB_SQL_MAX_OPEN_CONNS is not supported for sqlite, using default value 1")
-		}
-		conns = 1
-	}
-
-	sql.SetMaxOpenConns(conns)
-	sql.SetMaxIdleConns(conns)
-	sql.SetConnMaxLifetime(time.Hour)
-	sql.SetConnMaxIdleTime(3 * time.Minute)
-
-	log.WithContext(ctx).Infof("Set max open db connections to %d, max idle to %d, max lifetime to %v, max idle time to %v",
-		conns, conns, time.Hour, 3*time.Minute)
+	store := &SqlStore{conn: conn, db: conn.DB(nil), metrics: metrics, installationPK: 1}
 
 	if skipMigration {
 		log.WithContext(ctx).Infof("skipping migration")
-		return &SqlStore{db: db, storeEngine: storeEngine, metrics: metrics, installationPK: 1, transactionTimeout: transactionTimeout}, nil
+		return store, nil
 	}
 
-	if err := migratePreAuto(ctx, db); err != nil {
+	if err := migratePreAuto(ctx, store.db); err != nil {
 		return nil, fmt.Errorf("migratePreAuto: %w", err)
 	}
-	err = db.AutoMigrate(
+	err := conn.AutoMigrate(
 		&types.SetupKey{}, &nbpeer.Peer{}, &types.User{}, &types.PersonalAccessToken{}, &types.ProxyAccessToken{},
 		&types.Group{}, &types.GroupPeer{},
 		&types.Account{}, &types.Policy{}, &types.PolicyRule{}, &route.Route{}, &nbdns.NameServerGroup{},
@@ -146,110 +93,39 @@ func NewSqlStore(ctx context.Context, db *gorm.DB, storeEngine types.Engine, met
 	if err != nil {
 		return nil, fmt.Errorf("auto migratePreAuto: %w", err)
 	}
-	if err := migratePostAuto(ctx, db); err != nil {
+	if err := migratePostAuto(ctx, store.db); err != nil {
 		return nil, fmt.Errorf("migratePostAuto: %w", err)
 	}
 
-	return &SqlStore{db: db, storeEngine: storeEngine, metrics: metrics, installationPK: 1, transactionTimeout: transactionTimeout}, nil
+	return store, nil
+}
+
+// newStore runs the migrations on conn and releases it when they fail.
+func newStore(ctx context.Context, conn *db.Conn, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
+	store, err := NewSqlStore(ctx, conn, metrics, skipMigration)
+	if err != nil {
+		_ = conn.Close()
+		return nil, err
+	}
+	return store, nil
+}
+
+// Conn returns the shared connection so domain repositories can run alongside this store.
+func (s *SqlStore) Conn() *db.Conn {
+	return s.conn
+}
+
+func (s *SqlStore) pgxPool() *pgxpool.Pool {
+	return s.conn.Pool(s.tx)
 }
 
 func GetKeyQueryCondition(s *SqlStore) string {
-	if s.storeEngine == types.MysqlStoreEngine {
+	if s.conn.Engine() == db.MysqlStoreEngine {
 		return mysqlKeyQueryCondition
 	}
 	return keyQueryCondition
 }
 
-// SaveJob persists a job in DB
-func (s *SqlStore) CreatePeerJob(ctx context.Context, job *types.Job) error {
-	result := s.db.Create(job)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to create job in store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to create job in store")
-	}
-	return nil
-}
-
-func (s *SqlStore) CompletePeerJob(ctx context.Context, job *types.Job) error {
-	result := s.db.
-		Model(&types.Job{}).
-		Where(idQueryCondition, job.ID).
-		Updates(job)
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to update job in store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to update job in store")
-	}
-	return nil
-}
-
-// job was pending for too long and has been cancelled
-func (s *SqlStore) MarkPendingJobsAsFailed(ctx context.Context, accountID, peerID, jobID, reason string) error {
-	now := time.Now().UTC()
-	result := s.db.
-		Model(&types.Job{}).
-		Where(accountAndPeerIDQueryCondition+" AND id = ?"+" AND status = ?", accountID, peerID, jobID, types.JobStatusPending).
-		Updates(types.Job{
-			Status:       types.JobStatusFailed,
-			FailedReason: reason,
-			CompletedAt:  &now,
-		})
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to mark pending jobs as Failed job in store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to mark pending job as Failed in store")
-	}
-	return nil
-}
-
-// job was pending for too long and has been cancelled
-func (s *SqlStore) MarkAllPendingJobsAsFailed(ctx context.Context, accountID, peerID, reason string) error {
-	now := time.Now().UTC()
-	result := s.db.
-		Model(&types.Job{}).
-		Where(accountAndPeerIDQueryCondition+" AND status = ?", accountID, peerID, types.JobStatusPending).
-		Updates(types.Job{
-			Status:       types.JobStatusFailed,
-			FailedReason: reason,
-			CompletedAt:  &now,
-		})
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to mark pending jobs as Failed job in store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to mark pending job as Failed in store")
-	}
-	return nil
-}
-
-// GetJobByID fetches job by ID
-func (s *SqlStore) GetPeerJobByID(ctx context.Context, accountID, jobID string) (*types.Job, error) {
-	var job types.Job
-	err := s.db.
-		Where(accountAndIDQueryCondition, accountID, jobID).
-		First(&job).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return nil, status.Errorf(status.NotFound, "job %s not found", jobID)
-	}
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to fetch job from store: %s", err)
-		return nil, err
-	}
-	return &job, nil
-}
-
-// get all jobs
-func (s *SqlStore) GetPeerJobs(ctx context.Context, accountID, peerID string) ([]*types.Job, error) {
-	var jobs []*types.Job
-	err := s.db.
-		Where(accountAndPeerIDQueryCondition, accountID, peerID).
-		Order("created_at DESC").
-		Find(&jobs).Error
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to fetch jobs from store: %s", err)
-		return nil, err
-	}
-
-	return jobs, nil
-}
-
 // AcquireGlobalLock acquires global lock across all the accounts and returns a function that releases the lock
 func (s *SqlStore) AcquireGlobalLock(ctx context.Context) (unlock func()) {
 	log.WithContext(ctx).Tracef("acquiring global lock")
@@ -270,2754 +146,41 @@ func (s *SqlStore) AcquireGlobalLock(ctx context.Context) (unlock func()) {
 	return unlock
 }
 
-// Deprecated: Full
-// account operations are no longer supported
-func (s *SqlStore) SaveAccount(ctx context.Context, account *types.Account) error {
-	start := time.Now()
-	defer func() {
-		elapsed := time.Since(start)
-		if elapsed > 1*time.Second {
-			log.WithContext(ctx).Tracef("SaveAccount for account %s exceeded 1s, took: %v", account.Id, elapsed)
-		}
-	}()
-
-	// todo: remove this check after the issue is resolved
-	s.checkAccountDomainBeforeSave(ctx, account.Id, account.Domain)
-
-	generateAccountSQLTypes(account)
-
-	// Encrypt sensitive user data before saving
-	for i := range account.UsersG {
-		if err := account.UsersG[i].EncryptSensitiveData(s.fieldEncrypt); err != nil {
-			return fmt.Errorf("encrypt user: %w", err)
-		}
-	}
-
-	for _, group := range account.GroupsG {
-		group.StoreGroupPeers()
-	}
-
-	err := s.transaction(func(tx *gorm.DB) error {
-		result := tx.Select(clause.Associations).Delete(account.Policies, "account_id = ?", account.Id)
-		if result.Error != nil {
-			return result.Error
-		}
-
-		result = tx.Select(clause.Associations).Delete(account.UsersG, "account_id = ?", account.Id)
-		if result.Error != nil {
-			return result.Error
-		}
-
-		result = tx.Select(clause.Associations).Delete(account)
-		if result.Error != nil {
-			return result.Error
-		}
-
-		result = tx.
-			Session(&gorm.Session{FullSaveAssociations: true}).
-			Clauses(clause.OnConflict{UpdateAll: true}).
-			Create(account)
-		if result.Error != nil {
-			return result.Error
-		}
-		return nil
-	})
-
-	took := time.Since(start)
-	if s.metrics != nil {
-		s.metrics.StoreMetrics().CountPersistenceDuration(took)
-	}
-	log.WithContext(ctx).Debugf("took %d ms to persist an account to the store", took.Milliseconds())
-
-	return err
-}
-
-// generateAccountSQLTypes generates the GORM compatible types for the account
-func generateAccountSQLTypes(account *types.Account) {
-	for _, key := range account.SetupKeys {
-		account.SetupKeysG = append(account.SetupKeysG, *key)
-	}
-
-	if len(account.SetupKeys) != len(account.SetupKeysG) {
-		log.Warnf("SetupKeysG length mismatch for account %s", account.Id)
-	}
-
-	for id, peer := range account.Peers {
-		peer.ID = id
-		account.PeersG = append(account.PeersG, *peer)
-	}
-
-	for id, user := range account.Users {
-		user.Id = id
-		for id, pat := range user.PATs {
-			pat.ID = id
-			user.PATsG = append(user.PATsG, *pat)
-		}
-		account.UsersG = append(account.UsersG, *user)
-	}
-
-	for id, group := range account.Groups {
-		group.ID = id
-		group.AccountID = account.Id
-		account.GroupsG = append(account.GroupsG, group)
-	}
-
-	for id, route := range account.Routes {
-		route.ID = id
-		account.RoutesG = append(account.RoutesG, *route)
-	}
-
-	for id, ns := range account.NameServerGroups {
-		ns.ID = id
-		account.NameServerGroupsG = append(account.NameServerGroupsG, *ns)
-	}
-}
-
-// checkAccountDomainBeforeSave temporary method to troubleshoot an issue with domains getting blank
-func (s *SqlStore) checkAccountDomainBeforeSave(ctx context.Context, accountID, newDomain string) {
-	var acc types.Account
-	var domain string
-	result := s.db.Model(&acc).Select("domain").Where(idQueryCondition, accountID).Take(&domain)
-	if result.Error != nil {
-		if !errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			log.WithContext(ctx).Errorf("error when getting account %s from the store to check domain: %s", accountID, result.Error)
-		}
-		return
-	}
-	if domain != "" && newDomain == "" {
-		log.WithContext(ctx).Warnf("saving an account with empty domain when there was a domain set. Previous domain %s, Account ID: %s, Trace: %s", domain, accountID, debug.Stack())
-	}
-}
-
-func (s *SqlStore) DeleteAccount(ctx context.Context, account *types.Account) error {
-	start := time.Now()
-
-	err := s.transaction(func(tx *gorm.DB) error {
-		result := tx.Select(clause.Associations).Delete(account.Policies, "account_id = ?", account.Id)
-		if result.Error != nil {
-			return result.Error
-		}
-
-		result = tx.Select(clause.Associations).Delete(account.UsersG, "account_id = ?", account.Id)
-		if result.Error != nil {
-			return result.Error
-		}
-
-		result = tx.Select(clause.Associations).Delete(account.Services, "account_id = ?", account.Id)
-		if result.Error != nil {
-			return result.Error
-		}
-
-		result = tx.Select(clause.Associations).Delete(account)
-		if result.Error != nil {
-			return result.Error
-		}
-
-		return nil
-	})
-
-	took := time.Since(start)
-	if s.metrics != nil {
-		s.metrics.StoreMetrics().CountPersistenceDuration(took)
-	}
-	log.WithContext(ctx).Tracef("took %d ms to delete an account to the store", took.Milliseconds())
-
-	return err
-}
-
-func (s *SqlStore) SaveInstallationID(_ context.Context, ID string) error {
-	installation := installation{InstallationIDValue: ID}
-	installation.ID = uint(s.installationPK)
-
-	return s.db.Clauses(clause.OnConflict{UpdateAll: true}).Create(&installation).Error
-}
-
-func (s *SqlStore) GetInstallationID() string {
-	var installation installation
-
-	if result := s.db.Take(&installation, idQueryCondition, s.installationPK); result.Error != nil {
-		return ""
-	}
-
-	return installation.InstallationIDValue
-}
-
-func (s *SqlStore) SavePeer(ctx context.Context, accountID string, peer *nbpeer.Peer) error {
-	// To maintain data integrity, we create a copy of the peer's to prevent unintended updates to other fields.
-	peerCopy := peer.Copy()
-	peerCopy.AccountID = accountID
-
-	err := s.transaction(func(tx *gorm.DB) error {
-		// check if peer exists before saving
-		var peerID string
-		result := tx.Model(&nbpeer.Peer{}).Select("id").Take(&peerID, accountAndIDQueryCondition, accountID, peer.ID)
-		if result.Error != nil {
-			if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-				return status.Errorf(status.NotFound, peerNotFoundFMT, peer.ID)
-			}
-			return result.Error
-		}
-
-		if peerID == "" {
-			return status.Errorf(status.NotFound, peerNotFoundFMT, peer.ID)
-		}
-
-		result = tx.Model(&nbpeer.Peer{}).Where(accountAndIDQueryCondition, accountID, peer.ID).Save(peerCopy)
-		if result.Error != nil {
-			return status.Errorf(status.Internal, "failed to save peer to store: %v", result.Error)
-		}
-
-		return nil
-	})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (s *SqlStore) UpdateAccountDomainAttributes(ctx context.Context, accountID string, domain string, category string, isPrimaryDomain bool) error {
-	accountCopy := types.Account{
-		Domain:                 domain,
-		DomainCategory:         category,
-		IsDomainPrimaryAccount: isPrimaryDomain,
-	}
-
-	fieldsToUpdate := []string{"domain", "domain_category", "is_domain_primary_account"}
-	result := s.db.Model(&types.Account{}).
-		Select(fieldsToUpdate).
-		Where(idQueryCondition, accountID).
-		Updates(&accountCopy)
-	if result.Error != nil {
-		return status.Errorf(status.Internal, "failed to update account domain attributes to store: %v", result.Error)
-	}
-
-	if result.RowsAffected == 0 {
-		return status.Errorf(status.NotFound, "account %s", accountID)
-	}
-
-	return nil
-}
-
-func (s *SqlStore) SavePeerStatus(ctx context.Context, accountID, peerID string, peerStatus nbpeer.PeerStatus) error {
-	var peerCopy nbpeer.Peer
-	peerCopy.Status = &peerStatus
-
-	fieldsToUpdate := []string{
-		"peer_status_last_seen", "peer_status_session_started_at",
-		"peer_status_connected", "peer_status_login_expired",
-		"peer_status_requires_approval",
-	}
-	result := s.db.Model(&nbpeer.Peer{}).
-		Select(fieldsToUpdate).
-		Where(accountAndIDQueryCondition, accountID, peerID).
-		Updates(&peerCopy)
-	if result.Error != nil {
-		return status.Errorf(status.Internal, "failed to save peer status to store: %v", result.Error)
-	}
-
-	if result.RowsAffected == 0 {
-		return status.Errorf(status.NotFound, peerNotFoundFMT, peerID)
-	}
-
-	return nil
-}
-
-// MarkPeerConnectedIfNewerSession is an atomic optimistic-locked update.
-// The peer is marked connected with the given session token only when
-// the stored SessionStartedAt is strictly smaller than the incoming
-// one — equivalently, when no newer stream has already taken ownership.
-// The sentinel zero (set on peer creation or after a disconnect) counts
-// as the smallest possible token. This is the write half of the
-// fencing protocol described on PeerStatus.SessionStartedAt.
-//
-// The post-write side effects in the caller — geo lookup,
-// schedulePeerLoginExpiration, checkAndSchedulePeerInactivityExpiration,
-// OnPeersUpdated — all run AFTER this method returns and are deliberately
-// outside the database write so they cannot extend the row-lock window.
-//
-// LastSeen is set to the database's clock (CURRENT_TIMESTAMP) at the
-// moment the row is written. The caller never supplies LastSeen because
-// the value would otherwise drift under lock contention — a Go-side
-// time.Now() taken before the write can land minutes later than the
-// actual UPDATE under load, which previously caused real ordering bugs.
-func (s *SqlStore) MarkPeerConnectedIfNewerSession(ctx context.Context, accountID, peerID string, newSessionStartedAt int64) (bool, error) {
-	result := s.db.WithContext(ctx).
-		Model(&nbpeer.Peer{}).
-		Where(accountAndIDQueryCondition, accountID, peerID).
-		Where("peer_status_session_started_at < ?", newSessionStartedAt).
-		Updates(map[string]any{
-			"peer_status_connected":          true,
-			"peer_status_last_seen":          gorm.Expr("CURRENT_TIMESTAMP"),
-			"peer_status_session_started_at": newSessionStartedAt,
-			"peer_status_login_expired":      false,
-		})
-	if result.Error != nil {
-		return false, status.Errorf(status.Internal, "mark peer connected: %v", result.Error)
-	}
-	return result.RowsAffected > 0, nil
-}
-
-// MarkPeerDisconnectedIfSameSession is an atomic optimistic-locked update.
-// The peer is marked disconnected only when the stored SessionStartedAt
-// matches the incoming token — meaning the stream that owns the current
-// session is the one ending. If a newer stream has already replaced the
-// session, the update is skipped. LastSeen is set to CURRENT_TIMESTAMP at
-// write time; see MarkPeerConnectedIfNewerSession for the rationale.
-//
-// A zero sessionStartedAt is rejected at the call site; the underlying
-// WHERE on equality would otherwise match every never-connected peer.
-func (s *SqlStore) MarkPeerDisconnectedIfSameSession(ctx context.Context, accountID, peerID string, sessionStartedAt int64) (bool, error) {
-	if sessionStartedAt == 0 {
-		return false, nil
-	}
-	result := s.db.WithContext(ctx).
-		Model(&nbpeer.Peer{}).
-		Where(accountAndIDQueryCondition, accountID, peerID).
-		Where("peer_status_session_started_at = ?", sessionStartedAt).
-		Updates(map[string]any{
-			"peer_status_connected":          false,
-			"peer_status_last_seen":          gorm.Expr("CURRENT_TIMESTAMP"),
-			"peer_status_session_started_at": int64(0),
-		})
-	if result.Error != nil {
-		return false, status.Errorf(status.Internal, "mark peer disconnected: %v", result.Error)
-	}
-	return result.RowsAffected > 0, nil
-}
-
-// ApproveAccountPeers marks all peers that currently require approval in the given account as approved.
-func (s *SqlStore) ApproveAccountPeers(ctx context.Context, accountID string) (int, error) {
-	result := s.db.Model(&nbpeer.Peer{}).
-		Where("account_id = ? AND peer_status_requires_approval = ?", accountID, true).
-		Update("peer_status_requires_approval", false)
-	if result.Error != nil {
-		return 0, status.Errorf(status.Internal, "failed to approve pending account peers: %v", result.Error)
-	}
-
-	return int(result.RowsAffected), nil
-}
-
-// SaveUsers saves the given list of users to the database.
-func (s *SqlStore) SaveUsers(ctx context.Context, users []*types.User) error {
-	if len(users) == 0 {
-		return nil
-	}
-
-	usersCopy := make([]*types.User, len(users))
-	for i, user := range users {
-		userCopy := user.Copy()
-		userCopy.Email = user.Email
-		userCopy.Name = user.Name
-		if err := userCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
-			return fmt.Errorf("encrypt user: %w", err)
-		}
-		usersCopy[i] = userCopy
-	}
-
-	result := s.db.Clauses(clause.OnConflict{UpdateAll: true}).Create(&usersCopy)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to save users to store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to save users to store")
-	}
-	return nil
-}
-
-// SaveUser saves the given user to the database.
-func (s *SqlStore) SaveUser(ctx context.Context, user *types.User) error {
-	userCopy := user.Copy()
-	userCopy.Email = user.Email
-	userCopy.Name = user.Name
-
-	if err := userCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
-		return fmt.Errorf("encrypt user: %w", err)
-	}
-
-	result := s.db.Save(userCopy)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to save user to store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to save user to store")
-	}
-	return nil
-}
-
-// CreateGroups creates the given list of groups to the database.
-func (s *SqlStore) CreateGroups(ctx context.Context, accountID string, groups []*types.Group) error {
-	if len(groups) == 0 {
-		return nil
-	}
-
-	return s.db.Transaction(func(tx *gorm.DB) error {
-		result := tx.
-			Clauses(
-				clause.OnConflict{
-					Where:     clause.Where{Exprs: []clause.Expression{clause.Eq{Column: "groups.account_id", Value: accountID}}},
-					UpdateAll: true,
-				},
-			).
-			Omit(clause.Associations).
-			Create(&groups)
-		if result.Error != nil {
-			log.WithContext(ctx).Errorf("failed to save groups to store: %v", result.Error)
-			return status.Errorf(status.Internal, "failed to save groups to store")
-		}
-
-		return nil
-	})
-}
-
-// UpdateGroups updates the given list of groups to the database.
-func (s *SqlStore) UpdateGroups(ctx context.Context, accountID string, groups []*types.Group) error {
-	if len(groups) == 0 {
-		return nil
-	}
-
-	return s.db.Transaction(func(tx *gorm.DB) error {
-		result := tx.
-			Clauses(
-				clause.OnConflict{
-					Where:     clause.Where{Exprs: []clause.Expression{clause.Eq{Column: "groups.account_id", Value: accountID}}},
-					UpdateAll: true,
-				},
-			).
-			Omit(clause.Associations).
-			Create(&groups)
-		if result.Error != nil {
-			log.WithContext(ctx).Errorf("failed to save groups to store: %v", result.Error)
-			return status.Errorf(status.Internal, "failed to save groups to store")
-		}
-
-		return nil
-	})
-}
-
-// DeleteHashedPAT2TokenIDIndex is noop in SqlStore
-func (s *SqlStore) DeleteHashedPAT2TokenIDIndex(hashedToken string) error {
-	return nil
-}
-
-// DeleteTokenID2UserIDIndex is noop in SqlStore
-func (s *SqlStore) DeleteTokenID2UserIDIndex(tokenID string) error {
-	return nil
-}
-
-func (s *SqlStore) GetAccountByPrivateDomain(ctx context.Context, domain string) (*types.Account, error) {
-	accountID, err := s.GetAccountIDByPrivateDomain(ctx, LockingStrengthNone, domain)
-	if err != nil {
-		return nil, err
-	}
-
-	// TODO:  rework to not call GetAccount
-	return s.GetAccount(ctx, accountID)
-}
-
-func (s *SqlStore) GetAccountIDByPrivateDomain(ctx context.Context, lockStrength LockingStrength, domain string) (string, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var accountID string
-	result := tx.Model(&types.Account{}).Select("id").
-		Where("domain = ? and is_domain_primary_account = ? and domain_category = ?",
-			strings.ToLower(domain), true, types.PrivateCategory,
-		).Take(&accountID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return "", status.Errorf(status.NotFound, "account not found: provided domain is not registered or is not private")
-		}
-		log.WithContext(ctx).Errorf("error when getting account from the store: %s", result.Error)
-		return "", status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	return accountID, nil
-}
-
-func (s *SqlStore) GetAccountBySetupKey(ctx context.Context, setupKey string) (*types.Account, error) {
-	var key types.SetupKey
-	result := s.db.Select("account_id").Take(&key, GetKeyQueryCondition(s), setupKey)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewSetupKeyNotFoundError(setupKey)
-		}
-		log.WithContext(ctx).Errorf("failed to get account by setup key from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get account by setup key from store")
-	}
-
-	if key.AccountID == "" {
-		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-	}
-
-	return s.GetAccount(ctx, key.AccountID)
-}
-
-func (s *SqlStore) GetTokenIDByHashedToken(ctx context.Context, hashedToken string) (string, error) {
-	var token types.PersonalAccessToken
-	result := s.db.Take(&token, "hashed_token = ?", hashedToken)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		log.WithContext(ctx).Errorf("error when getting token from the store: %s", result.Error)
-		return "", status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	return token.ID, nil
-}
-
-func (s *SqlStore) GetUserByPATID(ctx context.Context, lockStrength LockingStrength, patID string) (*types.User, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var user types.User
-	result := tx.
-		Joins("JOIN personal_access_tokens ON personal_access_tokens.user_id = users.id").
-		Where("personal_access_tokens.id = ?", patID).Take(&user)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewPATNotFoundError(patID)
-		}
-		log.WithContext(ctx).Errorf("failed to get token user from the store: %s", result.Error)
-		return nil, status.NewGetUserFromStoreError()
-	}
-
-	if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-		return nil, fmt.Errorf("decrypt user: %w", err)
-	}
-
-	return &user, nil
-}
-
-func (s *SqlStore) GetUserByUserID(ctx context.Context, lockStrength LockingStrength, userID string) (*types.User, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var user types.User
-	result := tx.Take(&user, idQueryCondition, userID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewUserNotFoundError(userID)
-		}
-		return nil, status.NewGetUserFromStoreError()
-	}
-
-	if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-		return nil, fmt.Errorf("decrypt user: %w", err)
-	}
-
-	return &user, nil
-}
-
-func (s *SqlStore) DeleteUser(ctx context.Context, accountID, userID string) error {
-	err := s.transaction(func(tx *gorm.DB) error {
-		result := tx.Delete(&types.PersonalAccessToken{}, "user_id = ?", userID)
-		if result.Error != nil {
-			return result.Error
-		}
-
-		return tx.Delete(&types.User{}, accountAndIDQueryCondition, accountID, userID).Error
-	})
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to delete user from the store: %s", err)
-		return status.Errorf(status.Internal, "failed to delete user from store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) GetAccountUsers(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.User, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var users []*types.User
-	result := tx.Find(&users, accountIDCondition, accountID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "accountID not found: index lookup failed")
-		}
-		log.WithContext(ctx).Errorf("error when getting users from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "issue getting users from store")
-	}
-
-	for _, user := range users {
-		if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-			return nil, fmt.Errorf("decrypt user: %w", err)
-		}
-	}
-
-	return users, nil
-}
-
-func (s *SqlStore) GetAccountOwner(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.User, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var user types.User
-	result := tx.Take(&user, "account_id = ? AND role = ?", accountID, types.UserRoleOwner)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account owner not found: index lookup failed")
-		}
-		return nil, status.Errorf(status.Internal, "failed to get account owner from the store")
-	}
-
-	if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-		return nil, fmt.Errorf("decrypt user: %w", err)
-	}
-
-	return &user, nil
-}
-
-// SaveUserInvite saves a user invite to the database
-func (s *SqlStore) SaveUserInvite(ctx context.Context, invite *types.UserInviteRecord) error {
-	inviteCopy := invite.Copy()
-	if err := inviteCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
-		return fmt.Errorf("encrypt invite: %w", err)
-	}
-
-	result := s.db.Save(inviteCopy)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to save user invite to store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to save user invite to store")
-	}
-	return nil
-}
-
-// GetUserInviteByID retrieves a user invite by its ID and account ID
-func (s *SqlStore) GetUserInviteByID(ctx context.Context, lockStrength LockingStrength, accountID, inviteID string) (*types.UserInviteRecord, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var invite types.UserInviteRecord
-	result := tx.Where("account_id = ?", accountID).Take(&invite, idQueryCondition, inviteID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "user invite not found")
-		}
-		log.WithContext(ctx).Errorf("failed to get user invite from store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get user invite from store")
-	}
-
-	if err := invite.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-		return nil, fmt.Errorf("decrypt invite: %w", err)
-	}
-
-	return &invite, nil
-}
-
-// GetUserInviteByHashedToken retrieves a user invite by its hashed token
-func (s *SqlStore) GetUserInviteByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken string) (*types.UserInviteRecord, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var invite types.UserInviteRecord
-	result := tx.Take(&invite, "hashed_token = ?", hashedToken)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "user invite not found")
-		}
-		log.WithContext(ctx).Errorf("failed to get user invite from store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get user invite from store")
-	}
-
-	if err := invite.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-		return nil, fmt.Errorf("decrypt invite: %w", err)
-	}
-
-	return &invite, nil
-}
-
-// GetUserInviteByEmail retrieves a user invite by account ID and email.
-// Since email is encrypted with random IVs, we fetch all invites for the account
-// and compare emails in memory after decryption.
-func (s *SqlStore) GetUserInviteByEmail(ctx context.Context, lockStrength LockingStrength, accountID, email string) (*types.UserInviteRecord, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var invites []*types.UserInviteRecord
-	result := tx.Find(&invites, "account_id = ?", accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get user invites from store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get user invites from store")
-	}
-
-	for _, invite := range invites {
-		if err := invite.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-			return nil, fmt.Errorf("decrypt invite: %w", err)
-		}
-		if strings.EqualFold(invite.Email, email) {
-			return invite, nil
-		}
-	}
-
-	return nil, status.Errorf(status.NotFound, "user invite not found for email")
-}
-
-// GetAccountUserInvites retrieves all user invites for an account
-func (s *SqlStore) GetAccountUserInvites(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.UserInviteRecord, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var invites []*types.UserInviteRecord
-	result := tx.Find(&invites, "account_id = ?", accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get user invites from store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get user invites from store")
-	}
-
-	for _, invite := range invites {
-		if err := invite.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-			return nil, fmt.Errorf("decrypt invite: %w", err)
-		}
-	}
-
-	return invites, nil
-}
-
-// DeleteUserInvite deletes a user invite by its ID
-func (s *SqlStore) DeleteUserInvite(ctx context.Context, inviteID string) error {
-	result := s.db.Delete(&types.UserInviteRecord{}, idQueryCondition, inviteID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete user invite from store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to delete user invite from store")
-	}
-	return nil
-}
-
-func (s *SqlStore) GetAccountGroups(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.Group, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var groups []*types.Group
-	result := tx.Preload(clause.Associations).Find(&groups, accountIDCondition, accountID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "accountID not found: index lookup failed")
-		}
-		log.WithContext(ctx).Errorf("failed to get account groups from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get account groups from the store")
-	}
-
-	for _, g := range groups {
-		g.LoadGroupPeers()
-	}
-
-	return groups, nil
-}
-
-func (s *SqlStore) GetResourceGroups(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) ([]*types.Group, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var groups []*types.Group
-
-	likePattern := `%"ID":"` + resourceID + `"%`
-
-	result := tx.
-		Preload(clause.Associations).
-		Where("resources LIKE ?", likePattern).
-		Find(&groups)
-
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, nil
-		}
-		return nil, result.Error
-	}
-
-	for _, g := range groups {
-		g.LoadGroupPeers()
-	}
-
-	return groups, nil
-}
-
-func (s *SqlStore) GetAccountsCounter(ctx context.Context) (int64, error) {
-	var count int64
-	result := s.db.Model(&types.Account{}).Count(&count)
-	if result.Error != nil {
-		return 0, fmt.Errorf("failed to get all accounts counter: %w", result.Error)
-	}
-
-	return count, nil
-}
-
-// GetCustomDomainsCounts returns the total and validated custom domain counts.
-func (s *SqlStore) GetCustomDomainsCounts(ctx context.Context) (int64, int64, error) {
-	var total, validated int64
-	if err := s.db.Model(&domain.Domain{}).Count(&total).Error; err != nil {
-		return 0, 0, err
-	}
-	if err := s.db.Model(&domain.Domain{}).Where("validated = ?", true).Count(&validated).Error; err != nil {
-		return 0, 0, err
-	}
-	return total, validated, nil
-}
-
-// GetProxyMetrics aggregates per-cluster + per-proxy counts for the
-// self-hosted telemetry payload. Single round-trip via conditional
-// aggregations so a large proxies table doesn't fan out into multiple
-// queries.
-func (s *SqlStore) GetProxyMetrics(ctx context.Context) (ProxyMetrics, error) {
-	var m ProxyMetrics
-	activeCutoff := time.Now().Add(-proxyActiveThreshold)
-
-	// COUNT(DISTINCT ... CASE WHEN ...) is portable across sqlite/postgres
-	// (MySQL too) and keeps the round-trip to one. proxy.StatusConnected
-	// is the same string the cluster-capability queries use; the active
-	// window matches the cluster-capability semantics (only proxies
-	// heartbeating within ~2 * heartbeat interval count as connected).
-	row := s.db.WithContext(ctx).
-		Model(&proxy.Proxy{}).
-		Select(
-			"COUNT(DISTINCT cluster_address) AS clusters, "+
-				"COUNT(DISTINCT CASE WHEN account_id IS NOT NULL THEN cluster_address END) AS clusters_byop, "+
-				"COUNT(DISTINCT CASE WHEN private = ? THEN cluster_address END) AS clusters_private, "+
-				"COUNT(*) AS proxies, "+
-				"COUNT(CASE WHEN status = ? AND last_seen > ? THEN 1 END) AS proxies_connected",
-			true,
-			proxy.StatusConnected,
-			activeCutoff,
-		).
-		Row()
-	if err := row.Scan(&m.Clusters, &m.ClustersBYOP, &m.ClustersPrivate, &m.Proxies, &m.ProxiesConnected); err != nil {
-		return ProxyMetrics{}, fmt.Errorf("scan proxy metrics: %w", err)
-	}
-	return m, nil
-}
-
-func (s *SqlStore) GetAllAccounts(ctx context.Context) (all []*types.Account) {
-	var accounts []types.Account
-	result := s.db.Find(&accounts)
-	if result.Error != nil {
-		return all
-	}
-
-	for _, account := range accounts {
-		if acc, err := s.GetAccount(ctx, account.Id); err == nil {
-			all = append(all, acc)
-		}
-	}
-
-	return all
-}
-
-func (s *SqlStore) GetAccountMeta(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.AccountMeta, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var accountMeta types.AccountMeta
-	result := tx.Model(&types.Account{}).
-		Take(&accountMeta, idQueryCondition, accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("error when getting account meta %s from the store: %s", accountID, result.Error)
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewAccountNotFoundError(accountID)
-		}
-		return nil, status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	return &accountMeta, nil
-}
-
-// GetAccountOnboarding retrieves the onboarding information for a specific account.
-func (s *SqlStore) GetAccountOnboarding(ctx context.Context, accountID string) (*types.AccountOnboarding, error) {
-	var accountOnboarding types.AccountOnboarding
-	result := s.db.Model(&accountOnboarding).Take(&accountOnboarding, accountIDCondition, accountID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewAccountOnboardingNotFoundError(accountID)
-		}
-		log.WithContext(ctx).Errorf("error when getting account onboarding %s from the store: %s", accountID, result.Error)
-		return nil, status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	return &accountOnboarding, nil
-}
-
-// SaveAccountOnboarding updates the onboarding information for a specific account.
-func (s *SqlStore) SaveAccountOnboarding(ctx context.Context, onboarding *types.AccountOnboarding) error {
-	result := s.db.Clauses(clause.OnConflict{UpdateAll: true}).Create(onboarding)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("error when saving account onboarding %s in the store: %s", onboarding.AccountID, result.Error)
-		return status.Errorf(status.Internal, "error when saving account onboarding %s in the store: %s", onboarding.AccountID, result.Error)
-	}
-
-	return nil
-}
-
-func (s *SqlStore) GetAccount(ctx context.Context, accountID string) (*types.Account, error) {
-	if s.pool != nil {
-		return s.getAccountPgx(ctx, accountID)
-	}
-	return s.getAccountGorm(ctx, accountID)
-}
-
-func (s *SqlStore) getAccountGorm(ctx context.Context, accountID string) (*types.Account, error) {
-	start := time.Now()
-	defer func() {
-		elapsed := time.Since(start)
-		if elapsed > 1*time.Second {
-			log.WithContext(ctx).Tracef("GetAccount for account %s exceeded 1s, took: %v", accountID, elapsed)
-		}
-	}()
-
-	var account types.Account
-	result := s.db.Model(&account).
-		Preload("UsersG.PATsG"). // have to be specified as this is nested reference
-		Preload("Policies.Rules").
-		Preload("SetupKeysG").
-		Preload("PeersG").
-		Preload("UsersG").
-		Preload("GroupsG.GroupPeers").
-		Preload("RoutesG").
-		Preload("NameServerGroupsG").
-		Preload("PostureChecks").
-		Preload("Networks").
-		Preload("NetworkRouters").
-		Preload("NetworkResources").
-		Preload("Onboarding").
-		Preload("Services.Targets").
-		Preload("Domains").
-		Take(&account, idQueryCondition, accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("error when getting account %s from the store: %s", accountID, result.Error)
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewAccountNotFoundError(accountID)
-		}
-		return nil, status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	account.SetupKeys = make(map[string]*types.SetupKey, len(account.SetupKeysG))
-	for _, key := range account.SetupKeysG {
-		if key.UpdatedAt.IsZero() {
-			key.UpdatedAt = key.CreatedAt
-		}
-		if key.AutoGroups == nil {
-			key.AutoGroups = []string{}
-		}
-		account.SetupKeys[key.Key] = &key
-	}
-	account.SetupKeysG = nil
-
-	account.Peers = make(map[string]*nbpeer.Peer, len(account.PeersG))
-	for _, peer := range account.PeersG {
-		account.Peers[peer.ID] = &peer
-	}
-	account.PeersG = nil
-	account.Users = make(map[string]*types.User, len(account.UsersG))
-	for _, user := range account.UsersG {
-		user.PATs = make(map[string]*types.PersonalAccessToken, len(user.PATs))
-		for _, pat := range user.PATsG {
-			pat.UserID = ""
-			user.PATs[pat.ID] = &pat
-		}
-		if user.AutoGroups == nil {
-			user.AutoGroups = []string{}
-		}
-		if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-			return nil, fmt.Errorf("decrypt user: %w", err)
-		}
-		account.Users[user.Id] = &user
-		user.PATsG = nil
-	}
-	account.UsersG = nil
-	account.Groups = make(map[string]*types.Group, len(account.GroupsG))
-	for _, group := range account.GroupsG {
-		group.Peers = make([]string, len(group.GroupPeers))
-		for i, gp := range group.GroupPeers {
-			group.Peers[i] = gp.PeerID
-		}
-		if group.Resources == nil {
-			group.Resources = []types.Resource{}
-		}
-		account.Groups[group.ID] = group
-	}
-	account.GroupsG = nil
-
-	account.Routes = make(map[route.ID]*route.Route, len(account.RoutesG))
-	for _, route := range account.RoutesG {
-		account.Routes[route.ID] = &route
-	}
-	account.RoutesG = nil
-	account.NameServerGroups = make(map[string]*nbdns.NameServerGroup, len(account.NameServerGroupsG))
-	for _, ns := range account.NameServerGroupsG {
-		ns.AccountID = ""
-		if ns.NameServers == nil {
-			ns.NameServers = []nbdns.NameServer{}
-		}
-		if ns.Groups == nil {
-			ns.Groups = []string{}
-		}
-		if ns.Domains == nil {
-			ns.Domains = []string{}
-		}
-		account.NameServerGroups[ns.ID] = &ns
-	}
-	account.NameServerGroupsG = nil
-	return &account, nil
-}
-
-func (s *SqlStore) getAccountPgx(ctx context.Context, accountID string) (*types.Account, error) {
-	account, err := s.getAccount(ctx, accountID)
-	if err != nil {
-		return nil, err
-	}
-
-	var wg sync.WaitGroup
-	errChan := make(chan error, 16)
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		keys, err := s.getSetupKeys(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.SetupKeysG = keys
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		peers, err := s.getPeers(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.PeersG = peers
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		users, err := s.getUsers(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.UsersG = users
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		groups, err := s.getGroups(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.GroupsG = groups
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		policies, err := s.getPolicies(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.Policies = policies
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		routes, err := s.getRoutes(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.RoutesG = routes
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		nsgs, err := s.getNameServerGroups(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.NameServerGroupsG = nsgs
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		checks, err := s.getPostureChecks(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.PostureChecks = checks
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		services, err := s.getServices(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.Services = services
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		domains, err := s.ListCustomDomains(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.Domains = domains
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		networks, err := s.getNetworks(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.Networks = networks
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		routers, err := s.getNetworkRouters(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.NetworkRouters = routers
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		resources, err := s.getNetworkResources(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.NetworkResources = resources
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		err := s.getAccountOnboarding(ctx, accountID, account)
-		if err != nil {
-			errChan <- err
-			return
-		}
-	}()
-
-	wg.Wait()
-	close(errChan)
-	for e := range errChan {
-		if e != nil {
-			return nil, e
-		}
-	}
-
-	var userIDs []string
-	for _, u := range account.UsersG {
-		userIDs = append(userIDs, u.Id)
-	}
-	var policyIDs []string
-	for _, p := range account.Policies {
-		policyIDs = append(policyIDs, p.ID)
-	}
-	var groupIDs []string
-	for _, g := range account.GroupsG {
-		groupIDs = append(groupIDs, g.ID)
-	}
-
-	wg.Add(3)
-	errChan = make(chan error, 3)
-
-	var pats []types.PersonalAccessToken
-	go func() {
-		defer wg.Done()
-		var err error
-		pats, err = s.getPersonalAccessTokens(ctx, userIDs)
-		if err != nil {
-			errChan <- err
-		}
-	}()
-
-	var rules []*types.PolicyRule
-	go func() {
-		defer wg.Done()
-		var err error
-		rules, err = s.getPolicyRules(ctx, policyIDs)
-		if err != nil {
-			errChan <- err
-		}
-	}()
-
-	var groupPeers []types.GroupPeer
-	go func() {
-		defer wg.Done()
-		var err error
-		groupPeers, err = s.getGroupPeers(ctx, groupIDs)
-		if err != nil {
-			errChan <- err
-		}
-	}()
-
-	wg.Wait()
-	close(errChan)
-	for e := range errChan {
-		if e != nil {
-			return nil, e
-		}
-	}
-
-	patsByUserID := make(map[string][]*types.PersonalAccessToken)
-	for i := range pats {
-		pat := &pats[i]
-		patsByUserID[pat.UserID] = append(patsByUserID[pat.UserID], pat)
-		pat.UserID = ""
-	}
-
-	rulesByPolicyID := make(map[string][]*types.PolicyRule)
-	for _, rule := range rules {
-		rulesByPolicyID[rule.PolicyID] = append(rulesByPolicyID[rule.PolicyID], rule)
-	}
-
-	peersByGroupID := make(map[string][]string)
-	for _, gp := range groupPeers {
-		peersByGroupID[gp.GroupID] = append(peersByGroupID[gp.GroupID], gp.PeerID)
-	}
-
-	account.SetupKeys = make(map[string]*types.SetupKey, len(account.SetupKeysG))
-	for i := range account.SetupKeysG {
-		key := &account.SetupKeysG[i]
-		account.SetupKeys[key.Key] = key
-	}
-
-	account.Peers = make(map[string]*nbpeer.Peer, len(account.PeersG))
-	for i := range account.PeersG {
-		peer := &account.PeersG[i]
-		account.Peers[peer.ID] = peer
-	}
-
-	account.Users = make(map[string]*types.User, len(account.UsersG))
-	for i := range account.UsersG {
-		user := &account.UsersG[i]
-		if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-			return nil, fmt.Errorf("decrypt user: %w", err)
-		}
-		user.PATs = make(map[string]*types.PersonalAccessToken)
-		if userPats, ok := patsByUserID[user.Id]; ok {
-			for j := range userPats {
-				pat := userPats[j]
-				user.PATs[pat.ID] = pat
-			}
-		}
-		account.Users[user.Id] = user
-	}
-
-	for i := range account.Policies {
-		policy := account.Policies[i]
-		if policyRules, ok := rulesByPolicyID[policy.ID]; ok {
-			policy.Rules = policyRules
-		}
-	}
-
-	account.Groups = make(map[string]*types.Group, len(account.GroupsG))
-	for i := range account.GroupsG {
-		group := account.GroupsG[i]
-		if peerIDs, ok := peersByGroupID[group.ID]; ok {
-			group.Peers = peerIDs
-		}
-		account.Groups[group.ID] = group
-	}
-
-	account.Routes = make(map[route.ID]*route.Route, len(account.RoutesG))
-	for i := range account.RoutesG {
-		route := &account.RoutesG[i]
-		account.Routes[route.ID] = route
-	}
-
-	account.NameServerGroups = make(map[string]*nbdns.NameServerGroup, len(account.NameServerGroupsG))
-	for i := range account.NameServerGroupsG {
-		nsg := &account.NameServerGroupsG[i]
-		nsg.AccountID = ""
-		account.NameServerGroups[nsg.ID] = nsg
-	}
-
-	account.SetupKeysG = nil
-	account.PeersG = nil
-	account.UsersG = nil
-	account.GroupsG = nil
-	account.RoutesG = nil
-	account.NameServerGroupsG = nil
-
-	return account, nil
-}
-
-func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Account, error) {
-	var account types.Account
-	account.Network = &types.Network{}
-	const accountQuery = `
-		SELECT
-			id, created_by, created_at, domain, domain_category, is_domain_primary_account,
-			-- Embedded Network
-			network_identifier, network_net, network_net_v6, network_dns, network_serial,
-			-- Embedded DNSSettings
-			dns_settings_disabled_management_groups,
-			-- Embedded Settings
-			settings_peer_login_expiration_enabled, settings_peer_login_expiration,
-			settings_peer_inactivity_expiration_enabled, settings_peer_inactivity_expiration,
-			settings_regular_users_view_blocked, settings_groups_propagation_enabled,
-			settings_jwt_groups_enabled, settings_jwt_groups_claim_name, settings_jwt_allow_groups,
-			settings_routing_peer_dns_resolution_enabled, settings_dns_domain, settings_network_range,
-			settings_network_range_v6, settings_ipv6_enabled_groups, settings_lazy_connection_enabled,
-			settings_local_mfa_enabled, settings_metrics_push_enabled,
-			-- Embedded ExtraSettings
-			settings_extra_peer_approval_enabled, settings_extra_user_approval_required,
-			settings_extra_integrated_validator, settings_extra_integrated_validator_groups
-		FROM accounts WHERE id = $1`
-
-	var (
-		sPeerLoginExpirationEnabled      sql.NullBool
-		sPeerLoginExpiration             sql.NullInt64
-		sPeerInactivityExpirationEnabled sql.NullBool
-		sPeerInactivityExpiration        sql.NullInt64
-		sRegularUsersViewBlocked         sql.NullBool
-		sGroupsPropagationEnabled        sql.NullBool
-		sJWTGroupsEnabled                sql.NullBool
-		sJWTGroupsClaimName              sql.NullString
-		sJWTAllowGroups                  sql.NullString
-		sRoutingPeerDNSResolutionEnabled sql.NullBool
-		sDNSDomain                       sql.NullString
-		sNetworkRange                    sql.NullString
-		sNetworkRangeV6                  sql.NullString
-		sIPv6EnabledGroups               sql.NullString
-		sLazyConnectionEnabled           sql.NullBool
-		sLocalMFAEnabled                 sql.NullBool
-		sMetricsPushEnabled              sql.NullBool
-		sExtraPeerApprovalEnabled        sql.NullBool
-		sExtraUserApprovalRequired       sql.NullBool
-		sExtraIntegratedValidator        sql.NullString
-		sExtraIntegratedValidatorGroups  sql.NullString
-		networkNet                       sql.NullString
-		networkNetV6                     sql.NullString
-		dnsSettingsDisabledGroups        sql.NullString
-		networkIdentifier                sql.NullString
-		networkDns                       sql.NullString
-		networkSerial                    sql.NullInt64
-		createdAt                        sql.NullTime
-	)
-	err := s.pool.QueryRow(ctx, accountQuery, accountID).Scan(
-		&account.Id, &account.CreatedBy, &createdAt, &account.Domain, &account.DomainCategory, &account.IsDomainPrimaryAccount,
-		&networkIdentifier, &networkNet, &networkNetV6, &networkDns, &networkSerial,
-		&dnsSettingsDisabledGroups,
-		&sPeerLoginExpirationEnabled, &sPeerLoginExpiration,
-		&sPeerInactivityExpirationEnabled, &sPeerInactivityExpiration,
-		&sRegularUsersViewBlocked, &sGroupsPropagationEnabled,
-		&sJWTGroupsEnabled, &sJWTGroupsClaimName, &sJWTAllowGroups,
-		&sRoutingPeerDNSResolutionEnabled, &sDNSDomain, &sNetworkRange,
-		&sNetworkRangeV6, &sIPv6EnabledGroups, &sLazyConnectionEnabled,
-		&sLocalMFAEnabled, &sMetricsPushEnabled,
-		&sExtraPeerApprovalEnabled, &sExtraUserApprovalRequired,
-		&sExtraIntegratedValidator, &sExtraIntegratedValidatorGroups,
-	)
-	if err != nil {
-		if errors.Is(err, pgx.ErrNoRows) {
-			return nil, status.NewAccountNotFoundError(accountID)
-		}
-		return nil, status.NewGetAccountFromStoreError(err)
-	}
-
-	account.Settings = &types.Settings{Extra: &types.ExtraSettings{}}
-	if networkNet.Valid {
-		_ = json.Unmarshal([]byte(networkNet.String), &account.Network.Net)
-	}
-	if createdAt.Valid {
-		account.CreatedAt = createdAt.Time
-	}
-	if dnsSettingsDisabledGroups.Valid {
-		_ = json.Unmarshal([]byte(dnsSettingsDisabledGroups.String), &account.DNSSettings.DisabledManagementGroups)
-	}
-	if networkIdentifier.Valid {
-		account.Network.Identifier = networkIdentifier.String
-	}
-	if networkDns.Valid {
-		account.Network.Dns = networkDns.String
-	}
-	if networkSerial.Valid {
-		account.Network.Serial = uint64(networkSerial.Int64)
-	}
-	if sPeerLoginExpirationEnabled.Valid {
-		account.Settings.PeerLoginExpirationEnabled = sPeerLoginExpirationEnabled.Bool
-	}
-	if sPeerLoginExpiration.Valid {
-		account.Settings.PeerLoginExpiration = time.Duration(sPeerLoginExpiration.Int64)
-	}
-	if sPeerInactivityExpirationEnabled.Valid {
-		account.Settings.PeerInactivityExpirationEnabled = sPeerInactivityExpirationEnabled.Bool
-	}
-	if sPeerInactivityExpiration.Valid {
-		account.Settings.PeerInactivityExpiration = time.Duration(sPeerInactivityExpiration.Int64)
-	}
-	if sRegularUsersViewBlocked.Valid {
-		account.Settings.RegularUsersViewBlocked = sRegularUsersViewBlocked.Bool
-	}
-	if sGroupsPropagationEnabled.Valid {
-		account.Settings.GroupsPropagationEnabled = sGroupsPropagationEnabled.Bool
-	}
-	if sJWTGroupsEnabled.Valid {
-		account.Settings.JWTGroupsEnabled = sJWTGroupsEnabled.Bool
-	}
-	if sJWTGroupsClaimName.Valid {
-		account.Settings.JWTGroupsClaimName = sJWTGroupsClaimName.String
-	}
-	if sRoutingPeerDNSResolutionEnabled.Valid {
-		account.Settings.RoutingPeerDNSResolutionEnabled = sRoutingPeerDNSResolutionEnabled.Bool
-	}
-	if sDNSDomain.Valid {
-		account.Settings.DNSDomain = sDNSDomain.String
-	}
-	if sLazyConnectionEnabled.Valid {
-		account.Settings.LazyConnectionEnabled = sLazyConnectionEnabled.Bool
-	}
-	if sLocalMFAEnabled.Valid {
-		account.Settings.LocalMfaEnabled = sLocalMFAEnabled.Bool
-	}
-	if sMetricsPushEnabled.Valid {
-		account.Settings.MetricsPushEnabled = sMetricsPushEnabled.Bool
-	}
-	if sJWTAllowGroups.Valid {
-		_ = json.Unmarshal([]byte(sJWTAllowGroups.String), &account.Settings.JWTAllowGroups)
-	}
-	if sNetworkRange.Valid {
-		_ = json.Unmarshal([]byte(sNetworkRange.String), &account.Settings.NetworkRange)
-	}
-	if networkNetV6.Valid {
-		_ = json.Unmarshal([]byte(networkNetV6.String), &account.Network.NetV6)
-	}
-	if sNetworkRangeV6.Valid {
-		_ = json.Unmarshal([]byte(sNetworkRangeV6.String), &account.Settings.NetworkRangeV6)
-	}
-	if sIPv6EnabledGroups.Valid {
-		_ = json.Unmarshal([]byte(sIPv6EnabledGroups.String), &account.Settings.IPv6EnabledGroups)
-	}
-
-	if sExtraPeerApprovalEnabled.Valid {
-		account.Settings.Extra.PeerApprovalEnabled = sExtraPeerApprovalEnabled.Bool
-	}
-	if sExtraUserApprovalRequired.Valid {
-		account.Settings.Extra.UserApprovalRequired = sExtraUserApprovalRequired.Bool
-	}
-	if sExtraIntegratedValidator.Valid {
-		account.Settings.Extra.IntegratedValidator = sExtraIntegratedValidator.String
-	}
-	if sExtraIntegratedValidatorGroups.Valid {
-		_ = json.Unmarshal([]byte(sExtraIntegratedValidatorGroups.String), &account.Settings.Extra.IntegratedValidatorGroups)
-	}
-	return &account, nil
-}
-
-func (s *SqlStore) getSetupKeys(ctx context.Context, accountID string) ([]types.SetupKey, error) {
-	const query = `SELECT id, account_id, key, key_secret, name, type, created_at, expires_at, updated_at, 
-	revoked, used_times, last_used, auto_groups, usage_limit, ephemeral, allow_extra_dns_labels FROM setup_keys WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-
-	keys, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (types.SetupKey, error) {
-		var sk types.SetupKey
-		var autoGroups []byte
-		var skCreatedAt, expiresAt, updatedAt, lastUsed sql.NullTime
-		var revoked, ephemeral, allowExtraDNSLabels sql.NullBool
-		var usedTimes, usageLimit sql.NullInt64
-
-		err := row.Scan(&sk.Id, &sk.AccountID, &sk.Key, &sk.KeySecret, &sk.Name, &sk.Type, &skCreatedAt,
-			&expiresAt, &updatedAt, &revoked, &usedTimes, &lastUsed, &autoGroups, &usageLimit, &ephemeral, &allowExtraDNSLabels)
-
-		if err == nil {
-			if expiresAt.Valid {
-				sk.ExpiresAt = &expiresAt.Time
-			}
-			if skCreatedAt.Valid {
-				sk.CreatedAt = skCreatedAt.Time
-			}
-			if updatedAt.Valid {
-				sk.UpdatedAt = updatedAt.Time
-				if sk.UpdatedAt.IsZero() {
-					sk.UpdatedAt = sk.CreatedAt
-				}
-			}
-			if lastUsed.Valid {
-				sk.LastUsed = &lastUsed.Time
-			}
-			if revoked.Valid {
-				sk.Revoked = revoked.Bool
-			}
-			if usedTimes.Valid {
-				sk.UsedTimes = int(usedTimes.Int64)
-			}
-			if usageLimit.Valid {
-				sk.UsageLimit = int(usageLimit.Int64)
-			}
-			if ephemeral.Valid {
-				sk.Ephemeral = ephemeral.Bool
-			}
-			if allowExtraDNSLabels.Valid {
-				sk.AllowExtraDNSLabels = allowExtraDNSLabels.Bool
-			}
-			if autoGroups != nil {
-				_ = json.Unmarshal(autoGroups, &sk.AutoGroups)
-			} else {
-				sk.AutoGroups = []string{}
-			}
-		}
-		return sk, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	return keys, nil
-}
-
-func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Peer, error) {
-	const query = `SELECT id, account_id, key, ip, name, dns_label, user_id, ssh_key, ssh_enabled, login_expiration_enabled,
-	inactivity_expiration_enabled, last_login, created_at, ephemeral, extra_dns_labels, allow_extra_dns_labels, meta_hostname,
-	meta_go_os, meta_kernel, meta_core, meta_platform, meta_os, meta_os_version, meta_wt_version, meta_ui_version,
-	meta_kernel_version, meta_network_addresses, meta_system_serial_number, meta_system_product_name, meta_system_manufacturer,
-	meta_environment, meta_flags, meta_files, meta_capabilities, peer_status_last_seen, peer_status_session_started_at,
-	peer_status_connected, peer_status_login_expired, peer_status_requires_approval, location_connection_ip,
-	location_country_code, location_city_name, location_geo_name_id, proxy_meta_embedded, proxy_meta_cluster, ipv6
-	FROM peers WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-
-	peers, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (nbpeer.Peer, error) {
-		var p nbpeer.Peer
-		p.Status = &nbpeer.PeerStatus{}
-		var (
-			lastLogin, createdAt                                                                            sql.NullTime
-			sshEnabled, loginExpirationEnabled, inactivityExpirationEnabled, ephemeral, allowExtraDNSLabels sql.NullBool
-			peerStatusLastSeen                                                                              sql.NullTime
-			peerStatusSessionStartedAt                                                                      sql.NullInt64
-			peerStatusConnected, peerStatusLoginExpired, peerStatusRequiresApproval, proxyEmbedded          sql.NullBool
-			ip, extraDNS, netAddr, env, flags, files, capabilities, connIP, ipv6                            []byte
-			metaHostname, metaGoOS, metaKernel, metaCore, metaPlatform                                      sql.NullString
-			metaOS, metaOSVersion, metaWtVersion, metaUIVersion, metaKernelVersion                          sql.NullString
-			metaSystemSerialNumber, metaSystemProductName, metaSystemManufacturer                           sql.NullString
-			locationCountryCode, locationCityName, proxyCluster                                             sql.NullString
-			locationGeoNameID                                                                               sql.NullInt64
-		)
-
-		err := row.Scan(&p.ID, &p.AccountID, &p.Key, &ip, &p.Name, &p.DNSLabel, &p.UserID, &p.SSHKey, &sshEnabled,
-			&loginExpirationEnabled, &inactivityExpirationEnabled, &lastLogin, &createdAt, &ephemeral, &extraDNS,
-			&allowExtraDNSLabels, &metaHostname, &metaGoOS, &metaKernel, &metaCore, &metaPlatform,
-			&metaOS, &metaOSVersion, &metaWtVersion, &metaUIVersion, &metaKernelVersion, &netAddr,
-			&metaSystemSerialNumber, &metaSystemProductName, &metaSystemManufacturer, &env, &flags, &files, &capabilities,
-			&peerStatusLastSeen, &peerStatusSessionStartedAt, &peerStatusConnected, &peerStatusLoginExpired,
-			&peerStatusRequiresApproval, &connIP, &locationCountryCode, &locationCityName, &locationGeoNameID,
-			&proxyEmbedded, &proxyCluster, &ipv6)
-
-		if err == nil {
-			if lastLogin.Valid {
-				p.LastLogin = &lastLogin.Time
-			}
-			if createdAt.Valid {
-				p.CreatedAt = createdAt.Time
-			}
-			if sshEnabled.Valid {
-				p.SSHEnabled = sshEnabled.Bool
-			}
-			if loginExpirationEnabled.Valid {
-				p.LoginExpirationEnabled = loginExpirationEnabled.Bool
-			}
-			if inactivityExpirationEnabled.Valid {
-				p.InactivityExpirationEnabled = inactivityExpirationEnabled.Bool
-			}
-			if ephemeral.Valid {
-				p.Ephemeral = ephemeral.Bool
-			}
-			if allowExtraDNSLabels.Valid {
-				p.AllowExtraDNSLabels = allowExtraDNSLabels.Bool
-			}
-			if peerStatusLastSeen.Valid {
-				p.Status.LastSeen = peerStatusLastSeen.Time
-			}
-			if peerStatusSessionStartedAt.Valid {
-				p.Status.SessionStartedAt = peerStatusSessionStartedAt.Int64
-			}
-			if peerStatusConnected.Valid {
-				p.Status.Connected = peerStatusConnected.Bool
-			}
-			if peerStatusLoginExpired.Valid {
-				p.Status.LoginExpired = peerStatusLoginExpired.Bool
-			}
-			if peerStatusRequiresApproval.Valid {
-				p.Status.RequiresApproval = peerStatusRequiresApproval.Bool
-			}
-			if metaHostname.Valid {
-				p.Meta.Hostname = metaHostname.String
-			}
-			if metaGoOS.Valid {
-				p.Meta.GoOS = metaGoOS.String
-			}
-			if metaKernel.Valid {
-				p.Meta.Kernel = metaKernel.String
-			}
-			if metaCore.Valid {
-				p.Meta.Core = metaCore.String
-			}
-			if metaPlatform.Valid {
-				p.Meta.Platform = metaPlatform.String
-			}
-			if metaOS.Valid {
-				p.Meta.OS = metaOS.String
-			}
-			if metaOSVersion.Valid {
-				p.Meta.OSVersion = metaOSVersion.String
-			}
-			if metaWtVersion.Valid {
-				p.Meta.WtVersion = metaWtVersion.String
-			}
-			if metaUIVersion.Valid {
-				p.Meta.UIVersion = metaUIVersion.String
-			}
-			if metaKernelVersion.Valid {
-				p.Meta.KernelVersion = metaKernelVersion.String
-			}
-			if metaSystemSerialNumber.Valid {
-				p.Meta.SystemSerialNumber = metaSystemSerialNumber.String
-			}
-			if metaSystemProductName.Valid {
-				p.Meta.SystemProductName = metaSystemProductName.String
-			}
-			if metaSystemManufacturer.Valid {
-				p.Meta.SystemManufacturer = metaSystemManufacturer.String
-			}
-			if locationCountryCode.Valid {
-				p.Location.CountryCode = locationCountryCode.String
-			}
-			if locationCityName.Valid {
-				p.Location.CityName = locationCityName.String
-			}
-			if locationGeoNameID.Valid {
-				p.Location.GeoNameID = uint(locationGeoNameID.Int64)
-			}
-			if proxyEmbedded.Valid {
-				p.ProxyMeta.Embedded = proxyEmbedded.Bool
-			}
-			if proxyCluster.Valid {
-				p.ProxyMeta.Cluster = proxyCluster.String
-			}
-			if ip != nil {
-				_ = json.Unmarshal(ip, &p.IP)
-			}
-			if ipv6 != nil {
-				_ = json.Unmarshal(ipv6, &p.IPv6)
-			}
-			if extraDNS != nil {
-				_ = json.Unmarshal(extraDNS, &p.ExtraDNSLabels)
-			}
-			if netAddr != nil {
-				_ = json.Unmarshal(netAddr, &p.Meta.NetworkAddresses)
-			}
-			if env != nil {
-				_ = json.Unmarshal(env, &p.Meta.Environment)
-			}
-			if flags != nil {
-				_ = json.Unmarshal(flags, &p.Meta.Flags)
-			}
-			if files != nil {
-				_ = json.Unmarshal(files, &p.Meta.Files)
-			}
-			if capabilities != nil {
-				_ = json.Unmarshal(capabilities, &p.Meta.Capabilities)
-			}
-			if connIP != nil {
-				_ = json.Unmarshal(connIP, &p.Location.ConnectionIP)
-			}
-		}
-		return p, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	return peers, nil
-}
-
-func (s *SqlStore) getUsers(ctx context.Context, accountID string) ([]types.User, error) {
-	const query = `SELECT id, account_id, role, is_service_user, non_deletable, service_user_name, auto_groups, blocked, pending_approval, last_login, created_at, issued, integration_ref_id, integration_ref_integration_type, email, name FROM users WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-	users, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (types.User, error) {
-		var u types.User
-		var autoGroups []byte
-		var lastLogin, createdAt sql.NullTime
-		var isServiceUser, nonDeletable, blocked, pendingApproval sql.NullBool
-		err := row.Scan(&u.Id, &u.AccountID, &u.Role, &isServiceUser, &nonDeletable, &u.ServiceUserName, &autoGroups, &blocked, &pendingApproval, &lastLogin, &createdAt, &u.Issued, &u.IntegrationReference.ID, &u.IntegrationReference.IntegrationType, &u.Email, &u.Name)
-		if err == nil {
-			if lastLogin.Valid {
-				u.LastLogin = &lastLogin.Time
-			}
-			if createdAt.Valid {
-				u.CreatedAt = createdAt.Time
-			}
-			if isServiceUser.Valid {
-				u.IsServiceUser = isServiceUser.Bool
-			}
-			if nonDeletable.Valid {
-				u.NonDeletable = nonDeletable.Bool
-			}
-			if blocked.Valid {
-				u.Blocked = blocked.Bool
-			}
-			if pendingApproval.Valid {
-				u.PendingApproval = pendingApproval.Bool
-			}
-			if autoGroups != nil {
-				_ = json.Unmarshal(autoGroups, &u.AutoGroups)
-			} else {
-				u.AutoGroups = []string{}
-			}
-		}
-		return u, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	return users, nil
-}
-
-func (s *SqlStore) getGroups(ctx context.Context, accountID string) ([]*types.Group, error) {
-	const query = `SELECT id, account_id, name, issued, resources, integration_ref_id, integration_ref_integration_type FROM groups WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-	groups, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (*types.Group, error) {
-		var g types.Group
-		var resources []byte
-		var refID sql.NullInt64
-		var refType sql.NullString
-		err := row.Scan(&g.ID, &g.AccountID, &g.Name, &g.Issued, &resources, &refID, &refType)
-		if err == nil {
-			if refID.Valid {
-				g.IntegrationReference.ID = int(refID.Int64)
-			}
-			if refType.Valid {
-				g.IntegrationReference.IntegrationType = refType.String
-			}
-			if resources != nil {
-				_ = json.Unmarshal(resources, &g.Resources)
-			} else {
-				g.Resources = []types.Resource{}
-			}
-			g.GroupPeers = []types.GroupPeer{}
-			g.Peers = []string{}
-		}
-		return &g, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	return groups, nil
-}
-
-func (s *SqlStore) getPolicies(ctx context.Context, accountID string) ([]*types.Policy, error) {
-	const query = `SELECT id, account_id, name, description, enabled, source_posture_checks FROM policies WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-	policies, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (*types.Policy, error) {
-		var p types.Policy
-		var checks []byte
-		var enabled sql.NullBool
-		err := row.Scan(&p.ID, &p.AccountID, &p.Name, &p.Description, &enabled, &checks)
-		if err == nil {
-			if enabled.Valid {
-				p.Enabled = enabled.Bool
-			}
-			if checks != nil {
-				_ = json.Unmarshal(checks, &p.SourcePostureChecks)
-			}
-		}
-		return &p, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	return policies, nil
-}
-
-func (s *SqlStore) getRoutes(ctx context.Context, accountID string) ([]route.Route, error) {
-	const query = `SELECT id, account_id, network, domains, keep_route, net_id, description, peer, peer_groups, network_type, masquerade, metric, enabled, groups, access_control_groups, skip_auto_apply FROM routes WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-	routes, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (route.Route, error) {
-		var r route.Route
-		var network, domains, peerGroups, groups, accessGroups []byte
-		var keepRoute, masquerade, enabled, skipAutoApply sql.NullBool
-		var metric sql.NullInt64
-		err := row.Scan(&r.ID, &r.AccountID, &network, &domains, &keepRoute, &r.NetID, &r.Description, &r.Peer, &peerGroups, &r.NetworkType, &masquerade, &metric, &enabled, &groups, &accessGroups, &skipAutoApply)
-		if err == nil {
-			if keepRoute.Valid {
-				r.KeepRoute = keepRoute.Bool
-			}
-			if masquerade.Valid {
-				r.Masquerade = masquerade.Bool
-			}
-			if enabled.Valid {
-				r.Enabled = enabled.Bool
-			}
-			if skipAutoApply.Valid {
-				r.SkipAutoApply = skipAutoApply.Bool
-			}
-			if metric.Valid {
-				r.Metric = int(metric.Int64)
-			}
-			if network != nil {
-				_ = json.Unmarshal(network, &r.Network)
-			}
-			if domains != nil {
-				_ = json.Unmarshal(domains, &r.Domains)
-			}
-			if peerGroups != nil {
-				_ = json.Unmarshal(peerGroups, &r.PeerGroups)
-			}
-			if groups != nil {
-				_ = json.Unmarshal(groups, &r.Groups)
-			}
-			if accessGroups != nil {
-				_ = json.Unmarshal(accessGroups, &r.AccessControlGroups)
-			}
-		}
-		return r, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	return routes, nil
-}
-
-func (s *SqlStore) getNameServerGroups(ctx context.Context, accountID string) ([]nbdns.NameServerGroup, error) {
-	const query = `SELECT id, account_id, name, description, name_servers, groups, "primary", domains, enabled, search_domains_enabled FROM name_server_groups WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-	nsgs, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (nbdns.NameServerGroup, error) {
-		var n nbdns.NameServerGroup
-		var ns, groups, domains []byte
-		var primary, enabled, searchDomainsEnabled sql.NullBool
-		err := row.Scan(&n.ID, &n.AccountID, &n.Name, &n.Description, &ns, &groups, &primary, &domains, &enabled, &searchDomainsEnabled)
-		if err == nil {
-			if primary.Valid {
-				n.Primary = primary.Bool
-			}
-			if enabled.Valid {
-				n.Enabled = enabled.Bool
-			}
-			if searchDomainsEnabled.Valid {
-				n.SearchDomainsEnabled = searchDomainsEnabled.Bool
-			}
-			if ns != nil {
-				_ = json.Unmarshal(ns, &n.NameServers)
-			} else {
-				n.NameServers = []nbdns.NameServer{}
-			}
-			if groups != nil {
-				_ = json.Unmarshal(groups, &n.Groups)
-			} else {
-				n.Groups = []string{}
-			}
-			if domains != nil {
-				_ = json.Unmarshal(domains, &n.Domains)
-			} else {
-				n.Domains = []string{}
-			}
-		}
-		return n, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	return nsgs, nil
-}
-
-func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*posture.Checks, error) {
-	const query = `SELECT id, account_id, name, description, checks FROM posture_checks WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-	checks, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (*posture.Checks, error) {
-		var c posture.Checks
-		var checksDef []byte
-		err := row.Scan(&c.ID, &c.AccountID, &c.Name, &c.Description, &checksDef)
-		if err == nil && checksDef != nil {
-			_ = json.Unmarshal(checksDef, &c.Checks)
-		}
-		return &c, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	return checks, nil
-}
-
-func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
-	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth,
-		meta_created_at, meta_certificate_issued_at, meta_status, proxy_cluster,
-		pass_host_header, rewrite_redirects, session_private_key, session_public_key,
-		mode, listen_port, port_auto_assigned, source, source_peer, terminated,
-		private, access_groups
-		FROM services WHERE account_id = $1`
-
-	const targetsQuery = `SELECT id, account_id, service_id, path, host, port, protocol,
-		target_id, target_type, enabled
-		FROM targets WHERE service_id = ANY($1)`
-
-	serviceRows, err := s.pool.Query(ctx, serviceQuery, accountID)
-	if err != nil {
-		return nil, err
-	}
-
-	services, err := pgx.CollectRows(serviceRows, func(row pgx.CollectableRow) (*rpservice.Service, error) {
-		var s rpservice.Service
-		var auth []byte
-		var accessGroups []byte
-		var createdAt, certIssuedAt sql.NullTime
-		var status, proxyCluster, sessionPrivateKey, sessionPublicKey sql.NullString
-		var mode, source, sourcePeer sql.NullString
-		var terminated, portAutoAssigned, private sql.NullBool
-		var listenPort sql.NullInt64
-		err := row.Scan(
-			&s.ID,
-			&s.AccountID,
-			&s.Name,
-			&s.Domain,
-			&s.Enabled,
-			&auth,
-			&createdAt,
-			&certIssuedAt,
-			&status,
-			&proxyCluster,
-			&s.PassHostHeader,
-			&s.RewriteRedirects,
-			&sessionPrivateKey,
-			&sessionPublicKey,
-			&mode,
-			&listenPort,
-			&portAutoAssigned,
-			&source,
-			&sourcePeer,
-			&terminated,
-			&private,
-			&accessGroups,
-		)
-		if err != nil {
-			return nil, err
-		}
-
-		if auth != nil {
-			if err := json.Unmarshal(auth, &s.Auth); err != nil {
-				return nil, err
-			}
-		}
-
-		if len(accessGroups) > 0 {
-			if err := json.Unmarshal(accessGroups, &s.AccessGroups); err != nil {
-				return nil, fmt.Errorf("unmarshal access_groups: %w", err)
-			}
-		}
-
-		if private.Valid {
-			s.Private = private.Bool
-		}
-
-		s.Meta = rpservice.Meta{}
-		if createdAt.Valid {
-			s.Meta.CreatedAt = createdAt.Time
-		}
-		if certIssuedAt.Valid {
-			t := certIssuedAt.Time
-			s.Meta.CertificateIssuedAt = &t
-		}
-		if status.Valid {
-			s.Meta.Status = status.String
-		}
-		if proxyCluster.Valid {
-			s.ProxyCluster = proxyCluster.String
-		}
-		if sessionPrivateKey.Valid {
-			s.SessionPrivateKey = sessionPrivateKey.String
-		}
-		if sessionPublicKey.Valid {
-			s.SessionPublicKey = sessionPublicKey.String
-		}
-		if mode.Valid {
-			s.Mode = mode.String
-		}
-		if source.Valid {
-			s.Source = source.String
-		}
-		if sourcePeer.Valid {
-			s.SourcePeer = sourcePeer.String
-		}
-		if terminated.Valid {
-			s.Terminated = terminated.Bool
-		}
-		if portAutoAssigned.Valid {
-			s.PortAutoAssigned = portAutoAssigned.Bool
-		}
-		if listenPort.Valid {
-			s.ListenPort = uint16(listenPort.Int64)
-		}
-		s.Targets = []*rpservice.Target{}
-		return &s, nil
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	if len(services) == 0 {
-		return services, nil
-	}
-
-	serviceIDs := make([]string, len(services))
-	serviceMap := make(map[string]*rpservice.Service)
-	for i, s := range services {
-		serviceIDs[i] = s.ID
-		serviceMap[s.ID] = s
-	}
-
-	targetRows, err := s.pool.Query(ctx, targetsQuery, serviceIDs)
-	if err != nil {
-		return nil, err
-	}
-
-	targets, err := pgx.CollectRows(targetRows, func(row pgx.CollectableRow) (*rpservice.Target, error) {
-		var t rpservice.Target
-		var path sql.NullString
-		err := row.Scan(
-			&t.ID,
-			&t.AccountID,
-			&t.ServiceID,
-			&path,
-			&t.Host,
-			&t.Port,
-			&t.Protocol,
-			&t.TargetId,
-			&t.TargetType,
-			&t.Enabled,
-		)
-		if err != nil {
-			return nil, err
-		}
-		if path.Valid {
-			t.Path = &path.String
-		}
-		return &t, nil
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	for _, target := range targets {
-		if service, ok := serviceMap[target.ServiceID]; ok {
-			service.Targets = append(service.Targets, target)
-		}
-	}
-
-	return services, nil
-}
-
-func (s *SqlStore) getNetworks(ctx context.Context, accountID string) ([]*networkTypes.Network, error) {
-	const query = `SELECT id, account_id, name, description FROM networks WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-	networks, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkTypes.Network])
-	if err != nil {
-		return nil, err
-	}
-	result := make([]*networkTypes.Network, len(networks))
-	for i := range networks {
-		result[i] = &networks[i]
-	}
-	return result, nil
-}
-
-func (s *SqlStore) getNetworkRouters(ctx context.Context, accountID string) ([]*routerTypes.NetworkRouter, error) {
-	const query = `SELECT id, network_id, account_id, peer, peer_groups, masquerade, metric, enabled FROM network_routers WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-	routers, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (routerTypes.NetworkRouter, error) {
-		var r routerTypes.NetworkRouter
-		var peerGroups []byte
-		var masquerade, enabled sql.NullBool
-		var metric sql.NullInt64
-		err := row.Scan(&r.ID, &r.NetworkID, &r.AccountID, &r.Peer, &peerGroups, &masquerade, &metric, &enabled)
-		if err == nil {
-			if masquerade.Valid {
-				r.Masquerade = masquerade.Bool
-			}
-			if enabled.Valid {
-				r.Enabled = enabled.Bool
-			}
-			if metric.Valid {
-				r.Metric = int(metric.Int64)
-			}
-			if peerGroups != nil {
-				_ = json.Unmarshal(peerGroups, &r.PeerGroups)
-			}
-		}
-		return r, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	result := make([]*routerTypes.NetworkRouter, len(routers))
-	for i := range routers {
-		result[i] = &routers[i]
-	}
-	return result, nil
-}
-
-func (s *SqlStore) getNetworkResources(ctx context.Context, accountID string) ([]*resourceTypes.NetworkResource, error) {
-	const query = `SELECT id, network_id, account_id, name, description, type, domain, prefix, enabled FROM network_resources WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
-	if err != nil {
-		return nil, err
-	}
-	resources, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (resourceTypes.NetworkResource, error) {
-		var r resourceTypes.NetworkResource
-		var prefix []byte
-		var enabled sql.NullBool
-		err := row.Scan(&r.ID, &r.NetworkID, &r.AccountID, &r.Name, &r.Description, &r.Type, &r.Domain, &prefix, &enabled)
-		if err == nil {
-			if enabled.Valid {
-				r.Enabled = enabled.Bool
-			}
-			if prefix != nil {
-				_ = json.Unmarshal(prefix, &r.Prefix)
-			}
-		}
-		return r, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	result := make([]*resourceTypes.NetworkResource, len(resources))
-	for i := range resources {
-		result[i] = &resources[i]
-	}
-	return result, nil
-}
-
-func (s *SqlStore) getAccountOnboarding(ctx context.Context, accountID string, account *types.Account) error {
-	const query = `SELECT account_id, onboarding_flow_pending, signup_form_pending, created_at, updated_at FROM account_onboardings WHERE account_id = $1`
-	var onboardingFlowPending, signupFormPending sql.NullBool
-	var createdAt, updatedAt sql.NullTime
-	err := s.pool.QueryRow(ctx, query, accountID).Scan(
-		&account.Onboarding.AccountID,
-		&onboardingFlowPending,
-		&signupFormPending,
-		&createdAt,
-		&updatedAt,
-	)
-	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
-		return err
-	}
-	if createdAt.Valid {
-		account.Onboarding.CreatedAt = createdAt.Time
-	}
-	if updatedAt.Valid {
-		account.Onboarding.UpdatedAt = updatedAt.Time
-	}
-	if onboardingFlowPending.Valid {
-		account.Onboarding.OnboardingFlowPending = onboardingFlowPending.Bool
-	}
-	if signupFormPending.Valid {
-		account.Onboarding.SignupFormPending = signupFormPending.Bool
-	}
-	return nil
-}
-
-func (s *SqlStore) getPersonalAccessTokens(ctx context.Context, userIDs []string) ([]types.PersonalAccessToken, error) {
-	if len(userIDs) == 0 {
-		return nil, nil
-	}
-	const query = `SELECT id, user_id, name, hashed_token, expiration_date, created_by, created_at, last_used FROM personal_access_tokens WHERE user_id = ANY($1)`
-	rows, err := s.pool.Query(ctx, query, userIDs)
-	if err != nil {
-		return nil, err
-	}
-	pats, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (types.PersonalAccessToken, error) {
-		var pat types.PersonalAccessToken
-		var expirationDate, lastUsed, createdAt sql.NullTime
-		err := row.Scan(&pat.ID, &pat.UserID, &pat.Name, &pat.HashedToken, &expirationDate, &pat.CreatedBy, &createdAt, &lastUsed)
-		if err == nil {
-			if expirationDate.Valid {
-				pat.ExpirationDate = &expirationDate.Time
-			}
-			if createdAt.Valid {
-				pat.CreatedAt = createdAt.Time
-			}
-			if lastUsed.Valid {
-				pat.LastUsed = &lastUsed.Time
-			}
-		}
-		return pat, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	return pats, nil
-}
-
-func (s *SqlStore) getPolicyRules(ctx context.Context, policyIDs []string) ([]*types.PolicyRule, error) {
-	if len(policyIDs) == 0 {
-		return nil, nil
-	}
-	const query = `SELECT id, policy_id, name, description, enabled, action, destinations, destination_resource, sources, source_resource, bidirectional, protocol, ports, port_ranges, authorized_groups, authorized_user FROM policy_rules WHERE policy_id = ANY($1)`
-	rows, err := s.pool.Query(ctx, query, policyIDs)
-	if err != nil {
-		return nil, err
-	}
-	rules, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (*types.PolicyRule, error) {
-		var r types.PolicyRule
-		var dest, destRes, sources, sourceRes, ports, portRanges, authorizedGroups []byte
-		var enabled, bidirectional sql.NullBool
-		var authorizedUser sql.NullString
-		err := row.Scan(&r.ID, &r.PolicyID, &r.Name, &r.Description, &enabled, &r.Action, &dest, &destRes, &sources, &sourceRes, &bidirectional, &r.Protocol, &ports, &portRanges, &authorizedGroups, &authorizedUser)
-		if err == nil {
-			if enabled.Valid {
-				r.Enabled = enabled.Bool
-			}
-			if bidirectional.Valid {
-				r.Bidirectional = bidirectional.Bool
-			}
-			if dest != nil {
-				_ = json.Unmarshal(dest, &r.Destinations)
-			}
-			if destRes != nil {
-				_ = json.Unmarshal(destRes, &r.DestinationResource)
-			}
-			if sources != nil {
-				_ = json.Unmarshal(sources, &r.Sources)
-			}
-			if sourceRes != nil {
-				_ = json.Unmarshal(sourceRes, &r.SourceResource)
-			}
-			if ports != nil {
-				_ = json.Unmarshal(ports, &r.Ports)
-			}
-			if portRanges != nil {
-				_ = json.Unmarshal(portRanges, &r.PortRanges)
-			}
-			if authorizedGroups != nil {
-				_ = json.Unmarshal(authorizedGroups, &r.AuthorizedGroups)
-			}
-			if authorizedUser.Valid {
-				r.AuthorizedUser = authorizedUser.String
-			}
-		}
-		return &r, err
-	})
-	if err != nil {
-		return nil, err
-	}
-	return rules, nil
-}
-
-func (s *SqlStore) getGroupPeers(ctx context.Context, groupIDs []string) ([]types.GroupPeer, error) {
-	if len(groupIDs) == 0 {
-		return nil, nil
-	}
-	const query = `SELECT account_id, group_id, peer_id FROM group_peers WHERE group_id = ANY($1)`
-	rows, err := s.pool.Query(ctx, query, groupIDs)
-	if err != nil {
-		return nil, err
-	}
-	groupPeers, err := pgx.CollectRows(rows, pgx.RowToStructByName[types.GroupPeer])
-	if err != nil {
-		return nil, err
-	}
-	return groupPeers, nil
-}
-
-func (s *SqlStore) GetAccountByUser(ctx context.Context, userID string) (*types.Account, error) {
-	var user types.User
-	result := s.db.Select("account_id").Take(&user, idQueryCondition, userID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		return nil, status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	if user.AccountID == "" {
-		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-	}
-
-	return s.GetAccount(ctx, user.AccountID)
-}
-
-func (s *SqlStore) GetAccountByPeerID(ctx context.Context, peerID string) (*types.Account, error) {
-	var peer nbpeer.Peer
-	result := s.db.Select("account_id").Take(&peer, idQueryCondition, peerID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		return nil, status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	if peer.AccountID == "" {
-		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-	}
-
-	return s.GetAccount(ctx, peer.AccountID)
-}
-
-func (s *SqlStore) GetAccountByPeerPubKey(ctx context.Context, peerKey string) (*types.Account, error) {
-	var peer nbpeer.Peer
-	result := s.db.Select("account_id").Take(&peer, GetKeyQueryCondition(s), peerKey)
-
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		return nil, status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	if peer.AccountID == "" {
-		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-	}
-
-	return s.GetAccount(ctx, peer.AccountID)
-}
-
-func (s *SqlStore) GetAnyAccountID(ctx context.Context) (string, error) {
-	var account types.Account
-	result := s.db.Select("id").Order("created_at desc").Limit(1).Find(&account)
-	if result.Error != nil {
-		return "", status.NewGetAccountFromStoreError(result.Error)
-	}
-	if result.RowsAffected == 0 {
-		return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
-	}
-
-	return account.Id, nil
-}
-
-func (s *SqlStore) GetAccountIDByPeerPubKey(ctx context.Context, peerKey string) (string, error) {
-	var peer nbpeer.Peer
-	var accountID string
-	result := s.db.Model(&peer).Select("account_id").Where(GetKeyQueryCondition(s), peerKey).Take(&accountID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		return "", status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	return accountID, nil
-}
-
-func (s *SqlStore) GetAccountIDByUserID(ctx context.Context, lockStrength LockingStrength, userID string) (string, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var accountID string
-	result := tx.Model(&types.User{}).
-		Select("account_id").Where(idQueryCondition, userID).Take(&accountID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		return "", status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	return accountID, nil
-}
-
-func (s *SqlStore) GetAccountIDByPeerID(ctx context.Context, lockStrength LockingStrength, peerID string) (string, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var accountID string
-	result := tx.Model(&nbpeer.Peer{}).
-		Select("account_id").Where(idQueryCondition, peerID).Take(&accountID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return "", status.Errorf(status.NotFound, "peer %s account not found", peerID)
-		}
-		return "", status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	return accountID, nil
-}
-
-func (s *SqlStore) GetAccountIDBySetupKey(ctx context.Context, setupKey string) (string, error) {
-	var accountID string
-	result := s.db.Model(&types.SetupKey{}).Select("account_id").Where(GetKeyQueryCondition(s), setupKey).Take(&accountID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return "", status.NewSetupKeyNotFoundError(setupKey)
-		}
-		log.WithContext(ctx).Errorf("failed to get account ID by setup key from store: %v", result.Error)
-		return "", status.Errorf(status.Internal, "failed to get account ID by setup key from store")
-	}
-
-	if accountID == "" {
-		return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
-	}
-
-	return accountID, nil
-}
-
-func (s *SqlStore) GetTakenIPs(ctx context.Context, lockStrength LockingStrength, accountID string) ([]netip.Addr, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var ipJSONStrings []string
-
-	result := tx.Model(&nbpeer.Peer{}).
-		Where("account_id = ?", accountID).
-		Pluck("ip", &ipJSONStrings)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "no peers found for the account")
-		}
-		return nil, status.Errorf(status.Internal, "issue getting IPs from store: %s", result.Error)
-	}
-
-	ips := make([]netip.Addr, len(ipJSONStrings))
-	for i, ipJSON := range ipJSONStrings {
-		var ip netip.Addr
-		if err := json.Unmarshal([]byte(ipJSON), &ip); err != nil {
-			return nil, status.Errorf(status.Internal, "issue parsing IP JSON from store")
-		}
-		ips[i] = ip.Unmap()
-	}
-
-	return ips, nil
-}
-
-func (s *SqlStore) GetPeerLabelsInAccount(ctx context.Context, lockStrength LockingStrength, accountID string, dnsLabel string) ([]string, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var labels []string
-	result := tx.Model(&nbpeer.Peer{}).
-		Where("account_id = ? AND dns_label LIKE ?", accountID, dnsLabel+"%").
-		Pluck("dns_label", &labels)
-
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "no peers found for the account")
-		}
-		log.WithContext(ctx).Errorf("error when getting dns labels from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "issue getting dns labels from store: %s", result.Error)
-	}
-
-	return labels, nil
-}
-
-func (s *SqlStore) GetAccountNetwork(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.Network, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var accountNetwork types.AccountNetwork
-	if err := tx.Model(&types.Account{}).Where(idQueryCondition, accountID).Take(&accountNetwork).Error; err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, status.NewAccountNotFoundError(accountID)
-		}
-		return nil, status.Errorf(status.Internal, "issue getting network from store: %s", err)
-	}
-	return accountNetwork.Network, nil
-}
-
-func (s *SqlStore) GetPeerByPeerPubKey(ctx context.Context, lockStrength LockingStrength, peerKey string) (*nbpeer.Peer, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var peer nbpeer.Peer
-	result := tx.Take(&peer, GetKeyQueryCondition(s), peerKey)
-
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewPeerNotFoundError(peerKey)
-		}
-		return nil, status.Errorf(status.Internal, "issue getting peer from store: %s", result.Error)
-	}
-
-	return &peer, nil
-}
-
-func (s *SqlStore) GetAccountSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.Settings, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var accountSettings types.AccountSettings
-	if err := tx.Model(&types.Account{}).Where(idQueryCondition, accountID).Take(&accountSettings).Error; err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "settings not found")
-		}
-		return nil, status.Errorf(status.Internal, "issue getting settings from store: %s", err)
-	}
-	return accountSettings.Settings, nil
-}
-
-func (s *SqlStore) GetAccountCreatedBy(ctx context.Context, lockStrength LockingStrength, accountID string) (string, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var createdBy string
-	result := tx.Model(&types.Account{}).
-		Select("created_by").Take(&createdBy, idQueryCondition, accountID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return "", status.NewAccountNotFoundError(accountID)
-		}
-		return "", status.NewGetAccountFromStoreError(result.Error)
-	}
-
-	return createdBy, nil
-}
-
-// SaveUserLastLogin stores the last login time for a user in DB.
-func (s *SqlStore) SaveUserLastLogin(ctx context.Context, accountID, userID string, lastLogin time.Time) error {
-	var user types.User
-	result := s.db.Take(&user, accountAndIDQueryCondition, accountID, userID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return status.NewUserNotFoundError(userID)
-		}
-		return status.NewGetUserFromStoreError()
-	}
-
-	if !lastLogin.IsZero() {
-		user.LastLogin = &lastLogin
-		return s.db.Save(&user).Error
-	}
-
-	return nil
-}
-
-func (s *SqlStore) GetPostureCheckByChecksDefinition(accountID string, checks *posture.ChecksDefinition) (*posture.Checks, error) {
-	definitionJSON, err := json.Marshal(checks)
-	if err != nil {
-		return nil, err
-	}
-
-	var postureCheck posture.Checks
-	err = s.db.Where("account_id = ? AND checks = ?", accountID, string(definitionJSON)).Take(&postureCheck).Error
-	if err != nil {
-		return nil, err
-	}
-
-	return &postureCheck, nil
-}
-
 // Close closes the underlying DB connection
 func (s *SqlStore) Close(_ context.Context) error {
-	sql, err := s.db.DB()
-	if err != nil {
-		return fmt.Errorf("get db: %w", err)
-	}
-	return sql.Close()
+	return s.conn.Close()
 }
 
 // GetStoreEngine returns underlying store engine
 func (s *SqlStore) GetStoreEngine() types.Engine {
-	return s.storeEngine
+	return s.conn.Engine()
 }
 
 // NewSqliteStore creates a new SQLite store.
 func NewSqliteStore(ctx context.Context, dataDir string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
-	storeFile := storeSqliteFileName
-	if envFile, ok := os.LookupEnv("NB_STORE_ENGINE_SQLITE_FILE"); ok && envFile != "" {
-		storeFile = envFile
-	}
-
-	// Separate file path from any SQLite URI query parameters (e.g., "store.db?mode=rwc")
-	filePath, query, hasQuery := strings.Cut(storeFile, "?")
-
-	connStr := filePath
-	if !filepath.IsAbs(filePath) {
-		connStr = filepath.Join(dataDir, filePath)
-	}
-
-	// Compose query parameters. User-provided ?_busy_timeout (or its mattn alias
-	// ?_timeout) overrides our default; otherwise inject 30s so SQLite waits at
-	// most that long on a lock instead of blocking the only Go-side connection.
-	// mattn/go-sqlite3 applies PRAGMA from the DSN on every fresh connection, so
-	// the value survives ConnMaxIdleTime/ConnMaxLifetime recycling. cache=shared
-	// stays the default on non-Windows for the same reason as before.
-	parsed, _ := url.ParseQuery(query)
-	var defaults []string
-	if parsed.Get("_busy_timeout") == "" && parsed.Get("_timeout") == "" {
-		defaults = append(defaults, "_busy_timeout=30000")
-	}
-	if !hasQuery && runtime.GOOS != "windows" {
-		// To avoid `The process cannot access the file because it is being used by another process` on Windows
-		defaults = append(defaults, "cache=shared")
-	}
-	parts := defaults
-	if hasQuery {
-		parts = append(parts, query)
-	}
-	if len(parts) > 0 {
-		connStr += "?" + strings.Join(parts, "&")
-	}
-
-	db, err := gorm.Open(sqlite.Open(connStr), getGormConfig())
+	conn, err := db.OpenSqlite(ctx, dataDir)
 	if err != nil {
 		return nil, err
 	}
-
-	return NewSqlStore(ctx, db, types.SqliteStoreEngine, metrics, skipMigration)
+	return newStore(ctx, conn, metrics, skipMigration)
 }
 
 // NewPostgresqlStore creates a new Postgres store.
 func NewPostgresqlStore(ctx context.Context, dsn string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
-	db, err := gorm.Open(postgres.Open(dsn), getGormConfig())
+	conn, err := db.OpenPostgres(ctx, dsn, db.DefaultPoolConfig)
 	if err != nil {
 		return nil, err
 	}
-	pool, err := connectToPgDb(context.Background(), dsn)
-	if err != nil {
-		return nil, err
-	}
-	store, err := NewSqlStore(ctx, db, types.PostgresStoreEngine, metrics, skipMigration)
-	if err != nil {
-		pool.Close()
-		return nil, err
-	}
-	store.pool = pool
-	return store, nil
-}
-
-func connectToPgDb(ctx context.Context, dsn string) (*pgxpool.Pool, error) {
-	config, err := pgxpool.ParseConfig(dsn)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse database config: %w", err)
-	}
-
-	config.MaxConns = pgMaxConnections
-	config.MinConns = pgMinConnections
-	config.MaxConnLifetime = pgMaxConnLifetime
-	config.HealthCheckPeriod = pgHealthCheckPeriod
-
-	pool, err := pgxpool.NewWithConfig(ctx, config)
-	if err != nil {
-		return nil, fmt.Errorf("unable to create connection pool: %w", err)
-	}
-
-	if err := pool.Ping(ctx); err != nil {
-		pool.Close()
-		return nil, fmt.Errorf("unable to ping database: %w", err)
-	}
-
-	return pool, nil
+	return newStore(ctx, conn, metrics, skipMigration)
 }
 
 // NewMysqlStore creates a new MySQL store.
 func NewMysqlStore(ctx context.Context, dsn string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
-	db, err := gorm.Open(mysql.Open(dsn+"?charset=utf8&parseTime=True&loc=Local"), getGormConfig())
+	conn, err := db.OpenMysql(ctx, dsn)
 	if err != nil {
 		return nil, err
 	}
-
-	return NewSqlStore(ctx, db, types.MysqlStoreEngine, metrics, skipMigration)
-}
-
-func getGormConfig() *gorm.Config {
-	return &gorm.Config{
-		Logger:          logger.Default.LogMode(logger.Silent),
-		CreateBatchSize: 400,
-	}
-}
-
-// newPostgresStore initializes a new Postgres store.
-func newPostgresStore(ctx context.Context, metrics telemetry.AppMetrics, skipMigration bool) (Store, error) {
-	dsn, ok := lookupDSNEnv(postgresDsnEnv, postgresDsnEnvLegacy)
-	if !ok {
-		return nil, fmt.Errorf("%s is not set", postgresDsnEnv)
-	}
-	return NewPostgresqlStore(ctx, dsn, metrics, skipMigration)
-}
-
-// newMysqlStore initializes a new MySQL store.
-func newMysqlStore(ctx context.Context, metrics telemetry.AppMetrics, skipMigration bool) (Store, error) {
-	dsn, ok := lookupDSNEnv(mysqlDsnEnv, mysqlDsnEnvLegacy)
-	if !ok {
-		return nil, fmt.Errorf("%s is not set", mysqlDsnEnv)
-	}
-	return NewMysqlStore(ctx, dsn, metrics, skipMigration)
+	return newStore(ctx, conn, metrics, skipMigration)
 }
 
 // NewSqliteStoreFromFileStore restores a store from FileStore and stores SQLite DB in the file located in datadir.
@@ -3051,588 +214,93 @@ func NewSqliteStoreFromFileStore(ctx context.Context, fileStore *FileStore, data
 
 // NewPostgresqlStoreFromSqlStore restores a store from SqlStore and stores Postgres DB.
 func NewPostgresqlStoreFromSqlStore(ctx context.Context, sqliteStore *SqlStore, dsn string, metrics telemetry.AppMetrics) (*SqlStore, error) {
-	store, err := NewPostgresqlStoreForTests(ctx, dsn, metrics, false)
+	return newPostgresqlStoreFromSqlStore(ctx, sqliteStore, dsn, metrics, false)
+}
+
+func newPostgresqlStoreFromSqlStore(ctx context.Context, sqliteStore *SqlStore, dsn string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
+	store, err := NewPostgresqlStoreForTests(ctx, dsn, metrics, skipMigration)
 	if err != nil {
 		return nil, err
 	}
 
-	err = store.SaveInstallationID(ctx, sqliteStore.GetInstallationID())
-	if err != nil {
+	if err := seedFromSqliteStore(ctx, store, sqliteStore); err != nil {
+		_ = store.Close(ctx)
 		return nil, err
 	}
 
-	for _, account := range sqliteStore.GetAllAccounts(ctx) {
-		err := store.SaveAccount(ctx, account)
-		if err != nil {
-			return nil, err
-		}
-	}
-
 	return store, nil
 }
 
 // used for tests only
 func NewPostgresqlStoreForTests(ctx context.Context, dsn string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
-	db, err := gorm.Open(postgres.Open(dsn), getGormConfig())
+	conn, err := db.OpenPostgres(ctx, dsn, testPoolConfig)
 	if err != nil {
 		return nil, err
 	}
-	pool, err := connectToPgDbForTests(context.Background(), dsn)
-	if err != nil {
-		return nil, err
-	}
-	store, err := NewSqlStore(ctx, db, types.PostgresStoreEngine, metrics, skipMigration)
-	if err != nil {
-		pool.Close()
-		return nil, err
-	}
-	store.pool = pool
-	return store, nil
-}
-
-// used for tests only
-func connectToPgDbForTests(ctx context.Context, dsn string) (*pgxpool.Pool, error) {
-	config, err := pgxpool.ParseConfig(dsn)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse database config: %w", err)
-	}
-
-	config.MaxConns = 5
-	config.MinConns = 1
-	config.MaxConnLifetime = 30 * time.Second
-	config.HealthCheckPeriod = 10 * time.Second
-
-	pool, err := pgxpool.NewWithConfig(ctx, config)
-	if err != nil {
-		return nil, fmt.Errorf("unable to create connection pool: %w", err)
-	}
-
-	if err := pool.Ping(ctx); err != nil {
-		pool.Close()
-		return nil, fmt.Errorf("unable to ping database: %w", err)
-	}
-
-	return pool, nil
+	return newStore(ctx, conn, metrics, skipMigration)
 }
 
 // NewMysqlStoreFromSqlStore restores a store from SqlStore and stores MySQL DB.
 func NewMysqlStoreFromSqlStore(ctx context.Context, sqliteStore *SqlStore, dsn string, metrics telemetry.AppMetrics) (*SqlStore, error) {
-	store, err := NewMysqlStore(ctx, dsn, metrics, false)
-	if err != nil {
-		return nil, err
-	}
+	return newMysqlStoreFromSqlStore(ctx, sqliteStore, dsn, metrics, false)
+}
 
-	err = store.SaveInstallationID(ctx, sqliteStore.GetInstallationID())
-	if err != nil {
-		return nil, err
+// seedFromSqliteStore copies the installation ID and the accounts of the
+// sqlite seed store into a freshly created engine store.
+func seedFromSqliteStore(ctx context.Context, store, sqliteStore *SqlStore) error {
+	if err := store.SaveInstallationID(ctx, sqliteStore.GetInstallationID()); err != nil {
+		return err
 	}
-
 	for _, account := range sqliteStore.GetAllAccounts(ctx) {
-		err := store.SaveAccount(ctx, account)
-		if err != nil {
-			return nil, err
+		if err := store.SaveAccount(ctx, account); err != nil {
+			return err
 		}
 	}
+	return nil
+}
+
+func newMysqlStoreFromSqlStore(ctx context.Context, sqliteStore *SqlStore, dsn string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
+	store, err := NewMysqlStore(ctx, dsn, metrics, skipMigration)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := seedFromSqliteStore(ctx, store, sqliteStore); err != nil {
+		_ = store.Close(ctx)
+		return nil, err
+	}
 
 	return store, nil
 }
 
-func (s *SqlStore) GetSetupKeyBySecret(ctx context.Context, lockStrength LockingStrength, key string) (*types.SetupKey, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var setupKey types.SetupKey
-	result := tx.
-		Take(&setupKey, GetKeyQueryCondition(s), key)
-
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.PreconditionFailed, "setup key not found")
-		}
-		log.WithContext(ctx).Errorf("failed to get setup key by secret from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get setup key by secret from store")
-	}
-	return &setupKey, nil
-}
-
-func (s *SqlStore) IncrementSetupKeyUsage(ctx context.Context, setupKeyID string) error {
-	result := s.db.Model(&types.SetupKey{}).
-		Where(idQueryCondition, setupKeyID).
-		Updates(map[string]interface{}{
-			"used_times": gorm.Expr("used_times + 1"),
-			"last_used":  time.Now(),
-		})
-
-	if result.Error != nil {
-		return status.Errorf(status.Internal, "issue incrementing setup key usage count: %s", result.Error)
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewSetupKeyNotFoundError(setupKeyID)
-	}
-
-	return nil
-}
-
-// AddPeerToAllGroup adds a peer to the 'All' group. Method always needs to run in a transaction
-func (s *SqlStore) AddPeerToAllGroup(ctx context.Context, accountID string, peerID string) error {
-	var groupID string
-	_ = s.db.Model(types.Group{}).
-		Select("id").
-		Where("account_id = ? AND name = ?", accountID, "All").
-		Limit(1).
-		Scan(&groupID)
-
-	if groupID == "" {
-		return status.Errorf(status.NotFound, "group 'All' not found for account %s", accountID)
-	}
-
-	err := s.db.Clauses(clause.OnConflict{
-		Columns:   []clause.Column{{Name: "group_id"}, {Name: "peer_id"}},
-		DoNothing: true,
-	}).Create(&types.GroupPeer{
-		AccountID: accountID,
-		GroupID:   groupID,
-		PeerID:    peerID,
-	}).Error
-	if err != nil {
-		return status.Errorf(status.Internal, "error adding peer to group 'All': %v", err)
-	}
-
-	return nil
-}
-
-// AddPeerToGroup adds a peer to a group
-func (s *SqlStore) AddPeerToGroup(ctx context.Context, accountID, peerID, groupID string) error {
-	peer := &types.GroupPeer{
-		AccountID: accountID,
-		GroupID:   groupID,
-		PeerID:    peerID,
-	}
-
-	err := s.db.Clauses(clause.OnConflict{
-		Columns:   []clause.Column{{Name: "group_id"}, {Name: "peer_id"}},
-		DoNothing: true,
-	}).Create(peer).Error
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to add peer %s to group %s for account %s: %v", peerID, groupID, accountID, err)
-		return status.Errorf(status.Internal, "failed to add peer to group")
-	}
-
-	return nil
-}
-
-// RemovePeerFromGroup removes a peer from a group
-func (s *SqlStore) RemovePeerFromGroup(ctx context.Context, peerID string, groupID string) error {
-	err := s.db.
-		Delete(&types.GroupPeer{}, "group_id = ? AND peer_id = ?", groupID, peerID).Error
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to remove peer %s from group %s: %v", peerID, groupID, err)
-		return status.Errorf(status.Internal, "failed to remove peer from group")
-	}
-
-	return nil
-}
-
-// RemovePeerFromAllGroups removes a peer from all groups
-func (s *SqlStore) RemovePeerFromAllGroups(ctx context.Context, peerID string) error {
-	err := s.db.
-		Delete(&types.GroupPeer{}, "peer_id = ?", peerID).Error
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to remove peer %s from all groups: %v", peerID, err)
-		return status.Errorf(status.Internal, "failed to remove peer from all groups")
-	}
-
-	return nil
-}
-
-// AddResourceToGroup adds a resource to a group. Method always needs to run n a transaction
-func (s *SqlStore) AddResourceToGroup(ctx context.Context, accountId string, groupID string, resource *types.Resource) error {
-	var group types.Group
-	result := s.db.Where(accountAndIDQueryCondition, accountId, groupID).Take(&group)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return status.NewGroupNotFoundError(groupID)
-		}
-
-		return status.Errorf(status.Internal, "issue finding group: %s", result.Error)
-	}
-
-	for _, res := range group.Resources {
-		if res.ID == resource.ID {
-			return nil
-		}
-	}
-
-	group.Resources = append(group.Resources, *resource)
-
-	if err := s.db.Save(&group).Error; err != nil {
-		return status.Errorf(status.Internal, "issue updating group: %s", err)
-	}
-
-	return nil
-}
-
-// RemoveResourceFromGroup removes a resource from a group. Method always needs to run in a transaction
-func (s *SqlStore) RemoveResourceFromGroup(ctx context.Context, accountId string, groupID string, resourceID string) error {
-	var group types.Group
-	result := s.db.Where(accountAndIDQueryCondition, accountId, groupID).Take(&group)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return status.NewGroupNotFoundError(groupID)
-		}
-
-		return status.Errorf(status.Internal, "issue finding group: %s", result.Error)
-	}
-
-	for i, res := range group.Resources {
-		if res.ID == resourceID {
-			group.Resources = append(group.Resources[:i], group.Resources[i+1:]...)
-			break
-		}
-	}
-
-	if err := s.db.Save(&group).Error; err != nil {
-		return status.Errorf(status.Internal, "issue updating group: %s", err)
-	}
-
-	return nil
-}
-
-// GetPeerGroups retrieves all groups assigned to a specific peer in a given account.
-func (s *SqlStore) GetPeerGroups(ctx context.Context, lockStrength LockingStrength, accountId string, peerId string) ([]*types.Group, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var groups []*types.Group
-	query := tx.
-		Joins("JOIN group_peers ON group_peers.group_id = groups.id").
-		Where("group_peers.peer_id = ?", peerId).
-		Preload(clause.Associations).
-		Find(&groups)
-
-	if query.Error != nil {
-		return nil, query.Error
-	}
-
-	for _, group := range groups {
-		group.LoadGroupPeers()
-	}
-
-	return groups, nil
-}
-
-// GetPeerGroupIDs retrieves all group IDs assigned to a specific peer in a given account.
-func (s *SqlStore) GetPeerGroupIDs(ctx context.Context, lockStrength LockingStrength, accountId string, peerId string) ([]string, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var groupIDs []string
-	query := tx.
-		Model(&types.GroupPeer{}).
-		Where("account_id = ? AND peer_id = ?", accountId, peerId).
-		Pluck("group_id", &groupIDs)
-
-	if query.Error != nil {
-		if errors.Is(query.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "no groups found for peer %s in account %s", peerId, accountId)
-		}
-		log.WithContext(ctx).Errorf("failed to get group IDs for peer %s in account %s: %v", peerId, accountId, query.Error)
-		return nil, status.Errorf(status.Internal, "failed to get group IDs for peer from store")
-	}
-
-	return groupIDs, nil
-}
-
-// GetAccountPeers retrieves peers for an account.
-func (s *SqlStore) GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
-	var peers []*nbpeer.Peer
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-	query := tx.Where(accountIDCondition, accountID)
-
-	if nameFilter != "" {
-		query = query.Where("name LIKE ?", "%"+nameFilter+"%")
-	}
-	if ipFilter != "" {
-		query = query.Where("ip LIKE ? OR ipv6 LIKE ?", "%"+ipFilter+"%", "%"+ipFilter+"%")
-	}
-
-	if err := query.Find(&peers).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get peers from the store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get peers from store")
-	}
-
-	return peers, nil
-}
-
-// GetUserPeers retrieves peers for a user.
-func (s *SqlStore) GetUserPeers(ctx context.Context, lockStrength LockingStrength, accountID, userID string) ([]*nbpeer.Peer, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var peers []*nbpeer.Peer
-
-	// Exclude peers added via setup keys, as they are not user-specific and have an empty user_id.
-	if userID == "" {
-		return peers, nil
-	}
-
-	result := tx.
-		Find(&peers, "account_id = ? AND user_id = ?", accountID, userID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get peers from the store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get peers from store")
-	}
-
-	return peers, nil
-}
-
-func (s *SqlStore) AddPeerToAccount(ctx context.Context, peer *nbpeer.Peer) error {
-	if err := s.db.Create(peer).Error; err != nil {
-		return status.Errorf(status.Internal, "issue adding peer to account: %s", err)
-	}
-
-	return nil
-}
-
-// GetPeerByID retrieves a peer by its ID and account ID.
-func (s *SqlStore) GetPeerByID(ctx context.Context, lockStrength LockingStrength, accountID, peerID string) (*nbpeer.Peer, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var peer *nbpeer.Peer
-	result := tx.
-		Take(&peer, accountAndIDQueryCondition, accountID, peerID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewPeerNotFoundError(peerID)
-		}
-		return nil, status.Errorf(status.Internal, "failed to get peer from store")
-	}
-
-	return peer, nil
-}
-
-// GetPeersByIDs retrieves peers by their IDs and account ID.
-func (s *SqlStore) GetPeersByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, peerIDs []string) (map[string]*nbpeer.Peer, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var peers []*nbpeer.Peer
-	result := tx.Find(&peers, accountAndIDsQueryCondition, accountID, peerIDs)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get peers by ID's from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get peers by ID's from the store")
-	}
-
-	peersMap := make(map[string]*nbpeer.Peer)
-	for _, peer := range peers {
-		peersMap[peer.ID] = peer
-	}
-
-	return peersMap, nil
-}
-
-// GetAccountPeersWithExpiration retrieves a list of peers that have login expiration enabled and added by a user.
-func (s *SqlStore) GetAccountPeersWithExpiration(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*nbpeer.Peer, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var peers []*nbpeer.Peer
-	result := tx.
-		Where("login_expiration_enabled = ? AND peer_status_login_expired != ? AND user_id IS NOT NULL AND user_id != ''", true, true).
-		Find(&peers, accountIDCondition, accountID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get peers with expiration from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get peers with expiration from store")
-	}
-
-	return peers, nil
-}
-
-// GetAccountPeersWithInactivity retrieves a list of peers that have login expiration enabled and added by a user.
-func (s *SqlStore) GetAccountPeersWithInactivity(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*nbpeer.Peer, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var peers []*nbpeer.Peer
-	result := tx.
-		Where("inactivity_expiration_enabled = ? AND user_id IS NOT NULL AND user_id != ''", true).
-		Find(&peers, accountIDCondition, accountID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get peers with inactivity from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get peers with inactivity from store")
-	}
-
-	return peers, nil
-}
-
-// GetAllEphemeralPeers retrieves all peers with Ephemeral set to true across all accounts, optimized for batch processing.
-func (s *SqlStore) GetAllEphemeralPeers(ctx context.Context, lockStrength LockingStrength) ([]*nbpeer.Peer, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var allEphemeralPeers, batchPeers []*nbpeer.Peer
-	result := tx.
-		Where("ephemeral = ?", true).
-		FindInBatches(&batchPeers, 1000, func(tx *gorm.DB, batch int) error {
-			allEphemeralPeers = append(allEphemeralPeers, batchPeers...)
-			return nil
-		})
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to retrieve ephemeral peers: %s", result.Error)
-		return nil, fmt.Errorf("failed to retrieve ephemeral peers")
-	}
-
-	return allEphemeralPeers, nil
-}
-
-// DeletePeer removes a peer from the store.
-func (s *SqlStore) DeletePeer(ctx context.Context, accountID string, peerID string) error {
-	result := s.db.Delete(&nbpeer.Peer{}, accountAndIDQueryCondition, accountID, peerID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to delete peer from the store: %s", err)
-		return status.Errorf(status.Internal, "failed to delete peer from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewPeerNotFoundError(peerID)
-	}
-
-	return nil
-}
-
-func (s *SqlStore) IncrementNetworkSerial(ctx context.Context, accountId string) error {
-	result := s.db.Model(&types.Account{}).Where(idQueryCondition, accountId).Update("network_serial", gorm.Expr("network_serial + 1"))
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to increment network serial count in store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to increment network serial count in store")
-	}
-	return nil
-}
-
+// ExecuteInTransaction runs operation in a transaction. A store that is already
+// bound to one joins it instead of opening a second, independent transaction.
 func (s *SqlStore) ExecuteInTransaction(ctx context.Context, operation func(store Store) error) error {
-	timeoutCtx, cancel := context.WithTimeout(ctx, s.transactionTimeout)
-	defer cancel()
-
-	startTime := time.Now()
-	tx := s.db.WithContext(timeoutCtx).Begin()
-	if tx.Error != nil {
-		return tx.Error
+	if s.tx != nil {
+		return operation(s)
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			tx.Rollback()
-			panic(r)
-		}
-	}()
-
-	if s.storeEngine == types.PostgresStoreEngine {
-		if err := tx.Exec("SET LOCAL statement_timeout = '1min'").Error; err != nil {
-			tx.Rollback()
-			return fmt.Errorf("failed to set statement timeout: %w", err)
-		}
-		if err := tx.Exec("SET LOCAL lock_timeout = '1min'").Error; err != nil {
-			tx.Rollback()
-			return fmt.Errorf("failed to set lock timeout: %w", err)
-		}
-	}
-
-	// For MySQL, disable FK checks within this transaction to avoid deadlocks
-	// This is session-scoped and doesn't require SUPER privileges
-	if s.storeEngine == types.MysqlStoreEngine {
-		if err := tx.Exec("SET FOREIGN_KEY_CHECKS = 0").Error; err != nil {
-			tx.Rollback()
-			return fmt.Errorf("failed to disable FK checks: %w", err)
-		}
-	}
-
-	repo := s.withTx(tx)
-	err := operation(repo)
-	if err != nil {
-		tx.Rollback()
-		if errors.Is(err, context.DeadlineExceeded) || errors.Is(timeoutCtx.Err(), context.DeadlineExceeded) {
-			log.WithContext(ctx).Warnf("transaction exceeded %s timeout after %v, stack: %s", s.transactionTimeout, time.Since(startTime), debug.Stack())
-		}
-		return err
-	}
-
-	// Re-enable FK checks before commit (optional, as transaction end resets it)
-	if s.storeEngine == types.MysqlStoreEngine {
-		if err := tx.Exec("SET FOREIGN_KEY_CHECKS = 1").Error; err != nil {
-			tx.Rollback()
-			return fmt.Errorf("failed to re-enable FK checks: %w", err)
-		}
-	}
-
-	err = tx.Commit().Error
-	if err != nil {
-		if errors.Is(err, context.DeadlineExceeded) || errors.Is(timeoutCtx.Err(), context.DeadlineExceeded) {
-			log.WithContext(ctx).Warnf("transaction commit exceeded %s timeout after %v, stack: %s", s.transactionTimeout, time.Since(startTime), debug.Stack())
-		}
-		return err
-	}
-
-	log.WithContext(ctx).Tracef("transaction took %v", time.Since(startTime))
-	if s.metrics != nil {
-		s.metrics.StoreMetrics().CountTransactionDuration(time.Since(startTime))
-	}
-
-	return nil
+	return s.conn.RunInTx(ctx, func(tx *db.Tx) error {
+		return operation(s.withTx(tx))
+	})
 }
 
-func (s *SqlStore) withTx(tx *gorm.DB) Store {
+func (s *SqlStore) withTx(tx *db.Tx) Store {
 	return &SqlStore{
-		db:           tx,
-		storeEngine:  s.storeEngine,
+		conn:         s.conn,
+		db:           s.conn.DB(tx),
+		tx:           tx,
 		fieldEncrypt: s.fieldEncrypt,
 	}
 }
 
-// transaction wraps a GORM transaction with MySQL-specific FK checks handling
-// Use this instead of db.Transaction() directly to avoid deadlocks on MySQL/Aurora
-func (s *SqlStore) transaction(fn func(*gorm.DB) error) error {
-	return s.db.Transaction(func(tx *gorm.DB) error {
-		// For MySQL, disable FK checks within this transaction to avoid deadlocks
-		// This is session-scoped and doesn't require SUPER privileges
-		if s.storeEngine == types.MysqlStoreEngine {
-			if err := tx.Exec("SET FOREIGN_KEY_CHECKS = 0").Error; err != nil {
-				return fmt.Errorf("failed to disable FK checks: %w", err)
-			}
-		}
-
-		err := fn(tx)
-
-		// Re-enable FK checks before commit (optional, as transaction end resets it)
-		if s.storeEngine == types.MysqlStoreEngine && err == nil {
-			if fkErr := tx.Exec("SET FOREIGN_KEY_CHECKS = 1").Error; fkErr != nil {
-				return fmt.Errorf("failed to re-enable FK checks: %w", fkErr)
-			}
-		}
-
-		return err
+// transaction runs fn as a savepoint of the bound transaction, or in a new
+// transaction when the store is not bound to one.
+func (s *SqlStore) transaction(ctx context.Context, fn func(tx *gorm.DB) error) error {
+	if s.tx != nil {
+		return s.db.Transaction(fn)
+	}
+	return s.conn.RunInTx(ctx, func(tx *db.Tx) error {
+		return fn(s.conn.DB(tx))
 	})
 }
 
@@ -3644,2815 +312,3 @@ func (s *SqlStore) GetDB() *gorm.DB {
 func (s *SqlStore) SetFieldEncrypt(enc *crypt.FieldEncrypt) {
 	s.fieldEncrypt = enc
 }
-
-func (s *SqlStore) GetAccountDNSSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.DNSSettings, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var accountDNSSettings types.AccountDNSSettings
-	result := tx.Model(&types.Account{}).
-		Take(&accountDNSSettings, idQueryCondition, accountID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewAccountNotFoundError(accountID)
-		}
-		log.WithContext(ctx).Errorf("failed to get dns settings from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get dns settings from store")
-	}
-	return &accountDNSSettings.DNSSettings, nil
-}
-
-// AccountExists checks whether an account exists by the given ID.
-func (s *SqlStore) AccountExists(ctx context.Context, lockStrength LockingStrength, id string) (bool, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var accountID string
-	result := tx.Model(&types.Account{}).
-		Select("id").Take(&accountID, idQueryCondition, id)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return false, nil
-		}
-		return false, result.Error
-	}
-
-	return accountID != "", nil
-}
-
-// GetAccountDomainAndCategory retrieves the Domain and DomainCategory fields for an account based on the given accountID.
-func (s *SqlStore) GetAccountDomainAndCategory(ctx context.Context, lockStrength LockingStrength, accountID string) (string, string, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var account types.Account
-	result := tx.Model(&types.Account{}).Select("domain", "domain_category").
-		Where(idQueryCondition, accountID).Take(&account)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return "", "", status.Errorf(status.NotFound, "account not found")
-		}
-		return "", "", status.Errorf(status.Internal, "failed to get domain category from store: %v", result.Error)
-	}
-
-	return account.Domain, account.DomainCategory, nil
-}
-
-// GetGroupByID retrieves a group by ID and account ID.
-func (s *SqlStore) GetGroupByID(ctx context.Context, lockStrength LockingStrength, accountID, groupID string) (*types.Group, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var group *types.Group
-	result := tx.Preload(clause.Associations).Take(&group, accountAndIDQueryCondition, accountID, groupID)
-	if err := result.Error; err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, status.NewGroupNotFoundError(groupID)
-		}
-		log.WithContext(ctx).Errorf("failed to get group from store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get group from store")
-	}
-
-	group.LoadGroupPeers()
-
-	return group, nil
-}
-
-// GetGroupByName retrieves a group by name and account ID.
-func (s *SqlStore) GetGroupByName(ctx context.Context, lockStrength LockingStrength, accountID, groupName string) (*types.Group, error) {
-	tx := s.db
-
-	var group types.Group
-
-	// TODO: This fix is accepted for now, but if we need to handle this more frequently
-	// we may need to reconsider changing the types.
-	query := tx.Preload(clause.Associations)
-
-	result := query.
-		Model(&types.Group{}).
-		Joins("LEFT JOIN group_peers ON group_peers.group_id = groups.id").
-		Where("groups.account_id = ? AND groups.name = ?", accountID, groupName).
-		Group("groups.id").
-		Order("COUNT(group_peers.peer_id) DESC").
-		Limit(1).
-		First(&group)
-	if err := result.Error; err != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewGroupNotFoundError(groupName)
-		}
-		log.WithContext(ctx).Errorf("failed to get group by name from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get group by name from store")
-	}
-
-	group.LoadGroupPeers()
-
-	return &group, nil
-}
-
-// GetGroupsByIDs retrieves groups by their IDs and account ID.
-func (s *SqlStore) GetGroupsByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, groupIDs []string) (map[string]*types.Group, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var groups []*types.Group
-	result := tx.Preload(clause.Associations).Find(&groups, accountAndIDsQueryCondition, accountID, groupIDs)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get groups by ID's from store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get groups by ID's from store")
-	}
-
-	groupsMap := make(map[string]*types.Group)
-	for _, group := range groups {
-		group.LoadGroupPeers()
-		groupsMap[group.ID] = group
-	}
-
-	return groupsMap, nil
-}
-
-// CreateGroup creates a group in the store.
-func (s *SqlStore) CreateGroup(ctx context.Context, group *types.Group) error {
-	if group == nil {
-		return status.Errorf(status.InvalidArgument, "group is nil")
-	}
-
-	if err := s.db.Omit(clause.Associations).Create(group).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to save group to store: %v", err)
-		return status.Errorf(status.Internal, "failed to save group to store")
-	}
-
-	return nil
-}
-
-// UpdateGroup updates a group in the store.
-func (s *SqlStore) UpdateGroup(ctx context.Context, group *types.Group) error {
-	if group == nil {
-		return status.Errorf(status.InvalidArgument, "group is nil")
-	}
-
-	if err := s.db.Omit(clause.Associations).Save(group).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to save group to store: %v", err)
-		return status.Errorf(status.Internal, "failed to save group to store")
-	}
-
-	return nil
-}
-
-// DeleteGroup deletes a group from the database.
-func (s *SqlStore) DeleteGroup(ctx context.Context, accountID, groupID string) error {
-	result := s.db.Select(clause.Associations).
-		Delete(&types.Group{}, accountAndIDQueryCondition, accountID, groupID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to delete group from store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to delete group from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewGroupNotFoundError(groupID)
-	}
-
-	return nil
-}
-
-// DeleteGroups deletes groups from the database.
-func (s *SqlStore) DeleteGroups(ctx context.Context, accountID string, groupIDs []string) error {
-	result := s.db.Select(clause.Associations).
-		Delete(&types.Group{}, accountAndIDsQueryCondition, accountID, groupIDs)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete groups from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete groups from store")
-	}
-
-	return nil
-}
-
-// GetAccountPolicies retrieves policies for an account.
-func (s *SqlStore) GetAccountPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.Policy, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var policies []*types.Policy
-	result := tx.
-		Preload(clause.Associations).Find(&policies, accountIDCondition, accountID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get policies from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get policies from store")
-	}
-
-	return policies, nil
-}
-
-// GetPolicyByID retrieves a policy by its ID and account ID.
-func (s *SqlStore) GetPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*types.Policy, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var policy *types.Policy
-
-	result := tx.Preload(clause.Associations).
-		Take(&policy, accountAndIDQueryCondition, accountID, policyID)
-	if err := result.Error; err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, status.NewPolicyNotFoundError(policyID)
-		}
-		log.WithContext(ctx).Errorf("failed to get policy from store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get policy from store")
-	}
-
-	return policy, nil
-}
-
-func (s *SqlStore) CreatePolicy(ctx context.Context, policy *types.Policy) error {
-	result := s.db.Create(policy)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to create policy in store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to create policy in store")
-	}
-
-	return nil
-}
-
-// SavePolicy saves a policy to the database.
-func (s *SqlStore) SavePolicy(ctx context.Context, policy *types.Policy) error {
-	result := s.db.Session(&gorm.Session{FullSaveAssociations: true}).Save(policy)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to save policy to the store: %s", err)
-		return status.Errorf(status.Internal, "failed to save policy to store")
-	}
-	return nil
-}
-
-func (s *SqlStore) DeletePolicy(ctx context.Context, accountID, policyID string) error {
-	return s.transaction(func(tx *gorm.DB) error {
-		if err := tx.Where("policy_id = ?", policyID).Delete(&types.PolicyRule{}).Error; err != nil {
-			return fmt.Errorf("delete policy rules: %w", err)
-		}
-
-		result := tx.
-			Where(accountAndIDQueryCondition, accountID, policyID).
-			Delete(&types.Policy{})
-
-		if err := result.Error; err != nil {
-			log.WithContext(ctx).Errorf("failed to delete policy from store: %s", err)
-			return status.Errorf(status.Internal, "failed to delete policy from store")
-		}
-
-		if result.RowsAffected == 0 {
-			return status.NewPolicyNotFoundError(policyID)
-		}
-
-		return nil
-	})
-}
-
-func (s *SqlStore) GetPolicyRulesByResourceID(ctx context.Context, lockStrength LockingStrength, accountID string, resourceID string) ([]*types.PolicyRule, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var policyRules []*types.PolicyRule
-	resourceIDPattern := `%"ID":"` + resourceID + `"%`
-	result := tx.Where("source_resource LIKE ? OR destination_resource LIKE ?", resourceIDPattern, resourceIDPattern).
-		Find(&policyRules)
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get policy rules for resource id from store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get policy rules for resource id from store")
-	}
-
-	return policyRules, nil
-}
-
-// GetAccountPostureChecks retrieves posture checks for an account.
-func (s *SqlStore) GetAccountPostureChecks(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*posture.Checks, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var postureChecks []*posture.Checks
-	result := tx.Find(&postureChecks, accountIDCondition, accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get posture checks from store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get posture checks from store")
-	}
-
-	return postureChecks, nil
-}
-
-// GetPostureChecksByID retrieves posture checks by their ID and account ID.
-func (s *SqlStore) GetPostureChecksByID(ctx context.Context, lockStrength LockingStrength, accountID, postureChecksID string) (*posture.Checks, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var postureCheck *posture.Checks
-	result := tx.
-		Take(&postureCheck, accountAndIDQueryCondition, accountID, postureChecksID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewPostureChecksNotFoundError(postureChecksID)
-		}
-		log.WithContext(ctx).Errorf("failed to get posture check from store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get posture check from store")
-	}
-
-	return postureCheck, nil
-}
-
-// GetPostureChecksByIDs retrieves posture checks by their IDs and account ID.
-func (s *SqlStore) GetPostureChecksByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, postureChecksIDs []string) (map[string]*posture.Checks, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var postureChecks []*posture.Checks
-	result := tx.Find(&postureChecks, accountAndIDsQueryCondition, accountID, postureChecksIDs)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get posture checks by ID's from store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get posture checks by ID's from store")
-	}
-
-	postureChecksMap := make(map[string]*posture.Checks)
-	for _, postureCheck := range postureChecks {
-		postureChecksMap[postureCheck.ID] = postureCheck
-	}
-
-	return postureChecksMap, nil
-}
-
-// SavePostureChecks saves a posture checks to the database.
-func (s *SqlStore) SavePostureChecks(ctx context.Context, postureCheck *posture.Checks) error {
-	result := s.db.Save(postureCheck)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to save posture checks to store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to save posture checks to store")
-	}
-
-	return nil
-}
-
-// DeletePostureChecks deletes a posture checks from the database.
-func (s *SqlStore) DeletePostureChecks(ctx context.Context, accountID, postureChecksID string) error {
-	result := s.db.Delete(&posture.Checks{}, accountAndIDQueryCondition, accountID, postureChecksID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete posture checks from store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to delete posture checks from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewPostureChecksNotFoundError(postureChecksID)
-	}
-
-	return nil
-}
-
-// GetAccountRoutes retrieves network routes for an account.
-func (s *SqlStore) GetAccountRoutes(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*route.Route, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var routes []*route.Route
-	result := tx.Find(&routes, accountIDCondition, accountID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get routes from the store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get routes from store")
-	}
-
-	return routes, nil
-}
-
-// GetRouteByID retrieves a route by its ID and account ID.
-func (s *SqlStore) GetRouteByID(ctx context.Context, lockStrength LockingStrength, accountID string, routeID string) (*route.Route, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var route *route.Route
-	result := tx.Take(&route, accountAndIDQueryCondition, accountID, routeID)
-	if err := result.Error; err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, status.NewRouteNotFoundError(routeID)
-		}
-		log.WithContext(ctx).Errorf("failed to get route from the store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get route from store")
-	}
-
-	return route, nil
-}
-
-// SaveRoute saves a route to the database.
-func (s *SqlStore) SaveRoute(ctx context.Context, route *route.Route) error {
-	result := s.db.Save(route)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to save route to the store: %s", err)
-		return status.Errorf(status.Internal, "failed to save route to store")
-	}
-
-	return nil
-}
-
-// DeleteRoute deletes a route from the database.
-func (s *SqlStore) DeleteRoute(ctx context.Context, accountID, routeID string) error {
-	result := s.db.Delete(&route.Route{}, accountAndIDQueryCondition, accountID, routeID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to delete route from the store: %s", err)
-		return status.Errorf(status.Internal, "failed to delete route from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewRouteNotFoundError(routeID)
-	}
-
-	return nil
-}
-
-// GetAccountSetupKeys retrieves setup keys for an account.
-func (s *SqlStore) GetAccountSetupKeys(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.SetupKey, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var setupKeys []*types.SetupKey
-	result := tx.
-		Find(&setupKeys, accountIDCondition, accountID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get setup keys from the store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get setup keys from store")
-	}
-
-	return setupKeys, nil
-}
-
-// GetSetupKeyByID retrieves a setup key by its ID and account ID.
-func (s *SqlStore) GetSetupKeyByID(ctx context.Context, lockStrength LockingStrength, accountID, setupKeyID string) (*types.SetupKey, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var setupKey *types.SetupKey
-	result := tx.Take(&setupKey, accountAndIDQueryCondition, accountID, setupKeyID)
-	if err := result.Error; err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, status.NewSetupKeyNotFoundError(setupKeyID)
-		}
-		log.WithContext(ctx).Errorf("failed to get setup key from the store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get setup key from store")
-	}
-
-	return setupKey, nil
-}
-
-// SaveSetupKey saves a setup key to the database.
-func (s *SqlStore) SaveSetupKey(ctx context.Context, setupKey *types.SetupKey) error {
-	result := s.db.Save(setupKey)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to save setup key to store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to save setup key to store")
-	}
-
-	return nil
-}
-
-// DeleteSetupKey deletes a setup key from the database.
-func (s *SqlStore) DeleteSetupKey(ctx context.Context, accountID, keyID string) error {
-	result := s.db.Delete(&types.SetupKey{}, accountAndIDQueryCondition, accountID, keyID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete setup key from store: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to delete setup key from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewSetupKeyNotFoundError(keyID)
-	}
-
-	return nil
-}
-
-// GetAccountNameServerGroups retrieves name server groups for an account.
-func (s *SqlStore) GetAccountNameServerGroups(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*nbdns.NameServerGroup, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var nsGroups []*nbdns.NameServerGroup
-	result := tx.Find(&nsGroups, accountIDCondition, accountID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get name server groups from the store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get name server groups from store")
-	}
-
-	return nsGroups, nil
-}
-
-// GetNameServerGroupByID retrieves a name server group by its ID and account ID.
-func (s *SqlStore) GetNameServerGroupByID(ctx context.Context, lockStrength LockingStrength, accountID, nsGroupID string) (*nbdns.NameServerGroup, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var nsGroup *nbdns.NameServerGroup
-	result := tx.
-		Take(&nsGroup, accountAndIDQueryCondition, accountID, nsGroupID)
-	if err := result.Error; err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, status.NewNameServerGroupNotFoundError(nsGroupID)
-		}
-		log.WithContext(ctx).Errorf("failed to get name server group from the store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get name server group from store")
-	}
-
-	return nsGroup, nil
-}
-
-// SaveNameServerGroup saves a name server group to the database.
-func (s *SqlStore) SaveNameServerGroup(ctx context.Context, nameServerGroup *nbdns.NameServerGroup) error {
-	result := s.db.Save(nameServerGroup)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to save name server group to the store: %s", err)
-		return status.Errorf(status.Internal, "failed to save name server group to store")
-	}
-	return nil
-}
-
-// DeleteNameServerGroup deletes a name server group from the database.
-func (s *SqlStore) DeleteNameServerGroup(ctx context.Context, accountID, nsGroupID string) error {
-	result := s.db.Delete(&nbdns.NameServerGroup{}, accountAndIDQueryCondition, accountID, nsGroupID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to delete name server group from the store: %s", err)
-		return status.Errorf(status.Internal, "failed to delete name server group from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewNameServerGroupNotFoundError(nsGroupID)
-	}
-
-	return nil
-}
-
-// SaveDNSSettings saves the DNS settings to the store.
-func (s *SqlStore) SaveDNSSettings(ctx context.Context, accountID string, settings *types.DNSSettings) error {
-	result := s.db.Model(&types.Account{}).
-		Where(idQueryCondition, accountID).Updates(&types.AccountDNSSettings{DNSSettings: *settings})
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to save dns settings to store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to save dns settings to store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewAccountNotFoundError(accountID)
-	}
-
-	return nil
-}
-
-// SaveAccountSettings stores the account settings in DB.
-func (s *SqlStore) SaveAccountSettings(ctx context.Context, accountID string, settings *types.Settings) error {
-	result := s.db.Model(&types.Account{}).
-		Select("*").Where(idQueryCondition, accountID).Updates(&types.AccountSettings{Settings: settings})
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to save account settings to store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to save account settings to store")
-	}
-
-	// MySQL reports RowsAffected=0 for no-op updates where values don't change,
-	// unlike SQLite/Postgres which report matched rows. Skip the check since the
-	// caller (UpdateAccountSettings) already verified the account exists via
-	// GetAccountSettings with LockingStrengthUpdate.
-
-	return nil
-}
-
-func (s *SqlStore) GetAccountNetworks(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*networkTypes.Network, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var networks []*networkTypes.Network
-	result := tx.Find(&networks, accountIDCondition, accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get networks from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get networks from store")
-	}
-
-	return networks, nil
-}
-
-func (s *SqlStore) GetNetworkByID(ctx context.Context, lockStrength LockingStrength, accountID, networkID string) (*networkTypes.Network, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var network *networkTypes.Network
-	result := tx.Take(&network, accountAndIDQueryCondition, accountID, networkID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewNetworkNotFoundError(networkID)
-		}
-
-		log.WithContext(ctx).Errorf("failed to get network from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get network from store")
-	}
-
-	return network, nil
-}
-
-func (s *SqlStore) SaveNetwork(ctx context.Context, network *networkTypes.Network) error {
-	result := s.db.Save(network)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to save network to store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to save network to store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) DeleteNetwork(ctx context.Context, accountID, networkID string) error {
-	result := s.db.Delete(&networkTypes.Network{}, accountAndIDQueryCondition, accountID, networkID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete network from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete network from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewNetworkNotFoundError(networkID)
-	}
-
-	return nil
-}
-
-func (s *SqlStore) GetNetworkRoutersByNetID(ctx context.Context, lockStrength LockingStrength, accountID, netID string) ([]*routerTypes.NetworkRouter, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var netRouters []*routerTypes.NetworkRouter
-	result := tx.
-		Find(&netRouters, "account_id = ? AND network_id = ?", accountID, netID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get network routers from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get network routers from store")
-	}
-
-	return netRouters, nil
-}
-
-func (s *SqlStore) GetNetworkRoutersByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*routerTypes.NetworkRouter, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var netRouters []*routerTypes.NetworkRouter
-	result := tx.
-		Find(&netRouters, accountIDCondition, accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get network routers from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get network routers from store")
-	}
-
-	return netRouters, nil
-}
-
-func (s *SqlStore) GetNetworkRouterByID(ctx context.Context, lockStrength LockingStrength, accountID, routerID string) (*routerTypes.NetworkRouter, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var netRouter *routerTypes.NetworkRouter
-	result := tx.
-		Take(&netRouter, accountAndIDQueryCondition, accountID, routerID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewNetworkRouterNotFoundError(routerID)
-		}
-		log.WithContext(ctx).Errorf("failed to get network router from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get network router from store")
-	}
-
-	return netRouter, nil
-}
-
-func (s *SqlStore) CreateNetworkRouter(ctx context.Context, router *routerTypes.NetworkRouter) error {
-	if err := s.db.Create(router).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to create network router in store: %v", err)
-		return status.Errorf(status.Internal, "failed to create network router in store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) UpdateNetworkRouter(ctx context.Context, router *routerTypes.NetworkRouter) error {
-	result := s.db.
-		Select("*").
-		Where(accountAndIDQueryCondition, router.AccountID, router.ID).
-		Updates(router)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to update network router in store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to update network router in store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewNetworkRouterNotFoundError(router.ID)
-	}
-
-	return nil
-}
-
-func (s *SqlStore) DeleteNetworkRouter(ctx context.Context, accountID, routerID string) error {
-	result := s.db.Delete(&routerTypes.NetworkRouter{}, accountAndIDQueryCondition, accountID, routerID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete network router from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete network router from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewNetworkRouterNotFoundError(routerID)
-	}
-
-	return nil
-}
-
-func (s *SqlStore) GetNetworkResourcesByNetID(ctx context.Context, lockStrength LockingStrength, accountID, networkID string) ([]*resourceTypes.NetworkResource, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var netResources []*resourceTypes.NetworkResource
-	result := tx.
-		Find(&netResources, "account_id = ? AND network_id = ?", accountID, networkID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get network resources from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get network resources from store")
-	}
-
-	return netResources, nil
-}
-
-func (s *SqlStore) GetNetworkResourcesByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*resourceTypes.NetworkResource, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var netResources []*resourceTypes.NetworkResource
-	result := tx.
-		Find(&netResources, accountIDCondition, accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get network resources from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get network resources from store")
-	}
-
-	return netResources, nil
-}
-
-func (s *SqlStore) GetNetworkResourceByID(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) (*resourceTypes.NetworkResource, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var netResources *resourceTypes.NetworkResource
-	result := tx.
-		Take(&netResources, accountAndIDQueryCondition, accountID, resourceID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewNetworkResourceNotFoundError(resourceID)
-		}
-		log.WithContext(ctx).Errorf("failed to get network resource from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get network resource from store")
-	}
-
-	return netResources, nil
-}
-
-func (s *SqlStore) GetNetworkResourceByName(ctx context.Context, lockStrength LockingStrength, accountID, resourceName string) (*resourceTypes.NetworkResource, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var netResources *resourceTypes.NetworkResource
-	result := tx.
-		Take(&netResources, "account_id = ? AND name = ?", accountID, resourceName)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewNetworkResourceNotFoundError(resourceName)
-		}
-		log.WithContext(ctx).Errorf("failed to get network resource from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get network resource from store")
-	}
-
-	return netResources, nil
-}
-
-func (s *SqlStore) SaveNetworkResource(ctx context.Context, resource *resourceTypes.NetworkResource) error {
-	result := s.db.Save(resource)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to save network resource to store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to save network resource to store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) DeleteNetworkResource(ctx context.Context, accountID, resourceID string) error {
-	result := s.db.Delete(&resourceTypes.NetworkResource{}, accountAndIDQueryCondition, accountID, resourceID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete network resource from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete network resource from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewNetworkResourceNotFoundError(resourceID)
-	}
-
-	return nil
-}
-
-// GetPATByHashedToken returns a PersonalAccessToken by its hashed token.
-func (s *SqlStore) GetPATByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken string) (*types.PersonalAccessToken, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var pat types.PersonalAccessToken
-	result := tx.Take(&pat, "hashed_token = ?", hashedToken)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewPATNotFoundError(hashedToken)
-		}
-		log.WithContext(ctx).Errorf("failed to get pat by hash from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get pat by hash from store")
-	}
-
-	return &pat, nil
-}
-
-// GetPATByID retrieves a personal access token by its ID and user ID.
-func (s *SqlStore) GetPATByID(ctx context.Context, lockStrength LockingStrength, userID string, patID string) (*types.PersonalAccessToken, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var pat types.PersonalAccessToken
-	result := tx.
-		Take(&pat, "id = ? AND user_id = ?", patID, userID)
-	if err := result.Error; err != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewPATNotFoundError(patID)
-		}
-		log.WithContext(ctx).Errorf("failed to get pat from the store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get pat from store")
-	}
-
-	return &pat, nil
-}
-
-// GetUserPATs retrieves personal access tokens for a user.
-func (s *SqlStore) GetUserPATs(ctx context.Context, lockStrength LockingStrength, userID string) ([]*types.PersonalAccessToken, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var pats []*types.PersonalAccessToken
-	result := tx.Find(&pats, "user_id = ?", userID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get user pat's from the store: %s", err)
-		return nil, status.Errorf(status.Internal, "failed to get user pat's from store")
-	}
-
-	return pats, nil
-}
-
-// MarkPATUsed marks a personal access token as used.
-func (s *SqlStore) MarkPATUsed(ctx context.Context, patID string) error {
-	patCopy := types.PersonalAccessToken{
-		LastUsed: util.ToPtr(time.Now().UTC()),
-	}
-
-	fieldsToUpdate := []string{"last_used"}
-	result := s.db.Select(fieldsToUpdate).
-		Where(idQueryCondition, patID).Updates(&patCopy)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to mark pat as used: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to mark pat as used")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewPATNotFoundError(patID)
-	}
-
-	return nil
-}
-
-// SavePAT saves a personal access token to the database.
-func (s *SqlStore) SavePAT(ctx context.Context, pat *types.PersonalAccessToken) error {
-	result := s.db.Save(pat)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to save pat to the store: %s", err)
-		return status.Errorf(status.Internal, "failed to save pat to store")
-	}
-
-	return nil
-}
-
-// DeletePAT deletes a personal access token from the database.
-func (s *SqlStore) DeletePAT(ctx context.Context, userID, patID string) error {
-	result := s.db.Delete(&types.PersonalAccessToken{}, "user_id = ? AND id = ?", userID, patID)
-	if err := result.Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to delete pat from the store: %s", err)
-		return status.Errorf(status.Internal, "failed to delete pat from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewPATNotFoundError(patID)
-	}
-
-	return nil
-}
-
-// GetProxyAccessTokenByHashedToken retrieves a proxy access token by its hashed value.
-func (s *SqlStore) GetProxyAccessTokenByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken types.HashedProxyToken) (*types.ProxyAccessToken, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var token types.ProxyAccessToken
-	result := tx.Take(&token, "hashed_token = ?", hashedToken)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "proxy access token not found")
-		}
-		return nil, status.Errorf(status.Internal, "get proxy access token: %v", result.Error)
-	}
-
-	return &token, nil
-}
-
-// GetAllProxyAccessTokens retrieves all proxy access tokens.
-func (s *SqlStore) GetAllProxyAccessTokens(ctx context.Context, lockStrength LockingStrength) ([]*types.ProxyAccessToken, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var tokens []*types.ProxyAccessToken
-	result := tx.Find(&tokens)
-	if result.Error != nil {
-		return nil, status.Errorf(status.Internal, "get proxy access tokens: %v", result.Error)
-	}
-
-	return tokens, nil
-}
-
-// SaveProxyAccessToken saves a proxy access token to the database.
-func (s *SqlStore) SaveProxyAccessToken(ctx context.Context, token *types.ProxyAccessToken) error {
-	if result := s.db.Create(token); result.Error != nil {
-		return status.Errorf(status.Internal, "save proxy access token: %v", result.Error)
-	}
-	return nil
-}
-
-// RevokeProxyAccessToken revokes a proxy access token by its ID.
-func (s *SqlStore) RevokeProxyAccessToken(ctx context.Context, tokenID string) error {
-	result := s.db.Model(&types.ProxyAccessToken{}).Where(idQueryCondition, tokenID).Update("revoked", true)
-	if result.Error != nil {
-		return status.Errorf(status.Internal, "revoke proxy access token: %v", result.Error)
-	}
-
-	if result.RowsAffected == 0 {
-		return status.Errorf(status.NotFound, "proxy access token not found")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) GetProxyAccessTokensByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.ProxyAccessToken, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var tokens []*types.ProxyAccessToken
-	result := tx.Where("account_id = ?", accountID).Find(&tokens)
-	if result.Error != nil {
-		return nil, status.Errorf(status.Internal, "get proxy access tokens by account: %v", result.Error)
-	}
-
-	return tokens, nil
-}
-
-func (s *SqlStore) IsProxyAccessTokenValid(ctx context.Context, tokenID string) (bool, error) {
-	token, err := s.GetProxyAccessTokenByID(ctx, LockingStrengthNone, tokenID)
-	if err != nil {
-		return false, err
-	}
-	return token.IsValid(), nil
-}
-
-func (s *SqlStore) GetProxyAccessTokenByID(ctx context.Context, lockStrength LockingStrength, tokenID string) (*types.ProxyAccessToken, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var token types.ProxyAccessToken
-	result := tx.Take(&token, idQueryCondition, tokenID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "proxy access token not found")
-		}
-		return nil, status.Errorf(status.Internal, "get proxy access token by ID: %v", result.Error)
-	}
-
-	return &token, nil
-}
-
-// MarkProxyAccessTokenUsed updates the last used timestamp for a proxy access token.
-func (s *SqlStore) MarkProxyAccessTokenUsed(ctx context.Context, tokenID string) error {
-	result := s.db.Model(&types.ProxyAccessToken{}).
-		Where(idQueryCondition, tokenID).
-		Update("last_used", time.Now().UTC())
-	if result.Error != nil {
-		return status.Errorf(status.Internal, "mark proxy access token as used: %v", result.Error)
-	}
-
-	if result.RowsAffected == 0 {
-		return status.Errorf(status.NotFound, "proxy access token not found")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) GetPeerByIP(ctx context.Context, lockStrength LockingStrength, accountID string, ip net.IP) (*nbpeer.Peer, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	column := "ip"
-	if ip.To4() == nil {
-		column = "ipv6"
-	}
-	jsonValue := fmt.Sprintf(`"%s"`, ip.String())
-
-	var peer nbpeer.Peer
-	result := tx.
-		Take(&peer, fmt.Sprintf("account_id = ? AND %s = ?", column), accountID, jsonValue)
-	if result.Error != nil {
-		// A tunnel-IP miss is an expected outcome (e.g. the proxy's
-		// ValidateTunnelPeer probing an address that isn't in the
-		// account roster); surface it as NotFound so callers can tell
-		// it apart from a real store failure.
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "peer with ip %s not found", ip.String())
-		}
-		return nil, status.Errorf(status.Internal, "failed to get peer from store")
-	}
-
-	return &peer, nil
-}
-
-func (s *SqlStore) GetPeerIdByLabel(ctx context.Context, lockStrength LockingStrength, accountID string, hostname string) (string, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var peerID string
-	result := tx.Model(&nbpeer.Peer{}).
-		Select("id").
-		// Where(" = ?", hostname).
-		Where("account_id = ? AND dns_label = ?", accountID, hostname).
-		Limit(1).
-		Scan(&peerID)
-
-	if peerID == "" {
-		return "", gorm.ErrRecordNotFound
-	}
-
-	return peerID, result.Error
-}
-
-func (s *SqlStore) CountAccountsByPrivateDomain(ctx context.Context, domain string) (int64, error) {
-	var count int64
-	result := s.db.Model(&types.Account{}).
-		Where("domain = ? AND domain_category = ?",
-			strings.ToLower(domain), types.PrivateCategory,
-		).Count(&count)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to count accounts by private domain %s: %s", domain, result.Error)
-		return 0, status.Errorf(status.Internal, "failed to count accounts by private domain")
-	}
-
-	return count, nil
-}
-
-func (s *SqlStore) GetAccountGroupPeers(ctx context.Context, lockStrength LockingStrength, accountID string) (map[string]map[string]struct{}, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var peers []types.GroupPeer
-	result := tx.Find(&peers, accountIDCondition, accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get account group peers from store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get account group peers from store")
-	}
-
-	groupPeers := make(map[string]map[string]struct{})
-	for _, peer := range peers {
-		if _, exists := groupPeers[peer.GroupID]; !exists {
-			groupPeers[peer.GroupID] = make(map[string]struct{})
-		}
-		groupPeers[peer.GroupID][peer.PeerID] = struct{}{}
-	}
-
-	return groupPeers, nil
-}
-
-func (s *SqlStore) IsPrimaryAccount(ctx context.Context, accountID string) (bool, string, error) {
-	var info types.PrimaryAccountInfo
-	result := s.db.Model(&types.Account{}).
-		Select("is_domain_primary_account, domain").
-		Where(idQueryCondition, accountID).
-		Take(&info)
-
-	if result.Error != nil {
-		return false, "", status.Errorf(status.Internal, "failed to get account info: %v", result.Error)
-	}
-
-	return info.IsDomainPrimaryAccount, info.Domain, nil
-}
-
-func (s *SqlStore) MarkAccountPrimary(ctx context.Context, accountID string) error {
-	result := s.db.Model(&types.Account{}).
-		Where(idQueryCondition, accountID).
-		Update("is_domain_primary_account", true)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to mark account as primary: %s", result.Error)
-		return status.Errorf(status.Internal, "failed to mark account as primary")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewAccountNotFoundError(accountID)
-	}
-
-	return nil
-}
-
-type accountNetworkPatch struct {
-	Network *types.Network `gorm:"embedded;embeddedPrefix:network_"`
-}
-
-func (s *SqlStore) UpdateAccountNetwork(ctx context.Context, accountID string, ipNet net.IPNet) error {
-	patch := accountNetworkPatch{
-		Network: &types.Network{Net: ipNet},
-	}
-
-	result := s.db.
-		Model(&types.Account{}).
-		Where(idQueryCondition, accountID).
-		Updates(&patch)
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to update account network: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to update account network")
-	}
-	if result.RowsAffected == 0 {
-		return status.NewAccountNotFoundError(accountID)
-	}
-	return nil
-}
-
-// UpdateAccountNetworkV6 updates the IPv6 network range for the account.
-func (s *SqlStore) UpdateAccountNetworkV6(ctx context.Context, accountID string, ipNet net.IPNet) error {
-	patch := accountNetworkPatch{
-		Network: &types.Network{NetV6: ipNet},
-	}
-
-	result := s.db.
-		Model(&types.Account{}).
-		Where(idQueryCondition, accountID).
-		Updates(&patch)
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to update account network v6: %v", result.Error)
-		return status.Errorf(status.Internal, "update account network v6")
-	}
-	if result.RowsAffected == 0 {
-		return status.NewAccountNotFoundError(accountID)
-	}
-	return nil
-}
-
-func (s *SqlStore) GetPeersByGroupIDs(ctx context.Context, accountID string, groupIDs []string) ([]*nbpeer.Peer, error) {
-	if len(groupIDs) == 0 {
-		return []*nbpeer.Peer{}, nil
-	}
-
-	var peers []*nbpeer.Peer
-	peerIDsSubquery := s.db.Model(&types.GroupPeer{}).
-		Select("DISTINCT peer_id").
-		Where("account_id = ? AND group_id IN ?", accountID, groupIDs)
-
-	result := s.db.Where("id IN (?)", peerIDsSubquery).Find(&peers)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get peers by group IDs: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get peers by group IDs")
-	}
-
-	return peers, nil
-}
-
-func (s *SqlStore) GetPeerIDsByGroups(ctx context.Context, accountID string, groupIDs []string) ([]string, error) {
-	if len(groupIDs) == 0 {
-		return nil, nil
-	}
-
-	var peerIDs []string
-	result := s.db.Model(&types.GroupPeer{}).
-		Select("DISTINCT peer_id").
-		Where("account_id = ? AND group_id IN ?", accountID, groupIDs).
-		Pluck("peer_id", &peerIDs)
-	if result.Error != nil {
-		return nil, status.Errorf(status.Internal, "failed to get peer IDs by groups: %s", result.Error)
-	}
-
-	return peerIDs, nil
-}
-
-func (s *SqlStore) GetGroupIDsByPeerIDs(ctx context.Context, accountID string, peerIDs []string) ([]string, error) {
-	if len(peerIDs) == 0 {
-		return nil, nil
-	}
-
-	var groupIDs []string
-	result := s.db.Model(&types.GroupPeer{}).
-		Select("DISTINCT group_id").
-		Where("account_id = ? AND peer_id IN ?", accountID, peerIDs).
-		Pluck("group_id", &groupIDs)
-	if result.Error != nil {
-		return nil, status.Errorf(status.Internal, "failed to get group IDs by peers: %s", result.Error)
-	}
-
-	return groupIDs, nil
-}
-
-// GetEmbeddedProxyPeerIDsByCluster returns peer IDs of all embedded proxy peers
-// in the account, grouped by their ProxyCluster. The map is nil when no embedded
-// proxy peers exist.
-func (s *SqlStore) GetEmbeddedProxyPeerIDsByCluster(ctx context.Context, accountID string) (map[string][]string, error) {
-	type row struct {
-		ID      string
-		Cluster string
-	}
-	var rows []row
-	result := s.db.Model(&nbpeer.Peer{}).
-		Select("id, proxy_meta_cluster AS cluster").
-		Where("account_id = ? AND proxy_meta_embedded = ?", accountID, true).
-		Scan(&rows)
-	if result.Error != nil {
-		return nil, status.Errorf(status.Internal, "failed to get embedded proxy peers: %s", result.Error)
-	}
-
-	out := make(map[string][]string, len(rows))
-	for _, r := range rows {
-		out[r.Cluster] = append(out[r.Cluster], r.ID)
-	}
-	return out, nil
-}
-
-func (s *SqlStore) GetUserIDByPeerKey(ctx context.Context, lockStrength LockingStrength, peerKey string) (string, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var userID string
-	result := tx.Model(&nbpeer.Peer{}).
-		Select("user_id").
-		Take(&userID, GetKeyQueryCondition(s), peerKey)
-
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return "", status.Errorf(status.NotFound, "peer not found: index lookup failed")
-		}
-		return "", status.Errorf(status.Internal, "failed to get user ID by peer key")
-	}
-
-	return userID, nil
-}
-
-func (s *SqlStore) CreateZone(ctx context.Context, zone *zones.Zone) error {
-	result := s.db.Create(zone)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to create zone to store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to create zone to store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) UpdateZone(ctx context.Context, zone *zones.Zone) error {
-	result := s.db.Select("*").Save(zone)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to update zone to store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to update zone to store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) DeleteZone(ctx context.Context, accountID, zoneID string) error {
-	result := s.db.Delete(&zones.Zone{}, accountAndIDQueryCondition, accountID, zoneID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete zone from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete zone from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewZoneNotFoundError(zoneID)
-	}
-
-	return nil
-}
-
-func (s *SqlStore) GetZoneByID(ctx context.Context, lockStrength LockingStrength, accountID, zoneID string) (*zones.Zone, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var zone *zones.Zone
-	result := tx.Preload("Records").Take(&zone, accountAndIDQueryCondition, accountID, zoneID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewZoneNotFoundError(zoneID)
-		}
-
-		log.WithContext(ctx).Errorf("failed to get zone from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get zone from store")
-	}
-
-	return zone, nil
-}
-
-func (s *SqlStore) GetZoneByDomain(ctx context.Context, accountID, domain string) (*zones.Zone, error) {
-	var zone *zones.Zone
-	result := s.db.Where("account_id = ? AND domain = ?", accountID, domain).First(&zone)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewZoneNotFoundError(domain)
-		}
-
-		log.WithContext(ctx).Errorf("failed to get zone by domain from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get zone by domain from store")
-	}
-
-	return zone, nil
-}
-
-func (s *SqlStore) GetAccountZones(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*zones.Zone, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var zones []*zones.Zone
-	result := tx.Preload("Records").Find(&zones, accountIDCondition, accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get zones from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get zones from store")
-	}
-
-	return zones, nil
-}
-
-func (s *SqlStore) CreateDNSRecord(ctx context.Context, record *records.Record) error {
-	result := s.db.Create(record)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to create dns record to store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to create dns record to store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) UpdateDNSRecord(ctx context.Context, record *records.Record) error {
-	result := s.db.Select("*").Save(record)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to update dns record to store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to update dns record to store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) DeleteDNSRecord(ctx context.Context, accountID, zoneID, recordID string) error {
-	result := s.db.Delete(&records.Record{}, "account_id = ? AND zone_id = ? AND id = ?", accountID, zoneID, recordID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete dns record from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete dns record from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.NewDNSRecordNotFoundError(recordID)
-	}
-
-	return nil
-}
-
-func (s *SqlStore) GetDNSRecordByID(ctx context.Context, lockStrength LockingStrength, accountID, zoneID, recordID string) (*records.Record, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var record *records.Record
-	result := tx.Where("account_id = ? AND zone_id = ? AND id = ?", accountID, zoneID, recordID).Take(&record)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.NewDNSRecordNotFoundError(recordID)
-		}
-
-		log.WithContext(ctx).Errorf("failed to get dns record from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get dns record from store")
-	}
-
-	return record, nil
-}
-
-func (s *SqlStore) GetZoneDNSRecords(ctx context.Context, lockStrength LockingStrength, accountID, zoneID string) ([]*records.Record, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var recordsList []*records.Record
-	result := tx.Where("account_id = ? AND zone_id = ?", accountID, zoneID).Find(&recordsList)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get zone dns records from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get zone dns records from store")
-	}
-
-	return recordsList, nil
-}
-
-func (s *SqlStore) GetZoneDNSRecordsByName(ctx context.Context, lockStrength LockingStrength, accountID, zoneID, name string) ([]*records.Record, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var recordsList []*records.Record
-	result := tx.Where("account_id = ? AND zone_id = ? AND name = ?", accountID, zoneID, name).Find(&recordsList)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get zone dns records by name from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get zone dns records by name from store")
-	}
-
-	return recordsList, nil
-}
-
-func (s *SqlStore) DeleteZoneDNSRecords(ctx context.Context, accountID, zoneID string) error {
-	result := s.db.Delete(&records.Record{}, "account_id = ? AND zone_id = ?", accountID, zoneID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete zone dns records from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete zone dns records from store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) GetPeerIDByKey(ctx context.Context, lockStrength LockingStrength, key string) (string, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var peerID string
-	result := tx.Model(&nbpeer.Peer{}).
-		Select("id").
-		Where(GetKeyQueryCondition(s), key).
-		Limit(1).
-		Scan(&peerID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get peer ID by key: %s", result.Error)
-		return "", status.Errorf(status.Internal, "failed to get peer ID by key")
-	}
-
-	return peerID, nil
-}
-
-func (s *SqlStore) CreateService(ctx context.Context, service *rpservice.Service) error {
-	serviceCopy := service.Copy()
-	if err := serviceCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
-		return fmt.Errorf("encrypt service data: %w", err)
-	}
-	result := s.db.Create(serviceCopy)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to create service to store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to create service to store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) UpdateService(ctx context.Context, service *rpservice.Service) error {
-	serviceCopy := service.Copy()
-	if err := serviceCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
-		return fmt.Errorf("encrypt service data: %w", err)
-	}
-
-	// Create target type instance outside transaction to avoid variable shadowing
-	targetType := &rpservice.Target{}
-
-	// Use a transaction to ensure atomic updates of the service and its targets
-	err := s.db.Transaction(func(tx *gorm.DB) error {
-		// Delete existing targets
-		if err := tx.Where("service_id = ?", serviceCopy.ID).Delete(targetType).Error; err != nil {
-			return err
-		}
-
-		// Update the service and create new targets
-		if err := tx.Session(&gorm.Session{FullSaveAssociations: true}).Save(serviceCopy).Error; err != nil {
-			return err
-		}
-
-		return nil
-	})
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to update service to store: %v", err)
-		return status.Errorf(status.Internal, "failed to update service to store")
-	}
-
-	return nil
-}
-
-func (s *SqlStore) DeleteService(ctx context.Context, accountID, serviceID string) error {
-	result := s.db.Delete(&rpservice.Service{}, accountAndIDQueryCondition, accountID, serviceID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete service from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete service from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.Errorf(status.NotFound, "service %s not found", serviceID)
-	}
-
-	return nil
-}
-
-func (s *SqlStore) DeleteTarget(ctx context.Context, accountID string, serviceID string, targetID uint) error {
-	result := s.db.Delete(&rpservice.Target{}, "account_id = ? AND service_id = ? AND id = ?", accountID, serviceID, targetID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete target from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete target from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.Errorf(status.NotFound, "target not found for service %s", serviceID)
-	}
-
-	return nil
-}
-
-func (s *SqlStore) DeleteServiceTargets(ctx context.Context, accountID string, serviceID string) error {
-	result := s.db.Delete(&rpservice.Target{}, "account_id = ? AND service_id = ?", accountID, serviceID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete targets from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete targets from store")
-	}
-
-	return nil
-}
-
-// GetTargetsByServiceID retrieves all targets for a given service
-func (s *SqlStore) GetTargetsByServiceID(ctx context.Context, lockStrength LockingStrength, accountID string, serviceID string) ([]*rpservice.Target, error) {
-	var targets []*rpservice.Target
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-	result := tx.Where("account_id = ? AND service_id = ?", accountID, serviceID).Find(&targets)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get targets from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get targets from store")
-	}
-
-	return targets, nil
-}
-
-func (s *SqlStore) GetServiceByID(ctx context.Context, lockStrength LockingStrength, accountID, serviceID string) (*rpservice.Service, error) {
-	tx := s.db.Preload("Targets")
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var service *rpservice.Service
-	result := tx.Take(&service, accountAndIDQueryCondition, accountID, serviceID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "service %s not found", serviceID)
-		}
-
-		log.WithContext(ctx).Errorf("failed to get service from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get service from store")
-	}
-
-	if err := service.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-		return nil, fmt.Errorf("decrypt service data: %w", err)
-	}
-
-	return service, nil
-}
-
-func (s *SqlStore) GetServiceByDomain(ctx context.Context, domain string) (*rpservice.Service, error) {
-	var service *rpservice.Service
-	result := s.db.Preload("Targets").Where("domain = ?", domain).First(&service)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "service with domain %s not found", domain)
-		}
-
-		log.WithContext(ctx).Errorf("failed to get service by domain from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get service by domain from store")
-	}
-
-	if err := service.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-		return nil, fmt.Errorf("decrypt service data: %w", err)
-	}
-
-	return service, nil
-}
-
-func (s *SqlStore) GetServices(ctx context.Context, lockStrength LockingStrength) ([]*rpservice.Service, error) {
-	tx := s.db.Preload("Targets")
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var serviceList []*rpservice.Service
-	result := tx.Find(&serviceList)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get services from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get services from store")
-	}
-
-	for _, service := range serviceList {
-		if err := service.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-			return nil, fmt.Errorf("decrypt service data: %w", err)
-		}
-	}
-
-	return serviceList, nil
-}
-
-func (s *SqlStore) GetAccountServices(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*rpservice.Service, error) {
-	tx := s.db.Preload("Targets")
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var serviceList []*rpservice.Service
-	result := tx.Find(&serviceList, accountIDCondition, accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get services from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get services from store")
-	}
-
-	for _, service := range serviceList {
-		if err := service.DecryptSensitiveData(s.fieldEncrypt); err != nil {
-			return nil, fmt.Errorf("decrypt service data: %w", err)
-		}
-	}
-
-	return serviceList, nil
-}
-
-// RenewEphemeralService updates the last_renewed_at timestamp for an ephemeral service.
-func (s *SqlStore) RenewEphemeralService(ctx context.Context, accountID, peerID, serviceID string) error {
-	result := s.db.Model(&rpservice.Service{}).
-		Where("id = ? AND account_id = ? AND source_peer = ? AND source = ?", serviceID, accountID, peerID, rpservice.SourceEphemeral).
-		Update("meta_last_renewed_at", time.Now())
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to renew ephemeral service: %v", result.Error)
-		return status.Errorf(status.Internal, "renew ephemeral service")
-	}
-	if result.RowsAffected == 0 {
-		return status.Errorf(status.NotFound, "no active expose session for service %s", serviceID)
-	}
-	return nil
-}
-
-// GetExpiredEphemeralServices returns ephemeral services whose last renewal exceeds the given TTL.
-// Only the fields needed for reaping are selected. The limit parameter caps the batch size to
-// avoid loading too many rows in a single tick. Rows with empty source_peer are excluded to
-// skip malformed legacy data.
-func (s *SqlStore) GetExpiredEphemeralServices(ctx context.Context, ttl time.Duration, limit int) ([]*rpservice.Service, error) {
-	cutoff := time.Now().Add(-ttl)
-	var services []*rpservice.Service
-	result := s.db.
-		Select("id", "account_id", "source_peer", "domain").
-		Where("source = ? AND source_peer <> '' AND meta_last_renewed_at < ?", rpservice.SourceEphemeral, cutoff).
-		Limit(limit).
-		Find(&services)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get expired ephemeral services: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "get expired ephemeral services")
-	}
-	return services, nil
-}
-
-// CountEphemeralServicesByPeer returns the count of ephemeral services for a specific peer.
-// Use LockingStrengthUpdate inside a transaction to serialize concurrent create operations.
-// The locking is applied via a row-level SELECT ... FOR UPDATE (not on the aggregate) to
-// stay compatible with Postgres, which disallows FOR UPDATE on COUNT(*).
-func (s *SqlStore) CountEphemeralServicesByPeer(ctx context.Context, lockStrength LockingStrength, accountID, peerID string) (int64, error) {
-	if lockStrength == LockingStrengthNone {
-		var count int64
-		result := s.db.Model(&rpservice.Service{}).
-			Where("account_id = ? AND source_peer = ? AND source = ?", accountID, peerID, rpservice.SourceEphemeral).
-			Count(&count)
-		if result.Error != nil {
-			log.WithContext(ctx).Errorf("failed to count ephemeral services: %v", result.Error)
-			return 0, status.Errorf(status.Internal, "count ephemeral services")
-		}
-		return count, nil
-	}
-
-	var ids []string
-	result := s.db.Model(&rpservice.Service{}).
-		Clauses(clause.Locking{Strength: string(lockStrength)}).
-		Select("id").
-		Where("account_id = ? AND source_peer = ? AND source = ?", accountID, peerID, rpservice.SourceEphemeral).
-		Pluck("id", &ids)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to count ephemeral services: %v", result.Error)
-		return 0, status.Errorf(status.Internal, "count ephemeral services")
-	}
-	return int64(len(ids)), nil
-}
-
-// EphemeralServiceExists checks if an ephemeral service exists for the given peer and domain.
-// Use LockingStrengthUpdate inside a transaction to serialize concurrent create operations.
-func (s *SqlStore) EphemeralServiceExists(ctx context.Context, lockStrength LockingStrength, accountID, peerID, domain string) (bool, error) {
-	if lockStrength == LockingStrengthNone {
-		var count int64
-		result := s.db.Model(&rpservice.Service{}).
-			Where("account_id = ? AND source_peer = ? AND domain = ? AND source = ?", accountID, peerID, domain, rpservice.SourceEphemeral).
-			Count(&count)
-		if result.Error != nil {
-			log.WithContext(ctx).Errorf("failed to check ephemeral service existence: %v", result.Error)
-			return false, status.Errorf(status.Internal, "check ephemeral service existence")
-		}
-		return count > 0, nil
-	}
-
-	var id string
-	result := s.db.Model(&rpservice.Service{}).
-		Clauses(clause.Locking{Strength: string(lockStrength)}).
-		Select("id").
-		Where("account_id = ? AND source_peer = ? AND domain = ? AND source = ?", accountID, peerID, domain, rpservice.SourceEphemeral).
-		Limit(1).
-		Pluck("id", &id)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to check ephemeral service existence: %v", result.Error)
-		return false, status.Errorf(status.Internal, "check ephemeral service existence")
-	}
-	return id != "", nil
-}
-
-// GetServicesByClusterAndPort returns services matching the given proxy cluster, mode, and listen port.
-func (s *SqlStore) GetServicesByClusterAndPort(ctx context.Context, lockStrength LockingStrength, proxyCluster string, mode string, listenPort uint16) ([]*rpservice.Service, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var services []*rpservice.Service
-	result := tx.Where("proxy_cluster = ? AND mode = ? AND listen_port = ?", proxyCluster, mode, listenPort).Find(&services)
-	if result.Error != nil {
-		return nil, status.Errorf(status.Internal, "query services by cluster and port")
-	}
-
-	return services, nil
-}
-
-// GetServicesByCluster returns all services for the given proxy cluster.
-func (s *SqlStore) GetServicesByCluster(ctx context.Context, lockStrength LockingStrength, proxyCluster string) ([]*rpservice.Service, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var services []*rpservice.Service
-	result := tx.Where("proxy_cluster = ?", proxyCluster).Find(&services)
-	if result.Error != nil {
-		return nil, status.Errorf(status.Internal, "query services by cluster")
-	}
-	return services, nil
-}
-
-func (s *SqlStore) GetCustomDomain(ctx context.Context, accountID string, domainID string) (*domain.Domain, error) {
-	tx := s.db
-
-	customDomain := &domain.Domain{}
-	result := tx.Take(&customDomain, accountAndIDQueryCondition, accountID, domainID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "custom domain %s not found", domainID)
-		}
-
-		log.WithContext(ctx).Errorf("failed to get custom domain from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get custom domain from store")
-	}
-
-	return customDomain, nil
-}
-
-func (s *SqlStore) ListFreeDomains(ctx context.Context, accountID string) ([]string, error) {
-	return nil, nil
-}
-
-func (s *SqlStore) ListCustomDomains(ctx context.Context, accountID string) ([]*domain.Domain, error) {
-	tx := s.db
-
-	var domains []*domain.Domain
-	result := tx.Find(&domains, accountIDCondition, accountID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get reverse proxy custom domains from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get reverse proxy custom domains from store")
-	}
-
-	return domains, nil
-}
-
-func (s *SqlStore) CreateCustomDomain(ctx context.Context, accountID string, domainName string, targetCluster string, validated bool) (*domain.Domain, error) {
-	newDomain := &domain.Domain{
-		ID:            xid.New().String(), // Generate our own ID because gorm doesn't always configure the database to handle this for us.
-		Domain:        domainName,
-		AccountID:     accountID,
-		TargetCluster: targetCluster,
-		Type:          domain.TypeCustom,
-		Validated:     validated,
-	}
-	result := s.db.Create(newDomain)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to create reverse proxy custom domain to store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to create reverse proxy custom domain to store")
-	}
-
-	return newDomain, nil
-}
-
-func (s *SqlStore) UpdateCustomDomain(ctx context.Context, accountID string, d *domain.Domain) (*domain.Domain, error) {
-	d.AccountID = accountID
-	result := s.db.Select("*").Save(d)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to update reverse proxy custom domain to store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to update reverse proxy custom domain to store")
-	}
-
-	return d, nil
-}
-
-func (s *SqlStore) DeleteCustomDomain(ctx context.Context, accountID string, domainID string) error {
-	result := s.db.Delete(domain.Domain{}, accountAndIDQueryCondition, accountID, domainID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete reverse proxy custom domain from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete reverse proxy custom domain from store")
-	}
-
-	if result.RowsAffected == 0 {
-		return status.Errorf(status.NotFound, "reverse proxy custom domain %s not found", domainID)
-	}
-
-	return nil
-}
-
-// CreateAccessLog creates a new access log entry in the database
-func (s *SqlStore) CreateAccessLog(ctx context.Context, logEntry *accesslogs.AccessLogEntry) error {
-	result := s.db.Create(logEntry)
-	if result.Error != nil {
-		log.WithContext(ctx).WithFields(log.Fields{
-			"service_id": logEntry.ServiceID,
-			"method":     logEntry.Method,
-			"host":       logEntry.Host,
-			"path":       logEntry.Path,
-		}).Errorf("failed to create access log entry in store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to create access log entry in store")
-	}
-	return nil
-}
-
-// CreateAgentNetworkAccessLog persists a flattened agent-network access-log
-// entry together with its authorising-group child rows in a single
-// transaction.
-func (s *SqlStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error {
-	err := s.db.Transaction(func(tx *gorm.DB) error {
-		// Idempotent on the log id / (log_id, group_id) so a proxy resend of the
-		// same entry can't fail the request.
-		if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(entry).Error; err != nil {
-			return err
-		}
-		if len(groups) > 0 {
-			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&groups).Error; err != nil {
-				return err
-			}
-		}
-		return nil
-	})
-	if err != nil {
-		log.WithContext(ctx).WithFields(log.Fields{
-			"account_id": entry.AccountID,
-			"service_id": entry.ServiceID,
-			"model":      entry.Model,
-		}).Errorf("failed to create agent-network access log entry in store: %v", err)
-		return status.Errorf(status.Internal, "failed to create agent-network access log entry in store")
-	}
-	return nil
-}
-
-// CreateAgentNetworkUsage persists a stripped agent-network usage record
-// together with its authorising-group child rows in a single transaction.
-func (s *SqlStore) CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error {
-	err := s.db.Transaction(func(tx *gorm.DB) error {
-		// Idempotent on the usage id / (usage_id, group_id) so a proxy resend of
-		// the same entry can't fail the request.
-		if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(usage).Error; err != nil {
-			return err
-		}
-		if len(groups) > 0 {
-			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&groups).Error; err != nil {
-				return err
-			}
-		}
-		return nil
-	})
-	if err != nil {
-		log.WithContext(ctx).WithFields(log.Fields{
-			"account_id": usage.AccountID,
-			"model":      usage.Model,
-		}).Errorf("failed to create agent-network usage record in store: %v", err)
-		return status.Errorf(status.Internal, "failed to create agent-network usage record in store")
-	}
-	return nil
-}
-
-// DeleteOldAgentNetworkAccessLogs deletes an account's access-log rows (and
-// their authorising-group child rows) older than the cutoff. Usage records are
-// untouched — they are the long-term aggregate. Returns the number of log rows
-// deleted.
-func (s *SqlStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error) {
-	var deleted int64
-	err := s.db.Transaction(func(tx *gorm.DB) error {
-		// Remove group child rows for the soon-to-be-deleted logs first.
-		if err := tx.Exec(
-			"DELETE FROM agent_network_access_log_group WHERE account_id = ? AND log_id IN (SELECT id FROM agent_network_access_log WHERE account_id = ? AND timestamp < ?)",
-			accountID, accountID, olderThan,
-		).Error; err != nil {
-			return err
-		}
-		res := tx.Where("account_id = ? AND timestamp < ?", accountID, olderThan).
-			Delete(&agentNetworkTypes.AgentNetworkAccessLog{})
-		if res.Error != nil {
-			return res.Error
-		}
-		deleted = res.RowsAffected
-		return nil
-	})
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to delete old agent-network access logs for account %s: %v", accountID, err)
-		return 0, status.Errorf(status.Internal, "failed to delete old agent-network access logs")
-	}
-	return deleted, nil
-}
-
-// GetAgentNetworkUsageRows returns the stripped usage rows for an account that
-// match the filter (date / user / group / provider / model). Aggregation into
-// time buckets happens in the manager so granularities stay engine-portable.
-func (s *SqlStore) GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkUsage, error) {
-	var rows []*agentNetworkTypes.AgentNetworkUsage
-
-	query := s.applyAgentNetworkUsageFilters(
-		s.db.Where(accountIDCondition, accountID),
-		filter,
-	).Order("timestamp ASC")
-
-	if lockStrength != LockingStrengthNone {
-		query = query.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	if err := query.Find(&rows).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get agent-network usage rows from store: %v", err)
-		return nil, status.Errorf(status.Internal, "failed to get agent-network usage rows from store")
-	}
-	return rows, nil
-}
-
-// applyAgentNetworkUsageFilters applies the shared access-log filter's
-// date/user/group/provider/model conditions to a usage-table query. Pagination,
-// sort and free-text search are ignored — the overview is an aggregate.
-func (s *SqlStore) applyAgentNetworkUsageFilters(query *gorm.DB, filter agentNetworkTypes.AgentNetworkAccessLogFilter) *gorm.DB {
-	if filter.UserID != nil {
-		query = query.Where("user_id = ?", *filter.UserID)
-	}
-	if filter.SessionID != nil {
-		query = query.Where("session_id = ?", *filter.SessionID)
-	}
-	if len(filter.ProviderIDs) > 0 {
-		query = query.Where("resolved_provider_id IN ?", filter.ProviderIDs)
-	}
-	if len(filter.Models) > 0 {
-		query = query.Where("model IN ?", filter.Models)
-	}
-	if len(filter.GroupIDs) > 0 {
-		query = query.Where(
-			"id IN (SELECT usage_id FROM agent_network_request_usage_group WHERE group_id IN ?)",
-			filter.GroupIDs,
-		)
-	}
-	if filter.StartDate != nil {
-		query = query.Where("timestamp >= ?", *filter.StartDate)
-	}
-	if filter.EndDate != nil {
-		query = query.Where("timestamp <= ?", *filter.EndDate)
-	}
-	return query
-}
-
-// GetAgentNetworkAccessLogs retrieves flattened agent-network access logs for
-// an account with server-side pagination, filtering and sorting. Authorising
-// group ids are hydrated from the group child table for the returned page.
-func (s *SqlStore) GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLog, int64, error) {
-	var logs []*agentNetworkTypes.AgentNetworkAccessLog
-	var totalCount int64
-
-	countQuery := s.applyAgentNetworkAccessLogFilters(
-		s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).Where(accountIDCondition, accountID),
-		filter,
-	)
-	if err := countQuery.Count(&totalCount).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to count agent-network access logs: %v", err)
-		return nil, 0, status.Errorf(status.Internal, "failed to count agent-network access logs")
-	}
-
-	query := s.applyAgentNetworkAccessLogFilters(
-		s.db.Where(accountIDCondition, accountID),
-		filter,
-	).
-		Order(filter.GetSortColumn() + " " + filter.GetSortOrder()).
-		Limit(filter.GetLimit()).
-		Offset(filter.GetOffset())
-
-	if lockStrength != LockingStrengthNone {
-		query = query.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	if err := query.Find(&logs).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get agent-network access logs from store: %v", err)
-		return nil, 0, status.Errorf(status.Internal, "failed to get agent-network access logs from store")
-	}
-
-	if err := s.hydrateAgentNetworkAccessLogGroups(ctx, accountID, logs); err != nil {
-		return nil, 0, err
-	}
-
-	return logs, totalCount, nil
-}
-
-// applyAgentNetworkAccessLogFilters applies the filter conditions to a query.
-func (s *SqlStore) applyAgentNetworkAccessLogFilters(query *gorm.DB, filter agentNetworkTypes.AgentNetworkAccessLogFilter) *gorm.DB {
-	if filter.Search != nil {
-		p := "%" + *filter.Search + "%"
-		query = query.Where(
-			"id LIKE ? OR host LIKE ? OR path LIKE ? OR model LIKE ? OR user_id IN (SELECT id FROM users WHERE email LIKE ? OR name LIKE ?)",
-			p, p, p, p, p, p,
-		)
-	}
-	if filter.UserID != nil {
-		query = query.Where("user_id = ?", *filter.UserID)
-	}
-	if filter.SessionID != nil {
-		query = query.Where("session_id = ?", *filter.SessionID)
-	}
-	if filter.Decision != nil {
-		query = query.Where("decision = ?", *filter.Decision)
-	}
-	if filter.PathPrefix != nil {
-		query = query.Where("path LIKE ?", *filter.PathPrefix+"%")
-	}
-	if len(filter.ProviderIDs) > 0 {
-		query = query.Where("resolved_provider_id IN ?", filter.ProviderIDs)
-	}
-	if len(filter.Models) > 0 {
-		query = query.Where("model IN ?", filter.Models)
-	}
-	if len(filter.GroupIDs) > 0 {
-		query = query.Where(
-			"id IN (SELECT log_id FROM agent_network_access_log_group WHERE group_id IN ?)",
-			filter.GroupIDs,
-		)
-	}
-	if filter.StartDate != nil {
-		query = query.Where("timestamp >= ?", *filter.StartDate)
-	}
-	if filter.EndDate != nil {
-		query = query.Where("timestamp <= ?", *filter.EndDate)
-	}
-	return query
-}
-
-// hydrateAgentNetworkAccessLogGroups loads the authorising group ids for the
-// given page of entries and assigns them onto each entry's GroupIDs field.
-func (s *SqlStore) hydrateAgentNetworkAccessLogGroups(ctx context.Context, accountID string, logs []*agentNetworkTypes.AgentNetworkAccessLog) error {
-	if len(logs) == 0 {
-		return nil
-	}
-
-	ids := make([]string, 0, len(logs))
-	for _, l := range logs {
-		ids = append(ids, l.ID)
-	}
-
-	var rows []agentNetworkTypes.AgentNetworkAccessLogGroup
-	if err := s.db.
-		Where(accountIDCondition, accountID).
-		Where("log_id IN ?", ids).
-		Find(&rows).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to hydrate agent-network access log groups: %v", err)
-		return status.Errorf(status.Internal, "failed to hydrate agent-network access log groups")
-	}
-
-	byLog := make(map[string][]string, len(logs))
-	for _, r := range rows {
-		byLog[r.LogID] = append(byLog[r.LogID], r.GroupID)
-	}
-	for _, l := range logs {
-		l.GroupIDs = byLog[l.ID]
-	}
-	return nil
-}
-
-// agentNetworkSessionKeyExpr is the SQL group key for session-grouped access
-// logs: the row's session id, or — when the client sent none — the row id, so
-// session-less requests each form their own singleton group. COALESCE/NULLIF
-// are standard SQL, so this stays portable across SQLite and Postgres.
-const agentNetworkSessionKeyExpr = "COALESCE(NULLIF(session_id, ''), id)"
-
-// GetAgentNetworkAccessLogSessions retrieves agent-network access logs grouped
-// by session, with server-side pagination, filtering and sorting at the session
-// level. It paginates over the distinct session keys (ordered by the requested
-// session-level aggregate), fetches every entry for the page's sessions, and
-// folds them into per-session summaries. The returned count is the number of
-// matching sessions. Filters apply to the entries, so a session's summary
-// reflects only its filter-matching requests.
-func (s *SqlStore) GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLogSession, int64, error) {
-	// Count distinct sessions via a grouped subquery — portable and avoids
-	// relying on COUNT(DISTINCT <expr>) quoting quirks.
-	sessionsSubquery := s.applyAgentNetworkAccessLogFilters(
-		s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).Where(accountIDCondition, accountID),
-		filter,
-	).
-		Select(agentNetworkSessionKeyExpr + " AS session_key").
-		Group(agentNetworkSessionKeyExpr)
-
-	var totalCount int64
-	if err := s.db.Table("(?) AS sessions", sessionsSubquery).Count(&totalCount).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to count agent-network access-log sessions: %v", err)
-		return nil, 0, status.Errorf(status.Internal, "failed to count agent-network access-log sessions")
-	}
-
-	// The page of session keys, ordered by the session-level aggregate. The
-	// session-key tiebreaker keeps pagination deterministic when the primary
-	// aggregate ties.
-	type sessionKeyRow struct {
-		SessionKey string
-	}
-	var keyRows []sessionKeyRow
-	keyQuery := s.applyAgentNetworkAccessLogFilters(
-		s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).Where(accountIDCondition, accountID),
-		filter,
-	).
-		Select(agentNetworkSessionKeyExpr + " AS session_key").
-		Group(agentNetworkSessionKeyExpr).
-		Order(filter.GetSessionSortExpr() + " " + filter.GetSortOrder()).
-		Order("session_key ASC").
-		Limit(filter.GetLimit()).
-		Offset(filter.GetOffset())
-	if err := keyQuery.Scan(&keyRows).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to list agent-network access-log session keys: %v", err)
-		return nil, 0, status.Errorf(status.Internal, "failed to list agent-network access-log session keys")
-	}
-	if len(keyRows) == 0 {
-		return nil, totalCount, nil
-	}
-
-	keys := make([]string, 0, len(keyRows))
-	for _, r := range keyRows {
-		keys = append(keys, r.SessionKey)
-	}
-
-	// All entries for the page's sessions, contiguous per session and oldest
-	// first within each — the fold relies on that ordering.
-	var entries []*agentNetworkTypes.AgentNetworkAccessLog
-	entriesQuery := s.applyAgentNetworkAccessLogFilters(
-		s.db.Where(accountIDCondition, accountID),
-		filter,
-	).
-		Where(agentNetworkSessionKeyExpr+" IN ?", keys).
-		Order(agentNetworkSessionKeyExpr + ", timestamp ASC")
-
-	if lockStrength != LockingStrengthNone {
-		entriesQuery = entriesQuery.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	if err := entriesQuery.Find(&entries).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to get agent-network access-log session entries: %v", err)
-		return nil, 0, status.Errorf(status.Internal, "failed to get agent-network access-log session entries")
-	}
-
-	if err := s.hydrateAgentNetworkAccessLogGroups(ctx, accountID, entries); err != nil {
-		return nil, 0, err
-	}
-
-	return agentNetworkTypes.FoldAccessLogSessions(keys, entries), totalCount, nil
-}
-
-// GetAccountAccessLogs retrieves access logs for a given account with pagination and filtering
-func (s *SqlStore) GetAccountAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error) {
-	var logs []*accesslogs.AccessLogEntry
-	var totalCount int64
-
-	baseQuery := s.db.
-		Model(&accesslogs.AccessLogEntry{}).
-		Where(accountIDCondition, accountID)
-
-	baseQuery = s.applyAccessLogFilters(baseQuery, filter)
-
-	if err := baseQuery.Count(&totalCount).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to count access logs: %v", err)
-		return nil, 0, status.Errorf(status.Internal, "failed to count access logs")
-	}
-
-	query := s.db.
-		Where(accountIDCondition, accountID)
-
-	query = s.applyAccessLogFilters(query, filter)
-
-	sortColumns := filter.GetSortColumn()
-	sortOrder := strings.ToUpper(filter.GetSortOrder())
-
-	var orderClauses []string
-	for _, col := range strings.Split(sortColumns, ",") {
-		col = strings.TrimSpace(col)
-		if col != "" {
-			orderClauses = append(orderClauses, col+" "+sortOrder)
-		}
-	}
-	orderClause := strings.Join(orderClauses, ", ")
-
-	query = query.
-		Order(orderClause).
-		Limit(filter.GetLimit()).
-		Offset(filter.GetOffset())
-
-	if lockStrength != LockingStrengthNone {
-		query = query.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	result := query.Find(&logs)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get access logs from store: %v", result.Error)
-		return nil, 0, status.Errorf(status.Internal, "failed to get access logs from store")
-	}
-
-	return logs, totalCount, nil
-}
-
-// DeleteOldAccessLogs deletes all access logs older than the specified time
-func (s *SqlStore) DeleteOldAccessLogs(ctx context.Context, olderThan time.Time) (int64, error) {
-	result := s.db.
-		Where("timestamp < ?", olderThan).
-		Delete(&accesslogs.AccessLogEntry{})
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete old access logs: %v", result.Error)
-		return 0, status.Errorf(status.Internal, "failed to delete old access logs")
-	}
-
-	return result.RowsAffected, nil
-}
-
-// applyAccessLogFilters applies filter conditions to the query
-func (s *SqlStore) applyAccessLogFilters(query *gorm.DB, filter accesslogs.AccessLogFilter) *gorm.DB {
-	if filter.Search != nil {
-		searchPattern := "%" + *filter.Search + "%"
-		query = query.Where(
-			"id LIKE ? OR location_connection_ip LIKE ? OR host LIKE ? OR path LIKE ? OR CONCAT(host, path) LIKE ? OR user_id IN (SELECT id FROM users WHERE email LIKE ? OR name LIKE ?)",
-			searchPattern, searchPattern, searchPattern, searchPattern, searchPattern, searchPattern, searchPattern,
-		)
-	}
-
-	if filter.SourceIP != nil {
-		query = query.Where("location_connection_ip = ?", *filter.SourceIP)
-	}
-
-	if filter.Host != nil {
-		query = query.Where("host = ?", *filter.Host)
-	}
-
-	if filter.Path != nil {
-		// Support LIKE pattern for path filtering
-		query = query.Where("path LIKE ?", "%"+*filter.Path+"%")
-	}
-
-	if filter.UserID != nil {
-		query = query.Where("user_id = ?", *filter.UserID)
-	}
-
-	if filter.Method != nil {
-		query = query.Where("method = ?", *filter.Method)
-	}
-
-	if filter.Status != nil {
-		switch *filter.Status {
-		case "success":
-			query = query.Where("status_code >= ? AND status_code < ?", 200, 400)
-		case "failed":
-			query = query.Where("status_code < ? OR status_code >= ?", 200, 400)
-		}
-	}
-
-	if filter.StatusCode != nil {
-		query = query.Where("status_code = ?", *filter.StatusCode)
-	}
-
-	if filter.StartDate != nil {
-		query = query.Where("timestamp >= ?", *filter.StartDate)
-	}
-
-	if filter.EndDate != nil {
-		query = query.Where("timestamp <= ?", *filter.EndDate)
-	}
-
-	return query
-}
-
-func (s *SqlStore) GetServiceTargetByTargetID(ctx context.Context, lockStrength LockingStrength, accountID string, targetID string) (*rpservice.Target, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var target *rpservice.Target
-	result := tx.Take(&target, "account_id = ? AND target_id = ?", accountID, targetID)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "service target with ID %s not found", targetID)
-		}
-
-		log.WithContext(ctx).Errorf("failed to get service target from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get service target from store")
-	}
-
-	return target, nil
-}
-
-// SaveProxy saves or updates a proxy in the database
-func (s *SqlStore) SaveProxy(ctx context.Context, p *proxy.Proxy) error {
-	result := s.db.Save(p)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to save proxy: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to save proxy")
-	}
-	return nil
-}
-
-// DisconnectProxy marks a proxy as disconnected only if the session ID matches.
-// This prevents a slow-to-close old session from overwriting a newer reconnection.
-func (s *SqlStore) DisconnectProxy(ctx context.Context, proxyID, sessionID string) error {
-	now := time.Now()
-	result := s.db.
-		Model(&proxy.Proxy{}).
-		Where("id = ? AND session_id = ?", proxyID, sessionID).
-		Updates(map[string]any{
-			"status":          proxy.StatusDisconnected,
-			"disconnected_at": now,
-			"last_seen":       now,
-		})
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to disconnect proxy %s session %s: %v", proxyID, sessionID, result.Error)
-		return status.Errorf(status.Internal, "failed to disconnect proxy")
-	}
-	if result.RowsAffected == 0 {
-		log.WithContext(ctx).Debugf("proxy %s session %s: no row updated (superseded by newer session)", proxyID, sessionID)
-	}
-	return nil
-}
-
-// UpdateProxyHeartbeat updates the last_seen timestamp for the proxy's current session.
-func (s *SqlStore) UpdateProxyHeartbeat(ctx context.Context, p *proxy.Proxy) error {
-	now := time.Now()
-
-	result := s.db.
-		Model(&proxy.Proxy{}).
-		Where("id = ? AND session_id = ?", p.ID, p.SessionID).
-		Update("last_seen", now)
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to update proxy heartbeat: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to update proxy heartbeat")
-	}
-
-	if result.RowsAffected == 0 {
-		p.LastSeen = now
-		p.ConnectedAt = &now
-		p.Status = proxy.StatusConnected
-		if err := s.db.Create(p).Error; err != nil {
-			log.WithContext(ctx).Debugf("proxy %s session %s: heartbeat fallback insert skipped: %v", p.ID, p.SessionID, err)
-		}
-	}
-
-	return nil
-}
-
-// GetActiveProxyClusterAddresses returns the unique cluster addresses of active
-// shared proxies (those without an account scope). BYOP cluster addresses are
-// excluded; use GetActiveProxyClusterAddressesForAccount to retrieve them.
-func (s *SqlStore) GetActiveProxyClusterAddresses(ctx context.Context) ([]string, error) {
-	var addresses []string
-
-	result := s.db.
-		Model(&proxy.Proxy{}).
-		Where("account_id IS NULL AND status = ? AND last_seen > ?", proxy.StatusConnected, time.Now().Add(-proxyActiveThreshold)).
-		Distinct("cluster_address").
-		Pluck("cluster_address", &addresses)
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get active proxy cluster addresses: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get active proxy cluster addresses")
-	}
-
-	return addresses, nil
-}
-
-func (s *SqlStore) GetActiveProxyClusterAddressesForAccount(ctx context.Context, accountID string) ([]string, error) {
-	var addresses []string
-
-	result := s.db.
-		Model(&proxy.Proxy{}).
-		Where("account_id = ? AND status = ? AND last_seen > ?", accountID, proxy.StatusConnected, time.Now().Add(-proxyActiveThreshold)).
-		Distinct("cluster_address").
-		Pluck("cluster_address", &addresses)
-
-	if result.Error != nil {
-		return nil, status.Errorf(status.Internal, "failed to get active proxy cluster addresses for account")
-	}
-
-	return addresses, nil
-}
-
-func (s *SqlStore) GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error) {
-	var p proxy.Proxy
-	result := s.db.Where("account_id = ?", accountID).Take(&p)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "proxy not found for account")
-		}
-		return nil, status.Errorf(status.Internal, "get proxy by account ID: %v", result.Error)
-	}
-	return &p, nil
-}
-
-func (s *SqlStore) CountProxiesByAccountID(ctx context.Context, accountID string) (int64, error) {
-	var count int64
-	result := s.db.Model(&proxy.Proxy{}).Where("account_id = ?", accountID).Count(&count)
-	if result.Error != nil {
-		return 0, status.Errorf(status.Internal, "count proxies by account ID: %v", result.Error)
-	}
-	return count, nil
-}
-
-func (s *SqlStore) IsClusterAddressConflicting(ctx context.Context, clusterAddress, accountID string) (bool, error) {
-	var count int64
-	result := s.db.
-		Model(&proxy.Proxy{}).
-		Where("cluster_address = ? AND (account_id IS NULL OR account_id != ?)", clusterAddress, accountID).
-		Count(&count)
-	if result.Error != nil {
-		return false, status.Errorf(status.Internal, "check cluster address conflict: %v", result.Error)
-	}
-	return count > 0, nil
-}
-
-func (s *SqlStore) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
-	result := s.db.
-		Where("cluster_address = ? AND account_id = ?", clusterAddress, accountID).
-		Delete(&proxy.Proxy{})
-	if result.Error != nil {
-		return status.Errorf(status.Internal, "delete account cluster: %v", result.Error)
-	}
-	if result.RowsAffected == 0 {
-		return status.Errorf(status.NotFound, "cluster not found")
-	}
-	return nil
-}
-
-// GetProxyClusters returns every cluster the account can see (shared
-// plus its own BYOP), regardless of whether any proxy in the cluster
-// is currently heartbeating. Online and ConnectedProxies are derived
-// from the 2-min active window so the dashboard can render offline
-// clusters distinctly; the 1-hour heartbeat reaper still removes rows
-// that go quiet for too long.
-//
-// AccountOwned is determined by whether any proxy row in the group
-// carries a non-NULL account_id; the caller maps that to Cluster.Type.
-// Capability flags are NOT filled here — the handler enriches them via
-// the per-cluster capability lookups.
-func (s *SqlStore) GetProxyClusters(ctx context.Context, accountID string) ([]proxy.Cluster, error) {
-	activeCutoff := time.Now().Add(-proxyActiveThreshold)
-
-	type clusterRow struct {
-		ID               string
-		Address          string
-		ConnectedProxies int
-		Online           bool
-		AccountOwned     bool
-	}
-
-	var rows []clusterRow
-	result := s.db.Model(&proxy.Proxy{}).
-		Select(
-			"MIN(id) AS id, "+
-				"cluster_address AS address, "+
-				// COUNT(CASE WHEN ... THEN 1 END) counts only non-NULL — i.e. only
-				// rows that satisfy the predicate — so it works portably across
-				// sqlite/postgres/mysql without dialect-specific FILTER syntax.
-				"COUNT(CASE WHEN status = ? AND last_seen > ? THEN 1 END) AS connected_proxies, "+
-				// MAX(CASE …) > 0 expresses BOOL_OR in a way Postgres tolerates
-				// (Postgres can't MAX a boolean column).
-				"MAX(CASE WHEN status = ? AND last_seen > ? THEN 1 ELSE 0 END) > 0 AS online, "+
-				"MAX(CASE WHEN account_id IS NOT NULL THEN 1 ELSE 0 END) > 0 AS account_owned",
-			proxy.StatusConnected, activeCutoff,
-			proxy.StatusConnected, activeCutoff,
-		).
-		Where("account_id IS NULL OR account_id = ?", accountID).
-		Group("cluster_address").
-		Scan(&rows)
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy clusters: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "get proxy clusters")
-	}
-
-	clusters := make([]proxy.Cluster, 0, len(rows))
-	for _, r := range rows {
-		c := proxy.Cluster{
-			ID:               r.ID,
-			Address:          r.Address,
-			Online:           r.Online,
-			ConnectedProxies: r.ConnectedProxies,
-		}
-		if r.AccountOwned {
-			c.Type = proxy.ClusterTypeAccount
-		} else {
-			c.Type = proxy.ClusterTypeShared
-		}
-		clusters = append(clusters, c)
-	}
-
-	return clusters, nil
-}
-
-// proxyActiveThreshold is the maximum age of a heartbeat for a proxy to be
-// considered active. Must be at least 2x the heartbeat interval (1 min).
-const proxyActiveThreshold = 2 * time.Minute
-
-var validCapabilityColumns = map[string]struct{}{
-	"supports_custom_ports": {},
-	"require_subdomain":     {},
-	"supports_crowdsec":     {},
-	"private":               {},
-}
-
-// GetClusterSupportsCustomPorts returns whether any active proxy in the cluster
-// supports custom ports. Returns nil when no proxy reported the capability.
-func (s *SqlStore) GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
-	return s.getClusterCapability(ctx, clusterAddr, "supports_custom_ports")
-}
-
-// GetClusterRequireSubdomain returns whether any active proxy in the cluster
-// requires a subdomain. Returns nil when no proxy reported the capability.
-func (s *SqlStore) GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool {
-	return s.getClusterCapability(ctx, clusterAddr, "require_subdomain")
-}
-
-// GetClusterSupportsPrivate reports whether any active proxy in the cluster
-// has the private capability (nil = unreported).
-func (s *SqlStore) GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
-	return s.getClusterCapability(ctx, clusterAddr, "private")
-}
-
-// GetClusterSupportsCrowdSec returns whether all active proxies in the cluster
-// have CrowdSec configured. Returns nil when no proxy reported the capability.
-// Unlike other capabilities that use ANY-true (for rolling upgrades), CrowdSec
-// requires unanimous support: a single unconfigured proxy would let requests
-// bypass reputation checks.
-func (s *SqlStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
-	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_crowdsec")
-}
-
-// getClusterUnanimousCapability returns an aggregated boolean capability
-// requiring all active proxies in the cluster to report true.
-func (s *SqlStore) getClusterUnanimousCapability(ctx context.Context, clusterAddr, column string) *bool {
-	if _, ok := validCapabilityColumns[column]; !ok {
-		log.WithContext(ctx).Errorf("invalid capability column: %s", column)
-		return nil
-	}
-
-	var result struct {
-		Total    int64
-		Reported int64
-		AllTrue  bool
-	}
-
-	// All active proxies must have reported the capability (no NULLs) and all
-	// must report true. A single unreported or false proxy means the cluster
-	// does not unanimously support the capability.
-	err := s.db.WithContext(ctx).
-		Model(&proxy.Proxy{}).
-		Select("COUNT(*) AS total, "+
-			"COUNT(CASE WHEN "+column+" IS NOT NULL THEN 1 END) AS reported, "+
-			"COUNT(*) > 0 AND COUNT(*) = COUNT(CASE WHEN "+column+" = true THEN 1 END) AS all_true").
-		Where("cluster_address = ? AND status = ? AND last_seen > ?",
-			clusterAddr, "connected", time.Now().Add(-proxyActiveThreshold)).
-		Scan(&result).Error
-	if err != nil {
-		log.WithContext(ctx).Errorf("query cluster capability %s for %s: %v", column, clusterAddr, err)
-		return nil
-	}
-
-	if result.Total == 0 || result.Reported == 0 {
-		return nil
-	}
-
-	// If any proxy has not reported (NULL), we can't confirm unanimous support.
-	if result.Reported < result.Total {
-		v := false
-		return &v
-	}
-
-	return &result.AllTrue
-}
-
-// getClusterCapability returns an aggregated boolean capability for the given
-// cluster. It checks active (connected, recently seen) proxies and returns:
-//   - *true if any proxy in the cluster has the capability set to true,
-//   - *false if at least one proxy reported but none set it to true,
-//   - nil if no proxy reported the capability at all.
-func (s *SqlStore) getClusterCapability(ctx context.Context, clusterAddr, column string) *bool {
-	if _, ok := validCapabilityColumns[column]; !ok {
-		log.WithContext(ctx).Errorf("invalid capability column: %s", column)
-		return nil
-	}
-
-	var result struct {
-		HasCapability bool
-		AnyTrue       bool
-	}
-
-	err := s.db.
-		WithContext(ctx).
-		Model(&proxy.Proxy{}).
-		Select("COUNT(CASE WHEN "+column+" IS NOT NULL THEN 1 END) > 0 AS has_capability, "+
-			"COALESCE(MAX(CASE WHEN "+column+" = true THEN 1 ELSE 0 END), 0) = 1 AS any_true").
-		Where("cluster_address = ? AND status = ? AND last_seen > ?",
-			clusterAddr, "connected", time.Now().Add(-proxyActiveThreshold)).
-		Scan(&result).Error
-	if err != nil {
-		log.WithContext(ctx).Errorf("query cluster capability %s for %s: %v", column, clusterAddr, err)
-		return nil
-	}
-
-	if !result.HasCapability {
-		return nil
-	}
-
-	return &result.AnyTrue
-}
-
-// CleanupStaleProxies deletes proxies that haven't sent heartbeat in the specified duration
-func (s *SqlStore) CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error {
-	cutoffTime := time.Now().Add(-inactivityDuration)
-
-	result := s.db.
-		Where("last_seen < ?", cutoffTime).
-		Delete(&proxy.Proxy{})
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to cleanup stale proxies: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to cleanup stale proxies")
-	}
-
-	if result.RowsAffected > 0 {
-		log.WithContext(ctx).Infof("Cleaned up %d stale proxies", result.RowsAffected)
-	}
-
-	return nil
-}
-
-// GetRoutingPeerNetworks returns the distinct network names where the peer is assigned as a routing peer
-// in an enabled network router, either directly or via peer groups.
-func (s *SqlStore) GetRoutingPeerNetworks(_ context.Context, accountID, peerID string) ([]string, error) {
-	var routers []*routerTypes.NetworkRouter
-	if err := s.db.Select("peer, peer_groups, network_id").Where("account_id = ? AND enabled = true", accountID).Find(&routers).Error; err != nil {
-		return nil, status.Errorf(status.Internal, "failed to get enabled routers: %v", err)
-	}
-
-	if len(routers) == 0 {
-		return nil, nil
-	}
-
-	var groupPeers []types.GroupPeer
-	if err := s.db.Select("group_id").Where("account_id = ? AND peer_id = ?", accountID, peerID).Find(&groupPeers).Error; err != nil {
-		return nil, status.Errorf(status.Internal, "failed to get peer group memberships: %v", err)
-	}
-
-	groupSet := make(map[string]struct{}, len(groupPeers))
-	for _, gp := range groupPeers {
-		groupSet[gp.GroupID] = struct{}{}
-	}
-
-	networkIDs := make(map[string]struct{})
-	for _, r := range routers {
-		if r.Peer == peerID {
-			networkIDs[r.NetworkID] = struct{}{}
-		} else if r.Peer == "" {
-			for _, pg := range r.PeerGroups {
-				if _, ok := groupSet[pg]; ok {
-					networkIDs[r.NetworkID] = struct{}{}
-					break
-				}
-			}
-		}
-	}
-
-	if len(networkIDs) == 0 {
-		return nil, nil
-	}
-
-	ids := make([]string, 0, len(networkIDs))
-	for id := range networkIDs {
-		ids = append(ids, id)
-	}
-
-	var networks []*networkTypes.Network
-	if err := s.db.Select("name").Where("account_id = ? AND id IN ?", accountID, ids).Find(&networks).Error; err != nil {
-		return nil, status.Errorf(status.Internal, "failed to get networks: %v", err)
-	}
-
-	names := make([]string, 0, len(networks))
-	for _, n := range networks {
-		names = append(names, n.Name)
-	}
-
-	return names, nil
-}
diff --git a/management/server/store/sql_store_account.go b/management/server/store/sql_store_account.go
new file mode 100644
index 000000000..3780de77d
--- /dev/null
+++ b/management/server/store/sql_store_account.go
@@ -0,0 +1,1182 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"runtime/debug"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// Deprecated: Full
+// account operations are no longer supported
+func (s *SqlStore) SaveAccount(ctx context.Context, account *types.Account) error {
+	start := time.Now()
+	defer func() {
+		elapsed := time.Since(start)
+		if elapsed > 1*time.Second {
+			log.WithContext(ctx).Tracef("SaveAccount for account %s exceeded 1s, took: %v", account.Id, elapsed)
+		}
+	}()
+
+	// todo: remove this check after the issue is resolved
+	s.checkAccountDomainBeforeSave(ctx, account.Id, account.Domain)
+
+	generateAccountSQLTypes(account)
+
+	// Encrypt sensitive user data before saving
+	for i := range account.UsersG {
+		if err := account.UsersG[i].EncryptSensitiveData(s.fieldEncrypt); err != nil {
+			return fmt.Errorf("encrypt user: %w", err)
+		}
+	}
+
+	for _, group := range account.GroupsG {
+		group.StoreGroupPeers()
+	}
+
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
+		result := tx.Select(clause.Associations).Delete(account.Policies, "account_id = ?", account.Id)
+		if result.Error != nil {
+			return result.Error
+		}
+
+		result = tx.Select(clause.Associations).Delete(account.UsersG, "account_id = ?", account.Id)
+		if result.Error != nil {
+			return result.Error
+		}
+
+		result = tx.Select(clause.Associations).Delete(account)
+		if result.Error != nil {
+			return result.Error
+		}
+
+		result = tx.
+			Session(&gorm.Session{FullSaveAssociations: true}).
+			Clauses(clause.OnConflict{UpdateAll: true}).
+			Create(account)
+		if result.Error != nil {
+			return result.Error
+		}
+		return nil
+	})
+
+	took := time.Since(start)
+	if s.metrics != nil {
+		s.metrics.StoreMetrics().CountPersistenceDuration(took)
+	}
+	log.WithContext(ctx).Debugf("took %d ms to persist an account to the store", took.Milliseconds())
+
+	return err
+}
+
+// generateAccountSQLTypes generates the GORM compatible types for the account
+func generateAccountSQLTypes(account *types.Account) {
+	for _, key := range account.SetupKeys {
+		account.SetupKeysG = append(account.SetupKeysG, *key)
+	}
+
+	if len(account.SetupKeys) != len(account.SetupKeysG) {
+		log.Warnf("SetupKeysG length mismatch for account %s", account.Id)
+	}
+
+	for id, peer := range account.Peers {
+		peer.ID = id
+		account.PeersG = append(account.PeersG, *peer)
+	}
+
+	for id, user := range account.Users {
+		user.Id = id
+		for id, pat := range user.PATs {
+			pat.ID = id
+			user.PATsG = append(user.PATsG, *pat)
+		}
+		account.UsersG = append(account.UsersG, *user)
+	}
+
+	for id, group := range account.Groups {
+		group.ID = id
+		group.AccountID = account.Id
+		account.GroupsG = append(account.GroupsG, group)
+	}
+
+	for id, route := range account.Routes {
+		route.ID = id
+		account.RoutesG = append(account.RoutesG, *route)
+	}
+
+	for id, ns := range account.NameServerGroups {
+		ns.ID = id
+		account.NameServerGroupsG = append(account.NameServerGroupsG, *ns)
+	}
+}
+
+// checkAccountDomainBeforeSave temporary method to troubleshoot an issue with domains getting blank
+func (s *SqlStore) checkAccountDomainBeforeSave(ctx context.Context, accountID, newDomain string) {
+	var acc types.Account
+	var domain string
+	result := s.db.Model(&acc).Select("domain").Where(idQueryCondition, accountID).Take(&domain)
+	if result.Error != nil {
+		if !errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			log.WithContext(ctx).Errorf("error when getting account %s from the store to check domain: %s", accountID, result.Error)
+		}
+		return
+	}
+	if domain != "" && newDomain == "" {
+		log.WithContext(ctx).Warnf("saving an account with empty domain when there was a domain set. Previous domain %s, Account ID: %s, Trace: %s", domain, accountID, debug.Stack())
+	}
+}
+
+func (s *SqlStore) DeleteAccount(ctx context.Context, account *types.Account) error {
+	start := time.Now()
+
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
+		result := tx.Select(clause.Associations).Delete(account.Policies, "account_id = ?", account.Id)
+		if result.Error != nil {
+			return result.Error
+		}
+
+		result = tx.Select(clause.Associations).Delete(account.UsersG, "account_id = ?", account.Id)
+		if result.Error != nil {
+			return result.Error
+		}
+
+		result = tx.Select(clause.Associations).Delete(account.Services, "account_id = ?", account.Id)
+		if result.Error != nil {
+			return result.Error
+		}
+
+		if err := deleteAgentNetworkAccountConfig(tx, account.Id); err != nil {
+			return err
+		}
+
+		result = tx.Select(clause.Associations).Delete(account)
+		if result.Error != nil {
+			return result.Error
+		}
+
+		return nil
+	})
+
+	took := time.Since(start)
+	if s.metrics != nil {
+		s.metrics.StoreMetrics().CountPersistenceDuration(took)
+	}
+	log.WithContext(ctx).Tracef("took %d ms to delete an account to the store", took.Milliseconds())
+
+	return err
+}
+
+// deleteAgentNetworkAccountConfig removes the account's agent network configuration. These
+// tables are not account associations, so deleting the account does not reach them. The
+// settings row holds the account's globally unique gateway domain and the provider rows
+// hold its upstream API keys. Tables that grow with traffic are left out: consumption
+// counters and access logs are swept in the background, and usage records are kept.
+func deleteAgentNetworkAccountConfig(tx *gorm.DB, accountID string) error {
+	// Dependents first: policies point at providers and guardrails, and settings
+	// go last, as DeleteSettings refuses while providers exist.
+	models := []any{
+		&agentNetworkTypes.Policy{},
+		&agentNetworkTypes.Provider{},
+		&agentNetworkTypes.Guardrail{},
+		&agentNetworkTypes.AccountBudgetRule{},
+		&agentNetworkTypes.Settings{},
+	}
+	for _, model := range models {
+		if err := tx.Delete(model, "account_id = ?", accountID).Error; err != nil {
+			return fmt.Errorf("delete %T rows: %w", model, err)
+		}
+	}
+	return nil
+}
+
+func (s *SqlStore) UpdateAccountDomainAttributes(ctx context.Context, accountID string, domain string, category string, isPrimaryDomain bool) error {
+	accountCopy := types.Account{
+		Domain:                 domain,
+		DomainCategory:         category,
+		IsDomainPrimaryAccount: isPrimaryDomain,
+	}
+
+	fieldsToUpdate := []string{"domain", "domain_category", "is_domain_primary_account"}
+	result := s.db.Model(&types.Account{}).
+		Select(fieldsToUpdate).
+		Where(idQueryCondition, accountID).
+		Updates(&accountCopy)
+	if result.Error != nil {
+		return status.Errorf(status.Internal, "failed to update account domain attributes to store: %v", result.Error)
+	}
+
+	if result.RowsAffected == 0 {
+		return status.Errorf(status.NotFound, "account %s", accountID)
+	}
+
+	return nil
+}
+
+func (s *SqlStore) GetAccountByPrivateDomain(ctx context.Context, domain string) (*types.Account, error) {
+	accountID, err := s.GetAccountIDByPrivateDomain(ctx, LockingStrengthNone, domain)
+	if err != nil {
+		return nil, err
+	}
+
+	// TODO:  rework to not call GetAccount
+	return s.GetAccount(ctx, accountID)
+}
+
+func (s *SqlStore) GetAccountIDByPrivateDomain(ctx context.Context, lockStrength LockingStrength, domain string) (string, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var accountID string
+	result := tx.Model(&types.Account{}).Select("id").
+		Where("domain = ? and is_domain_primary_account = ? and domain_category = ?",
+			strings.ToLower(domain), true, types.PrivateCategory,
+		).Take(&accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return "", status.Errorf(status.NotFound, "account not found: provided domain is not registered or is not private")
+		}
+		log.WithContext(ctx).Errorf("error when getting account from the store: %s", result.Error)
+		return "", status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	return accountID, nil
+}
+
+func (s *SqlStore) GetAccountsCounter(ctx context.Context) (int64, error) {
+	var count int64
+	result := s.db.Model(&types.Account{}).Count(&count)
+	if result.Error != nil {
+		return 0, fmt.Errorf("failed to get all accounts counter: %w", result.Error)
+	}
+
+	return count, nil
+}
+
+func (s *SqlStore) GetAllAccounts(ctx context.Context) (all []*types.Account) {
+	var accounts []types.Account
+	result := s.db.Find(&accounts)
+	if result.Error != nil {
+		return all
+	}
+
+	for _, account := range accounts {
+		if acc, err := s.GetAccount(ctx, account.Id); err == nil {
+			all = append(all, acc)
+		}
+	}
+
+	return all
+}
+
+func (s *SqlStore) GetAccountMeta(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.AccountMeta, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var accountMeta types.AccountMeta
+	result := tx.Model(&types.Account{}).
+		Take(&accountMeta, idQueryCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("error when getting account meta %s from the store: %s", accountID, result.Error)
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewAccountNotFoundError(accountID)
+		}
+		return nil, status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	return &accountMeta, nil
+}
+
+func (s *SqlStore) GetAccount(ctx context.Context, accountID string) (*types.Account, error) {
+	if s.pgxPool() != nil {
+		return s.getAccountPgx(ctx, accountID)
+	}
+	return s.getAccountGorm(ctx, accountID)
+}
+
+func (s *SqlStore) getAccountGorm(ctx context.Context, accountID string) (*types.Account, error) {
+	start := time.Now()
+	defer func() {
+		elapsed := time.Since(start)
+		if elapsed > 1*time.Second {
+			log.WithContext(ctx).Tracef("GetAccount for account %s exceeded 1s, took: %v", accountID, elapsed)
+		}
+	}()
+
+	var account types.Account
+	result := s.db.Model(&account).
+		Preload("UsersG.PATsG"). // have to be specified as this is nested reference
+		Preload("Policies.Rules").
+		Preload("SetupKeysG").
+		Preload("PeersG").
+		Preload("UsersG").
+		Preload("GroupsG.GroupPeers").
+		Preload("RoutesG").
+		Preload("NameServerGroupsG").
+		Preload("PostureChecks").
+		Preload("Networks").
+		Preload("NetworkRouters").
+		Preload("NetworkResources").
+		Preload("Onboarding").
+		Preload("Services.Targets").
+		Preload("Domains").
+		Take(&account, idQueryCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("error when getting account %s from the store: %s", accountID, result.Error)
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewAccountNotFoundError(accountID)
+		}
+		return nil, status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	account.SetupKeys = make(map[string]*types.SetupKey, len(account.SetupKeysG))
+	for _, key := range account.SetupKeysG {
+		if key.UpdatedAt.IsZero() {
+			key.UpdatedAt = key.CreatedAt
+		}
+		if key.AutoGroups == nil {
+			key.AutoGroups = []string{}
+		}
+		account.SetupKeys[key.Key] = &key
+	}
+	account.SetupKeysG = nil
+
+	account.Peers = make(map[string]*nbpeer.Peer, len(account.PeersG))
+	for _, peer := range account.PeersG {
+		account.Peers[peer.ID] = &peer
+	}
+	account.PeersG = nil
+	account.Users = make(map[string]*types.User, len(account.UsersG))
+	for _, user := range account.UsersG {
+		user.PATs = make(map[string]*types.PersonalAccessToken, len(user.PATs))
+		for _, pat := range user.PATsG {
+			pat.UserID = ""
+			user.PATs[pat.ID] = &pat
+		}
+		if user.AutoGroups == nil {
+			user.AutoGroups = []string{}
+		}
+		if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+			return nil, fmt.Errorf("decrypt user: %w", err)
+		}
+		account.Users[user.Id] = &user
+		user.PATsG = nil
+	}
+	account.UsersG = nil
+	account.Groups = make(map[string]*types.Group, len(account.GroupsG))
+	for _, group := range account.GroupsG {
+		group.Peers = make([]string, len(group.GroupPeers))
+		for i, gp := range group.GroupPeers {
+			group.Peers[i] = gp.PeerID
+		}
+		if group.Resources == nil {
+			group.Resources = []types.Resource{}
+		}
+		account.Groups[group.ID] = group
+	}
+	account.GroupsG = nil
+
+	account.Routes = make(map[route.ID]*route.Route, len(account.RoutesG))
+	for _, route := range account.RoutesG {
+		account.Routes[route.ID] = &route
+	}
+	account.RoutesG = nil
+	account.NameServerGroups = make(map[string]*nbdns.NameServerGroup, len(account.NameServerGroupsG))
+	for _, ns := range account.NameServerGroupsG {
+		ns.AccountID = ""
+		if ns.NameServers == nil {
+			ns.NameServers = []nbdns.NameServer{}
+		}
+		if ns.Groups == nil {
+			ns.Groups = []string{}
+		}
+		if ns.Domains == nil {
+			ns.Domains = []string{}
+		}
+		account.NameServerGroups[ns.ID] = &ns
+	}
+	account.NameServerGroupsG = nil
+	return &account, nil
+}
+
+func (s *SqlStore) getAccountPgx(ctx context.Context, accountID string) (*types.Account, error) {
+	account, err := s.getAccount(ctx, accountID)
+	if err != nil {
+		return nil, err
+	}
+
+	var wg sync.WaitGroup
+	errChan := make(chan error, 16)
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		keys, err := s.getSetupKeys(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.SetupKeysG = keys
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		peers, err := s.getPeers(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.PeersG = peers
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		users, err := s.getUsers(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.UsersG = users
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		groups, err := s.getGroups(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.GroupsG = groups
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		policies, err := s.getPolicies(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.Policies = policies
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		routes, err := s.getRoutes(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.RoutesG = routes
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		nsgs, err := s.getNameServerGroups(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.NameServerGroupsG = nsgs
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		checks, err := s.getPostureChecks(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.PostureChecks = checks
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		services, err := s.getServices(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.Services = services
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		domains, err := s.ListCustomDomains(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.Domains = domains
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		networks, err := s.getNetworks(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.Networks = networks
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		routers, err := s.getNetworkRouters(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.NetworkRouters = routers
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		resources, err := s.getNetworkResources(ctx, accountID)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		account.NetworkResources = resources
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		err := s.getAccountOnboarding(ctx, accountID, account)
+		if err != nil {
+			errChan <- err
+			return
+		}
+	}()
+
+	wg.Wait()
+	close(errChan)
+	for e := range errChan {
+		if e != nil {
+			return nil, e
+		}
+	}
+
+	var userIDs []string
+	for _, u := range account.UsersG {
+		userIDs = append(userIDs, u.Id)
+	}
+	var policyIDs []string
+	for _, p := range account.Policies {
+		policyIDs = append(policyIDs, p.ID)
+	}
+	var groupIDs []string
+	for _, g := range account.GroupsG {
+		groupIDs = append(groupIDs, g.ID)
+	}
+
+	wg.Add(3)
+	errChan = make(chan error, 3)
+
+	var pats []types.PersonalAccessToken
+	go func() {
+		defer wg.Done()
+		var err error
+		pats, err = s.getPersonalAccessTokens(ctx, userIDs)
+		if err != nil {
+			errChan <- err
+		}
+	}()
+
+	var rules []*types.PolicyRule
+	go func() {
+		defer wg.Done()
+		var err error
+		rules, err = s.getPolicyRules(ctx, policyIDs)
+		if err != nil {
+			errChan <- err
+		}
+	}()
+
+	var groupPeers []types.GroupPeer
+	go func() {
+		defer wg.Done()
+		var err error
+		groupPeers, err = s.getGroupPeers(ctx, groupIDs)
+		if err != nil {
+			errChan <- err
+		}
+	}()
+
+	wg.Wait()
+	close(errChan)
+	for e := range errChan {
+		if e != nil {
+			return nil, e
+		}
+	}
+
+	patsByUserID := make(map[string][]*types.PersonalAccessToken)
+	for i := range pats {
+		pat := &pats[i]
+		patsByUserID[pat.UserID] = append(patsByUserID[pat.UserID], pat)
+		pat.UserID = ""
+	}
+
+	rulesByPolicyID := make(map[string][]*types.PolicyRule)
+	for _, rule := range rules {
+		rulesByPolicyID[rule.PolicyID] = append(rulesByPolicyID[rule.PolicyID], rule)
+	}
+
+	peersByGroupID := make(map[string][]string)
+	for _, gp := range groupPeers {
+		peersByGroupID[gp.GroupID] = append(peersByGroupID[gp.GroupID], gp.PeerID)
+	}
+
+	account.SetupKeys = make(map[string]*types.SetupKey, len(account.SetupKeysG))
+	for i := range account.SetupKeysG {
+		key := &account.SetupKeysG[i]
+		account.SetupKeys[key.Key] = key
+	}
+
+	account.Peers = make(map[string]*nbpeer.Peer, len(account.PeersG))
+	for i := range account.PeersG {
+		peer := &account.PeersG[i]
+		account.Peers[peer.ID] = peer
+	}
+
+	account.Users = make(map[string]*types.User, len(account.UsersG))
+	for i := range account.UsersG {
+		user := &account.UsersG[i]
+		if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+			return nil, fmt.Errorf("decrypt user: %w", err)
+		}
+		user.PATs = make(map[string]*types.PersonalAccessToken)
+		if userPats, ok := patsByUserID[user.Id]; ok {
+			for j := range userPats {
+				pat := userPats[j]
+				user.PATs[pat.ID] = pat
+			}
+		}
+		account.Users[user.Id] = user
+	}
+
+	for i := range account.Policies {
+		policy := account.Policies[i]
+		if policyRules, ok := rulesByPolicyID[policy.ID]; ok {
+			policy.Rules = policyRules
+		}
+	}
+
+	account.Groups = make(map[string]*types.Group, len(account.GroupsG))
+	for i := range account.GroupsG {
+		group := account.GroupsG[i]
+		if peerIDs, ok := peersByGroupID[group.ID]; ok {
+			group.Peers = peerIDs
+		}
+		account.Groups[group.ID] = group
+	}
+
+	account.Routes = make(map[route.ID]*route.Route, len(account.RoutesG))
+	for i := range account.RoutesG {
+		route := &account.RoutesG[i]
+		account.Routes[route.ID] = route
+	}
+
+	account.NameServerGroups = make(map[string]*nbdns.NameServerGroup, len(account.NameServerGroupsG))
+	for i := range account.NameServerGroupsG {
+		nsg := &account.NameServerGroupsG[i]
+		nsg.AccountID = ""
+		account.NameServerGroups[nsg.ID] = nsg
+	}
+
+	account.SetupKeysG = nil
+	account.PeersG = nil
+	account.UsersG = nil
+	account.GroupsG = nil
+	account.RoutesG = nil
+	account.NameServerGroupsG = nil
+
+	return account, nil
+}
+
+func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Account, error) {
+	var account types.Account
+	account.Network = &types.Network{}
+	const accountQuery = `
+		SELECT
+			id, created_by, created_at, domain, domain_category, is_domain_primary_account,
+			-- Embedded Network
+			network_identifier, network_net, network_net_v6, network_dns, network_serial,
+			-- Embedded DNSSettings
+			dns_settings_disabled_management_groups,
+			-- Embedded Settings
+			settings_peer_login_expiration_enabled, settings_peer_login_expiration,
+			settings_peer_inactivity_expiration_enabled, settings_peer_inactivity_expiration,
+			settings_regular_users_view_blocked, settings_groups_propagation_enabled,
+			settings_jwt_groups_enabled, settings_jwt_groups_claim_name, settings_jwt_allow_groups,
+			settings_routing_peer_dns_resolution_enabled, settings_dns_domain, settings_network_range,
+			settings_network_range_v6, settings_ipv6_enabled_groups, settings_lazy_connection_enabled,
+			settings_local_mfa_enabled, settings_metrics_push_enabled, settings_agent_network_only,
+			settings_peer_hostname_collision_rejected,
+			settings_dashboard_features, settings_auto_update_version, settings_auto_update_always,
+			settings_peer_expose_enabled, settings_peer_expose_groups,
+			-- Embedded ExtraSettings
+			settings_extra_peer_approval_enabled, settings_extra_user_approval_required,
+			settings_extra_integrated_validator, settings_extra_integrated_validator_groups
+		FROM accounts WHERE id = $1`
+
+	var (
+		sPeerLoginExpirationEnabled      sql.NullBool
+		sPeerLoginExpiration             sql.NullInt64
+		sPeerInactivityExpirationEnabled sql.NullBool
+		sPeerInactivityExpiration        sql.NullInt64
+		sRegularUsersViewBlocked         sql.NullBool
+		sGroupsPropagationEnabled        sql.NullBool
+		sJWTGroupsEnabled                sql.NullBool
+		sJWTGroupsClaimName              sql.NullString
+		sJWTAllowGroups                  sql.NullString
+		sRoutingPeerDNSResolutionEnabled sql.NullBool
+		sDNSDomain                       sql.NullString
+		sNetworkRange                    sql.NullString
+		sNetworkRangeV6                  sql.NullString
+		sIPv6EnabledGroups               sql.NullString
+		sLazyConnectionEnabled           sql.NullBool
+		sLocalMFAEnabled                 sql.NullBool
+		sMetricsPushEnabled              sql.NullBool
+		sPeerHostnameCollisionRejected   sql.NullBool
+		sAgentNetworkOnly                sql.NullBool
+		sDashboardFeatures               sql.NullString
+		autoUpdateVersion                sql.NullString
+		autoUpdateAlways                 sql.NullBool
+		peerExposeEnabled                sql.NullBool
+		peerExposeGroups                 sql.NullString
+		sExtraPeerApprovalEnabled        sql.NullBool
+		sExtraUserApprovalRequired       sql.NullBool
+		sExtraIntegratedValidator        sql.NullString
+		sExtraIntegratedValidatorGroups  sql.NullString
+		networkNet                       sql.NullString
+		networkNetV6                     sql.NullString
+		dnsSettingsDisabledGroups        sql.NullString
+		networkIdentifier                sql.NullString
+		networkDns                       sql.NullString
+		networkSerial                    sql.NullInt64
+		createdAt                        sql.NullTime
+	)
+	err := s.pgxPool().QueryRow(ctx, accountQuery, accountID).Scan(
+		&account.Id, &account.CreatedBy, &createdAt, &account.Domain, &account.DomainCategory, &account.IsDomainPrimaryAccount,
+		&networkIdentifier, &networkNet, &networkNetV6, &networkDns, &networkSerial,
+		&dnsSettingsDisabledGroups,
+		&sPeerLoginExpirationEnabled, &sPeerLoginExpiration,
+		&sPeerInactivityExpirationEnabled, &sPeerInactivityExpiration,
+		&sRegularUsersViewBlocked, &sGroupsPropagationEnabled,
+		&sJWTGroupsEnabled, &sJWTGroupsClaimName, &sJWTAllowGroups,
+		&sRoutingPeerDNSResolutionEnabled, &sDNSDomain, &sNetworkRange,
+		&sNetworkRangeV6, &sIPv6EnabledGroups, &sLazyConnectionEnabled,
+		&sLocalMFAEnabled, &sMetricsPushEnabled, &sAgentNetworkOnly,
+		&sPeerHostnameCollisionRejected,
+		&sDashboardFeatures, &autoUpdateVersion, &autoUpdateAlways,
+		&peerExposeEnabled, &peerExposeGroups,
+		&sExtraPeerApprovalEnabled, &sExtraUserApprovalRequired,
+		&sExtraIntegratedValidator, &sExtraIntegratedValidatorGroups,
+	)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, status.NewAccountNotFoundError(accountID)
+		}
+		return nil, status.NewGetAccountFromStoreError(err)
+	}
+
+	account.Settings = &types.Settings{Extra: &types.ExtraSettings{}}
+	if networkNet.Valid {
+		_ = json.Unmarshal([]byte(networkNet.String), &account.Network.Net)
+	}
+	if createdAt.Valid {
+		account.CreatedAt = createdAt.Time
+	}
+	if dnsSettingsDisabledGroups.Valid {
+		_ = json.Unmarshal([]byte(dnsSettingsDisabledGroups.String), &account.DNSSettings.DisabledManagementGroups)
+	}
+	if networkIdentifier.Valid {
+		account.Network.Identifier = networkIdentifier.String
+	}
+	if networkDns.Valid {
+		account.Network.Dns = networkDns.String
+	}
+	if networkSerial.Valid {
+		account.Network.Serial = uint64(networkSerial.Int64)
+	}
+	if sPeerLoginExpirationEnabled.Valid {
+		account.Settings.PeerLoginExpirationEnabled = sPeerLoginExpirationEnabled.Bool
+	}
+	if sPeerLoginExpiration.Valid {
+		account.Settings.PeerLoginExpiration = time.Duration(sPeerLoginExpiration.Int64)
+	}
+	if sPeerInactivityExpirationEnabled.Valid {
+		account.Settings.PeerInactivityExpirationEnabled = sPeerInactivityExpirationEnabled.Bool
+	}
+	if sPeerInactivityExpiration.Valid {
+		account.Settings.PeerInactivityExpiration = time.Duration(sPeerInactivityExpiration.Int64)
+	}
+	if sRegularUsersViewBlocked.Valid {
+		account.Settings.RegularUsersViewBlocked = sRegularUsersViewBlocked.Bool
+	}
+	if sGroupsPropagationEnabled.Valid {
+		account.Settings.GroupsPropagationEnabled = sGroupsPropagationEnabled.Bool
+	}
+	if sJWTGroupsEnabled.Valid {
+		account.Settings.JWTGroupsEnabled = sJWTGroupsEnabled.Bool
+	}
+	if sJWTGroupsClaimName.Valid {
+		account.Settings.JWTGroupsClaimName = sJWTGroupsClaimName.String
+	}
+	if sRoutingPeerDNSResolutionEnabled.Valid {
+		account.Settings.RoutingPeerDNSResolutionEnabled = sRoutingPeerDNSResolutionEnabled.Bool
+	}
+	if sDNSDomain.Valid {
+		account.Settings.DNSDomain = sDNSDomain.String
+	}
+	if sLazyConnectionEnabled.Valid {
+		account.Settings.LazyConnectionEnabled = sLazyConnectionEnabled.Bool
+	}
+	if sLocalMFAEnabled.Valid {
+		account.Settings.LocalMfaEnabled = sLocalMFAEnabled.Bool
+	}
+	if sMetricsPushEnabled.Valid {
+		account.Settings.MetricsPushEnabled = sMetricsPushEnabled.Bool
+	}
+	if sPeerHostnameCollisionRejected.Valid {
+		account.Settings.PeerHostnameCollisionRejected = sPeerHostnameCollisionRejected.Bool
+	}
+	if sAgentNetworkOnly.Valid {
+		account.Settings.AgentNetworkOnly = sAgentNetworkOnly.Bool
+	}
+	if sDashboardFeatures.Valid && sDashboardFeatures.String != "" {
+		if err := json.Unmarshal([]byte(sDashboardFeatures.String), &account.Settings.DashboardFeatures); err != nil {
+			log.WithContext(ctx).Warnf("failed to unmarshal dashboard features for account %s: %v", accountID, err)
+		}
+	}
+	if sJWTAllowGroups.Valid {
+		_ = json.Unmarshal([]byte(sJWTAllowGroups.String), &account.Settings.JWTAllowGroups)
+	}
+	if sNetworkRange.Valid {
+		_ = json.Unmarshal([]byte(sNetworkRange.String), &account.Settings.NetworkRange)
+	}
+	if networkNetV6.Valid {
+		_ = json.Unmarshal([]byte(networkNetV6.String), &account.Network.NetV6)
+	}
+	if sNetworkRangeV6.Valid {
+		_ = json.Unmarshal([]byte(sNetworkRangeV6.String), &account.Settings.NetworkRangeV6)
+	}
+	if sIPv6EnabledGroups.Valid {
+		_ = json.Unmarshal([]byte(sIPv6EnabledGroups.String), &account.Settings.IPv6EnabledGroups)
+	}
+	if autoUpdateAlways.Valid {
+		account.Settings.AutoUpdateAlways = autoUpdateAlways.Bool
+	}
+	if autoUpdateVersion.Valid {
+		account.Settings.AutoUpdateVersion = autoUpdateVersion.String
+	}
+	if peerExposeEnabled.Valid {
+		account.Settings.PeerExposeEnabled = peerExposeEnabled.Bool
+	}
+	if peerExposeGroups.Valid {
+		_ = json.Unmarshal([]byte(peerExposeGroups.String), &account.Settings.PeerExposeGroups)
+	}
+
+	if sExtraPeerApprovalEnabled.Valid {
+		account.Settings.Extra.PeerApprovalEnabled = sExtraPeerApprovalEnabled.Bool
+	}
+	if sExtraUserApprovalRequired.Valid {
+		account.Settings.Extra.UserApprovalRequired = sExtraUserApprovalRequired.Bool
+	}
+	if sExtraIntegratedValidator.Valid {
+		account.Settings.Extra.IntegratedValidator = sExtraIntegratedValidator.String
+	}
+	if sExtraIntegratedValidatorGroups.Valid {
+		_ = json.Unmarshal([]byte(sExtraIntegratedValidatorGroups.String), &account.Settings.Extra.IntegratedValidatorGroups)
+	}
+	return &account, nil
+}
+
+func (s *SqlStore) GetAnyAccountID(ctx context.Context) (string, error) {
+	var account types.Account
+	result := s.db.Select("id").Order("created_at desc").Limit(1).Find(&account)
+	if result.Error != nil {
+		return "", status.NewGetAccountFromStoreError(result.Error)
+	}
+	if result.RowsAffected == 0 {
+		return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
+	}
+
+	return account.Id, nil
+}
+
+func (s *SqlStore) GetAccountNetwork(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.Network, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var accountNetwork types.AccountNetwork
+	if err := tx.Model(&types.Account{}).Where(idQueryCondition, accountID).Take(&accountNetwork).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, status.NewAccountNotFoundError(accountID)
+		}
+		return nil, status.Errorf(status.Internal, "issue getting network from store: %s", err)
+	}
+	return accountNetwork.Network, nil
+}
+
+func (s *SqlStore) GetAccountSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.Settings, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var accountSettings types.AccountSettings
+	if err := tx.Model(&types.Account{}).Where(idQueryCondition, accountID).Take(&accountSettings).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "settings not found")
+		}
+		return nil, status.Errorf(status.Internal, "issue getting settings from store: %s", err)
+	}
+	return accountSettings.Settings, nil
+}
+
+func (s *SqlStore) GetAccountCreatedBy(ctx context.Context, lockStrength LockingStrength, accountID string) (string, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var createdBy string
+	result := tx.Model(&types.Account{}).
+		Select("created_by").Take(&createdBy, idQueryCondition, accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return "", status.NewAccountNotFoundError(accountID)
+		}
+		return "", status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	return createdBy, nil
+}
+
+func (s *SqlStore) IncrementNetworkSerial(ctx context.Context, accountId string) error {
+	result := s.db.Model(&types.Account{}).Where(idQueryCondition, accountId).Update("network_serial", gorm.Expr("network_serial + 1"))
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to increment network serial count in store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to increment network serial count in store")
+	}
+	return nil
+}
+
+func (s *SqlStore) GetAccountDNSSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.DNSSettings, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var accountDNSSettings types.AccountDNSSettings
+	result := tx.Model(&types.Account{}).
+		Take(&accountDNSSettings, idQueryCondition, accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewAccountNotFoundError(accountID)
+		}
+		log.WithContext(ctx).Errorf("failed to get dns settings from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get dns settings from store")
+	}
+	return &accountDNSSettings.DNSSettings, nil
+}
+
+// AccountExists checks whether an account exists by the given ID.
+func (s *SqlStore) AccountExists(ctx context.Context, lockStrength LockingStrength, id string) (bool, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var accountID string
+	result := tx.Model(&types.Account{}).
+		Select("id").Take(&accountID, idQueryCondition, id)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return false, nil
+		}
+		return false, result.Error
+	}
+
+	return accountID != "", nil
+}
+
+// GetAccountDomainAndCategory retrieves the Domain and DomainCategory fields for an account based on the given accountID.
+func (s *SqlStore) GetAccountDomainAndCategory(ctx context.Context, lockStrength LockingStrength, accountID string) (string, string, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var account types.Account
+	result := tx.Model(&types.Account{}).Select("domain", "domain_category").
+		Where(idQueryCondition, accountID).Take(&account)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return "", "", status.Errorf(status.NotFound, "account not found")
+		}
+		return "", "", status.Errorf(status.Internal, "failed to get domain category from store: %v", result.Error)
+	}
+
+	return account.Domain, account.DomainCategory, nil
+}
+
+// SaveDNSSettings saves the DNS settings to the store.
+func (s *SqlStore) SaveDNSSettings(ctx context.Context, accountID string, settings *types.DNSSettings) error {
+	result := s.db.Model(&types.Account{}).
+		Where(idQueryCondition, accountID).Updates(&types.AccountDNSSettings{DNSSettings: *settings})
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save dns settings to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to save dns settings to store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewAccountNotFoundError(accountID)
+	}
+
+	return nil
+}
+
+// SaveAccountSettings stores the account settings in DB.
+func (s *SqlStore) SaveAccountSettings(ctx context.Context, accountID string, settings *types.Settings) error {
+	result := s.db.Model(&types.Account{}).
+		Select("*").Where(idQueryCondition, accountID).Updates(&types.AccountSettings{Settings: settings})
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save account settings to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to save account settings to store")
+	}
+
+	// MySQL reports RowsAffected=0 for no-op updates where values don't change,
+	// unlike SQLite/Postgres which report matched rows. Skip the check since the
+	// caller (UpdateAccountSettings) already verified the account exists via
+	// GetAccountSettings with LockingStrengthUpdate.
+
+	return nil
+}
+
+func (s *SqlStore) CountAccountsByPrivateDomain(ctx context.Context, domain string) (int64, error) {
+	var count int64
+	result := s.db.Model(&types.Account{}).
+		Where("domain = ? AND domain_category = ?",
+			strings.ToLower(domain), types.PrivateCategory,
+		).Count(&count)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to count accounts by private domain %s: %s", domain, result.Error)
+		return 0, status.Errorf(status.Internal, "failed to count accounts by private domain")
+	}
+
+	return count, nil
+}
+
+func (s *SqlStore) IsPrimaryAccount(ctx context.Context, accountID string) (bool, string, error) {
+	var info types.PrimaryAccountInfo
+	result := s.db.Model(&types.Account{}).
+		Select("is_domain_primary_account, domain").
+		Where(idQueryCondition, accountID).
+		Take(&info)
+
+	if result.Error != nil {
+		return false, "", status.Errorf(status.Internal, "failed to get account info: %v", result.Error)
+	}
+
+	return info.IsDomainPrimaryAccount, info.Domain, nil
+}
+
+func (s *SqlStore) MarkAccountPrimary(ctx context.Context, accountID string) error {
+	result := s.db.Model(&types.Account{}).
+		Where(idQueryCondition, accountID).
+		Update("is_domain_primary_account", true)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to mark account as primary: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to mark account as primary")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewAccountNotFoundError(accountID)
+	}
+
+	return nil
+}
+
+type accountNetworkPatch struct {
+	Network *types.Network `gorm:"embedded;embeddedPrefix:network_"`
+}
+
+func (s *SqlStore) UpdateAccountNetwork(ctx context.Context, accountID string, ipNet net.IPNet) error {
+	patch := accountNetworkPatch{
+		Network: &types.Network{Net: ipNet},
+	}
+
+	result := s.db.
+		Model(&types.Account{}).
+		Where(idQueryCondition, accountID).
+		Updates(&patch)
+
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to update account network: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to update account network")
+	}
+	if result.RowsAffected == 0 {
+		return status.NewAccountNotFoundError(accountID)
+	}
+	return nil
+}
+
+// UpdateAccountNetworkV6 updates the IPv6 network range for the account.
+func (s *SqlStore) UpdateAccountNetworkV6(ctx context.Context, accountID string, ipNet net.IPNet) error {
+	patch := accountNetworkPatch{
+		Network: &types.Network{NetV6: ipNet},
+	}
+
+	result := s.db.
+		Model(&types.Account{}).
+		Where(idQueryCondition, accountID).
+		Updates(&patch)
+
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to update account network v6: %v", result.Error)
+		return status.Errorf(status.Internal, "update account network v6")
+	}
+	if result.RowsAffected == 0 {
+		return status.NewAccountNotFoundError(accountID)
+	}
+	return nil
+}
diff --git a/management/server/store/sql_store_account_onboarding.go b/management/server/store/sql_store_account_onboarding.go
new file mode 100644
index 000000000..73c8f14d0
--- /dev/null
+++ b/management/server/store/sql_store_account_onboarding.go
@@ -0,0 +1,70 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// GetAccountOnboarding retrieves the onboarding information for a specific account.
+func (s *SqlStore) GetAccountOnboarding(ctx context.Context, accountID string) (*types.AccountOnboarding, error) {
+	var accountOnboarding types.AccountOnboarding
+	result := s.db.Model(&accountOnboarding).Take(&accountOnboarding, accountIDCondition, accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewAccountOnboardingNotFoundError(accountID)
+		}
+		log.WithContext(ctx).Errorf("error when getting account onboarding %s from the store: %s", accountID, result.Error)
+		return nil, status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	return &accountOnboarding, nil
+}
+
+// SaveAccountOnboarding updates the onboarding information for a specific account.
+func (s *SqlStore) SaveAccountOnboarding(ctx context.Context, onboarding *types.AccountOnboarding) error {
+	result := s.db.Clauses(clause.OnConflict{UpdateAll: true}).Create(onboarding)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("error when saving account onboarding %s in the store: %s", onboarding.AccountID, result.Error)
+		return status.Errorf(status.Internal, "error when saving account onboarding %s in the store: %s", onboarding.AccountID, result.Error)
+	}
+
+	return nil
+}
+
+func (s *SqlStore) getAccountOnboarding(ctx context.Context, accountID string, account *types.Account) error {
+	const query = `SELECT account_id, onboarding_flow_pending, signup_form_pending, created_at, updated_at FROM account_onboardings WHERE account_id = $1`
+	var onboardingFlowPending, signupFormPending sql.NullBool
+	var createdAt, updatedAt sql.NullTime
+	err := s.pgxPool().QueryRow(ctx, query, accountID).Scan(
+		&account.Onboarding.AccountID,
+		&onboardingFlowPending,
+		&signupFormPending,
+		&createdAt,
+		&updatedAt,
+	)
+	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+		return err
+	}
+	if createdAt.Valid {
+		account.Onboarding.CreatedAt = createdAt.Time
+	}
+	if updatedAt.Valid {
+		account.Onboarding.UpdatedAt = updatedAt.Time
+	}
+	if onboardingFlowPending.Valid {
+		account.Onboarding.OnboardingFlowPending = onboardingFlowPending.Bool
+	}
+	if signupFormPending.Valid {
+		account.Onboarding.SignupFormPending = signupFormPending.Bool
+	}
+	return nil
+}
diff --git a/management/server/store/sql_store_account_onboarding_test.go b/management/server/store/sql_store_account_onboarding_test.go
new file mode 100644
index 000000000..9531cd892
--- /dev/null
+++ b/management/server/store/sql_store_account_onboarding_test.go
@@ -0,0 +1,68 @@
+package store
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+func TestSqlStore_GetAccountOnboarding(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "9439-34653001fc3b-bf1c8084-ba50-4ce7"
+	a, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	t.Logf("Onboarding: %+v", a.Onboarding)
+	err = store.SaveAccount(context.Background(), a)
+	require.NoError(t, err)
+	onboarding, err := store.GetAccountOnboarding(context.Background(), accountID)
+	require.NoError(t, err)
+	require.NotNil(t, onboarding)
+	require.Equal(t, accountID, onboarding.AccountID)
+	require.Equal(t, time.Date(2024, time.October, 2, 14, 1, 38, 210000000, time.UTC), onboarding.CreatedAt.UTC())
+}
+
+func TestSqlStore_SaveAccountOnboarding(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+	t.Run("New onboarding should be saved correctly", func(t *testing.T) {
+		accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+		onboarding := &types.AccountOnboarding{
+			AccountID:             accountID,
+			SignupFormPending:     true,
+			OnboardingFlowPending: true,
+		}
+
+		err = store.SaveAccountOnboarding(context.Background(), onboarding)
+		require.NoError(t, err)
+
+		savedOnboarding, err := store.GetAccountOnboarding(context.Background(), accountID)
+		require.NoError(t, err)
+		require.Equal(t, onboarding.SignupFormPending, savedOnboarding.SignupFormPending)
+		require.Equal(t, onboarding.OnboardingFlowPending, savedOnboarding.OnboardingFlowPending)
+	})
+
+	t.Run("Existing onboarding should be updated correctly", func(t *testing.T) {
+		accountID := "9439-34653001fc3b-bf1c8084-ba50-4ce7"
+		onboarding, err := store.GetAccountOnboarding(context.Background(), accountID)
+		require.NoError(t, err)
+
+		onboarding.OnboardingFlowPending = !onboarding.OnboardingFlowPending
+		onboarding.SignupFormPending = !onboarding.SignupFormPending
+
+		err = store.SaveAccountOnboarding(context.Background(), onboarding)
+		require.NoError(t, err)
+
+		savedOnboarding, err := store.GetAccountOnboarding(context.Background(), accountID)
+		require.NoError(t, err)
+		require.Equal(t, onboarding.SignupFormPending, savedOnboarding.SignupFormPending)
+		require.Equal(t, onboarding.OnboardingFlowPending, savedOnboarding.OnboardingFlowPending)
+	})
+}
diff --git a/management/server/store/sql_store_account_test.go b/management/server/store/sql_store_account_test.go
new file mode 100644
index 000000000..ba904bbe4
--- /dev/null
+++ b/management/server/store/sql_store_account_test.go
@@ -0,0 +1,1011 @@
+package store
+
+import (
+	"context"
+	"encoding/binary"
+	"fmt"
+	"net"
+	"net/netip"
+	"os"
+	"reflect"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	proxydomain "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+	nbroute "github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/netbirdio/netbird/shared/testing_helpers"
+)
+
+func Test_SaveAccount_Large(t *testing.T) {
+	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		runLargeTest(t, store)
+	})
+}
+
+func runLargeTest(t *testing.T, store Store) {
+	t.Helper()
+
+	account := newAccountWithId(context.Background(), "account_id", "testuser", "")
+	groupALL, err := account.GetGroupAll()
+	if err != nil {
+		t.Fatal(err)
+	}
+	setupKey, _ := types.GenerateDefaultSetupKey()
+	account.SetupKeys[setupKey.Key] = setupKey
+	const numPerAccount = 6000
+	for n := 0; n < numPerAccount; n++ {
+		netIP := sequentialIPv4(n)
+		peerID := fmt.Sprintf("%s-peer-%d", account.Id, n)
+		addr, _ := netip.AddrFromSlice(netIP)
+
+		peer := &nbpeer.Peer{
+			ID:         peerID,
+			Key:        peerID,
+			IP:         addr.Unmap(),
+			Name:       peerID,
+			DNSLabel:   peerID,
+			UserID:     "testuser",
+			Status:     &nbpeer.PeerStatus{Connected: false, LastSeen: time.Now()},
+			SSHEnabled: false,
+		}
+		account.Peers[peerID] = peer
+		group, _ := account.GetGroupAll()
+		group.Peers = append(group.Peers, peerID)
+		user := &types.User{
+			Id:        fmt.Sprintf("%s-user-%d", account.Id, n),
+			AccountID: account.Id,
+		}
+		account.Users[user.Id] = user
+		route := &nbroute.Route{
+			ID:          nbroute.ID(fmt.Sprintf("network-id-%d", n)),
+			Description: "base route",
+			NetID:       nbroute.NetID(fmt.Sprintf("network-id-%d", n)),
+			Network:     netip.MustParsePrefix(netIP.String() + "/24"),
+			NetworkType: nbroute.IPv4Network,
+			Metric:      9999,
+			Masquerade:  false,
+			Enabled:     true,
+			Groups:      []string{groupALL.ID},
+		}
+		account.Routes[route.ID] = route
+
+		group = &types.Group{
+			ID:        fmt.Sprintf("group-id-%d", n),
+			AccountID: account.Id,
+			Name:      fmt.Sprintf("group-id-%d", n),
+			Issued:    "api",
+			Peers:     nil,
+		}
+		account.Groups[group.ID] = group
+
+		nameserver := &nbdns.NameServerGroup{
+			ID:                   fmt.Sprintf("nameserver-id-%d", n),
+			AccountID:            account.Id,
+			Name:                 fmt.Sprintf("nameserver-id-%d", n),
+			Description:          "",
+			NameServers:          []nbdns.NameServer{{IP: netip.MustParseAddr(netIP.String()), NSType: nbdns.UDPNameServerType}},
+			Groups:               []string{group.ID},
+			Primary:              false,
+			Domains:              nil,
+			Enabled:              false,
+			SearchDomainsEnabled: false,
+		}
+		account.NameServerGroups[nameserver.ID] = nameserver
+
+		setupKey, _ := types.GenerateDefaultSetupKey()
+		_, exists := account.SetupKeys[setupKey.Key]
+		if exists {
+			t.Errorf("setup key already exists")
+		}
+		account.SetupKeys[setupKey.Key] = setupKey
+	}
+
+	err = store.SaveAccount(context.Background(), account)
+	require.NoError(t, err)
+
+	if len(store.GetAllAccounts(context.Background())) != 1 {
+		t.Errorf("expecting 1 Accounts to be stored after SaveAccount()")
+	}
+
+	a, err := store.GetAccount(context.Background(), account.Id)
+	if a == nil {
+		t.Errorf("expecting Account to be stored after SaveAccount(): %v", err)
+	}
+
+	if a != nil && len(a.Policies) != 1 {
+		t.Errorf("expecting Account to have one policy stored after SaveAccount(), got %d", len(a.Policies))
+	}
+
+	if a != nil && len(a.Policies[0].Rules) != 1 {
+		t.Errorf("expecting Account to have one policy rule stored after SaveAccount(), got %d", len(a.Policies[0].Rules))
+		return
+	}
+
+	if a != nil && len(a.Peers) != numPerAccount {
+		t.Errorf("expecting Account to have %d peers stored after SaveAccount(), got %d",
+			numPerAccount, len(a.Peers))
+		return
+	}
+
+	if a != nil && len(a.Users) != numPerAccount+1 {
+		t.Errorf("expecting Account to have %d users stored after SaveAccount(), got %d",
+			numPerAccount+1, len(a.Users))
+		return
+	}
+
+	if a != nil && len(a.Routes) != numPerAccount {
+		t.Errorf("expecting Account to have %d routes stored after SaveAccount(), got %d",
+			numPerAccount, len(a.Routes))
+		return
+	}
+
+	if a != nil && len(a.NameServerGroups) != numPerAccount {
+		t.Errorf("expecting Account to have %d NameServerGroups stored after SaveAccount(), got %d",
+			numPerAccount, len(a.NameServerGroups))
+		return
+	}
+
+	if a != nil && len(a.NameServerGroups) != numPerAccount {
+		t.Errorf("expecting Account to have %d NameServerGroups stored after SaveAccount(), got %d",
+			numPerAccount, len(a.NameServerGroups))
+		return
+	}
+
+	if a != nil && len(a.SetupKeys) != numPerAccount+1 {
+		t.Errorf("expecting Account to have %d SetupKeys stored after SaveAccount(), got %d",
+			numPerAccount+1, len(a.SetupKeys))
+		return
+	}
+}
+
+// sequentialIPv4 returns a unique IPv4 address for the given index, avoiding
+// the random collisions that would otherwise violate the unique (account_id, ip)
+// index when generating a large number of peers.
+func sequentialIPv4(n int) net.IP {
+	b := make([]byte, 4)
+	binary.BigEndian.PutUint32(b, 0x0A000000+uint32(n))
+	return net.IP(b)
+}
+
+func Test_SaveAccount(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("The SQLite store is not properly supported by Windows yet")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		account := newAccountWithId(context.Background(), "account_id", "testuser", "")
+		setupKey, _ := types.GenerateDefaultSetupKey()
+		account.SetupKeys[setupKey.Key] = setupKey
+		account.Peers["testpeer"] = &nbpeer.Peer{
+			Key:    "peerkey",
+			IP:     netip.AddrFrom4([4]byte{127, 0, 0, 1}),
+			IPv6:   netip.MustParseAddr("fd00::1"),
+			Meta:   nbpeer.PeerSystemMeta{},
+			Name:   "peer name",
+			Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
+		}
+
+		err := store.SaveAccount(context.Background(), account)
+		require.NoError(t, err)
+
+		account2 := newAccountWithId(context.Background(), "account_id2", "testuser2", "")
+		setupKey, _ = types.GenerateDefaultSetupKey()
+		account2.SetupKeys[setupKey.Key] = setupKey
+		account2.Peers["testpeer2"] = &nbpeer.Peer{
+			Key:    "peerkey2",
+			IP:     netip.AddrFrom4([4]byte{127, 0, 0, 2}),
+			IPv6:   netip.MustParseAddr("fd00::2"),
+			Meta:   nbpeer.PeerSystemMeta{},
+			Name:   "peer name 2",
+			Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
+		}
+
+		err = store.SaveAccount(context.Background(), account2)
+		require.NoError(t, err)
+
+		if len(store.GetAllAccounts(context.Background())) != 2 {
+			t.Errorf("expecting 2 Accounts to be stored after SaveAccount()")
+		}
+
+		a, err := store.GetAccount(context.Background(), account.Id)
+		if a == nil {
+			t.Errorf("expecting Account to be stored after SaveAccount(): %v", err)
+		}
+
+		if a != nil && len(a.Policies) != 1 {
+			t.Errorf("expecting Account to have one policy stored after SaveAccount(), got %d", len(a.Policies))
+		}
+
+		if a != nil && len(a.Policies[0].Rules) != 1 {
+			t.Errorf("expecting Account to have one policy rule stored after SaveAccount(), got %d", len(a.Policies[0].Rules))
+			return
+		}
+
+		if a, err := store.GetAccountByPeerPubKey(context.Background(), "peerkey"); a == nil {
+			t.Errorf("expecting PeerKeyID2AccountID index updated after SaveAccount(): %v", err)
+		}
+
+		if a, err := store.GetAccountByUser(context.Background(), "testuser"); a == nil {
+			t.Errorf("expecting UserID2AccountID index updated after SaveAccount(): %v", err)
+		}
+
+		if a, err := store.GetAccountByPeerID(context.Background(), "testpeer"); a == nil {
+			t.Errorf("expecting PeerID2AccountID index updated after SaveAccount(): %v", err)
+		}
+
+		if a, err := store.GetAccountBySetupKey(context.Background(), setupKey.Key); a == nil {
+			t.Errorf("expecting SetupKeyID2AccountID index updated after SaveAccount(): %v", err)
+		}
+	})
+}
+
+func Test_AccountSettings_SaveAndRetrieve(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("The SQLite store is not properly supported by Windows yet")
+	}
+
+	populateFields := testing_helpers.NewPopulateFields().WithCustomFieldSetter(
+		reflect.PointerTo(reflect.TypeOf(types.ExtraSettings{})), func(this *testing_helpers.PopulateFields, field reflect.Value) (int, error) {
+			es := types.ExtraSettings{}
+			reflectedEs := reflect.ValueOf(&es).Elem()
+			n, err := this.PopulateAll(reflectedEs)
+			if err != nil {
+				return n, err
+			}
+			field.Set(reflectedEs.Addr())
+			return n, nil
+		}).WithCustomFieldSetter(
+		reflect.PointerTo(reflect.TypeOf(types.DashboardFeatures{})), func(this *testing_helpers.PopulateFields, field reflect.Value) (int, error) {
+			t := true
+			df := types.DashboardFeatures{AgentNetwork: &t}
+			reflectedDf := reflect.ValueOf(&df).Elem()
+			field.Set(reflectedDf.Addr())
+			return 1, nil
+		}).WithSkippedTag("gorm", "-")
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		account := newAccountWithId(context.Background(), "account_id", "testuser", "")
+		setupKey, _ := types.GenerateDefaultSetupKey()
+		account.SetupKeys[setupKey.Key] = setupKey
+
+		settings := types.Settings{}
+		numOfExportedFields, err := populateFields.PopulateAll(reflect.ValueOf(&settings).Elem())
+		assert.NoError(t, err)
+		assert.Equal(t, 28, numOfExportedFields)
+		account.Settings = &settings
+
+		err = store.SaveAccount(context.Background(), account)
+		assert.NoError(t, err)
+
+		accountFromDb, err := store.GetAccount(context.Background(), account.Id)
+		assert.NoError(t, err)
+		assert.NotNil(t, accountFromDb)
+		assert.NotNil(t, accountFromDb.Settings)
+
+		assert.True(t, reflect.DeepEqual(&settings, accountFromDb.Settings), "created settings and settings retrieved from the db should match")
+	})
+}
+
+func TestSqlite_DeleteAccount(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("The SQLite store is not properly supported by Windows yet")
+	}
+
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	t.Cleanup(cleanUp)
+	assert.NoError(t, err)
+
+	testUserID := "testuser"
+	user := types.NewAdminUser(testUserID)
+	user.PATs = map[string]*types.PersonalAccessToken{"testtoken": {
+		ID:   "testtoken",
+		Name: "test token",
+	}}
+
+	account := newAccountWithId(context.Background(), "account_id", testUserID, "")
+	setupKey, _ := types.GenerateDefaultSetupKey()
+	account.SetupKeys[setupKey.Key] = setupKey
+	account.Peers["testpeer"] = &nbpeer.Peer{
+		Key:    "peerkey",
+		IP:     netip.AddrFrom4([4]byte{127, 0, 0, 1}),
+		IPv6:   netip.MustParseAddr("fd00::1"),
+		Meta:   nbpeer.PeerSystemMeta{},
+		Name:   "peer name",
+		Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
+	}
+	account.Users[testUserID] = user
+	account.Networks = []*networkTypes.Network{
+		{
+			ID:          "network_id",
+			AccountID:   account.Id,
+			Name:        "network name",
+			Description: "network description",
+		},
+	}
+	account.NetworkRouters = []*routerTypes.NetworkRouter{
+		{
+			ID:         "router_id",
+			NetworkID:  account.Networks[0].ID,
+			AccountID:  account.Id,
+			PeerGroups: []string{"group_id"},
+			Masquerade: true,
+			Metric:     1,
+		},
+	}
+	account.NetworkResources = []*resourceTypes.NetworkResource{
+		{
+			ID:          "resource_id",
+			NetworkID:   account.Networks[0].ID,
+			AccountID:   account.Id,
+			Name:        "Name",
+			Description: "Description",
+			Type:        "Domain",
+			Address:     "example.com",
+		},
+	}
+
+	account.Services = []*rpservice.Service{
+		{
+			ID:        "service_id",
+			AccountID: account.Id,
+			Name:      "test service",
+			Domain:    "svc.example.com",
+			Enabled:   true,
+			Targets: []*rpservice.Target{
+				{
+					AccountID: account.Id,
+					ServiceID: "service_id",
+					Host:      "localhost",
+					Port:      8080,
+					Protocol:  "http",
+					Enabled:   true,
+				},
+			},
+		},
+	}
+
+	account.Domains = []*proxydomain.Domain{
+		{
+			ID:        "domain_id",
+			Domain:    "custom.example.com",
+			AccountID: account.Id,
+			Validated: true,
+		},
+	}
+
+	err = store.SaveAccount(context.Background(), account)
+	require.NoError(t, err)
+
+	if len(store.GetAllAccounts(context.Background())) != 1 {
+		t.Errorf("expecting 1 Accounts to be stored after SaveAccount()")
+	}
+
+	o, err := store.GetAccountOnboarding(context.Background(), account.Id)
+	require.NoError(t, err)
+	require.Equal(t, o.AccountID, account.Id)
+
+	err = store.CreateAgentNetworkSettings(context.Background(), &agentNetworkTypes.Settings{
+		AccountID:    account.Id,
+		Domain:       "gw.example.com",
+		ProxyAddress: "gw.example.com",
+	})
+	require.NoError(t, err)
+
+	agentNetworkConfig := []any{
+		&agentNetworkTypes.Provider{ID: "an_provider", AccountID: account.Id, APIKey: "sk-test"},
+		&agentNetworkTypes.Policy{ID: "an_policy", AccountID: account.Id},
+		&agentNetworkTypes.Guardrail{ID: "an_guardrail", AccountID: account.Id},
+		&agentNetworkTypes.AccountBudgetRule{ID: "an_budget_rule", AccountID: account.Id},
+	}
+	for _, row := range agentNetworkConfig {
+		require.NoError(t, store.(*SqlStore).db.Create(row).Error, "creating %T", row)
+	}
+	otherProvider := &agentNetworkTypes.Provider{ID: "other_provider", AccountID: "other_account"}
+	require.NoError(t, store.(*SqlStore).db.Create(otherProvider).Error)
+
+	err = store.DeleteAccount(context.Background(), account)
+	require.NoError(t, err)
+
+	_, err = store.GetAccountOnboarding(context.Background(), account.Id)
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting onboarding")
+
+	if len(store.GetAllAccounts(context.Background())) != 0 {
+		t.Errorf("expecting 0 Accounts to be stored after DeleteAccount()")
+	}
+
+	_, err = store.GetAccountByPeerPubKey(context.Background(), "peerkey")
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by peer public key")
+
+	_, err = store.GetAccountByUser(context.Background(), "testuser")
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by user")
+
+	_, err = store.GetAccountByPeerID(context.Background(), "testpeer")
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by peer id")
+
+	_, err = store.GetAccountBySetupKey(context.Background(), setupKey.Key)
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by setup key")
+
+	_, err = store.GetAccount(context.Background(), account.Id)
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by id")
+
+	for _, policy := range account.Policies {
+		var rules []*types.PolicyRule
+		err = store.(*SqlStore).db.Model(&types.PolicyRule{}).Find(&rules, "policy_id = ?", policy.ID).Error
+		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for policy rules")
+		require.Len(t, rules, 0, "expecting no policy rules to be found after removing DeleteAccount")
+
+	}
+
+	for _, accountUser := range account.Users {
+		var pats []*types.PersonalAccessToken
+		err = store.(*SqlStore).db.Model(&types.PersonalAccessToken{}).Find(&pats, "user_id = ?", accountUser.Id).Error
+		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for personal access token")
+		require.Len(t, pats, 0, "expecting no personal access token to be found after removing DeleteAccount")
+
+	}
+
+	for _, network := range account.Networks {
+		routers, err := store.GetNetworkRoutersByNetID(context.Background(), LockingStrengthNone, account.Id, network.ID)
+		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for network routers")
+		require.Len(t, routers, 0, "expecting no network routers to be found after DeleteAccount")
+
+		resources, err := store.GetNetworkResourcesByNetID(context.Background(), LockingStrengthNone, account.Id, network.ID)
+		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for network resources")
+		require.Len(t, resources, 0, "expecting no network resources to be found after DeleteAccount")
+	}
+
+	domains, err := store.ListCustomDomains(context.Background(), account.Id)
+	require.NoError(t, err, "expecting no error after DeleteAccount when searching for custom domains")
+	require.Len(t, domains, 0, "expecting no custom domains to be found after DeleteAccount")
+
+	var services []*rpservice.Service
+	err = store.(*SqlStore).db.Model(&rpservice.Service{}).Find(&services, "account_id = ?", account.Id).Error
+	require.NoError(t, err, "expecting no error after DeleteAccount when searching for services")
+	require.Len(t, services, 0, "expecting no services to be found after DeleteAccount")
+
+	var targets []*rpservice.Target
+	err = store.(*SqlStore).db.Model(&rpservice.Target{}).Find(&targets, "account_id = ?", account.Id).Error
+	require.NoError(t, err, "expecting no error after DeleteAccount when searching for service targets")
+	require.Len(t, targets, 0, "expecting no service targets to be found after DeleteAccount")
+
+	_, err = store.GetAgentNetworkSettings(context.Background(), LockingStrengthNone, account.Id)
+	require.Error(t, err, "expecting agent network settings to be deleted with the account")
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "expecting a status error when getting agent network settings, got %v", err)
+	require.Equal(t, status.NotFound, sErr.Type(), "expecting agent network settings to be deleted with the account")
+
+	// The domain is globally unique, so a leftover row would keep it from another account.
+	err = store.CreateAgentNetworkSettings(context.Background(), &agentNetworkTypes.Settings{
+		AccountID:    "other_account",
+		Domain:       "gw.example.com",
+		ProxyAddress: "gw.example.com",
+	})
+	require.NoError(t, err, "expecting the deleted account's gateway domain to be free for another account")
+
+	for _, row := range agentNetworkConfig {
+		var count int64
+		err = store.(*SqlStore).db.Model(row).Where("account_id = ?", account.Id).Count(&count).Error
+		require.NoError(t, err, "counting %T rows after DeleteAccount", row)
+		assert.Zero(t, count, "expecting no %T rows to be found after DeleteAccount", row)
+	}
+
+	var otherProviders int64
+	err = store.(*SqlStore).db.Model(&agentNetworkTypes.Provider{}).Where("account_id = ?", "other_account").Count(&otherProviders).Error
+	require.NoError(t, err)
+	assert.Equal(t, int64(1), otherProviders, "expecting another account's agent network provider to survive DeleteAccount")
+}
+
+func Test_GetAccount(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("The SQLite store is not properly supported by Windows yet")
+	}
+
+	runTestForAllEngines(t, "../testdata/store.sql", func(t *testing.T, store Store) {
+		id := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+		account, err := store.GetAccount(context.Background(), id)
+		require.NoError(t, err)
+		require.Equal(t, id, account.Id, "account id should match")
+		require.Equal(t, false, account.Onboarding.OnboardingFlowPending)
+
+		id = "9439-34653001fc3b-bf1c8084-ba50-4ce7"
+
+		account, err = store.GetAccount(context.Background(), id)
+		require.NoError(t, err)
+		require.Equal(t, id, account.Id, "account id should match")
+		require.Equal(t, true, account.Onboarding.OnboardingFlowPending)
+
+		_, err = store.GetAccount(context.Background(), "non-existing-account")
+		assert.Error(t, err)
+		parsedErr, ok := status.FromError(err)
+		require.True(t, ok)
+		require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
+
+	})
+}
+
+func Test_TestGetAccountByPrivateDomain(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("The SQLite store is not properly supported by Windows yet")
+	}
+
+	runTestForAllEngines(t, "../testdata/store.sql", func(t *testing.T, store Store) {
+		existingDomain := "test.com"
+
+		account, err := store.GetAccountByPrivateDomain(context.Background(), existingDomain)
+		require.NoError(t, err, "should found account")
+		require.Equal(t, existingDomain, account.Domain, "domains should match")
+
+		_, err = store.GetAccountByPrivateDomain(context.Background(), "missing-domain.com")
+		require.Error(t, err, "should return error on domain lookup")
+		parsedErr, ok := status.FromError(err)
+		require.True(t, ok)
+		require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
+	})
+}
+
+func TestPostgresql_SaveAccount(t *testing.T) {
+	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.PostgresStoreEngine))
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	t.Cleanup(cleanUp)
+	assert.NoError(t, err)
+
+	account := newAccountWithId(context.Background(), "account_id", "testuser", "")
+	setupKey, _ := types.GenerateDefaultSetupKey()
+	account.SetupKeys[setupKey.Key] = setupKey
+	account.Peers["testpeer"] = &nbpeer.Peer{
+		Key:    "peerkey",
+		IP:     netip.AddrFrom4([4]byte{127, 0, 0, 1}),
+		IPv6:   netip.MustParseAddr("fd00::1"),
+		Meta:   nbpeer.PeerSystemMeta{},
+		Name:   "peer name",
+		Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
+	}
+
+	err = store.SaveAccount(context.Background(), account)
+	require.NoError(t, err)
+
+	account2 := newAccountWithId(context.Background(), "account_id2", "testuser2", "")
+	setupKey, _ = types.GenerateDefaultSetupKey()
+	account2.SetupKeys[setupKey.Key] = setupKey
+	account2.Peers["testpeer2"] = &nbpeer.Peer{
+		Key:    "peerkey2",
+		IP:     netip.AddrFrom4([4]byte{127, 0, 0, 2}),
+		IPv6:   netip.MustParseAddr("fd00::2"),
+		Meta:   nbpeer.PeerSystemMeta{},
+		Name:   "peer name 2",
+		Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
+	}
+
+	err = store.SaveAccount(context.Background(), account2)
+	require.NoError(t, err)
+
+	if len(store.GetAllAccounts(context.Background())) != 2 {
+		t.Errorf("expecting 2 Accounts to be stored after SaveAccount()")
+	}
+
+	a, err := store.GetAccount(context.Background(), account.Id)
+	if a == nil {
+		t.Errorf("expecting Account to be stored after SaveAccount(): %v", err)
+	}
+
+	if a != nil && len(a.Policies) != 1 {
+		t.Errorf("expecting Account to have one policy stored after SaveAccount(), got %d", len(a.Policies))
+	}
+
+	if a != nil && len(a.Policies[0].Rules) != 1 {
+		t.Errorf("expecting Account to have one policy rule stored after SaveAccount(), got %d", len(a.Policies[0].Rules))
+		return
+	}
+
+	if a, err := store.GetAccountByPeerPubKey(context.Background(), "peerkey"); a == nil {
+		t.Errorf("expecting PeerKeyID2AccountID index updated after SaveAccount(): %v", err)
+	}
+
+	if a, err := store.GetAccountByUser(context.Background(), "testuser"); a == nil {
+		t.Errorf("expecting UserID2AccountID index updated after SaveAccount(): %v", err)
+	}
+
+	if a, err := store.GetAccountByPeerID(context.Background(), "testpeer"); a == nil {
+		t.Errorf("expecting PeerID2AccountID index updated after SaveAccount(): %v", err)
+	}
+
+	if a, err := store.GetAccountBySetupKey(context.Background(), setupKey.Key); a == nil {
+		t.Errorf("expecting SetupKeyID2AccountID index updated after SaveAccount(): %v", err)
+	}
+}
+
+func TestPostgresql_DeleteAccount(t *testing.T) {
+	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.PostgresStoreEngine))
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	t.Cleanup(cleanUp)
+	assert.NoError(t, err)
+
+	testUserID := "testuser"
+	user := types.NewAdminUser(testUserID)
+	user.PATs = map[string]*types.PersonalAccessToken{"testtoken": {
+		ID:   "testtoken",
+		Name: "test token",
+	}}
+
+	account := newAccountWithId(context.Background(), "account_id", testUserID, "")
+	setupKey, _ := types.GenerateDefaultSetupKey()
+	account.SetupKeys[setupKey.Key] = setupKey
+	account.Peers["testpeer"] = &nbpeer.Peer{
+		Key:    "peerkey",
+		IP:     netip.AddrFrom4([4]byte{127, 0, 0, 1}),
+		IPv6:   netip.MustParseAddr("fd00::1"),
+		Meta:   nbpeer.PeerSystemMeta{},
+		Name:   "peer name",
+		Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
+	}
+	account.Users[testUserID] = user
+
+	err = store.SaveAccount(context.Background(), account)
+	require.NoError(t, err)
+
+	if len(store.GetAllAccounts(context.Background())) != 1 {
+		t.Errorf("expecting 1 Accounts to be stored after SaveAccount()")
+	}
+
+	err = store.DeleteAccount(context.Background(), account)
+	require.NoError(t, err)
+
+	if len(store.GetAllAccounts(context.Background())) != 0 {
+		t.Errorf("expecting 0 Accounts to be stored after DeleteAccount()")
+	}
+
+	_, err = store.GetAccountByPeerPubKey(context.Background(), "peerkey")
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by peer public key")
+
+	_, err = store.GetAccountByUser(context.Background(), "testuser")
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by user")
+
+	_, err = store.GetAccountByPeerID(context.Background(), "testpeer")
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by peer id")
+
+	_, err = store.GetAccountBySetupKey(context.Background(), setupKey.Key)
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by setup key")
+
+	_, err = store.GetAccount(context.Background(), account.Id)
+	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by id")
+
+	for _, policy := range account.Policies {
+		var rules []*types.PolicyRule
+		err = store.(*SqlStore).db.Model(&types.PolicyRule{}).Find(&rules, "policy_id = ?", policy.ID).Error
+		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for policy rules")
+		require.Len(t, rules, 0, "expecting no policy rules to be found after removing DeleteAccount")
+
+	}
+
+	for _, accountUser := range account.Users {
+		var pats []*types.PersonalAccessToken
+		err = store.(*SqlStore).db.Model(&types.PersonalAccessToken{}).Find(&pats, "user_id = ?", accountUser.Id).Error
+		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for personal access token")
+		require.Len(t, pats, 0, "expecting no personal access token to be found after removing DeleteAccount")
+
+	}
+
+}
+
+func TestPostgresql_TestGetAccountByPrivateDomain(t *testing.T) {
+	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.PostgresStoreEngine))
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanUp)
+	assert.NoError(t, err)
+
+	existingDomain := "test.com"
+
+	account, err := store.GetAccountByPrivateDomain(context.Background(), existingDomain)
+	require.NoError(t, err, "should found account")
+	require.Equal(t, existingDomain, account.Domain, "domains should match")
+
+	_, err = store.GetAccountByPrivateDomain(context.Background(), "missing-domain.com")
+	require.Error(t, err, "should return error on domain lookup")
+}
+
+func TestSqlite_GetAccountNetwork(t *testing.T) {
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	_, err = store.GetAccount(context.Background(), existingAccountID)
+	require.NoError(t, err)
+
+	network, err := store.GetAccountNetwork(context.Background(), LockingStrengthNone, existingAccountID)
+	require.NoError(t, err)
+	ip := net.IP{100, 64, 0, 0}.To16()
+	assert.Equal(t, ip, network.Net.IP)
+	assert.Equal(t, net.IPMask{255, 255, 0, 0}, network.Net.Mask)
+	assert.Equal(t, "", network.Dns)
+	assert.Equal(t, "af1c8024-ha40-4ce2-9418-34653101fc3c", network.Identifier)
+	assert.Equal(t, uint64(0), network.Serial)
+}
+
+func TestSqlStore_SaveAccountPersistsAgentNetworkOnly(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	account, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.False(t, account.Settings.AgentNetworkOnly, "setting should default to false")
+
+	account.Settings.AgentNetworkOnly = true
+	require.NoError(t, store.SaveAccount(context.Background(), account))
+
+	reloaded, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.True(t, reloaded.Settings.AgentNetworkOnly, "setting should survive a save/load round-trip")
+
+	reloaded.Settings.AgentNetworkOnly = false
+	require.NoError(t, store.SaveAccount(context.Background(), reloaded))
+
+	disabled, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.False(t, disabled.Settings.AgentNetworkOnly, "disabling should persist")
+}
+
+func TestSqlStore_SaveAccountPersistsDashboardFeatures(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	account, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.Nil(t, account.Settings.DashboardFeatures, "dashboard features should default to unset")
+
+	agentNetwork := true
+	account.Settings.DashboardFeatures = &types.DashboardFeatures{AgentNetwork: &agentNetwork}
+	require.NoError(t, store.SaveAccount(context.Background(), account))
+
+	reloaded, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.NotNil(t, reloaded.Settings.DashboardFeatures, "dashboard features should survive a save/load round-trip")
+	require.NotNil(t, reloaded.Settings.DashboardFeatures.AgentNetwork, "agent network flag should be set")
+	require.True(t, *reloaded.Settings.DashboardFeatures.AgentNetwork, "agent network flag should persist as true")
+
+	disabled := false
+	reloaded.Settings.DashboardFeatures = &types.DashboardFeatures{AgentNetwork: &disabled}
+	require.NoError(t, store.SaveAccount(context.Background(), reloaded))
+
+	reloadedDisabled, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.NotNil(t, reloadedDisabled.Settings.DashboardFeatures.AgentNetwork, "agent network flag should remain set")
+	require.False(t, *reloadedDisabled.Settings.DashboardFeatures.AgentNetwork, "explicit false should persist")
+}
+
+func TestSqlStore_UpdateAccountDomainAttributes(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	if err != nil {
+		t.Fatal(err)
+	}
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	t.Run("Should update attributes with public domain", func(t *testing.T) {
+		require.NoError(t, err)
+		domain := "example.com"
+		category := "public"
+		IsDomainPrimaryAccount := false
+		err = store.UpdateAccountDomainAttributes(context.Background(), accountID, domain, category, IsDomainPrimaryAccount)
+		require.NoError(t, err)
+		account, err := store.GetAccount(context.Background(), accountID)
+		require.NoError(t, err)
+		require.Equal(t, domain, account.Domain)
+		require.Equal(t, category, account.DomainCategory)
+		require.Equal(t, IsDomainPrimaryAccount, account.IsDomainPrimaryAccount)
+	})
+
+	t.Run("Should update attributes with private domain", func(t *testing.T) {
+		require.NoError(t, err)
+		domain := "test.com"
+		category := "private"
+		IsDomainPrimaryAccount := true
+		err = store.UpdateAccountDomainAttributes(context.Background(), accountID, domain, category, IsDomainPrimaryAccount)
+		require.NoError(t, err)
+		account, err := store.GetAccount(context.Background(), accountID)
+		require.NoError(t, err)
+		require.Equal(t, domain, account.Domain)
+		require.Equal(t, category, account.DomainCategory)
+		require.Equal(t, IsDomainPrimaryAccount, account.IsDomainPrimaryAccount)
+	})
+
+	t.Run("Should fail when account does not exist", func(t *testing.T) {
+		require.NoError(t, err)
+		domain := "test.com"
+		category := "private"
+		IsDomainPrimaryAccount := true
+		err = store.UpdateAccountDomainAttributes(context.Background(), "non-existing-account-id", domain, category, IsDomainPrimaryAccount)
+		require.Error(t, err)
+	})
+
+}
+
+func TestSqlStore_GetDNSSettings(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name        string
+		accountID   string
+		expectError bool
+	}{
+		{
+			name:        "retrieve existing account dns settings",
+			accountID:   "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing account dns settings",
+			accountID:   "non-existing",
+			expectError: true,
+		},
+		{
+			name:        "retrieve dns settings with empty account ID",
+			accountID:   "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dnsSettings, err := store.GetAccountDNSSettings(context.Background(), LockingStrengthNone, tt.accountID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, dnsSettings)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, dnsSettings)
+			}
+		})
+	}
+}
+
+func TestSqlStore_SaveDNSSettings(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	dnsSettings, err := store.GetAccountDNSSettings(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+
+	dnsSettings.DisabledManagementGroups = []string{"groupA", "groupB"}
+	err = store.SaveDNSSettings(context.Background(), accountID, dnsSettings)
+	require.NoError(t, err)
+
+	saveDNSSettings, err := store.GetAccountDNSSettings(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	require.Equal(t, saveDNSSettings, dnsSettings)
+}
+
+func TestSqlStore_GetAccountCreatedBy(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name        string
+		accountID   string
+		expectError bool
+		createdBy   string
+	}{
+		{
+			name:        "existing account ID",
+			accountID:   "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			expectError: false,
+			createdBy:   "edafee4e-63fb-11ec-90d6-0242ac120003",
+		},
+		{
+			name:        "non-existing account ID",
+			accountID:   "nonexistent",
+			expectError: true,
+		},
+		{
+			name:        "empty account ID",
+			accountID:   "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			createdBy, err := store.GetAccountCreatedBy(context.Background(), LockingStrengthNone, tt.accountID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Empty(t, createdBy)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, createdBy)
+				require.Equal(t, tt.createdBy, createdBy)
+			}
+		})
+	}
+
+}
+
+func TestSqlStore_GetAccountMeta(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	accountMeta, err := store.GetAccountMeta(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	require.NotNil(t, accountMeta)
+	require.Equal(t, accountID, accountMeta.AccountID)
+	require.Equal(t, "edafee4e-63fb-11ec-90d6-0242ac120003", accountMeta.CreatedBy)
+	require.Equal(t, "test.com", accountMeta.Domain)
+	require.Equal(t, "private", accountMeta.DomainCategory)
+	require.Equal(t, time.Date(2024, time.October, 2, 14, 1, 38, 210000000, time.UTC), accountMeta.CreatedAt.UTC())
+}
+
+func TestSqlStore_GetAnyAccountID(t *testing.T) {
+	t.Run("should return account ID when accounts exist", func(t *testing.T) {
+		store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+		t.Cleanup(cleanup)
+		require.NoError(t, err)
+
+		accountID, err := store.GetAnyAccountID(context.Background())
+		require.NoError(t, err)
+		assert.Equal(t, "bf1c8084-ba50-4ce7-9439-34653001fc3b", accountID)
+	})
+
+	t.Run("should return error when no accounts exist", func(t *testing.T) {
+		store, cleanup, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+		t.Cleanup(cleanup)
+		require.NoError(t, err)
+
+		accountID, err := store.GetAnyAccountID(context.Background())
+		require.Error(t, err)
+		sErr, ok := status.FromError(err)
+		assert.True(t, ok)
+		assert.Equal(t, sErr.Type(), status.NotFound)
+		assert.Empty(t, accountID)
+	})
+}
diff --git a/management/server/store/sql_store_activity_test.go b/management/server/store/sql_store_activity_test.go
new file mode 100644
index 000000000..b7aef47b1
--- /dev/null
+++ b/management/server/store/sql_store_activity_test.go
@@ -0,0 +1,122 @@
+package store
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+const activityAccountID = "activityAccountId"
+
+func newActivityTestStore(t *testing.T) Store {
+	t.Helper()
+
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanUp)
+
+	require.NoError(t, store.SaveAccount(context.Background(), &types.Account{
+		Id:        activityAccountID,
+		Domain:    "activity.example.com",
+		CreatedAt: time.Now().UTC(),
+	}))
+
+	return store
+}
+
+func TestRefreshPeerLastSeen(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+	stored := time.Now().UTC().Add(-3 * time.Hour)
+	require.NoError(t, store.AddPeerToAccount(ctx, activityPeer(stored)))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	assert.True(t, refreshed, "a peer seen three hours ago is stale enough to refresh")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should be stamped at write time")
+	assert.True(t, peer.Status.LastSeen.After(stored), "last seen must move forward")
+}
+
+// TestRefreshPeerLastSeenHonoursCutoff covers the throttle the caller relies on:
+// two concurrent requests both read the same stale peer, but only the statement
+// that still finds LastSeen behind the cutoff writes.
+func TestRefreshPeerLastSeenHonoursCutoff(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+	stored := time.Now().UTC().Add(-10 * time.Minute)
+	require.NoError(t, store.AddPeerToAccount(ctx, activityPeer(stored)))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	assert.False(t, refreshed, "a peer seen inside the interval must not be written")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, stored, peer.Status.LastSeen.UTC(), time.Second, "last seen must be left where it was")
+}
+
+// TestRefreshPeerLastSeenRecordsNeverSeenPeer covers the nullable column. Status
+// is an embedded pointer, so a peer stored without one leaves last seen NULL,
+// and NULL loses the cutoff comparison — such a peer would never record its
+// first activity.
+func TestRefreshPeerLastSeenRecordsNeverSeenPeer(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+	stored := activityPeer(time.Time{})
+	stored.Status = nil
+	require.NoError(t, store.AddPeerToAccount(ctx, stored))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	assert.True(t, refreshed, "a peer that was never seen must record its first activity")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should be stamped at write time")
+}
+
+// TestRefreshPeerLastSeenLeavesSessionStateAlone pins the column boundary: the
+// connected flag and the session token belong to the sync stream that owns the
+// peer's session, and a blind write here would corrupt its fencing. This is why
+// SavePeerStatus is not reused for an activity bump.
+func TestRefreshPeerLastSeenLeavesSessionStateAlone(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+
+	stored := activityPeer(time.Date(2026, 3, 1, 9, 0, 0, 0, time.UTC))
+	stored.Status.Connected = true
+	stored.Status.SessionStartedAt = 1234567890
+	require.NoError(t, store.AddPeerToAccount(ctx, stored))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	require.True(t, refreshed, "the peer is stale enough to refresh")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should move forward")
+	assert.True(t, peer.Status.Connected, "connected flag must survive an activity write")
+	assert.Equal(t, int64(1234567890), peer.Status.SessionStartedAt, "session token must survive an activity write")
+}
+
+func activityPeer(lastSeen time.Time) *nbpeer.Peer {
+	return &nbpeer.Peer{
+		ID:        "activityPeer",
+		AccountID: activityAccountID,
+		Key:       "activityPeerKey",
+		IP:        netip.MustParseAddr("100.64.0.9"),
+		Name:      "activity-peer",
+		DNSLabel:  "activity-peer",
+		Status:    &nbpeer.PeerStatus{LastSeen: lastSeen},
+	}
+}
diff --git a/management/server/store/sql_store_agent_network_access_log.go b/management/server/store/sql_store_agent_network_access_log.go
new file mode 100644
index 000000000..479dfa45e
--- /dev/null
+++ b/management/server/store/sql_store_agent_network_access_log.go
@@ -0,0 +1,285 @@
+package store
+
+import (
+	"context"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// CreateAgentNetworkAccessLog persists a flattened agent-network access-log
+// entry together with its authorising-group child rows in a single
+// transaction.
+func (s *SqlStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
+		// Idempotent on the log id / (log_id, group_id) so a proxy resend of the
+		// same entry can't fail the request.
+		if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(entry).Error; err != nil {
+			return err
+		}
+		if len(groups) > 0 {
+			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&groups).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{
+			"account_id": entry.AccountID,
+			"service_id": entry.ServiceID,
+			"model":      entry.Model,
+		}).Errorf("failed to create agent-network access log entry in store: %v", err)
+		return status.Errorf(status.Internal, "failed to create agent-network access log entry in store")
+	}
+	return nil
+}
+
+// DeleteOldAgentNetworkAccessLogs deletes an account's access-log rows (and
+// their authorising-group child rows) older than the cutoff. Usage records are
+// untouched — they are the long-term aggregate. Returns the number of log rows
+// deleted.
+func (s *SqlStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error) {
+	var deleted int64
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
+		// Remove group child rows for the soon-to-be-deleted logs first.
+		if err := tx.Exec(
+			"DELETE FROM agent_network_access_log_group WHERE account_id = ? AND log_id IN (SELECT id FROM agent_network_access_log WHERE account_id = ? AND timestamp < ?)",
+			accountID, accountID, olderThan,
+		).Error; err != nil {
+			return err
+		}
+		res := tx.Where("account_id = ? AND timestamp < ?", accountID, olderThan).
+			Delete(&agentNetworkTypes.AgentNetworkAccessLog{})
+		if res.Error != nil {
+			return res.Error
+		}
+		deleted = res.RowsAffected
+		return nil
+	})
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to delete old agent-network access logs for account %s: %v", accountID, err)
+		return 0, status.Errorf(status.Internal, "failed to delete old agent-network access logs")
+	}
+	return deleted, nil
+}
+
+// GetDeletedAccountIDsWithAgentNetworkAccessLogs returns the IDs of accounts that no
+// longer exist but still have access-log rows. The retention sweep is driven by settings
+// rows, which are deleted with the account, so it uses this to find logs it would
+// otherwise never expire.
+func (s *SqlStore) GetDeletedAccountIDsWithAgentNetworkAccessLogs(ctx context.Context) ([]string, error) {
+	var accountIDs []string
+	err := s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).
+		Distinct("account_id").
+		Where("NOT EXISTS (SELECT 1 FROM accounts WHERE accounts.id = agent_network_access_log.account_id)").
+		Pluck("account_id", &accountIDs).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to get deleted accounts with agent-network access logs: %v", err)
+		return nil, status.Errorf(status.Internal, "failed to get deleted accounts with agent-network access logs")
+	}
+	return accountIDs, nil
+}
+
+// GetAgentNetworkAccessLogs retrieves flattened agent-network access logs for
+// an account with server-side pagination, filtering and sorting. Authorising
+// group ids are hydrated from the group child table for the returned page.
+func (s *SqlStore) GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLog, int64, error) {
+	var logs []*agentNetworkTypes.AgentNetworkAccessLog
+	var totalCount int64
+
+	countQuery := s.applyAgentNetworkAccessLogFilters(
+		s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).Where(accountIDCondition, accountID),
+		filter,
+	)
+	if err := countQuery.Count(&totalCount).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to count agent-network access logs: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to count agent-network access logs")
+	}
+
+	query := s.applyAgentNetworkAccessLogFilters(
+		s.db.Where(accountIDCondition, accountID),
+		filter,
+	).
+		Order(filter.GetSortColumn() + " " + filter.GetSortOrder()).
+		Limit(filter.GetLimit()).
+		Offset(filter.GetOffset())
+
+	if lockStrength != LockingStrengthNone {
+		query = query.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	if err := query.Find(&logs).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get agent-network access logs from store: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to get agent-network access logs from store")
+	}
+
+	if err := s.hydrateAgentNetworkAccessLogGroups(ctx, accountID, logs); err != nil {
+		return nil, 0, err
+	}
+
+	return logs, totalCount, nil
+}
+
+// applyAgentNetworkAccessLogFilters applies the filter conditions to a query.
+func (s *SqlStore) applyAgentNetworkAccessLogFilters(query *gorm.DB, filter agentNetworkTypes.AgentNetworkAccessLogFilter) *gorm.DB {
+	if filter.Search != nil {
+		p := "%" + *filter.Search + "%"
+		query = query.Where(
+			"id LIKE ? OR host LIKE ? OR path LIKE ? OR model LIKE ? OR user_id IN (SELECT id FROM users WHERE email LIKE ? OR name LIKE ?)",
+			p, p, p, p, p, p,
+		)
+	}
+	if filter.UserID != nil {
+		query = query.Where("user_id = ?", *filter.UserID)
+	}
+	if filter.SessionID != nil {
+		query = query.Where("session_id = ?", *filter.SessionID)
+	}
+	if filter.Decision != nil {
+		query = query.Where("decision = ?", *filter.Decision)
+	}
+	if filter.PathPrefix != nil {
+		query = query.Where("path LIKE ?", *filter.PathPrefix+"%")
+	}
+	if len(filter.ProviderIDs) > 0 {
+		query = query.Where("resolved_provider_id IN ?", filter.ProviderIDs)
+	}
+	if len(filter.Models) > 0 {
+		query = query.Where("model IN ?", filter.Models)
+	}
+	if len(filter.GroupIDs) > 0 {
+		query = query.Where(
+			"id IN (SELECT log_id FROM agent_network_access_log_group WHERE group_id IN ?)",
+			filter.GroupIDs,
+		)
+	}
+	if filter.StartDate != nil {
+		query = query.Where("timestamp >= ?", *filter.StartDate)
+	}
+	if filter.EndDate != nil {
+		query = query.Where("timestamp <= ?", *filter.EndDate)
+	}
+	return query
+}
+
+// hydrateAgentNetworkAccessLogGroups loads the authorising group ids for the
+// given page of entries and assigns them onto each entry's GroupIDs field.
+func (s *SqlStore) hydrateAgentNetworkAccessLogGroups(ctx context.Context, accountID string, logs []*agentNetworkTypes.AgentNetworkAccessLog) error {
+	if len(logs) == 0 {
+		return nil
+	}
+
+	ids := make([]string, 0, len(logs))
+	for _, l := range logs {
+		ids = append(ids, l.ID)
+	}
+
+	var rows []agentNetworkTypes.AgentNetworkAccessLogGroup
+	if err := s.db.
+		Where(accountIDCondition, accountID).
+		Where("log_id IN ?", ids).
+		Find(&rows).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to hydrate agent-network access log groups: %v", err)
+		return status.Errorf(status.Internal, "failed to hydrate agent-network access log groups")
+	}
+
+	byLog := make(map[string][]string, len(logs))
+	for _, r := range rows {
+		byLog[r.LogID] = append(byLog[r.LogID], r.GroupID)
+	}
+	for _, l := range logs {
+		l.GroupIDs = byLog[l.ID]
+	}
+	return nil
+}
+
+// agentNetworkSessionKeyExpr is the SQL group key for session-grouped access
+// logs: the row's session id, or — when the client sent none — the row id, so
+// session-less requests each form their own singleton group. COALESCE/NULLIF
+// are standard SQL, so this stays portable across SQLite and Postgres.
+const agentNetworkSessionKeyExpr = "COALESCE(NULLIF(session_id, ''), id)"
+
+// GetAgentNetworkAccessLogSessions retrieves agent-network access logs grouped
+// by session, with server-side pagination, filtering and sorting at the session
+// level. It paginates over the distinct session keys (ordered by the requested
+// session-level aggregate), fetches every entry for the page's sessions, and
+// folds them into per-session summaries. The returned count is the number of
+// matching sessions. Filters apply to the entries, so a session's summary
+// reflects only its filter-matching requests.
+func (s *SqlStore) GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLogSession, int64, error) {
+	// Count distinct sessions via a grouped subquery — portable and avoids
+	// relying on COUNT(DISTINCT <expr>) quoting quirks.
+	sessionsSubquery := s.applyAgentNetworkAccessLogFilters(
+		s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).Where(accountIDCondition, accountID),
+		filter,
+	).
+		Select(agentNetworkSessionKeyExpr + " AS session_key").
+		Group(agentNetworkSessionKeyExpr)
+
+	var totalCount int64
+	if err := s.db.Table("(?) AS sessions", sessionsSubquery).Count(&totalCount).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to count agent-network access-log sessions: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to count agent-network access-log sessions")
+	}
+
+	// The page of session keys, ordered by the session-level aggregate. The
+	// session-key tiebreaker keeps pagination deterministic when the primary
+	// aggregate ties.
+	type sessionKeyRow struct {
+		SessionKey string
+	}
+	var keyRows []sessionKeyRow
+	keyQuery := s.applyAgentNetworkAccessLogFilters(
+		s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).Where(accountIDCondition, accountID),
+		filter,
+	).
+		Select(agentNetworkSessionKeyExpr + " AS session_key").
+		Group(agentNetworkSessionKeyExpr).
+		Order(filter.GetSessionSortExpr() + " " + filter.GetSortOrder()).
+		Order("session_key ASC").
+		Limit(filter.GetLimit()).
+		Offset(filter.GetOffset())
+	if err := keyQuery.Scan(&keyRows).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to list agent-network access-log session keys: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to list agent-network access-log session keys")
+	}
+	if len(keyRows) == 0 {
+		return nil, totalCount, nil
+	}
+
+	keys := make([]string, 0, len(keyRows))
+	for _, r := range keyRows {
+		keys = append(keys, r.SessionKey)
+	}
+
+	// All entries for the page's sessions, contiguous per session and oldest
+	// first within each — the fold relies on that ordering.
+	var entries []*agentNetworkTypes.AgentNetworkAccessLog
+	entriesQuery := s.applyAgentNetworkAccessLogFilters(
+		s.db.Where(accountIDCondition, accountID),
+		filter,
+	).
+		Where(agentNetworkSessionKeyExpr+" IN ?", keys).
+		Order(agentNetworkSessionKeyExpr + ", timestamp ASC")
+
+	if lockStrength != LockingStrengthNone {
+		entriesQuery = entriesQuery.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	if err := entriesQuery.Find(&entries).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get agent-network access-log session entries: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to get agent-network access-log session entries")
+	}
+
+	if err := s.hydrateAgentNetworkAccessLogGroups(ctx, accountID, entries); err != nil {
+		return nil, 0, err
+	}
+
+	return agentNetworkTypes.FoldAccessLogSessions(keys, entries), totalCount, nil
+}
diff --git a/management/server/store/sql_store_agent_network_usage.go b/management/server/store/sql_store_agent_network_usage.go
new file mode 100644
index 000000000..dc557d2f4
--- /dev/null
+++ b/management/server/store/sql_store_agent_network_usage.go
@@ -0,0 +1,91 @@
+package store
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// CreateAgentNetworkUsage persists a stripped agent-network usage record
+// together with its authorising-group child rows in a single transaction.
+func (s *SqlStore) CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
+		// Idempotent on the usage id / (usage_id, group_id) so a proxy resend of
+		// the same entry can't fail the request.
+		if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(usage).Error; err != nil {
+			return err
+		}
+		if len(groups) > 0 {
+			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&groups).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{
+			"account_id": usage.AccountID,
+			"model":      usage.Model,
+		}).Errorf("failed to create agent-network usage record in store: %v", err)
+		return status.Errorf(status.Internal, "failed to create agent-network usage record in store")
+	}
+	return nil
+}
+
+// GetAgentNetworkUsageRows returns the stripped usage rows for an account that
+// match the filter (date / user / group / provider / model). Aggregation into
+// time buckets happens in the manager so granularities stay engine-portable.
+func (s *SqlStore) GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkUsage, error) {
+	var rows []*agentNetworkTypes.AgentNetworkUsage
+
+	query := s.applyAgentNetworkUsageFilters(
+		s.db.Where(accountIDCondition, accountID),
+		filter,
+	).Order("timestamp ASC")
+
+	if lockStrength != LockingStrengthNone {
+		query = query.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	if err := query.Find(&rows).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get agent-network usage rows from store: %v", err)
+		return nil, status.Errorf(status.Internal, "failed to get agent-network usage rows from store")
+	}
+	return rows, nil
+}
+
+// applyAgentNetworkUsageFilters applies the shared access-log filter's
+// date/user/group/provider/model conditions to a usage-table query. Pagination,
+// sort and free-text search are ignored — the overview is an aggregate.
+func (s *SqlStore) applyAgentNetworkUsageFilters(query *gorm.DB, filter agentNetworkTypes.AgentNetworkAccessLogFilter) *gorm.DB {
+	if filter.UserID != nil {
+		query = query.Where("user_id = ?", *filter.UserID)
+	}
+	if filter.SessionID != nil {
+		query = query.Where("session_id = ?", *filter.SessionID)
+	}
+	if len(filter.ProviderIDs) > 0 {
+		query = query.Where("resolved_provider_id IN ?", filter.ProviderIDs)
+	}
+	if len(filter.Models) > 0 {
+		query = query.Where("model IN ?", filter.Models)
+	}
+	if len(filter.GroupIDs) > 0 {
+		query = query.Where(
+			"id IN (SELECT usage_id FROM agent_network_request_usage_group WHERE group_id IN ?)",
+			filter.GroupIDs,
+		)
+	}
+	if filter.StartDate != nil {
+		query = query.Where("timestamp >= ?", *filter.StartDate)
+	}
+	if filter.EndDate != nil {
+		query = query.Where("timestamp <= ?", *filter.EndDate)
+	}
+	return query
+}
diff --git a/management/server/store/sql_store_agentnetwork.go b/management/server/store/sql_store_agentnetwork.go
index b0df0cd2a..bdb1f97d6 100644
--- a/management/server/store/sql_store_agentnetwork.go
+++ b/management/server/store/sql_store_agentnetwork.go
@@ -71,7 +71,7 @@ func (s *SqlStore) GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetr
 	usageRow := db.Model(&agentNetworkTypes.AgentNetworkUsage{}).
 		Select("COALESCE(SUM(input_tokens), 0) AS input_tokens, " +
 			"COALESCE(SUM(output_tokens), 0) AS output_tokens, " +
-			"COALESCE(SUM(cost_usd), 0) AS cost_usd").Row()
+			"COALESCE(SUM" + agentNetworkTypes.CostUSDSQLExpr + ", 0) AS cost_usd").Row()
 	if err := usageRow.Scan(&m.InputTokens, &m.OutputTokens, &m.CostUSD); err != nil {
 		return AgentNetworkMetrics{}, fmt.Errorf("scan agent network usage metrics: %w", err)
 	}
@@ -315,25 +315,95 @@ func (s *SqlStore) GetAllAgentNetworkSettings(ctx context.Context, lockStrength
 	return settings, nil
 }
 
-// GetAgentNetworkSettingsByCluster returns every Settings row pinned to
-// the given proxy cluster. Used by the bootstrap label generator to
-// build the set of subdomains already taken on a cluster.
-func (s *SqlStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error) {
+// HasGatewayClusterPinnedByOtherAccount reports whether another account has a
+// labeled agent network gateway pinned beneath host, making host its cluster.
+// A self-addressed endpoint on the very same hostname is not counted: that
+// collision is the domain unique index's to refuse, as a conflict. Case-folded,
+// since a settings row written before hostnames were normalised may carry
+// capitals; one row per account, so the scan is cheap.
+func (s *SqlStore) HasGatewayClusterPinnedByOtherAccount(ctx context.Context, host, accountID string) (bool, error) {
+	return s.countGatewayRowsByOtherAccount(ctx, "LOWER(proxy_address) = LOWER(?) AND LOWER(domain) <> LOWER(proxy_address)", host, accountID)
+}
+
+// HasGatewayEndpointByOtherAccount reports whether host is another account's
+// agent network endpoint hostname (domain). Case-folded for the same reason as
+// HasGatewayClusterPinnedByOtherAccount.
+func (s *SqlStore) HasGatewayEndpointByOtherAccount(ctx context.Context, host, accountID string) (bool, error) {
+	return s.countGatewayRowsByOtherAccount(ctx, "LOWER(domain) = LOWER(?)", host, accountID)
+}
+
+func (s *SqlStore) countGatewayRowsByOtherAccount(ctx context.Context, predicate, host, accountID string) (bool, error) {
+	var count int64
+	result := s.db.
+		Model(&agentNetworkTypes.Settings{}).
+		Where(predicate+" AND account_id != ?", host, accountID).
+		Count(&count)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to check agent network gateway claims at host: %v", result.Error)
+		return false, status.Errorf(status.Internal, "check agent network gateway claims at host")
+	}
+	return count > 0, nil
+}
+
+// GetAgentNetworkSettingsByProxyAddress returns every Settings row whose
+// gateway is served by the proxy declaring the given cluster address. Used by
+// cluster-scoped synthesis to find the accounts a shared proxy serves.
+func (s *SqlStore) GetAgentNetworkSettingsByProxyAddress(ctx context.Context, lockStrength LockingStrength, proxyAddress string) ([]*agentNetworkTypes.Settings, error) {
 	tx := s.db
 	if lockStrength != LockingStrengthNone {
 		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
 	}
 
 	var settings []*agentNetworkTypes.Settings
-	result := tx.Find(&settings, "cluster = ?", cluster)
+	result := tx.Find(&settings, "proxy_address = ?", proxyAddress)
 	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get agent network settings by cluster from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get agent network settings by cluster from store")
+		log.WithContext(ctx).Errorf("failed to get agent network settings by proxy address from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network settings by proxy address from store")
 	}
 
 	return settings, nil
 }
 
+// GetAgentNetworkSettingsByDomain resolves the single Settings row holding the
+// given endpoint hostname — a point query on the domain unique index. Returns
+// status.NotFound when no account owns the domain.
+func (s *SqlStore) GetAgentNetworkSettingsByDomain(ctx context.Context, lockStrength LockingStrength, domain string) (*agentNetworkTypes.Settings, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var settings agentNetworkTypes.Settings
+	result := tx.Take(&settings, "domain = ?", domain)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "agent network settings for domain %s not found", domain)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get agent network settings by domain from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network settings by domain from store")
+	}
+
+	return &settings, nil
+}
+
+// CreateAgentNetworkSettings inserts a new settings row.
+//
+// Unlike SaveAgentNetworkSettings (an upsert) this is a plain INSERT, and it
+// returns the driver error unwrapped. Both properties are required by the
+// bootstrap allocator: an upsert would overwrite whichever row it collided
+// with, and the allocator classifies the rejection by matching the driver's
+// message — a unique violation on the account primary key means a concurrent
+// bootstrap for the same account won, and one on the domain index means the
+// hostname is taken.
+func (s *SqlStore) CreateAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {
+	if err := s.db.Create(settings).Error; err != nil {
+		log.WithContext(ctx).Debugf("failed to create agent network settings: %v", err)
+		return err
+	}
+	return nil
+}
+
 // SaveAgentNetworkSettings upserts the per-account Agent Network
 // settings row.
 func (s *SqlStore) SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {
@@ -346,6 +416,25 @@ func (s *SqlStore) SaveAgentNetworkSettings(ctx context.Context, settings *agent
 	return nil
 }
 
+// DeleteAgentNetworkSettings removes the per-account Agent Network settings
+// row, releasing the account's endpoint. Returns status.NotFound when no row
+// exists. The guards on the delete (no providers, no proxy actively serving
+// the endpoint) live in the manager, which runs this inside a transaction
+// after re-checking them under a row lock.
+func (s *SqlStore) DeleteAgentNetworkSettings(ctx context.Context, accountID string) error {
+	result := s.db.Delete(&agentNetworkTypes.Settings{}, "account_id = ?", accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete agent network settings from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete agent network settings from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.Errorf(status.NotFound, "agent network settings for account %s not found", accountID)
+	}
+
+	return nil
+}
+
 // IncrementAgentNetworkConsumption atomically upserts the consumption
 // row keyed on (account, dim_kind, dim_id, window_seconds, window_start)
 // and adds the supplied deltas. Concurrent calls from multiple proxy
@@ -530,7 +619,7 @@ func (s *SqlStore) IncrementAgentNetworkConsumptionBatch(
 	}
 
 	const tbl = "agent_network_consumption"
-	err := s.db.Transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		for _, k := range keys {
 			if k.DimID == "" || k.WindowSeconds <= 0 {
 				return status.Errorf(status.InvalidArgument, "dim_id and window_seconds must be set")
@@ -574,6 +663,21 @@ func (s *SqlStore) IncrementAgentNetworkConsumptionBatch(
 	return nil
 }
 
+// DeleteAgentNetworkConsumptionOfDeletedAccounts deletes every consumption counter whose
+// account no longer exists and returns the number of rows deleted. Counters grow with
+// traffic, so they are swept in the background instead of in the account-deletion
+// transaction, and the sweep also catches counters a proxy writes after the deletion.
+func (s *SqlStore) DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx context.Context) (int64, error) {
+	res := s.db.
+		Where("NOT EXISTS (SELECT 1 FROM accounts WHERE accounts.id = agent_network_consumption.account_id)").
+		Delete(&agentNetworkTypes.Consumption{})
+	if res.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete agent-network consumption of deleted accounts: %v", res.Error)
+		return 0, status.Errorf(status.Internal, "failed to delete agent-network consumption of deleted accounts")
+	}
+	return res.RowsAffected, nil
+}
+
 // ListAgentNetworkConsumption returns every consumption row recorded
 // for the account, ordered by window_start descending. Backs the
 // dashboard's basic counter view.
diff --git a/management/server/store/sql_store_agentnetwork_accesslog_test.go b/management/server/store/sql_store_agentnetwork_accesslog_test.go
index 793c82d79..b8a3560e0 100644
--- a/management/server/store/sql_store_agentnetwork_accesslog_test.go
+++ b/management/server/store/sql_store_agentnetwork_accesslog_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/types"
 )
 
 // TestAgentNetworkUsage_RealStore_RoundTrip drives CreateAgentNetworkUsage and
@@ -37,7 +38,7 @@ func TestAgentNetworkUsage_RealStore_RoundTrip(t *testing.T) {
 		InputTokens:        1200,
 		OutputTokens:       640,
 		TotalTokens:        1840,
-		CostUSD:            0.0231,
+		InputCostUSD:       0.0231,
 	}
 	usageGroups := []agentNetworkTypes.AgentNetworkUsageGroup{
 		{UsageID: usage.ID, GroupID: "grp-eng", AccountID: accountID},
@@ -71,7 +72,7 @@ func TestAgentNetworkUsage_RealStore_RoundTrip(t *testing.T) {
 		InputTokens:  1200,
 		OutputTokens: 640,
 		TotalTokens:  1840,
-		CostUSD:      0.0231,
+		InputCostUSD: 0.0231,
 	}
 	entryGroups := []agentNetworkTypes.AgentNetworkAccessLogGroup{
 		{LogID: entry.ID, GroupID: "grp-eng", AccountID: accountID},
@@ -127,7 +128,7 @@ func TestAgentNetworkUsageOverview_DailyAggregation(t *testing.T) {
 	mk := func(id string, ts time.Time, model string, in, out int64, cost float64) *agentNetworkTypes.AgentNetworkUsage {
 		return &agentNetworkTypes.AgentNetworkUsage{
 			ID: id, AccountID: accountID, Timestamp: ts, Model: model,
-			InputTokens: in, OutputTokens: out, TotalTokens: in + out, CostUSD: cost,
+			InputTokens: in, OutputTokens: out, TotalTokens: in + out, InputCostUSD: cost,
 		}
 	}
 	require.NoError(t, s.CreateAgentNetworkUsage(ctx, mk("u1", day1, "gpt-4o", 100, 50, 0.10), nil))
@@ -143,7 +144,7 @@ func TestAgentNetworkUsageOverview_DailyAggregation(t *testing.T) {
 	assert.Equal(t, "2026-05-05", buckets[0].PeriodStart, "oldest-first ordering")
 	assert.Equal(t, int64(300), buckets[0].InputTokens, "same-day input tokens summed")
 	assert.Equal(t, int64(130), buckets[0].OutputTokens)
-	assert.InDelta(t, 0.30, buckets[0].CostUSD, 1e-9, "same-day cost summed")
+	assert.InDelta(t, 0.30, buckets[0].TotalCostUSD(), 1e-9, "same-day cost summed")
 	assert.Equal(t, "2026-05-06", buckets[1].PeriodStart)
 	assert.Equal(t, int64(15), buckets[1].TotalTokens)
 
@@ -174,7 +175,7 @@ func TestAgentNetworkAccessLogSessions_RealStore(t *testing.T) {
 			ID: id, AccountID: accountID, ServiceID: "svc", Timestamp: ts,
 			UserID: user, StatusCode: 200, Provider: provider, Model: model,
 			SessionID: session, Decision: decision,
-			InputTokens: 100, OutputTokens: 50, TotalTokens: 150, CostUSD: cost,
+			InputTokens: 100, OutputTokens: 50, TotalTokens: 150, InputCostUSD: cost,
 		}
 	}
 
@@ -207,7 +208,7 @@ func TestAgentNetworkAccessLogSessions_RealStore(t *testing.T) {
 	s1 := sessions[2]
 	assert.Equal(t, 2, s1.RequestCount, "s1 has two requests")
 	assert.Equal(t, int64(300), s1.TotalTokens, "tokens summed across the session")
-	assert.InDelta(t, 0.30, s1.CostUSD, 1e-9, "cost summed across the session")
+	assert.InDelta(t, 0.30, s1.TotalCostUSD(), 1e-9, "cost summed across the session")
 	assert.Equal(t, "alice", s1.UserID)
 	assert.Equal(t, "allow", s1.Decision)
 	// SQLite hands times back in time.Local; normalise to UTC so the instant is
@@ -300,3 +301,37 @@ func TestDeleteOldAgentNetworkAccessLogs(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, usage, 1, "usage record for the deleted log must survive")
 }
+
+// TestDeleteAgentNetworkConsumptionOfDeletedAccounts verifies that the sweep removes the
+// consumption counters of accounts that no longer exist and leaves live accounts' counters,
+// including those of a live account without a settings row.
+func TestDeleteAgentNetworkConsumptionOfDeletedAccounts(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, s Store) {
+		ctx := context.Background()
+		const (
+			liveAccountID    = "acc-anet-consumption-live"
+			deletedAccountID = "acc-anet-consumption-deleted"
+		)
+		require.NoError(t, s.SaveAccount(ctx, &types.Account{Id: liveAccountID}))
+
+		windowStart := time.Now().UTC().Truncate(time.Hour)
+		for _, accountID := range []string{liveAccountID, deletedAccountID} {
+			for _, dimID := range []string{"user-1", "user-2"} {
+				require.NoError(t, s.IncrementAgentNetworkConsumption(ctx, accountID,
+					agentNetworkTypes.DimensionUser, dimID, 3600, windowStart, 10, 5, 0.01))
+			}
+		}
+
+		deleted, err := s.DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, int64(2), deleted, "both of the deleted account's counters should be removed")
+
+		rows, err := s.ListAgentNetworkConsumption(ctx, LockingStrengthNone, deletedAccountID)
+		require.NoError(t, err)
+		assert.Empty(t, rows, "the deleted account should have no consumption counters left")
+
+		rows, err = s.ListAgentNetworkConsumption(ctx, LockingStrengthNone, liveAccountID)
+		require.NoError(t, err)
+		assert.Len(t, rows, 2, "the live account's consumption counters should survive")
+	})
+}
diff --git a/management/server/store/sql_store_agentnetwork_budgetrule_test.go b/management/server/store/sql_store_agentnetwork_budgetrule_test.go
index 3bf7b797d..d1ad8af9a 100644
--- a/management/server/store/sql_store_agentnetwork_budgetrule_test.go
+++ b/management/server/store/sql_store_agentnetwork_budgetrule_test.go
@@ -88,9 +88,9 @@ func TestAgentNetworkSettings_RealStore_CollectionTogglesRoundTrip(t *testing.T)
 
 	const accountID = "acc-settings-toggles"
 	require.NoError(t, s.SaveAgentNetworkSettings(ctx, &agentNetworkTypes.Settings{
-		AccountID: accountID,
-		Cluster:   "eu.proxy.netbird.io",
-		Subdomain: "violet",
+		AccountID:    accountID,
+		Domain:       "violet.eu.proxy.netbird.io",
+		ProxyAddress: "eu.proxy.netbird.io",
 	}))
 
 	got, err := s.GetAgentNetworkSettings(ctx, LockingStrengthNone, accountID)
diff --git a/management/server/store/sql_store_custom_domain.go b/management/server/store/sql_store_custom_domain.go
new file mode 100644
index 000000000..5b7cbf519
--- /dev/null
+++ b/management/server/store/sql_store_custom_domain.go
@@ -0,0 +1,178 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/rs/xid"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// GetCustomDomainsCounts returns the total and validated custom domain counts.
+func (s *SqlStore) GetCustomDomainsCounts(ctx context.Context) (int64, int64, error) {
+	var total, validated int64
+	if err := s.db.Model(&domain.Domain{}).Count(&total).Error; err != nil {
+		return 0, 0, err
+	}
+	if err := s.db.Model(&domain.Domain{}).Where("validated = ?", true).Count(&validated).Error; err != nil {
+		return 0, 0, err
+	}
+	return total, validated, nil
+}
+
+func (s *SqlStore) GetCustomDomain(ctx context.Context, accountID string, domainID string) (*domain.Domain, error) {
+	tx := s.db
+
+	customDomain := &domain.Domain{}
+	result := tx.Take(&customDomain, accountAndIDQueryCondition, accountID, domainID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "custom domain %s not found", domainID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get custom domain from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get custom domain from store")
+	}
+
+	return customDomain, nil
+}
+
+func (s *SqlStore) ListFreeDomains(ctx context.Context, accountID string) ([]string, error) {
+	return nil, nil
+}
+
+func (s *SqlStore) ListCustomDomains(ctx context.Context, accountID string) ([]*domain.Domain, error) {
+	tx := s.db
+
+	var domains []*domain.Domain
+	result := tx.Find(&domains, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get reverse proxy custom domains from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get reverse proxy custom domains from store")
+	}
+
+	return domains, nil
+}
+
+// GetCustomDomainByName returns the custom domain row holding the given name,
+// regardless of which account owns it.
+func (s *SqlStore) GetCustomDomainByName(ctx context.Context, domainName string) (*domain.Domain, error) {
+	customDomain := &domain.Domain{}
+	result := s.db.Take(customDomain, "domain = ?", domainName)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "custom domain %s not found", domainName)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get custom domain by name from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get custom domain from store")
+	}
+
+	return customDomain, nil
+}
+
+func (s *SqlStore) CreateCustomDomain(ctx context.Context, accountID string, domainName string, targetCluster string, validated bool) (*domain.Domain, error) {
+	newDomain := &domain.Domain{
+		ID:            xid.New().String(), // Generate our own ID because gorm doesn't always configure the database to handle this for us.
+		Domain:        domainName,
+		AccountID:     accountID,
+		TargetCluster: targetCluster,
+		Type:          domain.TypeCustom,
+		Validated:     validated,
+	}
+	if !validated {
+		expiresAt := time.Now().UTC().Add(domain.ValidationTTL)
+		newDomain.ValidationExpiresAt = &expiresAt
+	}
+	result := s.db.Create(newDomain)
+	if result.Error != nil {
+		// The unique index is the last guard when two requests clear the
+		// manager's availability check at the same time. The one that loses the
+		// insert is a conflict, not an internal failure.
+		var count int64
+		if err := s.db.Model(&domain.Domain{}).Where("domain = ?", domainName).Count(&count).Error; err == nil && count > 0 {
+			// The insert error is logged even on this path: the name being taken
+			// is what the caller has to act on, but if the insert also failed for
+			// an unrelated reason the operator still needs to see it.
+			log.WithContext(ctx).Warnf("create reverse proxy custom domain %s rejected, name already registered: %v", domainName, result.Error)
+			return nil, status.Errorf(status.AlreadyExists, "domain %s is already registered", domainName)
+		}
+
+		log.WithContext(ctx).Errorf("failed to create reverse proxy custom domain to store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to create reverse proxy custom domain to store")
+	}
+
+	return newDomain, nil
+}
+
+// UpdateCustomDomain completes validation only while the original registration is pending.
+func (s *SqlStore) UpdateCustomDomain(ctx context.Context, accountID string, d *domain.Domain) (*domain.Domain, error) {
+	if !d.Validated {
+		return nil, status.Errorf(status.InvalidArgument, "custom domain update must complete validation")
+	}
+	result := s.db.WithContext(ctx).Model(&domain.Domain{}).
+		Where(accountAndIDQueryCondition, accountID, d.ID).
+		Where("domain = ? AND target_cluster = ?", d.Domain, d.TargetCluster).
+		Where("validated = ? AND validation_expires_at > ?", false, time.Now().UTC()).
+		Update("validated", true)
+	if result.Error != nil {
+		return nil, fmt.Errorf("validate custom domain in store: %w", result.Error)
+	}
+	if result.RowsAffected == 0 {
+		return nil, status.Errorf(status.PreconditionFailed, "custom domain registration is no longer pending validation")
+	}
+
+	return d, nil
+}
+
+// LockCustomDomains holds shared locks on registrations covering a service until commit.
+func (s *SqlStore) LockCustomDomains(ctx context.Context, accountID string, serviceDomain nbdomain.Domain) ([]*domain.Domain, error) {
+	var names []string
+	for name := serviceDomain.PunycodeString(); name != ""; {
+		names = append(names, name)
+		_, name, _ = strings.Cut(name, ".")
+	}
+
+	var domains []*domain.Domain
+	if err := s.db.WithContext(ctx).Clauses(clause.Locking{Strength: string(LockingStrengthShare)}).
+		Where(accountIDCondition, accountID).Where("domain IN ?", names).
+		Order("id").Find(&domains).Error; err != nil {
+		return nil, fmt.Errorf("lock custom domains: %w", err)
+	}
+	return domains, nil
+}
+
+// DeleteCustomDomain removes a registration only when no service uses its namespace.
+func (s *SqlStore) DeleteCustomDomain(ctx context.Context, accountID string, domainID string) error {
+	return s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		var d domain.Domain
+		// Service writes hold a shared lock on this row through commit, so neither
+		// operation can proceed against the other's outdated view of the domain.
+		if err := tx.Clauses(clause.Locking{Strength: string(LockingStrengthUpdate)}).
+			Take(&d, accountAndIDQueryCondition, accountID, domainID).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return status.Errorf(status.NotFound, "custom domain not found")
+			}
+			return fmt.Errorf("lock custom domain for deletion: %w", err)
+		}
+
+		result := tx.Where(accountAndIDQueryCondition, accountID, domainID).
+			Where("NOT EXISTS (?)", customDomainServices(tx, &d).Select("1")).Delete(&domain.Domain{})
+		if result.Error != nil {
+			return fmt.Errorf("delete custom domain: %w", result.Error)
+		}
+		if result.RowsAffected == 0 {
+			return status.Errorf(status.PreconditionFailed, "custom domain has dependent services; delete or move them before deleting the domain")
+		}
+		return nil
+	})
+}
diff --git a/management/server/store/sql_store_custom_domain_test.go b/management/server/store/sql_store_custom_domain_test.go
new file mode 100644
index 000000000..a274c7271
--- /dev/null
+++ b/management/server/store/sql_store_custom_domain_test.go
@@ -0,0 +1,182 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/types"
+	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestLockCustomDomains_ConcurrentServices(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		if store.GetStoreEngine() == types.SqliteStoreEngine {
+			t.Skip("SQLite serializes transactions on one connection")
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel()
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		_, err := store.CreateCustomDomain(ctx, "owner", "one.example.com", "cluster", true)
+		require.NoError(t, err)
+		_, err = store.CreateCustomDomain(ctx, "owner", "two.example.com", "cluster", true)
+		require.NoError(t, err)
+
+		locked := make(chan error, 1)
+		release := make(chan struct{})
+		done := make(chan error, 1)
+		go func() {
+			done <- store.ExecuteInTransaction(ctx, func(tx Store) error {
+				_, err := tx.LockCustomDomains(ctx, "owner", "app.one.example.com")
+				locked <- err
+				if err != nil {
+					return err
+				}
+				select {
+				case <-release:
+					return nil
+				case <-ctx.Done():
+					return ctx.Err()
+				}
+			})
+		}()
+		var lockErr error
+		select {
+		case lockErr = <-locked:
+		case err := <-done:
+			t.Fatalf("transaction ended before locking: %v", err)
+		}
+		writeCtx, writeCancel := context.WithTimeout(ctx, 3*time.Second)
+		defer writeCancel()
+		var writeErr error
+		for _, name := range []nbdomain.Domain{"app.one.example.com", "app.two.example.com"} {
+			writeErr = store.ExecuteInTransaction(writeCtx, func(tx Store) error {
+				if _, err := tx.LockCustomDomains(writeCtx, "owner", name); err != nil {
+					return err
+				}
+				return tx.CreateService(writeCtx, &rpservice.Service{
+					ID: name.PunycodeString(), AccountID: "owner", Domain: name.PunycodeString(),
+				})
+			})
+			if writeErr != nil {
+				break
+			}
+		}
+		close(release)
+		require.NoError(t, <-done)
+		require.NoError(t, lockErr)
+		require.NoError(t, writeErr, "domain authorization locks must allow concurrent service writes")
+		services, err := store.GetAccountServices(ctx, LockingStrengthNone, "owner")
+		require.NoError(t, err)
+		assert.Len(t, services, 2, "both services must commit while the first domain is locked")
+	})
+}
+
+func TestDeleteCustomDomain_ServiceDependencies(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		d, err := store.CreateCustomDomain(ctx, "owner", "example.com", "cluster", true)
+		require.NoError(t, err)
+		svc := &rpservice.Service{ID: "service", AccountID: "owner", Domain: "APP.EXAMPLE.COM."}
+		require.NoError(t, store.CreateService(ctx, svc))
+
+		err = store.DeleteCustomDomain(ctx, "other", d.ID)
+		require.Error(t, err)
+		sErr, ok := status.FromError(err)
+		require.True(t, ok, "cross-account deletion must return a typed error")
+		assert.Equal(t, status.NotFound, sErr.Type(), "cross-account deletion must not reveal dependencies")
+
+		err = store.DeleteCustomDomain(ctx, "owner", d.ID)
+		require.Error(t, err)
+		sErr, ok = status.FromError(err)
+		require.True(t, ok, "dependent services must return a typed error")
+		assert.Equal(t, status.PreconditionFailed, sErr.Type(), "deletion must fail until services are removed")
+		stored, err := store.GetCustomDomain(ctx, "owner", d.ID)
+		require.NoError(t, err)
+		assert.True(t, stored.Validated, "rejected deletion must preserve validation")
+
+		require.NoError(t, store.DeleteService(ctx, "owner", svc.ID))
+		require.NoError(t, store.DeleteCustomDomain(ctx, "owner", d.ID))
+		_, err = store.GetCustomDomain(ctx, "owner", d.ID)
+		require.Error(t, err, "the registration must be gone after successful deletion")
+	})
+}
+
+func TestDeleteCustomDomain_OtherAccountSubdomainIsNotADependency(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "other", "admin", "")))
+
+		// Registrations are unique by name, so a second account can hold a
+		// subdomain of the first account's registration and serve from it.
+		parent, err := store.CreateCustomDomain(ctx, "owner", "example.com", "cluster", true)
+		require.NoError(t, err)
+		_, err = store.CreateCustomDomain(ctx, "other", "team.example.com", "cluster", true)
+		require.NoError(t, err)
+		require.NoError(t, store.CreateService(ctx, &rpservice.Service{
+			ID: "service", AccountID: "other", Domain: "app.team.example.com",
+		}))
+
+		require.NoError(t, store.DeleteCustomDomain(ctx, "owner", parent.ID),
+			"another account's service must not hold the registration open")
+	})
+}
+
+func TestDeleteCustomDomain_ConcurrentServiceCreation(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		for i := range 10 {
+			d, err := store.CreateCustomDomain(ctx, "owner", fmt.Sprintf("app%d.example.com", i), "cluster", true)
+			require.NoError(t, err)
+			svc := &rpservice.Service{ID: fmt.Sprintf("service-%d", i), AccountID: "owner", Domain: "nested." + d.Domain}
+			start := make(chan struct{})
+			created := make(chan error, 1)
+			deleted := make(chan error, 1)
+			go func() {
+				<-start
+				created <- store.ExecuteInTransaction(ctx, func(tx Store) error {
+					domains, err := tx.LockCustomDomains(ctx, "owner", nbdomain.Domain(svc.Domain))
+					if err != nil {
+						return err
+					}
+					for _, candidate := range domains {
+						if candidate.ID == d.ID && candidate.Validated {
+							return tx.CreateService(ctx, svc)
+						}
+					}
+					return status.Errorf(status.PreconditionFailed, "registration was deleted")
+				})
+			}()
+			go func() {
+				<-start
+				deleted <- store.DeleteCustomDomain(ctx, "owner", d.ID)
+			}()
+			close(start)
+			createErr, deleteErr := <-created, <-deleted
+			require.True(t, createErr == nil || deleteErr == nil, "one operation must succeed: create=%v, delete=%v", createErr, deleteErr)
+			if createErr == nil {
+				require.Error(t, deleteErr, "a committed service must block deletion")
+				stored, err := store.GetCustomDomain(ctx, "owner", d.ID)
+				require.NoError(t, err)
+				assert.True(t, stored.Validated, "the service must retain its authorization")
+				require.NoError(t, store.DeleteService(ctx, "owner", svc.ID))
+				require.NoError(t, store.DeleteCustomDomain(ctx, "owner", d.ID))
+				continue
+			}
+			require.NoError(t, deleteErr)
+			services, err := store.GetAccountServices(ctx, LockingStrengthNone, "owner")
+			require.NoError(t, err)
+			assert.Empty(t, services, "a deleted registration must not leave a new service")
+		}
+	})
+}
diff --git a/management/server/store/sql_store_dns_record.go b/management/server/store/sql_store_dns_record.go
new file mode 100644
index 000000000..8a8fc00a1
--- /dev/null
+++ b/management/server/store/sql_store_dns_record.go
@@ -0,0 +1,109 @@
+package store
+
+import (
+	"context"
+	"errors"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) CreateDNSRecord(ctx context.Context, record *records.Record) error {
+	result := s.db.Create(record)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to create dns record to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to create dns record to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) UpdateDNSRecord(ctx context.Context, record *records.Record) error {
+	result := s.db.Select("*").Save(record)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to update dns record to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to update dns record to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) DeleteDNSRecord(ctx context.Context, accountID, zoneID, recordID string) error {
+	result := s.db.Delete(&records.Record{}, "account_id = ? AND zone_id = ? AND id = ?", accountID, zoneID, recordID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete dns record from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete dns record from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewDNSRecordNotFoundError(recordID)
+	}
+
+	return nil
+}
+
+func (s *SqlStore) GetDNSRecordByID(ctx context.Context, lockStrength LockingStrength, accountID, zoneID, recordID string) (*records.Record, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var record *records.Record
+	result := tx.Where("account_id = ? AND zone_id = ? AND id = ?", accountID, zoneID, recordID).Take(&record)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewDNSRecordNotFoundError(recordID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get dns record from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get dns record from store")
+	}
+
+	return record, nil
+}
+
+func (s *SqlStore) GetZoneDNSRecords(ctx context.Context, lockStrength LockingStrength, accountID, zoneID string) ([]*records.Record, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var recordsList []*records.Record
+	result := tx.Where("account_id = ? AND zone_id = ?", accountID, zoneID).Find(&recordsList)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get zone dns records from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get zone dns records from store")
+	}
+
+	return recordsList, nil
+}
+
+func (s *SqlStore) GetZoneDNSRecordsByName(ctx context.Context, lockStrength LockingStrength, accountID, zoneID, name string) ([]*records.Record, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var recordsList []*records.Record
+	result := tx.Where("account_id = ? AND zone_id = ? AND name = ?", accountID, zoneID, name).Find(&recordsList)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get zone dns records by name from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get zone dns records by name from store")
+	}
+
+	return recordsList, nil
+}
+
+func (s *SqlStore) DeleteZoneDNSRecords(ctx context.Context, accountID, zoneID string) error {
+	result := s.db.Delete(&records.Record{}, "account_id = ? AND zone_id = ?", accountID, zoneID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete zone dns records from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete zone dns records from store")
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_dns_record_test.go b/management/server/store/sql_store_dns_record_test.go
new file mode 100644
index 000000000..045dca1e9
--- /dev/null
+++ b/management/server/store/sql_store_dns_record_test.go
@@ -0,0 +1,260 @@
+package store
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestSqlStore_CreateDNSRecord(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	record := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
+
+	err = store.CreateDNSRecord(context.Background(), record)
+	require.NoError(t, err)
+
+	savedRecord, err := store.GetDNSRecordByID(context.Background(), LockingStrengthNone, accountID, zone.ID, record.ID)
+	require.NoError(t, err)
+	require.NotNil(t, savedRecord)
+	assert.Equal(t, record.ID, savedRecord.ID)
+	assert.Equal(t, record.Name, savedRecord.Name)
+	assert.Equal(t, record.Type, savedRecord.Type)
+	assert.Equal(t, record.Content, savedRecord.Content)
+	assert.Equal(t, record.TTL, savedRecord.TTL)
+	assert.Equal(t, zone.ID, savedRecord.ZoneID)
+}
+
+func TestSqlStore_GetDNSRecordByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	record := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
+	err = store.CreateDNSRecord(context.Background(), record)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name        string
+		accountID   string
+		zoneID      string
+		recordID    string
+		expectError bool
+	}{
+		{
+			name:        "retrieve existing record",
+			accountID:   accountID,
+			zoneID:      zone.ID,
+			recordID:    record.ID,
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing record",
+			accountID:   accountID,
+			zoneID:      zone.ID,
+			recordID:    "non-existing",
+			expectError: true,
+		},
+		{
+			name:        "retrieve with empty record ID",
+			accountID:   accountID,
+			zoneID:      zone.ID,
+			recordID:    "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			savedRecord, err := store.GetDNSRecordByID(context.Background(), LockingStrengthNone, tt.accountID, tt.zoneID, tt.recordID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, savedRecord)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, savedRecord)
+				assert.Equal(t, tt.recordID, savedRecord.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_GetZoneDNSRecords(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	recordA := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
+	err = store.CreateDNSRecord(context.Background(), recordA)
+	require.NoError(t, err)
+
+	recordAAAA := records.NewRecord(accountID, zone.ID, "ipv6.example.com", records.RecordTypeAAAA, "2001:db8::1", 300)
+	err = store.CreateDNSRecord(context.Background(), recordAAAA)
+	require.NoError(t, err)
+
+	recordCNAME := records.NewRecord(accountID, zone.ID, "alias.example.com", records.RecordTypeCNAME, "www.example.com", 300)
+	err = store.CreateDNSRecord(context.Background(), recordCNAME)
+	require.NoError(t, err)
+
+	allRecords, err := store.GetZoneDNSRecords(context.Background(), LockingStrengthNone, accountID, zone.ID)
+	require.NoError(t, err)
+	require.NotNil(t, allRecords)
+	assert.Equal(t, 3, len(allRecords))
+
+	recordIDs := make(map[string]bool)
+	for _, r := range allRecords {
+		recordIDs[r.ID] = true
+	}
+	assert.True(t, recordIDs[recordA.ID])
+	assert.True(t, recordIDs[recordAAAA.ID])
+	assert.True(t, recordIDs[recordCNAME.ID])
+}
+
+func TestSqlStore_GetZoneDNSRecordsByName(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	record1 := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
+	err = store.CreateDNSRecord(context.Background(), record1)
+	require.NoError(t, err)
+
+	record2 := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeAAAA, "2001:db8::1", 300)
+	err = store.CreateDNSRecord(context.Background(), record2)
+	require.NoError(t, err)
+
+	record3 := records.NewRecord(accountID, zone.ID, "mail.example.com", records.RecordTypeA, "192.168.1.2", 600)
+	err = store.CreateDNSRecord(context.Background(), record3)
+	require.NoError(t, err)
+
+	recordsByName, err := store.GetZoneDNSRecordsByName(context.Background(), LockingStrengthNone, accountID, zone.ID, "www.example.com")
+	require.NoError(t, err)
+	require.NotNil(t, recordsByName)
+	assert.Equal(t, 2, len(recordsByName))
+
+	for _, r := range recordsByName {
+		assert.Equal(t, "www.example.com", r.Name)
+	}
+}
+
+func TestSqlStore_UpdateDNSRecord(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	record := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
+	err = store.CreateDNSRecord(context.Background(), record)
+	require.NoError(t, err)
+
+	record.Name = "api.example.com"
+	record.Content = "192.168.1.100"
+	record.TTL = 600
+
+	err = store.UpdateDNSRecord(context.Background(), record)
+	require.NoError(t, err)
+
+	updatedRecord, err := store.GetDNSRecordByID(context.Background(), LockingStrengthNone, accountID, zone.ID, record.ID)
+	require.NoError(t, err)
+	require.NotNil(t, updatedRecord)
+	assert.Equal(t, "api.example.com", updatedRecord.Name)
+	assert.Equal(t, "192.168.1.100", updatedRecord.Content)
+	assert.Equal(t, 600, updatedRecord.TTL)
+}
+
+func TestSqlStore_DeleteDNSRecord(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	record := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
+	err = store.CreateDNSRecord(context.Background(), record)
+	require.NoError(t, err)
+
+	err = store.DeleteDNSRecord(context.Background(), accountID, zone.ID, record.ID)
+	require.NoError(t, err)
+
+	deletedRecord, err := store.GetDNSRecordByID(context.Background(), LockingStrengthNone, accountID, zone.ID, record.ID)
+	require.Error(t, err)
+	require.Nil(t, deletedRecord)
+	sErr, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, sErr.Type(), status.NotFound)
+}
+
+func TestSqlStore_DeleteZoneDNSRecords(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	record1 := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
+	err = store.CreateDNSRecord(context.Background(), record1)
+	require.NoError(t, err)
+
+	record2 := records.NewRecord(accountID, zone.ID, "mail.example.com", records.RecordTypeA, "192.168.1.2", 600)
+	err = store.CreateDNSRecord(context.Background(), record2)
+	require.NoError(t, err)
+
+	allRecords, err := store.GetZoneDNSRecords(context.Background(), LockingStrengthNone, accountID, zone.ID)
+	require.NoError(t, err)
+	assert.Equal(t, 2, len(allRecords))
+
+	err = store.DeleteZoneDNSRecords(context.Background(), accountID, zone.ID)
+	require.NoError(t, err)
+
+	remainingRecords, err := store.GetZoneDNSRecords(context.Background(), LockingStrengthNone, accountID, zone.ID)
+	require.NoError(t, err)
+	assert.Equal(t, 0, len(remainingRecords))
+}
diff --git a/management/server/store/sql_store_domain_expiration.go b/management/server/store/sql_store_domain_expiration.go
new file mode 100644
index 000000000..e7b09f4ad
--- /dev/null
+++ b/management/server/store/sql_store_domain_expiration.go
@@ -0,0 +1,63 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// GetExpiredCustomDomains lists pending registrations in stable batches across accounts.
+func (s *SqlStore) GetExpiredCustomDomains(ctx context.Context, now time.Time, afterID domain.ID, limit int) ([]*domain.Domain, error) {
+	var domains []*domain.Domain
+	result := s.db.WithContext(ctx).
+		Where("validated = ? AND validation_expires_at <= ? AND id > ?", false, now, string(afterID)).
+		Order("id").Limit(limit).Find(&domains)
+	if result.Error != nil {
+		return nil, fmt.Errorf("list expired custom domains: %w", result.Error)
+	}
+	return domains, nil
+}
+
+// DeleteExpiredCustomDomain deletes an expired registration only if no service uses its namespace.
+func (s *SqlStore) DeleteExpiredCustomDomain(ctx context.Context, d *domain.Domain, now time.Time) (bool, error) {
+	db := s.db.WithContext(ctx)
+	services := customDomainServices(db, d)
+	result := db.Where(accountAndIDQueryCondition, d.AccountID, d.ID).
+		Where("domain = ? AND validated = ? AND validation_expires_at <= ?", d.Domain, false, now).
+		Where("NOT EXISTS (?)", services.Select("1")).Delete(&domain.Domain{})
+	if result.Error != nil {
+		return false, fmt.Errorf("delete expired custom domain: %w", result.Error)
+	}
+	if result.RowsAffected > 0 {
+		return true, nil
+	}
+	var count int64
+	if err := customDomainServices(db, d).Count(&count).Error; err != nil {
+		return false, fmt.Errorf("check expired custom domain services: %w", err)
+	}
+	if count > 0 {
+		return false, status.Errorf(status.PreconditionFailed, "expired custom domain still has dependent services")
+	}
+	return false, nil
+}
+
+func customDomainServices(db *gorm.DB, d *domain.Domain) *gorm.DB {
+	name := strings.ToLower(strings.TrimSuffix(d.Domain, "."))
+	// Shared domain validation permits underscores, and older rows may contain
+	// other LIKE metacharacters.
+	escaped := strings.NewReplacer("!", "!!", "%", "!%", "_", "!_").Replace(name)
+	// Registrations are unique by name, so another account can hold a subdomain
+	// of this one and serve from it. Its services derive their cluster from that
+	// account's own registration and are not dependents of this one.
+	return db.Model(&rpservice.Service{}).Where(accountIDCondition, d.AccountID).Where(
+		"LOWER(domain) IN ? OR LOWER(domain) LIKE ? ESCAPE '!' OR LOWER(domain) LIKE ? ESCAPE '!'",
+		[]string{name, name + "."}, "%."+escaped, "%."+escaped+".",
+	)
+}
diff --git a/management/server/store/sql_store_domain_expiration_test.go b/management/server/store/sql_store_domain_expiration_test.go
new file mode 100644
index 000000000..7dcfb0562
--- /dev/null
+++ b/management/server/store/sql_store_domain_expiration_test.go
@@ -0,0 +1,78 @@
+package store
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+)
+
+func TestDeleteExpiredCustomDomain_ServiceDependencies(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		now := time.Now().UTC()
+		db := store.(*SqlStore).db
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		for _, tt := range []struct {
+			name        string
+			domainName  string
+			serviceHost string
+			protected   bool
+		}{
+			{"exact", "example.com", "example.com", true},
+			{"subdomain", "example.com", "deep.app.example.com", true},
+			{"case", "example.com", "APP.EXAMPLE.COM.", true},
+			{"suffix-boundary", "example.com", "notexample.com", false},
+			{"literal underscore", "a_b.example.com", "app.a_b.example.com", true},
+			{"underscore wildcard", "a_b.example.com", "app.axb.example.com", false},
+			{"legacy percent wildcard", "a%b.example.com", "app.axxb.example.com", false},
+			{"legacy escape character", "a!b.example.com", "app.ab.example.com", false},
+		} {
+			t.Run(tt.name, func(t *testing.T) {
+				d, err := store.CreateCustomDomain(ctx, "owner", tt.domainName, "cluster", false)
+				require.NoError(t, err)
+				require.NoError(t, db.Model(d).Update("validation_expires_at", now.Add(-time.Hour)).Error)
+				svc := &rpservice.Service{ID: "legacy", AccountID: "owner", Domain: tt.serviceHost}
+				require.NoError(t, store.CreateService(ctx, svc))
+				deleted, err := store.DeleteExpiredCustomDomain(ctx, d, now)
+				if tt.protected {
+					require.Error(t, err)
+					assert.False(t, deleted, "service namespaces must remain reserved")
+				} else {
+					require.NoError(t, err)
+					assert.True(t, deleted, "a hostname outside the namespace must not prevent cleanup")
+				}
+				require.NoError(t, db.Delete(svc).Error)
+				require.NoError(t, db.Delete(d).Error)
+			})
+		}
+	})
+}
+
+func TestDeleteExpiredCustomDomain_RechecksValidation(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		d, err := store.CreateCustomDomain(ctx, "owner", "validated.example.com", "cluster", false)
+		require.NoError(t, err)
+		d, err = store.GetCustomDomain(ctx, "owner", d.ID)
+		require.NoError(t, err)
+		stale := d.Copy()
+		d.Validated = true
+		_, err = store.UpdateCustomDomain(ctx, "owner", d)
+		require.NoError(t, err)
+		deleted, err := store.DeleteExpiredCustomDomain(ctx, stale, time.Now().Add(domain.ValidationTTL))
+		require.NoError(t, err)
+		assert.False(t, deleted, "a stale cleanup candidate must not delete a validated registration")
+		stored, err := store.GetCustomDomain(ctx, "owner", d.ID)
+		require.NoError(t, err)
+		assert.True(t, stored.Validated, "the validated registration must remain usable")
+		require.NotNil(t, stored.ValidationExpiresAt)
+		assert.Equal(t, stale.ValidationExpiresAt, stored.ValidationExpiresAt, "validation must preserve the original deadline")
+	})
+}
diff --git a/management/server/store/sql_store_get_account_test.go b/management/server/store/sql_store_get_account_test.go
index 56f2a6c41..aca8d8a12 100644
--- a/management/server/store/sql_store_get_account_test.go
+++ b/management/server/store/sql_store_get_account_test.go
@@ -13,7 +13,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/management/server/integration_reference"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -21,6 +20,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/integration_reference"
 )
 
 // TestGetAccount_LoadsCustomDomains verifies GetAccount populates account.Domains.
@@ -64,7 +64,7 @@ func assertGetAccountLoadsCustomDomains(t *testing.T, store Store) {
 
 	_, err := store.CreateCustomDomain(ctx, accountID, "example.com", "eu.proxy.netbird.io", true)
 	require.NoError(t, err, "creating the first custom domain must succeed")
-	_, err = store.CreateCustomDomain(ctx, accountID, "apps.acme.io", "us.proxy.netbird.io", false)
+	pending, err := store.CreateCustomDomain(ctx, accountID, "apps.acme.io", "us.proxy.netbird.io", false)
 	require.NoError(t, err, "creating the second custom domain must succeed")
 
 	account, err := store.GetAccount(ctx, accountID)
@@ -75,6 +75,10 @@ func assertGetAccountLoadsCustomDomains(t *testing.T, store Store) {
 	for _, d := range account.Domains {
 		require.NotNil(t, d)
 		byDomain[d.Domain] = d.TargetCluster
+		if d.ID == pending.ID {
+			require.NotNil(t, d.ValidationExpiresAt)
+			assert.WithinDuration(t, *pending.ValidationExpiresAt, *d.ValidationExpiresAt, time.Millisecond, "both account loaders must preserve the validation deadline")
+		}
 	}
 	assert.Equal(t, "eu.proxy.netbird.io", byDomain["example.com"], "custom domain must carry its target cluster")
 	assert.Equal(t, "us.proxy.netbird.io", byDomain["apps.acme.io"], "custom domain must carry its target cluster")
diff --git a/management/server/store/sql_store_group.go b/management/server/store/sql_store_group.go
new file mode 100644
index 000000000..323a45734
--- /dev/null
+++ b/management/server/store/sql_store_group.go
@@ -0,0 +1,356 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// CreateGroups creates the given list of groups to the database.
+// groupUpsertColumns is the explicit allowlist of columns that get updated when
+// CreateGroups / UpdateGroups hit a PK conflict. public_id is intentionally
+// omitted so a caller passing an entity with the zero value (e.g. an HTTP
+// handler-built struct) cannot reset the persisted public_id during an upsert.
+// Keep this in sync with the Group schema in management/server/types/group.go.
+func groupUpsertColumns() clause.Set {
+	return clause.AssignmentColumns([]string{
+		"account_id",
+		"name",
+		"issued",
+		"integration_ref_id",
+		"integration_ref_integration_type",
+		"resources",
+	})
+}
+
+func (s *SqlStore) CreateGroups(ctx context.Context, accountID string, groups []*types.Group) error {
+	if len(groups) == 0 {
+		return nil
+	}
+
+	return s.transaction(ctx, func(tx *gorm.DB) error {
+		result := tx.
+			Clauses(
+				clause.OnConflict{
+					Columns:   []clause.Column{{Name: "id"}},
+					Where:     clause.Where{Exprs: []clause.Expression{clause.Eq{Column: "groups.account_id", Value: accountID}}},
+					DoUpdates: groupUpsertColumns(),
+				},
+			).
+			Omit(clause.Associations).
+			Create(&groups)
+		if result.Error != nil {
+			log.WithContext(ctx).Errorf("failed to save groups to store: %v", result.Error)
+			return status.Errorf(status.Internal, "failed to save groups to store")
+		}
+
+		return nil
+	})
+}
+
+// UpdateGroups updates the given list of groups to the database.
+func (s *SqlStore) UpdateGroups(ctx context.Context, accountID string, groups []*types.Group) error {
+	if len(groups) == 0 {
+		return nil
+	}
+
+	return s.transaction(ctx, func(tx *gorm.DB) error {
+		result := tx.
+			Clauses(
+				clause.OnConflict{
+					Columns:   []clause.Column{{Name: "id"}},
+					Where:     clause.Where{Exprs: []clause.Expression{clause.Eq{Column: "groups.account_id", Value: accountID}}},
+					DoUpdates: groupUpsertColumns(),
+				},
+			).
+			Omit(clause.Associations).
+			Create(&groups)
+		if result.Error != nil {
+			log.WithContext(ctx).Errorf("failed to save groups to store: %v", result.Error)
+			return status.Errorf(status.Internal, "failed to save groups to store")
+		}
+
+		return nil
+	})
+}
+
+func (s *SqlStore) GetAccountGroups(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.Group, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var groups []*types.Group
+	result := tx.Preload(clause.Associations).Find(&groups, accountIDCondition, accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "accountID not found: index lookup failed")
+		}
+		log.WithContext(ctx).Errorf("failed to get account groups from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get account groups from the store")
+	}
+
+	for _, g := range groups {
+		g.LoadGroupPeers()
+	}
+
+	return groups, nil
+}
+
+func (s *SqlStore) GetResourceGroups(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) ([]*types.Group, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var groups []*types.Group
+
+	likePattern := `%"ID":"` + resourceID + `"%`
+
+	result := tx.
+		Preload(clause.Associations).
+		Where("resources LIKE ?", likePattern).
+		Find(&groups)
+
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, nil
+		}
+		return nil, result.Error
+	}
+
+	for _, g := range groups {
+		g.LoadGroupPeers()
+	}
+
+	return groups, nil
+}
+
+func (s *SqlStore) getGroups(ctx context.Context, accountID string) ([]*types.Group, error) {
+	const query = `SELECT id, account_id, public_id, name, issued, resources, integration_ref_id, integration_ref_integration_type FROM groups WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+	groups, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (*types.Group, error) {
+		var g types.Group
+		var resources []byte
+		var refID sql.NullInt64
+		var refType sql.NullString
+		err := row.Scan(&g.ID, &g.AccountID, &g.PublicID, &g.Name, &g.Issued, &resources, &refID, &refType)
+		if err == nil {
+			if refID.Valid {
+				g.IntegrationReference.ID = int(refID.Int64)
+			}
+			if refType.Valid {
+				g.IntegrationReference.IntegrationType = refType.String
+			}
+			if resources != nil {
+				_ = json.Unmarshal(resources, &g.Resources)
+			} else {
+				g.Resources = []types.Resource{}
+			}
+			g.GroupPeers = []types.GroupPeer{}
+			g.Peers = []string{}
+		}
+		return &g, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	return groups, nil
+}
+
+// AddResourceToGroup adds a resource to a group. Method always needs to run n a transaction
+func (s *SqlStore) AddResourceToGroup(ctx context.Context, accountId string, groupID string, resource *types.Resource) error {
+	var group types.Group
+	result := s.db.Where(accountAndIDQueryCondition, accountId, groupID).Take(&group)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return status.NewGroupNotFoundError(groupID)
+		}
+
+		return status.Errorf(status.Internal, "issue finding group: %s", result.Error)
+	}
+
+	for _, res := range group.Resources {
+		if res.ID == resource.ID {
+			return nil
+		}
+	}
+
+	group.Resources = append(group.Resources, *resource)
+
+	if err := s.db.Save(&group).Error; err != nil {
+		return status.Errorf(status.Internal, "issue updating group: %s", err)
+	}
+
+	return nil
+}
+
+// RemoveResourceFromGroup removes a resource from a group. Method always needs to run in a transaction
+func (s *SqlStore) RemoveResourceFromGroup(ctx context.Context, accountId string, groupID string, resourceID string) error {
+	var group types.Group
+	result := s.db.Where(accountAndIDQueryCondition, accountId, groupID).Take(&group)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return status.NewGroupNotFoundError(groupID)
+		}
+
+		return status.Errorf(status.Internal, "issue finding group: %s", result.Error)
+	}
+
+	for i, res := range group.Resources {
+		if res.ID == resourceID {
+			group.Resources = append(group.Resources[:i], group.Resources[i+1:]...)
+			break
+		}
+	}
+
+	if err := s.db.Save(&group).Error; err != nil {
+		return status.Errorf(status.Internal, "issue updating group: %s", err)
+	}
+
+	return nil
+}
+
+// GetGroupByID retrieves a group by ID and account ID.
+func (s *SqlStore) GetGroupByID(ctx context.Context, lockStrength LockingStrength, accountID, groupID string) (*types.Group, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var group *types.Group
+	result := tx.Preload(clause.Associations).Take(&group, accountAndIDQueryCondition, accountID, groupID)
+	if err := result.Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, status.NewGroupNotFoundError(groupID)
+		}
+		log.WithContext(ctx).Errorf("failed to get group from store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get group from store")
+	}
+
+	group.LoadGroupPeers()
+
+	return group, nil
+}
+
+// GetGroupByName retrieves a group by name and account ID.
+func (s *SqlStore) GetGroupByName(ctx context.Context, lockStrength LockingStrength, accountID, groupName string) (*types.Group, error) {
+	tx := s.db
+
+	var group types.Group
+
+	// TODO: This fix is accepted for now, but if we need to handle this more frequently
+	// we may need to reconsider changing the types.
+	query := tx.Preload(clause.Associations)
+
+	result := query.
+		Model(&types.Group{}).
+		Joins("LEFT JOIN group_peers ON group_peers.group_id = groups.id").
+		Where("groups.account_id = ? AND groups.name = ?", accountID, groupName).
+		Group("groups.id").
+		Order("COUNT(group_peers.peer_id) DESC").
+		Limit(1).
+		First(&group)
+	if err := result.Error; err != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewGroupNotFoundError(groupName)
+		}
+		log.WithContext(ctx).Errorf("failed to get group by name from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get group by name from store")
+	}
+
+	group.LoadGroupPeers()
+
+	return &group, nil
+}
+
+// GetGroupsByIDs retrieves groups by their IDs and account ID.
+func (s *SqlStore) GetGroupsByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, groupIDs []string) (map[string]*types.Group, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var groups []*types.Group
+	result := tx.Preload(clause.Associations).Find(&groups, accountAndIDsQueryCondition, accountID, groupIDs)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get groups by ID's from store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get groups by ID's from store")
+	}
+
+	groupsMap := make(map[string]*types.Group)
+	for _, group := range groups {
+		group.LoadGroupPeers()
+		groupsMap[group.ID] = group
+	}
+
+	return groupsMap, nil
+}
+
+// CreateGroup creates a group in the store.
+func (s *SqlStore) CreateGroup(ctx context.Context, group *types.Group) error {
+	if group == nil {
+		return status.Errorf(status.InvalidArgument, "group is nil")
+	}
+
+	if err := s.db.Omit(clause.Associations).Create(group).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to save group to store: %v", err)
+		return status.Errorf(status.Internal, "failed to save group to store")
+	}
+
+	return nil
+}
+
+// UpdateGroup updates a group in the store.
+func (s *SqlStore) UpdateGroup(ctx context.Context, group *types.Group) error {
+	if group == nil {
+		return status.Errorf(status.InvalidArgument, "group is nil")
+	}
+
+	if err := s.db.Omit(clause.Associations, "public_id").Save(group).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to save group to store: %v", err)
+		return status.Errorf(status.Internal, "failed to save group to store")
+	}
+
+	return nil
+}
+
+// DeleteGroup deletes a group from the database.
+func (s *SqlStore) DeleteGroup(ctx context.Context, accountID, groupID string) error {
+	result := s.db.Select(clause.Associations).
+		Delete(&types.Group{}, accountAndIDQueryCondition, accountID, groupID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to delete group from store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to delete group from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewGroupNotFoundError(groupID)
+	}
+
+	return nil
+}
+
+// DeleteGroups deletes groups from the database.
+func (s *SqlStore) DeleteGroups(ctx context.Context, accountID string, groupIDs []string) error {
+	result := s.db.Select(clause.Associations).
+		Delete(&types.Group{}, accountAndIDsQueryCondition, accountID, groupIDs)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete groups from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete groups from store")
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_group_peer.go b/management/server/store/sql_store_group_peer.go
new file mode 100644
index 000000000..cc4c44ad1
--- /dev/null
+++ b/management/server/store/sql_store_group_peer.go
@@ -0,0 +1,229 @@
+package store
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) getGroupPeers(ctx context.Context, groupIDs []string) ([]types.GroupPeer, error) {
+	if len(groupIDs) == 0 {
+		return nil, nil
+	}
+	const query = `SELECT account_id, group_id, peer_id FROM group_peers WHERE group_id = ANY($1)`
+	rows, err := s.pgxPool().Query(ctx, query, groupIDs)
+	if err != nil {
+		return nil, err
+	}
+	groupPeers, err := pgx.CollectRows(rows, pgx.RowToStructByName[types.GroupPeer])
+	if err != nil {
+		return nil, err
+	}
+	return groupPeers, nil
+}
+
+// AddPeerToAllGroup adds a peer to the 'All' group. Method always needs to run in a transaction
+func (s *SqlStore) AddPeerToAllGroup(ctx context.Context, accountID string, peerID string) error {
+	var groupID string
+	_ = s.db.Model(types.Group{}).
+		Select("id").
+		Where("account_id = ? AND name = ?", accountID, "All").
+		Limit(1).
+		Scan(&groupID)
+
+	if groupID == "" {
+		return status.Errorf(status.NotFound, "group 'All' not found for account %s", accountID)
+	}
+
+	err := s.db.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "group_id"}, {Name: "peer_id"}},
+		DoNothing: true,
+	}).Create(&types.GroupPeer{
+		AccountID: accountID,
+		GroupID:   groupID,
+		PeerID:    peerID,
+	}).Error
+	if err != nil {
+		return status.Errorf(status.Internal, "error adding peer to group 'All': %v", err)
+	}
+
+	return nil
+}
+
+// AddPeerToGroup adds a peer to a group
+func (s *SqlStore) AddPeerToGroup(ctx context.Context, accountID, peerID, groupID string) error {
+	peer := &types.GroupPeer{
+		AccountID: accountID,
+		GroupID:   groupID,
+		PeerID:    peerID,
+	}
+
+	err := s.db.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "group_id"}, {Name: "peer_id"}},
+		DoNothing: true,
+	}).Create(peer).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to add peer %s to group %s for account %s: %v", peerID, groupID, accountID, err)
+		return status.Errorf(status.Internal, "failed to add peer to group")
+	}
+
+	return nil
+}
+
+// RemovePeerFromGroup removes a peer from a group
+func (s *SqlStore) RemovePeerFromGroup(ctx context.Context, peerID string, groupID string) error {
+	err := s.db.
+		Delete(&types.GroupPeer{}, "group_id = ? AND peer_id = ?", groupID, peerID).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to remove peer %s from group %s: %v", peerID, groupID, err)
+		return status.Errorf(status.Internal, "failed to remove peer from group")
+	}
+
+	return nil
+}
+
+// RemovePeerFromAllGroups removes a peer from all groups
+func (s *SqlStore) RemovePeerFromAllGroups(ctx context.Context, peerID string) error {
+	err := s.db.
+		Delete(&types.GroupPeer{}, "peer_id = ?", peerID).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to remove peer %s from all groups: %v", peerID, err)
+		return status.Errorf(status.Internal, "failed to remove peer from all groups")
+	}
+
+	return nil
+}
+
+// GetPeerGroups retrieves all groups assigned to a specific peer in a given account.
+func (s *SqlStore) GetPeerGroups(ctx context.Context, lockStrength LockingStrength, accountId string, peerId string) ([]*types.Group, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var groups []*types.Group
+	query := tx.
+		Joins("JOIN group_peers ON group_peers.group_id = groups.id").
+		Where("groups.account_id = ? AND group_peers.peer_id = ?", accountId, peerId).
+		Preload(clause.Associations).
+		Find(&groups)
+
+	if query.Error != nil {
+		return nil, query.Error
+	}
+
+	for _, group := range groups {
+		group.LoadGroupPeers()
+	}
+
+	return groups, nil
+}
+
+// GetPeerGroupIDs retrieves all group IDs assigned to a specific peer in a given account.
+func (s *SqlStore) GetPeerGroupIDs(ctx context.Context, lockStrength LockingStrength, accountId string, peerId string) ([]string, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var groupIDs []string
+	query := tx.
+		Model(&types.GroupPeer{}).
+		Where("account_id = ? AND peer_id = ?", accountId, peerId).
+		Pluck("group_id", &groupIDs)
+
+	if query.Error != nil {
+		if errors.Is(query.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "no groups found for peer %s in account %s", peerId, accountId)
+		}
+		log.WithContext(ctx).Errorf("failed to get group IDs for peer %s in account %s: %v", peerId, accountId, query.Error)
+		return nil, status.Errorf(status.Internal, "failed to get group IDs for peer from store")
+	}
+
+	return groupIDs, nil
+}
+
+func (s *SqlStore) GetAccountGroupPeers(ctx context.Context, lockStrength LockingStrength, accountID string) (map[string]map[string]struct{}, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var peers []types.GroupPeer
+	result := tx.Find(&peers, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get account group peers from store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get account group peers from store")
+	}
+
+	groupPeers := make(map[string]map[string]struct{})
+	for _, peer := range peers {
+		if _, exists := groupPeers[peer.GroupID]; !exists {
+			groupPeers[peer.GroupID] = make(map[string]struct{})
+		}
+		groupPeers[peer.GroupID][peer.PeerID] = struct{}{}
+	}
+
+	return groupPeers, nil
+}
+
+func (s *SqlStore) GetPeersByGroupIDs(ctx context.Context, accountID string, groupIDs []string) ([]*nbpeer.Peer, error) {
+	if len(groupIDs) == 0 {
+		return []*nbpeer.Peer{}, nil
+	}
+
+	var peers []*nbpeer.Peer
+	peerIDsSubquery := s.db.Model(&types.GroupPeer{}).
+		Select("DISTINCT peer_id").
+		Where("account_id = ? AND group_id IN ?", accountID, groupIDs)
+
+	result := s.db.Where("account_id = ? AND id IN (?)", accountID, peerIDsSubquery).Find(&peers)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get peers by group IDs: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get peers by group IDs")
+	}
+
+	return peers, nil
+}
+
+func (s *SqlStore) GetPeerIDsByGroups(ctx context.Context, accountID string, groupIDs []string) ([]string, error) {
+	if len(groupIDs) == 0 {
+		return nil, nil
+	}
+
+	var peerIDs []string
+	result := s.db.Model(&types.GroupPeer{}).
+		Select("DISTINCT peer_id").
+		Where("account_id = ? AND group_id IN ?", accountID, groupIDs).
+		Pluck("peer_id", &peerIDs)
+	if result.Error != nil {
+		return nil, status.Errorf(status.Internal, "failed to get peer IDs by groups: %s", result.Error)
+	}
+
+	return peerIDs, nil
+}
+
+func (s *SqlStore) GetGroupIDsByPeerIDs(ctx context.Context, accountID string, peerIDs []string) ([]string, error) {
+	if len(peerIDs) == 0 {
+		return nil, nil
+	}
+
+	var groupIDs []string
+	result := s.db.Model(&types.GroupPeer{}).
+		Select("DISTINCT group_id").
+		Where("account_id = ? AND peer_id IN ?", accountID, peerIDs).
+		Pluck("group_id", &groupIDs)
+	if result.Error != nil {
+		return nil, status.Errorf(status.Internal, "failed to get group IDs by peers: %s", result.Error)
+	}
+
+	return groupIDs, nil
+}
diff --git a/management/server/store/sql_store_group_peer_test.go b/management/server/store/sql_store_group_peer_test.go
new file mode 100644
index 000000000..9f9a9e483
--- /dev/null
+++ b/management/server/store/sql_store_group_peer_test.go
@@ -0,0 +1,210 @@
+package store
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+func TestSqlStore_AddPeerToGroup(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	peerID := "cfefqs706sqkneg59g4g"
+	groupID := "cfefqs706sqkneg59g4h"
+
+	group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
+	require.NoError(t, err, "failed to get group")
+	require.Len(t, group.Peers, 0, "group should have 0 peers")
+
+	err = store.AddPeerToGroup(context.Background(), accountID, peerID, groupID)
+	require.NoError(t, err, "failed to add peer to group")
+
+	group, err = store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
+	require.NoError(t, err, "failed to get group")
+	require.Len(t, group.Peers, 1, "group should have 1 peers")
+	require.Contains(t, group.Peers, peerID)
+}
+
+func TestSqlStore_AddPeerToAllGroup(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	groupID := "cfefqs706sqkneg59g3g"
+
+	peer := &nbpeer.Peer{
+		ID:        "peer1",
+		AccountID: accountID,
+		DNSLabel:  "peer1.domain.test",
+	}
+
+	group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
+	require.NoError(t, err, "failed to get group")
+	require.Len(t, group.Peers, 2, "group should have 2 peers")
+	require.NotContains(t, group.Peers, peer.ID)
+
+	err = store.AddPeerToAccount(context.Background(), peer)
+	require.NoError(t, err, "failed to add peer to account")
+
+	err = store.AddPeerToAllGroup(context.Background(), accountID, peer.ID)
+	require.NoError(t, err, "failed to add peer to all group")
+
+	group, err = store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
+	require.NoError(t, err, "failed to get group")
+	require.Len(t, group.Peers, 3, "group should have  peers")
+	require.Contains(t, group.Peers, peer.ID)
+}
+
+func TestSqlStore_GetPeerGroups(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	peerID := "cfefqs706sqkneg59g4g"
+
+	groups, err := store.GetPeerGroups(context.Background(), LockingStrengthNone, accountID, peerID)
+	require.NoError(t, err)
+	assert.Len(t, groups, 1)
+	assert.Equal(t, groups[0].Name, "All")
+
+	err = store.AddPeerToGroup(context.Background(), accountID, peerID, "cfefqs706sqkneg59g4h")
+	require.NoError(t, err)
+
+	groups, err = store.GetPeerGroups(context.Background(), LockingStrengthNone, accountID, peerID)
+	require.NoError(t, err)
+	assert.Len(t, groups, 2)
+
+	foreignPeerID := "foreign-peer"
+	err = store.AddPeerToGroup(context.Background(), accountID, foreignPeerID, "cfefqs706sqkneg59g4h")
+	require.NoError(t, err)
+
+	groups, err = store.GetPeerGroups(context.Background(), LockingStrengthNone, "other-account", foreignPeerID)
+	require.NoError(t, err)
+	assert.Empty(t, groups, "groups of another account must not be returned")
+}
+
+func TestSqlStore_GetPeersByGroupIDs(t *testing.T) {
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	group1ID := "test-group-1"
+	group2ID := "test-group-2"
+	emptyGroupID := "empty-group"
+
+	peer1 := "cfefqs706sqkneg59g4g"
+	peer2 := "cfeg6sf06sqkneg59g50"
+
+	tests := []struct {
+		name          string
+		groupIDs      []string
+		expectedPeers []string
+		expectedCount int
+	}{
+		{
+			name:          "retrieve peers from single group with multiple peers",
+			groupIDs:      []string{group1ID},
+			expectedPeers: []string{peer1, peer2},
+			expectedCount: 2,
+		},
+		{
+			name:          "retrieve peers from single group with one peer",
+			groupIDs:      []string{group2ID},
+			expectedPeers: []string{peer1},
+			expectedCount: 1,
+		},
+		{
+			name:          "retrieve peers from multiple groups (with overlap)",
+			groupIDs:      []string{group1ID, group2ID},
+			expectedPeers: []string{peer1, peer2}, // should deduplicate
+			expectedCount: 2,
+		},
+		{
+			name:          "retrieve peers from existing 'All' group",
+			groupIDs:      []string{"cfefqs706sqkneg59g3g"}, // All group from test data
+			expectedPeers: []string{peer1, peer2},
+			expectedCount: 2,
+		},
+		{
+			name:          "retrieve peers from empty group",
+			groupIDs:      []string{emptyGroupID},
+			expectedPeers: []string{},
+			expectedCount: 0,
+		},
+		{
+			name:          "retrieve peers from non-existing group",
+			groupIDs:      []string{"non-existing-group"},
+			expectedPeers: []string{},
+			expectedCount: 0,
+		},
+		{
+			name:          "empty group IDs list",
+			groupIDs:      []string{},
+			expectedPeers: []string{},
+			expectedCount: 0,
+		},
+		{
+			name:          "mix of existing and non-existing groups",
+			groupIDs:      []string{group1ID, "non-existing-group"},
+			expectedPeers: []string{peer1, peer2},
+			expectedCount: 2,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
+			t.Cleanup(cleanup)
+			require.NoError(t, err)
+
+			ctx := context.Background()
+
+			groups := []*types.Group{
+				{
+					ID:        group1ID,
+					AccountID: accountID,
+				},
+				{
+					ID:        group2ID,
+					AccountID: accountID,
+				},
+			}
+			require.NoError(t, store.CreateGroups(ctx, accountID, groups))
+
+			otherAccount := newAccountWithId(ctx, "other-account", "other-user", "")
+			require.NoError(t, store.SaveAccount(ctx, otherAccount))
+			foreignPeer := &nbpeer.Peer{ID: "foreign-peer", AccountID: otherAccount.Id}
+			require.NoError(t, store.AddPeerToAccount(ctx, foreignPeer))
+
+			require.NoError(t, store.AddPeerToGroup(ctx, accountID, peer1, group1ID))
+			require.NoError(t, store.AddPeerToGroup(ctx, accountID, peer2, group1ID))
+			require.NoError(t, store.AddPeerToGroup(ctx, accountID, peer1, group2ID))
+			require.NoError(t, store.AddPeerToGroup(ctx, accountID, foreignPeer.ID, group1ID))
+
+			peers, err := store.GetPeersByGroupIDs(ctx, accountID, tt.groupIDs)
+			require.NoError(t, err)
+			require.Len(t, peers, tt.expectedCount)
+
+			if tt.expectedCount > 0 {
+				actualPeerIDs := make([]string, len(peers))
+				for i, peer := range peers {
+					actualPeerIDs[i] = peer.ID
+				}
+				assert.ElementsMatch(t, tt.expectedPeers, actualPeerIDs)
+
+				// Verify all returned peers belong to the correct account
+				for _, peer := range peers {
+					assert.Equal(t, accountID, peer.AccountID)
+				}
+			}
+		})
+	}
+}
diff --git a/management/server/store/sql_store_group_test.go b/management/server/store/sql_store_group_test.go
new file mode 100644
index 000000000..58291ab44
--- /dev/null
+++ b/management/server/store/sql_store_group_test.go
@@ -0,0 +1,289 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestSqlite_GetGroupByName(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	if err != nil {
+		t.Fatal(err)
+	}
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	group, err := store.GetGroupByName(context.Background(), LockingStrengthNone, accountID, "All")
+	require.NoError(t, err)
+	require.True(t, group.IsGroupAll())
+}
+
+func TestSqlStore_GetGroupsByIDs(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	tests := []struct {
+		name          string
+		groupIDs      []string
+		expectedCount int
+	}{
+		{
+			name:          "retrieve existing groups by existing IDs",
+			groupIDs:      []string{"cfefqs706sqkneg59g4g", "cfefqs706sqkneg59g3g"},
+			expectedCount: 2,
+		},
+		{
+			name:          "empty group IDs list",
+			groupIDs:      []string{},
+			expectedCount: 0,
+		},
+		{
+			name:          "non-existing group IDs",
+			groupIDs:      []string{"nonexistent1", "nonexistent2"},
+			expectedCount: 0,
+		},
+		{
+			name:          "mixed existing and non-existing group IDs",
+			groupIDs:      []string{"cfefqs706sqkneg59g4g", "nonexistent"},
+			expectedCount: 1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			groups, err := store.GetGroupsByIDs(context.Background(), LockingStrengthNone, accountID, tt.groupIDs)
+			require.NoError(t, err)
+			require.Len(t, groups, tt.expectedCount)
+		})
+	}
+}
+
+func TestSqlStore_CreateGroup(t *testing.T) {
+	if os.Getenv("CI") == "true" {
+		t.Log("Skipping MySQL test on CI")
+	}
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.MysqlStoreEngine))
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	group := &types.Group{
+		ID:         "group-id",
+		AccountID:  accountID,
+		Issued:     "api",
+		Peers:      []string{},
+		Resources:  []types.Resource{},
+		GroupPeers: []types.GroupPeer{},
+	}
+	err = store.CreateGroup(context.Background(), group)
+	require.NoError(t, err)
+
+	savedGroup, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, "group-id")
+	require.NoError(t, err)
+	require.Equal(t, savedGroup, group)
+}
+
+func TestSqlStore_CreateUpdateGroups(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	groups := []*types.Group{
+		{
+			ID:         "group-1",
+			AccountID:  accountID,
+			Issued:     "api",
+			Peers:      []string{},
+			Resources:  []types.Resource{},
+			GroupPeers: []types.GroupPeer{},
+		},
+		{
+			ID:         "group-2",
+			AccountID:  accountID,
+			Issued:     "integration",
+			Peers:      []string{},
+			Resources:  []types.Resource{},
+			GroupPeers: []types.GroupPeer{},
+		},
+	}
+	err = store.CreateGroups(context.Background(), accountID, groups)
+	require.NoError(t, err)
+
+	groups[1].Peers = []string{}
+	err = store.UpdateGroups(context.Background(), accountID, groups)
+	require.NoError(t, err)
+
+	group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groups[1].ID)
+	require.NoError(t, err)
+	require.Equal(t, groups[1], group)
+}
+
+func TestSqlStore_DeleteGroup(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	tests := []struct {
+		name        string
+		groupID     string
+		expectError bool
+	}{
+		{
+			name:        "delete existing group",
+			groupID:     "cfefqs706sqkneg59g4g",
+			expectError: false,
+		},
+		{
+			name:        "delete non-existing group",
+			groupID:     "non-existing-group-id",
+			expectError: true,
+		},
+		{
+			name:        "delete with empty group ID",
+			groupID:     "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := store.DeleteGroup(context.Background(), accountID, tt.groupID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+			} else {
+				require.NoError(t, err)
+
+				group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, tt.groupID)
+				require.Error(t, err)
+				require.Nil(t, group)
+			}
+		})
+	}
+}
+
+func TestSqlStore_DeleteGroups(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	tests := []struct {
+		name        string
+		groupIDs    []string
+		expectError bool
+	}{
+		{
+			name:        "delete multiple existing groups",
+			groupIDs:    []string{"cfefqs706sqkneg59g4g", "cfefqs706sqkneg59g3g"},
+			expectError: false,
+		},
+		{
+			name:        "delete non-existing groups",
+			groupIDs:    []string{"non-existing-id-1", "non-existing-id-2"},
+			expectError: false,
+		},
+		{
+			name:        "delete with empty group IDs list",
+			groupIDs:    []string{},
+			expectError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := store.DeleteGroups(context.Background(), accountID, tt.groupIDs)
+			if tt.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+
+				for _, groupID := range tt.groupIDs {
+					group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
+					require.Error(t, err)
+					require.Nil(t, group)
+				}
+			}
+		})
+	}
+}
+
+func TestSqlStore_AddAndRemoveResourceFromGroup(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	resourceId := "ctc4nci7qv9061u6ilfg"
+	groupID := "cs1tnh0hhcjnqoiuebeg"
+
+	res := &types.Resource{
+		ID:   resourceId,
+		Type: "host",
+	}
+	err = store.AddResourceToGroup(context.Background(), accountID, groupID, res)
+	require.NoError(t, err)
+
+	group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
+	require.NoError(t, err)
+	require.Contains(t, group.Resources, *res)
+
+	groups, err := store.GetResourceGroups(context.Background(), LockingStrengthNone, accountID, resourceId)
+	require.NoError(t, err)
+	require.Len(t, groups, 1)
+
+	err = store.RemoveResourceFromGroup(context.Background(), accountID, groupID, res.ID)
+	require.NoError(t, err)
+
+	group, err = store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
+	require.NoError(t, err)
+	require.NotContains(t, group.Resources, *res)
+}
+
+func TestSqlStore_SaveGroups_LargeBatch(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	accountGroups, err := store.GetAccountGroups(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	require.Len(t, accountGroups, 3)
+
+	groupsToSave := make([]*types.Group, 0)
+
+	for i := 1; i <= 8000; i++ {
+		groupsToSave = append(groupsToSave, &types.Group{
+			ID:        fmt.Sprintf("%d", i),
+			AccountID: accountID,
+			Name:      fmt.Sprintf("group-%d", i),
+		})
+	}
+
+	err = store.CreateGroups(context.Background(), accountID, groupsToSave)
+	require.NoError(t, err)
+
+	accountGroups, err = store.GetAccountGroups(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	require.Equal(t, 8003, len(accountGroups))
+}
diff --git a/management/server/store/sql_store_idp_migration.go b/management/server/store/sql_store_idp_migration.go
index 64962845b..760d2967c 100644
--- a/management/server/store/sql_store_idp_migration.go
+++ b/management/server/store/sql_store_idp_migration.go
@@ -57,11 +57,11 @@ func (s *SqlStore) ListUsers(ctx context.Context) ([]*types.User, error) {
 // txDeferFKConstraints defers foreign key constraint checks for the duration of the transaction.
 // MySQL is already handled by s.transaction (SET FOREIGN_KEY_CHECKS = 0).
 func (s *SqlStore) txDeferFKConstraints(tx *gorm.DB) error {
-	if s.storeEngine == types.SqliteStoreEngine {
+	if s.conn.Engine() == types.SqliteStoreEngine {
 		return tx.Exec("PRAGMA defer_foreign_keys = ON").Error
 	}
 
-	if s.storeEngine != types.PostgresStoreEngine {
+	if s.conn.Engine() != types.PostgresStoreEngine {
 		return nil
 	}
 
@@ -86,7 +86,7 @@ func (s *SqlStore) txDeferFKConstraints(tx *gorm.DB) error {
 // txRestoreFKConstraints reverts FK constraints back to NOT DEFERRABLE after the
 // deferred updates are done but before the transaction commits.
 func (s *SqlStore) txRestoreFKConstraints(tx *gorm.DB) error {
-	if s.storeEngine != types.PostgresStoreEngine {
+	if s.conn.Engine() != types.PostgresStoreEngine {
 		return nil
 	}
 
@@ -138,7 +138,7 @@ func (s *SqlStore) UpdateUserID(ctx context.Context, accountID, oldUserID, newUs
 	}
 
 	log.Info("Updating user ID in the store")
-	err := s.transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		if err := s.txDeferFKConstraints(tx); err != nil {
 			return err
 		}
@@ -161,7 +161,7 @@ func (s *SqlStore) UpdateUserID(ctx context.Context, accountID, oldUserID, newUs
 	}
 
 	log.Info("Restoring FK constraints")
-	err = s.transaction(func(tx *gorm.DB) error {
+	err = s.transaction(ctx, func(tx *gorm.DB) error {
 		if err := s.txRestoreFKConstraints(tx); err != nil {
 			return fmt.Errorf("restore FK constraints: %w", err)
 		}
diff --git a/management/server/store/sql_store_installation.go b/management/server/store/sql_store_installation.go
new file mode 100644
index 000000000..2bdfb9af1
--- /dev/null
+++ b/management/server/store/sql_store_installation.go
@@ -0,0 +1,29 @@
+package store
+
+import (
+	"context"
+
+	"gorm.io/gorm/clause"
+)
+
+type installation struct {
+	ID                  uint `gorm:"primaryKey"`
+	InstallationIDValue string
+}
+
+func (s *SqlStore) SaveInstallationID(_ context.Context, ID string) error {
+	installation := installation{InstallationIDValue: ID}
+	installation.ID = uint(s.installationPK)
+
+	return s.db.Clauses(clause.OnConflict{UpdateAll: true}).Create(&installation).Error
+}
+
+func (s *SqlStore) GetInstallationID() string {
+	var installation installation
+
+	if result := s.db.Take(&installation, idQueryCondition, s.installationPK); result.Error != nil {
+		return ""
+	}
+
+	return installation.InstallationIDValue
+}
diff --git a/management/server/store/sql_store_job.go b/management/server/store/sql_store_job.go
new file mode 100644
index 000000000..b5cc6c603
--- /dev/null
+++ b/management/server/store/sql_store_job.go
@@ -0,0 +1,103 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// SaveJob persists a job in DB
+func (s *SqlStore) CreatePeerJob(ctx context.Context, job *types.Job) error {
+	result := s.db.Create(job)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to create job in store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to create job in store")
+	}
+	return nil
+}
+
+func (s *SqlStore) CompletePeerJob(ctx context.Context, job *types.Job) error {
+	result := s.db.
+		Model(&types.Job{}).
+		Where(idQueryCondition, job.ID).
+		Updates(job)
+
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to update job in store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to update job in store")
+	}
+	return nil
+}
+
+// job was pending for too long and has been cancelled
+func (s *SqlStore) MarkPendingJobsAsFailed(ctx context.Context, accountID, peerID, jobID, reason string) error {
+	now := time.Now().UTC()
+	result := s.db.
+		Model(&types.Job{}).
+		Where(accountAndPeerIDQueryCondition+" AND id = ?"+" AND status = ?", accountID, peerID, jobID, types.JobStatusPending).
+		Updates(types.Job{
+			Status:       types.JobStatusFailed,
+			FailedReason: reason,
+			CompletedAt:  &now,
+		})
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to mark pending jobs as Failed job in store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to mark pending job as Failed in store")
+	}
+	return nil
+}
+
+// job was pending for too long and has been cancelled
+func (s *SqlStore) MarkAllPendingJobsAsFailed(ctx context.Context, accountID, peerID, reason string) error {
+	now := time.Now().UTC()
+	result := s.db.
+		Model(&types.Job{}).
+		Where(accountAndPeerIDQueryCondition+" AND status = ?", accountID, peerID, types.JobStatusPending).
+		Updates(types.Job{
+			Status:       types.JobStatusFailed,
+			FailedReason: reason,
+			CompletedAt:  &now,
+		})
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to mark pending jobs as Failed job in store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to mark pending job as Failed in store")
+	}
+	return nil
+}
+
+// GetJobByID fetches job by ID
+func (s *SqlStore) GetPeerJobByID(ctx context.Context, accountID, jobID string) (*types.Job, error) {
+	var job types.Job
+	err := s.db.
+		Where(accountAndIDQueryCondition, accountID, jobID).
+		First(&job).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, status.Errorf(status.NotFound, "job %s not found", jobID)
+	}
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to fetch job from store: %s", err)
+		return nil, err
+	}
+	return &job, nil
+}
+
+// get all jobs
+func (s *SqlStore) GetPeerJobs(ctx context.Context, accountID, peerID string) ([]*types.Job, error) {
+	var jobs []*types.Job
+	err := s.db.
+		Where(accountAndPeerIDQueryCondition, accountID, peerID).
+		Order("created_at DESC").
+		Find(&jobs).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to fetch jobs from store: %s", err)
+		return nil, err
+	}
+
+	return jobs, nil
+}
diff --git a/management/server/store/sql_store_name_server_group.go b/management/server/store/sql_store_name_server_group.go
new file mode 100644
index 000000000..595921913
--- /dev/null
+++ b/management/server/store/sql_store_name_server_group.go
@@ -0,0 +1,124 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) getNameServerGroups(ctx context.Context, accountID string) ([]nbdns.NameServerGroup, error) {
+	const query = `SELECT id, account_id, public_id, name, description, name_servers, groups, "primary", domains, enabled, search_domains_enabled FROM name_server_groups WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+	nsgs, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (nbdns.NameServerGroup, error) {
+		var n nbdns.NameServerGroup
+		var ns, groups, domains []byte
+		var primary, enabled, searchDomainsEnabled sql.NullBool
+		err := row.Scan(&n.ID, &n.AccountID, &n.PublicID, &n.Name, &n.Description, &ns, &groups, &primary, &domains, &enabled, &searchDomainsEnabled)
+		if err == nil {
+			if primary.Valid {
+				n.Primary = primary.Bool
+			}
+			if enabled.Valid {
+				n.Enabled = enabled.Bool
+			}
+			if searchDomainsEnabled.Valid {
+				n.SearchDomainsEnabled = searchDomainsEnabled.Bool
+			}
+			if ns != nil {
+				_ = json.Unmarshal(ns, &n.NameServers)
+			} else {
+				n.NameServers = []nbdns.NameServer{}
+			}
+			if groups != nil {
+				_ = json.Unmarshal(groups, &n.Groups)
+			} else {
+				n.Groups = []string{}
+			}
+			if domains != nil {
+				_ = json.Unmarshal(domains, &n.Domains)
+			} else {
+				n.Domains = []string{}
+			}
+		}
+		return n, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	return nsgs, nil
+}
+
+// GetAccountNameServerGroups retrieves name server groups for an account.
+func (s *SqlStore) GetAccountNameServerGroups(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*nbdns.NameServerGroup, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var nsGroups []*nbdns.NameServerGroup
+	result := tx.Find(&nsGroups, accountIDCondition, accountID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get name server groups from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get name server groups from store")
+	}
+
+	return nsGroups, nil
+}
+
+// GetNameServerGroupByID retrieves a name server group by its ID and account ID.
+func (s *SqlStore) GetNameServerGroupByID(ctx context.Context, lockStrength LockingStrength, accountID, nsGroupID string) (*nbdns.NameServerGroup, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var nsGroup *nbdns.NameServerGroup
+	result := tx.
+		Take(&nsGroup, accountAndIDQueryCondition, accountID, nsGroupID)
+	if err := result.Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, status.NewNameServerGroupNotFoundError(nsGroupID)
+		}
+		log.WithContext(ctx).Errorf("failed to get name server group from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get name server group from store")
+	}
+
+	return nsGroup, nil
+}
+
+// SaveNameServerGroup saves a name server group to the database.
+func (s *SqlStore) SaveNameServerGroup(ctx context.Context, nameServerGroup *nbdns.NameServerGroup) error {
+	result := s.db.Save(nameServerGroup)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to save name server group to the store: %s", err)
+		return status.Errorf(status.Internal, "failed to save name server group to store")
+	}
+	return nil
+}
+
+// DeleteNameServerGroup deletes a name server group from the database.
+func (s *SqlStore) DeleteNameServerGroup(ctx context.Context, accountID, nsGroupID string) error {
+	result := s.db.Delete(&nbdns.NameServerGroup{}, accountAndIDQueryCondition, accountID, nsGroupID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to delete name server group from the store: %s", err)
+		return status.Errorf(status.Internal, "failed to delete name server group from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewNameServerGroupNotFoundError(nsGroupID)
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_name_server_group_test.go b/management/server/store/sql_store_name_server_group_test.go
new file mode 100644
index 000000000..ae849c383
--- /dev/null
+++ b/management/server/store/sql_store_name_server_group_test.go
@@ -0,0 +1,143 @@
+package store
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestSqlStore_GetAccountNameServerGroups(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name          string
+		accountID     string
+		expectedCount int
+	}{
+		{
+			name:          "retrieve name server groups by existing account ID",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			expectedCount: 1,
+		},
+		{
+			name:          "non-existing account ID",
+			accountID:     "nonexistent",
+			expectedCount: 0,
+		},
+		{
+			name:          "empty account ID",
+			accountID:     "",
+			expectedCount: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peers, err := store.GetAccountNameServerGroups(context.Background(), LockingStrengthNone, tt.accountID)
+			require.NoError(t, err)
+			require.Len(t, peers, tt.expectedCount)
+		})
+	}
+
+}
+
+func TestSqlStore_GetNameServerByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	tests := []struct {
+		name        string
+		nsGroupID   string
+		expectError bool
+	}{
+		{
+			name:        "retrieve existing nameserver group",
+			nsGroupID:   "csqdelq7qv97ncu7d9t0",
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing nameserver group",
+			nsGroupID:   "non-existing",
+			expectError: true,
+		},
+		{
+			name:        "retrieve with empty nameserver group ID",
+			nsGroupID:   "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			nsGroup, err := store.GetNameServerGroupByID(context.Background(), LockingStrengthNone, accountID, tt.nsGroupID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, nsGroup)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, nsGroup)
+				require.Equal(t, tt.nsGroupID, nsGroup.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_SaveNameServerGroup(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	nsGroup := &nbdns.NameServerGroup{
+		ID:        "ns-group-id",
+		AccountID: accountID,
+		Name:      "NS Group",
+		NameServers: []nbdns.NameServer{
+			{
+				IP:     netip.MustParseAddr("8.8.8.8"),
+				NSType: 1,
+				Port:   53,
+			},
+		},
+		Groups:               []string{"groupA"},
+		Primary:              true,
+		Enabled:              true,
+		SearchDomainsEnabled: false,
+	}
+
+	err = store.SaveNameServerGroup(context.Background(), nsGroup)
+	require.NoError(t, err)
+
+	saveNSGroup, err := store.GetNameServerGroupByID(context.Background(), LockingStrengthNone, accountID, nsGroup.ID)
+	require.NoError(t, err)
+	require.Equal(t, saveNSGroup, nsGroup)
+}
+
+func TestSqlStore_DeleteNameServerGroup(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	nsGroupID := "csqdelq7qv97ncu7d9t0"
+
+	err = store.DeleteNameServerGroup(context.Background(), accountID, nsGroupID)
+	require.NoError(t, err)
+
+	nsGroup, err := store.GetNameServerGroupByID(context.Background(), LockingStrengthNone, accountID, nsGroupID)
+	require.Error(t, err)
+	require.Nil(t, nsGroup)
+}
diff --git a/management/server/store/sql_store_network.go b/management/server/store/sql_store_network.go
new file mode 100644
index 000000000..66333a4fb
--- /dev/null
+++ b/management/server/store/sql_store_network.go
@@ -0,0 +1,91 @@
+package store
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) getNetworks(ctx context.Context, accountID string) ([]*networkTypes.Network, error) {
+	const query = `SELECT id, account_id, public_id, name, description FROM networks WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+	networks, err := pgx.CollectRows(rows, pgx.RowToStructByName[networkTypes.Network])
+	if err != nil {
+		return nil, err
+	}
+	result := make([]*networkTypes.Network, len(networks))
+	for i := range networks {
+		result[i] = &networks[i]
+	}
+	return result, nil
+}
+
+func (s *SqlStore) GetAccountNetworks(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*networkTypes.Network, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var networks []*networkTypes.Network
+	result := tx.Find(&networks, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get networks from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get networks from store")
+	}
+
+	return networks, nil
+}
+
+func (s *SqlStore) GetNetworkByID(ctx context.Context, lockStrength LockingStrength, accountID, networkID string) (*networkTypes.Network, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var network *networkTypes.Network
+	result := tx.Take(&network, accountAndIDQueryCondition, accountID, networkID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewNetworkNotFoundError(networkID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get network from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get network from store")
+	}
+
+	return network, nil
+}
+
+func (s *SqlStore) SaveNetwork(ctx context.Context, network *networkTypes.Network) error {
+	result := s.db.Save(network)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save network to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to save network to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) DeleteNetwork(ctx context.Context, accountID, networkID string) error {
+	result := s.db.Delete(&networkTypes.Network{}, accountAndIDQueryCondition, accountID, networkID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete network from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete network from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewNetworkNotFoundError(networkID)
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_network_resource.go b/management/server/store/sql_store_network_resource.go
new file mode 100644
index 000000000..dd4352ea0
--- /dev/null
+++ b/management/server/store/sql_store_network_resource.go
@@ -0,0 +1,167 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) getNetworkResources(ctx context.Context, accountID string) ([]*resourceTypes.NetworkResource, error) {
+	const query = `SELECT id, network_id, account_id, public_id, name, description, type, domain, prefix, enabled FROM network_resources WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+	resources, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (resourceTypes.NetworkResource, error) {
+		var r resourceTypes.NetworkResource
+		var prefix []byte
+		var enabled sql.NullBool
+		err := row.Scan(&r.ID, &r.NetworkID, &r.AccountID, &r.PublicID, &r.Name, &r.Description, &r.Type, &r.Domain, &prefix, &enabled)
+		if err == nil {
+			if enabled.Valid {
+				r.Enabled = enabled.Bool
+			}
+			if prefix != nil {
+				_ = json.Unmarshal(prefix, &r.Prefix)
+			}
+		}
+		return r, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	result := make([]*resourceTypes.NetworkResource, len(resources))
+	for i := range resources {
+		result[i] = &resources[i]
+	}
+	return result, nil
+}
+
+func (s *SqlStore) GetNetworkResourcesByNetID(ctx context.Context, lockStrength LockingStrength, accountID, networkID string) ([]*resourceTypes.NetworkResource, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var netResources []*resourceTypes.NetworkResource
+	result := tx.
+		Find(&netResources, "account_id = ? AND network_id = ?", accountID, networkID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get network resources from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get network resources from store")
+	}
+
+	return netResources, nil
+}
+
+func (s *SqlStore) GetNetworkResourcesByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*resourceTypes.NetworkResource, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var netResources []*resourceTypes.NetworkResource
+	result := tx.
+		Find(&netResources, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get network resources from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get network resources from store")
+	}
+
+	return netResources, nil
+}
+
+func (s *SqlStore) GetNetworkResourceByID(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) (*resourceTypes.NetworkResource, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var netResources *resourceTypes.NetworkResource
+	result := tx.
+		Take(&netResources, accountAndIDQueryCondition, accountID, resourceID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewNetworkResourceNotFoundError(resourceID)
+		}
+		log.WithContext(ctx).Errorf("failed to get network resource from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get network resource from store")
+	}
+
+	return netResources, nil
+}
+
+// GetNetworkResourceByIDOrPublicID retrieves a network resource by either its ID or its
+// PublicID. See GetPolicyByIDOrPublicID for why peer-reported references need both.
+func (s *SqlStore) GetNetworkResourceByIDOrPublicID(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) (*resourceTypes.NetworkResource, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var netResources *resourceTypes.NetworkResource
+	result := tx.
+		Take(&netResources, accountAndAnyIDQueryCondition, accountID, resourceID, resourceID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewNetworkResourceNotFoundError(resourceID)
+		}
+		log.WithContext(ctx).Errorf("failed to get network resource from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get network resource from store")
+	}
+
+	return netResources, nil
+}
+
+func (s *SqlStore) GetNetworkResourceByName(ctx context.Context, lockStrength LockingStrength, accountID, resourceName string) (*resourceTypes.NetworkResource, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var netResources *resourceTypes.NetworkResource
+	result := tx.
+		Take(&netResources, "account_id = ? AND name = ?", accountID, resourceName)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewNetworkResourceNotFoundError(resourceName)
+		}
+		log.WithContext(ctx).Errorf("failed to get network resource from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get network resource from store")
+	}
+
+	return netResources, nil
+}
+
+func (s *SqlStore) SaveNetworkResource(ctx context.Context, resource *resourceTypes.NetworkResource) error {
+	result := s.db.Save(resource)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save network resource to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to save network resource to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) DeleteNetworkResource(ctx context.Context, accountID, resourceID string) error {
+	result := s.db.Delete(&resourceTypes.NetworkResource{}, accountAndIDQueryCondition, accountID, resourceID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete network resource from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete network resource from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewNetworkResourceNotFoundError(resourceID)
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_network_resource_test.go b/management/server/store/sql_store_network_resource_test.go
new file mode 100644
index 000000000..620874e54
--- /dev/null
+++ b/management/server/store/sql_store_network_resource_test.go
@@ -0,0 +1,161 @@
+package store
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestSqlStore_GetNetworkResourcesByNetID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	tests := []struct {
+		name          string
+		networkID     string
+		expectedCount int
+	}{
+		{
+			name:          "retrieve resources by existing network ID",
+			networkID:     "ct286bi7qv930dsrrug0",
+			expectedCount: 1,
+		},
+		{
+			name:          "retrieve resources by non-existing network ID",
+			networkID:     "non-existent",
+			expectedCount: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			netResources, err := store.GetNetworkResourcesByNetID(context.Background(), LockingStrengthNone, accountID, tt.networkID)
+			require.NoError(t, err)
+			require.Len(t, netResources, tt.expectedCount)
+		})
+	}
+}
+
+func TestSqlStore_GetNetworkResourceByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	tests := []struct {
+		name          string
+		netResourceID string
+		expectError   bool
+	}{
+		{
+			name:          "retrieve existing network resource ID",
+			netResourceID: "ctc4nci7qv9061u6ilfg",
+			expectError:   false,
+		},
+		{
+			name:          "retrieve non-existing network resource ID",
+			netResourceID: "non-existing",
+			expectError:   true,
+		},
+		{
+			name:          "retrieve network with empty resource ID",
+			netResourceID: "",
+			expectError:   true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			netResource, err := store.GetNetworkResourceByID(context.Background(), LockingStrengthNone, accountID, tt.netResourceID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, netResource)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, netResource)
+				require.Equal(t, tt.netResourceID, netResource.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_GetNetworkResourceByIDOrPublicID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	netResourceID := "ctc4nci7qv9061u6ilfg"
+
+	netResource, err := store.GetNetworkResourceByID(context.Background(), LockingStrengthNone, accountID, netResourceID)
+	require.NoError(t, err)
+	require.NotEmpty(t, netResource.PublicID)
+
+	for _, id := range []string{netResourceID, netResource.PublicID} {
+		netResource, err := store.GetNetworkResourceByIDOrPublicID(context.Background(), LockingStrengthNone, accountID, id)
+		require.NoError(t, err)
+		require.Equal(t, netResourceID, netResource.ID)
+	}
+
+	netResource, err = store.GetNetworkResourceByIDOrPublicID(context.Background(), LockingStrengthNone, accountID, "non-existing")
+	require.Error(t, err)
+	sErr, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, sErr.Type(), status.NotFound)
+	require.Nil(t, netResource)
+}
+
+func TestSqlStore_SaveNetworkResource(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	networkID := "ct286bi7qv930dsrrug0"
+
+	netResource, err := resourceTypes.NewNetworkResource(accountID, networkID, "resource-name", "", "example.com", []string{}, true)
+	require.NoError(t, err)
+
+	err = store.SaveNetworkResource(context.Background(), netResource)
+	require.NoError(t, err)
+
+	savedNetResource, err := store.GetNetworkResourceByID(context.Background(), LockingStrengthNone, accountID, netResource.ID)
+	require.NoError(t, err)
+	require.Equal(t, netResource.ID, savedNetResource.ID)
+	require.Equal(t, netResource.Name, savedNetResource.Name)
+	require.Equal(t, netResource.NetworkID, savedNetResource.NetworkID)
+	require.Equal(t, netResource.Type, resourceTypes.NetworkResourceType("domain"))
+	require.Equal(t, netResource.Domain, "example.com")
+	require.Equal(t, netResource.AccountID, savedNetResource.AccountID)
+	require.Equal(t, netResource.Prefix, netip.Prefix{})
+}
+
+func TestSqlStore_DeleteNetworkResource(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	netResourceID := "ctc4nci7qv9061u6ilfg"
+
+	err = store.DeleteNetworkResource(context.Background(), accountID, netResourceID)
+	require.NoError(t, err)
+
+	netResource, err := store.GetNetworkByID(context.Background(), LockingStrengthNone, accountID, netResourceID)
+	require.Error(t, err)
+	sErr, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, status.NotFound, sErr.Type())
+	require.Nil(t, netResource)
+}
diff --git a/management/server/store/sql_store_network_router.go b/management/server/store/sql_store_network_router.go
new file mode 100644
index 000000000..bb5cb6621
--- /dev/null
+++ b/management/server/store/sql_store_network_router.go
@@ -0,0 +1,208 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) getNetworkRouters(ctx context.Context, accountID string) ([]*routerTypes.NetworkRouter, error) {
+	const query = `SELECT id, network_id, account_id, public_id, peer, peer_groups, masquerade, metric, enabled FROM network_routers WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+	routers, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (routerTypes.NetworkRouter, error) {
+		var r routerTypes.NetworkRouter
+		var peerGroups []byte
+		var masquerade, enabled sql.NullBool
+		var metric sql.NullInt64
+		err := row.Scan(&r.ID, &r.NetworkID, &r.AccountID, &r.PublicID, &r.Peer, &peerGroups, &masquerade, &metric, &enabled)
+		if err == nil {
+			if masquerade.Valid {
+				r.Masquerade = masquerade.Bool
+			}
+			if enabled.Valid {
+				r.Enabled = enabled.Bool
+			}
+			if metric.Valid {
+				r.Metric = int(metric.Int64)
+			}
+			if peerGroups != nil {
+				_ = json.Unmarshal(peerGroups, &r.PeerGroups)
+			}
+		}
+		return r, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	result := make([]*routerTypes.NetworkRouter, len(routers))
+	for i := range routers {
+		result[i] = &routers[i]
+	}
+	return result, nil
+}
+
+func (s *SqlStore) GetNetworkRoutersByNetID(ctx context.Context, lockStrength LockingStrength, accountID, netID string) ([]*routerTypes.NetworkRouter, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var netRouters []*routerTypes.NetworkRouter
+	result := tx.
+		Find(&netRouters, "account_id = ? AND network_id = ?", accountID, netID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get network routers from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get network routers from store")
+	}
+
+	return netRouters, nil
+}
+
+func (s *SqlStore) GetNetworkRoutersByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*routerTypes.NetworkRouter, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var netRouters []*routerTypes.NetworkRouter
+	result := tx.
+		Find(&netRouters, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get network routers from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get network routers from store")
+	}
+
+	return netRouters, nil
+}
+
+func (s *SqlStore) GetNetworkRouterByID(ctx context.Context, lockStrength LockingStrength, accountID, routerID string) (*routerTypes.NetworkRouter, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var netRouter *routerTypes.NetworkRouter
+	result := tx.
+		Take(&netRouter, accountAndIDQueryCondition, accountID, routerID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewNetworkRouterNotFoundError(routerID)
+		}
+		log.WithContext(ctx).Errorf("failed to get network router from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get network router from store")
+	}
+
+	return netRouter, nil
+}
+
+func (s *SqlStore) CreateNetworkRouter(ctx context.Context, router *routerTypes.NetworkRouter) error {
+	if err := s.db.Create(router).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to create network router in store: %v", err)
+		return status.Errorf(status.Internal, "failed to create network router in store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) UpdateNetworkRouter(ctx context.Context, router *routerTypes.NetworkRouter) error {
+	result := s.db.
+		Select("*").
+		Where(accountAndIDQueryCondition, router.AccountID, router.ID).
+		Updates(router)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to update network router in store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to update network router in store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewNetworkRouterNotFoundError(router.ID)
+	}
+
+	return nil
+}
+
+func (s *SqlStore) DeleteNetworkRouter(ctx context.Context, accountID, routerID string) error {
+	result := s.db.Delete(&routerTypes.NetworkRouter{}, accountAndIDQueryCondition, accountID, routerID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete network router from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete network router from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewNetworkRouterNotFoundError(routerID)
+	}
+
+	return nil
+}
+
+// GetRoutingPeerNetworks returns the distinct network names where the peer is assigned as a routing peer
+// in an enabled network router, either directly or via peer groups.
+func (s *SqlStore) GetRoutingPeerNetworks(_ context.Context, accountID, peerID string) ([]string, error) {
+	var routers []*routerTypes.NetworkRouter
+	if err := s.db.Select("peer, peer_groups, network_id").Where("account_id = ? AND enabled = true", accountID).Find(&routers).Error; err != nil {
+		return nil, status.Errorf(status.Internal, "failed to get enabled routers: %v", err)
+	}
+
+	if len(routers) == 0 {
+		return nil, nil
+	}
+
+	var groupPeers []types.GroupPeer
+	if err := s.db.Select("group_id").Where("account_id = ? AND peer_id = ?", accountID, peerID).Find(&groupPeers).Error; err != nil {
+		return nil, status.Errorf(status.Internal, "failed to get peer group memberships: %v", err)
+	}
+
+	groupSet := make(map[string]struct{}, len(groupPeers))
+	for _, gp := range groupPeers {
+		groupSet[gp.GroupID] = struct{}{}
+	}
+
+	networkIDs := make(map[string]struct{})
+	for _, r := range routers {
+		if r.Peer == peerID {
+			networkIDs[r.NetworkID] = struct{}{}
+		} else if r.Peer == "" {
+			for _, pg := range r.PeerGroups {
+				if _, ok := groupSet[pg]; ok {
+					networkIDs[r.NetworkID] = struct{}{}
+					break
+				}
+			}
+		}
+	}
+
+	if len(networkIDs) == 0 {
+		return nil, nil
+	}
+
+	ids := make([]string, 0, len(networkIDs))
+	for id := range networkIDs {
+		ids = append(ids, id)
+	}
+
+	var networks []*networkTypes.Network
+	if err := s.db.Select("name").Where("account_id = ? AND id IN ?", accountID, ids).Find(&networks).Error; err != nil {
+		return nil, status.Errorf(status.Internal, "failed to get networks: %v", err)
+	}
+
+	names := make([]string, 0, len(networks))
+	for _, n := range networks {
+		names = append(names, n.Name)
+	}
+
+	return names, nil
+}
diff --git a/management/server/store/sql_store_network_router_test.go b/management/server/store/sql_store_network_router_test.go
new file mode 100644
index 000000000..c4e5280e6
--- /dev/null
+++ b/management/server/store/sql_store_network_router_test.go
@@ -0,0 +1,161 @@
+package store
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestSqlStore_GetNetworkRoutersByNetID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	tests := []struct {
+		name          string
+		networkID     string
+		expectedCount int
+	}{
+		{
+			name:          "retrieve routers by existing network ID",
+			networkID:     "ct286bi7qv930dsrrug0",
+			expectedCount: 1,
+		},
+		{
+			name:          "retrieve routers by non-existing network ID",
+			networkID:     "non-existent",
+			expectedCount: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			routers, err := store.GetNetworkRoutersByNetID(context.Background(), LockingStrengthNone, accountID, tt.networkID)
+			require.NoError(t, err)
+			require.Len(t, routers, tt.expectedCount)
+		})
+	}
+}
+
+func TestSqlStore_GetNetworkRouterByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	tests := []struct {
+		name            string
+		networkRouterID string
+		expectError     bool
+	}{
+		{
+			name:            "retrieve existing network router ID",
+			networkRouterID: "ctc20ji7qv9ck2sebc80",
+			expectError:     false,
+		},
+		{
+			name:            "retrieve non-existing network router ID",
+			networkRouterID: "non-existing",
+			expectError:     true,
+		},
+		{
+			name:            "retrieve network with empty router ID",
+			networkRouterID: "",
+			expectError:     true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			networkRouter, err := store.GetNetworkRouterByID(context.Background(), LockingStrengthNone, accountID, tt.networkRouterID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, networkRouter)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, networkRouter)
+				require.Equal(t, tt.networkRouterID, networkRouter.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_CreateNetworkRouter(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	networkID := "ct286bi7qv930dsrrug0"
+
+	netRouter, err := routerTypes.NewNetworkRouter(accountID, networkID, "", []string{"net-router-grp"}, true, 0, true)
+	require.NoError(t, err)
+
+	err = store.CreateNetworkRouter(context.Background(), netRouter)
+	require.NoError(t, err)
+
+	savedNetRouter, err := store.GetNetworkRouterByID(context.Background(), LockingStrengthNone, accountID, netRouter.ID)
+	require.NoError(t, err)
+	require.Equal(t, netRouter, savedNetRouter)
+}
+
+func TestSqlStore_UpdateNetworkRouter(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	networkID := "ct286bi7qv930dsrrug0"
+	routerID := "ctc20ji7qv9ck2sebc80"
+
+	netRouter := &routerTypes.NetworkRouter{
+		ID:         routerID,
+		AccountID:  accountID,
+		NetworkID:  networkID,
+		Peer:       "",
+		PeerGroups: []string{"net-router-grp"},
+		Masquerade: true,
+		Metric:     42,
+		Enabled:    true,
+	}
+
+	err = store.UpdateNetworkRouter(context.Background(), netRouter)
+	require.NoError(t, err)
+
+	savedNetRouter, err := store.GetNetworkRouterByID(context.Background(), LockingStrengthNone, accountID, routerID)
+	require.NoError(t, err)
+	require.Equal(t, netRouter, savedNetRouter)
+
+	// Updating a router under a different account must not match any row.
+	netRouter.AccountID = "non-existent-account"
+	err = store.UpdateNetworkRouter(context.Background(), netRouter)
+	require.Error(t, err)
+}
+
+func TestSqlStore_DeleteNetworkRouter(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	netRouterID := "ctc20ji7qv9ck2sebc80"
+
+	err = store.DeleteNetworkRouter(context.Background(), accountID, netRouterID)
+	require.NoError(t, err)
+
+	netRouter, err := store.GetNetworkByID(context.Background(), LockingStrengthNone, accountID, netRouterID)
+	require.Error(t, err)
+	sErr, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, status.NotFound, sErr.Type())
+	require.Nil(t, netRouter)
+}
diff --git a/management/server/store/sql_store_network_test.go b/management/server/store/sql_store_network_test.go
new file mode 100644
index 000000000..1eeda7cfc
--- /dev/null
+++ b/management/server/store/sql_store_network_test.go
@@ -0,0 +1,128 @@
+package store
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestSqlStore_GetAccountNetworks(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name          string
+		accountID     string
+		expectedCount int
+	}{
+		{
+			name:          "retrieve networks by existing account ID",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			expectedCount: 1,
+		},
+
+		{
+			name:          "retrieve networks by non-existing account ID",
+			accountID:     "non-existent",
+			expectedCount: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			networks, err := store.GetAccountNetworks(context.Background(), LockingStrengthNone, tt.accountID)
+			require.NoError(t, err)
+			require.Len(t, networks, tt.expectedCount)
+		})
+	}
+}
+
+func TestSqlStore_GetNetworkByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	tests := []struct {
+		name        string
+		networkID   string
+		expectError bool
+	}{
+		{
+			name:        "retrieve existing network ID",
+			networkID:   "ct286bi7qv930dsrrug0",
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing network ID",
+			networkID:   "non-existing",
+			expectError: true,
+		},
+		{
+			name:        "retrieve network with empty ID",
+			networkID:   "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			network, err := store.GetNetworkByID(context.Background(), LockingStrengthNone, accountID, tt.networkID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, network)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, network)
+				require.Equal(t, tt.networkID, network.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_SaveNetwork(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	network := &networkTypes.Network{
+		ID:        "net-id",
+		AccountID: accountID,
+		Name:      "net",
+	}
+
+	err = store.SaveNetwork(context.Background(), network)
+	require.NoError(t, err)
+
+	savedNet, err := store.GetNetworkByID(context.Background(), LockingStrengthNone, accountID, network.ID)
+	require.NoError(t, err)
+	require.Equal(t, network, savedNet)
+}
+
+func TestSqlStore_DeleteNetwork(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	networkID := "ct286bi7qv930dsrrug0"
+
+	err = store.DeleteNetwork(context.Background(), accountID, networkID)
+	require.NoError(t, err)
+
+	network, err := store.GetNetworkByID(context.Background(), LockingStrengthNone, accountID, networkID)
+	require.Error(t, err)
+	sErr, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, status.NotFound, sErr.Type())
+	require.Nil(t, network)
+}
diff --git a/management/server/store/sql_store_peer.go b/management/server/store/sql_store_peer.go
new file mode 100644
index 000000000..657d2a6e0
--- /dev/null
+++ b/management/server/store/sql_store_peer.go
@@ -0,0 +1,947 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) SavePeer(ctx context.Context, accountID string, peer *nbpeer.Peer) error {
+	// To maintain data integrity, we create a copy of the peer's to prevent unintended updates to other fields.
+	peerCopy := peer.Copy()
+	peerCopy.AccountID = accountID
+
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
+		// check if peer exists before saving
+		var peerID string
+		result := tx.Model(&nbpeer.Peer{}).Select("id").Take(&peerID, accountAndIDQueryCondition, accountID, peer.ID)
+		if result.Error != nil {
+			if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+				return status.Errorf(status.NotFound, peerNotFoundFMT, peer.ID)
+			}
+			return result.Error
+		}
+
+		if peerID == "" {
+			return status.Errorf(status.NotFound, peerNotFoundFMT, peer.ID)
+		}
+
+		result = tx.Model(&nbpeer.Peer{}).Where(accountAndIDQueryCondition, accountID, peer.ID).Save(peerCopy)
+		if result.Error != nil {
+			return status.Errorf(status.Internal, "failed to save peer to store: %v", result.Error)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *SqlStore) SavePeerStatus(ctx context.Context, accountID, peerID string, peerStatus nbpeer.PeerStatus) error {
+	var peerCopy nbpeer.Peer
+	peerCopy.Status = &peerStatus
+
+	fieldsToUpdate := []string{
+		"peer_status_last_seen", "peer_status_session_started_at",
+		"peer_status_connected", "peer_status_login_expired",
+		"peer_status_requires_approval",
+	}
+	result := s.db.Model(&nbpeer.Peer{}).
+		Select(fieldsToUpdate).
+		Where(accountAndIDQueryCondition, accountID, peerID).
+		Updates(&peerCopy)
+	if result.Error != nil {
+		return status.Errorf(status.Internal, "failed to save peer status to store: %v", result.Error)
+	}
+
+	if result.RowsAffected == 0 {
+		return status.Errorf(status.NotFound, peerNotFoundFMT, peerID)
+	}
+
+	return nil
+}
+
+// MarkPeerConnectedIfNewerSession is an atomic optimistic-locked update.
+// The peer is marked connected with the given session token only when
+// the stored SessionStartedAt is strictly smaller than the incoming
+// one — equivalently, when no newer stream has already taken ownership.
+// The sentinel zero (set on peer creation or after a disconnect) counts
+// as the smallest possible token. This is the write half of the
+// fencing protocol described on PeerStatus.SessionStartedAt.
+//
+// The post-write side effects in the caller — geo lookup,
+// schedulePeerLoginExpiration, checkAndSchedulePeerInactivityExpiration,
+// OnPeersUpdated — all run AFTER this method returns and are deliberately
+// outside the database write so they cannot extend the row-lock window.
+//
+// LastSeen is set to the database's clock (CURRENT_TIMESTAMP) at the
+// moment the row is written. The caller never supplies LastSeen because
+// the value would otherwise drift under lock contention — a Go-side
+// time.Now() taken before the write can land minutes later than the
+// actual UPDATE under load, which previously caused real ordering bugs.
+func (s *SqlStore) MarkPeerConnectedIfNewerSession(ctx context.Context, accountID, peerID string, newSessionStartedAt int64) (bool, error) {
+	result := s.db.WithContext(ctx).
+		Model(&nbpeer.Peer{}).
+		Where(accountAndIDQueryCondition, accountID, peerID).
+		Where("peer_status_session_started_at < ?", newSessionStartedAt).
+		Updates(map[string]any{
+			"peer_status_connected":          true,
+			"peer_status_last_seen":          gorm.Expr("CURRENT_TIMESTAMP"),
+			"peer_status_session_started_at": newSessionStartedAt,
+			"peer_status_login_expired":      false,
+		})
+	if result.Error != nil {
+		return false, status.Errorf(status.Internal, "mark peer connected: %v", result.Error)
+	}
+	return result.RowsAffected > 0, nil
+}
+
+// MarkPeerDisconnectedIfSameSession is an atomic optimistic-locked update.
+// The peer is marked disconnected only when the stored SessionStartedAt
+// matches the incoming token — meaning the stream that owns the current
+// session is the one ending. If a newer stream has already replaced the
+// session, the update is skipped. LastSeen is set to CURRENT_TIMESTAMP at
+// write time; see MarkPeerConnectedIfNewerSession for the rationale.
+//
+// A zero sessionStartedAt is rejected at the call site; the underlying
+// WHERE on equality would otherwise match every never-connected peer.
+func (s *SqlStore) MarkPeerDisconnectedIfSameSession(ctx context.Context, accountID, peerID string, sessionStartedAt int64) (bool, error) {
+	if sessionStartedAt == 0 {
+		return false, nil
+	}
+	result := s.db.WithContext(ctx).
+		Model(&nbpeer.Peer{}).
+		Where(accountAndIDQueryCondition, accountID, peerID).
+		Where("peer_status_session_started_at = ?", sessionStartedAt).
+		Updates(map[string]any{
+			"peer_status_connected":          false,
+			"peer_status_last_seen":          gorm.Expr("CURRENT_TIMESTAMP"),
+			"peer_status_session_started_at": int64(0),
+		})
+	if result.Error != nil {
+		return false, status.Errorf(status.Internal, "mark peer disconnected: %v", result.Error)
+	}
+	return result.RowsAffected > 0, nil
+}
+
+// ApproveAccountPeers marks all peers that currently require approval in the given account as approved.
+func (s *SqlStore) ApproveAccountPeers(ctx context.Context, accountID string) (int, error) {
+	result := s.db.Model(&nbpeer.Peer{}).
+		Where("account_id = ? AND peer_status_requires_approval = ?", accountID, true).
+		Update("peer_status_requires_approval", false)
+	if result.Error != nil {
+		return 0, status.Errorf(status.Internal, "failed to approve pending account peers: %v", result.Error)
+	}
+
+	return int(result.RowsAffected), nil
+}
+
+// RefreshPeerLastSeen updates only peer_status_last_seen. Every other status
+// column is left untouched: peer_status_connected and
+// peer_status_session_started_at belong to the sync stream that owns the
+// session, and a blind write here would corrupt the fencing
+// MarkPeerConnectedIfNewerSession relies on.
+//
+// LastSeen comes from the database clock for the same reason it does there: a
+// Go-side timestamp is taken before the write and can land after a connect that
+// used CURRENT_TIMESTAMP, dragging the column backwards.
+//
+// staleBefore carries the caller's throttle into the same statement, so
+// concurrent requests for one peer collapse into a single write instead of
+// each racing on its own stale read. The column is nullable — Status is an
+// embedded pointer, so a peer stored without one leaves it NULL — and NULL
+// loses every comparison, hence the explicit branch for a peer never seen.
+func (s *SqlStore) RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
+	result := s.db.WithContext(ctx).
+		Model(&nbpeer.Peer{}).
+		Where(accountAndIDQueryCondition, accountID, peerID).
+		Where("(peer_status_last_seen IS NULL OR peer_status_last_seen < ?)", staleBefore).
+		Update("peer_status_last_seen", gorm.Expr("CURRENT_TIMESTAMP"))
+	if result.Error != nil {
+		return false, status.Errorf(status.Internal, "refresh peer last seen: %v", result.Error)
+	}
+
+	return result.RowsAffected > 0, nil
+}
+
+func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Peer, error) {
+	const query = `SELECT id, account_id, key, ip, name, dns_label, user_id, ssh_key, ssh_enabled, login_expiration_enabled,
+	inactivity_expiration_enabled, last_login, created_at, ephemeral, extra_dns_labels, allow_extra_dns_labels, meta_hostname,
+	meta_go_os, meta_kernel, meta_core, meta_platform, meta_os, meta_os_version, meta_wt_version, meta_ui_version,
+	meta_kernel_version, meta_network_addresses, meta_system_serial_number, meta_system_product_name, meta_system_manufacturer,
+	meta_environment, meta_flags, meta_files, meta_certificates, meta_capabilities, peer_status_last_seen, peer_status_session_started_at,
+	peer_status_connected, peer_status_login_expired, peer_status_requires_approval, location_connection_ip,
+	location_country_code, location_city_name, location_geo_name_id, proxy_meta_embedded, proxy_meta_cluster, ipv6, meta_sync_message_version
+	FROM peers WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+
+	peers, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (nbpeer.Peer, error) {
+		var p nbpeer.Peer
+		p.Status = &nbpeer.PeerStatus{}
+		var (
+			lastLogin, createdAt                                                                            sql.NullTime
+			sshEnabled, loginExpirationEnabled, inactivityExpirationEnabled, ephemeral, allowExtraDNSLabels sql.NullBool
+			peerStatusLastSeen                                                                              sql.NullTime
+			peerStatusSessionStartedAt                                                                      sql.NullInt64
+			peerStatusConnected, peerStatusLoginExpired, peerStatusRequiresApproval, proxyEmbedded          sql.NullBool
+			ip, extraDNS, netAddr, env, flags, files, certificates, capabilities, connIP, ipv6              []byte
+			metaHostname, metaGoOS, metaKernel, metaCore, metaPlatform                                      sql.NullString
+			metaOS, metaOSVersion, metaWtVersion, metaUIVersion, metaKernelVersion                          sql.NullString
+			metaSystemSerialNumber, metaSystemProductName, metaSystemManufacturer                           sql.NullString
+			locationCountryCode, locationCityName, proxyCluster                                             sql.NullString
+			locationGeoNameID                                                                               sql.NullInt64
+			metaSyncMessageVersion                                                                          sql.NullInt32
+		)
+
+		err := row.Scan(&p.ID, &p.AccountID, &p.Key, &ip, &p.Name, &p.DNSLabel, &p.UserID, &p.SSHKey, &sshEnabled,
+			&loginExpirationEnabled, &inactivityExpirationEnabled, &lastLogin, &createdAt, &ephemeral, &extraDNS,
+			&allowExtraDNSLabels, &metaHostname, &metaGoOS, &metaKernel, &metaCore, &metaPlatform,
+			&metaOS, &metaOSVersion, &metaWtVersion, &metaUIVersion, &metaKernelVersion, &netAddr,
+			&metaSystemSerialNumber, &metaSystemProductName, &metaSystemManufacturer, &env, &flags, &files, &certificates, &capabilities,
+			&peerStatusLastSeen, &peerStatusSessionStartedAt, &peerStatusConnected, &peerStatusLoginExpired,
+			&peerStatusRequiresApproval, &connIP, &locationCountryCode, &locationCityName, &locationGeoNameID,
+			&proxyEmbedded, &proxyCluster, &ipv6, &metaSyncMessageVersion)
+
+		if err == nil {
+			if lastLogin.Valid {
+				p.LastLogin = &lastLogin.Time
+			}
+			if createdAt.Valid {
+				p.CreatedAt = createdAt.Time
+			}
+			if sshEnabled.Valid {
+				p.SSHEnabled = sshEnabled.Bool
+			}
+			if loginExpirationEnabled.Valid {
+				p.LoginExpirationEnabled = loginExpirationEnabled.Bool
+			}
+			if inactivityExpirationEnabled.Valid {
+				p.InactivityExpirationEnabled = inactivityExpirationEnabled.Bool
+			}
+			if ephemeral.Valid {
+				p.Ephemeral = ephemeral.Bool
+			}
+			if allowExtraDNSLabels.Valid {
+				p.AllowExtraDNSLabels = allowExtraDNSLabels.Bool
+			}
+			if peerStatusLastSeen.Valid {
+				p.Status.LastSeen = peerStatusLastSeen.Time
+			}
+			if peerStatusSessionStartedAt.Valid {
+				p.Status.SessionStartedAt = peerStatusSessionStartedAt.Int64
+			}
+			if peerStatusConnected.Valid {
+				p.Status.Connected = peerStatusConnected.Bool
+			}
+			if peerStatusLoginExpired.Valid {
+				p.Status.LoginExpired = peerStatusLoginExpired.Bool
+			}
+			if peerStatusRequiresApproval.Valid {
+				p.Status.RequiresApproval = peerStatusRequiresApproval.Bool
+			}
+			if metaHostname.Valid {
+				p.Meta.Hostname = metaHostname.String
+			}
+			if metaGoOS.Valid {
+				p.Meta.GoOS = metaGoOS.String
+			}
+			if metaKernel.Valid {
+				p.Meta.Kernel = metaKernel.String
+			}
+			if metaCore.Valid {
+				p.Meta.Core = metaCore.String
+			}
+			if metaPlatform.Valid {
+				p.Meta.Platform = metaPlatform.String
+			}
+			if metaOS.Valid {
+				p.Meta.OS = metaOS.String
+			}
+			if metaOSVersion.Valid {
+				p.Meta.OSVersion = metaOSVersion.String
+			}
+			if metaWtVersion.Valid {
+				p.Meta.WtVersion = metaWtVersion.String
+			}
+			if metaUIVersion.Valid {
+				p.Meta.UIVersion = metaUIVersion.String
+			}
+			if metaKernelVersion.Valid {
+				p.Meta.KernelVersion = metaKernelVersion.String
+			}
+			if metaSystemSerialNumber.Valid {
+				p.Meta.SystemSerialNumber = metaSystemSerialNumber.String
+			}
+			if metaSystemProductName.Valid {
+				p.Meta.SystemProductName = metaSystemProductName.String
+			}
+			if metaSystemManufacturer.Valid {
+				p.Meta.SystemManufacturer = metaSystemManufacturer.String
+			}
+			if locationCountryCode.Valid {
+				p.Location.CountryCode = locationCountryCode.String
+			}
+			if locationCityName.Valid {
+				p.Location.CityName = locationCityName.String
+			}
+			if locationGeoNameID.Valid {
+				p.Location.GeoNameID = uint(locationGeoNameID.Int64)
+			}
+			if proxyEmbedded.Valid {
+				p.ProxyMeta.Embedded = proxyEmbedded.Bool
+			}
+			if proxyCluster.Valid {
+				p.ProxyMeta.Cluster = proxyCluster.String
+			}
+			if ip != nil {
+				_ = json.Unmarshal(ip, &p.IP)
+			}
+			if ipv6 != nil {
+				_ = json.Unmarshal(ipv6, &p.IPv6)
+			}
+			if extraDNS != nil {
+				_ = json.Unmarshal(extraDNS, &p.ExtraDNSLabels)
+			}
+			if netAddr != nil {
+				_ = json.Unmarshal(netAddr, &p.Meta.NetworkAddresses)
+			}
+			if env != nil {
+				_ = json.Unmarshal(env, &p.Meta.Environment)
+			}
+			if flags != nil {
+				_ = json.Unmarshal(flags, &p.Meta.Flags)
+			}
+			if files != nil {
+				_ = json.Unmarshal(files, &p.Meta.Files)
+			}
+			if certificates != nil {
+				_ = json.Unmarshal(certificates, &p.Meta.Certificates)
+			}
+			if capabilities != nil {
+				_ = json.Unmarshal(capabilities, &p.Meta.Capabilities)
+			}
+			if connIP != nil {
+				_ = json.Unmarshal(connIP, &p.Location.ConnectionIP)
+			}
+			if metaSyncMessageVersion.Valid {
+				p.Meta.SyncMessageVersion = int(metaSyncMessageVersion.Int32)
+			}
+		}
+		return p, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	return peers, nil
+}
+
+func (s *SqlStore) GetAccountByPeerID(ctx context.Context, peerID string) (*types.Account, error) {
+	var peer nbpeer.Peer
+	result := s.db.Select("account_id").Take(&peer, idQueryCondition, peerID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
+		}
+		return nil, status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	if peer.AccountID == "" {
+		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
+	}
+
+	return s.GetAccount(ctx, peer.AccountID)
+}
+
+func (s *SqlStore) GetAccountByPeerPubKey(ctx context.Context, peerKey string) (*types.Account, error) {
+	var peer nbpeer.Peer
+	result := s.db.Select("account_id").Take(&peer, GetKeyQueryCondition(s), peerKey)
+
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
+		}
+		return nil, status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	if peer.AccountID == "" {
+		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
+	}
+
+	return s.GetAccount(ctx, peer.AccountID)
+}
+
+func (s *SqlStore) GetAccountIDByPeerPubKey(ctx context.Context, peerKey string) (string, error) {
+	var peer nbpeer.Peer
+	var accountID string
+	result := s.db.Model(&peer).Select("account_id").Where(GetKeyQueryCondition(s), peerKey).Take(&accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
+		}
+		return "", status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	return accountID, nil
+}
+
+func (s *SqlStore) GetAccountIDByPeerID(ctx context.Context, lockStrength LockingStrength, peerID string) (string, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var accountID string
+	result := tx.Model(&nbpeer.Peer{}).
+		Select("account_id").Where(idQueryCondition, peerID).Take(&accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return "", status.Errorf(status.NotFound, "peer %s account not found", peerID)
+		}
+		return "", status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	return accountID, nil
+}
+
+func (s *SqlStore) GetTakenIPs(ctx context.Context, lockStrength LockingStrength, accountID string) ([]netip.Addr, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var ipJSONStrings []string
+
+	result := tx.Model(&nbpeer.Peer{}).
+		Where("account_id = ?", accountID).
+		Pluck("ip", &ipJSONStrings)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "no peers found for the account")
+		}
+		return nil, status.Errorf(status.Internal, "issue getting IPs from store: %s", result.Error)
+	}
+
+	ips := make([]netip.Addr, len(ipJSONStrings))
+	for i, ipJSON := range ipJSONStrings {
+		var ip netip.Addr
+		if err := json.Unmarshal([]byte(ipJSON), &ip); err != nil {
+			return nil, status.Errorf(status.Internal, "issue parsing IP JSON from store")
+		}
+		ips[i] = ip.Unmap()
+	}
+
+	return ips, nil
+}
+
+func (s *SqlStore) GetPeerLabelsInAccount(ctx context.Context, lockStrength LockingStrength, accountID string, dnsLabel string) ([]string, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var labels []string
+	result := tx.Model(&nbpeer.Peer{}).
+		Where("account_id = ? AND dns_label LIKE ?", accountID, dnsLabel+"%").
+		Pluck("dns_label", &labels)
+
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "no peers found for the account")
+		}
+		log.WithContext(ctx).Errorf("error when getting dns labels from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "issue getting dns labels from store: %s", result.Error)
+	}
+
+	return labels, nil
+}
+
+func (s *SqlStore) GetPeerByPeerPubKey(ctx context.Context, lockStrength LockingStrength, peerKey string) (*nbpeer.Peer, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var peer nbpeer.Peer
+	result := tx.Take(&peer, GetKeyQueryCondition(s), peerKey)
+
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewPeerNotFoundError(peerKey)
+		}
+		return nil, status.Errorf(status.Internal, "issue getting peer from store: %s", result.Error)
+	}
+
+	return &peer, nil
+}
+
+func (s *SqlStore) GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
+	var peers []*nbpeer.Peer
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+	query := tx.Where(accountIDCondition, accountID)
+
+	if nameFilter != "" {
+		query = query.Where("name LIKE ?", "%"+nameFilter+"%")
+	}
+	if ipFilter != "" {
+		query = query.Where("ip LIKE ? OR ipv6 LIKE ?", "%"+ipFilter+"%", "%"+ipFilter+"%")
+	}
+	// MAC addresses live in the JSON-serialized meta_network_addresses column,
+	// so we match the raw JSON text rather than a dedicated column.
+	if macFilter != "" {
+		query = query.Where("meta_network_addresses LIKE ?", "%"+macFilter+"%")
+	}
+	if err := query.Find(&peers).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get peers from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get peers from store")
+	}
+
+	return peers, nil
+}
+
+// GetAccountPeers retrieves peers for an account.
+func (s *SqlStore) GetAccountPeersPaginated(ctx context.Context, lockStrength LockingStrength, accountID string, pagination PaginationState, filters PeerFilters, sorting PeerSorting) ([]*nbpeer.Peer, int, error) {
+	// main query
+	var peers []*nbpeer.Peer
+	{
+		tx := s.db
+		if lockStrength != LockingStrengthNone {
+			tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+		}
+		query := tx.Where("peers.account_id=?", accountID)
+		query = query.Where("(peers.proxy_meta_embedded=false or peers.proxy_meta_embedded is null)")
+		query = filters.AsConditions(query)
+		query = pagination.AsScope(query)
+		query = sorting.AsOrderBy(ctx, query)
+
+		if err := query.Distinct().Find(&peers).Error; err != nil {
+			log.WithContext(ctx).Errorf("failed to get peers from the store: %s", err)
+			return nil, 0, status.Errorf(status.Internal, "failed to get peers from store")
+		}
+	}
+
+	// total number of records
+	var peerCount int64
+	{
+		tx := s.db
+		if lockStrength != LockingStrengthNone {
+			tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+		}
+		query := tx.Where("peers.account_id=?", accountID)
+		query = query.Where("(peers.proxy_meta_embedded=false or peers.proxy_meta_embedded is null)")
+		query = filters.AsConditions(query)
+
+		if err := query.Table("peers").Select("count(distinct(peers.id))").Count(&peerCount).Error; err != nil {
+			log.WithContext(ctx).Errorf("failed to get total number of peers from the store: %s", err)
+			return nil, 0, status.Errorf(status.Internal, "failed to get total number of peers from store")
+		}
+	}
+
+	return peers, int(peerCount), nil
+}
+
+type PaginationState struct {
+	Page     int
+	PageSize int
+}
+
+func (p *PaginationState) AsScope(db *gorm.DB) *gorm.DB {
+	// empty pagination state
+	if p.PageSize == 0 {
+		return db
+	}
+	offset := max(p.Page-1, 0) * p.PageSize
+	return db.Offset(offset).Limit(p.PageSize)
+}
+
+type PeerFilters struct {
+	UserId           string
+	GroupIds         []string
+	Connected        *bool
+	ApprovalRequired *bool
+	Os               []string
+	IP               string
+	MAC              string
+	Hostname         string
+	Name             string
+	IsServer         *bool
+	PeersIds         []string
+}
+
+func (f *PeerFilters) AsConditions(db *gorm.DB) *gorm.DB {
+	if len(f.GroupIds) > 0 {
+		db = db.Joins("join group_peers on peers.id=group_peers.peer_id and peers.account_id=group_peers.account_id").Where("group_peers.group_id in (?)", f.GroupIds)
+	}
+	if f.UserId != "" {
+		db = db.Where("user_id=?", f.UserId)
+	}
+	if f.Connected != nil {
+		db = db.Where("peer_status_connected=?", *f.Connected)
+	}
+	if f.ApprovalRequired != nil {
+		db = db.Where("peer_status_requires_approval=?", *f.ApprovalRequired)
+	}
+	if len(f.Os) > 0 {
+		db = db.Where("meta_go_os in (?)", f.Os)
+	}
+	if f.IP != "" {
+		db = db.Where("ip like ? or lower(ipv6) like ?", fmt.Sprintf("%%%s%%", f.IP), fmt.Sprintf("%%%s%%", strings.ToLower(f.IP)))
+	}
+	if f.MAC != "" {
+		db = db.Where("lower(meta_network_addresses) like ?", fmt.Sprintf("%%%s%%", strings.ToLower(f.MAC)))
+	}
+	if f.Hostname != "" {
+		db = db.Where("lower(meta_hostname) like ?", fmt.Sprintf("%%%s%%", strings.ToLower(f.Hostname)))
+	}
+	if f.Name != "" {
+		db = db.Where("lower(name) like ?", fmt.Sprintf("%%%s%%", strings.ToLower(f.Name)))
+	}
+	if f.IsServer != nil {
+		if *f.IsServer {
+			db = db.Where("(user_id='' or user_id is null)")
+		} else {
+			db = db.Where("user_id<>'' and user_id is not null")
+		}
+	}
+	if len(f.PeersIds) > 0 {
+		db = db.Where("id in (?)", f.PeersIds)
+	}
+
+	return db
+}
+
+type PeerSortByField int
+
+const (
+	PeerSortByName PeerSortByField = iota
+	PeerSortByLastSeen
+	PeerSortByVersion
+)
+
+type OrderBy int
+
+const (
+	AscOrderBy OrderBy = iota
+	DescOrderBy
+)
+
+type PeerSortingKey struct {
+	Field PeerSortByField
+	Order OrderBy
+}
+
+type PeerSorting struct {
+	Fields []PeerSortingKey
+}
+
+func (s *PeerSorting) AsOrderBy(ctx context.Context, db *gorm.DB) *gorm.DB {
+	order := make([]clause.OrderByColumn, 0)
+
+	for _, key := range s.Fields {
+		switch key.Field {
+		case PeerSortByName:
+			order = append(order, clause.OrderByColumn{Column: clause.Column{Name: "peers.name"}, Desc: key.Order == DescOrderBy})
+		case PeerSortByLastSeen:
+			order = append(order, clause.OrderByColumn{Column: clause.Column{Name: "peers.peer_status_last_seen"}, Desc: key.Order == DescOrderBy})
+		case PeerSortByVersion:
+			order = append(order, clause.OrderByColumn{Column: clause.Column{Name: "meta_wt_version"}, Desc: key.Order == DescOrderBy})
+		default:
+			log.WithContext(ctx).Warnf("invalid order by column '%v', skipping", key.Field)
+		}
+	}
+
+	// always order/break ties by id asc order
+	order = append(order, clause.OrderByColumn{Column: clause.Column{Name: "peers.id"}, Desc: false})
+	return db.Order(clause.OrderBy{Columns: order})
+}
+
+// GetUserPeers retrieves peers for a user.
+func (s *SqlStore) GetUserPeers(ctx context.Context, lockStrength LockingStrength, accountID, userID string) ([]*nbpeer.Peer, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var peers []*nbpeer.Peer
+
+	// Exclude peers added via setup keys, as they are not user-specific and have an empty user_id.
+	if userID == "" {
+		return peers, nil
+	}
+
+	result := tx.
+		Find(&peers, "account_id = ? AND user_id = ?", accountID, userID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get peers from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get peers from store")
+	}
+
+	return peers, nil
+}
+
+func (s *SqlStore) AddPeerToAccount(ctx context.Context, peer *nbpeer.Peer) error {
+	if err := s.db.Create(peer).Error; err != nil {
+		return status.Errorf(status.Internal, "issue adding peer to account: %s", err)
+	}
+
+	return nil
+}
+
+// GetPeerByID retrieves a peer by its ID and account ID.
+func (s *SqlStore) GetPeerByID(ctx context.Context, lockStrength LockingStrength, accountID, peerID string) (*nbpeer.Peer, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var peer *nbpeer.Peer
+	result := tx.
+		Take(&peer, accountAndIDQueryCondition, accountID, peerID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewPeerNotFoundError(peerID)
+		}
+		return nil, status.Errorf(status.Internal, "failed to get peer from store")
+	}
+
+	return peer, nil
+}
+
+// GetPeersByIDs retrieves peers by their IDs and account ID.
+func (s *SqlStore) GetPeersByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, peerIDs []string) (map[string]*nbpeer.Peer, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var peers []*nbpeer.Peer
+	result := tx.Find(&peers, accountAndIDsQueryCondition, accountID, peerIDs)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get peers by ID's from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get peers by ID's from the store")
+	}
+
+	peersMap := make(map[string]*nbpeer.Peer)
+	for _, peer := range peers {
+		peersMap[peer.ID] = peer
+	}
+
+	return peersMap, nil
+}
+
+// GetAccountPeersWithExpiration retrieves a list of peers that have login expiration enabled and added by a user.
+func (s *SqlStore) GetAccountPeersWithExpiration(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*nbpeer.Peer, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var peers []*nbpeer.Peer
+	result := tx.
+		Where("login_expiration_enabled = ? AND peer_status_login_expired != ? AND user_id IS NOT NULL AND user_id != ''", true, true).
+		Find(&peers, accountIDCondition, accountID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get peers with expiration from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get peers with expiration from store")
+	}
+
+	return peers, nil
+}
+
+// GetAccountPeersWithInactivity retrieves a list of peers that have login expiration enabled and added by a user.
+func (s *SqlStore) GetAccountPeersWithInactivity(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*nbpeer.Peer, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var peers []*nbpeer.Peer
+	result := tx.
+		Where("inactivity_expiration_enabled = ? AND user_id IS NOT NULL AND user_id != ''", true).
+		Find(&peers, accountIDCondition, accountID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get peers with inactivity from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get peers with inactivity from store")
+	}
+
+	return peers, nil
+}
+
+// GetAllEphemeralPeers retrieves all peers with Ephemeral set to true across all accounts, optimized for batch processing.
+func (s *SqlStore) GetAllEphemeralPeers(ctx context.Context, lockStrength LockingStrength) ([]*nbpeer.Peer, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var allEphemeralPeers, batchPeers []*nbpeer.Peer
+	result := tx.
+		Where("ephemeral = ?", true).
+		FindInBatches(&batchPeers, 1000, func(tx *gorm.DB, batch int) error {
+			allEphemeralPeers = append(allEphemeralPeers, batchPeers...)
+			return nil
+		})
+
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to retrieve ephemeral peers: %s", result.Error)
+		return nil, fmt.Errorf("failed to retrieve ephemeral peers")
+	}
+
+	return allEphemeralPeers, nil
+}
+
+// DeletePeer removes a peer from the store.
+func (s *SqlStore) DeletePeer(ctx context.Context, accountID string, peerID string) error {
+	result := s.db.Delete(&nbpeer.Peer{}, accountAndIDQueryCondition, accountID, peerID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to delete peer from the store: %s", err)
+		return status.Errorf(status.Internal, "failed to delete peer from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewPeerNotFoundError(peerID)
+	}
+
+	return nil
+}
+
+func (s *SqlStore) GetPeerByIP(ctx context.Context, lockStrength LockingStrength, accountID string, ip net.IP) (*nbpeer.Peer, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	column := "ip"
+	if ip.To4() == nil {
+		column = "ipv6"
+	}
+	jsonValue := fmt.Sprintf(`"%s"`, ip.String())
+
+	var peer nbpeer.Peer
+	result := tx.
+		Take(&peer, fmt.Sprintf("account_id = ? AND %s = ?", column), accountID, jsonValue)
+	if result.Error != nil {
+		// A tunnel-IP miss is an expected outcome (e.g. the proxy's
+		// ValidateTunnelPeer probing an address that isn't in the
+		// account roster); surface it as NotFound so callers can tell
+		// it apart from a real store failure.
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "peer with ip %s not found", ip.String())
+		}
+		return nil, status.Errorf(status.Internal, "failed to get peer from store")
+	}
+
+	return &peer, nil
+}
+
+func (s *SqlStore) GetPeerIdByLabel(ctx context.Context, lockStrength LockingStrength, accountID string, hostname string) (string, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var peerID string
+	result := tx.Model(&nbpeer.Peer{}).
+		Select("id").
+		// Where(" = ?", hostname).
+		Where("account_id = ? AND dns_label = ?", accountID, hostname).
+		Limit(1).
+		Scan(&peerID)
+	if result.Error != nil {
+		return "", result.Error
+	}
+
+	if peerID == "" {
+		return "", gorm.ErrRecordNotFound
+	}
+
+	return peerID, nil
+}
+
+// GetEmbeddedProxyPeerIDsByCluster returns peer IDs of all embedded proxy peers
+// in the account, grouped by their ProxyCluster. The map is nil when no embedded
+// proxy peers exist.
+func (s *SqlStore) GetEmbeddedProxyPeerIDsByCluster(ctx context.Context, accountID string) (map[string][]string, error) {
+	type row struct {
+		ID      string
+		Cluster string
+	}
+	var rows []row
+	result := s.db.Model(&nbpeer.Peer{}).
+		Select("id, proxy_meta_cluster AS cluster").
+		Where("account_id = ? AND proxy_meta_embedded = ?", accountID, true).
+		Scan(&rows)
+	if result.Error != nil {
+		return nil, status.Errorf(status.Internal, "failed to get embedded proxy peers: %s", result.Error)
+	}
+
+	out := make(map[string][]string, len(rows))
+	for _, r := range rows {
+		out[r.Cluster] = append(out[r.Cluster], r.ID)
+	}
+	return out, nil
+}
+
+func (s *SqlStore) GetUserIDByPeerKey(ctx context.Context, lockStrength LockingStrength, peerKey string) (string, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var userID string
+	result := tx.Model(&nbpeer.Peer{}).
+		Select("user_id").
+		Take(&userID, GetKeyQueryCondition(s), peerKey)
+
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return "", status.Errorf(status.NotFound, "peer not found: index lookup failed")
+		}
+		return "", status.Errorf(status.Internal, "failed to get user ID by peer key")
+	}
+
+	return userID, nil
+}
+
+func (s *SqlStore) GetPeerIDByKey(ctx context.Context, lockStrength LockingStrength, key string) (string, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var peerID string
+	result := tx.Model(&nbpeer.Peer{}).
+		Select("id").
+		Where(GetKeyQueryCondition(s), key).
+		Limit(1).
+		Scan(&peerID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get peer ID by key: %s", result.Error)
+		return "", status.Errorf(status.Internal, "failed to get peer ID by key")
+	}
+
+	return peerID, nil
+}
diff --git a/management/server/store/sql_store_peer_test.go b/management/server/store/sql_store_peer_test.go
new file mode 100644
index 000000000..0b467e37b
--- /dev/null
+++ b/management/server/store/sql_store_peer_test.go
@@ -0,0 +1,943 @@
+package store
+
+import (
+	"context"
+	"encoding/binary"
+	"fmt"
+	"net"
+	"net/netip"
+	"reflect"
+	"sort"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/management/server/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/netbirdio/netbird/shared/testing_helpers"
+)
+
+// TestSqlStore_GetPeerByIP_NotFound pins the not-found semantics the
+// proxy's ValidateTunnelPeer relies on: a tunnel-IP that isn't in the
+// account roster must surface as a NotFound error (not a generic
+// Internal) so callers can distinguish an expected miss from a real
+// store failure. A known IP still resolves.
+func TestSqlStore_GetPeerByIP_NotFound(t *testing.T) {
+	runTestForAllEngines(t, "../testdata/store.sql", func(t *testing.T, store Store) {
+		const accountID = "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+		peer, err := store.GetPeerByIP(context.Background(), LockingStrengthNone, accountID, net.ParseIP("192.168.0.0"))
+		require.NoError(t, err, "known tunnel IP must resolve")
+		require.NotNil(t, peer)
+
+		_, err = store.GetPeerByIP(context.Background(), LockingStrengthNone, accountID, net.ParseIP("100.65.0.99"))
+		require.Error(t, err, "unknown tunnel IP must error")
+		parsedErr, ok := status.FromError(err)
+		require.True(t, ok, "error must be a status error")
+		require.Equal(t, status.NotFound, parsedErr.Type(), "tunnel-IP miss must be NotFound, not Internal")
+	})
+}
+
+func TestSqlStore_SavePeer(t *testing.T) {
+	populateFields := testing_helpers.NewPopulateFields()
+
+	runTestForAllEngines(t, "../testdata/store.sql", func(t *testing.T, store Store) {
+		account, err := store.GetAccount(context.Background(), "bf1c8084-ba50-4ce7-9439-34653001fc3b")
+		require.NoError(t, err)
+
+		metadata := nbpeer.PeerSystemMeta{}
+		reflectedMetadata := reflect.ValueOf(&metadata).Elem()
+
+		numOfFields, err := populateFields.PopulateAll(reflectedMetadata)
+		assert.NoError(t, err)
+		assert.Equal(t, 34, numOfFields)
+
+		// save status of non-existing peer
+		peer := &nbpeer.Peer{
+			Key:       "peerkey",
+			ID:        "testpeer",
+			IP:        netip.AddrFrom4([4]byte{127, 0, 0, 1}),
+			IPv6:      netip.MustParseAddr("fd00::1"),
+			Meta:      metadata, //nbpeer.PeerSystemMeta{Hostname: "testingpeer"},
+			Name:      "peer name",
+			Status:    &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
+			CreatedAt: time.Now().UTC(),
+		}
+		ctx := context.Background()
+		err = store.SavePeer(ctx, account.Id, peer)
+		assert.Error(t, err)
+		parsedErr, ok := status.FromError(err)
+		require.True(t, ok)
+		require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
+
+		// save new status of existing peer
+		account.Peers[peer.ID] = peer
+
+		err = store.SaveAccount(context.Background(), account)
+		require.NoError(t, err)
+
+		updatedPeer := peer.Copy()
+		updatedPeer.Status.Connected = false
+		updatedPeer.Meta.Hostname = "updatedpeer"
+
+		err = store.SavePeer(ctx, account.Id, updatedPeer)
+		require.NoError(t, err)
+
+		account, err = store.GetAccount(context.Background(), account.Id)
+		require.NoError(t, err)
+
+		actual := account.Peers[peer.ID]
+		assert.Equal(t, updatedPeer.Meta, actual.Meta)
+		assert.Equal(t, updatedPeer.Status.Connected, actual.Status.Connected)
+		assert.Equal(t, updatedPeer.Status.LoginExpired, actual.Status.LoginExpired)
+		assert.Equal(t, updatedPeer.Status.RequiresApproval, actual.Status.RequiresApproval)
+		assert.WithinDurationf(t, updatedPeer.Status.LastSeen, actual.Status.LastSeen.UTC(), time.Millisecond, "LastSeen should be equal")
+	})
+}
+
+func TestSqlStore_SavePeerStatus(t *testing.T) {
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanUp)
+	assert.NoError(t, err)
+
+	account, err := store.GetAccount(context.Background(), "bf1c8084-ba50-4ce7-9439-34653001fc3b")
+	require.NoError(t, err)
+
+	// save status of non-existing peer
+	newStatus := nbpeer.PeerStatus{Connected: false, LastSeen: time.Now().UTC()}
+	err = store.SavePeerStatus(context.Background(), account.Id, "non-existing-peer", newStatus)
+	assert.Error(t, err)
+	parsedErr, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
+
+	// save new status of existing peer
+	account.Peers["testpeer"] = &nbpeer.Peer{
+		Key:    "peerkey",
+		ID:     "testpeer",
+		IP:     netip.AddrFrom4([4]byte{127, 0, 0, 1}),
+		IPv6:   netip.MustParseAddr("fd00::1"),
+		Meta:   nbpeer.PeerSystemMeta{},
+		Name:   "peer name",
+		Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
+	}
+
+	err = store.SaveAccount(context.Background(), account)
+	require.NoError(t, err)
+
+	err = store.SavePeerStatus(context.Background(), account.Id, "testpeer", newStatus)
+	require.NoError(t, err)
+
+	account, err = store.GetAccount(context.Background(), account.Id)
+	require.NoError(t, err)
+
+	actual := account.Peers["testpeer"].Status
+	assert.Equal(t, newStatus.Connected, actual.Connected)
+	assert.Equal(t, newStatus.LoginExpired, actual.LoginExpired)
+	assert.Equal(t, newStatus.RequiresApproval, actual.RequiresApproval)
+	assert.WithinDurationf(t, newStatus.LastSeen, actual.LastSeen.UTC(), time.Millisecond, "LastSeen should be equal")
+
+	newStatus.Connected = true
+
+	err = store.SavePeerStatus(context.Background(), account.Id, "testpeer", newStatus)
+	require.NoError(t, err)
+
+	account, err = store.GetAccount(context.Background(), account.Id)
+	require.NoError(t, err)
+
+	actual = account.Peers["testpeer"].Status
+	assert.Equal(t, newStatus.Connected, actual.Connected)
+	assert.Equal(t, newStatus.LoginExpired, actual.LoginExpired)
+	assert.Equal(t, newStatus.RequiresApproval, actual.RequiresApproval)
+	assert.WithinDurationf(t, newStatus.LastSeen, actual.LastSeen.UTC(), time.Millisecond, "LastSeen should be equal")
+}
+
+func TestSqlite_GetTakenIPs(t *testing.T) {
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	defer cleanup()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	_, err = store.GetAccount(context.Background(), existingAccountID)
+	require.NoError(t, err)
+
+	takenIPs, err := store.GetTakenIPs(context.Background(), LockingStrengthNone, existingAccountID)
+	require.NoError(t, err)
+	assert.Equal(t, []netip.Addr{}, takenIPs)
+
+	peer1 := &nbpeer.Peer{
+		ID:        "peer1",
+		AccountID: existingAccountID,
+		Key:       "key1",
+		DNSLabel:  "peer1",
+		IP:        netip.AddrFrom4([4]byte{1, 1, 1, 1}),
+		IPv6:      netip.MustParseAddr("fd00::1:1:1:1"),
+	}
+	err = store.AddPeerToAccount(context.Background(), peer1)
+	require.NoError(t, err)
+
+	takenIPs, err = store.GetTakenIPs(context.Background(), LockingStrengthNone, existingAccountID)
+	require.NoError(t, err)
+	ip1 := netip.AddrFrom4([4]byte{1, 1, 1, 1})
+	assert.Equal(t, []netip.Addr{ip1}, takenIPs)
+
+	peer2 := &nbpeer.Peer{
+		ID:        "peer1second",
+		AccountID: existingAccountID,
+		Key:       "key2",
+		DNSLabel:  "peer1-1",
+		IP:        netip.AddrFrom4([4]byte{2, 2, 2, 2}),
+		IPv6:      netip.MustParseAddr("fd00::2:2:2:2"),
+	}
+	err = store.AddPeerToAccount(context.Background(), peer2)
+	require.NoError(t, err)
+
+	takenIPs, err = store.GetTakenIPs(context.Background(), LockingStrengthNone, existingAccountID)
+	require.NoError(t, err)
+	ip2 := netip.AddrFrom4([4]byte{2, 2, 2, 2})
+	assert.Equal(t, []netip.Addr{ip1, ip2}, takenIPs)
+}
+
+func TestSqlite_GetPeerLabelsInAccount(t *testing.T) {
+	runTestForAllEngines(t, "../testdata/extended-store.sql", func(t *testing.T, store Store) {
+		existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+		peerHostname := "peer1"
+
+		_, err := store.GetAccount(context.Background(), existingAccountID)
+		require.NoError(t, err)
+
+		labels, err := store.GetPeerLabelsInAccount(context.Background(), LockingStrengthNone, existingAccountID, peerHostname)
+		require.NoError(t, err)
+		assert.Equal(t, []string{}, labels)
+
+		peer1 := &nbpeer.Peer{
+			ID:        "peer1",
+			AccountID: existingAccountID,
+			Key:       "key1",
+			DNSLabel:  "peer1",
+			IP:        netip.AddrFrom4([4]byte{1, 1, 1, 1}),
+			IPv6:      netip.MustParseAddr("fd00::1:1:1:1"),
+		}
+		err = store.AddPeerToAccount(context.Background(), peer1)
+		require.NoError(t, err)
+
+		labels, err = store.GetPeerLabelsInAccount(context.Background(), LockingStrengthNone, existingAccountID, peerHostname)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"peer1"}, labels)
+
+		peer2 := &nbpeer.Peer{
+			ID:        "peer1second",
+			AccountID: existingAccountID,
+			Key:       "key2",
+			DNSLabel:  "peer1-1",
+			IP:        netip.AddrFrom4([4]byte{2, 2, 2, 2}),
+			IPv6:      netip.MustParseAddr("fd00::2:2:2:2"),
+		}
+		err = store.AddPeerToAccount(context.Background(), peer2)
+		require.NoError(t, err)
+
+		labels, err = store.GetPeerLabelsInAccount(context.Background(), LockingStrengthNone, existingAccountID, peerHostname)
+		require.NoError(t, err)
+
+		expected := []string{"peer1", "peer1-1"}
+		sort.Strings(expected)
+		sort.Strings(labels)
+		assert.Equal(t, expected, labels)
+	})
+}
+
+func Test_AddPeerWithSameDnsLabel(t *testing.T) {
+	runTestForAllEngines(t, "../testdata/extended-store.sql", func(t *testing.T, store Store) {
+		existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+		_, err := store.GetAccount(context.Background(), existingAccountID)
+		require.NoError(t, err)
+
+		peer1 := &nbpeer.Peer{
+			ID:        "peer1",
+			AccountID: existingAccountID,
+			Key:       "key1",
+			DNSLabel:  "peer1.domain.test",
+		}
+		err = store.AddPeerToAccount(context.Background(), peer1)
+		require.NoError(t, err)
+
+		peer2 := &nbpeer.Peer{
+			ID:        "peer1second",
+			AccountID: existingAccountID,
+			Key:       "key2",
+			DNSLabel:  "peer1.domain.test",
+		}
+		err = store.AddPeerToAccount(context.Background(), peer2)
+		require.Error(t, err)
+	})
+}
+
+func Test_AddPeerWithSameIP(t *testing.T) {
+	runTestForAllEngines(t, "../testdata/extended-store.sql", func(t *testing.T, store Store) {
+		existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+		_, err := store.GetAccount(context.Background(), existingAccountID)
+		require.NoError(t, err)
+
+		peer1 := &nbpeer.Peer{
+			ID:        "peer1",
+			AccountID: existingAccountID,
+			Key:       "key1",
+			IP:        netip.AddrFrom4([4]byte{1, 1, 1, 1}),
+			IPv6:      netip.MustParseAddr("fd00::1:1:1:1"),
+		}
+		err = store.AddPeerToAccount(context.Background(), peer1)
+		require.NoError(t, err)
+
+		peer2 := &nbpeer.Peer{
+			ID:        "peer1second",
+			AccountID: existingAccountID,
+			Key:       "key2",
+			IP:        netip.AddrFrom4([4]byte{1, 1, 1, 1}),
+			IPv6:      netip.MustParseAddr("fd00::2:2:2:2"),
+		}
+		err = store.AddPeerToAccount(context.Background(), peer2)
+		require.Error(t, err)
+	})
+}
+
+func TestSqlStore_GetPeerByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	tests := []struct {
+		name        string
+		peerID      string
+		expectError bool
+	}{
+		{
+			name:        "retrieve existing peer",
+			peerID:      "cfefqs706sqkneg59g4g",
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing peer",
+			peerID:      "non-existing",
+			expectError: true,
+		},
+		{
+			name:        "retrieve with empty peer ID",
+			peerID:      "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peer, err := store.GetPeerByID(context.Background(), LockingStrengthNone, accountID, tt.peerID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, peer)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, peer)
+				require.Equal(t, tt.peerID, peer.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_GetPeersByIDs(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	tests := []struct {
+		name          string
+		peerIDs       []string
+		expectedCount int
+	}{
+		{
+			name:          "retrieve existing peers by existing IDs",
+			peerIDs:       []string{"cfefqs706sqkneg59g4g", "cfeg6sf06sqkneg59g50"},
+			expectedCount: 2,
+		},
+		{
+			name:          "empty peer IDs list",
+			peerIDs:       []string{},
+			expectedCount: 0,
+		},
+		{
+			name:          "non-existing peer IDs",
+			peerIDs:       []string{"nonexistent1", "nonexistent2"},
+			expectedCount: 0,
+		},
+		{
+			name:          "mixed existing and non-existing peer IDs",
+			peerIDs:       []string{"cfeg6sf06sqkneg59g50", "nonexistent"},
+			expectedCount: 1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peers, err := store.GetPeersByIDs(context.Background(), LockingStrengthNone, accountID, tt.peerIDs)
+			require.NoError(t, err)
+			require.Len(t, peers, tt.expectedCount)
+		})
+	}
+}
+
+func TestSqlStore_AddPeerToAccount(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	peer := &nbpeer.Peer{
+		ID:        "peer1",
+		AccountID: accountID,
+		Key:       "key",
+		IP:        netip.AddrFrom4([4]byte{1, 1, 1, 1}),
+		IPv6:      netip.MustParseAddr("fd00::1:1:1:1"),
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname:  "hostname",
+			GoOS:      "linux",
+			Kernel:    "Linux",
+			Core:      "21.04",
+			Platform:  "x86_64",
+			OS:        "Ubuntu",
+			WtVersion: "development",
+			UIVersion: "development",
+		},
+		Name:     "peer.test",
+		DNSLabel: "peer",
+		Status: &nbpeer.PeerStatus{
+			LastSeen:         time.Now().UTC(),
+			Connected:        true,
+			LoginExpired:     false,
+			RequiresApproval: false,
+		},
+		SSHKey:                      "ssh-key",
+		SSHEnabled:                  false,
+		LoginExpirationEnabled:      true,
+		InactivityExpirationEnabled: false,
+		LastLogin:                   util.ToPtr(time.Now().UTC()),
+		CreatedAt:                   time.Now().UTC(),
+		Ephemeral:                   true,
+	}
+	err = store.AddPeerToAccount(context.Background(), peer)
+	require.NoError(t, err, "failed to add peer to account")
+
+	storedPeer, err := store.GetPeerByID(context.Background(), LockingStrengthNone, accountID, peer.ID)
+	require.NoError(t, err, "failed to get peer")
+
+	assert.Equal(t, peer.ID, storedPeer.ID)
+	assert.Equal(t, peer.AccountID, storedPeer.AccountID)
+	assert.Equal(t, peer.Key, storedPeer.Key)
+	assert.Equal(t, peer.IP.String(), storedPeer.IP.String())
+	assert.Equal(t, peer.Meta, storedPeer.Meta)
+	assert.Equal(t, peer.Name, storedPeer.Name)
+	assert.Equal(t, peer.DNSLabel, storedPeer.DNSLabel)
+	assert.Equal(t, peer.SSHKey, storedPeer.SSHKey)
+	assert.Equal(t, peer.SSHEnabled, storedPeer.SSHEnabled)
+	assert.Equal(t, peer.LoginExpirationEnabled, storedPeer.LoginExpirationEnabled)
+	assert.Equal(t, peer.InactivityExpirationEnabled, storedPeer.InactivityExpirationEnabled)
+	assert.WithinDurationf(t, peer.GetLastLogin(), storedPeer.GetLastLogin().UTC(), time.Millisecond, "LastLogin should be equal")
+	assert.WithinDurationf(t, peer.CreatedAt, storedPeer.CreatedAt.UTC(), time.Millisecond, "CreatedAt should be equal")
+	assert.Equal(t, peer.Ephemeral, storedPeer.Ephemeral)
+	assert.Equal(t, peer.Status.Connected, storedPeer.Status.Connected)
+	assert.Equal(t, peer.Status.LoginExpired, storedPeer.Status.LoginExpired)
+	assert.Equal(t, peer.Status.RequiresApproval, storedPeer.Status.RequiresApproval)
+	assert.WithinDurationf(t, peer.Status.LastSeen, storedPeer.Status.LastSeen.UTC(), time.Millisecond, "LastSeen should be equal")
+}
+
+func TestSqlStore_GetAccountPeers(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name          string
+		accountID     string
+		nameFilter    string
+		ipFilter      string
+		expectedCount int
+	}{
+		{
+			name:          "should retrieve peers for an existing account ID",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			expectedCount: 5,
+		},
+		{
+			name:          "should return no peers for a non-existing account ID",
+			accountID:     "nonexistent",
+			expectedCount: 0,
+		},
+		{
+			name:          "should return no peers for an empty account ID",
+			accountID:     "",
+			expectedCount: 0,
+		},
+		{
+			name:          "should filter peers by name",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			nameFilter:    "expiredhost",
+			expectedCount: 1,
+		},
+		{
+			name:          "should filter peers by partial name",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			nameFilter:    "host",
+			expectedCount: 4,
+		},
+		{
+			name:          "should filter peers by ip",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			ipFilter:      "100.64.39.54",
+			expectedCount: 1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peers, _, err := store.GetAccountPeersPaginated(context.Background(), LockingStrengthNone, tt.accountID, PaginationState{}, PeerFilters{Hostname: tt.nameFilter, IP: tt.ipFilter}, PeerSorting{})
+			require.NoError(t, err)
+			require.Len(t, peers, tt.expectedCount)
+		})
+	}
+
+}
+
+func TestSqlStore_GetAccountPeers_FilterByMac(t *testing.T) {
+	ctx := context.Background()
+	store, cleanup, err := NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	accountID := "test-account-mac"
+	userID := "test-user-mac"
+	account := newAccountWithId(ctx, accountID, userID, "example.com")
+	account.Peers["peer-mac-1"] = &nbpeer.Peer{
+		ID:        "peer-mac-1",
+		AccountID: accountID,
+		Key:       "peer-mac-key-1",
+		Name:      "macpeer",
+		IP:        netip.MustParseAddr("100.64.0.10"),
+		Meta: nbpeer.PeerSystemMeta{
+			NetworkAddresses: []nbpeer.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.0.11/24"), Mac: "00:93:37:bd:83:0f"},
+			},
+		},
+	}
+	require.NoError(t, store.SaveAccount(ctx, account))
+
+	tests := []struct {
+		name          string
+		macFilter     string
+		expectedCount int
+	}{
+		{name: "full mac matches", macFilter: "00:93:37:bd:83:0f", expectedCount: 1},
+		{name: "mac prefix matches", macFilter: "00:93:37", expectedCount: 1},
+		{name: "unknown mac does not match", macFilter: "11:22:33:44:55:66", expectedCount: 0},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peers, _, err := store.GetAccountPeersPaginated(ctx, LockingStrengthNone, accountID, PaginationState{}, PeerFilters{MAC: tt.macFilter}, PeerSorting{})
+			require.NoError(t, err)
+			require.Len(t, peers, tt.expectedCount)
+		})
+	}
+}
+
+func TestSqlStore_GetAccountPeersWithExpiration(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name            string
+		accountID       string
+		expectedCount   int
+		expectedPeerIDs []string
+	}{
+		{
+			name:            "should retrieve only non-expired peers with expiration enabled",
+			accountID:       "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			expectedCount:   1,
+			expectedPeerIDs: []string{"notexpired01"},
+		},
+		{
+			name:          "should return no peers with expiration for a non-existing account ID",
+			accountID:     "nonexistent",
+			expectedCount: 0,
+		},
+		{
+			name:          "should return no peers with expiration for a empty account ID",
+			accountID:     "",
+			expectedCount: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peers, err := store.GetAccountPeersWithExpiration(context.Background(), LockingStrengthNone, tt.accountID)
+			require.NoError(t, err)
+			require.Len(t, peers, tt.expectedCount)
+			for i, peer := range peers {
+				assert.Equal(t, tt.expectedPeerIDs[i], peer.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_GetAccountPeersWithExpiration_ExcludesAlreadyExpired(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	peers, err := store.GetAccountPeersWithExpiration(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+
+	// Verify the already-expired peer (cg05lnblo1hkg2j514p0) is not returned
+	for _, peer := range peers {
+		assert.NotEqual(t, "cg05lnblo1hkg2j514p0", peer.ID, "already expired peer should not be returned")
+		assert.False(t, peer.Status.LoginExpired, "returned peers should not have LoginExpired set")
+	}
+}
+
+func TestSqlStore_GetAccountPeersWithInactivity(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name          string
+		accountID     string
+		expectedCount int
+	}{
+		{
+			name:          "should retrieve peers with inactivity for an existing account ID",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			expectedCount: 1,
+		},
+		{
+			name:          "should return no peers with inactivity for a non-existing account ID",
+			accountID:     "nonexistent",
+			expectedCount: 0,
+		},
+		{
+			name:          "should return no peers with inactivity for an empty account ID",
+			accountID:     "",
+			expectedCount: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peers, err := store.GetAccountPeersWithInactivity(context.Background(), LockingStrengthNone, tt.accountID)
+			require.NoError(t, err)
+			require.Len(t, peers, tt.expectedCount)
+		})
+	}
+}
+
+func TestSqlStore_GetAllEphemeralPeers(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/storev1.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	peers, err := store.GetAllEphemeralPeers(context.Background(), LockingStrengthNone)
+	require.NoError(t, err)
+	require.Len(t, peers, 1)
+	require.True(t, peers[0].Ephemeral)
+}
+
+func TestSqlStore_GetUserPeers(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name          string
+		accountID     string
+		userID        string
+		expectedCount int
+	}{
+		{
+			name:          "should retrieve peers for existing account ID and user ID",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			userID:        "f4f6d672-63fb-11ec-90d6-0242ac120003",
+			expectedCount: 1,
+		},
+		{
+			name:          "should return no peers for non-existing account ID with existing user ID",
+			accountID:     "nonexistent",
+			userID:        "f4f6d672-63fb-11ec-90d6-0242ac120003",
+			expectedCount: 0,
+		},
+		{
+			name:          "should return no peers for non-existing user ID with existing account ID",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			userID:        "nonexistent_user",
+			expectedCount: 0,
+		},
+		{
+			name:          "should retrieve peers for another valid account ID and user ID",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			userID:        "edafee4e-63fb-11ec-90d6-0242ac120003",
+			expectedCount: 3,
+		},
+		{
+			name:          "should return no peers for existing account ID with empty user ID",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			userID:        "",
+			expectedCount: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peers, err := store.GetUserPeers(context.Background(), LockingStrengthNone, tt.accountID, tt.userID)
+			require.NoError(t, err)
+			require.Len(t, peers, tt.expectedCount)
+		})
+	}
+}
+
+func TestSqlStore_DeletePeer(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	peerID := "csrnkiq7qv9d8aitqd50"
+
+	err = store.DeletePeer(context.Background(), accountID, peerID)
+	require.NoError(t, err)
+
+	peer, err := store.GetPeerByID(context.Background(), LockingStrengthNone, accountID, peerID)
+	require.Error(t, err)
+	require.Nil(t, peer)
+}
+
+func BenchmarkGetAccountPeers(b *testing.B) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", b.TempDir())
+	if err != nil {
+		b.Fatal(err)
+	}
+	b.Cleanup(cleanup)
+
+	numberOfPeers := 1000
+	numberOfGroups := 200
+	numberOfPeersPerGroup := 500
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	peers := make([]*nbpeer.Peer, 0, numberOfPeers)
+	for i := 0; i < numberOfPeers; i++ {
+		peer := &nbpeer.Peer{
+			ID:        fmt.Sprintf("peer-%d", i),
+			AccountID: accountID,
+			Key:       fmt.Sprintf("key-%d", i),
+			DNSLabel:  fmt.Sprintf("peer%d.example.com", i),
+			IP:        intToIPv4(uint32(i)),
+		}
+		err = store.AddPeerToAccount(context.Background(), peer)
+		if err != nil {
+			b.Fatalf("Failed to add peer: %v", err)
+		}
+		peers = append(peers, peer)
+	}
+
+	for i := 0; i < numberOfGroups; i++ {
+		groupID := fmt.Sprintf("group-%d", i)
+		group := &types.Group{
+			ID:        groupID,
+			AccountID: accountID,
+		}
+		err = store.CreateGroup(context.Background(), group)
+		if err != nil {
+			b.Fatalf("Failed to create group: %v", err)
+		}
+		for j := 0; j < numberOfPeersPerGroup; j++ {
+			peerIndex := (i*numberOfPeersPerGroup + j) % numberOfPeers
+			err = store.AddPeerToGroup(context.Background(), accountID, peers[peerIndex].ID, groupID)
+			if err != nil {
+				b.Fatalf("Failed to add peer to group: %v", err)
+			}
+		}
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := store.GetPeerGroups(context.Background(), LockingStrengthNone, accountID, peers[i%numberOfPeers].ID)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func intToIPv4(n uint32) netip.Addr {
+	var b [4]byte
+	binary.BigEndian.PutUint32(b[:], n)
+	return netip.AddrFrom4(b)
+}
+
+func TestSqlStore_GetUserIDByPeerKey(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	userID := "test-user-123"
+	peerKey := "peer-key-abc"
+
+	peer := &nbpeer.Peer{
+		ID:        "test-peer-1",
+		Key:       peerKey,
+		AccountID: existingAccountID,
+		UserID:    userID,
+		IP:        netip.AddrFrom4([4]byte{10, 0, 0, 1}),
+		IPv6:      netip.MustParseAddr("fd00::a00:1"),
+		DNSLabel:  "test-peer-1",
+	}
+
+	err = store.AddPeerToAccount(context.Background(), peer)
+	require.NoError(t, err)
+
+	retrievedUserID, err := store.GetUserIDByPeerKey(context.Background(), LockingStrengthNone, peerKey)
+	require.NoError(t, err)
+	assert.Equal(t, userID, retrievedUserID)
+}
+
+func TestSqlStore_GetUserIDByPeerKey_NotFound(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	nonExistentPeerKey := "non-existent-peer-key"
+
+	userID, err := store.GetUserIDByPeerKey(context.Background(), LockingStrengthNone, nonExistentPeerKey)
+	require.Error(t, err)
+	assert.Equal(t, "", userID)
+}
+
+func TestSqlStore_GetUserIDByPeerKey_NoUserID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	peerKey := "peer-key-abc"
+
+	peer := &nbpeer.Peer{
+		ID:        "test-peer-1",
+		Key:       peerKey,
+		AccountID: existingAccountID,
+		UserID:    "",
+		IP:        netip.AddrFrom4([4]byte{10, 0, 0, 1}),
+		IPv6:      netip.MustParseAddr("fd00::a00:1"),
+		DNSLabel:  "test-peer-1",
+	}
+
+	err = store.AddPeerToAccount(context.Background(), peer)
+	require.NoError(t, err)
+
+	retrievedUserID, err := store.GetUserIDByPeerKey(context.Background(), LockingStrengthNone, peerKey)
+	require.NoError(t, err)
+	assert.Equal(t, "", retrievedUserID)
+}
+
+func TestSqlStore_ApproveAccountPeers(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		accountID := "test-account"
+		ctx := context.Background()
+
+		account := newAccountWithId(ctx, accountID, "testuser", "example.com")
+		err := store.SaveAccount(ctx, account)
+		require.NoError(t, err)
+
+		peers := []*nbpeer.Peer{
+			{
+				ID:        "peer1",
+				AccountID: accountID,
+				DNSLabel:  "peer1.netbird.cloud",
+				Key:       "peer1-key",
+				IP:        netip.MustParseAddr("100.64.0.1"),
+				IPv6:      netip.MustParseAddr("fd00::1"),
+				Status: &nbpeer.PeerStatus{
+					RequiresApproval: true,
+					LastSeen:         time.Now().UTC(),
+				},
+			},
+			{
+				ID:        "peer2",
+				AccountID: accountID,
+				DNSLabel:  "peer2.netbird.cloud",
+				Key:       "peer2-key",
+				IP:        netip.MustParseAddr("100.64.0.2"),
+				IPv6:      netip.MustParseAddr("fd00::2"),
+				Status: &nbpeer.PeerStatus{
+					RequiresApproval: true,
+					LastSeen:         time.Now().UTC(),
+				},
+			},
+			{
+				ID:        "peer3",
+				AccountID: accountID,
+				DNSLabel:  "peer3.netbird.cloud",
+				Key:       "peer3-key",
+				IP:        netip.MustParseAddr("100.64.0.3"),
+				IPv6:      netip.MustParseAddr("fd00::3"),
+				Status: &nbpeer.PeerStatus{
+					RequiresApproval: false,
+					LastSeen:         time.Now().UTC(),
+				},
+			},
+		}
+
+		for _, peer := range peers {
+			err = store.AddPeerToAccount(ctx, peer)
+			require.NoError(t, err)
+		}
+
+		t.Run("approve all pending peers", func(t *testing.T) {
+			count, err := store.ApproveAccountPeers(ctx, accountID)
+			require.NoError(t, err)
+			assert.Equal(t, 2, count)
+
+			allPeers, err := store.GetAccountPeers(ctx, LockingStrengthNone, accountID, "", "", "")
+			require.NoError(t, err)
+
+			for _, peer := range allPeers {
+				assert.False(t, peer.Status.RequiresApproval, "peer %s should not require approval", peer.ID)
+			}
+		})
+
+		t.Run("no peers to approve", func(t *testing.T) {
+			count, err := store.ApproveAccountPeers(ctx, accountID)
+			require.NoError(t, err)
+			assert.Equal(t, 0, count)
+		})
+
+		t.Run("non-existent account", func(t *testing.T) {
+			count, err := store.ApproveAccountPeers(ctx, "non-existent")
+			require.NoError(t, err)
+			assert.Equal(t, 0, count)
+		})
+	})
+}
diff --git a/management/server/store/sql_store_peers_filter_test.go b/management/server/store/sql_store_peers_filter_test.go
new file mode 100644
index 000000000..dabfcf2ae
--- /dev/null
+++ b/management/server/store/sql_store_peers_filter_test.go
@@ -0,0 +1,250 @@
+package store
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSqlStore_FilterPeers(t *testing.T) {
+	runTestForAllEnginesNoSqliteSeed(t, "../testdata/peers_pagination.sql", func(t *testing.T, engine string, store Store) {
+		var tests = []struct {
+			description    string
+			filters        PeerFilters
+			expectedLength int
+			expectedPeers  []string
+		}{
+			{
+				description:    "filter by user_id",
+				filters:        PeerFilters{UserId: "user-id-1"},
+				expectedLength: 1,
+				expectedPeers:  []string{"Peer-1-name"},
+			},
+			{
+				description:    "filter by connected status",
+				filters:        PeerFilters{Connected: new(true)},
+				expectedLength: 2,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name"},
+			},
+			{
+				description:    "filter by approval required status",
+				filters:        PeerFilters{ApprovalRequired: new(true)},
+				expectedLength: 2,
+				expectedPeers:  []string{"peer-2-name", "peer-3-name"},
+			},
+			{
+				description:    "filter by ipv4",
+				filters:        PeerFilters{IP: "10.10.10"},
+				expectedLength: 2,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name"},
+			},
+			{
+				description:    "filter by ipv6",
+				filters:        PeerFilters{IP: "ba80:6aa5:89f1:44d7:8701:869"},
+				expectedLength: 2,
+				expectedPeers:  []string{"peer-2-name", "peer-3-name"},
+			},
+			{
+				description:    "filter by ipv6 (uppercase)",
+				filters:        PeerFilters{IP: "BA80:6AA5:89f1:44d7:8701:869"},
+				expectedLength: 2,
+				expectedPeers:  []string{"peer-2-name", "peer-3-name"},
+			},
+			{
+				description:    "filter by mac",
+				filters:        PeerFilters{MAC: ":15:5d:24:0c"},
+				expectedLength: 3,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name", "peer-3-name"},
+			},
+			{
+				description:    "filter by mac (uppercase)",
+				filters:        PeerFilters{MAC: ":15:5D:24:0C"},
+				expectedLength: 3,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name", "peer-3-name"},
+			},
+			{
+				description:    "filter by kind (server)",
+				filters:        PeerFilters{IsServer: new(true), Os: []string{"linux"}},
+				expectedLength: 3,
+				expectedPeers:  []string{"peer-4-name", "peer-5-name", "peer-6-name"},
+			},
+			{
+				description:    "filter by kind (user_device)",
+				filters:        PeerFilters{IsServer: new(false)},
+				expectedLength: 3,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name", "peer-3-name"},
+			},
+			{
+				description:    "filter by group_ids",
+				filters:        PeerFilters{GroupIds: []string{"group-one-resource-id", "group-two-resources-id"}},
+				expectedLength: 2,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name"},
+			},
+			{
+				description:    "filter by os",
+				filters:        PeerFilters{Os: []string{"linux", "ios"}},
+				expectedLength: 5,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name", "peer-4-name", "peer-5-name", "peer-6-name"},
+			},
+			{
+				description:    "filter by peer id",
+				filters:        PeerFilters{PeersIds: []string{"peer-id-one", "peer-id-five", "peer-id-three"}},
+				expectedLength: 3,
+				expectedPeers:  []string{"Peer-1-name", "peer-3-name", "peer-5-name"},
+			},
+			{
+				description:    "filter by name",
+				filters:        PeerFilters{Name: "peer-1"},
+				expectedLength: 1,
+				expectedPeers:  []string{"Peer-1-name"},
+			},
+			{
+				description:    "filter by name (upper-case)",
+				filters:        PeerFilters{Name: "PEER-1"},
+				expectedLength: 1,
+				expectedPeers:  []string{"Peer-1-name"},
+			},
+			{
+				description:    "filter by hostname",
+				filters:        PeerFilters{Hostname: "one-name.local"},
+				expectedLength: 1,
+				expectedPeers:  []string{"Peer-1-name"},
+			},
+			{
+				description:    "filter by hostname (upper-case)",
+				filters:        PeerFilters{Hostname: "ONE-NAME.LOCAL"},
+				expectedLength: 1,
+				expectedPeers:  []string{"Peer-1-name"},
+			},
+		}
+		for _, tt := range tests {
+			t.Run(tt.description+" "+engine, func(t *testing.T) {
+				t.Helper()
+				peers, count, err := store.GetAccountPeersPaginated(context.Background(), LockingStrengthNone, "account-1",
+					PaginationState{}, tt.filters, PeerSorting{})
+				require.NoError(t, err)
+				require.Len(t, peers, tt.expectedLength)
+				require.Equal(t, tt.expectedLength, count)
+				actualPeerNames := make([]string, 0, len(peers))
+				for _, p := range peers {
+					actualPeerNames = append(actualPeerNames, p.Name)
+				}
+				require.ElementsMatch(t, actualPeerNames, tt.expectedPeers)
+			})
+		}
+	})
+}
+
+func TestSqlStore_PeersPaging(t *testing.T) {
+	runTestForAllEnginesNoSqliteSeed(t, "../testdata/peers_pagination.sql", func(t *testing.T, engine string, store Store) {
+		var tests = []struct {
+			description    string
+			page           int
+			pageSize       int
+			expectedLength int
+			expectedCount  int
+			expectedPeers  []string
+		}{
+			{
+				description:    "page 1, size 4",
+				page:           1,
+				pageSize:       4,
+				expectedLength: 4,
+				expectedCount:  6,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name", "peer-3-name", "peer-4-name"},
+			},
+			{
+				description:    "page 2, size 4",
+				page:           2,
+				pageSize:       4,
+				expectedLength: 2,
+				expectedCount:  6,
+				expectedPeers:  []string{"peer-5-name", "peer-6-name"},
+			},
+		}
+		for _, tt := range tests {
+			t.Run(tt.description+" "+engine, func(t *testing.T) {
+				t.Helper()
+				peers, count, err := store.GetAccountPeersPaginated(context.Background(), LockingStrengthNone, "account-1",
+					PaginationState{Page: tt.page, PageSize: tt.pageSize}, PeerFilters{}, PeerSorting{Fields: []PeerSortingKey{{Field: PeerSortByName}}})
+				require.NoError(t, err)
+				require.Len(t, peers, tt.expectedLength)
+				require.Equal(t, tt.expectedCount, count)
+				actualPeerNames := make([]string, 0, len(peers))
+				for _, p := range peers {
+					actualPeerNames = append(actualPeerNames, p.Name)
+				}
+				require.ElementsMatch(t, actualPeerNames, tt.expectedPeers)
+			})
+		}
+	})
+}
+
+func TestSqlStore_PeersSorting(t *testing.T) {
+	runTestForAllEnginesNoSqliteSeed(t, "../testdata/peers_pagination.sql", func(t *testing.T, engine string, store Store) {
+		var tests = []struct {
+			description    string
+			sorting        PeerSorting
+			expectedLength int
+			expectedPeers  []string
+		}{
+			{
+				description:    "default order (by id ascending)",
+				sorting:        PeerSorting{Fields: []PeerSortingKey{}},
+				expectedLength: 6,
+				expectedPeers:  []string{"peer-5-name", "peer-4-name", "Peer-1-name", "peer-6-name", "peer-3-name", "peer-2-name"},
+			},
+			{
+				description:    "by name ascending",
+				sorting:        PeerSorting{Fields: []PeerSortingKey{{Field: PeerSortByName}}},
+				expectedLength: 6,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name", "peer-3-name", "peer-4-name", "peer-5-name", "peer-6-name"},
+			},
+			{
+				description:    "by name descending",
+				sorting:        PeerSorting{Fields: []PeerSortingKey{{Field: PeerSortByName, Order: DescOrderBy}}},
+				expectedLength: 6,
+				expectedPeers:  []string{"peer-6-name", "peer-5-name", "peer-4-name", "peer-3-name", "peer-2-name", "Peer-1-name"},
+			},
+			{
+				description:    "by last_seen ascending",
+				sorting:        PeerSorting{Fields: []PeerSortingKey{{Field: PeerSortByLastSeen}}},
+				expectedLength: 6,
+				expectedPeers:  []string{"peer-6-name", "peer-4-name", "peer-5-name", "peer-3-name", "peer-2-name", "Peer-1-name"},
+			},
+			{
+				description:    "by last_seen descending",
+				sorting:        PeerSorting{Fields: []PeerSortingKey{{Field: PeerSortByLastSeen, Order: DescOrderBy}}},
+				expectedLength: 6,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name", "peer-3-name", "peer-5-name", "peer-4-name", "peer-6-name"},
+			},
+			{
+				description:    "by version ascending",
+				sorting:        PeerSorting{Fields: []PeerSortingKey{{Field: PeerSortByVersion}}},
+				expectedLength: 6,
+				expectedPeers:  []string{"Peer-1-name", "peer-2-name", "peer-4-name", "peer-3-name", "peer-6-name", "peer-5-name"},
+			},
+			{
+				description:    "by version descending",
+				sorting:        PeerSorting{Fields: []PeerSortingKey{{Field: PeerSortByVersion, Order: DescOrderBy}}},
+				expectedLength: 6,
+				expectedPeers:  []string{"peer-5-name", "peer-6-name", "peer-3-name", "peer-4-name", "peer-2-name", "Peer-1-name"},
+			},
+		}
+		for _, tt := range tests {
+			t.Run(tt.description+" "+engine, func(t *testing.T) {
+				t.Helper()
+				peers, _, err := store.GetAccountPeersPaginated(context.Background(), LockingStrengthNone, "account-1",
+					PaginationState{}, PeerFilters{}, tt.sorting)
+				require.NoError(t, err)
+				require.Len(t, peers, tt.expectedLength)
+				actualPeerNames := make([]string, 0, len(peers))
+				for _, p := range peers {
+					actualPeerNames = append(actualPeerNames, p.Name)
+				}
+				require.Equal(t, tt.expectedPeers, actualPeerNames)
+			})
+		}
+	})
+}
diff --git a/management/server/store/sql_store_personal_access_token.go b/management/server/store/sql_store_personal_access_token.go
new file mode 100644
index 000000000..d5be3e327
--- /dev/null
+++ b/management/server/store/sql_store_personal_access_token.go
@@ -0,0 +1,178 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/management/server/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// DeleteHashedPAT2TokenIDIndex is noop in SqlStore
+func (s *SqlStore) DeleteHashedPAT2TokenIDIndex(hashedToken string) error {
+	return nil
+}
+
+// DeleteTokenID2UserIDIndex is noop in SqlStore
+func (s *SqlStore) DeleteTokenID2UserIDIndex(tokenID string) error {
+	return nil
+}
+
+func (s *SqlStore) GetTokenIDByHashedToken(ctx context.Context, hashedToken string) (string, error) {
+	var token types.PersonalAccessToken
+	result := s.db.Take(&token, "hashed_token = ?", hashedToken)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
+		}
+		log.WithContext(ctx).Errorf("error when getting token from the store: %s", result.Error)
+		return "", status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	return token.ID, nil
+}
+
+func (s *SqlStore) getPersonalAccessTokens(ctx context.Context, userIDs []string) ([]types.PersonalAccessToken, error) {
+	if len(userIDs) == 0 {
+		return nil, nil
+	}
+	const query = `SELECT id, user_id, name, hashed_token, expiration_date, created_by, created_at, last_used FROM personal_access_tokens WHERE user_id = ANY($1)`
+	rows, err := s.pgxPool().Query(ctx, query, userIDs)
+	if err != nil {
+		return nil, err
+	}
+	pats, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (types.PersonalAccessToken, error) {
+		var pat types.PersonalAccessToken
+		var expirationDate, lastUsed, createdAt sql.NullTime
+		err := row.Scan(&pat.ID, &pat.UserID, &pat.Name, &pat.HashedToken, &expirationDate, &pat.CreatedBy, &createdAt, &lastUsed)
+		if err == nil {
+			if expirationDate.Valid {
+				pat.ExpirationDate = &expirationDate.Time
+			}
+			if createdAt.Valid {
+				pat.CreatedAt = createdAt.Time
+			}
+			if lastUsed.Valid {
+				pat.LastUsed = &lastUsed.Time
+			}
+		}
+		return pat, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	return pats, nil
+}
+
+// GetPATByHashedToken returns a PersonalAccessToken by its hashed token.
+func (s *SqlStore) GetPATByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken string) (*types.PersonalAccessToken, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var pat types.PersonalAccessToken
+	result := tx.Take(&pat, "hashed_token = ?", hashedToken)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewPATNotFoundError(hashedToken)
+		}
+		log.WithContext(ctx).Errorf("failed to get pat by hash from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get pat by hash from store")
+	}
+
+	return &pat, nil
+}
+
+// GetPATByID retrieves a personal access token by its ID and user ID.
+func (s *SqlStore) GetPATByID(ctx context.Context, lockStrength LockingStrength, userID string, patID string) (*types.PersonalAccessToken, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var pat types.PersonalAccessToken
+	result := tx.
+		Take(&pat, "id = ? AND user_id = ?", patID, userID)
+	if err := result.Error; err != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewPATNotFoundError(patID)
+		}
+		log.WithContext(ctx).Errorf("failed to get pat from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get pat from store")
+	}
+
+	return &pat, nil
+}
+
+// GetUserPATs retrieves personal access tokens for a user.
+func (s *SqlStore) GetUserPATs(ctx context.Context, lockStrength LockingStrength, userID string) ([]*types.PersonalAccessToken, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var pats []*types.PersonalAccessToken
+	result := tx.Find(&pats, "user_id = ?", userID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get user pat's from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get user pat's from store")
+	}
+
+	return pats, nil
+}
+
+// MarkPATUsed marks a personal access token as used.
+func (s *SqlStore) MarkPATUsed(ctx context.Context, patID string) error {
+	patCopy := types.PersonalAccessToken{
+		LastUsed: util.ToPtr(time.Now().UTC()),
+	}
+
+	fieldsToUpdate := []string{"last_used"}
+	result := s.db.Select(fieldsToUpdate).
+		Where(idQueryCondition, patID).Updates(&patCopy)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to mark pat as used: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to mark pat as used")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewPATNotFoundError(patID)
+	}
+
+	return nil
+}
+
+// SavePAT saves a personal access token to the database.
+func (s *SqlStore) SavePAT(ctx context.Context, pat *types.PersonalAccessToken) error {
+	result := s.db.Save(pat)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to save pat to the store: %s", err)
+		return status.Errorf(status.Internal, "failed to save pat to store")
+	}
+
+	return nil
+}
+
+// DeletePAT deletes a personal access token from the database.
+func (s *SqlStore) DeletePAT(ctx context.Context, userID, patID string) error {
+	result := s.db.Delete(&types.PersonalAccessToken{}, "user_id = ? AND id = ?", userID, patID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to delete pat from the store: %s", err)
+		return status.Errorf(status.Internal, "failed to delete pat from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewPATNotFoundError(patID)
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_personal_access_token_test.go b/management/server/store/sql_store_personal_access_token_test.go
new file mode 100644
index 000000000..f40e0d9c6
--- /dev/null
+++ b/management/server/store/sql_store_personal_access_token_test.go
@@ -0,0 +1,186 @@
+package store
+
+import (
+	"context"
+	"os"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/management/server/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func Test_GetTokenIDByHashedToken(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("The SQLite store is not properly supported by Windows yet")
+	}
+
+	runTestForAllEngines(t, "../testdata/store.sql", func(t *testing.T, store Store) {
+		hashed := "SoMeHaShEdToKeN"
+		id := "9dj38s35-63fb-11ec-90d6-0242ac120003"
+
+		token, err := store.GetTokenIDByHashedToken(context.Background(), hashed)
+		require.NoError(t, err)
+		require.Equal(t, id, token)
+
+		_, err = store.GetTokenIDByHashedToken(context.Background(), "non-existing-hash")
+		require.Error(t, err)
+		parsedErr, ok := status.FromError(err)
+		require.True(t, ok)
+		require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
+	})
+}
+
+func TestPostgresql_GetTokenIDByHashedToken(t *testing.T) {
+	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.PostgresStoreEngine))
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanUp)
+	assert.NoError(t, err)
+
+	hashed := "SoMeHaShEdToKeN"
+	id := "9dj38s35-63fb-11ec-90d6-0242ac120003"
+
+	token, err := store.GetTokenIDByHashedToken(context.Background(), hashed)
+	require.NoError(t, err)
+	require.Equal(t, id, token)
+}
+
+func TestSqlStore_GetPATByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	userID := "f4f6d672-63fb-11ec-90d6-0242ac120003"
+
+	tests := []struct {
+		name        string
+		patID       string
+		expectError bool
+	}{
+		{
+			name:        "retrieve existing PAT",
+			patID:       "9dj38s35-63fb-11ec-90d6-0242ac120003",
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing PAT",
+			patID:       "non-existing",
+			expectError: true,
+		},
+		{
+			name:        "retrieve with empty PAT ID",
+			patID:       "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pat, err := store.GetPATByID(context.Background(), LockingStrengthNone, userID, tt.patID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, pat)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, pat)
+				require.Equal(t, tt.patID, pat.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_GetUserPATs(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	userPATs, err := store.GetUserPATs(context.Background(), LockingStrengthNone, "f4f6d672-63fb-11ec-90d6-0242ac120003")
+	require.NoError(t, err)
+	require.Len(t, userPATs, 1)
+}
+
+func TestSqlStore_GetPATByHashedToken(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	pat, err := store.GetPATByHashedToken(context.Background(), LockingStrengthNone, "SoMeHaShEdToKeN")
+	require.NoError(t, err)
+	require.Equal(t, "9dj38s35-63fb-11ec-90d6-0242ac120003", pat.ID)
+}
+
+func TestSqlStore_MarkPATUsed(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	userID := "f4f6d672-63fb-11ec-90d6-0242ac120003"
+	patID := "9dj38s35-63fb-11ec-90d6-0242ac120003"
+
+	err = store.MarkPATUsed(context.Background(), patID)
+	require.NoError(t, err)
+
+	pat, err := store.GetPATByID(context.Background(), LockingStrengthNone, userID, patID)
+	require.NoError(t, err)
+	now := time.Now().UTC()
+	require.WithinRange(t, pat.LastUsed.UTC(), now.Add(-15*time.Second), now, "LastUsed should be within 1 second of now")
+}
+
+func TestSqlStore_SavePAT(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	userID := "edafee4e-63fb-11ec-90d6-0242ac120003"
+
+	pat := &types.PersonalAccessToken{
+		ID:             "pat-id",
+		UserID:         userID,
+		Name:           "token",
+		HashedToken:    "SoMeHaShEdToKeN",
+		ExpirationDate: util.ToPtr(time.Now().UTC().Add(12 * time.Hour)),
+		CreatedBy:      userID,
+		CreatedAt:      time.Now().UTC().Add(time.Hour),
+		LastUsed:       util.ToPtr(time.Now().UTC().Add(-15 * time.Minute)),
+	}
+	err = store.SavePAT(context.Background(), pat)
+	require.NoError(t, err)
+
+	savePAT, err := store.GetPATByID(context.Background(), LockingStrengthNone, userID, pat.ID)
+	require.NoError(t, err)
+	require.Equal(t, pat.ID, savePAT.ID)
+	require.Equal(t, pat.UserID, savePAT.UserID)
+	require.Equal(t, pat.HashedToken, savePAT.HashedToken)
+	require.Equal(t, pat.CreatedBy, savePAT.CreatedBy)
+	require.WithinDurationf(t, pat.GetExpirationDate(), savePAT.ExpirationDate.UTC(), time.Millisecond, "ExpirationDate should be equal")
+	require.WithinDurationf(t, pat.CreatedAt, savePAT.CreatedAt.UTC(), time.Millisecond, "CreatedAt should be equal")
+	require.WithinDurationf(t, pat.GetLastUsed(), savePAT.LastUsed.UTC(), time.Millisecond, "LastUsed should be equal")
+}
+
+func TestSqlStore_DeletePAT(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	userID := "f4f6d672-63fb-11ec-90d6-0242ac120003"
+	patID := "9dj38s35-63fb-11ec-90d6-0242ac120003"
+
+	err = store.DeletePAT(context.Background(), userID, patID)
+	require.NoError(t, err)
+
+	pat, err := store.GetPATByID(context.Background(), LockingStrengthNone, userID, patID)
+	require.Error(t, err)
+	require.Nil(t, pat)
+}
diff --git a/management/server/store/sql_store_pgx_parity_test.go b/management/server/store/sql_store_pgx_parity_test.go
new file mode 100644
index 000000000..1f17817d0
--- /dev/null
+++ b/management/server/store/sql_store_pgx_parity_test.go
@@ -0,0 +1,74 @@
+package store
+
+import (
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm/schema"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+)
+
+// TestPgxServiceColumnsMatchGorm guards the Postgres pgx read path against
+// drifting from the gorm model. The SQLite/MySQL gorm path loads rows by struct,
+// so a new column on a model is picked up automatically, but the hand-written
+// pgx SELECT in sql_store.go must be updated by hand. This test fails when a
+// gorm column is missing from the pgx column list, which otherwise silently
+// returns zero-valued on Postgres with no compile error.
+func TestPgxServiceColumnsMatchGorm(t *testing.T) {
+	tests := []struct {
+		name          string
+		model         any
+		selectColumns string
+		// excluded lists gorm columns intentionally not loaded by the pgx path.
+		excluded map[string]struct{}
+	}{
+		{
+			name:          "service",
+			model:         &rpservice.Service{},
+			selectColumns: serviceSelectColumns,
+		},
+		{
+			name:          "target",
+			model:         &rpservice.Target{},
+			selectColumns: targetSelectColumns,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			selected := parseColumnList(tc.selectColumns)
+			for _, col := range gormColumnNames(t, tc.model) {
+				if _, ok := tc.excluded[col]; ok {
+					continue
+				}
+				_, ok := selected[col]
+				assert.Truef(t, ok,
+					"gorm column %q is not read by the Postgres pgx SELECT; add it to %sSelectColumns in sql_store.go (or to the test's excluded set if it is intentionally not loaded)",
+					col, tc.name)
+			}
+		})
+	}
+}
+
+func parseColumnList(cols string) map[string]struct{} {
+	set := make(map[string]struct{})
+	for _, c := range strings.Split(cols, ",") {
+		if c = strings.TrimSpace(c); c != "" {
+			set[c] = struct{}{}
+		}
+	}
+	return set
+}
+
+// gormColumnNames returns the DB column names gorm would migrate for the model,
+// using the same default naming strategy the store configures.
+func gormColumnNames(t *testing.T, model any) []string {
+	t.Helper()
+	sch, err := schema.Parse(model, &sync.Map{}, schema.NamingStrategy{})
+	require.NoError(t, err)
+	return sch.DBNames
+}
diff --git a/management/server/store/sql_store_policy.go b/management/server/store/sql_store_policy.go
new file mode 100644
index 000000000..95e80e712
--- /dev/null
+++ b/management/server/store/sql_store_policy.go
@@ -0,0 +1,151 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) getPolicies(ctx context.Context, accountID string) ([]*types.Policy, error) {
+	const query = `SELECT id, account_id, public_id, name, description, enabled, source_posture_checks FROM policies WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+	policies, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (*types.Policy, error) {
+		var p types.Policy
+		var checks []byte
+		var enabled sql.NullBool
+		err := row.Scan(&p.ID, &p.AccountID, &p.PublicID, &p.Name, &p.Description, &enabled, &checks)
+		if err == nil {
+			if enabled.Valid {
+				p.Enabled = enabled.Bool
+			}
+			if checks != nil {
+				_ = json.Unmarshal(checks, &p.SourcePostureChecks)
+			}
+		}
+		return &p, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	return policies, nil
+}
+
+// GetAccountPolicies retrieves policies for an account.
+func (s *SqlStore) GetAccountPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.Policy, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var policies []*types.Policy
+	result := tx.
+		Preload(clause.Associations).Find(&policies, accountIDCondition, accountID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get policies from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get policies from store")
+	}
+
+	return policies, nil
+}
+
+// GetPolicyByID retrieves a policy by its ID and account ID.
+func (s *SqlStore) GetPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*types.Policy, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var policy *types.Policy
+
+	result := tx.Preload(clause.Associations).
+		Take(&policy, accountAndIDQueryCondition, accountID, policyID)
+	if err := result.Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, status.NewPolicyNotFoundError(policyID)
+		}
+		log.WithContext(ctx).Errorf("failed to get policy from store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get policy from store")
+	}
+
+	return policy, nil
+}
+
+// GetPolicyByIDOrPublicID retrieves a policy by either its ID or its PublicID. Peers report
+// whichever of the two the network map they were served carries, so callers resolving a
+// peer-reported reference cannot know upfront which namespace it belongs to.
+func (s *SqlStore) GetPolicyByIDOrPublicID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*types.Policy, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var policy *types.Policy
+
+	result := tx.Preload(clause.Associations).
+		Take(&policy, accountAndAnyIDQueryCondition, accountID, policyID, policyID)
+	if err := result.Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, status.NewPolicyNotFoundError(policyID)
+		}
+		log.WithContext(ctx).Errorf("failed to get policy from store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get policy from store")
+	}
+
+	return policy, nil
+}
+
+func (s *SqlStore) CreatePolicy(ctx context.Context, policy *types.Policy) error {
+	result := s.db.Create(policy)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to create policy in store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to create policy in store")
+	}
+
+	return nil
+}
+
+// SavePolicy saves a policy to the database.
+func (s *SqlStore) SavePolicy(ctx context.Context, policy *types.Policy) error {
+	result := s.db.Session(&gorm.Session{FullSaveAssociations: true}).Omit("public_id").Save(policy)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to save policy to the store: %s", err)
+		return status.Errorf(status.Internal, "failed to save policy to store")
+	}
+	return nil
+}
+
+func (s *SqlStore) DeletePolicy(ctx context.Context, accountID, policyID string) error {
+	return s.transaction(ctx, func(tx *gorm.DB) error {
+		if err := tx.Where("policy_id = ?", policyID).Delete(&types.PolicyRule{}).Error; err != nil {
+			return fmt.Errorf("delete policy rules: %w", err)
+		}
+
+		result := tx.
+			Where(accountAndIDQueryCondition, accountID, policyID).
+			Delete(&types.Policy{})
+
+		if err := result.Error; err != nil {
+			log.WithContext(ctx).Errorf("failed to delete policy from store: %s", err)
+			return status.Errorf(status.Internal, "failed to delete policy from store")
+		}
+
+		if result.RowsAffected == 0 {
+			return status.NewPolicyNotFoundError(policyID)
+		}
+
+		return nil
+	})
+}
diff --git a/management/server/store/sql_store_policy_rule.go b/management/server/store/sql_store_policy_rule.go
new file mode 100644
index 000000000..f822788ac
--- /dev/null
+++ b/management/server/store/sql_store_policy_rule.go
@@ -0,0 +1,88 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) getPolicyRules(ctx context.Context, policyIDs []string) ([]*types.PolicyRule, error) {
+	if len(policyIDs) == 0 {
+		return nil, nil
+	}
+	const query = `SELECT id, policy_id, name, description, enabled, action, destinations, destination_resource, sources, source_resource, bidirectional, protocol, ports, port_ranges, authorized_groups, authorized_user FROM policy_rules WHERE policy_id = ANY($1)`
+	rows, err := s.pgxPool().Query(ctx, query, policyIDs)
+	if err != nil {
+		return nil, err
+	}
+	rules, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (*types.PolicyRule, error) {
+		var r types.PolicyRule
+		var dest, destRes, sources, sourceRes, ports, portRanges, authorizedGroups []byte
+		var enabled, bidirectional sql.NullBool
+		var authorizedUser sql.NullString
+		err := row.Scan(&r.ID, &r.PolicyID, &r.Name, &r.Description, &enabled, &r.Action, &dest, &destRes, &sources, &sourceRes, &bidirectional, &r.Protocol, &ports, &portRanges, &authorizedGroups, &authorizedUser)
+		if err == nil {
+			if enabled.Valid {
+				r.Enabled = enabled.Bool
+			}
+			if bidirectional.Valid {
+				r.Bidirectional = bidirectional.Bool
+			}
+			if dest != nil {
+				_ = json.Unmarshal(dest, &r.Destinations)
+			}
+			if destRes != nil {
+				_ = json.Unmarshal(destRes, &r.DestinationResource)
+			}
+			if sources != nil {
+				_ = json.Unmarshal(sources, &r.Sources)
+			}
+			if sourceRes != nil {
+				_ = json.Unmarshal(sourceRes, &r.SourceResource)
+			}
+			if ports != nil {
+				_ = json.Unmarshal(ports, &r.Ports)
+			}
+			if portRanges != nil {
+				_ = json.Unmarshal(portRanges, &r.PortRanges)
+			}
+			if authorizedGroups != nil {
+				_ = json.Unmarshal(authorizedGroups, &r.AuthorizedGroups)
+			}
+			if authorizedUser.Valid {
+				r.AuthorizedUser = authorizedUser.String
+			}
+		}
+		return &r, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	return rules, nil
+}
+
+func (s *SqlStore) GetPolicyRulesByResourceID(ctx context.Context, lockStrength LockingStrength, accountID string, resourceID string) ([]*types.PolicyRule, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var policyRules []*types.PolicyRule
+	resourceIDPattern := `%"ID":"` + resourceID + `"%`
+	result := tx.Where("source_resource LIKE ? OR destination_resource LIKE ?", resourceIDPattern, resourceIDPattern).
+		Find(&policyRules)
+
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get policy rules for resource id from store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get policy rules for resource id from store")
+	}
+
+	return policyRules, nil
+}
diff --git a/management/server/store/sql_store_policy_test.go b/management/server/store/sql_store_policy_test.go
new file mode 100644
index 000000000..68865b184
--- /dev/null
+++ b/management/server/store/sql_store_policy_test.go
@@ -0,0 +1,152 @@
+package store
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestSqlStore_GetPolicyByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	tests := []struct {
+		name        string
+		policyID    string
+		expectError bool
+	}{
+		{
+			name:        "retrieve existing policy",
+			policyID:    "cs1tnh0hhcjnqoiuebf0",
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing policy checks",
+			policyID:    "non-existing",
+			expectError: true,
+		},
+		{
+			name:        "retrieve with empty policy ID",
+			policyID:    "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			policy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, tt.policyID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, policy)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, policy)
+				require.Equal(t, tt.policyID, policy.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_GetPolicyByIDOrPublicID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	policyID := "cs1tnh0hhcjnqoiuebf0"
+
+	policy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, policyID)
+	require.NoError(t, err)
+	require.NotEmpty(t, policy.PublicID)
+
+	for _, id := range []string{policyID, policy.PublicID} {
+		policy, err := store.GetPolicyByIDOrPublicID(context.Background(), LockingStrengthNone, accountID, id)
+		require.NoError(t, err)
+		require.Equal(t, policyID, policy.ID)
+	}
+
+	policy, err = store.GetPolicyByIDOrPublicID(context.Background(), LockingStrengthNone, accountID, "non-existing")
+	require.Error(t, err)
+	sErr, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, sErr.Type(), status.NotFound)
+	require.Nil(t, policy)
+}
+
+func TestSqlStore_CreatePolicy(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	policy := &types.Policy{
+		ID:        "policy-id",
+		AccountID: accountID,
+		Enabled:   true,
+		Rules: []*types.PolicyRule{
+			{
+				Enabled:       true,
+				Sources:       []string{"groupA"},
+				Destinations:  []string{"groupC"},
+				Bidirectional: true,
+				Action:        types.PolicyTrafficActionAccept,
+			},
+		},
+	}
+	err = store.CreatePolicy(context.Background(), policy)
+	require.NoError(t, err)
+
+	savePolicy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, policy.ID)
+	require.NoError(t, err)
+	require.Equal(t, savePolicy, policy)
+
+}
+
+func TestSqlStore_SavePolicy(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	policyID := "cs1tnh0hhcjnqoiuebf0"
+
+	policy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, policyID)
+	require.NoError(t, err)
+
+	policy.Enabled = false
+	policy.Description = "policy"
+	policy.Rules[0].Sources = []string{"group"}
+	policy.Rules[0].Ports = []string{"80", "443"}
+	err = store.SavePolicy(context.Background(), policy)
+	require.NoError(t, err)
+
+	savePolicy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, policy.ID)
+	require.NoError(t, err)
+	require.Equal(t, savePolicy, policy)
+}
+
+func TestSqlStore_DeletePolicy(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	policyID := "cs1tnh0hhcjnqoiuebf0"
+
+	err = store.DeletePolicy(context.Background(), accountID, policyID)
+	require.NoError(t, err)
+
+	policy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, policyID)
+	require.Error(t, err)
+	require.Nil(t, policy)
+}
diff --git a/management/server/store/sql_store_posture_checks.go b/management/server/store/sql_store_posture_checks.go
new file mode 100644
index 000000000..d951086d4
--- /dev/null
+++ b/management/server/store/sql_store_posture_checks.go
@@ -0,0 +1,137 @@
+package store
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/server/posture"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*posture.Checks, error) {
+	const query = `SELECT id, account_id, public_id, name, description, checks FROM posture_checks WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+	checks, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (*posture.Checks, error) {
+		var c posture.Checks
+		var checksDef []byte
+		err := row.Scan(&c.ID, &c.AccountID, &c.PublicID, &c.Name, &c.Description, &checksDef)
+		if err == nil && checksDef != nil {
+			_ = json.Unmarshal(checksDef, &c.Checks)
+		}
+		return &c, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	return checks, nil
+}
+
+func (s *SqlStore) GetPostureCheckByChecksDefinition(accountID string, checks *posture.ChecksDefinition) (*posture.Checks, error) {
+	definitionJSON, err := json.Marshal(checks)
+	if err != nil {
+		return nil, err
+	}
+
+	var postureCheck posture.Checks
+	err = s.db.Where("account_id = ? AND checks = ?", accountID, string(definitionJSON)).Take(&postureCheck).Error
+	if err != nil {
+		return nil, err
+	}
+
+	return &postureCheck, nil
+}
+
+// GetAccountPostureChecks retrieves posture checks for an account.
+func (s *SqlStore) GetAccountPostureChecks(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*posture.Checks, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var postureChecks []*posture.Checks
+	result := tx.Find(&postureChecks, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get posture checks from store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get posture checks from store")
+	}
+
+	return postureChecks, nil
+}
+
+// GetPostureChecksByID retrieves posture checks by their ID and account ID.
+func (s *SqlStore) GetPostureChecksByID(ctx context.Context, lockStrength LockingStrength, accountID, postureChecksID string) (*posture.Checks, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var postureCheck *posture.Checks
+	result := tx.
+		Take(&postureCheck, accountAndIDQueryCondition, accountID, postureChecksID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewPostureChecksNotFoundError(postureChecksID)
+		}
+		log.WithContext(ctx).Errorf("failed to get posture check from store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get posture check from store")
+	}
+
+	return postureCheck, nil
+}
+
+// GetPostureChecksByIDs retrieves posture checks by their IDs and account ID.
+func (s *SqlStore) GetPostureChecksByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, postureChecksIDs []string) (map[string]*posture.Checks, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var postureChecks []*posture.Checks
+	result := tx.Find(&postureChecks, accountAndIDsQueryCondition, accountID, postureChecksIDs)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get posture checks by ID's from store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get posture checks by ID's from store")
+	}
+
+	postureChecksMap := make(map[string]*posture.Checks)
+	for _, postureCheck := range postureChecks {
+		postureChecksMap[postureCheck.ID] = postureCheck
+	}
+
+	return postureChecksMap, nil
+}
+
+// SavePostureChecks saves a posture checks to the database.
+func (s *SqlStore) SavePostureChecks(ctx context.Context, postureCheck *posture.Checks) error {
+	result := s.db.Save(postureCheck)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save posture checks to store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to save posture checks to store")
+	}
+
+	return nil
+}
+
+// DeletePostureChecks deletes a posture checks from the database.
+func (s *SqlStore) DeletePostureChecks(ctx context.Context, accountID, postureChecksID string) error {
+	result := s.db.Delete(&posture.Checks{}, accountAndIDQueryCondition, accountID, postureChecksID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete posture checks from store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to delete posture checks from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewPostureChecksNotFoundError(postureChecksID)
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_posture_checks_test.go b/management/server/store/sql_store_posture_checks_test.go
new file mode 100644
index 000000000..7f0511517
--- /dev/null
+++ b/management/server/store/sql_store_posture_checks_test.go
@@ -0,0 +1,188 @@
+package store
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/posture"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestSqlStore_GetPostureChecksByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	tests := []struct {
+		name            string
+		postureChecksID string
+		expectError     bool
+	}{
+		{
+			name:            "retrieve existing posture checks",
+			postureChecksID: "csplshq7qv948l48f7t0",
+			expectError:     false,
+		},
+		{
+			name:            "retrieve non-existing posture checks",
+			postureChecksID: "non-existing",
+			expectError:     true,
+		},
+		{
+			name:            "retrieve with empty posture checks ID",
+			postureChecksID: "",
+			expectError:     true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			postureChecks, err := store.GetPostureChecksByID(context.Background(), LockingStrengthNone, accountID, tt.postureChecksID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, postureChecks)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, postureChecks)
+				require.Equal(t, tt.postureChecksID, postureChecks.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_GetPostureChecksByIDs(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	tests := []struct {
+		name            string
+		postureCheckIDs []string
+		expectedCount   int
+	}{
+		{
+			name:            "retrieve existing posture checks by existing IDs",
+			postureCheckIDs: []string{"csplshq7qv948l48f7t0", "cspnllq7qv95uq1r4k90"},
+			expectedCount:   2,
+		},
+		{
+			name:            "empty posture check IDs list",
+			postureCheckIDs: []string{},
+			expectedCount:   0,
+		},
+		{
+			name:            "non-existing posture check IDs",
+			postureCheckIDs: []string{"nonexistent1", "nonexistent2"},
+			expectedCount:   0,
+		},
+		{
+			name:            "mixed existing and non-existing posture check IDs",
+			postureCheckIDs: []string{"cspnllq7qv95uq1r4k90", "nonexistent"},
+			expectedCount:   1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			groups, err := store.GetPostureChecksByIDs(context.Background(), LockingStrengthNone, accountID, tt.postureCheckIDs)
+			require.NoError(t, err)
+			require.Len(t, groups, tt.expectedCount)
+		})
+	}
+}
+
+func TestSqlStore_SavePostureChecks(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	postureChecks := &posture.Checks{
+		ID:        "posture-checks-id",
+		AccountID: accountID,
+		Checks: posture.ChecksDefinition{
+			NBVersionCheck: &posture.NBVersionCheck{
+				MinVersion: "0.31.0",
+			},
+			OSVersionCheck: &posture.OSVersionCheck{
+				Ios: &posture.MinVersionCheck{
+					MinVersion: "13.0.1",
+				},
+				Linux: &posture.MinKernelVersionCheck{
+					MinKernelVersion: "5.3.3-dev",
+				},
+			},
+			GeoLocationCheck: &posture.GeoLocationCheck{
+				Locations: []posture.Location{
+					{
+						CountryCode: "DE",
+						CityName:    "Berlin",
+					},
+				},
+				Action: posture.CheckActionAllow,
+			},
+		},
+	}
+	err = store.SavePostureChecks(context.Background(), postureChecks)
+	require.NoError(t, err)
+
+	savePostureChecks, err := store.GetPostureChecksByID(context.Background(), LockingStrengthNone, accountID, "posture-checks-id")
+	require.NoError(t, err)
+	require.Equal(t, savePostureChecks, postureChecks)
+}
+
+func TestSqlStore_DeletePostureChecks(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	tests := []struct {
+		name            string
+		postureChecksID string
+		expectError     bool
+	}{
+		{
+			name:            "delete existing posture checks",
+			postureChecksID: "csplshq7qv948l48f7t0",
+			expectError:     false,
+		},
+		{
+			name:            "delete non-existing posture checks",
+			postureChecksID: "non-existing-posture-checks-id",
+			expectError:     true,
+		},
+		{
+			name:            "delete with empty posture checks ID",
+			postureChecksID: "",
+			expectError:     true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err = store.DeletePostureChecks(context.Background(), accountID, tt.postureChecksID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+			} else {
+				require.NoError(t, err)
+				group, err := store.GetPostureChecksByID(context.Background(), LockingStrengthNone, accountID, tt.postureChecksID)
+				require.Error(t, err)
+				require.Nil(t, group)
+			}
+		})
+	}
+}
diff --git a/management/server/store/sql_store_proxy.go b/management/server/store/sql_store_proxy.go
new file mode 100644
index 000000000..bdccd282c
--- /dev/null
+++ b/management/server/store/sql_store_proxy.go
@@ -0,0 +1,490 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// GetProxyMetrics aggregates per-cluster + per-proxy counts for the
+// self-hosted telemetry payload. Single round-trip via conditional
+// aggregations so a large proxies table doesn't fan out into multiple
+// queries.
+func (s *SqlStore) GetProxyMetrics(ctx context.Context) (ProxyMetrics, error) {
+	var m ProxyMetrics
+	activeCutoff := time.Now().Add(-proxyActiveThreshold)
+
+	// COUNT(DISTINCT ... CASE WHEN ...) is portable across sqlite/postgres
+	// (MySQL too) and keeps the round-trip to one. proxy.StatusConnected
+	// is the same string the cluster-capability queries use; the active
+	// window matches the cluster-capability semantics (only proxies
+	// heartbeating within ~2 * heartbeat interval count as connected).
+	row := s.db.WithContext(ctx).
+		Model(&proxy.Proxy{}).
+		Select(
+			"COUNT(DISTINCT cluster_address) AS clusters, "+
+				"COUNT(DISTINCT CASE WHEN account_id IS NOT NULL THEN cluster_address END) AS clusters_byop, "+
+				"COUNT(DISTINCT CASE WHEN private = ? THEN cluster_address END) AS clusters_private, "+
+				"COUNT(*) AS proxies, "+
+				"COUNT(CASE WHEN status = ? AND last_seen > ? THEN 1 END) AS proxies_connected",
+			true,
+			proxy.StatusConnected,
+			activeCutoff,
+		).
+		Row()
+	if err := row.Scan(&m.Clusters, &m.ClustersBYOP, &m.ClustersPrivate, &m.Proxies, &m.ProxiesConnected); err != nil {
+		return ProxyMetrics{}, fmt.Errorf("scan proxy metrics: %w", err)
+	}
+	return m, nil
+}
+
+// SaveProxy saves or updates a proxy in the database
+func (s *SqlStore) SaveProxy(ctx context.Context, p *proxy.Proxy) error {
+	result := s.db.Save(p)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save proxy: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to save proxy")
+	}
+	return nil
+}
+
+// DisconnectProxy marks a proxy as disconnected only if the session ID matches.
+// This prevents a slow-to-close old session from overwriting a newer reconnection.
+func (s *SqlStore) DisconnectProxy(ctx context.Context, proxyID, sessionID string) error {
+	now := time.Now()
+	result := s.db.
+		Model(&proxy.Proxy{}).
+		Where("id = ? AND session_id = ?", proxyID, sessionID).
+		Updates(map[string]any{
+			"status":          proxy.StatusDisconnected,
+			"disconnected_at": now,
+			"last_seen":       now,
+		})
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to disconnect proxy %s session %s: %v", proxyID, sessionID, result.Error)
+		return status.Errorf(status.Internal, "failed to disconnect proxy")
+	}
+	if result.RowsAffected == 0 {
+		log.WithContext(ctx).Debugf("proxy %s session %s: no row updated (superseded by newer session)", proxyID, sessionID)
+	}
+	return nil
+}
+
+// GetAllProxies returns all reverse proxy instance rows.
+func (s *SqlStore) GetAllProxies(ctx context.Context) ([]*proxy.Proxy, error) {
+	var proxies []*proxy.Proxy
+	result := s.db.Order("cluster_address, id").Find(&proxies)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get proxies: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get proxies")
+	}
+	return proxies, nil
+}
+
+// DisconnectAllProxies force-marks every proxy that is not already disconnected
+// as disconnected, regardless of session ID. Unlike DisconnectProxy it is not
+// session-guarded: it is an administrative repair helper, not part of the
+// connection lifecycle. last_seen is left untouched so the stale-proxy reaper
+// keeps working off the real last heartbeat. Returns the number of proxies updated.
+func (s *SqlStore) DisconnectAllProxies(ctx context.Context) (int64, error) {
+	result := s.db.
+		Model(&proxy.Proxy{}).
+		Where("status != ?", proxy.StatusDisconnected).
+		Updates(map[string]any{
+			"status":          proxy.StatusDisconnected,
+			"disconnected_at": time.Now(),
+		})
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to disconnect all proxies: %v", result.Error)
+		return 0, status.Errorf(status.Internal, "failed to disconnect all proxies")
+	}
+	return result.RowsAffected, nil
+}
+
+// UpdateProxyHeartbeat updates the last_seen timestamp for the proxy's current session.
+func (s *SqlStore) UpdateProxyHeartbeat(ctx context.Context, p *proxy.Proxy) error {
+	now := time.Now()
+
+	result := s.db.
+		Model(&proxy.Proxy{}).
+		Where("id = ? AND session_id = ?", p.ID, p.SessionID).
+		Updates(map[string]any{
+			"last_seen":       now,
+			"status":          proxy.StatusConnected,
+			"disconnected_at": nil,
+		})
+
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to update proxy heartbeat: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to update proxy heartbeat")
+	}
+
+	if result.RowsAffected == 0 {
+		p.LastSeen = now
+		p.ConnectedAt = &now
+		p.Status = proxy.StatusConnected
+		if err := s.db.Create(p).Error; err != nil {
+			log.WithContext(ctx).Debugf("proxy %s session %s: heartbeat fallback insert skipped: %v", p.ID, p.SessionID, err)
+		}
+	}
+
+	return nil
+}
+
+// GetActiveProxyClusterAddresses returns the unique cluster addresses of active
+// shared proxies (those without an account scope). BYOP cluster addresses are
+// excluded; use GetActiveProxyClusterAddressesForAccount to retrieve them.
+func (s *SqlStore) GetActiveProxyClusterAddresses(ctx context.Context) ([]string, error) {
+	var addresses []string
+
+	result := s.db.
+		Model(&proxy.Proxy{}).
+		Where("account_id IS NULL AND status = ? AND last_seen > ?", proxy.StatusConnected, time.Now().Add(-proxyActiveThreshold)).
+		Distinct("cluster_address").
+		Pluck("cluster_address", &addresses)
+
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get active proxy cluster addresses: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get active proxy cluster addresses")
+	}
+
+	return addresses, nil
+}
+
+func (s *SqlStore) GetActiveProxyClusterAddressesForAccount(ctx context.Context, accountID string) ([]string, error) {
+	var addresses []string
+
+	result := s.db.
+		Model(&proxy.Proxy{}).
+		Where("account_id = ? AND status = ? AND last_seen > ?", accountID, proxy.StatusConnected, time.Now().Add(-proxyActiveThreshold)).
+		Distinct("cluster_address").
+		Pluck("cluster_address", &addresses)
+
+	if result.Error != nil {
+		return nil, status.Errorf(status.Internal, "failed to get active proxy cluster addresses for account")
+	}
+
+	return addresses, nil
+}
+
+func (s *SqlStore) GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error) {
+	var p proxy.Proxy
+	result := s.db.Where("account_id = ?", accountID).Take(&p)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "proxy not found for account")
+		}
+		return nil, status.Errorf(status.Internal, "get proxy by account ID: %v", result.Error)
+	}
+	return &p, nil
+}
+
+func (s *SqlStore) CountProxiesByAccountID(ctx context.Context, accountID string) (int64, error) {
+	var count int64
+	result := s.db.Model(&proxy.Proxy{}).Where("account_id = ?", accountID).Count(&count)
+	if result.Error != nil {
+		return 0, status.Errorf(status.Internal, "count proxies by account ID: %v", result.Error)
+	}
+	return count, nil
+}
+
+// HasActiveProxyAtClusterAddress reports whether any proxy — shared or
+// account-scoped — is currently active at the given cluster address, using
+// the same connected-within-threshold window as the other active-proxy
+// queries. Backs the agent-network settings delete guard: settings cannot be
+// deleted while a proxy declares the endpoint hostname as its address.
+//
+// The comparison folds case on both sides: the caller passes a normalized
+// (lowercase) hostname, but proxies declare their cluster address verbatim
+// and Connect stores it unchanged, so on case-sensitive collations a proxy
+// declaring "GW.Example.com" would otherwise slip past the guard. Hostnames
+// are case-insensitive per RFC 4343; the guard must be too.
+func (s *SqlStore) HasActiveProxyAtClusterAddress(ctx context.Context, clusterAddress string) (bool, error) {
+	var count int64
+	result := s.db.
+		Model(&proxy.Proxy{}).
+		Where("LOWER(cluster_address) = LOWER(?) AND status = ? AND last_seen > ?", clusterAddress, proxy.StatusConnected, time.Now().Add(-proxyActiveThreshold)).
+		Count(&count)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to count active proxies at cluster address: %v", result.Error)
+		return false, status.Errorf(status.Internal, "failed to count active proxies at cluster address")
+	}
+	return count > 0, nil
+}
+
+func (s *SqlStore) IsClusterAddressConflicting(ctx context.Context, clusterAddress, accountID string) (bool, error) {
+	var count int64
+	result := s.db.
+		Model(&proxy.Proxy{}).
+		Where("cluster_address = ? AND (account_id IS NULL OR account_id != ?)", clusterAddress, accountID).
+		Count(&count)
+	if result.Error != nil {
+		return false, status.Errorf(status.Internal, "check cluster address conflict: %v", result.Error)
+	}
+	return count > 0, nil
+}
+
+// HasForeignAccountProxyAtHost reports whether a proxy owned by a different
+// account declares this host. Shared proxies (account_id IS NULL) are not
+// foreign: a shared cluster is what most accounts pin their agent network
+// gateway to. The match folds case because proxies declare their address as
+// the operator spelled it while the caller's host is normalised; that costs a
+// scan of the proxies table, taken once per account when its gateway is
+// bootstrapped, not on the per-connect path IsClusterAddressConflicting serves.
+func (s *SqlStore) HasForeignAccountProxyAtHost(ctx context.Context, host, accountID string) (bool, error) {
+	var count int64
+	result := s.db.
+		Model(&proxy.Proxy{}).
+		Where("LOWER(cluster_address) = LOWER(?) AND account_id IS NOT NULL AND account_id != ?", host, accountID).
+		Count(&count)
+	if result.Error != nil {
+		return false, status.Errorf(status.Internal, "check proxy host ownership: %v", result.Error)
+	}
+	return count > 0, nil
+}
+
+func (s *SqlStore) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
+	result := s.db.
+		Where("cluster_address = ? AND account_id = ?", clusterAddress, accountID).
+		Delete(&proxy.Proxy{})
+	if result.Error != nil {
+		return status.Errorf(status.Internal, "delete account cluster: %v", result.Error)
+	}
+	if result.RowsAffected == 0 {
+		return status.Errorf(status.NotFound, "cluster not found")
+	}
+	return nil
+}
+
+// GetProxyClusters returns every cluster the account can see (shared
+// plus its own BYOP), regardless of whether any proxy in the cluster
+// is currently heartbeating. Online and ConnectedProxies are derived
+// from the 2-min active window so the dashboard can render offline
+// clusters distinctly; the 1-hour heartbeat reaper still removes rows
+// that go quiet for too long.
+//
+// AccountOwned is determined by whether any proxy row in the group
+// carries a non-NULL account_id; the caller maps that to Cluster.Type.
+// Capability flags are NOT filled here — the handler enriches them via
+// the per-cluster capability lookups.
+func (s *SqlStore) GetProxyClusters(ctx context.Context, accountID string) ([]proxy.Cluster, error) {
+	activeCutoff := time.Now().Add(-proxyActiveThreshold)
+
+	type clusterRow struct {
+		ID               string
+		Address          string
+		ConnectedProxies int
+		Online           bool
+		AccountOwned     bool
+	}
+
+	var rows []clusterRow
+	result := s.db.Model(&proxy.Proxy{}).
+		Select(
+			"MIN(id) AS id, "+
+				"cluster_address AS address, "+
+				// COUNT(CASE WHEN ... THEN 1 END) counts only non-NULL — i.e. only
+				// rows that satisfy the predicate — so it works portably across
+				// sqlite/postgres/mysql without dialect-specific FILTER syntax.
+				"COUNT(CASE WHEN status = ? AND last_seen > ? THEN 1 END) AS connected_proxies, "+
+				// MAX(CASE …) > 0 expresses BOOL_OR in a way Postgres tolerates
+				// (Postgres can't MAX a boolean column).
+				"MAX(CASE WHEN status = ? AND last_seen > ? THEN 1 ELSE 0 END) > 0 AS online, "+
+				"MAX(CASE WHEN account_id IS NOT NULL THEN 1 ELSE 0 END) > 0 AS account_owned",
+			proxy.StatusConnected, activeCutoff,
+			proxy.StatusConnected, activeCutoff,
+		).
+		Where("account_id IS NULL OR account_id = ?", accountID).
+		Group("cluster_address").
+		Scan(&rows)
+
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get proxy clusters: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "get proxy clusters")
+	}
+
+	clusters := make([]proxy.Cluster, 0, len(rows))
+	for _, r := range rows {
+		c := proxy.Cluster{
+			ID:               r.ID,
+			Address:          r.Address,
+			Online:           r.Online,
+			ConnectedProxies: r.ConnectedProxies,
+		}
+		if r.AccountOwned {
+			c.Type = proxy.ClusterTypeAccount
+		} else {
+			c.Type = proxy.ClusterTypeShared
+		}
+		clusters = append(clusters, c)
+	}
+
+	return clusters, nil
+}
+
+// proxyActiveThreshold is the maximum age of a heartbeat for a proxy to be
+// considered active. Must be at least 2x the heartbeat interval (1 min).
+const proxyActiveThreshold = 2 * time.Minute
+
+var validCapabilityColumns = map[string]struct{}{
+	"supports_custom_ports": {},
+	"require_subdomain":     {},
+	"supports_crowdsec":     {},
+	"private":               {},
+}
+
+// GetClusterSupportsCustomPorts returns whether any active proxy in the cluster
+// supports custom ports. Returns nil when no proxy reported the capability.
+func (s *SqlStore) GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
+	return s.getClusterCapability(ctx, clusterAddr, "supports_custom_ports")
+}
+
+// GetClusterRequireSubdomain returns whether any active proxy in the cluster
+// requires a subdomain. Returns nil when no proxy reported the capability.
+func (s *SqlStore) GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool {
+	return s.getClusterCapability(ctx, clusterAddr, "require_subdomain")
+}
+
+// GetClusterSupportsPrivate reports whether any active proxy in the cluster
+// has the private capability (nil = unreported).
+func (s *SqlStore) GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
+	return s.getClusterCapability(ctx, clusterAddr, "private")
+}
+
+// GetClusterAllProxiesPrivate reports whether every active proxy in the cluster
+// has the private capability. Returns nil when no proxy reported the capability.
+// Use it where any proxy in the cluster may serve the result, since a single
+// non-private proxy would serve it without the private guarantees.
+func (s *SqlStore) GetClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool {
+	return s.getClusterUnanimousCapability(ctx, clusterAddr, "private")
+}
+
+// GetClusterSupportsCrowdSec returns whether all active proxies in the cluster
+// have CrowdSec configured. Returns nil when no proxy reported the capability.
+// Unlike other capabilities that use ANY-true (for rolling upgrades), CrowdSec
+// requires unanimous support: a single unconfigured proxy would let requests
+// bypass reputation checks.
+func (s *SqlStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
+	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_crowdsec")
+}
+
+// GetActiveProxyVersions returns every active proxy version in a cluster.
+func (s *SqlStore) GetActiveProxyVersions(ctx context.Context, clusterAddr string) ([]string, error) {
+	var versions []string
+	err := s.db.WithContext(ctx).
+		Model(&proxy.Proxy{}).
+		Where("LOWER(cluster_address) = LOWER(?) AND status = ? AND last_seen > ?",
+			clusterAddr, proxy.StatusConnected, time.Now().Add(-proxyActiveThreshold)).
+		Pluck("version", &versions).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to get active proxy versions for %s: %v", clusterAddr, err)
+		return nil, status.Errorf(status.Internal, "get active proxy versions")
+	}
+	return versions, nil
+}
+
+// getClusterUnanimousCapability returns an aggregated boolean capability
+// requiring all active proxies in the cluster to report true.
+func (s *SqlStore) getClusterUnanimousCapability(ctx context.Context, clusterAddr, column string) *bool {
+	if _, ok := validCapabilityColumns[column]; !ok {
+		log.WithContext(ctx).Errorf("invalid capability column: %s", column)
+		return nil
+	}
+
+	var result struct {
+		Total    int64
+		Reported int64
+		AllTrue  bool
+	}
+
+	// All active proxies must have reported the capability (no NULLs) and all
+	// must report true. A single unreported or false proxy means the cluster
+	// does not unanimously support the capability.
+	err := s.db.WithContext(ctx).
+		Model(&proxy.Proxy{}).
+		Select("COUNT(*) AS total, "+
+			"COUNT(CASE WHEN "+column+" IS NOT NULL THEN 1 END) AS reported, "+
+			"COUNT(*) > 0 AND COUNT(*) = COUNT(CASE WHEN "+column+" = true THEN 1 END) AS all_true").
+		Where("cluster_address = ? AND status = ? AND last_seen > ?",
+			clusterAddr, "connected", time.Now().Add(-proxyActiveThreshold)).
+		Scan(&result).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("query cluster capability %s for %s: %v", column, clusterAddr, err)
+		return nil
+	}
+
+	if result.Total == 0 || result.Reported == 0 {
+		return nil
+	}
+
+	// If any proxy has not reported (NULL), we can't confirm unanimous support.
+	if result.Reported < result.Total {
+		v := false
+		return &v
+	}
+
+	return &result.AllTrue
+}
+
+// getClusterCapability returns an aggregated boolean capability for the given
+// cluster. It checks active (connected, recently seen) proxies and returns:
+//   - *true if any proxy in the cluster has the capability set to true,
+//   - *false if at least one proxy reported but none set it to true,
+//   - nil if no proxy reported the capability at all.
+func (s *SqlStore) getClusterCapability(ctx context.Context, clusterAddr, column string) *bool {
+	if _, ok := validCapabilityColumns[column]; !ok {
+		log.WithContext(ctx).Errorf("invalid capability column: %s", column)
+		return nil
+	}
+
+	var result struct {
+		HasCapability bool
+		AnyTrue       bool
+	}
+
+	err := s.db.
+		WithContext(ctx).
+		Model(&proxy.Proxy{}).
+		Select("COUNT(CASE WHEN "+column+" IS NOT NULL THEN 1 END) > 0 AS has_capability, "+
+			"COALESCE(MAX(CASE WHEN "+column+" = true THEN 1 ELSE 0 END), 0) = 1 AS any_true").
+		Where("cluster_address = ? AND status = ? AND last_seen > ?",
+			clusterAddr, "connected", time.Now().Add(-proxyActiveThreshold)).
+		Scan(&result).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("query cluster capability %s for %s: %v", column, clusterAddr, err)
+		return nil
+	}
+
+	if !result.HasCapability {
+		return nil
+	}
+
+	return &result.AnyTrue
+}
+
+// CleanupStaleProxies deletes proxies that haven't sent heartbeat in the specified duration
+func (s *SqlStore) CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error {
+	cutoffTime := time.Now().Add(-inactivityDuration)
+
+	result := s.db.
+		Where("last_seen < ?", cutoffTime).
+		Delete(&proxy.Proxy{})
+
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to cleanup stale proxies: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to cleanup stale proxies")
+	}
+
+	if result.RowsAffected > 0 {
+		log.WithContext(ctx).Infof("Cleaned up %d stale proxies", result.RowsAffected)
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_proxy_access_token.go b/management/server/store/sql_store_proxy_access_token.go
new file mode 100644
index 000000000..b111c8f64
--- /dev/null
+++ b/management/server/store/sql_store_proxy_access_token.go
@@ -0,0 +1,127 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// GetProxyAccessTokenByHashedToken retrieves a proxy access token by its hashed value.
+func (s *SqlStore) GetProxyAccessTokenByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken types.HashedProxyToken) (*types.ProxyAccessToken, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var token types.ProxyAccessToken
+	result := tx.Take(&token, "hashed_token = ?", hashedToken)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "proxy access token not found")
+		}
+		return nil, status.Errorf(status.Internal, "get proxy access token: %v", result.Error)
+	}
+
+	return &token, nil
+}
+
+// GetAllProxyAccessTokens retrieves all proxy access tokens.
+func (s *SqlStore) GetAllProxyAccessTokens(ctx context.Context, lockStrength LockingStrength) ([]*types.ProxyAccessToken, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var tokens []*types.ProxyAccessToken
+	result := tx.Find(&tokens)
+	if result.Error != nil {
+		return nil, status.Errorf(status.Internal, "get proxy access tokens: %v", result.Error)
+	}
+
+	return tokens, nil
+}
+
+// SaveProxyAccessToken saves a proxy access token to the database.
+func (s *SqlStore) SaveProxyAccessToken(ctx context.Context, token *types.ProxyAccessToken) error {
+	if result := s.db.Create(token); result.Error != nil {
+		return status.Errorf(status.Internal, "save proxy access token: %v", result.Error)
+	}
+	return nil
+}
+
+// RevokeProxyAccessToken revokes a proxy access token by its ID.
+func (s *SqlStore) RevokeProxyAccessToken(ctx context.Context, tokenID string) error {
+	result := s.db.Model(&types.ProxyAccessToken{}).Where(idQueryCondition, tokenID).Update("revoked", true)
+	if result.Error != nil {
+		return status.Errorf(status.Internal, "revoke proxy access token: %v", result.Error)
+	}
+
+	if result.RowsAffected == 0 {
+		return status.Errorf(status.NotFound, "proxy access token not found")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) GetProxyAccessTokensByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.ProxyAccessToken, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var tokens []*types.ProxyAccessToken
+	result := tx.Where("account_id = ?", accountID).Find(&tokens)
+	if result.Error != nil {
+		return nil, status.Errorf(status.Internal, "get proxy access tokens by account: %v", result.Error)
+	}
+
+	return tokens, nil
+}
+
+func (s *SqlStore) IsProxyAccessTokenValid(ctx context.Context, tokenID string) (bool, error) {
+	token, err := s.GetProxyAccessTokenByID(ctx, LockingStrengthNone, tokenID)
+	if err != nil {
+		return false, err
+	}
+	return token.IsValid(), nil
+}
+
+func (s *SqlStore) GetProxyAccessTokenByID(ctx context.Context, lockStrength LockingStrength, tokenID string) (*types.ProxyAccessToken, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var token types.ProxyAccessToken
+	result := tx.Take(&token, idQueryCondition, tokenID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "proxy access token not found")
+		}
+		return nil, status.Errorf(status.Internal, "get proxy access token by ID: %v", result.Error)
+	}
+
+	return &token, nil
+}
+
+// MarkProxyAccessTokenUsed updates the last used timestamp for a proxy access token.
+func (s *SqlStore) MarkProxyAccessTokenUsed(ctx context.Context, tokenID string) error {
+	result := s.db.Model(&types.ProxyAccessToken{}).
+		Where(idQueryCondition, tokenID).
+		Update("last_used", time.Now().UTC())
+	if result.Error != nil {
+		return status.Errorf(status.Internal, "mark proxy access token as used: %v", result.Error)
+	}
+
+	if result.RowsAffected == 0 {
+		return status.Errorf(status.NotFound, "proxy access token not found")
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_proxy_disconnect_test.go b/management/server/store/sql_store_proxy_disconnect_test.go
new file mode 100644
index 000000000..2d0f34680
--- /dev/null
+++ b/management/server/store/sql_store_proxy_disconnect_test.go
@@ -0,0 +1,156 @@
+package store
+
+import (
+	"context"
+	"os"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+)
+
+// TestSqlStore_DisconnectAllProxies guards the administrative
+// force-disconnect helper:
+//
+//  1. Every proxy that is not already disconnected is marked
+//     disconnected regardless of its session ID (unlike
+//     DisconnectProxy, which is session-guarded).
+//  2. Rows that are already disconnected are left untouched, so their
+//     original disconnected_at is preserved and the returned count
+//     reflects only the rows that actually changed.
+//  3. last_seen is not modified — the stale-proxy reaper keeps working
+//     off the real last heartbeat.
+func TestSqlStore_DisconnectAllProxies(t *testing.T) {
+	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+
+		lastSeenFresh := time.Now().Add(-30 * time.Second)
+		lastSeenStale := time.Now().Add(-30 * time.Minute)
+		oldDisconnectedAt := time.Now().Add(-time.Hour)
+
+		accountID := "acct-disconnect"
+		proxies := []*rpproxy.Proxy{
+			{
+				ID:             "p-connected-fresh",
+				SessionID:      "sess-1",
+				ClusterAddress: "cluster-a.example.com",
+				IPAddress:      "10.0.0.1",
+				LastSeen:       lastSeenFresh,
+				Status:         rpproxy.StatusConnected,
+			},
+			{
+				ID:             "p-connected-stale",
+				SessionID:      "sess-2",
+				ClusterAddress: "cluster-b.example.com",
+				IPAddress:      "10.0.0.2",
+				AccountID:      &accountID,
+				LastSeen:       lastSeenStale,
+				Status:         rpproxy.StatusConnected,
+			},
+			{
+				ID:             "p-already-disconnected",
+				SessionID:      "sess-3",
+				ClusterAddress: "cluster-a.example.com",
+				IPAddress:      "10.0.0.3",
+				LastSeen:       lastSeenStale,
+				Status:         rpproxy.StatusDisconnected,
+				DisconnectedAt: &oldDisconnectedAt,
+			},
+		}
+		for _, p := range proxies {
+			require.NoError(t, store.SaveProxy(ctx, p))
+		}
+
+		all, err := store.GetAllProxies(ctx)
+		require.NoError(t, err)
+		require.Len(t, all, 3)
+
+		disconnected, err := store.DisconnectAllProxies(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, int64(2), disconnected)
+
+		all, err = store.GetAllProxies(ctx)
+		require.NoError(t, err)
+		require.Len(t, all, 3)
+
+		byID := make(map[string]*rpproxy.Proxy, len(all))
+		for _, p := range all {
+			byID[p.ID] = p
+		}
+
+		for id, p := range byID {
+			assert.Equal(t, rpproxy.StatusDisconnected, p.Status, "proxy %s should be disconnected", id)
+			require.NotNil(t, p.DisconnectedAt, "proxy %s should have disconnected_at set", id)
+		}
+
+		// force-marked rows carry a fresh disconnected_at; the untouched row keeps its original one
+		assert.WithinDuration(t, time.Now(), *byID["p-connected-fresh"].DisconnectedAt, 10*time.Second)
+		assert.WithinDuration(t, time.Now(), *byID["p-connected-stale"].DisconnectedAt, 10*time.Second)
+		assert.WithinDuration(t, oldDisconnectedAt, *byID["p-already-disconnected"].DisconnectedAt, time.Second)
+
+		// last_seen is preserved so the stale reaper schedule is unaffected
+		assert.WithinDuration(t, lastSeenFresh, byID["p-connected-fresh"].LastSeen, time.Second)
+		assert.WithinDuration(t, lastSeenStale, byID["p-connected-stale"].LastSeen, time.Second)
+
+		// idempotent: a second run has nothing left to update
+		disconnected, err = store.DisconnectAllProxies(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, int64(0), disconnected)
+	})
+}
+
+func TestSqlStore_UpdateProxyHeartbeatRestoresDisconnectedCurrentSession(t *testing.T) {
+	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		proxy := &rpproxy.Proxy{
+			ID:             "p-heartbeat",
+			SessionID:      "sess-heartbeat",
+			ClusterAddress: "cluster-heartbeat.example.com",
+			IPAddress:      "10.0.0.10",
+			LastSeen:       time.Now().Add(-30 * time.Second),
+			Status:         rpproxy.StatusConnected,
+		}
+		require.NoError(t, store.SaveProxy(ctx, proxy))
+
+		disconnected, err := store.DisconnectAllProxies(ctx)
+		require.NoError(t, err)
+		require.Equal(t, int64(1), disconnected)
+
+		require.NoError(t, store.UpdateProxyHeartbeat(ctx, &rpproxy.Proxy{ID: proxy.ID, SessionID: proxy.SessionID}))
+
+		all, err := store.GetAllProxies(ctx)
+		require.NoError(t, err)
+		require.Len(t, all, 1)
+		assert.Equal(t, rpproxy.StatusConnected, all[0].Status)
+		assert.Nil(t, all[0].DisconnectedAt)
+		assert.WithinDuration(t, time.Now(), all[0].LastSeen, 10*time.Second)
+
+		addresses, err := store.GetActiveProxyClusterAddresses(ctx)
+		require.NoError(t, err)
+		assert.Contains(t, addresses, proxy.ClusterAddress)
+	})
+}
+
+func TestSqlStore_GetAllProxies_Empty(t *testing.T) {
+	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		all, err := store.GetAllProxies(context.Background())
+		require.NoError(t, err)
+		assert.Empty(t, all)
+	})
+}
diff --git a/management/server/store/sql_store_route.go b/management/server/store/sql_store_route.go
new file mode 100644
index 000000000..ec9e130b1
--- /dev/null
+++ b/management/server/store/sql_store_route.go
@@ -0,0 +1,152 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) getRoutes(ctx context.Context, accountID string) ([]route.Route, error) {
+	const query = `SELECT id, account_id, public_id, network, domains, keep_route, net_id, description, peer, peer_groups, network_type, masquerade, metric, enabled, groups, access_control_groups, skip_auto_apply FROM routes WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+	routes, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (route.Route, error) {
+		var r route.Route
+		var network, domains, peerGroups, groups, accessGroups []byte
+		var keepRoute, masquerade, enabled, skipAutoApply sql.NullBool
+		var metric sql.NullInt64
+		err := row.Scan(&r.ID, &r.AccountID, &r.PublicID, &network, &domains, &keepRoute, &r.NetID, &r.Description, &r.Peer, &peerGroups, &r.NetworkType, &masquerade, &metric, &enabled, &groups, &accessGroups, &skipAutoApply)
+		if err == nil {
+			if keepRoute.Valid {
+				r.KeepRoute = keepRoute.Bool
+			}
+			if masquerade.Valid {
+				r.Masquerade = masquerade.Bool
+			}
+			if enabled.Valid {
+				r.Enabled = enabled.Bool
+			}
+			if skipAutoApply.Valid {
+				r.SkipAutoApply = skipAutoApply.Bool
+			}
+			if metric.Valid {
+				r.Metric = int(metric.Int64)
+			}
+			if network != nil {
+				_ = json.Unmarshal(network, &r.Network)
+			}
+			if domains != nil {
+				_ = json.Unmarshal(domains, &r.Domains)
+			}
+			if peerGroups != nil {
+				_ = json.Unmarshal(peerGroups, &r.PeerGroups)
+			}
+			if groups != nil {
+				_ = json.Unmarshal(groups, &r.Groups)
+			}
+			if accessGroups != nil {
+				_ = json.Unmarshal(accessGroups, &r.AccessControlGroups)
+			}
+		}
+		return r, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	return routes, nil
+}
+
+// GetAccountRoutes retrieves network routes for an account.
+func (s *SqlStore) GetAccountRoutes(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*route.Route, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var routes []*route.Route
+	result := tx.Find(&routes, accountIDCondition, accountID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get routes from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get routes from store")
+	}
+
+	return routes, nil
+}
+
+// GetRouteByID retrieves a route by its ID and account ID.
+func (s *SqlStore) GetRouteByID(ctx context.Context, lockStrength LockingStrength, accountID string, routeID string) (*route.Route, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var route *route.Route
+	result := tx.Take(&route, accountAndIDQueryCondition, accountID, routeID)
+	if err := result.Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, status.NewRouteNotFoundError(routeID)
+		}
+		log.WithContext(ctx).Errorf("failed to get route from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get route from store")
+	}
+
+	return route, nil
+}
+
+// GetRouteByIDOrPublicID retrieves a route by either its ID or its PublicID. See
+// GetPolicyByIDOrPublicID for why peer-reported references need both.
+func (s *SqlStore) GetRouteByIDOrPublicID(ctx context.Context, lockStrength LockingStrength, accountID string, routeID string) (*route.Route, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var route *route.Route
+	result := tx.Take(&route, accountAndAnyIDQueryCondition, accountID, routeID, routeID)
+	if err := result.Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, status.NewRouteNotFoundError(routeID)
+		}
+		log.WithContext(ctx).Errorf("failed to get route from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get route from store")
+	}
+
+	return route, nil
+}
+
+// SaveRoute saves a route to the database.
+func (s *SqlStore) SaveRoute(ctx context.Context, route *route.Route) error {
+	result := s.db.Save(route)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to save route to the store: %s", err)
+		return status.Errorf(status.Internal, "failed to save route to store")
+	}
+
+	return nil
+}
+
+// DeleteRoute deletes a route from the database.
+func (s *SqlStore) DeleteRoute(ctx context.Context, accountID, routeID string) error {
+	result := s.db.Delete(&route.Route{}, accountAndIDQueryCondition, accountID, routeID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to delete route from the store: %s", err)
+		return status.Errorf(status.Internal, "failed to delete route from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewRouteNotFoundError(routeID)
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_route_test.go b/management/server/store/sql_store_route_test.go
new file mode 100644
index 000000000..53e4f130e
--- /dev/null
+++ b/management/server/store/sql_store_route_test.go
@@ -0,0 +1,165 @@
+package store
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	nbroute "github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestSqlStore_GetAccountRoutes(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name          string
+		accountID     string
+		expectedCount int
+	}{
+		{
+			name:          "retrieve routes by existing account ID",
+			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
+			expectedCount: 1,
+		},
+		{
+			name:          "non-existing account ID",
+			accountID:     "nonexistent",
+			expectedCount: 0,
+		},
+		{
+			name:          "empty account ID",
+			accountID:     "",
+			expectedCount: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			routes, err := store.GetAccountRoutes(context.Background(), LockingStrengthNone, tt.accountID)
+			require.NoError(t, err)
+			require.Len(t, routes, tt.expectedCount)
+		})
+	}
+}
+
+func TestSqlStore_GetRouteByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	tests := []struct {
+		name        string
+		routeID     string
+		expectError bool
+	}{
+		{
+			name:        "retrieve existing route",
+			routeID:     "ct03t427qv97vmtmglog",
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing route",
+			routeID:     "non-existing",
+			expectError: true,
+		},
+		{
+			name:        "retrieve with empty route ID",
+			routeID:     "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			route, err := store.GetRouteByID(context.Background(), LockingStrengthNone, accountID, tt.routeID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, route)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, route)
+				require.Equal(t, tt.routeID, string(route.ID))
+			}
+		})
+	}
+}
+
+func TestSqlStore_GetRouteByIDOrPublicID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	routeID := "ct03t427qv97vmtmglog"
+
+	route, err := store.GetRouteByID(context.Background(), LockingStrengthNone, accountID, routeID)
+	require.NoError(t, err)
+	require.NotEmpty(t, route.PublicID)
+
+	for _, id := range []string{routeID, route.PublicID} {
+		route, err := store.GetRouteByIDOrPublicID(context.Background(), LockingStrengthNone, accountID, id)
+		require.NoError(t, err)
+		require.Equal(t, routeID, string(route.ID))
+	}
+
+	route, err = store.GetRouteByIDOrPublicID(context.Background(), LockingStrengthNone, accountID, "non-existing")
+	require.Error(t, err)
+	sErr, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, sErr.Type(), status.NotFound)
+	require.Nil(t, route)
+}
+
+func TestSqlStore_SaveRoute(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	route := &nbroute.Route{
+		ID:                  "route-id",
+		AccountID:           accountID,
+		Network:             netip.MustParsePrefix("10.10.0.0/16"),
+		NetID:               "netID",
+		PeerGroups:          []string{"routeA"},
+		NetworkType:         nbroute.IPv4Network,
+		Masquerade:          true,
+		Metric:              9999,
+		Enabled:             true,
+		Groups:              []string{"groupA"},
+		AccessControlGroups: []string{},
+	}
+	err = store.SaveRoute(context.Background(), route)
+	require.NoError(t, err)
+
+	saveRoute, err := store.GetRouteByID(context.Background(), LockingStrengthNone, accountID, string(route.ID))
+	require.NoError(t, err)
+	require.Equal(t, route, saveRoute)
+
+}
+
+func TestSqlStore_DeleteRoute(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	routeID := "ct03t427qv97vmtmglog"
+
+	err = store.DeleteRoute(context.Background(), accountID, routeID)
+	require.NoError(t, err)
+
+	route, err := store.GetRouteByID(context.Background(), LockingStrengthNone, accountID, routeID)
+	require.Error(t, err)
+	require.Nil(t, route)
+}
diff --git a/management/server/store/sql_store_service.go b/management/server/store/sql_store_service.go
new file mode 100644
index 000000000..4f4f3546d
--- /dev/null
+++ b/management/server/store/sql_store_service.go
@@ -0,0 +1,452 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// serviceSelectColumns and targetSelectColumns are the column lists the Postgres
+// pgx read path scans. They must stay in sync with the rpservice.Service and
+// rpservice.Target gorm models; TestPgxServiceColumnsMatchGorm enforces this.
+const serviceSelectColumns = `id, account_id, name, domain, enabled, auth, restrictions,
+	meta_created_at, meta_certificate_issued_at, meta_last_renewed_at, meta_status, proxy_cluster,
+	pass_host_header, rewrite_redirects, session_private_key, session_public_key,
+	mode, listen_port, port_auto_assigned, source, source_peer, terminated,
+	private, access_groups`
+
+func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
+	const serviceQuery = `SELECT ` + serviceSelectColumns + ` FROM services WHERE account_id = $1`
+
+	serviceRows, err := s.pgxPool().Query(ctx, serviceQuery, accountID)
+	if err != nil {
+		return nil, err
+	}
+
+	services, err := pgx.CollectRows(serviceRows, scanService)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(services) == 0 {
+		return services, nil
+	}
+
+	serviceIDs := make([]string, len(services))
+	serviceMap := make(map[string]*rpservice.Service)
+	for i, svc := range services {
+		serviceIDs[i] = svc.ID
+		serviceMap[svc.ID] = svc
+	}
+
+	targets, err := s.getServiceTargets(ctx, serviceIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, target := range targets {
+		if service, ok := serviceMap[target.ServiceID]; ok {
+			service.Targets = append(service.Targets, target)
+		}
+	}
+
+	return services, nil
+}
+
+func scanService(row pgx.CollectableRow) (*rpservice.Service, error) {
+	var s rpservice.Service
+	var auth []byte
+	var restrictions []byte
+	var accessGroups []byte
+	var createdAt, certIssuedAt, lastRenewedAt sql.NullTime
+	var status, proxyCluster, sessionPrivateKey, sessionPublicKey sql.NullString
+	var mode, source, sourcePeer sql.NullString
+	var terminated, portAutoAssigned, private sql.NullBool
+	var listenPort sql.NullInt64
+	err := row.Scan(
+		&s.ID,
+		&s.AccountID,
+		&s.Name,
+		&s.Domain,
+		&s.Enabled,
+		&auth,
+		&restrictions,
+		&createdAt,
+		&certIssuedAt,
+		&lastRenewedAt,
+		&status,
+		&proxyCluster,
+		&s.PassHostHeader,
+		&s.RewriteRedirects,
+		&sessionPrivateKey,
+		&sessionPublicKey,
+		&mode,
+		&listenPort,
+		&portAutoAssigned,
+		&source,
+		&sourcePeer,
+		&terminated,
+		&private,
+		&accessGroups,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	if auth != nil {
+		if err := json.Unmarshal(auth, &s.Auth); err != nil {
+			return nil, err
+		}
+	}
+
+	if len(restrictions) > 0 {
+		if err := json.Unmarshal(restrictions, &s.Restrictions); err != nil {
+			return nil, fmt.Errorf("unmarshal restrictions: %w", err)
+		}
+	}
+
+	if len(accessGroups) > 0 {
+		if err := json.Unmarshal(accessGroups, &s.AccessGroups); err != nil {
+			return nil, fmt.Errorf("unmarshal access_groups: %w", err)
+		}
+	}
+
+	if private.Valid {
+		s.Private = private.Bool
+	}
+
+	s.Meta = serviceMetaFromRow(createdAt, certIssuedAt, lastRenewedAt, status)
+	if proxyCluster.Valid {
+		s.ProxyCluster = proxyCluster.String
+	}
+	if sessionPrivateKey.Valid {
+		s.SessionPrivateKey = sessionPrivateKey.String
+	}
+	if sessionPublicKey.Valid {
+		s.SessionPublicKey = sessionPublicKey.String
+	}
+	if mode.Valid {
+		s.Mode = mode.String
+	}
+	if source.Valid {
+		s.Source = source.String
+	}
+	if sourcePeer.Valid {
+		s.SourcePeer = sourcePeer.String
+	}
+	if terminated.Valid {
+		s.Terminated = terminated.Bool
+	}
+	if portAutoAssigned.Valid {
+		s.PortAutoAssigned = portAutoAssigned.Bool
+	}
+	if listenPort.Valid {
+		if listenPort.Int64 < 0 || listenPort.Int64 > math.MaxUint16 {
+			return nil, fmt.Errorf("listen_port %d out of range", listenPort.Int64)
+		}
+		s.ListenPort = uint16(listenPort.Int64)
+	}
+	s.Targets = []*rpservice.Target{}
+	return &s, nil
+}
+
+func serviceMetaFromRow(createdAt, certIssuedAt, lastRenewedAt sql.NullTime, status sql.NullString) rpservice.Meta {
+	meta := rpservice.Meta{}
+	if createdAt.Valid {
+		meta.CreatedAt = createdAt.Time
+	}
+	if certIssuedAt.Valid {
+		t := certIssuedAt.Time
+		meta.CertificateIssuedAt = &t
+	}
+	if lastRenewedAt.Valid {
+		t := lastRenewedAt.Time
+		meta.LastRenewedAt = &t
+	}
+	if status.Valid {
+		meta.Status = status.String
+	}
+	return meta
+}
+
+func (s *SqlStore) CreateService(ctx context.Context, service *rpservice.Service) error {
+	serviceCopy := service.Copy()
+	if err := serviceCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
+		return fmt.Errorf("encrypt service data: %w", err)
+	}
+	result := s.db.Create(serviceCopy)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to create service to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to create service to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) UpdateService(ctx context.Context, service *rpservice.Service) error {
+	serviceCopy := service.Copy()
+	if err := serviceCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
+		return fmt.Errorf("encrypt service data: %w", err)
+	}
+
+	// Create target type instance outside transaction to avoid variable shadowing
+	targetType := &rpservice.Target{}
+
+	// Use a transaction to ensure atomic updates of the service and its targets
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
+		// Delete existing targets
+		if err := tx.Where("service_id = ?", serviceCopy.ID).Delete(targetType).Error; err != nil {
+			return err
+		}
+
+		// Update the service and create new targets
+		if err := tx.Session(&gorm.Session{FullSaveAssociations: true}).Save(serviceCopy).Error; err != nil {
+			return err
+		}
+
+		return nil
+	})
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to update service to store: %v", err)
+		return status.Errorf(status.Internal, "failed to update service to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) DeleteService(ctx context.Context, accountID, serviceID string) error {
+	result := s.db.Delete(&rpservice.Service{}, accountAndIDQueryCondition, accountID, serviceID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete service from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete service from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.Errorf(status.NotFound, "service %s not found", serviceID)
+	}
+
+	return nil
+}
+
+func (s *SqlStore) GetServiceByID(ctx context.Context, lockStrength LockingStrength, accountID, serviceID string) (*rpservice.Service, error) {
+	tx := s.db.Preload("Targets")
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var service *rpservice.Service
+	result := tx.Take(&service, accountAndIDQueryCondition, accountID, serviceID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "service %s not found", serviceID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get service from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get service from store")
+	}
+
+	if err := service.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+		return nil, fmt.Errorf("decrypt service data: %w", err)
+	}
+
+	return service, nil
+}
+
+func (s *SqlStore) GetServiceByDomain(ctx context.Context, domain string) (*rpservice.Service, error) {
+	var service *rpservice.Service
+	result := s.db.Preload("Targets").Where("domain = ?", domain).First(&service)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "service with domain %s not found", domain)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get service by domain from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get service by domain from store")
+	}
+
+	if err := service.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+		return nil, fmt.Errorf("decrypt service data: %w", err)
+	}
+
+	return service, nil
+}
+
+func (s *SqlStore) GetServices(ctx context.Context, lockStrength LockingStrength) ([]*rpservice.Service, error) {
+	tx := s.db.Preload("Targets")
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var serviceList []*rpservice.Service
+	result := tx.Find(&serviceList)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get services from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get services from store")
+	}
+
+	for _, service := range serviceList {
+		if err := service.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+			return nil, fmt.Errorf("decrypt service data: %w", err)
+		}
+	}
+
+	return serviceList, nil
+}
+
+func (s *SqlStore) GetAccountServices(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*rpservice.Service, error) {
+	tx := s.db.Preload("Targets")
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var serviceList []*rpservice.Service
+	result := tx.Find(&serviceList, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get services from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get services from store")
+	}
+
+	for _, service := range serviceList {
+		if err := service.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+			return nil, fmt.Errorf("decrypt service data: %w", err)
+		}
+	}
+
+	return serviceList, nil
+}
+
+// RenewEphemeralService updates the last_renewed_at timestamp for an ephemeral service.
+func (s *SqlStore) RenewEphemeralService(ctx context.Context, accountID, peerID, serviceID string) error {
+	result := s.db.Model(&rpservice.Service{}).
+		Where("id = ? AND account_id = ? AND source_peer = ? AND source = ?", serviceID, accountID, peerID, rpservice.SourceEphemeral).
+		Update("meta_last_renewed_at", time.Now())
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to renew ephemeral service: %v", result.Error)
+		return status.Errorf(status.Internal, "renew ephemeral service")
+	}
+	if result.RowsAffected == 0 {
+		return status.Errorf(status.NotFound, "no active expose session for service %s", serviceID)
+	}
+	return nil
+}
+
+// GetExpiredEphemeralServices returns ephemeral services whose last renewal exceeds the given TTL.
+// Only the fields needed for reaping are selected. The limit parameter caps the batch size to
+// avoid loading too many rows in a single tick. Rows with empty source_peer are excluded to
+// skip malformed legacy data.
+func (s *SqlStore) GetExpiredEphemeralServices(ctx context.Context, ttl time.Duration, limit int) ([]*rpservice.Service, error) {
+	cutoff := time.Now().Add(-ttl)
+	var services []*rpservice.Service
+	result := s.db.
+		Select("id", "account_id", "source_peer", "domain").
+		Where("source = ? AND source_peer <> '' AND meta_last_renewed_at < ?", rpservice.SourceEphemeral, cutoff).
+		Limit(limit).
+		Find(&services)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get expired ephemeral services: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "get expired ephemeral services")
+	}
+	return services, nil
+}
+
+// CountEphemeralServicesByPeer returns the count of ephemeral services for a specific peer.
+// Use LockingStrengthUpdate inside a transaction to serialize concurrent create operations.
+// The locking is applied via a row-level SELECT ... FOR UPDATE (not on the aggregate) to
+// stay compatible with Postgres, which disallows FOR UPDATE on COUNT(*).
+func (s *SqlStore) CountEphemeralServicesByPeer(ctx context.Context, lockStrength LockingStrength, accountID, peerID string) (int64, error) {
+	if lockStrength == LockingStrengthNone {
+		var count int64
+		result := s.db.Model(&rpservice.Service{}).
+			Where("account_id = ? AND source_peer = ? AND source = ?", accountID, peerID, rpservice.SourceEphemeral).
+			Count(&count)
+		if result.Error != nil {
+			log.WithContext(ctx).Errorf("failed to count ephemeral services: %v", result.Error)
+			return 0, status.Errorf(status.Internal, "count ephemeral services")
+		}
+		return count, nil
+	}
+
+	var ids []string
+	result := s.db.Model(&rpservice.Service{}).
+		Clauses(clause.Locking{Strength: string(lockStrength)}).
+		Select("id").
+		Where("account_id = ? AND source_peer = ? AND source = ?", accountID, peerID, rpservice.SourceEphemeral).
+		Pluck("id", &ids)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to count ephemeral services: %v", result.Error)
+		return 0, status.Errorf(status.Internal, "count ephemeral services")
+	}
+	return int64(len(ids)), nil
+}
+
+// EphemeralServiceExists checks if an ephemeral service exists for the given peer and domain.
+// Use LockingStrengthUpdate inside a transaction to serialize concurrent create operations.
+func (s *SqlStore) EphemeralServiceExists(ctx context.Context, lockStrength LockingStrength, accountID, peerID, domain string) (bool, error) {
+	if lockStrength == LockingStrengthNone {
+		var count int64
+		result := s.db.Model(&rpservice.Service{}).
+			Where("account_id = ? AND source_peer = ? AND domain = ? AND source = ?", accountID, peerID, domain, rpservice.SourceEphemeral).
+			Count(&count)
+		if result.Error != nil {
+			log.WithContext(ctx).Errorf("failed to check ephemeral service existence: %v", result.Error)
+			return false, status.Errorf(status.Internal, "check ephemeral service existence")
+		}
+		return count > 0, nil
+	}
+
+	var id string
+	result := s.db.Model(&rpservice.Service{}).
+		Clauses(clause.Locking{Strength: string(lockStrength)}).
+		Select("id").
+		Where("account_id = ? AND source_peer = ? AND domain = ? AND source = ?", accountID, peerID, domain, rpservice.SourceEphemeral).
+		Limit(1).
+		Pluck("id", &id)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to check ephemeral service existence: %v", result.Error)
+		return false, status.Errorf(status.Internal, "check ephemeral service existence")
+	}
+	return id != "", nil
+}
+
+// GetServicesByClusterAndPort returns services matching the given proxy cluster, mode, and listen port.
+func (s *SqlStore) GetServicesByClusterAndPort(ctx context.Context, lockStrength LockingStrength, proxyCluster string, mode string, listenPort uint16) ([]*rpservice.Service, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var services []*rpservice.Service
+	result := tx.Where("proxy_cluster = ? AND mode = ? AND listen_port = ?", proxyCluster, mode, listenPort).Find(&services)
+	if result.Error != nil {
+		return nil, status.Errorf(status.Internal, "query services by cluster and port")
+	}
+
+	return services, nil
+}
+
+// GetServicesByCluster returns all services for the given proxy cluster.
+func (s *SqlStore) GetServicesByCluster(ctx context.Context, lockStrength LockingStrength, proxyCluster string) ([]*rpservice.Service, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var services []*rpservice.Service
+	result := tx.Where("proxy_cluster = ?", proxyCluster).Find(&services)
+	if result.Error != nil {
+		return nil, status.Errorf(status.Internal, "query services by cluster")
+	}
+	return services, nil
+}
diff --git a/management/server/store/sql_store_service_target.go b/management/server/store/sql_store_service_target.go
new file mode 100644
index 000000000..0f7429880
--- /dev/null
+++ b/management/server/store/sql_store_service_target.go
@@ -0,0 +1,170 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const targetSelectColumns = `id, account_id, service_id, path, host, port, protocol,
+	target_id, target_type, enabled, access_action, proxy_protocol,
+	skip_tls_verify, request_timeout, session_idle_timeout, path_rewrite, custom_headers,
+	direct_upstream, middlewares, capture_max_request_bytes, capture_max_response_bytes,
+	capture_content_types, agent_network, disable_access_log`
+
+func (s *SqlStore) getServiceTargets(ctx context.Context, serviceIDs []string) ([]*rpservice.Target, error) {
+	const targetsQuery = `SELECT ` + targetSelectColumns + ` FROM targets WHERE service_id = ANY($1)`
+
+	rows, err := s.pgxPool().Query(ctx, targetsQuery, serviceIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	return pgx.CollectRows(rows, scanTarget)
+}
+
+func scanTarget(row pgx.CollectableRow) (*rpservice.Target, error) {
+	var t rpservice.Target
+	var path sql.NullString
+	var accessAction sql.NullString
+	var pathRewrite sql.NullString
+	var proxyProtocol, skipTLSVerify, directUpstream, agentNetwork, disableAccessLog sql.NullBool
+	var requestTimeout, sessionIdleTimeout, captureMaxRequestBytes, captureMaxResponseBytes sql.NullInt64
+	var customHeaders, middlewares, captureContentTypes []byte
+	err := row.Scan(
+		&t.ID,
+		&t.AccountID,
+		&t.ServiceID,
+		&path,
+		&t.Host,
+		&t.Port,
+		&t.Protocol,
+		&t.TargetId,
+		&t.TargetType,
+		&t.Enabled,
+		&accessAction,
+		&proxyProtocol,
+		&skipTLSVerify,
+		&requestTimeout,
+		&sessionIdleTimeout,
+		&pathRewrite,
+		&customHeaders,
+		&directUpstream,
+		&middlewares,
+		&captureMaxRequestBytes,
+		&captureMaxResponseBytes,
+		&captureContentTypes,
+		&agentNetwork,
+		&disableAccessLog,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if path.Valid {
+		t.Path = &path.String
+	}
+	if accessAction.Valid && accessAction.String != "" {
+		t.AccessAction = rpservice.TargetAccessAction(accessAction.String)
+	} else {
+		t.AccessAction = rpservice.TargetAccessActionInherit
+	}
+
+	t.ProxyProtocol = proxyProtocol.Bool
+	t.Options.SkipTLSVerify = skipTLSVerify.Bool
+	t.Options.RequestTimeout = time.Duration(requestTimeout.Int64)
+	t.Options.SessionIdleTimeout = time.Duration(sessionIdleTimeout.Int64)
+	t.Options.PathRewrite = rpservice.PathRewriteMode(pathRewrite.String)
+	t.Options.DirectUpstream = directUpstream.Bool
+	t.Options.CaptureMaxRequestBytes = captureMaxRequestBytes.Int64
+	t.Options.CaptureMaxResponseBytes = captureMaxResponseBytes.Int64
+	t.Options.AgentNetwork = agentNetwork.Bool
+	t.Options.DisableAccessLog = disableAccessLog.Bool
+
+	if len(customHeaders) > 0 {
+		if err := json.Unmarshal(customHeaders, &t.Options.CustomHeaders); err != nil {
+			return nil, fmt.Errorf("unmarshal custom_headers: %w", err)
+		}
+	}
+	if len(middlewares) > 0 {
+		if err := json.Unmarshal(middlewares, &t.Options.Middlewares); err != nil {
+			return nil, fmt.Errorf("unmarshal middlewares: %w", err)
+		}
+	}
+	if len(captureContentTypes) > 0 {
+		if err := json.Unmarshal(captureContentTypes, &t.Options.CaptureContentTypes); err != nil {
+			return nil, fmt.Errorf("unmarshal capture_content_types: %w", err)
+		}
+	}
+	return &t, nil
+}
+
+func (s *SqlStore) DeleteTarget(ctx context.Context, accountID string, serviceID string, targetID uint) error {
+	result := s.db.Delete(&rpservice.Target{}, "account_id = ? AND service_id = ? AND id = ?", accountID, serviceID, targetID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete target from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete target from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.Errorf(status.NotFound, "target not found for service %s", serviceID)
+	}
+
+	return nil
+}
+
+func (s *SqlStore) DeleteServiceTargets(ctx context.Context, accountID string, serviceID string) error {
+	result := s.db.Delete(&rpservice.Target{}, "account_id = ? AND service_id = ?", accountID, serviceID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete targets from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete targets from store")
+	}
+
+	return nil
+}
+
+// GetTargetsByServiceID retrieves all targets for a given service
+func (s *SqlStore) GetTargetsByServiceID(ctx context.Context, lockStrength LockingStrength, accountID string, serviceID string) ([]*rpservice.Target, error) {
+	var targets []*rpservice.Target
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+	result := tx.Where("account_id = ? AND service_id = ?", accountID, serviceID).Find(&targets)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get targets from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get targets from store")
+	}
+
+	return targets, nil
+}
+
+func (s *SqlStore) GetServiceTargetByTargetID(ctx context.Context, lockStrength LockingStrength, accountID string, targetID string) (*rpservice.Target, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var target *rpservice.Target
+	result := tx.Take(&target, "account_id = ? AND target_id = ?", accountID, targetID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "service target with ID %s not found", targetID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get service target from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get service target from store")
+	}
+
+	return target, nil
+}
diff --git a/management/server/store/sql_store_service_test.go b/management/server/store/sql_store_service_test.go
index 34999da4b..f71b8c97a 100644
--- a/management/server/store/sql_store_service_test.go
+++ b/management/server/store/sql_store_service_test.go
@@ -5,6 +5,7 @@ import (
 	"os"
 	"runtime"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -44,3 +45,93 @@ func TestSqlStore_GetAccount_PrivateServiceRoundtrip(t *testing.T) {
 		assert.Equal(t, []string{"grp-admins", "grp-ops"}, got.AccessGroups)
 	})
 }
+
+// TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip guards the Postgres pgx
+// read path (getServices) against silently dropping columns present on the gorm
+// model. Before the fix these fields loaded correctly on SQLite but came back
+// zero-valued on Postgres because the hand-written SELECT and scan omitted them.
+func TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		account := newAccountWithId(ctx, "account_svc_opts", "testuser", "")
+		require.NoError(t, store.SaveAccount(ctx, account))
+
+		renewedAt := time.Now().UTC().Truncate(time.Second)
+		targetPath := "/api"
+		svc := &rpservice.Service{
+			ID:        "svc-opts",
+			AccountID: account.Id,
+			Name:      "opts-svc",
+			Domain:    "opts.example",
+			Enabled:   true,
+			Mode:      rpservice.ModeHTTP,
+			Restrictions: rpservice.AccessRestrictions{
+				AllowedCIDRs:     []string{"10.0.0.0/8"},
+				BlockedCountries: []string{"XX"},
+				CrowdSecMode:     "block",
+			},
+			Meta: rpservice.Meta{
+				LastRenewedAt: &renewedAt,
+			},
+			Targets: []*rpservice.Target{
+				{
+					AccountID:     account.Id,
+					ServiceID:     "svc-opts",
+					Path:          &targetPath,
+					Host:          "backend.internal",
+					Port:          8080,
+					Protocol:      "http",
+					TargetId:      "tgt-1",
+					Enabled:       true,
+					AccessAction:  rpservice.TargetAccessActionBlock,
+					ProxyProtocol: true,
+					Options: rpservice.TargetOptions{
+						SkipTLSVerify:           true,
+						RequestTimeout:          30 * time.Second,
+						SessionIdleTimeout:      5 * time.Minute,
+						PathRewrite:             rpservice.PathRewritePreserve,
+						CustomHeaders:           map[string]string{"X-Foo": "bar"},
+						DirectUpstream:          true,
+						CaptureMaxRequestBytes:  1024,
+						CaptureMaxResponseBytes: 2048,
+						CaptureContentTypes:     []string{"application/json"},
+						AgentNetwork:            true,
+						DisableAccessLog:        true,
+					},
+				},
+			},
+		}
+		require.NoError(t, store.CreateService(ctx, svc))
+
+		loaded, err := store.GetAccount(ctx, account.Id)
+		require.NoError(t, err)
+		require.Len(t, loaded.Services, 1)
+
+		got := loaded.Services[0]
+		assert.Equal(t, []string{"10.0.0.0/8"}, got.Restrictions.AllowedCIDRs, "restrictions allowed CIDRs")
+		assert.Equal(t, []string{"XX"}, got.Restrictions.BlockedCountries, "restrictions blocked countries")
+		assert.Equal(t, "block", got.Restrictions.CrowdSecMode, "restrictions crowdsec mode")
+		require.NotNil(t, got.Meta.LastRenewedAt, "meta last renewed at")
+		assert.WithinDuration(t, renewedAt, *got.Meta.LastRenewedAt, time.Second, "meta last renewed at")
+
+		require.Len(t, got.Targets, 1)
+		tg := got.Targets[0]
+		assert.Equal(t, rpservice.TargetAccessActionBlock, tg.AccessAction, "target access action")
+		assert.True(t, tg.ProxyProtocol, "target proxy protocol")
+		assert.True(t, tg.Options.SkipTLSVerify, "options skip TLS verify")
+		assert.Equal(t, 30*time.Second, tg.Options.RequestTimeout, "options request timeout")
+		assert.Equal(t, 5*time.Minute, tg.Options.SessionIdleTimeout, "options session idle timeout")
+		assert.Equal(t, rpservice.PathRewritePreserve, tg.Options.PathRewrite, "options path rewrite")
+		assert.Equal(t, map[string]string{"X-Foo": "bar"}, tg.Options.CustomHeaders, "options custom headers")
+		assert.True(t, tg.Options.DirectUpstream, "options direct upstream")
+		assert.Equal(t, int64(1024), tg.Options.CaptureMaxRequestBytes, "options capture max request bytes")
+		assert.Equal(t, int64(2048), tg.Options.CaptureMaxResponseBytes, "options capture max response bytes")
+		assert.Equal(t, []string{"application/json"}, tg.Options.CaptureContentTypes, "options capture content types")
+		assert.True(t, tg.Options.AgentNetwork, "options agent network")
+		assert.True(t, tg.Options.DisableAccessLog, "options disable access log")
+	})
+}
diff --git a/management/server/store/sql_store_setup_key.go b/management/server/store/sql_store_setup_key.go
new file mode 100644
index 000000000..ac42ef725
--- /dev/null
+++ b/management/server/store/sql_store_setup_key.go
@@ -0,0 +1,219 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) GetAccountBySetupKey(ctx context.Context, setupKey string) (*types.Account, error) {
+	var key types.SetupKey
+	result := s.db.Select("account_id").Take(&key, GetKeyQueryCondition(s), setupKey)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewSetupKeyNotFoundError(setupKey)
+		}
+		log.WithContext(ctx).Errorf("failed to get account by setup key from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get account by setup key from store")
+	}
+
+	if key.AccountID == "" {
+		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
+	}
+
+	return s.GetAccount(ctx, key.AccountID)
+}
+
+func (s *SqlStore) getSetupKeys(ctx context.Context, accountID string) ([]types.SetupKey, error) {
+	const query = `SELECT id, account_id, key, key_secret, name, type, created_at, expires_at, updated_at, 
+	revoked, used_times, last_used, auto_groups, usage_limit, ephemeral, allow_extra_dns_labels FROM setup_keys WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+
+	keys, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (types.SetupKey, error) {
+		var sk types.SetupKey
+		var autoGroups []byte
+		var skCreatedAt, expiresAt, updatedAt, lastUsed sql.NullTime
+		var revoked, ephemeral, allowExtraDNSLabels sql.NullBool
+		var usedTimes, usageLimit sql.NullInt64
+
+		err := row.Scan(&sk.Id, &sk.AccountID, &sk.Key, &sk.KeySecret, &sk.Name, &sk.Type, &skCreatedAt,
+			&expiresAt, &updatedAt, &revoked, &usedTimes, &lastUsed, &autoGroups, &usageLimit, &ephemeral, &allowExtraDNSLabels)
+
+		if err == nil {
+			if expiresAt.Valid {
+				sk.ExpiresAt = &expiresAt.Time
+			}
+			if skCreatedAt.Valid {
+				sk.CreatedAt = skCreatedAt.Time
+			}
+			if updatedAt.Valid {
+				sk.UpdatedAt = updatedAt.Time
+				if sk.UpdatedAt.IsZero() {
+					sk.UpdatedAt = sk.CreatedAt
+				}
+			}
+			if lastUsed.Valid {
+				sk.LastUsed = &lastUsed.Time
+			}
+			if revoked.Valid {
+				sk.Revoked = revoked.Bool
+			}
+			if usedTimes.Valid {
+				sk.UsedTimes = int(usedTimes.Int64)
+			}
+			if usageLimit.Valid {
+				sk.UsageLimit = int(usageLimit.Int64)
+			}
+			if ephemeral.Valid {
+				sk.Ephemeral = ephemeral.Bool
+			}
+			if allowExtraDNSLabels.Valid {
+				sk.AllowExtraDNSLabels = allowExtraDNSLabels.Bool
+			}
+			if autoGroups != nil {
+				_ = json.Unmarshal(autoGroups, &sk.AutoGroups)
+			} else {
+				sk.AutoGroups = []string{}
+			}
+		}
+		return sk, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	return keys, nil
+}
+
+func (s *SqlStore) GetAccountIDBySetupKey(ctx context.Context, setupKey string) (string, error) {
+	var accountID string
+	result := s.db.Model(&types.SetupKey{}).Select("account_id").Where(GetKeyQueryCondition(s), setupKey).Take(&accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return "", status.NewSetupKeyNotFoundError(setupKey)
+		}
+		log.WithContext(ctx).Errorf("failed to get account ID by setup key from store: %v", result.Error)
+		return "", status.Errorf(status.Internal, "failed to get account ID by setup key from store")
+	}
+
+	if accountID == "" {
+		return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
+	}
+
+	return accountID, nil
+}
+
+func (s *SqlStore) GetSetupKeyBySecret(ctx context.Context, lockStrength LockingStrength, key string) (*types.SetupKey, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var setupKey types.SetupKey
+	result := tx.
+		Take(&setupKey, GetKeyQueryCondition(s), key)
+
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
+		}
+		log.WithContext(ctx).Errorf("failed to get setup key by secret from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get setup key by secret from store")
+	}
+	return &setupKey, nil
+}
+
+func (s *SqlStore) IncrementSetupKeyUsage(ctx context.Context, setupKeyID string) error {
+	result := s.db.Model(&types.SetupKey{}).
+		Where(idQueryCondition, setupKeyID).
+		Updates(map[string]interface{}{
+			"used_times": gorm.Expr("used_times + 1"),
+			"last_used":  time.Now(),
+		})
+
+	if result.Error != nil {
+		return status.Errorf(status.Internal, "issue incrementing setup key usage count: %s", result.Error)
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewSetupKeyNotFoundError(setupKeyID)
+	}
+
+	return nil
+}
+
+// GetAccountSetupKeys retrieves setup keys for an account.
+func (s *SqlStore) GetAccountSetupKeys(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.SetupKey, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var setupKeys []*types.SetupKey
+	result := tx.
+		Find(&setupKeys, accountIDCondition, accountID)
+	if err := result.Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get setup keys from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get setup keys from store")
+	}
+
+	return setupKeys, nil
+}
+
+// GetSetupKeyByID retrieves a setup key by its ID and account ID.
+func (s *SqlStore) GetSetupKeyByID(ctx context.Context, lockStrength LockingStrength, accountID, setupKeyID string) (*types.SetupKey, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var setupKey *types.SetupKey
+	result := tx.Take(&setupKey, accountAndIDQueryCondition, accountID, setupKeyID)
+	if err := result.Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, status.NewSetupKeyNotFoundError(setupKeyID)
+		}
+		log.WithContext(ctx).Errorf("failed to get setup key from the store: %s", err)
+		return nil, status.Errorf(status.Internal, "failed to get setup key from store")
+	}
+
+	return setupKey, nil
+}
+
+// SaveSetupKey saves a setup key to the database.
+func (s *SqlStore) SaveSetupKey(ctx context.Context, setupKey *types.SetupKey) error {
+	result := s.db.Save(setupKey)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save setup key to store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to save setup key to store")
+	}
+
+	return nil
+}
+
+// DeleteSetupKey deletes a setup key from the database.
+func (s *SqlStore) DeleteSetupKey(ctx context.Context, accountID, keyID string) error {
+	result := s.db.Delete(&types.SetupKey{}, accountAndIDQueryCondition, accountID, keyID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete setup key from store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to delete setup key from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewSetupKeyNotFoundError(keyID)
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_setup_key_test.go b/management/server/store/sql_store_setup_key_test.go
new file mode 100644
index 000000000..8835ea1f9
--- /dev/null
+++ b/management/server/store/sql_store_setup_key_test.go
@@ -0,0 +1,103 @@
+package store
+
+import (
+	"context"
+	"crypto/sha256"
+	b64 "encoding/base64"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+func TestSqlite_GetSetupKeyBySecret(t *testing.T) {
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	plainKey := "A2C8E62B-38F5-4553-B31E-DD66C696CEBB"
+	hashedKey := sha256.Sum256([]byte(plainKey))
+	encodedHashedKey := b64.StdEncoding.EncodeToString(hashedKey[:])
+
+	_, err = store.GetAccount(context.Background(), existingAccountID)
+	require.NoError(t, err)
+
+	setupKey, err := store.GetSetupKeyBySecret(context.Background(), LockingStrengthNone, encodedHashedKey)
+	require.NoError(t, err)
+	assert.Equal(t, encodedHashedKey, setupKey.Key)
+	assert.Equal(t, types.HiddenKey(plainKey, 4), setupKey.KeySecret)
+	assert.Equal(t, "bf1c8084-ba50-4ce7-9439-34653001fc3b", setupKey.AccountID)
+	assert.Equal(t, "Default key", setupKey.Name)
+}
+
+func TestSqlite_incrementSetupKeyUsage(t *testing.T) {
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	plainKey := "A2C8E62B-38F5-4553-B31E-DD66C696CEBB"
+	hashedKey := sha256.Sum256([]byte(plainKey))
+	encodedHashedKey := b64.StdEncoding.EncodeToString(hashedKey[:])
+
+	_, err = store.GetAccount(context.Background(), existingAccountID)
+	require.NoError(t, err)
+
+	setupKey, err := store.GetSetupKeyBySecret(context.Background(), LockingStrengthNone, encodedHashedKey)
+	require.NoError(t, err)
+	assert.Equal(t, 0, setupKey.UsedTimes)
+
+	err = store.IncrementSetupKeyUsage(context.Background(), setupKey.Id)
+	require.NoError(t, err)
+
+	setupKey, err = store.GetSetupKeyBySecret(context.Background(), LockingStrengthNone, encodedHashedKey)
+	require.NoError(t, err)
+	assert.Equal(t, 1, setupKey.UsedTimes)
+
+	err = store.IncrementSetupKeyUsage(context.Background(), setupKey.Id)
+	require.NoError(t, err)
+
+	setupKey, err = store.GetSetupKeyBySecret(context.Background(), LockingStrengthNone, encodedHashedKey)
+	require.NoError(t, err)
+	assert.Equal(t, 2, setupKey.UsedTimes)
+}
+
+func Test_DeleteSetupKeySuccessfully(t *testing.T) {
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	setupKeyID := "A2C8E62B-38F5-4553-B31E-DD66C696CEBB"
+
+	err = store.DeleteSetupKey(context.Background(), accountID, setupKeyID)
+	require.NoError(t, err)
+
+	_, err = store.GetSetupKeyByID(context.Background(), LockingStrengthNone, setupKeyID, accountID)
+	require.Error(t, err)
+}
+
+func Test_DeleteSetupKeyFailsForNonExistingKey(t *testing.T) {
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	nonExistingKeyID := "non-existing-key-id"
+
+	err = store.DeleteSetupKey(context.Background(), accountID, nonExistingKeyID)
+	require.Error(t, err)
+}
diff --git a/management/server/store/sql_store_test.go b/management/server/store/sql_store_test.go
index 92784af83..24f9a410d 100644
--- a/management/server/store/sql_store_test.go
+++ b/management/server/store/sql_store_test.go
@@ -2,15 +2,11 @@ package store
 
 import (
 	"context"
-	"crypto/sha256"
-	b64 "encoding/base64"
-	"encoding/binary"
 	"fmt"
 	"net"
 	"net/netip"
 	"os"
 	"runtime"
-	"sort"
 	"sync"
 	"testing"
 	"time"
@@ -19,22 +15,13 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	proxydomain "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
-	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
-	"github.com/netbirdio/netbird/management/internals/modules/zones"
-	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/management/server/util"
 	nbroute "github.com/netbirdio/netbird/route"
-	"github.com/netbirdio/netbird/shared/management/status"
-	"github.com/netbirdio/netbird/util/crypt"
 )
 
 func runTestForAllEngines(t *testing.T, testDataFile string, f func(t *testing.T, store Store)) {
@@ -45,6 +32,7 @@ func runTestForAllEngines(t *testing.T, testDataFile string, f func(t *testing.T
 		}
 		t.Setenv("NETBIRD_STORE_ENGINE", string(engine))
 		store, cleanUp, err := NewTestStoreFromSQL(context.Background(), testDataFile, t.TempDir())
+		assert.NoError(t, err, "engine: ", string(engine))
 		t.Cleanup(cleanUp)
 		assert.NoError(t, err)
 		t.Run(string(engine), func(t *testing.T) {
@@ -54,6 +42,22 @@ func runTestForAllEngines(t *testing.T, testDataFile string, f func(t *testing.T
 	}
 }
 
+func runTestForAllEnginesNoSqliteSeed(t *testing.T, testDataFile string, f func(t *testing.T, engine string, store Store)) {
+	t.Helper()
+	for _, engine := range supportedEngines {
+		if os.Getenv("NETBIRD_STORE_ENGINE") != "" && os.Getenv("NETBIRD_STORE_ENGINE") != string(engine) {
+			continue
+		}
+		t.Setenv("NETBIRD_STORE_ENGINE", string(engine))
+		store, cleanUp, err := NewTestStore(context.Background(), testDataFile, t.TempDir())
+		assert.NoError(t, err, "engine: ", string(engine))
+		t.Cleanup(cleanUp)
+		assert.NoError(t, err)
+		f(t, string(engine), store)
+		os.Unsetenv("NETBIRD_STORE_ENGINE")
+	}
+}
+
 func Test_NewStore(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("The SQLite store is not properly supported by Windows yet")
@@ -69,596 +73,6 @@ func Test_NewStore(t *testing.T) {
 	})
 }
 
-func Test_SaveAccount_Large(t *testing.T) {
-	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
-		runLargeTest(t, store)
-	})
-}
-
-func runLargeTest(t *testing.T, store Store) {
-	t.Helper()
-
-	account := newAccountWithId(context.Background(), "account_id", "testuser", "")
-	groupALL, err := account.GetGroupAll()
-	if err != nil {
-		t.Fatal(err)
-	}
-	setupKey, _ := types.GenerateDefaultSetupKey()
-	account.SetupKeys[setupKey.Key] = setupKey
-	const numPerAccount = 6000
-	for n := 0; n < numPerAccount; n++ {
-		netIP := sequentialIPv4(n)
-		peerID := fmt.Sprintf("%s-peer-%d", account.Id, n)
-		addr, _ := netip.AddrFromSlice(netIP)
-
-		peer := &nbpeer.Peer{
-			ID:         peerID,
-			Key:        peerID,
-			IP:         addr.Unmap(),
-			Name:       peerID,
-			DNSLabel:   peerID,
-			UserID:     "testuser",
-			Status:     &nbpeer.PeerStatus{Connected: false, LastSeen: time.Now()},
-			SSHEnabled: false,
-		}
-		account.Peers[peerID] = peer
-		group, _ := account.GetGroupAll()
-		group.Peers = append(group.Peers, peerID)
-		user := &types.User{
-			Id:        fmt.Sprintf("%s-user-%d", account.Id, n),
-			AccountID: account.Id,
-		}
-		account.Users[user.Id] = user
-		route := &nbroute.Route{
-			ID:          nbroute.ID(fmt.Sprintf("network-id-%d", n)),
-			Description: "base route",
-			NetID:       nbroute.NetID(fmt.Sprintf("network-id-%d", n)),
-			Network:     netip.MustParsePrefix(netIP.String() + "/24"),
-			NetworkType: nbroute.IPv4Network,
-			Metric:      9999,
-			Masquerade:  false,
-			Enabled:     true,
-			Groups:      []string{groupALL.ID},
-		}
-		account.Routes[route.ID] = route
-
-		group = &types.Group{
-			ID:        fmt.Sprintf("group-id-%d", n),
-			AccountID: account.Id,
-			Name:      fmt.Sprintf("group-id-%d", n),
-			Issued:    "api",
-			Peers:     nil,
-		}
-		account.Groups[group.ID] = group
-
-		nameserver := &nbdns.NameServerGroup{
-			ID:                   fmt.Sprintf("nameserver-id-%d", n),
-			AccountID:            account.Id,
-			Name:                 fmt.Sprintf("nameserver-id-%d", n),
-			Description:          "",
-			NameServers:          []nbdns.NameServer{{IP: netip.MustParseAddr(netIP.String()), NSType: nbdns.UDPNameServerType}},
-			Groups:               []string{group.ID},
-			Primary:              false,
-			Domains:              nil,
-			Enabled:              false,
-			SearchDomainsEnabled: false,
-		}
-		account.NameServerGroups[nameserver.ID] = nameserver
-
-		setupKey, _ := types.GenerateDefaultSetupKey()
-		_, exists := account.SetupKeys[setupKey.Key]
-		if exists {
-			t.Errorf("setup key already exists")
-		}
-		account.SetupKeys[setupKey.Key] = setupKey
-	}
-
-	err = store.SaveAccount(context.Background(), account)
-	require.NoError(t, err)
-
-	if len(store.GetAllAccounts(context.Background())) != 1 {
-		t.Errorf("expecting 1 Accounts to be stored after SaveAccount()")
-	}
-
-	a, err := store.GetAccount(context.Background(), account.Id)
-	if a == nil {
-		t.Errorf("expecting Account to be stored after SaveAccount(): %v", err)
-	}
-
-	if a != nil && len(a.Policies) != 1 {
-		t.Errorf("expecting Account to have one policy stored after SaveAccount(), got %d", len(a.Policies))
-	}
-
-	if a != nil && len(a.Policies[0].Rules) != 1 {
-		t.Errorf("expecting Account to have one policy rule stored after SaveAccount(), got %d", len(a.Policies[0].Rules))
-		return
-	}
-
-	if a != nil && len(a.Peers) != numPerAccount {
-		t.Errorf("expecting Account to have %d peers stored after SaveAccount(), got %d",
-			numPerAccount, len(a.Peers))
-		return
-	}
-
-	if a != nil && len(a.Users) != numPerAccount+1 {
-		t.Errorf("expecting Account to have %d users stored after SaveAccount(), got %d",
-			numPerAccount+1, len(a.Users))
-		return
-	}
-
-	if a != nil && len(a.Routes) != numPerAccount {
-		t.Errorf("expecting Account to have %d routes stored after SaveAccount(), got %d",
-			numPerAccount, len(a.Routes))
-		return
-	}
-
-	if a != nil && len(a.NameServerGroups) != numPerAccount {
-		t.Errorf("expecting Account to have %d NameServerGroups stored after SaveAccount(), got %d",
-			numPerAccount, len(a.NameServerGroups))
-		return
-	}
-
-	if a != nil && len(a.NameServerGroups) != numPerAccount {
-		t.Errorf("expecting Account to have %d NameServerGroups stored after SaveAccount(), got %d",
-			numPerAccount, len(a.NameServerGroups))
-		return
-	}
-
-	if a != nil && len(a.SetupKeys) != numPerAccount+1 {
-		t.Errorf("expecting Account to have %d SetupKeys stored after SaveAccount(), got %d",
-			numPerAccount+1, len(a.SetupKeys))
-		return
-	}
-}
-
-// sequentialIPv4 returns a unique IPv4 address for the given index, avoiding
-// the random collisions that would otherwise violate the unique (account_id, ip)
-// index when generating a large number of peers.
-func sequentialIPv4(n int) net.IP {
-	b := make([]byte, 4)
-	binary.BigEndian.PutUint32(b, 0x0A000000+uint32(n))
-	return net.IP(b)
-}
-
-func Test_SaveAccount(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("The SQLite store is not properly supported by Windows yet")
-	}
-
-	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
-		account := newAccountWithId(context.Background(), "account_id", "testuser", "")
-		setupKey, _ := types.GenerateDefaultSetupKey()
-		account.SetupKeys[setupKey.Key] = setupKey
-		account.Peers["testpeer"] = &nbpeer.Peer{
-			Key:    "peerkey",
-			IP:     netip.AddrFrom4([4]byte{127, 0, 0, 1}),
-			IPv6:   netip.MustParseAddr("fd00::1"),
-			Meta:   nbpeer.PeerSystemMeta{},
-			Name:   "peer name",
-			Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
-		}
-
-		err := store.SaveAccount(context.Background(), account)
-		require.NoError(t, err)
-
-		account2 := newAccountWithId(context.Background(), "account_id2", "testuser2", "")
-		setupKey, _ = types.GenerateDefaultSetupKey()
-		account2.SetupKeys[setupKey.Key] = setupKey
-		account2.Peers["testpeer2"] = &nbpeer.Peer{
-			Key:    "peerkey2",
-			IP:     netip.AddrFrom4([4]byte{127, 0, 0, 2}),
-			IPv6:   netip.MustParseAddr("fd00::2"),
-			Meta:   nbpeer.PeerSystemMeta{},
-			Name:   "peer name 2",
-			Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
-		}
-
-		err = store.SaveAccount(context.Background(), account2)
-		require.NoError(t, err)
-
-		if len(store.GetAllAccounts(context.Background())) != 2 {
-			t.Errorf("expecting 2 Accounts to be stored after SaveAccount()")
-		}
-
-		a, err := store.GetAccount(context.Background(), account.Id)
-		if a == nil {
-			t.Errorf("expecting Account to be stored after SaveAccount(): %v", err)
-		}
-
-		if a != nil && len(a.Policies) != 1 {
-			t.Errorf("expecting Account to have one policy stored after SaveAccount(), got %d", len(a.Policies))
-		}
-
-		if a != nil && len(a.Policies[0].Rules) != 1 {
-			t.Errorf("expecting Account to have one policy rule stored after SaveAccount(), got %d", len(a.Policies[0].Rules))
-			return
-		}
-
-		if a, err := store.GetAccountByPeerPubKey(context.Background(), "peerkey"); a == nil {
-			t.Errorf("expecting PeerKeyID2AccountID index updated after SaveAccount(): %v", err)
-		}
-
-		if a, err := store.GetAccountByUser(context.Background(), "testuser"); a == nil {
-			t.Errorf("expecting UserID2AccountID index updated after SaveAccount(): %v", err)
-		}
-
-		if a, err := store.GetAccountByPeerID(context.Background(), "testpeer"); a == nil {
-			t.Errorf("expecting PeerID2AccountID index updated after SaveAccount(): %v", err)
-		}
-
-		if a, err := store.GetAccountBySetupKey(context.Background(), setupKey.Key); a == nil {
-			t.Errorf("expecting SetupKeyID2AccountID index updated after SaveAccount(): %v", err)
-		}
-	})
-}
-
-func TestSqlite_DeleteAccount(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("The SQLite store is not properly supported by Windows yet")
-	}
-
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
-	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	t.Cleanup(cleanUp)
-	assert.NoError(t, err)
-
-	testUserID := "testuser"
-	user := types.NewAdminUser(testUserID)
-	user.PATs = map[string]*types.PersonalAccessToken{"testtoken": {
-		ID:   "testtoken",
-		Name: "test token",
-	}}
-
-	account := newAccountWithId(context.Background(), "account_id", testUserID, "")
-	setupKey, _ := types.GenerateDefaultSetupKey()
-	account.SetupKeys[setupKey.Key] = setupKey
-	account.Peers["testpeer"] = &nbpeer.Peer{
-		Key:    "peerkey",
-		IP:     netip.AddrFrom4([4]byte{127, 0, 0, 1}),
-		IPv6:   netip.MustParseAddr("fd00::1"),
-		Meta:   nbpeer.PeerSystemMeta{},
-		Name:   "peer name",
-		Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
-	}
-	account.Users[testUserID] = user
-	account.Networks = []*networkTypes.Network{
-		{
-			ID:          "network_id",
-			AccountID:   account.Id,
-			Name:        "network name",
-			Description: "network description",
-		},
-	}
-	account.NetworkRouters = []*routerTypes.NetworkRouter{
-		{
-			ID:         "router_id",
-			NetworkID:  account.Networks[0].ID,
-			AccountID:  account.Id,
-			PeerGroups: []string{"group_id"},
-			Masquerade: true,
-			Metric:     1,
-		},
-	}
-	account.NetworkResources = []*resourceTypes.NetworkResource{
-		{
-			ID:          "resource_id",
-			NetworkID:   account.Networks[0].ID,
-			AccountID:   account.Id,
-			Name:        "Name",
-			Description: "Description",
-			Type:        "Domain",
-			Address:     "example.com",
-		},
-	}
-
-	account.Services = []*rpservice.Service{
-		{
-			ID:        "service_id",
-			AccountID: account.Id,
-			Name:      "test service",
-			Domain:    "svc.example.com",
-			Enabled:   true,
-			Targets: []*rpservice.Target{
-				{
-					AccountID: account.Id,
-					ServiceID: "service_id",
-					Host:      "localhost",
-					Port:      8080,
-					Protocol:  "http",
-					Enabled:   true,
-				},
-			},
-		},
-	}
-
-	account.Domains = []*proxydomain.Domain{
-		{
-			ID:        "domain_id",
-			Domain:    "custom.example.com",
-			AccountID: account.Id,
-			Validated: true,
-		},
-	}
-
-	err = store.SaveAccount(context.Background(), account)
-	require.NoError(t, err)
-
-	if len(store.GetAllAccounts(context.Background())) != 1 {
-		t.Errorf("expecting 1 Accounts to be stored after SaveAccount()")
-	}
-
-	o, err := store.GetAccountOnboarding(context.Background(), account.Id)
-	require.NoError(t, err)
-	require.Equal(t, o.AccountID, account.Id)
-
-	err = store.DeleteAccount(context.Background(), account)
-	require.NoError(t, err)
-
-	_, err = store.GetAccountOnboarding(context.Background(), account.Id)
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting onboarding")
-
-	if len(store.GetAllAccounts(context.Background())) != 0 {
-		t.Errorf("expecting 0 Accounts to be stored after DeleteAccount()")
-	}
-
-	_, err = store.GetAccountByPeerPubKey(context.Background(), "peerkey")
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by peer public key")
-
-	_, err = store.GetAccountByUser(context.Background(), "testuser")
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by user")
-
-	_, err = store.GetAccountByPeerID(context.Background(), "testpeer")
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by peer id")
-
-	_, err = store.GetAccountBySetupKey(context.Background(), setupKey.Key)
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by setup key")
-
-	_, err = store.GetAccount(context.Background(), account.Id)
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by id")
-
-	for _, policy := range account.Policies {
-		var rules []*types.PolicyRule
-		err = store.(*SqlStore).db.Model(&types.PolicyRule{}).Find(&rules, "policy_id = ?", policy.ID).Error
-		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for policy rules")
-		require.Len(t, rules, 0, "expecting no policy rules to be found after removing DeleteAccount")
-
-	}
-
-	for _, accountUser := range account.Users {
-		var pats []*types.PersonalAccessToken
-		err = store.(*SqlStore).db.Model(&types.PersonalAccessToken{}).Find(&pats, "user_id = ?", accountUser.Id).Error
-		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for personal access token")
-		require.Len(t, pats, 0, "expecting no personal access token to be found after removing DeleteAccount")
-
-	}
-
-	for _, network := range account.Networks {
-		routers, err := store.GetNetworkRoutersByNetID(context.Background(), LockingStrengthNone, account.Id, network.ID)
-		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for network routers")
-		require.Len(t, routers, 0, "expecting no network routers to be found after DeleteAccount")
-
-		resources, err := store.GetNetworkResourcesByNetID(context.Background(), LockingStrengthNone, account.Id, network.ID)
-		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for network resources")
-		require.Len(t, resources, 0, "expecting no network resources to be found after DeleteAccount")
-	}
-
-	domains, err := store.ListCustomDomains(context.Background(), account.Id)
-	require.NoError(t, err, "expecting no error after DeleteAccount when searching for custom domains")
-	require.Len(t, domains, 0, "expecting no custom domains to be found after DeleteAccount")
-
-	var services []*rpservice.Service
-	err = store.(*SqlStore).db.Model(&rpservice.Service{}).Find(&services, "account_id = ?", account.Id).Error
-	require.NoError(t, err, "expecting no error after DeleteAccount when searching for services")
-	require.Len(t, services, 0, "expecting no services to be found after DeleteAccount")
-
-	var targets []*rpservice.Target
-	err = store.(*SqlStore).db.Model(&rpservice.Target{}).Find(&targets, "account_id = ?", account.Id).Error
-	require.NoError(t, err, "expecting no error after DeleteAccount when searching for service targets")
-	require.Len(t, targets, 0, "expecting no service targets to be found after DeleteAccount")
-}
-
-func Test_GetAccount(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("The SQLite store is not properly supported by Windows yet")
-	}
-
-	runTestForAllEngines(t, "../testdata/store.sql", func(t *testing.T, store Store) {
-		id := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-		account, err := store.GetAccount(context.Background(), id)
-		require.NoError(t, err)
-		require.Equal(t, id, account.Id, "account id should match")
-		require.Equal(t, false, account.Onboarding.OnboardingFlowPending)
-
-		id = "9439-34653001fc3b-bf1c8084-ba50-4ce7"
-
-		account, err = store.GetAccount(context.Background(), id)
-		require.NoError(t, err)
-		require.Equal(t, id, account.Id, "account id should match")
-		require.Equal(t, true, account.Onboarding.OnboardingFlowPending)
-
-		_, err = store.GetAccount(context.Background(), "non-existing-account")
-		assert.Error(t, err)
-		parsedErr, ok := status.FromError(err)
-		require.True(t, ok)
-		require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
-
-	})
-}
-
-// TestSqlStore_GetPeerByIP_NotFound pins the not-found semantics the
-// proxy's ValidateTunnelPeer relies on: a tunnel-IP that isn't in the
-// account roster must surface as a NotFound error (not a generic
-// Internal) so callers can distinguish an expected miss from a real
-// store failure. A known IP still resolves.
-func TestSqlStore_GetPeerByIP_NotFound(t *testing.T) {
-	runTestForAllEngines(t, "../testdata/store.sql", func(t *testing.T, store Store) {
-		const accountID = "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-		peer, err := store.GetPeerByIP(context.Background(), LockingStrengthNone, accountID, net.ParseIP("192.168.0.0"))
-		require.NoError(t, err, "known tunnel IP must resolve")
-		require.NotNil(t, peer)
-
-		_, err = store.GetPeerByIP(context.Background(), LockingStrengthNone, accountID, net.ParseIP("100.65.0.99"))
-		require.Error(t, err, "unknown tunnel IP must error")
-		parsedErr, ok := status.FromError(err)
-		require.True(t, ok, "error must be a status error")
-		require.Equal(t, status.NotFound, parsedErr.Type(), "tunnel-IP miss must be NotFound, not Internal")
-	})
-}
-
-func TestSqlStore_SavePeer(t *testing.T) {
-	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanUp)
-	assert.NoError(t, err)
-
-	account, err := store.GetAccount(context.Background(), "bf1c8084-ba50-4ce7-9439-34653001fc3b")
-	require.NoError(t, err)
-
-	// save status of non-existing peer
-	peer := &nbpeer.Peer{
-		Key:       "peerkey",
-		ID:        "testpeer",
-		IP:        netip.AddrFrom4([4]byte{127, 0, 0, 1}),
-		IPv6:      netip.MustParseAddr("fd00::1"),
-		Meta:      nbpeer.PeerSystemMeta{Hostname: "testingpeer"},
-		Name:      "peer name",
-		Status:    &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
-		CreatedAt: time.Now().UTC(),
-	}
-	ctx := context.Background()
-	err = store.SavePeer(ctx, account.Id, peer)
-	assert.Error(t, err)
-	parsedErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
-
-	// save new status of existing peer
-	account.Peers[peer.ID] = peer
-
-	err = store.SaveAccount(context.Background(), account)
-	require.NoError(t, err)
-
-	updatedPeer := peer.Copy()
-	updatedPeer.Status.Connected = false
-	updatedPeer.Meta.Hostname = "updatedpeer"
-
-	err = store.SavePeer(ctx, account.Id, updatedPeer)
-	require.NoError(t, err)
-
-	account, err = store.GetAccount(context.Background(), account.Id)
-	require.NoError(t, err)
-
-	actual := account.Peers[peer.ID]
-	assert.Equal(t, updatedPeer.Meta, actual.Meta)
-	assert.Equal(t, updatedPeer.Status.Connected, actual.Status.Connected)
-	assert.Equal(t, updatedPeer.Status.LoginExpired, actual.Status.LoginExpired)
-	assert.Equal(t, updatedPeer.Status.RequiresApproval, actual.Status.RequiresApproval)
-	assert.WithinDurationf(t, updatedPeer.Status.LastSeen, actual.Status.LastSeen.UTC(), time.Millisecond, "LastSeen should be equal")
-}
-
-func TestSqlStore_SavePeerStatus(t *testing.T) {
-	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanUp)
-	assert.NoError(t, err)
-
-	account, err := store.GetAccount(context.Background(), "bf1c8084-ba50-4ce7-9439-34653001fc3b")
-	require.NoError(t, err)
-
-	// save status of non-existing peer
-	newStatus := nbpeer.PeerStatus{Connected: false, LastSeen: time.Now().UTC()}
-	err = store.SavePeerStatus(context.Background(), account.Id, "non-existing-peer", newStatus)
-	assert.Error(t, err)
-	parsedErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
-
-	// save new status of existing peer
-	account.Peers["testpeer"] = &nbpeer.Peer{
-		Key:    "peerkey",
-		ID:     "testpeer",
-		IP:     netip.AddrFrom4([4]byte{127, 0, 0, 1}),
-		IPv6:   netip.MustParseAddr("fd00::1"),
-		Meta:   nbpeer.PeerSystemMeta{},
-		Name:   "peer name",
-		Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
-	}
-
-	err = store.SaveAccount(context.Background(), account)
-	require.NoError(t, err)
-
-	err = store.SavePeerStatus(context.Background(), account.Id, "testpeer", newStatus)
-	require.NoError(t, err)
-
-	account, err = store.GetAccount(context.Background(), account.Id)
-	require.NoError(t, err)
-
-	actual := account.Peers["testpeer"].Status
-	assert.Equal(t, newStatus.Connected, actual.Connected)
-	assert.Equal(t, newStatus.LoginExpired, actual.LoginExpired)
-	assert.Equal(t, newStatus.RequiresApproval, actual.RequiresApproval)
-	assert.WithinDurationf(t, newStatus.LastSeen, actual.LastSeen.UTC(), time.Millisecond, "LastSeen should be equal")
-
-	newStatus.Connected = true
-
-	err = store.SavePeerStatus(context.Background(), account.Id, "testpeer", newStatus)
-	require.NoError(t, err)
-
-	account, err = store.GetAccount(context.Background(), account.Id)
-	require.NoError(t, err)
-
-	actual = account.Peers["testpeer"].Status
-	assert.Equal(t, newStatus.Connected, actual.Connected)
-	assert.Equal(t, newStatus.LoginExpired, actual.LoginExpired)
-	assert.Equal(t, newStatus.RequiresApproval, actual.RequiresApproval)
-	assert.WithinDurationf(t, newStatus.LastSeen, actual.LastSeen.UTC(), time.Millisecond, "LastSeen should be equal")
-}
-
-func Test_TestGetAccountByPrivateDomain(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("The SQLite store is not properly supported by Windows yet")
-	}
-
-	runTestForAllEngines(t, "../testdata/store.sql", func(t *testing.T, store Store) {
-		existingDomain := "test.com"
-
-		account, err := store.GetAccountByPrivateDomain(context.Background(), existingDomain)
-		require.NoError(t, err, "should found account")
-		require.Equal(t, existingDomain, account.Domain, "domains should match")
-
-		_, err = store.GetAccountByPrivateDomain(context.Background(), "missing-domain.com")
-		require.Error(t, err, "should return error on domain lookup")
-		parsedErr, ok := status.FromError(err)
-		require.True(t, ok)
-		require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
-	})
-}
-
-func Test_GetTokenIDByHashedToken(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("The SQLite store is not properly supported by Windows yet")
-	}
-
-	runTestForAllEngines(t, "../testdata/store.sql", func(t *testing.T, store Store) {
-		hashed := "SoMeHaShEdToKeN"
-		id := "9dj38s35-63fb-11ec-90d6-0242ac120003"
-
-		token, err := store.GetTokenIDByHashedToken(context.Background(), hashed)
-		require.NoError(t, err)
-		require.Equal(t, id, token)
-
-		_, err = store.GetTokenIDByHashedToken(context.Background(), "non-existing-hash")
-		require.Error(t, err)
-		parsedErr, ok := status.FromError(err)
-		require.True(t, ok)
-		require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
-	})
-}
-
 func TestMigrate(t *testing.T) {
 	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
 		t.Skip("skip CI tests on darwin and windows")
@@ -785,434 +199,6 @@ func TestPostgresql_NewStore(t *testing.T) {
 	}
 }
 
-func TestPostgresql_SaveAccount(t *testing.T) {
-	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.PostgresStoreEngine))
-	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	t.Cleanup(cleanUp)
-	assert.NoError(t, err)
-
-	account := newAccountWithId(context.Background(), "account_id", "testuser", "")
-	setupKey, _ := types.GenerateDefaultSetupKey()
-	account.SetupKeys[setupKey.Key] = setupKey
-	account.Peers["testpeer"] = &nbpeer.Peer{
-		Key:    "peerkey",
-		IP:     netip.AddrFrom4([4]byte{127, 0, 0, 1}),
-		IPv6:   netip.MustParseAddr("fd00::1"),
-		Meta:   nbpeer.PeerSystemMeta{},
-		Name:   "peer name",
-		Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
-	}
-
-	err = store.SaveAccount(context.Background(), account)
-	require.NoError(t, err)
-
-	account2 := newAccountWithId(context.Background(), "account_id2", "testuser2", "")
-	setupKey, _ = types.GenerateDefaultSetupKey()
-	account2.SetupKeys[setupKey.Key] = setupKey
-	account2.Peers["testpeer2"] = &nbpeer.Peer{
-		Key:    "peerkey2",
-		IP:     netip.AddrFrom4([4]byte{127, 0, 0, 2}),
-		IPv6:   netip.MustParseAddr("fd00::2"),
-		Meta:   nbpeer.PeerSystemMeta{},
-		Name:   "peer name 2",
-		Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
-	}
-
-	err = store.SaveAccount(context.Background(), account2)
-	require.NoError(t, err)
-
-	if len(store.GetAllAccounts(context.Background())) != 2 {
-		t.Errorf("expecting 2 Accounts to be stored after SaveAccount()")
-	}
-
-	a, err := store.GetAccount(context.Background(), account.Id)
-	if a == nil {
-		t.Errorf("expecting Account to be stored after SaveAccount(): %v", err)
-	}
-
-	if a != nil && len(a.Policies) != 1 {
-		t.Errorf("expecting Account to have one policy stored after SaveAccount(), got %d", len(a.Policies))
-	}
-
-	if a != nil && len(a.Policies[0].Rules) != 1 {
-		t.Errorf("expecting Account to have one policy rule stored after SaveAccount(), got %d", len(a.Policies[0].Rules))
-		return
-	}
-
-	if a, err := store.GetAccountByPeerPubKey(context.Background(), "peerkey"); a == nil {
-		t.Errorf("expecting PeerKeyID2AccountID index updated after SaveAccount(): %v", err)
-	}
-
-	if a, err := store.GetAccountByUser(context.Background(), "testuser"); a == nil {
-		t.Errorf("expecting UserID2AccountID index updated after SaveAccount(): %v", err)
-	}
-
-	if a, err := store.GetAccountByPeerID(context.Background(), "testpeer"); a == nil {
-		t.Errorf("expecting PeerID2AccountID index updated after SaveAccount(): %v", err)
-	}
-
-	if a, err := store.GetAccountBySetupKey(context.Background(), setupKey.Key); a == nil {
-		t.Errorf("expecting SetupKeyID2AccountID index updated after SaveAccount(): %v", err)
-	}
-}
-
-func TestPostgresql_DeleteAccount(t *testing.T) {
-	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.PostgresStoreEngine))
-	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	t.Cleanup(cleanUp)
-	assert.NoError(t, err)
-
-	testUserID := "testuser"
-	user := types.NewAdminUser(testUserID)
-	user.PATs = map[string]*types.PersonalAccessToken{"testtoken": {
-		ID:   "testtoken",
-		Name: "test token",
-	}}
-
-	account := newAccountWithId(context.Background(), "account_id", testUserID, "")
-	setupKey, _ := types.GenerateDefaultSetupKey()
-	account.SetupKeys[setupKey.Key] = setupKey
-	account.Peers["testpeer"] = &nbpeer.Peer{
-		Key:    "peerkey",
-		IP:     netip.AddrFrom4([4]byte{127, 0, 0, 1}),
-		IPv6:   netip.MustParseAddr("fd00::1"),
-		Meta:   nbpeer.PeerSystemMeta{},
-		Name:   "peer name",
-		Status: &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
-	}
-	account.Users[testUserID] = user
-
-	err = store.SaveAccount(context.Background(), account)
-	require.NoError(t, err)
-
-	if len(store.GetAllAccounts(context.Background())) != 1 {
-		t.Errorf("expecting 1 Accounts to be stored after SaveAccount()")
-	}
-
-	err = store.DeleteAccount(context.Background(), account)
-	require.NoError(t, err)
-
-	if len(store.GetAllAccounts(context.Background())) != 0 {
-		t.Errorf("expecting 0 Accounts to be stored after DeleteAccount()")
-	}
-
-	_, err = store.GetAccountByPeerPubKey(context.Background(), "peerkey")
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by peer public key")
-
-	_, err = store.GetAccountByUser(context.Background(), "testuser")
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by user")
-
-	_, err = store.GetAccountByPeerID(context.Background(), "testpeer")
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by peer id")
-
-	_, err = store.GetAccountBySetupKey(context.Background(), setupKey.Key)
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by setup key")
-
-	_, err = store.GetAccount(context.Background(), account.Id)
-	require.Error(t, err, "expecting error after removing DeleteAccount when getting account by id")
-
-	for _, policy := range account.Policies {
-		var rules []*types.PolicyRule
-		err = store.(*SqlStore).db.Model(&types.PolicyRule{}).Find(&rules, "policy_id = ?", policy.ID).Error
-		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for policy rules")
-		require.Len(t, rules, 0, "expecting no policy rules to be found after removing DeleteAccount")
-
-	}
-
-	for _, accountUser := range account.Users {
-		var pats []*types.PersonalAccessToken
-		err = store.(*SqlStore).db.Model(&types.PersonalAccessToken{}).Find(&pats, "user_id = ?", accountUser.Id).Error
-		require.NoError(t, err, "expecting no error after removing DeleteAccount when searching for personal access token")
-		require.Len(t, pats, 0, "expecting no personal access token to be found after removing DeleteAccount")
-
-	}
-
-}
-
-func TestPostgresql_TestGetAccountByPrivateDomain(t *testing.T) {
-	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.PostgresStoreEngine))
-	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanUp)
-	assert.NoError(t, err)
-
-	existingDomain := "test.com"
-
-	account, err := store.GetAccountByPrivateDomain(context.Background(), existingDomain)
-	require.NoError(t, err, "should found account")
-	require.Equal(t, existingDomain, account.Domain, "domains should match")
-
-	_, err = store.GetAccountByPrivateDomain(context.Background(), "missing-domain.com")
-	require.Error(t, err, "should return error on domain lookup")
-}
-
-func TestPostgresql_GetTokenIDByHashedToken(t *testing.T) {
-	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.PostgresStoreEngine))
-	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanUp)
-	assert.NoError(t, err)
-
-	hashed := "SoMeHaShEdToKeN"
-	id := "9dj38s35-63fb-11ec-90d6-0242ac120003"
-
-	token, err := store.GetTokenIDByHashedToken(context.Background(), hashed)
-	require.NoError(t, err)
-	require.Equal(t, id, token)
-}
-
-func TestSqlite_GetTakenIPs(t *testing.T) {
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	defer cleanup()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	_, err = store.GetAccount(context.Background(), existingAccountID)
-	require.NoError(t, err)
-
-	takenIPs, err := store.GetTakenIPs(context.Background(), LockingStrengthNone, existingAccountID)
-	require.NoError(t, err)
-	assert.Equal(t, []netip.Addr{}, takenIPs)
-
-	peer1 := &nbpeer.Peer{
-		ID:        "peer1",
-		AccountID: existingAccountID,
-		Key:       "key1",
-		DNSLabel:  "peer1",
-		IP:        netip.AddrFrom4([4]byte{1, 1, 1, 1}),
-		IPv6:      netip.MustParseAddr("fd00::1:1:1:1"),
-	}
-	err = store.AddPeerToAccount(context.Background(), peer1)
-	require.NoError(t, err)
-
-	takenIPs, err = store.GetTakenIPs(context.Background(), LockingStrengthNone, existingAccountID)
-	require.NoError(t, err)
-	ip1 := netip.AddrFrom4([4]byte{1, 1, 1, 1})
-	assert.Equal(t, []netip.Addr{ip1}, takenIPs)
-
-	peer2 := &nbpeer.Peer{
-		ID:        "peer1second",
-		AccountID: existingAccountID,
-		Key:       "key2",
-		DNSLabel:  "peer1-1",
-		IP:        netip.AddrFrom4([4]byte{2, 2, 2, 2}),
-		IPv6:      netip.MustParseAddr("fd00::2:2:2:2"),
-	}
-	err = store.AddPeerToAccount(context.Background(), peer2)
-	require.NoError(t, err)
-
-	takenIPs, err = store.GetTakenIPs(context.Background(), LockingStrengthNone, existingAccountID)
-	require.NoError(t, err)
-	ip2 := netip.AddrFrom4([4]byte{2, 2, 2, 2})
-	assert.Equal(t, []netip.Addr{ip1, ip2}, takenIPs)
-}
-
-func TestSqlite_GetPeerLabelsInAccount(t *testing.T) {
-	runTestForAllEngines(t, "../testdata/extended-store.sql", func(t *testing.T, store Store) {
-		existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-		peerHostname := "peer1"
-
-		_, err := store.GetAccount(context.Background(), existingAccountID)
-		require.NoError(t, err)
-
-		labels, err := store.GetPeerLabelsInAccount(context.Background(), LockingStrengthNone, existingAccountID, peerHostname)
-		require.NoError(t, err)
-		assert.Equal(t, []string{}, labels)
-
-		peer1 := &nbpeer.Peer{
-			ID:        "peer1",
-			AccountID: existingAccountID,
-			Key:       "key1",
-			DNSLabel:  "peer1",
-			IP:        netip.AddrFrom4([4]byte{1, 1, 1, 1}),
-			IPv6:      netip.MustParseAddr("fd00::1:1:1:1"),
-		}
-		err = store.AddPeerToAccount(context.Background(), peer1)
-		require.NoError(t, err)
-
-		labels, err = store.GetPeerLabelsInAccount(context.Background(), LockingStrengthNone, existingAccountID, peerHostname)
-		require.NoError(t, err)
-		assert.Equal(t, []string{"peer1"}, labels)
-
-		peer2 := &nbpeer.Peer{
-			ID:        "peer1second",
-			AccountID: existingAccountID,
-			Key:       "key2",
-			DNSLabel:  "peer1-1",
-			IP:        netip.AddrFrom4([4]byte{2, 2, 2, 2}),
-			IPv6:      netip.MustParseAddr("fd00::2:2:2:2"),
-		}
-		err = store.AddPeerToAccount(context.Background(), peer2)
-		require.NoError(t, err)
-
-		labels, err = store.GetPeerLabelsInAccount(context.Background(), LockingStrengthNone, existingAccountID, peerHostname)
-		require.NoError(t, err)
-
-		expected := []string{"peer1", "peer1-1"}
-		sort.Strings(expected)
-		sort.Strings(labels)
-		assert.Equal(t, expected, labels)
-	})
-}
-
-func Test_AddPeerWithSameDnsLabel(t *testing.T) {
-	runTestForAllEngines(t, "../testdata/extended-store.sql", func(t *testing.T, store Store) {
-		existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-		_, err := store.GetAccount(context.Background(), existingAccountID)
-		require.NoError(t, err)
-
-		peer1 := &nbpeer.Peer{
-			ID:        "peer1",
-			AccountID: existingAccountID,
-			Key:       "key1",
-			DNSLabel:  "peer1.domain.test",
-		}
-		err = store.AddPeerToAccount(context.Background(), peer1)
-		require.NoError(t, err)
-
-		peer2 := &nbpeer.Peer{
-			ID:        "peer1second",
-			AccountID: existingAccountID,
-			Key:       "key2",
-			DNSLabel:  "peer1.domain.test",
-		}
-		err = store.AddPeerToAccount(context.Background(), peer2)
-		require.Error(t, err)
-	})
-}
-
-func Test_AddPeerWithSameIP(t *testing.T) {
-	runTestForAllEngines(t, "../testdata/extended-store.sql", func(t *testing.T, store Store) {
-		existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-		_, err := store.GetAccount(context.Background(), existingAccountID)
-		require.NoError(t, err)
-
-		peer1 := &nbpeer.Peer{
-			ID:        "peer1",
-			AccountID: existingAccountID,
-			Key:       "key1",
-			IP:        netip.AddrFrom4([4]byte{1, 1, 1, 1}),
-			IPv6:      netip.MustParseAddr("fd00::1:1:1:1"),
-		}
-		err = store.AddPeerToAccount(context.Background(), peer1)
-		require.NoError(t, err)
-
-		peer2 := &nbpeer.Peer{
-			ID:        "peer1second",
-			AccountID: existingAccountID,
-			Key:       "key2",
-			IP:        netip.AddrFrom4([4]byte{1, 1, 1, 1}),
-			IPv6:      netip.MustParseAddr("fd00::2:2:2:2"),
-		}
-		err = store.AddPeerToAccount(context.Background(), peer2)
-		require.Error(t, err)
-	})
-}
-
-func TestSqlite_GetAccountNetwork(t *testing.T) {
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	_, err = store.GetAccount(context.Background(), existingAccountID)
-	require.NoError(t, err)
-
-	network, err := store.GetAccountNetwork(context.Background(), LockingStrengthNone, existingAccountID)
-	require.NoError(t, err)
-	ip := net.IP{100, 64, 0, 0}.To16()
-	assert.Equal(t, ip, network.Net.IP)
-	assert.Equal(t, net.IPMask{255, 255, 0, 0}, network.Net.Mask)
-	assert.Equal(t, "", network.Dns)
-	assert.Equal(t, "af1c8024-ha40-4ce2-9418-34653101fc3c", network.Identifier)
-	assert.Equal(t, uint64(0), network.Serial)
-}
-
-func TestSqlite_GetSetupKeyBySecret(t *testing.T) {
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	plainKey := "A2C8E62B-38F5-4553-B31E-DD66C696CEBB"
-	hashedKey := sha256.Sum256([]byte(plainKey))
-	encodedHashedKey := b64.StdEncoding.EncodeToString(hashedKey[:])
-
-	_, err = store.GetAccount(context.Background(), existingAccountID)
-	require.NoError(t, err)
-
-	setupKey, err := store.GetSetupKeyBySecret(context.Background(), LockingStrengthNone, encodedHashedKey)
-	require.NoError(t, err)
-	assert.Equal(t, encodedHashedKey, setupKey.Key)
-	assert.Equal(t, types.HiddenKey(plainKey, 4), setupKey.KeySecret)
-	assert.Equal(t, "bf1c8084-ba50-4ce7-9439-34653001fc3b", setupKey.AccountID)
-	assert.Equal(t, "Default key", setupKey.Name)
-}
-
-func TestSqlite_incrementSetupKeyUsage(t *testing.T) {
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	plainKey := "A2C8E62B-38F5-4553-B31E-DD66C696CEBB"
-	hashedKey := sha256.Sum256([]byte(plainKey))
-	encodedHashedKey := b64.StdEncoding.EncodeToString(hashedKey[:])
-
-	_, err = store.GetAccount(context.Background(), existingAccountID)
-	require.NoError(t, err)
-
-	setupKey, err := store.GetSetupKeyBySecret(context.Background(), LockingStrengthNone, encodedHashedKey)
-	require.NoError(t, err)
-	assert.Equal(t, 0, setupKey.UsedTimes)
-
-	err = store.IncrementSetupKeyUsage(context.Background(), setupKey.Id)
-	require.NoError(t, err)
-
-	setupKey, err = store.GetSetupKeyBySecret(context.Background(), LockingStrengthNone, encodedHashedKey)
-	require.NoError(t, err)
-	assert.Equal(t, 1, setupKey.UsedTimes)
-
-	err = store.IncrementSetupKeyUsage(context.Background(), setupKey.Id)
-	require.NoError(t, err)
-
-	setupKey, err = store.GetSetupKeyBySecret(context.Background(), LockingStrengthNone, encodedHashedKey)
-	require.NoError(t, err)
-	assert.Equal(t, 2, setupKey.UsedTimes)
-}
-
 func TestSqlite_CreateAndGetObjectInTransaction(t *testing.T) {
 	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
 	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
@@ -1245,884 +231,6 @@ func TestSqlite_CreateAndGetObjectInTransaction(t *testing.T) {
 	assert.NoError(t, err)
 }
 
-func TestSqlStore_GetAccountUsers(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	if err != nil {
-		t.Fatal(err)
-	}
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	account, err := store.GetAccount(context.Background(), accountID)
-	require.NoError(t, err)
-	users, err := store.GetAccountUsers(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	require.Len(t, users, len(account.Users))
-}
-
-func TestSqlStore_UpdateAccountDomainAttributes(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	if err != nil {
-		t.Fatal(err)
-	}
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	t.Run("Should update attributes with public domain", func(t *testing.T) {
-		require.NoError(t, err)
-		domain := "example.com"
-		category := "public"
-		IsDomainPrimaryAccount := false
-		err = store.UpdateAccountDomainAttributes(context.Background(), accountID, domain, category, IsDomainPrimaryAccount)
-		require.NoError(t, err)
-		account, err := store.GetAccount(context.Background(), accountID)
-		require.NoError(t, err)
-		require.Equal(t, domain, account.Domain)
-		require.Equal(t, category, account.DomainCategory)
-		require.Equal(t, IsDomainPrimaryAccount, account.IsDomainPrimaryAccount)
-	})
-
-	t.Run("Should update attributes with private domain", func(t *testing.T) {
-		require.NoError(t, err)
-		domain := "test.com"
-		category := "private"
-		IsDomainPrimaryAccount := true
-		err = store.UpdateAccountDomainAttributes(context.Background(), accountID, domain, category, IsDomainPrimaryAccount)
-		require.NoError(t, err)
-		account, err := store.GetAccount(context.Background(), accountID)
-		require.NoError(t, err)
-		require.Equal(t, domain, account.Domain)
-		require.Equal(t, category, account.DomainCategory)
-		require.Equal(t, IsDomainPrimaryAccount, account.IsDomainPrimaryAccount)
-	})
-
-	t.Run("Should fail when account does not exist", func(t *testing.T) {
-		require.NoError(t, err)
-		domain := "test.com"
-		category := "private"
-		IsDomainPrimaryAccount := true
-		err = store.UpdateAccountDomainAttributes(context.Background(), "non-existing-account-id", domain, category, IsDomainPrimaryAccount)
-		require.Error(t, err)
-	})
-
-}
-
-func TestSqlite_GetGroupByName(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	if err != nil {
-		t.Fatal(err)
-	}
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	group, err := store.GetGroupByName(context.Background(), LockingStrengthNone, accountID, "All")
-	require.NoError(t, err)
-	require.True(t, group.IsGroupAll())
-}
-
-func Test_DeleteSetupKeySuccessfully(t *testing.T) {
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	setupKeyID := "A2C8E62B-38F5-4553-B31E-DD66C696CEBB"
-
-	err = store.DeleteSetupKey(context.Background(), accountID, setupKeyID)
-	require.NoError(t, err)
-
-	_, err = store.GetSetupKeyByID(context.Background(), LockingStrengthNone, setupKeyID, accountID)
-	require.Error(t, err)
-}
-
-func Test_DeleteSetupKeyFailsForNonExistingKey(t *testing.T) {
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	nonExistingKeyID := "non-existing-key-id"
-
-	err = store.DeleteSetupKey(context.Background(), accountID, nonExistingKeyID)
-	require.Error(t, err)
-}
-
-func TestSqlStore_GetGroupsByIDs(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	tests := []struct {
-		name          string
-		groupIDs      []string
-		expectedCount int
-	}{
-		{
-			name:          "retrieve existing groups by existing IDs",
-			groupIDs:      []string{"cfefqs706sqkneg59g4g", "cfefqs706sqkneg59g3g"},
-			expectedCount: 2,
-		},
-		{
-			name:          "empty group IDs list",
-			groupIDs:      []string{},
-			expectedCount: 0,
-		},
-		{
-			name:          "non-existing group IDs",
-			groupIDs:      []string{"nonexistent1", "nonexistent2"},
-			expectedCount: 0,
-		},
-		{
-			name:          "mixed existing and non-existing group IDs",
-			groupIDs:      []string{"cfefqs706sqkneg59g4g", "nonexistent"},
-			expectedCount: 1,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			groups, err := store.GetGroupsByIDs(context.Background(), LockingStrengthNone, accountID, tt.groupIDs)
-			require.NoError(t, err)
-			require.Len(t, groups, tt.expectedCount)
-		})
-	}
-}
-
-func TestSqlStore_CreateGroup(t *testing.T) {
-	if os.Getenv("CI") == "true" {
-		t.Log("Skipping MySQL test on CI")
-	}
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.MysqlStoreEngine))
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	group := &types.Group{
-		ID:         "group-id",
-		AccountID:  accountID,
-		Issued:     "api",
-		Peers:      []string{},
-		Resources:  []types.Resource{},
-		GroupPeers: []types.GroupPeer{},
-	}
-	err = store.CreateGroup(context.Background(), group)
-	require.NoError(t, err)
-
-	savedGroup, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, "group-id")
-	require.NoError(t, err)
-	require.Equal(t, savedGroup, group)
-}
-
-func TestSqlStore_CreateUpdateGroups(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	groups := []*types.Group{
-		{
-			ID:         "group-1",
-			AccountID:  accountID,
-			Issued:     "api",
-			Peers:      []string{},
-			Resources:  []types.Resource{},
-			GroupPeers: []types.GroupPeer{},
-		},
-		{
-			ID:         "group-2",
-			AccountID:  accountID,
-			Issued:     "integration",
-			Peers:      []string{},
-			Resources:  []types.Resource{},
-			GroupPeers: []types.GroupPeer{},
-		},
-	}
-	err = store.CreateGroups(context.Background(), accountID, groups)
-	require.NoError(t, err)
-
-	groups[1].Peers = []string{}
-	err = store.UpdateGroups(context.Background(), accountID, groups)
-	require.NoError(t, err)
-
-	group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groups[1].ID)
-	require.NoError(t, err)
-	require.Equal(t, groups[1], group)
-}
-
-func TestSqlStore_DeleteGroup(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	tests := []struct {
-		name        string
-		groupID     string
-		expectError bool
-	}{
-		{
-			name:        "delete existing group",
-			groupID:     "cfefqs706sqkneg59g4g",
-			expectError: false,
-		},
-		{
-			name:        "delete non-existing group",
-			groupID:     "non-existing-group-id",
-			expectError: true,
-		},
-		{
-			name:        "delete with empty group ID",
-			groupID:     "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := store.DeleteGroup(context.Background(), accountID, tt.groupID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-			} else {
-				require.NoError(t, err)
-
-				group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, tt.groupID)
-				require.Error(t, err)
-				require.Nil(t, group)
-			}
-		})
-	}
-}
-
-func TestSqlStore_DeleteGroups(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	tests := []struct {
-		name        string
-		groupIDs    []string
-		expectError bool
-	}{
-		{
-			name:        "delete multiple existing groups",
-			groupIDs:    []string{"cfefqs706sqkneg59g4g", "cfefqs706sqkneg59g3g"},
-			expectError: false,
-		},
-		{
-			name:        "delete non-existing groups",
-			groupIDs:    []string{"non-existing-id-1", "non-existing-id-2"},
-			expectError: false,
-		},
-		{
-			name:        "delete with empty group IDs list",
-			groupIDs:    []string{},
-			expectError: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := store.DeleteGroups(context.Background(), accountID, tt.groupIDs)
-			if tt.expectError {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-
-				for _, groupID := range tt.groupIDs {
-					group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
-					require.Error(t, err)
-					require.Nil(t, group)
-				}
-			}
-		})
-	}
-}
-
-func TestSqlStore_GetPeerByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	tests := []struct {
-		name        string
-		peerID      string
-		expectError bool
-	}{
-		{
-			name:        "retrieve existing peer",
-			peerID:      "cfefqs706sqkneg59g4g",
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing peer",
-			peerID:      "non-existing",
-			expectError: true,
-		},
-		{
-			name:        "retrieve with empty peer ID",
-			peerID:      "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			peer, err := store.GetPeerByID(context.Background(), LockingStrengthNone, accountID, tt.peerID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, peer)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, peer)
-				require.Equal(t, tt.peerID, peer.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_GetPeersByIDs(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	tests := []struct {
-		name          string
-		peerIDs       []string
-		expectedCount int
-	}{
-		{
-			name:          "retrieve existing peers by existing IDs",
-			peerIDs:       []string{"cfefqs706sqkneg59g4g", "cfeg6sf06sqkneg59g50"},
-			expectedCount: 2,
-		},
-		{
-			name:          "empty peer IDs list",
-			peerIDs:       []string{},
-			expectedCount: 0,
-		},
-		{
-			name:          "non-existing peer IDs",
-			peerIDs:       []string{"nonexistent1", "nonexistent2"},
-			expectedCount: 0,
-		},
-		{
-			name:          "mixed existing and non-existing peer IDs",
-			peerIDs:       []string{"cfeg6sf06sqkneg59g50", "nonexistent"},
-			expectedCount: 1,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			peers, err := store.GetPeersByIDs(context.Background(), LockingStrengthNone, accountID, tt.peerIDs)
-			require.NoError(t, err)
-			require.Len(t, peers, tt.expectedCount)
-		})
-	}
-}
-
-func TestSqlStore_GetPostureChecksByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	tests := []struct {
-		name            string
-		postureChecksID string
-		expectError     bool
-	}{
-		{
-			name:            "retrieve existing posture checks",
-			postureChecksID: "csplshq7qv948l48f7t0",
-			expectError:     false,
-		},
-		{
-			name:            "retrieve non-existing posture checks",
-			postureChecksID: "non-existing",
-			expectError:     true,
-		},
-		{
-			name:            "retrieve with empty posture checks ID",
-			postureChecksID: "",
-			expectError:     true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			postureChecks, err := store.GetPostureChecksByID(context.Background(), LockingStrengthNone, accountID, tt.postureChecksID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, postureChecks)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, postureChecks)
-				require.Equal(t, tt.postureChecksID, postureChecks.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_GetPostureChecksByIDs(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	tests := []struct {
-		name            string
-		postureCheckIDs []string
-		expectedCount   int
-	}{
-		{
-			name:            "retrieve existing posture checks by existing IDs",
-			postureCheckIDs: []string{"csplshq7qv948l48f7t0", "cspnllq7qv95uq1r4k90"},
-			expectedCount:   2,
-		},
-		{
-			name:            "empty posture check IDs list",
-			postureCheckIDs: []string{},
-			expectedCount:   0,
-		},
-		{
-			name:            "non-existing posture check IDs",
-			postureCheckIDs: []string{"nonexistent1", "nonexistent2"},
-			expectedCount:   0,
-		},
-		{
-			name:            "mixed existing and non-existing posture check IDs",
-			postureCheckIDs: []string{"cspnllq7qv95uq1r4k90", "nonexistent"},
-			expectedCount:   1,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			groups, err := store.GetPostureChecksByIDs(context.Background(), LockingStrengthNone, accountID, tt.postureCheckIDs)
-			require.NoError(t, err)
-			require.Len(t, groups, tt.expectedCount)
-		})
-	}
-}
-
-func TestSqlStore_SavePostureChecks(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	postureChecks := &posture.Checks{
-		ID:        "posture-checks-id",
-		AccountID: accountID,
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.31.0",
-			},
-			OSVersionCheck: &posture.OSVersionCheck{
-				Ios: &posture.MinVersionCheck{
-					MinVersion: "13.0.1",
-				},
-				Linux: &posture.MinKernelVersionCheck{
-					MinKernelVersion: "5.3.3-dev",
-				},
-			},
-			GeoLocationCheck: &posture.GeoLocationCheck{
-				Locations: []posture.Location{
-					{
-						CountryCode: "DE",
-						CityName:    "Berlin",
-					},
-				},
-				Action: posture.CheckActionAllow,
-			},
-		},
-	}
-	err = store.SavePostureChecks(context.Background(), postureChecks)
-	require.NoError(t, err)
-
-	savePostureChecks, err := store.GetPostureChecksByID(context.Background(), LockingStrengthNone, accountID, "posture-checks-id")
-	require.NoError(t, err)
-	require.Equal(t, savePostureChecks, postureChecks)
-}
-
-func TestSqlStore_DeletePostureChecks(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	tests := []struct {
-		name            string
-		postureChecksID string
-		expectError     bool
-	}{
-		{
-			name:            "delete existing posture checks",
-			postureChecksID: "csplshq7qv948l48f7t0",
-			expectError:     false,
-		},
-		{
-			name:            "delete non-existing posture checks",
-			postureChecksID: "non-existing-posture-checks-id",
-			expectError:     true,
-		},
-		{
-			name:            "delete with empty posture checks ID",
-			postureChecksID: "",
-			expectError:     true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err = store.DeletePostureChecks(context.Background(), accountID, tt.postureChecksID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-			} else {
-				require.NoError(t, err)
-				group, err := store.GetPostureChecksByID(context.Background(), LockingStrengthNone, accountID, tt.postureChecksID)
-				require.Error(t, err)
-				require.Nil(t, group)
-			}
-		})
-	}
-}
-
-func TestSqlStore_GetPolicyByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	tests := []struct {
-		name        string
-		policyID    string
-		expectError bool
-	}{
-		{
-			name:        "retrieve existing policy",
-			policyID:    "cs1tnh0hhcjnqoiuebf0",
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing policy checks",
-			policyID:    "non-existing",
-			expectError: true,
-		},
-		{
-			name:        "retrieve with empty policy ID",
-			policyID:    "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			policy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, tt.policyID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, policy)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, policy)
-				require.Equal(t, tt.policyID, policy.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_CreatePolicy(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	policy := &types.Policy{
-		ID:        "policy-id",
-		AccountID: accountID,
-		Enabled:   true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupC"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}
-	err = store.CreatePolicy(context.Background(), policy)
-	require.NoError(t, err)
-
-	savePolicy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, policy.ID)
-	require.NoError(t, err)
-	require.Equal(t, savePolicy, policy)
-
-}
-
-func TestSqlStore_SavePolicy(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	policyID := "cs1tnh0hhcjnqoiuebf0"
-
-	policy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, policyID)
-	require.NoError(t, err)
-
-	policy.Enabled = false
-	policy.Description = "policy"
-	policy.Rules[0].Sources = []string{"group"}
-	policy.Rules[0].Ports = []string{"80", "443"}
-	err = store.SavePolicy(context.Background(), policy)
-	require.NoError(t, err)
-
-	savePolicy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, policy.ID)
-	require.NoError(t, err)
-	require.Equal(t, savePolicy, policy)
-}
-
-func TestSqlStore_DeletePolicy(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	policyID := "cs1tnh0hhcjnqoiuebf0"
-
-	err = store.DeletePolicy(context.Background(), accountID, policyID)
-	require.NoError(t, err)
-
-	policy, err := store.GetPolicyByID(context.Background(), LockingStrengthNone, accountID, policyID)
-	require.Error(t, err)
-	require.Nil(t, policy)
-}
-
-func TestSqlStore_GetDNSSettings(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name        string
-		accountID   string
-		expectError bool
-	}{
-		{
-			name:        "retrieve existing account dns settings",
-			accountID:   "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing account dns settings",
-			accountID:   "non-existing",
-			expectError: true,
-		},
-		{
-			name:        "retrieve dns settings with empty account ID",
-			accountID:   "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			dnsSettings, err := store.GetAccountDNSSettings(context.Background(), LockingStrengthNone, tt.accountID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, dnsSettings)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, dnsSettings)
-			}
-		})
-	}
-}
-
-func TestSqlStore_SaveDNSSettings(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	dnsSettings, err := store.GetAccountDNSSettings(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-
-	dnsSettings.DisabledManagementGroups = []string{"groupA", "groupB"}
-	err = store.SaveDNSSettings(context.Background(), accountID, dnsSettings)
-	require.NoError(t, err)
-
-	saveDNSSettings, err := store.GetAccountDNSSettings(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	require.Equal(t, saveDNSSettings, dnsSettings)
-}
-
-func TestSqlStore_GetAccountNameServerGroups(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name          string
-		accountID     string
-		expectedCount int
-	}{
-		{
-			name:          "retrieve name server groups by existing account ID",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			expectedCount: 1,
-		},
-		{
-			name:          "non-existing account ID",
-			accountID:     "nonexistent",
-			expectedCount: 0,
-		},
-		{
-			name:          "empty account ID",
-			accountID:     "",
-			expectedCount: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			peers, err := store.GetAccountNameServerGroups(context.Background(), LockingStrengthNone, tt.accountID)
-			require.NoError(t, err)
-			require.Len(t, peers, tt.expectedCount)
-		})
-	}
-
-}
-
-func TestSqlStore_GetNameServerByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	tests := []struct {
-		name        string
-		nsGroupID   string
-		expectError bool
-	}{
-		{
-			name:        "retrieve existing nameserver group",
-			nsGroupID:   "csqdelq7qv97ncu7d9t0",
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing nameserver group",
-			nsGroupID:   "non-existing",
-			expectError: true,
-		},
-		{
-			name:        "retrieve with empty nameserver group ID",
-			nsGroupID:   "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			nsGroup, err := store.GetNameServerGroupByID(context.Background(), LockingStrengthNone, accountID, tt.nsGroupID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, nsGroup)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, nsGroup)
-				require.Equal(t, tt.nsGroupID, nsGroup.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_SaveNameServerGroup(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	nsGroup := &nbdns.NameServerGroup{
-		ID:        "ns-group-id",
-		AccountID: accountID,
-		Name:      "NS Group",
-		NameServers: []nbdns.NameServer{
-			{
-				IP:     netip.MustParseAddr("8.8.8.8"),
-				NSType: 1,
-				Port:   53,
-			},
-		},
-		Groups:               []string{"groupA"},
-		Primary:              true,
-		Enabled:              true,
-		SearchDomainsEnabled: false,
-	}
-
-	err = store.SaveNameServerGroup(context.Background(), nsGroup)
-	require.NoError(t, err)
-
-	saveNSGroup, err := store.GetNameServerGroupByID(context.Background(), LockingStrengthNone, accountID, nsGroup.ID)
-	require.NoError(t, err)
-	require.Equal(t, saveNSGroup, nsGroup)
-}
-
-func TestSqlStore_DeleteNameServerGroup(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	nsGroupID := "csqdelq7qv97ncu7d9t0"
-
-	err = store.DeleteNameServerGroup(context.Background(), accountID, nsGroupID)
-	require.NoError(t, err)
-
-	nsGroup, err := store.GetNameServerGroupByID(context.Background(), LockingStrengthNone, accountID, nsGroupID)
-	require.Error(t, err)
-	require.Nil(t, nsGroup)
-}
-
 // newAccountWithId creates a new Account with a default SetupKey (doesn't store in a Store) and provided id
 func newAccountWithId(ctx context.Context, accountID, userID, domain string) *types.Account {
 	log.WithContext(ctx).Debugf("creating new account")
@@ -2173,797 +281,6 @@ func newAccountWithId(ctx context.Context, accountID, userID, domain string) *ty
 	return acc
 }
 
-func TestSqlStore_GetAccountNetworks(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name          string
-		accountID     string
-		expectedCount int
-	}{
-		{
-			name:          "retrieve networks by existing account ID",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			expectedCount: 1,
-		},
-
-		{
-			name:          "retrieve networks by non-existing account ID",
-			accountID:     "non-existent",
-			expectedCount: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			networks, err := store.GetAccountNetworks(context.Background(), LockingStrengthNone, tt.accountID)
-			require.NoError(t, err)
-			require.Len(t, networks, tt.expectedCount)
-		})
-	}
-}
-
-func TestSqlStore_GetNetworkByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	tests := []struct {
-		name        string
-		networkID   string
-		expectError bool
-	}{
-		{
-			name:        "retrieve existing network ID",
-			networkID:   "ct286bi7qv930dsrrug0",
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing network ID",
-			networkID:   "non-existing",
-			expectError: true,
-		},
-		{
-			name:        "retrieve network with empty ID",
-			networkID:   "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			network, err := store.GetNetworkByID(context.Background(), LockingStrengthNone, accountID, tt.networkID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, network)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, network)
-				require.Equal(t, tt.networkID, network.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_SaveNetwork(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	network := &networkTypes.Network{
-		ID:        "net-id",
-		AccountID: accountID,
-		Name:      "net",
-	}
-
-	err = store.SaveNetwork(context.Background(), network)
-	require.NoError(t, err)
-
-	savedNet, err := store.GetNetworkByID(context.Background(), LockingStrengthNone, accountID, network.ID)
-	require.NoError(t, err)
-	require.Equal(t, network, savedNet)
-}
-
-func TestSqlStore_DeleteNetwork(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	networkID := "ct286bi7qv930dsrrug0"
-
-	err = store.DeleteNetwork(context.Background(), accountID, networkID)
-	require.NoError(t, err)
-
-	network, err := store.GetNetworkByID(context.Background(), LockingStrengthNone, accountID, networkID)
-	require.Error(t, err)
-	sErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, sErr.Type())
-	require.Nil(t, network)
-}
-
-func TestSqlStore_GetNetworkRoutersByNetID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	tests := []struct {
-		name          string
-		networkID     string
-		expectedCount int
-	}{
-		{
-			name:          "retrieve routers by existing network ID",
-			networkID:     "ct286bi7qv930dsrrug0",
-			expectedCount: 1,
-		},
-		{
-			name:          "retrieve routers by non-existing network ID",
-			networkID:     "non-existent",
-			expectedCount: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			routers, err := store.GetNetworkRoutersByNetID(context.Background(), LockingStrengthNone, accountID, tt.networkID)
-			require.NoError(t, err)
-			require.Len(t, routers, tt.expectedCount)
-		})
-	}
-}
-
-func TestSqlStore_GetNetworkRouterByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	tests := []struct {
-		name            string
-		networkRouterID string
-		expectError     bool
-	}{
-		{
-			name:            "retrieve existing network router ID",
-			networkRouterID: "ctc20ji7qv9ck2sebc80",
-			expectError:     false,
-		},
-		{
-			name:            "retrieve non-existing network router ID",
-			networkRouterID: "non-existing",
-			expectError:     true,
-		},
-		{
-			name:            "retrieve network with empty router ID",
-			networkRouterID: "",
-			expectError:     true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			networkRouter, err := store.GetNetworkRouterByID(context.Background(), LockingStrengthNone, accountID, tt.networkRouterID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, networkRouter)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, networkRouter)
-				require.Equal(t, tt.networkRouterID, networkRouter.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_CreateNetworkRouter(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	networkID := "ct286bi7qv930dsrrug0"
-
-	netRouter, err := routerTypes.NewNetworkRouter(accountID, networkID, "", []string{"net-router-grp"}, true, 0, true)
-	require.NoError(t, err)
-
-	err = store.CreateNetworkRouter(context.Background(), netRouter)
-	require.NoError(t, err)
-
-	savedNetRouter, err := store.GetNetworkRouterByID(context.Background(), LockingStrengthNone, accountID, netRouter.ID)
-	require.NoError(t, err)
-	require.Equal(t, netRouter, savedNetRouter)
-}
-
-func TestSqlStore_UpdateNetworkRouter(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	networkID := "ct286bi7qv930dsrrug0"
-	routerID := "ctc20ji7qv9ck2sebc80"
-
-	netRouter := &routerTypes.NetworkRouter{
-		ID:         routerID,
-		AccountID:  accountID,
-		NetworkID:  networkID,
-		Peer:       "",
-		PeerGroups: []string{"net-router-grp"},
-		Masquerade: true,
-		Metric:     42,
-		Enabled:    true,
-	}
-
-	err = store.UpdateNetworkRouter(context.Background(), netRouter)
-	require.NoError(t, err)
-
-	savedNetRouter, err := store.GetNetworkRouterByID(context.Background(), LockingStrengthNone, accountID, routerID)
-	require.NoError(t, err)
-	require.Equal(t, netRouter, savedNetRouter)
-
-	// Updating a router under a different account must not match any row.
-	netRouter.AccountID = "non-existent-account"
-	err = store.UpdateNetworkRouter(context.Background(), netRouter)
-	require.Error(t, err)
-}
-
-func TestSqlStore_DeleteNetworkRouter(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	netRouterID := "ctc20ji7qv9ck2sebc80"
-
-	err = store.DeleteNetworkRouter(context.Background(), accountID, netRouterID)
-	require.NoError(t, err)
-
-	netRouter, err := store.GetNetworkByID(context.Background(), LockingStrengthNone, accountID, netRouterID)
-	require.Error(t, err)
-	sErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, sErr.Type())
-	require.Nil(t, netRouter)
-}
-
-func TestSqlStore_GetNetworkResourcesByNetID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	tests := []struct {
-		name          string
-		networkID     string
-		expectedCount int
-	}{
-		{
-			name:          "retrieve resources by existing network ID",
-			networkID:     "ct286bi7qv930dsrrug0",
-			expectedCount: 1,
-		},
-		{
-			name:          "retrieve resources by non-existing network ID",
-			networkID:     "non-existent",
-			expectedCount: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			netResources, err := store.GetNetworkResourcesByNetID(context.Background(), LockingStrengthNone, accountID, tt.networkID)
-			require.NoError(t, err)
-			require.Len(t, netResources, tt.expectedCount)
-		})
-	}
-}
-
-func TestSqlStore_GetNetworkResourceByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	tests := []struct {
-		name          string
-		netResourceID string
-		expectError   bool
-	}{
-		{
-			name:          "retrieve existing network resource ID",
-			netResourceID: "ctc4nci7qv9061u6ilfg",
-			expectError:   false,
-		},
-		{
-			name:          "retrieve non-existing network resource ID",
-			netResourceID: "non-existing",
-			expectError:   true,
-		},
-		{
-			name:          "retrieve network with empty resource ID",
-			netResourceID: "",
-			expectError:   true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			netResource, err := store.GetNetworkResourceByID(context.Background(), LockingStrengthNone, accountID, tt.netResourceID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, netResource)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, netResource)
-				require.Equal(t, tt.netResourceID, netResource.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_SaveNetworkResource(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	networkID := "ct286bi7qv930dsrrug0"
-
-	netResource, err := resourceTypes.NewNetworkResource(accountID, networkID, "resource-name", "", "example.com", []string{}, true)
-	require.NoError(t, err)
-
-	err = store.SaveNetworkResource(context.Background(), netResource)
-	require.NoError(t, err)
-
-	savedNetResource, err := store.GetNetworkResourceByID(context.Background(), LockingStrengthNone, accountID, netResource.ID)
-	require.NoError(t, err)
-	require.Equal(t, netResource.ID, savedNetResource.ID)
-	require.Equal(t, netResource.Name, savedNetResource.Name)
-	require.Equal(t, netResource.NetworkID, savedNetResource.NetworkID)
-	require.Equal(t, netResource.Type, resourceTypes.NetworkResourceType("domain"))
-	require.Equal(t, netResource.Domain, "example.com")
-	require.Equal(t, netResource.AccountID, savedNetResource.AccountID)
-	require.Equal(t, netResource.Prefix, netip.Prefix{})
-}
-
-func TestSqlStore_DeleteNetworkResource(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	netResourceID := "ctc4nci7qv9061u6ilfg"
-
-	err = store.DeleteNetworkResource(context.Background(), accountID, netResourceID)
-	require.NoError(t, err)
-
-	netResource, err := store.GetNetworkByID(context.Background(), LockingStrengthNone, accountID, netResourceID)
-	require.Error(t, err)
-	sErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, sErr.Type())
-	require.Nil(t, netResource)
-}
-
-func TestSqlStore_AddAndRemoveResourceFromGroup(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	require.NoError(t, err)
-	t.Cleanup(cleanup)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	resourceId := "ctc4nci7qv9061u6ilfg"
-	groupID := "cs1tnh0hhcjnqoiuebeg"
-
-	res := &types.Resource{
-		ID:   resourceId,
-		Type: "host",
-	}
-	err = store.AddResourceToGroup(context.Background(), accountID, groupID, res)
-	require.NoError(t, err)
-
-	group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
-	require.NoError(t, err)
-	require.Contains(t, group.Resources, *res)
-
-	groups, err := store.GetResourceGroups(context.Background(), LockingStrengthNone, accountID, resourceId)
-	require.NoError(t, err)
-	require.Len(t, groups, 1)
-
-	err = store.RemoveResourceFromGroup(context.Background(), accountID, groupID, res.ID)
-	require.NoError(t, err)
-
-	group, err = store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
-	require.NoError(t, err)
-	require.NotContains(t, group.Resources, *res)
-}
-
-func TestSqlStore_AddPeerToGroup(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	peerID := "cfefqs706sqkneg59g4g"
-	groupID := "cfefqs706sqkneg59g4h"
-
-	group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
-	require.NoError(t, err, "failed to get group")
-	require.Len(t, group.Peers, 0, "group should have 0 peers")
-
-	err = store.AddPeerToGroup(context.Background(), accountID, peerID, groupID)
-	require.NoError(t, err, "failed to add peer to group")
-
-	group, err = store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
-	require.NoError(t, err, "failed to get group")
-	require.Len(t, group.Peers, 1, "group should have 1 peers")
-	require.Contains(t, group.Peers, peerID)
-}
-
-func TestSqlStore_AddPeerToAllGroup(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	groupID := "cfefqs706sqkneg59g3g"
-
-	peer := &nbpeer.Peer{
-		ID:        "peer1",
-		AccountID: accountID,
-		DNSLabel:  "peer1.domain.test",
-	}
-
-	group, err := store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
-	require.NoError(t, err, "failed to get group")
-	require.Len(t, group.Peers, 2, "group should have 2 peers")
-	require.NotContains(t, group.Peers, peer.ID)
-
-	err = store.AddPeerToAccount(context.Background(), peer)
-	require.NoError(t, err, "failed to add peer to account")
-
-	err = store.AddPeerToAllGroup(context.Background(), accountID, peer.ID)
-	require.NoError(t, err, "failed to add peer to all group")
-
-	group, err = store.GetGroupByID(context.Background(), LockingStrengthNone, accountID, groupID)
-	require.NoError(t, err, "failed to get group")
-	require.Len(t, group.Peers, 3, "group should have  peers")
-	require.Contains(t, group.Peers, peer.ID)
-}
-
-func TestSqlStore_AddPeerToAccount(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	peer := &nbpeer.Peer{
-		ID:        "peer1",
-		AccountID: accountID,
-		Key:       "key",
-		IP:        netip.AddrFrom4([4]byte{1, 1, 1, 1}),
-		IPv6:      netip.MustParseAddr("fd00::1:1:1:1"),
-		Meta: nbpeer.PeerSystemMeta{
-			Hostname:  "hostname",
-			GoOS:      "linux",
-			Kernel:    "Linux",
-			Core:      "21.04",
-			Platform:  "x86_64",
-			OS:        "Ubuntu",
-			WtVersion: "development",
-			UIVersion: "development",
-		},
-		Name:     "peer.test",
-		DNSLabel: "peer",
-		Status: &nbpeer.PeerStatus{
-			LastSeen:         time.Now().UTC(),
-			Connected:        true,
-			LoginExpired:     false,
-			RequiresApproval: false,
-		},
-		SSHKey:                      "ssh-key",
-		SSHEnabled:                  false,
-		LoginExpirationEnabled:      true,
-		InactivityExpirationEnabled: false,
-		LastLogin:                   util.ToPtr(time.Now().UTC()),
-		CreatedAt:                   time.Now().UTC(),
-		Ephemeral:                   true,
-	}
-	err = store.AddPeerToAccount(context.Background(), peer)
-	require.NoError(t, err, "failed to add peer to account")
-
-	storedPeer, err := store.GetPeerByID(context.Background(), LockingStrengthNone, accountID, peer.ID)
-	require.NoError(t, err, "failed to get peer")
-
-	assert.Equal(t, peer.ID, storedPeer.ID)
-	assert.Equal(t, peer.AccountID, storedPeer.AccountID)
-	assert.Equal(t, peer.Key, storedPeer.Key)
-	assert.Equal(t, peer.IP.String(), storedPeer.IP.String())
-	assert.Equal(t, peer.Meta, storedPeer.Meta)
-	assert.Equal(t, peer.Name, storedPeer.Name)
-	assert.Equal(t, peer.DNSLabel, storedPeer.DNSLabel)
-	assert.Equal(t, peer.SSHKey, storedPeer.SSHKey)
-	assert.Equal(t, peer.SSHEnabled, storedPeer.SSHEnabled)
-	assert.Equal(t, peer.LoginExpirationEnabled, storedPeer.LoginExpirationEnabled)
-	assert.Equal(t, peer.InactivityExpirationEnabled, storedPeer.InactivityExpirationEnabled)
-	assert.WithinDurationf(t, peer.GetLastLogin(), storedPeer.GetLastLogin().UTC(), time.Millisecond, "LastLogin should be equal")
-	assert.WithinDurationf(t, peer.CreatedAt, storedPeer.CreatedAt.UTC(), time.Millisecond, "CreatedAt should be equal")
-	assert.Equal(t, peer.Ephemeral, storedPeer.Ephemeral)
-	assert.Equal(t, peer.Status.Connected, storedPeer.Status.Connected)
-	assert.Equal(t, peer.Status.LoginExpired, storedPeer.Status.LoginExpired)
-	assert.Equal(t, peer.Status.RequiresApproval, storedPeer.Status.RequiresApproval)
-	assert.WithinDurationf(t, peer.Status.LastSeen, storedPeer.Status.LastSeen.UTC(), time.Millisecond, "LastSeen should be equal")
-}
-
-func TestSqlStore_GetPeerGroups(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	peerID := "cfefqs706sqkneg59g4g"
-
-	groups, err := store.GetPeerGroups(context.Background(), LockingStrengthNone, accountID, peerID)
-	require.NoError(t, err)
-	assert.Len(t, groups, 1)
-	assert.Equal(t, groups[0].Name, "All")
-
-	err = store.AddPeerToGroup(context.Background(), accountID, peerID, "cfefqs706sqkneg59g4h")
-	require.NoError(t, err)
-
-	groups, err = store.GetPeerGroups(context.Background(), LockingStrengthNone, accountID, peerID)
-	require.NoError(t, err)
-	assert.Len(t, groups, 2)
-}
-
-func TestSqlStore_GetAccountPeers(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name          string
-		accountID     string
-		nameFilter    string
-		ipFilter      string
-		expectedCount int
-	}{
-		{
-			name:          "should retrieve peers for an existing account ID",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			expectedCount: 5,
-		},
-		{
-			name:          "should return no peers for a non-existing account ID",
-			accountID:     "nonexistent",
-			expectedCount: 0,
-		},
-		{
-			name:          "should return no peers for an empty account ID",
-			accountID:     "",
-			expectedCount: 0,
-		},
-		{
-			name:          "should filter peers by name",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			nameFilter:    "expiredhost",
-			expectedCount: 1,
-		},
-		{
-			name:          "should filter peers by partial name",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			nameFilter:    "host",
-			expectedCount: 4,
-		},
-		{
-			name:          "should filter peers by ip",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			ipFilter:      "100.64.39.54",
-			expectedCount: 1,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			peers, err := store.GetAccountPeers(context.Background(), LockingStrengthNone, tt.accountID, tt.nameFilter, tt.ipFilter)
-			require.NoError(t, err)
-			require.Len(t, peers, tt.expectedCount)
-		})
-	}
-
-}
-
-func TestSqlStore_GetAccountPeersWithExpiration(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name            string
-		accountID       string
-		expectedCount   int
-		expectedPeerIDs []string
-	}{
-		{
-			name:            "should retrieve only non-expired peers with expiration enabled",
-			accountID:       "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			expectedCount:   1,
-			expectedPeerIDs: []string{"notexpired01"},
-		},
-		{
-			name:          "should return no peers with expiration for a non-existing account ID",
-			accountID:     "nonexistent",
-			expectedCount: 0,
-		},
-		{
-			name:          "should return no peers with expiration for a empty account ID",
-			accountID:     "",
-			expectedCount: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			peers, err := store.GetAccountPeersWithExpiration(context.Background(), LockingStrengthNone, tt.accountID)
-			require.NoError(t, err)
-			require.Len(t, peers, tt.expectedCount)
-			for i, peer := range peers {
-				assert.Equal(t, tt.expectedPeerIDs[i], peer.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_GetAccountPeersWithExpiration_ExcludesAlreadyExpired(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	peers, err := store.GetAccountPeersWithExpiration(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-
-	// Verify the already-expired peer (cg05lnblo1hkg2j514p0) is not returned
-	for _, peer := range peers {
-		assert.NotEqual(t, "cg05lnblo1hkg2j514p0", peer.ID, "already expired peer should not be returned")
-		assert.False(t, peer.Status.LoginExpired, "returned peers should not have LoginExpired set")
-	}
-}
-
-func TestSqlStore_GetAccountPeersWithInactivity(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name          string
-		accountID     string
-		expectedCount int
-	}{
-		{
-			name:          "should retrieve peers with inactivity for an existing account ID",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			expectedCount: 1,
-		},
-		{
-			name:          "should return no peers with inactivity for a non-existing account ID",
-			accountID:     "nonexistent",
-			expectedCount: 0,
-		},
-		{
-			name:          "should return no peers with inactivity for an empty account ID",
-			accountID:     "",
-			expectedCount: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			peers, err := store.GetAccountPeersWithInactivity(context.Background(), LockingStrengthNone, tt.accountID)
-			require.NoError(t, err)
-			require.Len(t, peers, tt.expectedCount)
-		})
-	}
-}
-
-func TestSqlStore_GetAllEphemeralPeers(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/storev1.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	peers, err := store.GetAllEphemeralPeers(context.Background(), LockingStrengthNone)
-	require.NoError(t, err)
-	require.Len(t, peers, 1)
-	require.True(t, peers[0].Ephemeral)
-}
-
-func TestSqlStore_GetUserPeers(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name          string
-		accountID     string
-		userID        string
-		expectedCount int
-	}{
-		{
-			name:          "should retrieve peers for existing account ID and user ID",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			userID:        "f4f6d672-63fb-11ec-90d6-0242ac120003",
-			expectedCount: 1,
-		},
-		{
-			name:          "should return no peers for non-existing account ID with existing user ID",
-			accountID:     "nonexistent",
-			userID:        "f4f6d672-63fb-11ec-90d6-0242ac120003",
-			expectedCount: 0,
-		},
-		{
-			name:          "should return no peers for non-existing user ID with existing account ID",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			userID:        "nonexistent_user",
-			expectedCount: 0,
-		},
-		{
-			name:          "should retrieve peers for another valid account ID and user ID",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			userID:        "edafee4e-63fb-11ec-90d6-0242ac120003",
-			expectedCount: 3,
-		},
-		{
-			name:          "should return no peers for existing account ID with empty user ID",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			userID:        "",
-			expectedCount: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			peers, err := store.GetUserPeers(context.Background(), LockingStrengthNone, tt.accountID, tt.userID)
-			require.NoError(t, err)
-			require.Len(t, peers, tt.expectedCount)
-		})
-	}
-}
-
-func TestSqlStore_DeletePeer(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	peerID := "csrnkiq7qv9d8aitqd50"
-
-	err = store.DeletePeer(context.Background(), accountID, peerID)
-	require.NoError(t, err)
-
-	peer, err := store.GetPeerByID(context.Background(), LockingStrengthNone, accountID, peerID)
-	require.Error(t, err)
-	require.Nil(t, peer)
-}
-
 func TestSqlStore_DatabaseBlocking(t *testing.T) {
 	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
 	t.Cleanup(cleanup)
@@ -3034,1068 +351,6 @@ func TestSqlStore_DatabaseBlocking(t *testing.T) {
 	t.Logf("Test completed")
 }
 
-func TestSqlStore_GetAccountCreatedBy(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name        string
-		accountID   string
-		expectError bool
-		createdBy   string
-	}{
-		{
-			name:        "existing account ID",
-			accountID:   "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			expectError: false,
-			createdBy:   "edafee4e-63fb-11ec-90d6-0242ac120003",
-		},
-		{
-			name:        "non-existing account ID",
-			accountID:   "nonexistent",
-			expectError: true,
-		},
-		{
-			name:        "empty account ID",
-			accountID:   "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			createdBy, err := store.GetAccountCreatedBy(context.Background(), LockingStrengthNone, tt.accountID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Empty(t, createdBy)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, createdBy)
-				require.Equal(t, tt.createdBy, createdBy)
-			}
-		})
-	}
-
-}
-
-func TestSqlStore_GetUserByUserID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name        string
-		userID      string
-		expectError bool
-	}{
-		{
-			name:        "retrieve existing user",
-			userID:      "edafee4e-63fb-11ec-90d6-0242ac120003",
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing user",
-			userID:      "non-existing",
-			expectError: true,
-		},
-		{
-			name:        "retrieve with empty user ID",
-			userID:      "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			user, err := store.GetUserByUserID(context.Background(), LockingStrengthNone, tt.userID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, user)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, user)
-				require.Equal(t, tt.userID, user.Id)
-			}
-		})
-	}
-}
-
-func TestSqlStore_GetUserByPATID(t *testing.T) {
-	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanUp)
-	assert.NoError(t, err)
-
-	id := "9dj38s35-63fb-11ec-90d6-0242ac120003"
-
-	user, err := store.GetUserByPATID(context.Background(), LockingStrengthNone, id)
-	require.NoError(t, err)
-	require.Equal(t, "f4f6d672-63fb-11ec-90d6-0242ac120003", user.Id)
-}
-
-func TestSqlStore_SaveUser(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	user := &types.User{
-		Id:            "user-id",
-		AccountID:     accountID,
-		Role:          types.UserRoleAdmin,
-		IsServiceUser: false,
-		AutoGroups:    []string{"groupA", "groupB"},
-		Blocked:       false,
-		LastLogin:     util.ToPtr(time.Now().UTC()),
-		CreatedAt:     time.Now().UTC().Add(-time.Hour),
-		Issued:        types.UserIssuedIntegration,
-	}
-	err = store.SaveUser(context.Background(), user)
-	require.NoError(t, err)
-
-	saveUser, err := store.GetUserByUserID(context.Background(), LockingStrengthNone, user.Id)
-	require.NoError(t, err)
-	require.Equal(t, user.Id, saveUser.Id)
-	require.Equal(t, user.AccountID, saveUser.AccountID)
-	require.Equal(t, user.Role, saveUser.Role)
-	require.Equal(t, user.AutoGroups, saveUser.AutoGroups)
-	require.WithinDurationf(t, user.GetLastLogin(), saveUser.LastLogin.UTC(), time.Millisecond, "LastLogin should be equal")
-	require.WithinDurationf(t, user.CreatedAt, saveUser.CreatedAt.UTC(), time.Millisecond, "CreatedAt should be equal")
-	require.Equal(t, user.Issued, saveUser.Issued)
-	require.Equal(t, user.Blocked, saveUser.Blocked)
-	require.Equal(t, user.IsServiceUser, saveUser.IsServiceUser)
-}
-
-func TestSqlStore_SaveUsers(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	accountUsers, err := store.GetAccountUsers(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	require.Len(t, accountUsers, 2)
-
-	users := []*types.User{
-		{
-			Id:         "user-1",
-			AccountID:  accountID,
-			Issued:     "api",
-			AutoGroups: []string{"groupA", "groupB"},
-		},
-		{
-			Id:         "user-2",
-			AccountID:  accountID,
-			Issued:     "integration",
-			AutoGroups: []string{"groupA"},
-		},
-	}
-	err = store.SaveUsers(context.Background(), users)
-	require.NoError(t, err)
-
-	accountUsers, err = store.GetAccountUsers(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	require.Len(t, accountUsers, 4)
-
-	users[1].AutoGroups = []string{"groupA", "groupC"}
-	err = store.SaveUsers(context.Background(), users)
-	require.NoError(t, err)
-
-	user, err := store.GetUserByUserID(context.Background(), LockingStrengthNone, users[1].Id)
-	require.NoError(t, err)
-	require.Equal(t, users[1].AutoGroups, user.AutoGroups)
-}
-
-func TestSqlStore_SaveUserWithEncryption(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	// Enable encryption
-	key, err := crypt.GenerateKey()
-	require.NoError(t, err)
-	fieldEncrypt, err := crypt.NewFieldEncrypt(key)
-	require.NoError(t, err)
-	store.SetFieldEncrypt(fieldEncrypt)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	// rawUser is used to read raw (potentially encrypted) data from the database
-	// without any gorm hooks or automatic decryption
-	type rawUser struct {
-		Id    string
-		Email string
-		Name  string
-	}
-
-	t.Run("save user with empty email and name", func(t *testing.T) {
-		user := &types.User{
-			Id:         "user-empty-fields",
-			AccountID:  accountID,
-			Role:       types.UserRoleUser,
-			Email:      "",
-			Name:       "",
-			AutoGroups: []string{"groupA"},
-		}
-		err = store.SaveUser(context.Background(), user)
-		require.NoError(t, err)
-
-		// Verify using direct database query that empty strings remain empty (not encrypted)
-		var raw rawUser
-		err = store.(*SqlStore).db.Table("users").Select("id, email, name").Where("id = ?", user.Id).First(&raw).Error
-		require.NoError(t, err)
-		require.Equal(t, "", raw.Email, "empty email should remain empty in database")
-		require.Equal(t, "", raw.Name, "empty name should remain empty in database")
-
-		// Verify manual decryption returns empty strings
-		decryptedEmail, err := fieldEncrypt.Decrypt(raw.Email)
-		require.NoError(t, err)
-		require.Equal(t, "", decryptedEmail)
-
-		decryptedName, err := fieldEncrypt.Decrypt(raw.Name)
-		require.NoError(t, err)
-		require.Equal(t, "", decryptedName)
-	})
-
-	t.Run("save user with email and name", func(t *testing.T) {
-		user := &types.User{
-			Id:         "user-with-fields",
-			AccountID:  accountID,
-			Role:       types.UserRoleAdmin,
-			Email:      "test@example.com",
-			Name:       "Test User",
-			AutoGroups: []string{"groupB"},
-		}
-		err = store.SaveUser(context.Background(), user)
-		require.NoError(t, err)
-
-		// Verify using direct database query that the data is encrypted (not plaintext)
-		var raw rawUser
-		err = store.(*SqlStore).db.Table("users").Select("id, email, name").Where("id = ?", user.Id).First(&raw).Error
-		require.NoError(t, err)
-		require.NotEqual(t, "test@example.com", raw.Email, "email should be encrypted in database")
-		require.NotEqual(t, "Test User", raw.Name, "name should be encrypted in database")
-
-		// Verify manual decryption returns correct values
-		decryptedEmail, err := fieldEncrypt.Decrypt(raw.Email)
-		require.NoError(t, err)
-		require.Equal(t, "test@example.com", decryptedEmail)
-
-		decryptedName, err := fieldEncrypt.Decrypt(raw.Name)
-		require.NoError(t, err)
-		require.Equal(t, "Test User", decryptedName)
-	})
-
-	t.Run("save multiple users with mixed fields", func(t *testing.T) {
-		users := []*types.User{
-			{
-				Id:        "batch-user-1",
-				AccountID: accountID,
-				Email:     "",
-				Name:      "",
-			},
-			{
-				Id:        "batch-user-2",
-				AccountID: accountID,
-				Email:     "batch@example.com",
-				Name:      "Batch User",
-			},
-		}
-		err = store.SaveUsers(context.Background(), users)
-		require.NoError(t, err)
-
-		// Verify first user (empty fields) using direct database query
-		var raw1 rawUser
-		err = store.(*SqlStore).db.Table("users").Select("id, email, name").Where("id = ?", "batch-user-1").First(&raw1).Error
-		require.NoError(t, err)
-		require.Equal(t, "", raw1.Email, "empty email should remain empty in database")
-		require.Equal(t, "", raw1.Name, "empty name should remain empty in database")
-
-		// Verify second user (with fields) using direct database query
-		var raw2 rawUser
-		err = store.(*SqlStore).db.Table("users").Select("id, email, name").Where("id = ?", "batch-user-2").First(&raw2).Error
-		require.NoError(t, err)
-		require.NotEqual(t, "batch@example.com", raw2.Email, "email should be encrypted in database")
-		require.NotEqual(t, "Batch User", raw2.Name, "name should be encrypted in database")
-
-		// Verify manual decryption returns empty strings for first user
-		decryptedEmail1, err := fieldEncrypt.Decrypt(raw1.Email)
-		require.NoError(t, err)
-		require.Equal(t, "", decryptedEmail1)
-
-		decryptedName1, err := fieldEncrypt.Decrypt(raw1.Name)
-		require.NoError(t, err)
-		require.Equal(t, "", decryptedName1)
-
-		// Verify manual decryption returns correct values for second user
-		decryptedEmail2, err := fieldEncrypt.Decrypt(raw2.Email)
-		require.NoError(t, err)
-		require.Equal(t, "batch@example.com", decryptedEmail2)
-
-		decryptedName2, err := fieldEncrypt.Decrypt(raw2.Name)
-		require.NoError(t, err)
-		require.Equal(t, "Batch User", decryptedName2)
-	})
-}
-
-func TestSqlStore_DeleteUser(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	userID := "f4f6d672-63fb-11ec-90d6-0242ac120003"
-
-	err = store.DeleteUser(context.Background(), accountID, userID)
-	require.NoError(t, err)
-
-	user, err := store.GetUserByUserID(context.Background(), LockingStrengthNone, userID)
-	require.Error(t, err)
-	require.Nil(t, user)
-
-	userPATs, err := store.GetUserPATs(context.Background(), LockingStrengthNone, userID)
-	require.NoError(t, err)
-	require.Len(t, userPATs, 0)
-}
-
-func TestSqlStore_GetPATByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	userID := "f4f6d672-63fb-11ec-90d6-0242ac120003"
-
-	tests := []struct {
-		name        string
-		patID       string
-		expectError bool
-	}{
-		{
-			name:        "retrieve existing PAT",
-			patID:       "9dj38s35-63fb-11ec-90d6-0242ac120003",
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing PAT",
-			patID:       "non-existing",
-			expectError: true,
-		},
-		{
-			name:        "retrieve with empty PAT ID",
-			patID:       "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			pat, err := store.GetPATByID(context.Background(), LockingStrengthNone, userID, tt.patID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, pat)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, pat)
-				require.Equal(t, tt.patID, pat.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_GetUserPATs(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	userPATs, err := store.GetUserPATs(context.Background(), LockingStrengthNone, "f4f6d672-63fb-11ec-90d6-0242ac120003")
-	require.NoError(t, err)
-	require.Len(t, userPATs, 1)
-}
-
-func TestSqlStore_GetPATByHashedToken(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	pat, err := store.GetPATByHashedToken(context.Background(), LockingStrengthNone, "SoMeHaShEdToKeN")
-	require.NoError(t, err)
-	require.Equal(t, "9dj38s35-63fb-11ec-90d6-0242ac120003", pat.ID)
-}
-
-func TestSqlStore_MarkPATUsed(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	userID := "f4f6d672-63fb-11ec-90d6-0242ac120003"
-	patID := "9dj38s35-63fb-11ec-90d6-0242ac120003"
-
-	err = store.MarkPATUsed(context.Background(), patID)
-	require.NoError(t, err)
-
-	pat, err := store.GetPATByID(context.Background(), LockingStrengthNone, userID, patID)
-	require.NoError(t, err)
-	now := time.Now().UTC()
-	require.WithinRange(t, pat.LastUsed.UTC(), now.Add(-15*time.Second), now, "LastUsed should be within 1 second of now")
-}
-
-func TestSqlStore_SavePAT(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	userID := "edafee4e-63fb-11ec-90d6-0242ac120003"
-
-	pat := &types.PersonalAccessToken{
-		ID:             "pat-id",
-		UserID:         userID,
-		Name:           "token",
-		HashedToken:    "SoMeHaShEdToKeN",
-		ExpirationDate: util.ToPtr(time.Now().UTC().Add(12 * time.Hour)),
-		CreatedBy:      userID,
-		CreatedAt:      time.Now().UTC().Add(time.Hour),
-		LastUsed:       util.ToPtr(time.Now().UTC().Add(-15 * time.Minute)),
-	}
-	err = store.SavePAT(context.Background(), pat)
-	require.NoError(t, err)
-
-	savePAT, err := store.GetPATByID(context.Background(), LockingStrengthNone, userID, pat.ID)
-	require.NoError(t, err)
-	require.Equal(t, pat.ID, savePAT.ID)
-	require.Equal(t, pat.UserID, savePAT.UserID)
-	require.Equal(t, pat.HashedToken, savePAT.HashedToken)
-	require.Equal(t, pat.CreatedBy, savePAT.CreatedBy)
-	require.WithinDurationf(t, pat.GetExpirationDate(), savePAT.ExpirationDate.UTC(), time.Millisecond, "ExpirationDate should be equal")
-	require.WithinDurationf(t, pat.CreatedAt, savePAT.CreatedAt.UTC(), time.Millisecond, "CreatedAt should be equal")
-	require.WithinDurationf(t, pat.GetLastUsed(), savePAT.LastUsed.UTC(), time.Millisecond, "LastUsed should be equal")
-}
-
-func TestSqlStore_DeletePAT(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	userID := "f4f6d672-63fb-11ec-90d6-0242ac120003"
-	patID := "9dj38s35-63fb-11ec-90d6-0242ac120003"
-
-	err = store.DeletePAT(context.Background(), userID, patID)
-	require.NoError(t, err)
-
-	pat, err := store.GetPATByID(context.Background(), LockingStrengthNone, userID, patID)
-	require.Error(t, err)
-	require.Nil(t, pat)
-}
-
-func TestSqlStore_SaveUsers_LargeBatch(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	accountUsers, err := store.GetAccountUsers(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	require.Len(t, accountUsers, 2)
-
-	usersToSave := make([]*types.User, 0)
-
-	for i := 1; i <= 8000; i++ {
-		usersToSave = append(usersToSave, &types.User{
-			Id:        fmt.Sprintf("user-%d", i),
-			AccountID: accountID,
-			Role:      types.UserRoleUser,
-		})
-	}
-
-	err = store.SaveUsers(context.Background(), usersToSave)
-	require.NoError(t, err)
-
-	accountUsers, err = store.GetAccountUsers(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	require.Equal(t, 8002, len(accountUsers))
-}
-
-func TestSqlStore_SaveGroups_LargeBatch(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	accountGroups, err := store.GetAccountGroups(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	require.Len(t, accountGroups, 3)
-
-	groupsToSave := make([]*types.Group, 0)
-
-	for i := 1; i <= 8000; i++ {
-		groupsToSave = append(groupsToSave, &types.Group{
-			ID:        fmt.Sprintf("%d", i),
-			AccountID: accountID,
-			Name:      fmt.Sprintf("group-%d", i),
-		})
-	}
-
-	err = store.CreateGroups(context.Background(), accountID, groupsToSave)
-	require.NoError(t, err)
-
-	accountGroups, err = store.GetAccountGroups(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	require.Equal(t, 8003, len(accountGroups))
-}
-func TestSqlStore_GetAccountRoutes(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name          string
-		accountID     string
-		expectedCount int
-	}{
-		{
-			name:          "retrieve routes by existing account ID",
-			accountID:     "bf1c8084-ba50-4ce7-9439-34653001fc3b",
-			expectedCount: 1,
-		},
-		{
-			name:          "non-existing account ID",
-			accountID:     "nonexistent",
-			expectedCount: 0,
-		},
-		{
-			name:          "empty account ID",
-			accountID:     "",
-			expectedCount: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			routes, err := store.GetAccountRoutes(context.Background(), LockingStrengthNone, tt.accountID)
-			require.NoError(t, err)
-			require.Len(t, routes, tt.expectedCount)
-		})
-	}
-}
-
-func TestSqlStore_GetRouteByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	tests := []struct {
-		name        string
-		routeID     string
-		expectError bool
-	}{
-		{
-			name:        "retrieve existing route",
-			routeID:     "ct03t427qv97vmtmglog",
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing route",
-			routeID:     "non-existing",
-			expectError: true,
-		},
-		{
-			name:        "retrieve with empty route ID",
-			routeID:     "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			route, err := store.GetRouteByID(context.Background(), LockingStrengthNone, accountID, tt.routeID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, route)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, route)
-				require.Equal(t, tt.routeID, string(route.ID))
-			}
-		})
-	}
-}
-
-func TestSqlStore_SaveRoute(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	route := &nbroute.Route{
-		ID:                  "route-id",
-		AccountID:           accountID,
-		Network:             netip.MustParsePrefix("10.10.0.0/16"),
-		NetID:               "netID",
-		PeerGroups:          []string{"routeA"},
-		NetworkType:         nbroute.IPv4Network,
-		Masquerade:          true,
-		Metric:              9999,
-		Enabled:             true,
-		Groups:              []string{"groupA"},
-		AccessControlGroups: []string{},
-	}
-	err = store.SaveRoute(context.Background(), route)
-	require.NoError(t, err)
-
-	saveRoute, err := store.GetRouteByID(context.Background(), LockingStrengthNone, accountID, string(route.ID))
-	require.NoError(t, err)
-	require.Equal(t, route, saveRoute)
-
-}
-
-func TestSqlStore_DeleteRoute(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	routeID := "ct03t427qv97vmtmglog"
-
-	err = store.DeleteRoute(context.Background(), accountID, routeID)
-	require.NoError(t, err)
-
-	route, err := store.GetRouteByID(context.Background(), LockingStrengthNone, accountID, routeID)
-	require.Error(t, err)
-	require.Nil(t, route)
-}
-
-func TestSqlStore_GetAccountMeta(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	accountMeta, err := store.GetAccountMeta(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	require.NotNil(t, accountMeta)
-	require.Equal(t, accountID, accountMeta.AccountID)
-	require.Equal(t, "edafee4e-63fb-11ec-90d6-0242ac120003", accountMeta.CreatedBy)
-	require.Equal(t, "test.com", accountMeta.Domain)
-	require.Equal(t, "private", accountMeta.DomainCategory)
-	require.Equal(t, time.Date(2024, time.October, 2, 14, 1, 38, 210000000, time.UTC), accountMeta.CreatedAt.UTC())
-}
-
-func TestSqlStore_GetAccountOnboarding(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "9439-34653001fc3b-bf1c8084-ba50-4ce7"
-	a, err := store.GetAccount(context.Background(), accountID)
-	require.NoError(t, err)
-	t.Logf("Onboarding: %+v", a.Onboarding)
-	err = store.SaveAccount(context.Background(), a)
-	require.NoError(t, err)
-	onboarding, err := store.GetAccountOnboarding(context.Background(), accountID)
-	require.NoError(t, err)
-	require.NotNil(t, onboarding)
-	require.Equal(t, accountID, onboarding.AccountID)
-	require.Equal(t, time.Date(2024, time.October, 2, 14, 1, 38, 210000000, time.UTC), onboarding.CreatedAt.UTC())
-}
-
-func TestSqlStore_SaveAccountOnboarding(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-	t.Run("New onboarding should be saved correctly", func(t *testing.T) {
-		accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-		onboarding := &types.AccountOnboarding{
-			AccountID:             accountID,
-			SignupFormPending:     true,
-			OnboardingFlowPending: true,
-		}
-
-		err = store.SaveAccountOnboarding(context.Background(), onboarding)
-		require.NoError(t, err)
-
-		savedOnboarding, err := store.GetAccountOnboarding(context.Background(), accountID)
-		require.NoError(t, err)
-		require.Equal(t, onboarding.SignupFormPending, savedOnboarding.SignupFormPending)
-		require.Equal(t, onboarding.OnboardingFlowPending, savedOnboarding.OnboardingFlowPending)
-	})
-
-	t.Run("Existing onboarding should be updated correctly", func(t *testing.T) {
-		accountID := "9439-34653001fc3b-bf1c8084-ba50-4ce7"
-		onboarding, err := store.GetAccountOnboarding(context.Background(), accountID)
-		require.NoError(t, err)
-
-		onboarding.OnboardingFlowPending = !onboarding.OnboardingFlowPending
-		onboarding.SignupFormPending = !onboarding.SignupFormPending
-
-		err = store.SaveAccountOnboarding(context.Background(), onboarding)
-		require.NoError(t, err)
-
-		savedOnboarding, err := store.GetAccountOnboarding(context.Background(), accountID)
-		require.NoError(t, err)
-		require.Equal(t, onboarding.SignupFormPending, savedOnboarding.SignupFormPending)
-		require.Equal(t, onboarding.OnboardingFlowPending, savedOnboarding.OnboardingFlowPending)
-	})
-}
-
-func TestSqlStore_GetAnyAccountID(t *testing.T) {
-	t.Run("should return account ID when accounts exist", func(t *testing.T) {
-		store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-		t.Cleanup(cleanup)
-		require.NoError(t, err)
-
-		accountID, err := store.GetAnyAccountID(context.Background())
-		require.NoError(t, err)
-		assert.Equal(t, "bf1c8084-ba50-4ce7-9439-34653001fc3b", accountID)
-	})
-
-	t.Run("should return error when no accounts exist", func(t *testing.T) {
-		store, cleanup, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-		t.Cleanup(cleanup)
-		require.NoError(t, err)
-
-		accountID, err := store.GetAnyAccountID(context.Background())
-		require.Error(t, err)
-		sErr, ok := status.FromError(err)
-		assert.True(t, ok)
-		assert.Equal(t, sErr.Type(), status.NotFound)
-		assert.Empty(t, accountID)
-	})
-}
-
-func BenchmarkGetAccountPeers(b *testing.B) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", b.TempDir())
-	if err != nil {
-		b.Fatal(err)
-	}
-	b.Cleanup(cleanup)
-
-	numberOfPeers := 1000
-	numberOfGroups := 200
-	numberOfPeersPerGroup := 500
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	peers := make([]*nbpeer.Peer, 0, numberOfPeers)
-	for i := 0; i < numberOfPeers; i++ {
-		peer := &nbpeer.Peer{
-			ID:        fmt.Sprintf("peer-%d", i),
-			AccountID: accountID,
-			Key:       fmt.Sprintf("key-%d", i),
-			DNSLabel:  fmt.Sprintf("peer%d.example.com", i),
-			IP:        intToIPv4(uint32(i)),
-		}
-		err = store.AddPeerToAccount(context.Background(), peer)
-		if err != nil {
-			b.Fatalf("Failed to add peer: %v", err)
-		}
-		peers = append(peers, peer)
-	}
-
-	for i := 0; i < numberOfGroups; i++ {
-		groupID := fmt.Sprintf("group-%d", i)
-		group := &types.Group{
-			ID:        groupID,
-			AccountID: accountID,
-		}
-		err = store.CreateGroup(context.Background(), group)
-		if err != nil {
-			b.Fatalf("Failed to create group: %v", err)
-		}
-		for j := 0; j < numberOfPeersPerGroup; j++ {
-			peerIndex := (i*numberOfPeersPerGroup + j) % numberOfPeers
-			err = store.AddPeerToGroup(context.Background(), accountID, peers[peerIndex].ID, groupID)
-			if err != nil {
-				b.Fatalf("Failed to add peer to group: %v", err)
-			}
-		}
-	}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_, err := store.GetPeerGroups(context.Background(), LockingStrengthNone, accountID, peers[i%numberOfPeers].ID)
-		if err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func intToIPv4(n uint32) netip.Addr {
-	var b [4]byte
-	binary.BigEndian.PutUint32(b[:], n)
-	return netip.AddrFrom4(b)
-}
-
-func TestSqlStore_GetPeersByGroupIDs(t *testing.T) {
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	group1ID := "test-group-1"
-	group2ID := "test-group-2"
-	emptyGroupID := "empty-group"
-
-	peer1 := "cfefqs706sqkneg59g4g"
-	peer2 := "cfeg6sf06sqkneg59g50"
-
-	tests := []struct {
-		name          string
-		groupIDs      []string
-		expectedPeers []string
-		expectedCount int
-	}{
-		{
-			name:          "retrieve peers from single group with multiple peers",
-			groupIDs:      []string{group1ID},
-			expectedPeers: []string{peer1, peer2},
-			expectedCount: 2,
-		},
-		{
-			name:          "retrieve peers from single group with one peer",
-			groupIDs:      []string{group2ID},
-			expectedPeers: []string{peer1},
-			expectedCount: 1,
-		},
-		{
-			name:          "retrieve peers from multiple groups (with overlap)",
-			groupIDs:      []string{group1ID, group2ID},
-			expectedPeers: []string{peer1, peer2}, // should deduplicate
-			expectedCount: 2,
-		},
-		{
-			name:          "retrieve peers from existing 'All' group",
-			groupIDs:      []string{"cfefqs706sqkneg59g3g"}, // All group from test data
-			expectedPeers: []string{peer1, peer2},
-			expectedCount: 2,
-		},
-		{
-			name:          "retrieve peers from empty group",
-			groupIDs:      []string{emptyGroupID},
-			expectedPeers: []string{},
-			expectedCount: 0,
-		},
-		{
-			name:          "retrieve peers from non-existing group",
-			groupIDs:      []string{"non-existing-group"},
-			expectedPeers: []string{},
-			expectedCount: 0,
-		},
-		{
-			name:          "empty group IDs list",
-			groupIDs:      []string{},
-			expectedPeers: []string{},
-			expectedCount: 0,
-		},
-		{
-			name:          "mix of existing and non-existing groups",
-			groupIDs:      []string{group1ID, "non-existing-group"},
-			expectedPeers: []string{peer1, peer2},
-			expectedCount: 2,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_policy_migrate.sql", t.TempDir())
-			t.Cleanup(cleanup)
-			require.NoError(t, err)
-
-			ctx := context.Background()
-
-			groups := []*types.Group{
-				{
-					ID:        group1ID,
-					AccountID: accountID,
-				},
-				{
-					ID:        group2ID,
-					AccountID: accountID,
-				},
-			}
-			require.NoError(t, store.CreateGroups(ctx, accountID, groups))
-
-			require.NoError(t, store.AddPeerToGroup(ctx, accountID, peer1, group1ID))
-			require.NoError(t, store.AddPeerToGroup(ctx, accountID, peer2, group1ID))
-			require.NoError(t, store.AddPeerToGroup(ctx, accountID, peer1, group2ID))
-
-			peers, err := store.GetPeersByGroupIDs(ctx, accountID, tt.groupIDs)
-			require.NoError(t, err)
-			require.Len(t, peers, tt.expectedCount)
-
-			if tt.expectedCount > 0 {
-				actualPeerIDs := make([]string, len(peers))
-				for i, peer := range peers {
-					actualPeerIDs[i] = peer.ID
-				}
-				assert.ElementsMatch(t, tt.expectedPeers, actualPeerIDs)
-
-				// Verify all returned peers belong to the correct account
-				for _, peer := range peers {
-					assert.Equal(t, accountID, peer.AccountID)
-				}
-			}
-		})
-	}
-}
-
-func TestSqlStore_GetUserIDByPeerKey(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	userID := "test-user-123"
-	peerKey := "peer-key-abc"
-
-	peer := &nbpeer.Peer{
-		ID:        "test-peer-1",
-		Key:       peerKey,
-		AccountID: existingAccountID,
-		UserID:    userID,
-		IP:        netip.AddrFrom4([4]byte{10, 0, 0, 1}),
-		IPv6:      netip.MustParseAddr("fd00::a00:1"),
-		DNSLabel:  "test-peer-1",
-	}
-
-	err = store.AddPeerToAccount(context.Background(), peer)
-	require.NoError(t, err)
-
-	retrievedUserID, err := store.GetUserIDByPeerKey(context.Background(), LockingStrengthNone, peerKey)
-	require.NoError(t, err)
-	assert.Equal(t, userID, retrievedUserID)
-}
-
-func TestSqlStore_GetUserIDByPeerKey_NotFound(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	nonExistentPeerKey := "non-existent-peer-key"
-
-	userID, err := store.GetUserIDByPeerKey(context.Background(), LockingStrengthNone, nonExistentPeerKey)
-	require.Error(t, err)
-	assert.Equal(t, "", userID)
-}
-
-func TestSqlStore_GetUserIDByPeerKey_NoUserID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	peerKey := "peer-key-abc"
-
-	peer := &nbpeer.Peer{
-		ID:        "test-peer-1",
-		Key:       peerKey,
-		AccountID: existingAccountID,
-		UserID:    "",
-		IP:        netip.AddrFrom4([4]byte{10, 0, 0, 1}),
-		IPv6:      netip.MustParseAddr("fd00::a00:1"),
-		DNSLabel:  "test-peer-1",
-	}
-
-	err = store.AddPeerToAccount(context.Background(), peer)
-	require.NoError(t, err)
-
-	retrievedUserID, err := store.GetUserIDByPeerKey(context.Background(), LockingStrengthNone, peerKey)
-	require.NoError(t, err)
-	assert.Equal(t, "", retrievedUserID)
-}
-
-func TestSqlStore_ApproveAccountPeers(t *testing.T) {
-	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
-		accountID := "test-account"
-		ctx := context.Background()
-
-		account := newAccountWithId(ctx, accountID, "testuser", "example.com")
-		err := store.SaveAccount(ctx, account)
-		require.NoError(t, err)
-
-		peers := []*nbpeer.Peer{
-			{
-				ID:        "peer1",
-				AccountID: accountID,
-				DNSLabel:  "peer1.netbird.cloud",
-				Key:       "peer1-key",
-				IP:        netip.MustParseAddr("100.64.0.1"),
-				IPv6:      netip.MustParseAddr("fd00::1"),
-				Status: &nbpeer.PeerStatus{
-					RequiresApproval: true,
-					LastSeen:         time.Now().UTC(),
-				},
-			},
-			{
-				ID:        "peer2",
-				AccountID: accountID,
-				DNSLabel:  "peer2.netbird.cloud",
-				Key:       "peer2-key",
-				IP:        netip.MustParseAddr("100.64.0.2"),
-				IPv6:      netip.MustParseAddr("fd00::2"),
-				Status: &nbpeer.PeerStatus{
-					RequiresApproval: true,
-					LastSeen:         time.Now().UTC(),
-				},
-			},
-			{
-				ID:        "peer3",
-				AccountID: accountID,
-				DNSLabel:  "peer3.netbird.cloud",
-				Key:       "peer3-key",
-				IP:        netip.MustParseAddr("100.64.0.3"),
-				IPv6:      netip.MustParseAddr("fd00::3"),
-				Status: &nbpeer.PeerStatus{
-					RequiresApproval: false,
-					LastSeen:         time.Now().UTC(),
-				},
-			},
-		}
-
-		for _, peer := range peers {
-			err = store.AddPeerToAccount(ctx, peer)
-			require.NoError(t, err)
-		}
-
-		t.Run("approve all pending peers", func(t *testing.T) {
-			count, err := store.ApproveAccountPeers(ctx, accountID)
-			require.NoError(t, err)
-			assert.Equal(t, 2, count)
-
-			allPeers, err := store.GetAccountPeers(ctx, LockingStrengthNone, accountID, "", "")
-			require.NoError(t, err)
-
-			for _, peer := range allPeers {
-				assert.False(t, peer.Status.RequiresApproval, "peer %s should not require approval", peer.ID)
-			}
-		})
-
-		t.Run("no peers to approve", func(t *testing.T) {
-			count, err := store.ApproveAccountPeers(ctx, accountID)
-			require.NoError(t, err)
-			assert.Equal(t, 0, count)
-		})
-
-		t.Run("non-existent account", func(t *testing.T) {
-			count, err := store.ApproveAccountPeers(ctx, "non-existent")
-			require.NoError(t, err)
-			assert.Equal(t, 0, count)
-		})
-	})
-}
-
 func TestSqlStore_ExecuteInTransaction_Timeout(t *testing.T) {
 	if os.Getenv("NETBIRD_STORE_ENGINE") == "mysql" {
 		t.Skip("Skipping timeout test for MySQL")
@@ -4109,7 +364,6 @@ func TestSqlStore_ExecuteInTransaction_Timeout(t *testing.T) {
 
 	sqlStore, ok := store.(*SqlStore)
 	require.True(t, ok)
-	assert.Equal(t, 1*time.Second, sqlStore.transactionTimeout)
 
 	ctx := context.Background()
 	err = sqlStore.ExecuteInTransaction(ctx, func(transaction Store) error {
@@ -4123,479 +377,6 @@ func TestSqlStore_ExecuteInTransaction_Timeout(t *testing.T) {
 	assert.Contains(t, err.Error(), "transaction has already been committed or rolled back", "expected transaction rolled back error, got: %v", err)
 }
 
-func TestSqlStore_CreateZone(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	savedZone, err := store.GetZoneByID(context.Background(), LockingStrengthNone, accountID, zone.ID)
-	require.NoError(t, err)
-	require.NotNil(t, savedZone)
-	assert.Equal(t, zone.ID, savedZone.ID)
-	assert.Equal(t, zone.Name, savedZone.Name)
-	assert.Equal(t, zone.Domain, savedZone.Domain)
-	assert.Equal(t, zone.Enabled, savedZone.Enabled)
-	assert.Equal(t, zone.EnableSearchDomain, savedZone.EnableSearchDomain)
-	assert.Equal(t, zone.DistributionGroups, savedZone.DistributionGroups)
-}
-
-func TestSqlStore_GetZoneByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name        string
-		accountID   string
-		zoneID      string
-		expectError bool
-	}{
-		{
-			name:        "retrieve existing zone",
-			accountID:   accountID,
-			zoneID:      zone.ID,
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing zone",
-			accountID:   accountID,
-			zoneID:      "non-existing",
-			expectError: true,
-		},
-		{
-			name:        "retrieve with empty zone ID",
-			accountID:   accountID,
-			zoneID:      "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			savedZone, err := store.GetZoneByID(context.Background(), LockingStrengthNone, tt.accountID, tt.zoneID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, savedZone)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, savedZone)
-				assert.Equal(t, tt.zoneID, savedZone.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_GetAccountZones(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone1 := zones.NewZone(accountID, "Zone 1", "example1.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone1)
-	require.NoError(t, err)
-
-	zone2 := zones.NewZone(accountID, "Zone 2", "example2.com", true, true, []string{"group1", "group2"})
-	err = store.CreateZone(context.Background(), zone2)
-	require.NoError(t, err)
-
-	allZones, err := store.GetAccountZones(context.Background(), LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	require.NotNil(t, allZones)
-	assert.GreaterOrEqual(t, len(allZones), 2)
-
-	zoneIDs := make(map[string]bool)
-	for _, z := range allZones {
-		zoneIDs[z.ID] = true
-	}
-	assert.True(t, zoneIDs[zone1.ID])
-	assert.True(t, zoneIDs[zone2.ID])
-}
-
-func TestSqlStore_GetZoneByDomain(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	otherAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3c"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name        string
-		accountID   string
-		domain      string
-		expectError bool
-		errorType   status.Type
-	}{
-		{
-			name:        "retrieve existing zone by domain",
-			accountID:   accountID,
-			domain:      "example.com",
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing zone domain",
-			accountID:   accountID,
-			domain:      "non-existing.com",
-			expectError: true,
-			errorType:   status.NotFound,
-		},
-		{
-			name:        "retrieve with empty domain",
-			accountID:   accountID,
-			domain:      "",
-			expectError: true,
-			errorType:   status.NotFound,
-		},
-		{
-			name:        "retrieve with different account ID",
-			accountID:   otherAccountID,
-			domain:      "example.com",
-			expectError: true,
-			errorType:   status.NotFound,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			savedZone, err := store.GetZoneByDomain(context.Background(), tt.accountID, tt.domain)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, tt.errorType, sErr.Type())
-				require.Nil(t, savedZone)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, savedZone)
-				assert.Equal(t, tt.domain, savedZone.Domain)
-				assert.Equal(t, zone.ID, savedZone.ID)
-				assert.Equal(t, zone.Name, savedZone.Name)
-			}
-		})
-	}
-}
-
-func TestSqlStore_UpdateZone(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	zone.Name = "Updated Zone"
-	zone.Domain = "updated.com"
-	zone.Enabled = false
-	zone.EnableSearchDomain = true
-	zone.DistributionGroups = []string{"group2", "group3"}
-
-	err = store.UpdateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	updatedZone, err := store.GetZoneByID(context.Background(), LockingStrengthNone, accountID, zone.ID)
-	require.NoError(t, err)
-	require.NotNil(t, updatedZone)
-	assert.Equal(t, "Updated Zone", updatedZone.Name)
-	assert.Equal(t, "updated.com", updatedZone.Domain)
-	assert.False(t, updatedZone.Enabled)
-	assert.True(t, updatedZone.EnableSearchDomain)
-	assert.Equal(t, []string{"group2", "group3"}, updatedZone.DistributionGroups)
-}
-
-func TestSqlStore_DeleteZone(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	err = store.DeleteZone(context.Background(), accountID, zone.ID)
-	require.NoError(t, err)
-
-	deletedZone, err := store.GetZoneByID(context.Background(), LockingStrengthNone, accountID, zone.ID)
-	require.Error(t, err)
-	require.Nil(t, deletedZone)
-	sErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, sErr.Type(), status.NotFound)
-}
-
-func TestSqlStore_CreateDNSRecord(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	record := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
-
-	err = store.CreateDNSRecord(context.Background(), record)
-	require.NoError(t, err)
-
-	savedRecord, err := store.GetDNSRecordByID(context.Background(), LockingStrengthNone, accountID, zone.ID, record.ID)
-	require.NoError(t, err)
-	require.NotNil(t, savedRecord)
-	assert.Equal(t, record.ID, savedRecord.ID)
-	assert.Equal(t, record.Name, savedRecord.Name)
-	assert.Equal(t, record.Type, savedRecord.Type)
-	assert.Equal(t, record.Content, savedRecord.Content)
-	assert.Equal(t, record.TTL, savedRecord.TTL)
-	assert.Equal(t, zone.ID, savedRecord.ZoneID)
-}
-
-func TestSqlStore_GetDNSRecordByID(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	record := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
-	err = store.CreateDNSRecord(context.Background(), record)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name        string
-		accountID   string
-		zoneID      string
-		recordID    string
-		expectError bool
-	}{
-		{
-			name:        "retrieve existing record",
-			accountID:   accountID,
-			zoneID:      zone.ID,
-			recordID:    record.ID,
-			expectError: false,
-		},
-		{
-			name:        "retrieve non-existing record",
-			accountID:   accountID,
-			zoneID:      zone.ID,
-			recordID:    "non-existing",
-			expectError: true,
-		},
-		{
-			name:        "retrieve with empty record ID",
-			accountID:   accountID,
-			zoneID:      zone.ID,
-			recordID:    "",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			savedRecord, err := store.GetDNSRecordByID(context.Background(), LockingStrengthNone, tt.accountID, tt.zoneID, tt.recordID)
-			if tt.expectError {
-				require.Error(t, err)
-				sErr, ok := status.FromError(err)
-				require.True(t, ok)
-				require.Equal(t, sErr.Type(), status.NotFound)
-				require.Nil(t, savedRecord)
-			} else {
-				require.NoError(t, err)
-				require.NotNil(t, savedRecord)
-				assert.Equal(t, tt.recordID, savedRecord.ID)
-			}
-		})
-	}
-}
-
-func TestSqlStore_GetZoneDNSRecords(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	recordA := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
-	err = store.CreateDNSRecord(context.Background(), recordA)
-	require.NoError(t, err)
-
-	recordAAAA := records.NewRecord(accountID, zone.ID, "ipv6.example.com", records.RecordTypeAAAA, "2001:db8::1", 300)
-	err = store.CreateDNSRecord(context.Background(), recordAAAA)
-	require.NoError(t, err)
-
-	recordCNAME := records.NewRecord(accountID, zone.ID, "alias.example.com", records.RecordTypeCNAME, "www.example.com", 300)
-	err = store.CreateDNSRecord(context.Background(), recordCNAME)
-	require.NoError(t, err)
-
-	allRecords, err := store.GetZoneDNSRecords(context.Background(), LockingStrengthNone, accountID, zone.ID)
-	require.NoError(t, err)
-	require.NotNil(t, allRecords)
-	assert.Equal(t, 3, len(allRecords))
-
-	recordIDs := make(map[string]bool)
-	for _, r := range allRecords {
-		recordIDs[r.ID] = true
-	}
-	assert.True(t, recordIDs[recordA.ID])
-	assert.True(t, recordIDs[recordAAAA.ID])
-	assert.True(t, recordIDs[recordCNAME.ID])
-}
-
-func TestSqlStore_GetZoneDNSRecordsByName(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	record1 := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
-	err = store.CreateDNSRecord(context.Background(), record1)
-	require.NoError(t, err)
-
-	record2 := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeAAAA, "2001:db8::1", 300)
-	err = store.CreateDNSRecord(context.Background(), record2)
-	require.NoError(t, err)
-
-	record3 := records.NewRecord(accountID, zone.ID, "mail.example.com", records.RecordTypeA, "192.168.1.2", 600)
-	err = store.CreateDNSRecord(context.Background(), record3)
-	require.NoError(t, err)
-
-	recordsByName, err := store.GetZoneDNSRecordsByName(context.Background(), LockingStrengthNone, accountID, zone.ID, "www.example.com")
-	require.NoError(t, err)
-	require.NotNil(t, recordsByName)
-	assert.Equal(t, 2, len(recordsByName))
-
-	for _, r := range recordsByName {
-		assert.Equal(t, "www.example.com", r.Name)
-	}
-}
-
-func TestSqlStore_UpdateDNSRecord(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	record := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
-	err = store.CreateDNSRecord(context.Background(), record)
-	require.NoError(t, err)
-
-	record.Name = "api.example.com"
-	record.Content = "192.168.1.100"
-	record.TTL = 600
-
-	err = store.UpdateDNSRecord(context.Background(), record)
-	require.NoError(t, err)
-
-	updatedRecord, err := store.GetDNSRecordByID(context.Background(), LockingStrengthNone, accountID, zone.ID, record.ID)
-	require.NoError(t, err)
-	require.NotNil(t, updatedRecord)
-	assert.Equal(t, "api.example.com", updatedRecord.Name)
-	assert.Equal(t, "192.168.1.100", updatedRecord.Content)
-	assert.Equal(t, 600, updatedRecord.TTL)
-}
-
-func TestSqlStore_DeleteDNSRecord(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	record := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
-	err = store.CreateDNSRecord(context.Background(), record)
-	require.NoError(t, err)
-
-	err = store.DeleteDNSRecord(context.Background(), accountID, zone.ID, record.ID)
-	require.NoError(t, err)
-
-	deletedRecord, err := store.GetDNSRecordByID(context.Background(), LockingStrengthNone, accountID, zone.ID, record.ID)
-	require.Error(t, err)
-	require.Nil(t, deletedRecord)
-	sErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, sErr.Type(), status.NotFound)
-}
-
-func TestSqlStore_DeleteZoneDNSRecords(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
-	err = store.CreateZone(context.Background(), zone)
-	require.NoError(t, err)
-
-	record1 := records.NewRecord(accountID, zone.ID, "www.example.com", records.RecordTypeA, "192.168.1.1", 300)
-	err = store.CreateDNSRecord(context.Background(), record1)
-	require.NoError(t, err)
-
-	record2 := records.NewRecord(accountID, zone.ID, "mail.example.com", records.RecordTypeA, "192.168.1.2", 600)
-	err = store.CreateDNSRecord(context.Background(), record2)
-	require.NoError(t, err)
-
-	allRecords, err := store.GetZoneDNSRecords(context.Background(), LockingStrengthNone, accountID, zone.ID)
-	require.NoError(t, err)
-	assert.Equal(t, 2, len(allRecords))
-
-	err = store.DeleteZoneDNSRecords(context.Background(), accountID, zone.ID)
-	require.NoError(t, err)
-
-	remainingRecords, err := store.GetZoneDNSRecords(context.Background(), LockingStrengthNone, accountID, zone.ID)
-	require.NoError(t, err)
-	assert.Equal(t, 0, len(remainingRecords))
-}
-
 // TestNewSqliteStore_BusyTimeoutApplied opens a fresh SQLite store and verifies
 // that the _busy_timeout DSN parameter took effect at the driver level. Without
 // this, lock contention on the single SQLite connection waits indefinitely on
@@ -4647,3 +428,88 @@ func TestNewSqliteStore_BusyTimeoutRespectsUserOverride(t *testing.T) {
 		})
 	}
 }
+
+func TestSqlStore_ExecuteInTransaction_RestoresForeignKeyChecksOnMysql(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		sqlStore := store.(*SqlStore)
+		if sqlStore.conn.Engine() != types.MysqlStoreEngine {
+			t.Skip("FOREIGN_KEY_CHECKS is MySQL specific")
+		}
+		sqlDB, err := sqlStore.GetDB().DB()
+		require.NoError(t, err)
+		sqlDB.SetMaxOpenConns(1)
+		ctx := context.Background()
+
+		foreignKeyChecks := func() int {
+			var enabled int
+			require.NoError(t, sqlStore.GetDB().Raw("SELECT @@SESSION.foreign_key_checks").Scan(&enabled).Error)
+			return enabled
+		}
+
+		err = store.ExecuteInTransaction(ctx, func(Store) error { return assert.AnError })
+		require.ErrorIs(t, err, assert.AnError)
+		assert.Equal(t, 1, foreignKeyChecks())
+
+		require.Panics(t, func() {
+			_ = store.ExecuteInTransaction(ctx, func(Store) error { panic("boom") })
+		})
+		assert.Equal(t, 1, foreignKeyChecks())
+
+		err = sqlStore.transaction(ctx, func(*gorm.DB) error { return assert.AnError })
+		require.ErrorIs(t, err, assert.AnError)
+		assert.Equal(t, 1, foreignKeyChecks())
+
+		err = store.ExecuteInTransaction(ctx, func(transaction Store) error {
+			bound := transaction.(*SqlStore)
+			require.NoError(t, bound.transaction(ctx, func(*gorm.DB) error { return nil }))
+			var enabled int
+			require.NoError(t, bound.GetDB().Raw("SELECT @@SESSION.foreign_key_checks").Scan(&enabled).Error)
+			assert.Equal(t, 0, enabled, "a savepoint must not re-enable FK checks for the rest of the transaction")
+			return nil
+		})
+		require.NoError(t, err)
+		assert.Equal(t, 1, foreignKeyChecks())
+	})
+}
+
+func TestSqlStore_Transaction_RollsBackOnError(t *testing.T) {
+	runTestForAllEngines(t, "../testdata/extended-store.sql", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+		group := &types.Group{ID: "rolled-back-group", AccountID: accountID, Name: "rolled back", Issued: "api"}
+
+		err := store.(*SqlStore).transaction(ctx, func(tx *gorm.DB) error {
+			require.NoError(t, tx.Omit(clause.Associations).Create(group).Error)
+			return assert.AnError
+		})
+		require.ErrorIs(t, err, assert.AnError)
+
+		_, err = store.GetGroupByID(ctx, LockingStrengthNone, accountID, group.ID)
+		require.Error(t, err)
+	})
+}
+
+func TestSqlStore_Transaction_NestedIsSavepoint(t *testing.T) {
+	runTestForAllEngines(t, "../testdata/extended-store.sql", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+		outer := &types.Group{ID: "outer-group", AccountID: accountID, Name: "outer", Issued: "api"}
+		inner := &types.Group{ID: "inner-group", AccountID: accountID, Name: "inner", Issued: "api"}
+
+		err := store.ExecuteInTransaction(ctx, func(transaction Store) error {
+			require.NoError(t, transaction.CreateGroup(ctx, outer))
+			err := transaction.(*SqlStore).transaction(ctx, func(tx *gorm.DB) error {
+				require.NoError(t, tx.Omit(clause.Associations).Create(inner).Error)
+				return assert.AnError
+			})
+			require.ErrorIs(t, err, assert.AnError)
+			return nil
+		})
+		require.NoError(t, err)
+
+		_, err = store.GetGroupByID(ctx, LockingStrengthNone, accountID, outer.ID)
+		require.NoError(t, err)
+		_, err = store.GetGroupByID(ctx, LockingStrengthNone, accountID, inner.ID)
+		require.Error(t, err)
+	})
+}
diff --git a/management/server/store/sql_store_user.go b/management/server/store/sql_store_user.go
new file mode 100644
index 000000000..4db03fb71
--- /dev/null
+++ b/management/server/store/sql_store_user.go
@@ -0,0 +1,272 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// SaveUsers saves the given list of users to the database.
+func (s *SqlStore) SaveUsers(ctx context.Context, users []*types.User) error {
+	if len(users) == 0 {
+		return nil
+	}
+
+	usersCopy := make([]*types.User, len(users))
+	for i, user := range users {
+		userCopy := user.Copy()
+		userCopy.Email = user.Email
+		userCopy.Name = user.Name
+		if err := userCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
+			return fmt.Errorf("encrypt user: %w", err)
+		}
+		usersCopy[i] = userCopy
+	}
+
+	result := s.db.Clauses(clause.OnConflict{UpdateAll: true}).Create(&usersCopy)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save users to store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to save users to store")
+	}
+	return nil
+}
+
+// SaveUser saves the given user to the database.
+func (s *SqlStore) SaveUser(ctx context.Context, user *types.User) error {
+	userCopy := user.Copy()
+	userCopy.Email = user.Email
+	userCopy.Name = user.Name
+
+	if err := userCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
+		return fmt.Errorf("encrypt user: %w", err)
+	}
+
+	result := s.db.Save(userCopy)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save user to store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to save user to store")
+	}
+	return nil
+}
+
+func (s *SqlStore) GetUserByPATID(ctx context.Context, lockStrength LockingStrength, patID string) (*types.User, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var user types.User
+	result := tx.
+		Joins("JOIN personal_access_tokens ON personal_access_tokens.user_id = users.id").
+		Where("personal_access_tokens.id = ?", patID).Take(&user)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewPATNotFoundError(patID)
+		}
+		log.WithContext(ctx).Errorf("failed to get token user from the store: %s", result.Error)
+		return nil, status.NewGetUserFromStoreError()
+	}
+
+	if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+		return nil, fmt.Errorf("decrypt user: %w", err)
+	}
+
+	return &user, nil
+}
+
+func (s *SqlStore) GetUserByUserID(ctx context.Context, lockStrength LockingStrength, userID string) (*types.User, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var user types.User
+	result := tx.Take(&user, idQueryCondition, userID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewUserNotFoundError(userID)
+		}
+		return nil, status.NewGetUserFromStoreError()
+	}
+
+	if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+		return nil, fmt.Errorf("decrypt user: %w", err)
+	}
+
+	return &user, nil
+}
+
+func (s *SqlStore) DeleteUser(ctx context.Context, accountID, userID string) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
+		result := tx.Delete(&types.PersonalAccessToken{}, "user_id = ?", userID)
+		if result.Error != nil {
+			return result.Error
+		}
+
+		return tx.Delete(&types.User{}, accountAndIDQueryCondition, accountID, userID).Error
+	})
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to delete user from the store: %s", err)
+		return status.Errorf(status.Internal, "failed to delete user from store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) GetAccountUsers(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.User, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var users []*types.User
+	result := tx.Find(&users, accountIDCondition, accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "accountID not found: index lookup failed")
+		}
+		log.WithContext(ctx).Errorf("error when getting users from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "issue getting users from store")
+	}
+
+	for _, user := range users {
+		if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+			return nil, fmt.Errorf("decrypt user: %w", err)
+		}
+	}
+
+	return users, nil
+}
+
+func (s *SqlStore) GetAccountOwner(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.User, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var user types.User
+	result := tx.Take(&user, "account_id = ? AND role = ?", accountID, types.UserRoleOwner)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "account owner not found: index lookup failed")
+		}
+		return nil, status.Errorf(status.Internal, "failed to get account owner from the store")
+	}
+
+	if err := user.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+		return nil, fmt.Errorf("decrypt user: %w", err)
+	}
+
+	return &user, nil
+}
+
+func (s *SqlStore) getUsers(ctx context.Context, accountID string) ([]types.User, error) {
+	const query = `SELECT id, account_id, role, is_service_user, non_deletable, service_user_name, auto_groups, blocked, pending_approval, last_login, created_at, issued, integration_ref_id, integration_ref_integration_type, email, name FROM users WHERE account_id = $1`
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
+	if err != nil {
+		return nil, err
+	}
+	users, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (types.User, error) {
+		var u types.User
+		var autoGroups []byte
+		var lastLogin, createdAt sql.NullTime
+		var isServiceUser, nonDeletable, blocked, pendingApproval sql.NullBool
+		err := row.Scan(&u.Id, &u.AccountID, &u.Role, &isServiceUser, &nonDeletable, &u.ServiceUserName, &autoGroups, &blocked, &pendingApproval, &lastLogin, &createdAt, &u.Issued, &u.IntegrationReference.ID, &u.IntegrationReference.IntegrationType, &u.Email, &u.Name)
+		if err == nil {
+			if lastLogin.Valid {
+				u.LastLogin = &lastLogin.Time
+			}
+			if createdAt.Valid {
+				u.CreatedAt = createdAt.Time
+			}
+			if isServiceUser.Valid {
+				u.IsServiceUser = isServiceUser.Bool
+			}
+			if nonDeletable.Valid {
+				u.NonDeletable = nonDeletable.Bool
+			}
+			if blocked.Valid {
+				u.Blocked = blocked.Bool
+			}
+			if pendingApproval.Valid {
+				u.PendingApproval = pendingApproval.Bool
+			}
+			if autoGroups != nil {
+				_ = json.Unmarshal(autoGroups, &u.AutoGroups)
+			} else {
+				u.AutoGroups = []string{}
+			}
+		}
+		return u, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	return users, nil
+}
+
+func (s *SqlStore) GetAccountByUser(ctx context.Context, userID string) (*types.Account, error) {
+	var user types.User
+	result := s.db.Select("account_id").Take(&user, idQueryCondition, userID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
+		}
+		return nil, status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	if user.AccountID == "" {
+		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
+	}
+
+	return s.GetAccount(ctx, user.AccountID)
+}
+
+func (s *SqlStore) GetAccountIDByUserID(ctx context.Context, lockStrength LockingStrength, userID string) (string, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var accountID string
+	result := tx.Model(&types.User{}).
+		Select("account_id").Where(idQueryCondition, userID).Take(&accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
+		}
+		return "", status.NewGetAccountFromStoreError(result.Error)
+	}
+
+	return accountID, nil
+}
+
+// SaveUserLastLogin stores the last login time for a user in DB.
+func (s *SqlStore) SaveUserLastLogin(ctx context.Context, accountID, userID string, lastLogin time.Time) error {
+	var user types.User
+	result := s.db.Take(&user, accountAndIDQueryCondition, accountID, userID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return status.NewUserNotFoundError(userID)
+		}
+		return status.NewGetUserFromStoreError()
+	}
+
+	if !lastLogin.IsZero() {
+		user.LastLogin = &lastLogin
+		return s.db.Save(&user).Error
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_user_invite.go b/management/server/store/sql_store_user_invite.go
new file mode 100644
index 000000000..3c93a0d19
--- /dev/null
+++ b/management/server/store/sql_store_user_invite.go
@@ -0,0 +1,139 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// SaveUserInvite saves a user invite to the database
+func (s *SqlStore) SaveUserInvite(ctx context.Context, invite *types.UserInviteRecord) error {
+	inviteCopy := invite.Copy()
+	if err := inviteCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
+		return fmt.Errorf("encrypt invite: %w", err)
+	}
+
+	result := s.db.Save(inviteCopy)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save user invite to store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to save user invite to store")
+	}
+	return nil
+}
+
+// GetUserInviteByID retrieves a user invite by its ID and account ID
+func (s *SqlStore) GetUserInviteByID(ctx context.Context, lockStrength LockingStrength, accountID, inviteID string) (*types.UserInviteRecord, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var invite types.UserInviteRecord
+	result := tx.Where("account_id = ?", accountID).Take(&invite, idQueryCondition, inviteID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "user invite not found")
+		}
+		log.WithContext(ctx).Errorf("failed to get user invite from store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get user invite from store")
+	}
+
+	if err := invite.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+		return nil, fmt.Errorf("decrypt invite: %w", err)
+	}
+
+	return &invite, nil
+}
+
+// GetUserInviteByHashedToken retrieves a user invite by its hashed token
+func (s *SqlStore) GetUserInviteByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken string) (*types.UserInviteRecord, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var invite types.UserInviteRecord
+	result := tx.Take(&invite, "hashed_token = ?", hashedToken)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "user invite not found")
+		}
+		log.WithContext(ctx).Errorf("failed to get user invite from store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get user invite from store")
+	}
+
+	if err := invite.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+		return nil, fmt.Errorf("decrypt invite: %w", err)
+	}
+
+	return &invite, nil
+}
+
+// GetUserInviteByEmail retrieves a user invite by account ID and email.
+// Since email is encrypted with random IVs, we fetch all invites for the account
+// and compare emails in memory after decryption.
+func (s *SqlStore) GetUserInviteByEmail(ctx context.Context, lockStrength LockingStrength, accountID, email string) (*types.UserInviteRecord, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var invites []*types.UserInviteRecord
+	result := tx.Find(&invites, "account_id = ?", accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get user invites from store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get user invites from store")
+	}
+
+	for _, invite := range invites {
+		if err := invite.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+			return nil, fmt.Errorf("decrypt invite: %w", err)
+		}
+		if strings.EqualFold(invite.Email, email) {
+			return invite, nil
+		}
+	}
+
+	return nil, status.Errorf(status.NotFound, "user invite not found for email")
+}
+
+// GetAccountUserInvites retrieves all user invites for an account
+func (s *SqlStore) GetAccountUserInvites(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.UserInviteRecord, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var invites []*types.UserInviteRecord
+	result := tx.Find(&invites, "account_id = ?", accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get user invites from store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get user invites from store")
+	}
+
+	for _, invite := range invites {
+		if err := invite.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+			return nil, fmt.Errorf("decrypt invite: %w", err)
+		}
+	}
+
+	return invites, nil
+}
+
+// DeleteUserInvite deletes a user invite by its ID
+func (s *SqlStore) DeleteUserInvite(ctx context.Context, inviteID string) error {
+	result := s.db.Delete(&types.UserInviteRecord{}, idQueryCondition, inviteID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete user invite from store: %s", result.Error)
+		return status.Errorf(status.Internal, "failed to delete user invite from store")
+	}
+	return nil
+}
diff --git a/management/server/store/sql_store_user_test.go b/management/server/store/sql_store_user_test.go
new file mode 100644
index 000000000..34bc458fe
--- /dev/null
+++ b/management/server/store/sql_store_user_test.go
@@ -0,0 +1,343 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/management/server/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/netbirdio/netbird/util/crypt"
+)
+
+func TestSqlStore_GetAccountUsers(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	if err != nil {
+		t.Fatal(err)
+	}
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	account, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	users, err := store.GetAccountUsers(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	require.Len(t, users, len(account.Users))
+}
+
+func TestSqlStore_GetUserByUserID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name        string
+		userID      string
+		expectError bool
+	}{
+		{
+			name:        "retrieve existing user",
+			userID:      "edafee4e-63fb-11ec-90d6-0242ac120003",
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing user",
+			userID:      "non-existing",
+			expectError: true,
+		},
+		{
+			name:        "retrieve with empty user ID",
+			userID:      "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			user, err := store.GetUserByUserID(context.Background(), LockingStrengthNone, tt.userID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, user)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, user)
+				require.Equal(t, tt.userID, user.Id)
+			}
+		})
+	}
+}
+
+func TestSqlStore_GetUserByPATID(t *testing.T) {
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanUp)
+	assert.NoError(t, err)
+
+	id := "9dj38s35-63fb-11ec-90d6-0242ac120003"
+
+	user, err := store.GetUserByPATID(context.Background(), LockingStrengthNone, id)
+	require.NoError(t, err)
+	require.Equal(t, "f4f6d672-63fb-11ec-90d6-0242ac120003", user.Id)
+}
+
+func TestSqlStore_SaveUser(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	user := &types.User{
+		Id:            "user-id",
+		AccountID:     accountID,
+		Role:          types.UserRoleAdmin,
+		IsServiceUser: false,
+		AutoGroups:    []string{"groupA", "groupB"},
+		Blocked:       false,
+		LastLogin:     util.ToPtr(time.Now().UTC()),
+		CreatedAt:     time.Now().UTC().Add(-time.Hour),
+		Issued:        types.UserIssuedIntegration,
+	}
+	err = store.SaveUser(context.Background(), user)
+	require.NoError(t, err)
+
+	saveUser, err := store.GetUserByUserID(context.Background(), LockingStrengthNone, user.Id)
+	require.NoError(t, err)
+	require.Equal(t, user.Id, saveUser.Id)
+	require.Equal(t, user.AccountID, saveUser.AccountID)
+	require.Equal(t, user.Role, saveUser.Role)
+	require.Equal(t, user.AutoGroups, saveUser.AutoGroups)
+	require.WithinDurationf(t, user.GetLastLogin(), saveUser.LastLogin.UTC(), time.Millisecond, "LastLogin should be equal")
+	require.WithinDurationf(t, user.CreatedAt, saveUser.CreatedAt.UTC(), time.Millisecond, "CreatedAt should be equal")
+	require.Equal(t, user.Issued, saveUser.Issued)
+	require.Equal(t, user.Blocked, saveUser.Blocked)
+	require.Equal(t, user.IsServiceUser, saveUser.IsServiceUser)
+}
+
+func TestSqlStore_SaveUsers(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	accountUsers, err := store.GetAccountUsers(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	require.Len(t, accountUsers, 2)
+
+	users := []*types.User{
+		{
+			Id:         "user-1",
+			AccountID:  accountID,
+			Issued:     "api",
+			AutoGroups: []string{"groupA", "groupB"},
+		},
+		{
+			Id:         "user-2",
+			AccountID:  accountID,
+			Issued:     "integration",
+			AutoGroups: []string{"groupA"},
+		},
+	}
+	err = store.SaveUsers(context.Background(), users)
+	require.NoError(t, err)
+
+	accountUsers, err = store.GetAccountUsers(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	require.Len(t, accountUsers, 4)
+
+	users[1].AutoGroups = []string{"groupA", "groupC"}
+	err = store.SaveUsers(context.Background(), users)
+	require.NoError(t, err)
+
+	user, err := store.GetUserByUserID(context.Background(), LockingStrengthNone, users[1].Id)
+	require.NoError(t, err)
+	require.Equal(t, users[1].AutoGroups, user.AutoGroups)
+}
+
+func TestSqlStore_SaveUserWithEncryption(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	// Enable encryption
+	key, err := crypt.GenerateKey()
+	require.NoError(t, err)
+	fieldEncrypt, err := crypt.NewFieldEncrypt(key)
+	require.NoError(t, err)
+	store.SetFieldEncrypt(fieldEncrypt)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	// rawUser is used to read raw (potentially encrypted) data from the database
+	// without any gorm hooks or automatic decryption
+	type rawUser struct {
+		Id    string
+		Email string
+		Name  string
+	}
+
+	t.Run("save user with empty email and name", func(t *testing.T) {
+		user := &types.User{
+			Id:         "user-empty-fields",
+			AccountID:  accountID,
+			Role:       types.UserRoleUser,
+			Email:      "",
+			Name:       "",
+			AutoGroups: []string{"groupA"},
+		}
+		err = store.SaveUser(context.Background(), user)
+		require.NoError(t, err)
+
+		// Verify using direct database query that empty strings remain empty (not encrypted)
+		var raw rawUser
+		err = store.(*SqlStore).db.Table("users").Select("id, email, name").Where("id = ?", user.Id).First(&raw).Error
+		require.NoError(t, err)
+		require.Equal(t, "", raw.Email, "empty email should remain empty in database")
+		require.Equal(t, "", raw.Name, "empty name should remain empty in database")
+
+		// Verify manual decryption returns empty strings
+		decryptedEmail, err := fieldEncrypt.Decrypt(raw.Email)
+		require.NoError(t, err)
+		require.Equal(t, "", decryptedEmail)
+
+		decryptedName, err := fieldEncrypt.Decrypt(raw.Name)
+		require.NoError(t, err)
+		require.Equal(t, "", decryptedName)
+	})
+
+	t.Run("save user with email and name", func(t *testing.T) {
+		user := &types.User{
+			Id:         "user-with-fields",
+			AccountID:  accountID,
+			Role:       types.UserRoleAdmin,
+			Email:      "test@example.com",
+			Name:       "Test User",
+			AutoGroups: []string{"groupB"},
+		}
+		err = store.SaveUser(context.Background(), user)
+		require.NoError(t, err)
+
+		// Verify using direct database query that the data is encrypted (not plaintext)
+		var raw rawUser
+		err = store.(*SqlStore).db.Table("users").Select("id, email, name").Where("id = ?", user.Id).First(&raw).Error
+		require.NoError(t, err)
+		require.NotEqual(t, "test@example.com", raw.Email, "email should be encrypted in database")
+		require.NotEqual(t, "Test User", raw.Name, "name should be encrypted in database")
+
+		// Verify manual decryption returns correct values
+		decryptedEmail, err := fieldEncrypt.Decrypt(raw.Email)
+		require.NoError(t, err)
+		require.Equal(t, "test@example.com", decryptedEmail)
+
+		decryptedName, err := fieldEncrypt.Decrypt(raw.Name)
+		require.NoError(t, err)
+		require.Equal(t, "Test User", decryptedName)
+	})
+
+	t.Run("save multiple users with mixed fields", func(t *testing.T) {
+		users := []*types.User{
+			{
+				Id:        "batch-user-1",
+				AccountID: accountID,
+				Email:     "",
+				Name:      "",
+			},
+			{
+				Id:        "batch-user-2",
+				AccountID: accountID,
+				Email:     "batch@example.com",
+				Name:      "Batch User",
+			},
+		}
+		err = store.SaveUsers(context.Background(), users)
+		require.NoError(t, err)
+
+		// Verify first user (empty fields) using direct database query
+		var raw1 rawUser
+		err = store.(*SqlStore).db.Table("users").Select("id, email, name").Where("id = ?", "batch-user-1").First(&raw1).Error
+		require.NoError(t, err)
+		require.Equal(t, "", raw1.Email, "empty email should remain empty in database")
+		require.Equal(t, "", raw1.Name, "empty name should remain empty in database")
+
+		// Verify second user (with fields) using direct database query
+		var raw2 rawUser
+		err = store.(*SqlStore).db.Table("users").Select("id, email, name").Where("id = ?", "batch-user-2").First(&raw2).Error
+		require.NoError(t, err)
+		require.NotEqual(t, "batch@example.com", raw2.Email, "email should be encrypted in database")
+		require.NotEqual(t, "Batch User", raw2.Name, "name should be encrypted in database")
+
+		// Verify manual decryption returns empty strings for first user
+		decryptedEmail1, err := fieldEncrypt.Decrypt(raw1.Email)
+		require.NoError(t, err)
+		require.Equal(t, "", decryptedEmail1)
+
+		decryptedName1, err := fieldEncrypt.Decrypt(raw1.Name)
+		require.NoError(t, err)
+		require.Equal(t, "", decryptedName1)
+
+		// Verify manual decryption returns correct values for second user
+		decryptedEmail2, err := fieldEncrypt.Decrypt(raw2.Email)
+		require.NoError(t, err)
+		require.Equal(t, "batch@example.com", decryptedEmail2)
+
+		decryptedName2, err := fieldEncrypt.Decrypt(raw2.Name)
+		require.NoError(t, err)
+		require.Equal(t, "Batch User", decryptedName2)
+	})
+}
+
+func TestSqlStore_DeleteUser(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	userID := "f4f6d672-63fb-11ec-90d6-0242ac120003"
+
+	err = store.DeleteUser(context.Background(), accountID, userID)
+	require.NoError(t, err)
+
+	user, err := store.GetUserByUserID(context.Background(), LockingStrengthNone, userID)
+	require.Error(t, err)
+	require.Nil(t, user)
+
+	userPATs, err := store.GetUserPATs(context.Background(), LockingStrengthNone, userID)
+	require.NoError(t, err)
+	require.Len(t, userPATs, 0)
+}
+
+func TestSqlStore_SaveUsers_LargeBatch(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	accountUsers, err := store.GetAccountUsers(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	require.Len(t, accountUsers, 2)
+
+	usersToSave := make([]*types.User, 0)
+
+	for i := 1; i <= 8000; i++ {
+		usersToSave = append(usersToSave, &types.User{
+			Id:        fmt.Sprintf("user-%d", i),
+			AccountID: accountID,
+			Role:      types.UserRoleUser,
+		})
+	}
+
+	err = store.SaveUsers(context.Background(), usersToSave)
+	require.NoError(t, err)
+
+	accountUsers, err = store.GetAccountUsers(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	require.Equal(t, 8002, len(accountUsers))
+}
diff --git a/management/server/store/sql_store_zone.go b/management/server/store/sql_store_zone.go
new file mode 100644
index 000000000..02b65546a
--- /dev/null
+++ b/management/server/store/sql_store_zone.go
@@ -0,0 +1,98 @@
+package store
+
+import (
+	"context"
+	"errors"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func (s *SqlStore) CreateZone(ctx context.Context, zone *zones.Zone) error {
+	result := s.db.Create(zone)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to create zone to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to create zone to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) UpdateZone(ctx context.Context, zone *zones.Zone) error {
+	result := s.db.Select("*").Save(zone)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to update zone to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to update zone to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) DeleteZone(ctx context.Context, accountID, zoneID string) error {
+	result := s.db.Delete(&zones.Zone{}, accountAndIDQueryCondition, accountID, zoneID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete zone from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete zone from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewZoneNotFoundError(zoneID)
+	}
+
+	return nil
+}
+
+func (s *SqlStore) GetZoneByID(ctx context.Context, lockStrength LockingStrength, accountID, zoneID string) (*zones.Zone, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var zone *zones.Zone
+	result := tx.Preload("Records").Take(&zone, accountAndIDQueryCondition, accountID, zoneID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewZoneNotFoundError(zoneID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get zone from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get zone from store")
+	}
+
+	return zone, nil
+}
+
+func (s *SqlStore) GetZoneByDomain(ctx context.Context, accountID, domain string) (*zones.Zone, error) {
+	var zone *zones.Zone
+	result := s.db.Where("account_id = ? AND domain = ?", accountID, domain).First(&zone)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewZoneNotFoundError(domain)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get zone by domain from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get zone by domain from store")
+	}
+
+	return zone, nil
+}
+
+func (s *SqlStore) GetAccountZones(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*zones.Zone, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var zones []*zones.Zone
+	result := tx.Preload("Records").Find(&zones, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get zones from the store: %s", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get zones from store")
+	}
+
+	return zones, nil
+}
diff --git a/management/server/store/sql_store_zone_test.go b/management/server/store/sql_store_zone_test.go
new file mode 100644
index 000000000..da2ef12e6
--- /dev/null
+++ b/management/server/store/sql_store_zone_test.go
@@ -0,0 +1,238 @@
+package store
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestSqlStore_CreateZone(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	savedZone, err := store.GetZoneByID(context.Background(), LockingStrengthNone, accountID, zone.ID)
+	require.NoError(t, err)
+	require.NotNil(t, savedZone)
+	assert.Equal(t, zone.ID, savedZone.ID)
+	assert.Equal(t, zone.Name, savedZone.Name)
+	assert.Equal(t, zone.Domain, savedZone.Domain)
+	assert.Equal(t, zone.Enabled, savedZone.Enabled)
+	assert.Equal(t, zone.EnableSearchDomain, savedZone.EnableSearchDomain)
+	assert.Equal(t, zone.DistributionGroups, savedZone.DistributionGroups)
+}
+
+func TestSqlStore_GetZoneByID(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name        string
+		accountID   string
+		zoneID      string
+		expectError bool
+	}{
+		{
+			name:        "retrieve existing zone",
+			accountID:   accountID,
+			zoneID:      zone.ID,
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing zone",
+			accountID:   accountID,
+			zoneID:      "non-existing",
+			expectError: true,
+		},
+		{
+			name:        "retrieve with empty zone ID",
+			accountID:   accountID,
+			zoneID:      "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			savedZone, err := store.GetZoneByID(context.Background(), LockingStrengthNone, tt.accountID, tt.zoneID)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, sErr.Type(), status.NotFound)
+				require.Nil(t, savedZone)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, savedZone)
+				assert.Equal(t, tt.zoneID, savedZone.ID)
+			}
+		})
+	}
+}
+
+func TestSqlStore_GetAccountZones(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone1 := zones.NewZone(accountID, "Zone 1", "example1.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone1)
+	require.NoError(t, err)
+
+	zone2 := zones.NewZone(accountID, "Zone 2", "example2.com", true, true, []string{"group1", "group2"})
+	err = store.CreateZone(context.Background(), zone2)
+	require.NoError(t, err)
+
+	allZones, err := store.GetAccountZones(context.Background(), LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	require.NotNil(t, allZones)
+	assert.GreaterOrEqual(t, len(allZones), 2)
+
+	zoneIDs := make(map[string]bool)
+	for _, z := range allZones {
+		zoneIDs[z.ID] = true
+	}
+	assert.True(t, zoneIDs[zone1.ID])
+	assert.True(t, zoneIDs[zone2.ID])
+}
+
+func TestSqlStore_GetZoneByDomain(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	otherAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3c"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name        string
+		accountID   string
+		domain      string
+		expectError bool
+		errorType   status.Type
+	}{
+		{
+			name:        "retrieve existing zone by domain",
+			accountID:   accountID,
+			domain:      "example.com",
+			expectError: false,
+		},
+		{
+			name:        "retrieve non-existing zone domain",
+			accountID:   accountID,
+			domain:      "non-existing.com",
+			expectError: true,
+			errorType:   status.NotFound,
+		},
+		{
+			name:        "retrieve with empty domain",
+			accountID:   accountID,
+			domain:      "",
+			expectError: true,
+			errorType:   status.NotFound,
+		},
+		{
+			name:        "retrieve with different account ID",
+			accountID:   otherAccountID,
+			domain:      "example.com",
+			expectError: true,
+			errorType:   status.NotFound,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			savedZone, err := store.GetZoneByDomain(context.Background(), tt.accountID, tt.domain)
+			if tt.expectError {
+				require.Error(t, err)
+				sErr, ok := status.FromError(err)
+				require.True(t, ok)
+				require.Equal(t, tt.errorType, sErr.Type())
+				require.Nil(t, savedZone)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, savedZone)
+				assert.Equal(t, tt.domain, savedZone.Domain)
+				assert.Equal(t, zone.ID, savedZone.ID)
+				assert.Equal(t, zone.Name, savedZone.Name)
+			}
+		})
+	}
+}
+
+func TestSqlStore_UpdateZone(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	zone.Name = "Updated Zone"
+	zone.Domain = "updated.com"
+	zone.Enabled = false
+	zone.EnableSearchDomain = true
+	zone.DistributionGroups = []string{"group2", "group3"}
+
+	err = store.UpdateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	updatedZone, err := store.GetZoneByID(context.Background(), LockingStrengthNone, accountID, zone.ID)
+	require.NoError(t, err)
+	require.NotNil(t, updatedZone)
+	assert.Equal(t, "Updated Zone", updatedZone.Name)
+	assert.Equal(t, "updated.com", updatedZone.Domain)
+	assert.False(t, updatedZone.Enabled)
+	assert.True(t, updatedZone.EnableSearchDomain)
+	assert.Equal(t, []string{"group2", "group3"}, updatedZone.DistributionGroups)
+}
+
+func TestSqlStore_DeleteZone(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+	zone := zones.NewZone(accountID, "Test Zone", "example.com", true, false, []string{"group1"})
+	err = store.CreateZone(context.Background(), zone)
+	require.NoError(t, err)
+
+	err = store.DeleteZone(context.Background(), accountID, zone.ID)
+	require.NoError(t, err)
+
+	deletedZone, err := store.GetZoneByID(context.Background(), LockingStrengthNone, accountID, zone.ID)
+	require.Error(t, err)
+	require.Nil(t, deletedZone)
+	sErr, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, sErr.Type(), status.NotFound)
+}
diff --git a/management/server/store/sqlstore_bench_test.go b/management/server/store/sqlstore_bench_test.go
index a38b4a8c1..b1933b0d3 100644
--- a/management/server/store/sqlstore_bench_test.go
+++ b/management/server/store/sqlstore_bench_test.go
@@ -22,6 +22,7 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	nbdb "github.com/netbirdio/netbird/management/internals/shared/db"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -281,10 +282,11 @@ func setupBenchmarkDB(b testing.TB) (*SqlStore, func(), string) {
 		b.Fatalf("failed to migrate database: %v", err)
 	}
 
-	store := &SqlStore{
-		db:   db,
-		pool: pool,
+	conn, err := nbdb.NewConn(context.Background(), db, nbdb.PostgresStoreEngine, pool)
+	if err != nil {
+		b.Fatalf("failed to create connection: %v", err)
 	}
+	store := &SqlStore{conn: conn, db: conn.DB(nil)}
 
 	const (
 		accountID           = "benchmark-account-id"
@@ -527,7 +529,7 @@ func BenchmarkGetAccount(b *testing.B) {
 			}
 		}
 	})
-	store.pool.Close()
+	_ = store.Close(ctx)
 }
 
 func TestAccountEquivalence(t *testing.T) {
diff --git a/management/server/store/store.go b/management/server/store/store.go
index 908c199f5..174e97b48 100644
--- a/management/server/store/store.go
+++ b/management/server/store/store.go
@@ -1,9 +1,10 @@
 package store
 
-//go:generate go run github.com/golang/mock/mockgen -package store -destination=store_mock.go -source=./store.go -build_flags=-mod=mod
+//go:generate go tool mockgen -package store -destination=store_mock.go -source=./store.go -build_flags=-mod=mod
 
 import (
 	"context"
+	"database/sql"
 	"errors"
 	"fmt"
 	"net"
@@ -12,28 +13,29 @@ import (
 	"path"
 	"path/filepath"
 	"regexp"
-	"runtime"
 	"slices"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
 	"gorm.io/driver/mysql"
 	"gorm.io/driver/postgres"
-	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
 
 	"github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/testutil"
 	"github.com/netbirdio/netbird/management/server/types"
+	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/util"
 	"github.com/netbirdio/netbird/util/crypt"
 
@@ -47,14 +49,14 @@ import (
 	"github.com/netbirdio/netbird/route"
 )
 
-type LockingStrength string
+type LockingStrength = db.LockingStrength
 
 const (
-	LockingStrengthUpdate      LockingStrength = "UPDATE"        // Strongest lock, preventing any changes by other transactions until your transaction completes.
-	LockingStrengthShare       LockingStrength = "SHARE"         // Allows reading but prevents changes by other transactions.
-	LockingStrengthNoKeyUpdate LockingStrength = "NO KEY UPDATE" // Similar to UPDATE but allows changes to related rows.
-	LockingStrengthKeyShare    LockingStrength = "KEY SHARE"     // Protects against changes to primary/unique keys but allows other updates.
-	LockingStrengthNone        LockingStrength = "NONE"          // No locking, allowing all transactions to proceed without restrictions.
+	LockingStrengthUpdate      = db.LockingStrengthUpdate
+	LockingStrengthShare       = db.LockingStrengthShare
+	LockingStrengthNoKeyUpdate = db.LockingStrengthNoKeyUpdate
+	LockingStrengthKeyShare    = db.LockingStrengthKeyShare
+	LockingStrengthNone        = db.LockingStrengthNone
 )
 
 type Store interface {
@@ -136,6 +138,7 @@ type Store interface {
 
 	GetAccountPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.Policy, error)
 	GetPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*types.Policy, error)
+	GetPolicyByIDOrPublicID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*types.Policy, error)
 	CreatePolicy(ctx context.Context, policy *types.Policy) error
 	SavePolicy(ctx context.Context, policy *types.Policy) error
 	DeletePolicy(ctx context.Context, accountID, policyID string) error
@@ -158,7 +161,8 @@ type Store interface {
 	RemoveResourceFromGroup(ctx context.Context, accountId string, groupID string, resourceID string) error
 	AddPeerToAccount(ctx context.Context, peer *nbpeer.Peer) error
 	GetPeerByPeerPubKey(ctx context.Context, lockStrength LockingStrength, peerKey string) (*nbpeer.Peer, error)
-	GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error)
+	GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error)
+	GetAccountPeersPaginated(ctx context.Context, lockStrength LockingStrength, accountID string, pagination PaginationState, filters PeerFilters, sorting PeerSorting) ([]*nbpeer.Peer, int, error)
 	GetUserPeers(ctx context.Context, lockStrength LockingStrength, accountID, userID string) ([]*nbpeer.Peer, error)
 	GetPeerByID(ctx context.Context, lockStrength LockingStrength, accountID string, peerID string) (*nbpeer.Peer, error)
 	GetPeersByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, peerIDs []string) (map[string]*nbpeer.Peer, error)
@@ -180,6 +184,14 @@ type Store interface {
 	// Returns true when the update happened, false when this stream lost
 	// the race against a newer session.
 	MarkPeerConnectedIfNewerSession(ctx context.Context, accountID, peerID string, newSessionStartedAt int64) (bool, error)
+	// RefreshPeerLastSeen records that a peer was just seen, stamping the
+	// database clock like the other status writers. Connected and
+	// SessionStartedAt are left alone, so this never interferes with the
+	// session-ownership protocol MarkPeerConnectedIfNewerSession implements.
+	// The write only lands when the stored LastSeen is older than
+	// staleBefore, which keeps a caller's throttle atomic under concurrent
+	// requests for the same peer. Returns true when the update happened.
+	RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error)
 	// MarkPeerDisconnectedIfSameSession sets the peer to disconnected and
 	// resets SessionStartedAt to zero, but only when the stored
 	// SessionStartedAt equals the given sessionStartedAt. LastSeen is
@@ -198,6 +210,7 @@ type Store interface {
 
 	GetAccountRoutes(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*route.Route, error)
 	GetRouteByID(ctx context.Context, lockStrength LockingStrength, accountID, routeID string) (*route.Route, error)
+	GetRouteByIDOrPublicID(ctx context.Context, lockStrength LockingStrength, accountID, routeID string) (*route.Route, error)
 	SaveRoute(ctx context.Context, route *route.Route) error
 	DeleteRoute(ctx context.Context, accountID, routeID string) error
 
@@ -238,6 +251,7 @@ type Store interface {
 	GetNetworkResourcesByNetID(ctx context.Context, lockStrength LockingStrength, accountID, netID string) ([]*resourceTypes.NetworkResource, error)
 	GetNetworkResourcesByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*resourceTypes.NetworkResource, error)
 	GetNetworkResourceByID(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) (*resourceTypes.NetworkResource, error)
+	GetNetworkResourceByIDOrPublicID(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) (*resourceTypes.NetworkResource, error)
 	GetNetworkResourceByName(ctx context.Context, lockStrength LockingStrength, accountID, resourceName string) (*resourceTypes.NetworkResource, error)
 	SaveNetworkResource(ctx context.Context, resource *resourceTypes.NetworkResource) error
 	DeleteNetworkResource(ctx context.Context, accountID, resourceID string) error
@@ -294,19 +308,21 @@ type Store interface {
 	GetCustomDomain(ctx context.Context, accountID string, domainID string) (*domain.Domain, error)
 	ListFreeDomains(ctx context.Context, accountID string) ([]string, error)
 	ListCustomDomains(ctx context.Context, accountID string) ([]*domain.Domain, error)
+	LockCustomDomains(ctx context.Context, accountID string, serviceDomain nbdomain.Domain) ([]*domain.Domain, error)
+	GetCustomDomainByName(ctx context.Context, domainName string) (*domain.Domain, error)
 	CreateCustomDomain(ctx context.Context, accountID string, domainName string, targetCluster string, validated bool) (*domain.Domain, error)
 	UpdateCustomDomain(ctx context.Context, accountID string, d *domain.Domain) (*domain.Domain, error)
+	GetExpiredCustomDomains(ctx context.Context, now time.Time, afterID domain.ID, limit int) ([]*domain.Domain, error)
+	DeleteExpiredCustomDomain(ctx context.Context, d *domain.Domain, now time.Time) (bool, error)
 	DeleteCustomDomain(ctx context.Context, accountID string, domainID string) error
 
-	CreateAccessLog(ctx context.Context, log *accesslogs.AccessLogEntry) error
-	GetAccountAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error)
-	DeleteOldAccessLogs(ctx context.Context, olderThan time.Time) (int64, error)
 	CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error
 	CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error
 	GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLog, int64, error)
 	GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLogSession, int64, error)
 	GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkUsage, error)
 	DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error)
+	GetDeletedAccountIDsWithAgentNetworkAccessLogs(ctx context.Context) ([]string, error)
 	GetServiceTargetByTargetID(ctx context.Context, lockStrength LockingStrength, accountID string, targetID string) (*rpservice.Target, error)
 	GetTargetsByServiceID(ctx context.Context, lockStrength LockingStrength, accountID string, serviceID string) ([]*rpservice.Target, error)
 	DeleteTarget(ctx context.Context, accountID string, serviceID string, targetID uint) error
@@ -322,10 +338,18 @@ type Store interface {
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
+	GetClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool
+	GetActiveProxyVersions(ctx context.Context, clusterAddr string) ([]string, error)
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
+	GetAllProxies(ctx context.Context) ([]*proxy.Proxy, error)
+	DisconnectAllProxies(ctx context.Context) (int64, error)
 	GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error)
 	CountProxiesByAccountID(ctx context.Context, accountID string) (int64, error)
 	IsClusterAddressConflicting(ctx context.Context, clusterAddress, accountID string) (bool, error)
+	HasActiveProxyAtClusterAddress(ctx context.Context, clusterAddress string) (bool, error)
+	HasForeignAccountProxyAtHost(ctx context.Context, host, accountID string) (bool, error)
+	HasGatewayClusterPinnedByOtherAccount(ctx context.Context, host, accountID string) (bool, error)
+	HasGatewayEndpointByOtherAccount(ctx context.Context, host, accountID string) (bool, error)
 	DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error
 
 	GetCustomDomainsCounts(ctx context.Context) (total int64, validated int64, err error)
@@ -358,13 +382,17 @@ type Store interface {
 	DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error
 	GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*agentNetworkTypes.Settings, error)
 	GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Settings, error)
-	GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error)
+	GetAgentNetworkSettingsByProxyAddress(ctx context.Context, lockStrength LockingStrength, proxyAddress string) ([]*agentNetworkTypes.Settings, error)
+	GetAgentNetworkSettingsByDomain(ctx context.Context, lockStrength LockingStrength, domain string) (*agentNetworkTypes.Settings, error)
+	CreateAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error
 	SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error
+	DeleteAgentNetworkSettings(ctx context.Context, accountID string) error
 	IncrementAgentNetworkConsumption(ctx context.Context, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time, tokensIn, tokensOut int64, costUSD float64) error
 	IncrementAgentNetworkConsumptionBatch(ctx context.Context, accountID string, keys []agentNetworkTypes.ConsumptionKey, tokensIn, tokensOut int64, costUSD float64) error
 	GetAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time) (*agentNetworkTypes.Consumption, error)
 	GetAgentNetworkConsumptionBatch(ctx context.Context, lockStrength LockingStrength, accountID string, keys []agentNetworkTypes.ConsumptionKey) (map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption, error)
 	ListAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Consumption, error)
+	DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx context.Context) (int64, error)
 	GetAccountAgentNetworkBudgetRules(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.AccountBudgetRule, error)
 	GetAgentNetworkBudgetRuleByID(ctx context.Context, lockStrength LockingStrength, accountID, ruleID string) (*agentNetworkTypes.AccountBudgetRule, error)
 	SaveAgentNetworkBudgetRule(ctx context.Context, rule *agentNetworkTypes.AccountBudgetRule) error
@@ -422,8 +450,8 @@ type AgentNetworkMetrics struct {
 }
 
 const (
-	postgresDsnEnv       = "NB_STORE_ENGINE_POSTGRES_DSN"
-	postgresDsnEnvLegacy = "NETBIRD_STORE_ENGINE_POSTGRES_DSN"
+	PostgresDsnEnv       = "NB_STORE_ENGINE_POSTGRES_DSN"
+	PostgresDsnEnvLegacy = "NETBIRD_STORE_ENGINE_POSTGRES_DSN"
 	mysqlDsnEnv          = "NB_STORE_ENGINE_MYSQL_DSN"
 	mysqlDsnEnvLegacy    = "NETBIRD_STORE_ENGINE_MYSQL_DSN"
 )
@@ -465,7 +493,7 @@ func getStoreEngine(ctx context.Context, dataDir string, kind types.Engine) type
 
 			// Migrate if it is the first run with a JSON file existing and no SQLite file present
 			jsonStoreFile := filepath.Join(dataDir, storeFileName)
-			sqliteStoreFile := filepath.Join(dataDir, storeSqliteFileName)
+			sqliteStoreFile := filepath.Join(dataDir, db.SqliteFileName)
 
 			if util.FileExists(jsonStoreFile) && !util.FileExists(sqliteStoreFile) {
 				log.WithContext(ctx).Warnf("unsupported store engine specified, but found %s. Automatically migrating to SQLite.", jsonStoreFile)
@@ -484,6 +512,16 @@ func getStoreEngine(ctx context.Context, dataDir string, kind types.Engine) type
 
 // NewStore creates a new store based on the provided engine type, data directory, and telemetry metrics
 func NewStore(ctx context.Context, kind types.Engine, dataDir string, metrics telemetry.AppMetrics, skipMigration bool) (Store, error) {
+	conn, err := OpenConn(ctx, kind, dataDir)
+	if err != nil {
+		return nil, err
+	}
+	return newStore(ctx, conn, metrics, skipMigration)
+}
+
+// OpenConn resolves the configured engine and opens the connection that the
+// store and the domain repositories share.
+func OpenConn(ctx context.Context, kind types.Engine, dataDir string) (*db.Conn, error) {
 	kind = getStoreEngine(ctx, dataDir, kind)
 
 	if err := checkFileStoreEngine(kind, dataDir); err != nil {
@@ -493,13 +531,21 @@ func NewStore(ctx context.Context, kind types.Engine, dataDir string, metrics te
 	switch kind {
 	case types.SqliteStoreEngine:
 		log.WithContext(ctx).Info("using SQLite store engine")
-		return NewSqliteStore(ctx, dataDir, metrics, skipMigration)
+		return db.OpenSqlite(ctx, dataDir)
 	case types.PostgresStoreEngine:
 		log.WithContext(ctx).Info("using Postgres store engine")
-		return newPostgresStore(ctx, metrics, skipMigration)
+		dsn, ok := lookupDSNEnv(PostgresDsnEnv, PostgresDsnEnvLegacy)
+		if !ok {
+			return nil, fmt.Errorf("%s is not set", PostgresDsnEnv)
+		}
+		return db.OpenPostgres(ctx, dsn, db.DefaultPoolConfig)
 	case types.MysqlStoreEngine:
 		log.WithContext(ctx).Info("using MySQL store engine")
-		return newMysqlStore(ctx, metrics, skipMigration)
+		dsn, ok := lookupDSNEnv(mysqlDsnEnv, mysqlDsnEnvLegacy)
+		if !ok {
+			return nil, fmt.Errorf("%s is not set", mysqlDsnEnv)
+		}
+		return db.OpenMysql(ctx, dsn)
 	default:
 		return nil, fmt.Errorf("unsupported kind of store: %s", kind)
 	}
@@ -582,6 +628,33 @@ func getMigrationsPreAuto(ctx context.Context) []migrationFunc {
 		func(db *gorm.DB) error {
 			return migration.CleanupOrphanedResources[domain.Domain, types.Account](ctx, db, "account_id")
 		},
+		func(db *gorm.DB) error {
+			return migration.BackfillPublicIDs[types.Policy](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.BackfillPublicIDs[types.Group](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.BackfillPublicIDs[route.Route](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.BackfillPublicIDs[resourceTypes.NetworkResource](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.BackfillPublicIDs[routerTypes.NetworkRouter](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.BackfillPublicIDs[dns.NameServerGroup](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.BackfillPublicIDs[networkTypes.Network](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.BackfillPublicIDs[posture.Checks](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.MigrateAgentNetworkSettingsToDomain(ctx, db)
+		},
 	}
 }
 
@@ -600,6 +673,9 @@ func migratePostAuto(ctx context.Context, db *gorm.DB) error {
 
 func getMigrationsPostAuto(ctx context.Context) []migrationFunc {
 	return []migrationFunc{
+		func(db *gorm.DB) error {
+			return migration.MigrateCustomDomainValidationExpiry(ctx, db)
+		},
 		func(db *gorm.DB) error {
 			return migration.CreateIndexIfNotExists[nbpeer.Peer](ctx, db, "idx_account_ip", "account_id", "ip")
 		},
@@ -624,6 +700,14 @@ func getMigrationsPostAuto(ctx context.Context) []migrationFunc {
 		func(db *gorm.DB) error {
 			return migration.DropIndex[proxy.Proxy](ctx, db, "idx_proxy_account_id_unique")
 		},
+		// Post-auto so the per-bucket cost columns already exist when the legacy
+		// aggregates are folded into them and dropped.
+		func(db *gorm.DB) error {
+			return migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkAccessLog](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db)
+		},
 	}
 }
 
@@ -635,32 +719,28 @@ func NewTestStoreFromSQL(ctx context.Context, filename string, dataDir string) (
 		kind = types.SqliteStoreEngine
 	}
 
-	storeStr := fmt.Sprintf("%s?cache=shared", storeSqliteFileName)
-	if runtime.GOOS == "windows" {
-		// Vo avoid `The process cannot access the file because it is being used by another process` on Windows
-		storeStr = storeSqliteFileName
-	}
-
-	file := filepath.Join(dataDir, storeStr)
-	db, err := gorm.Open(sqlite.Open(file), getGormConfig())
+	conn, err := db.OpenSqliteFile(ctx, dataDir, db.SqliteFileName)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, fmt.Errorf("failed to create test store: %v", err)
 	}
 
 	if filename != "" {
-		err = LoadSQL(db, filename)
+		err = LoadSQL(conn.DB(nil), filename, translaterForSql(kind))
 		if err != nil {
+			_ = conn.Close()
 			return nil, nil, fmt.Errorf("failed to load SQL file: %v", err)
 		}
 	}
 
-	store, err := NewSqlStore(ctx, db, types.SqliteStoreEngine, nil, false)
+	store, err := NewSqlStore(ctx, conn, nil, false)
 	if err != nil {
+		_ = conn.Close()
 		return nil, nil, fmt.Errorf("failed to create test store: %v", err)
 	}
 
 	err = addAllGroupToAccount(ctx, store)
 	if err != nil {
+		_ = store.Close(ctx)
 		return nil, nil, fmt.Errorf("failed to add all group to account: %v", err)
 	}
 
@@ -669,7 +749,7 @@ func NewTestStoreFromSQL(ctx context.Context, filename string, dataDir string) (
 
 	maxRetries := 2
 	for i := 0; i < maxRetries; i++ {
-		sqlStore, cleanup, err = getSqlStoreEngine(ctx, store, kind)
+		sqlStore, cleanup, err = getSqlStoreEngine(ctx, store, kind, dataDir)
 		if err == nil {
 			return sqlStore, cleanup, nil
 		}
@@ -677,9 +757,63 @@ func NewTestStoreFromSQL(ctx context.Context, filename string, dataDir string) (
 			time.Sleep(100 * time.Millisecond)
 		}
 	}
+	store.Close(ctx)
 	return nil, nil, fmt.Errorf("failed to create test store after %d attempts: %v", maxRetries, err)
 }
 
+func NewTestStore(ctx context.Context, filename string, dataDir string) (Store, func(), error) {
+	kind := getStoreEngineFromEnv()
+	if kind == "" {
+		kind = types.SqliteStoreEngine
+	}
+
+	var sqlStore *SqlStore
+	var cleanup func()
+	var err error
+
+	maxRetries := 2
+	for i := 0; i < maxRetries; i++ {
+		sqlStore, cleanup, err = getSqlStoreEngine(ctx, nil, kind, dataDir)
+		if err == nil {
+			break
+		}
+		if i < maxRetries-1 {
+			time.Sleep(100 * time.Millisecond)
+		}
+	}
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create test store after %d attempts: %v", maxRetries, err)
+	}
+
+	if filename != "" {
+		err = LoadSQL(sqlStore.db, filename, translaterForSql(kind))
+		if err != nil {
+			_ = sqlStore.Close(ctx)
+			return nil, nil, fmt.Errorf("failed to load SQL file: %v", err)
+		}
+	}
+
+	err = addAllGroupToAccount(ctx, sqlStore)
+	if err != nil {
+		_ = sqlStore.Close(ctx)
+		return nil, nil, fmt.Errorf("failed to add all group to account: %v", err)
+	}
+
+	return sqlStore, cleanup, nil
+}
+
+// use to translate double-quote escaped reserved names (ansi)
+// to mysql tick-escaped ones
+func translaterForSql(kind types.Engine) *strings.Replacer {
+	if kind != types.MysqlStoreEngine {
+		return strings.NewReplacer()
+	}
+	return strings.NewReplacer(
+		"\"key\"", "`key`",
+		"\"groups\"", "`groups`",
+	)
+}
+
 func addAllGroupToAccount(ctx context.Context, store Store) error {
 	allAccounts := store.GetAllAccounts(ctx)
 	for _, account := range allAccounts {
@@ -703,18 +837,28 @@ func addAllGroupToAccount(ctx context.Context, store Store) error {
 	return nil
 }
 
-func getSqlStoreEngine(ctx context.Context, store *SqlStore, kind types.Engine) (Store, func(), error) {
+func getSqlStoreEngine(ctx context.Context, sqliteStore *SqlStore, kind types.Engine, dataDir string) (*SqlStore, func(), error) {
+	var store *SqlStore
 	var cleanup func()
 	var err error
 	switch kind {
 	case types.PostgresStoreEngine:
-		store, cleanup, err = newReusedPostgresStore(ctx, store, kind)
+		store, cleanup, err = newReusedPostgresStore(ctx, sqliteStore, kind)
 	case types.MysqlStoreEngine:
-		store, cleanup, err = newReusedMysqlStore(ctx, store, kind)
+		store, cleanup, err = newReusedMysqlStore(ctx, sqliteStore, kind)
 	default:
 		cleanup = func() {
 			// sqlite doesn't need to be cleaned up
 		}
+		store = sqliteStore
+		var conn *db.Conn
+		if store == nil {
+			conn, err = db.OpenSqliteFile(ctx, dataDir, db.SqliteFileName)
+			if err != nil {
+				return nil, nil, fmt.Errorf("failed to create test store: %v", err)
+			}
+			store, err = NewSqlStore(ctx, conn, nil, false)
+		}
 	}
 	if err != nil {
 		return nil, cleanup, fmt.Errorf("failed to create test store: %v", err)
@@ -723,16 +867,18 @@ func getSqlStoreEngine(ctx context.Context, store *SqlStore, kind types.Engine)
 	closeConnection := func() {
 		cleanup()
 		store.Close(ctx)
-		if store.pool != nil {
-			store.pool.Close()
+		if sqliteStore != nil && store != sqliteStore {
+			// The sqlite store only seeded the engine under test; without this
+			// every test leaks its connection and the opener goroutines.
+			sqliteStore.Close(ctx)
 		}
 	}
 
 	return store, closeConnection, nil
 }
 
-func newReusedPostgresStore(ctx context.Context, store *SqlStore, kind types.Engine) (*SqlStore, func(), error) {
-	dsn, ok := lookupDSNEnv(postgresDsnEnv, postgresDsnEnvLegacy)
+func newReusedPostgresStore(ctx context.Context, sqliteStore *SqlStore, kind types.Engine) (*SqlStore, func(), error) {
+	dsn, ok := lookupDSNEnv(PostgresDsnEnv, PostgresDsnEnvLegacy)
 	if !ok || dsn == "" {
 		var err error
 		_, dsn, err = testutil.CreatePostgresTestContainer()
@@ -742,7 +888,7 @@ func newReusedPostgresStore(ctx context.Context, store *SqlStore, kind types.Eng
 	}
 
 	if dsn == "" {
-		return nil, nil, fmt.Errorf("%s is not set", postgresDsnEnv)
+		return nil, nil, fmt.Errorf("%s is not set", PostgresDsnEnv)
 	}
 
 	db, err := openDBWithRetry(dsn, kind, 5)
@@ -750,26 +896,39 @@ func newReusedPostgresStore(ctx context.Context, store *SqlStore, kind types.Eng
 		return nil, nil, fmt.Errorf("failed to open postgres connection: %v", err)
 	}
 
-	dsn, cleanup, err := createRandomDB(dsn, db, kind)
-
-	sqlDB, _ := db.DB()
-	if sqlDB != nil {
-		sqlDB.Close()
+	template, err := postgresSchemaTemplate(ctx, dsn, db)
+	if err != nil {
+		closeGormDB(db)
+		return nil, nil, err
 	}
 
+	dsn, cleanup, err := createRandomDB(dsn, db, kind, template)
+
+	closeGormDB(db)
+
 	if err != nil {
 		return nil, nil, err
 	}
 
-	store, err = NewPostgresqlStoreFromSqlStore(ctx, store, dsn, nil)
-	if err != nil {
-		return nil, nil, err
+	var store *SqlStore
+	if sqliteStore != nil {
+		store, err = newPostgresqlStoreFromSqlStore(ctx, sqliteStore, dsn, nil, true)
+		if err != nil {
+			cleanup()
+			return nil, nil, err
+		}
+	} else {
+		store, err = NewPostgresqlStoreForTests(ctx, dsn, nil, false)
+		if err != nil {
+			cleanup()
+			return nil, nil, err
+		}
 	}
 
 	return store, cleanup, nil
 }
 
-func newReusedMysqlStore(ctx context.Context, store *SqlStore, kind types.Engine) (*SqlStore, func(), error) {
+func newReusedMysqlStore(ctx context.Context, sqliteStore *SqlStore, kind types.Engine) (*SqlStore, func(), error) {
 	dsn, ok := lookupDSNEnv(mysqlDsnEnv, mysqlDsnEnvLegacy)
 	if !ok || dsn == "" {
 		var err error
@@ -795,7 +954,13 @@ func newReusedMysqlStore(ctx context.Context, store *SqlStore, kind types.Engine
 	sqlDB.SetMaxOpenConns(1)
 	sqlDB.SetMaxIdleConns(1)
 
-	dsn, cleanup, err := createRandomDB(dsn, db, kind)
+	tableDDL, err := mysqlSchemaTemplate(ctx, dsn, db)
+	if err != nil {
+		sqlDB.Close()
+		return nil, nil, err
+	}
+
+	dsn, cleanup, err := createRandomDB(dsn, db, kind, "")
 
 	sqlDB.Close()
 
@@ -803,28 +968,220 @@ func newReusedMysqlStore(ctx context.Context, store *SqlStore, kind types.Engine
 		return nil, nil, err
 	}
 
-	store, err = NewMysqlStoreFromSqlStore(ctx, store, dsn, nil)
-	if err != nil {
+	if err := cloneMysqlSchema(ctx, dsn, tableDDL); err != nil {
+		cleanup()
 		return nil, nil, err
 	}
 
+	var store *SqlStore
+	if sqliteStore != nil {
+		store, err = newMysqlStoreFromSqlStore(ctx, sqliteStore, dsn, nil, true)
+		if err != nil {
+			cleanup()
+			return nil, nil, err
+		}
+	} else {
+		store, err = NewMysqlStore(ctx, dsn, nil, false)
+		if err != nil {
+			cleanup()
+			return nil, nil, err
+		}
+	}
+
 	return store, cleanup, nil
 }
 
+// schemaTemplates remembers, per engine and server, a database that went
+// through the full migration once in this process. Every later test database
+// is cloned from it, so a test pays for CREATE DATABASE and a schema copy
+// instead of the 40-table AutoMigrate plus every pre and post migration, which
+// is what made each MySQL test store cost well over a second in CI.
+var (
+	schemaTemplatesMu sync.Mutex
+	schemaTemplates   = map[string]*schemaTemplate{}
+)
+
+type schemaTemplate struct {
+	dbName string
+	// tableDDL holds the CREATE TABLE statements of the template. MySQL has no
+	// server-side database template, so the schema is replayed statement by
+	// statement into each test database.
+	tableDDL []string
+}
+
+func schemaTemplateKey(engine types.Engine, dsn string) string {
+	return string(engine) + "|" + dsn
+}
+
+func newTestDBName(prefix string) string {
+	return fmt.Sprintf("%s_%s", prefix, strings.ReplaceAll(uuid.New().String(), "-", "_"))
+}
+
+// postgresSchemaTemplate returns the name of a fully migrated database that
+// CREATE DATABASE ... TEMPLATE can copy, creating it on first use.
+func postgresSchemaTemplate(ctx context.Context, baseDSN string, admin *gorm.DB) (string, error) {
+	schemaTemplatesMu.Lock()
+	defer schemaTemplatesMu.Unlock()
+
+	key := schemaTemplateKey(types.PostgresStoreEngine, baseDSN)
+	if tpl, ok := schemaTemplates[key]; ok {
+		return tpl.dbName, nil
+	}
+
+	name := newTestDBName("test_template")
+	if err := admin.Exec(fmt.Sprintf("CREATE DATABASE %s", name)).Error; err != nil {
+		return "", fmt.Errorf("create postgres template database: %w", err)
+	}
+
+	tplStore, err := NewPostgresqlStoreForTests(ctx, replaceDBName(baseDSN, name), nil, false)
+	if err != nil {
+		dropDatabase(admin, name)
+		return "", fmt.Errorf("migrate postgres template database: %w", err)
+	}
+	// TEMPLATE refuses a source that still has sessions, so release both handles
+	// before the first clone.
+	tplStore.Close(ctx)
+
+	schemaTemplates[key] = &schemaTemplate{dbName: name}
+	return name, nil
+}
+
+// mysqlSchemaTemplate returns the CREATE TABLE statements of a fully migrated
+// database, migrating one on first use.
+func mysqlSchemaTemplate(ctx context.Context, baseDSN string, admin *gorm.DB) ([]string, error) {
+	schemaTemplatesMu.Lock()
+	defer schemaTemplatesMu.Unlock()
+
+	key := schemaTemplateKey(types.MysqlStoreEngine, baseDSN)
+	if tpl, ok := schemaTemplates[key]; ok {
+		return tpl.tableDDL, nil
+	}
+
+	name := newTestDBName("test_template")
+	if err := admin.Exec(fmt.Sprintf("CREATE DATABASE %s", name)).Error; err != nil {
+		return nil, fmt.Errorf("create mysql template database: %w", err)
+	}
+
+	tplStore, err := NewMysqlStore(ctx, replaceDBName(baseDSN, name), nil, false)
+	if err != nil {
+		dropDatabase(admin, name)
+		return nil, fmt.Errorf("migrate mysql template database: %w", err)
+	}
+	tableDDL, err := mysqlTableDDL(ctx, tplStore.db, name)
+	tplStore.Close(ctx)
+	if err != nil {
+		dropDatabase(admin, name)
+		return nil, err
+	}
+
+	schemaTemplates[key] = &schemaTemplate{dbName: name, tableDDL: tableDDL}
+	return tableDDL, nil
+}
+
+func mysqlTableDDL(ctx context.Context, db *gorm.DB, dbName string) ([]string, error) {
+	sqlDB, err := db.DB()
+	if err != nil {
+		return nil, err
+	}
+
+	tables, err := mysqlTableNames(ctx, sqlDB, dbName)
+	if err != nil {
+		return nil, err
+	}
+
+	tableDDL := make([]string, 0, len(tables))
+	for _, table := range tables {
+		var name, createStmt string
+		row := sqlDB.QueryRowContext(ctx, fmt.Sprintf("SHOW CREATE TABLE %s.%s", dbName, table))
+		if err := row.Scan(&name, &createStmt); err != nil {
+			return nil, fmt.Errorf("read create statement of %s: %w", table, err)
+		}
+		tableDDL = append(tableDDL, createStmt)
+	}
+	return tableDDL, nil
+}
+
+func mysqlTableNames(ctx context.Context, sqlDB *sql.DB, dbName string) ([]string, error) {
+	rows, err := sqlDB.QueryContext(ctx, fmt.Sprintf("SHOW TABLES FROM %s", dbName))
+	if err != nil {
+		return nil, fmt.Errorf("list template tables: %w", err)
+	}
+	defer rows.Close()
+
+	var tables []string
+	for rows.Next() {
+		var table string
+		if err := rows.Scan(&table); err != nil {
+			return nil, fmt.Errorf("scan template table name: %w", err)
+		}
+		tables = append(tables, table)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("list template tables: %w", err)
+	}
+	return tables, nil
+}
+
+// cloneMysqlSchema replays the template's CREATE TABLE statements into the
+// database the DSN points at.
+func cloneMysqlSchema(ctx context.Context, dsn string, tableDDL []string) error {
+	gormDB, err := gorm.Open(mysql.Open(db.MysqlDSN(dsn)), db.GormConfig())
+	if err != nil {
+		return fmt.Errorf("connect to test database: %w", err)
+	}
+	sqlDB, err := gormDB.DB()
+	if err != nil {
+		return err
+	}
+	defer sqlDB.Close()
+
+	// The statements come out of SHOW TABLES in name order, not dependency
+	// order, and their foreign keys reference tables of the session's default
+	// database. Pin a single connection so the session setting below covers
+	// every statement, and connect straight to the new database so unqualified
+	// references land there.
+	sqlDB.SetMaxOpenConns(1)
+	if _, err := sqlDB.ExecContext(ctx, "SET FOREIGN_KEY_CHECKS = 0"); err != nil {
+		return fmt.Errorf("disable foreign key checks: %w", err)
+	}
+	for _, stmt := range tableDDL {
+		if _, err := sqlDB.ExecContext(ctx, stmt); err != nil {
+			return fmt.Errorf("replay table definition: %w", err)
+		}
+	}
+	return nil
+}
+
+// dropDatabase removes a template that never became usable, so a failed setup
+// does not leave it behind on a shared server. The server may still be tearing
+// down the sessions the failed migration held, so the drop retries while
+// Postgres reports the database as in use.
+func dropDatabase(admin *gorm.DB, name string) {
+	if err := execWithTemplateRetry(admin, fmt.Sprintf("DROP DATABASE IF EXISTS %s", name)); err != nil {
+		log.Warnf("failed to drop template database %s: %v", name, err)
+	}
+}
+
+func closeGormDB(db *gorm.DB) {
+	if sqlDB, _ := db.DB(); sqlDB != nil {
+		sqlDB.Close()
+	}
+}
+
 func openDBWithRetry(dsn string, engine types.Engine, maxRetries int) (*gorm.DB, error) {
-	var db *gorm.DB
+	var gormDB *gorm.DB
 	var err error
 
 	for i := range maxRetries {
 		switch engine {
 		case types.PostgresStoreEngine:
-			db, err = gorm.Open(postgres.Open(dsn), &gorm.Config{})
+			gormDB, err = gorm.Open(postgres.Open(dsn), &gorm.Config{})
 		case types.MysqlStoreEngine:
-			db, err = gorm.Open(mysql.Open(dsn+"?charset=utf8&parseTime=True&loc=Local"), &gorm.Config{})
+			gormDB, err = gorm.Open(mysql.Open(db.MysqlDSN(dsn)), &gorm.Config{})
 		}
 
 		if err == nil {
-			return db, nil
+			return gormDB, nil
 		}
 
 		if i < maxRetries-1 {
@@ -836,10 +1193,16 @@ func openDBWithRetry(dsn string, engine types.Engine, maxRetries int) (*gorm.DB,
 	return nil, err
 }
 
-func createRandomDB(dsn string, db *gorm.DB, engine types.Engine) (string, func(), error) {
-	dbName := fmt.Sprintf("test_db_%s", strings.ReplaceAll(uuid.New().String(), "-", "_"))
+// createRandomDB creates a uniquely named database for one test. On postgres a
+// non-empty template is copied server-side with CREATE DATABASE ... TEMPLATE.
+func createRandomDB(dsn string, admin *gorm.DB, engine types.Engine, template string) (string, func(), error) {
+	dbName := newTestDBName("test_db")
 
-	if err := db.Exec(fmt.Sprintf("CREATE DATABASE %s", dbName)).Error; err != nil {
+	createStmt := fmt.Sprintf("CREATE DATABASE %s", dbName)
+	if template != "" && engine == types.PostgresStoreEngine {
+		createStmt = fmt.Sprintf("CREATE DATABASE %s TEMPLATE %s", dbName, template)
+	}
+	if err := execWithTemplateRetry(admin, createStmt); err != nil {
 		return "", nil, fmt.Errorf("failed to create database: %v", err)
 	}
 
@@ -854,6 +1217,7 @@ func createRandomDB(dsn string, db *gorm.DB, engine types.Engine) (string, func(
 			dropDB, err = gorm.Open(postgres.Open(originalDSN), &gorm.Config{
 				SkipDefaultTransaction: true,
 				PrepareStmt:            false,
+				Logger:                 logger.Default.LogMode(logger.Info),
 			})
 			if err != nil {
 				log.Errorf("failed to connect for dropping database %s: %v", dbName, err)
@@ -874,7 +1238,7 @@ func createRandomDB(dsn string, db *gorm.DB, engine types.Engine) (string, func(
 			err = dropDB.Exec(fmt.Sprintf("DROP DATABASE IF EXISTS %s WITH (FORCE)", dbName)).Error
 
 		case types.MysqlStoreEngine:
-			dropDB, err = gorm.Open(mysql.Open(originalDSN+"?charset=utf8&parseTime=True&loc=Local"), &gorm.Config{
+			dropDB, err = gorm.Open(mysql.Open(db.MysqlDSN(originalDSN)), &gorm.Config{
 				SkipDefaultTransaction: true,
 				PrepareStmt:            false,
 			})
@@ -905,12 +1269,26 @@ func createRandomDB(dsn string, db *gorm.DB, engine types.Engine) (string, func(
 	return replaceDBName(dsn, dbName), cleanup, nil
 }
 
+// execWithTemplateRetry runs a statement, retrying briefly when postgres still
+// sees the template's just-closed sessions and refuses to copy it.
+func execWithTemplateRetry(db *gorm.DB, stmt string) error {
+	var err error
+	for attempt := 0; attempt < 20; attempt++ {
+		err = db.Exec(stmt).Error
+		if err == nil || !strings.Contains(err.Error(), "is being accessed by other users") {
+			return err
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	return err
+}
+
 func replaceDBName(dsn, newDBName string) string {
 	re := regexp.MustCompile(`(?P<pre>[:/@])(?P<dbname>[^/?]+)(?P<post>\?|$)`)
 	return re.ReplaceAllString(dsn, `${pre}`+newDBName+`${post}`)
 }
 
-func LoadSQL(db *gorm.DB, filepath string) error {
+func LoadSQL(db *gorm.DB, filepath string, translator *strings.Replacer) error {
 	sqlContent, err := os.ReadFile(filepath)
 	if err != nil {
 		return err
@@ -919,7 +1297,7 @@ func LoadSQL(db *gorm.DB, filepath string) error {
 	queries := strings.Split(string(sqlContent), ";")
 
 	for _, query := range queries {
-		query = strings.TrimSpace(query)
+		query = translator.Replace(strings.TrimSpace(query))
 		if query != "" {
 			err := db.Exec(query).Error
 			if err != nil {
@@ -938,7 +1316,7 @@ func MigrateFileStoreToSqlite(ctx context.Context, dataDir string) error {
 		return fmt.Errorf("%s doesn't exist, couldn't continue the operation", fileStorePath)
 	}
 
-	sqlStorePath := path.Join(dataDir, storeSqliteFileName)
+	sqlStorePath := path.Join(dataDir, db.SqliteFileName)
 	if _, err := os.Stat(sqlStorePath); err == nil {
 		return fmt.Errorf("%s already exists, couldn't continue the operation", sqlStorePath)
 	}
diff --git a/management/server/store/store_mock.go b/management/server/store/store_mock.go
index fdd2d0900..8b89219e5 100644
--- a/management/server/store/store_mock.go
+++ b/management/server/store/store_mock.go
@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: ./store.go
+//
+// Generated by this command:
+//
+//	mockgen -package store -destination=store_mock.go -source=./store.go -build_flags=-mod=mod
+//
 
 // Package store is a generated GoMock package.
 package store
@@ -11,28 +16,30 @@ import (
 	reflect "reflect"
 	time "time"
 
-	gomock "github.com/golang/mock/gomock"
 	dns "github.com/netbirdio/netbird/dns"
-	accesslogs "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	types "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	domain "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	proxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	service "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	zones "github.com/netbirdio/netbird/management/internals/modules/zones"
 	records "github.com/netbirdio/netbird/management/internals/modules/zones/records"
-	types "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	types0 "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	types1 "github.com/netbirdio/netbird/management/server/networks/types"
+	types0 "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	types1 "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	types2 "github.com/netbirdio/netbird/management/server/networks/types"
 	peer "github.com/netbirdio/netbird/management/server/peer"
 	posture "github.com/netbirdio/netbird/management/server/posture"
-	types2 "github.com/netbirdio/netbird/management/server/types"
+	types3 "github.com/netbirdio/netbird/management/server/types"
 	route "github.com/netbirdio/netbird/route"
+	domain0 "github.com/netbirdio/netbird/shared/management/domain"
 	crypt "github.com/netbirdio/netbird/util/crypt"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockStore is a mock of Store interface.
 type MockStore struct {
 	ctrl     *gomock.Controller
 	recorder *MockStoreMockRecorder
+	isgomock struct{}
 }
 
 // MockStoreMockRecorder is the mock recorder for MockStore.
@@ -62,7 +69,7 @@ func (m *MockStore) AccountExists(ctx context.Context, lockStrength LockingStren
 }
 
 // AccountExists indicates an expected call of AccountExists.
-func (mr *MockStoreMockRecorder) AccountExists(ctx, lockStrength, id interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) AccountExists(ctx, lockStrength, id any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AccountExists", reflect.TypeOf((*MockStore)(nil).AccountExists), ctx, lockStrength, id)
 }
@@ -76,23 +83,23 @@ func (m *MockStore) AcquireGlobalLock(ctx context.Context) func() {
 }
 
 // AcquireGlobalLock indicates an expected call of AcquireGlobalLock.
-func (mr *MockStoreMockRecorder) AcquireGlobalLock(ctx interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) AcquireGlobalLock(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AcquireGlobalLock", reflect.TypeOf((*MockStore)(nil).AcquireGlobalLock), ctx)
 }
 
 // AddPeerToAccount mocks base method.
-func (m *MockStore) AddPeerToAccount(ctx context.Context, peer *peer.Peer) error {
+func (m *MockStore) AddPeerToAccount(ctx context.Context, arg1 *peer.Peer) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "AddPeerToAccount", ctx, peer)
+	ret := m.ctrl.Call(m, "AddPeerToAccount", ctx, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // AddPeerToAccount indicates an expected call of AddPeerToAccount.
-func (mr *MockStoreMockRecorder) AddPeerToAccount(ctx, peer interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) AddPeerToAccount(ctx, arg1 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddPeerToAccount", reflect.TypeOf((*MockStore)(nil).AddPeerToAccount), ctx, peer)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddPeerToAccount", reflect.TypeOf((*MockStore)(nil).AddPeerToAccount), ctx, arg1)
 }
 
 // AddPeerToAllGroup mocks base method.
@@ -104,7 +111,7 @@ func (m *MockStore) AddPeerToAllGroup(ctx context.Context, accountID, peerID str
 }
 
 // AddPeerToAllGroup indicates an expected call of AddPeerToAllGroup.
-func (mr *MockStoreMockRecorder) AddPeerToAllGroup(ctx, accountID, peerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) AddPeerToAllGroup(ctx, accountID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddPeerToAllGroup", reflect.TypeOf((*MockStore)(nil).AddPeerToAllGroup), ctx, accountID, peerID)
 }
@@ -118,13 +125,13 @@ func (m *MockStore) AddPeerToGroup(ctx context.Context, accountID, peerId, group
 }
 
 // AddPeerToGroup indicates an expected call of AddPeerToGroup.
-func (mr *MockStoreMockRecorder) AddPeerToGroup(ctx, accountID, peerId, groupID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) AddPeerToGroup(ctx, accountID, peerId, groupID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddPeerToGroup", reflect.TypeOf((*MockStore)(nil).AddPeerToGroup), ctx, accountID, peerId, groupID)
 }
 
 // AddResourceToGroup mocks base method.
-func (m *MockStore) AddResourceToGroup(ctx context.Context, accountId, groupID string, resource *types2.Resource) error {
+func (m *MockStore) AddResourceToGroup(ctx context.Context, accountId, groupID string, resource *types3.Resource) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "AddResourceToGroup", ctx, accountId, groupID, resource)
 	ret0, _ := ret[0].(error)
@@ -132,7 +139,7 @@ func (m *MockStore) AddResourceToGroup(ctx context.Context, accountId, groupID s
 }
 
 // AddResourceToGroup indicates an expected call of AddResourceToGroup.
-func (mr *MockStoreMockRecorder) AddResourceToGroup(ctx, accountId, groupID, resource interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) AddResourceToGroup(ctx, accountId, groupID, resource any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddResourceToGroup", reflect.TypeOf((*MockStore)(nil).AddResourceToGroup), ctx, accountId, groupID, resource)
 }
@@ -147,7 +154,7 @@ func (m *MockStore) ApproveAccountPeers(ctx context.Context, accountID string) (
 }
 
 // ApproveAccountPeers indicates an expected call of ApproveAccountPeers.
-func (mr *MockStoreMockRecorder) ApproveAccountPeers(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) ApproveAccountPeers(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ApproveAccountPeers", reflect.TypeOf((*MockStore)(nil).ApproveAccountPeers), ctx, accountID)
 }
@@ -161,7 +168,7 @@ func (m *MockStore) CleanupStaleProxies(ctx context.Context, inactivityDuration
 }
 
 // CleanupStaleProxies indicates an expected call of CleanupStaleProxies.
-func (mr *MockStoreMockRecorder) CleanupStaleProxies(ctx, inactivityDuration interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CleanupStaleProxies(ctx, inactivityDuration any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupStaleProxies", reflect.TypeOf((*MockStore)(nil).CleanupStaleProxies), ctx, inactivityDuration)
 }
@@ -175,13 +182,13 @@ func (m *MockStore) Close(ctx context.Context) error {
 }
 
 // Close indicates an expected call of Close.
-func (mr *MockStoreMockRecorder) Close(ctx interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) Close(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockStore)(nil).Close), ctx)
 }
 
 // CompletePeerJob mocks base method.
-func (m *MockStore) CompletePeerJob(ctx context.Context, job *types2.Job) error {
+func (m *MockStore) CompletePeerJob(ctx context.Context, job *types3.Job) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CompletePeerJob", ctx, job)
 	ret0, _ := ret[0].(error)
@@ -189,24 +196,24 @@ func (m *MockStore) CompletePeerJob(ctx context.Context, job *types2.Job) error
 }
 
 // CompletePeerJob indicates an expected call of CompletePeerJob.
-func (mr *MockStoreMockRecorder) CompletePeerJob(ctx, job interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CompletePeerJob(ctx, job any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CompletePeerJob", reflect.TypeOf((*MockStore)(nil).CompletePeerJob), ctx, job)
 }
 
 // CountAccountsByPrivateDomain mocks base method.
-func (m *MockStore) CountAccountsByPrivateDomain(ctx context.Context, domain string) (int64, error) {
+func (m *MockStore) CountAccountsByPrivateDomain(ctx context.Context, arg1 string) (int64, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CountAccountsByPrivateDomain", ctx, domain)
+	ret := m.ctrl.Call(m, "CountAccountsByPrivateDomain", ctx, arg1)
 	ret0, _ := ret[0].(int64)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // CountAccountsByPrivateDomain indicates an expected call of CountAccountsByPrivateDomain.
-func (mr *MockStoreMockRecorder) CountAccountsByPrivateDomain(ctx, domain interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CountAccountsByPrivateDomain(ctx, arg1 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountsByPrivateDomain", reflect.TypeOf((*MockStore)(nil).CountAccountsByPrivateDomain), ctx, domain)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountsByPrivateDomain", reflect.TypeOf((*MockStore)(nil).CountAccountsByPrivateDomain), ctx, arg1)
 }
 
 // CountEphemeralServicesByPeer mocks base method.
@@ -219,7 +226,7 @@ func (m *MockStore) CountEphemeralServicesByPeer(ctx context.Context, lockStreng
 }
 
 // CountEphemeralServicesByPeer indicates an expected call of CountEphemeralServicesByPeer.
-func (mr *MockStoreMockRecorder) CountEphemeralServicesByPeer(ctx, lockStrength, accountID, peerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CountEphemeralServicesByPeer(ctx, lockStrength, accountID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountEphemeralServicesByPeer", reflect.TypeOf((*MockStore)(nil).CountEphemeralServicesByPeer), ctx, lockStrength, accountID, peerID)
 }
@@ -234,23 +241,51 @@ func (m *MockStore) CountProxiesByAccountID(ctx context.Context, accountID strin
 }
 
 // CountProxiesByAccountID indicates an expected call of CountProxiesByAccountID.
-func (mr *MockStoreMockRecorder) CountProxiesByAccountID(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CountProxiesByAccountID(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountProxiesByAccountID", reflect.TypeOf((*MockStore)(nil).CountProxiesByAccountID), ctx, accountID)
 }
 
-// CreateAccessLog mocks base method.
-func (m *MockStore) CreateAccessLog(ctx context.Context, log *accesslogs.AccessLogEntry) error {
+// CreateAgentNetworkAccessLog mocks base method.
+func (m *MockStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *types.AgentNetworkAccessLog, groups []types.AgentNetworkAccessLogGroup) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateAccessLog", ctx, log)
+	ret := m.ctrl.Call(m, "CreateAgentNetworkAccessLog", ctx, entry, groups)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
-// CreateAccessLog indicates an expected call of CreateAccessLog.
-func (mr *MockStoreMockRecorder) CreateAccessLog(ctx, log interface{}) *gomock.Call {
+// CreateAgentNetworkAccessLog indicates an expected call of CreateAgentNetworkAccessLog.
+func (mr *MockStoreMockRecorder) CreateAgentNetworkAccessLog(ctx, entry, groups any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAccessLog", reflect.TypeOf((*MockStore)(nil).CreateAccessLog), ctx, log)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkAccessLog", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkAccessLog), ctx, entry, groups)
+}
+
+// CreateAgentNetworkSettings mocks base method.
+func (m *MockStore) CreateAgentNetworkSettings(ctx context.Context, settings *types.Settings) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateAgentNetworkSettings", ctx, settings)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateAgentNetworkSettings indicates an expected call of CreateAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) CreateAgentNetworkSettings(ctx, settings any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkSettings), ctx, settings)
+}
+
+// CreateAgentNetworkUsage mocks base method.
+func (m *MockStore) CreateAgentNetworkUsage(ctx context.Context, usage *types.AgentNetworkUsage, groups []types.AgentNetworkUsageGroup) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateAgentNetworkUsage", ctx, usage, groups)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateAgentNetworkUsage indicates an expected call of CreateAgentNetworkUsage.
+func (mr *MockStoreMockRecorder) CreateAgentNetworkUsage(ctx, usage, groups any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkUsage", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkUsage), ctx, usage, groups)
 }
 
 // CreateCustomDomain mocks base method.
@@ -263,7 +298,7 @@ func (m *MockStore) CreateCustomDomain(ctx context.Context, accountID, domainNam
 }
 
 // CreateCustomDomain indicates an expected call of CreateCustomDomain.
-func (mr *MockStoreMockRecorder) CreateCustomDomain(ctx, accountID, domainName, targetCluster, validated interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CreateCustomDomain(ctx, accountID, domainName, targetCluster, validated any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateCustomDomain", reflect.TypeOf((*MockStore)(nil).CreateCustomDomain), ctx, accountID, domainName, targetCluster, validated)
 }
@@ -277,13 +312,13 @@ func (m *MockStore) CreateDNSRecord(ctx context.Context, record *records.Record)
 }
 
 // CreateDNSRecord indicates an expected call of CreateDNSRecord.
-func (mr *MockStoreMockRecorder) CreateDNSRecord(ctx, record interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CreateDNSRecord(ctx, record any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateDNSRecord", reflect.TypeOf((*MockStore)(nil).CreateDNSRecord), ctx, record)
 }
 
 // CreateGroup mocks base method.
-func (m *MockStore) CreateGroup(ctx context.Context, group *types2.Group) error {
+func (m *MockStore) CreateGroup(ctx context.Context, group *types3.Group) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateGroup", ctx, group)
 	ret0, _ := ret[0].(error)
@@ -291,13 +326,13 @@ func (m *MockStore) CreateGroup(ctx context.Context, group *types2.Group) error
 }
 
 // CreateGroup indicates an expected call of CreateGroup.
-func (mr *MockStoreMockRecorder) CreateGroup(ctx, group interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CreateGroup(ctx, group any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateGroup", reflect.TypeOf((*MockStore)(nil).CreateGroup), ctx, group)
 }
 
 // CreateGroups mocks base method.
-func (m *MockStore) CreateGroups(ctx context.Context, accountID string, groups []*types2.Group) error {
+func (m *MockStore) CreateGroups(ctx context.Context, accountID string, groups []*types3.Group) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateGroups", ctx, accountID, groups)
 	ret0, _ := ret[0].(error)
@@ -305,13 +340,13 @@ func (m *MockStore) CreateGroups(ctx context.Context, accountID string, groups [
 }
 
 // CreateGroups indicates an expected call of CreateGroups.
-func (mr *MockStoreMockRecorder) CreateGroups(ctx, accountID, groups interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CreateGroups(ctx, accountID, groups any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateGroups", reflect.TypeOf((*MockStore)(nil).CreateGroups), ctx, accountID, groups)
 }
 
 // CreateNetworkRouter mocks base method.
-func (m *MockStore) CreateNetworkRouter(ctx context.Context, router *types0.NetworkRouter) error {
+func (m *MockStore) CreateNetworkRouter(ctx context.Context, router *types1.NetworkRouter) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateNetworkRouter", ctx, router)
 	ret0, _ := ret[0].(error)
@@ -319,13 +354,13 @@ func (m *MockStore) CreateNetworkRouter(ctx context.Context, router *types0.Netw
 }
 
 // CreateNetworkRouter indicates an expected call of CreateNetworkRouter.
-func (mr *MockStoreMockRecorder) CreateNetworkRouter(ctx, router interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CreateNetworkRouter(ctx, router any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateNetworkRouter", reflect.TypeOf((*MockStore)(nil).CreateNetworkRouter), ctx, router)
 }
 
 // CreatePeerJob mocks base method.
-func (m *MockStore) CreatePeerJob(ctx context.Context, job *types2.Job) error {
+func (m *MockStore) CreatePeerJob(ctx context.Context, job *types3.Job) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreatePeerJob", ctx, job)
 	ret0, _ := ret[0].(error)
@@ -333,13 +368,13 @@ func (m *MockStore) CreatePeerJob(ctx context.Context, job *types2.Job) error {
 }
 
 // CreatePeerJob indicates an expected call of CreatePeerJob.
-func (mr *MockStoreMockRecorder) CreatePeerJob(ctx, job interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CreatePeerJob(ctx, job any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreatePeerJob", reflect.TypeOf((*MockStore)(nil).CreatePeerJob), ctx, job)
 }
 
 // CreatePolicy mocks base method.
-func (m *MockStore) CreatePolicy(ctx context.Context, policy *types2.Policy) error {
+func (m *MockStore) CreatePolicy(ctx context.Context, policy *types3.Policy) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreatePolicy", ctx, policy)
 	ret0, _ := ret[0].(error)
@@ -347,23 +382,23 @@ func (m *MockStore) CreatePolicy(ctx context.Context, policy *types2.Policy) err
 }
 
 // CreatePolicy indicates an expected call of CreatePolicy.
-func (mr *MockStoreMockRecorder) CreatePolicy(ctx, policy interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CreatePolicy(ctx, policy any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreatePolicy", reflect.TypeOf((*MockStore)(nil).CreatePolicy), ctx, policy)
 }
 
 // CreateService mocks base method.
-func (m *MockStore) CreateService(ctx context.Context, service *service.Service) error {
+func (m *MockStore) CreateService(ctx context.Context, arg1 *service.Service) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateService", ctx, service)
+	ret := m.ctrl.Call(m, "CreateService", ctx, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateService indicates an expected call of CreateService.
-func (mr *MockStoreMockRecorder) CreateService(ctx, service interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CreateService(ctx, arg1 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateService", reflect.TypeOf((*MockStore)(nil).CreateService), ctx, service)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateService", reflect.TypeOf((*MockStore)(nil).CreateService), ctx, arg1)
 }
 
 // CreateZone mocks base method.
@@ -375,13 +410,13 @@ func (m *MockStore) CreateZone(ctx context.Context, zone *zones.Zone) error {
 }
 
 // CreateZone indicates an expected call of CreateZone.
-func (mr *MockStoreMockRecorder) CreateZone(ctx, zone interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) CreateZone(ctx, zone any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateZone", reflect.TypeOf((*MockStore)(nil).CreateZone), ctx, zone)
 }
 
 // DeleteAccount mocks base method.
-func (m *MockStore) DeleteAccount(ctx context.Context, account *types2.Account) error {
+func (m *MockStore) DeleteAccount(ctx context.Context, account *types3.Account) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeleteAccount", ctx, account)
 	ret0, _ := ret[0].(error)
@@ -389,7 +424,7 @@ func (m *MockStore) DeleteAccount(ctx context.Context, account *types2.Account)
 }
 
 // DeleteAccount indicates an expected call of DeleteAccount.
-func (mr *MockStoreMockRecorder) DeleteAccount(ctx, account interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteAccount(ctx, account any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccount", reflect.TypeOf((*MockStore)(nil).DeleteAccount), ctx, account)
 }
@@ -403,11 +438,96 @@ func (m *MockStore) DeleteAccountCluster(ctx context.Context, clusterAddress, ac
 }
 
 // DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
-func (mr *MockStoreMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockStore)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
 }
 
+// DeleteAgentNetworkBudgetRule mocks base method.
+func (m *MockStore) DeleteAgentNetworkBudgetRule(ctx context.Context, accountID, ruleID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkBudgetRule", ctx, accountID, ruleID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkBudgetRule indicates an expected call of DeleteAgentNetworkBudgetRule.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkBudgetRule(ctx, accountID, ruleID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkBudgetRule), ctx, accountID, ruleID)
+}
+
+// DeleteAgentNetworkConsumptionOfDeletedAccounts mocks base method.
+func (m *MockStore) DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx context.Context) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkConsumptionOfDeletedAccounts", ctx)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DeleteAgentNetworkConsumptionOfDeletedAccounts indicates an expected call of DeleteAgentNetworkConsumptionOfDeletedAccounts.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkConsumptionOfDeletedAccounts", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkConsumptionOfDeletedAccounts), ctx)
+}
+
+// DeleteAgentNetworkGuardrail mocks base method.
+func (m *MockStore) DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkGuardrail", ctx, accountID, guardrailID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkGuardrail indicates an expected call of DeleteAgentNetworkGuardrail.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkGuardrail(ctx, accountID, guardrailID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkGuardrail", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkGuardrail), ctx, accountID, guardrailID)
+}
+
+// DeleteAgentNetworkPolicy mocks base method.
+func (m *MockStore) DeleteAgentNetworkPolicy(ctx context.Context, accountID, policyID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkPolicy", ctx, accountID, policyID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkPolicy indicates an expected call of DeleteAgentNetworkPolicy.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkPolicy(ctx, accountID, policyID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkPolicy", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkPolicy), ctx, accountID, policyID)
+}
+
+// DeleteAgentNetworkProvider mocks base method.
+func (m *MockStore) DeleteAgentNetworkProvider(ctx context.Context, accountID, providerID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkProvider", ctx, accountID, providerID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkProvider indicates an expected call of DeleteAgentNetworkProvider.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkProvider(ctx, accountID, providerID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkProvider", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkProvider), ctx, accountID, providerID)
+}
+
+// DeleteAgentNetworkSettings mocks base method.
+func (m *MockStore) DeleteAgentNetworkSettings(ctx context.Context, accountID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkSettings", ctx, accountID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkSettings indicates an expected call of DeleteAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkSettings(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkSettings), ctx, accountID)
+}
+
 // DeleteCustomDomain mocks base method.
 func (m *MockStore) DeleteCustomDomain(ctx context.Context, accountID, domainID string) error {
 	m.ctrl.T.Helper()
@@ -417,7 +537,7 @@ func (m *MockStore) DeleteCustomDomain(ctx context.Context, accountID, domainID
 }
 
 // DeleteCustomDomain indicates an expected call of DeleteCustomDomain.
-func (mr *MockStoreMockRecorder) DeleteCustomDomain(ctx, accountID, domainID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteCustomDomain(ctx, accountID, domainID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteCustomDomain", reflect.TypeOf((*MockStore)(nil).DeleteCustomDomain), ctx, accountID, domainID)
 }
@@ -431,11 +551,26 @@ func (m *MockStore) DeleteDNSRecord(ctx context.Context, accountID, zoneID, reco
 }
 
 // DeleteDNSRecord indicates an expected call of DeleteDNSRecord.
-func (mr *MockStoreMockRecorder) DeleteDNSRecord(ctx, accountID, zoneID, recordID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteDNSRecord(ctx, accountID, zoneID, recordID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteDNSRecord", reflect.TypeOf((*MockStore)(nil).DeleteDNSRecord), ctx, accountID, zoneID, recordID)
 }
 
+// DeleteExpiredCustomDomain mocks base method.
+func (m *MockStore) DeleteExpiredCustomDomain(ctx context.Context, d *domain.Domain, now time.Time) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteExpiredCustomDomain", ctx, d, now)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DeleteExpiredCustomDomain indicates an expected call of DeleteExpiredCustomDomain.
+func (mr *MockStoreMockRecorder) DeleteExpiredCustomDomain(ctx, d, now any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteExpiredCustomDomain", reflect.TypeOf((*MockStore)(nil).DeleteExpiredCustomDomain), ctx, d, now)
+}
+
 // DeleteGroup mocks base method.
 func (m *MockStore) DeleteGroup(ctx context.Context, accountID, groupID string) error {
 	m.ctrl.T.Helper()
@@ -445,7 +580,7 @@ func (m *MockStore) DeleteGroup(ctx context.Context, accountID, groupID string)
 }
 
 // DeleteGroup indicates an expected call of DeleteGroup.
-func (mr *MockStoreMockRecorder) DeleteGroup(ctx, accountID, groupID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteGroup(ctx, accountID, groupID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteGroup", reflect.TypeOf((*MockStore)(nil).DeleteGroup), ctx, accountID, groupID)
 }
@@ -459,7 +594,7 @@ func (m *MockStore) DeleteGroups(ctx context.Context, accountID string, groupIDs
 }
 
 // DeleteGroups indicates an expected call of DeleteGroups.
-func (mr *MockStoreMockRecorder) DeleteGroups(ctx, accountID, groupIDs interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteGroups(ctx, accountID, groupIDs any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteGroups", reflect.TypeOf((*MockStore)(nil).DeleteGroups), ctx, accountID, groupIDs)
 }
@@ -473,7 +608,7 @@ func (m *MockStore) DeleteHashedPAT2TokenIDIndex(hashedToken string) error {
 }
 
 // DeleteHashedPAT2TokenIDIndex indicates an expected call of DeleteHashedPAT2TokenIDIndex.
-func (mr *MockStoreMockRecorder) DeleteHashedPAT2TokenIDIndex(hashedToken interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteHashedPAT2TokenIDIndex(hashedToken any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteHashedPAT2TokenIDIndex", reflect.TypeOf((*MockStore)(nil).DeleteHashedPAT2TokenIDIndex), hashedToken)
 }
@@ -487,7 +622,7 @@ func (m *MockStore) DeleteNameServerGroup(ctx context.Context, accountID, nameSe
 }
 
 // DeleteNameServerGroup indicates an expected call of DeleteNameServerGroup.
-func (mr *MockStoreMockRecorder) DeleteNameServerGroup(ctx, accountID, nameServerGroupID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteNameServerGroup(ctx, accountID, nameServerGroupID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteNameServerGroup", reflect.TypeOf((*MockStore)(nil).DeleteNameServerGroup), ctx, accountID, nameServerGroupID)
 }
@@ -501,7 +636,7 @@ func (m *MockStore) DeleteNetwork(ctx context.Context, accountID, networkID stri
 }
 
 // DeleteNetwork indicates an expected call of DeleteNetwork.
-func (mr *MockStoreMockRecorder) DeleteNetwork(ctx, accountID, networkID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteNetwork(ctx, accountID, networkID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteNetwork", reflect.TypeOf((*MockStore)(nil).DeleteNetwork), ctx, accountID, networkID)
 }
@@ -515,7 +650,7 @@ func (m *MockStore) DeleteNetworkResource(ctx context.Context, accountID, resour
 }
 
 // DeleteNetworkResource indicates an expected call of DeleteNetworkResource.
-func (mr *MockStoreMockRecorder) DeleteNetworkResource(ctx, accountID, resourceID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteNetworkResource(ctx, accountID, resourceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteNetworkResource", reflect.TypeOf((*MockStore)(nil).DeleteNetworkResource), ctx, accountID, resourceID)
 }
@@ -529,24 +664,24 @@ func (m *MockStore) DeleteNetworkRouter(ctx context.Context, accountID, routerID
 }
 
 // DeleteNetworkRouter indicates an expected call of DeleteNetworkRouter.
-func (mr *MockStoreMockRecorder) DeleteNetworkRouter(ctx, accountID, routerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteNetworkRouter(ctx, accountID, routerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteNetworkRouter", reflect.TypeOf((*MockStore)(nil).DeleteNetworkRouter), ctx, accountID, routerID)
 }
 
-// DeleteOldAccessLogs mocks base method.
-func (m *MockStore) DeleteOldAccessLogs(ctx context.Context, olderThan time.Time) (int64, error) {
+// DeleteOldAgentNetworkAccessLogs mocks base method.
+func (m *MockStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteOldAccessLogs", ctx, olderThan)
+	ret := m.ctrl.Call(m, "DeleteOldAgentNetworkAccessLogs", ctx, accountID, olderThan)
 	ret0, _ := ret[0].(int64)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
-// DeleteOldAccessLogs indicates an expected call of DeleteOldAccessLogs.
-func (mr *MockStoreMockRecorder) DeleteOldAccessLogs(ctx, olderThan interface{}) *gomock.Call {
+// DeleteOldAgentNetworkAccessLogs indicates an expected call of DeleteOldAgentNetworkAccessLogs.
+func (mr *MockStoreMockRecorder) DeleteOldAgentNetworkAccessLogs(ctx, accountID, olderThan any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOldAccessLogs", reflect.TypeOf((*MockStore)(nil).DeleteOldAccessLogs), ctx, olderThan)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOldAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).DeleteOldAgentNetworkAccessLogs), ctx, accountID, olderThan)
 }
 
 // DeletePAT mocks base method.
@@ -558,7 +693,7 @@ func (m *MockStore) DeletePAT(ctx context.Context, userID, patID string) error {
 }
 
 // DeletePAT indicates an expected call of DeletePAT.
-func (mr *MockStoreMockRecorder) DeletePAT(ctx, userID, patID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeletePAT(ctx, userID, patID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePAT", reflect.TypeOf((*MockStore)(nil).DeletePAT), ctx, userID, patID)
 }
@@ -572,7 +707,7 @@ func (m *MockStore) DeletePeer(ctx context.Context, accountID, peerID string) er
 }
 
 // DeletePeer indicates an expected call of DeletePeer.
-func (mr *MockStoreMockRecorder) DeletePeer(ctx, accountID, peerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeletePeer(ctx, accountID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePeer", reflect.TypeOf((*MockStore)(nil).DeletePeer), ctx, accountID, peerID)
 }
@@ -586,7 +721,7 @@ func (m *MockStore) DeletePolicy(ctx context.Context, accountID, policyID string
 }
 
 // DeletePolicy indicates an expected call of DeletePolicy.
-func (mr *MockStoreMockRecorder) DeletePolicy(ctx, accountID, policyID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeletePolicy(ctx, accountID, policyID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePolicy", reflect.TypeOf((*MockStore)(nil).DeletePolicy), ctx, accountID, policyID)
 }
@@ -600,7 +735,7 @@ func (m *MockStore) DeletePostureChecks(ctx context.Context, accountID, postureC
 }
 
 // DeletePostureChecks indicates an expected call of DeletePostureChecks.
-func (mr *MockStoreMockRecorder) DeletePostureChecks(ctx, accountID, postureChecksID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeletePostureChecks(ctx, accountID, postureChecksID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePostureChecks", reflect.TypeOf((*MockStore)(nil).DeletePostureChecks), ctx, accountID, postureChecksID)
 }
@@ -614,7 +749,7 @@ func (m *MockStore) DeleteRoute(ctx context.Context, accountID, routeID string)
 }
 
 // DeleteRoute indicates an expected call of DeleteRoute.
-func (mr *MockStoreMockRecorder) DeleteRoute(ctx, accountID, routeID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteRoute(ctx, accountID, routeID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteRoute", reflect.TypeOf((*MockStore)(nil).DeleteRoute), ctx, accountID, routeID)
 }
@@ -628,7 +763,7 @@ func (m *MockStore) DeleteService(ctx context.Context, accountID, serviceID stri
 }
 
 // DeleteService indicates an expected call of DeleteService.
-func (mr *MockStoreMockRecorder) DeleteService(ctx, accountID, serviceID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteService(ctx, accountID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteService", reflect.TypeOf((*MockStore)(nil).DeleteService), ctx, accountID, serviceID)
 }
@@ -642,7 +777,7 @@ func (m *MockStore) DeleteServiceTargets(ctx context.Context, accountID, service
 }
 
 // DeleteServiceTargets indicates an expected call of DeleteServiceTargets.
-func (mr *MockStoreMockRecorder) DeleteServiceTargets(ctx, accountID, serviceID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteServiceTargets(ctx, accountID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteServiceTargets", reflect.TypeOf((*MockStore)(nil).DeleteServiceTargets), ctx, accountID, serviceID)
 }
@@ -656,7 +791,7 @@ func (m *MockStore) DeleteSetupKey(ctx context.Context, accountID, keyID string)
 }
 
 // DeleteSetupKey indicates an expected call of DeleteSetupKey.
-func (mr *MockStoreMockRecorder) DeleteSetupKey(ctx, accountID, keyID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteSetupKey(ctx, accountID, keyID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteSetupKey", reflect.TypeOf((*MockStore)(nil).DeleteSetupKey), ctx, accountID, keyID)
 }
@@ -670,7 +805,7 @@ func (m *MockStore) DeleteTarget(ctx context.Context, accountID, serviceID strin
 }
 
 // DeleteTarget indicates an expected call of DeleteTarget.
-func (mr *MockStoreMockRecorder) DeleteTarget(ctx, accountID, serviceID, targetID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteTarget(ctx, accountID, serviceID, targetID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteTarget", reflect.TypeOf((*MockStore)(nil).DeleteTarget), ctx, accountID, serviceID, targetID)
 }
@@ -684,7 +819,7 @@ func (m *MockStore) DeleteTokenID2UserIDIndex(tokenID string) error {
 }
 
 // DeleteTokenID2UserIDIndex indicates an expected call of DeleteTokenID2UserIDIndex.
-func (mr *MockStoreMockRecorder) DeleteTokenID2UserIDIndex(tokenID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteTokenID2UserIDIndex(tokenID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteTokenID2UserIDIndex", reflect.TypeOf((*MockStore)(nil).DeleteTokenID2UserIDIndex), tokenID)
 }
@@ -698,7 +833,7 @@ func (m *MockStore) DeleteUser(ctx context.Context, accountID, userID string) er
 }
 
 // DeleteUser indicates an expected call of DeleteUser.
-func (mr *MockStoreMockRecorder) DeleteUser(ctx, accountID, userID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteUser(ctx, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteUser", reflect.TypeOf((*MockStore)(nil).DeleteUser), ctx, accountID, userID)
 }
@@ -712,7 +847,7 @@ func (m *MockStore) DeleteUserInvite(ctx context.Context, inviteID string) error
 }
 
 // DeleteUserInvite indicates an expected call of DeleteUserInvite.
-func (mr *MockStoreMockRecorder) DeleteUserInvite(ctx, inviteID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteUserInvite(ctx, inviteID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteUserInvite", reflect.TypeOf((*MockStore)(nil).DeleteUserInvite), ctx, inviteID)
 }
@@ -726,7 +861,7 @@ func (m *MockStore) DeleteZone(ctx context.Context, accountID, zoneID string) er
 }
 
 // DeleteZone indicates an expected call of DeleteZone.
-func (mr *MockStoreMockRecorder) DeleteZone(ctx, accountID, zoneID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteZone(ctx, accountID, zoneID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteZone", reflect.TypeOf((*MockStore)(nil).DeleteZone), ctx, accountID, zoneID)
 }
@@ -740,11 +875,26 @@ func (m *MockStore) DeleteZoneDNSRecords(ctx context.Context, accountID, zoneID
 }
 
 // DeleteZoneDNSRecords indicates an expected call of DeleteZoneDNSRecords.
-func (mr *MockStoreMockRecorder) DeleteZoneDNSRecords(ctx, accountID, zoneID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DeleteZoneDNSRecords(ctx, accountID, zoneID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteZoneDNSRecords", reflect.TypeOf((*MockStore)(nil).DeleteZoneDNSRecords), ctx, accountID, zoneID)
 }
 
+// DisconnectAllProxies mocks base method.
+func (m *MockStore) DisconnectAllProxies(ctx context.Context) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DisconnectAllProxies", ctx)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DisconnectAllProxies indicates an expected call of DisconnectAllProxies.
+func (mr *MockStoreMockRecorder) DisconnectAllProxies(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DisconnectAllProxies", reflect.TypeOf((*MockStore)(nil).DisconnectAllProxies), ctx)
+}
+
 // DisconnectProxy mocks base method.
 func (m *MockStore) DisconnectProxy(ctx context.Context, proxyID, sessionID string) error {
 	m.ctrl.T.Helper()
@@ -754,24 +904,24 @@ func (m *MockStore) DisconnectProxy(ctx context.Context, proxyID, sessionID stri
 }
 
 // DisconnectProxy indicates an expected call of DisconnectProxy.
-func (mr *MockStoreMockRecorder) DisconnectProxy(ctx, proxyID, sessionID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) DisconnectProxy(ctx, proxyID, sessionID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DisconnectProxy", reflect.TypeOf((*MockStore)(nil).DisconnectProxy), ctx, proxyID, sessionID)
 }
 
 // EphemeralServiceExists mocks base method.
-func (m *MockStore) EphemeralServiceExists(ctx context.Context, lockStrength LockingStrength, accountID, peerID, domain string) (bool, error) {
+func (m *MockStore) EphemeralServiceExists(ctx context.Context, lockStrength LockingStrength, accountID, peerID, arg4 string) (bool, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "EphemeralServiceExists", ctx, lockStrength, accountID, peerID, domain)
+	ret := m.ctrl.Call(m, "EphemeralServiceExists", ctx, lockStrength, accountID, peerID, arg4)
 	ret0, _ := ret[0].(bool)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // EphemeralServiceExists indicates an expected call of EphemeralServiceExists.
-func (mr *MockStoreMockRecorder) EphemeralServiceExists(ctx, lockStrength, accountID, peerID, domain interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) EphemeralServiceExists(ctx, lockStrength, accountID, peerID, arg4 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "EphemeralServiceExists", reflect.TypeOf((*MockStore)(nil).EphemeralServiceExists), ctx, lockStrength, accountID, peerID, domain)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "EphemeralServiceExists", reflect.TypeOf((*MockStore)(nil).EphemeralServiceExists), ctx, lockStrength, accountID, peerID, arg4)
 }
 
 // ExecuteInTransaction mocks base method.
@@ -783,113 +933,157 @@ func (m *MockStore) ExecuteInTransaction(ctx context.Context, f func(Store) erro
 }
 
 // ExecuteInTransaction indicates an expected call of ExecuteInTransaction.
-func (mr *MockStoreMockRecorder) ExecuteInTransaction(ctx, f interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) ExecuteInTransaction(ctx, f any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ExecuteInTransaction", reflect.TypeOf((*MockStore)(nil).ExecuteInTransaction), ctx, f)
 }
 
 // GetAccount mocks base method.
-func (m *MockStore) GetAccount(ctx context.Context, accountID string) (*types2.Account, error) {
+func (m *MockStore) GetAccount(ctx context.Context, accountID string) (*types3.Account, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccount", ctx, accountID)
-	ret0, _ := ret[0].(*types2.Account)
+	ret0, _ := ret[0].(*types3.Account)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccount indicates an expected call of GetAccount.
-func (mr *MockStoreMockRecorder) GetAccount(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccount(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccount", reflect.TypeOf((*MockStore)(nil).GetAccount), ctx, accountID)
 }
 
-// GetAccountAccessLogs mocks base method.
-func (m *MockStore) GetAccountAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error) {
+// GetAccountAgentNetworkBudgetRules mocks base method.
+func (m *MockStore) GetAccountAgentNetworkBudgetRules(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.AccountBudgetRule, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountAccessLogs", ctx, lockStrength, accountID, filter)
-	ret0, _ := ret[0].([]*accesslogs.AccessLogEntry)
-	ret1, _ := ret[1].(int64)
-	ret2, _ := ret[2].(error)
-	return ret0, ret1, ret2
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkBudgetRules", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*types.AccountBudgetRule)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
 }
 
-// GetAccountAccessLogs indicates an expected call of GetAccountAccessLogs.
-func (mr *MockStoreMockRecorder) GetAccountAccessLogs(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
+// GetAccountAgentNetworkBudgetRules indicates an expected call of GetAccountAgentNetworkBudgetRules.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkBudgetRules(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAccessLogs", reflect.TypeOf((*MockStore)(nil).GetAccountAccessLogs), ctx, lockStrength, accountID, filter)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkBudgetRules", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkBudgetRules), ctx, lockStrength, accountID)
+}
+
+// GetAccountAgentNetworkGuardrails mocks base method.
+func (m *MockStore) GetAccountAgentNetworkGuardrails(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.Guardrail, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkGuardrails", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*types.Guardrail)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkGuardrails indicates an expected call of GetAccountAgentNetworkGuardrails.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkGuardrails(ctx, lockStrength, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkGuardrails", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkGuardrails), ctx, lockStrength, accountID)
+}
+
+// GetAccountAgentNetworkPolicies mocks base method.
+func (m *MockStore) GetAccountAgentNetworkPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.Policy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkPolicies", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*types.Policy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkPolicies indicates an expected call of GetAccountAgentNetworkPolicies.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkPolicies(ctx, lockStrength, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkPolicies", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkPolicies), ctx, lockStrength, accountID)
+}
+
+// GetAccountAgentNetworkProviders mocks base method.
+func (m *MockStore) GetAccountAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.Provider, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkProviders", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*types.Provider)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkProviders indicates an expected call of GetAccountAgentNetworkProviders.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkProviders(ctx, lockStrength, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkProviders", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkProviders), ctx, lockStrength, accountID)
 }
 
 // GetAccountByPeerID mocks base method.
-func (m *MockStore) GetAccountByPeerID(ctx context.Context, peerID string) (*types2.Account, error) {
+func (m *MockStore) GetAccountByPeerID(ctx context.Context, peerID string) (*types3.Account, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountByPeerID", ctx, peerID)
-	ret0, _ := ret[0].(*types2.Account)
+	ret0, _ := ret[0].(*types3.Account)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountByPeerID indicates an expected call of GetAccountByPeerID.
-func (mr *MockStoreMockRecorder) GetAccountByPeerID(ctx, peerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountByPeerID(ctx, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountByPeerID", reflect.TypeOf((*MockStore)(nil).GetAccountByPeerID), ctx, peerID)
 }
 
 // GetAccountByPeerPubKey mocks base method.
-func (m *MockStore) GetAccountByPeerPubKey(ctx context.Context, peerKey string) (*types2.Account, error) {
+func (m *MockStore) GetAccountByPeerPubKey(ctx context.Context, peerKey string) (*types3.Account, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountByPeerPubKey", ctx, peerKey)
-	ret0, _ := ret[0].(*types2.Account)
+	ret0, _ := ret[0].(*types3.Account)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountByPeerPubKey indicates an expected call of GetAccountByPeerPubKey.
-func (mr *MockStoreMockRecorder) GetAccountByPeerPubKey(ctx, peerKey interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountByPeerPubKey(ctx, peerKey any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountByPeerPubKey", reflect.TypeOf((*MockStore)(nil).GetAccountByPeerPubKey), ctx, peerKey)
 }
 
 // GetAccountByPrivateDomain mocks base method.
-func (m *MockStore) GetAccountByPrivateDomain(ctx context.Context, domain string) (*types2.Account, error) {
+func (m *MockStore) GetAccountByPrivateDomain(ctx context.Context, arg1 string) (*types3.Account, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountByPrivateDomain", ctx, domain)
-	ret0, _ := ret[0].(*types2.Account)
+	ret := m.ctrl.Call(m, "GetAccountByPrivateDomain", ctx, arg1)
+	ret0, _ := ret[0].(*types3.Account)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountByPrivateDomain indicates an expected call of GetAccountByPrivateDomain.
-func (mr *MockStoreMockRecorder) GetAccountByPrivateDomain(ctx, domain interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountByPrivateDomain(ctx, arg1 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountByPrivateDomain", reflect.TypeOf((*MockStore)(nil).GetAccountByPrivateDomain), ctx, domain)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountByPrivateDomain", reflect.TypeOf((*MockStore)(nil).GetAccountByPrivateDomain), ctx, arg1)
 }
 
 // GetAccountBySetupKey mocks base method.
-func (m *MockStore) GetAccountBySetupKey(ctx context.Context, setupKey string) (*types2.Account, error) {
+func (m *MockStore) GetAccountBySetupKey(ctx context.Context, setupKey string) (*types3.Account, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountBySetupKey", ctx, setupKey)
-	ret0, _ := ret[0].(*types2.Account)
+	ret0, _ := ret[0].(*types3.Account)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountBySetupKey indicates an expected call of GetAccountBySetupKey.
-func (mr *MockStoreMockRecorder) GetAccountBySetupKey(ctx, setupKey interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountBySetupKey(ctx, setupKey any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountBySetupKey", reflect.TypeOf((*MockStore)(nil).GetAccountBySetupKey), ctx, setupKey)
 }
 
 // GetAccountByUser mocks base method.
-func (m *MockStore) GetAccountByUser(ctx context.Context, userID string) (*types2.Account, error) {
+func (m *MockStore) GetAccountByUser(ctx context.Context, userID string) (*types3.Account, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountByUser", ctx, userID)
-	ret0, _ := ret[0].(*types2.Account)
+	ret0, _ := ret[0].(*types3.Account)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountByUser indicates an expected call of GetAccountByUser.
-func (mr *MockStoreMockRecorder) GetAccountByUser(ctx, userID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountByUser(ctx, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountByUser", reflect.TypeOf((*MockStore)(nil).GetAccountByUser), ctx, userID)
 }
@@ -904,22 +1098,22 @@ func (m *MockStore) GetAccountCreatedBy(ctx context.Context, lockStrength Lockin
 }
 
 // GetAccountCreatedBy indicates an expected call of GetAccountCreatedBy.
-func (mr *MockStoreMockRecorder) GetAccountCreatedBy(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountCreatedBy(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountCreatedBy", reflect.TypeOf((*MockStore)(nil).GetAccountCreatedBy), ctx, lockStrength, accountID)
 }
 
 // GetAccountDNSSettings mocks base method.
-func (m *MockStore) GetAccountDNSSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*types2.DNSSettings, error) {
+func (m *MockStore) GetAccountDNSSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*types3.DNSSettings, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountDNSSettings", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].(*types2.DNSSettings)
+	ret0, _ := ret[0].(*types3.DNSSettings)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountDNSSettings indicates an expected call of GetAccountDNSSettings.
-func (mr *MockStoreMockRecorder) GetAccountDNSSettings(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountDNSSettings(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountDNSSettings", reflect.TypeOf((*MockStore)(nil).GetAccountDNSSettings), ctx, lockStrength, accountID)
 }
@@ -935,7 +1129,7 @@ func (m *MockStore) GetAccountDomainAndCategory(ctx context.Context, lockStrengt
 }
 
 // GetAccountDomainAndCategory indicates an expected call of GetAccountDomainAndCategory.
-func (mr *MockStoreMockRecorder) GetAccountDomainAndCategory(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountDomainAndCategory(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountDomainAndCategory", reflect.TypeOf((*MockStore)(nil).GetAccountDomainAndCategory), ctx, lockStrength, accountID)
 }
@@ -950,22 +1144,22 @@ func (m *MockStore) GetAccountGroupPeers(ctx context.Context, lockStrength Locki
 }
 
 // GetAccountGroupPeers indicates an expected call of GetAccountGroupPeers.
-func (mr *MockStoreMockRecorder) GetAccountGroupPeers(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountGroupPeers(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountGroupPeers", reflect.TypeOf((*MockStore)(nil).GetAccountGroupPeers), ctx, lockStrength, accountID)
 }
 
 // GetAccountGroups mocks base method.
-func (m *MockStore) GetAccountGroups(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types2.Group, error) {
+func (m *MockStore) GetAccountGroups(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types3.Group, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountGroups", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*types2.Group)
+	ret0, _ := ret[0].([]*types3.Group)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountGroups indicates an expected call of GetAccountGroups.
-func (mr *MockStoreMockRecorder) GetAccountGroups(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountGroups(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountGroups", reflect.TypeOf((*MockStore)(nil).GetAccountGroups), ctx, lockStrength, accountID)
 }
@@ -980,7 +1174,7 @@ func (m *MockStore) GetAccountIDByPeerID(ctx context.Context, lockStrength Locki
 }
 
 // GetAccountIDByPeerID indicates an expected call of GetAccountIDByPeerID.
-func (mr *MockStoreMockRecorder) GetAccountIDByPeerID(ctx, lockStrength, peerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountIDByPeerID(ctx, lockStrength, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountIDByPeerID", reflect.TypeOf((*MockStore)(nil).GetAccountIDByPeerID), ctx, lockStrength, peerID)
 }
@@ -995,24 +1189,24 @@ func (m *MockStore) GetAccountIDByPeerPubKey(ctx context.Context, peerKey string
 }
 
 // GetAccountIDByPeerPubKey indicates an expected call of GetAccountIDByPeerPubKey.
-func (mr *MockStoreMockRecorder) GetAccountIDByPeerPubKey(ctx, peerKey interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountIDByPeerPubKey(ctx, peerKey any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountIDByPeerPubKey", reflect.TypeOf((*MockStore)(nil).GetAccountIDByPeerPubKey), ctx, peerKey)
 }
 
 // GetAccountIDByPrivateDomain mocks base method.
-func (m *MockStore) GetAccountIDByPrivateDomain(ctx context.Context, lockStrength LockingStrength, domain string) (string, error) {
+func (m *MockStore) GetAccountIDByPrivateDomain(ctx context.Context, lockStrength LockingStrength, arg2 string) (string, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountIDByPrivateDomain", ctx, lockStrength, domain)
+	ret := m.ctrl.Call(m, "GetAccountIDByPrivateDomain", ctx, lockStrength, arg2)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountIDByPrivateDomain indicates an expected call of GetAccountIDByPrivateDomain.
-func (mr *MockStoreMockRecorder) GetAccountIDByPrivateDomain(ctx, lockStrength, domain interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountIDByPrivateDomain(ctx, lockStrength, arg2 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountIDByPrivateDomain", reflect.TypeOf((*MockStore)(nil).GetAccountIDByPrivateDomain), ctx, lockStrength, domain)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountIDByPrivateDomain", reflect.TypeOf((*MockStore)(nil).GetAccountIDByPrivateDomain), ctx, lockStrength, arg2)
 }
 
 // GetAccountIDBySetupKey mocks base method.
@@ -1025,7 +1219,7 @@ func (m *MockStore) GetAccountIDBySetupKey(ctx context.Context, peerKey string)
 }
 
 // GetAccountIDBySetupKey indicates an expected call of GetAccountIDBySetupKey.
-func (mr *MockStoreMockRecorder) GetAccountIDBySetupKey(ctx, peerKey interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountIDBySetupKey(ctx, peerKey any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountIDBySetupKey", reflect.TypeOf((*MockStore)(nil).GetAccountIDBySetupKey), ctx, peerKey)
 }
@@ -1040,22 +1234,22 @@ func (m *MockStore) GetAccountIDByUserID(ctx context.Context, lockStrength Locki
 }
 
 // GetAccountIDByUserID indicates an expected call of GetAccountIDByUserID.
-func (mr *MockStoreMockRecorder) GetAccountIDByUserID(ctx, lockStrength, userID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountIDByUserID(ctx, lockStrength, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountIDByUserID", reflect.TypeOf((*MockStore)(nil).GetAccountIDByUserID), ctx, lockStrength, userID)
 }
 
 // GetAccountMeta mocks base method.
-func (m *MockStore) GetAccountMeta(ctx context.Context, lockStrength LockingStrength, accountID string) (*types2.AccountMeta, error) {
+func (m *MockStore) GetAccountMeta(ctx context.Context, lockStrength LockingStrength, accountID string) (*types3.AccountMeta, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountMeta", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].(*types2.AccountMeta)
+	ret0, _ := ret[0].(*types3.AccountMeta)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountMeta indicates an expected call of GetAccountMeta.
-func (mr *MockStoreMockRecorder) GetAccountMeta(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountMeta(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountMeta", reflect.TypeOf((*MockStore)(nil).GetAccountMeta), ctx, lockStrength, accountID)
 }
@@ -1070,84 +1264,100 @@ func (m *MockStore) GetAccountNameServerGroups(ctx context.Context, lockStrength
 }
 
 // GetAccountNameServerGroups indicates an expected call of GetAccountNameServerGroups.
-func (mr *MockStoreMockRecorder) GetAccountNameServerGroups(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountNameServerGroups(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountNameServerGroups", reflect.TypeOf((*MockStore)(nil).GetAccountNameServerGroups), ctx, lockStrength, accountID)
 }
 
 // GetAccountNetwork mocks base method.
-func (m *MockStore) GetAccountNetwork(ctx context.Context, lockStrength LockingStrength, accountId string) (*types2.Network, error) {
+func (m *MockStore) GetAccountNetwork(ctx context.Context, lockStrength LockingStrength, accountId string) (*types3.Network, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountNetwork", ctx, lockStrength, accountId)
-	ret0, _ := ret[0].(*types2.Network)
+	ret0, _ := ret[0].(*types3.Network)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountNetwork indicates an expected call of GetAccountNetwork.
-func (mr *MockStoreMockRecorder) GetAccountNetwork(ctx, lockStrength, accountId interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountNetwork(ctx, lockStrength, accountId any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountNetwork", reflect.TypeOf((*MockStore)(nil).GetAccountNetwork), ctx, lockStrength, accountId)
 }
 
 // GetAccountNetworks mocks base method.
-func (m *MockStore) GetAccountNetworks(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types1.Network, error) {
+func (m *MockStore) GetAccountNetworks(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types2.Network, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountNetworks", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*types1.Network)
+	ret0, _ := ret[0].([]*types2.Network)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountNetworks indicates an expected call of GetAccountNetworks.
-func (mr *MockStoreMockRecorder) GetAccountNetworks(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountNetworks(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountNetworks", reflect.TypeOf((*MockStore)(nil).GetAccountNetworks), ctx, lockStrength, accountID)
 }
 
 // GetAccountOnboarding mocks base method.
-func (m *MockStore) GetAccountOnboarding(ctx context.Context, accountID string) (*types2.AccountOnboarding, error) {
+func (m *MockStore) GetAccountOnboarding(ctx context.Context, accountID string) (*types3.AccountOnboarding, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountOnboarding", ctx, accountID)
-	ret0, _ := ret[0].(*types2.AccountOnboarding)
+	ret0, _ := ret[0].(*types3.AccountOnboarding)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountOnboarding indicates an expected call of GetAccountOnboarding.
-func (mr *MockStoreMockRecorder) GetAccountOnboarding(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountOnboarding(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountOnboarding", reflect.TypeOf((*MockStore)(nil).GetAccountOnboarding), ctx, accountID)
 }
 
 // GetAccountOwner mocks base method.
-func (m *MockStore) GetAccountOwner(ctx context.Context, lockStrength LockingStrength, accountID string) (*types2.User, error) {
+func (m *MockStore) GetAccountOwner(ctx context.Context, lockStrength LockingStrength, accountID string) (*types3.User, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountOwner", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].(*types2.User)
+	ret0, _ := ret[0].(*types3.User)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountOwner indicates an expected call of GetAccountOwner.
-func (mr *MockStoreMockRecorder) GetAccountOwner(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountOwner(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountOwner", reflect.TypeOf((*MockStore)(nil).GetAccountOwner), ctx, lockStrength, accountID)
 }
 
 // GetAccountPeers mocks base method.
-func (m *MockStore) GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter string) ([]*peer.Peer, error) {
+func (m *MockStore) GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter, macFilter string) ([]*peer.Peer, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountPeers", ctx, lockStrength, accountID, nameFilter, ipFilter)
+	ret := m.ctrl.Call(m, "GetAccountPeers", ctx, lockStrength, accountID, nameFilter, ipFilter, macFilter)
 	ret0, _ := ret[0].([]*peer.Peer)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountPeers indicates an expected call of GetAccountPeers.
-func (mr *MockStoreMockRecorder) GetAccountPeers(ctx, lockStrength, accountID, nameFilter, ipFilter interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountPeers(ctx, lockStrength, accountID, nameFilter, ipFilter, macFilter any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeers", reflect.TypeOf((*MockStore)(nil).GetAccountPeers), ctx, lockStrength, accountID, nameFilter, ipFilter)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeers", reflect.TypeOf((*MockStore)(nil).GetAccountPeers), ctx, lockStrength, accountID, nameFilter, ipFilter, macFilter)
+}
+
+// GetAccountPeersPaginated mocks base method.
+func (m *MockStore) GetAccountPeersPaginated(ctx context.Context, lockStrength LockingStrength, accountID string, pagination PaginationState, filters PeerFilters, sorting PeerSorting) ([]*peer.Peer, int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountPeersPaginated", ctx, lockStrength, accountID, pagination, filters, sorting)
+	ret0, _ := ret[0].([]*peer.Peer)
+	ret1, _ := ret[1].(int)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetAccountPeersPaginated indicates an expected call of GetAccountPeersPaginated.
+func (mr *MockStoreMockRecorder) GetAccountPeersPaginated(ctx, lockStrength, accountID, pagination, filters, sorting any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeersPaginated", reflect.TypeOf((*MockStore)(nil).GetAccountPeersPaginated), ctx, lockStrength, accountID, pagination, filters, sorting)
 }
 
 // GetAccountPeersWithExpiration mocks base method.
@@ -1160,7 +1370,7 @@ func (m *MockStore) GetAccountPeersWithExpiration(ctx context.Context, lockStren
 }
 
 // GetAccountPeersWithExpiration indicates an expected call of GetAccountPeersWithExpiration.
-func (mr *MockStoreMockRecorder) GetAccountPeersWithExpiration(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountPeersWithExpiration(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeersWithExpiration", reflect.TypeOf((*MockStore)(nil).GetAccountPeersWithExpiration), ctx, lockStrength, accountID)
 }
@@ -1175,22 +1385,22 @@ func (m *MockStore) GetAccountPeersWithInactivity(ctx context.Context, lockStren
 }
 
 // GetAccountPeersWithInactivity indicates an expected call of GetAccountPeersWithInactivity.
-func (mr *MockStoreMockRecorder) GetAccountPeersWithInactivity(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountPeersWithInactivity(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeersWithInactivity", reflect.TypeOf((*MockStore)(nil).GetAccountPeersWithInactivity), ctx, lockStrength, accountID)
 }
 
 // GetAccountPolicies mocks base method.
-func (m *MockStore) GetAccountPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types2.Policy, error) {
+func (m *MockStore) GetAccountPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types3.Policy, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountPolicies", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*types2.Policy)
+	ret0, _ := ret[0].([]*types3.Policy)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountPolicies indicates an expected call of GetAccountPolicies.
-func (mr *MockStoreMockRecorder) GetAccountPolicies(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountPolicies(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPolicies", reflect.TypeOf((*MockStore)(nil).GetAccountPolicies), ctx, lockStrength, accountID)
 }
@@ -1205,7 +1415,7 @@ func (m *MockStore) GetAccountPostureChecks(ctx context.Context, lockStrength Lo
 }
 
 // GetAccountPostureChecks indicates an expected call of GetAccountPostureChecks.
-func (mr *MockStoreMockRecorder) GetAccountPostureChecks(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountPostureChecks(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPostureChecks", reflect.TypeOf((*MockStore)(nil).GetAccountPostureChecks), ctx, lockStrength, accountID)
 }
@@ -1220,7 +1430,7 @@ func (m *MockStore) GetAccountRoutes(ctx context.Context, lockStrength LockingSt
 }
 
 // GetAccountRoutes indicates an expected call of GetAccountRoutes.
-func (mr *MockStoreMockRecorder) GetAccountRoutes(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountRoutes(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountRoutes", reflect.TypeOf((*MockStore)(nil).GetAccountRoutes), ctx, lockStrength, accountID)
 }
@@ -1235,67 +1445,67 @@ func (m *MockStore) GetAccountServices(ctx context.Context, lockStrength Locking
 }
 
 // GetAccountServices indicates an expected call of GetAccountServices.
-func (mr *MockStoreMockRecorder) GetAccountServices(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountServices(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountServices", reflect.TypeOf((*MockStore)(nil).GetAccountServices), ctx, lockStrength, accountID)
 }
 
 // GetAccountSettings mocks base method.
-func (m *MockStore) GetAccountSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*types2.Settings, error) {
+func (m *MockStore) GetAccountSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*types3.Settings, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountSettings", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].(*types2.Settings)
+	ret0, _ := ret[0].(*types3.Settings)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountSettings indicates an expected call of GetAccountSettings.
-func (mr *MockStoreMockRecorder) GetAccountSettings(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountSettings(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountSettings", reflect.TypeOf((*MockStore)(nil).GetAccountSettings), ctx, lockStrength, accountID)
 }
 
 // GetAccountSetupKeys mocks base method.
-func (m *MockStore) GetAccountSetupKeys(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types2.SetupKey, error) {
+func (m *MockStore) GetAccountSetupKeys(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types3.SetupKey, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountSetupKeys", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*types2.SetupKey)
+	ret0, _ := ret[0].([]*types3.SetupKey)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountSetupKeys indicates an expected call of GetAccountSetupKeys.
-func (mr *MockStoreMockRecorder) GetAccountSetupKeys(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountSetupKeys(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountSetupKeys", reflect.TypeOf((*MockStore)(nil).GetAccountSetupKeys), ctx, lockStrength, accountID)
 }
 
 // GetAccountUserInvites mocks base method.
-func (m *MockStore) GetAccountUserInvites(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types2.UserInviteRecord, error) {
+func (m *MockStore) GetAccountUserInvites(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types3.UserInviteRecord, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountUserInvites", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*types2.UserInviteRecord)
+	ret0, _ := ret[0].([]*types3.UserInviteRecord)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountUserInvites indicates an expected call of GetAccountUserInvites.
-func (mr *MockStoreMockRecorder) GetAccountUserInvites(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountUserInvites(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountUserInvites", reflect.TypeOf((*MockStore)(nil).GetAccountUserInvites), ctx, lockStrength, accountID)
 }
 
 // GetAccountUsers mocks base method.
-func (m *MockStore) GetAccountUsers(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types2.User, error) {
+func (m *MockStore) GetAccountUsers(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types3.User, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccountUsers", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*types2.User)
+	ret0, _ := ret[0].([]*types3.User)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountUsers indicates an expected call of GetAccountUsers.
-func (mr *MockStoreMockRecorder) GetAccountUsers(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountUsers(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountUsers", reflect.TypeOf((*MockStore)(nil).GetAccountUsers), ctx, lockStrength, accountID)
 }
@@ -1310,7 +1520,7 @@ func (m *MockStore) GetAccountZones(ctx context.Context, lockStrength LockingStr
 }
 
 // GetAccountZones indicates an expected call of GetAccountZones.
-func (mr *MockStoreMockRecorder) GetAccountZones(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountZones(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountZones", reflect.TypeOf((*MockStore)(nil).GetAccountZones), ctx, lockStrength, accountID)
 }
@@ -1325,7 +1535,7 @@ func (m *MockStore) GetAccountsCounter(ctx context.Context) (int64, error) {
 }
 
 // GetAccountsCounter indicates an expected call of GetAccountsCounter.
-func (mr *MockStoreMockRecorder) GetAccountsCounter(ctx interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountsCounter(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountsCounter", reflect.TypeOf((*MockStore)(nil).GetAccountsCounter), ctx)
 }
@@ -1340,7 +1550,7 @@ func (m *MockStore) GetActiveProxyClusterAddresses(ctx context.Context) ([]strin
 }
 
 // GetActiveProxyClusterAddresses indicates an expected call of GetActiveProxyClusterAddresses.
-func (mr *MockStoreMockRecorder) GetActiveProxyClusterAddresses(ctx interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetActiveProxyClusterAddresses(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveProxyClusterAddresses", reflect.TypeOf((*MockStore)(nil).GetActiveProxyClusterAddresses), ctx)
 }
@@ -1355,25 +1565,267 @@ func (m *MockStore) GetActiveProxyClusterAddressesForAccount(ctx context.Context
 }
 
 // GetActiveProxyClusterAddressesForAccount indicates an expected call of GetActiveProxyClusterAddressesForAccount.
-func (mr *MockStoreMockRecorder) GetActiveProxyClusterAddressesForAccount(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetActiveProxyClusterAddressesForAccount(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveProxyClusterAddressesForAccount", reflect.TypeOf((*MockStore)(nil).GetActiveProxyClusterAddressesForAccount), ctx, accountID)
 }
 
+// GetActiveProxyVersions mocks base method.
+func (m *MockStore) GetActiveProxyVersions(ctx context.Context, clusterAddr string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetActiveProxyVersions", ctx, clusterAddr)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetActiveProxyVersions indicates an expected call of GetActiveProxyVersions.
+func (mr *MockStoreMockRecorder) GetActiveProxyVersions(ctx, clusterAddr any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveProxyVersions", reflect.TypeOf((*MockStore)(nil).GetActiveProxyVersions), ctx, clusterAddr)
+}
+
+// GetAgentNetworkAccessLogSessions mocks base method.
+func (m *MockStore) GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkAccessLogSessions", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*types.AgentNetworkAccessLogSession)
+	ret1, _ := ret[1].(int64)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetAgentNetworkAccessLogSessions indicates an expected call of GetAgentNetworkAccessLogSessions.
+func (mr *MockStoreMockRecorder) GetAgentNetworkAccessLogSessions(ctx, lockStrength, accountID, filter any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkAccessLogSessions", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkAccessLogSessions), ctx, lockStrength, accountID, filter)
+}
+
+// GetAgentNetworkAccessLogs mocks base method.
+func (m *MockStore) GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkAccessLogs", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*types.AgentNetworkAccessLog)
+	ret1, _ := ret[1].(int64)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetAgentNetworkAccessLogs indicates an expected call of GetAgentNetworkAccessLogs.
+func (mr *MockStoreMockRecorder) GetAgentNetworkAccessLogs(ctx, lockStrength, accountID, filter any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkAccessLogs), ctx, lockStrength, accountID, filter)
+}
+
+// GetAgentNetworkBudgetRuleByID mocks base method.
+func (m *MockStore) GetAgentNetworkBudgetRuleByID(ctx context.Context, lockStrength LockingStrength, accountID, ruleID string) (*types.AccountBudgetRule, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkBudgetRuleByID", ctx, lockStrength, accountID, ruleID)
+	ret0, _ := ret[0].(*types.AccountBudgetRule)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkBudgetRuleByID indicates an expected call of GetAgentNetworkBudgetRuleByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkBudgetRuleByID(ctx, lockStrength, accountID, ruleID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkBudgetRuleByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkBudgetRuleByID), ctx, lockStrength, accountID, ruleID)
+}
+
+// GetAgentNetworkConsumption mocks base method.
+func (m *MockStore) GetAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string, kind types.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time) (*types.Consumption, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkConsumption", ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart)
+	ret0, _ := ret[0].(*types.Consumption)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkConsumption indicates an expected call of GetAgentNetworkConsumption.
+func (mr *MockStoreMockRecorder) GetAgentNetworkConsumption(ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkConsumption), ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart)
+}
+
+// GetAgentNetworkConsumptionBatch mocks base method.
+func (m *MockStore) GetAgentNetworkConsumptionBatch(ctx context.Context, lockStrength LockingStrength, accountID string, keys []types.ConsumptionKey) (map[types.ConsumptionKey]*types.Consumption, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkConsumptionBatch", ctx, lockStrength, accountID, keys)
+	ret0, _ := ret[0].(map[types.ConsumptionKey]*types.Consumption)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkConsumptionBatch indicates an expected call of GetAgentNetworkConsumptionBatch.
+func (mr *MockStoreMockRecorder) GetAgentNetworkConsumptionBatch(ctx, lockStrength, accountID, keys any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkConsumptionBatch", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkConsumptionBatch), ctx, lockStrength, accountID, keys)
+}
+
+// GetAgentNetworkGuardrailByID mocks base method.
+func (m *MockStore) GetAgentNetworkGuardrailByID(ctx context.Context, lockStrength LockingStrength, accountID, guardrailID string) (*types.Guardrail, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkGuardrailByID", ctx, lockStrength, accountID, guardrailID)
+	ret0, _ := ret[0].(*types.Guardrail)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkGuardrailByID indicates an expected call of GetAgentNetworkGuardrailByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkGuardrailByID(ctx, lockStrength, accountID, guardrailID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkGuardrailByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkGuardrailByID), ctx, lockStrength, accountID, guardrailID)
+}
+
+// GetAgentNetworkMetrics mocks base method.
+func (m *MockStore) GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetrics, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkMetrics", ctx)
+	ret0, _ := ret[0].(AgentNetworkMetrics)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkMetrics indicates an expected call of GetAgentNetworkMetrics.
+func (mr *MockStoreMockRecorder) GetAgentNetworkMetrics(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkMetrics", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkMetrics), ctx)
+}
+
+// GetAgentNetworkPolicyByID mocks base method.
+func (m *MockStore) GetAgentNetworkPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*types.Policy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkPolicyByID", ctx, lockStrength, accountID, policyID)
+	ret0, _ := ret[0].(*types.Policy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkPolicyByID indicates an expected call of GetAgentNetworkPolicyByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkPolicyByID(ctx, lockStrength, accountID, policyID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkPolicyByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkPolicyByID), ctx, lockStrength, accountID, policyID)
+}
+
+// GetAgentNetworkProviderByID mocks base method.
+func (m *MockStore) GetAgentNetworkProviderByID(ctx context.Context, lockStrength LockingStrength, accountID, providerID string) (*types.Provider, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkProviderByID", ctx, lockStrength, accountID, providerID)
+	ret0, _ := ret[0].(*types.Provider)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkProviderByID indicates an expected call of GetAgentNetworkProviderByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkProviderByID(ctx, lockStrength, accountID, providerID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkProviderByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkProviderByID), ctx, lockStrength, accountID, providerID)
+}
+
+// GetAgentNetworkSettings mocks base method.
+func (m *MockStore) GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*types.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettings", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].(*types.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkSettings indicates an expected call of GetAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettings(ctx, lockStrength, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettings), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkSettingsByDomain mocks base method.
+func (m *MockStore) GetAgentNetworkSettingsByDomain(ctx context.Context, lockStrength LockingStrength, arg2 string) (*types.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByDomain", ctx, lockStrength, arg2)
+	ret0, _ := ret[0].(*types.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkSettingsByDomain indicates an expected call of GetAgentNetworkSettingsByDomain.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByDomain(ctx, lockStrength, arg2 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByDomain", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByDomain), ctx, lockStrength, arg2)
+}
+
+// GetAgentNetworkSettingsByProxyAddress mocks base method.
+func (m *MockStore) GetAgentNetworkSettingsByProxyAddress(ctx context.Context, lockStrength LockingStrength, proxyAddress string) ([]*types.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByProxyAddress", ctx, lockStrength, proxyAddress)
+	ret0, _ := ret[0].([]*types.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkSettingsByProxyAddress indicates an expected call of GetAgentNetworkSettingsByProxyAddress.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByProxyAddress(ctx, lockStrength, proxyAddress any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByProxyAddress", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByProxyAddress), ctx, lockStrength, proxyAddress)
+}
+
+// GetAgentNetworkUsageRows mocks base method.
+func (m *MockStore) GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkUsage, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkUsageRows", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*types.AgentNetworkUsage)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkUsageRows indicates an expected call of GetAgentNetworkUsageRows.
+func (mr *MockStoreMockRecorder) GetAgentNetworkUsageRows(ctx, lockStrength, accountID, filter any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkUsageRows", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkUsageRows), ctx, lockStrength, accountID, filter)
+}
+
 // GetAllAccounts mocks base method.
-func (m *MockStore) GetAllAccounts(ctx context.Context) []*types2.Account {
+func (m *MockStore) GetAllAccounts(ctx context.Context) []*types3.Account {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAllAccounts", ctx)
-	ret0, _ := ret[0].([]*types2.Account)
+	ret0, _ := ret[0].([]*types3.Account)
 	return ret0
 }
 
 // GetAllAccounts indicates an expected call of GetAllAccounts.
-func (mr *MockStoreMockRecorder) GetAllAccounts(ctx interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAllAccounts(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAccounts", reflect.TypeOf((*MockStore)(nil).GetAllAccounts), ctx)
 }
 
+// GetAllAgentNetworkProviders mocks base method.
+func (m *MockStore) GetAllAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength) ([]*types.Provider, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAllAgentNetworkProviders", ctx, lockStrength)
+	ret0, _ := ret[0].([]*types.Provider)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAllAgentNetworkProviders indicates an expected call of GetAllAgentNetworkProviders.
+func (mr *MockStoreMockRecorder) GetAllAgentNetworkProviders(ctx, lockStrength any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAgentNetworkProviders", reflect.TypeOf((*MockStore)(nil).GetAllAgentNetworkProviders), ctx, lockStrength)
+}
+
+// GetAllAgentNetworkSettings mocks base method.
+func (m *MockStore) GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*types.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAllAgentNetworkSettings", ctx, lockStrength)
+	ret0, _ := ret[0].([]*types.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAllAgentNetworkSettings indicates an expected call of GetAllAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) GetAllAgentNetworkSettings(ctx, lockStrength any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAllAgentNetworkSettings), ctx, lockStrength)
+}
+
 // GetAllEphemeralPeers mocks base method.
 func (m *MockStore) GetAllEphemeralPeers(ctx context.Context, lockStrength LockingStrength) ([]*peer.Peer, error) {
 	m.ctrl.T.Helper()
@@ -1384,22 +1836,37 @@ func (m *MockStore) GetAllEphemeralPeers(ctx context.Context, lockStrength Locki
 }
 
 // GetAllEphemeralPeers indicates an expected call of GetAllEphemeralPeers.
-func (mr *MockStoreMockRecorder) GetAllEphemeralPeers(ctx, lockStrength interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAllEphemeralPeers(ctx, lockStrength any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllEphemeralPeers", reflect.TypeOf((*MockStore)(nil).GetAllEphemeralPeers), ctx, lockStrength)
 }
 
+// GetAllProxies mocks base method.
+func (m *MockStore) GetAllProxies(ctx context.Context) ([]*proxy.Proxy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAllProxies", ctx)
+	ret0, _ := ret[0].([]*proxy.Proxy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAllProxies indicates an expected call of GetAllProxies.
+func (mr *MockStoreMockRecorder) GetAllProxies(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllProxies", reflect.TypeOf((*MockStore)(nil).GetAllProxies), ctx)
+}
+
 // GetAllProxyAccessTokens mocks base method.
-func (m *MockStore) GetAllProxyAccessTokens(ctx context.Context, lockStrength LockingStrength) ([]*types2.ProxyAccessToken, error) {
+func (m *MockStore) GetAllProxyAccessTokens(ctx context.Context, lockStrength LockingStrength) ([]*types3.ProxyAccessToken, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAllProxyAccessTokens", ctx, lockStrength)
-	ret0, _ := ret[0].([]*types2.ProxyAccessToken)
+	ret0, _ := ret[0].([]*types3.ProxyAccessToken)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAllProxyAccessTokens indicates an expected call of GetAllProxyAccessTokens.
-func (mr *MockStoreMockRecorder) GetAllProxyAccessTokens(ctx, lockStrength interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAllProxyAccessTokens(ctx, lockStrength any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllProxyAccessTokens", reflect.TypeOf((*MockStore)(nil).GetAllProxyAccessTokens), ctx, lockStrength)
 }
@@ -1414,11 +1881,25 @@ func (m *MockStore) GetAnyAccountID(ctx context.Context) (string, error) {
 }
 
 // GetAnyAccountID indicates an expected call of GetAnyAccountID.
-func (mr *MockStoreMockRecorder) GetAnyAccountID(ctx interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAnyAccountID(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAnyAccountID", reflect.TypeOf((*MockStore)(nil).GetAnyAccountID), ctx)
 }
 
+// GetClusterAllProxiesPrivate mocks base method.
+func (m *MockStore) GetClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetClusterAllProxiesPrivate", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// GetClusterAllProxiesPrivate indicates an expected call of GetClusterAllProxiesPrivate.
+func (mr *MockStoreMockRecorder) GetClusterAllProxiesPrivate(ctx, clusterAddr any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterAllProxiesPrivate", reflect.TypeOf((*MockStore)(nil).GetClusterAllProxiesPrivate), ctx, clusterAddr)
+}
+
 // GetClusterRequireSubdomain mocks base method.
 func (m *MockStore) GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -1428,7 +1909,7 @@ func (m *MockStore) GetClusterRequireSubdomain(ctx context.Context, clusterAddr
 }
 
 // GetClusterRequireSubdomain indicates an expected call of GetClusterRequireSubdomain.
-func (mr *MockStoreMockRecorder) GetClusterRequireSubdomain(ctx, clusterAddr interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetClusterRequireSubdomain(ctx, clusterAddr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterRequireSubdomain", reflect.TypeOf((*MockStore)(nil).GetClusterRequireSubdomain), ctx, clusterAddr)
 }
@@ -1442,7 +1923,7 @@ func (m *MockStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr
 }
 
 // GetClusterSupportsCrowdSec indicates an expected call of GetClusterSupportsCrowdSec.
-func (mr *MockStoreMockRecorder) GetClusterSupportsCrowdSec(ctx, clusterAddr interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetClusterSupportsCrowdSec(ctx, clusterAddr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterSupportsCrowdSec", reflect.TypeOf((*MockStore)(nil).GetClusterSupportsCrowdSec), ctx, clusterAddr)
 }
@@ -1456,7 +1937,7 @@ func (m *MockStore) GetClusterSupportsCustomPorts(ctx context.Context, clusterAd
 }
 
 // GetClusterSupportsCustomPorts indicates an expected call of GetClusterSupportsCustomPorts.
-func (mr *MockStoreMockRecorder) GetClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetClusterSupportsCustomPorts(ctx, clusterAddr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterSupportsCustomPorts", reflect.TypeOf((*MockStore)(nil).GetClusterSupportsCustomPorts), ctx, clusterAddr)
 }
@@ -1470,7 +1951,7 @@ func (m *MockStore) GetClusterSupportsPrivate(ctx context.Context, clusterAddr s
 }
 
 // GetClusterSupportsPrivate indicates an expected call of GetClusterSupportsPrivate.
-func (mr *MockStoreMockRecorder) GetClusterSupportsPrivate(ctx, clusterAddr interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetClusterSupportsPrivate(ctx, clusterAddr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterSupportsPrivate", reflect.TypeOf((*MockStore)(nil).GetClusterSupportsPrivate), ctx, clusterAddr)
 }
@@ -1485,11 +1966,26 @@ func (m *MockStore) GetCustomDomain(ctx context.Context, accountID, domainID str
 }
 
 // GetCustomDomain indicates an expected call of GetCustomDomain.
-func (mr *MockStoreMockRecorder) GetCustomDomain(ctx, accountID, domainID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetCustomDomain(ctx, accountID, domainID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCustomDomain", reflect.TypeOf((*MockStore)(nil).GetCustomDomain), ctx, accountID, domainID)
 }
 
+// GetCustomDomainByName mocks base method.
+func (m *MockStore) GetCustomDomainByName(ctx context.Context, domainName string) (*domain.Domain, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetCustomDomainByName", ctx, domainName)
+	ret0, _ := ret[0].(*domain.Domain)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetCustomDomainByName indicates an expected call of GetCustomDomainByName.
+func (mr *MockStoreMockRecorder) GetCustomDomainByName(ctx, domainName any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCustomDomainByName", reflect.TypeOf((*MockStore)(nil).GetCustomDomainByName), ctx, domainName)
+}
+
 // GetCustomDomainsCounts mocks base method.
 func (m *MockStore) GetCustomDomainsCounts(ctx context.Context) (int64, int64, error) {
 	m.ctrl.T.Helper()
@@ -1501,7 +1997,7 @@ func (m *MockStore) GetCustomDomainsCounts(ctx context.Context) (int64, int64, e
 }
 
 // GetCustomDomainsCounts indicates an expected call of GetCustomDomainsCounts.
-func (mr *MockStoreMockRecorder) GetCustomDomainsCounts(ctx interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetCustomDomainsCounts(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCustomDomainsCounts", reflect.TypeOf((*MockStore)(nil).GetCustomDomainsCounts), ctx)
 }
@@ -1516,11 +2012,56 @@ func (m *MockStore) GetDNSRecordByID(ctx context.Context, lockStrength LockingSt
 }
 
 // GetDNSRecordByID indicates an expected call of GetDNSRecordByID.
-func (mr *MockStoreMockRecorder) GetDNSRecordByID(ctx, lockStrength, accountID, zoneID, recordID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetDNSRecordByID(ctx, lockStrength, accountID, zoneID, recordID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetDNSRecordByID", reflect.TypeOf((*MockStore)(nil).GetDNSRecordByID), ctx, lockStrength, accountID, zoneID, recordID)
 }
 
+// GetDeletedAccountIDsWithAgentNetworkAccessLogs mocks base method.
+func (m *MockStore) GetDeletedAccountIDsWithAgentNetworkAccessLogs(ctx context.Context) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetDeletedAccountIDsWithAgentNetworkAccessLogs", ctx)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetDeletedAccountIDsWithAgentNetworkAccessLogs indicates an expected call of GetDeletedAccountIDsWithAgentNetworkAccessLogs.
+func (mr *MockStoreMockRecorder) GetDeletedAccountIDsWithAgentNetworkAccessLogs(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetDeletedAccountIDsWithAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).GetDeletedAccountIDsWithAgentNetworkAccessLogs), ctx)
+}
+
+// GetEmbeddedProxyPeerIDsByCluster mocks base method.
+func (m *MockStore) GetEmbeddedProxyPeerIDsByCluster(ctx context.Context, accountID string) (map[string][]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetEmbeddedProxyPeerIDsByCluster", ctx, accountID)
+	ret0, _ := ret[0].(map[string][]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetEmbeddedProxyPeerIDsByCluster indicates an expected call of GetEmbeddedProxyPeerIDsByCluster.
+func (mr *MockStoreMockRecorder) GetEmbeddedProxyPeerIDsByCluster(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetEmbeddedProxyPeerIDsByCluster", reflect.TypeOf((*MockStore)(nil).GetEmbeddedProxyPeerIDsByCluster), ctx, accountID)
+}
+
+// GetExpiredCustomDomains mocks base method.
+func (m *MockStore) GetExpiredCustomDomains(ctx context.Context, now time.Time, afterID domain.ID, limit int) ([]*domain.Domain, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetExpiredCustomDomains", ctx, now, afterID, limit)
+	ret0, _ := ret[0].([]*domain.Domain)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetExpiredCustomDomains indicates an expected call of GetExpiredCustomDomains.
+func (mr *MockStoreMockRecorder) GetExpiredCustomDomains(ctx, now, afterID, limit any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetExpiredCustomDomains", reflect.TypeOf((*MockStore)(nil).GetExpiredCustomDomains), ctx, now, afterID, limit)
+}
+
 // GetExpiredEphemeralServices mocks base method.
 func (m *MockStore) GetExpiredEphemeralServices(ctx context.Context, ttl time.Duration, limit int) ([]*service.Service, error) {
 	m.ctrl.T.Helper()
@@ -1531,52 +2072,67 @@ func (m *MockStore) GetExpiredEphemeralServices(ctx context.Context, ttl time.Du
 }
 
 // GetExpiredEphemeralServices indicates an expected call of GetExpiredEphemeralServices.
-func (mr *MockStoreMockRecorder) GetExpiredEphemeralServices(ctx, ttl, limit interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetExpiredEphemeralServices(ctx, ttl, limit any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetExpiredEphemeralServices", reflect.TypeOf((*MockStore)(nil).GetExpiredEphemeralServices), ctx, ttl, limit)
 }
 
 // GetGroupByID mocks base method.
-func (m *MockStore) GetGroupByID(ctx context.Context, lockStrength LockingStrength, accountID, groupID string) (*types2.Group, error) {
+func (m *MockStore) GetGroupByID(ctx context.Context, lockStrength LockingStrength, accountID, groupID string) (*types3.Group, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGroupByID", ctx, lockStrength, accountID, groupID)
-	ret0, _ := ret[0].(*types2.Group)
+	ret0, _ := ret[0].(*types3.Group)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetGroupByID indicates an expected call of GetGroupByID.
-func (mr *MockStoreMockRecorder) GetGroupByID(ctx, lockStrength, accountID, groupID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetGroupByID(ctx, lockStrength, accountID, groupID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGroupByID", reflect.TypeOf((*MockStore)(nil).GetGroupByID), ctx, lockStrength, accountID, groupID)
 }
 
 // GetGroupByName mocks base method.
-func (m *MockStore) GetGroupByName(ctx context.Context, lockStrength LockingStrength, accountID, groupName string) (*types2.Group, error) {
+func (m *MockStore) GetGroupByName(ctx context.Context, lockStrength LockingStrength, accountID, groupName string) (*types3.Group, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGroupByName", ctx, lockStrength, accountID, groupName)
-	ret0, _ := ret[0].(*types2.Group)
+	ret0, _ := ret[0].(*types3.Group)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetGroupByName indicates an expected call of GetGroupByName.
-func (mr *MockStoreMockRecorder) GetGroupByName(ctx, lockStrength, accountID, groupName interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetGroupByName(ctx, lockStrength, accountID, groupName any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGroupByName", reflect.TypeOf((*MockStore)(nil).GetGroupByName), ctx, lockStrength, accountID, groupName)
 }
 
+// GetGroupIDsByPeerIDs mocks base method.
+func (m *MockStore) GetGroupIDsByPeerIDs(ctx context.Context, accountID string, peerIDs []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetGroupIDsByPeerIDs", ctx, accountID, peerIDs)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetGroupIDsByPeerIDs indicates an expected call of GetGroupIDsByPeerIDs.
+func (mr *MockStoreMockRecorder) GetGroupIDsByPeerIDs(ctx, accountID, peerIDs any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGroupIDsByPeerIDs", reflect.TypeOf((*MockStore)(nil).GetGroupIDsByPeerIDs), ctx, accountID, peerIDs)
+}
+
 // GetGroupsByIDs mocks base method.
-func (m *MockStore) GetGroupsByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, groupIDs []string) (map[string]*types2.Group, error) {
+func (m *MockStore) GetGroupsByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, groupIDs []string) (map[string]*types3.Group, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGroupsByIDs", ctx, lockStrength, accountID, groupIDs)
-	ret0, _ := ret[0].(map[string]*types2.Group)
+	ret0, _ := ret[0].(map[string]*types3.Group)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetGroupsByIDs indicates an expected call of GetGroupsByIDs.
-func (mr *MockStoreMockRecorder) GetGroupsByIDs(ctx, lockStrength, accountID, groupIDs interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetGroupsByIDs(ctx, lockStrength, accountID, groupIDs any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGroupsByIDs", reflect.TypeOf((*MockStore)(nil).GetGroupsByIDs), ctx, lockStrength, accountID, groupIDs)
 }
@@ -1605,157 +2161,172 @@ func (m *MockStore) GetNameServerGroupByID(ctx context.Context, lockStrength Loc
 }
 
 // GetNameServerGroupByID indicates an expected call of GetNameServerGroupByID.
-func (mr *MockStoreMockRecorder) GetNameServerGroupByID(ctx, lockStrength, nameServerGroupID, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetNameServerGroupByID(ctx, lockStrength, nameServerGroupID, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNameServerGroupByID", reflect.TypeOf((*MockStore)(nil).GetNameServerGroupByID), ctx, lockStrength, nameServerGroupID, accountID)
 }
 
 // GetNetworkByID mocks base method.
-func (m *MockStore) GetNetworkByID(ctx context.Context, lockStrength LockingStrength, accountID, networkID string) (*types1.Network, error) {
+func (m *MockStore) GetNetworkByID(ctx context.Context, lockStrength LockingStrength, accountID, networkID string) (*types2.Network, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetNetworkByID", ctx, lockStrength, accountID, networkID)
-	ret0, _ := ret[0].(*types1.Network)
+	ret0, _ := ret[0].(*types2.Network)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetNetworkByID indicates an expected call of GetNetworkByID.
-func (mr *MockStoreMockRecorder) GetNetworkByID(ctx, lockStrength, accountID, networkID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetNetworkByID(ctx, lockStrength, accountID, networkID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkByID", reflect.TypeOf((*MockStore)(nil).GetNetworkByID), ctx, lockStrength, accountID, networkID)
 }
 
 // GetNetworkResourceByID mocks base method.
-func (m *MockStore) GetNetworkResourceByID(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) (*types.NetworkResource, error) {
+func (m *MockStore) GetNetworkResourceByID(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) (*types0.NetworkResource, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetNetworkResourceByID", ctx, lockStrength, accountID, resourceID)
-	ret0, _ := ret[0].(*types.NetworkResource)
+	ret0, _ := ret[0].(*types0.NetworkResource)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetNetworkResourceByID indicates an expected call of GetNetworkResourceByID.
-func (mr *MockStoreMockRecorder) GetNetworkResourceByID(ctx, lockStrength, accountID, resourceID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetNetworkResourceByID(ctx, lockStrength, accountID, resourceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkResourceByID", reflect.TypeOf((*MockStore)(nil).GetNetworkResourceByID), ctx, lockStrength, accountID, resourceID)
 }
 
+// GetNetworkResourceByIDOrPublicID mocks base method.
+func (m *MockStore) GetNetworkResourceByIDOrPublicID(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) (*types0.NetworkResource, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetNetworkResourceByIDOrPublicID", ctx, lockStrength, accountID, resourceID)
+	ret0, _ := ret[0].(*types0.NetworkResource)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetNetworkResourceByIDOrPublicID indicates an expected call of GetNetworkResourceByIDOrPublicID.
+func (mr *MockStoreMockRecorder) GetNetworkResourceByIDOrPublicID(ctx, lockStrength, accountID, resourceID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkResourceByIDOrPublicID", reflect.TypeOf((*MockStore)(nil).GetNetworkResourceByIDOrPublicID), ctx, lockStrength, accountID, resourceID)
+}
+
 // GetNetworkResourceByName mocks base method.
-func (m *MockStore) GetNetworkResourceByName(ctx context.Context, lockStrength LockingStrength, accountID, resourceName string) (*types.NetworkResource, error) {
+func (m *MockStore) GetNetworkResourceByName(ctx context.Context, lockStrength LockingStrength, accountID, resourceName string) (*types0.NetworkResource, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetNetworkResourceByName", ctx, lockStrength, accountID, resourceName)
-	ret0, _ := ret[0].(*types.NetworkResource)
+	ret0, _ := ret[0].(*types0.NetworkResource)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetNetworkResourceByName indicates an expected call of GetNetworkResourceByName.
-func (mr *MockStoreMockRecorder) GetNetworkResourceByName(ctx, lockStrength, accountID, resourceName interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetNetworkResourceByName(ctx, lockStrength, accountID, resourceName any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkResourceByName", reflect.TypeOf((*MockStore)(nil).GetNetworkResourceByName), ctx, lockStrength, accountID, resourceName)
 }
 
 // GetNetworkResourcesByAccountID mocks base method.
-func (m *MockStore) GetNetworkResourcesByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.NetworkResource, error) {
+func (m *MockStore) GetNetworkResourcesByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types0.NetworkResource, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetNetworkResourcesByAccountID", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*types.NetworkResource)
+	ret0, _ := ret[0].([]*types0.NetworkResource)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetNetworkResourcesByAccountID indicates an expected call of GetNetworkResourcesByAccountID.
-func (mr *MockStoreMockRecorder) GetNetworkResourcesByAccountID(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetNetworkResourcesByAccountID(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkResourcesByAccountID", reflect.TypeOf((*MockStore)(nil).GetNetworkResourcesByAccountID), ctx, lockStrength, accountID)
 }
 
 // GetNetworkResourcesByNetID mocks base method.
-func (m *MockStore) GetNetworkResourcesByNetID(ctx context.Context, lockStrength LockingStrength, accountID, netID string) ([]*types.NetworkResource, error) {
+func (m *MockStore) GetNetworkResourcesByNetID(ctx context.Context, lockStrength LockingStrength, accountID, netID string) ([]*types0.NetworkResource, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetNetworkResourcesByNetID", ctx, lockStrength, accountID, netID)
-	ret0, _ := ret[0].([]*types.NetworkResource)
+	ret0, _ := ret[0].([]*types0.NetworkResource)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetNetworkResourcesByNetID indicates an expected call of GetNetworkResourcesByNetID.
-func (mr *MockStoreMockRecorder) GetNetworkResourcesByNetID(ctx, lockStrength, accountID, netID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetNetworkResourcesByNetID(ctx, lockStrength, accountID, netID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkResourcesByNetID", reflect.TypeOf((*MockStore)(nil).GetNetworkResourcesByNetID), ctx, lockStrength, accountID, netID)
 }
 
 // GetNetworkRouterByID mocks base method.
-func (m *MockStore) GetNetworkRouterByID(ctx context.Context, lockStrength LockingStrength, accountID, routerID string) (*types0.NetworkRouter, error) {
+func (m *MockStore) GetNetworkRouterByID(ctx context.Context, lockStrength LockingStrength, accountID, routerID string) (*types1.NetworkRouter, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetNetworkRouterByID", ctx, lockStrength, accountID, routerID)
-	ret0, _ := ret[0].(*types0.NetworkRouter)
+	ret0, _ := ret[0].(*types1.NetworkRouter)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetNetworkRouterByID indicates an expected call of GetNetworkRouterByID.
-func (mr *MockStoreMockRecorder) GetNetworkRouterByID(ctx, lockStrength, accountID, routerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetNetworkRouterByID(ctx, lockStrength, accountID, routerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkRouterByID", reflect.TypeOf((*MockStore)(nil).GetNetworkRouterByID), ctx, lockStrength, accountID, routerID)
 }
 
 // GetNetworkRoutersByAccountID mocks base method.
-func (m *MockStore) GetNetworkRoutersByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types0.NetworkRouter, error) {
+func (m *MockStore) GetNetworkRoutersByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types1.NetworkRouter, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetNetworkRoutersByAccountID", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*types0.NetworkRouter)
+	ret0, _ := ret[0].([]*types1.NetworkRouter)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetNetworkRoutersByAccountID indicates an expected call of GetNetworkRoutersByAccountID.
-func (mr *MockStoreMockRecorder) GetNetworkRoutersByAccountID(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetNetworkRoutersByAccountID(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkRoutersByAccountID", reflect.TypeOf((*MockStore)(nil).GetNetworkRoutersByAccountID), ctx, lockStrength, accountID)
 }
 
 // GetNetworkRoutersByNetID mocks base method.
-func (m *MockStore) GetNetworkRoutersByNetID(ctx context.Context, lockStrength LockingStrength, accountID, netID string) ([]*types0.NetworkRouter, error) {
+func (m *MockStore) GetNetworkRoutersByNetID(ctx context.Context, lockStrength LockingStrength, accountID, netID string) ([]*types1.NetworkRouter, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetNetworkRoutersByNetID", ctx, lockStrength, accountID, netID)
-	ret0, _ := ret[0].([]*types0.NetworkRouter)
+	ret0, _ := ret[0].([]*types1.NetworkRouter)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetNetworkRoutersByNetID indicates an expected call of GetNetworkRoutersByNetID.
-func (mr *MockStoreMockRecorder) GetNetworkRoutersByNetID(ctx, lockStrength, accountID, netID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetNetworkRoutersByNetID(ctx, lockStrength, accountID, netID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkRoutersByNetID", reflect.TypeOf((*MockStore)(nil).GetNetworkRoutersByNetID), ctx, lockStrength, accountID, netID)
 }
 
 // GetPATByHashedToken mocks base method.
-func (m *MockStore) GetPATByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken string) (*types2.PersonalAccessToken, error) {
+func (m *MockStore) GetPATByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken string) (*types3.PersonalAccessToken, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetPATByHashedToken", ctx, lockStrength, hashedToken)
-	ret0, _ := ret[0].(*types2.PersonalAccessToken)
+	ret0, _ := ret[0].(*types3.PersonalAccessToken)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPATByHashedToken indicates an expected call of GetPATByHashedToken.
-func (mr *MockStoreMockRecorder) GetPATByHashedToken(ctx, lockStrength, hashedToken interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPATByHashedToken(ctx, lockStrength, hashedToken any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPATByHashedToken", reflect.TypeOf((*MockStore)(nil).GetPATByHashedToken), ctx, lockStrength, hashedToken)
 }
 
 // GetPATByID mocks base method.
-func (m *MockStore) GetPATByID(ctx context.Context, lockStrength LockingStrength, userID, patID string) (*types2.PersonalAccessToken, error) {
+func (m *MockStore) GetPATByID(ctx context.Context, lockStrength LockingStrength, userID, patID string) (*types3.PersonalAccessToken, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetPATByID", ctx, lockStrength, userID, patID)
-	ret0, _ := ret[0].(*types2.PersonalAccessToken)
+	ret0, _ := ret[0].(*types3.PersonalAccessToken)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPATByID indicates an expected call of GetPATByID.
-func (mr *MockStoreMockRecorder) GetPATByID(ctx, lockStrength, userID, patID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPATByID(ctx, lockStrength, userID, patID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPATByID", reflect.TypeOf((*MockStore)(nil).GetPATByID), ctx, lockStrength, userID, patID)
 }
@@ -1770,7 +2341,7 @@ func (m *MockStore) GetPeerByID(ctx context.Context, lockStrength LockingStrengt
 }
 
 // GetPeerByID indicates an expected call of GetPeerByID.
-func (mr *MockStoreMockRecorder) GetPeerByID(ctx, lockStrength, accountID, peerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeerByID(ctx, lockStrength, accountID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerByID", reflect.TypeOf((*MockStore)(nil).GetPeerByID), ctx, lockStrength, accountID, peerID)
 }
@@ -1785,7 +2356,7 @@ func (m *MockStore) GetPeerByIP(ctx context.Context, lockStrength LockingStrengt
 }
 
 // GetPeerByIP indicates an expected call of GetPeerByIP.
-func (mr *MockStoreMockRecorder) GetPeerByIP(ctx, lockStrength, accountID, ip interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeerByIP(ctx, lockStrength, accountID, ip any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerByIP", reflect.TypeOf((*MockStore)(nil).GetPeerByIP), ctx, lockStrength, accountID, ip)
 }
@@ -1800,7 +2371,7 @@ func (m *MockStore) GetPeerByPeerPubKey(ctx context.Context, lockStrength Lockin
 }
 
 // GetPeerByPeerPubKey indicates an expected call of GetPeerByPeerPubKey.
-func (mr *MockStoreMockRecorder) GetPeerByPeerPubKey(ctx, lockStrength, peerKey interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeerByPeerPubKey(ctx, lockStrength, peerKey any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerByPeerPubKey", reflect.TypeOf((*MockStore)(nil).GetPeerByPeerPubKey), ctx, lockStrength, peerKey)
 }
@@ -1815,22 +2386,22 @@ func (m *MockStore) GetPeerGroupIDs(ctx context.Context, lockStrength LockingStr
 }
 
 // GetPeerGroupIDs indicates an expected call of GetPeerGroupIDs.
-func (mr *MockStoreMockRecorder) GetPeerGroupIDs(ctx, lockStrength, accountId, peerId interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeerGroupIDs(ctx, lockStrength, accountId, peerId any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerGroupIDs", reflect.TypeOf((*MockStore)(nil).GetPeerGroupIDs), ctx, lockStrength, accountId, peerId)
 }
 
 // GetPeerGroups mocks base method.
-func (m *MockStore) GetPeerGroups(ctx context.Context, lockStrength LockingStrength, accountId, peerId string) ([]*types2.Group, error) {
+func (m *MockStore) GetPeerGroups(ctx context.Context, lockStrength LockingStrength, accountId, peerId string) ([]*types3.Group, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetPeerGroups", ctx, lockStrength, accountId, peerId)
-	ret0, _ := ret[0].([]*types2.Group)
+	ret0, _ := ret[0].([]*types3.Group)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPeerGroups indicates an expected call of GetPeerGroups.
-func (mr *MockStoreMockRecorder) GetPeerGroups(ctx, lockStrength, accountId, peerId interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeerGroups(ctx, lockStrength, accountId, peerId any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerGroups", reflect.TypeOf((*MockStore)(nil).GetPeerGroups), ctx, lockStrength, accountId, peerId)
 }
@@ -1845,11 +2416,26 @@ func (m *MockStore) GetPeerIDByKey(ctx context.Context, lockStrength LockingStre
 }
 
 // GetPeerIDByKey indicates an expected call of GetPeerIDByKey.
-func (mr *MockStoreMockRecorder) GetPeerIDByKey(ctx, lockStrength, key interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeerIDByKey(ctx, lockStrength, key any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerIDByKey", reflect.TypeOf((*MockStore)(nil).GetPeerIDByKey), ctx, lockStrength, key)
 }
 
+// GetPeerIDsByGroups mocks base method.
+func (m *MockStore) GetPeerIDsByGroups(ctx context.Context, accountID string, groupIDs []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetPeerIDsByGroups", ctx, accountID, groupIDs)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetPeerIDsByGroups indicates an expected call of GetPeerIDsByGroups.
+func (mr *MockStoreMockRecorder) GetPeerIDsByGroups(ctx, accountID, groupIDs any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerIDsByGroups", reflect.TypeOf((*MockStore)(nil).GetPeerIDsByGroups), ctx, accountID, groupIDs)
+}
+
 // GetPeerIdByLabel mocks base method.
 func (m *MockStore) GetPeerIdByLabel(ctx context.Context, lockStrength LockingStrength, accountID, hostname string) (string, error) {
 	m.ctrl.T.Helper()
@@ -1860,37 +2446,37 @@ func (m *MockStore) GetPeerIdByLabel(ctx context.Context, lockStrength LockingSt
 }
 
 // GetPeerIdByLabel indicates an expected call of GetPeerIdByLabel.
-func (mr *MockStoreMockRecorder) GetPeerIdByLabel(ctx, lockStrength, accountID, hostname interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeerIdByLabel(ctx, lockStrength, accountID, hostname any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerIdByLabel", reflect.TypeOf((*MockStore)(nil).GetPeerIdByLabel), ctx, lockStrength, accountID, hostname)
 }
 
 // GetPeerJobByID mocks base method.
-func (m *MockStore) GetPeerJobByID(ctx context.Context, accountID, jobID string) (*types2.Job, error) {
+func (m *MockStore) GetPeerJobByID(ctx context.Context, accountID, jobID string) (*types3.Job, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetPeerJobByID", ctx, accountID, jobID)
-	ret0, _ := ret[0].(*types2.Job)
+	ret0, _ := ret[0].(*types3.Job)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPeerJobByID indicates an expected call of GetPeerJobByID.
-func (mr *MockStoreMockRecorder) GetPeerJobByID(ctx, accountID, jobID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeerJobByID(ctx, accountID, jobID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerJobByID", reflect.TypeOf((*MockStore)(nil).GetPeerJobByID), ctx, accountID, jobID)
 }
 
 // GetPeerJobs mocks base method.
-func (m *MockStore) GetPeerJobs(ctx context.Context, accountID, peerID string) ([]*types2.Job, error) {
+func (m *MockStore) GetPeerJobs(ctx context.Context, accountID, peerID string) ([]*types3.Job, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetPeerJobs", ctx, accountID, peerID)
-	ret0, _ := ret[0].([]*types2.Job)
+	ret0, _ := ret[0].([]*types3.Job)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPeerJobs indicates an expected call of GetPeerJobs.
-func (mr *MockStoreMockRecorder) GetPeerJobs(ctx, accountID, peerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeerJobs(ctx, accountID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerJobs", reflect.TypeOf((*MockStore)(nil).GetPeerJobs), ctx, accountID, peerID)
 }
@@ -1905,7 +2491,7 @@ func (m *MockStore) GetPeerLabelsInAccount(ctx context.Context, lockStrength Loc
 }
 
 // GetPeerLabelsInAccount indicates an expected call of GetPeerLabelsInAccount.
-func (mr *MockStoreMockRecorder) GetPeerLabelsInAccount(ctx, lockStrength, accountId, hostname interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeerLabelsInAccount(ctx, lockStrength, accountId, hostname any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerLabelsInAccount", reflect.TypeOf((*MockStore)(nil).GetPeerLabelsInAccount), ctx, lockStrength, accountId, hostname)
 }
@@ -1920,56 +2506,11 @@ func (m *MockStore) GetPeersByGroupIDs(ctx context.Context, accountID string, gr
 }
 
 // GetPeersByGroupIDs indicates an expected call of GetPeersByGroupIDs.
-func (mr *MockStoreMockRecorder) GetPeersByGroupIDs(ctx, accountID, groupIDs interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeersByGroupIDs(ctx, accountID, groupIDs any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeersByGroupIDs", reflect.TypeOf((*MockStore)(nil).GetPeersByGroupIDs), ctx, accountID, groupIDs)
 }
 
-// GetPeerIDsByGroups mocks base method.
-func (m *MockStore) GetPeerIDsByGroups(ctx context.Context, accountID string, groupIDs []string) ([]string, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetPeerIDsByGroups", ctx, accountID, groupIDs)
-	ret0, _ := ret[0].([]string)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetPeerIDsByGroups indicates an expected call of GetPeerIDsByGroups.
-func (mr *MockStoreMockRecorder) GetPeerIDsByGroups(ctx, accountID, groupIDs interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerIDsByGroups", reflect.TypeOf((*MockStore)(nil).GetPeerIDsByGroups), ctx, accountID, groupIDs)
-}
-
-// GetGroupIDsByPeerIDs mocks base method.
-func (m *MockStore) GetGroupIDsByPeerIDs(ctx context.Context, accountID string, peerIDs []string) ([]string, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetGroupIDsByPeerIDs", ctx, accountID, peerIDs)
-	ret0, _ := ret[0].([]string)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetGroupIDsByPeerIDs indicates an expected call of GetGroupIDsByPeerIDs.
-func (mr *MockStoreMockRecorder) GetGroupIDsByPeerIDs(ctx, accountID, peerIDs interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGroupIDsByPeerIDs", reflect.TypeOf((*MockStore)(nil).GetGroupIDsByPeerIDs), ctx, accountID, peerIDs)
-}
-
-// GetEmbeddedProxyPeerIDsByCluster mocks base method.
-func (m *MockStore) GetEmbeddedProxyPeerIDsByCluster(ctx context.Context, accountID string) (map[string][]string, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetEmbeddedProxyPeerIDsByCluster", ctx, accountID)
-	ret0, _ := ret[0].(map[string][]string)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetEmbeddedProxyPeerIDsByCluster indicates an expected call of GetEmbeddedProxyPeerIDsByCluster.
-func (mr *MockStoreMockRecorder) GetEmbeddedProxyPeerIDsByCluster(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetEmbeddedProxyPeerIDsByCluster", reflect.TypeOf((*MockStore)(nil).GetEmbeddedProxyPeerIDsByCluster), ctx, accountID)
-}
-
 // GetPeersByIDs mocks base method.
 func (m *MockStore) GetPeersByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, peerIDs []string) (map[string]*peer.Peer, error) {
 	m.ctrl.T.Helper()
@@ -1980,37 +2521,52 @@ func (m *MockStore) GetPeersByIDs(ctx context.Context, lockStrength LockingStren
 }
 
 // GetPeersByIDs indicates an expected call of GetPeersByIDs.
-func (mr *MockStoreMockRecorder) GetPeersByIDs(ctx, lockStrength, accountID, peerIDs interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPeersByIDs(ctx, lockStrength, accountID, peerIDs any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeersByIDs", reflect.TypeOf((*MockStore)(nil).GetPeersByIDs), ctx, lockStrength, accountID, peerIDs)
 }
 
 // GetPolicyByID mocks base method.
-func (m *MockStore) GetPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*types2.Policy, error) {
+func (m *MockStore) GetPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*types3.Policy, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetPolicyByID", ctx, lockStrength, accountID, policyID)
-	ret0, _ := ret[0].(*types2.Policy)
+	ret0, _ := ret[0].(*types3.Policy)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPolicyByID indicates an expected call of GetPolicyByID.
-func (mr *MockStoreMockRecorder) GetPolicyByID(ctx, lockStrength, accountID, policyID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPolicyByID(ctx, lockStrength, accountID, policyID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPolicyByID", reflect.TypeOf((*MockStore)(nil).GetPolicyByID), ctx, lockStrength, accountID, policyID)
 }
 
+// GetPolicyByIDOrPublicID mocks base method.
+func (m *MockStore) GetPolicyByIDOrPublicID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*types3.Policy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetPolicyByIDOrPublicID", ctx, lockStrength, accountID, policyID)
+	ret0, _ := ret[0].(*types3.Policy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetPolicyByIDOrPublicID indicates an expected call of GetPolicyByIDOrPublicID.
+func (mr *MockStoreMockRecorder) GetPolicyByIDOrPublicID(ctx, lockStrength, accountID, policyID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPolicyByIDOrPublicID", reflect.TypeOf((*MockStore)(nil).GetPolicyByIDOrPublicID), ctx, lockStrength, accountID, policyID)
+}
+
 // GetPolicyRulesByResourceID mocks base method.
-func (m *MockStore) GetPolicyRulesByResourceID(ctx context.Context, lockStrength LockingStrength, accountID, peerID string) ([]*types2.PolicyRule, error) {
+func (m *MockStore) GetPolicyRulesByResourceID(ctx context.Context, lockStrength LockingStrength, accountID, peerID string) ([]*types3.PolicyRule, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetPolicyRulesByResourceID", ctx, lockStrength, accountID, peerID)
-	ret0, _ := ret[0].([]*types2.PolicyRule)
+	ret0, _ := ret[0].([]*types3.PolicyRule)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPolicyRulesByResourceID indicates an expected call of GetPolicyRulesByResourceID.
-func (mr *MockStoreMockRecorder) GetPolicyRulesByResourceID(ctx, lockStrength, accountID, peerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPolicyRulesByResourceID(ctx, lockStrength, accountID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPolicyRulesByResourceID", reflect.TypeOf((*MockStore)(nil).GetPolicyRulesByResourceID), ctx, lockStrength, accountID, peerID)
 }
@@ -2025,7 +2581,7 @@ func (m *MockStore) GetPostureCheckByChecksDefinition(accountID string, checks *
 }
 
 // GetPostureCheckByChecksDefinition indicates an expected call of GetPostureCheckByChecksDefinition.
-func (mr *MockStoreMockRecorder) GetPostureCheckByChecksDefinition(accountID, checks interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPostureCheckByChecksDefinition(accountID, checks any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPostureCheckByChecksDefinition", reflect.TypeOf((*MockStore)(nil).GetPostureCheckByChecksDefinition), accountID, checks)
 }
@@ -2040,7 +2596,7 @@ func (m *MockStore) GetPostureChecksByID(ctx context.Context, lockStrength Locki
 }
 
 // GetPostureChecksByID indicates an expected call of GetPostureChecksByID.
-func (mr *MockStoreMockRecorder) GetPostureChecksByID(ctx, lockStrength, accountID, postureCheckID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPostureChecksByID(ctx, lockStrength, accountID, postureCheckID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPostureChecksByID", reflect.TypeOf((*MockStore)(nil).GetPostureChecksByID), ctx, lockStrength, accountID, postureCheckID)
 }
@@ -2055,52 +2611,52 @@ func (m *MockStore) GetPostureChecksByIDs(ctx context.Context, lockStrength Lock
 }
 
 // GetPostureChecksByIDs indicates an expected call of GetPostureChecksByIDs.
-func (mr *MockStoreMockRecorder) GetPostureChecksByIDs(ctx, lockStrength, accountID, postureChecksIDs interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPostureChecksByIDs(ctx, lockStrength, accountID, postureChecksIDs any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPostureChecksByIDs", reflect.TypeOf((*MockStore)(nil).GetPostureChecksByIDs), ctx, lockStrength, accountID, postureChecksIDs)
 }
 
 // GetProxyAccessTokenByHashedToken mocks base method.
-func (m *MockStore) GetProxyAccessTokenByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken types2.HashedProxyToken) (*types2.ProxyAccessToken, error) {
+func (m *MockStore) GetProxyAccessTokenByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken types3.HashedProxyToken) (*types3.ProxyAccessToken, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetProxyAccessTokenByHashedToken", ctx, lockStrength, hashedToken)
-	ret0, _ := ret[0].(*types2.ProxyAccessToken)
+	ret0, _ := ret[0].(*types3.ProxyAccessToken)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetProxyAccessTokenByHashedToken indicates an expected call of GetProxyAccessTokenByHashedToken.
-func (mr *MockStoreMockRecorder) GetProxyAccessTokenByHashedToken(ctx, lockStrength, hashedToken interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetProxyAccessTokenByHashedToken(ctx, lockStrength, hashedToken any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetProxyAccessTokenByHashedToken", reflect.TypeOf((*MockStore)(nil).GetProxyAccessTokenByHashedToken), ctx, lockStrength, hashedToken)
 }
 
 // GetProxyAccessTokenByID mocks base method.
-func (m *MockStore) GetProxyAccessTokenByID(ctx context.Context, lockStrength LockingStrength, tokenID string) (*types2.ProxyAccessToken, error) {
+func (m *MockStore) GetProxyAccessTokenByID(ctx context.Context, lockStrength LockingStrength, tokenID string) (*types3.ProxyAccessToken, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetProxyAccessTokenByID", ctx, lockStrength, tokenID)
-	ret0, _ := ret[0].(*types2.ProxyAccessToken)
+	ret0, _ := ret[0].(*types3.ProxyAccessToken)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetProxyAccessTokenByID indicates an expected call of GetProxyAccessTokenByID.
-func (mr *MockStoreMockRecorder) GetProxyAccessTokenByID(ctx, lockStrength, tokenID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetProxyAccessTokenByID(ctx, lockStrength, tokenID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetProxyAccessTokenByID", reflect.TypeOf((*MockStore)(nil).GetProxyAccessTokenByID), ctx, lockStrength, tokenID)
 }
 
 // GetProxyAccessTokensByAccountID mocks base method.
-func (m *MockStore) GetProxyAccessTokensByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types2.ProxyAccessToken, error) {
+func (m *MockStore) GetProxyAccessTokensByAccountID(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types3.ProxyAccessToken, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetProxyAccessTokensByAccountID", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*types2.ProxyAccessToken)
+	ret0, _ := ret[0].([]*types3.ProxyAccessToken)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetProxyAccessTokensByAccountID indicates an expected call of GetProxyAccessTokensByAccountID.
-func (mr *MockStoreMockRecorder) GetProxyAccessTokensByAccountID(ctx, lockStrength, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetProxyAccessTokensByAccountID(ctx, lockStrength, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetProxyAccessTokensByAccountID", reflect.TypeOf((*MockStore)(nil).GetProxyAccessTokensByAccountID), ctx, lockStrength, accountID)
 }
@@ -2115,7 +2671,7 @@ func (m *MockStore) GetProxyByAccountID(ctx context.Context, accountID string) (
 }
 
 // GetProxyByAccountID indicates an expected call of GetProxyByAccountID.
-func (mr *MockStoreMockRecorder) GetProxyByAccountID(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetProxyByAccountID(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetProxyByAccountID", reflect.TypeOf((*MockStore)(nil).GetProxyByAccountID), ctx, accountID)
 }
@@ -2130,7 +2686,7 @@ func (m *MockStore) GetProxyClusters(ctx context.Context, accountID string) ([]p
 }
 
 // GetProxyClusters indicates an expected call of GetProxyClusters.
-func (mr *MockStoreMockRecorder) GetProxyClusters(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetProxyClusters(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetProxyClusters", reflect.TypeOf((*MockStore)(nil).GetProxyClusters), ctx, accountID)
 }
@@ -2145,22 +2701,22 @@ func (m *MockStore) GetProxyMetrics(ctx context.Context) (ProxyMetrics, error) {
 }
 
 // GetProxyMetrics indicates an expected call of GetProxyMetrics.
-func (mr *MockStoreMockRecorder) GetProxyMetrics(ctx interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetProxyMetrics(ctx any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetProxyMetrics", reflect.TypeOf((*MockStore)(nil).GetProxyMetrics), ctx)
 }
 
 // GetResourceGroups mocks base method.
-func (m *MockStore) GetResourceGroups(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) ([]*types2.Group, error) {
+func (m *MockStore) GetResourceGroups(ctx context.Context, lockStrength LockingStrength, accountID, resourceID string) ([]*types3.Group, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetResourceGroups", ctx, lockStrength, accountID, resourceID)
-	ret0, _ := ret[0].([]*types2.Group)
+	ret0, _ := ret[0].([]*types3.Group)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetResourceGroups indicates an expected call of GetResourceGroups.
-func (mr *MockStoreMockRecorder) GetResourceGroups(ctx, lockStrength, accountID, resourceID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetResourceGroups(ctx, lockStrength, accountID, resourceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetResourceGroups", reflect.TypeOf((*MockStore)(nil).GetResourceGroups), ctx, lockStrength, accountID, resourceID)
 }
@@ -2175,11 +2731,26 @@ func (m *MockStore) GetRouteByID(ctx context.Context, lockStrength LockingStreng
 }
 
 // GetRouteByID indicates an expected call of GetRouteByID.
-func (mr *MockStoreMockRecorder) GetRouteByID(ctx, lockStrength, accountID, routeID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetRouteByID(ctx, lockStrength, accountID, routeID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRouteByID", reflect.TypeOf((*MockStore)(nil).GetRouteByID), ctx, lockStrength, accountID, routeID)
 }
 
+// GetRouteByIDOrPublicID mocks base method.
+func (m *MockStore) GetRouteByIDOrPublicID(ctx context.Context, lockStrength LockingStrength, accountID, routeID string) (*route.Route, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetRouteByIDOrPublicID", ctx, lockStrength, accountID, routeID)
+	ret0, _ := ret[0].(*route.Route)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetRouteByIDOrPublicID indicates an expected call of GetRouteByIDOrPublicID.
+func (mr *MockStoreMockRecorder) GetRouteByIDOrPublicID(ctx, lockStrength, accountID, routeID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRouteByIDOrPublicID", reflect.TypeOf((*MockStore)(nil).GetRouteByIDOrPublicID), ctx, lockStrength, accountID, routeID)
+}
+
 // GetRoutingPeerNetworks mocks base method.
 func (m *MockStore) GetRoutingPeerNetworks(ctx context.Context, accountID, peerID string) ([]string, error) {
 	m.ctrl.T.Helper()
@@ -2190,24 +2761,24 @@ func (m *MockStore) GetRoutingPeerNetworks(ctx context.Context, accountID, peerI
 }
 
 // GetRoutingPeerNetworks indicates an expected call of GetRoutingPeerNetworks.
-func (mr *MockStoreMockRecorder) GetRoutingPeerNetworks(ctx, accountID, peerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetRoutingPeerNetworks(ctx, accountID, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRoutingPeerNetworks", reflect.TypeOf((*MockStore)(nil).GetRoutingPeerNetworks), ctx, accountID, peerID)
 }
 
 // GetServiceByDomain mocks base method.
-func (m *MockStore) GetServiceByDomain(ctx context.Context, domain string) (*service.Service, error) {
+func (m *MockStore) GetServiceByDomain(ctx context.Context, arg1 string) (*service.Service, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetServiceByDomain", ctx, domain)
+	ret := m.ctrl.Call(m, "GetServiceByDomain", ctx, arg1)
 	ret0, _ := ret[0].(*service.Service)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetServiceByDomain indicates an expected call of GetServiceByDomain.
-func (mr *MockStoreMockRecorder) GetServiceByDomain(ctx, domain interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetServiceByDomain(ctx, arg1 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServiceByDomain", reflect.TypeOf((*MockStore)(nil).GetServiceByDomain), ctx, domain)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServiceByDomain", reflect.TypeOf((*MockStore)(nil).GetServiceByDomain), ctx, arg1)
 }
 
 // GetServiceByID mocks base method.
@@ -2220,7 +2791,7 @@ func (m *MockStore) GetServiceByID(ctx context.Context, lockStrength LockingStre
 }
 
 // GetServiceByID indicates an expected call of GetServiceByID.
-func (mr *MockStoreMockRecorder) GetServiceByID(ctx, lockStrength, accountID, serviceID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetServiceByID(ctx, lockStrength, accountID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServiceByID", reflect.TypeOf((*MockStore)(nil).GetServiceByID), ctx, lockStrength, accountID, serviceID)
 }
@@ -2235,7 +2806,7 @@ func (m *MockStore) GetServiceTargetByTargetID(ctx context.Context, lockStrength
 }
 
 // GetServiceTargetByTargetID indicates an expected call of GetServiceTargetByTargetID.
-func (mr *MockStoreMockRecorder) GetServiceTargetByTargetID(ctx, lockStrength, accountID, targetID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetServiceTargetByTargetID(ctx, lockStrength, accountID, targetID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServiceTargetByTargetID", reflect.TypeOf((*MockStore)(nil).GetServiceTargetByTargetID), ctx, lockStrength, accountID, targetID)
 }
@@ -2250,7 +2821,7 @@ func (m *MockStore) GetServices(ctx context.Context, lockStrength LockingStrengt
 }
 
 // GetServices indicates an expected call of GetServices.
-func (mr *MockStoreMockRecorder) GetServices(ctx, lockStrength interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetServices(ctx, lockStrength any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServices", reflect.TypeOf((*MockStore)(nil).GetServices), ctx, lockStrength)
 }
@@ -2265,7 +2836,7 @@ func (m *MockStore) GetServicesByCluster(ctx context.Context, lockStrength Locki
 }
 
 // GetServicesByCluster indicates an expected call of GetServicesByCluster.
-func (mr *MockStoreMockRecorder) GetServicesByCluster(ctx, lockStrength, proxyCluster interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetServicesByCluster(ctx, lockStrength, proxyCluster any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServicesByCluster", reflect.TypeOf((*MockStore)(nil).GetServicesByCluster), ctx, lockStrength, proxyCluster)
 }
@@ -2280,46 +2851,46 @@ func (m *MockStore) GetServicesByClusterAndPort(ctx context.Context, lockStrengt
 }
 
 // GetServicesByClusterAndPort indicates an expected call of GetServicesByClusterAndPort.
-func (mr *MockStoreMockRecorder) GetServicesByClusterAndPort(ctx, lockStrength, proxyCluster, mode, listenPort interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetServicesByClusterAndPort(ctx, lockStrength, proxyCluster, mode, listenPort any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetServicesByClusterAndPort", reflect.TypeOf((*MockStore)(nil).GetServicesByClusterAndPort), ctx, lockStrength, proxyCluster, mode, listenPort)
 }
 
 // GetSetupKeyByID mocks base method.
-func (m *MockStore) GetSetupKeyByID(ctx context.Context, lockStrength LockingStrength, accountID, setupKeyID string) (*types2.SetupKey, error) {
+func (m *MockStore) GetSetupKeyByID(ctx context.Context, lockStrength LockingStrength, accountID, setupKeyID string) (*types3.SetupKey, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetSetupKeyByID", ctx, lockStrength, accountID, setupKeyID)
-	ret0, _ := ret[0].(*types2.SetupKey)
+	ret0, _ := ret[0].(*types3.SetupKey)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetSetupKeyByID indicates an expected call of GetSetupKeyByID.
-func (mr *MockStoreMockRecorder) GetSetupKeyByID(ctx, lockStrength, accountID, setupKeyID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetSetupKeyByID(ctx, lockStrength, accountID, setupKeyID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetSetupKeyByID", reflect.TypeOf((*MockStore)(nil).GetSetupKeyByID), ctx, lockStrength, accountID, setupKeyID)
 }
 
 // GetSetupKeyBySecret mocks base method.
-func (m *MockStore) GetSetupKeyBySecret(ctx context.Context, lockStrength LockingStrength, key string) (*types2.SetupKey, error) {
+func (m *MockStore) GetSetupKeyBySecret(ctx context.Context, lockStrength LockingStrength, key string) (*types3.SetupKey, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetSetupKeyBySecret", ctx, lockStrength, key)
-	ret0, _ := ret[0].(*types2.SetupKey)
+	ret0, _ := ret[0].(*types3.SetupKey)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetSetupKeyBySecret indicates an expected call of GetSetupKeyBySecret.
-func (mr *MockStoreMockRecorder) GetSetupKeyBySecret(ctx, lockStrength, key interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetSetupKeyBySecret(ctx, lockStrength, key any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetSetupKeyBySecret", reflect.TypeOf((*MockStore)(nil).GetSetupKeyBySecret), ctx, lockStrength, key)
 }
 
 // GetStoreEngine mocks base method.
-func (m *MockStore) GetStoreEngine() types2.Engine {
+func (m *MockStore) GetStoreEngine() types3.Engine {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetStoreEngine")
-	ret0, _ := ret[0].(types2.Engine)
+	ret0, _ := ret[0].(types3.Engine)
 	return ret0
 }
 
@@ -2339,7 +2910,7 @@ func (m *MockStore) GetTakenIPs(ctx context.Context, lockStrength LockingStrengt
 }
 
 // GetTakenIPs indicates an expected call of GetTakenIPs.
-func (mr *MockStoreMockRecorder) GetTakenIPs(ctx, lockStrength, accountId interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetTakenIPs(ctx, lockStrength, accountId any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTakenIPs", reflect.TypeOf((*MockStore)(nil).GetTakenIPs), ctx, lockStrength, accountId)
 }
@@ -2354,7 +2925,7 @@ func (m *MockStore) GetTargetsByServiceID(ctx context.Context, lockStrength Lock
 }
 
 // GetTargetsByServiceID indicates an expected call of GetTargetsByServiceID.
-func (mr *MockStoreMockRecorder) GetTargetsByServiceID(ctx, lockStrength, accountID, serviceID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetTargetsByServiceID(ctx, lockStrength, accountID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTargetsByServiceID", reflect.TypeOf((*MockStore)(nil).GetTargetsByServiceID), ctx, lockStrength, accountID, serviceID)
 }
@@ -2369,37 +2940,37 @@ func (m *MockStore) GetTokenIDByHashedToken(ctx context.Context, secret string)
 }
 
 // GetTokenIDByHashedToken indicates an expected call of GetTokenIDByHashedToken.
-func (mr *MockStoreMockRecorder) GetTokenIDByHashedToken(ctx, secret interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetTokenIDByHashedToken(ctx, secret any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTokenIDByHashedToken", reflect.TypeOf((*MockStore)(nil).GetTokenIDByHashedToken), ctx, secret)
 }
 
 // GetUserByPATID mocks base method.
-func (m *MockStore) GetUserByPATID(ctx context.Context, lockStrength LockingStrength, patID string) (*types2.User, error) {
+func (m *MockStore) GetUserByPATID(ctx context.Context, lockStrength LockingStrength, patID string) (*types3.User, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetUserByPATID", ctx, lockStrength, patID)
-	ret0, _ := ret[0].(*types2.User)
+	ret0, _ := ret[0].(*types3.User)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetUserByPATID indicates an expected call of GetUserByPATID.
-func (mr *MockStoreMockRecorder) GetUserByPATID(ctx, lockStrength, patID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetUserByPATID(ctx, lockStrength, patID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserByPATID", reflect.TypeOf((*MockStore)(nil).GetUserByPATID), ctx, lockStrength, patID)
 }
 
 // GetUserByUserID mocks base method.
-func (m *MockStore) GetUserByUserID(ctx context.Context, lockStrength LockingStrength, userID string) (*types2.User, error) {
+func (m *MockStore) GetUserByUserID(ctx context.Context, lockStrength LockingStrength, userID string) (*types3.User, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetUserByUserID", ctx, lockStrength, userID)
-	ret0, _ := ret[0].(*types2.User)
+	ret0, _ := ret[0].(*types3.User)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetUserByUserID indicates an expected call of GetUserByUserID.
-func (mr *MockStoreMockRecorder) GetUserByUserID(ctx, lockStrength, userID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetUserByUserID(ctx, lockStrength, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserByUserID", reflect.TypeOf((*MockStore)(nil).GetUserByUserID), ctx, lockStrength, userID)
 }
@@ -2414,67 +2985,67 @@ func (m *MockStore) GetUserIDByPeerKey(ctx context.Context, lockStrength Locking
 }
 
 // GetUserIDByPeerKey indicates an expected call of GetUserIDByPeerKey.
-func (mr *MockStoreMockRecorder) GetUserIDByPeerKey(ctx, lockStrength, peerKey interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetUserIDByPeerKey(ctx, lockStrength, peerKey any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserIDByPeerKey", reflect.TypeOf((*MockStore)(nil).GetUserIDByPeerKey), ctx, lockStrength, peerKey)
 }
 
 // GetUserInviteByEmail mocks base method.
-func (m *MockStore) GetUserInviteByEmail(ctx context.Context, lockStrength LockingStrength, accountID, email string) (*types2.UserInviteRecord, error) {
+func (m *MockStore) GetUserInviteByEmail(ctx context.Context, lockStrength LockingStrength, accountID, email string) (*types3.UserInviteRecord, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetUserInviteByEmail", ctx, lockStrength, accountID, email)
-	ret0, _ := ret[0].(*types2.UserInviteRecord)
+	ret0, _ := ret[0].(*types3.UserInviteRecord)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetUserInviteByEmail indicates an expected call of GetUserInviteByEmail.
-func (mr *MockStoreMockRecorder) GetUserInviteByEmail(ctx, lockStrength, accountID, email interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetUserInviteByEmail(ctx, lockStrength, accountID, email any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserInviteByEmail", reflect.TypeOf((*MockStore)(nil).GetUserInviteByEmail), ctx, lockStrength, accountID, email)
 }
 
 // GetUserInviteByHashedToken mocks base method.
-func (m *MockStore) GetUserInviteByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken string) (*types2.UserInviteRecord, error) {
+func (m *MockStore) GetUserInviteByHashedToken(ctx context.Context, lockStrength LockingStrength, hashedToken string) (*types3.UserInviteRecord, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetUserInviteByHashedToken", ctx, lockStrength, hashedToken)
-	ret0, _ := ret[0].(*types2.UserInviteRecord)
+	ret0, _ := ret[0].(*types3.UserInviteRecord)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetUserInviteByHashedToken indicates an expected call of GetUserInviteByHashedToken.
-func (mr *MockStoreMockRecorder) GetUserInviteByHashedToken(ctx, lockStrength, hashedToken interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetUserInviteByHashedToken(ctx, lockStrength, hashedToken any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserInviteByHashedToken", reflect.TypeOf((*MockStore)(nil).GetUserInviteByHashedToken), ctx, lockStrength, hashedToken)
 }
 
 // GetUserInviteByID mocks base method.
-func (m *MockStore) GetUserInviteByID(ctx context.Context, lockStrength LockingStrength, accountID, inviteID string) (*types2.UserInviteRecord, error) {
+func (m *MockStore) GetUserInviteByID(ctx context.Context, lockStrength LockingStrength, accountID, inviteID string) (*types3.UserInviteRecord, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetUserInviteByID", ctx, lockStrength, accountID, inviteID)
-	ret0, _ := ret[0].(*types2.UserInviteRecord)
+	ret0, _ := ret[0].(*types3.UserInviteRecord)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetUserInviteByID indicates an expected call of GetUserInviteByID.
-func (mr *MockStoreMockRecorder) GetUserInviteByID(ctx, lockStrength, accountID, inviteID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetUserInviteByID(ctx, lockStrength, accountID, inviteID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserInviteByID", reflect.TypeOf((*MockStore)(nil).GetUserInviteByID), ctx, lockStrength, accountID, inviteID)
 }
 
 // GetUserPATs mocks base method.
-func (m *MockStore) GetUserPATs(ctx context.Context, lockStrength LockingStrength, userID string) ([]*types2.PersonalAccessToken, error) {
+func (m *MockStore) GetUserPATs(ctx context.Context, lockStrength LockingStrength, userID string) ([]*types3.PersonalAccessToken, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetUserPATs", ctx, lockStrength, userID)
-	ret0, _ := ret[0].([]*types2.PersonalAccessToken)
+	ret0, _ := ret[0].([]*types3.PersonalAccessToken)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetUserPATs indicates an expected call of GetUserPATs.
-func (mr *MockStoreMockRecorder) GetUserPATs(ctx, lockStrength, userID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetUserPATs(ctx, lockStrength, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserPATs", reflect.TypeOf((*MockStore)(nil).GetUserPATs), ctx, lockStrength, userID)
 }
@@ -2489,24 +3060,24 @@ func (m *MockStore) GetUserPeers(ctx context.Context, lockStrength LockingStreng
 }
 
 // GetUserPeers indicates an expected call of GetUserPeers.
-func (mr *MockStoreMockRecorder) GetUserPeers(ctx, lockStrength, accountID, userID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetUserPeers(ctx, lockStrength, accountID, userID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserPeers", reflect.TypeOf((*MockStore)(nil).GetUserPeers), ctx, lockStrength, accountID, userID)
 }
 
 // GetZoneByDomain mocks base method.
-func (m *MockStore) GetZoneByDomain(ctx context.Context, accountID, domain string) (*zones.Zone, error) {
+func (m *MockStore) GetZoneByDomain(ctx context.Context, accountID, arg2 string) (*zones.Zone, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetZoneByDomain", ctx, accountID, domain)
+	ret := m.ctrl.Call(m, "GetZoneByDomain", ctx, accountID, arg2)
 	ret0, _ := ret[0].(*zones.Zone)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetZoneByDomain indicates an expected call of GetZoneByDomain.
-func (mr *MockStoreMockRecorder) GetZoneByDomain(ctx, accountID, domain interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetZoneByDomain(ctx, accountID, arg2 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetZoneByDomain", reflect.TypeOf((*MockStore)(nil).GetZoneByDomain), ctx, accountID, domain)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetZoneByDomain", reflect.TypeOf((*MockStore)(nil).GetZoneByDomain), ctx, accountID, arg2)
 }
 
 // GetZoneByID mocks base method.
@@ -2519,7 +3090,7 @@ func (m *MockStore) GetZoneByID(ctx context.Context, lockStrength LockingStrengt
 }
 
 // GetZoneByID indicates an expected call of GetZoneByID.
-func (mr *MockStoreMockRecorder) GetZoneByID(ctx, lockStrength, accountID, zoneID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetZoneByID(ctx, lockStrength, accountID, zoneID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetZoneByID", reflect.TypeOf((*MockStore)(nil).GetZoneByID), ctx, lockStrength, accountID, zoneID)
 }
@@ -2534,7 +3105,7 @@ func (m *MockStore) GetZoneDNSRecords(ctx context.Context, lockStrength LockingS
 }
 
 // GetZoneDNSRecords indicates an expected call of GetZoneDNSRecords.
-func (mr *MockStoreMockRecorder) GetZoneDNSRecords(ctx, lockStrength, accountID, zoneID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetZoneDNSRecords(ctx, lockStrength, accountID, zoneID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetZoneDNSRecords", reflect.TypeOf((*MockStore)(nil).GetZoneDNSRecords), ctx, lockStrength, accountID, zoneID)
 }
@@ -2549,11 +3120,99 @@ func (m *MockStore) GetZoneDNSRecordsByName(ctx context.Context, lockStrength Lo
 }
 
 // GetZoneDNSRecordsByName indicates an expected call of GetZoneDNSRecordsByName.
-func (mr *MockStoreMockRecorder) GetZoneDNSRecordsByName(ctx, lockStrength, accountID, zoneID, name interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetZoneDNSRecordsByName(ctx, lockStrength, accountID, zoneID, name any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetZoneDNSRecordsByName", reflect.TypeOf((*MockStore)(nil).GetZoneDNSRecordsByName), ctx, lockStrength, accountID, zoneID, name)
 }
 
+// HasActiveProxyAtClusterAddress mocks base method.
+func (m *MockStore) HasActiveProxyAtClusterAddress(ctx context.Context, clusterAddress string) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HasActiveProxyAtClusterAddress", ctx, clusterAddress)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// HasActiveProxyAtClusterAddress indicates an expected call of HasActiveProxyAtClusterAddress.
+func (mr *MockStoreMockRecorder) HasActiveProxyAtClusterAddress(ctx, clusterAddress any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HasActiveProxyAtClusterAddress", reflect.TypeOf((*MockStore)(nil).HasActiveProxyAtClusterAddress), ctx, clusterAddress)
+}
+
+// HasForeignAccountProxyAtHost mocks base method.
+func (m *MockStore) HasForeignAccountProxyAtHost(ctx context.Context, host, accountID string) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HasForeignAccountProxyAtHost", ctx, host, accountID)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// HasForeignAccountProxyAtHost indicates an expected call of HasForeignAccountProxyAtHost.
+func (mr *MockStoreMockRecorder) HasForeignAccountProxyAtHost(ctx, host, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HasForeignAccountProxyAtHost", reflect.TypeOf((*MockStore)(nil).HasForeignAccountProxyAtHost), ctx, host, accountID)
+}
+
+// HasGatewayClusterPinnedByOtherAccount mocks base method.
+func (m *MockStore) HasGatewayClusterPinnedByOtherAccount(ctx context.Context, host, accountID string) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HasGatewayClusterPinnedByOtherAccount", ctx, host, accountID)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// HasGatewayClusterPinnedByOtherAccount indicates an expected call of HasGatewayClusterPinnedByOtherAccount.
+func (mr *MockStoreMockRecorder) HasGatewayClusterPinnedByOtherAccount(ctx, host, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HasGatewayClusterPinnedByOtherAccount", reflect.TypeOf((*MockStore)(nil).HasGatewayClusterPinnedByOtherAccount), ctx, host, accountID)
+}
+
+// HasGatewayEndpointByOtherAccount mocks base method.
+func (m *MockStore) HasGatewayEndpointByOtherAccount(ctx context.Context, host, accountID string) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HasGatewayEndpointByOtherAccount", ctx, host, accountID)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// HasGatewayEndpointByOtherAccount indicates an expected call of HasGatewayEndpointByOtherAccount.
+func (mr *MockStoreMockRecorder) HasGatewayEndpointByOtherAccount(ctx, host, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HasGatewayEndpointByOtherAccount", reflect.TypeOf((*MockStore)(nil).HasGatewayEndpointByOtherAccount), ctx, host, accountID)
+}
+
+// IncrementAgentNetworkConsumption mocks base method.
+func (m *MockStore) IncrementAgentNetworkConsumption(ctx context.Context, accountID string, kind types.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time, tokensIn, tokensOut int64, costUSD float64) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IncrementAgentNetworkConsumption", ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// IncrementAgentNetworkConsumption indicates an expected call of IncrementAgentNetworkConsumption.
+func (mr *MockStoreMockRecorder) IncrementAgentNetworkConsumption(ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).IncrementAgentNetworkConsumption), ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
+}
+
+// IncrementAgentNetworkConsumptionBatch mocks base method.
+func (m *MockStore) IncrementAgentNetworkConsumptionBatch(ctx context.Context, accountID string, keys []types.ConsumptionKey, tokensIn, tokensOut int64, costUSD float64) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IncrementAgentNetworkConsumptionBatch", ctx, accountID, keys, tokensIn, tokensOut, costUSD)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// IncrementAgentNetworkConsumptionBatch indicates an expected call of IncrementAgentNetworkConsumptionBatch.
+func (mr *MockStoreMockRecorder) IncrementAgentNetworkConsumptionBatch(ctx, accountID, keys, tokensIn, tokensOut, costUSD any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementAgentNetworkConsumptionBatch", reflect.TypeOf((*MockStore)(nil).IncrementAgentNetworkConsumptionBatch), ctx, accountID, keys, tokensIn, tokensOut, costUSD)
+}
+
 // IncrementNetworkSerial mocks base method.
 func (m *MockStore) IncrementNetworkSerial(ctx context.Context, accountId string) error {
 	m.ctrl.T.Helper()
@@ -2563,7 +3222,7 @@ func (m *MockStore) IncrementNetworkSerial(ctx context.Context, accountId string
 }
 
 // IncrementNetworkSerial indicates an expected call of IncrementNetworkSerial.
-func (mr *MockStoreMockRecorder) IncrementNetworkSerial(ctx, accountId interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) IncrementNetworkSerial(ctx, accountId any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementNetworkSerial", reflect.TypeOf((*MockStore)(nil).IncrementNetworkSerial), ctx, accountId)
 }
@@ -2577,7 +3236,7 @@ func (m *MockStore) IncrementSetupKeyUsage(ctx context.Context, setupKeyID strin
 }
 
 // IncrementSetupKeyUsage indicates an expected call of IncrementSetupKeyUsage.
-func (mr *MockStoreMockRecorder) IncrementSetupKeyUsage(ctx, setupKeyID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) IncrementSetupKeyUsage(ctx, setupKeyID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementSetupKeyUsage", reflect.TypeOf((*MockStore)(nil).IncrementSetupKeyUsage), ctx, setupKeyID)
 }
@@ -2592,7 +3251,7 @@ func (m *MockStore) IsClusterAddressConflicting(ctx context.Context, clusterAddr
 }
 
 // IsClusterAddressConflicting indicates an expected call of IsClusterAddressConflicting.
-func (mr *MockStoreMockRecorder) IsClusterAddressConflicting(ctx, clusterAddress, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) IsClusterAddressConflicting(ctx, clusterAddress, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsClusterAddressConflicting", reflect.TypeOf((*MockStore)(nil).IsClusterAddressConflicting), ctx, clusterAddress, accountID)
 }
@@ -2608,7 +3267,7 @@ func (m *MockStore) IsPrimaryAccount(ctx context.Context, accountID string) (boo
 }
 
 // IsPrimaryAccount indicates an expected call of IsPrimaryAccount.
-func (mr *MockStoreMockRecorder) IsPrimaryAccount(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) IsPrimaryAccount(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsPrimaryAccount", reflect.TypeOf((*MockStore)(nil).IsPrimaryAccount), ctx, accountID)
 }
@@ -2623,11 +3282,26 @@ func (m *MockStore) IsProxyAccessTokenValid(ctx context.Context, tokenID string)
 }
 
 // IsProxyAccessTokenValid indicates an expected call of IsProxyAccessTokenValid.
-func (mr *MockStoreMockRecorder) IsProxyAccessTokenValid(ctx, tokenID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) IsProxyAccessTokenValid(ctx, tokenID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsProxyAccessTokenValid", reflect.TypeOf((*MockStore)(nil).IsProxyAccessTokenValid), ctx, tokenID)
 }
 
+// ListAgentNetworkConsumption mocks base method.
+func (m *MockStore) ListAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.Consumption, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListAgentNetworkConsumption", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*types.Consumption)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListAgentNetworkConsumption indicates an expected call of ListAgentNetworkConsumption.
+func (mr *MockStoreMockRecorder) ListAgentNetworkConsumption(ctx, lockStrength, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).ListAgentNetworkConsumption), ctx, lockStrength, accountID)
+}
+
 // ListCustomDomains mocks base method.
 func (m *MockStore) ListCustomDomains(ctx context.Context, accountID string) ([]*domain.Domain, error) {
 	m.ctrl.T.Helper()
@@ -2638,7 +3312,7 @@ func (m *MockStore) ListCustomDomains(ctx context.Context, accountID string) ([]
 }
 
 // ListCustomDomains indicates an expected call of ListCustomDomains.
-func (mr *MockStoreMockRecorder) ListCustomDomains(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) ListCustomDomains(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListCustomDomains", reflect.TypeOf((*MockStore)(nil).ListCustomDomains), ctx, accountID)
 }
@@ -2653,11 +3327,26 @@ func (m *MockStore) ListFreeDomains(ctx context.Context, accountID string) ([]st
 }
 
 // ListFreeDomains indicates an expected call of ListFreeDomains.
-func (mr *MockStoreMockRecorder) ListFreeDomains(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) ListFreeDomains(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListFreeDomains", reflect.TypeOf((*MockStore)(nil).ListFreeDomains), ctx, accountID)
 }
 
+// LockCustomDomains mocks base method.
+func (m *MockStore) LockCustomDomains(ctx context.Context, accountID string, serviceDomain domain0.Domain) ([]*domain.Domain, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "LockCustomDomains", ctx, accountID, serviceDomain)
+	ret0, _ := ret[0].([]*domain.Domain)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// LockCustomDomains indicates an expected call of LockCustomDomains.
+func (mr *MockStoreMockRecorder) LockCustomDomains(ctx, accountID, serviceDomain any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LockCustomDomains", reflect.TypeOf((*MockStore)(nil).LockCustomDomains), ctx, accountID, serviceDomain)
+}
+
 // MarkAccountPrimary mocks base method.
 func (m *MockStore) MarkAccountPrimary(ctx context.Context, accountID string) error {
 	m.ctrl.T.Helper()
@@ -2667,7 +3356,7 @@ func (m *MockStore) MarkAccountPrimary(ctx context.Context, accountID string) er
 }
 
 // MarkAccountPrimary indicates an expected call of MarkAccountPrimary.
-func (mr *MockStoreMockRecorder) MarkAccountPrimary(ctx, accountID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) MarkAccountPrimary(ctx, accountID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkAccountPrimary", reflect.TypeOf((*MockStore)(nil).MarkAccountPrimary), ctx, accountID)
 }
@@ -2681,7 +3370,7 @@ func (m *MockStore) MarkAllPendingJobsAsFailed(ctx context.Context, accountID, p
 }
 
 // MarkAllPendingJobsAsFailed indicates an expected call of MarkAllPendingJobsAsFailed.
-func (mr *MockStoreMockRecorder) MarkAllPendingJobsAsFailed(ctx, accountID, peerID, reason interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) MarkAllPendingJobsAsFailed(ctx, accountID, peerID, reason any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkAllPendingJobsAsFailed", reflect.TypeOf((*MockStore)(nil).MarkAllPendingJobsAsFailed), ctx, accountID, peerID, reason)
 }
@@ -2695,7 +3384,7 @@ func (m *MockStore) MarkPATUsed(ctx context.Context, patID string) error {
 }
 
 // MarkPATUsed indicates an expected call of MarkPATUsed.
-func (mr *MockStoreMockRecorder) MarkPATUsed(ctx, patID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) MarkPATUsed(ctx, patID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkPATUsed", reflect.TypeOf((*MockStore)(nil).MarkPATUsed), ctx, patID)
 }
@@ -2710,7 +3399,7 @@ func (m *MockStore) MarkPeerConnectedIfNewerSession(ctx context.Context, account
 }
 
 // MarkPeerConnectedIfNewerSession indicates an expected call of MarkPeerConnectedIfNewerSession.
-func (mr *MockStoreMockRecorder) MarkPeerConnectedIfNewerSession(ctx, accountID, peerID, newSessionStartedAt interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) MarkPeerConnectedIfNewerSession(ctx, accountID, peerID, newSessionStartedAt any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkPeerConnectedIfNewerSession", reflect.TypeOf((*MockStore)(nil).MarkPeerConnectedIfNewerSession), ctx, accountID, peerID, newSessionStartedAt)
 }
@@ -2725,7 +3414,7 @@ func (m *MockStore) MarkPeerDisconnectedIfSameSession(ctx context.Context, accou
 }
 
 // MarkPeerDisconnectedIfSameSession indicates an expected call of MarkPeerDisconnectedIfSameSession.
-func (mr *MockStoreMockRecorder) MarkPeerDisconnectedIfSameSession(ctx, accountID, peerID, sessionStartedAt interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) MarkPeerDisconnectedIfSameSession(ctx, accountID, peerID, sessionStartedAt any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkPeerDisconnectedIfSameSession", reflect.TypeOf((*MockStore)(nil).MarkPeerDisconnectedIfSameSession), ctx, accountID, peerID, sessionStartedAt)
 }
@@ -2739,7 +3428,7 @@ func (m *MockStore) MarkPendingJobsAsFailed(ctx context.Context, accountID, peer
 }
 
 // MarkPendingJobsAsFailed indicates an expected call of MarkPendingJobsAsFailed.
-func (mr *MockStoreMockRecorder) MarkPendingJobsAsFailed(ctx, accountID, peerID, jobID, reason interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) MarkPendingJobsAsFailed(ctx, accountID, peerID, jobID, reason any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkPendingJobsAsFailed", reflect.TypeOf((*MockStore)(nil).MarkPendingJobsAsFailed), ctx, accountID, peerID, jobID, reason)
 }
@@ -2753,11 +3442,26 @@ func (m *MockStore) MarkProxyAccessTokenUsed(ctx context.Context, tokenID string
 }
 
 // MarkProxyAccessTokenUsed indicates an expected call of MarkProxyAccessTokenUsed.
-func (mr *MockStoreMockRecorder) MarkProxyAccessTokenUsed(ctx, tokenID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) MarkProxyAccessTokenUsed(ctx, tokenID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkProxyAccessTokenUsed", reflect.TypeOf((*MockStore)(nil).MarkProxyAccessTokenUsed), ctx, tokenID)
 }
 
+// RefreshPeerLastSeen mocks base method.
+func (m *MockStore) RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RefreshPeerLastSeen", ctx, accountID, peerID, staleBefore)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RefreshPeerLastSeen indicates an expected call of RefreshPeerLastSeen.
+func (mr *MockStoreMockRecorder) RefreshPeerLastSeen(ctx, accountID, peerID, staleBefore any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RefreshPeerLastSeen", reflect.TypeOf((*MockStore)(nil).RefreshPeerLastSeen), ctx, accountID, peerID, staleBefore)
+}
+
 // RemovePeerFromAllGroups mocks base method.
 func (m *MockStore) RemovePeerFromAllGroups(ctx context.Context, peerID string) error {
 	m.ctrl.T.Helper()
@@ -2767,7 +3471,7 @@ func (m *MockStore) RemovePeerFromAllGroups(ctx context.Context, peerID string)
 }
 
 // RemovePeerFromAllGroups indicates an expected call of RemovePeerFromAllGroups.
-func (mr *MockStoreMockRecorder) RemovePeerFromAllGroups(ctx, peerID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) RemovePeerFromAllGroups(ctx, peerID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemovePeerFromAllGroups", reflect.TypeOf((*MockStore)(nil).RemovePeerFromAllGroups), ctx, peerID)
 }
@@ -2781,7 +3485,7 @@ func (m *MockStore) RemovePeerFromGroup(ctx context.Context, peerID, groupID str
 }
 
 // RemovePeerFromGroup indicates an expected call of RemovePeerFromGroup.
-func (mr *MockStoreMockRecorder) RemovePeerFromGroup(ctx, peerID, groupID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) RemovePeerFromGroup(ctx, peerID, groupID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemovePeerFromGroup", reflect.TypeOf((*MockStore)(nil).RemovePeerFromGroup), ctx, peerID, groupID)
 }
@@ -2795,7 +3499,7 @@ func (m *MockStore) RemoveResourceFromGroup(ctx context.Context, accountId, grou
 }
 
 // RemoveResourceFromGroup indicates an expected call of RemoveResourceFromGroup.
-func (mr *MockStoreMockRecorder) RemoveResourceFromGroup(ctx, accountId, groupID, resourceID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) RemoveResourceFromGroup(ctx, accountId, groupID, resourceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveResourceFromGroup", reflect.TypeOf((*MockStore)(nil).RemoveResourceFromGroup), ctx, accountId, groupID, resourceID)
 }
@@ -2809,7 +3513,7 @@ func (m *MockStore) RenewEphemeralService(ctx context.Context, accountID, peerID
 }
 
 // RenewEphemeralService indicates an expected call of RenewEphemeralService.
-func (mr *MockStoreMockRecorder) RenewEphemeralService(ctx, accountID, peerID, serviceID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) RenewEphemeralService(ctx, accountID, peerID, serviceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RenewEphemeralService", reflect.TypeOf((*MockStore)(nil).RenewEphemeralService), ctx, accountID, peerID, serviceID)
 }
@@ -2823,13 +3527,13 @@ func (m *MockStore) RevokeProxyAccessToken(ctx context.Context, tokenID string)
 }
 
 // RevokeProxyAccessToken indicates an expected call of RevokeProxyAccessToken.
-func (mr *MockStoreMockRecorder) RevokeProxyAccessToken(ctx, tokenID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) RevokeProxyAccessToken(ctx, tokenID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeProxyAccessToken", reflect.TypeOf((*MockStore)(nil).RevokeProxyAccessToken), ctx, tokenID)
 }
 
 // SaveAccount mocks base method.
-func (m *MockStore) SaveAccount(ctx context.Context, account *types2.Account) error {
+func (m *MockStore) SaveAccount(ctx context.Context, account *types3.Account) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveAccount", ctx, account)
 	ret0, _ := ret[0].(error)
@@ -2837,13 +3541,13 @@ func (m *MockStore) SaveAccount(ctx context.Context, account *types2.Account) er
 }
 
 // SaveAccount indicates an expected call of SaveAccount.
-func (mr *MockStoreMockRecorder) SaveAccount(ctx, account interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveAccount(ctx, account any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAccount", reflect.TypeOf((*MockStore)(nil).SaveAccount), ctx, account)
 }
 
 // SaveAccountOnboarding mocks base method.
-func (m *MockStore) SaveAccountOnboarding(ctx context.Context, onboarding *types2.AccountOnboarding) error {
+func (m *MockStore) SaveAccountOnboarding(ctx context.Context, onboarding *types3.AccountOnboarding) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveAccountOnboarding", ctx, onboarding)
 	ret0, _ := ret[0].(error)
@@ -2851,13 +3555,13 @@ func (m *MockStore) SaveAccountOnboarding(ctx context.Context, onboarding *types
 }
 
 // SaveAccountOnboarding indicates an expected call of SaveAccountOnboarding.
-func (mr *MockStoreMockRecorder) SaveAccountOnboarding(ctx, onboarding interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveAccountOnboarding(ctx, onboarding any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAccountOnboarding", reflect.TypeOf((*MockStore)(nil).SaveAccountOnboarding), ctx, onboarding)
 }
 
 // SaveAccountSettings mocks base method.
-func (m *MockStore) SaveAccountSettings(ctx context.Context, accountID string, settings *types2.Settings) error {
+func (m *MockStore) SaveAccountSettings(ctx context.Context, accountID string, settings *types3.Settings) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveAccountSettings", ctx, accountID, settings)
 	ret0, _ := ret[0].(error)
@@ -2865,13 +3569,83 @@ func (m *MockStore) SaveAccountSettings(ctx context.Context, accountID string, s
 }
 
 // SaveAccountSettings indicates an expected call of SaveAccountSettings.
-func (mr *MockStoreMockRecorder) SaveAccountSettings(ctx, accountID, settings interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveAccountSettings(ctx, accountID, settings any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAccountSettings", reflect.TypeOf((*MockStore)(nil).SaveAccountSettings), ctx, accountID, settings)
 }
 
+// SaveAgentNetworkBudgetRule mocks base method.
+func (m *MockStore) SaveAgentNetworkBudgetRule(ctx context.Context, rule *types.AccountBudgetRule) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkBudgetRule", ctx, rule)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkBudgetRule indicates an expected call of SaveAgentNetworkBudgetRule.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkBudgetRule(ctx, rule any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkBudgetRule), ctx, rule)
+}
+
+// SaveAgentNetworkGuardrail mocks base method.
+func (m *MockStore) SaveAgentNetworkGuardrail(ctx context.Context, guardrail *types.Guardrail) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkGuardrail", ctx, guardrail)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkGuardrail indicates an expected call of SaveAgentNetworkGuardrail.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkGuardrail(ctx, guardrail any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkGuardrail", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkGuardrail), ctx, guardrail)
+}
+
+// SaveAgentNetworkPolicy mocks base method.
+func (m *MockStore) SaveAgentNetworkPolicy(ctx context.Context, policy *types.Policy) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkPolicy", ctx, policy)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkPolicy indicates an expected call of SaveAgentNetworkPolicy.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkPolicy(ctx, policy any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkPolicy", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkPolicy), ctx, policy)
+}
+
+// SaveAgentNetworkProvider mocks base method.
+func (m *MockStore) SaveAgentNetworkProvider(ctx context.Context, provider *types.Provider) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkProvider", ctx, provider)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkProvider indicates an expected call of SaveAgentNetworkProvider.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkProvider(ctx, provider any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkProvider", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkProvider), ctx, provider)
+}
+
+// SaveAgentNetworkSettings mocks base method.
+func (m *MockStore) SaveAgentNetworkSettings(ctx context.Context, settings *types.Settings) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkSettings", ctx, settings)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkSettings indicates an expected call of SaveAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkSettings(ctx, settings any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkSettings), ctx, settings)
+}
+
 // SaveDNSSettings mocks base method.
-func (m *MockStore) SaveDNSSettings(ctx context.Context, accountID string, settings *types2.DNSSettings) error {
+func (m *MockStore) SaveDNSSettings(ctx context.Context, accountID string, settings *types3.DNSSettings) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveDNSSettings", ctx, accountID, settings)
 	ret0, _ := ret[0].(error)
@@ -2879,7 +3653,7 @@ func (m *MockStore) SaveDNSSettings(ctx context.Context, accountID string, setti
 }
 
 // SaveDNSSettings indicates an expected call of SaveDNSSettings.
-func (mr *MockStoreMockRecorder) SaveDNSSettings(ctx, accountID, settings interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveDNSSettings(ctx, accountID, settings any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveDNSSettings", reflect.TypeOf((*MockStore)(nil).SaveDNSSettings), ctx, accountID, settings)
 }
@@ -2893,7 +3667,7 @@ func (m *MockStore) SaveInstallationID(ctx context.Context, ID string) error {
 }
 
 // SaveInstallationID indicates an expected call of SaveInstallationID.
-func (mr *MockStoreMockRecorder) SaveInstallationID(ctx, ID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveInstallationID(ctx, ID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveInstallationID", reflect.TypeOf((*MockStore)(nil).SaveInstallationID), ctx, ID)
 }
@@ -2907,13 +3681,13 @@ func (m *MockStore) SaveNameServerGroup(ctx context.Context, nameServerGroup *dn
 }
 
 // SaveNameServerGroup indicates an expected call of SaveNameServerGroup.
-func (mr *MockStoreMockRecorder) SaveNameServerGroup(ctx, nameServerGroup interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveNameServerGroup(ctx, nameServerGroup any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveNameServerGroup", reflect.TypeOf((*MockStore)(nil).SaveNameServerGroup), ctx, nameServerGroup)
 }
 
 // SaveNetwork mocks base method.
-func (m *MockStore) SaveNetwork(ctx context.Context, network *types1.Network) error {
+func (m *MockStore) SaveNetwork(ctx context.Context, network *types2.Network) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveNetwork", ctx, network)
 	ret0, _ := ret[0].(error)
@@ -2921,13 +3695,13 @@ func (m *MockStore) SaveNetwork(ctx context.Context, network *types1.Network) er
 }
 
 // SaveNetwork indicates an expected call of SaveNetwork.
-func (mr *MockStoreMockRecorder) SaveNetwork(ctx, network interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveNetwork(ctx, network any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveNetwork", reflect.TypeOf((*MockStore)(nil).SaveNetwork), ctx, network)
 }
 
 // SaveNetworkResource mocks base method.
-func (m *MockStore) SaveNetworkResource(ctx context.Context, resource *types.NetworkResource) error {
+func (m *MockStore) SaveNetworkResource(ctx context.Context, resource *types0.NetworkResource) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveNetworkResource", ctx, resource)
 	ret0, _ := ret[0].(error)
@@ -2935,13 +3709,13 @@ func (m *MockStore) SaveNetworkResource(ctx context.Context, resource *types.Net
 }
 
 // SaveNetworkResource indicates an expected call of SaveNetworkResource.
-func (mr *MockStoreMockRecorder) SaveNetworkResource(ctx, resource interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveNetworkResource(ctx, resource any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveNetworkResource", reflect.TypeOf((*MockStore)(nil).SaveNetworkResource), ctx, resource)
 }
 
 // SavePAT mocks base method.
-func (m *MockStore) SavePAT(ctx context.Context, pat *types2.PersonalAccessToken) error {
+func (m *MockStore) SavePAT(ctx context.Context, pat *types3.PersonalAccessToken) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SavePAT", ctx, pat)
 	ret0, _ := ret[0].(error)
@@ -2949,23 +3723,23 @@ func (m *MockStore) SavePAT(ctx context.Context, pat *types2.PersonalAccessToken
 }
 
 // SavePAT indicates an expected call of SavePAT.
-func (mr *MockStoreMockRecorder) SavePAT(ctx, pat interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SavePAT(ctx, pat any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SavePAT", reflect.TypeOf((*MockStore)(nil).SavePAT), ctx, pat)
 }
 
 // SavePeer mocks base method.
-func (m *MockStore) SavePeer(ctx context.Context, accountID string, peer *peer.Peer) error {
+func (m *MockStore) SavePeer(ctx context.Context, accountID string, arg2 *peer.Peer) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SavePeer", ctx, accountID, peer)
+	ret := m.ctrl.Call(m, "SavePeer", ctx, accountID, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // SavePeer indicates an expected call of SavePeer.
-func (mr *MockStoreMockRecorder) SavePeer(ctx, accountID, peer interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SavePeer(ctx, accountID, arg2 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SavePeer", reflect.TypeOf((*MockStore)(nil).SavePeer), ctx, accountID, peer)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SavePeer", reflect.TypeOf((*MockStore)(nil).SavePeer), ctx, accountID, arg2)
 }
 
 // SavePeerStatus mocks base method.
@@ -2977,13 +3751,13 @@ func (m *MockStore) SavePeerStatus(ctx context.Context, accountID, peerID string
 }
 
 // SavePeerStatus indicates an expected call of SavePeerStatus.
-func (mr *MockStoreMockRecorder) SavePeerStatus(ctx, accountID, peerID, status interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SavePeerStatus(ctx, accountID, peerID, status any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SavePeerStatus", reflect.TypeOf((*MockStore)(nil).SavePeerStatus), ctx, accountID, peerID, status)
 }
 
 // SavePolicy mocks base method.
-func (m *MockStore) SavePolicy(ctx context.Context, policy *types2.Policy) error {
+func (m *MockStore) SavePolicy(ctx context.Context, policy *types3.Policy) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SavePolicy", ctx, policy)
 	ret0, _ := ret[0].(error)
@@ -2991,7 +3765,7 @@ func (m *MockStore) SavePolicy(ctx context.Context, policy *types2.Policy) error
 }
 
 // SavePolicy indicates an expected call of SavePolicy.
-func (mr *MockStoreMockRecorder) SavePolicy(ctx, policy interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SavePolicy(ctx, policy any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SavePolicy", reflect.TypeOf((*MockStore)(nil).SavePolicy), ctx, policy)
 }
@@ -3005,27 +3779,27 @@ func (m *MockStore) SavePostureChecks(ctx context.Context, postureCheck *posture
 }
 
 // SavePostureChecks indicates an expected call of SavePostureChecks.
-func (mr *MockStoreMockRecorder) SavePostureChecks(ctx, postureCheck interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SavePostureChecks(ctx, postureCheck any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SavePostureChecks", reflect.TypeOf((*MockStore)(nil).SavePostureChecks), ctx, postureCheck)
 }
 
 // SaveProxy mocks base method.
-func (m *MockStore) SaveProxy(ctx context.Context, proxy *proxy.Proxy) error {
+func (m *MockStore) SaveProxy(ctx context.Context, arg1 *proxy.Proxy) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveProxy", ctx, proxy)
+	ret := m.ctrl.Call(m, "SaveProxy", ctx, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // SaveProxy indicates an expected call of SaveProxy.
-func (mr *MockStoreMockRecorder) SaveProxy(ctx, proxy interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveProxy(ctx, arg1 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveProxy", reflect.TypeOf((*MockStore)(nil).SaveProxy), ctx, proxy)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveProxy", reflect.TypeOf((*MockStore)(nil).SaveProxy), ctx, arg1)
 }
 
 // SaveProxyAccessToken mocks base method.
-func (m *MockStore) SaveProxyAccessToken(ctx context.Context, token *types2.ProxyAccessToken) error {
+func (m *MockStore) SaveProxyAccessToken(ctx context.Context, token *types3.ProxyAccessToken) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveProxyAccessToken", ctx, token)
 	ret0, _ := ret[0].(error)
@@ -3033,27 +3807,27 @@ func (m *MockStore) SaveProxyAccessToken(ctx context.Context, token *types2.Prox
 }
 
 // SaveProxyAccessToken indicates an expected call of SaveProxyAccessToken.
-func (mr *MockStoreMockRecorder) SaveProxyAccessToken(ctx, token interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveProxyAccessToken(ctx, token any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveProxyAccessToken", reflect.TypeOf((*MockStore)(nil).SaveProxyAccessToken), ctx, token)
 }
 
 // SaveRoute mocks base method.
-func (m *MockStore) SaveRoute(ctx context.Context, route *route.Route) error {
+func (m *MockStore) SaveRoute(ctx context.Context, arg1 *route.Route) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveRoute", ctx, route)
+	ret := m.ctrl.Call(m, "SaveRoute", ctx, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // SaveRoute indicates an expected call of SaveRoute.
-func (mr *MockStoreMockRecorder) SaveRoute(ctx, route interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveRoute(ctx, arg1 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveRoute", reflect.TypeOf((*MockStore)(nil).SaveRoute), ctx, route)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveRoute", reflect.TypeOf((*MockStore)(nil).SaveRoute), ctx, arg1)
 }
 
 // SaveSetupKey mocks base method.
-func (m *MockStore) SaveSetupKey(ctx context.Context, setupKey *types2.SetupKey) error {
+func (m *MockStore) SaveSetupKey(ctx context.Context, setupKey *types3.SetupKey) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveSetupKey", ctx, setupKey)
 	ret0, _ := ret[0].(error)
@@ -3061,13 +3835,13 @@ func (m *MockStore) SaveSetupKey(ctx context.Context, setupKey *types2.SetupKey)
 }
 
 // SaveSetupKey indicates an expected call of SaveSetupKey.
-func (mr *MockStoreMockRecorder) SaveSetupKey(ctx, setupKey interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveSetupKey(ctx, setupKey any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveSetupKey", reflect.TypeOf((*MockStore)(nil).SaveSetupKey), ctx, setupKey)
 }
 
 // SaveUser mocks base method.
-func (m *MockStore) SaveUser(ctx context.Context, user *types2.User) error {
+func (m *MockStore) SaveUser(ctx context.Context, user *types3.User) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveUser", ctx, user)
 	ret0, _ := ret[0].(error)
@@ -3075,13 +3849,13 @@ func (m *MockStore) SaveUser(ctx context.Context, user *types2.User) error {
 }
 
 // SaveUser indicates an expected call of SaveUser.
-func (mr *MockStoreMockRecorder) SaveUser(ctx, user interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveUser(ctx, user any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveUser", reflect.TypeOf((*MockStore)(nil).SaveUser), ctx, user)
 }
 
 // SaveUserInvite mocks base method.
-func (m *MockStore) SaveUserInvite(ctx context.Context, invite *types2.UserInviteRecord) error {
+func (m *MockStore) SaveUserInvite(ctx context.Context, invite *types3.UserInviteRecord) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveUserInvite", ctx, invite)
 	ret0, _ := ret[0].(error)
@@ -3089,7 +3863,7 @@ func (m *MockStore) SaveUserInvite(ctx context.Context, invite *types2.UserInvit
 }
 
 // SaveUserInvite indicates an expected call of SaveUserInvite.
-func (mr *MockStoreMockRecorder) SaveUserInvite(ctx, invite interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveUserInvite(ctx, invite any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveUserInvite", reflect.TypeOf((*MockStore)(nil).SaveUserInvite), ctx, invite)
 }
@@ -3103,13 +3877,13 @@ func (m *MockStore) SaveUserLastLogin(ctx context.Context, accountID, userID str
 }
 
 // SaveUserLastLogin indicates an expected call of SaveUserLastLogin.
-func (mr *MockStoreMockRecorder) SaveUserLastLogin(ctx, accountID, userID, lastLogin interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveUserLastLogin(ctx, accountID, userID, lastLogin any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveUserLastLogin", reflect.TypeOf((*MockStore)(nil).SaveUserLastLogin), ctx, accountID, userID, lastLogin)
 }
 
 // SaveUsers mocks base method.
-func (m *MockStore) SaveUsers(ctx context.Context, users []*types2.User) error {
+func (m *MockStore) SaveUsers(ctx context.Context, users []*types3.User) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SaveUsers", ctx, users)
 	ret0, _ := ret[0].(error)
@@ -3117,7 +3891,7 @@ func (m *MockStore) SaveUsers(ctx context.Context, users []*types2.User) error {
 }
 
 // SaveUsers indicates an expected call of SaveUsers.
-func (mr *MockStoreMockRecorder) SaveUsers(ctx, users interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SaveUsers(ctx, users any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveUsers", reflect.TypeOf((*MockStore)(nil).SaveUsers), ctx, users)
 }
@@ -3129,23 +3903,23 @@ func (m *MockStore) SetFieldEncrypt(enc *crypt.FieldEncrypt) {
 }
 
 // SetFieldEncrypt indicates an expected call of SetFieldEncrypt.
-func (mr *MockStoreMockRecorder) SetFieldEncrypt(enc interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) SetFieldEncrypt(enc any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetFieldEncrypt", reflect.TypeOf((*MockStore)(nil).SetFieldEncrypt), enc)
 }
 
 // UpdateAccountDomainAttributes mocks base method.
-func (m *MockStore) UpdateAccountDomainAttributes(ctx context.Context, accountID, domain, category string, isPrimaryDomain bool) error {
+func (m *MockStore) UpdateAccountDomainAttributes(ctx context.Context, accountID, arg2, category string, isPrimaryDomain bool) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateAccountDomainAttributes", ctx, accountID, domain, category, isPrimaryDomain)
+	ret := m.ctrl.Call(m, "UpdateAccountDomainAttributes", ctx, accountID, arg2, category, isPrimaryDomain)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // UpdateAccountDomainAttributes indicates an expected call of UpdateAccountDomainAttributes.
-func (mr *MockStoreMockRecorder) UpdateAccountDomainAttributes(ctx, accountID, domain, category, isPrimaryDomain interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateAccountDomainAttributes(ctx, accountID, arg2, category, isPrimaryDomain any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateAccountDomainAttributes", reflect.TypeOf((*MockStore)(nil).UpdateAccountDomainAttributes), ctx, accountID, domain, category, isPrimaryDomain)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateAccountDomainAttributes", reflect.TypeOf((*MockStore)(nil).UpdateAccountDomainAttributes), ctx, accountID, arg2, category, isPrimaryDomain)
 }
 
 // UpdateAccountNetwork mocks base method.
@@ -3157,7 +3931,7 @@ func (m *MockStore) UpdateAccountNetwork(ctx context.Context, accountID string,
 }
 
 // UpdateAccountNetwork indicates an expected call of UpdateAccountNetwork.
-func (mr *MockStoreMockRecorder) UpdateAccountNetwork(ctx, accountID, ipNet interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateAccountNetwork(ctx, accountID, ipNet any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateAccountNetwork", reflect.TypeOf((*MockStore)(nil).UpdateAccountNetwork), ctx, accountID, ipNet)
 }
@@ -3171,7 +3945,7 @@ func (m *MockStore) UpdateAccountNetworkV6(ctx context.Context, accountID string
 }
 
 // UpdateAccountNetworkV6 indicates an expected call of UpdateAccountNetworkV6.
-func (mr *MockStoreMockRecorder) UpdateAccountNetworkV6(ctx, accountID, ipNet interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateAccountNetworkV6(ctx, accountID, ipNet any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateAccountNetworkV6", reflect.TypeOf((*MockStore)(nil).UpdateAccountNetworkV6), ctx, accountID, ipNet)
 }
@@ -3186,7 +3960,7 @@ func (m *MockStore) UpdateCustomDomain(ctx context.Context, accountID string, d
 }
 
 // UpdateCustomDomain indicates an expected call of UpdateCustomDomain.
-func (mr *MockStoreMockRecorder) UpdateCustomDomain(ctx, accountID, d interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateCustomDomain(ctx, accountID, d any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateCustomDomain", reflect.TypeOf((*MockStore)(nil).UpdateCustomDomain), ctx, accountID, d)
 }
@@ -3200,13 +3974,13 @@ func (m *MockStore) UpdateDNSRecord(ctx context.Context, record *records.Record)
 }
 
 // UpdateDNSRecord indicates an expected call of UpdateDNSRecord.
-func (mr *MockStoreMockRecorder) UpdateDNSRecord(ctx, record interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateDNSRecord(ctx, record any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateDNSRecord", reflect.TypeOf((*MockStore)(nil).UpdateDNSRecord), ctx, record)
 }
 
 // UpdateGroup mocks base method.
-func (m *MockStore) UpdateGroup(ctx context.Context, group *types2.Group) error {
+func (m *MockStore) UpdateGroup(ctx context.Context, group *types3.Group) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "UpdateGroup", ctx, group)
 	ret0, _ := ret[0].(error)
@@ -3214,13 +3988,13 @@ func (m *MockStore) UpdateGroup(ctx context.Context, group *types2.Group) error
 }
 
 // UpdateGroup indicates an expected call of UpdateGroup.
-func (mr *MockStoreMockRecorder) UpdateGroup(ctx, group interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateGroup(ctx, group any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateGroup", reflect.TypeOf((*MockStore)(nil).UpdateGroup), ctx, group)
 }
 
 // UpdateGroups mocks base method.
-func (m *MockStore) UpdateGroups(ctx context.Context, accountID string, groups []*types2.Group) error {
+func (m *MockStore) UpdateGroups(ctx context.Context, accountID string, groups []*types3.Group) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "UpdateGroups", ctx, accountID, groups)
 	ret0, _ := ret[0].(error)
@@ -3228,13 +4002,13 @@ func (m *MockStore) UpdateGroups(ctx context.Context, accountID string, groups [
 }
 
 // UpdateGroups indicates an expected call of UpdateGroups.
-func (mr *MockStoreMockRecorder) UpdateGroups(ctx, accountID, groups interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateGroups(ctx, accountID, groups any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateGroups", reflect.TypeOf((*MockStore)(nil).UpdateGroups), ctx, accountID, groups)
 }
 
 // UpdateNetworkRouter mocks base method.
-func (m *MockStore) UpdateNetworkRouter(ctx context.Context, router *types0.NetworkRouter) error {
+func (m *MockStore) UpdateNetworkRouter(ctx context.Context, router *types1.NetworkRouter) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "UpdateNetworkRouter", ctx, router)
 	ret0, _ := ret[0].(error)
@@ -3242,7 +4016,7 @@ func (m *MockStore) UpdateNetworkRouter(ctx context.Context, router *types0.Netw
 }
 
 // UpdateNetworkRouter indicates an expected call of UpdateNetworkRouter.
-func (mr *MockStoreMockRecorder) UpdateNetworkRouter(ctx, router interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateNetworkRouter(ctx, router any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateNetworkRouter", reflect.TypeOf((*MockStore)(nil).UpdateNetworkRouter), ctx, router)
 }
@@ -3256,23 +4030,23 @@ func (m *MockStore) UpdateProxyHeartbeat(ctx context.Context, p *proxy.Proxy) er
 }
 
 // UpdateProxyHeartbeat indicates an expected call of UpdateProxyHeartbeat.
-func (mr *MockStoreMockRecorder) UpdateProxyHeartbeat(ctx, p interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateProxyHeartbeat(ctx, p any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateProxyHeartbeat", reflect.TypeOf((*MockStore)(nil).UpdateProxyHeartbeat), ctx, p)
 }
 
 // UpdateService mocks base method.
-func (m *MockStore) UpdateService(ctx context.Context, service *service.Service) error {
+func (m *MockStore) UpdateService(ctx context.Context, arg1 *service.Service) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateService", ctx, service)
+	ret := m.ctrl.Call(m, "UpdateService", ctx, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // UpdateService indicates an expected call of UpdateService.
-func (mr *MockStoreMockRecorder) UpdateService(ctx, service interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateService(ctx, arg1 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateService", reflect.TypeOf((*MockStore)(nil).UpdateService), ctx, service)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateService", reflect.TypeOf((*MockStore)(nil).UpdateService), ctx, arg1)
 }
 
 // UpdateZone mocks base method.
@@ -3284,7 +4058,7 @@ func (m *MockStore) UpdateZone(ctx context.Context, zone *zones.Zone) error {
 }
 
 // UpdateZone indicates an expected call of UpdateZone.
-func (mr *MockStoreMockRecorder) UpdateZone(ctx, zone interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) UpdateZone(ctx, zone any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateZone", reflect.TypeOf((*MockStore)(nil).UpdateZone), ctx, zone)
 }
diff --git a/management/server/store/store_mock_agentnetwork.go b/management/server/store/store_mock_agentnetwork.go
deleted file mode 100644
index 18adf20f0..000000000
--- a/management/server/store/store_mock_agentnetwork.go
+++ /dev/null
@@ -1,495 +0,0 @@
-package store
-
-import (
-	context "context"
-	reflect "reflect"
-	time "time"
-
-	gomock "github.com/golang/mock/gomock"
-
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-)
-
-// GetAllAgentNetworkProviders mocks base method.
-func (m *MockStore) GetAllAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Provider, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAllAgentNetworkProviders", ctx, lockStrength)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Provider)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAllAgentNetworkProviders indicates an expected call of GetAllAgentNetworkProviders.
-func (mr *MockStoreMockRecorder) GetAllAgentNetworkProviders(ctx, lockStrength interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAgentNetworkProviders", reflect.TypeOf((*MockStore)(nil).GetAllAgentNetworkProviders), ctx, lockStrength)
-}
-
-// GetAgentNetworkMetrics mocks base method.
-func (m *MockStore) GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetrics, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkMetrics", ctx)
-	ret0, _ := ret[0].(AgentNetworkMetrics)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkMetrics indicates an expected call of GetAgentNetworkMetrics.
-func (mr *MockStoreMockRecorder) GetAgentNetworkMetrics(ctx interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkMetrics", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkMetrics), ctx)
-}
-
-// GetAccountAgentNetworkProviders mocks base method.
-func (m *MockStore) GetAccountAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Provider, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountAgentNetworkProviders", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Provider)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountAgentNetworkProviders indicates an expected call of GetAccountAgentNetworkProviders.
-func (mr *MockStoreMockRecorder) GetAccountAgentNetworkProviders(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkProviders", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkProviders), ctx, lockStrength, accountID)
-}
-
-// GetAgentNetworkProviderByID mocks base method.
-func (m *MockStore) GetAgentNetworkProviderByID(ctx context.Context, lockStrength LockingStrength, accountID, providerID string) (*agentNetworkTypes.Provider, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkProviderByID", ctx, lockStrength, accountID, providerID)
-	ret0, _ := ret[0].(*agentNetworkTypes.Provider)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkProviderByID indicates an expected call of GetAgentNetworkProviderByID.
-func (mr *MockStoreMockRecorder) GetAgentNetworkProviderByID(ctx, lockStrength, accountID, providerID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkProviderByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkProviderByID), ctx, lockStrength, accountID, providerID)
-}
-
-// SaveAgentNetworkProvider mocks base method.
-func (m *MockStore) SaveAgentNetworkProvider(ctx context.Context, provider *agentNetworkTypes.Provider) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveAgentNetworkProvider", ctx, provider)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveAgentNetworkProvider indicates an expected call of SaveAgentNetworkProvider.
-func (mr *MockStoreMockRecorder) SaveAgentNetworkProvider(ctx, provider interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkProvider", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkProvider), ctx, provider)
-}
-
-// DeleteAgentNetworkProvider mocks base method.
-func (m *MockStore) DeleteAgentNetworkProvider(ctx context.Context, accountID, providerID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAgentNetworkProvider", ctx, accountID, providerID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAgentNetworkProvider indicates an expected call of DeleteAgentNetworkProvider.
-func (mr *MockStoreMockRecorder) DeleteAgentNetworkProvider(ctx, accountID, providerID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkProvider", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkProvider), ctx, accountID, providerID)
-}
-
-// GetAccountAgentNetworkPolicies mocks base method.
-func (m *MockStore) GetAccountAgentNetworkPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Policy, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountAgentNetworkPolicies", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Policy)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountAgentNetworkPolicies indicates an expected call of GetAccountAgentNetworkPolicies.
-func (mr *MockStoreMockRecorder) GetAccountAgentNetworkPolicies(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkPolicies", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkPolicies), ctx, lockStrength, accountID)
-}
-
-// GetAgentNetworkPolicyByID mocks base method.
-func (m *MockStore) GetAgentNetworkPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*agentNetworkTypes.Policy, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkPolicyByID", ctx, lockStrength, accountID, policyID)
-	ret0, _ := ret[0].(*agentNetworkTypes.Policy)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkPolicyByID indicates an expected call of GetAgentNetworkPolicyByID.
-func (mr *MockStoreMockRecorder) GetAgentNetworkPolicyByID(ctx, lockStrength, accountID, policyID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkPolicyByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkPolicyByID), ctx, lockStrength, accountID, policyID)
-}
-
-// SaveAgentNetworkPolicy mocks base method.
-func (m *MockStore) SaveAgentNetworkPolicy(ctx context.Context, policy *agentNetworkTypes.Policy) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveAgentNetworkPolicy", ctx, policy)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveAgentNetworkPolicy indicates an expected call of SaveAgentNetworkPolicy.
-func (mr *MockStoreMockRecorder) SaveAgentNetworkPolicy(ctx, policy interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkPolicy", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkPolicy), ctx, policy)
-}
-
-// DeleteAgentNetworkPolicy mocks base method.
-func (m *MockStore) DeleteAgentNetworkPolicy(ctx context.Context, accountID, policyID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAgentNetworkPolicy", ctx, accountID, policyID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAgentNetworkPolicy indicates an expected call of DeleteAgentNetworkPolicy.
-func (mr *MockStoreMockRecorder) DeleteAgentNetworkPolicy(ctx, accountID, policyID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkPolicy", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkPolicy), ctx, accountID, policyID)
-}
-
-// GetAccountAgentNetworkGuardrails mocks base method.
-func (m *MockStore) GetAccountAgentNetworkGuardrails(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Guardrail, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountAgentNetworkGuardrails", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Guardrail)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountAgentNetworkGuardrails indicates an expected call of GetAccountAgentNetworkGuardrails.
-func (mr *MockStoreMockRecorder) GetAccountAgentNetworkGuardrails(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkGuardrails", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkGuardrails), ctx, lockStrength, accountID)
-}
-
-// GetAgentNetworkGuardrailByID mocks base method.
-func (m *MockStore) GetAgentNetworkGuardrailByID(ctx context.Context, lockStrength LockingStrength, accountID, guardrailID string) (*agentNetworkTypes.Guardrail, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkGuardrailByID", ctx, lockStrength, accountID, guardrailID)
-	ret0, _ := ret[0].(*agentNetworkTypes.Guardrail)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkGuardrailByID indicates an expected call of GetAgentNetworkGuardrailByID.
-func (mr *MockStoreMockRecorder) GetAgentNetworkGuardrailByID(ctx, lockStrength, accountID, guardrailID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkGuardrailByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkGuardrailByID), ctx, lockStrength, accountID, guardrailID)
-}
-
-// SaveAgentNetworkGuardrail mocks base method.
-func (m *MockStore) SaveAgentNetworkGuardrail(ctx context.Context, guardrail *agentNetworkTypes.Guardrail) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveAgentNetworkGuardrail", ctx, guardrail)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveAgentNetworkGuardrail indicates an expected call of SaveAgentNetworkGuardrail.
-func (mr *MockStoreMockRecorder) SaveAgentNetworkGuardrail(ctx, guardrail interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkGuardrail", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkGuardrail), ctx, guardrail)
-}
-
-// DeleteAgentNetworkGuardrail mocks base method.
-func (m *MockStore) DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAgentNetworkGuardrail", ctx, accountID, guardrailID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAgentNetworkGuardrail indicates an expected call of DeleteAgentNetworkGuardrail.
-func (mr *MockStoreMockRecorder) DeleteAgentNetworkGuardrail(ctx, accountID, guardrailID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkGuardrail", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkGuardrail), ctx, accountID, guardrailID)
-}
-
-// GetAgentNetworkSettings mocks base method.
-func (m *MockStore) GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*agentNetworkTypes.Settings, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkSettings", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].(*agentNetworkTypes.Settings)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkSettings indicates an expected call of GetAgentNetworkSettings.
-func (mr *MockStoreMockRecorder) GetAgentNetworkSettings(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettings), ctx, lockStrength, accountID)
-}
-
-// GetAgentNetworkSettingsByCluster mocks base method.
-func (m *MockStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByCluster", ctx, lockStrength, cluster)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Settings)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkSettingsByCluster indicates an expected call of GetAgentNetworkSettingsByCluster.
-func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByCluster(ctx, lockStrength, cluster interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByCluster", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByCluster), ctx, lockStrength, cluster)
-}
-
-// SaveAgentNetworkSettings mocks base method.
-func (m *MockStore) SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveAgentNetworkSettings", ctx, settings)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveAgentNetworkSettings indicates an expected call of SaveAgentNetworkSettings.
-func (mr *MockStoreMockRecorder) SaveAgentNetworkSettings(ctx, settings interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkSettings), ctx, settings)
-}
-
-// IncrementAgentNetworkConsumption mocks base method.
-func (m *MockStore) IncrementAgentNetworkConsumption(ctx context.Context, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time, tokensIn, tokensOut int64, costUSD float64) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "IncrementAgentNetworkConsumption", ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// IncrementAgentNetworkConsumption indicates an expected call of IncrementAgentNetworkConsumption.
-func (mr *MockStoreMockRecorder) IncrementAgentNetworkConsumption(ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).IncrementAgentNetworkConsumption), ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
-}
-
-// GetAgentNetworkConsumption mocks base method.
-func (m *MockStore) GetAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time) (*agentNetworkTypes.Consumption, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkConsumption", ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart)
-	ret0, _ := ret[0].(*agentNetworkTypes.Consumption)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkConsumption indicates an expected call of GetAgentNetworkConsumption.
-func (mr *MockStoreMockRecorder) GetAgentNetworkConsumption(ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkConsumption), ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart)
-}
-
-// GetAgentNetworkConsumptionBatch mocks base method.
-func (m *MockStore) GetAgentNetworkConsumptionBatch(ctx context.Context, lockStrength LockingStrength, accountID string, keys []agentNetworkTypes.ConsumptionKey) (map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkConsumptionBatch", ctx, lockStrength, accountID, keys)
-	ret0, _ := ret[0].(map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkConsumptionBatch indicates an expected call of GetAgentNetworkConsumptionBatch.
-func (mr *MockStoreMockRecorder) GetAgentNetworkConsumptionBatch(ctx, lockStrength, accountID, keys interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkConsumptionBatch", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkConsumptionBatch), ctx, lockStrength, accountID, keys)
-}
-
-// IncrementAgentNetworkConsumptionBatch mocks base method.
-func (m *MockStore) IncrementAgentNetworkConsumptionBatch(ctx context.Context, accountID string, keys []agentNetworkTypes.ConsumptionKey, tokensIn, tokensOut int64, costUSD float64) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "IncrementAgentNetworkConsumptionBatch", ctx, accountID, keys, tokensIn, tokensOut, costUSD)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// IncrementAgentNetworkConsumptionBatch indicates an expected call of IncrementAgentNetworkConsumptionBatch.
-func (mr *MockStoreMockRecorder) IncrementAgentNetworkConsumptionBatch(ctx, accountID, keys, tokensIn, tokensOut, costUSD interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementAgentNetworkConsumptionBatch", reflect.TypeOf((*MockStore)(nil).IncrementAgentNetworkConsumptionBatch), ctx, accountID, keys, tokensIn, tokensOut, costUSD)
-}
-
-// ListAgentNetworkConsumption mocks base method.
-func (m *MockStore) ListAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Consumption, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ListAgentNetworkConsumption", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Consumption)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// ListAgentNetworkConsumption indicates an expected call of ListAgentNetworkConsumption.
-func (mr *MockStoreMockRecorder) ListAgentNetworkConsumption(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).ListAgentNetworkConsumption), ctx, lockStrength, accountID)
-}
-
-// GetAccountAgentNetworkBudgetRules mocks base method.
-func (m *MockStore) GetAccountAgentNetworkBudgetRules(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.AccountBudgetRule, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountAgentNetworkBudgetRules", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*agentNetworkTypes.AccountBudgetRule)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountAgentNetworkBudgetRules indicates an expected call of GetAccountAgentNetworkBudgetRules.
-func (mr *MockStoreMockRecorder) GetAccountAgentNetworkBudgetRules(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkBudgetRules", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkBudgetRules), ctx, lockStrength, accountID)
-}
-
-// GetAgentNetworkBudgetRuleByID mocks base method.
-func (m *MockStore) GetAgentNetworkBudgetRuleByID(ctx context.Context, lockStrength LockingStrength, accountID, ruleID string) (*agentNetworkTypes.AccountBudgetRule, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkBudgetRuleByID", ctx, lockStrength, accountID, ruleID)
-	ret0, _ := ret[0].(*agentNetworkTypes.AccountBudgetRule)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkBudgetRuleByID indicates an expected call of GetAgentNetworkBudgetRuleByID.
-func (mr *MockStoreMockRecorder) GetAgentNetworkBudgetRuleByID(ctx, lockStrength, accountID, ruleID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkBudgetRuleByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkBudgetRuleByID), ctx, lockStrength, accountID, ruleID)
-}
-
-// SaveAgentNetworkBudgetRule mocks base method.
-func (m *MockStore) SaveAgentNetworkBudgetRule(ctx context.Context, rule *agentNetworkTypes.AccountBudgetRule) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveAgentNetworkBudgetRule", ctx, rule)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveAgentNetworkBudgetRule indicates an expected call of SaveAgentNetworkBudgetRule.
-func (mr *MockStoreMockRecorder) SaveAgentNetworkBudgetRule(ctx, rule interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkBudgetRule), ctx, rule)
-}
-
-// DeleteAgentNetworkBudgetRule mocks base method.
-func (m *MockStore) DeleteAgentNetworkBudgetRule(ctx context.Context, accountID, ruleID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAgentNetworkBudgetRule", ctx, accountID, ruleID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAgentNetworkBudgetRule indicates an expected call of DeleteAgentNetworkBudgetRule.
-func (mr *MockStoreMockRecorder) DeleteAgentNetworkBudgetRule(ctx, accountID, ruleID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkBudgetRule), ctx, accountID, ruleID)
-}
-
-// CreateAgentNetworkAccessLog mocks base method.
-func (m *MockStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateAgentNetworkAccessLog", ctx, entry, groups)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// CreateAgentNetworkAccessLog indicates an expected call of CreateAgentNetworkAccessLog.
-func (mr *MockStoreMockRecorder) CreateAgentNetworkAccessLog(ctx, entry, groups interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkAccessLog", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkAccessLog), ctx, entry, groups)
-}
-
-// CreateAgentNetworkUsage mocks base method.
-func (m *MockStore) CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateAgentNetworkUsage", ctx, usage, groups)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// CreateAgentNetworkUsage indicates an expected call of CreateAgentNetworkUsage.
-func (mr *MockStoreMockRecorder) CreateAgentNetworkUsage(ctx, usage, groups interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkUsage", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkUsage), ctx, usage, groups)
-}
-
-// GetAgentNetworkAccessLogs mocks base method.
-func (m *MockStore) GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLog, int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkAccessLogs", ctx, lockStrength, accountID, filter)
-	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkAccessLog)
-	ret1, _ := ret[1].(int64)
-	ret2, _ := ret[2].(error)
-	return ret0, ret1, ret2
-}
-
-// GetAgentNetworkAccessLogs indicates an expected call of GetAgentNetworkAccessLogs.
-func (mr *MockStoreMockRecorder) GetAgentNetworkAccessLogs(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkAccessLogs), ctx, lockStrength, accountID, filter)
-}
-
-// GetAgentNetworkAccessLogSessions mocks base method.
-func (m *MockStore) GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLogSession, int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkAccessLogSessions", ctx, lockStrength, accountID, filter)
-	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkAccessLogSession)
-	ret1, _ := ret[1].(int64)
-	ret2, _ := ret[2].(error)
-	return ret0, ret1, ret2
-}
-
-// GetAgentNetworkAccessLogSessions indicates an expected call of GetAgentNetworkAccessLogSessions.
-func (mr *MockStoreMockRecorder) GetAgentNetworkAccessLogSessions(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkAccessLogSessions", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkAccessLogSessions), ctx, lockStrength, accountID, filter)
-}
-
-// GetAgentNetworkUsageRows mocks base method.
-func (m *MockStore) GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkUsage, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkUsageRows", ctx, lockStrength, accountID, filter)
-	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkUsage)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkUsageRows indicates an expected call of GetAgentNetworkUsageRows.
-func (mr *MockStoreMockRecorder) GetAgentNetworkUsageRows(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkUsageRows", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkUsageRows), ctx, lockStrength, accountID, filter)
-}
-
-// DeleteOldAgentNetworkAccessLogs mocks base method.
-func (m *MockStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteOldAgentNetworkAccessLogs", ctx, accountID, olderThan)
-	ret0, _ := ret[0].(int64)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// DeleteOldAgentNetworkAccessLogs indicates an expected call of DeleteOldAgentNetworkAccessLogs.
-func (mr *MockStoreMockRecorder) DeleteOldAgentNetworkAccessLogs(ctx, accountID, olderThan interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOldAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).DeleteOldAgentNetworkAccessLogs), ctx, accountID, olderThan)
-}
-
-// GetAllAgentNetworkSettings mocks base method.
-func (m *MockStore) GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Settings, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAllAgentNetworkSettings", ctx, lockStrength)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Settings)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAllAgentNetworkSettings indicates an expected call of GetAllAgentNetworkSettings.
-func (mr *MockStoreMockRecorder) GetAllAgentNetworkSettings(ctx, lockStrength interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAllAgentNetworkSettings), ctx, lockStrength)
-}
diff --git a/management/server/telemetry/updatechannel_metrics.go b/management/server/telemetry/updatechannel_metrics.go
index 2b280b352..ade46be59 100644
--- a/management/server/telemetry/updatechannel_metrics.go
+++ b/management/server/telemetry/updatechannel_metrics.go
@@ -10,19 +10,20 @@ import (
 
 // UpdateChannelMetrics represents all metrics related to the UpdateChannel
 type UpdateChannelMetrics struct {
-	createChannelDurationMicro        metric.Int64Histogram
-	closeChannelDurationMicro         metric.Int64Histogram
-	closeChannelsDurationMicro        metric.Int64Histogram
-	closeChannels                     metric.Int64Histogram
-	sendUpdateDurationMicro           metric.Int64Histogram
-	getAllConnectedPeersDurationMicro metric.Int64Histogram
-	getAllConnectedPeers              metric.Int64Histogram
-	hasChannelDurationMicro           metric.Int64Histogram
-	calcPostureChecksDurationMicro    metric.Int64Histogram
-	calcPeerNetworkMapDurationMs      metric.Int64Histogram
-	mergeNetworkMapDurationMicro      metric.Int64Histogram
-	toSyncResponseDurationMicro       metric.Int64Histogram
-	ctx                               context.Context
+	createChannelDurationMicro           metric.Int64Histogram
+	closeChannelDurationMicro            metric.Int64Histogram
+	closeChannelsDurationMicro           metric.Int64Histogram
+	closeChannels                        metric.Int64Histogram
+	sendUpdateDurationMicro              metric.Int64Histogram
+	getAllConnectedPeersDurationMicro    metric.Int64Histogram
+	getAllConnectedPeers                 metric.Int64Histogram
+	hasChannelDurationMicro              metric.Int64Histogram
+	calcPostureChecksDurationMicro       metric.Int64Histogram
+	calcPeerNetworkMapDurationMs         metric.Int64Histogram
+	mergeNetworkMapDurationMicro         metric.Int64Histogram
+	toSyncResponseDurationMicro          metric.Int64Histogram
+	toComponentSyncResponseDurationMicro metric.Int64Histogram
+	ctx                                  context.Context
 }
 
 // NewUpdateChannelMetrics creates an instance of UpdateChannel
@@ -125,20 +126,29 @@ func NewUpdateChannelMetrics(ctx context.Context, meter metric.Meter) (*UpdateCh
 		return nil, err
 	}
 
+	toComponentSyncResponseDurationMicro, err := meter.Int64Histogram("management.updatechannel.tocomponentsyncresponse.duration.micro",
+		metric.WithUnit("microseconds"),
+		metric.WithDescription("Duration of how long it takes to convert components to component sync response"),
+	)
+	if err != nil {
+		return nil, err
+	}
+
 	return &UpdateChannelMetrics{
-		createChannelDurationMicro:        createChannelDurationMicro,
-		closeChannelDurationMicro:         closeChannelDurationMicro,
-		closeChannelsDurationMicro:        closeChannelsDurationMicro,
-		closeChannels:                     closeChannels,
-		sendUpdateDurationMicro:           sendUpdateDurationMicro,
-		getAllConnectedPeersDurationMicro: getAllConnectedPeersDurationMicro,
-		getAllConnectedPeers:              getAllConnectedPeers,
-		hasChannelDurationMicro:           hasChannelDurationMicro,
-		calcPostureChecksDurationMicro:    calcPostureChecksDurationMicro,
-		calcPeerNetworkMapDurationMs:      calcPeerNetworkMapDurationMs,
-		mergeNetworkMapDurationMicro:      mergeNetworkMapDurationMicro,
-		toSyncResponseDurationMicro:       toSyncResponseDurationMicro,
-		ctx:                               ctx,
+		createChannelDurationMicro:           createChannelDurationMicro,
+		closeChannelDurationMicro:            closeChannelDurationMicro,
+		closeChannelsDurationMicro:           closeChannelsDurationMicro,
+		closeChannels:                        closeChannels,
+		sendUpdateDurationMicro:              sendUpdateDurationMicro,
+		getAllConnectedPeersDurationMicro:    getAllConnectedPeersDurationMicro,
+		getAllConnectedPeers:                 getAllConnectedPeers,
+		hasChannelDurationMicro:              hasChannelDurationMicro,
+		calcPostureChecksDurationMicro:       calcPostureChecksDurationMicro,
+		calcPeerNetworkMapDurationMs:         calcPeerNetworkMapDurationMs,
+		mergeNetworkMapDurationMicro:         mergeNetworkMapDurationMicro,
+		toSyncResponseDurationMicro:          toSyncResponseDurationMicro,
+		toComponentSyncResponseDurationMicro: toComponentSyncResponseDurationMicro,
+		ctx:                                  ctx,
 	}, nil
 }
 
@@ -193,3 +203,7 @@ func (metrics *UpdateChannelMetrics) CountMergeNetworkMapDuration(duration time.
 func (metrics *UpdateChannelMetrics) CountToSyncResponseDuration(duration time.Duration) {
 	metrics.toSyncResponseDurationMicro.Record(metrics.ctx, duration.Microseconds())
 }
+
+func (metrics *UpdateChannelMetrics) CountToComponentSyncResponseDuration(duration time.Duration) {
+	metrics.toComponentSyncResponseDurationMicro.Record(metrics.ctx, duration.Microseconds())
+}
diff --git a/management/server/testdata/peers_pagination.sql b/management/server/testdata/peers_pagination.sql
new file mode 100644
index 000000000..12e7d9d40
--- /dev/null
+++ b/management/server/testdata/peers_pagination.sql
@@ -0,0 +1,112 @@
+insert into accounts (id, domain, network_identifier, network_net, network_net_v6, network_dns, network_serial,dns_settings_disabled_management_groups,
+                      settings_peer_login_expiration_enabled, settings_peer_login_expiration, settings_peer_inactivity_expiration_enabled,
+                      settings_peer_inactivity_expiration, settings_dns_domain, settings_ipv6_enabled_groups, settings_routing_peer_dns_resolution_enabled,
+                      settings_lazy_connection_enabled, settings_auto_update_version, settings_auto_update_always, settings_metrics_push_enabled)
+VALUES('account-1','account-1-test.com','network-1','{"IP":"100.103.0.0","Mask":"//8AAA=="}','{"IP":"fdde:e995:fd38:a465::","Mask":"//////////8AAAAAAAAAAA=="}','',1,'["disabled-group-1","disabled-group-2"]',
+       true, 86400000000000, false,
+       86400000000000, null, '["group-one-resource-id"]', false,
+       false, 'disabled', false, false);
+insert into accounts (id, domain,network_identifier, network_net, network_net_v6, network_dns, network_serial,dns_settings_disabled_management_groups,
+                      settings_peer_login_expiration_enabled, settings_peer_login_expiration, settings_peer_inactivity_expiration_enabled,
+                      settings_peer_inactivity_expiration, settings_dns_domain, settings_ipv6_enabled_groups, settings_routing_peer_dns_resolution_enabled,
+                      settings_lazy_connection_enabled, settings_auto_update_version, settings_auto_update_always, settings_metrics_push_enabled)
+VALUES('account-2','account-2-test.com','network-2','{"IP":"110.0.0.0","Mask":"//8AAA=="}','{"IP":"fddf:e995:fd38:a465::","Mask":"//////////8AAAAAAAAAAA=="}','',2,null,
+       true, 86400000000000, false,
+       86400000000000, null, '["group-two-resources-id"]', false,
+       false, 'disabled', false, false);
+insert into "groups" (id, account_id, name, resources, public_id) VALUES('group-one-resource-id','account-1','group-1-name', '[{"ID":"host-id-1","Type":"host"}]','group-one-resource-id-public');
+insert into "groups" (id, account_id, name, resources, public_id) VALUES('group-two-resources-id','account-1','group-2-name', '[{"ID":"subnet-id-1","Type":"subnet"}, {"ID":"host-id-2","Type":"host"}]','group-two-resources-id-public');
+insert into "groups" (id, account_id, name, resources, public_id) VALUES('group-no-resources-id','account-1','group-3-name', null,'group-no-resources-id-public');
+insert into group_peers (account_id, peer_id, group_id) VALUES('account-1','peer-id-one','group-one-resource-id');
+insert into group_peers (account_id, peer_id, group_id) VALUES('account-1','peer-id-one','group-two-resources-id');
+insert into group_peers (account_id, peer_id, group_id) VALUES('account-1','peer-id-two','group-two-resources-id');
+insert into group_peers (account_id, peer_id, group_id) VALUES('account-1','peer-id-three','group-no-resources-id');
+insert into peers (id, account_id, "key", ssh_key, name, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, peer_status_last_seen, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+                   meta_hostname,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-one','account-1','key-1','ssh-key-1','Peer-1-name','peer-1','["extra-peer-1"]','user-id-1',true,true,'2026-08-06 13:25:59.12999','"10.10.10.1"','"fdf4:ba80:6aa5:89f1:44d7:8701:8677:4940"',
+                   false,true,false,'2026-08-06 13:25:59.12999','cluster-1.netbird.services',
+                   '0.76.0','linux','26.4.1','6.8.0-134-generic','[{"NetIP":"fe80::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ac"},{"NetIP":"192.168.16.1/20","Mac":"00:15:5d:24:0c:ac"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'peer-one-name.local', 'DE','Berlin','"46.201.148.187"');
+insert into peers (id,account_id,"key", ssh_key, name, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, peer_status_last_seen, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+                   meta_hostname,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-two','account-1','key-2','ssh-key-2','peer-2-name','peer-2','["extra-peer-2"]','user-id-2',true,true,'2026-08-06 14:25:59.12999','"10.10.100.1"','"fdf5:ba80:6aa5:89f1:44d7:8701:8698:4940"',
+                   true,true,false,'2026-08-06 12:25:59.12999','cluster-2.netbird.services',
+                   '0.76.1','ios','26.4.2','6.8.0-135-generic','[{"NetIP":"fe81::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ad"},{"NetIP":"192.168.17.1/20","Mac":"00:15:5d:24:0c:ad"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',0,
+                   'peer-two-name.local', 'DE','Berlin','"46.201.149.187"');
+insert into peers (id,account_id,"key", ssh_key, name, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, peer_status_last_seen, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses,
+                   meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version, meta_hostname,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-three','account-1','key-3','ssh-key-3','peer-3-name','peer-3','["extra-peer-3"]','user-id-3',true,true,'2026-08-06 12:25:59.12999','"10.10.200.1"','"fdf6:ba80:6aa5:89f1:44d7:8701:8699:4940"',
+                   true,false,false,'2026-08-06 11:25:59.12999','cluster-3.netbird.services',
+                   '0.76.3','windows','26.4.3','6.8.0-136-generic','[{"NetIP":"fe82::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ae"},{"NetIP":"192.168.18.1/20","Mac":"00:15:5d:24:0c:ae"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'peer-three-name.local','DE','Berlin','"46.201.150.187"');
+insert into peers (id,account_id,"key", ssh_key, name, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, peer_status_last_seen, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+                   meta_hostname,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-four','account-1','key-4','ssh-key-4','peer-4-name','peer-4','["extra-peer-4"]','',true,true,'2026-08-06 12:25:59.12999','"10.10.20.1"','"fdf6:ba80:6aa5:89f1:44d7:8701:8669:4940"',
+                   false,false,false,'2026-08-06 07:25:59.12999','cluster-4.netbird.services',
+                   '0.76.2','linux','26.4.3','6.8.0-136-generic','[{"NetIP":"fe82::8b4c:973f:a76b:3771/64","Mac":"00:15:7d:44:0c:ae"},{"NetIP":"192.168.18.1/20","Mac":"00:15:6d:34:0c:ae"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'peer-four-name.local','DE','Berlin','"46.201.150.187"');
+insert into peers (id,account_id,"key", ssh_key, name, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, peer_status_last_seen, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+                   meta_hostname,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-five','account-1','key-5','ssh-key-5','peer-5-name','peer-5','["extra-peer-5"]','',true,true,'2026-08-06 12:25:59.12999','"10.10.9.2"','"fdf6:ba80:6aa5:89f1:44d7:8701:8669:4941"',
+                   false,false,false,'2026-08-06 09:25:59.12999','cluster-4.netbird.services',
+                   '0.78.2','linux','26.4.3','6.8.0-136-generic','[{"NetIP":"fe82::8b4c:973f:a76b:3771/64","Mac":"00:15:7d:44:0c:ae"},{"NetIP":"192.168.18.1/20","Mac":"00:15:6d:34:0c:ae"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'peer-five-name.local','DE','Berlin','"46.201.150.187"');
+insert into peers (id,account_id,"key", ssh_key, name, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, peer_status_last_seen, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+                   meta_hostname,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-six','account-1','key-6','ssh-key-6','peer-6-name','peer-6','["extra-peer-6"]','',true,true,'2026-08-06 12:25:59.12999','"10.10.8.3"','"fdf6:ba80:6aa5:89f1:44d7:8701:8669:4942"',
+                   false,false,false,'2026-08-06 03:25:59.12999','cluster-4.netbird.services',
+                   '0.77.2','linux','26.4.3','6.8.0-136-generic','[{"NetIP":"fe82::8b4c:973f:a76b:3771/64","Mac":"00:15:7d:44:0c:ae"},{"NetIP":"192.168.18.1/20","Mac":"00:15:6d:34:0c:ae"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'peer-six-name.local','DE','Berlin','"46.201.150.187"');
+              --      peer-id-8 should never appear in any of the results, as we are filtering out proxy peers
+insert into peers (id,account_id,"key", ssh_key, name, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, peer_status_last_seen, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+                   meta_hostname,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-8','account-1','key-8','ssh-key-8','peer-8-name','peer-8','["extra-peer-8"]','',true,true,'2026-08-06 12:25:59.12999','"10.10.88.3"','"fdf6:ba80:6aa5:89f1:44d7:8701:8669:4943"',
+                   false,false,true,'2026-08-06 03:25:59.12999','cluster-4.netbird.services',
+                   '0.77.2','linux','26.4.3','6.8.0-136-generic','[{"NetIP":"fe82::8b4c:973f:a76b:3771/64","Mac":"00:15:7d:44:0c:ae"},{"NetIP":"192.168.18.1/20","Mac":"00:15:6d:34:0c:ae"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'peer-eight-name.local','DE','Berlin','"46.201.150.187"');
+insert into peers (id,account_id,"key", ssh_key, name, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
+	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, peer_status_last_seen, proxy_meta_cluster,
+	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
+                   meta_capabilities, meta_flags, meta_sync_message_version,
+                   meta_hostname,
+	            location_country_code, location_city_name, location_connection_ip)
+            values('peer-id-7','account-2','key-7','ssh-key-7','peer-7-name','peer-7','["extra-peer-7"]','',true,true,'2026-08-06 12:25:59.12999','"10.10.8.3"','"fdf6:ba80:6aa5:89f1:44d7:8701:8669:4942"',
+                   false,false,false,'2026-08-06 03:25:59.12999','cluster-4.netbird.services',
+                   '0.77.2','linux','26.4.3','6.8.0-136-generic','[{"NetIP":"fe82::8b4c:973f:a76b:3771/64","Mac":"00:15:7d:44:0c:ae"},{"NetIP":"192.168.18.1/20","Mac":"00:15:6d:34:0c:ae"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
+                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
+                   'peer-seven-name.local','DE','Berlin','"46.201.150.187"');
diff --git a/management/server/testutil/store.go b/management/server/testutil/store.go
index 07699e2c3..3854c1173 100644
--- a/management/server/testutil/store.go
+++ b/management/server/testutil/store.go
@@ -37,6 +37,18 @@ func CreateMysqlTestContainer() (func(), string, error) {
 		mysql.WithDatabase("testing"),
 		mysql.WithUsername("root"),
 		mysql.WithPassword("testing"),
+		// Every test creates and drops a database with about 40 tables, so with
+		// the server defaults the run is dominated by durability work: each
+		// CREATE TABLE fsyncs the redo log, the binary log and the doublewrite
+		// buffer. None of it protects anything in a container that is discarded
+		// after the run. Tables stay in per-table files on purpose: in the shared
+		// system tablespace the cost of every CREATE and DROP grew with the number
+		// of databases the run had already created.
+		testcontainers.WithCmd("mysqld",
+			"--innodb-flush-log-at-trx-commit=0",
+			"--innodb-doublewrite=OFF",
+			"--skip-log-bin",
+		),
 		testcontainers.WithWaitStrategy(
 			wait.ForLog("/usr/sbin/mysqld: ready for connections").
 				WithOccurrence(1).WithStartupTimeout(15*time.Second).WithPollInterval(100*time.Millisecond),
diff --git a/management/server/types/account.go b/management/server/types/account.go
index 7a0a0054f..d0688d1ee 100644
--- a/management/server/types/account.go
+++ b/management/server/types/account.go
@@ -9,7 +9,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/hashicorp/go-multierror"
 	"github.com/miekg/dns"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
@@ -18,8 +17,6 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	proxydomain "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
-	"github.com/netbirdio/netbird/management/internals/modules/zones"
-	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -28,12 +25,12 @@ import (
 	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/status"
-	"github.com/netbirdio/netbird/version"
 )
 
 const (
-	defaultTTL = 300
 	// privateServiceDNSRecordTTL is short so proxy-peer changes propagate quickly to clients.
 	privateServiceDNSRecordTTL      = 5
 	DefaultPeerLoginExpiration      = 24 * time.Hour
@@ -42,27 +39,8 @@ const (
 	PublicCategory  = "public"
 	PrivateCategory = "private"
 	UnknownCategory = "unknown"
-
-	// firewallRuleMinPortRangesVer defines the minimum peer version that supports port range rules.
-	firewallRuleMinPortRangesVer = "0.48.0"
-	// firewallRuleMinNativeSSHVer defines the minimum peer version that supports native SSH features in the firewall rules.
-	firewallRuleMinNativeSSHVer = "0.60.0"
-
-	// nativeSSHPortString defines the default port number as a string used for native SSH connections; this port is used by clients when hijacking ssh connections.
-	nativeSSHPortString = "22022"
-	nativeSSHPortNumber = 22022
-	// defaultSSHPortString defines the standard SSH port number as a string, commonly used for default SSH connections.
-	defaultSSHPortString = "22"
-	defaultSSHPortNumber = 22
 )
 
-type supportedFeatures struct {
-	nativeSSH  bool
-	portRanges bool
-}
-
-type LookupMap map[string]struct{}
-
 // AccountMeta is a struct that contains a stripped down version of the Account object.
 // It doesn't carry any peers, groups, policies, or routes, etc. Just some metadata (e.g. ID, created by, created at, etc).
 type AccountMeta struct {
@@ -111,6 +89,8 @@ type Account struct {
 	Onboarding       AccountOnboarding                `gorm:"foreignKey:AccountID;references:id;constraint:OnDelete:CASCADE"`
 
 	ReverseProxyFreeDomainNonce string
+
+	PostureValidation map[string]map[string]bool `gorm:"-"`
 }
 
 // this class is used by gorm only
@@ -303,9 +283,10 @@ func (a *Account) SynthesizePrivateServiceZones(peerID string) []nbdns.CustomZon
 			// it, adding a single private service would black-hole every
 			// other name under the zone apex.
 			zone = &nbdns.CustomZone{
-				Domain:           dns.Fqdn(serviceDomainZone),
-				Records:          []nbdns.SimpleRecord{},
-				NonAuthoritative: true,
+				Domain:               dns.Fqdn(serviceDomainZone),
+				Records:              []nbdns.SimpleRecord{},
+				NonAuthoritative:     true,
+				SearchDomainDisabled: true,
 			}
 			zonesByApex[serviceDomainZone] = zone
 		}
@@ -401,94 +382,11 @@ func peerInDistributionGroups(peerGroups LookupMap, distributionGroups []string)
 }
 
 func (a *Account) GetPeersCustomZone(ctx context.Context, dnsDomain string) nbdns.CustomZone {
-	var merr *multierror.Error
-
-	if dnsDomain == "" {
-		log.WithContext(ctx).Error("no dns domain is set, returning empty zone")
-		return nbdns.CustomZone{}
+	twins := make(map[string]*nmdata.Peer, len(a.Peers))
+	for id, p := range a.Peers {
+		twins[id] = twinPeer(p)
 	}
-
-	customZone := nbdns.CustomZone{
-		Domain:  dns.Fqdn(dnsDomain),
-		Records: make([]nbdns.SimpleRecord, 0, len(a.Peers)),
-	}
-
-	domainSuffix := "." + dnsDomain
-
-	ipv6AllowedPeers := a.peerIPv6AllowedSet()
-
-	var sb strings.Builder
-	for _, peer := range a.Peers {
-		if peer.DNSLabel == "" {
-			merr = multierror.Append(merr, fmt.Errorf("peer %s has an empty DNS label", peer.Name))
-			continue
-		}
-
-		sb.Grow(len(peer.DNSLabel) + len(domainSuffix))
-		sb.WriteString(peer.DNSLabel)
-		sb.WriteString(domainSuffix)
-
-		fqdn := sb.String()
-		customZone.Records = append(customZone.Records, nbdns.SimpleRecord{
-			Name:  fqdn,
-			Type:  int(dns.TypeA),
-			Class: nbdns.DefaultClass,
-			TTL:   defaultTTL,
-			RData: peer.IP.String(),
-		})
-		// Only advertise AAAA for peers that have a valid IPv6, whose client supports it,
-		// and that belong to an IPv6-enabled group. Old clients don't configure v6 on their
-		// WireGuard interface, so resolving their AAAA causes connections to hang.
-		// Capability changes (client upgrade/downgrade, --disable-ipv6 toggle) propagate
-		// to other peers via SyncPeer/LoginPeer regardless of version change, so AAAA
-		// records refresh when a peer first reports the IPv6 overlay capability.
-		_, peerAllowed := ipv6AllowedPeers[peer.ID]
-		hasIPv6 := peer.IPv6.IsValid() && peer.SupportsIPv6() && peerAllowed
-		if hasIPv6 {
-			customZone.Records = append(customZone.Records, nbdns.SimpleRecord{
-				Name:  fqdn,
-				Type:  int(dns.TypeAAAA),
-				Class: nbdns.DefaultClass,
-				TTL:   defaultTTL,
-				RData: peer.IPv6.String(),
-			})
-		}
-		sb.Reset()
-
-		for _, extraLabel := range peer.ExtraDNSLabels {
-			sb.Grow(len(extraLabel) + len(domainSuffix))
-			sb.WriteString(extraLabel)
-			sb.WriteString(domainSuffix)
-
-			extraFqdn := sb.String()
-			customZone.Records = append(customZone.Records, nbdns.SimpleRecord{
-				Name:  extraFqdn,
-				Type:  int(dns.TypeA),
-				Class: nbdns.DefaultClass,
-				TTL:   defaultTTL,
-				RData: peer.IP.String(),
-			})
-			if hasIPv6 {
-				customZone.Records = append(customZone.Records, nbdns.SimpleRecord{
-					Name:  extraFqdn,
-					Type:  int(dns.TypeAAAA),
-					Class: nbdns.DefaultClass,
-					TTL:   defaultTTL,
-					RData: peer.IPv6.String(),
-				})
-			}
-			sb.Reset()
-		}
-
-	}
-
-	go func() {
-		if merr != nil {
-			log.WithContext(ctx).Errorf("error generating custom zone for account %s: %v", a.Id, merr)
-		}
-	}()
-
-	return customZone
+	return fromTwinCustomZone(networkmap.PeersCustomZone(ctx, a.Id, dnsDomain, twins, a.peerIPv6AllowedSet()))
 }
 
 // GetExpiredPeers returns peers that have been expired
@@ -506,7 +404,7 @@ func (a *Account) GetExpiredPeers() []*nbpeer.Peer {
 
 // GetNextPeerExpiration returns the minimum duration in which the next peer of the account will expire if it was found.
 // If there is no peer that expires this function returns false and a duration of 0.
-// This function only considers peers that haven't been expired yet and that are connected.
+// This function only considers peers that haven't been expired yet, whether connected or not.
 func (a *Account) GetNextPeerExpiration() (time.Duration, bool) {
 	peersWithExpiry := a.GetPeersWithExpiration()
 	if len(peersWithExpiry) == 0 {
@@ -514,8 +412,7 @@ func (a *Account) GetNextPeerExpiration() (time.Duration, bool) {
 	}
 	var nextExpiry *time.Duration
 	for _, peer := range peersWithExpiry {
-		// consider only connected peers because others will require login on connecting to the management server
-		if peer.Status.LoginExpired || !peer.Status.Connected {
+		if peer.Status.LoginExpired {
 			continue
 		}
 		_, duration := peer.LoginExpired(a.Settings.PeerLoginExpiration)
@@ -893,6 +790,7 @@ func (a *Account) Copy() *Account {
 		Services:               services,
 		Onboarding:             a.Onboarding,
 		Domains:                domains,
+		PostureValidation:      a.PostureValidation,
 	}
 }
 
@@ -1010,13 +908,13 @@ func (a *Account) GetPeerConnectionResources(ctx context.Context, peer *nbpeer.P
 			var peerInSources, peerInDestinations bool
 
 			if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
-				sourcePeers, peerInSources = a.getPeerFromResource(rule.SourceResource, peer.ID)
+				sourcePeers, peerInSources = a.getPeerFromResource(ctx, rule.SourceResource, peer.ID, policy.SourcePostureChecks, validatedPeersMap)
 			} else {
 				sourcePeers, peerInSources = a.getAllPeersFromGroups(ctx, rule.Sources, peer.ID, policy.SourcePostureChecks, validatedPeersMap)
 			}
 
 			if rule.DestinationResource.Type == ResourceTypePeer && rule.DestinationResource.ID != "" {
-				destinationPeers, peerInDestinations = a.getPeerFromResource(rule.DestinationResource, peer.ID)
+				destinationPeers, peerInDestinations = a.getPeerFromResource(ctx, rule.DestinationResource, peer.ID, nil, validatedPeersMap)
 			} else {
 				destinationPeers, peerInDestinations = a.getAllPeersFromGroups(ctx, rule.Destinations, peer.ID, nil, validatedPeersMap)
 			}
@@ -1070,7 +968,7 @@ func (a *Account) GetPeerConnectionResources(ctx context.Context, peer *nbpeer.P
 				default:
 					authorizedUsers[auth.Wildcard] = a.getAllowedUserIDs()
 				}
-			} else if peerInDestinations && policyRuleImpliesLegacySSH(rule) && peer.SSHEnabled {
+			} else if peerInDestinations && PolicyRuleImpliesLegacySSH(rule) && peer.SSHEnabled {
 				sshEnabled = true
 				authorizedUsers[auth.Wildcard] = a.getAllowedUserIDs()
 			}
@@ -1081,6 +979,26 @@ func (a *Account) GetPeerConnectionResources(ctx context.Context, peer *nbpeer.P
 	return peers, fwRules, authorizedUsers, sshEnabled
 }
 
+// proxyTargetedDomainResourceIDs returns the set of domain network resource IDs
+// targeted by an enabled, non-terminated reverse-proxy service.
+func (a *Account) proxyTargetedDomainResourceIDs() map[string]struct{} {
+	ids := make(map[string]struct{})
+	for _, svc := range a.Services {
+		if svc == nil || !svc.Enabled || svc.Terminated {
+			continue
+		}
+		for _, target := range svc.Targets {
+			if target == nil || !target.Enabled {
+				continue
+			}
+			if target.TargetType == service.TargetTypeDomain {
+				ids[target.TargetId] = struct{}{}
+			}
+		}
+	}
+	return ids
+}
+
 func (a *Account) getAllowedUserIDs() map[string]struct{} {
 	users := make(map[string]struct{})
 	for _, nbUser := range a.Users {
@@ -1136,15 +1054,15 @@ func (a *Account) connResourcesGenerator(ctx context.Context, targetPeer *nbpeer
 				if len(rule.Ports) == 0 && len(rule.PortRanges) == 0 {
 					rules = append(rules, &fr)
 				} else {
-					rules = append(rules, expandPortsAndRanges(fr, rule, targetPeer)...)
+					rules = append(rules, ExpandPortsAndRanges(fr, rule, targetPeer)...)
 				}
 
-				rules = appendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, firewallRuleContext{
-					direction:   direction,
-					dirStr:      strconv.Itoa(direction),
-					protocolStr: string(protocol),
-					actionStr:   string(rule.Action),
-					portsJoined: strings.Join(rule.Ports, ","),
+				rules = AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, FirewallRuleContext{
+					Direction:   direction,
+					DirStr:      strconv.Itoa(direction),
+					ProtocolStr: string(protocol),
+					ActionStr:   string(rule.Action),
+					PortsJoined: strings.Join(rule.Ports, ","),
 				})
 			}
 		}, func() ([]*nbpeer.Peer, []*FirewallRule) {
@@ -1152,10 +1070,6 @@ func (a *Account) connResourcesGenerator(ctx context.Context, targetPeer *nbpeer
 		}
 }
 
-func policyRuleImpliesLegacySSH(rule *PolicyRule) bool {
-	return rule.Protocol == PolicyRuleProtocolALL || (rule.Protocol == PolicyRuleProtocolTCP && (portsIncludesSSH(rule.Ports) || portRangeIncludesSSH(rule.PortRanges)))
-}
-
 // PeerSSHEnabledFromPolicies is the network-map-free equivalent of the sshEnabled
 // determination in GetPeerConnectionResources / CalculateNetworkMapFromComponents.
 func PeerSSHEnabledFromPolicies(policies []*Policy, peerID string, peerGroupIDs map[string]struct{}, peerSSHEnabled bool) bool {
@@ -1170,7 +1084,7 @@ func PeerSSHEnabledFromPolicies(policies []*Policy, peerID string, peerGroupIDs
 			}
 
 			isSSHRule := rule.Protocol == PolicyRuleProtocolNetbirdSSH ||
-				(policyRuleImpliesLegacySSH(rule) && peerSSHEnabled)
+				(PolicyRuleImpliesLegacySSH(rule) && peerSSHEnabled)
 			if !isSSHRule {
 				continue
 			}
@@ -1197,24 +1111,6 @@ func ruleHasDestination(rule *PolicyRule, peerID string, peerGroupIDs map[string
 	return false
 }
 
-func portRangeIncludesSSH(portRanges []RulePortRange) bool {
-	for _, pr := range portRanges {
-		if (pr.Start <= defaultSSHPortNumber && pr.End >= defaultSSHPortNumber) || (pr.Start <= nativeSSHPortNumber && pr.End >= nativeSSHPortNumber) {
-			return true
-		}
-	}
-	return false
-}
-
-func portsIncludesSSH(ports []string) bool {
-	for _, port := range ports {
-		if port == defaultSSHPortString || port == nativeSSHPortString {
-			return true
-		}
-	}
-	return false
-}
-
 // getAllPeersFromGroups for given peer ID and list of groups
 //
 // Returns a list of peers from specified groups that pass specified posture checks
@@ -1223,8 +1119,17 @@ func portsIncludesSSH(ports []string) bool {
 // Important: Posture checks are applicable only to source group peers,
 // for destination group peers, call this method with an empty list of sourcePostureChecksIDs
 func (a *Account) getAllPeersFromGroups(ctx context.Context, groups []string, peerID string, sourcePostureChecksIDs []string, validatedPeersMap map[string]struct{}) ([]*nbpeer.Peer, bool) {
+	return a.filterPolicyPeers(ctx, a.getUniquePeerIDsFromGroupsIDs(ctx, groups), peerID, sourcePostureChecksIDs, validatedPeersMap)
+}
+
+// getPeerFromResource resolves a rule side that names a peer directly, admitting it
+// like a member of a group holding only that peer.
+func (a *Account) getPeerFromResource(ctx context.Context, resource Resource, peerID string, sourcePostureChecksIDs []string, validatedPeersMap map[string]struct{}) ([]*nbpeer.Peer, bool) {
+	return a.filterPolicyPeers(ctx, []string{resource.ID}, peerID, sourcePostureChecksIDs, validatedPeersMap)
+}
+
+func (a *Account) filterPolicyPeers(ctx context.Context, uniquePeerIDs []string, peerID string, sourcePostureChecksIDs []string, validatedPeersMap map[string]struct{}) ([]*nbpeer.Peer, bool) {
 	peerInGroups := false
-	uniquePeerIDs := a.getUniquePeerIDsFromGroupsIDs(ctx, groups)
 	filteredPeers := make([]*nbpeer.Peer, 0, len(uniquePeerIDs))
 	for _, p := range uniquePeerIDs {
 		peer, ok := a.Peers[p]
@@ -1253,19 +1158,6 @@ func (a *Account) getAllPeersFromGroups(ctx context.Context, groups []string, pe
 	return filteredPeers, peerInGroups
 }
 
-func (a *Account) getPeerFromResource(resource Resource, peerID string) ([]*nbpeer.Peer, bool) {
-	peer := a.GetPeer(resource.ID)
-	if peer == nil {
-		return []*nbpeer.Peer{}, false
-	}
-
-	if peer.ID == peerID {
-		return []*nbpeer.Peer{}, true
-	}
-
-	return []*nbpeer.Peer{peer}, false
-}
-
 // validatePostureChecksOnPeer validates the posture checks on a peer
 func (a *Account) validatePostureChecksOnPeer(ctx context.Context, sourcePostureChecksID []string, peerID string) bool {
 	peer, ok := a.Peers[peerID]
@@ -1314,7 +1206,7 @@ func (a *Account) getRouteFirewallRules(ctx context.Context, peerID string, poli
 			}
 
 			rulePeers := a.getRulePeers(rule, policy.SourcePostureChecks, peerID, distributionPeers, validatedPeersMap)
-			rules := generateRouteFirewallRules(ctx, route, rule, rulePeers, FirewallRuleDirectionIN, includeIPv6)
+			rules := GenerateRouteFirewallRules(ctx, route, rule, rulePeers, FirewallRuleDirectionIN, includeIPv6)
 			fwRules = append(fwRules, rules...)
 		}
 	}
@@ -1657,246 +1549,6 @@ func (a *Account) GetProxyPeers() map[string][]*nbpeer.Peer {
 	return proxyPeers
 }
 
-func (a *Account) InjectProxyPolicies(ctx context.Context) {
-	if len(a.Services) == 0 {
-		return
-	}
-
-	proxyPeersByCluster := a.GetProxyPeers()
-	if len(proxyPeersByCluster) == 0 {
-		return
-	}
-
-	for _, service := range a.Services {
-		if !service.Enabled {
-			continue
-		}
-		a.injectServiceProxyPolicies(ctx, service, proxyPeersByCluster)
-	}
-
-}
-
-func (a *Account) injectServiceProxyPolicies(ctx context.Context, service *service.Service, proxyPeersByCluster map[string][]*nbpeer.Peer) {
-	proxyPeers := proxyPeersByCluster[service.ProxyCluster]
-	for _, target := range service.Targets {
-		if !target.Enabled {
-			continue
-		}
-		a.injectTargetProxyPolicies(ctx, service, target, proxyPeers)
-	}
-
-	a.injectPrivateServicePolicies(service, proxyPeers)
-}
-
-// injectPrivateServicePolicies synthesises an in-memory ACL: AccessGroups → cluster proxy peers on TCP 80/443.
-func (a *Account) injectPrivateServicePolicies(svc *service.Service, proxyPeers []*nbpeer.Peer) {
-	if !svc.Private {
-		return
-	}
-	if len(svc.AccessGroups) == 0 {
-		return
-	}
-	if len(proxyPeers) == 0 {
-		return
-	}
-	for _, proxyPeer := range proxyPeers {
-		a.Policies = append(a.Policies, a.createPrivateServicePolicy(svc, proxyPeer))
-	}
-}
-
-func (a *Account) createPrivateServicePolicy(svc *service.Service, proxyPeer *nbpeer.Peer) *Policy {
-	policyID := fmt.Sprintf("private-access-%s-%s", svc.ID, proxyPeer.ID)
-	sources := append([]string(nil), svc.AccessGroups...)
-	return &Policy{
-		ID:      policyID,
-		Name:    fmt.Sprintf("Private Access to %s", svc.Name),
-		Enabled: true,
-		Rules: []*PolicyRule{
-			{
-				ID:       policyID,
-				PolicyID: policyID,
-				Name:     fmt.Sprintf("Allow access groups to reach %s", svc.Name),
-				Enabled:  true,
-				Sources:  sources,
-				DestinationResource: Resource{
-					ID:   proxyPeer.ID,
-					Type: ResourceTypePeer,
-				},
-				Bidirectional: false,
-				Protocol:      PolicyRuleProtocolTCP,
-				Action:        PolicyTrafficActionAccept,
-				PortRanges: []RulePortRange{
-					{Start: 80, End: 80},
-					{Start: 443, End: 443},
-				},
-			},
-		},
-	}
-}
-
-func (a *Account) injectTargetProxyPolicies(ctx context.Context, service *service.Service, target *service.Target, proxyPeers []*nbpeer.Peer) {
-	port, ok := a.resolveTargetPort(ctx, target)
-	if !ok {
-		return
-	}
-
-	path := ""
-	if target.Path != nil {
-		path = *target.Path
-	}
-
-	for _, proxyPeer := range proxyPeers {
-		policy := a.createProxyPolicy(service, target, proxyPeer, port, path)
-		a.Policies = append(a.Policies, policy)
-	}
-}
-
-func (a *Account) resolveTargetPort(ctx context.Context, target *service.Target) (uint16, bool) {
-	if target.Port != 0 {
-		return target.Port, true
-	}
-
-	switch target.Protocol {
-	case "https", "tls":
-		return 443, true
-	case "http":
-		return 80, true
-	default:
-		log.WithContext(ctx).Warnf("unsupported protocol %s for proxy target %s, skipping policy injection", target.Protocol, target.TargetId)
-		return 0, false
-	}
-}
-
-func (a *Account) createProxyPolicy(svc *service.Service, target *service.Target, proxyPeer *nbpeer.Peer, port uint16, path string) *Policy {
-	policyID := fmt.Sprintf("proxy-access-%s-%s-%s", svc.ID, proxyPeer.ID, path)
-
-	protocol := PolicyRuleProtocolTCP
-	if svc.Mode == service.ModeUDP {
-		protocol = PolicyRuleProtocolUDP
-	}
-
-	return &Policy{
-		ID:      policyID,
-		Name:    fmt.Sprintf("Proxy Access to %s", svc.Name),
-		Enabled: true,
-		Rules: []*PolicyRule{
-			{
-				ID:       policyID,
-				PolicyID: policyID,
-				Name:     fmt.Sprintf("Allow access to %s", svc.Name),
-				Enabled:  true,
-				SourceResource: Resource{
-					ID:   proxyPeer.ID,
-					Type: ResourceTypePeer,
-				},
-				DestinationResource: Resource{
-					ID:   target.TargetId,
-					Type: ResourceType(target.TargetType),
-				},
-				Bidirectional: false,
-				Protocol:      protocol,
-				Action:        PolicyTrafficActionAccept,
-				PortRanges: []RulePortRange{
-					{
-						Start: port,
-						End:   port,
-					},
-				},
-			},
-		},
-	}
-}
-
-// expandPortsAndRanges expands Ports and PortRanges of a rule into individual firewall rules
-func expandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *nbpeer.Peer) []*FirewallRule {
-	features := peerSupportedFirewallFeatures(peer.Meta.WtVersion)
-
-	var expanded []*FirewallRule
-
-	for _, port := range rule.Ports {
-		fr := base
-		fr.Port = port
-		expanded = append(expanded, &fr)
-	}
-
-	for _, portRange := range rule.PortRanges {
-		// prefer PolicyRule.Ports
-		if len(rule.Ports) > 0 {
-			break
-		}
-		fr := base
-
-		if features.portRanges {
-			fr.PortRange = portRange
-		} else {
-			// Peer doesn't support port ranges, only allow single-port ranges
-			if portRange.Start != portRange.End {
-				continue
-			}
-			fr.Port = strconv.FormatUint(uint64(portRange.Start), 10)
-		}
-		expanded = append(expanded, &fr)
-	}
-
-	if shouldCheckRulesForNativeSSH(features.nativeSSH, rule, peer) || rule.Protocol == PolicyRuleProtocolNetbirdSSH {
-		expanded = addNativeSSHRule(base, expanded)
-	}
-
-	return expanded
-}
-
-// addNativeSSHRule adds a native SSH rule (port 22022) to the expanded rules if the base rule has port 22 configured.
-func addNativeSSHRule(base FirewallRule, expanded []*FirewallRule) []*FirewallRule {
-	shouldAdd := false
-	for _, fr := range expanded {
-		if isPortInRule(nativeSSHPortString, 22022, fr) {
-			return expanded
-		}
-		if isPortInRule(defaultSSHPortString, 22, fr) {
-			shouldAdd = true
-		}
-	}
-	if !shouldAdd {
-		return expanded
-	}
-
-	fr := base
-	fr.Port = nativeSSHPortString
-	return append(expanded, &fr)
-}
-
-func isPortInRule(portString string, portInt uint16, rule *FirewallRule) bool {
-	return rule.Port == portString || (rule.PortRange.Start <= portInt && portInt <= rule.PortRange.End)
-}
-
-// shouldCheckRulesForNativeSSH determines whether specific policy rules should be checked for native SSH support.
-// While users can add the nativeSSHPortString, we look for cases when they used port 22 and based on SSH enabled
-// in both management and client, we indicate to add the native port.
-func shouldCheckRulesForNativeSSH(supportsNative bool, rule *PolicyRule, peer *nbpeer.Peer) bool {
-	return supportsNative && peer.SSHEnabled && peer.Meta.Flags.ServerSSHAllowed && rule.Protocol == PolicyRuleProtocolTCP
-}
-
-// peerSupportedFirewallFeatures checks if the peer version supports port ranges.
-func peerSupportedFirewallFeatures(peerVer string) supportedFeatures {
-	if version.IsDevelopmentVersion(peerVer) {
-		return supportedFeatures{true, true}
-	}
-
-	var features supportedFeatures
-
-	meetMinVer, err := posture.MeetsMinVersion(firewallRuleMinNativeSSHVer, peerVer)
-	features.nativeSSH = err == nil && meetMinVer
-
-	if features.nativeSSH {
-		features.portRanges = true
-	} else {
-		meetMinVer, err = posture.MeetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
-		features.portRanges = err == nil && meetMinVer
-	}
-
-	return features
-}
-
 // filterZoneRecordsForPeers filters DNS records to only include peers to connect.
 // AAAA records are excluded when the requesting peer lacks IPv6 capability.
 func filterZoneRecordsForPeers(peer *nbpeer.Peer, customZone nbdns.CustomZone, peersToConnect, expiredPeers []*nbpeer.Peer) []nbdns.SimpleRecord {
@@ -1929,66 +1581,3 @@ func filterZoneRecordsForPeers(peer *nbpeer.Peer, customZone nbdns.CustomZone, p
 
 	return filteredRecords
 }
-
-// filterPeerAppliedZones filters account zones based on the peer's group membership
-func filterPeerAppliedZones(ctx context.Context, accountZones []*zones.Zone, peerGroups LookupMap) []nbdns.CustomZone {
-	var customZones []nbdns.CustomZone
-
-	if len(peerGroups) == 0 {
-		return customZones
-	}
-
-	for _, zone := range accountZones {
-		if !zone.Enabled || len(zone.Records) == 0 {
-			continue
-		}
-
-		hasAccess := false
-		for _, distGroupID := range zone.DistributionGroups {
-			if _, found := peerGroups[distGroupID]; found {
-				hasAccess = true
-				break
-			}
-		}
-
-		if !hasAccess {
-			continue
-		}
-
-		simpleRecords := make([]nbdns.SimpleRecord, 0, len(zone.Records))
-		for _, record := range zone.Records {
-			var recordType int
-			rData := record.Content
-
-			switch record.Type {
-			case records.RecordTypeA:
-				recordType = int(dns.TypeA)
-			case records.RecordTypeAAAA:
-				recordType = int(dns.TypeAAAA)
-			case records.RecordTypeCNAME:
-				recordType = int(dns.TypeCNAME)
-				rData = dns.Fqdn(record.Content)
-			default:
-				log.WithContext(ctx).Warnf("unknown DNS record type %s for record %s", record.Type, record.ID)
-				continue
-			}
-
-			simpleRecords = append(simpleRecords, nbdns.SimpleRecord{
-				Name:  dns.Fqdn(record.Name),
-				Type:  recordType,
-				Class: nbdns.DefaultClass,
-				TTL:   record.TTL,
-				RData: rData,
-			})
-		}
-
-		customZones = append(customZones, nbdns.CustomZone{
-			Domain:               dns.Fqdn(zone.Domain),
-			Records:              simpleRecords,
-			SearchDomainDisabled: !zone.EnableSearchDomain,
-			NonAuthoritative:     true,
-		})
-	}
-
-	return customZones
-}
diff --git a/management/server/types/account_components.go b/management/server/types/account_components.go
index a42028351..3545fc8c8 100644
--- a/management/server/types/account_components.go
+++ b/management/server/types/account_components.go
@@ -2,20 +2,49 @@ package types
 
 import (
 	"context"
-	"slices"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/telemetry"
-	"github.com/netbirdio/netbird/route"
 )
 
+// GetPeerNetworkMapResult dispatches to either the legacy-NetworkMap path or
+// the components path based on the peer's capability and the kill switch.
+// Capable peers (PeerCapabilityComponentNetworkMap) get the raw components
+// shape — the server skips Calculate() entirely for them, saving CPU
+// proportional to the number of capable peers in the account. Legacy peers
+// (or any peer when componentsDisabled is true) get the fully-expanded
+// NetworkMap as before.
+func (a *Account) GetPeerNetworkMapResult(
+	ctx context.Context,
+	peerID string,
+	componentsDisabled bool,
+	peersCustomZone nbdns.CustomZone,
+	accountZones []*zones.Zone,
+	validatedPeersMap map[string]struct{},
+	resourcePolicies map[string][]*Policy,
+	routers map[string]map[string]*routerTypes.NetworkRouter,
+	metrics *telemetry.AccountManagerMetrics,
+	groupIDToUserIDs map[string][]string,
+) PeerNetworkMapResult {
+	peer := a.Peers[peerID]
+	if !componentsDisabled && peer != nil && peer.SupportsComponentNetworkMap() {
+		components := a.GetPeerNetworkMapComponents(
+			ctx, peerID, peersCustomZone, accountZones, validatedPeersMap, resourcePolicies, routers, groupIDToUserIDs,
+		)
+		return PeerNetworkMapResult{Components: components}
+	}
+	return PeerNetworkMapResult{
+		NetworkMap: a.GetPeerNetworkMapFromComponents(
+			ctx, peerID, peersCustomZone, accountZones, validatedPeersMap, resourcePolicies, routers, metrics, groupIDToUserIDs,
+		),
+	}
+}
+
 func (a *Account) GetPeerNetworkMapFromComponents(
 	ctx context.Context,
 	peerID string,
@@ -40,8 +69,8 @@ func (a *Account) GetPeerNetworkMapFromComponents(
 		groupIDToUserIDs,
 	)
 
-	if components == nil {
-		return &NetworkMap{Network: a.Network.Copy()}
+	if components.IsEmpty() {
+		return &NetworkMap{Network: components.Network}
 	}
 
 	nm := CalculateNetworkMapFromComponents(ctx, components)
@@ -61,6 +90,9 @@ func (a *Account) GetPeerNetworkMapFromComponents(
 	return nm
 }
 
+// GetPeerNetworkMapComponents builds the account's slim twin store and computes
+// the peer's components on it. The calculation itself lives on
+// networkmap.NetworkMapData and never touches the Account.
 func (a *Account) GetPeerNetworkMapComponents(
 	ctx context.Context,
 	peerID string,
@@ -72,513 +104,18 @@ func (a *Account) GetPeerNetworkMapComponents(
 	groupIDToUserIDs map[string][]string,
 ) *NetworkMapComponents {
 
-	peer := a.Peers[peerID]
-	if peer == nil {
-		return nil
-	}
-
-	if _, ok := validatedPeersMap[peerID]; !ok {
-		return nil
-	}
-
-	components := &NetworkMapComponents{
-		PeerID:              peerID,
-		Network:             a.Network.Copy(),
-		NameServerGroups:    make([]*nbdns.NameServerGroup, 0),
-		CustomZoneDomain:    peersCustomZone.Domain,
-		ResourcePoliciesMap: make(map[string][]*Policy),
-		RoutersMap:          make(map[string]map[string]*routerTypes.NetworkRouter),
-		NetworkResources:    make([]*resourceTypes.NetworkResource, 0),
-		PostureFailedPeers:  make(map[string]map[string]struct{}, len(a.PostureChecks)),
-		RouterPeers:         make(map[string]*nbpeer.Peer),
-	}
-
-	components.AccountSettings = &AccountSettingsInfo{
-		PeerLoginExpirationEnabled:      a.Settings.PeerLoginExpirationEnabled,
-		PeerLoginExpiration:             a.Settings.PeerLoginExpiration,
-		PeerInactivityExpirationEnabled: a.Settings.PeerInactivityExpirationEnabled,
-		PeerInactivityExpiration:        a.Settings.PeerInactivityExpiration,
-	}
-
-	components.DNSSettings = &a.DNSSettings
-
-	relevantPeers, relevantGroups, relevantPolicies, relevantRoutes, sshReqs := a.getPeersGroupsPoliciesRoutes(ctx, peerID, peer.SSHEnabled, validatedPeersMap, &components.PostureFailedPeers)
-
-	if len(sshReqs.neededGroupIDs) > 0 {
-		components.GroupIDToUserIDs = filterGroupIDToUserIDs(groupIDToUserIDs, sshReqs.neededGroupIDs)
-	}
-	if sshReqs.needAllowedUserIDs {
-		components.AllowedUserIDs = a.getAllowedUserIDs()
-	}
-
-	components.Peers = relevantPeers
-	components.Groups = relevantGroups
-	components.Policies = relevantPolicies
-	components.Routes = relevantRoutes
-	components.AllDNSRecords = filterDNSRecordsByPeers(peersCustomZone.Records, relevantPeers, peer.SupportsIPv6() && peer.IPv6.IsValid())
-
-	peerGroups := a.GetPeerGroups(peerID)
-	components.AccountZones = filterPeerAppliedZones(ctx, accountZones, peerGroups)
-	components.AccountZones = append(components.AccountZones, a.SynthesizePrivateServiceZones(peerID)...)
-
-	for _, nsGroup := range a.NameServerGroups {
-		if nsGroup.Enabled {
-			for _, gID := range nsGroup.Groups {
-				if _, found := relevantGroups[gID]; found {
-					components.NameServerGroups = append(components.NameServerGroups, nsGroup)
-					break
-				}
-			}
-		}
-	}
-
-	for _, resource := range a.NetworkResources {
-		if !resource.Enabled {
-			continue
-		}
-
-		policies, exists := resourcePolicies[resource.ID]
-		if !exists {
-			continue
-		}
-
-		addSourcePeers := false
-
-		networkRoutingPeers, routerExists := routers[resource.NetworkID]
-		if routerExists {
-			if _, ok := networkRoutingPeers[peerID]; ok {
-				addSourcePeers = true
-			}
-		}
-
-		for _, policy := range policies {
-			if addSourcePeers {
-				var peers []string
-				if policy.Rules[0].SourceResource.Type == ResourceTypePeer && policy.Rules[0].SourceResource.ID != "" {
-					peers = []string{policy.Rules[0].SourceResource.ID}
-				} else {
-					peers = a.getUniquePeerIDsFromGroupsIDs(ctx, policy.SourceGroups())
-				}
-				for _, pID := range a.getPostureValidPeersSaveFailed(peers, policy.SourcePostureChecks, validatedPeersMap, &components.PostureFailedPeers) {
-					if _, exists := components.Peers[pID]; !exists {
-						components.Peers[pID] = a.GetPeer(pID)
-					}
-				}
-			} else {
-				peerInSources := false
-				if policy.Rules[0].SourceResource.Type == ResourceTypePeer && policy.Rules[0].SourceResource.ID != "" {
-					peerInSources = policy.Rules[0].SourceResource.ID == peerID
-				} else {
-					for _, groupID := range policy.SourceGroups() {
-						if group := a.GetGroup(groupID); group != nil && slices.Contains(group.Peers, peerID) {
-							peerInSources = true
-							break
-						}
-					}
-				}
-				if !peerInSources {
-					continue
-				}
-				isValid, pname := a.validatePostureChecksOnPeerGetFailed(ctx, policy.SourcePostureChecks, peerID)
-				if !isValid && len(pname) > 0 {
-					if _, ok := components.PostureFailedPeers[pname]; !ok {
-						components.PostureFailedPeers[pname] = make(map[string]struct{})
-					}
-					components.PostureFailedPeers[pname][peer.ID] = struct{}{}
-					continue
-				}
-				addSourcePeers = true
-			}
-
-			for _, rule := range policy.Rules {
-				for _, srcGroupID := range rule.Sources {
-					if g := a.Groups[srcGroupID]; g != nil {
-						if _, exists := components.Groups[srcGroupID]; !exists {
-							components.Groups[srcGroupID] = g
-						}
-					}
-				}
-				for _, dstGroupID := range rule.Destinations {
-					if g := a.Groups[dstGroupID]; g != nil {
-						if _, exists := components.Groups[dstGroupID]; !exists {
-							components.Groups[dstGroupID] = g
-						}
-					}
-				}
-			}
-			components.ResourcePoliciesMap[resource.ID] = policies
-		}
-
-		components.RoutersMap[resource.NetworkID] = networkRoutingPeers
-		for peerIDKey := range networkRoutingPeers {
-			if p := a.Peers[peerIDKey]; p != nil {
-				if _, exists := components.RouterPeers[peerIDKey]; !exists {
-					components.RouterPeers[peerIDKey] = p
-				}
-				if _, exists := components.Peers[peerIDKey]; !exists {
-					if _, validated := validatedPeersMap[peerIDKey]; validated {
-						components.Peers[peerIDKey] = p
-					}
-				}
-			}
-		}
-
-		if addSourcePeers {
-			components.NetworkResources = append(components.NetworkResources, resource)
-		}
-	}
-
-	filterGroupPeers(&components.Groups, components.Peers)
-	filterPostureFailedPeers(&components.PostureFailedPeers, components.Policies, components.ResourcePoliciesMap, components.Peers)
-
-	return components
+	nmd := a.toNetworkMapData(accountZones, validatedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
+	return nmd.GetPeerNetworkMapComponents(peerID, TwinCustomZone(peersCustomZone))
 }
 
-type sshRequirements struct {
-	neededGroupIDs     map[string]struct{}
-	needAllowedUserIDs bool
-}
-
-func (a *Account) getPeersGroupsPoliciesRoutes(
-	ctx context.Context,
-	peerID string,
-	peerSSHEnabled bool,
-	validatedPeersMap map[string]struct{},
-	postureFailedPeers *map[string]map[string]struct{},
-) (map[string]*nbpeer.Peer, map[string]*Group, []*Policy, []*route.Route, sshRequirements) {
-	relevantPeerIDs := make(map[string]*nbpeer.Peer, len(a.Peers)/4)
-	relevantGroupIDs := make(map[string]*Group, len(a.Groups)/4)
-	relevantPolicies := make([]*Policy, 0, len(a.Policies))
-	relevantRoutes := make([]*route.Route, 0, len(a.Routes))
-	sshReqs := sshRequirements{neededGroupIDs: make(map[string]struct{})}
-
-	relevantPeerIDs[peerID] = a.GetPeer(peerID)
-
-	for groupID, group := range a.Groups {
-		if slices.Contains(group.Peers, peerID) {
-			relevantGroupIDs[groupID] = a.GetGroup(groupID)
-		}
-	}
-
-	routeAccessControlGroups := make(map[string]struct{})
-	for _, r := range a.Routes {
-		for _, groupID := range r.Groups {
-			relevantGroupIDs[groupID] = a.GetGroup(groupID)
-		}
-		for _, groupID := range r.PeerGroups {
-			relevantGroupIDs[groupID] = a.GetGroup(groupID)
-		}
-		if r.Enabled {
-			for _, groupID := range r.AccessControlGroups {
-				relevantGroupIDs[groupID] = a.GetGroup(groupID)
-				routeAccessControlGroups[groupID] = struct{}{}
-			}
-		}
-		relevantRoutes = append(relevantRoutes, r)
-	}
-
-	for _, policy := range a.Policies {
-		if !policy.Enabled {
-			continue
-		}
-
-		policyRelevant := false
-		for _, rule := range policy.Rules {
-			if !rule.Enabled {
-				continue
-			}
-
-			if len(routeAccessControlGroups) > 0 {
-				for _, destGroupID := range rule.Destinations {
-					if _, needed := routeAccessControlGroups[destGroupID]; needed {
-						policyRelevant = true
-						for _, srcGroupID := range rule.Sources {
-							relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
-						}
-						for _, dstGroupID := range rule.Destinations {
-							relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
-						}
-						break
-					}
-				}
-			}
-
-			var sourcePeers, destinationPeers []string
-			var peerInSources, peerInDestinations bool
-
-			if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
-				sourcePeers = []string{rule.SourceResource.ID}
-				if rule.SourceResource.ID == peerID {
-					peerInSources = true
-				}
-			} else {
-				sourcePeers, peerInSources = a.getPeersFromGroups(ctx, rule.Sources, peerID, policy.SourcePostureChecks, validatedPeersMap, postureFailedPeers)
-			}
-
-			if rule.DestinationResource.Type == ResourceTypePeer && rule.DestinationResource.ID != "" {
-				destinationPeers = []string{rule.DestinationResource.ID}
-				if rule.DestinationResource.ID == peerID {
-					peerInDestinations = true
-				}
-			} else {
-				destinationPeers, peerInDestinations = a.getPeersFromGroups(ctx, rule.Destinations, peerID, nil, validatedPeersMap, postureFailedPeers)
-			}
-
-			if peerInSources {
-				policyRelevant = true
-				for _, pid := range destinationPeers {
-					relevantPeerIDs[pid] = a.GetPeer(pid)
-				}
-				for _, dstGroupID := range rule.Destinations {
-					relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
-				}
-			}
-
-			if peerInDestinations {
-				policyRelevant = true
-				for _, pid := range sourcePeers {
-					relevantPeerIDs[pid] = a.GetPeer(pid)
-				}
-				for _, srcGroupID := range rule.Sources {
-					relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
-				}
-
-				if rule.Protocol == PolicyRuleProtocolNetbirdSSH {
-					switch {
-					case len(rule.AuthorizedGroups) > 0:
-						for groupID := range rule.AuthorizedGroups {
-							sshReqs.neededGroupIDs[groupID] = struct{}{}
-						}
-					case rule.AuthorizedUser != "":
-					default:
-						sshReqs.needAllowedUserIDs = true
-					}
-				} else if policyRuleImpliesLegacySSH(rule) && peerSSHEnabled {
-					sshReqs.needAllowedUserIDs = true
-				}
-			}
-		}
-		if policyRelevant {
-			relevantPolicies = append(relevantPolicies, policy)
-		}
-	}
-
-	return relevantPeerIDs, relevantGroupIDs, relevantPolicies, relevantRoutes, sshReqs
-}
-
-func (a *Account) getPeersFromGroups(ctx context.Context, groups []string, peerID string, sourcePostureChecksIDs []string,
-	validatedPeersMap map[string]struct{}, postureFailedPeers *map[string]map[string]struct{}) ([]string, bool) {
-	peerInGroups := false
-	filteredPeerIDs := make([]string, 0, len(groups))
-	seenPeerIds := make(map[string]struct{}, len(groups))
-
-	for _, gid := range groups {
-		group := a.GetGroup(gid)
-		if group == nil {
-			continue
-		}
-
-		if group.IsGroupAll() || len(groups) == 1 {
-			filteredPeerIDs = make([]string, 0, len(group.Peers))
-			peerInGroups = false
-			for _, pid := range group.Peers {
-				peer, ok := a.Peers[pid]
-				if !ok || peer == nil {
-					continue
-				}
-
-				if _, ok := validatedPeersMap[peer.ID]; !ok {
-					continue
-				}
-
-				isValid, pname := a.validatePostureChecksOnPeerGetFailed(ctx, sourcePostureChecksIDs, peer.ID)
-				if !isValid && len(pname) > 0 {
-					if _, ok := (*postureFailedPeers)[pname]; !ok {
-						(*postureFailedPeers)[pname] = make(map[string]struct{})
-					}
-					(*postureFailedPeers)[pname][peer.ID] = struct{}{}
-					continue
-				}
-
-				if peer.ID == peerID {
-					peerInGroups = true
-					continue
-				}
-
-				filteredPeerIDs = append(filteredPeerIDs, peer.ID)
-			}
-			return filteredPeerIDs, peerInGroups
-		}
-
-		for _, pid := range group.Peers {
-			if _, seen := seenPeerIds[pid]; seen {
-				continue
-			}
-			seenPeerIds[pid] = struct{}{}
-			peer, ok := a.Peers[pid]
-			if !ok || peer == nil {
-				continue
-			}
-
-			if _, ok := validatedPeersMap[peer.ID]; !ok {
-				continue
-			}
-
-			isValid, pname := a.validatePostureChecksOnPeerGetFailed(ctx, sourcePostureChecksIDs, peer.ID)
-			if !isValid && len(pname) > 0 {
-				if _, ok := (*postureFailedPeers)[pname]; !ok {
-					(*postureFailedPeers)[pname] = make(map[string]struct{})
-				}
-				(*postureFailedPeers)[pname][peer.ID] = struct{}{}
-				continue
-			}
-
-			if peer.ID == peerID {
-				peerInGroups = true
-				continue
-			}
-
-			filteredPeerIDs = append(filteredPeerIDs, peer.ID)
-		}
-	}
-
-	return filteredPeerIDs, peerInGroups
-}
-
-func (a *Account) validatePostureChecksOnPeerGetFailed(ctx context.Context, sourcePostureChecksID []string, peerID string) (bool, string) {
-	peer, ok := a.Peers[peerID]
-	if !ok || peer == nil {
-		return false, ""
-	}
-
-	for _, postureChecksID := range sourcePostureChecksID {
-		postureChecks := a.GetPostureChecks(postureChecksID)
-		if postureChecks == nil {
-			continue
-		}
-
-		for _, check := range postureChecks.GetChecks() {
-			isValid, _ := check.Check(ctx, *peer)
-			if !isValid {
-				return false, postureChecksID
-			}
-		}
-	}
-	return true, ""
-}
-
-func (a *Account) getPostureValidPeersSaveFailed(inputPeers []string, postureChecksIDs []string, validatedPeersMap map[string]struct{}, postureFailedPeers *map[string]map[string]struct{}) []string {
-	var dest []string
-	for _, peerID := range inputPeers {
-		if _, validated := validatedPeersMap[peerID]; !validated {
-			continue
-		}
-		valid, pname := a.validatePostureChecksOnPeerGetFailed(context.Background(), postureChecksIDs, peerID)
-		if valid {
-			dest = append(dest, peerID)
-			continue
-		}
-		if _, ok := (*postureFailedPeers)[pname]; !ok {
-			(*postureFailedPeers)[pname] = make(map[string]struct{})
-		}
-		(*postureFailedPeers)[pname][peerID] = struct{}{}
-	}
-	return dest
-}
-
-func filterGroupPeers(groups *map[string]*Group, peers map[string]*nbpeer.Peer) {
-	for groupID, groupInfo := range *groups {
-		filteredPeers := make([]string, 0, len(groupInfo.Peers))
-		for _, pid := range groupInfo.Peers {
-			if _, exists := peers[pid]; exists {
-				filteredPeers = append(filteredPeers, pid)
-			}
-		}
-
-		if len(filteredPeers) == 0 {
-			delete(*groups, groupID)
-		} else if len(filteredPeers) != len(groupInfo.Peers) {
-			ng := groupInfo.Copy()
-			ng.Peers = filteredPeers
-			(*groups)[groupID] = ng
-		}
-	}
-}
-
-func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}, policies []*Policy, resourcePoliciesMap map[string][]*Policy, peers map[string]*nbpeer.Peer) {
-	if len(*postureFailedPeers) == 0 {
-		return
-	}
-
-	referencedPostureChecks := make(map[string]struct{})
-	for _, policy := range policies {
-		for _, checkID := range policy.SourcePostureChecks {
-			referencedPostureChecks[checkID] = struct{}{}
-		}
-	}
-	for _, resPolicies := range resourcePoliciesMap {
-		for _, policy := range resPolicies {
-			for _, checkID := range policy.SourcePostureChecks {
-				referencedPostureChecks[checkID] = struct{}{}
-			}
-		}
-	}
-
-	for checkID, failedPeers := range *postureFailedPeers {
-		if _, referenced := referencedPostureChecks[checkID]; !referenced {
-			delete(*postureFailedPeers, checkID)
-			continue
-		}
-		for peerID := range failedPeers {
-			if _, exists := peers[peerID]; !exists {
-				delete(failedPeers, peerID)
-			}
-		}
-		if len(failedPeers) == 0 {
-			delete(*postureFailedPeers, checkID)
-		}
-	}
-}
-
-func filterDNSRecordsByPeers(records []nbdns.SimpleRecord, peers map[string]*nbpeer.Peer, includeIPv6 bool) []nbdns.SimpleRecord {
-	if len(records) == 0 || len(peers) == 0 {
-		return nil
-	}
-
-	// Include both v4 and v6 addresses so AAAA records (whose RData is an IPv6
-	// address) are not filtered out when peers have IPv6 assigned. When the
-	// requesting peer doesn't have IPv6, omit v6 IPs so AAAA records get dropped.
-	peerIPs := make(map[string]struct{}, len(peers)*2)
-	for _, peer := range peers {
-		if peer == nil {
-			continue
-		}
-		peerIPs[peer.IP.String()] = struct{}{}
-		if includeIPv6 && peer.IPv6.IsValid() {
-			peerIPs[peer.IPv6.String()] = struct{}{}
-		}
-	}
-
-	filteredRecords := make([]nbdns.SimpleRecord, 0, len(records))
-	for _, record := range records {
-		if _, exists := peerIPs[record.RData]; exists {
-			filteredRecords = append(filteredRecords, record)
-		}
-	}
-
-	return filteredRecords
-}
-
-func filterGroupIDToUserIDs(fullMap map[string][]string, neededGroupIDs map[string]struct{}) map[string][]string {
-	if len(neededGroupIDs) == 0 {
-		return nil
-	}
-
-	filtered := make(map[string][]string, len(neededGroupIDs))
-	for groupID := range neededGroupIDs {
-		if users, ok := fullMap[groupID]; ok {
-			filtered[groupID] = users
-		}
-	}
-	return filtered
+// PrecomputePostureValidation evaluates every posture check referenced by an enabled
+// policy once and stores the results on the account, so the per-peer components
+// calculations that follow look them up instead of re-evaluating checks for every
+// peer pair. The evaluation itself runs on the twin store; every twin built from
+// this account afterwards inherits the results. It must be called before the
+// account is shared across goroutines.
+func (a *Account) PrecomputePostureValidation(ctx context.Context) {
+	nmd := a.toNetworkMapData(nil, nil, nil, nil, nil)
+	nmd.PrecomputePostureValidation()
+	a.PostureValidation = nmd.PostureValidation
 }
diff --git a/management/server/types/account_components_test.go b/management/server/types/account_components_test.go
new file mode 100644
index 000000000..99f5f9b72
--- /dev/null
+++ b/management/server/types/account_components_test.go
@@ -0,0 +1,23 @@
+package types
+
+import (
+	"context"
+	"testing"
+
+	"github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/types"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetPeerNetworkMapComponents_PeerMissingFromAcount(t *testing.T) {
+	account := Account{Network: NewNetwork()}
+	nmapcomponets := account.GetPeerNetworkMapComponents(context.TODO(), "missing-peer", dns.CustomZone{}, nil, nil, nil, nil, nil)
+
+	assert.Equal(t, EmptyNetworkMapComponents(&types.NetworkMapComponents{
+		PeerID:                        "missing-peer",
+		Network:                       TwinNetwork(account.Network),
+		Peers:                         map[string]*nmdata.Peer{"missing-peer": nil},
+		ForceRoutingPeerDNSResolution: false,
+	}), nmapcomponets)
+}
diff --git a/management/server/types/account_networkmapdata.go b/management/server/types/account_networkmapdata.go
new file mode 100644
index 000000000..a1f04bc67
--- /dev/null
+++ b/management/server/types/account_networkmapdata.go
@@ -0,0 +1,646 @@
+package types
+
+import (
+	"github.com/miekg/dns"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	proxydomain "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/posture"
+	nbroute "github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+// toNetworkMapData builds the slim twin store from the account once per
+// account. The per-peer components calculation then runs on the twin.
+func (a *Account) toNetworkMapData(
+	accountZones []*zones.Zone,
+	validatedPeersMap map[string]struct{},
+	resourcePolicies map[string][]*Policy,
+	routers map[string]map[string]*routerTypes.NetworkRouter,
+	groupIDToUserIDs map[string][]string,
+) *networkmap.NetworkMapData {
+	nmd := &networkmap.NetworkMapData{
+		Peers:                     make(map[string]*nmdata.Peer, len(a.Peers)),
+		Groups:                    make(map[string]*nmdata.Group, len(a.Groups)),
+		Policies:                  make([]*nmdata.Policy, 0, len(a.Policies)),
+		Routes:                    make([]*nmdata.Route, 0, len(a.Routes)),
+		NameServerGroups:          make([]*nmdata.NameServerGroup, 0, len(a.NameServerGroups)),
+		NetworkResources:          make([]*nmdata.NetworkResource, 0, len(a.NetworkResources)),
+		PostureChecks:             make(map[string]*nmdata.PostureChecks, len(a.PostureChecks)),
+		ResourcePolicies:          make(map[string][]*nmdata.Policy, len(resourcePolicies)),
+		Routers:                   make(map[string]map[string]*nmdata.NetworkRouter, len(routers)),
+		ValidatedPeers:            validatedPeersMap,
+		GroupIDToUserIDs:          groupIDToUserIDs,
+		PostureValidation:         a.PostureValidation,
+		AllowedUserIDs:            a.getAllowedUserIDs(),
+		NetworkXIDToPublicID:      make(map[string]string, len(a.Networks)),
+		PostureCheckXIDToPublicID: make(map[string]string, len(a.PostureChecks)),
+	}
+
+	if a.Network != nil {
+		nmd.Network = TwinNetwork(a.Network)
+	}
+	nmd.DNSSettings = &nmdata.DNSSettings{DisabledManagementGroups: a.DNSSettings.DisabledManagementGroups}
+	nmd.AccountSettings = TwinAccountSettings(a.Settings)
+
+	for id, p := range a.Peers {
+		nmd.Peers[id] = twinPeer(p)
+	}
+	for id, g := range a.Groups {
+		nmd.Groups[id] = twinGroup(g)
+	}
+
+	policyCache := make(map[string]*nmdata.Policy, len(a.Policies))
+	twinPol := func(p *Policy) *nmdata.Policy {
+		if p == nil {
+			return nil
+		}
+		if tp, ok := policyCache[p.ID]; ok {
+			return tp
+		}
+		tp := twinPolicy(p)
+		policyCache[p.ID] = tp
+		return tp
+	}
+	for _, p := range a.Policies {
+		nmd.Policies = append(nmd.Policies, twinPol(p))
+	}
+	for resID, pols := range resourcePolicies {
+		twinPols := make([]*nmdata.Policy, 0, len(pols))
+		for _, p := range pols {
+			twinPols = append(twinPols, twinPol(p))
+		}
+		nmd.ResourcePolicies[resID] = twinPols
+	}
+
+	for _, r := range a.Routes {
+		if r == nil {
+			continue
+		}
+		nmd.Routes = append(nmd.Routes, twinRoute(r))
+	}
+	for _, nsg := range a.NameServerGroups {
+		nmd.NameServerGroups = append(nmd.NameServerGroups, twinNSG(nsg))
+	}
+	for _, res := range a.NetworkResources {
+		nmd.NetworkResources = append(nmd.NetworkResources, TwinNetworkResource(res))
+	}
+	for _, pc := range a.PostureChecks {
+		if pc != nil {
+			nmd.PostureChecks[pc.ID] = TwinPostureChecks(pc)
+			nmd.PostureCheckXIDToPublicID[pc.ID] = pc.PublicID
+		}
+	}
+	for _, n := range a.Networks {
+		if n != nil {
+			nmd.NetworkXIDToPublicID[n.ID] = n.PublicID
+		}
+	}
+	for networkID, inner := range routers {
+		twinInner := make(map[string]*nmdata.NetworkRouter, len(inner))
+		for peerID, router := range inner {
+			twinInner[peerID] = twinRouter(router)
+		}
+		nmd.Routers[networkID] = twinInner
+	}
+
+	nmd.ProxyTargetedDomainResourceIDs = a.proxyTargetedDomainResourceIDs()
+	nmd.AppliedZoneCandidates = buildAppliedZoneCandidates(accountZones)
+	nmd.PrivateServiceCandidates = a.buildPrivateServiceCandidates()
+	nmd.Services = TwinServices(a.Services)
+	nmd.Domains = twinProxyDomains(a.Domains)
+
+	return nmd
+}
+
+// TwinServices converts reverse-proxy services to their slim nmdata twins.
+// Exported for the network-map controller, which hands the store-backed twin
+// the same services the account carries.
+func TwinServices(services []*service.Service) []*nmdata.Service {
+	if len(services) == 0 {
+		return nil
+	}
+	out := make([]*nmdata.Service, 0, len(services))
+	for _, svc := range services {
+		if svc == nil {
+			continue
+		}
+		targets := make([]*nmdata.ServiceTarget, 0, len(svc.Targets))
+		for _, t := range svc.Targets {
+			if t == nil {
+				continue
+			}
+			path := ""
+			if t.Path != nil {
+				path = *t.Path
+			}
+			targets = append(targets, &nmdata.ServiceTarget{
+				Enabled:    t.Enabled,
+				Path:       path,
+				Port:       t.Port,
+				Protocol:   t.Protocol,
+				TargetID:   t.TargetId,
+				TargetType: string(t.TargetType),
+			})
+		}
+		out = append(out, &nmdata.Service{
+			ID:           svc.ID,
+			Enabled:      svc.Enabled,
+			Private:      svc.Private,
+			Mode:         svc.Mode,
+			Domain:       svc.Domain,
+			ProxyCluster: svc.ProxyCluster,
+			AccessGroups: svc.AccessGroups,
+			Targets:      targets,
+		})
+	}
+	return out
+}
+
+func twinPeer(p *nbpeer.Peer) *nmdata.Peer {
+	if p == nil {
+		return nil
+	}
+	networkAddresses := make([]nmdata.NetworkAddress, 0, len(p.Meta.NetworkAddresses))
+	for _, na := range p.Meta.NetworkAddresses {
+		networkAddresses = append(networkAddresses, nmdata.NetworkAddress{NetIP: na.NetIP})
+	}
+	files := make([]nmdata.File, 0, len(p.Meta.Files))
+	for _, f := range p.Meta.Files {
+		files = append(files, nmdata.File{Path: f.Path, ProcessIsRunning: f.ProcessIsRunning})
+	}
+	return &nmdata.Peer{
+		ID:                     p.ID,
+		Key:                    p.Key,
+		SSHKey:                 p.SSHKey,
+		DNSLabel:               p.DNSLabel,
+		UserID:                 p.UserID,
+		SSHEnabled:             p.SSHEnabled,
+		LoginExpirationEnabled: p.LoginExpirationEnabled,
+		LastLogin:              p.LastLogin,
+		IP:                     p.IP,
+		IPv6:                   p.IPv6,
+		RequiresApproval:       p.Status != nil && p.Status.RequiresApproval,
+		Connected:              p.Status != nil && p.Status.Connected,
+		ExtraDNSLabels:         p.ExtraDNSLabels,
+		ProxyMeta:              nmdata.ProxyMeta{Embedded: p.ProxyMeta.Embedded, Cluster: p.ProxyMeta.Cluster},
+		Meta: nmdata.PeerSystemMeta{
+			WtVersion:          p.Meta.WtVersion,
+			GoOS:               p.Meta.GoOS,
+			OSVersion:          p.Meta.OSVersion,
+			KernelVersion:      p.Meta.KernelVersion,
+			NetworkAddresses:   networkAddresses,
+			Files:              files,
+			Certificates:       p.Meta.Certificates,
+			Capabilities:       p.Meta.Capabilities,
+			SyncMessageVersion: p.Meta.SyncMessageVersion,
+			Flags: nmdata.Flags{
+				ServerSSHAllowed: p.Meta.Flags.ServerSSHAllowed,
+				DisableIPv6:      p.Meta.Flags.DisableIPv6,
+			},
+		},
+		Location: nmdata.PeerLocation{
+			CountryCode:  p.Location.CountryCode,
+			CityName:     p.Location.CityName,
+			ConnectionIP: p.Location.ConnectionIP,
+		},
+	}
+}
+
+// TwinPeer converts a real peer to its slim nmdata twin.
+func TwinPeer(p *nbpeer.Peer) *nmdata.Peer {
+	return twinPeer(p)
+}
+
+// TwinPeers converts real peers to their slim nmdata twins.
+func TwinPeers(peers []*nbpeer.Peer) []*nmdata.Peer {
+	out := make([]*nmdata.Peer, len(peers))
+	for i, p := range peers {
+		out[i] = twinPeer(p)
+	}
+	return out
+}
+
+// TwinGroups converts real groups to their slim nmdata twins.
+func TwinGroups(groups []*Group) []*nmdata.Group {
+	out := make([]*nmdata.Group, len(groups))
+	for i, g := range groups {
+		out[i] = twinGroup(g)
+	}
+	return out
+}
+
+func twinGroup(g *Group) *nmdata.Group {
+	if g == nil {
+		return nil
+	}
+	return &nmdata.Group{
+		ID:       g.ID,
+		Name:     g.Name,
+		PublicID: g.PublicID,
+		Peers:    g.Peers,
+	}
+}
+
+func twinPolicy(p *Policy) *nmdata.Policy {
+	if p == nil {
+		return nil
+	}
+	rules := make([]*nmdata.PolicyRule, 0, len(p.Rules))
+	for _, r := range p.Rules {
+		rules = append(rules, twinRule(r))
+	}
+	return &nmdata.Policy{
+		ID:                  p.ID,
+		PublicID:            p.PublicID,
+		Enabled:             p.Enabled,
+		SourcePostureChecks: p.SourcePostureChecks,
+		Rules:               rules,
+	}
+}
+
+func twinRule(r *PolicyRule) *nmdata.PolicyRule {
+	if r == nil {
+		return nil
+	}
+	var portRanges []nmdata.RulePortRange
+	if r.PortRanges != nil {
+		portRanges = make([]nmdata.RulePortRange, len(r.PortRanges))
+		for i, pr := range r.PortRanges {
+			portRanges[i] = nmdata.RulePortRange{Start: pr.Start, End: pr.End}
+		}
+	}
+	return &nmdata.PolicyRule{
+		ID:                  r.ID,
+		PolicyID:            r.PolicyID,
+		Enabled:             r.Enabled,
+		Action:              string(r.Action),
+		Protocol:            string(r.Protocol),
+		Bidirectional:       r.Bidirectional,
+		Sources:             r.Sources,
+		Destinations:        r.Destinations,
+		SourceResource:      nmdata.Resource{ID: r.SourceResource.ID, Type: string(r.SourceResource.Type)},
+		DestinationResource: nmdata.Resource{ID: r.DestinationResource.ID, Type: string(r.DestinationResource.Type)},
+		Ports:               r.Ports,
+		PortRanges:          portRanges,
+		AuthorizedGroups:    r.AuthorizedGroups,
+		AuthorizedUser:      r.AuthorizedUser,
+	}
+}
+
+func twinRoute(r *nbroute.Route) *nmdata.Route {
+	return &nmdata.Route{
+		ID:                  string(r.ID),
+		AccountID:           r.AccountID,
+		PublicID:            r.PublicID,
+		Network:             r.Network,
+		Domains:             r.Domains,
+		KeepRoute:           r.KeepRoute,
+		NetID:               string(r.NetID),
+		Description:         r.Description,
+		Peer:                r.Peer,
+		PeerID:              r.PeerID,
+		PeerGroups:          r.PeerGroups,
+		NetworkType:         int(r.NetworkType),
+		Masquerade:          r.Masquerade,
+		Metric:              r.Metric,
+		Enabled:             r.Enabled,
+		Groups:              r.Groups,
+		AccessControlGroups: r.AccessControlGroups,
+		SkipAutoApply:       r.SkipAutoApply,
+	}
+}
+
+// TwinRoute converts a real *route.Route to its slim nmdata twin. Exported for
+// tests that assert against twin routes returned in a NetworkMap.
+func TwinRoute(r *nbroute.Route) *nmdata.Route {
+	return twinRoute(r)
+}
+
+func TwinNetworkResource(r *resourceTypes.NetworkResource) *nmdata.NetworkResource {
+	if r == nil {
+		return nil
+	}
+	return &nmdata.NetworkResource{
+		ID:          r.ID,
+		NetworkID:   r.NetworkID,
+		AccountID:   r.AccountID,
+		PublicID:    r.PublicID,
+		Name:        r.Name,
+		Description: r.Description,
+		Type:        string(r.Type),
+		Address:     r.Address,
+		Domain:      r.Domain,
+		Prefix:      r.Prefix,
+		Enabled:     r.Enabled,
+	}
+}
+
+func twinRouter(r *routerTypes.NetworkRouter) *nmdata.NetworkRouter {
+	if r == nil {
+		return nil
+	}
+	return &nmdata.NetworkRouter{
+		PublicID:   r.PublicID,
+		PeerGroups: r.PeerGroups,
+		Masquerade: r.Masquerade,
+		Metric:     r.Metric,
+		Enabled:    r.Enabled,
+	}
+}
+
+func twinNSG(n *nbdns.NameServerGroup) *nmdata.NameServerGroup {
+	if n == nil {
+		return nil
+	}
+	nameServers := make([]nmdata.NameServer, 0, len(n.NameServers))
+	for _, ns := range n.NameServers {
+		nameServers = append(nameServers, nmdata.NameServer{
+			IP:     ns.IP,
+			NSType: int(ns.NSType),
+			Port:   ns.Port,
+		})
+	}
+	return &nmdata.NameServerGroup{
+		ID:                   n.ID,
+		PublicID:             n.PublicID,
+		Name:                 n.Name,
+		Description:          n.Description,
+		NameServers:          nameServers,
+		Groups:               n.Groups,
+		Primary:              n.Primary,
+		Domains:              n.Domains,
+		Enabled:              n.Enabled,
+		SearchDomainsEnabled: n.SearchDomainsEnabled,
+	}
+}
+
+// TwinNetwork converts a real *Network to its slim twin. Exported for the
+// graceful-degrade path that builds a minimal NetworkMapComponents directly.
+func TwinNetwork(n *Network) *nmdata.Network {
+	nc := n.Copy()
+	return &nmdata.Network{
+		Identifier: nc.Identifier,
+		Net:        nc.Net,
+		NetV6:      nc.NetV6,
+		Dns:        nc.Dns,
+		Serial:     int64(nc.Serial),
+	}
+}
+
+// TwinPostureChecksList converts posture checks to their slim nmdata twins.
+func TwinPostureChecksList(checks []*posture.Checks) []*nmdata.PostureChecks {
+	out := make([]*nmdata.PostureChecks, 0, len(checks))
+	for _, pc := range checks {
+		out = append(out, TwinPostureChecks(pc))
+	}
+	return out
+}
+
+// TwinPostureChecks converts posture checks to their slim nmdata twin.
+func TwinPostureChecks(pc *posture.Checks) *nmdata.PostureChecks {
+	if pc == nil {
+		return nil
+	}
+	out := &nmdata.PostureChecks{ID: pc.ID}
+	def := pc.Checks
+	if def.NBVersionCheck != nil {
+		out.Checks.NBVersionCheck = &nmdata.NBVersionCheck{MinVersion: def.NBVersionCheck.MinVersion}
+	}
+	if def.OSVersionCheck != nil {
+		oc := &nmdata.OSVersionCheck{}
+		if def.OSVersionCheck.Android != nil {
+			oc.Android = &nmdata.MinVersionCheck{MinVersion: def.OSVersionCheck.Android.MinVersion}
+		}
+		if def.OSVersionCheck.Darwin != nil {
+			oc.Darwin = &nmdata.MinVersionCheck{MinVersion: def.OSVersionCheck.Darwin.MinVersion}
+		}
+		if def.OSVersionCheck.Ios != nil {
+			oc.Ios = &nmdata.MinVersionCheck{MinVersion: def.OSVersionCheck.Ios.MinVersion}
+		}
+		if def.OSVersionCheck.Linux != nil {
+			oc.Linux = &nmdata.MinKernelVersionCheck{MinKernelVersion: def.OSVersionCheck.Linux.MinKernelVersion}
+		}
+		if def.OSVersionCheck.Windows != nil {
+			oc.Windows = &nmdata.MinKernelVersionCheck{MinKernelVersion: def.OSVersionCheck.Windows.MinKernelVersion}
+		}
+		out.Checks.OSVersionCheck = oc
+	}
+	if def.GeoLocationCheck != nil {
+		gc := &nmdata.GeoLocationCheck{Action: def.GeoLocationCheck.Action}
+		for _, loc := range def.GeoLocationCheck.Locations {
+			gc.Locations = append(gc.Locations, nmdata.GeoLocation{CountryCode: loc.CountryCode, CityName: loc.CityName})
+		}
+		out.Checks.GeoLocationCheck = gc
+	}
+	if def.PeerNetworkRangeCheck != nil {
+		out.Checks.PeerNetworkRangeCheck = &nmdata.PeerNetworkRangeCheck{
+			Action: def.PeerNetworkRangeCheck.Action,
+			Ranges: def.PeerNetworkRangeCheck.Ranges,
+		}
+	}
+	if def.ProcessCheck != nil {
+		procs := make([]nmdata.Process, 0, len(def.ProcessCheck.Processes))
+		for _, p := range def.ProcessCheck.Processes {
+			procs = append(procs, nmdata.Process{LinuxPath: p.LinuxPath, MacPath: p.MacPath, WindowsPath: p.WindowsPath})
+		}
+		out.Checks.ProcessCheck = &nmdata.ProcessCheck{Processes: procs}
+	}
+	if def.CertificateCheck != nil {
+		out.Checks.CertificateCheck = &nmdata.CertificateCheck{CACertificates: def.CertificateCheck.CACertificates}
+	}
+	return out
+}
+
+// buildAppliedZoneCandidates precomputes the account-level custom DNS zones
+// (record conversion) once; the per-peer distribution-group gate runs in the
+// components calc. Mirrors the account-level half of filterPeerAppliedZones.
+func buildAppliedZoneCandidates(accountZones []*zones.Zone) []networkmap.AppliedZoneCandidate {
+	var out []networkmap.AppliedZoneCandidate
+	for _, zone := range accountZones {
+		if !zone.Enabled || len(zone.Records) == 0 {
+			continue
+		}
+		simpleRecords := make([]nmdata.SimpleRecord, 0, len(zone.Records))
+		for _, record := range zone.Records {
+			var recordType int
+			rData := record.Content
+			switch record.Type {
+			case records.RecordTypeA:
+				recordType = int(dns.TypeA)
+			case records.RecordTypeAAAA:
+				recordType = int(dns.TypeAAAA)
+			case records.RecordTypeCNAME:
+				recordType = int(dns.TypeCNAME)
+				rData = dns.Fqdn(record.Content)
+			default:
+				continue
+			}
+			simpleRecords = append(simpleRecords, nmdata.SimpleRecord{
+				Name:  dns.Fqdn(record.Name),
+				Type:  recordType,
+				Class: nbdns.DefaultClass,
+				TTL:   record.TTL,
+				RData: rData,
+			})
+		}
+		out = append(out, networkmap.AppliedZoneCandidate{
+			DistributionGroups: zone.DistributionGroups,
+			Zone: nmdata.CustomZone{
+				Domain:               dns.Fqdn(zone.Domain),
+				Records:              simpleRecords,
+				SearchDomainDisabled: !zone.EnableSearchDomain,
+				NonAuthoritative:     true,
+			},
+		})
+	}
+	return out
+}
+
+// buildPrivateServiceCandidates precomputes the connected-proxy A records per
+// private service (account-level); the per-peer access-group gate + apex merge
+// run in the components calc. Mirrors the account-level half of
+// SynthesizePrivateServiceZones.
+func (a *Account) buildPrivateServiceCandidates() []networkmap.PrivateServiceCandidate {
+	if len(a.Services) == 0 {
+		return nil
+	}
+	proxyPeersByCluster := a.GetProxyPeers()
+	if len(proxyPeersByCluster) == 0 {
+		return nil
+	}
+
+	var out []networkmap.PrivateServiceCandidate
+	for _, svc := range a.Services {
+		if svc == nil || !svc.Enabled || !svc.Private {
+			continue
+		}
+		if len(svc.AccessGroups) == 0 {
+			continue
+		}
+		proxyPeers := proxyPeersByCluster[svc.ProxyCluster]
+		if len(proxyPeers) == 0 {
+			continue
+		}
+		apex := a.privateServiceDomainZone(svc)
+		if apex == "" {
+			continue
+		}
+
+		var recs []nmdata.SimpleRecord
+		for _, p := range proxyPeers {
+			if p == nil || !p.IP.IsValid() {
+				continue
+			}
+			if p.Status == nil || !p.Status.Connected {
+				continue
+			}
+			recs = append(recs, nmdata.SimpleRecord{
+				Name:  dns.Fqdn(svc.Domain),
+				Type:  int(dns.TypeA),
+				Class: nbdns.DefaultClass,
+				TTL:   privateServiceDNSRecordTTL,
+				RData: p.IP.String(),
+			})
+		}
+		if len(recs) == 0 {
+			continue
+		}
+
+		out = append(out, networkmap.PrivateServiceCandidate{
+			AccessGroups: svc.AccessGroups,
+			Zone: nmdata.CustomZone{
+				Domain:               dns.Fqdn(apex),
+				Records:              recs,
+				NonAuthoritative:     true,
+				SearchDomainDisabled: true,
+			},
+		})
+	}
+	return out
+}
+
+// TwinAccountSettings converts real account settings to the slim nmdata twin.
+// Exported for callers of the twin-based sync response builders.
+func TwinAccountSettings(s *Settings) *nmdata.AccountSettingsInfo {
+	if s == nil {
+		return nil
+	}
+	return &nmdata.AccountSettingsInfo{
+		PeerLoginExpirationEnabled:      s.PeerLoginExpirationEnabled,
+		PeerLoginExpiration:             s.PeerLoginExpiration,
+		PeerInactivityExpirationEnabled: s.PeerInactivityExpirationEnabled,
+		PeerInactivityExpiration:        s.PeerInactivityExpiration,
+		DNSDomain:                       s.DNSDomain,
+		IPv6EnabledGroups:               s.IPv6EnabledGroups,
+		RoutingPeerDNSResolutionEnabled: s.RoutingPeerDNSResolutionEnabled,
+		LazyConnectionEnabled:           s.LazyConnectionEnabled,
+		AutoUpdateVersion:               s.AutoUpdateVersion,
+		AutoUpdateAlways:                s.AutoUpdateAlways,
+		MetricsPushEnabled:              s.MetricsPushEnabled,
+	}
+}
+
+func fromTwinCustomZone(z nmdata.CustomZone) nbdns.CustomZone {
+	records := make([]nbdns.SimpleRecord, 0, len(z.Records))
+	for _, r := range z.Records {
+		records = append(records, nbdns.SimpleRecord{
+			Name:  r.Name,
+			Type:  r.Type,
+			Class: r.Class,
+			TTL:   r.TTL,
+			RData: r.RData,
+		})
+	}
+	return nbdns.CustomZone{
+		Domain:               z.Domain,
+		Records:              records,
+		SearchDomainDisabled: z.SearchDomainDisabled,
+		NonAuthoritative:     z.NonAuthoritative,
+	}
+}
+
+// TwinCustomZone converts a real DNS custom zone to its slim nmdata twin.
+// Exported for the network-map controller's DB-store path, which feeds real
+// zones into the twin-based components calculation.
+func TwinCustomZone(z nbdns.CustomZone) nmdata.CustomZone {
+	records := make([]nmdata.SimpleRecord, 0, len(z.Records))
+	for _, r := range z.Records {
+		records = append(records, nmdata.SimpleRecord{
+			Name:  r.Name,
+			Type:  r.Type,
+			Class: r.Class,
+			TTL:   r.TTL,
+			RData: r.RData,
+		})
+	}
+	return nmdata.CustomZone{
+		Domain:               z.Domain,
+		Records:              records,
+		SearchDomainDisabled: z.SearchDomainDisabled,
+		NonAuthoritative:     z.NonAuthoritative,
+	}
+}
+
+// twinProxyDomains converts the account's registered reverse-proxy domains to
+// their slim twins, so private-service zone apex resolution runs on the twin.
+func twinProxyDomains(domains []*proxydomain.Domain) []nmdata.ProxyDomain {
+	if len(domains) == 0 {
+		return nil
+	}
+	out := make([]nmdata.ProxyDomain, 0, len(domains))
+	for _, d := range domains {
+		if d == nil {
+			continue
+		}
+		out = append(out, nmdata.ProxyDomain{Domain: d.Domain, TargetCluster: d.TargetCluster})
+	}
+	return out
+}
diff --git a/management/server/types/account_posture_validation_test.go b/management/server/types/account_posture_validation_test.go
new file mode 100644
index 000000000..69a744bea
--- /dev/null
+++ b/management/server/types/account_posture_validation_test.go
@@ -0,0 +1,72 @@
+package types_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/management/server/posture"
+)
+
+func TestPrecomputePostureValidation_MatchesDirectEvaluation(t *testing.T) {
+	account, validatedPeers := scalableTestAccount(60, 5)
+
+	account.PostureChecks = append(account.PostureChecks, &posture.Checks{
+		ID: "posture-check-strict", Name: "Strict version",
+		Checks: posture.ChecksDefinition{
+			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.50.0"},
+		},
+	})
+	account.Policies[0].SourcePostureChecks = []string{"posture-check-ver", "posture-check-unknown"}
+	account.Policies[1].SourcePostureChecks = []string{"posture-check-strict"}
+	account.Policies[2].SourcePostureChecks = []string{"posture-check-ver"}
+	account.Policies[2].Enabled = false
+
+	ctx := context.Background()
+	resourcePolicies := account.GetResourcePoliciesMap()
+	routers := account.GetResourceRoutersMap()
+
+	type result struct {
+		peers              map[string]struct{}
+		postureFailedPeers map[string]map[string]struct{}
+	}
+	snapshot := func() map[string]result {
+		results := make(map[string]result, len(account.Peers))
+		for peerID := range account.Peers {
+			components := account.GetPeerNetworkMapComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil)
+			require.NotNil(t, components)
+			peerSet := make(map[string]struct{}, len(components.Peers))
+			for id := range components.Peers {
+				peerSet[id] = struct{}{}
+			}
+			results[peerID] = result{peers: peerSet, postureFailedPeers: components.PostureFailedPeers}
+		}
+		return results
+	}
+
+	direct := snapshot()
+	account.PrecomputePostureValidation(ctx)
+	memoized := snapshot()
+
+	require.Equal(t, len(direct), len(memoized))
+	for peerID, want := range direct {
+		got := memoized[peerID]
+		assert.Equal(t, want.peers, got.peers, "visible peers changed for %s", peerID)
+		assert.Equal(t, want.postureFailedPeers, got.postureFailedPeers, "posture failed peers changed for %s", peerID)
+	}
+}
+
+func TestPrecomputePostureValidation_NoPostureChecks(t *testing.T) {
+	account, validatedPeers := scalableTestAccount(10, 2)
+	account.PostureChecks = nil
+
+	ctx := context.Background()
+	account.PrecomputePostureValidation(ctx)
+
+	components := account.GetPeerNetworkMapComponents(ctx, "peer-0", nbdns.CustomZone{}, nil, validatedPeers, account.GetResourcePoliciesMap(), account.GetResourceRoutersMap(), nil)
+	require.NotNil(t, components)
+	assert.NotEmpty(t, components.Peers)
+}
diff --git a/management/server/types/account_private_netmap_test.go b/management/server/types/account_private_netmap_test.go
index dc097ce26..5dccfbf30 100644
--- a/management/server/types/account_private_netmap_test.go
+++ b/management/server/types/account_private_netmap_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 func TestPrivateService_NetworkMap_UserPeer_AndProxyPeer(t *testing.T) {
@@ -18,7 +18,6 @@ func TestPrivateService_NetworkMap_UserPeer_AndProxyPeer(t *testing.T) {
 	account.Peers["proxy-peer"].Meta.WtVersion = "0.50.0"
 
 	ctx := context.Background()
-	account.InjectProxyPolicies(ctx)
 
 	validated := map[string]struct{}{
 		"user-peer":  {},
@@ -49,7 +48,7 @@ func TestPrivateService_NetworkMap_UserPeer_AndProxyPeer(t *testing.T) {
 	})
 }
 
-func netmapPeerIDs(peers []*nbpeer.Peer) []string {
+func netmapPeerIDs(peers []*nmdata.Peer) []string {
 	ids := make([]string, 0, len(peers))
 	for _, p := range peers {
 		if p == nil {
diff --git a/management/server/types/account_test.go b/management/server/types/account_test.go
index d8e2e1f8c..063b2d7e7 100644
--- a/management/server/types/account_test.go
+++ b/management/server/types/account_test.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
+	"strings"
 	"testing"
 
 	"github.com/miekg/dns"
@@ -13,13 +14,12 @@ import (
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
-	"github.com/netbirdio/netbird/management/internals/modules/zones"
-	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 func setupTestAccount() *Account {
@@ -666,7 +666,7 @@ func Test_ExpandPortsAndRanges_SSHRuleExpansion(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := expandPortsAndRanges(tt.base, tt.rule, tt.peer)
+			result := ExpandPortsAndRanges(tt.base, tt.rule, tt.peer)
 
 			var ports []string
 			for _, fr := range result {
@@ -1040,518 +1040,6 @@ func Test_FilterZoneRecordsForPeers(t *testing.T) {
 	}
 }
 
-func Test_filterPeerAppliedZones(t *testing.T) {
-	ctx := context.Background()
-
-	tests := []struct {
-		name         string
-		accountZones []*zones.Zone
-		peerGroups   LookupMap
-		expected     []nbdns.CustomZone
-	}{
-		{
-			name:         "empty peer groups returns empty custom zones",
-			accountZones: []*zones.Zone{},
-			peerGroups:   LookupMap{},
-			expected:     []nbdns.CustomZone{},
-		},
-		{
-			name: "peer has access to zone with A record",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "example.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group1"},
-					Records: []*records.Record{
-						{
-							ID:      "record1",
-							Name:    "www.example.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.1",
-							TTL:     300,
-						},
-					},
-				},
-			},
-			peerGroups: LookupMap{"group1": struct{}{}},
-			expected: []nbdns.CustomZone{
-				{
-					Domain: "example.com.",
-					Records: []nbdns.SimpleRecord{
-						{
-							Name:  "www.example.com.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   300,
-							RData: "192.168.1.1",
-						},
-					},
-					SearchDomainDisabled: true,
-				},
-			},
-		},
-		{
-			name: "peer has access to zone with search domain enabled",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "internal.local",
-					Enabled:            true,
-					EnableSearchDomain: true,
-					DistributionGroups: []string{"group1"},
-					Records: []*records.Record{
-						{
-							ID:      "record1",
-							Name:    "api.internal.local",
-							Type:    records.RecordTypeA,
-							Content: "10.0.0.1",
-							TTL:     600,
-						},
-					},
-				},
-			},
-			peerGroups: LookupMap{"group1": struct{}{}},
-			expected: []nbdns.CustomZone{
-				{
-					Domain: "internal.local.",
-					Records: []nbdns.SimpleRecord{
-						{
-							Name:  "api.internal.local.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   600,
-							RData: "10.0.0.1",
-						},
-					},
-					SearchDomainDisabled: false,
-				},
-			},
-		},
-		{
-			name: "peer has no access to zone",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "private.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group2"},
-					Records: []*records.Record{
-						{
-							ID:      "record1",
-							Name:    "secret.private.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.1",
-							TTL:     300,
-						},
-					},
-				},
-			},
-			peerGroups: LookupMap{"group1": struct{}{}},
-			expected:   []nbdns.CustomZone{},
-		},
-		{
-			name: "disabled zone is filtered out",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "disabled.com",
-					Enabled:            false,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group1"},
-					Records: []*records.Record{
-						{
-							ID:      "record1",
-							Name:    "www.disabled.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.1",
-							TTL:     300,
-						},
-					},
-				},
-			},
-			peerGroups: LookupMap{"group1": struct{}{}},
-			expected:   []nbdns.CustomZone{},
-		},
-		{
-			name: "zone with no records is filtered out",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "empty.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group1"},
-					Records:            []*records.Record{},
-				},
-			},
-			peerGroups: LookupMap{"group1": struct{}{}},
-			expected:   []nbdns.CustomZone{},
-		},
-		{
-			name: "peer has access via multiple groups",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "multi.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group1", "group2", "group3"},
-					Records: []*records.Record{
-						{
-							ID:      "record1",
-							Name:    "www.multi.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.1",
-							TTL:     300,
-						},
-					},
-				},
-			},
-			peerGroups: LookupMap{"group2": struct{}{}},
-			expected: []nbdns.CustomZone{
-				{
-					Domain: "multi.com.",
-					Records: []nbdns.SimpleRecord{
-						{
-							Name:  "www.multi.com.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   300,
-							RData: "192.168.1.1",
-						},
-					},
-					SearchDomainDisabled: true,
-				},
-			},
-		},
-		{
-			name: "multiple zones with mixed access",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "allowed.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group1"},
-					Records: []*records.Record{
-						{
-							ID:      "record1",
-							Name:    "www.allowed.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.1",
-							TTL:     300,
-						},
-					},
-				},
-				{
-					ID:                 "zone2",
-					Domain:             "denied.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group2"},
-					Records: []*records.Record{
-						{
-							ID:      "record2",
-							Name:    "www.denied.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.2",
-							TTL:     300,
-						},
-					},
-				},
-			},
-			peerGroups: LookupMap{"group1": struct{}{}},
-			expected: []nbdns.CustomZone{
-				{
-					Domain: "allowed.com.",
-					Records: []nbdns.SimpleRecord{
-						{
-							Name:  "www.allowed.com.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   300,
-							RData: "192.168.1.1",
-						},
-					},
-					SearchDomainDisabled: true,
-				},
-			},
-		},
-		{
-			name: "zone with multiple record types",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "mixed.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group1"},
-					Records: []*records.Record{
-						{
-							ID:      "record1",
-							Name:    "www.mixed.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.1",
-							TTL:     300,
-						},
-						{
-							ID:      "record2",
-							Name:    "ipv6.mixed.com",
-							Type:    records.RecordTypeAAAA,
-							Content: "2001:db8::1",
-							TTL:     600,
-						},
-						{
-							ID:      "record3",
-							Name:    "alias.mixed.com",
-							Type:    records.RecordTypeCNAME,
-							Content: "www.mixed.com",
-							TTL:     900,
-						},
-					},
-				},
-			},
-			peerGroups: LookupMap{"group1": struct{}{}},
-			expected: []nbdns.CustomZone{
-				{
-					Domain: "mixed.com.",
-					Records: []nbdns.SimpleRecord{
-						{
-							Name:  "www.mixed.com.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   300,
-							RData: "192.168.1.1",
-						},
-						{
-							Name:  "ipv6.mixed.com.",
-							Type:  int(dns.TypeAAAA),
-							Class: nbdns.DefaultClass,
-							TTL:   600,
-							RData: "2001:db8::1",
-						},
-						{
-							Name:  "alias.mixed.com.",
-							Type:  int(dns.TypeCNAME),
-							Class: nbdns.DefaultClass,
-							TTL:   900,
-							RData: "www.mixed.com.",
-						},
-					},
-					SearchDomainDisabled: true,
-				},
-			},
-		},
-		{
-			name: "multiple zones both accessible",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "first.com",
-					Enabled:            true,
-					EnableSearchDomain: true,
-					DistributionGroups: []string{"group1"},
-					Records: []*records.Record{
-						{
-							ID:      "record1",
-							Name:    "www.first.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.1",
-							TTL:     300,
-						},
-					},
-				},
-				{
-					ID:                 "zone2",
-					Domain:             "second.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group1"},
-					Records: []*records.Record{
-						{
-							ID:      "record2",
-							Name:    "www.second.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.2",
-							TTL:     600,
-						},
-					},
-				},
-			},
-			peerGroups: LookupMap{"group1": struct{}{}},
-			expected: []nbdns.CustomZone{
-				{
-					Domain: "first.com.",
-					Records: []nbdns.SimpleRecord{
-						{
-							Name:  "www.first.com.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   300,
-							RData: "192.168.1.1",
-						},
-					},
-					SearchDomainDisabled: false,
-				},
-				{
-					Domain: "second.com.",
-					Records: []nbdns.SimpleRecord{
-						{
-							Name:  "www.second.com.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   600,
-							RData: "192.168.1.2",
-						},
-					},
-					SearchDomainDisabled: true,
-				},
-			},
-		},
-		{
-			name: "zone with multiple records of same type",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "multi-a.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group1"},
-					Records: []*records.Record{
-						{
-							ID:      "record1",
-							Name:    "www.multi-a.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.1",
-							TTL:     300,
-						},
-						{
-							ID:      "record2",
-							Name:    "www.multi-a.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.2",
-							TTL:     300,
-						},
-					},
-				},
-			},
-			peerGroups: LookupMap{"group1": struct{}{}},
-			expected: []nbdns.CustomZone{
-				{
-					Domain: "multi-a.com.",
-					Records: []nbdns.SimpleRecord{
-						{
-							Name:  "www.multi-a.com.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   300,
-							RData: "192.168.1.1",
-						},
-						{
-							Name:  "www.multi-a.com.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   300,
-							RData: "192.168.1.2",
-						},
-					},
-					SearchDomainDisabled: true,
-				},
-			},
-		},
-		{
-			name: "peer in multiple groups accessing different zones",
-			accountZones: []*zones.Zone{
-				{
-					ID:                 "zone1",
-					Domain:             "zone1.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group1"},
-					Records: []*records.Record{
-						{
-							ID:      "record1",
-							Name:    "www.zone1.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.1",
-							TTL:     300,
-						},
-					},
-				},
-				{
-					ID:                 "zone2",
-					Domain:             "zone2.com",
-					Enabled:            true,
-					EnableSearchDomain: false,
-					DistributionGroups: []string{"group2"},
-					Records: []*records.Record{
-						{
-							ID:      "record2",
-							Name:    "www.zone2.com",
-							Type:    records.RecordTypeA,
-							Content: "192.168.1.2",
-							TTL:     300,
-						},
-					},
-				},
-			},
-			peerGroups: LookupMap{"group1": struct{}{}, "group2": struct{}{}},
-			expected: []nbdns.CustomZone{
-				{
-					Domain: "zone1.com.",
-					Records: []nbdns.SimpleRecord{
-						{
-							Name:  "www.zone1.com.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   300,
-							RData: "192.168.1.1",
-						},
-					},
-					SearchDomainDisabled: true,
-				},
-				{
-					Domain: "zone2.com.",
-					Records: []nbdns.SimpleRecord{
-						{
-							Name:  "www.zone2.com.",
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   300,
-							RData: "192.168.1.2",
-						},
-					},
-					SearchDomainDisabled: true,
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := filterPeerAppliedZones(ctx, tt.accountZones, tt.peerGroups)
-			require.Equal(t, len(tt.expected), len(result), "number of custom zones should match")
-
-			for i, expectedZone := range tt.expected {
-				assert.Equal(t, expectedZone.Domain, result[i].Domain, "domain should match")
-				assert.Equal(t, expectedZone.SearchDomainDisabled, result[i].SearchDomainDisabled, "search domain disabled flag should match")
-				assert.Equal(t, len(expectedZone.Records), len(result[i].Records), "number of records should match")
-
-				for j, expectedRecord := range expectedZone.Records {
-					assert.Equal(t, expectedRecord.Name, result[i].Records[j].Name, "record name should match")
-					assert.Equal(t, expectedRecord.Type, result[i].Records[j].Type, "record type should match")
-					assert.Equal(t, expectedRecord.Class, result[i].Records[j].Class, "record class should match")
-					assert.Equal(t, expectedRecord.TTL, result[i].Records[j].TTL, "record TTL should match")
-					assert.Equal(t, expectedRecord.RData, result[i].Records[j].RData, "record RData should match")
-				}
-			}
-		})
-	}
-}
-
 func TestInjectPrivateServicePolicies_ProxyPeerGetsInboundRule(t *testing.T) {
 	ctx := context.Background()
 
@@ -1564,6 +1052,7 @@ func TestInjectPrivateServicePolicies_ProxyPeerGetsInboundRule(t *testing.T) {
 			Identifier: "net-1",
 			Net:        net.IPNet{IP: net.ParseIP("100.64.0.0"), Mask: net.CIDRMask(10, 32)},
 		},
+		Settings: &Settings{},
 		Peers: map[string]*nbpeer.Peer{
 			"user-peer": {
 				ID:        "user-peer",
@@ -1614,41 +1103,25 @@ func TestInjectPrivateServicePolicies_ProxyPeerGetsInboundRule(t *testing.T) {
 		},
 	}
 
-	account.InjectProxyPolicies(ctx)
-
-	var found *Policy
-	for _, p := range account.Policies {
-		if p != nil && p.ID == "private-access-svc-1-proxy-peer" {
-			found = p
-			break
-		}
-	}
-	require.NotNil(t, found, "expected synthesised private-access policy in account.Policies")
+	found := findPolicy(injectedPolicies(account), "private-access-svc-1-proxy-peer")
+	require.NotNil(t, found, "expected synthesised private-access policy in the twin store")
 	require.Len(t, found.Rules, 1, "policy should have exactly one rule")
 	rule := found.Rules[0]
 	assert.Equal(t, []string{"grp-admins"}, rule.Sources, "sources should be group IDs verbatim")
 	assert.Equal(t, "proxy-peer", rule.DestinationResource.ID, "destination resource should be the proxy peer ID")
-	assert.Equal(t, ResourceTypePeer, rule.DestinationResource.Type, "destination resource type should be peer")
+	assert.Equal(t, string(ResourceTypePeer), rule.DestinationResource.Type, "destination resource type should be peer")
 
 	validatedPeersMap := map[string]struct{}{
 		"user-peer":  {},
 		"proxy-peer": {},
 	}
 
-	proxyPeer := account.Peers["proxy-peer"]
-	aclPeers, firewallRules, _, _ := account.GetPeerConnectionResources(ctx, proxyPeer, validatedPeersMap, nil)
+	nm := account.GetPeerNetworkMapFromComponents(ctx, "proxy-peer", nbdns.CustomZone{}, nil, validatedPeersMap, nil, nil, nil, nil)
 
-	var sawUserAsAclPeer bool
-	for _, p := range aclPeers {
-		if p.ID == "user-peer" {
-			sawUserAsAclPeer = true
-			break
-		}
-	}
-	assert.True(t, sawUserAsAclPeer, "proxy peer should see the user peer as an ACL peer")
+	assert.Contains(t, netmapPeerIDs(nm.Peers), "user-peer", "proxy peer should see the user peer as an ACL peer")
 
 	var inboundRules []*FirewallRule
-	for _, r := range firewallRules {
+	for _, r := range nm.FirewallRules {
 		if r.Direction == FirewallRuleDirectionIN && r.PeerIP == userPeerIP.String() {
 			inboundRules = append(inboundRules, r)
 		}
@@ -1657,29 +1130,23 @@ func TestInjectPrivateServicePolicies_ProxyPeerGetsInboundRule(t *testing.T) {
 }
 
 func TestInjectPrivateServicePolicies_NotPrivate_NoPolicy(t *testing.T) {
-	ctx := context.Background()
 	account := privateServiceTestAccount(t)
 	account.Services[0].Private = false
 
-	account.InjectProxyPolicies(ctx)
 	assert.False(t, hasPrivateAccessPolicy(account, "svc-1"), "non-private service must not synthesise an access policy")
 }
 
 func TestInjectPrivateServicePolicies_EmptyAccessGroups_NoPolicy(t *testing.T) {
-	ctx := context.Background()
 	account := privateServiceTestAccount(t)
 	account.Services[0].AccessGroups = nil
 
-	account.InjectProxyPolicies(ctx)
 	assert.False(t, hasPrivateAccessPolicy(account, "svc-1"), "private service with no access groups must not synthesise a policy")
 }
 
 func TestInjectPrivateServicePolicies_NoProxyPeers_NoPolicy(t *testing.T) {
-	ctx := context.Background()
 	account := privateServiceTestAccount(t)
 	delete(account.Peers, "proxy-peer")
 
-	account.InjectProxyPolicies(ctx)
 	assert.False(t, hasPrivateAccessPolicy(account, "svc-1"), "policy must not synthesise when the cluster has no proxy peers")
 }
 
@@ -1742,12 +1209,101 @@ func privateServiceTestAccount(t *testing.T) *Account {
 	}
 }
 
+// injectedPolicies returns the twin's policies with the synthesised proxy ACLs
+// already in place, the way the per-peer computation sees them.
+func injectedPolicies(account *Account) []*nmdata.Policy {
+	nmd := account.toNetworkMapData(nil, nil, nil, nil, nil)
+	nmd.InjectProxyPolicies()
+	return nmd.Policies
+}
+
+func findPolicy(policies []*nmdata.Policy, id string) *nmdata.Policy {
+	for _, p := range policies {
+		if p != nil && p.ID == id {
+			return p
+		}
+	}
+	return nil
+}
+
 func hasPrivateAccessPolicy(account *Account, serviceID string) bool {
 	prefix := "private-access-" + serviceID + "-"
-	for _, p := range account.Policies {
-		if p != nil && len(p.ID) > len(prefix) && p.ID[:len(prefix)] == prefix {
+	for _, p := range injectedPolicies(account) {
+		if p != nil && strings.HasPrefix(p.ID, prefix) {
 			return true
 		}
 	}
 	return false
 }
+
+func TestForcesRoutingPeerDNSResolution(t *testing.T) {
+	buildAccountRes := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType, resType resourceTypes.NetworkResourceType) *Account {
+		return &Account{
+			Id: "accountID",
+			Groups: map[string]*Group{
+				"router-group": {ID: "router-group", Peers: []string{"router-peer-grp"}},
+			},
+			NetworkRouters: []*routerTypes.NetworkRouter{
+				{ID: "r1", NetworkID: "net-1", AccountID: "accountID", Peer: "router-peer", Enabled: true},
+				{ID: "r2", NetworkID: "net-1", AccountID: "accountID", PeerGroups: []string{"router-group"}, Enabled: true},
+			},
+			NetworkResources: []*resourceTypes.NetworkResource{
+				{ID: "res-domain", AccountID: "accountID", NetworkID: "net-1", Type: resType, Domain: "example.org", Enabled: resourceEnabled},
+			},
+			Services: []*service.Service{
+				{
+					ID: "svc-1", AccountID: "accountID", Enabled: serviceEnabled,
+					Targets: []*service.Target{
+						{TargetId: "res-domain", TargetType: targetType, Enabled: targetEnabled},
+					},
+				},
+			},
+		}
+	}
+
+	buildAccount := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType) *Account {
+		return buildAccountRes(serviceEnabled, targetEnabled, resourceEnabled, targetType, resourceTypes.Domain)
+	}
+
+	forced := func(account *Account, peerID string) bool {
+		nmd := account.toNetworkMapData(nil, nil, nil, account.GetResourceRoutersMap(), nil)
+		return nmd.GetPeerNetworkMapComponents(peerID, nmdata.CustomZone{}).ForceRoutingPeerDNSResolution
+	}
+
+	t.Run("router peer for RP-targeted domain resource is forced", func(t *testing.T) {
+		account := buildAccount(true, true, true, service.TargetTypeDomain)
+		assert.True(t, forced(account, "router-peer"), "direct router peer should be forced")
+		assert.True(t, forced(account, "router-peer-grp"), "group-member router peer should be forced")
+	})
+
+	t.Run("non-router peer is not forced", func(t *testing.T) {
+		account := buildAccount(true, true, true, service.TargetTypeDomain)
+		assert.False(t, forced(account, "other-peer"))
+	})
+
+	t.Run("not forced when service disabled", func(t *testing.T) {
+		account := buildAccount(false, true, true, service.TargetTypeDomain)
+		assert.False(t, forced(account, "router-peer"))
+	})
+
+	t.Run("not forced when target disabled", func(t *testing.T) {
+		account := buildAccount(true, false, true, service.TargetTypeDomain)
+		assert.False(t, forced(account, "router-peer"))
+	})
+
+	t.Run("not forced when resource disabled", func(t *testing.T) {
+		account := buildAccount(true, true, false, service.TargetTypeDomain)
+		assert.False(t, forced(account, "router-peer"))
+	})
+
+	t.Run("not forced for non-domain target type", func(t *testing.T) {
+		account := buildAccount(true, true, true, service.TargetTypePeer)
+		assert.False(t, forced(account, "router-peer"))
+	})
+
+	t.Run("not forced when targeted resource is not a domain", func(t *testing.T) {
+		account := buildAccountRes(true, true, true, service.TargetTypeDomain, resourceTypes.Host)
+		assert.False(t, forced(account, "router-peer"),
+			"a domain target pointing at a non-domain resource must not force resolution")
+	})
+}
diff --git a/management/server/types/aliases.go b/management/server/types/aliases.go
new file mode 100644
index 000000000..fa9af12f8
--- /dev/null
+++ b/management/server/types/aliases.go
@@ -0,0 +1,99 @@
+package types
+
+import (
+	"context"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	nbroute "github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	sharedtypes "github.com/netbirdio/netbird/shared/management/types"
+)
+
+// Type aliases for types relocated to shared/management/types so that the
+// client-side compute path can depend on them
+
+type FirewallRule = sharedtypes.FirewallRule
+
+type NetworkMap = sharedtypes.NetworkMap
+
+type PolicyTrafficActionType = sharedtypes.PolicyTrafficActionType
+type PolicyRuleProtocolType = sharedtypes.PolicyRuleProtocolType
+type RulePortRange = sharedtypes.RulePortRange
+
+type ResourceType = sharedtypes.ResourceType
+
+type RouteFirewallRule = sharedtypes.RouteFirewallRule
+
+type NetworkMapComponents = sharedtypes.NetworkMapComponents
+
+var EmptyNetworkMapComponents = sharedtypes.EmptyNetworkMapComponents
+
+type AccountSettingsInfo = sharedtypes.AccountSettingsInfo
+
+type GroupCompact = sharedtypes.GroupCompact
+type NetworkMapComponentsCompact = sharedtypes.NetworkMapComponentsCompact
+
+type LookupMap = sharedtypes.LookupMap
+type FirewallRuleContext = sharedtypes.FirewallRuleContext
+
+// Function forwarders preserve types.X(...) call sites that previously
+// resolved to package-local funcs. Plain forwarders (not var aliases) keep
+// the symbol immutable and allow the inliner to flatten the call.
+
+func ParseRuleString(rule string) (PolicyRuleProtocolType, RulePortRange, error) {
+	return sharedtypes.ParseRuleString(rule)
+}
+
+func PolicyRuleImpliesLegacySSH(rule *PolicyRule) bool {
+	return nmdata.PolicyRuleImpliesLegacySSH(twinRule(rule))
+}
+
+// ExpandPortsAndRanges / AppendIPv6FirewallRule / GenerateRouteFirewallRules
+// forward to the shared twin-typed helpers, converting the real types the
+// legacy Account calc still uses to nmdata twins at this boundary.
+
+func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *nbpeer.Peer) []*FirewallRule {
+	return sharedtypes.ExpandPortsAndRanges(base, twinRule(rule), twinPeer(peer))
+}
+
+func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *nbpeer.Peer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
+	return sharedtypes.AppendIPv6FirewallRule(rules, rulesExists, twinPeer(peer), twinPeer(targetPeer), twinRule(rule), rc)
+}
+
+func CalculateNetworkMapFromComponents(ctx context.Context, components *NetworkMapComponents) *NetworkMap {
+	return sharedtypes.CalculateNetworkMapFromComponents(ctx, components)
+}
+
+func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
+	return sharedtypes.GenerateRouteFirewallRules(ctx, twinRoute(route), twinRule(rule), TwinPeers(groupPeers), direction, includeIPv6)
+}
+
+const (
+	FirewallRuleDirectionIN  = sharedtypes.FirewallRuleDirectionIN
+	FirewallRuleDirectionOUT = sharedtypes.FirewallRuleDirectionOUT
+)
+
+const (
+	AllowedIPsFormat   = sharedtypes.AllowedIPsFormat
+	AllowedIPsV6Format = sharedtypes.AllowedIPsV6Format
+)
+
+const (
+	ResourceTypePeer   = sharedtypes.ResourceTypePeer
+	ResourceTypeDomain = sharedtypes.ResourceTypeDomain
+	ResourceTypeHost   = sharedtypes.ResourceTypeHost
+	ResourceTypeSubnet = sharedtypes.ResourceTypeSubnet
+)
+
+const (
+	PolicyTrafficActionAccept = sharedtypes.PolicyTrafficActionAccept
+	PolicyTrafficActionDrop   = sharedtypes.PolicyTrafficActionDrop
+)
+
+const (
+	PolicyRuleProtocolALL        = sharedtypes.PolicyRuleProtocolALL
+	PolicyRuleProtocolTCP        = sharedtypes.PolicyRuleProtocolTCP
+	PolicyRuleProtocolUDP        = sharedtypes.PolicyRuleProtocolUDP
+	PolicyRuleProtocolICMP       = sharedtypes.PolicyRuleProtocolICMP
+	PolicyRuleProtocolNetbirdSSH = sharedtypes.PolicyRuleProtocolNetbirdSSH
+)
diff --git a/management/server/types/group.go b/management/server/types/group.go
index b4f50080a..ac0a2a7f2 100644
--- a/management/server/types/group.go
+++ b/management/server/types/group.go
@@ -1,8 +1,8 @@
 package types
 
 import (
-	"github.com/netbirdio/netbird/management/server/integration_reference"
-	"github.com/netbirdio/netbird/management/server/networks/resources/types"
+	"github.com/netbirdio/netbird/shared/management/integration_reference"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 const (
@@ -19,6 +19,8 @@ type Group struct {
 	// AccountID is a reference to Account that this object belongs
 	AccountID string `json:"-" gorm:"index"`
 
+	PublicID string `json:"-"`
+
 	// Name visible in the UI
 	Name string
 
@@ -66,7 +68,7 @@ func (g *Group) EventMeta() map[string]any {
 	return map[string]any{"name": g.Name}
 }
 
-func (g *Group) EventMetaResource(resource *types.NetworkResource) map[string]any {
+func (g *Group) EventMetaResource(resource *nmdata.NetworkResource) map[string]any {
 	return map[string]any{"name": g.Name, "id": g.ID, "resource_name": resource.Name, "resource_id": resource.ID, "resource_type": resource.Type}
 }
 
@@ -74,6 +76,7 @@ func (g *Group) Copy() *Group {
 	group := &Group{
 		ID:                   g.ID,
 		AccountID:            g.AccountID,
+		PublicID:             g.PublicID,
 		Name:                 g.Name,
 		Issued:               g.Issued,
 		Peers:                make([]string, len(g.Peers)),
diff --git a/management/server/types/identity_provider.go b/management/server/types/identity_provider.go
index 0c1f9509c..f75b5319d 100644
--- a/management/server/types/identity_provider.go
+++ b/management/server/types/identity_provider.go
@@ -3,6 +3,7 @@ package types
 import (
 	"errors"
 	"net/url"
+	"strings"
 )
 
 // Identity provider validation errors
@@ -99,7 +100,16 @@ func (idp *IdentityProvider) Validate() error {
 	}
 	if idp.Issuer != "" {
 		parsedURL, err := url.Parse(idp.Issuer)
-		if err != nil || parsedURL.Scheme == "" || parsedURL.Host == "" {
+		if err != nil || parsedURL.Host == "" {
+			return ErrIdentityProviderIssuerInvalid
+		}
+		if parsedURL.Scheme != "https" {
+			return ErrIdentityProviderIssuerInvalid
+		}
+		if parsedURL.User != nil {
+			return ErrIdentityProviderIssuerInvalid
+		}
+		if strings.ContainsAny(idp.Issuer, "?#") {
 			return ErrIdentityProviderIssuerInvalid
 		}
 	}
diff --git a/management/server/types/identity_provider_test.go b/management/server/types/identity_provider_test.go
index 6ddc563f2..53385c5ac 100644
--- a/management/server/types/identity_provider_test.go
+++ b/management/server/types/identity_provider_test.go
@@ -135,3 +135,54 @@ func TestIdentityProvider_Validate(t *testing.T) {
 		})
 	}
 }
+
+func TestIdentityProvider_ValidateRejectsNonOriginIssuers(t *testing.T) {
+	issuers := []string{
+		"https://idp.example.com/realms/nb?foo=bar",
+		"https://idp.example.com/realms/nb#section",
+		"https://user:pass@idp.example.com",
+		"ftp://idp.example.com",
+		"ldap://idp.example.com",
+		"http://idp.example.com",
+	}
+
+	for _, issuer := range issuers {
+		t.Run(issuer, func(t *testing.T) {
+			idp := &IdentityProvider{
+				Name:     "test",
+				Type:     IdentityProviderTypeOIDC,
+				Issuer:   issuer,
+				ClientID: "client-id",
+			}
+			assert.ErrorIs(t, idp.Validate(), ErrIdentityProviderIssuerInvalid)
+		})
+	}
+}
+
+func TestIdentityProvider_ValidateAcceptsOriginAndPath(t *testing.T) {
+	for _, issuer := range []string{"https://idp.example.com", "https://idp.example.com/realms/nb", "https://127.0.0.1:5556/dex"} {
+		t.Run(issuer, func(t *testing.T) {
+			idp := &IdentityProvider{
+				Name:     "test",
+				Type:     IdentityProviderTypeOIDC,
+				Issuer:   issuer,
+				ClientID: "client-id",
+			}
+			assert.NoError(t, idp.Validate())
+		})
+	}
+}
+
+func TestIdentityProviderValidateRejectsBareDelimiters(t *testing.T) {
+	for _, issuer := range []string{"https://idp.example.com/realms/nb?", "https://idp.example.com/realms/nb#"} {
+		t.Run(issuer, func(t *testing.T) {
+			idp := &IdentityProvider{
+				Name:     "test",
+				Type:     IdentityProviderTypeOIDC,
+				Issuer:   issuer,
+				ClientID: "client-id",
+			}
+			assert.ErrorIs(t, idp.Validate(), ErrIdentityProviderIssuerInvalid)
+		})
+	}
+}
diff --git a/management/server/types/ipv6_endtoend_test.go b/management/server/types/ipv6_endtoend_test.go
index ddd1f649f..76c61369e 100644
--- a/management/server/types/ipv6_endtoend_test.go
+++ b/management/server/types/ipv6_endtoend_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 func TestNetworkMapComponents_IPv6EndToEnd(t *testing.T) {
@@ -104,7 +105,7 @@ func TestNetworkMapComponents_RemotePeerWithoutCapability(t *testing.T) {
 	require.NotNil(t, nm)
 
 	t.Run("AllowedIPs include remote v6", func(t *testing.T) {
-		var dst *nbpeer.Peer
+		var dst *nmdata.Peer
 		for _, p := range nm.Peers {
 			if p.ID == "peer-dst-1" {
 				dst = p
diff --git a/management/server/types/job.go b/management/server/types/job.go
index bad8f00ba..db2d0d42c 100644
--- a/management/server/types/job.go
+++ b/management/server/types/job.go
@@ -3,10 +3,12 @@ package types
 import (
 	"encoding/json"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
 
+	"github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
@@ -150,6 +152,21 @@ func validateAndBuildBundleParams(req api.WorkloadRequest, workload *Workload) e
 	if bundle.Parameters.LogFileCount < 1 || bundle.Parameters.LogFileCount > 1000 {
 		return fmt.Errorf("log-file-count must be between 1 and 1000, got %d", bundle.Parameters.LogFileCount)
 	}
+	// validate anonymize_level: omitted or empty defaults on the client;
+	// otherwise it must name a known level. An unknown value is rejected here
+	// rather than silently escalated, so a typo surfaces at job creation. The
+	// normalized (trimmed, lowercased) value is persisted so it matches what
+	// the client parses — the client only lowercases, so a stored " default "
+	// would otherwise resolve to strict.
+	if lvl := bundle.Parameters.AnonymizeLevel; lvl != nil {
+		normalized := strings.ToLower(strings.TrimSpace(*lvl))
+		switch normalized {
+		case "", anonymize.LevelDefaultString, anonymize.LevelStrictString:
+		default:
+			return fmt.Errorf("anonymize_level must be %q or %q, got %q", anonymize.LevelDefaultString, anonymize.LevelStrictString, *lvl)
+		}
+		bundle.Parameters.AnonymizeLevel = &normalized
+	}
 
 	workload.Parameters, err = json.Marshal(bundle.Parameters)
 	if err != nil {
@@ -209,6 +226,17 @@ func (j *Job) ToStreamJobRequest() (*proto.JobRequest, error) {
 	}
 }
 
+// derefString returns the pointed-to string, or "" when the pointer is nil.
+// The bundle parameters carry anonymize_level and upload_url as optional
+// fields; an absent value maps to the empty proto string, which the client
+// resolves to its default.
+func derefString(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
+
 func (j *Job) buildStreamBundleResponse() (*proto.JobRequest, error) {
 	var p api.BundleParameters
 	if err := json.Unmarshal(j.Workload.Parameters, &p); err != nil {
@@ -218,10 +246,12 @@ func (j *Job) buildStreamBundleResponse() (*proto.JobRequest, error) {
 		ID: []byte(j.ID),
 		WorkloadParameters: &proto.JobRequest_Bundle{
 			Bundle: &proto.BundleParameters{
-				BundleFor:     p.BundleFor,
-				BundleForTime: int64(p.BundleForTime),
-				LogFileCount:  int32(p.LogFileCount),
-				Anonymize:     p.Anonymize,
+				BundleFor:      p.BundleFor,
+				BundleForTime:  int64(p.BundleForTime),
+				LogFileCount:   int32(p.LogFileCount),
+				Anonymize:      p.Anonymize,
+				AnonymizeLevel: derefString(p.AnonymizeLevel),
+				UploadUrl:      derefString(p.UploadUrl),
 			},
 		},
 	}, nil
diff --git a/management/server/types/job_test.go b/management/server/types/job_test.go
new file mode 100644
index 000000000..428c2215b
--- /dev/null
+++ b/management/server/types/job_test.go
@@ -0,0 +1,137 @@
+package types
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+func strPtr(s string) *string { return &s }
+
+// bundleJobFromParams builds a bundle Job whose stored workload parameters are
+// the marshalled REST BundleParameters, mirroring what NewJob persists.
+func bundleJobFromParams(t *testing.T, p api.BundleParameters) *Job {
+	t.Helper()
+	raw, err := json.Marshal(p)
+	require.NoError(t, err, "marshal bundle parameters")
+	return &Job{
+		ID: "job-1",
+		Workload: Workload{
+			Type:       JobTypeBundle,
+			Parameters: raw,
+			Result:     []byte("{}"),
+		},
+	}
+}
+
+// TestBuildStreamBundleResponse_CarriesIdentityAndUploadFields verifies the
+// anonymize_level and upload_url REST fields are mapped onto the proto request
+// the client receives.
+func TestBuildStreamBundleResponse_CarriesIdentityAndUploadFields(t *testing.T) {
+	job := bundleJobFromParams(t, api.BundleParameters{
+		BundleFor:      true,
+		BundleForTime:  2,
+		LogFileCount:   100,
+		Anonymize:      true,
+		AnonymizeLevel: strPtr("strict"),
+		UploadUrl:      strPtr("https://upload.example.com"),
+	})
+
+	req, err := job.ToStreamJobRequest()
+	require.NoError(t, err, "ToStreamJobRequest must succeed")
+
+	bundle := req.GetBundle()
+	require.NotNil(t, bundle, "the request must carry bundle parameters")
+	assert.Equal(t, "strict", bundle.GetAnonymizeLevel(), "anonymize_level must reach the client")
+	assert.Equal(t, "https://upload.example.com", bundle.GetUploadUrl(), "upload_url must reach the client")
+	assert.True(t, bundle.GetAnonymize(), "existing fields must still map")
+	assert.Equal(t, int32(100), bundle.GetLogFileCount(), "existing fields must still map")
+}
+
+// newBundleJobRequest builds an api.JobRequest carrying a bundle workload with
+// the given parameters, mirroring what the REST handler decodes.
+func newBundleJobRequest(t *testing.T, p api.BundleParameters) *api.JobRequest {
+	t.Helper()
+	var wr api.WorkloadRequest
+	require.NoError(t, wr.FromBundleWorkloadRequest(api.BundleWorkloadRequest{
+		Type:       api.WorkloadTypeBundle,
+		Parameters: p,
+	}), "build bundle workload request")
+	return &api.JobRequest{Workload: wr}
+}
+
+// TestNewJob_AnonymizeLevelValidation verifies the management API accepts only
+// known anonymization levels (empty defaults on the client) and rejects an
+// unknown value instead of silently escalating it.
+func TestNewJob_AnonymizeLevelValidation(t *testing.T) {
+	base := api.BundleParameters{BundleFor: false, LogFileCount: 100, Anonymize: true}
+
+	for _, tc := range []struct {
+		name    string
+		level   *string
+		wantErr bool
+	}{
+		{name: "omitted", level: nil},
+		{name: "empty", level: strPtr("")},
+		{name: "default", level: strPtr("default")},
+		{name: "strict", level: strPtr("strict")},
+		{name: "mixed case", level: strPtr("Strict")},
+		{name: "padded", level: strPtr(" default ")},
+		{name: "unknown", level: strPtr("verbose"), wantErr: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			p := base
+			p.AnonymizeLevel = tc.level
+			_, err := NewJob("user-1", "acc-1", "peer-1", newBundleJobRequest(t, p))
+			if tc.wantErr {
+				require.Error(t, err, "an unknown anonymize_level must be rejected")
+				assert.Contains(t, err.Error(), "anonymize_level", "the error must name the offending field")
+				return
+			}
+			require.NoError(t, err, "a known anonymize_level must be accepted")
+		})
+	}
+}
+
+// TestNewJob_AnonymizeLevelNormalized verifies an accepted level is persisted
+// trimmed and lowercased, so it reaches the client as a value the client's
+// lowercase-only parser resolves correctly rather than escalating to strict.
+func TestNewJob_AnonymizeLevelNormalized(t *testing.T) {
+	job, err := NewJob("user-1", "acc-1", "peer-1", newBundleJobRequest(t, api.BundleParameters{
+		BundleFor:      false,
+		LogFileCount:   100,
+		Anonymize:      true,
+		AnonymizeLevel: strPtr("  Default  "),
+	}))
+	require.NoError(t, err, "a padded known level must be accepted")
+
+	req, err := job.ToStreamJobRequest()
+	require.NoError(t, err, "ToStreamJobRequest must succeed")
+	assert.Equal(t, "default", req.GetBundle().GetAnonymizeLevel(),
+		"the persisted level must be normalized so the client does not resolve it to strict")
+}
+
+// TestBuildStreamBundleResponse_OmittedFieldsMapToEmpty verifies that omitted
+// optional fields map to the empty proto string, which the client resolves to
+// its defaults (default anonymization level, default upload server).
+func TestBuildStreamBundleResponse_OmittedFieldsMapToEmpty(t *testing.T) {
+	job := bundleJobFromParams(t, api.BundleParameters{
+		BundleFor:     false,
+		BundleForTime: 1,
+		LogFileCount:  50,
+		Anonymize:     false,
+		// AnonymizeLevel and UploadUrl intentionally nil.
+	})
+
+	req, err := job.ToStreamJobRequest()
+	require.NoError(t, err, "ToStreamJobRequest must succeed")
+
+	bundle := req.GetBundle()
+	require.NotNil(t, bundle, "the request must carry bundle parameters")
+	assert.Empty(t, bundle.GetAnonymizeLevel(), "an omitted anonymize_level must map to empty so the client defaults it")
+	assert.Empty(t, bundle.GetUploadUrl(), "an omitted upload_url must map to empty so the client defaults it")
+}
diff --git a/management/server/types/legacynmap/account_components.go b/management/server/types/legacynmap/account_components.go
new file mode 100644
index 000000000..5d5b4a9cf
--- /dev/null
+++ b/management/server/types/legacynmap/account_components.go
@@ -0,0 +1,701 @@
+package legacynmap
+
+import (
+	"context"
+	"slices"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	"github.com/netbirdio/netbird/management/server/telemetry"
+	"github.com/netbirdio/netbird/route"
+)
+
+// GetPeerNetworkMapResult dispatches to either the legacy-NetworkMap path or
+// the components path based on the peer's capability and the kill switch.
+// Capable peers (PeerCapabilityComponentNetworkMap) get the raw components
+// shape — the server skips Calculate() entirely for them, saving CPU
+// proportional to the number of capable peers in the account. Legacy peers
+// (or any peer when componentsDisabled is true) get the fully-expanded
+// NetworkMap as before.
+
+func GetPeerNetworkMapFromComponents(a *Account,
+	ctx context.Context,
+	peerID string,
+	peersCustomZone nbdns.CustomZone,
+	accountZones []*zones.Zone,
+	validatedPeersMap map[string]struct{},
+	resourcePolicies map[string][]*Policy,
+	routers map[string]map[string]*routerTypes.NetworkRouter,
+	metrics *telemetry.AccountManagerMetrics,
+	groupIDToUserIDs map[string][]string,
+) *NetworkMap {
+	start := time.Now()
+
+	components := GetPeerNetworkMapComponents(a,
+		ctx,
+		peerID,
+		peersCustomZone,
+		accountZones,
+		validatedPeersMap,
+		resourcePolicies,
+		routers,
+		groupIDToUserIDs,
+	)
+
+	if components.IsEmpty() {
+		return &NetworkMap{Network: components.Network}
+	}
+
+	nm := CalculateNetworkMapFromComponents(ctx, components)
+
+	if metrics != nil {
+		objectCount := int64(len(nm.Peers) + len(nm.OfflinePeers) + len(nm.Routes) + len(nm.FirewallRules) + len(nm.RoutesFirewallRules))
+		metrics.CountNetworkMapObjects(objectCount)
+		metrics.CountGetPeerNetworkMapDuration(time.Since(start))
+
+		if objectCount > 5000 {
+			log.WithContext(ctx).Tracef("account: %s has a total resource count of %d objects from components, "+
+				"peers: %d, offline peers: %d, routes: %d, firewall rules: %d, route firewall rules: %d",
+				a.Id, objectCount, len(nm.Peers), len(nm.OfflinePeers), len(nm.Routes), len(nm.FirewallRules), len(nm.RoutesFirewallRules))
+		}
+	}
+
+	return nm
+}
+
+func GetPeerNetworkMapComponents(a *Account,
+	ctx context.Context,
+	peerID string,
+	peersCustomZone nbdns.CustomZone,
+	accountZones []*zones.Zone,
+	validatedPeersMap map[string]struct{},
+	resourcePolicies map[string][]*Policy,
+	routers map[string]map[string]*routerTypes.NetworkRouter,
+	groupIDToUserIDs map[string][]string,
+) *NetworkMapComponents {
+	peer := a.Peers[peerID]
+	// this can never happen, things are very wrong if it did
+	// TODO (dmitri) maybe consider using invariants?
+	if peer == nil {
+		log.WithField("peer id", peerID).Error("NetworkMapComponents are computed for a peer missing from the account")
+		return EmptyNetworkMapComponents(&NetworkMapComponents{
+			PeerID:  peerID,
+			Network: a.Network.Copy(),
+			// must include the target peer as it's required on the client
+			Peers: map[string]*ComponentPeer{peerID: peerToComponent(peer)},
+		})
+	}
+
+	if _, ok := validatedPeersMap[peerID]; !ok {
+		// Mirror legacy graceful-degrade: GetPeerNetworkMapFromComponents
+		// returns &NetworkMap{Network: a.Network.Copy()} when components is
+		// nil. Match that floor so the receiving client always sees the
+		// account Network identifier, not a fully-empty envelope.
+		return EmptyNetworkMapComponents(&NetworkMapComponents{
+			PeerID:  peerID,
+			Network: a.Network.Copy(),
+			// must include the target peer as it's required on the client
+			Peers: map[string]*ComponentPeer{peerID: peerToComponent(peer)},
+		})
+	}
+
+	components := &NetworkMapComponents{
+		PeerID:                    peerID,
+		Network:                   a.Network.Copy(),
+		NameServerGroups:          make([]*nbdns.NameServerGroup, 0),
+		CustomZoneDomain:          peersCustomZone.Domain,
+		ResourcePoliciesMap:       make(map[string][]*Policy),
+		RoutersMap:                make(map[string]map[string]*ComponentRouter),
+		NetworkResources:          make([]*ComponentResource, 0),
+		PostureFailedPeers:        make(map[string]map[string]struct{}, len(a.PostureChecks)),
+		RouterPeers:               make(map[string]*ComponentPeer),
+		NetworkXIDToPublicID:      make(map[string]string, len(a.Networks)),
+		PostureCheckXIDToPublicID: make(map[string]string, len(a.PostureChecks)),
+
+		ForceRoutingPeerDNSResolution: forcesRoutingPeerDNSResolution(a, peerID, routers),
+	}
+	for _, n := range a.Networks {
+		if n != nil {
+			components.NetworkXIDToPublicID[n.ID] = n.PublicID
+		}
+	}
+	for _, pc := range a.PostureChecks {
+		if pc != nil {
+			components.PostureCheckXIDToPublicID[pc.ID] = pc.PublicID
+		}
+	}
+
+	components.AccountSettings = &AccountSettingsInfo{
+		PeerLoginExpirationEnabled:      a.Settings.PeerLoginExpirationEnabled,
+		PeerLoginExpiration:             a.Settings.PeerLoginExpiration,
+		PeerInactivityExpirationEnabled: a.Settings.PeerInactivityExpirationEnabled,
+		PeerInactivityExpiration:        a.Settings.PeerInactivityExpiration,
+	}
+
+	components.DNSSettings = &a.DNSSettings
+
+	// relevantPeers always contains the target peer (peerID)
+	relevantPeers, relevantGroups, relevantPolicies, relevantRoutes, sshReqs := getPeersGroupsPoliciesRoutes(a, ctx, peerID, peer.SSHEnabled, validatedPeersMap, &components.PostureFailedPeers)
+
+	if len(sshReqs.neededGroupIDs) > 0 {
+		components.GroupIDToUserIDs = filterGroupIDToUserIDs(groupIDToUserIDs, sshReqs.neededGroupIDs)
+	}
+	if sshReqs.needAllowedUserIDs {
+		components.AllowedUserIDs = getAllowedUserIDs(a)
+	}
+
+	components.Peers = relevantPeers
+	components.Groups = groupsToComponent(relevantGroups)
+	components.Policies = relevantPolicies
+	components.Routes = relevantRoutes
+	components.AllDNSRecords = filterDNSRecordsByPeers(peersCustomZone.Records, relevantPeers, peer.SupportsIPv6() && peer.IPv6.IsValid())
+
+	peerGroups := a.GetPeerGroups(peerID)
+	components.AccountZones = filterPeerAppliedZones(ctx, accountZones, LookupMap(peerGroups))
+	components.AccountZones = append(components.AccountZones, a.SynthesizePrivateServiceZones(peerID)...)
+
+	for _, nsGroup := range a.NameServerGroups {
+		if nsGroup.Enabled {
+			for _, gID := range nsGroup.Groups {
+				if _, found := relevantGroups[gID]; found {
+					components.NameServerGroups = append(components.NameServerGroups, nsGroup)
+					break
+				}
+			}
+		}
+	}
+
+	for _, resource := range a.NetworkResources {
+		if !resource.Enabled {
+			continue
+		}
+
+		policies, exists := resourcePolicies[resource.ID]
+		if !exists {
+			continue
+		}
+
+		addSourcePeers := false
+
+		networkRoutingPeers, routerExists := routers[resource.NetworkID]
+		if routerExists {
+			if _, ok := networkRoutingPeers[peerID]; ok {
+				addSourcePeers = true
+			}
+		}
+
+		for _, policy := range policies {
+			if addSourcePeers {
+				var peers []string
+				if policy.Rules[0].SourceResource.Type == ResourceTypePeer && policy.Rules[0].SourceResource.ID != "" {
+					peers = []string{policy.Rules[0].SourceResource.ID}
+				} else {
+					peers = getUniquePeerIDsFromGroupsIDs(a, ctx, policy.SourceGroups())
+				}
+				for _, pID := range getPostureValidPeersSaveFailed(a, peers, policy.SourcePostureChecks, validatedPeersMap, &components.PostureFailedPeers) {
+					if _, exists := components.Peers[pID]; !exists {
+						components.Peers[pID] = peerToComponent(a.GetPeer(pID))
+					}
+				}
+			} else {
+				peerInSources := false
+				if policy.Rules[0].SourceResource.Type == ResourceTypePeer && policy.Rules[0].SourceResource.ID != "" {
+					peerInSources = policy.Rules[0].SourceResource.ID == peerID
+				} else {
+					for _, groupID := range policy.SourceGroups() {
+						if group := a.GetGroup(groupID); group != nil && slices.Contains(group.Peers, peerID) {
+							peerInSources = true
+							break
+						}
+					}
+				}
+				if !peerInSources {
+					continue
+				}
+				isValid, pname := validatePostureChecksOnPeerGetFailed(a, ctx, policy.SourcePostureChecks, peerID)
+				if !isValid && len(pname) > 0 {
+					if _, ok := components.PostureFailedPeers[pname]; !ok {
+						components.PostureFailedPeers[pname] = make(map[string]struct{})
+					}
+					components.PostureFailedPeers[pname][peer.ID] = struct{}{}
+					continue
+				}
+				addSourcePeers = true
+			}
+
+			for _, rule := range policy.Rules {
+				for _, srcGroupID := range rule.Sources {
+					if g := a.Groups[srcGroupID]; g != nil {
+						if _, exists := components.Groups[srcGroupID]; !exists {
+							components.Groups[srcGroupID] = groupToComponent(g)
+						}
+					}
+				}
+				for _, dstGroupID := range rule.Destinations {
+					if g := a.Groups[dstGroupID]; g != nil {
+						if _, exists := components.Groups[dstGroupID]; !exists {
+							components.Groups[dstGroupID] = groupToComponent(g)
+						}
+					}
+				}
+			}
+			components.ResourcePoliciesMap[resource.ID] = policies
+		}
+
+		// Only expose router peers and the per-network routers_map when this
+		// target peer actually has access to the resource (either as a router
+		// itself or via a policy that includes it as a source). Without this
+		// gate, every peer's envelope was leaking router peers of every
+		// network in the account — accounts with many tenants/networks
+		// shipped tens of unrelated peers in `peers[]` and `routers_map`.
+		if addSourcePeers {
+			components.RoutersMap[resource.NetworkID] = routersToComponentMap(networkRoutingPeers)
+			for peerIDKey := range networkRoutingPeers {
+				if p := a.Peers[peerIDKey]; p != nil {
+					cp := components.RouterPeers[peerIDKey]
+					if cp == nil {
+						cp = peerToComponent(p)
+						components.RouterPeers[peerIDKey] = cp
+					}
+					if _, exists := components.Peers[peerIDKey]; !exists {
+						if _, validated := validatedPeersMap[peerIDKey]; validated {
+							components.Peers[peerIDKey] = cp
+						}
+					}
+				}
+			}
+			components.NetworkResources = append(components.NetworkResources, resourceToComponent(resource))
+		}
+	}
+
+	filterGroupPeers(&components.Groups, components.Peers)
+	filterPostureFailedPeers(&components.PostureFailedPeers, components.Policies, components.ResourcePoliciesMap, components.Peers)
+
+	return components
+}
+
+type sshRequirements struct {
+	neededGroupIDs     map[string]struct{}
+	needAllowedUserIDs bool
+}
+
+func getPeersGroupsPoliciesRoutes(a *Account,
+	ctx context.Context,
+	peerID string,
+	peerSSHEnabled bool,
+	validatedPeersMap map[string]struct{},
+	postureFailedPeers *map[string]map[string]struct{},
+) (map[string]*ComponentPeer, map[string]*Group, []*Policy, []*route.Route, sshRequirements) {
+	relevantPeerIDs := make(map[string]*ComponentPeer, len(a.Peers)/4)
+	relevantGroupIDs := make(map[string]*Group, len(a.Groups)/4)
+	relevantPolicies := make([]*Policy, 0, len(a.Policies))
+	relevantRoutes := make([]*route.Route, 0, len(a.Routes))
+	sshReqs := sshRequirements{neededGroupIDs: make(map[string]struct{})}
+
+	relevantPeerIDs[peerID] = peerToComponent(a.GetPeer(peerID))
+
+	peerGroupSet := make(map[string]struct{}, 8)
+	for groupID, group := range a.Groups {
+		if slices.Contains(group.Peers, peerID) {
+			relevantGroupIDs[groupID] = a.GetGroup(groupID)
+			peerGroupSet[groupID] = struct{}{}
+		}
+	}
+
+	routeAccessControlGroups := make(map[string]struct{})
+	for _, r := range a.Routes {
+		if r == nil {
+			continue
+		}
+		relevant := r.Peer == peerID
+		if !relevant {
+			for _, groupID := range r.PeerGroups {
+				if _, ok := peerGroupSet[groupID]; ok {
+					relevant = true
+					break
+				}
+			}
+		}
+		if !relevant && r.Enabled {
+			for _, groupID := range r.Groups {
+				if _, ok := peerGroupSet[groupID]; ok {
+					relevant = true
+					break
+				}
+			}
+		}
+		if !relevant {
+			continue
+		}
+
+		for _, groupID := range r.PeerGroups {
+			relevantGroupIDs[groupID] = a.GetGroup(groupID)
+		}
+		for _, groupID := range r.Groups {
+			relevantGroupIDs[groupID] = a.GetGroup(groupID)
+		}
+		if r.Enabled {
+			for _, groupID := range r.AccessControlGroups {
+				relevantGroupIDs[groupID] = a.GetGroup(groupID)
+				routeAccessControlGroups[groupID] = struct{}{}
+			}
+		}
+
+		// Include route advertisers in relevantPeerIDs. The envelope
+		// encoder writes route.peer_index by looking up r.Peer in the
+		// shipped peers list; if the advertiser is policy-isolated from
+		// the target peer (no rule edge between them), it would otherwise
+		// be omitted and the decoder would fail to resolve r.Peer, leaving
+		// the client without a WG tunnel target for this route. Legacy
+		// NetworkMap.Routes shipped the WG public key inline, so the
+		// equivalence path doesn't surface this — but the dependency is
+		// real once a client actually tries to use the route.
+		// Gate by validatedPeersMap so non-validated advertisers stay out
+		// (matches the network-resource router behaviour at the bottom of
+		// this loop, and the legacy invariant that only validated peers
+		// reach a client's view).
+		if r.Peer != "" {
+			if _, ok := validatedPeersMap[r.Peer]; ok {
+				if p := a.GetPeer(r.Peer); p != nil {
+					relevantPeerIDs[r.Peer] = peerToComponent(p)
+				}
+			}
+		}
+		for _, groupID := range r.PeerGroups {
+			g := a.GetGroup(groupID)
+			if g == nil {
+				continue
+			}
+			for _, pid := range g.Peers {
+				if _, exists := relevantPeerIDs[pid]; exists {
+					continue
+				}
+				if _, ok := validatedPeersMap[pid]; !ok {
+					continue
+				}
+				if p := a.GetPeer(pid); p != nil {
+					relevantPeerIDs[pid] = peerToComponent(p)
+				}
+			}
+		}
+		relevantRoutes = append(relevantRoutes, r)
+	}
+
+	for _, policy := range a.Policies {
+		if !policy.Enabled {
+			continue
+		}
+
+		policyRelevant := false
+		for _, rule := range policy.Rules {
+			if !rule.Enabled {
+				continue
+			}
+
+			if len(routeAccessControlGroups) > 0 {
+				for _, destGroupID := range rule.Destinations {
+					if _, needed := routeAccessControlGroups[destGroupID]; needed {
+						policyRelevant = true
+						for _, srcGroupID := range rule.Sources {
+							relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
+						}
+						for _, dstGroupID := range rule.Destinations {
+							relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
+						}
+						break
+					}
+				}
+			}
+
+			var sourcePeers, destinationPeers []string
+			var peerInSources, peerInDestinations bool
+
+			if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
+				sourcePeers = []string{rule.SourceResource.ID}
+				if rule.SourceResource.ID == peerID {
+					peerInSources = true
+				}
+			} else {
+				sourcePeers, peerInSources = getPeersFromGroups(a, ctx, rule.Sources, peerID, policy.SourcePostureChecks, validatedPeersMap, postureFailedPeers)
+			}
+
+			if rule.DestinationResource.Type == ResourceTypePeer && rule.DestinationResource.ID != "" {
+				destinationPeers = []string{rule.DestinationResource.ID}
+				if rule.DestinationResource.ID == peerID {
+					peerInDestinations = true
+				}
+			} else {
+				destinationPeers, peerInDestinations = getPeersFromGroups(a, ctx, rule.Destinations, peerID, nil, validatedPeersMap, postureFailedPeers)
+			}
+
+			if peerInSources {
+				policyRelevant = true
+				for _, pid := range destinationPeers {
+					if _, exists := relevantPeerIDs[pid]; !exists {
+						relevantPeerIDs[pid] = peerToComponent(a.GetPeer(pid))
+					}
+				}
+				for _, dstGroupID := range rule.Destinations {
+					relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
+				}
+			}
+
+			if peerInDestinations {
+				policyRelevant = true
+				for _, pid := range sourcePeers {
+					if _, exists := relevantPeerIDs[pid]; !exists {
+						relevantPeerIDs[pid] = peerToComponent(a.GetPeer(pid))
+					}
+				}
+				for _, srcGroupID := range rule.Sources {
+					relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
+				}
+
+				if rule.Protocol == PolicyRuleProtocolNetbirdSSH {
+					switch {
+					case len(rule.AuthorizedGroups) > 0:
+						for groupID := range rule.AuthorizedGroups {
+							sshReqs.neededGroupIDs[groupID] = struct{}{}
+						}
+					case rule.AuthorizedUser != "":
+					default:
+						sshReqs.needAllowedUserIDs = true
+					}
+				} else if PolicyRuleImpliesLegacySSH(rule) && peerSSHEnabled {
+					sshReqs.needAllowedUserIDs = true
+				}
+			}
+		}
+		if policyRelevant {
+			relevantPolicies = append(relevantPolicies, policy)
+		}
+	}
+
+	return relevantPeerIDs, relevantGroupIDs, relevantPolicies, relevantRoutes, sshReqs
+}
+
+func getPeersFromGroups(a *Account, ctx context.Context, groups []string, peerID string, sourcePostureChecksIDs []string,
+	validatedPeersMap map[string]struct{}, postureFailedPeers *map[string]map[string]struct{}) ([]string, bool) {
+	peerInGroups := false
+	filteredPeerIDs := make([]string, 0, len(groups))
+	seenPeerIds := make(map[string]struct{}, len(groups))
+
+	for _, gid := range groups {
+		group := a.GetGroup(gid)
+		if group == nil {
+			continue
+		}
+
+		if group.IsGroupAll() || len(groups) == 1 {
+			filteredPeerIDs = make([]string, 0, len(group.Peers))
+			peerInGroups = false
+			for _, pid := range group.Peers {
+				peer, ok := a.Peers[pid]
+				if !ok || peer == nil {
+					continue
+				}
+
+				if _, ok := validatedPeersMap[peer.ID]; !ok {
+					continue
+				}
+
+				isValid, pname := validatePostureChecksOnPeerGetFailed(a, ctx, sourcePostureChecksIDs, peer.ID)
+				if !isValid && len(pname) > 0 {
+					if _, ok := (*postureFailedPeers)[pname]; !ok {
+						(*postureFailedPeers)[pname] = make(map[string]struct{})
+					}
+					(*postureFailedPeers)[pname][peer.ID] = struct{}{}
+					continue
+				}
+
+				if peer.ID == peerID {
+					peerInGroups = true
+					continue
+				}
+
+				filteredPeerIDs = append(filteredPeerIDs, peer.ID)
+			}
+			return filteredPeerIDs, peerInGroups
+		}
+
+		for _, pid := range group.Peers {
+			if _, seen := seenPeerIds[pid]; seen {
+				continue
+			}
+			seenPeerIds[pid] = struct{}{}
+			peer, ok := a.Peers[pid]
+			if !ok || peer == nil {
+				continue
+			}
+
+			if _, ok := validatedPeersMap[peer.ID]; !ok {
+				continue
+			}
+
+			isValid, pname := validatePostureChecksOnPeerGetFailed(a, ctx, sourcePostureChecksIDs, peer.ID)
+			if !isValid && len(pname) > 0 {
+				if _, ok := (*postureFailedPeers)[pname]; !ok {
+					(*postureFailedPeers)[pname] = make(map[string]struct{})
+				}
+				(*postureFailedPeers)[pname][peer.ID] = struct{}{}
+				continue
+			}
+
+			if peer.ID == peerID {
+				peerInGroups = true
+				continue
+			}
+
+			filteredPeerIDs = append(filteredPeerIDs, peer.ID)
+		}
+	}
+
+	return filteredPeerIDs, peerInGroups
+}
+
+func validatePostureChecksOnPeerGetFailed(a *Account, ctx context.Context, sourcePostureChecksID []string, peerID string) (bool, string) {
+	peer, ok := a.Peers[peerID]
+	if !ok || peer == nil {
+		return false, ""
+	}
+
+	for _, postureChecksID := range sourcePostureChecksID {
+		postureChecks := a.GetPostureChecks(postureChecksID)
+		if postureChecks == nil {
+			continue
+		}
+
+		for _, check := range postureChecks.GetChecks() {
+			isValid, _ := check.Check(ctx, *peer)
+			if !isValid {
+				return false, postureChecksID
+			}
+		}
+	}
+	return true, ""
+}
+
+func getPostureValidPeersSaveFailed(a *Account, inputPeers []string, postureChecksIDs []string, validatedPeersMap map[string]struct{}, postureFailedPeers *map[string]map[string]struct{}) []string {
+	var dest []string
+	for _, peerID := range inputPeers {
+		if _, validated := validatedPeersMap[peerID]; !validated {
+			continue
+		}
+		valid, pname := validatePostureChecksOnPeerGetFailed(a, context.Background(), postureChecksIDs, peerID)
+		if valid {
+			dest = append(dest, peerID)
+			continue
+		}
+		if _, ok := (*postureFailedPeers)[pname]; !ok {
+			(*postureFailedPeers)[pname] = make(map[string]struct{})
+		}
+		(*postureFailedPeers)[pname][peerID] = struct{}{}
+	}
+	return dest
+}
+
+// filterGroupPeers trims each group's Peers slice to only those peers that
+// also appear in `peers`. Groups whose filtered list is empty are NOT
+// deleted from the map — they're kept so the components wire encoder can
+// still resolve seq references from routes/policies/access-control groups
+// that name them. Calculate() tolerates groups with empty Peers (the inner
+// loops simply iterate zero times), so retaining them is behaviourally a
+// no-op for the legacy path that consumes the same NetworkMapComponents.
+func filterGroupPeers(groups *map[string]*ComponentGroup, peers map[string]*ComponentPeer) {
+	for groupID, groupInfo := range *groups {
+		filteredPeers := make([]string, 0, len(groupInfo.Peers))
+		for _, pid := range groupInfo.Peers {
+			if _, exists := peers[pid]; exists {
+				filteredPeers = append(filteredPeers, pid)
+			}
+		}
+
+		if len(filteredPeers) != len(groupInfo.Peers) {
+			ng := *groupInfo
+			ng.Peers = filteredPeers
+			(*groups)[groupID] = &ng
+		}
+	}
+}
+
+func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}, policies []*Policy, resourcePoliciesMap map[string][]*Policy, peers map[string]*ComponentPeer) {
+	if len(*postureFailedPeers) == 0 {
+		return
+	}
+
+	referencedPostureChecks := make(map[string]struct{})
+	for _, policy := range policies {
+		for _, checkID := range policy.SourcePostureChecks {
+			referencedPostureChecks[checkID] = struct{}{}
+		}
+	}
+	for _, resPolicies := range resourcePoliciesMap {
+		for _, policy := range resPolicies {
+			for _, checkID := range policy.SourcePostureChecks {
+				referencedPostureChecks[checkID] = struct{}{}
+			}
+		}
+	}
+
+	for checkID, failedPeers := range *postureFailedPeers {
+		if _, referenced := referencedPostureChecks[checkID]; !referenced {
+			delete(*postureFailedPeers, checkID)
+			continue
+		}
+		for peerID := range failedPeers {
+			if _, exists := peers[peerID]; !exists {
+				delete(failedPeers, peerID)
+			}
+		}
+		if len(failedPeers) == 0 {
+			delete(*postureFailedPeers, checkID)
+		}
+	}
+}
+
+func filterDNSRecordsByPeers(records []nbdns.SimpleRecord, peers map[string]*ComponentPeer, includeIPv6 bool) []nbdns.SimpleRecord {
+	if len(records) == 0 || len(peers) == 0 {
+		return nil
+	}
+
+	// Include both v4 and v6 addresses so AAAA records (whose RData is an IPv6
+	// address) are not filtered out when peers have IPv6 assigned. When the
+	// requesting peer doesn't have IPv6, omit v6 IPs so AAAA records get dropped.
+	peerIPs := make(map[string]struct{}, len(peers)*2)
+	for _, peer := range peers {
+		if peer == nil {
+			continue
+		}
+		peerIPs[peer.IP.String()] = struct{}{}
+		if includeIPv6 && peer.IPv6.IsValid() {
+			peerIPs[peer.IPv6.String()] = struct{}{}
+		}
+	}
+
+	filteredRecords := make([]nbdns.SimpleRecord, 0, len(records))
+	for _, record := range records {
+		if _, exists := peerIPs[record.RData]; exists {
+			filteredRecords = append(filteredRecords, record)
+		}
+	}
+
+	return filteredRecords
+}
+
+func filterGroupIDToUserIDs(fullMap map[string][]string, neededGroupIDs map[string]struct{}) map[string][]string {
+	if len(neededGroupIDs) == 0 {
+		return nil
+	}
+
+	filtered := make(map[string][]string, len(neededGroupIDs))
+	for groupID := range neededGroupIDs {
+		if users, ok := fullMap[groupID]; ok {
+			filtered[groupID] = users
+		}
+	}
+	return filtered
+}
diff --git a/management/server/types/legacynmap/aliases.go b/management/server/types/legacynmap/aliases.go
new file mode 100644
index 000000000..6b8f9574b
--- /dev/null
+++ b/management/server/types/legacynmap/aliases.go
@@ -0,0 +1,34 @@
+package legacynmap
+
+import (
+	types "github.com/netbirdio/netbird/management/server/types"
+	sharedtypes "github.com/netbirdio/netbird/shared/management/types"
+)
+
+type (
+	Account = types.Account
+
+	DNSSettings       = types.DNSSettings
+	FirewallRule      = sharedtypes.FirewallRule
+	Group             = types.Group
+	Network           = types.Network
+	Policy            = types.Policy
+	PolicyRule        = types.PolicyRule
+	Resource          = types.Resource
+	RulePortRange     = sharedtypes.RulePortRange
+	RouteFirewallRule = sharedtypes.RouteFirewallRule
+)
+
+const (
+	FirewallRuleDirectionIN  = sharedtypes.FirewallRuleDirectionIN
+	FirewallRuleDirectionOUT = sharedtypes.FirewallRuleDirectionOUT
+
+	PolicyRuleProtocolALL        = sharedtypes.PolicyRuleProtocolALL
+	PolicyRuleProtocolTCP        = sharedtypes.PolicyRuleProtocolTCP
+	PolicyRuleProtocolNetbirdSSH = sharedtypes.PolicyRuleProtocolNetbirdSSH
+	PolicyTrafficActionAccept    = sharedtypes.PolicyTrafficActionAccept
+	ResourceTypePeer             = sharedtypes.ResourceTypePeer
+
+	AllowedIPsFormat   = sharedtypes.AllowedIPsFormat
+	AllowedIPsV6Format = sharedtypes.AllowedIPsV6Format
+)
diff --git a/management/server/types/legacynmap/benchmark_test.go b/management/server/types/legacynmap/benchmark_test.go
new file mode 100644
index 000000000..22e291e00
--- /dev/null
+++ b/management/server/types/legacynmap/benchmark_test.go
@@ -0,0 +1,350 @@
+//go:build nmapequiv
+
+// Account-load benchmark: the legacy store.GetAccount hydration (pgx fast
+// path, as in production) vs the nmdata store's GetNetworkMapData, against the
+// same Postgres copy as the equivalence test.
+//
+//	NETBIRD_STORE_ENGINE_POSTGRES_DSN='...' go test -tags nmapequiv \
+//	  -run '^$' -bench . -benchtime 5x -timeout 60m \
+//	  ./management/server/types/legacynmap/
+//
+// NETMAP_ACCOUNTS selects the accounts (comma-separated); by default the ten
+// accounts with the most peers are used. Each account is a sub-benchmark, so
+// the two paths can be compared per account. One warmup call runs untimed
+// before each measurement so Postgres buffer-cache state is comparable.
+//
+// Reported metrics beyond ns/op and allocs:
+//
+//   - queries/op    round trips, counted client-side via a pgx tracer
+//     (GetNetworkMapData only — the legacy store's pool is internal)
+//   - xact/op       committed transactions from pg_stat_database; the legacy
+//     pgx path runs autocommit statements, so this approximates its round
+//     trips, while GetNetworkMapData runs a single transaction
+//   - tup_returned/op, tup_fetched/op   rows scanned/fetched server-side
+//   - blks_read/op, blks_hit/op         buffer cache misses/hits
+//
+// The pg_stat_database numbers are database-global: run without concurrent
+// load. The two stat snapshots per sub-benchmark add a small constant
+// overhead to the server-side deltas.
+package legacynmap_test
+
+import (
+	"context"
+	"os"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/stretchr/testify/require"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
+	networkmap_pgsql "github.com/netbirdio/netbird/management/internals/network_map_db/pgsql"
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+func BenchmarkGetAccount(b *testing.B) {
+	dsn := equivDSN()
+	if dsn == "" {
+		b.Skip("NETBIRD_STORE_ENGINE_POSTGRES_DSN not set")
+	}
+	ctx := context.Background()
+
+	statsConn, err := pgx.Connect(ctx, dsn)
+	require.NoError(b, err, "connect stats connection")
+	b.Cleanup(func() { statsConn.Close(ctx) })
+
+	testStore, err := store.NewPostgresqlStore(ctx, dsn, nil, true)
+	require.NoError(b, err, "connect to postgres")
+	b.Cleanup(func() { testStore.Close(ctx) })
+
+	for _, accountID := range benchAccountIDs(b, ctx, statsConn) {
+		b.Run(accountID, func(b *testing.B) {
+			logAccountShape(b, ctx, statsConn, accountID)
+			benchDBLoad(b, ctx, statsConn, nil, func() error {
+				_, err := testStore.GetAccount(ctx, accountID)
+				return err
+			})
+		})
+	}
+}
+
+func BenchmarkGetNetworkMapData(b *testing.B) {
+	dsn := equivDSN()
+	if dsn == "" {
+		b.Skip("NETBIRD_STORE_ENGINE_POSTGRES_DSN not set")
+	}
+	ctx := context.Background()
+
+	statsConn, err := pgx.Connect(ctx, dsn)
+	require.NoError(b, err, "connect stats connection")
+	b.Cleanup(func() { statsConn.Close(ctx) })
+
+	tracer := &queryCountTracer{}
+	cfg, err := pgxpool.ParseConfig(dsn)
+	require.NoError(b, err, "parse dsn")
+	cfg.ConnConfig.Tracer = tracer
+	pool, err := pgxpool.NewWithConfig(ctx, cfg)
+	require.NoError(b, err, "connect nmdata store")
+	b.Cleanup(pool.Close)
+	nmStore := nmDataStore(b, &networkmap_pgsql.PgStore{Pool: pool})
+
+	for _, accountID := range benchAccountIDs(b, ctx, statsConn) {
+		b.Run(accountID, func(b *testing.B) {
+			logAccountShape(b, ctx, statsConn, accountID)
+			benchDBLoad(b, ctx, statsConn, tracer, func() error {
+				_, err := nmStore.GetNetworkMapData(ctx, accountID)
+				return err
+			})
+		})
+	}
+}
+
+// BenchmarkAccountFullRound measures store load plus the full per-peer fan-out
+// to *proto.SyncResponse for every peer of the account, the way the production
+// account path runs it: index maps and per-peer twin building happen after
+// GetAccount and are part of the measured op. BenchmarkNetworkMapDataFullRound
+// is the equivalent for the nmdata path, whose index building happens inside
+// GetNetworkMapData. Select both with -bench FullRound.
+func BenchmarkAccountFullRound(b *testing.B) {
+	dsn := equivDSN()
+	if dsn == "" {
+		b.Skip("NETBIRD_STORE_ENGINE_POSTGRES_DSN not set")
+	}
+	ctx := context.Background()
+
+	statsConn, err := pgx.Connect(ctx, dsn)
+	require.NoError(b, err, "connect stats connection")
+	b.Cleanup(func() { statsConn.Close(ctx) })
+
+	testStore, err := store.NewPostgresqlStore(ctx, dsn, nil, true)
+	require.NoError(b, err, "connect to postgres")
+	b.Cleanup(func() { testStore.Close(ctx) })
+
+	for _, accountID := range benchAccountIDs(b, ctx, statsConn) {
+		b.Run(accountID, func(b *testing.B) {
+			logAccountShape(b, ctx, statsConn, accountID)
+			benchDBLoad(b, ctx, statsConn, nil, func() error {
+				account, err := testStore.GetAccount(ctx, accountID)
+				if err != nil {
+					return err
+				}
+				buildAccountSyncResponses(ctx, account)
+				return nil
+			})
+		})
+	}
+}
+
+func BenchmarkNetworkMapDataFullRound(b *testing.B) {
+	dsn := equivDSN()
+	if dsn == "" {
+		b.Skip("NETBIRD_STORE_ENGINE_POSTGRES_DSN not set")
+	}
+	ctx := context.Background()
+
+	statsConn, err := pgx.Connect(ctx, dsn)
+	require.NoError(b, err, "connect stats connection")
+	b.Cleanup(func() { statsConn.Close(ctx) })
+
+	tracer := &queryCountTracer{}
+	cfg, err := pgxpool.ParseConfig(dsn)
+	require.NoError(b, err, "parse dsn")
+	cfg.ConnConfig.Tracer = tracer
+	pool, err := pgxpool.NewWithConfig(ctx, cfg)
+	require.NoError(b, err, "connect nmdata store")
+	b.Cleanup(pool.Close)
+	nmStore := nmDataStore(b, &networkmap_pgsql.PgStore{Pool: pool})
+
+	for _, accountID := range benchAccountIDs(b, ctx, statsConn) {
+		b.Run(accountID, func(b *testing.B) {
+			logAccountShape(b, ctx, statsConn, accountID)
+			benchDBLoad(b, ctx, statsConn, tracer, func() error {
+				nmData, err := nmStore.GetNetworkMapData(ctx, accountID)
+				if err != nil {
+					return err
+				}
+				buildDataSyncResponses(ctx, nmData)
+				return nil
+			})
+		})
+	}
+}
+
+// buildAccountSyncResponses fans out to every peer like the controller's
+// account path: index maps once, twin conversion and network-map computation
+// per peer.
+func buildAccountSyncResponses(ctx context.Context, account *types.Account) {
+	validated := make(map[string]struct{}, len(account.Peers))
+	for peerID := range account.Peers {
+		validated[peerID] = struct{}{}
+	}
+	resourcePolicies := account.GetResourcePoliciesMap()
+	routers := account.GetResourceRoutersMap()
+	groupUsers := account.GetActiveGroupUsers()
+	settings := account.Settings
+	if settings == nil {
+		settings = &types.Settings{}
+	}
+	dnsCache := &cache.DNSConfigCache{}
+
+	for peerID, peer := range account.Peers {
+		nm := account.GetPeerNetworkMapFromComponents(
+			ctx, peerID, nbdns.CustomZone{}, nil, validated, resourcePolicies, routers, nil, groupUsers,
+		)
+		mgmtgrpc.ToSyncResponse(
+			ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, nm, equivDNSName, nil,
+			dnsCache, types.TwinAccountSettings(settings), settings.Extra, nil, 0,
+		)
+	}
+}
+
+// buildDataSyncResponses is the nmdata-path equivalent of
+// buildAccountSyncResponses.
+func buildDataSyncResponses(ctx context.Context, nmData *networkmap.NetworkMapData) {
+	validated := make(map[string]struct{}, len(nmData.Peers))
+	for peerID := range nmData.Peers {
+		validated[peerID] = struct{}{}
+	}
+	nmData.ValidatedPeers = validated
+	dnsCache := &cache.DNSConfigCache{}
+
+	for peerID, peer := range nmData.Peers {
+		components := nmData.GetPeerNetworkMapComponents(peerID, nmdata.CustomZone{})
+		nm := &types.NetworkMap{Network: components.Network}
+		if !components.IsEmpty() {
+			nm = types.CalculateNetworkMapFromComponents(ctx, components)
+		}
+		mgmtgrpc.ToSyncResponse(
+			ctx, nil, nil, nil, peer, nil, nil, nm, equivDNSName, nil,
+			dnsCache, nmData.AccountSettings, nil, nil, 0,
+		)
+	}
+}
+
+// benchDBLoad runs op b.N times and reports server-side pg_stat_database
+// deltas per op. A non-nil tracer additionally reports exact client round
+// trips per op.
+//
+// Backends flush cumulative stats at most once per second and only while
+// processing commands, so around each snapshot the load settles: sleep past
+// the flush interval, then run one extra untimed op whose command end flushes
+// everything pending. The trailing extra op lands inside the measured window,
+// hence the b.N+1 denominator for the server-side metrics.
+func benchDBLoad(b *testing.B, ctx context.Context, statsConn *pgx.Conn, tracer *queryCountTracer, op func() error) {
+	b.Helper()
+
+	require.NoError(b, op(), "warmup")
+	settleDBStats(b, op)
+
+	before, err := snapshotDBStats(ctx, statsConn)
+	require.NoError(b, err, "stats snapshot")
+	var queriesBefore int64
+	if tracer != nil {
+		queriesBefore = tracer.queries.Load()
+	}
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if err := op(); err != nil {
+			b.Fatal(err)
+		}
+	}
+	b.StopTimer()
+
+	settleDBStats(b, op)
+	after, err := snapshotDBStats(ctx, statsConn)
+	require.NoError(b, err, "stats snapshot")
+
+	ops := float64(b.N + 1)
+	if tracer != nil {
+		b.ReportMetric(float64(tracer.queries.Load()-queriesBefore)/ops, "queries/op")
+	}
+	b.ReportMetric(float64(after.xactCommit-before.xactCommit)/ops, "xact/op")
+	b.ReportMetric(float64(after.tupReturned-before.tupReturned)/ops, "tup_returned/op")
+	b.ReportMetric(float64(after.tupFetched-before.tupFetched)/ops, "tup_fetched/op")
+	b.ReportMetric(float64(after.blksRead-before.blksRead)/ops, "blks_read/op")
+	b.ReportMetric(float64(after.blksHit-before.blksHit)/ops, "blks_hit/op")
+}
+
+func settleDBStats(b *testing.B, op func() error) {
+	b.Helper()
+	time.Sleep(1100 * time.Millisecond)
+	require.NoError(b, op(), "stats flush op")
+	time.Sleep(100 * time.Millisecond)
+}
+
+func benchAccountIDs(b *testing.B, ctx context.Context, conn *pgx.Conn) []string {
+	b.Helper()
+
+	if ids := strings.TrimSpace(os.Getenv("NETMAP_ACCOUNTS")); ids != "" {
+		var out []string
+		for _, id := range strings.Split(ids, ",") {
+			if id = strings.TrimSpace(id); id != "" {
+				out = append(out, id)
+			}
+		}
+		return out
+	}
+
+	rows, err := conn.Query(ctx,
+		"select account_id from peers group by account_id order by count(*) desc, account_id limit 10")
+	require.NoError(b, err, "list benchmark accounts")
+	ids, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	require.NoError(b, err, "collect benchmark accounts")
+	require.NotEmpty(b, ids, "no accounts found")
+	return ids
+}
+
+func logAccountShape(b *testing.B, ctx context.Context, conn *pgx.Conn, accountID string) {
+	b.Helper()
+
+	var peers, groups, users, policies, routes, resources, nsGroups int
+	err := conn.QueryRow(ctx, `select
+		(select count(*) from peers where account_id=$1),
+		(select count(*) from groups where account_id=$1),
+		(select count(*) from users where account_id=$1),
+		(select count(*) from policies where account_id=$1),
+		(select count(*) from routes where account_id=$1),
+		(select count(*) from network_resources where account_id=$1),
+		(select count(*) from name_server_groups where account_id=$1)`, accountID).
+		Scan(&peers, &groups, &users, &policies, &routes, &resources, &nsGroups)
+	require.NoError(b, err, "account shape")
+	b.Logf("account=%s peers=%d groups=%d users=%d policies=%d routes=%d resources=%d nsgroups=%d",
+		accountID, peers, groups, users, policies, routes, resources, nsGroups)
+}
+
+type dbStats struct {
+	xactCommit  int64
+	tupReturned int64
+	tupFetched  int64
+	blksRead    int64
+	blksHit     int64
+}
+
+func snapshotDBStats(ctx context.Context, conn *pgx.Conn) (dbStats, error) {
+	var s dbStats
+	err := conn.QueryRow(ctx, `select xact_commit, tup_returned, tup_fetched, blks_read, blks_hit
+		from pg_stat_database where datname = current_database()`).
+		Scan(&s.xactCommit, &s.tupReturned, &s.tupFetched, &s.blksRead, &s.blksHit)
+	return s, err
+}
+
+type queryCountTracer struct {
+	queries atomic.Int64
+}
+
+func (t *queryCountTracer) TraceQueryStart(ctx context.Context, _ *pgx.Conn, _ pgx.TraceQueryStartData) context.Context {
+	t.queries.Add(1)
+	return ctx
+}
+
+func (t *queryCountTracer) TraceQueryEnd(context.Context, *pgx.Conn, pgx.TraceQueryEndData) {}
diff --git a/management/server/types/legacynmap/component_types.go b/management/server/types/legacynmap/component_types.go
new file mode 100644
index 000000000..a584b59af
--- /dev/null
+++ b/management/server/types/legacynmap/component_types.go
@@ -0,0 +1,106 @@
+package legacynmap
+
+import (
+	"net/netip"
+	"time"
+)
+
+// ComponentPeer is the self-contained peer representation used by
+// NetworkMapComponents and the calculated NetworkMap. It carries exactly the
+// subset of peer data that crosses the components wire format, so the shared
+// calculation layer stays independent of the management server's domain
+// types.
+type ComponentPeer struct {
+	ID                     string
+	Key                    string
+	IP                     netip.Addr
+	IPv6                   netip.Addr
+	DNSLabel               string
+	SSHKey                 string
+	SSHEnabled             bool
+	ServerSSHAllowed       bool
+	AgentVersion           string
+	SupportsSourcePrefixes bool
+	SupportsIPv6           bool
+	LoginExpirationEnabled bool
+	AddedWithSSOLogin      bool
+	LastLogin              time.Time
+	// ProxyEmbedded marks an ephemeral embedded proxy peer. Connections
+	// involving such a peer on either endpoint default to lazy.
+	ProxyEmbedded bool
+}
+
+// FQDN returns the peer's FQDN combined of the peer's DNS label and the system's DNS domain.
+func (p *ComponentPeer) FQDN(dnsDomain string) string {
+	if dnsDomain == "" {
+		return ""
+	}
+	return p.DNSLabel + "." + dnsDomain
+}
+
+// LoginExpired indicates whether the peer's login has expired, mirroring the
+// server-side peer semantics: only SSO-added peers with login expiration
+// enabled can expire.
+func (p *ComponentPeer) LoginExpired(expiresIn time.Duration) (bool, time.Duration) {
+	if !p.AddedWithSSOLogin || !p.LoginExpirationEnabled {
+		return false, 0
+	}
+	timeLeft := time.Until(p.LastLogin.Add(expiresIn))
+	return timeLeft <= 0, timeLeft
+}
+
+// GroupAllName is the reserved name of the default group that contains every peer in an account.
+const GroupAllName = "All"
+
+// ComponentGroup is the self-contained group representation used by
+// NetworkMapComponents: just the membership view the network-map calculation
+// needs, without the server's storage fields.
+type ComponentGroup struct {
+	ID       string
+	PublicID string
+	Name     string
+	Peers    []string
+}
+
+// IsGroupAll checks if the group is a default "All" group.
+func (g *ComponentGroup) IsGroupAll() bool {
+	return g.Name == GroupAllName
+}
+
+// ComponentRouter is the self-contained network-router representation used by
+// NetworkMapComponents.
+type ComponentRouter struct {
+	NetworkID  string
+	PublicID   string
+	Peer       string
+	PeerGroups []string
+	Masquerade bool
+	Metric     int
+	Enabled    bool
+}
+
+// ComponentResourceType mirrors the network-resource type enum on the
+// components wire format.
+type ComponentResourceType string
+
+const (
+	ComponentResourceHost   ComponentResourceType = "host"
+	ComponentResourceSubnet ComponentResourceType = "subnet"
+	ComponentResourceDomain ComponentResourceType = "domain"
+)
+
+// ComponentResource is the self-contained network-resource representation
+// used by NetworkMapComponents.
+type ComponentResource struct {
+	ID          string
+	PublicID    string
+	NetworkID   string
+	AccountID   string
+	Name        string
+	Description string
+	Type        ComponentResourceType
+	Address     string
+	Domain      string
+	Prefix      netip.Prefix
+	Enabled     bool
+}
diff --git a/management/server/types/legacynmap/converters.go b/management/server/types/legacynmap/converters.go
new file mode 100644
index 000000000..d1cae6b63
--- /dev/null
+++ b/management/server/types/legacynmap/converters.go
@@ -0,0 +1,126 @@
+package legacynmap
+
+import (
+	nbdns "github.com/netbirdio/netbird/dns"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/route"
+)
+
+// NetworkMap is main's shape. It is copied rather than aliased because this
+// branch's NetworkMap dropped ForceRoutingPeerDNSResolution, which main threads
+// into PeerConfig.RoutingPeerDnsResolutionEnabled.
+type NetworkMap struct {
+	Peers               []*ComponentPeer
+	Network             *Network
+	Routes              []*route.Route
+	DNSConfig           nbdns.Config
+	OfflinePeers        []*ComponentPeer
+	FirewallRules       []*FirewallRule
+	RoutesFirewallRules []*RouteFirewallRule
+	AuthorizedUsers     map[string]map[string]struct{}
+	EnableSSH           bool
+	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
+	// resolution regardless of the account-global setting, for reverse-proxy
+	// domain targets.
+	ForceRoutingPeerDNSResolution bool
+}
+
+// The ToComponent converters below are main's methods, re-expressed as free
+// functions because their receivers live in packages this one cannot extend.
+// Bodies are otherwise unchanged.
+
+func peerToComponent(p *nbpeer.Peer) *ComponentPeer {
+	if p == nil {
+		return nil
+	}
+	cp := &ComponentPeer{
+		ID:                     p.ID,
+		Key:                    p.Key,
+		IP:                     p.IP,
+		IPv6:                   p.IPv6,
+		DNSLabel:               p.DNSLabel,
+		SSHKey:                 p.SSHKey,
+		SSHEnabled:             p.SSHEnabled,
+		ServerSSHAllowed:       p.Meta.Flags.ServerSSHAllowed,
+		AgentVersion:           p.Meta.WtVersion,
+		SupportsSourcePrefixes: p.SupportsSourcePrefixes(),
+		SupportsIPv6:           p.SupportsIPv6(),
+		LoginExpirationEnabled: p.LoginExpirationEnabled,
+		AddedWithSSOLogin:      p.AddedWithSSOLogin(),
+		ProxyEmbedded:          p.ProxyMeta.Embedded,
+	}
+	if p.LastLogin != nil {
+		cp.LastLogin = *p.LastLogin
+	}
+	return cp
+}
+
+func groupToComponent(g *Group) *ComponentGroup {
+	if g == nil {
+		return nil
+	}
+	return &ComponentGroup{
+		ID:       g.ID,
+		PublicID: g.PublicID,
+		Name:     g.Name,
+		Peers:    g.Peers,
+	}
+}
+
+func groupsToComponent(groups map[string]*Group) map[string]*ComponentGroup {
+	if groups == nil {
+		return nil
+	}
+	out := make(map[string]*ComponentGroup, len(groups))
+	for id, g := range groups {
+		out[id] = groupToComponent(g)
+	}
+	return out
+}
+
+func routerToComponent(n *routerTypes.NetworkRouter) *ComponentRouter {
+	if n == nil {
+		return nil
+	}
+	return &ComponentRouter{
+		NetworkID:  n.NetworkID,
+		PublicID:   n.PublicID,
+		Peer:       n.Peer,
+		PeerGroups: n.PeerGroups,
+		Masquerade: n.Masquerade,
+		Metric:     n.Metric,
+		Enabled:    n.Enabled,
+	}
+}
+
+func routersToComponentMap(routers map[string]*routerTypes.NetworkRouter) map[string]*ComponentRouter {
+	if routers == nil {
+		return nil
+	}
+	out := make(map[string]*ComponentRouter, len(routers))
+	for id, r := range routers {
+		out[id] = routerToComponent(r)
+	}
+	return out
+}
+
+func resourceToComponent(n *resourceTypes.NetworkResource) *ComponentResource {
+	if n == nil {
+		return nil
+	}
+	return &ComponentResource{
+		ID:          n.ID,
+		PublicID:    n.PublicID,
+		NetworkID:   n.NetworkID,
+		AccountID:   n.AccountID,
+		Name:        n.Name,
+		Description: n.Description,
+		Type:        ComponentResourceType(n.Type),
+		Address:     n.Address,
+		Domain:      n.Domain,
+		Prefix:      n.Prefix,
+		Enabled:     n.Enabled,
+	}
+}
diff --git a/management/server/types/legacynmap/copied_funcs.go b/management/server/types/legacynmap/copied_funcs.go
new file mode 100644
index 000000000..4477967f5
--- /dev/null
+++ b/management/server/types/legacynmap/copied_funcs.go
@@ -0,0 +1,282 @@
+package legacynmap
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/miekg/dns"
+	log "github.com/sirupsen/logrus"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	nbroute "github.com/netbirdio/netbird/route"
+)
+
+func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*ComponentPeer, direction int, includeIPv6 bool) []*RouteFirewallRule {
+	rulesExists := make(map[string]struct{})
+	rules := make([]*RouteFirewallRule, 0)
+
+	v4Sources, v6Sources := splitPeerSourcesByFamily(groupPeers)
+
+	isV6Route := route.Network.Addr().Is6()
+
+	// Skip v6 destination routes entirely for peers without IPv6 support
+	if isV6Route && !includeIPv6 {
+		return rules
+	}
+
+	// Pick sources matching the destination family
+	sourceRanges := v4Sources
+	if isV6Route {
+		sourceRanges = v6Sources
+	}
+
+	baseRule := RouteFirewallRule{
+		PolicyID:     rule.PolicyID,
+		RouteID:      route.ID,
+		SourceRanges: sourceRanges,
+		Action:       string(rule.Action),
+		Destination:  route.Network.String(),
+		Protocol:     string(rule.Protocol),
+		Domains:      route.Domains,
+		IsDynamic:    route.IsDynamic(),
+	}
+
+	if len(rule.Ports) == 0 {
+		rules = append(rules, generateRulesWithPortRanges(baseRule, rule, rulesExists)...)
+	} else {
+		rules = append(rules, generateRulesWithPorts(ctx, baseRule, rule, rulesExists)...)
+	}
+
+	// Generate v6 counterpart for dynamic routes and 0.0.0.0/0 exit node routes.
+	isDefaultV4 := !isV6Route && route.Network.Bits() == 0
+	if includeIPv6 && (route.IsDynamic() || isDefaultV4) && len(v6Sources) > 0 {
+		v6Rule := baseRule
+		v6Rule.SourceRanges = v6Sources
+		if isDefaultV4 {
+			v6Rule.Destination = "::/0"
+			v6Rule.RouteID = route.ID + "-v6-default"
+		}
+		if len(rule.Ports) == 0 {
+			rules = append(rules, generateRulesWithPortRanges(v6Rule, rule, rulesExists)...)
+		} else {
+			rules = append(rules, generateRulesWithPorts(ctx, v6Rule, rule, rulesExists)...)
+		}
+	}
+
+	return rules
+}
+
+func filterPeerAppliedZones(ctx context.Context, accountZones []*zones.Zone, peerGroups LookupMap) []nbdns.CustomZone {
+	var customZones []nbdns.CustomZone
+
+	if len(peerGroups) == 0 {
+		return customZones
+	}
+
+	for _, zone := range accountZones {
+		if !zone.Enabled || len(zone.Records) == 0 {
+			continue
+		}
+
+		hasAccess := false
+		for _, distGroupID := range zone.DistributionGroups {
+			if _, found := peerGroups[distGroupID]; found {
+				hasAccess = true
+				break
+			}
+		}
+
+		if !hasAccess {
+			continue
+		}
+
+		simpleRecords := make([]nbdns.SimpleRecord, 0, len(zone.Records))
+		for _, record := range zone.Records {
+			var recordType int
+			rData := record.Content
+
+			switch record.Type {
+			case records.RecordTypeA:
+				recordType = int(dns.TypeA)
+			case records.RecordTypeAAAA:
+				recordType = int(dns.TypeAAAA)
+			case records.RecordTypeCNAME:
+				recordType = int(dns.TypeCNAME)
+				rData = dns.Fqdn(record.Content)
+			default:
+				log.WithContext(ctx).Warnf("unknown DNS record type %s for record %s", record.Type, record.ID)
+				continue
+			}
+
+			simpleRecords = append(simpleRecords, nbdns.SimpleRecord{
+				Name:  dns.Fqdn(record.Name),
+				Type:  recordType,
+				Class: nbdns.DefaultClass,
+				TTL:   record.TTL,
+				RData: rData,
+			})
+		}
+
+		customZones = append(customZones, nbdns.CustomZone{
+			Domain:               dns.Fqdn(zone.Domain),
+			Records:              simpleRecords,
+			SearchDomainDisabled: !zone.EnableSearchDomain,
+			NonAuthoritative:     true,
+		})
+	}
+
+	return customZones
+}
+
+func getAllowedUserIDs(a *Account) map[string]struct{} {
+	users := make(map[string]struct{})
+	for _, nbUser := range a.Users {
+		if !nbUser.IsBlocked() && !nbUser.IsServiceUser {
+			users[nbUser.Id] = struct{}{}
+		}
+	}
+	return users
+}
+
+func getUniquePeerIDsFromGroupsIDs(a *Account, ctx context.Context, groups []string) []string {
+	peerIDs := make(map[string]struct{}, len(groups)) // we expect at least one peer per group as initial capacity
+	for _, groupID := range groups {
+		group := a.GetGroup(groupID)
+		if group == nil {
+			log.WithContext(ctx).Warnf("group %s doesn't exist under account %s, will continue map generation without it", groupID, a.Id)
+			continue
+		}
+
+		if group.IsGroupAll() || len(groups) == 1 {
+			return group.Peers
+		}
+
+		for _, peerID := range group.Peers {
+			peerIDs[peerID] = struct{}{}
+		}
+	}
+
+	ids := make([]string, 0, len(peerIDs))
+	for peerID := range peerIDs {
+		ids = append(ids, peerID)
+	}
+
+	return ids
+}
+
+func forcesRoutingPeerDNSResolution(a *Account, peerID string, routers map[string]map[string]*routerTypes.NetworkRouter) bool {
+	targeted := proxyTargetedDomainResourceIDs(a)
+	if len(targeted) == 0 {
+		return false
+	}
+
+	for _, resource := range a.NetworkResources {
+		if resource == nil || !resource.Enabled || resource.Type != resourceTypes.Domain {
+			continue
+		}
+		if _, ok := targeted[resource.ID]; !ok {
+			continue
+		}
+		if _, isRouter := routers[resource.NetworkID][peerID]; isRouter {
+			return true
+		}
+	}
+
+	return false
+}
+
+func proxyTargetedDomainResourceIDs(a *Account) map[string]struct{} {
+	ids := make(map[string]struct{})
+	for _, svc := range a.Services {
+		if svc == nil || !svc.Enabled || svc.Terminated {
+			continue
+		}
+		for _, target := range svc.Targets {
+			if target == nil || !target.Enabled {
+				continue
+			}
+			if target.TargetType == service.TargetTypeDomain {
+				ids[target.TargetId] = struct{}{}
+			}
+		}
+	}
+	return ids
+}
+
+func splitPeerSourcesByFamily(groupPeers []*ComponentPeer) (v4, v6 []string) {
+	v4 = make([]string, 0, len(groupPeers))
+	v6 = make([]string, 0, len(groupPeers))
+	for _, peer := range groupPeers {
+		if peer == nil {
+			continue
+		}
+		v4 = append(v4, fmt.Sprintf(AllowedIPsFormat, peer.IP))
+		if peer.IPv6.IsValid() {
+			v6 = append(v6, fmt.Sprintf(AllowedIPsV6Format, peer.IPv6))
+		}
+	}
+	return
+}
+
+func generateRulesWithPortRanges(baseRule RouteFirewallRule, rule *PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
+	rules := make([]*RouteFirewallRule, 0)
+
+	ruleIDBase := generateRuleIDBase(rule, baseRule)
+	if len(rule.Ports) == 0 {
+		if len(rule.PortRanges) == 0 {
+			if _, ok := rulesExists[ruleIDBase]; !ok {
+				rulesExists[ruleIDBase] = struct{}{}
+				rules = append(rules, &baseRule)
+			}
+		} else {
+			for _, portRange := range rule.PortRanges {
+				ruleID := fmt.Sprintf("%s%d-%d", ruleIDBase, portRange.Start, portRange.End)
+				if _, ok := rulesExists[ruleID]; !ok {
+					rulesExists[ruleID] = struct{}{}
+					pr := baseRule
+					pr.PortRange = portRange
+					rules = append(rules, &pr)
+				}
+			}
+		}
+		return rules
+	}
+
+	return rules
+}
+
+func generateRulesWithPorts(ctx context.Context, baseRule RouteFirewallRule, rule *PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
+	rules := make([]*RouteFirewallRule, 0)
+	ruleIDBase := generateRuleIDBase(rule, baseRule)
+
+	for _, port := range rule.Ports {
+		ruleID := ruleIDBase + port
+		if _, ok := rulesExists[ruleID]; ok {
+			continue
+		}
+		rulesExists[ruleID] = struct{}{}
+
+		pr := baseRule
+		p, err := strconv.ParseUint(port, 10, 16)
+		if err != nil {
+			log.WithContext(ctx).Errorf("failed to parse port %s for rule: %s", port, rule.ID)
+			continue
+		}
+
+		pr.Port = uint16(p)
+		rules = append(rules, &pr)
+	}
+
+	return rules
+}
+
+func generateRuleIDBase(rule *PolicyRule, baseRule RouteFirewallRule) string {
+	return rule.ID + strings.Join(baseRule.SourceRanges, ",") + strconv.Itoa(FirewallRuleDirectionIN) + baseRule.Protocol + baseRule.Action
+}
diff --git a/management/server/types/legacynmap/doc.go b/management/server/types/legacynmap/doc.go
new file mode 100644
index 000000000..e0b0ecd11
--- /dev/null
+++ b/management/server/types/legacynmap/doc.go
@@ -0,0 +1,16 @@
+// Package legacynmap is a frozen copy of main's Account → NetworkMapComponents
+// → NetworkMap → proto path. It exists only to measure this tree against main:
+// the proto-equivalence test runs it over a production database copy, and the
+// nmaptest golden suite runs it as a third mode so every case pins all three
+// shapes to one expectation.
+//
+// It lives in its own package so it cannot reach this tree's unexported
+// helpers — a divergence can therefore never be hidden by the two sides
+// sharing code. Nothing in production imports it.
+//
+// Types are aliased rather than copied where they are byte-identical between
+// main and this branch. Anything that drifted is copied instead; see
+// converters.go and copied_funcs.go.
+//
+// Delete this package once the nmdata refactor is validated.
+package legacynmap
diff --git a/management/server/types/legacynmap/equivalence_test.go b/management/server/types/legacynmap/equivalence_test.go
new file mode 100644
index 000000000..20770e29b
--- /dev/null
+++ b/management/server/types/legacynmap/equivalence_test.go
@@ -0,0 +1,668 @@
+//go:build nmapequiv
+
+// Main-vs-branch equivalence check. For every peer of every account in a real
+// Postgres copy it computes the client-facing proto.NetworkMap twice:
+//
+//   - legacy path:  main's Account → NetworkMapComponents → Calculate → proto
+//     (the frozen copy in this package)
+//   - store path:   the pgsql nmdata store's NetworkMapData → components →
+//     Calculate → ToSyncResponse → proto (no Account involved)
+//   - account path: Account → toNetworkMapData twins → components → Calculate
+//     → ToSyncResponse → proto (the in-memory builder, no store queries)
+//
+// Both new paths are checked against the legacy proto.
+//
+// proto.NetworkMap is generated code identical in both trees, which is what
+// makes it the one usable comparison surface — the intermediate Go types differ
+// by design. proto.Equal would trip over repeated-field ordering, so both sides
+// are canonicalized first.
+//
+//	NETBIRD_STORE_ENGINE_POSTGRES_DSN='...' go test -tags nmapequiv \
+//	  -run TestNetworkMapProtoEquivalence -count=1 -timeout 60m \
+//	  ./management/server/types/legacynmap/
+//
+// Accounts are loaded one at a time and released between iterations, so peak
+// memory tracks the largest single account rather than the whole database.
+//
+// Env knobs: NETMAP_ACCOUNTS (comma-separated ids, skips discovery),
+// NETMAP_MAX_ACCOUNTS (0 = all), NETMAP_MAX_PEERS (0 = all). Fails at the
+// first divergence.
+package legacynmap_test
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"os"
+	"runtime"
+	"runtime/debug"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+	"google.golang.org/protobuf/encoding/prototext"
+	goproto "google.golang.org/protobuf/proto"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+	gormlogger "gorm.io/gorm/logger"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
+	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
+	networkmap_pgsql "github.com/netbirdio/netbird/management/internals/network_map_db/pgsql"
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
+	"github.com/netbirdio/netbird/management/server/settings"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/management/server/types/legacynmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const (
+	equivDNSName  = "netbird.cloud"
+	progressEvery = 5000
+)
+
+type equivStats struct {
+	accounts     int
+	peersChecked int
+}
+
+func TestNetworkMapProtoEquivalence(t *testing.T) {
+	if testing.Short() {
+		t.Skip("prod-db equivalence test, skipped in short mode")
+	}
+	dsn := equivDSN()
+	if dsn == "" {
+		t.Skip("NETBIRD_STORE_ENGINE_POSTGRES_DSN not set")
+	}
+
+	ctx := context.Background()
+	// skipMigration=true: this reads a restored production copy and must not
+	// alter its schema. Flip to false only if reads fail on an older dump.
+	testStore, err := store.NewPostgresqlStore(ctx, dsn, nil, true)
+	require.NoError(t, err, "connect to postgres")
+	t.Cleanup(func() { testStore.Close(ctx) })
+
+	pgStore, err := networkmap_pgsql.NewPostgresqlStore(ctx, dsn)
+	require.NoError(t, err, "connect nmdata store")
+	t.Cleanup(func() { pgStore.Pool.Close() })
+	nmStore := nmDataStore(t, pgStore)
+
+	accountIDs := equivAccountIDs(t, dsn)
+	require.NotEmpty(t, accountIDs, "no accounts selected")
+
+	stats := &equivStats{accounts: len(accountIDs)}
+	maxPeers := envInt("NETMAP_MAX_PEERS", 0)
+
+	for i, accountID := range accountIDs {
+		account, err := testStore.GetAccount(ctx, accountID)
+		if err != nil {
+			t.Logf("account %s: load failed, skipping: %v", accountID, err)
+			continue
+		}
+
+		checkAccount(ctx, t, testStore, nmStore, account, maxPeers, stats)
+
+		account = nil
+		debug.FreeOSMemory()
+
+		if i%progressEvery == 0 {
+			var ms runtime.MemStats
+			runtime.ReadMemStats(&ms)
+			t.Logf("progress: accounts=%d/%d peers_checked=%d heap=%dMiB", i, len(accountIDs), stats.peersChecked, ms.HeapAlloc>>20)
+		}
+	}
+
+	t.Logf("equivalence: accounts=%d peers_checked=%d — no divergence",
+		stats.accounts, stats.peersChecked)
+}
+
+// checkAccount compares both paths for every peer of one account. Nothing is
+// retained across peers, so memory stays flat within an account.
+func checkAccount(ctx context.Context, t *testing.T, accountStore store.Store, nmStore *networkmapdb.NetworkMapDBStoreImpl, account *types.Account, maxPeers int, stats *equivStats) {
+	t.Helper()
+
+	if len(account.Peers) == 0 {
+		return
+	}
+
+	nmData, err := nmStore.GetNetworkMapData(ctx, account.Id)
+	require.NoError(t, err, "account %s: nmdata store load", account.Id)
+
+	validated := make(map[string]struct{}, len(account.Peers))
+	peerIDs := make([]string, 0, len(account.Peers))
+	for peerID := range account.Peers {
+		validated[peerID] = struct{}{}
+		peerIDs = append(peerIDs, peerID)
+	}
+	sort.Strings(peerIDs)
+	if maxPeers > 0 && len(peerIDs) > maxPeers {
+		peerIDs = peerIDs[:maxPeers]
+	}
+
+	// Production fills ValidatedPeers via the integrated-validator wrapper; here
+	// every peer counts as validated, matching the legacy side's map.
+	nmData.ValidatedPeers = validated
+
+	// Custom DNS zones are built twice from the same rows — the account side
+	// from the zones manager, the store side in SQL — so both are fed in and
+	// compared rather than dropped. The same goes for the peers zone below:
+	// each side computes it with its own helper, which is where an AAAA gate
+	// that disagrees between the two would show up.
+	accountZones, err := accountStore.GetAccountZones(ctx, store.LockingStrengthNone, account.Id)
+	require.NoError(t, err, "account %s: load account zones", account.Id)
+
+	resourcePolicies := account.GetResourcePoliciesMap()
+	routers := account.GetResourceRoutersMap()
+	groupUsers := account.GetActiveGroupUsers()
+
+	// The reverse-proxy ACLs are synthesised, never persisted. Both new paths
+	// derive them inside the twin; main derived them in the controller, onto
+	// the account, before the resource-policy map. The legacy side therefore
+	// runs on its own view of the policies — a shallow copy so the account the
+	// other two paths read stays untouched and cannot double-count them.
+	legacyAccount := *account
+	if synth := legacynmap.SynthesizeProxyPolicies(account); len(synth) > 0 {
+		legacyAccount.Policies = append(slices.Clone(account.Policies), synth...)
+	}
+	legacyResourcePolicies := legacyAccount.GetResourcePoliciesMap()
+
+	settings := account.Settings
+	if settings == nil {
+		settings = &types.Settings{}
+	}
+
+	accountPeersZone := account.GetPeersCustomZone(ctx, equivDNSName)
+	storePeersZone := networkmap.PeersCustomZone(ctx, account.Id, equivDNSName, nmData.Peers, controller.IPv6AllowedPeersFromData(nmData))
+
+	for _, peerID := range peerIDs {
+		peer := account.Peers[peerID]
+		if peer == nil {
+			continue
+		}
+		dataPeer := nmData.Peers[peerID]
+		if dataPeer == nil {
+			t.Fatalf("after %d peers: account=%s peer=%s present in account store, missing in nmdata store", stats.peersChecked, account.Id, peerID)
+		}
+
+		// STORE PATH — nmdata store through the production computation, mirroring
+		// the controller's networkMapFromData.
+		components := nmData.GetPeerNetworkMapComponents(peerID, storePeersZone)
+		storeNM := &types.NetworkMap{Network: components.Network}
+		if !components.IsEmpty() {
+			storeNM = types.CalculateNetworkMapFromComponents(ctx, components)
+		}
+		// A separate cache per side: sharing one would let the first path
+		// populate entries the second then reuses, which can mask a real diff.
+		storeProto := mgmtgrpc.ToSyncResponse(
+			ctx, nil, nil, nil, dataPeer, nil, nil, storeNM, equivDNSName, nil,
+			&cache.DNSConfigCache{}, nmData.AccountSettings, settings.Extra, nil, 0,
+		).NetworkMap
+
+		// ACCOUNT PATH — Account → toNetworkMapData twins → components.
+		acctNM := account.GetPeerNetworkMapFromComponents(
+			ctx, peerID, accountPeersZone, accountZones, validated, resourcePolicies, routers, nil, groupUsers,
+		)
+		acctProto := mgmtgrpc.ToSyncResponse(
+			ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, acctNM, equivDNSName, nil,
+			&cache.DNSConfigCache{}, types.TwinAccountSettings(settings), settings.Extra, nil, 0,
+		).NetworkMap
+
+		// LEGACY PATH — main's frozen copy.
+		legacyNM := legacynmap.GetPeerNetworkMapFromComponents(
+			&legacyAccount, ctx, peerID, accountPeersZone, accountZones, validated, legacyResourcePolicies, routers, nil, groupUsers,
+		)
+		if legacyNM == nil {
+			t.Fatalf("after %d peers: account=%s peer=%s legacy NetworkMap nil, new non-nil", stats.peersChecked, account.Id, peerID)
+		}
+		legacyProto := legacynmap.ToProtoNetworkMap(
+			ctx, peer, legacyNM, equivDNSName, settings, nil, &cache.DNSConfigCache{}, 0,
+		)
+
+		canonicalize(legacyProto)
+		canonicalize(storeProto)
+		canonicalize(acctProto)
+		stats.peersChecked++
+
+		if !goproto.Equal(legacyProto, storeProto) {
+			t.Fatalf("after %d peers: store path: %s", stats.peersChecked, describeDivergence(legacyProto, storeProto, account.Id, peerID))
+		}
+		if !goproto.Equal(legacyProto, acctProto) {
+			t.Fatalf("after %d peers: account path: %s", stats.peersChecked, describeDivergence(legacyProto, acctProto, account.Id, peerID))
+		}
+	}
+}
+
+// nmDataStore wraps a raw connection store the way production's factory does.
+// The validator marks every peer validated and the extra settings are empty:
+// checkAccount overwrites ValidatedPeers anyway, and neither reaches the
+// compared network map.
+func nmDataStore(tb testing.TB, s networkmapdb.NetworkMapDBStore) *networkmapdb.NetworkMapDBStoreImpl {
+	tb.Helper()
+
+	extraSettings := settings.NewMockManager(gomock.NewController(tb))
+	extraSettings.EXPECT().GetExtraSettings(gomock.Any(), gomock.Any()).Return(&types.ExtraSettings{}, nil).AnyTimes()
+
+	return &networkmapdb.NetworkMapDBStoreImpl{
+		Store:                   s,
+		IntegratedPeerValidator: &validator.IntegratedValidatorImpl{},
+		ExtraSettingsManager:    extraSettings,
+	}
+}
+
+func equivDSN() string {
+	if dsn := os.Getenv("NETBIRD_STORE_ENGINE_POSTGRES_DSN"); dsn != "" {
+		return dsn
+	}
+	return os.Getenv("NB_STORE_ENGINE_POSTGRES_DSN")
+}
+
+// equivAccountIDs lists account ids with an id-only query. store.GetAllAccounts
+// would hydrate every account in the database before the first comparison runs.
+// Sorting happens in Go so the order does not depend on database collation.
+func equivAccountIDs(t *testing.T, dsn string) []string {
+	t.Helper()
+
+	if ids := strings.TrimSpace(os.Getenv("NETMAP_ACCOUNTS")); ids != "" {
+		var out []string
+		for _, id := range strings.Split(ids, ",") {
+			if id = strings.TrimSpace(id); id != "" {
+				out = append(out, id)
+			}
+		}
+		sort.Strings(out)
+		return out
+	}
+
+	db, err := gorm.Open(postgres.Open(dsn), &gorm.Config{Logger: gormlogger.Discard})
+	require.NoError(t, err, "open id-listing connection")
+	defer func() {
+		if sqlDB, err := db.DB(); err == nil {
+			sqlDB.Close()
+		}
+	}()
+
+	var ids []string
+	require.NoError(t, db.Model(&types.Account{}).Pluck("id", &ids).Error)
+	sort.Strings(ids)
+
+	if max := envInt("NETMAP_MAX_ACCOUNTS", 0); max > 0 && len(ids) > max {
+		ids = ids[:max]
+	}
+	return ids
+}
+
+func envInt(name string, def int) int {
+	if v := os.Getenv(name); v != "" {
+		if n, err := strconv.Atoi(v); err == nil {
+			return n
+		}
+	}
+	return def
+}
+
+// canonicalize sorts every repeated field by a stable key. Both paths iterate Go
+// maps while building these slices, so order can differ even when the content is
+// identical; without this proto.Equal reports noise.
+func canonicalize(nm *proto.NetworkMap) {
+	if nm == nil {
+		return
+	}
+	slices.SortFunc(nm.RemotePeers, cmpRemotePeer)
+	slices.SortFunc(nm.OfflinePeers, cmpRemotePeer)
+	slices.SortFunc(nm.Routes, cmpRoute)
+	slices.SortFunc(nm.FirewallRules, cmpFirewallRule)
+	slices.SortFunc(nm.RoutesFirewallRules, cmpRouteFirewallRule)
+
+	for _, r := range nm.FirewallRules {
+		slices.SortFunc(r.SourcePrefixes, bytes.Compare)
+	}
+	for _, r := range nm.RoutesFirewallRules {
+		slices.Sort(r.SourceRanges)
+	}
+	canonicalizeDNSConfig(nm.DNSConfig)
+	canonicalizeSSHAuth(nm.SshAuth)
+}
+
+func canonicalizeDNSConfig(d *proto.DNSConfig) {
+	if d == nil {
+		return
+	}
+	for _, g := range d.NameServerGroups {
+		if g == nil {
+			continue
+		}
+		slices.Sort(g.Domains)
+		slices.SortFunc(g.NameServers, func(a, b *proto.NameServer) int {
+			if a == nil || b == nil {
+				return boolCmp(a == nil, b == nil)
+			}
+			if c := cmp.Compare(a.IP, b.IP); c != 0 {
+				return c
+			}
+			if c := cmp.Compare(a.Port, b.Port); c != 0 {
+				return c
+			}
+			return cmp.Compare(a.NSType, b.NSType)
+		})
+	}
+	slices.SortFunc(d.NameServerGroups, func(a, b *proto.NameServerGroup) int {
+		return cmp.Compare(nsgKey(a), nsgKey(b))
+	})
+	for _, z := range d.CustomZones {
+		if z == nil {
+			continue
+		}
+		slices.SortFunc(z.Records, cmpSimpleRecord)
+	}
+	slices.SortFunc(d.CustomZones, func(a, b *proto.CustomZone) int {
+		if a == nil || b == nil {
+			return boolCmp(a == nil, b == nil)
+		}
+		return cmp.Compare(a.Domain, b.Domain)
+	})
+}
+
+// canonicalizeSSHAuth sorts AuthorizedUsers and re-keys MachineUsers.Indexes
+// against the new ordering, preserving which machine user maps to which hashes.
+func canonicalizeSSHAuth(s *proto.SSHAuth) {
+	if s == nil || len(s.AuthorizedUsers) == 0 {
+		return
+	}
+	type hashed struct {
+		bytes []byte
+		old   uint32
+	}
+	entries := make([]hashed, len(s.AuthorizedUsers))
+	for i, b := range s.AuthorizedUsers {
+		entries[i] = hashed{bytes: b, old: uint32(i)}
+	}
+	slices.SortFunc(entries, func(a, b hashed) int { return bytes.Compare(a.bytes, b.bytes) })
+
+	remap := make(map[uint32]uint32, len(entries))
+	sorted := make([][]byte, len(entries))
+	for newIdx, e := range entries {
+		remap[e.old] = uint32(newIdx)
+		sorted[newIdx] = e.bytes
+	}
+	s.AuthorizedUsers = sorted
+
+	for _, mu := range s.MachineUsers {
+		if mu == nil {
+			continue
+		}
+		for i, oldIdx := range mu.Indexes {
+			if newIdx, ok := remap[oldIdx]; ok {
+				mu.Indexes[i] = newIdx
+			}
+		}
+		slices.Sort(mu.Indexes)
+	}
+}
+
+func boolCmp(a, b bool) int {
+	if a == b {
+		return 0
+	}
+	if a {
+		return 1
+	}
+	return -1
+}
+
+func nsgKey(g *proto.NameServerGroup) string {
+	if g == nil {
+		return ""
+	}
+	var parts []string
+	for _, ns := range g.NameServers {
+		if ns == nil {
+			continue
+		}
+		parts = append(parts, ns.IP+":"+strconv.FormatInt(ns.Port, 10)+":"+strconv.FormatInt(ns.NSType, 10))
+	}
+	slices.Sort(parts)
+	key := strings.Join(parts, ",")
+	domains := append([]string(nil), g.Domains...)
+	slices.Sort(domains)
+	key += "|" + strings.Join(domains, "|")
+	if g.Primary {
+		key += "|P"
+	}
+	if g.SearchDomainsEnabled {
+		key += "|S"
+	}
+	return key
+}
+
+func cmpSimpleRecord(a, b *proto.SimpleRecord) int {
+	if a == nil || b == nil {
+		return boolCmp(a == nil, b == nil)
+	}
+	if c := cmp.Compare(a.Name, b.Name); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Type, b.Type); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Class, b.Class); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.RData, b.RData); c != 0 {
+		return c
+	}
+	return cmp.Compare(a.TTL, b.TTL)
+}
+
+func cmpRemotePeer(a, b *proto.RemotePeerConfig) int {
+	if a == nil || b == nil {
+		return boolCmp(a == nil, b == nil)
+	}
+	return cmp.Compare(a.WgPubKey, b.WgPubKey)
+}
+
+func cmpRoute(a, b *proto.Route) int {
+	if a == nil || b == nil {
+		return boolCmp(a == nil, b == nil)
+	}
+	if c := cmp.Compare(a.ID, b.ID); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.NetID, b.NetID); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Network, b.Network); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Peer, b.Peer); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Metric, b.Metric); c != 0 {
+		return c
+	}
+	return slices.Compare(a.Domains, b.Domains)
+}
+
+func cmpFirewallRule(a, b *proto.FirewallRule) int {
+	if a == nil || b == nil {
+		return boolCmp(a == nil, b == nil)
+	}
+	if c := bytes.Compare(a.PolicyID, b.PolicyID); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.PeerIP, b.PeerIP); c != 0 { //nolint:staticcheck
+		return c
+	}
+	if c := cmp.Compare(int32(a.Direction), int32(b.Direction)); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(int32(a.Action), int32(b.Action)); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Port, b.Port); c != 0 {
+		return c
+	}
+	return cmp.Compare(portInfoKey(a.PortInfo), portInfoKey(b.PortInfo))
+}
+
+func cmpRouteFirewallRule(a, b *proto.RouteFirewallRule) int {
+	if a == nil || b == nil {
+		return boolCmp(a == nil, b == nil)
+	}
+	if c := bytes.Compare(a.PolicyID, b.PolicyID); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.RouteID, b.RouteID); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.Destination, b.Destination); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(portInfoKey(a.PortInfo), portInfoKey(b.PortInfo)); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(int32(a.Action), int32(b.Action)); c != 0 {
+		return c
+	}
+	if c := slices.Compare(a.Domains, b.Domains); c != 0 {
+		return c
+	}
+	if c := slices.Compare(a.SourceRanges, b.SourceRanges); c != 0 {
+		return c
+	}
+	if c := cmp.Compare(a.CustomProtocol, b.CustomProtocol); c != 0 {
+		return c
+	}
+	return boolCmp(a.IsDynamic, b.IsDynamic)
+}
+
+func portInfoKey(pi *proto.PortInfo) string {
+	if pi == nil {
+		return ""
+	}
+	switch sel := pi.PortSelection.(type) {
+	case *proto.PortInfo_Port:
+		return "P" + strconv.FormatUint(uint64(sel.Port), 10)
+	case *proto.PortInfo_Range_:
+		if sel.Range == nil {
+			return "R"
+		}
+		return "R" + strconv.FormatUint(uint64(sel.Range.Start), 10) + "-" + strconv.FormatUint(uint64(sel.Range.End), 10)
+	}
+	return ""
+}
+
+// describeDivergence names the first differing field so a failure is actionable
+// without re-running against the database.
+func describeDivergence(legacy, updated *proto.NetworkMap, accountID, peerID string) string {
+	prefix := "account=" + accountID + " peer=" + peerID
+
+	lens := []struct {
+		field string
+		a, b  int
+		diff  func() string
+	}{
+		{"RemotePeers", len(legacy.RemotePeers), len(updated.RemotePeers), func() string { return diffLists(legacy.RemotePeers, updated.RemotePeers) }},
+		{"OfflinePeers", len(legacy.OfflinePeers), len(updated.OfflinePeers), func() string { return diffLists(legacy.OfflinePeers, updated.OfflinePeers) }},
+		{"Routes", len(legacy.Routes), len(updated.Routes), func() string { return diffLists(legacy.Routes, updated.Routes) }},
+		{"FirewallRules", len(legacy.FirewallRules), len(updated.FirewallRules), func() string { return diffLists(legacy.FirewallRules, updated.FirewallRules) }},
+		{"RoutesFirewallRules", len(legacy.RoutesFirewallRules), len(updated.RoutesFirewallRules), func() string { return diffLists(legacy.RoutesFirewallRules, updated.RoutesFirewallRules) }},
+	}
+	for _, l := range lens {
+		if l.a != l.b {
+			return prefix + " field=" + l.field + " legacy_len=" + strconv.Itoa(l.a) + " new_len=" + strconv.Itoa(l.b) + l.diff()
+		}
+	}
+
+	for i := range legacy.RemotePeers {
+		if !goproto.Equal(legacy.RemotePeers[i], updated.RemotePeers[i]) {
+			return prefix + " field=RemotePeers[" + strconv.Itoa(i) + "] legacy=" + protoStr(legacy.RemotePeers[i]) + " new=" + protoStr(updated.RemotePeers[i])
+		}
+	}
+	for i := range legacy.Routes {
+		if !goproto.Equal(legacy.Routes[i], updated.Routes[i]) {
+			return prefix + " field=Routes[" + strconv.Itoa(i) + "] legacy=" + protoStr(legacy.Routes[i]) + " new=" + protoStr(updated.Routes[i])
+		}
+	}
+	for i := range legacy.FirewallRules {
+		if !goproto.Equal(legacy.FirewallRules[i], updated.FirewallRules[i]) {
+			return prefix + " field=FirewallRules[" + strconv.Itoa(i) + "] legacy=" + protoStr(legacy.FirewallRules[i]) + " new=" + protoStr(updated.FirewallRules[i])
+		}
+	}
+	for i := range legacy.RoutesFirewallRules {
+		if !goproto.Equal(legacy.RoutesFirewallRules[i], updated.RoutesFirewallRules[i]) {
+			return prefix + " field=RoutesFirewallRules[" + strconv.Itoa(i) + "] legacy=" + protoStr(legacy.RoutesFirewallRules[i]) + " new=" + protoStr(updated.RoutesFirewallRules[i])
+		}
+	}
+	if !goproto.Equal(legacy.PeerConfig, updated.PeerConfig) {
+		return prefix + " field=PeerConfig legacy=" + protoStr(legacy.PeerConfig) + " new=" + protoStr(updated.PeerConfig)
+	}
+	if !goproto.Equal(legacy.DNSConfig, updated.DNSConfig) {
+		return prefix + " field=DNSConfig legacy=" + protoStr(legacy.DNSConfig) + " new=" + protoStr(updated.DNSConfig)
+	}
+	if !goproto.Equal(legacy.SshAuth, updated.SshAuth) {
+		return prefix + " field=SshAuth legacy=" + protoStr(legacy.SshAuth) + " new=" + protoStr(updated.SshAuth)
+	}
+	if legacy.Serial != updated.Serial {
+		return prefix + " field=Serial legacy=" + strconv.FormatUint(legacy.Serial, 10) + " new=" + strconv.FormatUint(updated.Serial, 10)
+	}
+	return prefix + " (repeated fields equal element-wise — scalar/oneof mismatch)"
+}
+
+// diffLists reports the multiset difference of two repeated proto fields, so a
+// length mismatch shows which elements each side is missing.
+func diffLists[M goproto.Message](legacy, updated []M) string {
+	counts := make(map[string]int)
+	for _, m := range legacy {
+		counts[prototext.MarshalOptions{}.Format(m)]++
+	}
+	for _, m := range updated {
+		counts[prototext.MarshalOptions{}.Format(m)]--
+	}
+
+	var onlyLegacy, onlyNew []string
+	for k, c := range counts {
+		for ; c > 0; c-- {
+			onlyLegacy = append(onlyLegacy, k)
+		}
+		for ; c < 0; c++ {
+			onlyNew = append(onlyNew, k)
+		}
+	}
+	slices.Sort(onlyLegacy)
+	slices.Sort(onlyNew)
+
+	var b strings.Builder
+	for _, k := range onlyLegacy {
+		b.WriteString("\n  only_legacy: " + k)
+	}
+	for _, k := range onlyNew {
+		b.WriteString("\n  only_new: " + k)
+	}
+	return b.String()
+}
+
+func protoStr(m goproto.Message) string {
+	if m == nil {
+		return "<nil>"
+	}
+	s := prototext.Format(m)
+	const maxLen = 800
+	if len(s) > maxLen {
+		return s[:maxLen] + "...(truncated)"
+	}
+	return s
+}
diff --git a/management/server/types/legacynmap/firewall_helpers.go b/management/server/types/legacynmap/firewall_helpers.go
new file mode 100644
index 000000000..d78690f3e
--- /dev/null
+++ b/management/server/types/legacynmap/firewall_helpers.go
@@ -0,0 +1,155 @@
+package legacynmap
+
+import (
+	"strconv"
+	"strings"
+
+	v "github.com/hashicorp/go-version"
+
+	"github.com/netbirdio/netbird/version"
+)
+
+const (
+	firewallRuleMinPortRangesVer = "0.48.0"
+	firewallRuleMinNativeSSHVer  = "0.60.0"
+
+	nativeSSHPortString  = "22022"
+	nativeSSHPortNumber  = 22022
+	defaultSSHPortString = "22"
+	defaultSSHPortNumber = 22
+)
+
+type supportedFeatures struct {
+	nativeSSH  bool
+	portRanges bool
+}
+
+type LookupMap map[string]struct{}
+
+func PolicyRuleImpliesLegacySSH(rule *PolicyRule) bool {
+	return rule.Protocol == PolicyRuleProtocolALL || (rule.Protocol == PolicyRuleProtocolTCP && (portsIncludesSSH(rule.Ports) || portRangeIncludesSSH(rule.PortRanges)))
+}
+
+func portRangeIncludesSSH(portRanges []RulePortRange) bool {
+	for _, pr := range portRanges {
+		if (pr.Start <= defaultSSHPortNumber && pr.End >= defaultSSHPortNumber) || (pr.Start <= nativeSSHPortNumber && pr.End >= nativeSSHPortNumber) {
+			return true
+		}
+	}
+	return false
+}
+
+func portsIncludesSSH(ports []string) bool {
+	for _, port := range ports {
+		if port == defaultSSHPortString || port == nativeSSHPortString {
+			return true
+		}
+	}
+	return false
+}
+
+// ExpandPortsAndRanges expands Ports and PortRanges of a rule into individual firewall rules.
+func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *ComponentPeer) []*FirewallRule {
+	features := peerSupportedFirewallFeatures(peer.AgentVersion)
+
+	var expanded []*FirewallRule
+
+	for _, port := range rule.Ports {
+		fr := base
+		fr.Port = port
+		expanded = append(expanded, &fr)
+	}
+
+	for _, portRange := range rule.PortRanges {
+		if len(rule.Ports) > 0 {
+			break
+		}
+		fr := base
+
+		if features.portRanges {
+			fr.PortRange = portRange
+		} else {
+			if portRange.Start != portRange.End {
+				continue
+			}
+			fr.Port = strconv.FormatUint(uint64(portRange.Start), 10)
+		}
+		expanded = append(expanded, &fr)
+	}
+
+	if shouldCheckRulesForNativeSSH(features.nativeSSH, rule, peer) || rule.Protocol == PolicyRuleProtocolNetbirdSSH {
+		expanded = addNativeSSHRule(base, expanded)
+	}
+
+	return expanded
+}
+
+func addNativeSSHRule(base FirewallRule, expanded []*FirewallRule) []*FirewallRule {
+	shouldAdd := false
+	for _, fr := range expanded {
+		if isPortInRule(nativeSSHPortString, 22022, fr) {
+			return expanded
+		}
+		if isPortInRule(defaultSSHPortString, 22, fr) {
+			shouldAdd = true
+		}
+	}
+	if !shouldAdd {
+		return expanded
+	}
+
+	fr := base
+	fr.Port = nativeSSHPortString
+	return append(expanded, &fr)
+}
+
+func isPortInRule(portString string, portInt uint16, rule *FirewallRule) bool {
+	return rule.Port == portString || (rule.PortRange.Start <= portInt && portInt <= rule.PortRange.End)
+}
+
+func shouldCheckRulesForNativeSSH(supportsNative bool, rule *PolicyRule, peer *ComponentPeer) bool {
+	return supportsNative && peer.SSHEnabled && peer.ServerSSHAllowed && rule.Protocol == PolicyRuleProtocolTCP
+}
+
+func peerSupportedFirewallFeatures(peerVer string) supportedFeatures {
+	if version.IsDevelopmentVersion(peerVer) {
+		return supportedFeatures{true, true}
+	}
+
+	var features supportedFeatures
+
+	meetMinVer, err := meetsMinVersion(firewallRuleMinNativeSSHVer, peerVer)
+	features.nativeSSH = err == nil && meetMinVer
+
+	if features.nativeSSH {
+		features.portRanges = true
+	} else {
+		meetMinVer, err = meetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
+		features.portRanges = err == nil && meetMinVer
+	}
+
+	return features
+}
+
+// meetsMinVersion is main's version.MeetsMinVersion, which does not exist at HEAD.
+func meetsMinVersion(minVer, peerVer string) (bool, error) {
+	peerVer = sanitizeVersion(peerVer)
+	minVer = sanitizeVersion(minVer)
+
+	peerNBVer, err := v.NewVersion(peerVer)
+	if err != nil {
+		return false, err
+	}
+
+	constraints, err := v.NewConstraint(">= " + minVer)
+	if err != nil {
+		return false, err
+	}
+
+	return constraints.Check(peerNBVer), nil
+}
+
+func sanitizeVersion(version string) string {
+	parts := strings.Split(version, "-")
+	return parts[0]
+}
diff --git a/management/server/types/networkmap_components.go b/management/server/types/legacynmap/networkmap_components.go
similarity index 82%
rename from management/server/types/networkmap_components.go
rename to management/server/types/legacynmap/networkmap_components.go
index b5514e19b..3f71dafa5 100644
--- a/management/server/types/networkmap_components.go
+++ b/management/server/types/legacynmap/networkmap_components.go
@@ -1,4 +1,4 @@
-package types
+package legacynmap
 
 import (
 	"context"
@@ -7,13 +7,11 @@ import (
 	"slices"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/netbirdio/netbird/client/ssh/auth"
 	nbdns "github.com/netbirdio/netbird/dns"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
@@ -26,22 +24,48 @@ type NetworkMapComponents struct {
 	DNSSettings      *DNSSettings
 	CustomZoneDomain string
 
-	Peers               map[string]*nbpeer.Peer
-	Groups              map[string]*Group
+	Peers               map[string]*ComponentPeer
+	Groups              map[string]*ComponentGroup
 	Policies            []*Policy
 	Routes              []*route.Route
 	NameServerGroups    []*nbdns.NameServerGroup
 	AllDNSRecords       []nbdns.SimpleRecord
 	AccountZones        []nbdns.CustomZone
 	ResourcePoliciesMap map[string][]*Policy
-	RoutersMap          map[string]map[string]*routerTypes.NetworkRouter
-	NetworkResources    []*resourceTypes.NetworkResource
+	RoutersMap          map[string]map[string]*ComponentRouter
+	NetworkResources    []*ComponentResource
 
 	GroupIDToUserIDs   map[string][]string
 	AllowedUserIDs     map[string]struct{}
 	PostureFailedPeers map[string]map[string]struct{}
 
-	RouterPeers map[string]*nbpeer.Peer
+	RouterPeers map[string]*ComponentPeer
+
+	// NetworkXIDToPublicID maps Network.ID (xid) → PublicID.
+	// Consumed by the envelope encoder to
+	// translate RoutersMap keys and NetworkResource.NetworkID references
+	// to compact uint32 ids. Legacy Calculate() doesn't consult it.
+	NetworkXIDToPublicID map[string]string
+
+	// PostureCheckXIDToPublicID maps posture.Checks.ID (xid) → PublicID.
+	// Same role as NetworkXIDToPublicID, used for PostureFailedPeers keys and
+	// policy SourcePostureChecks references.
+	PostureCheckXIDToPublicID map[string]string
+	routesByPeerOnce          sync.Once
+	routesByPeerIdx           map[string][]routeIndexEntry
+
+	// true when returning an empty-like map (returned instead of nil)
+	empty bool
+
+	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
+	// resolution regardless of the account-global setting, for reverse-proxy
+	// domain targets.
+	ForceRoutingPeerDNSResolution bool
+}
+
+type routeIndexEntry struct {
+	route    *route.Route
+	viaGroup bool
 }
 
 type AccountSettingsInfo struct {
@@ -51,15 +75,20 @@ type AccountSettingsInfo struct {
 	PeerInactivityExpiration        time.Duration
 }
 
-func (c *NetworkMapComponents) GetPeerInfo(peerID string) *nbpeer.Peer {
+func EmptyNetworkMapComponents(nm *NetworkMapComponents) *NetworkMapComponents {
+	nm.empty = true
+	return nm
+}
+
+func (c *NetworkMapComponents) GetPeerInfo(peerID string) *ComponentPeer {
 	return c.Peers[peerID]
 }
 
-func (c *NetworkMapComponents) GetRouterPeerInfo(peerID string) *nbpeer.Peer {
+func (c *NetworkMapComponents) GetRouterPeerInfo(peerID string) *ComponentPeer {
 	return c.RouterPeers[peerID]
 }
 
-func (c *NetworkMapComponents) GetGroupInfo(groupID string) *Group {
+func (c *NetworkMapComponents) GetGroupInfo(groupID string) *ComponentGroup {
 	return c.Groups[groupID]
 }
 
@@ -115,7 +144,7 @@ func (c *NetworkMapComponents) Calculate(ctx context.Context) *NetworkMap {
 
 	includeIPv6 := false
 	if p := c.Peers[targetPeerID]; p != nil {
-		includeIPv6 = p.SupportsIPv6() && p.IPv6.IsValid()
+		includeIPv6 = p.SupportsIPv6 && p.IPv6.IsValid()
 	}
 	routesUpdate := filterAndExpandRoutes(c.getRoutesToSync(targetPeerID, peersToConnect, peerGroups), includeIPv6)
 	routesFirewallRules := c.getPeerRoutesFirewallRules(ctx, targetPeerID, includeIPv6)
@@ -166,10 +195,16 @@ func (c *NetworkMapComponents) Calculate(ctx context.Context) *NetworkMap {
 		RoutesFirewallRules: append(networkResourcesFirewallRules, routesFirewallRules...),
 		AuthorizedUsers:     authorizedUsers,
 		EnableSSH:           sshEnabled,
+
+		ForceRoutingPeerDNSResolution: c.ForceRoutingPeerDNSResolution,
 	}
 }
 
-func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) ([]*nbpeer.Peer, []*FirewallRule, map[string]map[string]struct{}, bool) {
+func (c *NetworkMapComponents) IsEmpty() bool {
+	return c.empty
+}
+
+func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) ([]*ComponentPeer, []*FirewallRule, map[string]map[string]struct{}, bool) {
 	targetPeer := c.GetPeerInfo(targetPeerID)
 	if targetPeer == nil {
 		return nil, nil, nil, false
@@ -189,7 +224,7 @@ func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) (
 				continue
 			}
 
-			var sourcePeers, destinationPeers []*nbpeer.Peer
+			var sourcePeers, destinationPeers []*ComponentPeer
 			var peerInSources, peerInDestinations bool
 
 			if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
@@ -252,7 +287,7 @@ func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) (
 				default:
 					authorizedUsers[auth.Wildcard] = c.getAllowedUserIDs()
 				}
-			} else if peerInDestinations && policyRuleImpliesLegacySSH(rule) && targetPeer.SSHEnabled {
+			} else if peerInDestinations && PolicyRuleImpliesLegacySSH(rule) && targetPeer.SSHEnabled {
 				sshEnabled = true
 				authorizedUsers[auth.Wildcard] = c.getAllowedUserIDs()
 			}
@@ -272,13 +307,13 @@ func (c *NetworkMapComponents) getAllowedUserIDs() map[string]struct{} {
 	return make(map[string]struct{})
 }
 
-func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *nbpeer.Peer) (func(*PolicyRule, []*nbpeer.Peer, int), func() ([]*nbpeer.Peer, []*FirewallRule)) {
+func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *ComponentPeer) (func(*PolicyRule, []*ComponentPeer, int), func() ([]*ComponentPeer, []*FirewallRule)) {
 	rulesExists := make(map[string]struct{})
 	peersExists := make(map[string]struct{})
 	rules := make([]*FirewallRule, 0)
-	peers := make([]*nbpeer.Peer, 0)
+	peers := make([]*ComponentPeer, 0)
 
-	return func(rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int) {
+	return func(rule *PolicyRule, groupPeers []*ComponentPeer, direction int) {
 			protocol := rule.Protocol
 			if protocol == PolicyRuleProtocolNetbirdSSH {
 				protocol = PolicyRuleProtocolTCP
@@ -319,26 +354,26 @@ func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *nbpeer.Peer) (
 				if len(rule.Ports) == 0 && len(rule.PortRanges) == 0 {
 					rules = append(rules, &fr)
 				} else {
-					rules = append(rules, expandPortsAndRanges(fr, rule, targetPeer)...)
+					rules = append(rules, ExpandPortsAndRanges(fr, rule, targetPeer)...)
 				}
 
-				rules = appendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, firewallRuleContext{
-					direction:   direction,
-					dirStr:      dirStr,
-					protocolStr: protocolStr,
-					actionStr:   actionStr,
-					portsJoined: portsJoined,
+				rules = AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, FirewallRuleContext{
+					Direction:   direction,
+					DirStr:      dirStr,
+					ProtocolStr: protocolStr,
+					ActionStr:   actionStr,
+					PortsJoined: portsJoined,
 				})
 			}
-		}, func() ([]*nbpeer.Peer, []*FirewallRule) {
+		}, func() ([]*ComponentPeer, []*FirewallRule) {
 			return peers, rules
 		}
 }
 
-func (c *NetworkMapComponents) getAllPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string) ([]*nbpeer.Peer, bool) {
+func (c *NetworkMapComponents) getAllPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string) ([]*ComponentPeer, bool) {
 	peerInGroups := false
 	uniquePeerIDs := c.getUniquePeerIDsFromGroupsIDs(groups)
-	filteredPeers := make([]*nbpeer.Peer, 0, len(uniquePeerIDs))
+	filteredPeers := make([]*ComponentPeer, 0, len(uniquePeerIDs))
 
 	for _, p := range uniquePeerIDs {
 		peerInfo := c.GetPeerInfo(p)
@@ -390,22 +425,22 @@ func (c *NetworkMapComponents) getUniquePeerIDsFromGroupsIDs(groups []string) []
 	return ids
 }
 
-func (c *NetworkMapComponents) getPeerFromResource(resource Resource, peerID string) ([]*nbpeer.Peer, bool) {
+func (c *NetworkMapComponents) getPeerFromResource(resource Resource, peerID string) ([]*ComponentPeer, bool) {
 	if resource.ID == peerID {
-		return []*nbpeer.Peer{}, true
+		return []*ComponentPeer{}, true
 	}
 
 	peerInfo := c.GetPeerInfo(resource.ID)
 	if peerInfo == nil {
-		return []*nbpeer.Peer{}, false
+		return []*ComponentPeer{}, false
 	}
 
-	return []*nbpeer.Peer{peerInfo}, false
+	return []*ComponentPeer{peerInfo}, false
 }
 
-func (c *NetworkMapComponents) filterPeersByLoginExpiration(aclPeers []*nbpeer.Peer) ([]*nbpeer.Peer, []*nbpeer.Peer) {
-	peersToConnect := make([]*nbpeer.Peer, 0, len(aclPeers))
-	var expiredPeers []*nbpeer.Peer
+func (c *NetworkMapComponents) filterPeersByLoginExpiration(aclPeers []*ComponentPeer) ([]*ComponentPeer, []*ComponentPeer) {
+	peersToConnect := make([]*ComponentPeer, 0, len(aclPeers))
+	var expiredPeers []*ComponentPeer
 
 	for _, p := range aclPeers {
 		expired, _ := p.LoginExpired(c.AccountSettings.PeerLoginExpiration)
@@ -487,7 +522,7 @@ func filterAndExpandRoutes(routes []*route.Route, includeIPv6 bool) []*route.Rou
 	return filtered
 }
 
-func (c *NetworkMapComponents) getRoutesToSync(peerID string, aclPeers []*nbpeer.Peer, peerGroups LookupMap) []*route.Route {
+func (c *NetworkMapComponents) getRoutesToSync(peerID string, aclPeers []*ComponentPeer, peerGroups LookupMap) []*route.Route {
 	routes, peerDisabledRoutes := c.getRoutingPeerRoutes(peerID)
 	peerRoutesMembership := make(LookupMap)
 	for _, r := range append(routes, peerDisabledRoutes...) {
@@ -530,33 +565,43 @@ func (c *NetworkMapComponents) getRoutingPeerRoutes(peerID string) (enabledRoute
 		disabledRoutes = append(disabledRoutes, r)
 	}
 
-	for _, r := range c.Routes {
-		for _, groupID := range r.PeerGroups {
-			group := c.GetGroupInfo(groupID)
-			if group == nil {
-				continue
-			}
-			for _, id := range group.Peers {
-				if id != peerID {
-					continue
-				}
-
-				newPeerRoute := r.Copy()
-				newPeerRoute.Peer = id
-				newPeerRoute.PeerGroups = nil
-				newPeerRoute.ID = route.ID(string(r.ID) + ":" + id)
-				takeRoute(newPeerRoute)
-				break
-			}
-		}
-		if r.Peer == peerID {
-			takeRoute(r.Copy())
+	for _, entry := range c.routesByPeer()[peerID] {
+		if entry.viaGroup {
+			newPeerRoute := entry.route.Copy()
+			newPeerRoute.PeerGroups = nil
+			newPeerRoute.ID = route.ID(string(entry.route.ID) + ":" + peerID)
+			takeRoute(newPeerRoute)
+			continue
 		}
+		takeRoute(entry.route.Copy())
 	}
 
 	return enabledRoutes, disabledRoutes
 }
 
+func (c *NetworkMapComponents) routesByPeer() map[string][]routeIndexEntry {
+	c.routesByPeerOnce.Do(func() {
+		idx := make(map[string][]routeIndexEntry)
+		for _, r := range c.Routes {
+			for _, groupID := range r.PeerGroups {
+				group := c.GetGroupInfo(groupID)
+				if group == nil {
+					continue
+				}
+				for _, id := range group.Peers {
+					idx[id] = append(idx[id], routeIndexEntry{route: r, viaGroup: true})
+				}
+			}
+			if r.Peer != "" {
+				idx[r.Peer] = append(idx[r.Peer], routeIndexEntry{route: r})
+			}
+		}
+		c.routesByPeerIdx = idx
+	})
+
+	return c.routesByPeerIdx
+}
+
 func (c *NetworkMapComponents) filterRoutesByGroups(routes []*route.Route, groupListMap LookupMap) []*route.Route {
 	var filteredRoutes []*route.Route
 	for _, r := range routes {
@@ -684,14 +729,14 @@ func (c *NetworkMapComponents) getRouteFirewallRules(ctx context.Context, peerID
 			}
 
 			rulePeers := c.getRulePeers(rule, policy.SourcePostureChecks, peerID, distributionPeers)
-			rules := generateRouteFirewallRules(ctx, route, rule, rulePeers, FirewallRuleDirectionIN, includeIPv6)
+			rules := GenerateRouteFirewallRules(ctx, route, rule, rulePeers, FirewallRuleDirectionIN, includeIPv6)
 			fwRules = append(fwRules, rules...)
 		}
 	}
 	return fwRules
 }
 
-func (c *NetworkMapComponents) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}) []*nbpeer.Peer {
+func (c *NetworkMapComponents) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}) []*ComponentPeer {
 	distPeersWithPolicy := make(map[string]struct{})
 	for _, id := range rule.Sources {
 		group := c.GetGroupInfo(id)
@@ -718,7 +763,7 @@ func (c *NetworkMapComponents) getRulePeers(rule *PolicyRule, postureChecks []st
 		}
 	}
 
-	distributionGroupPeers := make([]*nbpeer.Peer, 0, len(distPeersWithPolicy))
+	distributionGroupPeers := make([]*ComponentPeer, 0, len(distPeersWithPolicy))
 	for pID := range distPeersWithPolicy {
 		peerInfo := c.GetPeerInfo(pID)
 		if peerInfo == nil {
@@ -758,8 +803,8 @@ func (c *NetworkMapComponents) getNetworkResourcesRoutesToSync(peerID string) (b
 
 func (c *NetworkMapComponents) processResourcePolicies(
 	peerID string,
-	resource *resourceTypes.NetworkResource,
-	networkRoutingPeers map[string]*routerTypes.NetworkRouter,
+	resource *ComponentResource,
+	networkRoutingPeers map[string]*ComponentRouter,
 	addSourcePeers bool,
 	allSourcePeers map[string]struct{},
 ) []*route.Route {
@@ -792,7 +837,7 @@ func (c *NetworkMapComponents) getResourcePolicyPeers(policy *Policy) []string {
 	return c.getUniquePeerIDsFromGroupsIDs(policy.SourceGroups())
 }
 
-func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *resourceTypes.NetworkResource, peerID string, router *routerTypes.NetworkRouter) []*route.Route {
+func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *ComponentResource, peerID string, router *ComponentRouter) []*route.Route {
 	resourceAppliedPolicies := c.ResourcePoliciesMap[resource.ID]
 
 	var routes []*route.Route
@@ -806,7 +851,7 @@ func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *resourceTypes
 	return routes
 }
 
-func (c *NetworkMapComponents) networkResourceToRoute(resource *resourceTypes.NetworkResource, peer *nbpeer.Peer, router *routerTypes.NetworkRouter) *route.Route {
+func (c *NetworkMapComponents) networkResourceToRoute(resource *ComponentResource, peer *ComponentPeer, router *ComponentRouter) *route.Route {
 	r := &route.Route{
 		ID:          route.ID(resource.ID + ":" + peer.ID),
 		AccountID:   resource.AccountID,
@@ -820,7 +865,7 @@ func (c *NetworkMapComponents) networkResourceToRoute(resource *resourceTypes.Ne
 		Description: resource.Description,
 	}
 
-	if resource.Type == resourceTypes.Host || resource.Type == resourceTypes.Subnet {
+	if resource.Type == ComponentResourceHost || resource.Type == ComponentResourceSubnet {
 		r.Network = resource.Prefix
 
 		r.NetworkType = route.IPv4Network
@@ -829,7 +874,7 @@ func (c *NetworkMapComponents) networkResourceToRoute(resource *resourceTypes.Ne
 		}
 	}
 
-	if resource.Type == resourceTypes.Domain {
+	if resource.Type == ComponentResourceDomain {
 		domainList, err := domain.FromStringList([]string{resource.Domain})
 		if err == nil {
 			r.Domains = domainList
@@ -907,11 +952,11 @@ func (c *NetworkMapComponents) getPoliciesSourcePeers(policies []*Policy) map[st
 func (c *NetworkMapComponents) addNetworksRoutingPeers(
 	networkResourcesRoutes []*route.Route,
 	peerID string,
-	peersToConnect []*nbpeer.Peer,
-	expiredPeers []*nbpeer.Peer,
+	peersToConnect []*ComponentPeer,
+	expiredPeers []*ComponentPeer,
 	isRouter bool,
 	sourcePeers map[string]struct{},
-) []*nbpeer.Peer {
+) []*ComponentPeer {
 
 	networkRoutesPeers := make(map[string]struct{}, len(networkResourcesRoutes))
 	for _, r := range networkResourcesRoutes {
@@ -953,21 +998,21 @@ func (c *NetworkMapComponents) addNetworksRoutingPeers(
 	return peersToConnect
 }
 
-type firewallRuleContext struct {
-	direction   int
-	dirStr      string
-	protocolStr string
-	actionStr   string
-	portsJoined string
+type FirewallRuleContext struct {
+	Direction   int
+	DirStr      string
+	ProtocolStr string
+	ActionStr   string
+	PortsJoined string
 }
 
-func appendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *nbpeer.Peer, rule *PolicyRule, rc firewallRuleContext) []*FirewallRule {
-	if !peer.IPv6.IsValid() || !targetPeer.SupportsIPv6() || !targetPeer.IPv6.IsValid() {
+func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *ComponentPeer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
+	if !peer.IPv6.IsValid() || !targetPeer.SupportsIPv6 || !targetPeer.IPv6.IsValid() {
 		return rules
 	}
 
 	v6IP := peer.IPv6.String()
-	v6RuleID := rule.ID + v6IP + rc.dirStr + rc.protocolStr + rc.actionStr + rc.portsJoined
+	v6RuleID := rule.ID + v6IP + rc.DirStr + rc.ProtocolStr + rc.ActionStr + rc.PortsJoined
 	if _, ok := rulesExists[v6RuleID]; ok {
 		return rules
 	}
@@ -976,12 +1021,12 @@ func appendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct
 	v6fr := FirewallRule{
 		PolicyID:  rule.ID,
 		PeerIP:    v6IP,
-		Direction: rc.direction,
-		Action:    rc.actionStr,
-		Protocol:  rc.protocolStr,
+		Direction: rc.Direction,
+		Action:    rc.ActionStr,
+		Protocol:  rc.ProtocolStr,
 	}
 	if len(rule.Ports) == 0 && len(rule.PortRanges) == 0 {
 		return append(rules, &v6fr)
 	}
-	return append(rules, expandPortsAndRanges(v6fr, rule, targetPeer)...)
+	return append(rules, ExpandPortsAndRanges(v6fr, rule, targetPeer)...)
 }
diff --git a/management/server/types/legacynmap/proto_legacy.go b/management/server/types/legacynmap/proto_legacy.go
new file mode 100644
index 000000000..36dc35401
--- /dev/null
+++ b/management/server/types/legacynmap/proto_legacy.go
@@ -0,0 +1,212 @@
+package legacynmap
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+	"net/url"
+	"strings"
+
+	"github.com/netbirdio/netbird/client/ssh/auth"
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+	nbroute "github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/netiputil"
+)
+
+func ToProtocolRoutes(routes []*nbroute.Route) []*proto.Route {
+	protoRoutes := make([]*proto.Route, 0, len(routes))
+	for _, r := range routes {
+		protoRoutes = append(protoRoutes, ToProtocolRoute(r))
+	}
+	return protoRoutes
+}
+
+func ToProtocolRoute(route *nbroute.Route) *proto.Route {
+	return &proto.Route{
+		ID:            string(route.ID),
+		NetID:         string(route.NetID),
+		Network:       route.Network.String(),
+		Domains:       route.Domains.ToPunycodeList(),
+		NetworkType:   int64(route.NetworkType),
+		Peer:          route.Peer,
+		Metric:        int64(route.Metric),
+		Masquerade:    route.Masquerade,
+		KeepRoute:     route.KeepRoute,
+		SkipAutoApply: route.SkipAutoApply,
+	}
+}
+
+func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*ComponentPeer, dnsName string, includeIPv6 bool, localIsProxy bool) []*proto.RemotePeerConfig {
+	for _, rPeer := range peers {
+		allowedIPs := []string{rPeer.IP.String() + "/32"}
+		if includeIPv6 && rPeer.IPv6.IsValid() {
+			allowedIPs = append(allowedIPs, rPeer.IPv6.String()+"/128")
+		}
+		dst = append(dst, &proto.RemotePeerConfig{
+			WgPubKey:     rPeer.Key,
+			AllowedIps:   allowedIPs,
+			SshConfig:    &proto.SSHConfig{SshPubKey: []byte(rPeer.SSHKey)},
+			Fqdn:         rPeer.FQDN(dnsName),
+			AgentVersion: rPeer.AgentVersion,
+			LazyState:    lazyStateFor(localIsProxy, rPeer),
+		})
+	}
+	return dst
+}
+
+// lazyStateFor returns the per-peer lazy override for a remote peer. Connections
+// involving an ephemeral proxy peer on either endpoint default to lazy so shared
+// proxy infrastructure is not kept permanently connected to every peer. All
+// other peers follow the account-wide flag. A future admin-facing per-peer
+// setting can return LazyStateEager here to force a peer always-active.
+func lazyStateFor(localIsProxy bool, rPeer *ComponentPeer) proto.LazyState {
+	if localIsProxy || rPeer.ProxyEmbedded {
+		return proto.LazyState_LazyStateLazy
+	}
+	return proto.LazyState_LazyStateDefault
+}
+
+func buildJWTConfig(config *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow) *proto.JWTConfig {
+	if config == nil || config.AuthAudience == "" {
+		return nil
+	}
+
+	issuer := strings.TrimSpace(config.AuthIssuer)
+	if issuer == "" && deviceFlowConfig != nil {
+		if d := deriveIssuerFromTokenEndpoint(deviceFlowConfig.ProviderConfig.TokenEndpoint); d != "" {
+			issuer = d
+		}
+	}
+	if issuer == "" {
+		return nil
+	}
+
+	keysLocation := strings.TrimSpace(config.AuthKeysLocation)
+	if keysLocation == "" {
+		keysLocation = strings.TrimSuffix(issuer, "/") + "/.well-known/jwks.json"
+	}
+
+	audience := config.AuthAudience
+	if config.CLIAuthAudience != "" {
+		audience = config.CLIAuthAudience
+	}
+
+	audiences := []string{config.AuthAudience}
+	if config.CLIAuthAudience != "" && config.CLIAuthAudience != config.AuthAudience {
+		audiences = append(audiences, config.CLIAuthAudience)
+	}
+
+	return &proto.JWTConfig{
+		Issuer:       issuer,
+		Audience:     audience, //nolint:staticcheck
+		Audiences:    audiences,
+		KeysLocation: keysLocation,
+	}
+}
+
+func toPeerConfig(peer *nbpeer.Peer, network *Network, dnsName string, settings *types.Settings, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool, forceRoutingPeerDNS bool) *proto.PeerConfig {
+	netmask, _ := network.Net.Mask.Size()
+	fqdn := peer.FQDN(dnsName)
+
+	sshConfig := &proto.SSHConfig{
+		SshEnabled: peer.SSHEnabled || enableSSH,
+	}
+
+	if sshConfig.SshEnabled {
+		sshConfig.JwtConfig = buildJWTConfig(httpConfig, deviceFlowConfig)
+	}
+
+	peerConfig := &proto.PeerConfig{
+		Address:                         fmt.Sprintf("%s/%d", peer.IP.String(), netmask),
+		SshConfig:                       sshConfig,
+		Fqdn:                            fqdn,
+		RoutingPeerDnsResolutionEnabled: settings.RoutingPeerDNSResolutionEnabled || peer.ProxyMeta.Embedded || forceRoutingPeerDNS,
+		LazyConnectionEnabled:           settings.LazyConnectionEnabled,
+		AutoUpdate: &proto.AutoUpdateSettings{
+			Version:      settings.AutoUpdateVersion,
+			AlwaysUpdate: settings.AutoUpdateAlways,
+		},
+	}
+
+	if peer.SupportsIPv6() && peer.IPv6.IsValid() && network.NetV6.IP != nil {
+		ones, _ := network.NetV6.Mask.Size()
+		v6Prefix := netip.PrefixFrom(peer.IPv6.Unmap(), ones)
+		if b, err := netiputil.EncodePrefix(v6Prefix); err == nil {
+			peerConfig.AddressV6 = b
+		}
+	}
+
+	return peerConfig
+}
+
+// ToProtoNetworkMap mirrors main's ToSyncResponse, restricted to the
+// proto.NetworkMap it produces. SyncResponse-level fields (NetbirdConfig,
+// Checks, the deprecated top-level RemotePeers) are omitted — they are not part
+// of the equivalence surface. PeerConfig is included because proto.NetworkMap
+// carries it, and it is where main's ForceRoutingPeerDNSResolution surfaces.
+func ToProtoNetworkMap(
+	ctx context.Context,
+	peer *nbpeer.Peer,
+	nm *NetworkMap,
+	dnsName string,
+	settings *types.Settings,
+	httpConfig *nbconfig.HttpServerConfig,
+	dnsCache networkmap.DNSConfigCache,
+	dnsFwdPort int64,
+) *proto.NetworkMap {
+	includeIPv6 := peer.SupportsIPv6() && peer.IPv6.IsValid()
+	useSourcePrefixes := peer.SupportsSourcePrefixes()
+	localIsProxy := peer.ProxyMeta.Embedded
+
+	peerConfig := toPeerConfig(peer, nm.Network, dnsName, settings, httpConfig, nil, nm.EnableSSH, nm.ForceRoutingPeerDNSResolution)
+
+	pm := &proto.NetworkMap{
+		Serial:     nm.Network.CurrentSerial(),
+		Routes:     ToProtocolRoutes(nm.Routes),
+		DNSConfig:  networkmap.ToProtocolDNSConfig(nm.DNSConfig, dnsCache, dnsFwdPort),
+		PeerConfig: peerConfig,
+	}
+
+	remotePeers := make([]*proto.RemotePeerConfig, 0, len(nm.Peers)+len(nm.OfflinePeers))
+	remotePeers = AppendRemotePeerConfig(remotePeers, nm.Peers, dnsName, includeIPv6, localIsProxy)
+	pm.RemotePeers = remotePeers
+	pm.RemotePeersIsEmpty = len(remotePeers) == 0
+
+	pm.OfflinePeers = AppendRemotePeerConfig(nil, nm.OfflinePeers, dnsName, includeIPv6, localIsProxy)
+
+	firewallRules := networkmap.ToProtocolFirewallRules(nm.FirewallRules, includeIPv6, useSourcePrefixes)
+	pm.FirewallRules = firewallRules
+	pm.FirewallRulesIsEmpty = len(firewallRules) == 0
+
+	routesFirewallRules := networkmap.ToProtocolRoutesFirewallRules(nm.RoutesFirewallRules)
+	pm.RoutesFirewallRules = routesFirewallRules
+	pm.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
+
+	if nm.AuthorizedUsers != nil {
+		hashedUsers, machineUsers := networkmap.BuildAuthorizedUsersProto(ctx, nm.AuthorizedUsers)
+		userIDClaim := auth.DefaultUserIDClaim
+		if httpConfig != nil && httpConfig.AuthUserIDClaim != "" {
+			userIDClaim = httpConfig.AuthUserIDClaim
+		}
+		pm.SshAuth = &proto.SSHAuth{AuthorizedUsers: hashedUsers, MachineUsers: machineUsers, UserIDClaim: userIDClaim}
+	}
+
+	return pm
+}
+
+func deriveIssuerFromTokenEndpoint(tokenEndpoint string) string {
+	if tokenEndpoint == "" {
+		return ""
+	}
+
+	u, err := url.Parse(tokenEndpoint)
+	if err != nil {
+		return ""
+	}
+
+	return fmt.Sprintf("%s://%s/", u.Scheme, u.Host)
+}
diff --git a/management/server/types/legacynmap/proxy_policies.go b/management/server/types/legacynmap/proxy_policies.go
new file mode 100644
index 000000000..e8f8c3969
--- /dev/null
+++ b/management/server/types/legacynmap/proxy_policies.go
@@ -0,0 +1,150 @@
+package legacynmap
+
+import (
+	"fmt"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	sharedtypes "github.com/netbirdio/netbird/shared/management/types"
+)
+
+// SynthesizeProxyPolicies is main's Account.InjectProxyPolicies, frozen. On
+// main the network-map controller called it on the account before computing,
+// so a comparison that starts from the account has to apply it too. It returns
+// the policies instead of appending them, so the caller can measure the legacy
+// path without mutating the account the other paths share.
+func SynthesizeProxyPolicies(a *Account) []*Policy {
+	if len(a.Services) == 0 {
+		return nil
+	}
+
+	proxyPeersByCluster := a.GetProxyPeers()
+	if len(proxyPeersByCluster) == 0 {
+		return nil
+	}
+
+	var out []*Policy
+	for _, svc := range a.Services {
+		if svc == nil || !svc.Enabled {
+			continue
+		}
+
+		proxyPeers := proxyPeersByCluster[svc.ProxyCluster]
+		for _, target := range svc.Targets {
+			if target == nil || !target.Enabled {
+				continue
+			}
+			port, ok := legacyTargetPort(target)
+			if !ok {
+				continue
+			}
+			path := ""
+			if target.Path != nil {
+				path = *target.Path
+			}
+			for _, proxyPeer := range proxyPeers {
+				out = append(out, legacyProxyPolicy(svc, target, proxyPeer, port, path))
+			}
+		}
+
+		out = append(out, legacyPrivateServicePolicies(a, svc, proxyPeers)...)
+	}
+	return out
+}
+
+func legacyPrivateServicePolicies(a *Account, svc *service.Service, proxyPeers []*nbpeer.Peer) []*Policy {
+	if !svc.Private || len(svc.AccessGroups) == 0 || len(proxyPeers) == 0 {
+		return nil
+	}
+
+	sources := make([]string, 0, len(svc.AccessGroups))
+	for _, groupID := range svc.AccessGroups {
+		if _, ok := a.Groups[groupID]; ok {
+			sources = append(sources, groupID)
+		}
+	}
+	if len(sources) == 0 {
+		return nil
+	}
+
+	out := make([]*Policy, 0, len(proxyPeers))
+	for _, proxyPeer := range proxyPeers {
+		policyID := fmt.Sprintf("private-access-%s-%s", svc.ID, proxyPeer.ID)
+		out = append(out, &Policy{
+			ID:      policyID,
+			Name:    fmt.Sprintf("Private Access to %s", svc.Name),
+			Enabled: true,
+			Rules: []*PolicyRule{
+				{
+					ID:       policyID,
+					PolicyID: policyID,
+					Name:     fmt.Sprintf("Allow access groups to reach %s", svc.Name),
+					Enabled:  true,
+					Sources:  append([]string(nil), sources...),
+					DestinationResource: Resource{
+						ID:   proxyPeer.ID,
+						Type: ResourceTypePeer,
+					},
+					Bidirectional: false,
+					Protocol:      PolicyRuleProtocolTCP,
+					Action:        PolicyTrafficActionAccept,
+					PortRanges: []RulePortRange{
+						{Start: 80, End: 80},
+						{Start: 443, End: 443},
+					},
+				},
+			},
+		})
+	}
+	return out
+}
+
+func legacyProxyPolicy(svc *service.Service, target *service.Target, proxyPeer *nbpeer.Peer, port uint16, path string) *Policy {
+	policyID := fmt.Sprintf("proxy-access-%s-%s-%s", svc.ID, proxyPeer.ID, path)
+
+	protocol := PolicyRuleProtocolTCP
+	if svc.Mode == service.ModeUDP {
+		protocol = sharedtypes.PolicyRuleProtocolUDP
+	}
+
+	return &Policy{
+		ID:      policyID,
+		Name:    fmt.Sprintf("Proxy Access to %s", svc.Name),
+		Enabled: true,
+		Rules: []*PolicyRule{
+			{
+				ID:       policyID,
+				PolicyID: policyID,
+				Name:     fmt.Sprintf("Allow access to %s", svc.Name),
+				Enabled:  true,
+				SourceResource: Resource{
+					ID:   proxyPeer.ID,
+					Type: ResourceTypePeer,
+				},
+				DestinationResource: Resource{
+					ID:   target.TargetId,
+					Type: sharedtypes.ResourceType(target.TargetType),
+				},
+				Bidirectional: false,
+				Protocol:      protocol,
+				Action:        PolicyTrafficActionAccept,
+				PortRanges:    []RulePortRange{{Start: port, End: port}},
+			},
+		},
+	}
+}
+
+func legacyTargetPort(target *service.Target) (uint16, bool) {
+	if target.Port != 0 {
+		return target.Port, true
+	}
+
+	switch target.Protocol {
+	case "https", "tls":
+		return 443, true
+	case "http":
+		return 80, true
+	default:
+		return 0, false
+	}
+}
diff --git a/management/server/types/network.go b/management/server/types/network.go
index fe67bfd97..fdb8cb521 100644
--- a/management/server/types/network.go
+++ b/management/server/types/network.go
@@ -1,24 +1,18 @@
 package types
 
 import (
+	"crypto/rand"
 	"encoding/binary"
 	"fmt"
-	"math/rand"
 	"net"
 	"net/netip"
 	"slices"
 	"sync"
-	"time"
 
 	"github.com/c-robinson/iplib"
 	"github.com/rs/xid"
-	"golang.org/x/exp/maps"
 
-	nbdns "github.com/netbirdio/netbird/dns"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/util"
-	"github.com/netbirdio/netbird/route"
-	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -28,95 +22,11 @@ const (
 	// NetSize is a global network size 100.64.0.0/10
 	NetSize = 10
 
-	// AllowedIPsFormat generates Wireguard AllowedIPs format (e.g. 100.64.30.1/32)
-	AllowedIPsFormat = "%s/32"
-	// AllowedIPsV6Format generates AllowedIPs format for v6 (e.g. fd12:3456:7890::1/128)
-	AllowedIPsV6Format = "%s/128"
-
 	// IPv6SubnetSize is the prefix length of per-account IPv6 subnets.
 	// Each account gets a /64 from its unique /48 ULA prefix.
 	IPv6SubnetSize = 64
 )
 
-type NetworkMap struct {
-	Peers               []*nbpeer.Peer
-	Network             *Network
-	Routes              []*route.Route
-	DNSConfig           nbdns.Config
-	OfflinePeers        []*nbpeer.Peer
-	FirewallRules       []*FirewallRule
-	RoutesFirewallRules []*RouteFirewallRule
-	ForwardingRules     []*ForwardingRule
-	AuthorizedUsers     map[string]map[string]struct{}
-	EnableSSH           bool
-}
-
-func (nm *NetworkMap) Merge(other *NetworkMap) {
-	nm.Peers = mergeUniquePeersByID(nm.Peers, other.Peers)
-	nm.Routes = util.MergeUnique(nm.Routes, other.Routes)
-	nm.OfflinePeers = mergeUniquePeersByID(nm.OfflinePeers, other.OfflinePeers)
-	nm.FirewallRules = util.MergeUnique(nm.FirewallRules, other.FirewallRules)
-	nm.RoutesFirewallRules = util.MergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
-	nm.ForwardingRules = util.MergeUnique(nm.ForwardingRules, other.ForwardingRules)
-}
-
-func mergeUniquePeersByID(peers1, peers2 []*nbpeer.Peer) []*nbpeer.Peer {
-	result := make(map[string]*nbpeer.Peer)
-	for _, peer := range peers1 {
-		result[peer.ID] = peer
-	}
-	for _, peer := range peers2 {
-		if _, ok := result[peer.ID]; !ok {
-			result[peer.ID] = peer
-		}
-	}
-
-	return maps.Values(result)
-}
-
-type ForwardingRule struct {
-	RuleProtocol      string
-	DestinationPorts  RulePortRange
-	TranslatedAddress net.IP
-	TranslatedPorts   RulePortRange
-}
-
-func (f *ForwardingRule) ToProto() *proto.ForwardingRule {
-	var protocol proto.RuleProtocol
-	switch f.RuleProtocol {
-	case "icmp":
-		protocol = proto.RuleProtocol_ICMP
-	case "tcp":
-		protocol = proto.RuleProtocol_TCP
-	case "udp":
-		protocol = proto.RuleProtocol_UDP
-	case "all":
-		protocol = proto.RuleProtocol_ALL
-	default:
-		protocol = proto.RuleProtocol_UNKNOWN
-	}
-	return &proto.ForwardingRule{
-		Protocol:          protocol,
-		DestinationPort:   f.DestinationPorts.ToProto(),
-		TranslatedAddress: ipToBytes(f.TranslatedAddress),
-		TranslatedPort:    f.TranslatedPorts.ToProto(),
-	}
-}
-
-func (f *ForwardingRule) Equal(other *ForwardingRule) bool {
-	return f.RuleProtocol == other.RuleProtocol &&
-		f.DestinationPorts.Equal(&other.DestinationPorts) &&
-		f.TranslatedAddress.Equal(other.TranslatedAddress) &&
-		f.TranslatedPorts.Equal(&other.TranslatedPorts)
-}
-
-func ipToBytes(ip net.IP) []byte {
-	if ip4 := ip.To4(); ip4 != nil {
-		return ip4
-	}
-	return ip.To16()
-}
-
 type Network struct {
 	Identifier string    `json:"id"`
 	Net        net.IPNet `gorm:"serializer:json"`
@@ -137,14 +47,12 @@ func NewNetwork() *Network {
 	n := iplib.NewNet4(net.ParseIP("100.64.0.0"), NetSize)
 	sub, _ := n.Subnet(SubnetSize)
 
-	s := rand.NewSource(time.Now().UnixNano())
-	r := rand.New(s)
-	intn := r.Intn(len(sub))
+	intn := util.RandIntn(len(sub))
 
 	return &Network{
 		Identifier: xid.New().String(),
 		Net:        sub[intn].IPNet,
-		NetV6:      AllocateIPv6Subnet(r),
+		NetV6:      AllocateIPv6Subnet(),
 		Dns:        "",
 		Serial:     0,
 	}
@@ -154,18 +62,13 @@ func NewNetwork() *Network {
 // The format follows RFC 4193 section 3.1: fd + 40-bit Global ID + 16-bit Subnet ID.
 // The Global ID and Subnet ID are randomized (simplified from the SHA-1 algorithm
 // in section 3.2.2), giving 2^56 possible /64 subnets across all accounts.
-func AllocateIPv6Subnet(r *rand.Rand) net.IPNet {
+func AllocateIPv6Subnet() net.IPNet {
 	ip := make(net.IP, 16)
 	ip[0] = 0xfd
-	// Bytes 1-5: 40-bit random Global ID
-	ip[1] = byte(r.Intn(256))
-	ip[2] = byte(r.Intn(256))
-	ip[3] = byte(r.Intn(256))
-	ip[4] = byte(r.Intn(256))
-	ip[5] = byte(r.Intn(256))
-	// Bytes 6-7: 16-bit random Subnet ID
-	ip[6] = byte(r.Intn(256))
-	ip[7] = byte(r.Intn(256))
+	// Bytes 1-5: 40-bit random Global ID, bytes 6-7: 16-bit random Subnet ID
+	if _, err := rand.Read(ip[1:8]); err != nil {
+		panic(err)
+	}
 
 	return net.IPNet{
 		IP:   ip,
@@ -199,36 +102,44 @@ func (n *Network) Copy() *Network {
 	}
 }
 
+// validateIPv4Prefix ensures the prefix is an IPv4 network with assignable host addresses.
+func validateIPv4Prefix(prefix netip.Prefix) error {
+	if !prefix.IsValid() || !prefix.Addr().Is4() || prefix.Bits() < 1 || prefix.Bits() >= 31 {
+		return fmt.Errorf("invalid IPv4 subnet: %s", prefix.String())
+	}
+	return nil
+}
+
 // AllocatePeerIP picks an available IP from a netip.Prefix.
 // This method considers already taken IPs and reuses IPs if there are gaps in takenIps.
 // E.g. if prefix=100.30.0.0/16 and takenIps=[100.30.0.1, 100.30.0.4] then the result would be 100.30.0.2 or 100.30.0.3.
 func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, error) {
-	b := prefix.Masked().Addr().As4()
-	baseIP := binary.BigEndian.Uint32(b[:])
-	hostBits := 32 - prefix.Bits()
-	totalIPs := uint32(1 << hostBits)
+	if err := validateIPv4Prefix(prefix); err != nil {
+		return netip.Addr{}, err
+	}
 
-	taken := make(map[uint32]struct{}, len(takenIps)+1)
-	taken[baseIP] = struct{}{}            // reserve network IP
-	taken[baseIP+totalIPs-1] = struct{}{} // reserve broadcast IP
+	baseIP, firstOffset, lastOffset := ipv4PeerRange(prefix)
+
+	taken := make(map[uint32]struct{}, len(takenIps))
 
 	for _, ip := range takenIps {
+		if !ip.Is4() {
+			continue
+		}
 		ab := ip.As4()
 		taken[binary.BigEndian.Uint32(ab[:])] = struct{}{}
 	}
 
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	maxAttempts := (int(totalIPs) - len(taken)) / 100
+	maxAttempts := (int(lastOffset-firstOffset+1) - len(taken)) / 100
 
 	for i := 0; i < maxAttempts; i++ {
-		offset := uint32(rng.Intn(int(totalIPs-2))) + 1
-		candidate := baseIP + offset
+		candidate := baseIP + randomOffset(firstOffset, lastOffset)
 		if _, exists := taken[candidate]; !exists {
 			return uint32ToIP(candidate), nil
 		}
 	}
 
-	for offset := uint32(1); offset < totalIPs-1; offset++ {
+	for offset := firstOffset; offset <= lastOffset; offset++ {
 		candidate := baseIP + offset
 		if _, exists := taken[candidate]; !exists {
 			return uint32ToIP(candidate), nil
@@ -240,16 +151,42 @@ func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, err
 
 // AllocateRandomPeerIP picks a random available IP from a netip.Prefix.
 func AllocateRandomPeerIP(prefix netip.Prefix) (netip.Addr, error) {
+	if err := validateIPv4Prefix(prefix); err != nil {
+		return netip.Addr{}, err
+	}
+
+	baseIP, firstOffset, lastOffset := ipv4PeerRange(prefix)
+	return uint32ToIP(baseIP + randomOffset(firstOffset, lastOffset)), nil
+}
+
+// IsReservedPeerIP reports whether ip is an address of the IPv4 prefix that is never assigned to a peer:
+// the network address, the broadcast address or the address before it, which clients use for their DNS resolver.
+// It returns false if prefix is not a valid IPv4 peer network or ip is not within it.
+func IsReservedPeerIP(prefix netip.Prefix, ip netip.Addr) bool {
+	ip = ip.Unmap()
+	if validateIPv4Prefix(prefix) != nil || !ip.Is4() || !prefix.Contains(ip) {
+		return false
+	}
+
+	baseIP, firstOffset, lastOffset := ipv4PeerRange(prefix)
+	b := ip.As4()
+	offset := binary.BigEndian.Uint32(b[:]) - baseIP
+	return offset < firstOffset || offset > lastOffset
+}
+
+// ipv4PeerRange returns the network address of the IPv4 prefix as uint32 and the first and last offset
+// from it that can be assigned to a peer. Reserved are the network address, the broadcast address and the
+// address before it, which clients in userspace and netstack mode use for their DNS resolver.
+func ipv4PeerRange(prefix netip.Prefix) (baseIP, firstOffset, lastOffset uint32) {
 	b := prefix.Masked().Addr().As4()
-	baseIP := binary.BigEndian.Uint32(b[:])
-	hostBits := 32 - prefix.Bits()
-	totalIPs := uint32(1 << hostBits)
+	broadcastOffset := uint32(1)<<(32-prefix.Bits()) - 1
+	dnsResolverOffset := broadcastOffset - 1
+	return binary.BigEndian.Uint32(b[:]), 1, dnsResolverOffset - 1
+}
 
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	offset := uint32(rng.Intn(int(totalIPs-2))) + 1
-
-	candidate := baseIP + offset
-	return uint32ToIP(candidate), nil
+// randomOffset returns a random offset in [firstOffset, lastOffset].
+func randomOffset(firstOffset, lastOffset uint32) uint32 {
+	return firstOffset + uint32(util.RandIntn(int(lastOffset-firstOffset+1)))
 }
 
 // AllocateRandomPeerIPv6 picks a random host address within the given IPv6 prefix.
@@ -262,23 +199,26 @@ func AllocateRandomPeerIPv6(prefix netip.Prefix) (netip.Addr, error) {
 
 	ip := prefix.Addr().As16()
 
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-
 	// Determine which byte the host bits start in
 	firstHostByte := ones / 8
 	// If the prefix doesn't end on a byte boundary, handle the partial byte
 	partialBits := ones % 8
 
+	var rnd [16]byte
+	if _, err := rand.Read(rnd[firstHostByte:]); err != nil {
+		return netip.Addr{}, err
+	}
+
 	if partialBits > 0 {
 		// Keep the network bits in the partial byte, randomize the rest
 		hostMask := byte(0xff >> partialBits)
-		ip[firstHostByte] = (ip[firstHostByte] & ^hostMask) | (byte(rng.Intn(256)) & hostMask)
+		ip[firstHostByte] = (ip[firstHostByte] & ^hostMask) | (rnd[firstHostByte] & hostMask)
 		firstHostByte++
 	}
 
 	// Randomize remaining full host bytes
 	for i := firstHostByte; i < 16; i++ {
-		ip[i] = byte(rng.Intn(256))
+		ip[i] = rnd[i]
 	}
 
 	// Avoid all-zeros and all-ones host parts by checking only host bits.
diff --git a/management/server/types/network_test.go b/management/server/types/network_test.go
index d8a06dbbc..aee59f7ed 100644
--- a/management/server/types/network_test.go
+++ b/management/server/types/network_test.go
@@ -42,12 +42,12 @@ func TestAllocatePeerIP(t *testing.T) {
 }
 
 func TestAllocatePeerIPSmallSubnet(t *testing.T) {
-	// Test /27 network (10.0.0.0/27) - should only have 30 usable IPs (10.0.0.1 to 10.0.0.30)
+	// Test /27 network (10.0.0.0/27) - should only have 29 usable IPs (10.0.0.1 to 10.0.0.29)
 	prefix := netip.MustParsePrefix("10.0.0.0/27")
 	var ips []netip.Addr
 
 	// Allocate all available IPs in the /27 network
-	for i := 0; i < 30; i++ {
+	for i := 0; i < 29; i++ {
 		ip, err := AllocatePeerIP(prefix, ips)
 		if err != nil {
 			t.Fatal(err)
@@ -61,7 +61,7 @@ func TestAllocatePeerIPSmallSubnet(t *testing.T) {
 		ips = append(ips, ip)
 	}
 
-	assert.Len(t, ips, 30)
+	assert.Len(t, ips, 29)
 
 	// Verify all IPs are unique
 	uniq := make(map[string]struct{})
@@ -86,13 +86,13 @@ func TestAllocatePeerIPVariousCIDRs(t *testing.T) {
 		cidr           string
 		expectedUsable int
 	}{
-		{"/30 network", "192.168.1.0/30", 2},   // 4 total - 2 reserved = 2 usable
-		{"/29 network", "192.168.1.0/29", 6},   // 8 total - 2 reserved = 6 usable
-		{"/28 network", "192.168.1.0/28", 14},  // 16 total - 2 reserved = 14 usable
-		{"/27 network", "192.168.1.0/27", 30},  // 32 total - 2 reserved = 30 usable
-		{"/26 network", "192.168.1.0/26", 62},  // 64 total - 2 reserved = 62 usable
-		{"/25 network", "192.168.1.0/25", 126}, // 128 total - 2 reserved = 126 usable
-		{"/16 network", "10.0.0.0/16", 65534},  // 65536 total - 2 reserved = 65534 usable
+		{"/30 network", "192.168.1.0/30", 1},   // 4 total - 3 reserved = 1 usable
+		{"/29 network", "192.168.1.0/29", 5},   // 8 total - 3 reserved = 5 usable
+		{"/28 network", "192.168.1.0/28", 13},  // 16 total - 3 reserved = 13 usable
+		{"/27 network", "192.168.1.0/27", 29},  // 32 total - 3 reserved = 29 usable
+		{"/26 network", "192.168.1.0/26", 61},  // 64 total - 3 reserved = 61 usable
+		{"/25 network", "192.168.1.0/25", 125}, // 128 total - 3 reserved = 125 usable
+		{"/16 network", "10.0.0.0/16", 65533},  // 65536 total - 3 reserved = 65533 usable
 	}
 
 	for _, tc := range testCases {
@@ -117,14 +117,16 @@ func TestAllocatePeerIPVariousCIDRs(t *testing.T) {
 				// Verify IP is within the correct range
 				assert.True(t, prefix.Contains(ip), "allocated IP %s is not within network %s", ip.String(), prefix.String())
 
-				// Verify IP is not network or broadcast address
+				// Verify IP is not network, DNS resolver or broadcast address
 				networkAddr := prefix.Masked().Addr()
 				hostBits := 32 - prefix.Bits()
 				b := networkAddr.As4()
 				baseIP := binary.BigEndian.Uint32(b[:])
+				dnsIP := uint32ToIP(baseIP + (1 << hostBits) - 2)
 				broadcastIP := uint32ToIP(baseIP + (1 << hostBits) - 1)
 
 				assert.NotEqual(t, networkAddr, ip, "allocated network address %s", ip.String())
+				assert.NotEqual(t, dnsIP, ip, "allocated DNS resolver address %s", ip.String())
 				assert.NotEqual(t, broadcastIP, ip, "allocated broadcast address %s", ip.String())
 
 				ips = append(ips, ip)
@@ -143,6 +145,96 @@ func TestAllocatePeerIPVariousCIDRs(t *testing.T) {
 	}
 }
 
+func TestAllocatePeerIPSkipsDNSResolverIP(t *testing.T) {
+	prefix := netip.MustParsePrefix("192.168.1.0/29")
+	ips := []netip.Addr{
+		netip.MustParseAddr("192.168.1.1"),
+		netip.MustParseAddr("192.168.1.2"),
+		netip.MustParseAddr("192.168.1.3"),
+		netip.MustParseAddr("192.168.1.4"),
+	}
+
+	ip, err := AllocatePeerIP(prefix, ips)
+	require.NoError(t, err)
+	assert.Equal(t, netip.MustParseAddr("192.168.1.5"), ip)
+
+	_, err = AllocatePeerIP(prefix, append(ips, ip))
+	assert.Error(t, err, "192.168.1.6 is the DNS resolver address and must not be allocated")
+}
+
+func TestAllocateRandomPeerIPSkipsReservedIPs(t *testing.T) {
+	for _, cidr := range []string{"192.168.1.0/30", "192.168.1.0/29"} {
+		t.Run(cidr, func(t *testing.T) {
+			prefix := netip.MustParsePrefix(cidr)
+			for i := 0; i < 1000; i++ {
+				ip, err := AllocateRandomPeerIP(prefix)
+				require.NoError(t, err)
+				require.True(t, prefix.Contains(ip), "allocated IP %s is not within network %s", ip, prefix)
+				require.False(t, IsReservedPeerIP(prefix, ip), "allocated reserved IP %s", ip)
+			}
+		})
+	}
+
+	ip, err := AllocateRandomPeerIP(netip.MustParsePrefix("192.168.1.0/30"))
+	require.NoError(t, err)
+	assert.Equal(t, netip.MustParseAddr("192.168.1.1"), ip)
+}
+
+func TestIsReservedPeerIP(t *testing.T) {
+	prefix := netip.MustParsePrefix("100.64.0.0/24")
+	testCases := []struct {
+		ip       string
+		reserved bool
+	}{
+		{"100.64.0.0", true},
+		{"100.64.0.1", false},
+		{"100.64.0.253", false},
+		{"100.64.0.254", true},
+		{"100.64.0.255", true},
+		{"::ffff:100.64.0.254", true},
+		{"100.64.1.254", false},
+		{"fd12:3456:7890:abcd::1", false},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.ip, func(t *testing.T) {
+			assert.Equal(t, tc.reserved, IsReservedPeerIP(prefix, netip.MustParseAddr(tc.ip)))
+		})
+	}
+
+	smallest := netip.MustParsePrefix("192.168.1.0/30")
+	assert.False(t, IsReservedPeerIP(smallest, netip.MustParseAddr("192.168.1.1")))
+	assert.True(t, IsReservedPeerIP(smallest, netip.MustParseAddr("192.168.1.2")))
+}
+
+func TestAllocateIPv4InvalidPrefixes(t *testing.T) {
+	prefixes := []netip.Prefix{
+		{},
+		netip.MustParsePrefix("0.0.0.0/0"),
+		netip.MustParsePrefix("192.168.1.0/31"),
+		netip.MustParsePrefix("192.168.1.1/32"),
+		netip.MustParsePrefix("fd12:3456:7890:abcd::/64"),
+	}
+
+	for _, prefix := range prefixes {
+		t.Run(prefix.String(), func(t *testing.T) {
+			_, err := AllocatePeerIP(prefix, nil)
+			assert.Error(t, err)
+
+			_, err = AllocateRandomPeerIP(prefix)
+			assert.Error(t, err)
+		})
+	}
+}
+
+func TestAllocatePeerIPIgnoresNonIPv4TakenIPs(t *testing.T) {
+	prefix := netip.MustParsePrefix("192.168.1.0/29")
+
+	ip, err := AllocatePeerIP(prefix, []netip.Addr{netip.MustParseAddr("fd12:3456:7890:abcd::1")})
+	require.NoError(t, err)
+	assert.True(t, prefix.Contains(ip))
+}
+
 func TestGenerateIPs(t *testing.T) {
 	ipNet := net.IPNet{IP: net.ParseIP("100.64.0.0"), Mask: net.IPMask{255, 255, 255, 0}}
 	ips, ipsLen := generateIPs(&ipNet, map[string]struct{}{"100.64.0.0": {}})
diff --git a/management/server/types/networkmap_benchmark_test.go b/management/server/types/networkmap_benchmark_test.go
index 38272e7b0..118ef9baf 100644
--- a/management/server/types/networkmap_benchmark_test.go
+++ b/management/server/types/networkmap_benchmark_test.go
@@ -86,6 +86,43 @@ func BenchmarkNetworkMapGeneration_AllPeers(b *testing.B) {
 			b.ReportAllocs()
 			b.ResetTimer()
 			for range b.N {
+				account.PrecomputePostureValidation(ctx)
+				for _, peerID := range peerIDs {
+					_ = account.GetPeerNetworkMapFromComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
+				}
+			}
+		})
+	}
+}
+
+// BenchmarkNetworkMapGeneration_AllPeersPostureChecks benchmarks the UpdateAccountPeers
+// hot path with a posture check attached to the account-wide policy, so posture
+// validation runs for every source peer of every target peer's map.
+func BenchmarkNetworkMapGeneration_AllPeersPostureChecks(b *testing.B) {
+	skipCIBenchmark(b)
+	scales := []benchmarkScale{
+		{"500peers_20groups", 500, 20},
+		{"1000peers_50groups", 1000, 50},
+	}
+
+	for _, scale := range scales {
+		account, validatedPeers := scalableTestAccount(scale.peers, scale.groups)
+		account.Policies[0].SourcePostureChecks = []string{"posture-check-ver"}
+		ctx := context.Background()
+
+		peerIDs := make([]string, 0, len(account.Peers))
+		for peerID := range account.Peers {
+			peerIDs = append(peerIDs, peerID)
+		}
+
+		b.Run("components/"+scale.name, func(b *testing.B) {
+			resourcePolicies := account.GetResourcePoliciesMap()
+			routers := account.GetResourceRoutersMap()
+			groupIDToUserIDs := account.GetActiveGroupUsers()
+			b.ReportAllocs()
+			b.ResetTimer()
+			for range b.N {
+				account.PrecomputePostureValidation(ctx)
 				for _, peerID := range peerIDs {
 					_ = account.GetPeerNetworkMapFromComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
 				}
diff --git a/management/server/types/networkmap_components_correctness_test.go b/management/server/types/networkmap_components_correctness_test.go
index 1e3035300..35b5f7149 100644
--- a/management/server/types/networkmap_components_correctness_test.go
+++ b/management/server/types/networkmap_components_correctness_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/rs/xid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -88,13 +89,13 @@ func buildScalableTestAccount(numPeers, numGroups int, withDefaultPolicy bool) (
 		for i := start; i < end; i++ {
 			groupPeers = append(groupPeers, fmt.Sprintf("peer-%d", i))
 		}
-		groups[groupID] = &types.Group{ID: groupID, Name: fmt.Sprintf("Group %d", g), Peers: groupPeers}
+		groups[groupID] = &types.Group{ID: groupID, PublicID: xid.New().String(), Name: fmt.Sprintf("Group %d", g), Peers: groupPeers}
 	}
 
 	policies := make([]*types.Policy, 0, numGroups+2)
 	if withDefaultPolicy {
 		policies = append(policies, &types.Policy{
-			ID: "policy-all", Name: "Default-Allow", Enabled: true,
+			ID: "policy-all", PublicID: xid.New().String(), Name: "Default-Allow", Enabled: true,
 			Rules: []*types.PolicyRule{{
 				ID: "rule-all", Name: "Allow All", Enabled: true, Action: types.PolicyTrafficActionAccept,
 				Protocol: types.PolicyRuleProtocolALL, Bidirectional: true,
@@ -107,7 +108,7 @@ func buildScalableTestAccount(numPeers, numGroups int, withDefaultPolicy bool) (
 		groupID := fmt.Sprintf("group-%d", g)
 		dstGroup := fmt.Sprintf("group-%d", (g+1)%numGroups)
 		policies = append(policies, &types.Policy{
-			ID: fmt.Sprintf("policy-%d", g), Name: fmt.Sprintf("Policy %d", g), Enabled: true,
+			ID: fmt.Sprintf("policy-%d", g), PublicID: xid.New().String(), Name: fmt.Sprintf("Policy %d", g), Enabled: true,
 			Rules: []*types.PolicyRule{{
 				ID: fmt.Sprintf("rule-%d", g), Name: fmt.Sprintf("Rule %d", g), Enabled: true,
 				Action: types.PolicyTrafficActionAccept, Protocol: types.PolicyRuleProtocolTCP,
@@ -120,7 +121,7 @@ func buildScalableTestAccount(numPeers, numGroups int, withDefaultPolicy bool) (
 
 	if numGroups >= 2 {
 		policies = append(policies, &types.Policy{
-			ID: "policy-drop", Name: "Drop DB traffic", Enabled: true,
+			ID: "policy-drop", PublicID: xid.New().String(), Name: "Drop DB traffic", Enabled: true,
 			Rules: []*types.PolicyRule{{
 				ID: "rule-drop", Name: "Drop DB", Enabled: true, Action: types.PolicyTrafficActionDrop,
 				Protocol: types.PolicyRuleProtocolTCP, Ports: []string{"5432"}, Bidirectional: true,
@@ -144,6 +145,7 @@ func buildScalableTestAccount(numPeers, numGroups int, withDefaultPolicy bool) (
 		groupID := fmt.Sprintf("group-%d", r%numGroups)
 		routes[routeID] = &route.Route{
 			ID:                  routeID,
+			PublicID:            xid.New().String(),
 			Network:             netip.MustParsePrefix(fmt.Sprintf("10.%d.0.0/16", r)),
 			Peer:                peers[routePeerID].Key,
 			PeerID:              routePeerID,
@@ -178,18 +180,18 @@ func buildScalableTestAccount(numPeers, numGroups int, withDefaultPolicy bool) (
 		}
 		routerPeerID := fmt.Sprintf("peer-%d", routerPeerIdx)
 
-		networksList = append(networksList, &networkTypes.Network{ID: netID, Name: fmt.Sprintf("Network %d", nr), AccountID: "test-account"})
+		networksList = append(networksList, &networkTypes.Network{ID: netID, PublicID: xid.New().String(), Name: fmt.Sprintf("Network %d", nr), AccountID: "test-account"})
 		networkResources = append(networkResources, &resourceTypes.NetworkResource{
-			ID: resID, NetworkID: netID, AccountID: "test-account", Enabled: true,
+			ID: resID, PublicID: xid.New().String(), NetworkID: netID, AccountID: "test-account", Enabled: true,
 			Address: fmt.Sprintf("svc-%d.netbird.cloud", nr),
 		})
 		networkRouters = append(networkRouters, &routerTypes.NetworkRouter{
-			ID: fmt.Sprintf("router-%d", nr), NetworkID: netID, Peer: routerPeerID,
+			ID: fmt.Sprintf("router-%d", nr), PublicID: xid.New().String(), NetworkID: netID, Peer: routerPeerID,
 			Enabled: true, AccountID: "test-account",
 		})
 
 		policies = append(policies, &types.Policy{
-			ID: fmt.Sprintf("policy-res-%d", nr), Name: fmt.Sprintf("Resource Policy %d", nr), Enabled: true,
+			ID: fmt.Sprintf("policy-res-%d", nr), PublicID: xid.New().String(), Name: fmt.Sprintf("Resource Policy %d", nr), Enabled: true,
 			SourcePostureChecks: []string{"posture-check-ver"},
 			Rules: []*types.PolicyRule{{
 				ID: fmt.Sprintf("rule-res-%d", nr), Name: fmt.Sprintf("Allow Resource %d", nr), Enabled: true,
@@ -215,12 +217,12 @@ func buildScalableTestAccount(numPeers, numGroups int, withDefaultPolicy bool) (
 		DNSSettings: types.DNSSettings{DisabledManagementGroups: []string{}},
 		NameServerGroups: map[string]*nbdns.NameServerGroup{
 			"ns-group-main": {
-				ID: "ns-group-main", Name: "Main NS", Enabled: true, Groups: []string{"group-all"},
+				ID: "ns-group-main", PublicID: xid.New().String(), Name: "Main NS", Enabled: true, Groups: []string{"group-all"},
 				NameServers: []nbdns.NameServer{{IP: netip.MustParseAddr("8.8.8.8"), NSType: nbdns.UDPNameServerType, Port: 53}},
 			},
 		},
 		PostureChecks: []*posture.Checks{
-			{ID: "posture-check-ver", Name: "Check version", Checks: posture.ChecksDefinition{
+			{ID: "posture-check-ver", PublicID: xid.New().String(), Name: "Check version", Checks: posture.ChecksDefinition{
 				NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.26.0"},
 			}},
 		},
@@ -386,7 +388,7 @@ func TestComponents_NetworkSerial(t *testing.T) {
 	account.Network.Serial = 42
 	nm := componentsNetworkMap(account, "peer-0", validatedPeers)
 	require.NotNil(t, nm)
-	assert.Equal(t, uint64(42), nm.Network.Serial, "network serial should match")
+	assert.Equal(t, uint64(42), nm.Network.CurrentSerial(), "network serial should match")
 }
 
 // ──────────────────────────────────────────────────────────────────────────────
@@ -810,7 +812,7 @@ func TestComponents_AllPeersGetValidMaps(t *testing.T) {
 		}
 		nm := componentsNetworkMap(account, peerID, validatedPeers)
 		require.NotNil(t, nm, "network map should not be nil for %s", peerID)
-		assert.Equal(t, account.Network.Serial, nm.Network.Serial, "serial mismatch for %s", peerID)
+		assert.Equal(t, account.Network.Serial, nm.Network.CurrentSerial(), "serial mismatch for %s", peerID)
 		assert.NotEmpty(t, nm.Peers, "validated peer %s should see other peers", peerID)
 	}
 }
@@ -831,7 +833,7 @@ func TestComponents_LargeScaleMapGeneration(t *testing.T) {
 				require.NotNil(t, nm, "network map should not be nil for %s", peerID)
 				assert.NotEmpty(t, nm.Peers, "peer %s should see other peers at scale", peerID)
 				assert.NotEmpty(t, nm.Routes, "peer %s should have routes at scale", peerID)
-				assert.Equal(t, account.Network.Serial, nm.Network.Serial, "serial mismatch for %s", peerID)
+				assert.Equal(t, account.Network.Serial, nm.Network.CurrentSerial(), "serial mismatch for %s", peerID)
 			}
 		})
 	}
@@ -873,6 +875,89 @@ func TestComponents_PeerAsSourceResource(t *testing.T) {
 	assert.True(t, has443, "peer-0 as source resource should have port 443 rule")
 }
 
+func hasFirewallRuleTo(nm *types.NetworkMap, peerIP, port string) bool {
+	for _, rule := range nm.FirewallRules {
+		if rule.PeerIP == peerIP && rule.Port == port {
+			return true
+		}
+	}
+	return false
+}
+
+// TestComponents_PeerAsSourceResource_PostureChecks verifies that a directly referenced
+// source peer is gated by the policy's posture checks like a member of a group holding only
+// that peer: peer-1 (0.25.0) fails the 0.26.0 minimum, peer-2 (0.40.0) passes.
+func TestComponents_PeerAsSourceResource_PostureChecks(t *testing.T) {
+	account, validatedPeers := scalableTestAccountWithoutDefaultPolicy(20, 2)
+
+	for _, sourcePeerID := range []string{"peer-1", "peer-2"} {
+		account.Policies = append(account.Policies, &types.Policy{
+			ID: "policy-peer-src-" + sourcePeerID, Name: "Peer Source " + sourcePeerID, Enabled: true, AccountID: "test-account",
+			SourcePostureChecks: []string{"posture-check-ver"},
+			Rules: []*types.PolicyRule{{
+				ID: "rule-peer-src-" + sourcePeerID, Enabled: true,
+				Action:         types.PolicyTrafficActionAccept,
+				Protocol:       types.PolicyRuleProtocolTCP,
+				Bidirectional:  true,
+				Ports:          []string{"9443"},
+				SourceResource: types.Resource{ID: sourcePeerID, Type: types.ResourceTypePeer},
+				Destinations:   []string{"group-0"},
+			}},
+		})
+	}
+
+	nm0 := componentsNetworkMap(account, "peer-0", validatedPeers)
+	require.NotNil(t, nm0)
+	assert.False(t, hasFirewallRuleTo(nm0, "100.64.0.1", "9443"), "destination must not see the direct source peer failing the posture check")
+	assert.True(t, hasFirewallRuleTo(nm0, "100.64.0.2", "9443"), "destination must see the direct source peer passing the posture check")
+
+	nm1 := componentsNetworkMap(account, "peer-1", validatedPeers)
+	require.NotNil(t, nm1)
+	assert.False(t, hasFirewallRuleTo(nm1, "100.64.0.0", "9443"), "a direct source peer failing the posture check gets no policy connectivity")
+
+	nm2 := componentsNetworkMap(account, "peer-2", validatedPeers)
+	require.NotNil(t, nm2)
+	assert.True(t, hasFirewallRuleTo(nm2, "100.64.0.0", "9443"), "a direct source peer passing the posture check gets policy connectivity")
+}
+
+// TestComponents_PeerAsResource_Unvalidated verifies that a directly referenced peer is
+// subject to approval like a group member, whether it is the rule's source or destination.
+func TestComponents_PeerAsResource_Unvalidated(t *testing.T) {
+	account, validatedPeers := scalableTestAccountWithoutDefaultPolicy(20, 2)
+	delete(validatedPeers, "peer-2")
+
+	account.Policies = append(account.Policies,
+		&types.Policy{
+			ID: "policy-unval-src", Name: "Unvalidated Source", Enabled: true, AccountID: "test-account",
+			Rules: []*types.PolicyRule{{
+				ID: "rule-unval-src", Enabled: true,
+				Action: types.PolicyTrafficActionAccept, Protocol: types.PolicyRuleProtocolTCP, Bidirectional: true,
+				Ports:          []string{"9443"},
+				SourceResource: types.Resource{ID: "peer-2", Type: types.ResourceTypePeer},
+				Destinations:   []string{"group-0"},
+			}},
+		},
+		&types.Policy{
+			ID: "policy-unval-dst", Name: "Unvalidated Destination", Enabled: true, AccountID: "test-account",
+			Rules: []*types.PolicyRule{{
+				ID: "rule-unval-dst", Enabled: true,
+				Action: types.PolicyTrafficActionAccept, Protocol: types.PolicyRuleProtocolTCP, Bidirectional: true,
+				Ports:               []string{"9444"},
+				Sources:             []string{"group-0"},
+				DestinationResource: types.Resource{ID: "peer-2", Type: types.ResourceTypePeer},
+			}},
+		},
+	)
+
+	nm0 := componentsNetworkMap(account, "peer-0", validatedPeers)
+	require.NotNil(t, nm0)
+	assert.False(t, hasFirewallRuleTo(nm0, "100.64.0.2", "9443"), "an unvalidated direct source peer must not be admitted")
+	assert.False(t, hasFirewallRuleTo(nm0, "100.64.0.2", "9444"), "an unvalidated direct destination peer must not be admitted")
+	for _, p := range nm0.Peers {
+		assert.NotEqual(t, "peer-2", p.ID, "an unvalidated direct peer must not be shipped as a remote peer")
+	}
+}
+
 // TestComponents_PeerAsDestinationResource verifies that a policy with DestinationResource.Type=Peer
 // targets only that specific peer as the destination.
 func TestComponents_PeerAsDestinationResource(t *testing.T) {
diff --git a/management/server/types/networkmap_components_test.go b/management/server/types/networkmap_components_test.go
index 1a99b4511..9e76de775 100644
--- a/management/server/types/networkmap_components_test.go
+++ b/management/server/types/networkmap_components_test.go
@@ -18,6 +18,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 func networkMapFromComponents(t *testing.T, account *types.Account, peerID string, validatedPeers map[string]struct{}) *types.NetworkMap {
@@ -49,7 +50,7 @@ func allPeersValidated(account *types.Account, excludePeerIDs ...string) map[str
 	return validated
 }
 
-func peerIDs(peers []*nbpeer.Peer) []string {
+func peerIDs(peers []*nmdata.Peer) []string {
 	ids := make([]string, len(peers))
 	for i, p := range peers {
 		ids[i] = p.ID
@@ -174,6 +175,63 @@ func TestNetworkMapComponents_NetworkResourceRoutes_RouterPeer(t *testing.T) {
 	assert.NotEmpty(t, nm.RoutesFirewallRules, "router peer should have route firewall rules for the resource")
 }
 
+// A receiver without a firewall asks Calculate to skip the route firewall
+// rules. Everything the rest of the sync consumes — routes, peers, peer
+// firewall rules — must come out unchanged.
+func TestNetworkMapComponents_SkipRouteFirewallRules(t *testing.T) {
+	ctx := context.Background()
+	account := createComponentTestAccount()
+
+	// The shared fixture leaves peer-router-1 out of every peer ACL, so its
+	// FirewallRules would be empty and the comparison below vacuous. Give the
+	// router a policy of its own.
+	account.Policies = append(account.Policies, &types.Policy{
+		ID: "policy-router", Name: "Router connectivity", Enabled: true,
+		Rules: []*types.PolicyRule{{
+			ID: "rule-router", Name: "Allow all <-> router", Enabled: true,
+			Action: types.PolicyTrafficActionAccept, Protocol: types.PolicyRuleProtocolALL,
+			Bidirectional: true,
+			Sources:       []string{"group-all"}, Destinations: []string{"group-all"},
+		}},
+	})
+
+	validated := allPeersValidated(account)
+
+	components := account.GetPeerNetworkMapComponents(
+		ctx,
+		"peer-router-1",
+		account.GetPeersCustomZone(ctx, "netbird.io"),
+		nil,
+		validated,
+		account.GetResourcePoliciesMap(),
+		account.GetResourceRoutersMap(),
+		account.GetActiveGroupUsers(),
+	)
+
+	full := components.Calculate(ctx)
+	require.NotEmpty(t, full.RoutesFirewallRules, "baseline: router peer must get route firewall rules")
+	require.NotEmpty(t, full.FirewallRules, "baseline: router peer must get peer firewall rules")
+
+	components.SkipRouteFirewallRules = true
+	skipped := components.Calculate(ctx)
+
+	assert.Empty(t, skipped.RoutesFirewallRules, "route firewall rules must not be computed when skipped")
+	assert.ElementsMatch(t, routeNetworks(full.Routes), routeNetworks(skipped.Routes),
+		"skipping route firewall rules must not change the routes")
+	assert.ElementsMatch(t, peerIDs(full.Peers), peerIDs(skipped.Peers),
+		"skipping route firewall rules must not change the peers to connect")
+	assert.Equal(t, full.FirewallRules, skipped.FirewallRules,
+		"peer firewall rules are unrelated and must come out unchanged")
+}
+
+func routeNetworks(routes []*nmdata.Route) []string {
+	networks := make([]string, 0, len(routes))
+	for _, r := range routes {
+		networks = append(networks, r.Network.String())
+	}
+	return networks
+}
+
 func TestNetworkMapComponents_NetworkResourceRoutes_UnrelatedPeer(t *testing.T) {
 	account := createComponentTestAccount()
 	validated := allPeersValidated(account)
@@ -625,7 +683,7 @@ func TestNetworkMapComponents_DomainNetworkResource(t *testing.T) {
 
 	var hasDomainRoute bool
 	for _, r := range nm.Routes {
-		if r.NetworkType == route.DomainNetwork && len(r.Domains) > 0 && r.Domains[0].SafeString() == "api.example.com" {
+		if r.NetworkType == int(route.DomainNetwork) && len(r.Domains) > 0 && r.Domains[0].SafeString() == "api.example.com" {
 			hasDomainRoute = true
 		}
 	}
diff --git a/management/server/types/networkmap_wire_benchmark_test.go b/management/server/types/networkmap_wire_benchmark_test.go
new file mode 100644
index 000000000..ccec054cd
--- /dev/null
+++ b/management/server/types/networkmap_wire_benchmark_test.go
@@ -0,0 +1,163 @@
+package types_test
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"testing"
+
+	goproto "google.golang.org/protobuf/proto"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// wireBenchScales — trimmed scale set for wire-size measurements. Encoding
+// and marshalling are linear, so the largest extremes don't add signal.
+var wireBenchScales = []benchmarkScale{
+	{"100peers_5groups", 100, 5},
+	{"500peers_20groups", 500, 20},
+	{"1000peers_50groups", 1000, 50},
+	{"5000peers_100groups", 5000, 100},
+}
+
+// assignValidWgKeys overwrites every peer's Key with a valid base64-encoded
+// 32-byte string. The default scalableTestAccount uses unparsable strings
+// like "key-peer-0", which makes the components encoder emit a nil WgPubKey
+// and the legacy encoder ship 10-char placeholders — both shrink the wire
+// size in unrealistic ways. Production peers always have valid 44-char base64
+// keys, so any benchmark/breakdown that wants honest numbers must call this.
+func assignValidWgKeys(account *types.Account) {
+	for _, p := range account.Peers {
+		var raw [32]byte
+		_, _ = rand.Read(raw[:])
+		p.Key = base64.StdEncoding.EncodeToString(raw[:])
+	}
+}
+
+// BenchmarkNetworkMapWireEncode reports per-call ns and the marshaled wire
+// size for both encoding paths. Run with:
+//
+//	go test -run=^$ -bench=BenchmarkNetworkMapWireEncode -benchmem ./management/server/types/
+func BenchmarkNetworkMapWireEncode(b *testing.B) {
+	skipCIBenchmark(b)
+
+	for _, scale := range wireBenchScales {
+		account, validatedPeers := scalableTestAccount(scale.peers, scale.groups)
+		// populateAccountSeqIDs(account)
+		assignValidWgKeys(account)
+
+		ctx := context.Background()
+		resourcePolicies := account.GetResourcePoliciesMap()
+		routers := account.GetResourceRoutersMap()
+		groupIDToUserIDs := account.GetActiveGroupUsers()
+
+		peerID := "peer-0"
+		peer := account.Peers[peerID]
+
+		networkMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
+		components := account.GetPeerNetworkMapComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, groupIDToUserIDs)
+
+		dnsCache := &cache.DNSConfigCache{}
+		settings := &types.Settings{}
+
+		// Pre-encode once so the size metric is identical for every run inside
+		// the same scale; the b.Loop call only re-runs encode + Marshal.
+		legacyResp := mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, networkMap, "netbird.cloud", nil, dnsCache, types.TwinAccountSettings(settings), nil, nil, 0)
+		legacyBytes, err := goproto.Marshal(legacyResp.NetworkMap)
+		if err != nil {
+			b.Fatalf("marshal legacy networkmap: %v", err)
+		}
+
+		envelopeInput := mgmtgrpc.ComponentsEnvelopeInput{
+			Components: components,
+			PeerConfig: legacyResp.NetworkMap.PeerConfig,
+			DNSDomain:  "netbird.cloud",
+		}
+		envelope := mgmtgrpc.EncodeNetworkMapEnvelope(envelopeInput)
+		envelopeBytes, err := goproto.Marshal(envelope)
+		if err != nil {
+			b.Fatalf("marshal envelope: %v", err)
+		}
+
+		b.Run(fmt.Sprintf("legacy/%s", scale.name), func(b *testing.B) {
+			b.ReportAllocs()
+			b.ReportMetric(float64(len(legacyBytes)), "bytes/msg")
+			b.ResetTimer()
+			for range b.N {
+				resp := mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, networkMap, "netbird.cloud", nil, dnsCache, types.TwinAccountSettings(settings), nil, nil, 0)
+				if _, err := goproto.Marshal(resp.NetworkMap); err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+
+		b.Run(fmt.Sprintf("components/%s", scale.name), func(b *testing.B) {
+			b.ReportAllocs()
+			b.ReportMetric(float64(len(envelopeBytes)), "bytes/msg")
+			b.ResetTimer()
+			for range b.N {
+				env := mgmtgrpc.EncodeNetworkMapEnvelope(envelopeInput)
+				if _, err := goproto.Marshal(env); err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
+
+// BenchmarkNetworkMapWireSize is a fast snapshot of the wire size by scale
+// without a tight encode loop. Run with -bench to see one ns/op + bytes per
+// scale (treat the timing as informational; the sample is one Marshal per
+// scale, not the full b.N loop).
+func BenchmarkNetworkMapWireSize(b *testing.B) {
+	skipCIBenchmark(b)
+
+	for _, scale := range wireBenchScales {
+		account, validatedPeers := scalableTestAccount(scale.peers, scale.groups)
+		// populateAccountSeqIDs(account)
+		assignValidWgKeys(account)
+
+		ctx := context.Background()
+		resourcePolicies := account.GetResourcePoliciesMap()
+		routers := account.GetResourceRoutersMap()
+		groupIDToUserIDs := account.GetActiveGroupUsers()
+
+		peerID := "peer-0"
+		peer := account.Peers[peerID]
+
+		networkMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
+		components := account.GetPeerNetworkMapComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, groupIDToUserIDs)
+
+		dnsCache := &cache.DNSConfigCache{}
+		settings := &types.Settings{}
+
+		legacyResp := mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, networkMap, "netbird.cloud", nil, dnsCache, types.TwinAccountSettings(settings), nil, nil, 0)
+		legacyBytes, err := goproto.Marshal(legacyResp.NetworkMap)
+		if err != nil {
+			b.Fatalf("marshal legacy networkmap: %v", err)
+		}
+
+		env := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+			Components: components,
+			PeerConfig: legacyResp.NetworkMap.PeerConfig,
+			DNSDomain:  "netbird.cloud",
+		})
+		envBytes, err := goproto.Marshal(env)
+		if err != nil {
+			b.Fatalf("marshal envelope: %v", err)
+		}
+
+		b.Run(fmt.Sprintf("size/%s", scale.name), func(b *testing.B) {
+			b.ReportMetric(float64(len(legacyBytes)), "legacy_bytes")
+			b.ReportMetric(float64(len(envBytes)), "components_bytes")
+			ratio := float64(len(envBytes)) / float64(len(legacyBytes))
+			b.ReportMetric(ratio, "components/legacy")
+			for range b.N {
+			}
+		})
+	}
+}
diff --git a/management/server/types/networkmap_wire_breakdown_test.go b/management/server/types/networkmap_wire_breakdown_test.go
new file mode 100644
index 000000000..adf66b386
--- /dev/null
+++ b/management/server/types/networkmap_wire_breakdown_test.go
@@ -0,0 +1,149 @@
+package types_test
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+
+	goproto "google.golang.org/protobuf/proto"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// TestNetworkMapWireBreakdown is a one-shot diagnostic: it computes the wire
+// size attributable to each top-level field of both the legacy NetworkMap and
+// the components NetworkMapEnvelope at the 5000-peer scale, so the migration
+// docs can attribute the size reduction to each optimization. Runs only on
+// demand via -run TestNetworkMapWireBreakdown.
+func TestNetworkMapWireBreakdown(t *testing.T) {
+	if testing.Short() {
+		t.Skip("size diagnostic, skipped with -short")
+	}
+	if os.Getenv("NB_RUN_WIRE_BREAKDOWN") != "1" {
+		t.Skip("set NB_RUN_WIRE_BREAKDOWN=1 to run wire breakdown diagnostic")
+	}
+
+	const peerCount, groupCount = 5000, 100
+	account, validatedPeers := scalableTestAccount(peerCount, groupCount)
+	assignValidWgKeys(account)
+
+	ctx := context.Background()
+	resourcePolicies := account.GetResourcePoliciesMap()
+	routers := account.GetResourceRoutersMap()
+	groupIDToUserIDs := account.GetActiveGroupUsers()
+
+	peerID := "peer-0"
+	peer := account.Peers[peerID]
+	networkMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
+	components := account.GetPeerNetworkMapComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, groupIDToUserIDs)
+
+	dnsCache := &cache.DNSConfigCache{}
+	settings := &types.Settings{}
+
+	legacyResp := mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, networkMap, "netbird.cloud", nil, dnsCache, types.TwinAccountSettings(settings), nil, nil, 0)
+	legacyTotal := mustMarshalSize(t, legacyResp.NetworkMap)
+
+	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+		Components: components,
+		PeerConfig: legacyResp.NetworkMap.PeerConfig,
+		DNSDomain:  "netbird.cloud",
+	})
+	componentsTotal := mustMarshalSize(t, envelope)
+
+	t.Logf("\n=== LEGACY NetworkMap (%d peers, %d groups) ===", peerCount, groupCount)
+	t.Logf("  Total: %d bytes\n", legacyTotal)
+
+	legacyBreakdown := []struct {
+		name string
+		nm   *proto.NetworkMap
+	}{
+		{"RemotePeers", &proto.NetworkMap{RemotePeers: legacyResp.NetworkMap.RemotePeers}},
+		{"OfflinePeers", &proto.NetworkMap{OfflinePeers: legacyResp.NetworkMap.OfflinePeers}},
+		{"FirewallRules", &proto.NetworkMap{FirewallRules: legacyResp.NetworkMap.FirewallRules}},
+		{"Routes", &proto.NetworkMap{Routes: legacyResp.NetworkMap.Routes}},
+		{"RoutesFirewallRules", &proto.NetworkMap{RoutesFirewallRules: legacyResp.NetworkMap.RoutesFirewallRules}},
+		{"DNSConfig", &proto.NetworkMap{DNSConfig: legacyResp.NetworkMap.DNSConfig}},
+		{"PeerConfig", &proto.NetworkMap{PeerConfig: legacyResp.NetworkMap.PeerConfig}},
+		{"SshAuth", &proto.NetworkMap{SshAuth: legacyResp.NetworkMap.SshAuth}},
+	}
+	for _, e := range legacyBreakdown {
+		size := mustMarshalSize(t, e.nm)
+		t.Logf("  %-22s %8d bytes  %5.1f%%", e.name, size, pct(size, legacyTotal))
+	}
+
+	full := envelope.GetFull()
+	if full == nil {
+		t.Fatalf("expected full network map envelope payload, got nil")
+	}
+	t.Logf("\n=== COMPONENTS NetworkMapEnvelope (%d peers, %d groups) ===", peerCount, groupCount)
+	t.Logf("  Total: %d bytes  (%.1f%% of legacy)\n", componentsTotal, pct(componentsTotal, legacyTotal))
+
+	componentsBreakdown := []struct {
+		name string
+		nm   *proto.NetworkMapComponentsFull
+	}{
+		{"Peers", &proto.NetworkMapComponentsFull{Peers: full.Peers}},
+		{"Policies", &proto.NetworkMapComponentsFull{Policies: full.Policies}},
+		{"Groups", &proto.NetworkMapComponentsFull{Groups: full.Groups}},
+		{"Routes (raw)", &proto.NetworkMapComponentsFull{Routes: full.Routes}},
+		{"NameServerGroups", &proto.NetworkMapComponentsFull{NameserverGroups: full.NameserverGroups}},
+		{"AllDNSRecords", &proto.NetworkMapComponentsFull{AllDnsRecords: full.AllDnsRecords}},
+		{"AccountZones", &proto.NetworkMapComponentsFull{AccountZones: full.AccountZones}},
+		{"NetworkResources", &proto.NetworkMapComponentsFull{NetworkResources: full.NetworkResources}},
+		{"RoutersMap", &proto.NetworkMapComponentsFull{RoutersMap: full.RoutersMap}},
+		{"ResourcePoliciesMap", &proto.NetworkMapComponentsFull{ResourcePoliciesMap: full.ResourcePoliciesMap}},
+		{"GroupIDToUserIDs", &proto.NetworkMapComponentsFull{GroupIdToUserIds: full.GroupIdToUserIds}},
+		{"AllowedUserIDs", &proto.NetworkMapComponentsFull{AllowedUserIds: full.AllowedUserIds}},
+		{"PostureFailedPeers", &proto.NetworkMapComponentsFull{PostureFailedPeers: full.PostureFailedPeers}},
+		{"DNSSettings", &proto.NetworkMapComponentsFull{DnsSettings: full.DnsSettings}},
+		{"PeerConfig", &proto.NetworkMapComponentsFull{PeerConfig: full.PeerConfig}},
+		{"AgentVersions", &proto.NetworkMapComponentsFull{AgentVersions: full.AgentVersions}},
+	}
+	for _, e := range componentsBreakdown {
+		size := mustMarshalSize(t, e.nm)
+		t.Logf("  %-22s %8d bytes  %5.1f%%", e.name, size, pct(size, componentsTotal))
+	}
+
+	t.Logf("\n=== Per-PeerCompact average ===")
+	if len(full.Peers) > 0 {
+		t.Logf("  PeerCompact avg: %d bytes/peer", mustMarshalSize(t, &proto.NetworkMapComponentsFull{Peers: full.Peers})/len(full.Peers))
+	}
+	if len(legacyResp.NetworkMap.RemotePeers) > 0 {
+		t.Logf("  RemotePeer avg:  %d bytes/peer",
+			mustMarshalSize(t, &proto.NetworkMap{RemotePeers: legacyResp.NetworkMap.RemotePeers})/len(legacyResp.NetworkMap.RemotePeers))
+	}
+
+	t.Logf("\n=== FirewallRule expansion footprint ===")
+	t.Logf("  legacy FirewallRules count: %d", len(legacyResp.NetworkMap.FirewallRules))
+	t.Logf("  components Policies count:  %d", len(full.Policies))
+	t.Logf("  components Groups count:    %d", len(full.Groups))
+
+	totalGroupPeerIdxs := 0
+	for _, g := range full.Groups {
+		totalGroupPeerIdxs += len(g.PeerIndexes)
+	}
+	t.Logf("  components peer-index refs across all groups: %d", totalGroupPeerIdxs)
+}
+
+func mustMarshalSize(t *testing.T, m goproto.Message) int {
+	b, err := goproto.Marshal(m)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	return len(b)
+}
+
+func pct(part, total int) float64 {
+	if total == 0 {
+		return 0
+	}
+	return 100 * float64(part) / float64(total)
+}
+
+// Stops fmt being unused if the breakdown loop above is later commented out.
+var _ = fmt.Sprintf
diff --git a/management/server/types/peer_networkmap_result.go b/management/server/types/peer_networkmap_result.go
new file mode 100644
index 000000000..fadbeb599
--- /dev/null
+++ b/management/server/types/peer_networkmap_result.go
@@ -0,0 +1,25 @@
+package types
+
+// PeerNetworkMapResult is what the network_map controller produces for a
+// single peer. Exactly one of NetworkMap or Components is populated depending
+// on the peer's capability:
+//
+//   - Components-capable peers (PeerCapabilityComponentNetworkMap) get
+//     Components: the raw types.NetworkMapComponents the client decodes and
+//     runs Calculate() on locally. NetworkMap stays nil — the server skips
+//     the expansion entirely.
+//   - Legacy peers (or any peer when the kill switch is set) get NetworkMap:
+//     the fully-expanded view the legacy gRPC path consumes.
+//
+// The gRPC layer (ToSyncResponseForPeer) dispatches by which field is
+// non-nil; callers must not rely on both being set.
+type PeerNetworkMapResult struct {
+	NetworkMap *NetworkMap
+	Components *NetworkMapComponents
+}
+
+// IsComponents reports whether the result carries the components shape.
+// Use this in preference to direct nil checks on the fields.
+func (r PeerNetworkMapResult) IsComponents() bool {
+	return r.Components != nil
+}
diff --git a/management/server/types/peer_networkmap_result_test.go b/management/server/types/peer_networkmap_result_test.go
new file mode 100644
index 000000000..908581a08
--- /dev/null
+++ b/management/server/types/peer_networkmap_result_test.go
@@ -0,0 +1,104 @@
+package types_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// helper: marks the given peer as components-capable.
+func markCapable(p *nbpeer.Peer) {
+	p.Meta.Capabilities = append(p.Meta.Capabilities, nbpeer.PeerCapabilityComponentNetworkMap)
+}
+
+func TestGetPeerNetworkMapResult_CapablePeerGetsComponents(t *testing.T) {
+	account, validatedPeers := scalableTestAccount(10, 2)
+	markCapable(account.Peers["peer-0"])
+
+	resourcePolicies := account.GetResourcePoliciesMap()
+	routers := account.GetResourceRoutersMap()
+	groupIDToUserIDs := account.GetActiveGroupUsers()
+
+	result := account.GetPeerNetworkMapResult(
+		context.Background(),
+		"peer-0",
+		false, // componentsDisabled
+		nbdns.CustomZone{},
+		nil,
+		validatedPeers,
+		resourcePolicies,
+		routers,
+		nil,
+		groupIDToUserIDs,
+	)
+
+	require.True(t, result.IsComponents(), "capable peer must get the components shape")
+	assert.Nil(t, result.NetworkMap)
+	require.NotNil(t, result.Components)
+	assert.Equal(t, "peer-0", result.Components.PeerID)
+}
+
+func TestGetPeerNetworkMapResult_LegacyPeerGetsNetworkMap(t *testing.T) {
+	account, validatedPeers := scalableTestAccount(10, 2)
+	// peer-0 left without the component capability
+
+	resourcePolicies := account.GetResourcePoliciesMap()
+	routers := account.GetResourceRoutersMap()
+	groupIDToUserIDs := account.GetActiveGroupUsers()
+
+	result := account.GetPeerNetworkMapResult(
+		context.Background(),
+		"peer-0",
+		false,
+		nbdns.CustomZone{},
+		nil,
+		validatedPeers,
+		resourcePolicies,
+		routers,
+		nil,
+		groupIDToUserIDs,
+	)
+
+	assert.False(t, result.IsComponents())
+	assert.Nil(t, result.Components)
+	require.NotNil(t, result.NetworkMap, "legacy peer must get a NetworkMap")
+}
+
+func TestGetPeerNetworkMapResult_KillSwitchOverridesCapability(t *testing.T) {
+	// Capable peer + componentsDisabled=true → falls back to legacy.
+	account, validatedPeers := scalableTestAccount(10, 2)
+	markCapable(account.Peers["peer-0"])
+
+	resourcePolicies := account.GetResourcePoliciesMap()
+	routers := account.GetResourceRoutersMap()
+	groupIDToUserIDs := account.GetActiveGroupUsers()
+
+	result := account.GetPeerNetworkMapResult(
+		context.Background(),
+		"peer-0",
+		true, // componentsDisabled = true (kill switch)
+		nbdns.CustomZone{},
+		nil,
+		validatedPeers,
+		resourcePolicies,
+		routers,
+		nil,
+		groupIDToUserIDs,
+	)
+
+	assert.False(t, result.IsComponents(), "kill switch must force legacy NetworkMap path")
+	assert.Nil(t, result.Components)
+	require.NotNil(t, result.NetworkMap)
+}
+
+func TestPeerNetworkMapResult_IsComponents(t *testing.T) {
+	assert.True(t, types.PeerNetworkMapResult{Components: &types.NetworkMapComponents{}}.IsComponents())
+	assert.False(t, types.PeerNetworkMapResult{NetworkMap: &types.NetworkMap{}}.IsComponents())
+	assert.False(t, types.PeerNetworkMapResult{}.IsComponents())
+}
diff --git a/management/server/types/policy.go b/management/server/types/policy.go
index d410aec8d..9786d17b6 100644
--- a/management/server/types/policy.go
+++ b/management/server/types/policy.go
@@ -1,32 +1,5 @@
 package types
 
-import (
-	"errors"
-	"fmt"
-	"strconv"
-	"strings"
-)
-
-const (
-	// PolicyTrafficActionAccept indicates that the traffic is accepted
-	PolicyTrafficActionAccept = PolicyTrafficActionType("accept")
-	// PolicyTrafficActionDrop indicates that the traffic is dropped
-	PolicyTrafficActionDrop = PolicyTrafficActionType("drop")
-)
-
-const (
-	// PolicyRuleProtocolALL type of traffic
-	PolicyRuleProtocolALL = PolicyRuleProtocolType("all")
-	// PolicyRuleProtocolTCP type of traffic
-	PolicyRuleProtocolTCP = PolicyRuleProtocolType("tcp")
-	// PolicyRuleProtocolUDP type of traffic
-	PolicyRuleProtocolUDP = PolicyRuleProtocolType("udp")
-	// PolicyRuleProtocolICMP type of traffic
-	PolicyRuleProtocolICMP = PolicyRuleProtocolType("icmp")
-	// PolicyRuleProtocolNetbirdSSH type of traffic
-	PolicyRuleProtocolNetbirdSSH = PolicyRuleProtocolType("netbird-ssh")
-)
-
 const (
 	// PolicyRuleFlowDirect allows traffic from source to destination
 	PolicyRuleFlowDirect = PolicyRuleDirection("direct")
@@ -56,6 +29,8 @@ type Policy struct {
 	// ID of the policy'
 	ID string `gorm:"primaryKey"`
 
+	PublicID string `json:"-" gorm:"index"`
+
 	// AccountID is a reference to Account that this object belongs
 	AccountID string `json:"-" gorm:"index"`
 
@@ -80,6 +55,7 @@ func (p *Policy) Copy() *Policy {
 	c := &Policy{
 		ID:                  p.ID,
 		AccountID:           p.AccountID,
+		PublicID:            p.PublicID,
 		Name:                p.Name,
 		Description:         p.Description,
 		Enabled:             p.Enabled,
@@ -181,85 +157,3 @@ func (p *Policy) SourceGroups() []string {
 
 	return groupIDs
 }
-
-func ParseRuleString(rule string) (PolicyRuleProtocolType, RulePortRange, error) {
-	rule = strings.TrimSpace(strings.ToLower(rule))
-	if rule == "all" {
-		return PolicyRuleProtocolALL, RulePortRange{}, nil
-	}
-	if rule == "icmp" {
-		return PolicyRuleProtocolICMP, RulePortRange{}, nil
-	}
-
-	split := strings.Split(rule, "/")
-	if len(split) != 2 {
-		return "", RulePortRange{}, errors.New("invalid rule format: expected protocol/port or protocol/port-range")
-	}
-
-	protoStr := strings.TrimSpace(split[0])
-	portStr := strings.TrimSpace(split[1])
-
-	var protocol PolicyRuleProtocolType
-	switch protoStr {
-	case "tcp":
-		protocol = PolicyRuleProtocolTCP
-	case "udp":
-		protocol = PolicyRuleProtocolUDP
-	case "icmp":
-		return "", RulePortRange{}, errors.New("icmp does not accept ports; use 'icmp' without '/…'")
-	case "netbird-ssh":
-		return PolicyRuleProtocolNetbirdSSH, RulePortRange{Start: nativeSSHPortNumber, End: nativeSSHPortNumber}, nil
-	default:
-		return "", RulePortRange{}, fmt.Errorf("invalid protocol: %q", protoStr)
-	}
-
-	portRange, err := parsePortRange(portStr)
-	if err != nil {
-		return "", RulePortRange{}, err
-	}
-
-	return protocol, portRange, nil
-}
-
-func parsePortRange(portStr string) (RulePortRange, error) {
-	if strings.Contains(portStr, "-") {
-		rangeParts := strings.Split(portStr, "-")
-		if len(rangeParts) != 2 {
-			return RulePortRange{}, fmt.Errorf("invalid port range %q", portStr)
-		}
-		start, err := parsePort(strings.TrimSpace(rangeParts[0]))
-		if err != nil {
-			return RulePortRange{}, err
-		}
-		end, err := parsePort(strings.TrimSpace(rangeParts[1]))
-		if err != nil {
-			return RulePortRange{}, err
-		}
-		if start > end {
-			return RulePortRange{}, fmt.Errorf("invalid port range: start %d > end %d", start, end)
-		}
-		return RulePortRange{Start: uint16(start), End: uint16(end)}, nil
-	}
-
-	p, err := parsePort(portStr)
-	if err != nil {
-		return RulePortRange{}, err
-	}
-
-	return RulePortRange{Start: uint16(p), End: uint16(p)}, nil
-}
-
-func parsePort(portStr string) (int, error) {
-
-	if portStr == "" {
-		return 0, errors.New("empty port")
-	}
-	p, err := strconv.Atoi(portStr)
-	if err != nil {
-		return 0, fmt.Errorf("invalid port %q: %w", portStr, err)
-	}
-	if p < 1 || p > 65535 {
-		return 0, fmt.Errorf("port out of range (1–65535): %d", p)
-	}
-	return p, nil
-}
diff --git a/management/server/types/policyrule.go b/management/server/types/policyrule.go
index 52c494a6a..87905f005 100644
--- a/management/server/types/policyrule.go
+++ b/management/server/types/policyrule.go
@@ -2,43 +2,14 @@ package types
 
 import (
 	"slices"
-
-	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
 // PolicyUpdateOperationType operation type
 type PolicyUpdateOperationType int
 
-// PolicyTrafficActionType action type for the firewall
-type PolicyTrafficActionType string
-
-// PolicyRuleProtocolType type of traffic
-type PolicyRuleProtocolType string
-
 // PolicyRuleDirection direction of traffic
 type PolicyRuleDirection string
 
-// RulePortRange represents a range of ports for a firewall rule.
-type RulePortRange struct {
-	Start uint16
-	End   uint16
-}
-
-func (r *RulePortRange) ToProto() *proto.PortInfo {
-	return &proto.PortInfo{
-		PortSelection: &proto.PortInfo_Range_{
-			Range: &proto.PortInfo_Range{
-				Start: uint32(r.Start),
-				End:   uint32(r.End),
-			},
-		},
-	}
-}
-
-func (r *RulePortRange) Equal(other *RulePortRange) bool {
-	return r.Start == other.Start && r.End == other.End
-}
-
 // PolicyRule is the metadata of the policy
 type PolicyRule struct {
 	// ID of the policy rule
diff --git a/management/server/types/proxy_access_token.go b/management/server/types/proxy_access_token.go
index b20b83bc1..9bb27ef02 100644
--- a/management/server/types/proxy_access_token.go
+++ b/management/server/types/proxy_access_token.go
@@ -68,7 +68,7 @@ type ProxyAccessTokenGenerated struct {
 // CreateNewProxyAccessToken generates a new proxy access token.
 // Returns the token with hashed value stored and plain token for one-time display.
 func CreateNewProxyAccessToken(name string, expiresIn time.Duration, accountID *string, createdBy string) (*ProxyAccessTokenGenerated, error) {
-	hashedToken, plainToken, err := generateProxyToken()
+	hashedToken, plainToken, err := GenerateProxyToken()
 	if err != nil {
 		return nil, err
 	}
@@ -94,7 +94,10 @@ func CreateNewProxyAccessToken(name string, expiresIn time.Duration, accountID *
 	}, nil
 }
 
-func generateProxyToken() (HashedProxyToken, PlainProxyToken, error) {
+// GenerateProxyToken generates a new random proxy token, returning its SHA-256
+// hash (for storage) and the one-time plaintext. Exported so external modules
+// can mint tokens in the canonical proxy-token format.
+func GenerateProxyToken() (HashedProxyToken, PlainProxyToken, error) {
 	secret, err := b.Random(ProxyTokenSecretLength)
 	if err != nil {
 		return "", "", err
diff --git a/management/server/types/proxy_access_token_test.go b/management/server/types/proxy_access_token_test.go
index aa1a4d2dd..740b87c2f 100644
--- a/management/server/types/proxy_access_token_test.go
+++ b/management/server/types/proxy_access_token_test.go
@@ -1,6 +1,7 @@
 package types
 
 import (
+	"strings"
 	"testing"
 	"time"
 
@@ -123,6 +124,22 @@ func TestCreateNewProxyAccessToken(t *testing.T) {
 	})
 }
 
+func TestGenerateProxyToken(t *testing.T) {
+	hashed, plain, err := GenerateProxyToken()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := plain.Validate(); err != nil {
+		t.Errorf("generated token failed Validate(): %v", err)
+	}
+	if plain.Hash() != hashed {
+		t.Error("returned hashed token does not match Hash(plain)")
+	}
+	if !strings.HasPrefix(string(plain), ProxyTokenPrefix) {
+		t.Errorf("token %q missing prefix %q", plain, ProxyTokenPrefix)
+	}
+}
+
 func TestProxyAccessToken_IsExpired(t *testing.T) {
 	past := time.Now().Add(-1 * time.Hour)
 	future := time.Now().Add(1 * time.Hour)
diff --git a/management/server/types/resource.go b/management/server/types/resource.go
index 8347d8c03..0f065c850 100644
--- a/management/server/types/resource.go
+++ b/management/server/types/resource.go
@@ -4,15 +4,6 @@ import (
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
-type ResourceType string
-
-const (
-	ResourceTypePeer   ResourceType = "peer"
-	ResourceTypeDomain ResourceType = "domain"
-	ResourceTypeHost   ResourceType = "host"
-	ResourceTypeSubnet ResourceType = "subnet"
-)
-
 type Resource struct {
 	ID   string
 	Type ResourceType
diff --git a/management/server/types/settings.go b/management/server/types/settings.go
index d17d0ef2b..8aa1c7e4c 100644
--- a/management/server/types/settings.go
+++ b/management/server/types/settings.go
@@ -76,6 +76,19 @@ type Settings struct {
 	// MetricsPushEnabled globally enables or disables client metrics push for the account
 	MetricsPushEnabled bool `gorm:"default:false"`
 
+	// PeerHostnameCollisionRejected rejects registering or renaming a peer to a hostname
+	// already used by another peer of the account instead of suffixing it
+	PeerHostnameCollisionRejected bool `gorm:"default:false"`
+
+	// AgentNetworkOnly limits the dashboard to the Agent Network surface for this account.
+	// Set for accounts created via netbird.ai signups; users can disable it later.
+	AgentNetworkOnly bool `gorm:"default:false"`
+
+	// DashboardFeatures holds per-account dashboard section visibility overrides.
+	// It serializes to a single JSON column so new sections can be added without
+	// a schema change.
+	DashboardFeatures *DashboardFeatures `gorm:"serializer:json"`
+
 	// EmbeddedIdpEnabled indicates if the embedded identity provider is enabled.
 	// This is a runtime-only field, not stored in the database.
 	EmbeddedIdpEnabled bool `gorm:"-"`
@@ -114,6 +127,8 @@ func (s *Settings) Copy() *Settings {
 		AutoUpdateAlways:                s.AutoUpdateAlways,
 		IPv6EnabledGroups:               slices.Clone(s.IPv6EnabledGroups),
 		MetricsPushEnabled:              s.MetricsPushEnabled,
+		PeerHostnameCollisionRejected:   s.PeerHostnameCollisionRejected,
+		AgentNetworkOnly:                s.AgentNetworkOnly,
 		EmbeddedIdpEnabled:              s.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               s.LocalAuthDisabled,
 		LocalMfaEnabled:                 s.LocalMfaEnabled,
@@ -121,9 +136,31 @@ func (s *Settings) Copy() *Settings {
 	if s.Extra != nil {
 		settings.Extra = s.Extra.Copy()
 	}
+	if s.DashboardFeatures != nil {
+		settings.DashboardFeatures = s.DashboardFeatures.Copy()
+	}
 	return settings
 }
 
+// DashboardFeatures holds per-account dashboard section visibility overrides.
+// Nil fields are unset and follow the default dashboard behavior; an explicit
+// value forces that section shown or hidden for the account.
+type DashboardFeatures struct {
+	// AgentNetwork, when set, forces the Agent Network menu shown (true) or
+	// hidden (false) regardless of the deployment feature flag.
+	AgentNetwork *bool `json:"agent_network,omitempty"`
+}
+
+// Copy returns a deep copy of the DashboardFeatures struct.
+func (d *DashboardFeatures) Copy() *DashboardFeatures {
+	c := &DashboardFeatures{}
+	if d.AgentNetwork != nil {
+		v := *d.AgentNetwork
+		c.AgentNetwork = &v
+	}
+	return c
+}
+
 type ExtraSettings struct {
 	// PeerApprovalEnabled enables or disables the need for peers bo be approved by an administrator
 	PeerApprovalEnabled bool
diff --git a/management/server/types/store.go b/management/server/types/store.go
index 2ca4383b2..a13d52f91 100644
--- a/management/server/types/store.go
+++ b/management/server/types/store.go
@@ -1,10 +1,12 @@
 package types
 
-type Engine string
+import "github.com/netbirdio/netbird/management/internals/shared/db"
+
+type Engine = db.Engine
 
 const (
-	PostgresStoreEngine Engine = "postgres"
+	PostgresStoreEngine        = db.PostgresStoreEngine
 	FileStoreEngine     Engine = "jsonfile"
-	SqliteStoreEngine   Engine = "sqlite"
-	MysqlStoreEngine    Engine = "mysql"
+	SqliteStoreEngine          = db.SqliteStoreEngine
+	MysqlStoreEngine           = db.MysqlStoreEngine
 )
diff --git a/management/server/types/update_reason.go b/management/server/types/update_reason.go
index 9d752da9a..e829a1b2a 100644
--- a/management/server/types/update_reason.go
+++ b/management/server/types/update_reason.go
@@ -34,4 +34,7 @@ const (
 	UpdateOperationCreate UpdateOperation = "create"
 	UpdateOperationUpdate UpdateOperation = "update"
 	UpdateOperationDelete UpdateOperation = "delete"
+	// UpdateOperationRefresh is a periodic push that carries no change of its own, so
+	// it stays out of the counters that track what an administrator actually edited.
+	UpdateOperationRefresh UpdateOperation = "refresh"
 )
diff --git a/management/server/types/user.go b/management/server/types/user.go
index dc601e15b..bebc20ea4 100644
--- a/management/server/types/user.go
+++ b/management/server/types/user.go
@@ -6,18 +6,20 @@ import (
 	"time"
 
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integration_reference"
+	"github.com/netbirdio/netbird/shared/management/integration_reference"
 	"github.com/netbirdio/netbird/util/crypt"
 )
 
 const (
-	UserRoleOwner        UserRole = "owner"
-	UserRoleAdmin        UserRole = "admin"
-	UserRoleUser         UserRole = "user"
-	UserRoleUnknown      UserRole = "unknown"
-	UserRoleBillingAdmin UserRole = "billing_admin"
-	UserRoleAuditor      UserRole = "auditor"
-	UserRoleNetworkAdmin UserRole = "network_admin"
+	UserRoleOwner             UserRole = "owner"
+	UserRoleAdmin             UserRole = "admin"
+	UserRoleUser              UserRole = "user"
+	UserRoleUnknown           UserRole = "unknown"
+	UserRoleBillingAdmin      UserRole = "billing_admin"
+	UserRoleAuditor           UserRole = "auditor"
+	UserRoleNetworkAdmin      UserRole = "network_admin"
+	UserRoleAgentNetworkAdmin UserRole = "agent_network_admin"
+	UserRoleUsageViewer       UserRole = "usage_viewer"
 
 	UserStatusActive   UserStatus = "active"
 	UserStatusDisabled UserStatus = "disabled"
@@ -42,6 +44,10 @@ func StrRoleToUserRole(strRole string) UserRole {
 		return UserRoleAuditor
 	case "network_admin":
 		return UserRoleNetworkAdmin
+	case "agent_network_admin":
+		return UserRoleAgentNetworkAdmin
+	case "usage_viewer":
+		return UserRoleUsageViewer
 	default:
 		return UserRoleUnknown
 	}
@@ -140,7 +146,7 @@ func (u *User) IsRegularUser() bool {
 
 // IsRestrictable checks whether a user is in a restrictable role.
 func (u *User) IsRestrictable() bool {
-	return u.Role == UserRoleUser || u.Role == UserRoleBillingAdmin
+	return u.Role == UserRoleUser || u.Role == UserRoleBillingAdmin || u.Role == UserRoleUsageViewer
 }
 
 // ToUserInfo converts a User object to a UserInfo object.
@@ -279,6 +285,25 @@ func (u *User) EncryptSensitiveData(enc *crypt.FieldEncrypt) error {
 	return nil
 }
 
+func MaskEmail(email string) string {
+	local, domain, found := strings.Cut(email, "@")
+	if !found || local == "" || domain == "" {
+		return ""
+	}
+
+	// Runes, not bytes, so a non-ASCII local part is not cut mid-character.
+	runes := []rune(local)
+
+	// Keeping the first two and the last needs a local part of at least four to
+	// hide anything at all: at three or fewer those are the whole of it, and the
+	// address would be recoverable in full from what is meant to conceal it.
+	if len(runes) < 4 {
+		return "****@" + domain
+	}
+
+	return string(runes[:2]) + "****" + string(runes[len(runes)-1]) + "@" + domain
+}
+
 // DecryptSensitiveData decrypts the user's sensitive fields (Email and Name) in place.
 func (u *User) DecryptSensitiveData(enc *crypt.FieldEncrypt) error {
 	if enc == nil {
diff --git a/management/server/types/user_test.go b/management/server/types/user_test.go
index e11df96aa..1b3ce7ce6 100644
--- a/management/server/types/user_test.go
+++ b/management/server/types/user_test.go
@@ -296,3 +296,144 @@ func TestUser_EncryptDecryptRoundTrip(t *testing.T) {
 		})
 	}
 }
+
+func TestMaskEmail(t *testing.T) {
+	testCases := []struct {
+		name     string
+		email    string
+		expected string
+	}{
+		{
+			name:     "ordinary address keeps the first two, the last, and the domain",
+			email:    "admin@example.com",
+			expected: "ad****n@example.com",
+		},
+		{
+			name:     "four characters is the shortest local part that reveals anything",
+			email:    "abcd@example.com",
+			expected: "ab****d@example.com",
+		},
+		{
+			name:     "three character local part is masked whole, since a lead and tail would be all of it",
+			email:    "abc@example.com",
+			expected: "****@example.com",
+		},
+		{
+			name:     "two character local part is masked whole",
+			email:    "ab@example.com",
+			expected: "****@example.com",
+		},
+		{
+			name:     "single character local part is masked whole",
+			email:    "a@b.co",
+			expected: "****@b.co",
+		},
+		{
+			name:     "mask width does not report the length it stands in for",
+			email:    "a.very.long.local.part@example.com",
+			expected: "a.****t@example.com",
+		},
+		{
+			name:     "a local part far longer than the mask is still reduced to three characters",
+			email:    "finance.department.notifications.owner.account@example.com",
+			expected: "fi****t@example.com",
+		},
+		{
+			name:     "plus addressing is masked along with the rest of the local part",
+			email:    "admin+netbird@example.com",
+			expected: "ad****d@example.com",
+		},
+		{
+			name:     "separators inside the local part are not treated specially",
+			email:    "first.last-name_x@example.com",
+			expected: "fi****x@example.com",
+		},
+		{
+			name:     "case is preserved rather than normalised",
+			email:    "Admin@Example.COM",
+			expected: "Ad****n@Example.COM",
+		},
+		{
+			name:     "subdomains stay intact",
+			email:    "owner@mail.corp.example.com",
+			expected: "ow****r@mail.corp.example.com",
+		},
+		{
+			name:     "german umlauts count as single characters",
+			email:    "müller@example.de",
+			expected: "mü****r@example.de",
+		},
+		{
+			name:     "cyrillic local part is cut on runes",
+			email:    "иванов@example.ru",
+			expected: "ив****в@example.ru",
+		},
+		{
+			name:     "cjk local part of three runes is masked whole, counted in runes not bytes",
+			email:    "用户名@example.cn",
+			expected: "****@example.cn",
+		},
+		{
+			name:     "cjk local part of four runes reveals the first two and the last",
+			email:    "用户名字@example.cn",
+			expected: "用户****字@example.cn",
+		},
+		{
+			name:     "arabic local part is cut on runes",
+			email:    "مستخدم@example.sa",
+			expected: "مس****م@example.sa",
+		},
+		{
+			name:     "two rune non-ascii local part is masked whole",
+			email:    "ää@example.de",
+			expected: "****@example.de",
+		},
+		{
+			name:     "astral plane runes are not split into surrogates",
+			email:    "a🎉bc@example.com",
+			expected: "a🎉****c@example.com",
+		},
+		{
+			name:     "a non-ascii domain is left alone",
+			email:    "admin@münchen.example",
+			expected: "ad****n@münchen.example",
+		},
+		{
+			name:     "only the first separator splits, so a second stays in the domain",
+			email:    "a@b@example.com",
+			expected: "****@b@example.com",
+		},
+		{
+			name:     "empty email has nothing to mask",
+			email:    "",
+			expected: "",
+		},
+		{
+			name:     "value without a separator is not an address",
+			email:    "not-an-email",
+			expected: "",
+		},
+		{
+			name:     "missing local part is not an address",
+			email:    "@example.com",
+			expected: "",
+		},
+		{
+			name:     "missing domain is not an address",
+			email:    "admin@",
+			expected: "",
+		},
+		{
+			name:     "a bare separator is not an address",
+			email:    "@",
+			expected: "",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, MaskEmail(tc.email))
+		})
+	}
+
+}
diff --git a/management/server/user.go b/management/server/user.go
index b4b9ebe01..e64320666 100644
--- a/management/server/user.go
+++ b/management/server/user.go
@@ -321,6 +321,10 @@ func (am *DefaultAccountManager) DeleteUser(ctx context.Context, accountID, init
 		return err
 	}
 
+	if targetUser.AccountID != accountID {
+		return status.NewUserNotFoundError(targetUserID)
+	}
+
 	if targetUser.Role == types.UserRoleOwner {
 		return status.NewOwnerDeletePermissionError()
 	}
@@ -589,7 +593,7 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 		return nil, err
 	}
 
-	var updateAccountPeers bool
+	affected := make(affectedPeerSet)
 	var peersToExpire []*nbpeer.Peer
 	var addUserEvents []func()
 	var usersToSave = make([]*types.User, 0, len(updates))
@@ -624,21 +628,27 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 			return nil, status.Errorf(status.InvalidArgument, "provided user update is nil")
 		}
 
+		var itemSnap *affectedpeers.Snapshot
+		var itemChange affectedpeers.Change
 		err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
-			_, updatedUser, userPeersToExpire, userEvents, err := am.processUserUpdate(
+			change, updatedUser, userPeersToExpire, userEvents, err := am.processUserUpdate(
 				ctx, transaction, groupsMap, accountID, initiatorUserID, initiatorUser, update, addIfNotExists, settings,
 			)
 			if err != nil {
 				return fmt.Errorf("failed to process update for user %s: %w", update.Id, err)
 			}
 
-			updateAccountPeers = true
-
 			err = transaction.SaveUser(ctx, updatedUser)
 			if err != nil {
 				return fmt.Errorf("failed to save updated user %s: %w", update.Id, err)
 			}
 
+			snap, err := affectedpeers.Load(ctx, transaction, accountID, change)
+			if err != nil {
+				return err
+			}
+
+			itemSnap, itemChange = snap, change
 			usersToSave = append(usersToSave, updatedUser)
 			addUserEvents = append(addUserEvents, userEvents...)
 			peersToExpire = append(peersToExpire, userPeersToExpire...)
@@ -652,7 +662,9 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 			}
 			globalErr = errors.Join(globalErr, err)
 			// continue when updating multiple users
+			continue
 		}
+		affected.add(itemSnap.Expand(ctx, accountID, itemChange))
 	}
 
 	var updatedUsersInfo = make([]*types.UserInfo, 0, len(usersToSave))
@@ -679,11 +691,11 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 			log.WithContext(ctx).Errorf("failed update expired peers: %s", err)
 			return nil, err
 		}
-	} else if updateAccountPeers {
+	} else if len(usersToSave) > 0 {
 		if err = am.Store.IncrementNetworkSerial(ctx, accountID); err != nil {
 			return nil, fmt.Errorf("failed to increment network serial: %w", err)
 		}
-		am.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate})
+		go am.dispatchAffectedPeerIDs(ctx, accountID, affected.ids())
 	}
 
 	return updatedUsersInfo, globalErr
@@ -755,19 +767,21 @@ func (am *DefaultAccountManager) prepareUserUpdateEvents(ctx context.Context, ac
 }
 
 func (am *DefaultAccountManager) processUserUpdate(ctx context.Context, transaction store.Store, groupsMap map[string]*types.Group,
-	accountID, initiatorUserId string, initiatorUser, update *types.User, addIfNotExists bool, settings *types.Settings) (bool, *types.User, []*nbpeer.Peer, []func(), error) {
+	accountID, initiatorUserId string, initiatorUser, update *types.User, addIfNotExists bool, settings *types.Settings) (affectedpeers.Change, *types.User, []*nbpeer.Peer, []func(), error) {
+
+	var change affectedpeers.Change
 
 	if update == nil {
-		return false, nil, nil, nil, status.Errorf(status.InvalidArgument, "provided user update is nil")
+		return change, nil, nil, nil, status.Errorf(status.InvalidArgument, "provided user update is nil")
 	}
 
 	oldUser, isNewUser, err := getUserOrCreateIfNotExists(ctx, transaction, accountID, update, addIfNotExists)
 	if err != nil {
-		return false, nil, nil, nil, err
+		return change, nil, nil, nil, err
 	}
 
 	if err := validateUserUpdate(groupsMap, initiatorUser, oldUser, update); err != nil {
-		return false, nil, nil, nil, err
+		return change, nil, nil, nil, err
 	}
 
 	// only auto groups, revoked status, and integration reference can be updated for now
@@ -788,13 +802,13 @@ func (am *DefaultAccountManager) processUserUpdate(ctx context.Context, transact
 	var transferredOwnerRole bool
 	result, err := handleOwnerRoleTransfer(ctx, transaction, initiatorUser, update)
 	if err != nil {
-		return false, nil, nil, nil, err
+		return change, nil, nil, nil, err
 	}
 	transferredOwnerRole = result
 
 	userPeers, err := transaction.GetUserPeers(ctx, store.LockingStrengthNone, updatedUser.AccountID, update.Id)
 	if err != nil {
-		return false, nil, nil, nil, err
+		return change, nil, nil, nil, err
 	}
 
 	var peersToExpire []*nbpeer.Peer
@@ -803,6 +817,32 @@ func (am *DefaultAccountManager) processUserUpdate(ctx context.Context, transact
 		peersToExpire = userPeers
 	}
 
+	// A user reaches a peer's network map only through the SSH rules: as part of a
+	// group -> user mapping, and as part of the account's allowed-user set. Creating,
+	// blocking or unblocking a user adds it to or removes it from both, so every group
+	// it maps into changes — including the All group that holds every active user.
+	// Otherwise only the auto-groups it joined or left do.
+	if isNewUser || oldUser.IsBlocked() != updatedUser.IsBlocked() {
+		change.AllowedUsersChanged = true
+		change.UserGroupIDs = slices.Concat(oldUser.AutoGroups, updatedUser.AutoGroups, allGroupIDs(groupsMap))
+	} else {
+		change.UserGroupIDs = slices.Concat(
+			util.Difference(oldUser.AutoGroups, updatedUser.AutoGroups),
+			util.Difference(updatedUser.AutoGroups, oldUser.AutoGroups),
+		)
+	}
+
+	// The user's peers are the changed entity in every scenario the update can
+	// produce — group membership, IPv6 assignment, SSH mappings — so they refresh
+	// together with every peer they can connect to, like on a regular peer update.
+	// An update that changes neither the auto-groups nor the active-user set has no
+	// peer-visible effect and refreshes nobody.
+	if len(change.UserGroupIDs) > 0 || change.AllowedUsersChanged {
+		for _, peer := range userPeers {
+			change.ChangedPeerIDs = append(change.ChangedPeerIDs, peer.ID)
+		}
+	}
+
 	var removedGroups, addedGroups []string
 	if update.AutoGroups != nil && settings.GroupsPropagationEnabled {
 		removedGroups = util.Difference(oldUser.AutoGroups, update.AutoGroups)
@@ -810,26 +850,40 @@ func (am *DefaultAccountManager) processUserUpdate(ctx context.Context, transact
 		for _, peer := range userPeers {
 			for _, groupID := range removedGroups {
 				if err := transaction.RemovePeerFromGroup(ctx, peer.ID, groupID); err != nil {
-					return false, nil, nil, nil, fmt.Errorf("failed to remove peer %s from group %s: %w", peer.ID, groupID, err)
+					return change, nil, nil, nil, fmt.Errorf("failed to remove peer %s from group %s: %w", peer.ID, groupID, err)
 				}
 			}
 			for _, groupID := range addedGroups {
 				if err := transaction.AddPeerToGroup(ctx, accountID, peer.ID, groupID); err != nil {
-					return false, nil, nil, nil, fmt.Errorf("failed to add peer %s to group %s: %w", peer.ID, groupID, err)
+					return change, nil, nil, nil, fmt.Errorf("failed to add peer %s to group %s: %w", peer.ID, groupID, err)
 				}
 			}
 		}
 
 		allGroupChanges := slices.Concat(removedGroups, addedGroups)
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, allGroupChanges); err != nil {
-			return false, nil, nil, nil, fmt.Errorf("reconcile IPv6 for group changes: %w", err)
+		change.LinkGroups = allGroupChanges
+
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, allGroupChanges)
+		if err != nil {
+			return change, nil, nil, nil, fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 		}
+		change.ChangedPeerIDs = append(change.ChangedPeerIDs, ipv6Changed...)
 	}
 
-	updateAccountPeers := len(userPeers) > 0
 	userEventsToAdd := am.prepareUserUpdateEvents(ctx, updatedUser.AccountID, initiatorUserId, oldUser, updatedUser, transferredOwnerRole, isNewUser, removedGroups, addedGroups, transaction)
 
-	return updateAccountPeers, updatedUser, peersToExpire, userEventsToAdd, nil
+	return change, updatedUser, peersToExpire, userEventsToAdd, nil
+}
+
+// allGroupIDs returns the ID of the account's All group, which every active user maps
+// into, as a slice so callers can concatenate it.
+func allGroupIDs(groupsMap map[string]*types.Group) []string {
+	for _, group := range groupsMap {
+		if group.IsGroupAll() {
+			return []string{group.ID}
+		}
+	}
+	return nil
 }
 
 // getUserOrCreateIfNotExists retrieves the existing user or creates a new one if it doesn't exist.
@@ -1127,28 +1181,35 @@ func (am *DefaultAccountManager) expireAndUpdatePeers(ctx context.Context, accou
 	dnsDomain := am.networkMapController.GetDNSDomain(settings)
 
 	var peerIDs []string
-	for _, peer := range peers {
+	defer func() {
+		if len(peerIDs) == 0 {
+			return
+		}
+		// this will trigger peer disconnect from the management service
+		log.Debugf("Expiring %d peers for account %s", len(peerIDs), accountID)
+		am.networkMapController.DisconnectPeers(ctx, accountID, peerIDs)
+	}()
+	for _, candidate := range peers {
 		// nolint:staticcheck
-		ctx = context.WithValue(ctx, nbcontext.PeerIDKey, peer.Key)
+		peerCtx := context.WithValue(ctx, nbcontext.PeerIDKey, candidate.Key)
 
-		if peer.UserID == "" {
+		if candidate.UserID == "" {
 			// we do not want to expire peers that are added via setup key
 			continue
 		}
 
-		if peer.Status.LoginExpired {
+		peer, err := am.expirePeerIfStillDue(peerCtx, accountID, candidate.ID, settings, reason)
+		if err != nil {
+			return err
+		}
+		if peer == nil {
 			continue
 		}
 		peerIDs = append(peerIDs, peer.ID)
-		peer.MarkLoginExpired(true)
-
-		if err := am.Store.SavePeerStatus(ctx, accountID, peer.ID, *peer.Status); err != nil {
-			return err
-		}
 		meta := peer.EventMeta(dnsDomain)
 		meta["reason"] = string(reason)
 		am.StoreEvent(
-			ctx,
+			peerCtx,
 			peer.UserID, peer.ID, accountID,
 			activity.PeerLoginExpired, meta,
 		)
@@ -1165,15 +1226,53 @@ func (am *DefaultAccountManager) expireAndUpdatePeers(ctx context.Context, accou
 	if err != nil {
 		return fmt.Errorf("notify network map controller of peer update: %w", err)
 	}
-
-	if len(peerIDs) != 0 {
-		// this will trigger peer disconnect from the management service
-		log.Debugf("Expiring %d peers for account %s", len(peerIDs), accountID)
-		am.networkMapController.DisconnectPeers(ctx, accountID, peerIDs)
-	}
 	return nil
 }
 
+// expirePeerIfStillDue flags the peer as login-expired and returns its fresh copy, or nil
+// when it no longer qualifies. The candidate list is read without a lock, so a login that
+// landed in between would otherwise be overwritten with a stale expired status.
+func (am *DefaultAccountManager) expirePeerIfStillDue(ctx context.Context, accountID, peerID string, settings *types.Settings, reason peerExpirationReason) (*nbpeer.Peer, error) {
+	var expired *nbpeer.Peer
+	err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		peer, err := transaction.GetPeerByID(ctx, store.LockingStrengthUpdate, accountID, peerID)
+		if err != nil {
+			if s, ok := status.FromError(err); ok && s.Type() == status.NotFound {
+				return nil
+			}
+			return err
+		}
+		if peer.Status.LoginExpired || !peerExpirationDue(peer, settings, reason) {
+			return nil
+		}
+		peer.MarkLoginExpired(true)
+		if err := transaction.SavePeerStatus(ctx, accountID, peer.ID, *peer.Status); err != nil {
+			return err
+		}
+		expired = peer
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return expired, nil
+}
+
+// peerExpirationDue re-evaluates a time-based expiry against the peer's current state.
+// Administrative reasons expire the peer unconditionally.
+func peerExpirationDue(peer *nbpeer.Peer, settings *types.Settings, reason peerExpirationReason) bool {
+	switch reason {
+	case peerExpirationSessionExpired:
+		expired, _ := peer.LoginExpired(settings.PeerLoginExpiration)
+		return settings.PeerLoginExpirationEnabled && expired
+	case peerExpirationInactivity:
+		expired, _ := peer.SessionExpired(settings.PeerInactivityExpiration)
+		return settings.PeerInactivityExpirationEnabled && expired
+	default:
+		return true
+	}
+}
+
 func (am *DefaultAccountManager) deleteUserFromIDP(ctx context.Context, targetUserID, accountID string) error {
 	if am.userDeleteFromIDPEnabled {
 		log.WithContext(ctx).Debugf("user %s deleted from IdP", targetUserID)
@@ -1287,6 +1386,10 @@ func (am *DefaultAccountManager) deleteRegularUser(ctx context.Context, accountI
 			return fmt.Errorf("failed to get user to delete: %w", err)
 		}
 
+		if targetUser.Role == types.UserRoleOwner && targetUser.Id != initiatorUserID {
+			return status.NewOwnerDeletePermissionError()
+		}
+
 		settings, err = transaction.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
 		if err != nil {
 			return fmt.Errorf("failed to get account settings: %w", err)
@@ -1349,6 +1452,25 @@ func (am *DefaultAccountManager) deleteRegularUser(ctx context.Context, accountI
 	return updateAccountPeers, nil
 }
 
+// pendingApprovalError refuses a user awaiting approval, naming the owner who
+// can approve them when their address resolves. Failing to resolve one is not a
+// reason to withhold the refusal, so the lookup is best effort.
+func (am *DefaultAccountManager) pendingApprovalError(ctx context.Context, accountID string) error {
+	owner, err := am.GetOwnerInfo(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Debugf("pending approval refusal: owner of account %s did not resolve: %v", accountID, err)
+		return status.NewUserPendingApprovalError()
+	}
+
+	masked := types.MaskEmail(owner.Email)
+	if masked == "" {
+		log.WithContext(ctx).Debugf("pending approval refusal: no address found for the owner of account %s", accountID)
+		return status.NewUserPendingApprovalError()
+	}
+
+	return status.NewUserPendingApprovalByOwnerError(masked)
+}
+
 // GetOwnerInfo retrieves the owner information for a given account ID.
 func (am *DefaultAccountManager) GetOwnerInfo(ctx context.Context, accountID string) (*types.UserInfo, error) {
 	owner, err := am.Store.GetAccountOwner(ctx, store.LockingStrengthNone, accountID)
@@ -1406,6 +1528,14 @@ func (am *DefaultAccountManager) GetCurrentUserInfo(ctx context.Context, userAut
 		return nil, err
 	}
 
+	// A user pending approval is blocked too, and the dashboard needs to tell
+	// the two apart: one is a dead end, the other resolves by itself once the
+	// owner acts. Naming that owner needs the address the IdP holds, which is
+	// why this is answered here rather than in the permission gate.
+	if user.IsBlocked() && user.PendingApproval {
+		return nil, am.pendingApprovalError(ctx, user.AccountID)
+	}
+
 	if user.IsBlocked() {
 		return nil, status.NewUserBlockedError()
 	}
@@ -1849,12 +1979,17 @@ func (am *DefaultAccountManager) DeleteUserInvite(ctx context.Context, accountID
 
 const minPasswordLength = 8
 
-// validatePassword checks password strength requirements:
+// validatePassword checks password strength requirements.
+func validatePassword(password string) error {
+	return ValidatePassword(password)
+}
+
+// ValidatePassword checks password strength requirements:
 // - Minimum 8 characters
 // - At least 1 digit
 // - At least 1 uppercase letter
 // - At least 1 special character
-func validatePassword(password string) error {
+func ValidatePassword(password string) error {
 	if len(password) < minPasswordLength {
 		return errors.New("password must be at least 8 characters long")
 	}
diff --git a/management/server/user_test.go b/management/server/user_test.go
index f32a6b3a1..fcfb7a1e7 100644
--- a/management/server/user_test.go
+++ b/management/server/user_test.go
@@ -33,7 +33,7 @@ import (
 	"github.com/netbirdio/netbird/idp/dex"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integration_reference"
+	"github.com/netbirdio/netbird/shared/management/integration_reference"
 )
 
 const (
@@ -802,6 +802,52 @@ func TestUser_DeleteUser_SelfDelete(t *testing.T) {
 	}
 }
 
+func TestUser_DeleteUser_OtherAccount(t *testing.T) {
+	testStore, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	if err != nil {
+		t.Fatalf("Error when creating store: %s", err)
+	}
+	t.Cleanup(cleanup)
+
+	account := newAccountWithId(context.Background(), mockAccountID, mockUserID, "", "", "", false)
+	if err = testStore.SaveAccount(context.Background(), account); err != nil {
+		t.Fatalf("Error when saving account: %s", err)
+	}
+
+	otherAccount := newAccountWithId(context.Background(), "otherAccount", "otherOwner", "", "", "", false)
+	otherAccount.Users["otherRegularUser"] = &types.User{
+		Id:        "otherRegularUser",
+		AccountID: "otherAccount",
+		Role:      types.UserRoleUser,
+	}
+	otherAccount.Users["otherServiceUser"] = &types.User{
+		Id:              "otherServiceUser",
+		AccountID:       "otherAccount",
+		Role:            types.UserRoleUser,
+		IsServiceUser:   true,
+		ServiceUserName: "otherServiceUser",
+	}
+	if err = testStore.SaveAccount(context.Background(), otherAccount); err != nil {
+		t.Fatalf("Error when saving other account: %s", err)
+	}
+
+	am := DefaultAccountManager{
+		Store:              testStore,
+		eventStore:         &activity.InMemoryEventStore{},
+		permissionsManager: permissions.NewManager(testStore),
+	}
+
+	for _, targetUserID := range []string{"otherRegularUser", "otherServiceUser"} {
+		t.Run(targetUserID, func(t *testing.T) {
+			err := am.DeleteUser(context.Background(), mockAccountID, mockUserID, targetUserID)
+			assert.Equal(t, status.NewUserNotFoundError(targetUserID), err)
+
+			_, err = testStore.GetUserByUserID(context.Background(), store.LockingStrengthNone, targetUserID)
+			assert.NoError(t, err, "user of another account must not be deleted")
+		})
+	}
+}
+
 func TestUser_DeleteUser_regularUser(t *testing.T) {
 	store, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
 	if err != nil {
@@ -896,6 +942,49 @@ func TestUser_DeleteUser_regularUser(t *testing.T) {
 
 }
 
+func TestUser_deleteRegularUser_RejectsOwner(t *testing.T) {
+	s, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	account := newAccountWithId(context.Background(), mockAccountID, mockUserID, "", "", "", false)
+	account.Users[mockTargetUserId] = &types.User{
+		Id:     mockTargetUserId,
+		Issued: types.UserIssuedAPI,
+		Role:   types.UserRoleOwner,
+	}
+	require.NoError(t, s.SaveAccount(context.Background(), account))
+
+	am := DefaultAccountManager{Store: s}
+
+	_, err = am.deleteRegularUser(context.Background(), mockAccountID, mockUserID, &types.UserInfo{ID: mockTargetUserId})
+	assert.EqualError(t, err, status.NewOwnerDeletePermissionError().Error())
+}
+
+func TestUser_deleteRegularUser_InitiatorOwnerDeletesThemself(t *testing.T) {
+	s, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	account := newAccountWithId(context.Background(), mockAccountID, mockUserID, "", "", "", false)
+	require.NoError(t, s.SaveAccount(context.Background(), account))
+
+	networkMapControllerMock := network_map.NewMockController(gomock.NewController(t))
+	networkMapControllerMock.EXPECT().OnPeersDeleted(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(nil)
+
+	am := DefaultAccountManager{
+		Store:                s,
+		eventStore:           &activity.InMemoryEventStore{},
+		networkMapController: networkMapControllerMock,
+	}
+
+	_, err = am.deleteRegularUser(context.Background(), mockAccountID, mockUserID, &types.UserInfo{ID: mockUserID})
+	require.NoError(t, err)
+
+	_, err = s.GetUserByUserID(context.Background(), store.LockingStrengthNone, mockUserID)
+	assert.Equal(t, status.NewUserNotFoundError(mockUserID), err)
+}
+
 func TestUser_DeleteUser_RegularUsers(t *testing.T) {
 	store, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
 	if err != nil {
@@ -1455,166 +1544,170 @@ func TestDefaultAccountManager_SaveUser(t *testing.T) {
 }
 
 func TestUserAccountPeersUpdate(t *testing.T) {
-	// account groups propagation is enabled
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		// account groups propagation is enabled
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	require.NoError(t, err)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
+		require.NoError(t, err)
 
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+		policy := &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"groupA"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
 			},
-		},
-	}
-	_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-	require.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Creating a new regular user should send peer update (as users are not filtered yet)
-	t.Run("creating new regular user with no groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
-			Id:        "regularUser1",
-			AccountID: account.Id,
-			Role:      types.UserRoleUser,
-			Issued:    types.UserIssuedAPI,
-		}, true)
+		}
+		_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// updating user with no linked peers should update account peers and send peer update (as users are not filtered yet)
-	t.Run("updating user with no linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating a new regular user should send peer update (as users are not filtered yet)
+		step(t, "creating new regular user with no groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
-			Id:        "regularUser1",
-			AccountID: account.Id,
-			Role:      types.UserRoleUser,
-			Issued:    types.UserIssuedAPI,
-		}, false)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
+				Id:        "regularUser1",
+				AccountID: account.Id,
+				Role:      types.UserRoleUser,
+				Issued:    types.UserIssuedAPI,
+			}, true)
+			require.NoError(t, err)
 
-	// drain any buffered updates from previous subtests
-	drainPeerUpdates(updMsg)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-	// deleting user with no linked peers should not update account peers and not send peer update
-	t.Run("deleting user with no linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// saving an unchanged user with no linked peers should not update account peers and not send peer update
+		step(t, "updating user with no linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser1")
-		require.NoError(t, err)
+			_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
+				Id:        "regularUser1",
+				AccountID: account.Id,
+				Role:      types.UserRoleUser,
+				Issued:    types.UserIssuedAPI,
+			}, false)
+			require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-	// create a user and add new peer with the user
-	_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
-		Id:        "regularUser2",
-		AccountID: account.Id,
-		Role:      types.UserRoleAdmin,
-		Issued:    types.UserIssuedAPI,
-	}, true)
-	require.NoError(t, err)
+		// drain any buffered updates from previous subtests
+		drainPeerUpdates(updMsg)
 
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
+		// deleting user with no linked peers should not update account peers and not send peer update
+		step(t, "deleting user with no linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	expectedPeerKey := key.PublicKey().String()
-	peer4, _, _, _, err := manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
-		Key:  expectedPeerKey,
-		Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-	}, false)
-	require.NoError(t, err)
+			err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser1")
+			require.NoError(t, err)
 
-	// updating user with linked peers should update account peers and send peer update
-	t.Run("updating user with linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
+		// create a user and add new peer with the user
 		_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
 			Id:        "regularUser2",
 			AccountID: account.Id,
 			Role:      types.UserRoleAdmin,
 			Issued:    types.UserIssuedAPI,
+		}, true)
+		require.NoError(t, err)
+
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+
+		expectedPeerKey := key.PublicKey().String()
+		peer4, _, _, _, err := manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
+			Key:  expectedPeerKey,
+			Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
 		}, false)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// updating user with linked peers should update account peers and send peer update
+		step(t, "updating user with linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	peer4UpdMsg := updateManager.CreateChannel(context.Background(), peer4.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer4.ID)
-	})
+			_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
+				Id:        "regularUser2",
+				AccountID: account.Id,
+				Role:      types.UserRoleAdmin,
+				Issued:    types.UserIssuedAPI,
+			}, false)
+			require.NoError(t, err)
 
-	// deleting user with linked peers should update account peers and send peer update
-	t.Run("deleting user with linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, peer4UpdMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser2")
-		require.NoError(t, err)
+		peer4UpdMsg := updateManager.CreateChannel(context.Background(), peer4.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer4.ID)
+		})
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// deleting user with linked peers should update account peers and send peer update
+		step(t, "deleting user with linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, peer4UpdMsg)
+				close(done)
+			}()
+
+			err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser2")
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 
@@ -1690,6 +1783,42 @@ func TestDefaultAccountManager_GetCurrentUserInfo(t *testing.T) {
 	}
 	require.NoError(t, store.SaveAccount(context.Background(), account2))
 
+	account3 := newAccountWithId(context.Background(), "account3", "account3Owner", "", "owner@example.com", "", false)
+	account3.Users["pending-user"] = &types.User{
+		Id:              "pending-user",
+		AccountID:       account3.Id,
+		Role:            types.UserRoleUser,
+		Blocked:         true,
+		PendingApproval: true,
+	}
+	require.NoError(t, store.SaveAccount(context.Background(), account3))
+
+	// The owner has no address to name, so the refusal falls back to the generic one.
+	account4 := newAccountWithId(context.Background(), "account4", "account4Owner", "", "", "", false)
+	account4.Users["pending-user-without-owner-email"] = &types.User{
+		Id:              "pending-user-without-owner-email",
+		AccountID:       account4.Id,
+		Role:            types.UserRoleUser,
+		Blocked:         true,
+		PendingApproval: true,
+	}
+	require.NoError(t, store.SaveAccount(context.Background(), account4))
+
+	// No user holds the owner role, so the owner lookup itself fails.
+	account5 := newAccountWithId(context.Background(), "account5", "account5Admin", "", "", "", false)
+	account5.Users["account5Admin"].Role = types.UserRoleAdmin
+	account5.Users["pending-user-without-owner"] = &types.User{
+		Id:              "pending-user-without-owner",
+		AccountID:       account5.Id,
+		Role:            types.UserRoleUser,
+		Blocked:         true,
+		PendingApproval: true,
+	}
+	require.NoError(t, store.SaveAccount(context.Background(), account5))
+
+	account6 := newAccountWithId(context.Background(), "account6", "account6Owner", "", "stranger@example.com", "", false)
+	require.NoError(t, store.SaveAccount(context.Background(), account6))
+
 	permissionsManager := permissions.NewManager(store)
 	am := DefaultAccountManager{
 		Store:              store,
@@ -1723,6 +1852,34 @@ func TestDefaultAccountManager_GetCurrentUserInfo(t *testing.T) {
 			userAuth:    auth.UserAuth{AccountId: account1.Id, UserId: "service-user"},
 			expectedErr: status.NewPermissionDeniedError(),
 		},
+		{
+			name:        "pending approval names the owner",
+			userAuth:    auth.UserAuth{AccountId: account3.Id, UserId: "pending-user"},
+			expectedErr: status.NewUserPendingApprovalByOwnerError("ow****r@example.com"),
+		},
+		{
+			name:        "pending approval without an owner address",
+			userAuth:    auth.UserAuth{AccountId: account4.Id, UserId: "pending-user-without-owner-email"},
+			expectedErr: status.NewUserPendingApprovalError(),
+		},
+		{
+			name:        "pending approval without an owner",
+			userAuth:    auth.UserAuth{AccountId: account5.Id, UserId: "pending-user-without-owner"},
+			expectedErr: status.NewUserPendingApprovalError(),
+		},
+		{
+			// The account claim points at an account the caller is not in. The
+			// owner named has to be the one of the account holding the caller's
+			// own record, never the one the claim asks for.
+			name:        "pending approval ignores a mismatched account claim",
+			userAuth:    auth.UserAuth{AccountId: account6.Id, UserId: "pending-user"},
+			expectedErr: status.NewUserPendingApprovalByOwnerError("ow****r@example.com"),
+		},
+		{
+			name:        "blocked user answers before the account claim is validated",
+			userAuth:    auth.UserAuth{AccountId: account6.Id, UserId: "blocked-user"},
+			expectedErr: status.NewUserBlockedError(),
+		},
 		{
 			name:     "owner user",
 			userAuth: auth.UserAuth{AccountId: account1.Id, UserId: "account1Owner"},
diff --git a/management/server/util/util.go b/management/server/util/util.go
index 617484274..38cd3de58 100644
--- a/management/server/util/util.go
+++ b/management/server/util/util.go
@@ -1,5 +1,20 @@
 package util
 
+import (
+	"crypto/rand"
+	"math/big"
+)
+
+// RandIntn returns a uniformly distributed int in [0, n) sourced from
+// crypto/rand. It panics if n <= 0 or the platform randomness source fails.
+func RandIntn(n int) int {
+	v, err := rand.Int(rand.Reader, big.NewInt(int64(n)))
+	if err != nil {
+		panic(err)
+	}
+	return int(v.Int64())
+}
+
 // Difference returns the elements in `a` that aren't in `b`.
 func Difference(a, b []string) []string {
 	mb := make(map[string]struct{}, len(b))
@@ -19,34 +34,3 @@ func Difference(a, b []string) []string {
 func ToPtr[T any](value T) *T {
 	return &value
 }
-
-type comparableObject[T any] interface {
-	Equal(other T) bool
-}
-
-func MergeUnique[T comparableObject[T]](arr1, arr2 []T) []T {
-	var result []T
-
-	for _, item := range arr1 {
-		if !contains(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	for _, item := range arr2 {
-		if !contains(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	return result
-}
-
-func contains[T comparableObject[T]](slice []T, element T) bool {
-	for _, item := range slice {
-		if item.Equal(element) {
-			return true
-		}
-	}
-	return false
-}
diff --git a/management/server/util/util_test.go b/management/server/util/util_test.go
deleted file mode 100644
index 5c928b369..000000000
--- a/management/server/util/util_test.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package util
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-type testObject struct {
-	value int
-}
-
-func (t testObject) Equal(other testObject) bool {
-	return t.value == other.value
-}
-
-func Test_MergeUniqueArraysWithoutDuplicates(t *testing.T) {
-	arr1 := []testObject{{value: 1}, {value: 2}}
-	arr2 := []testObject{{value: 2}, {value: 3}}
-	result := MergeUnique(arr1, arr2)
-	assert.Len(t, result, 3)
-	assert.Contains(t, result, testObject{value: 1})
-	assert.Contains(t, result, testObject{value: 2})
-	assert.Contains(t, result, testObject{value: 3})
-}
-
-func Test_MergeUniqueHandlesEmptyArrays(t *testing.T) {
-	arr1 := []testObject{}
-	arr2 := []testObject{}
-	result := MergeUnique(arr1, arr2)
-	assert.Empty(t, result)
-}
-
-func Test_MergeUniqueHandlesOneEmptyArray(t *testing.T) {
-	arr1 := []testObject{{value: 1}, {value: 2}}
-	arr2 := []testObject{}
-	result := MergeUnique(arr1, arr2)
-	assert.Len(t, result, 2)
-	assert.Contains(t, result, testObject{value: 1})
-	assert.Contains(t, result, testObject{value: 2})
-}
diff --git a/proxy/Dockerfile b/proxy/Dockerfile
index 22c4cbfaa..5944d944e 100644
--- a/proxy/Dockerfile
+++ b/proxy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26.7-alpine AS builder
 WORKDIR /app
 
 RUN echo "netbird:x:1000:1000:netbird:/var/lib/netbird:/sbin/nologin" > /tmp/passwd && \
diff --git a/proxy/Dockerfile.multistage b/proxy/Dockerfile.multistage
index 01e342c0e..d1db32296 100644
--- a/proxy/Dockerfile.multistage
+++ b/proxy/Dockerfile.multistage
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26.7-alpine AS builder
 WORKDIR /app
 
 COPY go.mod go.sum ./
@@ -10,10 +10,12 @@ COPY encryption ./encryption
 COPY flow ./flow
 COPY formatter ./formatter
 COPY monotime ./monotime
+COPY management ./management
 COPY proxy ./proxy
 COPY route ./route
 COPY shared ./shared
 COPY sharedsock ./sharedsock
+COPY trustedproxy ./trustedproxy
 COPY upload-server ./upload-server
 COPY util ./util
 COPY version ./version
diff --git a/proxy/Dockerfile.ubi b/proxy/Dockerfile.ubi
new file mode 100644
index 000000000..a74280a49
--- /dev/null
+++ b/proxy/Dockerfile.ubi
@@ -0,0 +1,32 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-reverse-proxy" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Reverse Proxy" \
+      description="NetBird Reverse Proxy provides an identity-aware entrypoint to services in NetBird networks."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-proxy /go/bin/netbird-proxy
+COPY licenses/ /licenses/
+# Only the writable directories share the root group for arbitrary non-root UIDs.
+# Runtime-created private keys retain the application's restrictive file modes.
+RUN mkdir -p /var/lib/netbird /certs && \
+    chown 1000:0 /var/lib/netbird /certs && \
+    chmod 0770 /var/lib/netbird /certs && \
+    chmod -R a+rX /licenses
+
+USER 1000:0
+ENV HOME=/var/lib/netbird
+ENV NB_PROXY_ADDRESS=":8443"
+# Unprivileged ports: runtimes such as OpenShift and Podman keep the kernel
+# default that reserves ports below 1024 for root. 8080 is the health probe.
+ENV NB_PROXY_ACME_ADDRESS=":8081"
+EXPOSE 8443
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/go/bin/netbird-proxy"]
diff --git a/proxy/README.md b/proxy/README.md
index 6af7cadd2..47079ba0a 100644
--- a/proxy/README.md
+++ b/proxy/README.md
@@ -33,6 +33,43 @@ If any authentication methods are registered for the Host domain, then the Proxy
 If the user is successfully authenticated, their request will be forwarded through to the Proxy to be proxied to the relevant Peer.
 Successful authentication does not guarantee a successful forwarding of the request as there may be failures behind the Proxy, such as with Peer connectivity or the underlying resource.
 
+### Target access control
+
+HTTP targets have an optional `access_action` setting, configured under
+**Edit Target → Optional Settings → Access** in the dashboard:
+
+| Value | Behavior |
+| --- | --- |
+| `inherit` | Use the service's authentication settings. This is the default. A service without authentication remains public. |
+| `bypass` | Forward anonymously without prompting for service authentication. |
+| `block` | Return HTTP 403, including for authenticated users. |
+
+The longest matching Location prefix selects both the target and its access
+action. Prefixes are literal and case-sensitive: `/api` also matches `/apiv2`,
+while `/api/` only matches requests beginning with `/api/` and does not match
+`/api` itself. Wildcards and regular expressions are not supported. A blocked
+request or failed authentication never falls through to another target. Disabling
+or deleting a target removes its rule, so a less-specific target may then match.
+
+Service IP, country, and reputation restrictions still apply to bypassed paths.
+Bypass is unavailable for private services and Agent Network targets. Bypassed
+requests have no NetBird user identity; configured header-auth credentials,
+NetBird session cookies, and client-supplied NetBird identity headers are still
+removed before forwarding. Custom upstream headers remain target settings, so
+consider their effect when making a target public.
+
+Services using target access overrides reject ambiguous request paths, including
+encoded separators and traversal segments, before forwarding. Path rewriting
+continues to use the selected Location prefix after access checks.
+
+Upgrade all proxies before using target access actions. Older proxies ignore
+these actions and continue applying the service's authentication settings.
+API updates that omit an existing Location's
+`access_action` preserve its setting; send `"access_action": "inherit"` explicitly
+to restore service authentication. Requests omitting all access actions cannot
+remove or rename a controlled Location; use an updated client and explicitly
+include the intended actions when changing those targets.
+
 ## TLS
 
 Due to the authentication provided, the Proxy uses HTTPS for its endpoint, even if the underlying service is HTTP.
diff --git a/proxy/auth/auth.go b/proxy/auth/auth.go
index 78f0097d5..605780959 100644
--- a/proxy/auth/auth.go
+++ b/proxy/auth/auth.go
@@ -30,6 +30,20 @@ const (
 	SessionJWTIssuer     = "netbird-management"
 )
 
+// Query parameters management uses to hand the OIDC session to the proxy. The
+// proxy strips them before forwarding, so they must not collide with names the
+// proxied service uses itself.
+const (
+	SessionCodeQueryParam  = "nb_session_code"
+	SessionTokenQueryParam = "session_token"
+)
+
+// HeaderUserID is the synthetic user id recorded for header-authenticated
+// requests. Header auth validates a per-service secret and resolves no user
+// record, so proxy access logs and management-minted session tokens both
+// attribute the request to this id.
+const HeaderUserID = "header-user"
+
 // ResolveProto determines the protocol scheme based on the forwarded proto
 // configuration. When set to "http" or "https" the value is used directly.
 // Otherwise TLS state is used: if conn is non-nil "https" is returned, else "http".
@@ -60,7 +74,7 @@ func ValidateSessionJWT(tokenString, domain string, publicKey ed25519.PublicKey)
 			return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
 		}
 		return publicKey, nil
-	}, jwt.WithAudience(domain), jwt.WithIssuer(SessionJWTIssuer))
+	}, jwt.WithAudience(domain), jwt.WithIssuer(SessionJWTIssuer), jwt.WithStrictDecoding())
 	if err != nil {
 		return "", "", "", nil, nil, fmt.Errorf("parse token: %w", err)
 	}
diff --git a/proxy/cmd/proxy/cmd/root.go b/proxy/cmd/proxy/cmd/root.go
index ad8e1b7c0..5734efe4e 100644
--- a/proxy/cmd/proxy/cmd/root.go
+++ b/proxy/cmd/proxy/cmd/root.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/signal"
 	"strconv"
+	"strings"
 	"syscall"
 	"time"
 
@@ -13,11 +14,14 @@ import (
 	"github.com/spf13/cobra"
 	"golang.org/x/crypto/acme"
 
+	"github.com/netbirdio/netbird/shared/externalipmap"
 	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/profiling"
 
 	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy"
 	nbacme "github.com/netbirdio/netbird/proxy/internal/acme"
+	"github.com/netbirdio/netbird/trustedproxy"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -29,6 +33,8 @@ const (
 	// how many buffers each receive/TUN worker eagerly allocates. Zero
 	// (unset) keeps the platform default.
 	envMaxBatchSize = "NB_PROXY_MAX_BATCH_SIZE"
+
+	applicationName = "proxy"
 )
 
 const DefaultManagementURL = "https://api.netbird.io:443"
@@ -70,6 +76,7 @@ var (
 	certLockMethod        string
 	wildcardCertDir       string
 	wgPort                uint16
+	externalIPMap         []string
 	proxyProtocol         bool
 	preSharedKey          string
 	supportsCustomPorts   bool
@@ -113,6 +120,7 @@ func init() {
 	rootCmd.Flags().StringVar(&certLockMethod, "cert-lock-method", envStringOrDefault("NB_PROXY_CERT_LOCK_METHOD", "auto"), "Certificate lock method for cross-replica coordination: auto, flock, or k8s-lease")
 	rootCmd.Flags().StringVar(&wildcardCertDir, "wildcard-cert-dir", envStringOrDefault("NB_PROXY_WILDCARD_CERT_DIR", ""), "Directory containing wildcard certificate pairs (<name>.crt/<name>.key). Wildcard patterns are extracted from SANs automatically")
 	rootCmd.Flags().Uint16Var(&wgPort, "wg-port", envUint16OrDefault("NB_PROXY_WG_PORT", 0), "WireGuard listen port (0 = random). Fixed port only works with single-account deployments")
+	rootCmd.Flags().StringSliceVar(&externalIPMap, "external-ip-map", envStringSliceOrDefault("NB_PROXY_EXTERNAL_IP_MAP", nil), "Comma-separated external IPs to advertise as ICE candidates, as IP or IP/internal-IP-or-interface (e.g. '203.0.113.5/10.0.0.5'). Requires a fixed --wg-port forwarded on the NAT")
 	rootCmd.Flags().BoolVar(&proxyProtocol, "proxy-protocol", envBoolOrDefault("NB_PROXY_PROXY_PROTOCOL", false), "Enable PROXY protocol on TCP listeners to preserve client IPs behind L4 proxies")
 	rootCmd.Flags().StringVar(&preSharedKey, "preshared-key", envStringOrDefault("NB_PROXY_PRESHARED_KEY", ""), "Define a pre-shared key for the tunnel between proxy and peers")
 	rootCmd.Flags().BoolVar(&supportsCustomPorts, "supports-custom-ports", envBoolOrDefault("NB_PROXY_SUPPORTS_CUSTOM_PORTS", true), "Whether the proxy can bind arbitrary ports for UDP/TCP passthrough")
@@ -159,6 +167,9 @@ func runServer(cmd *cobra.Command, args []string) error {
 
 	logger.Infof("configured log level: %s", level)
 
+	stopProfiling := profiling.Start(applicationName)
+	defer stopProfiling()
+
 	var wgPool, wgBatch uint64
 	var perf embed.Performance
 	if raw := os.Getenv(envPreallocatedBuffers); raw != "" {
@@ -209,11 +220,18 @@ func runServer(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("invalid domain value %q: %w", proxyDomain, err)
 	}
 
-	parsedTrustedProxies, err := proxy.ParseTrustedProxies(trustedProxies)
+	parsedTrustedProxies, err := trustedproxy.Parse(trustedProxies)
 	if err != nil {
 		return fmt.Errorf("invalid --trusted-proxies: %w", err)
 	}
 
+	for i := range externalIPMap {
+		externalIPMap[i] = strings.TrimSpace(externalIPMap[i])
+	}
+	if err := externalipmap.Validate(externalIPMap); err != nil {
+		return fmt.Errorf("invalid --external-ip-map: %w", err)
+	}
+
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
 	defer stop()
 
@@ -241,6 +259,7 @@ func runServer(cmd *cobra.Command, args []string) error {
 		CertLockMethod:           nbacme.CertLockMethod(certLockMethod),
 		WildcardCertDir:          wildcardCertDir,
 		WireguardPort:            wgPort,
+		NATExternalIPs:           externalIPMap,
 		Performance:              perf,
 		ProxyProtocol:            proxyProtocol,
 		PreSharedKey:             preSharedKey,
@@ -279,6 +298,14 @@ func envStringOrDefault(key string, def string) string {
 	return v
 }
 
+func envStringSliceOrDefault(key string, def []string) []string {
+	v, exists := os.LookupEnv(key)
+	if !exists || v == "" {
+		return def
+	}
+	return strings.Split(v, ",")
+}
+
 func envUint16OrDefault(key string, def uint16) uint16 {
 	v, exists := os.LookupEnv(key)
 	if !exists {
diff --git a/proxy/cmd/proxy/main.go b/proxy/cmd/proxy/main.go
index 16e7e8ac2..6851c6cfc 100644
--- a/proxy/cmd/proxy/main.go
+++ b/proxy/cmd/proxy/main.go
@@ -4,6 +4,7 @@ import (
 	"net/http"
 	// nolint:gosec
 	_ "net/http/pprof"
+	"os"
 	"runtime"
 
 	log "github.com/sirupsen/logrus"
@@ -26,9 +27,13 @@ var (
 )
 
 func main() {
-	go func() {
-		log.Println(http.ListenAndServe("localhost:6060", nil))
-	}()
+	if pprofAddr := os.Getenv("NB_PPROF_ADDR"); pprofAddr != "" {
+		log.Infof("pprof enabled, listening on: %s", pprofAddr)
+		go func() {
+			log.Println(http.ListenAndServe(pprofAddr, nil))
+		}()
+	}
+
 	cmd.SetVersionInfo(Version, Commit, BuildDate, GoVersion)
 	cmd.Execute()
 }
diff --git a/proxy/internal/accesslog/logger.go b/proxy/internal/accesslog/logger.go
index db868b4e0..a438f42d2 100644
--- a/proxy/internal/accesslog/logger.go
+++ b/proxy/internal/accesslog/logger.go
@@ -16,6 +16,7 @@ import (
 	"github.com/netbirdio/netbird/proxy/auth"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 const (
@@ -66,7 +67,7 @@ type denyBucket struct {
 type Logger struct {
 	client         gRPCClient
 	logger         *log.Logger
-	trustedProxies []netip.Prefix
+	trustedProxies *trustedproxy.List
 
 	usageMux    sync.Mutex
 	domainUsage map[string]*domainUsage
@@ -82,7 +83,7 @@ type Logger struct {
 // NewLogger creates a new access log Logger. The trustedProxies parameter
 // configures which upstream proxy IP ranges are trusted for extracting
 // the real client IP from X-Forwarded-For headers.
-func NewLogger(client gRPCClient, logger *log.Logger, trustedProxies []netip.Prefix) *Logger {
+func NewLogger(client gRPCClient, logger *log.Logger, trustedProxies *trustedproxy.List) *Logger {
 	if logger == nil {
 		logger = log.StandardLogger()
 	}
@@ -220,14 +221,21 @@ func (l *Logger) allowDenyLog(serviceID types.ServiceID, reason string) bool {
 // proxy/internal/middleware/keys.go — only the dimensions management needs to
 // record a usage row (provider / model / tokens / cost / groups).
 var usageMetadataKeys = map[string]struct{}{
-	"llm.provider":             {},
-	"llm.model":                {},
-	"llm.resolved_provider_id": {},
-	"llm.input_tokens":         {},
-	"llm.output_tokens":        {},
-	"llm.total_tokens":         {},
-	"cost.usd_total":           {},
-	"llm.authorising_groups":   {},
+	"llm.provider":              {},
+	"llm.model":                 {},
+	"llm.resolved_provider_id":  {},
+	"llm.input_tokens":          {},
+	"llm.output_tokens":         {},
+	"llm.total_tokens":          {},
+	"llm.cached_input_tokens":   {},
+	"llm.cache_creation_tokens": {},
+	"cost.usd_input":            {},
+	"cost.usd_cached_input":     {},
+	"cost.usd_cache_creation":   {},
+	"cost.usd_output":           {},
+	"cost.usd_total":            {},
+	"cost.usd_cache":            {},
+	"llm.authorising_groups":    {},
 }
 
 // stripAgentNetworkEntryForUsage returns the entry reduced to what's needed to
diff --git a/proxy/internal/accesslog/requestip.go b/proxy/internal/accesslog/requestip.go
index 30c483fd9..71cea85d0 100644
--- a/proxy/internal/accesslog/requestip.go
+++ b/proxy/internal/accesslog/requestip.go
@@ -4,13 +4,13 @@ import (
 	"net/http"
 	"net/netip"
 
-	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 // extractSourceIP resolves the real client IP from the request using trusted
 // proxy configuration. When trustedProxies is non-empty and the direct
 // connection is from a trusted source, it walks X-Forwarded-For right-to-left
 // skipping trusted IPs. Otherwise it returns RemoteAddr directly.
-func extractSourceIP(r *http.Request, trustedProxies []netip.Prefix) netip.Addr {
-	return proxy.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For"), trustedProxies)
+func extractSourceIP(r *http.Request, trustedProxies *trustedproxy.List) netip.Addr {
+	return trustedProxies.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For"))
 }
diff --git a/proxy/internal/acme/locker.go b/proxy/internal/acme/locker.go
index 2f0f18885..f42324736 100644
--- a/proxy/internal/acme/locker.go
+++ b/proxy/internal/acme/locker.go
@@ -2,12 +2,14 @@ package acme
 
 import (
 	"context"
+	"fmt"
 	"path/filepath"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/proxy/internal/flock"
 	"github.com/netbirdio/netbird/proxy/internal/k8s"
+	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 // certLocker provides distributed mutual exclusion for certificate operations.
@@ -74,9 +76,15 @@ func newFlockLocker(certDir string, logger *log.Logger) *flockLocker {
 	return &flockLocker{certDir: certDir, logger: logger}
 }
 
-// Lock acquires an advisory file lock for the given domain.
-func (l *flockLocker) Lock(ctx context.Context, domain string) (func(), error) {
-	lockPath := filepath.Join(l.certDir, domain+".lock")
+// Lock acquires an advisory file lock for the given domain. The domain must
+// be a valid hostname so the lock file always resolves to a direct child of
+// certDir; anything else is rejected before touching the filesystem.
+func (l *flockLocker) Lock(ctx context.Context, name string) (func(), error) {
+	if !domain.IsValidDomainNoWildcard(name) {
+		return nil, fmt.Errorf("invalid domain %q for lock file", name)
+	}
+
+	lockPath := filepath.Join(l.certDir, name+".lock")
 	lockFile, err := flock.Lock(ctx, lockPath)
 	if err != nil {
 		return nil, err
@@ -89,7 +97,7 @@ func (l *flockLocker) Lock(ctx context.Context, domain string) (func(), error) {
 
 	return func() {
 		if err := flock.Unlock(lockFile); err != nil {
-			l.logger.Debugf("release cert lock for domain %q: %v", domain, err)
+			l.logger.Debugf("release cert lock for domain %q: %v", name, err)
 		}
 	}, nil
 }
diff --git a/proxy/internal/acme/locker_test.go b/proxy/internal/acme/locker_test.go
index 39245df0c..f131f64f3 100644
--- a/proxy/internal/acme/locker_test.go
+++ b/proxy/internal/acme/locker_test.go
@@ -63,3 +63,33 @@ func TestNewCertLockerK8sFallsBackToFlock(t *testing.T) {
 	_, ok := locker.(*flockLocker)
 	assert.True(t, ok, "k8s-lease without SA should fall back to flockLocker")
 }
+
+func TestFlockLockerRejectsUnsafeDomain(t *testing.T) {
+	root := t.TempDir()
+	certDir := filepath.Join(root, "certs")
+	require.NoError(t, os.Mkdir(certDir, 0o700))
+	locker := newFlockLocker(certDir, nil)
+
+	for _, d := range []string{
+		"",
+		".",
+		"..",
+		"../escape",
+		"../../etc/cron.d/attacker",
+		"sub/dir.example.com",
+		`back\slash.example.com`,
+		"*.example.com",
+	} {
+		unlock, err := locker.Lock(context.Background(), d)
+		assert.Error(t, err, "domain %q", d)
+		assert.Nil(t, unlock, "domain %q", d)
+	}
+
+	assert.NoFileExists(t, filepath.Join(root, "escape.lock"))
+	certEntries, err := os.ReadDir(certDir)
+	require.NoError(t, err)
+	assert.Empty(t, certEntries)
+	rootEntries, err := os.ReadDir(root)
+	require.NoError(t, err)
+	assert.Len(t, rootEntries, 1)
+}
diff --git a/proxy/internal/auth/README.md b/proxy/internal/auth/README.md
new file mode 100644
index 000000000..5ebf75cee
--- /dev/null
+++ b/proxy/internal/auth/README.md
@@ -0,0 +1,26 @@
+# PIN and password authentication limits
+
+PIN and password credentials are accepted only in a POST form body. Query-string
+credentials and credentials on other HTTP methods are ignored.
+
+The proxy permits a burst of five credential checks per account and service,
+then replenishes one check every six seconds (ten per minute). PIN and password
+checks share the same budget. Five failed checks from one client IP in a
+rolling five-minute window block that source for fifteen minutes. In-flight checks
+reserve failure slots; blocked requests do not extend the cooldown. Successful
+authentication clears that source's failure history. Infrastructure failures
+consume the service budget without counting as incorrect credentials.
+
+Throttled requests return HTTP 429 with a `Retry-After` delay in seconds. The
+login page displays that delay. Existing authenticated sessions and other
+authentication methods do not consume these credential budgets.
+
+The client IP comes from the existing trusted-proxy resolution. Deployments
+behind a load balancer must configure trusted proxies correctly; otherwise
+visitors share the load balancer's source budget. Visitors behind the same NAT
+also share a source budget for a service.
+
+State is held in memory per proxy process and resets on restart. Multiple
+replicas have independent budgets. State is bounded to 16,384 source entries and
+4,096 service entries; when capacity is exhausted, new checks are denied until
+idle entries expire. Active blocks are never evicted to admit a new source.
diff --git a/proxy/internal/auth/credential.go b/proxy/internal/auth/credential.go
new file mode 100644
index 000000000..0e93891fb
--- /dev/null
+++ b/proxy/internal/auth/credential.go
@@ -0,0 +1,100 @@
+package auth
+
+import (
+	"errors"
+	"math"
+	"net/http"
+	"strconv"
+	"time"
+
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+)
+
+var errCredentialClientIP = errors.New("invalid client address")
+
+type credentialLimitError struct {
+	retryAfter time.Duration
+}
+
+func (e *credentialLimitError) Error() string {
+	return "too many authentication attempts"
+}
+
+func credentialFormValue(r *http.Request, field string) string {
+	if r.Method != http.MethodPost {
+		return ""
+	}
+	return r.PostFormValue(field)
+}
+
+func (mw *Middleware) authenticateScheme(r *http.Request, config DomainConfig, scheme Scheme) (string, string, error) {
+	method := scheme.Type()
+	if (method != auth.MethodPIN && method != auth.MethodPassword) || !wasCredentialSubmitted(r, method) {
+		return scheme.Authenticate(r)
+	}
+	ip := mw.resolveClientIP(r).Unmap()
+	if !ip.IsValid() {
+		return "", "", errCredentialClientIP
+	}
+	source, retry := mw.credentials.begin(credentialSourceKey{
+		service: credentialServiceKey{accountID: config.AccountID, serviceID: config.ServiceID},
+		ip:      ip,
+	})
+	if retry > 0 {
+		return "", "", &credentialLimitError{retryAfter: retry}
+	}
+	token, prompt, err := scheme.Authenticate(r)
+	outcome := credentialUnavailable
+	if err == nil {
+		outcome = credentialRejected
+		if token != "" {
+			outcome = credentialAccepted
+		}
+	}
+	mw.credentials.finish(source, outcome)
+	return token, prompt, err
+}
+
+func credentialRetryAfter(err error) time.Duration {
+	var limitErr *credentialLimitError
+	if errors.As(err, &limitErr) {
+		return limitErr.retryAfter
+	}
+	s := status.Convert(err)
+	if s.Code() != codes.ResourceExhausted {
+		return 0
+	}
+	for _, detail := range s.Details() {
+		if info, ok := detail.(*errdetails.RetryInfo); ok && info.RetryDelay != nil && info.RetryDelay.CheckValid() == nil {
+			if delay := info.RetryDelay.AsDuration(); delay > 0 {
+				return delay
+			}
+		}
+	}
+	return credentialCheckInterval
+}
+
+func (mw *Middleware) writeAuthenticationError(w http.ResponseWriter, r *http.Request, method auth.Method, err error) {
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetOrigin(proxy.OriginAuth)
+		cd.SetAuthMethod(method.String())
+	}
+	if retry := credentialRetryAfter(err); retry > 0 {
+		// RFC 6585 section 4 forbids caching 429 responses.
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Retry-After", strconv.FormatInt(int64(math.Ceil(retry.Seconds())), 10))
+		http.Error(w, "too many authentication attempts; try again later", http.StatusTooManyRequests)
+		return
+	}
+	if errors.Is(err, errCredentialClientIP) {
+		http.Error(w, "invalid client address", http.StatusBadRequest)
+		return
+	}
+	mw.logger.WithField("scheme", method.String()).Warnf("authentication infrastructure error: %v", err)
+	http.Error(w, "authentication service unavailable", http.StatusBadGateway)
+}
diff --git a/proxy/internal/auth/credential_limiter.go b/proxy/internal/auth/credential_limiter.go
new file mode 100644
index 000000000..be9e70413
--- /dev/null
+++ b/proxy/internal/auth/credential_limiter.go
@@ -0,0 +1,169 @@
+package auth
+
+import (
+	"net/netip"
+	"sync"
+	"time"
+
+	"golang.org/x/time/rate"
+
+	"github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+const (
+	credentialFailureLimit    = 5
+	credentialFailureWindow   = 5 * time.Minute
+	credentialBlockDuration   = 15 * time.Minute
+	credentialCheckInterval   = 6 * time.Second
+	credentialCheckBurst      = 5
+	credentialMaxSources      = 16384
+	credentialMaxServices     = 4096
+	credentialCleanupInterval = time.Minute
+)
+
+type credentialServiceKey struct {
+	accountID types.AccountID
+	serviceID types.ServiceID
+}
+
+type credentialSourceKey struct {
+	service credentialServiceKey
+	ip      netip.Addr
+}
+
+type credentialSource struct {
+	failures     []time.Time
+	pending      int
+	expiresAt    time.Time
+	blockedUntil time.Time
+}
+
+type credentialService struct {
+	limiter  *rate.Limiter
+	lastUsed time.Time
+}
+
+type credentialOutcome string
+
+const (
+	credentialUnavailable credentialOutcome = "unavailable"
+	credentialRejected    credentialOutcome = "rejected"
+	credentialAccepted    credentialOutcome = "accepted"
+)
+
+// State is local to this proxy process. Active blocks are never evicted to
+// make room for a new source; exhausting capacity denies new checks.
+type credentialLimiter struct {
+	mu          sync.Mutex
+	now         func() time.Time
+	sources     map[credentialSourceKey]*credentialSource
+	services    map[credentialServiceKey]*credentialService
+	nextCleanup time.Time
+}
+
+func newCredentialLimiter() *credentialLimiter {
+	return &credentialLimiter{
+		now:      time.Now,
+		sources:  make(map[credentialSourceKey]*credentialSource),
+		services: make(map[credentialServiceKey]*credentialService),
+	}
+}
+
+func (l *credentialLimiter) begin(key credentialSourceKey) (*credentialSource, time.Duration) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	now := l.now()
+	l.cleanup(now)
+	source := l.sources[key]
+	if source != nil {
+		if now.Before(source.blockedUntil) {
+			return nil, source.blockedUntil.Sub(now)
+		}
+		if source.pending == 0 && !now.Before(source.expiresAt) {
+			*source = credentialSource{}
+		}
+		source.expireFailures(now)
+		// Reserve the failure budget before verification so concurrent guesses
+		// cannot all pass a check against the same completed failure count.
+		if len(source.failures)+source.pending >= credentialFailureLimit {
+			return nil, time.Second
+		}
+	} else if len(l.sources) >= credentialMaxSources {
+		return nil, credentialCleanupInterval
+	}
+	if retry := l.allowService(key.service, now); retry > 0 {
+		return nil, retry
+	}
+	if source == nil {
+		source = &credentialSource{}
+		l.sources[key] = source
+	}
+	if source.expiresAt.IsZero() {
+		source.expiresAt = now.Add(credentialFailureWindow)
+	}
+	source.pending++
+	return source, 0
+}
+
+func (l *credentialLimiter) allowService(key credentialServiceKey, now time.Time) time.Duration {
+	service := l.services[key]
+	if service == nil {
+		if len(l.services) >= credentialMaxServices {
+			return credentialCleanupInterval
+		}
+		service = &credentialService{limiter: rate.NewLimiter(rate.Every(credentialCheckInterval), credentialCheckBurst)}
+		l.services[key] = service
+	}
+	service.lastUsed = now
+	if service.limiter.AllowN(now, 1) {
+		return 0
+	}
+	return max(time.Nanosecond, time.Duration((1-service.limiter.TokensAt(now))*float64(credentialCheckInterval)))
+}
+
+func (l *credentialLimiter) finish(source *credentialSource, outcome credentialOutcome) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	source.pending--
+	now := l.now()
+	source.expireFailures(now)
+	switch outcome {
+	case credentialRejected:
+		source.failures = append(source.failures, now)
+		source.expiresAt = now.Add(credentialFailureWindow)
+		if len(source.failures) >= credentialFailureLimit && source.blockedUntil.IsZero() {
+			source.blockedUntil = now.Add(credentialBlockDuration)
+			source.expiresAt = source.blockedUntil
+		}
+	case credentialAccepted:
+		if !now.Before(source.blockedUntil) {
+			source.failures = nil
+			source.expiresAt = now.Add(credentialFailureWindow)
+		}
+	case credentialUnavailable:
+		// Transport failures consume the service budget, but are not bad guesses.
+	}
+}
+
+func (s *credentialSource) expireFailures(now time.Time) {
+	for len(s.failures) > 0 && !now.Before(s.failures[0].Add(credentialFailureWindow)) {
+		s.failures = s.failures[1:]
+	}
+}
+
+func (l *credentialLimiter) cleanup(now time.Time) {
+	if now.Before(l.nextCleanup) {
+		return
+	}
+	l.nextCleanup = now.Add(credentialCleanupInterval)
+	for key, source := range l.sources {
+		if source.pending == 0 && !now.Before(source.expiresAt) {
+			delete(l.sources, key)
+		}
+	}
+	for key, service := range l.services {
+		if now.Sub(service.lastUsed) >= credentialBlockDuration {
+			delete(l.services, key)
+		}
+	}
+}
diff --git a/proxy/internal/auth/credential_limiter_test.go b/proxy/internal/auth/credential_limiter_test.go
new file mode 100644
index 000000000..dfa346baf
--- /dev/null
+++ b/proxy/internal/auth/credential_limiter_test.go
@@ -0,0 +1,190 @@
+package auth
+
+import (
+	"net/netip"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+func TestCredentialLimiterCooldown(t *testing.T) {
+	l := newCredentialLimiter()
+	now := time.Now()
+	l.now = func() time.Time { return now }
+	key := credentialSourceKey{service: credentialServiceKey{"account", "service"}, ip: netip.MustParseAddr("192.0.2.1")}
+	for range credentialFailureLimit {
+		attempt, retry := l.begin(key)
+		require.Zero(t, retry, "initial guesses must reach verification")
+		l.finish(attempt, credentialRejected)
+	}
+	_, retry := l.begin(key)
+	assert.Equal(t, credentialBlockDuration, retry, "five failures must start a fifteen-minute block")
+	now = now.Add(credentialBlockDuration - time.Second)
+	_, retry = l.begin(key)
+	assert.Equal(t, time.Second, retry, "blocked requests must not extend the deadline")
+	now = now.Add(time.Second)
+	attempt, retry := l.begin(key)
+	require.Zero(t, retry, "the source must recover when its block expires")
+	l.finish(attempt, credentialAccepted)
+}
+
+func TestCredentialLimiterFailureWindowAndSuccess(t *testing.T) {
+	for _, outcome := range []credentialOutcome{credentialAccepted, credentialUnavailable} {
+		t.Run(map[credentialOutcome]string{credentialAccepted: "success", credentialUnavailable: "infrastructure error"}[outcome], func(t *testing.T) {
+			l := newCredentialLimiter()
+			now := time.Now()
+			l.now = func() time.Time { return now }
+			key := credentialSourceKey{service: credentialServiceKey{"account", "service"}, ip: netip.MustParseAddr("192.0.2.1")}
+			for range 4 {
+				attempt, retry := l.begin(key)
+				require.Zero(t, retry, "four failures must fit the budget")
+				l.finish(attempt, credentialRejected)
+			}
+			attempt, retry := l.begin(key)
+			require.Zero(t, retry, "fifth check must be allowed")
+			l.finish(attempt, outcome)
+			now = now.Add(credentialCheckInterval)
+			attempt, retry = l.begin(key)
+			require.Zero(t, retry, "success or infrastructure error must not start a block")
+			l.finish(attempt, credentialRejected)
+			now = now.Add(credentialCheckInterval)
+			attempt, retry = l.begin(key)
+			if outcome == credentialUnavailable {
+				assert.Greater(t, retry, time.Duration(0), "infrastructure errors must preserve earlier failures")
+				return
+			}
+			require.Zero(t, retry, "success must clear earlier failures")
+			l.finish(attempt, credentialRejected)
+			now = now.Add(credentialFailureWindow)
+			for range credentialFailureLimit {
+				attempt, retry = l.begin(key)
+				require.Zero(t, retry, "old failures must expire")
+				l.finish(attempt, credentialRejected)
+			}
+		})
+	}
+}
+
+func TestCredentialLimiterRollingWindow(t *testing.T) {
+	l := newCredentialLimiter()
+	now := time.Now()
+	l.now = func() time.Time { return now }
+	key := credentialSourceKey{service: credentialServiceKey{"account", "service"}, ip: netip.MustParseAddr("192.0.2.1")}
+	attempt, retry := l.begin(key)
+	require.Zero(t, retry, "the first failure starts the history")
+	l.finish(attempt, credentialRejected)
+	now = now.Add(4 * time.Minute)
+	for range 3 {
+		attempt, retry = l.begin(key)
+		require.Zero(t, retry, "three more failures must fit the budget")
+		l.finish(attempt, credentialRejected)
+	}
+	now = now.Add(time.Minute + time.Second)
+	for range 2 {
+		attempt, retry = l.begin(key)
+		require.Zero(t, retry, "only the oldest failure must have expired")
+		l.finish(attempt, credentialRejected)
+	}
+	_, retry = l.begin(key)
+	assert.Equal(t, credentialBlockDuration, retry, "five recent failures must block even across the first window boundary")
+}
+
+func TestCredentialLimiterServiceBudget(t *testing.T) {
+	l := newCredentialLimiter()
+	now := time.Now()
+	l.now = func() time.Time { return now }
+	key := credentialSourceKey{service: credentialServiceKey{"account", "service"}, ip: netip.MustParseAddr("192.0.2.1")}
+	for range credentialCheckBurst {
+		attempt, retry := l.begin(key)
+		require.Zero(t, retry, "initial checks must fit the service burst")
+		l.finish(attempt, credentialAccepted)
+		key.ip = key.ip.Next()
+	}
+	_, retry := l.begin(key)
+	assert.Equal(t, credentialCheckInterval, retry, "changing IP must not bypass the service budget")
+	other := key
+	other.service.accountID = "another-account"
+	attempt, retry := l.begin(other)
+	require.Zero(t, retry, "accounts must have separate budgets")
+	l.finish(attempt, credentialAccepted)
+	other = key
+	other.service.serviceID = "another-service"
+	attempt, retry = l.begin(other)
+	require.Zero(t, retry, "services must have separate budgets")
+	l.finish(attempt, credentialAccepted)
+	now = now.Add(credentialCheckInterval)
+	attempt, retry = l.begin(key)
+	require.Zero(t, retry, "one check must refill every six seconds")
+	l.finish(attempt, credentialAccepted)
+	_, retry = l.begin(key)
+	assert.Equal(t, credentialCheckInterval, retry, "refill must only grant one new check")
+}
+
+func TestCredentialLimiterConcurrentReservations(t *testing.T) {
+	l := newCredentialLimiter()
+	now := time.Now()
+	l.now = func() time.Time { return now }
+	key := credentialSourceKey{service: credentialServiceKey{"account", "service"}, ip: netip.MustParseAddr("192.0.2.1")}
+	var attempts []*credentialSource
+	for range credentialFailureLimit {
+		attempt, retry := l.begin(key)
+		require.Zero(t, retry, "initial requests must reserve the failure budget")
+		attempts = append(attempts, attempt)
+	}
+	// Refill the service budget while earlier verification calls are still running.
+	now = now.Add(time.Minute)
+	var admitted atomic.Int32
+	var wg sync.WaitGroup
+	for range 100 {
+		wg.Go(func() {
+			attempt, retry := l.begin(key)
+			if retry == 0 {
+				admitted.Add(1)
+				l.finish(attempt, credentialRejected)
+			}
+		})
+	}
+	wg.Wait()
+	assert.Zero(t, admitted.Load(), "in-flight guesses must reserve the failure budget despite a refilled service budget")
+	for _, attempt := range attempts {
+		wg.Go(func() { l.finish(attempt, credentialRejected) })
+	}
+	wg.Wait()
+	_, retry := l.begin(key)
+	assert.Equal(t, credentialBlockDuration, retry, "concurrent failures must activate the block")
+}
+
+func TestCredentialLimiterCapacityAndCleanup(t *testing.T) {
+	for _, fullSources := range []bool{true, false} {
+		t.Run(map[bool]string{true: "sources", false: "services"}[fullSources], func(t *testing.T) {
+			l := newCredentialLimiter()
+			now := time.Now()
+			l.now = func() time.Time { return now }
+			key := credentialSourceKey{service: credentialServiceKey{"account", "service"}, ip: netip.MustParseAddr("192.0.2.1")}
+			if fullSources {
+				ip := netip.MustParseAddr("198.18.0.1")
+				for range credentialMaxSources {
+					l.sources[credentialSourceKey{service: key.service, ip: ip}] = &credentialSource{expiresAt: now.Add(credentialBlockDuration), blockedUntil: now.Add(credentialBlockDuration)}
+					ip = ip.Next()
+				}
+			} else {
+				for i := range credentialMaxServices {
+					l.services[credentialServiceKey{serviceID: key.service.serviceID, accountID: types.AccountID(strconv.Itoa(i))}] = &credentialService{lastUsed: now}
+				}
+			}
+			_, retry := l.begin(key)
+			assert.Positive(t, retry, "full state must deny new checks without evicting active entries")
+			now = now.Add(credentialBlockDuration)
+			attempt, retry := l.begin(key)
+			require.Zero(t, retry, "expired state must release capacity")
+			l.finish(attempt, credentialAccepted)
+		})
+	}
+}
diff --git a/proxy/internal/auth/credential_test.go b/proxy/internal/auth/credential_test.go
new file mode 100644
index 000000000..cae2cff69
--- /dev/null
+++ b/proxy/internal/auth/credential_test.go
@@ -0,0 +1,196 @@
+package auth
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	servicemanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service/manager"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
+	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/server/store"
+	mgmttypes "github.com/netbirdio/netbird/management/server/types"
+	proxyauth "github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// localCredentialClient replaces the transport while keeping the real service
+// store, credential verification, and session signing.
+type localCredentialClient struct {
+	server *nbgrpc.ProxyServiceServer
+}
+
+func (c localCredentialClient) Authenticate(ctx context.Context, req *proto.AuthenticateRequest, _ ...grpc.CallOption) (*proto.AuthenticateResponse, error) {
+	return c.server.Authenticate(ctx, req)
+}
+
+func credentialHandler(t *testing.T, field string) (*Middleware, http.Handler) {
+	t.Helper()
+	ctx := context.Background()
+	s, err := store.NewStore(ctx, mgmttypes.SqliteStoreEngine, t.TempDir(), nil, false)
+	require.NoError(t, err)
+	t.Cleanup(func() { assert.NoError(t, s.Close(ctx)) })
+	require.NoError(t, s.SaveAccount(ctx, &mgmttypes.Account{Id: "account"}))
+	keys := generateTestKeyPair(t)
+	svc := &service.Service{
+		ID: "service", AccountID: "account", Name: "test", Domain: "example.com",
+		Enabled: true, SessionPrivateKey: keys.PrivateKey, SessionPublicKey: keys.PublicKey,
+		Auth: service.AuthConfig{
+			PinAuth:      &service.PINAuthConfig{Enabled: true, Pin: "842716"},
+			PasswordAuth: &service.PasswordAuthConfig{Enabled: true, Password: "842716"},
+		},
+	}
+	require.NoError(t, svc.Auth.HashSecrets())
+	require.NoError(t, s.CreateService(ctx, svc))
+	server := nbgrpc.NewProxyServiceServer(nil, nil, nil, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
+	t.Cleanup(server.Close)
+	server.SetServiceManager(servicemanager.NewManager(s, nil, nil, nil, nil, nil))
+	client := localCredentialClient{server: server}
+	var scheme Scheme = NewPin(client, "service", "account")
+	if field == "password" {
+		scheme = NewPassword(client, "service", "account")
+	}
+	mw := NewMiddleware(nil, nil, nil)
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, keys.PublicKey, time.Hour, "account", "service", nil, false, nil))
+	return mw, mw.Protect(newPassthroughHandler())
+}
+
+func credentialRequest(method, field, value string) *http.Request {
+	r := httptest.NewRequest(method, "https://example.com/", strings.NewReader(url.Values{field: {value}}.Encode()))
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	r.RemoteAddr = "198.51.100.25:12345"
+	return r
+}
+
+func TestCredentialAuthPOSTOnly(t *testing.T) {
+	for _, field := range []string{"pin", "password"} {
+		t.Run(field, func(t *testing.T) {
+			_, handler := credentialHandler(t, field)
+			for _, method := range []string{http.MethodGet, http.MethodPut, http.MethodPatch, http.MethodDelete, http.MethodPost} {
+				r := credentialRequest(method, field, "")
+				r.URL.RawQuery = url.Values{field: {"842716"}}.Encode()
+				resp := httptest.NewRecorder()
+				handler.ServeHTTP(resp, r)
+				assert.Equal(t, http.StatusUnauthorized, resp.Code, "%s query credentials must not authenticate", method)
+				assert.Empty(t, resp.Result().Cookies(), "query credentials must not issue a session")
+			}
+			for _, method := range []string{http.MethodGet, http.MethodPut, http.MethodPatch, http.MethodDelete} {
+				resp := httptest.NewRecorder()
+				handler.ServeHTTP(resp, credentialRequest(method, field, "842716"))
+				assert.Equal(t, http.StatusUnauthorized, resp.Code, "%s body credentials must not authenticate", method)
+			}
+			resp := httptest.NewRecorder()
+			handler.ServeHTTP(resp, credentialRequest(http.MethodPost, field, "842716"))
+			assert.Equal(t, http.StatusSeeOther, resp.Code, "POST body credentials must authenticate")
+		})
+	}
+}
+
+func TestCredentialAuthThrottling(t *testing.T) {
+	for _, field := range []string{"pin", "password"} {
+		t.Run(field, func(t *testing.T) {
+			_, handler := credentialHandler(t, field)
+			for range 5 {
+				resp := httptest.NewRecorder()
+				handler.ServeHTTP(resp, credentialRequest(http.MethodPost, field, "000000"))
+				require.Equal(t, http.StatusUnauthorized, resp.Code, "initial wrong credentials must be rejected")
+			}
+			resp := httptest.NewRecorder()
+			handler.ServeHTTP(resp, credentialRequest(http.MethodPost, field, "842716"))
+			assert.Equal(t, http.StatusTooManyRequests, resp.Code, "even correct credentials must wait for the block to expire")
+			assert.Equal(t, "900", resp.Header().Get("Retry-After"), "five failures must block the source for fifteen minutes")
+			assert.Empty(t, resp.Result().Cookies(), "blocked credentials must not issue a session")
+		})
+	}
+}
+
+func TestCredentialAuthSessionAndClientIP(t *testing.T) {
+	keys := generateTestKeyPair(t)
+	token, err := sessionkey.SignToken(keys.PrivateKey, "pin-user", "", "example.com", proxyauth.MethodPIN, nil, nil, time.Hour)
+	require.NoError(t, err)
+	mw := NewMiddleware(nil, nil, nil)
+	now := time.Now()
+	mw.credentials.now = func() time.Time { return now }
+	scheme := &stubScheme{method: proxyauth.MethodPIN, promptID: "pin"}
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, keys.PublicKey, 0, "account", "service", nil, false, nil))
+	handler := mw.Protect(newPassthroughHandler())
+	for range credentialFailureLimit {
+		resp := httptest.NewRecorder()
+		handler.ServeHTTP(resp, credentialRequest(http.MethodPost, "pin", "000000"))
+		require.Equal(t, http.StatusUnauthorized, resp.Code, "bad PIN must consume the failure budget")
+	}
+	now = now.Add(credentialCheckInterval)
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, keys.PublicKey, 0, "account", "service", nil, false, nil))
+	r := credentialRequest(http.MethodPost, "pin", "000000")
+	r.RemoteAddr = "[::ffff:198.51.100.25]:45678"
+	r.Header.Set("X-Forwarded-For", "192.0.2.5")
+	r.Header.Set("X-Real-IP", "192.0.2.6")
+	resp := httptest.NewRecorder()
+	handler.ServeHTTP(resp, r)
+	assert.Equal(t, http.StatusTooManyRequests, resp.Code, "mapped addresses and untrusted forwarding headers must not bypass the source block")
+	assert.Equal(t, "no-store", resp.Header().Get("Cache-Control"), "rate limits must not be cached")
+	r.AddCookie(&http.Cookie{Name: proxyauth.SessionCookieName, Value: token})
+	resp = httptest.NewRecorder()
+	handler.ServeHTTP(resp, r)
+	assert.Equal(t, http.StatusOK, resp.Code, "an existing session must pass even with credentials in the request")
+	assert.Equal(t, "backend", resp.Body.String(), "the authenticated request must reach the application")
+	r = credentialRequest(http.MethodPost, "pin", "000000")
+	cd := proxy.NewCapturedData("test")
+	cd.SetClientIP(netip.MustParseAddr("192.0.2.9"))
+	r = r.WithContext(proxy.WithCapturedData(r.Context(), cd))
+	resp = httptest.NewRecorder()
+	handler.ServeHTTP(resp, r)
+	assert.Equal(t, http.StatusUnauthorized, resp.Code, "a client resolved by the trusted-proxy middleware must get its own source budget")
+	r = credentialRequest(http.MethodPost, "pin", "000000")
+	r.RemoteAddr = "invalid"
+	resp = httptest.NewRecorder()
+	handler.ServeHTTP(resp, r)
+	assert.Equal(t, http.StatusBadRequest, resp.Code, "an unresolvable client address must fail closed")
+	now = now.Add(credentialBlockDuration)
+	scheme.token = token
+	resp = httptest.NewRecorder()
+	handler.ServeHTTP(resp, credentialRequest(http.MethodPost, "pin", "842716"))
+	assert.Equal(t, http.StatusSeeOther, resp.Code, "credentials must work again after cooldown")
+}
+
+func TestCredentialAuthManagementThrottling(t *testing.T) {
+	s, err := status.New(codes.ResourceExhausted, "rate limited").WithDetails(&errdetails.RetryInfo{RetryDelay: durationpb.New(2500 * time.Millisecond)})
+	require.NoError(t, err)
+	for _, tc := range []struct {
+		name  string
+		err   error
+		code  int
+		retry string
+	}{
+		{"retry info", fmt.Errorf("authenticate PIN: %w", s.Err()), http.StatusTooManyRequests, "3"},
+		{"missing retry info", status.Error(codes.ResourceExhausted, "rate limited"), http.StatusTooManyRequests, "6"},
+		{"unavailable", status.Error(codes.Unavailable, "unavailable"), http.StatusBadGateway, ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			keys := generateTestKeyPair(t)
+			mw := NewMiddleware(nil, nil, nil)
+			scheme := &stubScheme{method: proxyauth.MethodPIN, authFn: func(*http.Request) (string, string, error) { return "", "", tc.err }}
+			require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, keys.PublicKey, 0, "account", "service", nil, false, nil))
+			resp := httptest.NewRecorder()
+			mw.Protect(newPassthroughHandler()).ServeHTTP(resp, credentialRequest(http.MethodPost, "pin", "000000"))
+			assert.Equal(t, tc.code, resp.Code, "management errors must keep their HTTP meaning")
+			assert.Equal(t, tc.retry, resp.Header().Get("Retry-After"), "retry hints must round up to whole seconds")
+		})
+	}
+}
diff --git a/proxy/internal/auth/header.go b/proxy/internal/auth/header.go
index 194800a49..64d5da8f1 100644
--- a/proxy/internal/auth/header.go
+++ b/proxy/internal/auth/header.go
@@ -1,36 +1,33 @@
 package auth
 
 import (
+	"crypto/sha256"
 	"errors"
-	"fmt"
 	"net/http"
+	"sync"
 
 	"github.com/netbirdio/netbird/proxy/auth"
-	"github.com/netbirdio/netbird/proxy/internal/types"
-	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/hash/argon2id"
 )
 
-// ErrHeaderAuthFailed indicates that the header was present but the
-// credential did not validate. Callers should return 401 instead of
-// falling through to other auth schemes.
-var ErrHeaderAuthFailed = errors.New("header authentication failed")
-
-// Header implements header-based authentication. The proxy checks for the
-// configured header in each request and validates its value via gRPC.
+// Header implements header-based authentication. The service mapping carries
+// the argon2id hash of every value accepted for the header, so the proxy
+// verifies the credential locally rather than round-tripping to management.
 type Header struct {
-	id         types.ServiceID
-	accountId  types.AccountID
 	headerName string
-	client     authenticator
+	hashes     []string
+	verified   *verifiedValues
 }
 
-// NewHeader creates a Header authentication scheme for the given header name.
-func NewHeader(client authenticator, id types.ServiceID, accountId types.AccountID, headerName string) Header {
+// NewHeader creates a Header authentication scheme accepting any value whose
+// argon2id hash appears in hashes. An empty hashes slice rejects every request
+// carrying the header, so a mapping that arrived without its hashes fails
+// closed instead of leaving the service unprotected.
+func NewHeader(headerName string, hashes []string) Header {
 	return Header{
-		id:         id,
-		accountId:  accountId,
-		headerName: headerName,
-		client:     client,
+		headerName: http.CanonicalHeaderKey(headerName),
+		hashes:     hashes,
+		verified:   &verifiedValues{seen: make(map[[32]byte]struct{}, len(hashes))},
 	}
 }
 
@@ -39,31 +36,64 @@ func (Header) Type() auth.Method {
 	return auth.MethodHeader
 }
 
-// Authenticate checks for the configured header in the request. If absent,
-// returns empty (unauthenticated). If present, validates via gRPC.
-func (h Header) Authenticate(r *http.Request) (string, string, error) {
+// Authenticate satisfies Scheme. Header credentials are resolved by Verify
+// before the scheme loop runs, so a request that reaches here never carries
+// the header and there is no credential to prompt for.
+func (Header) Authenticate(*http.Request) (string, string, error) {
+	return "", "", nil
+}
+
+// Verify reports whether the request carries the configured header and, when
+// it does, whether the value matches one of the service's hashes.
+//
+// A non-nil unusable is a diagnostic rather than a request error: a stored hash
+// could not be decoded, so no credential can ever match it and the header stays
+// unauthenticatable until the service is saved again. Folding that into an
+// ordinary mismatch would hide the misconfiguration behind a permanent 401.
+func (h Header) Verify(r *http.Request) (present, matched bool, unusable error) {
 	value := r.Header.Get(h.headerName)
 	if value == "" {
-		return "", "", nil
+		return false, false, nil
 	}
 
-	res, err := h.client.Authenticate(r.Context(), &proto.AuthenticateRequest{
-		Id:        string(h.id),
-		AccountId: string(h.accountId),
-		Request: &proto.AuthenticateRequest_HeaderAuth{
-			HeaderAuth: &proto.HeaderAuthRequest{
-				HeaderValue: value,
-				HeaderName:  h.headerName,
-			},
-		},
-	})
-	if err != nil {
-		return "", "", fmt.Errorf("authenticate header: %w", err)
+	digest := sha256.Sum256([]byte(value))
+	if h.verified.has(digest) {
+		return true, true, nil
 	}
 
-	if res.GetSuccess() {
-		return res.GetSessionToken(), "", nil
+	for _, hash := range h.hashes {
+		err := argon2id.Verify(value, hash)
+		if err == nil {
+			h.verified.add(digest)
+			return true, true, nil
+		}
+		if !errors.Is(err, argon2id.ErrMismatchedHashAndPassword) {
+			unusable = err
+		}
 	}
+	return true, false, unusable
+}
 
-	return "", "", ErrHeaderAuthFailed
+// verifiedValues remembers which header values already passed argon2id
+// verification. argon2id is deliberately expensive (19 MiB, two passes) and
+// header credentials repeat on every request, so re-deriving per request would
+// dominate the hot path. The set cannot outgrow the number of configured
+// hashes, and a mapping update builds a fresh scheme with an empty set.
+// Values are keyed by digest so the plaintext credential is not retained.
+type verifiedValues struct {
+	mu   sync.Mutex
+	seen map[[32]byte]struct{}
+}
+
+func (v *verifiedValues) has(digest [32]byte) bool {
+	v.mu.Lock()
+	defer v.mu.Unlock()
+	_, ok := v.seen[digest]
+	return ok
+}
+
+func (v *verifiedValues) add(digest [32]byte) {
+	v.mu.Lock()
+	defer v.mu.Unlock()
+	v.seen[digest] = struct{}{}
 }
diff --git a/proxy/internal/auth/middleware.go b/proxy/internal/auth/middleware.go
index 72630b085..735fcbac3 100644
--- a/proxy/internal/auth/middleware.go
+++ b/proxy/internal/auth/middleware.go
@@ -46,7 +46,7 @@ type Scheme interface {
 	// an authenticated user. An empty token indicates an unauthenticated
 	// request; optionally, promptData may be returned for the login UI.
 	// An error indicates an infrastructure failure (e.g. gRPC unavailable).
-	Authenticate(*http.Request) (token string, promptData string, err error)
+	Authenticate(*http.Request) (token, promptData string, err error)
 }
 
 // DomainConfig holds the authentication and restriction settings for a protected domain.
@@ -59,6 +59,27 @@ type DomainConfig struct {
 	IPRestrictions    *restrict.Filter
 	// Private routes the domain through ValidateTunnelPeer; failure → 403.
 	Private bool
+	// AllowedGroups holds the group ids that may reach the service through an
+	// OIDC identity. When non-empty, a session cookie is honoured only if its
+	// groups claim intersects this set. Empty means group membership does not
+	// restrict access.
+	AllowedGroups map[string]struct{}
+	// TargetResolver pins the target and access action used by this auth snapshot.
+	TargetResolver *proxy.TargetResolver
+}
+
+// DomainOption configures a domain authentication snapshot.
+type DomainOption func(*DomainConfig) error
+
+// WithTargetResolver attaches an immutable target-routing snapshot to a domain.
+func WithTargetResolver(resolver *proxy.TargetResolver) DomainOption {
+	return func(config *DomainConfig) error {
+		if resolver == nil {
+			return errors.New("target resolver is nil")
+		}
+		config.TargetResolver = resolver
+		return nil
+	}
 }
 
 type validationResult struct {
@@ -72,6 +93,8 @@ type validationResult struct {
 	// Groups for tokens minted before names were embedded; the consumer
 	// falls back to ids for missing positions.
 	GroupNames []string
+	// MintedToken is the session token issued when a one-time code is redeemed.
+	MintedToken string
 }
 
 // Middleware applies per-domain authentication and IP restriction checks.
@@ -82,6 +105,7 @@ type Middleware struct {
 	sessionValidator SessionValidator
 	geo              restrict.GeoResolver
 	tunnelCache      *tunnelValidationCache
+	credentials      *credentialLimiter
 }
 
 // NewMiddleware creates a new authentication middleware. The sessionValidator is
@@ -96,6 +120,7 @@ func NewMiddleware(logger *log.Logger, sessionValidator SessionValidator, geo re
 		sessionValidator: sessionValidator,
 		geo:              geo,
 		tunnelCache:      newTunnelValidationCache(),
+		credentials:      newCredentialLimiter(),
 	}
 }
 
@@ -123,12 +148,18 @@ func (mw *Middleware) Protect(next http.Handler) http.Handler {
 			return
 		}
 
+		resolvedRequest, handled := mw.handleTargetAccess(w, r, config, next)
+		if handled {
+			return
+		}
+		r = resolvedRequest
+
 		// Private services bypass operator schemes and gate on tunnel peer.
 		if config.Private {
 			if mw.forwardWithTunnelPeer(w, r, host, config, next) {
 				return
 			}
-			http.Error(w, "Forbidden", http.StatusForbidden)
+			denyPrivate(w)
 			return
 		}
 
@@ -146,7 +177,7 @@ func (mw *Middleware) Protect(next http.Handler) http.Handler {
 			return
 		}
 
-		if mw.forwardWithHeaderAuth(w, r, host, config, next) {
+		if mw.forwardWithHeaderAuth(w, r, config, next) {
 			return
 		}
 
@@ -162,6 +193,66 @@ func (mw *Middleware) Protect(next http.Handler) http.Handler {
 	})
 }
 
+func (mw *Middleware) handleTargetAccess(w http.ResponseWriter, r *http.Request, config DomainConfig, next http.Handler) (*http.Request, bool) {
+	if config.TargetResolver == nil {
+		return r, false
+	}
+	resolvedRequest, action, err := config.TargetResolver.ResolveRequest(r)
+	if err != nil {
+		mw.rejectUnsafePath(w, r, err)
+		return r, true
+	}
+	r = resolvedRequest
+	switch action {
+	case proxy.AccessActionInherit:
+		return r, false
+	case proxy.AccessActionBypass:
+		if config.Private {
+			mw.logger.Error("private domain reached a bypass target; denying")
+			denyPrivate(w)
+			return r, true
+		}
+		markAccessAction(r, action)
+		next.ServeHTTP(w, r)
+	case proxy.AccessActionBlock:
+		markAccessAction(r, action)
+		w.Header().Set("Cache-Control", "no-store")
+		denyForbidden(w, config)
+	default:
+		mw.logger.Errorf("resolved unknown access action %q; denying", action)
+		markAccessAction(r, action)
+		w.Header().Set("Cache-Control", "no-store")
+		denyForbidden(w, config)
+	}
+	return r, true
+}
+
+func (mw *Middleware) rejectUnsafePath(w http.ResponseWriter, r *http.Request, err error) {
+	mw.logger.WithFields(log.Fields{
+		"host": r.Host,
+		"path": r.URL.EscapedPath(),
+	}).Debugf("rejecting request path: %v", err)
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetOrigin(proxy.OriginAuth)
+		cd.SetMetadata("access_action", "invalid_path")
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	http.Error(w, "Bad Request", http.StatusBadRequest)
+}
+
+func markAccessAction(r *http.Request, action proxy.AccessAction) {
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetMetadata("access_action", string(action))
+		switch action {
+		case proxy.AccessActionBypass:
+			cd.SetAuthMethod("path_bypass")
+		case proxy.AccessActionBlock:
+			cd.SetAuthMethod("path_block")
+			cd.SetOrigin(proxy.OriginAuth)
+		}
+	}
+}
+
 // requestIsPlainHTTP reports whether the request arrived without TLS.
 // Used to gate cookie-on-plain warnings and the OIDC plain-HTTP block.
 func requestIsPlainHTTP(r *http.Request) bool {
@@ -223,7 +314,7 @@ func (mw *Middleware) checkIPRestrictions(w http.ResponseWriter, r *http.Request
 	clientIP := mw.resolveClientIP(r)
 	if !clientIP.IsValid() {
 		mw.logger.Debugf("IP restriction: cannot resolve client address for %q, denying", r.RemoteAddr)
-		http.Error(w, "Forbidden", http.StatusForbidden)
+		denyForbidden(w, config)
 		return false
 	}
 
@@ -258,10 +349,30 @@ func (mw *Middleware) checkIPRestrictions(w http.ResponseWriter, r *http.Request
 
 	reason := verdict.String()
 	mw.blockIPRestriction(r, reason)
-	http.Error(w, "Forbidden", http.StatusForbidden)
+	denyForbidden(w, config)
 	return false
 }
 
+// denyForbidden writes a 403, dropping the client connection when the
+// domain is private so a later retry cannot reuse it.
+func denyForbidden(w http.ResponseWriter, config DomainConfig) {
+	if config.Private {
+		denyPrivate(w)
+		return
+	}
+	http.Error(w, "Forbidden", http.StatusForbidden)
+}
+
+// denyPrivate writes a 403 and closes the connection, so a client refused
+// before joining the overlay cannot keep retrying on the same warm socket.
+// Go's HTTP/2 server turns the exact lowercase "close" token into a GOAWAY.
+func denyPrivate(w http.ResponseWriter) {
+	h := w.Header()
+	h.Set("Connection", "close")
+	h.Set("Cache-Control", "no-store")
+	http.Error(w, "Forbidden", http.StatusForbidden)
+}
+
 // resolveClientIP extracts the real client IP from CapturedData, falling back to r.RemoteAddr.
 func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
@@ -316,6 +427,9 @@ func (mw *Middleware) handleOAuthCallbackError(w http.ResponseWriter, r *http.Re
 
 // forwardWithSessionCookie checks for a valid session cookie and, if found,
 // sets the user identity on the request context and forwards to the next handler.
+// A signature-valid cookie is not on its own a grant: an OIDC session must also
+// carry a group the service allows, so a token cannot be replayed past the
+// group check that gated the login it came from.
 func (mw *Middleware) forwardWithSessionCookie(w http.ResponseWriter, r *http.Request, host string, config DomainConfig, next http.Handler) bool {
 	cookie, err := r.Cookie(auth.SessionCookieName)
 	if err != nil {
@@ -325,6 +439,24 @@ func (mw *Middleware) forwardWithSessionCookie(w http.ResponseWriter, r *http.Re
 	if err != nil {
 		return false
 	}
+
+	// Header auth is checked per request against the mapping's hashes and mints
+	// no session, so a header-method token can only predate that. Honouring it
+	// would keep a rotated credential working until the token expired.
+	if method == auth.MethodHeader.String() {
+		mw.logger.WithField("host", host).
+			Debug("ignoring header-auth session cookie; the header is required on every request")
+		return false
+	}
+
+	if !sessionGroupsAllowed(config.AllowedGroups, auth.Method(method), groups) {
+		mw.logger.WithFields(log.Fields{
+			"host":    host,
+			"user_id": userID,
+		}).Debug("session cookie rejected: groups claim does not intersect the service's allowed groups")
+		return false
+	}
+
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
 		cd.SetUserID(userID)
 		cd.SetUserEmail(email)
@@ -436,73 +568,44 @@ func isTunnelSourceIP(ip netip.Addr) bool {
 
 // forwardWithHeaderAuth checks for a Header auth scheme. If the header validates,
 // the request is forwarded directly (no redirect), which is important for API clients.
-func (mw *Middleware) forwardWithHeaderAuth(w http.ResponseWriter, r *http.Request, host string, config DomainConfig, next http.Handler) bool {
+func (mw *Middleware) forwardWithHeaderAuth(w http.ResponseWriter, r *http.Request, config DomainConfig, next http.Handler) bool {
+	var presented []string
 	for _, scheme := range config.Schemes {
 		hdr, ok := scheme.(Header)
 		if !ok {
 			continue
 		}
 
-		handled := mw.tryHeaderScheme(w, r, host, config, hdr, next)
-		if handled {
+		present, matched, unusable := hdr.Verify(r)
+		if matched {
+			if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+				cd.SetUserID(auth.HeaderUserID)
+				cd.SetAuthMethod(auth.MethodHeader.String())
+			}
+			next.ServeHTTP(w, r)
 			return true
 		}
+		if unusable != nil {
+			mw.logger.WithFields(log.Fields{
+				"host":   r.Host,
+				"header": hdr.headerName,
+			}).WithError(unusable).Error("header auth: a configured hash cannot be decoded, so this header can never authenticate; re-save the service")
+		}
+		if present {
+			presented = append(presented, hdr.headerName)
+		}
 	}
-	return false
-}
 
-func (mw *Middleware) tryHeaderScheme(w http.ResponseWriter, r *http.Request, host string, config DomainConfig, hdr Header, next http.Handler) bool {
-	token, _, err := hdr.Authenticate(r)
-	if err != nil {
-		return mw.handleHeaderAuthError(w, r, err)
-	}
-	if token == "" {
+	if len(presented) == 0 {
 		return false
 	}
 
-	result, err := mw.validateSessionToken(r.Context(), host, token, config.SessionPublicKey, auth.MethodHeader)
-	if err != nil {
-		setHeaderCapturedData(r.Context(), "", "", nil, nil)
-		status := http.StatusBadRequest
-		msg := "invalid session token"
-		if errors.Is(err, errValidationUnavailable) {
-			status = http.StatusBadGateway
-			msg = "authentication service unavailable"
-		}
-		http.Error(w, msg, status)
-		return true
-	}
-
-	if !result.Valid {
-		setHeaderCapturedData(r.Context(), result.UserID, result.UserEmail, result.Groups, result.GroupNames)
-		http.Error(w, "Unauthorized", http.StatusUnauthorized)
-		return true
-	}
-
-	setSessionCookie(w, token, config.SessionExpiration)
-	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
-		cd.SetUserID(result.UserID)
-		cd.SetUserEmail(result.UserEmail)
-		cd.SetUserGroups(result.Groups)
-		cd.SetUserGroupNames(result.GroupNames)
-		cd.SetAuthMethod(auth.MethodHeader.String())
-	}
-
-	next.ServeHTTP(w, r)
-	return true
-}
-
-func (mw *Middleware) handleHeaderAuthError(w http.ResponseWriter, r *http.Request, err error) bool {
-	if errors.Is(err, ErrHeaderAuthFailed) {
-		setHeaderCapturedData(r.Context(), "", "", nil, nil)
-		http.Error(w, "Unauthorized", http.StatusUnauthorized)
-		return true
-	}
-	mw.logger.WithField("scheme", "header").Warnf("header auth infrastructure error: %v", err)
-	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
-		cd.SetOrigin(proxy.OriginAuth)
-	}
-	http.Error(w, "authentication service unavailable", http.StatusBadGateway)
+	mw.logger.WithFields(log.Fields{
+		"host":    r.Host,
+		"headers": presented,
+	}).Debug("header auth rejected: no presented header matched a configured hash")
+	setHeaderCapturedData(r.Context(), "", "", nil, nil)
+	http.Error(w, "Unauthorized", http.StatusUnauthorized)
 	return true
 }
 
@@ -526,13 +629,9 @@ func (mw *Middleware) authenticateWithSchemes(w http.ResponseWriter, r *http.Req
 	var attemptedMethod string
 
 	for _, scheme := range config.Schemes {
-		token, promptData, err := scheme.Authenticate(r)
+		token, promptData, err := mw.authenticateScheme(r, config, scheme)
 		if err != nil {
-			mw.logger.WithField("scheme", scheme.Type().String()).Warnf("authentication infrastructure error: %v", err)
-			if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
-				cd.SetOrigin(proxy.OriginAuth)
-			}
-			http.Error(w, "authentication service unavailable", http.StatusBadGateway)
+			mw.writeAuthenticationError(w, r, scheme.Type(), err)
 			return
 		}
 
@@ -566,7 +665,8 @@ func (mw *Middleware) authenticateWithSchemes(w http.ResponseWriter, r *http.Req
 // handleAuthenticatedToken validates the token, handles denied access, and on
 // success sets a session cookie and redirects to the original URL.
 func (mw *Middleware) handleAuthenticatedToken(w http.ResponseWriter, r *http.Request, host, token string, config DomainConfig, scheme Scheme) {
-	result, err := mw.validateSessionToken(r.Context(), host, token, config.SessionPublicKey, scheme.Type())
+	isCode := scheme.Type() == auth.MethodOIDC && r.URL.Query().Get(auth.SessionCodeQueryParam) != ""
+	result, err := mw.validateSessionToken(r.Context(), host, token, isCode, config.SessionPublicKey, scheme.Type())
 	if err != nil {
 		if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
 			cd.SetOrigin(proxy.OriginAuth)
@@ -597,7 +697,13 @@ func (mw *Middleware) handleAuthenticatedToken(w http.ResponseWriter, r *http.Re
 		return
 	}
 
-	setSessionCookie(w, token, config.SessionExpiration)
+	// When a code was redeemed, the cookie must hold the durable token the
+	// server returned, not the single-use code.
+	cookieValue := token
+	if result.MintedToken != "" {
+		cookieValue = result.MintedToken
+	}
+	setSessionCookie(w, cookieValue, config.SessionExpiration)
 
 	// Redirect instead of forwarding the auth POST to the backend.
 	// The browser will follow with a GET carrying the new session cookie.
@@ -633,52 +739,83 @@ func setSessionCookie(w http.ResponseWriter, token string, expiration time.Durat
 func wasCredentialSubmitted(r *http.Request, method auth.Method) bool {
 	switch method {
 	case auth.MethodPIN:
-		return r.FormValue("pin") != ""
+		return credentialFormValue(r, pinFormId) != ""
 	case auth.MethodPassword:
-		return r.FormValue("password") != ""
+		return credentialFormValue(r, passwordFormId) != ""
 	case auth.MethodOIDC:
-		return r.URL.Query().Get("session_token") != ""
+		return r.URL.Query().Get(auth.SessionTokenQueryParam) != "" || r.URL.Query().Get(auth.SessionCodeQueryParam) != ""
 	}
 	return false
 }
 
-// AddDomain registers authentication schemes for the given domain. With schemes a valid session public key is required.
-// private=true forces ValidateTunnelPeer enforcement (403 on failure) regardless of the schemes list.
-func (mw *Middleware) AddDomain(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool) error {
-	if len(schemes) == 0 {
-		mw.domainsMux.Lock()
-		defer mw.domainsMux.Unlock()
-		mw.domains[domain] = DomainConfig{
-			AccountID:      accountID,
-			ServiceID:      serviceID,
-			IPRestrictions: ipRestrictions,
-			Private:        private,
-		}
-		return nil
-	}
-
-	pubKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
-	if err != nil {
-		return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
-	}
-	if len(pubKeyBytes) != ed25519.PublicKeySize {
-		return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
-	}
-
-	mw.domainsMux.Lock()
-	defer mw.domainsMux.Unlock()
-	mw.domains[domain] = DomainConfig{
-		Schemes:           schemes,
-		SessionPublicKey:  pubKeyBytes,
+// NewDomainConfig validates and builds an immutable domain configuration.
+func NewDomainConfig(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool, allowedGroups []string, opts ...DomainOption) (DomainConfig, error) {
+	config := DomainConfig{
+		Schemes:           append([]Scheme(nil), schemes...),
 		SessionExpiration: expiration,
 		AccountID:         accountID,
 		ServiceID:         serviceID,
 		IPRestrictions:    ipRestrictions,
 		Private:           private,
+		AllowedGroups:     groupSet(allowedGroups),
 	}
+	if len(schemes) > 0 {
+		pubKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
+		if err != nil {
+			return DomainConfig{}, fmt.Errorf("decode session public key for domain %s: %w", domain, err)
+		}
+		if len(pubKeyBytes) != ed25519.PublicKeySize {
+			return DomainConfig{}, fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
+		}
+		config.SessionPublicKey = append(ed25519.PublicKey(nil), pubKeyBytes...)
+	}
+	for _, option := range opts {
+		if option == nil {
+			return DomainConfig{}, fmt.Errorf("nil domain option for domain %s", domain)
+		}
+		if err := option(&config); err != nil {
+			return DomainConfig{}, fmt.Errorf("configure domain %s: %w", domain, err)
+		}
+	}
+	if config.Private && config.TargetResolver != nil && config.TargetResolver.HasBypass() {
+		return DomainConfig{}, fmt.Errorf("authentication bypass is not allowed for private domain %s", domain)
+	}
+	return config, nil
+}
+
+// AddDomainConfig atomically publishes a validated domain configuration.
+func (mw *Middleware) AddDomainConfig(domain string, config DomainConfig) {
+	config.Schemes = append([]Scheme(nil), config.Schemes...)
+	config.SessionPublicKey = append(ed25519.PublicKey(nil), config.SessionPublicKey...)
+	config.AllowedGroups = cloneGroupSet(config.AllowedGroups)
+	mw.domainsMux.Lock()
+	defer mw.domainsMux.Unlock()
+	mw.domains[domain] = config
+}
+
+// AddDomain registers authentication schemes for the given domain. With schemes a valid session public key is required.
+// private=true forces ValidateTunnelPeer enforcement (403 on failure) regardless of the schemes list.
+// allowedGroups restricts OIDC sessions to the given group ids; empty means unrestricted.
+func (mw *Middleware) AddDomain(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool, allowedGroups []string, opts ...DomainOption) error {
+	config, err := NewDomainConfig(domain, schemes, publicKeyB64, expiration, accountID, serviceID, ipRestrictions, private, allowedGroups, opts...)
+	if err != nil {
+		return err
+	}
+	mw.AddDomainConfig(domain, config)
 	return nil
 }
 
+func cloneGroupSet(groups map[string]struct{}) map[string]struct{} {
+	if groups == nil {
+		return nil
+	}
+	cloned := make(map[string]struct{}, len(groups))
+	for group := range groups {
+		cloned[group] = struct{}{}
+	}
+	return cloned
+}
+
 // RemoveDomain unregisters authentication for the given domain.
 func (mw *Middleware) RemoveDomain(domain string) {
 	mw.domainsMux.Lock()
@@ -688,12 +825,15 @@ func (mw *Middleware) RemoveDomain(domain string) {
 
 // validateSessionToken validates a session token. OIDC tokens with a configured
 // validator go through gRPC for group access checks; other methods validate locally.
-func (mw *Middleware) validateSessionToken(ctx context.Context, host, token string, publicKey ed25519.PublicKey, method auth.Method) (*validationResult, error) {
+func (mw *Middleware) validateSessionToken(ctx context.Context, host, token string, isCode bool, publicKey ed25519.PublicKey, method auth.Method) (*validationResult, error) {
 	if method == auth.MethodOIDC && mw.sessionValidator != nil {
-		resp, err := mw.sessionValidator.ValidateSession(ctx, &proto.ValidateSessionRequest{
-			Domain:       host,
-			SessionToken: token,
-		})
+		req := &proto.ValidateSessionRequest{Domain: host}
+		if isCode {
+			req.SessionCode = token
+		} else {
+			req.SessionToken = token //nolint:staticcheck
+		}
+		resp, err := mw.sessionValidator.ValidateSession(ctx, req)
 		if err != nil {
 			return nil, fmt.Errorf("%w: %w", errValidationUnavailable, err)
 		}
@@ -711,11 +851,12 @@ func (mw *Middleware) validateSessionToken(ctx context.Context, host, token stri
 			}, nil
 		}
 		return &validationResult{
-			UserID:     resp.UserId,
-			UserEmail:  resp.GetUserEmail(),
-			Valid:      true,
-			Groups:     resp.GetPeerGroupIds(),
-			GroupNames: resp.GetPeerGroupNames(),
+			UserID:      resp.UserId,
+			UserEmail:   resp.GetUserEmail(),
+			Valid:       true,
+			Groups:      resp.GetPeerGroupIds(),
+			GroupNames:  resp.GetPeerGroupNames(),
+			MintedToken: resp.GetSessionToken(),
 		}, nil
 	}
 
@@ -726,14 +867,60 @@ func (mw *Middleware) validateSessionToken(ctx context.Context, host, token stri
 	return &validationResult{UserID: userID, UserEmail: email, Valid: true, Groups: groups, GroupNames: groupNames}, nil
 }
 
-// stripSessionTokenParam returns the request URI with the session_token query
-// parameter removed so it doesn't linger in the browser's address bar or history.
+// groupSet builds the lookup set the cookie path consults, returning nil for an
+// empty list so callers can test membership restriction with len().
+func groupSet(groups []string) map[string]struct{} {
+	if len(groups) == 0 {
+		return nil
+	}
+	set := make(map[string]struct{}, len(groups))
+	for _, g := range groups {
+		if g != "" {
+			set[g] = struct{}{}
+		}
+	}
+	if len(set) == 0 {
+		return nil
+	}
+	return set
+}
+
+// sessionGroupsAllowed reports whether a session token's groups claim satisfies
+// the service's allowed groups. Only OIDC sessions are gated: password, PIN and
+// header credentials carry no group identity and are authorised by the secret
+// itself, which mirrors how management validates them. A token minted before the
+// groups claim existed carries none and is therefore denied on a group-restricted
+// service, which sends the user back through login for a fresh decision. A method
+// this build doesn't know carries no such argument, so it is denied.
+func sessionGroupsAllowed(allowed map[string]struct{}, method auth.Method, groups []string) bool {
+	if len(allowed) == 0 {
+		return true
+	}
+	switch method {
+	case auth.MethodPassword, auth.MethodPIN, auth.MethodHeader:
+		return true
+	case auth.MethodOIDC:
+		for _, g := range groups {
+			if _, ok := allowed[g]; ok {
+				return true
+			}
+		}
+		return false
+	default:
+		return false
+	}
+}
+
+// stripSessionTokenParam returns the request URI with the session hand-off
+// query parameters removed so they don't linger in the browser's address bar
+// or history.
 func stripSessionTokenParam(u *url.URL) string {
 	q := u.Query()
-	if !q.Has("session_token") {
+	if !q.Has(auth.SessionTokenQueryParam) && !q.Has(auth.SessionCodeQueryParam) {
 		return u.RequestURI()
 	}
-	q.Del("session_token")
+	q.Del(auth.SessionTokenQueryParam)
+	q.Del(auth.SessionCodeQueryParam)
 	clean := *u
 	clean.RawQuery = q.Encode()
 	return clean.RequestURI()
diff --git a/proxy/internal/auth/middleware_test.go b/proxy/internal/auth/middleware_test.go
index 6608c2b22..cce35ae35 100644
--- a/proxy/internal/auth/middleware_test.go
+++ b/proxy/internal/auth/middleware_test.go
@@ -16,6 +16,7 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	logtest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
@@ -25,6 +26,7 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/proxy"
 	"github.com/netbirdio/netbird/proxy/internal/restrict"
 	"github.com/netbirdio/netbird/proxy/internal/types"
+	"github.com/netbirdio/netbird/shared/hash/argon2id"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -64,7 +66,7 @@ func TestAddDomain_ValidKey(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil)
 	require.NoError(t, err)
 
 	mw.domainsMux.RLock()
@@ -81,7 +83,7 @@ func TestAddDomain_EmptyKey(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", []Scheme{scheme}, "", time.Hour, "", "", nil, false, nil)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -95,7 +97,7 @@ func TestAddDomain_InvalidBase64(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "not-valid-base64!!!", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", []Scheme{scheme}, "not-valid-base64!!!", time.Hour, "", "", nil, false, nil)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "decode session public key")
 
@@ -110,7 +112,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 
 	shortKey := base64.StdEncoding.EncodeToString([]byte("tooshort"))
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, shortKey, time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", []Scheme{scheme}, shortKey, time.Hour, "", "", nil, false, nil)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -123,7 +125,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 func TestAddDomain_NoSchemes_NoKeyRequired(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false, nil)
 	require.NoError(t, err, "domains with no auth schemes should not require a key")
 
 	mw.domainsMux.RLock()
@@ -139,8 +141,8 @@ func TestAddDomain_OverwritesPreviousConfig(t *testing.T) {
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp2.PublicKey, 2*time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false, nil))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp2.PublicKey, 2*time.Hour, "", "", nil, false, nil))
 
 	mw.domainsMux.RLock()
 	config := mw.domains["example.com"]
@@ -156,7 +158,7 @@ func TestRemoveDomain(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	mw.RemoveDomain("example.com")
 
@@ -180,7 +182,7 @@ func TestProtect_UnknownDomainPassesThrough(t *testing.T) {
 
 func TestProtect_DomainWithNoSchemesPassesThrough(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	require.NoError(t, mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -197,7 +199,7 @@ func TestProtect_UnauthenticatedRequestIsBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -218,7 +220,7 @@ func TestProtect_HostWithPortIsMatched(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -239,7 +241,7 @@ func TestProtect_ValidSessionCookiePassesThrough(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
 	require.NoError(t, err)
@@ -272,7 +274,7 @@ func TestProtect_SessionCookieGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	groups := []string{"engineering", "sre"}
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, groups, nil, time.Hour)
@@ -337,7 +339,7 @@ func TestProtect_PrivateService_TunnelPeerGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	// Private service: no operator schemes — auth gates solely on the tunnel peer.
-	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true, nil))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14")) // CGNAT tunnel source
@@ -377,7 +379,7 @@ func TestProtect_PrivateService_TunnelPeerDenied(t *testing.T) {
 	}}
 	mw := NewMiddleware(log.StandardLogger(), validator, nil)
 	kp := generateTestKeyPair(t)
-	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true, nil))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14"))
@@ -405,7 +407,7 @@ func TestProtect_ExpiredSessionCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	// Sign a token that expired 1 second ago.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, -time.Second)
@@ -431,7 +433,7 @@ func TestProtect_WrongDomainCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	// Token signed for a different domain audience.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "other.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -458,7 +460,7 @@ func TestProtect_WrongKeyCookieIsRejected(t *testing.T) {
 	kp2 := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	// Token signed with a different private key.
 	token, err := sessionkey.SignToken(kp2.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -495,7 +497,7 @@ func TestProtect_SchemeAuthRedirectsWithCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -548,7 +550,7 @@ func TestProtect_FailedAuthDoesNotSetCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -584,7 +586,7 @@ func TestProtect_MultipleSchemes(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{pinScheme, passwordScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{pinScheme, passwordScheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -614,7 +616,7 @@ func TestProtect_InvalidTokenFromSchemeReturns400(t *testing.T) {
 			return "invalid-jwt-token", "", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -638,7 +640,7 @@ func TestAddDomain_RandomBytes32NotEd25519(t *testing.T) {
 	key := base64.StdEncoding.EncodeToString(randomBytes)
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	err = mw.AddDomain("example.com", []Scheme{scheme}, key, time.Hour, "", "", nil, false)
+	err = mw.AddDomain("example.com", []Scheme{scheme}, key, time.Hour, "", "", nil, false, nil)
 	require.NoError(t, err, "any 32-byte key should be accepted at registration time")
 }
 
@@ -647,10 +649,10 @@ func TestAddDomain_InvalidKeyDoesNotCorruptExistingConfig(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	// Attempt to overwrite with an invalid key.
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "bad", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", []Scheme{scheme}, "bad", time.Hour, "", "", nil, false, nil)
 	require.Error(t, err)
 
 	// The original valid config should still be intact.
@@ -674,7 +676,7 @@ func TestProtect_FailedPinAuthCapturesAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -701,7 +703,7 @@ func TestProtect_FailedPasswordAuthCapturesAuthMethod(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -728,7 +730,7 @@ func TestProtect_NoCredentialsDoesNotCaptureAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -781,6 +783,18 @@ func TestWasCredentialSubmitted(t *testing.T) {
 			query:    url.Values{"session_token": {"abc123"}},
 			expected: true,
 		},
+		{
+			name:     "OIDC code in query",
+			method:   auth.MethodOIDC,
+			query:    url.Values{"nb_session_code": {"abc123"}},
+			expected: true,
+		},
+		{
+			name:     "OIDC backend session_code in query",
+			method:   auth.MethodOIDC,
+			query:    url.Values{"session_code": {"abc123"}},
+			expected: false,
+		},
 		{
 			name:     "OIDC token not in query",
 			method:   auth.MethodOIDC,
@@ -816,7 +830,7 @@ func TestCheckIPRestrictions_UnparseableAddress(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}}), false)
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}}), false, nil)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -852,7 +866,7 @@ func TestCheckIPRestrictions_UsesCapturedDataClientIP(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}}), false)
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}}), false, nil)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -893,7 +907,7 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}}), false)
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}}), false, nil)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -920,7 +934,7 @@ func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 		restrict.ParseFilter(restrict.FilterConfig{
 			AllowedCIDRs:     []string{"100.64.0.0/10"},
 			AllowedCountries: []string{"US"},
-		}), false)
+		}), false, nil)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -954,7 +968,7 @@ func TestCheckIPRestrictions_OverlayOriginRespectsCIDR(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}}), false)
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}}), false, nil)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -982,7 +996,7 @@ func TestProtect_OIDCOnlyRedirectsDirectly(t *testing.T) {
 			return "", oidcURL, nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1011,7 +1025,7 @@ func TestProtect_OIDCWithOtherMethodShowsLoginPage(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{oidcScheme, pinScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{oidcScheme, pinScheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1023,39 +1037,25 @@ func TestProtect_OIDCWithOtherMethodShowsLoginPage(t *testing.T) {
 	assert.Equal(t, http.StatusUnauthorized, rec.Code, "should show login page when multiple methods exist")
 }
 
-// mockAuthenticator is a minimal mock for the authenticator gRPC interface
-// used by the Header scheme.
-type mockAuthenticator struct {
-	fn func(ctx context.Context, req *proto.AuthenticateRequest) (*proto.AuthenticateResponse, error)
-}
-
-func (m *mockAuthenticator) Authenticate(ctx context.Context, in *proto.AuthenticateRequest, _ ...grpc.CallOption) (*proto.AuthenticateResponse, error) {
-	return m.fn(ctx, in)
-}
-
-// newHeaderSchemeWithToken creates a Header scheme backed by a mock that
-// returns a signed session token when the expected header value is provided.
-func newHeaderSchemeWithToken(t *testing.T, kp *sessionkey.KeyPair, headerName, expectedValue string) Header {
+// newHeaderScheme creates a Header scheme accepting each of the given values,
+// hashed the way management hashes them before putting them on the mapping.
+func newHeaderScheme(t *testing.T, headerName string, acceptedValues ...string) Header {
 	t.Helper()
-	token, err := sessionkey.SignToken(kp.PrivateKey, "header-user", "", "example.com", auth.MethodHeader, nil, nil, time.Hour)
-	require.NoError(t, err)
-
-	mock := &mockAuthenticator{fn: func(_ context.Context, req *proto.AuthenticateRequest) (*proto.AuthenticateResponse, error) {
-		ha := req.GetHeaderAuth()
-		if ha != nil && ha.GetHeaderValue() == expectedValue {
-			return &proto.AuthenticateResponse{Success: true, SessionToken: token}, nil
-		}
-		return &proto.AuthenticateResponse{Success: false}, nil
-	}}
-	return NewHeader(mock, "svc1", "acc1", headerName)
+	hashes := make([]string, 0, len(acceptedValues))
+	for _, v := range acceptedValues {
+		hash, err := argon2id.Hash(v)
+		require.NoError(t, err, "hashing an accepted header value must succeed")
+		hashes = append(hashes, hash)
+	}
+	return NewHeader(headerName, hashes)
 }
 
 func TestProtect_HeaderAuth_ForwardsOnSuccess(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 	kp := generateTestKeyPair(t)
 
-	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	hdr := newHeaderScheme(t, "X-API-Key", "secret-key")
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
 
 	var backendCalled bool
 	capturedData := proxy.NewCapturedData("")
@@ -1075,19 +1075,12 @@ func TestProtect_HeaderAuth_ForwardsOnSuccess(t *testing.T) {
 	assert.Equal(t, http.StatusOK, rec.Code)
 	assert.Equal(t, "ok", rec.Body.String())
 
-	// Session cookie should be set.
-	var sessionCookie *http.Cookie
+	// The credential rides on every request, so no session cookie is issued.
 	for _, c := range rec.Result().Cookies() {
-		if c.Name == auth.SessionCookieName {
-			sessionCookie = c
-			break
-		}
+		assert.NotEqual(t, auth.SessionCookieName, c.Name, "header auth must not issue a session cookie")
 	}
-	require.NotNil(t, sessionCookie, "session cookie should be set after successful header auth")
-	assert.True(t, sessionCookie.HttpOnly)
-	assert.True(t, sessionCookie.Secure)
 
-	assert.Equal(t, "header-user", capturedData.GetUserID())
+	assert.Equal(t, auth.HeaderUserID, capturedData.GetUserID())
 	assert.Equal(t, "header", capturedData.GetAuthMethod())
 }
 
@@ -1095,10 +1088,10 @@ func TestProtect_HeaderAuth_MissingHeaderFallsThrough(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 	kp := generateTestKeyPair(t)
 
-	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
+	hdr := newHeaderScheme(t, "X-API-Key", "secret-key")
 	// Also add a PIN scheme so we can verify fallthrough behavior.
 	pinScheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr, pinScheme}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr, pinScheme}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1114,11 +1107,8 @@ func TestProtect_HeaderAuth_WrongValueReturns401(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 	kp := generateTestKeyPair(t)
 
-	mock := &mockAuthenticator{fn: func(_ context.Context, _ *proto.AuthenticateRequest) (*proto.AuthenticateResponse, error) {
-		return &proto.AuthenticateResponse{Success: false}, nil
-	}}
-	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	hdr := newHeaderScheme(t, "X-API-Key", "secret-key")
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -1131,94 +1121,283 @@ func TestProtect_HeaderAuth_WrongValueReturns401(t *testing.T) {
 
 	assert.Equal(t, http.StatusUnauthorized, rec.Code)
 	assert.Equal(t, "header", capturedData.GetAuthMethod())
+	assert.Empty(t, hdr.verified.seen, "a rejected value must not be memoized")
 }
 
-func TestProtect_HeaderAuth_InfraErrorReturns502(t *testing.T) {
+// TestProtect_HeaderAuth_MatchesAnyConfiguredHeader covers a client that carries
+// a valid credential on one configured header while also sending an unrelated
+// value on another — an app-level Authorization alongside an API key, say.
+// Schemes OR across header names, so the valid credential admits the request no
+// matter which order the mapping happened to list the headers in.
+func TestProtect_HeaderAuth_MatchesAnyConfiguredHeader(t *testing.T) {
+	tests := []struct {
+		name        string
+		matchedLast bool
+	}{
+		{name: "unmatched header listed first", matchedLast: true},
+		{name: "matched header listed first", matchedLast: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mw := NewMiddleware(log.StandardLogger(), nil, nil)
+			kp := generateTestKeyPair(t)
+
+			authz := newHeaderScheme(t, "Authorization", "Bearer proxy-secret")
+			apiKey := newHeaderScheme(t, "X-Api-Key", "secret-key")
+			schemes := []Scheme{apiKey, authz}
+			if tt.matchedLast {
+				schemes = []Scheme{authz, apiKey}
+			}
+			require.NoError(t, mw.AddDomain("example.com", schemes, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
+
+			var backendCalled bool
+			handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				backendCalled = true
+				w.WriteHeader(http.StatusOK)
+			}))
+
+			req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+			req.Header.Set("X-Api-Key", "secret-key")
+			req.Header.Set("Authorization", "Bearer app-level-token")
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			assert.True(t, backendCalled, "a valid credential on one header must admit the request")
+			assert.Equal(t, http.StatusOK, rec.Code)
+		})
+	}
+}
+
+// TestProtect_HeaderAuth_RejectsWhenEveryPresentedHeaderFails is the other half
+// of the OR: trying all schemes before rejecting must not turn into admitting a
+// request that satisfied none of them.
+func TestProtect_HeaderAuth_RejectsWhenEveryPresentedHeaderFails(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 	kp := generateTestKeyPair(t)
 
-	mock := &mockAuthenticator{fn: func(_ context.Context, _ *proto.AuthenticateRequest) (*proto.AuthenticateResponse, error) {
-		return nil, errors.New("gRPC unavailable")
-	}}
-	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
-
-	handler := mw.Protect(newPassthroughHandler())
-
-	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
-	req.Header.Set("X-API-Key", "some-key")
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	assert.Equal(t, http.StatusBadGateway, rec.Code)
-}
-
-func TestProtect_HeaderAuth_SubsequentRequestUsesSessionCookie(t *testing.T) {
-	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	kp := generateTestKeyPair(t)
-
-	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	authz := newHeaderScheme(t, "Authorization", "Bearer proxy-secret")
+	apiKey := newHeaderScheme(t, "X-Api-Key", "secret-key")
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{authz, apiKey}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
 
+	var backendCalled bool
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		backendCalled = true
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	req.Header.Set("X-Api-Key", "wrong-key")
+	req.Header.Set("Authorization", "Bearer wrong-token")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.False(t, backendCalled)
+	assert.Equal(t, http.StatusUnauthorized, rec.Code)
+}
+
+// TestProtect_HeaderAuth_ReportsUndecodableHash covers a stored hash the proxy
+// cannot decode. No credential can ever match it, so the header is permanently
+// unauthenticatable — an operator fault that has to surface loudly instead of
+// hiding behind the same quiet 401 a wrong credential earns.
+func TestProtect_HeaderAuth_ReportsUndecodableHash(t *testing.T) {
+	validHash, err := argon2id.Hash("secret-key")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name       string
+		hashes     []string
+		wantErrLog bool
+	}{
+		{name: "stored hash cannot be decoded", hashes: []string{"$argon2id$v=19$garbage"}, wantErrLog: true},
+		{name: "wrong credential against a good hash", hashes: []string{validHash}, wantErrLog: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			logger, hook := logtest.NewNullLogger()
+			logger.SetLevel(log.DebugLevel)
+			mw := NewMiddleware(logger, nil, nil)
+			kp := generateTestKeyPair(t)
+
+			require.NoError(t, mw.AddDomain("example.com", []Scheme{NewHeader("X-Api-Key", tt.hashes)},
+				kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
+
+			handler := mw.Protect(newPassthroughHandler())
+
+			req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+			req.Header.Set("X-Api-Key", "wrong-key")
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			require.Equal(t, http.StatusUnauthorized, rec.Code, "either way the request is denied")
+
+			var errored []string
+			for _, entry := range hook.AllEntries() {
+				if entry.Level == log.ErrorLevel {
+					errored = append(errored, entry.Message)
+				}
+			}
+
+			if !tt.wantErrLog {
+				assert.Empty(t, errored, "a wrong credential is not an operator fault")
+				return
+			}
+			require.Len(t, errored, 1, "an undecodable hash must be reported once")
+			assert.Contains(t, errored[0], "cannot be decoded")
+		})
+	}
+}
+
+// TestProtect_HeaderAuth_NoHashesFailsClosed covers a mapping that names a
+// header but carries no hash for it: the check cannot be evaluated, so the
+// request must be denied rather than let through unauthenticated.
+func TestProtect_HeaderAuth_NoHashesFailsClosed(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	kp := generateTestKeyPair(t)
+
+	hdr := NewHeader("X-API-Key", nil)
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
+
+	var backendCalled bool
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		backendCalled = true
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	req.Header.Set("X-API-Key", "any-key")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusUnauthorized, rec.Code)
+	assert.False(t, backendCalled, "a header auth with no hashes must not admit the request")
+}
+
+// TestProtect_HeaderAuth_SubsequentRequestRequiresHeader verifies that header
+// auth grants no ambient session: a follow-up request that drops the header is
+// treated as unauthenticated.
+func TestProtect_HeaderAuth_SubsequentRequestRequiresHeader(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	kp := generateTestKeyPair(t)
+
+	hdr := newHeaderScheme(t, "X-API-Key", "secret-key")
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
+
+	var backendCalls int
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		backendCalls++
 		w.WriteHeader(http.StatusOK)
 	}))
 
-	// First request with header auth.
 	req1 := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
 	req1.Header.Set("X-API-Key", "secret-key")
 	req1 = req1.WithContext(proxy.WithCapturedData(req1.Context(), proxy.NewCapturedData("")))
 	rec1 := httptest.NewRecorder()
 	handler.ServeHTTP(rec1, req1)
 	require.Equal(t, http.StatusOK, rec1.Code)
+	require.Equal(t, 1, backendCalls)
 
-	// Extract session cookie.
-	var sessionCookie *http.Cookie
-	for _, c := range rec1.Result().Cookies() {
-		if c.Name == auth.SessionCookieName {
-			sessionCookie = c
-			break
-		}
-	}
-	require.NotNil(t, sessionCookie)
-
-	// Second request with only the session cookie (no header).
-	capturedData2 := proxy.NewCapturedData("")
+	// Same client, second request, header omitted: no cookie was handed out, so
+	// there is nothing to carry the earlier success forward.
 	req2 := httptest.NewRequest(http.MethodGet, "http://example.com/other", nil)
-	req2.AddCookie(sessionCookie)
-	req2 = req2.WithContext(proxy.WithCapturedData(req2.Context(), capturedData2))
+	for _, c := range rec1.Result().Cookies() {
+		req2.AddCookie(c)
+	}
 	rec2 := httptest.NewRecorder()
 	handler.ServeHTTP(rec2, req2)
 
-	assert.Equal(t, http.StatusOK, rec2.Code)
-	assert.Equal(t, "header-user", capturedData2.GetUserID())
-	assert.Equal(t, "header", capturedData2.GetAuthMethod())
+	assert.Equal(t, http.StatusUnauthorized, rec2.Code, "dropping the header must revoke access")
+	assert.Equal(t, 1, backendCalls, "backend must not be reached without the header")
 }
 
-// TestProtect_HeaderAuth_MultipleValuesSameHeader verifies that the proxy
-// correctly handles multiple valid credentials for the same header name.
-// In production, the mgmt gRPC authenticateHeader iterates all configured
-// header auths and accepts if any hash matches (OR semantics). The proxy
-// creates one Header scheme per entry, but a single gRPC call checks all.
+// TestProtect_HeaderAuth_LegacySessionCookieIsIgnored covers the upgrade
+// window. Header auth used to mint a session token, so cookies with
+// method=header survive a proxy upgrade and stay signature-valid for their full
+// lifetime. They must not stand in for the header, or a credential rotated
+// right after the upgrade would keep working until every such token expired.
+func TestProtect_HeaderAuth_LegacySessionCookieIsIgnored(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	kp := generateTestKeyPair(t)
+
+	hdr := newHeaderScheme(t, "X-API-Key", "secret-key")
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
+
+	// A token management would have minted for header auth before the upgrade.
+	legacyToken, err := sessionkey.SignToken(kp.PrivateKey, auth.HeaderUserID, "", "example.com", auth.MethodHeader, nil, nil, time.Hour)
+	require.NoError(t, err)
+
+	var backendCalls int
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		backendCalls++
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	t.Run("cookie alone is rejected", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookieName, Value: legacyToken})
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+
+		assert.Equal(t, http.StatusUnauthorized, rec.Code, "a header-auth cookie must not authenticate on its own")
+		assert.Equal(t, 0, backendCalls, "backend must not be reached without the header")
+	})
+
+	t.Run("cookie does not block the header path", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookieName, Value: legacyToken})
+		req.Header.Set("X-API-Key", "secret-key")
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+
+		assert.Equal(t, http.StatusOK, rec.Code, "a client sending both must still be admitted by the header")
+		assert.Equal(t, 1, backendCalls)
+	})
+}
+
+// TestProtect_HeaderAuth_RepeatedValueIsMemoized verifies the KDF is run once
+// per distinct accepted value. argon2id is deliberately expensive, so a
+// credential that repeats on every request must not be re-derived each time.
+func TestProtect_HeaderAuth_RepeatedValueIsMemoized(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	kp := generateTestKeyPair(t)
+
+	hdr := newHeaderScheme(t, "X-API-Key", "key-a", "key-b")
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
+
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	get := func(value string) int {
+		req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+		req.Header.Set("X-API-Key", value)
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+		return rec.Code
+	}
+
+	require.Equal(t, http.StatusOK, get("key-a"))
+	require.Equal(t, http.StatusOK, get("key-a"))
+	assert.Len(t, hdr.verified.seen, 1, "the same value must be memoized once")
+
+	require.Equal(t, http.StatusOK, get("key-b"))
+	assert.Len(t, hdr.verified.seen, 2, "each accepted value gets its own entry")
+
+	require.Equal(t, http.StatusUnauthorized, get("key-c"))
+	assert.Len(t, hdr.verified.seen, 2, "rejected values must not grow the set")
+}
+
+// TestProtect_HeaderAuth_MultipleValuesSameHeader verifies that a service with
+// several accepted credentials for one header name accepts any of them.
+// Management applied these OR semantics while it still validated the value; the
+// proxy preserves them by carrying every hash for a name on one scheme.
 func TestProtect_HeaderAuth_MultipleValuesSameHeader(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 	kp := generateTestKeyPair(t)
 
-	// Mock simulates mgmt behavior: accepts either token-a or token-b.
-	accepted := map[string]bool{"Bearer token-a": true, "Bearer token-b": true}
-	mock := &mockAuthenticator{fn: func(_ context.Context, req *proto.AuthenticateRequest) (*proto.AuthenticateResponse, error) {
-		ha := req.GetHeaderAuth()
-		if ha != nil && accepted[ha.GetHeaderValue()] {
-			token, err := sessionkey.SignToken(kp.PrivateKey, "header-user", "", "example.com", auth.MethodHeader, nil, nil, time.Hour)
-			require.NoError(t, err)
-			return &proto.AuthenticateResponse{Success: true, SessionToken: token}, nil
-		}
-		return &proto.AuthenticateResponse{Success: false}, nil
-	}}
-
-	// Single Header scheme (as if one entry existed), but the mock checks both values.
-	hdr := NewHeader(mock, "svc1", "acc1", "Authorization")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	hdr := newHeaderScheme(t, "Authorization", "Bearer token-a", "Bearer token-b")
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false, nil))
 
 	var backendCalled bool
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -1276,7 +1455,7 @@ func TestProtect_OIDCOnPlainHTTP_BlockedWith400(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1300,7 +1479,7 @@ func TestProtect_OIDCOverTLS_NotBlocked(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1320,7 +1499,7 @@ func TestProtect_NonOIDCSchemes_PlainHTTP_NotBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1350,7 +1529,7 @@ func TestProtect_TunnelPeerFastPath_RequiresInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1385,7 +1564,7 @@ func TestProtect_TunnelPeerFastPath_TakesPathWithInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false, nil))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1404,3 +1583,24 @@ func TestProtect_TunnelPeerFastPath_TakesPathWithInboundMarker(t *testing.T) {
 	assert.Equal(t, http.StatusOK, rec.Code,
 		"a successful tunnel-peer validation must forward to the next handler")
 }
+
+func TestStripSessionTokenParam(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"strips session_token", "https://ex.com/p?a=1&session_token=tok", "/p?a=1"},
+		{"strips nb_session_code", "https://ex.com/p?a=1&nb_session_code=code", "/p?a=1"},
+		{"strips both", "https://ex.com/p?session_token=tok&nb_session_code=code&a=1", "/p?a=1"},
+		{"keeps backend session_code", "https://ex.com/p?a=1&session_code=backend", "/p?a=1&session_code=backend"},
+		{"no-op when absent", "https://ex.com/p?a=1", "/p?a=1"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			u, err := url.Parse(tc.in)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, stripSessionTokenParam(u))
+		})
+	}
+}
diff --git a/proxy/internal/auth/oidc.go b/proxy/internal/auth/oidc.go
index a60e6437a..0215fddc3 100644
--- a/proxy/internal/auth/oidc.go
+++ b/proxy/internal/auth/oidc.go
@@ -40,10 +40,15 @@ func (OIDC) Type() auth.Method {
 
 // Authenticate checks for an OIDC session token or obtains the OIDC redirect URL.
 func (o OIDC) Authenticate(r *http.Request) (string, string, error) {
-	// Check for the session_token query param (from OIDC redirects).
-	// The management server passes the token in the URL because it cannot set
-	// cookies for the proxy's domain (cookies are domain-scoped per RFC 6265).
-	if token := r.URL.Query().Get("session_token"); token != "" {
+	// Check for the session credential returned by the OIDC callback. The management
+	// server passes it in the URL because it cannot set a cookie for the proxy's
+	// domain (cookies are domain-scoped per RFC 6265). The current flow uses a
+	// single-use session code to keep the durable token out of the URL.
+	// session_token remains supported for backward compatibility.
+	if code := r.URL.Query().Get(auth.SessionCodeQueryParam); code != "" {
+		return code, "", nil
+	}
+	if token := r.URL.Query().Get(auth.SessionTokenQueryParam); token != "" {
 		return token, "", nil
 	}
 
diff --git a/proxy/internal/auth/password.go b/proxy/internal/auth/password.go
index 6a7eda3e1..c43e8e3af 100644
--- a/proxy/internal/auth/password.go
+++ b/proxy/internal/auth/password.go
@@ -35,7 +35,7 @@ func (Password) Type() auth.Method {
 // so that it can be injected into a request from the UI so that
 // authentication may be successful.
 func (p Password) Authenticate(r *http.Request) (string, string, error) {
-	password := r.FormValue(passwordFormId)
+	password := credentialFormValue(r, passwordFormId)
 
 	if password == "" {
 		// No password submitted; return the form ID so the UI can prompt the user.
diff --git a/proxy/internal/auth/pin.go b/proxy/internal/auth/pin.go
index 4d08f3dc6..180f2648d 100644
--- a/proxy/internal/auth/pin.go
+++ b/proxy/internal/auth/pin.go
@@ -35,7 +35,7 @@ func (Pin) Type() auth.Method {
 // so that it can be injected into a request from the UI so that
 // authentication may be successful.
 func (p Pin) Authenticate(r *http.Request) (string, string, error) {
-	pin := r.FormValue(pinFormId)
+	pin := credentialFormValue(r, pinFormId)
 
 	if pin == "" {
 		// No PIN submitted; return the form ID so the UI can prompt the user.
diff --git a/proxy/internal/auth/private_deny_test.go b/proxy/internal/auth/private_deny_test.go
new file mode 100644
index 000000000..5bec67168
--- /dev/null
+++ b/proxy/internal/auth/private_deny_test.go
@@ -0,0 +1,272 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/http/httptrace"
+	"net/netip"
+	"sync"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/proxy/internal/restrict"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// switchableTunnelValidator flips the ValidateTunnelPeer verdict between requests.
+type switchableTunnelValidator struct {
+	mu    sync.Mutex
+	valid bool
+}
+
+func (s *switchableTunnelValidator) setValid(v bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.valid = v
+}
+
+func (s *switchableTunnelValidator) ValidateSession(context.Context, *proto.ValidateSessionRequest, ...grpc.CallOption) (*proto.ValidateSessionResponse, error) {
+	return nil, errors.New("not used in this test")
+}
+
+func (s *switchableTunnelValidator) ValidateTunnelPeer(context.Context, *proto.ValidateTunnelPeerRequest, ...grpc.CallOption) (*proto.ValidateTunnelPeerResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if !s.valid {
+		return &proto.ValidateTunnelPeerResponse{Valid: false, DeniedReason: "not_in_group"}, nil
+	}
+	return &proto.ValidateTunnelPeerResponse{
+		Valid:        true,
+		UserId:       "user-1",
+		SessionToken: "tunnel-session-token",
+	}, nil
+}
+
+// testServerHost is the domain key Protect derives from the httptest listener.
+const testServerHost = "127.0.0.1"
+
+var testTunnelIP = netip.MustParseAddr("100.90.1.14")
+
+// startProtectedServer serves mw.Protect and stamps requests as overlay traffic.
+func startProtectedServer(t *testing.T, mw *Middleware, clientIP netip.Addr, lookup TunnelLookupFunc, h2 bool) *httptest.Server {
+	t.Helper()
+	protected := mw.Protect(newPassthroughHandler())
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		cd := proxy.NewCapturedData("")
+		cd.SetClientIP(clientIP)
+		ctx := proxy.WithCapturedData(r.Context(), cd)
+		ctx = WithTunnelLookup(ctx, lookup)
+		protected.ServeHTTP(w, r.WithContext(ctx))
+	})
+
+	srv := httptest.NewUnstartedServer(handler)
+	if h2 {
+		srv.EnableHTTP2 = true
+		srv.StartTLS()
+	} else {
+		srv.Start()
+	}
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+// tracedResponse is what a test observes from one client round trip.
+type tracedResponse struct {
+	status       int
+	protoMajor   int
+	close        bool
+	connection   string
+	cacheControl string
+	reused       bool
+}
+
+// doTraced GETs url and reports whether the connection that served it was reused.
+func doTraced(t *testing.T, client *http.Client, url string) tracedResponse {
+	t.Helper()
+	var reused bool
+	trace := &httptrace.ClientTrace{
+		GotConn: func(info httptrace.GotConnInfo) { reused = info.Reused },
+	}
+	req, err := http.NewRequestWithContext(httptrace.WithClientTrace(context.Background(), trace), http.MethodGet, url, nil)
+	require.NoError(t, err)
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	defer func() { require.NoError(t, resp.Body.Close()) }()
+	_, err = io.Copy(io.Discard, resp.Body)
+	require.NoError(t, err)
+	return tracedResponse{
+		status:       resp.StatusCode,
+		protoMajor:   resp.ProtoMajor,
+		close:        resp.Close,
+		connection:   resp.Header.Get("Connection"),
+		cacheControl: resp.Header.Get("Cache-Control"),
+		reused:       reused,
+	}
+}
+
+func acceptAllLookup(_ netip.Addr) (PeerIdentity, bool) {
+	return PeerIdentity{TunnelIP: testTunnelIP}, true
+}
+
+func newPrivateMiddleware(t *testing.T, validator SessionValidator, ipRestrictions *restrict.Filter) *Middleware {
+	t.Helper()
+	mw := NewMiddleware(log.StandardLogger(), validator, nil)
+	kp := generateTestKeyPair(t)
+	require.NoError(t, mw.AddDomain(testServerHost, nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", ipRestrictions, true, nil))
+	return mw
+}
+
+// A rejected tunnel peer must emit the exact lowercase "close" token h2 matches on.
+func TestProtect_PrivateService_DeniedSetsCloseHeaders(t *testing.T) {
+	mw := newPrivateMiddleware(t, &switchableTunnelValidator{}, nil)
+	handler := mw.Protect(newPassthroughHandler())
+
+	cd := proxy.NewCapturedData("")
+	cd.SetClientIP(testTunnelIP)
+	req := httptest.NewRequest(http.MethodGet, "http://"+testServerHost+"/", nil)
+	req.RemoteAddr = testTunnelIP.String() + ":5000"
+	req = req.WithContext(WithTunnelLookup(proxy.WithCapturedData(req.Context(), cd), acceptAllLookup))
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.Equal(t, "close", rec.Header().Get("Connection"), "private denial must ask the client to drop the connection")
+	assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"), "private denial must not be cacheable")
+}
+
+// A denied client must not keep reusing the warm socket after joining the overlay.
+func TestPrivateDeny_HTTP1_ClosesConnection(t *testing.T) {
+	validator := &switchableTunnelValidator{}
+	mw := newPrivateMiddleware(t, validator, nil)
+	srv := startProtectedServer(t, mw, testTunnelIP, acceptAllLookup, false)
+	client := srv.Client()
+
+	resp := doTraced(t, client, srv.URL)
+	assert.Equal(t, http.StatusForbidden, resp.status)
+	assert.Equal(t, 1, resp.protoMajor, "plain httptest server must speak HTTP/1.1")
+	// The Go client folds "Connection: close" into resp.close and drops the header.
+	assert.True(t, resp.close, "private denial must make the client mark the connection as not reusable")
+	assert.Equal(t, "no-store", resp.cacheControl, "private denial must not be cacheable")
+
+	validator.setValid(true)
+	resp2 := doTraced(t, client, srv.URL)
+	assert.Equal(t, http.StatusOK, resp2.status, "the retry must reach the upstream once the peer is valid")
+	assert.False(t, resp2.reused, "the retry must open a new connection")
+}
+
+// On HTTP/2 the header becomes a GOAWAY and the retry must use a new connection.
+func TestPrivateDeny_HTTP2_SendsGoAway(t *testing.T) {
+	validator := &switchableTunnelValidator{}
+	mw := newPrivateMiddleware(t, validator, nil)
+	srv := startProtectedServer(t, mw, testTunnelIP, acceptAllLookup, true)
+	client := srv.Client()
+
+	resp := doTraced(t, client, srv.URL)
+	require.Equal(t, 2, resp.protoMajor, "test client must negotiate HTTP/2")
+	assert.Equal(t, http.StatusForbidden, resp.status)
+	assert.Empty(t, resp.connection, "HTTP/2 must not carry a Connection header on the wire")
+	assert.Equal(t, "no-store", resp.cacheControl)
+
+	validator.setValid(true)
+	resp2 := doTraced(t, client, srv.URL)
+	assert.Equal(t, 2, resp2.protoMajor)
+	assert.Equal(t, http.StatusOK, resp2.status, "the retry must reach the upstream once the peer is valid")
+	assert.False(t, resp2.reused, "GOAWAY must retire the connection so the retry opens a new one")
+}
+
+// Legitimate private traffic keeps its keep-alive connection.
+func TestPrivateAllow_KeepsConnection(t *testing.T) {
+	validator := &switchableTunnelValidator{valid: true}
+	mw := newPrivateMiddleware(t, validator, nil)
+	srv := startProtectedServer(t, mw, testTunnelIP, acceptAllLookup, false)
+	client := srv.Client()
+
+	resp := doTraced(t, client, srv.URL)
+	assert.Equal(t, http.StatusOK, resp.status)
+	assert.Empty(t, resp.connection, "an allowed private request must not close the connection")
+
+	resp2 := doTraced(t, client, srv.URL)
+	assert.Equal(t, http.StatusOK, resp2.status)
+	assert.True(t, resp2.reused, "allowed private traffic must keep reusing the connection")
+}
+
+// Public denials keep the connection open; only private services change.
+func TestPublicDeny_KeepsConnection(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	filter := restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}})
+	require.NoError(t, mw.AddDomain(testServerHost, nil, "", 0, "acct-1", "svc-1", filter, false, nil))
+	srv := startProtectedServer(t, mw, netip.MustParseAddr("192.168.1.1"), nil, false)
+	client := srv.Client()
+
+	resp := doTraced(t, client, srv.URL)
+	assert.Equal(t, http.StatusForbidden, resp.status)
+	assert.Empty(t, resp.connection, "public denial must not close the connection")
+	assert.Empty(t, resp.cacheControl, "public denial must not gain cache headers")
+
+	resp2 := doTraced(t, client, srv.URL)
+	assert.Equal(t, http.StatusForbidden, resp2.status)
+	assert.True(t, resp2.reused, "public denials must keep reusing the connection")
+}
+
+// IP restriction denials on a private service must close the connection too.
+func TestCheckIPRestrictions_PrivateDenialClosesConnection(t *testing.T) {
+	filter := restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}})
+	mw := newPrivateMiddleware(t, &switchableTunnelValidator{valid: true}, filter)
+	handler := mw.Protect(newPassthroughHandler())
+
+	tests := []struct {
+		name       string
+		remoteAddr string
+	}{
+		{"denied by CIDR", "100.65.5.6:5000"},
+		{"unresolvable client address", "not-an-ip:1234"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "http://"+testServerHost+"/", nil)
+			req.RemoteAddr = tt.remoteAddr
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			assert.Equal(t, http.StatusForbidden, rec.Code)
+			assert.Equal(t, "close", rec.Header().Get("Connection"), "private IP-restriction denial must close the connection")
+			assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"), "private IP-restriction denial must not be cacheable")
+		})
+	}
+}
+
+func TestCheckIPRestrictions_PublicDenialKeepsConnection(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	filter := restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}})
+	require.NoError(t, mw.AddDomain(testServerHost, nil, "", 0, "acct-1", "svc-1", filter, false, nil))
+	handler := mw.Protect(newPassthroughHandler())
+
+	tests := []struct {
+		name       string
+		remoteAddr string
+	}{
+		{"denied by CIDR", "192.168.1.1:5000"},
+		{"unresolvable client address", "not-an-ip:1234"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "http://"+testServerHost+"/", nil)
+			req.RemoteAddr = tt.remoteAddr
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			assert.Equal(t, http.StatusForbidden, rec.Code)
+			assert.Empty(t, rec.Header().Get("Connection"), "public IP-restriction denial must not close the connection")
+			assert.Empty(t, rec.Header().Get("Cache-Control"), "public IP-restriction denial must not gain cache headers")
+		})
+	}
+}
diff --git a/proxy/internal/auth/session_groups_test.go b/proxy/internal/auth/session_groups_test.go
new file mode 100644
index 000000000..6635b812b
--- /dev/null
+++ b/proxy/internal/auth/session_groups_test.go
@@ -0,0 +1,167 @@
+package auth
+
+import (
+	"context"
+	"crypto/tls"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
+	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// denyingSessionValidator mimics management for a user who completed OIDC login
+// but is outside the service's distribution groups: ValidateSession denies.
+type denyingSessionValidator struct {
+	calls int
+}
+
+func (d *denyingSessionValidator) ValidateSession(context.Context, *proto.ValidateSessionRequest, ...grpc.CallOption) (*proto.ValidateSessionResponse, error) {
+	d.calls++
+	return &proto.ValidateSessionResponse{Valid: false, UserId: "user-1", DeniedReason: "not_in_group"}, nil
+}
+
+func (d *denyingSessionValidator) ValidateTunnelPeer(context.Context, *proto.ValidateTunnelPeerRequest, ...grpc.CallOption) (*proto.ValidateTunnelPeerResponse, error) {
+	return &proto.ValidateTunnelPeerResponse{Valid: false}, nil
+}
+
+// TestProtect_SelfInstalledCookieCannotBypassGroupCheck is the regression guard
+// for the group-authorisation bypass: a user denied at login still holds the raw
+// session token from the ?session_token= redirect, so pasting it into the
+// nb_session cookie must not buy access. The cookie path validated only the JWT
+// signature, which turned the token management had already refused into a bearer
+// credential for the service.
+func TestProtect_SelfInstalledCookieCannotBypassGroupCheck(t *testing.T) {
+	validator := &denyingSessionValidator{}
+	mw := NewMiddleware(log.StandardLogger(), validator, nil)
+	kp := generateTestKeyPair(t)
+
+	oidc := &stubScheme{method: auth.MethodOIDC, authFn: func(r *http.Request) (string, string, error) {
+		return r.URL.Query().Get("session_token"), "https://idp.example/authorize", nil
+	}}
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{oidc}, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, false, []string{"grp-allowed"}))
+
+	// The token a denied user gets to see: validly signed for this service and
+	// domain, but carrying no group the service allows.
+	token, err := sessionkey.SignToken(kp.PrivateKey, "user-1", "john.doe@example.com", "example.com", auth.MethodOIDC, nil, nil, time.Hour)
+	require.NoError(t, err)
+
+	backendHits := 0
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		backendHits++
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	t.Run("token in the callback URL is denied", func(t *testing.T) {
+		rec := serveWithCookie(t, handler, "https://example.com/?session_token="+token, nil)
+
+		assert.Equal(t, http.StatusForbidden, rec.Code, "group check must deny the login")
+		assert.Empty(t, rec.Result().Cookies(), "a denied login must not install a session cookie")
+	})
+
+	t.Run("same token pasted into the session cookie is denied", func(t *testing.T) {
+		rec := serveWithCookie(t, handler, "https://example.com/", &http.Cookie{Name: auth.SessionCookieName, Value: token})
+
+		assert.NotEqual(t, http.StatusOK, rec.Code, "a self-installed cookie must not reach the backend")
+		assert.Equal(t, 0, backendHits, "backend must never be reached without an allowed group")
+	})
+}
+
+// TestProtect_SessionCookieWithAllowedGroupPassesThrough is the positive half of
+// the group gate: a member of an allowed group keeps the cookie fast-path, with
+// no management round-trip.
+func TestProtect_SessionCookieWithAllowedGroupPassesThrough(t *testing.T) {
+	validator := &denyingSessionValidator{}
+	mw := NewMiddleware(log.StandardLogger(), validator, nil)
+	kp := generateTestKeyPair(t)
+
+	oidc := &stubScheme{method: auth.MethodOIDC}
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{oidc}, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, false, []string{"grp-other", "grp-allowed"}))
+
+	token, err := sessionkey.SignToken(kp.PrivateKey, "user-2", "jane@example.com", "example.com", auth.MethodOIDC,
+		[]string{"grp-unrelated", "grp-allowed"}, []string{"Unrelated", "Allowed"}, time.Hour)
+	require.NoError(t, err)
+
+	handler := mw.Protect(newPassthroughHandler())
+	rec := serveWithCookie(t, handler, "https://example.com/", &http.Cookie{Name: auth.SessionCookieName, Value: token})
+
+	assert.Equal(t, http.StatusOK, rec.Code, "a cookie carrying an allowed group must pass through")
+	assert.Equal(t, 0, validator.calls, "the cookie fast-path must not call management")
+}
+
+// TestProtect_NonOIDCSessionCookieIgnoresGroupRestriction locks the scope of the
+// gate: PIN, password and header credentials carry no group identity and are
+// authorised by the secret itself, exactly as management validates them.
+func TestProtect_NonOIDCSessionCookieIgnoresGroupRestriction(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	kp := generateTestKeyPair(t)
+
+	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, false, []string{"grp-allowed"}))
+
+	token, err := sessionkey.SignToken(kp.PrivateKey, "pin-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
+	require.NoError(t, err)
+
+	handler := mw.Protect(newPassthroughHandler())
+	rec := serveWithCookie(t, handler, "https://example.com/", &http.Cookie{Name: auth.SessionCookieName, Value: token})
+
+	assert.Equal(t, http.StatusOK, rec.Code, "a PIN session must not be gated on OIDC group membership")
+}
+
+func TestSessionGroupsAllowed(t *testing.T) {
+	allowed := groupSet([]string{"a", "b"})
+
+	tests := []struct {
+		name    string
+		allowed map[string]struct{}
+		method  auth.Method
+		groups  []string
+		want    bool
+	}{
+		{"unrestricted service allows a groupless token", nil, auth.MethodOIDC, nil, true},
+		{"restricted service allows an intersecting token", allowed, auth.MethodOIDC, []string{"c", "b"}, true},
+		{"restricted service denies a disjoint token", allowed, auth.MethodOIDC, []string{"c"}, false},
+		{"restricted service denies a groupless token", allowed, auth.MethodOIDC, nil, false},
+		{"restricted service ignores a pin token", allowed, auth.MethodPIN, nil, true},
+		{"restricted service ignores a password token", allowed, auth.MethodPassword, nil, true},
+		{"restricted service ignores a header token", allowed, auth.MethodHeader, nil, true},
+		{"restricted service denies an unknown method", allowed, auth.Method("totp"), []string{"a"}, false},
+		{"restricted service denies a token with no method", allowed, auth.Method(""), []string{"a"}, false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, sessionGroupsAllowed(tc.allowed, tc.method, tc.groups))
+		})
+	}
+}
+
+func TestGroupSetDropsEmptyEntries(t *testing.T) {
+	assert.Nil(t, groupSet(nil), "no groups means unrestricted")
+	assert.Nil(t, groupSet([]string{"", ""}), "blank ids must not restrict access to nothing reachable")
+	assert.Equal(t, map[string]struct{}{"a": {}}, groupSet([]string{"a", ""}))
+}
+
+// serveWithCookie drives the middleware over TLS with captured data attached,
+// optionally carrying a session cookie.
+func serveWithCookie(t *testing.T, handler http.Handler, url string, cookie *http.Cookie) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, url, nil)
+	req.TLS = &tls.ConnectionState{}
+	if cookie != nil {
+		req.AddCookie(cookie)
+	}
+	req = req.WithContext(proxy.WithCapturedData(req.Context(), proxy.NewCapturedData("")))
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	return rec
+}
diff --git a/proxy/internal/auth/target_access_test.go b/proxy/internal/auth/target_access_test.go
new file mode 100644
index 000000000..56f924b60
--- /dev/null
+++ b/proxy/internal/auth/target_access_test.go
@@ -0,0 +1,278 @@
+package auth
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	proxyauth "github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/proxy/internal/restrict"
+)
+
+type targetAccessRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f targetAccessRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func targetAccessResolver(t *testing.T, action proxy.AccessAction) *proxy.TargetResolver {
+	t.Helper()
+	targetURL, err := url.Parse("http://backend.internal")
+	require.NoError(t, err)
+	resolver, err := proxy.NewTargetResolver(proxy.Mapping{
+		ID:        "service-1",
+		AccountID: "account-1",
+		Host:      "example.com",
+		Paths: map[string]*proxy.PathTarget{
+			"/selected": {
+				URL:          targetURL,
+				AccessAction: action,
+			},
+		},
+	})
+	require.NoError(t, err)
+	return resolver
+}
+
+func TestProtect_TargetAccessActions(t *testing.T) {
+	tests := []struct {
+		name             string
+		action           proxy.AccessAction
+		wantStatus       int
+		wantBackendCalls int
+		wantSchemeCalls  int
+		wantCacheControl string
+	}{
+		{
+			name:             "bypass forwards without authentication",
+			action:           proxy.AccessActionBypass,
+			wantStatus:       http.StatusNoContent,
+			wantBackendCalls: 1,
+		},
+		{
+			name:             "block rejects before authentication",
+			action:           proxy.AccessActionBlock,
+			wantStatus:       http.StatusForbidden,
+			wantSchemeCalls:  0,
+			wantCacheControl: "no-store",
+		},
+		{
+			name:            "inherit runs configured authentication",
+			action:          proxy.AccessActionInherit,
+			wantStatus:      http.StatusUnauthorized,
+			wantSchemeCalls: 1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mw := NewMiddleware(log.StandardLogger(), nil, nil)
+			kp := generateTestKeyPair(t)
+			schemeCalls := 0
+			scheme := &stubScheme{
+				method: proxyauth.MethodPIN,
+				authFn: func(*http.Request) (string, string, error) {
+					schemeCalls++
+					return "", "pin", nil
+				},
+			}
+			err := mw.AddDomain(
+				"example.com",
+				[]Scheme{scheme},
+				kp.PublicKey,
+				time.Hour,
+				"account-1",
+				"service-1",
+				nil,
+				false,
+				nil,
+				WithTargetResolver(targetAccessResolver(t, tt.action)),
+			)
+			require.NoError(t, err)
+
+			backendCalls := 0
+			handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				backendCalls++
+				w.WriteHeader(http.StatusNoContent)
+			}))
+			req := httptest.NewRequest(http.MethodGet, "http://example.com/selected/status", nil)
+			rec := httptest.NewRecorder()
+
+			handler.ServeHTTP(rec, req)
+
+			assert.Equal(t, tt.wantStatus, rec.Code)
+			assert.Equal(t, tt.wantBackendCalls, backendCalls, "backend call count")
+			assert.Equal(t, tt.wantSchemeCalls, schemeCalls, "authentication scheme call count")
+			assert.Equal(t, tt.wantCacheControl, rec.Header().Get("Cache-Control"), "cache policy")
+		})
+	}
+}
+
+func TestProtect_BypassRecordsActionWithoutIdentity(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	require.NoError(t, mw.AddDomain(
+		"example.com", nil, "", 0, "account-1", "service-1", nil, false, nil,
+		WithTargetResolver(targetAccessResolver(t, proxy.AccessActionBypass)),
+	))
+
+	handler := mw.Protect(newPassthroughHandler())
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/selected", nil)
+	captured := proxy.NewCapturedData("request-1")
+	req = req.WithContext(proxy.WithCapturedData(req.Context(), captured))
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.Empty(t, captured.GetUserID())
+	assert.Empty(t, captured.GetUserEmail())
+	assert.Empty(t, captured.GetUserGroups())
+	assert.Equal(t, "path_bypass", captured.GetAuthMethod())
+	assert.Equal(t, "bypass", captured.GetMetadata()["access_action"])
+}
+
+func TestProtect_TargetResolverPinsMissThroughAuthentication(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	resolver := targetAccessResolver(t, proxy.AccessActionBypass)
+	require.NoError(t, mw.AddDomain(
+		"example.com", nil, "", 0, "account-1", "service-1", nil, false, nil,
+		WithTargetResolver(resolver),
+	))
+
+	forwarded := false
+	reverseProxy := proxy.NewReverseProxy(targetAccessRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		forwarded = true
+		return nil, errors.New("unexpected forwarding")
+	}), "auto", nil, nil)
+	replacementURL, err := url.Parse("http://replacement.internal")
+	require.NoError(t, err)
+	reverseProxy.AddMapping(proxy.Mapping{
+		ID:        "service-1",
+		AccountID: "account-1",
+		Host:      "example.com",
+		Paths: map[string]*proxy.PathTarget{
+			"/": {URL: replacementURL},
+		},
+	})
+	handler := mw.Protect(reverseProxy)
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/not-selected", nil)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusNotFound, rec.Code, "a miss pinned before auth must reach the proxy unchanged")
+	assert.False(t, forwarded, "the proxy must not fall back to a newly published mapping after a pinned miss")
+}
+
+func TestProtect_UnsafePathFailsBeforeAuthentication(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	kp := generateTestKeyPair(t)
+	schemeCalls := 0
+	scheme := &stubScheme{
+		method: proxyauth.MethodPIN,
+		authFn: func(*http.Request) (string, string, error) {
+			schemeCalls++
+			return "", "pin", nil
+		},
+	}
+	require.NoError(t, mw.AddDomain(
+		"example.com",
+		[]Scheme{scheme},
+		kp.PublicKey,
+		time.Hour,
+		"account-1",
+		"service-1",
+		nil,
+		false,
+		nil,
+		WithTargetResolver(targetAccessResolver(t, proxy.AccessActionBlock)),
+	))
+
+	backendCalled := false
+	handler := mw.Protect(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+		backendCalled = true
+	}))
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	req.URL.Path = "/selected/../other"
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusBadRequest, rec.Code)
+	assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"))
+	assert.Zero(t, schemeCalls, "unsafe paths must be rejected before credentials are evaluated")
+	assert.False(t, backendCalled)
+}
+
+func TestProtect_IPRestrictionsRunBeforeTargetAccessAction(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	filter := restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}})
+	require.NoError(t, mw.AddDomain(
+		"example.com", nil, "", 0, "account-1", "service-1", filter, false, nil,
+		WithTargetResolver(targetAccessResolver(t, proxy.AccessActionBypass)),
+	))
+
+	backendCalled := false
+	handler := mw.Protect(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+		backendCalled = true
+	}))
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/selected", nil)
+	req.RemoteAddr = "192.0.2.10:1234"
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.False(t, backendCalled, "bypass must not bypass service IP restrictions")
+}
+
+func TestNewDomainConfig_RejectsPrivateBypass(t *testing.T) {
+	_, err := NewDomainConfig(
+		"private.example.com",
+		nil,
+		"",
+		0,
+		"account-1",
+		"service-1",
+		nil,
+		true,
+		nil,
+		WithTargetResolver(targetAccessResolver(t, proxy.AccessActionBypass)),
+	)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not allowed for private domain")
+}
+
+func TestAddDomainConfig_PublishesPreparedSnapshot(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	config, err := NewDomainConfig(
+		"example.com",
+		nil,
+		"",
+		0,
+		"account-1",
+		"service-1",
+		nil,
+		false,
+		[]string{"group-1"},
+		WithTargetResolver(targetAccessResolver(t, proxy.AccessActionBlock)),
+	)
+	require.NoError(t, err)
+
+	mw.AddDomainConfig("example.com", config)
+	delete(config.AllowedGroups, "group-1")
+
+	published, exists := mw.getDomainConfig("example.com")
+	require.True(t, exists)
+	assert.Contains(t, published.AllowedGroups, "group-1", "published mutable fields should be copied")
+	assert.NotNil(t, published.TargetResolver)
+}
diff --git a/proxy/internal/auth/tunnel_cache.go b/proxy/internal/auth/tunnel_cache.go
index 10b671d82..185c53c62 100644
--- a/proxy/internal/auth/tunnel_cache.go
+++ b/proxy/internal/auth/tunnel_cache.go
@@ -3,20 +3,30 @@ package auth
 import (
 	"context"
 	"net/netip"
+	"os"
+	"strings"
 	"sync"
 	"time"
 
+	log "github.com/sirupsen/logrus"
 	"golang.org/x/sync/singleflight"
 
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-// tunnelCacheTTL caps how long a positive ValidateTunnelPeer result is
-// reused before re-fetching from management. 5 minutes balances freshness
-// against management load on busy mesh networks.
+// tunnelCacheTTL is the default cap on how long a positive ValidateTunnelPeer
+// result is reused before re-fetching from management. 5 minutes balances
+// freshness against management load on busy mesh networks. Override it with
+// envTunnelCacheTTL when an account needs authorization changes to take effect
+// sooner (at the cost of more ValidateTunnelPeer RPCs).
 const tunnelCacheTTL = 300 * time.Second
 
+// envTunnelCacheTTL overrides tunnelCacheTTL. The value is a Go duration string
+// (e.g. "30s", "2m"); an unset, unparseable, or non-positive value keeps the
+// default.
+const envTunnelCacheTTL = "NB_PROXY_TUNNEL_CACHE_TTL"
+
 // tunnelCachePerAccount caps the number of cached identities per account.
 // Bounded eviction avoids memory growth in pathological cases (huge peer
 // roster, brief request bursts) while staying generous for normal use.
@@ -60,16 +70,35 @@ type accountBucket struct {
 	order []tunnelCacheKey
 }
 
-// newTunnelValidationCache constructs a cache with default TTL and bounds.
+// newTunnelValidationCache constructs a cache with the configured TTL
+// (envTunnelCacheTTL override or default) and default bounds.
 func newTunnelValidationCache() *tunnelValidationCache {
 	return &tunnelValidationCache{
 		entries: make(map[types.AccountID]*accountBucket),
-		ttl:     tunnelCacheTTL,
+		ttl:     tunnelCacheTTLFromEnv(),
 		maxSize: tunnelCachePerAccount,
 		now:     time.Now,
 	}
 }
 
+// tunnelCacheTTLFromEnv returns the tunnel-cache TTL, honoring the
+// envTunnelCacheTTL override. The override must be a positive Go duration
+// string (e.g. "30s", "2m"); anything unset, unparseable, or non-positive
+// falls back to tunnelCacheTTL.
+func tunnelCacheTTLFromEnv() time.Duration {
+	raw := strings.TrimSpace(os.Getenv(envTunnelCacheTTL))
+	if raw == "" {
+		return tunnelCacheTTL
+	}
+	d, err := time.ParseDuration(raw)
+	if err != nil || d <= 0 {
+		log.Warnf("ignoring invalid %s=%q (want a positive Go duration like 30s or 2m); using default %s",
+			envTunnelCacheTTL, raw, tunnelCacheTTL)
+		return tunnelCacheTTL
+	}
+	return d
+}
+
 // get returns a cached response for the key, or nil when missing or
 // expired. Expired entries are evicted lazily on read.
 func (c *tunnelValidationCache) get(key tunnelCacheKey) *proto.ValidateTunnelPeerResponse {
diff --git a/proxy/internal/auth/tunnel_cache_test.go b/proxy/internal/auth/tunnel_cache_test.go
index 1a63dc107..d663b91e7 100644
--- a/proxy/internal/auth/tunnel_cache_test.go
+++ b/proxy/internal/auth/tunnel_cache_test.go
@@ -169,3 +169,32 @@ func TestTunnelCache_BoundedSizeEvictsOldest(t *testing.T) {
 	assert.NotNil(t, cache.get(keys[1]), "second-newest must remain cached")
 	assert.NotNil(t, cache.get(keys[2]), "newest must remain cached")
 }
+
+func TestTunnelCacheTTLFromEnv(t *testing.T) {
+	t.Run("unset uses default", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+	})
+	t.Run("valid duration overrides", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "45s")
+		assert.Equal(t, 45*time.Second, tunnelCacheTTLFromEnv())
+	})
+	t.Run("whitespace trimmed", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "  2m ")
+		assert.Equal(t, 2*time.Minute, tunnelCacheTTLFromEnv())
+	})
+	t.Run("unparseable uses default", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "nonsense")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+	})
+	t.Run("non-positive uses default", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "0s")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+		t.Setenv(envTunnelCacheTTL, "-30s")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+	})
+	t.Run("constructor honors override", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "90s")
+		assert.Equal(t, 90*time.Second, newTunnelValidationCache().ttl)
+	})
+}
diff --git a/proxy/internal/auth/tunnel_lookup_test.go b/proxy/internal/auth/tunnel_lookup_test.go
index 808aa8b41..066f5dc1a 100644
--- a/proxy/internal/auth/tunnel_lookup_test.go
+++ b/proxy/internal/auth/tunnel_lookup_test.go
@@ -44,7 +44,7 @@ func (s *stubSessionValidator) ValidateTunnelPeer(_ context.Context, in *proto.V
 func newTunnelMiddleware(t *testing.T, validator SessionValidator) *Middleware {
 	t.Helper()
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("svc.example", nil, "", 0, "acct-1", "svc-1", nil, false))
+	require.NoError(t, mw.AddDomain("svc.example", nil, "", 0, "acct-1", "svc-1", nil, false, nil))
 	return mw
 }
 
@@ -235,8 +235,8 @@ func TestForwardWithTunnelPeer_RoutesAccountIDIntoCacheKey(t *testing.T) {
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
 
-	require.NoError(t, mw.AddDomain("svc-a.example", nil, "", 0, "acct-a", "svc-a", nil, false))
-	require.NoError(t, mw.AddDomain("svc-b.example", nil, "", 0, "acct-b", "svc-b", nil, false))
+	require.NoError(t, mw.AddDomain("svc-a.example", nil, "", 0, "acct-a", "svc-a", nil, false, nil))
+	require.NoError(t, mw.AddDomain("svc-b.example", nil, "", 0, "acct-b", "svc-b", nil, false, nil))
 
 	// The fast-path requires the inbound-listener marker on the context.
 	// The peerstore lookup itself is account-agnostic at this level
@@ -299,7 +299,7 @@ func TestForwardWithTunnelPeer_LocalLookupShortCircuitDoesNotPopulateCache(t *te
 
 func TestPrivateService_FailsClosedOnTunnelPeerFailure(t *testing.T) {
 	mw := NewMiddleware(log.New(), nil, nil)
-	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true, nil))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -328,7 +328,7 @@ func TestPrivateService_ForwardsOnTunnelPeerSuccess(t *testing.T) {
 		},
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true, nil))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
diff --git a/proxy/internal/debug/handler.go b/proxy/internal/debug/handler.go
index 6300228d7..960c3e089 100644
--- a/proxy/internal/debug/handler.go
+++ b/proxy/internal/debug/handler.go
@@ -105,6 +105,20 @@ type Handler struct {
 	startTime  time.Time
 	templates  *template.Template
 	templateMu sync.RWMutex
+
+	// setPerformance applies a buffer cap to one client. Held as a field so
+	// tests can drive applyBufferCap without a live embedded client.
+	setPerformance func(*nbembed.Client, uint32) error
+
+	perfMu       sync.Mutex
+	perfInflight map[types.AccountID]*perfWorker
+}
+
+// perfWorker is the single in-flight retune for one account. err is valid once
+// done is closed.
+type perfWorker struct {
+	done chan struct{}
+	err  error
 }
 
 // NewHandler creates a new debug handler.
@@ -113,10 +127,11 @@ func NewHandler(provider clientProvider, healthChecker healthChecker, logger *lo
 		logger = log.StandardLogger()
 	}
 	h := &Handler{
-		provider:  provider,
-		health:    healthChecker,
-		logger:    logger,
-		startTime: time.Now(),
+		provider:       provider,
+		health:         healthChecker,
+		logger:         logger,
+		startTime:      time.Now(),
+		setPerformance: setClientPerformance,
 	}
 	if err := h.loadTemplates(); err != nil {
 		logger.Errorf("failed to load embedded templates: %v", err)
@@ -716,15 +731,7 @@ func (h *Handler) handlePerf(w http.ResponseWriter, r *http.Request) {
 	}
 
 	capN := uint32(n)
-	applied := 0
-	failed := map[string]string{}
-	for accountID, client := range h.provider.ListClientsForStartup() {
-		if err := client.SetPerformance(nbembed.Performance{PreallocatedBuffersPerPool: &capN}); err != nil {
-			failed[string(accountID)] = err.Error()
-			continue
-		}
-		applied++
-	}
+	applied, failed, inFlight := h.applyBufferCap(capN)
 
 	resp := map[string]any{
 		"success": true,
@@ -734,9 +741,165 @@ func (h *Handler) handlePerf(w http.ResponseWriter, r *http.Request) {
 	if len(failed) > 0 {
 		resp["failed"] = failed
 	}
+	if len(inFlight) > 0 {
+		resp["in_flight"] = inFlight
+	}
 	h.writeJSON(w, resp)
 }
 
+// perfApplyTimeout bounds the whole apply, however many clients are registered.
+// A var, not a const, so tests can shorten the wait.
+var perfApplyTimeout = 5 * time.Second
+
+type perfResult struct {
+	accountID types.AccountID
+	err       error
+}
+
+// setClientPerformance is the production implementation behind Handler.setPerformance.
+func setClientPerformance(client *nbembed.Client, capN uint32) error {
+	return client.SetPerformance(nbembed.Performance{PreallocatedBuffersPerPool: &capN})
+}
+
+// collectBuffered takes every result already sitting in the channel, removing
+// those accounts from pending, and returns how many of them succeeded. It is
+// called when the deadline fires: select picks at random among ready cases, so
+// a result that landed in time would otherwise be reported as a timeout.
+func collectBuffered(results <-chan perfResult, pending map[types.AccountID]*perfWorker, failed map[string]string) int {
+	applied := 0
+	for {
+		select {
+		case res := <-results:
+			delete(pending, res.accountID)
+			if res.err != nil {
+				failed[string(res.accountID)] = res.err.Error()
+				continue
+			}
+			applied++
+		default:
+			return applied
+		}
+	}
+}
+
+// resolvePending closes out the accounts still pending when the deadline fires.
+// A worker whose done channel is closed has finished, whatever the results
+// channel has managed to deliver, so its own error is the truth; the rest are
+// genuinely still running and are reported as timed out. Returns how many of
+// them had in fact succeeded.
+func resolvePending(pending map[types.AccountID]*perfWorker, failed map[string]string) int {
+	applied := 0
+	for accountID, w := range pending {
+		select {
+		case <-w.done:
+			if w.err != nil {
+				failed[string(accountID)] = w.err.Error()
+				continue
+			}
+			applied++
+		default:
+			failed[string(accountID)] = fmt.Sprintf("timed out after %s waiting for the client", perfApplyTimeout)
+		}
+	}
+	return applied
+}
+
+// startPerfWorker returns the in-flight retune for the account, starting one if
+// there is none. The bool reports whether this call started it.
+//
+// At most one retune runs per account at a time. A client wedged inside its own
+// lock never returns, so without this a caller could add one permanently blocked
+// goroutine per request just by retrying the endpoint.
+func (h *Handler) startPerfWorker(accountID types.AccountID, client *nbembed.Client, capN uint32, results chan<- perfResult) (*perfWorker, bool) {
+	h.perfMu.Lock()
+	defer h.perfMu.Unlock()
+
+	if w, ok := h.perfInflight[accountID]; ok {
+		return w, false
+	}
+
+	w := &perfWorker{done: make(chan struct{})}
+	if h.perfInflight == nil {
+		h.perfInflight = make(map[types.AccountID]*perfWorker)
+	}
+	h.perfInflight[accountID] = w
+
+	go func() {
+		err := h.setPerformance(client, capN)
+		w.err = err
+		close(w.done)
+
+		// Publish before touching the registry: perfMu is taken once per
+		// account by every caller walking the fleet, so a finishing worker
+		// can queue behind a long apply and miss its own deadline.
+		results <- perfResult{accountID: accountID, err: err}
+
+		h.perfMu.Lock()
+		delete(h.perfInflight, accountID)
+		h.perfMu.Unlock()
+	}()
+
+	return w, true
+}
+
+// applyBufferCap sets the WireGuard buffer pool cap on every registered client
+// and reports how many took it, a per-account error for those that did not, and
+// the accounts whose earlier retune has not come back yet.
+//
+// Clients are handled concurrently and the wait is bounded: SetPerformance goes
+// through the embedded client's lock, which Start and Stop hold for as long as
+// they take - and on a wedged client Stop never returns. This endpoint is the
+// recovery path for exactly that fleet, so one stuck account must neither delay
+// the others nor accumulate goroutines across retries.
+func (h *Handler) applyBufferCap(capN uint32) (int, map[string]string, []string) {
+	clients := h.provider.ListClientsForStartup()
+	results := make(chan perfResult, len(clients))
+
+	applied := 0
+	failed := map[string]string{}
+	var inFlight []string
+	pending := make(map[types.AccountID]*perfWorker, len(clients))
+
+	for accountID, client := range clients {
+		w, started := h.startPerfWorker(accountID, client, capN, results)
+		if started {
+			pending[accountID] = w
+			continue
+		}
+		// Another request owns this account's retune. Take its result if it
+		// has already landed, otherwise report it as still running instead of
+		// waiting on it again.
+		select {
+		case <-w.done:
+			if w.err != nil {
+				failed[string(accountID)] = w.err.Error()
+				continue
+			}
+			applied++
+		default:
+			inFlight = append(inFlight, string(accountID))
+		}
+	}
+
+	deadline := time.After(perfApplyTimeout)
+	for range len(pending) {
+		select {
+		case res := <-results:
+			delete(pending, res.accountID)
+			if res.err != nil {
+				failed[string(res.accountID)] = res.err.Error()
+				continue
+			}
+			applied++
+		case <-deadline:
+			applied += collectBuffered(results, pending, failed)
+			applied += resolvePending(pending, failed)
+			return applied, failed, inFlight
+		}
+	}
+	return applied, failed, inFlight
+}
+
 // handleRuntime returns cheap runtime and process stats. Safe to hit on a
 // running proxy; does not read pprof profiles.
 func (h *Handler) handleRuntime(w http.ResponseWriter, _ *http.Request) {
diff --git a/proxy/internal/debug/perf_test.go b/proxy/internal/debug/perf_test.go
new file mode 100644
index 000000000..abcfccb50
--- /dev/null
+++ b/proxy/internal/debug/perf_test.go
@@ -0,0 +1,158 @@
+package debug
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	nbembed "github.com/netbirdio/netbird/client/embed"
+	"github.com/netbirdio/netbird/proxy/internal/health"
+	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
+	"github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+// perfProvider serves a fixed set of accounts. The clients are nil: the tests
+// drive Handler.setPerformance, which never dereferences them.
+type perfProvider struct {
+	accounts []types.AccountID
+}
+
+func (p *perfProvider) GetClient(types.AccountID) (*nbembed.Client, bool) { return nil, false }
+
+func (p *perfProvider) ListClientsForDebug() map[types.AccountID]roundtrip.ClientDebugInfo {
+	return nil
+}
+
+func (p *perfProvider) ListClientsForStartup() map[types.AccountID]*nbembed.Client {
+	out := make(map[types.AccountID]*nbembed.Client, len(p.accounts))
+	for _, id := range p.accounts {
+		out[id] = nil
+	}
+	return out
+}
+
+type stubHealth struct{}
+
+func (stubHealth) ReadinessProbe() bool              { return true }
+func (stubHealth) StartupProbe(context.Context) bool { return true }
+func (stubHealth) CheckClientsConnected(context.Context) (bool, map[types.AccountID]health.ClientHealth) {
+	return true, nil
+}
+
+func shortenPerfTimeout(t *testing.T, d time.Duration) {
+	t.Helper()
+	prev := perfApplyTimeout
+	perfApplyTimeout = d
+	t.Cleanup(func() { perfApplyTimeout = prev })
+}
+
+// TestCollectBufferedCountsResultsReadyAtTheDeadline covers the select-ordering
+// trap: when the deadline fires, results already buffered must be counted, not
+// reported as timeouts. Driving collectBuffered directly keeps it deterministic
+// - through applyBufferCap the two select cases race by construction.
+func TestCollectBufferedCountsResultsReadyAtTheDeadline(t *testing.T) {
+	results := make(chan perfResult, 3)
+	results <- perfResult{accountID: "ok"}
+	results <- perfResult{accountID: "broken", err: errors.New("boom")}
+
+	pending := map[types.AccountID]*perfWorker{
+		"ok":     {done: make(chan struct{})},
+		"broken": {done: make(chan struct{})},
+		"wedged": {done: make(chan struct{})},
+	}
+	failed := map[string]string{}
+
+	applied := collectBuffered(results, pending, failed)
+
+	if applied != 1 {
+		t.Fatalf("applied = %d, want 1", applied)
+	}
+	if failed["broken"] != "boom" {
+		t.Fatalf("failed = %v, want the error recorded for \"broken\"", failed)
+	}
+	if _, ok := pending["wedged"]; !ok || len(pending) != 1 {
+		t.Fatalf("pending = %v, want only the account that never answered", pending)
+	}
+}
+
+// TestApplyBufferCapSingleFlightPerAccount covers the goroutine accumulation
+// reported on PR #7452: repeated calls against a client stuck in its own lock
+// must not start a second attempt for the same account.
+func TestApplyBufferCapSingleFlightPerAccount(t *testing.T) {
+	shortenPerfTimeout(t, 50*time.Millisecond)
+
+	release := make(chan struct{})
+	t.Cleanup(func() { close(release) })
+
+	var calls atomic.Int32
+	h := &Handler{
+		provider: &perfProvider{accounts: []types.AccountID{"wedged"}},
+		health:   stubHealth{},
+		setPerformance: func(_ *nbembed.Client, _ uint32) error {
+			calls.Add(1)
+			<-release
+			return nil
+		},
+	}
+
+	for i := range 5 {
+		applied, failed, inFlight := h.applyBufferCap(4096)
+		if applied != 0 {
+			t.Fatalf("call %d: applied = %d, want 0", i, applied)
+		}
+		if i == 0 {
+			if len(failed) != 1 {
+				t.Fatalf("first call: failed = %v, want the account reported as timed out", failed)
+			}
+			continue
+		}
+		if len(inFlight) != 1 {
+			t.Fatalf("call %d: inFlight = %v, want the account reported as still running", i, inFlight)
+		}
+		if len(failed) != 0 {
+			t.Fatalf("call %d: failed = %v, want empty while the retune is in flight", i, failed)
+		}
+	}
+
+	if got := calls.Load(); got != 1 {
+		t.Fatalf("setPerformance called %d times, want 1: each retry started another blocked worker", got)
+	}
+}
+
+// TestResolvePendingTrustsFinishedWorkers covers the reporting race cubic
+// flagged on PR #7452: a retune that finished just before the deadline must be
+// reported by its outcome, not as a timeout, whatever the results channel has
+// delivered so far.
+func TestResolvePendingTrustsFinishedWorkers(t *testing.T) {
+	ok := &perfWorker{done: make(chan struct{})}
+	close(ok.done)
+
+	broken := &perfWorker{done: make(chan struct{}), err: errors.New("boom")}
+	close(broken.done)
+
+	stillRunning := &perfWorker{done: make(chan struct{})}
+
+	pending := map[types.AccountID]*perfWorker{
+		"ok":      ok,
+		"broken":  broken,
+		"running": stillRunning,
+	}
+	failed := map[string]string{}
+
+	applied := resolvePending(pending, failed)
+
+	if applied != 1 {
+		t.Fatalf("applied = %d, want 1", applied)
+	}
+	if failed["broken"] != "boom" {
+		t.Fatalf("failed[broken] = %q, want the worker's own error", failed["broken"])
+	}
+	if _, ok := failed["ok"]; ok {
+		t.Fatalf("failed = %v, want no entry for the account that succeeded", failed)
+	}
+	if got := failed["running"]; got == "" || got == "boom" {
+		t.Fatalf("failed[running] = %q, want the timeout message", got)
+	}
+}
diff --git a/proxy/internal/llm/bedrock.go b/proxy/internal/llm/bedrock.go
index f7802beb2..eb64167a1 100644
--- a/proxy/internal/llm/bedrock.go
+++ b/proxy/internal/llm/bedrock.go
@@ -56,10 +56,12 @@ type bedrockResponse struct {
 		OutputTokens             int64 `json:"output_tokens"`
 		CacheReadInputTokens     int64 `json:"cache_read_input_tokens"`
 		CacheCreationInputTokens int64 `json:"cache_creation_input_tokens"`
-		// Converse — camelCase.
-		InputTokensCamel  int64 `json:"inputTokens"`
-		OutputTokensCamel int64 `json:"outputTokens"`
-		TotalTokensCamel  int64 `json:"totalTokens"`
+		// Converse — camelCase; cache buckets are additive to inputTokens (AWS names the write bucket cacheWriteInputTokens).
+		InputTokensCamel      int64 `json:"inputTokens"`
+		OutputTokensCamel     int64 `json:"outputTokens"`
+		TotalTokensCamel      int64 `json:"totalTokens"`
+		CacheReadTokensCamel  int64 `json:"cacheReadInputTokens"`
+		CacheWriteTokensCamel int64 `json:"cacheWriteInputTokens"`
 	} `json:"usage"`
 }
 
@@ -83,16 +85,18 @@ func (BedrockParser) ParseResponse(status int, contentType string, body []byte)
 	}
 	inTok := firstNonZero(resp.Usage.InputTokens, resp.Usage.InputTokensCamel)
 	outTok := firstNonZero(resp.Usage.OutputTokens, resp.Usage.OutputTokensCamel)
+	cacheRead := firstNonZero(resp.Usage.CacheReadInputTokens, resp.Usage.CacheReadTokensCamel)
+	cacheWrite := firstNonZero(resp.Usage.CacheCreationInputTokens, resp.Usage.CacheWriteTokensCamel)
 	total := resp.Usage.TotalTokensCamel
 	if total == 0 {
-		total = inTok + outTok + resp.Usage.CacheReadInputTokens + resp.Usage.CacheCreationInputTokens
+		total = inTok + outTok + cacheRead + cacheWrite
 	}
 	return Usage{
 		InputTokens:         inTok,
 		OutputTokens:        outTok,
 		TotalTokens:         total,
-		CachedInputTokens:   resp.Usage.CacheReadInputTokens,
-		CacheCreationTokens: resp.Usage.CacheCreationInputTokens,
+		CachedInputTokens:   cacheRead,
+		CacheCreationTokens: cacheWrite,
 	}, nil
 }
 
diff --git a/proxy/internal/llm/bedrock_test.go b/proxy/internal/llm/bedrock_test.go
index ca6f092f3..e99ee55df 100644
--- a/proxy/internal/llm/bedrock_test.go
+++ b/proxy/internal/llm/bedrock_test.go
@@ -26,6 +26,18 @@ func TestBedrockParser_ParseResponse_Converse(t *testing.T) {
 	require.Equal(t, int64(14), u.TotalTokens, "converse uses provider total")
 }
 
+// Converse camelCase cache fields must land in the billed Usage buckets, same as the InvokeModel snake_case fields.
+func TestBedrockParser_ParseResponse_ConverseCacheBuckets(t *testing.T) {
+	body := []byte(`{"usage":{"inputTokens":11,"outputTokens":3,"cacheReadInputTokens":7,"cacheWriteInputTokens":9}}`)
+	u, err := BedrockParser{}.ParseResponse(200, "application/json", body)
+	require.NoError(t, err)
+	require.Equal(t, int64(11), u.InputTokens, "converse input tokens")
+	require.Equal(t, int64(3), u.OutputTokens, "converse output tokens")
+	require.Equal(t, int64(7), u.CachedInputTokens, "converse cache-read tokens")
+	require.Equal(t, int64(9), u.CacheCreationTokens, "converse cache-write tokens")
+	require.Equal(t, int64(11+3+7+9), u.TotalTokens, "total backfill is additive when the provider omits totalTokens")
+}
+
 func TestBedrockParser_ParseResponse_StreamingUnsupported(t *testing.T) {
 	_, err := BedrockParser{}.ParseResponse(200, "application/vnd.amazon.eventstream", []byte("binary"))
 	require.ErrorIs(t, err, ErrStreamingUnsupported, "event-stream must route to the streaming accumulator")
diff --git a/proxy/internal/llm/fixtures/pricing.yaml b/proxy/internal/llm/fixtures/pricing.yaml
deleted file mode 100644
index 3d26ff803..000000000
--- a/proxy/internal/llm/fixtures/pricing.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-# Realistic-pricing starter for llm_observability. Drop this into the
-# directory you point the proxy at via --plugin-data-dir, then reference it
-# from the target's plugin config:
-#
-#   plugins:
-#     - id: llm_observability
-#       enabled: true
-#       params:
-#         pricing_path: pricing.yaml
-#
-# Values are USD per 1_000 tokens. Public list prices drift; treat this as a
-# starting point and keep your production copy current.
-
-openai:
-  # GPT-5 family
-  gpt-5:
-    input_per_1k: 0.00125
-    output_per_1k: 0.01
-  gpt-5-mini:
-    input_per_1k: 0.00025
-    output_per_1k: 0.002
-  gpt-5-nano:
-    input_per_1k: 0.00005
-    output_per_1k: 0.0004
-  gpt-5.4:
-    input_per_1k: 0.00125
-    output_per_1k: 0.01
-  # GPT-4o family
-  gpt-4o:
-    input_per_1k: 0.0025
-    output_per_1k: 0.01
-  gpt-4o-mini:
-    input_per_1k: 0.00015
-    output_per_1k: 0.0006
-  # Embeddings
-  text-embedding-3-large:
-    input_per_1k: 0.00013
-    output_per_1k: 0
-  text-embedding-3-small:
-    input_per_1k: 0.00002
-    output_per_1k: 0
-
-anthropic:
-  # Claude 4.x family
-  claude-opus-4-7:
-    input_per_1k: 0.015
-    output_per_1k: 0.075
-  claude-sonnet-4-7:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-  claude-sonnet-4-6:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-  claude-sonnet-4-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-  claude-haiku-4-5:
-    input_per_1k: 0.0008
-    output_per_1k: 0.004
diff --git a/proxy/internal/llm/model.go b/proxy/internal/llm/model.go
new file mode 100644
index 000000000..2e056a57a
--- /dev/null
+++ b/proxy/internal/llm/model.go
@@ -0,0 +1,29 @@
+package llm
+
+import (
+	sharedllm "github.com/netbirdio/netbird/shared/llm"
+)
+
+// NormalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
+// prefix, and the version/throughput suffix from a Bedrock model id so it
+// matches the catalog/pricing key. Thin delegate to the shared implementation
+// (shared/llm), which management also uses at synthesis time so both sides of
+// the pricing / routing contract normalize identically.
+func NormalizeBedrockModel(modelID string) string {
+	return sharedllm.NormalizeBedrockModel(modelID)
+}
+
+// NormalizeAnthropicModel strips the trailing "-YYYYMMDD" release-date suffix
+// from an Anthropic model id so a dated id a client pins matches the undated
+// one the operator registered. Thin delegate to shared/llm for the same
+// contract reason as the two below.
+func NormalizeAnthropicModel(modelID string) string {
+	return sharedllm.NormalizeAnthropicModel(modelID)
+}
+
+// NormalizeVertexModel strips the "@version" suffix from a Vertex AI model id
+// so it matches the catalog/pricing key. Thin delegate to shared/llm, kept
+// beside NormalizeBedrockModel for the same contract reason.
+func NormalizeVertexModel(modelID string) string {
+	return sharedllm.NormalizeVertexModel(modelID)
+}
diff --git a/proxy/internal/llm/pricing/defaults_coverage_test.go b/proxy/internal/llm/pricing/defaults_coverage_test.go
deleted file mode 100644
index be23682da..000000000
--- a/proxy/internal/llm/pricing/defaults_coverage_test.go
+++ /dev/null
@@ -1,65 +0,0 @@
-package pricing
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestDefaultTable_FirstPartyModelCoverage guards the embedded defaults against
-// silent drift/gaps: every metered first-party model the management catalog
-// enumerates must resolve to a price, and a few rates that previously drifted
-// are pinned to their LiteLLM-validated values. Keep this list in step with the
-// catalog (management/server/agentnetwork/catalog) when adding models.
-func TestDefaultTable_FirstPartyModelCoverage(t *testing.T) {
-	tbl := DefaultTable()
-	require.NotNil(t, tbl, "embedded default pricing table must load")
-
-	mustPrice := map[string][]string{
-		// openai parser covers openai_api, azure_openai_api, and mistral_api.
-		"openai": {
-			"gpt-5.5", "gpt-5.5-pro", "gpt-5.4", "gpt-5.4-mini", "gpt-5.4-nano",
-			"gpt-5.3-codex", "gpt-5.3-chat-latest", "o4-mini",
-			"gpt-4.1", "gpt-4.1-mini", "gpt-4.1-nano", "gpt-4o", "gpt-4o-mini",
-			"gpt-4-turbo", "gpt-3.5-turbo", "gpt-35-turbo",
-			"text-embedding-3-large", "text-embedding-3-small",
-			"mistral-large-latest", "mistral-medium-3-5", "codestral-2508",
-			"ministral-8b-latest", "mistral-embed",
-		},
-		"anthropic": {
-			"claude-fable-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6",
-			"claude-opus-4-1", "claude-sonnet-4-6", "claude-sonnet-4-5", "claude-haiku-4-5",
-		},
-		// bedrock keys are the normalized ids the request parser emits.
-		"bedrock": {
-			"anthropic.claude-opus-4-8", "anthropic.claude-opus-4-7", "anthropic.claude-opus-4-6",
-			"anthropic.claude-opus-4-1", "anthropic.claude-sonnet-4-6", "anthropic.claude-sonnet-4-5",
-			"anthropic.claude-haiku-4-5", "meta.llama3-3-70b-instruct",
-			"amazon.nova-pro", "amazon.nova-lite", "amazon.nova-micro", "amazon.nova-2-lite",
-		},
-	}
-	for provider, models := range mustPrice {
-		for _, m := range models {
-			_, ok := tbl.Cost(provider, m, 1000, 1000, 0, 0)
-			assert.True(t, ok, "%s/%s must be priced in the embedded defaults", provider, m)
-		}
-	}
-
-	// Pin per-direction rates independently (input-only then output-only) so a
-	// swap or skew of input<->output that preserves the combined total is still
-	// caught — these are rates that previously drifted or are easy to mis-enter.
-	in, ok := tbl.Cost("openai", "gpt-5.4", 1000, 0, 0, 0)
-	require.True(t, ok)
-	assert.InDelta(t, 0.0025, in, 1e-9, "gpt-5.4 input = 0.0025 per 1k")
-	out, ok := tbl.Cost("openai", "gpt-5.4", 0, 1000, 0, 0)
-	require.True(t, ok)
-	assert.InDelta(t, 0.015, out, 1e-9, "gpt-5.4 output = 0.015 per 1k")
-
-	in, ok = tbl.Cost("bedrock", "anthropic.claude-sonnet-4-5", 1000, 0, 0, 0)
-	require.True(t, ok)
-	assert.InDelta(t, 0.003, in, 1e-9, "bedrock sonnet-4-5 input = 0.003 per 1k")
-	out, ok = tbl.Cost("bedrock", "anthropic.claude-sonnet-4-5", 0, 1000, 0, 0)
-	require.True(t, ok)
-	assert.InDelta(t, 0.015, out, 1e-9, "bedrock sonnet-4-5 output = 0.015 per 1k")
-}
diff --git a/proxy/internal/llm/pricing/pricing.go b/proxy/internal/llm/pricing/pricing.go
index 09afec5ff..52cedb60e 100644
--- a/proxy/internal/llm/pricing/pricing.go
+++ b/proxy/internal/llm/pricing/pricing.go
@@ -1,102 +1,32 @@
-// Package pricing implements the embedded-default + override pricing table
-// shared by middleware that converts LLM token usage into a USD cost
-// estimate. The table is hot-reloadable from a basename under the proxy
-// data directory; missing override files keep the embedded defaults so
-// cost annotation works without operator action.
+// Package pricing implements the pricing table and cost formula the
+// cost_meter middleware uses to convert LLM token usage into a USD cost
+// estimate. The table's content arrives from the management server inside
+// cost_meter's middleware config (synthesized from the catalog plus the
+// operator's stored per-provider prices) — the proxy carries no embedded
+// price list. Price updates ride the ordinary mapping push: a chain
+// rebuild constructs a fresh table, so there is nothing to reload.
 package pricing
 
 import (
-	"bytes"
-	"context"
-	_ "embed"
-	"errors"
 	"fmt"
-	"io"
-	"io/fs"
 	"math"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
 
-	log "github.com/sirupsen/logrus"
-	"go.opentelemetry.io/otel/attribute"
-	"go.opentelemetry.io/otel/metric"
-	"gopkg.in/yaml.v3"
+	sharedllm "github.com/netbirdio/netbird/shared/llm"
 )
 
-//go:embed defaults_pricing.yaml
-var defaultPricingYAML []byte
-
-var (
-	defaultTableOnce sync.Once
-	defaultTablePtr  *Table
-)
-
-// DefaultTable returns the pricing table embedded in the binary. The result
-// is parsed once and shared; callers must not mutate the returned value.
-// Cost annotation works without any operator action because every loader
-// starts with this table.
-func DefaultTable() *Table {
-	defaultTableOnce.Do(func() {
-		t, err := parsePricingBytes(defaultPricingYAML)
-		if err != nil {
-			panic(fmt.Sprintf("llmobs: embedded default pricing failed to parse: %v", err))
-		}
-		defaultTablePtr = t
-	})
-	return defaultTablePtr
-}
-
-// mergeOver returns a new Table containing every entry from base, with any
-// matching entry from overlay replacing the base value. Either argument may
-// be nil. Result is a fresh allocation so callers can mutate / Store safely.
-func mergeOver(base, overlay *Table) *Table {
-	if overlay == nil || len(overlay.entries) == 0 {
-		return base
-	}
-	if base == nil || len(base.entries) == 0 {
-		return overlay
-	}
-	out := make(map[string]map[string]Entry, len(base.entries))
-	for provider, models := range base.entries {
-		inner := make(map[string]Entry, len(models))
-		for model, e := range models {
-			inner[model] = e
-		}
-		out[provider] = inner
-	}
-	for provider, models := range overlay.entries {
-		inner, ok := out[provider]
-		if !ok {
-			inner = make(map[string]Entry, len(models))
-			out[provider] = inner
-		}
-		for model, e := range models {
-			inner[model] = e
-		}
-	}
-	return &Table{entries: out}
-}
-
 // Entry is a single model's input and output pricing, expressed in USD per
 // 1000 tokens.
 //
 // CachedInputPer1K applies to OpenAI's cached prompt tokens, which are a
 // subset of input_tokens — when set, the cached portion is billed at this
 // rate and the non-cached remainder at InputPer1K. Zero means "no discount
-// configured", and cached tokens are billed at InputPer1K (matches current
-// behaviour where cached counts weren't extracted at all).
+// configured", and cached tokens are billed at InputPer1K.
 //
 // CacheReadPer1K and CacheCreationPer1K apply to Anthropic's two prompt-
 // cache fields, which are additive to input_tokens: cache_read is the
 // cheaper read-from-cache rate, cache_creation is the more expensive
 // write-to-cache rate. Zero means "no rate configured" and the
-// corresponding token bucket is billed at InputPer1K. This is more
-// accurate than today's behaviour, where Anthropic's cache tokens are
-// ignored and not charged at all.
+// corresponding token bucket is billed at InputPer1K.
 type Entry struct {
 	InputPer1K         float64
 	OutputPer1K        float64
@@ -105,29 +35,164 @@ type Entry struct {
 	CacheCreationPer1K float64
 }
 
-// Table is a provider-to-model pricing lookup. Instances are immutable once
-// built and are swapped atomically by Loader.
+// EntryJSON is the wire shape of a pricing entry inside cost_meter's
+// middleware config. Field names are the management→proxy contract; the
+// management synthesizer marshals the same names (its pricing.Entry).
+type EntryJSON struct {
+	InputPer1K         float64 `json:"input_per_1k"`
+	OutputPer1K        float64 `json:"output_per_1k"`
+	CachedInputPer1K   float64 `json:"cached_input_per_1k"`
+	CacheReadPer1K     float64 `json:"cache_read_per_1k"`
+	CacheCreationPer1K float64 `json:"cache_creation_per_1k"`
+}
+
+// Table is a provider-surface-to-model pricing lookup. Instances are
+// immutable once built; a mapping update builds a whole new middleware
+// instance (and with it a new table) rather than mutating this one.
 type Table struct {
 	entries map[string]map[string]Entry
 }
 
+// NewEntries validates and converts a wire-shape map (surface-or-record ->
+// model -> rates) into the internal representation. Every rate must be a
+// finite, non-negative USD amount; a violation is returned as an error so
+// a corrupt config fails the chain build loudly instead of mispricing.
+// Management validates the same constraints at its API boundary, so this
+// is defense-in-depth. Nil input yields an empty (never-matching) map.
+func NewEntries(raw map[string]map[string]EntryJSON) (map[string]map[string]Entry, error) {
+	out := make(map[string]map[string]Entry, len(raw))
+	for outer, models := range raw {
+		inner := make(map[string]Entry, len(models))
+		for model, e := range models {
+			for field, v := range map[string]float64{
+				"input_per_1k":          e.InputPer1K,
+				"output_per_1k":         e.OutputPer1K,
+				"cached_input_per_1k":   e.CachedInputPer1K,
+				"cache_read_per_1k":     e.CacheReadPer1K,
+				"cache_creation_per_1k": e.CacheCreationPer1K,
+			} {
+				if v < 0 || math.IsNaN(v) || math.IsInf(v, 0) {
+					return nil, fmt.Errorf("pricing %s/%s: %s must be a finite, non-negative rate, got %v", outer, model, field, v)
+				}
+			}
+			// EntryJSON and Entry are field-identical (tags aside), so a
+			// direct conversion carries all five rates.
+			inner[model] = Entry(e)
+		}
+		out[outer] = inner
+	}
+	return out, nil
+}
+
+// NewTable builds an immutable Table from the wire-shape defaults map.
+// See NewEntries for validation semantics.
+func NewTable(raw map[string]map[string]EntryJSON) (*Table, error) {
+	entries, err := NewEntries(raw)
+	if err != nil {
+		return nil, err
+	}
+	return &Table{entries: entries}, nil
+}
+
+// Lookup returns the entry for the given provider surface and model. A
+// dated Anthropic id falls back to its undated form, so a client pinning
+// "claude-sonnet-4-5-20250929" bills at the registered "claude-sonnet-4-5"
+// rate instead of recording no cost at all.
+func (t *Table) Lookup(provider, model string) (Entry, bool) {
+	if t == nil {
+		return Entry{}, false
+	}
+	byModel, ok := t.entries[provider]
+	if !ok {
+		return Entry{}, false
+	}
+	if e, found := byModel[model]; found {
+		return e, true
+	}
+	undated := sharedllm.NormalizeAnthropicModel(model)
+	if undated == model {
+		return Entry{}, false
+	}
+	e, ok := byModel[undated]
+	return e, ok
+}
+
+// Has reports whether the provider/model pair is present in the table.
+func (t *Table) Has(provider, model string) bool {
+	_, ok := t.Lookup(provider, model)
+	return ok
+}
+
 // Cost returns the estimated USD cost for the given token counts. ok is
 // false when the provider or model is not present in the table; the caller
 // can still emit token metrics with a model=unknown label.
+func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool) {
+	c, ok := t.Costs(provider, model, inTokens, outTokens, cachedInput, cacheCreation)
+	return c.TotalUSD, ok
+}
+
+// Costs returns the estimated USD cost split for the given token counts.
+// The provider surface selects the cache formula; see EntryCosts.
+func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool) {
+	entry, ok := t.Lookup(provider, model)
+	if !ok {
+		return Costs{}, false
+	}
+	return EntryCosts(entry, provider, inTokens, outTokens, cachedInput, cacheCreation), true
+}
+
+// Costs is a per-request cost split. The four per-bucket fields are the base
+// of the breakdown — one per token bucket the provider bills separately — and
+// the two aggregates are derived from them:
+//
+//	TotalUSD = InputUSD + CachedInputUSD + CacheCreationUSD + OutputUSD
+//	CacheUSD = CachedInputUSD + CacheCreationUSD
+//
+// InputUSD is always the cost of the *non-cached* input bucket, for both
+// provider shapes: on OpenAI the cached subset is carved out of inTokens and
+// billed as CachedInputUSD, so the two never double-count. Buckets a provider
+// doesn't bill are zero, which keeps the identities above true everywhere.
+type Costs struct {
+	InputUSD         float64
+	CachedInputUSD   float64
+	CacheCreationUSD float64
+	OutputUSD        float64
+	TotalUSD         float64
+	CacheUSD         float64
+}
+
+// newCosts assembles a split from its per-bucket parts, deriving the two
+// aggregates so TotalUSD and CacheUSD can never drift from the breakdown.
+func newCosts(input, cachedInput, cacheCreation, output float64) Costs {
+	return Costs{
+		InputUSD:         input,
+		CachedInputUSD:   cachedInput,
+		CacheCreationUSD: cacheCreation,
+		OutputUSD:        output,
+		TotalUSD:         input + cachedInput + cacheCreation + output,
+		CacheUSD:         cachedInput + cacheCreation,
+	}
+}
+
+// EntryCosts computes the USD cost split for the given entry and token
+// counts. The surface (the llm.provider value the request parser stamps)
+// selects the cache formula; the entry may come from the surface-keyed
+// defaults table or from a per-provider-record override — the math is
+// identical either way.
 //
 // Provider-shape semantics for cached / cache-creation counts:
 //
-//   - OpenAI: cachedInput is a SUBSET of inTokens. The cached portion is
+//   - "openai": cachedInput is a SUBSET of inTokens. The cached portion is
 //     billed at CachedInputPer1K (or InputPer1K when no override), and the
 //     non-cached remainder of inTokens at InputPer1K. cacheCreation is
 //     ignored (OpenAI has no analogue).
-//   - Anthropic: cachedInput (cache_read) and cacheCreation are ADDITIVE to
-//     inTokens. The three buckets are billed at CacheReadPer1K,
+//   - "anthropic", "bedrock": cachedInput (cache_read) and cacheCreation are
+//     ADDITIVE to inTokens. The three buckets are billed at CacheReadPer1K,
 //     CacheCreationPer1K, and InputPer1K respectively, each falling back
 //     to InputPer1K when the corresponding rate is zero.
-//   - Other providers: cached and cacheCreation are ignored; cost is
+//   - Other surfaces: cached and cacheCreation are ignored; cost is
 //     inTokens*InputPer1K + outTokens*OutputPer1K.
-func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool) {
+func EntryCosts(entry Entry, surface string, inTokens, outTokens, cachedInput, cacheCreation int64) Costs {
 	// Clamp negatives to zero before any pricing math so a malformed
 	// upstream count can never produce a negative cost.
 	if inTokens < 0 {
@@ -142,19 +207,8 @@ func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, c
 	if cacheCreation < 0 {
 		cacheCreation = 0
 	}
-	if t == nil {
-		return 0, false
-	}
-	byModel, ok := t.entries[provider]
-	if !ok {
-		return 0, false
-	}
-	entry, ok := byModel[model]
-	if !ok {
-		return 0, false
-	}
 	output := (float64(outTokens) / 1000.0) * entry.OutputPer1K
-	switch provider {
+	switch surface {
 	case "openai":
 		// cachedInput is a subset of inTokens; clamp so a malformed
 		// upstream (cached > total) can't produce a negative remainder.
@@ -168,7 +222,7 @@ func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, c
 		}
 		nonCached := float64(inTokens-clamped) / 1000.0 * entry.InputPer1K
 		cached := float64(clamped) / 1000.0 * cachedRate
-		return nonCached + cached + output, true
+		return newCosts(nonCached, cached, 0, output)
 	case "anthropic", "bedrock":
 		// Bedrock-Anthropic returns the same additive cache buckets as
 		// first-party Anthropic; non-Anthropic Bedrock models simply report
@@ -184,266 +238,9 @@ func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, c
 		input := float64(inTokens) / 1000.0 * entry.InputPer1K
 		read := float64(cachedInput) / 1000.0 * readRate
 		create := float64(cacheCreation) / 1000.0 * createRate
-		return input + read + create + output, true
+		return newCosts(input, read, create, output)
 	default:
 		input := float64(inTokens) / 1000.0 * entry.InputPer1K
-		return input + output, true
+		return newCosts(input, 0, 0, output)
 	}
 }
-
-// Has reports whether the provider/model pair is present in the table.
-func (t *Table) Has(provider, model string) bool {
-	if t == nil {
-		return false
-	}
-	byModel, ok := t.entries[provider]
-	if !ok {
-		return false
-	}
-	_, ok = byModel[model]
-	return ok
-}
-
-// pricingFile mirrors the on-disk YAML schema. Keys are provider names; the
-// nested map keys are model names.
-type pricingFile map[string]map[string]struct {
-	InputPer1K         float64 `yaml:"input_per_1k"`
-	OutputPer1K        float64 `yaml:"output_per_1k"`
-	CachedInputPer1K   float64 `yaml:"cached_input_per_1k"`
-	CacheReadPer1K     float64 `yaml:"cache_read_per_1k"`
-	CacheCreationPer1K float64 `yaml:"cache_creation_per_1k"`
-}
-
-const (
-	// ReloadInterval is the mtime-poll cadence for the background reloader.
-	ReloadInterval = 30 * time.Second
-
-	// errorBackoff bounds how often the loader logs a repeated parse error.
-	errorBackoff = 5 * time.Minute
-)
-
-var basenameRegex = regexp.MustCompile(`^[a-zA-Z0-9._-]+$`)
-
-// Loader is a confined, hot-reloadable pricing table reader. Construction
-// must succeed against the target file; subsequent reload failures keep the
-// previously-loaded table so callers never observe a blank price list.
-type Loader struct {
-	baseDir  string
-	fullPath string
-	pluginID string
-	table    atomic.Pointer[Table]
-	mtime    atomic.Int64
-	failures metric.Int64Counter
-	interval time.Duration
-}
-
-// NewLoader returns a pricing loader that overlays an optional file-based
-// table on top of the embedded defaults. Missing override file, baseDir, or
-// relPath is not an error: the loader keeps the embedded defaults so cost
-// metadata is still emitted for known models.
-//
-// Errors:
-//   - bad basename, traversal segment, or absolute relPath are rejected so a
-//     misconfigured target surfaces immediately.
-//   - permission errors and YAML parse errors keep the defaults but log a
-//     warning; cost annotation does not silently break.
-//
-// failures is optional; pass nil in tests that do not care about
-// reload-failure telemetry.
-func NewLoader(baseDir, relPath, pluginID string, failures metric.Int64Counter) (*Loader, error) {
-	defaults := DefaultTable()
-	l := &Loader{
-		baseDir:  baseDir,
-		pluginID: pluginID,
-		failures: failures,
-	}
-	l.table.Store(defaults)
-
-	if strings.TrimSpace(baseDir) == "" || strings.TrimSpace(relPath) == "" {
-		return l, nil
-	}
-
-	full, err := resolveMiddlewareDataPath(baseDir, relPath)
-	if err != nil {
-		return nil, err
-	}
-	l.fullPath = full
-
-	overlay, mtime, err := loadPricing(full)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			// Override file is optional. Defaults already stored.
-			return l, nil
-		}
-		// Symlink rejection, oversize file, parse failure, permission errors
-		// — surface so a misconfigured operator sees the problem instead of
-		// silently running with stale defaults.
-		return nil, fmt.Errorf("load pricing %s: %w", full, err)
-	}
-	l.table.Store(mergeOver(defaults, overlay))
-	l.mtime.Store(mtime.UnixNano())
-	return l, nil
-}
-
-// Get returns the current pricing table. The returned pointer is immutable;
-// callers must not mutate its contents.
-func (l *Loader) Get() *Table {
-	if l == nil {
-		return nil
-	}
-	return l.table.Load()
-}
-
-// WatchesFile reports whether this loader is bound to an override file on
-// disk. False for defaults-only loaders (no operator override given).
-// Callers use this to decide whether to spawn the mtime-poll goroutine.
-func (l *Loader) WatchesFile() bool {
-	if l == nil {
-		return false
-	}
-	return l.fullPath != ""
-}
-
-// SetReloadInterval overrides the mtime-poll cadence used by Reload. Calls
-// after Reload has started have no effect on the running loop. Intended for
-// tests; production code uses the default ReloadInterval.
-func (l *Loader) SetReloadInterval(d time.Duration) {
-	if l == nil || d <= 0 {
-		return
-	}
-	l.interval = d
-}
-
-// Reload runs a polling loop that checks the pricing file mtime every
-// ReloadInterval (or the value passed to SetReloadInterval). Returns when
-// ctx is cancelled.
-func (l *Loader) Reload(ctx context.Context) {
-	if l == nil {
-		return
-	}
-	interval := l.interval
-	if interval <= 0 {
-		interval = ReloadInterval
-	}
-	t := time.NewTicker(interval)
-	defer t.Stop()
-
-	var lastErrAt time.Time
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-t.C:
-			if err := l.reload(); err != nil {
-				if l.failures != nil {
-					l.failures.Add(ctx, 1, metric.WithAttributes(
-						attribute.String("plugin", l.pluginID),
-					))
-				}
-				now := time.Now()
-				if now.Sub(lastErrAt) >= errorBackoff {
-					log.Warnf("llmobs: pricing reload failed for %s: %v", l.fullPath, err)
-					lastErrAt = now
-				}
-			}
-		}
-	}
-}
-
-// reload performs a single-shot mtime check and reload. The reloaded
-// override file is merged on top of the embedded defaults; missing override
-// (e.g. operator deleted the file) is not an error and reverts to defaults.
-func (l *Loader) reload() error {
-	if l.fullPath == "" {
-		// Defaults-only loader; nothing on disk to reload.
-		return nil
-	}
-	mtime, err := statMtime(l.fullPath)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			// File was removed since startup. Drop back to defaults and
-			// reset mtime so a future re-creation triggers a reload.
-			l.table.Store(DefaultTable())
-			l.mtime.Store(0)
-			return nil
-		}
-		return err
-	}
-	if mtime.UnixNano() == l.mtime.Load() {
-		return nil
-	}
-
-	overlay, newMtime, err := loadPricing(l.fullPath)
-	if err != nil {
-		return err
-	}
-	l.table.Store(mergeOver(DefaultTable(), overlay))
-	l.mtime.Store(newMtime.UnixNano())
-	return nil
-}
-
-// resolveMiddlewareDataPath validates relPath is a safe basename and resolves
-// it under baseDir. An additional cleaned-prefix check guards against
-// CVE-style edge cases where Join is used with trailing path segments.
-func resolveMiddlewareDataPath(baseDir, relPath string) (string, error) {
-	if strings.TrimSpace(baseDir) == "" {
-		return "", errors.New("middleware-data-dir is not configured")
-	}
-	if relPath == "" {
-		return "", errors.New("pricing path is empty")
-	}
-	if !basenameRegex.MatchString(relPath) {
-		return "", fmt.Errorf("pricing path %q is not a safe basename", relPath)
-	}
-	if filepath.IsAbs(relPath) {
-		return "", fmt.Errorf("pricing path %q must be a basename, not absolute", relPath)
-	}
-
-	cleanBase, err := filepath.Abs(filepath.Clean(baseDir))
-	if err != nil {
-		return "", fmt.Errorf("resolve middleware-data-dir: %w", err)
-	}
-	full := filepath.Join(cleanBase, relPath)
-	cleanedFull := filepath.Clean(full)
-	if !strings.HasPrefix(cleanedFull, cleanBase+string(filepath.Separator)) && cleanedFull != cleanBase {
-		return "", fmt.Errorf("pricing path %q escapes middleware-data-dir", relPath)
-	}
-	return cleanedFull, nil
-}
-
-func parsePricingBytes(data []byte) (*Table, error) {
-	dec := yaml.NewDecoder(bytes.NewReader(data))
-	dec.KnownFields(true)
-
-	var raw pricingFile
-	if err := dec.Decode(&raw); err != nil && !errors.Is(err, io.EOF) {
-		return nil, fmt.Errorf("decode pricing yaml: %w", err)
-	}
-
-	out := make(map[string]map[string]Entry, len(raw))
-	for provider, models := range raw {
-		inner := make(map[string]Entry, len(models))
-		for model, entry := range models {
-			for field, v := range map[string]float64{
-				"input_per_1k":          entry.InputPer1K,
-				"output_per_1k":         entry.OutputPer1K,
-				"cached_input_per_1k":   entry.CachedInputPer1K,
-				"cache_read_per_1k":     entry.CacheReadPer1K,
-				"cache_creation_per_1k": entry.CacheCreationPer1K,
-			} {
-				if v < 0 || math.IsNaN(v) || math.IsInf(v, 0) {
-					return nil, fmt.Errorf("pricing %s/%s: %s must be a finite, non-negative rate, got %v", provider, model, field, v)
-				}
-			}
-			inner[model] = Entry{
-				InputPer1K:         entry.InputPer1K,
-				OutputPer1K:        entry.OutputPer1K,
-				CachedInputPer1K:   entry.CachedInputPer1K,
-				CacheReadPer1K:     entry.CacheReadPer1K,
-				CacheCreationPer1K: entry.CacheCreationPer1K,
-			}
-		}
-		out[provider] = inner
-	}
-	return &Table{entries: out}, nil
-}
diff --git a/proxy/internal/llm/pricing/pricing_other.go b/proxy/internal/llm/pricing/pricing_other.go
deleted file mode 100644
index e65fffff1..000000000
--- a/proxy/internal/llm/pricing/pricing_other.go
+++ /dev/null
@@ -1,20 +0,0 @@
-//go:build !unix
-
-package pricing
-
-import (
-	"fmt"
-	"time"
-)
-
-// loadPricing is unavailable on non-Unix platforms because O_NOFOLLOW and
-// fstat-from-FD are required to honour the spec's symlink-safety rules. The
-// proxy is only deployed on Linux today; a Windows port would need an
-// equivalent path-as-handle implementation.
-func loadPricing(path string) (*Table, time.Time, error) {
-	return nil, time.Time{}, fmt.Errorf("llmobs pricing loader is not supported on this platform: %s", path)
-}
-
-func statMtime(path string) (time.Time, error) {
-	return time.Time{}, fmt.Errorf("llmobs pricing loader is not supported on this platform: %s", path)
-}
diff --git a/proxy/internal/llm/pricing/pricing_test.go b/proxy/internal/llm/pricing/pricing_test.go
index 7ac2a85dc..e7d339f06 100644
--- a/proxy/internal/llm/pricing/pricing_test.go
+++ b/proxy/internal/llm/pricing/pricing_test.go
@@ -1,47 +1,13 @@
-//go:build unix
-
 package pricing
 
 import (
-	"context"
-	"os"
-	"path/filepath"
+	"math"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-func copyFixture(t *testing.T, src, dst string) {
-	t.Helper()
-	data, err := os.ReadFile(src)
-	require.NoError(t, err, "read source fixture")
-	require.NoError(t, os.WriteFile(dst, data, 0o600), "write target fixture")
-}
-
-func TestNewLoader_HappyPath(t *testing.T) {
-	base := t.TempDir()
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
-
-	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.NoError(t, err, "NewLoader must succeed with a valid fixture")
-	table := l.Get()
-	require.NotNil(t, table, "table populated after load")
-
-	cost, ok := table.Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
-	require.True(t, ok, "known provider/model resolves")
-	assert.InDelta(t, 0.00075, cost, 1e-9, "cost = 0.00015 + 0.0006 per 1k tokens")
-
-	cost, ok = table.Cost("openai", "gpt-4o", 2000, 1000, 0, 0)
-	require.True(t, ok, "second known model resolves")
-	assert.InDelta(t, 0.015, cost, 1e-9, "cost for gpt-4o: 2*0.0025 + 1*0.01")
-
-	cost, ok = table.Cost("anthropic", "claude-sonnet-4-5", 1000, 1000, 0, 0)
-	require.True(t, ok, "anthropic model resolves")
-	assert.InDelta(t, 0.018, cost, 1e-9, "cost for claude-sonnet-4-5: 0.003 + 0.015")
-}
-
 // TestCost_OpenAICachedSubsetDiscount proves OpenAI's cached input
 // tokens are billed at the configured cached_input_per_1k rate while
 // the non-cached remainder of input_tokens is billed at the regular
@@ -65,11 +31,9 @@ func TestCost_OpenAICachedSubsetDiscount(t *testing.T) {
 		"cached subset must bill at the discount rate; non-cached remainder at regular rate")
 }
 
-// TestCost_OpenAICachedFallsBackToInputRate covers the operator
-// opt-in contract: when CachedInputPer1K is unset (zero), cached
-// tokens bill at the regular input rate. This matches today's
-// behaviour (cached counts weren't extracted at all so they
-// implicitly billed at the input rate via prompt_tokens).
+// TestCost_OpenAICachedFallsBackToInputRate covers the fallback
+// contract: when CachedInputPer1K is unset (zero), cached tokens bill
+// at the regular input rate.
 func TestCost_OpenAICachedFallsBackToInputRate(t *testing.T) {
 	tbl := &Table{entries: map[string]map[string]Entry{
 		"openai": {"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01}},
@@ -78,7 +42,7 @@ func TestCost_OpenAICachedFallsBackToInputRate(t *testing.T) {
 	require.True(t, ok)
 	want := 0.0025 + (500.0/1000.0)*0.01
 	assert.InDelta(t, want, cost, 1e-12,
-		"absent cached_input_per_1k rate must fall back to input_per_1k — same as pre-feature behaviour")
+		"absent cached_input_per_1k rate must fall back to input_per_1k")
 }
 
 // TestCost_OpenAIClampsCachedToInputCount is the defensive guard
@@ -100,10 +64,7 @@ func TestCost_OpenAIClampsCachedToInputCount(t *testing.T) {
 // TestCost_AnthropicCacheReadAndCreationAreAdditive proves the
 // Anthropic shape: cache_read and cache_creation tokens are
 // ADDITIVE to input_tokens (not subset), each billed at its own
-// configured rate. The two rates pull in opposite directions —
-// cache_read is the cheaper read-from-cache rate (≈0.1× input),
-// cache_creation is the more expensive write-to-cache rate
-// (≈1.25× input).
+// configured rate.
 func TestCost_AnthropicCacheReadAndCreationAreAdditive(t *testing.T) {
 	tbl := &Table{entries: map[string]map[string]Entry{
 		"anthropic": {"claude-sonnet": {
@@ -125,11 +86,9 @@ func TestCost_AnthropicCacheReadAndCreationAreAdditive(t *testing.T) {
 		"each Anthropic input bucket must bill at its own configured rate")
 }
 
-// TestCost_AnthropicCacheRatesFallBackToInput covers the no-opt-in
+// TestCost_AnthropicCacheRatesFallBackToInput covers the no-rate
 // path: when neither CacheReadPer1K nor CacheCreationPer1K is set,
-// cache tokens bill at the regular input rate. This is more
-// accurate than today's behaviour (cache tokens ignored entirely)
-// without requiring operators to opt in via YAML.
+// cache tokens bill at the regular input rate.
 func TestCost_AnthropicCacheRatesFallBackToInput(t *testing.T) {
 	tbl := &Table{entries: map[string]map[string]Entry{
 		"anthropic": {"claude-sonnet": {InputPer1K: 0.003, OutputPer1K: 0.015}},
@@ -139,259 +98,39 @@ func TestCost_AnthropicCacheRatesFallBackToInput(t *testing.T) {
 	// Without overrides: every input bucket at input_per_1k.
 	want := ((256.0+768.0+512.0)/1000.0)*0.003 + (200.0/1000.0)*0.015
 	assert.InDelta(t, want, cost, 1e-12,
-		"absent cache rates must fall back to input_per_1k — Anthropic cache tokens were ignored before this change, billing at input rate is more accurate as a default")
+		"absent cache rates must fall back to input_per_1k")
 }
 
-func TestNewLoader_UnknownModel(t *testing.T) {
-	base := t.TempDir()
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
+// TestEntryCosts_SurfaceSelectsFormula pins that the formula branches on
+// the SURFACE, not on which table the entry came from: the same entry
+// bills a subset carve-out on "openai", additive buckets on
+// "anthropic"/"bedrock", and ignores cache counts everywhere else. This
+// is what keeps per-provider-record entries (looked up by record id)
+// mathematically identical to defaults-table entries.
+func TestEntryCosts_SurfaceSelectsFormula(t *testing.T) {
+	e := Entry{InputPer1K: 0.002, OutputPer1K: 0.01, CachedInputPer1K: 0.001, CacheReadPer1K: 0.0002, CacheCreationPer1K: 0.0025}
 
-	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.NoError(t, err)
+	openai := EntryCosts(e, "openai", 1000, 0, 400, 300)
+	assert.InDelta(t, (600.0/1000.0)*0.002+(400.0/1000.0)*0.001, openai.TotalUSD, 1e-12,
+		"openai: cached is a subset, cacheCreation ignored")
 
-	_, ok := l.Get().Cost("openai", "fantasy-model", 10, 10, 0, 0)
-	assert.False(t, ok, "unknown model returns ok=false")
+	anthropic := EntryCosts(e, "anthropic", 1000, 0, 400, 300)
+	assert.InDelta(t, 0.002+(400.0/1000.0)*0.0002+(300.0/1000.0)*0.0025, anthropic.TotalUSD, 1e-12,
+		"anthropic: cache buckets are additive")
 
-	_, ok = l.Get().Cost("cohere", "anything", 10, 10, 0, 0)
-	assert.False(t, ok, "unknown provider returns ok=false")
+	bedrock := EntryCosts(e, "bedrock", 1000, 0, 400, 300)
+	assert.InDelta(t, anthropic.TotalUSD, bedrock.TotalUSD, 1e-12, "bedrock shares the anthropic formula")
+
+	other := EntryCosts(e, "gemini", 1000, 0, 400, 300)
+	assert.InDelta(t, 0.002, other.TotalUSD, 1e-12, "unknown surface: cache counts ignored")
 }
 
-func TestNewLoader_InvalidYAMLRejected(t *testing.T) {
-	base := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(base, "pricing.yaml"), []byte("\t- this is not: valid: yaml: :["), 0o600))
-
-	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.Error(t, err, "invalid YAML must surface as construction error")
-}
-
-func TestLoader_ReloadKeepsPreviousOnParseError(t *testing.T) {
-	base := t.TempDir()
-	target := filepath.Join(base, "pricing.yaml")
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
-
-	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.NoError(t, err)
-	require.NotNil(t, l.Get(), "initial table populated")
-
-	// Overwrite with content that violates the strict schema (extra field)
-	// plus a bumped mtime to trigger reload.
-	require.NoError(t, os.WriteFile(target, []byte("openai:\n  gpt-4o:\n    input_per_1k: 1.0\n    output_per_1k: 2.0\n    bogus_field: nope\n"), 0o600))
-	future := time.Now().Add(time.Hour)
-	require.NoError(t, os.Chtimes(target, future, future))
-
-	err = l.reload()
-	require.Error(t, err, "parse error surfaced by reload()")
-
-	cost, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
-	require.True(t, ok, "previous table still available after parse failure")
-	assert.InDelta(t, 0.00075, cost, 1e-9, "previous cost preserved")
-}
-
-func TestLoader_ReloadNoChangeIsNoOp(t *testing.T) {
-	base := t.TempDir()
-	target := filepath.Join(base, "pricing.yaml")
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
-
-	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.NoError(t, err)
-	ptrBefore := l.Get()
-
-	require.NoError(t, l.reload(), "no-change reload must not error")
-	ptrAfter := l.Get()
-	assert.Same(t, ptrBefore, ptrAfter, "table pointer unchanged when mtime unchanged")
-}
-
-func TestLoader_ReloadDetectsChange(t *testing.T) {
-	base := t.TempDir()
-	target := filepath.Join(base, "pricing.yaml")
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
-
-	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.NoError(t, err)
-
-	updated := []byte("openai:\n  gpt-4o-mini:\n    input_per_1k: 1.00\n    output_per_1k: 2.00\n")
-	require.NoError(t, os.WriteFile(target, updated, 0o600))
-	future := time.Now().Add(time.Hour)
-	require.NoError(t, os.Chtimes(target, future, future))
-
-	require.NoError(t, l.reload(), "reload must succeed on valid new content")
-
-	cost, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
-	require.True(t, ok, "updated model still present")
-	assert.InDelta(t, 3.0, cost, 0.0001, "new prices are applied: 1 + 2 per 1k")
-}
-
-// TestLoader_ReloadGoroutinePicksUpChanges proves the background goroutine
-// started via Reload actually swaps the pricing table when the file changes
-// on disk. Without that goroutine running, pricing edits would never reach
-// requests until a proxy restart.
-func TestLoader_ReloadGoroutinePicksUpChanges(t *testing.T) {
-	base := t.TempDir()
-	target := filepath.Join(base, "pricing.yaml")
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
-
-	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.NoError(t, err)
-	l.SetReloadInterval(20 * time.Millisecond)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	done := make(chan struct{})
-	go func() {
-		l.Reload(ctx)
-		close(done)
-	}()
-
-	// Before any rewrite, the loader holds the fixture's prices.
-	costBefore, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
-	require.True(t, ok, "fixture model must resolve initially")
-	assert.InDelta(t, 0.00075, costBefore, 1e-9, "fixture prices apply before rewrite")
-
-	updated := []byte("openai:\n  gpt-4o-mini:\n    input_per_1k: 1.00\n    output_per_1k: 2.00\n")
-	require.NoError(t, os.WriteFile(target, updated, 0o600))
-	future := time.Now().Add(time.Hour)
-	require.NoError(t, os.Chtimes(target, future, future))
-
-	deadline := time.Now().Add(2 * time.Second)
-	for {
-		cost, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
-		if ok && cost > 2.5 {
-			break
-		}
-		if time.Now().After(deadline) {
-			t.Fatalf("background reloader did not pick up rewrite within deadline")
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	cancel()
-	select {
-	case <-done:
-	case <-time.After(2 * time.Second):
-		t.Fatal("Reload loop did not exit after cancel")
-	}
-}
-
-func TestLoader_ReloadBackgroundLoopCancellation(t *testing.T) {
-	base := t.TempDir()
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
-	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.NoError(t, err)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan struct{})
-	go func() {
-		l.Reload(ctx)
-		close(done)
-	}()
-	cancel()
-
-	select {
-	case <-done:
-	case <-time.After(2 * time.Second):
-		t.Fatal("Reload loop did not exit on context cancel")
-	}
-}
-
-func TestNewLoader_PathValidation(t *testing.T) {
-	base := t.TempDir()
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
-
-	cases := []struct {
-		name    string
-		relPath string
-	}{
-		{"traversal", "../../etc/passwd"},
-		{"absolute", "/etc/passwd"},
-		{"slash in basename", "sub/pricing.yaml"},
-		{"control chars", "pricing\x00.yaml"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			_, err := NewLoader(base, tc.relPath, "llm_observability", nil)
-			require.Error(t, err, "NewLoader must reject %q", tc.relPath)
-		})
-	}
-
-	// Empty relPath is no longer a validation error: the loader treats it
-	// as "no override file, defaults only" so cost metadata is still
-	// emitted for the embedded models out of the box.
-	t.Run("empty falls back to defaults", func(t *testing.T) {
-		l, err := NewLoader(base, "", "llm_observability", nil)
-		require.NoError(t, err, "empty relPath should yield a defaults-only loader")
-		require.NotNil(t, l, "loader must be returned")
-		require.False(t, l.WatchesFile(), "no file watching when no override is given")
-		_, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
-		assert.True(t, ok, "embedded defaults should still resolve gpt-4o-mini")
-	})
-}
-
-// TestNewLoader_PathValidation_Extended covers the remaining attack shapes
-// called out in C2: dot references, embedded traversal segments, and a
-// newline in the basename. The basename regex must reject each one even
-// though filepath.Clean would otherwise collapse them.
-func TestNewLoader_PathValidation_Extended(t *testing.T) {
-	base := t.TempDir()
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
-
-	cases := []struct {
-		name    string
-		relPath string
-	}{
-		{"dot", "."},
-		{"dotdot", ".."},
-		{"relative traversal", "../pricing.yaml"},
-		{"embedded slash", "pri/cing.yaml"},
-		{"newline", "pricing\n.yaml"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			_, err := NewLoader(base, tc.relPath, "llm_observability", nil)
-			require.Error(t, err, "NewLoader must reject %q", tc.relPath)
-		})
-	}
-}
-
-// TestNewLoader_ValidBasenameLoads proves the allowlist is exclusive: a
-// basename containing only safe characters under baseDir loads. Without this
-// a regression that over-tightened the regex would silently break valid
-// deployments.
-func TestNewLoader_ValidBasenameLoads(t *testing.T) {
-	base := t.TempDir()
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing-v2_prod.yaml"))
-
-	l, err := NewLoader(base, "pricing-v2_prod.yaml", "llm_observability", nil)
-	require.NoError(t, err, "basename with _, -, . must load")
-	require.NotNil(t, l.Get(), "table populated")
-}
-
-// TestNewLoader_SymlinkOutsideBaseDirRejected constructs a symlink under
-// baseDir that points to a file outside it. O_NOFOLLOW must refuse to open
-// the symlink even though the symlink path itself is a valid basename under
-// baseDir.
-func TestNewLoader_SymlinkOutsideBaseDirRejected(t *testing.T) {
-	outside := t.TempDir()
-	target := filepath.Join(outside, "evil.yaml")
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
-
-	base := t.TempDir()
-	link := filepath.Join(base, "pricing.yaml")
-	require.NoError(t, os.Symlink(target, link), "symlink setup")
-
-	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.Error(t, err, "O_NOFOLLOW must reject symlink even when it points outside baseDir")
-}
-
-func TestNewLoader_SymlinkRejected(t *testing.T) {
-	base := t.TempDir()
-	concrete := filepath.Join(base, "real.yaml")
-	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), concrete)
-
-	link := filepath.Join(base, "pricing.yaml")
-	require.NoError(t, os.Symlink(concrete, link), "symlink setup")
-
-	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.Error(t, err, "O_NOFOLLOW must reject symlinked targets")
+// TestEntryCosts_ClampsNegativeTokens: malformed upstream counts must
+// never produce a negative cost.
+func TestEntryCosts_ClampsNegativeTokens(t *testing.T) {
+	e := Entry{InputPer1K: 0.002, OutputPer1K: 0.01}
+	c := EntryCosts(e, "openai", -50, -10, -5, -3)
+	assert.Zero(t, c.TotalUSD, "all-negative counts clamp to zero cost")
 }
 
 func TestTableCost_NilSafe(t *testing.T) {
@@ -402,31 +141,56 @@ func TestTableCost_NilSafe(t *testing.T) {
 	assert.False(t, t1.Has("x", "y"), "nil table has nothing")
 }
 
-func TestLoaderGet_NilSafe(t *testing.T) {
-	var l *Loader
-	assert.Nil(t, l.Get(), "nil loader returns nil table")
-}
-
-// TestNewLoader_RejectsOversizedFile_FixesM4 proves the loader bounds reads
-// at maxPricingBytes so a hostile file cannot exhaust process memory.
-func TestNewLoader_RejectsOversizedFile_FixesM4(t *testing.T) {
-	base := t.TempDir()
-	target := filepath.Join(base, "pricing.yaml")
-
-	// Build a YAML payload larger than the cap. We pad with valid YAML
-	// comments so a partial read would still fail the size check rather
-	// than the parser.
-	header := "openai:\n"
-	bigComment := make([]byte, maxPricingBytes+1024)
-	for i := range bigComment {
-		bigComment[i] = ' '
+func TestNewTable_ValidatesRates(t *testing.T) {
+	good := map[string]map[string]EntryJSON{
+		"openai": {"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01, CachedInputPer1K: 0.00125}},
 	}
-	bigComment[0] = '#'
-	bigComment[len(bigComment)-1] = '\n'
-	payload := append([]byte(header), bigComment...)
-	require.NoError(t, os.WriteFile(target, payload, 0o600))
+	tbl, err := NewTable(good)
+	require.NoError(t, err)
+	cost, ok := tbl.Cost("openai", "gpt-4o", 1000, 1000, 0, 0)
+	require.True(t, ok, "entry survives the wire conversion")
+	assert.InDelta(t, 0.0125, cost, 1e-9)
 
-	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
-	require.Error(t, err, "oversized pricing file must be rejected")
-	assert.Contains(t, err.Error(), "exceeds", "rejection must reference the byte cap")
+	_, ok = tbl.Cost("openai", "unknown-model", 1, 1, 0, 0)
+	assert.False(t, ok, "unknown model misses")
+
+	for name, bad := range map[string]EntryJSON{
+		"negative input":  {InputPer1K: -1, OutputPer1K: 0.01},
+		"NaN output":      {InputPer1K: 0.01, OutputPer1K: math.NaN()},
+		"Inf cache read":  {InputPer1K: 0.01, OutputPer1K: 0.01, CacheReadPer1K: math.Inf(1)},
+		"negative cached": {InputPer1K: 0.01, OutputPer1K: 0.01, CachedInputPer1K: -0.001},
+	} {
+		_, err := NewTable(map[string]map[string]EntryJSON{"openai": {"m": bad}})
+		assert.Error(t, err, "case %q must be rejected so a corrupt config fails the chain build instead of mispricing", name)
+	}
+}
+
+func TestNewTable_NilAndEmpty(t *testing.T) {
+	tbl, err := NewTable(nil)
+	require.NoError(t, err, "nil map builds an empty (never-matching) table")
+	_, ok := tbl.Cost("openai", "gpt-4o", 1, 1, 0, 0)
+	assert.False(t, ok, "empty table prices nothing")
+
+	entries, err := NewEntries(nil)
+	require.NoError(t, err)
+	assert.Empty(t, entries, "nil in, empty (never-matching) map out for the per-record map")
+}
+
+// TestLookup_DatedAnthropicIDFallsBackToUndated covers a client pinning a
+// release date on a model priced under its undated id. Without the
+// fallback the request records no cost at all.
+func TestLookup_DatedAnthropicIDFallsBackToUndated(t *testing.T) {
+	table, err := NewTable(map[string]map[string]EntryJSON{
+		"anthropic": {
+			"claude-sonnet-4-5": {InputPer1K: 0.003, OutputPer1K: 0.015},
+		},
+	})
+	require.NoError(t, err, "table must build from a valid defaults map")
+
+	entry, ok := table.Lookup("anthropic", "claude-sonnet-4-5-20250929")
+	require.True(t, ok, "a dated id must resolve to the undated entry")
+	assert.InDelta(t, 0.003, entry.InputPer1K, 1e-9, "dated id must bill at the registered rate")
+
+	_, ok = table.Lookup("anthropic", "claude-sonnet-9-9-20250929")
+	assert.False(t, ok, "an unknown family must stay unpriced")
 }
diff --git a/proxy/internal/llm/pricing/pricing_unix.go b/proxy/internal/llm/pricing/pricing_unix.go
deleted file mode 100644
index 4f3ea33a2..000000000
--- a/proxy/internal/llm/pricing/pricing_unix.go
+++ /dev/null
@@ -1,68 +0,0 @@
-//go:build unix
-
-package pricing
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"syscall"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// maxPricingBytes caps the size of the pricing YAML on read so a hostile or
-// runaway file cannot exhaust process memory during reload. 1 MiB is several
-// orders of magnitude larger than any reasonable pricing table.
-const maxPricingBytes int64 = 1 << 20
-
-// loadPricing opens the file with O_NOFOLLOW, fstats the open descriptor,
-// and parses from that same descriptor. Never re-opens by path so a
-// mid-read rename or symlink swap cannot substitute content. Bytes are
-// capped at maxPricingBytes so the loader cannot be coerced into reading an
-// unbounded file.
-func loadPricing(path string) (*Table, time.Time, error) {
-	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW, 0)
-	if err != nil {
-		return nil, time.Time{}, fmt.Errorf("open %s: %w", path, err)
-	}
-	defer func() {
-		if cerr := f.Close(); cerr != nil {
-			log.Debugf("close pricing file %s: %v", path, cerr)
-		}
-	}()
-
-	info, err := f.Stat()
-	if err != nil {
-		return nil, time.Time{}, fmt.Errorf("fstat %s: %w", path, err)
-	}
-	if !info.Mode().IsRegular() {
-		return nil, time.Time{}, fmt.Errorf("pricing file %s is not a regular file", path)
-	}
-
-	data, err := io.ReadAll(io.LimitReader(f, maxPricingBytes+1))
-	if err != nil {
-		return nil, time.Time{}, fmt.Errorf("read %s: %w", path, err)
-	}
-	if int64(len(data)) > maxPricingBytes {
-		return nil, time.Time{}, fmt.Errorf("pricing file %s exceeds %d bytes", path, maxPricingBytes)
-	}
-
-	table, err := parsePricingBytes(data)
-	if err != nil {
-		return nil, time.Time{}, err
-	}
-	return table, info.ModTime(), nil
-}
-
-// statMtime returns the mtime of the file at path. It uses lstat semantics
-// via os.Lstat so a symlink swap is detected even though O_NOFOLLOW will
-// later reject the open.
-func statMtime(path string) (time.Time, error) {
-	info, err := os.Lstat(path)
-	if err != nil {
-		return time.Time{}, fmt.Errorf("lstat %s: %w", path, err)
-	}
-	return info.ModTime(), nil
-}
diff --git a/proxy/internal/metrics/client_metrics_test.go b/proxy/internal/metrics/client_metrics_test.go
new file mode 100644
index 000000000..c71e6fb57
--- /dev/null
+++ b/proxy/internal/metrics/client_metrics_test.go
@@ -0,0 +1,49 @@
+package metrics_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	sdkmetric "go.opentelemetry.io/otel/sdk/metric"
+	"go.opentelemetry.io/otel/sdk/metric/metricdata"
+
+	"github.com/netbirdio/netbird/proxy/internal/metrics"
+)
+
+func TestRegisterClientObserver(t *testing.T) {
+	reader := sdkmetric.NewManualReader()
+	provider := sdkmetric.NewMeterProvider(sdkmetric.WithReader(reader))
+	m, err := metrics.New(context.Background(), provider.Meter("test"))
+	require.NoError(t, err)
+
+	clients := 2
+	require.NoError(t, m.RegisterClientObserver(func() int { return clients }))
+
+	var rm metricdata.ResourceMetrics
+	require.NoError(t, reader.Collect(context.Background(), &rm))
+	assert.Equal(t, int64(2), gaugeValue(t, rm, "proxy.clients.count"), "gauge must report the current client count")
+
+	clients = 1
+	require.NoError(t, reader.Collect(context.Background(), &rm))
+	assert.Equal(t, int64(1), gaugeValue(t, rm, "proxy.clients.count"), "gauge must follow the client count on the next collection")
+}
+
+func gaugeValue(t *testing.T, rm metricdata.ResourceMetrics, name string) int64 {
+	t.Helper()
+
+	for _, sm := range rm.ScopeMetrics {
+		for _, mtr := range sm.Metrics {
+			if mtr.Name != name {
+				continue
+			}
+			gauge, ok := mtr.Data.(metricdata.Gauge[int64])
+			require.True(t, ok, "%s must be an int64 gauge", name)
+			require.Len(t, gauge.DataPoints, 1, "%s must have a single data point", name)
+			return gauge.DataPoints[0].Value
+		}
+	}
+	t.Fatalf("gauge %s not found", name)
+	return 0
+}
diff --git a/proxy/internal/metrics/metrics.go b/proxy/internal/metrics/metrics.go
index 5fd23d934..d7b1797a1 100644
--- a/proxy/internal/metrics/metrics.go
+++ b/proxy/internal/metrics/metrics.go
@@ -196,6 +196,21 @@ func (m *Metrics) RecordAddPeerDuration(d time.Duration, err error) {
 	))
 }
 
+// RegisterClientObserver reports the number of embedded clients as a gauge.
+// clientCount runs on every collection cycle, so it must stay cheap.
+func (m *Metrics) RegisterClientObserver(clientCount func() int) error {
+	_, err := m.meter.Int64ObservableGauge(
+		"proxy.clients.count",
+		metric.WithUnit("1"),
+		metric.WithDescription("Current number of embedded NetBird clients running on the netbird proxy"),
+		metric.WithInt64Callback(func(_ context.Context, o metric.Int64Observer) error {
+			o.Observe(int64(clientCount()))
+			return nil
+		}),
+	)
+	return err
+}
+
 func (m *Metrics) initL4Metrics(meter metric.Meter) error {
 	var err error
 
diff --git a/proxy/internal/middleware/builtin/builtin.go b/proxy/internal/middleware/builtin/builtin.go
index 9ea4cf89d..9df60dd65 100644
--- a/proxy/internal/middleware/builtin/builtin.go
+++ b/proxy/internal/middleware/builtin/builtin.go
@@ -36,15 +36,13 @@ var defaultRegistry = middleware.NewRegistry()
 
 // FactoryContext is the per-process bag that concrete factories may
 // consult during construction. It carries the proxy-lifetime context,
-// the data directory used for static config files (pricing tables,
-// allowlists), the OTel meter, and the proxy logger.
+// the OTel meter, and the proxy logger.
 //
 // Configure must be called once at boot before any chain build calls
 // Resolve. Calling it twice overwrites the prior value; tests may rely
 // on this to reset state.
 type FactoryContext struct {
 	Context    context.Context
-	DataDir    string
 	Meter      metric.Meter
 	Logger     *log.Logger
 	MgmtClient MgmtClient
@@ -58,12 +56,11 @@ var (
 // Configure stores the per-process FactoryContext. Concrete factories
 // reach for it via Context(). mgmt may be nil on tests / standalone
 // builds with no management server; consumers must guard.
-func Configure(ctx context.Context, dataDir string, meter metric.Meter, logger *log.Logger, mgmt MgmtClient) {
+func Configure(ctx context.Context, meter metric.Meter, logger *log.Logger, mgmt MgmtClient) {
 	ctxMu.Lock()
 	defer ctxMu.Unlock()
 	ctxStore = FactoryContext{
 		Context:    ctx,
-		DataDir:    dataDir,
 		Meter:      meter,
 		Logger:     logger,
 		MgmtClient: mgmt,
diff --git a/proxy/internal/middleware/builtin/cost_calculation_matrix_test.go b/proxy/internal/middleware/builtin/cost_calculation_matrix_test.go
new file mode 100644
index 000000000..be3682c0e
--- /dev/null
+++ b/proxy/internal/middleware/builtin/cost_calculation_matrix_test.go
@@ -0,0 +1,333 @@
+package builtin_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"strconv"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	mgmtpricing "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/cost_meter"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_request_parser"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_response_parser"
+)
+
+// Drives the real pipeline (llm_request_parser → llm_response_parser → cost_meter) on the REAL default pricing
+// table management ships (mgmtpricing.DefaultTable, catalog-derived) and asserts exact USD amounts hardcoded from
+// the vendors' published prices, including the cache split. This is the cross-stack pricing contract test: the
+// management-side Entry JSON must decode into the proxy-side table and produce these exact costs.
+func TestCostCalculation_ProviderMatrix(t *testing.T) {
+	builtin.Configure(context.Background(), nil, nil, nil)
+
+	reqMW, err := llm_request_parser.Factory{}.New(nil)
+	require.NoError(t, err, "build llm_request_parser")
+	respMW, err := llm_response_parser.Factory{}.New(nil)
+	require.NoError(t, err, "build llm_response_parser")
+	costCfgJSON, err := json.Marshal(map[string]any{"pricing": map[string]any{"defaults": mgmtpricing.DefaultTable()}})
+	require.NoError(t, err, "marshal management default table into cost_meter config")
+	costMW, err := cost_meter.Factory{}.New(costCfgJSON)
+	require.NoError(t, err, "build cost_meter")
+	t.Cleanup(func() { _ = costMW.Close() })
+
+	const jsonCT = "application/json"
+	const sseCT = "text/event-stream"
+	const awsCT = "application/vnd.amazon.eventstream"
+
+	cases := []struct {
+		name     string
+		url      string
+		reqBody  []byte
+		respCT   string
+		respBody []byte
+
+		wantProvider  string
+		wantModel     string
+		wantCost      float64 // exact expected USD; ignored when wantSkip is set
+		wantCacheCost float64 // expected cost.usd_cache portion of wantCost
+		wantSkip      string  // expected cost.skipped reason, "" when priced
+	}{
+		{
+			// gpt-4o-mini $0.15/$0.60 per MTok: 1000×0.15/1M + 500×0.60/1M.
+			name:         "openai chat completions",
+			url:          "https://api.openai.com/v1/chat/completions",
+			reqBody:      []byte(`{"model":"gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"choices":[{"message":{"content":"pong"}}],"usage":{"prompt_tokens":1000,"completion_tokens":500,"total_tokens":1500}}`),
+			wantProvider: "openai",
+			wantModel:    "gpt-4o-mini",
+			wantCost:     0.00045,
+		},
+		{
+			// OpenAI cached tokens are a SUBSET of prompt_tokens at a discount; gpt-4o $2.50/$10 per MTok, cached $1.25/M:
+			// 250×2.5/1M + 750×1.25/1M + 500×10/1M.
+			name:          "openai cached subset discount",
+			url:           "https://api.openai.com/v1/chat/completions",
+			reqBody:       []byte(`{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":500,"prompt_tokens_details":{"cached_tokens":750}}}`),
+			wantProvider:  "openai",
+			wantModel:     "gpt-4o",
+			wantCost:      0.0065625,
+			wantCacheCost: 0.0009375,
+		},
+		{
+			// OpenAI streaming: usage rides the final SSE frame.
+			name:         "openai chat SSE stream",
+			url:          "https://api.openai.com/v1/chat/completions",
+			reqBody:      []byte(`{"model":"gpt-4o-mini","stream":true,"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       sseCT,
+			respBody:     sseBody(`{"choices":[{"delta":{"content":"po"}}]}`, `{"choices":[{"delta":{"content":"ng"}}]}`, `{"choices":[],"usage":{"prompt_tokens":1000,"completion_tokens":500}}`, "[DONE]"),
+			wantProvider: "openai",
+			wantModel:    "gpt-4o-mini",
+			wantCost:     0.00045,
+		},
+		{
+			// Mistral speaks the OpenAI shape: mistral-large-latest $0.50/$1.50 per MTok.
+			name:         "mistral via openai shape",
+			url:          "https://api.mistral.ai/v1/chat/completions",
+			reqBody:      []byte(`{"model":"mistral-large-latest","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":1000}}`),
+			wantProvider: "openai",
+			wantModel:    "mistral-large-latest",
+			wantCost:     0.002,
+		},
+		{
+			// The field report, minus caching: Bedrock Sonnet 4.6 $3/$15 per MTok, 3×3/1M + 1514×15/1M = $0.022719.
+			// Also covers inference-profile normalization of the region-prefixed versioned id in the URL.
+			name:         "bedrock invoke — reported scenario, no cache",
+			url:          "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke",
+			reqBody:      []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"content":[{"type":"text","text":"pong"}],"usage":{"input_tokens":3,"output_tokens":1514}}`),
+			wantProvider: "bedrock",
+			wantModel:    "anthropic.claude-sonnet-4-6",
+			wantCost:     0.022719,
+		},
+		{
+			// The field report as observed: the FIRST call of a session also wrote a 30,528-token prompt cache at
+			// 1.25× input ($3.75/M): 0.022719 + 30528×3.75/1M = $0.137199 — the reported $0.1372.
+			name:          "bedrock invoke — reported scenario with cache write",
+			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke",
+			reqBody:       []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"usage":{"input_tokens":3,"output_tokens":1514,"cache_creation_input_tokens":30528,"cache_read_input_tokens":0}}`),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-sonnet-4-6",
+			wantCost:      0.137199,
+			wantCacheCost: 0.11448,
+		},
+		{
+			// Same numbers over the InvokeModel event-stream: message_start carries input + cache, message_delta the output.
+			name:          "bedrock invoke stream with cache write",
+			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke-with-response-stream",
+			reqBody:       []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        awsCT,
+			respBody:      bedrockInvokeStream(t, `{"type":"message_start","message":{"usage":{"input_tokens":3,"output_tokens":1,"cache_creation_input_tokens":30528}}}`, `{"type":"content_block_delta","delta":{"type":"text_delta","text":"pong"}}`, `{"type":"message_delta","usage":{"output_tokens":1514}}`),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-sonnet-4-6",
+			wantCost:      0.137199,
+			wantCacheCost: 0.11448,
+		},
+		{
+			// Converse camelCase usage incl. cache buckets. Haiku 4.5 $1/$5 per MTok, read $0.10/M, write $1.25/M:
+			// 50×1/1M + 100×5/1M + 2000×0.1/1M + 1000×1.25/1M = $0.002.
+			name:          "bedrock converse with cache buckets",
+			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/eu.anthropic.claude-haiku-4-5-20251001-v1:0/converse",
+			reqBody:       []byte(`{"messages":[{"role":"user","content":[{"text":"hi"}]}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"output":{"message":{"content":[{"text":"pong"}]}},"usage":{"inputTokens":50,"outputTokens":100,"totalTokens":3150,"cacheReadInputTokens":2000,"cacheWriteInputTokens":1000}}`),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-haiku-4-5",
+			wantCost:      0.002,
+			wantCacheCost: 0.00145,
+		},
+		{
+			// Same numbers over converse-stream: usage rides the trailing metadata frame.
+			name:    "bedrock converse stream with cache buckets",
+			url:     "https://bedrock-runtime.eu-central-1.amazonaws.com/model/eu.anthropic.claude-haiku-4-5-20251001-v1:0/converse-stream",
+			reqBody: []byte(`{"messages":[{"role":"user","content":[{"text":"hi"}]}]}`),
+			respCT:  awsCT,
+			respBody: bedrockConverseStream(t,
+				`{"delta":{"text":"pong"}}`,
+				`{"usage":{"inputTokens":50,"outputTokens":100,"totalTokens":3150,"cacheReadInputTokens":2000,"cacheWriteInputTokens":1000}}`,
+			),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-haiku-4-5",
+			wantCost:      0.002,
+			wantCacheCost: 0.00145,
+		},
+		{
+			// First-party Anthropic, additive cache buckets. Sonnet 4.6:
+			// 256×3/1M + 200×15/1M + 768×0.3/1M + 512×3.75/1M.
+			name:          "anthropic messages with cache buckets",
+			url:           "https://api.anthropic.com/v1/messages",
+			reqBody:       []byte(`{"model":"claude-sonnet-4-6","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"content":[{"type":"text","text":"pong"}],"usage":{"input_tokens":256,"output_tokens":200,"cache_read_input_tokens":768,"cache_creation_input_tokens":512}}`),
+			wantProvider:  "anthropic",
+			wantModel:     "claude-sonnet-4-6",
+			wantCost:      0.0059184,
+			wantCacheCost: 0.0021504,
+		},
+		{
+			// Anthropic SSE: input from message_start, output from message_delta. Haiku 4.5: 1000×1/1M + 2000×5/1M.
+			name:         "anthropic SSE stream",
+			url:          "https://api.anthropic.com/v1/messages",
+			reqBody:      []byte(`{"model":"claude-haiku-4-5","stream":true,"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       sseCT,
+			respBody:     sseBody(`{"type":"message_start","message":{"usage":{"input_tokens":1000,"output_tokens":2}}}`, `{"type":"content_block_delta","delta":{"type":"text_delta","text":"pong"}}`, `{"type":"message_delta","usage":{"output_tokens":2000}}`, `{"type":"message_stop"}`),
+			wantProvider: "anthropic",
+			wantModel:    "claude-haiku-4-5",
+			wantCost:     0.011,
+		},
+		{
+			// Kimi's Anthropic-compatible endpoint: kimi-k3 $3/$15 per MTok under the anthropic table.
+			name:         "kimi anthropic shape",
+			url:          "https://api.moonshot.ai/anthropic/v1/messages",
+			reqBody:      []byte(`{"model":"kimi-k3","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"input_tokens":1000,"output_tokens":1000}}`),
+			wantProvider: "anthropic",
+			wantModel:    "kimi-k3",
+			wantCost:     0.018,
+		},
+		{
+			// Vertex path-routed model with "@version" stripped; Anthropic-on-Vertex priced under the anthropic table.
+			name:         "vertex anthropic path-routed",
+			url:          "https://aiplatform.googleapis.com/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-4-6@20260115:rawPredict",
+			reqBody:      []byte(`{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"input_tokens":200,"output_tokens":100}}`),
+			wantProvider: "anthropic",
+			wantModel:    "claude-sonnet-4-6",
+			wantCost:     0.0021,
+		},
+		{
+			// Gateway-prefixed model ids are not in the pricing table: the meter must SKIP, never guess a rate.
+			name:         "gateway-prefixed model skips pricing",
+			url:          "https://gateway.example.com/v1/chat/completions",
+			reqBody:      []byte(`{"model":"openai/gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":500}}`),
+			wantProvider: "openai",
+			wantModel:    "openai/gpt-4o-mini",
+			wantSkip:     "unknown_model",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			in := &middleware.Input{
+				Method:  "POST",
+				URL:     tc.url,
+				Headers: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+				Body:    tc.reqBody,
+			}
+
+			reqOut, err := reqMW.Invoke(context.Background(), in)
+			require.NoError(t, err, "request parser")
+			in.Metadata = append(in.Metadata, reqOut.Metadata...)
+
+			require.Equal(t, tc.wantProvider, metaKV(in.Metadata, middleware.KeyLLMProvider), "detected provider")
+			require.Equal(t, tc.wantModel, metaKV(in.Metadata, middleware.KeyLLMModel), "detected (normalized) model")
+
+			in.Status = 200
+			in.RespHeaders = []middleware.KV{{Key: "Content-Type", Value: tc.respCT}}
+			in.RespBody = tc.respBody
+
+			respOut, err := respMW.Invoke(context.Background(), in)
+			require.NoError(t, err, "response parser")
+			in.Metadata = append(in.Metadata, respOut.Metadata...)
+
+			costOut, err := costMW.Invoke(context.Background(), in)
+			require.NoError(t, err, "cost meter")
+
+			if tc.wantSkip != "" {
+				assert.Equal(t, tc.wantSkip, metaKV(costOut.Metadata, middleware.KeyCostSkipped), "expected cost skip reason")
+				assert.Empty(t, metaKV(costOut.Metadata, middleware.KeyCostUSDTotal), "no cost may be emitted on skip")
+				return
+			}
+
+			raw := metaKV(costOut.Metadata, middleware.KeyCostUSDTotal)
+			require.NotEmpty(t, raw, "cost.usd_total must be emitted; skip=%q", metaKV(costOut.Metadata, middleware.KeyCostSkipped))
+			got, err := strconv.ParseFloat(raw, 64)
+			require.NoError(t, err, "cost must be a float")
+			// cost.usd_total is rendered with %.6f: allow half of the last printed digit on top of float error.
+			assert.InDelta(t, tc.wantCost, got, 5.1e-7, "USD cost for %s", tc.name)
+
+			rawCache := metaKV(costOut.Metadata, middleware.KeyCostUSDCache)
+			require.NotEmpty(t, rawCache, "cost.usd_cache must be emitted next to cost.usd_total")
+			gotCache, err := strconv.ParseFloat(rawCache, 64)
+			require.NoError(t, err, "cache cost must be a float")
+			assert.InDelta(t, tc.wantCacheCost, gotCache, 5.1e-7, "cache USD cost for %s", tc.name)
+		})
+	}
+}
+
+// metaKV returns the value for key in kvs, or "" when absent.
+func metaKV(kvs []middleware.KV, key string) string {
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value
+		}
+	}
+	return ""
+}
+
+// sseBody renders data frames as a text/event-stream body.
+func sseBody(frames ...string) []byte {
+	var b bytes.Buffer
+	for _, f := range frames {
+		b.WriteString("data: ")
+		b.WriteString(f)
+		b.WriteString("\n\n")
+	}
+	return b.Bytes()
+}
+
+// awsFrame encodes one AWS event-stream frame with the given :event-type.
+func awsFrame(t *testing.T, eventType string, payload []byte) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	enc := eventstream.NewEncoder()
+	require.NoError(t, enc.Encode(&buf, eventstream.Message{
+		Headers: eventstream.Headers{{Name: ":event-type", Value: eventstream.StringValue(eventType)}},
+		Payload: payload,
+	}), "encode event-stream frame")
+	return buf.Bytes()
+}
+
+// bedrockInvokeStream builds an invoke-with-response-stream body: each "chunk" frame wraps a base64 Anthropic event.
+func bedrockInvokeStream(t *testing.T, events ...string) []byte {
+	t.Helper()
+	var body bytes.Buffer
+	for _, ev := range events {
+		wrap, err := json.Marshal(map[string]string{"bytes": base64.StdEncoding.EncodeToString([]byte(ev))})
+		require.NoError(t, err)
+		body.Write(awsFrame(t, "chunk", wrap))
+	}
+	return body.Bytes()
+}
+
+// bedrockConverseStream builds a converse-stream body: contentBlockDelta frames plus a trailing metadata usage frame.
+func bedrockConverseStream(t *testing.T, deltas ...string) []byte {
+	t.Helper()
+	var body bytes.Buffer
+	for i, ev := range deltas {
+		eventType := "contentBlockDelta"
+		if i == len(deltas)-1 {
+			eventType = "metadata"
+		}
+		body.Write(awsFrame(t, eventType, []byte(ev)))
+	}
+	return body.Bytes()
+}
diff --git a/proxy/internal/middleware/builtin/cost_meter/factory.go b/proxy/internal/middleware/builtin/cost_meter/factory.go
index b8a58d10e..2993ce32e 100644
--- a/proxy/internal/middleware/builtin/cost_meter/factory.go
+++ b/proxy/internal/middleware/builtin/cost_meter/factory.go
@@ -2,7 +2,6 @@ package cost_meter
 
 import (
 	"bytes"
-	"context"
 	"encoding/json"
 	"fmt"
 
@@ -11,16 +10,27 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
 )
 
-// defaultPricingFilename is the basename probed inside the proxy data
-// directory when no override is configured.
-const defaultPricingFilename = "pricing.yaml"
-
-// Config is the on-wire configuration for the middleware.
+// Config is the on-wire configuration for the middleware, synthesized by
+// management (buildCostMeterConfigJSON). The proxy has no embedded price
+// list: this payload is the only pricing source, and updates arrive as
+// ordinary mapping pushes that rebuild the chain (and with it this
+// middleware instance) — no per-request fetches, no reload loops.
 type Config struct {
-	// PricingPath optionally overrides the basename of the pricing
-	// file probed inside the proxy data directory. When empty the
-	// loader falls back to "pricing.yaml".
-	PricingPath string `json:"pricing_path"`
+	Pricing *PricingConfig `json:"pricing"`
+}
+
+// PricingConfig carries the full pricing table:
+//   - Defaults: parser surface ("openai"/"anthropic"/"bedrock") ->
+//     normalized model id -> rates, matched against llm.provider +
+//     llm.model.
+//   - Providers: provider record id -> normalized model id -> rates,
+//     matched against the llm.resolved_provider_id metadata llm_router
+//     stamps. Entries arrive fully materialized (management folds default
+//     cache rates in at synth time), so lookup order is simply
+//     per-record first, defaults second.
+type PricingConfig struct {
+	Defaults  map[string]map[string]pricing.EntryJSON `json:"defaults"`
+	Providers map[string]map[string]pricing.EntryJSON `json:"providers"`
 }
 
 // Factory builds cost_meter instances from raw config bytes.
@@ -29,45 +39,45 @@ type Factory struct{}
 // ID returns the registry identifier.
 func (Factory) ID() string { return ID }
 
-// New constructs a middleware instance. Empty, null, and {} configs
-// are accepted; non-empty rawConfig that fails to unmarshal is
-// rejected so misconfigurations surface at chain build time. The
-// pricing loader is built once per instance and reused across
-// invocations.
+// New constructs a middleware instance. Empty, null, and {} configs are
+// accepted for backward compatibility with a management server that
+// predates config-delivered pricing — the instance then skips every cost
+// computation (unknown_model) and a warning is logged once at build time.
+// Non-empty rawConfig that fails to unmarshal, or a table carrying a
+// non-finite / negative rate, is rejected so misconfigurations surface at
+// chain build time.
 func (Factory) New(rawConfig []byte) (middleware.Middleware, error) {
 	cfg, err := decodeConfig(rawConfig)
 	if err != nil {
 		return nil, err
 	}
 
-	fctx := builtin.Context()
-	pricingPath := cfg.PricingPath
-	if pricingPath == "" {
-		pricingPath = defaultPricingFilename
+	if cfg.Pricing == nil {
+		if logger := builtin.Context().Logger; logger != nil {
+			logger.Warnf("cost_meter: no pricing table in middleware config; management predates config-delivered pricing — every request will record cost.skipped=unknown_model ($0)")
+		}
+		return newMiddleware(mustEmptyTable(), nil), nil
 	}
 
-	loader, err := pricing.NewLoader(fctx.DataDir, pricingPath, ID, nil)
+	defaults, err := pricing.NewTable(cfg.Pricing.Defaults)
 	if err != nil {
-		return nil, fmt.Errorf("init pricing loader: %w", err)
+		return nil, fmt.Errorf("cost_meter pricing defaults: %w", err)
 	}
-
-	cancel := startReloader(fctx.Context, loader)
-
-	return newMiddleware(loader, cancel), nil
+	perRecord, err := pricing.NewEntries(cfg.Pricing.Providers)
+	if err != nil {
+		return nil, fmt.Errorf("cost_meter per-provider pricing: %w", err)
+	}
+	return newMiddleware(defaults, perRecord), nil
 }
 
-// startReloader binds the loader's mtime-poll goroutine to a context
-// derived from the proxy-lifetime context and returns its cancel func so
-// the owning middleware can stop the goroutine on teardown. Returns nil
-// when there's nothing to watch (nil context or defaults-only loader), in
-// which case the middleware's Close is a no-op.
-func startReloader(ctx context.Context, loader *pricing.Loader) context.CancelFunc {
-	if ctx == nil || !loader.WatchesFile() {
-		return nil
+// mustEmptyTable returns a valid empty table. NewTable on a nil map cannot
+// fail; the panic guard documents that invariant.
+func mustEmptyTable() *pricing.Table {
+	t, err := pricing.NewTable(nil)
+	if err != nil {
+		panic(fmt.Sprintf("cost_meter: empty pricing table must build: %v", err))
 	}
-	cctx, cancel := context.WithCancel(ctx)
-	go loader.Reload(cctx)
-	return cancel
+	return t
 }
 
 // decodeConfig accepts empty, null, and {} configs, returning a
diff --git a/proxy/internal/middleware/builtin/cost_meter/middleware.go b/proxy/internal/middleware/builtin/cost_meter/middleware.go
index 4da620310..8e2e0590c 100644
--- a/proxy/internal/middleware/builtin/cost_meter/middleware.go
+++ b/proxy/internal/middleware/builtin/cost_meter/middleware.go
@@ -1,7 +1,9 @@
 // Package cost_meter implements the SlotOnResponse middleware that
 // converts token-usage metadata emitted by llm_response_parser into a
-// per-request USD cost estimate. The middleware uses the shared pricing
-// loader so operator pricing overrides apply to the chain.
+// per-request USD cost estimate. Pricing arrives from management inside
+// the middleware config: a per-provider-record table (the operator's
+// stored prices, matched via llm.resolved_provider_id) consulted first,
+// then the surface-keyed defaults table.
 package cost_meter
 
 import (
@@ -9,6 +11,7 @@ import (
 	"fmt"
 	"strconv"
 
+	"github.com/netbirdio/netbird/proxy/internal/llm"
 	"github.com/netbirdio/netbird/proxy/internal/llm/pricing"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
@@ -17,7 +20,9 @@ import (
 const ID = "cost_meter"
 
 // Version is the implementation version emitted via the spec merge.
-const Version = "1.0.0"
+// 1.1.0: pricing is config-delivered (defaults + per-provider-record
+// entries) instead of proxy-embedded.
+const Version = "1.1.0"
 
 // Skip reasons emitted under KeyCostSkipped. The set is closed; the
 // dashboard surfaces these verbatim.
@@ -32,24 +37,31 @@ const (
 )
 
 var metadataKeys = []string{
+	middleware.KeyCostUSDInput,
+	middleware.KeyCostUSDCachedInput,
+	middleware.KeyCostUSDCacheCreation,
+	middleware.KeyCostUSDOutput,
 	middleware.KeyCostUSDTotal,
+	middleware.KeyCostUSDCache,
 	middleware.KeyCostSkipped,
 }
 
 // Middleware computes a per-response cost estimate from the token
-// counts emitted upstream by llm_response_parser.
+// counts emitted upstream by llm_response_parser. Both tables are
+// immutable — a pricing change arrives as a mapping push that rebuilds
+// the chain with a fresh instance.
 type Middleware struct {
-	loader *pricing.Loader
-	// cancel stops this instance's pricing-reload goroutine. Non-nil only
-	// when the loader watches an override file; Close calls it so a chain
-	// rebuild doesn't leak a poll goroutine per retired instance.
-	cancel context.CancelFunc
+	// defaults is the surface-keyed table (llm.provider x llm.model).
+	defaults *pricing.Table
+	// perRecord is keyed by provider record id (llm.resolved_provider_id)
+	// then normalized model id; entries arrive fully materialized from
+	// management. Consulted before defaults. May be nil.
+	perRecord map[string]map[string]pricing.Entry
 }
 
-// newMiddleware constructs a Middleware bound to the given pricing loader.
-// cancel may be nil (defaults-only loader with no reloader to stop).
-func newMiddleware(loader *pricing.Loader, cancel context.CancelFunc) *Middleware {
-	return &Middleware{loader: loader, cancel: cancel}
+// newMiddleware constructs a Middleware over the given pricing tables.
+func newMiddleware(defaults *pricing.Table, perRecord map[string]map[string]pricing.Entry) *Middleware {
+	return &Middleware{defaults: defaults, perRecord: perRecord}
 }
 
 // ID returns the registry identifier.
@@ -74,16 +86,9 @@ func (m *Middleware) MetadataKeys() []string {
 // response.
 func (m *Middleware) MutationsSupported() bool { return false }
 
-// Close stops this instance's pricing-reload goroutine, if any. Called by
-// the chain when a rebuild retires the instance, so the mtime-poll loop
-// doesn't outlive the chain it belonged to. Safe to call on a nil receiver
-// and on an instance with no reloader.
-func (m *Middleware) Close() error {
-	if m != nil && m.cancel != nil {
-		m.cancel()
-	}
-	return nil
-}
+// Close releases resources owned by the middleware. Stateless — the
+// pricing tables are plain maps owned by this instance.
+func (m *Middleware) Close() error { return nil }
 
 // Invoke reads provider, model, and token metadata, looks up pricing,
 // and emits either KeyCostUSDTotal or KeyCostSkipped. The decision is
@@ -139,19 +144,73 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 		return out, nil
 	}
 
-	table := m.loader.Get()
-	cost, ok := table.Cost(provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
+	costs, ok := m.lookupCosts(in.Metadata, provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
 	if !ok {
 		out.Metadata = skip(skipUnknownModel)
 		return out, nil
 	}
 
+	// Per-bucket costs first: they're the base of the breakdown, and the two
+	// aggregates that follow are derived from exactly these four values.
 	out.Metadata = []middleware.KV{
-		{Key: middleware.KeyCostUSDTotal, Value: fmt.Sprintf("%.6f", cost)},
+		{Key: middleware.KeyCostUSDInput, Value: usd(costs.InputUSD)},
+		{Key: middleware.KeyCostUSDCachedInput, Value: usd(costs.CachedInputUSD)},
+		{Key: middleware.KeyCostUSDCacheCreation, Value: usd(costs.CacheCreationUSD)},
+		{Key: middleware.KeyCostUSDOutput, Value: usd(costs.OutputUSD)},
+		{Key: middleware.KeyCostUSDTotal, Value: usd(costs.TotalUSD)},
+		{Key: middleware.KeyCostUSDCache, Value: usd(costs.CacheUSD)},
 	}
 	return out, nil
 }
 
+// lookupCosts resolves the price for this request and computes the cost
+// split. Resolution order:
+//
+//  1. Per-provider-record entry: the operator's stored price for the
+//     provider route that served the request, keyed by the
+//     llm.resolved_provider_id metadata llm_router stamped on the allow
+//     path. Absent metadata (e.g. no router in the chain) skips this tier.
+//  2. Surface defaults: the catalog-derived table keyed by llm.provider.
+//
+// The surface always selects the cache formula — a per-record entry for an
+// Anthropic route still bills its cache buckets additively.
+func (m *Middleware) lookupCosts(md []middleware.KV, surface, model string, inTokens, outTokens, cachedTokens, cacheCreationTokens int64) (pricing.Costs, bool) {
+	if recordID := lookupKV(md, middleware.KeyLLMResolvedProviderID); recordID != "" {
+		if entry, ok := perRecordEntry(m.perRecord[recordID], model); ok {
+			return pricing.EntryCosts(entry, surface, inTokens, outTokens, cachedTokens, cacheCreationTokens), true
+		}
+	}
+	return m.defaults.Costs(surface, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
+}
+
+// perRecordEntry resolves the operator's stored price for a model on one
+// provider record, falling back to the undated form of a dated Anthropic id
+// so a client that pins a release date still bills at the registered rate.
+func perRecordEntry(byModel map[string]pricing.Entry, model string) (pricing.Entry, bool) {
+	if entry, ok := byModel[model]; ok {
+		return entry, true
+	}
+	undated := llm.NormalizeAnthropicModel(model)
+	if undated == model {
+		return pricing.Entry{}, false
+	}
+	entry, ok := byModel[undated]
+	return entry, ok
+}
+
+// usd renders a cost as the fixed-precision string every cost.usd_* key
+// carries, so the per-bucket values and the aggregates round identically.
+//
+// 9 decimals, not 6: these values are summed downstream — per request, per
+// session, and per usage bucket — so the rounding step is applied once per
+// bucket per row and then accumulated. At 6 decimals a single row loses up to
+// 2e-6 across its four buckets (enough to break a 1e-6 reconciliation against
+// published rates), and a bucket smaller than half a microdollar quantises to
+// zero outright: 16 cache-read tokens on a cheap model is 1.6e-9, so summing
+// 10k such rows reports 0.02 instead of 0.016. Nano-dollar precision keeps the
+// per-row error ~1000x below the smallest realistic bucket.
+func usd(v float64) string { return fmt.Sprintf("%.9f", v) }
+
 // skip returns a single-entry metadata slice carrying the given skip
 // reason under KeyCostSkipped.
 func skip(reason string) []middleware.KV {
diff --git a/proxy/internal/middleware/builtin/cost_meter/middleware_test.go b/proxy/internal/middleware/builtin/cost_meter/middleware_test.go
index d1c161cab..482061270 100644
--- a/proxy/internal/middleware/builtin/cost_meter/middleware_test.go
+++ b/proxy/internal/middleware/builtin/cost_meter/middleware_test.go
@@ -3,39 +3,50 @@ package cost_meter
 import (
 	"context"
 	"encoding/json"
-	"os"
-	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/netbirdio/netbird/proxy/internal/llm/pricing"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
-	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
 )
 
-const fixturePricing = `openai:
-  gpt-4o:
-    input_per_1k: 0.0025
-    output_per_1k: 0.01
-  gpt-4o-mini:
-    input_per_1k: 0.00015
-    output_per_1k: 0.0006
-anthropic:
-  claude-sonnet-4-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-`
-
-// configureBuiltin points the package-level FactoryContext at a tmp
-// directory containing the test pricing fixture. Returns the path so
-// callers can override files later if needed.
-func configureBuiltin(t *testing.T) string {
+// fixtureConfig mirrors what management's buildCostMeterConfigJSON ships:
+// a surface-keyed defaults table. Rates match the retired YAML fixture so
+// every cost assertion below is byte-identical to the pre-feature values.
+func fixtureConfig(t *testing.T) []byte {
 	t.Helper()
-	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "pricing.yaml"), []byte(fixturePricing), 0o600), "write pricing fixture")
-	builtin.Configure(context.Background(), dir, nil, nil, nil)
-	return dir
+	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
+		Defaults: map[string]map[string]pricing.EntryJSON{
+			"openai": {
+				"gpt-4o":      {InputPer1K: 0.0025, OutputPer1K: 0.01},
+				"gpt-4o-mini": {InputPer1K: 0.00015, OutputPer1K: 0.0006},
+			},
+			"anthropic": {
+				"claude-sonnet-4-5": {InputPer1K: 0.003, OutputPer1K: 0.015},
+			},
+		},
+	}})
+	require.NoError(t, err)
+	return raw
+}
+
+// fixtureConfigWithCache adds the cache-rate fields.
+func fixtureConfigWithCache(t *testing.T) []byte {
+	t.Helper()
+	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
+		Defaults: map[string]map[string]pricing.EntryJSON{
+			"openai": {
+				"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01, CachedInputPer1K: 0.00125},
+			},
+			"anthropic": {
+				"claude-sonnet-4-5": {InputPer1K: 0.003, OutputPer1K: 0.015, CacheReadPer1K: 0.0003, CacheCreationPer1K: 0.00375},
+			},
+		},
+	}})
+	require.NoError(t, err)
+	return raw
 }
 
 func metaValue(t *testing.T, kvs []middleware.KV, key string) (string, bool) {
@@ -56,8 +67,7 @@ func buildMiddleware(t *testing.T, raw []byte) middleware.Middleware {
 }
 
 func TestMiddleware_StaticSurface(t *testing.T) {
-	configureBuiltin(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfig(t))
 
 	assert.Equal(t, ID, mw.ID(), "ID must match the registered constant")
 	assert.Equal(t, Version, mw.Version(), "Version must match the constant")
@@ -67,12 +77,22 @@ func TestMiddleware_StaticSurface(t *testing.T) {
 	assert.NoError(t, mw.Close(), "Close on stateless middleware is a no-op")
 
 	keys := mw.MetadataKeys()
-	expected := []string{middleware.KeyCostUSDTotal, middleware.KeyCostSkipped}
+	expected := []string{
+		middleware.KeyCostUSDInput,
+		middleware.KeyCostUSDCachedInput,
+		middleware.KeyCostUSDCacheCreation,
+		middleware.KeyCostUSDOutput,
+		middleware.KeyCostUSDTotal,
+		middleware.KeyCostUSDCache,
+		middleware.KeyCostSkipped,
+	}
 	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
 }
 
+// TestFactory_AcceptsEmptyAndJSONConfig: empty/null/{} configs are what an
+// old management (pre config-delivered pricing) sends — they must build a
+// working (all-skip) instance, never fail the chain.
 func TestFactory_AcceptsEmptyAndJSONConfig(t *testing.T) {
-	configureBuiltin(t)
 	cases := [][]byte{nil, {}, []byte("null"), []byte("{}"), []byte("   ")}
 	for _, raw := range cases {
 		mw, err := Factory{}.New(raw)
@@ -82,15 +102,57 @@ func TestFactory_AcceptsEmptyAndJSONConfig(t *testing.T) {
 }
 
 func TestFactory_RejectsMalformedConfig(t *testing.T) {
-	configureBuiltin(t)
 	mw, err := Factory{}.New([]byte("{not json"))
 	require.Error(t, err, "malformed config must surface at construction")
 	assert.Nil(t, mw, "no instance is returned on error")
 }
 
-func TestFactory_DefaultPricingPathLoadsFixture(t *testing.T) {
-	configureBuiltin(t)
-	mw := buildMiddleware(t, nil)
+// TestFactory_RejectsInvalidRates: a non-finite or negative rate anywhere
+// in the table fails the chain build (defense-in-depth behind management's
+// API validation) rather than silently mispricing.
+func TestFactory_RejectsInvalidRates(t *testing.T) {
+	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
+		Defaults: map[string]map[string]pricing.EntryJSON{
+			"openai": {"gpt-4o": {InputPer1K: -0.0025, OutputPer1K: 0.01}},
+		},
+	}})
+	require.NoError(t, err)
+	mw, err := Factory{}.New(raw)
+	require.Error(t, err, "negative rate must fail the build")
+	assert.Nil(t, mw)
+
+	raw, err = json.Marshal(Config{Pricing: &PricingConfig{
+		Providers: map[string]map[string]pricing.EntryJSON{
+			"prov-1": {"m": {InputPer1K: 0.01, OutputPer1K: 0.01, CacheReadPer1K: -1}},
+		},
+	}})
+	require.NoError(t, err)
+	_, err = Factory{}.New(raw)
+	require.Error(t, err, "per-record tables validate too")
+}
+
+// TestFactory_NilPricingSkipsEverything is the version-skew contract: a
+// new proxy under an old management ({} config) must build, allow, and
+// skip with unknown_model — degraded but never broken.
+func TestFactory_NilPricingSkipsEverything(t *testing.T) {
+	mw := buildMiddleware(t, []byte("{}"))
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+			{Key: middleware.KeyLLMInputTokens, Value: "1000"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "1000"},
+		},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "cost_meter always allows")
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
+	require.True(t, ok, "no pricing table means every request skips")
+	assert.Equal(t, skipUnknownModel, value)
+}
+
+func TestFactory_ConfigDefaultsPriceRequests(t *testing.T) {
+	mw := buildMiddleware(t, fixtureConfig(t))
 
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -105,37 +167,81 @@ func TestFactory_DefaultPricingPathLoadsFixture(t *testing.T) {
 
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cost.usd_total must be emitted for known model")
-	assert.Equal(t, "0.000750", value, "0.00015 + 0.0006 per 1k tokens, 6-decimal format")
+	assert.Equal(t, "0.000750000", value, "0.00015 + 0.0006 per 1k tokens, 9-decimal format")
 }
 
-func TestFactory_PricingPathOverride(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "custom.yaml"), []byte(fixturePricing), 0o600), "write custom pricing")
-	builtin.Configure(context.Background(), dir, nil, nil, nil)
-
-	raw, err := json.Marshal(Config{PricingPath: "custom.yaml"})
+// TestInvoke_PerRecordEntryBeatsDefaults: when llm_router resolved a
+// provider record whose operator pinned a price for the model, that price
+// wins over the surface default.
+func TestInvoke_PerRecordEntryBeatsDefaults(t *testing.T) {
+	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
+		Defaults: map[string]map[string]pricing.EntryJSON{
+			"openai": {"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01}},
+		},
+		Providers: map[string]map[string]pricing.EntryJSON{
+			"prov-azure": {"gpt-4o": {InputPer1K: 0.005, OutputPer1K: 0.02}},
+		},
+	}})
 	require.NoError(t, err)
-
 	mw := buildMiddleware(t, raw)
+
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMProvider, Value: "openai"},
 			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
-			{Key: middleware.KeyLLMInputTokens, Value: "2000"},
+			{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-azure"},
+			{Key: middleware.KeyLLMInputTokens, Value: "1000"},
 			{Key: middleware.KeyLLMOutputTokens, Value: "1000"},
 		},
 	})
 	require.NoError(t, err)
-
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
-	require.True(t, ok, "cost.usd_total must be emitted with custom pricing path")
-	assert.Equal(t, "0.015000", value, "2*0.0025 + 1*0.01 = 0.015 with 6-decimal format")
+	require.True(t, ok)
+	assert.Equal(t, "0.025000000", value, "operator's per-record price (0.005+0.02) wins over the default (0.0025+0.01)")
 }
 
-func TestInvoke_ComputesCostForKnownModel(t *testing.T) {
-	configureBuiltin(t)
-	mw := buildMiddleware(t, nil)
+// TestInvoke_PerRecordMissFallsBackToDefaults: a resolved record with no
+// entry for this model (or no entries at all) falls through to the
+// surface defaults — gateway providers rely on exactly this.
+func TestInvoke_PerRecordMissFallsBackToDefaults(t *testing.T) {
+	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
+		Defaults: map[string]map[string]pricing.EntryJSON{
+			"openai": {"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01}},
+		},
+		Providers: map[string]map[string]pricing.EntryJSON{
+			"prov-1": {"some-other-model": {InputPer1K: 1, OutputPer1K: 1}},
+		},
+	}})
+	require.NoError(t, err)
+	mw := buildMiddleware(t, raw)
 
+	for name, recordID := range map[string]string{
+		"record with other models": "prov-1",
+		"record with no entries":   "prov-gateway",
+	} {
+		t.Run(name, func(t *testing.T) {
+			out, err := mw.Invoke(context.Background(), &middleware.Input{
+				Metadata: []middleware.KV{
+					{Key: middleware.KeyLLMProvider, Value: "openai"},
+					{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+					{Key: middleware.KeyLLMResolvedProviderID, Value: recordID},
+					{Key: middleware.KeyLLMInputTokens, Value: "1000"},
+					{Key: middleware.KeyLLMOutputTokens, Value: "1000"},
+				},
+			})
+			require.NoError(t, err)
+			value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
+			require.True(t, ok, "per-record miss must fall back to the surface default, not skip")
+			assert.Equal(t, "0.012500000", value, "default rates apply")
+		})
+	}
+}
+
+// TestInvoke_NoResolvedProviderIDUsesDefaults: metadata without a
+// resolved provider id (router denied, or a chain without llm_router)
+// prices from the defaults table directly.
+func TestInvoke_NoResolvedProviderIDUsesDefaults(t *testing.T) {
+	mw := buildMiddleware(t, fixtureConfig(t))
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
@@ -145,17 +251,15 @@ func TestInvoke_ComputesCostForKnownModel(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
-	require.True(t, ok, "cost.usd_total must be emitted")
-	assert.Equal(t, "0.018000", value, "0.003 + 0.015 = 0.018 with 6-decimal format")
+	require.True(t, ok)
+	assert.Equal(t, "0.018000000", value, "0.003 + 0.015 = 0.018 with 9-decimal format")
 	_, skipped := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
 	assert.False(t, skipped, "cost.skipped must not be set when cost is computed")
 }
 
 func TestInvoke_MissingProvider(t *testing.T) {
-	configureBuiltin(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfig(t))
 
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -171,8 +275,7 @@ func TestInvoke_MissingProvider(t *testing.T) {
 }
 
 func TestInvoke_MissingModel(t *testing.T) {
-	configureBuiltin(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfig(t))
 
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -188,8 +291,7 @@ func TestInvoke_MissingModel(t *testing.T) {
 }
 
 func TestInvoke_MissingTokens(t *testing.T) {
-	configureBuiltin(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfig(t))
 
 	cases := []struct {
 		name string
@@ -232,8 +334,7 @@ func TestInvoke_MissingTokens(t *testing.T) {
 }
 
 func TestInvoke_UnparseableTokens(t *testing.T) {
-	configureBuiltin(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfig(t))
 
 	cases := []struct {
 		name string
@@ -263,8 +364,7 @@ func TestInvoke_UnparseableTokens(t *testing.T) {
 }
 
 func TestInvoke_ZeroTokens(t *testing.T) {
-	configureBuiltin(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfig(t))
 
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -283,8 +383,7 @@ func TestInvoke_ZeroTokens(t *testing.T) {
 }
 
 func TestInvoke_UnknownModel(t *testing.T) {
-	configureBuiltin(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfig(t))
 
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -301,8 +400,7 @@ func TestInvoke_UnknownModel(t *testing.T) {
 }
 
 func TestInvoke_NilInput(t *testing.T) {
-	configureBuiltin(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfig(t))
 
 	out, err := mw.Invoke(context.Background(), nil)
 	require.NoError(t, err)
@@ -311,36 +409,12 @@ func TestInvoke_NilInput(t *testing.T) {
 	assert.Empty(t, out.Metadata, "no metadata must be emitted on nil input")
 }
 
-const fixturePricingWithCache = `openai:
-  gpt-4o:
-    input_per_1k: 0.0025
-    output_per_1k: 0.01
-    cached_input_per_1k: 0.00125
-anthropic:
-  claude-sonnet-4-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-`
-
-// configureBuiltinWithCacheRates points the package-level
-// FactoryContext at a tmp directory containing pricing entries that
-// include the cache rate fields.
-func configureBuiltinWithCacheRates(t *testing.T) {
-	t.Helper()
-	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "pricing.yaml"), []byte(fixturePricingWithCache), 0o600), "write cache-aware pricing fixture")
-	builtin.Configure(context.Background(), dir, nil, nil, nil)
-}
-
 // TestInvoke_OpenAICachedSubsetDiscount proves the OpenAI shape end
 // to end through the middleware: cached_input_tokens is treated as a
 // SUBSET of input_tokens and discounted at the configured rate, not
 // added on top.
 func TestInvoke_OpenAICachedSubsetDiscount(t *testing.T) {
-	configureBuiltinWithCacheRates(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfigWithCache(t))
 
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -357,16 +431,32 @@ func TestInvoke_OpenAICachedSubsetDiscount(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cached subset path must produce a cost — never a skip")
 	// 250 non-cached at 0.0025/1k + 750 cached at 0.00125/1k + 500 output at 0.01/1k.
-	assert.Equal(t, "0.006563", value,
+	assert.Equal(t, "0.006562500", value,
 		"cached subset must be billed at the discount rate, non-cached at the full rate; never double-billed")
+
+	cache, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDCache)
+	require.True(t, ok, "cost.usd_cache must be emitted alongside cost.usd_total")
+	// 750 cached at 0.00125/1k = 0.0009375.
+	assert.Equal(t, "0.000937500", cache, "cache cost is the discounted cost of the cached subset")
+
+	// Per-bucket breakdown. On OpenAI the cached subset is carved out of the
+	// input bucket, so input covers only the 250 non-cached tokens — the two
+	// must never double-count the same 750 tokens.
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDInput, "0.000625000",
+		"input bucket bills only the non-cached remainder")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCachedInput, "0.000937500",
+		"cached-input bucket bills the discounted subset")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCacheCreation, "0.000000000",
+		"OpenAI has no cache-write bucket")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDOutput, "0.005000000",
+		"output bucket bills 500 tokens at 0.01/1k")
 }
 
 // TestInvoke_AnthropicCacheBucketsAdditive proves the Anthropic
 // shape: cache_read and cache_creation are additive to input_tokens
 // and each carries its own rate.
 func TestInvoke_AnthropicCacheBucketsAdditive(t *testing.T) {
-	configureBuiltinWithCacheRates(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfigWithCache(t))
 
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -384,19 +474,69 @@ func TestInvoke_AnthropicCacheBucketsAdditive(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok)
 	// 256 input * 0.003 + 768 cache_read * 0.0003 + 512 cache_creation * 0.00375 + 200 output * 0.015
-	// = 0.000768 + 0.0002304 + 0.00192 + 0.003 = 0.0059184 → "0.005918" with 6-decimal format.
-	assert.Equal(t, "0.005918", value,
+	// = 0.000768 + 0.0002304 + 0.00192 + 0.003 = 0.0059184.
+	assert.Equal(t, "0.005918400", value,
 		"each Anthropic input bucket must bill at its own rate — cache_read cheap, cache_creation expensive, regular input mid")
+
+	cache, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDCache)
+	require.True(t, ok, "cost.usd_cache must be emitted alongside cost.usd_total")
+	// 768 cache_read * 0.0003 + 512 cache_creation * 0.00375 = 0.0021504.
+	assert.Equal(t, "0.002150400", cache, "cache cost sums the read and creation buckets")
+
+	// Per-bucket breakdown: four separately-billed buckets, each at its own rate.
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDInput, "0.000768000",
+		"input bucket bills 256 tokens at 0.003/1k")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCachedInput, "0.000230400",
+		"cache-read bucket bills 768 tokens at the cheap 0.0003/1k")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCacheCreation, "0.001920000",
+		"cache-write bucket bills 512 tokens at the expensive 0.00375/1k")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDOutput, "0.003000000",
+		"output bucket bills 200 tokens at 0.015/1k")
+}
+
+// TestInvoke_PerRecordEntryUsesSurfaceFormula: a per-record entry for an
+// anthropic-surface request must bill its cache buckets additively — the
+// formula follows llm.provider, not which table the entry came from.
+func TestInvoke_PerRecordEntryUsesSurfaceFormula(t *testing.T) {
+	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
+		Providers: map[string]map[string]pricing.EntryJSON{
+			"prov-ant": {"claude-sonnet-4-5": {InputPer1K: 0.003, OutputPer1K: 0.015, CacheReadPer1K: 0.0003, CacheCreationPer1K: 0.00375}},
+		},
+	}})
+	require.NoError(t, err)
+	mw := buildMiddleware(t, raw)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
+			{Key: middleware.KeyLLMModel, Value: "claude-sonnet-4-5"},
+			{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-ant"},
+			{Key: middleware.KeyLLMInputTokens, Value: "256"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "200"},
+			{Key: middleware.KeyLLMCachedInputTokens, Value: "768"},
+			{Key: middleware.KeyLLMCacheCreationTokens, Value: "512"},
+		},
+	})
+	require.NoError(t, err)
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
+	require.True(t, ok)
+	assert.Equal(t, "0.005918400", value, "identical math to the defaults-table entry with the same rates")
+}
+
+// assertBucket asserts one per-bucket cost key carries the expected
+// 9-decimal value.
+func assertBucket(t *testing.T, md []middleware.KV, key, want, msg string) {
+	t.Helper()
+	got, ok := metaValue(t, md, key)
+	require.Truef(t, ok, "%s must be emitted", key)
+	assert.Equal(t, want, got, msg)
 }
 
 // TestInvoke_CachedTokensAbsentFallsBackToBaseFormula covers the
-// "operator hasn't opted in" path: with no cached metadata keys
-// emitted, the meter must produce exactly the same cost as before
-// the feature landed. Critical so operators with the new binary but
-// no YAML changes see no behavioural drift on OpenAI requests.
+// no-cache-metadata path: with no cached keys emitted, the meter must
+// produce exactly the input+output cost.
 func TestInvoke_CachedTokensAbsentFallsBackToBaseFormula(t *testing.T) {
-	configureBuiltinWithCacheRates(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfigWithCache(t))
 
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -411,7 +551,7 @@ func TestInvoke_CachedTokensAbsentFallsBackToBaseFormula(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok)
 	// 1000 input * 0.0025 + 500 output * 0.01 = 0.0025 + 0.005 = 0.0075
-	assert.Equal(t, "0.007500", value, "no cached metadata = same cost as before the feature landed")
+	assert.Equal(t, "0.007500000", value, "no cached metadata = plain input+output cost")
 }
 
 // TestInvoke_UnparseableCachedTokensSkippedSilently proves the
@@ -420,8 +560,7 @@ func TestInvoke_CachedTokensAbsentFallsBackToBaseFormula(t *testing.T) {
 // regular formula. Cache buckets are a refinement, never a reason to
 // abort cost computation.
 func TestInvoke_UnparseableCachedTokensSkippedSilently(t *testing.T) {
-	configureBuiltinWithCacheRates(t)
-	mw := buildMiddleware(t, nil)
+	mw := buildMiddleware(t, fixtureConfigWithCache(t))
 
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -435,25 +574,13 @@ func TestInvoke_UnparseableCachedTokensSkippedSilently(t *testing.T) {
 	require.NoError(t, err)
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "garbage cache metadata must NOT switch the response from a cost to a skip — fall back to 0 cached")
-	assert.Equal(t, "0.007500", value, "same as the no-cached-metadata path")
+	assert.Equal(t, "0.007500000", value, "same as the no-cached-metadata path")
 }
 
-// TestMiddleware_CloseCancelsReloader proves Close stops the per-instance
-// pricing-reload goroutine: a chain rebuild retires the old instance and
-// calls Close, which must invoke the cancel func startReloader handed it so
-// the mtime-poll loop doesn't outlive the chain.
-func TestMiddleware_CloseCancelsReloader(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	m := newMiddleware(nil, cancel)
-
-	require.NoError(t, m.Close(), "Close must not error")
-	require.Error(t, ctx.Err(), "Close must cancel the reloader context so the poll goroutine exits")
-}
-
-// TestMiddleware_CloseNilSafe confirms Close is a no-op (no panic) for an
-// instance with no reloader and for a nil receiver.
+// TestMiddleware_CloseNilSafe confirms Close is a no-op (no panic) even
+// for a nil receiver.
 func TestMiddleware_CloseNilSafe(t *testing.T) {
-	require.NoError(t, newMiddleware(nil, nil).Close(), "no-reloader Close must be a no-op")
+	require.NoError(t, newMiddleware(nil, nil).Close(), "Close must be a no-op")
 	var m *Middleware
 	require.NoError(t, m.Close(), "nil-receiver Close must be safe")
 }
diff --git a/proxy/internal/middleware/builtin/llm_guardrail/factory.go b/proxy/internal/middleware/builtin/llm_guardrail/factory.go
index 6dd2a8e8d..9cec0dc68 100644
--- a/proxy/internal/middleware/builtin/llm_guardrail/factory.go
+++ b/proxy/internal/middleware/builtin/llm_guardrail/factory.go
@@ -10,11 +10,15 @@ import (
 )
 
 // Config is the JSON-decoded shape accepted by the factory. The
-// runtime path consumes the normalised allowlist; raw config is not
+// runtime path consumes the normalised allowlists; raw config is not
 // retained beyond construction.
 type Config struct {
-	ModelAllowlist []string      `json:"model_allowlist"`
-	PromptCapture  PromptCapture `json:"prompt_capture"`
+	// ProviderAllowlists maps a resolved provider id (KeyLLMResolvedProviderID) to
+	// its model allowlist. A provider present is restricted to those models; one
+	// absent is unrestricted. Kept per-provider so one provider's list can't leak
+	// onto another.
+	ProviderAllowlists map[string][]string `json:"provider_allowlists,omitempty"`
+	PromptCapture      PromptCapture       `json:"prompt_capture"`
 }
 
 // PromptCapture toggles the optional prompt capture + redaction step
@@ -54,21 +58,28 @@ func isEmptyJSON(raw []byte) bool {
 	return false
 }
 
-// normaliseConfig lowercases and trims allowlist entries so the runtime
-// match is case-insensitive. Empty entries are dropped.
+// normaliseConfig lowercases and trims allowlist entries for case-insensitive
+// matching; empty entries drop. A provider whose entries all drop keeps an empty
+// (non-nil) list — "deny every model" — distinct from an absent provider
+// (unrestricted).
 func normaliseConfig(cfg Config) Config {
-	if len(cfg.ModelAllowlist) == 0 {
+	if len(cfg.ProviderAllowlists) == 0 {
+		cfg.ProviderAllowlists = nil
 		return cfg
 	}
-	cleaned := make([]string, 0, len(cfg.ModelAllowlist))
-	for _, entry := range cfg.ModelAllowlist {
-		n := normaliseModel(entry)
-		if n == "" {
-			continue
+	cleaned := make(map[string][]string, len(cfg.ProviderAllowlists))
+	for provider, models := range cfg.ProviderAllowlists {
+		list := make([]string, 0, len(models))
+		for _, entry := range models {
+			n := normaliseModel(entry)
+			if n == "" {
+				continue
+			}
+			list = append(list, n)
 		}
-		cleaned = append(cleaned, n)
+		cleaned[provider] = list
 	}
-	cfg.ModelAllowlist = cleaned
+	cfg.ProviderAllowlists = cleaned
 	return cfg
 }
 
diff --git a/proxy/internal/middleware/builtin/llm_guardrail/middleware.go b/proxy/internal/middleware/builtin/llm_guardrail/middleware.go
index e6259f06f..d2b14f265 100644
--- a/proxy/internal/middleware/builtin/llm_guardrail/middleware.go
+++ b/proxy/internal/middleware/builtin/llm_guardrail/middleware.go
@@ -25,6 +25,14 @@ const (
 	denyCodeModel    = "llm_policy.model_blocked"
 	denyReasonModel  = "model_blocked"
 	denyMessageModel = "model is not in the policy allowlist"
+	// Deny reason used when an allowlist is configured but the request model
+	// could not be determined. URL/path-routed providers (AWS Bedrock, Google
+	// Vertex, ...) carry the model outside the JSON body, so a request shape the
+	// parser does not recognise reaches the guardrail with no model. Such a
+	// request must be denied (fail closed), never waved through.
+	denyCodeModelUnknown    = "llm_policy.model_unknown"
+	denyReasonModelUnknown  = "model_unknown"
+	denyMessageModelUnknown = "request model could not be determined for the policy allowlist"
 )
 
 // Middleware enforces the model allowlist and optionally captures the
@@ -75,8 +83,11 @@ func (m *Middleware) MutationsSupported() bool { return false }
 // prompt capture only affects the metadata emitted alongside an allow.
 func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
 	model, modelPresent := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
+	providerID, _ := lookupMetadata(in.Metadata, middleware.KeyLLMResolvedProviderID)
+	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
+	nonInference, _ := lookupMetadata(in.Metadata, middleware.KeyLLMNonInference)
 
-	if denial := m.evaluateAllowlist(model, modelPresent); denial != nil {
+	if denial := m.evaluateAllowlist(providerID, surface, model, modelPresent, nonInference == "true"); denial != nil {
 		return denial, nil
 	}
 
@@ -102,41 +113,80 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 // is a no-op.
 func (m *Middleware) Close() error { return nil }
 
-// evaluateAllowlist returns a deny Output when the configured allowlist
-// rejects the model. A nil return means the request should proceed.
-func (m *Middleware) evaluateAllowlist(model string, modelPresent bool) *middleware.Output {
-	if len(m.cfg.ModelAllowlist) == 0 {
+// evaluateAllowlist denies when the resolved provider's allowlist rejects the
+// model; nil means proceed. Scoped to the provider llm_router resolved, so an
+// unrestricted provider (absent from config) is never caught by another's list.
+func (m *Middleware) evaluateAllowlist(providerID, surface, model string, modelPresent, nonInference bool) *middleware.Output {
+	if len(m.cfg.ProviderAllowlists) == 0 {
 		return nil
 	}
-	if !modelPresent {
+	// Restrictions exist but the resolved provider is unknown, so we can't tell
+	// if this request targets a restricted provider — fail closed. llm_router
+	// normally stamps the provider first, so this is a defensive guard.
+	if providerID == "" {
+		return denyModel(surface, "", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
+	}
+	allowlist, restricted := m.cfg.ProviderAllowlists[providerID]
+	if !restricted {
+		// This provider has no allowlist (some authorising policy left it
+		// unrestricted); management owns any per-policy/group decision.
 		return nil
 	}
-	if m.modelInAllowlist(model) {
+	// Fail closed: with an allowlist in effect for this provider, a request whose
+	// model the parser couldn't extract (absent/empty) is denied. This enforces
+	// the allowlist for path-routed providers (Bedrock, Vertex) with no body model.
+	//
+	// The exception is a non-inference endpoint the router already authorised.
+	// The model listing and the connection-warming probe name no model
+	// anywhere — not in a body, not in the path — so failing closed here
+	// rejected model discovery for exactly the accounts that configured an
+	// allowlist, which is the outage this endpoint is meant to avoid. The
+	// per-model lookup does name one (the router stamps it from the path), so
+	// it still falls through to the allowlist check below.
+	if !modelPresent || normaliseModel(model) == "" {
+		if nonInference {
+			return nil
+		}
+		return denyModel(surface, "", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
+	}
+	if modelInAllowlist(allowlist, model) {
 		return nil
 	}
+	return denyModel(surface, model, denyCodeModel, denyMessageModel, denyReasonModel)
+}
+
+// denyModel builds a 403 deny Output for a model-allowlist rejection. model is
+// included in the details only when non-empty.
+func denyModel(surface, model, code, message, reason string) *middleware.Output {
+	details := map[string]string{}
+	if model != "" {
+		details["model"] = model
+	}
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Code:    denyCodeModel,
-			Message: denyMessageModel,
-			Details: map[string]string{"model": model},
+			Code:    code,
+			Message: message,
+			Details: details,
+			Surface: surface,
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
-			{Key: middleware.KeyLLMPolicyReason, Value: denyReasonModel},
+			{Key: middleware.KeyLLMPolicyReason, Value: reason},
 		},
 	}
 }
 
-// modelInAllowlist reports whether the model matches any allowlist
-// entry under the case-insensitive, trim-tolerant comparison rule.
-func (m *Middleware) modelInAllowlist(model string) bool {
+// modelInAllowlist reports whether the model matches any entry in the supplied
+// (already-normalised) allowlist under the case-insensitive, trim-tolerant
+// comparison rule.
+func modelInAllowlist(allowlist []string, model string) bool {
 	normalised := normaliseModel(model)
 	if normalised == "" {
 		return false
 	}
-	for _, allowed := range m.cfg.ModelAllowlist {
+	for _, allowed := range allowlist {
 		if allowed == normalised {
 			return true
 		}
diff --git a/proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go b/proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go
index 865dc07af..19d8473fe 100644
--- a/proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go
+++ b/proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go
@@ -26,6 +26,25 @@ func newInput(meta ...middleware.KV) *middleware.Input {
 	return &middleware.Input{Slot: middleware.SlotOnRequest, Metadata: meta}
 }
 
+const (
+	testProvider  = "prov-1"
+	otherProvider = "prov-2"
+)
+
+// providerCfg builds a Config restricting testProvider to the given models.
+func providerCfg(models ...string) Config {
+	return Config{ProviderAllowlists: map[string][]string{testProvider: models}}
+}
+
+// newInputProvider builds an input that carries a resolved provider id (as
+// llm_router would stamp) plus any extra metadata.
+func newInputProvider(provider string, meta ...middleware.KV) *middleware.Input {
+	all := make([]middleware.KV, 0, len(meta)+1)
+	all = append(all, middleware.KV{Key: middleware.KeyLLMResolvedProviderID, Value: provider})
+	all = append(all, meta...)
+	return &middleware.Input{Slot: middleware.SlotOnRequest, Metadata: all}
+}
+
 func TestMiddlewareIdentity(t *testing.T) {
 	mw := New(Config{})
 	assert.Equal(t, ID, mw.ID(), "middleware ID must be llm_guardrail")
@@ -47,12 +66,12 @@ func TestMiddlewareIdentity(t *testing.T) {
 
 func TestAllowlistEmptyAllowsAnyModel(t *testing.T) {
 	mw := New(Config{})
-	out, err := mw.Invoke(context.Background(), newInput(
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
 	))
 	require.NoError(t, err)
 	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "empty allowlist must allow any model")
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "no provider allowlists must allow any model")
 	v, ok := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
 	require.True(t, ok, "decision metadata must be emitted")
 	assert.Equal(t, "allow", v, "decision must be allow")
@@ -62,8 +81,8 @@ func TestAllowlistEmptyAllowsAnyModel(t *testing.T) {
 }
 
 func TestAllowlistMatchAllows(t *testing.T) {
-	mw := New(Config{ModelAllowlist: []string{"gpt-4o", "claude-opus-4"}})
-	out, err := mw.Invoke(context.Background(), newInput(
+	mw := New(providerCfg("gpt-4o", "claude-opus-4"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
 	))
 	require.NoError(t, err)
@@ -71,8 +90,8 @@ func TestAllowlistMatchAllows(t *testing.T) {
 }
 
 func TestAllowlistMissDenies(t *testing.T) {
-	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
-	out, err := mw.Invoke(context.Background(), newInput(
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},
 	))
 	require.NoError(t, err)
@@ -91,10 +110,10 @@ func TestAllowlistMissDenies(t *testing.T) {
 }
 
 func TestAllowlistCaseInsensitive(t *testing.T) {
-	mw := New(Config{ModelAllowlist: []string{"  GPT-4o  ", "Claude-OPUS-4"}})
+	mw := New(providerCfg("  GPT-4o  ", "Claude-OPUS-4"))
 	cases := []string{"gpt-4o", "GPT-4O", "  claude-opus-4 "}
 	for _, model := range cases {
-		out, err := mw.Invoke(context.Background(), newInput(
+		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 			middleware.KV{Key: middleware.KeyLLMModel, Value: model},
 		))
 		require.NoError(t, err)
@@ -102,13 +121,120 @@ func TestAllowlistCaseInsensitive(t *testing.T) {
 	}
 }
 
-func TestAllowlistMissingModelKeyAllows(t *testing.T) {
-	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
+func TestAllowlistMissingModelKeyDenies(t *testing.T) {
+	// Fail closed: with an allowlist in effect for the resolved provider, a
+	// request whose model the parser could not extract (URL/path-routed
+	// providers such as Bedrock or Vertex whose shape wasn't recognised) must be
+	// denied, not allowed.
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "absent model must be denied when the provider is restricted")
+	assert.Equal(t, 403, out.DenyStatus, "deny status must be 403")
+	require.NotNil(t, out.DenyReason, "deny reason must be populated")
+	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
+	dec, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
+	assert.Equal(t, "deny", dec, "decision must be deny when model key is absent")
+	reason, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyReason)
+	assert.Equal(t, "model_unknown", reason, "reason metadata must be model_unknown")
+}
+
+func TestAllowlistEmptyModelValueDenies(t *testing.T) {
+	// A present-but-empty model is as undeterminable as an absent one.
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "   "},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "empty model must be denied when the provider is restricted")
+	require.NotNil(t, out.DenyReason, "deny reason must be populated")
+	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
+}
+
+func TestAllowlistEmptyListAllowsMissingModel(t *testing.T) {
+	// Without any provider allowlists there is nothing to enforce, so a missing
+	// model is still allowed — the fail-closed rule only applies when a
+	// restriction is in effect.
+	mw := New(Config{})
 	out, err := mw.Invoke(context.Background(), newInput())
 	require.NoError(t, err)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "missing model key must allow even with non-empty allowlist")
-	dec, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
-	assert.Equal(t, "allow", dec, "decision must be allow when model key is absent")
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "no allowlist must allow even without a model")
+}
+
+func TestUnrestrictedProviderAllowsAnyModel(t *testing.T) {
+	// The request resolved to otherProvider, which has no allowlist, so its
+	// traffic must not be caught by testProvider's restriction — the
+	// cross-provider-leak / false-deny guard.
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(otherProvider,
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},
+	))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "an unrestricted provider must not inherit another provider's allowlist")
+}
+
+func TestPerProviderAllowlistsAreIsolated(t *testing.T) {
+	// gpt-4o is allowed only on testProvider; claude-opus-4 only on
+	// otherProvider. A model allowlisted for one provider must not be usable on
+	// the other — the fail-closed layer never unions allowlists across providers.
+	mw := New(Config{ProviderAllowlists: map[string][]string{
+		testProvider:  {"gpt-4o"},
+		otherProvider: {"claude-opus-4"},
+	}})
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},
+	))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "claude-opus-4 is allowed only on otherProvider, not testProvider")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code, "cross-provider model must be blocked, not model_unknown")
+}
+
+func TestRestrictionsButNoResolvedProviderFailsClosed(t *testing.T) {
+	// Restrictions exist for the account but the resolved provider id is absent,
+	// so the request cannot be scoped to a provider. Fail closed rather than
+	// wave it through.
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "missing resolved provider must fail closed when restrictions exist")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
+}
+
+func TestEnabledButEmptyAllowlistDeniesEveryModel(t *testing.T) {
+	// An allowlist-enabled provider with zero models is distinct from an
+	// unrestricted (absent) provider: it must deny every model.
+	mw := New(providerCfg())
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "an enabled-but-empty allowlist must deny every model")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code, "deny code must be model_blocked, not model_unknown")
+}
+
+func TestFactoryAllEmptyEntriesDenyEveryModel(t *testing.T) {
+	// All the provider's entries are blank; they collapse to a non-nil empty
+	// list (deny everything for that provider), not "no restriction".
+	raw := []byte(`{"provider_allowlists":{"prov-1":["","   "]}}`)
+	mw, err := Factory{}.New(raw)
+	require.NoError(t, err)
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "all-blank allowlist entries must still restrict the provider")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code, "deny code must be model_blocked")
 }
 
 func TestPromptCaptureDisabledEmitsNoPrompt(t *testing.T) {
@@ -186,8 +312,8 @@ func TestFactoryAcceptsZeroConfigs(t *testing.T) {
 
 func TestFactoryDecodesValidConfig(t *testing.T) {
 	cfg := Config{
-		ModelAllowlist: []string{"gpt-4o"},
-		PromptCapture:  PromptCapture{Enabled: true, RedactPii: true},
+		ProviderAllowlists: map[string][]string{testProvider: {"gpt-4o"}},
+		PromptCapture:      PromptCapture{Enabled: true, RedactPii: true},
 	}
 	raw, err := json.Marshal(cfg)
 	require.NoError(t, err, "marshalling test config must succeed")
@@ -203,17 +329,66 @@ func TestFactoryRejectsMalformedJSON(t *testing.T) {
 }
 
 func TestFactoryNormalisesAllowlist(t *testing.T) {
-	raw := []byte(`{"model_allowlist":["  GPT-4o  ","",""," Claude-3 "]}`)
+	raw := []byte(`{"provider_allowlists":{"prov-1":["  GPT-4o  ","",""," Claude-3 "]}}`)
 	mw, err := Factory{}.New(raw)
 	require.NoError(t, err)
-	out, err := mw.Invoke(context.Background(), newInput(
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
 	))
 	require.NoError(t, err)
 	assert.Equal(t, middleware.DecisionAllow, out.Decision, "factory must lowercase + trim allowlist entries")
-	out2, err := mw.Invoke(context.Background(), newInput(
+	out2, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-3"},
 	))
 	require.NoError(t, err)
 	assert.Equal(t, middleware.DecisionAllow, out2.Decision, "trimmed entry must still match")
 }
+
+// TestAllowlistSkipsNonInferenceWithoutModel covers the reported regression:
+// GET /v1/models carries no model anywhere, so the fail-closed rule above
+// denied model discovery for exactly the accounts that configured a provider
+// allowlist — the clients that read a 403 here render an empty model picker.
+// The router authorises those endpoints by path before the guardrail sees
+// them, so an absent model there is expected rather than undeterminable.
+func TestAllowlistSkipsNonInferenceWithoutModel(t *testing.T) {
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+		middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision,
+		"model discovery must not be refused because it names no model")
+}
+
+// TestAllowlistStillAppliesToNonInferenceWithModel pins that the exemption is
+// scoped to requests that genuinely name nothing. The per-model lookup
+// (GET /v1/models/{id}) is non-inference too, but the router stamps the model
+// from its path, so the allowlist must still decide it — otherwise the
+// exemption becomes a way to confirm a model the policy blocks.
+func TestAllowlistStillAppliesToNonInferenceWithModel(t *testing.T) {
+	mw := New(providerCfg("gpt-4o"))
+
+	t.Run("model in the allowlist", func(t *testing.T) {
+		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+			middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
+			middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+		))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision,
+			"an allowlisted model must stay reachable")
+	})
+
+	t.Run("model outside the allowlist", func(t *testing.T) {
+		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+			middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
+			middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-5"},
+		))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionDeny, out.Decision,
+			"non-inference must not become a way past the allowlist")
+		require.NotNil(t, out.DenyReason)
+		assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code,
+			"a named but blocked model is blocked, not unknown")
+	})
+}
diff --git a/proxy/internal/middleware/builtin/llm_identity_inject/factory.go b/proxy/internal/middleware/builtin/llm_identity_inject/factory.go
index 8594c392d..8a5314337 100644
--- a/proxy/internal/middleware/builtin/llm_identity_inject/factory.go
+++ b/proxy/internal/middleware/builtin/llm_identity_inject/factory.go
@@ -64,6 +64,11 @@ type JSONMetadataRule struct {
 	UserKey        string `json:"user_key,omitempty"`
 	GroupsKey      string `json:"groups_key,omitempty"`
 	MaxValueLength int    `json:"max_value_length,omitempty"`
+	// Sanitize replaces characters outside the destination provider's accepted
+	// set with '_' before emitting each value. AWS Bedrock's
+	// X-Amzn-Bedrock-Request-Metadata restricts values to [A-Za-z0-9 +-=._:/@];
+	// group display names with other characters would otherwise 400.
+	Sanitize bool `json:"sanitize,omitempty"`
 }
 
 // Config is the on-wire configuration accepted by the factory. An
diff --git a/proxy/internal/middleware/builtin/llm_identity_inject/middleware.go b/proxy/internal/middleware/builtin/llm_identity_inject/middleware.go
index ee3f1c20d..60b99e194 100644
--- a/proxy/internal/middleware/builtin/llm_identity_inject/middleware.go
+++ b/proxy/internal/middleware/builtin/llm_identity_inject/middleware.go
@@ -217,6 +217,32 @@ func applyHeaderPair(rule *HeaderPairRule, in *middleware.Input) *middleware.Mut
 	return mutations
 }
 
+// bodyInjectableSurfaces are the request-body dialects that accept the
+// OpenAI-standard identity fields this middleware writes. A surface
+// outside this set gets header-only stamping: "user" and "metadata.tags"
+// are not part of the Anthropic Messages schema, which rejects unknown
+// top-level fields and permits only "user_id" under metadata, so writing
+// them into an Anthropic-shaped body turns a working request into a 400.
+// Claude Code speaks that shape through gateway records pinned to the
+// OpenAI parser, so the check keys on the detected surface rather than
+// on the provider record.
+var bodyInjectableSurfaces = map[string]struct{}{
+	"openai": {},
+	// An empty surface means no parser claimed the path (a custom gateway
+	// base). Those upstreams are OpenAI-compatible by convention, so keep
+	// the long-standing behaviour rather than silently dropping identity.
+	"": {},
+}
+
+// bodyAcceptsOpenAIIdentity reports whether the request body may carry the
+// OpenAI-standard identity fields, read from the surface llm_request_parser
+// resolved from the request path.
+func bodyAcceptsOpenAIIdentity(in *middleware.Input) bool {
+	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
+	_, ok := bodyInjectableSurfaces[surface]
+	return ok
+}
+
 // injectIntoBody parses the request body and writes the supplied
 // identity dimensions into it. Tags land at metadata.tags (creating
 // the metadata object when absent); the user identity lands at the
@@ -225,6 +251,8 @@ func applyHeaderPair(rule *HeaderPairRule, in *middleware.Input) *middleware.Mut
 // was written. Returns ok=false (no mutation) when:
 //
 //   - both inputs are empty (nothing to write);
+//   - the body speaks a dialect without these fields (see
+//     bodyInjectableSurfaces);
 //   - the body is empty or truncated (we don't have the full document
 //     to safely round-trip);
 //   - the body isn't a JSON object (skip silently — this middleware
@@ -245,6 +273,9 @@ func injectIntoBody(in *middleware.Input, tags []string, userID string) ([]byte,
 	if in == nil || len(in.Body) == 0 || in.BodyTruncated {
 		return nil, false
 	}
+	if !bodyAcceptsOpenAIIdentity(in) {
+		return nil, false
+	}
 	var doc map[string]any
 	if err := json.Unmarshal(in.Body, &doc); err != nil {
 		return nil, false
@@ -292,15 +323,21 @@ func applyJSONMetadata(rule *JSONMetadataRule, in *middleware.Input) *middleware
 	mutations := &middleware.Mutations{}
 	mutations.HeadersRemove = append(mutations.HeadersRemove, rule.Header)
 
+	emit := func(v string) string {
+		if rule.Sanitize {
+			v = sanitizeMetadataValue(v)
+		}
+		return truncate(v, rule.MaxValueLength)
+	}
 	payload := map[string]string{}
 	if rule.UserKey != "" {
 		if identity := identityFor(in); identity != "" {
-			payload[rule.UserKey] = truncate(identity, rule.MaxValueLength)
+			payload[rule.UserKey] = emit(identity)
 		}
 	}
 	if rule.GroupsKey != "" {
 		if csv := authorisingTagsCSV(in); csv != "" {
-			payload[rule.GroupsKey] = truncate(csv, rule.MaxValueLength)
+			payload[rule.GroupsKey] = emit(csv)
 		}
 	}
 	if len(payload) == 0 {
@@ -359,6 +396,36 @@ func truncate(s string, maxBytes int) string {
 	return s[:maxBytes]
 }
 
+// sanitizeMetadataValue replaces any character outside AWS Bedrock's accepted
+// request-metadata class — letters, digits, space, and + - = . _ : / @ — with
+// '_'. This keeps values (notably the groups CSV, whose commas are rejected, and
+// group display names with arbitrary characters) from making Bedrock reject the
+// request with 400. The result stays opaque to the gateway.
+func sanitizeMetadataValue(s string) string {
+	var b strings.Builder
+	b.Grow(len(s))
+	for _, r := range s {
+		if metadataCharAllowed(r) {
+			b.WriteRune(r)
+		} else {
+			b.WriteByte('_')
+		}
+	}
+	return b.String()
+}
+
+func metadataCharAllowed(r rune) bool {
+	switch {
+	case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9':
+		return true
+	}
+	switch r {
+	case ' ', '+', '-', '=', '.', '_', ':', '/', '@':
+		return true
+	}
+	return false
+}
+
 // tagsIDsFromAuthorising reads llm_router's authorising-groups metadata
 // (a CSV of group ids) and returns the parsed slice. Returns nil when
 // the key is absent or empty so the caller can fall back to the full
diff --git a/proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go b/proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go
index aab1271d8..f602f5c33 100644
--- a/proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go
+++ b/proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go
@@ -304,6 +304,46 @@ func TestInject_JSONMetadata_TruncatesValues(t *testing.T) {
 		"per-value byte length must be capped at MaxValueLength")
 }
 
+// TestInject_JSONMetadata_Sanitize pins the AWS-Bedrock sanitization path: when
+// Sanitize is set, characters outside Bedrock's accepted metadata class
+// (notably the groups CSV comma and arbitrary characters in group display
+// names) are replaced with '_' so Bedrock doesn't reject the request. Allowed
+// characters (letters, digits, spaces, and @ . _ : / + - =) pass through.
+func TestInject_JSONMetadata_Sanitize(t *testing.T) {
+	rule := ProviderInjection{
+		ProviderID: portkeyProvider,
+		JSONMetadata: &JSONMetadataRule{
+			Header:         "X-Amzn-Bedrock-Request-Metadata",
+			UserKey:        "user",
+			GroupsKey:      "group",
+			MaxValueLength: 256,
+			Sanitize:       true,
+		},
+	}
+	mw := New(Config{Providers: []ProviderInjection{rule}})
+	in := newInput(portkeyProvider, "alice", []string{"g1", "g2"})
+	in.UserEmail = "alice@example.com"
+	// Group display names carry characters Bedrock rejects (comma, '#'); the CSV
+	// join adds another comma between the two groups.
+	in.UserGroupNames = []string{"Eng,Team", "Ops#1"}
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	require.Len(t, out.Mutations.HeadersAdd, 1)
+	added := out.Mutations.HeadersAdd[0]
+	assert.Equal(t, "X-Amzn-Bedrock-Request-Metadata", added.Key,
+		"the Bedrock cost-allocation header carries the metadata JSON")
+
+	var payload map[string]string
+	require.NoError(t, json.Unmarshal([]byte(added.Value), &payload))
+	assert.Equal(t, "alice@example.com", payload["user"],
+		"'@' and '.' are in Bedrock's accepted set and must be preserved")
+	assert.NotContains(t, payload["group"], ",", "commas must be sanitized — Bedrock rejects them")
+	assert.NotContains(t, payload["group"], "#", "disallowed characters must be sanitized")
+	assert.Contains(t, payload["group"], "Eng", "allowed characters must be preserved")
+}
+
 // TestInject_JSONMetadata_EmptyIdentity_StripsButDoesNotAdd verifies the
 // anti-spoof Remove still fires when there's nothing to stamp.
 func TestInject_JSONMetadata_EmptyIdentity_StripsButDoesNotAdd(t *testing.T) {
@@ -664,3 +704,57 @@ func TestInject_ExtraHeaders_EmptyValueSkipped(t *testing.T) {
 			"empty extra value must not be stamped")
 	}
 }
+
+// TestInject_AnthropicBodyIsNotRewritten pins the shape gate. Claude Code
+// reaches a LiteLLM record on /v1/messages, where "user" is not a
+// permitted top-level field and metadata accepts only "user_id", so
+// writing the OpenAI-standard fields would turn a working request into a
+// 400 naming a field the client never sent. Header stamping still runs, so
+// spend tracking and per-end-user budgets keep working.
+func TestInject_AnthropicBodyIsNotRewritten(t *testing.T) {
+	rule := liteLLMRuleWithBody()
+	rule.HeaderPair.EndUserIDInBody = true
+	mw := New(Config{Providers: []ProviderInjection{rule}})
+
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+	in.UserEmail = "alice@example.com"
+	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
+	in.Body = []byte(`{"model":"claude-sonnet-5","messages":[]}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	assert.Empty(t, out.Mutations.BodyReplace,
+		"an Anthropic-shaped body must reach the upstream unmodified")
+
+	var endUser string
+	for _, kv := range out.Mutations.HeadersAdd {
+		if kv.Key == "x-litellm-end-user-id" {
+			endUser = kv.Value
+		}
+	}
+	assert.Equal(t, "alice@example.com", endUser,
+		"header stamping must still carry identity when body inject is skipped")
+}
+
+// TestInject_OpenAIBodyStillRewritten guards the gate against
+// over-reaching: the OpenAI surface must keep its body-level identity,
+// which is the only path LiteLLM's tag-budget check reads.
+func TestInject_OpenAIBodyStillRewritten(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleWithBody()}})
+
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "openai"})
+	in.Body = []byte(`{"model":"gpt-4o-mini","messages":[]}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	require.NotEmpty(t, out.Mutations.BodyReplace, "the OpenAI surface still gets body tags")
+
+	var doc map[string]any
+	require.NoError(t, json.Unmarshal(out.Mutations.BodyReplace, &doc))
+	meta, ok := doc["metadata"].(map[string]any)
+	require.True(t, ok, "metadata must be an object")
+	assert.NotEmpty(t, meta["tags"], "metadata.tags must still be written")
+}
diff --git a/proxy/internal/middleware/builtin/llm_limit_check/middleware.go b/proxy/internal/middleware/builtin/llm_limit_check/middleware.go
index bebe4dca4..1e7edcf42 100644
--- a/proxy/internal/middleware/builtin/llm_limit_check/middleware.go
+++ b/proxy/internal/middleware/builtin/llm_limit_check/middleware.go
@@ -84,6 +84,15 @@ func (m *Middleware) Invoke(ctx context.Context, in *middleware.Input) (*middlew
 		return allowNoAttribution(), nil
 	}
 
+	// Model-listing and other non-inference endpoints carry no model, and
+	// management's per-model allowlist fails closed on an empty one. The
+	// router has already authorised the route against the caller's groups
+	// and the request consumes no tokens, so gating it on a model that
+	// cannot exist would only break gateway model discovery.
+	if lookupKV(in.Metadata, middleware.KeyLLMNonInference) == "true" {
+		return allowNoAttribution(), nil
+	}
+
 	providerID := lookupKV(in.Metadata, middleware.KeyLLMResolvedProviderID)
 	if providerID == "" {
 		// llm_router didn't emit a resolved provider id — usually
@@ -117,7 +126,7 @@ func (m *Middleware) Invoke(ctx context.Context, in *middleware.Input) (*middlew
 	}
 
 	if resp.GetDecision() == "deny" {
-		return denyFromManagement(resp), nil
+		return denyFromManagement(resp, lookupKV(in.Metadata, middleware.KeyLLMProvider)), nil
 	}
 	return allowFromManagement(resp), nil
 }
@@ -161,7 +170,7 @@ func allowFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.O
 // envelope. The deny code surfaces verbatim through the framework's
 // fixed JSON template; arbitrary middleware bytes can't reach the
 // wire.
-func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Output {
+func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse, surface string) *middleware.Output {
 	code := resp.GetDenyCode()
 	if code == "" {
 		code = "llm_policy.cap_exceeded"
@@ -175,7 +184,8 @@ func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Ou
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
 			Code:    code,
-			Message: "LLM policy limit exceeded",
+			Message: denyMessageForCode(code),
+			Surface: surface,
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
@@ -184,6 +194,21 @@ func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Ou
 	}
 }
 
+// denyMessageForCode maps a management deny code to a public message.
+// Model-allowlist rejections get a model-specific message matching the
+// local guardrail; everything else keeps the generic quota wording. The
+// message stays generic so it never leaks internal quota detail.
+func denyMessageForCode(code string) string {
+	switch code {
+	case "llm_policy.model_blocked":
+		return "model is not in the policy allowlist"
+	case "llm_policy.model_unknown":
+		return "request model could not be determined for the policy allowlist"
+	default:
+		return "LLM policy limit exceeded"
+	}
+}
+
 // lookupKV returns the value associated with key, or the empty
 // string when absent.
 func lookupKV(kvs []middleware.KV, key string) string {
diff --git a/proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go b/proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go
index 2c26c2abe..7754998ee 100644
--- a/proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go
+++ b/proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go
@@ -115,6 +115,46 @@ func TestInvoke_DenyConvertsToProxyDeny(t *testing.T) {
 	assert.NotContains(t, out.DenyReason.Message, "1000", "internal cap numbers must not reach the caller")
 }
 
+// TestInvoke_ModelDenyMessages proves a model-allowlist rejection gets a
+// model-specific public message rather than the generic quota wording, so a
+// blocked or undetermined model reads consistently with the local guardrail.
+func TestInvoke_ModelDenyMessages(t *testing.T) {
+	cases := []struct {
+		name    string
+		code    string
+		message string
+	}{
+		{"blocked", "llm_policy.model_blocked", "model is not in the policy allowlist"},
+		{"unknown", "llm_policy.model_unknown", "request model could not be determined for the policy allowlist"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			mgmt := &fakeMgmt{
+				checkResp: &proto.CheckLLMPolicyLimitsResponse{
+					Decision: "deny",
+					DenyCode: tc.code,
+				},
+			}
+			m := New(mgmt, nil)
+
+			out := runInvoke(t, m, &middleware.Input{
+				AccountID:  "acc-1",
+				UserGroups: []string{"grp-engineers"},
+				Metadata: []middleware.KV{
+					{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-1"},
+					{Key: middleware.KeyLLMModel, Value: "some-model"},
+				},
+			})
+
+			assert.Equal(t, middleware.DecisionDeny, out.Decision)
+			require.NotNil(t, out.DenyReason, "deny envelope must carry a reason payload")
+			assert.Equal(t, tc.code, out.DenyReason.Code, "canonical deny code surfaces to the caller")
+			assert.Equal(t, tc.message, out.DenyReason.Message,
+				"model denials must use a model-specific message, matching the local guardrail")
+		})
+	}
+}
+
 // TestInvoke_NoMgmtClientPassesThrough proves the partial-wiring
 // safety: a middleware constructed without a management client
 // allows every request without attribution. This makes a half-set-up
@@ -184,3 +224,35 @@ func TestMetadataKeys_Allowlist(t *testing.T) {
 	}
 	assert.ElementsMatch(t, want, keys)
 }
+
+// TestInvoke_NonInferenceSkipsPreflight covers gateway model discovery:
+// GET /v1/models carries no model, and management's per-model allowlist
+// fails closed on an empty one, so a pre-flight would deny discovery for
+// exactly the accounts that use the model allowlist. The router marks the
+// request non-inference after authorising the route, and the gate must
+// then allow without calling management at all.
+func TestInvoke_NonInferenceSkipsPreflight(t *testing.T) {
+	mgmt := &fakeMgmt{
+		checkResp: &proto.CheckLLMPolicyLimitsResponse{
+			Decision: "deny",
+			DenyCode: "llm_policy.model_blocked",
+		},
+	}
+	m := New(mgmt, nil)
+
+	out := runInvoke(t, m, &middleware.Input{
+		AccountID:  "acc-1",
+		UserID:     "user-bob",
+		UserGroups: []string{"grp-engineers"},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-1"},
+			{Key: middleware.KeyLLMNonInference, Value: "true"},
+		},
+	})
+
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "model-less endpoints must not be gated on a model")
+	assert.Nil(t, mgmt.checkReq, "no pre-flight may be sent for a non-inference request")
+
+	assert.Empty(t, lookupKV(out.Metadata, middleware.KeyLLMSelectedPolicyID),
+		"no policy is attributed when nothing was metered")
+}
diff --git a/proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go b/proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go
index 827b81d07..82f44cb50 100644
--- a/proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go
+++ b/proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go
@@ -1,27 +1,14 @@
 package llm_request_parser
 
 import (
+	"context"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-)
 
-func TestNormalizeBedrockModel(t *testing.T) {
-	cases := map[string]string{
-		"eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
-		"us.anthropic.claude-opus-4-8-20250101-v1:0":   "anthropic.claude-opus-4-8",
-		"apac.anthropic.claude-haiku-4-5-v1:0":         "anthropic.claude-haiku-4-5",
-		"anthropic.claude-sonnet-4-5-20250929-v1:0":    "anthropic.claude-sonnet-4-5",
-		"meta.llama3-3-70b-instruct-v1:0":              "meta.llama3-3-70b-instruct",
-		"amazon.nova-pro-v1:0":                         "amazon.nova-pro",
-		"amazon.nova-2-lite-v1:0":                      "amazon.nova-2-lite",
-		// Inference-profile ARN — model id lives in the last path segment.
-		"arn:aws:bedrock:eu-central-1:123456789012:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
-	}
-	for in, want := range cases {
-		require.Equal(t, want, normalizeBedrockModel(in), "normalize %q", in)
-	}
-}
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
 
 func TestParseBedrockPath(t *testing.T) {
 	tests := []struct {
@@ -53,3 +40,25 @@ func TestParseBedrockPath(t *testing.T) {
 		}
 	}
 }
+
+// TestInvoke_BedrockCountTokens covers the dedicated token-counting
+// endpoint. Denying it does not break the client, it just pushes context
+// counting back onto the inference endpoint, which is billable.
+func TestInvoke_BedrockCountTokens(t *testing.T) {
+	mw := newMiddleware(t)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/model/us.anthropic.claude-sonnet-4-5-20250929-v1:0/count-tokens",
+		Body: []byte(`{"input":{"converse":{"messages":[]}}}`),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+
+	model, ok := metaValue(t, out.Metadata, middleware.KeyLLMModel)
+	require.True(t, ok, "count-tokens carries a model in the path and must emit it")
+	assert.Equal(t, "anthropic.claude-sonnet-4-5", model, "model must be normalized like any other action")
+
+	stream, _ := metaValue(t, out.Metadata, middleware.KeyLLMStream)
+	assert.Equal(t, "false", stream, "count-tokens never streams")
+}
diff --git a/proxy/internal/middleware/builtin/llm_request_parser/guardrail_allowlist_test.go b/proxy/internal/middleware/builtin/llm_request_parser/guardrail_allowlist_test.go
new file mode 100644
index 000000000..1eae26d73
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_request_parser/guardrail_allowlist_test.go
@@ -0,0 +1,113 @@
+package llm_request_parser
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+)
+
+// runParserGuardrail runs the request parser then the model-allowlist guardrail
+// in SlotOnRequest order, threading the parser's metadata into the guardrail the
+// same way the real chain does. It returns the guardrail decision so tests can
+// assert allowlist enforcement for URL/path-routed providers end to end.
+func runParserGuardrail(t *testing.T, url string, body []byte, allowlist []string) *middleware.Output {
+	t.Helper()
+	parser := newMiddleware(t)
+	parsed, err := parser.Invoke(context.Background(), &middleware.Input{
+		Slot: middleware.SlotOnRequest,
+		URL:  url,
+		Body: body,
+	})
+	require.NoError(t, err, "parser must not error")
+
+	const providerID = "prov-under-test"
+	guard := llm_guardrail.New(llm_guardrail.Config{
+		ProviderAllowlists: map[string][]string{providerID: allowlist},
+	})
+	// The real chain has llm_router stamp the resolved provider id before the
+	// guardrail runs; the parser doesn't, so add it here so the guardrail can
+	// scope the allowlist to this provider.
+	meta := append([]middleware.KV{{Key: middleware.KeyLLMResolvedProviderID, Value: providerID}}, parsed.Metadata...)
+	out, err := guard.Invoke(context.Background(), &middleware.Input{
+		Slot:     middleware.SlotOnRequest,
+		Metadata: meta,
+	})
+	require.NoError(t, err, "guardrail must not error")
+	require.NotNil(t, out, "guardrail must return an output")
+	return out
+}
+
+// TestModelAllowlist_URLRoutedProviders validates that the model allowlist is
+// enforced for providers whose model travels in the URL path (AWS Bedrock,
+// Google Vertex) rather than the JSON body. The "unknown action" case is the
+// regression guard for #6751: a Bedrock request shape the parser cannot map to a
+// model must fail closed under an allowlist instead of bypassing it.
+func TestModelAllowlist_URLRoutedProviders(t *testing.T) {
+	const bedrockBody = `{"anthropic_version":"bedrock-2023-05-31","messages":[{"role":"user","content":"hi"}]}`
+	const vertexBody = `{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"hi"}]}`
+
+	tests := []struct {
+		name      string
+		url       string
+		body      string
+		allowlist []string
+		decision  middleware.Decision
+		denyCode  string
+	}{
+		{
+			name:      "bedrock allowed model passes",
+			url:       "https://bedrock-runtime.us-east-1.amazonaws.com/model/us.anthropic.claude-haiku-4-5-v1:0/invoke",
+			body:      bedrockBody,
+			allowlist: []string{"anthropic.claude-haiku-4-5"},
+			decision:  middleware.DecisionAllow,
+		},
+		{
+			name:      "bedrock disallowed model denied",
+			url:       "https://bedrock-runtime.us-east-1.amazonaws.com/model/us.anthropic.claude-opus-4-8-v1:0/invoke",
+			body:      bedrockBody,
+			allowlist: []string{"anthropic.claude-haiku-4-5"},
+			decision:  middleware.DecisionDeny,
+			denyCode:  "llm_policy.model_blocked",
+		},
+		{
+			name:      "bedrock unknown action fails closed",
+			url:       "https://bedrock-runtime.us-east-1.amazonaws.com/model/us.anthropic.claude-opus-4-8-v1:0/some-future-action",
+			body:      bedrockBody,
+			allowlist: []string{"anthropic.claude-haiku-4-5"},
+			decision:  middleware.DecisionDeny,
+			denyCode:  "llm_policy.model_unknown",
+		},
+		{
+			name:      "vertex disallowed model denied",
+			url:       "/v1/projects/p/locations/global/publishers/anthropic/models/claude-opus-4-8@20250101:rawPredict",
+			body:      vertexBody,
+			allowlist: []string{"claude-haiku-4-5"},
+			decision:  middleware.DecisionDeny,
+			denyCode:  "llm_policy.model_blocked",
+		},
+		{
+			name:      "vertex allowed model passes",
+			url:       "/v1/projects/p/locations/global/publishers/anthropic/models/claude-haiku-4-5@20250101:rawPredict",
+			body:      vertexBody,
+			allowlist: []string{"claude-haiku-4-5"},
+			decision:  middleware.DecisionAllow,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			out := runParserGuardrail(t, tt.url, []byte(tt.body), tt.allowlist)
+			assert.Equal(t, tt.decision, out.Decision, "unexpected decision for %s", tt.name)
+			if tt.decision == middleware.DecisionDeny {
+				require.NotNil(t, out.DenyReason, "deny reason must be set for %s", tt.name)
+				assert.Equal(t, 403, out.DenyStatus, "deny status must be 403 for %s", tt.name)
+				assert.Equal(t, tt.denyCode, out.DenyReason.Code, "deny code for %s", tt.name)
+			}
+		})
+	}
+}
diff --git a/proxy/internal/middleware/builtin/llm_request_parser/middleware.go b/proxy/internal/middleware/builtin/llm_request_parser/middleware.go
index 64ca04e6a..7129c2298 100644
--- a/proxy/internal/middleware/builtin/llm_request_parser/middleware.go
+++ b/proxy/internal/middleware/builtin/llm_request_parser/middleware.go
@@ -8,7 +8,6 @@ package llm_request_parser
 import (
 	"context"
 	"net/url"
-	"regexp"
 	"strconv"
 	"strings"
 	"unicode/utf8"
@@ -62,6 +61,8 @@ func (middlewareImpl) MetadataKeys() []string {
 		middleware.KeyLLMRequestPromptRaw,
 		middleware.KeyLLMCaptureTruncated,
 		middleware.KeyLLMSessionID,
+		middleware.KeyLLMAgentID,
+		middleware.KeyLLMParentAgentID,
 	}
 }
 
@@ -73,9 +74,9 @@ func (middlewareImpl) Close() error { return nil }
 
 // Invoke detects the LLM provider, parses request facts, and emits
 // metadata. Always returns DecisionAllow; never errors. Provider
-// selection prefers the configured providerID (synthesiser-stamped on
-// agent-network targets) so requests routed to a custom upstream URL
-// still resolve. Falls back to URL sniffing when no providerID is set.
+// selection prefers the request path, falling back to the configured
+// providerID (synthesiser-stamped on agent-network targets) so requests
+// routed to a custom upstream URL still resolve.
 func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
 	out := &middleware.Output{Decision: middleware.DecisionAllow}
 	if in == nil {
@@ -93,9 +94,14 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 		return m.invokeBedrock(in, br), nil
 	}
 
-	parser, ok := llm.ParserByName(m.providerID)
+	// A path that names an API surface wins over the configured providerID:
+	// a gateway record pinned to "openai" still serves Claude Code on
+	// /v1/messages, and reading that body with the OpenAI parser loses the
+	// Anthropic usage block and prices the request on the wrong surface.
+	// providerID stays the fallback for upstreams whose path says nothing.
+	parser, ok := llm.DetectParser(extractPath(in.URL))
 	if !ok {
-		parser, ok = llm.DetectParser(extractPath(in.URL))
+		parser, ok = llm.ParserByName(m.providerID)
 	}
 	if !ok {
 		return out, nil
@@ -117,9 +123,9 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 	}
 	appendSessionID := func(md []middleware.KV) []middleware.KV {
 		if sessionID != "" {
-			return append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
+			md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 		}
-		return md
+		return appendAgentIDs(md, in.Headers)
 	}
 
 	facts, err := parser.ParseRequest(in.Body)
@@ -161,6 +167,41 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 	return out, nil
 }
 
+// agentIDHeader and parentAgentIDHeader carry sub-agent attribution: a
+// coding agent that spawns helpers stamps the spawned agent's id, plus the
+// spawning agent's when that helper is itself nested. Both are opaque
+// identifiers rather than content, so they're emitted regardless of the
+// prompt-collection toggle, the same way the session id is.
+const (
+	agentIDHeader       = "x-claude-code-agent-id"
+	parentAgentIDHeader = "x-claude-code-parent-agent-id"
+)
+
+// appendAgentIDs stamps the sub-agent attribution headers onto the metadata
+// bag, skipping either one the request doesn't carry.
+func appendAgentIDs(md []middleware.KV, headers []middleware.KV) []middleware.KV {
+	for _, pair := range []struct{ key, header string }{
+		{middleware.KeyLLMAgentID, agentIDHeader},
+		{middleware.KeyLLMParentAgentID, parentAgentIDHeader},
+	} {
+		if v := headerValue(headers, pair.header); v != "" {
+			md = append(md, middleware.KV{Key: pair.key, Value: v})
+		}
+	}
+	return md
+}
+
+// headerValue returns the first non-empty value for the named header.
+// Headers arrive in canonical form, so the match is case-insensitive.
+func headerValue(headers []middleware.KV, want string) string {
+	for _, kv := range headers {
+		if strings.EqualFold(kv.Key, want) && kv.Value != "" {
+			return kv.Value
+		}
+	}
+	return ""
+}
+
 // sessionIDHeaders are request header names that may carry a client
 // session identifier, checked in order, case-insensitively. Matching is
 // against Go's canonical header form, so use the hyphenated names the
@@ -174,10 +215,8 @@ var sessionIDHeaders = []string{"x-claude-code-session-id", "session-id", "x-ses
 // canonical form, so the match is case-insensitive.
 func sessionIDFromHeaders(headers []middleware.KV) string {
 	for _, want := range sessionIDHeaders {
-		for _, kv := range headers {
-			if strings.EqualFold(kv.Key, want) && kv.Value != "" {
-				return kv.Value
-			}
+		if v := headerValue(headers, want); v != "" {
+			return v
 		}
 	}
 	return ""
@@ -253,9 +292,13 @@ func parseVertexPath(reqPath string) (vertexRequest, bool) {
 	if c := strings.LastIndex(rest, ":"); c >= 0 {
 		model, action = rest[:c], rest[c+1:]
 	}
-	if at := strings.Index(model, "@"); at >= 0 {
-		model = model[:at]
+	// Token counting hangs off the model as its own path segment
+	// (".../models/{model}/count-tokens:rawPredict"), so anything past the
+	// first "/" belongs to the method rather than the model id.
+	if slash := strings.Index(model, "/"); slash >= 0 {
+		model = model[:slash]
 	}
+	model = llm.NormalizeVertexModel(model)
 	if model == "" {
 		return vertexRequest{}, false
 	}
@@ -301,6 +344,7 @@ func (m middlewareImpl) invokeVertex(in *middleware.Input, vx vertexRequest) *mi
 	if sessionID != "" {
 		md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 	}
+	md = appendAgentIDs(md, in.Headers)
 
 	promptTruncated := false
 	if parser != nil && m.capturePrompt {
@@ -343,20 +387,14 @@ func trimBedrockNamespace(reqPath string) string {
 	return reqPath
 }
 
-// bedrockRegionPrefixes are the cross-region inference-profile prefixes that
-// front a Bedrock model id (e.g. "eu.anthropic.claude-...").
-var bedrockRegionPrefixes = []string{"us.", "eu.", "apac.", "global."}
-
-// bedrockVersionSuffix matches the trailing "-vN[:N]" or "-YYYYMMDD-vN[:N]"
-// version/throughput suffix of a Bedrock model id.
-var bedrockVersionSuffix = regexp.MustCompile(`-(\d{8}-)?v\d+(:\d+)?$`)
-
 // parseBedrockPath extracts the model and streaming/converse flags from an AWS
 // Bedrock runtime model endpoint:
 //
 //	/model/{modelId}/{action}
 //
-// action ∈ {invoke, invoke-with-response-stream, converse, converse-stream}.
+// action ∈ {invoke, invoke-with-response-stream, converse, converse-stream,
+// count-tokens}. Token counting carries a model and no usage, so it routes
+// like any other action and meters to zero.
 // The modelId may be URL-encoded and may carry a cross-region inference-profile
 // prefix and a version suffix; normalizeBedrockModel strips both so the model
 // matches catalog pricing.
@@ -375,12 +413,12 @@ func parseBedrockPath(reqPath string) (bedrockRequest, bool) {
 	if decoded, err := url.PathUnescape(rawModel); err == nil {
 		rawModel = decoded
 	}
-	model := normalizeBedrockModel(rawModel)
+	model := llm.NormalizeBedrockModel(rawModel)
 	if model == "" {
 		return bedrockRequest{}, false
 	}
 	switch action {
-	case "invoke", "converse":
+	case "invoke", "converse", "count-tokens":
 		return bedrockRequest{model: model}, true
 	case "invoke-with-response-stream", "converse-stream":
 		return bedrockRequest{model: model, stream: true}, true
@@ -389,30 +427,6 @@ func parseBedrockPath(reqPath string) (bedrockRequest, bool) {
 	}
 }
 
-// normalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
-// prefix, and the version/throughput suffix from a Bedrock model id so it
-// matches the catalog/pricing key, e.g.
-// "eu.anthropic.claude-sonnet-4-5-20250929-v1:0" -> "anthropic.claude-sonnet-4-5"
-// and "arn:aws:bedrock:eu-central-1:123:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0"
-// -> "anthropic.claude-sonnet-4-5".
-func normalizeBedrockModel(modelID string) string {
-	m := modelID
-	// A full ARN (inference-profile / provisioned-throughput / foundation-model)
-	// carries the model id in its last path segment.
-	if strings.HasPrefix(m, "arn:") {
-		if i := strings.LastIndex(m, "/"); i >= 0 {
-			m = m[i+1:]
-		}
-	}
-	for _, p := range bedrockRegionPrefixes {
-		if strings.HasPrefix(m, p) {
-			m = m[len(p):]
-			break
-		}
-	}
-	return bedrockVersionSuffix.ReplaceAllString(m, "")
-}
-
 // invokeBedrock emits the model/provider/session/prompt for an AWS Bedrock
 // request. Bedrock is metered under the dedicated "bedrock" parser, which reads
 // both the InvokeModel and Converse response shapes.
@@ -432,6 +446,7 @@ func (m middlewareImpl) invokeBedrock(in *middleware.Input, br bedrockRequest) *
 	if sessionID != "" {
 		md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 	}
+	md = appendAgentIDs(md, in.Headers)
 
 	promptTruncated := false
 	if parser != nil && m.capturePrompt {
diff --git a/proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go b/proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go
index bc185b295..8d8517860 100644
--- a/proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go
+++ b/proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go
@@ -45,6 +45,8 @@ func TestMiddleware_StaticSurface(t *testing.T) {
 		middleware.KeyLLMRequestPromptRaw,
 		middleware.KeyLLMCaptureTruncated,
 		middleware.KeyLLMSessionID,
+		middleware.KeyLLMAgentID,
+		middleware.KeyLLMParentAgentID,
 	}
 	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
 }
@@ -230,6 +232,31 @@ func TestInvoke_ProviderIDConfigBypassesURLSniff(t *testing.T) {
 	assert.Equal(t, "gpt-4o-mini", model)
 }
 
+func TestInvoke_PathSurfaceBeatsProviderIDConfig(t *testing.T) {
+	// Gateway records (LiteLLM, Portkey, OpenRouter) pin provider_id
+	// "openai", but the same record serves Claude Code on /v1/messages.
+	// Parsing that body as OpenAI reads no usage off the Anthropic
+	// response and prices the request on a surface where no claude-*
+	// model exists, so the path has to win.
+	mw, err := Factory{}.New([]byte(`{"provider_id":"openai"}`))
+	require.NoError(t, err, "factory must accept provider_id config")
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/v1/messages",
+		Body: []byte(`{"model":"claude-sonnet-5","stream":true,"messages":[{"role":"user","content":"Hi"}]}`),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, out)
+
+	provider, ok := metaValue(t, out.Metadata, middleware.KeyLLMProvider)
+	require.True(t, ok, "provider must be emitted")
+	assert.Equal(t, "anthropic", provider, "the /v1/messages path selects the Anthropic surface")
+
+	model, ok := metaValue(t, out.Metadata, middleware.KeyLLMModel)
+	require.True(t, ok, "model must be extracted")
+	assert.Equal(t, "claude-sonnet-5", model)
+}
+
 func TestInvoke_UnknownProviderIDFallsBackToURL(t *testing.T) {
 	mw, err := Factory{}.New([]byte(`{"provider_id":"not-a-real-parser"}`))
 	require.NoError(t, err, "factory must accept any provider_id string")
@@ -416,3 +443,81 @@ func TestInvoke_NilInputAllows(t *testing.T) {
 	assert.Equal(t, middleware.DecisionAllow, out.Decision, "nil input still allows")
 	assert.Empty(t, out.Metadata, "nil input emits no metadata")
 }
+
+// TestParseVertexPath_CountTokensKeepsModel covers Vertex token counting,
+// where the method hangs off the model as its own path segment. Splitting
+// only on the final colon swallowed "/count-tokens" into the model id, so
+// the router saw a model no route could claim.
+func TestParseVertexPath_CountTokensKeepsModel(t *testing.T) {
+	cases := map[string]struct {
+		model  string
+		stream bool
+	}{
+		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5:rawPredict":                       {model: "claude-sonnet-5"},
+		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5:streamRawPredict":                 {model: "claude-sonnet-5", stream: true},
+		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5/count-tokens:rawPredict":          {model: "claude-sonnet-5"},
+		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5@20250929/count-tokens:rawPredict": {model: "claude-sonnet-5"},
+	}
+	for path, want := range cases {
+		vx, ok := parseVertexPath(path)
+		require.True(t, ok, "must parse %q", path)
+		assert.Equal(t, want.model, vx.model, "model for %q", path)
+		assert.Equal(t, want.stream, vx.stream, "stream flag for %q", path)
+		assert.Equal(t, "anthropic", vx.publisher, "publisher for %q", path)
+	}
+}
+
+// TestInvoke_EmitsAgentIDs covers sub-agent attribution: several agents run
+// in parallel inside one session, and without their ids every request in
+// the session attributes to the session alone.
+func TestInvoke_EmitsAgentIDs(t *testing.T) {
+	mw := newMiddleware(t)
+
+	t.Run("spawned agent", func(t *testing.T) {
+		out, err := mw.Invoke(context.Background(), &middleware.Input{
+			URL:  "/v1/messages",
+			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
+			Headers: []middleware.KV{
+				{Key: "X-Claude-Code-Session-Id", Value: "sess-1"},
+				{Key: "X-Claude-Code-Agent-Id", Value: "agent-7"},
+			},
+		})
+		require.NoError(t, err)
+
+		agent, ok := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
+		require.True(t, ok, "the spawned agent's id must be emitted")
+		assert.Equal(t, "agent-7", agent)
+
+		_, ok = metaValue(t, out.Metadata, middleware.KeyLLMParentAgentID)
+		assert.False(t, ok, "a top-level agent has no parent to emit")
+	})
+
+	t.Run("nested agent", func(t *testing.T) {
+		out, err := mw.Invoke(context.Background(), &middleware.Input{
+			URL:  "/v1/messages",
+			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
+			Headers: []middleware.KV{
+				{Key: "X-Claude-Code-Agent-Id", Value: "agent-9"},
+				{Key: "X-Claude-Code-Parent-Agent-Id", Value: "agent-7"},
+			},
+		})
+		require.NoError(t, err)
+
+		agent, _ := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
+		assert.Equal(t, "agent-9", agent)
+		parent, ok := metaValue(t, out.Metadata, middleware.KeyLLMParentAgentID)
+		require.True(t, ok, "a nested agent must carry the spawning agent's id")
+		assert.Equal(t, "agent-7", parent)
+	})
+
+	t.Run("absent on a plain request", func(t *testing.T) {
+		out, err := mw.Invoke(context.Background(), &middleware.Input{
+			URL:  "/v1/messages",
+			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
+		})
+		require.NoError(t, err)
+
+		_, ok := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
+		assert.False(t, ok, "no key is emitted when the client sends no agent id")
+	})
+}
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go b/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go
index a82a9cdbc..30809b46e 100644
--- a/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go
+++ b/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go
@@ -69,15 +69,18 @@ func applyBedrockInvokeChunk(payload []byte, usage *llm.Usage, completion *strin
 }
 
 // converseStreamEvent captures the Converse stream frames carrying completion
-// text (contentBlockDelta) and the final token usage (metadata).
+// text (contentBlockDelta) and the final token usage (metadata). Cache buckets
+// are additive to inputTokens (AWS write bucket: cacheWriteInputTokens).
 type converseStreamEvent struct {
 	Delta *struct {
 		Text string `json:"text"`
 	} `json:"delta"`
 	Usage *struct {
-		InputTokens  int64 `json:"inputTokens"`
-		OutputTokens int64 `json:"outputTokens"`
-		TotalTokens  int64 `json:"totalTokens"`
+		InputTokens      int64 `json:"inputTokens"`
+		OutputTokens     int64 `json:"outputTokens"`
+		TotalTokens      int64 `json:"totalTokens"`
+		CacheReadTokens  int64 `json:"cacheReadInputTokens"`
+		CacheWriteTokens int64 `json:"cacheWriteInputTokens"`
 	} `json:"usage"`
 }
 
@@ -105,6 +108,12 @@ func applyConverseStreamEvent(eventType string, payload []byte, usage *llm.Usage
 			if ev.Usage.TotalTokens > 0 {
 				usage.TotalTokens = ev.Usage.TotalTokens
 			}
+			if ev.Usage.CacheReadTokens > 0 {
+				usage.CachedInputTokens = ev.Usage.CacheReadTokens
+			}
+			if ev.Usage.CacheWriteTokens > 0 {
+				usage.CacheCreationTokens = ev.Usage.CacheWriteTokens
+			}
 		}
 	}
 }
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go b/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go
index f93505882..f66347591 100644
--- a/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go
+++ b/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go
@@ -66,6 +66,24 @@ func TestAccumulateBedrockStream_Converse(t *testing.T) {
 	require.Equal(t, "pong", completion, "converse text deltas concatenated")
 }
 
+// The converse-stream metadata frame's camelCase cache fields must reach the billed cache buckets.
+func TestAccumulateBedrockStream_ConverseCacheBuckets(t *testing.T) {
+	var body bytes.Buffer
+	body.Write(bedrockFrame(t, "contentBlockDelta", mustJSON(t, map[string]any{"delta": map[string]any{"text": "pong"}})))
+	body.Write(bedrockFrame(t, "metadata", mustJSON(t, map[string]any{"usage": map[string]any{
+		"inputTokens": 11, "outputTokens": 3, "totalTokens": 30,
+		"cacheReadInputTokens": 7, "cacheWriteInputTokens": 9,
+	}})))
+
+	usage, completion := accumulateBedrockStream(body.Bytes())
+	require.Equal(t, int64(11), usage.InputTokens, "input tokens from metadata frame")
+	require.Equal(t, int64(3), usage.OutputTokens, "output tokens from metadata frame")
+	require.Equal(t, int64(7), usage.CachedInputTokens, "cache-read tokens from metadata frame")
+	require.Equal(t, int64(9), usage.CacheCreationTokens, "cache-write tokens from metadata frame")
+	require.Equal(t, int64(30), usage.TotalTokens, "provider-reported total wins")
+	require.Equal(t, "pong", completion)
+}
+
 func TestAccumulateBedrockStream_Truncated(t *testing.T) {
 	// A body cut mid-frame must not panic; partial usage is returned.
 	full := bedrockFrame(t, "metadata", mustJSON(t, map[string]any{"usage": map[string]any{"inputTokens": 11, "outputTokens": 3}}))
diff --git a/proxy/internal/middleware/builtin/llm_router/bedrock_discovery_test.go b/proxy/internal/middleware/builtin/llm_router/bedrock_discovery_test.go
new file mode 100644
index 000000000..d21e33c21
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_router/bedrock_discovery_test.go
@@ -0,0 +1,175 @@
+package llm_router
+
+import (
+	"context"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// bedrockRoute is a Bedrock provider whose listing lives on the control plane
+// while inference goes to the runtime host — the split this file is about.
+func bedrockRoute(models []string, policies []ModelPolicyRule) ProviderRoute {
+	return ProviderRoute{
+		ID:              "prov-bedrock",
+		Bedrock:         true,
+		Models:          models,
+		ModelPolicies:   policies,
+		UpstreamScheme:  "https",
+		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
+		DiscoveryHost:   "bedrock.eu-central-1.amazonaws.com",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer aws-token",
+		AllowedGroupIDs: []string{defaultTestGroup},
+	}
+}
+
+func getInput(path string) *middleware.Input {
+	return &middleware.Input{
+		Slot:       middleware.SlotOnRequest,
+		Method:     http.MethodGet,
+		URL:        "https://endpoint.netbird.local" + path,
+		UserGroups: []string{defaultTestGroup},
+	}
+}
+
+// TestBedrockListingGoesToTheControlPlane is the whole point of DiscoveryHost.
+// ListInferenceProfiles is not an operation bedrock-runtime implements — it
+// answers <UnknownOperationException/> — so a listing forwarded to the
+// inference upstream can only 404, however well it is routed.
+func TestBedrockListingGoesToTheControlPlane(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{bedrockRoute(nil, nil)}})
+
+	out, err := mw.Invoke(context.Background(), getInput("/inference-profiles"))
+	require.NoError(t, err)
+	require.Equal(t, middleware.DecisionAllow, out.Decision)
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+
+	assert.Equal(t, "bedrock.eu-central-1.amazonaws.com", out.Mutations.RewriteUpstream.Host)
+}
+
+// TestBedrockInferenceStillGoesToTheRuntimeHost is the other half: the
+// redirect must apply to the listing alone. Sending an InvokeModel call to the
+// control plane would break every Bedrock request in the account.
+func TestBedrockInferenceStillGoesToTheRuntimeHost(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{bedrockRoute(nil, nil)}})
+
+	in := newInputWithModelAndURL("anthropic.claude-haiku-4-5",
+		"https://endpoint.netbird.local/model/eu.anthropic.claude-haiku-4-5-20251001-v1:0/invoke")
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.Equal(t, middleware.DecisionAllow, out.Decision)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+
+	assert.Equal(t, "bedrock-runtime.eu-central-1.amazonaws.com", out.Mutations.RewriteUpstream.Host)
+}
+
+// TestIsListingPath guards the narrower reading of "model-less". Both the
+// upstream redirect and the policy bound key on this, and the warming probe
+// must be excluded from both: it carries no listing to filter, and pointing it
+// at the control plane would warm a pool the inference requests never use.
+func TestIsListingPath(t *testing.T) {
+	for path, want := range map[string]bool{
+		"/v1/models":                  true,
+		"/inference-profiles":         true,
+		"/bedrock/inference-profiles": true,
+		"/api/hello":                  false,
+		"/v1/models/gpt-4o":           false, // the per-model lookup, routed elsewhere
+		"/v1/chat/completions":        false,
+	} {
+		t.Run(path, func(t *testing.T) {
+			assert.Equal(t, want, isListingPath(path))
+		})
+	}
+}
+
+// TestBedrockListingIsBoundByPolicy covers the case that was previously
+// unreachable: filtering keyed on /v1/models alone, so a Bedrock listing was
+// routed but never narrowed to what the caller may use.
+func TestBedrockListingIsBoundByPolicy(t *testing.T) {
+	route := bedrockRoute(
+		[]string{"eu.anthropic.claude-haiku-4-5-20251001-v1:0", "eu.anthropic.claude-sonnet-4-6"},
+		[]ModelPolicyRule{{
+			GroupIDs: []string{defaultTestGroup},
+			// A guardrail allowlist names the catalog key, which is the form an
+			// operator picks in the UI — not the region-prefixed wire id the
+			// record registers.
+			Models: []string{"anthropic.claude-haiku-4-5"},
+		}},
+	)
+	mw := New(Config{Providers: []ProviderRoute{route}})
+
+	out, err := mw.Invoke(context.Background(), getInput("/inference-profiles"))
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+
+	// Exact-string intersection would find nothing here and bound the listing
+	// to empty, handing the caller a picker with no models on a provider that
+	// works perfectly well.
+	assert.Equal(t, []string{"eu.anthropic.claude-haiku-4-5-20251001-v1:0"},
+		out.Mutations.RewriteUpstream.DiscoveryModels)
+}
+
+// TestBedrockListingWithoutADiscoveryHostFallsThrough keeps a proxied or
+// self-hosted Bedrock endpoint working: the synthesiser emits no discovery
+// host for one, and the listing must then go to the configured upstream rather
+// than nowhere.
+func TestBedrockListingWithoutADiscoveryHostFallsThrough(t *testing.T) {
+	route := bedrockRoute(nil, nil)
+	route.UpstreamHost = "bedrock.internal.example.com"
+	route.DiscoveryHost = ""
+	mw := New(Config{Providers: []ProviderRoute{route}})
+
+	out, err := mw.Invoke(context.Background(), getInput("/inference-profiles"))
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+
+	assert.Equal(t, "bedrock.internal.example.com", out.Mutations.RewriteUpstream.Host)
+}
+
+// TestBedrockProfileDetailHonoursTheModelTable covers GetInferenceProfile,
+// which the listing filter cannot help with: it answers for one profile with a
+// single object, not a set, so nothing narrows it on the way back. Authorising
+// it by provider type alone would let any caller with a Bedrock route read the
+// full configuration of every profile in the account.
+//
+// Both registration spellings are exercised, because a record may carry the
+// raw profile id AWS issues or the catalog key it reduces to.
+func TestBedrockProfileDetailHonoursTheModelTable(t *testing.T) {
+	const permitted = "eu.anthropic.claude-sonnet-5-20260514-v1:0"
+
+	for _, registered := range []string{permitted, "anthropic.claude-sonnet-5"} {
+		t.Run(registered, func(t *testing.T) {
+			mw := New(Config{Providers: []ProviderRoute{bedrockRoute([]string{registered}, nil)}})
+
+			out, err := mw.Invoke(context.Background(), getInput("/inference-profiles/"+permitted))
+			require.NoError(t, err)
+			assert.Equal(t, middleware.DecisionAllow, out.Decision,
+				"a profile the record registers must still resolve")
+
+			denied, err := mw.Invoke(context.Background(),
+				getInput("/inference-profiles/eu.anthropic.claude-opus-5-20260514-v1:0"))
+			require.NoError(t, err)
+			assert.Equal(t, middleware.DecisionDeny, denied.Decision,
+				"a profile outside the record's models must not be readable")
+		})
+	}
+}
+
+// TestBedrockProfileListingStaysModelLess pins the other half: the listing
+// names no profile, so it must not be judged against the model table. It is
+// bounded by DiscoveryModels in the response instead, and denying it here
+// would take model discovery away from exactly the records that enumerate
+// their models.
+func TestBedrockProfileListingStaysModelLess(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{bedrockRoute([]string{"anthropic.claude-sonnet-5"}, nil)}})
+
+	out, err := mw.Invoke(context.Background(), getInput("/inference-profiles"))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+}
diff --git a/proxy/internal/middleware/builtin/llm_router/bedrock_route_test.go b/proxy/internal/middleware/builtin/llm_router/bedrock_route_test.go
new file mode 100644
index 000000000..03a17aa52
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_router/bedrock_route_test.go
@@ -0,0 +1,134 @@
+package llm_router
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// TestRouteClaimsModel_BedrockNormalizesCandidate guards the fix for the native
+// Bedrock routing gap: the request model reaches the router already normalized
+// (the parser strips the region/inference-profile prefix and version suffix),
+// so a provider registered with the raw inference-profile id must still match.
+func TestRouteClaimsModel_BedrockNormalizesCandidate(t *testing.T) {
+	route := ProviderRoute{Bedrock: true, Models: []string{"us.anthropic.claude-haiku-4-5"}}
+	assert.True(t, routeClaimsModel(route, "anthropic.claude-haiku-4-5"),
+		"raw region-prefixed Bedrock model must match the normalized request model")
+	assert.False(t, routeClaimsModel(route, "anthropic.claude-opus-4-8"),
+		"a model outside the provider's list must not match")
+
+	// A provider registered with the already-normalized id also matches.
+	normalized := ProviderRoute{Bedrock: true, Models: []string{"anthropic.claude-haiku-4-5"}}
+	assert.True(t, routeClaimsModel(normalized, "anthropic.claude-haiku-4-5"),
+		"normalized Bedrock model must match")
+
+	// Non-Bedrock routes keep exact matching (no prefix stripping).
+	openai := ProviderRoute{Models: []string{"gpt-4o"}}
+	assert.True(t, routeClaimsModel(openai, "gpt-4o"), "exact model must match")
+	assert.False(t, routeClaimsModel(openai, "us.gpt-4o"),
+		"non-Bedrock routes must not strip a us. prefix")
+}
+
+// TestRouter_BedrockCountTokensRoutes pins that the token-counting action
+// reaches the Bedrock route instead of denying as not-routable.
+func TestRouter_BedrockCountTokensRoutes(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "bedrock-prod",
+		Bedrock:         true,
+		Models:          []string{"anthropic.claude-sonnet-4-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
+	}}})
+
+	in := newInputWithModelAndURL("anthropic.claude-sonnet-4-5",
+		"/model/anthropic.claude-sonnet-4-5-20250929-v1:0/count-tokens")
+	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "bedrock"})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "count-tokens must route, not deny")
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "bedrock-runtime.eu-central-1.amazonaws.com", out.Mutations.RewriteUpstream.Host)
+}
+
+// TestRouter_BedrockInferenceProfilesRoutes covers the startup lookups a
+// client makes to resolve a configured inference profile. They carry no
+// model, so before they were recognised they denied and wrote a policy
+// rejection into the access log on every session start.
+func TestRouter_BedrockInferenceProfilesRoutes(t *testing.T) {
+	bedrock := ProviderRoute{
+		ID:              "bedrock-prod",
+		Bedrock:         true,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
+	}
+	openai := ProviderRoute{
+		ID:              "openai-prod",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}
+	mw := New(Config{Providers: []ProviderRoute{openai, bedrock}})
+
+	for _, path := range []string{
+		"/inference-profiles?type=SYSTEM_DEFINED",
+		"/inference-profiles/us.anthropic.claude-sonnet-5",
+	} {
+		out, err := mw.Invoke(context.Background(), newModellessInput(path))
+		require.NoError(t, err)
+		require.NotNil(t, out)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision, "%s must route", path)
+		require.NotNil(t, out.Mutations)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Equal(t, "bedrock-runtime.eu-central-1.amazonaws.com", out.Mutations.RewriteUpstream.Host,
+			"%s must reach the Bedrock provider, not the first authorised one", path)
+
+		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+		assert.Equal(t, "true", nonInference, "%s carries no model to gate on", path)
+	}
+}
+
+// TestRouter_BedrockNamespacedInferenceProfilesStripsPrefix pins that the
+// optional gateway namespace is removed before the request goes upstream.
+func TestRouter_BedrockNamespacedInferenceProfilesStripsPrefix(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "bedrock-prod",
+		Bedrock:         true,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
+	}}})
+
+	out, err := mw.Invoke(context.Background(), newModellessInput("/bedrock/inference-profiles"))
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "/bedrock", out.Mutations.RewriteUpstream.StripPathPrefix,
+		"the namespace prefix must not reach the real Bedrock endpoint")
+}
+
+// TestRouteClaimsModel_VertexNormalizesCandidate is the Vertex counterpart of
+// the Bedrock case above: the parser strips the "@version" suffix from the
+// path model, so a provider registered with the versioned form must still
+// match the normalized request model.
+func TestRouteClaimsModel_VertexNormalizesCandidate(t *testing.T) {
+	route := ProviderRoute{Vertex: true, Models: []string{"claude-sonnet-4-5@20250929"}}
+	assert.True(t, routeClaimsModel(route, "claude-sonnet-4-5"),
+		"raw @version Vertex model must match the normalized request model")
+	assert.False(t, routeClaimsModel(route, "claude-opus-4-8"),
+		"a model outside the provider's list must not match")
+
+	// Non-Vertex routes keep exact matching (no @version stripping).
+	openai := ProviderRoute{Models: []string{"gpt-4o@2024"}}
+	assert.False(t, routeClaimsModel(openai, "gpt-4o"),
+		"non-Vertex routes must not strip an @version suffix")
+}
diff --git a/proxy/internal/middleware/builtin/llm_router/factory.go b/proxy/internal/middleware/builtin/llm_router/factory.go
index 938a23ebe..70a2179b5 100644
--- a/proxy/internal/middleware/builtin/llm_router/factory.go
+++ b/proxy/internal/middleware/builtin/llm_router/factory.go
@@ -36,7 +36,10 @@ type ProviderRoute struct {
 	// request on a same-vendor route so catch-all gateways of a different
 	// vendor can't swallow it. Empty disables vendor filtering for this
 	// route.
-	Vendor          string   `json:"vendor,omitempty"`
+	Vendor string `json:"vendor,omitempty"`
+	// Vendors lists every parser surface a multi-surface gateway accepts.
+	// Vendor remains supported for existing single-surface configurations.
+	Vendors         []string `json:"vendors,omitempty"`
 	Models          []string `json:"models"`
 	UpstreamScheme  string   `json:"upstream_scheme"`
 	UpstreamHost    string   `json:"upstream_host"`
@@ -44,6 +47,19 @@ type ProviderRoute struct {
 	AuthHeaderName  string   `json:"auth_header_name"`
 	AuthHeaderValue string   `json:"auth_header_value"`
 	AllowedGroupIDs []string `json:"allowed_group_ids"`
+	// ModelPolicies carries, per authorising policy, the source groups it
+	// binds and the models it permits. The router uses it to bound a model
+	// listing to what THIS caller may use: a provider reachable by two groups
+	// under different allowlists must not offer either group the other's
+	// models. Empty means no policy restricts models on this route.
+	ModelPolicies []ModelPolicyRule `json:"model_policies,omitempty"`
+	// DiscoveryHost, when set, is the host that serves this provider's model
+	// listing, for a vendor that does not serve it from the same host as
+	// inference. Bedrock is why it exists: ListInferenceProfiles is a control
+	// plane operation on bedrock.<region>, while InvokeModel must go to
+	// bedrock-runtime.<region>, so one record genuinely needs two hosts.
+	// Empty means the listing is served from UpstreamHost like everything else.
+	DiscoveryHost string `json:"discovery_host,omitempty"`
 	// Vertex marks a Google Vertex AI provider. Vertex requests carry the
 	// model in the URL path, so the router selects this route by path
 	// (isVertexPath) and bypasses the model/vendor table entirely.
@@ -65,6 +81,18 @@ type ProviderRoute struct {
 	SkipTLSVerify bool `json:"skip_tls_verify,omitempty"`
 }
 
+// ModelPolicyRule is one authorising policy's contribution to what a caller
+// may use on a route: the source groups it binds, and the models it permits.
+//
+// Models is nil when the policy sets no model allowlist — an unrestricted
+// policy, which lifts the restriction for the groups it binds. That is why
+// nil and empty must stay distinct: an empty list is a guardrail that permits
+// nothing, and collapsing the two would let a listing fail open.
+type ModelPolicyRule struct {
+	GroupIDs []string `json:"group_ids"`
+	Models   []string `json:"models"`
+}
+
 // Config is the on-wire configuration accepted by the factory. An
 // empty Providers slice yields a router that denies every request as
 // not-routable; the synthesiser is responsible for stamping the
diff --git a/proxy/internal/middleware/builtin/llm_router/middleware.go b/proxy/internal/middleware/builtin/llm_router/middleware.go
index 2aaeb1089..5c0a45119 100644
--- a/proxy/internal/middleware/builtin/llm_router/middleware.go
+++ b/proxy/internal/middleware/builtin/llm_router/middleware.go
@@ -23,6 +23,7 @@ import (
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/google"
 
+	"github.com/netbirdio/netbird/proxy/internal/llm"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
 
@@ -108,6 +109,10 @@ func (m *Middleware) MetadataKeys() []string {
 		middleware.KeyLLMAuthorisingGroups,
 		middleware.KeyLLMPolicyDecision,
 		middleware.KeyLLMPolicyReason,
+		middleware.KeyLLMNonInference,
+		// Emitted only for the per-model lookup, whose model lives in the path
+		// rather than a body the parser could read.
+		middleware.KeyLLMModel,
 	}
 }
 
@@ -136,29 +141,26 @@ const (
 // known to a provider that no policy authorises for the caller deny
 // with no_authorised_provider.
 func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
+	reqPath := requestPath(in.URL)
+	// The caller's API dialect, used to mirror a denial in the vendor's own
+	// error shape so the client can explain it to the user.
+	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
+	model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
+
 	// Vertex AI carries the model in the URL path, not the body, and is
 	// selected by path rather than by the model/vendor table. Route it before
 	// the model lookup so a model the parser extracted from the path can't be
 	// claimed by a same-vendor direct provider (e.g. claude-* on api.anthropic.com).
-	reqPath := requestPath(in.URL)
 	if isVertexPath(reqPath) {
-		model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 		// The request parser emits no llm.provider for a Vertex publisher it
 		// can't parse (e.g. google/gemini). Forwarding such a request would
 		// bypass token/budget metering, so deny it rather than serve it
 		// unmetered.
-		if vendor, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider); vendor == "" {
-			return denyUnmeterable(), nil
+		if surface == "" {
+			return denyUnmeterable(surface), nil
 		}
 		route, outcome := m.matchVertex(reqPath, model, in.UserGroups)
-		switch outcome {
-		case matchOutcomeFound:
-			return m.allowWithRoute(route, in.UserGroups), nil
-		case matchOutcomeUnauthorised:
-			return denyNoAuthorisedRoute(model), nil
-		default:
-			return denyUnknownModel(model), nil
-		}
+		return m.decide(route, outcome, surface, model, in.UserGroups, nil), nil
 	}
 
 	// Bedrock likewise carries the model in the URL path (/model/{id}/{action}),
@@ -166,52 +168,236 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 	// before the model lookup; when the prefix is present, strip it from the
 	// forwarded path so the real Bedrock endpoint receives its native path.
 	if isBedrockPath(reqPath) {
-		model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 		native, hadPrefix := splitBedrockNamespace(reqPath)
 		route, outcome := m.matchBedrock(native, model, in.UserGroups)
-		switch outcome {
-		case matchOutcomeFound:
-			out := m.allowWithRoute(route, in.UserGroups)
-			if hadPrefix && out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
-				out.Mutations.RewriteUpstream.StripPathPrefix = bedrockNamespacePrefix
+		return m.decide(route, outcome, surface, model, in.UserGroups, func(out *middleware.Output) {
+			if hadPrefix {
+				stripBedrockNamespace(out)
 			}
-			return out, nil
-		case matchOutcomeUnauthorised:
-			return denyNoAuthorisedRoute(model), nil
-		default:
-			return denyUnknownModel(model), nil
-		}
+		}), nil
 	}
 
-	model, ok := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
-	if !ok || model == "" {
-		// Non-inference endpoints (model listing) carry no model but still
-		// need rewriting from the synth placeholder to a real upstream;
-		// clients such as Codex call GET /v1/models at startup to enumerate
-		// availability and read a 403 as "model unavailable".
-		route, outcome := m.matchModelless(requestPath(in.URL), in.UserGroups)
-		switch outcome {
-		case matchOutcomeFound:
-			return m.allowWithRoute(route, in.UserGroups), nil
-		case matchOutcomeUnauthorised:
-			// A recognised model-less endpoint exists but no provider
-			// authorises the caller — deny as an authorisation failure
-			// rather than masking it as a missing model.
-			return denyNoAuthorisedRoute(model), nil
-		default:
-			return denyMissingModel(), nil
-		}
+	// GET /v1/models/{id} carries no body, so no model reaches the router in
+	// metadata — but the path names one, and answering it confirms a model
+	// exists and is reachable. Authorise it against the model table like any
+	// other per-model request, then mark it non-inference so it still skips
+	// the token pre-flight it would otherwise charge nothing against.
+	if detail, isDetail := modelDetailID(reqPath); isDetail && isNonInferenceMethod(in.Method) {
+		route, outcome := m.matchRoute(detail, surface, reqPath, in.UserGroups)
+		return m.decide(route, outcome, surface, detail, in.UserGroups, func(out *middleware.Output) {
+			markNonInference(out)
+			// The parser reads models from JSON bodies only, and this request
+			// has none, so stamp the one the path names. Without it the
+			// guardrail's own allowlist — a separate, possibly narrower list
+			// than the route's — never sees a model to check.
+			out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMModel, Value: detail})
+		}), nil
 	}
 
-	vendor, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
-	route, outcome := m.matchRoute(model, vendor, requestPath(in.URL), in.UserGroups)
+	if model == "" {
+		return m.routeModelless(reqPath, surface, in.Method, in.UserGroups), nil
+	}
+
+	route, outcome := m.matchRoute(model, surface, reqPath, in.UserGroups)
+	return m.decide(route, outcome, surface, model, in.UserGroups, nil), nil
+}
+
+// decide turns a per-model match result into the middleware's decision. Every
+// surface that routes by model shares the same two denial arms — a model no
+// route claims is not routable, one that some route claims but none authorises
+// for this caller is an authorisation failure — so they live here once.
+// decorate, when non-nil, adjusts the allow with whatever that surface needs.
+func (m *Middleware) decide(
+	route ProviderRoute,
+	outcome matchOutcome,
+	surface, model string,
+	userGroups []string,
+	decorate func(*middleware.Output),
+) *middleware.Output {
 	switch outcome {
 	case matchOutcomeFound:
-		return m.allowWithRoute(route, in.UserGroups), nil
+		out := m.allowWithRoute(route, surface, userGroups)
+		if decorate != nil {
+			decorate(out)
+		}
+		return out
 	case matchOutcomeUnauthorised:
-		return denyNoAuthorisedRoute(model), nil
+		return denyNoAuthorisedRoute(surface, model)
 	default:
-		return denyUnknownModel(model), nil
+		return denyUnknownModel(surface, model)
+	}
+}
+
+// routeModelless serves the endpoints that name no model at all: the model
+// listing, the connection-warming probe, and the Bedrock inference-profile
+// lookup. They still need rewriting from the synth placeholder to a real
+// upstream — clients such as Codex call GET /v1/models at startup to enumerate
+// availability and read a 403 as "model unavailable".
+func (m *Middleware) routeModelless(reqPath, surface, method string, userGroups []string) *middleware.Output {
+	route, outcome := m.matchModelless(reqPath, method, userGroups)
+	switch outcome {
+	case matchOutcomeFound:
+		out := m.allowWithRoute(route, surface, userGroups)
+		markNonInference(out)
+		if _, hadPrefix := splitBedrockNamespace(reqPath); hadPrefix {
+			stripBedrockNamespace(out)
+		}
+		if isListingPath(reqPath) && out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
+			// A vendor that serves its listing from somewhere other than its
+			// inference upstream is redirected here, and only for the listing
+			// — every other request still goes to the configured upstream.
+			if route.DiscoveryHost != "" {
+				out.Mutations.RewriteUpstream.Host = route.DiscoveryHost
+			}
+			// What the caller may actually use bounds what the picker may
+			// offer: every entry outside it is a request the chain will deny a
+			// moment later.
+			if models, bounded := discoverableModels(route, userGroups); bounded {
+				out.Mutations.RewriteUpstream.DiscoveryModels = models
+			}
+		}
+		return out
+	case matchOutcomeUnauthorised:
+		// A recognised model-less endpoint exists but no provider authorises
+		// the caller — deny as an authorisation failure rather than masking it
+		// as a missing model.
+		return denyNoAuthorisedRoute(surface, "")
+	default:
+		return denyMissingModel(surface)
+	}
+}
+
+// isNonInferenceMethod reports whether a request method is one the
+// non-inference endpoints actually use: the listing and the per-model lookup
+// are GET, the connection-warming probe is HEAD or GET. The method is the only
+// thing separating "GET /v1/models/{id}" from a POST to the same path carrying
+// an inference body, and the non-inference mark exempts a request from the
+// token pre-flight — so anything else falls through to normal per-model
+// routing, which denies when the request names no model.
+func isNonInferenceMethod(method string) bool {
+	return method == http.MethodGet || method == http.MethodHead
+}
+
+// discoverableModels returns the model ids a caller in userGroups may actually
+// use on this route, and whether the listing should be bounded to them at all.
+//
+// Two things narrow a listing, and both must apply or the picker offers models
+// the very next request refuses:
+//
+//   - the provider's own enumerated models, when it lists any (a gateway record
+//     enumerates nothing and claims everything);
+//   - the model allowlists of the policies that authorise THIS caller. A
+//     provider reachable by two groups under different allowlists must not
+//     offer either group the other's models, which is why the rules carry their
+//     source groups rather than arriving pre-flattened.
+//
+// A policy that sets no allowlist lifts the restriction for the groups it
+// binds, so a caller holding one unrestricted policy sees the provider's full
+// list. bounded is false when nothing narrows the listing — an unrestricted
+// caller on a route that enumerates nothing — in which case the upstream's own
+// answer passes through untouched.
+func discoverableModels(route ProviderRoute, userGroups []string) ([]string, bool) {
+	permitted, restricted := policyPermittedModels(route, userGroups)
+
+	switch {
+	case !restricted && len(route.Models) == 0:
+		return nil, false
+	case !restricted:
+		return append([]string(nil), route.Models...), true
+	case len(route.Models) == 0:
+		// A gateway record enumerates nothing, so the allowlist is the whole
+		// bound — previously such a record offered the upstream's entire
+		// catalogue however narrow the policy was.
+		return sortedModels(permitted), true
+	}
+
+	// Both bound: only what the provider serves and the policy permits.
+	intersection := make(map[string]struct{}, len(route.Models))
+	for _, m := range route.Models {
+		if _, ok := permitted[m]; ok {
+			intersection[m] = struct{}{}
+			continue
+		}
+		// The two sides are not always written the same way. A Bedrock record
+		// may register the raw inference-profile id an operator copied from
+		// AWS while a guardrail allowlist names the catalog key, and comparing
+		// those verbatim finds nothing — which would bound a correctly
+		// configured provider's listing down to empty. routeClaimsModel
+		// already normalises the candidate for exactly this reason, and the
+		// listing bound has to agree with it or the picker disagrees with what
+		// the guardrail will actually allow.
+		if route.Bedrock {
+			if _, ok := permitted[llm.NormalizeBedrockModel(m)]; ok {
+				intersection[m] = struct{}{}
+			}
+		}
+		if route.Vertex {
+			if _, ok := permitted[llm.NormalizeVertexModel(m)]; ok {
+				intersection[m] = struct{}{}
+			}
+		}
+	}
+	return sortedModels(intersection), true
+}
+
+// policyPermittedModels folds the rules whose groups intersect the caller's
+// into the set of models they permit. restricted is false when the caller
+// holds at least one authorising policy that sets no allowlist, or when no
+// rule binds them at all.
+func policyPermittedModels(route ProviderRoute, userGroups []string) (map[string]struct{}, bool) {
+	permitted := make(map[string]struct{})
+	restricted := false
+	for _, rule := range route.ModelPolicies {
+		if !groupsIntersect(rule.GroupIDs, userGroups) {
+			continue
+		}
+		if rule.Models == nil {
+			// An unrestricted policy the caller holds lifts the restriction
+			// entirely, whatever the others say.
+			return nil, false
+		}
+		restricted = true
+		for _, m := range rule.Models {
+			permitted[m] = struct{}{}
+		}
+	}
+	return permitted, restricted
+}
+
+// groupsIntersect reports whether the two group-id sets share a member.
+func groupsIntersect(a, b []string) bool {
+	for _, x := range a {
+		for _, y := range b {
+			if x == y {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// sortedModels flattens a model set into a stable slice so the bound the proxy
+// applies — and any test asserting on it — does not depend on map order.
+func sortedModels(set map[string]struct{}) []string {
+	out := make([]string, 0, len(set))
+	for m := range set {
+		out = append(out, m)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// markNonInference tags an allow as a request that spends no tokens, so the
+// limit check skips the management pre-flight it would charge nothing against.
+func markNonInference(out *middleware.Output) {
+	out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"})
+}
+
+// stripBedrockNamespace tells the rewrite to drop the optional "/bedrock"
+// gateway namespace so the upstream receives its native Bedrock path.
+func stripBedrockNamespace(out *middleware.Output) {
+	if out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
+		out.Mutations.RewriteUpstream.StripPathPrefix = bedrockNamespacePrefix
 	}
 }
 
@@ -228,7 +414,7 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 //     peer, return matchOutcomeUnauthorised so the caller can emit
 //     the dedicated no_authorised_provider deny code.
 //  3. Vendor precedence: when the request carries a detected vendor
-//     (llm.provider) and at least one candidate is the same vendor,
+//     (llm.provider) and at least one candidate declares that vendor,
 //     drop the rest — a vendor-tagged request must never cross to
 //     another vendor's route (e.g. an Anthropic call landing on an
 //     OpenAI-compatible gateway that also claims the model).
@@ -251,9 +437,9 @@ func (m *Middleware) matchRoute(model, vendor, reqPath string, userGroups []stri
 
 	// Vendor pinning runs BEFORE the group filter so a request the parser
 	// tagged with a vendor can never cross to another vendor's route — not
-	// even an authorised one. Narrow to same-vendor routes when any
-	// model-matched route declares that vendor; setups with no vendor tag on
-	// any route fall through unchanged. After narrowing, if no same-vendor
+	// even an authorised one. Narrow to supporting routes when any
+	// model-matched route declares that vendor; setups with no matching vendor
+	// declaration fall through unchanged. After narrowing, if no supporting
 	// route authorises the caller, that's matchOutcomeUnauthorised (no
 	// cross-vendor fallback).
 	if vendor != "" {
@@ -299,12 +485,91 @@ func (m *Middleware) matchRoute(model, vendor, reqPath string, userGroups []stri
 	return best, matchOutcomeFound
 }
 
-// isModelLessPath reports whether reqPath is a known OpenAI-shaped
-// non-inference endpoint that legitimately carries no model in its
-// request (the model-listing endpoints). These must route to an upstream
-// rather than deny, so model enumeration works end to end.
+// connectionWarmPath is the probe Anthropic clients send before their first
+// inference request to open the upstream connection early. Forwarding it
+// warms the connection the request will actually use; denying it only fills
+// the access log with rejections at every session start.
+const connectionWarmPath = "/api/hello"
+
+// modelListingPath is the endpoint clients read at startup to populate
+// their model picker. Its response is a list the proxy can bound; the
+// per-model "/v1/models/{id}" lookup returns a single object and is left
+// alone.
+const modelListingPath = "/v1/models"
+
+// isListingPath reports whether reqPath asks for a MODEL LISTING, as opposed
+// to the other model-less endpoints. Only a listing gets an upstream redirect
+// and a policy bound: the connection-warming probe carries no model list to
+// filter, and rewriting its host would send the warm-up to the wrong pool.
+func isListingPath(reqPath string) bool {
+	return reqPath == modelListingPath || isBedrockModelLessPath(reqPath)
+}
+
+// isModelLessPath reports whether reqPath is a known non-inference endpoint
+// that legitimately carries no model at all: the model listing and the
+// connection-warming probe. These must route to an upstream rather than
+// deny, so model enumeration works end to end. The per-model
+// "/v1/models/{id}" lookup is deliberately excluded — it names a model, so
+// it is authorised against the model table instead (see modelDetailID).
 func isModelLessPath(reqPath string) bool {
-	return reqPath == "/v1/models" || strings.HasPrefix(reqPath, "/v1/models/")
+	return reqPath == modelListingPath || reqPath == connectionWarmPath
+}
+
+// modelDetailID returns the model id named by a "/v1/models/{id}" lookup.
+// reqPath comes from url.URL.Path, which is already percent-decoded, so an
+// id carrying a "/" (a self-hosted "Qwen/Qwen2.5-0.5B-Instruct" sent as
+// "Qwen%2FQwen2.5-...") arrives whole and everything after the prefix is the
+// id, separators included.
+func modelDetailID(reqPath string) (string, bool) {
+	if !strings.HasPrefix(reqPath, modelListingPath+"/") {
+		return "", false
+	}
+	id := strings.TrimPrefix(reqPath, modelListingPath+"/")
+	if id == "" {
+		return "", false
+	}
+	return id, true
+}
+
+// isBedrockModelLessPath reports whether reqPath is a Bedrock
+// inference-profile lookup, optionally behind the "/bedrock" gateway
+// namespace. Clients read these at startup to resolve a configured profile
+// to its underlying model. They carry no model of their own, so they route
+// by path to a Bedrock provider rather than through the model table.
+//
+// On native AWS these live on the control plane ("bedrock.<region>") while a
+// provider's upstream is normally the runtime host ("bedrock-runtime.<region>"),
+// so forwarding yields a 404 there. That is deliberate: a client has one base
+// URL, so pointing it straight at the runtime host 404s identically, and
+// forwarding keeps the proxy transparent instead of inventing a policy denial
+// the client would never otherwise see. Operators whose Bedrock upstream is a
+// gateway that does serve the lookup get a working answer.
+func isBedrockModelLessPath(reqPath string) bool {
+	native, _ := splitBedrockNamespace(reqPath)
+	return native == "/inference-profiles" || strings.HasPrefix(native, bedrockProfileDetailPrefix)
+}
+
+// bedrockProfileDetailPrefix precedes the identifier in a GetInferenceProfile
+// lookup, once any gateway namespace is off the front.
+const bedrockProfileDetailPrefix = "/inference-profiles/"
+
+// bedrockProfileID returns the inference profile a "/inference-profiles/{id}"
+// lookup names. The listing beside it names none, which is what separates the
+// two: a listing is a set the response filter can bound, while this answers
+// for one profile with a single object no filter inspects.
+//
+// The id arrives as AWS issues it — region prefix and version suffix included
+// — because that is the only form that works at invoke time.
+func bedrockProfileID(reqPath string) (string, bool) {
+	native, _ := splitBedrockNamespace(reqPath)
+	if !strings.HasPrefix(native, bedrockProfileDetailPrefix) {
+		return "", false
+	}
+	id := strings.TrimPrefix(native, bedrockProfileDetailPrefix)
+	if id == "" {
+		return "", false
+	}
+	return id, true
 }
 
 // isVertexPath reports whether reqPath is a Google Vertex AI publisher
@@ -331,20 +596,33 @@ func splitBedrockNamespace(reqPath string) (string, bool) {
 	return reqPath, false
 }
 
+// bedrockActions are the runtime actions that follow the model id in a
+// Bedrock path. count-tokens is here so a client can price its context
+// against the dedicated endpoint; denying it pushes that work back onto
+// the inference endpoint, which bills for it.
+var bedrockActions = []string{
+	"/invoke",
+	"/invoke-with-response-stream",
+	"/converse",
+	"/converse-stream",
+	"/count-tokens",
+}
+
 // isBedrockPath reports whether reqPath is an AWS Bedrock runtime model
-// endpoint: /model/{modelId}/{action} where action is invoke,
-// invoke-with-response-stream, converse, or converse-stream — optionally behind
-// a "/bedrock" gateway-namespace prefix. The model lives in the path, so these
-// requests are routed by path to the Bedrock provider.
+// endpoint: /model/{modelId}/{action} — optionally behind a "/bedrock"
+// gateway-namespace prefix. The model lives in the path, so these requests
+// are routed by path to the Bedrock provider.
 func isBedrockPath(reqPath string) bool {
 	native, _ := splitBedrockNamespace(reqPath)
 	if !strings.HasPrefix(native, "/model/") {
 		return false
 	}
-	return strings.HasSuffix(native, "/invoke") ||
-		strings.HasSuffix(native, "/invoke-with-response-stream") ||
-		strings.HasSuffix(native, "/converse") ||
-		strings.HasSuffix(native, "/converse-stream")
+	for _, action := range bedrockActions {
+		if strings.HasSuffix(native, action) {
+			return true
+		}
+	}
+	return false
 }
 
 // matchVertex selects the Vertex provider authorised for the caller's groups
@@ -424,19 +702,42 @@ func (m *Middleware) matchPathRoute(reqPath, model string, userGroups []string,
 // declaration order), matchOutcomeUnauthorised when no provider authorises
 // the caller, or matchOutcomeUnknownModel when the path isn't a recognised
 // model-less endpoint.
-func (m *Middleware) matchModelless(reqPath string, userGroups []string) (ProviderRoute, matchOutcome) {
-	if !isModelLessPath(reqPath) {
+func (m *Middleware) matchModelless(reqPath, method string, userGroups []string) (ProviderRoute, matchOutcome) {
+	if !isNonInferenceMethod(method) {
 		return ProviderRoute{}, matchOutcomeUnknownModel
 	}
-	var candidates []ProviderRoute
-	for _, route := range m.cfg.Providers {
+	var eligible func(ProviderRoute) bool
+	switch {
+	case isBedrockModelLessPath(reqPath):
+		if profile, isDetail := bedrockProfileID(reqPath); isDetail {
+			// A detail lookup names one profile, so it is authorised like any
+			// other per-model request rather than by provider type alone. The
+			// listing beside it is bounded by DiscoveryModels on the way back,
+			// but this answers with a single object no filter inspects — so
+			// without the check here, a caller reads the full configuration of
+			// every profile in the account, including the ones its policy
+			// never named.
+			//
+			// The id is normalised first: a record may register the raw
+			// profile id or the catalog key it reduces to, and routeClaimsModel
+			// expects the normalised form an inference request would carry.
+			wanted := llm.NormalizeBedrockModel(profile)
+			eligible = func(r ProviderRoute) bool { return r.Bedrock && routeClaimsModel(r, wanted) }
+		} else {
+			eligible = func(r ProviderRoute) bool { return r.Bedrock }
+		}
+	case isModelLessPath(reqPath):
 		// Vertex/Bedrock are path-routed and don't serve OpenAI-style
 		// model-listing endpoints; including them here could rewrite a
 		// GET /v1/models to an upstream that 404s it.
-		if route.Vertex || route.Bedrock {
-			continue
-		}
-		if routeAuthorisesGroups(route, userGroups) {
+		eligible = func(r ProviderRoute) bool { return !r.Vertex && !r.Bedrock }
+	default:
+		return ProviderRoute{}, matchOutcomeUnknownModel
+	}
+
+	var candidates []ProviderRoute
+	for _, route := range m.cfg.Providers {
+		if eligible(route) && routeAuthorisesGroups(route, userGroups) {
 			candidates = append(candidates, route)
 		}
 	}
@@ -509,21 +810,31 @@ func authorisingGroupsCSV(routeGroups, userGroups []string) string {
 	return strings.Join(out, ",")
 }
 
-// matchingVendor returns the subset of routes whose Vendor equals the
-// request's detected vendor. Routes with an empty Vendor never match — an
-// untagged route can't be asserted to speak the request's surface, so it
-// stays out of the vendor-filtered set (but remains eligible via the
-// fall-through when no route matches the vendor at all).
+// matchingVendor returns the routes that declare the request's detected
+// vendor through either the legacy singular field or the multi-vendor field.
+// Untagged routes remain eligible only when no route declares the vendor.
 func matchingVendor(routes []ProviderRoute, vendor string) []ProviderRoute {
 	var out []ProviderRoute
 	for _, r := range routes {
-		if r.Vendor == vendor {
+		if routeSupportsVendor(r, vendor) {
 			out = append(out, r)
 		}
 	}
 	return out
 }
 
+func routeSupportsVendor(route ProviderRoute, vendor string) bool {
+	if route.Vendor == vendor {
+		return true
+	}
+	for _, candidate := range route.Vendors {
+		if candidate == vendor {
+			return true
+		}
+	}
+	return false
+}
+
 // explicitlyClaiming returns the subset of routes whose Models list
 // names the model exactly. Catch-all routes (empty Models) are excluded,
 // so callers can prefer a provider that genuinely declares the model over
@@ -555,6 +866,29 @@ func routeClaimsModel(route ProviderRoute, model string) bool {
 		if candidate == model {
 			return true
 		}
+		// Bedrock request models reach the router already normalized (the parser
+		// strips the region / inference-profile prefix and version suffix), but
+		// the operator may register the raw inference-profile id (e.g.
+		// "us.anthropic.claude-haiku-4-5"). Normalize the candidate so both sides
+		// compare equal; otherwise a native Bedrock request denies as not-routable.
+		if route.Bedrock && llm.NormalizeBedrockModel(candidate) == model {
+			return true
+		}
+		// Vertex likewise: the parser strips the "@version" suffix from the
+		// path model, while the operator may register the versioned form.
+		if route.Vertex && llm.NormalizeVertexModel(candidate) == model {
+			return true
+		}
+		// A client may pin a dated Anthropic id ("claude-sonnet-4-5-20250929")
+		// where the operator registered the undated one. Only an undated
+		// registration absorbs a dated request: normalising both sides would
+		// let a route pinned to one dated release claim a different one, so an
+		// operator who deliberately pinned a build would silently serve
+		// another — and with several such routes, ordering would decide which.
+		if candidate == llm.NormalizeAnthropicModel(candidate) &&
+			candidate == llm.NormalizeAnthropicModel(model) {
+			return true
+		}
 	}
 	return false
 }
@@ -603,7 +937,7 @@ func requestPath(raw string) string {
 // provider id so identity-stamping middlewares (llm_identity_inject)
 // tag the request with ONLY the groups that authorised this specific
 // route — not every group the peer happens to be in.
-func (m *Middleware) allowWithRoute(route ProviderRoute, userGroups []string) *middleware.Output {
+func (m *Middleware) allowWithRoute(route ProviderRoute, surface string, userGroups []string) *middleware.Output {
 	rewrite := &middleware.UpstreamRewrite{
 		Scheme: route.UpstreamScheme,
 		Host:   route.UpstreamHost,
@@ -625,7 +959,7 @@ func (m *Middleware) allowWithRoute(route ProviderRoute, userGroups []string) *m
 		// request time (cached + auto-refreshed) instead of a static value.
 		bearer, err := m.gcpBearer(route.GCPServiceAccountKeyB64)
 		if err != nil {
-			return denyUpstreamAuth()
+			return denyUpstreamAuth(surface)
 		}
 		authValue = bearer
 	}
@@ -695,11 +1029,12 @@ func (m *Middleware) gcpTokenSource(saKeyB64 string) (oauth2.TokenSource, error)
 // denyUpstreamAuth is returned when the router cannot obtain the upstream
 // credential (e.g. a malformed service-account key or an unreachable token
 // endpoint). It surfaces as a 502 — an upstream problem, not a policy denial.
-func denyUpstreamAuth() *middleware.Output {
+func denyUpstreamAuth(surface string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 502,
 		DenyReason: &middleware.DenyReason{
+			Surface: surface,
 			Code:    denyCodeUpstreamAuth,
 			Message: "could not obtain upstream credential",
 		},
@@ -713,11 +1048,12 @@ func denyUpstreamAuth() *middleware.Output {
 // denyUnmeterable returns the deny envelope for a path-routed request whose
 // publisher has no parser surface, so its usage can't be metered. Serving it
 // would bypass token/budget caps, so it is rejected with a 403.
-func denyUnmeterable() *middleware.Output {
+func denyUnmeterable(surface string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
+			Surface: surface,
 			Code:    denyCodeUnmeterable,
 			Message: "request publisher is not supported for metering",
 		},
@@ -730,11 +1066,12 @@ func denyUnmeterable() *middleware.Output {
 
 // denyMissingModel returns the deny envelope for a request whose
 // envelope has no llm.model metadata.
-func denyMissingModel() *middleware.Output {
+func denyMissingModel(surface string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
+			Surface: surface,
 			Code:    denyCodeNotRoutable,
 			Message: "missing llm.model on request envelope",
 		},
@@ -747,11 +1084,12 @@ func denyMissingModel() *middleware.Output {
 
 // denyUnknownModel returns the deny envelope for a model that no
 // configured provider claims.
-func denyUnknownModel(model string) *middleware.Output {
+func denyUnknownModel(surface, model string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
+			Surface: surface,
 			Code:    denyCodeNotRoutable,
 			Message: fmt.Sprintf("no provider configured for model %s", model),
 			Details: map[string]string{"model": model},
@@ -766,11 +1104,12 @@ func denyUnknownModel(model string) *middleware.Output {
 // denyNoAuthorisedRoute returns the deny envelope for a model that one
 // or more providers claim, but where no policy authorises the caller's
 // groups for any of those providers.
-func denyNoAuthorisedRoute(model string) *middleware.Output {
+func denyNoAuthorisedRoute(surface, model string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
+			Surface: surface,
 			Code:    denyCodeNoAuthorisedRoute,
 			Message: fmt.Sprintf("no policy authorises model %s for the caller's groups", model),
 			Details: map[string]string{"model": model},
diff --git a/proxy/internal/middleware/builtin/llm_router/middleware_test.go b/proxy/internal/middleware/builtin/llm_router/middleware_test.go
index 425c383c1..8612d8f18 100644
--- a/proxy/internal/middleware/builtin/llm_router/middleware_test.go
+++ b/proxy/internal/middleware/builtin/llm_router/middleware_test.go
@@ -2,6 +2,7 @@ package llm_router
 
 import (
 	"context"
+	"net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -60,6 +61,8 @@ func TestMiddlewareIdentity(t *testing.T) {
 		[]string{
 			middleware.KeyLLMResolvedProviderID,
 			middleware.KeyLLMAuthorisingGroups,
+			middleware.KeyLLMNonInference,
+			middleware.KeyLLMModel,
 			middleware.KeyLLMPolicyDecision,
 			middleware.KeyLLMPolicyReason,
 		},
@@ -171,8 +174,12 @@ func TestRouter_MissingModel(t *testing.T) {
 // from which a model could be parsed). UserGroups matches defaultTestGroup.
 func newModellessInput(reqURL string) *middleware.Input {
 	return &middleware.Input{
-		Slot:       middleware.SlotOnRequest,
-		URL:        reqURL,
+		Slot: middleware.SlotOnRequest,
+		URL:  reqURL,
+		// The non-inference endpoints are read requests; the method is what
+		// separates them from an inference body posted to the same path, so
+		// state it rather than leaning on the zero value.
+		Method:     http.MethodGet,
 		UserGroups: []string{defaultTestGroup},
 	}
 }
@@ -197,6 +204,12 @@ func TestRouter_ModelLessPath_RoutesToAuthorisedProvider(t *testing.T) {
 
 	provider, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
 	assert.Equal(t, "openai-prod", provider, "resolved provider must be the authorised route")
+
+	// The limits gate reads this to tell "no model applies here" from
+	// "the model could not be determined", which fails closed.
+	nonInference, ok := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+	require.True(t, ok, "model-less allow must mark the request non-inference")
+	assert.Equal(t, "true", nonInference)
 }
 
 func TestRouter_ModelLessPath_MultiProviderDeclarationOrder(t *testing.T) {
@@ -399,6 +412,50 @@ func TestRouter_VendorKeepsOpenAIOffAnthropic(t *testing.T) {
 	assert.Equal(t, "api.openai.com", out.Mutations.RewriteUpstream.Host, "openai vendor must pin to the openai route despite anthropic being declared first")
 }
 
+func TestRouter_MultiVendorGatewayAcceptsBothSurfaces(t *testing.T) {
+	gateway := ProviderRoute{
+		ID:              "agentgateway",
+		Vendors:         []string{"openai", "anthropic"},
+		Models:          nil,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "gateway.example.com",
+	}
+	other := ProviderRoute{
+		ID:              "other-vendor",
+		Vendor:          "mistral",
+		Models:          nil,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "mistral.example.com",
+	}
+	mw := New(Config{Providers: []ProviderRoute{other, gateway}})
+
+	for _, tc := range []struct {
+		name   string
+		vendor string
+		model  string
+		path   string
+	}{
+		{name: "OpenAI", vendor: "openai", model: "gpt-4o-mini", path: "/v1/chat/completions"},
+		{name: "Anthropic", vendor: "anthropic", model: "claude-sonnet-4-5", path: "/v1/messages"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := mw.Invoke(context.Background(), newInputVendorModelURL(tc.vendor, tc.model, tc.path))
+			require.NoError(t, err)
+			require.NotNil(t, out)
+			assert.Equal(t, middleware.DecisionAllow, out.Decision,
+				"supported vendor must route through the multi-surface gateway")
+			require.NotNil(t, out.Mutations)
+			require.NotNil(t, out.Mutations.RewriteUpstream)
+			assert.Equal(t, "gateway.example.com", out.Mutations.RewriteUpstream.Host)
+
+			provider, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+			assert.Equal(t, "agentgateway", provider)
+		})
+	}
+}
+
 // TestRouter_VendorAbsentFallsBackToModelPath confirms vendor filtering is
 // inert when the request carries no detected vendor: routing then relies on
 // model/path as before.
@@ -679,6 +736,23 @@ func TestRouter_FactoryRejectsBadJSON(t *testing.T) {
 	require.Error(t, err, "malformed JSON config must be rejected at chain build time")
 }
 
+func TestRouter_FactoryDecodesLegacyAndMultiVendorFields(t *testing.T) {
+	raw := []byte(`{"providers":[` +
+		`{"id":"legacy","vendor":"openai","models":[],"upstream_scheme":"https","upstream_host":"openai.example.com","auth_header_name":"Authorization","auth_header_value":"Bearer legacy","allowed_group_ids":["group"]},` +
+		`{"id":"multi","vendors":["openai","anthropic"],"models":[],"upstream_scheme":"https","upstream_host":"gateway.example.com","auth_header_name":"Authorization","auth_header_value":"Bearer multi","allowed_group_ids":["group"]}` +
+		`]}`)
+
+	resolved, err := Factory{}.New(raw)
+	require.NoError(t, err)
+	router, ok := resolved.(*Middleware)
+	require.True(t, ok, "factory must return the concrete router middleware")
+	require.Len(t, router.cfg.Providers, 2)
+	assert.Equal(t, "openai", router.cfg.Providers[0].Vendor,
+		"the legacy singular field must keep decoding")
+	assert.Equal(t, []string{"openai", "anthropic"}, router.cfg.Providers[1].Vendors,
+		"the multi-vendor field must decode both supported surfaces")
+}
+
 func TestRouter_FactoryAcceptsEmptyShapes(t *testing.T) {
 	cases := [][]byte{nil, []byte(""), []byte(" "), []byte("null"), []byte("{}"), []byte("[]")}
 	for _, raw := range cases {
@@ -873,3 +947,403 @@ func TestRouter_EmptyModelsClaimsAnyModel(t *testing.T) {
 	resolved, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
 	assert.Equal(t, "litellm", resolved)
 }
+
+// TestRouter_DatedAnthropicModelRoutes covers a client pinning a release
+// date on a model the operator registered undated. Exact matches still win,
+// so an operator who registers both dated releases keeps them distinct.
+func TestRouter_DatedAnthropicModelRoutes(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "anthropic-prod",
+		Vendor:          "anthropic",
+		Models:          []string{"claude-sonnet-4-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}}})
+
+	in := newInputWithModelAndURL("claude-sonnet-4-5-20250929", "/v1/messages")
+	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "a dated id must route to the undated registration")
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
+}
+
+// TestRouter_ConnectionWarmProbeRoutes covers the HEAD /api/hello probe an
+// Anthropic client sends before its first request. Forwarding it warms the
+// connection that request will use; denying it only wrote a rejection into
+// the access log at every session start.
+func TestRouter_ConnectionWarmProbeRoutes(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "anthropic-prod",
+		Vendor:          "anthropic",
+		Models:          []string{"claude-sonnet-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}}})
+
+	in := newModellessInput("/api/hello")
+	in.Method = http.MethodHead
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "the warm-up probe must reach the upstream")
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
+
+	nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+	assert.Equal(t, "true", nonInference, "the probe carries no model to gate on")
+}
+
+// TestRouter_ModelListingCarriesAuthorisedModels pins the list the proxy
+// bounds the discovery response with. A catch-all route enumerates nothing,
+// so it must not bound the upstream's list at all.
+func TestRouter_ModelListingCarriesAuthorisedModels(t *testing.T) {
+	enumerated := ProviderRoute{
+		ID:              "anthropic-prod",
+		Models:          []string{"claude-sonnet-5", "claude-haiku-4-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}
+
+	t.Run("enumerated route bounds the listing", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{enumerated}})
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models"))
+		require.NoError(t, err)
+		require.NotNil(t, out.Mutations)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Equal(t, []string{"claude-sonnet-5", "claude-haiku-4-5"},
+			out.Mutations.RewriteUpstream.DiscoveryModels,
+			"the picker must be bounded by what the route authorises")
+	})
+
+	t.Run("catch-all route leaves the listing alone", func(t *testing.T) {
+		catchAll := enumerated
+		catchAll.Models = nil
+		mw := New(Config{Providers: []ProviderRoute{catchAll}})
+
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models"))
+		require.NoError(t, err)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Empty(t, out.Mutations.RewriteUpstream.DiscoveryModels,
+			"a route that claims every model cannot bound the upstream's list")
+	})
+
+	t.Run("per-model lookup is not a listing", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{enumerated}})
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5"))
+		require.NoError(t, err)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Empty(t, out.Mutations.RewriteUpstream.DiscoveryModels,
+			"the single-object lookup has no data array to filter")
+	})
+}
+
+// TestRouter_ModelDetailHonoursAllowlist pins that GET /v1/models/{id} is
+// authorised against the model table. It carries no body model, so treating
+// it as a model-less endpoint would let a caller confirm a model the route
+// does not list — the listing itself is bounded to the allowlist, so the
+// detail lookup must be too.
+func TestRouter_ModelDetailHonoursAllowlist(t *testing.T) {
+	enumerated := ProviderRoute{
+		ID:              "anthropic-prod",
+		Models:          []string{"claude-sonnet-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}
+
+	t.Run("allowlisted model routes and skips metering", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{enumerated}})
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5"))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision)
+		require.NotNil(t, out.Mutations)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
+
+		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+		assert.Equal(t, "true", nonInference, "a detail lookup spends no tokens")
+	})
+
+	t.Run("model outside the allowlist denies", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{enumerated}})
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-opus-5"))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionDeny, out.Decision,
+			"a model no route lists must not be confirmed by the detail lookup")
+	})
+
+	t.Run("dated id matches its undated registration", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{enumerated}})
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5-20250929"))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision,
+			"a pinned release of an allowlisted family stays reachable")
+	})
+
+	t.Run("catch-all route still answers every lookup", func(t *testing.T) {
+		catchAll := enumerated
+		catchAll.Models = nil
+		mw := New(Config{Providers: []ProviderRoute{catchAll}})
+
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/anything-at-all"))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision,
+			"a gateway that enumerates nothing cannot refuse a lookup")
+	})
+}
+
+// TestRouter_NonInferenceRequiresReadMethod pins that the non-inference mark —
+// which exempts a request from the token pre-flight — is reachable only by the
+// read methods these endpoints actually use. A POST to the same path could
+// carry an inference body, so it must not buy the exemption; it falls through
+// to normal per-model routing instead, which denies when no model is named.
+func TestRouter_NonInferenceRequiresReadMethod(t *testing.T) {
+	route := ProviderRoute{
+		ID:              "gateway",
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "gateway.example.com",
+	}
+
+	for _, path := range []string{"/v1/models", "/v1/models/claude-sonnet-5", "/api/hello"} {
+		t.Run("POST "+path, func(t *testing.T) {
+			mw := New(Config{Providers: []ProviderRoute{route}})
+
+			in := newModellessInput(path)
+			in.Method = http.MethodPost
+
+			out, err := mw.Invoke(context.Background(), in)
+			require.NoError(t, err)
+			assert.Equal(t, middleware.DecisionDeny, out.Decision,
+				"a write to a non-inference path must not route unmetered")
+
+			nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+			assert.NotEqual(t, "true", nonInference,
+				"only a read method may skip the token pre-flight")
+		})
+	}
+
+	t.Run("HEAD keeps the warm probe working", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{route}})
+
+		in := newModellessInput(connectionWarmPath)
+		in.Method = http.MethodHead
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision,
+			"the HEAD warm probe must still reach the upstream")
+
+		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+		assert.Equal(t, "true", nonInference,
+			"the HEAD warm probe carries no model to meter")
+	})
+}
+
+// TestRouter_PinnedDatedModelStaysDistinct pins that a route registered
+// against one dated Anthropic release does not claim another. Normalising
+// both sides of the comparison made every dated build of a family
+// interchangeable, so an operator who deliberately pinned a build would have
+// served a different one — and with several such routes, declaration or path
+// order would have decided which.
+func TestRouter_PinnedDatedModelStaysDistinct(t *testing.T) {
+	pinned := ProviderRoute{
+		ID:              "anthropic-pinned",
+		Vendor:          "anthropic",
+		Models:          []string{"claude-sonnet-4-5-20250101"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "pinned.example.com",
+	}
+
+	t.Run("a different dated release is not claimed", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{pinned}})
+		in := newInputWithModelAndURL("claude-sonnet-4-5-20250202", "/v1/messages")
+		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionDeny, out.Decision,
+			"a route pinned to one dated build must not serve another")
+	})
+
+	t.Run("its own dated release still routes", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{pinned}})
+		in := newInputWithModelAndURL("claude-sonnet-4-5-20250101", "/v1/messages")
+		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision, "the exact match must still route")
+	})
+
+	t.Run("two pinned builds each route to their own provider", func(t *testing.T) {
+		other := pinned
+		other.ID = "anthropic-pinned-newer"
+		other.Models = []string{"claude-sonnet-4-5-20250202"}
+		other.UpstreamHost = "newer.example.com"
+		mw := New(Config{Providers: []ProviderRoute{pinned, other}})
+
+		in := newInputWithModelAndURL("claude-sonnet-4-5-20250202", "/v1/messages")
+		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		require.Equal(t, middleware.DecisionAllow, out.Decision)
+		require.NotNil(t, out.Mutations)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Equal(t, "newer.example.com", out.Mutations.RewriteUpstream.Host,
+			"declaration order must not decide between two deliberately pinned builds")
+	})
+}
+
+// TestRouter_DiscoveryBoundToCallersPolicies pins that a model listing is
+// bounded by the policies that authorise the caller, not by the union across
+// everyone who can reach the provider. Two teams sharing one provider record
+// under different allowlists is the case that makes the difference visible: a
+// flattened per-provider list would offer each team the other's models, and
+// every one of those entries is a request the guardrail then refuses.
+func TestRouter_DiscoveryBoundToCallersPolicies(t *testing.T) {
+	const (
+		eng   = "grp-eng"
+		sales = "grp-sales"
+	)
+	route := ProviderRoute{
+		ID:              "shared-gateway",
+		Models:          []string{"claude-sonnet-5", "claude-haiku-4-5", "gpt-4o"},
+		AllowedGroupIDs: []string{eng, sales},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "gateway.example.com",
+		ModelPolicies: []ModelPolicyRule{
+			{GroupIDs: []string{eng}, Models: []string{"claude-sonnet-5"}},
+			{GroupIDs: []string{sales}, Models: []string{"gpt-4o"}},
+		},
+	}
+
+	listingFor := func(t *testing.T, group string) []string {
+		t.Helper()
+		mw := New(Config{Providers: []ProviderRoute{route}})
+		in := newModellessInput(modelListingPath)
+		in.UserGroups = []string{group}
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		require.Equal(t, middleware.DecisionAllow, out.Decision)
+		require.NotNil(t, out.Mutations)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		return out.Mutations.RewriteUpstream.DiscoveryModels
+	}
+
+	t.Run("each group sees only its own policy's models", func(t *testing.T) {
+		assert.Equal(t, []string{"claude-sonnet-5"}, listingFor(t, eng),
+			"engineering must not be offered the model only sales may use")
+		assert.Equal(t, []string{"gpt-4o"}, listingFor(t, sales),
+			"sales must not be offered the model only engineering may use")
+	})
+
+	t.Run("a model no policy allows is offered to nobody", func(t *testing.T) {
+		for _, group := range []string{eng, sales} {
+			assert.NotContains(t, listingFor(t, group), "claude-haiku-4-5",
+				"the provider serves it, but no policy permits it")
+		}
+	})
+}
+
+// TestRouter_DiscoveryUnrestrictedPolicy covers the lifting rule: a caller
+// holding one policy without a model allowlist sees everything the provider
+// enumerates, whatever the other policies say.
+func TestRouter_DiscoveryUnrestrictedPolicy(t *testing.T) {
+	const (
+		eng   = "grp-eng"
+		admin = "grp-admin"
+	)
+	route := ProviderRoute{
+		ID:              "shared-gateway",
+		Models:          []string{"claude-sonnet-5", "gpt-4o"},
+		AllowedGroupIDs: []string{eng, admin},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "gateway.example.com",
+		ModelPolicies: []ModelPolicyRule{
+			{GroupIDs: []string{eng}, Models: []string{"claude-sonnet-5"}},
+			// nil Models: a policy that sets no allowlist at all.
+			{GroupIDs: []string{admin}},
+		},
+	}
+	mw := New(Config{Providers: []ProviderRoute{route}})
+
+	in := newModellessInput(modelListingPath)
+	in.UserGroups = []string{eng, admin}
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.ElementsMatch(t, []string{"claude-sonnet-5", "gpt-4o"},
+		out.Mutations.RewriteUpstream.DiscoveryModels,
+		"an unrestricted policy the caller holds lifts the restriction")
+}
+
+// TestRouter_DiscoveryOnGatewayRecord covers a record that enumerates no
+// models. It previously offered the upstream's whole catalogue however narrow
+// the policy was, because there was nothing to intersect against; the policy
+// allowlist is now the bound on its own.
+func TestRouter_DiscoveryOnGatewayRecord(t *testing.T) {
+	const eng = "grp-eng"
+	base := ProviderRoute{
+		ID:              "litellm",
+		AllowedGroupIDs: []string{eng},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "litellm.internal",
+	}
+
+	t.Run("a policy allowlist bounds it", func(t *testing.T) {
+		route := base
+		route.ModelPolicies = []ModelPolicyRule{{GroupIDs: []string{eng}, Models: []string{"gpt-4o"}}}
+		mw := New(Config{Providers: []ProviderRoute{route}})
+
+		in := newModellessInput(modelListingPath)
+		in.UserGroups = []string{eng}
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"gpt-4o"}, out.Mutations.RewriteUpstream.DiscoveryModels,
+			"a catch-all record must still be bounded by what policy permits")
+	})
+
+	t.Run("an allowlist permitting nothing offers nothing", func(t *testing.T) {
+		route := base
+		route.ModelPolicies = []ModelPolicyRule{{GroupIDs: []string{eng}, Models: []string{}}}
+		mw := New(Config{Providers: []ProviderRoute{route}})
+
+		in := newModellessInput(modelListingPath)
+		in.UserGroups = []string{eng}
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Empty(t, out.Mutations.RewriteUpstream.DiscoveryModels,
+			"an empty allowlist permits nothing, and must not be read as unrestricted")
+	})
+
+	t.Run("no policy restriction leaves the listing alone", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{base}})
+
+		in := newModellessInput(modelListingPath)
+		in.UserGroups = []string{eng}
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Nil(t, out.Mutations.RewriteUpstream.DiscoveryModels,
+			"nothing narrows the listing, so the upstream's own answer passes through")
+	})
+}
diff --git a/proxy/internal/middleware/chain.go b/proxy/internal/middleware/chain.go
index 45d32cdb0..9eed93678 100644
--- a/proxy/internal/middleware/chain.go
+++ b/proxy/internal/middleware/chain.go
@@ -264,7 +264,7 @@ func applyMutations(ctx context.Context, d *Dispatcher, spec Spec, r *http.Reque
 	if m == nil {
 		return
 	}
-	add, remove, blocked := FilterHeaderMutations(m)
+	add, remove, blocked := filterHeaderMutations(m, spec.ID)
 	for _, h := range blocked {
 		d.metrics.IncHeaderMutationBlocked(ctx, spec.ID, h)
 	}
diff --git a/proxy/internal/middleware/chain_test.go b/proxy/internal/middleware/chain_test.go
index 929ccee08..ffb23271e 100644
--- a/proxy/internal/middleware/chain_test.go
+++ b/proxy/internal/middleware/chain_test.go
@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"context"
+	"net/http"
 	"strconv"
 	"testing"
 
@@ -278,6 +279,64 @@ func TestChain_ApplyMutations_RewriteGatedOnCanMutate(t *testing.T) {
 	assert.Nil(t, rewrite, "rewrite must be filtered when CanMutate=false")
 }
 
+func TestChain_IdentityInjectReplacesReservedNetBirdHeaders(t *testing.T) {
+	mw := &fakeMiddleware{
+		id:                 "llm_identity_inject",
+		slot:               SlotOnRequest,
+		mutationsSupported: true,
+		canMutate:          true,
+		mutations: &Mutations{
+			HeadersRemove: []string{"x-netbird-user-id", "x-netbird-groups"},
+			HeadersAdd: []KV{
+				{Key: "x-netbird-user-id", Value: "trusted-user"},
+				{Key: "x-netbird-groups", Value: "trusted-group"},
+			},
+		},
+	}
+	c := chainFor(t, mw)
+	req, err := http.NewRequest(http.MethodGet, "https://gateway.example.com/v1/models", nil)
+	require.NoError(t, err)
+	req.Header.Set("x-netbird-user-id", "spoofed-user")
+	req.Header.Set("x-netbird-groups", "spoofed-group")
+
+	denied, _, _, err := c.RunRequest(context.Background(), req, &Input{}, NewAccumulator(0))
+	require.NoError(t, err)
+	assert.Nil(t, denied, "identity injection must not deny the request")
+	assert.Equal(t, "trusted-user", req.Header.Get("x-netbird-user-id"),
+		"the built-in identity middleware must replace a spoofed user header")
+	assert.Equal(t, "trusted-group", req.Header.Get("x-netbird-groups"),
+		"the built-in identity middleware must replace spoofed groups")
+}
+
+func TestChain_OtherMiddlewareCannotReplaceReservedNetBirdHeaders(t *testing.T) {
+	mw := &fakeMiddleware{
+		id:                 "untrusted-middleware",
+		slot:               SlotOnRequest,
+		mutationsSupported: true,
+		canMutate:          true,
+		mutations: &Mutations{
+			HeadersRemove: []string{"x-netbird-user-id", "x-netbird-groups"},
+			HeadersAdd: []KV{
+				{Key: "x-netbird-user-id", Value: "replacement-user"},
+				{Key: "x-netbird-groups", Value: "replacement-group"},
+			},
+		},
+	}
+	c := chainFor(t, mw)
+	req, err := http.NewRequest(http.MethodGet, "https://gateway.example.com/v1/models", nil)
+	require.NoError(t, err)
+	req.Header.Set("x-netbird-user-id", "original-user")
+	req.Header.Set("x-netbird-groups", "original-group")
+
+	denied, _, _, err := c.RunRequest(context.Background(), req, &Input{}, NewAccumulator(0))
+	require.NoError(t, err)
+	assert.Nil(t, denied, "blocked mutations must not deny the request")
+	assert.Equal(t, "original-user", req.Header.Get("x-netbird-user-id"),
+		"other middleware must remain unable to mutate reserved identity headers")
+	assert.Equal(t, "original-group", req.Header.Get("x-netbird-groups"),
+		"other middleware must remain unable to mutate reserved identity headers")
+}
+
 // TestChain_RunRequest_PropagatesUserGroups asserts the chain forwards
 // Input.UserGroups verbatim through cloneInputFor so policy-aware
 // middlewares (e.g. llm_policy_check) can authorise without an extra
diff --git a/proxy/internal/middleware/decision.go b/proxy/internal/middleware/decision.go
index 0970bdea4..97dca4af5 100644
--- a/proxy/internal/middleware/decision.go
+++ b/proxy/internal/middleware/decision.go
@@ -11,11 +11,78 @@ var codeRegex = regexp.MustCompile(`^[a-z][a-z0-9._-]{0,63}$`)
 // denyResponse is the on-wire shape rendered by RenderDenyResponse.
 // Keeping this as a typed struct ensures we never leak
 // middleware-supplied bytes outside known fields.
+//
+// Type and Error mirror the denial in the vendor's own error shape when
+// the request reached a known LLM surface. LLM clients only parse their
+// provider's envelope, so without the mirror a budget stop reaches the
+// user as an unexplained API error. The NetBird fields stay where they
+// were, so the body is a superset and existing consumers are unaffected.
 type denyResponse struct {
 	Code       string            `json:"code"`
 	Message    string            `json:"message,omitempty"`
 	Details    map[string]string `json:"details,omitempty"`
 	Middleware string            `json:"middleware,omitempty"`
+	Type       string            `json:"type,omitempty"`
+	Error      *providerError    `json:"error,omitempty"`
+}
+
+// providerError is the nested error object both vendor envelopes carry.
+type providerError struct {
+	Type    string `json:"type"`
+	Message string `json:"message,omitempty"`
+	Code    string `json:"code,omitempty"`
+}
+
+// Vendor error types keyed by HTTP status, per each provider's published
+// error reference.
+const (
+	anthropicErrInvalidRequest = "invalid_request_error"
+	anthropicErrPermission     = "permission_error"
+	anthropicErrRateLimit      = "rate_limit_error"
+	anthropicErrAPI            = "api_error"
+	openAIErrInvalidRequest    = "invalid_request_error"
+	openAIErrRateLimit         = "rate_limit_error"
+)
+
+// providerEnvelope returns the vendor-shaped mirror for a denial on the
+// given surface, or nil when the surface has no envelope we can speak.
+// message is the already-redacted public message.
+func providerEnvelope(surface, code, message string, status int) (string, *providerError) {
+	switch surface {
+	case "anthropic":
+		return "error", &providerError{
+			Type:    anthropicErrorType(status),
+			Message: message,
+		}
+	case "openai":
+		return "", &providerError{
+			Type:    openAIErrorType(status),
+			Message: message,
+			Code:    code,
+		}
+	default:
+		return "", nil
+	}
+}
+
+func anthropicErrorType(status int) string {
+	switch status {
+	case http.StatusForbidden:
+		return anthropicErrPermission
+	case http.StatusTooManyRequests:
+		return anthropicErrRateLimit
+	case http.StatusBadRequest:
+		return anthropicErrInvalidRequest
+	default:
+		return anthropicErrAPI
+	}
+}
+
+func openAIErrorType(status int) string {
+	if status == http.StatusTooManyRequests {
+		return openAIErrRateLimit
+	}
+	return openAIErrInvalidRequest
 }
 
 // RenderDenyResponse writes a structured JSON deny body. Status is
@@ -36,6 +103,7 @@ func RenderDenyResponse(w http.ResponseWriter, middlewareID string, reason *Deny
 		Message:    truncate(Scan(reason.Message), 256),
 		Middleware: truncate(Scan(middlewareID), 64),
 	}
+	resp.Type, resp.Error = providerEnvelope(reason.Surface, resp.Code, resp.Message, status)
 	if n := len(reason.Details); n > 0 {
 		resp.Details = make(map[string]string, min(n, 8))
 		for k, v := range reason.Details {
diff --git a/proxy/internal/middleware/decision_test.go b/proxy/internal/middleware/decision_test.go
new file mode 100644
index 000000000..cf14c86ff
--- /dev/null
+++ b/proxy/internal/middleware/decision_test.go
@@ -0,0 +1,92 @@
+package middleware
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// decodeDeny renders a denial and returns the parsed body plus the status.
+func decodeDeny(t *testing.T, reason *DenyReason, status int) (map[string]any, int) {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	RenderDenyResponse(rec, "llm_limit_check", reason, status)
+
+	var body map[string]any
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &body), "deny body must be valid JSON")
+	return body, rec.Code
+}
+
+// TestRenderDeny_AnthropicSurfaceMirrorsVendorShape covers a budget stop
+// reaching Claude Code. The client only parses the Anthropic envelope, so
+// without the mirror the user sees an unexplained API error instead of the
+// reason their request was refused.
+func TestRenderDeny_AnthropicSurfaceMirrorsVendorShape(t *testing.T) {
+	body, status := decodeDeny(t, &DenyReason{
+		Code:    "llm_policy.budget_cap_exceeded",
+		Message: "LLM policy limit exceeded",
+		Surface: "anthropic",
+	}, http.StatusForbidden)
+
+	assert.Equal(t, http.StatusForbidden, status)
+	assert.Equal(t, "error", body["type"], "Anthropic errors carry type=error at the top level")
+
+	errObj, ok := body["error"].(map[string]any)
+	require.True(t, ok, "error must be an object")
+	assert.Equal(t, "permission_error", errObj["type"], "403 maps to permission_error")
+	assert.Equal(t, "LLM policy limit exceeded", errObj["message"])
+
+	// The NetBird fields stay put so existing consumers keep working.
+	assert.Equal(t, "llm_policy.budget_cap_exceeded", body["code"])
+	assert.Equal(t, "LLM policy limit exceeded", body["message"])
+	assert.Equal(t, "llm_limit_check", body["middleware"])
+}
+
+// TestRenderDeny_OpenAISurfaceMirrorsVendorShape pins the OpenAI envelope,
+// which nests the code and carries no top-level type.
+func TestRenderDeny_OpenAISurfaceMirrorsVendorShape(t *testing.T) {
+	body, _ := decodeDeny(t, &DenyReason{
+		Code:    "llm_policy.model_blocked",
+		Message: "model is not in the policy allowlist",
+		Surface: "openai",
+	}, http.StatusForbidden)
+
+	assert.NotContains(t, body, "type", "OpenAI errors have no top-level type")
+
+	errObj, ok := body["error"].(map[string]any)
+	require.True(t, ok, "error must be an object")
+	assert.Equal(t, "invalid_request_error", errObj["type"])
+	assert.Equal(t, "llm_policy.model_blocked", errObj["code"], "the NetBird code rides in the vendor code field")
+	assert.Equal(t, "model is not in the policy allowlist", errObj["message"])
+}
+
+// TestRenderDeny_RateLimitStatusMapsToVendorRateLimit pins the mapping a
+// client's backoff keys on.
+func TestRenderDeny_RateLimitStatusMapsToVendorRateLimit(t *testing.T) {
+	body, status := decodeDeny(t, &DenyReason{
+		Code:    "llm_policy.token_cap_exceeded",
+		Message: "LLM policy limit exceeded",
+		Surface: "anthropic",
+	}, http.StatusTooManyRequests)
+
+	assert.Equal(t, http.StatusTooManyRequests, status, "429 must survive the status clamp")
+	errObj := body["error"].(map[string]any)
+	assert.Equal(t, "rate_limit_error", errObj["type"])
+}
+
+// TestRenderDeny_NoSurfaceKeepsLegacyShape guards non-LLM middlewares and
+// denials raised before a surface is known.
+func TestRenderDeny_NoSurfaceKeepsLegacyShape(t *testing.T) {
+	body, _ := decodeDeny(t, &DenyReason{
+		Code:    "llm_policy.model_not_routable",
+		Message: "no provider configured for model x",
+	}, http.StatusForbidden)
+
+	assert.NotContains(t, body, "type", "no surface means no vendor mirror")
+	assert.NotContains(t, body, "error", "no surface means no vendor mirror")
+	assert.Equal(t, "llm_policy.model_not_routable", body["code"])
+}
diff --git a/proxy/internal/middleware/headerpolicy.go b/proxy/internal/middleware/headerpolicy.go
index d041ad1e1..b1fa564c2 100644
--- a/proxy/internal/middleware/headerpolicy.go
+++ b/proxy/internal/middleware/headerpolicy.go
@@ -2,6 +2,8 @@ package middleware
 
 import "strings"
 
+const trustedIdentityMiddlewareID = "llm_identity_inject"
+
 var denyHeaders = []string{
 	"Authorization",
 	"Connection",
@@ -78,18 +80,22 @@ func isHeaderFieldName(name string) bool {
 // header names so the dispatcher can increment the blocked-header
 // metric.
 func FilterHeaderMutations(m *Mutations) (filteredAdd []KV, filteredRemove []string, blocked []string) {
+	return filterHeaderMutations(m, "")
+}
+
+func filterHeaderMutations(m *Mutations, middlewareID string) (filteredAdd []KV, filteredRemove []string, blocked []string) {
 	if m == nil {
 		return nil, nil, nil
 	}
 	for _, kv := range m.HeadersAdd {
-		if IsHeaderMutable(kv.Key) {
+		if IsHeaderMutable(kv.Key) || isTrustedIdentityHeader(middlewareID, kv.Key) {
 			filteredAdd = append(filteredAdd, kv)
 			continue
 		}
 		blocked = append(blocked, kv.Key)
 	}
 	for _, name := range m.HeadersRemove {
-		if IsHeaderMutable(name) {
+		if IsHeaderMutable(name) || isTrustedIdentityHeader(middlewareID, name) {
 			filteredRemove = append(filteredRemove, name)
 			continue
 		}
@@ -97,3 +103,11 @@ func FilterHeaderMutations(m *Mutations) (filteredAdd []KV, filteredRemove []str
 	}
 	return filteredAdd, filteredRemove, blocked
 }
+
+func isTrustedIdentityHeader(middlewareID, name string) bool {
+	if middlewareID != trustedIdentityMiddlewareID {
+		return false
+	}
+	return strings.EqualFold(name, "x-netbird-user-id") ||
+		strings.EqualFold(name, "x-netbird-groups")
+}
diff --git a/proxy/internal/middleware/headerpolicy_test.go b/proxy/internal/middleware/headerpolicy_test.go
new file mode 100644
index 000000000..7daa93eec
--- /dev/null
+++ b/proxy/internal/middleware/headerpolicy_test.go
@@ -0,0 +1,26 @@
+package middleware
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFilterHeaderMutationsDoesNotTrustReservedHeaders(t *testing.T) {
+	mutations := &Mutations{
+		HeadersAdd: []KV{
+			{Key: "x-request-label", Value: "allowed"},
+			{Key: "x-netbird-user-id", Value: "spoofed-user"},
+		},
+		HeadersRemove: []string{"x-request-label", "x-netbird-groups"},
+	}
+
+	filteredAdd, filteredRemove, blocked := FilterHeaderMutations(mutations)
+
+	assert.Equal(t, []KV{{Key: "x-request-label", Value: "allowed"}}, filteredAdd,
+		"the public filter should retain mutable additions")
+	assert.Equal(t, []string{"x-request-label"}, filteredRemove,
+		"the public filter should retain mutable removals")
+	assert.ElementsMatch(t, []string{"x-netbird-user-id", "x-netbird-groups"}, blocked,
+		"the public filter must not grant the identity middleware exception")
+}
diff --git a/proxy/internal/middleware/keys.go b/proxy/internal/middleware/keys.go
index 9c584ad82..eff3fa756 100644
--- a/proxy/internal/middleware/keys.go
+++ b/proxy/internal/middleware/keys.go
@@ -22,6 +22,15 @@ const (
 	// body. Empty for clients that don't send one.
 	KeyLLMSessionID = "llm.session_id"
 
+	// Sub-agent attribution (emitted by llm_request_parser from the
+	// client's request headers). A coding agent that spawns helpers
+	// stamps the spawned agent's id, and the spawning agent's id when
+	// the helper is itself nested, so cost within one session can be
+	// split across the agents that ran in parallel. These identify an
+	// agent, not a person or a device: never treat them as a user id.
+	KeyLLMAgentID       = "llm.agent_id"
+	KeyLLMParentAgentID = "llm.parent_agent_id"
+
 	// LLM response-side metadata (emitted by llm_response_parser).
 	//nolint:gosec // metadata key name, not a credential
 	KeyLLMInputTokens = "llm.input_tokens"
@@ -66,6 +75,14 @@ const (
 	// downstream gateways' spend logs.
 	KeyLLMAuthorisingGroups = "llm.authorising_groups"
 
+	// LLM non-inference marker (emitted by llm_router on the allow path
+	// for endpoints that legitimately carry no model, such as model
+	// listing). The router still authorises these against the caller's
+	// groups; the marker only tells the limits gate that a per-model
+	// allowlist has nothing to evaluate, so an empty model must not be
+	// read as an undetermined one. Never derived from client input.
+	KeyLLMNonInference = "llm.non_inference"
+
 	// LLM policy attribution (emitted by llm_limit_check on the allow
 	// path). Names the policy that paid for this request and the
 	// dimension counters the post-flight llm_limit_record middleware
@@ -75,8 +92,19 @@ const (
 	KeyLLMAttributionGroupID = "llm.attribution_group_id"
 	KeyLLMAttributionWindowS = "llm.attribution_window_seconds"
 
-	// Cost metering (emitted by cost_meter).
-	KeyCostUSDTotal = "cost.usd_total"
+	// Cost metering (emitted by cost_meter). The four per-bucket keys are the
+	// base of the breakdown — one per token bucket the provider bills
+	// separately — and the two aggregates below are derived from them:
+	// usd_total is their sum, usd_cache is cached_input + cache_creation.
+	KeyCostUSDInput = "cost.usd_input"
+	// KeyCostUSDCachedInput is the cost of the cache-read bucket (Anthropic cache_read; OpenAI's discounted cached subset of input).
+	KeyCostUSDCachedInput = "cost.usd_cached_input"
+	// KeyCostUSDCacheCreation is the cost of the cache-write bucket. Zero for providers without one.
+	KeyCostUSDCacheCreation = "cost.usd_cache_creation"
+	KeyCostUSDOutput        = "cost.usd_output"
+	KeyCostUSDTotal         = "cost.usd_total"
+	// KeyCostUSDCache is the portion of cost.usd_total billed for prompt-cache buckets (cache read/creation, or OpenAI's cached input subset).
+	KeyCostUSDCache = "cost.usd_cache"
 	KeyCostSkipped  = "cost.skipped"
 
 	// Framework-emitted error markers. Use the mw.<id>.* prefix to
diff --git a/proxy/internal/middleware/manager.go b/proxy/internal/middleware/manager.go
index 9b22edeff..14ed0b894 100644
--- a/proxy/internal/middleware/manager.go
+++ b/proxy/internal/middleware/manager.go
@@ -29,6 +29,10 @@ type PathTargetBinding struct {
 	Specs     []Spec
 }
 
+// Revision identifies a service's middleware binding snapshot. Zero is
+// reserved for routes that are not coupled to a manager snapshot.
+type Revision uint64
+
 // LiveServiceCheck reports whether the given service ID is still
 // present in the proxy's live mapping cache. The Manager calls it
 // during InvalidateMiddleware so a chain whose service has been
@@ -42,14 +46,16 @@ type LiveServiceCheck func(serviceID string) bool
 // InvalidateMiddleware find the chain keys that reference a given
 // middleware without scanning the whole table.
 type chainTable struct {
-	byTarget     map[string]*Chain
-	byMiddleware map[string]map[string]struct{}
+	byTarget        map[string]*Chain
+	byMiddleware    map[string]map[string]struct{}
+	serviceRevision map[string]Revision
 }
 
 func newChainTable() *chainTable {
 	return &chainTable{
-		byTarget:     make(map[string]*Chain),
-		byMiddleware: make(map[string]map[string]struct{}),
+		byTarget:        make(map[string]*Chain),
+		byMiddleware:    make(map[string]map[string]struct{}),
+		serviceRevision: make(map[string]Revision),
 	}
 }
 
@@ -65,6 +71,9 @@ func (c *chainTable) clone() *chainTable {
 		}
 		out.byMiddleware[id] = set
 	}
+	for serviceID, revision := range c.serviceRevision {
+		out.serviceRevision[serviceID] = revision
+	}
 	return out
 }
 
@@ -121,6 +130,7 @@ type Manager struct {
 	resolver         *Resolver
 	lastBindings     map[string]PathTargetBinding
 	liveServiceCheck atomic.Pointer[LiveServiceCheck]
+	nextRevision     Revision
 }
 
 // NewManager constructs a Manager with the given capture budget size.
@@ -179,14 +189,29 @@ func (m *Manager) Dispatcher() *Dispatcher {
 	return m.dispatcher
 }
 
-// Rebuild replaces every chain keyed by serviceID with the provided
-// bindings. Entries for other services are preserved. Replaced chains
-// are closed asynchronously after the atomic swap so in-flight
-// requests against the previous chain finish before middleware
-// resources are released.
+// Rebuild replaces every chain keyed by serviceID with the provided bindings.
+// It is the compatibility wrapper for callers that do not consume revisions.
 func (m *Manager) Rebuild(serviceID string, bindings []PathTargetBinding) error {
+	_, err := m.RebuildSnapshot(serviceID, bindings)
+	return err
+}
+
+// RebuildSnapshot atomically replaces a service's chains and assigns a nonzero
+// revision, including for empty bindings. Retired chains close asynchronously.
+func (m *Manager) RebuildSnapshot(serviceID string, bindings []PathTargetBinding) (Revision, error) {
+	for _, b := range bindings {
+		if b.ServiceID != serviceID {
+			return 0, fmt.Errorf("binding service %q does not match rebuild service %q", b.ServiceID, serviceID)
+		}
+	}
+
 	m.writeMu.Lock()
 	defer m.writeMu.Unlock()
+	if m.nextRevision == ^Revision(0) {
+		return 0, fmt.Errorf("middleware snapshot revision exhausted")
+	}
+	m.nextRevision++
+	revision := m.nextRevision
 
 	cur := m.chains.Load()
 	next := cur.clone()
@@ -205,9 +230,6 @@ func (m *Manager) Rebuild(serviceID string, bindings []PathTargetBinding) error
 	}
 
 	for _, b := range bindings {
-		if b.ServiceID != serviceID {
-			return fmt.Errorf("binding service %q does not match rebuild service %q", b.ServiceID, serviceID)
-		}
 		key := chainKey(b.ServiceID, b.PathID)
 		m.lastBindings[key] = cloneBinding(b)
 		chain := m.buildChain(b)
@@ -217,10 +239,11 @@ func (m *Manager) Rebuild(serviceID string, bindings []PathTargetBinding) error
 		}
 		next.addChain(key, chain)
 	}
+	next.serviceRevision[serviceID] = revision
 
 	m.chains.Store(next)
 	m.closeChainsAsync(retired)
-	return nil
+	return revision, nil
 }
 
 // Invalidate drops every chain for the given service ID.
@@ -246,6 +269,7 @@ func (m *Manager) Invalidate(serviceID string) {
 			delete(m.lastBindings, k)
 		}
 	}
+	delete(next.serviceRevision, serviceID)
 	m.chains.Store(next)
 	m.closeChainsAsync(retired)
 }
@@ -359,6 +383,19 @@ func (m *Manager) ChainFor(serviceID, pathID string) *Chain {
 	return c
 }
 
+// ChainForRevision returns a chain only if the service revision matches.
+// A matching revision with a nil chain is a coherent chainless target. Zero never matches.
+func (m *Manager) ChainForRevision(serviceID, pathID string, revision Revision) (*Chain, bool) {
+	if revision == 0 {
+		return nil, false
+	}
+	tbl := m.chains.Load()
+	if tbl == nil || tbl.serviceRevision[serviceID] != revision {
+		return nil, false
+	}
+	return tbl.byTarget[chainKey(serviceID, pathID)], true
+}
+
 // buildChain resolves each enabled spec and returns the assembled
 // chain. Returns a nil chain when no middlewares are bound; resolver
 // errors per middleware are logged and counted but do not abort the
diff --git a/proxy/internal/middleware/manager_revision_test.go b/proxy/internal/middleware/manager_revision_test.go
new file mode 100644
index 000000000..491b550c7
--- /dev/null
+++ b/proxy/internal/middleware/manager_revision_test.go
@@ -0,0 +1,230 @@
+package middleware
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const revisionTestMiddlewareID = "revision_test"
+
+type revisionTestFactory struct {
+	builds atomic.Int64
+}
+
+func (f *revisionTestFactory) ID() string {
+	return revisionTestMiddlewareID
+}
+
+func (f *revisionTestFactory) New(_ []byte) (Middleware, error) {
+	f.builds.Add(1)
+	return revisionTestMiddleware{}, nil
+}
+
+type revisionTestMiddleware struct{}
+
+func (revisionTestMiddleware) ID() string                     { return revisionTestMiddlewareID }
+func (revisionTestMiddleware) Version() string                { return "test" }
+func (revisionTestMiddleware) Slot() Slot                     { return SlotOnRequest }
+func (revisionTestMiddleware) AcceptedContentTypes() []string { return nil }
+func (revisionTestMiddleware) MetadataKeys() []string         { return nil }
+func (revisionTestMiddleware) MutationsSupported() bool       { return false }
+func (revisionTestMiddleware) Invoke(context.Context, *Input) (*Output, error) {
+	return &Output{Decision: DecisionAllow}, nil
+}
+func (revisionTestMiddleware) Close() error { return nil }
+
+func newRevisionTestManager(t *testing.T) (*Manager, *revisionTestFactory) {
+	t.Helper()
+	factory := &revisionTestFactory{}
+	registry := NewRegistry()
+	require.NoError(t, registry.Register(factory))
+	manager := NewManager(1, nil, nil)
+	manager.SetResolver(NewResolver(registry))
+	return manager, factory
+}
+
+func revisionTestBinding(serviceID, pathID string) PathTargetBinding {
+	return PathTargetBinding{
+		ServiceID: serviceID,
+		PathID:    pathID,
+		Specs: []Spec{{
+			ID:      revisionTestMiddlewareID,
+			Slot:    SlotOnRequest,
+			Enabled: true,
+		}},
+	}
+}
+
+func TestManagerRebuildSnapshotRevisionLookup(t *testing.T) {
+	manager, _ := newRevisionTestManager(t)
+	binding := revisionTestBinding("service", "/")
+
+	revision1, err := manager.RebuildSnapshot("service", []PathTargetBinding{binding})
+	require.NoError(t, err)
+	require.NotZero(t, revision1)
+	chain1, match := manager.ChainForRevision("service", "/", revision1)
+	require.True(t, match)
+	require.NotNil(t, chain1)
+
+	revision2, err := manager.RebuildSnapshot("service", []PathTargetBinding{binding})
+	require.NoError(t, err)
+	assert.NotEqual(t, revision1, revision2)
+	chain2, match := manager.ChainForRevision("service", "/", revision2)
+	require.True(t, match)
+	require.NotNil(t, chain2)
+	assert.NotSame(t, chain1, chain2)
+
+	stale, match := manager.ChainForRevision("service", "/", revision1)
+	assert.False(t, match)
+	assert.Nil(t, stale)
+	zero, match := manager.ChainForRevision("service", "/", 0)
+	assert.False(t, match)
+	assert.Nil(t, zero)
+}
+
+func TestManagerRebuildSnapshotTracksChainlessTransitions(t *testing.T) {
+	manager, _ := newRevisionTestManager(t)
+
+	chainlessRevision, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+	chain, match := manager.ChainForRevision("service", "/", chainlessRevision)
+	assert.True(t, match)
+	assert.Nil(t, chain)
+
+	chainRevision, err := manager.RebuildSnapshot("service", []PathTargetBinding{
+		revisionTestBinding("service", "/"),
+	})
+	require.NoError(t, err)
+	_, match = manager.ChainForRevision("service", "/", chainlessRevision)
+	assert.False(t, match)
+	chain, match = manager.ChainForRevision("service", "/", chainRevision)
+	assert.True(t, match)
+	assert.NotNil(t, chain)
+
+	chainlessRevision2, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+	_, match = manager.ChainForRevision("service", "/", chainRevision)
+	assert.False(t, match)
+	chain, match = manager.ChainForRevision("service", "/", chainlessRevision2)
+	assert.True(t, match)
+	assert.Nil(t, chain)
+}
+
+func TestManagerInvalidateMiddlewarePreservesServiceRevision(t *testing.T) {
+	manager, factory := newRevisionTestManager(t)
+	revision, err := manager.RebuildSnapshot("service", []PathTargetBinding{
+		revisionTestBinding("service", "/"),
+	})
+	require.NoError(t, err)
+	chain1, match := manager.ChainForRevision("service", "/", revision)
+	require.True(t, match)
+	require.NotNil(t, chain1)
+
+	manager.InvalidateMiddleware(revisionTestMiddlewareID)
+
+	chain2, match := manager.ChainForRevision("service", "/", revision)
+	require.True(t, match)
+	require.NotNil(t, chain2)
+	assert.NotSame(t, chain1, chain2)
+	assert.EqualValues(t, 2, factory.builds.Load())
+}
+
+func TestManagerInvalidateRemovesRevisionAndReaddDoesNotReuseIt(t *testing.T) {
+	manager, _ := newRevisionTestManager(t)
+	revision1, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+
+	manager.Invalidate("service")
+	_, match := manager.ChainForRevision("service", "/", revision1)
+	assert.False(t, match)
+
+	revision2, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+	assert.NotEqual(t, revision1, revision2)
+	_, match = manager.ChainForRevision("service", "/", revision2)
+	assert.True(t, match)
+
+	manager.InvalidateAll()
+	_, match = manager.ChainForRevision("service", "/", revision2)
+	assert.False(t, match)
+
+	revision3, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+	assert.NotEqual(t, revision1, revision3)
+	assert.NotEqual(t, revision2, revision3)
+}
+
+func TestManagerRebuildSnapshotRejectsMismatchedBindingBeforeMutation(t *testing.T) {
+	manager, _ := newRevisionTestManager(t)
+	binding := revisionTestBinding("service", "/")
+	revision1, err := manager.RebuildSnapshot("service", []PathTargetBinding{binding})
+	require.NoError(t, err)
+	chain1, match := manager.ChainForRevision("service", "/", revision1)
+	require.True(t, match)
+
+	invalid := revisionTestBinding("other-service", "/replacement")
+	revision, err := manager.RebuildSnapshot("service", []PathTargetBinding{invalid})
+	require.Error(t, err)
+	assert.Zero(t, revision)
+	chainAfter, match := manager.ChainForRevision("service", "/", revision1)
+	assert.True(t, match)
+	assert.Same(t, chain1, chainAfter)
+
+	revision2, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+	assert.Equal(t, revision1+1, revision2, "a rejected rebuild must not consume a revision")
+}
+
+func TestManagerConcurrentRebuildSnapshotRevisionsAreUnique(t *testing.T) {
+	manager, _ := newRevisionTestManager(t)
+	const rebuilds = 64
+
+	start := make(chan struct{})
+	revisions := make(chan Revision, rebuilds)
+	errors := make(chan error, rebuilds)
+	var wg sync.WaitGroup
+	for range rebuilds {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			<-start
+			revision, err := manager.RebuildSnapshot("service", nil)
+			if err != nil {
+				errors <- err
+				return
+			}
+			revisions <- revision
+		}()
+	}
+	close(start)
+	wg.Wait()
+	close(errors)
+	close(revisions)
+
+	for err := range errors {
+		require.NoError(t, err)
+	}
+	seen := make(map[Revision]struct{}, rebuilds)
+	for revision := range revisions {
+		require.NotZero(t, revision)
+		_, duplicate := seen[revision]
+		assert.False(t, duplicate, "each successful rebuild must receive a fresh revision")
+		seen[revision] = struct{}{}
+	}
+	require.Len(t, seen, rebuilds)
+
+	matches := 0
+	for revision := range seen {
+		chain, match := manager.ChainForRevision("service", "/", revision)
+		assert.Nil(t, chain)
+		if match {
+			matches++
+		}
+	}
+	assert.Equal(t, 1, matches, "only the current immutable table revision may match")
+}
diff --git a/proxy/internal/middleware/types.go b/proxy/internal/middleware/types.go
index 1ed5c9d88..3c0ac0ab6 100644
--- a/proxy/internal/middleware/types.go
+++ b/proxy/internal/middleware/types.go
@@ -179,6 +179,12 @@ type DenyReason struct {
 	Code    string
 	Message string
 	Details map[string]string
+	// Surface names the LLM API dialect the caller speaks (the
+	// llm.provider value), so the rendered body can mirror the denial in
+	// that vendor's error shape alongside the NetBird fields. Empty for
+	// non-LLM middlewares and for denials raised before a surface was
+	// resolved; the body then carries the NetBird fields alone.
+	Surface string
 }
 
 // Output is the value each middleware returns to the dispatcher. The
@@ -247,6 +253,12 @@ type UpstreamRewrite struct {
 	// without verifying its TLS certificate. Set by llm_router from the
 	// provider's skip_tls_verification for self-hosted / internal gateways.
 	SkipTLSVerify bool
+	// DiscoveryModels, when non-empty, is the set of model ids the resolved
+	// route authorises, and the proxy drops everything else from the
+	// model-listing response. Empty leaves the upstream's list untouched,
+	// which is what a route that claims every model wants. Set by
+	// llm_router on a model-listing request only.
+	DiscoveryModels []string
 }
 
 // AuthHeader is a single name/value pair the proxy injects on the
diff --git a/proxy/internal/proxy/agent_network_chain_realstack_test.go b/proxy/internal/proxy/agent_network_chain_realstack_test.go
index bc611fc98..12fab9e8c 100644
--- a/proxy/internal/proxy/agent_network_chain_realstack_test.go
+++ b/proxy/internal/proxy/agent_network_chain_realstack_test.go
@@ -18,10 +18,10 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/test/bufconn"
 
-	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
-	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 	"github.com/netbirdio/netbird/proxy/internal/middleware/bodytap"
@@ -73,8 +73,8 @@ func TestReverseProxy_AgentNetworkRequest_FullChain(t *testing.T) {
 		testAdminUser = "user-admin-1"
 		adminGroupID  = "grp-admins"
 		providerID    = "prov-openai-test"
-		cluster       = "test.proxy.local"
-		subdomain     = "fullchain"
+		domain        = "fullchain.test.proxy.local"
+		proxyAddress  = "test.proxy.local"
 	)
 	testLogger := log.New()
 	testLogger.SetLevel(log.PanicLevel) // keep test output clean
@@ -127,21 +127,25 @@ func TestReverseProxy_AgentNetworkRequest_FullChain(t *testing.T) {
 	// increments on the response leg.
 	require.NoError(t, st.SaveAgentNetworkSettings(ctx, &agentNetworkTypes.Settings{
 		AccountID:              testAccountID,
-		Cluster:                cluster,
-		Subdomain:              subdomain,
+		Domain:                 domain,
+		ProxyAddress:           proxyAddress,
 		EnablePromptCollection: true,
 		EnableLogCollection:    true,
 		RedactPii:              true,
 	}))
 	require.NoError(t, st.SaveAgentNetworkProvider(ctx, &agentNetworkTypes.Provider{
-		ID:                providerID,
-		AccountID:         testAccountID,
-		ProviderID:        "openai_api",
-		Name:              "openai-fullchain-test",
-		UpstreamURL:       upstream.URL, // router rewrites to this
-		APIKey:            "sk-test",
-		Enabled:           true,
-		Models:            []agentNetworkTypes.ProviderModel{{ID: "gpt-5.4"}},
+		ID:          providerID,
+		AccountID:   testAccountID,
+		ProviderID:  "openai_api",
+		Name:        "openai-fullchain-test",
+		UpstreamURL: upstream.URL, // router rewrites to this
+		APIKey:      "sk-test",
+		Enabled:     true,
+		// Operator-pinned prices deliberately differ from the catalog's
+		// gpt-5.4 rates (0.0025/0.015) so the cost assertion below proves
+		// the per-provider-record price — not the default table — billed
+		// this request: stored price → synth → wire → cost_meter.
+		Models:            []agentNetworkTypes.ProviderModel{{ID: "gpt-5.4", InputPer1k: 0.004, OutputPer1k: 0.02}},
 		SessionPrivateKey: "priv",
 		SessionPublicKey:  "pub",
 	}))
@@ -176,7 +180,7 @@ func TestReverseProxy_AgentNetworkRequest_FullChain(t *testing.T) {
 
 	// ---- 5. Wire the middleware framework — same registry the proxy uses
 	// in production, configured with our bufconn-backed management client.
-	mwbuiltin.Configure(ctx, t.TempDir(), nil, testLogger, mgmtClient)
+	mwbuiltin.Configure(ctx, nil, testLogger, mgmtClient)
 	registry := mwbuiltin.DefaultRegistry()
 	mwMetrics, err := middleware.NewMetrics(nil)
 	require.NoError(t, err)
@@ -283,13 +287,23 @@ func TestReverseProxy_AgentNetworkRequest_FullChain(t *testing.T) {
 			if r.DimensionKind == agentNetworkTypes.DimensionGroup &&
 				r.DimensionID == adminGroupID &&
 				r.WindowSeconds == 60 &&
-				r.TokensInput+r.TokensOutput > 0 {
+				r.TokensInput+r.TokensOutput > 0 &&
+				r.CostUSD > 0 {
 				return true
 			}
 		}
 		return false
 	}, 5*time.Second, 50*time.Millisecond,
-		"Admins group consumption row must increment via the response leg — if this fails the proxy's respInput dropped UserGroups again or the parser/recorder wiring is broken")
+		"Admins group consumption row must increment via the response leg WITH a non-zero cost — a zero cost means the operator's stored price never reached cost_meter (synth → wire → per-record lookup broken)")
+
+	// 8a-cost. Exact cost from the OPERATOR's stored price, not the catalog
+	// default: 12 prompt tokens × 0.004/1k + 40 completion tokens × 0.02/1k
+	// = 0.000048 + 0.0008 = 0.000848. With catalog rates it would be 0.00063
+	// — this assertion distinguishes the two, closing the loop on the whole
+	// dynamic-pricing feature (dashboard save → synth → gRPC wire →
+	// llm.resolved_provider_id lookup → billing).
+	assert.Equal(t, "0.000848000", cd.GetMetadata()["cost.usd_total"],
+		"cost must be computed from the provider record's operator-pinned price")
 
 	// 8b. Both the captured prompt and the captured completion are
 	// redacted — proves the synth threads redact_pii=true into BOTH parser
diff --git a/proxy/internal/proxy/discovery_filter.go b/proxy/internal/proxy/discovery_filter.go
new file mode 100644
index 000000000..d5502e1f1
--- /dev/null
+++ b/proxy/internal/proxy/discovery_filter.go
@@ -0,0 +1,237 @@
+package proxy
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+
+	sharedllm "github.com/netbirdio/netbird/shared/llm"
+)
+
+// maxDiscoveryBodyBytes bounds the model-listing response the filter will
+// buffer. A listing is a few kilobytes of ids; anything larger is not a
+// listing we recognise, and buffering it to rewrite would cost more than
+// the filtering is worth.
+const maxDiscoveryBodyBytes = 1 << 20
+
+// modelDiscoveryFilter returns a ModifyResponse hook that drops models the
+// caller's policy does not authorise from a model-listing response, then
+// delegates to next (which may be nil).
+//
+// Clients populate their model picker from this endpoint, so an unfiltered
+// list offers models the very next request denies. The filter is
+// best-effort: a response it cannot safely rewrite passes through
+// untouched rather than reaching the client corrupted.
+func modelDiscoveryFilter(allowed []string, next func(*http.Response) error) func(*http.Response) error {
+	permitted := make(map[string]struct{}, len(allowed)*2)
+	for _, id := range allowed {
+		permitted[id] = struct{}{}
+		permitted[sharedllm.NormalizeAnthropicModel(id)] = struct{}{}
+	}
+
+	return func(resp *http.Response) error {
+		if err := filterModelListing(resp, permitted); err != nil {
+			return err
+		}
+		if next == nil {
+			return nil
+		}
+		return next(resp)
+	}
+}
+
+// filterModelListing rewrites the response body in place, keeping only the
+// entries whose id the policy authorises. Responses that are not a plain
+// JSON listing are left alone.
+func filterModelListing(resp *http.Response, permitted map[string]struct{}) error {
+	if !isPlainJSONListing(resp) {
+		return nil
+	}
+
+	// One byte past the cap, so an oversized body is detectable without
+	// buffering all of it.
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxDiscoveryBodyBytes+1))
+	if err != nil {
+		_ = resp.Body.Close()
+		return err
+	}
+	if len(body) > maxDiscoveryBodyBytes {
+		// Too large to filter. Put the bytes already read back in front of the
+		// unread remainder and forward the response exactly as the upstream
+		// sent it, headers included. Buffering what was read and closing here
+		// would truncate the body at the cap and hand the client a short,
+		// invalid listing — worse than not filtering at all.
+		resp.Body = spliceBody(body, resp.Body)
+		return nil
+	}
+	if err := resp.Body.Close(); err != nil {
+		return err
+	}
+
+	filtered, ok := filterListingBody(body, permitted)
+	if !ok {
+		restoreBody(resp, body)
+		return nil
+	}
+	restoreBody(resp, filtered)
+	return nil
+}
+
+// isPlainJSONListing reports whether the response is a JSON body the filter
+// can parse. A content-encoded body is skipped: the transport only
+// transparently decompresses what it negotiated itself, and the client
+// negotiates its own encoding on this request.
+func isPlainJSONListing(resp *http.Response) bool {
+	if resp == nil || resp.Body == nil {
+		return false
+	}
+	if resp.StatusCode != http.StatusOK {
+		return false
+	}
+	if enc := resp.Header.Get("Content-Encoding"); enc != "" && !strings.EqualFold(enc, "identity") {
+		return false
+	}
+	return strings.Contains(strings.ToLower(resp.Header.Get("Content-Type")), "application/json")
+}
+
+// listingEnvelopes maps a listing's wrapper key to the field naming the model
+// id inside it. Vendors did not converge on one shape: OpenAI's is what
+// Anthropic adopted, while Bedrock returns inference-profile summaries under a
+// key of its own. A body matching none of these is forwarded untouched.
+var listingEnvelopes = []struct {
+	key     string
+	idField string
+}{
+	{"data", "id"},
+	{"inferenceProfileSummaries", "inferenceProfileId"},
+}
+
+// filterListingBody returns the listing with unauthorised entries removed.
+// ok is false when the body is not a listing shape, in which case the
+// caller must forward the original bytes.
+func filterListingBody(body []byte, permitted map[string]struct{}) ([]byte, bool) {
+	var doc map[string]json.RawMessage
+	if err := json.Unmarshal(body, &doc); err != nil {
+		return nil, false
+	}
+	for _, envelope := range listingEnvelopes {
+		raw, present := doc[envelope.key]
+		if !present {
+			continue
+		}
+		var entries []map[string]json.RawMessage
+		if err := json.Unmarshal(raw, &entries); err != nil {
+			return nil, false
+		}
+
+		kept := make([]map[string]json.RawMessage, 0, len(entries))
+		for _, entry := range entries {
+			if entryPermitted(entry, envelope.idField, permitted) {
+				kept = append(kept, entry)
+			}
+		}
+
+		encoded, err := json.Marshal(kept)
+		if err != nil {
+			return nil, false
+		}
+		doc[envelope.key] = encoded
+		out, err := json.Marshal(doc)
+		if err != nil {
+			return nil, false
+		}
+		return out, true
+	}
+	return nil, false
+}
+
+// entryPermitted reports whether a listing entry names a model the policy
+// authorises, trying every form the same model is written in.
+func entryPermitted(entry map[string]json.RawMessage, idField string, permitted map[string]struct{}) bool {
+	raw, ok := entry[idField]
+	if !ok {
+		return false
+	}
+	var id string
+	if err := json.Unmarshal(raw, &id); err != nil {
+		return false
+	}
+	for _, candidate := range modelIDForms(id) {
+		if _, ok := permitted[candidate]; ok {
+			return true
+		}
+	}
+	return false
+}
+
+// gatewayNamespaces are the provider prefixes a gateway prepends to a model
+// it re-exports: LiteLLM lists a Bedrock model the operator registered as
+// "anthropic.claude-opus-5" under "bedrock/anthropic.claude-opus-5". Only
+// these are stripped before matching.
+//
+// A slash is not by itself a namespace separator. Self-hosted backends ship
+// ids that carry one ("Qwen/Qwen2.5-0.5B-Instruct"), and an upstream is free
+// to scope ids per tenant ("tenant-b/claude-sonnet-5"). Treating every slash
+// as a prefix let any such id match an allowed model by its tail, so the
+// picker offered models the policy never named.
+var gatewayNamespaces = map[string]struct{}{
+	"anthropic": {},
+	"azure":     {},
+	"bedrock":   {},
+	"mistral":   {},
+	"openai":    {},
+	"vertex_ai": {},
+}
+
+// modelIDForms returns the forms a single model id may be written in: the id
+// itself, its undated form, and — when the id is namespaced by a gateway we
+// recognise — the same two with that namespace removed
+// ("vertex_ai/claude-sonnet-5"). The bare id is always tried first.
+//
+// The namespace is what precedes the FIRST slash: it is a prefix the gateway
+// put in front of the whole id, and everything after it is the id the
+// operator would have registered, separators included.
+func modelIDForms(id string) []string {
+	if id == "" {
+		return nil
+	}
+	forms := []string{id, sharedllm.NormalizeAnthropicModel(id)}
+	// A Bedrock listing returns region-prefixed, version-suffixed profile ids
+	// ("eu.anthropic.claude-haiku-4-5-20251001-v1:0") while the record may
+	// register the catalog key. Stripping to the key is a no-op for ids that
+	// carry neither, so this costs nothing on the other surfaces.
+	if bedrock := sharedllm.NormalizeBedrockModel(id); bedrock != id {
+		forms = append(forms, bedrock)
+	}
+	if slash := strings.Index(id, "/"); slash > 0 {
+		if _, ok := gatewayNamespaces[id[:slash]]; ok {
+			tail := id[slash+1:]
+			forms = append(forms, tail, sharedllm.NormalizeAnthropicModel(tail))
+		}
+	}
+	return forms
+}
+
+// restoreBody puts body back on the response and fixes the length headers
+// so the client reads exactly what is there.
+// spliceBody returns a ReadCloser that yields prefix followed by whatever is
+// left in rest, closing rest when closed. It lets the filter put back bytes it
+// consumed while deciding, without owning the rest of the stream.
+func spliceBody(prefix []byte, rest io.ReadCloser) io.ReadCloser {
+	return struct {
+		io.Reader
+		io.Closer
+	}{
+		Reader: io.MultiReader(bytes.NewReader(prefix), rest),
+		Closer: rest,
+	}
+}
+
+func restoreBody(resp *http.Response, body []byte) {
+	resp.Body = io.NopCloser(bytes.NewReader(body))
+	resp.ContentLength = int64(len(body))
+	resp.Header.Set("Content-Length", strconv.Itoa(len(body)))
+}
diff --git a/proxy/internal/proxy/discovery_filter_test.go b/proxy/internal/proxy/discovery_filter_test.go
new file mode 100644
index 000000000..fd5666345
--- /dev/null
+++ b/proxy/internal/proxy/discovery_filter_test.go
@@ -0,0 +1,272 @@
+package proxy
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// jsonListingResponse builds a 200 model-listing response with the given
+// body, as an upstream would return it.
+func jsonListingResponse(body string) *http.Response {
+	resp := &http.Response{
+		StatusCode:    http.StatusOK,
+		Header:        http.Header{},
+		Body:          io.NopCloser(strings.NewReader(body)),
+		ContentLength: int64(len(body)),
+	}
+	resp.Header.Set("Content-Type", "application/json")
+	return resp
+}
+
+// listedIDs runs the filter and returns the ids left in the response.
+func listedIDs(t *testing.T, allowed []string, body string) []string {
+	t.Helper()
+	resp := jsonListingResponse(body)                            //nolint:bodyclose // in-memory body, replaced by the filter
+	require.NoError(t, modelDiscoveryFilter(allowed, nil)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
+
+	raw, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+
+	var doc struct {
+		Data []struct {
+			ID string `json:"id"`
+		} `json:"data"`
+	}
+	require.NoError(t, json.Unmarshal(raw, &doc), "filtered body must stay valid JSON")
+
+	ids := make([]string, 0, len(doc.Data))
+	for _, entry := range doc.Data {
+		ids = append(ids, entry.ID)
+	}
+	return ids
+}
+
+// TestModelDiscoveryFilter_KeepsOnlyAuthorisedModels covers the picker a
+// developer sees: an unfiltered upstream list offers every model the shared
+// key can reach, and each one the policy excludes is a request the chain
+// denies a moment later.
+func TestModelDiscoveryFilter_KeepsOnlyAuthorisedModels(t *testing.T) {
+	ids := listedIDs(t, []string{"claude-sonnet-5", "claude-haiku-4-5"}, `{
+		"data": [
+			{"id": "claude-opus-5", "display_name": "Claude Opus 5"},
+			{"id": "claude-sonnet-5", "display_name": "Claude Sonnet 5"},
+			{"id": "claude-haiku-4-5"}
+		],
+		"has_more": false
+	}`)
+
+	assert.Equal(t, []string{"claude-sonnet-5", "claude-haiku-4-5"}, ids,
+		"only the models the route authorises may reach the picker")
+}
+
+// TestModelDiscoveryFilter_MatchesDatedAndPrefixedIDs pins the two id forms
+// a gateway returns for a model the operator registered plainly.
+func TestModelDiscoveryFilter_MatchesDatedAndPrefixedIDs(t *testing.T) {
+	ids := listedIDs(t, []string{"claude-sonnet-4-5", "anthropic.claude-opus-5"}, `{
+		"data": [
+			{"id": "claude-sonnet-4-5-20250929"},
+			{"id": "bedrock/anthropic.claude-opus-5"},
+			{"id": "gpt-4o"}
+		]
+	}`)
+
+	assert.Equal(t, []string{"claude-sonnet-4-5-20250929", "bedrock/anthropic.claude-opus-5"}, ids,
+		"a dated or provider-prefixed id must match its registered form")
+}
+
+// TestModelDiscoveryFilter_PreservesEnvelopeFields guards the rest of the
+// document: clients read paging fields alongside data.
+func TestModelDiscoveryFilter_PreservesEnvelopeFields(t *testing.T) {
+	resp := jsonListingResponse(`{"data":[{"id":"claude-sonnet-5"}],"has_more":true,"first_id":"x"}`) //nolint:bodyclose // in-memory body, replaced by the filter
+	require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, nil)(resp))                  //nolint:bodyclose // in-memory body, replaced by the filter
+
+	raw, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+
+	var doc map[string]any
+	require.NoError(t, json.Unmarshal(raw, &doc))
+	assert.Equal(t, true, doc["has_more"], "paging fields must survive the rewrite")
+	assert.Equal(t, "x", doc["first_id"])
+	assert.Equal(t, strconv.Itoa(len(raw)), resp.Header.Get("Content-Length"),
+		"Content-Length must match the rewritten body")
+}
+
+// TestModelDiscoveryFilter_PassesThroughUnfilterable covers the responses
+// the filter must not touch: a compressed body it cannot parse, a non-JSON
+// body, an error status, and a document with no data array.
+func TestModelDiscoveryFilter_PassesThroughUnfilterable(t *testing.T) {
+	cases := map[string]func() *http.Response{
+		"compressed": func() *http.Response {
+			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
+			resp.Header.Set("Content-Encoding", "gzip")
+			return resp
+		},
+		"not json": func() *http.Response {
+			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
+			resp.Header.Set("Content-Type", "text/html")
+			return resp
+		},
+		"error status": func() *http.Response {
+			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
+			resp.StatusCode = http.StatusInternalServerError
+			return resp
+		},
+		"no data array": func() *http.Response {
+			return jsonListingResponse(`{"object":"list"}`)
+		},
+	}
+
+	for name, build := range cases {
+		t.Run(name, func(t *testing.T) {
+			resp := build() //nolint:bodyclose // in-memory body, replaced by the filter
+			original, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			resp.Body = io.NopCloser(bytes.NewReader(original))
+
+			require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, nil)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
+
+			got, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			assert.Equal(t, string(original), string(got), "an unfilterable response must reach the client unchanged")
+		})
+	}
+}
+
+// TestModelDiscoveryFilter_RunsNextHook pins that an existing
+// ModifyResponse hook still runs after filtering.
+func TestModelDiscoveryFilter_RunsNextHook(t *testing.T) {
+	called := false
+	next := func(*http.Response) error {
+		called = true
+		return nil
+	}
+
+	resp := jsonListingResponse(`{"data":[{"id":"claude-sonnet-5"}]}`)                //nolint:bodyclose // in-memory body, replaced by the filter
+	require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, next)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
+	assert.True(t, called, "the chained hook must still run")
+}
+
+// TestModelDiscoveryFilter_KeepsSlashBearingIDs covers self-hosted backends
+// whose model ids carry a slash of their own. Treating the slash as a
+// gateway prefix and keeping only the tail dropped every such model from
+// the picker even though the policy named it exactly.
+func TestModelDiscoveryFilter_KeepsSlashBearingIDs(t *testing.T) {
+	ids := listedIDs(t, []string{"Qwen/Qwen2.5-0.5B-Instruct"}, `{
+		"object": "list",
+		"data": [
+			{"id": "Qwen/Qwen2.5-0.5B-Instruct"},
+			{"id": "Qwen/Qwen2.5-7B-Instruct"}
+		]
+	}`)
+
+	assert.Equal(t, []string{"Qwen/Qwen2.5-0.5B-Instruct"}, ids,
+		"a slash inside the model id is part of the id, not a provider prefix")
+}
+
+// TestModelDiscoveryFilter_RejectsTailMatchOnUnknownNamespace covers the id
+// an upstream scopes with a prefix of its own. "tenant-b/claude-sonnet-5"
+// ends in a model the policy permits, but it is a different model on a
+// different tenant, and the guardrail denies that string outright — so
+// offering it hands the picker an entry the next request refuses.
+func TestModelDiscoveryFilter_RejectsTailMatchOnUnknownNamespace(t *testing.T) {
+	ids := listedIDs(t, []string{"claude-sonnet-5"}, `{
+		"data": [
+			{"id": "claude-sonnet-5"},
+			{"id": "tenant-b/claude-sonnet-5"},
+			{"id": "Qwen/claude-sonnet-5"}
+		]
+	}`)
+
+	assert.Equal(t, []string{"claude-sonnet-5"}, ids,
+		"only a namespace a gateway is known to prepend may be stripped before matching")
+}
+
+// TestModelDiscoveryFilter_ForwardsOversizedBodyIntact covers a listing past
+// the buffering cap. The filter reads one byte beyond the cap to detect the
+// size; forwarding only what it read would hand the client a body truncated
+// at exactly 1 MiB — valid-looking, short, and unparseable as JSON. The bytes
+// already read must be spliced back in front of the unread remainder so the
+// response reaches the client exactly as the upstream sent it.
+func TestModelDiscoveryFilter_ForwardsOversizedBodyIntact(t *testing.T) {
+	// A well-formed listing whose single entry pads the body past the cap.
+	padding := strings.Repeat("x", maxDiscoveryBodyBytes)
+	body := `{"object":"list","data":[{"id":"gpt-4o","note":"` + padding + `"}]}`
+	require.Greater(t, len(body), maxDiscoveryBodyBytes+1,
+		"the fixture must exceed the cap by more than the one-byte probe")
+
+	resp := jsonListingResponse(body)                        //nolint:bodyclose // in-memory body
+	require.NoError(t, modelDiscoveryFilter(nil, nil)(resp)) //nolint:bodyclose // in-memory body
+
+	got, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	assert.Equal(t, len(body), len(got),
+		"an oversized listing must reach the client whole, not truncated at the cap")
+	assert.Equal(t, body, string(got), "the forwarded bytes must be the upstream's own")
+
+	var doc map[string]json.RawMessage
+	assert.NoError(t, json.Unmarshal(got, &doc),
+		"the forwarded body must still parse as JSON")
+}
+
+// TestModelDiscoveryFilter_OversizedBodyKeepsUpstreamHeaders pins that the
+// oversized path leaves the response metadata alone. Rewriting Content-Length
+// to the truncated prefix is what made the corruption invisible to the client
+// until it tried to parse.
+func TestModelDiscoveryFilter_OversizedBodyKeepsUpstreamHeaders(t *testing.T) {
+	padding := strings.Repeat("x", maxDiscoveryBodyBytes)
+	body := `{"object":"list","data":[{"id":"gpt-4o","note":"` + padding + `"}]}`
+
+	resp := jsonListingResponse(body) //nolint:bodyclose // in-memory body
+	resp.Header.Set("Content-Length", strconv.Itoa(len(body)))
+	require.NoError(t, modelDiscoveryFilter(nil, nil)(resp)) //nolint:bodyclose // in-memory body
+
+	assert.Equal(t, int64(len(body)), resp.ContentLength,
+		"ContentLength must keep describing the body the client receives")
+	assert.Equal(t, strconv.Itoa(len(body)), resp.Header.Get("Content-Length"),
+		"the Content-Length header must not be rewritten to the truncated prefix")
+}
+
+// TestFilterBedrockInferenceProfiles covers the second listing envelope. AWS
+// returns inference-profile summaries under a key of its own with an id field
+// of its own, so a filter that only knew OpenAI's shape forwarded a Bedrock
+// listing whole — offering every profile in the account regardless of policy.
+func TestFilterBedrockInferenceProfiles(t *testing.T) {
+	body := []byte(`{"inferenceProfileSummaries":[
+	  {"inferenceProfileId":"eu.anthropic.claude-haiku-4-5-20251001-v1:0","status":"ACTIVE"},
+	  {"inferenceProfileId":"eu.anthropic.claude-sonnet-4-6","status":"ACTIVE"},
+	  {"inferenceProfileId":"global.cohere.embed-v4:0","status":"ACTIVE"}
+	]}`)
+
+	// The permitted set holds what the record registers. Here that is the
+	// catalog key, while the vendor answers with region-prefixed wire ids —
+	// the two must still line up.
+	permitted := map[string]struct{}{"anthropic.claude-haiku-4-5": {}}
+
+	out, ok := filterListingBody(body, permitted)
+	require.True(t, ok, "a Bedrock listing must be recognised as filterable")
+
+	var doc struct {
+		Summaries []struct {
+			ID string `json:"inferenceProfileId"`
+		} `json:"inferenceProfileSummaries"`
+	}
+	require.NoError(t, json.Unmarshal(out, &doc))
+	require.Len(t, doc.Summaries, 1)
+	assert.Equal(t, "eu.anthropic.claude-haiku-4-5-20251001-v1:0", doc.Summaries[0].ID)
+}
+
+// TestFilterLeavesUnknownEnvelopesAlone keeps the best-effort contract: a body
+// the filter cannot parse must reach the client exactly as the upstream sent
+// it, rather than being rewritten into something shorter and wrong.
+func TestFilterLeavesUnknownEnvelopesAlone(t *testing.T) {
+	_, ok := filterListingBody([]byte(`{"models":[{"name":"something"}]}`), map[string]struct{}{})
+	assert.False(t, ok)
+}
diff --git a/proxy/internal/proxy/reverseproxy.go b/proxy/internal/proxy/reverseproxy.go
index 835a1c0b2..bf3ccaeb1 100644
--- a/proxy/internal/proxy/reverseproxy.go
+++ b/proxy/internal/proxy/reverseproxy.go
@@ -22,6 +22,7 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/proxy/web"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 type ReverseProxy struct {
@@ -29,10 +30,10 @@ type ReverseProxy struct {
 	// forwardedProto overrides the X-Forwarded-Proto header value.
 	// Valid values: "auto" (detect from TLS), "http", "https".
 	forwardedProto string
-	// trustedProxies is a list of IP prefixes for trusted upstream proxies.
-	// When the direct connection comes from a trusted proxy, forwarding
-	// headers are preserved and appended to instead of being stripped.
-	trustedProxies []netip.Prefix
+	// trustedProxies is the set of trusted upstream proxies. When the direct
+	// connection comes from a trusted proxy, forwarding headers are preserved
+	// and appended to instead of being stripped.
+	trustedProxies *trustedproxy.List
 	mappingsMux    sync.RWMutex
 	mappings       map[string]Mapping
 	logger         *log.Logger
@@ -63,7 +64,7 @@ func WithMiddlewareManager(m *middleware.Manager) Option {
 // between requested URLs and targets.
 // The internal mappings can be modified using the AddMapping
 // and RemoveMapping functions.
-func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trustedProxies []netip.Prefix, logger *log.Logger, opts ...Option) *ReverseProxy {
+func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trustedProxies *trustedproxy.List, logger *log.Logger, opts ...Option) *ReverseProxy {
 	if logger == nil {
 		logger = log.StandardLogger()
 	}
@@ -81,7 +82,15 @@ func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trusted
 }
 
 func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	result, exists := p.findTargetForRequest(r)
+	resolution, pinned := targetResolutionFromContext(r.Context())
+	result, exists := resolution.result, resolution.matched
+	if !pinned {
+		result, exists = p.findTargetForRequest(r)
+		if result.requirePinned {
+			p.serveProxyUnavailable(w, r)
+			return
+		}
+	}
 	if !exists {
 		p.serveRouteError(w, r, http.StatusNotFound, "Service Not Found",
 			"The requested service could not be found. Please check the URL, try refreshing, or check if the peer is running. If that doesn't work, see our documentation for help.")
@@ -118,7 +127,11 @@ func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		rewriteMatchedPath = ""
 	}
 
-	chain := p.resolveChain(result)
+	chain, current := p.resolveChain(result)
+	if !current || (targetRequiresMiddleware(pt) && (chain == nil || chain.Empty())) {
+		p.serveProxyUnavailable(w, r)
+		return
+	}
 	if chain == nil || chain.Empty() {
 		p.serveDirect(w, r, ctx, result, rewriteMatchedPath)
 		return
@@ -126,6 +139,28 @@ func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	p.serveWithChain(w, r, ctx, result, chain, rewriteMatchedPath, capturedData)
 }
 
+func (p *ReverseProxy) serveProxyUnavailable(w http.ResponseWriter, r *http.Request) {
+	if cd := CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetOrigin(OriginProxyError)
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	web.ServeErrorPage(w, r, http.StatusServiceUnavailable, "Service Unavailable",
+		"The requested service is being updated. Please try again shortly.", getRequestID(r),
+		web.ErrorStatus{Proxy: true, Destination: false})
+}
+
+func targetRequiresMiddleware(target *PathTarget) bool {
+	if target == nil {
+		return false
+	}
+	for _, spec := range target.Middlewares {
+		if spec.Enabled {
+			return true
+		}
+	}
+	return false
+}
+
 // serveRouteError marks the request as un-routed on any captured-data
 // context and renders the proxy error page.
 func (p *ReverseProxy) serveRouteError(w http.ResponseWriter, r *http.Request, status int, title, message string) {
@@ -362,6 +397,9 @@ func (p *ReverseProxy) forwardUpstream(respWriter http.ResponseWriter, r *http.R
 	if result.rewriteRedirects {
 		rp.ModifyResponse = p.rewriteLocationFunc(effectiveURL, rewriteMatchedPath, r) //nolint:bodyclose
 	}
+	if upstreamRewrite != nil && len(upstreamRewrite.DiscoveryModels) > 0 {
+		rp.ModifyResponse = modelDiscoveryFilter(upstreamRewrite.DiscoveryModels, rp.ModifyResponse) //nolint:bodyclose // the hook replaces the body and closes the original
+	}
 	rp.ServeHTTP(respWriter, r.WithContext(ctx))
 }
 
@@ -451,14 +489,15 @@ func applyUpstreamHeaders(r *http.Request, rewrite *middleware.UpstreamRewrite)
 	}
 }
 
-// resolveChain returns the middleware chain registered for the
-// resolved target, or nil when middleware is disabled for the proxy
-// or the target.
-func (p *ReverseProxy) resolveChain(result targetResult) *middleware.Chain {
+// resolveChain returns a chain only from the target's routing revision.
+func (p *ReverseProxy) resolveChain(result targetResult) (*middleware.Chain, bool) {
 	if p.middlewareManager == nil {
-		return nil
+		return nil, result.middlewareRevision == 0
 	}
-	return p.middlewareManager.ChainFor(string(result.serviceID), result.matchedPath)
+	if result.middlewareRevision == 0 {
+		return p.middlewareManager.ChainFor(string(result.serviceID), result.matchedPath), true
+	}
+	return p.middlewareManager.ChainForRevision(string(result.serviceID), result.matchedPath, result.middlewareRevision)
 }
 
 // buildRequestInput gathers the per-request fields the middleware
@@ -527,7 +566,7 @@ func (p *ReverseProxy) isSelfTargetLoop(r *http.Request, target *url.URL) bool {
 	if !types.IsOverlayOrigin(r.Context()) {
 		return false
 	}
-	srcIP := extractHostIP(r.RemoteAddr)
+	srcIP := trustedproxy.ExtractHostIP(r.RemoteAddr)
 	if !srcIP.IsValid() {
 		return false
 	}
@@ -578,9 +617,9 @@ func (p *ReverseProxy) rewriteFunc(target *url.URL, matchedPath string, passHost
 
 		stampNetBirdIdentity(r)
 
-		clientIP := extractHostIP(r.In.RemoteAddr)
+		clientIP := trustedproxy.ExtractHostIP(r.In.RemoteAddr)
 
-		if isTrustedAddr(clientIP, p.trustedProxies) {
+		if p.trustedProxies.Contains(clientIP) {
 			p.setTrustedForwardingHeaders(r, clientIP)
 		} else {
 			p.setUntrustedForwardingHeaders(r, clientIP)
@@ -664,7 +703,7 @@ func (p *ReverseProxy) setTrustedForwardingHeaders(r *httputil.ProxyRequest, cli
 	if realIP := r.In.Header.Get("X-Real-IP"); realIP != "" {
 		r.Out.Header.Set("X-Real-IP", realIP)
 	} else {
-		resolved := ResolveClientIP(r.In.RemoteAddr, r.In.Header.Get("X-Forwarded-For"), p.trustedProxies)
+		resolved := p.trustedProxies.ResolveClientIP(r.In.RemoteAddr, r.In.Header.Get("X-Forwarded-For"))
 		r.Out.Header.Set("X-Real-IP", resolved.String())
 	}
 
@@ -717,12 +756,13 @@ func stripSessionCookie(r *httputil.ProxyRequest) {
 	}
 }
 
-// stripSessionTokenQuery removes the OIDC session_token query parameter from
-// the outgoing URL to prevent credential leakage to backends.
+// stripSessionTokenQuery removes the OIDC session hand-off query parameters
+// from the outgoing URL to prevent credential leakage to backends.
 func stripSessionTokenQuery(r *httputil.ProxyRequest) {
 	q := r.Out.URL.Query()
-	if q.Has("session_token") {
-		q.Del("session_token")
+	if q.Has(auth.SessionTokenQueryParam) || q.Has(auth.SessionCodeQueryParam) {
+		q.Del(auth.SessionTokenQueryParam)
+		q.Del(auth.SessionCodeQueryParam)
 		r.Out.URL.RawQuery = q.Encode()
 	}
 }
@@ -804,6 +844,12 @@ func classifyProxyError(err error) (title, message string, code int, status web.
 			http.StatusBadGateway,
 			web.ErrorStatus{Proxy: false, Destination: false}
 
+	case errors.Is(err, roundtrip.ErrDirectUpstreamBlocked):
+		return "Destination Not Allowed",
+			"This proxy does not connect to private or internal addresses. Please contact your administrator.",
+			http.StatusBadGateway,
+			web.ErrorStatus{Proxy: false, Destination: false}
+
 	case errors.Is(err, roundtrip.ErrTooManyInflight):
 		return "Service Overloaded",
 			"The service is currently handling too many requests. Please try again shortly.",
diff --git a/proxy/internal/proxy/reverseproxy_test.go b/proxy/internal/proxy/reverseproxy_test.go
index 9bd427056..b26ca1f9f 100644
--- a/proxy/internal/proxy/reverseproxy_test.go
+++ b/proxy/internal/proxy/reverseproxy_test.go
@@ -23,6 +23,7 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/proxy/web"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 func TestRewriteFunc_HostRewriting(t *testing.T) {
@@ -235,6 +236,17 @@ func TestRewriteFunc_SessionTokenQueryStripping(t *testing.T) {
 			"other query parameters must be preserved")
 	})
 
+	t.Run("strips nb_session_code query parameter", func(t *testing.T) {
+		pr := newProxyRequest(t, "http://example.com/callback?nb_session_code=code123&other=keep", "1.2.3.4:5000")
+
+		rewrite(pr)
+
+		assert.Empty(t, pr.Out.URL.Query().Get("nb_session_code"),
+			"OIDC session code must be stripped from backend request")
+		assert.Equal(t, "keep", pr.Out.URL.Query().Get("other"),
+			"other query parameters must be preserved")
+	})
+
 	t.Run("preserves query when no session_token present", func(t *testing.T) {
 		pr := newProxyRequest(t, "http://example.com/api?foo=bar&baz=qux", "1.2.3.4:5000")
 
@@ -302,7 +314,7 @@ func TestExtractHostIP(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, extractHostIP(tt.remoteAddr))
+			assert.Equal(t, tt.expected, trustedproxy.ExtractHostIP(tt.remoteAddr))
 		})
 	}
 }
@@ -330,7 +342,7 @@ func TestExtractForwardedPort(t *testing.T) {
 
 func TestRewriteFunc_TrustedProxy(t *testing.T) {
 	target, _ := url.Parse("http://backend.internal:8080")
-	trusted := []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}
+	trusted := trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")})
 
 	t.Run("appends to X-Forwarded-For", func(t *testing.T) {
 		p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}
@@ -1052,6 +1064,17 @@ func TestClassifyProxyError(t *testing.T) {
 			wantCode:   http.StatusBadGateway,
 			wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
 		},
+		{
+			name: "direct upstream blocked by dial guard",
+			err: &net.OpError{
+				Op:  "dial",
+				Net: "tcp",
+				Err: roundtrip.ErrDirectUpstreamBlocked,
+			},
+			wantTitle:  "Destination Not Allowed",
+			wantCode:   http.StatusBadGateway,
+			wantStatus: web.ErrorStatus{Proxy: false, Destination: false},
+		},
 		{
 			name:       "unknown error falls to default",
 			err:        errors.New("something unexpected"),
diff --git a/proxy/internal/proxy/servicemapping.go b/proxy/internal/proxy/servicemapping.go
index 64fccc42a..40115fd9d 100644
--- a/proxy/internal/proxy/servicemapping.go
+++ b/proxy/internal/proxy/servicemapping.go
@@ -23,9 +23,22 @@ const (
 	PathRewritePreserve
 )
 
+// AccessAction controls how authentication handles requests for a target.
+type AccessAction string
+
+const (
+	// AccessActionInherit applies the service's configured authentication.
+	AccessActionInherit AccessAction = "inherit"
+	// AccessActionBypass skips the service's configured authentication.
+	AccessActionBypass AccessAction = "bypass"
+	// AccessActionBlock rejects the request before authentication.
+	AccessActionBlock AccessAction = "block"
+)
+
 // PathTarget holds a backend URL and per-target behavioral options.
 type PathTarget struct {
 	URL            *url.URL
+	AccessAction   AccessAction
 	SkipTLSVerify  bool
 	RequestTimeout time.Duration
 	PathRewrite    PathRewriteMode
@@ -61,18 +74,25 @@ type Mapping struct {
 	// StripAuthHeaders are header names used for header-based auth.
 	// These headers are stripped from requests before forwarding.
 	StripAuthHeaders []string
+	// MiddlewareRevision binds this routing snapshot to its middleware policies.
+	MiddlewareRevision middleware.Revision
 	// sortedPaths caches the paths sorted by length (longest first).
 	sortedPaths []string
+	// requirePinnedResolution prevents a mapping with target access actions
+	// from being forwarded outside the auth-owned resolver snapshot.
+	requirePinnedResolution bool
 }
 
 type targetResult struct {
-	target           *PathTarget
-	matchedPath      string
-	serviceID        types.ServiceID
-	accountID        types.AccountID
-	passHostHeader   bool
-	rewriteRedirects bool
-	stripAuthHeaders []string
+	target             *PathTarget
+	matchedPath        string
+	serviceID          types.ServiceID
+	accountID          types.AccountID
+	passHostHeader     bool
+	rewriteRedirects   bool
+	stripAuthHeaders   []string
+	middlewareRevision middleware.Revision
+	requirePinned      bool
 }
 
 func (p *ReverseProxy) findTargetForRequest(req *http.Request) (targetResult, bool) {
@@ -90,6 +110,7 @@ func (p *ReverseProxy) findTargetForRequest(req *http.Request) (targetResult, bo
 		p.logger.Debugf("no mapping found for host: %s", host)
 		return targetResult{}, false
 	}
+	baseResult := targetResult{requirePinned: m.requirePinnedResolution}
 
 	for _, path := range m.sortedPaths {
 		if strings.HasPrefix(req.URL.Path, path) {
@@ -100,18 +121,20 @@ func (p *ReverseProxy) findTargetForRequest(req *http.Request) (targetResult, bo
 			}
 			p.logger.Debugf("matched host: %s, path: %s -> %s", host, path, pt.URL)
 			return targetResult{
-				target:           pt,
-				matchedPath:      path,
-				serviceID:        m.ID,
-				accountID:        m.AccountID,
-				passHostHeader:   m.PassHostHeader,
-				rewriteRedirects: m.RewriteRedirects,
-				stripAuthHeaders: m.StripAuthHeaders,
+				target:             pt,
+				matchedPath:        path,
+				serviceID:          m.ID,
+				accountID:          m.AccountID,
+				passHostHeader:     m.PassHostHeader,
+				rewriteRedirects:   m.RewriteRedirects,
+				stripAuthHeaders:   m.StripAuthHeaders,
+				middlewareRevision: m.MiddlewareRevision,
+				requirePinned:      m.requirePinnedResolution,
 			}, true
 		}
 	}
 	p.logger.Debugf("no path match for host: %s, path: %s", host, req.URL.Path)
-	return targetResult{}, false
+	return baseResult, false
 }
 
 // AddMapping registers a host-to-backend mapping for the reverse proxy.
@@ -125,6 +148,7 @@ func (p *ReverseProxy) AddMapping(m Mapping) {
 		return len(paths[i]) > len(paths[j])
 	})
 	m.sortedPaths = paths
+	m.requirePinnedResolution = mappingHasNonDefaultAccessAction(m)
 
 	p.mappingsMux.Lock()
 	defer p.mappingsMux.Unlock()
diff --git a/proxy/internal/proxy/target_middleware_snapshot_test.go b/proxy/internal/proxy/target_middleware_snapshot_test.go
new file mode 100644
index 000000000..dbbff55c7
--- /dev/null
+++ b/proxy/internal/proxy/target_middleware_snapshot_test.go
@@ -0,0 +1,150 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	guardrail "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+)
+
+func TestReverseProxy_PinnedTargetFailsClosedAcrossMiddlewareRevisions(t *testing.T) {
+	restrictiveGuardrail := []middleware.Spec{{
+		ID:        guardrail.ID,
+		Slot:      middleware.SlotOnRequest,
+		Enabled:   true,
+		RawConfig: []byte(`{"provider_allowlists":{"provider-1":["allowed-model"]}}`),
+	}}
+	unrestrictedGuardrail := []middleware.Spec{{
+		ID:        guardrail.ID,
+		Slot:      middleware.SlotOnRequest,
+		Enabled:   true,
+		RawConfig: []byte(`{}`),
+	}}
+
+	tests := []struct {
+		name           string
+		oldMiddlewares []middleware.Spec
+		newMiddlewares []middleware.Spec
+		oldStatus      int
+	}{
+		{
+			name:           "replacement policy cannot authorize old target",
+			oldMiddlewares: restrictiveGuardrail,
+			newMiddlewares: unrestrictedGuardrail,
+			oldStatus:      http.StatusForbidden,
+		},
+		{
+			name:           "new policy cannot run on old no-policy target",
+			newMiddlewares: unrestrictedGuardrail,
+			oldStatus:      http.StatusNoContent,
+		},
+		{
+			name:           "removed policy cannot disappear from old target",
+			oldMiddlewares: unrestrictedGuardrail,
+			oldStatus:      http.StatusNoContent,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			registry := middleware.NewRegistry()
+			require.NoError(t, registry.Register(guardrail.Factory{}))
+			manager := middleware.NewManager(0, nil, nil)
+			manager.SetResolver(middleware.NewResolver(registry))
+
+			oldTarget := &PathTarget{
+				URL:          mustTargetURL(t, "http://old-agent-backend.internal"),
+				AgentNetwork: true,
+				Middlewares:  tt.oldMiddlewares,
+			}
+			oldMapping := resolverMapping(map[string]*PathTarget{"/": oldTarget})
+			oldRevision := rebuildMiddlewareSnapshot(t, manager, &oldMapping)
+			oldResolver, err := NewTargetResolver(oldMapping)
+			require.NoError(t, err)
+
+			// Auth resolves and pins the old route and middleware revision before
+			// the replacement snapshot is installed.
+			req := httptest.NewRequest(http.MethodPost, "http://example.com/v1/chat/completions", nil)
+			oldPinnedReq, _, err := oldResolver.ResolveRequest(req)
+			require.NoError(t, err)
+
+			var upstreamHosts []string
+			rp := NewReverseProxy(resolverRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				upstreamHosts = append(upstreamHosts, req.URL.Host)
+				return &http.Response{
+					StatusCode: http.StatusNoContent,
+					Header:     make(http.Header),
+					Body:       http.NoBody,
+				}, nil
+			}), "auto", nil, nil, WithMiddlewareManager(manager))
+
+			before := httptest.NewRecorder()
+			rp.ServeHTTP(before, oldPinnedReq.Clone(oldPinnedReq.Context()))
+			require.Equal(t, tt.oldStatus, before.Code, "the original snapshot must work before replacement")
+			if tt.oldStatus == http.StatusNoContent {
+				require.Equal(t, []string{"old-agent-backend.internal"}, upstreamHosts)
+			} else {
+				require.Empty(t, upstreamHosts)
+			}
+			upstreamHosts = nil
+
+			newTarget := &PathTarget{
+				URL:          mustTargetURL(t, "http://new-agent-backend.internal"),
+				AgentNetwork: true,
+				Middlewares:  tt.newMiddlewares,
+			}
+			newMapping := resolverMapping(map[string]*PathTarget{"/": newTarget})
+			newRevision := rebuildMiddlewareSnapshot(t, manager, &newMapping)
+			require.NotEqual(t, oldRevision, newRevision)
+
+			stale := httptest.NewRecorder()
+			rp.ServeHTTP(stale, oldPinnedReq)
+
+			assert.Equal(t, http.StatusServiceUnavailable, stale.Code,
+				"a pinned target must not use a replacement middleware revision")
+			assert.Equal(t, "no-store", stale.Header().Get("Cache-Control"))
+			assert.Empty(t, upstreamHosts,
+				"a mixed target/policy generation must never reach an upstream")
+
+			// A request resolved from the replacement route snapshot is coherent
+			// with the replacement chain and reaches only the new backend.
+			newResolver, err := NewTargetResolver(newMapping)
+			require.NoError(t, err)
+			freshReq, _, err := newResolver.ResolveRequest(
+				httptest.NewRequest(http.MethodPost, "http://example.com/v1/chat/completions", nil),
+			)
+			require.NoError(t, err)
+
+			fresh := httptest.NewRecorder()
+			rp.ServeHTTP(fresh, freshReq)
+
+			assert.Equal(t, http.StatusNoContent, fresh.Code)
+			assert.Equal(t, []string{"new-agent-backend.internal"}, upstreamHosts)
+		})
+	}
+}
+
+func rebuildMiddlewareSnapshot(t *testing.T, manager *middleware.Manager, mapping *Mapping) middleware.Revision {
+	t.Helper()
+	bindings := make([]middleware.PathTargetBinding, 0, len(mapping.Paths))
+	for path, target := range mapping.Paths {
+		if target == nil || len(target.Middlewares) == 0 {
+			continue
+		}
+		bindings = append(bindings, middleware.PathTargetBinding{
+			ServiceID: string(mapping.ID),
+			PathID:    path,
+			Specs:     target.Middlewares,
+		})
+	}
+	revision, err := manager.RebuildSnapshot(string(mapping.ID), bindings)
+	require.NoError(t, err)
+	require.NotZero(t, revision)
+	mapping.MiddlewareRevision = revision
+	return revision
+}
diff --git a/proxy/internal/proxy/target_resolver.go b/proxy/internal/proxy/target_resolver.go
new file mode 100644
index 000000000..67ce51a24
--- /dev/null
+++ b/proxy/internal/proxy/target_resolver.go
@@ -0,0 +1,300 @@
+package proxy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"net/http"
+	"net/url"
+	"sort"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/bodytap"
+)
+
+// ErrUnsafeRequestPath indicates that a request path cannot be matched safely.
+var ErrUnsafeRequestPath = errors.New("unsafe request path")
+
+// TargetResolver is an immutable routing snapshot shared by auth and forwarding.
+type TargetResolver struct {
+	mapping     Mapping
+	strictPaths bool
+	hasBypass   bool
+}
+
+type targetResolution struct {
+	result  targetResult
+	matched bool
+}
+
+type targetResolutionContextKey struct{}
+
+// NewTargetResolver builds an immutable target-routing snapshot.
+func NewTargetResolver(mapping Mapping) (*TargetResolver, error) {
+	snapshot, err := cloneResolverMapping(mapping)
+	if err != nil {
+		return nil, err
+	}
+
+	resolver := &TargetResolver{mapping: snapshot}
+	for _, target := range snapshot.Paths {
+		action := effectiveAccessAction(target.AccessAction)
+		if action != AccessActionInherit {
+			resolver.strictPaths = true
+		}
+		if action == AccessActionBypass {
+			resolver.hasBypass = true
+		}
+	}
+	return resolver, nil
+}
+
+// ResolveRequest selects and pins a target for both auth and forwarding.
+func (r *TargetResolver) ResolveRequest(req *http.Request) (*http.Request, AccessAction, error) {
+	if r == nil {
+		return req, AccessActionInherit, nil
+	}
+	if req == nil || req.URL == nil {
+		return req, AccessActionInherit, fmt.Errorf("%w: missing URL", ErrUnsafeRequestPath)
+	}
+	if r.strictPaths {
+		if err := validateAccessPath(req.URL); err != nil {
+			return req, AccessActionInherit, err
+		}
+	}
+
+	result, matched := findTargetInMapping(req.URL.Path, r.mapping)
+	resolution := targetResolution{result: result, matched: matched}
+	ctx := context.WithValue(req.Context(), targetResolutionContextKey{}, resolution)
+	resolvedReq := req.WithContext(ctx)
+	if !matched {
+		return resolvedReq, AccessActionInherit, nil
+	}
+
+	if cd := CapturedDataFromContext(ctx); cd != nil {
+		cd.SetServiceID(result.serviceID)
+		cd.SetAccountID(result.accountID)
+		cd.SetAgentNetwork(result.target.AgentNetwork)
+		cd.SetSuppressAccessLog(result.target.DisableAccessLog)
+	}
+	return resolvedReq, effectiveAccessAction(result.target.AccessAction), nil
+}
+
+// HasBypass reports whether the snapshot contains an authentication bypass.
+func (r *TargetResolver) HasBypass() bool {
+	return r != nil && r.hasBypass
+}
+
+// WithMiddlewareRevision returns a routing snapshot bound to the given policy revision.
+func (r *TargetResolver) WithMiddlewareRevision(revision middleware.Revision) *TargetResolver {
+	bound := *r
+	bound.mapping.MiddlewareRevision = revision
+	return &bound
+}
+
+func targetResolutionFromContext(ctx context.Context) (targetResolution, bool) {
+	resolution, ok := ctx.Value(targetResolutionContextKey{}).(targetResolution)
+	return resolution, ok
+}
+
+func effectiveAccessAction(action AccessAction) AccessAction {
+	if action == "" {
+		return AccessActionInherit
+	}
+	return action
+}
+
+func mappingHasNonDefaultAccessAction(mapping Mapping) bool {
+	for _, target := range mapping.Paths {
+		if target != nil && effectiveAccessAction(target.AccessAction) != AccessActionInherit {
+			return true
+		}
+	}
+	return false
+}
+
+func cloneResolverMapping(mapping Mapping) (Mapping, error) {
+	snapshot := mapping
+	snapshot.Paths = make(map[string]*PathTarget, len(mapping.Paths))
+	snapshot.StripAuthHeaders = append([]string(nil), mapping.StripAuthHeaders...)
+	snapshot.sortedPaths = make([]string, 0, len(mapping.Paths))
+
+	for path, target := range mapping.Paths {
+		if target == nil || target.URL == nil {
+			return Mapping{}, fmt.Errorf("target for path %q is incomplete", path)
+		}
+		action := effectiveAccessAction(target.AccessAction)
+		switch action {
+		case AccessActionInherit, AccessActionBypass, AccessActionBlock:
+		default:
+			return Mapping{}, fmt.Errorf("unknown access action %q for path %q", target.AccessAction, path)
+		}
+		if action == AccessActionBypass && target.AgentNetwork {
+			return Mapping{}, fmt.Errorf("authentication bypass is not allowed for Agent Network target %q", path)
+		}
+		if action != AccessActionInherit {
+			if err := validateAccessPrefix(path); err != nil {
+				return Mapping{}, fmt.Errorf("invalid access-controlled path %q: %w", path, err)
+			}
+		}
+
+		cloned := clonePathTarget(target)
+		cloned.AccessAction = action
+		snapshot.Paths[path] = cloned
+		snapshot.sortedPaths = append(snapshot.sortedPaths, path)
+	}
+	sort.Slice(snapshot.sortedPaths, func(i, j int) bool {
+		return len(snapshot.sortedPaths[i]) > len(snapshot.sortedPaths[j])
+	})
+	snapshot.requirePinnedResolution = mappingHasNonDefaultAccessAction(snapshot)
+	return snapshot, nil
+}
+
+func validateAccessPrefix(prefix string) error {
+	if strings.ContainsAny(prefix, "?#") {
+		return fmt.Errorf("%w: query or fragment delimiter", ErrUnsafeRequestPath)
+	}
+	return validateAccessPath(&url.URL{Path: prefix})
+}
+
+func clonePathTarget(target *PathTarget) *PathTarget {
+	cloned := *target
+	clonedURL := *target.URL
+	cloned.URL = &clonedURL
+	cloned.CustomHeaders = maps.Clone(target.CustomHeaders)
+	cloned.Middlewares = cloneMiddlewareSpecs(target.Middlewares)
+	cloned.CaptureConfig = cloneCaptureConfig(target.CaptureConfig)
+	return &cloned
+}
+
+func cloneMiddlewareSpecs(specs []middleware.Spec) []middleware.Spec {
+	if specs == nil {
+		return nil
+	}
+	cloned := make([]middleware.Spec, len(specs))
+	for i, spec := range specs {
+		cloned[i] = spec.Clone()
+	}
+	return cloned
+}
+
+func cloneCaptureConfig(config *bodytap.Config) *bodytap.Config {
+	if config == nil {
+		return nil
+	}
+	cloned := *config
+	cloned.ContentTypes = append([]string(nil), config.ContentTypes...)
+	return &cloned
+}
+
+func findTargetInMapping(path string, mapping Mapping) (targetResult, bool) {
+	for _, prefix := range mapping.sortedPaths {
+		if !strings.HasPrefix(path, prefix) {
+			continue
+		}
+		target := mapping.Paths[prefix]
+		if target == nil || target.URL == nil {
+			continue
+		}
+		return targetResult{
+			target:             target,
+			matchedPath:        prefix,
+			serviceID:          mapping.ID,
+			accountID:          mapping.AccountID,
+			passHostHeader:     mapping.PassHostHeader,
+			rewriteRedirects:   mapping.RewriteRedirects,
+			stripAuthHeaders:   mapping.StripAuthHeaders,
+			middlewareRevision: mapping.MiddlewareRevision,
+			requirePinned:      mapping.requirePinnedResolution,
+		}, true
+	}
+	return targetResult{requirePinned: mapping.requirePinnedResolution}, false
+}
+
+func validateAccessPath(requestURL *url.URL) error {
+	if requestURL.Opaque != "" || requestURL.Path == "" || requestURL.Path[0] != '/' {
+		return fmt.Errorf("%w: path must be absolute", ErrUnsafeRequestPath)
+	}
+	if !utf8.ValidString(requestURL.Path) {
+		return fmt.Errorf("%w: path is not valid UTF-8", ErrUnsafeRequestPath)
+	}
+	if requestURL.RawPath != "" {
+		decoded, err := url.PathUnescape(requestURL.RawPath)
+		if err != nil || decoded != requestURL.Path {
+			return fmt.Errorf("%w: invalid escaped path", ErrUnsafeRequestPath)
+		}
+	}
+	if err := validateDecodedAccessPath(requestURL.Path); err != nil {
+		return err
+	}
+	return validateEscapedAccessPath(requestURL.EscapedPath())
+}
+
+func validateDecodedAccessPath(path string) error {
+	if strings.Contains(path, "//") || strings.ContainsAny(path, "\\;?#") {
+		return fmt.Errorf("%w: ambiguous path separator", ErrUnsafeRequestPath)
+	}
+	for _, segment := range strings.Split(path, "/") {
+		if segment == "." || segment == ".." {
+			return fmt.Errorf("%w: dot segment", ErrUnsafeRequestPath)
+		}
+	}
+	for _, char := range path {
+		if char < 0x20 || char == 0x7f {
+			return fmt.Errorf("%w: control character", ErrUnsafeRequestPath)
+		}
+	}
+	return nil
+}
+
+func validateEscapedAccessPath(escapedPath string) error {
+	for i := 0; i < len(escapedPath); i++ {
+		if escapedPath[i] != '%' {
+			continue
+		}
+		if i+2 >= len(escapedPath) {
+			return fmt.Errorf("%w: truncated escape", ErrUnsafeRequestPath)
+		}
+		value, ok := decodeHexByte(escapedPath[i+1], escapedPath[i+2])
+		if !ok {
+			return fmt.Errorf("%w: invalid escape", ErrUnsafeRequestPath)
+		}
+		switch value {
+		case '/', '\\', '.', '%', 0:
+			return fmt.Errorf("%w: ambiguous escaped character", ErrUnsafeRequestPath)
+		}
+		if value < 0x20 || value == 0x7f {
+			return fmt.Errorf("%w: escaped control character", ErrUnsafeRequestPath)
+		}
+		i += 2
+	}
+	return nil
+}
+
+func decodeHexByte(high, low byte) (byte, bool) {
+	hi, ok := hexNibble(high)
+	if !ok {
+		return 0, false
+	}
+	lo, ok := hexNibble(low)
+	if !ok {
+		return 0, false
+	}
+	return hi<<4 | lo, true
+}
+
+func hexNibble(value byte) (byte, bool) {
+	switch {
+	case value >= '0' && value <= '9':
+		return value - '0', true
+	case value >= 'a' && value <= 'f':
+		return value - 'a' + 10, true
+	case value >= 'A' && value <= 'F':
+		return value - 'A' + 10, true
+	default:
+		return 0, false
+	}
+}
diff --git a/proxy/internal/proxy/target_resolver_path_test.go b/proxy/internal/proxy/target_resolver_path_test.go
new file mode 100644
index 000000000..d2c5efa35
--- /dev/null
+++ b/proxy/internal/proxy/target_resolver_path_test.go
@@ -0,0 +1,202 @@
+package proxy
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateAccessPath(t *testing.T) {
+	tests := []struct {
+		name    string
+		url     url.URL
+		wantErr bool
+	}{
+		{name: "root", url: url.URL{Path: "/"}},
+		{name: "nested path", url: url.URL{Path: "/public/status"}},
+		{name: "trailing slash", url: url.URL{Path: "/public/"}},
+		{name: "dots within segments", url: url.URL{Path: "/.well-known/file..json"}},
+		{name: "space", url: url.URL{Path: "/file name"}},
+		{name: "unicode", url: url.URL{Path: "/unicode/é"}},
+		{name: "encoded space", url: url.URL{Path: "/file name", RawPath: "/file%20name"}},
+		{name: "encoded letter", url: url.URL{Path: "/public", RawPath: "/%70ublic"}},
+		{name: "encoded unicode", url: url.URL{Path: "/unicode/é", RawPath: "/unicode/%C3%a9"}},
+		{
+			name: "query and fragment are separate from the path",
+			url:  url.URL{Path: "/public", RawQuery: "next=/../private", Fragment: "section"},
+		},
+		{name: "empty path", url: url.URL{}, wantErr: true},
+		{name: "relative path", url: url.URL{Path: "public"}, wantErr: true},
+		{name: "opaque URL", url: url.URL{Path: "/public", Opaque: "//example.com/private"}, wantErr: true},
+		{name: "invalid UTF-8", url: url.URL{Path: "/public/\xff"}, wantErr: true},
+		{
+			name:    "encoded invalid UTF-8",
+			url:     url.URL{Path: "/public/\xff", RawPath: "/public/%ff"},
+			wantErr: true,
+		},
+		{name: "bare escape", url: url.URL{Path: "/public", RawPath: "/public%"}, wantErr: true},
+		{name: "short escape", url: url.URL{Path: "/public", RawPath: "/public%2"}, wantErr: true},
+		{name: "invalid escape", url: url.URL{Path: "/public", RawPath: "/public%GG"}, wantErr: true},
+		{name: "mismatched raw path", url: url.URL{Path: "/public", RawPath: "/private"}, wantErr: true},
+		{name: "duplicate separator", url: url.URL{Path: "/public//private"}, wantErr: true},
+		{name: "backslash", url: url.URL{Path: "/public\\private"}, wantErr: true},
+		{name: "path parameter", url: url.URL{Path: "/public;private"}, wantErr: true},
+		{name: "query delimiter in path", url: url.URL{Path: "/public?private"}, wantErr: true},
+		{name: "fragment delimiter in path", url: url.URL{Path: "/public#private"}, wantErr: true},
+		{name: "dot segment", url: url.URL{Path: "/public/./private"}, wantErr: true},
+		{name: "parent segment", url: url.URL{Path: "/public/../private"}, wantErr: true},
+		{name: "NUL", url: url.URL{Path: "/public/\x00private"}, wantErr: true},
+		{name: "control character", url: url.URL{Path: "/public/\x1fprivate"}, wantErr: true},
+		{name: "DEL", url: url.URL{Path: "/public/\x7fprivate"}, wantErr: true},
+		{
+			name:    "encoded separator",
+			url:     url.URL{Path: "/public/private", RawPath: "/public%2Fprivate"},
+			wantErr: true,
+		},
+		{
+			// The decoded dot is within a segment, so only escaped validation rejects it.
+			name:    "encoded dot within segment",
+			url:     url.URL{Path: "/file.txt", RawPath: "/file%2Etxt"},
+			wantErr: true,
+		},
+		{
+			name:    "double encoding",
+			url:     url.URL{Path: "/public/%2e%2e/private", RawPath: "/public/%252e%252e/private"},
+			wantErr: true,
+		},
+		{name: "percent without raw path", url: url.URL{Path: "/public/%2fprivate"}, wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateAccessPath(&tt.url)
+			if tt.wantErr {
+				assert.ErrorIs(t, err, ErrUnsafeRequestPath, "unsafe URL path must be rejected")
+				return
+			}
+			assert.NoError(t, err, "ordinary URL path must remain supported")
+		})
+	}
+}
+
+func TestValidateAccessPath_RejectsEncodedTraversal(t *testing.T) {
+	tests := []struct {
+		name    string
+		rawPath string
+	}{
+		{name: "encoded parent segment", rawPath: "/public/%2E%2E/private"},
+		{
+			name: "UTF-16LE encoded traversal",
+			rawPath: "%2f%00%70%00%75%00%62%00%6c%00%69%00%63%00%2f%00" +
+				"%2e%00%2e%00%2f%00%70%00%72%00%69%00%76%00%61%00%74%00%65%00",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Preserve percent-decoded bytes, including NULs, without transcoding UTF-16.
+			path, err := url.PathUnescape(tt.rawPath)
+			require.NoError(t, err)
+
+			err = validateAccessPath(&url.URL{Path: path, RawPath: tt.rawPath})
+			assert.ErrorIs(t, err, ErrUnsafeRequestPath, "encoded traversal must be rejected")
+		})
+	}
+}
+
+func TestValidateDecodedAccessPath(t *testing.T) {
+	tests := []struct {
+		name    string
+		path    string
+		wantErr bool
+	}{
+		{name: "root", path: "/"},
+		{name: "nested path", path: "/public/status"},
+		{name: "trailing slash", path: "/public/"},
+		{name: "dots within segments", path: "/.well-known/file..json/..."},
+		{name: "space boundary", path: "/file\x20name"},
+		{name: "last printable ASCII", path: "/file\x7e"},
+		{name: "unicode", path: "/unicode/é"},
+		{name: "duplicate leading separator", path: "//public", wantErr: true},
+		{name: "duplicate nested separator", path: "/public//private", wantErr: true},
+		{name: "backslash", path: "/public\\private", wantErr: true},
+		{name: "path parameter", path: "/public;private", wantErr: true},
+		{name: "query delimiter", path: "/public?private", wantErr: true},
+		{name: "fragment delimiter", path: "/public#private", wantErr: true},
+		{name: "dot segment", path: "/public/./private", wantErr: true},
+		{name: "parent segment", path: "/public/../private", wantErr: true},
+		{name: "terminal dot segment", path: "/public/.", wantErr: true},
+		{name: "terminal parent segment", path: "/public/..", wantErr: true},
+		{name: "NUL", path: "/public/\x00private", wantErr: true},
+		{name: "tab", path: "/public/\tprivate", wantErr: true},
+		{name: "newline", path: "/public/\nprivate", wantErr: true},
+		{name: "carriage return", path: "/public/\rprivate", wantErr: true},
+		{name: "last C0 control", path: "/public/\x1fprivate", wantErr: true},
+		{name: "DEL", path: "/public/\x7fprivate", wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateDecodedAccessPath(tt.path)
+			if tt.wantErr {
+				assert.ErrorIs(t, err, ErrUnsafeRequestPath, "unsafe decoded path %q must be rejected", tt.path)
+				return
+			}
+			assert.NoError(t, err, "ordinary decoded path %q must remain supported", tt.path)
+		})
+	}
+}
+
+func TestValidateEscapedAccessPath(t *testing.T) {
+	// Malformed escapes and decoded controls normally fail earlier in validateAccessPath.
+	// Exercise these guards directly so changes to that ordering cannot silently weaken them.
+	tests := []struct {
+		name    string
+		path    string
+		wantErr bool
+	}{
+		{name: "root", path: "/"},
+		{name: "unescaped path", path: "/.well-known/file.txt"},
+		{name: "encoded space boundary", path: "/file%20name"},
+		{name: "encoded last printable ASCII lowercase", path: "/file%7e"},
+		{name: "encoded last printable ASCII uppercase", path: "/file%7E"},
+		{name: "adjacent escapes", path: "/%41%42%39"},
+		{name: "mixed case unicode escapes", path: "/unicode/%C3%a9"},
+		{name: "bare escape", path: "/public/%", wantErr: true},
+		{name: "short escape", path: "/public/%2", wantErr: true},
+		{name: "invalid high nibble", path: "/public/%G0", wantErr: true},
+		{name: "invalid low nibble", path: "/public/%0g", wantErr: true},
+		{name: "encoded slash lowercase", path: "/public%2fprivate", wantErr: true},
+		{name: "encoded slash uppercase", path: "/public%2Fprivate", wantErr: true},
+		{name: "encoded backslash lowercase", path: "/public%5cprivate", wantErr: true},
+		{name: "encoded backslash uppercase", path: "/public%5Cprivate", wantErr: true},
+		{name: "encoded dot lowercase", path: "/file%2etxt", wantErr: true},
+		{name: "encoded dot uppercase", path: "/file%2Etxt", wantErr: true},
+		{name: "encoded percent", path: "/public/%25", wantErr: true},
+		{name: "double encoding", path: "/public/%252e%252e/private", wantErr: true},
+		{name: "encoded NUL", path: "/public/%00private", wantErr: true},
+		{name: "encoded first non-NUL control", path: "/public/%01private", wantErr: true},
+		{name: "encoded tab", path: "/public/%09private", wantErr: true},
+		{name: "encoded newline", path: "/public/%0aprivate", wantErr: true},
+		{name: "encoded carriage return", path: "/public/%0Dprivate", wantErr: true},
+		{name: "encoded last C0 control lowercase", path: "/public/%1fprivate", wantErr: true},
+		{name: "encoded last C0 control uppercase", path: "/public/%1Fprivate", wantErr: true},
+		{name: "encoded DEL lowercase", path: "/public/%7fprivate", wantErr: true},
+		{name: "encoded DEL uppercase", path: "/public/%7Fprivate", wantErr: true},
+		{name: "unsafe escape after valid escape", path: "/%41%2fprivate", wantErr: true},
+		{name: "malformed escape after valid escape", path: "/%41%", wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateEscapedAccessPath(tt.path)
+			if tt.wantErr {
+				assert.ErrorIs(t, err, ErrUnsafeRequestPath, "unsafe escaped path %q must be rejected", tt.path)
+				return
+			}
+			assert.NoError(t, err, "ordinary escaped path %q must remain supported", tt.path)
+		})
+	}
+}
diff --git a/proxy/internal/proxy/target_resolver_test.go b/proxy/internal/proxy/target_resolver_test.go
new file mode 100644
index 000000000..bf48d812c
--- /dev/null
+++ b/proxy/internal/proxy/target_resolver_test.go
@@ -0,0 +1,336 @@
+package proxy
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	guardrail "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+)
+
+type resolverRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f resolverRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func resolverMapping(targets map[string]*PathTarget) Mapping {
+	return Mapping{
+		ID:        "service-1",
+		AccountID: "account-1",
+		Host:      "example.com",
+		Paths:     targets,
+	}
+}
+
+func mustTargetURL(t *testing.T, rawURL string) *url.URL {
+	t.Helper()
+	targetURL, err := url.Parse(rawURL)
+	require.NoError(t, err)
+	return targetURL
+}
+
+func TestTargetResolver_LongestPrefixPinsTargetAndAction(t *testing.T) {
+	mapping := resolverMapping(map[string]*PathTarget{
+		"/": {
+			URL:          mustTargetURL(t, "http://root.internal"),
+			AccessAction: AccessActionInherit,
+		},
+		"/public": {
+			URL:           mustTargetURL(t, "http://public.internal"),
+			AccessAction:  AccessActionBypass,
+			CustomHeaders: map[string]string{"X-Target": "original"},
+		},
+	})
+	resolver, err := NewTargetResolver(mapping)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/public/status", nil)
+	resolvedReq, action, err := resolver.ResolveRequest(req)
+	require.NoError(t, err)
+	assert.Equal(t, AccessActionBypass, action, "the longest matching target action should be selected")
+
+	// Mutating both the source mapping and the live proxy mapping must not
+	// change the target already selected by the auth snapshot.
+	mapping.Paths["/public"].URL.Host = "mutated.internal"
+	mapping.Paths["/public"].CustomHeaders["X-Target"] = "mutated"
+	liveMapping := resolverMapping(map[string]*PathTarget{
+		"/": {URL: mustTargetURL(t, "http://replacement.internal")},
+	})
+
+	var gotHost, gotHeader string
+	rp := NewReverseProxy(resolverRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		gotHost = req.URL.Host
+		gotHeader = req.Header.Get("X-Target")
+		return &http.Response{
+			StatusCode: http.StatusNoContent,
+			Header:     make(http.Header),
+			Body:       http.NoBody,
+		}, nil
+	}), "auto", nil, nil)
+	rp.AddMapping(liveMapping)
+	rec := httptest.NewRecorder()
+	rp.ServeHTTP(rec, resolvedReq)
+
+	assert.Equal(t, http.StatusNoContent, rec.Code)
+	assert.Equal(t, "public.internal", gotHost, "forwarding must reuse the target pinned before auth")
+	assert.Equal(t, "original", gotHeader, "resolver-owned target options must be immutable")
+}
+
+func TestTargetResolver_PinnedMissDoesNotFallBackToNewMapping(t *testing.T) {
+	resolver, err := NewTargetResolver(resolverMapping(map[string]*PathTarget{
+		"/api": {URL: mustTargetURL(t, "http://api.internal")},
+	}))
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/other", nil)
+	resolvedReq, action, err := resolver.ResolveRequest(req)
+	require.NoError(t, err)
+	assert.Equal(t, AccessActionInherit, action)
+
+	called := false
+	rp := NewReverseProxy(resolverRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		called = true
+		return nil, errors.New("unexpected forwarding")
+	}), "auto", nil, nil)
+	rp.AddMapping(resolverMapping(map[string]*PathTarget{
+		"/": {URL: mustTargetURL(t, "http://new.internal")},
+	}))
+	rec := httptest.NewRecorder()
+	rp.ServeHTTP(rec, resolvedReq)
+
+	assert.Equal(t, http.StatusNotFound, rec.Code)
+	assert.False(t, called, "a miss pinned before auth must not be resolved again after an update")
+}
+
+func TestReverseProxy_UnpinnedNonDefaultMappingFailsClosed(t *testing.T) {
+	for _, requestPath := range []string{"/public", "/missing"} {
+		t.Run(requestPath, func(t *testing.T) {
+			called := false
+			rp := NewReverseProxy(resolverRoundTripFunc(func(*http.Request) (*http.Response, error) {
+				called = true
+				return nil, errors.New("unexpected forwarding")
+			}), "auto", nil, nil)
+			rp.AddMapping(resolverMapping(map[string]*PathTarget{
+				"/public": {
+					URL:          mustTargetURL(t, "http://public.internal"),
+					AccessAction: AccessActionBypass,
+				},
+			}))
+
+			req := httptest.NewRequest(http.MethodGet, "http://example.com"+requestPath, nil)
+			rec := httptest.NewRecorder()
+			rp.ServeHTTP(rec, req)
+
+			assert.Equal(t, http.StatusServiceUnavailable, rec.Code,
+				"both target hits and misses must require an auth-owned resolution")
+			assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"),
+				"an unavailable routing snapshot must not be cached")
+			assert.False(t, called, "a target access action must never forward without an auth-owned resolution")
+		})
+	}
+}
+
+func TestReverseProxy_ConfiguredMiddlewareMissingChainFailsClosed(t *testing.T) {
+	called := false
+	manager := middleware.NewManager(0, nil, nil)
+	rp := NewReverseProxy(resolverRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		called = true
+		return nil, errors.New("unexpected forwarding")
+	}), "auto", nil, nil, WithMiddlewareManager(manager))
+	rp.AddMapping(resolverMapping(map[string]*PathTarget{
+		"/": {
+			URL: mustTargetURL(t, "http://protected.internal"),
+			Middlewares: []middleware.Spec{{
+				ID:      "required-policy",
+				Slot:    middleware.SlotOnRequest,
+				Enabled: true,
+			}},
+		},
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	rec := httptest.NewRecorder()
+	rp.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusServiceUnavailable, rec.Code)
+	assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"))
+	assert.False(t, called, "a missing configured policy chain must never become pass-through")
+}
+
+func TestReverseProxy_PinnedTargetFailsClosedAfterMiddlewareRemoval(t *testing.T) {
+	target := &PathTarget{
+		URL:          mustTargetURL(t, "http://protected.internal"),
+		AccessAction: AccessActionInherit,
+		Middlewares: []middleware.Spec{{
+			ID:      guardrail.ID,
+			Slot:    middleware.SlotOnRequest,
+			Enabled: true,
+		}},
+	}
+	mapping := resolverMapping(map[string]*PathTarget{"/": target})
+	resolver, err := NewTargetResolver(mapping)
+	require.NoError(t, err)
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	resolvedReq, _, err := resolver.ResolveRequest(req)
+	require.NoError(t, err)
+
+	upstreamCalls := 0
+	registry := middleware.NewRegistry()
+	require.NoError(t, registry.Register(guardrail.Factory{}))
+	manager := middleware.NewManager(0, nil, nil)
+	manager.SetResolver(middleware.NewResolver(registry))
+	require.NoError(t, manager.Rebuild(string(mapping.ID), []middleware.PathTargetBinding{{
+		ServiceID: string(mapping.ID),
+		PathID:    "/",
+		Specs:     target.Middlewares,
+	}}))
+	require.NotNil(t, manager.ChainFor(string(mapping.ID), "/"), "the policy chain must exist before invalidation")
+	rp := NewReverseProxy(resolverRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		upstreamCalls++
+		return &http.Response{
+			StatusCode: http.StatusNoContent,
+			Header:     make(http.Header),
+			Body:       http.NoBody,
+		}, nil
+	}), "auto", nil, nil, WithMiddlewareManager(manager))
+	before := httptest.NewRecorder()
+	rp.ServeHTTP(before, resolvedReq.Clone(resolvedReq.Context()))
+	require.Equal(t, http.StatusNoContent, before.Code, "the installed policy chain must allow forwarding")
+	require.Equal(t, 1, upstreamCalls, "the upstream must receive the request before invalidation")
+
+	manager.Invalidate(string(mapping.ID))
+	require.Nil(t, manager.ChainFor(string(mapping.ID), "/"), "invalidation must remove the installed chain")
+	rec := httptest.NewRecorder()
+	rp.ServeHTTP(rec, resolvedReq)
+
+	assert.Equal(t, http.StatusServiceUnavailable, rec.Code, "a removed policy chain must fail closed")
+	assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"), "a removed policy chain must not be cached")
+	assert.Equal(t, 1, upstreamCalls, "a stale pinned target must not bypass a removed policy chain")
+}
+
+func TestTargetResolver_RejectsUnsafePathsWhenActionsAreConfigured(t *testing.T) {
+	resolver, err := NewTargetResolver(resolverMapping(map[string]*PathTarget{
+		"/public": {
+			URL:          mustTargetURL(t, "http://public.internal"),
+			AccessAction: AccessActionBypass,
+		},
+		"/": {URL: mustTargetURL(t, "http://root.internal")},
+	}))
+	require.NoError(t, err)
+
+	tests := []struct {
+		name    string
+		path    string
+		rawPath string
+	}{
+		{name: "dot segment", path: "/public/../private"},
+		{name: "duplicate separator", path: "/public//private"},
+		{name: "backslash", path: `/public\private`},
+		{name: "path parameter", path: "/public;ignored/private"},
+		{name: "encoded query delimiter", path: "/public?ignored", rawPath: "/public%3fignored"},
+		{name: "encoded fragment delimiter", path: "/public#ignored", rawPath: "/public%23ignored"},
+		{name: "encoded slash", path: "/public/private", rawPath: "/public%2fprivate"},
+		{name: "encoded dot", path: "/public/../private", rawPath: "/public/%2e%2e/private"},
+		{name: "double encoding", path: "/public/%2e%2e/private", rawPath: "/public/%252e%252e/private"},
+		{name: "escaped NUL", path: "/public/\x00private", rawPath: "/public/%00private"},
+		{name: "mismatched raw path", path: "/public/safe", rawPath: "/different"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+			req.URL.Path = tt.path
+			req.URL.RawPath = tt.rawPath
+
+			_, _, err := resolver.ResolveRequest(req)
+
+			require.ErrorIs(t, err, ErrUnsafeRequestPath)
+		})
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/public/file%20name", nil)
+	_, action, err := resolver.ResolveRequest(req)
+	require.NoError(t, err)
+	assert.Equal(t, AccessActionBypass, action, "ordinary percent-encoded path data should remain supported")
+}
+
+func TestTargetResolver_InheritOnlyPreservesLegacyPathHandling(t *testing.T) {
+	resolver, err := NewTargetResolver(resolverMapping(map[string]*PathTarget{
+		"/": {URL: mustTargetURL(t, "http://root.internal")},
+	}))
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	req.URL.Path = "/legacy/../path"
+	resolvedReq, action, err := resolver.ResolveRequest(req)
+
+	require.NoError(t, err)
+	assert.Equal(t, AccessActionInherit, action)
+	_, pinned := targetResolutionFromContext(resolvedReq.Context())
+	assert.True(t, pinned, "inherit-only mappings should still pin their target snapshot")
+}
+
+func TestNewTargetResolver_RejectsInvalidAccessActions(t *testing.T) {
+	tests := []struct {
+		name   string
+		target *PathTarget
+	}{
+		{
+			name: "unknown action",
+			target: &PathTarget{
+				URL:          mustTargetURL(t, "http://target.internal"),
+				AccessAction: AccessAction("unknown"),
+			},
+		},
+		{
+			name: "Agent Network bypass",
+			target: &PathTarget{
+				URL:          mustTargetURL(t, "http://target.internal"),
+				AccessAction: AccessActionBypass,
+				AgentNetwork: true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := NewTargetResolver(resolverMapping(map[string]*PathTarget{"/": tt.target}))
+			require.Error(t, err)
+		})
+	}
+}
+
+func TestNewTargetResolver_RejectsNoncanonicalAccessPrefixes(t *testing.T) {
+	prefixes := []string{
+		"public",
+		"/public/../private",
+		"/public//nested",
+		`/public\nested`,
+		"/public;parameter",
+		"/public%2fprivate",
+		"/public?query",
+		"/public#fragment",
+		"/public\x00nested",
+	}
+
+	for _, prefix := range prefixes {
+		t.Run(prefix, func(t *testing.T) {
+			_, err := NewTargetResolver(resolverMapping(map[string]*PathTarget{
+				prefix: {
+					URL:          mustTargetURL(t, "http://target.internal"),
+					AccessAction: AccessActionBlock,
+				},
+				"/": {URL: mustTargetURL(t, "http://root.internal")},
+			}))
+
+			require.ErrorIs(t, err, ErrUnsafeRequestPath)
+		})
+	}
+}
diff --git a/proxy/internal/proxy/trustedproxy.go b/proxy/internal/proxy/trustedproxy.go
deleted file mode 100644
index 0fe693f90..000000000
--- a/proxy/internal/proxy/trustedproxy.go
+++ /dev/null
@@ -1,81 +0,0 @@
-package proxy
-
-import (
-	"net/netip"
-	"strings"
-)
-
-// IsTrustedProxy checks if the given IP string falls within any of the trusted prefixes.
-func IsTrustedProxy(ipStr string, trusted []netip.Prefix) bool {
-	addr, err := netip.ParseAddr(ipStr)
-	if err != nil || len(trusted) == 0 {
-		return false
-	}
-	return isTrustedAddr(addr.Unmap(), trusted)
-}
-
-// ResolveClientIP extracts the real client IP from X-Forwarded-For using the trusted proxy list.
-// It walks the XFF chain right-to-left, skipping IPs that match trusted prefixes.
-// The first untrusted IP is the real client.
-//
-// If the trusted list is empty or remoteAddr is not trusted, it returns the
-// remoteAddr IP directly (ignoring any forwarding headers).
-func ResolveClientIP(remoteAddr, xff string, trusted []netip.Prefix) netip.Addr {
-	remoteIP := extractHostIP(remoteAddr)
-
-	if len(trusted) == 0 || !isTrustedAddr(remoteIP, trusted) {
-		return remoteIP
-	}
-
-	if xff == "" {
-		return remoteIP
-	}
-
-	parts := strings.Split(xff, ",")
-	for i := len(parts) - 1; i >= 0; i-- {
-		ip := strings.TrimSpace(parts[i])
-		if ip == "" {
-			continue
-		}
-		addr, err := netip.ParseAddr(ip)
-		if err != nil {
-			continue
-		}
-		addr = addr.Unmap()
-		if !isTrustedAddr(addr, trusted) {
-			return addr
-		}
-	}
-
-	// All IPs in XFF are trusted; return the leftmost as best guess.
-	if first := strings.TrimSpace(parts[0]); first != "" {
-		if addr, err := netip.ParseAddr(first); err == nil {
-			return addr.Unmap()
-		}
-	}
-	return remoteIP
-}
-
-// extractHostIP parses the IP from a host:port string and returns it unmapped.
-func extractHostIP(hostPort string) netip.Addr {
-	if ap, err := netip.ParseAddrPort(hostPort); err == nil {
-		return ap.Addr().Unmap()
-	}
-	if addr, err := netip.ParseAddr(hostPort); err == nil {
-		return addr.Unmap()
-	}
-	return netip.Addr{}
-}
-
-// isTrustedAddr checks if the given address falls within any of the trusted prefixes.
-func isTrustedAddr(addr netip.Addr, trusted []netip.Prefix) bool {
-	if !addr.IsValid() {
-		return false
-	}
-	for _, prefix := range trusted {
-		if prefix.Contains(addr) {
-			return true
-		}
-	}
-	return false
-}
diff --git a/proxy/internal/proxy/trustedproxy_test.go b/proxy/internal/proxy/trustedproxy_test.go
deleted file mode 100644
index 35ed1f5c2..000000000
--- a/proxy/internal/proxy/trustedproxy_test.go
+++ /dev/null
@@ -1,129 +0,0 @@
-package proxy
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestIsTrustedProxy(t *testing.T) {
-	trusted := []netip.Prefix{
-		netip.MustParsePrefix("10.0.0.0/8"),
-		netip.MustParsePrefix("192.168.1.0/24"),
-		netip.MustParsePrefix("fd00::/8"),
-	}
-
-	tests := []struct {
-		name    string
-		ip      string
-		trusted []netip.Prefix
-		want    bool
-	}{
-		{"empty trusted list", "10.0.0.1", nil, false},
-		{"IP within /8 prefix", "10.1.2.3", trusted, true},
-		{"IP within /24 prefix", "192.168.1.100", trusted, true},
-		{"IP outside all prefixes", "203.0.113.50", trusted, false},
-		{"boundary IP just outside prefix", "192.168.2.1", trusted, false},
-		{"unparsable IP", "not-an-ip", trusted, false},
-		{"IPv6 in trusted range", "fd00::1", trusted, true},
-		{"IPv6 outside range", "2001:db8::1", trusted, false},
-		{"empty string", "", trusted, false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, IsTrustedProxy(tt.ip, tt.trusted))
-		})
-	}
-}
-
-func TestResolveClientIP(t *testing.T) {
-	trusted := []netip.Prefix{
-		netip.MustParsePrefix("10.0.0.0/8"),
-		netip.MustParsePrefix("172.16.0.0/12"),
-	}
-
-	tests := []struct {
-		name       string
-		remoteAddr string
-		xff        string
-		trusted    []netip.Prefix
-		want       netip.Addr
-	}{
-		{
-			name:       "empty trusted list returns RemoteAddr",
-			remoteAddr: "203.0.113.50:9999",
-			xff:        "1.2.3.4",
-			trusted:    nil,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "untrusted RemoteAddr ignores XFF",
-			remoteAddr: "203.0.113.50:9999",
-			xff:        "1.2.3.4, 10.0.0.1",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "trusted RemoteAddr with single client in XFF",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "203.0.113.50",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "trusted RemoteAddr walks past trusted entries in XFF",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "203.0.113.50, 10.0.0.2, 172.16.0.5",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "trusted RemoteAddr with empty XFF falls back to RemoteAddr",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("10.0.0.1"),
-		},
-		{
-			name:       "all XFF IPs trusted returns leftmost",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "10.0.0.2, 172.16.0.1, 10.0.0.3",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("10.0.0.2"),
-		},
-		{
-			name:       "XFF with whitespace",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        " 203.0.113.50 , 10.0.0.2 ",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "XFF with empty segments",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "203.0.113.50,,10.0.0.2",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "multi-hop with mixed trust",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "8.8.8.8, 203.0.113.50, 172.16.0.1",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "RemoteAddr without port",
-			remoteAddr: "10.0.0.1",
-			xff:        "203.0.113.50",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, ResolveClientIP(tt.remoteAddr, tt.xff, tt.trusted))
-		})
-	}
-}
diff --git a/proxy/internal/roundtrip/clone_http2_test.go b/proxy/internal/roundtrip/clone_http2_test.go
new file mode 100644
index 000000000..f2707ff19
--- /dev/null
+++ b/proxy/internal/roundtrip/clone_http2_test.go
@@ -0,0 +1,40 @@
+package roundtrip
+
+import (
+	"net/http"
+	"testing"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// offersHTTP2 reports whether t will negotiate h2 with a TLS upstream.
+// Clone forces t's one-time protocol setup, which registers an "h2"
+// handler in t.TLSNextProto only when HTTP/2 ended up enabled.
+func offersHTTP2(t *http.Transport) bool {
+	_ = t.Clone()
+	_, ok := t.TLSNextProto["h2"]
+	return ok
+}
+
+func TestNewMultiTransportKeepsHTTP2AcrossClone(t *testing.T) {
+	for _, tc := range []struct {
+		version string
+		want    bool
+	}{
+		{string(upstreamHTTPAuto), true},
+		{string(upstreamHTTP2), true},
+		{string(upstreamHTTP11), false},
+	} {
+		t.Run(tc.version, func(t *testing.T) {
+			t.Setenv(EnvUpstreamHTTPVersion, tc.version)
+			m := NewMultiTransport(noEmbeddedRoundTripper{}, log.New())
+
+			if got := offersHTTP2(m.direct.primary); got != tc.want {
+				t.Errorf("direct transport offers h2 = %v, want %v", got, tc.want)
+			}
+			if got := offersHTTP2(m.insecure.primary); got != tc.want {
+				t.Errorf("insecure transport offers h2 = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/proxy/internal/roundtrip/dialguard.go b/proxy/internal/roundtrip/dialguard.go
new file mode 100644
index 000000000..ac01263b4
--- /dev/null
+++ b/proxy/internal/roundtrip/dialguard.go
@@ -0,0 +1,90 @@
+package roundtrip
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+	"syscall"
+)
+
+// ErrDirectUpstreamBlocked is returned when a direct-upstream dial targets
+// an address that is not globally reachable while
+// NB_PROXY_DIRECT_UPSTREAM_BLOCK_PRIVATE is set.
+var ErrDirectUpstreamBlocked = errors.New("direct upstream address is not allowed")
+
+// blockedUpstreamPrefixes are the ranges that reach the proxy host, its
+// cluster or its cloud provider rather than the public internet. NAT64
+// and 6to4 addresses are matched by the IPv4 address they embed.
+var blockedUpstreamPrefixes = []netip.Prefix{
+	// IPv4
+	netip.MustParsePrefix("0.0.0.0/8"),       // "this network", including 0.0.0.0
+	netip.MustParsePrefix("10.0.0.0/8"),      // RFC1918
+	netip.MustParsePrefix("100.64.0.0/10"),   // CGNAT
+	netip.MustParsePrefix("127.0.0.0/8"),     // loopback
+	netip.MustParsePrefix("169.254.0.0/16"),  // link-local, cloud metadata services
+	netip.MustParsePrefix("172.16.0.0/12"),   // RFC1918
+	netip.MustParsePrefix("192.0.0.0/24"),    // IETF protocol assignments
+	netip.MustParsePrefix("192.0.2.0/24"),    // documentation
+	netip.MustParsePrefix("192.88.99.0/24"),  // 6to4 relay anycast (deprecated)
+	netip.MustParsePrefix("192.168.0.0/16"),  // RFC1918
+	netip.MustParsePrefix("198.18.0.0/15"),   // benchmarking
+	netip.MustParsePrefix("198.51.100.0/24"), // documentation
+	netip.MustParsePrefix("203.0.113.0/24"),  // documentation
+	netip.MustParsePrefix("224.0.0.0/4"),     // multicast
+	netip.MustParsePrefix("240.0.0.0/4"),     // reserved, including broadcast
+
+	// IPv6
+	netip.MustParsePrefix("::/96"),          // unspecified, loopback, IPv4-compatible
+	netip.MustParsePrefix("64:ff9b:1::/48"), // local-use NAT64
+	netip.MustParsePrefix("100::/64"),       // discard-only
+	netip.MustParsePrefix("2001::/32"),      // Teredo
+	netip.MustParsePrefix("2001:2::/48"),    // benchmarking
+	netip.MustParsePrefix("2001:db8::/32"),  // documentation
+	netip.MustParsePrefix("3fff::/20"),      // documentation
+	netip.MustParsePrefix("5f00::/16"),      // SRv6 SIDs
+	netip.MustParsePrefix("fc00::/7"),       // unique local, including AWS IMDS fd00:ec2::254
+	netip.MustParsePrefix("fe80::/10"),      // link-local
+	netip.MustParsePrefix("fec0::/10"),      // site-local (deprecated)
+	netip.MustParsePrefix("ff00::/8"),       // multicast
+}
+
+var (
+	nat64Prefix = netip.MustParsePrefix("64:ff9b::/96")
+	sixToFour   = netip.MustParsePrefix("2002::/16")
+)
+
+// isBlockedUpstreamAddr reports whether a guarded direct-upstream dial
+// must refuse addr.
+func isBlockedUpstreamAddr(addr netip.Addr) bool {
+	addr = addr.Unmap().WithZone("")
+	if !addr.IsValid() {
+		return true
+	}
+
+	if nat64Prefix.Contains(addr) {
+		b := addr.As16()
+		return isBlockedUpstreamAddr(netip.AddrFrom4([4]byte(b[12:16])))
+	}
+	if sixToFour.Contains(addr) {
+		b := addr.As16()
+		return isBlockedUpstreamAddr(netip.AddrFrom4([4]byte(b[2:6])))
+	}
+
+	for _, p := range blockedUpstreamPrefixes {
+		if p.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}
+
+// guardUpstreamDial is a net.Dialer ControlContext that refuses blocked
+// addresses. It sees the resolved address of each socket just before
+// connect, so DNS rebinding cannot swap the target after the check.
+func guardUpstreamDial(_ context.Context, _, address string, _ syscall.RawConn) error {
+	ap, err := netip.ParseAddrPort(address)
+	if err != nil || isBlockedUpstreamAddr(ap.Addr()) {
+		return ErrDirectUpstreamBlocked
+	}
+	return nil
+}
diff --git a/proxy/internal/roundtrip/dialguard_test.go b/proxy/internal/roundtrip/dialguard_test.go
new file mode 100644
index 000000000..79453d8c3
--- /dev/null
+++ b/proxy/internal/roundtrip/dialguard_test.go
@@ -0,0 +1,189 @@
+package roundtrip
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"net/url"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsBlockedUpstreamAddr(t *testing.T) {
+	blocked := []string{
+		"0.0.0.0",
+		"0.1.2.3",
+		"10.1.2.3",
+		"100.64.0.1",
+		"100.127.255.254",
+		"127.0.0.1",
+		"127.255.255.255",
+		"169.254.169.254",
+		"172.16.0.1",
+		"172.31.255.255",
+		"192.0.0.170",
+		"192.168.1.1",
+		"192.88.99.1",
+		"198.18.0.1",
+		"224.0.0.1",
+		"255.255.255.255",
+		"::",
+		"::1",
+		"::169.254.169.254",
+		"::ffff:127.0.0.1",
+		"::ffff:169.254.169.254",
+		"::ffff:10.0.0.1",
+		"64:ff9b::a9fe:a9fe", // NAT64 of 169.254.169.254
+		"64:ff9b::a00:1",     // NAT64 of 10.0.0.1
+		"64:ff9b:1::1",
+		"2001::1",
+		"2001:0:4136:e378:8000:63bf:3fff:fdd2",
+		"2001:2::1",
+		"3fff::1",
+		"5f00::1",
+		"2002:a9fe:a9fe::1", // 6to4 of 169.254.169.254
+		"2002:7f00:1::",     // 6to4 of 127.0.0.1
+		"fc00::1",
+		"fd00:ec2::254",
+		"fe80::1",
+		"fe80::1%eth0",
+		"fec0::1",
+		"ff02::1",
+	}
+	for _, s := range blocked {
+		t.Run("blocks "+s, func(t *testing.T) {
+			assert.True(t, isBlockedUpstreamAddr(netip.MustParseAddr(s)))
+		})
+	}
+
+	allowed := []string{
+		"1.1.1.1",
+		"8.8.8.8",
+		"100.63.255.255",
+		"100.128.0.0",
+		"172.15.255.255",
+		"172.32.0.0",
+		"169.253.255.255",
+		"2606:4700:4700::1111",
+		"2001:4860:4860::8888",
+		"2001:1::1",
+		"4000::1",
+		"::ffff:8.8.8.8",
+		"64:ff9b::808:808", // NAT64 of 8.8.8.8
+		"2002:808:808::1",  // 6to4 of 8.8.8.8
+	}
+	for _, s := range allowed {
+		t.Run("allows "+s, func(t *testing.T) {
+			assert.False(t, isBlockedUpstreamAddr(netip.MustParseAddr(s)))
+		})
+	}
+
+	assert.True(t, isBlockedUpstreamAddr(netip.Addr{}), "the zero Addr must be refused")
+}
+
+func TestGuardUpstreamDial_RejectsUnparsableAddress(t *testing.T) {
+	err := guardUpstreamDial(context.Background(), "tcp", "not-an-address", nil)
+	assert.ErrorIs(t, err, ErrDirectUpstreamBlocked, "an address the guard cannot parse must fail closed")
+}
+
+// TestMultiTransport_BlockPrivateUpstreams exercises the guard end to end
+// against a loopback test server: by IP literal and by a hostname that
+// resolves to loopback, on both direct branches, and confirms the
+// embedded branch is not affected.
+func TestMultiTransport_BlockPrivateUpstreams(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, "reached")
+	}))
+	defer srv.Close()
+
+	_, port, err := net.SplitHostPort(srv.Listener.Addr().String())
+	require.NoError(t, err)
+	byName := (&url.URL{Scheme: "http", Host: net.JoinHostPort("localhost", port)}).String()
+
+	directCtx := WithDirectUpstream(context.Background())
+	insecureCtx := WithSkipTLSVerify(directCtx)
+
+	// roundTrip returns the response body, so callers never hold one open.
+	roundTrip := func(t *testing.T, mt *MultiTransport, ctx context.Context, target string) (string, error) {
+		t.Helper()
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, target, nil)
+		require.NoError(t, err)
+		resp, err := mt.RoundTrip(req)
+		if err != nil {
+			return "", err
+		}
+		defer func() { _ = resp.Body.Close() }()
+		body, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+		return string(body), nil
+	}
+
+	t.Run("enabled refuses loopback", func(t *testing.T) {
+		t.Setenv(EnvDirectUpstreamBlockPrivate, "true")
+		mt := NewMultiTransport(&stubRoundTripper{body: "embedded"}, nil)
+
+		cases := []struct {
+			name   string
+			ctx    context.Context
+			target string
+		}{
+			{"direct by IP", directCtx, srv.URL},
+			{"direct by hostname", directCtx, byName},
+			{"insecure by IP", insecureCtx, srv.URL},
+			{"insecure by hostname", insecureCtx, byName},
+		}
+		for _, tc := range cases {
+			t.Run(tc.name, func(t *testing.T) {
+				_, err := roundTrip(t, mt, tc.ctx, tc.target)
+				require.Error(t, err)
+				assert.ErrorIs(t, err, ErrDirectUpstreamBlocked)
+			})
+		}
+	})
+
+	t.Run("invalid value enables the guard", func(t *testing.T) {
+		t.Setenv(EnvDirectUpstreamBlockPrivate, "yes please")
+		mt := NewMultiTransport(&stubRoundTripper{body: "embedded"}, nil)
+
+		_, err := roundTrip(t, mt, directCtx, srv.URL)
+		assert.ErrorIs(t, err, ErrDirectUpstreamBlocked, "a value that does not parse must fail closed")
+	})
+
+	t.Run("explicit false disables the guard", func(t *testing.T) {
+		t.Setenv(EnvDirectUpstreamBlockPrivate, "false")
+		mt := NewMultiTransport(&stubRoundTripper{body: "embedded"}, nil)
+
+		body, err := roundTrip(t, mt, directCtx, srv.URL)
+		require.NoError(t, err)
+		assert.Equal(t, "reached", body)
+	})
+
+	t.Run("enabled leaves embedded branch alone", func(t *testing.T) {
+		t.Setenv(EnvDirectUpstreamBlockPrivate, "true")
+		embedded := &stubRoundTripper{body: "embedded"}
+		mt := NewMultiTransport(embedded, nil)
+
+		body, err := roundTrip(t, mt, context.Background(), srv.URL)
+		require.NoError(t, err)
+		assert.Equal(t, "embedded", body)
+		assert.True(t, embedded.called, "the guard must not change dispatch to the embedded transport")
+	})
+
+	t.Run("disabled by default", func(t *testing.T) {
+		// Register the restore first so an exported value comes back after
+		// the test, then exercise a genuinely absent variable.
+		t.Setenv(EnvDirectUpstreamBlockPrivate, "")
+		require.NoError(t, os.Unsetenv(EnvDirectUpstreamBlockPrivate))
+		mt := NewMultiTransport(&stubRoundTripper{body: "embedded"}, nil)
+
+		body, err := roundTrip(t, mt, directCtx, srv.URL)
+		require.NoError(t, err, "private and self-hosted proxies must keep reaching local upstreams")
+		assert.Equal(t, "reached", body)
+	})
+}
diff --git a/proxy/internal/roundtrip/multi.go b/proxy/internal/roundtrip/multi.go
index 567249437..a430d45bd 100644
--- a/proxy/internal/roundtrip/multi.go
+++ b/proxy/internal/roundtrip/multi.go
@@ -26,8 +26,8 @@ import (
 // branch at all), construct the MultiTransport via NewDirectOnly.
 type MultiTransport struct {
 	embedded http.RoundTripper
-	direct   *http.Transport
-	insecure *http.Transport
+	direct   *upstreamTransport
+	insecure *upstreamTransport
 }
 
 // errNoEmbeddedTransport is returned when a request reaches the
@@ -41,7 +41,9 @@ var errNoEmbeddedTransport = errors.New("multitransport: embedded roundtripper n
 // MultiTransport that only ever uses the direct branch. The direct
 // branches honour the same NB_PROXY_* tuning env vars as the embedded
 // transport (see loadTransportConfig) plus a dial-timeout wrapper that
-// respects types.WithDialTimeout.
+// respects types.WithDialTimeout. With NB_PROXY_DIRECT_UPSTREAM_BLOCK_PRIVATE
+// set, the direct branches refuse addresses that are not globally reachable
+// (see guardUpstreamDial).
 func NewMultiTransport(embedded http.RoundTripper, logger *log.Logger) *MultiTransport {
 	if logger == nil {
 		logger = log.StandardLogger()
@@ -51,9 +53,11 @@ func NewMultiTransport(embedded http.RoundTripper, logger *log.Logger) *MultiTra
 		Timeout:   30 * time.Second,
 		KeepAlive: 30 * time.Second,
 	}
+	if cfg.blockPrivateUpstreams {
+		dialer.ControlContext = guardUpstreamDial
+	}
 	direct := &http.Transport{
 		DialContext:           dialWithTimeout(dialer.DialContext),
-		ForceAttemptHTTP2:     true,
 		MaxIdleConns:          cfg.maxIdleConns,
 		MaxIdleConnsPerHost:   cfg.maxIdleConnsPerHost,
 		MaxConnsPerHost:       cfg.maxConnsPerHost,
@@ -65,13 +69,16 @@ func NewMultiTransport(embedded http.RoundTripper, logger *log.Logger) *MultiTra
 		ReadBufferSize:        cfg.readBufferSize,
 		DisableCompression:    cfg.disableCompression,
 	}
+	// Clone runs the transport's one-time protocol setup, so the HTTP
+	// version must be applied first or the source loses HTTP/2 for good.
+	applyUpstreamHTTPVersion(direct, cfg.upstreamHTTPVersion)
 	insecure := direct.Clone()
 	insecure.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec // matches the embedded NetBird transport's per-target opt-in
 
 	return &MultiTransport{
 		embedded: embedded,
-		direct:   direct,
-		insecure: insecure,
+		direct:   newUpstreamTransport(direct, cfg.upstreamHTTPVersion, logger),
+		insecure: newUpstreamTransport(insecure, cfg.upstreamHTTPVersion, logger),
 	}
 }
 
diff --git a/proxy/internal/roundtrip/multi_test.go b/proxy/internal/roundtrip/multi_test.go
index 5c6cf1c97..7b8b50e81 100644
--- a/proxy/internal/roundtrip/multi_test.go
+++ b/proxy/internal/roundtrip/multi_test.go
@@ -5,6 +5,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"strings"
 	"testing"
 	"time"
@@ -75,16 +76,71 @@ func TestMultiTransport_AppliesEnvOverridesToDirect(t *testing.T) {
 
 	mt := NewMultiTransport(&stubRoundTripper{body: "embedded"}, nil)
 
-	assert.Equal(t, 42, mt.direct.MaxIdleConns,
+	assert.Equal(t, 42, mt.direct.primary.MaxIdleConns,
 		"NB_PROXY_MAX_IDLE_CONNS must propagate to the direct transport")
-	assert.Equal(t, 11*time.Second, mt.direct.IdleConnTimeout,
+	assert.Equal(t, 11*time.Second, mt.direct.primary.IdleConnTimeout,
 		"NB_PROXY_IDLE_CONN_TIMEOUT must propagate to the direct transport")
-	assert.Equal(t, 7*time.Second, mt.direct.TLSHandshakeTimeout,
+	assert.Equal(t, 7*time.Second, mt.direct.primary.TLSHandshakeTimeout,
 		"NB_PROXY_TLS_HANDSHAKE_TIMEOUT must propagate to the direct transport")
-	assert.Equal(t, 42, mt.insecure.MaxIdleConns,
+	assert.Equal(t, 42, mt.insecure.primary.MaxIdleConns,
 		"env tuning must also apply to the insecure-skip-verify direct transport")
 }
 
+// TestMultiTransport_UpstreamHTTPVersion pins the protocol actually
+// negotiated with an HTTPS upstream that offers both h2 and http/1.1.
+// The request rides the insecure clone, so this also covers the version
+// surviving http.Transport.Clone.
+func TestMultiTransport_UpstreamHTTPVersion(t *testing.T) {
+	tests := []struct {
+		name      string
+		env       string
+		wantProto string
+	}{
+		{name: "unset negotiates h2", env: "", wantProto: "HTTP/2.0"},
+		{name: "auto negotiates h2", env: "auto", wantProto: "HTTP/2.0"},
+		{name: "1.1 pins http/1.1", env: "1.1", wantProto: "HTTP/1.1"},
+		{name: "2 negotiates h2", env: "2", wantProto: "HTTP/2.0"},
+		{name: "unsupported value keeps the default", env: "http3", wantProto: "HTTP/2.0"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// t.Setenv registers the restore for whatever the process
+			// inherited; unsetting afterwards lets the default row
+			// exercise a genuinely absent variable.
+			t.Setenv(EnvUpstreamHTTPVersion, tc.env)
+			if tc.env == "" {
+				require.NoError(t, os.Unsetenv(EnvUpstreamHTTPVersion))
+			}
+
+			// The test server's certificate isn't in any root pool, so the
+			// request rides the insecure branch via WithSkipTLSVerify.
+			srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				_, _ = io.WriteString(w, r.Proto)
+			}))
+			srv.EnableHTTP2 = true
+			srv.StartTLS()
+			defer srv.Close()
+
+			mt := NewDirectOnly(nil)
+			ctx := WithSkipTLSVerify(WithDirectUpstream(context.Background()))
+			req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL, nil)
+			require.NoError(t, err)
+
+			resp, err := mt.RoundTrip(req)
+			require.NoError(t, err)
+			body, err := io.ReadAll(resp.Body)
+			_ = resp.Body.Close()
+			require.NoError(t, err)
+
+			assert.Equal(t, tc.wantProto, resp.Proto,
+				"client-side protocol must follow %s=%q", EnvUpstreamHTTPVersion, tc.env)
+			assert.Equal(t, tc.wantProto, string(body),
+				"the upstream must see the same protocol the client negotiated")
+		})
+	}
+}
+
 // TestMultiTransport_NilEmbeddedErrorsWhenWGPathRequested guards
 // against the previous silent fallback: a MultiTransport constructed
 // without an embedded transport must reject requests that don't
diff --git a/proxy/internal/roundtrip/netbird.go b/proxy/internal/roundtrip/netbird.go
index cb2e7f930..21feb59b7 100644
--- a/proxy/internal/roundtrip/netbird.go
+++ b/proxy/internal/roundtrip/netbird.go
@@ -30,6 +30,12 @@ import (
 
 const deviceNamePrefix = "ingress-proxy-"
 
+// envProxyRosenpass toggles Rosenpass (permissive) on the embedded proxy client. Defaults to on.
+const envProxyRosenpass = "NB_PROXY_ROSENPASS" //nolint:gosec // env var name, not a credential
+
+// envProxyClientLogLevel sets the embedded NetBird client's log level.
+const envProxyClientLogLevel = "NB_PROXY_CLIENT_LOG_LEVEL"
+
 const clientStopTimeout = 30 * time.Second
 
 const createProxyPeerTimeout = 30 * time.Second
@@ -76,10 +82,10 @@ type serviceNotification struct {
 // clientEntry holds an embedded NetBird client and tracks which services use it.
 type clientEntry struct {
 	client    *embed.Client
-	transport *http.Transport
+	transport *upstreamTransport
 	// insecureTransport is a clone of transport with TLS verification disabled,
 	// used when per-target skip_tls_verify is set.
-	insecureTransport *http.Transport
+	insecureTransport *upstreamTransport
 	services          map[ServiceKey]serviceInfo
 	createdAt         time.Time
 	started           bool
@@ -138,6 +144,8 @@ type ClientConfig struct {
 	WGPort       uint16
 	PreSharedKey string
 	Performance  embed.Performance
+	// NATExternalIPs mirrors embed.Options.NATExternalIPs.
+	NATExternalIPs []string
 	// BlockInbound mirrors embed.Options.BlockInbound. Set to true on the
 	// standalone proxy where the embedded client never accepts inbound;
 	// set to false on the private/embedded proxy so the engine creates
@@ -353,11 +361,11 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 	// NB_PROXY_CLIENT_LOG_LEVEL (e.g. "trace") to surface the embedded NetBird
 	// client's relay / signal / handshake detail for local debugging.
 	clientLogLevel := log.WarnLevel.String()
-	if v := strings.TrimSpace(os.Getenv("NB_PROXY_CLIENT_LOG_LEVEL")); v != "" {
+	if v := strings.TrimSpace(os.Getenv(envProxyClientLogLevel)); v != "" {
 		if lvl, err := log.ParseLevel(v); err == nil {
 			clientLogLevel = lvl.String()
 		} else {
-			n.logger.Warnf("invalid NB_PROXY_CLIENT_LOG_LEVEL %q, using %q: %v", v, clientLogLevel, err)
+			n.logger.Warnf("invalid %s %q, using %q: %v", envProxyClientLogLevel, v, clientLogLevel, err)
 		}
 	}
 
@@ -367,15 +375,26 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 		}
 	})
 
+	// Rosenpass runs in permissive mode by default so the embedded proxy can
+	// establish connections with Rosenpass-enabled peers (which otherwise fail
+	// on a PSK mismatch) while still falling back to plain WireGuard for peers
+	// that do not run Rosenpass. Set NB_PROXY_ROSENPASS=false to disable it.
+	rosenpassEnabled := true
+	if v, ok := envBool(envProxyRosenpass, n.logger); ok {
+		rosenpassEnabled = v
+	}
+
 	// Create embedded NetBird client with the generated private key.
 	// The peer has already been created via CreateProxyPeer RPC with the public key.
 	wgPort := int(n.clientCfg.WGPort)
 	embedOpts := embed.Options{
-		DeviceName:    deviceNamePrefix + n.proxyID,
-		ManagementURL: n.clientCfg.MgmtAddr,
-		PrivateKey:    privateKey.String(),
-		LogLevel:      clientLogLevel,
-		BlockInbound:  n.clientCfg.BlockInbound,
+		DeviceName:          deviceNamePrefix + n.proxyID,
+		ManagementURL:       n.clientCfg.MgmtAddr,
+		PrivateKey:          privateKey.String(),
+		LogLevel:            clientLogLevel,
+		BlockInbound:        n.clientCfg.BlockInbound,
+		EnableRosenpass:     rosenpassEnabled,
+		RosenpassPermissive: rosenpassEnabled,
 		// The embedded proxy peer must never be a stepping stone into
 		// the proxy host's LAN: it only exists to reach NetBird mesh
 		// targets or, when direct_upstream is set, the host network
@@ -385,6 +404,7 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 		WireguardPort:  &wgPort,
 		PreSharedKey:   n.clientCfg.PreSharedKey,
 		Performance:    n.clientCfg.Performance,
+		NATExternalIPs: n.clientCfg.NATExternalIPs,
 	}
 	logEmbedOptions(n.logger, accountID, serviceID, publicKey.String(), embedOpts)
 	client, err := embed.New(embedOpts)
@@ -397,7 +417,6 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 	// not work with reverse proxied requests.
 	transport := &http.Transport{
 		DialContext:           dialWithTimeout(client.DialContext),
-		ForceAttemptHTTP2:     true,
 		MaxIdleConns:          n.transportCfg.maxIdleConns,
 		MaxIdleConnsPerHost:   n.transportCfg.maxIdleConnsPerHost,
 		MaxConnsPerHost:       n.transportCfg.maxConnsPerHost,
@@ -409,15 +428,17 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 		ReadBufferSize:        n.transportCfg.readBufferSize,
 		DisableCompression:    n.transportCfg.disableCompression,
 	}
-
+	// Clone runs the transport's one-time protocol setup, so the HTTP
+	// version must be applied first or the source loses HTTP/2 for good.
+	applyUpstreamHTTPVersion(transport, n.transportCfg.upstreamHTTPVersion)
 	insecureTransport := transport.Clone()
 	insecureTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec
 
 	return &clientEntry{
 		client:            client,
 		services:          map[ServiceKey]serviceInfo{key: si},
-		transport:         transport,
-		insecureTransport: insecureTransport,
+		transport:         newUpstreamTransport(transport, n.transportCfg.upstreamHTTPVersion, n.logger),
+		insecureTransport: newUpstreamTransport(insecureTransport, n.transportCfg.upstreamHTTPVersion, n.logger),
 		createdAt:         time.Now(),
 		started:           false,
 		inflightMap:       make(map[backendKey]chan struct{}),
@@ -896,9 +917,12 @@ func logEmbedOptions(logger *log.Logger, accountID types.AccountID, serviceID ty
 		"management_url":        opts.ManagementURL,
 		"log_level":             opts.LogLevel,
 		"wg_port":               wgPort,
+		"nat_external_ips":      opts.NATExternalIPs,
 		"mtu":                   mtu,
 		"block_inbound":         opts.BlockInbound,
 		"block_lan_access":      opts.BlockLANAccess,
+		"rosenpass_enabled":     opts.EnableRosenpass,
+		"rosenpass_permissive":  opts.RosenpassPermissive,
 		"disable_ipv6":          opts.DisableIPv6,
 		"disable_client_routes": opts.DisableClientRoutes,
 		"no_userspace":          opts.NoUserspace,
diff --git a/proxy/internal/roundtrip/transport.go b/proxy/internal/roundtrip/transport.go
index 7c450bbb7..6383079c4 100644
--- a/proxy/internal/roundtrip/transport.go
+++ b/proxy/internal/roundtrip/transport.go
@@ -1,8 +1,11 @@
 package roundtrip
 
 import (
+	"crypto/tls"
+	"net/http"
 	"os"
 	"strconv"
+	"strings"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -21,6 +24,36 @@ const (
 	EnvReadBufferSize        = "NB_PROXY_READ_BUFFER_SIZE"
 	EnvDisableCompression    = "NB_PROXY_DISABLE_COMPRESSION"
 	EnvMaxInflight           = "NB_PROXY_MAX_INFLIGHT"
+	EnvUpstreamHTTPVersion   = "NB_PROXY_UPSTREAM_HTTP_VERSION"
+	// EnvDirectUpstreamBlockPrivate refuses direct-upstream dials to
+	// addresses that are not globally reachable (loopback, private,
+	// link-local, CGNAT, ...). Off by default: private and self-hosted
+	// proxies use direct_upstream to reach LAN and localhost services.
+	// Proxies that serve untrusted accounts must turn it on.
+	EnvDirectUpstreamBlockPrivate = "NB_PROXY_DIRECT_UPSTREAM_BLOCK_PRIVATE"
+)
+
+// upstreamHTTPVersion selects the HTTP version the proxy uses towards an
+// upstream. The explicit values are absolute: they mean the same thing
+// however the transports are dialled and whatever the default becomes,
+// so operator configuration survives a change of default.
+type upstreamHTTPVersion string
+
+const (
+	// upstreamHTTPAuto leaves the choice to the upstream: h2 is offered
+	// alongside http/1.1 in the TLS handshake and the upstream picks.
+	// An upstream that picks h2 and then fails to serve it is moved to
+	// HTTP/1.1 on its own (see upstreamTransport), which is the part
+	// ALPN cannot express. This is the only value whose meaning tracks
+	// the proxy's default.
+	upstreamHTTPAuto upstreamHTTPVersion = "auto"
+	// upstreamHTTP11 never offers h2, so the upstream sees HTTP/1.1.
+	upstreamHTTP11 upstreamHTTPVersion = "1.1"
+	// upstreamHTTP2 offers h2 in the TLS handshake and keeps it there:
+	// an upstream that negotiates h2 and then breaks is never moved to
+	// HTTP/1.1. Cleartext upstreams stay on HTTP/1.1 regardless: the
+	// proxy speaks no h2c.
+	upstreamHTTP2 upstreamHTTPVersion = "2"
 )
 
 // transportConfig holds tunable parameters for the per-account HTTP transport.
@@ -37,6 +70,14 @@ type transportConfig struct {
 	disableCompression    bool
 	// maxInflight limits per-backend concurrent requests. 0 means unlimited.
 	maxInflight int
+	// upstreamHTTPVersion selects the HTTP version used towards HTTPS
+	// upstreams. The default negotiates it with each upstream; the
+	// explicit values are for backends whose advertised h2 support is
+	// unusable and whose failure mode the negotiation cannot see.
+	upstreamHTTPVersion upstreamHTTPVersion
+	// blockPrivateUpstreams guards the direct branches' dialer with
+	// guardUpstreamDial. It has no effect on the embedded branch.
+	blockPrivateUpstreams bool
 }
 
 func defaultTransportConfig() transportConfig {
@@ -47,6 +88,7 @@ func defaultTransportConfig() transportConfig {
 		idleConnTimeout:       90 * time.Second,
 		tlsHandshakeTimeout:   10 * time.Second,
 		expectContinueTimeout: 1 * time.Second,
+		upstreamHTTPVersion:   upstreamHTTPAuto,
 	}
 }
 
@@ -86,6 +128,10 @@ func loadTransportConfig(logger *log.Logger) transportConfig {
 	if v, ok := envInt(EnvMaxInflight, logger); ok {
 		cfg.maxInflight = v
 	}
+	if v, ok := envUpstreamHTTPVersion(EnvUpstreamHTTPVersion, logger); ok {
+		cfg.upstreamHTTPVersion = v
+	}
+	cfg.blockPrivateUpstreams = envGuardBool(EnvDirectUpstreamBlockPrivate, logger)
 
 	logger.WithFields(log.Fields{
 		"max_idle_conns":          cfg.maxIdleConns,
@@ -99,11 +145,84 @@ func loadTransportConfig(logger *log.Logger) transportConfig {
 		"read_buffer_size":        cfg.readBufferSize,
 		"disable_compression":     cfg.disableCompression,
 		"max_inflight":            cfg.maxInflight,
+		"upstream_http_version":   cfg.upstreamHTTPVersion,
+		"block_private_upstreams": cfg.blockPrivateUpstreams,
 	}).Debug("backend transport configuration")
 
 	return cfg
 }
 
+// applyUpstreamHTTPVersion configures t's ALPN offer for the requested
+// HTTP version. It is the single place that decides which protocols a
+// transport offers, so changing the proxy's default only touches this
+// function and leaves every explicit operator setting intact. What
+// happens when a negotiated h2 upstream then fails belongs to
+// upstreamTransport, which owns the runtime half of "auto".
+//
+// HTTP/1.1 is pinned by clearing ForceAttemptHTTP2 and installing an
+// empty TLSNextProto, which disables h2 regardless of how the transport
+// is dialled. Relying on net/http's conservative default (h2 off
+// whenever a custom dialer is set) would silently start negotiating h2
+// again the day a transport switches to DialTLSContext.
+func applyUpstreamHTTPVersion(t *http.Transport, version upstreamHTTPVersion) {
+	if version == upstreamHTTP11 {
+		t.ForceAttemptHTTP2 = false
+		t.TLSNextProto = map[string]func(string, *tls.Conn) http.RoundTripper{}
+		t.TLSClientConfig = withoutHTTP2ALPN(t.TLSClientConfig)
+		return
+	}
+	t.ForceAttemptHTTP2 = true
+}
+
+// withoutHTTP2ALPN drops h2 from the ALPN offer. Configuring h2 makes
+// net/http append h2 to the transport's TLSClientConfig, so a transport
+// cloned from one that already served a request carries that offer with
+// it. Left in place, the upstream would select a protocol this
+// transport then refuses to speak, and the response would come back as
+// h2 frames parsed as an HTTP/1.1 message.
+func withoutHTTP2ALPN(cfg *tls.Config) *tls.Config {
+	// A nil config offers no ALPN at all, which is already HTTP/1.1.
+	if cfg == nil || len(cfg.NextProtos) == 0 {
+		return cfg
+	}
+
+	protos := make([]string, 0, len(cfg.NextProtos))
+	for _, proto := range cfg.NextProtos {
+		if proto == "h2" {
+			continue
+		}
+		protos = append(protos, proto)
+	}
+	if len(protos) == len(cfg.NextProtos) {
+		return cfg
+	}
+
+	// Clone rather than edit in place: the caller may share this config
+	// with the transport it was cloned from.
+	stripped := cfg.Clone()
+	stripped.NextProtos = protos
+
+	return stripped
+}
+
+// envUpstreamHTTPVersion reads an upstream HTTP version from the
+// environment. An unrecognised value warns and leaves the default in
+// place rather than guessing at the operator's intent.
+func envUpstreamHTTPVersion(key string, logger *log.Logger) (upstreamHTTPVersion, bool) {
+	s := strings.TrimSpace(os.Getenv(key))
+	if s == "" {
+		return "", false
+	}
+	switch v := upstreamHTTPVersion(strings.ToLower(s)); v {
+	case upstreamHTTPAuto, upstreamHTTP11, upstreamHTTP2:
+		return v, true
+	default:
+		logger.Warnf("ignoring unsupported %s=%q, expected one of %q, %q, %q",
+			key, s, upstreamHTTPAuto, upstreamHTTP11, upstreamHTTP2)
+		return "", false
+	}
+}
+
 func envInt(key string, logger *log.Logger) (int, bool) {
 	s := os.Getenv(key)
 	if s == "" {
@@ -138,6 +257,22 @@ func envDuration(key string, logger *log.Logger) (time.Duration, bool) {
 	return v, true
 }
 
+// envGuardBool reads a bool that turns a security guard on. Unset means
+// off, but a value that does not parse turns the guard on: a typo must not
+// leave a proxy that was meant to be guarded without the guard.
+func envGuardBool(key string, logger *log.Logger) bool {
+	s := os.Getenv(key)
+	if s == "" {
+		return false
+	}
+	v, err := strconv.ParseBool(s)
+	if err != nil {
+		logger.Warnf("failed to parse %s=%q as bool, enabling it: %v", key, s, err)
+		return true
+	}
+	return v
+}
+
 func envBool(key string, logger *log.Logger) (bool, bool) {
 	s := os.Getenv(key)
 	if s == "" {
diff --git a/proxy/internal/roundtrip/upstream.go b/proxy/internal/roundtrip/upstream.go
new file mode 100644
index 000000000..6602c836e
--- /dev/null
+++ b/proxy/internal/roundtrip/upstream.go
@@ -0,0 +1,455 @@
+package roundtrip
+
+import (
+	"errors"
+	"net"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// upstreamDowngradeTTL is how long an upstream stays pinned to HTTP/1.1
+// after an h2 failure that only implied it cannot serve h2. Bounded so a
+// fixed or replaced backend returns to h2 without restarting the proxy.
+// A pin the upstream asked for itself does not expire — see downgrade.
+const upstreamDowngradeTTL = 10 * time.Minute
+
+// downgrade is an upstream's HTTP/1.1 pin.
+type downgrade struct {
+	// expiry is when the pin lapses and the upstream is offered h2
+	// again. The zero time means it never does: the upstream answered
+	// HTTP_1_1_REQUIRED, which is a statement about how it is
+	// configured, not a fault that may clear on its own. Re-probing
+	// that every upstreamDowngradeTTL would buy nothing but a failed
+	// request per interval, so the pin holds until the transport goes
+	// away with the proxy or the account's client.
+	expiry time.Time
+}
+
+// permanent reports whether the upstream asked for this pin itself.
+func (d downgrade) permanent() bool {
+	return d.expiry.IsZero()
+}
+
+// active reports whether the pin still stands at now.
+func (d downgrade) active(now time.Time) bool {
+	return d.permanent() || now.Before(d.expiry)
+}
+
+// upstreamTransport carries requests to a single upstream family (one
+// TLS configuration) and implements what upstreamHTTPAuto means.
+//
+// ALPN already lets the upstream pick the protocol: primary offers both
+// h2 and http/1.1 and the server chooses. What ALPN cannot express is
+// an upstream that selects h2 and then fails to speak it — the case
+// this type handles. The first h2-level failure for a host pins that
+// host to fallback, an HTTP/1.1-only clone of primary, and the request
+// is retried there when it can be replayed.
+//
+// The downgrade is per upstream host, not per transport: one broken
+// backend must not drop every other backend to HTTP/1.1.
+type upstreamTransport struct {
+	// primary is the configured transport: h2 offered in ALPN for
+	// upstreamHTTPAuto and upstreamHTTP2, HTTP/1.1-only for
+	// upstreamHTTP11.
+	primary *http.Transport
+	// version decides whether a downgrade may happen at all. Only
+	// upstreamHTTPAuto downgrades; the explicit values are absolute.
+	version upstreamHTTPVersion
+	logger  *log.Logger
+
+	// fallbackMu guards the lazy fallback clone: most deployments never
+	// hit a broken h2 upstream and should not pay for a second
+	// connection pool.
+	fallbackMu sync.Mutex
+	fallback   *http.Transport
+
+	mu sync.RWMutex
+	// downgraded maps an upstream host to its HTTP/1.1 pin.
+	downgraded map[string]downgrade
+}
+
+// newUpstreamTransport wraps base for the requested HTTP version. base
+// must not be used directly afterwards: the wrapper owns it, including
+// its connection pool.
+func newUpstreamTransport(base *http.Transport, version upstreamHTTPVersion, logger *log.Logger) *upstreamTransport {
+	if logger == nil {
+		logger = log.StandardLogger()
+	}
+	applyUpstreamHTTPVersion(base, version)
+
+	return &upstreamTransport{
+		primary:    base,
+		version:    version,
+		logger:     logger,
+		downgraded: make(map[string]downgrade),
+	}
+}
+
+// RoundTrip implements http.RoundTripper.
+func (t *upstreamTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if !t.mayDowngrade(req) {
+		return t.primary.RoundTrip(req)
+	}
+
+	host := upstreamKey(req.URL)
+	if t.isDowngraded(host) {
+		return t.http1().RoundTrip(req)
+	}
+
+	resp, err := t.primary.RoundTrip(req)
+	if err == nil || !isHTTP2ProtocolError(err) {
+		return resp, err
+	}
+
+	// HTTP_1_1_REQUIRED is the upstream saying it will not serve this
+	// request over h2 however often it is asked — IIS answers it for
+	// Windows Authentication and for client-certificate sites, where
+	// the cause is site configuration rather than a passing fault.
+	t.markDowngraded(host, isHTTP11Required(err))
+
+	if !safeToRetry(req, err) {
+		// The upstream may have carried out the request before failing
+		// to answer over h2, and repeating it could duplicate whatever
+		// it did. The host is pinned either way, so the next request
+		// goes out over HTTP/1.1.
+		t.logger.WithFields(log.Fields{
+			"upstream": host,
+			"method":   req.Method,
+		}).Debug("not retrying over HTTP/1.1: the upstream may already have applied this request")
+		return nil, err
+	}
+
+	retry, ok := replayable(req)
+	if !ok {
+		// The body is already consumed and cannot be regenerated, so
+		// this request fails, and the pin carries the next one.
+		return nil, err
+	}
+	return t.http1().RoundTrip(retry)
+}
+
+// CloseIdleConnections closes idle connections on both pools.
+func (t *upstreamTransport) CloseIdleConnections() {
+	t.primary.CloseIdleConnections()
+	if fallback := t.existingHTTP1(); fallback != nil {
+		fallback.CloseIdleConnections()
+	}
+}
+
+// mayDowngrade reports whether a failed request is a downgrade
+// candidate. Only upstreamHTTPAuto downgrades, and only for TLS
+// upstreams: the proxy speaks no h2c, so a cleartext upstream is
+// already on HTTP/1.1 and an error there says nothing about h2.
+func (t *upstreamTransport) mayDowngrade(req *http.Request) bool {
+	return t.version == upstreamHTTPAuto && req.URL != nil && req.URL.Scheme == "https"
+}
+
+func (t *upstreamTransport) isDowngraded(host string) bool {
+	t.mu.RLock()
+	pin, ok := t.downgraded[host]
+	t.mu.RUnlock()
+
+	if !ok {
+		return false
+	}
+	if pin.active(time.Now()) {
+		return true
+	}
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	// Re-read under the write lock rather than trusting the expired pin
+	// from above: a concurrent request may have re-pinned the host since,
+	// and that pin decides this request too. Reporting the stale read
+	// would send one request back to h2 against a live pin.
+	pin, ok = t.downgraded[host]
+	if !ok {
+		return false
+	}
+	if pin.active(time.Now()) {
+		return true
+	}
+	delete(t.downgraded, host)
+
+	return false
+}
+
+// markDowngraded pins host to HTTP/1.1. permanent marks a pin the
+// upstream asked for; anything else lapses after upstreamDowngradeTTL so
+// a repaired backend is offered h2 again.
+func (t *upstreamTransport) markDowngraded(host string, permanent bool) {
+	now := time.Now()
+	pin := downgrade{expiry: now.Add(upstreamDowngradeTTL)}
+	if permanent {
+		pin = downgrade{}
+	}
+
+	t.mu.Lock()
+	previous, pinned := t.downgraded[host]
+	// A permanent pin is never weakened back into an expiring one: the
+	// upstream has already said h2 is not on offer.
+	promoted := pinned && !previous.permanent() && permanent
+	if !pinned || !previous.permanent() {
+		t.downgraded[host] = pin
+	}
+	for h, existing := range t.downgraded {
+		if !existing.active(now) {
+			delete(t.downgraded, h)
+		}
+	}
+	t.mu.Unlock()
+
+	// Log a new pin, and a pin the upstream has since asked to make
+	// permanent — otherwise an operator would only ever see the "for the
+	// next 10m" line and never learn the upstream settled the question.
+	if pinned && !promoted {
+		return
+	}
+
+	entry := t.logger.WithField("upstream", host)
+	if permanent {
+		entry.Warnf("upstream answered HTTP_1_1_REQUIRED, using HTTP/1.1 for it from now on")
+		return
+	}
+	entry.Warnf("upstream negotiated HTTP/2 but failed to serve it, using HTTP/1.1 for the next %s (set %s=1.1 to pin it)",
+		upstreamDowngradeTTL, EnvUpstreamHTTPVersion)
+}
+
+// http1 returns the HTTP/1.1-only clone, creating it on first use.
+func (t *upstreamTransport) http1() *http.Transport {
+	t.fallbackMu.Lock()
+	defer t.fallbackMu.Unlock()
+
+	if t.fallback == nil {
+		fallback := t.primary.Clone()
+		applyUpstreamHTTPVersion(fallback, upstreamHTTP11)
+		t.fallback = fallback
+	}
+
+	return t.fallback
+}
+
+// existingHTTP1 returns the fallback transport only if it was already
+// created, so housekeeping never allocates a second connection pool for
+// an upstream that never needed one.
+func (t *upstreamTransport) existingHTTP1() *http.Transport {
+	t.fallbackMu.Lock()
+	defer t.fallbackMu.Unlock()
+
+	return t.fallback
+}
+
+// upstreamKey normalizes an authority for use as a pin key, so one
+// upstream cannot end up with two independent pins. DNS labels compare
+// case-insensitively, and the default HTTPS port is implied — every
+// downgrade path is TLS-only, so a bare host and the same host on :443
+// are the same upstream.
+func upstreamKey(u *url.URL) string {
+	host := normalizeUpstreamHost(u.Hostname())
+
+	port := u.Port()
+	if port == "" || port == "443" {
+		return host
+	}
+
+	// JoinHostPort rather than concatenation: an IPv6 literal needs its
+	// brackets back after Hostname stripped them.
+	return net.JoinHostPort(host, port)
+}
+
+// normalizeUpstreamHost folds the spellings of one host onto a single
+// key. An IP literal goes through netip so that the several textual
+// forms of one address (case, leading zeroes, a compressed run) collapse
+// and a v4-mapped address keys as the v4 address it is. A zone
+// identifier is left exactly as written: it names an interface, and
+// interface names are case-sensitive on the systems that have them, so
+// %eth0 and %ETH0 may be different links and must not share a pin.
+// Anything that is not an IP literal is a DNS name, which compares
+// case-insensitively.
+func normalizeUpstreamHost(host string) string {
+	if addr, err := netip.ParseAddr(host); err == nil {
+		return addr.Unmap().String()
+	}
+
+	return strings.ToLower(host)
+}
+
+// safeToRetry reports whether req may be sent a second time over
+// HTTP/1.1 after err ended its h2 attempt.
+//
+// A failure at the h2 layer does not say whether the upstream already
+// carried out the request, so replaying one that changes state could
+// duplicate it. Two cases are safe: a request whose repetition is
+// harmless by definition, and an upstream that told us it processed
+// nothing on the connection. The second is what makes the IIS case work
+// for every method — a site requiring HTTP/1.1 refuses at stream 0,
+// before the request is looked at.
+func safeToRetry(req *http.Request, err error) bool {
+	return idempotent(req) || upstreamProcessedNothing(err)
+}
+
+// idempotent reports whether repeating req is defined to be harmless.
+// It mirrors net/http's own retry rule (Request.isReplayable): a method
+// with no side effects, or a caller that promised the upstream
+// deduplicates by key.
+func idempotent(req *http.Request) bool {
+	if req.Header.Get("Idempotency-Key") != "" || req.Header.Get("X-Idempotency-Key") != "" {
+		return true
+	}
+
+	switch req.Method {
+	// An empty method means GET, as in net/http.
+	case "", http.MethodGet, http.MethodHead, http.MethodOptions, http.MethodTrace:
+		return true
+	}
+
+	return false
+}
+
+// upstreamProcessedNothing reports whether err describes a GOAWAY that
+// named this request's stream as one the upstream had not received, so
+// it cannot have acted on it. A stream error says the opposite: the
+// stream was open, so the request had been delivered.
+func upstreamProcessedNothing(err error) bool {
+	if err == nil {
+		return false
+	}
+
+	msg := transportError(err).Error()
+
+	return strings.Contains(msg, goAwayStreamNotReceivedMarker) ||
+		strings.Contains(msg, goAwayNothingProcessedMarker)
+}
+
+// replayable returns a request that can be sent a second time, or
+// ok=false when the body is gone. A RoundTripper consumes and closes
+// the body it was given, so a retry needs either no body at all or
+// GetBody to produce a fresh one.
+func replayable(req *http.Request) (*http.Request, bool) {
+	if req.Body == nil || req.Body == http.NoBody {
+		return req, true
+	}
+	if req.GetBody == nil {
+		return nil, false
+	}
+
+	body, err := req.GetBody()
+	if err != nil {
+		return nil, false
+	}
+
+	retry := req.Clone(req.Context())
+	retry.Body = body
+
+	return retry, true
+}
+
+// http2ErrorMarkers are the substrings that identify an HTTP/2 protocol
+// failure. net/http bundles its own private copy of the http2 package,
+// so its errors cannot be matched by type from here: http2.StreamError
+// and friends in x/net are different types from the ones a
+// bundled-h2 transport returns. The strings below are the formats those
+// bundled errors print, and they are specific to h2 framing — a
+// downgrade must never be triggered by an ordinary network or TLS
+// error, which retrying on HTTP/1.1 would not fix.
+var http2ErrorMarkers = []string{
+	// Transport-level h2 failures, e.g.
+	// "http2: server sent GOAWAY and closed the connection".
+	"http2:",
+	// http2.StreamError, e.g. "stream error: stream ID 1; PROTOCOL_ERROR".
+	"stream error: stream ID",
+	// http2.ConnectionError, e.g. "connection error: PROTOCOL_ERROR".
+	"connection error: ",
+	// The code an upstream sends to say the request must be retried
+	// over HTTP/1.1, as a GOAWAY or on the stream.
+	http11RequiredMarker,
+}
+
+const (
+	// http11RequiredMarker is the error code an upstream sends to say the
+	// request belongs on HTTP/1.1. Unlike the other markers it is not a
+	// fault: the upstream is describing its own configuration.
+	http11RequiredMarker = "HTTP_1_1_REQUIRED"
+
+	// A GOAWAY carrying NO_ERROR closes a connection without complaint:
+	// a server draining before shutdown, recycling an application pool,
+	// capping requests per connection. The upstream speaks h2 perfectly
+	// well, so this must never pin it. The two spellings are the two
+	// formats the bundled transport prints the code in.
+	goAwayNoErrorEqualsMarker = "ErrCode=NO_ERROR"
+	goAwayNoErrorColonMarker  = "ErrCode:NO_ERROR"
+	// gracefulGoAwayMarker is errClientConnGotGoAway, which the bundled
+	// transport raises for a stream the server never received on a
+	// connection it is shutting down gracefully. It normally retries
+	// those itself on a new connection and this never surfaces.
+	gracefulGoAwayMarker = "Transport received Server's graceful shutdown GOAWAY"
+
+	// goAwayStreamNotReceivedMarker is the bundled transport's abort for
+	// the first stream on a connection whose GOAWAY carried a real error
+	// code — the IIS case. It sits in the same "streamID > LastStreamID"
+	// branch as the graceful abort, so the server had not received the
+	// stream (see net/http's h2_bundle.go).
+	goAwayStreamNotReceivedMarker = "Transport received GOAWAY from server ErrCode:"
+	// goAwayNothingProcessedMarker is a GoAwayError naming stream 0 as
+	// the last one received, which says the same thing. The trailing
+	// comma keeps it from matching LastStreamID=10 and the rest.
+	goAwayNothingProcessedMarker = "LastStreamID=0,"
+)
+
+// isHTTP11Required reports whether the upstream itself asked for
+// HTTP/1.1, rather than merely failing at h2.
+func isHTTP11Required(err error) bool {
+	return err != nil && strings.Contains(transportError(err).Error(), http11RequiredMarker)
+}
+
+// isHTTP2ProtocolError reports whether err says the upstream cannot
+// serve the h2 it negotiated.
+func isHTTP2ProtocolError(err error) bool {
+	if err == nil {
+		return false
+	}
+
+	msg := transportError(err).Error()
+
+	// A graceful GOAWAY is routine connection management, not an
+	// upstream that cannot serve h2.
+	if isGracefulGoAway(msg) {
+		return false
+	}
+
+	for _, marker := range http2ErrorMarkers {
+		if strings.Contains(msg, marker) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// isGracefulGoAway reports whether msg describes a GOAWAY sent to close
+// a healthy connection rather than to report an inability to serve h2.
+func isGracefulGoAway(msg string) bool {
+	return strings.Contains(msg, goAwayNoErrorEqualsMarker) ||
+		strings.Contains(msg, goAwayNoErrorColonMarker) ||
+		strings.Contains(msg, gracefulGoAwayMarker)
+}
+
+// transportError strips a *url.Error wrapper, which prefixes the request
+// URL to the message. Markers are matched as substrings, so a URL left
+// in place could classify an ordinary dial or TLS failure as an h2 one
+// on the strength of the path alone.
+func transportError(err error) error {
+	var urlErr *url.Error
+	if errors.As(err, &urlErr) && urlErr.Err != nil {
+		return urlErr.Err
+	}
+
+	return err
+}
diff --git a/proxy/internal/roundtrip/upstream_test.go b/proxy/internal/roundtrip/upstream_test.go
new file mode 100644
index 000000000..a83570ef3
--- /dev/null
+++ b/proxy/internal/roundtrip/upstream_test.go
@@ -0,0 +1,587 @@
+package roundtrip
+
+import (
+	"bufio"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"errors"
+	"fmt"
+	"io"
+	"math/big"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/http2"
+)
+
+// TestUpstreamTransport_AutoFallsBackOnBrokenHTTP2 covers the case ALPN
+// cannot express: the upstream advertises h2, picks it, and then cannot
+// serve it. The request must still succeed, over HTTP/1.1, and the
+// upstream must stay on HTTP/1.1 for the requests that follow.
+func TestUpstreamTransport_AutoFallsBackOnBrokenHTTP2(t *testing.T) {
+	t.Setenv(EnvUpstreamHTTPVersion, string(upstreamHTTPAuto))
+	srv := startBrokenHTTP2Server(t)
+
+	mt := NewDirectOnly(nil)
+	ctx := WithSkipTLSVerify(WithDirectUpstream(context.Background()))
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://"+srv.addr, nil)
+	require.NoError(t, err)
+
+	resp, err := mt.RoundTrip(req)
+	require.NoError(t, err, "a replayable request must be retried on HTTP/1.1 instead of failing")
+	body, err := io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+	require.NoError(t, err)
+	assert.Equal(t, "HTTP/1.1", resp.Proto, "the retry must ride the HTTP/1.1 transport")
+	assert.Equal(t, "http/1.1", string(body), "the upstream must see an http/1.1 ALPN offer on the retry")
+
+	assert.True(t, mt.insecure.isDowngraded(srv.addr),
+		"the upstream must stay pinned to HTTP/1.1 after proving it cannot serve h2")
+	mt.insecure.mu.RLock()
+	pin := mt.insecure.downgraded[srv.addr]
+	mt.insecure.mu.RUnlock()
+	assert.True(t, pin.permanent(),
+		"an upstream answering HTTP_1_1_REQUIRED must not be re-probed for h2")
+
+	// The second request must not repeat the h2 attempt: the server
+	// counts h2 handshakes, so a repeat would show up here.
+	h2Attempts := srv.http2Handshakes()
+	req, err = http.NewRequestWithContext(ctx, http.MethodGet, "https://"+srv.addr, nil)
+	require.NoError(t, err)
+	resp, err = mt.RoundTrip(req)
+	require.NoError(t, err)
+	_ = resp.Body.Close()
+
+	assert.Equal(t, "HTTP/1.1", resp.Proto, "a pinned upstream must go straight to HTTP/1.1")
+	assert.Equal(t, h2Attempts, srv.http2Handshakes(),
+		"a pinned upstream must not be probed for h2 again until the pin expires")
+}
+
+// TestUpstreamTransport_ExplicitHTTP2NeverDowngrades pins the promise
+// that the explicit values are absolute: an operator who asked for h2
+// keeps h2, broken upstream or not.
+func TestUpstreamTransport_ExplicitHTTP2NeverDowngrades(t *testing.T) {
+	t.Setenv(EnvUpstreamHTTPVersion, string(upstreamHTTP2))
+	srv := startBrokenHTTP2Server(t)
+
+	mt := NewDirectOnly(nil)
+	ctx := WithSkipTLSVerify(WithDirectUpstream(context.Background()))
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://"+srv.addr, nil)
+	require.NoError(t, err)
+
+	resp, err := mt.RoundTrip(req)
+	if err == nil {
+		_ = resp.Body.Close()
+	}
+	require.Error(t, err, "NB_PROXY_UPSTREAM_HTTP_VERSION=2 must not fall back to HTTP/1.1")
+	assert.False(t, mt.insecure.isDowngraded(srv.addr), "an explicit version must never pin an upstream")
+}
+
+// TestUpstreamTransport_AutoDoesNotReplayUnsafeRequests covers the
+// other half of the fallback: an h2 failure says nothing about whether
+// the upstream already applied the request, so a state-changing one is
+// not replayed. The host is still pinned, so the next request rides
+// HTTP/1.1 without a second h2 attempt.
+func TestUpstreamTransport_AutoDoesNotReplayUnsafeRequests(t *testing.T) {
+	t.Setenv(EnvUpstreamHTTPVersion, string(upstreamHTTPAuto))
+	srv := startBrokenHTTP2Server(t)
+	// A stream error means the stream was open, so the upstream had the
+	// request in hand — unlike the GOAWAY at stream 0 the fake server
+	// sends, which states it processed nothing.
+	streamErr := http2.StreamError{StreamID: 1, Code: http2.ErrCodeProtocol}
+
+	mt := NewDirectOnly(nil)
+	transport := mt.insecure
+	ctx := WithSkipTLSVerify(WithDirectUpstream(context.Background()))
+
+	assert.False(t, safeToRetry(newTestRequest(t, ctx, http.MethodPost, srv.addr), streamErr),
+		"a POST must not be replayed after a failure that may have been applied")
+	assert.True(t, safeToRetry(newTestRequest(t, ctx, http.MethodGet, srv.addr), streamErr),
+		"a GET is safe to replay whatever the failure was")
+
+	// The fake server's GOAWAY names stream 0, so even a POST is safe
+	// there and the request must succeed over HTTP/1.1.
+	resp, err := transport.RoundTrip(newTestRequest(t, ctx, http.MethodPost, srv.addr))
+	require.NoError(t, err, "a GOAWAY at stream 0 means the upstream applied nothing, so the POST may be replayed")
+	body, err := io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+	require.NoError(t, err)
+	assert.Equal(t, "http/1.1", string(body), "the retry must reach the upstream over http/1.1")
+
+	h2Attempts := srv.http2Handshakes()
+	resp, err = transport.RoundTrip(newTestRequest(t, ctx, http.MethodPost, srv.addr))
+	require.NoError(t, err)
+	_ = resp.Body.Close()
+	assert.Equal(t, h2Attempts, srv.http2Handshakes(),
+		"the pin must carry later requests without another h2 attempt")
+}
+
+func newTestRequest(t *testing.T, ctx context.Context, method, addr string) *http.Request {
+	t.Helper()
+
+	req, err := http.NewRequestWithContext(ctx, method, "https://"+addr, strings.NewReader("payload"))
+	require.NoError(t, err)
+
+	return req
+}
+
+func TestUpstreamKey(t *testing.T) {
+	tests := []struct {
+		name string
+		url  string
+		want string
+	}{
+		{name: "host", url: "https://backend.invalid/path", want: "backend.invalid"},
+		// DNS is case-insensitive, so these are one upstream and must
+		// share one pin.
+		{name: "mixed case", url: "https://Backend.INVALID/path", want: "backend.invalid"},
+		// The default port is implied on every path that can downgrade.
+		{name: "explicit default port", url: "https://backend.invalid:443/", want: "backend.invalid"},
+		{name: "non-default port", url: "https://backend.invalid:8443/", want: "backend.invalid:8443"},
+		// An IPv6 literal needs its brackets back after Hostname strips
+		// them, or the key is not a dialable authority.
+		{name: "ipv6 default port", url: "https://[2001:db8::1]/", want: "2001:db8::1"},
+		{name: "ipv6 with port", url: "https://[2001:db8::1]:8443/", want: "[2001:db8::1]:8443"},
+		// One address in three spellings: hex case, a leading zero and an
+		// uncompressed zero run are all the same upstream.
+		{name: "ipv6 upper case", url: "https://[2001:DB8::1]/", want: "2001:db8::1"},
+		{name: "ipv6 leading zero", url: "https://[2001:0db8::1]/", want: "2001:db8::1"},
+		{name: "ipv6 uncompressed", url: "https://[2001:db8:0:0:0:0:0:1]/", want: "2001:db8::1"},
+		// A v4-mapped address is the v4 address, not a second upstream.
+		{name: "v4-mapped", url: "https://[::ffff:192.0.2.1]/", want: "192.0.2.1"},
+		// A zone names an interface, and interface names are
+		// case-sensitive, so these two are different links.
+		{name: "ipv6 zone", url: "https://[fe80::1%25eth0]/", want: "fe80::1%eth0"},
+		{name: "ipv6 zone upper case", url: "https://[fe80::1%25ETH0]/", want: "fe80::1%ETH0"},
+		// The address before the zone still normalizes.
+		{name: "ipv6 zone with upper-case address", url: "https://[FE80::1%25eth0]/", want: "fe80::1%eth0"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			parsed, err := url.Parse(tc.url)
+			require.NoError(t, err)
+
+			assert.Equal(t, tc.want, upstreamKey(parsed))
+		})
+	}
+}
+
+func TestSafeToRetry(t *testing.T) {
+	streamErr := http2.StreamError{StreamID: 1, Code: http2.ErrCodeProtocol}
+	goAwayAtZero := errors.New(`http2: server sent GOAWAY and closed the connection; LastStreamID=0, ErrCode=HTTP_1_1_REQUIRED, debug=""`)
+	goAwayLater := errors.New(`http2: server sent GOAWAY and closed the connection; LastStreamID=11, ErrCode=PROTOCOL_ERROR, debug=""`)
+
+	tests := []struct {
+		name    string
+		method  string
+		headers map[string]string
+		err     error
+		want    bool
+	}{
+		{name: "get", method: http.MethodGet, err: streamErr, want: true},
+		{name: "head", method: http.MethodHead, err: streamErr, want: true},
+		{name: "options", method: http.MethodOptions, err: streamErr, want: true},
+		{name: "trace", method: http.MethodTrace, err: streamErr, want: true},
+		{name: "post", method: http.MethodPost, err: streamErr, want: false},
+		{name: "put", method: http.MethodPut, err: streamErr, want: false},
+		{name: "patch", method: http.MethodPatch, err: streamErr, want: false},
+		{name: "delete", method: http.MethodDelete, err: streamErr, want: false},
+		// The upstream reported it handled nothing, so repeating the
+		// request cannot duplicate anything.
+		{name: "post with goaway at stream 0", method: http.MethodPost, err: goAwayAtZero, want: true},
+		// What the bundled transport actually raises for the first
+		// stream on a connection the upstream GOAWAYs with a real error
+		// code, which is the shape a real IIS site produces.
+		{
+			name:   "post with first-stream goaway abort",
+			method: http.MethodPost,
+			err:    errors.New("http2: Transport received GOAWAY from server ErrCode:HTTP_1_1_REQUIRED"),
+			want:   true,
+		},
+		// It handled earlier streams, so this one may have been applied.
+		{name: "post with goaway after other streams", method: http.MethodPost, err: goAwayLater, want: false},
+		{
+			name:    "post with idempotency key",
+			method:  http.MethodPost,
+			headers: map[string]string{"Idempotency-Key": "abc"},
+			err:     streamErr,
+			want:    true,
+		},
+		{
+			name:    "post with prefixed idempotency key",
+			method:  http.MethodPost,
+			headers: map[string]string{"X-Idempotency-Key": "abc"},
+			err:     streamErr,
+			want:    true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			req, err := http.NewRequest(tc.method, "https://backend.invalid", nil)
+			require.NoError(t, err)
+			for k, v := range tc.headers {
+				req.Header.Set(k, v)
+			}
+
+			assert.Equal(t, tc.want, safeToRetry(req, tc.err))
+		})
+	}
+}
+
+func TestUpstreamTransport_MayDowngrade(t *testing.T) {
+	tests := []struct {
+		name    string
+		version upstreamHTTPVersion
+		url     string
+		want    bool
+	}{
+		{name: "auto over TLS", version: upstreamHTTPAuto, url: "https://backend.invalid", want: true},
+		// The proxy speaks no h2c, so a cleartext upstream is already on
+		// HTTP/1.1 and its failures say nothing about h2.
+		{name: "auto cleartext", version: upstreamHTTPAuto, url: "http://backend.invalid", want: false},
+		{name: "explicit 1.1", version: upstreamHTTP11, url: "https://backend.invalid", want: false},
+		{name: "explicit 2", version: upstreamHTTP2, url: "https://backend.invalid", want: false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			transport := newUpstreamTransport(&http.Transport{}, tc.version, nil)
+			req, err := http.NewRequest(http.MethodGet, tc.url, nil)
+			require.NoError(t, err)
+
+			assert.Equal(t, tc.want, transport.mayDowngrade(req))
+		})
+	}
+}
+
+func TestUpstreamTransport_DowngradeExpires(t *testing.T) {
+	transport := newUpstreamTransport(&http.Transport{}, upstreamHTTPAuto, nil)
+	transport.markDowngraded("backend.invalid:443", false)
+	require.True(t, transport.isDowngraded("backend.invalid:443"))
+
+	transport.mu.Lock()
+	transport.downgraded["backend.invalid:443"] = downgrade{expiry: time.Now().Add(-time.Second)}
+	transport.mu.Unlock()
+
+	assert.False(t, transport.isDowngraded("backend.invalid:443"),
+		"an expired pin must let the upstream be offered h2 again")
+	transport.mu.RLock()
+	_, stillTracked := transport.downgraded["backend.invalid:443"]
+	transport.mu.RUnlock()
+	assert.False(t, stillTracked, "an expired pin must not be kept around")
+}
+
+func TestUpstreamTransport_DowngradeIsPerUpstream(t *testing.T) {
+	transport := newUpstreamTransport(&http.Transport{}, upstreamHTTPAuto, nil)
+	transport.markDowngraded("broken.invalid:443", false)
+
+	assert.True(t, transport.isDowngraded("broken.invalid:443"))
+	assert.False(t, transport.isDowngraded("healthy.invalid:443"),
+		"one broken upstream must not drop the others to HTTP/1.1")
+}
+
+// TestUpstreamTransport_HTTP11RequiredPinIsPermanent covers the IIS
+// case: HTTP_1_1_REQUIRED describes how the upstream is configured
+// (Windows Authentication, client certificates), so re-probing it every
+// upstreamDowngradeTTL would only buy a failed request per interval.
+func TestUpstreamTransport_HTTP11RequiredPinIsPermanent(t *testing.T) {
+	transport := newUpstreamTransport(&http.Transport{}, upstreamHTTPAuto, nil)
+	transport.markDowngraded("iis.invalid:443", true)
+
+	transport.mu.RLock()
+	pin := transport.downgraded["iis.invalid:443"]
+	transport.mu.RUnlock()
+
+	assert.True(t, pin.permanent(), "an upstream that asked for HTTP/1.1 must not be re-probed")
+	assert.True(t, pin.active(time.Now().Add(100*upstreamDowngradeTTL)),
+		"a permanent pin must outlive any TTL")
+}
+
+func TestUpstreamTransport_PermanentPinSurvivesLaterFailures(t *testing.T) {
+	transport := newUpstreamTransport(&http.Transport{}, upstreamHTTPAuto, nil)
+	transport.markDowngraded("iis.invalid:443", true)
+	// A later ambiguous failure for the same upstream must not turn the
+	// permanent pin into an expiring one.
+	transport.markDowngraded("iis.invalid:443", false)
+
+	transport.mu.RLock()
+	pin := transport.downgraded["iis.invalid:443"]
+	transport.mu.RUnlock()
+
+	assert.True(t, pin.permanent(), "a permanent pin must never be weakened")
+}
+
+func TestIsHTTP11Required(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "goaway",
+			err:  errors.New(`http2: server sent GOAWAY and closed the connection; LastStreamID=0, ErrCode=HTTP_1_1_REQUIRED, debug=""`),
+			want: true,
+		},
+		{
+			name: "stream error",
+			err:  http2.StreamError{StreamID: 1, Code: http2.ErrCodeHTTP11Required},
+			want: true,
+		},
+		{
+			name: "other h2 failure",
+			err:  http2.StreamError{StreamID: 1, Code: http2.ErrCodeProtocol},
+			want: false,
+		},
+		{name: "nil", err: nil, want: false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, isHTTP11Required(tc.err))
+		})
+	}
+}
+
+func TestIsHTTP2ProtocolError(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "goaway demanding http/1.1",
+			err:  errors.New(`http2: server sent GOAWAY and closed the connection; LastStreamID=0, ErrCode=HTTP_1_1_REQUIRED, debug=""`),
+			want: true,
+		},
+		{
+			name: "stream error",
+			err:  http2.StreamError{StreamID: 1, Code: http2.ErrCodeProtocol},
+			want: true,
+		},
+		{
+			name: "connection error",
+			err:  http2.ConnectionError(http2.ErrCodeProtocol),
+			want: true,
+		},
+		{
+			name: "wrapped h2 error",
+			err:  errors.New("Get \"https://backend.invalid\": http2: client connection lost"),
+			want: true,
+		},
+		// A GOAWAY with NO_ERROR is a server draining a connection —
+		// recycling an application pool, capping requests per
+		// connection, shutting down gracefully. It speaks h2 fine.
+		{
+			name: "graceful goaway",
+			err:  errors.New(`http2: server sent GOAWAY and closed the connection; LastStreamID=9, ErrCode=NO_ERROR, debug=""`),
+			want: false,
+		},
+		{
+			name: "graceful shutdown abort",
+			err:  errors.New("http2: Transport received Server's graceful shutdown GOAWAY"),
+			want: false,
+		},
+		// Markers are substrings, so a URL carried by a *url.Error must
+		// not be able to classify a plain failure as an h2 one.
+		{
+			name: "url error whose path looks like a marker",
+			err: &url.Error{
+				Op:  "Get",
+				URL: "https://backend.invalid/http2:/connection error: x",
+				Err: errors.New("dial tcp 10.0.0.1:443: connect: connection refused"),
+			},
+			want: false,
+		},
+		// Retrying these on HTTP/1.1 fixes nothing, so they must never
+		// pin an upstream.
+		{name: "dial failure", err: errors.New("dial tcp 10.0.0.1:443: connect: connection refused"), want: false},
+		{name: "tls failure", err: errors.New("tls: failed to verify certificate: x509: certificate signed by unknown authority"), want: false},
+		{name: "context cancelled", err: context.Canceled, want: false},
+		{name: "eof", err: io.EOF, want: false},
+		{name: "nil", err: nil, want: false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, isHTTP2ProtocolError(tc.err))
+		})
+	}
+}
+
+func TestReplayable(t *testing.T) {
+	t.Run("bodyless request", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "https://backend.invalid", nil)
+		require.NoError(t, err)
+
+		retry, ok := replayable(req)
+		require.True(t, ok)
+		assert.Same(t, req, retry, "a bodyless request needs no clone")
+	})
+
+	t.Run("request with GetBody", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodPost, "https://backend.invalid", strings.NewReader("payload"))
+		require.NoError(t, err)
+		// Consume the body the way a failed RoundTrip would.
+		_, err = io.ReadAll(req.Body)
+		require.NoError(t, err)
+
+		retry, ok := replayable(req)
+		require.True(t, ok)
+		body, err := io.ReadAll(retry.Body)
+		require.NoError(t, err)
+		assert.Equal(t, "payload", string(body), "the retry must carry a fresh copy of the body")
+	})
+
+	t.Run("streamed request", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodPost, "https://backend.invalid", io.NopCloser(strings.NewReader("payload")))
+		require.NoError(t, err)
+		require.Nil(t, req.GetBody, "an opaque reader must not get a GetBody")
+
+		_, ok := replayable(req)
+		assert.False(t, ok, "a body that cannot be regenerated must not be replayed")
+	})
+}
+
+// brokenHTTP2Server advertises h2 in ALPN, accepts it, and then refuses
+// to serve it — the upstream behaviour that motivated the fallback. Over
+// http/1.1 it answers normally, so a downgraded request succeeds.
+type brokenHTTP2Server struct {
+	addr string
+
+	handshakes chan struct{}
+}
+
+func (s *brokenHTTP2Server) http2Handshakes() int {
+	return len(s.handshakes)
+}
+
+func startBrokenHTTP2Server(t *testing.T) *brokenHTTP2Server {
+	t.Helper()
+
+	ln, err := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{
+		Certificates: []tls.Certificate{selfSignedCert(t)},
+		NextProtos:   []string{"h2", "http/1.1"},
+		MinVersion:   tls.VersionTLS12,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+
+	srv := &brokenHTTP2Server{
+		addr: ln.Addr().String(),
+		// Buffered well past what the test drives so a stuck server
+		// never blocks the accept loop.
+		handshakes: make(chan struct{}, 64),
+	}
+
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			go srv.handle(conn)
+		}
+	}()
+
+	return srv
+}
+
+func (s *brokenHTTP2Server) handle(conn net.Conn) {
+	defer func() { _ = conn.Close() }()
+
+	tlsConn, ok := conn.(*tls.Conn)
+	if !ok {
+		return
+	}
+	if err := tlsConn.Handshake(); err != nil {
+		return
+	}
+
+	proto := tlsConn.ConnectionState().NegotiatedProtocol
+	if proto == "h2" {
+		select {
+		case s.handshakes <- struct{}{}:
+		default:
+		}
+		s.refuseHTTP2(tlsConn)
+		return
+	}
+
+	s.serveHTTP1(tlsConn, proto)
+}
+
+// refuseHTTP2 completes just enough of the h2 handshake for the client
+// to accept the connection, then sends the GOAWAY an upstream uses to
+// say the request belongs on HTTP/1.1.
+//
+// The client is still writing its preface and request while the GOAWAY
+// goes out, so the connection is drained before the caller closes it.
+// Closing a socket with unread bytes still in its receive buffer makes
+// the kernel answer with RST, which reaches the client as a write error
+// rather than the GOAWAY — no h2 error, so no downgrade, and the test
+// fails on the error the client saw first.
+func (s *brokenHTTP2Server) refuseHTTP2(conn net.Conn) {
+	framer := http2.NewFramer(conn, conn)
+	if err := framer.WriteSettings(); err != nil {
+		return
+	}
+	if err := framer.WriteGoAway(0, http2.ErrCodeHTTP11Required, nil); err != nil {
+		return
+	}
+
+	// The client closes its side once it has read the GOAWAY, which ends
+	// the drain; the deadline is only a backstop against a client that
+	// never does.
+	_ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	_, _ = io.Copy(io.Discard, conn)
+}
+
+// serveHTTP1 answers a single request with the ALPN protocol the
+// upstream actually settled on, so a test asserting on the body is
+// checking what the upstream saw rather than a constant.
+func (s *brokenHTTP2Server) serveHTTP1(conn net.Conn, alpn string) {
+	reader := bufio.NewReader(conn)
+	if _, err := http.ReadRequest(reader); err != nil {
+		return
+	}
+
+	_, _ = fmt.Fprintf(conn,
+		"HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: %d\r\nConnection: close\r\n\r\n%s",
+		len(alpn), alpn)
+}
+
+func selfSignedCert(t *testing.T) tls.Certificate {
+	t.Helper()
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	template := x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "127.0.0.1"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+		IsCA:         true,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
+	require.NoError(t, err)
+
+	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
+}
diff --git a/proxy/lifecycle.go b/proxy/lifecycle.go
index 0d4aded9c..206c296ac 100644
--- a/proxy/lifecycle.go
+++ b/proxy/lifecycle.go
@@ -2,13 +2,13 @@ package proxy
 
 import (
 	"context"
-	"net/netip"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy/internal/acme"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 // Config bundles every knob the proxy reads at construction time. It mirrors
@@ -83,12 +83,15 @@ type Config struct {
 	// ForwardedProto overrides the X-Forwarded-Proto value sent to
 	// backends. Valid values: "auto", "http", "https".
 	ForwardedProto string
-	// TrustedProxies is a list of IP prefixes for trusted upstream
-	// proxies that may set forwarding headers.
-	TrustedProxies []netip.Prefix
+	// TrustedProxies is the set of trusted upstream proxies that may set
+	// forwarding headers.
+	TrustedProxies *trustedproxy.List
 	// WireguardPort is the UDP port for the embedded NetBird tunnel.
 	// Zero asks the OS for a random port.
 	WireguardPort uint16
+	// NATExternalIPs are external IPs advertised as ICE candidates by the
+	// embedded tunnel. Requires a fixed WireguardPort forwarded on the NAT.
+	NATExternalIPs []string
 	// ProxyProtocol enables PROXY protocol (v1/v2) on TCP listeners.
 	ProxyProtocol bool
 	// PreSharedKey is the WireGuard pre-shared key used between the
@@ -160,6 +163,7 @@ func New(ctx context.Context, cfg Config) *Server {
 		ForwardedProto:           cfg.ForwardedProto,
 		TrustedProxies:           cfg.TrustedProxies,
 		WireguardPort:            cfg.WireguardPort,
+		NATExternalIPs:           cfg.NATExternalIPs,
 		ProxyProtocol:            cfg.ProxyProtocol,
 		PreSharedKey:             cfg.PreSharedKey,
 		Performance:              cfg.Performance,
diff --git a/proxy/management_byop_integration_test.go b/proxy/management_byop_integration_test.go
index d075e47ec..42301254d 100644
--- a/proxy/management_byop_integration_test.go
+++ b/proxy/management_byop_integration_test.go
@@ -104,7 +104,7 @@ func setupBYOPIntegrationTest(t *testing.T) *byopTestSetup {
 	require.NoError(t, err)
 
 	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, cacheStore)
 
 	meter := noop.NewMeterProvider().Meter("test")
 	realProxyManager, err := proxymanager.NewManager(testStore, meter)
@@ -121,7 +121,7 @@ func setupBYOPIntegrationTest(t *testing.T) *byopTestSetup {
 	proxyService := nbgrpc.NewProxyServiceServer(
 		&testAccessLogManager{},
 		tokenStore,
-		pkceStore,
+		singleUseStore,
 		oidcConfig,
 		nil,
 		usersManager,
diff --git a/proxy/management_integration_test.go b/proxy/management_integration_test.go
index cb82813b0..03a9855de 100644
--- a/proxy/management_integration_test.go
+++ b/proxy/management_integration_test.go
@@ -119,7 +119,7 @@ func setupIntegrationTest(t *testing.T) *integrationTestSetup {
 	require.NoError(t, err)
 
 	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, cacheStore)
 
 	// Create real users manager
 	usersManager := users.NewManager(testStore)
@@ -131,12 +131,12 @@ func setupIntegrationTest(t *testing.T) *integrationTestSetup {
 		HMACKey:  []byte("test-hmac-key"),
 	}
 
-	proxyManager := &testProxyManager{}
+	proxyManager := &testProxyManager{supportsSessionCode: true}
 
 	proxyService := nbgrpc.NewProxyServiceServer(
 		&testAccessLogManager{},
 		tokenStore,
-		pkceStore,
+		singleUseStore,
 		oidcConfig,
 		nil,
 		usersManager,
@@ -202,9 +202,11 @@ func (m *testAccessLogManager) GetAllAccessLogs(_ context.Context, _, _ string,
 }
 
 // testProxyManager is a mock implementation of proxy.Manager for testing.
-type testProxyManager struct{}
+type testProxyManager struct {
+	supportsSessionCode bool
+}
 
-func (m *testProxyManager) Connect(_ context.Context, proxyID, sessionID, _, _ string, _ *string, _ *nbproxy.Capabilities) (*nbproxy.Proxy, error) {
+func (m *testProxyManager) Connect(_ context.Context, proxyID, sessionID, _, _, _ string, _ *string, _ *nbproxy.Capabilities) (*nbproxy.Proxy, error) {
 	return &nbproxy.Proxy{ID: proxyID, SessionID: sessionID, Status: nbproxy.StatusConnected}, nil
 }
 
@@ -244,6 +246,14 @@ func (m *testProxyManager) ClusterSupportsPrivate(_ context.Context, _ string) *
 	return nil
 }
 
+func (m *testProxyManager) ClusterAllProxiesPrivate(_ context.Context, _ string) *bool {
+	return nil
+}
+
+func (m *testProxyManager) ClusterSupportsSessionCode(_ context.Context, _ string) bool {
+	return m.supportsSessionCode
+}
+
 func (m *testProxyManager) CleanupStale(_ context.Context, _ time.Duration) error {
 	return nil
 }
@@ -571,6 +581,7 @@ func TestIntegration_ProxyConnection_ReconnectDoesNotDuplicateState(t *testing.T
 					proxytypes.ServiceID(mapping.GetId()),
 					nil,
 					mapping.GetPrivate(),
+					mapping.GetAuth().GetAllowedGroupIds(),
 				)
 				require.NoError(t, err)
 
diff --git a/proxy/proxyprotocol_test.go b/proxy/proxyprotocol_test.go
index fe2fe7e2d..9e19314ed 100644
--- a/proxy/proxyprotocol_test.go
+++ b/proxy/proxyprotocol_test.go
@@ -10,12 +10,14 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 func TestWrapProxyProtocol_OverridesRemoteAddr(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("127.0.0.1/32")},
+		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("127.0.0.1/32")}),
 		ProxyProtocol:  true,
 	}
 
@@ -66,7 +68,7 @@ func TestWrapProxyProtocol_OverridesRemoteAddr(t *testing.T) {
 func TestProxyProtocolPolicy_TrustedRequires(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}),
 	}
 
 	opts := proxyproto.ConnPolicyOptions{
@@ -80,7 +82,7 @@ func TestProxyProtocolPolicy_TrustedRequires(t *testing.T) {
 func TestProxyProtocolPolicy_UntrustedIgnores(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}),
 	}
 
 	opts := proxyproto.ConnPolicyOptions{
@@ -94,7 +96,7 @@ func TestProxyProtocolPolicy_UntrustedIgnores(t *testing.T) {
 func TestProxyProtocolPolicy_InvalidIPRejects(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}),
 	}
 
 	opts := proxyproto.ConnPolicyOptions{
diff --git a/proxy/server.go b/proxy/server.go
index f28d580bd..3bba38644 100644
--- a/proxy/server.go
+++ b/proxy/server.go
@@ -20,6 +20,7 @@ import (
 	"net/url"
 	"path/filepath"
 	"reflect"
+	"slices"
 	"sync"
 	"time"
 
@@ -67,6 +68,7 @@ import (
 	"github.com/netbirdio/netbird/proxy/web"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/trustedproxy"
 	"github.com/netbirdio/netbird/util/embeddedroots"
 )
 
@@ -79,19 +81,19 @@ type portRouter struct {
 
 type Server struct {
 	ctx               context.Context
-	mgmtClient    proto.ProxyServiceClient
-	proxy         *proxy.ReverseProxy
-	netbird       *roundtrip.NetBird
-	acme          *acme.Manager
+	mgmtClient        proto.ProxyServiceClient
+	proxy             *proxy.ReverseProxy
+	netbird           *roundtrip.NetBird
+	acme              *acme.Manager
 	staticCertWatcher *certwatch.Watcher
-	auth          *auth.Middleware
-	http          *http.Server
-	https         *http.Server
-	debug         *http.Server
-	healthServer  *health.Server
-	healthChecker *health.Checker
-	meter         *proxymetrics.Metrics
-	accessLog     *accesslog.Logger
+	auth              *auth.Middleware
+	http              *http.Server
+	https             *http.Server
+	debug             *http.Server
+	healthServer      *health.Server
+	healthChecker     *health.Checker
+	meter             *proxymetrics.Metrics
+	accessLog         *accesslog.Logger
 	// middlewareManager drives per-target middleware dispatch. Always
 	// constructed during boot; an empty registry produces empty chains and
 	// the reverse-proxy stays on the no-capture fast path.
@@ -99,16 +101,16 @@ type Server struct {
 	// middlewareRegistry is the source of registered middleware factories.
 	// Concrete middlewares register themselves through init().
 	middlewareRegistry *middleware.Registry
-	mainRouter    *nbtcp.Router
-	mainPort      uint16
-	udpMu         sync.Mutex
-	udpRelays     map[types.ServiceID]*udprelay.Relay
-	udpRelayWg    sync.WaitGroup
-	portMu        sync.RWMutex
-	portRouters   map[uint16]*portRouter
-	svcPorts      map[types.ServiceID][]uint16
-	lastMappings  map[types.ServiceID]*proto.ProxyMapping
-	portRouterWg  sync.WaitGroup
+	mainRouter         *nbtcp.Router
+	mainPort           uint16
+	udpMu              sync.Mutex
+	udpRelays          map[types.ServiceID]*udprelay.Relay
+	udpRelayWg         sync.WaitGroup
+	portMu             sync.RWMutex
+	portRouters        map[uint16]*portRouter
+	svcPorts           map[types.ServiceID][]uint16
+	lastMappings       map[types.ServiceID]*proto.ProxyMapping
+	portRouterWg       sync.WaitGroup
 
 	// hijackTracker tracks hijacked connections (e.g. WebSocket upgrades)
 	// so they can be closed during graceful shutdown, since http.Server.Shutdown
@@ -192,15 +194,18 @@ type Server struct {
 	// ForwardedProto overrides the X-Forwarded-Proto value sent to backends.
 	// Valid values: "auto" (detect from TLS), "http", "https".
 	ForwardedProto string
-	// TrustedProxies is a list of IP prefixes for trusted upstream proxies.
-	// When set, forwarding headers from these sources are preserved and
-	// appended to instead of being stripped.
-	TrustedProxies []netip.Prefix
+	// TrustedProxies is the set of trusted upstream proxies. When set,
+	// forwarding headers from these sources are preserved and appended to
+	// instead of being stripped.
+	TrustedProxies *trustedproxy.List
 	// WireguardPort is the port for the NetBird tunnel interface. Use 0
 	// for a random OS-assigned port. A fixed port only works with
 	// single-account deployments; multiple accounts will fail to bind
 	// the same port.
 	WireguardPort uint16
+	// NATExternalIPs maps external IPs advertised as ICE candidates by every
+	// embedded client. Requires a fixed WireguardPort forwarded on the NAT.
+	NATExternalIPs []string
 	// Performance configures the tunnel pool/batch sizes for every
 	// embedded client this proxy spawns.
 	Performance embed.Performance
@@ -245,10 +250,6 @@ type Server struct {
 	// in processMappings before the receive loop reconnects to resync.
 	// Zero uses defaultMappingBatchWatchdog.
 	MappingBatchWatchdog time.Duration
-	// MiddlewareDataDir is the base directory the middleware system uses to
-	// resolve file-backed configuration (e.g. the cost_meter pricing table).
-	// Empty means any middleware that requires a file fails at configure time.
-	MiddlewareDataDir string
 	// MiddlewareCaptureBudgetBytes overrides the proxy-wide in-flight capture
 	// budget passed to middleware.NewManager. Zero or negative values fall
 	// back to defaultMiddlewareCaptureBudgetBytes (256 MiB).
@@ -364,6 +365,13 @@ func (s *Server) Start(ctx context.Context) error {
 		return err
 	}
 
+	startupOK := false
+	defer func() {
+		if !startupOK {
+			s.cleanupFailedStart()
+		}
+	}()
+
 	// Management client must be initialised BEFORE the middleware manager —
 	// initMiddlewareManager passes s.mgmtClient into the builtin FactoryContext
 	// that the limit-check / limit-record middlewares pull from. Reversed
@@ -376,7 +384,9 @@ func (s *Server) Start(ctx context.Context) error {
 	runCtx, runCancel := context.WithCancel(ctx)
 	s.runCancel = runCancel
 
-	s.initNetBirdClient()
+	if err := s.initNetBirdClient(); err != nil {
+		return err
+	}
 	// Create health checker before the mapping worker so it can track
 	// management connectivity from the first stream connection.
 	s.healthChecker = health.NewChecker(s.Logger, s.netbird)
@@ -397,18 +407,6 @@ func (s *Server) Start(ctx context.Context) error {
 		return err
 	}
 
-	startupOK := false
-	defer func() {
-		if startupOK {
-			return
-		}
-		if s.geoRaw != nil {
-			if closeErr := s.geoRaw.Close(); closeErr != nil {
-				s.Logger.Debugf("close geolocation on startup failure: %v", closeErr)
-			}
-		}
-	}()
-
 	s.auth = auth.NewMiddleware(s.Logger, s.mgmtClient, s.geo)
 	s.accessLog = accesslog.NewLogger(s.mgmtClient, s.Logger, s.TrustedProxies)
 
@@ -477,14 +475,7 @@ func (s *Server) Stop(ctx context.Context) error {
 		go func() {
 			defer close(done)
 			s.gracefulShutdown()
-			if s.runCancel != nil {
-				s.runCancel()
-			}
-			if s.mgmtConn != nil {
-				if err := s.mgmtConn.Close(); err != nil {
-					s.Logger.Debugf("management connection close: %v", err)
-				}
-			}
+			s.releaseRunResources()
 		}()
 
 		select {
@@ -499,6 +490,27 @@ func (s *Server) Stop(ctx context.Context) error {
 	return s.runErr
 }
 
+// cleanupFailedStart releases what a failed Start already brought up. It
+// skips the drain and pre-stop delay because nothing has served yet, and
+// consumes stopOnce so a later Stop stays a no-op.
+func (s *Server) cleanupFailedStart() {
+	s.stopOnce.Do(func() {
+		s.shutdownServices()
+		s.releaseRunResources()
+	})
+}
+
+func (s *Server) releaseRunResources() {
+	if s.runCancel != nil {
+		s.runCancel()
+	}
+	if s.mgmtConn != nil {
+		if err := s.mgmtConn.Close(); err != nil {
+			s.Logger.Debugf("management connection close: %v", err)
+		}
+	}
+}
+
 // waitAndStop blocks until ctx is cancelled or a background goroutine
 // reports a fatal error, then drains and stops. Used by ListenAndServe.
 func (s *Server) waitAndStop(ctx context.Context) error {
@@ -570,12 +582,13 @@ func (s *Server) initManagementClient() error {
 // initNetBirdClient builds the multi-tenant embedded NetBird client used
 // for outbound RoundTripping and (when --private is on) per-account
 // inbound listeners.
-func (s *Server) initNetBirdClient() {
+func (s *Server) initNetBirdClient() error {
 	s.netbird = roundtrip.NewNetBird(s.ctx, s.ID, s.ProxyURL, roundtrip.ClientConfig{
-		MgmtAddr:     s.ManagementAddress,
-		WGPort:       s.WireguardPort,
-		PreSharedKey: s.PreSharedKey,
-		Performance:  s.Performance,
+		MgmtAddr:       s.ManagementAddress,
+		WGPort:         s.WireguardPort,
+		PreSharedKey:   s.PreSharedKey,
+		Performance:    s.Performance,
+		NATExternalIPs: s.NATExternalIPs,
 		// On --private the embedded client serves per-account inbound
 		// listeners and must apply management's ACL: keep BlockInbound off
 		// so the engine creates the ACL manager. On the standalone proxy
@@ -583,6 +596,10 @@ func (s *Server) initNetBirdClient() {
 		BlockInbound: !s.Private,
 	}, s.Logger, s, s.mgmtClient)
 	s.netbird.OnAddPeer = s.meter.RecordAddPeerDuration
+	if err := s.meter.RegisterClientObserver(s.netbird.ClientCount); err != nil {
+		return fmt.Errorf("register client metrics: %w", err)
+	}
+	return nil
 }
 
 // initReverseProxy builds the meter-instrumented reverse proxy. MultiTransport
@@ -718,7 +735,7 @@ func (s *Server) wrapProxyProtocol(ln net.Listener) net.Listener {
 		Listener:          ln,
 		ReadHeaderTimeout: proxyProtoHeaderTimeout,
 	}
-	if len(s.TrustedProxies) > 0 {
+	if !s.TrustedProxies.Empty() {
 		ppListener.ConnPolicy = s.proxyProtocolPolicy
 	} else {
 		s.Logger.Warn("PROXY protocol enabled without trusted proxies; any source may send PROXY headers")
@@ -742,10 +759,8 @@ func (s *Server) proxyProtocolPolicy(opts proxyproto.ConnPolicyOptions) (proxypr
 	addr = addr.Unmap()
 
 	// called per accept
-	for _, prefix := range s.TrustedProxies {
-		if prefix.Contains(addr) {
-			return proxyproto.REQUIRE, nil
-		}
+	if s.TrustedProxies.Contains(addr) {
+		return proxyproto.REQUIRE, nil
 	}
 	return proxyproto.IGNORE, nil
 }
@@ -1288,6 +1303,10 @@ func (s *Server) proxyCapabilities() *proto.ProxyCapabilities {
 }
 
 func (s *Server) tryGetMappingUpdate(ctx context.Context, client proto.ProxyServiceClient, initialSyncDone *bool, onConnected func()) error {
+	// Canceling closes the stream on management; a bare return leaves it open.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
 	connectTime := time.Now()
 	mappingClient, err := client.GetMappingUpdate(ctx, &proto.GetMappingUpdateRequest{
 		ProxyId:      s.ID,
@@ -1310,6 +1329,10 @@ func (s *Server) tryGetMappingUpdate(ctx context.Context, client proto.ProxyServ
 }
 
 func (s *Server) trySyncMappings(ctx context.Context, client proto.ProxyServiceClient, initialSyncDone *bool, onConnected func()) error {
+	// Canceling closes the stream on management; a bare return leaves it open.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
 	connectTime := time.Now()
 	stream, err := client.SyncMappings(ctx)
 	if err != nil {
@@ -1633,6 +1656,22 @@ func (s *Server) addMapping(ctx context.Context, mapping *proto.ProxyMapping) er
 // state and re-applies them from the new mapping.
 func (s *Server) modifyMapping(ctx context.Context, mapping *proto.ProxyMapping) error {
 	if old := s.loadMapping(types.ServiceID(mapping.GetId())); old != nil {
+		if !types.ServiceMode(old.GetMode()).IsL4() &&
+			!types.ServiceMode(mapping.GetMode()).IsL4() &&
+			old.GetDomain() == mapping.GetDomain() &&
+			len(old.GetPath()) > 0 && len(mapping.GetPath()) > 0 {
+			if err := s.updateMapping(ctx, mapping); err != nil {
+				// Fail the whole service closed until a valid update arrives: the old
+				// policy could retain access this replacement intended to revoke.
+				// Keep the peer, but withdraw routes and the cached mapping for recovery.
+				s.cleanupMappingRoutes(old)
+				s.deleteMapping(types.ServiceID(mapping.GetId()))
+				return err
+			}
+			s.storeMapping(mapping)
+			s.hijackTracker.CloseByHost(mapping.GetDomain())
+			return nil
+		}
 		s.cleanupMappingRoutes(old)
 		if mode := types.ServiceMode(old.GetMode()); mode.IsL4() {
 			s.meter.L4ServiceRemoved(mode)
@@ -2049,13 +2088,16 @@ func (s *Server) addUDPRelay(ctx context.Context, mapping *proto.ProxyMapping, t
 }
 
 func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping) error {
-	// Very simple implementation here, we don't touch the existing peer
-	// connection or any existing TLS configuration, we simply overwrite
-	// the auth and proxy mappings.
-	// Note: this does require the management server to always send a
-	// full mapping rather than deltas during a modification.
 	accountID := types.AccountID(mapping.GetAccountId())
 	svcID := types.ServiceID(mapping.GetId())
+	m, err := s.protoToMapping(ctx, mapping)
+	if err != nil {
+		return err
+	}
+	resolver, err := proxy.NewTargetResolver(m)
+	if err != nil {
+		return fmt.Errorf("prepare target routes: %w", err)
+	}
 
 	var schemes []auth.Scheme
 	if mapping.GetAuth().GetPassword() {
@@ -2067,24 +2109,56 @@ func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping)
 	if mapping.GetAuth().GetOidc() {
 		schemes = append(schemes, auth.NewOIDC(s.mgmtClient, svcID, accountID, s.ForwardedProto))
 	}
-	for _, ha := range mapping.GetAuth().GetHeaderAuths() {
-		schemes = append(schemes, auth.NewHeader(s.mgmtClient, svcID, accountID, ha.GetHeader()))
-	}
+	schemes = append(schemes, headerAuthSchemes(mapping.GetAuth().GetHeaderAuths())...)
 
 	ipRestrictions := s.parseRestrictions(mapping)
 	s.warnIfGeoUnavailable(mapping.GetDomain(), mapping.GetAccessRestrictions())
 
 	maxSessionAge := time.Duration(mapping.GetAuth().GetMaxSessionAgeSeconds()) * time.Second
-	if err := s.auth.AddDomain(mapping.GetDomain(), schemes, mapping.GetAuth().GetSessionKey(), maxSessionAge, accountID, svcID, ipRestrictions, mapping.GetPrivate()); err != nil {
+	config, err := auth.NewDomainConfig(mapping.GetDomain(), schemes, mapping.GetAuth().GetSessionKey(), maxSessionAge, accountID, svcID, ipRestrictions, mapping.GetPrivate(), mapping.GetAuth().GetAllowedGroupIds(), auth.WithTargetResolver(resolver))
+	if err != nil {
 		return fmt.Errorf("auth setup for domain %s: %w", mapping.GetDomain(), err)
 	}
-	m := s.protoToMapping(ctx, mapping)
-	s.proxy.AddMapping(m)
+	revision, err := s.rebuildMiddlewareChains(svcID, m)
+	if err != nil {
+		return err
+	}
+	m.MiddlewareRevision = revision
+	config.TargetResolver = resolver.WithMiddlewareRevision(revision)
+	// The auth snapshot owns its resolver, so an in-flight request cannot
+	// authorize an old target and then forward to a replacement target.
+	s.auth.AddDomainConfig(mapping.GetDomain(), config)
 	s.meter.AddMapping(m)
-	s.rebuildMiddlewareChains(svcID, m)
+	s.proxy.AddMapping(m)
 	return nil
 }
 
+// headerAuthSchemes builds one scheme per canonical header name, carrying every
+// hash configured for that name so any of them is accepted — the OR semantics
+// management applied while it still validated the credential itself. No entry is
+// ever dropped: a name that arrives blank, or without a hash, still yields a
+// scheme, because a mapping that lost its only scheme would fall through
+// Protect's no-schemes pass-through and serve the domain unauthenticated.
+func headerAuthSchemes(headerAuths []*proto.HeaderAuth) []auth.Scheme {
+	names := make([]string, 0, len(headerAuths))
+	hashes := make(map[string][]string, len(headerAuths))
+	for _, ha := range headerAuths {
+		name := http.CanonicalHeaderKey(ha.GetHeader())
+		if !slices.Contains(names, name) {
+			names = append(names, name)
+		}
+		if hash := ha.GetHashedValue(); hash != "" {
+			hashes[name] = append(hashes[name], hash)
+		}
+	}
+
+	schemes := make([]auth.Scheme, 0, len(names))
+	for _, name := range names {
+		schemes = append(schemes, auth.NewHeader(name, hashes[name]))
+	}
+	return schemes
+}
+
 // initMiddlewareManager wires the middleware subsystem at boot. It configures
 // the per-process FactoryContext concrete middlewares consult, installs the
 // live-service check, and binds the resolver to the registry concrete
@@ -2094,7 +2168,7 @@ func (s *Server) initMiddlewareManager(ctx context.Context) error {
 		return fmt.Errorf("middleware manager requires metrics bundle")
 	}
 	otelMeter := s.meter.Meter()
-	mwbuiltin.Configure(ctx, s.MiddlewareDataDir, otelMeter, s.Logger, s.mgmtClient)
+	mwbuiltin.Configure(ctx, otelMeter, s.Logger, s.mgmtClient)
 
 	mwMetrics, err := middleware.NewMetrics(otelMeter)
 	if err != nil {
@@ -2118,16 +2192,17 @@ func (s *Server) initMiddlewareManager(ctx context.Context) error {
 	return nil
 }
 
-// rebuildMiddlewareChains converts m into per-path bindings and calls
-// Manager.Rebuild. Short-circuits when the middleware manager is unset.
-func (s *Server) rebuildMiddlewareChains(svcID types.ServiceID, m proxy.Mapping) {
+// rebuildMiddlewareChains installs the service's policies before its routing snapshot.
+func (s *Server) rebuildMiddlewareChains(svcID types.ServiceID, m proxy.Mapping) (middleware.Revision, error) {
 	if s.middlewareManager == nil {
-		return
+		return 0, nil
 	}
 	bindings := buildMiddlewareBindings(svcID, m)
-	if err := s.middlewareManager.Rebuild(string(svcID), bindings); err != nil {
-		s.Logger.WithError(err).WithField("service_id", svcID).Error("failed to rebuild middleware chains")
+	revision, err := s.middlewareManager.RebuildSnapshot(string(svcID), bindings)
+	if err != nil {
+		return 0, fmt.Errorf("rebuild middleware chains for service %s: %w", svcID, err)
 	}
+	return revision, nil
 }
 
 // isLiveService reports whether svcID is currently present in the live
@@ -2212,10 +2287,10 @@ func (s *Server) cleanupMappingRoutes(mapping *proto.ProxyMapping) {
 		if s.acme != nil {
 			s.acme.RemoveDomain(d)
 		}
-		s.auth.RemoveDomain(host)
 		if s.proxy.RemoveMapping(proxy.Mapping{Host: host}) {
 			s.meter.RemoveMapping(proxy.Mapping{Host: host})
 		}
+		s.auth.RemoveDomain(host)
 		// Close hijacked connections (WebSocket) for this domain.
 		if n := s.hijackTracker.CloseByHost(host); n > 0 {
 			s.Logger.Debugf("closed %d hijacked connection(s) for %s", n, host)
@@ -2288,23 +2363,33 @@ func (s *Server) deleteMapping(svcID types.ServiceID) *proto.ProxyMapping {
 	return m
 }
 
-func (s *Server) protoToMapping(ctx context.Context, mapping *proto.ProxyMapping) proxy.Mapping {
+func (s *Server) protoToMapping(ctx context.Context, mapping *proto.ProxyMapping) (proxy.Mapping, error) {
+	pathMappings := mapping.GetPath()
+	actions, strictPaths, err := parseTargetAccessActions(pathMappings)
+	if err != nil {
+		return proxy.Mapping{}, err
+	}
+
 	paths := make(map[string]*proxy.PathTarget)
-	for _, pathMapping := range mapping.GetPath() {
+	for i, pathMapping := range pathMappings {
+		path := pathMapping.GetPath()
+		if strictPaths && path == "" {
+			path = "/"
+		}
+		if strictPaths {
+			if _, exists := paths[path]; exists {
+				return proxy.Mapping{}, fmt.Errorf("duplicate target location %q", path)
+			}
+		}
 		targetURL, err := url.Parse(pathMapping.GetTarget())
 		if err != nil {
-			s.Logger.WithFields(log.Fields{
-				"service_id": mapping.GetId(),
-				"account_id": mapping.GetAccountId(),
-				"domain":     mapping.GetDomain(),
-				"path":       pathMapping.GetPath(),
-				"target":     pathMapping.GetTarget(),
-			}).WithError(err).Error("failed to parse target URL for path, skipping")
-			s.notifyError(ctx, mapping, fmt.Errorf("invalid target URL %q for path %q: %w", pathMapping.GetTarget(), pathMapping.GetPath(), err))
-			continue
+			return proxy.Mapping{}, fmt.Errorf("parse target URL for location %q: %w", path, err)
+		}
+		if targetURL.Host == "" || (targetURL.Scheme != "http" && targetURL.Scheme != "https") {
+			return proxy.Mapping{}, fmt.Errorf("invalid HTTP target URL for location %q", path)
 		}
 
-		pt := &proxy.PathTarget{URL: targetURL}
+		pt := &proxy.PathTarget{URL: targetURL, AccessAction: actions[i]}
 		if opts := pathMapping.GetOptions(); opts != nil {
 			pt.SkipTLSVerify = opts.GetSkipTlsVerify()
 			pt.PathRewrite = protoToPathRewrite(opts.GetPathRewrite())
@@ -2321,7 +2406,7 @@ func (s *Server) protoToMapping(ctx context.Context, mapping *proto.ProxyMapping
 			pt.DisableAccessLog = opts.GetDisableAccessLog()
 		}
 		pt.RequestTimeout = s.clampDialTimeout(pt.RequestTimeout)
-		paths[pathMapping.GetPath()] = pt
+		paths[path] = pt
 	}
 	m := proxy.Mapping{
 		ID:               types.ServiceID(mapping.GetId()),
@@ -2334,7 +2419,7 @@ func (s *Server) protoToMapping(ctx context.Context, mapping *proto.ProxyMapping
 	for _, ha := range mapping.GetAuth().GetHeaderAuths() {
 		m.StripAuthHeaders = append(m.StripAuthHeaders, ha.GetHeader())
 	}
-	return m
+	return m, nil
 }
 
 func protoToPathRewrite(mode proto.PathRewriteMode) proxy.PathRewriteMode {
diff --git a/proxy/server_test.go b/proxy/server_test.go
index f0c4765db..cf583985f 100644
--- a/proxy/server_test.go
+++ b/proxy/server_test.go
@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 	"time"
 
@@ -14,9 +16,12 @@ import (
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel/metric/noop"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/connectivity"
 
+	"github.com/netbirdio/netbird/proxy/internal/auth"
 	proxymetrics "github.com/netbirdio/netbird/proxy/internal/metrics"
 	"github.com/netbirdio/netbird/proxy/internal/types"
+	"github.com/netbirdio/netbird/shared/hash/argon2id"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -102,6 +107,25 @@ func TestStartFailsWithoutManagement(t *testing.T) {
 	assert.Contains(t, err.Error(), "already started", "error must explain why the call was rejected")
 }
 
+func TestStartFailureReleasesManagementConnection(t *testing.T) {
+	srv := New(t.Context(), Config{
+		Logger:               quietLifecycleLogger(),
+		ListenAddr:           "127.0.0.1:0",
+		ManagementAddress:    "https://127.0.0.1:1",
+		CertificateDirectory: t.TempDir(),
+		CertificateFile:      "missing.crt",
+		CertificateKeyFile:   "missing.key",
+	})
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	err := srv.Start(ctx)
+	require.Error(t, err, "Start must fail on the missing certificate")
+	require.NotNil(t, srv.mgmtConn, "the management connection is created before the certificate step")
+	assert.Equal(t, connectivity.Shutdown, srv.mgmtConn.GetState(), "a failed Start must close the management connection it opened")
+}
+
 func TestStopIsIdempotent(t *testing.T) {
 	srv := &Server{
 		Logger:    quietLifecycleLogger(),
@@ -209,6 +233,62 @@ func TestRedactMappingForLog_HandlesEmptyOrNilFields(t *testing.T) {
 	assert.Empty(t, redacted.Path, "empty Path must remain empty")
 }
 
+// headerSchemeAccepts reports whether the scheme admits value for headerName.
+func headerSchemeAccepts(t *testing.T, scheme auth.Scheme, headerName, value string) bool {
+	t.Helper()
+	hdr, ok := scheme.(auth.Header)
+	require.True(t, ok, "header auths must produce Header schemes")
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	req.Header.Set(headerName, value)
+	_, matched, _ := hdr.Verify(req)
+	return matched
+}
+
+func TestHeaderAuthSchemes_GroupsValuesByCanonicalHeaderName(t *testing.T) {
+	hashOf := func(v string) string {
+		hash, err := argon2id.Hash(v)
+		require.NoError(t, err)
+		return hash
+	}
+
+	schemes := headerAuthSchemes([]*proto.HeaderAuth{
+		{Header: "Authorization", HashedValue: hashOf("Bearer a")},
+		{Header: "authorization", HashedValue: hashOf("Bearer b")},
+		{Header: "X-Api-Key", HashedValue: hashOf("key-1")},
+	})
+
+	require.Len(t, schemes, 2, "entries differing only in header-name case must collapse into one scheme")
+
+	assert.True(t, headerSchemeAccepts(t, schemes[0], "Authorization", "Bearer a"), "first value for the header must be accepted")
+	assert.True(t, headerSchemeAccepts(t, schemes[0], "Authorization", "Bearer b"), "second value for the same header must be accepted")
+	assert.False(t, headerSchemeAccepts(t, schemes[0], "Authorization", "Bearer c"), "unconfigured value must be rejected")
+	assert.True(t, headerSchemeAccepts(t, schemes[1], "X-Api-Key", "key-1"), "a second header name keeps its own scheme")
+}
+
+// TestHeaderAuthSchemes_MissingHashFailsClosed covers a mapping that names a
+// header but carries no hash for it. Dropping the scheme would leave a service
+// whose only auth is that header wide open, so the scheme is kept and denies.
+func TestHeaderAuthSchemes_MissingHashFailsClosed(t *testing.T) {
+	schemes := headerAuthSchemes([]*proto.HeaderAuth{{Header: "X-Api-Key"}})
+
+	require.Len(t, schemes, 1, "a header without a hash must still register a scheme")
+	assert.False(t, headerSchemeAccepts(t, schemes[0], "X-Api-Key", "anything"),
+		"a header auth without a hash must reject every value")
+}
+
+// TestHeaderAuthSchemes_BlankNameFailsClosed covers a mapping row whose header
+// name is empty. Skipping it would leave a service whose only auth is that entry
+// with no schemes at all, which Protect treats as an unprotected domain, so the
+// entry is kept and the domain stays gated.
+func TestHeaderAuthSchemes_BlankNameFailsClosed(t *testing.T) {
+	schemes := headerAuthSchemes([]*proto.HeaderAuth{{Header: "", HashedValue: "$argon2id$not-a-real-hash"}})
+
+	require.Len(t, schemes, 1, "a blank header name must still register a scheme")
+	assert.False(t, headerSchemeAccepts(t, schemes[0], "X-Api-Key", "anything"),
+		"a blank header auth must not admit any request")
+}
+
 type statusUpdateOnlyClient struct {
 	proto.ProxyServiceClient
 }
diff --git a/proxy/target_access_control.go b/proxy/target_access_control.go
new file mode 100644
index 000000000..9460375c9
--- /dev/null
+++ b/proxy/target_access_control.go
@@ -0,0 +1,40 @@
+package proxy
+
+import (
+	"fmt"
+
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func parseTargetAccessActions(pathMappings []*proto.PathMapping) ([]proxy.AccessAction, bool, error) {
+	actions := make([]proxy.AccessAction, len(pathMappings))
+	strictPaths := false
+	for i, pathMapping := range pathMappings {
+		if pathMapping == nil {
+			return nil, false, fmt.Errorf("nil target mapping")
+		}
+		action, err := targetAccessActionFromProto(pathMapping.GetAccessAction())
+		if err != nil {
+			return nil, false, err
+		}
+		actions[i] = action
+		if action != proxy.AccessActionInherit {
+			strictPaths = true
+		}
+	}
+	return actions, strictPaths, nil
+}
+
+func targetAccessActionFromProto(action proto.TargetAccessAction) (proxy.AccessAction, error) {
+	switch action {
+	case proto.TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT:
+		return proxy.AccessActionInherit, nil
+	case proto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS:
+		return proxy.AccessActionBypass, nil
+	case proto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK:
+		return proxy.AccessActionBlock, nil
+	default:
+		return "", fmt.Errorf("unknown target access action %d", action)
+	}
+}
diff --git a/proxy/target_access_control_integration_test.go b/proxy/target_access_control_integration_test.go
new file mode 100644
index 000000000..82fc6d67a
--- /dev/null
+++ b/proxy/target_access_control_integration_test.go
@@ -0,0 +1,270 @@
+package proxy
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/base64"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	nbproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/hash/argon2id"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func targetAccessService(t *testing.T, upstreamURL string) *service.Service {
+	t.Helper()
+
+	u, err := url.Parse(upstreamURL)
+	require.NoError(t, err)
+	host, portText, err := net.SplitHostPort(u.Host)
+	require.NoError(t, err)
+	port, err := strconv.ParseUint(portText, 10, 16)
+	require.NoError(t, err)
+
+	headerHash, err := argon2id.Hash(targetAccessSecret)
+	require.NoError(t, err)
+	publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+
+	newTarget := func(path string, action service.TargetAccessAction) *service.Target {
+		return &service.Target{
+			Path:         strPtr(path),
+			Host:         host,
+			Port:         uint16(port),
+			Protocol:     u.Scheme,
+			TargetId:     "target-access-upstream",
+			TargetType:   service.TargetTypeCluster,
+			Enabled:      true,
+			AccessAction: action,
+			Options: service.TargetOptions{
+				DirectUpstream: true,
+			},
+		}
+	}
+
+	return &service.Service{
+		ID:                "target-access-service",
+		AccountID:         targetAccessAccountID,
+		Name:              "Target Access Control",
+		Domain:            targetAccessDomain,
+		ProxyCluster:      targetAccessCluster,
+		Enabled:           true,
+		SessionPrivateKey: base64.StdEncoding.EncodeToString(privateKey),
+		SessionPublicKey:  base64.StdEncoding.EncodeToString(publicKey),
+		Targets: []*service.Target{
+			newTarget("/", service.TargetAccessActionInherit),
+			newTarget("/public", service.TargetAccessActionBypass),
+			newTarget("/blocked", service.TargetAccessActionBlock),
+		},
+		Auth: service.AuthConfig{HeaderAuths: []*service.HeaderAuthConfig{{
+			Enabled: true,
+			Header:  targetAccessHeader,
+			Value:   headerHash,
+		}}},
+		Restrictions: service.AccessRestrictions{
+			BlockedCIDRs: []string{"203.0.113.0/24"},
+		},
+	}
+}
+
+func privateServiceCapabilities() *proto.ProxyCapabilities {
+	supported := true
+	return &proto.ProxyCapabilities{
+		SupportsPrivateService: &supported,
+	}
+}
+
+func targetAccessMappingStream(t *testing.T, setup *integrationTestSetup, proxyID string, caps *proto.ProxyCapabilities) proto.ProxyService_GetMappingUpdateClient {
+	t.Helper()
+
+	conn, err := grpc.NewClient(setup.grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	t.Cleanup(cancel)
+	stream, err := proto.NewProxyServiceClient(conn).GetMappingUpdate(ctx, &proto.GetMappingUpdateRequest{
+		ProxyId:      proxyID,
+		Version:      "target-access-test",
+		Address:      targetAccessCluster,
+		Capabilities: caps,
+	})
+	require.NoError(t, err)
+	return stream
+}
+
+func receiveTargetAccessSnapshot(t *testing.T, stream proto.ProxyService_GetMappingUpdateClient) map[string]*proto.ProxyMapping {
+	t.Helper()
+
+	mappings := make(map[string]*proto.ProxyMapping)
+	for {
+		msg, err := stream.Recv()
+		require.NoError(t, err)
+		for _, mapping := range msg.GetMapping() {
+			mappings[mapping.GetId()] = mapping
+		}
+		if msg.GetInitialSyncComplete() {
+			return mappings
+		}
+	}
+}
+
+func receiveTargetAccessUpdate(t *testing.T, stream proto.ProxyService_GetMappingUpdateClient, serviceID string) *proto.ProxyMapping {
+	t.Helper()
+
+	for {
+		msg, err := stream.Recv()
+		require.NoError(t, err)
+		for _, mapping := range msg.GetMapping() {
+			if mapping.GetId() == serviceID {
+				return mapping
+			}
+		}
+	}
+}
+
+func TestIntegration_TargetAccessControl_ManagementToUpstream(t *testing.T) {
+	setup := setupIntegrationTest(t)
+	t.Cleanup(setup.cleanup)
+
+	upstreamRecorder := &targetAccessUpstream{}
+	upstream := httptest.NewServer(upstreamRecorder)
+	t.Cleanup(upstream.Close)
+
+	svc := targetAccessService(t, upstream.URL)
+	require.NoError(t, setup.store.CreateService(t.Context(), svc))
+
+	stream := targetAccessMappingStream(t, setup, "target-access-proxy", nil)
+	snapshot := receiveTargetAccessSnapshot(t, stream)
+	mapping := snapshot[svc.ID]
+	require.NotNil(t, mapping, "proxy must receive the target-access service")
+
+	actions := make(map[string]proto.TargetAccessAction)
+	for _, pathMapping := range mapping.GetPath() {
+		actions[pathMapping.GetPath()] = pathMapping.GetAccessAction()
+	}
+	assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT, actions["/"])
+	assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS, actions["/public"])
+	assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK, actions["/blocked"])
+
+	runtime, handler := newTargetAccessRuntime(t)
+	applyTargetAccessMapping(t, runtime, mapping)
+
+	before := len(upstreamRecorder.snapshot())
+	res := targetAccessRequestTo(handler, "/private", "198.51.100.10:12000", nil)
+	assert.Equal(t, http.StatusUnauthorized, res.Code, "inherit must retain service authentication")
+	assert.Len(t, upstreamRecorder.snapshot(), before, "unauthenticated inherited request must not reach upstream")
+
+	validHeader := http.Header{targetAccessHeader: []string{targetAccessSecret}}
+	res = targetAccessRequestTo(handler, "/private", "198.51.100.10:12000", validHeader)
+	assert.Equal(t, http.StatusOK, res.Code, "valid service authentication must pass an inherited target")
+	inheritedRequests := upstreamRecorder.snapshot()
+	require.Len(t, inheritedRequests, before+1)
+	assert.Empty(t, inheritedRequests[len(inheritedRequests)-1].headers.Get(targetAccessHeader),
+		"proxy authentication credential must not be forwarded upstream")
+
+	bypassHeaders := http.Header{
+		targetAccessHeader: []string{"spoofed-auth"},
+		"X-NetBird-User":   []string{"spoofed@example.com"},
+		"X-NetBird-Groups": []string{"administrators"},
+	}
+	res = targetAccessRequestTo(handler, "/public/ready", "198.51.100.10:12000", bypassHeaders)
+	assert.Equal(t, http.StatusOK, res.Code, "bypass target must reach upstream without authenticating")
+	bypassRequests := upstreamRecorder.snapshot()
+	require.Len(t, bypassRequests, before+2)
+	bypassed := bypassRequests[len(bypassRequests)-1]
+	assert.Equal(t, "/ready", bypassed.path, "routing must retain the existing literal-prefix rewrite")
+	assert.Empty(t, bypassed.headers.Get(targetAccessHeader), "configured auth header must be stripped on bypass")
+	assert.Empty(t, bypassed.headers.Get("X-NetBird-User"), "bypass must not permit spoofed identity")
+	assert.Empty(t, bypassed.headers.Get("X-NetBird-Groups"), "bypass must not permit spoofed groups")
+
+	before = len(bypassRequests)
+	res = targetAccessRequestTo(handler, "/blocked/secret", "198.51.100.10:12000", validHeader)
+	assert.Equal(t, http.StatusForbidden, res.Code, "block must win even when service authentication is valid")
+	assert.Len(t, upstreamRecorder.snapshot(), before, "blocked request must not reach upstream")
+
+	res = targetAccessRequestTo(handler, "/public/ready", "203.0.113.8:12000", nil)
+	assert.Equal(t, http.StatusForbidden, res.Code, "connection restrictions must run before bypass")
+	assert.Len(t, upstreamRecorder.snapshot(), before, "restricted bypass request must not reach upstream")
+
+	for _, target := range svc.Targets {
+		switch *target.Path {
+		case "/public":
+			target.AccessAction = service.TargetAccessActionBlock
+		case "/blocked":
+			target.AccessAction = service.TargetAccessActionBypass
+		}
+	}
+	require.NoError(t, setup.store.UpdateService(t.Context(), svc))
+	persisted, err := setup.store.GetServiceByID(t.Context(), store.LockingStrengthNone, targetAccessAccountID, svc.ID)
+	require.NoError(t, err)
+	update := persisted.ToProtoMapping(service.Update, "", nbproxy.OIDCValidationConfig{})
+	setup.proxyService.SendServiceUpdate(&proto.GetMappingUpdateResponse{Mapping: []*proto.ProxyMapping{update}})
+	receivedUpdate := receiveTargetAccessUpdate(t, stream, svc.ID)
+	applyTargetAccessMapping(t, runtime, receivedUpdate)
+
+	res = targetAccessRequestTo(handler, "/public/ready", "198.51.100.10:12000", validHeader)
+	assert.Equal(t, http.StatusForbidden, res.Code, "modified action must replace bypass with block")
+	assert.Len(t, upstreamRecorder.snapshot(), before, "newly blocked request must not reach upstream")
+
+	res = targetAccessRequestTo(handler, "/blocked/ready", "198.51.100.10:12000", nil)
+	assert.Equal(t, http.StatusOK, res.Code, "modified action must replace block with bypass")
+	assert.Len(t, upstreamRecorder.snapshot(), before+1, "newly bypassed request must reach upstream")
+
+	require.NoError(t, setup.store.DeleteService(t.Context(), targetAccessAccountID, svc.ID))
+	removed := persisted.ToProtoMapping(service.Delete, "", nbproxy.OIDCValidationConfig{})
+	setup.proxyService.SendServiceUpdate(&proto.GetMappingUpdateResponse{Mapping: []*proto.ProxyMapping{removed}})
+	receivedRemoval := receiveTargetAccessUpdate(t, stream, svc.ID)
+	runtime.removeMapping(t.Context(), receivedRemoval)
+
+	res = targetAccessRequestTo(handler, "/blocked/ready", "198.51.100.10:12000", nil)
+	assert.Equal(t, http.StatusNotFound, res.Code, "removed mapping must no longer route")
+	assert.Len(t, upstreamRecorder.snapshot(), before+1, "request after removal must not reach upstream")
+}
+
+func TestIntegration_TargetAccessControl_PrivateServiceRejectsBypass(t *testing.T) {
+	setup := setupIntegrationTest(t)
+	t.Cleanup(setup.cleanup)
+
+	upstreamRecorder := &targetAccessUpstream{}
+	upstream := httptest.NewServer(upstreamRecorder)
+	t.Cleanup(upstream.Close)
+
+	svc := targetAccessService(t, upstream.URL)
+	svc.ID = "target-access-private"
+	svc.Domain = "target-access-private.test.proxy.io"
+	svc.Private = true
+	svc.Targets = svc.Targets[1:2]
+	require.NoError(t, setup.store.CreateService(t.Context(), svc))
+
+	stream := targetAccessMappingStream(t, setup, "target-access-private", privateServiceCapabilities())
+	mapping := receiveTargetAccessSnapshot(t, stream)[svc.ID]
+	require.NotNil(t, mapping, "proxy supporting private services must receive private target-access mapping")
+
+	runtime, handler := newTargetAccessRuntime(t)
+	err := runtime.updateMapping(t.Context(), mapping)
+	require.Error(t, err, "private service with a bypass target must be rejected")
+
+	req := httptest.NewRequest(http.MethodGet, "http://"+svc.Domain+"/public/ready", nil)
+	req.Host = svc.Domain
+	req.RemoteAddr = "100.64.0.20:12000"
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusNotFound, recorder.Code, "rejected private mapping must not be published")
+	assert.Empty(t, upstreamRecorder.snapshot(), "rejected private mapping must not reach upstream")
+}
diff --git a/proxy/target_access_control_runtime_test.go b/proxy/target_access_control_runtime_test.go
new file mode 100644
index 000000000..4ff3104e4
--- /dev/null
+++ b/proxy/target_access_control_runtime_test.go
@@ -0,0 +1,172 @@
+package proxy
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/metric/noop"
+
+	"github.com/netbirdio/netbird/proxy/internal/auth"
+	proxymetrics "github.com/netbirdio/netbird/proxy/internal/metrics"
+	internalproxy "github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
+	nbtcp "github.com/netbirdio/netbird/proxy/internal/tcp"
+	proxytypes "github.com/netbirdio/netbird/proxy/internal/types"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const (
+	targetAccessAccountID = "test-account-1"
+	targetAccessCluster   = "test.proxy.io"
+	targetAccessDomain    = "target-access.test.proxy.io"
+	targetAccessHeader    = "X-Test-Key"
+	targetAccessSecret    = "valid-secret"
+)
+
+type targetAccessRequest struct {
+	path    string
+	headers http.Header
+}
+
+type targetAccessUpstream struct {
+	mu       sync.Mutex
+	requests []targetAccessRequest
+}
+
+func (u *targetAccessUpstream) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	u.mu.Lock()
+	u.requests = append(u.requests, targetAccessRequest{
+		path:    r.URL.Path,
+		headers: r.Header.Clone(),
+	})
+	u.mu.Unlock()
+	w.WriteHeader(http.StatusOK)
+}
+
+func (u *targetAccessUpstream) snapshot() []targetAccessRequest {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return append([]targetAccessRequest(nil), u.requests...)
+}
+
+func newTargetAccessRuntime(t *testing.T) (*Server, http.Handler) {
+	t.Helper()
+
+	logger := quietLifecycleLogger()
+	meter, err := proxymetrics.New(t.Context(), noop.Meter{})
+	require.NoError(t, err)
+
+	reverseProxy := internalproxy.NewReverseProxy(http.DefaultTransport, "auto", nil, logger)
+	authMiddleware := auth.NewMiddleware(logger, nil, nil)
+	srv := &Server{
+		ctx:              t.Context(),
+		Logger:           logger,
+		proxy:            reverseProxy,
+		auth:             authMiddleware,
+		meter:            meter,
+		mainRouter:       nbtcp.NewRouter(logger, nil, &net.TCPAddr{}),
+		portRouters:      make(map[uint16]*portRouter),
+		svcPorts:         make(map[proxytypes.ServiceID][]uint16),
+		lastMappings:     make(map[proxytypes.ServiceID]*proto.ProxyMapping),
+		crowdsecServices: make(map[proxytypes.ServiceID]bool),
+		removePeer: func(context.Context, proxytypes.AccountID, roundtrip.ServiceKey) error {
+			return nil
+		},
+	}
+
+	return srv, authMiddleware.Protect(reverseProxy)
+}
+
+func applyTargetAccessMapping(t *testing.T, srv *Server, mapping *proto.ProxyMapping) {
+	t.Helper()
+	require.NoError(t, srv.updateMapping(t.Context(), mapping))
+	srv.storeMapping(mapping)
+}
+
+func targetAccessRequestTo(handler http.Handler, path, remoteAddr string, headers http.Header) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(http.MethodGet, "http://"+targetAccessDomain+path, nil)
+	req.Host = targetAccessDomain
+	req.RemoteAddr = remoteAddr
+	for name, values := range headers {
+		for _, value := range values {
+			req.Header.Add(name, value)
+		}
+	}
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, req)
+	return recorder
+}
+
+func TestModifyHTTPMappingFromEmptyPathsRegistersRoute(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("X-Test-Upstream", "reached")
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(upstream.Close)
+
+	runtime, handler := newTargetAccessRuntime(t)
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = listener.Close() })
+
+	router := nbtcp.NewRouter(runtime.Logger, func(proxytypes.AccountID) (proxytypes.DialContextFunc, error) {
+		return func(context.Context, string, string) (net.Conn, error) {
+			return nil, net.ErrClosed
+		}, nil
+	}, listener.Addr())
+	router.SetFallback(nbtcp.Route{
+		Type:      nbtcp.RouteTCP,
+		AccountID: "fallback-account",
+		ServiceID: "fallback-service",
+		Target:    "unreachable.test:443",
+	})
+	runtime.mainRouter = router
+
+	httpServer := &http.Server{
+		Handler:           handler,
+		TLSConfig:         selfSignedTLSConfig(t),
+		ReadHeaderTimeout: time.Second,
+	}
+	t.Cleanup(func() { _ = httpServer.Close() })
+	go func() { _ = httpServer.ServeTLS(router.HTTPListener(), "", "") }()
+	go feedRouterFromListener(t.Context(), listener, router, runtime.Logger, proxytypes.AccountID(targetAccessAccountID))
+
+	previous := &proto.ProxyMapping{
+		Id:        "empty-to-routable",
+		AccountId: targetAccessAccountID,
+		Domain:    targetAccessDomain,
+	}
+	runtime.storeMapping(previous)
+	replacement := &proto.ProxyMapping{
+		Id:        previous.GetId(),
+		AccountId: previous.GetAccountId(),
+		Domain:    previous.GetDomain(),
+		Path: []*proto.PathMapping{{
+			Path:   "/",
+			Target: upstream.URL,
+		}},
+	}
+	require.NoError(t, runtime.modifyMapping(t.Context(), replacement))
+
+	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true, MinVersion: tls.VersionTLS12}, //nolint:gosec
+		DialContext: func(ctx context.Context, network, _ string) (net.Conn, error) {
+			return (&net.Dialer{}).DialContext(ctx, network, listener.Addr().String())
+		},
+	}
+	t.Cleanup(transport.CloseIdleConnections)
+	client := &http.Client{Transport: transport, Timeout: 3 * time.Second}
+	response, err := client.Get("https://" + targetAccessDomain + "/ready")
+	require.NoError(t, err, "first target must register the domain with the SNI router")
+	t.Cleanup(func() { _ = response.Body.Close() })
+	assert.Equal(t, http.StatusNoContent, response.StatusCode)
+	assert.Equal(t, "reached", response.Header.Get("X-Test-Upstream"))
+}
diff --git a/proxy/target_access_control_test.go b/proxy/target_access_control_test.go
new file mode 100644
index 000000000..a1be3a83b
--- /dev/null
+++ b/proxy/target_access_control_test.go
@@ -0,0 +1,151 @@
+package proxy
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+
+	internalproxy "github.com/netbirdio/netbird/proxy/internal/proxy"
+	managementproto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestTargetAccessActionFromProto(t *testing.T) {
+	tests := []struct {
+		name string
+		wire managementproto.TargetAccessAction
+		want internalproxy.AccessAction
+	}{
+		{"inherit", managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT, internalproxy.AccessActionInherit},
+		{"bypass", managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS, internalproxy.AccessActionBypass},
+		{"block", managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK, internalproxy.AccessActionBlock},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := targetAccessActionFromProto(tt.wire)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got, "wire action must retain its enforcement meaning")
+		})
+	}
+	_, err := targetAccessActionFromProto(managementproto.TargetAccessAction(99))
+	require.Error(t, err, "an unknown wire action must reject the mapping")
+}
+
+func TestProtoToMappingPreservesLegacyDuplicateLocations(t *testing.T) {
+	runtime, _ := newTargetAccessRuntime(t)
+	mapping, err := runtime.protoToMapping(t.Context(), &managementproto.ProxyMapping{
+		Id: "legacy-service", AccountId: "account", Domain: targetAccessDomain,
+		Path: []*managementproto.PathMapping{
+			{Path: "/", Target: "http://first.internal"},
+			{Path: "/", Target: "https://second.internal"},
+			{Path: "", Target: "http://empty.internal"},
+		},
+	})
+	require.NoError(t, err)
+	require.Len(t, mapping.Paths, 2, "legacy empty and slash locations must remain distinct")
+	assert.Equal(t, "second.internal", mapping.Paths["/"].URL.Host,
+		"legacy duplicate locations must retain last-entry-wins behavior")
+	assert.Equal(t, "empty.internal", mapping.Paths[""].URL.Host)
+}
+
+func TestProtoToMappingRejectsDuplicateLocationsWhenAccessControlIsActive(t *testing.T) {
+	tests := []struct {
+		name  string
+		paths []*managementproto.PathMapping
+	}{
+		{
+			name: "duplicate action location",
+			paths: []*managementproto.PathMapping{
+				{Path: "/", Target: "http://first.internal"},
+				{Path: "/", Target: "http://second.internal", AccessAction: managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK},
+			},
+		},
+		{
+			name: "root aliases",
+			paths: []*managementproto.PathMapping{
+				{Path: "", Target: "http://first.internal"},
+				{Path: "/", Target: "http://second.internal", AccessAction: managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS},
+			},
+		},
+		{
+			name: "action elsewhere",
+			paths: []*managementproto.PathMapping{
+				{Path: "/", Target: "http://first.internal"},
+				{Path: "/", Target: "http://second.internal"},
+				{Path: "/public", Target: "http://public.internal", AccessAction: managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			runtime, _ := newTargetAccessRuntime(t)
+			_, err := runtime.protoToMapping(t.Context(), &managementproto.ProxyMapping{
+				Id: "guarded-service", AccountId: "account", Domain: targetAccessDomain, Path: tt.paths,
+			})
+			assert.ErrorContains(t, err, `duplicate target location "/"`)
+		})
+	}
+}
+
+func TestModifyHTTPMappingRejectsInvalidReplacement(t *testing.T) {
+	tests := []struct {
+		name   string
+		modify func(*managementproto.ProxyMapping)
+	}{
+		{"unknown action", func(m *managementproto.ProxyMapping) {
+			m.Path[0].AccessAction = managementproto.TargetAccessAction(99)
+		}},
+		{"duplicate locations", func(m *managementproto.ProxyMapping) {
+			m.Path = append(m.Path, &managementproto.PathMapping{Path: "/", Target: "http://127.0.0.1:1"})
+		}},
+		{"duplicate root aliases", func(m *managementproto.ProxyMapping) {
+			m.Path = append(m.Path, &managementproto.PathMapping{Target: "http://127.0.0.1:1"})
+		}},
+		{"nil target", func(m *managementproto.ProxyMapping) {
+			m.Path = append(m.Path, nil)
+		}},
+		{"malformed URL", func(m *managementproto.ProxyMapping) {
+			m.Path[0].Target = "http://["
+		}},
+		{"missing host", func(m *managementproto.ProxyMapping) {
+			m.Path[0].Target = "http:/backend"
+		}},
+		{"unsupported protocol", func(m *managementproto.ProxyMapping) {
+			m.Path[0].Target = "ftp://backend"
+		}},
+		{"private bypass", func(m *managementproto.ProxyMapping) {
+			m.Private = true
+			m.Path[0].AccessAction = managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS
+		}},
+		{"agent network bypass", func(m *managementproto.ProxyMapping) {
+			m.Path[0].AccessAction = managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS
+			m.Path[0].Options = &managementproto.PathTargetOptions{AgentNetwork: true}
+		}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			runtime, handler := newTargetAccessRuntime(t)
+			original := &managementproto.ProxyMapping{
+				Id: "guarded-service", AccountId: "account", Domain: targetAccessDomain,
+				Path: []*managementproto.PathMapping{{
+					Path: "/", Target: "http://127.0.0.1:1",
+					AccessAction: managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK,
+				}},
+			}
+			applyTargetAccessMapping(t, runtime, original)
+			replacement := proto.Clone(original).(*managementproto.ProxyMapping)
+			tt.modify(replacement)
+			require.Error(t, runtime.modifyMapping(t.Context(), replacement))
+			response := targetAccessRequestTo(handler, "/protected", "192.0.2.1:1234", nil)
+			assert.Equal(t, http.StatusNotFound, response.Code,
+				"invalid replacement must withdraw the route instead of retaining a stale policy")
+			require.NoError(t, runtime.modifyMapping(t.Context(), original),
+				"a valid update must reinstall a previously withdrawn route")
+			recovered := targetAccessRequestTo(handler, "/protected", "192.0.2.1:1234", nil)
+			assert.Equal(t, http.StatusForbidden, recovered.Code, "the reinstalled block must be enforced")
+		})
+	}
+}
diff --git a/proxy/target_middleware_revision_test.go b/proxy/target_middleware_revision_test.go
new file mode 100644
index 000000000..7dd5453a2
--- /dev/null
+++ b/proxy/target_middleware_revision_test.go
@@ -0,0 +1,115 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	protobuf "google.golang.org/protobuf/proto"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	guardrail "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+	internalproxy "github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestUpdateMappingBindsMiddlewareRevisionAcrossPolicyUpdates(t *testing.T) {
+	oldUpstream := &targetAccessUpstream{}
+	oldBackend := httptest.NewServer(oldUpstream)
+	t.Cleanup(oldBackend.Close)
+	newUpstream := &targetAccessUpstream{}
+	newBackend := httptest.NewServer(newUpstream)
+	t.Cleanup(newBackend.Close)
+
+	runtime, _ := newTargetAccessRuntime(t)
+	registry := middleware.NewRegistry()
+	require.NoError(t, registry.Register(guardrail.Factory{}))
+	manager := middleware.NewManager(0, nil, runtime.Logger)
+	manager.SetResolver(middleware.NewResolver(registry))
+	manager.SetLiveServiceCheck(runtime.isLiveService)
+	t.Cleanup(manager.InvalidateAll)
+	runtime.middlewareRegistry = registry
+	runtime.middlewareManager = manager
+	runtime.proxy = internalproxy.NewReverseProxy(http.DefaultTransport, "auto", nil, runtime.Logger,
+		internalproxy.WithMiddlewareManager(manager))
+	handler := runtime.auth.Protect(runtime.proxy)
+
+	mapping := &proto.ProxyMapping{
+		Id: "middleware-revision-service", AccountId: targetAccessAccountID, Domain: targetAccessDomain,
+		Path: []*proto.PathMapping{{
+			Path: "/", Target: oldBackend.URL,
+			Options: &proto.PathTargetOptions{
+				AgentNetwork:   true,
+				DirectUpstream: true,
+				Middlewares: []*proto.MiddlewareConfig{{
+					Id:         guardrail.ID,
+					Slot:       proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST,
+					Enabled:    true,
+					ConfigJson: []byte(`{"provider_allowlists":{"provider-1":["allowed-model"]}}`),
+				}},
+			},
+		}},
+	}
+	applyTargetAccessMapping(t, runtime, mapping)
+	initial := targetAccessRequestTo(handler, "/v1/chat/completions", "192.0.2.1:1234", nil)
+	require.Equal(t, http.StatusForbidden, initial.Code,
+		"the original guardrail must reject a request with no known model")
+	require.Empty(t, oldUpstream.snapshot(), "the original policy must prevent upstream forwarding")
+
+	// Hold the request at the auth/proxy boundary so updateMapping runs after
+	// authorization has pinned the route but before its middleware is selected.
+	captureAuthorizedRequest := func() *http.Request {
+		var pinned *http.Request
+		capture := runtime.auth.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			pinned = r
+			w.WriteHeader(http.StatusNoContent)
+		}))
+		response := targetAccessRequestTo(capture, "/v1/chat/completions", "192.0.2.1:1234", nil)
+		require.Equal(t, http.StatusNoContent, response.Code, "auth must pass the resolved request to the proxy")
+		require.NotNil(t, pinned, "the request must be captured after auth target resolution")
+		return pinned
+	}
+	staleRequest := captureAuthorizedRequest()
+	oldChain := manager.ChainFor(mapping.GetId(), "/")
+	require.NotNil(t, oldChain, "updateMapping must install the original guardrail chain")
+
+	replacement := protobuf.Clone(mapping).(*proto.ProxyMapping)
+	replacement.Path[0].Target = newBackend.URL
+	replacement.Path[0].Options.Middlewares[0].ConfigJson = []byte(`{}`)
+	applyTargetAccessMapping(t, runtime, replacement)
+	newChain := manager.ChainFor(mapping.GetId(), "/")
+	require.NotNil(t, newChain, "updateMapping must install the replacement guardrail chain")
+	require.NotSame(t, oldChain, newChain, "a policy update must replace the middleware chain")
+
+	staleResponse := httptest.NewRecorder()
+	runtime.proxy.ServeHTTP(staleResponse, staleRequest)
+	assert.Equal(t, http.StatusServiceUnavailable, staleResponse.Code,
+		"a request authorized against the old target must not execute the replacement policy")
+	assert.Equal(t, "no-store", staleResponse.Header().Get("Cache-Control"), "stale policy failures must not be cached")
+	assert.Empty(t, oldUpstream.snapshot(), "a replacement policy must never authorize the old upstream")
+	assert.Empty(t, newUpstream.snapshot(), "a stale request must not forward to the replacement upstream")
+
+	fresh := targetAccessRequestTo(handler, "/v1/chat/completions", "192.0.2.1:1234", nil)
+	require.Equal(t, http.StatusOK, fresh.Code, "fresh auth resolution must use the replacement middleware revision")
+	require.Len(t, newUpstream.snapshot(), 1, "the replacement target must receive the fresh request")
+
+	// Provider changes rebuild middleware instances without replacing the
+	// service mapping, so requests pinned to its current revision stay valid.
+	currentRequest := captureAuthorizedRequest()
+	manager.InvalidateMiddleware(guardrail.ID)
+	refreshedChain := manager.ChainFor(mapping.GetId(), "/")
+	require.NotNil(t, refreshedChain, "a live service must retain its chain after provider refresh")
+	require.NotSame(t, newChain, refreshedChain, "provider refresh must rebuild the concrete guardrail chain")
+
+	currentResponse := httptest.NewRecorder()
+	runtime.proxy.ServeHTTP(currentResponse, currentRequest)
+	assert.Equal(t, http.StatusOK, currentResponse.Code, "provider refresh must preserve the current request's revision")
+	assert.Len(t, newUpstream.snapshot(), 2, "the current request must reach the replacement target after refresh")
+
+	afterRefresh := targetAccessRequestTo(handler, "/v1/chat/completions", "192.0.2.1:1234", nil)
+	assert.Equal(t, http.StatusOK, afterRefresh.Code, "new requests must continue after provider refresh")
+	assert.Len(t, newUpstream.snapshot(), 3, "fresh requests must use the rebuilt chain and current target")
+	assert.Empty(t, oldUpstream.snapshot(), "no request may reach the retired target")
+}
diff --git a/proxy/trustedproxy.go b/proxy/trustedproxy.go
deleted file mode 100644
index 3a1f0ad37..000000000
--- a/proxy/trustedproxy.go
+++ /dev/null
@@ -1,43 +0,0 @@
-package proxy
-
-import (
-	"fmt"
-	"net/netip"
-	"strings"
-)
-
-// ParseTrustedProxies parses a comma-separated list of CIDR prefixes or bare IPs
-// into a slice of netip.Prefix values suitable for trusted proxy configuration.
-// Bare IPs are converted to single-host prefixes (/32 or /128).
-func ParseTrustedProxies(raw string) ([]netip.Prefix, error) {
-	if raw == "" {
-		return nil, nil
-	}
-
-	parts := strings.Split(raw, ",")
-	prefixes := make([]netip.Prefix, 0, len(parts))
-	for _, part := range parts {
-		part = strings.TrimSpace(part)
-		if part == "" {
-			continue
-		}
-
-		prefix, err := netip.ParsePrefix(part)
-		if err == nil {
-			prefixes = append(prefixes, prefix)
-			continue
-		}
-
-		addr, addrErr := netip.ParseAddr(part)
-		if addrErr != nil {
-			return nil, fmt.Errorf("parse trusted proxy %q: not a valid CIDR or IP: %w", part, addrErr)
-		}
-
-		bits := 32
-		if addr.Is6() {
-			bits = 128
-		}
-		prefixes = append(prefixes, netip.PrefixFrom(addr, bits))
-	}
-	return prefixes, nil
-}
diff --git a/proxy/trustedproxy_test.go b/proxy/trustedproxy_test.go
deleted file mode 100644
index 974e56863..000000000
--- a/proxy/trustedproxy_test.go
+++ /dev/null
@@ -1,90 +0,0 @@
-package proxy
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParseTrustedProxies(t *testing.T) {
-	tests := []struct {
-		name    string
-		raw     string
-		want    []netip.Prefix
-		wantErr bool
-	}{
-		{
-			name: "empty string returns nil",
-			raw:  "",
-			want: nil,
-		},
-		{
-			name: "single CIDR",
-			raw:  "10.0.0.0/8",
-			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
-		},
-		{
-			name: "single bare IPv4",
-			raw:  "1.2.3.4",
-			want: []netip.Prefix{netip.MustParsePrefix("1.2.3.4/32")},
-		},
-		{
-			name: "single bare IPv6",
-			raw:  "::1",
-			want: []netip.Prefix{netip.MustParsePrefix("::1/128")},
-		},
-		{
-			name: "comma-separated CIDRs",
-			raw:  "10.0.0.0/8, 192.168.1.0/24",
-			want: []netip.Prefix{
-				netip.MustParsePrefix("10.0.0.0/8"),
-				netip.MustParsePrefix("192.168.1.0/24"),
-			},
-		},
-		{
-			name: "mixed CIDRs and bare IPs",
-			raw:  "10.0.0.0/8, 1.2.3.4, fd00::/8",
-			want: []netip.Prefix{
-				netip.MustParsePrefix("10.0.0.0/8"),
-				netip.MustParsePrefix("1.2.3.4/32"),
-				netip.MustParsePrefix("fd00::/8"),
-			},
-		},
-		{
-			name: "whitespace around entries",
-			raw:  "  10.0.0.0/8 , 192.168.0.0/16  ",
-			want: []netip.Prefix{
-				netip.MustParsePrefix("10.0.0.0/8"),
-				netip.MustParsePrefix("192.168.0.0/16"),
-			},
-		},
-		{
-			name: "trailing comma produces no extra entry",
-			raw:  "10.0.0.0/8,",
-			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
-		},
-		{
-			name:    "invalid entry",
-			raw:     "not-an-ip",
-			wantErr: true,
-		},
-		{
-			name:    "partially invalid",
-			raw:     "10.0.0.0/8, garbage",
-			wantErr: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := ParseTrustedProxies(tt.raw)
-			if tt.wantErr {
-				require.Error(t, err)
-				return
-			}
-			require.NoError(t, err)
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}
diff --git a/proxy/web/dist/assets/index.js b/proxy/web/dist/assets/index.js
index 9ce3e4394..0a34a21d4 100644
--- a/proxy/web/dist/assets/index.js
+++ b/proxy/web/dist/assets/index.js
@@ -1,9 +1,9 @@
-(function(){const v=document.createElement("link").relList;if(v&&v.supports&&v.supports("modulepreload"))return;for(const _ of document.querySelectorAll('link[rel="modulepreload"]'))f(_);new MutationObserver(_=>{for(const O of _)if(O.type==="childList")for(const D of O.addedNodes)D.tagName==="LINK"&&D.rel==="modulepreload"&&f(D)}).observe(document,{childList:!0,subtree:!0});function S(_){const O={};return _.integrity&&(O.integrity=_.integrity),_.referrerPolicy&&(O.referrerPolicy=_.referrerPolicy),_.crossOrigin==="use-credentials"?O.credentials="include":_.crossOrigin==="anonymous"?O.credentials="omit":O.credentials="same-origin",O}function f(_){if(_.ep)return;_.ep=!0;const O=S(_);fetch(_.href,O)}})();var Sf={exports:{}},Du={};var Yd;function jm(){if(Yd)return Du;Yd=1;var r=Symbol.for("react.transitional.element"),v=Symbol.for("react.fragment");function S(f,_,O){var D=null;if(O!==void 0&&(D=""+O),_.key!==void 0&&(D=""+_.key),"key"in _){O={};for(var U in _)U!=="key"&&(O[U]=_[U])}else O=_;return _=O.ref,{$$typeof:r,type:f,key:D,ref:_!==void 0?_:null,props:O}}return Du.Fragment=v,Du.jsx=S,Du.jsxs=S,Du}var Gd;function Rm(){return Gd||(Gd=1,Sf.exports=jm()),Sf.exports}var A=Rm(),xf={exports:{}},K={};var Xd;function Hm(){if(Xd)return K;Xd=1;var r=Symbol.for("react.transitional.element"),v=Symbol.for("react.portal"),S=Symbol.for("react.fragment"),f=Symbol.for("react.strict_mode"),_=Symbol.for("react.profiler"),O=Symbol.for("react.consumer"),D=Symbol.for("react.context"),U=Symbol.for("react.forward_ref"),N=Symbol.for("react.suspense"),p=Symbol.for("react.memo"),R=Symbol.for("react.lazy"),H=Symbol.for("react.activity"),V=Symbol.iterator;function st(s){return s===null||typeof s!="object"?null:(s=V&&s[V]||s["@@iterator"],typeof s=="function"?s:null)}var ct={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},G=Object.assign,Q={};function L(s,M,j){this.props=s,this.context=M,this.refs=Q,this.updater=j||ct}L.prototype.isReactComponent={},L.prototype.setState=function(s,M){if(typeof s!="object"&&typeof s!="function"&&s!=null)throw Error("takes an object of state variables to update or a function which returns an object of state variables.");this.updater.enqueueSetState(this,s,M,"setState")},L.prototype.forceUpdate=function(s){this.updater.enqueueForceUpdate(this,s,"forceUpdate")};function gt(){}gt.prototype=L.prototype;function zt(s,M,j){this.props=s,this.context=M,this.refs=Q,this.updater=j||ct}var _t=zt.prototype=new gt;_t.constructor=zt,G(_t,L.prototype),_t.isPureReactComponent=!0;var it=Array.isArray;function Ot(){}var J={H:null,A:null,T:null,S:null},Rt=Object.prototype.hasOwnProperty;function It(s,M,j){var q=j.ref;return{$$typeof:r,type:s,key:M,ref:q!==void 0?q:null,props:j}}function jl(s,M){return It(s.type,M,s.props)}function Pt(s){return typeof s=="object"&&s!==null&&s.$$typeof===r}function I(s){var M={"=":"=0",":":"=2"};return"$"+s.replace(/[=:]/g,function(j){return M[j]})}var Rl=/\/+/g;function tl(s,M){return typeof s=="object"&&s!==null&&s.key!=null?I(""+s.key):M.toString(36)}function ll(s){switch(s.status){case"fulfilled":return s.value;case"rejected":throw s.reason;default:switch(typeof s.status=="string"?s.then(Ot,Ot):(s.status="pending",s.then(function(M){s.status==="pending"&&(s.status="fulfilled",s.value=M)},function(M){s.status==="pending"&&(s.status="rejected",s.reason=M)})),s.status){case"fulfilled":return s.value;case"rejected":throw s.reason}}throw s}function x(s,M,j,q,k){var P=typeof s;(P==="undefined"||P==="boolean")&&(s=null);var yt=!1;if(s===null)yt=!0;else switch(P){case"bigint":case"string":case"number":yt=!0;break;case"object":switch(s.$$typeof){case r:case v:yt=!0;break;case R:return yt=s._init,x(yt(s._payload),M,j,q,k)}}if(yt)return k=k(s),yt=q===""?"."+tl(s,0):q,it(k)?(j="",yt!=null&&(j=yt.replace(Rl,"$&/")+"/"),x(k,M,j,"",function(qa){return qa})):k!=null&&(Pt(k)&&(k=jl(k,j+(k.key==null||s&&s.key===k.key?"":(""+k.key).replace(Rl,"$&/")+"/")+yt)),M.push(k)),1;yt=0;var Wt=q===""?".":q+":";if(it(s))for(var Ut=0;Ut<s.length;Ut++)q=s[Ut],P=Wt+tl(q,Ut),yt+=x(q,M,j,P,k);else if(Ut=st(s),typeof Ut=="function")for(s=Ut.call(s),Ut=0;!(q=s.next()).done;)q=q.value,P=Wt+tl(q,Ut++),yt+=x(q,M,j,P,k);else if(P==="object"){if(typeof s.then=="function")return x(ll(s),M,j,q,k);throw M=String(s),Error("Objects are not valid as a React child (found: "+(M==="[object Object]"?"object with keys {"+Object.keys(s).join(", ")+"}":M)+"). If you meant to render a collection of children, use an array instead.")}return yt}function C(s,M,j){if(s==null)return s;var q=[],k=0;return x(s,q,"","",function(P){return M.call(j,P,k++)}),q}function Z(s){if(s._status===-1){var M=s._result;M=M(),M.then(function(j){(s._status===0||s._status===-1)&&(s._status=1,s._result=j)},function(j){(s._status===0||s._status===-1)&&(s._status=2,s._result=j)}),s._status===-1&&(s._status=0,s._result=M)}if(s._status===1)return s._result.default;throw s._result}var nt=typeof reportError=="function"?reportError:function(s){if(typeof window=="object"&&typeof window.ErrorEvent=="function"){var M=new window.ErrorEvent("error",{bubbles:!0,cancelable:!0,message:typeof s=="object"&&s!==null&&typeof s.message=="string"?String(s.message):String(s),error:s});if(!window.dispatchEvent(M))return}else if(typeof process=="object"&&typeof process.emit=="function"){process.emit("uncaughtException",s);return}console.error(s)},dt={map:C,forEach:function(s,M,j){C(s,function(){M.apply(this,arguments)},j)},count:function(s){var M=0;return C(s,function(){M++}),M},toArray:function(s){return C(s,function(M){return M})||[]},only:function(s){if(!Pt(s))throw Error("React.Children.only expected to receive a single React element child.");return s}};return K.Activity=H,K.Children=dt,K.Component=L,K.Fragment=S,K.Profiler=_,K.PureComponent=zt,K.StrictMode=f,K.Suspense=N,K.__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE=J,K.__COMPILER_RUNTIME={__proto__:null,c:function(s){return J.H.useMemoCache(s)}},K.cache=function(s){return function(){return s.apply(null,arguments)}},K.cacheSignal=function(){return null},K.cloneElement=function(s,M,j){if(s==null)throw Error("The argument must be a React element, but you passed "+s+".");var q=G({},s.props),k=s.key;if(M!=null)for(P in M.key!==void 0&&(k=""+M.key),M)!Rt.call(M,P)||P==="key"||P==="__self"||P==="__source"||P==="ref"&&M.ref===void 0||(q[P]=M[P]);var P=arguments.length-2;if(P===1)q.children=j;else if(1<P){for(var yt=Array(P),Wt=0;Wt<P;Wt++)yt[Wt]=arguments[Wt+2];q.children=yt}return It(s.type,k,q)},K.createContext=function(s){return s={$$typeof:D,_currentValue:s,_currentValue2:s,_threadCount:0,Provider:null,Consumer:null},s.Provider=s,s.Consumer={$$typeof:O,_context:s},s},K.createElement=function(s,M,j){var q,k={},P=null;if(M!=null)for(q in M.key!==void 0&&(P=""+M.key),M)Rt.call(M,q)&&q!=="key"&&q!=="__self"&&q!=="__source"&&(k[q]=M[q]);var yt=arguments.length-2;if(yt===1)k.children=j;else if(1<yt){for(var Wt=Array(yt),Ut=0;Ut<yt;Ut++)Wt[Ut]=arguments[Ut+2];k.children=Wt}if(s&&s.defaultProps)for(q in yt=s.defaultProps,yt)k[q]===void 0&&(k[q]=yt[q]);return It(s,P,k)},K.createRef=function(){return{current:null}},K.forwardRef=function(s){return{$$typeof:U,render:s}},K.isValidElement=Pt,K.lazy=function(s){return{$$typeof:R,_payload:{_status:-1,_result:s},_init:Z}},K.memo=function(s,M){return{$$typeof:p,type:s,compare:M===void 0?null:M}},K.startTransition=function(s){var M=J.T,j={};J.T=j;try{var q=s(),k=J.S;k!==null&&k(j,q),typeof q=="object"&&q!==null&&typeof q.then=="function"&&q.then(Ot,nt)}catch(P){nt(P)}finally{M!==null&&j.types!==null&&(M.types=j.types),J.T=M}},K.unstable_useCacheRefresh=function(){return J.H.useCacheRefresh()},K.use=function(s){return J.H.use(s)},K.useActionState=function(s,M,j){return J.H.useActionState(s,M,j)},K.useCallback=function(s,M){return J.H.useCallback(s,M)},K.useContext=function(s){return J.H.useContext(s)},K.useDebugValue=function(){},K.useDeferredValue=function(s,M){return J.H.useDeferredValue(s,M)},K.useEffect=function(s,M){return J.H.useEffect(s,M)},K.useEffectEvent=function(s){return J.H.useEffectEvent(s)},K.useId=function(){return J.H.useId()},K.useImperativeHandle=function(s,M,j){return J.H.useImperativeHandle(s,M,j)},K.useInsertionEffect=function(s,M){return J.H.useInsertionEffect(s,M)},K.useLayoutEffect=function(s,M){return J.H.useLayoutEffect(s,M)},K.useMemo=function(s,M){return J.H.useMemo(s,M)},K.useOptimistic=function(s,M){return J.H.useOptimistic(s,M)},K.useReducer=function(s,M,j){return J.H.useReducer(s,M,j)},K.useRef=function(s){return J.H.useRef(s)},K.useState=function(s){return J.H.useState(s)},K.useSyncExternalStore=function(s,M,j){return J.H.useSyncExternalStore(s,M,j)},K.useTransition=function(){return J.H.useTransition()},K.version="19.2.4",K}var Qd;function Rf(){return Qd||(Qd=1,xf.exports=Hm()),xf.exports}var xt=Rf(),zf={exports:{}},Uu={},Tf={exports:{}},Ef={};var Zd;function Bm(){return Zd||(Zd=1,(function(r){function v(x,C){var Z=x.length;x.push(C);t:for(;0<Z;){var nt=Z-1>>>1,dt=x[nt];if(0<_(dt,C))x[nt]=C,x[Z]=dt,Z=nt;else break t}}function S(x){return x.length===0?null:x[0]}function f(x){if(x.length===0)return null;var C=x[0],Z=x.pop();if(Z!==C){x[0]=Z;t:for(var nt=0,dt=x.length,s=dt>>>1;nt<s;){var M=2*(nt+1)-1,j=x[M],q=M+1,k=x[q];if(0>_(j,Z))q<dt&&0>_(k,j)?(x[nt]=k,x[q]=Z,nt=q):(x[nt]=j,x[M]=Z,nt=M);else if(q<dt&&0>_(k,Z))x[nt]=k,x[q]=Z,nt=q;else break t}}return C}function _(x,C){var Z=x.sortIndex-C.sortIndex;return Z!==0?Z:x.id-C.id}if(r.unstable_now=void 0,typeof performance=="object"&&typeof performance.now=="function"){var O=performance;r.unstable_now=function(){return O.now()}}else{var D=Date,U=D.now();r.unstable_now=function(){return D.now()-U}}var N=[],p=[],R=1,H=null,V=3,st=!1,ct=!1,G=!1,Q=!1,L=typeof setTimeout=="function"?setTimeout:null,gt=typeof clearTimeout=="function"?clearTimeout:null,zt=typeof setImmediate<"u"?setImmediate:null;function _t(x){for(var C=S(p);C!==null;){if(C.callback===null)f(p);else if(C.startTime<=x)f(p),C.sortIndex=C.expirationTime,v(N,C);else break;C=S(p)}}function it(x){if(G=!1,_t(x),!ct)if(S(N)!==null)ct=!0,Ot||(Ot=!0,I());else{var C=S(p);C!==null&&ll(it,C.startTime-x)}}var Ot=!1,J=-1,Rt=5,It=-1;function jl(){return Q?!0:!(r.unstable_now()-It<Rt)}function Pt(){if(Q=!1,Ot){var x=r.unstable_now();It=x;var C=!0;try{t:{ct=!1,G&&(G=!1,gt(J),J=-1),st=!0;var Z=V;try{l:{for(_t(x),H=S(N);H!==null&&!(H.expirationTime>x&&jl());){var nt=H.callback;if(typeof nt=="function"){H.callback=null,V=H.priorityLevel;var dt=nt(H.expirationTime<=x);if(x=r.unstable_now(),typeof dt=="function"){H.callback=dt,_t(x),C=!0;break l}H===S(N)&&f(N),_t(x)}else f(N);H=S(N)}if(H!==null)C=!0;else{var s=S(p);s!==null&&ll(it,s.startTime-x),C=!1}}break t}finally{H=null,V=Z,st=!1}C=void 0}}finally{C?I():Ot=!1}}}var I;if(typeof zt=="function")I=function(){zt(Pt)};else if(typeof MessageChannel<"u"){var Rl=new MessageChannel,tl=Rl.port2;Rl.port1.onmessage=Pt,I=function(){tl.postMessage(null)}}else I=function(){L(Pt,0)};function ll(x,C){J=L(function(){x(r.unstable_now())},C)}r.unstable_IdlePriority=5,r.unstable_ImmediatePriority=1,r.unstable_LowPriority=4,r.unstable_NormalPriority=3,r.unstable_Profiling=null,r.unstable_UserBlockingPriority=2,r.unstable_cancelCallback=function(x){x.callback=null},r.unstable_forceFrameRate=function(x){0>x||125<x?console.error("forceFrameRate takes a positive int between 0 and 125, forcing frame rates higher than 125 fps is not supported"):Rt=0<x?Math.floor(1e3/x):5},r.unstable_getCurrentPriorityLevel=function(){return V},r.unstable_next=function(x){switch(V){case 1:case 2:case 3:var C=3;break;default:C=V}var Z=V;V=C;try{return x()}finally{V=Z}},r.unstable_requestPaint=function(){Q=!0},r.unstable_runWithPriority=function(x,C){switch(x){case 1:case 2:case 3:case 4:case 5:break;default:x=3}var Z=V;V=x;try{return C()}finally{V=Z}},r.unstable_scheduleCallback=function(x,C,Z){var nt=r.unstable_now();switch(typeof Z=="object"&&Z!==null?(Z=Z.delay,Z=typeof Z=="number"&&0<Z?nt+Z:nt):Z=nt,x){case 1:var dt=-1;break;case 2:dt=250;break;case 5:dt=1073741823;break;case 4:dt=1e4;break;default:dt=5e3}return dt=Z+dt,x={id:R++,callback:C,priorityLevel:x,startTime:Z,expirationTime:dt,sortIndex:-1},Z>nt?(x.sortIndex=Z,v(p,x),S(N)===null&&x===S(p)&&(G?(gt(J),J=-1):G=!0,ll(it,Z-nt))):(x.sortIndex=dt,v(N,x),ct||st||(ct=!0,Ot||(Ot=!0,I()))),x},r.unstable_shouldYield=jl,r.unstable_wrapCallback=function(x){var C=V;return function(){var Z=V;V=C;try{return x.apply(this,arguments)}finally{V=Z}}}})(Ef)),Ef}var wd;function qm(){return wd||(wd=1,Tf.exports=Bm()),Tf.exports}var Af={exports:{}},kt={};var Ld;function Ym(){if(Ld)return kt;Ld=1;var r=Rf();function v(N){var p="https://react.dev/errors/"+N;if(1<arguments.length){p+="?args[]="+encodeURIComponent(arguments[1]);for(var R=2;R<arguments.length;R++)p+="&args[]="+encodeURIComponent(arguments[R])}return"Minified React error #"+N+"; visit "+p+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}function S(){}var f={d:{f:S,r:function(){throw Error(v(522))},D:S,C:S,L:S,m:S,X:S,S,M:S},p:0,findDOMNode:null},_=Symbol.for("react.portal");function O(N,p,R){var H=3<arguments.length&&arguments[3]!==void 0?arguments[3]:null;return{$$typeof:_,key:H==null?null:""+H,children:N,containerInfo:p,implementation:R}}var D=r.__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE;function U(N,p){if(N==="font")return"";if(typeof p=="string")return p==="use-credentials"?p:""}return kt.__DOM_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE=f,kt.createPortal=function(N,p){var R=2<arguments.length&&arguments[2]!==void 0?arguments[2]:null;if(!p||p.nodeType!==1&&p.nodeType!==9&&p.nodeType!==11)throw Error(v(299));return O(N,p,null,R)},kt.flushSync=function(N){var p=D.T,R=f.p;try{if(D.T=null,f.p=2,N)return N()}finally{D.T=p,f.p=R,f.d.f()}},kt.preconnect=function(N,p){typeof N=="string"&&(p?(p=p.crossOrigin,p=typeof p=="string"?p==="use-credentials"?p:"":void 0):p=null,f.d.C(N,p))},kt.prefetchDNS=function(N){typeof N=="string"&&f.d.D(N)},kt.preinit=function(N,p){if(typeof N=="string"&&p&&typeof p.as=="string"){var R=p.as,H=U(R,p.crossOrigin),V=typeof p.integrity=="string"?p.integrity:void 0,st=typeof p.fetchPriority=="string"?p.fetchPriority:void 0;R==="style"?f.d.S(N,typeof p.precedence=="string"?p.precedence:void 0,{crossOrigin:H,integrity:V,fetchPriority:st}):R==="script"&&f.d.X(N,{crossOrigin:H,integrity:V,fetchPriority:st,nonce:typeof p.nonce=="string"?p.nonce:void 0})}},kt.preinitModule=function(N,p){if(typeof N=="string")if(typeof p=="object"&&p!==null){if(p.as==null||p.as==="script"){var R=U(p.as,p.crossOrigin);f.d.M(N,{crossOrigin:R,integrity:typeof p.integrity=="string"?p.integrity:void 0,nonce:typeof p.nonce=="string"?p.nonce:void 0})}}else p==null&&f.d.M(N)},kt.preload=function(N,p){if(typeof N=="string"&&typeof p=="object"&&p!==null&&typeof p.as=="string"){var R=p.as,H=U(R,p.crossOrigin);f.d.L(N,R,{crossOrigin:H,integrity:typeof p.integrity=="string"?p.integrity:void 0,nonce:typeof p.nonce=="string"?p.nonce:void 0,type:typeof p.type=="string"?p.type:void 0,fetchPriority:typeof p.fetchPriority=="string"?p.fetchPriority:void 0,referrerPolicy:typeof p.referrerPolicy=="string"?p.referrerPolicy:void 0,imageSrcSet:typeof p.imageSrcSet=="string"?p.imageSrcSet:void 0,imageSizes:typeof p.imageSizes=="string"?p.imageSizes:void 0,media:typeof p.media=="string"?p.media:void 0})}},kt.preloadModule=function(N,p){if(typeof N=="string")if(p){var R=U(p.as,p.crossOrigin);f.d.m(N,{as:typeof p.as=="string"&&p.as!=="script"?p.as:void 0,crossOrigin:R,integrity:typeof p.integrity=="string"?p.integrity:void 0})}else f.d.m(N)},kt.requestFormReset=function(N){f.d.r(N)},kt.unstable_batchedUpdates=function(N,p){return N(p)},kt.useFormState=function(N,p,R){return D.H.useFormState(N,p,R)},kt.useFormStatus=function(){return D.H.useHostTransitionStatus()},kt.version="19.2.4",kt}var Vd;function Gm(){if(Vd)return Af.exports;Vd=1;function r(){if(!(typeof __REACT_DEVTOOLS_GLOBAL_HOOK__>"u"||typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE!="function"))try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(r)}catch(v){console.error(v)}}return r(),Af.exports=Ym(),Af.exports}var Kd;function Xm(){if(Kd)return Uu;Kd=1;var r=qm(),v=Rf(),S=Gm();function f(t){var l="https://react.dev/errors/"+t;if(1<arguments.length){l+="?args[]="+encodeURIComponent(arguments[1]);for(var e=2;e<arguments.length;e++)l+="&args[]="+encodeURIComponent(arguments[e])}return"Minified React error #"+t+"; visit "+l+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}function _(t){return!(!t||t.nodeType!==1&&t.nodeType!==9&&t.nodeType!==11)}function O(t){var l=t,e=t;if(t.alternate)for(;l.return;)l=l.return;else{t=l;do l=t,(l.flags&4098)!==0&&(e=l.return),t=l.return;while(t)}return l.tag===3?e:null}function D(t){if(t.tag===13){var l=t.memoizedState;if(l===null&&(t=t.alternate,t!==null&&(l=t.memoizedState)),l!==null)return l.dehydrated}return null}function U(t){if(t.tag===31){var l=t.memoizedState;if(l===null&&(t=t.alternate,t!==null&&(l=t.memoizedState)),l!==null)return l.dehydrated}return null}function N(t){if(O(t)!==t)throw Error(f(188))}function p(t){var l=t.alternate;if(!l){if(l=O(t),l===null)throw Error(f(188));return l!==t?null:t}for(var e=t,a=l;;){var u=e.return;if(u===null)break;var n=u.alternate;if(n===null){if(a=u.return,a!==null){e=a;continue}break}if(u.child===n.child){for(n=u.child;n;){if(n===e)return N(u),t;if(n===a)return N(u),l;n=n.sibling}throw Error(f(188))}if(e.return!==a.return)e=u,a=n;else{for(var i=!1,c=u.child;c;){if(c===e){i=!0,e=u,a=n;break}if(c===a){i=!0,a=u,e=n;break}c=c.sibling}if(!i){for(c=n.child;c;){if(c===e){i=!0,e=n,a=u;break}if(c===a){i=!0,a=n,e=u;break}c=c.sibling}if(!i)throw Error(f(189))}}if(e.alternate!==a)throw Error(f(190))}if(e.tag!==3)throw Error(f(188));return e.stateNode.current===e?t:l}function R(t){var l=t.tag;if(l===5||l===26||l===27||l===6)return t;for(t=t.child;t!==null;){if(l=R(t),l!==null)return l;t=t.sibling}return null}var H=Object.assign,V=Symbol.for("react.element"),st=Symbol.for("react.transitional.element"),ct=Symbol.for("react.portal"),G=Symbol.for("react.fragment"),Q=Symbol.for("react.strict_mode"),L=Symbol.for("react.profiler"),gt=Symbol.for("react.consumer"),zt=Symbol.for("react.context"),_t=Symbol.for("react.forward_ref"),it=Symbol.for("react.suspense"),Ot=Symbol.for("react.suspense_list"),J=Symbol.for("react.memo"),Rt=Symbol.for("react.lazy"),It=Symbol.for("react.activity"),jl=Symbol.for("react.memo_cache_sentinel"),Pt=Symbol.iterator;function I(t){return t===null||typeof t!="object"?null:(t=Pt&&t[Pt]||t["@@iterator"],typeof t=="function"?t:null)}var Rl=Symbol.for("react.client.reference");function tl(t){if(t==null)return null;if(typeof t=="function")return t.$$typeof===Rl?null:t.displayName||t.name||null;if(typeof t=="string")return t;switch(t){case G:return"Fragment";case L:return"Profiler";case Q:return"StrictMode";case it:return"Suspense";case Ot:return"SuspenseList";case It:return"Activity"}if(typeof t=="object")switch(t.$$typeof){case ct:return"Portal";case zt:return t.displayName||"Context";case gt:return(t._context.displayName||"Context")+".Consumer";case _t:var l=t.render;return t=t.displayName,t||(t=l.displayName||l.name||"",t=t!==""?"ForwardRef("+t+")":"ForwardRef"),t;case J:return l=t.displayName||null,l!==null?l:tl(t.type)||"Memo";case Rt:l=t._payload,t=t._init;try{return tl(t(l))}catch{}}return null}var ll=Array.isArray,x=v.__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE,C=S.__DOM_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE,Z={pending:!1,data:null,method:null,action:null},nt=[],dt=-1;function s(t){return{current:t}}function M(t){0>dt||(t.current=nt[dt],nt[dt]=null,dt--)}function j(t,l){dt++,nt[dt]=t.current,t.current=l}var q=s(null),k=s(null),P=s(null),yt=s(null);function Wt(t,l){switch(j(P,l),j(k,t),j(q,null),l.nodeType){case 9:case 11:t=(t=l.documentElement)&&(t=t.namespaceURI)?cd(t):0;break;default:if(t=l.tagName,l=l.namespaceURI)l=cd(l),t=fd(l,t);else switch(t){case"svg":t=1;break;case"math":t=2;break;default:t=0}}M(q),j(q,t)}function Ut(){M(q),M(k),M(P)}function qa(t){t.memoizedState!==null&&j(yt,t);var l=q.current,e=fd(l,t.type);l!==e&&(j(k,t),j(q,e))}function Hu(t){k.current===t&&(M(q),M(k)),yt.current===t&&(M(yt),Mu._currentValue=Z)}var li,Bf;function Ue(t){if(li===void 0)try{throw Error()}catch(e){var l=e.stack.trim().match(/\n( *(at )?)/);li=l&&l[1]||"",Bf=-1<e.stack.indexOf(`
+(function(){const v=document.createElement("link").relList;if(v&&v.supports&&v.supports("modulepreload"))return;for(const _ of document.querySelectorAll('link[rel="modulepreload"]'))f(_);new MutationObserver(_=>{for(const O of _)if(O.type==="childList")for(const D of O.addedNodes)D.tagName==="LINK"&&D.rel==="modulepreload"&&f(D)}).observe(document,{childList:!0,subtree:!0});function S(_){const O={};return _.integrity&&(O.integrity=_.integrity),_.referrerPolicy&&(O.referrerPolicy=_.referrerPolicy),_.crossOrigin==="use-credentials"?O.credentials="include":_.crossOrigin==="anonymous"?O.credentials="omit":O.credentials="same-origin",O}function f(_){if(_.ep)return;_.ep=!0;const O=S(_);fetch(_.href,O)}})();var Sf={exports:{}},Du={};var Yd;function jm(){if(Yd)return Du;Yd=1;var r=Symbol.for("react.transitional.element"),v=Symbol.for("react.fragment");function S(f,_,O){var D=null;if(O!==void 0&&(D=""+O),_.key!==void 0&&(D=""+_.key),"key"in _){O={};for(var U in _)U!=="key"&&(O[U]=_[U])}else O=_;return _=O.ref,{$$typeof:r,type:f,key:D,ref:_!==void 0?_:null,props:O}}return Du.Fragment=v,Du.jsx=S,Du.jsxs=S,Du}var Gd;function Rm(){return Gd||(Gd=1,Sf.exports=jm()),Sf.exports}var E=Rm(),xf={exports:{}},K={};var Xd;function Hm(){if(Xd)return K;Xd=1;var r=Symbol.for("react.transitional.element"),v=Symbol.for("react.portal"),S=Symbol.for("react.fragment"),f=Symbol.for("react.strict_mode"),_=Symbol.for("react.profiler"),O=Symbol.for("react.consumer"),D=Symbol.for("react.context"),U=Symbol.for("react.forward_ref"),N=Symbol.for("react.suspense"),p=Symbol.for("react.memo"),R=Symbol.for("react.lazy"),H=Symbol.for("react.activity"),L=Symbol.iterator;function ot(o){return o===null||typeof o!="object"?null:(o=L&&o[L]||o["@@iterator"],typeof o=="function"?o:null)}var ct={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},G=Object.assign,Q={};function V(o,M,j){this.props=o,this.context=M,this.refs=Q,this.updater=j||ct}V.prototype.isReactComponent={},V.prototype.setState=function(o,M){if(typeof o!="object"&&typeof o!="function"&&o!=null)throw Error("takes an object of state variables to update or a function which returns an object of state variables.");this.updater.enqueueSetState(this,o,M,"setState")},V.prototype.forceUpdate=function(o){this.updater.enqueueForceUpdate(this,o,"forceUpdate")};function gt(){}gt.prototype=V.prototype;function zt(o,M,j){this.props=o,this.context=M,this.refs=Q,this.updater=j||ct}var _t=zt.prototype=new gt;_t.constructor=zt,G(_t,V.prototype),_t.isPureReactComponent=!0;var nt=Array.isArray;function Ot(){}var J={H:null,A:null,T:null,S:null},Nt=Object.prototype.hasOwnProperty;function Xt(o,M,j){var q=j.ref;return{$$typeof:r,type:o,key:M,ref:q!==void 0?q:null,props:j}}function pl(o,M){return Xt(o.type,M,o.props)}function Pt(o){return typeof o=="object"&&o!==null&&o.$$typeof===r}function I(o){var M={"=":"=0",":":"=2"};return"$"+o.replace(/[=:]/g,function(j){return M[j]})}var Rl=/\/+/g;function tl(o,M){return typeof o=="object"&&o!==null&&o.key!=null?I(""+o.key):M.toString(36)}function ll(o){switch(o.status){case"fulfilled":return o.value;case"rejected":throw o.reason;default:switch(typeof o.status=="string"?o.then(Ot,Ot):(o.status="pending",o.then(function(M){o.status==="pending"&&(o.status="fulfilled",o.value=M)},function(M){o.status==="pending"&&(o.status="rejected",o.reason=M)})),o.status){case"fulfilled":return o.value;case"rejected":throw o.reason}}throw o}function x(o,M,j,q,k){var P=typeof o;(P==="undefined"||P==="boolean")&&(o=null);var yt=!1;if(o===null)yt=!0;else switch(P){case"bigint":case"string":case"number":yt=!0;break;case"object":switch(o.$$typeof){case r:case v:yt=!0;break;case R:return yt=o._init,x(yt(o._payload),M,j,q,k)}}if(yt)return k=k(o),yt=q===""?"."+tl(o,0):q,nt(k)?(j="",yt!=null&&(j=yt.replace(Rl,"$&/")+"/"),x(k,M,j,"",function(qa){return qa})):k!=null&&(Pt(k)&&(k=pl(k,j+(k.key==null||o&&o.key===k.key?"":(""+k.key).replace(Rl,"$&/")+"/")+yt)),M.push(k)),1;yt=0;var $t=q===""?".":q+":";if(nt(o))for(var Ct=0;Ct<o.length;Ct++)q=o[Ct],P=$t+tl(q,Ct),yt+=x(q,M,j,P,k);else if(Ct=ot(o),typeof Ct=="function")for(o=Ct.call(o),Ct=0;!(q=o.next()).done;)q=q.value,P=$t+tl(q,Ct++),yt+=x(q,M,j,P,k);else if(P==="object"){if(typeof o.then=="function")return x(ll(o),M,j,q,k);throw M=String(o),Error("Objects are not valid as a React child (found: "+(M==="[object Object]"?"object with keys {"+Object.keys(o).join(", ")+"}":M)+"). If you meant to render a collection of children, use an array instead.")}return yt}function C(o,M,j){if(o==null)return o;var q=[],k=0;return x(o,q,"","",function(P){return M.call(j,P,k++)}),q}function Z(o){if(o._status===-1){var M=o._result;M=M(),M.then(function(j){(o._status===0||o._status===-1)&&(o._status=1,o._result=j)},function(j){(o._status===0||o._status===-1)&&(o._status=2,o._result=j)}),o._status===-1&&(o._status=0,o._result=M)}if(o._status===1)return o._result.default;throw o._result}var it=typeof reportError=="function"?reportError:function(o){if(typeof window=="object"&&typeof window.ErrorEvent=="function"){var M=new window.ErrorEvent("error",{bubbles:!0,cancelable:!0,message:typeof o=="object"&&o!==null&&typeof o.message=="string"?String(o.message):String(o),error:o});if(!window.dispatchEvent(M))return}else if(typeof process=="object"&&typeof process.emit=="function"){process.emit("uncaughtException",o);return}console.error(o)},dt={map:C,forEach:function(o,M,j){C(o,function(){M.apply(this,arguments)},j)},count:function(o){var M=0;return C(o,function(){M++}),M},toArray:function(o){return C(o,function(M){return M})||[]},only:function(o){if(!Pt(o))throw Error("React.Children.only expected to receive a single React element child.");return o}};return K.Activity=H,K.Children=dt,K.Component=V,K.Fragment=S,K.Profiler=_,K.PureComponent=zt,K.StrictMode=f,K.Suspense=N,K.__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE=J,K.__COMPILER_RUNTIME={__proto__:null,c:function(o){return J.H.useMemoCache(o)}},K.cache=function(o){return function(){return o.apply(null,arguments)}},K.cacheSignal=function(){return null},K.cloneElement=function(o,M,j){if(o==null)throw Error("The argument must be a React element, but you passed "+o+".");var q=G({},o.props),k=o.key;if(M!=null)for(P in M.key!==void 0&&(k=""+M.key),M)!Nt.call(M,P)||P==="key"||P==="__self"||P==="__source"||P==="ref"&&M.ref===void 0||(q[P]=M[P]);var P=arguments.length-2;if(P===1)q.children=j;else if(1<P){for(var yt=Array(P),$t=0;$t<P;$t++)yt[$t]=arguments[$t+2];q.children=yt}return Xt(o.type,k,q)},K.createContext=function(o){return o={$$typeof:D,_currentValue:o,_currentValue2:o,_threadCount:0,Provider:null,Consumer:null},o.Provider=o,o.Consumer={$$typeof:O,_context:o},o},K.createElement=function(o,M,j){var q,k={},P=null;if(M!=null)for(q in M.key!==void 0&&(P=""+M.key),M)Nt.call(M,q)&&q!=="key"&&q!=="__self"&&q!=="__source"&&(k[q]=M[q]);var yt=arguments.length-2;if(yt===1)k.children=j;else if(1<yt){for(var $t=Array(yt),Ct=0;Ct<yt;Ct++)$t[Ct]=arguments[Ct+2];k.children=$t}if(o&&o.defaultProps)for(q in yt=o.defaultProps,yt)k[q]===void 0&&(k[q]=yt[q]);return Xt(o,P,k)},K.createRef=function(){return{current:null}},K.forwardRef=function(o){return{$$typeof:U,render:o}},K.isValidElement=Pt,K.lazy=function(o){return{$$typeof:R,_payload:{_status:-1,_result:o},_init:Z}},K.memo=function(o,M){return{$$typeof:p,type:o,compare:M===void 0?null:M}},K.startTransition=function(o){var M=J.T,j={};J.T=j;try{var q=o(),k=J.S;k!==null&&k(j,q),typeof q=="object"&&q!==null&&typeof q.then=="function"&&q.then(Ot,it)}catch(P){it(P)}finally{M!==null&&j.types!==null&&(M.types=j.types),J.T=M}},K.unstable_useCacheRefresh=function(){return J.H.useCacheRefresh()},K.use=function(o){return J.H.use(o)},K.useActionState=function(o,M,j){return J.H.useActionState(o,M,j)},K.useCallback=function(o,M){return J.H.useCallback(o,M)},K.useContext=function(o){return J.H.useContext(o)},K.useDebugValue=function(){},K.useDeferredValue=function(o,M){return J.H.useDeferredValue(o,M)},K.useEffect=function(o,M){return J.H.useEffect(o,M)},K.useEffectEvent=function(o){return J.H.useEffectEvent(o)},K.useId=function(){return J.H.useId()},K.useImperativeHandle=function(o,M,j){return J.H.useImperativeHandle(o,M,j)},K.useInsertionEffect=function(o,M){return J.H.useInsertionEffect(o,M)},K.useLayoutEffect=function(o,M){return J.H.useLayoutEffect(o,M)},K.useMemo=function(o,M){return J.H.useMemo(o,M)},K.useOptimistic=function(o,M){return J.H.useOptimistic(o,M)},K.useReducer=function(o,M,j){return J.H.useReducer(o,M,j)},K.useRef=function(o){return J.H.useRef(o)},K.useState=function(o){return J.H.useState(o)},K.useSyncExternalStore=function(o,M,j){return J.H.useSyncExternalStore(o,M,j)},K.useTransition=function(){return J.H.useTransition()},K.version="19.2.4",K}var Qd;function Rf(){return Qd||(Qd=1,xf.exports=Hm()),xf.exports}var xt=Rf(),zf={exports:{}},Uu={},Tf={exports:{}},Af={};var Zd;function Bm(){return Zd||(Zd=1,(function(r){function v(x,C){var Z=x.length;x.push(C);t:for(;0<Z;){var it=Z-1>>>1,dt=x[it];if(0<_(dt,C))x[it]=C,x[Z]=dt,Z=it;else break t}}function S(x){return x.length===0?null:x[0]}function f(x){if(x.length===0)return null;var C=x[0],Z=x.pop();if(Z!==C){x[0]=Z;t:for(var it=0,dt=x.length,o=dt>>>1;it<o;){var M=2*(it+1)-1,j=x[M],q=M+1,k=x[q];if(0>_(j,Z))q<dt&&0>_(k,j)?(x[it]=k,x[q]=Z,it=q):(x[it]=j,x[M]=Z,it=M);else if(q<dt&&0>_(k,Z))x[it]=k,x[q]=Z,it=q;else break t}}return C}function _(x,C){var Z=x.sortIndex-C.sortIndex;return Z!==0?Z:x.id-C.id}if(r.unstable_now=void 0,typeof performance=="object"&&typeof performance.now=="function"){var O=performance;r.unstable_now=function(){return O.now()}}else{var D=Date,U=D.now();r.unstable_now=function(){return D.now()-U}}var N=[],p=[],R=1,H=null,L=3,ot=!1,ct=!1,G=!1,Q=!1,V=typeof setTimeout=="function"?setTimeout:null,gt=typeof clearTimeout=="function"?clearTimeout:null,zt=typeof setImmediate<"u"?setImmediate:null;function _t(x){for(var C=S(p);C!==null;){if(C.callback===null)f(p);else if(C.startTime<=x)f(p),C.sortIndex=C.expirationTime,v(N,C);else break;C=S(p)}}function nt(x){if(G=!1,_t(x),!ct)if(S(N)!==null)ct=!0,Ot||(Ot=!0,I());else{var C=S(p);C!==null&&ll(nt,C.startTime-x)}}var Ot=!1,J=-1,Nt=5,Xt=-1;function pl(){return Q?!0:!(r.unstable_now()-Xt<Nt)}function Pt(){if(Q=!1,Ot){var x=r.unstable_now();Xt=x;var C=!0;try{t:{ct=!1,G&&(G=!1,gt(J),J=-1),ot=!0;var Z=L;try{l:{for(_t(x),H=S(N);H!==null&&!(H.expirationTime>x&&pl());){var it=H.callback;if(typeof it=="function"){H.callback=null,L=H.priorityLevel;var dt=it(H.expirationTime<=x);if(x=r.unstable_now(),typeof dt=="function"){H.callback=dt,_t(x),C=!0;break l}H===S(N)&&f(N),_t(x)}else f(N);H=S(N)}if(H!==null)C=!0;else{var o=S(p);o!==null&&ll(nt,o.startTime-x),C=!1}}break t}finally{H=null,L=Z,ot=!1}C=void 0}}finally{C?I():Ot=!1}}}var I;if(typeof zt=="function")I=function(){zt(Pt)};else if(typeof MessageChannel<"u"){var Rl=new MessageChannel,tl=Rl.port2;Rl.port1.onmessage=Pt,I=function(){tl.postMessage(null)}}else I=function(){V(Pt,0)};function ll(x,C){J=V(function(){x(r.unstable_now())},C)}r.unstable_IdlePriority=5,r.unstable_ImmediatePriority=1,r.unstable_LowPriority=4,r.unstable_NormalPriority=3,r.unstable_Profiling=null,r.unstable_UserBlockingPriority=2,r.unstable_cancelCallback=function(x){x.callback=null},r.unstable_forceFrameRate=function(x){0>x||125<x?console.error("forceFrameRate takes a positive int between 0 and 125, forcing frame rates higher than 125 fps is not supported"):Nt=0<x?Math.floor(1e3/x):5},r.unstable_getCurrentPriorityLevel=function(){return L},r.unstable_next=function(x){switch(L){case 1:case 2:case 3:var C=3;break;default:C=L}var Z=L;L=C;try{return x()}finally{L=Z}},r.unstable_requestPaint=function(){Q=!0},r.unstable_runWithPriority=function(x,C){switch(x){case 1:case 2:case 3:case 4:case 5:break;default:x=3}var Z=L;L=x;try{return C()}finally{L=Z}},r.unstable_scheduleCallback=function(x,C,Z){var it=r.unstable_now();switch(typeof Z=="object"&&Z!==null?(Z=Z.delay,Z=typeof Z=="number"&&0<Z?it+Z:it):Z=it,x){case 1:var dt=-1;break;case 2:dt=250;break;case 5:dt=1073741823;break;case 4:dt=1e4;break;default:dt=5e3}return dt=Z+dt,x={id:R++,callback:C,priorityLevel:x,startTime:Z,expirationTime:dt,sortIndex:-1},Z>it?(x.sortIndex=Z,v(p,x),S(N)===null&&x===S(p)&&(G?(gt(J),J=-1):G=!0,ll(nt,Z-it))):(x.sortIndex=dt,v(N,x),ct||ot||(ct=!0,Ot||(Ot=!0,I()))),x},r.unstable_shouldYield=pl,r.unstable_wrapCallback=function(x){var C=L;return function(){var Z=L;L=C;try{return x.apply(this,arguments)}finally{L=Z}}}})(Af)),Af}var wd;function qm(){return wd||(wd=1,Tf.exports=Bm()),Tf.exports}var Ef={exports:{}},Wt={};var Ld;function Ym(){if(Ld)return Wt;Ld=1;var r=Rf();function v(N){var p="https://react.dev/errors/"+N;if(1<arguments.length){p+="?args[]="+encodeURIComponent(arguments[1]);for(var R=2;R<arguments.length;R++)p+="&args[]="+encodeURIComponent(arguments[R])}return"Minified React error #"+N+"; visit "+p+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}function S(){}var f={d:{f:S,r:function(){throw Error(v(522))},D:S,C:S,L:S,m:S,X:S,S,M:S},p:0,findDOMNode:null},_=Symbol.for("react.portal");function O(N,p,R){var H=3<arguments.length&&arguments[3]!==void 0?arguments[3]:null;return{$$typeof:_,key:H==null?null:""+H,children:N,containerInfo:p,implementation:R}}var D=r.__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE;function U(N,p){if(N==="font")return"";if(typeof p=="string")return p==="use-credentials"?p:""}return Wt.__DOM_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE=f,Wt.createPortal=function(N,p){var R=2<arguments.length&&arguments[2]!==void 0?arguments[2]:null;if(!p||p.nodeType!==1&&p.nodeType!==9&&p.nodeType!==11)throw Error(v(299));return O(N,p,null,R)},Wt.flushSync=function(N){var p=D.T,R=f.p;try{if(D.T=null,f.p=2,N)return N()}finally{D.T=p,f.p=R,f.d.f()}},Wt.preconnect=function(N,p){typeof N=="string"&&(p?(p=p.crossOrigin,p=typeof p=="string"?p==="use-credentials"?p:"":void 0):p=null,f.d.C(N,p))},Wt.prefetchDNS=function(N){typeof N=="string"&&f.d.D(N)},Wt.preinit=function(N,p){if(typeof N=="string"&&p&&typeof p.as=="string"){var R=p.as,H=U(R,p.crossOrigin),L=typeof p.integrity=="string"?p.integrity:void 0,ot=typeof p.fetchPriority=="string"?p.fetchPriority:void 0;R==="style"?f.d.S(N,typeof p.precedence=="string"?p.precedence:void 0,{crossOrigin:H,integrity:L,fetchPriority:ot}):R==="script"&&f.d.X(N,{crossOrigin:H,integrity:L,fetchPriority:ot,nonce:typeof p.nonce=="string"?p.nonce:void 0})}},Wt.preinitModule=function(N,p){if(typeof N=="string")if(typeof p=="object"&&p!==null){if(p.as==null||p.as==="script"){var R=U(p.as,p.crossOrigin);f.d.M(N,{crossOrigin:R,integrity:typeof p.integrity=="string"?p.integrity:void 0,nonce:typeof p.nonce=="string"?p.nonce:void 0})}}else p==null&&f.d.M(N)},Wt.preload=function(N,p){if(typeof N=="string"&&typeof p=="object"&&p!==null&&typeof p.as=="string"){var R=p.as,H=U(R,p.crossOrigin);f.d.L(N,R,{crossOrigin:H,integrity:typeof p.integrity=="string"?p.integrity:void 0,nonce:typeof p.nonce=="string"?p.nonce:void 0,type:typeof p.type=="string"?p.type:void 0,fetchPriority:typeof p.fetchPriority=="string"?p.fetchPriority:void 0,referrerPolicy:typeof p.referrerPolicy=="string"?p.referrerPolicy:void 0,imageSrcSet:typeof p.imageSrcSet=="string"?p.imageSrcSet:void 0,imageSizes:typeof p.imageSizes=="string"?p.imageSizes:void 0,media:typeof p.media=="string"?p.media:void 0})}},Wt.preloadModule=function(N,p){if(typeof N=="string")if(p){var R=U(p.as,p.crossOrigin);f.d.m(N,{as:typeof p.as=="string"&&p.as!=="script"?p.as:void 0,crossOrigin:R,integrity:typeof p.integrity=="string"?p.integrity:void 0})}else f.d.m(N)},Wt.requestFormReset=function(N){f.d.r(N)},Wt.unstable_batchedUpdates=function(N,p){return N(p)},Wt.useFormState=function(N,p,R){return D.H.useFormState(N,p,R)},Wt.useFormStatus=function(){return D.H.useHostTransitionStatus()},Wt.version="19.2.4",Wt}var Vd;function Gm(){if(Vd)return Ef.exports;Vd=1;function r(){if(!(typeof __REACT_DEVTOOLS_GLOBAL_HOOK__>"u"||typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE!="function"))try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(r)}catch(v){console.error(v)}}return r(),Ef.exports=Ym(),Ef.exports}var Kd;function Xm(){if(Kd)return Uu;Kd=1;var r=qm(),v=Rf(),S=Gm();function f(t){var l="https://react.dev/errors/"+t;if(1<arguments.length){l+="?args[]="+encodeURIComponent(arguments[1]);for(var e=2;e<arguments.length;e++)l+="&args[]="+encodeURIComponent(arguments[e])}return"Minified React error #"+t+"; visit "+l+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}function _(t){return!(!t||t.nodeType!==1&&t.nodeType!==9&&t.nodeType!==11)}function O(t){var l=t,e=t;if(t.alternate)for(;l.return;)l=l.return;else{t=l;do l=t,(l.flags&4098)!==0&&(e=l.return),t=l.return;while(t)}return l.tag===3?e:null}function D(t){if(t.tag===13){var l=t.memoizedState;if(l===null&&(t=t.alternate,t!==null&&(l=t.memoizedState)),l!==null)return l.dehydrated}return null}function U(t){if(t.tag===31){var l=t.memoizedState;if(l===null&&(t=t.alternate,t!==null&&(l=t.memoizedState)),l!==null)return l.dehydrated}return null}function N(t){if(O(t)!==t)throw Error(f(188))}function p(t){var l=t.alternate;if(!l){if(l=O(t),l===null)throw Error(f(188));return l!==t?null:t}for(var e=t,a=l;;){var u=e.return;if(u===null)break;var n=u.alternate;if(n===null){if(a=u.return,a!==null){e=a;continue}break}if(u.child===n.child){for(n=u.child;n;){if(n===e)return N(u),t;if(n===a)return N(u),l;n=n.sibling}throw Error(f(188))}if(e.return!==a.return)e=u,a=n;else{for(var i=!1,c=u.child;c;){if(c===e){i=!0,e=u,a=n;break}if(c===a){i=!0,a=u,e=n;break}c=c.sibling}if(!i){for(c=n.child;c;){if(c===e){i=!0,e=n,a=u;break}if(c===a){i=!0,a=n,e=u;break}c=c.sibling}if(!i)throw Error(f(189))}}if(e.alternate!==a)throw Error(f(190))}if(e.tag!==3)throw Error(f(188));return e.stateNode.current===e?t:l}function R(t){var l=t.tag;if(l===5||l===26||l===27||l===6)return t;for(t=t.child;t!==null;){if(l=R(t),l!==null)return l;t=t.sibling}return null}var H=Object.assign,L=Symbol.for("react.element"),ot=Symbol.for("react.transitional.element"),ct=Symbol.for("react.portal"),G=Symbol.for("react.fragment"),Q=Symbol.for("react.strict_mode"),V=Symbol.for("react.profiler"),gt=Symbol.for("react.consumer"),zt=Symbol.for("react.context"),_t=Symbol.for("react.forward_ref"),nt=Symbol.for("react.suspense"),Ot=Symbol.for("react.suspense_list"),J=Symbol.for("react.memo"),Nt=Symbol.for("react.lazy"),Xt=Symbol.for("react.activity"),pl=Symbol.for("react.memo_cache_sentinel"),Pt=Symbol.iterator;function I(t){return t===null||typeof t!="object"?null:(t=Pt&&t[Pt]||t["@@iterator"],typeof t=="function"?t:null)}var Rl=Symbol.for("react.client.reference");function tl(t){if(t==null)return null;if(typeof t=="function")return t.$$typeof===Rl?null:t.displayName||t.name||null;if(typeof t=="string")return t;switch(t){case G:return"Fragment";case V:return"Profiler";case Q:return"StrictMode";case nt:return"Suspense";case Ot:return"SuspenseList";case Xt:return"Activity"}if(typeof t=="object")switch(t.$$typeof){case ct:return"Portal";case zt:return t.displayName||"Context";case gt:return(t._context.displayName||"Context")+".Consumer";case _t:var l=t.render;return t=t.displayName,t||(t=l.displayName||l.name||"",t=t!==""?"ForwardRef("+t+")":"ForwardRef"),t;case J:return l=t.displayName||null,l!==null?l:tl(t.type)||"Memo";case Nt:l=t._payload,t=t._init;try{return tl(t(l))}catch{}}return null}var ll=Array.isArray,x=v.__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE,C=S.__DOM_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE,Z={pending:!1,data:null,method:null,action:null},it=[],dt=-1;function o(t){return{current:t}}function M(t){0>dt||(t.current=it[dt],it[dt]=null,dt--)}function j(t,l){dt++,it[dt]=t.current,t.current=l}var q=o(null),k=o(null),P=o(null),yt=o(null);function $t(t,l){switch(j(P,l),j(k,t),j(q,null),l.nodeType){case 9:case 11:t=(t=l.documentElement)&&(t=t.namespaceURI)?cd(t):0;break;default:if(t=l.tagName,l=l.namespaceURI)l=cd(l),t=fd(l,t);else switch(t){case"svg":t=1;break;case"math":t=2;break;default:t=0}}M(q),j(q,t)}function Ct(){M(q),M(k),M(P)}function qa(t){t.memoizedState!==null&&j(yt,t);var l=q.current,e=fd(l,t.type);l!==e&&(j(k,t),j(q,e))}function Hu(t){k.current===t&&(M(q),M(k)),yt.current===t&&(M(yt),Mu._currentValue=Z)}var li,Bf;function Ue(t){if(li===void 0)try{throw Error()}catch(e){var l=e.stack.trim().match(/\n( *(at )?)/);li=l&&l[1]||"",Bf=-1<e.stack.indexOf(`
     at`)?" (<anonymous>)":-1<e.stack.indexOf("@")?"@unknown:0:0":""}return`
-`+li+t+Bf}var ei=!1;function ai(t,l){if(!t||ei)return"";ei=!0;var e=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{var a={DetermineComponentFrameRoot:function(){try{if(l){var E=function(){throw Error()};if(Object.defineProperty(E.prototype,"props",{set:function(){throw Error()}}),typeof Reflect=="object"&&Reflect.construct){try{Reflect.construct(E,[])}catch(b){var g=b}Reflect.construct(t,[],E)}else{try{E.call()}catch(b){g=b}t.call(E.prototype)}}else{try{throw Error()}catch(b){g=b}(E=t())&&typeof E.catch=="function"&&E.catch(function(){})}}catch(b){if(b&&g&&typeof b.stack=="string")return[b.stack,g.stack]}return[null,null]}};a.DetermineComponentFrameRoot.displayName="DetermineComponentFrameRoot";var u=Object.getOwnPropertyDescriptor(a.DetermineComponentFrameRoot,"name");u&&u.configurable&&Object.defineProperty(a.DetermineComponentFrameRoot,"name",{value:"DetermineComponentFrameRoot"});var n=a.DetermineComponentFrameRoot(),i=n[0],c=n[1];if(i&&c){var o=i.split(`
+`+li+t+Bf}var ei=!1;function ai(t,l){if(!t||ei)return"";ei=!0;var e=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{var a={DetermineComponentFrameRoot:function(){try{if(l){var A=function(){throw Error()};if(Object.defineProperty(A.prototype,"props",{set:function(){throw Error()}}),typeof Reflect=="object"&&Reflect.construct){try{Reflect.construct(A,[])}catch(b){var g=b}Reflect.construct(t,[],A)}else{try{A.call()}catch(b){g=b}t.call(A.prototype)}}else{try{throw Error()}catch(b){g=b}(A=t())&&typeof A.catch=="function"&&A.catch(function(){})}}catch(b){if(b&&g&&typeof b.stack=="string")return[b.stack,g.stack]}return[null,null]}};a.DetermineComponentFrameRoot.displayName="DetermineComponentFrameRoot";var u=Object.getOwnPropertyDescriptor(a.DetermineComponentFrameRoot,"name");u&&u.configurable&&Object.defineProperty(a.DetermineComponentFrameRoot,"name",{value:"DetermineComponentFrameRoot"});var n=a.DetermineComponentFrameRoot(),i=n[0],c=n[1];if(i&&c){var s=i.split(`
 `),h=c.split(`
-`);for(u=a=0;a<o.length&&!o[a].includes("DetermineComponentFrameRoot");)a++;for(;u<h.length&&!h[u].includes("DetermineComponentFrameRoot");)u++;if(a===o.length||u===h.length)for(a=o.length-1,u=h.length-1;1<=a&&0<=u&&o[a]!==h[u];)u--;for(;1<=a&&0<=u;a--,u--)if(o[a]!==h[u]){if(a!==1||u!==1)do if(a--,u--,0>u||o[a]!==h[u]){var z=`
-`+o[a].replace(" at new "," at ");return t.displayName&&z.includes("<anonymous>")&&(z=z.replace("<anonymous>",t.displayName)),z}while(1<=a&&0<=u);break}}}finally{ei=!1,Error.prepareStackTrace=e}return(e=t?t.displayName||t.name:"")?Ue(e):""}function o0(t,l){switch(t.tag){case 26:case 27:case 5:return Ue(t.type);case 16:return Ue("Lazy");case 13:return t.child!==l&&l!==null?Ue("Suspense Fallback"):Ue("Suspense");case 19:return Ue("SuspenseList");case 0:case 15:return ai(t.type,!1);case 11:return ai(t.type.render,!1);case 1:return ai(t.type,!0);case 31:return Ue("Activity");default:return""}}function qf(t){try{var l="",e=null;do l+=o0(t,e),e=t,t=t.return;while(t);return l}catch(a){return`
+`);for(u=a=0;a<s.length&&!s[a].includes("DetermineComponentFrameRoot");)a++;for(;u<h.length&&!h[u].includes("DetermineComponentFrameRoot");)u++;if(a===s.length||u===h.length)for(a=s.length-1,u=h.length-1;1<=a&&0<=u&&s[a]!==h[u];)u--;for(;1<=a&&0<=u;a--,u--)if(s[a]!==h[u]){if(a!==1||u!==1)do if(a--,u--,0>u||s[a]!==h[u]){var z=`
+`+s[a].replace(" at new "," at ");return t.displayName&&z.includes("<anonymous>")&&(z=z.replace("<anonymous>",t.displayName)),z}while(1<=a&&0<=u);break}}}finally{ei=!1,Error.prepareStackTrace=e}return(e=t?t.displayName||t.name:"")?Ue(e):""}function s0(t,l){switch(t.tag){case 26:case 27:case 5:return Ue(t.type);case 16:return Ue("Lazy");case 13:return t.child!==l&&l!==null?Ue("Suspense Fallback"):Ue("Suspense");case 19:return Ue("SuspenseList");case 0:case 15:return ai(t.type,!1);case 11:return ai(t.type.render,!1);case 1:return ai(t.type,!0);case 31:return Ue("Activity");default:return""}}function qf(t){try{var l="",e=null;do l+=s0(t,e),e=t,t=t.return;while(t);return l}catch(a){return`
 Error generating stack: `+a.message+`
-`+a.stack}}var ui=Object.prototype.hasOwnProperty,ni=r.unstable_scheduleCallback,ii=r.unstable_cancelCallback,s0=r.unstable_shouldYield,d0=r.unstable_requestPaint,rl=r.unstable_now,y0=r.unstable_getCurrentPriorityLevel,Yf=r.unstable_ImmediatePriority,Gf=r.unstable_UserBlockingPriority,Bu=r.unstable_NormalPriority,m0=r.unstable_LowPriority,Xf=r.unstable_IdlePriority,h0=r.log,g0=r.unstable_setDisableYieldValue,Ya=null,ol=null;function ue(t){if(typeof h0=="function"&&g0(t),ol&&typeof ol.setStrictMode=="function")try{ol.setStrictMode(Ya,t)}catch{}}var sl=Math.clz32?Math.clz32:p0,v0=Math.log,b0=Math.LN2;function p0(t){return t>>>=0,t===0?32:31-(v0(t)/b0|0)|0}var qu=256,Yu=262144,Gu=4194304;function Ce(t){var l=t&42;if(l!==0)return l;switch(t&-t){case 1:return 1;case 2:return 2;case 4:return 4;case 8:return 8;case 16:return 16;case 32:return 32;case 64:return 64;case 128:return 128;case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:return t&261888;case 262144:case 524288:case 1048576:case 2097152:return t&3932160;case 4194304:case 8388608:case 16777216:case 33554432:return t&62914560;case 67108864:return 67108864;case 134217728:return 134217728;case 268435456:return 268435456;case 536870912:return 536870912;case 1073741824:return 0;default:return t}}function Xu(t,l,e){var a=t.pendingLanes;if(a===0)return 0;var u=0,n=t.suspendedLanes,i=t.pingedLanes;t=t.warmLanes;var c=a&134217727;return c!==0?(a=c&~n,a!==0?u=Ce(a):(i&=c,i!==0?u=Ce(i):e||(e=c&~t,e!==0&&(u=Ce(e))))):(c=a&~n,c!==0?u=Ce(c):i!==0?u=Ce(i):e||(e=a&~t,e!==0&&(u=Ce(e)))),u===0?0:l!==0&&l!==u&&(l&n)===0&&(n=u&-u,e=l&-l,n>=e||n===32&&(e&4194048)!==0)?l:u}function Ga(t,l){return(t.pendingLanes&~(t.suspendedLanes&~t.pingedLanes)&l)===0}function S0(t,l){switch(t){case 1:case 2:case 4:case 8:case 64:return l+250;case 16:case 32:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return l+5e3;case 4194304:case 8388608:case 16777216:case 33554432:return-1;case 67108864:case 134217728:case 268435456:case 536870912:case 1073741824:return-1;default:return-1}}function Qf(){var t=Gu;return Gu<<=1,(Gu&62914560)===0&&(Gu=4194304),t}function ci(t){for(var l=[],e=0;31>e;e++)l.push(t);return l}function Xa(t,l){t.pendingLanes|=l,l!==268435456&&(t.suspendedLanes=0,t.pingedLanes=0,t.warmLanes=0)}function x0(t,l,e,a,u,n){var i=t.pendingLanes;t.pendingLanes=e,t.suspendedLanes=0,t.pingedLanes=0,t.warmLanes=0,t.expiredLanes&=e,t.entangledLanes&=e,t.errorRecoveryDisabledLanes&=e,t.shellSuspendCounter=0;var c=t.entanglements,o=t.expirationTimes,h=t.hiddenUpdates;for(e=i&~e;0<e;){var z=31-sl(e),E=1<<z;c[z]=0,o[z]=-1;var g=h[z];if(g!==null)for(h[z]=null,z=0;z<g.length;z++){var b=g[z];b!==null&&(b.lane&=-536870913)}e&=~E}a!==0&&Zf(t,a,0),n!==0&&u===0&&t.tag!==0&&(t.suspendedLanes|=n&~(i&~l))}function Zf(t,l,e){t.pendingLanes|=l,t.suspendedLanes&=~l;var a=31-sl(l);t.entangledLanes|=l,t.entanglements[a]=t.entanglements[a]|1073741824|e&261930}function wf(t,l){var e=t.entangledLanes|=l;for(t=t.entanglements;e;){var a=31-sl(e),u=1<<a;u&l|t[a]&l&&(t[a]|=l),e&=~u}}function Lf(t,l){var e=l&-l;return e=(e&42)!==0?1:fi(e),(e&(t.suspendedLanes|l))!==0?0:e}function fi(t){switch(t){case 2:t=1;break;case 8:t=4;break;case 32:t=16;break;case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:case 4194304:case 8388608:case 16777216:case 33554432:t=128;break;case 268435456:t=134217728;break;default:t=0}return t}function ri(t){return t&=-t,2<t?8<t?(t&134217727)!==0?32:268435456:8:2}function Vf(){var t=C.p;return t!==0?t:(t=window.event,t===void 0?32:Ud(t.type))}function Kf(t,l){var e=C.p;try{return C.p=t,l()}finally{C.p=e}}var ne=Math.random().toString(36).slice(2),wt="__reactFiber$"+ne,el="__reactProps$"+ne,Fe="__reactContainer$"+ne,oi="__reactEvents$"+ne,z0="__reactListeners$"+ne,T0="__reactHandles$"+ne,Jf="__reactResources$"+ne,Qa="__reactMarker$"+ne;function si(t){delete t[wt],delete t[el],delete t[oi],delete t[z0],delete t[T0]}function Ie(t){var l=t[wt];if(l)return l;for(var e=t.parentNode;e;){if(l=e[Fe]||e[wt]){if(e=l.alternate,l.child!==null||e!==null&&e.child!==null)for(t=hd(t);t!==null;){if(e=t[wt])return e;t=hd(t)}return l}t=e,e=t.parentNode}return null}function Pe(t){if(t=t[wt]||t[Fe]){var l=t.tag;if(l===5||l===6||l===13||l===31||l===26||l===27||l===3)return t}return null}function Za(t){var l=t.tag;if(l===5||l===26||l===27||l===6)return t.stateNode;throw Error(f(33))}function ta(t){var l=t[Jf];return l||(l=t[Jf]={hoistableStyles:new Map,hoistableScripts:new Map}),l}function Xt(t){t[Qa]=!0}var kf=new Set,Wf={};function je(t,l){la(t,l),la(t+"Capture",l)}function la(t,l){for(Wf[t]=l,t=0;t<l.length;t++)kf.add(l[t])}var E0=RegExp("^[:A-Z_a-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD][:A-Z_a-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD\\-.0-9\\u00B7\\u0300-\\u036F\\u203F-\\u2040]*$"),$f={},Ff={};function A0(t){return ui.call(Ff,t)?!0:ui.call($f,t)?!1:E0.test(t)?Ff[t]=!0:($f[t]=!0,!1)}function Qu(t,l,e){if(A0(l))if(e===null)t.removeAttribute(l);else{switch(typeof e){case"undefined":case"function":case"symbol":t.removeAttribute(l);return;case"boolean":var a=l.toLowerCase().slice(0,5);if(a!=="data-"&&a!=="aria-"){t.removeAttribute(l);return}}t.setAttribute(l,""+e)}}function Zu(t,l,e){if(e===null)t.removeAttribute(l);else{switch(typeof e){case"undefined":case"function":case"symbol":case"boolean":t.removeAttribute(l);return}t.setAttribute(l,""+e)}}function Gl(t,l,e,a){if(a===null)t.removeAttribute(e);else{switch(typeof a){case"undefined":case"function":case"symbol":case"boolean":t.removeAttribute(e);return}t.setAttributeNS(l,e,""+a)}}function pl(t){switch(typeof t){case"bigint":case"boolean":case"number":case"string":case"undefined":return t;case"object":return t;default:return""}}function If(t){var l=t.type;return(t=t.nodeName)&&t.toLowerCase()==="input"&&(l==="checkbox"||l==="radio")}function M0(t,l,e){var a=Object.getOwnPropertyDescriptor(t.constructor.prototype,l);if(!t.hasOwnProperty(l)&&typeof a<"u"&&typeof a.get=="function"&&typeof a.set=="function"){var u=a.get,n=a.set;return Object.defineProperty(t,l,{configurable:!0,get:function(){return u.call(this)},set:function(i){e=""+i,n.call(this,i)}}),Object.defineProperty(t,l,{enumerable:a.enumerable}),{getValue:function(){return e},setValue:function(i){e=""+i},stopTracking:function(){t._valueTracker=null,delete t[l]}}}}function di(t){if(!t._valueTracker){var l=If(t)?"checked":"value";t._valueTracker=M0(t,l,""+t[l])}}function Pf(t){if(!t)return!1;var l=t._valueTracker;if(!l)return!0;var e=l.getValue(),a="";return t&&(a=If(t)?t.checked?"true":"false":t.value),t=a,t!==e?(l.setValue(t),!0):!1}function wu(t){if(t=t||(typeof document<"u"?document:void 0),typeof t>"u")return null;try{return t.activeElement||t.body}catch{return t.body}}var _0=/[\n"\\]/g;function Sl(t){return t.replace(_0,function(l){return"\\"+l.charCodeAt(0).toString(16)+" "})}function yi(t,l,e,a,u,n,i,c){t.name="",i!=null&&typeof i!="function"&&typeof i!="symbol"&&typeof i!="boolean"?t.type=i:t.removeAttribute("type"),l!=null?i==="number"?(l===0&&t.value===""||t.value!=l)&&(t.value=""+pl(l)):t.value!==""+pl(l)&&(t.value=""+pl(l)):i!=="submit"&&i!=="reset"||t.removeAttribute("value"),l!=null?mi(t,i,pl(l)):e!=null?mi(t,i,pl(e)):a!=null&&t.removeAttribute("value"),u==null&&n!=null&&(t.defaultChecked=!!n),u!=null&&(t.checked=u&&typeof u!="function"&&typeof u!="symbol"),c!=null&&typeof c!="function"&&typeof c!="symbol"&&typeof c!="boolean"?t.name=""+pl(c):t.removeAttribute("name")}function tr(t,l,e,a,u,n,i,c){if(n!=null&&typeof n!="function"&&typeof n!="symbol"&&typeof n!="boolean"&&(t.type=n),l!=null||e!=null){if(!(n!=="submit"&&n!=="reset"||l!=null)){di(t);return}e=e!=null?""+pl(e):"",l=l!=null?""+pl(l):e,c||l===t.value||(t.value=l),t.defaultValue=l}a=a??u,a=typeof a!="function"&&typeof a!="symbol"&&!!a,t.checked=c?t.checked:!!a,t.defaultChecked=!!a,i!=null&&typeof i!="function"&&typeof i!="symbol"&&typeof i!="boolean"&&(t.name=i),di(t)}function mi(t,l,e){l==="number"&&wu(t.ownerDocument)===t||t.defaultValue===""+e||(t.defaultValue=""+e)}function ea(t,l,e,a){if(t=t.options,l){l={};for(var u=0;u<e.length;u++)l["$"+e[u]]=!0;for(e=0;e<t.length;e++)u=l.hasOwnProperty("$"+t[e].value),t[e].selected!==u&&(t[e].selected=u),u&&a&&(t[e].defaultSelected=!0)}else{for(e=""+pl(e),l=null,u=0;u<t.length;u++){if(t[u].value===e){t[u].selected=!0,a&&(t[u].defaultSelected=!0);return}l!==null||t[u].disabled||(l=t[u])}l!==null&&(l.selected=!0)}}function lr(t,l,e){if(l!=null&&(l=""+pl(l),l!==t.value&&(t.value=l),e==null)){t.defaultValue!==l&&(t.defaultValue=l);return}t.defaultValue=e!=null?""+pl(e):""}function er(t,l,e,a){if(l==null){if(a!=null){if(e!=null)throw Error(f(92));if(ll(a)){if(1<a.length)throw Error(f(93));a=a[0]}e=a}e==null&&(e=""),l=e}e=pl(l),t.defaultValue=e,a=t.textContent,a===e&&a!==""&&a!==null&&(t.value=a),di(t)}function aa(t,l){if(l){var e=t.firstChild;if(e&&e===t.lastChild&&e.nodeType===3){e.nodeValue=l;return}}t.textContent=l}var O0=new Set("animationIterationCount aspectRatio borderImageOutset borderImageSlice borderImageWidth boxFlex boxFlexGroup boxOrdinalGroup columnCount columns flex flexGrow flexPositive flexShrink flexNegative flexOrder gridArea gridRow gridRowEnd gridRowSpan gridRowStart gridColumn gridColumnEnd gridColumnSpan gridColumnStart fontWeight lineClamp lineHeight opacity order orphans scale tabSize widows zIndex zoom fillOpacity floodOpacity stopOpacity strokeDasharray strokeDashoffset strokeMiterlimit strokeOpacity strokeWidth MozAnimationIterationCount MozBoxFlex MozBoxFlexGroup MozLineClamp msAnimationIterationCount msFlex msZoom msFlexGrow msFlexNegative msFlexOrder msFlexPositive msFlexShrink msGridColumn msGridColumnSpan msGridRow msGridRowSpan WebkitAnimationIterationCount WebkitBoxFlex WebKitBoxFlexGroup WebkitBoxOrdinalGroup WebkitColumnCount WebkitColumns WebkitFlex WebkitFlexGrow WebkitFlexPositive WebkitFlexShrink WebkitLineClamp".split(" "));function ar(t,l,e){var a=l.indexOf("--")===0;e==null||typeof e=="boolean"||e===""?a?t.setProperty(l,""):l==="float"?t.cssFloat="":t[l]="":a?t.setProperty(l,e):typeof e!="number"||e===0||O0.has(l)?l==="float"?t.cssFloat=e:t[l]=(""+e).trim():t[l]=e+"px"}function ur(t,l,e){if(l!=null&&typeof l!="object")throw Error(f(62));if(t=t.style,e!=null){for(var a in e)!e.hasOwnProperty(a)||l!=null&&l.hasOwnProperty(a)||(a.indexOf("--")===0?t.setProperty(a,""):a==="float"?t.cssFloat="":t[a]="");for(var u in l)a=l[u],l.hasOwnProperty(u)&&e[u]!==a&&ar(t,u,a)}else for(var n in l)l.hasOwnProperty(n)&&ar(t,n,l[n])}function hi(t){if(t.indexOf("-")===-1)return!1;switch(t){case"annotation-xml":case"color-profile":case"font-face":case"font-face-src":case"font-face-uri":case"font-face-format":case"font-face-name":case"missing-glyph":return!1;default:return!0}}var N0=new Map([["acceptCharset","accept-charset"],["htmlFor","for"],["httpEquiv","http-equiv"],["crossOrigin","crossorigin"],["accentHeight","accent-height"],["alignmentBaseline","alignment-baseline"],["arabicForm","arabic-form"],["baselineShift","baseline-shift"],["capHeight","cap-height"],["clipPath","clip-path"],["clipRule","clip-rule"],["colorInterpolation","color-interpolation"],["colorInterpolationFilters","color-interpolation-filters"],["colorProfile","color-profile"],["colorRendering","color-rendering"],["dominantBaseline","dominant-baseline"],["enableBackground","enable-background"],["fillOpacity","fill-opacity"],["fillRule","fill-rule"],["floodColor","flood-color"],["floodOpacity","flood-opacity"],["fontFamily","font-family"],["fontSize","font-size"],["fontSizeAdjust","font-size-adjust"],["fontStretch","font-stretch"],["fontStyle","font-style"],["fontVariant","font-variant"],["fontWeight","font-weight"],["glyphName","glyph-name"],["glyphOrientationHorizontal","glyph-orientation-horizontal"],["glyphOrientationVertical","glyph-orientation-vertical"],["horizAdvX","horiz-adv-x"],["horizOriginX","horiz-origin-x"],["imageRendering","image-rendering"],["letterSpacing","letter-spacing"],["lightingColor","lighting-color"],["markerEnd","marker-end"],["markerMid","marker-mid"],["markerStart","marker-start"],["overlinePosition","overline-position"],["overlineThickness","overline-thickness"],["paintOrder","paint-order"],["panose-1","panose-1"],["pointerEvents","pointer-events"],["renderingIntent","rendering-intent"],["shapeRendering","shape-rendering"],["stopColor","stop-color"],["stopOpacity","stop-opacity"],["strikethroughPosition","strikethrough-position"],["strikethroughThickness","strikethrough-thickness"],["strokeDasharray","stroke-dasharray"],["strokeDashoffset","stroke-dashoffset"],["strokeLinecap","stroke-linecap"],["strokeLinejoin","stroke-linejoin"],["strokeMiterlimit","stroke-miterlimit"],["strokeOpacity","stroke-opacity"],["strokeWidth","stroke-width"],["textAnchor","text-anchor"],["textDecoration","text-decoration"],["textRendering","text-rendering"],["transformOrigin","transform-origin"],["underlinePosition","underline-position"],["underlineThickness","underline-thickness"],["unicodeBidi","unicode-bidi"],["unicodeRange","unicode-range"],["unitsPerEm","units-per-em"],["vAlphabetic","v-alphabetic"],["vHanging","v-hanging"],["vIdeographic","v-ideographic"],["vMathematical","v-mathematical"],["vectorEffect","vector-effect"],["vertAdvY","vert-adv-y"],["vertOriginX","vert-origin-x"],["vertOriginY","vert-origin-y"],["wordSpacing","word-spacing"],["writingMode","writing-mode"],["xmlnsXlink","xmlns:xlink"],["xHeight","x-height"]]),D0=/^[\u0000-\u001F ]*j[\r\n\t]*a[\r\n\t]*v[\r\n\t]*a[\r\n\t]*s[\r\n\t]*c[\r\n\t]*r[\r\n\t]*i[\r\n\t]*p[\r\n\t]*t[\r\n\t]*:/i;function Lu(t){return D0.test(""+t)?"javascript:throw new Error('React has blocked a javascript: URL as a security precaution.')":t}function Xl(){}var gi=null;function vi(t){return t=t.target||t.srcElement||window,t.correspondingUseElement&&(t=t.correspondingUseElement),t.nodeType===3?t.parentNode:t}var ua=null,na=null;function nr(t){var l=Pe(t);if(l&&(t=l.stateNode)){var e=t[el]||null;t:switch(t=l.stateNode,l.type){case"input":if(yi(t,e.value,e.defaultValue,e.defaultValue,e.checked,e.defaultChecked,e.type,e.name),l=e.name,e.type==="radio"&&l!=null){for(e=t;e.parentNode;)e=e.parentNode;for(e=e.querySelectorAll('input[name="'+Sl(""+l)+'"][type="radio"]'),l=0;l<e.length;l++){var a=e[l];if(a!==t&&a.form===t.form){var u=a[el]||null;if(!u)throw Error(f(90));yi(a,u.value,u.defaultValue,u.defaultValue,u.checked,u.defaultChecked,u.type,u.name)}}for(l=0;l<e.length;l++)a=e[l],a.form===t.form&&Pf(a)}break t;case"textarea":lr(t,e.value,e.defaultValue);break t;case"select":l=e.value,l!=null&&ea(t,!!e.multiple,l,!1)}}}var bi=!1;function ir(t,l,e){if(bi)return t(l,e);bi=!0;try{var a=t(l);return a}finally{if(bi=!1,(ua!==null||na!==null)&&(Cn(),ua&&(l=ua,t=na,na=ua=null,nr(l),t)))for(l=0;l<t.length;l++)nr(t[l])}}function wa(t,l){var e=t.stateNode;if(e===null)return null;var a=e[el]||null;if(a===null)return null;e=a[l];t:switch(l){case"onClick":case"onClickCapture":case"onDoubleClick":case"onDoubleClickCapture":case"onMouseDown":case"onMouseDownCapture":case"onMouseMove":case"onMouseMoveCapture":case"onMouseUp":case"onMouseUpCapture":case"onMouseEnter":(a=!a.disabled)||(t=t.type,a=!(t==="button"||t==="input"||t==="select"||t==="textarea")),t=!a;break t;default:t=!1}if(t)return null;if(e&&typeof e!="function")throw Error(f(231,l,typeof e));return e}var Ql=!(typeof window>"u"||typeof window.document>"u"||typeof window.document.createElement>"u"),pi=!1;if(Ql)try{var La={};Object.defineProperty(La,"passive",{get:function(){pi=!0}}),window.addEventListener("test",La,La),window.removeEventListener("test",La,La)}catch{pi=!1}var ie=null,Si=null,Vu=null;function cr(){if(Vu)return Vu;var t,l=Si,e=l.length,a,u="value"in ie?ie.value:ie.textContent,n=u.length;for(t=0;t<e&&l[t]===u[t];t++);var i=e-t;for(a=1;a<=i&&l[e-a]===u[n-a];a++);return Vu=u.slice(t,1<a?1-a:void 0)}function Ku(t){var l=t.keyCode;return"charCode"in t?(t=t.charCode,t===0&&l===13&&(t=13)):t=l,t===10&&(t=13),32<=t||t===13?t:0}function Ju(){return!0}function fr(){return!1}function al(t){function l(e,a,u,n,i){this._reactName=e,this._targetInst=u,this.type=a,this.nativeEvent=n,this.target=i,this.currentTarget=null;for(var c in t)t.hasOwnProperty(c)&&(e=t[c],this[c]=e?e(n):n[c]);return this.isDefaultPrevented=(n.defaultPrevented!=null?n.defaultPrevented:n.returnValue===!1)?Ju:fr,this.isPropagationStopped=fr,this}return H(l.prototype,{preventDefault:function(){this.defaultPrevented=!0;var e=this.nativeEvent;e&&(e.preventDefault?e.preventDefault():typeof e.returnValue!="unknown"&&(e.returnValue=!1),this.isDefaultPrevented=Ju)},stopPropagation:function(){var e=this.nativeEvent;e&&(e.stopPropagation?e.stopPropagation():typeof e.cancelBubble!="unknown"&&(e.cancelBubble=!0),this.isPropagationStopped=Ju)},persist:function(){},isPersistent:Ju}),l}var Re={eventPhase:0,bubbles:0,cancelable:0,timeStamp:function(t){return t.timeStamp||Date.now()},defaultPrevented:0,isTrusted:0},ku=al(Re),Va=H({},Re,{view:0,detail:0}),U0=al(Va),xi,zi,Ka,Wu=H({},Va,{screenX:0,screenY:0,clientX:0,clientY:0,pageX:0,pageY:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,getModifierState:Ei,button:0,buttons:0,relatedTarget:function(t){return t.relatedTarget===void 0?t.fromElement===t.srcElement?t.toElement:t.fromElement:t.relatedTarget},movementX:function(t){return"movementX"in t?t.movementX:(t!==Ka&&(Ka&&t.type==="mousemove"?(xi=t.screenX-Ka.screenX,zi=t.screenY-Ka.screenY):zi=xi=0,Ka=t),xi)},movementY:function(t){return"movementY"in t?t.movementY:zi}}),rr=al(Wu),C0=H({},Wu,{dataTransfer:0}),j0=al(C0),R0=H({},Va,{relatedTarget:0}),Ti=al(R0),H0=H({},Re,{animationName:0,elapsedTime:0,pseudoElement:0}),B0=al(H0),q0=H({},Re,{clipboardData:function(t){return"clipboardData"in t?t.clipboardData:window.clipboardData}}),Y0=al(q0),G0=H({},Re,{data:0}),or=al(G0),X0={Esc:"Escape",Spacebar:" ",Left:"ArrowLeft",Up:"ArrowUp",Right:"ArrowRight",Down:"ArrowDown",Del:"Delete",Win:"OS",Menu:"ContextMenu",Apps:"ContextMenu",Scroll:"ScrollLock",MozPrintableKey:"Unidentified"},Q0={8:"Backspace",9:"Tab",12:"Clear",13:"Enter",16:"Shift",17:"Control",18:"Alt",19:"Pause",20:"CapsLock",27:"Escape",32:" ",33:"PageUp",34:"PageDown",35:"End",36:"Home",37:"ArrowLeft",38:"ArrowUp",39:"ArrowRight",40:"ArrowDown",45:"Insert",46:"Delete",112:"F1",113:"F2",114:"F3",115:"F4",116:"F5",117:"F6",118:"F7",119:"F8",120:"F9",121:"F10",122:"F11",123:"F12",144:"NumLock",145:"ScrollLock",224:"Meta"},Z0={Alt:"altKey",Control:"ctrlKey",Meta:"metaKey",Shift:"shiftKey"};function w0(t){var l=this.nativeEvent;return l.getModifierState?l.getModifierState(t):(t=Z0[t])?!!l[t]:!1}function Ei(){return w0}var L0=H({},Va,{key:function(t){if(t.key){var l=X0[t.key]||t.key;if(l!=="Unidentified")return l}return t.type==="keypress"?(t=Ku(t),t===13?"Enter":String.fromCharCode(t)):t.type==="keydown"||t.type==="keyup"?Q0[t.keyCode]||"Unidentified":""},code:0,location:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,repeat:0,locale:0,getModifierState:Ei,charCode:function(t){return t.type==="keypress"?Ku(t):0},keyCode:function(t){return t.type==="keydown"||t.type==="keyup"?t.keyCode:0},which:function(t){return t.type==="keypress"?Ku(t):t.type==="keydown"||t.type==="keyup"?t.keyCode:0}}),V0=al(L0),K0=H({},Wu,{pointerId:0,width:0,height:0,pressure:0,tangentialPressure:0,tiltX:0,tiltY:0,twist:0,pointerType:0,isPrimary:0}),sr=al(K0),J0=H({},Va,{touches:0,targetTouches:0,changedTouches:0,altKey:0,metaKey:0,ctrlKey:0,shiftKey:0,getModifierState:Ei}),k0=al(J0),W0=H({},Re,{propertyName:0,elapsedTime:0,pseudoElement:0}),$0=al(W0),F0=H({},Wu,{deltaX:function(t){return"deltaX"in t?t.deltaX:"wheelDeltaX"in t?-t.wheelDeltaX:0},deltaY:function(t){return"deltaY"in t?t.deltaY:"wheelDeltaY"in t?-t.wheelDeltaY:"wheelDelta"in t?-t.wheelDelta:0},deltaZ:0,deltaMode:0}),I0=al(F0),P0=H({},Re,{newState:0,oldState:0}),ty=al(P0),ly=[9,13,27,32],Ai=Ql&&"CompositionEvent"in window,Ja=null;Ql&&"documentMode"in document&&(Ja=document.documentMode);var ey=Ql&&"TextEvent"in window&&!Ja,dr=Ql&&(!Ai||Ja&&8<Ja&&11>=Ja),yr=" ",mr=!1;function hr(t,l){switch(t){case"keyup":return ly.indexOf(l.keyCode)!==-1;case"keydown":return l.keyCode!==229;case"keypress":case"mousedown":case"focusout":return!0;default:return!1}}function gr(t){return t=t.detail,typeof t=="object"&&"data"in t?t.data:null}var ia=!1;function ay(t,l){switch(t){case"compositionend":return gr(l);case"keypress":return l.which!==32?null:(mr=!0,yr);case"textInput":return t=l.data,t===yr&&mr?null:t;default:return null}}function uy(t,l){if(ia)return t==="compositionend"||!Ai&&hr(t,l)?(t=cr(),Vu=Si=ie=null,ia=!1,t):null;switch(t){case"paste":return null;case"keypress":if(!(l.ctrlKey||l.altKey||l.metaKey)||l.ctrlKey&&l.altKey){if(l.char&&1<l.char.length)return l.char;if(l.which)return String.fromCharCode(l.which)}return null;case"compositionend":return dr&&l.locale!=="ko"?null:l.data;default:return null}}var ny={color:!0,date:!0,datetime:!0,"datetime-local":!0,email:!0,month:!0,number:!0,password:!0,range:!0,search:!0,tel:!0,text:!0,time:!0,url:!0,week:!0};function vr(t){var l=t&&t.nodeName&&t.nodeName.toLowerCase();return l==="input"?!!ny[t.type]:l==="textarea"}function br(t,l,e,a){ua?na?na.push(a):na=[a]:ua=a,l=Gn(l,"onChange"),0<l.length&&(e=new ku("onChange","change",null,e,a),t.push({event:e,listeners:l}))}var ka=null,Wa=null;function iy(t){ld(t,0)}function $u(t){var l=Za(t);if(Pf(l))return t}function pr(t,l){if(t==="change")return l}var Sr=!1;if(Ql){var Mi;if(Ql){var _i="oninput"in document;if(!_i){var xr=document.createElement("div");xr.setAttribute("oninput","return;"),_i=typeof xr.oninput=="function"}Mi=_i}else Mi=!1;Sr=Mi&&(!document.documentMode||9<document.documentMode)}function zr(){ka&&(ka.detachEvent("onpropertychange",Tr),Wa=ka=null)}function Tr(t){if(t.propertyName==="value"&&$u(Wa)){var l=[];br(l,Wa,t,vi(t)),ir(iy,l)}}function cy(t,l,e){t==="focusin"?(zr(),ka=l,Wa=e,ka.attachEvent("onpropertychange",Tr)):t==="focusout"&&zr()}function fy(t){if(t==="selectionchange"||t==="keyup"||t==="keydown")return $u(Wa)}function ry(t,l){if(t==="click")return $u(l)}function oy(t,l){if(t==="input"||t==="change")return $u(l)}function sy(t,l){return t===l&&(t!==0||1/t===1/l)||t!==t&&l!==l}var dl=typeof Object.is=="function"?Object.is:sy;function $a(t,l){if(dl(t,l))return!0;if(typeof t!="object"||t===null||typeof l!="object"||l===null)return!1;var e=Object.keys(t),a=Object.keys(l);if(e.length!==a.length)return!1;for(a=0;a<e.length;a++){var u=e[a];if(!ui.call(l,u)||!dl(t[u],l[u]))return!1}return!0}function Er(t){for(;t&&t.firstChild;)t=t.firstChild;return t}function Ar(t,l){var e=Er(t);t=0;for(var a;e;){if(e.nodeType===3){if(a=t+e.textContent.length,t<=l&&a>=l)return{node:e,offset:l-t};t=a}t:{for(;e;){if(e.nextSibling){e=e.nextSibling;break t}e=e.parentNode}e=void 0}e=Er(e)}}function Mr(t,l){return t&&l?t===l?!0:t&&t.nodeType===3?!1:l&&l.nodeType===3?Mr(t,l.parentNode):"contains"in t?t.contains(l):t.compareDocumentPosition?!!(t.compareDocumentPosition(l)&16):!1:!1}function _r(t){t=t!=null&&t.ownerDocument!=null&&t.ownerDocument.defaultView!=null?t.ownerDocument.defaultView:window;for(var l=wu(t.document);l instanceof t.HTMLIFrameElement;){try{var e=typeof l.contentWindow.location.href=="string"}catch{e=!1}if(e)t=l.contentWindow;else break;l=wu(t.document)}return l}function Oi(t){var l=t&&t.nodeName&&t.nodeName.toLowerCase();return l&&(l==="input"&&(t.type==="text"||t.type==="search"||t.type==="tel"||t.type==="url"||t.type==="password")||l==="textarea"||t.contentEditable==="true")}var dy=Ql&&"documentMode"in document&&11>=document.documentMode,ca=null,Ni=null,Fa=null,Di=!1;function Or(t,l,e){var a=e.window===e?e.document:e.nodeType===9?e:e.ownerDocument;Di||ca==null||ca!==wu(a)||(a=ca,"selectionStart"in a&&Oi(a)?a={start:a.selectionStart,end:a.selectionEnd}:(a=(a.ownerDocument&&a.ownerDocument.defaultView||window).getSelection(),a={anchorNode:a.anchorNode,anchorOffset:a.anchorOffset,focusNode:a.focusNode,focusOffset:a.focusOffset}),Fa&&$a(Fa,a)||(Fa=a,a=Gn(Ni,"onSelect"),0<a.length&&(l=new ku("onSelect","select",null,l,e),t.push({event:l,listeners:a}),l.target=ca)))}function He(t,l){var e={};return e[t.toLowerCase()]=l.toLowerCase(),e["Webkit"+t]="webkit"+l,e["Moz"+t]="moz"+l,e}var fa={animationend:He("Animation","AnimationEnd"),animationiteration:He("Animation","AnimationIteration"),animationstart:He("Animation","AnimationStart"),transitionrun:He("Transition","TransitionRun"),transitionstart:He("Transition","TransitionStart"),transitioncancel:He("Transition","TransitionCancel"),transitionend:He("Transition","TransitionEnd")},Ui={},Nr={};Ql&&(Nr=document.createElement("div").style,"AnimationEvent"in window||(delete fa.animationend.animation,delete fa.animationiteration.animation,delete fa.animationstart.animation),"TransitionEvent"in window||delete fa.transitionend.transition);function Be(t){if(Ui[t])return Ui[t];if(!fa[t])return t;var l=fa[t],e;for(e in l)if(l.hasOwnProperty(e)&&e in Nr)return Ui[t]=l[e];return t}var Dr=Be("animationend"),Ur=Be("animationiteration"),Cr=Be("animationstart"),yy=Be("transitionrun"),my=Be("transitionstart"),hy=Be("transitioncancel"),jr=Be("transitionend"),Rr=new Map,Ci="abort auxClick beforeToggle cancel canPlay canPlayThrough click close contextMenu copy cut drag dragEnd dragEnter dragExit dragLeave dragOver dragStart drop durationChange emptied encrypted ended error gotPointerCapture input invalid keyDown keyPress keyUp load loadedData loadedMetadata loadStart lostPointerCapture mouseDown mouseMove mouseOut mouseOver mouseUp paste pause play playing pointerCancel pointerDown pointerMove pointerOut pointerOver pointerUp progress rateChange reset resize seeked seeking stalled submit suspend timeUpdate touchCancel touchEnd touchStart volumeChange scroll toggle touchMove waiting wheel".split(" ");Ci.push("scrollEnd");function Dl(t,l){Rr.set(t,l),je(l,[t])}var Fu=typeof reportError=="function"?reportError:function(t){if(typeof window=="object"&&typeof window.ErrorEvent=="function"){var l=new window.ErrorEvent("error",{bubbles:!0,cancelable:!0,message:typeof t=="object"&&t!==null&&typeof t.message=="string"?String(t.message):String(t),error:t});if(!window.dispatchEvent(l))return}else if(typeof process=="object"&&typeof process.emit=="function"){process.emit("uncaughtException",t);return}console.error(t)},xl=[],ra=0,ji=0;function Iu(){for(var t=ra,l=ji=ra=0;l<t;){var e=xl[l];xl[l++]=null;var a=xl[l];xl[l++]=null;var u=xl[l];xl[l++]=null;var n=xl[l];if(xl[l++]=null,a!==null&&u!==null){var i=a.pending;i===null?u.next=u:(u.next=i.next,i.next=u),a.pending=u}n!==0&&Hr(e,u,n)}}function Pu(t,l,e,a){xl[ra++]=t,xl[ra++]=l,xl[ra++]=e,xl[ra++]=a,ji|=a,t.lanes|=a,t=t.alternate,t!==null&&(t.lanes|=a)}function Ri(t,l,e,a){return Pu(t,l,e,a),tn(t)}function qe(t,l){return Pu(t,null,null,l),tn(t)}function Hr(t,l,e){t.lanes|=e;var a=t.alternate;a!==null&&(a.lanes|=e);for(var u=!1,n=t.return;n!==null;)n.childLanes|=e,a=n.alternate,a!==null&&(a.childLanes|=e),n.tag===22&&(t=n.stateNode,t===null||t._visibility&1||(u=!0)),t=n,n=n.return;return t.tag===3?(n=t.stateNode,u&&l!==null&&(u=31-sl(e),t=n.hiddenUpdates,a=t[u],a===null?t[u]=[l]:a.push(l),l.lane=e|536870912),n):null}function tn(t){if(50<pu)throw pu=0,wc=null,Error(f(185));for(var l=t.return;l!==null;)t=l,l=t.return;return t.tag===3?t.stateNode:null}var oa={};function gy(t,l,e,a){this.tag=t,this.key=e,this.sibling=this.child=this.return=this.stateNode=this.type=this.elementType=null,this.index=0,this.refCleanup=this.ref=null,this.pendingProps=l,this.dependencies=this.memoizedState=this.updateQueue=this.memoizedProps=null,this.mode=a,this.subtreeFlags=this.flags=0,this.deletions=null,this.childLanes=this.lanes=0,this.alternate=null}function yl(t,l,e,a){return new gy(t,l,e,a)}function Hi(t){return t=t.prototype,!(!t||!t.isReactComponent)}function Zl(t,l){var e=t.alternate;return e===null?(e=yl(t.tag,l,t.key,t.mode),e.elementType=t.elementType,e.type=t.type,e.stateNode=t.stateNode,e.alternate=t,t.alternate=e):(e.pendingProps=l,e.type=t.type,e.flags=0,e.subtreeFlags=0,e.deletions=null),e.flags=t.flags&65011712,e.childLanes=t.childLanes,e.lanes=t.lanes,e.child=t.child,e.memoizedProps=t.memoizedProps,e.memoizedState=t.memoizedState,e.updateQueue=t.updateQueue,l=t.dependencies,e.dependencies=l===null?null:{lanes:l.lanes,firstContext:l.firstContext},e.sibling=t.sibling,e.index=t.index,e.ref=t.ref,e.refCleanup=t.refCleanup,e}function Br(t,l){t.flags&=65011714;var e=t.alternate;return e===null?(t.childLanes=0,t.lanes=l,t.child=null,t.subtreeFlags=0,t.memoizedProps=null,t.memoizedState=null,t.updateQueue=null,t.dependencies=null,t.stateNode=null):(t.childLanes=e.childLanes,t.lanes=e.lanes,t.child=e.child,t.subtreeFlags=0,t.deletions=null,t.memoizedProps=e.memoizedProps,t.memoizedState=e.memoizedState,t.updateQueue=e.updateQueue,t.type=e.type,l=e.dependencies,t.dependencies=l===null?null:{lanes:l.lanes,firstContext:l.firstContext}),t}function ln(t,l,e,a,u,n){var i=0;if(a=t,typeof t=="function")Hi(t)&&(i=1);else if(typeof t=="string")i=xm(t,e,q.current)?26:t==="html"||t==="head"||t==="body"?27:5;else t:switch(t){case It:return t=yl(31,e,l,u),t.elementType=It,t.lanes=n,t;case G:return Ye(e.children,u,n,l);case Q:i=8,u|=24;break;case L:return t=yl(12,e,l,u|2),t.elementType=L,t.lanes=n,t;case it:return t=yl(13,e,l,u),t.elementType=it,t.lanes=n,t;case Ot:return t=yl(19,e,l,u),t.elementType=Ot,t.lanes=n,t;default:if(typeof t=="object"&&t!==null)switch(t.$$typeof){case zt:i=10;break t;case gt:i=9;break t;case _t:i=11;break t;case J:i=14;break t;case Rt:i=16,a=null;break t}i=29,e=Error(f(130,t===null?"null":typeof t,"")),a=null}return l=yl(i,e,l,u),l.elementType=t,l.type=a,l.lanes=n,l}function Ye(t,l,e,a){return t=yl(7,t,a,l),t.lanes=e,t}function Bi(t,l,e){return t=yl(6,t,null,l),t.lanes=e,t}function qr(t){var l=yl(18,null,null,0);return l.stateNode=t,l}function qi(t,l,e){return l=yl(4,t.children!==null?t.children:[],t.key,l),l.lanes=e,l.stateNode={containerInfo:t.containerInfo,pendingChildren:null,implementation:t.implementation},l}var Yr=new WeakMap;function zl(t,l){if(typeof t=="object"&&t!==null){var e=Yr.get(t);return e!==void 0?e:(l={value:t,source:l,stack:qf(l)},Yr.set(t,l),l)}return{value:t,source:l,stack:qf(l)}}var sa=[],da=0,en=null,Ia=0,Tl=[],El=0,ce=null,Hl=1,Bl="";function wl(t,l){sa[da++]=Ia,sa[da++]=en,en=t,Ia=l}function Gr(t,l,e){Tl[El++]=Hl,Tl[El++]=Bl,Tl[El++]=ce,ce=t;var a=Hl;t=Bl;var u=32-sl(a)-1;a&=~(1<<u),e+=1;var n=32-sl(l)+u;if(30<n){var i=u-u%5;n=(a&(1<<i)-1).toString(32),a>>=i,u-=i,Hl=1<<32-sl(l)+u|e<<u|a,Bl=n+t}else Hl=1<<n|e<<u|a,Bl=t}function Yi(t){t.return!==null&&(wl(t,1),Gr(t,1,0))}function Gi(t){for(;t===en;)en=sa[--da],sa[da]=null,Ia=sa[--da],sa[da]=null;for(;t===ce;)ce=Tl[--El],Tl[El]=null,Bl=Tl[--El],Tl[El]=null,Hl=Tl[--El],Tl[El]=null}function Xr(t,l){Tl[El++]=Hl,Tl[El++]=Bl,Tl[El++]=ce,Hl=l.id,Bl=l.overflow,ce=t}var Lt=null,Tt=null,ut=!1,fe=null,Al=!1,Xi=Error(f(519));function re(t){var l=Error(f(418,1<arguments.length&&arguments[1]!==void 0&&arguments[1]?"text":"HTML",""));throw Pa(zl(l,t)),Xi}function Qr(t){var l=t.stateNode,e=t.type,a=t.memoizedProps;switch(l[wt]=t,l[el]=a,e){case"dialog":lt("cancel",l),lt("close",l);break;case"iframe":case"object":case"embed":lt("load",l);break;case"video":case"audio":for(e=0;e<xu.length;e++)lt(xu[e],l);break;case"source":lt("error",l);break;case"img":case"image":case"link":lt("error",l),lt("load",l);break;case"details":lt("toggle",l);break;case"input":lt("invalid",l),tr(l,a.value,a.defaultValue,a.checked,a.defaultChecked,a.type,a.name,!0);break;case"select":lt("invalid",l);break;case"textarea":lt("invalid",l),er(l,a.value,a.defaultValue,a.children)}e=a.children,typeof e!="string"&&typeof e!="number"&&typeof e!="bigint"||l.textContent===""+e||a.suppressHydrationWarning===!0||nd(l.textContent,e)?(a.popover!=null&&(lt("beforetoggle",l),lt("toggle",l)),a.onScroll!=null&&lt("scroll",l),a.onScrollEnd!=null&&lt("scrollend",l),a.onClick!=null&&(l.onclick=Xl),l=!0):l=!1,l||re(t,!0)}function Zr(t){for(Lt=t.return;Lt;)switch(Lt.tag){case 5:case 31:case 13:Al=!1;return;case 27:case 3:Al=!0;return;default:Lt=Lt.return}}function ya(t){if(t!==Lt)return!1;if(!ut)return Zr(t),ut=!0,!1;var l=t.tag,e;if((e=l!==3&&l!==27)&&((e=l===5)&&(e=t.type,e=!(e!=="form"&&e!=="button")||uf(t.type,t.memoizedProps)),e=!e),e&&Tt&&re(t),Zr(t),l===13){if(t=t.memoizedState,t=t!==null?t.dehydrated:null,!t)throw Error(f(317));Tt=md(t)}else if(l===31){if(t=t.memoizedState,t=t!==null?t.dehydrated:null,!t)throw Error(f(317));Tt=md(t)}else l===27?(l=Tt,Te(t.type)?(t=of,of=null,Tt=t):Tt=l):Tt=Lt?_l(t.stateNode.nextSibling):null;return!0}function Ge(){Tt=Lt=null,ut=!1}function Qi(){var t=fe;return t!==null&&(cl===null?cl=t:cl.push.apply(cl,t),fe=null),t}function Pa(t){fe===null?fe=[t]:fe.push(t)}var Zi=s(null),Xe=null,Ll=null;function oe(t,l,e){j(Zi,l._currentValue),l._currentValue=e}function Vl(t){t._currentValue=Zi.current,M(Zi)}function wi(t,l,e){for(;t!==null;){var a=t.alternate;if((t.childLanes&l)!==l?(t.childLanes|=l,a!==null&&(a.childLanes|=l)):a!==null&&(a.childLanes&l)!==l&&(a.childLanes|=l),t===e)break;t=t.return}}function Li(t,l,e,a){var u=t.child;for(u!==null&&(u.return=t);u!==null;){var n=u.dependencies;if(n!==null){var i=u.child;n=n.firstContext;t:for(;n!==null;){var c=n;n=u;for(var o=0;o<l.length;o++)if(c.context===l[o]){n.lanes|=e,c=n.alternate,c!==null&&(c.lanes|=e),wi(n.return,e,t),a||(i=null);break t}n=c.next}}else if(u.tag===18){if(i=u.return,i===null)throw Error(f(341));i.lanes|=e,n=i.alternate,n!==null&&(n.lanes|=e),wi(i,e,t),i=null}else i=u.child;if(i!==null)i.return=u;else for(i=u;i!==null;){if(i===t){i=null;break}if(u=i.sibling,u!==null){u.return=i.return,i=u;break}i=i.return}u=i}}function ma(t,l,e,a){t=null;for(var u=l,n=!1;u!==null;){if(!n){if((u.flags&524288)!==0)n=!0;else if((u.flags&262144)!==0)break}if(u.tag===10){var i=u.alternate;if(i===null)throw Error(f(387));if(i=i.memoizedProps,i!==null){var c=u.type;dl(u.pendingProps.value,i.value)||(t!==null?t.push(c):t=[c])}}else if(u===yt.current){if(i=u.alternate,i===null)throw Error(f(387));i.memoizedState.memoizedState!==u.memoizedState.memoizedState&&(t!==null?t.push(Mu):t=[Mu])}u=u.return}t!==null&&Li(l,t,e,a),l.flags|=262144}function an(t){for(t=t.firstContext;t!==null;){if(!dl(t.context._currentValue,t.memoizedValue))return!0;t=t.next}return!1}function Qe(t){Xe=t,Ll=null,t=t.dependencies,t!==null&&(t.firstContext=null)}function Vt(t){return wr(Xe,t)}function un(t,l){return Xe===null&&Qe(t),wr(t,l)}function wr(t,l){var e=l._currentValue;if(l={context:l,memoizedValue:e,next:null},Ll===null){if(t===null)throw Error(f(308));Ll=l,t.dependencies={lanes:0,firstContext:l},t.flags|=524288}else Ll=Ll.next=l;return e}var vy=typeof AbortController<"u"?AbortController:function(){var t=[],l=this.signal={aborted:!1,addEventListener:function(e,a){t.push(a)}};this.abort=function(){l.aborted=!0,t.forEach(function(e){return e()})}},by=r.unstable_scheduleCallback,py=r.unstable_NormalPriority,Ht={$$typeof:zt,Consumer:null,Provider:null,_currentValue:null,_currentValue2:null,_threadCount:0};function Vi(){return{controller:new vy,data:new Map,refCount:0}}function tu(t){t.refCount--,t.refCount===0&&by(py,function(){t.controller.abort()})}var lu=null,Ki=0,ha=0,ga=null;function Sy(t,l){if(lu===null){var e=lu=[];Ki=0,ha=Wc(),ga={status:"pending",value:void 0,then:function(a){e.push(a)}}}return Ki++,l.then(Lr,Lr),l}function Lr(){if(--Ki===0&&lu!==null){ga!==null&&(ga.status="fulfilled");var t=lu;lu=null,ha=0,ga=null;for(var l=0;l<t.length;l++)(0,t[l])()}}function xy(t,l){var e=[],a={status:"pending",value:null,reason:null,then:function(u){e.push(u)}};return t.then(function(){a.status="fulfilled",a.value=l;for(var u=0;u<e.length;u++)(0,e[u])(l)},function(u){for(a.status="rejected",a.reason=u,u=0;u<e.length;u++)(0,e[u])(void 0)}),a}var Vr=x.S;x.S=function(t,l){Ns=rl(),typeof l=="object"&&l!==null&&typeof l.then=="function"&&Sy(t,l),Vr!==null&&Vr(t,l)};var Ze=s(null);function Ji(){var t=Ze.current;return t!==null?t:St.pooledCache}function nn(t,l){l===null?j(Ze,Ze.current):j(Ze,l.pool)}function Kr(){var t=Ji();return t===null?null:{parent:Ht._currentValue,pool:t}}var va=Error(f(460)),ki=Error(f(474)),cn=Error(f(542)),fn={then:function(){}};function Jr(t){return t=t.status,t==="fulfilled"||t==="rejected"}function kr(t,l,e){switch(e=t[e],e===void 0?t.push(l):e!==l&&(l.then(Xl,Xl),l=e),l.status){case"fulfilled":return l.value;case"rejected":throw t=l.reason,$r(t),t;default:if(typeof l.status=="string")l.then(Xl,Xl);else{if(t=St,t!==null&&100<t.shellSuspendCounter)throw Error(f(482));t=l,t.status="pending",t.then(function(a){if(l.status==="pending"){var u=l;u.status="fulfilled",u.value=a}},function(a){if(l.status==="pending"){var u=l;u.status="rejected",u.reason=a}})}switch(l.status){case"fulfilled":return l.value;case"rejected":throw t=l.reason,$r(t),t}throw Le=l,va}}function we(t){try{var l=t._init;return l(t._payload)}catch(e){throw e!==null&&typeof e=="object"&&typeof e.then=="function"?(Le=e,va):e}}var Le=null;function Wr(){if(Le===null)throw Error(f(459));var t=Le;return Le=null,t}function $r(t){if(t===va||t===cn)throw Error(f(483))}var ba=null,eu=0;function rn(t){var l=eu;return eu+=1,ba===null&&(ba=[]),kr(ba,t,l)}function au(t,l){l=l.props.ref,t.ref=l!==void 0?l:null}function on(t,l){throw l.$$typeof===V?Error(f(525)):(t=Object.prototype.toString.call(l),Error(f(31,t==="[object Object]"?"object with keys {"+Object.keys(l).join(", ")+"}":t)))}function Fr(t){function l(y,d){if(t){var m=y.deletions;m===null?(y.deletions=[d],y.flags|=16):m.push(d)}}function e(y,d){if(!t)return null;for(;d!==null;)l(y,d),d=d.sibling;return null}function a(y){for(var d=new Map;y!==null;)y.key!==null?d.set(y.key,y):d.set(y.index,y),y=y.sibling;return d}function u(y,d){return y=Zl(y,d),y.index=0,y.sibling=null,y}function n(y,d,m){return y.index=m,t?(m=y.alternate,m!==null?(m=m.index,m<d?(y.flags|=67108866,d):m):(y.flags|=67108866,d)):(y.flags|=1048576,d)}function i(y){return t&&y.alternate===null&&(y.flags|=67108866),y}function c(y,d,m,T){return d===null||d.tag!==6?(d=Bi(m,y.mode,T),d.return=y,d):(d=u(d,m),d.return=y,d)}function o(y,d,m,T){var X=m.type;return X===G?z(y,d,m.props.children,T,m.key):d!==null&&(d.elementType===X||typeof X=="object"&&X!==null&&X.$$typeof===Rt&&we(X)===d.type)?(d=u(d,m.props),au(d,m),d.return=y,d):(d=ln(m.type,m.key,m.props,null,y.mode,T),au(d,m),d.return=y,d)}function h(y,d,m,T){return d===null||d.tag!==4||d.stateNode.containerInfo!==m.containerInfo||d.stateNode.implementation!==m.implementation?(d=qi(m,y.mode,T),d.return=y,d):(d=u(d,m.children||[]),d.return=y,d)}function z(y,d,m,T,X){return d===null||d.tag!==7?(d=Ye(m,y.mode,T,X),d.return=y,d):(d=u(d,m),d.return=y,d)}function E(y,d,m){if(typeof d=="string"&&d!==""||typeof d=="number"||typeof d=="bigint")return d=Bi(""+d,y.mode,m),d.return=y,d;if(typeof d=="object"&&d!==null){switch(d.$$typeof){case st:return m=ln(d.type,d.key,d.props,null,y.mode,m),au(m,d),m.return=y,m;case ct:return d=qi(d,y.mode,m),d.return=y,d;case Rt:return d=we(d),E(y,d,m)}if(ll(d)||I(d))return d=Ye(d,y.mode,m,null),d.return=y,d;if(typeof d.then=="function")return E(y,rn(d),m);if(d.$$typeof===zt)return E(y,un(y,d),m);on(y,d)}return null}function g(y,d,m,T){var X=d!==null?d.key:null;if(typeof m=="string"&&m!==""||typeof m=="number"||typeof m=="bigint")return X!==null?null:c(y,d,""+m,T);if(typeof m=="object"&&m!==null){switch(m.$$typeof){case st:return m.key===X?o(y,d,m,T):null;case ct:return m.key===X?h(y,d,m,T):null;case Rt:return m=we(m),g(y,d,m,T)}if(ll(m)||I(m))return X!==null?null:z(y,d,m,T,null);if(typeof m.then=="function")return g(y,d,rn(m),T);if(m.$$typeof===zt)return g(y,d,un(y,m),T);on(y,m)}return null}function b(y,d,m,T,X){if(typeof T=="string"&&T!==""||typeof T=="number"||typeof T=="bigint")return y=y.get(m)||null,c(d,y,""+T,X);if(typeof T=="object"&&T!==null){switch(T.$$typeof){case st:return y=y.get(T.key===null?m:T.key)||null,o(d,y,T,X);case ct:return y=y.get(T.key===null?m:T.key)||null,h(d,y,T,X);case Rt:return T=we(T),b(y,d,m,T,X)}if(ll(T)||I(T))return y=y.get(m)||null,z(d,y,T,X,null);if(typeof T.then=="function")return b(y,d,m,rn(T),X);if(T.$$typeof===zt)return b(y,d,m,un(d,T),X);on(d,T)}return null}function B(y,d,m,T){for(var X=null,ft=null,Y=d,$=d=0,at=null;Y!==null&&$<m.length;$++){Y.index>$?(at=Y,Y=null):at=Y.sibling;var rt=g(y,Y,m[$],T);if(rt===null){Y===null&&(Y=at);break}t&&Y&&rt.alternate===null&&l(y,Y),d=n(rt,d,$),ft===null?X=rt:ft.sibling=rt,ft=rt,Y=at}if($===m.length)return e(y,Y),ut&&wl(y,$),X;if(Y===null){for(;$<m.length;$++)Y=E(y,m[$],T),Y!==null&&(d=n(Y,d,$),ft===null?X=Y:ft.sibling=Y,ft=Y);return ut&&wl(y,$),X}for(Y=a(Y);$<m.length;$++)at=b(Y,y,$,m[$],T),at!==null&&(t&&at.alternate!==null&&Y.delete(at.key===null?$:at.key),d=n(at,d,$),ft===null?X=at:ft.sibling=at,ft=at);return t&&Y.forEach(function(Oe){return l(y,Oe)}),ut&&wl(y,$),X}function w(y,d,m,T){if(m==null)throw Error(f(151));for(var X=null,ft=null,Y=d,$=d=0,at=null,rt=m.next();Y!==null&&!rt.done;$++,rt=m.next()){Y.index>$?(at=Y,Y=null):at=Y.sibling;var Oe=g(y,Y,rt.value,T);if(Oe===null){Y===null&&(Y=at);break}t&&Y&&Oe.alternate===null&&l(y,Y),d=n(Oe,d,$),ft===null?X=Oe:ft.sibling=Oe,ft=Oe,Y=at}if(rt.done)return e(y,Y),ut&&wl(y,$),X;if(Y===null){for(;!rt.done;$++,rt=m.next())rt=E(y,rt.value,T),rt!==null&&(d=n(rt,d,$),ft===null?X=rt:ft.sibling=rt,ft=rt);return ut&&wl(y,$),X}for(Y=a(Y);!rt.done;$++,rt=m.next())rt=b(Y,y,$,rt.value,T),rt!==null&&(t&&rt.alternate!==null&&Y.delete(rt.key===null?$:rt.key),d=n(rt,d,$),ft===null?X=rt:ft.sibling=rt,ft=rt);return t&&Y.forEach(function(Cm){return l(y,Cm)}),ut&&wl(y,$),X}function pt(y,d,m,T){if(typeof m=="object"&&m!==null&&m.type===G&&m.key===null&&(m=m.props.children),typeof m=="object"&&m!==null){switch(m.$$typeof){case st:t:{for(var X=m.key;d!==null;){if(d.key===X){if(X=m.type,X===G){if(d.tag===7){e(y,d.sibling),T=u(d,m.props.children),T.return=y,y=T;break t}}else if(d.elementType===X||typeof X=="object"&&X!==null&&X.$$typeof===Rt&&we(X)===d.type){e(y,d.sibling),T=u(d,m.props),au(T,m),T.return=y,y=T;break t}e(y,d);break}else l(y,d);d=d.sibling}m.type===G?(T=Ye(m.props.children,y.mode,T,m.key),T.return=y,y=T):(T=ln(m.type,m.key,m.props,null,y.mode,T),au(T,m),T.return=y,y=T)}return i(y);case ct:t:{for(X=m.key;d!==null;){if(d.key===X)if(d.tag===4&&d.stateNode.containerInfo===m.containerInfo&&d.stateNode.implementation===m.implementation){e(y,d.sibling),T=u(d,m.children||[]),T.return=y,y=T;break t}else{e(y,d);break}else l(y,d);d=d.sibling}T=qi(m,y.mode,T),T.return=y,y=T}return i(y);case Rt:return m=we(m),pt(y,d,m,T)}if(ll(m))return B(y,d,m,T);if(I(m)){if(X=I(m),typeof X!="function")throw Error(f(150));return m=X.call(m),w(y,d,m,T)}if(typeof m.then=="function")return pt(y,d,rn(m),T);if(m.$$typeof===zt)return pt(y,d,un(y,m),T);on(y,m)}return typeof m=="string"&&m!==""||typeof m=="number"||typeof m=="bigint"?(m=""+m,d!==null&&d.tag===6?(e(y,d.sibling),T=u(d,m),T.return=y,y=T):(e(y,d),T=Bi(m,y.mode,T),T.return=y,y=T),i(y)):e(y,d)}return function(y,d,m,T){try{eu=0;var X=pt(y,d,m,T);return ba=null,X}catch(Y){if(Y===va||Y===cn)throw Y;var ft=yl(29,Y,null,y.mode);return ft.lanes=T,ft.return=y,ft}}}var Ve=Fr(!0),Ir=Fr(!1),se=!1;function Wi(t){t.updateQueue={baseState:t.memoizedState,firstBaseUpdate:null,lastBaseUpdate:null,shared:{pending:null,lanes:0,hiddenCallbacks:null},callbacks:null}}function $i(t,l){t=t.updateQueue,l.updateQueue===t&&(l.updateQueue={baseState:t.baseState,firstBaseUpdate:t.firstBaseUpdate,lastBaseUpdate:t.lastBaseUpdate,shared:t.shared,callbacks:null})}function de(t){return{lane:t,tag:0,payload:null,callback:null,next:null}}function ye(t,l,e){var a=t.updateQueue;if(a===null)return null;if(a=a.shared,(ot&2)!==0){var u=a.pending;return u===null?l.next=l:(l.next=u.next,u.next=l),a.pending=l,l=tn(t),Hr(t,null,e),l}return Pu(t,a,l,e),tn(t)}function uu(t,l,e){if(l=l.updateQueue,l!==null&&(l=l.shared,(e&4194048)!==0)){var a=l.lanes;a&=t.pendingLanes,e|=a,l.lanes=e,wf(t,e)}}function Fi(t,l){var e=t.updateQueue,a=t.alternate;if(a!==null&&(a=a.updateQueue,e===a)){var u=null,n=null;if(e=e.firstBaseUpdate,e!==null){do{var i={lane:e.lane,tag:e.tag,payload:e.payload,callback:null,next:null};n===null?u=n=i:n=n.next=i,e=e.next}while(e!==null);n===null?u=n=l:n=n.next=l}else u=n=l;e={baseState:a.baseState,firstBaseUpdate:u,lastBaseUpdate:n,shared:a.shared,callbacks:a.callbacks},t.updateQueue=e;return}t=e.lastBaseUpdate,t===null?e.firstBaseUpdate=l:t.next=l,e.lastBaseUpdate=l}var Ii=!1;function nu(){if(Ii){var t=ga;if(t!==null)throw t}}function iu(t,l,e,a){Ii=!1;var u=t.updateQueue;se=!1;var n=u.firstBaseUpdate,i=u.lastBaseUpdate,c=u.shared.pending;if(c!==null){u.shared.pending=null;var o=c,h=o.next;o.next=null,i===null?n=h:i.next=h,i=o;var z=t.alternate;z!==null&&(z=z.updateQueue,c=z.lastBaseUpdate,c!==i&&(c===null?z.firstBaseUpdate=h:c.next=h,z.lastBaseUpdate=o))}if(n!==null){var E=u.baseState;i=0,z=h=o=null,c=n;do{var g=c.lane&-536870913,b=g!==c.lane;if(b?(et&g)===g:(a&g)===g){g!==0&&g===ha&&(Ii=!0),z!==null&&(z=z.next={lane:0,tag:c.tag,payload:c.payload,callback:null,next:null});t:{var B=t,w=c;g=l;var pt=e;switch(w.tag){case 1:if(B=w.payload,typeof B=="function"){E=B.call(pt,E,g);break t}E=B;break t;case 3:B.flags=B.flags&-65537|128;case 0:if(B=w.payload,g=typeof B=="function"?B.call(pt,E,g):B,g==null)break t;E=H({},E,g);break t;case 2:se=!0}}g=c.callback,g!==null&&(t.flags|=64,b&&(t.flags|=8192),b=u.callbacks,b===null?u.callbacks=[g]:b.push(g))}else b={lane:g,tag:c.tag,payload:c.payload,callback:c.callback,next:null},z===null?(h=z=b,o=E):z=z.next=b,i|=g;if(c=c.next,c===null){if(c=u.shared.pending,c===null)break;b=c,c=b.next,b.next=null,u.lastBaseUpdate=b,u.shared.pending=null}}while(!0);z===null&&(o=E),u.baseState=o,u.firstBaseUpdate=h,u.lastBaseUpdate=z,n===null&&(u.shared.lanes=0),be|=i,t.lanes=i,t.memoizedState=E}}function Pr(t,l){if(typeof t!="function")throw Error(f(191,t));t.call(l)}function to(t,l){var e=t.callbacks;if(e!==null)for(t.callbacks=null,t=0;t<e.length;t++)Pr(e[t],l)}var pa=s(null),sn=s(0);function lo(t,l){t=te,j(sn,t),j(pa,l),te=t|l.baseLanes}function Pi(){j(sn,te),j(pa,pa.current)}function tc(){te=sn.current,M(pa),M(sn)}var ml=s(null),Ml=null;function me(t){var l=t.alternate;j(Ct,Ct.current&1),j(ml,t),Ml===null&&(l===null||pa.current!==null||l.memoizedState!==null)&&(Ml=t)}function lc(t){j(Ct,Ct.current),j(ml,t),Ml===null&&(Ml=t)}function eo(t){t.tag===22?(j(Ct,Ct.current),j(ml,t),Ml===null&&(Ml=t)):he()}function he(){j(Ct,Ct.current),j(ml,ml.current)}function hl(t){M(ml),Ml===t&&(Ml=null),M(Ct)}var Ct=s(0);function dn(t){for(var l=t;l!==null;){if(l.tag===13){var e=l.memoizedState;if(e!==null&&(e=e.dehydrated,e===null||ff(e)||rf(e)))return l}else if(l.tag===19&&(l.memoizedProps.revealOrder==="forwards"||l.memoizedProps.revealOrder==="backwards"||l.memoizedProps.revealOrder==="unstable_legacy-backwards"||l.memoizedProps.revealOrder==="together")){if((l.flags&128)!==0)return l}else if(l.child!==null){l.child.return=l,l=l.child;continue}if(l===t)break;for(;l.sibling===null;){if(l.return===null||l.return===t)return null;l=l.return}l.sibling.return=l.return,l=l.sibling}return null}var Kl=0,W=null,vt=null,Bt=null,yn=!1,Sa=!1,Ke=!1,mn=0,cu=0,xa=null,zy=0;function Nt(){throw Error(f(321))}function ec(t,l){if(l===null)return!1;for(var e=0;e<l.length&&e<t.length;e++)if(!dl(t[e],l[e]))return!1;return!0}function ac(t,l,e,a,u,n){return Kl=n,W=l,l.memoizedState=null,l.updateQueue=null,l.lanes=0,x.H=t===null||t.memoizedState===null?Xo:bc,Ke=!1,n=e(a,u),Ke=!1,Sa&&(n=uo(l,e,a,u)),ao(t),n}function ao(t){x.H=ou;var l=vt!==null&&vt.next!==null;if(Kl=0,Bt=vt=W=null,yn=!1,cu=0,xa=null,l)throw Error(f(300));t===null||qt||(t=t.dependencies,t!==null&&an(t)&&(qt=!0))}function uo(t,l,e,a){W=t;var u=0;do{if(Sa&&(xa=null),cu=0,Sa=!1,25<=u)throw Error(f(301));if(u+=1,Bt=vt=null,t.updateQueue!=null){var n=t.updateQueue;n.lastEffect=null,n.events=null,n.stores=null,n.memoCache!=null&&(n.memoCache.index=0)}x.H=Qo,n=l(e,a)}while(Sa);return n}function Ty(){var t=x.H,l=t.useState()[0];return l=typeof l.then=="function"?fu(l):l,t=t.useState()[0],(vt!==null?vt.memoizedState:null)!==t&&(W.flags|=1024),l}function uc(){var t=mn!==0;return mn=0,t}function nc(t,l,e){l.updateQueue=t.updateQueue,l.flags&=-2053,t.lanes&=~e}function ic(t){if(yn){for(t=t.memoizedState;t!==null;){var l=t.queue;l!==null&&(l.pending=null),t=t.next}yn=!1}Kl=0,Bt=vt=W=null,Sa=!1,cu=mn=0,xa=null}function $t(){var t={memoizedState:null,baseState:null,baseQueue:null,queue:null,next:null};return Bt===null?W.memoizedState=Bt=t:Bt=Bt.next=t,Bt}function jt(){if(vt===null){var t=W.alternate;t=t!==null?t.memoizedState:null}else t=vt.next;var l=Bt===null?W.memoizedState:Bt.next;if(l!==null)Bt=l,vt=t;else{if(t===null)throw W.alternate===null?Error(f(467)):Error(f(310));vt=t,t={memoizedState:vt.memoizedState,baseState:vt.baseState,baseQueue:vt.baseQueue,queue:vt.queue,next:null},Bt===null?W.memoizedState=Bt=t:Bt=Bt.next=t}return Bt}function hn(){return{lastEffect:null,events:null,stores:null,memoCache:null}}function fu(t){var l=cu;return cu+=1,xa===null&&(xa=[]),t=kr(xa,t,l),l=W,(Bt===null?l.memoizedState:Bt.next)===null&&(l=l.alternate,x.H=l===null||l.memoizedState===null?Xo:bc),t}function gn(t){if(t!==null&&typeof t=="object"){if(typeof t.then=="function")return fu(t);if(t.$$typeof===zt)return Vt(t)}throw Error(f(438,String(t)))}function cc(t){var l=null,e=W.updateQueue;if(e!==null&&(l=e.memoCache),l==null){var a=W.alternate;a!==null&&(a=a.updateQueue,a!==null&&(a=a.memoCache,a!=null&&(l={data:a.data.map(function(u){return u.slice()}),index:0})))}if(l==null&&(l={data:[],index:0}),e===null&&(e=hn(),W.updateQueue=e),e.memoCache=l,e=l.data[l.index],e===void 0)for(e=l.data[l.index]=Array(t),a=0;a<t;a++)e[a]=jl;return l.index++,e}function Jl(t,l){return typeof l=="function"?l(t):l}function vn(t){var l=jt();return fc(l,vt,t)}function fc(t,l,e){var a=t.queue;if(a===null)throw Error(f(311));a.lastRenderedReducer=e;var u=t.baseQueue,n=a.pending;if(n!==null){if(u!==null){var i=u.next;u.next=n.next,n.next=i}l.baseQueue=u=n,a.pending=null}if(n=t.baseState,u===null)t.memoizedState=n;else{l=u.next;var c=i=null,o=null,h=l,z=!1;do{var E=h.lane&-536870913;if(E!==h.lane?(et&E)===E:(Kl&E)===E){var g=h.revertLane;if(g===0)o!==null&&(o=o.next={lane:0,revertLane:0,gesture:null,action:h.action,hasEagerState:h.hasEagerState,eagerState:h.eagerState,next:null}),E===ha&&(z=!0);else if((Kl&g)===g){h=h.next,g===ha&&(z=!0);continue}else E={lane:0,revertLane:h.revertLane,gesture:null,action:h.action,hasEagerState:h.hasEagerState,eagerState:h.eagerState,next:null},o===null?(c=o=E,i=n):o=o.next=E,W.lanes|=g,be|=g;E=h.action,Ke&&e(n,E),n=h.hasEagerState?h.eagerState:e(n,E)}else g={lane:E,revertLane:h.revertLane,gesture:h.gesture,action:h.action,hasEagerState:h.hasEagerState,eagerState:h.eagerState,next:null},o===null?(c=o=g,i=n):o=o.next=g,W.lanes|=E,be|=E;h=h.next}while(h!==null&&h!==l);if(o===null?i=n:o.next=c,!dl(n,t.memoizedState)&&(qt=!0,z&&(e=ga,e!==null)))throw e;t.memoizedState=n,t.baseState=i,t.baseQueue=o,a.lastRenderedState=n}return u===null&&(a.lanes=0),[t.memoizedState,a.dispatch]}function rc(t){var l=jt(),e=l.queue;if(e===null)throw Error(f(311));e.lastRenderedReducer=t;var a=e.dispatch,u=e.pending,n=l.memoizedState;if(u!==null){e.pending=null;var i=u=u.next;do n=t(n,i.action),i=i.next;while(i!==u);dl(n,l.memoizedState)||(qt=!0),l.memoizedState=n,l.baseQueue===null&&(l.baseState=n),e.lastRenderedState=n}return[n,a]}function no(t,l,e){var a=W,u=jt(),n=ut;if(n){if(e===void 0)throw Error(f(407));e=e()}else e=l();var i=!dl((vt||u).memoizedState,e);if(i&&(u.memoizedState=e,qt=!0),u=u.queue,dc(fo.bind(null,a,u,t),[t]),u.getSnapshot!==l||i||Bt!==null&&Bt.memoizedState.tag&1){if(a.flags|=2048,za(9,{destroy:void 0},co.bind(null,a,u,e,l),null),St===null)throw Error(f(349));n||(Kl&127)!==0||io(a,l,e)}return e}function io(t,l,e){t.flags|=16384,t={getSnapshot:l,value:e},l=W.updateQueue,l===null?(l=hn(),W.updateQueue=l,l.stores=[t]):(e=l.stores,e===null?l.stores=[t]:e.push(t))}function co(t,l,e,a){l.value=e,l.getSnapshot=a,ro(l)&&oo(t)}function fo(t,l,e){return e(function(){ro(l)&&oo(t)})}function ro(t){var l=t.getSnapshot;t=t.value;try{var e=l();return!dl(t,e)}catch{return!0}}function oo(t){var l=qe(t,2);l!==null&&fl(l,t,2)}function oc(t){var l=$t();if(typeof t=="function"){var e=t;if(t=e(),Ke){ue(!0);try{e()}finally{ue(!1)}}}return l.memoizedState=l.baseState=t,l.queue={pending:null,lanes:0,dispatch:null,lastRenderedReducer:Jl,lastRenderedState:t},l}function so(t,l,e,a){return t.baseState=e,fc(t,vt,typeof a=="function"?a:Jl)}function Ey(t,l,e,a,u){if(Sn(t))throw Error(f(485));if(t=l.action,t!==null){var n={payload:u,action:t,next:null,isTransition:!0,status:"pending",value:null,reason:null,listeners:[],then:function(i){n.listeners.push(i)}};x.T!==null?e(!0):n.isTransition=!1,a(n),e=l.pending,e===null?(n.next=l.pending=n,yo(l,n)):(n.next=e.next,l.pending=e.next=n)}}function yo(t,l){var e=l.action,a=l.payload,u=t.state;if(l.isTransition){var n=x.T,i={};x.T=i;try{var c=e(u,a),o=x.S;o!==null&&o(i,c),mo(t,l,c)}catch(h){sc(t,l,h)}finally{n!==null&&i.types!==null&&(n.types=i.types),x.T=n}}else try{n=e(u,a),mo(t,l,n)}catch(h){sc(t,l,h)}}function mo(t,l,e){e!==null&&typeof e=="object"&&typeof e.then=="function"?e.then(function(a){ho(t,l,a)},function(a){return sc(t,l,a)}):ho(t,l,e)}function ho(t,l,e){l.status="fulfilled",l.value=e,go(l),t.state=e,l=t.pending,l!==null&&(e=l.next,e===l?t.pending=null:(e=e.next,l.next=e,yo(t,e)))}function sc(t,l,e){var a=t.pending;if(t.pending=null,a!==null){a=a.next;do l.status="rejected",l.reason=e,go(l),l=l.next;while(l!==a)}t.action=null}function go(t){t=t.listeners;for(var l=0;l<t.length;l++)(0,t[l])()}function vo(t,l){return l}function bo(t,l){if(ut){var e=St.formState;if(e!==null){t:{var a=W;if(ut){if(Tt){l:{for(var u=Tt,n=Al;u.nodeType!==8;){if(!n){u=null;break l}if(u=_l(u.nextSibling),u===null){u=null;break l}}n=u.data,u=n==="F!"||n==="F"?u:null}if(u){Tt=_l(u.nextSibling),a=u.data==="F!";break t}}re(a)}a=!1}a&&(l=e[0])}}return e=$t(),e.memoizedState=e.baseState=l,a={pending:null,lanes:0,dispatch:null,lastRenderedReducer:vo,lastRenderedState:l},e.queue=a,e=qo.bind(null,W,a),a.dispatch=e,a=oc(!1),n=vc.bind(null,W,!1,a.queue),a=$t(),u={state:l,dispatch:null,action:t,pending:null},a.queue=u,e=Ey.bind(null,W,u,n,e),u.dispatch=e,a.memoizedState=t,[l,e,!1]}function po(t){var l=jt();return So(l,vt,t)}function So(t,l,e){if(l=fc(t,l,vo)[0],t=vn(Jl)[0],typeof l=="object"&&l!==null&&typeof l.then=="function")try{var a=fu(l)}catch(i){throw i===va?cn:i}else a=l;l=jt();var u=l.queue,n=u.dispatch;return e!==l.memoizedState&&(W.flags|=2048,za(9,{destroy:void 0},Ay.bind(null,u,e),null)),[a,n,t]}function Ay(t,l){t.action=l}function xo(t){var l=jt(),e=vt;if(e!==null)return So(l,e,t);jt(),l=l.memoizedState,e=jt();var a=e.queue.dispatch;return e.memoizedState=t,[l,a,!1]}function za(t,l,e,a){return t={tag:t,create:e,deps:a,inst:l,next:null},l=W.updateQueue,l===null&&(l=hn(),W.updateQueue=l),e=l.lastEffect,e===null?l.lastEffect=t.next=t:(a=e.next,e.next=t,t.next=a,l.lastEffect=t),t}function zo(){return jt().memoizedState}function bn(t,l,e,a){var u=$t();W.flags|=t,u.memoizedState=za(1|l,{destroy:void 0},e,a===void 0?null:a)}function pn(t,l,e,a){var u=jt();a=a===void 0?null:a;var n=u.memoizedState.inst;vt!==null&&a!==null&&ec(a,vt.memoizedState.deps)?u.memoizedState=za(l,n,e,a):(W.flags|=t,u.memoizedState=za(1|l,n,e,a))}function To(t,l){bn(8390656,8,t,l)}function dc(t,l){pn(2048,8,t,l)}function My(t){W.flags|=4;var l=W.updateQueue;if(l===null)l=hn(),W.updateQueue=l,l.events=[t];else{var e=l.events;e===null?l.events=[t]:e.push(t)}}function Eo(t){var l=jt().memoizedState;return My({ref:l,nextImpl:t}),function(){if((ot&2)!==0)throw Error(f(440));return l.impl.apply(void 0,arguments)}}function Ao(t,l){return pn(4,2,t,l)}function Mo(t,l){return pn(4,4,t,l)}function _o(t,l){if(typeof l=="function"){t=t();var e=l(t);return function(){typeof e=="function"?e():l(null)}}if(l!=null)return t=t(),l.current=t,function(){l.current=null}}function Oo(t,l,e){e=e!=null?e.concat([t]):null,pn(4,4,_o.bind(null,l,t),e)}function yc(){}function No(t,l){var e=jt();l=l===void 0?null:l;var a=e.memoizedState;return l!==null&&ec(l,a[1])?a[0]:(e.memoizedState=[t,l],t)}function Do(t,l){var e=jt();l=l===void 0?null:l;var a=e.memoizedState;if(l!==null&&ec(l,a[1]))return a[0];if(a=t(),Ke){ue(!0);try{t()}finally{ue(!1)}}return e.memoizedState=[a,l],a}function mc(t,l,e){return e===void 0||(Kl&1073741824)!==0&&(et&261930)===0?t.memoizedState=l:(t.memoizedState=e,t=Us(),W.lanes|=t,be|=t,e)}function Uo(t,l,e,a){return dl(e,l)?e:pa.current!==null?(t=mc(t,e,a),dl(t,l)||(qt=!0),t):(Kl&42)===0||(Kl&1073741824)!==0&&(et&261930)===0?(qt=!0,t.memoizedState=e):(t=Us(),W.lanes|=t,be|=t,l)}function Co(t,l,e,a,u){var n=C.p;C.p=n!==0&&8>n?n:8;var i=x.T,c={};x.T=c,vc(t,!1,l,e);try{var o=u(),h=x.S;if(h!==null&&h(c,o),o!==null&&typeof o=="object"&&typeof o.then=="function"){var z=xy(o,a);ru(t,l,z,bl(t))}else ru(t,l,a,bl(t))}catch(E){ru(t,l,{then:function(){},status:"rejected",reason:E},bl())}finally{C.p=n,i!==null&&c.types!==null&&(i.types=c.types),x.T=i}}function _y(){}function hc(t,l,e,a){if(t.tag!==5)throw Error(f(476));var u=jo(t).queue;Co(t,u,l,Z,e===null?_y:function(){return Ro(t),e(a)})}function jo(t){var l=t.memoizedState;if(l!==null)return l;l={memoizedState:Z,baseState:Z,baseQueue:null,queue:{pending:null,lanes:0,dispatch:null,lastRenderedReducer:Jl,lastRenderedState:Z},next:null};var e={};return l.next={memoizedState:e,baseState:e,baseQueue:null,queue:{pending:null,lanes:0,dispatch:null,lastRenderedReducer:Jl,lastRenderedState:e},next:null},t.memoizedState=l,t=t.alternate,t!==null&&(t.memoizedState=l),l}function Ro(t){var l=jo(t);l.next===null&&(l=t.alternate.memoizedState),ru(t,l.next.queue,{},bl())}function gc(){return Vt(Mu)}function Ho(){return jt().memoizedState}function Bo(){return jt().memoizedState}function Oy(t){for(var l=t.return;l!==null;){switch(l.tag){case 24:case 3:var e=bl();t=de(e);var a=ye(l,t,e);a!==null&&(fl(a,l,e),uu(a,l,e)),l={cache:Vi()},t.payload=l;return}l=l.return}}function Ny(t,l,e){var a=bl();e={lane:a,revertLane:0,gesture:null,action:e,hasEagerState:!1,eagerState:null,next:null},Sn(t)?Yo(l,e):(e=Ri(t,l,e,a),e!==null&&(fl(e,t,a),Go(e,l,a)))}function qo(t,l,e){var a=bl();ru(t,l,e,a)}function ru(t,l,e,a){var u={lane:a,revertLane:0,gesture:null,action:e,hasEagerState:!1,eagerState:null,next:null};if(Sn(t))Yo(l,u);else{var n=t.alternate;if(t.lanes===0&&(n===null||n.lanes===0)&&(n=l.lastRenderedReducer,n!==null))try{var i=l.lastRenderedState,c=n(i,e);if(u.hasEagerState=!0,u.eagerState=c,dl(c,i))return Pu(t,l,u,0),St===null&&Iu(),!1}catch{}if(e=Ri(t,l,u,a),e!==null)return fl(e,t,a),Go(e,l,a),!0}return!1}function vc(t,l,e,a){if(a={lane:2,revertLane:Wc(),gesture:null,action:a,hasEagerState:!1,eagerState:null,next:null},Sn(t)){if(l)throw Error(f(479))}else l=Ri(t,e,a,2),l!==null&&fl(l,t,2)}function Sn(t){var l=t.alternate;return t===W||l!==null&&l===W}function Yo(t,l){Sa=yn=!0;var e=t.pending;e===null?l.next=l:(l.next=e.next,e.next=l),t.pending=l}function Go(t,l,e){if((e&4194048)!==0){var a=l.lanes;a&=t.pendingLanes,e|=a,l.lanes=e,wf(t,e)}}var ou={readContext:Vt,use:gn,useCallback:Nt,useContext:Nt,useEffect:Nt,useImperativeHandle:Nt,useLayoutEffect:Nt,useInsertionEffect:Nt,useMemo:Nt,useReducer:Nt,useRef:Nt,useState:Nt,useDebugValue:Nt,useDeferredValue:Nt,useTransition:Nt,useSyncExternalStore:Nt,useId:Nt,useHostTransitionStatus:Nt,useFormState:Nt,useActionState:Nt,useOptimistic:Nt,useMemoCache:Nt,useCacheRefresh:Nt};ou.useEffectEvent=Nt;var Xo={readContext:Vt,use:gn,useCallback:function(t,l){return $t().memoizedState=[t,l===void 0?null:l],t},useContext:Vt,useEffect:To,useImperativeHandle:function(t,l,e){e=e!=null?e.concat([t]):null,bn(4194308,4,_o.bind(null,l,t),e)},useLayoutEffect:function(t,l){return bn(4194308,4,t,l)},useInsertionEffect:function(t,l){bn(4,2,t,l)},useMemo:function(t,l){var e=$t();l=l===void 0?null:l;var a=t();if(Ke){ue(!0);try{t()}finally{ue(!1)}}return e.memoizedState=[a,l],a},useReducer:function(t,l,e){var a=$t();if(e!==void 0){var u=e(l);if(Ke){ue(!0);try{e(l)}finally{ue(!1)}}}else u=l;return a.memoizedState=a.baseState=u,t={pending:null,lanes:0,dispatch:null,lastRenderedReducer:t,lastRenderedState:u},a.queue=t,t=t.dispatch=Ny.bind(null,W,t),[a.memoizedState,t]},useRef:function(t){var l=$t();return t={current:t},l.memoizedState=t},useState:function(t){t=oc(t);var l=t.queue,e=qo.bind(null,W,l);return l.dispatch=e,[t.memoizedState,e]},useDebugValue:yc,useDeferredValue:function(t,l){var e=$t();return mc(e,t,l)},useTransition:function(){var t=oc(!1);return t=Co.bind(null,W,t.queue,!0,!1),$t().memoizedState=t,[!1,t]},useSyncExternalStore:function(t,l,e){var a=W,u=$t();if(ut){if(e===void 0)throw Error(f(407));e=e()}else{if(e=l(),St===null)throw Error(f(349));(et&127)!==0||io(a,l,e)}u.memoizedState=e;var n={value:e,getSnapshot:l};return u.queue=n,To(fo.bind(null,a,n,t),[t]),a.flags|=2048,za(9,{destroy:void 0},co.bind(null,a,n,e,l),null),e},useId:function(){var t=$t(),l=St.identifierPrefix;if(ut){var e=Bl,a=Hl;e=(a&~(1<<32-sl(a)-1)).toString(32)+e,l="_"+l+"R_"+e,e=mn++,0<e&&(l+="H"+e.toString(32)),l+="_"}else e=zy++,l="_"+l+"r_"+e.toString(32)+"_";return t.memoizedState=l},useHostTransitionStatus:gc,useFormState:bo,useActionState:bo,useOptimistic:function(t){var l=$t();l.memoizedState=l.baseState=t;var e={pending:null,lanes:0,dispatch:null,lastRenderedReducer:null,lastRenderedState:null};return l.queue=e,l=vc.bind(null,W,!0,e),e.dispatch=l,[t,l]},useMemoCache:cc,useCacheRefresh:function(){return $t().memoizedState=Oy.bind(null,W)},useEffectEvent:function(t){var l=$t(),e={impl:t};return l.memoizedState=e,function(){if((ot&2)!==0)throw Error(f(440));return e.impl.apply(void 0,arguments)}}},bc={readContext:Vt,use:gn,useCallback:No,useContext:Vt,useEffect:dc,useImperativeHandle:Oo,useInsertionEffect:Ao,useLayoutEffect:Mo,useMemo:Do,useReducer:vn,useRef:zo,useState:function(){return vn(Jl)},useDebugValue:yc,useDeferredValue:function(t,l){var e=jt();return Uo(e,vt.memoizedState,t,l)},useTransition:function(){var t=vn(Jl)[0],l=jt().memoizedState;return[typeof t=="boolean"?t:fu(t),l]},useSyncExternalStore:no,useId:Ho,useHostTransitionStatus:gc,useFormState:po,useActionState:po,useOptimistic:function(t,l){var e=jt();return so(e,vt,t,l)},useMemoCache:cc,useCacheRefresh:Bo};bc.useEffectEvent=Eo;var Qo={readContext:Vt,use:gn,useCallback:No,useContext:Vt,useEffect:dc,useImperativeHandle:Oo,useInsertionEffect:Ao,useLayoutEffect:Mo,useMemo:Do,useReducer:rc,useRef:zo,useState:function(){return rc(Jl)},useDebugValue:yc,useDeferredValue:function(t,l){var e=jt();return vt===null?mc(e,t,l):Uo(e,vt.memoizedState,t,l)},useTransition:function(){var t=rc(Jl)[0],l=jt().memoizedState;return[typeof t=="boolean"?t:fu(t),l]},useSyncExternalStore:no,useId:Ho,useHostTransitionStatus:gc,useFormState:xo,useActionState:xo,useOptimistic:function(t,l){var e=jt();return vt!==null?so(e,vt,t,l):(e.baseState=t,[t,e.queue.dispatch])},useMemoCache:cc,useCacheRefresh:Bo};Qo.useEffectEvent=Eo;function pc(t,l,e,a){l=t.memoizedState,e=e(a,l),e=e==null?l:H({},l,e),t.memoizedState=e,t.lanes===0&&(t.updateQueue.baseState=e)}var Sc={enqueueSetState:function(t,l,e){t=t._reactInternals;var a=bl(),u=de(a);u.payload=l,e!=null&&(u.callback=e),l=ye(t,u,a),l!==null&&(fl(l,t,a),uu(l,t,a))},enqueueReplaceState:function(t,l,e){t=t._reactInternals;var a=bl(),u=de(a);u.tag=1,u.payload=l,e!=null&&(u.callback=e),l=ye(t,u,a),l!==null&&(fl(l,t,a),uu(l,t,a))},enqueueForceUpdate:function(t,l){t=t._reactInternals;var e=bl(),a=de(e);a.tag=2,l!=null&&(a.callback=l),l=ye(t,a,e),l!==null&&(fl(l,t,e),uu(l,t,e))}};function Zo(t,l,e,a,u,n,i){return t=t.stateNode,typeof t.shouldComponentUpdate=="function"?t.shouldComponentUpdate(a,n,i):l.prototype&&l.prototype.isPureReactComponent?!$a(e,a)||!$a(u,n):!0}function wo(t,l,e,a){t=l.state,typeof l.componentWillReceiveProps=="function"&&l.componentWillReceiveProps(e,a),typeof l.UNSAFE_componentWillReceiveProps=="function"&&l.UNSAFE_componentWillReceiveProps(e,a),l.state!==t&&Sc.enqueueReplaceState(l,l.state,null)}function Je(t,l){var e=l;if("ref"in l){e={};for(var a in l)a!=="ref"&&(e[a]=l[a])}if(t=t.defaultProps){e===l&&(e=H({},e));for(var u in t)e[u]===void 0&&(e[u]=t[u])}return e}function Lo(t){Fu(t)}function Vo(t){console.error(t)}function Ko(t){Fu(t)}function xn(t,l){try{var e=t.onUncaughtError;e(l.value,{componentStack:l.stack})}catch(a){setTimeout(function(){throw a})}}function Jo(t,l,e){try{var a=t.onCaughtError;a(e.value,{componentStack:e.stack,errorBoundary:l.tag===1?l.stateNode:null})}catch(u){setTimeout(function(){throw u})}}function xc(t,l,e){return e=de(e),e.tag=3,e.payload={element:null},e.callback=function(){xn(t,l)},e}function ko(t){return t=de(t),t.tag=3,t}function Wo(t,l,e,a){var u=e.type.getDerivedStateFromError;if(typeof u=="function"){var n=a.value;t.payload=function(){return u(n)},t.callback=function(){Jo(l,e,a)}}var i=e.stateNode;i!==null&&typeof i.componentDidCatch=="function"&&(t.callback=function(){Jo(l,e,a),typeof u!="function"&&(pe===null?pe=new Set([this]):pe.add(this));var c=a.stack;this.componentDidCatch(a.value,{componentStack:c!==null?c:""})})}function Dy(t,l,e,a,u){if(e.flags|=32768,a!==null&&typeof a=="object"&&typeof a.then=="function"){if(l=e.alternate,l!==null&&ma(l,e,u,!0),e=ml.current,e!==null){switch(e.tag){case 31:case 13:return Ml===null?jn():e.alternate===null&&Dt===0&&(Dt=3),e.flags&=-257,e.flags|=65536,e.lanes=u,a===fn?e.flags|=16384:(l=e.updateQueue,l===null?e.updateQueue=new Set([a]):l.add(a),Kc(t,a,u)),!1;case 22:return e.flags|=65536,a===fn?e.flags|=16384:(l=e.updateQueue,l===null?(l={transitions:null,markerInstances:null,retryQueue:new Set([a])},e.updateQueue=l):(e=l.retryQueue,e===null?l.retryQueue=new Set([a]):e.add(a)),Kc(t,a,u)),!1}throw Error(f(435,e.tag))}return Kc(t,a,u),jn(),!1}if(ut)return l=ml.current,l!==null?((l.flags&65536)===0&&(l.flags|=256),l.flags|=65536,l.lanes=u,a!==Xi&&(t=Error(f(422),{cause:a}),Pa(zl(t,e)))):(a!==Xi&&(l=Error(f(423),{cause:a}),Pa(zl(l,e))),t=t.current.alternate,t.flags|=65536,u&=-u,t.lanes|=u,a=zl(a,e),u=xc(t.stateNode,a,u),Fi(t,u),Dt!==4&&(Dt=2)),!1;var n=Error(f(520),{cause:a});if(n=zl(n,e),bu===null?bu=[n]:bu.push(n),Dt!==4&&(Dt=2),l===null)return!0;a=zl(a,e),e=l;do{switch(e.tag){case 3:return e.flags|=65536,t=u&-u,e.lanes|=t,t=xc(e.stateNode,a,t),Fi(e,t),!1;case 1:if(l=e.type,n=e.stateNode,(e.flags&128)===0&&(typeof l.getDerivedStateFromError=="function"||n!==null&&typeof n.componentDidCatch=="function"&&(pe===null||!pe.has(n))))return e.flags|=65536,u&=-u,e.lanes|=u,u=ko(u),Wo(u,t,e,a),Fi(e,u),!1}e=e.return}while(e!==null);return!1}var zc=Error(f(461)),qt=!1;function Kt(t,l,e,a){l.child=t===null?Ir(l,null,e,a):Ve(l,t.child,e,a)}function $o(t,l,e,a,u){e=e.render;var n=l.ref;if("ref"in a){var i={};for(var c in a)c!=="ref"&&(i[c]=a[c])}else i=a;return Qe(l),a=ac(t,l,e,i,n,u),c=uc(),t!==null&&!qt?(nc(t,l,u),kl(t,l,u)):(ut&&c&&Yi(l),l.flags|=1,Kt(t,l,a,u),l.child)}function Fo(t,l,e,a,u){if(t===null){var n=e.type;return typeof n=="function"&&!Hi(n)&&n.defaultProps===void 0&&e.compare===null?(l.tag=15,l.type=n,Io(t,l,n,a,u)):(t=ln(e.type,null,a,l,l.mode,u),t.ref=l.ref,t.return=l,l.child=t)}if(n=t.child,!Dc(t,u)){var i=n.memoizedProps;if(e=e.compare,e=e!==null?e:$a,e(i,a)&&t.ref===l.ref)return kl(t,l,u)}return l.flags|=1,t=Zl(n,a),t.ref=l.ref,t.return=l,l.child=t}function Io(t,l,e,a,u){if(t!==null){var n=t.memoizedProps;if($a(n,a)&&t.ref===l.ref)if(qt=!1,l.pendingProps=a=n,Dc(t,u))(t.flags&131072)!==0&&(qt=!0);else return l.lanes=t.lanes,kl(t,l,u)}return Tc(t,l,e,a,u)}function Po(t,l,e,a){var u=a.children,n=t!==null?t.memoizedState:null;if(t===null&&l.stateNode===null&&(l.stateNode={_visibility:1,_pendingMarkers:null,_retryCache:null,_transitions:null}),a.mode==="hidden"){if((l.flags&128)!==0){if(n=n!==null?n.baseLanes|e:e,t!==null){for(a=l.child=t.child,u=0;a!==null;)u=u|a.lanes|a.childLanes,a=a.sibling;a=u&~n}else a=0,l.child=null;return ts(t,l,n,e,a)}if((e&536870912)!==0)l.memoizedState={baseLanes:0,cachePool:null},t!==null&&nn(l,n!==null?n.cachePool:null),n!==null?lo(l,n):Pi(),eo(l);else return a=l.lanes=536870912,ts(t,l,n!==null?n.baseLanes|e:e,e,a)}else n!==null?(nn(l,n.cachePool),lo(l,n),he(),l.memoizedState=null):(t!==null&&nn(l,null),Pi(),he());return Kt(t,l,u,e),l.child}function su(t,l){return t!==null&&t.tag===22||l.stateNode!==null||(l.stateNode={_visibility:1,_pendingMarkers:null,_retryCache:null,_transitions:null}),l.sibling}function ts(t,l,e,a,u){var n=Ji();return n=n===null?null:{parent:Ht._currentValue,pool:n},l.memoizedState={baseLanes:e,cachePool:n},t!==null&&nn(l,null),Pi(),eo(l),t!==null&&ma(t,l,a,!0),l.childLanes=u,null}function zn(t,l){return l=En({mode:l.mode,children:l.children},t.mode),l.ref=t.ref,t.child=l,l.return=t,l}function ls(t,l,e){return Ve(l,t.child,null,e),t=zn(l,l.pendingProps),t.flags|=2,hl(l),l.memoizedState=null,t}function Uy(t,l,e){var a=l.pendingProps,u=(l.flags&128)!==0;if(l.flags&=-129,t===null){if(ut){if(a.mode==="hidden")return t=zn(l,a),l.lanes=536870912,su(null,t);if(lc(l),(t=Tt)?(t=yd(t,Al),t=t!==null&&t.data==="&"?t:null,t!==null&&(l.memoizedState={dehydrated:t,treeContext:ce!==null?{id:Hl,overflow:Bl}:null,retryLane:536870912,hydrationErrors:null},e=qr(t),e.return=l,l.child=e,Lt=l,Tt=null)):t=null,t===null)throw re(l);return l.lanes=536870912,null}return zn(l,a)}var n=t.memoizedState;if(n!==null){var i=n.dehydrated;if(lc(l),u)if(l.flags&256)l.flags&=-257,l=ls(t,l,e);else if(l.memoizedState!==null)l.child=t.child,l.flags|=128,l=null;else throw Error(f(558));else if(qt||ma(t,l,e,!1),u=(e&t.childLanes)!==0,qt||u){if(a=St,a!==null&&(i=Lf(a,e),i!==0&&i!==n.retryLane))throw n.retryLane=i,qe(t,i),fl(a,t,i),zc;jn(),l=ls(t,l,e)}else t=n.treeContext,Tt=_l(i.nextSibling),Lt=l,ut=!0,fe=null,Al=!1,t!==null&&Xr(l,t),l=zn(l,a),l.flags|=4096;return l}return t=Zl(t.child,{mode:a.mode,children:a.children}),t.ref=l.ref,l.child=t,t.return=l,t}function Tn(t,l){var e=l.ref;if(e===null)t!==null&&t.ref!==null&&(l.flags|=4194816);else{if(typeof e!="function"&&typeof e!="object")throw Error(f(284));(t===null||t.ref!==e)&&(l.flags|=4194816)}}function Tc(t,l,e,a,u){return Qe(l),e=ac(t,l,e,a,void 0,u),a=uc(),t!==null&&!qt?(nc(t,l,u),kl(t,l,u)):(ut&&a&&Yi(l),l.flags|=1,Kt(t,l,e,u),l.child)}function es(t,l,e,a,u,n){return Qe(l),l.updateQueue=null,e=uo(l,a,e,u),ao(t),a=uc(),t!==null&&!qt?(nc(t,l,n),kl(t,l,n)):(ut&&a&&Yi(l),l.flags|=1,Kt(t,l,e,n),l.child)}function as(t,l,e,a,u){if(Qe(l),l.stateNode===null){var n=oa,i=e.contextType;typeof i=="object"&&i!==null&&(n=Vt(i)),n=new e(a,n),l.memoizedState=n.state!==null&&n.state!==void 0?n.state:null,n.updater=Sc,l.stateNode=n,n._reactInternals=l,n=l.stateNode,n.props=a,n.state=l.memoizedState,n.refs={},Wi(l),i=e.contextType,n.context=typeof i=="object"&&i!==null?Vt(i):oa,n.state=l.memoizedState,i=e.getDerivedStateFromProps,typeof i=="function"&&(pc(l,e,i,a),n.state=l.memoizedState),typeof e.getDerivedStateFromProps=="function"||typeof n.getSnapshotBeforeUpdate=="function"||typeof n.UNSAFE_componentWillMount!="function"&&typeof n.componentWillMount!="function"||(i=n.state,typeof n.componentWillMount=="function"&&n.componentWillMount(),typeof n.UNSAFE_componentWillMount=="function"&&n.UNSAFE_componentWillMount(),i!==n.state&&Sc.enqueueReplaceState(n,n.state,null),iu(l,a,n,u),nu(),n.state=l.memoizedState),typeof n.componentDidMount=="function"&&(l.flags|=4194308),a=!0}else if(t===null){n=l.stateNode;var c=l.memoizedProps,o=Je(e,c);n.props=o;var h=n.context,z=e.contextType;i=oa,typeof z=="object"&&z!==null&&(i=Vt(z));var E=e.getDerivedStateFromProps;z=typeof E=="function"||typeof n.getSnapshotBeforeUpdate=="function",c=l.pendingProps!==c,z||typeof n.UNSAFE_componentWillReceiveProps!="function"&&typeof n.componentWillReceiveProps!="function"||(c||h!==i)&&wo(l,n,a,i),se=!1;var g=l.memoizedState;n.state=g,iu(l,a,n,u),nu(),h=l.memoizedState,c||g!==h||se?(typeof E=="function"&&(pc(l,e,E,a),h=l.memoizedState),(o=se||Zo(l,e,o,a,g,h,i))?(z||typeof n.UNSAFE_componentWillMount!="function"&&typeof n.componentWillMount!="function"||(typeof n.componentWillMount=="function"&&n.componentWillMount(),typeof n.UNSAFE_componentWillMount=="function"&&n.UNSAFE_componentWillMount()),typeof n.componentDidMount=="function"&&(l.flags|=4194308)):(typeof n.componentDidMount=="function"&&(l.flags|=4194308),l.memoizedProps=a,l.memoizedState=h),n.props=a,n.state=h,n.context=i,a=o):(typeof n.componentDidMount=="function"&&(l.flags|=4194308),a=!1)}else{n=l.stateNode,$i(t,l),i=l.memoizedProps,z=Je(e,i),n.props=z,E=l.pendingProps,g=n.context,h=e.contextType,o=oa,typeof h=="object"&&h!==null&&(o=Vt(h)),c=e.getDerivedStateFromProps,(h=typeof c=="function"||typeof n.getSnapshotBeforeUpdate=="function")||typeof n.UNSAFE_componentWillReceiveProps!="function"&&typeof n.componentWillReceiveProps!="function"||(i!==E||g!==o)&&wo(l,n,a,o),se=!1,g=l.memoizedState,n.state=g,iu(l,a,n,u),nu();var b=l.memoizedState;i!==E||g!==b||se||t!==null&&t.dependencies!==null&&an(t.dependencies)?(typeof c=="function"&&(pc(l,e,c,a),b=l.memoizedState),(z=se||Zo(l,e,z,a,g,b,o)||t!==null&&t.dependencies!==null&&an(t.dependencies))?(h||typeof n.UNSAFE_componentWillUpdate!="function"&&typeof n.componentWillUpdate!="function"||(typeof n.componentWillUpdate=="function"&&n.componentWillUpdate(a,b,o),typeof n.UNSAFE_componentWillUpdate=="function"&&n.UNSAFE_componentWillUpdate(a,b,o)),typeof n.componentDidUpdate=="function"&&(l.flags|=4),typeof n.getSnapshotBeforeUpdate=="function"&&(l.flags|=1024)):(typeof n.componentDidUpdate!="function"||i===t.memoizedProps&&g===t.memoizedState||(l.flags|=4),typeof n.getSnapshotBeforeUpdate!="function"||i===t.memoizedProps&&g===t.memoizedState||(l.flags|=1024),l.memoizedProps=a,l.memoizedState=b),n.props=a,n.state=b,n.context=o,a=z):(typeof n.componentDidUpdate!="function"||i===t.memoizedProps&&g===t.memoizedState||(l.flags|=4),typeof n.getSnapshotBeforeUpdate!="function"||i===t.memoizedProps&&g===t.memoizedState||(l.flags|=1024),a=!1)}return n=a,Tn(t,l),a=(l.flags&128)!==0,n||a?(n=l.stateNode,e=a&&typeof e.getDerivedStateFromError!="function"?null:n.render(),l.flags|=1,t!==null&&a?(l.child=Ve(l,t.child,null,u),l.child=Ve(l,null,e,u)):Kt(t,l,e,u),l.memoizedState=n.state,t=l.child):t=kl(t,l,u),t}function us(t,l,e,a){return Ge(),l.flags|=256,Kt(t,l,e,a),l.child}var Ec={dehydrated:null,treeContext:null,retryLane:0,hydrationErrors:null};function Ac(t){return{baseLanes:t,cachePool:Kr()}}function Mc(t,l,e){return t=t!==null?t.childLanes&~e:0,l&&(t|=vl),t}function ns(t,l,e){var a=l.pendingProps,u=!1,n=(l.flags&128)!==0,i;if((i=n)||(i=t!==null&&t.memoizedState===null?!1:(Ct.current&2)!==0),i&&(u=!0,l.flags&=-129),i=(l.flags&32)!==0,l.flags&=-33,t===null){if(ut){if(u?me(l):he(),(t=Tt)?(t=yd(t,Al),t=t!==null&&t.data!=="&"?t:null,t!==null&&(l.memoizedState={dehydrated:t,treeContext:ce!==null?{id:Hl,overflow:Bl}:null,retryLane:536870912,hydrationErrors:null},e=qr(t),e.return=l,l.child=e,Lt=l,Tt=null)):t=null,t===null)throw re(l);return rf(t)?l.lanes=32:l.lanes=536870912,null}var c=a.children;return a=a.fallback,u?(he(),u=l.mode,c=En({mode:"hidden",children:c},u),a=Ye(a,u,e,null),c.return=l,a.return=l,c.sibling=a,l.child=c,a=l.child,a.memoizedState=Ac(e),a.childLanes=Mc(t,i,e),l.memoizedState=Ec,su(null,a)):(me(l),_c(l,c))}var o=t.memoizedState;if(o!==null&&(c=o.dehydrated,c!==null)){if(n)l.flags&256?(me(l),l.flags&=-257,l=Oc(t,l,e)):l.memoizedState!==null?(he(),l.child=t.child,l.flags|=128,l=null):(he(),c=a.fallback,u=l.mode,a=En({mode:"visible",children:a.children},u),c=Ye(c,u,e,null),c.flags|=2,a.return=l,c.return=l,a.sibling=c,l.child=a,Ve(l,t.child,null,e),a=l.child,a.memoizedState=Ac(e),a.childLanes=Mc(t,i,e),l.memoizedState=Ec,l=su(null,a));else if(me(l),rf(c)){if(i=c.nextSibling&&c.nextSibling.dataset,i)var h=i.dgst;i=h,a=Error(f(419)),a.stack="",a.digest=i,Pa({value:a,source:null,stack:null}),l=Oc(t,l,e)}else if(qt||ma(t,l,e,!1),i=(e&t.childLanes)!==0,qt||i){if(i=St,i!==null&&(a=Lf(i,e),a!==0&&a!==o.retryLane))throw o.retryLane=a,qe(t,a),fl(i,t,a),zc;ff(c)||jn(),l=Oc(t,l,e)}else ff(c)?(l.flags|=192,l.child=t.child,l=null):(t=o.treeContext,Tt=_l(c.nextSibling),Lt=l,ut=!0,fe=null,Al=!1,t!==null&&Xr(l,t),l=_c(l,a.children),l.flags|=4096);return l}return u?(he(),c=a.fallback,u=l.mode,o=t.child,h=o.sibling,a=Zl(o,{mode:"hidden",children:a.children}),a.subtreeFlags=o.subtreeFlags&65011712,h!==null?c=Zl(h,c):(c=Ye(c,u,e,null),c.flags|=2),c.return=l,a.return=l,a.sibling=c,l.child=a,su(null,a),a=l.child,c=t.child.memoizedState,c===null?c=Ac(e):(u=c.cachePool,u!==null?(o=Ht._currentValue,u=u.parent!==o?{parent:o,pool:o}:u):u=Kr(),c={baseLanes:c.baseLanes|e,cachePool:u}),a.memoizedState=c,a.childLanes=Mc(t,i,e),l.memoizedState=Ec,su(t.child,a)):(me(l),e=t.child,t=e.sibling,e=Zl(e,{mode:"visible",children:a.children}),e.return=l,e.sibling=null,t!==null&&(i=l.deletions,i===null?(l.deletions=[t],l.flags|=16):i.push(t)),l.child=e,l.memoizedState=null,e)}function _c(t,l){return l=En({mode:"visible",children:l},t.mode),l.return=t,t.child=l}function En(t,l){return t=yl(22,t,null,l),t.lanes=0,t}function Oc(t,l,e){return Ve(l,t.child,null,e),t=_c(l,l.pendingProps.children),t.flags|=2,l.memoizedState=null,t}function is(t,l,e){t.lanes|=l;var a=t.alternate;a!==null&&(a.lanes|=l),wi(t.return,l,e)}function Nc(t,l,e,a,u,n){var i=t.memoizedState;i===null?t.memoizedState={isBackwards:l,rendering:null,renderingStartTime:0,last:a,tail:e,tailMode:u,treeForkCount:n}:(i.isBackwards=l,i.rendering=null,i.renderingStartTime=0,i.last=a,i.tail=e,i.tailMode=u,i.treeForkCount=n)}function cs(t,l,e){var a=l.pendingProps,u=a.revealOrder,n=a.tail;a=a.children;var i=Ct.current,c=(i&2)!==0;if(c?(i=i&1|2,l.flags|=128):i&=1,j(Ct,i),Kt(t,l,a,e),a=ut?Ia:0,!c&&t!==null&&(t.flags&128)!==0)t:for(t=l.child;t!==null;){if(t.tag===13)t.memoizedState!==null&&is(t,e,l);else if(t.tag===19)is(t,e,l);else if(t.child!==null){t.child.return=t,t=t.child;continue}if(t===l)break t;for(;t.sibling===null;){if(t.return===null||t.return===l)break t;t=t.return}t.sibling.return=t.return,t=t.sibling}switch(u){case"forwards":for(e=l.child,u=null;e!==null;)t=e.alternate,t!==null&&dn(t)===null&&(u=e),e=e.sibling;e=u,e===null?(u=l.child,l.child=null):(u=e.sibling,e.sibling=null),Nc(l,!1,u,e,n,a);break;case"backwards":case"unstable_legacy-backwards":for(e=null,u=l.child,l.child=null;u!==null;){if(t=u.alternate,t!==null&&dn(t)===null){l.child=u;break}t=u.sibling,u.sibling=e,e=u,u=t}Nc(l,!0,e,null,n,a);break;case"together":Nc(l,!1,null,null,void 0,a);break;default:l.memoizedState=null}return l.child}function kl(t,l,e){if(t!==null&&(l.dependencies=t.dependencies),be|=l.lanes,(e&l.childLanes)===0)if(t!==null){if(ma(t,l,e,!1),(e&l.childLanes)===0)return null}else return null;if(t!==null&&l.child!==t.child)throw Error(f(153));if(l.child!==null){for(t=l.child,e=Zl(t,t.pendingProps),l.child=e,e.return=l;t.sibling!==null;)t=t.sibling,e=e.sibling=Zl(t,t.pendingProps),e.return=l;e.sibling=null}return l.child}function Dc(t,l){return(t.lanes&l)!==0?!0:(t=t.dependencies,!!(t!==null&&an(t)))}function Cy(t,l,e){switch(l.tag){case 3:Wt(l,l.stateNode.containerInfo),oe(l,Ht,t.memoizedState.cache),Ge();break;case 27:case 5:qa(l);break;case 4:Wt(l,l.stateNode.containerInfo);break;case 10:oe(l,l.type,l.memoizedProps.value);break;case 31:if(l.memoizedState!==null)return l.flags|=128,lc(l),null;break;case 13:var a=l.memoizedState;if(a!==null)return a.dehydrated!==null?(me(l),l.flags|=128,null):(e&l.child.childLanes)!==0?ns(t,l,e):(me(l),t=kl(t,l,e),t!==null?t.sibling:null);me(l);break;case 19:var u=(t.flags&128)!==0;if(a=(e&l.childLanes)!==0,a||(ma(t,l,e,!1),a=(e&l.childLanes)!==0),u){if(a)return cs(t,l,e);l.flags|=128}if(u=l.memoizedState,u!==null&&(u.rendering=null,u.tail=null,u.lastEffect=null),j(Ct,Ct.current),a)break;return null;case 22:return l.lanes=0,Po(t,l,e,l.pendingProps);case 24:oe(l,Ht,t.memoizedState.cache)}return kl(t,l,e)}function fs(t,l,e){if(t!==null)if(t.memoizedProps!==l.pendingProps)qt=!0;else{if(!Dc(t,e)&&(l.flags&128)===0)return qt=!1,Cy(t,l,e);qt=(t.flags&131072)!==0}else qt=!1,ut&&(l.flags&1048576)!==0&&Gr(l,Ia,l.index);switch(l.lanes=0,l.tag){case 16:t:{var a=l.pendingProps;if(t=we(l.elementType),l.type=t,typeof t=="function")Hi(t)?(a=Je(t,a),l.tag=1,l=as(null,l,t,a,e)):(l.tag=0,l=Tc(null,l,t,a,e));else{if(t!=null){var u=t.$$typeof;if(u===_t){l.tag=11,l=$o(null,l,t,a,e);break t}else if(u===J){l.tag=14,l=Fo(null,l,t,a,e);break t}}throw l=tl(t)||t,Error(f(306,l,""))}}return l;case 0:return Tc(t,l,l.type,l.pendingProps,e);case 1:return a=l.type,u=Je(a,l.pendingProps),as(t,l,a,u,e);case 3:t:{if(Wt(l,l.stateNode.containerInfo),t===null)throw Error(f(387));a=l.pendingProps;var n=l.memoizedState;u=n.element,$i(t,l),iu(l,a,null,e);var i=l.memoizedState;if(a=i.cache,oe(l,Ht,a),a!==n.cache&&Li(l,[Ht],e,!0),nu(),a=i.element,n.isDehydrated)if(n={element:a,isDehydrated:!1,cache:i.cache},l.updateQueue.baseState=n,l.memoizedState=n,l.flags&256){l=us(t,l,a,e);break t}else if(a!==u){u=zl(Error(f(424)),l),Pa(u),l=us(t,l,a,e);break t}else for(t=l.stateNode.containerInfo,t.nodeType===9?t=t.body:t=t.nodeName==="HTML"?t.ownerDocument.body:t,Tt=_l(t.firstChild),Lt=l,ut=!0,fe=null,Al=!0,e=Ir(l,null,a,e),l.child=e;e;)e.flags=e.flags&-3|4096,e=e.sibling;else{if(Ge(),a===u){l=kl(t,l,e);break t}Kt(t,l,a,e)}l=l.child}return l;case 26:return Tn(t,l),t===null?(e=pd(l.type,null,l.pendingProps,null))?l.memoizedState=e:ut||(e=l.type,t=l.pendingProps,a=Xn(P.current).createElement(e),a[wt]=l,a[el]=t,Jt(a,e,t),Xt(a),l.stateNode=a):l.memoizedState=pd(l.type,t.memoizedProps,l.pendingProps,t.memoizedState),null;case 27:return qa(l),t===null&&ut&&(a=l.stateNode=gd(l.type,l.pendingProps,P.current),Lt=l,Al=!0,u=Tt,Te(l.type)?(of=u,Tt=_l(a.firstChild)):Tt=u),Kt(t,l,l.pendingProps.children,e),Tn(t,l),t===null&&(l.flags|=4194304),l.child;case 5:return t===null&&ut&&((u=a=Tt)&&(a=fm(a,l.type,l.pendingProps,Al),a!==null?(l.stateNode=a,Lt=l,Tt=_l(a.firstChild),Al=!1,u=!0):u=!1),u||re(l)),qa(l),u=l.type,n=l.pendingProps,i=t!==null?t.memoizedProps:null,a=n.children,uf(u,n)?a=null:i!==null&&uf(u,i)&&(l.flags|=32),l.memoizedState!==null&&(u=ac(t,l,Ty,null,null,e),Mu._currentValue=u),Tn(t,l),Kt(t,l,a,e),l.child;case 6:return t===null&&ut&&((t=e=Tt)&&(e=rm(e,l.pendingProps,Al),e!==null?(l.stateNode=e,Lt=l,Tt=null,t=!0):t=!1),t||re(l)),null;case 13:return ns(t,l,e);case 4:return Wt(l,l.stateNode.containerInfo),a=l.pendingProps,t===null?l.child=Ve(l,null,a,e):Kt(t,l,a,e),l.child;case 11:return $o(t,l,l.type,l.pendingProps,e);case 7:return Kt(t,l,l.pendingProps,e),l.child;case 8:return Kt(t,l,l.pendingProps.children,e),l.child;case 12:return Kt(t,l,l.pendingProps.children,e),l.child;case 10:return a=l.pendingProps,oe(l,l.type,a.value),Kt(t,l,a.children,e),l.child;case 9:return u=l.type._context,a=l.pendingProps.children,Qe(l),u=Vt(u),a=a(u),l.flags|=1,Kt(t,l,a,e),l.child;case 14:return Fo(t,l,l.type,l.pendingProps,e);case 15:return Io(t,l,l.type,l.pendingProps,e);case 19:return cs(t,l,e);case 31:return Uy(t,l,e);case 22:return Po(t,l,e,l.pendingProps);case 24:return Qe(l),a=Vt(Ht),t===null?(u=Ji(),u===null&&(u=St,n=Vi(),u.pooledCache=n,n.refCount++,n!==null&&(u.pooledCacheLanes|=e),u=n),l.memoizedState={parent:a,cache:u},Wi(l),oe(l,Ht,u)):((t.lanes&e)!==0&&($i(t,l),iu(l,null,null,e),nu()),u=t.memoizedState,n=l.memoizedState,u.parent!==a?(u={parent:a,cache:a},l.memoizedState=u,l.lanes===0&&(l.memoizedState=l.updateQueue.baseState=u),oe(l,Ht,a)):(a=n.cache,oe(l,Ht,a),a!==u.cache&&Li(l,[Ht],e,!0))),Kt(t,l,l.pendingProps.children,e),l.child;case 29:throw l.pendingProps}throw Error(f(156,l.tag))}function Wl(t){t.flags|=4}function Uc(t,l,e,a,u){if((l=(t.mode&32)!==0)&&(l=!1),l){if(t.flags|=16777216,(u&335544128)===u)if(t.stateNode.complete)t.flags|=8192;else if(Hs())t.flags|=8192;else throw Le=fn,ki}else t.flags&=-16777217}function rs(t,l){if(l.type!=="stylesheet"||(l.state.loading&4)!==0)t.flags&=-16777217;else if(t.flags|=16777216,!Ed(l))if(Hs())t.flags|=8192;else throw Le=fn,ki}function An(t,l){l!==null&&(t.flags|=4),t.flags&16384&&(l=t.tag!==22?Qf():536870912,t.lanes|=l,Ma|=l)}function du(t,l){if(!ut)switch(t.tailMode){case"hidden":l=t.tail;for(var e=null;l!==null;)l.alternate!==null&&(e=l),l=l.sibling;e===null?t.tail=null:e.sibling=null;break;case"collapsed":e=t.tail;for(var a=null;e!==null;)e.alternate!==null&&(a=e),e=e.sibling;a===null?l||t.tail===null?t.tail=null:t.tail.sibling=null:a.sibling=null}}function Et(t){var l=t.alternate!==null&&t.alternate.child===t.child,e=0,a=0;if(l)for(var u=t.child;u!==null;)e|=u.lanes|u.childLanes,a|=u.subtreeFlags&65011712,a|=u.flags&65011712,u.return=t,u=u.sibling;else for(u=t.child;u!==null;)e|=u.lanes|u.childLanes,a|=u.subtreeFlags,a|=u.flags,u.return=t,u=u.sibling;return t.subtreeFlags|=a,t.childLanes=e,l}function jy(t,l,e){var a=l.pendingProps;switch(Gi(l),l.tag){case 16:case 15:case 0:case 11:case 7:case 8:case 12:case 9:case 14:return Et(l),null;case 1:return Et(l),null;case 3:return e=l.stateNode,a=null,t!==null&&(a=t.memoizedState.cache),l.memoizedState.cache!==a&&(l.flags|=2048),Vl(Ht),Ut(),e.pendingContext&&(e.context=e.pendingContext,e.pendingContext=null),(t===null||t.child===null)&&(ya(l)?Wl(l):t===null||t.memoizedState.isDehydrated&&(l.flags&256)===0||(l.flags|=1024,Qi())),Et(l),null;case 26:var u=l.type,n=l.memoizedState;return t===null?(Wl(l),n!==null?(Et(l),rs(l,n)):(Et(l),Uc(l,u,null,a,e))):n?n!==t.memoizedState?(Wl(l),Et(l),rs(l,n)):(Et(l),l.flags&=-16777217):(t=t.memoizedProps,t!==a&&Wl(l),Et(l),Uc(l,u,t,a,e)),null;case 27:if(Hu(l),e=P.current,u=l.type,t!==null&&l.stateNode!=null)t.memoizedProps!==a&&Wl(l);else{if(!a){if(l.stateNode===null)throw Error(f(166));return Et(l),null}t=q.current,ya(l)?Qr(l):(t=gd(u,a,e),l.stateNode=t,Wl(l))}return Et(l),null;case 5:if(Hu(l),u=l.type,t!==null&&l.stateNode!=null)t.memoizedProps!==a&&Wl(l);else{if(!a){if(l.stateNode===null)throw Error(f(166));return Et(l),null}if(n=q.current,ya(l))Qr(l);else{var i=Xn(P.current);switch(n){case 1:n=i.createElementNS("http://www.w3.org/2000/svg",u);break;case 2:n=i.createElementNS("http://www.w3.org/1998/Math/MathML",u);break;default:switch(u){case"svg":n=i.createElementNS("http://www.w3.org/2000/svg",u);break;case"math":n=i.createElementNS("http://www.w3.org/1998/Math/MathML",u);break;case"script":n=i.createElement("div"),n.innerHTML="<script><\/script>",n=n.removeChild(n.firstChild);break;case"select":n=typeof a.is=="string"?i.createElement("select",{is:a.is}):i.createElement("select"),a.multiple?n.multiple=!0:a.size&&(n.size=a.size);break;default:n=typeof a.is=="string"?i.createElement(u,{is:a.is}):i.createElement(u)}}n[wt]=l,n[el]=a;t:for(i=l.child;i!==null;){if(i.tag===5||i.tag===6)n.appendChild(i.stateNode);else if(i.tag!==4&&i.tag!==27&&i.child!==null){i.child.return=i,i=i.child;continue}if(i===l)break t;for(;i.sibling===null;){if(i.return===null||i.return===l)break t;i=i.return}i.sibling.return=i.return,i=i.sibling}l.stateNode=n;t:switch(Jt(n,u,a),u){case"button":case"input":case"select":case"textarea":a=!!a.autoFocus;break t;case"img":a=!0;break t;default:a=!1}a&&Wl(l)}}return Et(l),Uc(l,l.type,t===null?null:t.memoizedProps,l.pendingProps,e),null;case 6:if(t&&l.stateNode!=null)t.memoizedProps!==a&&Wl(l);else{if(typeof a!="string"&&l.stateNode===null)throw Error(f(166));if(t=P.current,ya(l)){if(t=l.stateNode,e=l.memoizedProps,a=null,u=Lt,u!==null)switch(u.tag){case 27:case 5:a=u.memoizedProps}t[wt]=l,t=!!(t.nodeValue===e||a!==null&&a.suppressHydrationWarning===!0||nd(t.nodeValue,e)),t||re(l,!0)}else t=Xn(t).createTextNode(a),t[wt]=l,l.stateNode=t}return Et(l),null;case 31:if(e=l.memoizedState,t===null||t.memoizedState!==null){if(a=ya(l),e!==null){if(t===null){if(!a)throw Error(f(318));if(t=l.memoizedState,t=t!==null?t.dehydrated:null,!t)throw Error(f(557));t[wt]=l}else Ge(),(l.flags&128)===0&&(l.memoizedState=null),l.flags|=4;Et(l),t=!1}else e=Qi(),t!==null&&t.memoizedState!==null&&(t.memoizedState.hydrationErrors=e),t=!0;if(!t)return l.flags&256?(hl(l),l):(hl(l),null);if((l.flags&128)!==0)throw Error(f(558))}return Et(l),null;case 13:if(a=l.memoizedState,t===null||t.memoizedState!==null&&t.memoizedState.dehydrated!==null){if(u=ya(l),a!==null&&a.dehydrated!==null){if(t===null){if(!u)throw Error(f(318));if(u=l.memoizedState,u=u!==null?u.dehydrated:null,!u)throw Error(f(317));u[wt]=l}else Ge(),(l.flags&128)===0&&(l.memoizedState=null),l.flags|=4;Et(l),u=!1}else u=Qi(),t!==null&&t.memoizedState!==null&&(t.memoizedState.hydrationErrors=u),u=!0;if(!u)return l.flags&256?(hl(l),l):(hl(l),null)}return hl(l),(l.flags&128)!==0?(l.lanes=e,l):(e=a!==null,t=t!==null&&t.memoizedState!==null,e&&(a=l.child,u=null,a.alternate!==null&&a.alternate.memoizedState!==null&&a.alternate.memoizedState.cachePool!==null&&(u=a.alternate.memoizedState.cachePool.pool),n=null,a.memoizedState!==null&&a.memoizedState.cachePool!==null&&(n=a.memoizedState.cachePool.pool),n!==u&&(a.flags|=2048)),e!==t&&e&&(l.child.flags|=8192),An(l,l.updateQueue),Et(l),null);case 4:return Ut(),t===null&&Pc(l.stateNode.containerInfo),Et(l),null;case 10:return Vl(l.type),Et(l),null;case 19:if(M(Ct),a=l.memoizedState,a===null)return Et(l),null;if(u=(l.flags&128)!==0,n=a.rendering,n===null)if(u)du(a,!1);else{if(Dt!==0||t!==null&&(t.flags&128)!==0)for(t=l.child;t!==null;){if(n=dn(t),n!==null){for(l.flags|=128,du(a,!1),t=n.updateQueue,l.updateQueue=t,An(l,t),l.subtreeFlags=0,t=e,e=l.child;e!==null;)Br(e,t),e=e.sibling;return j(Ct,Ct.current&1|2),ut&&wl(l,a.treeForkCount),l.child}t=t.sibling}a.tail!==null&&rl()>Dn&&(l.flags|=128,u=!0,du(a,!1),l.lanes=4194304)}else{if(!u)if(t=dn(n),t!==null){if(l.flags|=128,u=!0,t=t.updateQueue,l.updateQueue=t,An(l,t),du(a,!0),a.tail===null&&a.tailMode==="hidden"&&!n.alternate&&!ut)return Et(l),null}else 2*rl()-a.renderingStartTime>Dn&&e!==536870912&&(l.flags|=128,u=!0,du(a,!1),l.lanes=4194304);a.isBackwards?(n.sibling=l.child,l.child=n):(t=a.last,t!==null?t.sibling=n:l.child=n,a.last=n)}return a.tail!==null?(t=a.tail,a.rendering=t,a.tail=t.sibling,a.renderingStartTime=rl(),t.sibling=null,e=Ct.current,j(Ct,u?e&1|2:e&1),ut&&wl(l,a.treeForkCount),t):(Et(l),null);case 22:case 23:return hl(l),tc(),a=l.memoizedState!==null,t!==null?t.memoizedState!==null!==a&&(l.flags|=8192):a&&(l.flags|=8192),a?(e&536870912)!==0&&(l.flags&128)===0&&(Et(l),l.subtreeFlags&6&&(l.flags|=8192)):Et(l),e=l.updateQueue,e!==null&&An(l,e.retryQueue),e=null,t!==null&&t.memoizedState!==null&&t.memoizedState.cachePool!==null&&(e=t.memoizedState.cachePool.pool),a=null,l.memoizedState!==null&&l.memoizedState.cachePool!==null&&(a=l.memoizedState.cachePool.pool),a!==e&&(l.flags|=2048),t!==null&&M(Ze),null;case 24:return e=null,t!==null&&(e=t.memoizedState.cache),l.memoizedState.cache!==e&&(l.flags|=2048),Vl(Ht),Et(l),null;case 25:return null;case 30:return null}throw Error(f(156,l.tag))}function Ry(t,l){switch(Gi(l),l.tag){case 1:return t=l.flags,t&65536?(l.flags=t&-65537|128,l):null;case 3:return Vl(Ht),Ut(),t=l.flags,(t&65536)!==0&&(t&128)===0?(l.flags=t&-65537|128,l):null;case 26:case 27:case 5:return Hu(l),null;case 31:if(l.memoizedState!==null){if(hl(l),l.alternate===null)throw Error(f(340));Ge()}return t=l.flags,t&65536?(l.flags=t&-65537|128,l):null;case 13:if(hl(l),t=l.memoizedState,t!==null&&t.dehydrated!==null){if(l.alternate===null)throw Error(f(340));Ge()}return t=l.flags,t&65536?(l.flags=t&-65537|128,l):null;case 19:return M(Ct),null;case 4:return Ut(),null;case 10:return Vl(l.type),null;case 22:case 23:return hl(l),tc(),t!==null&&M(Ze),t=l.flags,t&65536?(l.flags=t&-65537|128,l):null;case 24:return Vl(Ht),null;case 25:return null;default:return null}}function os(t,l){switch(Gi(l),l.tag){case 3:Vl(Ht),Ut();break;case 26:case 27:case 5:Hu(l);break;case 4:Ut();break;case 31:l.memoizedState!==null&&hl(l);break;case 13:hl(l);break;case 19:M(Ct);break;case 10:Vl(l.type);break;case 22:case 23:hl(l),tc(),t!==null&&M(Ze);break;case 24:Vl(Ht)}}function yu(t,l){try{var e=l.updateQueue,a=e!==null?e.lastEffect:null;if(a!==null){var u=a.next;e=u;do{if((e.tag&t)===t){a=void 0;var n=e.create,i=e.inst;a=n(),i.destroy=a}e=e.next}while(e!==u)}}catch(c){ht(l,l.return,c)}}function ge(t,l,e){try{var a=l.updateQueue,u=a!==null?a.lastEffect:null;if(u!==null){var n=u.next;a=n;do{if((a.tag&t)===t){var i=a.inst,c=i.destroy;if(c!==void 0){i.destroy=void 0,u=l;var o=e,h=c;try{h()}catch(z){ht(u,o,z)}}}a=a.next}while(a!==n)}}catch(z){ht(l,l.return,z)}}function ss(t){var l=t.updateQueue;if(l!==null){var e=t.stateNode;try{to(l,e)}catch(a){ht(t,t.return,a)}}}function ds(t,l,e){e.props=Je(t.type,t.memoizedProps),e.state=t.memoizedState;try{e.componentWillUnmount()}catch(a){ht(t,l,a)}}function mu(t,l){try{var e=t.ref;if(e!==null){switch(t.tag){case 26:case 27:case 5:var a=t.stateNode;break;case 30:a=t.stateNode;break;default:a=t.stateNode}typeof e=="function"?t.refCleanup=e(a):e.current=a}}catch(u){ht(t,l,u)}}function ql(t,l){var e=t.ref,a=t.refCleanup;if(e!==null)if(typeof a=="function")try{a()}catch(u){ht(t,l,u)}finally{t.refCleanup=null,t=t.alternate,t!=null&&(t.refCleanup=null)}else if(typeof e=="function")try{e(null)}catch(u){ht(t,l,u)}else e.current=null}function ys(t){var l=t.type,e=t.memoizedProps,a=t.stateNode;try{t:switch(l){case"button":case"input":case"select":case"textarea":e.autoFocus&&a.focus();break t;case"img":e.src?a.src=e.src:e.srcSet&&(a.srcset=e.srcSet)}}catch(u){ht(t,t.return,u)}}function Cc(t,l,e){try{var a=t.stateNode;em(a,t.type,e,l),a[el]=l}catch(u){ht(t,t.return,u)}}function ms(t){return t.tag===5||t.tag===3||t.tag===26||t.tag===27&&Te(t.type)||t.tag===4}function jc(t){t:for(;;){for(;t.sibling===null;){if(t.return===null||ms(t.return))return null;t=t.return}for(t.sibling.return=t.return,t=t.sibling;t.tag!==5&&t.tag!==6&&t.tag!==18;){if(t.tag===27&&Te(t.type)||t.flags&2||t.child===null||t.tag===4)continue t;t.child.return=t,t=t.child}if(!(t.flags&2))return t.stateNode}}function Rc(t,l,e){var a=t.tag;if(a===5||a===6)t=t.stateNode,l?(e.nodeType===9?e.body:e.nodeName==="HTML"?e.ownerDocument.body:e).insertBefore(t,l):(l=e.nodeType===9?e.body:e.nodeName==="HTML"?e.ownerDocument.body:e,l.appendChild(t),e=e._reactRootContainer,e!=null||l.onclick!==null||(l.onclick=Xl));else if(a!==4&&(a===27&&Te(t.type)&&(e=t.stateNode,l=null),t=t.child,t!==null))for(Rc(t,l,e),t=t.sibling;t!==null;)Rc(t,l,e),t=t.sibling}function Mn(t,l,e){var a=t.tag;if(a===5||a===6)t=t.stateNode,l?e.insertBefore(t,l):e.appendChild(t);else if(a!==4&&(a===27&&Te(t.type)&&(e=t.stateNode),t=t.child,t!==null))for(Mn(t,l,e),t=t.sibling;t!==null;)Mn(t,l,e),t=t.sibling}function hs(t){var l=t.stateNode,e=t.memoizedProps;try{for(var a=t.type,u=l.attributes;u.length;)l.removeAttributeNode(u[0]);Jt(l,a,e),l[wt]=t,l[el]=e}catch(n){ht(t,t.return,n)}}var $l=!1,Yt=!1,Hc=!1,gs=typeof WeakSet=="function"?WeakSet:Set,Qt=null;function Hy(t,l){if(t=t.containerInfo,ef=Jn,t=_r(t),Oi(t)){if("selectionStart"in t)var e={start:t.selectionStart,end:t.selectionEnd};else t:{e=(e=t.ownerDocument)&&e.defaultView||window;var a=e.getSelection&&e.getSelection();if(a&&a.rangeCount!==0){e=a.anchorNode;var u=a.anchorOffset,n=a.focusNode;a=a.focusOffset;try{e.nodeType,n.nodeType}catch{e=null;break t}var i=0,c=-1,o=-1,h=0,z=0,E=t,g=null;l:for(;;){for(var b;E!==e||u!==0&&E.nodeType!==3||(c=i+u),E!==n||a!==0&&E.nodeType!==3||(o=i+a),E.nodeType===3&&(i+=E.nodeValue.length),(b=E.firstChild)!==null;)g=E,E=b;for(;;){if(E===t)break l;if(g===e&&++h===u&&(c=i),g===n&&++z===a&&(o=i),(b=E.nextSibling)!==null)break;E=g,g=E.parentNode}E=b}e=c===-1||o===-1?null:{start:c,end:o}}else e=null}e=e||{start:0,end:0}}else e=null;for(af={focusedElem:t,selectionRange:e},Jn=!1,Qt=l;Qt!==null;)if(l=Qt,t=l.child,(l.subtreeFlags&1028)!==0&&t!==null)t.return=l,Qt=t;else for(;Qt!==null;){switch(l=Qt,n=l.alternate,t=l.flags,l.tag){case 0:if((t&4)!==0&&(t=l.updateQueue,t=t!==null?t.events:null,t!==null))for(e=0;e<t.length;e++)u=t[e],u.ref.impl=u.nextImpl;break;case 11:case 15:break;case 1:if((t&1024)!==0&&n!==null){t=void 0,e=l,u=n.memoizedProps,n=n.memoizedState,a=e.stateNode;try{var B=Je(e.type,u);t=a.getSnapshotBeforeUpdate(B,n),a.__reactInternalSnapshotBeforeUpdate=t}catch(w){ht(e,e.return,w)}}break;case 3:if((t&1024)!==0){if(t=l.stateNode.containerInfo,e=t.nodeType,e===9)cf(t);else if(e===1)switch(t.nodeName){case"HEAD":case"HTML":case"BODY":cf(t);break;default:t.textContent=""}}break;case 5:case 26:case 27:case 6:case 4:case 17:break;default:if((t&1024)!==0)throw Error(f(163))}if(t=l.sibling,t!==null){t.return=l.return,Qt=t;break}Qt=l.return}}function vs(t,l,e){var a=e.flags;switch(e.tag){case 0:case 11:case 15:Il(t,e),a&4&&yu(5,e);break;case 1:if(Il(t,e),a&4)if(t=e.stateNode,l===null)try{t.componentDidMount()}catch(i){ht(e,e.return,i)}else{var u=Je(e.type,l.memoizedProps);l=l.memoizedState;try{t.componentDidUpdate(u,l,t.__reactInternalSnapshotBeforeUpdate)}catch(i){ht(e,e.return,i)}}a&64&&ss(e),a&512&&mu(e,e.return);break;case 3:if(Il(t,e),a&64&&(t=e.updateQueue,t!==null)){if(l=null,e.child!==null)switch(e.child.tag){case 27:case 5:l=e.child.stateNode;break;case 1:l=e.child.stateNode}try{to(t,l)}catch(i){ht(e,e.return,i)}}break;case 27:l===null&&a&4&&hs(e);case 26:case 5:Il(t,e),l===null&&a&4&&ys(e),a&512&&mu(e,e.return);break;case 12:Il(t,e);break;case 31:Il(t,e),a&4&&Ss(t,e);break;case 13:Il(t,e),a&4&&xs(t,e),a&64&&(t=e.memoizedState,t!==null&&(t=t.dehydrated,t!==null&&(e=Ly.bind(null,e),om(t,e))));break;case 22:if(a=e.memoizedState!==null||$l,!a){l=l!==null&&l.memoizedState!==null||Yt,u=$l;var n=Yt;$l=a,(Yt=l)&&!n?Pl(t,e,(e.subtreeFlags&8772)!==0):Il(t,e),$l=u,Yt=n}break;case 30:break;default:Il(t,e)}}function bs(t){var l=t.alternate;l!==null&&(t.alternate=null,bs(l)),t.child=null,t.deletions=null,t.sibling=null,t.tag===5&&(l=t.stateNode,l!==null&&si(l)),t.stateNode=null,t.return=null,t.dependencies=null,t.memoizedProps=null,t.memoizedState=null,t.pendingProps=null,t.stateNode=null,t.updateQueue=null}var Mt=null,ul=!1;function Fl(t,l,e){for(e=e.child;e!==null;)ps(t,l,e),e=e.sibling}function ps(t,l,e){if(ol&&typeof ol.onCommitFiberUnmount=="function")try{ol.onCommitFiberUnmount(Ya,e)}catch{}switch(e.tag){case 26:Yt||ql(e,l),Fl(t,l,e),e.memoizedState?e.memoizedState.count--:e.stateNode&&(e=e.stateNode,e.parentNode.removeChild(e));break;case 27:Yt||ql(e,l);var a=Mt,u=ul;Te(e.type)&&(Mt=e.stateNode,ul=!1),Fl(t,l,e),Tu(e.stateNode),Mt=a,ul=u;break;case 5:Yt||ql(e,l);case 6:if(a=Mt,u=ul,Mt=null,Fl(t,l,e),Mt=a,ul=u,Mt!==null)if(ul)try{(Mt.nodeType===9?Mt.body:Mt.nodeName==="HTML"?Mt.ownerDocument.body:Mt).removeChild(e.stateNode)}catch(n){ht(e,l,n)}else try{Mt.removeChild(e.stateNode)}catch(n){ht(e,l,n)}break;case 18:Mt!==null&&(ul?(t=Mt,sd(t.nodeType===9?t.body:t.nodeName==="HTML"?t.ownerDocument.body:t,e.stateNode),Ra(t)):sd(Mt,e.stateNode));break;case 4:a=Mt,u=ul,Mt=e.stateNode.containerInfo,ul=!0,Fl(t,l,e),Mt=a,ul=u;break;case 0:case 11:case 14:case 15:ge(2,e,l),Yt||ge(4,e,l),Fl(t,l,e);break;case 1:Yt||(ql(e,l),a=e.stateNode,typeof a.componentWillUnmount=="function"&&ds(e,l,a)),Fl(t,l,e);break;case 21:Fl(t,l,e);break;case 22:Yt=(a=Yt)||e.memoizedState!==null,Fl(t,l,e),Yt=a;break;default:Fl(t,l,e)}}function Ss(t,l){if(l.memoizedState===null&&(t=l.alternate,t!==null&&(t=t.memoizedState,t!==null))){t=t.dehydrated;try{Ra(t)}catch(e){ht(l,l.return,e)}}}function xs(t,l){if(l.memoizedState===null&&(t=l.alternate,t!==null&&(t=t.memoizedState,t!==null&&(t=t.dehydrated,t!==null))))try{Ra(t)}catch(e){ht(l,l.return,e)}}function By(t){switch(t.tag){case 31:case 13:case 19:var l=t.stateNode;return l===null&&(l=t.stateNode=new gs),l;case 22:return t=t.stateNode,l=t._retryCache,l===null&&(l=t._retryCache=new gs),l;default:throw Error(f(435,t.tag))}}function _n(t,l){var e=By(t);l.forEach(function(a){if(!e.has(a)){e.add(a);var u=Vy.bind(null,t,a);a.then(u,u)}})}function nl(t,l){var e=l.deletions;if(e!==null)for(var a=0;a<e.length;a++){var u=e[a],n=t,i=l,c=i;t:for(;c!==null;){switch(c.tag){case 27:if(Te(c.type)){Mt=c.stateNode,ul=!1;break t}break;case 5:Mt=c.stateNode,ul=!1;break t;case 3:case 4:Mt=c.stateNode.containerInfo,ul=!0;break t}c=c.return}if(Mt===null)throw Error(f(160));ps(n,i,u),Mt=null,ul=!1,n=u.alternate,n!==null&&(n.return=null),u.return=null}if(l.subtreeFlags&13886)for(l=l.child;l!==null;)zs(l,t),l=l.sibling}var Ul=null;function zs(t,l){var e=t.alternate,a=t.flags;switch(t.tag){case 0:case 11:case 14:case 15:nl(l,t),il(t),a&4&&(ge(3,t,t.return),yu(3,t),ge(5,t,t.return));break;case 1:nl(l,t),il(t),a&512&&(Yt||e===null||ql(e,e.return)),a&64&&$l&&(t=t.updateQueue,t!==null&&(a=t.callbacks,a!==null&&(e=t.shared.hiddenCallbacks,t.shared.hiddenCallbacks=e===null?a:e.concat(a))));break;case 26:var u=Ul;if(nl(l,t),il(t),a&512&&(Yt||e===null||ql(e,e.return)),a&4){var n=e!==null?e.memoizedState:null;if(a=t.memoizedState,e===null)if(a===null)if(t.stateNode===null){t:{a=t.type,e=t.memoizedProps,u=u.ownerDocument||u;l:switch(a){case"title":n=u.getElementsByTagName("title")[0],(!n||n[Qa]||n[wt]||n.namespaceURI==="http://www.w3.org/2000/svg"||n.hasAttribute("itemprop"))&&(n=u.createElement(a),u.head.insertBefore(n,u.querySelector("head > title"))),Jt(n,a,e),n[wt]=t,Xt(n),a=n;break t;case"link":var i=zd("link","href",u).get(a+(e.href||""));if(i){for(var c=0;c<i.length;c++)if(n=i[c],n.getAttribute("href")===(e.href==null||e.href===""?null:e.href)&&n.getAttribute("rel")===(e.rel==null?null:e.rel)&&n.getAttribute("title")===(e.title==null?null:e.title)&&n.getAttribute("crossorigin")===(e.crossOrigin==null?null:e.crossOrigin)){i.splice(c,1);break l}}n=u.createElement(a),Jt(n,a,e),u.head.appendChild(n);break;case"meta":if(i=zd("meta","content",u).get(a+(e.content||""))){for(c=0;c<i.length;c++)if(n=i[c],n.getAttribute("content")===(e.content==null?null:""+e.content)&&n.getAttribute("name")===(e.name==null?null:e.name)&&n.getAttribute("property")===(e.property==null?null:e.property)&&n.getAttribute("http-equiv")===(e.httpEquiv==null?null:e.httpEquiv)&&n.getAttribute("charset")===(e.charSet==null?null:e.charSet)){i.splice(c,1);break l}}n=u.createElement(a),Jt(n,a,e),u.head.appendChild(n);break;default:throw Error(f(468,a))}n[wt]=t,Xt(n),a=n}t.stateNode=a}else Td(u,t.type,t.stateNode);else t.stateNode=xd(u,a,t.memoizedProps);else n!==a?(n===null?e.stateNode!==null&&(e=e.stateNode,e.parentNode.removeChild(e)):n.count--,a===null?Td(u,t.type,t.stateNode):xd(u,a,t.memoizedProps)):a===null&&t.stateNode!==null&&Cc(t,t.memoizedProps,e.memoizedProps)}break;case 27:nl(l,t),il(t),a&512&&(Yt||e===null||ql(e,e.return)),e!==null&&a&4&&Cc(t,t.memoizedProps,e.memoizedProps);break;case 5:if(nl(l,t),il(t),a&512&&(Yt||e===null||ql(e,e.return)),t.flags&32){u=t.stateNode;try{aa(u,"")}catch(B){ht(t,t.return,B)}}a&4&&t.stateNode!=null&&(u=t.memoizedProps,Cc(t,u,e!==null?e.memoizedProps:u)),a&1024&&(Hc=!0);break;case 6:if(nl(l,t),il(t),a&4){if(t.stateNode===null)throw Error(f(162));a=t.memoizedProps,e=t.stateNode;try{e.nodeValue=a}catch(B){ht(t,t.return,B)}}break;case 3:if(wn=null,u=Ul,Ul=Qn(l.containerInfo),nl(l,t),Ul=u,il(t),a&4&&e!==null&&e.memoizedState.isDehydrated)try{Ra(l.containerInfo)}catch(B){ht(t,t.return,B)}Hc&&(Hc=!1,Ts(t));break;case 4:a=Ul,Ul=Qn(t.stateNode.containerInfo),nl(l,t),il(t),Ul=a;break;case 12:nl(l,t),il(t);break;case 31:nl(l,t),il(t),a&4&&(a=t.updateQueue,a!==null&&(t.updateQueue=null,_n(t,a)));break;case 13:nl(l,t),il(t),t.child.flags&8192&&t.memoizedState!==null!=(e!==null&&e.memoizedState!==null)&&(Nn=rl()),a&4&&(a=t.updateQueue,a!==null&&(t.updateQueue=null,_n(t,a)));break;case 22:u=t.memoizedState!==null;var o=e!==null&&e.memoizedState!==null,h=$l,z=Yt;if($l=h||u,Yt=z||o,nl(l,t),Yt=z,$l=h,il(t),a&8192)t:for(l=t.stateNode,l._visibility=u?l._visibility&-2:l._visibility|1,u&&(e===null||o||$l||Yt||ke(t)),e=null,l=t;;){if(l.tag===5||l.tag===26){if(e===null){o=e=l;try{if(n=o.stateNode,u)i=n.style,typeof i.setProperty=="function"?i.setProperty("display","none","important"):i.display="none";else{c=o.stateNode;var E=o.memoizedProps.style,g=E!=null&&E.hasOwnProperty("display")?E.display:null;c.style.display=g==null||typeof g=="boolean"?"":(""+g).trim()}}catch(B){ht(o,o.return,B)}}}else if(l.tag===6){if(e===null){o=l;try{o.stateNode.nodeValue=u?"":o.memoizedProps}catch(B){ht(o,o.return,B)}}}else if(l.tag===18){if(e===null){o=l;try{var b=o.stateNode;u?dd(b,!0):dd(o.stateNode,!1)}catch(B){ht(o,o.return,B)}}}else if((l.tag!==22&&l.tag!==23||l.memoizedState===null||l===t)&&l.child!==null){l.child.return=l,l=l.child;continue}if(l===t)break t;for(;l.sibling===null;){if(l.return===null||l.return===t)break t;e===l&&(e=null),l=l.return}e===l&&(e=null),l.sibling.return=l.return,l=l.sibling}a&4&&(a=t.updateQueue,a!==null&&(e=a.retryQueue,e!==null&&(a.retryQueue=null,_n(t,e))));break;case 19:nl(l,t),il(t),a&4&&(a=t.updateQueue,a!==null&&(t.updateQueue=null,_n(t,a)));break;case 30:break;case 21:break;default:nl(l,t),il(t)}}function il(t){var l=t.flags;if(l&2){try{for(var e,a=t.return;a!==null;){if(ms(a)){e=a;break}a=a.return}if(e==null)throw Error(f(160));switch(e.tag){case 27:var u=e.stateNode,n=jc(t);Mn(t,n,u);break;case 5:var i=e.stateNode;e.flags&32&&(aa(i,""),e.flags&=-33);var c=jc(t);Mn(t,c,i);break;case 3:case 4:var o=e.stateNode.containerInfo,h=jc(t);Rc(t,h,o);break;default:throw Error(f(161))}}catch(z){ht(t,t.return,z)}t.flags&=-3}l&4096&&(t.flags&=-4097)}function Ts(t){if(t.subtreeFlags&1024)for(t=t.child;t!==null;){var l=t;Ts(l),l.tag===5&&l.flags&1024&&l.stateNode.reset(),t=t.sibling}}function Il(t,l){if(l.subtreeFlags&8772)for(l=l.child;l!==null;)vs(t,l.alternate,l),l=l.sibling}function ke(t){for(t=t.child;t!==null;){var l=t;switch(l.tag){case 0:case 11:case 14:case 15:ge(4,l,l.return),ke(l);break;case 1:ql(l,l.return);var e=l.stateNode;typeof e.componentWillUnmount=="function"&&ds(l,l.return,e),ke(l);break;case 27:Tu(l.stateNode);case 26:case 5:ql(l,l.return),ke(l);break;case 22:l.memoizedState===null&&ke(l);break;case 30:ke(l);break;default:ke(l)}t=t.sibling}}function Pl(t,l,e){for(e=e&&(l.subtreeFlags&8772)!==0,l=l.child;l!==null;){var a=l.alternate,u=t,n=l,i=n.flags;switch(n.tag){case 0:case 11:case 15:Pl(u,n,e),yu(4,n);break;case 1:if(Pl(u,n,e),a=n,u=a.stateNode,typeof u.componentDidMount=="function")try{u.componentDidMount()}catch(h){ht(a,a.return,h)}if(a=n,u=a.updateQueue,u!==null){var c=a.stateNode;try{var o=u.shared.hiddenCallbacks;if(o!==null)for(u.shared.hiddenCallbacks=null,u=0;u<o.length;u++)Pr(o[u],c)}catch(h){ht(a,a.return,h)}}e&&i&64&&ss(n),mu(n,n.return);break;case 27:hs(n);case 26:case 5:Pl(u,n,e),e&&a===null&&i&4&&ys(n),mu(n,n.return);break;case 12:Pl(u,n,e);break;case 31:Pl(u,n,e),e&&i&4&&Ss(u,n);break;case 13:Pl(u,n,e),e&&i&4&&xs(u,n);break;case 22:n.memoizedState===null&&Pl(u,n,e),mu(n,n.return);break;case 30:break;default:Pl(u,n,e)}l=l.sibling}}function Bc(t,l){var e=null;t!==null&&t.memoizedState!==null&&t.memoizedState.cachePool!==null&&(e=t.memoizedState.cachePool.pool),t=null,l.memoizedState!==null&&l.memoizedState.cachePool!==null&&(t=l.memoizedState.cachePool.pool),t!==e&&(t!=null&&t.refCount++,e!=null&&tu(e))}function qc(t,l){t=null,l.alternate!==null&&(t=l.alternate.memoizedState.cache),l=l.memoizedState.cache,l!==t&&(l.refCount++,t!=null&&tu(t))}function Cl(t,l,e,a){if(l.subtreeFlags&10256)for(l=l.child;l!==null;)Es(t,l,e,a),l=l.sibling}function Es(t,l,e,a){var u=l.flags;switch(l.tag){case 0:case 11:case 15:Cl(t,l,e,a),u&2048&&yu(9,l);break;case 1:Cl(t,l,e,a);break;case 3:Cl(t,l,e,a),u&2048&&(t=null,l.alternate!==null&&(t=l.alternate.memoizedState.cache),l=l.memoizedState.cache,l!==t&&(l.refCount++,t!=null&&tu(t)));break;case 12:if(u&2048){Cl(t,l,e,a),t=l.stateNode;try{var n=l.memoizedProps,i=n.id,c=n.onPostCommit;typeof c=="function"&&c(i,l.alternate===null?"mount":"update",t.passiveEffectDuration,-0)}catch(o){ht(l,l.return,o)}}else Cl(t,l,e,a);break;case 31:Cl(t,l,e,a);break;case 13:Cl(t,l,e,a);break;case 23:break;case 22:n=l.stateNode,i=l.alternate,l.memoizedState!==null?n._visibility&2?Cl(t,l,e,a):hu(t,l):n._visibility&2?Cl(t,l,e,a):(n._visibility|=2,Ta(t,l,e,a,(l.subtreeFlags&10256)!==0||!1)),u&2048&&Bc(i,l);break;case 24:Cl(t,l,e,a),u&2048&&qc(l.alternate,l);break;default:Cl(t,l,e,a)}}function Ta(t,l,e,a,u){for(u=u&&((l.subtreeFlags&10256)!==0||!1),l=l.child;l!==null;){var n=t,i=l,c=e,o=a,h=i.flags;switch(i.tag){case 0:case 11:case 15:Ta(n,i,c,o,u),yu(8,i);break;case 23:break;case 22:var z=i.stateNode;i.memoizedState!==null?z._visibility&2?Ta(n,i,c,o,u):hu(n,i):(z._visibility|=2,Ta(n,i,c,o,u)),u&&h&2048&&Bc(i.alternate,i);break;case 24:Ta(n,i,c,o,u),u&&h&2048&&qc(i.alternate,i);break;default:Ta(n,i,c,o,u)}l=l.sibling}}function hu(t,l){if(l.subtreeFlags&10256)for(l=l.child;l!==null;){var e=t,a=l,u=a.flags;switch(a.tag){case 22:hu(e,a),u&2048&&Bc(a.alternate,a);break;case 24:hu(e,a),u&2048&&qc(a.alternate,a);break;default:hu(e,a)}l=l.sibling}}var gu=8192;function Ea(t,l,e){if(t.subtreeFlags&gu)for(t=t.child;t!==null;)As(t,l,e),t=t.sibling}function As(t,l,e){switch(t.tag){case 26:Ea(t,l,e),t.flags&gu&&t.memoizedState!==null&&zm(e,Ul,t.memoizedState,t.memoizedProps);break;case 5:Ea(t,l,e);break;case 3:case 4:var a=Ul;Ul=Qn(t.stateNode.containerInfo),Ea(t,l,e),Ul=a;break;case 22:t.memoizedState===null&&(a=t.alternate,a!==null&&a.memoizedState!==null?(a=gu,gu=16777216,Ea(t,l,e),gu=a):Ea(t,l,e));break;default:Ea(t,l,e)}}function Ms(t){var l=t.alternate;if(l!==null&&(t=l.child,t!==null)){l.child=null;do l=t.sibling,t.sibling=null,t=l;while(t!==null)}}function vu(t){var l=t.deletions;if((t.flags&16)!==0){if(l!==null)for(var e=0;e<l.length;e++){var a=l[e];Qt=a,Os(a,t)}Ms(t)}if(t.subtreeFlags&10256)for(t=t.child;t!==null;)_s(t),t=t.sibling}function _s(t){switch(t.tag){case 0:case 11:case 15:vu(t),t.flags&2048&&ge(9,t,t.return);break;case 3:vu(t);break;case 12:vu(t);break;case 22:var l=t.stateNode;t.memoizedState!==null&&l._visibility&2&&(t.return===null||t.return.tag!==13)?(l._visibility&=-3,On(t)):vu(t);break;default:vu(t)}}function On(t){var l=t.deletions;if((t.flags&16)!==0){if(l!==null)for(var e=0;e<l.length;e++){var a=l[e];Qt=a,Os(a,t)}Ms(t)}for(t=t.child;t!==null;){switch(l=t,l.tag){case 0:case 11:case 15:ge(8,l,l.return),On(l);break;case 22:e=l.stateNode,e._visibility&2&&(e._visibility&=-3,On(l));break;default:On(l)}t=t.sibling}}function Os(t,l){for(;Qt!==null;){var e=Qt;switch(e.tag){case 0:case 11:case 15:ge(8,e,l);break;case 23:case 22:if(e.memoizedState!==null&&e.memoizedState.cachePool!==null){var a=e.memoizedState.cachePool.pool;a!=null&&a.refCount++}break;case 24:tu(e.memoizedState.cache)}if(a=e.child,a!==null)a.return=e,Qt=a;else t:for(e=t;Qt!==null;){a=Qt;var u=a.sibling,n=a.return;if(bs(a),a===e){Qt=null;break t}if(u!==null){u.return=n,Qt=u;break t}Qt=n}}}var qy={getCacheForType:function(t){var l=Vt(Ht),e=l.data.get(t);return e===void 0&&(e=t(),l.data.set(t,e)),e},cacheSignal:function(){return Vt(Ht).controller.signal}},Yy=typeof WeakMap=="function"?WeakMap:Map,ot=0,St=null,tt=null,et=0,mt=0,gl=null,ve=!1,Aa=!1,Yc=!1,te=0,Dt=0,be=0,We=0,Gc=0,vl=0,Ma=0,bu=null,cl=null,Xc=!1,Nn=0,Ns=0,Dn=1/0,Un=null,pe=null,Gt=0,Se=null,_a=null,le=0,Qc=0,Zc=null,Ds=null,pu=0,wc=null;function bl(){return(ot&2)!==0&&et!==0?et&-et:x.T!==null?Wc():Vf()}function Us(){if(vl===0)if((et&536870912)===0||ut){var t=Yu;Yu<<=1,(Yu&3932160)===0&&(Yu=262144),vl=t}else vl=536870912;return t=ml.current,t!==null&&(t.flags|=32),vl}function fl(t,l,e){(t===St&&(mt===2||mt===9)||t.cancelPendingCommit!==null)&&(Oa(t,0),xe(t,et,vl,!1)),Xa(t,e),((ot&2)===0||t!==St)&&(t===St&&((ot&2)===0&&(We|=e),Dt===4&&xe(t,et,vl,!1)),Yl(t))}function Cs(t,l,e){if((ot&6)!==0)throw Error(f(327));var a=!e&&(l&127)===0&&(l&t.expiredLanes)===0||Ga(t,l),u=a?Qy(t,l):Vc(t,l,!0),n=a;do{if(u===0){Aa&&!a&&xe(t,l,0,!1);break}else{if(e=t.current.alternate,n&&!Gy(e)){u=Vc(t,l,!1),n=!1;continue}if(u===2){if(n=l,t.errorRecoveryDisabledLanes&n)var i=0;else i=t.pendingLanes&-536870913,i=i!==0?i:i&536870912?536870912:0;if(i!==0){l=i;t:{var c=t;u=bu;var o=c.current.memoizedState.isDehydrated;if(o&&(Oa(c,i).flags|=256),i=Vc(c,i,!1),i!==2){if(Yc&&!o){c.errorRecoveryDisabledLanes|=n,We|=n,u=4;break t}n=cl,cl=u,n!==null&&(cl===null?cl=n:cl.push.apply(cl,n))}u=i}if(n=!1,u!==2)continue}}if(u===1){Oa(t,0),xe(t,l,0,!0);break}t:{switch(a=t,n=u,n){case 0:case 1:throw Error(f(345));case 4:if((l&4194048)!==l)break;case 6:xe(a,l,vl,!ve);break t;case 2:cl=null;break;case 3:case 5:break;default:throw Error(f(329))}if((l&62914560)===l&&(u=Nn+300-rl(),10<u)){if(xe(a,l,vl,!ve),Xu(a,0,!0)!==0)break t;le=l,a.timeoutHandle=rd(js.bind(null,a,e,cl,Un,Xc,l,vl,We,Ma,ve,n,"Throttled",-0,0),u);break t}js(a,e,cl,Un,Xc,l,vl,We,Ma,ve,n,null,-0,0)}}break}while(!0);Yl(t)}function js(t,l,e,a,u,n,i,c,o,h,z,E,g,b){if(t.timeoutHandle=-1,E=l.subtreeFlags,E&8192||(E&16785408)===16785408){E={stylesheets:null,count:0,imgCount:0,imgBytes:0,suspenseyImages:[],waitingForImages:!0,waitingForViewTransition:!1,unsuspend:Xl},As(l,n,E);var B=(n&62914560)===n?Nn-rl():(n&4194048)===n?Ns-rl():0;if(B=Tm(E,B),B!==null){le=n,t.cancelPendingCommit=B(Qs.bind(null,t,l,n,e,a,u,i,c,o,z,E,null,g,b)),xe(t,n,i,!h);return}}Qs(t,l,n,e,a,u,i,c,o)}function Gy(t){for(var l=t;;){var e=l.tag;if((e===0||e===11||e===15)&&l.flags&16384&&(e=l.updateQueue,e!==null&&(e=e.stores,e!==null)))for(var a=0;a<e.length;a++){var u=e[a],n=u.getSnapshot;u=u.value;try{if(!dl(n(),u))return!1}catch{return!1}}if(e=l.child,l.subtreeFlags&16384&&e!==null)e.return=l,l=e;else{if(l===t)break;for(;l.sibling===null;){if(l.return===null||l.return===t)return!0;l=l.return}l.sibling.return=l.return,l=l.sibling}}return!0}function xe(t,l,e,a){l&=~Gc,l&=~We,t.suspendedLanes|=l,t.pingedLanes&=~l,a&&(t.warmLanes|=l),a=t.expirationTimes;for(var u=l;0<u;){var n=31-sl(u),i=1<<n;a[n]=-1,u&=~i}e!==0&&Zf(t,e,l)}function Cn(){return(ot&6)===0?(Su(0),!1):!0}function Lc(){if(tt!==null){if(mt===0)var t=tt.return;else t=tt,Ll=Xe=null,ic(t),ba=null,eu=0,t=tt;for(;t!==null;)os(t.alternate,t),t=t.return;tt=null}}function Oa(t,l){var e=t.timeoutHandle;e!==-1&&(t.timeoutHandle=-1,nm(e)),e=t.cancelPendingCommit,e!==null&&(t.cancelPendingCommit=null,e()),le=0,Lc(),St=t,tt=e=Zl(t.current,null),et=l,mt=0,gl=null,ve=!1,Aa=Ga(t,l),Yc=!1,Ma=vl=Gc=We=be=Dt=0,cl=bu=null,Xc=!1,(l&8)!==0&&(l|=l&32);var a=t.entangledLanes;if(a!==0)for(t=t.entanglements,a&=l;0<a;){var u=31-sl(a),n=1<<u;l|=t[u],a&=~n}return te=l,Iu(),e}function Rs(t,l){W=null,x.H=ou,l===va||l===cn?(l=Wr(),mt=3):l===ki?(l=Wr(),mt=4):mt=l===zc?8:l!==null&&typeof l=="object"&&typeof l.then=="function"?6:1,gl=l,tt===null&&(Dt=1,xn(t,zl(l,t.current)))}function Hs(){var t=ml.current;return t===null?!0:(et&4194048)===et?Ml===null:(et&62914560)===et||(et&536870912)!==0?t===Ml:!1}function Bs(){var t=x.H;return x.H=ou,t===null?ou:t}function qs(){var t=x.A;return x.A=qy,t}function jn(){Dt=4,ve||(et&4194048)!==et&&ml.current!==null||(Aa=!0),(be&134217727)===0&&(We&134217727)===0||St===null||xe(St,et,vl,!1)}function Vc(t,l,e){var a=ot;ot|=2;var u=Bs(),n=qs();(St!==t||et!==l)&&(Un=null,Oa(t,l)),l=!1;var i=Dt;t:do try{if(mt!==0&&tt!==null){var c=tt,o=gl;switch(mt){case 8:Lc(),i=6;break t;case 3:case 2:case 9:case 6:ml.current===null&&(l=!0);var h=mt;if(mt=0,gl=null,Na(t,c,o,h),e&&Aa){i=0;break t}break;default:h=mt,mt=0,gl=null,Na(t,c,o,h)}}Xy(),i=Dt;break}catch(z){Rs(t,z)}while(!0);return l&&t.shellSuspendCounter++,Ll=Xe=null,ot=a,x.H=u,x.A=n,tt===null&&(St=null,et=0,Iu()),i}function Xy(){for(;tt!==null;)Ys(tt)}function Qy(t,l){var e=ot;ot|=2;var a=Bs(),u=qs();St!==t||et!==l?(Un=null,Dn=rl()+500,Oa(t,l)):Aa=Ga(t,l);t:do try{if(mt!==0&&tt!==null){l=tt;var n=gl;l:switch(mt){case 1:mt=0,gl=null,Na(t,l,n,1);break;case 2:case 9:if(Jr(n)){mt=0,gl=null,Gs(l);break}l=function(){mt!==2&&mt!==9||St!==t||(mt=7),Yl(t)},n.then(l,l);break t;case 3:mt=7;break t;case 4:mt=5;break t;case 7:Jr(n)?(mt=0,gl=null,Gs(l)):(mt=0,gl=null,Na(t,l,n,7));break;case 5:var i=null;switch(tt.tag){case 26:i=tt.memoizedState;case 5:case 27:var c=tt;if(i?Ed(i):c.stateNode.complete){mt=0,gl=null;var o=c.sibling;if(o!==null)tt=o;else{var h=c.return;h!==null?(tt=h,Rn(h)):tt=null}break l}}mt=0,gl=null,Na(t,l,n,5);break;case 6:mt=0,gl=null,Na(t,l,n,6);break;case 8:Lc(),Dt=6;break t;default:throw Error(f(462))}}Zy();break}catch(z){Rs(t,z)}while(!0);return Ll=Xe=null,x.H=a,x.A=u,ot=e,tt!==null?0:(St=null,et=0,Iu(),Dt)}function Zy(){for(;tt!==null&&!s0();)Ys(tt)}function Ys(t){var l=fs(t.alternate,t,te);t.memoizedProps=t.pendingProps,l===null?Rn(t):tt=l}function Gs(t){var l=t,e=l.alternate;switch(l.tag){case 15:case 0:l=es(e,l,l.pendingProps,l.type,void 0,et);break;case 11:l=es(e,l,l.pendingProps,l.type.render,l.ref,et);break;case 5:ic(l);default:os(e,l),l=tt=Br(l,te),l=fs(e,l,te)}t.memoizedProps=t.pendingProps,l===null?Rn(t):tt=l}function Na(t,l,e,a){Ll=Xe=null,ic(l),ba=null,eu=0;var u=l.return;try{if(Dy(t,u,l,e,et)){Dt=1,xn(t,zl(e,t.current)),tt=null;return}}catch(n){if(u!==null)throw tt=u,n;Dt=1,xn(t,zl(e,t.current)),tt=null;return}l.flags&32768?(ut||a===1?t=!0:Aa||(et&536870912)!==0?t=!1:(ve=t=!0,(a===2||a===9||a===3||a===6)&&(a=ml.current,a!==null&&a.tag===13&&(a.flags|=16384))),Xs(l,t)):Rn(l)}function Rn(t){var l=t;do{if((l.flags&32768)!==0){Xs(l,ve);return}t=l.return;var e=jy(l.alternate,l,te);if(e!==null){tt=e;return}if(l=l.sibling,l!==null){tt=l;return}tt=l=t}while(l!==null);Dt===0&&(Dt=5)}function Xs(t,l){do{var e=Ry(t.alternate,t);if(e!==null){e.flags&=32767,tt=e;return}if(e=t.return,e!==null&&(e.flags|=32768,e.subtreeFlags=0,e.deletions=null),!l&&(t=t.sibling,t!==null)){tt=t;return}tt=t=e}while(t!==null);Dt=6,tt=null}function Qs(t,l,e,a,u,n,i,c,o){t.cancelPendingCommit=null;do Hn();while(Gt!==0);if((ot&6)!==0)throw Error(f(327));if(l!==null){if(l===t.current)throw Error(f(177));if(n=l.lanes|l.childLanes,n|=ji,x0(t,e,n,i,c,o),t===St&&(tt=St=null,et=0),_a=l,Se=t,le=e,Qc=n,Zc=u,Ds=a,(l.subtreeFlags&10256)!==0||(l.flags&10256)!==0?(t.callbackNode=null,t.callbackPriority=0,Ky(Bu,function(){return Ks(),null})):(t.callbackNode=null,t.callbackPriority=0),a=(l.flags&13878)!==0,(l.subtreeFlags&13878)!==0||a){a=x.T,x.T=null,u=C.p,C.p=2,i=ot,ot|=4;try{Hy(t,l,e)}finally{ot=i,C.p=u,x.T=a}}Gt=1,Zs(),ws(),Ls()}}function Zs(){if(Gt===1){Gt=0;var t=Se,l=_a,e=(l.flags&13878)!==0;if((l.subtreeFlags&13878)!==0||e){e=x.T,x.T=null;var a=C.p;C.p=2;var u=ot;ot|=4;try{zs(l,t);var n=af,i=_r(t.containerInfo),c=n.focusedElem,o=n.selectionRange;if(i!==c&&c&&c.ownerDocument&&Mr(c.ownerDocument.documentElement,c)){if(o!==null&&Oi(c)){var h=o.start,z=o.end;if(z===void 0&&(z=h),"selectionStart"in c)c.selectionStart=h,c.selectionEnd=Math.min(z,c.value.length);else{var E=c.ownerDocument||document,g=E&&E.defaultView||window;if(g.getSelection){var b=g.getSelection(),B=c.textContent.length,w=Math.min(o.start,B),pt=o.end===void 0?w:Math.min(o.end,B);!b.extend&&w>pt&&(i=pt,pt=w,w=i);var y=Ar(c,w),d=Ar(c,pt);if(y&&d&&(b.rangeCount!==1||b.anchorNode!==y.node||b.anchorOffset!==y.offset||b.focusNode!==d.node||b.focusOffset!==d.offset)){var m=E.createRange();m.setStart(y.node,y.offset),b.removeAllRanges(),w>pt?(b.addRange(m),b.extend(d.node,d.offset)):(m.setEnd(d.node,d.offset),b.addRange(m))}}}}for(E=[],b=c;b=b.parentNode;)b.nodeType===1&&E.push({element:b,left:b.scrollLeft,top:b.scrollTop});for(typeof c.focus=="function"&&c.focus(),c=0;c<E.length;c++){var T=E[c];T.element.scrollLeft=T.left,T.element.scrollTop=T.top}}Jn=!!ef,af=ef=null}finally{ot=u,C.p=a,x.T=e}}t.current=l,Gt=2}}function ws(){if(Gt===2){Gt=0;var t=Se,l=_a,e=(l.flags&8772)!==0;if((l.subtreeFlags&8772)!==0||e){e=x.T,x.T=null;var a=C.p;C.p=2;var u=ot;ot|=4;try{vs(t,l.alternate,l)}finally{ot=u,C.p=a,x.T=e}}Gt=3}}function Ls(){if(Gt===4||Gt===3){Gt=0,d0();var t=Se,l=_a,e=le,a=Ds;(l.subtreeFlags&10256)!==0||(l.flags&10256)!==0?Gt=5:(Gt=0,_a=Se=null,Vs(t,t.pendingLanes));var u=t.pendingLanes;if(u===0&&(pe=null),ri(e),l=l.stateNode,ol&&typeof ol.onCommitFiberRoot=="function")try{ol.onCommitFiberRoot(Ya,l,void 0,(l.current.flags&128)===128)}catch{}if(a!==null){l=x.T,u=C.p,C.p=2,x.T=null;try{for(var n=t.onRecoverableError,i=0;i<a.length;i++){var c=a[i];n(c.value,{componentStack:c.stack})}}finally{x.T=l,C.p=u}}(le&3)!==0&&Hn(),Yl(t),u=t.pendingLanes,(e&261930)!==0&&(u&42)!==0?t===wc?pu++:(pu=0,wc=t):pu=0,Su(0)}}function Vs(t,l){(t.pooledCacheLanes&=l)===0&&(l=t.pooledCache,l!=null&&(t.pooledCache=null,tu(l)))}function Hn(){return Zs(),ws(),Ls(),Ks()}function Ks(){if(Gt!==5)return!1;var t=Se,l=Qc;Qc=0;var e=ri(le),a=x.T,u=C.p;try{C.p=32>e?32:e,x.T=null,e=Zc,Zc=null;var n=Se,i=le;if(Gt=0,_a=Se=null,le=0,(ot&6)!==0)throw Error(f(331));var c=ot;if(ot|=4,_s(n.current),Es(n,n.current,i,e),ot=c,Su(0,!1),ol&&typeof ol.onPostCommitFiberRoot=="function")try{ol.onPostCommitFiberRoot(Ya,n)}catch{}return!0}finally{C.p=u,x.T=a,Vs(t,l)}}function Js(t,l,e){l=zl(e,l),l=xc(t.stateNode,l,2),t=ye(t,l,2),t!==null&&(Xa(t,2),Yl(t))}function ht(t,l,e){if(t.tag===3)Js(t,t,e);else for(;l!==null;){if(l.tag===3){Js(l,t,e);break}else if(l.tag===1){var a=l.stateNode;if(typeof l.type.getDerivedStateFromError=="function"||typeof a.componentDidCatch=="function"&&(pe===null||!pe.has(a))){t=zl(e,t),e=ko(2),a=ye(l,e,2),a!==null&&(Wo(e,a,l,t),Xa(a,2),Yl(a));break}}l=l.return}}function Kc(t,l,e){var a=t.pingCache;if(a===null){a=t.pingCache=new Yy;var u=new Set;a.set(l,u)}else u=a.get(l),u===void 0&&(u=new Set,a.set(l,u));u.has(e)||(Yc=!0,u.add(e),t=wy.bind(null,t,l,e),l.then(t,t))}function wy(t,l,e){var a=t.pingCache;a!==null&&a.delete(l),t.pingedLanes|=t.suspendedLanes&e,t.warmLanes&=~e,St===t&&(et&e)===e&&(Dt===4||Dt===3&&(et&62914560)===et&&300>rl()-Nn?(ot&2)===0&&Oa(t,0):Gc|=e,Ma===et&&(Ma=0)),Yl(t)}function ks(t,l){l===0&&(l=Qf()),t=qe(t,l),t!==null&&(Xa(t,l),Yl(t))}function Ly(t){var l=t.memoizedState,e=0;l!==null&&(e=l.retryLane),ks(t,e)}function Vy(t,l){var e=0;switch(t.tag){case 31:case 13:var a=t.stateNode,u=t.memoizedState;u!==null&&(e=u.retryLane);break;case 19:a=t.stateNode;break;case 22:a=t.stateNode._retryCache;break;default:throw Error(f(314))}a!==null&&a.delete(l),ks(t,e)}function Ky(t,l){return ni(t,l)}var Bn=null,Da=null,Jc=!1,qn=!1,kc=!1,ze=0;function Yl(t){t!==Da&&t.next===null&&(Da===null?Bn=Da=t:Da=Da.next=t),qn=!0,Jc||(Jc=!0,ky())}function Su(t,l){if(!kc&&qn){kc=!0;do for(var e=!1,a=Bn;a!==null;){if(t!==0){var u=a.pendingLanes;if(u===0)var n=0;else{var i=a.suspendedLanes,c=a.pingedLanes;n=(1<<31-sl(42|t)+1)-1,n&=u&~(i&~c),n=n&201326741?n&201326741|1:n?n|2:0}n!==0&&(e=!0,Is(a,n))}else n=et,n=Xu(a,a===St?n:0,a.cancelPendingCommit!==null||a.timeoutHandle!==-1),(n&3)===0||Ga(a,n)||(e=!0,Is(a,n));a=a.next}while(e);kc=!1}}function Jy(){Ws()}function Ws(){qn=Jc=!1;var t=0;ze!==0&&um()&&(t=ze);for(var l=rl(),e=null,a=Bn;a!==null;){var u=a.next,n=$s(a,l);n===0?(a.next=null,e===null?Bn=u:e.next=u,u===null&&(Da=e)):(e=a,(t!==0||(n&3)!==0)&&(qn=!0)),a=u}Gt!==0&&Gt!==5||Su(t),ze!==0&&(ze=0)}function $s(t,l){for(var e=t.suspendedLanes,a=t.pingedLanes,u=t.expirationTimes,n=t.pendingLanes&-62914561;0<n;){var i=31-sl(n),c=1<<i,o=u[i];o===-1?((c&e)===0||(c&a)!==0)&&(u[i]=S0(c,l)):o<=l&&(t.expiredLanes|=c),n&=~c}if(l=St,e=et,e=Xu(t,t===l?e:0,t.cancelPendingCommit!==null||t.timeoutHandle!==-1),a=t.callbackNode,e===0||t===l&&(mt===2||mt===9)||t.cancelPendingCommit!==null)return a!==null&&a!==null&&ii(a),t.callbackNode=null,t.callbackPriority=0;if((e&3)===0||Ga(t,e)){if(l=e&-e,l===t.callbackPriority)return l;switch(a!==null&&ii(a),ri(e)){case 2:case 8:e=Gf;break;case 32:e=Bu;break;case 268435456:e=Xf;break;default:e=Bu}return a=Fs.bind(null,t),e=ni(e,a),t.callbackPriority=l,t.callbackNode=e,l}return a!==null&&a!==null&&ii(a),t.callbackPriority=2,t.callbackNode=null,2}function Fs(t,l){if(Gt!==0&&Gt!==5)return t.callbackNode=null,t.callbackPriority=0,null;var e=t.callbackNode;if(Hn()&&t.callbackNode!==e)return null;var a=et;return a=Xu(t,t===St?a:0,t.cancelPendingCommit!==null||t.timeoutHandle!==-1),a===0?null:(Cs(t,a,l),$s(t,rl()),t.callbackNode!=null&&t.callbackNode===e?Fs.bind(null,t):null)}function Is(t,l){if(Hn())return null;Cs(t,l,!0)}function ky(){im(function(){(ot&6)!==0?ni(Yf,Jy):Ws()})}function Wc(){if(ze===0){var t=ha;t===0&&(t=qu,qu<<=1,(qu&261888)===0&&(qu=256)),ze=t}return ze}function Ps(t){return t==null||typeof t=="symbol"||typeof t=="boolean"?null:typeof t=="function"?t:Lu(""+t)}function td(t,l){var e=l.ownerDocument.createElement("input");return e.name=l.name,e.value=l.value,t.id&&e.setAttribute("form",t.id),l.parentNode.insertBefore(e,l),t=new FormData(t),e.parentNode.removeChild(e),t}function Wy(t,l,e,a,u){if(l==="submit"&&e&&e.stateNode===u){var n=Ps((u[el]||null).action),i=a.submitter;i&&(l=(l=i[el]||null)?Ps(l.formAction):i.getAttribute("formAction"),l!==null&&(n=l,i=null));var c=new ku("action","action",null,a,u);t.push({event:c,listeners:[{instance:null,listener:function(){if(a.defaultPrevented){if(ze!==0){var o=i?td(u,i):new FormData(u);hc(e,{pending:!0,data:o,method:u.method,action:n},null,o)}}else typeof n=="function"&&(c.preventDefault(),o=i?td(u,i):new FormData(u),hc(e,{pending:!0,data:o,method:u.method,action:n},n,o))},currentTarget:u}]})}}for(var $c=0;$c<Ci.length;$c++){var Fc=Ci[$c],$y=Fc.toLowerCase(),Fy=Fc[0].toUpperCase()+Fc.slice(1);Dl($y,"on"+Fy)}Dl(Dr,"onAnimationEnd"),Dl(Ur,"onAnimationIteration"),Dl(Cr,"onAnimationStart"),Dl("dblclick","onDoubleClick"),Dl("focusin","onFocus"),Dl("focusout","onBlur"),Dl(yy,"onTransitionRun"),Dl(my,"onTransitionStart"),Dl(hy,"onTransitionCancel"),Dl(jr,"onTransitionEnd"),la("onMouseEnter",["mouseout","mouseover"]),la("onMouseLeave",["mouseout","mouseover"]),la("onPointerEnter",["pointerout","pointerover"]),la("onPointerLeave",["pointerout","pointerover"]),je("onChange","change click focusin focusout input keydown keyup selectionchange".split(" ")),je("onSelect","focusout contextmenu dragend focusin keydown keyup mousedown mouseup selectionchange".split(" ")),je("onBeforeInput",["compositionend","keypress","textInput","paste"]),je("onCompositionEnd","compositionend focusout keydown keypress keyup mousedown".split(" ")),je("onCompositionStart","compositionstart focusout keydown keypress keyup mousedown".split(" ")),je("onCompositionUpdate","compositionupdate focusout keydown keypress keyup mousedown".split(" "));var xu="abort canplay canplaythrough durationchange emptied encrypted ended error loadeddata loadedmetadata loadstart pause play playing progress ratechange resize seeked seeking stalled suspend timeupdate volumechange waiting".split(" "),Iy=new Set("beforetoggle cancel close invalid load scroll scrollend toggle".split(" ").concat(xu));function ld(t,l){l=(l&4)!==0;for(var e=0;e<t.length;e++){var a=t[e],u=a.event;a=a.listeners;t:{var n=void 0;if(l)for(var i=a.length-1;0<=i;i--){var c=a[i],o=c.instance,h=c.currentTarget;if(c=c.listener,o!==n&&u.isPropagationStopped())break t;n=c,u.currentTarget=h;try{n(u)}catch(z){Fu(z)}u.currentTarget=null,n=o}else for(i=0;i<a.length;i++){if(c=a[i],o=c.instance,h=c.currentTarget,c=c.listener,o!==n&&u.isPropagationStopped())break t;n=c,u.currentTarget=h;try{n(u)}catch(z){Fu(z)}u.currentTarget=null,n=o}}}}function lt(t,l){var e=l[oi];e===void 0&&(e=l[oi]=new Set);var a=t+"__bubble";e.has(a)||(ed(l,t,2,!1),e.add(a))}function Ic(t,l,e){var a=0;l&&(a|=4),ed(e,t,a,l)}var Yn="_reactListening"+Math.random().toString(36).slice(2);function Pc(t){if(!t[Yn]){t[Yn]=!0,kf.forEach(function(e){e!=="selectionchange"&&(Iy.has(e)||Ic(e,!1,t),Ic(e,!0,t))});var l=t.nodeType===9?t:t.ownerDocument;l===null||l[Yn]||(l[Yn]=!0,Ic("selectionchange",!1,l))}}function ed(t,l,e,a){switch(Ud(l)){case 2:var u=Mm;break;case 8:u=_m;break;default:u=hf}e=u.bind(null,l,e,t),u=void 0,!pi||l!=="touchstart"&&l!=="touchmove"&&l!=="wheel"||(u=!0),a?u!==void 0?t.addEventListener(l,e,{capture:!0,passive:u}):t.addEventListener(l,e,!0):u!==void 0?t.addEventListener(l,e,{passive:u}):t.addEventListener(l,e,!1)}function tf(t,l,e,a,u){var n=a;if((l&1)===0&&(l&2)===0&&a!==null)t:for(;;){if(a===null)return;var i=a.tag;if(i===3||i===4){var c=a.stateNode.containerInfo;if(c===u)break;if(i===4)for(i=a.return;i!==null;){var o=i.tag;if((o===3||o===4)&&i.stateNode.containerInfo===u)return;i=i.return}for(;c!==null;){if(i=Ie(c),i===null)return;if(o=i.tag,o===5||o===6||o===26||o===27){a=n=i;continue t}c=c.parentNode}}a=a.return}ir(function(){var h=n,z=vi(e),E=[];t:{var g=Rr.get(t);if(g!==void 0){var b=ku,B=t;switch(t){case"keypress":if(Ku(e)===0)break t;case"keydown":case"keyup":b=V0;break;case"focusin":B="focus",b=Ti;break;case"focusout":B="blur",b=Ti;break;case"beforeblur":case"afterblur":b=Ti;break;case"click":if(e.button===2)break t;case"auxclick":case"dblclick":case"mousedown":case"mousemove":case"mouseup":case"mouseout":case"mouseover":case"contextmenu":b=rr;break;case"drag":case"dragend":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"dragstart":case"drop":b=j0;break;case"touchcancel":case"touchend":case"touchmove":case"touchstart":b=k0;break;case Dr:case Ur:case Cr:b=B0;break;case jr:b=$0;break;case"scroll":case"scrollend":b=U0;break;case"wheel":b=I0;break;case"copy":case"cut":case"paste":b=Y0;break;case"gotpointercapture":case"lostpointercapture":case"pointercancel":case"pointerdown":case"pointermove":case"pointerout":case"pointerover":case"pointerup":b=sr;break;case"toggle":case"beforetoggle":b=ty}var w=(l&4)!==0,pt=!w&&(t==="scroll"||t==="scrollend"),y=w?g!==null?g+"Capture":null:g;w=[];for(var d=h,m;d!==null;){var T=d;if(m=T.stateNode,T=T.tag,T!==5&&T!==26&&T!==27||m===null||y===null||(T=wa(d,y),T!=null&&w.push(zu(d,T,m))),pt)break;d=d.return}0<w.length&&(g=new b(g,B,null,e,z),E.push({event:g,listeners:w}))}}if((l&7)===0){t:{if(g=t==="mouseover"||t==="pointerover",b=t==="mouseout"||t==="pointerout",g&&e!==gi&&(B=e.relatedTarget||e.fromElement)&&(Ie(B)||B[Fe]))break t;if((b||g)&&(g=z.window===z?z:(g=z.ownerDocument)?g.defaultView||g.parentWindow:window,b?(B=e.relatedTarget||e.toElement,b=h,B=B?Ie(B):null,B!==null&&(pt=O(B),w=B.tag,B!==pt||w!==5&&w!==27&&w!==6)&&(B=null)):(b=null,B=h),b!==B)){if(w=rr,T="onMouseLeave",y="onMouseEnter",d="mouse",(t==="pointerout"||t==="pointerover")&&(w=sr,T="onPointerLeave",y="onPointerEnter",d="pointer"),pt=b==null?g:Za(b),m=B==null?g:Za(B),g=new w(T,d+"leave",b,e,z),g.target=pt,g.relatedTarget=m,T=null,Ie(z)===h&&(w=new w(y,d+"enter",B,e,z),w.target=m,w.relatedTarget=pt,T=w),pt=T,b&&B)l:{for(w=Py,y=b,d=B,m=0,T=y;T;T=w(T))m++;T=0;for(var X=d;X;X=w(X))T++;for(;0<m-T;)y=w(y),m--;for(;0<T-m;)d=w(d),T--;for(;m--;){if(y===d||d!==null&&y===d.alternate){w=y;break l}y=w(y),d=w(d)}w=null}else w=null;b!==null&&ad(E,g,b,w,!1),B!==null&&pt!==null&&ad(E,pt,B,w,!0)}}t:{if(g=h?Za(h):window,b=g.nodeName&&g.nodeName.toLowerCase(),b==="select"||b==="input"&&g.type==="file")var ft=pr;else if(vr(g))if(Sr)ft=oy;else{ft=fy;var Y=cy}else b=g.nodeName,!b||b.toLowerCase()!=="input"||g.type!=="checkbox"&&g.type!=="radio"?h&&hi(h.elementType)&&(ft=pr):ft=ry;if(ft&&(ft=ft(t,h))){br(E,ft,e,z);break t}Y&&Y(t,g,h),t==="focusout"&&h&&g.type==="number"&&h.memoizedProps.value!=null&&mi(g,"number",g.value)}switch(Y=h?Za(h):window,t){case"focusin":(vr(Y)||Y.contentEditable==="true")&&(ca=Y,Ni=h,Fa=null);break;case"focusout":Fa=Ni=ca=null;break;case"mousedown":Di=!0;break;case"contextmenu":case"mouseup":case"dragend":Di=!1,Or(E,e,z);break;case"selectionchange":if(dy)break;case"keydown":case"keyup":Or(E,e,z)}var $;if(Ai)t:{switch(t){case"compositionstart":var at="onCompositionStart";break t;case"compositionend":at="onCompositionEnd";break t;case"compositionupdate":at="onCompositionUpdate";break t}at=void 0}else ia?hr(t,e)&&(at="onCompositionEnd"):t==="keydown"&&e.keyCode===229&&(at="onCompositionStart");at&&(dr&&e.locale!=="ko"&&(ia||at!=="onCompositionStart"?at==="onCompositionEnd"&&ia&&($=cr()):(ie=z,Si="value"in ie?ie.value:ie.textContent,ia=!0)),Y=Gn(h,at),0<Y.length&&(at=new or(at,t,null,e,z),E.push({event:at,listeners:Y}),$?at.data=$:($=gr(e),$!==null&&(at.data=$)))),($=ey?ay(t,e):uy(t,e))&&(at=Gn(h,"onBeforeInput"),0<at.length&&(Y=new or("onBeforeInput","beforeinput",null,e,z),E.push({event:Y,listeners:at}),Y.data=$)),Wy(E,t,h,e,z)}ld(E,l)})}function zu(t,l,e){return{instance:t,listener:l,currentTarget:e}}function Gn(t,l){for(var e=l+"Capture",a=[];t!==null;){var u=t,n=u.stateNode;if(u=u.tag,u!==5&&u!==26&&u!==27||n===null||(u=wa(t,e),u!=null&&a.unshift(zu(t,u,n)),u=wa(t,l),u!=null&&a.push(zu(t,u,n))),t.tag===3)return a;t=t.return}return[]}function Py(t){if(t===null)return null;do t=t.return;while(t&&t.tag!==5&&t.tag!==27);return t||null}function ad(t,l,e,a,u){for(var n=l._reactName,i=[];e!==null&&e!==a;){var c=e,o=c.alternate,h=c.stateNode;if(c=c.tag,o!==null&&o===a)break;c!==5&&c!==26&&c!==27||h===null||(o=h,u?(h=wa(e,n),h!=null&&i.unshift(zu(e,h,o))):u||(h=wa(e,n),h!=null&&i.push(zu(e,h,o)))),e=e.return}i.length!==0&&t.push({event:l,listeners:i})}var tm=/\r\n?/g,lm=/\u0000|\uFFFD/g;function ud(t){return(typeof t=="string"?t:""+t).replace(tm,`
-`).replace(lm,"")}function nd(t,l){return l=ud(l),ud(t)===l}function bt(t,l,e,a,u,n){switch(e){case"children":typeof a=="string"?l==="body"||l==="textarea"&&a===""||aa(t,a):(typeof a=="number"||typeof a=="bigint")&&l!=="body"&&aa(t,""+a);break;case"className":Zu(t,"class",a);break;case"tabIndex":Zu(t,"tabindex",a);break;case"dir":case"role":case"viewBox":case"width":case"height":Zu(t,e,a);break;case"style":ur(t,a,n);break;case"data":if(l!=="object"){Zu(t,"data",a);break}case"src":case"href":if(a===""&&(l!=="a"||e!=="href")){t.removeAttribute(e);break}if(a==null||typeof a=="function"||typeof a=="symbol"||typeof a=="boolean"){t.removeAttribute(e);break}a=Lu(""+a),t.setAttribute(e,a);break;case"action":case"formAction":if(typeof a=="function"){t.setAttribute(e,"javascript:throw new Error('A React form was unexpectedly submitted. If you called form.submit() manually, consider using form.requestSubmit() instead. If you\\'re trying to use event.stopPropagation() in a submit event handler, consider also calling event.preventDefault().')");break}else typeof n=="function"&&(e==="formAction"?(l!=="input"&&bt(t,l,"name",u.name,u,null),bt(t,l,"formEncType",u.formEncType,u,null),bt(t,l,"formMethod",u.formMethod,u,null),bt(t,l,"formTarget",u.formTarget,u,null)):(bt(t,l,"encType",u.encType,u,null),bt(t,l,"method",u.method,u,null),bt(t,l,"target",u.target,u,null)));if(a==null||typeof a=="symbol"||typeof a=="boolean"){t.removeAttribute(e);break}a=Lu(""+a),t.setAttribute(e,a);break;case"onClick":a!=null&&(t.onclick=Xl);break;case"onScroll":a!=null&&lt("scroll",t);break;case"onScrollEnd":a!=null&&lt("scrollend",t);break;case"dangerouslySetInnerHTML":if(a!=null){if(typeof a!="object"||!("__html"in a))throw Error(f(61));if(e=a.__html,e!=null){if(u.children!=null)throw Error(f(60));t.innerHTML=e}}break;case"multiple":t.multiple=a&&typeof a!="function"&&typeof a!="symbol";break;case"muted":t.muted=a&&typeof a!="function"&&typeof a!="symbol";break;case"suppressContentEditableWarning":case"suppressHydrationWarning":case"defaultValue":case"defaultChecked":case"innerHTML":case"ref":break;case"autoFocus":break;case"xlinkHref":if(a==null||typeof a=="function"||typeof a=="boolean"||typeof a=="symbol"){t.removeAttribute("xlink:href");break}e=Lu(""+a),t.setAttributeNS("http://www.w3.org/1999/xlink","xlink:href",e);break;case"contentEditable":case"spellCheck":case"draggable":case"value":case"autoReverse":case"externalResourcesRequired":case"focusable":case"preserveAlpha":a!=null&&typeof a!="function"&&typeof a!="symbol"?t.setAttribute(e,""+a):t.removeAttribute(e);break;case"inert":case"allowFullScreen":case"async":case"autoPlay":case"controls":case"default":case"defer":case"disabled":case"disablePictureInPicture":case"disableRemotePlayback":case"formNoValidate":case"hidden":case"loop":case"noModule":case"noValidate":case"open":case"playsInline":case"readOnly":case"required":case"reversed":case"scoped":case"seamless":case"itemScope":a&&typeof a!="function"&&typeof a!="symbol"?t.setAttribute(e,""):t.removeAttribute(e);break;case"capture":case"download":a===!0?t.setAttribute(e,""):a!==!1&&a!=null&&typeof a!="function"&&typeof a!="symbol"?t.setAttribute(e,a):t.removeAttribute(e);break;case"cols":case"rows":case"size":case"span":a!=null&&typeof a!="function"&&typeof a!="symbol"&&!isNaN(a)&&1<=a?t.setAttribute(e,a):t.removeAttribute(e);break;case"rowSpan":case"start":a==null||typeof a=="function"||typeof a=="symbol"||isNaN(a)?t.removeAttribute(e):t.setAttribute(e,a);break;case"popover":lt("beforetoggle",t),lt("toggle",t),Qu(t,"popover",a);break;case"xlinkActuate":Gl(t,"http://www.w3.org/1999/xlink","xlink:actuate",a);break;case"xlinkArcrole":Gl(t,"http://www.w3.org/1999/xlink","xlink:arcrole",a);break;case"xlinkRole":Gl(t,"http://www.w3.org/1999/xlink","xlink:role",a);break;case"xlinkShow":Gl(t,"http://www.w3.org/1999/xlink","xlink:show",a);break;case"xlinkTitle":Gl(t,"http://www.w3.org/1999/xlink","xlink:title",a);break;case"xlinkType":Gl(t,"http://www.w3.org/1999/xlink","xlink:type",a);break;case"xmlBase":Gl(t,"http://www.w3.org/XML/1998/namespace","xml:base",a);break;case"xmlLang":Gl(t,"http://www.w3.org/XML/1998/namespace","xml:lang",a);break;case"xmlSpace":Gl(t,"http://www.w3.org/XML/1998/namespace","xml:space",a);break;case"is":Qu(t,"is",a);break;case"innerText":case"textContent":break;default:(!(2<e.length)||e[0]!=="o"&&e[0]!=="O"||e[1]!=="n"&&e[1]!=="N")&&(e=N0.get(e)||e,Qu(t,e,a))}}function lf(t,l,e,a,u,n){switch(e){case"style":ur(t,a,n);break;case"dangerouslySetInnerHTML":if(a!=null){if(typeof a!="object"||!("__html"in a))throw Error(f(61));if(e=a.__html,e!=null){if(u.children!=null)throw Error(f(60));t.innerHTML=e}}break;case"children":typeof a=="string"?aa(t,a):(typeof a=="number"||typeof a=="bigint")&&aa(t,""+a);break;case"onScroll":a!=null&&lt("scroll",t);break;case"onScrollEnd":a!=null&&lt("scrollend",t);break;case"onClick":a!=null&&(t.onclick=Xl);break;case"suppressContentEditableWarning":case"suppressHydrationWarning":case"innerHTML":case"ref":break;case"innerText":case"textContent":break;default:if(!Wf.hasOwnProperty(e))t:{if(e[0]==="o"&&e[1]==="n"&&(u=e.endsWith("Capture"),l=e.slice(2,u?e.length-7:void 0),n=t[el]||null,n=n!=null?n[e]:null,typeof n=="function"&&t.removeEventListener(l,n,u),typeof a=="function")){typeof n!="function"&&n!==null&&(e in t?t[e]=null:t.hasAttribute(e)&&t.removeAttribute(e)),t.addEventListener(l,a,u);break t}e in t?t[e]=a:a===!0?t.setAttribute(e,""):Qu(t,e,a)}}}function Jt(t,l,e){switch(l){case"div":case"span":case"svg":case"path":case"a":case"g":case"p":case"li":break;case"img":lt("error",t),lt("load",t);var a=!1,u=!1,n;for(n in e)if(e.hasOwnProperty(n)){var i=e[n];if(i!=null)switch(n){case"src":a=!0;break;case"srcSet":u=!0;break;case"children":case"dangerouslySetInnerHTML":throw Error(f(137,l));default:bt(t,l,n,i,e,null)}}u&&bt(t,l,"srcSet",e.srcSet,e,null),a&&bt(t,l,"src",e.src,e,null);return;case"input":lt("invalid",t);var c=n=i=u=null,o=null,h=null;for(a in e)if(e.hasOwnProperty(a)){var z=e[a];if(z!=null)switch(a){case"name":u=z;break;case"type":i=z;break;case"checked":o=z;break;case"defaultChecked":h=z;break;case"value":n=z;break;case"defaultValue":c=z;break;case"children":case"dangerouslySetInnerHTML":if(z!=null)throw Error(f(137,l));break;default:bt(t,l,a,z,e,null)}}tr(t,n,c,o,h,i,u,!1);return;case"select":lt("invalid",t),a=i=n=null;for(u in e)if(e.hasOwnProperty(u)&&(c=e[u],c!=null))switch(u){case"value":n=c;break;case"defaultValue":i=c;break;case"multiple":a=c;default:bt(t,l,u,c,e,null)}l=n,e=i,t.multiple=!!a,l!=null?ea(t,!!a,l,!1):e!=null&&ea(t,!!a,e,!0);return;case"textarea":lt("invalid",t),n=u=a=null;for(i in e)if(e.hasOwnProperty(i)&&(c=e[i],c!=null))switch(i){case"value":a=c;break;case"defaultValue":u=c;break;case"children":n=c;break;case"dangerouslySetInnerHTML":if(c!=null)throw Error(f(91));break;default:bt(t,l,i,c,e,null)}er(t,a,u,n);return;case"option":for(o in e)e.hasOwnProperty(o)&&(a=e[o],a!=null)&&(o==="selected"?t.selected=a&&typeof a!="function"&&typeof a!="symbol":bt(t,l,o,a,e,null));return;case"dialog":lt("beforetoggle",t),lt("toggle",t),lt("cancel",t),lt("close",t);break;case"iframe":case"object":lt("load",t);break;case"video":case"audio":for(a=0;a<xu.length;a++)lt(xu[a],t);break;case"image":lt("error",t),lt("load",t);break;case"details":lt("toggle",t);break;case"embed":case"source":case"link":lt("error",t),lt("load",t);case"area":case"base":case"br":case"col":case"hr":case"keygen":case"meta":case"param":case"track":case"wbr":case"menuitem":for(h in e)if(e.hasOwnProperty(h)&&(a=e[h],a!=null))switch(h){case"children":case"dangerouslySetInnerHTML":throw Error(f(137,l));default:bt(t,l,h,a,e,null)}return;default:if(hi(l)){for(z in e)e.hasOwnProperty(z)&&(a=e[z],a!==void 0&&lf(t,l,z,a,e,void 0));return}}for(c in e)e.hasOwnProperty(c)&&(a=e[c],a!=null&&bt(t,l,c,a,e,null))}function em(t,l,e,a){switch(l){case"div":case"span":case"svg":case"path":case"a":case"g":case"p":case"li":break;case"input":var u=null,n=null,i=null,c=null,o=null,h=null,z=null;for(b in e){var E=e[b];if(e.hasOwnProperty(b)&&E!=null)switch(b){case"checked":break;case"value":break;case"defaultValue":o=E;default:a.hasOwnProperty(b)||bt(t,l,b,null,a,E)}}for(var g in a){var b=a[g];if(E=e[g],a.hasOwnProperty(g)&&(b!=null||E!=null))switch(g){case"type":n=b;break;case"name":u=b;break;case"checked":h=b;break;case"defaultChecked":z=b;break;case"value":i=b;break;case"defaultValue":c=b;break;case"children":case"dangerouslySetInnerHTML":if(b!=null)throw Error(f(137,l));break;default:b!==E&&bt(t,l,g,b,a,E)}}yi(t,i,c,o,h,z,n,u);return;case"select":b=i=c=g=null;for(n in e)if(o=e[n],e.hasOwnProperty(n)&&o!=null)switch(n){case"value":break;case"multiple":b=o;default:a.hasOwnProperty(n)||bt(t,l,n,null,a,o)}for(u in a)if(n=a[u],o=e[u],a.hasOwnProperty(u)&&(n!=null||o!=null))switch(u){case"value":g=n;break;case"defaultValue":c=n;break;case"multiple":i=n;default:n!==o&&bt(t,l,u,n,a,o)}l=c,e=i,a=b,g!=null?ea(t,!!e,g,!1):!!a!=!!e&&(l!=null?ea(t,!!e,l,!0):ea(t,!!e,e?[]:"",!1));return;case"textarea":b=g=null;for(c in e)if(u=e[c],e.hasOwnProperty(c)&&u!=null&&!a.hasOwnProperty(c))switch(c){case"value":break;case"children":break;default:bt(t,l,c,null,a,u)}for(i in a)if(u=a[i],n=e[i],a.hasOwnProperty(i)&&(u!=null||n!=null))switch(i){case"value":g=u;break;case"defaultValue":b=u;break;case"children":break;case"dangerouslySetInnerHTML":if(u!=null)throw Error(f(91));break;default:u!==n&&bt(t,l,i,u,a,n)}lr(t,g,b);return;case"option":for(var B in e)g=e[B],e.hasOwnProperty(B)&&g!=null&&!a.hasOwnProperty(B)&&(B==="selected"?t.selected=!1:bt(t,l,B,null,a,g));for(o in a)g=a[o],b=e[o],a.hasOwnProperty(o)&&g!==b&&(g!=null||b!=null)&&(o==="selected"?t.selected=g&&typeof g!="function"&&typeof g!="symbol":bt(t,l,o,g,a,b));return;case"img":case"link":case"area":case"base":case"br":case"col":case"embed":case"hr":case"keygen":case"meta":case"param":case"source":case"track":case"wbr":case"menuitem":for(var w in e)g=e[w],e.hasOwnProperty(w)&&g!=null&&!a.hasOwnProperty(w)&&bt(t,l,w,null,a,g);for(h in a)if(g=a[h],b=e[h],a.hasOwnProperty(h)&&g!==b&&(g!=null||b!=null))switch(h){case"children":case"dangerouslySetInnerHTML":if(g!=null)throw Error(f(137,l));break;default:bt(t,l,h,g,a,b)}return;default:if(hi(l)){for(var pt in e)g=e[pt],e.hasOwnProperty(pt)&&g!==void 0&&!a.hasOwnProperty(pt)&&lf(t,l,pt,void 0,a,g);for(z in a)g=a[z],b=e[z],!a.hasOwnProperty(z)||g===b||g===void 0&&b===void 0||lf(t,l,z,g,a,b);return}}for(var y in e)g=e[y],e.hasOwnProperty(y)&&g!=null&&!a.hasOwnProperty(y)&&bt(t,l,y,null,a,g);for(E in a)g=a[E],b=e[E],!a.hasOwnProperty(E)||g===b||g==null&&b==null||bt(t,l,E,g,a,b)}function id(t){switch(t){case"css":case"script":case"font":case"img":case"image":case"input":case"link":return!0;default:return!1}}function am(){if(typeof performance.getEntriesByType=="function"){for(var t=0,l=0,e=performance.getEntriesByType("resource"),a=0;a<e.length;a++){var u=e[a],n=u.transferSize,i=u.initiatorType,c=u.duration;if(n&&c&&id(i)){for(i=0,c=u.responseEnd,a+=1;a<e.length;a++){var o=e[a],h=o.startTime;if(h>c)break;var z=o.transferSize,E=o.initiatorType;z&&id(E)&&(o=o.responseEnd,i+=z*(o<c?1:(c-h)/(o-h)))}if(--a,l+=8*(n+i)/(u.duration/1e3),t++,10<t)break}}if(0<t)return l/t/1e6}return navigator.connection&&(t=navigator.connection.downlink,typeof t=="number")?t:5}var ef=null,af=null;function Xn(t){return t.nodeType===9?t:t.ownerDocument}function cd(t){switch(t){case"http://www.w3.org/2000/svg":return 1;case"http://www.w3.org/1998/Math/MathML":return 2;default:return 0}}function fd(t,l){if(t===0)switch(l){case"svg":return 1;case"math":return 2;default:return 0}return t===1&&l==="foreignObject"?0:t}function uf(t,l){return t==="textarea"||t==="noscript"||typeof l.children=="string"||typeof l.children=="number"||typeof l.children=="bigint"||typeof l.dangerouslySetInnerHTML=="object"&&l.dangerouslySetInnerHTML!==null&&l.dangerouslySetInnerHTML.__html!=null}var nf=null;function um(){var t=window.event;return t&&t.type==="popstate"?t===nf?!1:(nf=t,!0):(nf=null,!1)}var rd=typeof setTimeout=="function"?setTimeout:void 0,nm=typeof clearTimeout=="function"?clearTimeout:void 0,od=typeof Promise=="function"?Promise:void 0,im=typeof queueMicrotask=="function"?queueMicrotask:typeof od<"u"?function(t){return od.resolve(null).then(t).catch(cm)}:rd;function cm(t){setTimeout(function(){throw t})}function Te(t){return t==="head"}function sd(t,l){var e=l,a=0;do{var u=e.nextSibling;if(t.removeChild(e),u&&u.nodeType===8)if(e=u.data,e==="/$"||e==="/&"){if(a===0){t.removeChild(u),Ra(l);return}a--}else if(e==="$"||e==="$?"||e==="$~"||e==="$!"||e==="&")a++;else if(e==="html")Tu(t.ownerDocument.documentElement);else if(e==="head"){e=t.ownerDocument.head,Tu(e);for(var n=e.firstChild;n;){var i=n.nextSibling,c=n.nodeName;n[Qa]||c==="SCRIPT"||c==="STYLE"||c==="LINK"&&n.rel.toLowerCase()==="stylesheet"||e.removeChild(n),n=i}}else e==="body"&&Tu(t.ownerDocument.body);e=u}while(e);Ra(l)}function dd(t,l){var e=t;t=0;do{var a=e.nextSibling;if(e.nodeType===1?l?(e._stashedDisplay=e.style.display,e.style.display="none"):(e.style.display=e._stashedDisplay||"",e.getAttribute("style")===""&&e.removeAttribute("style")):e.nodeType===3&&(l?(e._stashedText=e.nodeValue,e.nodeValue=""):e.nodeValue=e._stashedText||""),a&&a.nodeType===8)if(e=a.data,e==="/$"){if(t===0)break;t--}else e!=="$"&&e!=="$?"&&e!=="$~"&&e!=="$!"||t++;e=a}while(e)}function cf(t){var l=t.firstChild;for(l&&l.nodeType===10&&(l=l.nextSibling);l;){var e=l;switch(l=l.nextSibling,e.nodeName){case"HTML":case"HEAD":case"BODY":cf(e),si(e);continue;case"SCRIPT":case"STYLE":continue;case"LINK":if(e.rel.toLowerCase()==="stylesheet")continue}t.removeChild(e)}}function fm(t,l,e,a){for(;t.nodeType===1;){var u=e;if(t.nodeName.toLowerCase()!==l.toLowerCase()){if(!a&&(t.nodeName!=="INPUT"||t.type!=="hidden"))break}else if(a){if(!t[Qa])switch(l){case"meta":if(!t.hasAttribute("itemprop"))break;return t;case"link":if(n=t.getAttribute("rel"),n==="stylesheet"&&t.hasAttribute("data-precedence"))break;if(n!==u.rel||t.getAttribute("href")!==(u.href==null||u.href===""?null:u.href)||t.getAttribute("crossorigin")!==(u.crossOrigin==null?null:u.crossOrigin)||t.getAttribute("title")!==(u.title==null?null:u.title))break;return t;case"style":if(t.hasAttribute("data-precedence"))break;return t;case"script":if(n=t.getAttribute("src"),(n!==(u.src==null?null:u.src)||t.getAttribute("type")!==(u.type==null?null:u.type)||t.getAttribute("crossorigin")!==(u.crossOrigin==null?null:u.crossOrigin))&&n&&t.hasAttribute("async")&&!t.hasAttribute("itemprop"))break;return t;default:return t}}else if(l==="input"&&t.type==="hidden"){var n=u.name==null?null:""+u.name;if(u.type==="hidden"&&t.getAttribute("name")===n)return t}else return t;if(t=_l(t.nextSibling),t===null)break}return null}function rm(t,l,e){if(l==="")return null;for(;t.nodeType!==3;)if((t.nodeType!==1||t.nodeName!=="INPUT"||t.type!=="hidden")&&!e||(t=_l(t.nextSibling),t===null))return null;return t}function yd(t,l){for(;t.nodeType!==8;)if((t.nodeType!==1||t.nodeName!=="INPUT"||t.type!=="hidden")&&!l||(t=_l(t.nextSibling),t===null))return null;return t}function ff(t){return t.data==="$?"||t.data==="$~"}function rf(t){return t.data==="$!"||t.data==="$?"&&t.ownerDocument.readyState!=="loading"}function om(t,l){var e=t.ownerDocument;if(t.data==="$~")t._reactRetry=l;else if(t.data!=="$?"||e.readyState!=="loading")l();else{var a=function(){l(),e.removeEventListener("DOMContentLoaded",a)};e.addEventListener("DOMContentLoaded",a),t._reactRetry=a}}function _l(t){for(;t!=null;t=t.nextSibling){var l=t.nodeType;if(l===1||l===3)break;if(l===8){if(l=t.data,l==="$"||l==="$!"||l==="$?"||l==="$~"||l==="&"||l==="F!"||l==="F")break;if(l==="/$"||l==="/&")return null}}return t}var of=null;function md(t){t=t.nextSibling;for(var l=0;t;){if(t.nodeType===8){var e=t.data;if(e==="/$"||e==="/&"){if(l===0)return _l(t.nextSibling);l--}else e!=="$"&&e!=="$!"&&e!=="$?"&&e!=="$~"&&e!=="&"||l++}t=t.nextSibling}return null}function hd(t){t=t.previousSibling;for(var l=0;t;){if(t.nodeType===8){var e=t.data;if(e==="$"||e==="$!"||e==="$?"||e==="$~"||e==="&"){if(l===0)return t;l--}else e!=="/$"&&e!=="/&"||l++}t=t.previousSibling}return null}function gd(t,l,e){switch(l=Xn(e),t){case"html":if(t=l.documentElement,!t)throw Error(f(452));return t;case"head":if(t=l.head,!t)throw Error(f(453));return t;case"body":if(t=l.body,!t)throw Error(f(454));return t;default:throw Error(f(451))}}function Tu(t){for(var l=t.attributes;l.length;)t.removeAttributeNode(l[0]);si(t)}var Ol=new Map,vd=new Set;function Qn(t){return typeof t.getRootNode=="function"?t.getRootNode():t.nodeType===9?t:t.ownerDocument}var ee=C.d;C.d={f:sm,r:dm,D:ym,C:mm,L:hm,m:gm,X:bm,S:vm,M:pm};function sm(){var t=ee.f(),l=Cn();return t||l}function dm(t){var l=Pe(t);l!==null&&l.tag===5&&l.type==="form"?Ro(l):ee.r(t)}var Ua=typeof document>"u"?null:document;function bd(t,l,e){var a=Ua;if(a&&typeof l=="string"&&l){var u=Sl(l);u='link[rel="'+t+'"][href="'+u+'"]',typeof e=="string"&&(u+='[crossorigin="'+e+'"]'),vd.has(u)||(vd.add(u),t={rel:t,crossOrigin:e,href:l},a.querySelector(u)===null&&(l=a.createElement("link"),Jt(l,"link",t),Xt(l),a.head.appendChild(l)))}}function ym(t){ee.D(t),bd("dns-prefetch",t,null)}function mm(t,l){ee.C(t,l),bd("preconnect",t,l)}function hm(t,l,e){ee.L(t,l,e);var a=Ua;if(a&&t&&l){var u='link[rel="preload"][as="'+Sl(l)+'"]';l==="image"&&e&&e.imageSrcSet?(u+='[imagesrcset="'+Sl(e.imageSrcSet)+'"]',typeof e.imageSizes=="string"&&(u+='[imagesizes="'+Sl(e.imageSizes)+'"]')):u+='[href="'+Sl(t)+'"]';var n=u;switch(l){case"style":n=Ca(t);break;case"script":n=ja(t)}Ol.has(n)||(t=H({rel:"preload",href:l==="image"&&e&&e.imageSrcSet?void 0:t,as:l},e),Ol.set(n,t),a.querySelector(u)!==null||l==="style"&&a.querySelector(Eu(n))||l==="script"&&a.querySelector(Au(n))||(l=a.createElement("link"),Jt(l,"link",t),Xt(l),a.head.appendChild(l)))}}function gm(t,l){ee.m(t,l);var e=Ua;if(e&&t){var a=l&&typeof l.as=="string"?l.as:"script",u='link[rel="modulepreload"][as="'+Sl(a)+'"][href="'+Sl(t)+'"]',n=u;switch(a){case"audioworklet":case"paintworklet":case"serviceworker":case"sharedworker":case"worker":case"script":n=ja(t)}if(!Ol.has(n)&&(t=H({rel:"modulepreload",href:t},l),Ol.set(n,t),e.querySelector(u)===null)){switch(a){case"audioworklet":case"paintworklet":case"serviceworker":case"sharedworker":case"worker":case"script":if(e.querySelector(Au(n)))return}a=e.createElement("link"),Jt(a,"link",t),Xt(a),e.head.appendChild(a)}}}function vm(t,l,e){ee.S(t,l,e);var a=Ua;if(a&&t){var u=ta(a).hoistableStyles,n=Ca(t);l=l||"default";var i=u.get(n);if(!i){var c={loading:0,preload:null};if(i=a.querySelector(Eu(n)))c.loading=5;else{t=H({rel:"stylesheet",href:t,"data-precedence":l},e),(e=Ol.get(n))&&sf(t,e);var o=i=a.createElement("link");Xt(o),Jt(o,"link",t),o._p=new Promise(function(h,z){o.onload=h,o.onerror=z}),o.addEventListener("load",function(){c.loading|=1}),o.addEventListener("error",function(){c.loading|=2}),c.loading|=4,Zn(i,l,a)}i={type:"stylesheet",instance:i,count:1,state:c},u.set(n,i)}}}function bm(t,l){ee.X(t,l);var e=Ua;if(e&&t){var a=ta(e).hoistableScripts,u=ja(t),n=a.get(u);n||(n=e.querySelector(Au(u)),n||(t=H({src:t,async:!0},l),(l=Ol.get(u))&&df(t,l),n=e.createElement("script"),Xt(n),Jt(n,"link",t),e.head.appendChild(n)),n={type:"script",instance:n,count:1,state:null},a.set(u,n))}}function pm(t,l){ee.M(t,l);var e=Ua;if(e&&t){var a=ta(e).hoistableScripts,u=ja(t),n=a.get(u);n||(n=e.querySelector(Au(u)),n||(t=H({src:t,async:!0,type:"module"},l),(l=Ol.get(u))&&df(t,l),n=e.createElement("script"),Xt(n),Jt(n,"link",t),e.head.appendChild(n)),n={type:"script",instance:n,count:1,state:null},a.set(u,n))}}function pd(t,l,e,a){var u=(u=P.current)?Qn(u):null;if(!u)throw Error(f(446));switch(t){case"meta":case"title":return null;case"style":return typeof e.precedence=="string"&&typeof e.href=="string"?(l=Ca(e.href),e=ta(u).hoistableStyles,a=e.get(l),a||(a={type:"style",instance:null,count:0,state:null},e.set(l,a)),a):{type:"void",instance:null,count:0,state:null};case"link":if(e.rel==="stylesheet"&&typeof e.href=="string"&&typeof e.precedence=="string"){t=Ca(e.href);var n=ta(u).hoistableStyles,i=n.get(t);if(i||(u=u.ownerDocument||u,i={type:"stylesheet",instance:null,count:0,state:{loading:0,preload:null}},n.set(t,i),(n=u.querySelector(Eu(t)))&&!n._p&&(i.instance=n,i.state.loading=5),Ol.has(t)||(e={rel:"preload",as:"style",href:e.href,crossOrigin:e.crossOrigin,integrity:e.integrity,media:e.media,hrefLang:e.hrefLang,referrerPolicy:e.referrerPolicy},Ol.set(t,e),n||Sm(u,t,e,i.state))),l&&a===null)throw Error(f(528,""));return i}if(l&&a!==null)throw Error(f(529,""));return null;case"script":return l=e.async,e=e.src,typeof e=="string"&&l&&typeof l!="function"&&typeof l!="symbol"?(l=ja(e),e=ta(u).hoistableScripts,a=e.get(l),a||(a={type:"script",instance:null,count:0,state:null},e.set(l,a)),a):{type:"void",instance:null,count:0,state:null};default:throw Error(f(444,t))}}function Ca(t){return'href="'+Sl(t)+'"'}function Eu(t){return'link[rel="stylesheet"]['+t+"]"}function Sd(t){return H({},t,{"data-precedence":t.precedence,precedence:null})}function Sm(t,l,e,a){t.querySelector('link[rel="preload"][as="style"]['+l+"]")?a.loading=1:(l=t.createElement("link"),a.preload=l,l.addEventListener("load",function(){return a.loading|=1}),l.addEventListener("error",function(){return a.loading|=2}),Jt(l,"link",e),Xt(l),t.head.appendChild(l))}function ja(t){return'[src="'+Sl(t)+'"]'}function Au(t){return"script[async]"+t}function xd(t,l,e){if(l.count++,l.instance===null)switch(l.type){case"style":var a=t.querySelector('style[data-href~="'+Sl(e.href)+'"]');if(a)return l.instance=a,Xt(a),a;var u=H({},e,{"data-href":e.href,"data-precedence":e.precedence,href:null,precedence:null});return a=(t.ownerDocument||t).createElement("style"),Xt(a),Jt(a,"style",u),Zn(a,e.precedence,t),l.instance=a;case"stylesheet":u=Ca(e.href);var n=t.querySelector(Eu(u));if(n)return l.state.loading|=4,l.instance=n,Xt(n),n;a=Sd(e),(u=Ol.get(u))&&sf(a,u),n=(t.ownerDocument||t).createElement("link"),Xt(n);var i=n;return i._p=new Promise(function(c,o){i.onload=c,i.onerror=o}),Jt(n,"link",a),l.state.loading|=4,Zn(n,e.precedence,t),l.instance=n;case"script":return n=ja(e.src),(u=t.querySelector(Au(n)))?(l.instance=u,Xt(u),u):(a=e,(u=Ol.get(n))&&(a=H({},e),df(a,u)),t=t.ownerDocument||t,u=t.createElement("script"),Xt(u),Jt(u,"link",a),t.head.appendChild(u),l.instance=u);case"void":return null;default:throw Error(f(443,l.type))}else l.type==="stylesheet"&&(l.state.loading&4)===0&&(a=l.instance,l.state.loading|=4,Zn(a,e.precedence,t));return l.instance}function Zn(t,l,e){for(var a=e.querySelectorAll('link[rel="stylesheet"][data-precedence],style[data-precedence]'),u=a.length?a[a.length-1]:null,n=u,i=0;i<a.length;i++){var c=a[i];if(c.dataset.precedence===l)n=c;else if(n!==u)break}n?n.parentNode.insertBefore(t,n.nextSibling):(l=e.nodeType===9?e.head:e,l.insertBefore(t,l.firstChild))}function sf(t,l){t.crossOrigin==null&&(t.crossOrigin=l.crossOrigin),t.referrerPolicy==null&&(t.referrerPolicy=l.referrerPolicy),t.title==null&&(t.title=l.title)}function df(t,l){t.crossOrigin==null&&(t.crossOrigin=l.crossOrigin),t.referrerPolicy==null&&(t.referrerPolicy=l.referrerPolicy),t.integrity==null&&(t.integrity=l.integrity)}var wn=null;function zd(t,l,e){if(wn===null){var a=new Map,u=wn=new Map;u.set(e,a)}else u=wn,a=u.get(e),a||(a=new Map,u.set(e,a));if(a.has(t))return a;for(a.set(t,null),e=e.getElementsByTagName(t),u=0;u<e.length;u++){var n=e[u];if(!(n[Qa]||n[wt]||t==="link"&&n.getAttribute("rel")==="stylesheet")&&n.namespaceURI!=="http://www.w3.org/2000/svg"){var i=n.getAttribute(l)||"";i=t+i;var c=a.get(i);c?c.push(n):a.set(i,[n])}}return a}function Td(t,l,e){t=t.ownerDocument||t,t.head.insertBefore(e,l==="title"?t.querySelector("head > title"):null)}function xm(t,l,e){if(e===1||l.itemProp!=null)return!1;switch(t){case"meta":case"title":return!0;case"style":if(typeof l.precedence!="string"||typeof l.href!="string"||l.href==="")break;return!0;case"link":if(typeof l.rel!="string"||typeof l.href!="string"||l.href===""||l.onLoad||l.onError)break;return l.rel==="stylesheet"?(t=l.disabled,typeof l.precedence=="string"&&t==null):!0;case"script":if(l.async&&typeof l.async!="function"&&typeof l.async!="symbol"&&!l.onLoad&&!l.onError&&l.src&&typeof l.src=="string")return!0}return!1}function Ed(t){return!(t.type==="stylesheet"&&(t.state.loading&3)===0)}function zm(t,l,e,a){if(e.type==="stylesheet"&&(typeof a.media!="string"||matchMedia(a.media).matches!==!1)&&(e.state.loading&4)===0){if(e.instance===null){var u=Ca(a.href),n=l.querySelector(Eu(u));if(n){l=n._p,l!==null&&typeof l=="object"&&typeof l.then=="function"&&(t.count++,t=Ln.bind(t),l.then(t,t)),e.state.loading|=4,e.instance=n,Xt(n);return}n=l.ownerDocument||l,a=Sd(a),(u=Ol.get(u))&&sf(a,u),n=n.createElement("link"),Xt(n);var i=n;i._p=new Promise(function(c,o){i.onload=c,i.onerror=o}),Jt(n,"link",a),e.instance=n}t.stylesheets===null&&(t.stylesheets=new Map),t.stylesheets.set(e,l),(l=e.state.preload)&&(e.state.loading&3)===0&&(t.count++,e=Ln.bind(t),l.addEventListener("load",e),l.addEventListener("error",e))}}var yf=0;function Tm(t,l){return t.stylesheets&&t.count===0&&Kn(t,t.stylesheets),0<t.count||0<t.imgCount?function(e){var a=setTimeout(function(){if(t.stylesheets&&Kn(t,t.stylesheets),t.unsuspend){var n=t.unsuspend;t.unsuspend=null,n()}},6e4+l);0<t.imgBytes&&yf===0&&(yf=62500*am());var u=setTimeout(function(){if(t.waitingForImages=!1,t.count===0&&(t.stylesheets&&Kn(t,t.stylesheets),t.unsuspend)){var n=t.unsuspend;t.unsuspend=null,n()}},(t.imgBytes>yf?50:800)+l);return t.unsuspend=e,function(){t.unsuspend=null,clearTimeout(a),clearTimeout(u)}}:null}function Ln(){if(this.count--,this.count===0&&(this.imgCount===0||!this.waitingForImages)){if(this.stylesheets)Kn(this,this.stylesheets);else if(this.unsuspend){var t=this.unsuspend;this.unsuspend=null,t()}}}var Vn=null;function Kn(t,l){t.stylesheets=null,t.unsuspend!==null&&(t.count++,Vn=new Map,l.forEach(Em,t),Vn=null,Ln.call(t))}function Em(t,l){if(!(l.state.loading&4)){var e=Vn.get(t);if(e)var a=e.get(null);else{e=new Map,Vn.set(t,e);for(var u=t.querySelectorAll("link[data-precedence],style[data-precedence]"),n=0;n<u.length;n++){var i=u[n];(i.nodeName==="LINK"||i.getAttribute("media")!=="not all")&&(e.set(i.dataset.precedence,i),a=i)}a&&e.set(null,a)}u=l.instance,i=u.getAttribute("data-precedence"),n=e.get(i)||a,n===a&&e.set(null,u),e.set(i,u),this.count++,a=Ln.bind(this),u.addEventListener("load",a),u.addEventListener("error",a),n?n.parentNode.insertBefore(u,n.nextSibling):(t=t.nodeType===9?t.head:t,t.insertBefore(u,t.firstChild)),l.state.loading|=4}}var Mu={$$typeof:zt,Provider:null,Consumer:null,_currentValue:Z,_currentValue2:Z,_threadCount:0};function Am(t,l,e,a,u,n,i,c,o){this.tag=1,this.containerInfo=t,this.pingCache=this.current=this.pendingChildren=null,this.timeoutHandle=-1,this.callbackNode=this.next=this.pendingContext=this.context=this.cancelPendingCommit=null,this.callbackPriority=0,this.expirationTimes=ci(-1),this.entangledLanes=this.shellSuspendCounter=this.errorRecoveryDisabledLanes=this.expiredLanes=this.warmLanes=this.pingedLanes=this.suspendedLanes=this.pendingLanes=0,this.entanglements=ci(0),this.hiddenUpdates=ci(null),this.identifierPrefix=a,this.onUncaughtError=u,this.onCaughtError=n,this.onRecoverableError=i,this.pooledCache=null,this.pooledCacheLanes=0,this.formState=o,this.incompleteTransitions=new Map}function Ad(t,l,e,a,u,n,i,c,o,h,z,E){return t=new Am(t,l,e,i,o,h,z,E,c),l=1,n===!0&&(l|=24),n=yl(3,null,null,l),t.current=n,n.stateNode=t,l=Vi(),l.refCount++,t.pooledCache=l,l.refCount++,n.memoizedState={element:a,isDehydrated:e,cache:l},Wi(n),t}function Md(t){return t?(t=oa,t):oa}function _d(t,l,e,a,u,n){u=Md(u),a.context===null?a.context=u:a.pendingContext=u,a=de(l),a.payload={element:e},n=n===void 0?null:n,n!==null&&(a.callback=n),e=ye(t,a,l),e!==null&&(fl(e,t,l),uu(e,t,l))}function Od(t,l){if(t=t.memoizedState,t!==null&&t.dehydrated!==null){var e=t.retryLane;t.retryLane=e!==0&&e<l?e:l}}function mf(t,l){Od(t,l),(t=t.alternate)&&Od(t,l)}function Nd(t){if(t.tag===13||t.tag===31){var l=qe(t,67108864);l!==null&&fl(l,t,67108864),mf(t,67108864)}}function Dd(t){if(t.tag===13||t.tag===31){var l=bl();l=fi(l);var e=qe(t,l);e!==null&&fl(e,t,l),mf(t,l)}}var Jn=!0;function Mm(t,l,e,a){var u=x.T;x.T=null;var n=C.p;try{C.p=2,hf(t,l,e,a)}finally{C.p=n,x.T=u}}function _m(t,l,e,a){var u=x.T;x.T=null;var n=C.p;try{C.p=8,hf(t,l,e,a)}finally{C.p=n,x.T=u}}function hf(t,l,e,a){if(Jn){var u=gf(a);if(u===null)tf(t,l,a,kn,e),Cd(t,a);else if(Nm(u,t,l,e,a))a.stopPropagation();else if(Cd(t,a),l&4&&-1<Om.indexOf(t)){for(;u!==null;){var n=Pe(u);if(n!==null)switch(n.tag){case 3:if(n=n.stateNode,n.current.memoizedState.isDehydrated){var i=Ce(n.pendingLanes);if(i!==0){var c=n;for(c.pendingLanes|=2,c.entangledLanes|=2;i;){var o=1<<31-sl(i);c.entanglements[1]|=o,i&=~o}Yl(n),(ot&6)===0&&(Dn=rl()+500,Su(0))}}break;case 31:case 13:c=qe(n,2),c!==null&&fl(c,n,2),Cn(),mf(n,2)}if(n=gf(a),n===null&&tf(t,l,a,kn,e),n===u)break;u=n}u!==null&&a.stopPropagation()}else tf(t,l,a,null,e)}}function gf(t){return t=vi(t),vf(t)}var kn=null;function vf(t){if(kn=null,t=Ie(t),t!==null){var l=O(t);if(l===null)t=null;else{var e=l.tag;if(e===13){if(t=D(l),t!==null)return t;t=null}else if(e===31){if(t=U(l),t!==null)return t;t=null}else if(e===3){if(l.stateNode.current.memoizedState.isDehydrated)return l.tag===3?l.stateNode.containerInfo:null;t=null}else l!==t&&(t=null)}}return kn=t,null}function Ud(t){switch(t){case"beforetoggle":case"cancel":case"click":case"close":case"contextmenu":case"copy":case"cut":case"auxclick":case"dblclick":case"dragend":case"dragstart":case"drop":case"focusin":case"focusout":case"input":case"invalid":case"keydown":case"keypress":case"keyup":case"mousedown":case"mouseup":case"paste":case"pause":case"play":case"pointercancel":case"pointerdown":case"pointerup":case"ratechange":case"reset":case"resize":case"seeked":case"submit":case"toggle":case"touchcancel":case"touchend":case"touchstart":case"volumechange":case"change":case"selectionchange":case"textInput":case"compositionstart":case"compositionend":case"compositionupdate":case"beforeblur":case"afterblur":case"beforeinput":case"blur":case"fullscreenchange":case"focus":case"hashchange":case"popstate":case"select":case"selectstart":return 2;case"drag":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"mousemove":case"mouseout":case"mouseover":case"pointermove":case"pointerout":case"pointerover":case"scroll":case"touchmove":case"wheel":case"mouseenter":case"mouseleave":case"pointerenter":case"pointerleave":return 8;case"message":switch(y0()){case Yf:return 2;case Gf:return 8;case Bu:case m0:return 32;case Xf:return 268435456;default:return 32}default:return 32}}var bf=!1,Ee=null,Ae=null,Me=null,_u=new Map,Ou=new Map,_e=[],Om="mousedown mouseup touchcancel touchend touchstart auxclick dblclick pointercancel pointerdown pointerup dragend dragstart drop compositionend compositionstart keydown keypress keyup input textInput copy cut paste click change contextmenu reset".split(" ");function Cd(t,l){switch(t){case"focusin":case"focusout":Ee=null;break;case"dragenter":case"dragleave":Ae=null;break;case"mouseover":case"mouseout":Me=null;break;case"pointerover":case"pointerout":_u.delete(l.pointerId);break;case"gotpointercapture":case"lostpointercapture":Ou.delete(l.pointerId)}}function Nu(t,l,e,a,u,n){return t===null||t.nativeEvent!==n?(t={blockedOn:l,domEventName:e,eventSystemFlags:a,nativeEvent:n,targetContainers:[u]},l!==null&&(l=Pe(l),l!==null&&Nd(l)),t):(t.eventSystemFlags|=a,l=t.targetContainers,u!==null&&l.indexOf(u)===-1&&l.push(u),t)}function Nm(t,l,e,a,u){switch(l){case"focusin":return Ee=Nu(Ee,t,l,e,a,u),!0;case"dragenter":return Ae=Nu(Ae,t,l,e,a,u),!0;case"mouseover":return Me=Nu(Me,t,l,e,a,u),!0;case"pointerover":var n=u.pointerId;return _u.set(n,Nu(_u.get(n)||null,t,l,e,a,u)),!0;case"gotpointercapture":return n=u.pointerId,Ou.set(n,Nu(Ou.get(n)||null,t,l,e,a,u)),!0}return!1}function jd(t){var l=Ie(t.target);if(l!==null){var e=O(l);if(e!==null){if(l=e.tag,l===13){if(l=D(e),l!==null){t.blockedOn=l,Kf(t.priority,function(){Dd(e)});return}}else if(l===31){if(l=U(e),l!==null){t.blockedOn=l,Kf(t.priority,function(){Dd(e)});return}}else if(l===3&&e.stateNode.current.memoizedState.isDehydrated){t.blockedOn=e.tag===3?e.stateNode.containerInfo:null;return}}}t.blockedOn=null}function Wn(t){if(t.blockedOn!==null)return!1;for(var l=t.targetContainers;0<l.length;){var e=gf(t.nativeEvent);if(e===null){e=t.nativeEvent;var a=new e.constructor(e.type,e);gi=a,e.target.dispatchEvent(a),gi=null}else return l=Pe(e),l!==null&&Nd(l),t.blockedOn=e,!1;l.shift()}return!0}function Rd(t,l,e){Wn(t)&&e.delete(l)}function Dm(){bf=!1,Ee!==null&&Wn(Ee)&&(Ee=null),Ae!==null&&Wn(Ae)&&(Ae=null),Me!==null&&Wn(Me)&&(Me=null),_u.forEach(Rd),Ou.forEach(Rd)}function $n(t,l){t.blockedOn===l&&(t.blockedOn=null,bf||(bf=!0,r.unstable_scheduleCallback(r.unstable_NormalPriority,Dm)))}var Fn=null;function Hd(t){Fn!==t&&(Fn=t,r.unstable_scheduleCallback(r.unstable_NormalPriority,function(){Fn===t&&(Fn=null);for(var l=0;l<t.length;l+=3){var e=t[l],a=t[l+1],u=t[l+2];if(typeof a!="function"){if(vf(a||e)===null)continue;break}var n=Pe(e);n!==null&&(t.splice(l,3),l-=3,hc(n,{pending:!0,data:u,method:e.method,action:a},a,u))}}))}function Ra(t){function l(o){return $n(o,t)}Ee!==null&&$n(Ee,t),Ae!==null&&$n(Ae,t),Me!==null&&$n(Me,t),_u.forEach(l),Ou.forEach(l);for(var e=0;e<_e.length;e++){var a=_e[e];a.blockedOn===t&&(a.blockedOn=null)}for(;0<_e.length&&(e=_e[0],e.blockedOn===null);)jd(e),e.blockedOn===null&&_e.shift();if(e=(t.ownerDocument||t).$$reactFormReplay,e!=null)for(a=0;a<e.length;a+=3){var u=e[a],n=e[a+1],i=u[el]||null;if(typeof n=="function")i||Hd(e);else if(i){var c=null;if(n&&n.hasAttribute("formAction")){if(u=n,i=n[el]||null)c=i.formAction;else if(vf(u)!==null)continue}else c=i.action;typeof c=="function"?e[a+1]=c:(e.splice(a,3),a-=3),Hd(e)}}}function Bd(){function t(n){n.canIntercept&&n.info==="react-transition"&&n.intercept({handler:function(){return new Promise(function(i){return u=i})},focusReset:"manual",scroll:"manual"})}function l(){u!==null&&(u(),u=null),a||setTimeout(e,20)}function e(){if(!a&&!navigation.transition){var n=navigation.currentEntry;n&&n.url!=null&&navigation.navigate(n.url,{state:n.getState(),info:"react-transition",history:"replace"})}}if(typeof navigation=="object"){var a=!1,u=null;return navigation.addEventListener("navigate",t),navigation.addEventListener("navigatesuccess",l),navigation.addEventListener("navigateerror",l),setTimeout(e,100),function(){a=!0,navigation.removeEventListener("navigate",t),navigation.removeEventListener("navigatesuccess",l),navigation.removeEventListener("navigateerror",l),u!==null&&(u(),u=null)}}}function pf(t){this._internalRoot=t}In.prototype.render=pf.prototype.render=function(t){var l=this._internalRoot;if(l===null)throw Error(f(409));var e=l.current,a=bl();_d(e,a,t,l,null,null)},In.prototype.unmount=pf.prototype.unmount=function(){var t=this._internalRoot;if(t!==null){this._internalRoot=null;var l=t.containerInfo;_d(t.current,2,null,t,null,null),Cn(),l[Fe]=null}};function In(t){this._internalRoot=t}In.prototype.unstable_scheduleHydration=function(t){if(t){var l=Vf();t={blockedOn:null,target:t,priority:l};for(var e=0;e<_e.length&&l!==0&&l<_e[e].priority;e++);_e.splice(e,0,t),e===0&&jd(t)}};var qd=v.version;if(qd!=="19.2.4")throw Error(f(527,qd,"19.2.4"));C.findDOMNode=function(t){var l=t._reactInternals;if(l===void 0)throw typeof t.render=="function"?Error(f(188)):(t=Object.keys(t).join(","),Error(f(268,t)));return t=p(l),t=t!==null?R(t):null,t=t===null?null:t.stateNode,t};var Um={bundleType:0,version:"19.2.4",rendererPackageName:"react-dom",currentDispatcherRef:x,reconcilerVersion:"19.2.4"};if(typeof __REACT_DEVTOOLS_GLOBAL_HOOK__<"u"){var Pn=__REACT_DEVTOOLS_GLOBAL_HOOK__;if(!Pn.isDisabled&&Pn.supportsFiber)try{Ya=Pn.inject(Um),ol=Pn}catch{}}return Uu.createRoot=function(t,l){if(!_(t))throw Error(f(299));var e=!1,a="",u=Lo,n=Vo,i=Ko;return l!=null&&(l.unstable_strictMode===!0&&(e=!0),l.identifierPrefix!==void 0&&(a=l.identifierPrefix),l.onUncaughtError!==void 0&&(u=l.onUncaughtError),l.onCaughtError!==void 0&&(n=l.onCaughtError),l.onRecoverableError!==void 0&&(i=l.onRecoverableError)),l=Ad(t,1,!1,null,null,e,a,null,u,n,i,Bd),t[Fe]=l.current,Pc(t),new pf(l)},Uu.hydrateRoot=function(t,l,e){if(!_(t))throw Error(f(299));var a=!1,u="",n=Lo,i=Vo,c=Ko,o=null;return e!=null&&(e.unstable_strictMode===!0&&(a=!0),e.identifierPrefix!==void 0&&(u=e.identifierPrefix),e.onUncaughtError!==void 0&&(n=e.onUncaughtError),e.onCaughtError!==void 0&&(i=e.onCaughtError),e.onRecoverableError!==void 0&&(c=e.onRecoverableError),e.formState!==void 0&&(o=e.formState)),l=Ad(t,1,!0,l,e??null,a,u,o,n,i,c,Bd),l.context=Md(null),e=l.current,a=bl(),a=fi(a),u=de(a),u.callback=null,ye(e,u,a),e=a,l.current.lanes=e,Xa(l,e),Yl(l),t[Fe]=l.current,Pc(t),new In(l)},Uu.version="19.2.4",Uu}var Jd;function Qm(){if(Jd)return zf.exports;Jd=1;function r(){if(!(typeof __REACT_DEVTOOLS_GLOBAL_HOOK__>"u"||typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE!="function"))try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(r)}catch(v){console.error(v)}}return r(),zf.exports=Xm(),zf.exports}var Zm=Qm();const wm=r=>r.replace(/([a-z0-9])([A-Z])/g,"$1-$2").toLowerCase(),Pd=(...r)=>r.filter((v,S,f)=>!!v&&v.trim()!==""&&f.indexOf(v)===S).join(" ").trim();var Lm={xmlns:"http://www.w3.org/2000/svg",width:24,height:24,viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:2,strokeLinecap:"round",strokeLinejoin:"round"};const Vm=xt.forwardRef(({color:r="currentColor",size:v=24,strokeWidth:S=2,absoluteStrokeWidth:f,className:_="",children:O,iconNode:D,...U},N)=>xt.createElement("svg",{ref:N,...Lm,width:v,height:v,stroke:r,strokeWidth:f?Number(S)*24/Number(v):S,className:Pd("lucide",_),...U},[...D.map(([p,R])=>xt.createElement(p,R)),...Array.isArray(O)?O:[O]]));const Nl=(r,v)=>{const S=xt.forwardRef(({className:f,..._},O)=>xt.createElement(Vm,{ref:O,iconNode:v,className:Pd(`lucide-${wm(r)}`,f),..._}));return S.displayName=`${r}`,S};const Km=Nl("Binary",[["rect",{x:"14",y:"14",width:"4",height:"6",rx:"2",key:"p02svl"}],["rect",{x:"6",y:"4",width:"4",height:"6",rx:"2",key:"xm4xkj"}],["path",{d:"M6 20h4",key:"1i6q5t"}],["path",{d:"M14 10h4",key:"ru81e7"}],["path",{d:"M6 14h2v6",key:"16z9wg"}],["path",{d:"M14 4h2v6",key:"1idq9u"}]]);const Jm=Nl("BookText",[["path",{d:"M4 19.5v-15A2.5 2.5 0 0 1 6.5 2H19a1 1 0 0 1 1 1v18a1 1 0 0 1-1 1H6.5a1 1 0 0 1 0-5H20",key:"k3hazp"}],["path",{d:"M8 11h8",key:"vwpz6n"}],["path",{d:"M8 7h6",key:"1f0q6e"}]]);const km=Nl("EyeOff",[["path",{d:"M10.733 5.076a10.744 10.744 0 0 1 11.205 6.575 1 1 0 0 1 0 .696 10.747 10.747 0 0 1-1.444 2.49",key:"ct8e1f"}],["path",{d:"M14.084 14.158a3 3 0 0 1-4.242-4.242",key:"151rxh"}],["path",{d:"M17.479 17.499a10.75 10.75 0 0 1-15.417-5.151 1 1 0 0 1 0-.696 10.75 10.75 0 0 1 4.446-5.143",key:"13bj9a"}],["path",{d:"m2 2 20 20",key:"1ooewy"}]]);const Wm=Nl("Eye",[["path",{d:"M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0",key:"1nclc0"}],["circle",{cx:"12",cy:"12",r:"3",key:"1v7zrd"}]]);const $m=Nl("Globe",[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20",key:"13o1zl"}],["path",{d:"M2 12h20",key:"9i4pu4"}]]);const kd=Nl("LoaderCircle",[["path",{d:"M21 12a9 9 0 1 1-6.219-8.56",key:"13zald"}]]);const Fm=Nl("Lock",[["rect",{width:"18",height:"11",x:"3",y:"11",rx:"2",ry:"2",key:"1w4ew1"}],["path",{d:"M7 11V7a5 5 0 0 1 10 0v4",key:"fwvmzm"}]]);const Im=Nl("LogIn",[["path",{d:"M15 3h4a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2h-4",key:"u53s6r"}],["polyline",{points:"10 17 15 12 10 7",key:"1ail0h"}],["line",{x1:"15",x2:"3",y1:"12",y2:"12",key:"v6grx8"}]]);const Pm=Nl("RotateCw",[["path",{d:"M21 12a9 9 0 1 1-9-9c2.52 0 4.93 1 6.74 2.74L21 8",key:"1p45f6"}],["path",{d:"M21 3v5h-5",key:"1q7to0"}]]);const th=Nl("User",[["path",{d:"M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2",key:"975kel"}],["circle",{cx:"12",cy:"7",r:"4",key:"17ys0d"}]]);const lh=Nl("Waypoints",[["circle",{cx:"12",cy:"4.5",r:"2.5",key:"r5ysbb"}],["path",{d:"m10.2 6.3-3.9 3.9",key:"1nzqf6"}],["circle",{cx:"4.5",cy:"12",r:"2.5",key:"jydg6v"}],["path",{d:"M7 12h10",key:"b7w52i"}],["circle",{cx:"19.5",cy:"12",r:"2.5",key:"1piiel"}],["path",{d:"m13.8 17.7 3.9-3.9",key:"1wyg1y"}],["circle",{cx:"12",cy:"19.5",r:"2.5",key:"13o1pw"}]]);const eh=Nl("X",[["path",{d:"M18 6 6 18",key:"1bl5f8"}],["path",{d:"m6 6 12 12",key:"d8bk6v"}]]);function t0(){return globalThis.__DATA__??{}}function l0(r){var v,S,f="";if(typeof r=="string"||typeof r=="number")f+=r;else if(typeof r=="object")if(Array.isArray(r)){var _=r.length;for(v=0;v<_;v++)r[v]&&(S=l0(r[v]))&&(f&&(f+=" "),f+=S)}else for(S in r)r[S]&&(f&&(f+=" "),f+=S);return f}function ah(){for(var r,v,S=0,f="",_=arguments.length;S<_;S++)(r=arguments[S])&&(v=l0(r))&&(f&&(f+=" "),f+=v);return f}const Hf="-",uh=r=>{const v=ih(r),{conflictingClassGroups:S,conflictingClassGroupModifiers:f}=r;return{getClassGroupId:D=>{const U=D.split(Hf);return U[0]===""&&U.length!==1&&U.shift(),e0(U,v)||nh(D)},getConflictingClassGroupIds:(D,U)=>{const N=S[D]||[];return U&&f[D]?[...N,...f[D]]:N}}},e0=(r,v)=>{if(r.length===0)return v.classGroupId;const S=r[0],f=v.nextPart.get(S),_=f?e0(r.slice(1),f):void 0;if(_)return _;if(v.validators.length===0)return;const O=r.join(Hf);return v.validators.find(({validator:D})=>D(O))?.classGroupId},Wd=/^\[(.+)\]$/,nh=r=>{if(Wd.test(r)){const v=Wd.exec(r)[1],S=v?.substring(0,v.indexOf(":"));if(S)return"arbitrary.."+S}},ih=r=>{const{theme:v,prefix:S}=r,f={nextPart:new Map,validators:[]};return fh(Object.entries(r.classGroups),S).forEach(([O,D])=>{Df(D,f,O,v)}),f},Df=(r,v,S,f)=>{r.forEach(_=>{if(typeof _=="string"){const O=_===""?v:$d(v,_);O.classGroupId=S;return}if(typeof _=="function"){if(ch(_)){Df(_(f),v,S,f);return}v.validators.push({validator:_,classGroupId:S});return}Object.entries(_).forEach(([O,D])=>{Df(D,$d(v,O),S,f)})})},$d=(r,v)=>{let S=r;return v.split(Hf).forEach(f=>{S.nextPart.has(f)||S.nextPart.set(f,{nextPart:new Map,validators:[]}),S=S.nextPart.get(f)}),S},ch=r=>r.isThemeGetter,fh=(r,v)=>v?r.map(([S,f])=>{const _=f.map(O=>typeof O=="string"?v+O:typeof O=="object"?Object.fromEntries(Object.entries(O).map(([D,U])=>[v+D,U])):O);return[S,_]}):r,rh=r=>{if(r<1)return{get:()=>{},set:()=>{}};let v=0,S=new Map,f=new Map;const _=(O,D)=>{S.set(O,D),v++,v>r&&(v=0,f=S,S=new Map)};return{get(O){let D=S.get(O);if(D!==void 0)return D;if((D=f.get(O))!==void 0)return _(O,D),D},set(O,D){S.has(O)?S.set(O,D):_(O,D)}}},a0="!",oh=r=>{const{separator:v,experimentalParseClassName:S}=r,f=v.length===1,_=v[0],O=v.length,D=U=>{const N=[];let p=0,R=0,H;for(let Q=0;Q<U.length;Q++){let L=U[Q];if(p===0){if(L===_&&(f||U.slice(Q,Q+O)===v)){N.push(U.slice(R,Q)),R=Q+O;continue}if(L==="/"){H=Q;continue}}L==="["?p++:L==="]"&&p--}const V=N.length===0?U:U.substring(R),st=V.startsWith(a0),ct=st?V.substring(1):V,G=H&&H>R?H-R:void 0;return{modifiers:N,hasImportantModifier:st,baseClassName:ct,maybePostfixModifierPosition:G}};return S?U=>S({className:U,parseClassName:D}):D},sh=r=>{if(r.length<=1)return r;const v=[];let S=[];return r.forEach(f=>{f[0]==="["?(v.push(...S.sort(),f),S=[]):S.push(f)}),v.push(...S.sort()),v},dh=r=>({cache:rh(r.cacheSize),parseClassName:oh(r),...uh(r)}),yh=/\s+/,mh=(r,v)=>{const{parseClassName:S,getClassGroupId:f,getConflictingClassGroupIds:_}=v,O=[],D=r.trim().split(yh);let U="";for(let N=D.length-1;N>=0;N-=1){const p=D[N],{modifiers:R,hasImportantModifier:H,baseClassName:V,maybePostfixModifierPosition:st}=S(p);let ct=!!st,G=f(ct?V.substring(0,st):V);if(!G){if(!ct){U=p+(U.length>0?" "+U:U);continue}if(G=f(V),!G){U=p+(U.length>0?" "+U:U);continue}ct=!1}const Q=sh(R).join(":"),L=H?Q+a0:Q,gt=L+G;if(O.includes(gt))continue;O.push(gt);const zt=_(G,ct);for(let _t=0;_t<zt.length;++_t){const it=zt[_t];O.push(L+it)}U=p+(U.length>0?" "+U:U)}return U};function hh(){let r=0,v,S,f="";for(;r<arguments.length;)(v=arguments[r++])&&(S=u0(v))&&(f&&(f+=" "),f+=S);return f}const u0=r=>{if(typeof r=="string")return r;let v,S="";for(let f=0;f<r.length;f++)r[f]&&(v=u0(r[f]))&&(S&&(S+=" "),S+=v);return S};function gh(r,...v){let S,f,_,O=D;function D(N){const p=v.reduce((R,H)=>H(R),r());return S=dh(p),f=S.cache.get,_=S.cache.set,O=U,U(N)}function U(N){const p=f(N);if(p)return p;const R=mh(N,S);return _(N,R),R}return function(){return O(hh.apply(null,arguments))}}const At=r=>{const v=S=>S[r]||[];return v.isThemeGetter=!0,v},n0=/^\[(?:([a-z-]+):)?(.+)\]$/i,vh=/^\d+\/\d+$/,bh=new Set(["px","full","screen"]),ph=/^(\d+(\.\d+)?)?(xs|sm|md|lg|xl)$/,Sh=/\d+(%|px|r?em|[sdl]?v([hwib]|min|max)|pt|pc|in|cm|mm|cap|ch|ex|r?lh|cq(w|h|i|b|min|max))|\b(calc|min|max|clamp)\(.+\)|^0$/,xh=/^(rgba?|hsla?|hwb|(ok)?(lab|lch)|color-mix)\(.+\)$/,zh=/^(inset_)?-?((\d+)?\.?(\d+)[a-z]+|0)_-?((\d+)?\.?(\d+)[a-z]+|0)/,Th=/^(url|image|image-set|cross-fade|element|(repeating-)?(linear|radial|conic)-gradient)\(.+\)$/,ae=r=>Ha(r)||bh.has(r)||vh.test(r),Ne=r=>Ba(r,"length",Uh),Ha=r=>!!r&&!Number.isNaN(Number(r)),Mf=r=>Ba(r,"number",Ha),Cu=r=>!!r&&Number.isInteger(Number(r)),Eh=r=>r.endsWith("%")&&Ha(r.slice(0,-1)),F=r=>n0.test(r),De=r=>ph.test(r),Ah=new Set(["length","size","percentage"]),Mh=r=>Ba(r,Ah,i0),_h=r=>Ba(r,"position",i0),Oh=new Set(["image","url"]),Nh=r=>Ba(r,Oh,jh),Dh=r=>Ba(r,"",Ch),ju=()=>!0,Ba=(r,v,S)=>{const f=n0.exec(r);return f?f[1]?typeof v=="string"?f[1]===v:v.has(f[1]):S(f[2]):!1},Uh=r=>Sh.test(r)&&!xh.test(r),i0=()=>!1,Ch=r=>zh.test(r),jh=r=>Th.test(r),Rh=()=>{const r=At("colors"),v=At("spacing"),S=At("blur"),f=At("brightness"),_=At("borderColor"),O=At("borderRadius"),D=At("borderSpacing"),U=At("borderWidth"),N=At("contrast"),p=At("grayscale"),R=At("hueRotate"),H=At("invert"),V=At("gap"),st=At("gradientColorStops"),ct=At("gradientColorStopPositions"),G=At("inset"),Q=At("margin"),L=At("opacity"),gt=At("padding"),zt=At("saturate"),_t=At("scale"),it=At("sepia"),Ot=At("skew"),J=At("space"),Rt=At("translate"),It=()=>["auto","contain","none"],jl=()=>["auto","hidden","clip","visible","scroll"],Pt=()=>["auto",F,v],I=()=>[F,v],Rl=()=>["",ae,Ne],tl=()=>["auto",Ha,F],ll=()=>["bottom","center","left","left-bottom","left-top","right","right-bottom","right-top","top"],x=()=>["solid","dashed","dotted","double","none"],C=()=>["normal","multiply","screen","overlay","darken","lighten","color-dodge","color-burn","hard-light","soft-light","difference","exclusion","hue","saturation","color","luminosity"],Z=()=>["start","end","center","between","around","evenly","stretch"],nt=()=>["","0",F],dt=()=>["auto","avoid","all","avoid-page","page","left","right","column"],s=()=>[Ha,F];return{cacheSize:500,separator:":",theme:{colors:[ju],spacing:[ae,Ne],blur:["none","",De,F],brightness:s(),borderColor:[r],borderRadius:["none","","full",De,F],borderSpacing:I(),borderWidth:Rl(),contrast:s(),grayscale:nt(),hueRotate:s(),invert:nt(),gap:I(),gradientColorStops:[r],gradientColorStopPositions:[Eh,Ne],inset:Pt(),margin:Pt(),opacity:s(),padding:I(),saturate:s(),scale:s(),sepia:nt(),skew:s(),space:I(),translate:I()},classGroups:{aspect:[{aspect:["auto","square","video",F]}],container:["container"],columns:[{columns:[De]}],"break-after":[{"break-after":dt()}],"break-before":[{"break-before":dt()}],"break-inside":[{"break-inside":["auto","avoid","avoid-page","avoid-column"]}],"box-decoration":[{"box-decoration":["slice","clone"]}],box:[{box:["border","content"]}],display:["block","inline-block","inline","flex","inline-flex","table","inline-table","table-caption","table-cell","table-column","table-column-group","table-footer-group","table-header-group","table-row-group","table-row","flow-root","grid","inline-grid","contents","list-item","hidden"],float:[{float:["right","left","none","start","end"]}],clear:[{clear:["left","right","both","none","start","end"]}],isolation:["isolate","isolation-auto"],"object-fit":[{object:["contain","cover","fill","none","scale-down"]}],"object-position":[{object:[...ll(),F]}],overflow:[{overflow:jl()}],"overflow-x":[{"overflow-x":jl()}],"overflow-y":[{"overflow-y":jl()}],overscroll:[{overscroll:It()}],"overscroll-x":[{"overscroll-x":It()}],"overscroll-y":[{"overscroll-y":It()}],position:["static","fixed","absolute","relative","sticky"],inset:[{inset:[G]}],"inset-x":[{"inset-x":[G]}],"inset-y":[{"inset-y":[G]}],start:[{start:[G]}],end:[{end:[G]}],top:[{top:[G]}],right:[{right:[G]}],bottom:[{bottom:[G]}],left:[{left:[G]}],visibility:["visible","invisible","collapse"],z:[{z:["auto",Cu,F]}],basis:[{basis:Pt()}],"flex-direction":[{flex:["row","row-reverse","col","col-reverse"]}],"flex-wrap":[{flex:["wrap","wrap-reverse","nowrap"]}],flex:[{flex:["1","auto","initial","none",F]}],grow:[{grow:nt()}],shrink:[{shrink:nt()}],order:[{order:["first","last","none",Cu,F]}],"grid-cols":[{"grid-cols":[ju]}],"col-start-end":[{col:["auto",{span:["full",Cu,F]},F]}],"col-start":[{"col-start":tl()}],"col-end":[{"col-end":tl()}],"grid-rows":[{"grid-rows":[ju]}],"row-start-end":[{row:["auto",{span:[Cu,F]},F]}],"row-start":[{"row-start":tl()}],"row-end":[{"row-end":tl()}],"grid-flow":[{"grid-flow":["row","col","dense","row-dense","col-dense"]}],"auto-cols":[{"auto-cols":["auto","min","max","fr",F]}],"auto-rows":[{"auto-rows":["auto","min","max","fr",F]}],gap:[{gap:[V]}],"gap-x":[{"gap-x":[V]}],"gap-y":[{"gap-y":[V]}],"justify-content":[{justify:["normal",...Z()]}],"justify-items":[{"justify-items":["start","end","center","stretch"]}],"justify-self":[{"justify-self":["auto","start","end","center","stretch"]}],"align-content":[{content:["normal",...Z(),"baseline"]}],"align-items":[{items:["start","end","center","baseline","stretch"]}],"align-self":[{self:["auto","start","end","center","stretch","baseline"]}],"place-content":[{"place-content":[...Z(),"baseline"]}],"place-items":[{"place-items":["start","end","center","baseline","stretch"]}],"place-self":[{"place-self":["auto","start","end","center","stretch"]}],p:[{p:[gt]}],px:[{px:[gt]}],py:[{py:[gt]}],ps:[{ps:[gt]}],pe:[{pe:[gt]}],pt:[{pt:[gt]}],pr:[{pr:[gt]}],pb:[{pb:[gt]}],pl:[{pl:[gt]}],m:[{m:[Q]}],mx:[{mx:[Q]}],my:[{my:[Q]}],ms:[{ms:[Q]}],me:[{me:[Q]}],mt:[{mt:[Q]}],mr:[{mr:[Q]}],mb:[{mb:[Q]}],ml:[{ml:[Q]}],"space-x":[{"space-x":[J]}],"space-x-reverse":["space-x-reverse"],"space-y":[{"space-y":[J]}],"space-y-reverse":["space-y-reverse"],w:[{w:["auto","min","max","fit","svw","lvw","dvw",F,v]}],"min-w":[{"min-w":[F,v,"min","max","fit"]}],"max-w":[{"max-w":[F,v,"none","full","min","max","fit","prose",{screen:[De]},De]}],h:[{h:[F,v,"auto","min","max","fit","svh","lvh","dvh"]}],"min-h":[{"min-h":[F,v,"min","max","fit","svh","lvh","dvh"]}],"max-h":[{"max-h":[F,v,"min","max","fit","svh","lvh","dvh"]}],size:[{size:[F,v,"auto","min","max","fit"]}],"font-size":[{text:["base",De,Ne]}],"font-smoothing":["antialiased","subpixel-antialiased"],"font-style":["italic","not-italic"],"font-weight":[{font:["thin","extralight","light","normal","medium","semibold","bold","extrabold","black",Mf]}],"font-family":[{font:[ju]}],"fvn-normal":["normal-nums"],"fvn-ordinal":["ordinal"],"fvn-slashed-zero":["slashed-zero"],"fvn-figure":["lining-nums","oldstyle-nums"],"fvn-spacing":["proportional-nums","tabular-nums"],"fvn-fraction":["diagonal-fractions","stacked-fractions"],tracking:[{tracking:["tighter","tight","normal","wide","wider","widest",F]}],"line-clamp":[{"line-clamp":["none",Ha,Mf]}],leading:[{leading:["none","tight","snug","normal","relaxed","loose",ae,F]}],"list-image":[{"list-image":["none",F]}],"list-style-type":[{list:["none","disc","decimal",F]}],"list-style-position":[{list:["inside","outside"]}],"placeholder-color":[{placeholder:[r]}],"placeholder-opacity":[{"placeholder-opacity":[L]}],"text-alignment":[{text:["left","center","right","justify","start","end"]}],"text-color":[{text:[r]}],"text-opacity":[{"text-opacity":[L]}],"text-decoration":["underline","overline","line-through","no-underline"],"text-decoration-style":[{decoration:[...x(),"wavy"]}],"text-decoration-thickness":[{decoration:["auto","from-font",ae,Ne]}],"underline-offset":[{"underline-offset":["auto",ae,F]}],"text-decoration-color":[{decoration:[r]}],"text-transform":["uppercase","lowercase","capitalize","normal-case"],"text-overflow":["truncate","text-ellipsis","text-clip"],"text-wrap":[{text:["wrap","nowrap","balance","pretty"]}],indent:[{indent:I()}],"vertical-align":[{align:["baseline","top","middle","bottom","text-top","text-bottom","sub","super",F]}],whitespace:[{whitespace:["normal","nowrap","pre","pre-line","pre-wrap","break-spaces"]}],break:[{break:["normal","words","all","keep"]}],hyphens:[{hyphens:["none","manual","auto"]}],content:[{content:["none",F]}],"bg-attachment":[{bg:["fixed","local","scroll"]}],"bg-clip":[{"bg-clip":["border","padding","content","text"]}],"bg-opacity":[{"bg-opacity":[L]}],"bg-origin":[{"bg-origin":["border","padding","content"]}],"bg-position":[{bg:[...ll(),_h]}],"bg-repeat":[{bg:["no-repeat",{repeat:["","x","y","round","space"]}]}],"bg-size":[{bg:["auto","cover","contain",Mh]}],"bg-image":[{bg:["none",{"gradient-to":["t","tr","r","br","b","bl","l","tl"]},Nh]}],"bg-color":[{bg:[r]}],"gradient-from-pos":[{from:[ct]}],"gradient-via-pos":[{via:[ct]}],"gradient-to-pos":[{to:[ct]}],"gradient-from":[{from:[st]}],"gradient-via":[{via:[st]}],"gradient-to":[{to:[st]}],rounded:[{rounded:[O]}],"rounded-s":[{"rounded-s":[O]}],"rounded-e":[{"rounded-e":[O]}],"rounded-t":[{"rounded-t":[O]}],"rounded-r":[{"rounded-r":[O]}],"rounded-b":[{"rounded-b":[O]}],"rounded-l":[{"rounded-l":[O]}],"rounded-ss":[{"rounded-ss":[O]}],"rounded-se":[{"rounded-se":[O]}],"rounded-ee":[{"rounded-ee":[O]}],"rounded-es":[{"rounded-es":[O]}],"rounded-tl":[{"rounded-tl":[O]}],"rounded-tr":[{"rounded-tr":[O]}],"rounded-br":[{"rounded-br":[O]}],"rounded-bl":[{"rounded-bl":[O]}],"border-w":[{border:[U]}],"border-w-x":[{"border-x":[U]}],"border-w-y":[{"border-y":[U]}],"border-w-s":[{"border-s":[U]}],"border-w-e":[{"border-e":[U]}],"border-w-t":[{"border-t":[U]}],"border-w-r":[{"border-r":[U]}],"border-w-b":[{"border-b":[U]}],"border-w-l":[{"border-l":[U]}],"border-opacity":[{"border-opacity":[L]}],"border-style":[{border:[...x(),"hidden"]}],"divide-x":[{"divide-x":[U]}],"divide-x-reverse":["divide-x-reverse"],"divide-y":[{"divide-y":[U]}],"divide-y-reverse":["divide-y-reverse"],"divide-opacity":[{"divide-opacity":[L]}],"divide-style":[{divide:x()}],"border-color":[{border:[_]}],"border-color-x":[{"border-x":[_]}],"border-color-y":[{"border-y":[_]}],"border-color-s":[{"border-s":[_]}],"border-color-e":[{"border-e":[_]}],"border-color-t":[{"border-t":[_]}],"border-color-r":[{"border-r":[_]}],"border-color-b":[{"border-b":[_]}],"border-color-l":[{"border-l":[_]}],"divide-color":[{divide:[_]}],"outline-style":[{outline:["",...x()]}],"outline-offset":[{"outline-offset":[ae,F]}],"outline-w":[{outline:[ae,Ne]}],"outline-color":[{outline:[r]}],"ring-w":[{ring:Rl()}],"ring-w-inset":["ring-inset"],"ring-color":[{ring:[r]}],"ring-opacity":[{"ring-opacity":[L]}],"ring-offset-w":[{"ring-offset":[ae,Ne]}],"ring-offset-color":[{"ring-offset":[r]}],shadow:[{shadow:["","inner","none",De,Dh]}],"shadow-color":[{shadow:[ju]}],opacity:[{opacity:[L]}],"mix-blend":[{"mix-blend":[...C(),"plus-lighter","plus-darker"]}],"bg-blend":[{"bg-blend":C()}],filter:[{filter:["","none"]}],blur:[{blur:[S]}],brightness:[{brightness:[f]}],contrast:[{contrast:[N]}],"drop-shadow":[{"drop-shadow":["","none",De,F]}],grayscale:[{grayscale:[p]}],"hue-rotate":[{"hue-rotate":[R]}],invert:[{invert:[H]}],saturate:[{saturate:[zt]}],sepia:[{sepia:[it]}],"backdrop-filter":[{"backdrop-filter":["","none"]}],"backdrop-blur":[{"backdrop-blur":[S]}],"backdrop-brightness":[{"backdrop-brightness":[f]}],"backdrop-contrast":[{"backdrop-contrast":[N]}],"backdrop-grayscale":[{"backdrop-grayscale":[p]}],"backdrop-hue-rotate":[{"backdrop-hue-rotate":[R]}],"backdrop-invert":[{"backdrop-invert":[H]}],"backdrop-opacity":[{"backdrop-opacity":[L]}],"backdrop-saturate":[{"backdrop-saturate":[zt]}],"backdrop-sepia":[{"backdrop-sepia":[it]}],"border-collapse":[{border:["collapse","separate"]}],"border-spacing":[{"border-spacing":[D]}],"border-spacing-x":[{"border-spacing-x":[D]}],"border-spacing-y":[{"border-spacing-y":[D]}],"table-layout":[{table:["auto","fixed"]}],caption:[{caption:["top","bottom"]}],transition:[{transition:["none","all","","colors","opacity","shadow","transform",F]}],duration:[{duration:s()}],ease:[{ease:["linear","in","out","in-out",F]}],delay:[{delay:s()}],animate:[{animate:["none","spin","ping","pulse","bounce",F]}],transform:[{transform:["","gpu","none"]}],scale:[{scale:[_t]}],"scale-x":[{"scale-x":[_t]}],"scale-y":[{"scale-y":[_t]}],rotate:[{rotate:[Cu,F]}],"translate-x":[{"translate-x":[Rt]}],"translate-y":[{"translate-y":[Rt]}],"skew-x":[{"skew-x":[Ot]}],"skew-y":[{"skew-y":[Ot]}],"transform-origin":[{origin:["center","top","top-right","right","bottom-right","bottom","bottom-left","left","top-left",F]}],accent:[{accent:["auto",r]}],appearance:[{appearance:["none","auto"]}],cursor:[{cursor:["auto","default","pointer","wait","text","move","help","not-allowed","none","context-menu","progress","cell","crosshair","vertical-text","alias","copy","no-drop","grab","grabbing","all-scroll","col-resize","row-resize","n-resize","e-resize","s-resize","w-resize","ne-resize","nw-resize","se-resize","sw-resize","ew-resize","ns-resize","nesw-resize","nwse-resize","zoom-in","zoom-out",F]}],"caret-color":[{caret:[r]}],"pointer-events":[{"pointer-events":["none","auto"]}],resize:[{resize:["none","y","x",""]}],"scroll-behavior":[{scroll:["auto","smooth"]}],"scroll-m":[{"scroll-m":I()}],"scroll-mx":[{"scroll-mx":I()}],"scroll-my":[{"scroll-my":I()}],"scroll-ms":[{"scroll-ms":I()}],"scroll-me":[{"scroll-me":I()}],"scroll-mt":[{"scroll-mt":I()}],"scroll-mr":[{"scroll-mr":I()}],"scroll-mb":[{"scroll-mb":I()}],"scroll-ml":[{"scroll-ml":I()}],"scroll-p":[{"scroll-p":I()}],"scroll-px":[{"scroll-px":I()}],"scroll-py":[{"scroll-py":I()}],"scroll-ps":[{"scroll-ps":I()}],"scroll-pe":[{"scroll-pe":I()}],"scroll-pt":[{"scroll-pt":I()}],"scroll-pr":[{"scroll-pr":I()}],"scroll-pb":[{"scroll-pb":I()}],"scroll-pl":[{"scroll-pl":I()}],"snap-align":[{snap:["start","end","center","align-none"]}],"snap-stop":[{snap:["normal","always"]}],"snap-type":[{snap:["none","x","y","both"]}],"snap-strictness":[{snap:["mandatory","proximity"]}],touch:[{touch:["auto","none","manipulation"]}],"touch-x":[{"touch-pan":["x","left","right"]}],"touch-y":[{"touch-pan":["y","up","down"]}],"touch-pz":["touch-pinch-zoom"],select:[{select:["none","text","all","auto"]}],"will-change":[{"will-change":["auto","scroll","contents","transform",F]}],fill:[{fill:[r,"none"]}],"stroke-w":[{stroke:[ae,Ne,Mf]}],stroke:[{stroke:[r,"none"]}],sr:["sr-only","not-sr-only"],"forced-color-adjust":[{"forced-color-adjust":["auto","none"]}]},conflictingClassGroups:{overflow:["overflow-x","overflow-y"],overscroll:["overscroll-x","overscroll-y"],inset:["inset-x","inset-y","start","end","top","right","bottom","left"],"inset-x":["right","left"],"inset-y":["top","bottom"],flex:["basis","grow","shrink"],gap:["gap-x","gap-y"],p:["px","py","ps","pe","pt","pr","pb","pl"],px:["pr","pl"],py:["pt","pb"],m:["mx","my","ms","me","mt","mr","mb","ml"],mx:["mr","ml"],my:["mt","mb"],size:["w","h"],"font-size":["leading"],"fvn-normal":["fvn-ordinal","fvn-slashed-zero","fvn-figure","fvn-spacing","fvn-fraction"],"fvn-ordinal":["fvn-normal"],"fvn-slashed-zero":["fvn-normal"],"fvn-figure":["fvn-normal"],"fvn-spacing":["fvn-normal"],"fvn-fraction":["fvn-normal"],"line-clamp":["display","overflow"],rounded:["rounded-s","rounded-e","rounded-t","rounded-r","rounded-b","rounded-l","rounded-ss","rounded-se","rounded-ee","rounded-es","rounded-tl","rounded-tr","rounded-br","rounded-bl"],"rounded-s":["rounded-ss","rounded-es"],"rounded-e":["rounded-se","rounded-ee"],"rounded-t":["rounded-tl","rounded-tr"],"rounded-r":["rounded-tr","rounded-br"],"rounded-b":["rounded-br","rounded-bl"],"rounded-l":["rounded-tl","rounded-bl"],"border-spacing":["border-spacing-x","border-spacing-y"],"border-w":["border-w-s","border-w-e","border-w-t","border-w-r","border-w-b","border-w-l"],"border-w-x":["border-w-r","border-w-l"],"border-w-y":["border-w-t","border-w-b"],"border-color":["border-color-s","border-color-e","border-color-t","border-color-r","border-color-b","border-color-l"],"border-color-x":["border-color-r","border-color-l"],"border-color-y":["border-color-t","border-color-b"],"scroll-m":["scroll-mx","scroll-my","scroll-ms","scroll-me","scroll-mt","scroll-mr","scroll-mb","scroll-ml"],"scroll-mx":["scroll-mr","scroll-ml"],"scroll-my":["scroll-mt","scroll-mb"],"scroll-p":["scroll-px","scroll-py","scroll-ps","scroll-pe","scroll-pt","scroll-pr","scroll-pb","scroll-pl"],"scroll-px":["scroll-pr","scroll-pl"],"scroll-py":["scroll-pt","scroll-pb"],touch:["touch-x","touch-y","touch-pz"],"touch-x":["touch"],"touch-y":["touch"],"touch-pz":["touch"]},conflictingClassGroupModifiers:{"font-size":["leading"]}}},Hh=gh(Rh);function Zt(...r){return Hh(ah(r))}const Bh=["relative cursor-pointer","text-sm focus:z-10 focus:ring-2 font-medium focus:outline-none whitespace-nowrap shadow-sm","inline-flex gap-2 items-center justify-center transition-colors focus:ring-offset-1","disabled:opacity-40 disabled:cursor-not-allowed disabled:text-nb-gray-300 ring-offset-neutral-950/50"],qh={default:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900","dark:focus:ring-zinc-800/50 dark:bg-nb-gray dark:text-gray-400 dark:border-gray-700/30 dark:hover:text-white dark:hover:bg-zinc-800/50"],primary:["dark:focus:ring-netbird-600/50 dark:ring-offset-neutral-950/50 enabled:dark:bg-netbird disabled:dark:bg-nb-gray-910 dark:text-gray-100 enabled:dark:hover:text-white enabled:dark:hover:bg-netbird-500/80","enabled:bg-netbird enabled:text-white enabled:focus:ring-netbird-400/50 enabled:hover:bg-netbird-500"],secondary:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900","dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20","dark:bg-nb-gray-920 dark:text-gray-400 dark:border-gray-700/40 dark:hover:text-white dark:hover:bg-nb-gray-910"],secondaryLighter:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900","dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20","dark:bg-nb-gray-900/70 dark:text-gray-400 dark:border-gray-700/70 dark:hover:text-white dark:hover:bg-nb-gray-800/60"],input:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-neutral-200 text-gray-900","dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20","dark:bg-nb-gray-900 dark:text-gray-400 dark:border-nb-gray-700 dark:hover:bg-nb-gray-900/80"],dropdown:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-neutral-200 text-gray-900","dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20","dark:bg-nb-gray-900/40 dark:text-gray-400 dark:border-nb-gray-900 dark:hover:bg-nb-gray-900/50"],dotted:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900 border-dashed","dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20","dark:bg-nb-gray-900/30 dark:text-gray-400 dark:border-gray-500/40 dark:hover:text-white dark:hover:bg-zinc-800/50"],tertiary:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900","dark:focus:ring-zinc-800/50 dark:bg-white dark:text-gray-800 dark:border-gray-700/40 dark:hover:bg-neutral-200 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300"],white:["focus:ring-white/50 bg-white text-gray-800 border-white outline-none hover:bg-neutral-200 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300","disabled:dark:bg-nb-gray-900 disabled:dark:text-nb-gray-300 disabled:dark:border-nb-gray-900"],outline:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900","dark:focus:ring-zinc-800/50 dark:bg-transparent dark:text-netbird dark:border-netbird dark:hover:bg-nb-gray-900/30"],"danger-outline":["enabled:dark:focus:ring-red-800/20 enabled:dark:focus:bg-red-950/40 enabled:hover:dark:bg-red-950/50 enabled:dark:hover:border-red-800/50 dark:bg-transparent dark:text-red-500"],"danger-text":["dark:bg-transparent dark:text-red-500 dark:hover:text-red-600 dark:border-transparent !px-0 !shadow-none !py-0 focus:ring-red-500/30 dark:ring-offset-neutral-950/50"],"default-outline":["dark:ring-offset-nb-gray-950/50 dark:focus:ring-nb-gray-500/20","dark:bg-transparent dark:text-nb-gray-400 dark:border-transparent dark:hover:text-white dark:hover:bg-nb-gray-900/30 dark:hover:border-nb-gray-800/50","data-[state=open]:dark:text-white data-[state=open]:dark:bg-nb-gray-900/30 data-[state=open]:dark:border-nb-gray-800/50"],danger:["dark:focus:ring-red-700/20 dark:focus:bg-red-700 hover:dark:bg-red-700 dark:hover:border-red-800/50 dark:bg-red-600 dark:text-red-100"]},Yh={xs:"text-xs py-2 px-4",xs2:"text-[0.78rem] py-2 px-4",sm:"text-sm py-2.5 px-4",md:"text-sm py-2.5 px-4",lg:"text-base py-2.5 px-4"},Gh={0:"border",1:"border border-transparent",2:"border border-t-0 border-b-0"},Ru=xt.forwardRef(({variant:r="default",rounded:v=!0,border:S=1,size:f="md",stopPropagation:_=!0,className:O,onClick:D,children:U,...N},p)=>A.jsx("button",{type:"button",...N,ref:p,className:Zt(Bh,qh[r],Yh[f],Gh[S?1:0],v&&"rounded-md",O),onClick:R=>{_&&R.stopPropagation(),D?.(R)},children:U}));Ru.displayName="Button";const Xh={default:["bg-nb-gray-900 placeholder:text-neutral-400/70 border-nb-gray-700","ring-offset-neutral-950/50 focus-visible:ring-neutral-500/20"],darker:["bg-nb-gray-920 placeholder:text-neutral-400/70 border-nb-gray-800","ring-offset-neutral-950/50 focus-visible:ring-neutral-500/20"],error:["bg-nb-gray-900 placeholder:text-neutral-400/70 border-red-500 text-red-500","ring-offset-red-500/10 focus-visible:ring-red-500/10"]},Qh={default:"bg-nb-gray-900 border-nb-gray-700 text-nb-gray-300",error:"bg-nb-gray-900 border-red-500 text-nb-gray-300 text-red-500"},c0=xt.forwardRef(({className:r,type:v,customSuffix:S,customPrefix:f,icon:_,maxWidthClass:O="",error:D,variant:U="default",prefixClassName:N,showPasswordToggle:p=!1,...R},H)=>{const[V,st]=xt.useState(!1),ct=v==="password",G=ct&&V?"text":v,L=(ct&&p?A.jsx("button",{type:"button",onClick:()=>st(!V),className:"hover:text-white transition-all","aria-label":"Toggle password visibility",children:V?A.jsx(km,{size:18}):A.jsx(Wm,{size:18})}):null)||S,gt=D?"error":U;return A.jsxs(A.Fragment,{children:[A.jsxs("div",{className:Zt("flex relative h-[42px]",O),children:[f&&A.jsx("div",{className:Zt(Qh[D?"error":"default"],"flex h-[42px] w-auto rounded-l-md px-3 py-2 text-sm","border items-center whitespace-nowrap",R.disabled&&"opacity-40",N),children:f}),A.jsx("div",{className:Zt("absolute left-0 top-0 h-full flex items-center text-xs text-nb-gray-300 pl-3 leading-[0]",R.disabled&&"opacity-40"),children:_}),A.jsx("input",{type:G,ref:H,...R,className:Zt(Xh[gt],"flex h-[42px] w-full rounded-md px-3 py-2 text-sm","file:bg-transparent file:text-sm file:font-medium file:border-0","focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2","disabled:cursor-not-allowed disabled:opacity-40","border",f&&"!border-l-0 !rounded-l-none",L&&"!pr-16",_&&"!pl-10",r)}),A.jsx("div",{className:Zt("absolute right-0 top-0 h-full flex items-center text-xs text-nb-gray-300 pr-4 leading-[0] select-none",R.disabled&&"opacity-30"),children:L})]}),D&&A.jsx("p",{className:"text-xs text-red-500 mt-2",children:D})]})});c0.displayName="Input";const Zh=xt.forwardRef(function({value:v,onChange:S,length:f=6,disabled:_=!1,className:O,autoFocus:D=!1},U){const N=xt.useRef([]);xt.useImperativeHandle(U,()=>({focus:()=>{N.current[0]?.focus()}}));const p=v.split("").concat(new Array(f).fill("")).slice(0,f),R=Array.from({length:f},(G,Q)=>`pin-${Q}`),H=(G,Q)=>{if(!/^\d*$/.test(Q))return;const L=[...p];L[G]=Q.slice(-1);const gt=L.join("").replaceAll(/\s/g,"");S(gt),Q&&G<f-1&&N.current[G+1]?.focus()},V=(G,Q)=>{Q.key==="Backspace"&&!p[G]&&G>0&&N.current[G-1]?.focus(),Q.key==="ArrowLeft"&&G>0&&N.current[G-1]?.focus(),Q.key==="ArrowRight"&&G<f-1&&N.current[G+1]?.focus()},st=G=>{G.preventDefault();const Q=G.clipboardData.getData("text").replaceAll(/\D/g,"").slice(0,f);S(Q);const L=Math.min(Q.length,f-1);N.current[L]?.focus()},ct=G=>{G.target.select()};return A.jsx("div",{className:Zt("flex gap-2 w-full min-w-0",O),children:p.map((G,Q)=>A.jsx("input",{id:R[Q],ref:L=>{N.current[Q]=L},type:"text",inputMode:"numeric",maxLength:1,value:G,onChange:L=>H(Q,L.target.value),onKeyDown:L=>V(Q,L),onPaste:st,onFocus:ct,disabled:_,autoFocus:D&&Q===0,className:Zt("flex-1 min-w-0 h-[42px] text-center text-sm rounded-md","dark:bg-nb-gray-900 border dark:border-nb-gray-700","dark:placeholder:text-neutral-400/70","focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2","ring-offset-neutral-200/20 dark:ring-offset-neutral-950/50 dark:focus-visible:ring-neutral-500/20","disabled:cursor-not-allowed disabled:opacity-40")},R[Q]))})}),f0=xt.createContext({value:"",onChange:()=>{}}),r0=()=>xt.useContext(f0);function $e({value:r,defaultValue:v,onChange:S,children:f}){const[_,O]=xt.useState(v??""),D=r??_,U=xt.useCallback(p=>{r===void 0&&O(p),S?.(p)},[r,S]),N=xt.useMemo(()=>({value:D,onChange:U}),[D,U]);return A.jsx(f0.Provider,{value:N,children:A.jsx("div",{children:typeof f=="function"?f({value:D,onChange:U}):f})})}function wh({children:r,className:v}){return A.jsx("div",{role:"tablist",className:Zt("bg-nb-gray-930/70 p-1.5 flex justify-center gap-1 border-nb-gray-900",v),children:r})}function Lh({children:r,value:v,disabled:S=!1,className:f,selected:_,onClick:O}){const D=r0(),U=_??v===D.value;let N="";U?N="bg-nb-gray-900 text-white":S||(N="text-nb-gray-400 hover:bg-nb-gray-900/50");const p=()=>{D.onChange(v),O?.()};return A.jsx("button",{role:"tab",type:"button",disabled:S,"aria-selected":U,onClick:p,className:Zt("px-4 py-2 text-sm rounded-md w-full transition-all cursor-pointer",S&&"opacity-30 cursor-not-allowed",N,f),children:A.jsx("div",{className:"flex items-center w-full justify-center gap-2",children:r})})}function Vh({children:r,value:v,className:S,visible:f}){const _=r0();return f??v===_.value?A.jsx("div",{role:"tabpanel",className:Zt("bg-nb-gray-930/70 px-4 pt-4 pb-5 rounded-b-md border border-t-0 border-nb-gray-900",S),children:r}):null}$e.List=wh;$e.Trigger=Lh;$e.Content=Vh;const Kh="/__netbird__/assets/netbird-full.svg",Jh="data:image/svg+xml,%3csvg%20width='31'%20height='23'%20viewBox='0%200%2031%2023'%20fill='none'%20xmlns='http://www.w3.org/2000/svg'%3e%3cpath%20d='M21.4631%200.523438C17.8173%200.857913%2016.0028%202.95675%2015.3171%204.01871L4.66406%2022.4734H17.5163L30.1929%200.523438H21.4631Z'%20fill='%23F68330'/%3e%3cpath%20d='M17.5265%2022.4737L0%203.88525C0%203.88525%2019.8177%20-1.44128%2021.7493%2015.1738L17.5265%2022.4737Z'%20fill='%23F68330'/%3e%3cpath%20d='M14.9236%204.70563L9.54688%2014.0208L17.5158%2022.4747L21.7385%2015.158C21.0696%209.44682%2018.2851%206.32784%2014.9236%204.69727'%20fill='%23F05252'/%3e%3c/svg%3e",ti={small:{desktop:14,mobile:20},default:{desktop:22,mobile:30},large:{desktop:24,mobile:40}},kh=({size:r="default",mobile:v=!0})=>A.jsxs(A.Fragment,{children:[A.jsx("img",{src:Kh,height:ti[r].desktop,style:{height:ti[r].desktop},alt:"NetBird Logo",className:Zt(v&&"hidden md:block","group-hover:opacity-80 transition-all")}),v&&A.jsx("img",{src:Jh,width:ti[r].mobile,style:{width:ti[r].mobile},alt:"NetBird Logo",className:Zt(v&&"md:hidden ml-4")})]});function Uf(){return A.jsxs("a",{href:"https://netbird.io?utm_source=netbird-proxy&utm_medium=web&utm_campaign=powered_by",target:"_blank",rel:"noopener noreferrer",className:"flex items-center justify-center mt-8 gap-2 group cursor-pointer",children:[A.jsx("span",{className:"text-sm text-nb-gray-400 font-light text-center group-hover:opacity-80 transition-all",children:"Powered by"}),A.jsx(kh,{size:"small",mobile:!1})]})}const Wh=({className:r})=>A.jsx("div",{className:Zt("h-full w-full absolute left-0 top-0 rounded-md overflow-hidden z-0 pointer-events-none",r),children:A.jsx("div",{className:"bg-linear-to-b from-nb-gray-900/10 via-transparent to-transparent w-full h-full rounded-md"})}),Fd=({children:r,className:v})=>A.jsxs("div",{className:Zt("px-6 sm:px-10 py-10 pt-8","bg-nb-gray-940 border border-nb-gray-910 rounded-lg relative",v),children:[A.jsx(Wh,{}),r]});function Cf({children:r,className:v}){return A.jsx("h1",{className:Zt("text-xl! text-center z-10 relative",v),children:r})}function jf({children:r,className:v}){return A.jsx("div",{className:Zt("text-sm text-nb-gray-300 font-light mt-2 block text-center z-10 relative",v),children:r})}const $h=()=>A.jsxs("div",{className:"flex items-center justify-center relative my-4",children:[A.jsx("span",{className:"bg-nb-gray-940 relative z-10 px-4 text-xs text-nb-gray-400 font-medium",children:"OR"}),A.jsx("span",{className:"h-px bg-nb-gray-900 w-full absolute z-0"})]}),Fh=({error:r})=>A.jsx("div",{className:"text-red-400 bg-red-800/20 border border-red-800/50 rounded-lg px-4 py-3 whitespace-break-spaces text-sm",children:r});function Id({className:r,htmlFor:v,...S}){return A.jsx("label",{htmlFor:v,className:Zt("text-sm font-medium tracking-wider leading-none","peer-disabled:cursor-not-allowed peer-disabled:opacity-70","mb-2.5 inline-block text-nb-gray-200","flex items-center gap-2 select-none",r),...S})}const _f=t0(),Ft=_f.methods&&Object.keys(_f.methods).length>0?_f.methods:{password:"password",pin:"pin",oidc:"/auth/oidc"};function Ih(){xt.useEffect(()=>{document.title="Authentication Required - NetBird Service"},[]);const[r,v]=xt.useState(null),[S,f]=xt.useState(null),[_,O]=xt.useState(""),[D,U]=xt.useState(""),N=xt.useRef(null),p=xt.useRef(null),[R,H]=xt.useState(Ft.password?"password":"pin"),V=(it,Ot)=>{v(Ot),f(null),it==="password"?(U(""),setTimeout(()=>N.current?.focus(),200)):(O(""),setTimeout(()=>p.current?.focus(),200))},st=(it,Ot)=>{v(null),f(it);const J=new FormData;it==="password"?J.append(Ft.password,Ot):J.append(Ft.pin,Ot),fetch(globalThis.location.href,{method:"POST",body:J,redirect:"manual"}).then(Rt=>{Rt.type==="opaqueredirect"||Rt.status===0?(f("redirect"),globalThis.location.reload()):V(it,"Authentication failed. Please try again.")}).catch(()=>{V(it,"An error occurred. Please try again.")})},ct=it=>{O(it),it.length===6&&st("pin",it)},G=_.length===6,Q=D.length>0,L=S!==null||R==="password"&&!Q||R==="pin"&&!G,gt=Ft.password||Ft.pin,zt=Ft.password&&Ft.pin,_t=R==="password"?"Sign in":"Submit";return S==="redirect"?A.jsxs("main",{className:"mt-20",children:[A.jsxs(Fd,{className:"max-w-105 mx-auto",children:[A.jsx(Cf,{children:"Authenticated"}),A.jsx(jf,{children:"Loading service..."}),A.jsx("div",{className:"flex justify-center mt-7",children:A.jsx(kd,{className:"animate-spin",size:24})})]}),A.jsx(Uf,{})]}):A.jsxs("main",{className:"mt-20",children:[A.jsxs(Fd,{className:"max-w-105 mx-auto",children:[A.jsx(Cf,{children:"Authentication Required"}),A.jsx(jf,{children:"The service you are trying to access is protected. Please authenticate to continue."}),A.jsxs("div",{className:"flex flex-col gap-4 mt-7 z-10 relative",children:[r&&A.jsx(Fh,{error:r}),Ft.oidc&&A.jsxs(Ru,{variant:"primary",className:"w-full",onClick:()=>{globalThis.location.href=Ft.oidc},children:[A.jsx(Im,{size:16}),"Sign in with SSO"]}),Ft.oidc&&gt&&A.jsx($h,{}),gt&&A.jsxs("form",{onSubmit:it=>{it.preventDefault(),st(R,R==="password"?D:_)},children:[zt&&A.jsx($e,{value:R,onChange:it=>{H(it),setTimeout(()=>{it==="password"?N.current?.focus():p.current?.focus()},0)},children:A.jsxs($e.List,{className:"rounded-lg border mb-4",children:[A.jsxs($e.Trigger,{value:"password",children:[A.jsx(Fm,{size:14}),"Password"]}),A.jsxs($e.Trigger,{value:"pin",children:[A.jsx(Km,{size:14}),"PIN"]})]})}),A.jsxs("div",{className:"mb-4",children:[Ft.password&&(R==="password"||!Ft.pin)&&A.jsxs(A.Fragment,{children:[!zt&&A.jsx(Id,{htmlFor:"password",children:"Password"}),A.jsx(c0,{ref:N,type:"password",id:"password",placeholder:"Enter password",disabled:S!==null,showPasswordToggle:!0,autoFocus:!0,value:D,onChange:it=>U(it.target.value)})]}),Ft.pin&&(R==="pin"||!Ft.password)&&A.jsxs(A.Fragment,{children:[!zt&&A.jsx(Id,{htmlFor:"pin-0",children:"Enter PIN Code"}),A.jsx(Zh,{ref:p,value:_,onChange:ct,disabled:S!==null,autoFocus:!Ft.password})]})]}),A.jsx(Ru,{type:"submit",disabled:L,variant:"secondary",className:"w-full",children:S===null?_t:A.jsxs(A.Fragment,{children:[A.jsx(kd,{className:"animate-spin",size:16}),"Verifying..."]})})]})]})]}),A.jsx(Uf,{})]})}function Ph({success:r=!0}){return r?A.jsx("div",{className:"flex-1 flex items-center justify-center h-12 w-full px-5",children:A.jsx("div",{className:"w-full border-t-2 border-dashed border-green-500"})}):A.jsxs("div",{className:"flex-1 flex items-center justify-center h-12 min-w-10 px-5 relative",children:[A.jsx("div",{className:"w-full border-t-2 border-dashed border-nb-gray-900"}),A.jsx("div",{className:"absolute inset-0 flex items-center justify-center",children:A.jsx("div",{className:"w-8 h-8 rounded-full flex items-center justify-center",children:A.jsx(eh,{size:18,className:"text-netbird"})})})]})}function Of({icon:r,label:v,detail:S,success:f=!0,line:_=!0}){return A.jsxs(A.Fragment,{children:[_&&A.jsx(Ph,{success:f}),A.jsxs("div",{className:"flex flex-col items-center gap-2",children:[A.jsx("div",{className:"w-14 h-14 rounded-md flex items-center justify-center from-nb-gray-940 to-nb-gray-930/70 bg-gradient-to-br border border-nb-gray-910",children:A.jsx(r,{size:20,className:"text-nb-gray-200"})}),A.jsx("span",{className:"text-sm text-nb-gray-200 font-normal mt-1",children:v}),A.jsx("span",{className:`text-xs font-medium uppercase ${f?"text-green-500":"text-netbird"}`,children:f?"Connected":"Unreachable"}),S&&A.jsx("span",{className:"text-xs text-nb-gray-400 truncate text-center",children:S})]})]})}function tg({code:r,title:v,message:S,proxy:f=!0,destination:_=!0,requestId:O,simple:D=!1,retryUrl:U}){xt.useEffect(()=>{document.title=`${v} - NetBird Service`},[v]);const[N]=xt.useState(()=>new Date().toISOString());return A.jsxs("main",{className:"flex flex-col items-center mt-24 px-4 max-w-3xl mx-auto",children:[A.jsxs("div",{className:"text-sm text-netbird font-normal font-mono mb-3 z-10 relative",children:["Error ",r]}),A.jsx(Cf,{className:"text-3xl!",children:v}),A.jsx(jf,{className:"mt-2 mb-8 max-w-md",children:S}),!D&&A.jsxs("div",{className:"hidden sm:flex items-start justify-center w-full mt-6 mb-16 z-10 relative",children:[A.jsx(Of,{icon:th,label:"You",line:!1}),A.jsx(Of,{icon:lh,label:"Proxy",success:f}),A.jsx(Of,{icon:$m,label:"Destination",success:_})]}),A.jsxs("div",{className:"flex gap-3 justify-center items-center mb-6 z-10 relative",children:[A.jsxs(Ru,{variant:"primary",onClick:()=>{U?globalThis.location.href=U:globalThis.location.reload()},children:[A.jsx(Pm,{size:16}),"Refresh Page"]}),A.jsxs(Ru,{variant:"secondary",onClick:()=>globalThis.open("https://docs.netbird.io","_blank","noopener,noreferrer"),children:[A.jsx(Jm,{size:16}),"Documentation"]})]}),A.jsxs("div",{className:"text-center text-xs text-nb-gray-300 uppercase z-10 relative font-mono flex flex-col sm:flex-row gap-2 sm:gap-10 mt-4 mb-3",children:[A.jsxs("div",{children:[A.jsx("span",{className:"text-nb-gray-400",children:"REQUEST-ID:"})," ",O]}),A.jsxs("div",{children:[A.jsx("span",{className:"text-nb-gray-400",children:"TIMESTAMP:"})," ",N]})]}),A.jsx(Uf,{})]})}const Nf=t0();Zm.createRoot(document.getElementById("root")).render(A.jsx(xt.StrictMode,{children:Nf.page==="error"&&Nf.error?A.jsx(tg,{...Nf.error}):A.jsx(Ih,{})}));
+`+a.stack}}var ui=Object.prototype.hasOwnProperty,ni=r.unstable_scheduleCallback,ii=r.unstable_cancelCallback,o0=r.unstable_shouldYield,d0=r.unstable_requestPaint,rl=r.unstable_now,y0=r.unstable_getCurrentPriorityLevel,Yf=r.unstable_ImmediatePriority,Gf=r.unstable_UserBlockingPriority,Bu=r.unstable_NormalPriority,m0=r.unstable_LowPriority,Xf=r.unstable_IdlePriority,h0=r.log,g0=r.unstable_setDisableYieldValue,Ya=null,sl=null;function ue(t){if(typeof h0=="function"&&g0(t),sl&&typeof sl.setStrictMode=="function")try{sl.setStrictMode(Ya,t)}catch{}}var ol=Math.clz32?Math.clz32:p0,v0=Math.log,b0=Math.LN2;function p0(t){return t>>>=0,t===0?32:31-(v0(t)/b0|0)|0}var qu=256,Yu=262144,Gu=4194304;function Ce(t){var l=t&42;if(l!==0)return l;switch(t&-t){case 1:return 1;case 2:return 2;case 4:return 4;case 8:return 8;case 16:return 16;case 32:return 32;case 64:return 64;case 128:return 128;case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:return t&261888;case 262144:case 524288:case 1048576:case 2097152:return t&3932160;case 4194304:case 8388608:case 16777216:case 33554432:return t&62914560;case 67108864:return 67108864;case 134217728:return 134217728;case 268435456:return 268435456;case 536870912:return 536870912;case 1073741824:return 0;default:return t}}function Xu(t,l,e){var a=t.pendingLanes;if(a===0)return 0;var u=0,n=t.suspendedLanes,i=t.pingedLanes;t=t.warmLanes;var c=a&134217727;return c!==0?(a=c&~n,a!==0?u=Ce(a):(i&=c,i!==0?u=Ce(i):e||(e=c&~t,e!==0&&(u=Ce(e))))):(c=a&~n,c!==0?u=Ce(c):i!==0?u=Ce(i):e||(e=a&~t,e!==0&&(u=Ce(e)))),u===0?0:l!==0&&l!==u&&(l&n)===0&&(n=u&-u,e=l&-l,n>=e||n===32&&(e&4194048)!==0)?l:u}function Ga(t,l){return(t.pendingLanes&~(t.suspendedLanes&~t.pingedLanes)&l)===0}function S0(t,l){switch(t){case 1:case 2:case 4:case 8:case 64:return l+250;case 16:case 32:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return l+5e3;case 4194304:case 8388608:case 16777216:case 33554432:return-1;case 67108864:case 134217728:case 268435456:case 536870912:case 1073741824:return-1;default:return-1}}function Qf(){var t=Gu;return Gu<<=1,(Gu&62914560)===0&&(Gu=4194304),t}function ci(t){for(var l=[],e=0;31>e;e++)l.push(t);return l}function Xa(t,l){t.pendingLanes|=l,l!==268435456&&(t.suspendedLanes=0,t.pingedLanes=0,t.warmLanes=0)}function x0(t,l,e,a,u,n){var i=t.pendingLanes;t.pendingLanes=e,t.suspendedLanes=0,t.pingedLanes=0,t.warmLanes=0,t.expiredLanes&=e,t.entangledLanes&=e,t.errorRecoveryDisabledLanes&=e,t.shellSuspendCounter=0;var c=t.entanglements,s=t.expirationTimes,h=t.hiddenUpdates;for(e=i&~e;0<e;){var z=31-ol(e),A=1<<z;c[z]=0,s[z]=-1;var g=h[z];if(g!==null)for(h[z]=null,z=0;z<g.length;z++){var b=g[z];b!==null&&(b.lane&=-536870913)}e&=~A}a!==0&&Zf(t,a,0),n!==0&&u===0&&t.tag!==0&&(t.suspendedLanes|=n&~(i&~l))}function Zf(t,l,e){t.pendingLanes|=l,t.suspendedLanes&=~l;var a=31-ol(l);t.entangledLanes|=l,t.entanglements[a]=t.entanglements[a]|1073741824|e&261930}function wf(t,l){var e=t.entangledLanes|=l;for(t=t.entanglements;e;){var a=31-ol(e),u=1<<a;u&l|t[a]&l&&(t[a]|=l),e&=~u}}function Lf(t,l){var e=l&-l;return e=(e&42)!==0?1:fi(e),(e&(t.suspendedLanes|l))!==0?0:e}function fi(t){switch(t){case 2:t=1;break;case 8:t=4;break;case 32:t=16;break;case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:case 4194304:case 8388608:case 16777216:case 33554432:t=128;break;case 268435456:t=134217728;break;default:t=0}return t}function ri(t){return t&=-t,2<t?8<t?(t&134217727)!==0?32:268435456:8:2}function Vf(){var t=C.p;return t!==0?t:(t=window.event,t===void 0?32:Ud(t.type))}function Kf(t,l){var e=C.p;try{return C.p=t,l()}finally{C.p=e}}var ne=Math.random().toString(36).slice(2),Lt="__reactFiber$"+ne,el="__reactProps$"+ne,Fe="__reactContainer$"+ne,si="__reactEvents$"+ne,z0="__reactListeners$"+ne,T0="__reactHandles$"+ne,Jf="__reactResources$"+ne,Qa="__reactMarker$"+ne;function oi(t){delete t[Lt],delete t[el],delete t[si],delete t[z0],delete t[T0]}function Ie(t){var l=t[Lt];if(l)return l;for(var e=t.parentNode;e;){if(l=e[Fe]||e[Lt]){if(e=l.alternate,l.child!==null||e!==null&&e.child!==null)for(t=hd(t);t!==null;){if(e=t[Lt])return e;t=hd(t)}return l}t=e,e=t.parentNode}return null}function Pe(t){if(t=t[Lt]||t[Fe]){var l=t.tag;if(l===5||l===6||l===13||l===31||l===26||l===27||l===3)return t}return null}function Za(t){var l=t.tag;if(l===5||l===26||l===27||l===6)return t.stateNode;throw Error(f(33))}function ta(t){var l=t[Jf];return l||(l=t[Jf]={hoistableStyles:new Map,hoistableScripts:new Map}),l}function Qt(t){t[Qa]=!0}var kf=new Set,Wf={};function je(t,l){la(t,l),la(t+"Capture",l)}function la(t,l){for(Wf[t]=l,t=0;t<l.length;t++)kf.add(l[t])}var A0=RegExp("^[:A-Z_a-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD][:A-Z_a-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD\\-.0-9\\u00B7\\u0300-\\u036F\\u203F-\\u2040]*$"),$f={},Ff={};function E0(t){return ui.call(Ff,t)?!0:ui.call($f,t)?!1:A0.test(t)?Ff[t]=!0:($f[t]=!0,!1)}function Qu(t,l,e){if(E0(l))if(e===null)t.removeAttribute(l);else{switch(typeof e){case"undefined":case"function":case"symbol":t.removeAttribute(l);return;case"boolean":var a=l.toLowerCase().slice(0,5);if(a!=="data-"&&a!=="aria-"){t.removeAttribute(l);return}}t.setAttribute(l,""+e)}}function Zu(t,l,e){if(e===null)t.removeAttribute(l);else{switch(typeof e){case"undefined":case"function":case"symbol":case"boolean":t.removeAttribute(l);return}t.setAttribute(l,""+e)}}function Gl(t,l,e,a){if(a===null)t.removeAttribute(e);else{switch(typeof a){case"undefined":case"function":case"symbol":case"boolean":t.removeAttribute(e);return}t.setAttributeNS(l,e,""+a)}}function Sl(t){switch(typeof t){case"bigint":case"boolean":case"number":case"string":case"undefined":return t;case"object":return t;default:return""}}function If(t){var l=t.type;return(t=t.nodeName)&&t.toLowerCase()==="input"&&(l==="checkbox"||l==="radio")}function M0(t,l,e){var a=Object.getOwnPropertyDescriptor(t.constructor.prototype,l);if(!t.hasOwnProperty(l)&&typeof a<"u"&&typeof a.get=="function"&&typeof a.set=="function"){var u=a.get,n=a.set;return Object.defineProperty(t,l,{configurable:!0,get:function(){return u.call(this)},set:function(i){e=""+i,n.call(this,i)}}),Object.defineProperty(t,l,{enumerable:a.enumerable}),{getValue:function(){return e},setValue:function(i){e=""+i},stopTracking:function(){t._valueTracker=null,delete t[l]}}}}function di(t){if(!t._valueTracker){var l=If(t)?"checked":"value";t._valueTracker=M0(t,l,""+t[l])}}function Pf(t){if(!t)return!1;var l=t._valueTracker;if(!l)return!0;var e=l.getValue(),a="";return t&&(a=If(t)?t.checked?"true":"false":t.value),t=a,t!==e?(l.setValue(t),!0):!1}function wu(t){if(t=t||(typeof document<"u"?document:void 0),typeof t>"u")return null;try{return t.activeElement||t.body}catch{return t.body}}var _0=/[\n"\\]/g;function xl(t){return t.replace(_0,function(l){return"\\"+l.charCodeAt(0).toString(16)+" "})}function yi(t,l,e,a,u,n,i,c){t.name="",i!=null&&typeof i!="function"&&typeof i!="symbol"&&typeof i!="boolean"?t.type=i:t.removeAttribute("type"),l!=null?i==="number"?(l===0&&t.value===""||t.value!=l)&&(t.value=""+Sl(l)):t.value!==""+Sl(l)&&(t.value=""+Sl(l)):i!=="submit"&&i!=="reset"||t.removeAttribute("value"),l!=null?mi(t,i,Sl(l)):e!=null?mi(t,i,Sl(e)):a!=null&&t.removeAttribute("value"),u==null&&n!=null&&(t.defaultChecked=!!n),u!=null&&(t.checked=u&&typeof u!="function"&&typeof u!="symbol"),c!=null&&typeof c!="function"&&typeof c!="symbol"&&typeof c!="boolean"?t.name=""+Sl(c):t.removeAttribute("name")}function tr(t,l,e,a,u,n,i,c){if(n!=null&&typeof n!="function"&&typeof n!="symbol"&&typeof n!="boolean"&&(t.type=n),l!=null||e!=null){if(!(n!=="submit"&&n!=="reset"||l!=null)){di(t);return}e=e!=null?""+Sl(e):"",l=l!=null?""+Sl(l):e,c||l===t.value||(t.value=l),t.defaultValue=l}a=a??u,a=typeof a!="function"&&typeof a!="symbol"&&!!a,t.checked=c?t.checked:!!a,t.defaultChecked=!!a,i!=null&&typeof i!="function"&&typeof i!="symbol"&&typeof i!="boolean"&&(t.name=i),di(t)}function mi(t,l,e){l==="number"&&wu(t.ownerDocument)===t||t.defaultValue===""+e||(t.defaultValue=""+e)}function ea(t,l,e,a){if(t=t.options,l){l={};for(var u=0;u<e.length;u++)l["$"+e[u]]=!0;for(e=0;e<t.length;e++)u=l.hasOwnProperty("$"+t[e].value),t[e].selected!==u&&(t[e].selected=u),u&&a&&(t[e].defaultSelected=!0)}else{for(e=""+Sl(e),l=null,u=0;u<t.length;u++){if(t[u].value===e){t[u].selected=!0,a&&(t[u].defaultSelected=!0);return}l!==null||t[u].disabled||(l=t[u])}l!==null&&(l.selected=!0)}}function lr(t,l,e){if(l!=null&&(l=""+Sl(l),l!==t.value&&(t.value=l),e==null)){t.defaultValue!==l&&(t.defaultValue=l);return}t.defaultValue=e!=null?""+Sl(e):""}function er(t,l,e,a){if(l==null){if(a!=null){if(e!=null)throw Error(f(92));if(ll(a)){if(1<a.length)throw Error(f(93));a=a[0]}e=a}e==null&&(e=""),l=e}e=Sl(l),t.defaultValue=e,a=t.textContent,a===e&&a!==""&&a!==null&&(t.value=a),di(t)}function aa(t,l){if(l){var e=t.firstChild;if(e&&e===t.lastChild&&e.nodeType===3){e.nodeValue=l;return}}t.textContent=l}var O0=new Set("animationIterationCount aspectRatio borderImageOutset borderImageSlice borderImageWidth boxFlex boxFlexGroup boxOrdinalGroup columnCount columns flex flexGrow flexPositive flexShrink flexNegative flexOrder gridArea gridRow gridRowEnd gridRowSpan gridRowStart gridColumn gridColumnEnd gridColumnSpan gridColumnStart fontWeight lineClamp lineHeight opacity order orphans scale tabSize widows zIndex zoom fillOpacity floodOpacity stopOpacity strokeDasharray strokeDashoffset strokeMiterlimit strokeOpacity strokeWidth MozAnimationIterationCount MozBoxFlex MozBoxFlexGroup MozLineClamp msAnimationIterationCount msFlex msZoom msFlexGrow msFlexNegative msFlexOrder msFlexPositive msFlexShrink msGridColumn msGridColumnSpan msGridRow msGridRowSpan WebkitAnimationIterationCount WebkitBoxFlex WebKitBoxFlexGroup WebkitBoxOrdinalGroup WebkitColumnCount WebkitColumns WebkitFlex WebkitFlexGrow WebkitFlexPositive WebkitFlexShrink WebkitLineClamp".split(" "));function ar(t,l,e){var a=l.indexOf("--")===0;e==null||typeof e=="boolean"||e===""?a?t.setProperty(l,""):l==="float"?t.cssFloat="":t[l]="":a?t.setProperty(l,e):typeof e!="number"||e===0||O0.has(l)?l==="float"?t.cssFloat=e:t[l]=(""+e).trim():t[l]=e+"px"}function ur(t,l,e){if(l!=null&&typeof l!="object")throw Error(f(62));if(t=t.style,e!=null){for(var a in e)!e.hasOwnProperty(a)||l!=null&&l.hasOwnProperty(a)||(a.indexOf("--")===0?t.setProperty(a,""):a==="float"?t.cssFloat="":t[a]="");for(var u in l)a=l[u],l.hasOwnProperty(u)&&e[u]!==a&&ar(t,u,a)}else for(var n in l)l.hasOwnProperty(n)&&ar(t,n,l[n])}function hi(t){if(t.indexOf("-")===-1)return!1;switch(t){case"annotation-xml":case"color-profile":case"font-face":case"font-face-src":case"font-face-uri":case"font-face-format":case"font-face-name":case"missing-glyph":return!1;default:return!0}}var N0=new Map([["acceptCharset","accept-charset"],["htmlFor","for"],["httpEquiv","http-equiv"],["crossOrigin","crossorigin"],["accentHeight","accent-height"],["alignmentBaseline","alignment-baseline"],["arabicForm","arabic-form"],["baselineShift","baseline-shift"],["capHeight","cap-height"],["clipPath","clip-path"],["clipRule","clip-rule"],["colorInterpolation","color-interpolation"],["colorInterpolationFilters","color-interpolation-filters"],["colorProfile","color-profile"],["colorRendering","color-rendering"],["dominantBaseline","dominant-baseline"],["enableBackground","enable-background"],["fillOpacity","fill-opacity"],["fillRule","fill-rule"],["floodColor","flood-color"],["floodOpacity","flood-opacity"],["fontFamily","font-family"],["fontSize","font-size"],["fontSizeAdjust","font-size-adjust"],["fontStretch","font-stretch"],["fontStyle","font-style"],["fontVariant","font-variant"],["fontWeight","font-weight"],["glyphName","glyph-name"],["glyphOrientationHorizontal","glyph-orientation-horizontal"],["glyphOrientationVertical","glyph-orientation-vertical"],["horizAdvX","horiz-adv-x"],["horizOriginX","horiz-origin-x"],["imageRendering","image-rendering"],["letterSpacing","letter-spacing"],["lightingColor","lighting-color"],["markerEnd","marker-end"],["markerMid","marker-mid"],["markerStart","marker-start"],["overlinePosition","overline-position"],["overlineThickness","overline-thickness"],["paintOrder","paint-order"],["panose-1","panose-1"],["pointerEvents","pointer-events"],["renderingIntent","rendering-intent"],["shapeRendering","shape-rendering"],["stopColor","stop-color"],["stopOpacity","stop-opacity"],["strikethroughPosition","strikethrough-position"],["strikethroughThickness","strikethrough-thickness"],["strokeDasharray","stroke-dasharray"],["strokeDashoffset","stroke-dashoffset"],["strokeLinecap","stroke-linecap"],["strokeLinejoin","stroke-linejoin"],["strokeMiterlimit","stroke-miterlimit"],["strokeOpacity","stroke-opacity"],["strokeWidth","stroke-width"],["textAnchor","text-anchor"],["textDecoration","text-decoration"],["textRendering","text-rendering"],["transformOrigin","transform-origin"],["underlinePosition","underline-position"],["underlineThickness","underline-thickness"],["unicodeBidi","unicode-bidi"],["unicodeRange","unicode-range"],["unitsPerEm","units-per-em"],["vAlphabetic","v-alphabetic"],["vHanging","v-hanging"],["vIdeographic","v-ideographic"],["vMathematical","v-mathematical"],["vectorEffect","vector-effect"],["vertAdvY","vert-adv-y"],["vertOriginX","vert-origin-x"],["vertOriginY","vert-origin-y"],["wordSpacing","word-spacing"],["writingMode","writing-mode"],["xmlnsXlink","xmlns:xlink"],["xHeight","x-height"]]),D0=/^[\u0000-\u001F ]*j[\r\n\t]*a[\r\n\t]*v[\r\n\t]*a[\r\n\t]*s[\r\n\t]*c[\r\n\t]*r[\r\n\t]*i[\r\n\t]*p[\r\n\t]*t[\r\n\t]*:/i;function Lu(t){return D0.test(""+t)?"javascript:throw new Error('React has blocked a javascript: URL as a security precaution.')":t}function Xl(){}var gi=null;function vi(t){return t=t.target||t.srcElement||window,t.correspondingUseElement&&(t=t.correspondingUseElement),t.nodeType===3?t.parentNode:t}var ua=null,na=null;function nr(t){var l=Pe(t);if(l&&(t=l.stateNode)){var e=t[el]||null;t:switch(t=l.stateNode,l.type){case"input":if(yi(t,e.value,e.defaultValue,e.defaultValue,e.checked,e.defaultChecked,e.type,e.name),l=e.name,e.type==="radio"&&l!=null){for(e=t;e.parentNode;)e=e.parentNode;for(e=e.querySelectorAll('input[name="'+xl(""+l)+'"][type="radio"]'),l=0;l<e.length;l++){var a=e[l];if(a!==t&&a.form===t.form){var u=a[el]||null;if(!u)throw Error(f(90));yi(a,u.value,u.defaultValue,u.defaultValue,u.checked,u.defaultChecked,u.type,u.name)}}for(l=0;l<e.length;l++)a=e[l],a.form===t.form&&Pf(a)}break t;case"textarea":lr(t,e.value,e.defaultValue);break t;case"select":l=e.value,l!=null&&ea(t,!!e.multiple,l,!1)}}}var bi=!1;function ir(t,l,e){if(bi)return t(l,e);bi=!0;try{var a=t(l);return a}finally{if(bi=!1,(ua!==null||na!==null)&&(Cn(),ua&&(l=ua,t=na,na=ua=null,nr(l),t)))for(l=0;l<t.length;l++)nr(t[l])}}function wa(t,l){var e=t.stateNode;if(e===null)return null;var a=e[el]||null;if(a===null)return null;e=a[l];t:switch(l){case"onClick":case"onClickCapture":case"onDoubleClick":case"onDoubleClickCapture":case"onMouseDown":case"onMouseDownCapture":case"onMouseMove":case"onMouseMoveCapture":case"onMouseUp":case"onMouseUpCapture":case"onMouseEnter":(a=!a.disabled)||(t=t.type,a=!(t==="button"||t==="input"||t==="select"||t==="textarea")),t=!a;break t;default:t=!1}if(t)return null;if(e&&typeof e!="function")throw Error(f(231,l,typeof e));return e}var Ql=!(typeof window>"u"||typeof window.document>"u"||typeof window.document.createElement>"u"),pi=!1;if(Ql)try{var La={};Object.defineProperty(La,"passive",{get:function(){pi=!0}}),window.addEventListener("test",La,La),window.removeEventListener("test",La,La)}catch{pi=!1}var ie=null,Si=null,Vu=null;function cr(){if(Vu)return Vu;var t,l=Si,e=l.length,a,u="value"in ie?ie.value:ie.textContent,n=u.length;for(t=0;t<e&&l[t]===u[t];t++);var i=e-t;for(a=1;a<=i&&l[e-a]===u[n-a];a++);return Vu=u.slice(t,1<a?1-a:void 0)}function Ku(t){var l=t.keyCode;return"charCode"in t?(t=t.charCode,t===0&&l===13&&(t=13)):t=l,t===10&&(t=13),32<=t||t===13?t:0}function Ju(){return!0}function fr(){return!1}function al(t){function l(e,a,u,n,i){this._reactName=e,this._targetInst=u,this.type=a,this.nativeEvent=n,this.target=i,this.currentTarget=null;for(var c in t)t.hasOwnProperty(c)&&(e=t[c],this[c]=e?e(n):n[c]);return this.isDefaultPrevented=(n.defaultPrevented!=null?n.defaultPrevented:n.returnValue===!1)?Ju:fr,this.isPropagationStopped=fr,this}return H(l.prototype,{preventDefault:function(){this.defaultPrevented=!0;var e=this.nativeEvent;e&&(e.preventDefault?e.preventDefault():typeof e.returnValue!="unknown"&&(e.returnValue=!1),this.isDefaultPrevented=Ju)},stopPropagation:function(){var e=this.nativeEvent;e&&(e.stopPropagation?e.stopPropagation():typeof e.cancelBubble!="unknown"&&(e.cancelBubble=!0),this.isPropagationStopped=Ju)},persist:function(){},isPersistent:Ju}),l}var Re={eventPhase:0,bubbles:0,cancelable:0,timeStamp:function(t){return t.timeStamp||Date.now()},defaultPrevented:0,isTrusted:0},ku=al(Re),Va=H({},Re,{view:0,detail:0}),U0=al(Va),xi,zi,Ka,Wu=H({},Va,{screenX:0,screenY:0,clientX:0,clientY:0,pageX:0,pageY:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,getModifierState:Ai,button:0,buttons:0,relatedTarget:function(t){return t.relatedTarget===void 0?t.fromElement===t.srcElement?t.toElement:t.fromElement:t.relatedTarget},movementX:function(t){return"movementX"in t?t.movementX:(t!==Ka&&(Ka&&t.type==="mousemove"?(xi=t.screenX-Ka.screenX,zi=t.screenY-Ka.screenY):zi=xi=0,Ka=t),xi)},movementY:function(t){return"movementY"in t?t.movementY:zi}}),rr=al(Wu),C0=H({},Wu,{dataTransfer:0}),j0=al(C0),R0=H({},Va,{relatedTarget:0}),Ti=al(R0),H0=H({},Re,{animationName:0,elapsedTime:0,pseudoElement:0}),B0=al(H0),q0=H({},Re,{clipboardData:function(t){return"clipboardData"in t?t.clipboardData:window.clipboardData}}),Y0=al(q0),G0=H({},Re,{data:0}),sr=al(G0),X0={Esc:"Escape",Spacebar:" ",Left:"ArrowLeft",Up:"ArrowUp",Right:"ArrowRight",Down:"ArrowDown",Del:"Delete",Win:"OS",Menu:"ContextMenu",Apps:"ContextMenu",Scroll:"ScrollLock",MozPrintableKey:"Unidentified"},Q0={8:"Backspace",9:"Tab",12:"Clear",13:"Enter",16:"Shift",17:"Control",18:"Alt",19:"Pause",20:"CapsLock",27:"Escape",32:" ",33:"PageUp",34:"PageDown",35:"End",36:"Home",37:"ArrowLeft",38:"ArrowUp",39:"ArrowRight",40:"ArrowDown",45:"Insert",46:"Delete",112:"F1",113:"F2",114:"F3",115:"F4",116:"F5",117:"F6",118:"F7",119:"F8",120:"F9",121:"F10",122:"F11",123:"F12",144:"NumLock",145:"ScrollLock",224:"Meta"},Z0={Alt:"altKey",Control:"ctrlKey",Meta:"metaKey",Shift:"shiftKey"};function w0(t){var l=this.nativeEvent;return l.getModifierState?l.getModifierState(t):(t=Z0[t])?!!l[t]:!1}function Ai(){return w0}var L0=H({},Va,{key:function(t){if(t.key){var l=X0[t.key]||t.key;if(l!=="Unidentified")return l}return t.type==="keypress"?(t=Ku(t),t===13?"Enter":String.fromCharCode(t)):t.type==="keydown"||t.type==="keyup"?Q0[t.keyCode]||"Unidentified":""},code:0,location:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,repeat:0,locale:0,getModifierState:Ai,charCode:function(t){return t.type==="keypress"?Ku(t):0},keyCode:function(t){return t.type==="keydown"||t.type==="keyup"?t.keyCode:0},which:function(t){return t.type==="keypress"?Ku(t):t.type==="keydown"||t.type==="keyup"?t.keyCode:0}}),V0=al(L0),K0=H({},Wu,{pointerId:0,width:0,height:0,pressure:0,tangentialPressure:0,tiltX:0,tiltY:0,twist:0,pointerType:0,isPrimary:0}),or=al(K0),J0=H({},Va,{touches:0,targetTouches:0,changedTouches:0,altKey:0,metaKey:0,ctrlKey:0,shiftKey:0,getModifierState:Ai}),k0=al(J0),W0=H({},Re,{propertyName:0,elapsedTime:0,pseudoElement:0}),$0=al(W0),F0=H({},Wu,{deltaX:function(t){return"deltaX"in t?t.deltaX:"wheelDeltaX"in t?-t.wheelDeltaX:0},deltaY:function(t){return"deltaY"in t?t.deltaY:"wheelDeltaY"in t?-t.wheelDeltaY:"wheelDelta"in t?-t.wheelDelta:0},deltaZ:0,deltaMode:0}),I0=al(F0),P0=H({},Re,{newState:0,oldState:0}),ty=al(P0),ly=[9,13,27,32],Ei=Ql&&"CompositionEvent"in window,Ja=null;Ql&&"documentMode"in document&&(Ja=document.documentMode);var ey=Ql&&"TextEvent"in window&&!Ja,dr=Ql&&(!Ei||Ja&&8<Ja&&11>=Ja),yr=" ",mr=!1;function hr(t,l){switch(t){case"keyup":return ly.indexOf(l.keyCode)!==-1;case"keydown":return l.keyCode!==229;case"keypress":case"mousedown":case"focusout":return!0;default:return!1}}function gr(t){return t=t.detail,typeof t=="object"&&"data"in t?t.data:null}var ia=!1;function ay(t,l){switch(t){case"compositionend":return gr(l);case"keypress":return l.which!==32?null:(mr=!0,yr);case"textInput":return t=l.data,t===yr&&mr?null:t;default:return null}}function uy(t,l){if(ia)return t==="compositionend"||!Ei&&hr(t,l)?(t=cr(),Vu=Si=ie=null,ia=!1,t):null;switch(t){case"paste":return null;case"keypress":if(!(l.ctrlKey||l.altKey||l.metaKey)||l.ctrlKey&&l.altKey){if(l.char&&1<l.char.length)return l.char;if(l.which)return String.fromCharCode(l.which)}return null;case"compositionend":return dr&&l.locale!=="ko"?null:l.data;default:return null}}var ny={color:!0,date:!0,datetime:!0,"datetime-local":!0,email:!0,month:!0,number:!0,password:!0,range:!0,search:!0,tel:!0,text:!0,time:!0,url:!0,week:!0};function vr(t){var l=t&&t.nodeName&&t.nodeName.toLowerCase();return l==="input"?!!ny[t.type]:l==="textarea"}function br(t,l,e,a){ua?na?na.push(a):na=[a]:ua=a,l=Gn(l,"onChange"),0<l.length&&(e=new ku("onChange","change",null,e,a),t.push({event:e,listeners:l}))}var ka=null,Wa=null;function iy(t){ld(t,0)}function $u(t){var l=Za(t);if(Pf(l))return t}function pr(t,l){if(t==="change")return l}var Sr=!1;if(Ql){var Mi;if(Ql){var _i="oninput"in document;if(!_i){var xr=document.createElement("div");xr.setAttribute("oninput","return;"),_i=typeof xr.oninput=="function"}Mi=_i}else Mi=!1;Sr=Mi&&(!document.documentMode||9<document.documentMode)}function zr(){ka&&(ka.detachEvent("onpropertychange",Tr),Wa=ka=null)}function Tr(t){if(t.propertyName==="value"&&$u(Wa)){var l=[];br(l,Wa,t,vi(t)),ir(iy,l)}}function cy(t,l,e){t==="focusin"?(zr(),ka=l,Wa=e,ka.attachEvent("onpropertychange",Tr)):t==="focusout"&&zr()}function fy(t){if(t==="selectionchange"||t==="keyup"||t==="keydown")return $u(Wa)}function ry(t,l){if(t==="click")return $u(l)}function sy(t,l){if(t==="input"||t==="change")return $u(l)}function oy(t,l){return t===l&&(t!==0||1/t===1/l)||t!==t&&l!==l}var dl=typeof Object.is=="function"?Object.is:oy;function $a(t,l){if(dl(t,l))return!0;if(typeof t!="object"||t===null||typeof l!="object"||l===null)return!1;var e=Object.keys(t),a=Object.keys(l);if(e.length!==a.length)return!1;for(a=0;a<e.length;a++){var u=e[a];if(!ui.call(l,u)||!dl(t[u],l[u]))return!1}return!0}function Ar(t){for(;t&&t.firstChild;)t=t.firstChild;return t}function Er(t,l){var e=Ar(t);t=0;for(var a;e;){if(e.nodeType===3){if(a=t+e.textContent.length,t<=l&&a>=l)return{node:e,offset:l-t};t=a}t:{for(;e;){if(e.nextSibling){e=e.nextSibling;break t}e=e.parentNode}e=void 0}e=Ar(e)}}function Mr(t,l){return t&&l?t===l?!0:t&&t.nodeType===3?!1:l&&l.nodeType===3?Mr(t,l.parentNode):"contains"in t?t.contains(l):t.compareDocumentPosition?!!(t.compareDocumentPosition(l)&16):!1:!1}function _r(t){t=t!=null&&t.ownerDocument!=null&&t.ownerDocument.defaultView!=null?t.ownerDocument.defaultView:window;for(var l=wu(t.document);l instanceof t.HTMLIFrameElement;){try{var e=typeof l.contentWindow.location.href=="string"}catch{e=!1}if(e)t=l.contentWindow;else break;l=wu(t.document)}return l}function Oi(t){var l=t&&t.nodeName&&t.nodeName.toLowerCase();return l&&(l==="input"&&(t.type==="text"||t.type==="search"||t.type==="tel"||t.type==="url"||t.type==="password")||l==="textarea"||t.contentEditable==="true")}var dy=Ql&&"documentMode"in document&&11>=document.documentMode,ca=null,Ni=null,Fa=null,Di=!1;function Or(t,l,e){var a=e.window===e?e.document:e.nodeType===9?e:e.ownerDocument;Di||ca==null||ca!==wu(a)||(a=ca,"selectionStart"in a&&Oi(a)?a={start:a.selectionStart,end:a.selectionEnd}:(a=(a.ownerDocument&&a.ownerDocument.defaultView||window).getSelection(),a={anchorNode:a.anchorNode,anchorOffset:a.anchorOffset,focusNode:a.focusNode,focusOffset:a.focusOffset}),Fa&&$a(Fa,a)||(Fa=a,a=Gn(Ni,"onSelect"),0<a.length&&(l=new ku("onSelect","select",null,l,e),t.push({event:l,listeners:a}),l.target=ca)))}function He(t,l){var e={};return e[t.toLowerCase()]=l.toLowerCase(),e["Webkit"+t]="webkit"+l,e["Moz"+t]="moz"+l,e}var fa={animationend:He("Animation","AnimationEnd"),animationiteration:He("Animation","AnimationIteration"),animationstart:He("Animation","AnimationStart"),transitionrun:He("Transition","TransitionRun"),transitionstart:He("Transition","TransitionStart"),transitioncancel:He("Transition","TransitionCancel"),transitionend:He("Transition","TransitionEnd")},Ui={},Nr={};Ql&&(Nr=document.createElement("div").style,"AnimationEvent"in window||(delete fa.animationend.animation,delete fa.animationiteration.animation,delete fa.animationstart.animation),"TransitionEvent"in window||delete fa.transitionend.transition);function Be(t){if(Ui[t])return Ui[t];if(!fa[t])return t;var l=fa[t],e;for(e in l)if(l.hasOwnProperty(e)&&e in Nr)return Ui[t]=l[e];return t}var Dr=Be("animationend"),Ur=Be("animationiteration"),Cr=Be("animationstart"),yy=Be("transitionrun"),my=Be("transitionstart"),hy=Be("transitioncancel"),jr=Be("transitionend"),Rr=new Map,Ci="abort auxClick beforeToggle cancel canPlay canPlayThrough click close contextMenu copy cut drag dragEnd dragEnter dragExit dragLeave dragOver dragStart drop durationChange emptied encrypted ended error gotPointerCapture input invalid keyDown keyPress keyUp load loadedData loadedMetadata loadStart lostPointerCapture mouseDown mouseMove mouseOut mouseOver mouseUp paste pause play playing pointerCancel pointerDown pointerMove pointerOut pointerOver pointerUp progress rateChange reset resize seeked seeking stalled submit suspend timeUpdate touchCancel touchEnd touchStart volumeChange scroll toggle touchMove waiting wheel".split(" ");Ci.push("scrollEnd");function Ul(t,l){Rr.set(t,l),je(l,[t])}var Fu=typeof reportError=="function"?reportError:function(t){if(typeof window=="object"&&typeof window.ErrorEvent=="function"){var l=new window.ErrorEvent("error",{bubbles:!0,cancelable:!0,message:typeof t=="object"&&t!==null&&typeof t.message=="string"?String(t.message):String(t),error:t});if(!window.dispatchEvent(l))return}else if(typeof process=="object"&&typeof process.emit=="function"){process.emit("uncaughtException",t);return}console.error(t)},zl=[],ra=0,ji=0;function Iu(){for(var t=ra,l=ji=ra=0;l<t;){var e=zl[l];zl[l++]=null;var a=zl[l];zl[l++]=null;var u=zl[l];zl[l++]=null;var n=zl[l];if(zl[l++]=null,a!==null&&u!==null){var i=a.pending;i===null?u.next=u:(u.next=i.next,i.next=u),a.pending=u}n!==0&&Hr(e,u,n)}}function Pu(t,l,e,a){zl[ra++]=t,zl[ra++]=l,zl[ra++]=e,zl[ra++]=a,ji|=a,t.lanes|=a,t=t.alternate,t!==null&&(t.lanes|=a)}function Ri(t,l,e,a){return Pu(t,l,e,a),tn(t)}function qe(t,l){return Pu(t,null,null,l),tn(t)}function Hr(t,l,e){t.lanes|=e;var a=t.alternate;a!==null&&(a.lanes|=e);for(var u=!1,n=t.return;n!==null;)n.childLanes|=e,a=n.alternate,a!==null&&(a.childLanes|=e),n.tag===22&&(t=n.stateNode,t===null||t._visibility&1||(u=!0)),t=n,n=n.return;return t.tag===3?(n=t.stateNode,u&&l!==null&&(u=31-ol(e),t=n.hiddenUpdates,a=t[u],a===null?t[u]=[l]:a.push(l),l.lane=e|536870912),n):null}function tn(t){if(50<pu)throw pu=0,wc=null,Error(f(185));for(var l=t.return;l!==null;)t=l,l=t.return;return t.tag===3?t.stateNode:null}var sa={};function gy(t,l,e,a){this.tag=t,this.key=e,this.sibling=this.child=this.return=this.stateNode=this.type=this.elementType=null,this.index=0,this.refCleanup=this.ref=null,this.pendingProps=l,this.dependencies=this.memoizedState=this.updateQueue=this.memoizedProps=null,this.mode=a,this.subtreeFlags=this.flags=0,this.deletions=null,this.childLanes=this.lanes=0,this.alternate=null}function yl(t,l,e,a){return new gy(t,l,e,a)}function Hi(t){return t=t.prototype,!(!t||!t.isReactComponent)}function Zl(t,l){var e=t.alternate;return e===null?(e=yl(t.tag,l,t.key,t.mode),e.elementType=t.elementType,e.type=t.type,e.stateNode=t.stateNode,e.alternate=t,t.alternate=e):(e.pendingProps=l,e.type=t.type,e.flags=0,e.subtreeFlags=0,e.deletions=null),e.flags=t.flags&65011712,e.childLanes=t.childLanes,e.lanes=t.lanes,e.child=t.child,e.memoizedProps=t.memoizedProps,e.memoizedState=t.memoizedState,e.updateQueue=t.updateQueue,l=t.dependencies,e.dependencies=l===null?null:{lanes:l.lanes,firstContext:l.firstContext},e.sibling=t.sibling,e.index=t.index,e.ref=t.ref,e.refCleanup=t.refCleanup,e}function Br(t,l){t.flags&=65011714;var e=t.alternate;return e===null?(t.childLanes=0,t.lanes=l,t.child=null,t.subtreeFlags=0,t.memoizedProps=null,t.memoizedState=null,t.updateQueue=null,t.dependencies=null,t.stateNode=null):(t.childLanes=e.childLanes,t.lanes=e.lanes,t.child=e.child,t.subtreeFlags=0,t.deletions=null,t.memoizedProps=e.memoizedProps,t.memoizedState=e.memoizedState,t.updateQueue=e.updateQueue,t.type=e.type,l=e.dependencies,t.dependencies=l===null?null:{lanes:l.lanes,firstContext:l.firstContext}),t}function ln(t,l,e,a,u,n){var i=0;if(a=t,typeof t=="function")Hi(t)&&(i=1);else if(typeof t=="string")i=xm(t,e,q.current)?26:t==="html"||t==="head"||t==="body"?27:5;else t:switch(t){case Xt:return t=yl(31,e,l,u),t.elementType=Xt,t.lanes=n,t;case G:return Ye(e.children,u,n,l);case Q:i=8,u|=24;break;case V:return t=yl(12,e,l,u|2),t.elementType=V,t.lanes=n,t;case nt:return t=yl(13,e,l,u),t.elementType=nt,t.lanes=n,t;case Ot:return t=yl(19,e,l,u),t.elementType=Ot,t.lanes=n,t;default:if(typeof t=="object"&&t!==null)switch(t.$$typeof){case zt:i=10;break t;case gt:i=9;break t;case _t:i=11;break t;case J:i=14;break t;case Nt:i=16,a=null;break t}i=29,e=Error(f(130,t===null?"null":typeof t,"")),a=null}return l=yl(i,e,l,u),l.elementType=t,l.type=a,l.lanes=n,l}function Ye(t,l,e,a){return t=yl(7,t,a,l),t.lanes=e,t}function Bi(t,l,e){return t=yl(6,t,null,l),t.lanes=e,t}function qr(t){var l=yl(18,null,null,0);return l.stateNode=t,l}function qi(t,l,e){return l=yl(4,t.children!==null?t.children:[],t.key,l),l.lanes=e,l.stateNode={containerInfo:t.containerInfo,pendingChildren:null,implementation:t.implementation},l}var Yr=new WeakMap;function Tl(t,l){if(typeof t=="object"&&t!==null){var e=Yr.get(t);return e!==void 0?e:(l={value:t,source:l,stack:qf(l)},Yr.set(t,l),l)}return{value:t,source:l,stack:qf(l)}}var oa=[],da=0,en=null,Ia=0,Al=[],El=0,ce=null,Hl=1,Bl="";function wl(t,l){oa[da++]=Ia,oa[da++]=en,en=t,Ia=l}function Gr(t,l,e){Al[El++]=Hl,Al[El++]=Bl,Al[El++]=ce,ce=t;var a=Hl;t=Bl;var u=32-ol(a)-1;a&=~(1<<u),e+=1;var n=32-ol(l)+u;if(30<n){var i=u-u%5;n=(a&(1<<i)-1).toString(32),a>>=i,u-=i,Hl=1<<32-ol(l)+u|e<<u|a,Bl=n+t}else Hl=1<<n|e<<u|a,Bl=t}function Yi(t){t.return!==null&&(wl(t,1),Gr(t,1,0))}function Gi(t){for(;t===en;)en=oa[--da],oa[da]=null,Ia=oa[--da],oa[da]=null;for(;t===ce;)ce=Al[--El],Al[El]=null,Bl=Al[--El],Al[El]=null,Hl=Al[--El],Al[El]=null}function Xr(t,l){Al[El++]=Hl,Al[El++]=Bl,Al[El++]=ce,Hl=l.id,Bl=l.overflow,ce=t}var Vt=null,Tt=null,ut=!1,fe=null,Ml=!1,Xi=Error(f(519));function re(t){var l=Error(f(418,1<arguments.length&&arguments[1]!==void 0&&arguments[1]?"text":"HTML",""));throw Pa(Tl(l,t)),Xi}function Qr(t){var l=t.stateNode,e=t.type,a=t.memoizedProps;switch(l[Lt]=t,l[el]=a,e){case"dialog":lt("cancel",l),lt("close",l);break;case"iframe":case"object":case"embed":lt("load",l);break;case"video":case"audio":for(e=0;e<xu.length;e++)lt(xu[e],l);break;case"source":lt("error",l);break;case"img":case"image":case"link":lt("error",l),lt("load",l);break;case"details":lt("toggle",l);break;case"input":lt("invalid",l),tr(l,a.value,a.defaultValue,a.checked,a.defaultChecked,a.type,a.name,!0);break;case"select":lt("invalid",l);break;case"textarea":lt("invalid",l),er(l,a.value,a.defaultValue,a.children)}e=a.children,typeof e!="string"&&typeof e!="number"&&typeof e!="bigint"||l.textContent===""+e||a.suppressHydrationWarning===!0||nd(l.textContent,e)?(a.popover!=null&&(lt("beforetoggle",l),lt("toggle",l)),a.onScroll!=null&&lt("scroll",l),a.onScrollEnd!=null&&lt("scrollend",l),a.onClick!=null&&(l.onclick=Xl),l=!0):l=!1,l||re(t,!0)}function Zr(t){for(Vt=t.return;Vt;)switch(Vt.tag){case 5:case 31:case 13:Ml=!1;return;case 27:case 3:Ml=!0;return;default:Vt=Vt.return}}function ya(t){if(t!==Vt)return!1;if(!ut)return Zr(t),ut=!0,!1;var l=t.tag,e;if((e=l!==3&&l!==27)&&((e=l===5)&&(e=t.type,e=!(e!=="form"&&e!=="button")||uf(t.type,t.memoizedProps)),e=!e),e&&Tt&&re(t),Zr(t),l===13){if(t=t.memoizedState,t=t!==null?t.dehydrated:null,!t)throw Error(f(317));Tt=md(t)}else if(l===31){if(t=t.memoizedState,t=t!==null?t.dehydrated:null,!t)throw Error(f(317));Tt=md(t)}else l===27?(l=Tt,Te(t.type)?(t=sf,sf=null,Tt=t):Tt=l):Tt=Vt?Ol(t.stateNode.nextSibling):null;return!0}function Ge(){Tt=Vt=null,ut=!1}function Qi(){var t=fe;return t!==null&&(cl===null?cl=t:cl.push.apply(cl,t),fe=null),t}function Pa(t){fe===null?fe=[t]:fe.push(t)}var Zi=o(null),Xe=null,Ll=null;function se(t,l,e){j(Zi,l._currentValue),l._currentValue=e}function Vl(t){t._currentValue=Zi.current,M(Zi)}function wi(t,l,e){for(;t!==null;){var a=t.alternate;if((t.childLanes&l)!==l?(t.childLanes|=l,a!==null&&(a.childLanes|=l)):a!==null&&(a.childLanes&l)!==l&&(a.childLanes|=l),t===e)break;t=t.return}}function Li(t,l,e,a){var u=t.child;for(u!==null&&(u.return=t);u!==null;){var n=u.dependencies;if(n!==null){var i=u.child;n=n.firstContext;t:for(;n!==null;){var c=n;n=u;for(var s=0;s<l.length;s++)if(c.context===l[s]){n.lanes|=e,c=n.alternate,c!==null&&(c.lanes|=e),wi(n.return,e,t),a||(i=null);break t}n=c.next}}else if(u.tag===18){if(i=u.return,i===null)throw Error(f(341));i.lanes|=e,n=i.alternate,n!==null&&(n.lanes|=e),wi(i,e,t),i=null}else i=u.child;if(i!==null)i.return=u;else for(i=u;i!==null;){if(i===t){i=null;break}if(u=i.sibling,u!==null){u.return=i.return,i=u;break}i=i.return}u=i}}function ma(t,l,e,a){t=null;for(var u=l,n=!1;u!==null;){if(!n){if((u.flags&524288)!==0)n=!0;else if((u.flags&262144)!==0)break}if(u.tag===10){var i=u.alternate;if(i===null)throw Error(f(387));if(i=i.memoizedProps,i!==null){var c=u.type;dl(u.pendingProps.value,i.value)||(t!==null?t.push(c):t=[c])}}else if(u===yt.current){if(i=u.alternate,i===null)throw Error(f(387));i.memoizedState.memoizedState!==u.memoizedState.memoizedState&&(t!==null?t.push(Mu):t=[Mu])}u=u.return}t!==null&&Li(l,t,e,a),l.flags|=262144}function an(t){for(t=t.firstContext;t!==null;){if(!dl(t.context._currentValue,t.memoizedValue))return!0;t=t.next}return!1}function Qe(t){Xe=t,Ll=null,t=t.dependencies,t!==null&&(t.firstContext=null)}function Kt(t){return wr(Xe,t)}function un(t,l){return Xe===null&&Qe(t),wr(t,l)}function wr(t,l){var e=l._currentValue;if(l={context:l,memoizedValue:e,next:null},Ll===null){if(t===null)throw Error(f(308));Ll=l,t.dependencies={lanes:0,firstContext:l},t.flags|=524288}else Ll=Ll.next=l;return e}var vy=typeof AbortController<"u"?AbortController:function(){var t=[],l=this.signal={aborted:!1,addEventListener:function(e,a){t.push(a)}};this.abort=function(){l.aborted=!0,t.forEach(function(e){return e()})}},by=r.unstable_scheduleCallback,py=r.unstable_NormalPriority,Ht={$$typeof:zt,Consumer:null,Provider:null,_currentValue:null,_currentValue2:null,_threadCount:0};function Vi(){return{controller:new vy,data:new Map,refCount:0}}function tu(t){t.refCount--,t.refCount===0&&by(py,function(){t.controller.abort()})}var lu=null,Ki=0,ha=0,ga=null;function Sy(t,l){if(lu===null){var e=lu=[];Ki=0,ha=Wc(),ga={status:"pending",value:void 0,then:function(a){e.push(a)}}}return Ki++,l.then(Lr,Lr),l}function Lr(){if(--Ki===0&&lu!==null){ga!==null&&(ga.status="fulfilled");var t=lu;lu=null,ha=0,ga=null;for(var l=0;l<t.length;l++)(0,t[l])()}}function xy(t,l){var e=[],a={status:"pending",value:null,reason:null,then:function(u){e.push(u)}};return t.then(function(){a.status="fulfilled",a.value=l;for(var u=0;u<e.length;u++)(0,e[u])(l)},function(u){for(a.status="rejected",a.reason=u,u=0;u<e.length;u++)(0,e[u])(void 0)}),a}var Vr=x.S;x.S=function(t,l){No=rl(),typeof l=="object"&&l!==null&&typeof l.then=="function"&&Sy(t,l),Vr!==null&&Vr(t,l)};var Ze=o(null);function Ji(){var t=Ze.current;return t!==null?t:St.pooledCache}function nn(t,l){l===null?j(Ze,Ze.current):j(Ze,l.pool)}function Kr(){var t=Ji();return t===null?null:{parent:Ht._currentValue,pool:t}}var va=Error(f(460)),ki=Error(f(474)),cn=Error(f(542)),fn={then:function(){}};function Jr(t){return t=t.status,t==="fulfilled"||t==="rejected"}function kr(t,l,e){switch(e=t[e],e===void 0?t.push(l):e!==l&&(l.then(Xl,Xl),l=e),l.status){case"fulfilled":return l.value;case"rejected":throw t=l.reason,$r(t),t;default:if(typeof l.status=="string")l.then(Xl,Xl);else{if(t=St,t!==null&&100<t.shellSuspendCounter)throw Error(f(482));t=l,t.status="pending",t.then(function(a){if(l.status==="pending"){var u=l;u.status="fulfilled",u.value=a}},function(a){if(l.status==="pending"){var u=l;u.status="rejected",u.reason=a}})}switch(l.status){case"fulfilled":return l.value;case"rejected":throw t=l.reason,$r(t),t}throw Le=l,va}}function we(t){try{var l=t._init;return l(t._payload)}catch(e){throw e!==null&&typeof e=="object"&&typeof e.then=="function"?(Le=e,va):e}}var Le=null;function Wr(){if(Le===null)throw Error(f(459));var t=Le;return Le=null,t}function $r(t){if(t===va||t===cn)throw Error(f(483))}var ba=null,eu=0;function rn(t){var l=eu;return eu+=1,ba===null&&(ba=[]),kr(ba,t,l)}function au(t,l){l=l.props.ref,t.ref=l!==void 0?l:null}function sn(t,l){throw l.$$typeof===L?Error(f(525)):(t=Object.prototype.toString.call(l),Error(f(31,t==="[object Object]"?"object with keys {"+Object.keys(l).join(", ")+"}":t)))}function Fr(t){function l(y,d){if(t){var m=y.deletions;m===null?(y.deletions=[d],y.flags|=16):m.push(d)}}function e(y,d){if(!t)return null;for(;d!==null;)l(y,d),d=d.sibling;return null}function a(y){for(var d=new Map;y!==null;)y.key!==null?d.set(y.key,y):d.set(y.index,y),y=y.sibling;return d}function u(y,d){return y=Zl(y,d),y.index=0,y.sibling=null,y}function n(y,d,m){return y.index=m,t?(m=y.alternate,m!==null?(m=m.index,m<d?(y.flags|=67108866,d):m):(y.flags|=67108866,d)):(y.flags|=1048576,d)}function i(y){return t&&y.alternate===null&&(y.flags|=67108866),y}function c(y,d,m,T){return d===null||d.tag!==6?(d=Bi(m,y.mode,T),d.return=y,d):(d=u(d,m),d.return=y,d)}function s(y,d,m,T){var X=m.type;return X===G?z(y,d,m.props.children,T,m.key):d!==null&&(d.elementType===X||typeof X=="object"&&X!==null&&X.$$typeof===Nt&&we(X)===d.type)?(d=u(d,m.props),au(d,m),d.return=y,d):(d=ln(m.type,m.key,m.props,null,y.mode,T),au(d,m),d.return=y,d)}function h(y,d,m,T){return d===null||d.tag!==4||d.stateNode.containerInfo!==m.containerInfo||d.stateNode.implementation!==m.implementation?(d=qi(m,y.mode,T),d.return=y,d):(d=u(d,m.children||[]),d.return=y,d)}function z(y,d,m,T,X){return d===null||d.tag!==7?(d=Ye(m,y.mode,T,X),d.return=y,d):(d=u(d,m),d.return=y,d)}function A(y,d,m){if(typeof d=="string"&&d!==""||typeof d=="number"||typeof d=="bigint")return d=Bi(""+d,y.mode,m),d.return=y,d;if(typeof d=="object"&&d!==null){switch(d.$$typeof){case ot:return m=ln(d.type,d.key,d.props,null,y.mode,m),au(m,d),m.return=y,m;case ct:return d=qi(d,y.mode,m),d.return=y,d;case Nt:return d=we(d),A(y,d,m)}if(ll(d)||I(d))return d=Ye(d,y.mode,m,null),d.return=y,d;if(typeof d.then=="function")return A(y,rn(d),m);if(d.$$typeof===zt)return A(y,un(y,d),m);sn(y,d)}return null}function g(y,d,m,T){var X=d!==null?d.key:null;if(typeof m=="string"&&m!==""||typeof m=="number"||typeof m=="bigint")return X!==null?null:c(y,d,""+m,T);if(typeof m=="object"&&m!==null){switch(m.$$typeof){case ot:return m.key===X?s(y,d,m,T):null;case ct:return m.key===X?h(y,d,m,T):null;case Nt:return m=we(m),g(y,d,m,T)}if(ll(m)||I(m))return X!==null?null:z(y,d,m,T,null);if(typeof m.then=="function")return g(y,d,rn(m),T);if(m.$$typeof===zt)return g(y,d,un(y,m),T);sn(y,m)}return null}function b(y,d,m,T,X){if(typeof T=="string"&&T!==""||typeof T=="number"||typeof T=="bigint")return y=y.get(m)||null,c(d,y,""+T,X);if(typeof T=="object"&&T!==null){switch(T.$$typeof){case ot:return y=y.get(T.key===null?m:T.key)||null,s(d,y,T,X);case ct:return y=y.get(T.key===null?m:T.key)||null,h(d,y,T,X);case Nt:return T=we(T),b(y,d,m,T,X)}if(ll(T)||I(T))return y=y.get(m)||null,z(d,y,T,X,null);if(typeof T.then=="function")return b(y,d,m,rn(T),X);if(T.$$typeof===zt)return b(y,d,m,un(d,T),X);sn(d,T)}return null}function B(y,d,m,T){for(var X=null,ft=null,Y=d,$=d=0,at=null;Y!==null&&$<m.length;$++){Y.index>$?(at=Y,Y=null):at=Y.sibling;var rt=g(y,Y,m[$],T);if(rt===null){Y===null&&(Y=at);break}t&&Y&&rt.alternate===null&&l(y,Y),d=n(rt,d,$),ft===null?X=rt:ft.sibling=rt,ft=rt,Y=at}if($===m.length)return e(y,Y),ut&&wl(y,$),X;if(Y===null){for(;$<m.length;$++)Y=A(y,m[$],T),Y!==null&&(d=n(Y,d,$),ft===null?X=Y:ft.sibling=Y,ft=Y);return ut&&wl(y,$),X}for(Y=a(Y);$<m.length;$++)at=b(Y,y,$,m[$],T),at!==null&&(t&&at.alternate!==null&&Y.delete(at.key===null?$:at.key),d=n(at,d,$),ft===null?X=at:ft.sibling=at,ft=at);return t&&Y.forEach(function(Oe){return l(y,Oe)}),ut&&wl(y,$),X}function w(y,d,m,T){if(m==null)throw Error(f(151));for(var X=null,ft=null,Y=d,$=d=0,at=null,rt=m.next();Y!==null&&!rt.done;$++,rt=m.next()){Y.index>$?(at=Y,Y=null):at=Y.sibling;var Oe=g(y,Y,rt.value,T);if(Oe===null){Y===null&&(Y=at);break}t&&Y&&Oe.alternate===null&&l(y,Y),d=n(Oe,d,$),ft===null?X=Oe:ft.sibling=Oe,ft=Oe,Y=at}if(rt.done)return e(y,Y),ut&&wl(y,$),X;if(Y===null){for(;!rt.done;$++,rt=m.next())rt=A(y,rt.value,T),rt!==null&&(d=n(rt,d,$),ft===null?X=rt:ft.sibling=rt,ft=rt);return ut&&wl(y,$),X}for(Y=a(Y);!rt.done;$++,rt=m.next())rt=b(Y,y,$,rt.value,T),rt!==null&&(t&&rt.alternate!==null&&Y.delete(rt.key===null?$:rt.key),d=n(rt,d,$),ft===null?X=rt:ft.sibling=rt,ft=rt);return t&&Y.forEach(function(Cm){return l(y,Cm)}),ut&&wl(y,$),X}function pt(y,d,m,T){if(typeof m=="object"&&m!==null&&m.type===G&&m.key===null&&(m=m.props.children),typeof m=="object"&&m!==null){switch(m.$$typeof){case ot:t:{for(var X=m.key;d!==null;){if(d.key===X){if(X=m.type,X===G){if(d.tag===7){e(y,d.sibling),T=u(d,m.props.children),T.return=y,y=T;break t}}else if(d.elementType===X||typeof X=="object"&&X!==null&&X.$$typeof===Nt&&we(X)===d.type){e(y,d.sibling),T=u(d,m.props),au(T,m),T.return=y,y=T;break t}e(y,d);break}else l(y,d);d=d.sibling}m.type===G?(T=Ye(m.props.children,y.mode,T,m.key),T.return=y,y=T):(T=ln(m.type,m.key,m.props,null,y.mode,T),au(T,m),T.return=y,y=T)}return i(y);case ct:t:{for(X=m.key;d!==null;){if(d.key===X)if(d.tag===4&&d.stateNode.containerInfo===m.containerInfo&&d.stateNode.implementation===m.implementation){e(y,d.sibling),T=u(d,m.children||[]),T.return=y,y=T;break t}else{e(y,d);break}else l(y,d);d=d.sibling}T=qi(m,y.mode,T),T.return=y,y=T}return i(y);case Nt:return m=we(m),pt(y,d,m,T)}if(ll(m))return B(y,d,m,T);if(I(m)){if(X=I(m),typeof X!="function")throw Error(f(150));return m=X.call(m),w(y,d,m,T)}if(typeof m.then=="function")return pt(y,d,rn(m),T);if(m.$$typeof===zt)return pt(y,d,un(y,m),T);sn(y,m)}return typeof m=="string"&&m!==""||typeof m=="number"||typeof m=="bigint"?(m=""+m,d!==null&&d.tag===6?(e(y,d.sibling),T=u(d,m),T.return=y,y=T):(e(y,d),T=Bi(m,y.mode,T),T.return=y,y=T),i(y)):e(y,d)}return function(y,d,m,T){try{eu=0;var X=pt(y,d,m,T);return ba=null,X}catch(Y){if(Y===va||Y===cn)throw Y;var ft=yl(29,Y,null,y.mode);return ft.lanes=T,ft.return=y,ft}}}var Ve=Fr(!0),Ir=Fr(!1),oe=!1;function Wi(t){t.updateQueue={baseState:t.memoizedState,firstBaseUpdate:null,lastBaseUpdate:null,shared:{pending:null,lanes:0,hiddenCallbacks:null},callbacks:null}}function $i(t,l){t=t.updateQueue,l.updateQueue===t&&(l.updateQueue={baseState:t.baseState,firstBaseUpdate:t.firstBaseUpdate,lastBaseUpdate:t.lastBaseUpdate,shared:t.shared,callbacks:null})}function de(t){return{lane:t,tag:0,payload:null,callback:null,next:null}}function ye(t,l,e){var a=t.updateQueue;if(a===null)return null;if(a=a.shared,(st&2)!==0){var u=a.pending;return u===null?l.next=l:(l.next=u.next,u.next=l),a.pending=l,l=tn(t),Hr(t,null,e),l}return Pu(t,a,l,e),tn(t)}function uu(t,l,e){if(l=l.updateQueue,l!==null&&(l=l.shared,(e&4194048)!==0)){var a=l.lanes;a&=t.pendingLanes,e|=a,l.lanes=e,wf(t,e)}}function Fi(t,l){var e=t.updateQueue,a=t.alternate;if(a!==null&&(a=a.updateQueue,e===a)){var u=null,n=null;if(e=e.firstBaseUpdate,e!==null){do{var i={lane:e.lane,tag:e.tag,payload:e.payload,callback:null,next:null};n===null?u=n=i:n=n.next=i,e=e.next}while(e!==null);n===null?u=n=l:n=n.next=l}else u=n=l;e={baseState:a.baseState,firstBaseUpdate:u,lastBaseUpdate:n,shared:a.shared,callbacks:a.callbacks},t.updateQueue=e;return}t=e.lastBaseUpdate,t===null?e.firstBaseUpdate=l:t.next=l,e.lastBaseUpdate=l}var Ii=!1;function nu(){if(Ii){var t=ga;if(t!==null)throw t}}function iu(t,l,e,a){Ii=!1;var u=t.updateQueue;oe=!1;var n=u.firstBaseUpdate,i=u.lastBaseUpdate,c=u.shared.pending;if(c!==null){u.shared.pending=null;var s=c,h=s.next;s.next=null,i===null?n=h:i.next=h,i=s;var z=t.alternate;z!==null&&(z=z.updateQueue,c=z.lastBaseUpdate,c!==i&&(c===null?z.firstBaseUpdate=h:c.next=h,z.lastBaseUpdate=s))}if(n!==null){var A=u.baseState;i=0,z=h=s=null,c=n;do{var g=c.lane&-536870913,b=g!==c.lane;if(b?(et&g)===g:(a&g)===g){g!==0&&g===ha&&(Ii=!0),z!==null&&(z=z.next={lane:0,tag:c.tag,payload:c.payload,callback:null,next:null});t:{var B=t,w=c;g=l;var pt=e;switch(w.tag){case 1:if(B=w.payload,typeof B=="function"){A=B.call(pt,A,g);break t}A=B;break t;case 3:B.flags=B.flags&-65537|128;case 0:if(B=w.payload,g=typeof B=="function"?B.call(pt,A,g):B,g==null)break t;A=H({},A,g);break t;case 2:oe=!0}}g=c.callback,g!==null&&(t.flags|=64,b&&(t.flags|=8192),b=u.callbacks,b===null?u.callbacks=[g]:b.push(g))}else b={lane:g,tag:c.tag,payload:c.payload,callback:c.callback,next:null},z===null?(h=z=b,s=A):z=z.next=b,i|=g;if(c=c.next,c===null){if(c=u.shared.pending,c===null)break;b=c,c=b.next,b.next=null,u.lastBaseUpdate=b,u.shared.pending=null}}while(!0);z===null&&(s=A),u.baseState=s,u.firstBaseUpdate=h,u.lastBaseUpdate=z,n===null&&(u.shared.lanes=0),be|=i,t.lanes=i,t.memoizedState=A}}function Pr(t,l){if(typeof t!="function")throw Error(f(191,t));t.call(l)}function ts(t,l){var e=t.callbacks;if(e!==null)for(t.callbacks=null,t=0;t<e.length;t++)Pr(e[t],l)}var pa=o(null),on=o(0);function ls(t,l){t=te,j(on,t),j(pa,l),te=t|l.baseLanes}function Pi(){j(on,te),j(pa,pa.current)}function tc(){te=on.current,M(pa),M(on)}var ml=o(null),_l=null;function me(t){var l=t.alternate;j(jt,jt.current&1),j(ml,t),_l===null&&(l===null||pa.current!==null||l.memoizedState!==null)&&(_l=t)}function lc(t){j(jt,jt.current),j(ml,t),_l===null&&(_l=t)}function es(t){t.tag===22?(j(jt,jt.current),j(ml,t),_l===null&&(_l=t)):he()}function he(){j(jt,jt.current),j(ml,ml.current)}function hl(t){M(ml),_l===t&&(_l=null),M(jt)}var jt=o(0);function dn(t){for(var l=t;l!==null;){if(l.tag===13){var e=l.memoizedState;if(e!==null&&(e=e.dehydrated,e===null||ff(e)||rf(e)))return l}else if(l.tag===19&&(l.memoizedProps.revealOrder==="forwards"||l.memoizedProps.revealOrder==="backwards"||l.memoizedProps.revealOrder==="unstable_legacy-backwards"||l.memoizedProps.revealOrder==="together")){if((l.flags&128)!==0)return l}else if(l.child!==null){l.child.return=l,l=l.child;continue}if(l===t)break;for(;l.sibling===null;){if(l.return===null||l.return===t)return null;l=l.return}l.sibling.return=l.return,l=l.sibling}return null}var Kl=0,W=null,vt=null,Bt=null,yn=!1,Sa=!1,Ke=!1,mn=0,cu=0,xa=null,zy=0;function Dt(){throw Error(f(321))}function ec(t,l){if(l===null)return!1;for(var e=0;e<l.length&&e<t.length;e++)if(!dl(t[e],l[e]))return!1;return!0}function ac(t,l,e,a,u,n){return Kl=n,W=l,l.memoizedState=null,l.updateQueue=null,l.lanes=0,x.H=t===null||t.memoizedState===null?Gs:bc,Ke=!1,n=e(a,u),Ke=!1,Sa&&(n=us(l,e,a,u)),as(t),n}function as(t){x.H=su;var l=vt!==null&&vt.next!==null;if(Kl=0,Bt=vt=W=null,yn=!1,cu=0,xa=null,l)throw Error(f(300));t===null||qt||(t=t.dependencies,t!==null&&an(t)&&(qt=!0))}function us(t,l,e,a){W=t;var u=0;do{if(Sa&&(xa=null),cu=0,Sa=!1,25<=u)throw Error(f(301));if(u+=1,Bt=vt=null,t.updateQueue!=null){var n=t.updateQueue;n.lastEffect=null,n.events=null,n.stores=null,n.memoCache!=null&&(n.memoCache.index=0)}x.H=Xs,n=l(e,a)}while(Sa);return n}function Ty(){var t=x.H,l=t.useState()[0];return l=typeof l.then=="function"?fu(l):l,t=t.useState()[0],(vt!==null?vt.memoizedState:null)!==t&&(W.flags|=1024),l}function uc(){var t=mn!==0;return mn=0,t}function nc(t,l,e){l.updateQueue=t.updateQueue,l.flags&=-2053,t.lanes&=~e}function ic(t){if(yn){for(t=t.memoizedState;t!==null;){var l=t.queue;l!==null&&(l.pending=null),t=t.next}yn=!1}Kl=0,Bt=vt=W=null,Sa=!1,cu=mn=0,xa=null}function Ft(){var t={memoizedState:null,baseState:null,baseQueue:null,queue:null,next:null};return Bt===null?W.memoizedState=Bt=t:Bt=Bt.next=t,Bt}function Rt(){if(vt===null){var t=W.alternate;t=t!==null?t.memoizedState:null}else t=vt.next;var l=Bt===null?W.memoizedState:Bt.next;if(l!==null)Bt=l,vt=t;else{if(t===null)throw W.alternate===null?Error(f(467)):Error(f(310));vt=t,t={memoizedState:vt.memoizedState,baseState:vt.baseState,baseQueue:vt.baseQueue,queue:vt.queue,next:null},Bt===null?W.memoizedState=Bt=t:Bt=Bt.next=t}return Bt}function hn(){return{lastEffect:null,events:null,stores:null,memoCache:null}}function fu(t){var l=cu;return cu+=1,xa===null&&(xa=[]),t=kr(xa,t,l),l=W,(Bt===null?l.memoizedState:Bt.next)===null&&(l=l.alternate,x.H=l===null||l.memoizedState===null?Gs:bc),t}function gn(t){if(t!==null&&typeof t=="object"){if(typeof t.then=="function")return fu(t);if(t.$$typeof===zt)return Kt(t)}throw Error(f(438,String(t)))}function cc(t){var l=null,e=W.updateQueue;if(e!==null&&(l=e.memoCache),l==null){var a=W.alternate;a!==null&&(a=a.updateQueue,a!==null&&(a=a.memoCache,a!=null&&(l={data:a.data.map(function(u){return u.slice()}),index:0})))}if(l==null&&(l={data:[],index:0}),e===null&&(e=hn(),W.updateQueue=e),e.memoCache=l,e=l.data[l.index],e===void 0)for(e=l.data[l.index]=Array(t),a=0;a<t;a++)e[a]=pl;return l.index++,e}function Jl(t,l){return typeof l=="function"?l(t):l}function vn(t){var l=Rt();return fc(l,vt,t)}function fc(t,l,e){var a=t.queue;if(a===null)throw Error(f(311));a.lastRenderedReducer=e;var u=t.baseQueue,n=a.pending;if(n!==null){if(u!==null){var i=u.next;u.next=n.next,n.next=i}l.baseQueue=u=n,a.pending=null}if(n=t.baseState,u===null)t.memoizedState=n;else{l=u.next;var c=i=null,s=null,h=l,z=!1;do{var A=h.lane&-536870913;if(A!==h.lane?(et&A)===A:(Kl&A)===A){var g=h.revertLane;if(g===0)s!==null&&(s=s.next={lane:0,revertLane:0,gesture:null,action:h.action,hasEagerState:h.hasEagerState,eagerState:h.eagerState,next:null}),A===ha&&(z=!0);else if((Kl&g)===g){h=h.next,g===ha&&(z=!0);continue}else A={lane:0,revertLane:h.revertLane,gesture:null,action:h.action,hasEagerState:h.hasEagerState,eagerState:h.eagerState,next:null},s===null?(c=s=A,i=n):s=s.next=A,W.lanes|=g,be|=g;A=h.action,Ke&&e(n,A),n=h.hasEagerState?h.eagerState:e(n,A)}else g={lane:A,revertLane:h.revertLane,gesture:h.gesture,action:h.action,hasEagerState:h.hasEagerState,eagerState:h.eagerState,next:null},s===null?(c=s=g,i=n):s=s.next=g,W.lanes|=A,be|=A;h=h.next}while(h!==null&&h!==l);if(s===null?i=n:s.next=c,!dl(n,t.memoizedState)&&(qt=!0,z&&(e=ga,e!==null)))throw e;t.memoizedState=n,t.baseState=i,t.baseQueue=s,a.lastRenderedState=n}return u===null&&(a.lanes=0),[t.memoizedState,a.dispatch]}function rc(t){var l=Rt(),e=l.queue;if(e===null)throw Error(f(311));e.lastRenderedReducer=t;var a=e.dispatch,u=e.pending,n=l.memoizedState;if(u!==null){e.pending=null;var i=u=u.next;do n=t(n,i.action),i=i.next;while(i!==u);dl(n,l.memoizedState)||(qt=!0),l.memoizedState=n,l.baseQueue===null&&(l.baseState=n),e.lastRenderedState=n}return[n,a]}function ns(t,l,e){var a=W,u=Rt(),n=ut;if(n){if(e===void 0)throw Error(f(407));e=e()}else e=l();var i=!dl((vt||u).memoizedState,e);if(i&&(u.memoizedState=e,qt=!0),u=u.queue,dc(fs.bind(null,a,u,t),[t]),u.getSnapshot!==l||i||Bt!==null&&Bt.memoizedState.tag&1){if(a.flags|=2048,za(9,{destroy:void 0},cs.bind(null,a,u,e,l),null),St===null)throw Error(f(349));n||(Kl&127)!==0||is(a,l,e)}return e}function is(t,l,e){t.flags|=16384,t={getSnapshot:l,value:e},l=W.updateQueue,l===null?(l=hn(),W.updateQueue=l,l.stores=[t]):(e=l.stores,e===null?l.stores=[t]:e.push(t))}function cs(t,l,e,a){l.value=e,l.getSnapshot=a,rs(l)&&ss(t)}function fs(t,l,e){return e(function(){rs(l)&&ss(t)})}function rs(t){var l=t.getSnapshot;t=t.value;try{var e=l();return!dl(t,e)}catch{return!0}}function ss(t){var l=qe(t,2);l!==null&&fl(l,t,2)}function sc(t){var l=Ft();if(typeof t=="function"){var e=t;if(t=e(),Ke){ue(!0);try{e()}finally{ue(!1)}}}return l.memoizedState=l.baseState=t,l.queue={pending:null,lanes:0,dispatch:null,lastRenderedReducer:Jl,lastRenderedState:t},l}function os(t,l,e,a){return t.baseState=e,fc(t,vt,typeof a=="function"?a:Jl)}function Ay(t,l,e,a,u){if(Sn(t))throw Error(f(485));if(t=l.action,t!==null){var n={payload:u,action:t,next:null,isTransition:!0,status:"pending",value:null,reason:null,listeners:[],then:function(i){n.listeners.push(i)}};x.T!==null?e(!0):n.isTransition=!1,a(n),e=l.pending,e===null?(n.next=l.pending=n,ds(l,n)):(n.next=e.next,l.pending=e.next=n)}}function ds(t,l){var e=l.action,a=l.payload,u=t.state;if(l.isTransition){var n=x.T,i={};x.T=i;try{var c=e(u,a),s=x.S;s!==null&&s(i,c),ys(t,l,c)}catch(h){oc(t,l,h)}finally{n!==null&&i.types!==null&&(n.types=i.types),x.T=n}}else try{n=e(u,a),ys(t,l,n)}catch(h){oc(t,l,h)}}function ys(t,l,e){e!==null&&typeof e=="object"&&typeof e.then=="function"?e.then(function(a){ms(t,l,a)},function(a){return oc(t,l,a)}):ms(t,l,e)}function ms(t,l,e){l.status="fulfilled",l.value=e,hs(l),t.state=e,l=t.pending,l!==null&&(e=l.next,e===l?t.pending=null:(e=e.next,l.next=e,ds(t,e)))}function oc(t,l,e){var a=t.pending;if(t.pending=null,a!==null){a=a.next;do l.status="rejected",l.reason=e,hs(l),l=l.next;while(l!==a)}t.action=null}function hs(t){t=t.listeners;for(var l=0;l<t.length;l++)(0,t[l])()}function gs(t,l){return l}function vs(t,l){if(ut){var e=St.formState;if(e!==null){t:{var a=W;if(ut){if(Tt){l:{for(var u=Tt,n=Ml;u.nodeType!==8;){if(!n){u=null;break l}if(u=Ol(u.nextSibling),u===null){u=null;break l}}n=u.data,u=n==="F!"||n==="F"?u:null}if(u){Tt=Ol(u.nextSibling),a=u.data==="F!";break t}}re(a)}a=!1}a&&(l=e[0])}}return e=Ft(),e.memoizedState=e.baseState=l,a={pending:null,lanes:0,dispatch:null,lastRenderedReducer:gs,lastRenderedState:l},e.queue=a,e=Bs.bind(null,W,a),a.dispatch=e,a=sc(!1),n=vc.bind(null,W,!1,a.queue),a=Ft(),u={state:l,dispatch:null,action:t,pending:null},a.queue=u,e=Ay.bind(null,W,u,n,e),u.dispatch=e,a.memoizedState=t,[l,e,!1]}function bs(t){var l=Rt();return ps(l,vt,t)}function ps(t,l,e){if(l=fc(t,l,gs)[0],t=vn(Jl)[0],typeof l=="object"&&l!==null&&typeof l.then=="function")try{var a=fu(l)}catch(i){throw i===va?cn:i}else a=l;l=Rt();var u=l.queue,n=u.dispatch;return e!==l.memoizedState&&(W.flags|=2048,za(9,{destroy:void 0},Ey.bind(null,u,e),null)),[a,n,t]}function Ey(t,l){t.action=l}function Ss(t){var l=Rt(),e=vt;if(e!==null)return ps(l,e,t);Rt(),l=l.memoizedState,e=Rt();var a=e.queue.dispatch;return e.memoizedState=t,[l,a,!1]}function za(t,l,e,a){return t={tag:t,create:e,deps:a,inst:l,next:null},l=W.updateQueue,l===null&&(l=hn(),W.updateQueue=l),e=l.lastEffect,e===null?l.lastEffect=t.next=t:(a=e.next,e.next=t,t.next=a,l.lastEffect=t),t}function xs(){return Rt().memoizedState}function bn(t,l,e,a){var u=Ft();W.flags|=t,u.memoizedState=za(1|l,{destroy:void 0},e,a===void 0?null:a)}function pn(t,l,e,a){var u=Rt();a=a===void 0?null:a;var n=u.memoizedState.inst;vt!==null&&a!==null&&ec(a,vt.memoizedState.deps)?u.memoizedState=za(l,n,e,a):(W.flags|=t,u.memoizedState=za(1|l,n,e,a))}function zs(t,l){bn(8390656,8,t,l)}function dc(t,l){pn(2048,8,t,l)}function My(t){W.flags|=4;var l=W.updateQueue;if(l===null)l=hn(),W.updateQueue=l,l.events=[t];else{var e=l.events;e===null?l.events=[t]:e.push(t)}}function Ts(t){var l=Rt().memoizedState;return My({ref:l,nextImpl:t}),function(){if((st&2)!==0)throw Error(f(440));return l.impl.apply(void 0,arguments)}}function As(t,l){return pn(4,2,t,l)}function Es(t,l){return pn(4,4,t,l)}function Ms(t,l){if(typeof l=="function"){t=t();var e=l(t);return function(){typeof e=="function"?e():l(null)}}if(l!=null)return t=t(),l.current=t,function(){l.current=null}}function _s(t,l,e){e=e!=null?e.concat([t]):null,pn(4,4,Ms.bind(null,l,t),e)}function yc(){}function Os(t,l){var e=Rt();l=l===void 0?null:l;var a=e.memoizedState;return l!==null&&ec(l,a[1])?a[0]:(e.memoizedState=[t,l],t)}function Ns(t,l){var e=Rt();l=l===void 0?null:l;var a=e.memoizedState;if(l!==null&&ec(l,a[1]))return a[0];if(a=t(),Ke){ue(!0);try{t()}finally{ue(!1)}}return e.memoizedState=[a,l],a}function mc(t,l,e){return e===void 0||(Kl&1073741824)!==0&&(et&261930)===0?t.memoizedState=l:(t.memoizedState=e,t=Uo(),W.lanes|=t,be|=t,e)}function Ds(t,l,e,a){return dl(e,l)?e:pa.current!==null?(t=mc(t,e,a),dl(t,l)||(qt=!0),t):(Kl&42)===0||(Kl&1073741824)!==0&&(et&261930)===0?(qt=!0,t.memoizedState=e):(t=Uo(),W.lanes|=t,be|=t,l)}function Us(t,l,e,a,u){var n=C.p;C.p=n!==0&&8>n?n:8;var i=x.T,c={};x.T=c,vc(t,!1,l,e);try{var s=u(),h=x.S;if(h!==null&&h(c,s),s!==null&&typeof s=="object"&&typeof s.then=="function"){var z=xy(s,a);ru(t,l,z,bl(t))}else ru(t,l,a,bl(t))}catch(A){ru(t,l,{then:function(){},status:"rejected",reason:A},bl())}finally{C.p=n,i!==null&&c.types!==null&&(i.types=c.types),x.T=i}}function _y(){}function hc(t,l,e,a){if(t.tag!==5)throw Error(f(476));var u=Cs(t).queue;Us(t,u,l,Z,e===null?_y:function(){return js(t),e(a)})}function Cs(t){var l=t.memoizedState;if(l!==null)return l;l={memoizedState:Z,baseState:Z,baseQueue:null,queue:{pending:null,lanes:0,dispatch:null,lastRenderedReducer:Jl,lastRenderedState:Z},next:null};var e={};return l.next={memoizedState:e,baseState:e,baseQueue:null,queue:{pending:null,lanes:0,dispatch:null,lastRenderedReducer:Jl,lastRenderedState:e},next:null},t.memoizedState=l,t=t.alternate,t!==null&&(t.memoizedState=l),l}function js(t){var l=Cs(t);l.next===null&&(l=t.alternate.memoizedState),ru(t,l.next.queue,{},bl())}function gc(){return Kt(Mu)}function Rs(){return Rt().memoizedState}function Hs(){return Rt().memoizedState}function Oy(t){for(var l=t.return;l!==null;){switch(l.tag){case 24:case 3:var e=bl();t=de(e);var a=ye(l,t,e);a!==null&&(fl(a,l,e),uu(a,l,e)),l={cache:Vi()},t.payload=l;return}l=l.return}}function Ny(t,l,e){var a=bl();e={lane:a,revertLane:0,gesture:null,action:e,hasEagerState:!1,eagerState:null,next:null},Sn(t)?qs(l,e):(e=Ri(t,l,e,a),e!==null&&(fl(e,t,a),Ys(e,l,a)))}function Bs(t,l,e){var a=bl();ru(t,l,e,a)}function ru(t,l,e,a){var u={lane:a,revertLane:0,gesture:null,action:e,hasEagerState:!1,eagerState:null,next:null};if(Sn(t))qs(l,u);else{var n=t.alternate;if(t.lanes===0&&(n===null||n.lanes===0)&&(n=l.lastRenderedReducer,n!==null))try{var i=l.lastRenderedState,c=n(i,e);if(u.hasEagerState=!0,u.eagerState=c,dl(c,i))return Pu(t,l,u,0),St===null&&Iu(),!1}catch{}if(e=Ri(t,l,u,a),e!==null)return fl(e,t,a),Ys(e,l,a),!0}return!1}function vc(t,l,e,a){if(a={lane:2,revertLane:Wc(),gesture:null,action:a,hasEagerState:!1,eagerState:null,next:null},Sn(t)){if(l)throw Error(f(479))}else l=Ri(t,e,a,2),l!==null&&fl(l,t,2)}function Sn(t){var l=t.alternate;return t===W||l!==null&&l===W}function qs(t,l){Sa=yn=!0;var e=t.pending;e===null?l.next=l:(l.next=e.next,e.next=l),t.pending=l}function Ys(t,l,e){if((e&4194048)!==0){var a=l.lanes;a&=t.pendingLanes,e|=a,l.lanes=e,wf(t,e)}}var su={readContext:Kt,use:gn,useCallback:Dt,useContext:Dt,useEffect:Dt,useImperativeHandle:Dt,useLayoutEffect:Dt,useInsertionEffect:Dt,useMemo:Dt,useReducer:Dt,useRef:Dt,useState:Dt,useDebugValue:Dt,useDeferredValue:Dt,useTransition:Dt,useSyncExternalStore:Dt,useId:Dt,useHostTransitionStatus:Dt,useFormState:Dt,useActionState:Dt,useOptimistic:Dt,useMemoCache:Dt,useCacheRefresh:Dt};su.useEffectEvent=Dt;var Gs={readContext:Kt,use:gn,useCallback:function(t,l){return Ft().memoizedState=[t,l===void 0?null:l],t},useContext:Kt,useEffect:zs,useImperativeHandle:function(t,l,e){e=e!=null?e.concat([t]):null,bn(4194308,4,Ms.bind(null,l,t),e)},useLayoutEffect:function(t,l){return bn(4194308,4,t,l)},useInsertionEffect:function(t,l){bn(4,2,t,l)},useMemo:function(t,l){var e=Ft();l=l===void 0?null:l;var a=t();if(Ke){ue(!0);try{t()}finally{ue(!1)}}return e.memoizedState=[a,l],a},useReducer:function(t,l,e){var a=Ft();if(e!==void 0){var u=e(l);if(Ke){ue(!0);try{e(l)}finally{ue(!1)}}}else u=l;return a.memoizedState=a.baseState=u,t={pending:null,lanes:0,dispatch:null,lastRenderedReducer:t,lastRenderedState:u},a.queue=t,t=t.dispatch=Ny.bind(null,W,t),[a.memoizedState,t]},useRef:function(t){var l=Ft();return t={current:t},l.memoizedState=t},useState:function(t){t=sc(t);var l=t.queue,e=Bs.bind(null,W,l);return l.dispatch=e,[t.memoizedState,e]},useDebugValue:yc,useDeferredValue:function(t,l){var e=Ft();return mc(e,t,l)},useTransition:function(){var t=sc(!1);return t=Us.bind(null,W,t.queue,!0,!1),Ft().memoizedState=t,[!1,t]},useSyncExternalStore:function(t,l,e){var a=W,u=Ft();if(ut){if(e===void 0)throw Error(f(407));e=e()}else{if(e=l(),St===null)throw Error(f(349));(et&127)!==0||is(a,l,e)}u.memoizedState=e;var n={value:e,getSnapshot:l};return u.queue=n,zs(fs.bind(null,a,n,t),[t]),a.flags|=2048,za(9,{destroy:void 0},cs.bind(null,a,n,e,l),null),e},useId:function(){var t=Ft(),l=St.identifierPrefix;if(ut){var e=Bl,a=Hl;e=(a&~(1<<32-ol(a)-1)).toString(32)+e,l="_"+l+"R_"+e,e=mn++,0<e&&(l+="H"+e.toString(32)),l+="_"}else e=zy++,l="_"+l+"r_"+e.toString(32)+"_";return t.memoizedState=l},useHostTransitionStatus:gc,useFormState:vs,useActionState:vs,useOptimistic:function(t){var l=Ft();l.memoizedState=l.baseState=t;var e={pending:null,lanes:0,dispatch:null,lastRenderedReducer:null,lastRenderedState:null};return l.queue=e,l=vc.bind(null,W,!0,e),e.dispatch=l,[t,l]},useMemoCache:cc,useCacheRefresh:function(){return Ft().memoizedState=Oy.bind(null,W)},useEffectEvent:function(t){var l=Ft(),e={impl:t};return l.memoizedState=e,function(){if((st&2)!==0)throw Error(f(440));return e.impl.apply(void 0,arguments)}}},bc={readContext:Kt,use:gn,useCallback:Os,useContext:Kt,useEffect:dc,useImperativeHandle:_s,useInsertionEffect:As,useLayoutEffect:Es,useMemo:Ns,useReducer:vn,useRef:xs,useState:function(){return vn(Jl)},useDebugValue:yc,useDeferredValue:function(t,l){var e=Rt();return Ds(e,vt.memoizedState,t,l)},useTransition:function(){var t=vn(Jl)[0],l=Rt().memoizedState;return[typeof t=="boolean"?t:fu(t),l]},useSyncExternalStore:ns,useId:Rs,useHostTransitionStatus:gc,useFormState:bs,useActionState:bs,useOptimistic:function(t,l){var e=Rt();return os(e,vt,t,l)},useMemoCache:cc,useCacheRefresh:Hs};bc.useEffectEvent=Ts;var Xs={readContext:Kt,use:gn,useCallback:Os,useContext:Kt,useEffect:dc,useImperativeHandle:_s,useInsertionEffect:As,useLayoutEffect:Es,useMemo:Ns,useReducer:rc,useRef:xs,useState:function(){return rc(Jl)},useDebugValue:yc,useDeferredValue:function(t,l){var e=Rt();return vt===null?mc(e,t,l):Ds(e,vt.memoizedState,t,l)},useTransition:function(){var t=rc(Jl)[0],l=Rt().memoizedState;return[typeof t=="boolean"?t:fu(t),l]},useSyncExternalStore:ns,useId:Rs,useHostTransitionStatus:gc,useFormState:Ss,useActionState:Ss,useOptimistic:function(t,l){var e=Rt();return vt!==null?os(e,vt,t,l):(e.baseState=t,[t,e.queue.dispatch])},useMemoCache:cc,useCacheRefresh:Hs};Xs.useEffectEvent=Ts;function pc(t,l,e,a){l=t.memoizedState,e=e(a,l),e=e==null?l:H({},l,e),t.memoizedState=e,t.lanes===0&&(t.updateQueue.baseState=e)}var Sc={enqueueSetState:function(t,l,e){t=t._reactInternals;var a=bl(),u=de(a);u.payload=l,e!=null&&(u.callback=e),l=ye(t,u,a),l!==null&&(fl(l,t,a),uu(l,t,a))},enqueueReplaceState:function(t,l,e){t=t._reactInternals;var a=bl(),u=de(a);u.tag=1,u.payload=l,e!=null&&(u.callback=e),l=ye(t,u,a),l!==null&&(fl(l,t,a),uu(l,t,a))},enqueueForceUpdate:function(t,l){t=t._reactInternals;var e=bl(),a=de(e);a.tag=2,l!=null&&(a.callback=l),l=ye(t,a,e),l!==null&&(fl(l,t,e),uu(l,t,e))}};function Qs(t,l,e,a,u,n,i){return t=t.stateNode,typeof t.shouldComponentUpdate=="function"?t.shouldComponentUpdate(a,n,i):l.prototype&&l.prototype.isPureReactComponent?!$a(e,a)||!$a(u,n):!0}function Zs(t,l,e,a){t=l.state,typeof l.componentWillReceiveProps=="function"&&l.componentWillReceiveProps(e,a),typeof l.UNSAFE_componentWillReceiveProps=="function"&&l.UNSAFE_componentWillReceiveProps(e,a),l.state!==t&&Sc.enqueueReplaceState(l,l.state,null)}function Je(t,l){var e=l;if("ref"in l){e={};for(var a in l)a!=="ref"&&(e[a]=l[a])}if(t=t.defaultProps){e===l&&(e=H({},e));for(var u in t)e[u]===void 0&&(e[u]=t[u])}return e}function ws(t){Fu(t)}function Ls(t){console.error(t)}function Vs(t){Fu(t)}function xn(t,l){try{var e=t.onUncaughtError;e(l.value,{componentStack:l.stack})}catch(a){setTimeout(function(){throw a})}}function Ks(t,l,e){try{var a=t.onCaughtError;a(e.value,{componentStack:e.stack,errorBoundary:l.tag===1?l.stateNode:null})}catch(u){setTimeout(function(){throw u})}}function xc(t,l,e){return e=de(e),e.tag=3,e.payload={element:null},e.callback=function(){xn(t,l)},e}function Js(t){return t=de(t),t.tag=3,t}function ks(t,l,e,a){var u=e.type.getDerivedStateFromError;if(typeof u=="function"){var n=a.value;t.payload=function(){return u(n)},t.callback=function(){Ks(l,e,a)}}var i=e.stateNode;i!==null&&typeof i.componentDidCatch=="function"&&(t.callback=function(){Ks(l,e,a),typeof u!="function"&&(pe===null?pe=new Set([this]):pe.add(this));var c=a.stack;this.componentDidCatch(a.value,{componentStack:c!==null?c:""})})}function Dy(t,l,e,a,u){if(e.flags|=32768,a!==null&&typeof a=="object"&&typeof a.then=="function"){if(l=e.alternate,l!==null&&ma(l,e,u,!0),e=ml.current,e!==null){switch(e.tag){case 31:case 13:return _l===null?jn():e.alternate===null&&Ut===0&&(Ut=3),e.flags&=-257,e.flags|=65536,e.lanes=u,a===fn?e.flags|=16384:(l=e.updateQueue,l===null?e.updateQueue=new Set([a]):l.add(a),Kc(t,a,u)),!1;case 22:return e.flags|=65536,a===fn?e.flags|=16384:(l=e.updateQueue,l===null?(l={transitions:null,markerInstances:null,retryQueue:new Set([a])},e.updateQueue=l):(e=l.retryQueue,e===null?l.retryQueue=new Set([a]):e.add(a)),Kc(t,a,u)),!1}throw Error(f(435,e.tag))}return Kc(t,a,u),jn(),!1}if(ut)return l=ml.current,l!==null?((l.flags&65536)===0&&(l.flags|=256),l.flags|=65536,l.lanes=u,a!==Xi&&(t=Error(f(422),{cause:a}),Pa(Tl(t,e)))):(a!==Xi&&(l=Error(f(423),{cause:a}),Pa(Tl(l,e))),t=t.current.alternate,t.flags|=65536,u&=-u,t.lanes|=u,a=Tl(a,e),u=xc(t.stateNode,a,u),Fi(t,u),Ut!==4&&(Ut=2)),!1;var n=Error(f(520),{cause:a});if(n=Tl(n,e),bu===null?bu=[n]:bu.push(n),Ut!==4&&(Ut=2),l===null)return!0;a=Tl(a,e),e=l;do{switch(e.tag){case 3:return e.flags|=65536,t=u&-u,e.lanes|=t,t=xc(e.stateNode,a,t),Fi(e,t),!1;case 1:if(l=e.type,n=e.stateNode,(e.flags&128)===0&&(typeof l.getDerivedStateFromError=="function"||n!==null&&typeof n.componentDidCatch=="function"&&(pe===null||!pe.has(n))))return e.flags|=65536,u&=-u,e.lanes|=u,u=Js(u),ks(u,t,e,a),Fi(e,u),!1}e=e.return}while(e!==null);return!1}var zc=Error(f(461)),qt=!1;function Jt(t,l,e,a){l.child=t===null?Ir(l,null,e,a):Ve(l,t.child,e,a)}function Ws(t,l,e,a,u){e=e.render;var n=l.ref;if("ref"in a){var i={};for(var c in a)c!=="ref"&&(i[c]=a[c])}else i=a;return Qe(l),a=ac(t,l,e,i,n,u),c=uc(),t!==null&&!qt?(nc(t,l,u),kl(t,l,u)):(ut&&c&&Yi(l),l.flags|=1,Jt(t,l,a,u),l.child)}function $s(t,l,e,a,u){if(t===null){var n=e.type;return typeof n=="function"&&!Hi(n)&&n.defaultProps===void 0&&e.compare===null?(l.tag=15,l.type=n,Fs(t,l,n,a,u)):(t=ln(e.type,null,a,l,l.mode,u),t.ref=l.ref,t.return=l,l.child=t)}if(n=t.child,!Dc(t,u)){var i=n.memoizedProps;if(e=e.compare,e=e!==null?e:$a,e(i,a)&&t.ref===l.ref)return kl(t,l,u)}return l.flags|=1,t=Zl(n,a),t.ref=l.ref,t.return=l,l.child=t}function Fs(t,l,e,a,u){if(t!==null){var n=t.memoizedProps;if($a(n,a)&&t.ref===l.ref)if(qt=!1,l.pendingProps=a=n,Dc(t,u))(t.flags&131072)!==0&&(qt=!0);else return l.lanes=t.lanes,kl(t,l,u)}return Tc(t,l,e,a,u)}function Is(t,l,e,a){var u=a.children,n=t!==null?t.memoizedState:null;if(t===null&&l.stateNode===null&&(l.stateNode={_visibility:1,_pendingMarkers:null,_retryCache:null,_transitions:null}),a.mode==="hidden"){if((l.flags&128)!==0){if(n=n!==null?n.baseLanes|e:e,t!==null){for(a=l.child=t.child,u=0;a!==null;)u=u|a.lanes|a.childLanes,a=a.sibling;a=u&~n}else a=0,l.child=null;return Ps(t,l,n,e,a)}if((e&536870912)!==0)l.memoizedState={baseLanes:0,cachePool:null},t!==null&&nn(l,n!==null?n.cachePool:null),n!==null?ls(l,n):Pi(),es(l);else return a=l.lanes=536870912,Ps(t,l,n!==null?n.baseLanes|e:e,e,a)}else n!==null?(nn(l,n.cachePool),ls(l,n),he(),l.memoizedState=null):(t!==null&&nn(l,null),Pi(),he());return Jt(t,l,u,e),l.child}function ou(t,l){return t!==null&&t.tag===22||l.stateNode!==null||(l.stateNode={_visibility:1,_pendingMarkers:null,_retryCache:null,_transitions:null}),l.sibling}function Ps(t,l,e,a,u){var n=Ji();return n=n===null?null:{parent:Ht._currentValue,pool:n},l.memoizedState={baseLanes:e,cachePool:n},t!==null&&nn(l,null),Pi(),es(l),t!==null&&ma(t,l,a,!0),l.childLanes=u,null}function zn(t,l){return l=An({mode:l.mode,children:l.children},t.mode),l.ref=t.ref,t.child=l,l.return=t,l}function to(t,l,e){return Ve(l,t.child,null,e),t=zn(l,l.pendingProps),t.flags|=2,hl(l),l.memoizedState=null,t}function Uy(t,l,e){var a=l.pendingProps,u=(l.flags&128)!==0;if(l.flags&=-129,t===null){if(ut){if(a.mode==="hidden")return t=zn(l,a),l.lanes=536870912,ou(null,t);if(lc(l),(t=Tt)?(t=yd(t,Ml),t=t!==null&&t.data==="&"?t:null,t!==null&&(l.memoizedState={dehydrated:t,treeContext:ce!==null?{id:Hl,overflow:Bl}:null,retryLane:536870912,hydrationErrors:null},e=qr(t),e.return=l,l.child=e,Vt=l,Tt=null)):t=null,t===null)throw re(l);return l.lanes=536870912,null}return zn(l,a)}var n=t.memoizedState;if(n!==null){var i=n.dehydrated;if(lc(l),u)if(l.flags&256)l.flags&=-257,l=to(t,l,e);else if(l.memoizedState!==null)l.child=t.child,l.flags|=128,l=null;else throw Error(f(558));else if(qt||ma(t,l,e,!1),u=(e&t.childLanes)!==0,qt||u){if(a=St,a!==null&&(i=Lf(a,e),i!==0&&i!==n.retryLane))throw n.retryLane=i,qe(t,i),fl(a,t,i),zc;jn(),l=to(t,l,e)}else t=n.treeContext,Tt=Ol(i.nextSibling),Vt=l,ut=!0,fe=null,Ml=!1,t!==null&&Xr(l,t),l=zn(l,a),l.flags|=4096;return l}return t=Zl(t.child,{mode:a.mode,children:a.children}),t.ref=l.ref,l.child=t,t.return=l,t}function Tn(t,l){var e=l.ref;if(e===null)t!==null&&t.ref!==null&&(l.flags|=4194816);else{if(typeof e!="function"&&typeof e!="object")throw Error(f(284));(t===null||t.ref!==e)&&(l.flags|=4194816)}}function Tc(t,l,e,a,u){return Qe(l),e=ac(t,l,e,a,void 0,u),a=uc(),t!==null&&!qt?(nc(t,l,u),kl(t,l,u)):(ut&&a&&Yi(l),l.flags|=1,Jt(t,l,e,u),l.child)}function lo(t,l,e,a,u,n){return Qe(l),l.updateQueue=null,e=us(l,a,e,u),as(t),a=uc(),t!==null&&!qt?(nc(t,l,n),kl(t,l,n)):(ut&&a&&Yi(l),l.flags|=1,Jt(t,l,e,n),l.child)}function eo(t,l,e,a,u){if(Qe(l),l.stateNode===null){var n=sa,i=e.contextType;typeof i=="object"&&i!==null&&(n=Kt(i)),n=new e(a,n),l.memoizedState=n.state!==null&&n.state!==void 0?n.state:null,n.updater=Sc,l.stateNode=n,n._reactInternals=l,n=l.stateNode,n.props=a,n.state=l.memoizedState,n.refs={},Wi(l),i=e.contextType,n.context=typeof i=="object"&&i!==null?Kt(i):sa,n.state=l.memoizedState,i=e.getDerivedStateFromProps,typeof i=="function"&&(pc(l,e,i,a),n.state=l.memoizedState),typeof e.getDerivedStateFromProps=="function"||typeof n.getSnapshotBeforeUpdate=="function"||typeof n.UNSAFE_componentWillMount!="function"&&typeof n.componentWillMount!="function"||(i=n.state,typeof n.componentWillMount=="function"&&n.componentWillMount(),typeof n.UNSAFE_componentWillMount=="function"&&n.UNSAFE_componentWillMount(),i!==n.state&&Sc.enqueueReplaceState(n,n.state,null),iu(l,a,n,u),nu(),n.state=l.memoizedState),typeof n.componentDidMount=="function"&&(l.flags|=4194308),a=!0}else if(t===null){n=l.stateNode;var c=l.memoizedProps,s=Je(e,c);n.props=s;var h=n.context,z=e.contextType;i=sa,typeof z=="object"&&z!==null&&(i=Kt(z));var A=e.getDerivedStateFromProps;z=typeof A=="function"||typeof n.getSnapshotBeforeUpdate=="function",c=l.pendingProps!==c,z||typeof n.UNSAFE_componentWillReceiveProps!="function"&&typeof n.componentWillReceiveProps!="function"||(c||h!==i)&&Zs(l,n,a,i),oe=!1;var g=l.memoizedState;n.state=g,iu(l,a,n,u),nu(),h=l.memoizedState,c||g!==h||oe?(typeof A=="function"&&(pc(l,e,A,a),h=l.memoizedState),(s=oe||Qs(l,e,s,a,g,h,i))?(z||typeof n.UNSAFE_componentWillMount!="function"&&typeof n.componentWillMount!="function"||(typeof n.componentWillMount=="function"&&n.componentWillMount(),typeof n.UNSAFE_componentWillMount=="function"&&n.UNSAFE_componentWillMount()),typeof n.componentDidMount=="function"&&(l.flags|=4194308)):(typeof n.componentDidMount=="function"&&(l.flags|=4194308),l.memoizedProps=a,l.memoizedState=h),n.props=a,n.state=h,n.context=i,a=s):(typeof n.componentDidMount=="function"&&(l.flags|=4194308),a=!1)}else{n=l.stateNode,$i(t,l),i=l.memoizedProps,z=Je(e,i),n.props=z,A=l.pendingProps,g=n.context,h=e.contextType,s=sa,typeof h=="object"&&h!==null&&(s=Kt(h)),c=e.getDerivedStateFromProps,(h=typeof c=="function"||typeof n.getSnapshotBeforeUpdate=="function")||typeof n.UNSAFE_componentWillReceiveProps!="function"&&typeof n.componentWillReceiveProps!="function"||(i!==A||g!==s)&&Zs(l,n,a,s),oe=!1,g=l.memoizedState,n.state=g,iu(l,a,n,u),nu();var b=l.memoizedState;i!==A||g!==b||oe||t!==null&&t.dependencies!==null&&an(t.dependencies)?(typeof c=="function"&&(pc(l,e,c,a),b=l.memoizedState),(z=oe||Qs(l,e,z,a,g,b,s)||t!==null&&t.dependencies!==null&&an(t.dependencies))?(h||typeof n.UNSAFE_componentWillUpdate!="function"&&typeof n.componentWillUpdate!="function"||(typeof n.componentWillUpdate=="function"&&n.componentWillUpdate(a,b,s),typeof n.UNSAFE_componentWillUpdate=="function"&&n.UNSAFE_componentWillUpdate(a,b,s)),typeof n.componentDidUpdate=="function"&&(l.flags|=4),typeof n.getSnapshotBeforeUpdate=="function"&&(l.flags|=1024)):(typeof n.componentDidUpdate!="function"||i===t.memoizedProps&&g===t.memoizedState||(l.flags|=4),typeof n.getSnapshotBeforeUpdate!="function"||i===t.memoizedProps&&g===t.memoizedState||(l.flags|=1024),l.memoizedProps=a,l.memoizedState=b),n.props=a,n.state=b,n.context=s,a=z):(typeof n.componentDidUpdate!="function"||i===t.memoizedProps&&g===t.memoizedState||(l.flags|=4),typeof n.getSnapshotBeforeUpdate!="function"||i===t.memoizedProps&&g===t.memoizedState||(l.flags|=1024),a=!1)}return n=a,Tn(t,l),a=(l.flags&128)!==0,n||a?(n=l.stateNode,e=a&&typeof e.getDerivedStateFromError!="function"?null:n.render(),l.flags|=1,t!==null&&a?(l.child=Ve(l,t.child,null,u),l.child=Ve(l,null,e,u)):Jt(t,l,e,u),l.memoizedState=n.state,t=l.child):t=kl(t,l,u),t}function ao(t,l,e,a){return Ge(),l.flags|=256,Jt(t,l,e,a),l.child}var Ac={dehydrated:null,treeContext:null,retryLane:0,hydrationErrors:null};function Ec(t){return{baseLanes:t,cachePool:Kr()}}function Mc(t,l,e){return t=t!==null?t.childLanes&~e:0,l&&(t|=vl),t}function uo(t,l,e){var a=l.pendingProps,u=!1,n=(l.flags&128)!==0,i;if((i=n)||(i=t!==null&&t.memoizedState===null?!1:(jt.current&2)!==0),i&&(u=!0,l.flags&=-129),i=(l.flags&32)!==0,l.flags&=-33,t===null){if(ut){if(u?me(l):he(),(t=Tt)?(t=yd(t,Ml),t=t!==null&&t.data!=="&"?t:null,t!==null&&(l.memoizedState={dehydrated:t,treeContext:ce!==null?{id:Hl,overflow:Bl}:null,retryLane:536870912,hydrationErrors:null},e=qr(t),e.return=l,l.child=e,Vt=l,Tt=null)):t=null,t===null)throw re(l);return rf(t)?l.lanes=32:l.lanes=536870912,null}var c=a.children;return a=a.fallback,u?(he(),u=l.mode,c=An({mode:"hidden",children:c},u),a=Ye(a,u,e,null),c.return=l,a.return=l,c.sibling=a,l.child=c,a=l.child,a.memoizedState=Ec(e),a.childLanes=Mc(t,i,e),l.memoizedState=Ac,ou(null,a)):(me(l),_c(l,c))}var s=t.memoizedState;if(s!==null&&(c=s.dehydrated,c!==null)){if(n)l.flags&256?(me(l),l.flags&=-257,l=Oc(t,l,e)):l.memoizedState!==null?(he(),l.child=t.child,l.flags|=128,l=null):(he(),c=a.fallback,u=l.mode,a=An({mode:"visible",children:a.children},u),c=Ye(c,u,e,null),c.flags|=2,a.return=l,c.return=l,a.sibling=c,l.child=a,Ve(l,t.child,null,e),a=l.child,a.memoizedState=Ec(e),a.childLanes=Mc(t,i,e),l.memoizedState=Ac,l=ou(null,a));else if(me(l),rf(c)){if(i=c.nextSibling&&c.nextSibling.dataset,i)var h=i.dgst;i=h,a=Error(f(419)),a.stack="",a.digest=i,Pa({value:a,source:null,stack:null}),l=Oc(t,l,e)}else if(qt||ma(t,l,e,!1),i=(e&t.childLanes)!==0,qt||i){if(i=St,i!==null&&(a=Lf(i,e),a!==0&&a!==s.retryLane))throw s.retryLane=a,qe(t,a),fl(i,t,a),zc;ff(c)||jn(),l=Oc(t,l,e)}else ff(c)?(l.flags|=192,l.child=t.child,l=null):(t=s.treeContext,Tt=Ol(c.nextSibling),Vt=l,ut=!0,fe=null,Ml=!1,t!==null&&Xr(l,t),l=_c(l,a.children),l.flags|=4096);return l}return u?(he(),c=a.fallback,u=l.mode,s=t.child,h=s.sibling,a=Zl(s,{mode:"hidden",children:a.children}),a.subtreeFlags=s.subtreeFlags&65011712,h!==null?c=Zl(h,c):(c=Ye(c,u,e,null),c.flags|=2),c.return=l,a.return=l,a.sibling=c,l.child=a,ou(null,a),a=l.child,c=t.child.memoizedState,c===null?c=Ec(e):(u=c.cachePool,u!==null?(s=Ht._currentValue,u=u.parent!==s?{parent:s,pool:s}:u):u=Kr(),c={baseLanes:c.baseLanes|e,cachePool:u}),a.memoizedState=c,a.childLanes=Mc(t,i,e),l.memoizedState=Ac,ou(t.child,a)):(me(l),e=t.child,t=e.sibling,e=Zl(e,{mode:"visible",children:a.children}),e.return=l,e.sibling=null,t!==null&&(i=l.deletions,i===null?(l.deletions=[t],l.flags|=16):i.push(t)),l.child=e,l.memoizedState=null,e)}function _c(t,l){return l=An({mode:"visible",children:l},t.mode),l.return=t,t.child=l}function An(t,l){return t=yl(22,t,null,l),t.lanes=0,t}function Oc(t,l,e){return Ve(l,t.child,null,e),t=_c(l,l.pendingProps.children),t.flags|=2,l.memoizedState=null,t}function no(t,l,e){t.lanes|=l;var a=t.alternate;a!==null&&(a.lanes|=l),wi(t.return,l,e)}function Nc(t,l,e,a,u,n){var i=t.memoizedState;i===null?t.memoizedState={isBackwards:l,rendering:null,renderingStartTime:0,last:a,tail:e,tailMode:u,treeForkCount:n}:(i.isBackwards=l,i.rendering=null,i.renderingStartTime=0,i.last=a,i.tail=e,i.tailMode=u,i.treeForkCount=n)}function io(t,l,e){var a=l.pendingProps,u=a.revealOrder,n=a.tail;a=a.children;var i=jt.current,c=(i&2)!==0;if(c?(i=i&1|2,l.flags|=128):i&=1,j(jt,i),Jt(t,l,a,e),a=ut?Ia:0,!c&&t!==null&&(t.flags&128)!==0)t:for(t=l.child;t!==null;){if(t.tag===13)t.memoizedState!==null&&no(t,e,l);else if(t.tag===19)no(t,e,l);else if(t.child!==null){t.child.return=t,t=t.child;continue}if(t===l)break t;for(;t.sibling===null;){if(t.return===null||t.return===l)break t;t=t.return}t.sibling.return=t.return,t=t.sibling}switch(u){case"forwards":for(e=l.child,u=null;e!==null;)t=e.alternate,t!==null&&dn(t)===null&&(u=e),e=e.sibling;e=u,e===null?(u=l.child,l.child=null):(u=e.sibling,e.sibling=null),Nc(l,!1,u,e,n,a);break;case"backwards":case"unstable_legacy-backwards":for(e=null,u=l.child,l.child=null;u!==null;){if(t=u.alternate,t!==null&&dn(t)===null){l.child=u;break}t=u.sibling,u.sibling=e,e=u,u=t}Nc(l,!0,e,null,n,a);break;case"together":Nc(l,!1,null,null,void 0,a);break;default:l.memoizedState=null}return l.child}function kl(t,l,e){if(t!==null&&(l.dependencies=t.dependencies),be|=l.lanes,(e&l.childLanes)===0)if(t!==null){if(ma(t,l,e,!1),(e&l.childLanes)===0)return null}else return null;if(t!==null&&l.child!==t.child)throw Error(f(153));if(l.child!==null){for(t=l.child,e=Zl(t,t.pendingProps),l.child=e,e.return=l;t.sibling!==null;)t=t.sibling,e=e.sibling=Zl(t,t.pendingProps),e.return=l;e.sibling=null}return l.child}function Dc(t,l){return(t.lanes&l)!==0?!0:(t=t.dependencies,!!(t!==null&&an(t)))}function Cy(t,l,e){switch(l.tag){case 3:$t(l,l.stateNode.containerInfo),se(l,Ht,t.memoizedState.cache),Ge();break;case 27:case 5:qa(l);break;case 4:$t(l,l.stateNode.containerInfo);break;case 10:se(l,l.type,l.memoizedProps.value);break;case 31:if(l.memoizedState!==null)return l.flags|=128,lc(l),null;break;case 13:var a=l.memoizedState;if(a!==null)return a.dehydrated!==null?(me(l),l.flags|=128,null):(e&l.child.childLanes)!==0?uo(t,l,e):(me(l),t=kl(t,l,e),t!==null?t.sibling:null);me(l);break;case 19:var u=(t.flags&128)!==0;if(a=(e&l.childLanes)!==0,a||(ma(t,l,e,!1),a=(e&l.childLanes)!==0),u){if(a)return io(t,l,e);l.flags|=128}if(u=l.memoizedState,u!==null&&(u.rendering=null,u.tail=null,u.lastEffect=null),j(jt,jt.current),a)break;return null;case 22:return l.lanes=0,Is(t,l,e,l.pendingProps);case 24:se(l,Ht,t.memoizedState.cache)}return kl(t,l,e)}function co(t,l,e){if(t!==null)if(t.memoizedProps!==l.pendingProps)qt=!0;else{if(!Dc(t,e)&&(l.flags&128)===0)return qt=!1,Cy(t,l,e);qt=(t.flags&131072)!==0}else qt=!1,ut&&(l.flags&1048576)!==0&&Gr(l,Ia,l.index);switch(l.lanes=0,l.tag){case 16:t:{var a=l.pendingProps;if(t=we(l.elementType),l.type=t,typeof t=="function")Hi(t)?(a=Je(t,a),l.tag=1,l=eo(null,l,t,a,e)):(l.tag=0,l=Tc(null,l,t,a,e));else{if(t!=null){var u=t.$$typeof;if(u===_t){l.tag=11,l=Ws(null,l,t,a,e);break t}else if(u===J){l.tag=14,l=$s(null,l,t,a,e);break t}}throw l=tl(t)||t,Error(f(306,l,""))}}return l;case 0:return Tc(t,l,l.type,l.pendingProps,e);case 1:return a=l.type,u=Je(a,l.pendingProps),eo(t,l,a,u,e);case 3:t:{if($t(l,l.stateNode.containerInfo),t===null)throw Error(f(387));a=l.pendingProps;var n=l.memoizedState;u=n.element,$i(t,l),iu(l,a,null,e);var i=l.memoizedState;if(a=i.cache,se(l,Ht,a),a!==n.cache&&Li(l,[Ht],e,!0),nu(),a=i.element,n.isDehydrated)if(n={element:a,isDehydrated:!1,cache:i.cache},l.updateQueue.baseState=n,l.memoizedState=n,l.flags&256){l=ao(t,l,a,e);break t}else if(a!==u){u=Tl(Error(f(424)),l),Pa(u),l=ao(t,l,a,e);break t}else for(t=l.stateNode.containerInfo,t.nodeType===9?t=t.body:t=t.nodeName==="HTML"?t.ownerDocument.body:t,Tt=Ol(t.firstChild),Vt=l,ut=!0,fe=null,Ml=!0,e=Ir(l,null,a,e),l.child=e;e;)e.flags=e.flags&-3|4096,e=e.sibling;else{if(Ge(),a===u){l=kl(t,l,e);break t}Jt(t,l,a,e)}l=l.child}return l;case 26:return Tn(t,l),t===null?(e=pd(l.type,null,l.pendingProps,null))?l.memoizedState=e:ut||(e=l.type,t=l.pendingProps,a=Xn(P.current).createElement(e),a[Lt]=l,a[el]=t,kt(a,e,t),Qt(a),l.stateNode=a):l.memoizedState=pd(l.type,t.memoizedProps,l.pendingProps,t.memoizedState),null;case 27:return qa(l),t===null&&ut&&(a=l.stateNode=gd(l.type,l.pendingProps,P.current),Vt=l,Ml=!0,u=Tt,Te(l.type)?(sf=u,Tt=Ol(a.firstChild)):Tt=u),Jt(t,l,l.pendingProps.children,e),Tn(t,l),t===null&&(l.flags|=4194304),l.child;case 5:return t===null&&ut&&((u=a=Tt)&&(a=fm(a,l.type,l.pendingProps,Ml),a!==null?(l.stateNode=a,Vt=l,Tt=Ol(a.firstChild),Ml=!1,u=!0):u=!1),u||re(l)),qa(l),u=l.type,n=l.pendingProps,i=t!==null?t.memoizedProps:null,a=n.children,uf(u,n)?a=null:i!==null&&uf(u,i)&&(l.flags|=32),l.memoizedState!==null&&(u=ac(t,l,Ty,null,null,e),Mu._currentValue=u),Tn(t,l),Jt(t,l,a,e),l.child;case 6:return t===null&&ut&&((t=e=Tt)&&(e=rm(e,l.pendingProps,Ml),e!==null?(l.stateNode=e,Vt=l,Tt=null,t=!0):t=!1),t||re(l)),null;case 13:return uo(t,l,e);case 4:return $t(l,l.stateNode.containerInfo),a=l.pendingProps,t===null?l.child=Ve(l,null,a,e):Jt(t,l,a,e),l.child;case 11:return Ws(t,l,l.type,l.pendingProps,e);case 7:return Jt(t,l,l.pendingProps,e),l.child;case 8:return Jt(t,l,l.pendingProps.children,e),l.child;case 12:return Jt(t,l,l.pendingProps.children,e),l.child;case 10:return a=l.pendingProps,se(l,l.type,a.value),Jt(t,l,a.children,e),l.child;case 9:return u=l.type._context,a=l.pendingProps.children,Qe(l),u=Kt(u),a=a(u),l.flags|=1,Jt(t,l,a,e),l.child;case 14:return $s(t,l,l.type,l.pendingProps,e);case 15:return Fs(t,l,l.type,l.pendingProps,e);case 19:return io(t,l,e);case 31:return Uy(t,l,e);case 22:return Is(t,l,e,l.pendingProps);case 24:return Qe(l),a=Kt(Ht),t===null?(u=Ji(),u===null&&(u=St,n=Vi(),u.pooledCache=n,n.refCount++,n!==null&&(u.pooledCacheLanes|=e),u=n),l.memoizedState={parent:a,cache:u},Wi(l),se(l,Ht,u)):((t.lanes&e)!==0&&($i(t,l),iu(l,null,null,e),nu()),u=t.memoizedState,n=l.memoizedState,u.parent!==a?(u={parent:a,cache:a},l.memoizedState=u,l.lanes===0&&(l.memoizedState=l.updateQueue.baseState=u),se(l,Ht,a)):(a=n.cache,se(l,Ht,a),a!==u.cache&&Li(l,[Ht],e,!0))),Jt(t,l,l.pendingProps.children,e),l.child;case 29:throw l.pendingProps}throw Error(f(156,l.tag))}function Wl(t){t.flags|=4}function Uc(t,l,e,a,u){if((l=(t.mode&32)!==0)&&(l=!1),l){if(t.flags|=16777216,(u&335544128)===u)if(t.stateNode.complete)t.flags|=8192;else if(Ho())t.flags|=8192;else throw Le=fn,ki}else t.flags&=-16777217}function fo(t,l){if(l.type!=="stylesheet"||(l.state.loading&4)!==0)t.flags&=-16777217;else if(t.flags|=16777216,!Ad(l))if(Ho())t.flags|=8192;else throw Le=fn,ki}function En(t,l){l!==null&&(t.flags|=4),t.flags&16384&&(l=t.tag!==22?Qf():536870912,t.lanes|=l,Ma|=l)}function du(t,l){if(!ut)switch(t.tailMode){case"hidden":l=t.tail;for(var e=null;l!==null;)l.alternate!==null&&(e=l),l=l.sibling;e===null?t.tail=null:e.sibling=null;break;case"collapsed":e=t.tail;for(var a=null;e!==null;)e.alternate!==null&&(a=e),e=e.sibling;a===null?l||t.tail===null?t.tail=null:t.tail.sibling=null:a.sibling=null}}function At(t){var l=t.alternate!==null&&t.alternate.child===t.child,e=0,a=0;if(l)for(var u=t.child;u!==null;)e|=u.lanes|u.childLanes,a|=u.subtreeFlags&65011712,a|=u.flags&65011712,u.return=t,u=u.sibling;else for(u=t.child;u!==null;)e|=u.lanes|u.childLanes,a|=u.subtreeFlags,a|=u.flags,u.return=t,u=u.sibling;return t.subtreeFlags|=a,t.childLanes=e,l}function jy(t,l,e){var a=l.pendingProps;switch(Gi(l),l.tag){case 16:case 15:case 0:case 11:case 7:case 8:case 12:case 9:case 14:return At(l),null;case 1:return At(l),null;case 3:return e=l.stateNode,a=null,t!==null&&(a=t.memoizedState.cache),l.memoizedState.cache!==a&&(l.flags|=2048),Vl(Ht),Ct(),e.pendingContext&&(e.context=e.pendingContext,e.pendingContext=null),(t===null||t.child===null)&&(ya(l)?Wl(l):t===null||t.memoizedState.isDehydrated&&(l.flags&256)===0||(l.flags|=1024,Qi())),At(l),null;case 26:var u=l.type,n=l.memoizedState;return t===null?(Wl(l),n!==null?(At(l),fo(l,n)):(At(l),Uc(l,u,null,a,e))):n?n!==t.memoizedState?(Wl(l),At(l),fo(l,n)):(At(l),l.flags&=-16777217):(t=t.memoizedProps,t!==a&&Wl(l),At(l),Uc(l,u,t,a,e)),null;case 27:if(Hu(l),e=P.current,u=l.type,t!==null&&l.stateNode!=null)t.memoizedProps!==a&&Wl(l);else{if(!a){if(l.stateNode===null)throw Error(f(166));return At(l),null}t=q.current,ya(l)?Qr(l):(t=gd(u,a,e),l.stateNode=t,Wl(l))}return At(l),null;case 5:if(Hu(l),u=l.type,t!==null&&l.stateNode!=null)t.memoizedProps!==a&&Wl(l);else{if(!a){if(l.stateNode===null)throw Error(f(166));return At(l),null}if(n=q.current,ya(l))Qr(l);else{var i=Xn(P.current);switch(n){case 1:n=i.createElementNS("http://www.w3.org/2000/svg",u);break;case 2:n=i.createElementNS("http://www.w3.org/1998/Math/MathML",u);break;default:switch(u){case"svg":n=i.createElementNS("http://www.w3.org/2000/svg",u);break;case"math":n=i.createElementNS("http://www.w3.org/1998/Math/MathML",u);break;case"script":n=i.createElement("div"),n.innerHTML="<script><\/script>",n=n.removeChild(n.firstChild);break;case"select":n=typeof a.is=="string"?i.createElement("select",{is:a.is}):i.createElement("select"),a.multiple?n.multiple=!0:a.size&&(n.size=a.size);break;default:n=typeof a.is=="string"?i.createElement(u,{is:a.is}):i.createElement(u)}}n[Lt]=l,n[el]=a;t:for(i=l.child;i!==null;){if(i.tag===5||i.tag===6)n.appendChild(i.stateNode);else if(i.tag!==4&&i.tag!==27&&i.child!==null){i.child.return=i,i=i.child;continue}if(i===l)break t;for(;i.sibling===null;){if(i.return===null||i.return===l)break t;i=i.return}i.sibling.return=i.return,i=i.sibling}l.stateNode=n;t:switch(kt(n,u,a),u){case"button":case"input":case"select":case"textarea":a=!!a.autoFocus;break t;case"img":a=!0;break t;default:a=!1}a&&Wl(l)}}return At(l),Uc(l,l.type,t===null?null:t.memoizedProps,l.pendingProps,e),null;case 6:if(t&&l.stateNode!=null)t.memoizedProps!==a&&Wl(l);else{if(typeof a!="string"&&l.stateNode===null)throw Error(f(166));if(t=P.current,ya(l)){if(t=l.stateNode,e=l.memoizedProps,a=null,u=Vt,u!==null)switch(u.tag){case 27:case 5:a=u.memoizedProps}t[Lt]=l,t=!!(t.nodeValue===e||a!==null&&a.suppressHydrationWarning===!0||nd(t.nodeValue,e)),t||re(l,!0)}else t=Xn(t).createTextNode(a),t[Lt]=l,l.stateNode=t}return At(l),null;case 31:if(e=l.memoizedState,t===null||t.memoizedState!==null){if(a=ya(l),e!==null){if(t===null){if(!a)throw Error(f(318));if(t=l.memoizedState,t=t!==null?t.dehydrated:null,!t)throw Error(f(557));t[Lt]=l}else Ge(),(l.flags&128)===0&&(l.memoizedState=null),l.flags|=4;At(l),t=!1}else e=Qi(),t!==null&&t.memoizedState!==null&&(t.memoizedState.hydrationErrors=e),t=!0;if(!t)return l.flags&256?(hl(l),l):(hl(l),null);if((l.flags&128)!==0)throw Error(f(558))}return At(l),null;case 13:if(a=l.memoizedState,t===null||t.memoizedState!==null&&t.memoizedState.dehydrated!==null){if(u=ya(l),a!==null&&a.dehydrated!==null){if(t===null){if(!u)throw Error(f(318));if(u=l.memoizedState,u=u!==null?u.dehydrated:null,!u)throw Error(f(317));u[Lt]=l}else Ge(),(l.flags&128)===0&&(l.memoizedState=null),l.flags|=4;At(l),u=!1}else u=Qi(),t!==null&&t.memoizedState!==null&&(t.memoizedState.hydrationErrors=u),u=!0;if(!u)return l.flags&256?(hl(l),l):(hl(l),null)}return hl(l),(l.flags&128)!==0?(l.lanes=e,l):(e=a!==null,t=t!==null&&t.memoizedState!==null,e&&(a=l.child,u=null,a.alternate!==null&&a.alternate.memoizedState!==null&&a.alternate.memoizedState.cachePool!==null&&(u=a.alternate.memoizedState.cachePool.pool),n=null,a.memoizedState!==null&&a.memoizedState.cachePool!==null&&(n=a.memoizedState.cachePool.pool),n!==u&&(a.flags|=2048)),e!==t&&e&&(l.child.flags|=8192),En(l,l.updateQueue),At(l),null);case 4:return Ct(),t===null&&Pc(l.stateNode.containerInfo),At(l),null;case 10:return Vl(l.type),At(l),null;case 19:if(M(jt),a=l.memoizedState,a===null)return At(l),null;if(u=(l.flags&128)!==0,n=a.rendering,n===null)if(u)du(a,!1);else{if(Ut!==0||t!==null&&(t.flags&128)!==0)for(t=l.child;t!==null;){if(n=dn(t),n!==null){for(l.flags|=128,du(a,!1),t=n.updateQueue,l.updateQueue=t,En(l,t),l.subtreeFlags=0,t=e,e=l.child;e!==null;)Br(e,t),e=e.sibling;return j(jt,jt.current&1|2),ut&&wl(l,a.treeForkCount),l.child}t=t.sibling}a.tail!==null&&rl()>Dn&&(l.flags|=128,u=!0,du(a,!1),l.lanes=4194304)}else{if(!u)if(t=dn(n),t!==null){if(l.flags|=128,u=!0,t=t.updateQueue,l.updateQueue=t,En(l,t),du(a,!0),a.tail===null&&a.tailMode==="hidden"&&!n.alternate&&!ut)return At(l),null}else 2*rl()-a.renderingStartTime>Dn&&e!==536870912&&(l.flags|=128,u=!0,du(a,!1),l.lanes=4194304);a.isBackwards?(n.sibling=l.child,l.child=n):(t=a.last,t!==null?t.sibling=n:l.child=n,a.last=n)}return a.tail!==null?(t=a.tail,a.rendering=t,a.tail=t.sibling,a.renderingStartTime=rl(),t.sibling=null,e=jt.current,j(jt,u?e&1|2:e&1),ut&&wl(l,a.treeForkCount),t):(At(l),null);case 22:case 23:return hl(l),tc(),a=l.memoizedState!==null,t!==null?t.memoizedState!==null!==a&&(l.flags|=8192):a&&(l.flags|=8192),a?(e&536870912)!==0&&(l.flags&128)===0&&(At(l),l.subtreeFlags&6&&(l.flags|=8192)):At(l),e=l.updateQueue,e!==null&&En(l,e.retryQueue),e=null,t!==null&&t.memoizedState!==null&&t.memoizedState.cachePool!==null&&(e=t.memoizedState.cachePool.pool),a=null,l.memoizedState!==null&&l.memoizedState.cachePool!==null&&(a=l.memoizedState.cachePool.pool),a!==e&&(l.flags|=2048),t!==null&&M(Ze),null;case 24:return e=null,t!==null&&(e=t.memoizedState.cache),l.memoizedState.cache!==e&&(l.flags|=2048),Vl(Ht),At(l),null;case 25:return null;case 30:return null}throw Error(f(156,l.tag))}function Ry(t,l){switch(Gi(l),l.tag){case 1:return t=l.flags,t&65536?(l.flags=t&-65537|128,l):null;case 3:return Vl(Ht),Ct(),t=l.flags,(t&65536)!==0&&(t&128)===0?(l.flags=t&-65537|128,l):null;case 26:case 27:case 5:return Hu(l),null;case 31:if(l.memoizedState!==null){if(hl(l),l.alternate===null)throw Error(f(340));Ge()}return t=l.flags,t&65536?(l.flags=t&-65537|128,l):null;case 13:if(hl(l),t=l.memoizedState,t!==null&&t.dehydrated!==null){if(l.alternate===null)throw Error(f(340));Ge()}return t=l.flags,t&65536?(l.flags=t&-65537|128,l):null;case 19:return M(jt),null;case 4:return Ct(),null;case 10:return Vl(l.type),null;case 22:case 23:return hl(l),tc(),t!==null&&M(Ze),t=l.flags,t&65536?(l.flags=t&-65537|128,l):null;case 24:return Vl(Ht),null;case 25:return null;default:return null}}function ro(t,l){switch(Gi(l),l.tag){case 3:Vl(Ht),Ct();break;case 26:case 27:case 5:Hu(l);break;case 4:Ct();break;case 31:l.memoizedState!==null&&hl(l);break;case 13:hl(l);break;case 19:M(jt);break;case 10:Vl(l.type);break;case 22:case 23:hl(l),tc(),t!==null&&M(Ze);break;case 24:Vl(Ht)}}function yu(t,l){try{var e=l.updateQueue,a=e!==null?e.lastEffect:null;if(a!==null){var u=a.next;e=u;do{if((e.tag&t)===t){a=void 0;var n=e.create,i=e.inst;a=n(),i.destroy=a}e=e.next}while(e!==u)}}catch(c){ht(l,l.return,c)}}function ge(t,l,e){try{var a=l.updateQueue,u=a!==null?a.lastEffect:null;if(u!==null){var n=u.next;a=n;do{if((a.tag&t)===t){var i=a.inst,c=i.destroy;if(c!==void 0){i.destroy=void 0,u=l;var s=e,h=c;try{h()}catch(z){ht(u,s,z)}}}a=a.next}while(a!==n)}}catch(z){ht(l,l.return,z)}}function so(t){var l=t.updateQueue;if(l!==null){var e=t.stateNode;try{ts(l,e)}catch(a){ht(t,t.return,a)}}}function oo(t,l,e){e.props=Je(t.type,t.memoizedProps),e.state=t.memoizedState;try{e.componentWillUnmount()}catch(a){ht(t,l,a)}}function mu(t,l){try{var e=t.ref;if(e!==null){switch(t.tag){case 26:case 27:case 5:var a=t.stateNode;break;case 30:a=t.stateNode;break;default:a=t.stateNode}typeof e=="function"?t.refCleanup=e(a):e.current=a}}catch(u){ht(t,l,u)}}function ql(t,l){var e=t.ref,a=t.refCleanup;if(e!==null)if(typeof a=="function")try{a()}catch(u){ht(t,l,u)}finally{t.refCleanup=null,t=t.alternate,t!=null&&(t.refCleanup=null)}else if(typeof e=="function")try{e(null)}catch(u){ht(t,l,u)}else e.current=null}function yo(t){var l=t.type,e=t.memoizedProps,a=t.stateNode;try{t:switch(l){case"button":case"input":case"select":case"textarea":e.autoFocus&&a.focus();break t;case"img":e.src?a.src=e.src:e.srcSet&&(a.srcset=e.srcSet)}}catch(u){ht(t,t.return,u)}}function Cc(t,l,e){try{var a=t.stateNode;em(a,t.type,e,l),a[el]=l}catch(u){ht(t,t.return,u)}}function mo(t){return t.tag===5||t.tag===3||t.tag===26||t.tag===27&&Te(t.type)||t.tag===4}function jc(t){t:for(;;){for(;t.sibling===null;){if(t.return===null||mo(t.return))return null;t=t.return}for(t.sibling.return=t.return,t=t.sibling;t.tag!==5&&t.tag!==6&&t.tag!==18;){if(t.tag===27&&Te(t.type)||t.flags&2||t.child===null||t.tag===4)continue t;t.child.return=t,t=t.child}if(!(t.flags&2))return t.stateNode}}function Rc(t,l,e){var a=t.tag;if(a===5||a===6)t=t.stateNode,l?(e.nodeType===9?e.body:e.nodeName==="HTML"?e.ownerDocument.body:e).insertBefore(t,l):(l=e.nodeType===9?e.body:e.nodeName==="HTML"?e.ownerDocument.body:e,l.appendChild(t),e=e._reactRootContainer,e!=null||l.onclick!==null||(l.onclick=Xl));else if(a!==4&&(a===27&&Te(t.type)&&(e=t.stateNode,l=null),t=t.child,t!==null))for(Rc(t,l,e),t=t.sibling;t!==null;)Rc(t,l,e),t=t.sibling}function Mn(t,l,e){var a=t.tag;if(a===5||a===6)t=t.stateNode,l?e.insertBefore(t,l):e.appendChild(t);else if(a!==4&&(a===27&&Te(t.type)&&(e=t.stateNode),t=t.child,t!==null))for(Mn(t,l,e),t=t.sibling;t!==null;)Mn(t,l,e),t=t.sibling}function ho(t){var l=t.stateNode,e=t.memoizedProps;try{for(var a=t.type,u=l.attributes;u.length;)l.removeAttributeNode(u[0]);kt(l,a,e),l[Lt]=t,l[el]=e}catch(n){ht(t,t.return,n)}}var $l=!1,Yt=!1,Hc=!1,go=typeof WeakSet=="function"?WeakSet:Set,Zt=null;function Hy(t,l){if(t=t.containerInfo,ef=Jn,t=_r(t),Oi(t)){if("selectionStart"in t)var e={start:t.selectionStart,end:t.selectionEnd};else t:{e=(e=t.ownerDocument)&&e.defaultView||window;var a=e.getSelection&&e.getSelection();if(a&&a.rangeCount!==0){e=a.anchorNode;var u=a.anchorOffset,n=a.focusNode;a=a.focusOffset;try{e.nodeType,n.nodeType}catch{e=null;break t}var i=0,c=-1,s=-1,h=0,z=0,A=t,g=null;l:for(;;){for(var b;A!==e||u!==0&&A.nodeType!==3||(c=i+u),A!==n||a!==0&&A.nodeType!==3||(s=i+a),A.nodeType===3&&(i+=A.nodeValue.length),(b=A.firstChild)!==null;)g=A,A=b;for(;;){if(A===t)break l;if(g===e&&++h===u&&(c=i),g===n&&++z===a&&(s=i),(b=A.nextSibling)!==null)break;A=g,g=A.parentNode}A=b}e=c===-1||s===-1?null:{start:c,end:s}}else e=null}e=e||{start:0,end:0}}else e=null;for(af={focusedElem:t,selectionRange:e},Jn=!1,Zt=l;Zt!==null;)if(l=Zt,t=l.child,(l.subtreeFlags&1028)!==0&&t!==null)t.return=l,Zt=t;else for(;Zt!==null;){switch(l=Zt,n=l.alternate,t=l.flags,l.tag){case 0:if((t&4)!==0&&(t=l.updateQueue,t=t!==null?t.events:null,t!==null))for(e=0;e<t.length;e++)u=t[e],u.ref.impl=u.nextImpl;break;case 11:case 15:break;case 1:if((t&1024)!==0&&n!==null){t=void 0,e=l,u=n.memoizedProps,n=n.memoizedState,a=e.stateNode;try{var B=Je(e.type,u);t=a.getSnapshotBeforeUpdate(B,n),a.__reactInternalSnapshotBeforeUpdate=t}catch(w){ht(e,e.return,w)}}break;case 3:if((t&1024)!==0){if(t=l.stateNode.containerInfo,e=t.nodeType,e===9)cf(t);else if(e===1)switch(t.nodeName){case"HEAD":case"HTML":case"BODY":cf(t);break;default:t.textContent=""}}break;case 5:case 26:case 27:case 6:case 4:case 17:break;default:if((t&1024)!==0)throw Error(f(163))}if(t=l.sibling,t!==null){t.return=l.return,Zt=t;break}Zt=l.return}}function vo(t,l,e){var a=e.flags;switch(e.tag){case 0:case 11:case 15:Il(t,e),a&4&&yu(5,e);break;case 1:if(Il(t,e),a&4)if(t=e.stateNode,l===null)try{t.componentDidMount()}catch(i){ht(e,e.return,i)}else{var u=Je(e.type,l.memoizedProps);l=l.memoizedState;try{t.componentDidUpdate(u,l,t.__reactInternalSnapshotBeforeUpdate)}catch(i){ht(e,e.return,i)}}a&64&&so(e),a&512&&mu(e,e.return);break;case 3:if(Il(t,e),a&64&&(t=e.updateQueue,t!==null)){if(l=null,e.child!==null)switch(e.child.tag){case 27:case 5:l=e.child.stateNode;break;case 1:l=e.child.stateNode}try{ts(t,l)}catch(i){ht(e,e.return,i)}}break;case 27:l===null&&a&4&&ho(e);case 26:case 5:Il(t,e),l===null&&a&4&&yo(e),a&512&&mu(e,e.return);break;case 12:Il(t,e);break;case 31:Il(t,e),a&4&&So(t,e);break;case 13:Il(t,e),a&4&&xo(t,e),a&64&&(t=e.memoizedState,t!==null&&(t=t.dehydrated,t!==null&&(e=Ly.bind(null,e),sm(t,e))));break;case 22:if(a=e.memoizedState!==null||$l,!a){l=l!==null&&l.memoizedState!==null||Yt,u=$l;var n=Yt;$l=a,(Yt=l)&&!n?Pl(t,e,(e.subtreeFlags&8772)!==0):Il(t,e),$l=u,Yt=n}break;case 30:break;default:Il(t,e)}}function bo(t){var l=t.alternate;l!==null&&(t.alternate=null,bo(l)),t.child=null,t.deletions=null,t.sibling=null,t.tag===5&&(l=t.stateNode,l!==null&&oi(l)),t.stateNode=null,t.return=null,t.dependencies=null,t.memoizedProps=null,t.memoizedState=null,t.pendingProps=null,t.stateNode=null,t.updateQueue=null}var Mt=null,ul=!1;function Fl(t,l,e){for(e=e.child;e!==null;)po(t,l,e),e=e.sibling}function po(t,l,e){if(sl&&typeof sl.onCommitFiberUnmount=="function")try{sl.onCommitFiberUnmount(Ya,e)}catch{}switch(e.tag){case 26:Yt||ql(e,l),Fl(t,l,e),e.memoizedState?e.memoizedState.count--:e.stateNode&&(e=e.stateNode,e.parentNode.removeChild(e));break;case 27:Yt||ql(e,l);var a=Mt,u=ul;Te(e.type)&&(Mt=e.stateNode,ul=!1),Fl(t,l,e),Tu(e.stateNode),Mt=a,ul=u;break;case 5:Yt||ql(e,l);case 6:if(a=Mt,u=ul,Mt=null,Fl(t,l,e),Mt=a,ul=u,Mt!==null)if(ul)try{(Mt.nodeType===9?Mt.body:Mt.nodeName==="HTML"?Mt.ownerDocument.body:Mt).removeChild(e.stateNode)}catch(n){ht(e,l,n)}else try{Mt.removeChild(e.stateNode)}catch(n){ht(e,l,n)}break;case 18:Mt!==null&&(ul?(t=Mt,od(t.nodeType===9?t.body:t.nodeName==="HTML"?t.ownerDocument.body:t,e.stateNode),Ra(t)):od(Mt,e.stateNode));break;case 4:a=Mt,u=ul,Mt=e.stateNode.containerInfo,ul=!0,Fl(t,l,e),Mt=a,ul=u;break;case 0:case 11:case 14:case 15:ge(2,e,l),Yt||ge(4,e,l),Fl(t,l,e);break;case 1:Yt||(ql(e,l),a=e.stateNode,typeof a.componentWillUnmount=="function"&&oo(e,l,a)),Fl(t,l,e);break;case 21:Fl(t,l,e);break;case 22:Yt=(a=Yt)||e.memoizedState!==null,Fl(t,l,e),Yt=a;break;default:Fl(t,l,e)}}function So(t,l){if(l.memoizedState===null&&(t=l.alternate,t!==null&&(t=t.memoizedState,t!==null))){t=t.dehydrated;try{Ra(t)}catch(e){ht(l,l.return,e)}}}function xo(t,l){if(l.memoizedState===null&&(t=l.alternate,t!==null&&(t=t.memoizedState,t!==null&&(t=t.dehydrated,t!==null))))try{Ra(t)}catch(e){ht(l,l.return,e)}}function By(t){switch(t.tag){case 31:case 13:case 19:var l=t.stateNode;return l===null&&(l=t.stateNode=new go),l;case 22:return t=t.stateNode,l=t._retryCache,l===null&&(l=t._retryCache=new go),l;default:throw Error(f(435,t.tag))}}function _n(t,l){var e=By(t);l.forEach(function(a){if(!e.has(a)){e.add(a);var u=Vy.bind(null,t,a);a.then(u,u)}})}function nl(t,l){var e=l.deletions;if(e!==null)for(var a=0;a<e.length;a++){var u=e[a],n=t,i=l,c=i;t:for(;c!==null;){switch(c.tag){case 27:if(Te(c.type)){Mt=c.stateNode,ul=!1;break t}break;case 5:Mt=c.stateNode,ul=!1;break t;case 3:case 4:Mt=c.stateNode.containerInfo,ul=!0;break t}c=c.return}if(Mt===null)throw Error(f(160));po(n,i,u),Mt=null,ul=!1,n=u.alternate,n!==null&&(n.return=null),u.return=null}if(l.subtreeFlags&13886)for(l=l.child;l!==null;)zo(l,t),l=l.sibling}var Cl=null;function zo(t,l){var e=t.alternate,a=t.flags;switch(t.tag){case 0:case 11:case 14:case 15:nl(l,t),il(t),a&4&&(ge(3,t,t.return),yu(3,t),ge(5,t,t.return));break;case 1:nl(l,t),il(t),a&512&&(Yt||e===null||ql(e,e.return)),a&64&&$l&&(t=t.updateQueue,t!==null&&(a=t.callbacks,a!==null&&(e=t.shared.hiddenCallbacks,t.shared.hiddenCallbacks=e===null?a:e.concat(a))));break;case 26:var u=Cl;if(nl(l,t),il(t),a&512&&(Yt||e===null||ql(e,e.return)),a&4){var n=e!==null?e.memoizedState:null;if(a=t.memoizedState,e===null)if(a===null)if(t.stateNode===null){t:{a=t.type,e=t.memoizedProps,u=u.ownerDocument||u;l:switch(a){case"title":n=u.getElementsByTagName("title")[0],(!n||n[Qa]||n[Lt]||n.namespaceURI==="http://www.w3.org/2000/svg"||n.hasAttribute("itemprop"))&&(n=u.createElement(a),u.head.insertBefore(n,u.querySelector("head > title"))),kt(n,a,e),n[Lt]=t,Qt(n),a=n;break t;case"link":var i=zd("link","href",u).get(a+(e.href||""));if(i){for(var c=0;c<i.length;c++)if(n=i[c],n.getAttribute("href")===(e.href==null||e.href===""?null:e.href)&&n.getAttribute("rel")===(e.rel==null?null:e.rel)&&n.getAttribute("title")===(e.title==null?null:e.title)&&n.getAttribute("crossorigin")===(e.crossOrigin==null?null:e.crossOrigin)){i.splice(c,1);break l}}n=u.createElement(a),kt(n,a,e),u.head.appendChild(n);break;case"meta":if(i=zd("meta","content",u).get(a+(e.content||""))){for(c=0;c<i.length;c++)if(n=i[c],n.getAttribute("content")===(e.content==null?null:""+e.content)&&n.getAttribute("name")===(e.name==null?null:e.name)&&n.getAttribute("property")===(e.property==null?null:e.property)&&n.getAttribute("http-equiv")===(e.httpEquiv==null?null:e.httpEquiv)&&n.getAttribute("charset")===(e.charSet==null?null:e.charSet)){i.splice(c,1);break l}}n=u.createElement(a),kt(n,a,e),u.head.appendChild(n);break;default:throw Error(f(468,a))}n[Lt]=t,Qt(n),a=n}t.stateNode=a}else Td(u,t.type,t.stateNode);else t.stateNode=xd(u,a,t.memoizedProps);else n!==a?(n===null?e.stateNode!==null&&(e=e.stateNode,e.parentNode.removeChild(e)):n.count--,a===null?Td(u,t.type,t.stateNode):xd(u,a,t.memoizedProps)):a===null&&t.stateNode!==null&&Cc(t,t.memoizedProps,e.memoizedProps)}break;case 27:nl(l,t),il(t),a&512&&(Yt||e===null||ql(e,e.return)),e!==null&&a&4&&Cc(t,t.memoizedProps,e.memoizedProps);break;case 5:if(nl(l,t),il(t),a&512&&(Yt||e===null||ql(e,e.return)),t.flags&32){u=t.stateNode;try{aa(u,"")}catch(B){ht(t,t.return,B)}}a&4&&t.stateNode!=null&&(u=t.memoizedProps,Cc(t,u,e!==null?e.memoizedProps:u)),a&1024&&(Hc=!0);break;case 6:if(nl(l,t),il(t),a&4){if(t.stateNode===null)throw Error(f(162));a=t.memoizedProps,e=t.stateNode;try{e.nodeValue=a}catch(B){ht(t,t.return,B)}}break;case 3:if(wn=null,u=Cl,Cl=Qn(l.containerInfo),nl(l,t),Cl=u,il(t),a&4&&e!==null&&e.memoizedState.isDehydrated)try{Ra(l.containerInfo)}catch(B){ht(t,t.return,B)}Hc&&(Hc=!1,To(t));break;case 4:a=Cl,Cl=Qn(t.stateNode.containerInfo),nl(l,t),il(t),Cl=a;break;case 12:nl(l,t),il(t);break;case 31:nl(l,t),il(t),a&4&&(a=t.updateQueue,a!==null&&(t.updateQueue=null,_n(t,a)));break;case 13:nl(l,t),il(t),t.child.flags&8192&&t.memoizedState!==null!=(e!==null&&e.memoizedState!==null)&&(Nn=rl()),a&4&&(a=t.updateQueue,a!==null&&(t.updateQueue=null,_n(t,a)));break;case 22:u=t.memoizedState!==null;var s=e!==null&&e.memoizedState!==null,h=$l,z=Yt;if($l=h||u,Yt=z||s,nl(l,t),Yt=z,$l=h,il(t),a&8192)t:for(l=t.stateNode,l._visibility=u?l._visibility&-2:l._visibility|1,u&&(e===null||s||$l||Yt||ke(t)),e=null,l=t;;){if(l.tag===5||l.tag===26){if(e===null){s=e=l;try{if(n=s.stateNode,u)i=n.style,typeof i.setProperty=="function"?i.setProperty("display","none","important"):i.display="none";else{c=s.stateNode;var A=s.memoizedProps.style,g=A!=null&&A.hasOwnProperty("display")?A.display:null;c.style.display=g==null||typeof g=="boolean"?"":(""+g).trim()}}catch(B){ht(s,s.return,B)}}}else if(l.tag===6){if(e===null){s=l;try{s.stateNode.nodeValue=u?"":s.memoizedProps}catch(B){ht(s,s.return,B)}}}else if(l.tag===18){if(e===null){s=l;try{var b=s.stateNode;u?dd(b,!0):dd(s.stateNode,!1)}catch(B){ht(s,s.return,B)}}}else if((l.tag!==22&&l.tag!==23||l.memoizedState===null||l===t)&&l.child!==null){l.child.return=l,l=l.child;continue}if(l===t)break t;for(;l.sibling===null;){if(l.return===null||l.return===t)break t;e===l&&(e=null),l=l.return}e===l&&(e=null),l.sibling.return=l.return,l=l.sibling}a&4&&(a=t.updateQueue,a!==null&&(e=a.retryQueue,e!==null&&(a.retryQueue=null,_n(t,e))));break;case 19:nl(l,t),il(t),a&4&&(a=t.updateQueue,a!==null&&(t.updateQueue=null,_n(t,a)));break;case 30:break;case 21:break;default:nl(l,t),il(t)}}function il(t){var l=t.flags;if(l&2){try{for(var e,a=t.return;a!==null;){if(mo(a)){e=a;break}a=a.return}if(e==null)throw Error(f(160));switch(e.tag){case 27:var u=e.stateNode,n=jc(t);Mn(t,n,u);break;case 5:var i=e.stateNode;e.flags&32&&(aa(i,""),e.flags&=-33);var c=jc(t);Mn(t,c,i);break;case 3:case 4:var s=e.stateNode.containerInfo,h=jc(t);Rc(t,h,s);break;default:throw Error(f(161))}}catch(z){ht(t,t.return,z)}t.flags&=-3}l&4096&&(t.flags&=-4097)}function To(t){if(t.subtreeFlags&1024)for(t=t.child;t!==null;){var l=t;To(l),l.tag===5&&l.flags&1024&&l.stateNode.reset(),t=t.sibling}}function Il(t,l){if(l.subtreeFlags&8772)for(l=l.child;l!==null;)vo(t,l.alternate,l),l=l.sibling}function ke(t){for(t=t.child;t!==null;){var l=t;switch(l.tag){case 0:case 11:case 14:case 15:ge(4,l,l.return),ke(l);break;case 1:ql(l,l.return);var e=l.stateNode;typeof e.componentWillUnmount=="function"&&oo(l,l.return,e),ke(l);break;case 27:Tu(l.stateNode);case 26:case 5:ql(l,l.return),ke(l);break;case 22:l.memoizedState===null&&ke(l);break;case 30:ke(l);break;default:ke(l)}t=t.sibling}}function Pl(t,l,e){for(e=e&&(l.subtreeFlags&8772)!==0,l=l.child;l!==null;){var a=l.alternate,u=t,n=l,i=n.flags;switch(n.tag){case 0:case 11:case 15:Pl(u,n,e),yu(4,n);break;case 1:if(Pl(u,n,e),a=n,u=a.stateNode,typeof u.componentDidMount=="function")try{u.componentDidMount()}catch(h){ht(a,a.return,h)}if(a=n,u=a.updateQueue,u!==null){var c=a.stateNode;try{var s=u.shared.hiddenCallbacks;if(s!==null)for(u.shared.hiddenCallbacks=null,u=0;u<s.length;u++)Pr(s[u],c)}catch(h){ht(a,a.return,h)}}e&&i&64&&so(n),mu(n,n.return);break;case 27:ho(n);case 26:case 5:Pl(u,n,e),e&&a===null&&i&4&&yo(n),mu(n,n.return);break;case 12:Pl(u,n,e);break;case 31:Pl(u,n,e),e&&i&4&&So(u,n);break;case 13:Pl(u,n,e),e&&i&4&&xo(u,n);break;case 22:n.memoizedState===null&&Pl(u,n,e),mu(n,n.return);break;case 30:break;default:Pl(u,n,e)}l=l.sibling}}function Bc(t,l){var e=null;t!==null&&t.memoizedState!==null&&t.memoizedState.cachePool!==null&&(e=t.memoizedState.cachePool.pool),t=null,l.memoizedState!==null&&l.memoizedState.cachePool!==null&&(t=l.memoizedState.cachePool.pool),t!==e&&(t!=null&&t.refCount++,e!=null&&tu(e))}function qc(t,l){t=null,l.alternate!==null&&(t=l.alternate.memoizedState.cache),l=l.memoizedState.cache,l!==t&&(l.refCount++,t!=null&&tu(t))}function jl(t,l,e,a){if(l.subtreeFlags&10256)for(l=l.child;l!==null;)Ao(t,l,e,a),l=l.sibling}function Ao(t,l,e,a){var u=l.flags;switch(l.tag){case 0:case 11:case 15:jl(t,l,e,a),u&2048&&yu(9,l);break;case 1:jl(t,l,e,a);break;case 3:jl(t,l,e,a),u&2048&&(t=null,l.alternate!==null&&(t=l.alternate.memoizedState.cache),l=l.memoizedState.cache,l!==t&&(l.refCount++,t!=null&&tu(t)));break;case 12:if(u&2048){jl(t,l,e,a),t=l.stateNode;try{var n=l.memoizedProps,i=n.id,c=n.onPostCommit;typeof c=="function"&&c(i,l.alternate===null?"mount":"update",t.passiveEffectDuration,-0)}catch(s){ht(l,l.return,s)}}else jl(t,l,e,a);break;case 31:jl(t,l,e,a);break;case 13:jl(t,l,e,a);break;case 23:break;case 22:n=l.stateNode,i=l.alternate,l.memoizedState!==null?n._visibility&2?jl(t,l,e,a):hu(t,l):n._visibility&2?jl(t,l,e,a):(n._visibility|=2,Ta(t,l,e,a,(l.subtreeFlags&10256)!==0||!1)),u&2048&&Bc(i,l);break;case 24:jl(t,l,e,a),u&2048&&qc(l.alternate,l);break;default:jl(t,l,e,a)}}function Ta(t,l,e,a,u){for(u=u&&((l.subtreeFlags&10256)!==0||!1),l=l.child;l!==null;){var n=t,i=l,c=e,s=a,h=i.flags;switch(i.tag){case 0:case 11:case 15:Ta(n,i,c,s,u),yu(8,i);break;case 23:break;case 22:var z=i.stateNode;i.memoizedState!==null?z._visibility&2?Ta(n,i,c,s,u):hu(n,i):(z._visibility|=2,Ta(n,i,c,s,u)),u&&h&2048&&Bc(i.alternate,i);break;case 24:Ta(n,i,c,s,u),u&&h&2048&&qc(i.alternate,i);break;default:Ta(n,i,c,s,u)}l=l.sibling}}function hu(t,l){if(l.subtreeFlags&10256)for(l=l.child;l!==null;){var e=t,a=l,u=a.flags;switch(a.tag){case 22:hu(e,a),u&2048&&Bc(a.alternate,a);break;case 24:hu(e,a),u&2048&&qc(a.alternate,a);break;default:hu(e,a)}l=l.sibling}}var gu=8192;function Aa(t,l,e){if(t.subtreeFlags&gu)for(t=t.child;t!==null;)Eo(t,l,e),t=t.sibling}function Eo(t,l,e){switch(t.tag){case 26:Aa(t,l,e),t.flags&gu&&t.memoizedState!==null&&zm(e,Cl,t.memoizedState,t.memoizedProps);break;case 5:Aa(t,l,e);break;case 3:case 4:var a=Cl;Cl=Qn(t.stateNode.containerInfo),Aa(t,l,e),Cl=a;break;case 22:t.memoizedState===null&&(a=t.alternate,a!==null&&a.memoizedState!==null?(a=gu,gu=16777216,Aa(t,l,e),gu=a):Aa(t,l,e));break;default:Aa(t,l,e)}}function Mo(t){var l=t.alternate;if(l!==null&&(t=l.child,t!==null)){l.child=null;do l=t.sibling,t.sibling=null,t=l;while(t!==null)}}function vu(t){var l=t.deletions;if((t.flags&16)!==0){if(l!==null)for(var e=0;e<l.length;e++){var a=l[e];Zt=a,Oo(a,t)}Mo(t)}if(t.subtreeFlags&10256)for(t=t.child;t!==null;)_o(t),t=t.sibling}function _o(t){switch(t.tag){case 0:case 11:case 15:vu(t),t.flags&2048&&ge(9,t,t.return);break;case 3:vu(t);break;case 12:vu(t);break;case 22:var l=t.stateNode;t.memoizedState!==null&&l._visibility&2&&(t.return===null||t.return.tag!==13)?(l._visibility&=-3,On(t)):vu(t);break;default:vu(t)}}function On(t){var l=t.deletions;if((t.flags&16)!==0){if(l!==null)for(var e=0;e<l.length;e++){var a=l[e];Zt=a,Oo(a,t)}Mo(t)}for(t=t.child;t!==null;){switch(l=t,l.tag){case 0:case 11:case 15:ge(8,l,l.return),On(l);break;case 22:e=l.stateNode,e._visibility&2&&(e._visibility&=-3,On(l));break;default:On(l)}t=t.sibling}}function Oo(t,l){for(;Zt!==null;){var e=Zt;switch(e.tag){case 0:case 11:case 15:ge(8,e,l);break;case 23:case 22:if(e.memoizedState!==null&&e.memoizedState.cachePool!==null){var a=e.memoizedState.cachePool.pool;a!=null&&a.refCount++}break;case 24:tu(e.memoizedState.cache)}if(a=e.child,a!==null)a.return=e,Zt=a;else t:for(e=t;Zt!==null;){a=Zt;var u=a.sibling,n=a.return;if(bo(a),a===e){Zt=null;break t}if(u!==null){u.return=n,Zt=u;break t}Zt=n}}}var qy={getCacheForType:function(t){var l=Kt(Ht),e=l.data.get(t);return e===void 0&&(e=t(),l.data.set(t,e)),e},cacheSignal:function(){return Kt(Ht).controller.signal}},Yy=typeof WeakMap=="function"?WeakMap:Map,st=0,St=null,tt=null,et=0,mt=0,gl=null,ve=!1,Ea=!1,Yc=!1,te=0,Ut=0,be=0,We=0,Gc=0,vl=0,Ma=0,bu=null,cl=null,Xc=!1,Nn=0,No=0,Dn=1/0,Un=null,pe=null,Gt=0,Se=null,_a=null,le=0,Qc=0,Zc=null,Do=null,pu=0,wc=null;function bl(){return(st&2)!==0&&et!==0?et&-et:x.T!==null?Wc():Vf()}function Uo(){if(vl===0)if((et&536870912)===0||ut){var t=Yu;Yu<<=1,(Yu&3932160)===0&&(Yu=262144),vl=t}else vl=536870912;return t=ml.current,t!==null&&(t.flags|=32),vl}function fl(t,l,e){(t===St&&(mt===2||mt===9)||t.cancelPendingCommit!==null)&&(Oa(t,0),xe(t,et,vl,!1)),Xa(t,e),((st&2)===0||t!==St)&&(t===St&&((st&2)===0&&(We|=e),Ut===4&&xe(t,et,vl,!1)),Yl(t))}function Co(t,l,e){if((st&6)!==0)throw Error(f(327));var a=!e&&(l&127)===0&&(l&t.expiredLanes)===0||Ga(t,l),u=a?Qy(t,l):Vc(t,l,!0),n=a;do{if(u===0){Ea&&!a&&xe(t,l,0,!1);break}else{if(e=t.current.alternate,n&&!Gy(e)){u=Vc(t,l,!1),n=!1;continue}if(u===2){if(n=l,t.errorRecoveryDisabledLanes&n)var i=0;else i=t.pendingLanes&-536870913,i=i!==0?i:i&536870912?536870912:0;if(i!==0){l=i;t:{var c=t;u=bu;var s=c.current.memoizedState.isDehydrated;if(s&&(Oa(c,i).flags|=256),i=Vc(c,i,!1),i!==2){if(Yc&&!s){c.errorRecoveryDisabledLanes|=n,We|=n,u=4;break t}n=cl,cl=u,n!==null&&(cl===null?cl=n:cl.push.apply(cl,n))}u=i}if(n=!1,u!==2)continue}}if(u===1){Oa(t,0),xe(t,l,0,!0);break}t:{switch(a=t,n=u,n){case 0:case 1:throw Error(f(345));case 4:if((l&4194048)!==l)break;case 6:xe(a,l,vl,!ve);break t;case 2:cl=null;break;case 3:case 5:break;default:throw Error(f(329))}if((l&62914560)===l&&(u=Nn+300-rl(),10<u)){if(xe(a,l,vl,!ve),Xu(a,0,!0)!==0)break t;le=l,a.timeoutHandle=rd(jo.bind(null,a,e,cl,Un,Xc,l,vl,We,Ma,ve,n,"Throttled",-0,0),u);break t}jo(a,e,cl,Un,Xc,l,vl,We,Ma,ve,n,null,-0,0)}}break}while(!0);Yl(t)}function jo(t,l,e,a,u,n,i,c,s,h,z,A,g,b){if(t.timeoutHandle=-1,A=l.subtreeFlags,A&8192||(A&16785408)===16785408){A={stylesheets:null,count:0,imgCount:0,imgBytes:0,suspenseyImages:[],waitingForImages:!0,waitingForViewTransition:!1,unsuspend:Xl},Eo(l,n,A);var B=(n&62914560)===n?Nn-rl():(n&4194048)===n?No-rl():0;if(B=Tm(A,B),B!==null){le=n,t.cancelPendingCommit=B(Qo.bind(null,t,l,n,e,a,u,i,c,s,z,A,null,g,b)),xe(t,n,i,!h);return}}Qo(t,l,n,e,a,u,i,c,s)}function Gy(t){for(var l=t;;){var e=l.tag;if((e===0||e===11||e===15)&&l.flags&16384&&(e=l.updateQueue,e!==null&&(e=e.stores,e!==null)))for(var a=0;a<e.length;a++){var u=e[a],n=u.getSnapshot;u=u.value;try{if(!dl(n(),u))return!1}catch{return!1}}if(e=l.child,l.subtreeFlags&16384&&e!==null)e.return=l,l=e;else{if(l===t)break;for(;l.sibling===null;){if(l.return===null||l.return===t)return!0;l=l.return}l.sibling.return=l.return,l=l.sibling}}return!0}function xe(t,l,e,a){l&=~Gc,l&=~We,t.suspendedLanes|=l,t.pingedLanes&=~l,a&&(t.warmLanes|=l),a=t.expirationTimes;for(var u=l;0<u;){var n=31-ol(u),i=1<<n;a[n]=-1,u&=~i}e!==0&&Zf(t,e,l)}function Cn(){return(st&6)===0?(Su(0),!1):!0}function Lc(){if(tt!==null){if(mt===0)var t=tt.return;else t=tt,Ll=Xe=null,ic(t),ba=null,eu=0,t=tt;for(;t!==null;)ro(t.alternate,t),t=t.return;tt=null}}function Oa(t,l){var e=t.timeoutHandle;e!==-1&&(t.timeoutHandle=-1,nm(e)),e=t.cancelPendingCommit,e!==null&&(t.cancelPendingCommit=null,e()),le=0,Lc(),St=t,tt=e=Zl(t.current,null),et=l,mt=0,gl=null,ve=!1,Ea=Ga(t,l),Yc=!1,Ma=vl=Gc=We=be=Ut=0,cl=bu=null,Xc=!1,(l&8)!==0&&(l|=l&32);var a=t.entangledLanes;if(a!==0)for(t=t.entanglements,a&=l;0<a;){var u=31-ol(a),n=1<<u;l|=t[u],a&=~n}return te=l,Iu(),e}function Ro(t,l){W=null,x.H=su,l===va||l===cn?(l=Wr(),mt=3):l===ki?(l=Wr(),mt=4):mt=l===zc?8:l!==null&&typeof l=="object"&&typeof l.then=="function"?6:1,gl=l,tt===null&&(Ut=1,xn(t,Tl(l,t.current)))}function Ho(){var t=ml.current;return t===null?!0:(et&4194048)===et?_l===null:(et&62914560)===et||(et&536870912)!==0?t===_l:!1}function Bo(){var t=x.H;return x.H=su,t===null?su:t}function qo(){var t=x.A;return x.A=qy,t}function jn(){Ut=4,ve||(et&4194048)!==et&&ml.current!==null||(Ea=!0),(be&134217727)===0&&(We&134217727)===0||St===null||xe(St,et,vl,!1)}function Vc(t,l,e){var a=st;st|=2;var u=Bo(),n=qo();(St!==t||et!==l)&&(Un=null,Oa(t,l)),l=!1;var i=Ut;t:do try{if(mt!==0&&tt!==null){var c=tt,s=gl;switch(mt){case 8:Lc(),i=6;break t;case 3:case 2:case 9:case 6:ml.current===null&&(l=!0);var h=mt;if(mt=0,gl=null,Na(t,c,s,h),e&&Ea){i=0;break t}break;default:h=mt,mt=0,gl=null,Na(t,c,s,h)}}Xy(),i=Ut;break}catch(z){Ro(t,z)}while(!0);return l&&t.shellSuspendCounter++,Ll=Xe=null,st=a,x.H=u,x.A=n,tt===null&&(St=null,et=0,Iu()),i}function Xy(){for(;tt!==null;)Yo(tt)}function Qy(t,l){var e=st;st|=2;var a=Bo(),u=qo();St!==t||et!==l?(Un=null,Dn=rl()+500,Oa(t,l)):Ea=Ga(t,l);t:do try{if(mt!==0&&tt!==null){l=tt;var n=gl;l:switch(mt){case 1:mt=0,gl=null,Na(t,l,n,1);break;case 2:case 9:if(Jr(n)){mt=0,gl=null,Go(l);break}l=function(){mt!==2&&mt!==9||St!==t||(mt=7),Yl(t)},n.then(l,l);break t;case 3:mt=7;break t;case 4:mt=5;break t;case 7:Jr(n)?(mt=0,gl=null,Go(l)):(mt=0,gl=null,Na(t,l,n,7));break;case 5:var i=null;switch(tt.tag){case 26:i=tt.memoizedState;case 5:case 27:var c=tt;if(i?Ad(i):c.stateNode.complete){mt=0,gl=null;var s=c.sibling;if(s!==null)tt=s;else{var h=c.return;h!==null?(tt=h,Rn(h)):tt=null}break l}}mt=0,gl=null,Na(t,l,n,5);break;case 6:mt=0,gl=null,Na(t,l,n,6);break;case 8:Lc(),Ut=6;break t;default:throw Error(f(462))}}Zy();break}catch(z){Ro(t,z)}while(!0);return Ll=Xe=null,x.H=a,x.A=u,st=e,tt!==null?0:(St=null,et=0,Iu(),Ut)}function Zy(){for(;tt!==null&&!o0();)Yo(tt)}function Yo(t){var l=co(t.alternate,t,te);t.memoizedProps=t.pendingProps,l===null?Rn(t):tt=l}function Go(t){var l=t,e=l.alternate;switch(l.tag){case 15:case 0:l=lo(e,l,l.pendingProps,l.type,void 0,et);break;case 11:l=lo(e,l,l.pendingProps,l.type.render,l.ref,et);break;case 5:ic(l);default:ro(e,l),l=tt=Br(l,te),l=co(e,l,te)}t.memoizedProps=t.pendingProps,l===null?Rn(t):tt=l}function Na(t,l,e,a){Ll=Xe=null,ic(l),ba=null,eu=0;var u=l.return;try{if(Dy(t,u,l,e,et)){Ut=1,xn(t,Tl(e,t.current)),tt=null;return}}catch(n){if(u!==null)throw tt=u,n;Ut=1,xn(t,Tl(e,t.current)),tt=null;return}l.flags&32768?(ut||a===1?t=!0:Ea||(et&536870912)!==0?t=!1:(ve=t=!0,(a===2||a===9||a===3||a===6)&&(a=ml.current,a!==null&&a.tag===13&&(a.flags|=16384))),Xo(l,t)):Rn(l)}function Rn(t){var l=t;do{if((l.flags&32768)!==0){Xo(l,ve);return}t=l.return;var e=jy(l.alternate,l,te);if(e!==null){tt=e;return}if(l=l.sibling,l!==null){tt=l;return}tt=l=t}while(l!==null);Ut===0&&(Ut=5)}function Xo(t,l){do{var e=Ry(t.alternate,t);if(e!==null){e.flags&=32767,tt=e;return}if(e=t.return,e!==null&&(e.flags|=32768,e.subtreeFlags=0,e.deletions=null),!l&&(t=t.sibling,t!==null)){tt=t;return}tt=t=e}while(t!==null);Ut=6,tt=null}function Qo(t,l,e,a,u,n,i,c,s){t.cancelPendingCommit=null;do Hn();while(Gt!==0);if((st&6)!==0)throw Error(f(327));if(l!==null){if(l===t.current)throw Error(f(177));if(n=l.lanes|l.childLanes,n|=ji,x0(t,e,n,i,c,s),t===St&&(tt=St=null,et=0),_a=l,Se=t,le=e,Qc=n,Zc=u,Do=a,(l.subtreeFlags&10256)!==0||(l.flags&10256)!==0?(t.callbackNode=null,t.callbackPriority=0,Ky(Bu,function(){return Ko(),null})):(t.callbackNode=null,t.callbackPriority=0),a=(l.flags&13878)!==0,(l.subtreeFlags&13878)!==0||a){a=x.T,x.T=null,u=C.p,C.p=2,i=st,st|=4;try{Hy(t,l,e)}finally{st=i,C.p=u,x.T=a}}Gt=1,Zo(),wo(),Lo()}}function Zo(){if(Gt===1){Gt=0;var t=Se,l=_a,e=(l.flags&13878)!==0;if((l.subtreeFlags&13878)!==0||e){e=x.T,x.T=null;var a=C.p;C.p=2;var u=st;st|=4;try{zo(l,t);var n=af,i=_r(t.containerInfo),c=n.focusedElem,s=n.selectionRange;if(i!==c&&c&&c.ownerDocument&&Mr(c.ownerDocument.documentElement,c)){if(s!==null&&Oi(c)){var h=s.start,z=s.end;if(z===void 0&&(z=h),"selectionStart"in c)c.selectionStart=h,c.selectionEnd=Math.min(z,c.value.length);else{var A=c.ownerDocument||document,g=A&&A.defaultView||window;if(g.getSelection){var b=g.getSelection(),B=c.textContent.length,w=Math.min(s.start,B),pt=s.end===void 0?w:Math.min(s.end,B);!b.extend&&w>pt&&(i=pt,pt=w,w=i);var y=Er(c,w),d=Er(c,pt);if(y&&d&&(b.rangeCount!==1||b.anchorNode!==y.node||b.anchorOffset!==y.offset||b.focusNode!==d.node||b.focusOffset!==d.offset)){var m=A.createRange();m.setStart(y.node,y.offset),b.removeAllRanges(),w>pt?(b.addRange(m),b.extend(d.node,d.offset)):(m.setEnd(d.node,d.offset),b.addRange(m))}}}}for(A=[],b=c;b=b.parentNode;)b.nodeType===1&&A.push({element:b,left:b.scrollLeft,top:b.scrollTop});for(typeof c.focus=="function"&&c.focus(),c=0;c<A.length;c++){var T=A[c];T.element.scrollLeft=T.left,T.element.scrollTop=T.top}}Jn=!!ef,af=ef=null}finally{st=u,C.p=a,x.T=e}}t.current=l,Gt=2}}function wo(){if(Gt===2){Gt=0;var t=Se,l=_a,e=(l.flags&8772)!==0;if((l.subtreeFlags&8772)!==0||e){e=x.T,x.T=null;var a=C.p;C.p=2;var u=st;st|=4;try{vo(t,l.alternate,l)}finally{st=u,C.p=a,x.T=e}}Gt=3}}function Lo(){if(Gt===4||Gt===3){Gt=0,d0();var t=Se,l=_a,e=le,a=Do;(l.subtreeFlags&10256)!==0||(l.flags&10256)!==0?Gt=5:(Gt=0,_a=Se=null,Vo(t,t.pendingLanes));var u=t.pendingLanes;if(u===0&&(pe=null),ri(e),l=l.stateNode,sl&&typeof sl.onCommitFiberRoot=="function")try{sl.onCommitFiberRoot(Ya,l,void 0,(l.current.flags&128)===128)}catch{}if(a!==null){l=x.T,u=C.p,C.p=2,x.T=null;try{for(var n=t.onRecoverableError,i=0;i<a.length;i++){var c=a[i];n(c.value,{componentStack:c.stack})}}finally{x.T=l,C.p=u}}(le&3)!==0&&Hn(),Yl(t),u=t.pendingLanes,(e&261930)!==0&&(u&42)!==0?t===wc?pu++:(pu=0,wc=t):pu=0,Su(0)}}function Vo(t,l){(t.pooledCacheLanes&=l)===0&&(l=t.pooledCache,l!=null&&(t.pooledCache=null,tu(l)))}function Hn(){return Zo(),wo(),Lo(),Ko()}function Ko(){if(Gt!==5)return!1;var t=Se,l=Qc;Qc=0;var e=ri(le),a=x.T,u=C.p;try{C.p=32>e?32:e,x.T=null,e=Zc,Zc=null;var n=Se,i=le;if(Gt=0,_a=Se=null,le=0,(st&6)!==0)throw Error(f(331));var c=st;if(st|=4,_o(n.current),Ao(n,n.current,i,e),st=c,Su(0,!1),sl&&typeof sl.onPostCommitFiberRoot=="function")try{sl.onPostCommitFiberRoot(Ya,n)}catch{}return!0}finally{C.p=u,x.T=a,Vo(t,l)}}function Jo(t,l,e){l=Tl(e,l),l=xc(t.stateNode,l,2),t=ye(t,l,2),t!==null&&(Xa(t,2),Yl(t))}function ht(t,l,e){if(t.tag===3)Jo(t,t,e);else for(;l!==null;){if(l.tag===3){Jo(l,t,e);break}else if(l.tag===1){var a=l.stateNode;if(typeof l.type.getDerivedStateFromError=="function"||typeof a.componentDidCatch=="function"&&(pe===null||!pe.has(a))){t=Tl(e,t),e=Js(2),a=ye(l,e,2),a!==null&&(ks(e,a,l,t),Xa(a,2),Yl(a));break}}l=l.return}}function Kc(t,l,e){var a=t.pingCache;if(a===null){a=t.pingCache=new Yy;var u=new Set;a.set(l,u)}else u=a.get(l),u===void 0&&(u=new Set,a.set(l,u));u.has(e)||(Yc=!0,u.add(e),t=wy.bind(null,t,l,e),l.then(t,t))}function wy(t,l,e){var a=t.pingCache;a!==null&&a.delete(l),t.pingedLanes|=t.suspendedLanes&e,t.warmLanes&=~e,St===t&&(et&e)===e&&(Ut===4||Ut===3&&(et&62914560)===et&&300>rl()-Nn?(st&2)===0&&Oa(t,0):Gc|=e,Ma===et&&(Ma=0)),Yl(t)}function ko(t,l){l===0&&(l=Qf()),t=qe(t,l),t!==null&&(Xa(t,l),Yl(t))}function Ly(t){var l=t.memoizedState,e=0;l!==null&&(e=l.retryLane),ko(t,e)}function Vy(t,l){var e=0;switch(t.tag){case 31:case 13:var a=t.stateNode,u=t.memoizedState;u!==null&&(e=u.retryLane);break;case 19:a=t.stateNode;break;case 22:a=t.stateNode._retryCache;break;default:throw Error(f(314))}a!==null&&a.delete(l),ko(t,e)}function Ky(t,l){return ni(t,l)}var Bn=null,Da=null,Jc=!1,qn=!1,kc=!1,ze=0;function Yl(t){t!==Da&&t.next===null&&(Da===null?Bn=Da=t:Da=Da.next=t),qn=!0,Jc||(Jc=!0,ky())}function Su(t,l){if(!kc&&qn){kc=!0;do for(var e=!1,a=Bn;a!==null;){if(t!==0){var u=a.pendingLanes;if(u===0)var n=0;else{var i=a.suspendedLanes,c=a.pingedLanes;n=(1<<31-ol(42|t)+1)-1,n&=u&~(i&~c),n=n&201326741?n&201326741|1:n?n|2:0}n!==0&&(e=!0,Io(a,n))}else n=et,n=Xu(a,a===St?n:0,a.cancelPendingCommit!==null||a.timeoutHandle!==-1),(n&3)===0||Ga(a,n)||(e=!0,Io(a,n));a=a.next}while(e);kc=!1}}function Jy(){Wo()}function Wo(){qn=Jc=!1;var t=0;ze!==0&&um()&&(t=ze);for(var l=rl(),e=null,a=Bn;a!==null;){var u=a.next,n=$o(a,l);n===0?(a.next=null,e===null?Bn=u:e.next=u,u===null&&(Da=e)):(e=a,(t!==0||(n&3)!==0)&&(qn=!0)),a=u}Gt!==0&&Gt!==5||Su(t),ze!==0&&(ze=0)}function $o(t,l){for(var e=t.suspendedLanes,a=t.pingedLanes,u=t.expirationTimes,n=t.pendingLanes&-62914561;0<n;){var i=31-ol(n),c=1<<i,s=u[i];s===-1?((c&e)===0||(c&a)!==0)&&(u[i]=S0(c,l)):s<=l&&(t.expiredLanes|=c),n&=~c}if(l=St,e=et,e=Xu(t,t===l?e:0,t.cancelPendingCommit!==null||t.timeoutHandle!==-1),a=t.callbackNode,e===0||t===l&&(mt===2||mt===9)||t.cancelPendingCommit!==null)return a!==null&&a!==null&&ii(a),t.callbackNode=null,t.callbackPriority=0;if((e&3)===0||Ga(t,e)){if(l=e&-e,l===t.callbackPriority)return l;switch(a!==null&&ii(a),ri(e)){case 2:case 8:e=Gf;break;case 32:e=Bu;break;case 268435456:e=Xf;break;default:e=Bu}return a=Fo.bind(null,t),e=ni(e,a),t.callbackPriority=l,t.callbackNode=e,l}return a!==null&&a!==null&&ii(a),t.callbackPriority=2,t.callbackNode=null,2}function Fo(t,l){if(Gt!==0&&Gt!==5)return t.callbackNode=null,t.callbackPriority=0,null;var e=t.callbackNode;if(Hn()&&t.callbackNode!==e)return null;var a=et;return a=Xu(t,t===St?a:0,t.cancelPendingCommit!==null||t.timeoutHandle!==-1),a===0?null:(Co(t,a,l),$o(t,rl()),t.callbackNode!=null&&t.callbackNode===e?Fo.bind(null,t):null)}function Io(t,l){if(Hn())return null;Co(t,l,!0)}function ky(){im(function(){(st&6)!==0?ni(Yf,Jy):Wo()})}function Wc(){if(ze===0){var t=ha;t===0&&(t=qu,qu<<=1,(qu&261888)===0&&(qu=256)),ze=t}return ze}function Po(t){return t==null||typeof t=="symbol"||typeof t=="boolean"?null:typeof t=="function"?t:Lu(""+t)}function td(t,l){var e=l.ownerDocument.createElement("input");return e.name=l.name,e.value=l.value,t.id&&e.setAttribute("form",t.id),l.parentNode.insertBefore(e,l),t=new FormData(t),e.parentNode.removeChild(e),t}function Wy(t,l,e,a,u){if(l==="submit"&&e&&e.stateNode===u){var n=Po((u[el]||null).action),i=a.submitter;i&&(l=(l=i[el]||null)?Po(l.formAction):i.getAttribute("formAction"),l!==null&&(n=l,i=null));var c=new ku("action","action",null,a,u);t.push({event:c,listeners:[{instance:null,listener:function(){if(a.defaultPrevented){if(ze!==0){var s=i?td(u,i):new FormData(u);hc(e,{pending:!0,data:s,method:u.method,action:n},null,s)}}else typeof n=="function"&&(c.preventDefault(),s=i?td(u,i):new FormData(u),hc(e,{pending:!0,data:s,method:u.method,action:n},n,s))},currentTarget:u}]})}}for(var $c=0;$c<Ci.length;$c++){var Fc=Ci[$c],$y=Fc.toLowerCase(),Fy=Fc[0].toUpperCase()+Fc.slice(1);Ul($y,"on"+Fy)}Ul(Dr,"onAnimationEnd"),Ul(Ur,"onAnimationIteration"),Ul(Cr,"onAnimationStart"),Ul("dblclick","onDoubleClick"),Ul("focusin","onFocus"),Ul("focusout","onBlur"),Ul(yy,"onTransitionRun"),Ul(my,"onTransitionStart"),Ul(hy,"onTransitionCancel"),Ul(jr,"onTransitionEnd"),la("onMouseEnter",["mouseout","mouseover"]),la("onMouseLeave",["mouseout","mouseover"]),la("onPointerEnter",["pointerout","pointerover"]),la("onPointerLeave",["pointerout","pointerover"]),je("onChange","change click focusin focusout input keydown keyup selectionchange".split(" ")),je("onSelect","focusout contextmenu dragend focusin keydown keyup mousedown mouseup selectionchange".split(" ")),je("onBeforeInput",["compositionend","keypress","textInput","paste"]),je("onCompositionEnd","compositionend focusout keydown keypress keyup mousedown".split(" ")),je("onCompositionStart","compositionstart focusout keydown keypress keyup mousedown".split(" ")),je("onCompositionUpdate","compositionupdate focusout keydown keypress keyup mousedown".split(" "));var xu="abort canplay canplaythrough durationchange emptied encrypted ended error loadeddata loadedmetadata loadstart pause play playing progress ratechange resize seeked seeking stalled suspend timeupdate volumechange waiting".split(" "),Iy=new Set("beforetoggle cancel close invalid load scroll scrollend toggle".split(" ").concat(xu));function ld(t,l){l=(l&4)!==0;for(var e=0;e<t.length;e++){var a=t[e],u=a.event;a=a.listeners;t:{var n=void 0;if(l)for(var i=a.length-1;0<=i;i--){var c=a[i],s=c.instance,h=c.currentTarget;if(c=c.listener,s!==n&&u.isPropagationStopped())break t;n=c,u.currentTarget=h;try{n(u)}catch(z){Fu(z)}u.currentTarget=null,n=s}else for(i=0;i<a.length;i++){if(c=a[i],s=c.instance,h=c.currentTarget,c=c.listener,s!==n&&u.isPropagationStopped())break t;n=c,u.currentTarget=h;try{n(u)}catch(z){Fu(z)}u.currentTarget=null,n=s}}}}function lt(t,l){var e=l[si];e===void 0&&(e=l[si]=new Set);var a=t+"__bubble";e.has(a)||(ed(l,t,2,!1),e.add(a))}function Ic(t,l,e){var a=0;l&&(a|=4),ed(e,t,a,l)}var Yn="_reactListening"+Math.random().toString(36).slice(2);function Pc(t){if(!t[Yn]){t[Yn]=!0,kf.forEach(function(e){e!=="selectionchange"&&(Iy.has(e)||Ic(e,!1,t),Ic(e,!0,t))});var l=t.nodeType===9?t:t.ownerDocument;l===null||l[Yn]||(l[Yn]=!0,Ic("selectionchange",!1,l))}}function ed(t,l,e,a){switch(Ud(l)){case 2:var u=Mm;break;case 8:u=_m;break;default:u=hf}e=u.bind(null,l,e,t),u=void 0,!pi||l!=="touchstart"&&l!=="touchmove"&&l!=="wheel"||(u=!0),a?u!==void 0?t.addEventListener(l,e,{capture:!0,passive:u}):t.addEventListener(l,e,!0):u!==void 0?t.addEventListener(l,e,{passive:u}):t.addEventListener(l,e,!1)}function tf(t,l,e,a,u){var n=a;if((l&1)===0&&(l&2)===0&&a!==null)t:for(;;){if(a===null)return;var i=a.tag;if(i===3||i===4){var c=a.stateNode.containerInfo;if(c===u)break;if(i===4)for(i=a.return;i!==null;){var s=i.tag;if((s===3||s===4)&&i.stateNode.containerInfo===u)return;i=i.return}for(;c!==null;){if(i=Ie(c),i===null)return;if(s=i.tag,s===5||s===6||s===26||s===27){a=n=i;continue t}c=c.parentNode}}a=a.return}ir(function(){var h=n,z=vi(e),A=[];t:{var g=Rr.get(t);if(g!==void 0){var b=ku,B=t;switch(t){case"keypress":if(Ku(e)===0)break t;case"keydown":case"keyup":b=V0;break;case"focusin":B="focus",b=Ti;break;case"focusout":B="blur",b=Ti;break;case"beforeblur":case"afterblur":b=Ti;break;case"click":if(e.button===2)break t;case"auxclick":case"dblclick":case"mousedown":case"mousemove":case"mouseup":case"mouseout":case"mouseover":case"contextmenu":b=rr;break;case"drag":case"dragend":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"dragstart":case"drop":b=j0;break;case"touchcancel":case"touchend":case"touchmove":case"touchstart":b=k0;break;case Dr:case Ur:case Cr:b=B0;break;case jr:b=$0;break;case"scroll":case"scrollend":b=U0;break;case"wheel":b=I0;break;case"copy":case"cut":case"paste":b=Y0;break;case"gotpointercapture":case"lostpointercapture":case"pointercancel":case"pointerdown":case"pointermove":case"pointerout":case"pointerover":case"pointerup":b=or;break;case"toggle":case"beforetoggle":b=ty}var w=(l&4)!==0,pt=!w&&(t==="scroll"||t==="scrollend"),y=w?g!==null?g+"Capture":null:g;w=[];for(var d=h,m;d!==null;){var T=d;if(m=T.stateNode,T=T.tag,T!==5&&T!==26&&T!==27||m===null||y===null||(T=wa(d,y),T!=null&&w.push(zu(d,T,m))),pt)break;d=d.return}0<w.length&&(g=new b(g,B,null,e,z),A.push({event:g,listeners:w}))}}if((l&7)===0){t:{if(g=t==="mouseover"||t==="pointerover",b=t==="mouseout"||t==="pointerout",g&&e!==gi&&(B=e.relatedTarget||e.fromElement)&&(Ie(B)||B[Fe]))break t;if((b||g)&&(g=z.window===z?z:(g=z.ownerDocument)?g.defaultView||g.parentWindow:window,b?(B=e.relatedTarget||e.toElement,b=h,B=B?Ie(B):null,B!==null&&(pt=O(B),w=B.tag,B!==pt||w!==5&&w!==27&&w!==6)&&(B=null)):(b=null,B=h),b!==B)){if(w=rr,T="onMouseLeave",y="onMouseEnter",d="mouse",(t==="pointerout"||t==="pointerover")&&(w=or,T="onPointerLeave",y="onPointerEnter",d="pointer"),pt=b==null?g:Za(b),m=B==null?g:Za(B),g=new w(T,d+"leave",b,e,z),g.target=pt,g.relatedTarget=m,T=null,Ie(z)===h&&(w=new w(y,d+"enter",B,e,z),w.target=m,w.relatedTarget=pt,T=w),pt=T,b&&B)l:{for(w=Py,y=b,d=B,m=0,T=y;T;T=w(T))m++;T=0;for(var X=d;X;X=w(X))T++;for(;0<m-T;)y=w(y),m--;for(;0<T-m;)d=w(d),T--;for(;m--;){if(y===d||d!==null&&y===d.alternate){w=y;break l}y=w(y),d=w(d)}w=null}else w=null;b!==null&&ad(A,g,b,w,!1),B!==null&&pt!==null&&ad(A,pt,B,w,!0)}}t:{if(g=h?Za(h):window,b=g.nodeName&&g.nodeName.toLowerCase(),b==="select"||b==="input"&&g.type==="file")var ft=pr;else if(vr(g))if(Sr)ft=sy;else{ft=fy;var Y=cy}else b=g.nodeName,!b||b.toLowerCase()!=="input"||g.type!=="checkbox"&&g.type!=="radio"?h&&hi(h.elementType)&&(ft=pr):ft=ry;if(ft&&(ft=ft(t,h))){br(A,ft,e,z);break t}Y&&Y(t,g,h),t==="focusout"&&h&&g.type==="number"&&h.memoizedProps.value!=null&&mi(g,"number",g.value)}switch(Y=h?Za(h):window,t){case"focusin":(vr(Y)||Y.contentEditable==="true")&&(ca=Y,Ni=h,Fa=null);break;case"focusout":Fa=Ni=ca=null;break;case"mousedown":Di=!0;break;case"contextmenu":case"mouseup":case"dragend":Di=!1,Or(A,e,z);break;case"selectionchange":if(dy)break;case"keydown":case"keyup":Or(A,e,z)}var $;if(Ei)t:{switch(t){case"compositionstart":var at="onCompositionStart";break t;case"compositionend":at="onCompositionEnd";break t;case"compositionupdate":at="onCompositionUpdate";break t}at=void 0}else ia?hr(t,e)&&(at="onCompositionEnd"):t==="keydown"&&e.keyCode===229&&(at="onCompositionStart");at&&(dr&&e.locale!=="ko"&&(ia||at!=="onCompositionStart"?at==="onCompositionEnd"&&ia&&($=cr()):(ie=z,Si="value"in ie?ie.value:ie.textContent,ia=!0)),Y=Gn(h,at),0<Y.length&&(at=new sr(at,t,null,e,z),A.push({event:at,listeners:Y}),$?at.data=$:($=gr(e),$!==null&&(at.data=$)))),($=ey?ay(t,e):uy(t,e))&&(at=Gn(h,"onBeforeInput"),0<at.length&&(Y=new sr("onBeforeInput","beforeinput",null,e,z),A.push({event:Y,listeners:at}),Y.data=$)),Wy(A,t,h,e,z)}ld(A,l)})}function zu(t,l,e){return{instance:t,listener:l,currentTarget:e}}function Gn(t,l){for(var e=l+"Capture",a=[];t!==null;){var u=t,n=u.stateNode;if(u=u.tag,u!==5&&u!==26&&u!==27||n===null||(u=wa(t,e),u!=null&&a.unshift(zu(t,u,n)),u=wa(t,l),u!=null&&a.push(zu(t,u,n))),t.tag===3)return a;t=t.return}return[]}function Py(t){if(t===null)return null;do t=t.return;while(t&&t.tag!==5&&t.tag!==27);return t||null}function ad(t,l,e,a,u){for(var n=l._reactName,i=[];e!==null&&e!==a;){var c=e,s=c.alternate,h=c.stateNode;if(c=c.tag,s!==null&&s===a)break;c!==5&&c!==26&&c!==27||h===null||(s=h,u?(h=wa(e,n),h!=null&&i.unshift(zu(e,h,s))):u||(h=wa(e,n),h!=null&&i.push(zu(e,h,s)))),e=e.return}i.length!==0&&t.push({event:l,listeners:i})}var tm=/\r\n?/g,lm=/\u0000|\uFFFD/g;function ud(t){return(typeof t=="string"?t:""+t).replace(tm,`
+`).replace(lm,"")}function nd(t,l){return l=ud(l),ud(t)===l}function bt(t,l,e,a,u,n){switch(e){case"children":typeof a=="string"?l==="body"||l==="textarea"&&a===""||aa(t,a):(typeof a=="number"||typeof a=="bigint")&&l!=="body"&&aa(t,""+a);break;case"className":Zu(t,"class",a);break;case"tabIndex":Zu(t,"tabindex",a);break;case"dir":case"role":case"viewBox":case"width":case"height":Zu(t,e,a);break;case"style":ur(t,a,n);break;case"data":if(l!=="object"){Zu(t,"data",a);break}case"src":case"href":if(a===""&&(l!=="a"||e!=="href")){t.removeAttribute(e);break}if(a==null||typeof a=="function"||typeof a=="symbol"||typeof a=="boolean"){t.removeAttribute(e);break}a=Lu(""+a),t.setAttribute(e,a);break;case"action":case"formAction":if(typeof a=="function"){t.setAttribute(e,"javascript:throw new Error('A React form was unexpectedly submitted. If you called form.submit() manually, consider using form.requestSubmit() instead. If you\\'re trying to use event.stopPropagation() in a submit event handler, consider also calling event.preventDefault().')");break}else typeof n=="function"&&(e==="formAction"?(l!=="input"&&bt(t,l,"name",u.name,u,null),bt(t,l,"formEncType",u.formEncType,u,null),bt(t,l,"formMethod",u.formMethod,u,null),bt(t,l,"formTarget",u.formTarget,u,null)):(bt(t,l,"encType",u.encType,u,null),bt(t,l,"method",u.method,u,null),bt(t,l,"target",u.target,u,null)));if(a==null||typeof a=="symbol"||typeof a=="boolean"){t.removeAttribute(e);break}a=Lu(""+a),t.setAttribute(e,a);break;case"onClick":a!=null&&(t.onclick=Xl);break;case"onScroll":a!=null&&lt("scroll",t);break;case"onScrollEnd":a!=null&&lt("scrollend",t);break;case"dangerouslySetInnerHTML":if(a!=null){if(typeof a!="object"||!("__html"in a))throw Error(f(61));if(e=a.__html,e!=null){if(u.children!=null)throw Error(f(60));t.innerHTML=e}}break;case"multiple":t.multiple=a&&typeof a!="function"&&typeof a!="symbol";break;case"muted":t.muted=a&&typeof a!="function"&&typeof a!="symbol";break;case"suppressContentEditableWarning":case"suppressHydrationWarning":case"defaultValue":case"defaultChecked":case"innerHTML":case"ref":break;case"autoFocus":break;case"xlinkHref":if(a==null||typeof a=="function"||typeof a=="boolean"||typeof a=="symbol"){t.removeAttribute("xlink:href");break}e=Lu(""+a),t.setAttributeNS("http://www.w3.org/1999/xlink","xlink:href",e);break;case"contentEditable":case"spellCheck":case"draggable":case"value":case"autoReverse":case"externalResourcesRequired":case"focusable":case"preserveAlpha":a!=null&&typeof a!="function"&&typeof a!="symbol"?t.setAttribute(e,""+a):t.removeAttribute(e);break;case"inert":case"allowFullScreen":case"async":case"autoPlay":case"controls":case"default":case"defer":case"disabled":case"disablePictureInPicture":case"disableRemotePlayback":case"formNoValidate":case"hidden":case"loop":case"noModule":case"noValidate":case"open":case"playsInline":case"readOnly":case"required":case"reversed":case"scoped":case"seamless":case"itemScope":a&&typeof a!="function"&&typeof a!="symbol"?t.setAttribute(e,""):t.removeAttribute(e);break;case"capture":case"download":a===!0?t.setAttribute(e,""):a!==!1&&a!=null&&typeof a!="function"&&typeof a!="symbol"?t.setAttribute(e,a):t.removeAttribute(e);break;case"cols":case"rows":case"size":case"span":a!=null&&typeof a!="function"&&typeof a!="symbol"&&!isNaN(a)&&1<=a?t.setAttribute(e,a):t.removeAttribute(e);break;case"rowSpan":case"start":a==null||typeof a=="function"||typeof a=="symbol"||isNaN(a)?t.removeAttribute(e):t.setAttribute(e,a);break;case"popover":lt("beforetoggle",t),lt("toggle",t),Qu(t,"popover",a);break;case"xlinkActuate":Gl(t,"http://www.w3.org/1999/xlink","xlink:actuate",a);break;case"xlinkArcrole":Gl(t,"http://www.w3.org/1999/xlink","xlink:arcrole",a);break;case"xlinkRole":Gl(t,"http://www.w3.org/1999/xlink","xlink:role",a);break;case"xlinkShow":Gl(t,"http://www.w3.org/1999/xlink","xlink:show",a);break;case"xlinkTitle":Gl(t,"http://www.w3.org/1999/xlink","xlink:title",a);break;case"xlinkType":Gl(t,"http://www.w3.org/1999/xlink","xlink:type",a);break;case"xmlBase":Gl(t,"http://www.w3.org/XML/1998/namespace","xml:base",a);break;case"xmlLang":Gl(t,"http://www.w3.org/XML/1998/namespace","xml:lang",a);break;case"xmlSpace":Gl(t,"http://www.w3.org/XML/1998/namespace","xml:space",a);break;case"is":Qu(t,"is",a);break;case"innerText":case"textContent":break;default:(!(2<e.length)||e[0]!=="o"&&e[0]!=="O"||e[1]!=="n"&&e[1]!=="N")&&(e=N0.get(e)||e,Qu(t,e,a))}}function lf(t,l,e,a,u,n){switch(e){case"style":ur(t,a,n);break;case"dangerouslySetInnerHTML":if(a!=null){if(typeof a!="object"||!("__html"in a))throw Error(f(61));if(e=a.__html,e!=null){if(u.children!=null)throw Error(f(60));t.innerHTML=e}}break;case"children":typeof a=="string"?aa(t,a):(typeof a=="number"||typeof a=="bigint")&&aa(t,""+a);break;case"onScroll":a!=null&&lt("scroll",t);break;case"onScrollEnd":a!=null&&lt("scrollend",t);break;case"onClick":a!=null&&(t.onclick=Xl);break;case"suppressContentEditableWarning":case"suppressHydrationWarning":case"innerHTML":case"ref":break;case"innerText":case"textContent":break;default:if(!Wf.hasOwnProperty(e))t:{if(e[0]==="o"&&e[1]==="n"&&(u=e.endsWith("Capture"),l=e.slice(2,u?e.length-7:void 0),n=t[el]||null,n=n!=null?n[e]:null,typeof n=="function"&&t.removeEventListener(l,n,u),typeof a=="function")){typeof n!="function"&&n!==null&&(e in t?t[e]=null:t.hasAttribute(e)&&t.removeAttribute(e)),t.addEventListener(l,a,u);break t}e in t?t[e]=a:a===!0?t.setAttribute(e,""):Qu(t,e,a)}}}function kt(t,l,e){switch(l){case"div":case"span":case"svg":case"path":case"a":case"g":case"p":case"li":break;case"img":lt("error",t),lt("load",t);var a=!1,u=!1,n;for(n in e)if(e.hasOwnProperty(n)){var i=e[n];if(i!=null)switch(n){case"src":a=!0;break;case"srcSet":u=!0;break;case"children":case"dangerouslySetInnerHTML":throw Error(f(137,l));default:bt(t,l,n,i,e,null)}}u&&bt(t,l,"srcSet",e.srcSet,e,null),a&&bt(t,l,"src",e.src,e,null);return;case"input":lt("invalid",t);var c=n=i=u=null,s=null,h=null;for(a in e)if(e.hasOwnProperty(a)){var z=e[a];if(z!=null)switch(a){case"name":u=z;break;case"type":i=z;break;case"checked":s=z;break;case"defaultChecked":h=z;break;case"value":n=z;break;case"defaultValue":c=z;break;case"children":case"dangerouslySetInnerHTML":if(z!=null)throw Error(f(137,l));break;default:bt(t,l,a,z,e,null)}}tr(t,n,c,s,h,i,u,!1);return;case"select":lt("invalid",t),a=i=n=null;for(u in e)if(e.hasOwnProperty(u)&&(c=e[u],c!=null))switch(u){case"value":n=c;break;case"defaultValue":i=c;break;case"multiple":a=c;default:bt(t,l,u,c,e,null)}l=n,e=i,t.multiple=!!a,l!=null?ea(t,!!a,l,!1):e!=null&&ea(t,!!a,e,!0);return;case"textarea":lt("invalid",t),n=u=a=null;for(i in e)if(e.hasOwnProperty(i)&&(c=e[i],c!=null))switch(i){case"value":a=c;break;case"defaultValue":u=c;break;case"children":n=c;break;case"dangerouslySetInnerHTML":if(c!=null)throw Error(f(91));break;default:bt(t,l,i,c,e,null)}er(t,a,u,n);return;case"option":for(s in e)e.hasOwnProperty(s)&&(a=e[s],a!=null)&&(s==="selected"?t.selected=a&&typeof a!="function"&&typeof a!="symbol":bt(t,l,s,a,e,null));return;case"dialog":lt("beforetoggle",t),lt("toggle",t),lt("cancel",t),lt("close",t);break;case"iframe":case"object":lt("load",t);break;case"video":case"audio":for(a=0;a<xu.length;a++)lt(xu[a],t);break;case"image":lt("error",t),lt("load",t);break;case"details":lt("toggle",t);break;case"embed":case"source":case"link":lt("error",t),lt("load",t);case"area":case"base":case"br":case"col":case"hr":case"keygen":case"meta":case"param":case"track":case"wbr":case"menuitem":for(h in e)if(e.hasOwnProperty(h)&&(a=e[h],a!=null))switch(h){case"children":case"dangerouslySetInnerHTML":throw Error(f(137,l));default:bt(t,l,h,a,e,null)}return;default:if(hi(l)){for(z in e)e.hasOwnProperty(z)&&(a=e[z],a!==void 0&&lf(t,l,z,a,e,void 0));return}}for(c in e)e.hasOwnProperty(c)&&(a=e[c],a!=null&&bt(t,l,c,a,e,null))}function em(t,l,e,a){switch(l){case"div":case"span":case"svg":case"path":case"a":case"g":case"p":case"li":break;case"input":var u=null,n=null,i=null,c=null,s=null,h=null,z=null;for(b in e){var A=e[b];if(e.hasOwnProperty(b)&&A!=null)switch(b){case"checked":break;case"value":break;case"defaultValue":s=A;default:a.hasOwnProperty(b)||bt(t,l,b,null,a,A)}}for(var g in a){var b=a[g];if(A=e[g],a.hasOwnProperty(g)&&(b!=null||A!=null))switch(g){case"type":n=b;break;case"name":u=b;break;case"checked":h=b;break;case"defaultChecked":z=b;break;case"value":i=b;break;case"defaultValue":c=b;break;case"children":case"dangerouslySetInnerHTML":if(b!=null)throw Error(f(137,l));break;default:b!==A&&bt(t,l,g,b,a,A)}}yi(t,i,c,s,h,z,n,u);return;case"select":b=i=c=g=null;for(n in e)if(s=e[n],e.hasOwnProperty(n)&&s!=null)switch(n){case"value":break;case"multiple":b=s;default:a.hasOwnProperty(n)||bt(t,l,n,null,a,s)}for(u in a)if(n=a[u],s=e[u],a.hasOwnProperty(u)&&(n!=null||s!=null))switch(u){case"value":g=n;break;case"defaultValue":c=n;break;case"multiple":i=n;default:n!==s&&bt(t,l,u,n,a,s)}l=c,e=i,a=b,g!=null?ea(t,!!e,g,!1):!!a!=!!e&&(l!=null?ea(t,!!e,l,!0):ea(t,!!e,e?[]:"",!1));return;case"textarea":b=g=null;for(c in e)if(u=e[c],e.hasOwnProperty(c)&&u!=null&&!a.hasOwnProperty(c))switch(c){case"value":break;case"children":break;default:bt(t,l,c,null,a,u)}for(i in a)if(u=a[i],n=e[i],a.hasOwnProperty(i)&&(u!=null||n!=null))switch(i){case"value":g=u;break;case"defaultValue":b=u;break;case"children":break;case"dangerouslySetInnerHTML":if(u!=null)throw Error(f(91));break;default:u!==n&&bt(t,l,i,u,a,n)}lr(t,g,b);return;case"option":for(var B in e)g=e[B],e.hasOwnProperty(B)&&g!=null&&!a.hasOwnProperty(B)&&(B==="selected"?t.selected=!1:bt(t,l,B,null,a,g));for(s in a)g=a[s],b=e[s],a.hasOwnProperty(s)&&g!==b&&(g!=null||b!=null)&&(s==="selected"?t.selected=g&&typeof g!="function"&&typeof g!="symbol":bt(t,l,s,g,a,b));return;case"img":case"link":case"area":case"base":case"br":case"col":case"embed":case"hr":case"keygen":case"meta":case"param":case"source":case"track":case"wbr":case"menuitem":for(var w in e)g=e[w],e.hasOwnProperty(w)&&g!=null&&!a.hasOwnProperty(w)&&bt(t,l,w,null,a,g);for(h in a)if(g=a[h],b=e[h],a.hasOwnProperty(h)&&g!==b&&(g!=null||b!=null))switch(h){case"children":case"dangerouslySetInnerHTML":if(g!=null)throw Error(f(137,l));break;default:bt(t,l,h,g,a,b)}return;default:if(hi(l)){for(var pt in e)g=e[pt],e.hasOwnProperty(pt)&&g!==void 0&&!a.hasOwnProperty(pt)&&lf(t,l,pt,void 0,a,g);for(z in a)g=a[z],b=e[z],!a.hasOwnProperty(z)||g===b||g===void 0&&b===void 0||lf(t,l,z,g,a,b);return}}for(var y in e)g=e[y],e.hasOwnProperty(y)&&g!=null&&!a.hasOwnProperty(y)&&bt(t,l,y,null,a,g);for(A in a)g=a[A],b=e[A],!a.hasOwnProperty(A)||g===b||g==null&&b==null||bt(t,l,A,g,a,b)}function id(t){switch(t){case"css":case"script":case"font":case"img":case"image":case"input":case"link":return!0;default:return!1}}function am(){if(typeof performance.getEntriesByType=="function"){for(var t=0,l=0,e=performance.getEntriesByType("resource"),a=0;a<e.length;a++){var u=e[a],n=u.transferSize,i=u.initiatorType,c=u.duration;if(n&&c&&id(i)){for(i=0,c=u.responseEnd,a+=1;a<e.length;a++){var s=e[a],h=s.startTime;if(h>c)break;var z=s.transferSize,A=s.initiatorType;z&&id(A)&&(s=s.responseEnd,i+=z*(s<c?1:(c-h)/(s-h)))}if(--a,l+=8*(n+i)/(u.duration/1e3),t++,10<t)break}}if(0<t)return l/t/1e6}return navigator.connection&&(t=navigator.connection.downlink,typeof t=="number")?t:5}var ef=null,af=null;function Xn(t){return t.nodeType===9?t:t.ownerDocument}function cd(t){switch(t){case"http://www.w3.org/2000/svg":return 1;case"http://www.w3.org/1998/Math/MathML":return 2;default:return 0}}function fd(t,l){if(t===0)switch(l){case"svg":return 1;case"math":return 2;default:return 0}return t===1&&l==="foreignObject"?0:t}function uf(t,l){return t==="textarea"||t==="noscript"||typeof l.children=="string"||typeof l.children=="number"||typeof l.children=="bigint"||typeof l.dangerouslySetInnerHTML=="object"&&l.dangerouslySetInnerHTML!==null&&l.dangerouslySetInnerHTML.__html!=null}var nf=null;function um(){var t=window.event;return t&&t.type==="popstate"?t===nf?!1:(nf=t,!0):(nf=null,!1)}var rd=typeof setTimeout=="function"?setTimeout:void 0,nm=typeof clearTimeout=="function"?clearTimeout:void 0,sd=typeof Promise=="function"?Promise:void 0,im=typeof queueMicrotask=="function"?queueMicrotask:typeof sd<"u"?function(t){return sd.resolve(null).then(t).catch(cm)}:rd;function cm(t){setTimeout(function(){throw t})}function Te(t){return t==="head"}function od(t,l){var e=l,a=0;do{var u=e.nextSibling;if(t.removeChild(e),u&&u.nodeType===8)if(e=u.data,e==="/$"||e==="/&"){if(a===0){t.removeChild(u),Ra(l);return}a--}else if(e==="$"||e==="$?"||e==="$~"||e==="$!"||e==="&")a++;else if(e==="html")Tu(t.ownerDocument.documentElement);else if(e==="head"){e=t.ownerDocument.head,Tu(e);for(var n=e.firstChild;n;){var i=n.nextSibling,c=n.nodeName;n[Qa]||c==="SCRIPT"||c==="STYLE"||c==="LINK"&&n.rel.toLowerCase()==="stylesheet"||e.removeChild(n),n=i}}else e==="body"&&Tu(t.ownerDocument.body);e=u}while(e);Ra(l)}function dd(t,l){var e=t;t=0;do{var a=e.nextSibling;if(e.nodeType===1?l?(e._stashedDisplay=e.style.display,e.style.display="none"):(e.style.display=e._stashedDisplay||"",e.getAttribute("style")===""&&e.removeAttribute("style")):e.nodeType===3&&(l?(e._stashedText=e.nodeValue,e.nodeValue=""):e.nodeValue=e._stashedText||""),a&&a.nodeType===8)if(e=a.data,e==="/$"){if(t===0)break;t--}else e!=="$"&&e!=="$?"&&e!=="$~"&&e!=="$!"||t++;e=a}while(e)}function cf(t){var l=t.firstChild;for(l&&l.nodeType===10&&(l=l.nextSibling);l;){var e=l;switch(l=l.nextSibling,e.nodeName){case"HTML":case"HEAD":case"BODY":cf(e),oi(e);continue;case"SCRIPT":case"STYLE":continue;case"LINK":if(e.rel.toLowerCase()==="stylesheet")continue}t.removeChild(e)}}function fm(t,l,e,a){for(;t.nodeType===1;){var u=e;if(t.nodeName.toLowerCase()!==l.toLowerCase()){if(!a&&(t.nodeName!=="INPUT"||t.type!=="hidden"))break}else if(a){if(!t[Qa])switch(l){case"meta":if(!t.hasAttribute("itemprop"))break;return t;case"link":if(n=t.getAttribute("rel"),n==="stylesheet"&&t.hasAttribute("data-precedence"))break;if(n!==u.rel||t.getAttribute("href")!==(u.href==null||u.href===""?null:u.href)||t.getAttribute("crossorigin")!==(u.crossOrigin==null?null:u.crossOrigin)||t.getAttribute("title")!==(u.title==null?null:u.title))break;return t;case"style":if(t.hasAttribute("data-precedence"))break;return t;case"script":if(n=t.getAttribute("src"),(n!==(u.src==null?null:u.src)||t.getAttribute("type")!==(u.type==null?null:u.type)||t.getAttribute("crossorigin")!==(u.crossOrigin==null?null:u.crossOrigin))&&n&&t.hasAttribute("async")&&!t.hasAttribute("itemprop"))break;return t;default:return t}}else if(l==="input"&&t.type==="hidden"){var n=u.name==null?null:""+u.name;if(u.type==="hidden"&&t.getAttribute("name")===n)return t}else return t;if(t=Ol(t.nextSibling),t===null)break}return null}function rm(t,l,e){if(l==="")return null;for(;t.nodeType!==3;)if((t.nodeType!==1||t.nodeName!=="INPUT"||t.type!=="hidden")&&!e||(t=Ol(t.nextSibling),t===null))return null;return t}function yd(t,l){for(;t.nodeType!==8;)if((t.nodeType!==1||t.nodeName!=="INPUT"||t.type!=="hidden")&&!l||(t=Ol(t.nextSibling),t===null))return null;return t}function ff(t){return t.data==="$?"||t.data==="$~"}function rf(t){return t.data==="$!"||t.data==="$?"&&t.ownerDocument.readyState!=="loading"}function sm(t,l){var e=t.ownerDocument;if(t.data==="$~")t._reactRetry=l;else if(t.data!=="$?"||e.readyState!=="loading")l();else{var a=function(){l(),e.removeEventListener("DOMContentLoaded",a)};e.addEventListener("DOMContentLoaded",a),t._reactRetry=a}}function Ol(t){for(;t!=null;t=t.nextSibling){var l=t.nodeType;if(l===1||l===3)break;if(l===8){if(l=t.data,l==="$"||l==="$!"||l==="$?"||l==="$~"||l==="&"||l==="F!"||l==="F")break;if(l==="/$"||l==="/&")return null}}return t}var sf=null;function md(t){t=t.nextSibling;for(var l=0;t;){if(t.nodeType===8){var e=t.data;if(e==="/$"||e==="/&"){if(l===0)return Ol(t.nextSibling);l--}else e!=="$"&&e!=="$!"&&e!=="$?"&&e!=="$~"&&e!=="&"||l++}t=t.nextSibling}return null}function hd(t){t=t.previousSibling;for(var l=0;t;){if(t.nodeType===8){var e=t.data;if(e==="$"||e==="$!"||e==="$?"||e==="$~"||e==="&"){if(l===0)return t;l--}else e!=="/$"&&e!=="/&"||l++}t=t.previousSibling}return null}function gd(t,l,e){switch(l=Xn(e),t){case"html":if(t=l.documentElement,!t)throw Error(f(452));return t;case"head":if(t=l.head,!t)throw Error(f(453));return t;case"body":if(t=l.body,!t)throw Error(f(454));return t;default:throw Error(f(451))}}function Tu(t){for(var l=t.attributes;l.length;)t.removeAttributeNode(l[0]);oi(t)}var Nl=new Map,vd=new Set;function Qn(t){return typeof t.getRootNode=="function"?t.getRootNode():t.nodeType===9?t:t.ownerDocument}var ee=C.d;C.d={f:om,r:dm,D:ym,C:mm,L:hm,m:gm,X:bm,S:vm,M:pm};function om(){var t=ee.f(),l=Cn();return t||l}function dm(t){var l=Pe(t);l!==null&&l.tag===5&&l.type==="form"?js(l):ee.r(t)}var Ua=typeof document>"u"?null:document;function bd(t,l,e){var a=Ua;if(a&&typeof l=="string"&&l){var u=xl(l);u='link[rel="'+t+'"][href="'+u+'"]',typeof e=="string"&&(u+='[crossorigin="'+e+'"]'),vd.has(u)||(vd.add(u),t={rel:t,crossOrigin:e,href:l},a.querySelector(u)===null&&(l=a.createElement("link"),kt(l,"link",t),Qt(l),a.head.appendChild(l)))}}function ym(t){ee.D(t),bd("dns-prefetch",t,null)}function mm(t,l){ee.C(t,l),bd("preconnect",t,l)}function hm(t,l,e){ee.L(t,l,e);var a=Ua;if(a&&t&&l){var u='link[rel="preload"][as="'+xl(l)+'"]';l==="image"&&e&&e.imageSrcSet?(u+='[imagesrcset="'+xl(e.imageSrcSet)+'"]',typeof e.imageSizes=="string"&&(u+='[imagesizes="'+xl(e.imageSizes)+'"]')):u+='[href="'+xl(t)+'"]';var n=u;switch(l){case"style":n=Ca(t);break;case"script":n=ja(t)}Nl.has(n)||(t=H({rel:"preload",href:l==="image"&&e&&e.imageSrcSet?void 0:t,as:l},e),Nl.set(n,t),a.querySelector(u)!==null||l==="style"&&a.querySelector(Au(n))||l==="script"&&a.querySelector(Eu(n))||(l=a.createElement("link"),kt(l,"link",t),Qt(l),a.head.appendChild(l)))}}function gm(t,l){ee.m(t,l);var e=Ua;if(e&&t){var a=l&&typeof l.as=="string"?l.as:"script",u='link[rel="modulepreload"][as="'+xl(a)+'"][href="'+xl(t)+'"]',n=u;switch(a){case"audioworklet":case"paintworklet":case"serviceworker":case"sharedworker":case"worker":case"script":n=ja(t)}if(!Nl.has(n)&&(t=H({rel:"modulepreload",href:t},l),Nl.set(n,t),e.querySelector(u)===null)){switch(a){case"audioworklet":case"paintworklet":case"serviceworker":case"sharedworker":case"worker":case"script":if(e.querySelector(Eu(n)))return}a=e.createElement("link"),kt(a,"link",t),Qt(a),e.head.appendChild(a)}}}function vm(t,l,e){ee.S(t,l,e);var a=Ua;if(a&&t){var u=ta(a).hoistableStyles,n=Ca(t);l=l||"default";var i=u.get(n);if(!i){var c={loading:0,preload:null};if(i=a.querySelector(Au(n)))c.loading=5;else{t=H({rel:"stylesheet",href:t,"data-precedence":l},e),(e=Nl.get(n))&&of(t,e);var s=i=a.createElement("link");Qt(s),kt(s,"link",t),s._p=new Promise(function(h,z){s.onload=h,s.onerror=z}),s.addEventListener("load",function(){c.loading|=1}),s.addEventListener("error",function(){c.loading|=2}),c.loading|=4,Zn(i,l,a)}i={type:"stylesheet",instance:i,count:1,state:c},u.set(n,i)}}}function bm(t,l){ee.X(t,l);var e=Ua;if(e&&t){var a=ta(e).hoistableScripts,u=ja(t),n=a.get(u);n||(n=e.querySelector(Eu(u)),n||(t=H({src:t,async:!0},l),(l=Nl.get(u))&&df(t,l),n=e.createElement("script"),Qt(n),kt(n,"link",t),e.head.appendChild(n)),n={type:"script",instance:n,count:1,state:null},a.set(u,n))}}function pm(t,l){ee.M(t,l);var e=Ua;if(e&&t){var a=ta(e).hoistableScripts,u=ja(t),n=a.get(u);n||(n=e.querySelector(Eu(u)),n||(t=H({src:t,async:!0,type:"module"},l),(l=Nl.get(u))&&df(t,l),n=e.createElement("script"),Qt(n),kt(n,"link",t),e.head.appendChild(n)),n={type:"script",instance:n,count:1,state:null},a.set(u,n))}}function pd(t,l,e,a){var u=(u=P.current)?Qn(u):null;if(!u)throw Error(f(446));switch(t){case"meta":case"title":return null;case"style":return typeof e.precedence=="string"&&typeof e.href=="string"?(l=Ca(e.href),e=ta(u).hoistableStyles,a=e.get(l),a||(a={type:"style",instance:null,count:0,state:null},e.set(l,a)),a):{type:"void",instance:null,count:0,state:null};case"link":if(e.rel==="stylesheet"&&typeof e.href=="string"&&typeof e.precedence=="string"){t=Ca(e.href);var n=ta(u).hoistableStyles,i=n.get(t);if(i||(u=u.ownerDocument||u,i={type:"stylesheet",instance:null,count:0,state:{loading:0,preload:null}},n.set(t,i),(n=u.querySelector(Au(t)))&&!n._p&&(i.instance=n,i.state.loading=5),Nl.has(t)||(e={rel:"preload",as:"style",href:e.href,crossOrigin:e.crossOrigin,integrity:e.integrity,media:e.media,hrefLang:e.hrefLang,referrerPolicy:e.referrerPolicy},Nl.set(t,e),n||Sm(u,t,e,i.state))),l&&a===null)throw Error(f(528,""));return i}if(l&&a!==null)throw Error(f(529,""));return null;case"script":return l=e.async,e=e.src,typeof e=="string"&&l&&typeof l!="function"&&typeof l!="symbol"?(l=ja(e),e=ta(u).hoistableScripts,a=e.get(l),a||(a={type:"script",instance:null,count:0,state:null},e.set(l,a)),a):{type:"void",instance:null,count:0,state:null};default:throw Error(f(444,t))}}function Ca(t){return'href="'+xl(t)+'"'}function Au(t){return'link[rel="stylesheet"]['+t+"]"}function Sd(t){return H({},t,{"data-precedence":t.precedence,precedence:null})}function Sm(t,l,e,a){t.querySelector('link[rel="preload"][as="style"]['+l+"]")?a.loading=1:(l=t.createElement("link"),a.preload=l,l.addEventListener("load",function(){return a.loading|=1}),l.addEventListener("error",function(){return a.loading|=2}),kt(l,"link",e),Qt(l),t.head.appendChild(l))}function ja(t){return'[src="'+xl(t)+'"]'}function Eu(t){return"script[async]"+t}function xd(t,l,e){if(l.count++,l.instance===null)switch(l.type){case"style":var a=t.querySelector('style[data-href~="'+xl(e.href)+'"]');if(a)return l.instance=a,Qt(a),a;var u=H({},e,{"data-href":e.href,"data-precedence":e.precedence,href:null,precedence:null});return a=(t.ownerDocument||t).createElement("style"),Qt(a),kt(a,"style",u),Zn(a,e.precedence,t),l.instance=a;case"stylesheet":u=Ca(e.href);var n=t.querySelector(Au(u));if(n)return l.state.loading|=4,l.instance=n,Qt(n),n;a=Sd(e),(u=Nl.get(u))&&of(a,u),n=(t.ownerDocument||t).createElement("link"),Qt(n);var i=n;return i._p=new Promise(function(c,s){i.onload=c,i.onerror=s}),kt(n,"link",a),l.state.loading|=4,Zn(n,e.precedence,t),l.instance=n;case"script":return n=ja(e.src),(u=t.querySelector(Eu(n)))?(l.instance=u,Qt(u),u):(a=e,(u=Nl.get(n))&&(a=H({},e),df(a,u)),t=t.ownerDocument||t,u=t.createElement("script"),Qt(u),kt(u,"link",a),t.head.appendChild(u),l.instance=u);case"void":return null;default:throw Error(f(443,l.type))}else l.type==="stylesheet"&&(l.state.loading&4)===0&&(a=l.instance,l.state.loading|=4,Zn(a,e.precedence,t));return l.instance}function Zn(t,l,e){for(var a=e.querySelectorAll('link[rel="stylesheet"][data-precedence],style[data-precedence]'),u=a.length?a[a.length-1]:null,n=u,i=0;i<a.length;i++){var c=a[i];if(c.dataset.precedence===l)n=c;else if(n!==u)break}n?n.parentNode.insertBefore(t,n.nextSibling):(l=e.nodeType===9?e.head:e,l.insertBefore(t,l.firstChild))}function of(t,l){t.crossOrigin==null&&(t.crossOrigin=l.crossOrigin),t.referrerPolicy==null&&(t.referrerPolicy=l.referrerPolicy),t.title==null&&(t.title=l.title)}function df(t,l){t.crossOrigin==null&&(t.crossOrigin=l.crossOrigin),t.referrerPolicy==null&&(t.referrerPolicy=l.referrerPolicy),t.integrity==null&&(t.integrity=l.integrity)}var wn=null;function zd(t,l,e){if(wn===null){var a=new Map,u=wn=new Map;u.set(e,a)}else u=wn,a=u.get(e),a||(a=new Map,u.set(e,a));if(a.has(t))return a;for(a.set(t,null),e=e.getElementsByTagName(t),u=0;u<e.length;u++){var n=e[u];if(!(n[Qa]||n[Lt]||t==="link"&&n.getAttribute("rel")==="stylesheet")&&n.namespaceURI!=="http://www.w3.org/2000/svg"){var i=n.getAttribute(l)||"";i=t+i;var c=a.get(i);c?c.push(n):a.set(i,[n])}}return a}function Td(t,l,e){t=t.ownerDocument||t,t.head.insertBefore(e,l==="title"?t.querySelector("head > title"):null)}function xm(t,l,e){if(e===1||l.itemProp!=null)return!1;switch(t){case"meta":case"title":return!0;case"style":if(typeof l.precedence!="string"||typeof l.href!="string"||l.href==="")break;return!0;case"link":if(typeof l.rel!="string"||typeof l.href!="string"||l.href===""||l.onLoad||l.onError)break;return l.rel==="stylesheet"?(t=l.disabled,typeof l.precedence=="string"&&t==null):!0;case"script":if(l.async&&typeof l.async!="function"&&typeof l.async!="symbol"&&!l.onLoad&&!l.onError&&l.src&&typeof l.src=="string")return!0}return!1}function Ad(t){return!(t.type==="stylesheet"&&(t.state.loading&3)===0)}function zm(t,l,e,a){if(e.type==="stylesheet"&&(typeof a.media!="string"||matchMedia(a.media).matches!==!1)&&(e.state.loading&4)===0){if(e.instance===null){var u=Ca(a.href),n=l.querySelector(Au(u));if(n){l=n._p,l!==null&&typeof l=="object"&&typeof l.then=="function"&&(t.count++,t=Ln.bind(t),l.then(t,t)),e.state.loading|=4,e.instance=n,Qt(n);return}n=l.ownerDocument||l,a=Sd(a),(u=Nl.get(u))&&of(a,u),n=n.createElement("link"),Qt(n);var i=n;i._p=new Promise(function(c,s){i.onload=c,i.onerror=s}),kt(n,"link",a),e.instance=n}t.stylesheets===null&&(t.stylesheets=new Map),t.stylesheets.set(e,l),(l=e.state.preload)&&(e.state.loading&3)===0&&(t.count++,e=Ln.bind(t),l.addEventListener("load",e),l.addEventListener("error",e))}}var yf=0;function Tm(t,l){return t.stylesheets&&t.count===0&&Kn(t,t.stylesheets),0<t.count||0<t.imgCount?function(e){var a=setTimeout(function(){if(t.stylesheets&&Kn(t,t.stylesheets),t.unsuspend){var n=t.unsuspend;t.unsuspend=null,n()}},6e4+l);0<t.imgBytes&&yf===0&&(yf=62500*am());var u=setTimeout(function(){if(t.waitingForImages=!1,t.count===0&&(t.stylesheets&&Kn(t,t.stylesheets),t.unsuspend)){var n=t.unsuspend;t.unsuspend=null,n()}},(t.imgBytes>yf?50:800)+l);return t.unsuspend=e,function(){t.unsuspend=null,clearTimeout(a),clearTimeout(u)}}:null}function Ln(){if(this.count--,this.count===0&&(this.imgCount===0||!this.waitingForImages)){if(this.stylesheets)Kn(this,this.stylesheets);else if(this.unsuspend){var t=this.unsuspend;this.unsuspend=null,t()}}}var Vn=null;function Kn(t,l){t.stylesheets=null,t.unsuspend!==null&&(t.count++,Vn=new Map,l.forEach(Am,t),Vn=null,Ln.call(t))}function Am(t,l){if(!(l.state.loading&4)){var e=Vn.get(t);if(e)var a=e.get(null);else{e=new Map,Vn.set(t,e);for(var u=t.querySelectorAll("link[data-precedence],style[data-precedence]"),n=0;n<u.length;n++){var i=u[n];(i.nodeName==="LINK"||i.getAttribute("media")!=="not all")&&(e.set(i.dataset.precedence,i),a=i)}a&&e.set(null,a)}u=l.instance,i=u.getAttribute("data-precedence"),n=e.get(i)||a,n===a&&e.set(null,u),e.set(i,u),this.count++,a=Ln.bind(this),u.addEventListener("load",a),u.addEventListener("error",a),n?n.parentNode.insertBefore(u,n.nextSibling):(t=t.nodeType===9?t.head:t,t.insertBefore(u,t.firstChild)),l.state.loading|=4}}var Mu={$$typeof:zt,Provider:null,Consumer:null,_currentValue:Z,_currentValue2:Z,_threadCount:0};function Em(t,l,e,a,u,n,i,c,s){this.tag=1,this.containerInfo=t,this.pingCache=this.current=this.pendingChildren=null,this.timeoutHandle=-1,this.callbackNode=this.next=this.pendingContext=this.context=this.cancelPendingCommit=null,this.callbackPriority=0,this.expirationTimes=ci(-1),this.entangledLanes=this.shellSuspendCounter=this.errorRecoveryDisabledLanes=this.expiredLanes=this.warmLanes=this.pingedLanes=this.suspendedLanes=this.pendingLanes=0,this.entanglements=ci(0),this.hiddenUpdates=ci(null),this.identifierPrefix=a,this.onUncaughtError=u,this.onCaughtError=n,this.onRecoverableError=i,this.pooledCache=null,this.pooledCacheLanes=0,this.formState=s,this.incompleteTransitions=new Map}function Ed(t,l,e,a,u,n,i,c,s,h,z,A){return t=new Em(t,l,e,i,s,h,z,A,c),l=1,n===!0&&(l|=24),n=yl(3,null,null,l),t.current=n,n.stateNode=t,l=Vi(),l.refCount++,t.pooledCache=l,l.refCount++,n.memoizedState={element:a,isDehydrated:e,cache:l},Wi(n),t}function Md(t){return t?(t=sa,t):sa}function _d(t,l,e,a,u,n){u=Md(u),a.context===null?a.context=u:a.pendingContext=u,a=de(l),a.payload={element:e},n=n===void 0?null:n,n!==null&&(a.callback=n),e=ye(t,a,l),e!==null&&(fl(e,t,l),uu(e,t,l))}function Od(t,l){if(t=t.memoizedState,t!==null&&t.dehydrated!==null){var e=t.retryLane;t.retryLane=e!==0&&e<l?e:l}}function mf(t,l){Od(t,l),(t=t.alternate)&&Od(t,l)}function Nd(t){if(t.tag===13||t.tag===31){var l=qe(t,67108864);l!==null&&fl(l,t,67108864),mf(t,67108864)}}function Dd(t){if(t.tag===13||t.tag===31){var l=bl();l=fi(l);var e=qe(t,l);e!==null&&fl(e,t,l),mf(t,l)}}var Jn=!0;function Mm(t,l,e,a){var u=x.T;x.T=null;var n=C.p;try{C.p=2,hf(t,l,e,a)}finally{C.p=n,x.T=u}}function _m(t,l,e,a){var u=x.T;x.T=null;var n=C.p;try{C.p=8,hf(t,l,e,a)}finally{C.p=n,x.T=u}}function hf(t,l,e,a){if(Jn){var u=gf(a);if(u===null)tf(t,l,a,kn,e),Cd(t,a);else if(Nm(u,t,l,e,a))a.stopPropagation();else if(Cd(t,a),l&4&&-1<Om.indexOf(t)){for(;u!==null;){var n=Pe(u);if(n!==null)switch(n.tag){case 3:if(n=n.stateNode,n.current.memoizedState.isDehydrated){var i=Ce(n.pendingLanes);if(i!==0){var c=n;for(c.pendingLanes|=2,c.entangledLanes|=2;i;){var s=1<<31-ol(i);c.entanglements[1]|=s,i&=~s}Yl(n),(st&6)===0&&(Dn=rl()+500,Su(0))}}break;case 31:case 13:c=qe(n,2),c!==null&&fl(c,n,2),Cn(),mf(n,2)}if(n=gf(a),n===null&&tf(t,l,a,kn,e),n===u)break;u=n}u!==null&&a.stopPropagation()}else tf(t,l,a,null,e)}}function gf(t){return t=vi(t),vf(t)}var kn=null;function vf(t){if(kn=null,t=Ie(t),t!==null){var l=O(t);if(l===null)t=null;else{var e=l.tag;if(e===13){if(t=D(l),t!==null)return t;t=null}else if(e===31){if(t=U(l),t!==null)return t;t=null}else if(e===3){if(l.stateNode.current.memoizedState.isDehydrated)return l.tag===3?l.stateNode.containerInfo:null;t=null}else l!==t&&(t=null)}}return kn=t,null}function Ud(t){switch(t){case"beforetoggle":case"cancel":case"click":case"close":case"contextmenu":case"copy":case"cut":case"auxclick":case"dblclick":case"dragend":case"dragstart":case"drop":case"focusin":case"focusout":case"input":case"invalid":case"keydown":case"keypress":case"keyup":case"mousedown":case"mouseup":case"paste":case"pause":case"play":case"pointercancel":case"pointerdown":case"pointerup":case"ratechange":case"reset":case"resize":case"seeked":case"submit":case"toggle":case"touchcancel":case"touchend":case"touchstart":case"volumechange":case"change":case"selectionchange":case"textInput":case"compositionstart":case"compositionend":case"compositionupdate":case"beforeblur":case"afterblur":case"beforeinput":case"blur":case"fullscreenchange":case"focus":case"hashchange":case"popstate":case"select":case"selectstart":return 2;case"drag":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"mousemove":case"mouseout":case"mouseover":case"pointermove":case"pointerout":case"pointerover":case"scroll":case"touchmove":case"wheel":case"mouseenter":case"mouseleave":case"pointerenter":case"pointerleave":return 8;case"message":switch(y0()){case Yf:return 2;case Gf:return 8;case Bu:case m0:return 32;case Xf:return 268435456;default:return 32}default:return 32}}var bf=!1,Ae=null,Ee=null,Me=null,_u=new Map,Ou=new Map,_e=[],Om="mousedown mouseup touchcancel touchend touchstart auxclick dblclick pointercancel pointerdown pointerup dragend dragstart drop compositionend compositionstart keydown keypress keyup input textInput copy cut paste click change contextmenu reset".split(" ");function Cd(t,l){switch(t){case"focusin":case"focusout":Ae=null;break;case"dragenter":case"dragleave":Ee=null;break;case"mouseover":case"mouseout":Me=null;break;case"pointerover":case"pointerout":_u.delete(l.pointerId);break;case"gotpointercapture":case"lostpointercapture":Ou.delete(l.pointerId)}}function Nu(t,l,e,a,u,n){return t===null||t.nativeEvent!==n?(t={blockedOn:l,domEventName:e,eventSystemFlags:a,nativeEvent:n,targetContainers:[u]},l!==null&&(l=Pe(l),l!==null&&Nd(l)),t):(t.eventSystemFlags|=a,l=t.targetContainers,u!==null&&l.indexOf(u)===-1&&l.push(u),t)}function Nm(t,l,e,a,u){switch(l){case"focusin":return Ae=Nu(Ae,t,l,e,a,u),!0;case"dragenter":return Ee=Nu(Ee,t,l,e,a,u),!0;case"mouseover":return Me=Nu(Me,t,l,e,a,u),!0;case"pointerover":var n=u.pointerId;return _u.set(n,Nu(_u.get(n)||null,t,l,e,a,u)),!0;case"gotpointercapture":return n=u.pointerId,Ou.set(n,Nu(Ou.get(n)||null,t,l,e,a,u)),!0}return!1}function jd(t){var l=Ie(t.target);if(l!==null){var e=O(l);if(e!==null){if(l=e.tag,l===13){if(l=D(e),l!==null){t.blockedOn=l,Kf(t.priority,function(){Dd(e)});return}}else if(l===31){if(l=U(e),l!==null){t.blockedOn=l,Kf(t.priority,function(){Dd(e)});return}}else if(l===3&&e.stateNode.current.memoizedState.isDehydrated){t.blockedOn=e.tag===3?e.stateNode.containerInfo:null;return}}}t.blockedOn=null}function Wn(t){if(t.blockedOn!==null)return!1;for(var l=t.targetContainers;0<l.length;){var e=gf(t.nativeEvent);if(e===null){e=t.nativeEvent;var a=new e.constructor(e.type,e);gi=a,e.target.dispatchEvent(a),gi=null}else return l=Pe(e),l!==null&&Nd(l),t.blockedOn=e,!1;l.shift()}return!0}function Rd(t,l,e){Wn(t)&&e.delete(l)}function Dm(){bf=!1,Ae!==null&&Wn(Ae)&&(Ae=null),Ee!==null&&Wn(Ee)&&(Ee=null),Me!==null&&Wn(Me)&&(Me=null),_u.forEach(Rd),Ou.forEach(Rd)}function $n(t,l){t.blockedOn===l&&(t.blockedOn=null,bf||(bf=!0,r.unstable_scheduleCallback(r.unstable_NormalPriority,Dm)))}var Fn=null;function Hd(t){Fn!==t&&(Fn=t,r.unstable_scheduleCallback(r.unstable_NormalPriority,function(){Fn===t&&(Fn=null);for(var l=0;l<t.length;l+=3){var e=t[l],a=t[l+1],u=t[l+2];if(typeof a!="function"){if(vf(a||e)===null)continue;break}var n=Pe(e);n!==null&&(t.splice(l,3),l-=3,hc(n,{pending:!0,data:u,method:e.method,action:a},a,u))}}))}function Ra(t){function l(s){return $n(s,t)}Ae!==null&&$n(Ae,t),Ee!==null&&$n(Ee,t),Me!==null&&$n(Me,t),_u.forEach(l),Ou.forEach(l);for(var e=0;e<_e.length;e++){var a=_e[e];a.blockedOn===t&&(a.blockedOn=null)}for(;0<_e.length&&(e=_e[0],e.blockedOn===null);)jd(e),e.blockedOn===null&&_e.shift();if(e=(t.ownerDocument||t).$$reactFormReplay,e!=null)for(a=0;a<e.length;a+=3){var u=e[a],n=e[a+1],i=u[el]||null;if(typeof n=="function")i||Hd(e);else if(i){var c=null;if(n&&n.hasAttribute("formAction")){if(u=n,i=n[el]||null)c=i.formAction;else if(vf(u)!==null)continue}else c=i.action;typeof c=="function"?e[a+1]=c:(e.splice(a,3),a-=3),Hd(e)}}}function Bd(){function t(n){n.canIntercept&&n.info==="react-transition"&&n.intercept({handler:function(){return new Promise(function(i){return u=i})},focusReset:"manual",scroll:"manual"})}function l(){u!==null&&(u(),u=null),a||setTimeout(e,20)}function e(){if(!a&&!navigation.transition){var n=navigation.currentEntry;n&&n.url!=null&&navigation.navigate(n.url,{state:n.getState(),info:"react-transition",history:"replace"})}}if(typeof navigation=="object"){var a=!1,u=null;return navigation.addEventListener("navigate",t),navigation.addEventListener("navigatesuccess",l),navigation.addEventListener("navigateerror",l),setTimeout(e,100),function(){a=!0,navigation.removeEventListener("navigate",t),navigation.removeEventListener("navigatesuccess",l),navigation.removeEventListener("navigateerror",l),u!==null&&(u(),u=null)}}}function pf(t){this._internalRoot=t}In.prototype.render=pf.prototype.render=function(t){var l=this._internalRoot;if(l===null)throw Error(f(409));var e=l.current,a=bl();_d(e,a,t,l,null,null)},In.prototype.unmount=pf.prototype.unmount=function(){var t=this._internalRoot;if(t!==null){this._internalRoot=null;var l=t.containerInfo;_d(t.current,2,null,t,null,null),Cn(),l[Fe]=null}};function In(t){this._internalRoot=t}In.prototype.unstable_scheduleHydration=function(t){if(t){var l=Vf();t={blockedOn:null,target:t,priority:l};for(var e=0;e<_e.length&&l!==0&&l<_e[e].priority;e++);_e.splice(e,0,t),e===0&&jd(t)}};var qd=v.version;if(qd!=="19.2.4")throw Error(f(527,qd,"19.2.4"));C.findDOMNode=function(t){var l=t._reactInternals;if(l===void 0)throw typeof t.render=="function"?Error(f(188)):(t=Object.keys(t).join(","),Error(f(268,t)));return t=p(l),t=t!==null?R(t):null,t=t===null?null:t.stateNode,t};var Um={bundleType:0,version:"19.2.4",rendererPackageName:"react-dom",currentDispatcherRef:x,reconcilerVersion:"19.2.4"};if(typeof __REACT_DEVTOOLS_GLOBAL_HOOK__<"u"){var Pn=__REACT_DEVTOOLS_GLOBAL_HOOK__;if(!Pn.isDisabled&&Pn.supportsFiber)try{Ya=Pn.inject(Um),sl=Pn}catch{}}return Uu.createRoot=function(t,l){if(!_(t))throw Error(f(299));var e=!1,a="",u=ws,n=Ls,i=Vs;return l!=null&&(l.unstable_strictMode===!0&&(e=!0),l.identifierPrefix!==void 0&&(a=l.identifierPrefix),l.onUncaughtError!==void 0&&(u=l.onUncaughtError),l.onCaughtError!==void 0&&(n=l.onCaughtError),l.onRecoverableError!==void 0&&(i=l.onRecoverableError)),l=Ed(t,1,!1,null,null,e,a,null,u,n,i,Bd),t[Fe]=l.current,Pc(t),new pf(l)},Uu.hydrateRoot=function(t,l,e){if(!_(t))throw Error(f(299));var a=!1,u="",n=ws,i=Ls,c=Vs,s=null;return e!=null&&(e.unstable_strictMode===!0&&(a=!0),e.identifierPrefix!==void 0&&(u=e.identifierPrefix),e.onUncaughtError!==void 0&&(n=e.onUncaughtError),e.onCaughtError!==void 0&&(i=e.onCaughtError),e.onRecoverableError!==void 0&&(c=e.onRecoverableError),e.formState!==void 0&&(s=e.formState)),l=Ed(t,1,!0,l,e??null,a,u,s,n,i,c,Bd),l.context=Md(null),e=l.current,a=bl(),a=fi(a),u=de(a),u.callback=null,ye(e,u,a),e=a,l.current.lanes=e,Xa(l,e),Yl(l),t[Fe]=l.current,Pc(t),new In(l)},Uu.version="19.2.4",Uu}var Jd;function Qm(){if(Jd)return zf.exports;Jd=1;function r(){if(!(typeof __REACT_DEVTOOLS_GLOBAL_HOOK__>"u"||typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE!="function"))try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(r)}catch(v){console.error(v)}}return r(),zf.exports=Xm(),zf.exports}var Zm=Qm();const wm=r=>r.replace(/([a-z0-9])([A-Z])/g,"$1-$2").toLowerCase(),Pd=(...r)=>r.filter((v,S,f)=>!!v&&v.trim()!==""&&f.indexOf(v)===S).join(" ").trim();var Lm={xmlns:"http://www.w3.org/2000/svg",width:24,height:24,viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:2,strokeLinecap:"round",strokeLinejoin:"round"};const Vm=xt.forwardRef(({color:r="currentColor",size:v=24,strokeWidth:S=2,absoluteStrokeWidth:f,className:_="",children:O,iconNode:D,...U},N)=>xt.createElement("svg",{ref:N,...Lm,width:v,height:v,stroke:r,strokeWidth:f?Number(S)*24/Number(v):S,className:Pd("lucide",_),...U},[...D.map(([p,R])=>xt.createElement(p,R)),...Array.isArray(O)?O:[O]]));const Dl=(r,v)=>{const S=xt.forwardRef(({className:f,..._},O)=>xt.createElement(Vm,{ref:O,iconNode:v,className:Pd(`lucide-${wm(r)}`,f),..._}));return S.displayName=`${r}`,S};const Km=Dl("Binary",[["rect",{x:"14",y:"14",width:"4",height:"6",rx:"2",key:"p02svl"}],["rect",{x:"6",y:"4",width:"4",height:"6",rx:"2",key:"xm4xkj"}],["path",{d:"M6 20h4",key:"1i6q5t"}],["path",{d:"M14 10h4",key:"ru81e7"}],["path",{d:"M6 14h2v6",key:"16z9wg"}],["path",{d:"M14 4h2v6",key:"1idq9u"}]]);const Jm=Dl("BookText",[["path",{d:"M4 19.5v-15A2.5 2.5 0 0 1 6.5 2H19a1 1 0 0 1 1 1v18a1 1 0 0 1-1 1H6.5a1 1 0 0 1 0-5H20",key:"k3hazp"}],["path",{d:"M8 11h8",key:"vwpz6n"}],["path",{d:"M8 7h6",key:"1f0q6e"}]]);const km=Dl("EyeOff",[["path",{d:"M10.733 5.076a10.744 10.744 0 0 1 11.205 6.575 1 1 0 0 1 0 .696 10.747 10.747 0 0 1-1.444 2.49",key:"ct8e1f"}],["path",{d:"M14.084 14.158a3 3 0 0 1-4.242-4.242",key:"151rxh"}],["path",{d:"M17.479 17.499a10.75 10.75 0 0 1-15.417-5.151 1 1 0 0 1 0-.696 10.75 10.75 0 0 1 4.446-5.143",key:"13bj9a"}],["path",{d:"m2 2 20 20",key:"1ooewy"}]]);const Wm=Dl("Eye",[["path",{d:"M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0",key:"1nclc0"}],["circle",{cx:"12",cy:"12",r:"3",key:"1v7zrd"}]]);const $m=Dl("Globe",[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20",key:"13o1zl"}],["path",{d:"M2 12h20",key:"9i4pu4"}]]);const kd=Dl("LoaderCircle",[["path",{d:"M21 12a9 9 0 1 1-6.219-8.56",key:"13zald"}]]);const Fm=Dl("Lock",[["rect",{width:"18",height:"11",x:"3",y:"11",rx:"2",ry:"2",key:"1w4ew1"}],["path",{d:"M7 11V7a5 5 0 0 1 10 0v4",key:"fwvmzm"}]]);const Im=Dl("LogIn",[["path",{d:"M15 3h4a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2h-4",key:"u53s6r"}],["polyline",{points:"10 17 15 12 10 7",key:"1ail0h"}],["line",{x1:"15",x2:"3",y1:"12",y2:"12",key:"v6grx8"}]]);const Pm=Dl("RotateCw",[["path",{d:"M21 12a9 9 0 1 1-9-9c2.52 0 4.93 1 6.74 2.74L21 8",key:"1p45f6"}],["path",{d:"M21 3v5h-5",key:"1q7to0"}]]);const th=Dl("User",[["path",{d:"M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2",key:"975kel"}],["circle",{cx:"12",cy:"7",r:"4",key:"17ys0d"}]]);const lh=Dl("Waypoints",[["circle",{cx:"12",cy:"4.5",r:"2.5",key:"r5ysbb"}],["path",{d:"m10.2 6.3-3.9 3.9",key:"1nzqf6"}],["circle",{cx:"4.5",cy:"12",r:"2.5",key:"jydg6v"}],["path",{d:"M7 12h10",key:"b7w52i"}],["circle",{cx:"19.5",cy:"12",r:"2.5",key:"1piiel"}],["path",{d:"m13.8 17.7 3.9-3.9",key:"1wyg1y"}],["circle",{cx:"12",cy:"19.5",r:"2.5",key:"13o1pw"}]]);const eh=Dl("X",[["path",{d:"M18 6 6 18",key:"1bl5f8"}],["path",{d:"m6 6 12 12",key:"d8bk6v"}]]);function t0(){return globalThis.__DATA__??{}}function l0(r){var v,S,f="";if(typeof r=="string"||typeof r=="number")f+=r;else if(typeof r=="object")if(Array.isArray(r)){var _=r.length;for(v=0;v<_;v++)r[v]&&(S=l0(r[v]))&&(f&&(f+=" "),f+=S)}else for(S in r)r[S]&&(f&&(f+=" "),f+=S);return f}function ah(){for(var r,v,S=0,f="",_=arguments.length;S<_;S++)(r=arguments[S])&&(v=l0(r))&&(f&&(f+=" "),f+=v);return f}const Hf="-",uh=r=>{const v=ih(r),{conflictingClassGroups:S,conflictingClassGroupModifiers:f}=r;return{getClassGroupId:D=>{const U=D.split(Hf);return U[0]===""&&U.length!==1&&U.shift(),e0(U,v)||nh(D)},getConflictingClassGroupIds:(D,U)=>{const N=S[D]||[];return U&&f[D]?[...N,...f[D]]:N}}},e0=(r,v)=>{if(r.length===0)return v.classGroupId;const S=r[0],f=v.nextPart.get(S),_=f?e0(r.slice(1),f):void 0;if(_)return _;if(v.validators.length===0)return;const O=r.join(Hf);return v.validators.find(({validator:D})=>D(O))?.classGroupId},Wd=/^\[(.+)\]$/,nh=r=>{if(Wd.test(r)){const v=Wd.exec(r)[1],S=v?.substring(0,v.indexOf(":"));if(S)return"arbitrary.."+S}},ih=r=>{const{theme:v,prefix:S}=r,f={nextPart:new Map,validators:[]};return fh(Object.entries(r.classGroups),S).forEach(([O,D])=>{Df(D,f,O,v)}),f},Df=(r,v,S,f)=>{r.forEach(_=>{if(typeof _=="string"){const O=_===""?v:$d(v,_);O.classGroupId=S;return}if(typeof _=="function"){if(ch(_)){Df(_(f),v,S,f);return}v.validators.push({validator:_,classGroupId:S});return}Object.entries(_).forEach(([O,D])=>{Df(D,$d(v,O),S,f)})})},$d=(r,v)=>{let S=r;return v.split(Hf).forEach(f=>{S.nextPart.has(f)||S.nextPart.set(f,{nextPart:new Map,validators:[]}),S=S.nextPart.get(f)}),S},ch=r=>r.isThemeGetter,fh=(r,v)=>v?r.map(([S,f])=>{const _=f.map(O=>typeof O=="string"?v+O:typeof O=="object"?Object.fromEntries(Object.entries(O).map(([D,U])=>[v+D,U])):O);return[S,_]}):r,rh=r=>{if(r<1)return{get:()=>{},set:()=>{}};let v=0,S=new Map,f=new Map;const _=(O,D)=>{S.set(O,D),v++,v>r&&(v=0,f=S,S=new Map)};return{get(O){let D=S.get(O);if(D!==void 0)return D;if((D=f.get(O))!==void 0)return _(O,D),D},set(O,D){S.has(O)?S.set(O,D):_(O,D)}}},a0="!",sh=r=>{const{separator:v,experimentalParseClassName:S}=r,f=v.length===1,_=v[0],O=v.length,D=U=>{const N=[];let p=0,R=0,H;for(let Q=0;Q<U.length;Q++){let V=U[Q];if(p===0){if(V===_&&(f||U.slice(Q,Q+O)===v)){N.push(U.slice(R,Q)),R=Q+O;continue}if(V==="/"){H=Q;continue}}V==="["?p++:V==="]"&&p--}const L=N.length===0?U:U.substring(R),ot=L.startsWith(a0),ct=ot?L.substring(1):L,G=H&&H>R?H-R:void 0;return{modifiers:N,hasImportantModifier:ot,baseClassName:ct,maybePostfixModifierPosition:G}};return S?U=>S({className:U,parseClassName:D}):D},oh=r=>{if(r.length<=1)return r;const v=[];let S=[];return r.forEach(f=>{f[0]==="["?(v.push(...S.sort(),f),S=[]):S.push(f)}),v.push(...S.sort()),v},dh=r=>({cache:rh(r.cacheSize),parseClassName:sh(r),...uh(r)}),yh=/\s+/,mh=(r,v)=>{const{parseClassName:S,getClassGroupId:f,getConflictingClassGroupIds:_}=v,O=[],D=r.trim().split(yh);let U="";for(let N=D.length-1;N>=0;N-=1){const p=D[N],{modifiers:R,hasImportantModifier:H,baseClassName:L,maybePostfixModifierPosition:ot}=S(p);let ct=!!ot,G=f(ct?L.substring(0,ot):L);if(!G){if(!ct){U=p+(U.length>0?" "+U:U);continue}if(G=f(L),!G){U=p+(U.length>0?" "+U:U);continue}ct=!1}const Q=oh(R).join(":"),V=H?Q+a0:Q,gt=V+G;if(O.includes(gt))continue;O.push(gt);const zt=_(G,ct);for(let _t=0;_t<zt.length;++_t){const nt=zt[_t];O.push(V+nt)}U=p+(U.length>0?" "+U:U)}return U};function hh(){let r=0,v,S,f="";for(;r<arguments.length;)(v=arguments[r++])&&(S=u0(v))&&(f&&(f+=" "),f+=S);return f}const u0=r=>{if(typeof r=="string")return r;let v,S="";for(let f=0;f<r.length;f++)r[f]&&(v=u0(r[f]))&&(S&&(S+=" "),S+=v);return S};function gh(r,...v){let S,f,_,O=D;function D(N){const p=v.reduce((R,H)=>H(R),r());return S=dh(p),f=S.cache.get,_=S.cache.set,O=U,U(N)}function U(N){const p=f(N);if(p)return p;const R=mh(N,S);return _(N,R),R}return function(){return O(hh.apply(null,arguments))}}const Et=r=>{const v=S=>S[r]||[];return v.isThemeGetter=!0,v},n0=/^\[(?:([a-z-]+):)?(.+)\]$/i,vh=/^\d+\/\d+$/,bh=new Set(["px","full","screen"]),ph=/^(\d+(\.\d+)?)?(xs|sm|md|lg|xl)$/,Sh=/\d+(%|px|r?em|[sdl]?v([hwib]|min|max)|pt|pc|in|cm|mm|cap|ch|ex|r?lh|cq(w|h|i|b|min|max))|\b(calc|min|max|clamp)\(.+\)|^0$/,xh=/^(rgba?|hsla?|hwb|(ok)?(lab|lch)|color-mix)\(.+\)$/,zh=/^(inset_)?-?((\d+)?\.?(\d+)[a-z]+|0)_-?((\d+)?\.?(\d+)[a-z]+|0)/,Th=/^(url|image|image-set|cross-fade|element|(repeating-)?(linear|radial|conic)-gradient)\(.+\)$/,ae=r=>Ha(r)||bh.has(r)||vh.test(r),Ne=r=>Ba(r,"length",Uh),Ha=r=>!!r&&!Number.isNaN(Number(r)),Mf=r=>Ba(r,"number",Ha),Cu=r=>!!r&&Number.isInteger(Number(r)),Ah=r=>r.endsWith("%")&&Ha(r.slice(0,-1)),F=r=>n0.test(r),De=r=>ph.test(r),Eh=new Set(["length","size","percentage"]),Mh=r=>Ba(r,Eh,i0),_h=r=>Ba(r,"position",i0),Oh=new Set(["image","url"]),Nh=r=>Ba(r,Oh,jh),Dh=r=>Ba(r,"",Ch),ju=()=>!0,Ba=(r,v,S)=>{const f=n0.exec(r);return f?f[1]?typeof v=="string"?f[1]===v:v.has(f[1]):S(f[2]):!1},Uh=r=>Sh.test(r)&&!xh.test(r),i0=()=>!1,Ch=r=>zh.test(r),jh=r=>Th.test(r),Rh=()=>{const r=Et("colors"),v=Et("spacing"),S=Et("blur"),f=Et("brightness"),_=Et("borderColor"),O=Et("borderRadius"),D=Et("borderSpacing"),U=Et("borderWidth"),N=Et("contrast"),p=Et("grayscale"),R=Et("hueRotate"),H=Et("invert"),L=Et("gap"),ot=Et("gradientColorStops"),ct=Et("gradientColorStopPositions"),G=Et("inset"),Q=Et("margin"),V=Et("opacity"),gt=Et("padding"),zt=Et("saturate"),_t=Et("scale"),nt=Et("sepia"),Ot=Et("skew"),J=Et("space"),Nt=Et("translate"),Xt=()=>["auto","contain","none"],pl=()=>["auto","hidden","clip","visible","scroll"],Pt=()=>["auto",F,v],I=()=>[F,v],Rl=()=>["",ae,Ne],tl=()=>["auto",Ha,F],ll=()=>["bottom","center","left","left-bottom","left-top","right","right-bottom","right-top","top"],x=()=>["solid","dashed","dotted","double","none"],C=()=>["normal","multiply","screen","overlay","darken","lighten","color-dodge","color-burn","hard-light","soft-light","difference","exclusion","hue","saturation","color","luminosity"],Z=()=>["start","end","center","between","around","evenly","stretch"],it=()=>["","0",F],dt=()=>["auto","avoid","all","avoid-page","page","left","right","column"],o=()=>[Ha,F];return{cacheSize:500,separator:":",theme:{colors:[ju],spacing:[ae,Ne],blur:["none","",De,F],brightness:o(),borderColor:[r],borderRadius:["none","","full",De,F],borderSpacing:I(),borderWidth:Rl(),contrast:o(),grayscale:it(),hueRotate:o(),invert:it(),gap:I(),gradientColorStops:[r],gradientColorStopPositions:[Ah,Ne],inset:Pt(),margin:Pt(),opacity:o(),padding:I(),saturate:o(),scale:o(),sepia:it(),skew:o(),space:I(),translate:I()},classGroups:{aspect:[{aspect:["auto","square","video",F]}],container:["container"],columns:[{columns:[De]}],"break-after":[{"break-after":dt()}],"break-before":[{"break-before":dt()}],"break-inside":[{"break-inside":["auto","avoid","avoid-page","avoid-column"]}],"box-decoration":[{"box-decoration":["slice","clone"]}],box:[{box:["border","content"]}],display:["block","inline-block","inline","flex","inline-flex","table","inline-table","table-caption","table-cell","table-column","table-column-group","table-footer-group","table-header-group","table-row-group","table-row","flow-root","grid","inline-grid","contents","list-item","hidden"],float:[{float:["right","left","none","start","end"]}],clear:[{clear:["left","right","both","none","start","end"]}],isolation:["isolate","isolation-auto"],"object-fit":[{object:["contain","cover","fill","none","scale-down"]}],"object-position":[{object:[...ll(),F]}],overflow:[{overflow:pl()}],"overflow-x":[{"overflow-x":pl()}],"overflow-y":[{"overflow-y":pl()}],overscroll:[{overscroll:Xt()}],"overscroll-x":[{"overscroll-x":Xt()}],"overscroll-y":[{"overscroll-y":Xt()}],position:["static","fixed","absolute","relative","sticky"],inset:[{inset:[G]}],"inset-x":[{"inset-x":[G]}],"inset-y":[{"inset-y":[G]}],start:[{start:[G]}],end:[{end:[G]}],top:[{top:[G]}],right:[{right:[G]}],bottom:[{bottom:[G]}],left:[{left:[G]}],visibility:["visible","invisible","collapse"],z:[{z:["auto",Cu,F]}],basis:[{basis:Pt()}],"flex-direction":[{flex:["row","row-reverse","col","col-reverse"]}],"flex-wrap":[{flex:["wrap","wrap-reverse","nowrap"]}],flex:[{flex:["1","auto","initial","none",F]}],grow:[{grow:it()}],shrink:[{shrink:it()}],order:[{order:["first","last","none",Cu,F]}],"grid-cols":[{"grid-cols":[ju]}],"col-start-end":[{col:["auto",{span:["full",Cu,F]},F]}],"col-start":[{"col-start":tl()}],"col-end":[{"col-end":tl()}],"grid-rows":[{"grid-rows":[ju]}],"row-start-end":[{row:["auto",{span:[Cu,F]},F]}],"row-start":[{"row-start":tl()}],"row-end":[{"row-end":tl()}],"grid-flow":[{"grid-flow":["row","col","dense","row-dense","col-dense"]}],"auto-cols":[{"auto-cols":["auto","min","max","fr",F]}],"auto-rows":[{"auto-rows":["auto","min","max","fr",F]}],gap:[{gap:[L]}],"gap-x":[{"gap-x":[L]}],"gap-y":[{"gap-y":[L]}],"justify-content":[{justify:["normal",...Z()]}],"justify-items":[{"justify-items":["start","end","center","stretch"]}],"justify-self":[{"justify-self":["auto","start","end","center","stretch"]}],"align-content":[{content:["normal",...Z(),"baseline"]}],"align-items":[{items:["start","end","center","baseline","stretch"]}],"align-self":[{self:["auto","start","end","center","stretch","baseline"]}],"place-content":[{"place-content":[...Z(),"baseline"]}],"place-items":[{"place-items":["start","end","center","baseline","stretch"]}],"place-self":[{"place-self":["auto","start","end","center","stretch"]}],p:[{p:[gt]}],px:[{px:[gt]}],py:[{py:[gt]}],ps:[{ps:[gt]}],pe:[{pe:[gt]}],pt:[{pt:[gt]}],pr:[{pr:[gt]}],pb:[{pb:[gt]}],pl:[{pl:[gt]}],m:[{m:[Q]}],mx:[{mx:[Q]}],my:[{my:[Q]}],ms:[{ms:[Q]}],me:[{me:[Q]}],mt:[{mt:[Q]}],mr:[{mr:[Q]}],mb:[{mb:[Q]}],ml:[{ml:[Q]}],"space-x":[{"space-x":[J]}],"space-x-reverse":["space-x-reverse"],"space-y":[{"space-y":[J]}],"space-y-reverse":["space-y-reverse"],w:[{w:["auto","min","max","fit","svw","lvw","dvw",F,v]}],"min-w":[{"min-w":[F,v,"min","max","fit"]}],"max-w":[{"max-w":[F,v,"none","full","min","max","fit","prose",{screen:[De]},De]}],h:[{h:[F,v,"auto","min","max","fit","svh","lvh","dvh"]}],"min-h":[{"min-h":[F,v,"min","max","fit","svh","lvh","dvh"]}],"max-h":[{"max-h":[F,v,"min","max","fit","svh","lvh","dvh"]}],size:[{size:[F,v,"auto","min","max","fit"]}],"font-size":[{text:["base",De,Ne]}],"font-smoothing":["antialiased","subpixel-antialiased"],"font-style":["italic","not-italic"],"font-weight":[{font:["thin","extralight","light","normal","medium","semibold","bold","extrabold","black",Mf]}],"font-family":[{font:[ju]}],"fvn-normal":["normal-nums"],"fvn-ordinal":["ordinal"],"fvn-slashed-zero":["slashed-zero"],"fvn-figure":["lining-nums","oldstyle-nums"],"fvn-spacing":["proportional-nums","tabular-nums"],"fvn-fraction":["diagonal-fractions","stacked-fractions"],tracking:[{tracking:["tighter","tight","normal","wide","wider","widest",F]}],"line-clamp":[{"line-clamp":["none",Ha,Mf]}],leading:[{leading:["none","tight","snug","normal","relaxed","loose",ae,F]}],"list-image":[{"list-image":["none",F]}],"list-style-type":[{list:["none","disc","decimal",F]}],"list-style-position":[{list:["inside","outside"]}],"placeholder-color":[{placeholder:[r]}],"placeholder-opacity":[{"placeholder-opacity":[V]}],"text-alignment":[{text:["left","center","right","justify","start","end"]}],"text-color":[{text:[r]}],"text-opacity":[{"text-opacity":[V]}],"text-decoration":["underline","overline","line-through","no-underline"],"text-decoration-style":[{decoration:[...x(),"wavy"]}],"text-decoration-thickness":[{decoration:["auto","from-font",ae,Ne]}],"underline-offset":[{"underline-offset":["auto",ae,F]}],"text-decoration-color":[{decoration:[r]}],"text-transform":["uppercase","lowercase","capitalize","normal-case"],"text-overflow":["truncate","text-ellipsis","text-clip"],"text-wrap":[{text:["wrap","nowrap","balance","pretty"]}],indent:[{indent:I()}],"vertical-align":[{align:["baseline","top","middle","bottom","text-top","text-bottom","sub","super",F]}],whitespace:[{whitespace:["normal","nowrap","pre","pre-line","pre-wrap","break-spaces"]}],break:[{break:["normal","words","all","keep"]}],hyphens:[{hyphens:["none","manual","auto"]}],content:[{content:["none",F]}],"bg-attachment":[{bg:["fixed","local","scroll"]}],"bg-clip":[{"bg-clip":["border","padding","content","text"]}],"bg-opacity":[{"bg-opacity":[V]}],"bg-origin":[{"bg-origin":["border","padding","content"]}],"bg-position":[{bg:[...ll(),_h]}],"bg-repeat":[{bg:["no-repeat",{repeat:["","x","y","round","space"]}]}],"bg-size":[{bg:["auto","cover","contain",Mh]}],"bg-image":[{bg:["none",{"gradient-to":["t","tr","r","br","b","bl","l","tl"]},Nh]}],"bg-color":[{bg:[r]}],"gradient-from-pos":[{from:[ct]}],"gradient-via-pos":[{via:[ct]}],"gradient-to-pos":[{to:[ct]}],"gradient-from":[{from:[ot]}],"gradient-via":[{via:[ot]}],"gradient-to":[{to:[ot]}],rounded:[{rounded:[O]}],"rounded-s":[{"rounded-s":[O]}],"rounded-e":[{"rounded-e":[O]}],"rounded-t":[{"rounded-t":[O]}],"rounded-r":[{"rounded-r":[O]}],"rounded-b":[{"rounded-b":[O]}],"rounded-l":[{"rounded-l":[O]}],"rounded-ss":[{"rounded-ss":[O]}],"rounded-se":[{"rounded-se":[O]}],"rounded-ee":[{"rounded-ee":[O]}],"rounded-es":[{"rounded-es":[O]}],"rounded-tl":[{"rounded-tl":[O]}],"rounded-tr":[{"rounded-tr":[O]}],"rounded-br":[{"rounded-br":[O]}],"rounded-bl":[{"rounded-bl":[O]}],"border-w":[{border:[U]}],"border-w-x":[{"border-x":[U]}],"border-w-y":[{"border-y":[U]}],"border-w-s":[{"border-s":[U]}],"border-w-e":[{"border-e":[U]}],"border-w-t":[{"border-t":[U]}],"border-w-r":[{"border-r":[U]}],"border-w-b":[{"border-b":[U]}],"border-w-l":[{"border-l":[U]}],"border-opacity":[{"border-opacity":[V]}],"border-style":[{border:[...x(),"hidden"]}],"divide-x":[{"divide-x":[U]}],"divide-x-reverse":["divide-x-reverse"],"divide-y":[{"divide-y":[U]}],"divide-y-reverse":["divide-y-reverse"],"divide-opacity":[{"divide-opacity":[V]}],"divide-style":[{divide:x()}],"border-color":[{border:[_]}],"border-color-x":[{"border-x":[_]}],"border-color-y":[{"border-y":[_]}],"border-color-s":[{"border-s":[_]}],"border-color-e":[{"border-e":[_]}],"border-color-t":[{"border-t":[_]}],"border-color-r":[{"border-r":[_]}],"border-color-b":[{"border-b":[_]}],"border-color-l":[{"border-l":[_]}],"divide-color":[{divide:[_]}],"outline-style":[{outline:["",...x()]}],"outline-offset":[{"outline-offset":[ae,F]}],"outline-w":[{outline:[ae,Ne]}],"outline-color":[{outline:[r]}],"ring-w":[{ring:Rl()}],"ring-w-inset":["ring-inset"],"ring-color":[{ring:[r]}],"ring-opacity":[{"ring-opacity":[V]}],"ring-offset-w":[{"ring-offset":[ae,Ne]}],"ring-offset-color":[{"ring-offset":[r]}],shadow:[{shadow:["","inner","none",De,Dh]}],"shadow-color":[{shadow:[ju]}],opacity:[{opacity:[V]}],"mix-blend":[{"mix-blend":[...C(),"plus-lighter","plus-darker"]}],"bg-blend":[{"bg-blend":C()}],filter:[{filter:["","none"]}],blur:[{blur:[S]}],brightness:[{brightness:[f]}],contrast:[{contrast:[N]}],"drop-shadow":[{"drop-shadow":["","none",De,F]}],grayscale:[{grayscale:[p]}],"hue-rotate":[{"hue-rotate":[R]}],invert:[{invert:[H]}],saturate:[{saturate:[zt]}],sepia:[{sepia:[nt]}],"backdrop-filter":[{"backdrop-filter":["","none"]}],"backdrop-blur":[{"backdrop-blur":[S]}],"backdrop-brightness":[{"backdrop-brightness":[f]}],"backdrop-contrast":[{"backdrop-contrast":[N]}],"backdrop-grayscale":[{"backdrop-grayscale":[p]}],"backdrop-hue-rotate":[{"backdrop-hue-rotate":[R]}],"backdrop-invert":[{"backdrop-invert":[H]}],"backdrop-opacity":[{"backdrop-opacity":[V]}],"backdrop-saturate":[{"backdrop-saturate":[zt]}],"backdrop-sepia":[{"backdrop-sepia":[nt]}],"border-collapse":[{border:["collapse","separate"]}],"border-spacing":[{"border-spacing":[D]}],"border-spacing-x":[{"border-spacing-x":[D]}],"border-spacing-y":[{"border-spacing-y":[D]}],"table-layout":[{table:["auto","fixed"]}],caption:[{caption:["top","bottom"]}],transition:[{transition:["none","all","","colors","opacity","shadow","transform",F]}],duration:[{duration:o()}],ease:[{ease:["linear","in","out","in-out",F]}],delay:[{delay:o()}],animate:[{animate:["none","spin","ping","pulse","bounce",F]}],transform:[{transform:["","gpu","none"]}],scale:[{scale:[_t]}],"scale-x":[{"scale-x":[_t]}],"scale-y":[{"scale-y":[_t]}],rotate:[{rotate:[Cu,F]}],"translate-x":[{"translate-x":[Nt]}],"translate-y":[{"translate-y":[Nt]}],"skew-x":[{"skew-x":[Ot]}],"skew-y":[{"skew-y":[Ot]}],"transform-origin":[{origin:["center","top","top-right","right","bottom-right","bottom","bottom-left","left","top-left",F]}],accent:[{accent:["auto",r]}],appearance:[{appearance:["none","auto"]}],cursor:[{cursor:["auto","default","pointer","wait","text","move","help","not-allowed","none","context-menu","progress","cell","crosshair","vertical-text","alias","copy","no-drop","grab","grabbing","all-scroll","col-resize","row-resize","n-resize","e-resize","s-resize","w-resize","ne-resize","nw-resize","se-resize","sw-resize","ew-resize","ns-resize","nesw-resize","nwse-resize","zoom-in","zoom-out",F]}],"caret-color":[{caret:[r]}],"pointer-events":[{"pointer-events":["none","auto"]}],resize:[{resize:["none","y","x",""]}],"scroll-behavior":[{scroll:["auto","smooth"]}],"scroll-m":[{"scroll-m":I()}],"scroll-mx":[{"scroll-mx":I()}],"scroll-my":[{"scroll-my":I()}],"scroll-ms":[{"scroll-ms":I()}],"scroll-me":[{"scroll-me":I()}],"scroll-mt":[{"scroll-mt":I()}],"scroll-mr":[{"scroll-mr":I()}],"scroll-mb":[{"scroll-mb":I()}],"scroll-ml":[{"scroll-ml":I()}],"scroll-p":[{"scroll-p":I()}],"scroll-px":[{"scroll-px":I()}],"scroll-py":[{"scroll-py":I()}],"scroll-ps":[{"scroll-ps":I()}],"scroll-pe":[{"scroll-pe":I()}],"scroll-pt":[{"scroll-pt":I()}],"scroll-pr":[{"scroll-pr":I()}],"scroll-pb":[{"scroll-pb":I()}],"scroll-pl":[{"scroll-pl":I()}],"snap-align":[{snap:["start","end","center","align-none"]}],"snap-stop":[{snap:["normal","always"]}],"snap-type":[{snap:["none","x","y","both"]}],"snap-strictness":[{snap:["mandatory","proximity"]}],touch:[{touch:["auto","none","manipulation"]}],"touch-x":[{"touch-pan":["x","left","right"]}],"touch-y":[{"touch-pan":["y","up","down"]}],"touch-pz":["touch-pinch-zoom"],select:[{select:["none","text","all","auto"]}],"will-change":[{"will-change":["auto","scroll","contents","transform",F]}],fill:[{fill:[r,"none"]}],"stroke-w":[{stroke:[ae,Ne,Mf]}],stroke:[{stroke:[r,"none"]}],sr:["sr-only","not-sr-only"],"forced-color-adjust":[{"forced-color-adjust":["auto","none"]}]},conflictingClassGroups:{overflow:["overflow-x","overflow-y"],overscroll:["overscroll-x","overscroll-y"],inset:["inset-x","inset-y","start","end","top","right","bottom","left"],"inset-x":["right","left"],"inset-y":["top","bottom"],flex:["basis","grow","shrink"],gap:["gap-x","gap-y"],p:["px","py","ps","pe","pt","pr","pb","pl"],px:["pr","pl"],py:["pt","pb"],m:["mx","my","ms","me","mt","mr","mb","ml"],mx:["mr","ml"],my:["mt","mb"],size:["w","h"],"font-size":["leading"],"fvn-normal":["fvn-ordinal","fvn-slashed-zero","fvn-figure","fvn-spacing","fvn-fraction"],"fvn-ordinal":["fvn-normal"],"fvn-slashed-zero":["fvn-normal"],"fvn-figure":["fvn-normal"],"fvn-spacing":["fvn-normal"],"fvn-fraction":["fvn-normal"],"line-clamp":["display","overflow"],rounded:["rounded-s","rounded-e","rounded-t","rounded-r","rounded-b","rounded-l","rounded-ss","rounded-se","rounded-ee","rounded-es","rounded-tl","rounded-tr","rounded-br","rounded-bl"],"rounded-s":["rounded-ss","rounded-es"],"rounded-e":["rounded-se","rounded-ee"],"rounded-t":["rounded-tl","rounded-tr"],"rounded-r":["rounded-tr","rounded-br"],"rounded-b":["rounded-br","rounded-bl"],"rounded-l":["rounded-tl","rounded-bl"],"border-spacing":["border-spacing-x","border-spacing-y"],"border-w":["border-w-s","border-w-e","border-w-t","border-w-r","border-w-b","border-w-l"],"border-w-x":["border-w-r","border-w-l"],"border-w-y":["border-w-t","border-w-b"],"border-color":["border-color-s","border-color-e","border-color-t","border-color-r","border-color-b","border-color-l"],"border-color-x":["border-color-r","border-color-l"],"border-color-y":["border-color-t","border-color-b"],"scroll-m":["scroll-mx","scroll-my","scroll-ms","scroll-me","scroll-mt","scroll-mr","scroll-mb","scroll-ml"],"scroll-mx":["scroll-mr","scroll-ml"],"scroll-my":["scroll-mt","scroll-mb"],"scroll-p":["scroll-px","scroll-py","scroll-ps","scroll-pe","scroll-pt","scroll-pr","scroll-pb","scroll-pl"],"scroll-px":["scroll-pr","scroll-pl"],"scroll-py":["scroll-pt","scroll-pb"],touch:["touch-x","touch-y","touch-pz"],"touch-x":["touch"],"touch-y":["touch"],"touch-pz":["touch"]},conflictingClassGroupModifiers:{"font-size":["leading"]}}},Hh=gh(Rh);function wt(...r){return Hh(ah(r))}const Bh=["relative cursor-pointer","text-sm focus:z-10 focus:ring-2 font-medium focus:outline-none whitespace-nowrap shadow-sm","inline-flex gap-2 items-center justify-center transition-colors focus:ring-offset-1","disabled:opacity-40 disabled:cursor-not-allowed disabled:text-nb-gray-300 ring-offset-neutral-950/50"],qh={default:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900","dark:focus:ring-zinc-800/50 dark:bg-nb-gray dark:text-gray-400 dark:border-gray-700/30 dark:hover:text-white dark:hover:bg-zinc-800/50"],primary:["dark:focus:ring-netbird-600/50 dark:ring-offset-neutral-950/50 enabled:dark:bg-netbird disabled:dark:bg-nb-gray-910 dark:text-gray-100 enabled:dark:hover:text-white enabled:dark:hover:bg-netbird-500/80","enabled:bg-netbird enabled:text-white enabled:focus:ring-netbird-400/50 enabled:hover:bg-netbird-500"],secondary:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900","dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20","dark:bg-nb-gray-920 dark:text-gray-400 dark:border-gray-700/40 dark:hover:text-white dark:hover:bg-nb-gray-910"],secondaryLighter:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900","dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20","dark:bg-nb-gray-900/70 dark:text-gray-400 dark:border-gray-700/70 dark:hover:text-white dark:hover:bg-nb-gray-800/60"],input:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-neutral-200 text-gray-900","dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20","dark:bg-nb-gray-900 dark:text-gray-400 dark:border-nb-gray-700 dark:hover:bg-nb-gray-900/80"],dropdown:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-neutral-200 text-gray-900","dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20","dark:bg-nb-gray-900/40 dark:text-gray-400 dark:border-nb-gray-900 dark:hover:bg-nb-gray-900/50"],dotted:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900 border-dashed","dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20","dark:bg-nb-gray-900/30 dark:text-gray-400 dark:border-gray-500/40 dark:hover:text-white dark:hover:bg-zinc-800/50"],tertiary:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900","dark:focus:ring-zinc-800/50 dark:bg-white dark:text-gray-800 dark:border-gray-700/40 dark:hover:bg-neutral-200 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300"],white:["focus:ring-white/50 bg-white text-gray-800 border-white outline-none hover:bg-neutral-200 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300","disabled:dark:bg-nb-gray-900 disabled:dark:text-nb-gray-300 disabled:dark:border-nb-gray-900"],outline:["bg-white hover:text-black focus:ring-zinc-200/50 hover:bg-gray-100 border-gray-200 text-gray-900","dark:focus:ring-zinc-800/50 dark:bg-transparent dark:text-netbird dark:border-netbird dark:hover:bg-nb-gray-900/30"],"danger-outline":["enabled:dark:focus:ring-red-800/20 enabled:dark:focus:bg-red-950/40 enabled:hover:dark:bg-red-950/50 enabled:dark:hover:border-red-800/50 dark:bg-transparent dark:text-red-500"],"danger-text":["dark:bg-transparent dark:text-red-500 dark:hover:text-red-600 dark:border-transparent !px-0 !shadow-none !py-0 focus:ring-red-500/30 dark:ring-offset-neutral-950/50"],"default-outline":["dark:ring-offset-nb-gray-950/50 dark:focus:ring-nb-gray-500/20","dark:bg-transparent dark:text-nb-gray-400 dark:border-transparent dark:hover:text-white dark:hover:bg-nb-gray-900/30 dark:hover:border-nb-gray-800/50","data-[state=open]:dark:text-white data-[state=open]:dark:bg-nb-gray-900/30 data-[state=open]:dark:border-nb-gray-800/50"],danger:["dark:focus:ring-red-700/20 dark:focus:bg-red-700 hover:dark:bg-red-700 dark:hover:border-red-800/50 dark:bg-red-600 dark:text-red-100"]},Yh={xs:"text-xs py-2 px-4",xs2:"text-[0.78rem] py-2 px-4",sm:"text-sm py-2.5 px-4",md:"text-sm py-2.5 px-4",lg:"text-base py-2.5 px-4"},Gh={0:"border",1:"border border-transparent",2:"border border-t-0 border-b-0"},Ru=xt.forwardRef(({variant:r="default",rounded:v=!0,border:S=1,size:f="md",stopPropagation:_=!0,className:O,onClick:D,children:U,...N},p)=>E.jsx("button",{type:"button",...N,ref:p,className:wt(Bh,qh[r],Yh[f],Gh[S?1:0],v&&"rounded-md",O),onClick:R=>{_&&R.stopPropagation(),D?.(R)},children:U}));Ru.displayName="Button";const Xh={default:["bg-nb-gray-900 placeholder:text-neutral-400/70 border-nb-gray-700","ring-offset-neutral-950/50 focus-visible:ring-neutral-500/20"],darker:["bg-nb-gray-920 placeholder:text-neutral-400/70 border-nb-gray-800","ring-offset-neutral-950/50 focus-visible:ring-neutral-500/20"],error:["bg-nb-gray-900 placeholder:text-neutral-400/70 border-red-500 text-red-500","ring-offset-red-500/10 focus-visible:ring-red-500/10"]},Qh={default:"bg-nb-gray-900 border-nb-gray-700 text-nb-gray-300",error:"bg-nb-gray-900 border-red-500 text-nb-gray-300 text-red-500"},c0=xt.forwardRef(({className:r,type:v,customSuffix:S,customPrefix:f,icon:_,maxWidthClass:O="",error:D,variant:U="default",prefixClassName:N,showPasswordToggle:p=!1,...R},H)=>{const[L,ot]=xt.useState(!1),ct=v==="password",G=ct&&L?"text":v,V=(ct&&p?E.jsx("button",{type:"button",onClick:()=>ot(!L),className:"hover:text-white transition-all","aria-label":"Toggle password visibility",children:L?E.jsx(km,{size:18}):E.jsx(Wm,{size:18})}):null)||S,gt=D?"error":U;return E.jsxs(E.Fragment,{children:[E.jsxs("div",{className:wt("flex relative h-[42px]",O),children:[f&&E.jsx("div",{className:wt(Qh[D?"error":"default"],"flex h-[42px] w-auto rounded-l-md px-3 py-2 text-sm","border items-center whitespace-nowrap",R.disabled&&"opacity-40",N),children:f}),E.jsx("div",{className:wt("absolute left-0 top-0 h-full flex items-center text-xs text-nb-gray-300 pl-3 leading-[0]",R.disabled&&"opacity-40"),children:_}),E.jsx("input",{type:G,ref:H,...R,className:wt(Xh[gt],"flex h-[42px] w-full rounded-md px-3 py-2 text-sm","file:bg-transparent file:text-sm file:font-medium file:border-0","focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2","disabled:cursor-not-allowed disabled:opacity-40","border",f&&"!border-l-0 !rounded-l-none",V&&"!pr-16",_&&"!pl-10",r)}),E.jsx("div",{className:wt("absolute right-0 top-0 h-full flex items-center text-xs text-nb-gray-300 pr-4 leading-[0] select-none",R.disabled&&"opacity-30"),children:V})]}),D&&E.jsx("p",{className:"text-xs text-red-500 mt-2",children:D})]})});c0.displayName="Input";const Zh=xt.forwardRef(function({value:v,onChange:S,length:f=6,disabled:_=!1,className:O,autoFocus:D=!1},U){const N=xt.useRef([]);xt.useImperativeHandle(U,()=>({focus:()=>{N.current[0]?.focus()}}));const p=v.split("").concat(new Array(f).fill("")).slice(0,f),R=Array.from({length:f},(G,Q)=>`pin-${Q}`),H=(G,Q)=>{if(!/^\d*$/.test(Q))return;const V=[...p];V[G]=Q.slice(-1);const gt=V.join("").replaceAll(/\s/g,"");S(gt),Q&&G<f-1&&N.current[G+1]?.focus()},L=(G,Q)=>{Q.key==="Backspace"&&!p[G]&&G>0&&N.current[G-1]?.focus(),Q.key==="ArrowLeft"&&G>0&&N.current[G-1]?.focus(),Q.key==="ArrowRight"&&G<f-1&&N.current[G+1]?.focus()},ot=G=>{G.preventDefault();const Q=G.clipboardData.getData("text").replaceAll(/\D/g,"").slice(0,f);S(Q);const V=Math.min(Q.length,f-1);N.current[V]?.focus()},ct=G=>{G.target.select()};return E.jsx("div",{className:wt("flex gap-2 w-full min-w-0",O),children:p.map((G,Q)=>E.jsx("input",{id:R[Q],ref:V=>{N.current[Q]=V},type:"text",inputMode:"numeric",maxLength:1,value:G,onChange:V=>H(Q,V.target.value),onKeyDown:V=>L(Q,V),onPaste:ot,onFocus:ct,disabled:_,autoFocus:D&&Q===0,className:wt("flex-1 min-w-0 h-[42px] text-center text-sm rounded-md","dark:bg-nb-gray-900 border dark:border-nb-gray-700","dark:placeholder:text-neutral-400/70","focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2","ring-offset-neutral-200/20 dark:ring-offset-neutral-950/50 dark:focus-visible:ring-neutral-500/20","disabled:cursor-not-allowed disabled:opacity-40")},R[Q]))})}),f0=xt.createContext({value:"",onChange:()=>{}}),r0=()=>xt.useContext(f0);function $e({value:r,defaultValue:v,onChange:S,children:f}){const[_,O]=xt.useState(v??""),D=r??_,U=xt.useCallback(p=>{r===void 0&&O(p),S?.(p)},[r,S]),N=xt.useMemo(()=>({value:D,onChange:U}),[D,U]);return E.jsx(f0.Provider,{value:N,children:E.jsx("div",{children:typeof f=="function"?f({value:D,onChange:U}):f})})}function wh({children:r,className:v}){return E.jsx("div",{role:"tablist",className:wt("bg-nb-gray-930/70 p-1.5 flex justify-center gap-1 border-nb-gray-900",v),children:r})}function Lh({children:r,value:v,disabled:S=!1,className:f,selected:_,onClick:O}){const D=r0(),U=_??v===D.value;let N="";U?N="bg-nb-gray-900 text-white":S||(N="text-nb-gray-400 hover:bg-nb-gray-900/50");const p=()=>{D.onChange(v),O?.()};return E.jsx("button",{role:"tab",type:"button",disabled:S,"aria-selected":U,onClick:p,className:wt("px-4 py-2 text-sm rounded-md w-full transition-all cursor-pointer",S&&"opacity-30 cursor-not-allowed",N,f),children:E.jsx("div",{className:"flex items-center w-full justify-center gap-2",children:r})})}function Vh({children:r,value:v,className:S,visible:f}){const _=r0();return f??v===_.value?E.jsx("div",{role:"tabpanel",className:wt("bg-nb-gray-930/70 px-4 pt-4 pb-5 rounded-b-md border border-t-0 border-nb-gray-900",S),children:r}):null}$e.List=wh;$e.Trigger=Lh;$e.Content=Vh;const Kh="/__netbird__/assets/netbird-full.svg",Jh="data:image/svg+xml,%3csvg%20width='31'%20height='23'%20viewBox='0%200%2031%2023'%20fill='none'%20xmlns='http://www.w3.org/2000/svg'%3e%3cpath%20d='M21.4631%200.523438C17.8173%200.857913%2016.0028%202.95675%2015.3171%204.01871L4.66406%2022.4734H17.5163L30.1929%200.523438H21.4631Z'%20fill='%23F68330'/%3e%3cpath%20d='M17.5265%2022.4737L0%203.88525C0%203.88525%2019.8177%20-1.44128%2021.7493%2015.1738L17.5265%2022.4737Z'%20fill='%23F68330'/%3e%3cpath%20d='M14.9236%204.70563L9.54688%2014.0208L17.5158%2022.4747L21.7385%2015.158C21.0696%209.44682%2018.2851%206.32784%2014.9236%204.69727'%20fill='%23F05252'/%3e%3c/svg%3e",ti={small:{desktop:14,mobile:20},default:{desktop:22,mobile:30},large:{desktop:24,mobile:40}},kh=({size:r="default",mobile:v=!0})=>E.jsxs(E.Fragment,{children:[E.jsx("img",{src:Kh,height:ti[r].desktop,style:{height:ti[r].desktop},alt:"NetBird Logo",className:wt(v&&"hidden md:block","group-hover:opacity-80 transition-all")}),v&&E.jsx("img",{src:Jh,width:ti[r].mobile,style:{width:ti[r].mobile},alt:"NetBird Logo",className:wt(v&&"md:hidden ml-4")})]});function Uf(){return E.jsxs("a",{href:"https://netbird.io?utm_source=netbird-proxy&utm_medium=web&utm_campaign=powered_by",target:"_blank",rel:"noopener noreferrer",className:"flex items-center justify-center mt-8 gap-2 group cursor-pointer",children:[E.jsx("span",{className:"text-sm text-nb-gray-400 font-light text-center group-hover:opacity-80 transition-all",children:"Powered by"}),E.jsx(kh,{size:"small",mobile:!1})]})}const Wh=({className:r})=>E.jsx("div",{className:wt("h-full w-full absolute left-0 top-0 rounded-md overflow-hidden z-0 pointer-events-none",r),children:E.jsx("div",{className:"bg-linear-to-b from-nb-gray-900/10 via-transparent to-transparent w-full h-full rounded-md"})}),Fd=({children:r,className:v})=>E.jsxs("div",{className:wt("px-6 sm:px-10 py-10 pt-8","bg-nb-gray-940 border border-nb-gray-910 rounded-lg relative",v),children:[E.jsx(Wh,{}),r]});function Cf({children:r,className:v}){return E.jsx("h1",{className:wt("text-xl! text-center z-10 relative",v),children:r})}function jf({children:r,className:v}){return E.jsx("div",{className:wt("text-sm text-nb-gray-300 font-light mt-2 block text-center z-10 relative",v),children:r})}const $h=()=>E.jsxs("div",{className:"flex items-center justify-center relative my-4",children:[E.jsx("span",{className:"bg-nb-gray-940 relative z-10 px-4 text-xs text-nb-gray-400 font-medium",children:"OR"}),E.jsx("span",{className:"h-px bg-nb-gray-900 w-full absolute z-0"})]}),Fh=({error:r})=>E.jsx("div",{className:"text-red-400 bg-red-800/20 border border-red-800/50 rounded-lg px-4 py-3 whitespace-break-spaces text-sm",children:r});function Id({className:r,htmlFor:v,...S}){return E.jsx("label",{htmlFor:v,className:wt("text-sm font-medium tracking-wider leading-none","peer-disabled:cursor-not-allowed peer-disabled:opacity-70","mb-2.5 inline-block text-nb-gray-200","flex items-center gap-2 select-none",r),...S})}const _f=t0(),It=_f.methods&&Object.keys(_f.methods).length>0?_f.methods:{password:"password",pin:"pin",oidc:"/auth/oidc"};function Ih(){xt.useEffect(()=>{document.title="Authentication Required - NetBird Service"},[]);const[r,v]=xt.useState(null),[S,f]=xt.useState(null),[_,O]=xt.useState(""),[D,U]=xt.useState(""),N=xt.useRef(null),p=xt.useRef(null),[R,H]=xt.useState(It.password?"password":"pin"),L=(nt,Ot)=>{v(Ot),f(null),nt==="password"?(U(""),setTimeout(()=>N.current?.focus(),200)):(O(""),setTimeout(()=>p.current?.focus(),200))},ot=(nt,Ot)=>{v(null),f(nt);const J=new FormData;nt==="password"?J.append(It.password,Ot):J.append(It.pin,Ot),fetch(globalThis.location.href,{method:"POST",body:J,redirect:"manual"}).then(Nt=>{if(Nt.type==="opaqueredirect"||Nt.status===0)f("redirect"),globalThis.location.reload();else if(Nt.status===429){const Xt=Number(Nt.headers.get("Retry-After")),pl=Number.isFinite(Xt)&&Xt>0?` Try again in ${Math.ceil(Xt)} seconds.`:" Please try again later.";L(nt,`Too many authentication attempts.${pl}`)}else L(nt,"Authentication failed. Please try again.")}).catch(()=>{L(nt,"An error occurred. Please try again.")})},ct=nt=>{O(nt),nt.length===6&&ot("pin",nt)},G=_.length===6,Q=D.length>0,V=S!==null||R==="password"&&!Q||R==="pin"&&!G,gt=It.password||It.pin,zt=It.password&&It.pin,_t=R==="password"?"Sign in":"Submit";return S==="redirect"?E.jsxs("main",{className:"mt-20",children:[E.jsxs(Fd,{className:"max-w-105 mx-auto",children:[E.jsx(Cf,{children:"Authenticated"}),E.jsx(jf,{children:"Loading service..."}),E.jsx("div",{className:"flex justify-center mt-7",children:E.jsx(kd,{className:"animate-spin",size:24})})]}),E.jsx(Uf,{})]}):E.jsxs("main",{className:"mt-20",children:[E.jsxs(Fd,{className:"max-w-105 mx-auto",children:[E.jsx(Cf,{children:"Authentication Required"}),E.jsx(jf,{children:"The service you are trying to access is protected. Please authenticate to continue."}),E.jsxs("div",{className:"flex flex-col gap-4 mt-7 z-10 relative",children:[r&&E.jsx(Fh,{error:r}),It.oidc&&E.jsxs(Ru,{variant:"primary",className:"w-full",onClick:()=>{globalThis.location.href=It.oidc},children:[E.jsx(Im,{size:16}),"Sign in with SSO"]}),It.oidc&&gt&&E.jsx($h,{}),gt&&E.jsxs("form",{onSubmit:nt=>{nt.preventDefault(),ot(R,R==="password"?D:_)},children:[zt&&E.jsx($e,{value:R,onChange:nt=>{H(nt),setTimeout(()=>{nt==="password"?N.current?.focus():p.current?.focus()},0)},children:E.jsxs($e.List,{className:"rounded-lg border mb-4",children:[E.jsxs($e.Trigger,{value:"password",children:[E.jsx(Fm,{size:14}),"Password"]}),E.jsxs($e.Trigger,{value:"pin",children:[E.jsx(Km,{size:14}),"PIN"]})]})}),E.jsxs("div",{className:"mb-4",children:[It.password&&(R==="password"||!It.pin)&&E.jsxs(E.Fragment,{children:[!zt&&E.jsx(Id,{htmlFor:"password",children:"Password"}),E.jsx(c0,{ref:N,type:"password",id:"password",placeholder:"Enter password",disabled:S!==null,showPasswordToggle:!0,autoFocus:!0,value:D,onChange:nt=>U(nt.target.value)})]}),It.pin&&(R==="pin"||!It.password)&&E.jsxs(E.Fragment,{children:[!zt&&E.jsx(Id,{htmlFor:"pin-0",children:"Enter PIN Code"}),E.jsx(Zh,{ref:p,value:_,onChange:ct,disabled:S!==null,autoFocus:!It.password})]})]}),E.jsx(Ru,{type:"submit",disabled:V,variant:"secondary",className:"w-full",children:S===null?_t:E.jsxs(E.Fragment,{children:[E.jsx(kd,{className:"animate-spin",size:16}),"Verifying..."]})})]})]})]}),E.jsx(Uf,{})]})}function Ph({success:r=!0}){return r?E.jsx("div",{className:"flex-1 flex items-center justify-center h-12 w-full px-5",children:E.jsx("div",{className:"w-full border-t-2 border-dashed border-green-500"})}):E.jsxs("div",{className:"flex-1 flex items-center justify-center h-12 min-w-10 px-5 relative",children:[E.jsx("div",{className:"w-full border-t-2 border-dashed border-nb-gray-900"}),E.jsx("div",{className:"absolute inset-0 flex items-center justify-center",children:E.jsx("div",{className:"w-8 h-8 rounded-full flex items-center justify-center",children:E.jsx(eh,{size:18,className:"text-netbird"})})})]})}function Of({icon:r,label:v,detail:S,success:f=!0,line:_=!0}){return E.jsxs(E.Fragment,{children:[_&&E.jsx(Ph,{success:f}),E.jsxs("div",{className:"flex flex-col items-center gap-2",children:[E.jsx("div",{className:"w-14 h-14 rounded-md flex items-center justify-center from-nb-gray-940 to-nb-gray-930/70 bg-gradient-to-br border border-nb-gray-910",children:E.jsx(r,{size:20,className:"text-nb-gray-200"})}),E.jsx("span",{className:"text-sm text-nb-gray-200 font-normal mt-1",children:v}),E.jsx("span",{className:`text-xs font-medium uppercase ${f?"text-green-500":"text-netbird"}`,children:f?"Connected":"Unreachable"}),S&&E.jsx("span",{className:"text-xs text-nb-gray-400 truncate text-center",children:S})]})]})}function tg({code:r,title:v,message:S,proxy:f=!0,destination:_=!0,requestId:O,simple:D=!1,retryUrl:U}){xt.useEffect(()=>{document.title=`${v} - NetBird Service`},[v]);const[N]=xt.useState(()=>new Date().toISOString());return E.jsxs("main",{className:"flex flex-col items-center mt-24 px-4 max-w-3xl mx-auto",children:[E.jsxs("div",{className:"text-sm text-netbird font-normal font-mono mb-3 z-10 relative",children:["Error ",r]}),E.jsx(Cf,{className:"text-3xl!",children:v}),E.jsx(jf,{className:"mt-2 mb-8 max-w-md",children:S}),!D&&E.jsxs("div",{className:"hidden sm:flex items-start justify-center w-full mt-6 mb-16 z-10 relative",children:[E.jsx(Of,{icon:th,label:"You",line:!1}),E.jsx(Of,{icon:lh,label:"Proxy",success:f}),E.jsx(Of,{icon:$m,label:"Destination",success:_})]}),E.jsxs("div",{className:"flex gap-3 justify-center items-center mb-6 z-10 relative",children:[E.jsxs(Ru,{variant:"primary",onClick:()=>{U?globalThis.location.href=U:globalThis.location.reload()},children:[E.jsx(Pm,{size:16}),"Refresh Page"]}),E.jsxs(Ru,{variant:"secondary",onClick:()=>globalThis.open("https://docs.netbird.io","_blank","noopener,noreferrer"),children:[E.jsx(Jm,{size:16}),"Documentation"]})]}),E.jsxs("div",{className:"text-center text-xs text-nb-gray-300 uppercase z-10 relative font-mono flex flex-col sm:flex-row gap-2 sm:gap-10 mt-4 mb-3",children:[E.jsxs("div",{children:[E.jsx("span",{className:"text-nb-gray-400",children:"REQUEST-ID:"})," ",O]}),E.jsxs("div",{children:[E.jsx("span",{className:"text-nb-gray-400",children:"TIMESTAMP:"})," ",N]})]}),E.jsx(Uf,{})]})}const Nf=t0();Zm.createRoot(document.getElementById("root")).render(E.jsx(xt.StrictMode,{children:Nf.page==="error"&&Nf.error?E.jsx(tg,{...Nf.error}):E.jsx(Ih,{})}));
diff --git a/proxy/web/scripts/third-party-licenses.mjs b/proxy/web/scripts/third-party-licenses.mjs
new file mode 100644
index 000000000..2ebff5f59
--- /dev/null
+++ b/proxy/web/scripts/third-party-licenses.mjs
@@ -0,0 +1,68 @@
+// Prints the third-party terms for the prebuilt UI in dist/ to stdout.
+// Package versions come from package-lock.json and the license texts from an
+// installed node_modules (run `npm ci --ignore-scripts` first).
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const webDir = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+// Build tools whose own code is emitted into dist: tailwindcss generates the
+// preflight and utility CSS, vite injects its modulepreload polyfill.
+const bundledTooling = new Set(["node_modules/tailwindcss", "node_modules/vite"]);
+
+// Inter ships as a font file rather than a package, so its OFL lives beside it.
+const staticTerms = [
+  {
+    title: "Inter 4.001 (git-66647c0bb), SIL Open Font License 1.1",
+    file: "src/assets/fonts/OFL.txt",
+  },
+];
+
+const termPattern = /^(licen[cs]e|copying|notice|patents)/i;
+
+function fail(message) {
+  process.stderr.write(`${message}\n`);
+  process.exit(1);
+}
+
+function shippedPackages(lock) {
+  return Object.entries(lock.packages)
+    .filter(([path, meta]) => path !== "" && (!meta.dev || bundledTooling.has(path)))
+    .sort(([a], [b]) => Number(a > b) - Number(a < b));
+}
+
+function packageSection(path, meta) {
+  const dir = join(webDir, path);
+  const manifest = join(dir, "package.json");
+  if (!existsSync(manifest)) {
+    fail(`${path} is not installed; run npm ci --ignore-scripts in proxy/web`);
+  }
+  const installed = JSON.parse(readFileSync(manifest, "utf8"));
+  if (installed.version !== meta.version) {
+    fail(`${path} is ${installed.version}, package-lock.json pins ${meta.version}`);
+  }
+
+  const terms = readdirSync(dir).filter((name) => termPattern.test(name)).sort();
+  if (terms.length === 0) {
+    fail(`no license terms found for ${path}`);
+  }
+
+  const name = path.slice(path.lastIndexOf("node_modules/") + "node_modules/".length);
+  return terms
+    .map((term) => `=== ${name} ${meta.version} (${term}) ===\n\n${readFileSync(join(dir, term), "utf8")}`)
+    .join("\n\n");
+}
+
+const lock = JSON.parse(readFileSync(join(webDir, "package-lock.json"), "utf8"));
+const sections = shippedPackages(lock).map(([path, meta]) => packageSection(path, meta));
+for (const { title, file } of staticTerms) {
+  sections.push(`=== ${title} ===\n\n${readFileSync(join(webDir, file), "utf8")}`);
+}
+
+process.stdout.write(
+  "Third-party terms for the prebuilt authentication UI in proxy/web/dist.\n" +
+    "Generated from proxy/web/package-lock.json at release time.\n\n\n" +
+    sections.join("\n\n\n") +
+    "\n",
+);
diff --git a/proxy/web/src/App.tsx b/proxy/web/src/App.tsx
index ab453aa3e..3f09aacfb 100644
--- a/proxy/web/src/App.tsx
+++ b/proxy/web/src/App.tsx
@@ -68,6 +68,12 @@ function App() {
         if (res.type === "opaqueredirect" || res.status === 0) {
           setSubmitting("redirect");
           globalThis.location.reload();
+        } else if (res.status === 429) {
+          const seconds = Number(res.headers.get("Retry-After"));
+          const wait = Number.isFinite(seconds) && seconds > 0
+            ? ` Try again in ${Math.ceil(seconds)} seconds.`
+            : " Please try again later.";
+          handleAuthError(method, `Too many authentication attempts.${wait}`);
         } else {
           handleAuthError(method, "Authentication failed. Please try again.");
         }
diff --git a/proxy/web/src/assets/fonts/OFL.txt b/proxy/web/src/assets/fonts/OFL.txt
new file mode 100644
index 000000000..9b2ca37b3
--- /dev/null
+++ b/proxy/web/src/assets/fonts/OFL.txt
@@ -0,0 +1,92 @@
+Copyright (c) 2016 The Inter Project Authors (https://github.com/rsms/inter)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION AND CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/proxy/web/web.go b/proxy/web/web.go
index 6773a9c1a..de3e4771a 100644
--- a/proxy/web/web.go
+++ b/proxy/web/web.go
@@ -10,6 +10,8 @@ import (
 	"net/url"
 	"path/filepath"
 	"strings"
+
+	"github.com/netbirdio/netbird/proxy/auth"
 )
 
 // PathPrefix is the unique URL prefix for serving the proxy's own web assets.
@@ -180,7 +182,8 @@ func ServeAccessDeniedPage(w http.ResponseWriter, r *http.Request, code int, tit
 // stripAuthParams returns the request URI with auth-related query parameters removed.
 func stripAuthParams(u *url.URL) string {
 	q := u.Query()
-	q.Del("session_token")
+	q.Del(auth.SessionTokenQueryParam)
+	q.Del(auth.SessionCodeQueryParam)
 	q.Del("error")
 	q.Del("error_description")
 	clean := *u
diff --git a/relay/Dockerfile.ubi b/relay/Dockerfile.ubi
new file mode 100644
index 000000000..86b0cbc01
--- /dev/null
+++ b/relay/Dockerfile.ubi
@@ -0,0 +1,33 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-relay" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Relay" \
+      description="NetBird Relay carries traffic between peers when a direct connection is unavailable."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-relay /go/bin/netbird-relay
+COPY licenses/ /licenses/
+# Only the data directory shares the root group for arbitrary non-root UIDs.
+# Runtime-created Let's Encrypt keys retain the application's restrictive modes.
+RUN mkdir -p /var/lib/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+USER 1000:0
+ENV HOME=/var/lib/netbird
+ENV NB_LOG_FILE=console
+# Unprivileged port: runtimes such as OpenShift and Podman keep the kernel
+# default that reserves ports below 1024 for root. 8443/udp carries QUIC and
+# 9000 is the health probe.
+ENV NB_LISTEN_ADDRESS=":8443"
+EXPOSE 8443 8443/udp
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/go/bin/netbird-relay"]
diff --git a/relay/cmd/root.go b/relay/cmd/root.go
index b1949ca11..a64812d4d 100644
--- a/relay/cmd/root.go
+++ b/relay/cmd/root.go
@@ -24,6 +24,7 @@ import (
 	"github.com/netbirdio/netbird/shared/metrics"
 	"github.com/netbirdio/netbird/shared/relay/auth"
 	"github.com/netbirdio/netbird/stun"
+	"github.com/netbirdio/netbird/trustedproxy"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -45,6 +46,9 @@ type Config struct {
 	LogLevel                 string
 	LogFile                  string
 	HealthcheckListenAddress string
+	// TrustedProxies is a comma-separated list of upstream proxy CIDRs/IPs whose
+	// X-Real-Ip/X-Real-Port headers are trusted. Empty means never trust these headers.
+	TrustedProxies string
 	// STUN server configuration
 	EnableSTUN   bool
 	STUNPorts    []int
@@ -116,6 +120,7 @@ func init() {
 	rootCmd.PersistentFlags().StringVar(&cobraConfig.LogLevel, "log-level", "info", "log level")
 	rootCmd.PersistentFlags().StringVar(&cobraConfig.LogFile, "log-file", "console", "log file")
 	rootCmd.PersistentFlags().StringVarP(&cobraConfig.HealthcheckListenAddress, "health-listen-address", "H", ":9000", "listen address of healthcheck server")
+	rootCmd.PersistentFlags().StringVar(&cobraConfig.TrustedProxies, "trusted-proxies", "", "comma-separated list of upstream proxy CIDRs or IPs whose X-Real-Ip/X-Real-Port headers are trusted; leave empty to always use the direct connection address")
 	rootCmd.PersistentFlags().BoolVar(&cobraConfig.EnableSTUN, "enable-stun", false, "enable embedded STUN server")
 	rootCmd.PersistentFlags().IntSliceVar(&cobraConfig.STUNPorts, "stun-ports", []int{3478}, "ports for the embedded STUN server (can be specified multiple times or comma-separated)")
 	rootCmd.PersistentFlags().StringVar(&cobraConfig.STUNLogLevel, "stun-log-level", "info", "log level for STUN server (panic, fatal, error, warn, info, debug, trace)")
@@ -155,8 +160,15 @@ func execute(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("setup metrics: %v", err)
 	}
 
+	trustedProxies, err := trustedproxy.Parse(cobraConfig.TrustedProxies)
+	if err != nil {
+		log.Debugf("failed to parse trusted proxies: %s", err)
+		return fmt.Errorf("failed to parse trusted proxies: %s", err)
+	}
+
 	srvListenerCfg := server.ListenerConfig{
-		Address: cobraConfig.ListenAddress,
+		Address:        cobraConfig.ListenAddress,
+		TrustedProxies: trustedProxies,
 	}
 
 	tlsConfig, tlsSupport, err := handleTLSConfig(cobraConfig)
@@ -173,7 +185,7 @@ func execute(cmd *cobra.Command, args []string) error {
 	}
 
 	hashedSecret := sha256.Sum256([]byte(cobraConfig.AuthSecret))
-	authenticator := auth.NewTimedHMACValidator(hashedSecret[:], 24*time.Hour)
+	authenticator := auth.NewTimedHMACValidator(hashedSecret[:])
 
 	cfg := server.Config{
 		Meter:          metricsServer.Meter,
diff --git a/relay/server/handshake.go b/relay/server/handshake.go
index 067888406..f064b3501 100644
--- a/relay/server/handshake.go
+++ b/relay/server/handshake.go
@@ -5,14 +5,8 @@ import (
 	"fmt"
 	"time"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/relay/server/listener"
 	"github.com/netbirdio/netbird/shared/relay/messages"
-	//nolint:staticcheck
-	"github.com/netbirdio/netbird/shared/relay/messages/address"
-	//nolint:staticcheck
-	authmsg "github.com/netbirdio/netbird/shared/relay/messages/auth"
 )
 
 const (
@@ -23,55 +17,30 @@ const (
 
 type Validator interface {
 	Validate(any) error
-	// Deprecated: Use Validate instead.
-	ValidateHelloMsgType(any) error
 }
 
-// preparedMsg contains the marshalled success response messages
+// preparedMsg contains the marshalled success response message
 type preparedMsg struct {
-	responseHelloMsg []byte
-	responseAuthMsg  []byte
+	responseAuthMsg []byte
 }
 
 func newPreparedMsg(instanceURL string) (*preparedMsg, error) {
-	rhm, err := marshalResponseHelloMsg(instanceURL)
-	if err != nil {
-		return nil, err
-	}
-
 	ram, err := messages.MarshalAuthResponse(instanceURL)
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal auth response msg: %w", err)
 	}
 
 	return &preparedMsg{
-		responseHelloMsg: rhm,
-		responseAuthMsg:  ram,
+		responseAuthMsg: ram,
 	}, nil
 }
 
-func marshalResponseHelloMsg(instanceURL string) ([]byte, error) {
-	addr := &address.Address{URL: instanceURL}
-	addrData, err := addr.Marshal()
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal response address: %w", err)
-	}
-
-	//nolint:staticcheck
-	responseMsg, err := messages.MarshalHelloResponse(addrData)
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal hello response: %w", err)
-	}
-	return responseMsg, nil
-}
-
 type handshake struct {
 	conn        listener.Conn
 	validator   Validator
 	preparedMsg *preparedMsg
 
-	handshakeMethodAuth bool
-	peerID              *messages.PeerID
+	peerID *messages.PeerID
 }
 
 func (h *handshake) handshakeReceive(ctx context.Context) (*messages.PeerID, error) {
@@ -93,17 +62,11 @@ func (h *handshake) handshakeReceive(ctx context.Context) (*messages.PeerID, err
 		return nil, fmt.Errorf("determine message type from %s: %w", h.conn.RemoteAddr(), err)
 	}
 
-	var peerID *messages.PeerID
-	switch msgType {
-	//nolint:staticcheck
-	case messages.MsgTypeHello:
-		peerID, err = h.handleHelloMsg(buf)
-	case messages.MsgTypeAuth:
-		h.handshakeMethodAuth = true
-		peerID, err = h.handleAuthMsg(buf)
-	default:
+	if msgType != messages.MsgTypeAuth {
 		return nil, fmt.Errorf("invalid message type %d from %s", msgType, h.conn.RemoteAddr())
 	}
+
+	peerID, err := h.handleAuthMsg(buf)
 	if err != nil {
 		return peerID, err
 	}
@@ -112,46 +75,17 @@ func (h *handshake) handshakeReceive(ctx context.Context) (*messages.PeerID, err
 }
 
 func (h *handshake) handshakeResponse(ctx context.Context) error {
-	var responseMsg []byte
-	if h.handshakeMethodAuth {
-		responseMsg = h.preparedMsg.responseAuthMsg
-	} else {
-		responseMsg = h.preparedMsg.responseHelloMsg
-	}
-
-	if _, err := h.conn.Write(ctx, responseMsg); err != nil {
+	if _, err := h.conn.Write(ctx, h.preparedMsg.responseAuthMsg); err != nil {
 		return fmt.Errorf("handshake response write to %s (%s): %w", h.peerID, h.conn.RemoteAddr(), err)
 	}
 
 	return nil
 }
 
-func (h *handshake) handleHelloMsg(buf []byte) (*messages.PeerID, error) {
-	//nolint:staticcheck
-	peerID, authData, err := messages.UnmarshalHelloMsg(buf)
-	if err != nil {
-		return nil, fmt.Errorf("unmarshal hello message: %w", err)
-	}
-
-	log.Warnf("peer %s (%s) is using deprecated initial message type", peerID, h.conn.RemoteAddr())
-
-	authMsg, err := authmsg.UnmarshalMsg(authData)
-	if err != nil {
-		return nil, fmt.Errorf("unmarshal auth message: %w", err)
-	}
-
-	//nolint:staticcheck
-	if err := h.validator.ValidateHelloMsgType(authMsg.AdditionalData); err != nil {
-		return nil, fmt.Errorf("validate %s (%s): %w", peerID, h.conn.RemoteAddr(), err)
-	}
-
-	return peerID, nil
-}
-
 func (h *handshake) handleAuthMsg(buf []byte) (*messages.PeerID, error) {
 	rawPeerID, authPayload, err := messages.UnmarshalAuthMsg(buf)
 	if err != nil {
-		return nil, fmt.Errorf("unmarshal hello message: %w", err)
+		return nil, fmt.Errorf("unmarshal auth message: %w", err)
 	}
 
 	if err := h.validator.Validate(authPayload); err != nil {
diff --git a/relay/server/listener/quic/listener.go b/relay/server/listener/quic/listener.go
index 68f0e03c0..115a2d0c2 100644
--- a/relay/server/listener/quic/listener.go
+++ b/relay/server/listener/quic/listener.go
@@ -25,21 +25,28 @@ type Listener struct {
 	listener *quic.Listener
 }
 
-func (l *Listener) Listen(acceptFn func(conn relaylistener.Conn)) error {
+func (l *Listener) Bind() error {
 	quicCfg := &quic.Config{
 		EnableDatagrams:   true,
 		InitialPacketSize: nbRelay.QUICInitialPacketSize,
 	}
 	listener, err := quic.ListenAddr(l.Address, l.TLSConfig, quicCfg)
 	if err != nil {
-		return fmt.Errorf("failed to create QUIC listener: %v", err)
+		return err
 	}
 
 	l.listener = listener
 	log.Infof("QUIC server listening on address: %s", l.Address)
+	return nil
+}
+
+func (l *Listener) Serve(acceptFn func(conn relaylistener.Conn)) error {
+	if l.listener == nil {
+		return errors.New("listener is not bound")
+	}
 
 	for {
-		session, err := listener.Accept(context.Background())
+		session, err := l.listener.Accept(context.Background())
 		if err != nil {
 			if errors.Is(err, quic.ErrServerClosed) {
 				return nil
@@ -51,7 +58,10 @@ func (l *Listener) Listen(acceptFn func(conn relaylistener.Conn)) error {
 
 		log.Infof("QUIC client connected from: %s", session.RemoteAddr())
 		conn := NewConn(session)
-		acceptFn(conn)
+		// Run the accept handler (which performs the pre-auth handshake) in its
+		// own goroutine so a slow or stalled handshake cannot block accepting
+		// further connections.
+		go acceptFn(conn)
 	}
 }
 
diff --git a/relay/server/listener/quic/listener_test.go b/relay/server/listener/quic/listener_test.go
new file mode 100644
index 000000000..6a2e9ce75
--- /dev/null
+++ b/relay/server/listener/quic/listener_test.go
@@ -0,0 +1,130 @@
+package quic
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"math/big"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	relaylistener "github.com/netbirdio/netbird/relay/server/listener"
+	quictls "github.com/netbirdio/netbird/shared/relay/tls"
+)
+
+func TestListener_ShutdownBeforeServe(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0", TLSConfig: testTLSConfig(t)}
+	require.NoError(t, l.Bind())
+	addr := l.listener.Addr().String()
+	require.NoError(t, l.Shutdown(context.Background()))
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- l.Serve(func(relaylistener.Conn) {})
+	}()
+
+	assert.NoError(t, waitForServeToReturn(t, errChan))
+	requireUDPAddressFree(t, addr)
+}
+
+func TestListener_ShutdownStopsServe(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0", TLSConfig: testTLSConfig(t)}
+	require.NoError(t, l.Bind())
+	addr := l.listener.Addr().String()
+
+	accepted := make(chan relaylistener.Conn, 1)
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- l.Serve(func(conn relaylistener.Conn) { accepted <- conn })
+	}()
+
+	// quic-go completes handshakes on a bound socket before Accept is called, so
+	// only a session handed to acceptFn proves Serve is blocked in Accept when
+	// Shutdown arrives.
+	dialTestSession(t, addr)
+	var conn relaylistener.Conn
+	select {
+	case conn = <-accepted:
+	case <-time.After(5 * time.Second):
+		t.Fatal("listener did not accept the test session")
+	}
+
+	require.NoError(t, l.Shutdown(context.Background()))
+	assert.NoError(t, waitForServeToReturn(t, errChan))
+
+	// Shutdown leaves accepted sessions alive, as the relay closes its peers itself,
+	// and quic-go keeps the UDP socket bound until the last session is gone.
+	require.NoError(t, conn.Close())
+	requireUDPAddressFree(t, addr)
+}
+
+func TestListener_Unbound(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0", TLSConfig: testTLSConfig(t)}
+	assert.Error(t, l.Serve(func(relaylistener.Conn) {}), "Serve must refuse an unbound listener")
+	assert.NoError(t, l.Shutdown(context.Background()), "Shutdown of an unbound listener is a no-op")
+}
+
+func testTLSConfig(t *testing.T) *tls.Config {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	require.NoError(t, err)
+
+	return &tls.Config{
+		Certificates: []tls.Certificate{{Certificate: [][]byte{certDER}, PrivateKey: key}},
+		NextProtos:   []string{quictls.NBalpn},
+	}
+}
+
+func dialTestSession(t *testing.T, addr string) {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	tlsCfg := &tls.Config{InsecureSkipVerify: true, NextProtos: []string{quictls.NBalpn}}
+	session, err := quic.DialAddr(ctx, addr, tlsCfg, &quic.Config{EnableDatagrams: true})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = session.CloseWithError(0, "") })
+}
+
+func waitForServeToReturn(t *testing.T, errChan <-chan error) error {
+	t.Helper()
+	select {
+	case err := <-errChan:
+		return err
+	case <-time.After(5 * time.Second):
+		t.Fatal("Serve did not return")
+		return nil
+	}
+}
+
+// quic-go retires a closed session's connection IDs on a timer and closes the UDP
+// socket from its read loop once the last one is gone, so the address is polled
+// rather than checked once.
+func requireUDPAddressFree(t *testing.T, addr string) {
+	t.Helper()
+	require.Eventually(t, func() bool {
+		conn, err := net.ListenPacket("udp", addr)
+		if err != nil {
+			return false
+		}
+		_ = conn.Close()
+		return true
+	}, 5*time.Second, 10*time.Millisecond, "udp address %s must be released", addr)
+}
diff --git a/relay/server/listener/ws/listener.go b/relay/server/listener/ws/listener.go
index ba175f901..a1a26668a 100644
--- a/relay/server/listener/ws/listener.go
+++ b/relay/server/listener/ws/listener.go
@@ -15,6 +15,7 @@ import (
 	"github.com/netbirdio/netbird/relay/protocol"
 	relaylistener "github.com/netbirdio/netbird/relay/server/listener"
 	"github.com/netbirdio/netbird/shared/relay"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 const (
@@ -27,33 +28,61 @@ type Listener struct {
 	Address string
 	// TLSConfig is the TLS configuration for the server.
 	TLSConfig *tls.Config
+	// TrustedProxies is the set of upstream proxies whose X-Real-Ip/X-Real-Port
+	// headers are trusted. Headers from any other immediate peer are ignored.
+	TrustedProxies *trustedproxy.List
 
+	listener net.Listener
 	server   *http.Server
 	acceptFn func(conn relaylistener.Conn)
 }
 
-func (l *Listener) Listen(acceptFn func(conn relaylistener.Conn)) error {
-	l.acceptFn = acceptFn
+func (l *Listener) Bind() error {
+	addr := l.Address
+	if addr == "" {
+		addr = ":http"
+		if l.TLSConfig != nil {
+			addr = ":https"
+		}
+	}
+
+	listener, err := net.Listen("tcp", addr)
+	if err != nil {
+		return err
+	}
+
 	mux := http.NewServeMux()
 	mux.HandleFunc(URLPath, l.onAccept)
 
+	l.listener = listener
 	l.server = &http.Server{
-		Addr:              l.Address,
 		Handler:           mux,
 		TLSConfig:         l.TLSConfig,
 		ReadHeaderTimeout: 5 * time.Second,
 	}
 
-	log.Infof("WS server listening address: %s", l.Address)
+	log.Infof("WS server listening address: %s", addr)
+	return nil
+}
+
+func (l *Listener) Serve(acceptFn func(conn relaylistener.Conn)) error {
+	if l.listener == nil {
+		return errors.New("listener is not bound")
+	}
+
+	l.acceptFn = acceptFn
 	var err error
 	if l.TLSConfig != nil {
-		err = l.server.ListenAndServeTLS("", "")
+		err = l.server.ServeTLS(l.listener, "", "")
 	} else {
-		err = l.server.ListenAndServe()
+		err = l.server.Serve(l.listener)
 	}
 	if errors.Is(err, http.ErrServerClosed) {
 		return nil
 	}
+	if closeErr := l.listener.Close(); closeErr != nil && !errors.Is(closeErr, net.ErrClosed) {
+		log.Debugf("failed to close WS listener: %v", closeErr)
+	}
 	return err
 }
 
@@ -62,7 +91,7 @@ func (l *Listener) Protocol() protocol.Protocol {
 }
 
 func (l *Listener) Shutdown(ctx context.Context) error {
-	if l.server == nil {
+	if l.listener == nil {
 		return nil
 	}
 
@@ -70,12 +99,15 @@ func (l *Listener) Shutdown(ctx context.Context) error {
 	if err := l.server.Shutdown(ctx); err != nil {
 		return fmt.Errorf("server shutdown failed: %v", err)
 	}
+	if err := l.listener.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
+		return fmt.Errorf("close listener: %w", err)
+	}
 	log.Infof("WS listener stopped")
 	return nil
 }
 
 func (l *Listener) onAccept(w http.ResponseWriter, r *http.Request) {
-	connRemoteAddr := remoteAddr(r)
+	connRemoteAddr := remoteAddr(r, l.TrustedProxies)
 
 	acceptOptions := &websocket.AcceptOptions{
 		OriginPatterns: []string{"*"},
@@ -102,9 +134,17 @@ func (l *Listener) onAccept(w http.ResponseWriter, r *http.Request) {
 	l.acceptFn(conn)
 }
 
-func remoteAddr(r *http.Request) string {
-	if r.Header.Get("X-Real-Ip") == "" || r.Header.Get("X-Real-Port") == "" {
+func remoteAddr(r *http.Request, trustedProxies *trustedproxy.List) string {
+	realIP := r.Header.Get("X-Real-Ip")
+	realPort := r.Header.Get("X-Real-Port")
+	if realIP == "" || realPort == "" {
 		return r.RemoteAddr
 	}
-	return net.JoinHostPort(r.Header.Get("X-Real-Ip"), r.Header.Get("X-Real-Port"))
+
+	if !trustedProxies.IsTrusted(r.RemoteAddr) {
+		log.Debugf("ignoring X-Real-Ip header from untrusted peer %s", r.RemoteAddr)
+		return r.RemoteAddr
+	}
+
+	return net.JoinHostPort(realIP, realPort)
 }
diff --git a/relay/server/listener/ws/listener_test.go b/relay/server/listener/ws/listener_test.go
new file mode 100644
index 000000000..2373fb5ed
--- /dev/null
+++ b/relay/server/listener/ws/listener_test.go
@@ -0,0 +1,104 @@
+package ws
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	relaylistener "github.com/netbirdio/netbird/relay/server/listener"
+)
+
+func TestListener_ShutdownBeforeServe(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0"}
+	require.NoError(t, l.Bind())
+	addr := l.listener.Addr().String()
+	require.NoError(t, l.Shutdown(context.Background()))
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- l.Serve(func(relaylistener.Conn) {})
+	}()
+
+	assert.NoError(t, waitForServeToReturn(t, errChan))
+	requireTCPAddressFree(t, addr)
+}
+
+func TestListener_ShutdownStopsServe(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0"}
+	require.NoError(t, l.Bind())
+	addr := l.listener.Addr().String()
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- l.Serve(func(relaylistener.Conn) {})
+	}()
+
+	// A bound socket accepts TCP connections before Serve runs, so only a served
+	// HTTP response proves the accept loop is running.
+	require.Eventually(t, func() bool {
+		return httpGetSucceeds("http://" + addr + "/")
+	}, 5*time.Second, 10*time.Millisecond, "listener did not start serving")
+
+	require.NoError(t, l.Shutdown(context.Background()))
+	assert.NoError(t, waitForServeToReturn(t, errChan))
+	requireTCPAddressFree(t, addr)
+}
+
+func TestListener_ServeErrorReleasesSocket(t *testing.T) {
+	// A TLS config without certificates makes ServeTLS fail before it takes
+	// ownership of the listener, so only Serve itself can close the socket.
+	l := &Listener{Address: "127.0.0.1:0", TLSConfig: &tls.Config{}}
+	require.NoError(t, l.Bind())
+	addr := l.listener.Addr().String()
+
+	assert.Error(t, l.Serve(func(relaylistener.Conn) {}), "ServeTLS must fail without a certificate")
+	requireTCPAddressFree(t, addr)
+	assert.NoError(t, l.Shutdown(context.Background()), "Shutdown after a failed Serve must succeed")
+}
+
+func TestListener_Unbound(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0"}
+	assert.Error(t, l.Serve(func(relaylistener.Conn) {}), "Serve must refuse an unbound listener")
+	assert.NoError(t, l.Shutdown(context.Background()), "Shutdown of an unbound listener is a no-op")
+}
+
+func waitForServeToReturn(t *testing.T, errChan <-chan error) error {
+	t.Helper()
+	select {
+	case err := <-errChan:
+		return err
+	case <-time.After(5 * time.Second):
+		t.Fatal("Serve did not return")
+		return nil
+	}
+}
+
+func httpGetSucceeds(url string) bool {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, http.NoBody)
+	if err != nil {
+		return false
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return false
+	}
+	_ = resp.Body.Close()
+	return true
+}
+
+func requireTCPAddressFree(t *testing.T, addr string) {
+	t.Helper()
+	ln, err := net.Listen("tcp", addr)
+	require.NoError(t, err, "tcp address %s must be released", addr)
+	require.NoError(t, ln.Close())
+}
diff --git a/relay/server/relay.go b/relay/server/relay.go
index 84c424b8e..58f9db840 100644
--- a/relay/server/relay.go
+++ b/relay/server/relay.go
@@ -21,7 +21,8 @@ import (
 )
 
 type Listener interface {
-	Listen(func(conn listener.Conn)) error
+	Bind() error
+	Serve(func(conn listener.Conn)) error
 	Shutdown(ctx context.Context) error
 	Protocol() protocol.Protocol
 }
@@ -122,6 +123,9 @@ func (r *Relay) Accept(conn listener.Conn) {
 	r.closeMu.RLock()
 	defer r.closeMu.RUnlock()
 	if r.closed {
+		if err := conn.Close(); err != nil {
+			log.Debugf("failed to close connection after shutdown, %s: %s", conn.RemoteAddr(), err)
+		}
 		return
 	}
 
diff --git a/relay/server/relay_test.go b/relay/server/relay_test.go
new file mode 100644
index 000000000..aea0f2a62
--- /dev/null
+++ b/relay/server/relay_test.go
@@ -0,0 +1,55 @@
+package server
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/relay/auth/allow"
+)
+
+type closeRecorderConn struct {
+	reads  int
+	closed bool
+}
+
+func (c *closeRecorderConn) Read(context.Context, []byte) (int, error) {
+	c.reads++
+	return 0, net.ErrClosed
+}
+
+func (c *closeRecorderConn) Write(context.Context, []byte) (int, error) {
+	return 0, net.ErrClosed
+}
+
+func (c *closeRecorderConn) RemoteAddr() net.Addr {
+	return &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1}
+}
+
+func (c *closeRecorderConn) Close() error {
+	c.closed = true
+	return nil
+}
+
+func (c *closeRecorderConn) Protocol() string {
+	return "test"
+}
+
+func TestRelay_AcceptAfterShutdownClosesConn(t *testing.T) {
+	relay, err := NewRelay(Config{
+		ExposedAddress: "rel://127.0.0.1:1234",
+		AuthValidator:  &allow.Auth{},
+	})
+	require.NoError(t, err)
+	relay.Shutdown(context.Background())
+
+	conn := &closeRecorderConn{}
+	relay.Accept(conn)
+	assert.True(t, conn.closed, "a connection accepted after shutdown must be closed")
+	// The handshake error path closes the connection too, so only an untouched Read
+	// proves the closed guard rejected it before any handshake.
+	assert.Zero(t, conn.reads, "a connection accepted after shutdown must not be read")
+}
diff --git a/relay/server/server.go b/relay/server/server.go
index 340da55b8..4636eed65 100644
--- a/relay/server/server.go
+++ b/relay/server/server.go
@@ -3,6 +3,7 @@ package server
 import (
 	"context"
 	"crypto/tls"
+	"fmt"
 	"net/url"
 	"sync"
 
@@ -15,14 +16,17 @@ import (
 	"github.com/netbirdio/netbird/relay/server/listener/quic"
 	"github.com/netbirdio/netbird/relay/server/listener/ws"
 	quictls "github.com/netbirdio/netbird/shared/relay/tls"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 // ListenerConfig is the configuration for the listener.
 // Address: the address to bind the listener to. It could be an address behind a reverse proxy.
 // TLSConfig: the TLS configuration for the listener.
+// TrustedProxies: upstream proxy prefixes whose forwarding headers (X-Real-Ip/X-Real-Port) are trusted.
 type ListenerConfig struct {
-	Address   string
-	TLSConfig *tls.Config
+	Address        string
+	TLSConfig      *tls.Config
+	TrustedProxies *trustedproxy.List
 }
 
 // Server is the main entry point for the relay server.
@@ -32,6 +36,7 @@ type Server struct {
 	relay       *Relay
 	listeners   []Listener
 	listenerMux sync.Mutex
+	closed      bool
 }
 
 // NewServer creates and returns a new relay server instance.
@@ -59,38 +64,30 @@ func NewServer(config Config) (*Server, error) {
 	}, nil
 }
 
-// Listen starts the relay server.
+// Listen binds the relay listeners and serves them until Shutdown is called.
 func (r *Server) Listen(cfg ListenerConfig) error {
-	wSListener := &ws.Listener{
-		Address:   cfg.Address,
-		TLSConfig: cfg.TLSConfig,
-	}
-
 	r.listenerMux.Lock()
-	r.listeners = append(r.listeners, wSListener)
-
-	tlsConfigQUIC, err := quictls.ServerQUICTLSConfig(cfg.TLSConfig)
-	if err != nil {
-		log.Warnf("Not starting QUIC listener: %v", err)
-	} else {
-		quicListener := &quic.Listener{
-			Address:   cfg.Address,
-			TLSConfig: tlsConfigQUIC,
-		}
-
-		r.listeners = append(r.listeners, quicListener)
+	if r.closed {
+		r.listenerMux.Unlock()
+		return nil
 	}
 
-	errChan := make(chan error, len(r.listeners))
+	listeners, err := bindListeners(newListeners(cfg))
+	if err != nil {
+		r.listenerMux.Unlock()
+		return err
+	}
+	r.listeners = append(r.listeners, listeners...)
+
+	errChan := make(chan error, len(listeners))
 	wg := sync.WaitGroup{}
-	for _, l := range r.listeners {
+	for _, l := range listeners {
 		wg.Add(1)
 		go func(listener Listener) {
 			defer wg.Done()
-			errChan <- listener.Listen(r.relay.Accept)
+			errChan <- listener.Serve(r.relay.Accept)
 		}(l)
 	}
-
 	r.listenerMux.Unlock()
 
 	wg.Wait()
@@ -106,18 +103,14 @@ func (r *Server) Listen(cfg ListenerConfig) error {
 // Shutdown stops the relay server. If there are active connections, they will be closed gracefully. In case of a context,
 // the connections will be forcefully closed.
 func (r *Server) Shutdown(ctx context.Context) error {
-	r.relay.Shutdown(ctx)
-
 	r.listenerMux.Lock()
-	var multiErr *multierror.Error
-	for _, l := range r.listeners {
-		if err := l.Shutdown(ctx); err != nil {
-			multiErr = multierror.Append(multiErr, err)
-		}
-	}
-	r.listeners = r.listeners[:0]
+	r.closed = true
+	listeners := r.listeners
+	r.listeners = nil
 	r.listenerMux.Unlock()
-	return nberrors.FormatErrorOrNil(multiErr)
+
+	r.relay.Shutdown(ctx)
+	return shutdownListeners(ctx, listeners)
 }
 
 func (r *Server) ListenerProtocols() []protocol.Protocol {
@@ -141,3 +134,48 @@ func (r *Server) InstanceURL() url.URL {
 func (r *Server) RelayAccept() func(conn listener.Conn) {
 	return r.relay.Accept
 }
+
+func newListeners(cfg ListenerConfig) []Listener {
+	listeners := []Listener{
+		&ws.Listener{
+			Address:        cfg.Address,
+			TLSConfig:      cfg.TLSConfig,
+			TrustedProxies: cfg.TrustedProxies,
+		},
+	}
+
+	tlsConfigQUIC, err := quictls.ServerQUICTLSConfig(cfg.TLSConfig)
+	if err != nil {
+		log.Warnf("Not starting QUIC listener: %v", err)
+		return listeners
+	}
+
+	return append(listeners, &quic.Listener{
+		Address:   cfg.Address,
+		TLSConfig: tlsConfigQUIC,
+	})
+}
+
+func bindListeners(listeners []Listener) ([]Listener, error) {
+	bound := make([]Listener, 0, len(listeners))
+	for _, l := range listeners {
+		if err := l.Bind(); err != nil {
+			if shutdownErr := shutdownListeners(context.Background(), bound); shutdownErr != nil {
+				log.Warnf("failed to close listeners after bind error: %v", shutdownErr)
+			}
+			return nil, fmt.Errorf("%s listener: %w", l.Protocol(), err)
+		}
+		bound = append(bound, l)
+	}
+	return bound, nil
+}
+
+func shutdownListeners(ctx context.Context, listeners []Listener) error {
+	var multiErr *multierror.Error
+	for _, l := range listeners {
+		if err := l.Shutdown(ctx); err != nil {
+			multiErr = multierror.Append(multiErr, err)
+		}
+	}
+	return nberrors.FormatErrorOrNil(multiErr)
+}
diff --git a/relay/server/server_test.go b/relay/server/server_test.go
new file mode 100644
index 000000000..6ec802b94
--- /dev/null
+++ b/relay/server/server_test.go
@@ -0,0 +1,230 @@
+package server
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"math/big"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/relay/server/listener/quic"
+	"github.com/netbirdio/netbird/shared/relay/auth/allow"
+)
+
+func TestServer_ShutdownBeforeListen(t *testing.T) {
+	addr := freeAddress(t)
+	srv := newTestServer(t, addr)
+	require.NoError(t, srv.Shutdown(context.Background()))
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- srv.Listen(ListenerConfig{Address: addr})
+	}()
+
+	assert.NoError(t, waitForReturn(t, "Listen", errChan))
+	assert.Empty(t, srv.ListenerProtocols(), "a shut down server must not register listeners")
+	requireAddressFree(t, addr)
+}
+
+func TestServer_ShutdownStopsListen(t *testing.T) {
+	addr := freeAddress(t)
+	srv := newTestServer(t, addr)
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- srv.Listen(ListenerConfig{Address: addr})
+	}()
+
+	waitForListeners(t, srv, errChan)
+
+	require.NoError(t, srv.Shutdown(context.Background()))
+	assert.NoError(t, waitForReturn(t, "Listen", errChan))
+	requireAddressFree(t, addr)
+}
+
+func TestServer_ConcurrentListenAndShutdown(t *testing.T) {
+	tlsCfg := testTLSConfig(t)
+	for round := 0; round < 20; round++ {
+		t.Run(fmt.Sprintf("round-%d", round), func(t *testing.T) {
+			addr := freeAddress(t)
+			srv := newTestServer(t, addr)
+
+			start := make(chan struct{})
+			listenErr := make(chan error, 1)
+			shutdownErr := make(chan error, 1)
+			go func() {
+				<-start
+				listenErr <- srv.Listen(ListenerConfig{Address: addr, TLSConfig: tlsCfg})
+			}()
+			go func() {
+				<-start
+				shutdownErr <- srv.Shutdown(context.Background())
+			}()
+			close(start)
+
+			// Either side may take the lock first: Listen then returns without binding,
+			// or Shutdown stops its accept loops. Listen must return in both cases.
+			assert.NoError(t, waitForReturn(t, "Listen", listenErr))
+			assert.NoError(t, waitForReturn(t, "Shutdown", shutdownErr))
+			assert.Empty(t, srv.ListenerProtocols(), "no listener may stay registered after shutdown")
+			requireAddressFree(t, addr)
+		})
+	}
+}
+
+func TestServer_ListenReturnsBindError(t *testing.T) {
+	blocker, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = blocker.Close() })
+	addr := blocker.Addr().String()
+	srv := newTestServer(t, addr)
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- srv.Listen(ListenerConfig{Address: addr})
+	}()
+
+	assert.Error(t, waitForReturn(t, "Listen", errChan), "Listen must return the bind error instead of serving")
+	assert.Empty(t, srv.ListenerProtocols(), "a failed Listen must not register listeners")
+
+	require.NoError(t, blocker.Close())
+	requireAddressFree(t, addr)
+}
+
+func TestServer_ListenRollsBackOnBindError(t *testing.T) {
+	addr := freeAddress(t)
+	blocker, err := net.ListenPacket("udp", addr)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = blocker.Close() })
+	srv := newTestServer(t, addr)
+	tlsCfg := testTLSConfig(t)
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- srv.Listen(ListenerConfig{Address: addr, TLSConfig: tlsCfg})
+	}()
+
+	err = waitForReturn(t, "Listen", errChan)
+	require.Error(t, err, "Listen must fail when the QUIC port is taken")
+	assert.ErrorContains(t, err, string(quic.Proto)+" listener", "the QUIC listener must be the one that failed to bind")
+	assert.Empty(t, srv.ListenerProtocols(), "a failed Listen must not register listeners")
+
+	// The WS listener binds first, so a free TCP port proves the rollback closed it.
+	ln, err := net.Listen("tcp", addr)
+	require.NoError(t, err, "the WS socket must be released after the QUIC bind failure")
+	require.NoError(t, ln.Close())
+}
+
+func newTestServer(t *testing.T, addr string) *Server {
+	t.Helper()
+	srv, err := NewServer(Config{
+		ExposedAddress: "rel://" + addr,
+		AuthValidator:  &allow.Auth{},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, srv.Shutdown(context.Background()))
+	})
+	return srv
+}
+
+// The server binds TCP and UDP on the same port, so a port is only picked when
+// both are free. The probes are closed before Listen binds, which leaves a small
+// window for another process to take the port; waitForListeners then reports the
+// bind error instead of a timeout.
+func freeAddress(t *testing.T) string {
+	t.Helper()
+	for attempt := 0; attempt < 10; attempt++ {
+		ln, err := net.Listen("tcp", "127.0.0.1:0")
+		require.NoError(t, err)
+		addr := ln.Addr().String()
+		require.NoError(t, ln.Close())
+
+		conn, err := net.ListenPacket("udp", addr)
+		if err != nil {
+			continue
+		}
+		require.NoError(t, conn.Close())
+		return addr
+	}
+	t.Fatal("no address with both tcp and udp ports free")
+	return ""
+}
+
+// Listen registers its listeners under the same lock that starts serving, so a
+// non-empty ListenerProtocols means the sockets are bound. A Listen that returns
+// before that has failed to bind, and its error is reported instead of a timeout.
+func waitForListeners(t *testing.T, srv *Server, errChan <-chan error) {
+	t.Helper()
+	deadline := time.After(5 * time.Second)
+	for len(srv.ListenerProtocols()) == 0 {
+		select {
+		case err := <-errChan:
+			t.Fatalf("Listen returned before binding: %v", err)
+		case <-deadline:
+			t.Fatal("listeners were not bound")
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+}
+
+func waitForReturn(t *testing.T, op string, errChan <-chan error) error {
+	t.Helper()
+	select {
+	case err := <-errChan:
+		return err
+	case <-time.After(5 * time.Second):
+		t.Fatalf("%s did not return", op)
+		return nil
+	}
+}
+
+// The QUIC listener releases its UDP socket from the read loop after Close returns,
+// so both sockets are polled instead of checked once.
+func requireAddressFree(t *testing.T, addr string) {
+	t.Helper()
+	require.Eventually(t, func() bool {
+		ln, err := net.Listen("tcp", addr)
+		if err != nil {
+			return false
+		}
+		_ = ln.Close()
+
+		conn, err := net.ListenPacket("udp", addr)
+		if err != nil {
+			return false
+		}
+		_ = conn.Close()
+		return true
+	}, 5*time.Second, 10*time.Millisecond, "address %s must be released", addr)
+}
+
+// A nil TLS config only yields a QUIC listener in the devcert build, so the tests
+// that need both listeners pass a real one and bind them regardless of build tags.
+func testTLSConfig(t *testing.T) *tls.Config {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	require.NoError(t, err)
+
+	return &tls.Config{
+		Certificates: []tls.Certificate{{Certificate: [][]byte{certDER}, PrivateKey: key}},
+	}
+}
diff --git a/release_files/collect-licenses.sh b/release_files/collect-licenses.sh
new file mode 100644
index 000000000..8481c9c3e
--- /dev/null
+++ b/release_files/collect-licenses.sh
@@ -0,0 +1,109 @@
+#!/bin/sh
+#
+# Collect the license terms shipped in /licenses of the UBI images: NetBird's
+# own licenses, the Go standard library terms, and the root license files of
+# every module the Go package links on the given architectures.
+#
+#   -l FILE   component license, copied as AGPL-3.0.txt (path from repo root)
+#   -t TAGS   build tags used for the dependency walk
+#   -w        add the proxy web UI's third-party licenses (needs proxy/web/node_modules)
+set -eu
+
+usage() {
+	printf '%s\n' "usage: $0 [-l LICENSE_FILE] [-t TAGS] [-w] OUTPUT_DIRECTORY PACKAGE GOARCH..." >&2
+	exit 2
+}
+
+component_license=""
+tags=""
+web=false
+while getopts l:t:w opt; do
+	case "$opt" in
+	l) component_license=$OPTARG ;;
+	t) tags=$OPTARG ;;
+	w) web=true ;;
+	*) usage ;;
+	esac
+done
+shift $((OPTIND - 1))
+[ "$#" -ge 3 ] || usage
+
+repo_root=$(CDPATH='' cd -- "$(dirname "$0")/.." && pwd)
+output_name=$(basename "$1")
+if [ -z "$output_name" ] || [ "$output_name" = . ] || [ "$output_name" = .. ] || [ "$output_name" = / ]; then
+	printf '%s\n' "OUTPUT_DIRECTORY must name a directory" >&2
+	exit 2
+fi
+output_parent=$(CDPATH='' cd -- "$(dirname "$1")" && pwd)
+output="$output_parent/$output_name"
+package=$2
+shift 2
+
+if [ -e "$output" ] || [ -L "$output" ]; then
+	printf 'output directory already exists: %s\n' "$output" >&2
+	exit 1
+fi
+modules=$(mktemp "${TMPDIR:-/tmp}/netbird-licenses.modules.XXXXXX")
+sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-licenses.sorted.XXXXXX")
+# Assemble beside the target and rename on success, so a failed run leaves
+# nothing behind that would block the next attempt.
+staging=$(mktemp -d "$output_parent/.$output_name.XXXXXX")
+trap 'rm -f "$modules" "$sorted_modules"; rm -rf "$staging"' EXIT HUP INT TERM
+mkdir "$staging/third_party"
+
+if [ -n "$component_license" ]; then
+	cp "$repo_root/$component_license" "$staging/AGPL-3.0.txt"
+fi
+cp "$repo_root/LICENSE" "$staging/BSD-3-Clause.txt"
+if [ "$web" = true ]; then
+	node "$repo_root/proxy/web/scripts/third-party-licenses.mjs" >"$staging/Web-THIRD-PARTY-LICENSES"
+fi
+
+cd "$repo_root"
+for arch in "$@"; do
+	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-0} \
+		go list -deps -tags "$tags" -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' "$package" >>"$modules"
+done
+LC_ALL=C sort -u "$modules" >"$sorted_modules"
+
+goroot=$(go env GOROOT)
+for term in LICENSE PATENTS; do
+	if [ ! -f "$goroot/$term" ]; then
+		printf 'missing Go standard-library term: %s\n' "$goroot/$term" >&2
+		exit 1
+	fi
+	cp "$goroot/$term" "$staging/Go-$term"
+done
+
+while IFS='	' read -r module version module_dir; do
+	[ -n "$module" ] || continue
+	[ "$module" = "github.com/netbirdio/netbird" ] && continue
+
+	if [ -z "$version" ] || [ ! -d "$module_dir" ]; then
+		printf 'cannot collect terms for module %s at version %s\n' "$module" "$version" >&2
+		exit 1
+	fi
+
+	destination="$staging/third_party/$module/$version"
+	mkdir -p "$destination"
+	printf 'module: %s\nversion: %s\n' "$module" "$version" >"$destination/MODULE"
+
+	found=false
+	for term in \
+		"$module_dir"/LICENSE* "$module_dir"/License* "$module_dir"/license* \
+		"$module_dir"/LICENCE* "$module_dir"/Licence* "$module_dir"/licence* \
+		"$module_dir"/COPYING* "$module_dir"/Copying* "$module_dir"/copying* \
+		"$module_dir"/NOTICE* "$module_dir"/Notice* "$module_dir"/notice* \
+		"$module_dir"/PATENTS* "$module_dir"/Patents* "$module_dir"/patents*; do
+		[ -f "$term" ] || continue
+		cp "$term" "$destination/"
+		found=true
+	done
+
+	if [ "$found" = false ]; then
+		printf 'no root license terms found for module %s at %s\n' "$module" "$module_dir" >&2
+		exit 1
+	fi
+done <"$sorted_modules"
+
+mv "$staging" "$output"
diff --git a/release_files/darwin_pkg/postinstall b/release_files/darwin_pkg/postinstall
index 33fa4bfee..2c96a80cd 100755
--- a/release_files/darwin_pkg/postinstall
+++ b/release_files/darwin_pkg/postinstall
@@ -30,7 +30,23 @@ mkdir -p /usr/local/bin/
     $AGENT service install || true
     $AGENT service start || true
 
-    open $APP
+    console_user=$(stat -f%Su /dev/console 2>/dev/null)
+    case "$console_user" in
+        ""|root|loginwindow|_mbsetupuser)
+            echo "No active GUI user session (console user: '${console_user:-none}'); skipping UI launch."
+            ;;
+        *)
+            uid=$(id -u "$console_user" 2>/dev/null)
+            if [ -z "$uid" ]; then
+                echo "Could not resolve uid for console user '$console_user'; skipping UI launch."
+            else
+                echo "Launching NetBird UI as console user $console_user (uid $uid)."
+                if ! launchctl asuser "$uid" sudo -u "$console_user" -H open "$APP"; then
+                    echo "Failed to launch NetBird UI; if autostart is enabled it will start at next login."
+                fi
+            fi
+            ;;
+    esac
 
     echo "Finished Netbird installation successfully"
     exit 0 # all good
diff --git a/release_files/darwin_pkg/preinstall b/release_files/darwin_pkg/preinstall
index 5965e82eb..231bcae4e 100755
--- a/release_files/darwin_pkg/preinstall
+++ b/release_files/darwin_pkg/preinstall
@@ -4,9 +4,67 @@ set -x
 
 LOG_FILE=/var/log/netbird/client_pre_install.log
 AGENT=/usr/local/bin/netbird
+UI_PROCESS=netbird-ui
 
 mkdir -p /var/log/netbird/
 
+# wait_for_ui_exit polls for up to $1 seconds, returning 0 as soon as no UI
+# process is left and 1 if one is still running when the time is up.
+wait_for_ui_exit() {
+    waited=0
+    while [ "$waited" -lt "$1" ]; do
+        pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
+        sleep 1
+        waited=$((waited + 1))
+    done
+    return 1
+}
+
+# request_ui_quit asks the UI to quit from inside the console user's session and
+# reports whether the request could be sent at all. The installer runs as root
+# outside that session, so a quit Apple event sent straight from here always
+# fails with -600.
+request_ui_quit() {
+    console_user=$(stat -f%Su /dev/console 2>/dev/null)
+    case "$console_user" in
+        ""|root|loginwindow|_mbsetupuser)
+            echo "No active GUI user session (console user: '${console_user:-none}'); skipping the quit request."
+            return 1
+            ;;
+    esac
+
+    uid=$(id -u "$console_user" 2>/dev/null)
+    if [ -z "$uid" ]; then
+        echo "Could not resolve uid for console user '$console_user'; skipping the quit request."
+        return 1
+    fi
+
+    echo "Asking the NetBird UI to quit as console user $console_user (uid $uid)."
+    launchctl asuser "$uid" sudo -u "$console_user" -H osascript -e 'quit app "NetBird"' || true
+}
+
+# quit_ui stops a running UI so the app bundle can be replaced underneath it. A
+# UI process that survives the install keeps serving the old binary until it is
+# quit by hand, so anything still running once the quit request is out of the
+# way is signalled. Waiting for a graceful exit only makes sense when a quit
+# request was actually sent.
+quit_ui() {
+    if request_ui_quit && wait_for_ui_exit 10; then
+        return 0
+    fi
+
+    pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
+
+    echo "NetBird UI still running; terminating it."
+    pkill -x "$UI_PROCESS" || true
+    if wait_for_ui_exit 3; then
+        return 0
+    fi
+
+    echo "NetBird UI ignored SIGTERM; killing it."
+    pkill -KILL -x "$UI_PROCESS" || true
+}
+
 {
     # check if it was installed with brew
     brew list --formula | grep netbird
@@ -15,10 +73,9 @@ mkdir -p /var/log/netbird/
         echo "NetBird has been installed with Brew. Please use Brew to update the package."
         exit 1
     fi
-    osascript -e 'quit app "Netbird"' || true
+    quit_ui
     $AGENT service stop || true
 
     echo "Preinstall complete"
     exit 0 # all good
 } &> $LOG_FILE
-
diff --git a/release_files/freebsd-port-diff.sh b/release_files/freebsd-port-diff.sh
index 6ffa141be..cd3c341b9 100755
--- a/release_files/freebsd-port-diff.sh
+++ b/release_files/freebsd-port-diff.sh
@@ -3,52 +3,25 @@
 # FreeBSD Port Diff Generator for NetBird
 #
 # This script generates the diff file required for submitting a FreeBSD port update.
-# It works on macOS, Linux, and FreeBSD by fetching files from FreeBSD cgit and
-# computing checksums from the Go module proxy.
+# It works on macOS, Linux, and FreeBSD by fetching files from the FreeBSD ports
+# GitHub mirror and computing checksums from the Go module proxy.
 #
 # Usage: ./freebsd-port-diff.sh [new_version]
 # Example: ./freebsd-port-diff.sh 0.60.7
 #
-# If no version is provided, it fetches the latest from GitHub.
+# If no version is provided, it uses the latest stable release from GitHub.
+# Prerelease versions (canary, rc, ...) are rejected: the port only tracks
+# stable releases.
 
 set -e
 
-GITHUB_REPO="netbirdio/netbird"
-PORTS_CGIT_BASE="https://cgit.freebsd.org/ports/plain/security/netbird"
+# shellcheck source=release_files/freebsd-port-lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/freebsd-port-lib.sh"
+
 GO_PROXY="https://proxy.golang.org/github.com/netbirdio/netbird/@v"
 OUTPUT_DIR="${OUTPUT_DIR:-.}"
 AWK_FIRST_FIELD='{print $1}'
 
-fetch_all_tags() {
-    curl -sL "https://github.com/${GITHUB_REPO}/tags" 2>/dev/null | \
-        grep -oE '/releases/tag/v[0-9]+\.[0-9]+\.[0-9]+([^"]+)?' | \
-        grep -iv 'rc' | \
-        sed 's/.*\/v//' | \
-        sort -u -V
-    return 0
-}
-
-fetch_current_ports_version() {
-    echo "Fetching current version from FreeBSD ports..." >&2
-    curl -sL "${PORTS_CGIT_BASE}/Makefile" 2>/dev/null | \
-        grep -E "^DISTVERSION=" | \
-        sed 's/DISTVERSION=[[:space:]]*//' | \
-        tr -d '\t '
-    return 0
-}
-
-fetch_latest_github_release() {
-    echo "Fetching latest release from GitHub..." >&2
-    fetch_all_tags | tail -1
-    return 0
-}
-
-fetch_ports_file() {
-    local filename="$1"
-    curl -sL "${PORTS_CGIT_BASE}/${filename}" 2>/dev/null
-    return 0
-}
-
 compute_checksums() {
     local version="$1"
     local tmpdir
@@ -61,11 +34,15 @@ compute_checksums() {
     local mod_file="${tmpdir}/v${version}.mod"
     local zip_file="${tmpdir}/v${version}.zip"
 
-    curl -sL "${GO_PROXY}/v${version}.mod" -o "$mod_file" 2>/dev/null
-    curl -sL "${GO_PROXY}/v${version}.zip" -o "$zip_file" 2>/dev/null
+    local -a curl_opts=(-fsL --proto '=https' --proto-redir '=https' --retry 3)
+    if ! curl "${curl_opts[@]}" "${GO_PROXY}/v${version}.mod" -o "$mod_file" 2>/dev/null || \
+       ! curl "${curl_opts[@]}" "${GO_PROXY}/v${version}.zip" -o "$zip_file" 2>/dev/null; then
+        echo "Error: Could not download v${version} from the Go module proxy" >&2
+        return 1
+    fi
 
     if [[ ! -s "$mod_file" ]] || [[ ! -s "$zip_file" ]]; then
-        echo "Error: Could not download files from Go module proxy" >&2
+        echo "Error: Go module proxy returned empty files for v${version}" >&2
         return 1
     fi
 
@@ -117,25 +94,12 @@ generate_new_makefile() {
 }
 
 # Parse arguments
-NEW_VERSION="${1:-}"
-
-# Auto-detect versions if not provided
-OLD_VERSION=$(fetch_current_ports_version)
-if [[ -z "$OLD_VERSION" ]]; then
-    echo "Error: Could not fetch current version from FreeBSD ports" >&2
-    exit 1
-fi
-echo "Current FreeBSD ports version: ${OLD_VERSION}" >&2
-
-if [[ -z "$NEW_VERSION" ]]; then
-    NEW_VERSION=$(fetch_latest_github_release)
-    if [[ -z "$NEW_VERSION" ]]; then
-        echo "Error: Could not fetch latest release from GitHub" >&2
-        exit 1
-    fi
-fi
+NEW_VERSION=$(resolve_target_version "${1:-}")
 echo "Target version: ${NEW_VERSION}" >&2
 
+OLD_VERSION=$(fetch_current_ports_version)
+echo "Current FreeBSD ports version: ${OLD_VERSION}" >&2
+
 if [[ "$OLD_VERSION" = "$NEW_VERSION" ]]; then
     echo "Port is already at version ${NEW_VERSION}. Nothing to do." >&2
     exit 0
diff --git a/release_files/freebsd-port-issue-body.sh b/release_files/freebsd-port-issue-body.sh
index 1c23dbbbe..16fe0e2b6 100755
--- a/release_files/freebsd-port-issue-body.sh
+++ b/release_files/freebsd-port-issue-body.sh
@@ -9,78 +9,30 @@
 # Example: ./freebsd-port-issue-body.sh 0.56.0 0.59.1
 #
 # If no versions are provided, the script will:
-#   - Fetch OLD version from FreeBSD ports cgit (current version in ports tree)
-#   - Fetch NEW version from latest NetBird GitHub release tag
+#   - Fetch OLD version from the FreeBSD ports GitHub mirror (current version in ports tree)
+#   - Fetch NEW version from the latest stable NetBird release tag on GitHub
+#
+# Prerelease versions (canary, rc, ...) are rejected: the port only tracks
+# stable releases.
 
 set -e
 
-GITHUB_REPO="netbirdio/netbird"
-PORTS_CGIT_URL="https://cgit.freebsd.org/ports/plain/security/netbird/Makefile"
-
-fetch_current_ports_version() {
-    echo "Fetching current version from FreeBSD ports..." >&2
-    local makefile_content
-    makefile_content=$(curl -sL "$PORTS_CGIT_URL" 2>/dev/null)
-    if [[ -z "$makefile_content" ]]; then
-        echo "Error: Could not fetch Makefile from FreeBSD ports" >&2
-        return 1
-    fi
-    echo "$makefile_content" | grep -E "^DISTVERSION=" | sed 's/DISTVERSION=[[:space:]]*//' | tr -d '\t '
-    return 0
-}
-
-fetch_all_tags() {
-    # Fetch tags from GitHub tags page (no rate limiting, no auth needed)
-    curl -sL "https://github.com/${GITHUB_REPO}/tags" 2>/dev/null | \
-        grep -oE '/releases/tag/v[0-9]+\.[0-9]+\.[0-9]+([^"]+)?' | \
-        grep -iv 'rc' | \
-        sed 's/.*\/v//' | \
-        sort -u -V
-    return 0
-}
-
-fetch_latest_github_release() {
-    echo "Fetching latest release from GitHub..." >&2
-    local latest
-
-    # Fetch from GitHub tags page
-    latest=$(fetch_all_tags | tail -1)
-
-    if [[ -z "$latest" ]]; then
-        # Fallback to GitHub API
-        latest=$(curl -sL "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" 2>/dev/null | \
-            grep '"tag_name"' | sed 's/.*"tag_name": *"v\([^"]*\)".*/\1/')
-    fi
-
-    if [[ -z "$latest" ]]; then
-        echo "Error: Could not fetch latest release from GitHub" >&2
-        return 1
-    fi
-    echo "$latest"
-    return 0
-}
+# shellcheck source=release_files/freebsd-port-lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/freebsd-port-lib.sh"
 
 OLD_VERSION="${1:-}"
 NEW_VERSION="${2:-}"
 
 if [[ -z "$OLD_VERSION" ]]; then
     OLD_VERSION=$(fetch_current_ports_version)
-    if [[ -z "$OLD_VERSION" ]]; then
-        echo "Error: Could not determine old version. Please provide it manually." >&2
-        echo "Usage: $0 <old_version> <new_version>" >&2
-        exit 1
-    fi
     echo "Detected OLD version from FreeBSD ports: $OLD_VERSION" >&2
 fi
 
 if [[ -z "$NEW_VERSION" ]]; then
-    NEW_VERSION=$(fetch_latest_github_release)
-    if [[ -z "$NEW_VERSION" ]]; then
-        echo "Error: Could not determine new version. Please provide it manually." >&2
-        echo "Usage: $0 <old_version> <new_version>" >&2
-        exit 1
-    fi
+    NEW_VERSION=$(resolve_target_version "")
     echo "Detected NEW version from GitHub: $NEW_VERSION" >&2
+else
+    NEW_VERSION=$(resolve_target_version "$NEW_VERSION")
 fi
 
 if [[ "$OLD_VERSION" = "$NEW_VERSION" ]]; then
@@ -94,8 +46,11 @@ OUTPUT_DIR="${OUTPUT_DIR:-.}"
 fetch_releases_between_versions() {
     echo "Fetching release history from GitHub..." >&2
 
-    # Fetch all tags and filter to those between OLD and NEW versions
-    fetch_all_tags | \
+    local tags
+    tags=$(fetch_stable_tags) || return 1
+
+    # List the stable releases after OLD up to and including NEW
+    echo "$tags" | \
         while read -r ver; do
             if [[ "$(printf '%s\n' "$OLD_VERSION" "$ver" | sort -V | head -n1)" = "$OLD_VERSION" ]] && \
                [[ "$(printf '%s\n' "$ver" "$NEW_VERSION" | sort -V | head -n1)" = "$ver" ]] && \
@@ -108,7 +63,7 @@ fetch_releases_between_versions() {
 
 generate_changelog_section() {
     local releases
-    releases=$(fetch_releases_between_versions)
+    releases=$(fetch_releases_between_versions) || return 1
 
     echo "Changelogs:"
     if [[ -n "$releases" ]]; then
@@ -123,7 +78,10 @@ generate_changelog_section() {
 
 OUTPUT_FILE="${OUTPUT_DIR}/netbird-${NEW_VERSION}-issue.txt"
 
-cat << EOF > "$OUTPUT_FILE"
+# Built before the heredoc: a failing substitution inside it would not stop the script.
+CHANGELOG=$(generate_changelog_section)
+
+cat << EOT > "$OUTPUT_FILE"
 BUGZILLA ISSUE DETAILS
 ======================
 
@@ -135,11 +93,11 @@ Description:
 ------------
 security/netbird: Update ${OLD_VERSION} => ${NEW_VERSION}
 
-$(generate_changelog_section)
+${CHANGELOG}
 
 Commit log:
 https://github.com/${GITHUB_REPO}/compare/v${OLD_VERSION}...v${NEW_VERSION}
-EOF
+EOT
 
 echo "========================================="
 echo "Issue body saved to: ${OUTPUT_FILE}"
diff --git a/release_files/freebsd-port-lib.sh b/release_files/freebsd-port-lib.sh
new file mode 100644
index 000000000..20102be54
--- /dev/null
+++ b/release_files/freebsd-port-lib.sh
@@ -0,0 +1,98 @@
+#!/bin/bash
+#
+# Shared helpers for the FreeBSD port scripts. Source this file, do not run it.
+#
+# The FreeBSD port tracks stable NetBird releases only, so every helper here
+# works on plain MAJOR.MINOR.PATCH versions and ignores canary, release
+# candidate and any other prerelease tag.
+
+GITHUB_REPO="netbirdio/netbird"
+GITHUB_REPO_URL="https://github.com/${GITHUB_REPO}.git"
+PORTS_MIRROR_BASE="https://raw.githubusercontent.com/freebsd/freebsd-ports/main/security/netbird"
+STABLE_VERSION_RE='^[0-9]+\.[0-9]+\.[0-9]+$'
+
+# is_stable_version reports whether the version is a plain MAJOR.MINOR.PATCH release.
+is_stable_version() {
+    local version="$1"
+    if [[ "$version" =~ $STABLE_VERSION_RE ]]; then
+        return 0
+    fi
+    return 1
+}
+
+# fetch_stable_tags prints the stable release versions known to GitHub, oldest
+# first. git ls-remote returns every tag in one round trip, with no API
+# pagination or rate limit to work around.
+fetch_stable_tags() {
+    local refs
+    if ! refs=$(git ls-remote --tags --refs "$GITHUB_REPO_URL" 2>/dev/null); then
+        echo "Error: Could not list tags of ${GITHUB_REPO_URL}" >&2
+        return 1
+    fi
+
+    echo "$refs" | \
+        sed -nE 's#.*refs/tags/v([0-9]+\.[0-9]+\.[0-9]+)$#\1#p' | \
+        sort -u -V
+    return 0
+}
+
+# resolve_target_version validates an explicitly requested version, or picks the
+# latest stable release from GitHub when none was given. A leading "v" is
+# accepted so a git tag name can be passed as is.
+resolve_target_version() {
+    local raw="$1"
+    local requested="${raw#v}"
+
+    if [[ -n "$raw" ]]; then
+        if ! is_stable_version "$requested"; then
+            echo "Error: '${raw}' is not a stable release. The FreeBSD port only tracks MAJOR.MINOR.PATCH versions." >&2
+            return 1
+        fi
+        echo "$requested"
+        return 0
+    fi
+
+    echo "Fetching latest stable release from GitHub..." >&2
+    local latest
+    latest=$(fetch_stable_tags | tail -1)
+    if [[ -z "$latest" ]]; then
+        echo "Error: Could not determine the latest stable release from GitHub" >&2
+        return 1
+    fi
+    echo "$latest"
+    return 0
+}
+
+# fetch_ports_file prints a file from the security/netbird port on the FreeBSD
+# ports GitHub mirror.
+fetch_ports_file() {
+    local filename="$1"
+    local content
+    if ! content=$(curl -fsL --proto '=https' --proto-redir '=https' --retry 3 "${PORTS_MIRROR_BASE}/${filename}" 2>/dev/null); then
+        echo "Error: Could not fetch ${filename} from ${PORTS_MIRROR_BASE}" >&2
+        return 1
+    fi
+    if [[ "$content" == \<* ]]; then
+        echo "Error: Received HTML instead of ${filename} from ${PORTS_MIRROR_BASE}" >&2
+        return 1
+    fi
+    printf '%s' "$content"
+    return 0
+}
+
+# fetch_current_ports_version prints the DISTVERSION currently in the ports tree.
+fetch_current_ports_version() {
+    echo "Fetching current version from FreeBSD ports..." >&2
+    local makefile version
+    makefile=$(fetch_ports_file "Makefile") || return 1
+    version=$(echo "$makefile" | \
+        grep -E "^DISTVERSION=" | \
+        sed 's/DISTVERSION=[[:space:]]*//' | \
+        tr -d '\t ')
+    if [[ -z "$version" ]]; then
+        echo "Error: Could not extract DISTVERSION from ports Makefile" >&2
+        return 1
+    fi
+    echo "$version"
+    return 0
+}
diff --git a/release_files/install.sh b/release_files/install.sh
index a002de472..4769e34f0 100755
--- a/release_files/install.sh
+++ b/release_files/install.sh
@@ -17,6 +17,9 @@ ARCH="$(uname -m)"
 PACKAGE_MANAGER="bin"
 INSTALL_DIR=""
 SUDO=""
+# curl protocol set for --proto / --proto-redir: https and nothing else, so no
+# request and no redirect in a chain can fall back to plaintext.
+PROTO_HTTPS="=https"
 
 
 if command -v sudo > /dev/null && [ "$(id -u)" -ne 0 ]; then
@@ -25,6 +28,15 @@ elif command -v doas > /dev/null && [ "$(id -u)" -ne 0 ]; then
     SUDO="doas"
 fi
 
+# Downloads are staged in a private directory instead of /tmp. Fixed names in a
+# shared directory can collide with entries created there beforehand, and the
+# paths staged here are consumed by the privileged install steps below.
+NB_TMPDIR="$(mktemp -d "${TMPDIR:-/tmp}/netbird.XXXXXXXXXX")" || {
+    echo "Unable to create a temporary directory for the downloads"
+    exit 1
+}
+trap 'rm -rf "$NB_TMPDIR"' EXIT
+
 if [ -z ${NETBIRD_RELEASE+x} ]; then
     NETBIRD_RELEASE=latest
 fi
@@ -73,10 +85,11 @@ download_release_binary() {
     DOWNLOAD_URL="${BASE_URL}/${VERSION}/${BINARY_NAME}"
 
     echo "Installing $1 from $DOWNLOAD_URL"
+    ARCHIVE_PATH="${NB_TMPDIR}/${BINARY_NAME}"
     if [ -n "$GITHUB_TOKEN" ]; then
-      cd /tmp && curl -H  "Authorization: token ${GITHUB_TOKEN}" -LO "$DOWNLOAD_URL"
+      curl -H  "Authorization: token ${GITHUB_TOKEN}" -L --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" -o "$ARCHIVE_PATH" "$DOWNLOAD_URL"
     else
-      cd /tmp && curl -LO "$DOWNLOAD_URL" || curl -LO --dns-servers 8.8.8.8 "$DOWNLOAD_URL"
+      curl -L --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" -o "$ARCHIVE_PATH" "$DOWNLOAD_URL" || curl -L --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" -o "$ARCHIVE_PATH" --dns-servers 8.8.8.8 "$DOWNLOAD_URL"
     fi
 
 
@@ -89,12 +102,12 @@ download_release_binary() {
         fi
 
         # Unzip the app and move to INSTALL_DIR
-        unzip -q -o "$BINARY_NAME"
-        mv -v "netbird_ui_${OS_TYPE}/" "$INSTALL_DIR/" || mv -v "netbird_ui_${OS_TYPE}_${ARCH}/" "$INSTALL_DIR/"
+        unzip -q -o "$ARCHIVE_PATH" -d "$NB_TMPDIR"
+        mv -v "${NB_TMPDIR}/netbird_ui_${OS_TYPE}/" "$INSTALL_DIR/" || mv -v "${NB_TMPDIR}/netbird_ui_${OS_TYPE}_${ARCH}/" "$INSTALL_DIR/"
     else
         ${SUDO} mkdir -p "$INSTALL_DIR"
-        tar -xzvf "$BINARY_NAME"
-        ${SUDO} mv "${1%_"${BINARY_BASE_NAME}"}" "$INSTALL_DIR/"
+        tar -xzvf "$ARCHIVE_PATH" -C "$NB_TMPDIR"
+        ${SUDO} mv "${NB_TMPDIR}/${1%_"${BINARY_BASE_NAME}"}" "$INSTALL_DIR/"
     fi
 }
 
@@ -110,7 +123,7 @@ add_apt_repo() {
         /usr/share/keyrings/netbird-archive-keyring.gpg \
         /usr/share/keyrings/wiretrustee-archive-keyring.gpg
 
-    curl -sSL https://pkgs.netbird.io/debian/public.key \
+    curl -sSL --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" https://pkgs.netbird.io/debian/public.key \
     | ${SUDO} gpg --dearmor -o /usr/share/keyrings/netbird-archive-keyring.gpg
 
     # Explicitly set the file permission
@@ -183,11 +196,10 @@ install_pkg() {
     *) echo "Unsupported macOS arch: $(uname -m)" >&2; exit 1 ;;
   esac
 
-  PKG_URL=$(curl -sIL -o /dev/null -w '%{url_effective}' "https://pkgs.netbird.io/macos/${ARCH}")
+  PKG_URL=$(curl -sIL --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" -o /dev/null -w '%{url_effective}' "https://pkgs.netbird.io/macos/${ARCH}")
   echo "Downloading NetBird macOS installer from https://pkgs.netbird.io/macos/${ARCH}"
-  curl -fsSL -o /tmp/netbird.pkg "${PKG_URL}"
-  ${SUDO} installer -pkg /tmp/netbird.pkg -target /
-  rm -f /tmp/netbird.pkg
+  curl -fsSL --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" -o "${NB_TMPDIR}/netbird.pkg" "${PKG_URL}"
+  ${SUDO} installer -pkg "${NB_TMPDIR}/netbird.pkg" -target /
 }
 
 check_use_bin_variable() {
diff --git a/release_files/netbird.sysconfig b/release_files/netbird.sysconfig
new file mode 100644
index 000000000..655e746a7
--- /dev/null
+++ b/release_files/netbird.sysconfig
@@ -0,0 +1,19 @@
+# Environment for the netbird client service (netbird.service).
+# Every "netbird up" flag has an NB_* equivalent; see
+# https://docs.netbird.io/get-started/cli#environment-variables
+#
+# Red Hat Enterprise Linux 9 ships the in-kernel WireGuard module as a
+# Technology Preview and taints the kernel when it loads. For a fully
+# supported RHEL 9 configuration run the client with userspace WireGuard:
+#NB_WG_KERNEL_DISABLED=true
+#
+# Self-hosted management server:
+#NB_MANAGEMENT_URL=https://netbird.example.com
+#
+# Peer name shown in the dashboard (defaults to the system hostname):
+#NB_HOSTNAME=
+#
+# Certificate posture checks:
+#NB_CERT_STORE_DIR=/etc/netbird/certs
+#NB_CERT_PKCS11_URI=pkcs11:token=netbird?module-path=/usr/lib64/pkcs11/libtpm2_pkcs11.so
+#NB_TPM_PIN=
diff --git a/release_files/post_install.sh b/release_files/post_install.sh
index 12b272698..c763b7447 100644
--- a/release_files/post_install.sh
+++ b/release_files/post_install.sh
@@ -9,8 +9,18 @@ else
     systemd_version=$(systemctl --version | head -1 | sed 's/systemd //g')
 fi
 
+# The service environment file may hold the PKCS#11 token PIN (NB_TPM_PIN). Package
+# upgrades keep a locally modified copy with its old mode, so restrict it on every run.
+restrict_env_file() {
+    if [ -f /etc/sysconfig/netbird ]; then
+      chmod 0600 /etc/sysconfig/netbird
+    fi
+    return 0
+}
+
 cleanInstall() {
     printf "\033[32m Post Install of an clean install\033[0m\n"
+    restrict_env_file
     # Step 3 (clean install), enable the service in the proper way for this platform
     /usr/bin/netbird service install
     /usr/bin/netbird service start
@@ -18,6 +28,7 @@ cleanInstall() {
 
 upgrade() {
     printf "\033[32m Post Install of an upgrade\033[0m\n"
+    restrict_env_file
     if [ "${use_systemctl}" = "True" ]; then
       printf "\033[32m Stopping the service\033[0m\n"
       systemctl stop netbird 2> /dev/null || true
diff --git a/release_files/rpm-changelog.sh b/release_files/rpm-changelog.sh
new file mode 100755
index 000000000..d9150399e
--- /dev/null
+++ b/release_files/rpm-changelog.sh
@@ -0,0 +1,145 @@
+#!/bin/sh
+#
+# Generate the changelog nfpm embeds into the RPM.
+#
+# chglog records the whole commit message for each entry. Pull requests are
+# squashed on merge, so that body is usually the pull request description:
+# template headings, review checklists, HTML comments and Co-authored-by
+# trailers. None of that belongs in a package on Red Hat's catalog, and it is
+# most of the changelog's size. Keep the subject line and drop the rest.
+#
+# chglog also records the bare tag as each entry's version, while nfpm writes
+# that string into the changelog header verbatim and never appends the release.
+# rpmlint then reports incoherent-version-in-changelog, because the entry reads
+# 0.79.0 while the package is 0.79.0-1. Rewrite each version the way nfpm
+# renders the package EVR.
+
+set -eu
+
+go tool chglog init
+
+python3 - changelog.yml <<'PYEOF'
+import re
+import sys
+
+path = sys.argv[1]
+lines = open(path, encoding="utf-8").read().split("\n")
+
+NOTE = re.compile(r"^      note: (.*)$")
+SEMVER = re.compile(r"^- semver: (.*)$")
+BLOCK = {"|", "|-", "|+", ">", ">-", ">+"}
+
+# nfpm defaults the RPM release to 1 and the packaging sets no other value.
+RELEASE = "1"
+
+
+def quote(text):
+    """Render text as a YAML single-quoted scalar."""
+    return "      note: '{}'".format(text.replace("'", "''"))
+
+
+def evr(version):
+    """Render a semver tag the way nfpm renders the package EVR."""
+    version, _, metadata = version.partition("+")
+    core, _, prerelease = version.partition("-")
+    if prerelease:
+        core += "~" + prerelease.replace("-", "_")
+    if metadata:
+        core += "+" + metadata
+    return "{}-{}".format(core, RELEASE)
+
+
+def first_line_of_double_quoted(value):
+    """Text of a double-quoted scalar up to its first \\n escape."""
+    out = []
+    i = 1
+    while i < len(value):
+        c = value[i]
+        if c == "\\" and i + 1 < len(value):
+            if value[i + 1] == "n":
+                break
+            out.append(value[i:i + 2])
+            i += 2
+            continue
+        if c == '"':
+            break
+        out.append(c)
+        i += 1
+    return "".join(out).replace('\\"', '"').replace("\\\\", "\\")
+
+
+out = []
+seen = 0
+i = 0
+while i < len(lines):
+    line = lines[i]
+
+    m = SEMVER.match(line)
+    if m:
+        out.append("- semver: '{}'".format(evr(m.group(1))))
+        i += 1
+        continue
+
+    m = NOTE.match(line)
+    if not m:
+        out.append(line)
+        i += 1
+        continue
+
+    seen += 1
+    value = m.group(1)
+
+    if value in BLOCK:
+        # Subject is the first non-empty body line; skip the rest of the block.
+        i += 1
+        subject = None
+        while i < len(lines) and (lines[i] == "" or lines[i].startswith("        ")):
+            if subject is None and lines[i].strip():
+                subject = lines[i][8:]
+            i += 1
+        if subject is None:
+            sys.exit("empty block scalar note near line {}".format(i))
+        out.append(quote(subject))
+        continue
+
+    if value.startswith('"') and value.endswith('"') and len(value) > 1:
+        out.append(quote(first_line_of_double_quoted(value)))
+        i += 1
+        continue
+
+    if value.startswith("'") and value.endswith("'") and len(value) > 1:
+        out.append(line)
+        i += 1
+        continue
+
+    if not value.startswith(("'", '"')) and value not in BLOCK:
+        out.append(line)
+        i += 1
+        continue
+
+    sys.exit("unhandled note form at line {}: {!r}".format(i + 1, value))
+
+open(path, "w", encoding="utf-8").write("\n".join(out))
+print("changelog entries: {}".format(seen))
+PYEOF
+
+# Every note must now be a single line. A multi-line one means the rewrite
+# missed a form chglog emitted, and the package would ship the pull request
+# body again.
+if grep -nE "^      note: [|>]" changelog.yml; then
+	echo "block-scalar notes survived the rewrite" >&2
+	exit 1
+fi
+if grep -nE '^      note: ".*\\n' changelog.yml; then
+	echo "multi-line notes survived the rewrite" >&2
+	exit 1
+fi
+
+# Every entry must carry the release, or rpmlint reports the changelog version
+# as incoherent with the package again.
+if grep -nE "^- semver: " changelog.yml | grep -vE -- "-[0-9]+'$"; then
+	echo "changelog entries without the RPM release survived the rewrite" >&2
+	exit 1
+fi
+
+test -s changelog.yml
diff --git a/release_files/rpm-provides.sh b/release_files/rpm-provides.sh
new file mode 100644
index 000000000..b1332c18b
--- /dev/null
+++ b/release_files/rpm-provides.sh
@@ -0,0 +1,46 @@
+#!/bin/sh
+#
+# Write .goreleaser.generated.yaml with the @RPM_EVR@ placeholder filled in.
+#
+# Red Hat certification (RPM Version Handling) expects rpmbuild's ISA provide,
+# netbird(x86-64) = <evr>. nfpm does not emit it and GoReleaser does not template
+# the provides field, so the version is substituted before GoReleaser runs.
+#
+# The value has to match what nfpm derives from the same tag: a semver
+# prerelease becomes a tilde suffix, and the release defaults to 1.
+
+set -eu
+
+OUT=.goreleaser.generated.yaml
+
+TAG="${GITHUB_REF#refs/tags/}"
+case "$TAG" in
+v*) ;;
+*) TAG=$(git describe --tags --abbrev=0) ;;
+esac
+
+EVR=$(python3 - "$TAG" <<'PYEOF'
+import sys
+
+version = sys.argv[1].lstrip("v")
+version, _, metadata = version.partition("+")
+core, _, prerelease = version.partition("-")
+if prerelease:
+    core += "~" + prerelease.replace("-", "_")
+if metadata:
+    core += "+" + metadata
+print("{}-1".format(core))
+PYEOF
+)
+
+# Written to a separate, ignored file: GoReleaser refuses to release from a
+# dirty tree, so .goreleaser.yaml itself must stay untouched.
+sed "s/@RPM_EVR@/${EVR}/g" .goreleaser.yaml > "$OUT"
+
+# A surviving placeholder means the provides entries moved or were renamed.
+if grep -n "@RPM_EVR@" "$OUT"; then
+	echo "unsubstituted @RPM_EVR@ left in $OUT" >&2
+	exit 1
+fi
+
+echo "rpm provides version: ${EVR} -> ${OUT}"
diff --git a/route/route.go b/route/route.go
index 97b9721f6..ef9a39ef7 100644
--- a/route/route.go
+++ b/route/route.go
@@ -95,6 +95,7 @@ type Route struct {
 	ID ID `gorm:"primaryKey"`
 	// AccountID is a reference to Account that this object belongs
 	AccountID string `gorm:"index"`
+	PublicID  string `json:"-" gorm:"index"`
 	// Network and Domains are mutually exclusive
 	Network             netip.Prefix `gorm:"serializer:json"`
 	Domains             domain.List  `gorm:"serializer:json"`
@@ -128,6 +129,7 @@ func (r *Route) Copy() *Route {
 	route := &Route{
 		ID:                  r.ID,
 		AccountID:           r.AccountID,
+		PublicID:            r.PublicID,
 		Description:         r.Description,
 		NetID:               r.NetID,
 		Network:             r.Network,
diff --git a/shared/auth/jwt/validator.go b/shared/auth/jwt/validator.go
index cf18b2cf6..240d64bb3 100644
--- a/shared/auth/jwt/validator.go
+++ b/shared/auth/jwt/validator.go
@@ -18,7 +18,6 @@ import (
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
-
 	log "github.com/sirupsen/logrus"
 )
 
@@ -217,8 +216,8 @@ func (v *Validator) ValidateAndParse(ctx context.Context, token string) (*jwt.To
 		jwt.WithAudience(v.audienceList...),
 		jwt.WithIssuer(v.issuer),
 		jwt.WithIssuedAt(),
+		jwt.WithStrictDecoding(),
 	)
-
 	// Check if there was an error in parsing...
 	if err != nil {
 		err = fmt.Errorf("%w: %s", errTokenParsing, err)
@@ -289,36 +288,64 @@ func getPublicKey(token *jwt.Token, jwks *Jwks) (interface{}, error) {
 	return nil, errKeyNotFound
 }
 
-func getPublicKeyFromECDSA(jwk JSONWebKey) (publicKey *ecdsa.PublicKey, err error) {
+func curveFromName(crv string) (elliptic.Curve, error) {
+	switch crv {
+	case p256:
+		return elliptic.P256(), nil
+	case p384:
+		return elliptic.P384(), nil
+	case p521:
+		return elliptic.P521(), nil
+	default:
+		return nil, fmt.Errorf("unsupported elliptic curve %q", crv)
+	}
+}
+
+func getPublicKeyFromECDSA(jwk JSONWebKey) (*ecdsa.PublicKey, error) {
 	if jwk.X == "" || jwk.Y == "" || jwk.Crv == "" {
 		return nil, fmt.Errorf("ecdsa key incomplete")
 	}
 
-	var xCoordinate []byte
-	if xCoordinate, err = base64.RawURLEncoding.DecodeString(jwk.X); err != nil {
+	curve, err := curveFromName(jwk.Crv)
+	if err != nil {
 		return nil, err
 	}
 
-	var yCoordinate []byte
-	if yCoordinate, err = base64.RawURLEncoding.DecodeString(jwk.Y); err != nil {
-		return nil, err
+	xCoordinate, err := base64.RawURLEncoding.DecodeString(jwk.X)
+	if err != nil {
+		return nil, fmt.Errorf("decode ecdsa x coordinate: %w", err)
 	}
 
-	publicKey = &ecdsa.PublicKey{}
-
-	var curve elliptic.Curve
-	switch jwk.Crv {
-	case p256:
-		curve = elliptic.P256()
-	case p384:
-		curve = elliptic.P384()
-	case p521:
-		curve = elliptic.P521()
+	yCoordinate, err := base64.RawURLEncoding.DecodeString(jwk.Y)
+	if err != nil {
+		return nil, fmt.Errorf("decode ecdsa y coordinate: %w", err)
 	}
 
-	publicKey.Curve = curve
-	publicKey.X = big.NewInt(0).SetBytes(xCoordinate)
-	publicKey.Y = big.NewInt(0).SetBytes(yCoordinate)
+	var x, y big.Int
+	x.SetBytes(xCoordinate)
+	y.SetBytes(yCoordinate)
+
+	bits := curve.Params().BitSize
+	if x.BitLen() > bits {
+		return nil, fmt.Errorf("ecdsa x coordinate is %d bits, exceeds curve %s field size of %d bits", x.BitLen(), jwk.Crv, bits)
+	}
+	if y.BitLen() > bits {
+		return nil, fmt.Errorf("ecdsa y coordinate is %d bits, exceeds curve %s field size of %d bits", y.BitLen(), jwk.Crv, bits)
+	}
+
+	// Round up: P-521's field is 521 bits, so a coordinate needs 66 bytes, not 65.
+	size := (bits + 7) / 8
+
+	// Assemble the SEC 1 uncompressed point (0x04 || X || Y)
+	point := make([]byte, 1+2*size)
+	point[0] = 4
+	x.FillBytes(point[1 : 1+size])
+	y.FillBytes(point[1+size:])
+
+	publicKey, err := ecdsa.ParseUncompressedPublicKey(curve, point)
+	if err != nil {
+		return nil, fmt.Errorf("parse ecdsa public key: %w", err)
+	}
 
 	return publicKey, nil
 }
diff --git a/shared/auth/jwt/validator_test.go b/shared/auth/jwt/validator_test.go
new file mode 100644
index 000000000..a5b3f4a39
--- /dev/null
+++ b/shared/auth/jwt/validator_test.go
@@ -0,0 +1,214 @@
+package jwt
+
+import (
+	"bytes"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// ecdsaJWK builds a JWK for pub using uncompressed-point encoding
+func ecdsaJWK(t *testing.T, kid string, pub *ecdsa.PublicKey, crv string, size int) JSONWebKey {
+	t.Helper()
+
+	point, err := pub.Bytes()
+	require.NoError(t, err)
+	require.Len(t, point, 1+2*size)
+	require.Equal(t, byte(4), point[0], "expected uncompressed point")
+
+	return JSONWebKey{
+		Kty: "EC",
+		Kid: kid,
+		Use: "sig",
+		Crv: crv,
+		X:   base64.RawURLEncoding.EncodeToString(point[1 : 1+size]),
+		Y:   base64.RawURLEncoding.EncodeToString(point[1+size:]),
+	}
+}
+
+func TestGetPublicKeyFromECDSA_RoundTrip(t *testing.T) {
+	tests := []struct {
+		crv   string
+		curve elliptic.Curve
+		size  int
+	}{
+		{p256, elliptic.P256(), 32},
+		{p384, elliptic.P384(), 48},
+		{p521, elliptic.P521(), 66},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.crv, func(t *testing.T) {
+			priv, err := ecdsa.GenerateKey(tc.curve, rand.Reader)
+			require.NoError(t, err)
+
+			got, err := getPublicKeyFromECDSA(ecdsaJWK(t, "kid", &priv.PublicKey, tc.crv, tc.size))
+			require.NoError(t, err)
+			assert.True(t, priv.PublicKey.Equal(got), "parsed key differs from the original")
+		})
+	}
+}
+
+// TestGetPublicKeyFromECDSA_ShortCoordinate covers IdPs that strip leading zero
+// bytes from a coordinate instead of padding to the curve's field size.
+func TestGetPublicKeyFromECDSA_ShortCoordinate(t *testing.T) {
+	var (
+		priv  *ecdsa.PrivateKey
+		point []byte
+	)
+	for i := 0; i < 10000; i++ {
+		key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		require.NoError(t, err)
+
+		p, err := key.PublicKey.Bytes()
+		require.NoError(t, err)
+
+		if p[1] == 0 || p[33] == 0 {
+			priv, point = key, p
+			break
+		}
+	}
+	require.NotNil(t, priv, "no key with a leading zero coordinate byte was generated")
+
+	jwk := JSONWebKey{
+		Kty: "EC",
+		Kid: "kid",
+		Crv: p256,
+		X:   base64.RawURLEncoding.EncodeToString(bytes.TrimLeft(point[1:33], "\x00")),
+		Y:   base64.RawURLEncoding.EncodeToString(bytes.TrimLeft(point[33:], "\x00")),
+	}
+
+	got, err := getPublicKeyFromECDSA(jwk)
+	require.NoError(t, err)
+	assert.True(t, priv.PublicKey.Equal(got))
+}
+
+func TestGetPublicKeyFromECDSA_Invalid(t *testing.T) {
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	valid := ecdsaJWK(t, "kid", &priv.PublicKey, p256, 32)
+
+	offCurve := valid
+	x, err := base64.RawURLEncoding.DecodeString(valid.X)
+	require.NoError(t, err)
+	x[31] ^= 0xff
+	offCurve.X = base64.RawURLEncoding.EncodeToString(x)
+
+	// 33 non-zero bytes is 264 bits, past P-256's 256-bit field.
+	oversized := valid
+	oversized.X = base64.RawURLEncoding.EncodeToString(bytes.Repeat([]byte{0xff}, 33))
+
+	// P-521 coordinates occupy 66 bytes but only 521 bits, so a full 66-byte
+	// 0xff value (528 bits) is over the field size without being over the byte
+	// length. Only a bit-length bound catches this.
+	overP521 := JSONWebKey{
+		Kty: "EC",
+		Crv: p521,
+		X:   base64.RawURLEncoding.EncodeToString(bytes.Repeat([]byte{0xff}, 66)),
+		Y:   base64.RawURLEncoding.EncodeToString(bytes.Repeat([]byte{0xff}, 66)),
+	}
+
+	zeroPoint := valid
+	zeroPoint.X = base64.RawURLEncoding.EncodeToString(make([]byte, 32))
+	zeroPoint.Y = base64.RawURLEncoding.EncodeToString(make([]byte, 32))
+
+	tests := []struct {
+		name        string
+		jwk         JSONWebKey
+		errContains string
+	}{
+		{name: "missing crv", jwk: JSONWebKey{Kty: "EC", X: valid.X, Y: valid.Y}},
+		{name: "missing x", jwk: JSONWebKey{Kty: "EC", Crv: p256, Y: valid.Y}},
+		{name: "unsupported curve", jwk: JSONWebKey{Kty: "EC", Crv: "P-224", X: valid.X, Y: valid.Y}, errContains: "unsupported elliptic curve"},
+		{name: "undecodable x", jwk: JSONWebKey{Kty: "EC", Crv: p256, X: "!!not base64!!!", Y: valid.Y}, errContains: "decode ecdsa x coordinate"},
+		{name: "coordinate over field size", jwk: oversized, errContains: "exceeds curve P-256 field size of 256 bits"},
+		{name: "p521 coordinate over field size", jwk: overP521, errContains: "exceeds curve P-521 field size of 521 bits"},
+		{name: "off-curve point", jwk: offCurve, errContains: "parse ecdsa public key"},
+		{name: "point at infinity", jwk: zeroPoint, errContains: "parse ecdsa public key"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			key, err := getPublicKeyFromECDSA(tc.jwk)
+			require.Error(t, err)
+			assert.Nil(t, key)
+			if tc.errContains != "" {
+				assert.ErrorContains(t, err, tc.errContains)
+			}
+		})
+	}
+}
+
+// TestValidateAndParse_ECDSA verifies an ES256-signed token end to end, proving
+// the parsed key actually validates signatures.
+func TestValidateAndParse_ECDSA(t *testing.T) {
+	const (
+		kid      = "es256-kid"
+		issuer   = "https://issuer.example.com/"
+		audience = "netbird"
+	)
+
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	jwks, err := json.Marshal(Jwks{Keys: []JSONWebKey{ecdsaJWK(t, kid, &priv.PublicKey, p256, 32)}})
+	require.NoError(t, err)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(jwks)
+	}))
+	defer srv.Close()
+
+	token := jwt.NewWithClaims(jwt.SigningMethodES256, jwt.MapClaims{
+		"iss": issuer,
+		"aud": audience,
+		"sub": "user-1",
+		"iat": time.Now().Add(-time.Minute).Unix(),
+		"exp": time.Now().Add(time.Hour).Unix(),
+	})
+	token.Header["kid"] = kid
+
+	signed, err := token.SignedString(priv)
+	require.NoError(t, err)
+
+	v := NewValidator(issuer, []string{audience}, srv.URL, false)
+
+	parsed, err := v.ValidateAndParse(context.Background(), signed)
+	require.NoError(t, err)
+	require.True(t, parsed.Valid)
+
+	claims, ok := parsed.Claims.(jwt.MapClaims)
+	require.True(t, ok)
+	assert.Equal(t, "user-1", claims["sub"])
+
+	// A token signed by a different key of the same curve must be rejected.
+	other, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	forged := jwt.NewWithClaims(jwt.SigningMethodES256, jwt.MapClaims{
+		"iss": issuer,
+		"aud": audience,
+		"sub": "user-1",
+		"iat": time.Now().Add(-time.Minute).Unix(),
+		"exp": time.Now().Add(time.Hour).Unix(),
+	})
+	forged.Header["kid"] = kid
+
+	forgedSigned, err := forged.SignedString(other)
+	require.NoError(t, err)
+
+	_, err = v.ValidateAndParse(context.Background(), forgedSigned)
+	require.Error(t, err)
+}
diff --git a/shared/externalipmap/validate.go b/shared/externalipmap/validate.go
new file mode 100644
index 000000000..30517007c
--- /dev/null
+++ b/shared/externalipmap/validate.go
@@ -0,0 +1,70 @@
+// Package externalipmap validates the --external-ip-map flag shared by the
+// agent and the proxy.
+package externalipmap
+
+import (
+	"fmt"
+	"net"
+	"strings"
+)
+
+const flagName = "external-ip-map"
+
+// Validate checks each element is formatted as "IP", "IP/IP" or
+// "IP/interface". The engine drops every mapping when one element fails to
+// parse, so callers should reject bad input up front.
+func Validate(list []string) error {
+	for _, element := range list {
+		if element == "" {
+			return fmt.Errorf("empty string is not a valid input for %s", flagName)
+		}
+
+		subElements := strings.Split(element, "/")
+		if len(subElements) > 2 {
+			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"String\" or \"String/String\"", element, flagName)
+		}
+
+		if !isValidIP(subElements[0]) {
+			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"IP\" or \"IP/IP\", or \"IP/Interface Name\"", element, flagName)
+		}
+
+		if len(subElements) == 2 {
+			if err := validateInternal(subElements[1]); err != nil {
+				return fmt.Errorf("%s is not a valid input for %s. it should be an IP string or a network name: %w", subElements[1], flagName, err)
+			}
+		}
+	}
+	return nil
+}
+
+func validateInternal(element string) error {
+	if isValidIP(element) {
+		return nil
+	}
+	validIface, err := isValidInterface(element)
+	if err != nil {
+		return fmt.Errorf("validate network interface name: %w", err)
+	}
+	if !validIface {
+		return fmt.Errorf("invalid IP or network interface name not found")
+	}
+	return nil
+}
+
+// isValidIP uses net.ParseIP to match the engine's parser exactly.
+func isValidIP(ip string) bool {
+	return net.ParseIP(ip) != nil
+}
+
+func isValidInterface(name string) (bool, error) {
+	netInterfaces, err := net.Interfaces()
+	if err != nil {
+		return false, err
+	}
+	for _, iface := range netInterfaces {
+		if iface.Name == name {
+			return true, nil
+		}
+	}
+	return false, nil
+}
diff --git a/shared/externalipmap/validate_test.go b/shared/externalipmap/validate_test.go
new file mode 100644
index 000000000..baf3cf787
--- /dev/null
+++ b/shared/externalipmap/validate_test.go
@@ -0,0 +1,48 @@
+package externalipmap
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidate(t *testing.T) {
+	ifaces, err := net.Interfaces()
+	require.NoError(t, err)
+	require.NotEmpty(t, ifaces, "host must have at least one interface")
+	iface := ifaces[0].Name
+
+	tests := []struct {
+		name    string
+		input   []string
+		wantErr bool
+	}{
+		{name: "nil", input: nil},
+		{name: "single IP", input: []string{"203.0.113.5"}},
+		{name: "IP to IP", input: []string{"203.0.113.5/10.0.0.5"}},
+		{name: "IP to interface", input: []string{"203.0.113.5/" + iface}},
+		{name: "several", input: []string{"203.0.113.5", "203.0.113.6/10.0.0.6"}},
+		{name: "empty element", input: []string{""}, wantErr: true},
+		// The engine rejects padded values, so validation must too.
+		{name: "space padded", input: []string{"203.0.113.5", " 203.0.113.6"}, wantErr: true},
+		{name: "not an IP", input: []string{"not-an-ip"}, wantErr: true},
+		{name: "too many slashes", input: []string{"203.0.113.5/10.0.0.5/10.0.0.6"}, wantErr: true},
+		{name: "unknown interface", input: []string{"203.0.113.5/nb-no-such-iface0"}, wantErr: true},
+		{name: "external interface", input: []string{iface}, wantErr: true},
+		{name: "interface to IP", input: []string{iface + "/10.0.0.5"}, wantErr: true},
+		{name: "two interfaces", input: []string{iface + "/" + iface}, wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := Validate(tt.input)
+			if tt.wantErr {
+				assert.Error(t, err, "input %q should be rejected", tt.input)
+				return
+			}
+			assert.NoError(t, err, "input %q should be accepted", tt.input)
+		})
+	}
+}
diff --git a/shared/lifecycle/stop_handlers.go b/shared/lifecycle/stop_handlers.go
new file mode 100644
index 000000000..f6ec2688b
--- /dev/null
+++ b/shared/lifecycle/stop_handlers.go
@@ -0,0 +1,57 @@
+package lifecycle
+
+import (
+	"runtime/debug"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// StopHandlers collects functions to run once when their owner exits. Embed it
+// in a server type to expose OnStop and RunStopHandlers.
+type StopHandlers struct {
+	mu       sync.Mutex
+	stopped  bool
+	handlers []func()
+}
+
+// OnStop registers fn to run once when the owner stops. Handlers run in
+// reverse registration order. A handler registered after the owner has
+// stopped runs immediately.
+func (h *StopHandlers) OnStop(fn func()) {
+	h.mu.Lock()
+	stopped := h.stopped
+	if !stopped {
+		h.handlers = append(h.handlers, fn)
+	}
+	h.mu.Unlock()
+
+	if stopped {
+		runStopHandler(fn)
+	}
+}
+
+// RunStopHandlers runs every registered handler once, last registered first.
+// Later calls are no-ops, so it can be wired to several exit paths at once.
+func (h *StopHandlers) RunStopHandlers() {
+	h.mu.Lock()
+	handlers := h.handlers
+	h.handlers = nil
+	h.stopped = true
+	h.mu.Unlock()
+
+	for i := len(handlers) - 1; i >= 0; i-- {
+		runStopHandler(handlers[i])
+	}
+}
+
+// runStopHandler keeps one panicking handler from skipping the ones still
+// pending; on the shutdown path there is no second chance to run them.
+func runStopHandler(fn func()) {
+	defer func() {
+		if r := recover(); r != nil {
+			log.Errorf("stop handler panicked: %v\n%s", r, debug.Stack())
+		}
+	}()
+	fn()
+}
diff --git a/shared/lifecycle/stop_handlers_test.go b/shared/lifecycle/stop_handlers_test.go
new file mode 100644
index 000000000..787f39e6d
--- /dev/null
+++ b/shared/lifecycle/stop_handlers_test.go
@@ -0,0 +1,43 @@
+package lifecycle
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStopHandlers_RunOnceInReverseOrder(t *testing.T) {
+	var h StopHandlers
+	var order []string
+	h.OnStop(func() { order = append(order, "first") })
+	h.OnStop(func() { order = append(order, "second") })
+
+	h.RunStopHandlers()
+	h.RunStopHandlers()
+
+	assert.Equal(t, []string{"second", "first"}, order, "handlers must run once, last registered first")
+}
+
+func TestStopHandlers_PanicDoesNotSkipRemainingHandlers(t *testing.T) {
+	var h StopHandlers
+	var order []string
+	h.OnStop(func() { order = append(order, "first") })
+	h.OnStop(func() { panic("boom") })
+	h.OnStop(func() { order = append(order, "third") })
+
+	h.RunStopHandlers()
+
+	assert.Equal(t, []string{"third", "first"}, order, "handlers around a panicking one must still run")
+}
+
+func TestStopHandlers_LateRegistrationRunsImmediately(t *testing.T) {
+	var h StopHandlers
+	h.RunStopHandlers()
+
+	runs := 0
+	h.OnStop(func() { runs++ })
+	assert.Equal(t, 1, runs, "a handler registered after the stop must run right away")
+
+	h.RunStopHandlers()
+	assert.Equal(t, 1, runs, "later runs must stay no-ops and must not repeat the handler")
+}
diff --git a/shared/llm/model.go b/shared/llm/model.go
new file mode 100644
index 000000000..881097bda
--- /dev/null
+++ b/shared/llm/model.go
@@ -0,0 +1,153 @@
+// Package llm holds LLM model-identifier helpers shared by the proxy and
+// the management server. The proxy normalizes model ids parsed off inbound
+// requests; management normalizes the operator's registered model ids at
+// synthesis time so both sides of the pricing / routing contract compare
+// equal.
+package llm
+
+import (
+	"regexp"
+	"strings"
+)
+
+// bedrockVendorNamespaces are the vendor segments a Bedrock model id is
+// published under. They identify the geography in front of a cross-region
+// inference profile without knowing the geography: in
+// "eu.anthropic.claude-...", what makes "eu" a geography is that "anthropic"
+// follows it.
+//
+// A vendor missing from here is not fatal — bedrockGeographies covers the
+// same id from the other side — but it is one of the two ways an id can go
+// unrecognised, and the list needs a new entry whenever AWS onboards a
+// vendor. A live listing found "global.xai.grok-4.6" days after this was
+// first written.
+var bedrockVendorNamespaces = map[string]struct{}{
+	"ai21":       {},
+	"amazon":     {},
+	"anthropic":  {},
+	"cohere":     {},
+	"deepseek":   {},
+	"luma":       {},
+	"meta":       {},
+	"mistral":    {},
+	"openai":     {},
+	"qwen":       {},
+	"stability":  {},
+	"twelvelabs": {},
+	"writer":     {},
+	"xai":        {},
+}
+
+// bedrockGeographies are the geography segments AWS issues cross-region
+// inference profiles under. They recognise a profile whose vendor we have
+// never seen, which is the case bedrockVendorNamespaces alone gets wrong:
+// "global.xai.grok-4.6" is a geography and a model whether or not "xai" is
+// a name we know.
+//
+// Neither list is sufficient alone. A geography list on its own is what this
+// file started with, and it aged badly — it held us, eu, apac and global, so
+// every profile issued under jp, au, ca, sa or us-gov carried its prefix into
+// the pricing key, matched no catalog entry, and reported the model unpriced.
+// A vendor list on its own misses a new vendor under a known geography.
+// Together, an id has to be new on both axes at once to go unrecognised.
+var bedrockGeographies = map[string]struct{}{
+	"apac":   {},
+	"au":     {},
+	"ca":     {},
+	"eu":     {},
+	"global": {},
+	"jp":     {},
+	"sa":     {},
+	"us":     {},
+	"us-gov": {},
+}
+
+// stripBedrockGeography removes the cross-region inference-profile geography
+// from a Bedrock model id, leaving the "<vendor>.<model>" form the catalog and
+// the pricing table key on.
+//
+// A leading segment counts as a geography when it is one we know, or when a
+// known vendor follows it. Either alone is enough: the id has to be new on
+// both axes before its geography survives.
+//
+// The segment has to be followed by two more, so "amazon.nova-pro" stays a
+// vendor and a model rather than becoming a geography and a model — cutting
+// its first segment would strip the vendor away. Over-stripping is the
+// dangerous direction, because the result also decides which route may claim
+// a model.
+func stripBedrockGeography(modelID string) string {
+	geo, rest, found := strings.Cut(modelID, ".")
+	if !found || geo == "" {
+		return modelID
+	}
+	vendor, _, found := strings.Cut(rest, ".")
+	if !found {
+		return modelID
+	}
+	if _, ok := bedrockGeographies[geo]; ok {
+		return rest
+	}
+	if _, ok := bedrockVendorNamespaces[vendor]; ok {
+		return rest
+	}
+	return modelID
+}
+
+// bedrockVersionSuffix matches the trailing "-vN[:N]" or "-YYYYMMDD-vN[:N]"
+// version/throughput suffix of a Bedrock model id.
+var bedrockVersionSuffix = regexp.MustCompile(`-(\d{8}-)?v\d+(:\d+)?$`)
+
+// NormalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
+// prefix, and the version/throughput suffix from a Bedrock model id so it
+// matches the catalog/pricing key, e.g.
+// "eu.anthropic.claude-sonnet-4-5-20250929-v1:0" -> "anthropic.claude-sonnet-4-5"
+// and the inference-profile ARN's last segment likewise. It is the single
+// source of truth shared by the proxy's request parser (which normalizes the
+// request model from the URL path), the proxy's router (which normalizes the
+// operator's registered Bedrock model ids so both sides compare equal), and
+// the management synthesizer (which keys per-provider pricing entries by the
+// normalized id the parser will emit at billing time).
+func NormalizeBedrockModel(modelID string) string {
+	m := modelID
+	// A full ARN (inference-profile / provisioned-throughput / foundation-model)
+	// carries the model id in its last path segment.
+	if strings.HasPrefix(m, "arn:") {
+		if i := strings.LastIndex(m, "/"); i >= 0 {
+			m = m[i+1:]
+		}
+	}
+	m = stripBedrockGeography(m)
+	return bedrockVersionSuffix.ReplaceAllString(m, "")
+}
+
+// anthropicDatedModel matches a Claude model id carrying the trailing
+// "-YYYYMMDD" release-date suffix Anthropic appends to a pinned release,
+// capturing the id without it. The "claude" anchor is load-bearing: pricing
+// looks every model up through this helper regardless of surface, and an
+// operator may register a custom id with any shape at all, so an unanchored
+// "-\d{8}$" would let "internal-llm-20250101" silently inherit the rate
+// registered for "internal-llm". The anchor also covers the vendor-prefixed
+// forms ("anthropic.claude-...", "us.anthropic.claude-...").
+var anthropicDatedModel = regexp.MustCompile(`(?i)^(.*claude.*)-\d{8}$`)
+
+// NormalizeAnthropicModel strips the trailing release-date suffix from a
+// Claude model id, e.g. "claude-sonnet-4-5-20250929" -> "claude-sonnet-4-5",
+// so a dated id a client pins matches the undated one the operator
+// registered. Ids that are not Claude-family are returned untouched.
+// Callers try the verbatim id first and fall back to this, so two dated
+// releases of the same family stay distinct wherever both are registered
+// explicitly.
+func NormalizeAnthropicModel(modelID string) string {
+	return anthropicDatedModel.ReplaceAllString(modelID, "$1")
+}
+
+// NormalizeVertexModel strips the "@version" suffix from a Vertex AI model id
+// (e.g. "claude-sonnet-4-5@20250929" -> "claude-sonnet-4-5") so it matches
+// the catalog/pricing key. Vertex publisher models are priced under their
+// vendor surface with the bare, unversioned id.
+func NormalizeVertexModel(modelID string) string {
+	if at := strings.Index(modelID, "@"); at >= 0 {
+		return modelID[:at]
+	}
+	return modelID
+}
diff --git a/shared/llm/model_test.go b/shared/llm/model_test.go
new file mode 100644
index 000000000..077a650fb
--- /dev/null
+++ b/shared/llm/model_test.go
@@ -0,0 +1,120 @@
+package llm
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeBedrockModel(t *testing.T) {
+	cases := map[string]string{
+		"eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
+		"us.anthropic.claude-haiku-4-5":                "anthropic.claude-haiku-4-5",
+		"us.anthropic.claude-opus-4-8-20250101-v1:0":   "anthropic.claude-opus-4-8",
+		"apac.anthropic.claude-haiku-4-5-v1:0":         "anthropic.claude-haiku-4-5",
+		"amazon.nova-2-lite-v1:0":                      "amazon.nova-2-lite",
+		"anthropic.claude-sonnet-4-5-20250929-v1:0":    "anthropic.claude-sonnet-4-5",
+		"meta.llama3-3-70b-instruct-v1:0":              "meta.llama3-3-70b-instruct",
+		"amazon.nova-pro-v1:0":                         "amazon.nova-pro",
+		// Inference-profile ARN — model id lives in the last path segment.
+		"arn:aws:bedrock:eu-central-1:123456789012:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
+	}
+	for in, want := range cases {
+		require.Equal(t, want, NormalizeBedrockModel(in), "normalize %q", in)
+	}
+}
+
+func TestNormalizeVertexModel(t *testing.T) {
+	cases := map[string]string{
+		"claude-sonnet-4-5@20250929": "claude-sonnet-4-5",
+		"claude-haiku-4-5":           "claude-haiku-4-5",
+		"gpt-4o@2024-08-06":          "gpt-4o",
+	}
+	for in, want := range cases {
+		require.Equal(t, want, NormalizeVertexModel(in), "normalize %q", in)
+	}
+}
+
+func TestNormalizeAnthropicModel(t *testing.T) {
+	cases := map[string]string{
+		"claude-sonnet-4-5-20250929":            "claude-sonnet-4-5",
+		"claude-3-5-haiku-20241022":             "claude-3-5-haiku",
+		"claude-sonnet-5":                       "claude-sonnet-5",
+		"claude-opus-4-8":                       "claude-opus-4-8",
+		"anthropic.claude-haiku-4-5":            "anthropic.claude-haiku-4-5",
+		"anthropic.claude-sonnet-4-5-20250929":  "anthropic.claude-sonnet-4-5",
+		"us.anthropic.claude-opus-4-8-20250101": "us.anthropic.claude-opus-4-8",
+		// Non-Claude ids must survive untouched even when they end in eight
+		// consecutive digits: an operator can register a custom model under
+		// any id, and pricing looks every one of them up through this helper.
+		"gpt-4o":                  "gpt-4o",
+		"gpt-4o-2024-08-06":       "gpt-4o-2024-08-06",
+		"gpt-4o-20240806":         "gpt-4o-20240806",
+		"internal-llm-20250101":   "internal-llm-20250101",
+		"deepseek-r1-20250120":    "deepseek-r1-20250120",
+		"Qwen/Qwen2.5-20250101":   "Qwen/Qwen2.5-20250101",
+		"gemini-2-5-pro-20250101": "gemini-2-5-pro-20250101",
+		"":                        "",
+	}
+	for in, want := range cases {
+		require.Equal(t, want, NormalizeAnthropicModel(in), "normalize %q", in)
+	}
+}
+
+// TestNormalizeBedrockModel_GeographiesBeyondTheOriginalFour covers the bug
+// that made this vendor-anchored: the geography used to be matched against a
+// list of four, so a profile issued anywhere else kept its prefix, missed the
+// catalog key it was supposed to match, and reported the model unpriced.
+func TestNormalizeBedrockModel_GeographiesBeyondTheOriginalFour(t *testing.T) {
+	for _, geo := range []string{"us", "eu", "apac", "global", "jp", "au", "ca", "sa", "us-gov", "il", "mx"} {
+		t.Run(geo, func(t *testing.T) {
+			got := NormalizeBedrockModel(geo + ".anthropic.claude-sonnet-5-20260514-v1:0")
+			require.Equal(t, "anthropic.claude-sonnet-5", got,
+				"a cross-region profile must reduce to the catalog key whatever geography issued it")
+		})
+	}
+}
+
+// TestNormalizeBedrockModel_KeepsAVendorItCannotMistakeForAGeography pins the
+// direction that must never break: a plain "<vendor>.<model>" id has no
+// geography, and cutting its first segment would strip the vendor away and
+// hand the id to whichever route claims the bare model name.
+func TestNormalizeBedrockModel_KeepsAVendorItCannotMistakeForAGeography(t *testing.T) {
+	cases := map[string]string{
+		"amazon.nova-pro-v1:0":            "amazon.nova-pro",
+		"anthropic.claude-sonnet-5-v1:0":  "anthropic.claude-sonnet-5",
+		"meta.llama3-3-70b-instruct-v1:0": "meta.llama3-3-70b-instruct",
+		"cohere.command-r-plus-v1:0":      "cohere.command-r-plus",
+		// Unknown on both axes: neither the leading segment nor the one
+		// after it is a name we hold, so the id is left exactly as it came.
+		"xx.unknownvendor.some-model-v1:0": "xx.unknownvendor.some-model",
+		"Qwen/Qwen2.5-0.5B-Instruct":       "Qwen/Qwen2.5-0.5B-Instruct",
+	}
+	for in, want := range cases {
+		t.Run(in, func(t *testing.T) {
+			require.Equal(t, want, NormalizeBedrockModel(in))
+		})
+	}
+}
+
+// TestNormalizeBedrockModel_RecognisesAnIdNewOnOneAxis covers what a live
+// eu-central-1 listing returned days after the vendor list was written:
+// "global.xai.grok-4.6", a vendor the list did not hold. Anchoring only on the
+// vendor left the geography in the key, so the id matched no catalog entry and
+// the model metered at zero. Each id below is unfamiliar on one axis and
+// recognised through the other.
+func TestNormalizeBedrockModel_RecognisesAnIdNewOnOneAxis(t *testing.T) {
+	cases := map[string]string{
+		// Known geography, vendor we had never seen (the live case).
+		"global.xai.grok-4.6": "xai.grok-4.6",
+		"eu.xai.grok-4.6":     "xai.grok-4.6",
+		// Known vendor, geography outside the list.
+		"il.anthropic.claude-sonnet-5-20260514-v1:0": "anthropic.claude-sonnet-5",
+		"mx.amazon.nova-2-lite-v1:0":                 "amazon.nova-2-lite",
+	}
+	for in, want := range cases {
+		t.Run(in, func(t *testing.T) {
+			require.Equal(t, want, NormalizeBedrockModel(in))
+		})
+	}
+}
diff --git a/shared/management/certposture/certposture_test.go b/shared/management/certposture/certposture_test.go
new file mode 100644
index 000000000..e8f3d20c1
--- /dev/null
+++ b/shared/management/certposture/certposture_test.go
@@ -0,0 +1,227 @@
+package certposture
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+var (
+	secret   = []byte("test-secret")
+	peerKey  = []byte("peer-public-key-aaaaaaaaaaaaaaaa")
+	otherKey = []byte("peer-public-key-bbbbbbbbbbbbbbbb")
+	now      = time.Now().Truncate(Window)
+)
+
+func TestChallenger_NonceIsStableWithinWindowAndPerPeer(t *testing.T) {
+	c := NewChallenger(secret)
+
+	assert.Equal(t, c.Nonce(peerKey, now), c.Nonce(peerKey, now.Add(time.Minute)))
+	assert.NotEqual(t, c.Nonce(peerKey, now), c.Nonce(peerKey, now.Add(Window)))
+	assert.NotEqual(t, c.Nonce(peerKey, now), c.Nonce(otherKey, now))
+	assert.NotEqual(t, c.Nonce(peerKey, now), NewChallenger([]byte("other")).Nonce(peerKey, now))
+}
+
+func TestChallenger_VerifyNonce(t *testing.T) {
+	c := NewChallenger(secret)
+	nonce := c.Nonce(peerKey, now)
+
+	tests := []struct {
+		name    string
+		nonce   []byte
+		peerKey []byte
+		at      time.Time
+		wantErr error
+	}{
+		{"current window", nonce, peerKey, now, nil},
+		{"previous window still accepted", nonce, peerKey, now.Add(Window), nil},
+		{"two windows later expired", nonce, peerKey, now.Add(2 * Window), ErrNonceExpired},
+		// An instance whose clock runs a little ahead issues the next window's nonce early.
+		{"issued one window ahead accepted", c.Nonce(peerKey, now.Add(Window)), peerKey, now, nil},
+		{"issued two windows ahead rejected", c.Nonce(peerKey, now.Add(2*Window)), peerKey, now, ErrNonceExpired},
+		{"other peer", nonce, otherKey, now, ErrNonceMismatch},
+		{"tampered mac", tamper(nonce, len(nonce)-1), peerKey, now, ErrNonceMismatch},
+		{"malformed", nonce[:10], peerKey, now, ErrNonceMalformed},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := c.verifyNonce(tt.nonce, tt.peerKey, tt.at)
+			assert.ErrorIs(t, err, tt.wantErr)
+		})
+	}
+}
+
+// TestNonceAcceptedAlongside must agree with verifyNonce: a proof for a nonce is still
+// accepted while the next window's nonce is issued, and no longer two windows on.
+func TestNonceAcceptedAlongside(t *testing.T) {
+	c := NewChallenger(secret)
+	issued := c.Nonce(peerKey, now)
+
+	assert.True(t, NonceAcceptedAlongside(issued, issued), "the current nonce is accepted")
+	assert.True(t, NonceAcceptedAlongside(issued, c.Nonce(peerKey, now.Add(Window))), "a proof from the previous window is accepted")
+	assert.False(t, NonceAcceptedAlongside(issued, c.Nonce(peerKey, now.Add(2*Window))), "a proof two windows old is not")
+	assert.True(t, NonceAcceptedAlongside(c.Nonce(peerKey, now.Add(Window)), issued), "a nonce from an instance one window ahead is accepted")
+	assert.False(t, NonceAcceptedAlongside(c.Nonce(peerKey, now.Add(2*Window)), issued), "a nonce two windows ahead is not")
+	assert.False(t, NonceAcceptedAlongside([]byte("short"), issued), "a malformed nonce is not")
+
+	for _, tt := range []struct {
+		later time.Duration
+		want  bool
+	}{{0, true}, {Window, true}, {2 * Window, false}} {
+		err := c.verifyNonce(issued, peerKey, now.Add(tt.later))
+		assert.Equal(t, tt.want, err == nil, "verifyNonce agrees %s later", tt.later)
+	}
+}
+
+func TestSignVerify_RoundTripPerKeyType(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	keys := map[string]crypto.Signer{
+		SigAlgECDSASHA256:  certtest.ECDSAKey(t),
+		SigAlgECDSASHA384:  p384Key(t),
+		SigAlgRSAPSSSHA256: certtest.RSAKey(t),
+		SigAlgEd25519:      certtest.Ed25519Key(t),
+	}
+	for wantAlg, key := range keys {
+		t.Run(wantAlg, func(t *testing.T) {
+			c := NewChallenger(secret)
+			proof := signedProof(t, c, ca, key)
+			assert.Equal(t, wantAlg, proof.SigAlg)
+
+			chain, err := c.Verify(proof, peerKey, now)
+			require.NoError(t, err)
+			require.Len(t, chain, 1)
+			assert.NoError(t, VerifyChain(chain, mustPool(t, ca.PEM), now))
+		})
+	}
+}
+
+func p384Key(t *testing.T) crypto.Signer {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+	require.NoError(t, err)
+	return key
+}
+
+// TestSign_RefusesCurvesTheProofDoesNotName: a proof names its algorithm from the key, and
+// the verifier only knows P-256 and P-384, so P-521 is refused before anything is signed.
+func TestSign_RefusesCurvesTheProofDoesNotName(t *testing.T) {
+	key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	require.NoError(t, err)
+
+	_, _, err = Sign(key, NewChallenger(secret).Nonce(peerKey, now), peerKey)
+
+	assert.ErrorIs(t, err, ErrUnsupportedKey)
+}
+
+func TestVerify_Rejections(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	c := NewChallenger(secret)
+	good := signedProof(t, c, ca, certtest.ECDSAKey(t))
+
+	tests := []struct {
+		name    string
+		mutate  func(p Proof) Proof
+		peerKey []byte
+		wantErr error
+	}{
+		{"replayed for other peer", identity, otherKey, ErrNonceMismatch},
+		{"signature tampered", func(p Proof) Proof { p.Signature = tamper(p.Signature, 5); return p }, peerKey, ErrSignatureInvalid},
+		{"nonce swapped after signing", func(p Proof) Proof { p.Nonce = c.Nonce(peerKey, now.Add(-Window)); return p }, peerKey, ErrSignatureInvalid},
+		{"foreign leaf presented", func(p Proof) Proof {
+			p.Chain = [][]byte{ca.Issue(t, certtest.ECDSAKey(t), "other").Raw}
+			return p
+		}, peerKey, ErrSignatureInvalid},
+		{"alg mismatch", func(p Proof) Proof { p.SigAlg = SigAlgEd25519; return p }, peerKey, ErrSigAlgMismatch},
+		{"empty chain", func(p Proof) Proof { p.Chain = nil; return p }, peerKey, ErrEmptyChain},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := c.Verify(tt.mutate(good), tt.peerKey, now)
+			assert.ErrorIs(t, err, tt.wantErr)
+		})
+	}
+}
+
+func TestVerify_SecretMismatchAcrossChallengers(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	proof := signedProof(t, NewChallenger(secret), ca, certtest.ECDSAKey(t))
+
+	_, err := NewChallenger([]byte("other-instance-secret")).Verify(proof, peerKey, now)
+	assert.ErrorIs(t, err, ErrNonceMismatch)
+}
+
+func TestChainMatchesCAs(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	otherCA := certtest.NewCA(t, "other-root")
+	leaf := ca.Issue(t, certtest.ECDSAKey(t), "device")
+	chainPEM := EncodeChainPEM([]*x509.Certificate{leaf})
+
+	assert.True(t, ChainMatchesCAs(chainPEM, []string{ca.PEM}, now))
+	assert.True(t, ChainMatchesCAs(chainPEM, []string{otherCA.PEM, ca.PEM}, now))
+	assert.False(t, ChainMatchesCAs(chainPEM, []string{otherCA.PEM}, now))
+	assert.False(t, ChainMatchesCAs(chainPEM, []string{ca.PEM}, now.Add(30*24*time.Hour)))
+	assert.False(t, ChainMatchesCAs(chainPEM, []string{"not a pem"}, now))
+	assert.False(t, ChainMatchesCAs("not a pem", []string{ca.PEM}, now))
+}
+
+func TestChainPEM_RoundTrip(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	leaf := ca.Issue(t, certtest.ECDSAKey(t), "device")
+
+	chain, err := ParseChainPEM(EncodeChainPEM([]*x509.Certificate{leaf, ca.Cert}))
+	require.NoError(t, err)
+	require.Len(t, chain, 2)
+	assert.Equal(t, leaf.Raw, chain[0].Raw)
+	assert.Equal(t, ca.Cert.Raw, chain[1].Raw)
+}
+
+func TestVerify_AcceptsMaximumPSSSalt(t *testing.T) {
+	// A TPM chooses the PSS salt itself and older firmware uses the largest salt that
+	// fits, so a proof from such a key carries more salt than Sign asks a software key for.
+	ca := certtest.NewCA(t, "root")
+	key := certtest.RSAKey(t).(*rsa.PrivateKey)
+	leaf := ca.Issue(t, key, "device")
+	c := NewChallenger(secret)
+	nonce := c.Nonce(peerKey, now)
+	digest := sha256.Sum256(proofMessage(nonce, peerKey))
+	sig, err := rsa.SignPSS(rand.Reader, key, crypto.SHA256, digest[:], &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthAuto})
+	require.NoError(t, err)
+
+	_, err = c.Verify(Proof{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: SigAlgRSAPSSSHA256, Signature: sig}, peerKey, now)
+	assert.NoError(t, err, "a valid PSS signature must verify regardless of salt length")
+}
+
+func signedProof(t *testing.T, c *Challenger, ca *certtest.CA, key crypto.Signer) Proof {
+	t.Helper()
+	leaf := ca.Issue(t, key, "device")
+	nonce := c.Nonce(peerKey, now)
+	sigAlg, sig, err := Sign(key, nonce, peerKey)
+	require.NoError(t, err)
+	return Proof{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: sigAlg, Signature: sig}
+}
+
+func mustPool(t *testing.T, pems ...string) *x509.CertPool {
+	t.Helper()
+	pool, err := ParseCAs(pems)
+	require.NoError(t, err)
+	return pool
+}
+
+func identity(p Proof) Proof { return p }
+
+func tamper(b []byte, i int) []byte {
+	out := append([]byte(nil), b...)
+	out[i] ^= 0xff
+	return out
+}
diff --git a/shared/management/certposture/certtest/certtest.go b/shared/management/certposture/certtest/certtest.go
new file mode 100644
index 000000000..8b810a193
--- /dev/null
+++ b/shared/management/certposture/certtest/certtest.go
@@ -0,0 +1,109 @@
+// Package certtest builds throwaway CAs and leaf certificates for certificate posture tests.
+package certtest
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+type CA struct {
+	Cert *x509.Certificate
+	Key  crypto.Signer
+	PEM  string
+}
+
+func NewCA(t *testing.T, name string) *CA {
+	t.Helper()
+	return newCA(t, name, nil)
+}
+
+// NewIntermediate creates a CA signed by parent.
+func NewIntermediate(t *testing.T, parent *CA, name string) *CA {
+	t.Helper()
+	return newCA(t, name, parent)
+}
+
+func newCA(t *testing.T, name string, parent *CA) *CA {
+	t.Helper()
+	key := ECDSAKey(t)
+	tmpl := &x509.Certificate{
+		SerialNumber:          big.NewInt(time.Now().UnixNano()),
+		Subject:               pkix.Name{CommonName: name},
+		NotBefore:             time.Now().Add(-24 * time.Hour),
+		NotAfter:              time.Now().Add(48 * time.Hour),
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
+	}
+	issuer, issuerKey := tmpl, key
+	if parent != nil {
+		issuer, issuerKey = parent.Cert, parent.Key
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, issuer, key.Public(), issuerKey)
+	require.NoError(t, err)
+	cert, err := x509.ParseCertificate(der)
+	require.NoError(t, err)
+	return &CA{Cert: cert, Key: key, PEM: CertPEM(cert)}
+}
+
+// Issue signs a leaf certificate for key with the CA.
+func (ca *CA) Issue(t *testing.T, key crypto.Signer, cn string) *x509.Certificate {
+	t.Helper()
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(time.Now().UnixNano()),
+		Subject:      pkix.Name{CommonName: cn},
+		NotBefore:    time.Now().Add(-24 * time.Hour),
+		NotAfter:     time.Now().Add(48 * time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, ca.Cert, key.Public(), ca.Key)
+	require.NoError(t, err)
+	cert, err := x509.ParseCertificate(der)
+	require.NoError(t, err)
+	return cert
+}
+
+func ECDSAKey(t *testing.T) crypto.Signer {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	return key
+}
+
+func RSAKey(t *testing.T) crypto.Signer {
+	t.Helper()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	return key
+}
+
+func Ed25519Key(t *testing.T) crypto.Signer {
+	t.Helper()
+	_, key, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	return key
+}
+
+func CertPEM(cert *x509.Certificate) string {
+	return string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw}))
+}
+
+func KeyPEM(t *testing.T, key crypto.Signer) string {
+	t.Helper()
+	der, err := x509.MarshalPKCS8PrivateKey(key)
+	require.NoError(t, err)
+	return string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: der}))
+}
diff --git a/shared/management/certposture/chain.go b/shared/management/certposture/chain.go
new file mode 100644
index 000000000..80fb46b4b
--- /dev/null
+++ b/shared/management/certposture/chain.go
@@ -0,0 +1,121 @@
+package certposture
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+var ErrNoCertificateInPEM = errors.New("no certificate found in PEM data")
+
+// ParseCAs builds a root pool from PEM encoded CA certificates.
+func ParseCAs(pems []string) (*x509.CertPool, error) {
+	roots := x509.NewCertPool()
+	for _, p := range pems {
+		if !roots.AppendCertsFromPEM([]byte(p)) {
+			return nil, ErrNoCertificateInPEM
+		}
+	}
+	return roots, nil
+}
+
+// VerifyChain reports whether the leaf (chain[0]) chains to one of roots using the
+// remaining certificates as intermediates.
+func VerifyChain(chain []*x509.Certificate, roots *x509.CertPool, now time.Time) error {
+	if len(chain) == 0 {
+		return ErrEmptyChain
+	}
+	_, err := VerifiedChain(chain[0], chain[1:], roots, now)
+	return err
+}
+
+// VerifiedChain finds a path from leaf to one of roots through any of intermediates,
+// trying every candidate issuer rather than the first that matches, and returns it
+// without the root, leaf first. It applies the same rules as VerifyChain.
+func VerifiedChain(leaf *x509.Certificate, intermediates []*x509.Certificate, roots *x509.CertPool, now time.Time) ([]*x509.Certificate, error) {
+	pool := x509.NewCertPool()
+	for _, cert := range intermediates {
+		pool.AddCert(cert)
+	}
+	chains, err := leaf.Verify(x509.VerifyOptions{
+		Roots:         roots,
+		Intermediates: pool,
+		CurrentTime:   now,
+		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
+	})
+	if err != nil {
+		return nil, err
+	}
+	chain := chains[0]
+	if len(chain) > 1 {
+		chain = chain[:len(chain)-1]
+	}
+	return chain, nil
+}
+
+// ChainMatchesCAs is VerifyChain over the PEM forms stored in peer meta and check config.
+func ChainMatchesCAs(chainPEM string, caPEMs []string, now time.Time) bool {
+	roots, err := ParseCAs(caPEMs)
+	if err != nil {
+		return false
+	}
+	return chainMatchesPool(chainPEM, roots, now)
+}
+
+// AnyChainMatchesCAs reports whether at least one of the peer's verified chains
+// is anchored in one of the configured CAs.
+func AnyChainMatchesCAs(chainPEMs, caPEMs []string, now time.Time) bool {
+	roots, err := ParseCAs(caPEMs)
+	if err != nil {
+		return false
+	}
+	for _, chainPEM := range chainPEMs {
+		if chainMatchesPool(chainPEM, roots, now) {
+			return true
+		}
+	}
+	return false
+}
+
+func chainMatchesPool(chainPEM string, roots *x509.CertPool, now time.Time) bool {
+	chain, err := ParseChainPEM(chainPEM)
+	if err != nil {
+		return false
+	}
+	return VerifyChain(chain, roots, now) == nil
+}
+
+func EncodeChainPEM(chain []*x509.Certificate) string {
+	var b strings.Builder
+	for _, cert := range chain {
+		_ = pem.Encode(&b, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})
+	}
+	return b.String()
+}
+
+func ParseChainPEM(chainPEM string) ([]*x509.Certificate, error) {
+	var chain []*x509.Certificate
+	rest := []byte(chainPEM)
+	for {
+		var block *pem.Block
+		block, rest = pem.Decode(rest)
+		if block == nil {
+			break
+		}
+		if block.Type != "CERTIFICATE" {
+			continue
+		}
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("parse certificate: %w", err)
+		}
+		chain = append(chain, cert)
+	}
+	if len(chain) == 0 {
+		return nil, ErrNoCertificateInPEM
+	}
+	return chain, nil
+}
diff --git a/shared/management/certposture/challenge.go b/shared/management/certposture/challenge.go
new file mode 100644
index 000000000..62da17349
--- /dev/null
+++ b/shared/management/certposture/challenge.go
@@ -0,0 +1,139 @@
+package certposture
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/binary"
+	"errors"
+	"os"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// Window is the default challenge window. A nonce stays valid through the window
+	// after the one it was issued in, so a peer re-proves possession of its key between
+	// once and twice per window. One window early is accepted too, for clock skew.
+	Window = 12 * time.Hour
+
+	// EnvWindow overrides Window, for end-to-end tests that cannot wait half a day to
+	// watch a renewal. Every management instance has to be given the same value: the
+	// window is part of the nonce, so instances that disagree reject each other's.
+	EnvWindow = "NB_CERT_CHALLENGE_WINDOW"
+
+	// minWindow keeps the renewal period, a third of the window, well above the
+	// refresher's one-second tick.
+	minWindow = 30 * time.Second
+	maxWindow = 24 * time.Hour
+
+	challengeDomain = "netbird-cert-challenge-v1"
+	windowLen       = 8
+	nonceLen        = windowLen + sha256.Size
+
+	// NonceSize is the length of every nonce a Challenger issues.
+	NonceSize = nonceLen
+)
+
+var effectiveWindow = sync.OnceValue(resolveWindow)
+
+// EffectiveWindow returns the challenge window in force, which is Window unless
+// EnvWindow overrides it. Everything timed against the window derives from this, so a
+// test that shortens it shortens the renewal that goes with it.
+func EffectiveWindow() time.Duration {
+	return effectiveWindow()
+}
+
+func resolveWindow() time.Duration {
+	val := os.Getenv(EnvWindow)
+	if val == "" {
+		return Window
+	}
+
+	window, err := time.ParseDuration(val)
+	if err != nil {
+		log.Warnf("failed to parse %s, keeping the %s certificate challenge window: %v", EnvWindow, Window, err)
+		return Window
+	}
+	if window < minWindow || window > maxWindow {
+		log.Warnf("%s of %s is outside %s..%s, keeping the %s certificate challenge window", EnvWindow, window, minWindow, maxWindow, Window)
+		return Window
+	}
+	if window%time.Second != 0 {
+		log.Warnf("%s of %s is not a whole number of seconds, keeping the %s certificate challenge window", EnvWindow, window, Window)
+		return Window
+	}
+
+	// Loud on purpose: this sets how long a device can pass the certificate check after
+	// its key has gone, and it has to match on every instance.
+	log.Warnf("certificate challenge window overridden to %s by %s", window, EnvWindow)
+	return window
+}
+
+var (
+	ErrNonceMalformed = errors.New("certificate challenge nonce is malformed")
+	ErrNonceExpired   = errors.New("certificate challenge nonce is expired")
+	ErrNonceMismatch  = errors.New("certificate challenge nonce was not issued to this peer")
+)
+
+// Challenger issues and verifies stateless per-peer nonces. A nonce is bound to the
+// peer and to a time window, so any instance sharing the secret can verify it.
+type Challenger struct {
+	secret []byte
+	window time.Duration
+}
+
+func NewChallenger(secret []byte) *Challenger {
+	return &Challenger{secret: secret, window: EffectiveWindow()}
+}
+
+func (c *Challenger) Nonce(peerKey []byte, now time.Time) []byte {
+	return c.nonceForWindow(peerKey, c.windowOf(now))
+}
+
+func (c *Challenger) verifyNonce(nonce, peerKey []byte, now time.Time) error {
+	if len(nonce) != nonceLen {
+		return ErrNonceMalformed
+	}
+	window := binary.BigEndian.Uint64(nonce[:windowLen])
+	if !windowAccepted(window, c.windowOf(now)) {
+		return ErrNonceExpired
+	}
+	if !hmac.Equal(nonce, c.nonceForWindow(peerKey, window)) {
+		return ErrNonceMismatch
+	}
+	return nil
+}
+
+func (c *Challenger) windowOf(now time.Time) uint64 {
+	return uint64(now.Unix() / int64(c.window.Seconds()))
+}
+
+func (c *Challenger) nonceForWindow(peerKey []byte, window uint64) []byte {
+	nonce := make([]byte, windowLen, nonceLen)
+	binary.BigEndian.PutUint64(nonce, window)
+
+	mac := hmac.New(sha256.New, c.secret)
+	mac.Write([]byte(challengeDomain))
+	mac.Write(peerKey)
+	mac.Write(nonce[:windowLen])
+	return mac.Sum(nonce)
+}
+
+// NonceAcceptedAlongside reports whether a proof answering nonce is still accepted while
+// management issues current to the same peer, by the same window rule verification uses.
+func NonceAcceptedAlongside(nonce, current []byte) bool {
+	if len(nonce) != nonceLen || len(current) != nonceLen {
+		return false
+	}
+	window := binary.BigEndian.Uint64(nonce[:windowLen])
+	return windowAccepted(window, binary.BigEndian.Uint64(current[:windowLen]))
+}
+
+// windowAccepted reports whether a nonce of window is accepted in window current: the
+// current window, the previous one so a nonce outlives a rollover, and the next one so an
+// instance whose clock runs slightly ahead is not rejected by the others.
+func windowAccepted(window, current uint64) bool {
+	return window == current || window+1 == current || window == current+1
+}
diff --git a/shared/management/certposture/challenge_test.go b/shared/management/certposture/challenge_test.go
new file mode 100644
index 000000000..1d1acddc4
--- /dev/null
+++ b/shared/management/certposture/challenge_test.go
@@ -0,0 +1,108 @@
+package certposture
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveWindow(t *testing.T) {
+	// An end-to-end run shortens the window so a renewal can be watched in seconds
+	// rather than half a day. Anything it cannot make sense of leaves the default in
+	// place, because a window nobody intended is a security property nobody chose.
+	tests := []struct {
+		name string
+		env  string
+		want time.Duration
+	}{
+		{name: "unset keeps the default", env: "", want: Window},
+		{name: "a test-sized window is taken", env: "30s", want: 30 * time.Second},
+		{name: "garbage keeps the default", env: "soon", want: Window},
+		{name: "below the floor keeps the default", env: "10ms", want: Window},
+		{name: "too short for the refresh tick keeps the default", env: "1s", want: Window},
+		{name: "a fractional second keeps the default", env: "30500ms", want: Window},
+		{name: "above the ceiling keeps the default", env: "100h", want: Window},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv(EnvWindow, tt.env)
+			if tt.env == "" {
+				require.NoError(t, os.Unsetenv(EnvWindow))
+			}
+			assert.Equal(t, tt.want, resolveWindow())
+		})
+	}
+}
+
+func TestChallenger_HonoursAShortenedWindow(t *testing.T) {
+	// The window is what a nonce is stamped with, so a shortened one has to make a
+	// nonce expire sooner, not just change a number in a log line.
+	short := 2 * time.Second
+	c := &Challenger{secret: []byte("secret"), window: short}
+	peerKey := []byte("peer-key")
+
+	issued := time.Unix(1_790_000_000, 0)
+	nonce := c.Nonce(peerKey, issued)
+
+	require.NoError(t, c.verifyNonce(nonce, peerKey, issued), "a nonce is valid when issued")
+	require.NoError(t, c.verifyNonce(nonce, peerKey, issued.Add(short)), "and through the window after it")
+	assert.ErrorIs(t, c.verifyNonce(nonce, peerKey, issued.Add(3*short)), ErrNonceExpired,
+		"a shortened window must actually expire the nonce sooner")
+}
+
+// heldNonceAlwaysAccepted walks ten windows and, at every step, checks the nonce the peer
+// would be holding if it were re-stamped every period starting at offset. It returns how
+// many of those checks would have rejected the peer.
+func heldNonceAlwaysAccepted(c *Challenger, peerKey []byte, period, offset time.Duration) int {
+	start := time.Unix(0, 0).UTC().Add(offset)
+	var rejected int
+	for elapsed := time.Duration(0); elapsed < 10*Window; elapsed += 7 * time.Minute {
+		periods := int64(elapsed / period)
+		lastRefresh := start.Add(time.Duration(periods) * period)
+		if c.verifyNonce(c.Nonce(peerKey, lastRefresh), peerKey, start.Add(elapsed)) != nil {
+			rejected++
+		}
+	}
+	return rejected
+}
+
+// TestNonce_StaysValidWhenRestampedWithinAWindow is the reason management keeps no per-peer
+// nonce state. A nonce carries the window it was minted in, not the instant, and is accepted
+// for that window and the next. A peer re-stamped at least once per window therefore can
+// never be holding one that has fallen outside the accepted pair, whoever it is and whenever
+// it was last served. There is nothing to track and nothing to search for: the guarantee
+// comes from the cadence alone.
+//
+// The offsets matter: each account is given a phase of its own so a restart does not fan out
+// to every account at once, so the property has to hold off the window boundary too.
+func TestNonce_StaysValidWhenRestampedWithinAWindow(t *testing.T) {
+	c := &Challenger{secret: []byte("secret"), window: Window}
+	peerKey := []byte("peer-key")
+
+	for _, period := range []time.Duration{Window / 3, Window / 2, Window} {
+		for _, offset := range []time.Duration{0, Window / 7, Window / 2, Window - time.Minute} {
+			t.Run(period.String()+"+"+offset.String(), func(t *testing.T) {
+				assert.Zero(t, heldNonceAlwaysAccepted(c, peerKey, period, offset),
+					"a peer re-stamped every %v is never left holding an expired nonce", period)
+			})
+		}
+	}
+}
+
+func TestNonce_ExpiresWhenRestampedTooSlowly(t *testing.T) {
+	// The counterpart, which is what gives the test above its teeth. Note the aligned case
+	// does not fail: a cadence of exactly two windows that lands on the boundaries is
+	// covered by the grace window. Off the boundary it is not, and real refreshes are off
+	// the boundary by design.
+	c := &Challenger{secret: []byte("secret"), window: Window}
+	peerKey := []byte("peer-key")
+
+	assert.Zero(t, heldNonceAlwaysAccepted(c, peerKey, 2*Window, 0),
+		"two windows exactly on the boundary happens to be covered by the grace window")
+	assert.NotZero(t, heldNonceAlwaysAccepted(c, peerKey, 2*Window, Window/2),
+		"the same cadence off the boundary must leave the peer rejected for a stretch")
+}
diff --git a/shared/management/certposture/proof.go b/shared/management/certposture/proof.go
new file mode 100644
index 000000000..2c2df2132
--- /dev/null
+++ b/shared/management/certposture/proof.go
@@ -0,0 +1,154 @@
+package certposture
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/sha512"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"time"
+)
+
+const (
+	SigAlgECDSASHA256  = "ecdsa-sha256"
+	SigAlgECDSASHA384  = "ecdsa-sha384"
+	SigAlgRSAPSSSHA256 = "rsa-pss-sha256"
+	SigAlgEd25519      = "ed25519"
+
+	proofDomain = "netbird-posture-cert-v1"
+	minRSABits  = 2048
+)
+
+var (
+	ErrUnsupportedKey   = errors.New("unsupported certificate key")
+	ErrEmptyChain       = errors.New("certificate chain is empty")
+	ErrSignatureInvalid = errors.New("certificate proof signature is invalid")
+	ErrSigAlgMismatch   = errors.New("signature algorithm does not match the certificate key")
+)
+
+// Proof is a client's demonstration that it holds the private key of the leaf
+// certificate in Chain, made by signing the challenge nonce bound to its peer key.
+type Proof struct {
+	Nonce     []byte
+	Chain     [][]byte
+	SigAlg    string
+	Signature []byte
+}
+
+// Sign produces the proof signature for a nonce using the leaf's private key. The key
+// never leaves the signer, which may be backed by a file, a TPM or an OS keystore.
+func Sign(signer crypto.Signer, nonce, peerKey []byte) (string, []byte, error) {
+	sigAlg, err := sigAlgFor(signer.Public())
+	if err != nil {
+		return "", nil, err
+	}
+
+	msg := proofMessage(nonce, peerKey)
+	var sig []byte
+	switch sigAlg {
+	case SigAlgECDSASHA256:
+		d := sha256.Sum256(msg)
+		sig, err = signer.Sign(rand.Reader, d[:], crypto.SHA256)
+	case SigAlgECDSASHA384:
+		d := sha512.Sum384(msg)
+		sig, err = signer.Sign(rand.Reader, d[:], crypto.SHA384)
+	case SigAlgRSAPSSSHA256:
+		d := sha256.Sum256(msg)
+		sig, err = signer.Sign(rand.Reader, d[:], &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: crypto.SHA256})
+	case SigAlgEd25519:
+		sig, err = signer.Sign(rand.Reader, msg, crypto.Hash(0))
+	}
+	if err != nil {
+		return "", nil, fmt.Errorf("sign certificate proof: %w", err)
+	}
+	return sigAlg, sig, nil
+}
+
+// Verify checks that the proof's nonce was issued by this challenger to peerKey and is
+// still fresh, and that the signature validates against the leaf's public key. It
+// returns the parsed chain on success. Chain trust is deliberately not evaluated here.
+func (c *Challenger) Verify(proof Proof, peerKey []byte, now time.Time) ([]*x509.Certificate, error) {
+	if err := c.verifyNonce(proof.Nonce, peerKey, now); err != nil {
+		return nil, err
+	}
+	chain, err := parseChain(proof.Chain)
+	if err != nil {
+		return nil, err
+	}
+	leaf := chain[0]
+	sigAlg, err := sigAlgFor(leaf.PublicKey)
+	if err != nil {
+		return nil, err
+	}
+	if sigAlg != proof.SigAlg {
+		return nil, ErrSigAlgMismatch
+	}
+	if !verifySignature(leaf.PublicKey, sigAlg, proofMessage(proof.Nonce, peerKey), proof.Signature) {
+		return nil, ErrSignatureInvalid
+	}
+	return chain, nil
+}
+
+func proofMessage(nonce, peerKey []byte) []byte {
+	msg := make([]byte, 0, len(proofDomain)+len(nonce)+len(peerKey))
+	msg = append(msg, proofDomain...)
+	msg = append(msg, nonce...)
+	return append(msg, peerKey...)
+}
+
+func sigAlgFor(pub crypto.PublicKey) (string, error) {
+	switch k := pub.(type) {
+	case *ecdsa.PublicKey:
+		switch k.Curve {
+		case elliptic.P256():
+			return SigAlgECDSASHA256, nil
+		case elliptic.P384():
+			return SigAlgECDSASHA384, nil
+		}
+	case *rsa.PublicKey:
+		if k.N.BitLen() >= minRSABits {
+			return SigAlgRSAPSSSHA256, nil
+		}
+	case ed25519.PublicKey:
+		return SigAlgEd25519, nil
+	}
+	return "", ErrUnsupportedKey
+}
+
+func verifySignature(pub crypto.PublicKey, sigAlg string, msg, sig []byte) bool {
+	switch sigAlg {
+	case SigAlgECDSASHA256:
+		d := sha256.Sum256(msg)
+		return ecdsa.VerifyASN1(pub.(*ecdsa.PublicKey), d[:], sig)
+	case SigAlgECDSASHA384:
+		d := sha512.Sum384(msg)
+		return ecdsa.VerifyASN1(pub.(*ecdsa.PublicKey), d[:], sig)
+	case SigAlgRSAPSSSHA256:
+		d := sha256.Sum256(msg)
+		return rsa.VerifyPSS(pub.(*rsa.PublicKey), crypto.SHA256, d[:], sig, &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthAuto}) == nil
+	case SigAlgEd25519:
+		return ed25519.Verify(pub.(ed25519.PublicKey), msg, sig)
+	}
+	return false
+}
+
+func parseChain(der [][]byte) ([]*x509.Certificate, error) {
+	if len(der) == 0 {
+		return nil, ErrEmptyChain
+	}
+	chain := make([]*x509.Certificate, 0, len(der))
+	for _, raw := range der {
+		cert, err := x509.ParseCertificate(raw)
+		if err != nil {
+			return nil, fmt.Errorf("parse certificate: %w", err)
+		}
+		chain = append(chain, cert)
+	}
+	return chain, nil
+}
diff --git a/shared/management/client/client.go b/shared/management/client/client.go
index 8205e3a4f..64a54f45a 100644
--- a/shared/management/client/client.go
+++ b/shared/management/client/client.go
@@ -12,7 +12,7 @@ import (
 // Client is the interface for the management service client.
 type Client interface {
 	io.Closer
-	Sync(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error
+	Sync(ctx context.Context, getInfo func(ctx context.Context) *system.Info, msgHandler func(msg *proto.SyncResponse) error) error
 	Job(ctx context.Context, msgHandler func(msg *proto.JobRequest) *proto.JobResponse) error
 	Register(setupKey string, jwtToken string, sysInfo *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
 	Login(sysInfo *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
@@ -21,8 +21,11 @@ type Client interface {
 	// is not eligible for session extension.
 	ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error)
-	GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error)
-	GetNetworkMap(sysInfo *system.Info) (*proto.NetworkMap, error)
+	// GetPKCEAuthorizationFlow returns the PKCE authorization flow information.
+	//
+	// sessionExtend marks the flow as renewing an existing peer's session rather
+	// than logging one in. See PKCEAuthorizationFlowRequest.
+	GetPKCEAuthorizationFlow(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error)
 	GetServerURL() string
 	// IsHealthy returns the current connection status without blocking.
 	// Used by the engine to monitor connectivity in the background.
diff --git a/shared/management/client/client_test.go b/shared/management/client/client_test.go
index b62317775..d8992d0f0 100644
--- a/shared/management/client/client_test.go
+++ b/shared/management/client/client_test.go
@@ -2,16 +2,18 @@ package client
 
 import (
 	"context"
+	"fmt"
 	"net"
 	"os"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -33,7 +35,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/mock_server"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -126,8 +127,8 @@ func startManagement(t *testing.T) (*grpc.Server, net.Listener) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManger), config)
-	accountManager, err := mgmt.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peersManger), config, nil)
+	accountManager, err := mgmt.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -305,7 +306,7 @@ func TestClient_Sync(t *testing.T) {
 	defer cancel()
 
 	go func() {
-		err = client.Sync(ctx, info, func(msg *mgmtProto.SyncResponse) error {
+		err = client.Sync(ctx, func(context.Context) *system.Info { return info }, func(msg *mgmtProto.SyncResponse) error {
 			ch <- msg
 			return nil
 		})
@@ -316,33 +317,156 @@ func TestClient_Sync(t *testing.T) {
 
 	select {
 	case resp := <-ch:
-		if resp.GetPeerConfig() == nil {
+		if resp.GetPeerConfig() == nil && resp.GetNetworkMap().GetPeerConfig() == nil {
 			t.Error("expecting non nil PeerConfig got nil")
 		}
 		if resp.GetNetbirdConfig() == nil {
 			t.Error("expecting non nil NetbirdConfig got nil")
 		}
-		// we test network map peers from 0.29.3 and dev builds
+		// Top-level RemotePeers is deprecated and must stay empty for
+		// v0.29.3+ (and dev) clients — the field rides inside NetworkMap
+		// (legacy) or the NetworkMapEnvelope (components) instead.
 		if len(resp.GetRemotePeers()) != 0 {
 			t.Error("expecting top-level RemotePeers to be empty for v0.29.3+ clients")
 		}
-		networkMap := resp.GetNetworkMap()
-		if len(networkMap.GetRemotePeers()) != 1 {
-			t.Errorf("expecting RemotePeers size %d got %d", 1, len(networkMap.GetRemotePeers()))
+		// Component-capable clients receive a NetworkMapEnvelope; the
+		// remote-peers list is encoded inside it. Decode it and check the
+		// envelope's peers slice. Legacy peers populate NetworkMap.RemotePeers;
+		// both shapes must surface exactly one remote peer.
+		remotePeerKeys := remotePeerKeysFromSync(resp, testKey.PublicKey().String())
+		if len(remotePeerKeys) != 1 {
+			t.Errorf("expecting RemotePeers size %d got %d", 1, len(remotePeerKeys))
 			return
 		}
-
-		if networkMap.GetRemotePeersIsEmpty() {
+		if resp.GetNetworkMap() != nil && resp.GetNetworkMap().GetRemotePeersIsEmpty() {
 			t.Error("expecting RemotePeers property to be false, got true")
 		}
-		if networkMap.GetRemotePeers()[0].GetWgPubKey() != remoteKey.PublicKey().String() {
-			t.Errorf("expecting RemotePeer public key %s got %s", remoteKey.PublicKey().String(), networkMap.GetRemotePeers()[0].GetWgPubKey())
+		if remotePeerKeys[0] != remoteKey.PublicKey().String() {
+			t.Errorf("expecting RemotePeer public key %s got %s", remoteKey.PublicKey().String(), remotePeerKeys[0])
 		}
 	case <-time.After(3 * time.Second):
 		t.Error("timeout waiting for test to finish")
 	}
 }
 
+// remotePeerKeysFromSync extracts the remote-peer WG keys from either the
+// legacy NetworkMap.RemotePeers list or the components NetworkMapEnvelope's
+// inner peers slice (filtering out the local receiving peer identified by
+// localKey, since the envelope's peers list is index-addressed and includes
+// the local peer alongside remotes).
+func remotePeerKeysFromSync(resp *mgmtProto.SyncResponse, localKey string) []string {
+	if rp := resp.GetRemotePeers(); len(rp) > 0 {
+		out := make([]string, 0, len(rp))
+		for _, p := range rp {
+			out = append(out, p.GetWgPubKey())
+		}
+		return out
+	}
+	if rp := resp.GetNetworkMap().GetRemotePeers(); len(rp) > 0 {
+		out := make([]string, 0, len(rp))
+		for _, p := range rp {
+			out = append(out, p.GetWgPubKey())
+		}
+		return out
+	}
+	env := resp.GetNetworkMapEnvelope().GetFull()
+	if env == nil {
+		return nil
+	}
+	out := make([]string, 0, len(env.GetPeers()))
+	for _, p := range env.GetPeers() {
+		key := wgKeyFromBytes(p.GetWgPubKey())
+		if key == "" || key == localKey {
+			continue
+		}
+		out = append(out, key)
+	}
+	return out
+}
+
+// wgKeyFromBytes mirrors the client-side decoder: the envelope ships raw 32
+// bytes; reconstruct the standard base64 key the test compares against.
+func wgKeyFromBytes(raw []byte) string {
+	if len(raw) == 0 {
+		return ""
+	}
+	var k wgtypes.Key
+	if len(raw) != len(k) {
+		return ""
+	}
+	copy(k[:], raw)
+	return k.String()
+}
+
+func TestClient_SyncGathersInfoOnEveryConnect(t *testing.T) {
+	s, lis, mgmtMockServer, serverKey := startMockManagement(t)
+	defer s.GracefulStop()
+
+	testKey, err := wgtypes.GenerateKey()
+	require.NoError(t, err)
+
+	hostnames := make(chan string, 2)
+	mgmtMockServer.SyncFunc = func(msg *mgmtProto.EncryptedMessage, _ mgmtProto.ManagementService_SyncServer) error {
+		peerKey, err := wgtypes.ParseKey(msg.GetWgPubKey())
+		if err != nil {
+			t.Errorf("invalid peer key: %v", err)
+			return status.Error(codes.InvalidArgument, err.Error())
+		}
+		syncReq := &mgmtProto.SyncRequest{}
+		if err := encryption.DecryptMessage(peerKey, serverKey, msg.Body, syncReq); err != nil {
+			t.Errorf("decrypt sync request: %v", err)
+			return status.Error(codes.InvalidArgument, err.Error())
+		}
+		select {
+		case hostnames <- syncReq.GetMeta().GetHostname():
+		default:
+		}
+		// Returning closes the stream, so the client reconnects and gathers again.
+		return nil
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	client, err := NewClient(ctx, lis.Addr().String(), testKey, false)
+	require.NoError(t, err)
+
+	var gathers atomic.Int32
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		_ = client.Sync(ctx, func(ctx context.Context) *system.Info {
+			info := system.GetInfo(ctx)
+			info.Hostname = fmt.Sprintf("host-%d", gathers.Add(1))
+			return info
+		}, func(*mgmtProto.SyncResponse) error { return nil })
+	}()
+
+	// A connect attempt can fail before it reaches the server, so the sequence
+	// numbers seen here may skip. What matters is that the reconnect carries a
+	// newly gathered info instead of the one sent on the previous stream.
+	var seen []int
+	for len(seen) < 2 {
+		select {
+		case got := <-hostnames:
+			var n int
+			_, err := fmt.Sscanf(got, "host-%d", &n)
+			require.NoError(t, err, "hostname should carry the gather sequence number")
+			seen = append(seen, n)
+		case <-time.After(10 * time.Second):
+			t.Fatalf("timeout waiting for the second sync request, got %v", seen)
+		}
+	}
+	assert.Greater(t, seen[1], seen[0], "the reconnect should carry a newly gathered info")
+
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for Sync to return after cancel")
+	}
+}
+
 func Test_SystemMetaDataFromClient(t *testing.T) {
 	s, lis, mgmtMockServer, serverKey := startMockManagement(t)
 	defer s.GracefulStop()
@@ -537,11 +661,16 @@ func Test_GetPKCEAuthorizationFlow(t *testing.T) {
 	expectedFlowInfo := &mgmtProto.PKCEAuthorizationFlow{
 		ProviderConfig: &mgmtProto.ProviderConfig{
 			ClientID:     "client",
-			ClientSecret: "secret",
+			ClientSecret: "secret", //nolint:staticcheck
 		},
 	}
 
+	var gotRequest mgmtProto.PKCEAuthorizationFlowRequest
 	mgmtMockServer.GetPKCEAuthorizationFlowFunc = func(ctx context.Context, req *mgmtProto.EncryptedMessage) (*mgmtProto.EncryptedMessage, error) {
+		if err := encryption.DecryptMessage(client.key.PublicKey(), serverKey, req.Body, &gotRequest); err != nil {
+			return nil, err
+		}
+
 		encryptedResp, err := encryption.EncryptMessage(client.key.PublicKey(), serverKey, expectedFlowInfo)
 		if err != nil {
 			return nil, err
@@ -554,10 +683,10 @@ func Test_GetPKCEAuthorizationFlow(t *testing.T) {
 		}, nil
 	}
 
-	flowInfo, err := client.GetPKCEAuthorizationFlow()
-	if err != nil {
-		t.Error("error while retrieving pkce auth flow information")
-	}
+	flowInfo, err := client.GetPKCEAuthorizationFlow(true)
+	require.NoError(t, err)
+
+	assert.True(t, gotRequest.GetSessionExtend(), "session extend should reach the server")
 
 	assert.Equal(t, expectedFlowInfo.ProviderConfig.ClientID, flowInfo.ProviderConfig.ClientID, "provider configured client ID should match")
 	assert.Equal(t, expectedFlowInfo.ProviderConfig.ClientSecret, flowInfo.ProviderConfig.ClientSecret, "provider configured client secret should match") //nolint:staticcheck
diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go
index e3ba259c6..6aa9855d4 100644
--- a/shared/management/client/grpc.go
+++ b/shared/management/client/grpc.go
@@ -21,9 +21,11 @@ import (
 	"google.golang.org/grpc/connectivity"
 
 	nbgrpc "github.com/netbirdio/netbird/client/grpc"
+	"github.com/netbirdio/netbird/client/netevents"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/shared/management/domain"
+	nbmgmtgrpc "github.com/netbirdio/netbird/shared/management/grpc"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/util/wsproxy"
 )
@@ -61,6 +63,10 @@ type GrpcClient struct {
 	connStateCallbackLock sync.RWMutex
 	serverURL             string
 
+	// netMgr gates the stream retry loop on OS-reported network
+	// availability and sweeps the transport on network change.
+	netMgr *netevents.Manager
+
 	// syncStreamErr holds the last Sync stream error, or nil while the stream
 	// is established and healthy. GetServerKey succeeds even when the peer
 	// cannot sync (e.g. the server returns "settings not found"), so the
@@ -110,16 +116,37 @@ func MaxRecvMsgSize() int {
 	return size
 }
 
+// Option configures optional GrpcClient behavior.
+type Option func(*GrpcClient)
+
+// WithNetEvents injects the OS network event handling.
+func WithNetEvents(events *netevents.Manager) Option {
+	return func(c *GrpcClient) { c.netMgr = events }
+}
+
 // NewClient creates a new client to Management service
-func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsEnabled bool) (*GrpcClient, error) {
-	var conn *grpc.ClientConn
+func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsEnabled bool, opts ...Option) (*GrpcClient, error) {
+	// Options apply before dialing: the sweeper must wrap the first connection too.
+	c := &GrpcClient{
+		key:                   ourPrivateKey,
+		ctx:                   ctx,
+		connStateCallbackLock: sync.RWMutex{},
+		serverURL:             addr,
+	}
+	for _, opt := range opts {
+		opt(c)
+	}
 
 	var extraOpts []grpc.DialOption
 	if maxSize := MaxRecvMsgSize(); maxSize > 0 {
 		extraOpts = append(extraOpts, grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(maxSize)))
 		log.Infof("management gRPC max receive message size set to %d bytes", maxSize)
 	}
+	if c.netMgr != nil {
+		extraOpts = append(extraOpts, nbgrpc.WithSweeper(c.netMgr))
+	}
 
+	var conn *grpc.ClientConn
 	operation := func() error {
 		var err error
 		conn, err = nbgrpc.CreateConnection(ctx, addr, tlsEnabled, wsproxy.ManagementComponent, extraOpts...)
@@ -135,16 +162,9 @@ func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsE
 		return nil, err
 	}
 
-	realClient := proto.NewManagementServiceClient(conn)
-
-	return &GrpcClient{
-		key:                   ourPrivateKey,
-		realClient:            realClient,
-		ctx:                   ctx,
-		conn:                  conn,
-		connStateCallbackLock: sync.RWMutex{},
-		serverURL:             addr,
-	}, nil
+	c.conn = conn
+	c.realClient = proto.NewManagementServiceClient(conn)
+	return c, nil
 }
 
 // GetServerURL returns the management server URL
@@ -185,17 +205,17 @@ func (c *GrpcClient) ready() bool {
 
 // Sync wraps the real client's Sync endpoint call and takes care of retries and encryption/decryption of messages
 // Blocking request. The result will be sent via msgHandler callback function
-func (c *GrpcClient) Sync(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error {
-	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key) error {
-		return c.handleSyncStream(ctx, serverPubKey, sysInfo, msgHandler)
+func (c *GrpcClient) Sync(ctx context.Context, getInfo func(ctx context.Context) *system.Info, msgHandler func(msg *proto.SyncResponse) error) error {
+	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key, backOff backoff.BackOff) error {
+		return c.handleSyncStream(ctx, serverPubKey, getInfo, msgHandler, backOff)
 	})
 }
 
 // Job wraps the real client's Job endpoint call and takes care of retries and encryption/decryption of messages
 // Blocking request. The result will be sent via msgHandler callback function
 func (c *GrpcClient) Job(ctx context.Context, msgHandler func(msg *proto.JobRequest) *proto.JobResponse) error {
-	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key) error {
-		return c.handleJobStream(ctx, serverPubKey, msgHandler)
+	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key, backOff backoff.BackOff) error {
+		return c.handleJobStream(ctx, serverPubKey, msgHandler, backOff)
 	})
 }
 
@@ -203,18 +223,38 @@ func (c *GrpcClient) Job(ctx context.Context, msgHandler func(msg *proto.JobRequ
 // It takes care of retries, connection readiness, and fetching server public key.
 func (c *GrpcClient) withMgmtStream(
 	ctx context.Context,
-	handler func(ctx context.Context, serverPubKey wgtypes.Key) error,
+	handler func(ctx context.Context, serverPubKey wgtypes.Key, backOff backoff.BackOff) error,
 ) error {
-	backOff := defaultBackoff(ctx)
+	backOff := c.netMgr.QuickRetryBackoff(ctx, defaultBackoff(ctx))
 	operation := func() error {
-		log.Debugf("management connection state %v", c.conn.GetState())
-		connState := c.conn.GetState()
+		// suspend reconnect attempts while the OS reports no usable network.
+		// Wait only errors on a cancelled context, which means shutdown, so
+		// stop the loop without reporting a failure.
+		if waited, err := c.netMgr.Wait(ctx); err != nil {
+			log.Debugf("management connection context has been canceled while offline, this usually indicates shutdown")
+			return nil //nolint:nilerr // a cancelled context means shutdown, not a retryable failure
+		} else if waited {
+			backOff.Reset()
+			// dials attempted while offline grew the channel's internal backoff;
+			// reset it too, or the reconnect waits out that timer first
+			c.conn.ResetConnectBackoff()
+		}
 
+		connState := c.conn.GetState()
+		log.Debugf("management connection state %v", connState)
 		if connState == connectivity.Shutdown {
 			return backoff.Permanent(fmt.Errorf("connection to management has been shut down"))
-		} else if !(connState == connectivity.Ready || connState == connectivity.Idle) {
+		}
+		if !(connState == connectivity.Ready || connState == connectivity.Idle) {
+			// A dial may already be in flight (e.g. the other stream triggered
+			// it after a network change); wait for it to settle and proceed if
+			// the channel became usable, instead of burning a backoff round on
+			// a successful dial. A failed dial errors out as before.
 			c.conn.WaitForStateChange(ctx, connState)
-			return fmt.Errorf("connection to management is not ready and in %s state", connState)
+			connState = c.conn.GetState()
+			if !(connState == connectivity.Ready || connState == connectivity.Idle) {
+				return fmt.Errorf("connection to management is not ready and in %s state", connState)
+			}
 		}
 
 		serverPubKey, err := c.getServerPublicKey()
@@ -223,10 +263,10 @@ func (c *GrpcClient) withMgmtStream(
 			return err
 		}
 
-		return handler(ctx, *serverPubKey)
+		return handler(ctx, *serverPubKey, backOff)
 	}
 
-	err := backoff.Retry(operation, backOff)
+	err := nbgrpc.Retry(ctx, operation, backOff, c.netMgr)
 	if err != nil {
 		log.Warnf("exiting the Management service connection retry loop due to the unrecoverable error: %s", err)
 	}
@@ -238,6 +278,7 @@ func (c *GrpcClient) handleJobStream(
 	ctx context.Context,
 	serverPubKey wgtypes.Key,
 	msgHandler func(msg *proto.JobRequest) *proto.JobResponse,
+	backOff backoff.BackOff,
 ) error {
 	ctx, cancelStream := context.WithCancel(ctx)
 	defer cancelStream()
@@ -255,6 +296,19 @@ func (c *GrpcClient) handleJobStream(
 
 	log.Debug("job stream handshake sent successfully")
 
+	// The stream is up, so reset the backoff. This matters for two reasons,
+	// both caused by the backoff lib not resetting its state on a successful
+	// connection:
+	//  1. Without a reset, after a connect followed by an error the next retry
+	//     starts from the accumulated (large) interval instead of retrying
+	//     promptly, delaying reconnection.
+	//  2. Worse, once the accumulated elapsed time exceeds MaxElapsedTime, the
+	//     next stream error makes NextBackOff() return Stop, so the retry loop
+	//     exits immediately. That error is then mislabeled unrecoverable and
+	//     bubbles up to trigger a full engine restart / data-plane teardown
+	//     instead of a silent reconnection.
+	backOff.Reset()
+
 	// Main loop: receive, process, respond
 	for {
 		jobReq, err := c.receiveJobRequest(ctx, stream, serverPubKey)
@@ -370,11 +424,11 @@ func (c *GrpcClient) sendJobResponse(
 	return nil
 }
 
-func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.Key, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error {
+func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.Key, getInfo func(ctx context.Context) *system.Info, msgHandler func(msg *proto.SyncResponse) error, backOff backoff.BackOff) error {
 	ctx, cancelStream := context.WithCancel(ctx)
 	defer cancelStream()
 
-	stream, err := c.connectToSyncStream(ctx, serverPubKey, sysInfo)
+	stream, err := c.connectToSyncStream(ctx, serverPubKey, getInfo(ctx))
 	if err != nil {
 		log.Debugf("failed to open Management Service stream: %s", err)
 		c.notifyDisconnected(err)
@@ -389,6 +443,19 @@ func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.
 	c.notifyConnected()
 	c.setSyncStreamConnected()
 
+	// The stream is up, so reset the backoff. This matters for two reasons,
+	// both caused by the backoff lib not resetting its state on a successful
+	// connection:
+	//  1. Without a reset, after a connect followed by an error the next retry
+	//     starts from the accumulated (large) interval instead of retrying
+	//     promptly, delaying reconnection.
+	//  2. Worse, once the accumulated elapsed time exceeds MaxElapsedTime, the
+	//     next stream error makes NextBackOff() return Stop, so the retry loop
+	//     exits immediately. That error is then mislabeled unrecoverable and
+	//     bubbles up to trigger a full engine restart / data-plane teardown
+	//     instead of a silent reconnection.
+	backOff.Reset()
+
 	// blocking until error
 	err = c.receiveUpdatesEvents(stream, serverPubKey, msgHandler)
 	if err != nil {
@@ -408,49 +475,6 @@ func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.
 	return nil
 }
 
-// GetNetworkMap return with the network map
-func (c *GrpcClient) GetNetworkMap(sysInfo *system.Info) (*proto.NetworkMap, error) {
-	serverPubKey, err := c.getServerPublicKey()
-	if err != nil {
-		log.Debugf("failed getting Management Service public key: %s", err)
-		return nil, err
-	}
-
-	ctx, cancelStream := context.WithCancel(c.ctx)
-	defer cancelStream()
-	stream, err := c.connectToSyncStream(ctx, *serverPubKey, sysInfo)
-	if err != nil {
-		log.Debugf("failed to open Management Service stream: %s", err)
-		return nil, err
-	}
-	defer func() {
-		_ = stream.CloseSend()
-	}()
-
-	update, err := stream.Recv()
-	if err == io.EOF {
-		log.Debugf("Management stream has been closed by server: %s", err)
-		return nil, err
-	}
-	if err != nil {
-		log.Debugf("disconnected from Management Service sync stream: %v", err)
-		return nil, err
-	}
-
-	decryptedResp := &proto.SyncResponse{}
-	err = encryption.DecryptMessage(*serverPubKey, c.key, update.Body, decryptedResp)
-	if err != nil {
-		log.Errorf("failed decrypting update message from Management Service: %s", err)
-		return nil, err
-	}
-
-	if decryptedResp.GetNetworkMap() == nil {
-		return nil, fmt.Errorf("invalid msg, required network map")
-	}
-
-	return decryptedResp.GetNetworkMap(), nil
-}
-
 func (c *GrpcClient) connectToSyncStream(ctx context.Context, serverPubKey wgtypes.Key, sysInfo *system.Info) (proto.ManagementService_SyncClient, error) {
 	req := &proto.SyncRequest{Meta: infoToMetaData(sysInfo)}
 
@@ -597,7 +621,13 @@ func (c *GrpcClient) login(req *proto.LoginRequest) (*proto.LoginResponse, error
 
 	err = backoff.Retry(operation, nbgrpc.Backoff(c.ctx))
 	if err != nil {
-		log.Errorf("failed to login to Management Service: %v", err)
+		// PermissionDenied is how management asks an unknown peer to register,
+		// which the caller does next, so it is not an error worth reporting.
+		if s, ok := gstatus.FromError(err); ok && s.Code() == codes.PermissionDenied {
+			log.Debugf("login to Management Service refused: %v", err)
+		} else {
+			log.Errorf("failed to login to Management Service: %v", err)
+		}
 		return nil, err
 	}
 
@@ -654,26 +684,14 @@ func (c *GrpcClient) ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*
 		return nil, err
 	}
 
-	var resp *proto.EncryptedMessage
-	operation := func() error {
-		mgmCtx, cancel := context.WithTimeout(context.Background(), ConnectTimeout)
-		defer cancel()
+	mgmCtx, cancel := context.WithTimeout(c.ctx, ConnectTimeout)
+	defer cancel()
 
-		var err error
-		resp, err = c.realClient.ExtendAuthSession(mgmCtx, &proto.EncryptedMessage{
-			WgPubKey: c.key.PublicKey().String(),
-			Body:     reqBody,
-		})
-		if err != nil {
-			if s, ok := gstatus.FromError(err); ok && s.Code() == codes.Canceled {
-				return err
-			}
-			return backoff.Permanent(err)
-		}
-		return nil
-	}
-
-	if err := backoff.Retry(operation, nbgrpc.Backoff(c.ctx)); err != nil {
+	resp, err := c.realClient.ExtendAuthSession(mgmCtx, &proto.EncryptedMessage{
+		WgPubKey: c.key.PublicKey().String(),
+		Body:     reqBody,
+	})
+	if err != nil {
 		log.Errorf("failed to extend auth session on Management Service: %v", err)
 		return nil, err
 	}
@@ -726,9 +744,13 @@ func (c *GrpcClient) GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlo
 	return flowInfoResp, nil
 }
 
-// GetPKCEAuthorizationFlow returns a pkce authorization flow information.
+// GetPKCEAuthorizationFlow returns the PKCE authorization flow information.
 // It also takes care of encrypting and decrypting messages.
-func (c *GrpcClient) GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error) {
+//
+// sessionExtend tells the server the flow will renew an existing peer's session
+// rather than log one in, so it can rule out a configuration that would let the
+// IdP answer from an unrelated account. See PKCEAuthorizationFlowRequest.
+func (c *GrpcClient) GetPKCEAuthorizationFlow(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error) {
 	if !c.ready() {
 		return nil, fmt.Errorf("no connection to management in order to get pkce authorization flow")
 	}
@@ -741,7 +763,7 @@ func (c *GrpcClient) GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, e
 	mgmCtx, cancel := context.WithTimeout(c.ctx, time.Second*2)
 	defer cancel()
 
-	message := &proto.PKCEAuthorizationFlowRequest{}
+	message := &proto.PKCEAuthorizationFlowRequest{SessionExtend: sessionExtend}
 	encryptedMSG, err := encryption.EncryptMessage(*serverKey, c.key, message)
 	if err != nil {
 		return nil, err
@@ -1002,6 +1024,19 @@ func infoToMetaData(info *system.Info) *proto.PeerSystemMeta {
 		})
 	}
 
+	proofs := make([]*proto.CertificateProof, 0, len(info.CertificateProofs))
+	for _, p := range info.CertificateProofs {
+		proofs = append(proofs, &proto.CertificateProof{
+			Nonce:     p.Nonce,
+			Chain:     p.Chain,
+			SigAlg:    p.SigAlg,
+			Signature: p.Signature,
+		})
+	}
+	if len(proofs) > 0 {
+		log.Debugf("peer meta carries %d certificate posture proofs", len(proofs))
+	}
+
 	return &proto.PeerSystemMeta{
 		Hostname:         info.Hostname,
 		GoOS:             info.GoOS,
@@ -1021,12 +1056,14 @@ func infoToMetaData(info *system.Info) *proto.PeerSystemMeta {
 			Cloud:    info.Environment.Cloud,
 			Platform: info.Environment.Platform,
 		},
-		Files: files,
+		Files:             files,
+		CertificateProofs: proofs,
 
 		Flags: &proto.Flags{
 			RosenpassEnabled:    info.RosenpassEnabled,
 			RosenpassPermissive: info.RosenpassPermissive,
 			ServerSSHAllowed:    info.ServerSSHAllowed,
+			RemoteJobsAllowed:   info.RemoteJobsAllowed,
 
 			DisableClientRoutes: info.DisableClientRoutes,
 			DisableServerRoutes: info.DisableServerRoutes,
@@ -1038,6 +1075,8 @@ func infoToMetaData(info *system.Info) *proto.PeerSystemMeta {
 		},
 
 		Capabilities: peerCapabilities(*info),
+
+		SyncMessageVersion: syncMessageVersion(*info),
 	}
 }
 
@@ -1051,3 +1090,10 @@ func peerCapabilities(info system.Info) []proto.PeerCapability {
 	}
 	return caps
 }
+
+func syncMessageVersion(info system.Info) int32 {
+	if info.SyncMessageVersion != nil {
+		return int32(*info.SyncMessageVersion)
+	}
+	return int32(nbmgmtgrpc.HighestSyncMessageVersion)
+}
diff --git a/shared/management/client/grpc_test.go b/shared/management/client/grpc_test.go
index c947130fd..8c69cea1c 100644
--- a/shared/management/client/grpc_test.go
+++ b/shared/management/client/grpc_test.go
@@ -12,6 +12,8 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
+	"github.com/netbirdio/netbird/client/system"
+	"github.com/netbirdio/netbird/shared/management/certposture"
 	mgmtProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -93,3 +95,25 @@ func TestMaxRecvMsgSizeIntegration(t *testing.T) {
 		assert.Len(t, resp.Key, payloadSize)
 	})
 }
+
+// TestInfoToMetaData_CarriesCertificateProofs: management verifies the proofs it receives
+// in the peer meta, so a field dropped by the mapping fails the certificate check without
+// any error on either side.
+func TestInfoToMetaData_CarriesCertificateProofs(t *testing.T) {
+	info := &system.Info{CertificateProofs: []certposture.Proof{
+		{Nonce: []byte("nonce-1"), Chain: [][]byte{[]byte("leaf"), []byte("intermediate")}, SigAlg: "ecdsa-sha256", Signature: []byte("sig-1")},
+		{Nonce: []byte("nonce-2"), Chain: [][]byte{[]byte("other")}, SigAlg: "rsa-pss-sha256", Signature: []byte("sig-2")},
+	}}
+
+	meta := infoToMetaData(info)
+
+	require.Len(t, meta.GetCertificateProofs(), 2, "every proof reaches the meta")
+	first := meta.GetCertificateProofs()[0]
+	assert.Equal(t, []byte("nonce-1"), first.GetNonce())
+	assert.Equal(t, [][]byte{[]byte("leaf"), []byte("intermediate")}, first.GetChain(), "the whole chain is carried, in order")
+	assert.Equal(t, "ecdsa-sha256", first.GetSigAlg())
+	assert.Equal(t, []byte("sig-1"), first.GetSignature())
+	assert.Equal(t, "rsa-pss-sha256", meta.GetCertificateProofs()[1].GetSigAlg())
+
+	assert.Empty(t, infoToMetaData(&system.Info{}).GetCertificateProofs(), "a device without proofs sends none")
+}
diff --git a/shared/management/client/mock.go b/shared/management/client/mock.go
index ba156a225..330bf9ece 100644
--- a/shared/management/client/mock.go
+++ b/shared/management/client/mock.go
@@ -11,12 +11,12 @@ import (
 // MockClient is a mock implementation of the Client interface for testing.
 type MockClient struct {
 	CloseFunc                      func() error
-	SyncFunc                       func(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error
+	SyncFunc                       func(ctx context.Context, getInfo func(ctx context.Context) *system.Info, msgHandler func(msg *proto.SyncResponse) error) error
 	RegisterFunc                   func(setupKey string, jwtToken string, info *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
 	LoginFunc                      func(info *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
 	ExtendAuthSessionFunc          func(info *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlowFunc func() (*proto.DeviceAuthorizationFlow, error)
-	GetPKCEAuthorizationFlowFunc   func() (*proto.PKCEAuthorizationFlow, error)
+	GetPKCEAuthorizationFlowFunc   func(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error)
 	GetServerURLFunc               func() string
 	HealthCheckFunc                func() error
 	SyncMetaFunc                   func(sysInfo *system.Info) error
@@ -38,11 +38,11 @@ func (m *MockClient) Close() error {
 	return m.CloseFunc()
 }
 
-func (m *MockClient) Sync(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error {
+func (m *MockClient) Sync(ctx context.Context, getInfo func(ctx context.Context) *system.Info, msgHandler func(msg *proto.SyncResponse) error) error {
 	if m.SyncFunc == nil {
 		return nil
 	}
-	return m.SyncFunc(ctx, sysInfo, msgHandler)
+	return m.SyncFunc(ctx, getInfo, msgHandler)
 }
 
 func (m *MockClient) Job(ctx context.Context, msgHandler func(msg *proto.JobRequest) *proto.JobResponse) error {
@@ -80,11 +80,12 @@ func (m *MockClient) GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlo
 	return m.GetDeviceAuthorizationFlowFunc()
 }
 
-func (m *MockClient) GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error) {
+// GetPKCEAuthorizationFlow returns the PKCE authorization flow information.
+func (m *MockClient) GetPKCEAuthorizationFlow(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error) {
 	if m.GetPKCEAuthorizationFlowFunc == nil {
 		return nil, nil
 	}
-	return m.GetPKCEAuthorizationFlowFunc()
+	return m.GetPKCEAuthorizationFlowFunc(sessionExtend)
 }
 
 func (m *MockClient) HealthCheck() error {
@@ -94,11 +95,6 @@ func (m *MockClient) HealthCheck() error {
 	return m.HealthCheckFunc()
 }
 
-// GetNetworkMap mock implementation of GetNetworkMap from Client interface.
-func (m *MockClient) GetNetworkMap(_ *system.Info) (*proto.NetworkMap, error) {
-	return nil, nil
-}
-
 // GetServerURL mock implementation of GetServerURL from mgm.Client interface
 func (m *MockClient) GetServerURL() string {
 	if m.GetServerURLFunc == nil {
diff --git a/shared/management/client/rest/agentnetwork.go b/shared/management/client/rest/agentnetwork.go
new file mode 100644
index 000000000..13328aab7
--- /dev/null
+++ b/shared/management/client/rest/agentnetwork.go
@@ -0,0 +1,417 @@
+package rest
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// AgentNetworkAPI APIs for the Agent Network (AI/LLM gateway), do not use directly
+// see more: https://docs.netbird.io/api/resources/agent-network
+type AgentNetworkAPI struct {
+	c *Client
+}
+
+// ListCatalogProviders lists the catalog of supported upstream AI providers
+// (openai_api, anthropic_api, bedrock_api, ...) with their default models and
+// pricing, used to prefill provider create forms.
+func (a *AgentNetworkAPI) ListCatalogProviders(ctx context.Context) ([]api.AgentNetworkCatalogProvider, error) {
+	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/catalog/providers", nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[[]api.AgentNetworkCatalogProvider](resp)
+	return ret, err
+}
+
+// ListProviders lists all Agent Network providers
+func (a *AgentNetworkAPI) ListProviders(ctx context.Context) ([]api.AgentNetworkProvider, error) {
+	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/providers", nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[[]api.AgentNetworkProvider](resp)
+	return ret, err
+}
+
+// GetProvider gets Agent Network provider info
+func (a *AgentNetworkAPI) GetProvider(ctx context.Context, providerID string) (*api.AgentNetworkProvider, error) {
+	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/providers/"+providerID, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkProvider](resp)
+	return &ret, err
+}
+
+// CreateProvider creates a new Agent Network provider. Providers have no
+// settings side effects — bootstrap the account's gateway endpoint separately
+// via CreateSettings.
+func (a *AgentNetworkAPI) CreateProvider(ctx context.Context, request api.PostApiAgentNetworkProvidersJSONRequestBody) (*api.AgentNetworkProvider, error) {
+	requestBytes, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/providers", bytes.NewReader(requestBytes), nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkProvider](resp)
+	return &ret, err
+}
+
+// UpdateProvider updates an Agent Network provider. The request replaces the
+// provider's mutable state; only an omitted api_key keeps the stored key
+// (secrets are never required to round-trip).
+func (a *AgentNetworkAPI) UpdateProvider(ctx context.Context, providerID string, request api.PutApiAgentNetworkProvidersProviderIdJSONRequestBody) (*api.AgentNetworkProvider, error) {
+	requestBytes, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/providers/"+providerID, bytes.NewReader(requestBytes), nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkProvider](resp)
+	return &ret, err
+}
+
+// DeleteProvider deletes an Agent Network provider. Fails while any policy
+// still references the provider — detach it first.
+func (a *AgentNetworkAPI) DeleteProvider(ctx context.Context, providerID string) error {
+	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/providers/"+providerID, nil, nil)
+	if err != nil {
+		return err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+
+	return nil
+}
+
+// ListPolicies lists all Agent Network policies
+func (a *AgentNetworkAPI) ListPolicies(ctx context.Context) ([]api.AgentNetworkPolicy, error) {
+	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/policies", nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[[]api.AgentNetworkPolicy](resp)
+	return ret, err
+}
+
+// GetPolicy gets Agent Network policy info
+func (a *AgentNetworkAPI) GetPolicy(ctx context.Context, policyID string) (*api.AgentNetworkPolicy, error) {
+	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/policies/"+policyID, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkPolicy](resp)
+	return &ret, err
+}
+
+// CreatePolicy creates a new Agent Network policy
+func (a *AgentNetworkAPI) CreatePolicy(ctx context.Context, request api.PostApiAgentNetworkPoliciesJSONRequestBody) (*api.AgentNetworkPolicy, error) {
+	requestBytes, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/policies", bytes.NewReader(requestBytes), nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkPolicy](resp)
+	return &ret, err
+}
+
+// UpdatePolicy updates an Agent Network policy
+func (a *AgentNetworkAPI) UpdatePolicy(ctx context.Context, policyID string, request api.PutApiAgentNetworkPoliciesPolicyIdJSONRequestBody) (*api.AgentNetworkPolicy, error) {
+	requestBytes, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/policies/"+policyID, bytes.NewReader(requestBytes), nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkPolicy](resp)
+	return &ret, err
+}
+
+// DeletePolicy deletes an Agent Network policy
+func (a *AgentNetworkAPI) DeletePolicy(ctx context.Context, policyID string) error {
+	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/policies/"+policyID, nil, nil)
+	if err != nil {
+		return err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+
+	return nil
+}
+
+// ListGuardrails lists all Agent Network guardrails
+func (a *AgentNetworkAPI) ListGuardrails(ctx context.Context) ([]api.AgentNetworkGuardrail, error) {
+	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/guardrails", nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[[]api.AgentNetworkGuardrail](resp)
+	return ret, err
+}
+
+// GetGuardrail gets Agent Network guardrail info
+func (a *AgentNetworkAPI) GetGuardrail(ctx context.Context, guardrailID string) (*api.AgentNetworkGuardrail, error) {
+	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/guardrails/"+guardrailID, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkGuardrail](resp)
+	return &ret, err
+}
+
+// CreateGuardrail creates a new Agent Network guardrail
+func (a *AgentNetworkAPI) CreateGuardrail(ctx context.Context, request api.PostApiAgentNetworkGuardrailsJSONRequestBody) (*api.AgentNetworkGuardrail, error) {
+	requestBytes, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/guardrails", bytes.NewReader(requestBytes), nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkGuardrail](resp)
+	return &ret, err
+}
+
+// UpdateGuardrail updates an Agent Network guardrail
+func (a *AgentNetworkAPI) UpdateGuardrail(ctx context.Context, guardrailID string, request api.PutApiAgentNetworkGuardrailsGuardrailIdJSONRequestBody) (*api.AgentNetworkGuardrail, error) {
+	requestBytes, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/guardrails/"+guardrailID, bytes.NewReader(requestBytes), nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkGuardrail](resp)
+	return &ret, err
+}
+
+// DeleteGuardrail deletes an Agent Network guardrail
+func (a *AgentNetworkAPI) DeleteGuardrail(ctx context.Context, guardrailID string) error {
+	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/guardrails/"+guardrailID, nil, nil)
+	if err != nil {
+		return err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+
+	return nil
+}
+
+// ListBudgetRules lists all account-level Agent Network budget rules
+func (a *AgentNetworkAPI) ListBudgetRules(ctx context.Context) ([]api.AgentNetworkBudgetRule, error) {
+	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/budget-rules", nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[[]api.AgentNetworkBudgetRule](resp)
+	return ret, err
+}
+
+// GetBudgetRule gets Agent Network budget rule info
+func (a *AgentNetworkAPI) GetBudgetRule(ctx context.Context, ruleID string) (*api.AgentNetworkBudgetRule, error) {
+	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/budget-rules/"+ruleID, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkBudgetRule](resp)
+	return &ret, err
+}
+
+// CreateBudgetRule creates a new Agent Network budget rule
+func (a *AgentNetworkAPI) CreateBudgetRule(ctx context.Context, request api.PostApiAgentNetworkBudgetRulesJSONRequestBody) (*api.AgentNetworkBudgetRule, error) {
+	requestBytes, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/budget-rules", bytes.NewReader(requestBytes), nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkBudgetRule](resp)
+	return &ret, err
+}
+
+// UpdateBudgetRule updates an Agent Network budget rule
+func (a *AgentNetworkAPI) UpdateBudgetRule(ctx context.Context, ruleID string, request api.PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody) (*api.AgentNetworkBudgetRule, error) {
+	requestBytes, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/budget-rules/"+ruleID, bytes.NewReader(requestBytes), nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkBudgetRule](resp)
+	return &ret, err
+}
+
+// DeleteBudgetRule deletes an Agent Network budget rule
+func (a *AgentNetworkAPI) DeleteBudgetRule(ctx context.Context, ruleID string) error {
+	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/budget-rules/"+ruleID, nil, nil)
+	if err != nil {
+		return err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+
+	return nil
+}
+
+// GetSettings gets the account's Agent Network gateway settings (endpoint,
+// proxy address, collection toggles). An account that has not been
+// bootstrapped yet — via CreateSettings — reads as the defaults with an empty
+// Endpoint and ProxyAddress. Management servers prior to that contract
+// answered 200 with a JSON null body instead; that legacy shape is translated
+// to an APIError matchable via IsNotFound rather than fabricating defaults
+// the server never stated.
+func (a *AgentNetworkAPI) GetSettings(ctx context.Context) (*api.AgentNetworkSettings, error) {
+	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/settings", nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	if trimmed := bytes.TrimSpace(body); len(trimmed) == 0 || bytes.Equal(trimmed, []byte("null")) {
+		return nil, &APIError{StatusCode: http.StatusNotFound, Message: "agent network settings not found"}
+	}
+	var ret api.AgentNetworkSettings
+	if err := json.Unmarshal(body, &ret); err != nil {
+		return nil, err
+	}
+	return &ret, nil
+}
+
+// CreateSettings bootstraps the account's Agent Network settings row,
+// assigning the immutable endpoint. Exactly one of request.ProxyAddress
+// (labeled endpoint beneath that cluster; the server allocates the label) and
+// request.Endpoint (self-addressed dedicated endpoint, claimed verbatim) must
+// be set. Returns a conflict when the account already has a settings row.
+func (a *AgentNetworkAPI) CreateSettings(ctx context.Context, request api.PostApiAgentNetworkSettingsJSONRequestBody) (*api.AgentNetworkSettings, error) {
+	requestBytes, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/settings", bytes.NewReader(requestBytes), nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkSettings](resp)
+	return &ret, err
+}
+
+// UpdateSettings updates the account's Agent Network settings; the request
+// carries every field, replacing the mutable ones (collection toggles and
+// retention). The endpoint and proxy address are assigned at bootstrap
+// (CreateSettings) and immutable — the request must echo them unchanged, and
+// a request carrying different values is rejected. Returns not-found until
+// the account is bootstrapped.
+func (a *AgentNetworkAPI) UpdateSettings(ctx context.Context, request api.PutApiAgentNetworkSettingsJSONRequestBody) (*api.AgentNetworkSettings, error) {
+	requestBytes, err := json.Marshal(request)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/settings", bytes.NewReader(requestBytes), nil)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+	ret, err := parseResponse[api.AgentNetworkSettings](resp)
+	return &ret, err
+}
+
+// DeleteSettings deletes the account's Agent Network settings row, releasing
+// the endpoint. The server refuses (precondition failed) while any provider
+// exists for the account or while a proxy is actively serving the endpoint.
+// Bootstrapping again afterwards allocates a new endpoint.
+func (a *AgentNetworkAPI) DeleteSettings(ctx context.Context) error {
+	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/settings", nil, nil)
+	if err != nil {
+		return err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+
+	return nil
+}
diff --git a/shared/management/client/rest/agentnetwork_test.go b/shared/management/client/rest/agentnetwork_test.go
new file mode 100644
index 000000000..049aa6cfd
--- /dev/null
+++ b/shared/management/client/rest/agentnetwork_test.go
@@ -0,0 +1,561 @@
+//go:build integration
+
+package rest_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/client/rest"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+)
+
+var (
+	testAgentNetworkProvider = api.AgentNetworkProvider{
+		Id:          "ainp_test",
+		ProviderId:  "openai_api",
+		Name:        "OpenAI",
+		UpstreamUrl: "https://api.openai.com",
+		Models:      []api.AgentNetworkProviderModel{},
+		Enabled:     true,
+	}
+
+	testAgentNetworkPolicy = api.AgentNetworkPolicy{
+		Id:                     "ainpol_test",
+		Name:                   "Engineering → OpenAI",
+		Enabled:                true,
+		SourceGroups:           []string{"grp-eng"},
+		DestinationProviderIds: []string{"ainp_test"},
+	}
+
+	testAgentNetworkGuardrail = api.AgentNetworkGuardrail{
+		Id:   "aingr_test",
+		Name: "No secrets",
+	}
+
+	testAgentNetworkBudgetRule = api.AgentNetworkBudgetRule{
+		Id:      "ainbud_test",
+		Name:    "Org monthly ceiling",
+		Enabled: true,
+	}
+
+	testAgentNetworkSettings = api.AgentNetworkSettings{
+		Endpoint:               "violet.eu.proxy.netbird.io",
+		ProxyAddress:           "eu.proxy.netbird.io",
+		Dedicated:              false,
+		EnableLogCollection:    true,
+		AccessLogRetentionDays: ptr(30),
+	}
+)
+
+func TestAgentNetwork_ListCatalogProviders_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/catalog/providers", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal([]api.AgentNetworkCatalogProvider{{Id: "openai_api", Name: "OpenAI"}})
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.ListCatalogProviders(context.Background())
+		require.NoError(t, err)
+		assert.Len(t, ret, 1)
+		assert.Equal(t, "openai_api", ret[0].Id)
+	})
+}
+
+func TestAgentNetwork_ListProviders_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/providers", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal([]api.AgentNetworkProvider{testAgentNetworkProvider})
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.ListProviders(context.Background())
+		require.NoError(t, err)
+		assert.Len(t, ret, 1)
+		assert.Equal(t, testAgentNetworkProvider, ret[0])
+	})
+}
+
+func TestAgentNetwork_GetProvider_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "GET", r.Method)
+			retBytes, _ := json.Marshal(testAgentNetworkProvider)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.GetProvider(context.Background(), "ainp_test")
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkProvider, *ret)
+	})
+}
+
+func TestAgentNetwork_GetProvider_Err(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "not found", Code: 404})
+			w.WriteHeader(404)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		_, err := c.AgentNetwork.GetProvider(context.Background(), "ainp_test")
+		require.Error(t, err)
+		assert.True(t, rest.IsNotFound(err), "a 404 must be matchable via IsNotFound")
+	})
+}
+
+func TestAgentNetwork_CreateProvider_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/providers", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "POST", r.Method)
+			reqBytes, err := io.ReadAll(r.Body)
+			require.NoError(t, err)
+			var req api.PostApiAgentNetworkProvidersJSONRequestBody
+			require.NoError(t, json.Unmarshal(reqBytes, &req))
+			assert.Equal(t, "OpenAI", req.Name)
+			retBytes, _ := json.Marshal(testAgentNetworkProvider)
+			_, err = w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.CreateProvider(context.Background(), api.PostApiAgentNetworkProvidersJSONRequestBody{
+			ProviderId:  "openai_api",
+			Name:        "OpenAI",
+			UpstreamUrl: "https://api.openai.com",
+			ApiKey:      ptr("sk-test"),
+		})
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkProvider, *ret)
+	})
+}
+
+func TestAgentNetwork_UpdateProvider_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "PUT", r.Method)
+			reqBytes, err := io.ReadAll(r.Body)
+			require.NoError(t, err)
+			// Omitted optional fields must be absent from the wire (not
+			// zero-valued) so the server-side merge preserves them.
+			assert.NotContains(t, string(reqBytes), "api_key")
+			assert.NotContains(t, string(reqBytes), "models")
+			retBytes, _ := json.Marshal(testAgentNetworkProvider)
+			_, err = w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.UpdateProvider(context.Background(), "ainp_test", api.PutApiAgentNetworkProvidersProviderIdJSONRequestBody{
+			ProviderId:  "openai_api",
+			Name:        "OpenAI",
+			UpstreamUrl: "https://api.openai.com",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkProvider, *ret)
+	})
+}
+
+func TestAgentNetwork_DeleteProvider_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "DELETE", r.Method)
+			_, err := w.Write([]byte("{}"))
+			require.NoError(t, err)
+		})
+		err := c.AgentNetwork.DeleteProvider(context.Background(), "ainp_test")
+		require.NoError(t, err)
+	})
+}
+
+func TestAgentNetwork_ListPolicies_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/policies", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal([]api.AgentNetworkPolicy{testAgentNetworkPolicy})
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.ListPolicies(context.Background())
+		require.NoError(t, err)
+		assert.Len(t, ret, 1)
+		assert.Equal(t, testAgentNetworkPolicy, ret[0])
+	})
+}
+
+func TestAgentNetwork_GetPolicy_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/policies/ainpol_test", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal(testAgentNetworkPolicy)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.GetPolicy(context.Background(), "ainpol_test")
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkPolicy, *ret)
+	})
+}
+
+func TestAgentNetwork_CreatePolicy_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/policies", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "POST", r.Method)
+			retBytes, _ := json.Marshal(testAgentNetworkPolicy)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.CreatePolicy(context.Background(), api.PostApiAgentNetworkPoliciesJSONRequestBody{
+			Name:                   "Engineering → OpenAI",
+			SourceGroups:           []string{"grp-eng"},
+			DestinationProviderIds: []string{"ainp_test"},
+		})
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkPolicy, *ret)
+	})
+}
+
+func TestAgentNetwork_UpdatePolicy_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/policies/ainpol_test", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "PUT", r.Method)
+			retBytes, _ := json.Marshal(testAgentNetworkPolicy)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.UpdatePolicy(context.Background(), "ainpol_test", api.PutApiAgentNetworkPoliciesPolicyIdJSONRequestBody{
+			Name:                   "Engineering → OpenAI",
+			SourceGroups:           []string{"grp-eng"},
+			DestinationProviderIds: []string{"ainp_test"},
+		})
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkPolicy, *ret)
+	})
+}
+
+func TestAgentNetwork_DeletePolicy_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/policies/ainpol_test", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "DELETE", r.Method)
+			_, err := w.Write([]byte("{}"))
+			require.NoError(t, err)
+		})
+		err := c.AgentNetwork.DeletePolicy(context.Background(), "ainpol_test")
+		require.NoError(t, err)
+	})
+}
+
+func TestAgentNetwork_ListGuardrails_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/guardrails", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal([]api.AgentNetworkGuardrail{testAgentNetworkGuardrail})
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.ListGuardrails(context.Background())
+		require.NoError(t, err)
+		assert.Len(t, ret, 1)
+		assert.Equal(t, testAgentNetworkGuardrail, ret[0])
+	})
+}
+
+func TestAgentNetwork_GetGuardrail_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/guardrails/aingr_test", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal(testAgentNetworkGuardrail)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.GetGuardrail(context.Background(), "aingr_test")
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkGuardrail, *ret)
+	})
+}
+
+func TestAgentNetwork_CreateGuardrail_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/guardrails", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "POST", r.Method)
+			retBytes, _ := json.Marshal(testAgentNetworkGuardrail)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.CreateGuardrail(context.Background(), api.PostApiAgentNetworkGuardrailsJSONRequestBody{
+			Name: "No secrets",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkGuardrail, *ret)
+	})
+}
+
+func TestAgentNetwork_UpdateGuardrail_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/guardrails/aingr_test", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "PUT", r.Method)
+			retBytes, _ := json.Marshal(testAgentNetworkGuardrail)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.UpdateGuardrail(context.Background(), "aingr_test", api.PutApiAgentNetworkGuardrailsGuardrailIdJSONRequestBody{
+			Name: "No secrets",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkGuardrail, *ret)
+	})
+}
+
+func TestAgentNetwork_DeleteGuardrail_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/guardrails/aingr_test", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "DELETE", r.Method)
+			_, err := w.Write([]byte("{}"))
+			require.NoError(t, err)
+		})
+		err := c.AgentNetwork.DeleteGuardrail(context.Background(), "aingr_test")
+		require.NoError(t, err)
+	})
+}
+
+func TestAgentNetwork_ListBudgetRules_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/budget-rules", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal([]api.AgentNetworkBudgetRule{testAgentNetworkBudgetRule})
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.ListBudgetRules(context.Background())
+		require.NoError(t, err)
+		assert.Len(t, ret, 1)
+		assert.Equal(t, testAgentNetworkBudgetRule, ret[0])
+	})
+}
+
+func TestAgentNetwork_GetBudgetRule_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/budget-rules/ainbud_test", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal(testAgentNetworkBudgetRule)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.GetBudgetRule(context.Background(), "ainbud_test")
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkBudgetRule, *ret)
+	})
+}
+
+func TestAgentNetwork_CreateBudgetRule_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/budget-rules", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "POST", r.Method)
+			retBytes, _ := json.Marshal(testAgentNetworkBudgetRule)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.CreateBudgetRule(context.Background(), api.PostApiAgentNetworkBudgetRulesJSONRequestBody{
+			Name: "Org monthly ceiling",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkBudgetRule, *ret)
+	})
+}
+
+func TestAgentNetwork_UpdateBudgetRule_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/budget-rules/ainbud_test", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "PUT", r.Method)
+			retBytes, _ := json.Marshal(testAgentNetworkBudgetRule)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.UpdateBudgetRule(context.Background(), "ainbud_test", api.PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody{
+			Name: "Org monthly ceiling",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkBudgetRule, *ret)
+	})
+}
+
+func TestAgentNetwork_DeleteBudgetRule_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/budget-rules/ainbud_test", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "DELETE", r.Method)
+			_, err := w.Write([]byte("{}"))
+			require.NoError(t, err)
+		})
+		err := c.AgentNetwork.DeleteBudgetRule(context.Background(), "ainbud_test")
+		require.NoError(t, err)
+	})
+}
+
+func TestAgentNetwork_GetSettings_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal(testAgentNetworkSettings)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.GetSettings(context.Background())
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkSettings, *ret)
+	})
+}
+
+// TestAgentNetwork_GetSettings_UnbootstrappedDefaults pins the settings-read
+// contract: an unbootstrapped account answers 200 with the defaults and empty
+// cluster/subdomain/endpoint, which the client passes through untouched.
+func TestAgentNetwork_GetSettings_UnbootstrappedDefaults(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal(api.AgentNetworkSettings{
+				EnableLogCollection:    true,
+				AccessLogRetentionDays: ptr(30),
+			})
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.GetSettings(context.Background())
+		require.NoError(t, err)
+		assert.Empty(t, ret.Endpoint, "empty endpoint is the not-bootstrapped signal")
+		assert.True(t, ret.EnableLogCollection, "defaults must pass through")
+	})
+}
+
+func TestAgentNetwork_GetSettings_Err(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "no", Code: 403})
+			w.WriteHeader(403)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		_, err := c.AgentNetwork.GetSettings(context.Background())
+		require.Error(t, err)
+		assert.Equal(t, "no", err.Error())
+	})
+}
+
+// TestAgentNetwork_GetSettings_LegacyNullBody pins the compatibility shim for
+// management servers that answered 200 with a JSON null body before the
+// defaults contract: the client translates that shape into an IsNotFound
+// error instead of returning a bogus zero-valued settings object or
+// fabricating defaults the server never stated.
+func TestAgentNetwork_GetSettings_LegacyNullBody(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
+			_, err := w.Write([]byte("null"))
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.GetSettings(context.Background())
+		require.Error(t, err)
+		assert.Nil(t, ret)
+		assert.True(t, rest.IsNotFound(err), "the legacy 200+null shape must surface as IsNotFound")
+	})
+}
+
+func TestAgentNetwork_CreateSettings_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "POST", r.Method)
+			reqBytes, err := io.ReadAll(r.Body)
+			require.NoError(t, err)
+			var req api.PostApiAgentNetworkSettingsJSONRequestBody
+			require.NoError(t, json.Unmarshal(reqBytes, &req))
+			require.NotNil(t, req.ProxyAddress, "proxy address must be on the wire")
+			assert.Equal(t, "eu.proxy.netbird.io", *req.ProxyAddress)
+			assert.Nil(t, req.Endpoint, "endpoint must stay off the wire for a labeled bootstrap")
+			retBytes, _ := json.Marshal(testAgentNetworkSettings)
+			_, err = w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.CreateSettings(context.Background(), api.PostApiAgentNetworkSettingsJSONRequestBody{
+			ProxyAddress: ptr("eu.proxy.netbird.io"),
+		})
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkSettings, *ret)
+	})
+}
+
+func TestAgentNetwork_CreateSettings_Conflict(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "agent network settings already bootstrapped for account acct1", Code: 409})
+			w.WriteHeader(409)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		_, err := c.AgentNetwork.CreateSettings(context.Background(), api.PostApiAgentNetworkSettingsJSONRequestBody{
+			Endpoint: ptr("gw.example.com"),
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "already bootstrapped")
+	})
+}
+
+func TestAgentNetwork_UpdateSettings_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "PUT", r.Method)
+			reqBytes, err := io.ReadAll(r.Body)
+			require.NoError(t, err)
+			var req api.PutApiAgentNetworkSettingsJSONRequestBody
+			require.NoError(t, json.Unmarshal(reqBytes, &req))
+			assert.True(t, req.EnableLogCollection)
+			assert.Equal(t, "brave-otter.eu.proxy.netbird.io", req.Endpoint,
+				"the identity echo must be on the wire")
+			assert.Equal(t, "eu.proxy.netbird.io", req.ProxyAddress,
+				"the identity echo must be on the wire")
+			retBytes, _ := json.Marshal(testAgentNetworkSettings)
+			_, err = w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		ret, err := c.AgentNetwork.UpdateSettings(context.Background(), api.PutApiAgentNetworkSettingsJSONRequestBody{
+			Endpoint:            "brave-otter.eu.proxy.netbird.io",
+			ProxyAddress:        "eu.proxy.netbird.io",
+			EnableLogCollection: true,
+		})
+		require.NoError(t, err)
+		assert.Equal(t, testAgentNetworkSettings, *ret)
+	})
+}
+
+func TestAgentNetwork_UpdateSettings_Err(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "agent network settings have not been bootstrapped yet; POST /api/agent-network/settings to bootstrap them", Code: 404})
+			w.WriteHeader(404)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		_, err := c.AgentNetwork.UpdateSettings(context.Background(), api.PutApiAgentNetworkSettingsJSONRequestBody{
+			EnableLogCollection: true,
+		})
+		require.Error(t, err)
+		assert.True(t, rest.IsNotFound(err), "an unbootstrapped account must surface as IsNotFound")
+	})
+}
+
+func TestAgentNetwork_DeleteSettings_200(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "DELETE", r.Method)
+			_, err := w.Write([]byte("{}"))
+			require.NoError(t, err)
+		})
+		require.NoError(t, c.AgentNetwork.DeleteSettings(context.Background()))
+	})
+}
+
+func TestAgentNetwork_DeleteSettings_Guarded(t *testing.T) {
+	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
+		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
+			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "agent network settings cannot be deleted while 2 provider(s) exist; delete the providers first", Code: 412})
+			w.WriteHeader(412)
+			_, err := w.Write(retBytes)
+			require.NoError(t, err)
+		})
+		err := c.AgentNetwork.DeleteSettings(context.Background())
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "cannot be deleted")
+	})
+}
diff --git a/shared/management/client/rest/client.go b/shared/management/client/rest/client.go
index 43312b9e6..7dea4a3f0 100644
--- a/shared/management/client/rest/client.go
+++ b/shared/management/client/rest/client.go
@@ -127,10 +127,6 @@ type Client struct {
 	// see more: https://docs.netbird.io/api/resources/identity-providers
 	IdentityProviders *IdentityProvidersAPI
 
-	// Ingress NetBird Ingress Peers APIs
-	// see more: https://docs.netbird.io/api/resources/ingress-ports
-	Ingress *IngressAPI
-
 	// Instance NetBird Instance API
 	// see more: https://docs.netbird.io/api/resources/instance
 	Instance *InstanceAPI
@@ -147,6 +143,10 @@ type Client struct {
 	// ReverseProxyTokens account-scoped proxy access tokens used to register
 	// self-hosted (bring-your-own-proxy) `netbird proxy` instances.
 	ReverseProxyTokens *ReverseProxyTokensAPI
+
+	// AgentNetwork NetBird Agent Network (AI/LLM gateway) APIs: catalog,
+	// providers, policies, guardrails, budget rules and account settings.
+	AgentNetwork *AgentNetworkAPI
 }
 
 // New initialize new Client instance using PAT token
@@ -203,12 +203,12 @@ func (c *Client) initialize() {
 	c.OktaScimIDP = &OktaScimIDPAPI{c}
 	c.EventStreaming = &EventStreamingAPI{c}
 	c.IdentityProviders = &IdentityProvidersAPI{c}
-	c.Ingress = &IngressAPI{c}
 	c.Instance = &InstanceAPI{c}
 	c.ReverseProxyServices = &ReverseProxyServicesAPI{c}
 	c.ReverseProxyClusters = &ReverseProxyClustersAPI{c}
 	c.ReverseProxyDomains = &ReverseProxyDomainsAPI{c}
 	c.ReverseProxyTokens = &ReverseProxyTokensAPI{c}
+	c.AgentNetwork = &AgentNetworkAPI{c}
 }
 
 // NewRequest creates and executes new management API request
diff --git a/shared/management/client/rest/ingress.go b/shared/management/client/rest/ingress.go
deleted file mode 100644
index f69288d7e..000000000
--- a/shared/management/client/rest/ingress.go
+++ /dev/null
@@ -1,92 +0,0 @@
-package rest
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// IngressAPI APIs for Ingress Peers, do not use directly
-type IngressAPI struct {
-	c *Client
-}
-
-// List all ingress peers
-// See more: https://docs.netbird.io/api/resources/ingress#list-all-ingress-peers
-func (a *IngressAPI) List(ctx context.Context) ([]api.IngressPeer, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/ingress/peers", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.IngressPeer](resp)
-	return ret, err
-}
-
-// Get ingress peer info
-// See more: https://docs.netbird.io/api/resources/ingress#retrieve-an-ingress-peer
-func (a *IngressAPI) Get(ctx context.Context, ingressPeerID string) (*api.IngressPeer, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/ingress/peers/"+ingressPeerID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPeer](resp)
-	return &ret, err
-}
-
-// Create new ingress peer
-// See more: https://docs.netbird.io/api/resources/ingress#create-an-ingress-peer
-func (a *IngressAPI) Create(ctx context.Context, request api.PostApiIngressPeersJSONRequestBody) (*api.IngressPeer, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/ingress/peers", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPeer](resp)
-	return &ret, err
-}
-
-// Update update ingress peer
-// See more: https://docs.netbird.io/api/resources/ingress#update-an-ingress-peer
-func (a *IngressAPI) Update(ctx context.Context, ingressPeerID string, request api.PutApiIngressPeersIngressPeerIdJSONRequestBody) (*api.IngressPeer, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/ingress/peers/"+ingressPeerID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPeer](resp)
-	return &ret, err
-}
-
-// Delete delete ingress peer
-// See more: https://docs.netbird.io/api/resources/ingress#delete-an-ingress-peer
-func (a *IngressAPI) Delete(ctx context.Context, ingressPeerID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/ingress/peers/"+ingressPeerID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
diff --git a/shared/management/client/rest/ingress_test.go b/shared/management/client/rest/ingress_test.go
deleted file mode 100644
index c915db094..000000000
--- a/shared/management/client/rest/ingress_test.go
+++ /dev/null
@@ -1,184 +0,0 @@
-//go:build integration
-
-package rest_test
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/client/rest"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-)
-
-var testIngressPeer = api.IngressPeer{
-	Connected: true,
-	Enabled:   true,
-	Id:        "Test",
-}
-
-func TestIngress_List_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.IngressPeer{testIngressPeer})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.List(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testIngressPeer, ret[0])
-	})
-}
-
-func TestIngress_List_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.List(context.Background())
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestIngress_Get_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testIngressPeer)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Get(context.Background(), "Test")
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPeer, *ret)
-	})
-}
-
-func TestIngress_Get_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Get(context.Background(), "Test")
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestIngress_Create_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PostApiIngressPeersJSONRequestBody
-			err = json.Unmarshal(reqBytes, &req)
-			require.NoError(t, err)
-			assert.Equal(t, "peer-id", req.PeerId)
-			retBytes, _ := json.Marshal(testIngressPeer)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Create(context.Background(), api.PostApiIngressPeersJSONRequestBody{
-			PeerId: "peer-id",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPeer, *ret)
-	})
-}
-
-func TestIngress_Create_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Create(context.Background(), api.PostApiIngressPeersJSONRequestBody{
-			PeerId: "peer-id",
-		})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestIngress_Update_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PutApiIngressPeersIngressPeerIdJSONRequestBody
-			err = json.Unmarshal(reqBytes, &req)
-			require.NoError(t, err)
-			assert.Equal(t, true, req.Enabled)
-			retBytes, _ := json.Marshal(testIngressPeer)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Update(context.Background(), "Test", api.PutApiIngressPeersIngressPeerIdJSONRequestBody{
-			Enabled: true,
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPeer, *ret)
-	})
-}
-
-func TestIngress_Update_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Update(context.Background(), "Test", api.PutApiIngressPeersIngressPeerIdJSONRequestBody{
-			Enabled: true,
-		})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestIngress_Delete_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			w.WriteHeader(200)
-		})
-		err := c.Ingress.Delete(context.Background(), "Test")
-		require.NoError(t, err)
-	})
-}
-
-func TestIngress_Delete_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "Not found", Code: 404})
-			w.WriteHeader(404)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		err := c.Ingress.Delete(context.Background(), "Test")
-		assert.Error(t, err)
-		assert.Equal(t, "Not found", err.Error())
-	})
-}
diff --git a/shared/management/client/rest/peers.go b/shared/management/client/rest/peers.go
index b22bcae67..30faff925 100644
--- a/shared/management/client/rest/peers.go
+++ b/shared/management/client/rest/peers.go
@@ -125,98 +125,6 @@ func (a *PeersAPI) CreateTemporaryAccess(ctx context.Context, peerID string, req
 	return &ret, err
 }
 
-// PeerIngressPortsAPI APIs for Peer Ingress Ports, do not use directly
-type PeerIngressPortsAPI struct {
-	c      *Client
-	peerID string
-}
-
-// IngressPorts APIs for peer ingress ports
-func (a *PeersAPI) IngressPorts(peerID string) *PeerIngressPortsAPI {
-	return &PeerIngressPortsAPI{
-		c:      a.c,
-		peerID: peerID,
-	}
-}
-
-// List list all ingress port allocations for a peer
-// See more: https://docs.netbird.io/api/resources/peers#list-all-ingress-port-allocations
-func (a *PeerIngressPortsAPI) List(ctx context.Context) ([]api.IngressPortAllocation, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/peers/"+a.peerID+"/ingress/ports", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.IngressPortAllocation](resp)
-	return ret, err
-}
-
-// Get get ingress port allocation info
-// See more: https://docs.netbird.io/api/resources/peers#retrieve-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Get(ctx context.Context, allocationID string) (*api.IngressPortAllocation, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/peers/"+a.peerID+"/ingress/ports/"+allocationID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPortAllocation](resp)
-	return &ret, err
-}
-
-// Create create new ingress port allocation
-// See more: https://docs.netbird.io/api/resources/peers#create-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Create(ctx context.Context, request api.PostApiPeersPeerIdIngressPortsJSONRequestBody) (*api.IngressPortAllocation, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/peers/"+a.peerID+"/ingress/ports", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPortAllocation](resp)
-	return &ret, err
-}
-
-// Update update ingress port allocation
-// See more: https://docs.netbird.io/api/resources/peers#update-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Update(ctx context.Context, allocationID string, request api.PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody) (*api.IngressPortAllocation, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/peers/"+a.peerID+"/ingress/ports/"+allocationID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPortAllocation](resp)
-	return &ret, err
-}
-
-// Delete delete ingress port allocation
-// See more: https://docs.netbird.io/api/resources/peers#delete-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Delete(ctx context.Context, allocationID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/peers/"+a.peerID+"/ingress/ports/"+allocationID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
 // PeerJobsAPI APIs for Peer Jobs, do not use directly
 type PeerJobsAPI struct {
 	c      *Client
diff --git a/shared/management/client/rest/peers_test.go b/shared/management/client/rest/peers_test.go
index 5724b57f9..7370b238b 100644
--- a/shared/management/client/rest/peers_test.go
+++ b/shared/management/client/rest/peers_test.go
@@ -31,11 +31,6 @@ var (
 		Name: "test-peer",
 	}
 
-	testIngressPortAllocation = api.IngressPortAllocation{
-		Enabled: true,
-		Id:      "alloc-1",
-	}
-
 	testJobResponse = api.JobResponse{
 		Id:     "job-1",
 		Status: "pending",
@@ -221,146 +216,6 @@ func TestPeers_CreateTemporaryAccess_Err(t *testing.T) {
 	})
 }
 
-func TestPeerIngressPorts_List_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.IngressPortAllocation{testIngressPortAllocation})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").List(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testIngressPortAllocation, ret[0])
-	})
-}
-
-func TestPeerIngressPorts_List_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").List(context.Background())
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Get_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testIngressPortAllocation)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Get(context.Background(), "alloc-1")
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPortAllocation, *ret)
-	})
-}
-
-func TestPeerIngressPorts_Get_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Get(context.Background(), "alloc-1")
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Create_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			retBytes, _ := json.Marshal(testIngressPortAllocation)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Create(context.Background(), api.PostApiPeersPeerIdIngressPortsJSONRequestBody{})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPortAllocation, *ret)
-	})
-}
-
-func TestPeerIngressPorts_Create_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Create(context.Background(), api.PostApiPeersPeerIdIngressPortsJSONRequestBody{})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Update_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			retBytes, _ := json.Marshal(testIngressPortAllocation)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Update(context.Background(), "alloc-1", api.PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody{})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPortAllocation, *ret)
-	})
-}
-
-func TestPeerIngressPorts_Update_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Update(context.Background(), "alloc-1", api.PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody{})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Delete_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			w.WriteHeader(200)
-		})
-		err := c.Peers.IngressPorts("Test").Delete(context.Background(), "alloc-1")
-		require.NoError(t, err)
-	})
-}
-
-func TestPeerIngressPorts_Delete_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "Not found", Code: 404})
-			w.WriteHeader(404)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		err := c.Peers.IngressPorts("Test").Delete(context.Background(), "alloc-1")
-		assert.Error(t, err)
-		assert.Equal(t, "Not found", err.Error())
-	})
-}
-
 func TestPeerJobs_List_200(t *testing.T) {
 	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
 		mux.HandleFunc("/api/peers/Test/jobs", func(w http.ResponseWriter, r *http.Request) {
diff --git a/shared/management/grpc/sync_message_versions.go b/shared/management/grpc/sync_message_versions.go
new file mode 100644
index 000000000..4852408f7
--- /dev/null
+++ b/shared/management/grpc/sync_message_versions.go
@@ -0,0 +1,67 @@
+package grpc
+
+import (
+	"errors"
+	"fmt"
+)
+
+type SyncMessageVersion uint16
+
+const (
+	Base SyncMessageVersion = iota
+	ComponentNetworkMap
+)
+
+const DefaultSyncMessageVersion = Base
+const HighestSyncMessageVersion = ComponentNetworkMap
+
+var ErrorUnrecognizedSyncMessageVersion = errors.New("unrecognized SyncMessageVersion")
+
+func ValidateSyncMessageVersion(v *int) error {
+	// empty list == we support all available versions
+	if v == nil {
+		return nil
+	}
+	if *v < 0 || *v > int(HighestSyncMessageVersion) {
+		return fmt.Errorf("sync message version must between 0 and %d, %w", HighestSyncMessageVersion, ErrorUnrecognizedSyncMessageVersion)
+	}
+	return nil
+}
+
+// returns SyncMessage version from config, or highest available version if the config is missing or
+// base if it is invalid
+// the assumption is ValidateSyncMessageVersion() has been called before using SyncMessageVersionFromConfig()
+func SyncMessageVersionFromConfig(v *int) SyncMessageVersion {
+	if v == nil {
+		return DefaultSyncMessageVersion
+	}
+	if *v < 0 || *v > int(HighestSyncMessageVersion) {
+		return Base
+	}
+
+	return SyncMessageVersion(*v)
+}
+
+// convert per-account supported versions to SyncMessageVersion
+// the assumption is ValidateSyncMessageVersion() has been called before using SyncMessageVersionsFromMap()
+func SyncMessageVersionsFromMap(toconvert map[string]int) map[string]SyncMessageVersion {
+	// no per-account overrides
+	if len(toconvert) == 0 {
+		return nil
+	}
+
+	toret := make(map[string]SyncMessageVersion)
+
+	for account, version := range toconvert {
+		toret[account] = SyncMessageVersionFromConfig(&version)
+	}
+	return toret
+}
+
+// return highest common sync message version, or Default (which is always available)
+func HighestCommonSyncMessageVersion(a SyncMessageVersion, b SyncMessageVersion) SyncMessageVersion {
+	if a > b {
+		return b
+	}
+	return a
+}
diff --git a/shared/management/grpc/sync_message_versions_test.go b/shared/management/grpc/sync_message_versions_test.go
new file mode 100644
index 000000000..300274059
--- /dev/null
+++ b/shared/management/grpc/sync_message_versions_test.go
@@ -0,0 +1,39 @@
+package grpc
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidation(t *testing.T) {
+	assert.NoError(t, ValidateSyncMessageVersion(nil))
+	assert.NoError(t, ValidateSyncMessageVersion(toIntPtr(0)))
+	assert.NoError(t, ValidateSyncMessageVersion(toIntPtr(1)))
+	assert.ErrorIs(t, ValidateSyncMessageVersion(toIntPtr(int(^uint(0)>>1))), ErrorUnrecognizedSyncMessageVersion)
+	assert.ErrorIs(t, ValidateSyncMessageVersion(toIntPtr(-1)), ErrorUnrecognizedSyncMessageVersion)
+}
+
+func TestVersionFromConfig(t *testing.T) {
+	assert.Equal(t, DefaultSyncMessageVersion, SyncMessageVersionFromConfig(nil))
+	assert.Equal(t, Base, SyncMessageVersionFromConfig(toIntPtr(0)))
+	assert.Equal(t, ComponentNetworkMap, SyncMessageVersionFromConfig(toIntPtr(1)))
+	assert.Equal(t, DefaultSyncMessageVersion, SyncMessageVersionFromConfig(toIntPtr(-1)))
+	assert.Equal(t, DefaultSyncMessageVersion, SyncMessageVersionFromConfig(toIntPtr(int(^uint(0)>>1))))
+}
+
+func TestPerAccountConversionStringToEnum(t *testing.T) {
+	assert.Equal(t, map[string]SyncMessageVersion{"1": HighestSyncMessageVersion}, SyncMessageVersionsFromMap(map[string]int{"1": 1}))
+	assert.Equal(t, map[string]SyncMessageVersion{"2": DefaultSyncMessageVersion}, SyncMessageVersionsFromMap(map[string]int{"2": -1}))
+}
+
+func TestCommonVersions(t *testing.T) {
+	assert.Equal(t, Base, HighestCommonSyncMessageVersion(Base, HighestSyncMessageVersion))
+	assert.Equal(t, Base, HighestCommonSyncMessageVersion(HighestSyncMessageVersion, Base))
+	assert.Equal(t, Base, HighestCommonSyncMessageVersion(Base, Base))
+	assert.Equal(t, HighestSyncMessageVersion, HighestCommonSyncMessageVersion(HighestSyncMessageVersion, HighestSyncMessageVersion))
+}
+
+func toIntPtr(v int) *int {
+	return &v
+}
diff --git a/shared/management/http/api/generate.sh b/shared/management/http/api/generate.sh
index ba29a6905..8f563e99a 100755
--- a/shared/management/http/api/generate.sh
+++ b/shared/management/http/api/generate.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 if ! which realpath > /dev/null 2>&1
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index f746b31f4..ca8c1339b 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -31,9 +31,6 @@ tags:
     description: View information about the account and network events.
   - name: Accounts
     description: View information about the accounts.
-  - name: Ingress Ports
-    description: Interact with and view information about the ingress peers and ports.
-    x-cloud-only: true
   - name: Identity Providers
     description: Interact with and view information about identity providers.
   - name: Services
@@ -154,6 +151,14 @@ components:
           type: boolean
           description: Whether sensitive data should be anonymized in the bundle.
           example: false
+        anonymize_level:
+          type: string
+          description: How much the anonymizer redacts. "default" (or empty) keeps internal IP ranges, "strict" also anonymizes them.
+          example: strict
+        upload_url:
+          type: string
+          description: Service URL the client requests an upload URL from before uploading the bundle. Empty selects the default upload server.
+          example: https://upload.debug.netbird.io
       required:
         - bundle_for
         - bundle_for_time
@@ -375,6 +380,16 @@ components:
           description: Enables or disables client metrics push for all peers in the account
           type: boolean
           example: false
+        peer_hostname_collision_rejected:
+          description: When enabled, registering or renaming a peer to a hostname already used by another peer in the account fails instead of receiving an IP-based suffix. Applies to ephemeral peers as well.
+          type: boolean
+          example: false
+        agent_network_only:
+          description: Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
+          type: boolean
+          example: false
+        dashboard_features:
+          $ref: '#/components/schemas/AccountDashboardFeatures'
         embedded_idp_enabled:
           description: Indicates whether the embedded identity provider (Dex) is enabled for this account. This is a read-only field.
           type: boolean
@@ -403,6 +418,14 @@ components:
         - regular_users_view_blocked
         - peer_expose_enabled
         - peer_expose_groups
+    AccountDashboardFeatures:
+      description: Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
+      type: object
+      properties:
+        agent_network:
+          description: Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies. Must be true when agent_network_only is enabled.
+          type: boolean
+          example: true
     AccountExtraSettings:
       type: object
       properties:
@@ -804,6 +827,20 @@ components:
         - ssh_enabled
         - login_expiration_enabled
         - inactivity_expiration_enabled
+    NetworkAddress:
+      type: object
+      properties:
+        net_ip:
+          description: IP address with CIDR of the interface
+          type: string
+          example: 192.168.0.11/24
+        mac:
+          description: MAC address of the interface
+          type: string
+          example: "00:93:37:bd:83:0f"
+      required:
+        - net_ip
+        - mac
     Peer:
       allOf:
         - $ref: '#/components/schemas/PeerMinimum'
@@ -823,6 +860,11 @@ components:
               type: string
               format: ipv6
               example: "fd00:4e42:ab12::1"
+            network_addresses:
+              description: Network interfaces (IP + MAC) reported by the peer
+              type: array
+              items:
+                $ref: '#/components/schemas/NetworkAddress'
             connection_ip:
               description: Peer's public connection IP address
               type: string
@@ -962,6 +1004,10 @@ components:
           description: Indicates whether SSH access this peer is allowed or not
           type: boolean
           example: true
+        remote_jobs_allowed:
+          description: Indicates whether the peer has opted into management-requested remote jobs (e.g. debug bundles)
+          type: boolean
+          example: true
         disable_client_routes:
           description: Indicates whether client routes are disabled on this peer or not
           type: boolean
@@ -1419,13 +1465,14 @@ components:
           enum: [ "all", "tcp", "udp", "icmp", "netbird-ssh" ]
           example: "tcp"
         ports:
-          description: Policy rule affected ports
+          description: Policy rule affected ports. Mutually exclusive with `port_ranges`. A rule accepts either individual ports or port ranges, not both.
+          x-omit-from-example: true
           type: array
           items:
             type: string
             example: "80"
         port_ranges:
-          description: Policy rule affected ports ranges list
+          description: Policy rule affected ports ranges list. Mutually exclusive with `ports`. To mix individual ports with ranges in one rule, express each single port as a range with identical start and end values (for example, start 443, end 443).
           type: array
           items:
             $ref: '#/components/schemas/RulePortRange'
@@ -1445,7 +1492,7 @@ components:
         - action
 
     RulePortRange:
-      description: Policy rule affected ports range
+      description: Policy rule affected ports range. A range with identical start and end values represents a single port.
       type: object
       properties:
         start:
@@ -1648,6 +1695,8 @@ components:
           $ref: '#/components/schemas/PeerNetworkRangeCheck'
         process_check:
           $ref: '#/components/schemas/ProcessCheck'
+        certificate_check:
+          $ref: '#/components/schemas/CertificateCheck'
     NBVersionCheck:
       description: Posture check for the version of NetBird
       type: object
@@ -1765,6 +1814,19 @@ components:
           description: Path to the process executable file in a Windows operating system
           type: string
           example: "C:\ProgramData\NetBird\netbird.exe"
+    CertificateCheck:
+      description: Posture check for a certificate held by the peer that chains to one of the given CA certificates. Not supported on mobile devices (iOS and Android), which always fail this check and are denied access
+      type: object
+      properties:
+        ca_certificates:
+          description: PEM encoded CA certificates the peer's certificate must chain to
+          type: array
+          minItems: 1
+          items:
+            type: string
+          example: ["-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----"]
+      required:
+        - ca_certificates
     Location:
       description: Describe geographical location information
       type: object
@@ -2393,222 +2455,6 @@ components:
         - initiator_email
         - target_id
         - meta
-    IngressPeerCreateRequest:
-      type: object
-      properties:
-        peer_id:
-          description: ID of the peer that is used as an ingress peer
-          type: string
-          example: ch8i4ug6lnn4g9hqv7m0
-        enabled:
-          description: Defines if an ingress peer is enabled
-          type: boolean
-          example: true
-        fallback:
-          description: Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-          type: boolean
-          example: true
-      required:
-        - peer_id
-        - enabled
-        - fallback
-    IngressPeerUpdateRequest:
-      type: object
-      properties:
-        enabled:
-          description: Defines if an ingress peer is enabled
-          type: boolean
-          example: true
-        fallback:
-          description: Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-          type: boolean
-          example: true
-      required:
-        - enabled
-        - fallback
-    IngressPeer:
-      type: object
-      properties:
-        id:
-          description: ID of the ingress peer
-          type: string
-          example: ch8i4ug6lnn4g9hqv7m0
-        peer_id:
-          description: ID of the peer that is used as an ingress peer
-          type: string
-          example: x7p3kqf2rdd8j5zxw4n9
-        ingress_ip:
-          description: Ingress IP address of the ingress peer where the traffic arrives
-          type: string
-          example: 192.34.0.123
-        available_ports:
-          $ref: '#/components/schemas/AvailablePorts'
-        enabled:
-          description: Indicates if an ingress peer is enabled
-          type: boolean
-          example: true
-        connected:
-          description: Indicates if an ingress peer is connected to the management server
-          type: boolean
-          example: true
-        fallback:
-          description: Indicates if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-          type: boolean
-          example: true
-        region:
-          description: Region of the ingress peer
-          type: string
-          example: germany
-      required:
-        - id
-        - peer_id
-        - ingress_ip
-        - available_ports
-        - enabled
-        - connected
-        - fallback
-        - region
-    AvailablePorts:
-      type: object
-      properties:
-        tcp:
-          description: Number of available TCP  ports left on the ingress peer
-          type: integer
-          example: 45765
-        udp:
-          description: Number of available UDP ports left on the ingress peer
-          type: integer
-          example: 50000
-      required:
-        - tcp
-        - udp
-    IngressPortAllocationRequest:
-      type: object
-      properties:
-        name:
-          description: Name of the ingress port allocation
-          type: string
-          example: Ingress Port Allocation 1
-        enabled:
-          description: Indicates if an ingress port allocation is enabled
-          type: boolean
-          example: true
-        port_ranges:
-          description: List of port ranges that are forwarded by the ingress peer
-          type: array
-          items:
-            $ref: '#/components/schemas/IngressPortAllocationRequestPortRange'
-        direct_port:
-          description: Direct port allocation
-          $ref: '#/components/schemas/IngressPortAllocationRequestDirectPort'
-      required:
-        - name
-        - enabled
-    IngressPortAllocationRequestPortRange:
-      type: object
-      properties:
-        start:
-          description: The starting port of the range of forwarded ports
-          type: integer
-          example: 80
-        end:
-          description: The ending port of the range of forwarded ports
-          type: integer
-          example: 320
-        protocol:
-          description: The protocol accepted by the port range
-          type: string
-          enum: [ "tcp", "udp", "tcp/udp" ]
-          example: tcp
-      required:
-        - start
-        - end
-        - protocol
-    IngressPortAllocationRequestDirectPort:
-      type: object
-      properties:
-        count:
-          description: The number of ports to be forwarded
-          type: integer
-          example: 5
-        protocol:
-          description: The protocol accepted by the port
-          type: string
-          enum: [ "tcp", "udp", "tcp/udp" ]
-          example: udp
-      required:
-        - count
-        - protocol
-    IngressPortAllocation:
-      type: object
-      properties:
-        id:
-          description: ID of the ingress port allocation
-          type: string
-          example: ch8i4ug6lnn4g9hqv7m0
-        name:
-          description: Name of the ingress port allocation
-          type: string
-          example: Ingress Peer Allocation 1
-        ingress_peer_id:
-          description: ID of the ingress peer that forwards the ports
-          type: string
-          example: x7p3kqf2rdd8j5zxw4n9
-        region:
-          description: Region of the ingress peer
-          type: string
-          example: germany
-        enabled:
-          description: Indicates if an ingress port allocation is enabled
-          type: boolean
-          example: true
-        ingress_ip:
-          description: Ingress IP address of the ingress peer where the traffic arrives
-          type: string
-          example: 192.34.0.123
-        port_range_mappings:
-          description: List of port ranges that are allowed to be used by the ingress peer
-          type: array
-          items:
-            $ref: '#/components/schemas/IngressPortAllocationPortMapping'
-      required:
-        - id
-        - name
-        - ingress_peer_id
-        - region
-        - enabled
-        - ingress_ip
-        - port_range_mappings
-    IngressPortAllocationPortMapping:
-      type: object
-      properties:
-        translated_start:
-          description: The starting port of the translated range of forwarded ports
-          type: integer
-          example: 80
-        translated_end:
-          description: The ending port of the translated range of forwarded ports
-          type: integer
-          example: 320
-        ingress_start:
-          description: The starting port of the range of ingress ports mapped to the forwarded ports
-          type: integer
-          example: 1080
-        ingress_end:
-          description: The ending port of the range of ingress ports mapped to the forwarded ports
-          type: integer
-          example: 1320
-        protocol:
-          description: Protocol accepted by the ports
-          type: string
-          enum: [ "tcp", "udp", "tcp/udp" ]
-          example: tcp
-      required:
-        - translated_start
-        - translated_end
-        - ingress_start
-        - ingress_end
-        - protocol
     NetworkTrafficLocation:
       type: object
       properties:
@@ -2769,6 +2615,28 @@ components:
           type: integer
           description: "Number of packets transmitted."
           example: 5
+        num_of_starts:
+          type: integer
+          description: "Number of start events."
+          example: 3
+        num_of_ends:
+          type: integer
+          description: "Number of end events."
+          example: 4
+        num_of_drops:
+          type: integer
+          description: "Number of drop events."
+          example: 5
+        window_start:
+          type: string
+          format: date-time
+          description: Timestamp of the start of the aggregation window.
+          example: 2025-03-20T16:23:58.125397Z
+        window_end:
+          type: string
+          format: date-time
+          description: Timestamp of the end of the aggregation window.
+          example: 2025-03-20T16:23:58.125397Z
         events:
           type: array
           description: "List of events that are correlated to this flow (e.g., start, end)."
@@ -2790,6 +2658,11 @@ components:
         - rx_packets
         - tx_bytes
         - tx_packets
+        - num_of_starts
+        - num_of_ends
+        - num_of_drops
+        - window_start
+        - window_end
         - events
     NetworkTrafficEventsResponse:
       type: object
@@ -3236,6 +3109,12 @@ components:
           type: string
           description: URL path prefix for this target (HTTP only)
           example: "/"
+        access_action:
+          type: string
+          description: Access action applied after this target's HTTP path prefix is selected. "inherit" uses the service authentication configuration, "bypass" skips service authentication, and "block" denies access. HTTP services only.
+          enum: [inherit, bypass, block]
+          default: inherit
+          example: "inherit"
         protocol:
           type: string
           description: Protocol to use when connecting to the backend
@@ -4566,7 +4445,7 @@ components:
 
     FleetDMMatchAttributes:
       type: object
-      description: Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
+      description: Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
       additionalProperties: false
       properties:
         disk_encryption_enabled:
@@ -5108,12 +4987,12 @@ components:
         identity_header_user_id:
           type: string
           description: |
-            Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
+            Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
           example: "x-bf-dim-netbird_user_id"
         identity_header_groups:
           type: string
           description: |
-            Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
+            Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
           example: "x-bf-dim-netbird_groups"
         enabled:
           type: boolean
@@ -5123,6 +5002,10 @@ components:
           type: boolean
           description: Whether upstream TLS certificate verification is skipped when the proxy dials this provider's URL. Intended for self-hosted / internal gateways behind a private or self-signed certificate.
           example: false
+        metadata_disabled:
+          type: boolean
+          description: Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
+          example: false
         created_at:
           type: string
           format: date-time
@@ -5141,8 +5024,11 @@ components:
         - name
         - upstream_url
         - models
+        - identity_header_user_id
+        - identity_header_groups
         - enabled
         - skip_tls_verification
+        - metadata_disabled
         - created_at
         - updated_at
     AgentNetworkProviderRequest:
@@ -5160,10 +5046,6 @@ components:
           type: string
           description: Full upstream URL (with scheme) that NetBird forwards traffic to.
           example: "https://api.openai.com"
-        bootstrap_cluster:
-          type: string
-          description: Proxy cluster used to bootstrap the per-account agent-network endpoint when the first provider is created. Ignored on subsequent creates and on updates because the cluster is pinned on the account-level Settings row.
-          example: "eu.proxy.netbird.io"
         api_key:
           type: string
           description: Upstream provider API key. Sealed at rest on the management server and never returned in responses. Required on create; optional on update (omit to keep the existing key).
@@ -5176,7 +5058,7 @@ components:
         extra_values:
           type: object
           description: |
-            Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). When present on a request, the whole map replaces the stored values. Empty strings drop the corresponding key.
+            Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). The request's map replaces the stored values; empty strings drop the corresponding key.
           additionalProperties:
             type: string
           example:
@@ -5184,12 +5066,12 @@ components:
         identity_header_user_id:
           type: string
           description: |
-            Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
+            Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. Empty or omitted disables stamping for this dimension.
           example: "x-bf-dim-netbird_user_id"
         identity_header_groups:
           type: string
           description: |
-            Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same omit / empty semantics as `identity_header_user_id`.
+            Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same semantics as `identity_header_user_id`.
           example: "x-bf-dim-netbird_groups"
         enabled:
           type: boolean
@@ -5197,7 +5079,11 @@ components:
           example: true
         skip_tls_verification:
           type: boolean
-          description: Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
+          description: Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false.
+          example: false
+        metadata_disabled:
+          type: boolean
+          description: Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected).
           example: false
       required:
         - provider_id
@@ -5221,6 +5107,21 @@ components:
           format: double
           description: Cost per 1k output tokens, in USD.
           example: 0.0006
+        cached_input_per_1k:
+          type: number
+          format: double
+          description: OpenAI-shape cache rate — cost per 1k cached prompt tokens (a subset of input tokens), in USD. Omitted means inherit NetBird's default rate for this model when one exists; 0 means no discount (cached tokens bill at input_per_1k).
+          example: 0.000075
+        cache_read_per_1k:
+          type: number
+          format: double
+          description: Anthropic-shape cache rate — cost per 1k cache-read tokens (additive to input tokens), in USD. Omitted means inherit NetBird's default rate for this model when one exists; 0 means cache reads bill at input_per_1k.
+          example: 0.0003
+        cache_creation_per_1k:
+          type: number
+          format: double
+          description: Anthropic-shape cache rate — cost per 1k cache-creation tokens (additive to input tokens), in USD. Omitted means inherit NetBird's default rate for this model when one exists; 0 means cache writes bill at input_per_1k.
+          example: 0.00375
       required:
         - id
         - input_per_1k
@@ -5246,6 +5147,21 @@ components:
           format: double
           description: Output token price per 1k tokens, in USD.
           example: 0.015
+        cached_input_per_1k:
+          type: number
+          format: double
+          description: OpenAI-shape cache rate — default cost per 1k cached prompt tokens (a subset of input tokens), in USD. Absent when the model has no cached-input discount.
+          example: 0.000075
+        cache_read_per_1k:
+          type: number
+          format: double
+          description: Anthropic-shape cache rate — default cost per 1k cache-read tokens (additive to input tokens), in USD. Absent when the model has no cache-read rate.
+          example: 0.0003
+        cache_creation_per_1k:
+          type: number
+          format: double
+          description: Anthropic-shape cache rate — default cost per 1k cache-creation tokens (additive to input tokens), in USD. Absent when the model has no cache-creation rate.
+          example: 0.00375
         context_window:
           type: integer
           description: Maximum context window in tokens.
@@ -5256,6 +5172,84 @@ components:
         - input_per_1k
         - output_per_1k
         - context_window
+    AgentNetworkModelDiscoveryRequest:
+      type: object
+      properties:
+        catalog_provider_id:
+          type: string
+          description: Catalog provider to query (AgentNetworkCatalogProvider.id). Determines the listing endpoint, the auth header and the response shape.
+          example: "bedrock_api"
+        upstream_url:
+          type: string
+          description: |
+            The upstream being configured. Used to reach vendors that serve their listing from the same host as inference, and to read back the region for those whose host embeds one. Sent alongside provider_id, it overrides the stored upstream, so an edit can be listed against the URL on the form before it is saved.
+          example: "https://bedrock-runtime.eu-central-1.amazonaws.com"
+        api_key:
+          type: string
+          description: Credential to query the vendor with, for a provider that has not been saved yet. Mutually exclusive with provider_id.
+          example: "sk-..."
+        provider_id:
+          type: string
+          description: Existing Agent Network provider record to query with. Its stored credential is used, and its upstream unless upstream_url overrides it, so the form can refresh the list without the client holding the key.
+          example: "ch8i4ug6lnn4g9hqv7m0"
+      required:
+        - catalog_provider_id
+    AgentNetworkModelDiscoveryResponse:
+      type: object
+      properties:
+        models:
+          type: array
+          description: Models the credential can reach, in the order the vendor returned them.
+          items:
+            $ref: '#/components/schemas/AgentNetworkDiscoveredModel'
+      required:
+        - models
+    AgentNetworkDiscoveredModel:
+      type: object
+      properties:
+        id:
+          type: string
+          description: |
+            Identifier to register on the provider record, in the form the vendor issues it. For Bedrock this is the region-prefixed inference-profile id, which is the only form AWS accepts at invoke time.
+          example: "eu.anthropic.claude-haiku-4-5-20251001-v1:0"
+        label:
+          type: string
+          description: Vendor-supplied display name, where the vendor supplies one.
+          example: "EU Anthropic Claude Haiku 4.5"
+        pricing_known:
+          type: boolean
+          description: Whether NetBird's shipped pricing table can price this model. When false the rates below are all zero and the operator must set them, or requests to this model would record a cost of zero.
+          example: true
+        input_per_1k:
+          type: number
+          format: double
+          description: Default input token price per 1k tokens, in USD, from the same table the proxy bills with. Zero when pricing_known is false.
+          example: 0.005
+        output_per_1k:
+          type: number
+          format: double
+          description: Default output token price per 1k tokens, in USD. Zero when pricing_known is false.
+          example: 0.015
+        cached_input_per_1k:
+          type: number
+          format: double
+          description: OpenAI-shape cache rate — default cost per 1k cached prompt tokens (a subset of input tokens), in USD. Absent when the model has no cached-input discount.
+          example: 0.000075
+        cache_read_per_1k:
+          type: number
+          format: double
+          description: Anthropic-shape cache rate — default cost per 1k cache-read tokens (additive to input tokens), in USD. Absent when the model has no cache-read rate.
+          example: 0.0003
+        cache_creation_per_1k:
+          type: number
+          format: double
+          description: Anthropic-shape cache rate — default cost per 1k cache-creation tokens (additive to input tokens), in USD. Absent when the model has no cache-creation rate.
+          example: 0.00375
+      required:
+        - id
+        - pricing_known
+        - input_per_1k
+        - output_per_1k
     AgentNetworkCatalogProvider:
       type: object
       properties:
@@ -5304,6 +5298,13 @@ components:
             $ref: '#/components/schemas/AgentNetworkCatalogExtraHeader'
         identity_injection:
           $ref: '#/components/schemas/AgentNetworkCatalogIdentityInjection'
+        pricing_surfaces:
+          type: array
+          description: |
+            Cost-meter pricing surfaces this provider's traffic is metered under ("openai", "anthropic", "bedrock"). Tells the dashboard which cache-rate fields apply to this provider's models: "openai" → cached_input_per_1k (cached prompt tokens are a subset of input); "anthropic"/"bedrock" → cache_read_per_1k + cache_creation_per_1k (additive buckets). Absent/empty for gateway and custom entries, whose upstream shape NetBird cannot know ahead of time — surface all cache fields for those.
+          items:
+            type: string
+          example: ["openai"]
         models:
           type: array
           description: Catalog models available for this provider.
@@ -5643,6 +5644,57 @@ components:
       required:
         - name
         - checks
+    AgentNetworkAgentConfig:
+      type: object
+      description: The caller-scoped Agent Network connection config backing the self-service "Connect your agent" view. Available to every authenticated user; the providers are computed from the caller's own groups and the answer carries display metadata only.
+      properties:
+        configured:
+          type: boolean
+          description: False only when the account has no Agent Network set up. A caller that no policy covers yet still reads as configured, with an empty providers list.
+        endpoint:
+          type: string
+          description: The account's Agent Network base URL, reachable over the NetBird tunnel only. Returned to every member of a configured account - it authorizes nothing on its own, since the gateway still refuses every request no policy permits. Empty when configured is false.
+          example: https://calm-otter.proxy.example.com
+        providers:
+          type: array
+          description: The providers at least one of the caller's policies authorizes, in creation order. Empty when no policy covers the caller.
+          items:
+            $ref: '#/components/schemas/AgentNetworkAgentConfigProvider'
+      required:
+        - configured
+        - endpoint
+        - providers
+    AgentNetworkAgentConfigProvider:
+      type: object
+      description: One provider the caller may use, reduced to what a local tool needs for configuration.
+      properties:
+        name:
+          type: string
+          description: Operator-assigned provider label.
+          example: Bedrock prod
+        catalog_id:
+          type: string
+          description: Catalog entry id naming the provider type.
+          example: bedrock_api
+        api_flavor:
+          type: string
+          description: Request-body shape the provider speaks ("anthropic", "openai"). Empty when the gateway dispatches it by URL path instead.
+          example: anthropic
+        all_models_allowed:
+          type: boolean
+          description: True when no model allowlist restricts this provider for the caller; models then lists the declared or catalog models as a courtesy.
+        models:
+          type: array
+          description: The effective model allowlist for the caller (or the declared/catalog models when all_models_allowed is true).
+          items:
+            type: string
+          example: [ "anthropic.claude-sonnet-4-5" ]
+      required:
+        - name
+        - catalog_id
+        - api_flavor
+        - all_models_allowed
+        - models
     AgentNetworkConsumption:
       type: object
       description: One per-(dimension, window) consumption counter row. The proxy ticks one row per dimension on every served LLM request; the dashboard reads this listing to surface live counter growth.
@@ -5772,13 +5824,48 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens consumed.
+          description: Total tokens consumed, including prompt-cache tokens.
           example: 1840
+        cached_input_tokens:
+          type: integer
+          format: int64
+          description: Input tokens read from the provider's prompt cache. Additive to input_tokens for Anthropic-shape providers; a subset of input_tokens for OpenAI.
+          example: 0
+        cache_creation_tokens:
+          type: integer
+          format: int64
+          description: Input tokens written to the provider's prompt cache. Zero for providers without a cache-write bucket.
+          example: 30528
         cost_usd:
           type: number
           format: double
           description: Estimated USD cost of the request.
           example: 0.0231
+        input_cost_usd:
+          type: number
+          format: double
+          description: Cost of the non-cached input tokens. Base component of cost_usd.
+          example: 0.0048
+        cached_input_cost_usd:
+          type: number
+          format: double
+          description: Cost of the prompt-cache read tokens. Base component of cost_usd, and part of cache_cost_usd.
+          example: 0.0015
+        cache_creation_cost_usd:
+          type: number
+          format: double
+          description: Cost of the prompt-cache write tokens. Base component of cost_usd, and part of cache_cost_usd.
+          example: 0.1130
+        output_cost_usd:
+          type: number
+          format: double
+          description: Cost of the output tokens. Base component of cost_usd.
+          example: 0.0038
+        cache_cost_usd:
+          type: number
+          format: double
+          description: Portion of cost_usd billed for prompt-cache usage.
+          example: 0.1145
         stream:
           type: boolean
           description: Whether the request was a streaming completion.
@@ -5802,7 +5889,14 @@ components:
         - input_tokens
         - output_tokens
         - total_tokens
+        - cached_input_tokens
+        - cache_creation_tokens
+        - input_cost_usd
+        - cached_input_cost_usd
+        - cache_creation_cost_usd
+        - output_cost_usd
         - cost_usd
+        - cache_cost_usd
     AgentNetworkAccessLogsResponse:
       type: object
       properties:
@@ -5876,13 +5970,48 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens across the session.
+          description: Total tokens across the session, including prompt-cache tokens.
           example: 12880
+        cached_input_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache read tokens across the session.
+          example: 0
+        cache_creation_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache write tokens across the session.
+          example: 30528
         cost_usd:
           type: number
           format: double
           description: Total estimated USD cost across the session.
           example: 0.1617
+        input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of non-cached input tokens across the session.
+          example: 0.0210
+        cached_input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache read tokens across the session.
+          example: 0.0015
+        cache_creation_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache write tokens across the session.
+          example: 0.1130
+        output_cost_usd:
+          type: number
+          format: double
+          description: Total cost of output tokens across the session.
+          example: 0.0262
+        cache_cost_usd:
+          type: number
+          format: double
+          description: Portion of cost_usd billed for prompt-cache usage across the session.
+          example: 0.1145
         providers:
           type: array
           items:
@@ -5909,7 +6038,14 @@ components:
         - input_tokens
         - output_tokens
         - total_tokens
+        - cached_input_tokens
+        - cache_creation_tokens
+        - input_cost_usd
+        - cached_input_cost_usd
+        - cache_creation_cost_usd
+        - output_cost_usd
         - cost_usd
+        - cache_cost_usd
         - decision
         - entries
     AgentNetworkAccessLogSessionsResponse:
@@ -5963,35 +6099,77 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens in the bucket.
+          description: Total tokens in the bucket, including prompt-cache tokens.
           example: 184000
+        cached_input_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache read tokens in the bucket.
+          example: 20000
+        cache_creation_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache write tokens in the bucket.
+          example: 45000
+        input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of non-cached input tokens in the bucket.
+          example: 1.12
+        cached_input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache read tokens in the bucket.
+          example: 0.06
+        cache_creation_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache write tokens in the bucket.
+          example: 0.36
+        output_cost_usd:
+          type: number
+          format: double
+          description: Total cost of output tokens in the bucket.
+          example: 0.77
         cost_usd:
           type: number
           format: double
           description: Total estimated USD spend in the bucket.
           example: 2.31
+        cache_cost_usd:
+          type: number
+          format: double
+          description: Portion of cost_usd billed for prompt-cache usage in the bucket.
+          example: 0.42
       required:
         - period_start
         - input_tokens
         - output_tokens
         - total_tokens
+        - cached_input_tokens
+        - cache_creation_tokens
+        - input_cost_usd
+        - cached_input_cost_usd
+        - cache_creation_cost_usd
+        - output_cost_usd
         - cost_usd
+        - cache_cost_usd
     AgentNetworkSettings:
       type: object
-      description: Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.
+      description: Per-account Agent Network gateway settings. One row per account; endpoint and proxy_address are assigned at bootstrap (POST) and immutable thereafter. Before bootstrap the account reads as the default values with empty endpoint and proxy_address.
       properties:
-        cluster:
-          type: string
-          description: Address of the NetBird proxy cluster fronting this account's agent-network endpoint.
-          example: "eu.proxy.netbird.io"
-        subdomain:
-          type: string
-          description: Auto-generated DNS-safe label that prefixes the cluster to form the agent-network endpoint.
-          example: "violet"
         endpoint:
           type: string
-          description: Bare hostname agents call for this account, computed as `<subdomain>.<cluster>`.
-          example: "violet.eu.proxy.netbird.io"
+          description: Bare hostname agents call for this account. Empty until the account is bootstrapped.
+          example: "brave-otter.eu.proxy.netbird.io"
+        proxy_address:
+          type: string
+          description: Declared cluster address of the proxy serving this account's gateway. Equal to `endpoint` when a dedicated proxy serves the account; otherwise the endpoint's immediate parent (a shared cluster the endpoint hangs one label beneath). Empty until the account is bootstrapped.
+          example: "eu.proxy.netbird.io"
+        dedicated:
+          type: boolean
+          description: Whether the account's gateway is served by a proxy dedicated to it (endpoint equals proxy_address).
+          example: false
         enable_log_collection:
           type: boolean
           description: Whether per-request access-log entries are collected for this account's agent-network traffic.
@@ -6011,28 +6189,62 @@ components:
         created_at:
           type: string
           format: date-time
-          description: Timestamp when the settings row was created.
+          description: Timestamp when the settings row was created. Absent until the account is bootstrapped.
           readOnly: true
           example: "2026-04-26T10:30:00Z"
         updated_at:
           type: string
           format: date-time
-          description: Timestamp when the settings row was last updated.
+          description: Timestamp when the settings row was last updated. Absent until the account is bootstrapped.
           readOnly: true
           example: "2026-04-26T10:30:00Z"
       required:
-        - cluster
-        - subdomain
         - endpoint
+        - proxy_address
+        - dedicated
         - enable_log_collection
         - enable_prompt_collection
         - redact_pii
-        - created_at
-        - updated_at
+    AgentNetworkSettingsCreateRequest:
+      type: object
+      description: Bootstraps the per-account Agent Network settings row, assigning the account's immutable endpoint. Exactly one of `proxy_address` and `endpoint` must be provided. `proxy_address` requests a labeled endpoint — the server allocates a label and the endpoint becomes `<label>.<proxy_address>`, served by whichever proxy declares that parent address. `endpoint` claims the given hostname itself as a self-addressed (dedicated) endpoint, served only by a proxy declaring exactly that address — the claim is legitimate before the proxy exists (address-first). Collection toggles may ride along; omitted toggles take their defaults.
+      properties:
+        proxy_address:
+          type: string
+          description: Cluster address to allocate a labeled endpoint beneath. Mutually exclusive with `endpoint`.
+          example: "eu.proxy.netbird.io"
+        endpoint:
+          type: string
+          description: Hostname to claim as the account's self-addressed (dedicated) endpoint. Mutually exclusive with `proxy_address`. Rejected when another account already holds it.
+          example: "brave-otter.gateway.example.com"
+        enable_log_collection:
+          type: boolean
+          description: Whether per-request access-log entries are collected for this account's agent-network traffic. Defaults to true.
+          example: true
+        enable_prompt_collection:
+          type: boolean
+          description: Master switch for request/response prompt capture. Defaults to false.
+          example: false
+        redact_pii:
+          type: boolean
+          description: Whether captured prompts have PII redacted. Defaults to false.
+          example: false
+        access_log_retention_days:
+          type: integer
+          description: Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely. Defaults to 30.
+          example: 30
     AgentNetworkSettingsRequest:
       type: object
-      description: Mutable account-level Agent Network settings. Cluster and subdomain are immutable and not accepted here.
+      description: Account-level Agent Network settings update. Every field is required, matching the PUT convention of the other endpoints. The endpoint and proxy address are assigned at bootstrap (POST) and are immutable — the request must carry them unchanged, and a request carrying different values is rejected. To change them, delete the settings (DELETE, guarded) and bootstrap again; re-creating allocates a new endpoint.
       properties:
+        endpoint:
+          type: string
+          description: The account's gateway endpoint hostname. Immutable — must match the assigned value; a different value is rejected.
+          example: "brave-otter.eu.proxy.netbird.io"
+        proxy_address:
+          type: string
+          description: Declared cluster address of the proxy serving this account's gateway. Immutable — must match the assigned value; a different value is rejected.
+          example: "eu.proxy.netbird.io"
         enable_log_collection:
           type: boolean
           description: Whether per-request access-log entries are collected for this account's agent-network traffic.
@@ -6050,9 +6262,50 @@ components:
           description: Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely.
           example: 30
       required:
+        - endpoint
+        - proxy_address
         - enable_log_collection
         - enable_prompt_collection
         - redact_pii
+        - access_log_retention_days
+    AgentNetworkManagedProxy:
+      type: object
+      description: A NetBird-managed Agent Network gateway deployment.
+      properties:
+        id:
+          type: string
+          description: Managed proxy deployment ID.
+          example: "d1m3kebd9pcs0c1pnu7g"
+        state:
+          type: string
+          description: Derived deployment state. `provisioning` until the gateway is rolled out and connected, `ready` while the gateway actively serves the endpoint, `failed` when the rollout reported a failure, `disabled` while the gateway is turned off and the endpoint is not served.
+          enum: [ "provisioning", "ready", "failed", "disabled" ]
+          example: "ready"
+        endpoint:
+          type: string
+          description: The account's gateway hostname.
+          example: "brave-otter.gateway.netbird.io"
+        region:
+          type: string
+          description: Region of the cluster hosting the deployment.
+          example: "us-east"
+        message:
+          type: string
+          description: Failure detail reported by the rollout. Only set when state is `failed`.
+      required:
+        - id
+        - state
+        - endpoint
+    AgentNetworkManagedProxyConflict:
+      type: object
+      description: Conflict body returned when the account already has an Agent Network endpoint that managed provisioning does not own, naming that endpoint.
+      properties:
+        endpoint:
+          type: string
+          description: The Agent Network endpoint already assigned to the account.
+          example: "llm.example.com"
+      required:
+        - endpoint
     AgentNetworkBudgetRule:
       type: object
       description: Account-level budget rule. A limit-only rule bound to groups and/or users that applies across all policies as a min-wins ceiling. Empty targets means it applies to every caller.
@@ -7088,6 +7341,11 @@ paths:
           schema:
             type: string
           description: Filter peers by IP address
+        - in: query
+          name: mac
+          schema:
+            type: string
+          description: Filter peers by MAC address of a network interface
       security:
         - BearerAuth: [ ]
         - TokenAuth: [ ]
@@ -7267,341 +7525,6 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '500':
           "$ref": "#/components/responses/internal_error"
-  /api/peers/{peerId}/ingress/ports:
-    get:
-      x-cloud-only: true
-      summary: List all Port Allocations
-      description: Returns a list of all ingress port allocations for a peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: query
-          name: name
-          schema:
-            type: string
-          description: Filters ingress port allocations by name
-      responses:
-        '200':
-          description: A JSON Array of Ingress Port Allocations
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    post:
-      x-cloud-only: true
-      summary: Create a Port Allocation
-      description: Creates a new ingress port allocation for a peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-      requestBody:
-        description: New Ingress Port Allocation request
-        content:
-          'application/json':
-            schema:
-              $ref: '#/components/schemas/IngressPortAllocationRequest'
-      responses:
-        '200':
-          description: A Ingress Port Allocation object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/peers/{peerId}/ingress/ports/{allocationId}:
-    get:
-      x-cloud-only: true
-      summary: Retrieve a Port Allocation
-      description: Get information about an ingress port allocation
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: path
-          name: allocationId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress port allocation
-      responses:
-        '200':
-          description: A Ingress Port Allocation object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    put:
-      x-cloud-only: true
-      summary: Update a Port Allocation
-      description: Update information about an ingress port allocation
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: path
-          name: allocationId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress port allocation
-      requestBody:
-        description: update an ingress port allocation
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/IngressPortAllocationRequest'
-      responses:
-        '200':
-          description: A Ingress Port Allocation object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    delete:
-      x-cloud-only: true
-      summary: Delete a Port Allocation
-      description: Delete an ingress port allocation
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: path
-          name: allocationId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress port allocation
-      responses:
-        '200':
-          description: Delete status code
-          content: { }
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/ingress/peers:
-    get:
-      x-cloud-only: true
-      summary: List all Ingress Peers
-      description: Returns a list of all ingress peers
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      responses:
-        '200':
-          description: A JSON Array of Ingress Peers
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    post:
-      x-cloud-only: true
-      summary: Create a Ingress Peer
-      description: Creates a new ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      requestBody:
-        description: New Ingress Peer request
-        content:
-          'application/json':
-            schema:
-              $ref: '#/components/schemas/IngressPeerCreateRequest'
-      responses:
-        '200':
-          description: A Ingress Peer object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/ingress/peers/{ingressPeerId}:
-    get:
-      x-cloud-only: true
-      summary: Retrieve a Ingress Peer
-      description: Get information about an ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: ingressPeerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress peer
-      responses:
-        '200':
-          description: A Ingress Peer object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    put:
-      x-cloud-only: true
-      summary: Update a Ingress Peer
-      description: Update information about an ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: ingressPeerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress peer
-      requestBody:
-        description: update an ingress peer
-        content:
-          'application/json':
-            schema:
-              $ref: '#/components/schemas/IngressPeerUpdateRequest'
-      responses:
-        '200':
-          description: A Ingress Peer object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    delete:
-      x-cloud-only: true
-      summary: Delete a Ingress Peer
-      description: Delete an ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: ingressPeerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress peer
-      responses:
-        '200':
-          description: Delete status code
-          content: { }
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
   /api/setup-keys:
     get:
       summary: List all Setup Keys
@@ -9300,6 +9223,18 @@ paths:
           required: false
           schema:
             type: string
+        - name: source_id
+          in: query
+          description: Filter by source endpoint ID
+          required: false
+          schema:
+            type: string
+        - name: destination_id
+          in: query
+          description: Filter by destination endpoint ID
+          required: false
+          schema:
+            type: string
         - name: protocol
           in: query
           description: Filter by protocol
@@ -10161,6 +10096,28 @@ paths:
           $ref: "#/components/responses/requires_authentication"
         "500":
           $ref: "#/components/responses/internal_error"
+    delete:
+      summary: Delete MSP tenant
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of a tenant account
+      responses:
+        "200":
+          description: Successfully deleted the tenant
+        "400":
+          $ref: "#/components/responses/bad_request"
+        "403":
+          $ref: "#/components/responses/requires_authentication"
+        "404":
+          description: The tenant was not found
+        "500":
+          $ref: "#/components/responses/internal_error"
   /api/integrations/msp/tenants/{id}/unlink:
     post:
       summary: Unlink a tenant
@@ -10451,7 +10408,7 @@ paths:
         - EDR Intune Integrations
       summary: Delete EDR Intune Integration
       description: Deletes an EDR Intune Integration by its ID.
-      operationId: deleteIntegration
+      operationId: deleteEDRIntuneIntegration
       responses:
         '200':
           description: Integration deleted successfully. Returns an empty object.
@@ -12535,7 +12492,7 @@ paths:
         - Event Streaming Integrations
       summary: Delete Event Streaming Integration
       description: Deletes an event streaming integration by its ID.
-      operationId: deleteIntegration
+      operationId: deleteEventStreamingIntegration
       responses:
         '200':
           description: Integration deleted successfully. Returns an empty object.
@@ -12907,7 +12864,7 @@ paths:
   /api/reverse-proxies/domains/{domainId}:
     delete:
       summary: Delete a Custom domain
-      description: Delete an existing service custom domain
+      description: Delete an existing service custom domain after removing or moving all services that use it or its subdomains, including disabled services.
       tags: [ Services ]
       security:
         - BearerAuth: [ ]
@@ -12930,12 +12887,15 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '404':
           "$ref": "#/components/responses/not_found"
+        '412':
+          description: The domain or one of its subdomains is still used by a service
+          content: { }
         '500':
           "$ref": "#/components/responses/internal_error"
   /api/reverse-proxies/domains/{domainId}/validate:
     get:
       summary: Validate a custom domain
-      description: Trigger domain ownership validation for a custom domain
+      description: Validate domain ownership for a custom domain
       tags: [ Services ]
       security:
         - BearerAuth: [ ]
@@ -12948,8 +12908,8 @@ paths:
             type: string
           description: The custom domain ID
       responses:
-        '202':
-          description: Reverse proxy custom domain validation triggered
+        '204':
+          description: Reverse proxy custom domain validated
         '400':
           "$ref": "#/components/responses/bad_request"
         '401':
@@ -12958,6 +12918,9 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '404':
           "$ref": "#/components/responses/not_found"
+        '412':
+          description: Precondition failed - the custom domain could not be validated
+          content: { }
         '500':
           "$ref": "#/components/responses/internal_error"
   /api/integrations/notifications/types:
@@ -13129,10 +13092,71 @@ paths:
           "$ref": "#/components/responses/not_found"
         '500':
           "$ref": "#/components/responses/internal_error"
+  /api/integrations/agent-network/managed-proxy:
+    post:
+      summary: Provision a managed Agent Network gateway
+      description: Starts provisioning of a NetBird-managed Agent Network gateway for the account, allocating its endpoint under the managed zone on the first call. Idempotent — answers 202 when this call started (or, after a failure, restarted) provisioning and 200 when a deployment already exists, reporting current state either way. A disabled deployment answers 200 with state `disabled` and stays disabled. Returns 409 when the account already has an Agent Network endpoint that managed provisioning does not own, and 503 when endpoint allocation is temporarily exhausted.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: A managed gateway deployment already exists; reports its current state.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkManagedProxy'
+        '202':
+          description: Provisioning started, or restarted after a reported failure
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkManagedProxy'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '409':
+          description: The account already has an Agent Network endpoint not owned by managed provisioning
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkManagedProxyConflict'
+        '500':
+          "$ref": "#/components/responses/internal_error"
+        '503':
+          description: Endpoint allocation is temporarily exhausted; retry later
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+    get:
+      summary: Retrieve managed Agent Network gateway status
+      description: Reports the account's managed gateway deployment and its derived state, including `disabled` for a deployment that is turned off. Returns 404 when the account has no managed deployment.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: The account's managed gateway deployment
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkManagedProxy'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
   /api/agent-network/access-logs:
     get:
       summary: List Agent Network access logs
-      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access log entries. Available only when the account has log collection enabled; otherwise entries are not retained.
+      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access log entries. Available only when the account has log collection enabled; otherwise entries are not retained. Callers without the account-wide grant are not denied - the response is scoped to their own requests (any user_id or group_id filter is overridden).
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13247,7 +13271,7 @@ paths:
   /api/agent-network/access-log-sessions:
     get:
       summary: List Agent Network access logs grouped by session
-      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access logs grouped by session. The page unit is a session (total_records counts sessions); each session carries an aggregate summary and its ordered entries. Requests the client sent no session id for each form their own singleton group. Accepts the same filters as the flat access-logs endpoint. Available only when the account has log collection enabled.
+      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access logs grouped by session. The page unit is a session (total_records counts sessions); each session carries an aggregate summary and its ordered entries. Requests the client sent no session id for each form their own singleton group. Accepts the same filters as the flat access-logs endpoint. Available only when the account has log collection enabled. Callers without the account-wide grant are not denied - the response is scoped to their own requests (any user_id or group_id filter is overridden).
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13362,7 +13386,7 @@ paths:
   /api/agent-network/usage/overview:
     get:
       summary: Agent Network usage overview
-      description: Returns agent-network token and cost usage aggregated into time buckets, server-side filtered. Usage is always collected (independent of log collection).
+      description: Returns agent-network token and cost usage aggregated into time buckets, server-side filtered. Usage is always collected (independent of log collection). Callers without the account-wide grant are not denied - the response is scoped to their own usage (any user_id or group_id filter is overridden).
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13462,10 +13486,29 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '500':
           "$ref": "#/components/responses/internal_error"
+  /api/agent-network/agent-config:
+    get:
+      summary: Retrieve the caller's Agent Network agent config
+      description: Returns everything the caller needs to configure a local AI tool and nothing more - the account's Agent Network endpoint plus the providers and models the caller's own policies allow. Available to every authenticated user regardless of role; the response never contains provider credentials, policy or guardrail configuration, or providers the caller cannot reach.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: The caller-scoped Agent Network agent config
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkAgentConfig'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '500':
+          "$ref": "#/components/responses/internal_error"
   /api/agent-network/settings:
     get:
       summary: Retrieve Agent Network settings
-      description: Returns the per-account Agent Network gateway settings (cluster, subdomain, endpoint). Returns 404 when no provider has been created yet — settings are lazily bootstrapped on first provider create.
+      description: Returns the per-account Agent Network gateway settings (endpoint, proxy address, collection toggles). Before the account is bootstrapped via POST, the response carries the default values with an empty endpoint and proxy address.
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13481,13 +13524,44 @@ paths:
           "$ref": "#/components/responses/requires_authentication"
         '403':
           "$ref": "#/components/responses/forbidden"
-        '404':
-          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    post:
+      summary: Bootstrap Agent Network settings
+      description: Creates the per-account Agent Network settings row and allocates the account's endpoint. Exactly one of `proxy_address` (labeled endpoint under that cluster; the server allocates the label) and `endpoint` (self-addressed dedicated endpoint, claimed verbatim) must be provided. The endpoint and proxy address are immutable once assigned. Returns 409 when the account already has a settings row.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      requestBody:
+        required: true
+        description: Settings bootstrap request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkSettingsCreateRequest'
+      responses:
+        '200':
+          description: The freshly bootstrapped Agent Network settings
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkSettings'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '409':
+          "$ref": "#/components/responses/conflict"
+        '422':
+          "$ref": "#/components/responses/validation_failed"
         '500':
           "$ref": "#/components/responses/internal_error"
     put:
       summary: Update Agent Network settings
-      description: Updates the mutable account-level Agent Network settings (collection toggles). Cluster and subdomain are immutable and ignored if sent. Returns 404 when settings have not been bootstrapped (no provider created yet).
+      description: Updates the account-level Agent Network settings; the request carries every field, replacing the mutable ones (collection toggles and retention). Returns 404 when the account has no settings row yet — bootstrap it with POST first. The endpoint and proxy address are assigned at bootstrap and immutable; the request must carry them unchanged, and a request carrying different values is rejected.
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13513,6 +13587,29 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '404':
           "$ref": "#/components/responses/not_found"
+        '422':
+          "$ref": "#/components/responses/validation_failed"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    delete:
+      summary: Delete Agent Network settings
+      description: Deletes the account's Agent Network settings row, releasing the endpoint. Guarded — the delete is refused with 412 while any Agent Network provider exists for the account or while a proxy is actively serving the endpoint. Bootstrapping again after a delete allocates a new endpoint; the released hostname is not reserved.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: Settings deleted
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '412':
+          description: Delete refused — Agent Network providers still exist for the account, or a proxy is actively serving the endpoint
+          content: { }
         '500':
           "$ref": "#/components/responses/internal_error"
   /api/agent-network/budget-rules:
@@ -13689,6 +13786,42 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '500':
           "$ref": "#/components/responses/internal_error"
+  /api/agent-network/catalog/providers/models:
+    post:
+      summary: Discover the models a provider credential can reach
+      description: |
+        Asks the vendor which models the supplied credential can actually use, so the provider form can offer a live list instead of only the static catalog. The endpoint, auth header and response shape are taken from the catalog entry, never from the request.
+
+        Supply either an api_key together with the upstream_url being configured (before the provider is saved), or a provider_id of an existing record to reuse its stored credential.
+
+        Returns 422 for a catalog provider that has no listing endpoint (most gateways); the caller should fall back to the catalog's own model list. A model whose price the shipped table does not know is returned with pricing_known false, and the operator must set rates for it.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkModelDiscoveryRequest'
+      responses:
+        '200':
+          description: The models the credential can reach
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkModelDiscoveryResponse'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '422':
+          "$ref": "#/components/responses/validation_failed_simple"
+        '500':
+          "$ref": "#/components/responses/internal_error"
   /api/agent-network/providers:
     get:
       summary: List all Agent Network Providers
@@ -13714,7 +13847,14 @@ paths:
           "$ref": "#/components/responses/internal_error"
     post:
       summary: Create an Agent Network Provider
-      description: Connects a new Agent Network AI provider for the account.
+      description: |
+        Connects a new Agent Network AI provider for the account.
+
+        The credential is checked against the vendor's model listing before the provider is stored, so a record the vendor will not accept is refused rather than saved. A rejected credential, a listing endpoint that does not resolve or answer, a vendor outage, and a timeout all block the write and return 422.
+
+        What that proves about the upstream URL is narrower than the URL itself. Only its host is used: the listing is requested over HTTPS at the path the catalog entry declares, so a configured scheme or path is neither used nor validated here. Where the catalog entry has a listing host of its own — Bedrock, whose listing comes from the control plane — even the host is only resolved, never contacted, so a public host that does not answer is still stored.
+
+        Only what cannot be checked at all is exempt and stored unverified: a catalog provider with no listing endpoint, one with no host to derive a listing from, an upstream resolving to a private address the management service will not dial, and a provider configured to skip TLS verification.
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13740,6 +13880,8 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '409':
           "$ref": "#/components/responses/conflict"
+        '422':
+          "$ref": "#/components/responses/validation_failed_simple"
         '500':
           "$ref": "#/components/responses/internal_error"
   /api/agent-network/providers/{providerId}:
@@ -13776,7 +13918,10 @@ paths:
           "$ref": "#/components/responses/internal_error"
     put:
       summary: Update an Agent Network Provider
-      description: Update an existing Agent Network AI provider.
+      description: |
+        Update an existing Agent Network AI provider.
+
+        When the upstream URL, the API key or the catalog provider changes, the record is checked against the vendor before the change is stored, and a refusal returns 422 without replacing what was there. Switching TLS verification back on is the fourth trigger: a provider exempt from the check was stored unverified, so the edit that ends the exemption is the first opportunity to check it. Where one of the four does fire, an update that omits the API key is checked against the stored one. Edits touching none of them — a rename, model rows, price edits — are stored without a check, as are the cases the create description lists as unverifiable.
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13811,6 +13956,8 @@ paths:
           "$ref": "#/components/responses/not_found"
         '409':
           "$ref": "#/components/responses/conflict"
+        '422':
+          "$ref": "#/components/responses/validation_failed_simple"
         '500':
           "$ref": "#/components/responses/internal_error"
     delete:
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index 3b587c4bf..1595553ed 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -77,6 +77,30 @@ func (e AgentNetworkConsumptionDimensionKind) Valid() bool {
 	}
 }
 
+// Defines values for AgentNetworkManagedProxyState.
+const (
+	AgentNetworkManagedProxyStateDisabled     AgentNetworkManagedProxyState = "disabled"
+	AgentNetworkManagedProxyStateFailed       AgentNetworkManagedProxyState = "failed"
+	AgentNetworkManagedProxyStateProvisioning AgentNetworkManagedProxyState = "provisioning"
+	AgentNetworkManagedProxyStateReady        AgentNetworkManagedProxyState = "ready"
+)
+
+// Valid indicates whether the value is a known member of the AgentNetworkManagedProxyState enum.
+func (e AgentNetworkManagedProxyState) Valid() bool {
+	switch e {
+	case AgentNetworkManagedProxyStateDisabled:
+		return true
+	case AgentNetworkManagedProxyStateFailed:
+		return true
+	case AgentNetworkManagedProxyStateProvisioning:
+		return true
+	case AgentNetworkManagedProxyStateReady:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateAzureIntegrationRequestHost.
 const (
 	CreateAzureIntegrationRequestHostMicrosoftCom CreateAzureIntegrationRequestHost = "microsoft.com"
@@ -584,69 +608,6 @@ func (e IdentityProviderType) Valid() bool {
 	}
 }
 
-// Defines values for IngressPortAllocationPortMappingProtocol.
-const (
-	IngressPortAllocationPortMappingProtocolTcp    IngressPortAllocationPortMappingProtocol = "tcp"
-	IngressPortAllocationPortMappingProtocolTcpudp IngressPortAllocationPortMappingProtocol = "tcp/udp"
-	IngressPortAllocationPortMappingProtocolUdp    IngressPortAllocationPortMappingProtocol = "udp"
-)
-
-// Valid indicates whether the value is a known member of the IngressPortAllocationPortMappingProtocol enum.
-func (e IngressPortAllocationPortMappingProtocol) Valid() bool {
-	switch e {
-	case IngressPortAllocationPortMappingProtocolTcp:
-		return true
-	case IngressPortAllocationPortMappingProtocolTcpudp:
-		return true
-	case IngressPortAllocationPortMappingProtocolUdp:
-		return true
-	default:
-		return false
-	}
-}
-
-// Defines values for IngressPortAllocationRequestDirectPortProtocol.
-const (
-	IngressPortAllocationRequestDirectPortProtocolTcp    IngressPortAllocationRequestDirectPortProtocol = "tcp"
-	IngressPortAllocationRequestDirectPortProtocolTcpudp IngressPortAllocationRequestDirectPortProtocol = "tcp/udp"
-	IngressPortAllocationRequestDirectPortProtocolUdp    IngressPortAllocationRequestDirectPortProtocol = "udp"
-)
-
-// Valid indicates whether the value is a known member of the IngressPortAllocationRequestDirectPortProtocol enum.
-func (e IngressPortAllocationRequestDirectPortProtocol) Valid() bool {
-	switch e {
-	case IngressPortAllocationRequestDirectPortProtocolTcp:
-		return true
-	case IngressPortAllocationRequestDirectPortProtocolTcpudp:
-		return true
-	case IngressPortAllocationRequestDirectPortProtocolUdp:
-		return true
-	default:
-		return false
-	}
-}
-
-// Defines values for IngressPortAllocationRequestPortRangeProtocol.
-const (
-	IngressPortAllocationRequestPortRangeProtocolTcp    IngressPortAllocationRequestPortRangeProtocol = "tcp"
-	IngressPortAllocationRequestPortRangeProtocolTcpudp IngressPortAllocationRequestPortRangeProtocol = "tcp/udp"
-	IngressPortAllocationRequestPortRangeProtocolUdp    IngressPortAllocationRequestPortRangeProtocol = "udp"
-)
-
-// Valid indicates whether the value is a known member of the IngressPortAllocationRequestPortRangeProtocol enum.
-func (e IngressPortAllocationRequestPortRangeProtocol) Valid() bool {
-	switch e {
-	case IngressPortAllocationRequestPortRangeProtocolTcp:
-		return true
-	case IngressPortAllocationRequestPortRangeProtocolTcpudp:
-		return true
-	case IngressPortAllocationRequestPortRangeProtocolUdp:
-		return true
-	default:
-		return false
-	}
-}
-
 // Defines values for IntegrationResponsePlatform.
 const (
 	IntegrationResponsePlatformDatadog     IntegrationResponsePlatform = "datadog"
@@ -1076,6 +1037,27 @@ func (e ServiceRequestMode) Valid() bool {
 	}
 }
 
+// Defines values for ServiceTargetAccessAction.
+const (
+	ServiceTargetAccessActionBlock   ServiceTargetAccessAction = "block"
+	ServiceTargetAccessActionBypass  ServiceTargetAccessAction = "bypass"
+	ServiceTargetAccessActionInherit ServiceTargetAccessAction = "inherit"
+)
+
+// Valid indicates whether the value is a known member of the ServiceTargetAccessAction enum.
+func (e ServiceTargetAccessAction) Valid() bool {
+	switch e {
+	case ServiceTargetAccessActionBlock:
+		return true
+	case ServiceTargetAccessActionBypass:
+		return true
+	case ServiceTargetAccessActionInherit:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ServiceTargetProtocol.
 const (
 	ServiceTargetProtocolHttp  ServiceTargetProtocol = "http"
@@ -1612,6 +1594,12 @@ type Account struct {
 	Settings   AccountSettings   `json:"settings"`
 }
 
+// AccountDashboardFeatures Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
+type AccountDashboardFeatures struct {
+	// AgentNetwork Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies. Must be true when agent_network_only is enabled.
+	AgentNetwork *bool `json:"agent_network,omitempty"`
+}
+
 // AccountExtraSettings defines model for AccountExtraSettings.
 type AccountExtraSettings struct {
 	// NetworkTrafficLogsEnabled Enables or disables network traffic logging. If enabled, all network traffic events from peers will be stored.
@@ -1647,12 +1635,18 @@ type AccountRequest struct {
 
 // AccountSettings defines model for AccountSettings.
 type AccountSettings struct {
+	// AgentNetworkOnly Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
+	AgentNetworkOnly *bool `json:"agent_network_only,omitempty"`
+
 	// AutoUpdateAlways When true, updates are installed automatically in the background. When false, updates require user interaction from the UI.
 	AutoUpdateAlways *bool `json:"auto_update_always,omitempty"`
 
 	// AutoUpdateVersion Set Clients auto-update version. "latest", "disabled", or a specific version (e.g "0.50.1")
 	AutoUpdateVersion *string `json:"auto_update_version,omitempty"`
 
+	// DashboardFeatures Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
+	DashboardFeatures *AccountDashboardFeatures `json:"dashboard_features,omitempty"`
+
 	// DnsDomain Allows to define a custom dns domain for the account
 	DnsDomain *string `json:"dns_domain,omitempty"`
 
@@ -1699,6 +1693,9 @@ type AccountSettings struct {
 	// PeerExposeGroups Limits which peer groups are allowed to expose services. If empty, all peers are allowed when peer expose is enabled.
 	PeerExposeGroups []string `json:"peer_expose_groups"`
 
+	// PeerHostnameCollisionRejected When enabled, registering or renaming a peer to a hostname already used by another peer in the account fails instead of receiving an IP-based suffix. Applies to ephemeral peers as well.
+	PeerHostnameCollisionRejected *bool `json:"peer_hostname_collision_rejected,omitempty"`
+
 	// PeerInactivityExpiration Period of time of inactivity after which peer session expires (seconds).
 	PeerInactivityExpiration int `json:"peer_inactivity_expiration"`
 
@@ -1720,6 +1717,21 @@ type AccountSettings struct {
 
 // AgentNetworkAccessLog One per-request agent-network (LLM) access log entry with flattened, queryable LLM dimensions.
 type AgentNetworkAccessLog struct {
+	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage.
+	CacheCostUsd float64 `json:"cache_cost_usd"`
+
+	// CacheCreationCostUsd Cost of the prompt-cache write tokens. Base component of cost_usd, and part of cache_cost_usd.
+	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
+
+	// CacheCreationTokens Input tokens written to the provider's prompt cache. Zero for providers without a cache-write bucket.
+	CacheCreationTokens int64 `json:"cache_creation_tokens"`
+
+	// CachedInputCostUsd Cost of the prompt-cache read tokens. Base component of cost_usd, and part of cache_cost_usd.
+	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
+
+	// CachedInputTokens Input tokens read from the provider's prompt cache. Additive to input_tokens for Anthropic-shape providers; a subset of input_tokens for OpenAI.
+	CachedInputTokens int64 `json:"cached_input_tokens"`
+
 	// CostUsd Estimated USD cost of the request.
 	CostUsd float64 `json:"cost_usd"`
 
@@ -1741,6 +1753,9 @@ type AgentNetworkAccessLog struct {
 	// Id Unique identifier for the access log entry.
 	Id string `json:"id"`
 
+	// InputCostUsd Cost of the non-cached input tokens. Base component of cost_usd.
+	InputCostUsd float64 `json:"input_cost_usd"`
+
 	// InputTokens Input (prompt) tokens consumed.
 	InputTokens int64 `json:"input_tokens"`
 
@@ -1750,6 +1765,9 @@ type AgentNetworkAccessLog struct {
 	// Model Requested LLM model.
 	Model *string `json:"model,omitempty"`
 
+	// OutputCostUsd Cost of the output tokens. Base component of cost_usd.
+	OutputCostUsd float64 `json:"output_cost_usd"`
+
 	// OutputTokens Output (completion) tokens produced.
 	OutputTokens int64 `json:"output_tokens"`
 
@@ -1789,7 +1807,7 @@ type AgentNetworkAccessLog struct {
 	// Timestamp Timestamp when the request was made.
 	Timestamp time.Time `json:"timestamp"`
 
-	// TotalTokens Total tokens consumed.
+	// TotalTokens Total tokens consumed, including prompt-cache tokens.
 	TotalTokens int64 `json:"total_tokens"`
 
 	// UserId NetBird user id of the authenticated caller, if applicable.
@@ -1798,6 +1816,21 @@ type AgentNetworkAccessLog struct {
 
 // AgentNetworkAccessLogSession A session-grouped view of agent-network access logs — all requests sharing a session id (or a single session-less request) folded into one summary plus its ordered entries.
 type AgentNetworkAccessLogSession struct {
+	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage across the session.
+	CacheCostUsd float64 `json:"cache_cost_usd"`
+
+	// CacheCreationCostUsd Total cost of prompt-cache write tokens across the session.
+	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
+
+	// CacheCreationTokens Total prompt-cache write tokens across the session.
+	CacheCreationTokens int64 `json:"cache_creation_tokens"`
+
+	// CachedInputCostUsd Total cost of prompt-cache read tokens across the session.
+	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
+
+	// CachedInputTokens Total prompt-cache read tokens across the session.
+	CachedInputTokens int64 `json:"cached_input_tokens"`
+
 	// CostUsd Total estimated USD cost across the session.
 	CostUsd float64 `json:"cost_usd"`
 
@@ -1813,12 +1846,18 @@ type AgentNetworkAccessLogSession struct {
 	// GroupIds Union of the authorising group ids across the session's entries.
 	GroupIds *[]string `json:"group_ids,omitempty"`
 
+	// InputCostUsd Total cost of non-cached input tokens across the session.
+	InputCostUsd float64 `json:"input_cost_usd"`
+
 	// InputTokens Total input (prompt) tokens across the session.
 	InputTokens int64 `json:"input_tokens"`
 
 	// Models Distinct models seen in the session.
 	Models *[]string `json:"models,omitempty"`
 
+	// OutputCostUsd Total cost of output tokens across the session.
+	OutputCostUsd float64 `json:"output_cost_usd"`
+
 	// OutputTokens Total output (completion) tokens across the session.
 	OutputTokens int64 `json:"output_tokens"`
 
@@ -1834,7 +1873,7 @@ type AgentNetworkAccessLogSession struct {
 	// StartedAt Timestamp of the session's earliest request.
 	StartedAt time.Time `json:"started_at"`
 
-	// TotalTokens Total tokens across the session.
+	// TotalTokens Total tokens across the session, including prompt-cache tokens.
 	TotalTokens int64 `json:"total_tokens"`
 
 	// UserId NetBird user id of the session's caller.
@@ -1877,6 +1916,36 @@ type AgentNetworkAccessLogsResponse struct {
 	TotalRecords int `json:"total_records"`
 }
 
+// AgentNetworkAgentConfig The caller-scoped Agent Network connection config backing the self-service "Connect your agent" view. Available to every authenticated user; the providers are computed from the caller's own groups and the answer carries display metadata only.
+type AgentNetworkAgentConfig struct {
+	// Configured False only when the account has no Agent Network set up. A caller that no policy covers yet still reads as configured, with an empty providers list.
+	Configured bool `json:"configured"`
+
+	// Endpoint The account's Agent Network base URL, reachable over the NetBird tunnel only. Returned to every member of a configured account - it authorizes nothing on its own, since the gateway still refuses every request no policy permits. Empty when configured is false.
+	Endpoint string `json:"endpoint"`
+
+	// Providers The providers at least one of the caller's policies authorizes, in creation order. Empty when no policy covers the caller.
+	Providers []AgentNetworkAgentConfigProvider `json:"providers"`
+}
+
+// AgentNetworkAgentConfigProvider One provider the caller may use, reduced to what a local tool needs for configuration.
+type AgentNetworkAgentConfigProvider struct {
+	// AllModelsAllowed True when no model allowlist restricts this provider for the caller; models then lists the declared or catalog models as a courtesy.
+	AllModelsAllowed bool `json:"all_models_allowed"`
+
+	// ApiFlavor Request-body shape the provider speaks ("anthropic", "openai"). Empty when the gateway dispatches it by URL path instead.
+	ApiFlavor string `json:"api_flavor"`
+
+	// CatalogId Catalog entry id naming the provider type.
+	CatalogId string `json:"catalog_id"`
+
+	// Models The effective model allowlist for the caller (or the declared/catalog models when all_models_allowed is true).
+	Models []string `json:"models"`
+
+	// Name Operator-assigned provider label.
+	Name string `json:"name"`
+}
+
 // AgentNetworkBudgetRule Account-level budget rule. A limit-only rule bound to groups and/or users that applies across all policies as a min-wins ceiling. Empty targets means it applies to every caller.
 type AgentNetworkBudgetRule struct {
 	CreatedAt *time.Time `json:"created_at,omitempty"`
@@ -1963,6 +2032,15 @@ type AgentNetworkCatalogJSONMetadataInjection struct {
 
 // AgentNetworkCatalogModel defines model for AgentNetworkCatalogModel.
 type AgentNetworkCatalogModel struct {
+	// CacheCreationPer1k Anthropic-shape cache rate — default cost per 1k cache-creation tokens (additive to input tokens), in USD. Absent when the model has no cache-creation rate.
+	CacheCreationPer1k *float64 `json:"cache_creation_per_1k,omitempty"`
+
+	// CacheReadPer1k Anthropic-shape cache rate — default cost per 1k cache-read tokens (additive to input tokens), in USD. Absent when the model has no cache-read rate.
+	CacheReadPer1k *float64 `json:"cache_read_per_1k,omitempty"`
+
+	// CachedInputPer1k OpenAI-shape cache rate — default cost per 1k cached prompt tokens (a subset of input tokens), in USD. Absent when the model has no cached-input discount.
+	CachedInputPer1k *float64 `json:"cached_input_per_1k,omitempty"`
+
 	// ContextWindow Maximum context window in tokens.
 	ContextWindow int `json:"context_window"`
 
@@ -2016,6 +2094,9 @@ type AgentNetworkCatalogProvider struct {
 
 	// Name Display name for the provider.
 	Name string `json:"name"`
+
+	// PricingSurfaces Cost-meter pricing surfaces this provider's traffic is metered under ("openai", "anthropic", "bedrock"). Tells the dashboard which cache-rate fields apply to this provider's models: "openai" → cached_input_per_1k (cached prompt tokens are a subset of input); "anthropic"/"bedrock" → cache_read_per_1k + cache_creation_per_1k (additive buckets). Absent/empty for gateway and custom entries, whose upstream shape NetBird cannot know ahead of time — surface all cache fields for those.
+	PricingSurfaces *[]string `json:"pricing_surfaces,omitempty"`
 }
 
 // AgentNetworkCatalogProviderKind Presentation grouping for the provider Select on the dashboard.
@@ -2054,6 +2135,33 @@ type AgentNetworkConsumption struct {
 // AgentNetworkConsumptionDimensionKind Whether this row counts a single end user or a single source group across every member.
 type AgentNetworkConsumptionDimensionKind string
 
+// AgentNetworkDiscoveredModel defines model for AgentNetworkDiscoveredModel.
+type AgentNetworkDiscoveredModel struct {
+	// CacheCreationPer1k Anthropic-shape cache rate — default cost per 1k cache-creation tokens (additive to input tokens), in USD. Absent when the model has no cache-creation rate.
+	CacheCreationPer1k *float64 `json:"cache_creation_per_1k,omitempty"`
+
+	// CacheReadPer1k Anthropic-shape cache rate — default cost per 1k cache-read tokens (additive to input tokens), in USD. Absent when the model has no cache-read rate.
+	CacheReadPer1k *float64 `json:"cache_read_per_1k,omitempty"`
+
+	// CachedInputPer1k OpenAI-shape cache rate — default cost per 1k cached prompt tokens (a subset of input tokens), in USD. Absent when the model has no cached-input discount.
+	CachedInputPer1k *float64 `json:"cached_input_per_1k,omitempty"`
+
+	// Id Identifier to register on the provider record, in the form the vendor issues it. For Bedrock this is the region-prefixed inference-profile id, which is the only form AWS accepts at invoke time.
+	Id string `json:"id"`
+
+	// InputPer1k Default input token price per 1k tokens, in USD, from the same table the proxy bills with. Zero when pricing_known is false.
+	InputPer1k float64 `json:"input_per_1k"`
+
+	// Label Vendor-supplied display name, where the vendor supplies one.
+	Label *string `json:"label,omitempty"`
+
+	// OutputPer1k Default output token price per 1k tokens, in USD. Zero when pricing_known is false.
+	OutputPer1k float64 `json:"output_per_1k"`
+
+	// PricingKnown Whether NetBird's shipped pricing table can price this model. When false the rates below are all zero and the operator must set them, or requests to this model would record a cost of zero.
+	PricingKnown bool `json:"pricing_known"`
+}
+
 // AgentNetworkGuardrail defines model for AgentNetworkGuardrail.
 type AgentNetworkGuardrail struct {
 	// Checks Guardrail check parameters. Each entry has an `enabled` flag plus per-check configuration; disabled entries are inert.
@@ -2101,6 +2209,54 @@ type AgentNetworkGuardrailRequest struct {
 	Name string `json:"name"`
 }
 
+// AgentNetworkManagedProxy A NetBird-managed Agent Network gateway deployment.
+type AgentNetworkManagedProxy struct {
+	// Endpoint The account's gateway hostname.
+	Endpoint string `json:"endpoint"`
+
+	// Id Managed proxy deployment ID.
+	Id string `json:"id"`
+
+	// Message Failure detail reported by the rollout. Only set when state is `failed`.
+	Message *string `json:"message,omitempty"`
+
+	// Region Region of the cluster hosting the deployment.
+	Region *string `json:"region,omitempty"`
+
+	// State Derived deployment state. `provisioning` until the gateway is rolled out and connected, `ready` while the gateway actively serves the endpoint, `failed` when the rollout reported a failure, `disabled` while the gateway is turned off and the endpoint is not served.
+	State AgentNetworkManagedProxyState `json:"state"`
+}
+
+// AgentNetworkManagedProxyState Derived deployment state. `provisioning` until the gateway is rolled out and connected, `ready` while the gateway actively serves the endpoint, `failed` when the rollout reported a failure, `disabled` while the gateway is turned off and the endpoint is not served.
+type AgentNetworkManagedProxyState string
+
+// AgentNetworkManagedProxyConflict Conflict body returned when the account already has an Agent Network endpoint that managed provisioning does not own, naming that endpoint.
+type AgentNetworkManagedProxyConflict struct {
+	// Endpoint The Agent Network endpoint already assigned to the account.
+	Endpoint string `json:"endpoint"`
+}
+
+// AgentNetworkModelDiscoveryRequest defines model for AgentNetworkModelDiscoveryRequest.
+type AgentNetworkModelDiscoveryRequest struct {
+	// ApiKey Credential to query the vendor with, for a provider that has not been saved yet. Mutually exclusive with provider_id.
+	ApiKey *string `json:"api_key,omitempty"`
+
+	// CatalogProviderId Catalog provider to query (AgentNetworkCatalogProvider.id). Determines the listing endpoint, the auth header and the response shape.
+	CatalogProviderId string `json:"catalog_provider_id"`
+
+	// ProviderId Existing Agent Network provider record to query with. Its stored credential is used, and its upstream unless upstream_url overrides it, so the form can refresh the list without the client holding the key.
+	ProviderId *string `json:"provider_id,omitempty"`
+
+	// UpstreamUrl The upstream being configured. Used to reach vendors that serve their listing from the same host as inference, and to read back the region for those whose host embeds one. Sent alongside provider_id, it overrides the stored upstream, so an edit can be listed against the URL on the form before it is saved.
+	UpstreamUrl *string `json:"upstream_url,omitempty"`
+}
+
+// AgentNetworkModelDiscoveryResponse defines model for AgentNetworkModelDiscoveryResponse.
+type AgentNetworkModelDiscoveryResponse struct {
+	// Models Models the credential can reach, in the order the vendor returned them.
+	Models []AgentNetworkDiscoveredModel `json:"models"`
+}
+
 // AgentNetworkPolicy defines model for AgentNetworkPolicy.
 type AgentNetworkPolicy struct {
 	// CreatedAt Timestamp when the policy was created.
@@ -2209,11 +2365,14 @@ type AgentNetworkProvider struct {
 	// Id Provider ID
 	Id string `json:"id"`
 
-	// IdentityHeaderGroups Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
-	IdentityHeaderGroups *string `json:"identity_header_groups,omitempty"`
+	// IdentityHeaderGroups Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
+	IdentityHeaderGroups string `json:"identity_header_groups"`
 
-	// IdentityHeaderUserId Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
-	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
+	// IdentityHeaderUserId Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
+	IdentityHeaderUserId string `json:"identity_header_user_id"`
+
+	// MetadataDisabled Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
+	MetadataDisabled bool `json:"metadata_disabled"`
 
 	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
 	Models []AgentNetworkProviderModel `json:"models"`
@@ -2236,6 +2395,15 @@ type AgentNetworkProvider struct {
 
 // AgentNetworkProviderModel A model exposed by the provider, with the operator's per-1k input/output prices in USD.
 type AgentNetworkProviderModel struct {
+	// CacheCreationPer1k Anthropic-shape cache rate — cost per 1k cache-creation tokens (additive to input tokens), in USD. Omitted means inherit NetBird's default rate for this model when one exists; 0 means cache writes bill at input_per_1k.
+	CacheCreationPer1k *float64 `json:"cache_creation_per_1k,omitempty"`
+
+	// CacheReadPer1k Anthropic-shape cache rate — cost per 1k cache-read tokens (additive to input tokens), in USD. Omitted means inherit NetBird's default rate for this model when one exists; 0 means cache reads bill at input_per_1k.
+	CacheReadPer1k *float64 `json:"cache_read_per_1k,omitempty"`
+
+	// CachedInputPer1k OpenAI-shape cache rate — cost per 1k cached prompt tokens (a subset of input tokens), in USD. Omitted means inherit NetBird's default rate for this model when one exists; 0 means no discount (cached tokens bill at input_per_1k).
+	CachedInputPer1k *float64 `json:"cached_input_per_1k,omitempty"`
+
 	// Id Model identifier (e.g. "gpt-4o-mini").
 	Id string `json:"id"`
 
@@ -2251,21 +2419,21 @@ type AgentNetworkProviderRequest struct {
 	// ApiKey Upstream provider API key. Sealed at rest on the management server and never returned in responses. Required on create; optional on update (omit to keep the existing key).
 	ApiKey *string `json:"api_key,omitempty"`
 
-	// BootstrapCluster Proxy cluster used to bootstrap the per-account agent-network endpoint when the first provider is created. Ignored on subsequent creates and on updates because the cluster is pinned on the account-level Settings row.
-	BootstrapCluster *string `json:"bootstrap_cluster,omitempty"`
-
 	// Enabled Whether the provider is enabled. Defaults to true on create.
 	Enabled *bool `json:"enabled,omitempty"`
 
-	// ExtraValues Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). When present on a request, the whole map replaces the stored values. Empty strings drop the corresponding key.
+	// ExtraValues Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). The request's map replaces the stored values; empty strings drop the corresponding key.
 	ExtraValues *map[string]string `json:"extra_values,omitempty"`
 
-	// IdentityHeaderGroups Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same omit / empty semantics as `identity_header_user_id`.
+	// IdentityHeaderGroups Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same semantics as `identity_header_user_id`.
 	IdentityHeaderGroups *string `json:"identity_header_groups,omitempty"`
 
-	// IdentityHeaderUserId Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
+	// IdentityHeaderUserId Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. Empty or omitted disables stamping for this dimension.
 	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
+	// MetadataDisabled Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected).
+	MetadataDisabled *bool `json:"metadata_disabled,omitempty"`
+
 	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
 	Models *[]AgentNetworkProviderModel `json:"models,omitempty"`
 
@@ -2275,47 +2443,68 @@ type AgentNetworkProviderRequest struct {
 	// ProviderId Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
 	ProviderId string `json:"provider_id"`
 
-	// SkipTlsVerification Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
+	// SkipTlsVerification Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false.
 	SkipTlsVerification *bool `json:"skip_tls_verification,omitempty"`
 
 	// UpstreamUrl Full upstream URL (with scheme) that NetBird forwards traffic to.
 	UpstreamUrl string `json:"upstream_url"`
 }
 
-// AgentNetworkSettings Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.
+// AgentNetworkSettings Per-account Agent Network gateway settings. One row per account; endpoint and proxy_address are assigned at bootstrap (POST) and immutable thereafter. Before bootstrap the account reads as the default values with empty endpoint and proxy_address.
 type AgentNetworkSettings struct {
 	// AccessLogRetentionDays Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely. Usage records are retained independently.
 	AccessLogRetentionDays *int `json:"access_log_retention_days,omitempty"`
 
-	// Cluster Address of the NetBird proxy cluster fronting this account's agent-network endpoint.
-	Cluster string `json:"cluster"`
-
-	// CreatedAt Timestamp when the settings row was created.
+	// CreatedAt Timestamp when the settings row was created. Absent until the account is bootstrapped.
 	CreatedAt *time.Time `json:"created_at,omitempty"`
 
+	// Dedicated Whether the account's gateway is served by a proxy dedicated to it (endpoint equals proxy_address).
+	Dedicated bool `json:"dedicated"`
+
 	// EnableLogCollection Whether per-request access-log entries are collected for this account's agent-network traffic.
 	EnableLogCollection bool `json:"enable_log_collection"`
 
 	// EnablePromptCollection Master switch for request/response prompt capture. Capture runs only when this is on AND a policy guardrail also enables it.
 	EnablePromptCollection bool `json:"enable_prompt_collection"`
 
-	// Endpoint Bare hostname agents call for this account, computed as `<subdomain>.<cluster>`.
+	// Endpoint Bare hostname agents call for this account. Empty until the account is bootstrapped.
 	Endpoint string `json:"endpoint"`
 
+	// ProxyAddress Declared cluster address of the proxy serving this account's gateway. Equal to `endpoint` when a dedicated proxy serves the account; otherwise the endpoint's immediate parent (a shared cluster the endpoint hangs one label beneath). Empty until the account is bootstrapped.
+	ProxyAddress string `json:"proxy_address"`
+
 	// RedactPii Whether captured prompts have PII redacted. Effective redaction is the OR of this and any policy guardrail's redact setting.
 	RedactPii bool `json:"redact_pii"`
 
-	// Subdomain Auto-generated DNS-safe label that prefixes the cluster to form the agent-network endpoint.
-	Subdomain string `json:"subdomain"`
-
-	// UpdatedAt Timestamp when the settings row was last updated.
+	// UpdatedAt Timestamp when the settings row was last updated. Absent until the account is bootstrapped.
 	UpdatedAt *time.Time `json:"updated_at,omitempty"`
 }
 
-// AgentNetworkSettingsRequest Mutable account-level Agent Network settings. Cluster and subdomain are immutable and not accepted here.
+// AgentNetworkSettingsCreateRequest Bootstraps the per-account Agent Network settings row, assigning the account's immutable endpoint. Exactly one of `proxy_address` and `endpoint` must be provided. `proxy_address` requests a labeled endpoint — the server allocates a label and the endpoint becomes `<label>.<proxy_address>`, served by whichever proxy declares that parent address. `endpoint` claims the given hostname itself as a self-addressed (dedicated) endpoint, served only by a proxy declaring exactly that address — the claim is legitimate before the proxy exists (address-first). Collection toggles may ride along; omitted toggles take their defaults.
+type AgentNetworkSettingsCreateRequest struct {
+	// AccessLogRetentionDays Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely. Defaults to 30.
+	AccessLogRetentionDays *int `json:"access_log_retention_days,omitempty"`
+
+	// EnableLogCollection Whether per-request access-log entries are collected for this account's agent-network traffic. Defaults to true.
+	EnableLogCollection *bool `json:"enable_log_collection,omitempty"`
+
+	// EnablePromptCollection Master switch for request/response prompt capture. Defaults to false.
+	EnablePromptCollection *bool `json:"enable_prompt_collection,omitempty"`
+
+	// Endpoint Hostname to claim as the account's self-addressed (dedicated) endpoint. Mutually exclusive with `proxy_address`. Rejected when another account already holds it.
+	Endpoint *string `json:"endpoint,omitempty"`
+
+	// ProxyAddress Cluster address to allocate a labeled endpoint beneath. Mutually exclusive with `endpoint`.
+	ProxyAddress *string `json:"proxy_address,omitempty"`
+
+	// RedactPii Whether captured prompts have PII redacted. Defaults to false.
+	RedactPii *bool `json:"redact_pii,omitempty"`
+}
+
+// AgentNetworkSettingsRequest Account-level Agent Network settings update. Every field is required, matching the PUT convention of the other endpoints. The endpoint and proxy address are assigned at bootstrap (POST) and are immutable — the request must carry them unchanged, and a request carrying different values is rejected. To change them, delete the settings (DELETE, guarded) and bootstrap again; re-creating allocates a new endpoint.
 type AgentNetworkSettingsRequest struct {
 	// AccessLogRetentionDays Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely.
-	AccessLogRetentionDays *int `json:"access_log_retention_days,omitempty"`
+	AccessLogRetentionDays int `json:"access_log_retention_days"`
 
 	// EnableLogCollection Whether per-request access-log entries are collected for this account's agent-network traffic.
 	EnableLogCollection bool `json:"enable_log_collection"`
@@ -2323,37 +2512,55 @@ type AgentNetworkSettingsRequest struct {
 	// EnablePromptCollection Master switch for request/response prompt capture.
 	EnablePromptCollection bool `json:"enable_prompt_collection"`
 
+	// Endpoint The account's gateway endpoint hostname. Immutable — must match the assigned value; a different value is rejected.
+	Endpoint string `json:"endpoint"`
+
+	// ProxyAddress Declared cluster address of the proxy serving this account's gateway. Immutable — must match the assigned value; a different value is rejected.
+	ProxyAddress string `json:"proxy_address"`
+
 	// RedactPii Whether captured prompts have PII redacted.
 	RedactPii bool `json:"redact_pii"`
 }
 
 // AgentNetworkUsageBucket One aggregated agent-network usage time bucket (UTC). The bucket width is set by the request's granularity.
 type AgentNetworkUsageBucket struct {
+	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage in the bucket.
+	CacheCostUsd float64 `json:"cache_cost_usd"`
+
+	// CacheCreationCostUsd Total cost of prompt-cache write tokens in the bucket.
+	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
+
+	// CacheCreationTokens Total prompt-cache write tokens in the bucket.
+	CacheCreationTokens int64 `json:"cache_creation_tokens"`
+
+	// CachedInputCostUsd Total cost of prompt-cache read tokens in the bucket.
+	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
+
+	// CachedInputTokens Total prompt-cache read tokens in the bucket.
+	CachedInputTokens int64 `json:"cached_input_tokens"`
+
 	// CostUsd Total estimated USD spend in the bucket.
 	CostUsd float64 `json:"cost_usd"`
 
+	// InputCostUsd Total cost of non-cached input tokens in the bucket.
+	InputCostUsd float64 `json:"input_cost_usd"`
+
 	// InputTokens Total input (prompt) tokens in the bucket.
 	InputTokens int64 `json:"input_tokens"`
 
+	// OutputCostUsd Total cost of output tokens in the bucket.
+	OutputCostUsd float64 `json:"output_cost_usd"`
+
 	// OutputTokens Total output (completion) tokens in the bucket.
 	OutputTokens int64 `json:"output_tokens"`
 
 	// PeriodStart Start of the bucket in YYYY-MM-DD (UTC) — the day, the week start (Monday), or the month start, depending on granularity.
 	PeriodStart string `json:"period_start"`
 
-	// TotalTokens Total tokens in the bucket.
+	// TotalTokens Total tokens in the bucket, including prompt-cache tokens.
 	TotalTokens int64 `json:"total_tokens"`
 }
 
-// AvailablePorts defines model for AvailablePorts.
-type AvailablePorts struct {
-	// Tcp Number of available TCP  ports left on the ingress peer
-	Tcp int `json:"tcp"`
-
-	// Udp Number of available UDP ports left on the ingress peer
-	Udp int `json:"udp"`
-}
-
 // AzureIntegration defines model for AzureIntegration.
 type AzureIntegration struct {
 	// ClientId Azure AD application (client) ID
@@ -2401,6 +2608,9 @@ type BundleParameters struct {
 	// Anonymize Whether sensitive data should be anonymized in the bundle.
 	Anonymize bool `json:"anonymize"`
 
+	// AnonymizeLevel How much the anonymizer redacts. "default" (or empty) keeps internal IP ranges, "strict" also anonymizes them.
+	AnonymizeLevel *string `json:"anonymize_level,omitempty"`
+
 	// BundleFor Whether to generate a bundle for the given timeframe.
 	BundleFor bool `json:"bundle_for"`
 
@@ -2409,6 +2619,9 @@ type BundleParameters struct {
 
 	// LogFileCount Maximum number of log files to include in the bundle.
 	LogFileCount int `json:"log_file_count"`
+
+	// UploadUrl Service URL the client requests an upload URL from before uploading the bundle. Empty selects the default upload server.
+	UploadUrl *string `json:"upload_url,omitempty"`
 }
 
 // BundleResult defines model for BundleResult.
@@ -2443,6 +2656,12 @@ type BypassResponse struct {
 	PeerId string `json:"peer_id"`
 }
 
+// CertificateCheck Posture check for a certificate held by the peer that chains to one of the given CA certificates. Not supported on mobile devices (iOS and Android), which always fail this check and are denied access
+type CertificateCheck struct {
+	// CaCertificates PEM encoded CA certificates the peer's certificate must chain to
+	CaCertificates []string `json:"ca_certificates"`
+}
+
 // CheckoutResponse defines model for CheckoutResponse.
 type CheckoutResponse struct {
 	// SessionId The unique identifier for the checkout session.
@@ -2454,6 +2673,9 @@ type CheckoutResponse struct {
 
 // Checks List of objects that perform the actual checks
 type Checks struct {
+	// CertificateCheck Posture check for a certificate held by the peer that chains to one of the given CA certificates. Not supported on mobile devices (iOS and Android), which always fail this check and are denied access
+	CertificateCheck *CertificateCheck `json:"certificate_check,omitempty"`
+
 	// GeoLocationCheck Posture check for geo location
 	GeoLocationCheck *GeoLocationCheck `json:"geo_location_check,omitempty"`
 
@@ -2750,7 +2972,7 @@ type EDRFleetDMRequest struct {
 	// LastSyncedInterval The devices last sync requirement interval in hours. Minimum value is 24 hours
 	LastSyncedInterval int `json:"last_synced_interval"`
 
-	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
+	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
 	MatchAttributes FleetDMMatchAttributes `json:"match_attributes"`
 }
 
@@ -2783,7 +3005,7 @@ type EDRFleetDMResponse struct {
 	// LastSyncedInterval The devices last sync requirement interval in hours.
 	LastSyncedInterval int `json:"last_synced_interval"`
 
-	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
+	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
 	MatchAttributes FleetDMMatchAttributes `json:"match_attributes"`
 
 	// UpdatedAt Timestamp of when the integration was last updated.
@@ -3003,7 +3225,7 @@ type Event struct {
 // EventActivityCode The string code of the activity that occurred during the event
 type EventActivityCode string
 
-// FleetDMMatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
+// FleetDMMatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
 type FleetDMMatchAttributes struct {
 	// DiskEncryptionEnabled Whether disk encryption (FileVault/BitLocker) must be enabled on the host
 	DiskEncryptionEnabled *bool `json:"disk_encryption_enabled,omitempty"`
@@ -3200,139 +3422,6 @@ type IdpIntegrationSyncLog struct {
 	Timestamp time.Time `json:"timestamp"`
 }
 
-// IngressPeer defines model for IngressPeer.
-type IngressPeer struct {
-	AvailablePorts AvailablePorts `json:"available_ports"`
-
-	// Connected Indicates if an ingress peer is connected to the management server
-	Connected bool `json:"connected"`
-
-	// Enabled Indicates if an ingress peer is enabled
-	Enabled bool `json:"enabled"`
-
-	// Fallback Indicates if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-	Fallback bool `json:"fallback"`
-
-	// Id ID of the ingress peer
-	Id string `json:"id"`
-
-	// IngressIp Ingress IP address of the ingress peer where the traffic arrives
-	IngressIp string `json:"ingress_ip"`
-
-	// PeerId ID of the peer that is used as an ingress peer
-	PeerId string `json:"peer_id"`
-
-	// Region Region of the ingress peer
-	Region string `json:"region"`
-}
-
-// IngressPeerCreateRequest defines model for IngressPeerCreateRequest.
-type IngressPeerCreateRequest struct {
-	// Enabled Defines if an ingress peer is enabled
-	Enabled bool `json:"enabled"`
-
-	// Fallback Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-	Fallback bool `json:"fallback"`
-
-	// PeerId ID of the peer that is used as an ingress peer
-	PeerId string `json:"peer_id"`
-}
-
-// IngressPeerUpdateRequest defines model for IngressPeerUpdateRequest.
-type IngressPeerUpdateRequest struct {
-	// Enabled Defines if an ingress peer is enabled
-	Enabled bool `json:"enabled"`
-
-	// Fallback Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-	Fallback bool `json:"fallback"`
-}
-
-// IngressPortAllocation defines model for IngressPortAllocation.
-type IngressPortAllocation struct {
-	// Enabled Indicates if an ingress port allocation is enabled
-	Enabled bool `json:"enabled"`
-
-	// Id ID of the ingress port allocation
-	Id string `json:"id"`
-
-	// IngressIp Ingress IP address of the ingress peer where the traffic arrives
-	IngressIp string `json:"ingress_ip"`
-
-	// IngressPeerId ID of the ingress peer that forwards the ports
-	IngressPeerId string `json:"ingress_peer_id"`
-
-	// Name Name of the ingress port allocation
-	Name string `json:"name"`
-
-	// PortRangeMappings List of port ranges that are allowed to be used by the ingress peer
-	PortRangeMappings []IngressPortAllocationPortMapping `json:"port_range_mappings"`
-
-	// Region Region of the ingress peer
-	Region string `json:"region"`
-}
-
-// IngressPortAllocationPortMapping defines model for IngressPortAllocationPortMapping.
-type IngressPortAllocationPortMapping struct {
-	// IngressEnd The ending port of the range of ingress ports mapped to the forwarded ports
-	IngressEnd int `json:"ingress_end"`
-
-	// IngressStart The starting port of the range of ingress ports mapped to the forwarded ports
-	IngressStart int `json:"ingress_start"`
-
-	// Protocol Protocol accepted by the ports
-	Protocol IngressPortAllocationPortMappingProtocol `json:"protocol"`
-
-	// TranslatedEnd The ending port of the translated range of forwarded ports
-	TranslatedEnd int `json:"translated_end"`
-
-	// TranslatedStart The starting port of the translated range of forwarded ports
-	TranslatedStart int `json:"translated_start"`
-}
-
-// IngressPortAllocationPortMappingProtocol Protocol accepted by the ports
-type IngressPortAllocationPortMappingProtocol string
-
-// IngressPortAllocationRequest defines model for IngressPortAllocationRequest.
-type IngressPortAllocationRequest struct {
-	DirectPort *IngressPortAllocationRequestDirectPort `json:"direct_port,omitempty"`
-
-	// Enabled Indicates if an ingress port allocation is enabled
-	Enabled bool `json:"enabled"`
-
-	// Name Name of the ingress port allocation
-	Name string `json:"name"`
-
-	// PortRanges List of port ranges that are forwarded by the ingress peer
-	PortRanges *[]IngressPortAllocationRequestPortRange `json:"port_ranges,omitempty"`
-}
-
-// IngressPortAllocationRequestDirectPort defines model for IngressPortAllocationRequestDirectPort.
-type IngressPortAllocationRequestDirectPort struct {
-	// Count The number of ports to be forwarded
-	Count int `json:"count"`
-
-	// Protocol The protocol accepted by the port
-	Protocol IngressPortAllocationRequestDirectPortProtocol `json:"protocol"`
-}
-
-// IngressPortAllocationRequestDirectPortProtocol The protocol accepted by the port
-type IngressPortAllocationRequestDirectPortProtocol string
-
-// IngressPortAllocationRequestPortRange defines model for IngressPortAllocationRequestPortRange.
-type IngressPortAllocationRequestPortRange struct {
-	// End The ending port of the range of forwarded ports
-	End int `json:"end"`
-
-	// Protocol The protocol accepted by the port range
-	Protocol IngressPortAllocationRequestPortRangeProtocol `json:"protocol"`
-
-	// Start The starting port of the range of forwarded ports
-	Start int `json:"start"`
-}
-
-// IngressPortAllocationRequestPortRangeProtocol The protocol accepted by the port range
-type IngressPortAllocationRequestPortRangeProtocol string
-
 // InstanceStatus Instance status information
 type InstanceStatus struct {
 	// SetupRequired Indicates whether the instance requires initial setup
@@ -3568,6 +3657,15 @@ type Network struct {
 	RoutingPeersCount int `json:"routing_peers_count"`
 }
 
+// NetworkAddress defines model for NetworkAddress.
+type NetworkAddress struct {
+	// Mac MAC address of the interface
+	Mac string `json:"mac"`
+
+	// NetIp IP address with CIDR of the interface
+	NetIp string `json:"net_ip"`
+}
+
 // NetworkRequest defines model for NetworkRequest.
 type NetworkRequest struct {
 	// Description Network description
@@ -3709,9 +3807,18 @@ type NetworkTrafficEvent struct {
 	Events []NetworkTrafficSubEvent `json:"events"`
 
 	// FlowId FlowID is the ID of the connection flow. Not unique because it can be the same for multiple events (e.g., start and end of the connection).
-	FlowId string               `json:"flow_id"`
-	Icmp   NetworkTrafficICMP   `json:"icmp"`
-	Policy NetworkTrafficPolicy `json:"policy"`
+	FlowId string             `json:"flow_id"`
+	Icmp   NetworkTrafficICMP `json:"icmp"`
+
+	// NumOfDrops Number of drop events.
+	NumOfDrops int `json:"num_of_drops"`
+
+	// NumOfEnds Number of end events.
+	NumOfEnds int `json:"num_of_ends"`
+
+	// NumOfStarts Number of start events.
+	NumOfStarts int                  `json:"num_of_starts"`
+	Policy      NetworkTrafficPolicy `json:"policy"`
 
 	// Protocol Protocol is the protocol of the traffic (e.g. 1 = ICMP, 6 = TCP, 17 = UDP, etc.).
 	Protocol int `json:"protocol"`
@@ -3732,6 +3839,12 @@ type NetworkTrafficEvent struct {
 	// TxPackets Number of packets transmitted.
 	TxPackets int                `json:"tx_packets"`
 	User      NetworkTrafficUser `json:"user"`
+
+	// WindowEnd Timestamp of the end of the aggregation window.
+	WindowEnd time.Time `json:"window_end"`
+
+	// WindowStart Timestamp of the start of the aggregation window.
+	WindowStart time.Time `json:"window_start"`
 }
 
 // NetworkTrafficEventsResponse defines model for NetworkTrafficEventsResponse.
@@ -4002,6 +4115,9 @@ type Peer struct {
 	// Name Peer's hostname
 	Name string `json:"name"`
 
+	// NetworkAddresses Network interfaces (IP + MAC) reported by the peer
+	NetworkAddresses *[]NetworkAddress `json:"network_addresses,omitempty"`
+
 	// Os Peer's operating system and version
 	Os string `json:"os"`
 
@@ -4096,6 +4212,9 @@ type PeerBatch struct {
 	// Name Peer's hostname
 	Name string `json:"name"`
 
+	// NetworkAddresses Network interfaces (IP + MAC) reported by the peer
+	NetworkAddresses *[]NetworkAddress `json:"network_addresses,omitempty"`
+
 	// Os Peer's operating system and version
 	Os string `json:"os"`
 
@@ -4138,6 +4257,9 @@ type PeerLocalFlags struct {
 	// LazyConnectionEnabled Indicates whether lazy connection is enabled on this peer
 	LazyConnectionEnabled *bool `json:"lazy_connection_enabled,omitempty"`
 
+	// RemoteJobsAllowed Indicates whether the peer has opted into management-requested remote jobs (e.g. debug bundles)
+	RemoteJobsAllowed *bool `json:"remote_jobs_allowed,omitempty"`
+
 	// RosenpassEnabled Indicates whether Rosenpass is enabled on this peer
 	RosenpassEnabled *bool `json:"rosenpass_enabled,omitempty"`
 
@@ -4327,10 +4449,10 @@ type PolicyRule struct {
 	// Name Policy rule name identifier
 	Name string `json:"name"`
 
-	// PortRanges Policy rule affected ports ranges list
+	// PortRanges Policy rule affected ports ranges list. Mutually exclusive with `ports`. To mix individual ports with ranges in one rule, express each single port as a range with identical start and end values (for example, start 443, end 443).
 	PortRanges *[]RulePortRange `json:"port_ranges,omitempty"`
 
-	// Ports Policy rule affected ports
+	// Ports Policy rule affected ports. Mutually exclusive with `port_ranges`. A rule accepts either individual ports or port ranges, not both.
 	Ports *[]string `json:"ports,omitempty"`
 
 	// Protocol Policy rule type of the traffic
@@ -4367,10 +4489,10 @@ type PolicyRuleMinimum struct {
 	// Name Policy rule name identifier
 	Name string `json:"name"`
 
-	// PortRanges Policy rule affected ports ranges list
+	// PortRanges Policy rule affected ports ranges list. Mutually exclusive with `ports`. To mix individual ports with ranges in one rule, express each single port as a range with identical start and end values (for example, start 443, end 443).
 	PortRanges *[]RulePortRange `json:"port_ranges,omitempty"`
 
-	// Ports Policy rule affected ports
+	// Ports Policy rule affected ports. Mutually exclusive with `port_ranges`. A rule accepts either individual ports or port ranges, not both.
 	Ports *[]string `json:"ports,omitempty"`
 
 	// Protocol Policy rule type of the traffic
@@ -4410,10 +4532,10 @@ type PolicyRuleUpdate struct {
 	// Name Policy rule name identifier
 	Name string `json:"name"`
 
-	// PortRanges Policy rule affected ports ranges list
+	// PortRanges Policy rule affected ports ranges list. Mutually exclusive with `ports`. To mix individual ports with ranges in one rule, express each single port as a range with identical start and end values (for example, start 443, end 443).
 	PortRanges *[]RulePortRange `json:"port_ranges,omitempty"`
 
-	// Ports Policy rule affected ports
+	// Ports Policy rule affected ports. Mutually exclusive with `port_ranges`. A rule accepts either individual ports or port ranges, not both.
 	Ports *[]string `json:"ports,omitempty"`
 
 	// Protocol Policy rule type of the traffic
@@ -4821,7 +4943,7 @@ type RouteRequest struct {
 	SkipAutoApply *bool `json:"skip_auto_apply,omitempty"`
 }
 
-// RulePortRange Policy rule affected ports range
+// RulePortRange Policy rule affected ports range. A range with identical start and end values represents a single port.
 type RulePortRange struct {
 	// End The ending port of the range
 	End int `json:"end"`
@@ -5015,6 +5137,9 @@ type ServiceRequestMode string
 
 // ServiceTarget defines model for ServiceTarget.
 type ServiceTarget struct {
+	// AccessAction Access action applied after this target's HTTP path prefix is selected. "inherit" uses the service authentication configuration, "bypass" skips service authentication, and "block" denies access. HTTP services only.
+	AccessAction *ServiceTargetAccessAction `json:"access_action,omitempty"`
+
 	// Enabled Whether this target is enabled
 	Enabled bool `json:"enabled"`
 
@@ -5038,6 +5163,9 @@ type ServiceTarget struct {
 	TargetType ServiceTargetTargetType `json:"target_type"`
 }
 
+// ServiceTargetAccessAction Access action applied after this target's HTTP path prefix is selected. "inherit" uses the service authentication configuration, "bypass" skips service authentication, and "block" denies access. HTTP services only.
+type ServiceTargetAccessAction string
+
 // ServiceTargetProtocol Protocol to use when connecting to the backend
 type ServiceTargetProtocol string
 
@@ -5842,6 +5970,12 @@ type GetApiEventsNetworkTrafficParams struct {
 	// ReporterId Filter by reporter ID
 	ReporterId *string `form:"reporter_id,omitempty" json:"reporter_id,omitempty"`
 
+	// SourceId Filter by source endpoint ID
+	SourceId *string `form:"source_id,omitempty" json:"source_id,omitempty"`
+
+	// DestinationId Filter by destination endpoint ID
+	DestinationId *string `form:"destination_id,omitempty" json:"destination_id,omitempty"`
+
 	// Protocol Filter by protocol
 	Protocol *int `form:"protocol,omitempty" json:"protocol,omitempty"`
 
@@ -6009,12 +6143,9 @@ type GetApiPeersParams struct {
 
 	// Ip Filter peers by IP address
 	Ip *string `form:"ip,omitempty" json:"ip,omitempty"`
-}
 
-// GetApiPeersPeerIdIngressPortsParams defines parameters for GetApiPeersPeerIdIngressPorts.
-type GetApiPeersPeerIdIngressPortsParams struct {
-	// Name Filters ingress port allocations by name
-	Name *string `form:"name,omitempty" json:"name,omitempty"`
+	// Mac Filter peers by MAC address of a network interface
+	Mac *string `form:"mac,omitempty" json:"mac,omitempty"`
 }
 
 // GetApiUsersParams defines parameters for GetApiUsers.
@@ -6032,6 +6163,9 @@ type PostApiAgentNetworkBudgetRulesJSONRequestBody = AgentNetworkBudgetRuleReque
 // PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody defines body for PutApiAgentNetworkBudgetRulesRuleId for application/json ContentType.
 type PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody = AgentNetworkBudgetRuleRequest
 
+// PostApiAgentNetworkCatalogProvidersModelsJSONRequestBody defines body for PostApiAgentNetworkCatalogProvidersModels for application/json ContentType.
+type PostApiAgentNetworkCatalogProvidersModelsJSONRequestBody = AgentNetworkModelDiscoveryRequest
+
 // PostApiAgentNetworkGuardrailsJSONRequestBody defines body for PostApiAgentNetworkGuardrails for application/json ContentType.
 type PostApiAgentNetworkGuardrailsJSONRequestBody = AgentNetworkGuardrailRequest
 
@@ -6050,6 +6184,9 @@ type PostApiAgentNetworkProvidersJSONRequestBody = AgentNetworkProviderRequest
 // PutApiAgentNetworkProvidersProviderIdJSONRequestBody defines body for PutApiAgentNetworkProvidersProviderId for application/json ContentType.
 type PutApiAgentNetworkProvidersProviderIdJSONRequestBody = AgentNetworkProviderRequest
 
+// PostApiAgentNetworkSettingsJSONRequestBody defines body for PostApiAgentNetworkSettings for application/json ContentType.
+type PostApiAgentNetworkSettingsJSONRequestBody = AgentNetworkSettingsCreateRequest
+
 // PutApiAgentNetworkSettingsJSONRequestBody defines body for PutApiAgentNetworkSettings for application/json ContentType.
 type PutApiAgentNetworkSettingsJSONRequestBody = AgentNetworkSettingsRequest
 
@@ -6092,12 +6229,6 @@ type PostApiIdentityProvidersJSONRequestBody = IdentityProviderRequest
 // PutApiIdentityProvidersIdpIdJSONRequestBody defines body for PutApiIdentityProvidersIdpId for application/json ContentType.
 type PutApiIdentityProvidersIdpIdJSONRequestBody = IdentityProviderRequest
 
-// PostApiIngressPeersJSONRequestBody defines body for PostApiIngressPeers for application/json ContentType.
-type PostApiIngressPeersJSONRequestBody = IngressPeerCreateRequest
-
-// PutApiIngressPeersIngressPeerIdJSONRequestBody defines body for PutApiIngressPeersIngressPeerId for application/json ContentType.
-type PutApiIngressPeersIngressPeerIdJSONRequestBody = IngressPeerUpdateRequest
-
 // CreateAzureIntegrationJSONRequestBody defines body for CreateAzureIntegration for application/json ContentType.
 type CreateAzureIntegrationJSONRequestBody = CreateAzureIntegrationRequest
 
@@ -6206,12 +6337,6 @@ type PutApiNetworksNetworkIdRoutersRouterIdJSONRequestBody = NetworkRouterReques
 // PutApiPeersPeerIdJSONRequestBody defines body for PutApiPeersPeerId for application/json ContentType.
 type PutApiPeersPeerIdJSONRequestBody = PeerRequest
 
-// PostApiPeersPeerIdIngressPortsJSONRequestBody defines body for PostApiPeersPeerIdIngressPorts for application/json ContentType.
-type PostApiPeersPeerIdIngressPortsJSONRequestBody = IngressPortAllocationRequest
-
-// PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody defines body for PutApiPeersPeerIdIngressPortsAllocationId for application/json ContentType.
-type PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody = IngressPortAllocationRequest
-
 // PostApiPeersPeerIdJobsJSONRequestBody defines body for PostApiPeersPeerIdJobs for application/json ContentType.
 type PostApiPeersPeerIdJobsJSONRequestBody = JobRequest
 
diff --git a/shared/management/http/apiv1alpha1/bundle.yaml b/shared/management/http/apiv1alpha1/bundle.yaml
new file mode 100644
index 000000000..5ac8011ea
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/bundle.yaml
@@ -0,0 +1,1069 @@
+openapi: 3.1.0
+servers:
+  - url: /api/v1alpha1
+    description: Default server
+info:
+  title: NetBird REST API
+  description: API to manipulate groups, rules, policies and retrieve information about peers and users
+  version: 1.0.0-alpha1
+tags:
+  - name: Users
+    description: Interact with and view information about users.
+  - name: Tokens
+    description: Interact with and view information about tokens.
+  - name: Peers
+    description: Interact with and view information about peers.
+  - name: Setup Keys
+    description: Interact with and view information about setup keys.
+  - name: Groups
+    description: Interact with and view information about groups.
+  - name: Policies
+    description: Interact with and view information about policies.
+  - name: Posture Checks
+    description: Interact with and view information about posture checks.
+  - name: Routes
+    description: Interact with and view information about routes.
+  - name: DNS
+    description: Interact with and view information about DNS configuration.
+  - name: DNS Zones
+    description: Interact with and view information about custom DNS zones.
+  - name: Events
+    description: View information about the account and network events.
+  - name: Accounts
+    description: View information about the accounts.
+  - name: Ingress Ports
+    description: Interact with and view information about the ingress peers and ports.
+    x-cloud-only: true
+  - name: Identity Providers
+    description: Interact with and view information about identity providers.
+  - name: Services
+    description: Interact with and view information about reverse proxy services.
+  - name: Instance
+    description: Instance setup and status endpoints for initial configuration.
+  - name: Jobs
+    description: Interact with and view information about remote jobs.
+    x-experimental: true
+  - name: Usage
+    description: Retrieve current usage statistics for the account.
+    x-cloud-only: true
+  - name: Subscription
+    description: Manage and view information about account subscriptions.
+    x-cloud-only: true
+  - name: Plans
+    description: Retrieve available plans and products.
+    x-cloud-only: true
+  - name: Checkout
+    description: Manage checkout sessions for plan subscriptions.
+    x-cloud-only: true
+  - name: AWS Marketplace
+    description: Manage AWS Marketplace subscriptions.
+    x-cloud-only: true
+  - name: Portal
+    description: Access customer portal for subscription management.
+    x-cloud-only: true
+  - name: Invoice
+    description: Manage and retrieve account invoices.
+    x-cloud-only: true
+  - name: MSP
+    description: MSP portal for Tenant management.
+    x-cloud-only: true
+  - name: IDP SCIM Integrations
+    description: Manage generic SCIM identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Google Integrations
+    description: Manage Google Workspace identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Azure Integrations
+    description: Manage Azure AD identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Okta SCIM Integrations
+    description: Manage Okta SCIM identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: EDR Intune Integrations
+    description: Manage Microsoft Intune EDR integrations.
+    x-cloud-only: true
+  - name: EDR SentinelOne Integrations
+    description: Manage SentinelOne EDR integrations.
+    x-cloud-only: true
+  - name: EDR Falcon Integrations
+    description: Manage CrowdStrike Falcon EDR integrations.
+    x-cloud-only: true
+  - name: EDR Huntress Integrations
+    description: Manage Huntress EDR integrations.
+    x-cloud-only: true
+  - name: EDR FleetDM Integrations
+    description: Manage FleetDM EDR integrations.
+    x-cloud-only: true
+  - name: EDR Peers
+    description: Manage EDR compliance bypass for peers.
+    x-cloud-only: true
+  - name: Event Streaming Integrations
+    description: Manage event streaming integrations.
+    x-cloud-only: true
+  - name: Notifications
+    description: Manage notification channels for account event alerts.
+    x-cloud-only: true
+components:
+  schemas:
+    CountryCode:
+      description: 2-letter ISO 3166-1 alpha-2 code that represents the country
+      type: string
+      example: "DE"
+    CityName:
+      description: Commonly used English name of the city
+      type: string
+      example: "Berlin"
+    Country:
+      description: Describe country geographical location information
+      type: object
+      properties:
+        country_name:
+          description: Commonly used English name of the country
+          type: string
+          example: "Germany"
+        country_code:
+          $ref: '#/components/schemas/CountryCode'
+      required:
+        - country_name
+        - country_code
+    City:
+      description: Describe city geographical location information
+      type: object
+      properties:
+        geoname_id:
+          description: Integer ID of the record in GeoNames database
+          type: integer
+          example: 2950158
+        city_name:
+          description: Commonly used English name of the city
+          type: string
+          example: "Berlin"
+      required:
+        - geoname_id
+        - city_name
+    ErrorResponse:
+      type: object
+      description: Standard error response
+      properties:
+        message:
+          type: string
+          description: A human-readable error message.
+          example: "couldn't parse JSON request"
+    PeerBatch:
+      type: object
+      properties:
+        peer_count:
+          description: Total number of peers
+          type: integer
+          example: 5
+        page:
+          description: Current page number
+          type: integer
+          example: 5
+        page_size:
+          description: Page size
+          type: integer
+          example: 5
+        peers:
+          description: List of peers
+          type: array
+          items:
+            $ref: '#/components/schemas/Peer'
+      required:
+        - peer_count
+        - page
+        - page_size
+        - peers
+    PeerMinimum:
+      type: object
+      properties:
+        id:
+          description: Peer ID
+          type: string
+          example: chacbco6lnnbn6cg5s90
+        name:
+          description: Peer's hostname
+          type: string
+          example: stage-host-1
+      required:
+        - id
+        - name
+    GroupMinimum:
+      type: object
+      properties:
+        id:
+          description: Group ID
+          type: string
+          example: ch8i4ug6lnn4g9hqv7m0
+        name:
+          description: Group Name identifier
+          type: string
+          example: devs
+        peers_count:
+          description: Count of peers associated to the group
+          type: integer
+          example: 2
+        resources_count:
+          description: Count of resources associated to the group
+          type: integer
+          example: 5
+        issued:
+          description: How the group was issued (api, integration, jwt)
+          type: string
+          enum:
+            - "api"
+            - "integration"
+            - "jwt"
+          example: api
+      required:
+        - id
+        - name
+        - peers_count
+        - resources_count
+    PeerLocalFlags:
+      type: object
+      properties:
+        rosenpass_enabled:
+          description: Indicates whether Rosenpass is enabled on this peer
+          type: boolean
+          example: true
+        rosenpass_permissive:
+          description: Indicates whether Rosenpass is in permissive mode or not
+          type: boolean
+          example: false
+        server_ssh_allowed:
+          description: Indicates whether SSH access this peer is allowed or not
+          type: boolean
+          example: true
+        remote_jobs_allowed:
+          description: Indicates whether the peer has opted into management-requested remote jobs (e.g. debug bundles)
+          type: boolean
+          example: true
+        disable_client_routes:
+          description: Indicates whether client routes are disabled on this peer or not
+          type: boolean
+          example: false
+        disable_server_routes:
+          description: Indicates whether server routes are disabled on this peer or not
+          type: boolean
+          example: false
+        disable_dns:
+          description: Indicates whether DNS management is disabled on this peer or not
+          type: boolean
+          example: false
+        disable_firewall:
+          description: Indicates whether firewall management is disabled on this peer or not
+          type: boolean
+          example: false
+        block_lan_access:
+          description: Indicates whether LAN access is blocked on this peer when used as a routing peer
+          type: boolean
+          example: false
+        block_inbound:
+          description: Indicates whether inbound traffic is blocked on this peer
+          type: boolean
+          example: false
+        lazy_connection_enabled:
+          description: Indicates whether lazy connection is enabled on this peer
+          type: boolean
+          example: false
+    Peer:
+      allOf:
+        - $ref: '#/components/schemas/PeerMinimum'
+        - type: object
+          properties:
+            created_at:
+              description: Peer creation date (UTC)
+              type: string
+              format: date-time
+              example: "2023-05-05T09:00:35.477782Z"
+            ip:
+              description: Peer's IP address
+              type: string
+              example: 10.64.0.1
+            ipv6:
+              description: Peer's IPv6 overlay address
+              type: string
+              format: ipv6
+              example: "fd00:4e42:ab12::1"
+            connection_ip:
+              description: Peer's public connection IP address
+              type: string
+              example: 35.64.0.1
+            connected:
+              description: Peer to Management connection status
+              type: boolean
+              example: true
+            last_seen:
+              description: Last time peer connected to Netbird's management service
+              type: string
+              format: date-time
+              example: "2023-05-05T10:05:26.420578Z"
+            os:
+              description: Peer's operating system and version
+              type: string
+              example: Darwin 13.2.1
+            kernel_version:
+              description: Peer's operating system kernel version
+              type: string
+              example: 23.2.0
+            geoname_id:
+              description: Unique identifier from the GeoNames database for a specific geographical location.
+              type: integer
+              example: 2643743
+            version:
+              description: Peer's daemon or cli version
+              type: string
+              example: 0.14.0
+            groups:
+              description: Groups that the peer belongs to
+              type: array
+              items:
+                $ref: '#/components/schemas/GroupMinimum'
+            ssh_enabled:
+              description: Indicates whether SSH server is enabled on this peer
+              type: boolean
+              example: true
+            user_id:
+              description: User ID of the user that enrolled this peer
+              type: string
+              example: google-oauth2|277474792786460067937
+            hostname:
+              description: Hostname of the machine
+              type: string
+              example: stage-host-1
+            ui_version:
+              description: Peer's desktop UI version
+              type: string
+              example: 0.14.0
+            dns_label:
+              description: Peer's DNS label is the parsed peer name for domain resolution. It is used to form an FQDN by appending the account's domain to the peer label. e.g. peer-dns-label.netbird.cloud
+              type: string
+              example: stage-host-1.netbird.cloud
+            login_expiration_enabled:
+              description: Indicates whether peer login expiration has been enabled or not
+              type: boolean
+              example: false
+            login_expired:
+              description: Indicates whether peer's login expired or not
+              type: boolean
+              example: false
+            last_login:
+              description: Last time this peer performed log in (authentication). E.g., user authenticated.
+              type: string
+              format: date-time
+              example: "2023-05-05T09:00:35.477782Z"
+            inactivity_expiration_enabled:
+              description: Indicates whether peer inactivity expiration has been enabled or not
+              type: boolean
+              example: false
+            approval_required:
+              description: (Cloud only) Indicates whether peer needs approval
+              type: boolean
+              example: true
+            disapproval_reason:
+              description: (Cloud only) Reason why the peer requires approval
+              type: string
+            country_code:
+              $ref: '#/components/schemas/CountryCode'
+            city_name:
+              $ref: '#/components/schemas/CityName'
+            serial_number:
+              description: System serial number
+              type: string
+              example: "C02XJ0J0JGH7"
+            extra_dns_labels:
+              description: Extra DNS labels added to the peer
+              type: array
+              items:
+                type: string
+                example: "stage-host-1"
+            ephemeral:
+              description: Indicates whether the peer is ephemeral or not
+              type: boolean
+              example: false
+            local_flags:
+              $ref: '#/components/schemas/PeerLocalFlags'
+          required:
+            - city_name
+            - connected
+            - connection_ip
+            - country_code
+            - created_at
+            - dns_label
+            - geoname_id
+            - groups
+            - hostname
+            - ip
+            - kernel_version
+            - last_login
+            - last_seen
+            - login_expiration_enabled
+            - login_expired
+            - inactivity_expiration_enabled
+            - os
+            - ssh_enabled
+            - user_id
+            - version
+            - ui_version
+            - approval_required
+            - serial_number
+            - extra_dns_labels
+            - ephemeral
+    PeerRequest:
+      type: object
+      properties:
+        name:
+          type: string
+          example: stage-host-1
+        ssh_enabled:
+          type: boolean
+          example: true
+        login_expiration_enabled:
+          type: boolean
+          example: false
+        inactivity_expiration_enabled:
+          type: boolean
+          example: false
+        approval_required:
+          description: (Cloud only) Indicates whether peer needs approval
+          type: boolean
+          example: true
+        ip:
+          description: Peer's IP address
+          type: string
+          format: ipv4
+          example: 100.64.0.15
+        ipv6:
+          description: Peer's IPv6 overlay address. Omitted if IPv6 is not enabled for the account.
+          type: string
+          format: ipv6
+          example: "fd00:4e42:ab12::1"
+      required:
+        - name
+        - ssh_enabled
+        - login_expiration_enabled
+        - inactivity_expiration_enabled
+    User:
+      type: object
+      properties:
+        id:
+          description: User ID
+          type: string
+          example: google-oauth2|277474792786460067937
+        email:
+          description: User's email address
+          type: string
+          example: demo@netbird.io
+        password:
+          description: User's password. Only present when user is created (create user endpoint is called) and only when IdP supports user creation with password.
+          type: string
+          example: super_secure_password
+        name:
+          description: User's name from idp provider
+          type: string
+          example: Tom Schulz
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        status:
+          description: User's status
+          type: string
+          enum:
+            - "active"
+            - "invited"
+            - "blocked"
+          example: active
+        last_login:
+          description: Last time this user performed a login to the dashboard
+          type: string
+          format: date-time
+          example: "2023-05-05T09:00:35.477782Z"
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_current:
+          description: Is true if authenticated user is the same as this user
+          type: boolean
+          readOnly: true
+          example: true
+        is_service_user:
+          description: Is true if this user is a service user
+          type: boolean
+          readOnly: true
+          example: false
+        is_blocked:
+          description: Is true if this user is blocked. Blocked users can't use the system
+          type: boolean
+          example: false
+        pending_approval:
+          description: Is true if this user requires approval before being activated. Only applicable for users joining via domain matching when user_approval_required is enabled.
+          type: boolean
+          example: false
+        issued:
+          description: How user was issued by API or Integration
+          type: string
+          example: api
+        idp_id:
+          description: Identity provider ID (connector ID) that the user authenticated with. Only populated for users with Dex-encoded user IDs.
+          type: string
+          example: okta-abc123
+        permissions:
+          $ref: '#/components/schemas/UserPermissions'
+      required:
+        - id
+        - email
+        - name
+        - role
+        - auto_groups
+        - status
+        - is_blocked
+        - pending_approval
+    UserCreateRequest:
+      type: object
+      properties:
+        email:
+          description: User's Email to send invite to
+          type: string
+          example: demo@netbird.io
+        name:
+          description: User's full name
+          type: string
+          example: Tom Schulz
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_service_user:
+          description: Is true if this user is a service user
+          type: boolean
+          example: false
+      required:
+        - role
+        - auto_groups
+        - is_service_user
+    UserRequest:
+      type: object
+      properties:
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_blocked:
+          description: If set to true then user is blocked and can't use the system
+          type: boolean
+          example: false
+      required:
+        - role
+        - auto_groups
+        - is_blocked
+    UserPermissions:
+      type: object
+      properties:
+        is_restricted:
+          type: boolean
+          description: Indicates whether this User's Peers view is restricted
+        modules:
+          type: object
+          additionalProperties:
+            type: object
+            additionalProperties:
+              type: boolean
+            propertyNames:
+              type: string
+              description: The operation type
+          propertyNames:
+            type: string
+            description: The module name
+          example: {"networks": {"read": true, "create": false, "update": false, "delete": false}, "peers": {"read": false, "create": false, "update": false, "delete": false}}
+      required:
+        - modules
+        - is_restricted
+  responses:
+    not_found:
+      description: Resource not found
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    validation_failed_simple:
+      description: Validation failed
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    bad_request:
+      description: Bad Request
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    unprocessable:
+      description: Unprocessable Entity
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              message:
+                type: string
+              code:
+                type: integer
+            required:
+              - message
+              - code
+    internal_error:
+      description: Internal Server Error
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    validation_failed:
+      description: Validation failed
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    forbidden:
+      description: Forbidden
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    requires_authentication:
+      description: Requires authentication
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    conflict:
+      description: Conflict
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+  headers:
+    X-Request-Id:
+      description: |
+        Unique identifier assigned to the request by the server and set on every
+        response. Useful for correlating client requests with server-side logs.
+      schema:
+        type: string
+        example: cot7r4n3l3vh3qj4qveg
+      example: cot7r4n3l3vh3qj4qveg
+  securitySchemes:
+    BearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+    TokenAuth:
+      type: apiKey
+      in: header
+      name: Authorization
+      description: >-
+        Enter the token with the `Token` prefix, e.g. "Token nbp_F3f0d.....".
+  pathItems:
+    peers:
+      get:
+        summary: List all Peers
+        description: Returns a list of all peers
+        tags:
+          - Peers
+        parameters:
+          - name: page
+            in: query
+            description: Page number
+            required: false
+            schema:
+              type: integer
+              minimum: 1
+              default: 1
+          - name: page_size
+            in: query
+            description: Number of peers per page
+            required: false
+            schema:
+              type: integer
+              minimum: 1
+              maximum: 250
+              default: 100
+          - name: user_id
+            in: query
+            description: filter peers by their user_id
+            required: false
+            schema:
+              type: string
+          - name: group_ids
+            in: query
+            description: filter peers by group_ids
+            required: false
+            schema:
+              type: array
+              items:
+                type: string
+          - name: peer_ids
+            in: query
+            description: filter peers by their ids
+            required: false
+            schema:
+              type: array
+              minItems: 1
+              maxItems: 50
+              items:
+                type: string
+          - name: connected
+            in: query
+            description: Filter by peer connected status
+            required: false
+            schema:
+              type: boolean
+          - name: approval_required
+            in: query
+            description: Filter by approval_required field
+            required: false
+            schema:
+              type: boolean
+          - name: os
+            in: query
+            description: Peer os
+            required: false
+            schema:
+              type: array
+              items:
+                type: string
+                enum:
+                  - linux
+                  - windows
+                  - darwin
+                  - android
+                  - ios
+                  - js
+          - name: ip
+            in: query
+            description: filter peers by ip
+            required: false
+            schema:
+              type: string
+          - name: mac
+            in: query
+            description: filter peers by mac address
+            required: false
+            schema:
+              type: string
+          - name: name
+            in: query
+            description: filter peers by hostname
+            required: false
+            schema:
+              type: string
+          - name: hostname
+            in: query
+            description: filter peers by hostname
+            required: false
+            schema:
+              type: string
+          - name: kind
+            in: query
+            description: filter peers by host kind
+            required: false
+            schema:
+              type: string
+              enum:
+                - server
+                - user_device
+          - name: sort_by
+            in: query
+            description: sorting of peers
+            required: false
+            example: sort_by=name,asc&sort_by=last_seen,desc&sort_by=version
+            schema:
+              type: array
+              items:
+                type: string
+                enum:
+                  - name
+                  - last_seen
+                  - version
+                  - asc
+                  - desc
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        responses:
+          '200':
+            description: A JSON Array of Peers
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/PeerBatch'
+          '400':
+            "$ref": "#/components/responses/bad_request"
+          '401':
+            "$ref": "#/components/responses/requires_authentication"
+          '403':
+            "$ref": "#/components/responses/forbidden"
+          '422':
+            "$ref": "#/components/responses/unprocessable"
+          '500':
+            "$ref": "#/components/responses/internal_error"
+    peer:
+      get:
+        summary: Retrieve a Peer
+        description: Get information about a peer
+        tags:
+          - Peers
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: path
+            name: peerId
+            required: true
+            schema:
+              type: string
+            description: The unique identifier of a peer
+        responses:
+          '200':
+            description: A Peer object
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/Peer'
+          '400':
+            "$ref": '#/components/responses/bad_request'
+          '401':
+            "$ref": '#/components/responses/requires_authentication'
+          '403':
+            "$ref": '#/components/responses/forbidden'
+          '500':
+            "$ref": '#/components/responses/internal_error'
+      put:
+        summary: Update a Peer
+        description: Update information about a peer
+        tags:
+          - Peers
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: path
+            name: peerId
+            required: true
+            schema:
+              type: string
+            description: The unique identifier of a peer
+        requestBody:
+          description: update a peer
+          required: true
+          content:
+            'application/json':
+              schema:
+                $ref: '#/components/schemas/PeerRequest'
+        responses:
+          '200':
+            description: A Peer object
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/Peer'
+          '400':
+            "$ref": '#/components/responses/bad_request'
+          '401':
+            "$ref": '#/components/responses/requires_authentication'
+          '403':
+            "$ref": '#/components/responses/forbidden'
+          '422':
+            "$ref": "#/components/responses/unprocessable"
+          '500':
+            "$ref": '#/components/responses/internal_error'
+      delete:
+        summary: Delete a Peer
+        description: Delete a peer
+        tags:
+          - Peers
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: path
+            name: peerId
+            required: true
+            schema:
+              type: string
+            description: The unique identifier of a peer
+        responses:
+          '200':
+            description: Delete status code
+            content: {}
+          '400':
+            "$ref": '#/components/responses/bad_request'
+          '401':
+            "$ref": '#/components/responses/requires_authentication'
+          '403':
+            "$ref": '#/components/responses/forbidden'
+          '500':
+            "$ref": '#/components/responses/internal_error'
+    UsersPath:
+      get:
+        summary: List all Users
+        description: Returns a list of all users
+        tags:
+          - Users
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: query
+            name: service_user
+            schema:
+              type: boolean
+            description: Filters users and returns either regular users or service users
+        responses:
+          '200':
+            description: A JSON array of Users
+            content:
+              application/json:
+                schema:
+                  type: array
+                  items:
+                    $ref: '#/components/schemas/User'
+          '400':
+            "$ref": "#/components/responses/bad_request"
+          '401':
+            "$ref": "#/components/responses/requires_authentication"
+          '403':
+            "$ref": "#/components/responses/forbidden"
+          '422':
+            "$ref": "#/components/responses/unprocessable"
+          '500':
+            "$ref": "#/components/responses/internal_error"
+      post:
+        summary: Create a User
+        description: Creates a new service user or sends an invite to a regular user
+        tags:
+          - Users
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        requestBody:
+          description: User invite information
+          required: true
+          content:
+            'application/json':
+              schema:
+                $ref: '#/components/schemas/UserCreateRequest'
+        responses:
+          '200':
+            description: A User object
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/User'
+          '400':
+            "$ref": "#/components/responses/bad_request"
+          '401':
+            "$ref": "#/components/responses/requires_authentication"
+          '403':
+            "$ref": "#/components/responses/forbidden"
+          '422':
+            "$ref": "#/components/responses/unprocessable"
+          '500':
+            "$ref": "#/components/responses/internal_error"
+    UserPath:
+      put:
+        summary: Update a User
+        description: Update information about a User
+        tags:
+          - Users
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: path
+            name: userId
+            required: true
+            schema:
+              type: string
+            description: The unique identifier of a user
+        requestBody:
+          description: User update
+          required: true
+          content:
+            'application/json':
+              schema:
+                $ref: '#/components/schemas/UserRequest'
+        responses:
+          '200':
+            description: A User object
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/User'
+          '400':
+            "$ref": "#/components/responses/bad_request"
+          '401':
+            "$ref": "#/components/responses/requires_authentication"
+          '403':
+            "$ref": "#/components/responses/forbidden"
+          '422':
+            "$ref": "#/components/responses/unprocessable"
+          '500':
+            "$ref": "#/components/responses/internal_error"
+      delete:
+        summary: Delete a User
+        description: This method removes a user from accessing the system. For this leaves the IDP user intact unless the `--user-delete-from-idp` is passed to management startup.
+        tags:
+          - Users
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: path
+            name: userId
+            required: true
+            schema:
+              type: string
+            description: The unique identifier of a user
+        responses:
+          '200':
+            description: Delete status code
+            content: {}
+          '400':
+            "$ref": "#/components/responses/bad_request"
+          '401':
+            "$ref": "#/components/responses/requires_authentication"
+          '403':
+            "$ref": "#/components/responses/forbidden"
+          '500':
+            "$ref": "#/components/responses/internal_error"
+paths:
+  /peers:
+    $ref: '#/components/pathItems/peers'
+  /peers/{peerId}:
+    $ref: '#/components/pathItems/peer'
+  /users:
+    $ref: '#/components/pathItems/UsersPath'
+  /users/{userId}:
+    $ref: '#/components/pathItems/UserPath'
diff --git a/shared/management/http/apiv1alpha1/group/components.yaml b/shared/management/http/apiv1alpha1/group/components.yaml
new file mode 100644
index 000000000..6817cd8c0
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/group/components.yaml
@@ -0,0 +1,31 @@
+components:
+  schemas:
+    GroupMinimum:
+      type: object
+      properties:
+        id:
+          description: Group ID
+          type: string
+          example: ch8i4ug6lnn4g9hqv7m0
+        name:
+          description: Group Name identifier
+          type: string
+          example: devs
+        peers_count:
+          description: Count of peers associated to the group
+          type: integer
+          example: 2
+        resources_count:
+          description: Count of resources associated to the group
+          type: integer
+          example: 5
+        issued:
+          description: How the group was issued (api, integration, jwt)
+          type: string
+          enum: [ "api", "integration", "jwt" ]
+          example: api
+      required:
+        - id
+        - name
+        - peers_count
+        - resources_count
\ No newline at end of file
diff --git a/shared/management/http/apiv1alpha1/openapi.yaml b/shared/management/http/apiv1alpha1/openapi.yaml
new file mode 100644
index 000000000..2abd1709d
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/openapi.yaml
@@ -0,0 +1,250 @@
+openapi: 3.1.0
+servers:
+  - url: /api/v1alpha1
+    description: Default server
+info:
+  title: NetBird REST API
+  description: API to manipulate groups, rules, policies and retrieve information about peers and users
+  version: 1.0.0-alpha1
+tags:
+  - name: Users
+    description: Interact with and view information about users.
+  - name: Tokens
+    description: Interact with and view information about tokens.
+  - name: Peers
+    description: Interact with and view information about peers.
+  - name: Setup Keys
+    description: Interact with and view information about setup keys.
+  - name: Groups
+    description: Interact with and view information about groups.
+  - name: Policies
+    description: Interact with and view information about policies.
+  - name: Posture Checks
+    description: Interact with and view information about posture checks.
+  - name: Routes
+    description: Interact with and view information about routes.
+  - name: DNS
+    description: Interact with and view information about DNS configuration.
+  - name: DNS Zones
+    description: Interact with and view information about custom DNS zones.
+  - name: Events
+    description: View information about the account and network events.
+  - name: Accounts
+    description: View information about the accounts.
+  - name: Ingress Ports
+    description: Interact with and view information about the ingress peers and ports.
+    x-cloud-only: true
+  - name: Identity Providers
+    description: Interact with and view information about identity providers.
+  - name: Services
+    description: Interact with and view information about reverse proxy services.
+  - name: Instance
+    description: Instance setup and status endpoints for initial configuration.
+  - name: Jobs
+    description: Interact with and view information about remote jobs.
+    x-experimental: true
+
+  - name: Usage
+    description: Retrieve current usage statistics for the account.
+    x-cloud-only: true
+  - name: Subscription
+    description: Manage and view information about account subscriptions.
+    x-cloud-only: true
+  - name: Plans
+    description: Retrieve available plans and products.
+    x-cloud-only: true
+  - name: Checkout
+    description: Manage checkout sessions for plan subscriptions.
+    x-cloud-only: true
+  - name: AWS Marketplace
+    description: Manage AWS Marketplace subscriptions.
+    x-cloud-only: true
+  - name: Portal
+    description: Access customer portal for subscription management.
+    x-cloud-only: true
+  - name: Invoice
+    description: Manage and retrieve account invoices.
+    x-cloud-only: true
+  - name: MSP
+    description: MSP portal for Tenant management.
+    x-cloud-only: true
+  - name: IDP SCIM Integrations
+    description: Manage generic SCIM identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Google Integrations
+    description: Manage Google Workspace identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Azure Integrations
+    description: Manage Azure AD identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Okta SCIM Integrations
+    description: Manage Okta SCIM identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: EDR Intune Integrations
+    description: Manage Microsoft Intune EDR integrations.
+    x-cloud-only: true
+  - name: EDR SentinelOne Integrations
+    description: Manage SentinelOne EDR integrations.
+    x-cloud-only: true
+  - name: EDR Falcon Integrations
+    description: Manage CrowdStrike Falcon EDR integrations.
+    x-cloud-only: true
+  - name: EDR Huntress Integrations
+    description: Manage Huntress EDR integrations.
+    x-cloud-only: true
+  - name: EDR FleetDM Integrations
+    description: Manage FleetDM EDR integrations.
+    x-cloud-only: true
+  - name: EDR Peers
+    description: Manage EDR compliance bypass for peers.
+    x-cloud-only: true
+  - name: Event Streaming Integrations
+    description: Manage event streaming integrations.
+    x-cloud-only: true
+  - name: Notifications
+    description: Manage notification channels for account event alerts.
+    x-cloud-only: true
+
+components:
+  schemas:
+    CountryCode:
+      description: 2-letter ISO 3166-1 alpha-2 code that represents the country
+      type: string
+      example: "DE"
+    CityName:
+      description: Commonly used English name of the city
+      type: string
+      example: "Berlin"
+    Country:
+      description: Describe country geographical location information
+      type: object
+      properties:
+        country_name:
+          description: Commonly used English name of the country
+          type: string
+          example: "Germany"
+        country_code:
+          $ref: '#/components/schemas/CountryCode'
+      required:
+        - country_name
+        - country_code
+    City:
+      description: Describe city geographical location information
+      type: object
+      properties:
+        geoname_id:
+          description: Integer ID of the record in GeoNames database
+          type: integer
+          example: 2950158
+        city_name:
+          description: Commonly used English name of the city
+          type: string
+          example: "Berlin"
+      required:
+        - geoname_id
+        - city_name
+    ErrorResponse:
+      type: object
+      description: Standard error response
+      properties:
+        message:
+          type: string
+          description: A human-readable error message.
+          example: "couldn't parse JSON request"
+  responses:
+    not_found:
+      description: Resource not found
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    validation_failed_simple:
+      description: Validation failed
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    bad_request:
+      description: Bad Request
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    unprocessable:
+      description: Unprocessable Entity
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              message:
+                type: string
+              code:
+                type: integer
+            required:
+             - message
+             - code
+    internal_error:
+      description: Internal Server Error
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    validation_failed:
+      description: Validation failed
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    forbidden:
+      description: Forbidden
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    requires_authentication:
+      description: Requires authentication
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    conflict:
+      description: Conflict
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'   
+  headers:
+    X-Request-Id:
+      description: |
+        Unique identifier assigned to the request by the server and set on every
+        response. Useful for correlating client requests with server-side logs.
+      schema:
+        type: string
+        example: cot7r4n3l3vh3qj4qveg
+  securitySchemes:
+    BearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+    TokenAuth:
+      type: apiKey
+      in: header
+      name: Authorization
+      description: >-
+        Enter the token with the `Token` prefix, e.g. "Token nbp_F3f0d.....".
+paths:
+  /peers:
+    $ref: './peer/peers.yaml'
+  /peers/{peerId}:
+    $ref: './peer/peer.yaml'
+  /users:
+    $ref: './user/user_paths.yaml#/UsersPath'
+  /users/{userId}:
+    $ref: './user/user_paths.yaml#/UserPath'
diff --git a/shared/management/http/apiv1alpha1/peer/components.yaml b/shared/management/http/apiv1alpha1/peer/components.yaml
new file mode 100644
index 000000000..8c197d8e0
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/peer/components.yaml
@@ -0,0 +1,265 @@
+components:
+  schemas:
+    PeerRequest:
+      type: object
+      properties:
+        name:
+          type: string
+          example: stage-host-1
+        ssh_enabled:
+          type: boolean
+          example: true
+        login_expiration_enabled:
+          type: boolean
+          example: false
+        inactivity_expiration_enabled:
+          type: boolean
+          example: false
+        approval_required:
+          description: (Cloud only) Indicates whether peer needs approval
+          type: boolean
+          example: true
+        ip:
+          description: Peer's IP address
+          type: string
+          format: ipv4
+          example: 100.64.0.15
+        ipv6:
+          description: Peer's IPv6 overlay address. Omitted if IPv6 is not enabled for the account.
+          type: string
+          format: ipv6
+          example: "fd00:4e42:ab12::1"
+      required:
+        - name
+        - ssh_enabled
+        - login_expiration_enabled
+        - inactivity_expiration_enabled
+    PeerMinimum:
+      type: object
+      properties:
+        id:
+          description: Peer ID
+          type: string
+          example: chacbco6lnnbn6cg5s90
+        name:
+          description: Peer's hostname
+          type: string
+          example: stage-host-1
+      required:
+        - id
+        - name
+    Peer:
+      allOf:
+        - $ref: '#/components/schemas/PeerMinimum'
+        - type: object
+          properties:
+            created_at:
+              description: Peer creation date (UTC)
+              type: string
+              format: date-time
+              example: "2023-05-05T09:00:35.477782Z"
+            ip:
+              description: Peer's IP address
+              type: string
+              example: 10.64.0.1
+            ipv6:
+              description: Peer's IPv6 overlay address
+              type: string
+              format: ipv6
+              example: "fd00:4e42:ab12::1"
+            connection_ip:
+              description: Peer's public connection IP address
+              type: string
+              example: 35.64.0.1
+            connected:
+              description: Peer to Management connection status
+              type: boolean
+              example: true
+            last_seen:
+              description: Last time peer connected to Netbird's management service
+              type: string
+              format: date-time
+              example: "2023-05-05T10:05:26.420578Z"
+            os:
+              description: Peer's operating system and version
+              type: string
+              example: Darwin 13.2.1
+            kernel_version:
+              description: Peer's operating system kernel version
+              type: string
+              example: 23.2.0
+            geoname_id:
+              description: Unique identifier from the GeoNames database for a specific geographical location.
+              type: integer
+              example: 2643743
+            version:
+              description: Peer's daemon or cli version
+              type: string
+              example: 0.14.0
+            groups:
+              description: Groups that the peer belongs to
+              type: array
+              items:
+                $ref: '../group/components.yaml#/components/schemas/GroupMinimum'
+            ssh_enabled:
+              description: Indicates whether SSH server is enabled on this peer
+              type: boolean
+              example: true
+            user_id:
+              description: User ID of the user that enrolled this peer
+              type: string
+              example: google-oauth2|277474792786460067937
+            hostname:
+              description: Hostname of the machine
+              type: string
+              example: stage-host-1
+            ui_version:
+              description: Peer's desktop UI version
+              type: string
+              example: 0.14.0
+            dns_label:
+              description: Peer's DNS label is the parsed peer name for domain resolution. It is used to form an FQDN by appending the account's domain to the peer label. e.g. peer-dns-label.netbird.cloud
+              type: string
+              example: stage-host-1.netbird.cloud
+            login_expiration_enabled:
+              description: Indicates whether peer login expiration has been enabled or not
+              type: boolean
+              example: false
+            login_expired:
+              description: Indicates whether peer's login expired or not
+              type: boolean
+              example: false
+            last_login:
+              description: Last time this peer performed log in (authentication). E.g., user authenticated.
+              type: string
+              format: date-time
+              example: "2023-05-05T09:00:35.477782Z"
+            inactivity_expiration_enabled:
+              description: Indicates whether peer inactivity expiration has been enabled or not
+              type: boolean
+              example: false
+            approval_required:
+              description: (Cloud only) Indicates whether peer needs approval
+              type: boolean
+              example: true
+            disapproval_reason:
+              description: (Cloud only) Reason why the peer requires approval
+              type: string
+            country_code:
+              $ref: '../openapi.yaml#/components/schemas/CountryCode'
+            city_name:
+              $ref: '../openapi.yaml#/components/schemas/CityName'
+            serial_number:
+              description: System serial number
+              type: string
+              example: "C02XJ0J0JGH7"
+            extra_dns_labels:
+              description: Extra DNS labels added to the peer
+              type: array
+              items:
+                type: string
+                example: "stage-host-1"
+            ephemeral:
+              description: Indicates whether the peer is ephemeral or not
+              type: boolean
+              example: false
+            local_flags:
+              $ref: '#/components/schemas/PeerLocalFlags'
+          required:
+            - city_name
+            - connected
+            - connection_ip
+            - country_code
+            - created_at
+            - dns_label
+            - geoname_id
+            - groups
+            - hostname
+            - ip
+            - kernel_version
+            - last_login
+            - last_seen
+            - login_expiration_enabled
+            - login_expired
+            - inactivity_expiration_enabled
+            - os
+            - ssh_enabled
+            - user_id
+            - version
+            - ui_version
+            - approval_required
+            - serial_number
+            - extra_dns_labels
+            - ephemeral
+    PeerLocalFlags:
+      type: object
+      properties:
+        rosenpass_enabled:
+          description: Indicates whether Rosenpass is enabled on this peer
+          type: boolean
+          example: true
+        rosenpass_permissive:
+          description: Indicates whether Rosenpass is in permissive mode or not
+          type: boolean
+          example: false
+        server_ssh_allowed:
+          description: Indicates whether SSH access this peer is allowed or not
+          type: boolean
+          example: true
+        remote_jobs_allowed:
+          description: Indicates whether the peer has opted into management-requested remote jobs (e.g. debug bundles)
+          type: boolean
+          example: true
+        disable_client_routes:
+          description: Indicates whether client routes are disabled on this peer or not
+          type: boolean
+          example: false
+        disable_server_routes:
+          description: Indicates whether server routes are disabled on this peer or not
+          type: boolean
+          example: false
+        disable_dns:
+          description: Indicates whether DNS management is disabled on this peer or not
+          type: boolean
+          example: false
+        disable_firewall:
+          description: Indicates whether firewall management is disabled on this peer or not
+          type: boolean
+          example: false
+        block_lan_access:
+          description: Indicates whether LAN access is blocked on this peer when used as a routing peer
+          type: boolean
+          example: false
+        block_inbound:
+          description: Indicates whether inbound traffic is blocked on this peer
+          type: boolean
+          example: false
+        lazy_connection_enabled:
+          description: Indicates whether lazy connection is enabled on this peer
+          type: boolean
+          example: false
+    PeerBatch:
+      type: object
+      properties:
+        peer_count:
+          description: Total number of peers
+          type: integer
+          example: 5
+        page:
+          description: Current page number
+          type: integer
+          example: 5
+        page_size:
+          description: Page size
+          type: integer
+          example: 5
+        peers:
+          description: List of peers
+          type: array
+          items:
+            $ref: '#/components/schemas/Peer'
+      required:
+        - peer_count
+        - page
+        - page_size
+        - peers
\ No newline at end of file
diff --git a/shared/management/http/apiv1alpha1/peer/peer.yaml b/shared/management/http/apiv1alpha1/peer/peer.yaml
new file mode 100644
index 000000000..7c7c1a85d
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/peer/peer.yaml
@@ -0,0 +1,93 @@
+get:
+  summary: Retrieve a Peer
+  description: Get information about a peer
+  tags: [ Peers ]
+  security:
+    - BearerAuth: [ ]
+    - TokenAuth: [ ]
+  parameters:
+    - in: path
+      name: peerId
+      required: true
+      schema:
+        type: string
+      description: The unique identifier of a peer
+  responses:
+    '200':
+      description: A Peer object
+      content:
+        application/json:
+          schema:
+            $ref: './components.yaml#/components/schemas/Peer'
+    '400':
+      "$ref": '../openapi.yaml#/components/responses/bad_request'
+    '401':
+      "$ref": '../openapi.yaml#/components/responses/requires_authentication'
+    '403':
+      "$ref": '../openapi.yaml#/components/responses/forbidden'
+    '500':
+      "$ref": '../openapi.yaml#/components/responses/internal_error'
+put:
+  summary: Update a Peer
+  description: Update information about a peer
+  tags: [ Peers ]
+  security:
+    - BearerAuth: [ ]
+    - TokenAuth: [ ]
+  parameters:
+    - in: path
+      name: peerId
+      required: true
+      schema:
+        type: string
+      description: The unique identifier of a peer
+  requestBody:
+    description: update a peer
+    required: true
+    content:
+      'application/json':
+        schema:
+          $ref: './components.yaml#/components/schemas/PeerRequest'
+  responses:
+    '200':
+      description: A Peer object
+      content:
+        application/json:
+          schema:
+            $ref: './components.yaml#/components/schemas/Peer'
+    '400':
+      "$ref": '../openapi.yaml#/components/responses/bad_request'
+    '401':
+      "$ref": '../openapi.yaml#/components/responses/requires_authentication'
+    '403':
+      "$ref": '../openapi.yaml#/components/responses/forbidden'
+    '422':
+      "$ref": "../openapi.yaml#/components/responses/unprocessable"
+    '500':
+      "$ref": '../openapi.yaml#/components/responses/internal_error'
+delete:
+  summary: Delete a Peer
+  description: Delete a peer
+  tags: [ Peers ]
+  security:
+    - BearerAuth: [ ]
+    - TokenAuth: [ ]
+  parameters:
+    - in: path
+      name: peerId
+      required: true
+      schema:
+        type: string
+      description: The unique identifier of a peer
+  responses:
+    '200':
+      description: Delete status code
+      content: { }
+    '400':
+      "$ref": '../openapi.yaml#/components/responses/bad_request'
+    '401':
+      "$ref": '../openapi.yaml#/components/responses/requires_authentication'
+    '403':
+      "$ref": '../openapi.yaml#/components/responses/forbidden'
+    '500':
+      "$ref": '../openapi.yaml#/components/responses/internal_error'
diff --git a/shared/management/http/apiv1alpha1/peer/peers.yaml b/shared/management/http/apiv1alpha1/peer/peers.yaml
new file mode 100644
index 000000000..5a32260ad
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/peer/peers.yaml
@@ -0,0 +1,141 @@
+get:
+  summary: List all Peers
+  description: Returns a list of all peers
+  tags: [ Peers ]
+  parameters:
+    - name: page
+      in: query
+      description: Page number
+      required: false
+      schema:
+        type: integer
+        minimum: 1
+        default: 1
+    - name: page_size
+      in: query
+      description: Number of peers per page
+      required: false
+      schema:
+        type: integer
+        minimum: 1
+        maximum: 250
+        default: 100
+    - name: user_id
+      in: query
+      description: filter peers by their user_id
+      required: false
+      schema:
+        type: string
+    - name: group_ids
+      in: query
+      description: filter peers by group_ids
+      required: false
+      schema:
+        type: array
+        items:
+          type: string
+    - name: peer_ids
+      in: query
+      description: filter peers by their ids
+      required: false
+      schema:
+        type: array
+        minItems: 1
+        maxItems: 50
+        items:
+          type: string
+    - name: connected
+      in: query
+      description: Filter by peer connected status
+      required: false
+      schema:
+        type: boolean
+    - name: approval_required
+      in: query
+      description: Filter by approval_required field
+      required: false
+      schema:
+        type: boolean
+    - name: os
+      in: query
+      description: Peer os
+      required: false
+      schema:
+        type: array
+        items:
+          type: string
+          enum:
+           - linux
+           - windows
+           - darwin
+           - android
+           - ios
+           - js
+    - name: ip
+      in: query
+      description: filter peers by ip
+      required: false
+      schema:
+        type: string
+    - name: mac
+      in: query
+      description: filter peers by mac address
+      required: false
+      schema:
+        type: string
+    - name: name
+      in: query
+      description: filter peers by hostname
+      required: false
+      schema:
+        type: string
+    - name: hostname
+      in: query
+      description: filter peers by hostname
+      required: false
+      schema:
+        type: string
+    - name: kind
+      in: query
+      description: filter peers by host kind
+      required: false
+      schema:
+        type: string
+        enum:
+          - server
+          - user_device
+    - name: sort_by
+      in: query
+      description: sorting of peers
+      required: false
+      example: sort_by=name,asc&sort_by=last_seen,desc&sort_by=version
+      schema:
+        type: array
+        items:
+          type: string
+          enum:
+           - name
+           - last_seen
+           - version
+           - asc
+           - desc
+  security:
+    - BearerAuth: [ ]
+    - TokenAuth: [ ]
+  responses:
+    '200':
+      description: A JSON Array of Peers
+      content:
+        application/json:
+          schema:
+            $ref: './components.yaml#/components/schemas/PeerBatch'
+    '400':
+      "$ref": "../openapi.yaml#/components/responses/bad_request"
+    '401':
+      "$ref": "../openapi.yaml#/components/responses/requires_authentication"
+    '403':
+      "$ref": "../openapi.yaml#/components/responses/forbidden"
+    '422':
+      "$ref": "../openapi.yaml#/components/responses/unprocessable"
+    '500':
+      "$ref": "../openapi.yaml#/components/responses/internal_error"
diff --git a/shared/management/http/apiv1alpha1/runtime_tooling.go b/shared/management/http/apiv1alpha1/runtime_tooling.go
new file mode 100644
index 000000000..6460e2e2f
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/runtime_tooling.go
@@ -0,0 +1,93 @@
+package apiv1alpha1
+
+import (
+	_ "embed"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"os"
+	"strings"
+
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/pb33f/libopenapi"
+	validator "github.com/pb33f/libopenapi-validator"
+	"github.com/pb33f/libopenapi-validator/config"
+	"github.com/pb33f/libopenapi-validator/errors"
+	"github.com/pb33f/libopenapi/datamodel"
+	log "github.com/sirupsen/logrus"
+)
+
+// TODO (dmitri) this needs to be extracted, as it will grow to 500Kb
+//
+//go:embed bundle.yaml
+var bundle []byte
+
+func CreateV1ApiValidatingMiddleware() (*V1ValidatorMiddleware, error) {
+	doc, err := libopenapi.NewDocumentWithConfiguration(bundle, &datamodel.DocumentConfiguration{
+		Logger: slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
+			Level: slog.LevelInfo,
+		})),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	model, err := doc.BuildV3Model()
+	if err != nil {
+		return nil, err
+	}
+
+	// TODO figure out document validation: rn it's possible to have a spec
+	// that's not entirely correct -- parts of it fail to parse, but silently
+	v := validator.NewValidatorFromV3Model(&model.Model,
+		config.WithoutSecurityValidation(),
+		config.WithStandardBodyDecoders(),
+		config.WithRejectUnsupportedBodyContent(),
+		config.WithRequestDefaults())
+	// v.SetDocument(doc)
+	// v.ValidatePathParams()
+	// if valid, errs := v.ValidateDocument(); !valid {
+	// 	return nil, fmt.Errorf("error validating OpenAPI doc, %s", errs)
+	// }
+
+	return &V1ValidatorMiddleware{Validator: v}, nil
+}
+
+type V1ValidatorMiddleware struct {
+	Validator validator.Validator
+}
+
+func (v *V1ValidatorMiddleware) Handler(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		valid, errs := v.Validator.ValidateHttpRequestSync(r)
+		if !valid {
+			validationErrs := make([]string, 0, len(errs))
+			for _, err := range errs {
+				validationErrs = append(validationErrs, validationError(err))
+			}
+
+			log.WithContext(r.Context()).Debugf("error validating request: %s", strings.Join(validationErrs, ", "))
+			util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid request: %s", strings.Join(validationErrs, ", ")), w)
+
+			return
+		}
+		h.ServeHTTP(w, r)
+	})
+}
+
+func validationError(err *errors.ValidationError) string {
+	if err.SchemaValidationErrors != nil {
+		errs := make([]string, 0, len(err.SchemaValidationErrors))
+		for _, e := range err.SchemaValidationErrors {
+			errs = append(errs, fmt.Sprintf("field %s: %s", e.FieldPath, e.Reason))
+		}
+		return fmt.Sprintf("%s: %s", err.Message, strings.Join(errs, ", "))
+	} else {
+		if err.SpecLine > 0 && err.SpecCol > 0 {
+			return fmt.Sprintf("%s, Line: %d, Column: %d", err.Message, err.SpecLine, err.SpecCol)
+		} else {
+			return fmt.Sprint(err.Message)
+		}
+	}
+}
diff --git a/shared/management/http/apiv1alpha1/tooling.go b/shared/management/http/apiv1alpha1/tooling.go
new file mode 100644
index 000000000..8594348fc
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/tooling.go
@@ -0,0 +1,152 @@
+package apiv1alpha1
+
+import (
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+	"unicode"
+
+	"github.com/pb33f/libopenapi"
+	"github.com/pb33f/libopenapi/bundler"
+	"github.com/pb33f/libopenapi/datamodel"
+	v3 "github.com/pb33f/libopenapi/datamodel/high/v3"
+	"github.com/pb33f/libopenapi/generator/golang"
+)
+
+var ApiPath = filepath.Join("shared", "management", "http", "apiv1alpha1", "openapi.yaml")
+
+func GenerateV1ApiBindings(openapipath string) ([]byte, *v3.Document, error) {
+	specFile, err := os.ReadFile(openapipath)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	multiFileDoc, err := libopenapi.NewDocumentWithConfiguration(specFile, &datamodel.DocumentConfiguration{
+		AllowFileReferences:     true,
+		BasePath:                filepath.Dir(openapipath),
+		SpecFilePath:            openapipath,
+		ExtractRefsSequentially: true,
+		Logger: slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
+			Level: slog.LevelError,
+		})),
+		TransformSiblingRefs:      true,                    // enable openapi 3.1 compliance by default
+		MergeReferencedProperties: true,                    // enable enhanced resolution by default
+		PropertyMergeStrategy:     datamodel.PreserveLocal, // local properties take precedence
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+	multiFileModel, err := multiFileDoc.BuildV3Model()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	bundle, err := bundler.BundleDocumentComposed(&multiFileModel.Model, &bundler.BundleCompositionConfig{
+		StrictValidation: true,
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	doc, err := libopenapi.NewDocumentWithConfiguration(bundle, &datamodel.DocumentConfiguration{
+		Logger: slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
+			Level: slog.LevelInfo,
+		})),
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	model, err := doc.BuildV3Model()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return bundle, &model.Model, nil
+}
+
+func GenerateV1Schema(model *v3.Document) (*golang.GeneratedFile, error) {
+	// render every schema in components.schemas into one file
+	gen := golang.NewGenerator(
+		golang.WithGeneratedComment(true),
+		golang.WithFormatMapping("date-time", "time.Time", "time"),
+		golang.WithOptionalFieldsAsPointers(true),
+		golang.WithEnumConstants(true),
+		golang.WithNestedTypeNameDelimiter(""),
+		golang.WithPackageName("apiv1alpha1"),
+		golang.WithFieldNameResolver(toPublicName))
+
+	return gen.RenderSchemas(model.Components.Schemas)
+}
+
+// this is to keep existing naming of fields like "id", "url", etc
+// libopenapi by default converts them to all-uppercase, like "ID", "URL", etc
+func toPublicName(name string) string {
+	parts := splitIdentifier(name)
+	if len(parts) == 0 {
+		return "Value"
+	}
+	var b strings.Builder
+	for _, p := range parts {
+		rs := []rune(strings.ToLower(p))
+		rs[0] = unicode.ToUpper(rs[0])
+		b.WriteString(string(rs))
+	}
+	out := b.String()
+	first := []rune(out)[0]
+	if unicode.IsDigit(first) {
+		return "Value" + out
+	}
+	return out
+}
+
+func splitIdentifier(name string) []string {
+	var raw []string
+	var b strings.Builder
+	flush := func() {
+		if b.Len() > 0 {
+			raw = append(raw, b.String())
+			b.Reset()
+		}
+	}
+	for _, r := range name {
+		switch {
+		case unicode.IsLetter(r) || unicode.IsDigit(r):
+			b.WriteRune(r)
+		default:
+			flush()
+		}
+	}
+	flush()
+	var parts []string
+	for _, part := range raw {
+		parts = append(parts, splitCamel(part)...)
+	}
+	return parts
+}
+
+func splitCamel(value string) []string {
+	rs := []rune(value)
+	if len(rs) == 0 {
+		return nil
+	}
+	var parts []string
+	start := 0
+	for i := 1; i < len(rs); i++ {
+		prev := rs[i-1]
+		cur := rs[i]
+		var next rune
+		if i+1 < len(rs) {
+			next = rs[i+1]
+		}
+		lowerToUpper := unicode.IsLower(prev) && unicode.IsUpper(cur)
+		acronymToWord := unicode.IsUpper(prev) && unicode.IsUpper(cur) && next != 0 && unicode.IsLower(next)
+		if lowerToUpper || acronymToWord {
+			parts = append(parts, string(rs[start:i]))
+			start = i
+		}
+	}
+	parts = append(parts, string(rs[start:]))
+	return parts
+}
diff --git a/shared/management/http/apiv1alpha1/types.gen.go b/shared/management/http/apiv1alpha1/types.gen.go
new file mode 100644
index 000000000..14ac4e7f4
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/types.gen.go
@@ -0,0 +1,418 @@
+// Code generated by libopenapi generator/golang. DO NOT EDIT.
+
+package apiv1alpha1
+
+import (
+	"encoding/json"
+	"time"
+)
+
+// CountryCode 2-letter ISO 3166-1 alpha-2 code that represents the country.
+// CountryCode example value is defined in the OpenAPI schema.
+type CountryCode string
+
+// CityName Commonly used English name of the city.
+// CityName example value is defined in the OpenAPI schema.
+type CityName string
+
+// Country Describe country geographical location information.
+type Country struct {
+	// CountryName Commonly used English name of the country.
+	// CountryName example value is defined in the OpenAPI schema.
+	CountryName string      `json:"country_name"`
+	CountryCode CountryCode `json:"country_code"`
+}
+
+// City Describe city geographical location information.
+type City struct {
+	// GeonameId Integer ID of the record in GeoNames database.
+	// GeonameId example value is defined in the OpenAPI schema.
+	GeonameId int `json:"geoname_id"`
+	// CityName Commonly used English name of the city.
+	// CityName example value is defined in the OpenAPI schema.
+	CityName string `json:"city_name"`
+}
+
+// ErrorResponse Standard error response.
+type ErrorResponse struct {
+	// Message A human-readable error message.
+	// Message example value is defined in the OpenAPI schema.
+	Message *string `json:"message,omitempty"`
+}
+
+type PeerBatch struct {
+	// PeerCount Total number of peers.
+	// PeerCount example value is defined in the OpenAPI schema.
+	PeerCount int `json:"peer_count"`
+	// Page Current page number.
+	// Page example value is defined in the OpenAPI schema.
+	Page int `json:"page"`
+	// PageSize Page size.
+	// PageSize example value is defined in the OpenAPI schema.
+	PageSize int `json:"page_size"`
+	// Peers List of peers.
+	Peers []Peer `json:"peers"`
+}
+
+type PeerMinimum struct {
+	// Id Peer ID.
+	// Id example value is defined in the OpenAPI schema.
+	Id string `json:"id"`
+	// Name Peer's hostname.
+	// Name example value is defined in the OpenAPI schema.
+	Name string `json:"name"`
+}
+
+// GroupMinimumIssued How the group was issued (api, integration, jwt).
+// GroupMinimumIssued example value is defined in the OpenAPI schema.
+type GroupMinimumIssued string
+
+const (
+	GroupMinimumIssuedAPI         GroupMinimumIssued = "api"
+	GroupMinimumIssuedIntegration GroupMinimumIssued = "integration"
+	GroupMinimumIssuedJWT         GroupMinimumIssued = "jwt"
+)
+
+type GroupMinimum struct {
+	// Id Group ID.
+	// Id example value is defined in the OpenAPI schema.
+	Id string `json:"id"`
+	// Name Group Name identifier.
+	// Name example value is defined in the OpenAPI schema.
+	Name string `json:"name"`
+	// PeersCount Count of peers associated to the group.
+	// PeersCount example value is defined in the OpenAPI schema.
+	PeersCount int `json:"peers_count"`
+	// ResourcesCount Count of resources associated to the group.
+	// ResourcesCount example value is defined in the OpenAPI schema.
+	ResourcesCount int `json:"resources_count"`
+	// Issued How the group was issued (api, integration, jwt).
+	// Issued example value is defined in the OpenAPI schema.
+	Issued *GroupMinimumIssued `json:"issued,omitempty"`
+}
+
+type PeerLocalFlags struct {
+	// RosenpassEnabled Indicates whether Rosenpass is enabled on this peer.
+	// RosenpassEnabled example value is defined in the OpenAPI schema.
+	RosenpassEnabled *bool `json:"rosenpass_enabled,omitempty"`
+	// RosenpassPermissive Indicates whether Rosenpass is in permissive mode or not.
+	// RosenpassPermissive example value is defined in the OpenAPI schema.
+	RosenpassPermissive *bool `json:"rosenpass_permissive,omitempty"`
+	// ServerSshAllowed Indicates whether SSH access this peer is allowed or not.
+	// ServerSshAllowed example value is defined in the OpenAPI schema.
+	ServerSshAllowed *bool `json:"server_ssh_allowed,omitempty"`
+	// RemoteJobsAllowed Indicates whether the peer has opted into management-requested remote jobs (e.g. debug bundles).
+	// RemoteJobsAllowed example value is defined in the OpenAPI schema.
+	RemoteJobsAllowed *bool `json:"remote_jobs_allowed,omitempty"`
+	// DisableClientRoutes Indicates whether client routes are disabled on this peer or not.
+	// DisableClientRoutes example value is defined in the OpenAPI schema.
+	DisableClientRoutes *bool `json:"disable_client_routes,omitempty"`
+	// DisableServerRoutes Indicates whether server routes are disabled on this peer or not.
+	// DisableServerRoutes example value is defined in the OpenAPI schema.
+	DisableServerRoutes *bool `json:"disable_server_routes,omitempty"`
+	// DisableDns Indicates whether DNS management is disabled on this peer or not.
+	// DisableDns example value is defined in the OpenAPI schema.
+	DisableDns *bool `json:"disable_dns,omitempty"`
+	// DisableFirewall Indicates whether firewall management is disabled on this peer or not.
+	// DisableFirewall example value is defined in the OpenAPI schema.
+	DisableFirewall *bool `json:"disable_firewall,omitempty"`
+	// BlockLanAccess Indicates whether LAN access is blocked on this peer when used as a routing peer.
+	// BlockLanAccess example value is defined in the OpenAPI schema.
+	BlockLanAccess *bool `json:"block_lan_access,omitempty"`
+	// BlockInbound Indicates whether inbound traffic is blocked on this peer.
+	// BlockInbound example value is defined in the OpenAPI schema.
+	BlockInbound *bool `json:"block_inbound,omitempty"`
+	// LazyConnectionEnabled Indicates whether lazy connection is enabled on this peer.
+	// LazyConnectionEnabled example value is defined in the OpenAPI schema.
+	LazyConnectionEnabled *bool `json:"lazy_connection_enabled,omitempty"`
+}
+
+type Peer struct {
+	PeerMinimum
+	// CreatedAt Peer creation date (UTC).
+	// CreatedAt example value is defined in the OpenAPI schema.
+	CreatedAt time.Time `json:"created_at"`
+	// Ip Peer's IP address.
+	// Ip example value is defined in the OpenAPI schema.
+	Ip string `json:"ip"`
+	// Ipv6 Peer's IPv6 overlay address.
+	// Ipv6 example value is defined in the OpenAPI schema.
+	Ipv6 *string `json:"ipv6,omitempty"`
+	// ConnectionIp Peer's public connection IP address.
+	// ConnectionIp example value is defined in the OpenAPI schema.
+	ConnectionIp string `json:"connection_ip"`
+	// Connected Peer to Management connection status.
+	// Connected example value is defined in the OpenAPI schema.
+	Connected bool `json:"connected"`
+	// LastSeen Last time peer connected to Netbird's management service.
+	// LastSeen example value is defined in the OpenAPI schema.
+	LastSeen time.Time `json:"last_seen"`
+	// Os Peer's operating system and version.
+	// Os example value is defined in the OpenAPI schema.
+	Os string `json:"os"`
+	// KernelVersion Peer's operating system kernel version.
+	// KernelVersion example value is defined in the OpenAPI schema.
+	KernelVersion string `json:"kernel_version"`
+	// GeonameId Unique identifier from the GeoNames database for a specific geographical location.
+	// GeonameId example value is defined in the OpenAPI schema.
+	GeonameId int `json:"geoname_id"`
+	// Version Peer's daemon or cli version.
+	// Version example value is defined in the OpenAPI schema.
+	Version string `json:"version"`
+	// Groups Groups that the peer belongs to.
+	Groups []GroupMinimum `json:"groups"`
+	// SshEnabled Indicates whether SSH server is enabled on this peer.
+	// SshEnabled example value is defined in the OpenAPI schema.
+	SshEnabled bool `json:"ssh_enabled"`
+	// UserId User ID of the user that enrolled this peer.
+	// UserId example value is defined in the OpenAPI schema.
+	UserId string `json:"user_id"`
+	// Hostname Hostname of the machine.
+	// Hostname example value is defined in the OpenAPI schema.
+	Hostname string `json:"hostname"`
+	// UiVersion Peer's desktop UI version.
+	// UiVersion example value is defined in the OpenAPI schema.
+	UiVersion string `json:"ui_version"`
+	// DnsLabel Peer's DNS label is the parsed peer name for domain resolution. It is used to form an FQDN by appending the account's domain to the peer label. e.g. peer-dns-label.netbird.cloud.
+	// DnsLabel example value is defined in the OpenAPI schema.
+	DnsLabel string `json:"dns_label"`
+	// LoginExpirationEnabled Indicates whether peer login expiration has been enabled or not.
+	// LoginExpirationEnabled example value is defined in the OpenAPI schema.
+	LoginExpirationEnabled bool `json:"login_expiration_enabled"`
+	// LoginExpired Indicates whether peer's login expired or not.
+	// LoginExpired example value is defined in the OpenAPI schema.
+	LoginExpired bool `json:"login_expired"`
+	// LastLogin Last time this peer performed log in (authentication). E.g., user authenticated.
+	// LastLogin example value is defined in the OpenAPI schema.
+	LastLogin time.Time `json:"last_login"`
+	// InactivityExpirationEnabled Indicates whether peer inactivity expiration has been enabled or not.
+	// InactivityExpirationEnabled example value is defined in the OpenAPI schema.
+	InactivityExpirationEnabled bool `json:"inactivity_expiration_enabled"`
+	// ApprovalRequired (Cloud only) Indicates whether peer needs approval.
+	// ApprovalRequired example value is defined in the OpenAPI schema.
+	ApprovalRequired bool `json:"approval_required"`
+	// DisapprovalReason (Cloud only) Reason why the peer requires approval.
+	DisapprovalReason *string     `json:"disapproval_reason,omitempty"`
+	CountryCode       CountryCode `json:"country_code"`
+	CityName          CityName    `json:"city_name"`
+	// SerialNumber System serial number.
+	// SerialNumber example value is defined in the OpenAPI schema.
+	SerialNumber string `json:"serial_number"`
+	// ExtraDnsLabels Extra DNS labels added to the peer.
+	ExtraDnsLabels []string `json:"extra_dns_labels"`
+	// Ephemeral Indicates whether the peer is ephemeral or not.
+	// Ephemeral example value is defined in the OpenAPI schema.
+	Ephemeral  bool            `json:"ephemeral"`
+	LocalFlags *PeerLocalFlags `json:"local_flags,omitempty"`
+}
+
+type PeerRequest struct {
+	// Name example value is defined in the OpenAPI schema.
+	Name string `json:"name"`
+	// SshEnabled example value is defined in the OpenAPI schema.
+	SshEnabled bool `json:"ssh_enabled"`
+	// LoginExpirationEnabled example value is defined in the OpenAPI schema.
+	LoginExpirationEnabled bool `json:"login_expiration_enabled"`
+	// InactivityExpirationEnabled example value is defined in the OpenAPI schema.
+	InactivityExpirationEnabled bool `json:"inactivity_expiration_enabled"`
+	// ApprovalRequired (Cloud only) Indicates whether peer needs approval.
+	// ApprovalRequired example value is defined in the OpenAPI schema.
+	ApprovalRequired *bool `json:"approval_required,omitempty"`
+	// Ip Peer's IP address.
+	// Ip example value is defined in the OpenAPI schema.
+	Ip *string `json:"ip,omitempty"`
+	// Ipv6 Peer's IPv6 overlay address. Omitted if IPv6 is not enabled for the account.
+	// Ipv6 example value is defined in the OpenAPI schema.
+	Ipv6 *string `json:"ipv6,omitempty"`
+}
+
+// UserStatus User's status.
+// UserStatus example value is defined in the OpenAPI schema.
+type UserStatus string
+
+const (
+	UserStatusActive  UserStatus = "active"
+	UserStatusInvited UserStatus = "invited"
+	UserStatusBlocked UserStatus = "blocked"
+)
+
+type User struct {
+	// Id User ID.
+	// Id example value is defined in the OpenAPI schema.
+	Id string `json:"id"`
+	// Email User's email address.
+	// Email example value is defined in the OpenAPI schema.
+	Email string `json:"email"`
+	// Password User's password. Only present when user is created (create user endpoint is called) and only when IdP supports user creation with password.
+	// Password example value is defined in the OpenAPI schema.
+	Password *string `json:"password,omitempty"`
+	// Name User's name from idp provider.
+	// Name example value is defined in the OpenAPI schema.
+	Name string `json:"name"`
+	// Role User's NetBird account role.
+	// Role example value is defined in the OpenAPI schema.
+	Role string `json:"role"`
+	// Status User's status.
+	// Status example value is defined in the OpenAPI schema.
+	Status UserStatus `json:"status"`
+	// LastLogin Last time this user performed a login to the dashboard.
+	// LastLogin example value is defined in the OpenAPI schema.
+	LastLogin *time.Time `json:"last_login,omitempty"`
+	// AutoGroups Group IDs to auto-assign to peers registered by this user.
+	AutoGroups []string `json:"auto_groups"`
+	// IsCurrent Is true if authenticated user is the same as this user.
+	// IsCurrent readOnly.
+	// IsCurrent example value is defined in the OpenAPI schema.
+	IsCurrent *bool `json:"is_current,omitempty"`
+	// IsServiceUser Is true if this user is a service user.
+	// IsServiceUser readOnly.
+	// IsServiceUser example value is defined in the OpenAPI schema.
+	IsServiceUser *bool `json:"is_service_user,omitempty"`
+	// IsBlocked Is true if this user is blocked. Blocked users can't use the system.
+	// IsBlocked example value is defined in the OpenAPI schema.
+	IsBlocked bool `json:"is_blocked"`
+	// PendingApproval Is true if this user requires approval before being activated. Only applicable for users joining via domain matching when user_approval_required is enabled.
+	// PendingApproval example value is defined in the OpenAPI schema.
+	PendingApproval bool `json:"pending_approval"`
+	// Issued How user was issued by API or Integration.
+	// Issued example value is defined in the OpenAPI schema.
+	Issued *string `json:"issued,omitempty"`
+	// IdpId Identity provider ID (connector ID) that the user authenticated with. Only populated for users with Dex-encoded user IDs.
+	// IdpId example value is defined in the OpenAPI schema.
+	IdpId       *string          `json:"idp_id,omitempty"`
+	Permissions *UserPermissions `json:"permissions,omitempty"`
+}
+
+type UserCreateRequest struct {
+	// Email User's Email to send invite to.
+	// Email example value is defined in the OpenAPI schema.
+	Email *string `json:"email,omitempty"`
+	// Name User's full name.
+	// Name example value is defined in the OpenAPI schema.
+	Name *string `json:"name,omitempty"`
+	// Role User's NetBird account role.
+	// Role example value is defined in the OpenAPI schema.
+	Role string `json:"role"`
+	// AutoGroups Group IDs to auto-assign to peers registered by this user.
+	AutoGroups []string `json:"auto_groups"`
+	// IsServiceUser Is true if this user is a service user.
+	// IsServiceUser example value is defined in the OpenAPI schema.
+	IsServiceUser bool `json:"is_service_user"`
+}
+
+type UserRequest struct {
+	// Role User's NetBird account role.
+	// Role example value is defined in the OpenAPI schema.
+	Role string `json:"role"`
+	// AutoGroups Group IDs to auto-assign to peers registered by this user.
+	AutoGroups []string `json:"auto_groups"`
+	// IsBlocked If set to true then user is blocked and can't use the system.
+	// IsBlocked example value is defined in the OpenAPI schema.
+	IsBlocked bool `json:"is_blocked"`
+}
+
+type UserPermissionsModulesAdditionalProperty struct {
+	AdditionalProperties map[string]bool `json:"-"`
+}
+
+func (m *UserPermissionsModulesAdditionalProperty) UnmarshalJSON(data []byte) error {
+	type Alias UserPermissionsModulesAdditionalProperty
+	var known Alias
+	if err := json.Unmarshal(data, &known); err != nil {
+		return err
+	}
+	*m = UserPermissionsModulesAdditionalProperty(known)
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	if len(raw) == 0 {
+		return nil
+	}
+	m.AdditionalProperties = make(map[string]bool, len(raw))
+	for key, value := range raw {
+		var decoded bool
+		if err := json.Unmarshal(value, &decoded); err != nil {
+			return err
+		}
+		m.AdditionalProperties[key] = decoded
+	}
+	return nil
+}
+
+func (m UserPermissionsModulesAdditionalProperty) MarshalJSON() ([]byte, error) {
+	type Alias UserPermissionsModulesAdditionalProperty
+	encoded, err := json.Marshal(Alias(m))
+	if err != nil {
+		return nil, err
+	}
+	var object map[string]json.RawMessage
+	if err := json.Unmarshal(encoded, &object); err != nil {
+		return nil, err
+	}
+	for key, value := range m.AdditionalProperties {
+		encodedValue, err := json.Marshal(value)
+		if err != nil {
+			return nil, err
+		}
+		object[key] = encodedValue
+	}
+	return json.Marshal(object)
+}
+
+// UserPermissionsModules example value is defined in the OpenAPI schema.
+type UserPermissionsModules struct {
+	AdditionalProperties map[string]map[string]bool `json:"-"`
+}
+
+func (m *UserPermissionsModules) UnmarshalJSON(data []byte) error {
+	type Alias UserPermissionsModules
+	var known Alias
+	if err := json.Unmarshal(data, &known); err != nil {
+		return err
+	}
+	*m = UserPermissionsModules(known)
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	if len(raw) == 0 {
+		return nil
+	}
+	m.AdditionalProperties = make(map[string]map[string]bool, len(raw))
+	for key, value := range raw {
+		var decoded map[string]bool
+		if err := json.Unmarshal(value, &decoded); err != nil {
+			return err
+		}
+		m.AdditionalProperties[key] = decoded
+	}
+	return nil
+}
+
+func (m UserPermissionsModules) MarshalJSON() ([]byte, error) {
+	type Alias UserPermissionsModules
+	encoded, err := json.Marshal(Alias(m))
+	if err != nil {
+		return nil, err
+	}
+	var object map[string]json.RawMessage
+	if err := json.Unmarshal(encoded, &object); err != nil {
+		return nil, err
+	}
+	for key, value := range m.AdditionalProperties {
+		encodedValue, err := json.Marshal(value)
+		if err != nil {
+			return nil, err
+		}
+		object[key] = encodedValue
+	}
+	return json.Marshal(object)
+}
+
+type UserPermissions struct {
+	// IsRestricted Indicates whether this User's Peers view is restricted.
+	IsRestricted bool `json:"is_restricted"`
+	// Modules example value is defined in the OpenAPI schema.
+	Modules map[string]map[string]bool `json:"modules"`
+}
diff --git a/shared/management/http/apiv1alpha1/user/user_components.yaml b/shared/management/http/apiv1alpha1/user/user_components.yaml
new file mode 100644
index 000000000..d3cac52e8
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/user/user_components.yaml
@@ -0,0 +1,150 @@
+components:
+  schemas:
+    User:
+      type: object
+      properties:
+        id:
+          description: User ID
+          type: string
+          example: google-oauth2|277474792786460067937
+        email:
+          description: User's email address
+          type: string
+          example: demo@netbird.io
+        password:
+          description: User's password. Only present when user is created (create user endpoint is called) and only when IdP supports user creation with password.
+          type: string
+          example: super_secure_password
+        name:
+          description: User's name from idp provider
+          type: string
+          example: Tom Schulz
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        status:
+          description: User's status
+          type: string
+          enum: [ "active", "invited", "blocked" ]
+          example: active
+        last_login:
+          description: Last time this user performed a login to the dashboard
+          type: string
+          format: date-time
+          example: "2023-05-05T09:00:35.477782Z"
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_current:
+          description: Is true if authenticated user is the same as this user
+          type: boolean
+          readOnly: true
+          example: true
+        is_service_user:
+          description: Is true if this user is a service user
+          type: boolean
+          readOnly: true
+          example: false
+        is_blocked:
+          description: Is true if this user is blocked. Blocked users can't use the system
+          type: boolean
+          example: false
+        pending_approval:
+          description: Is true if this user requires approval before being activated. Only applicable for users joining via domain matching when user_approval_required is enabled.
+          type: boolean
+          example: false
+        issued:
+          description: How user was issued by API or Integration
+          type: string
+          example: api
+        idp_id:
+          description: Identity provider ID (connector ID) that the user authenticated with. Only populated for users with Dex-encoded user IDs.
+          type: string
+          example: okta-abc123
+        permissions:
+          $ref: '#/components/schemas/UserPermissions'
+      required:
+        - id
+        - email
+        - name
+        - role
+        - auto_groups
+        - status
+        - is_blocked
+        - pending_approval
+    UserPermissions:
+      type: object
+      properties:
+        is_restricted:
+          type: boolean
+          description: Indicates whether this User's Peers view is restricted
+        modules:
+          type: object
+          additionalProperties:
+            type: object
+            additionalProperties:
+              type: boolean
+            propertyNames:
+              type: string
+              description: The operation type
+          propertyNames:
+            type: string
+            description: The module name
+          example: { "networks": { "read": true, "create": false, "update": false, "delete": false }, "peers": { "read": false, "create": false, "update": false, "delete": false } }
+      required:
+        - modules
+        - is_restricted
+    UserRequest:
+      type: object
+      properties:
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_blocked:
+          description: If set to true then user is blocked and can't use the system
+          type: boolean
+          example: false
+      required:
+        - role
+        - auto_groups
+        - is_blocked
+    UserCreateRequest:
+      type: object
+      properties:
+        email:
+          description: User's Email to send invite to
+          type: string
+          example: demo@netbird.io
+        name:
+          description: User's full name
+          type: string
+          example: Tom Schulz
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_service_user:
+          description: Is true if this user is a service user
+          type: boolean
+          example: false
+      required:
+        - role
+        - auto_groups
+        - is_service_user
\ No newline at end of file
diff --git a/shared/management/http/apiv1alpha1/user/user_paths.yaml b/shared/management/http/apiv1alpha1/user/user_paths.yaml
new file mode 100644
index 000000000..be5b836c4
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/user/user_paths.yaml
@@ -0,0 +1,129 @@
+UsersPath:
+  get:
+    summary: List all Users
+    description: Returns a list of all users
+    tags: [ Users ]
+    security:
+      - BearerAuth: [ ]
+      - TokenAuth: [ ]
+    parameters:
+      - in: query
+        name: service_user
+        schema:
+          type: boolean
+        description: Filters users and returns either regular users or service users
+    responses:
+      '200':
+        description: A JSON array of Users
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                $ref: './user_components.yaml#/components/schemas/User'
+      '400':
+        "$ref": "../openapi.yaml#/components/responses/bad_request"
+      '401':
+        "$ref": "../openapi.yaml#/components/responses/requires_authentication"
+      '403':
+        "$ref": "../openapi.yaml#/components/responses/forbidden"
+      '422':
+        "$ref": "../openapi.yaml#/components/responses/unprocessable"
+      '500':
+        "$ref": "../openapi.yaml#/components/responses/internal_error"
+  post:
+    summary: Create a User
+    description: Creates a new service user or sends an invite to a regular user
+    tags: [ Users ]
+    security:
+      - BearerAuth: [ ]
+      - TokenAuth: [ ]
+    requestBody:
+      description: User invite information
+      required: true
+      content:
+        'application/json':
+          schema:
+            $ref: './user_components.yaml#/components/schemas/UserCreateRequest'
+    responses:
+      '200':
+        description: A User object
+        content:
+          application/json:
+            schema:
+              $ref: './user_components.yaml#/components/schemas/User'
+      '400':
+        "$ref": "../openapi.yaml#/components/responses/bad_request"
+      '401':
+        "$ref": "../openapi.yaml#/components/responses/requires_authentication"
+      '403':
+        "$ref": "../openapi.yaml#/components/responses/forbidden"
+      '422':
+        "$ref": "../openapi.yaml#/components/responses/unprocessable"
+      '500':
+        "$ref": "../openapi.yaml#/components/responses/internal_error"
+UserPath:
+  put:
+    summary: Update a User
+    description: Update information about a User
+    tags: [ Users ]
+    security:
+      - BearerAuth: [ ]
+      - TokenAuth: [ ]
+    parameters:
+      - in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+        description: The unique identifier of a user
+    requestBody:
+      description: User update
+      required: true
+      content:
+        'application/json':
+          schema:
+            $ref: './user_components.yaml#/components/schemas/UserRequest'
+    responses:
+      '200':
+        description: A User object
+        content:
+          application/json:
+            schema:
+              $ref: './user_components.yaml#/components/schemas/User'
+      '400':
+        "$ref": "../openapi.yaml#/components/responses/bad_request"
+      '401':
+        "$ref": "../openapi.yaml#/components/responses/requires_authentication"
+      '403':
+        "$ref": "../openapi.yaml#/components/responses/forbidden"
+      '422':
+        "$ref": "../openapi.yaml#/components/responses/unprocessable"
+      '500':
+        "$ref": "../openapi.yaml#/components/responses/internal_error"
+  delete:
+    summary: Delete a User
+    description: This method removes a user from accessing the system. For this leaves the IDP user intact unless the `--user-delete-from-idp` is passed to management startup.
+    tags: [ Users ]
+    security:
+      - BearerAuth: [ ]
+      - TokenAuth: [ ]
+    parameters:
+      - in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+        description: The unique identifier of a user
+    responses:
+      '200':
+        description: Delete status code
+        content: { }
+      '400':
+        "$ref": "../openapi.yaml#/components/responses/bad_request"
+      '401':
+        "$ref": "../openapi.yaml#/components/responses/requires_authentication"
+      '403':
+        "$ref": "../openapi.yaml#/components/responses/forbidden"
+      '500':
+        "$ref": "../openapi.yaml#/components/responses/internal_error"
diff --git a/management/server/integration_reference/integration_reference.go b/shared/management/integration_reference/integration_reference.go
similarity index 100%
rename from management/server/integration_reference/integration_reference.go
rename to shared/management/integration_reference/integration_reference.go
diff --git a/shared/management/networkmap/decode.go b/shared/management/networkmap/decode.go
new file mode 100644
index 000000000..0cd45e417
--- /dev/null
+++ b/shared/management/networkmap/decode.go
@@ -0,0 +1,614 @@
+package networkmap
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"net"
+	"net/netip"
+	"slices"
+	"strconv"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/management/types"
+)
+
+// DecodeEnvelope converts a NetworkMapEnvelope into a NetworkMapComponents
+// the client can run Calculate() over. Every ID-reference on the wire is a
+// xid from corresponding public_id field.
+//
+// ID scheme on the client side:
+//
+//	Peers              base64(wg_pub_key)          // stable across snapshots
+func DecodeEnvelope(ctx context.Context, env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents, error) {
+	full := env.GetFull()
+	if full == nil {
+		return nil, fmt.Errorf("envelope has no Full payload")
+	}
+
+	c := &types.NetworkMapComponents{
+		PeerID:              "", // engine fills its own peer id from PeerConfig
+		Network:             decodeAccountNetwork(full.Network),
+		AccountSettings:     decodeAccountSettings(full.AccountSettings),
+		CustomZoneDomain:    full.CustomZoneDomain,
+		Peers:               make(map[string]*nmdata.Peer, len(full.Peers)),
+		Groups:              make(map[string]*nmdata.Group, len(full.Groups)),
+		Policies:            make([]*nmdata.Policy, 0, len(full.Policies)),
+		Routes:              make([]*nmdata.Route, 0, len(full.Routes)),
+		NameServerGroups:    make([]*nmdata.NameServerGroup, 0, len(full.NameserverGroups)),
+		AllDNSRecords:       decodeSimpleRecords(full.AllDnsRecords),
+		AccountZones:        decodeCustomZones(full.AccountZones),
+		ResourcePoliciesMap: make(map[string][]*nmdata.Policy),
+		RoutersMap:          make(map[string]map[string]*nmdata.NetworkRouter),
+		NetworkResources:    make([]*nmdata.NetworkResource, 0, len(full.NetworkResources)),
+		RouterPeers:         make(map[string]*nmdata.Peer),
+		AllowedUserIDs:      stringSliceToSet(full.AllowedUserIds),
+		PostureFailedPeers:  make(map[string]map[string]struct{}, len(full.PostureFailedPeers)),
+		GroupIDToUserIDs:    make(map[string][]string, len(full.GroupIdToUserIds)),
+	}
+
+	if full.DnsSettings != nil {
+		c.DNSSettings = &nmdata.DNSSettings{
+			DisabledManagementGroups: full.DnsSettings.DisabledManagementGroupIds,
+		}
+	} else {
+		c.DNSSettings = &nmdata.DNSSettings{}
+	}
+
+	// Phase 1: peers. The envelope's peers slice is index-addressed on the
+	// wire; we re-key by the peer's WireGuard public key (base64) so the
+	// in-memory components struct uses a stable identifier across
+	// snapshots. peerIDByIndex lets downstream phases resolve wire indexes
+	// back to that key. A peer with a missing or malformed wg_pub_key is
+	// skipped (and its index keeps "" so any cross-reference falls into the
+	// same missing-peer branch downstream) — matches legacy behaviour, which
+	// degrades gracefully rather than aborting the whole sync on a single
+	// bad row.
+	peerIDByIndex := make([]string, len(full.Peers))
+	for idx, pc := range full.Peers {
+		if pc == nil {
+			log.Warnf("envelope: peers[%d] is nil, skipping", idx)
+			continue
+		}
+		if len(pc.WgPubKey) != 32 {
+			log.Warnf("envelope: peers[%d] wg_pub_key length %d (want 32), skipping", idx, len(pc.WgPubKey))
+			continue
+		}
+		peerID := base64.StdEncoding.EncodeToString(pc.WgPubKey)
+		peer := decodePeerCompact(pc, peerID)
+		c.Peers[peerID] = peer
+		peerIDByIndex[idx] = peerID
+	}
+
+	// Phase 2: groups.
+	for i, gc := range full.Groups {
+		if gc == nil {
+			return nil, fmt.Errorf("invalid envelope: groups[%d] is nil", i)
+		}
+		groupID := gc.Id
+		peerIDs := make([]string, 0, len(gc.PeerIndexes))
+		for _, idx := range gc.PeerIndexes {
+			if int(idx) < len(peerIDByIndex) {
+				peerIDs = append(peerIDs, peerIDByIndex[idx])
+			} else {
+				log.WithField("peer idx", idx).Error("unrecognized peer idx during decoding")
+			}
+		}
+
+		fromCompactResources := func() []nmdata.Resource {
+			var toret []nmdata.Resource
+
+			for _, r := range gc.Resources {
+				res := resourceFromProto(r, peerIDByIndex)
+				if res == (nmdata.Resource{}) {
+					log.WithContext(ctx).Warnf("skipping invalid resource in group compact: %s", r.String())
+					continue
+				}
+				toret = append(toret, res)
+			}
+
+			return toret
+		}
+
+		group := &nmdata.Group{
+			PublicID:  gc.Id,
+			Peers:     peerIDs,
+			Resources: fromCompactResources(),
+		}
+		if gc.IsAll {
+			group.Name = nmdata.GroupAllName
+		}
+		c.Groups[groupID] = group
+	}
+
+	// Phase 3: policies (PolicyCompact = one rule per entry; current data
+	// model is 1 rule per policy).
+	policyByID := make(map[string]*nmdata.Policy, len(full.Policies))
+	for i, pc := range full.Policies {
+		if pc == nil {
+			return nil, fmt.Errorf("invalid envelope: policies[%d] is nil", i)
+		}
+		policy := decodePolicyCompact(pc, pc.Id, peerIDByIndex)
+		c.Policies = append(c.Policies, policy)
+		policyByID[pc.Id] = policy
+	}
+
+	// Phase 4: routes.
+	for i, rr := range full.Routes {
+		if rr == nil {
+			return nil, fmt.Errorf("invalid envelope: routes[%d] is nil", i)
+		}
+		c.Routes = append(c.Routes, decodeRouteRaw(rr, peerIDByIndex))
+	}
+
+	// Phase 5: NSGs.
+	for i, nsg := range full.NameserverGroups {
+		if nsg == nil {
+			return nil, fmt.Errorf("invalid envelope: nameserver_groups[%d] is nil", i)
+		}
+		c.NameServerGroups = append(c.NameServerGroups, decodeNameServerGroupRaw(nsg))
+	}
+
+	// Phase 6: network resources.
+	for i, nr := range full.NetworkResources {
+		if nr == nil {
+			return nil, fmt.Errorf("invalid envelope: network_resources[%d] is nil", i)
+		}
+		c.NetworkResources = append(c.NetworkResources, decodeNetworkResource(nr))
+	}
+
+	// Phase 7: routers_map (outer key = network seq id, inner key = peer-id
+	// reconstructed from peer_index). Synthesized network id is "net_<seq>".
+	for networkID, list := range full.RoutersMap {
+		inner := make(map[string]*nmdata.NetworkRouter, len(list.Entries))
+		for _, entry := range list.Entries {
+			if !entry.PeerIndexSet {
+				continue
+			}
+			if int(entry.PeerIndex) >= len(peerIDByIndex) {
+				log.WithField("peer idx", entry.PeerIndex).Error("unrecognized peer id when decoding router map")
+				continue
+			}
+			peerID := peerIDByIndex[entry.PeerIndex]
+			inner[peerID] = &nmdata.NetworkRouter{
+				PublicID:   entry.Id,
+				PeerGroups: entry.PeerGroupIds,
+				Masquerade: entry.Masquerade,
+				Metric:     int(entry.Metric),
+				Enabled:    entry.Enabled,
+			}
+		}
+		if len(inner) > 0 {
+			c.RoutersMap[networkID] = inner
+		}
+	}
+
+	// Phase 8: resource_policies_map (resource seq id → list of *types.Policy
+	// pointers from the decoded policies slice). Resource ID is synthesized
+	// the same way as in decodeNetworkResource.
+	for resourceID, ids := range full.ResourcePoliciesMap {
+		if len(ids.Ids) == 0 {
+			continue
+		}
+		policies := make([]*nmdata.Policy, 0, len(ids.Ids))
+		for _, id := range ids.Ids {
+			if p, ok := policyByID[id]; ok {
+				policies = append(policies, p)
+			} else {
+				log.WithField("policy id", id).Error("unrecognized policy when decoding resource policies")
+			}
+		}
+		if len(policies) > 0 {
+			c.ResourcePoliciesMap[resourceID] = policies
+		}
+	}
+
+	// Phase 8: rebuild resource_policies_map
+	for _, r := range c.NetworkResources {
+		policies := policiesForNetworkResource(r.ID, c.Policies, c.Groups)
+		if len(policies) == 0 {
+			continue
+		}
+		c.ResourcePoliciesMap[r.ID] = policies
+	}
+
+	// Phase 9: group_id_to_user_ids — wire keys are seq ids, synth to strings.
+	for groupId, list := range full.GroupIdToUserIds {
+		c.GroupIDToUserIDs[groupId] = append([]string(nil), list.UserIds...)
+	}
+
+	// Phase 10: posture_failed_peers — wire keys are posture-check seq ids,
+	// values are peer indexes that need to be turned into peer ids. PolicyRule
+	// SourcePostureChecks (also synth ids) reference the same key space.
+	for checkID, set := range full.PostureFailedPeers {
+		failed := make(map[string]struct{}, len(set.PeerIndexes))
+		for _, idx := range set.PeerIndexes {
+			if int(idx) < len(peerIDByIndex) {
+				failed[peerIDByIndex[idx]] = struct{}{}
+			} else {
+				log.WithField("peer idx", idx).Error("unrecognized peer when decoding posture failed peers")
+			}
+		}
+		if len(failed) > 0 {
+			c.PostureFailedPeers[checkID] = failed
+		}
+	}
+
+	// Phase 11: router_peer_indexes — peers that act as routers. They're
+	// already in c.Peers (router peers are appended to the global peers
+	// list by the encoder); RouterPeers is the subset.
+	for _, idx := range full.RouterPeerIndexes {
+		if int(idx) < len(peerIDByIndex) {
+			peerID := peerIDByIndex[idx]
+			c.RouterPeers[peerID] = c.Peers[peerID]
+		}
+	}
+
+	return c, nil
+}
+
+func networkResourceGroups(resourceId string, groups map[string]*nmdata.Group) []string {
+	var toret []string
+	for _, group := range groups {
+		for _, resource := range group.Resources {
+			if resource.ID == resourceId {
+				toret = append(toret, group.PublicID)
+			}
+		}
+	}
+	return toret
+}
+
+func policiesForNetworkResource(resourceId string, allPolicies []*nmdata.Policy, groups map[string]*nmdata.Group) []*nmdata.Policy {
+	var toret []*nmdata.Policy
+
+	networkResourceGroups := networkResourceGroups(resourceId, groups)
+	for _, p := range allPolicies {
+		if p == nil || !p.Enabled || len(p.Rules) == 0 {
+			continue
+		}
+
+		// there's always only one rule in each policy
+		if p.Rules[0].DestinationResource.ID == resourceId {
+			toret = append(toret, p)
+			continue
+		}
+		for _, groupId := range networkResourceGroups {
+			if slices.Contains(p.Rules[0].Destinations, groupId) {
+				toret = append(toret, p)
+				break
+			}
+		}
+	}
+
+	return toret
+}
+
+// decodeAccountNetwork never returns nil — Calculate() dereferences
+// c.Network unconditionally, and servers that predate the fix omit the field
+// entirely from the empty-components envelope.
+func decodeAccountNetwork(an *proto.AccountNetwork) *nmdata.Network {
+	n := &nmdata.Network{}
+	if an == nil {
+		return n
+	}
+	n.Identifier = an.Identifier
+	n.Dns = an.Dns
+	n.Serial = int64(an.Serial)
+	if an.NetCidr != "" {
+		if _, ipnet, err := net.ParseCIDR(an.NetCidr); err == nil && ipnet != nil {
+			n.Net = *ipnet
+		}
+	}
+	if an.NetV6Cidr != "" {
+		if _, ipnet, err := net.ParseCIDR(an.NetV6Cidr); err == nil && ipnet != nil {
+			n.NetV6 = *ipnet
+		}
+	}
+	return n
+}
+
+func decodeAccountSettings(as *proto.AccountSettingsCompact) *nmdata.AccountSettingsInfo {
+	if as == nil {
+		return &nmdata.AccountSettingsInfo{}
+	}
+	return &nmdata.AccountSettingsInfo{
+		PeerLoginExpirationEnabled: as.PeerLoginExpirationEnabled,
+		PeerLoginExpiration:        time.Duration(as.PeerLoginExpirationNs),
+	}
+}
+
+func decodePeerCompact(pc *proto.PeerCompact, peerID string) *nmdata.Peer {
+	var caps []int32
+	if pc.SupportsSourcePrefixes {
+		caps = append(caps, nmdata.PeerCapabilitySourcePrefixes)
+	}
+	if pc.SupportsIpv6 {
+		caps = append(caps, nmdata.PeerCapabilityIPv6Overlay)
+	}
+	peer := &nmdata.Peer{
+		ID:                     peerID,
+		Key:                    peerID,
+		SSHKey:                 string(pc.SshPubKey),
+		SSHEnabled:             pc.SshEnabled,
+		DNSLabel:               pc.DnsLabel,
+		LoginExpirationEnabled: pc.LoginExpirationEnabled,
+		ProxyMeta:              nmdata.ProxyMeta{Embedded: pc.ProxyEmbedded},
+		Meta: nmdata.PeerSystemMeta{
+			WtVersion:    pc.AgentVersion,
+			Capabilities: caps,
+			Flags: nmdata.Flags{
+				ServerSSHAllowed: pc.ServerSshAllowed,
+			},
+		},
+	}
+	if pc.AddedWithSsoLogin {
+		// Set a non-empty UserID so (*Peer).AddedWithSSOLogin() returns true.
+		// The original UserID isn't on the wire; the value is intentionally
+		// visibly synthetic so any future consumer that mistakes UserID for a
+		// real account user xid won't silently match (or worse, write the
+		// sentinel into a downstream record).
+		peer.UserID = "<env-sso>"
+	}
+	if pc.LastLoginUnixNano != 0 {
+		t := time.Unix(0, pc.LastLoginUnixNano)
+		peer.LastLogin = &t
+	}
+	switch len(pc.Ip) {
+	case 4:
+		peer.IP = netip.AddrFrom4([4]byte{pc.Ip[0], pc.Ip[1], pc.Ip[2], pc.Ip[3]})
+	case 16:
+		var a [16]byte
+		copy(a[:], pc.Ip)
+		peer.IP = netip.AddrFrom16(a)
+	}
+	if len(pc.Ipv6) == 16 {
+		var a [16]byte
+		copy(a[:], pc.Ipv6)
+		peer.IPv6 = netip.AddrFrom16(a)
+	}
+	return peer
+}
+
+func decodePolicyCompact(pc *proto.PolicyCompact, policyID string, peerIDByIndex []string) *nmdata.Policy {
+	rule := &nmdata.PolicyRule{
+		ID:                  policyID, // 1 rule per policy → reuse synthesized id
+		PolicyID:            policyID,
+		Enabled:             true,
+		Action:              string(actionFromProto(pc.Action)),
+		Protocol:            string(protocolFromProto(pc.Protocol)),
+		Bidirectional:       pc.Bidirectional,
+		Ports:               uint32SliceToStrings(pc.Ports),
+		PortRanges:          portRangesFromProto(pc.PortRanges),
+		Sources:             pc.SourceGroupIds,
+		Destinations:        pc.DestinationGroupIds,
+		AuthorizedUser:      pc.AuthorizedUser,
+		AuthorizedGroups:    authorizedGroupsFromProto(pc.AuthorizedGroups),
+		SourceResource:      resourceFromProto(pc.SourceResource, peerIDByIndex),
+		DestinationResource: resourceFromProto(pc.DestinationResource, peerIDByIndex),
+	}
+	return &nmdata.Policy{
+		ID:                  policyID,
+		PublicID:            pc.Id,
+		Enabled:             true,
+		Rules:               []*nmdata.PolicyRule{rule},
+		SourcePostureChecks: pc.SourcePostureCheckIds,
+	}
+}
+
+// resourceFromProto rebuilds types.Resource. For peer-typed resources the
+// peer reference is reconstructed from the envelope's peer index — wire
+// format ships no xid for peers, so we use the synthesized peer id.
+func resourceFromProto(r *proto.ResourceCompact, peerIDByIndex []string) nmdata.Resource {
+	if r == nil || !types.ResourceType(r.Type).Valid() {
+		return nmdata.Resource{}
+	}
+
+	if r.Type == string(types.ResourceTypePeer) {
+		if !r.PeerIndexSet || int(r.PeerIndex) >= len(peerIDByIndex) {
+			return nmdata.Resource{}
+		}
+		return nmdata.Resource{Type: r.Type, ID: peerIDByIndex[int(r.PeerIndex)]}
+	}
+
+	return nmdata.Resource{Type: r.Type, ID: r.Id}
+}
+
+// authorizedGroupsFromProto inverts encodeAuthorizedGroups: the wire form
+// keys by group account_seq_id, the typed PolicyRule field keys by group
+// xid string. We rebuild using the same synthetic scheme the rest of the
+// decoder uses ("g<seq>").
+func authorizedGroupsFromProto(m map[string]*proto.UserNameList) map[string][]string {
+	if len(m) == 0 {
+		return nil
+	}
+	out := make(map[string][]string, len(m))
+	for id, list := range m {
+		if list == nil {
+			continue
+		}
+		out[id] = append([]string(nil), list.Names...)
+	}
+	return out
+}
+
+func decodeRouteRaw(rr *proto.RouteRaw, peerIDByIndex []string) *nmdata.Route {
+	r := &nmdata.Route{
+		ID:                  rr.Id,
+		PublicID:            rr.Id,
+		NetID:               rr.NetId,
+		Description:         rr.Description,
+		Domains:             domainsFromPunycode(rr.Domains),
+		KeepRoute:           rr.KeepRoute,
+		NetworkType:         int(rr.NetworkType),
+		Masquerade:          rr.Masquerade,
+		Metric:              int(rr.Metric),
+		Enabled:             rr.Enabled,
+		Groups:              rr.GroupIds,
+		AccessControlGroups: rr.AccessControlGroupIds,
+		PeerGroups:          rr.PeerGroupIds,
+		SkipAutoApply:       rr.SkipAutoApply,
+	}
+	if rr.NetworkCidr != "" {
+		if p, err := netip.ParsePrefix(rr.NetworkCidr); err == nil {
+			r.Network = p
+		}
+	}
+	if rr.PeerIndexSet && int(rr.PeerIndex) < len(peerIDByIndex) {
+		r.Peer = peerIDByIndex[rr.PeerIndex]
+	}
+	return r
+}
+
+func decodeNameServerGroupRaw(nsg *proto.NameServerGroupRaw) *nmdata.NameServerGroup {
+	out := &nmdata.NameServerGroup{
+		ID:                   nsg.Id,
+		PublicID:             nsg.Id,
+		Groups:               nsg.GroupIds,
+		Primary:              nsg.Primary,
+		Domains:              nsg.Domains,
+		Enabled:              nsg.Enabled,
+		SearchDomainsEnabled: nsg.SearchDomainsEnabled,
+		NameServers:          make([]nmdata.NameServer, 0, len(nsg.Nameservers)),
+	}
+	for _, ns := range nsg.Nameservers {
+		if addr, err := netip.ParseAddr(ns.IP); err == nil {
+			out.NameServers = append(out.NameServers, nmdata.NameServer{
+				IP:     addr,
+				NSType: int(ns.NSType),
+				Port:   int(ns.Port),
+			})
+		}
+	}
+	return out
+}
+
+func decodeNetworkResource(nr *proto.NetworkResourceRaw) *nmdata.NetworkResource {
+	out := &nmdata.NetworkResource{
+		ID:          nr.Id,
+		PublicID:    nr.Id,
+		NetworkID:   nr.NetworkSeq,
+		Name:        nr.Name,
+		Description: nr.Description,
+		Type:        nr.Type,
+		Address:     nr.Address,
+		Domain:      nr.DomainValue,
+		Enabled:     nr.Enabled,
+	}
+	if nr.PrefixCidr != "" {
+		if p, err := netip.ParsePrefix(nr.PrefixCidr); err == nil {
+			out.Prefix = p
+		}
+	}
+	return out
+}
+
+func decodeSimpleRecords(records []*proto.SimpleRecord) []nmdata.SimpleRecord {
+	out := make([]nmdata.SimpleRecord, 0, len(records))
+	for _, r := range records {
+		out = append(out, nmdata.SimpleRecord{
+			Name:  r.Name,
+			Type:  int(r.Type),
+			Class: r.Class,
+			TTL:   int(r.TTL),
+			RData: r.RData,
+		})
+	}
+	return out
+}
+
+func decodeCustomZones(zones []*proto.CustomZone) []nmdata.CustomZone {
+	out := make([]nmdata.CustomZone, 0, len(zones))
+	for _, z := range zones {
+		out = append(out, nmdata.CustomZone{
+			Domain:               z.Domain,
+			Records:              decodeSimpleRecords(z.Records),
+			SearchDomainDisabled: z.SearchDomainDisabled,
+			NonAuthoritative:     z.NonAuthoritative,
+		})
+	}
+	return out
+}
+
+func uint32SliceToStrings(ports []uint32) []string {
+	if len(ports) == 0 {
+		return nil
+	}
+	out := make([]string, len(ports))
+	for i, p := range ports {
+		out[i] = strconv.FormatUint(uint64(p), 10)
+	}
+	return out
+}
+
+func portRangesFromProto(ranges []*proto.PortInfo_Range) []nmdata.RulePortRange {
+	if len(ranges) == 0 {
+		return nil
+	}
+	out := make([]nmdata.RulePortRange, 0, len(ranges))
+	for _, r := range ranges {
+		if r == nil || r.Start > 65535 || r.End > 65535 {
+			continue
+		}
+		out = append(out, nmdata.RulePortRange{
+			Start: uint16(r.Start),
+			End:   uint16(r.End),
+		})
+	}
+	return out
+}
+
+func actionFromProto(a proto.RuleAction) types.PolicyTrafficActionType {
+	if a == proto.RuleAction_DROP {
+		return types.PolicyTrafficActionDrop
+	}
+	return types.PolicyTrafficActionAccept
+}
+
+func protocolFromProto(p proto.RuleProtocol) types.PolicyRuleProtocolType {
+	switch p {
+	case proto.RuleProtocol_TCP:
+		return types.PolicyRuleProtocolTCP
+	case proto.RuleProtocol_UDP:
+		return types.PolicyRuleProtocolUDP
+	case proto.RuleProtocol_ICMP:
+		return types.PolicyRuleProtocolICMP
+	case proto.RuleProtocol_ALL:
+		return types.PolicyRuleProtocolALL
+	case proto.RuleProtocol_NETBIRD_SSH:
+		return types.PolicyRuleProtocolNetbirdSSH
+	default:
+		return types.PolicyRuleProtocolALL
+	}
+}
+
+func stringSliceToSet(s []string) map[string]struct{} {
+	if len(s) == 0 {
+		return nil
+	}
+	out := make(map[string]struct{}, len(s))
+	for _, v := range s {
+		out[v] = struct{}{}
+	}
+	return out
+}
+
+// domainsFromPunycode is a thin wrapper that converts a punycode list back to
+// the domain.List type the route.Route struct expects. It accepts the
+// punycode strings as-is (no extra decoding) — symmetric with
+// route.Domains.ToPunycodeList() used in the encoder.
+func domainsFromPunycode(punycoded []string) domain.List {
+	if len(punycoded) == 0 {
+		return nil
+	}
+	out := make(domain.List, 0, len(punycoded))
+	for _, d := range punycoded {
+		out = append(out, domain.Domain(d))
+	}
+	return out
+}
diff --git a/shared/management/networkmap/decode_test.go b/shared/management/networkmap/decode_test.go
new file mode 100644
index 000000000..7e2f17c60
--- /dev/null
+++ b/shared/management/networkmap/decode_test.go
@@ -0,0 +1,61 @@
+package networkmap
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	protobuf "google.golang.org/protobuf/proto"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestDecodePolicy(t *testing.T) {
+	assert.Equal(t,
+		nmdata.Resource{Type: "peer", ID: "valid-id"},
+		resourceFromProto(
+			&proto.ResourceCompact{Type: "peer", PeerIndexSet: true, PeerIndex: uint32(1)},
+			[]string{"invalid-id-0", "valid-id", "invalid-id-2"}))
+	// check invalid peer index returns an empty resource
+	assert.Equal(t,
+		nmdata.Resource{},
+		resourceFromProto(
+			&proto.ResourceCompact{Type: "peer", PeerIndexSet: true, PeerIndex: uint32(100)},
+			[]string{"invalid-id-0", "valid-id", "invalid-id-2"}))
+	assert.Equal(t,
+		nmdata.Resource{Type: "domain", ID: "domain"},
+		resourceFromProto(
+			&proto.ResourceCompact{Type: "domain", Id: "domain"}, []string{}))
+	assert.Equal(t,
+		nmdata.Resource{Type: "host", ID: "host"},
+		resourceFromProto(
+			&proto.ResourceCompact{Type: "host", Id: "host"}, []string{}))
+	assert.Equal(t,
+		nmdata.Resource{Type: "subnet", ID: "subnet"},
+		resourceFromProto(
+			&proto.ResourceCompact{Type: "subnet", Id: "subnet"}, []string{}))
+	// an unknown resource type return an empty resource
+	assert.Equal(t,
+		nmdata.Resource{},
+		resourceFromProto(
+			&proto.ResourceCompact{Type: "boom", Id: "boom"}, []string{}))
+}
+
+// ResourceCompact fields 1-3 are the v0.77 wire contract. Retyping any of them
+// makes peers on either side of the change silently drop policy resources, so
+// the encoding is pinned here as raw bytes: field 1 "peer" (bytes), field 2
+// true (varint), field 3 7 (varint).
+func TestResourceCompactLegacyWireFormat(t *testing.T) {
+	legacy := []byte{0x0a, 0x04, 'p', 'e', 'e', 'r', 0x10, 0x01, 0x18, 0x07}
+
+	var decoded proto.ResourceCompact
+	require.NoError(t, protobuf.Unmarshal(legacy, &decoded))
+	assert.Equal(t, "peer", decoded.Type)
+	assert.True(t, decoded.PeerIndexSet)
+	assert.Equal(t, uint32(7), decoded.PeerIndex)
+
+	encoded, err := protobuf.Marshal(&proto.ResourceCompact{Type: "peer", PeerIndexSet: true, PeerIndex: 7})
+	require.NoError(t, err)
+	assert.Equal(t, legacy, encoded)
+}
diff --git a/shared/management/networkmap/encode.go b/shared/management/networkmap/encode.go
new file mode 100644
index 000000000..dfacabe18
--- /dev/null
+++ b/shared/management/networkmap/encode.go
@@ -0,0 +1,337 @@
+// Package networkmap contains the shared NetworkMap helpers that both the
+// management server and the client agent need.
+//
+// The proto-conversion helpers (types.NetworkMap → proto.NetworkMap) live
+// here so the client can run the same conversion locally after deriving its
+// NetworkMap from a NetworkMapEnvelope, without taking a dependency on the
+// server-side conversion package (which pulls in cloud integrations and is
+// otherwise an unwanted internal import on the client).
+//
+// The helpers are pure functions over inputs — no caches, no IO, no logging
+// beyond a context-aware error log when an individual user-id hash fails.
+package networkmap
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+	goproto "google.golang.org/protobuf/proto"
+
+	"net/netip"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/management/types"
+	"github.com/netbirdio/netbird/shared/netiputil"
+	"github.com/netbirdio/netbird/shared/sshauth"
+)
+
+// ToProtocolRoutes converts a slice of typed routes to their proto form.
+func ToProtocolRoutes(routes []*nmdata.Route) []*proto.Route {
+	protoRoutes := make([]*proto.Route, 0, len(routes))
+	for _, r := range routes {
+		protoRoutes = append(protoRoutes, ToProtocolRoute(r))
+	}
+	return protoRoutes
+}
+
+// ToProtocolRoute converts one typed route to its proto form.
+func ToProtocolRoute(route *nmdata.Route) *proto.Route {
+	return &proto.Route{
+		ID:            string(route.ID),
+		NetID:         string(route.NetID),
+		Network:       route.Network.String(),
+		Domains:       route.Domains.ToPunycodeList(),
+		NetworkType:   int64(route.NetworkType),
+		Peer:          route.Peer,
+		Metric:        int64(route.Metric),
+		Masquerade:    route.Masquerade,
+		KeepRoute:     route.KeepRoute,
+		SkipAutoApply: route.SkipAutoApply,
+	}
+}
+
+// ToProtocolFirewallRules converts the firewall rules to the protocol form.
+// When useSourcePrefixes is true, the compact SourcePrefixes field is
+// populated alongside the deprecated PeerIP for forward compatibility.
+// Wildcard rules ("0.0.0.0") are expanded into separate v4/v6 SourcePrefixes
+// when includeIPv6 is true.
+func ToProtocolFirewallRules(rules []*types.FirewallRule, includeIPv6, useSourcePrefixes bool) []*proto.FirewallRule {
+	result := make([]*proto.FirewallRule, 0, len(rules))
+	for i := range rules {
+		rule := rules[i]
+
+		fwRule := &proto.FirewallRule{
+			PolicyID:  []byte(rule.PolicyID),
+			PeerIP:    rule.PeerIP, //nolint:staticcheck // populated for backward compatibility
+			Direction: GetProtoDirection(rule.Direction),
+			Action:    GetProtoAction(rule.Action),
+			Protocol:  GetProtoProtocol(rule.Protocol),
+			Port:      rule.Port,
+		}
+
+		if useSourcePrefixes && rule.PeerIP != "" {
+			result = append(result, populateSourcePrefixes(fwRule, rule, includeIPv6)...)
+		}
+
+		if ShouldUsePortRange(fwRule) {
+			fwRule.PortInfo = rule.PortRange.ToProto()
+		}
+
+		result = append(result, fwRule)
+	}
+	return result
+}
+
+// populateSourcePrefixes sets SourcePrefixes on fwRule and returns any
+// additional rules needed (e.g. a v6 wildcard clone when the peer IP is
+// unspecified).
+func populateSourcePrefixes(fwRule *proto.FirewallRule, rule *types.FirewallRule, includeIPv6 bool) []*proto.FirewallRule {
+	addr, err := netip.ParseAddr(rule.PeerIP)
+	if err != nil {
+		return nil
+	}
+
+	if !addr.IsUnspecified() {
+		fwRule.SourcePrefixes = [][]byte{netiputil.EncodeAddr(addr.Unmap())}
+		return nil
+	}
+
+	v4Wildcard, _ := netiputil.EncodePrefix(netip.PrefixFrom(netip.IPv4Unspecified(), 0))
+	fwRule.SourcePrefixes = [][]byte{v4Wildcard}
+
+	if !includeIPv6 {
+		return nil
+	}
+
+	v6Rule := goproto.Clone(fwRule).(*proto.FirewallRule)
+	v6Rule.PeerIP = "::" //nolint:staticcheck // populated for backward compatibility
+	v6Wildcard, _ := netiputil.EncodePrefix(netip.PrefixFrom(netip.IPv6Unspecified(), 0))
+	v6Rule.SourcePrefixes = [][]byte{v6Wildcard}
+	if ShouldUsePortRange(v6Rule) {
+		v6Rule.PortInfo = rule.PortRange.ToProto()
+	}
+	return []*proto.FirewallRule{v6Rule}
+}
+
+// GetProtoDirection converts the direction to proto.RuleDirection.
+func GetProtoDirection(direction int) proto.RuleDirection {
+	if direction == types.FirewallRuleDirectionOUT {
+		return proto.RuleDirection_OUT
+	}
+	return proto.RuleDirection_IN
+}
+
+// GetProtoAction converts the action to proto.RuleAction.
+func GetProtoAction(action string) proto.RuleAction {
+	if action == string(types.PolicyTrafficActionDrop) {
+		return proto.RuleAction_DROP
+	}
+	return proto.RuleAction_ACCEPT
+}
+
+// GetProtoProtocol converts the protocol to proto.RuleProtocol.
+func GetProtoProtocol(protocol string) proto.RuleProtocol {
+	switch types.PolicyRuleProtocolType(protocol) {
+	case types.PolicyRuleProtocolALL:
+		return proto.RuleProtocol_ALL
+	case types.PolicyRuleProtocolTCP:
+		return proto.RuleProtocol_TCP
+	case types.PolicyRuleProtocolUDP:
+		return proto.RuleProtocol_UDP
+	case types.PolicyRuleProtocolICMP:
+		return proto.RuleProtocol_ICMP
+	case types.PolicyRuleProtocolNetbirdSSH:
+		return proto.RuleProtocol_NETBIRD_SSH
+	default:
+		return proto.RuleProtocol_UNKNOWN
+	}
+}
+
+// GetProtoPortInfo converts route-firewall-rule port info to proto.PortInfo.
+func GetProtoPortInfo(rule *types.RouteFirewallRule) *proto.PortInfo {
+	var portInfo proto.PortInfo
+	if rule.Port != 0 {
+		portInfo.PortSelection = &proto.PortInfo_Port{Port: uint32(rule.Port)}
+	} else if portRange := rule.PortRange; portRange.Start != 0 && portRange.End != 0 {
+		portInfo.PortSelection = &proto.PortInfo_Range_{
+			Range: &proto.PortInfo_Range{
+				Start: uint32(portRange.Start),
+				End:   uint32(portRange.End),
+			},
+		}
+	}
+	return &portInfo
+}
+
+// ShouldUsePortRange reports whether the firewall rule should use a port
+// range rather than a single port (TCP/UDP without a single port).
+func ShouldUsePortRange(rule *proto.FirewallRule) bool {
+	return rule.Port == "" && (rule.Protocol == proto.RuleProtocol_UDP || rule.Protocol == proto.RuleProtocol_TCP)
+}
+
+// ToProtocolRoutesFirewallRules converts a slice of typed route-firewall
+// rules to proto.
+func ToProtocolRoutesFirewallRules(rules []*types.RouteFirewallRule) []*proto.RouteFirewallRule {
+	result := make([]*proto.RouteFirewallRule, len(rules))
+	for i := range rules {
+		rule := rules[i]
+		result[i] = &proto.RouteFirewallRule{
+			SourceRanges: rule.SourceRanges,
+			Action:       GetProtoAction(rule.Action),
+			Destination:  rule.Destination,
+			Protocol:     GetProtoProtocol(rule.Protocol),
+			PortInfo:     GetProtoPortInfo(rule),
+			IsDynamic:    rule.IsDynamic,
+			Domains:      rule.Domains.ToPunycodeList(),
+			PolicyID:     []byte(rule.PolicyID),
+			RouteID:      string(rule.RouteID),
+		}
+	}
+	return result
+}
+
+// ConvertToProtoCustomZone converts an nbdns.CustomZone to its proto form.
+func ConvertToProtoCustomZone(zone nbdns.CustomZone) *proto.CustomZone {
+	protoZone := &proto.CustomZone{
+		Domain:               zone.Domain,
+		Records:              make([]*proto.SimpleRecord, 0, len(zone.Records)),
+		SearchDomainDisabled: zone.SearchDomainDisabled,
+		NonAuthoritative:     zone.NonAuthoritative,
+	}
+	for _, record := range zone.Records {
+		protoZone.Records = append(protoZone.Records, &proto.SimpleRecord{
+			Name:  record.Name,
+			Type:  int64(record.Type),
+			Class: record.Class,
+			TTL:   int64(record.TTL),
+			RData: record.RData,
+		})
+	}
+	return protoZone
+}
+
+// ConvertToProtoNameServerGroup converts a NameServerGroup to its proto form.
+func ConvertToProtoNameServerGroup(nsGroup *nbdns.NameServerGroup) *proto.NameServerGroup {
+	protoGroup := &proto.NameServerGroup{
+		Primary:              nsGroup.Primary,
+		Domains:              nsGroup.Domains,
+		SearchDomainsEnabled: nsGroup.SearchDomainsEnabled,
+		NameServers:          make([]*proto.NameServer, 0, len(nsGroup.NameServers)),
+	}
+	for _, ns := range nsGroup.NameServers {
+		protoGroup.NameServers = append(protoGroup.NameServers, &proto.NameServer{
+			IP:     ns.IP.String(),
+			Port:   int64(ns.Port),
+			NSType: int64(ns.NSType),
+		})
+	}
+	return protoGroup
+}
+
+// DNSConfigCache is the cache contract for amortising NameServerGroup
+// proto-conversion across peers in the same account. Server uses a concrete
+// implementation; client passes nil (no cross-peer caching needed when
+// rebuilding a single NetworkMap from an envelope).
+type DNSConfigCache interface {
+	GetNameServerGroup(key string) (*proto.NameServerGroup, bool)
+	SetNameServerGroup(key string, value *proto.NameServerGroup)
+}
+
+// ToProtocolDNSConfig converts nbdns.Config to proto.DNSConfig. If cache is
+// non-nil, NameServerGroup proto values are cached by NSG.ID across calls —
+// the server amortises this across peers, the client passes nil.
+func ToProtocolDNSConfig(update nbdns.Config, cache DNSConfigCache, forwardPort int64) *proto.DNSConfig {
+	protoUpdate := &proto.DNSConfig{
+		ServiceEnable:    update.ServiceEnable,
+		CustomZones:      make([]*proto.CustomZone, 0, len(update.CustomZones)),
+		NameServerGroups: make([]*proto.NameServerGroup, 0, len(update.NameServerGroups)),
+		ForwarderPort:    forwardPort, //nolint:staticcheck
+	}
+
+	for _, zone := range update.CustomZones {
+		protoUpdate.CustomZones = append(protoUpdate.CustomZones, ConvertToProtoCustomZone(zone))
+	}
+
+	for _, nsGroup := range update.NameServerGroups {
+		if cache != nil {
+			if cachedGroup, exists := cache.GetNameServerGroup(nsGroup.ID); exists {
+				protoUpdate.NameServerGroups = append(protoUpdate.NameServerGroups, cachedGroup)
+				continue
+			}
+		}
+		protoGroup := ConvertToProtoNameServerGroup(nsGroup)
+		if cache != nil {
+			cache.SetNameServerGroup(nsGroup.ID, protoGroup)
+		}
+		protoUpdate.NameServerGroups = append(protoUpdate.NameServerGroups, protoGroup)
+	}
+
+	return protoUpdate
+}
+
+// AppendRemotePeerConfig appends typed peers as proto.RemotePeerConfig
+// entries to dst and returns the result. localIsProxy reports whether the peer
+// receiving this config is itself an embedded proxy.
+func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*nmdata.Peer, dnsName string, includeIPv6 bool, localIsProxy bool) []*proto.RemotePeerConfig {
+	for _, rPeer := range peers {
+		allowedIPs := []string{rPeer.IP.String() + "/32"}
+		if includeIPv6 && rPeer.IPv6.IsValid() {
+			allowedIPs = append(allowedIPs, rPeer.IPv6.String()+"/128")
+		}
+		dst = append(dst, &proto.RemotePeerConfig{
+			WgPubKey:     rPeer.Key,
+			AllowedIps:   allowedIPs,
+			SshConfig:    &proto.SSHConfig{SshPubKey: []byte(rPeer.SSHKey)},
+			Fqdn:         rPeer.FQDN(dnsName),
+			AgentVersion: rPeer.Meta.WtVersion,
+			LazyState:    lazyStateFor(localIsProxy, rPeer),
+		})
+	}
+	return dst
+}
+
+// lazyStateFor returns the per-peer lazy override for a remote peer. Connections
+// involving an ephemeral proxy peer on either endpoint default to lazy so shared
+// proxy infrastructure is not kept permanently connected to every peer. All
+// other peers follow the account-wide flag. A future admin-facing per-peer
+// setting can return LazyStateEager here to force a peer always-active.
+func lazyStateFor(localIsProxy bool, rPeer *nmdata.Peer) proto.LazyState {
+	if localIsProxy || rPeer.ProxyMeta.Embedded {
+		return proto.LazyState_LazyStateLazy
+	}
+	return proto.LazyState_LazyStateDefault
+}
+
+// BuildAuthorizedUsersProto deduplicates user-IDs into a hashed list and
+// builds per-machine-user index maps. Returns (hashedUsers, machineUsers).
+// Errors from individual hash failures are logged via the provided context;
+// they leave the offending user out of the result but don't abort the build.
+func BuildAuthorizedUsersProto(ctx context.Context, authorizedUsers map[string]map[string]struct{}) ([][]byte, map[string]*proto.MachineUserIndexes) {
+	userIDToIndex := make(map[string]uint32)
+	var hashedUsers [][]byte
+	machineUsers := make(map[string]*proto.MachineUserIndexes, len(authorizedUsers))
+
+	for machineUser, users := range authorizedUsers {
+		indexes := make([]uint32, 0, len(users))
+		for userID := range users {
+			idx, exists := userIDToIndex[userID]
+			if !exists {
+				hash, err := sshauth.HashUserID(userID)
+				if err != nil {
+					log.WithContext(ctx).WithError(err).Error("failed to hash user id")
+					continue
+				}
+				idx = uint32(len(hashedUsers))
+				userIDToIndex[userID] = idx
+				hashedUsers = append(hashedUsers, hash[:])
+			}
+			indexes = append(indexes, idx)
+		}
+		machineUsers[machineUser] = &proto.MachineUserIndexes{Indexes: indexes}
+	}
+
+	return hashedUsers, machineUsers
+}
diff --git a/shared/management/networkmap/envelope.go b/shared/management/networkmap/envelope.go
new file mode 100644
index 000000000..b2fbbef08
--- /dev/null
+++ b/shared/management/networkmap/envelope.go
@@ -0,0 +1,133 @@
+package networkmap
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/management/types"
+)
+
+// EnvelopeResult is what the client engine consumes after receiving a
+// component-format NetworkMap. Both fields are populated:
+//
+//   - NetworkMap is the *proto.NetworkMap shape the engine reads today via
+//     update.GetNetworkMap() — built from the envelope's components by
+//     running Calculate() locally + converting back through the shared
+//     proto helpers.
+//   - Components is the *types.NetworkMapComponents the engine retains so
+//     future incremental delta updates have a base to apply changes
+//     against. The client keeps it under its sync lock.
+type EnvelopeResult struct {
+	NetworkMap *proto.NetworkMap
+	Components *types.NetworkMapComponents
+}
+
+// EnvelopeToNetworkMap is the full client-side pipeline: decode the
+// component envelope back to a typed NetworkMapComponents, run Calculate()
+// locally to produce the typed NetworkMap and convert it to the wire form the
+// engine consumes.
+//
+// localPeerKey is the receiving peer's WG pub key (used to derive
+// includeIPv6 / useSourcePrefixes from the receiving peer's own record in
+// the components struct, mirroring legacy ToSyncResponse behaviour).
+//
+// dnsName is the account's DNS domain ("netbird.cloud" etc.); used when
+// rebuilding the per-peer FQDNs that proto.RemotePeerConfig carries.
+//
+// skipRouteFirewallRules leaves RoutesFirewallRules empty. Callers that have
+// no firewall to program pass true: the rules are the most expensive part of
+// Calculate on a peer that routes many network resources, and nothing reads
+// them afterwards.
+func EnvelopeToNetworkMap(ctx context.Context, env *proto.NetworkMapEnvelope, localPeerKey, dnsName string, skipRouteFirewallRules bool) (*EnvelopeResult, error) {
+	components, err := DecodeEnvelope(ctx, env)
+	if err != nil {
+		return nil, fmt.Errorf("decode envelope: %w", err)
+	}
+
+	// Find the receiving peer in the decoded components by WG key.
+	// c.Peers is keyed by canonical base64 of the raw 32-byte pub key
+	// (decoder re-encodes the bytes off the wire). The caller may pass a
+	// non-canonical encoding (some persisted production keys carry
+	// non-zero trailing padding bits that survived a legacy import), so
+	// round-trip through raw bytes once to canonicalize before lookup.
+	canonicalKey := canonicalizeWgKey(localPeerKey)
+	localPeer := components.Peers[canonicalKey]
+	if localPeer == nil {
+		return nil, fmt.Errorf("receiving peer (wg_key prefix %q) not found among %d decoded peers — components have no PeerID, Calculate would return empty", trimKey(localPeerKey), len(components.Peers))
+	}
+	components.PeerID = canonicalKey
+	components.SkipRouteFirewallRules = skipRouteFirewallRules
+
+	includeIPv6 := localPeer.SupportsIPv6() && localPeer.IPv6.IsValid()
+	useSourcePrefixes := localPeer.SupportsSourcePrefixes()
+
+	typedNM := components.Calculate(ctx)
+
+	full := env.GetFull()
+	dnsFwdPort := int64(0)
+	if full != nil {
+		dnsFwdPort = full.DnsForwarderPort
+	}
+
+	protoNM := &proto.NetworkMap{
+		Serial: typedNM.Network.CurrentSerial(),
+	}
+	if full != nil {
+		protoNM.PeerConfig = full.PeerConfig
+	}
+	protoNM.Routes = ToProtocolRoutes(typedNM.Routes)
+	protoNM.DNSConfig = ToProtocolDNSConfig(typedNM.DNSConfig, nil, dnsFwdPort)
+
+	remotePeers := AppendRemotePeerConfig(nil, typedNM.Peers, dnsName, includeIPv6, localPeer.ProxyMeta.Embedded)
+	protoNM.RemotePeers = remotePeers
+	protoNM.RemotePeersIsEmpty = len(remotePeers) == 0
+
+	protoNM.OfflinePeers = AppendRemotePeerConfig(nil, typedNM.OfflinePeers, dnsName, includeIPv6, localPeer.ProxyMeta.Embedded)
+
+	firewallRules := ToProtocolFirewallRules(typedNM.FirewallRules, includeIPv6, useSourcePrefixes)
+	protoNM.FirewallRules = firewallRules
+	protoNM.FirewallRulesIsEmpty = len(firewallRules) == 0
+
+	routesFirewallRules := ToProtocolRoutesFirewallRules(typedNM.RoutesFirewallRules)
+	protoNM.RoutesFirewallRules = routesFirewallRules
+	protoNM.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
+
+	if typedNM.AuthorizedUsers != nil {
+		hashedUsers, machineUsers := BuildAuthorizedUsersProto(ctx, typedNM.AuthorizedUsers)
+		userIDClaim := ""
+		if full != nil {
+			userIDClaim = full.UserIdClaim
+		}
+		protoNM.SshAuth = &proto.SSHAuth{
+			AuthorizedUsers: hashedUsers,
+			MachineUsers:    machineUsers,
+			UserIDClaim:     userIDClaim,
+		}
+	}
+
+	return &EnvelopeResult{
+		NetworkMap: protoNM,
+		Components: components,
+	}, nil
+}
+
+func trimKey(s string) string {
+	if len(s) > 12 {
+		return s[:12]
+	}
+	return s
+}
+
+// canonicalizeWgKey normalises a base64-encoded WireGuard public key so it
+// matches the canonical encoding emitted by the envelope decoder. Returns
+// the input unchanged when it does not decode to 32 raw bytes (caller will
+// hit a miss in the peer map and surface the error).
+func canonicalizeWgKey(s string) string {
+	raw, err := base64.StdEncoding.DecodeString(s)
+	if err != nil || len(raw) != 32 {
+		return s
+	}
+	return base64.StdEncoding.EncodeToString(raw)
+}
diff --git a/shared/management/networkmap/envelope_test.go b/shared/management/networkmap/envelope_test.go
new file mode 100644
index 000000000..98333a3c8
--- /dev/null
+++ b/shared/management/networkmap/envelope_test.go
@@ -0,0 +1,463 @@
+package networkmap_test
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	goproto "google.golang.org/protobuf/proto"
+
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/server/types"
+	nbnetworkmap "github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// TestEnvelopeToNetworkMap_RoundTrip exercises the full client-side pipeline:
+// build a small components struct, encode an envelope, marshal/unmarshal the
+// wire bytes, decode back via EnvelopeToNetworkMap, and verify the result is
+// non-empty and consistent.
+func TestEnvelopeToNetworkMap_RoundTrip(t *testing.T) {
+	c, localPeerKey := buildSmokeComponents(t)
+
+	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+		Components: c,
+		DNSDomain:  "netbird.cloud",
+	})
+
+	wire, err := goproto.Marshal(envelope)
+	require.NoError(t, err, "marshal envelope")
+
+	var decoded proto.NetworkMapEnvelope
+	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
+
+	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud", false)
+	require.NoError(t, err, "EnvelopeToNetworkMap")
+	require.NotNil(t, result)
+	require.NotNil(t, result.NetworkMap, "decoded NetworkMap must be non-nil")
+	require.NotNil(t, result.Components, "Components must be retained for future delta updates")
+	require.NotNil(t, result.Components.AccountSettings)
+	require.NotEmpty(t, result.NetworkMap.RemotePeers, "two-peer allow policy should produce one remote peer")
+	require.NotEmpty(t, result.NetworkMap.FirewallRules, "two-peer allow policy should produce firewall rules")
+}
+
+// TestCalculate_FirewallRuleProtocol_NeverNetbirdSSH guards against the
+// scenario where a rule with Protocol=NetbirdSSH leaks the enum value into
+// proto.FirewallRule.Protocol. Calculate() must rewrite NetbirdSSH → TCP
+// before forming firewall rules. Without that rewrite, agents fall into
+// UNKNOWN-protocol handling, which on some platforms downgrades to
+// allow-all — a real security regression.
+func TestCalculate_FirewallRuleProtocol_NeverNetbirdSSH(t *testing.T) {
+	c, localPeerKey := buildSmokeComponents(t)
+	// Replace the smoke policy with a NetbirdSSH-protocol allow.
+	c.Policies = []*nmdata.Policy{{
+		ID: "pol-ssh", PublicID: "2", Enabled: true,
+		Rules: []*nmdata.PolicyRule{{
+			ID:            "rule-ssh",
+			Enabled:       true,
+			Action:        string(types.PolicyTrafficActionAccept),
+			Protocol:      string(types.PolicyRuleProtocolNetbirdSSH),
+			Bidirectional: true,
+			Sources:       []string{"group-all"},
+			Destinations:  []string{"group-all"},
+		}},
+	}}
+
+	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+		Components: c,
+		DNSDomain:  "netbird.cloud",
+	})
+	wire, err := goproto.Marshal(envelope)
+	require.NoError(t, err)
+	var decoded proto.NetworkMapEnvelope
+	require.NoError(t, goproto.Unmarshal(wire, &decoded))
+
+	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud", false)
+	require.NoError(t, err)
+	require.NotEmpty(t, result.NetworkMap.FirewallRules, "ssh policy should produce firewall rules")
+	for i, fr := range result.NetworkMap.FirewallRules {
+		require.NotEqualf(t, proto.RuleProtocol_NETBIRD_SSH, fr.Protocol,
+			"FirewallRules[%d].Protocol must be the rewritten TCP, not NETBIRD_SSH", i)
+	}
+}
+
+func TestEnvelopeToNetworkMap_NilEnvelope(t *testing.T) {
+	_, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), nil, "key", "netbird.cloud", false)
+	require.Error(t, err, "nil envelope must produce an error rather than panic")
+}
+
+func TestEnvelopeToNetworkMap_FullPayloadMissing(t *testing.T) {
+	env := &proto.NetworkMapEnvelope{}
+	_, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), env, "key", "netbird.cloud", false)
+	require.Error(t, err, "envelope with no Full payload must produce an error")
+}
+
+// TestDecodeEnvelope_MalformedWgKeyPeerSkipped feeds an envelope where one
+// peer has a wg_pub_key that is not 32 bytes long. The decoder must skip
+// that peer (keeping the rest of the snapshot usable) instead of aborting
+// the whole sync — mirrors legacy behaviour that tolerates an occasional
+// bad row.
+func TestDecodeEnvelope_MalformedWgKeyPeerSkipped(t *testing.T) {
+	c, localPeerKey := buildSmokeComponents(t)
+	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+		Components: c,
+		DNSDomain:  "netbird.cloud",
+	})
+	require.NotNil(t, envelope.GetFull())
+
+	full := envelope.GetFull()
+	require.Len(t, full.Peers, 2, "smoke fixture should have two peers")
+
+	// Truncate the second peer's wg_pub_key so it fails the length gate.
+	for _, p := range full.Peers {
+		if base64.StdEncoding.EncodeToString(p.WgPubKey) != localPeerKey {
+			p.WgPubKey = p.WgPubKey[:31]
+		}
+	}
+
+	wire, err := goproto.Marshal(envelope)
+	require.NoError(t, err, "marshal envelope")
+	var decoded proto.NetworkMapEnvelope
+	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
+
+	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud", false)
+	require.NoError(t, err, "EnvelopeToNetworkMap must tolerate one bad peer key")
+	require.NotNil(t, result)
+	require.NotNil(t, result.Components)
+	require.Len(t, result.Components.Peers, 1, "the well-formed peer survives, the malformed one is dropped")
+}
+
+// TestEnvelopeRoundTrip_AllGroupShortCircuitParity reproduces prod accounts
+// with several groups literally named "All" where the "All"-named group does
+// not contain every peer. Server-side Calculate short-circuits destination
+// expansion at the first group named "All" (getUniquePeerIDsFromGroupsIDs),
+// ignoring the remaining destination groups. The wire must preserve enough
+// group identity for the decoded components to short-circuit identically —
+// otherwise the client unions all destination groups and emits extra
+// firewall rules the server never produced.
+func TestEnvelopeRoundTrip_AllGroupShortCircuitParity(t *testing.T) {
+	ctx := context.Background()
+
+	peers := map[string]*nmdata.Peer{}
+	for i, id := range []string{"peer-T", "peer-S", "peer-ALL", "peer-O"} {
+		peers[id] = &nmdata.Peer{
+			ID:       id,
+			Key:      randomWgKey(t),
+			IP:       netip.AddrFrom4([4]byte{100, 64, 0, byte(i + 1)}),
+			DNSLabel: id,
+			Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+		}
+	}
+
+	c := &types.NetworkMapComponents{
+		PeerID: "peer-T",
+		Network: &nmdata.Network{
+			Identifier: "net-all-groups",
+			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
+			Serial:     1,
+		},
+		AccountSettings: &nmdata.AccountSettingsInfo{},
+		DNSSettings:     &nmdata.DNSSettings{},
+		Peers:           peers,
+		Groups: map[string]*nmdata.Group{
+			"g-src": {PublicID: "1", Name: "staff", Peers: []string{"peer-T", "peer-S"}},
+			"g-all": {PublicID: "2", Name: "All", Peers: []string{"peer-ALL"}},
+			"g-two": {PublicID: "3", Name: "second", Peers: []string{"peer-T", "peer-O"}},
+		},
+		Policies: []*nmdata.Policy{{
+			ID: "pol-multi-dest", PublicID: "10", Enabled: true,
+			Rules: []*nmdata.PolicyRule{{
+				ID:           "rule-multi-dest",
+				Enabled:      true,
+				Action:       string(types.PolicyTrafficActionAccept),
+				Protocol:     string(types.PolicyRuleProtocolALL),
+				Sources:      []string{"g-src"},
+				Destinations: []string{"g-all", "g-two"},
+			}},
+		}},
+	}
+
+	serverNM := c.Calculate(ctx)
+	require.NotNil(t, serverNM)
+
+	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+		Components: c,
+		DNSDomain:  "netbird.cloud",
+	})
+	wire, err := goproto.Marshal(envelope)
+	require.NoError(t, err, "marshal envelope")
+	var decodedEnv proto.NetworkMapEnvelope
+	require.NoError(t, goproto.Unmarshal(wire, &decodedEnv), "unmarshal envelope")
+
+	result, err := nbnetworkmap.EnvelopeToNetworkMap(ctx, &decodedEnv, peers["peer-T"].Key, "netbird.cloud", false)
+	require.NoError(t, err, "EnvelopeToNetworkMap")
+	clientNM := result.NetworkMap
+
+	serverRules := make([]string, 0, len(serverNM.FirewallRules))
+	for _, r := range serverNM.FirewallRules {
+		serverRules = append(serverRules, fmt.Sprintf("%s/%d", r.PeerIP, r.Direction))
+	}
+	clientRules := make([]string, 0, len(clientNM.FirewallRules))
+	for _, r := range clientNM.FirewallRules {
+		clientRules = append(clientRules, fmt.Sprintf("%s/%d", r.PeerIP, r.Direction)) // nolint:staticcheck
+	}
+	require.ElementsMatch(t, serverRules, clientRules,
+		"client-side Calculate must expand destination groups exactly like the server")
+
+	serverPeers := make([]string, 0, len(serverNM.Peers))
+	for _, p := range serverNM.Peers {
+		serverPeers = append(serverPeers, p.Key)
+	}
+	clientPeers := make([]string, 0, len(clientNM.RemotePeers))
+	for _, p := range clientNM.RemotePeers {
+		clientPeers = append(clientPeers, p.WgPubKey)
+	}
+	require.ElementsMatch(t, serverPeers, clientPeers,
+		"client-side Calculate must connect the same remote peers as the server")
+}
+
+// TestEnvelopeToNetworkMap_EmptyComponents covers the graceful-degrade path
+// the server takes for a peer that is missing from the account or absent from
+// the validated-peers map. The legacy server short-circuited before
+// Calculate() and shipped a NetworkMap carrying only the account Network; the
+// components path runs Calculate() on the client instead, so the envelope must
+// carry Network or the client panics dereferencing a nil *types.Network.
+func TestEnvelopeToNetworkMap_EmptyComponents(t *testing.T) {
+	localPeerKey := randomWgKey(t)
+	c := types.EmptyNetworkMapComponents(&types.NetworkMapComponents{
+		PeerID: "peer-A",
+		Network: &nmdata.Network{
+			Identifier: "net-empty",
+			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
+			Serial:     7,
+		},
+		Peers: map[string]*nmdata.Peer{
+			"peer-A": {ID: "peer-A", Key: localPeerKey, IP: netip.AddrFrom4([4]byte{100, 64, 0, 1})},
+		},
+	})
+
+	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+		Components: c,
+		DNSDomain:  "netbird.cloud",
+	})
+	require.NotNil(t, envelope.GetFull().Network, "empty envelope must carry the account Network")
+
+	wire, err := goproto.Marshal(envelope)
+	require.NoError(t, err, "marshal envelope")
+	var decoded proto.NetworkMapEnvelope
+	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
+
+	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud", false)
+	require.NoError(t, err, "EnvelopeToNetworkMap must degrade gracefully on empty components")
+	require.Equal(t, uint64(7), result.NetworkMap.Serial)
+	require.Empty(t, result.NetworkMap.RemotePeers, "unvalidated peer connects to nobody")
+}
+
+// TestEnvelopeToNetworkMap_MissingNetwork simulates a server that omits
+// AccountNetwork from the envelope. Clients must degrade rather than panic, so
+// they survive talking to a management server that predates the encoder fix.
+func TestEnvelopeToNetworkMap_MissingNetwork(t *testing.T) {
+	c, localPeerKey := buildSmokeComponents(t)
+
+	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+		Components: c,
+		DNSDomain:  "netbird.cloud",
+	})
+	envelope.GetFull().Network = nil
+
+	wire, err := goproto.Marshal(envelope)
+	require.NoError(t, err, "marshal envelope")
+	var decoded proto.NetworkMapEnvelope
+	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
+
+	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud", false)
+	require.NoError(t, err, "a missing AccountNetwork must not panic the client")
+	require.NotNil(t, result.Components.Network)
+	require.NotEmpty(t, result.NetworkMap.RemotePeers, "the rest of the snapshot stays usable")
+}
+
+// buildSmokeComponents returns a minimal NetworkMapComponents (2 peers, 1
+// group, 1 allow policy) plus the receiving peer's WG public key. Sufficient
+// to validate the encode → marshal → decode → Calculate pipeline produces
+// non-empty output.
+func buildSmokeComponents(t *testing.T) (*types.NetworkMapComponents, string) {
+	t.Helper()
+
+	peerAKey := randomWgKey(t)
+	peerBKey := randomWgKey(t)
+
+	peerA := &nmdata.Peer{
+		ID:       "peer-A",
+		Key:      peerAKey,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 1}),
+		DNSLabel: "peerA",
+		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	}
+	peerB := &nmdata.Peer{
+		ID:       "peer-B",
+		Key:      peerBKey,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 2}),
+		DNSLabel: "peerB",
+		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	}
+
+	group := &nmdata.Group{
+		PublicID: "1", Name: "All",
+		Peers: []string{"peer-A", "peer-B"},
+	}
+
+	policy := &nmdata.Policy{
+		ID: "pol-allow", PublicID: "1", Enabled: true,
+		Rules: []*nmdata.PolicyRule{{
+			ID:            "rule-allow",
+			Enabled:       true,
+			Action:        string(types.PolicyTrafficActionAccept),
+			Protocol:      string(types.PolicyRuleProtocolALL),
+			Bidirectional: true,
+			Sources:       []string{"group-all"},
+			Destinations:  []string{"group-all"},
+		}},
+	}
+
+	c := &types.NetworkMapComponents{
+		PeerID: "peer-A",
+		Network: &nmdata.Network{
+			Identifier: "net-smoke",
+			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
+			Serial:     1,
+		},
+		AccountSettings: &nmdata.AccountSettingsInfo{},
+		DNSSettings:     &nmdata.DNSSettings{},
+		Peers: map[string]*nmdata.Peer{
+			"peer-A": peerA,
+			"peer-B": peerB,
+		},
+		Groups: map[string]*nmdata.Group{
+			"group-all": group,
+		},
+		Policies: []*nmdata.Policy{policy},
+	}
+	return c, peerAKey
+}
+
+func randomWgKey(t *testing.T) string {
+	t.Helper()
+	var raw [32]byte
+	_, err := rand.Read(raw[:])
+	require.NoError(t, err)
+	return base64.StdEncoding.EncodeToString(raw[:])
+}
+
+// TestEnvelopeToNetworkMap_SkipRouteFirewallRules covers the flag end to end,
+// through the envelope rather than by poking Calculate directly. The
+// RoutesFirewallRulesIsEmpty derivation is the part that matters: the client's
+// legacy-management probe reads an empty rule list together with that bit, so
+// skipping the rules must set it rather than leave it false.
+func TestEnvelopeToNetworkMap_SkipRouteFirewallRules(t *testing.T) {
+	ctx := context.Background()
+	c, routerKey := buildRoutedResourceComponents(t)
+
+	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+		Components: c,
+		DNSDomain:  "netbird.cloud",
+	})
+	wire, err := goproto.Marshal(envelope)
+	require.NoError(t, err, "marshal envelope")
+	var decoded proto.NetworkMapEnvelope
+	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
+
+	full, err := nbnetworkmap.EnvelopeToNetworkMap(ctx, &decoded, routerKey, "netbird.cloud", false)
+	require.NoError(t, err, "EnvelopeToNetworkMap without skip")
+	require.NotEmpty(t, full.NetworkMap.RoutesFirewallRules,
+		"baseline: the router peer must receive route firewall rules")
+	require.False(t, full.NetworkMap.RoutesFirewallRulesIsEmpty,
+		"baseline: the empty bit must be false when rules are present")
+
+	var decodedSkip proto.NetworkMapEnvelope
+	require.NoError(t, goproto.Unmarshal(wire, &decodedSkip), "unmarshal envelope")
+	skipped, err := nbnetworkmap.EnvelopeToNetworkMap(ctx, &decodedSkip, routerKey, "netbird.cloud", true)
+	require.NoError(t, err, "EnvelopeToNetworkMap with skip")
+
+	assert.Empty(t, skipped.NetworkMap.RoutesFirewallRules,
+		"route firewall rules must not be computed when skipped")
+	assert.True(t, skipped.NetworkMap.RoutesFirewallRulesIsEmpty,
+		"the empty bit must be derived from the skipped list, or the client misreads it as legacy management")
+	assert.Len(t, skipped.NetworkMap.Routes, len(full.NetworkMap.Routes),
+		"skipping route firewall rules must not change the routes")
+	assert.Len(t, skipped.NetworkMap.RemotePeers, len(full.NetworkMap.RemotePeers),
+		"skipping route firewall rules must not change the remote peers")
+}
+
+// buildRoutedResourceComponents returns components in which the local peer is
+// the routing peer for one enabled network resource, reachable by a second
+// peer through a resource policy — the minimum shape that yields a non-empty
+// RoutesFirewallRules. It also returns the local peer's WG key.
+func buildRoutedResourceComponents(t *testing.T) (*types.NetworkMapComponents, string) {
+	t.Helper()
+
+	routerKey := randomWgKey(t)
+	peers := map[string]*nmdata.Peer{
+		"peer-R": {
+			ID: "peer-R", Key: routerKey, DNSLabel: "router",
+			IP:   netip.AddrFrom4([4]byte{100, 64, 0, 1}),
+			Meta: nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+		},
+		"peer-S": {
+			ID: "peer-S", Key: randomWgKey(t), DNSLabel: "source",
+			IP:   netip.AddrFrom4([4]byte{100, 64, 0, 2}),
+			Meta: nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+		},
+	}
+
+	resourcePolicy := &nmdata.Policy{
+		ID: "pol-res", PublicID: "10", Enabled: true,
+		Rules: []*nmdata.PolicyRule{{
+			ID:       "rule-res",
+			Enabled:  true,
+			Action:   string(types.PolicyTrafficActionAccept),
+			Protocol: string(types.PolicyRuleProtocolALL),
+			Sources:  []string{"g-src"},
+		}},
+	}
+
+	c := &types.NetworkMapComponents{
+		PeerID: "peer-R",
+		Network: &nmdata.Network{
+			Identifier: "net-routed-resource",
+			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
+			Serial:     1,
+		},
+		AccountSettings: &nmdata.AccountSettingsInfo{},
+		DNSSettings:     &nmdata.DNSSettings{},
+		Peers:           peers,
+		Groups: map[string]*nmdata.Group{
+			"g-src":     {PublicID: "1", Name: "sources", Peers: []string{"peer-S"}},
+			"g-routers": {PublicID: "2", Name: "routers", Peers: []string{"peer-R"}},
+		},
+		NetworkResources: []*nmdata.NetworkResource{{
+			ID: "res-1", NetworkID: "netid-1", PublicID: "100", Name: "res1",
+			Type:    "subnet",
+			Prefix:  netip.MustParsePrefix("10.200.0.0/24"),
+			Enabled: true,
+		}},
+		RoutersMap: map[string]map[string]*nmdata.NetworkRouter{
+			"netid-1": {"peer-R": {
+				PublicID: "200", PeerGroups: []string{"g-routers"}, Metric: 9999, Enabled: true,
+			}},
+		},
+		ResourcePoliciesMap: map[string][]*nmdata.Policy{
+			"res-1": {resourcePolicy},
+		},
+		Policies:             []*nmdata.Policy{resourcePolicy},
+		NetworkXIDToPublicID: map[string]string{"netid-1": "1"},
+	}
+
+	return c, routerKey
+}
diff --git a/shared/management/networkmap/networkmapcompute.go b/shared/management/networkmap/networkmapcompute.go
new file mode 100644
index 000000000..65e76d097
--- /dev/null
+++ b/shared/management/networkmap/networkmapcompute.go
@@ -0,0 +1,815 @@
+package networkmap
+
+import (
+	"slices"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/types"
+)
+
+type sshRequirements struct {
+	neededGroupIDs     map[string]struct{}
+	needAllowedUserIDs bool
+}
+
+// GetPeerNetworkMapComponents computes the peer's NetworkMapComponents from the
+// slim twin store. It mirrors the former Account.GetPeerNetworkMapComponents
+// exactly, operating on nmdata twins throughout — no Account reference and no
+// twin↔real conversion, since the produced components hold twins.
+func (nmd *NetworkMapData) GetPeerNetworkMapComponents(peerID string, peersCustomZone nmdata.CustomZone) *types.NetworkMapComponents {
+	nmd.InjectProxyPolicies()
+
+	forceRoutingPeerDNS := nmd.forcesRoutingPeerDNSResolution(peerID)
+
+	peer := nmd.Peers[peerID]
+	if peer == nil {
+		return types.EmptyNetworkMapComponents(&types.NetworkMapComponents{
+			PeerID:                        peerID,
+			Network:                       nmd.Network,
+			Peers:                         map[string]*nmdata.Peer{peerID: peer},
+			ForceRoutingPeerDNSResolution: forceRoutingPeerDNS,
+		})
+	}
+
+	if _, ok := nmd.ValidatedPeers[peerID]; !ok {
+		return types.EmptyNetworkMapComponents(&types.NetworkMapComponents{
+			PeerID:                        peerID,
+			Network:                       nmd.Network,
+			Peers:                         map[string]*nmdata.Peer{peerID: peer},
+			ForceRoutingPeerDNSResolution: forceRoutingPeerDNS,
+		})
+	}
+
+	components := &types.NetworkMapComponents{
+		PeerID:                        peerID,
+		Network:                       nmd.Network,
+		AccountSettings:               nmd.AccountSettings,
+		DNSSettings:                   nmd.DNSSettings,
+		CustomZoneDomain:              peersCustomZone.Domain,
+		NameServerGroups:              make([]*nmdata.NameServerGroup, 0),
+		ResourcePoliciesMap:           make(map[string][]*nmdata.Policy),
+		RoutersMap:                    make(map[string]map[string]*nmdata.NetworkRouter),
+		NetworkResources:              make([]*nmdata.NetworkResource, 0),
+		PostureFailedPeers:            make(map[string]map[string]struct{}, len(nmd.PostureChecks)),
+		RouterPeers:                   make(map[string]*nmdata.Peer),
+		NetworkXIDToPublicID:          nmd.NetworkXIDToPublicID,
+		PostureCheckXIDToPublicID:     nmd.PostureCheckXIDToPublicID,
+		ForceRoutingPeerDNSResolution: forceRoutingPeerDNS,
+	}
+
+	relevantPeers, relevantGroups, relevantPolicies, relevantRoutes, sshReqs := nmd.getPeersGroupsPoliciesRoutes(peerID, peer.SSHEnabled, &components.PostureFailedPeers)
+
+	if len(sshReqs.neededGroupIDs) > 0 {
+		components.GroupIDToUserIDs = filterGroupIDToUserIDs(nmd.GroupIDToUserIDs, sshReqs.neededGroupIDs)
+	}
+	if sshReqs.needAllowedUserIDs {
+		components.AllowedUserIDs = nmd.getAllowedUserIDs()
+	}
+
+	components.Peers = relevantPeers
+	components.Groups = relevantGroups
+	components.Policies = relevantPolicies
+	components.Routes = relevantRoutes
+	components.AllDNSRecords = filterDNSRecordsByPeers(peersCustomZone.Records, relevantPeers, peer.SupportsIPv6() && peer.IPv6.IsValid())
+
+	peerGroups := nmd.GetPeerGroups(peerID)
+	components.AccountZones = nmd.appliedZones(peerGroups)
+	components.AccountZones = append(components.AccountZones, nmd.privateServiceZones(peerGroups)...)
+
+	for _, nsGroup := range nmd.NameServerGroups {
+		if nsGroup != nil && nsGroup.Enabled {
+			for _, gID := range nsGroup.Groups {
+				if _, found := relevantGroups[gID]; found {
+					components.NameServerGroups = append(components.NameServerGroups, nsGroup)
+					break
+				}
+			}
+		}
+	}
+
+	for _, resource := range nmd.NetworkResources {
+		if resource == nil || !resource.Enabled {
+			continue
+		}
+
+		policies, exists := nmd.ResourcePolicies[resource.ID]
+		if !exists {
+			continue
+		}
+
+		addSourcePeers := false
+
+		networkRoutingPeers, routerExists := nmd.Routers[resource.NetworkID]
+		if routerExists {
+			if _, ok := networkRoutingPeers[peerID]; ok {
+				addSourcePeers = true
+			}
+		}
+
+		for _, policy := range policies {
+			if policy == nil || !policy.Enabled || len(policy.Rules) == 0 || policy.Rules[0] == nil {
+				continue
+			}
+			if addSourcePeers {
+				var peers []string
+				if policy.Rules[0].SourceResource.Type == string(types.ResourceTypePeer) && policy.Rules[0].SourceResource.ID != "" {
+					peers = []string{policy.Rules[0].SourceResource.ID}
+				} else {
+					peers = nmd.getUniquePeerIDsFromGroupsIDs(policy.SourceGroups())
+				}
+				for _, pID := range nmd.getPostureValidPeersSaveFailed(peers, policy.SourcePostureChecks, &components.PostureFailedPeers) {
+					if _, exists := components.Peers[pID]; !exists {
+						components.Peers[pID] = nmd.Peers[pID]
+					}
+				}
+			} else {
+				peerInSources := false
+				if policy.Rules[0].SourceResource.Type == string(types.ResourceTypePeer) && policy.Rules[0].SourceResource.ID != "" {
+					peerInSources = policy.Rules[0].SourceResource.ID == peerID
+				} else {
+					for _, groupID := range policy.SourceGroups() {
+						if group := nmd.Groups[groupID]; group != nil && slices.Contains(group.Peers, peerID) {
+							peerInSources = true
+							break
+						}
+					}
+				}
+				if !peerInSources {
+					continue
+				}
+				isValid, pname := nmd.validatePostureChecksOnPeerGetFailed(policy.SourcePostureChecks, peerID)
+				if !isValid && len(pname) > 0 {
+					if _, ok := components.PostureFailedPeers[pname]; !ok {
+						components.PostureFailedPeers[pname] = make(map[string]struct{})
+					}
+					components.PostureFailedPeers[pname][peer.ID] = struct{}{}
+					continue
+				}
+				addSourcePeers = true
+			}
+
+			for _, rule := range policy.Rules {
+				if rule == nil || !rule.Enabled {
+					continue
+				}
+				for _, srcGroupID := range rule.Sources {
+					if g := nmd.Groups[srcGroupID]; g != nil {
+						if _, exists := components.Groups[srcGroupID]; !exists {
+							components.Groups[srcGroupID] = g
+						}
+					}
+				}
+				for _, dstGroupID := range rule.Destinations {
+					if g := nmd.Groups[dstGroupID]; g != nil {
+						if _, exists := components.Groups[dstGroupID]; !exists {
+							components.Groups[dstGroupID] = g
+						}
+					}
+				}
+			}
+			components.ResourcePoliciesMap[resource.ID] = policies
+		}
+
+		if addSourcePeers {
+			components.RoutersMap[resource.NetworkID] = networkRoutingPeers
+			for peerIDKey := range networkRoutingPeers {
+				p := nmd.Peers[peerIDKey]
+				if p == nil {
+					continue
+				}
+				// An unapproved peer must not carry traffic, so it is kept out of
+				// RouterPeers as well: the envelope encoder indexes that map into
+				// the wire peer table, from which the client restores every entry.
+				if _, validated := nmd.ValidatedPeers[peerIDKey]; !validated {
+					continue
+				}
+				if _, exists := components.RouterPeers[peerIDKey]; !exists {
+					components.RouterPeers[peerIDKey] = p
+				}
+				if _, exists := components.Peers[peerIDKey]; !exists {
+					components.Peers[peerIDKey] = p
+				}
+			}
+			components.NetworkResources = append(components.NetworkResources, resource)
+		}
+	}
+
+	filterGroupPeers(&components.Groups, components.Peers)
+	filterPostureFailedPeers(&components.PostureFailedPeers, components.Policies, components.ResourcePoliciesMap, components.Peers)
+
+	return components
+}
+
+func (nmd *NetworkMapData) getPeersGroupsPoliciesRoutes(
+	peerID string,
+	peerSSHEnabled bool,
+	postureFailedPeers *map[string]map[string]struct{},
+) (map[string]*nmdata.Peer, map[string]*nmdata.Group, []*nmdata.Policy, []*nmdata.Route, sshRequirements) {
+	relevantPeerIDs := make(map[string]*nmdata.Peer, len(nmd.Peers)/4)
+	relevantGroupIDs := make(map[string]*nmdata.Group, len(nmd.Groups)/4)
+	relevantPolicies := make([]*nmdata.Policy, 0, len(nmd.Policies))
+	relevantRoutes := make([]*nmdata.Route, 0, len(nmd.Routes))
+	sshReqs := sshRequirements{neededGroupIDs: make(map[string]struct{})}
+
+	relevantPeerIDs[peerID] = nmd.Peers[peerID]
+
+	peerGroupSet := nmd.GetPeerGroups(peerID)
+	for groupID := range peerGroupSet {
+		relevantGroupIDs[groupID] = nmd.Groups[groupID]
+	}
+
+	routeAccessControlGroups := make(map[string]struct{})
+	for _, r := range nmd.Routes {
+		if r == nil {
+			continue
+		}
+		relevant := r.Peer == peerID
+		if !relevant {
+			for _, groupID := range r.PeerGroups {
+				if _, ok := peerGroupSet[groupID]; ok {
+					relevant = true
+					break
+				}
+			}
+		}
+		if !relevant && r.Enabled {
+			for _, groupID := range r.Groups {
+				if _, ok := peerGroupSet[groupID]; ok {
+					relevant = true
+					break
+				}
+			}
+		}
+		if !relevant {
+			continue
+		}
+
+		for _, groupID := range r.PeerGroups {
+			if g := nmd.Groups[groupID]; g != nil {
+				relevantGroupIDs[groupID] = g
+			}
+		}
+		for _, groupID := range r.Groups {
+			if g := nmd.Groups[groupID]; g != nil {
+				relevantGroupIDs[groupID] = g
+			}
+		}
+		if r.Enabled {
+			for _, groupID := range r.AccessControlGroups {
+				if g := nmd.Groups[groupID]; g != nil {
+					relevantGroupIDs[groupID] = g
+				}
+				routeAccessControlGroups[groupID] = struct{}{}
+			}
+		}
+
+		if r.Peer != "" {
+			if _, ok := nmd.ValidatedPeers[r.Peer]; ok {
+				if p := nmd.Peers[r.Peer]; p != nil {
+					relevantPeerIDs[r.Peer] = p
+				}
+			}
+		}
+		for _, groupID := range r.PeerGroups {
+			g := nmd.Groups[groupID]
+			if g == nil {
+				continue
+			}
+			for _, pid := range g.Peers {
+				if _, exists := relevantPeerIDs[pid]; exists {
+					continue
+				}
+				if _, ok := nmd.ValidatedPeers[pid]; !ok {
+					continue
+				}
+				if p := nmd.Peers[pid]; p != nil {
+					relevantPeerIDs[pid] = p
+				}
+			}
+		}
+		relevantRoutes = append(relevantRoutes, r)
+	}
+
+	for _, policy := range nmd.Policies {
+		if policy == nil || !policy.Enabled {
+			continue
+		}
+
+		policyRelevant := false
+		for _, rule := range policy.Rules {
+			if rule == nil || !rule.Enabled {
+				continue
+			}
+
+			if len(routeAccessControlGroups) > 0 {
+				for _, destGroupID := range rule.Destinations {
+					if _, needed := routeAccessControlGroups[destGroupID]; needed {
+						policyRelevant = true
+						for _, srcGroupID := range rule.Sources {
+							if g := nmd.Groups[srcGroupID]; g != nil {
+								relevantGroupIDs[srcGroupID] = g
+							}
+						}
+						for _, dstGroupID := range rule.Destinations {
+							if g := nmd.Groups[dstGroupID]; g != nil {
+								relevantGroupIDs[dstGroupID] = g
+							}
+						}
+						break
+					}
+				}
+			}
+
+			var sourcePeers, destinationPeers []string
+			var peerInSources, peerInDestinations bool
+
+			if rule.SourceResource.Type == string(types.ResourceTypePeer) && rule.SourceResource.ID != "" {
+				sourcePeers, peerInSources = nmd.getPeerFromResource(rule.SourceResource, peerID, policy.SourcePostureChecks, postureFailedPeers)
+			} else {
+				sourcePeers, peerInSources = nmd.getPeersFromGroups(rule.Sources, peerID, policy.SourcePostureChecks, postureFailedPeers)
+			}
+
+			if rule.DestinationResource.Type == string(types.ResourceTypePeer) && rule.DestinationResource.ID != "" {
+				destinationPeers, peerInDestinations = nmd.getPeerFromResource(rule.DestinationResource, peerID, nil, postureFailedPeers)
+			} else {
+				destinationPeers, peerInDestinations = nmd.getPeersFromGroups(rule.Destinations, peerID, nil, postureFailedPeers)
+			}
+
+			if peerInSources {
+				policyRelevant = true
+				for _, pid := range destinationPeers {
+					relevantPeerIDs[pid] = nmd.Peers[pid]
+				}
+				for _, dstGroupID := range rule.Destinations {
+					if g := nmd.Groups[dstGroupID]; g != nil {
+						relevantGroupIDs[dstGroupID] = g
+					}
+				}
+			}
+
+			if peerInDestinations {
+				policyRelevant = true
+				for _, pid := range sourcePeers {
+					relevantPeerIDs[pid] = nmd.Peers[pid]
+				}
+				for _, srcGroupID := range rule.Sources {
+					if g := nmd.Groups[srcGroupID]; g != nil {
+						relevantGroupIDs[srcGroupID] = g
+					}
+				}
+
+				if rule.Protocol == string(types.PolicyRuleProtocolNetbirdSSH) {
+					switch {
+					case len(rule.AuthorizedGroups) > 0:
+						for groupID := range rule.AuthorizedGroups {
+							sshReqs.neededGroupIDs[groupID] = struct{}{}
+						}
+					case rule.AuthorizedUser != "":
+					default:
+						sshReqs.needAllowedUserIDs = true
+					}
+				} else if nmdata.PolicyRuleImpliesLegacySSH(rule) && peerSSHEnabled {
+					sshReqs.needAllowedUserIDs = true
+				}
+			}
+		}
+		if policyRelevant {
+			relevantPolicies = append(relevantPolicies, policy)
+		}
+	}
+
+	return relevantPeerIDs, relevantGroupIDs, relevantPolicies, relevantRoutes, sshReqs
+}
+
+func (nmd *NetworkMapData) getPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string,
+	postureFailedPeers *map[string]map[string]struct{}) ([]string, bool) {
+	peerInGroups := false
+	filteredPeerIDs := make([]string, 0, len(groups))
+	seenPeerIds := make(map[string]struct{}, len(groups))
+
+	for _, gid := range groups {
+		group := nmd.Groups[gid]
+		if group == nil {
+			continue
+		}
+
+		if group.IsGroupAll() || len(groups) == 1 {
+			filteredPeerIDs = make([]string, 0, len(group.Peers))
+			peerInGroups = false
+			for _, pid := range group.Peers {
+				if !nmd.admitPolicyPeer(pid, sourcePostureChecksIDs, postureFailedPeers) {
+					continue
+				}
+
+				if pid == peerID {
+					peerInGroups = true
+					continue
+				}
+
+				filteredPeerIDs = append(filteredPeerIDs, pid)
+			}
+			return filteredPeerIDs, peerInGroups
+		}
+
+		for _, pid := range group.Peers {
+			if _, seen := seenPeerIds[pid]; seen {
+				continue
+			}
+			seenPeerIds[pid] = struct{}{}
+			if !nmd.admitPolicyPeer(pid, sourcePostureChecksIDs, postureFailedPeers) {
+				continue
+			}
+
+			if pid == peerID {
+				peerInGroups = true
+				continue
+			}
+
+			filteredPeerIDs = append(filteredPeerIDs, pid)
+		}
+	}
+
+	return filteredPeerIDs, peerInGroups
+}
+
+// getPeerFromResource resolves a rule side that names a peer directly, admitting it
+// like a member of a group holding only that peer.
+func (nmd *NetworkMapData) getPeerFromResource(resource nmdata.Resource, peerID string, sourcePostureChecksIDs []string,
+	postureFailedPeers *map[string]map[string]struct{}) ([]string, bool) {
+	if !nmd.admitPolicyPeer(resource.ID, sourcePostureChecksIDs, postureFailedPeers) {
+		return nil, false
+	}
+	if resource.ID == peerID {
+		return nil, true
+	}
+	return []string{resource.ID}, false
+}
+
+// admitPolicyPeer applies the per-peer admission of a rule side: the peer must exist,
+// be validated and pass the rule's posture checks. A failed check is recorded in
+// postureFailedPeers.
+func (nmd *NetworkMapData) admitPolicyPeer(pid string, sourcePostureChecksIDs []string, postureFailedPeers *map[string]map[string]struct{}) bool {
+	peer, ok := nmd.Peers[pid]
+	if !ok || peer == nil {
+		return false
+	}
+
+	if _, ok := nmd.ValidatedPeers[pid]; !ok {
+		return false
+	}
+
+	isValid, pname := nmd.validatePostureChecksOnPeerGetFailed(sourcePostureChecksIDs, pid)
+	if !isValid && len(pname) > 0 {
+		if _, ok := (*postureFailedPeers)[pname]; !ok {
+			(*postureFailedPeers)[pname] = make(map[string]struct{})
+		}
+		(*postureFailedPeers)[pname][pid] = struct{}{}
+		return false
+	}
+	return true
+}
+
+func (nmd *NetworkMapData) validatePostureChecksOnPeerGetFailed(sourcePostureChecksID []string, peerID string) (bool, string) {
+	peer, ok := nmd.Peers[peerID]
+	if !ok || peer == nil {
+		return false, ""
+	}
+
+	for _, postureChecksID := range sourcePostureChecksID {
+		if valid, cached := nmd.cachedPostureCheckResult(postureChecksID, peerID); cached {
+			if !valid {
+				return false, postureChecksID
+			}
+			continue
+		}
+
+		postureChecks := nmd.PostureChecks[postureChecksID]
+		if postureChecks == nil {
+			continue
+		}
+		if !postureChecks.Passes(peer) {
+			return false, postureChecksID
+		}
+	}
+	return true, ""
+}
+
+func (nmd *NetworkMapData) PrecomputePostureValidation() {
+	if len(nmd.PostureChecks) == 0 {
+		nmd.PostureValidation = nil
+		return
+	}
+
+	checkPeerIDs := make(map[string]map[string]struct{})
+	for _, policy := range nmd.Policies {
+		if policy == nil || !policy.Enabled || len(policy.SourcePostureChecks) == 0 {
+			continue
+		}
+
+		groupPeerIDs := nmd.getUniquePeerIDsFromGroupsIDs(policy.SourceGroups())
+		for _, postureChecksID := range policy.SourcePostureChecks {
+			set := checkPeerIDs[postureChecksID]
+			if set == nil {
+				set = make(map[string]struct{}, len(groupPeerIDs))
+				checkPeerIDs[postureChecksID] = set
+			}
+			for _, pid := range groupPeerIDs {
+				set[pid] = struct{}{}
+			}
+			for _, rule := range policy.Rules {
+				if rule == nil {
+					continue
+				}
+				if rule.SourceResource.Type == string(types.ResourceTypePeer) && rule.SourceResource.ID != "" {
+					set[rule.SourceResource.ID] = struct{}{}
+				}
+			}
+		}
+	}
+
+	results := make(map[string]map[string]bool, len(checkPeerIDs))
+	for postureChecksID, peerIDs := range checkPeerIDs {
+		results[postureChecksID] = nmd.evaluatePostureChecksForPeers(postureChecksID, peerIDs)
+	}
+	nmd.PostureValidation = results
+}
+
+func (nmd *NetworkMapData) evaluatePostureChecksForPeers(postureChecksID string, peerIDs map[string]struct{}) map[string]bool {
+	postureChecks := nmd.PostureChecks[postureChecksID]
+	if postureChecks == nil {
+		return nil
+	}
+
+	checks := postureChecks.GetChecks()
+	results := make(map[string]bool, len(peerIDs))
+	for peerID := range peerIDs {
+		peer := nmd.Peers[peerID]
+		if peer == nil {
+			continue
+		}
+		results[peerID] = nmdata.PassesChecks(checks, peer)
+	}
+	return results
+}
+
+func (nmd *NetworkMapData) cachedPostureCheckResult(postureChecksID, peerID string) (bool, bool) {
+	results, ok := nmd.PostureValidation[postureChecksID]
+	if !ok {
+		return false, false
+	}
+	if results == nil {
+		return true, true
+	}
+	valid, found := results[peerID]
+	return valid, found
+}
+
+func (nmd *NetworkMapData) getPostureValidPeersSaveFailed(inputPeers []string, postureChecksIDs []string, postureFailedPeers *map[string]map[string]struct{}) []string {
+	var dest []string
+	for _, peerID := range inputPeers {
+		if _, validated := nmd.ValidatedPeers[peerID]; !validated {
+			continue
+		}
+		valid, pname := nmd.validatePostureChecksOnPeerGetFailed(postureChecksIDs, peerID)
+		if valid {
+			dest = append(dest, peerID)
+			continue
+		}
+		if pname == "" {
+			continue
+		}
+		if _, ok := (*postureFailedPeers)[pname]; !ok {
+			(*postureFailedPeers)[pname] = make(map[string]struct{})
+		}
+		(*postureFailedPeers)[pname][peerID] = struct{}{}
+	}
+	return dest
+}
+
+// forcesRoutingPeerDNSResolution reports whether the given peer must run
+// routing-peer DNS resolution regardless of the account-global
+// RoutingPeerDNSResolutionEnabled setting: true when the peer routes a domain
+// network resource targeted by an enabled reverse-proxy service, so the peer's
+// DNS forwarder starts and can resolve the target for the embedded proxy peers.
+func (nmd *NetworkMapData) forcesRoutingPeerDNSResolution(peerID string) bool {
+	if len(nmd.ProxyTargetedDomainResourceIDs) == 0 {
+		return false
+	}
+
+	for _, resource := range nmd.NetworkResources {
+		if resource == nil || !resource.Enabled || resource.Type != string(types.ResourceTypeDomain) {
+			continue
+		}
+		if _, ok := nmd.ProxyTargetedDomainResourceIDs[resource.ID]; !ok {
+			continue
+		}
+		if _, isRouter := nmd.Routers[resource.NetworkID][peerID]; isRouter {
+			return true
+		}
+	}
+
+	return false
+}
+
+// GetPeerGroups returns the set of group IDs the peer belongs to. The
+// underlying peer→groups index is built once per NetworkMapData and the
+// returned set is shared — callers must not mutate it.
+func (nmd *NetworkMapData) GetPeerGroups(peerID string) map[string]struct{} {
+	nmd.peerGroupsOnce.Do(func() {
+		idx := make(map[string]map[string]struct{}, len(nmd.Peers))
+		for groupID, group := range nmd.Groups {
+			if group == nil {
+				continue
+			}
+			for _, pid := range group.Peers {
+				set, ok := idx[pid]
+				if !ok {
+					set = make(map[string]struct{})
+					idx[pid] = set
+				}
+				set[groupID] = struct{}{}
+			}
+		}
+		nmd.peerGroupsIdx = idx
+	})
+
+	if set, ok := nmd.peerGroupsIdx[peerID]; ok {
+		return set
+	}
+	return map[string]struct{}{}
+}
+
+func (nmd *NetworkMapData) getUniquePeerIDsFromGroupsIDs(groups []string) []string {
+	peerIDs := make(map[string]struct{}, len(groups))
+	for _, groupID := range groups {
+		group := nmd.Groups[groupID]
+		if group == nil {
+			continue
+		}
+
+		if group.IsGroupAll() || len(groups) == 1 {
+			return group.Peers
+		}
+
+		for _, peerID := range group.Peers {
+			peerIDs[peerID] = struct{}{}
+		}
+	}
+
+	ids := make([]string, 0, len(peerIDs))
+	for peerID := range peerIDs {
+		ids = append(ids, peerID)
+	}
+
+	return ids
+}
+
+func (nmd *NetworkMapData) getAllowedUserIDs() map[string]struct{} {
+	return nmd.AllowedUserIDs
+}
+
+func (nmd *NetworkMapData) appliedZones(peerGroups map[string]struct{}) []nmdata.CustomZone {
+	if len(peerGroups) == 0 {
+		return nil
+	}
+	var out []nmdata.CustomZone
+	for _, cand := range nmd.AppliedZoneCandidates {
+		if peerInDistributionGroups(peerGroups, cand.DistributionGroups) {
+			out = append(out, cand.Zone)
+		}
+	}
+	return out
+}
+
+func (nmd *NetworkMapData) privateServiceZones(peerGroups map[string]struct{}) []nmdata.CustomZone {
+	byApex := make(map[string]*nmdata.CustomZone)
+	var order []string
+	for _, cand := range nmd.PrivateServiceCandidates {
+		if !peerInDistributionGroups(peerGroups, cand.AccessGroups) {
+			continue
+		}
+		zone, exists := byApex[cand.Zone.Domain]
+		if !exists {
+			nz := nmdata.CustomZone{
+				Domain:               cand.Zone.Domain,
+				SearchDomainDisabled: cand.Zone.SearchDomainDisabled,
+				NonAuthoritative:     cand.Zone.NonAuthoritative,
+			}
+			byApex[cand.Zone.Domain] = &nz
+			zone = &nz
+			order = append(order, cand.Zone.Domain)
+		}
+		zone.Records = append(zone.Records, cand.Zone.Records...)
+	}
+
+	var out []nmdata.CustomZone
+	for _, apex := range order {
+		zone := byApex[apex]
+		if len(zone.Records) == 0 {
+			continue
+		}
+		out = append(out, *zone)
+	}
+	return out
+}
+
+func peerInDistributionGroups(peerGroups map[string]struct{}, groups []string) bool {
+	for _, g := range groups {
+		if _, ok := peerGroups[g]; ok {
+			return true
+		}
+	}
+	return false
+}
+
+func filterGroupPeers(groups *map[string]*nmdata.Group, peers map[string]*nmdata.Peer) {
+	for groupID, groupInfo := range *groups {
+		filteredPeers := make([]string, 0, len(groupInfo.Peers))
+		for _, pid := range groupInfo.Peers {
+			if _, exists := peers[pid]; exists {
+				filteredPeers = append(filteredPeers, pid)
+			}
+		}
+
+		if len(filteredPeers) != len(groupInfo.Peers) {
+			ng := groupInfo.Copy()
+			ng.Peers = filteredPeers
+			(*groups)[groupID] = ng
+		}
+	}
+}
+
+func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}, policies []*nmdata.Policy, resourcePoliciesMap map[string][]*nmdata.Policy, peers map[string]*nmdata.Peer) {
+	if len(*postureFailedPeers) == 0 {
+		return
+	}
+
+	referencedPostureChecks := make(map[string]struct{})
+	for _, policy := range policies {
+		for _, checkID := range policy.SourcePostureChecks {
+			referencedPostureChecks[checkID] = struct{}{}
+		}
+	}
+	for _, resPolicies := range resourcePoliciesMap {
+		for _, policy := range resPolicies {
+			for _, checkID := range policy.SourcePostureChecks {
+				referencedPostureChecks[checkID] = struct{}{}
+			}
+		}
+	}
+
+	for checkID, failedPeers := range *postureFailedPeers {
+		if _, referenced := referencedPostureChecks[checkID]; !referenced {
+			delete(*postureFailedPeers, checkID)
+			continue
+		}
+		for peerID := range failedPeers {
+			if _, exists := peers[peerID]; !exists {
+				delete(failedPeers, peerID)
+			}
+		}
+		if len(failedPeers) == 0 {
+			delete(*postureFailedPeers, checkID)
+		}
+	}
+}
+
+func filterDNSRecordsByPeers(records []nmdata.SimpleRecord, peers map[string]*nmdata.Peer, includeIPv6 bool) []nmdata.SimpleRecord {
+	if len(records) == 0 || len(peers) == 0 {
+		return nil
+	}
+
+	peerIPs := make(map[string]struct{}, len(peers)*2)
+	for _, peer := range peers {
+		if peer == nil {
+			continue
+		}
+		peerIPs[peer.IP.String()] = struct{}{}
+		if includeIPv6 && peer.IPv6.IsValid() {
+			peerIPs[peer.IPv6.String()] = struct{}{}
+		}
+	}
+
+	filteredRecords := make([]nmdata.SimpleRecord, 0, len(records))
+	for _, record := range records {
+		if _, exists := peerIPs[record.RData]; exists {
+			filteredRecords = append(filteredRecords, record)
+		}
+	}
+
+	return filteredRecords
+}
+
+func filterGroupIDToUserIDs(fullMap map[string][]string, neededGroupIDs map[string]struct{}) map[string][]string {
+	if len(neededGroupIDs) == 0 {
+		return nil
+	}
+
+	filtered := make(map[string][]string, len(neededGroupIDs))
+	for groupID := range neededGroupIDs {
+		if users, ok := fullMap[groupID]; ok {
+			filtered[groupID] = users
+		}
+	}
+	return filtered
+}
diff --git a/shared/management/networkmap/networkmapcompute_test.go b/shared/management/networkmap/networkmapcompute_test.go
new file mode 100644
index 000000000..ad21fd70f
--- /dev/null
+++ b/shared/management/networkmap/networkmapcompute_test.go
@@ -0,0 +1,1664 @@
+package networkmap_test
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	nbtypes "github.com/netbirdio/netbird/shared/management/types"
+)
+
+const (
+	targetID          = "peer-target"
+	postureMinVersion = "0.30.0"
+	passingVersion    = "1.0.0"
+	failingVersion    = "0.1.0"
+)
+
+func newPeer(id string, hostNum byte) *nmdata.Peer {
+	return &nmdata.Peer{
+		ID:       id,
+		Key:      "key-" + id,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, hostNum}),
+		DNSLabel: id,
+		Meta:     nmdata.PeerSystemMeta{WtVersion: passingVersion},
+	}
+}
+
+func newNMD(peers ...*nmdata.Peer) *networkmap.NetworkMapData {
+	nmd := &networkmap.NetworkMapData{
+		Peers:           make(map[string]*nmdata.Peer),
+		Groups:          make(map[string]*nmdata.Group),
+		ValidatedPeers:  make(map[string]struct{}),
+		Network:         &nmdata.Network{Identifier: "network-1", Serial: 7},
+		AccountSettings: &nmdata.AccountSettingsInfo{},
+		DNSSettings:     &nmdata.DNSSettings{},
+	}
+	for _, p := range peers {
+		nmd.Peers[p.ID] = p
+		nmd.ValidatedPeers[p.ID] = struct{}{}
+	}
+	return nmd
+}
+
+func addGroup(nmd *networkmap.NetworkMapData, id string, peerIDs ...string) *nmdata.Group {
+	g := &nmdata.Group{ID: id, Name: id, Peers: peerIDs}
+	nmd.Groups[id] = g
+	return g
+}
+
+func newRule(sources, destinations []string) *nmdata.PolicyRule {
+	return &nmdata.PolicyRule{
+		Enabled:       true,
+		Action:        string(nbtypes.PolicyTrafficActionAccept),
+		Protocol:      string(nbtypes.PolicyRuleProtocolTCP),
+		Bidirectional: true,
+		Sources:       sources,
+		Destinations:  destinations,
+	}
+}
+
+func newPolicy(id string, rules ...*nmdata.PolicyRule) *nmdata.Policy {
+	for i, r := range rules {
+		if r.ID == "" {
+			r.ID = fmt.Sprintf("%s-rule-%d", id, i)
+		}
+		r.PolicyID = id
+	}
+	return &nmdata.Policy{ID: id, Enabled: true, Rules: rules}
+}
+
+func addVersionCheck(nmd *networkmap.NetworkMapData, id, minVersion string) {
+	if nmd.PostureChecks == nil {
+		nmd.PostureChecks = make(map[string]*nmdata.PostureChecks)
+	}
+	nmd.PostureChecks[id] = &nmdata.PostureChecks{
+		ID:     id,
+		Checks: nmdata.ChecksDefinition{NBVersionCheck: &nmdata.NBVersionCheck{MinVersion: minVersion}},
+	}
+}
+
+func compute(nmd *networkmap.NetworkMapData, peerID string) *nbtypes.NetworkMapComponents {
+	return nmd.GetPeerNetworkMapComponents(peerID, nmdata.CustomZone{})
+}
+
+func peerIDSet(peers map[string]*nmdata.Peer) []string {
+	ids := make([]string, 0, len(peers))
+	for id := range peers {
+		ids = append(ids, id)
+	}
+	return ids
+}
+
+func policyIDs(policies []*nmdata.Policy) []string {
+	ids := make([]string, 0, len(policies))
+	for _, p := range policies {
+		ids = append(ids, p.ID)
+	}
+	return ids
+}
+
+func groupIDSet(groups map[string]*nmdata.Group) []string {
+	ids := make([]string, 0, len(groups))
+	for id := range groups {
+		ids = append(ids, id)
+	}
+	return ids
+}
+
+func TestGetPeerNetworkMapComponents_UnknownPeer(t *testing.T) {
+	nmd := newNMD(newPeer("peer-a", 2))
+
+	c := compute(nmd, "missing")
+
+	require.True(t, c.IsEmpty())
+	assert.Equal(t, "missing", c.PeerID)
+	assert.Same(t, nmd.Network, c.Network)
+	require.Contains(t, c.Peers, "missing")
+	assert.Nil(t, c.Peers["missing"])
+	assert.Len(t, c.Peers, 1)
+	assert.Nil(t, c.AccountSettings)
+	assert.Nil(t, c.Policies)
+	assert.False(t, c.ForceRoutingPeerDNSResolution)
+}
+
+func TestGetPeerNetworkMapComponents_UnvalidatedPeer(t *testing.T) {
+	target := newPeer(targetID, 1)
+	nmd := newNMD(target)
+	delete(nmd.ValidatedPeers, targetID)
+
+	c := compute(nmd, targetID)
+
+	require.True(t, c.IsEmpty())
+	assert.Equal(t, targetID, c.PeerID)
+	assert.Same(t, target, c.Peers[targetID])
+	assert.Len(t, c.Peers, 1)
+	assert.Nil(t, c.AccountSettings)
+	assert.Nil(t, c.Groups)
+}
+
+// The forced-DNS flag must be computed even on the empty-components early
+// exits, so an unknown or unvalidated proxy routing peer still starts its DNS
+// forwarder.
+func TestGetPeerNetworkMapComponents_EmptyComponentsKeepForcedDNSResolution(t *testing.T) {
+	build := func() *networkmap.NetworkMapData {
+		nmd := newNMD(newPeer("unval-router", 1))
+		delete(nmd.ValidatedPeers, "unval-router")
+		nmd.NetworkResources = []*nmdata.NetworkResource{
+			{ID: "res-1", NetworkID: "net-1", Type: string(nbtypes.ResourceTypeDomain), Enabled: true},
+		}
+		nmd.ProxyTargetedDomainResourceIDs = map[string]struct{}{"res-1": {}}
+		nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {"ghost-router": {}, "unval-router": {}}}
+		return nmd
+	}
+
+	t.Run("unknown peer", func(t *testing.T) {
+		c := compute(build(), "ghost-router")
+		require.True(t, c.IsEmpty())
+		assert.True(t, c.ForceRoutingPeerDNSResolution)
+	})
+
+	t.Run("unvalidated peer", func(t *testing.T) {
+		c := compute(build(), "unval-router")
+		require.True(t, c.IsEmpty())
+		assert.True(t, c.ForceRoutingPeerDNSResolution)
+	})
+}
+
+func TestGetPeerNetworkMapComponents_ForceRoutingPeerDNSResolution(t *testing.T) {
+	forced := func(mutate func(*networkmap.NetworkMapData)) bool {
+		nmd := newNMD(newPeer(targetID, 1))
+		nmd.NetworkResources = []*nmdata.NetworkResource{
+			{ID: "res-1", NetworkID: "net-1", Type: string(nbtypes.ResourceTypeDomain), Enabled: true},
+		}
+		nmd.ProxyTargetedDomainResourceIDs = map[string]struct{}{"res-1": {}}
+		nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {targetID: {}}}
+		if mutate != nil {
+			mutate(nmd)
+		}
+		return compute(nmd, targetID).ForceRoutingPeerDNSResolution
+	}
+
+	t.Run("router of targeted domain resource is forced", func(t *testing.T) {
+		assert.True(t, forced(nil))
+	})
+	t.Run("no proxy-targeted resources", func(t *testing.T) {
+		assert.False(t, forced(func(nmd *networkmap.NetworkMapData) {
+			nmd.ProxyTargetedDomainResourceIDs = nil
+		}))
+	})
+	t.Run("resource disabled", func(t *testing.T) {
+		assert.False(t, forced(func(nmd *networkmap.NetworkMapData) {
+			nmd.NetworkResources[0].Enabled = false
+		}))
+	})
+	t.Run("resource not a domain", func(t *testing.T) {
+		assert.False(t, forced(func(nmd *networkmap.NetworkMapData) {
+			nmd.NetworkResources[0].Type = string(nbtypes.ResourceTypeHost)
+		}))
+	})
+	t.Run("resource not targeted", func(t *testing.T) {
+		assert.False(t, forced(func(nmd *networkmap.NetworkMapData) {
+			nmd.ProxyTargetedDomainResourceIDs = map[string]struct{}{"res-other": {}}
+		}))
+	})
+	t.Run("peer not a router of the resource network", func(t *testing.T) {
+		assert.False(t, forced(func(nmd *networkmap.NetworkMapData) {
+			nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {"someone-else": {}}}
+		}))
+	})
+	t.Run("nil resource entry tolerated", func(t *testing.T) {
+		assert.True(t, forced(func(nmd *networkmap.NetworkMapData) {
+			nmd.NetworkResources = append([]*nmdata.NetworkResource{nil}, nmd.NetworkResources...)
+		}))
+	})
+}
+
+func TestGetPeerNetworkMapComponents_CoreFieldsPassThrough(t *testing.T) {
+	target := newPeer(targetID, 1)
+	nmd := newNMD(target)
+	nmd.NetworkXIDToPublicID = map[string]string{"net-xid": "net-pub"}
+	nmd.PostureCheckXIDToPublicID = map[string]string{"pc-xid": "pc-pub"}
+
+	c := nmd.GetPeerNetworkMapComponents(targetID, nmdata.CustomZone{Domain: "acme.netbird.cloud."})
+
+	require.False(t, c.IsEmpty())
+	assert.Equal(t, targetID, c.PeerID)
+	assert.Same(t, nmd.Network, c.Network)
+	assert.Same(t, nmd.AccountSettings, c.AccountSettings)
+	assert.Same(t, nmd.DNSSettings, c.DNSSettings)
+	assert.Equal(t, "acme.netbird.cloud.", c.CustomZoneDomain)
+	assert.Equal(t, nmd.NetworkXIDToPublicID, c.NetworkXIDToPublicID)
+	assert.Equal(t, nmd.PostureCheckXIDToPublicID, c.PostureCheckXIDToPublicID)
+
+	assert.Equal(t, map[string]*nmdata.Peer{targetID: target}, c.Peers)
+	assert.Empty(t, c.Groups)
+	assert.Empty(t, c.Policies)
+	assert.Empty(t, c.Routes)
+	assert.Empty(t, c.NameServerGroups)
+	assert.Empty(t, c.NetworkResources)
+	assert.Empty(t, c.ResourcePoliciesMap)
+	assert.Empty(t, c.RoutersMap)
+	assert.Empty(t, c.RouterPeers)
+	assert.Empty(t, c.PostureFailedPeers)
+	assert.Nil(t, c.AllDNSRecords)
+	assert.Empty(t, c.AccountZones)
+	assert.Nil(t, c.GroupIDToUserIDs)
+	assert.Nil(t, c.AllowedUserIDs)
+	assert.False(t, c.ForceRoutingPeerDNSResolution)
+}
+
+func TestGetPeerNetworkMapComponents_OwnGroupsTrimmedWithoutMutatingStore(t *testing.T) {
+	target := newPeer(targetID, 1)
+	bystander := newPeer("peer-bystander", 2)
+	nmd := newNMD(target, bystander)
+	stored := addGroup(nmd, "g-mixed", targetID, bystander.ID)
+
+	c := compute(nmd, targetID)
+
+	require.Contains(t, c.Groups, "g-mixed")
+	assert.Equal(t, []string{targetID}, c.Groups["g-mixed"].Peers)
+	assert.NotSame(t, stored, c.Groups["g-mixed"])
+	assert.Equal(t, []string{targetID, bystander.ID}, stored.Peers)
+}
+
+func TestGetPeerNetworkMapComponents_PolicyRelevance(t *testing.T) {
+	t.Run("peer in sources pulls destination peers and groups", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		srcSibling := newPeer("peer-src-sibling", 2)
+		dst := newPeer("peer-dst", 3)
+		nmd := newNMD(target, srcSibling, dst)
+		addGroup(nmd, "g-src", targetID, srcSibling.ID)
+		addGroup(nmd, "g-dst", dst.ID)
+		p := newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))
+		nmd.Policies = []*nmdata.Policy{p}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID, dst.ID}, peerIDSet(c.Peers),
+			"source-side siblings must not be connected")
+		assert.ElementsMatch(t, []string{"g-src", "g-dst"}, groupIDSet(c.Groups))
+		assert.Equal(t, []string{targetID}, c.Groups["g-src"].Peers)
+		assert.Equal(t, []string{dst.ID}, c.Groups["g-dst"].Peers)
+	})
+
+	t.Run("peer in destinations pulls source peers and groups", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		src := newPeer("peer-src", 2)
+		nmd := newNMD(target, src)
+		addGroup(nmd, "g-src", src.ID)
+		addGroup(nmd, "g-dst", targetID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID, src.ID}, peerIDSet(c.Peers))
+		assert.ElementsMatch(t, []string{"g-src", "g-dst"}, groupIDSet(c.Groups))
+	})
+
+	t.Run("unrelated policy contributes nothing", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		a := newPeer("peer-a", 2)
+		b := newPeer("peer-b", 3)
+		nmd := newNMD(target, a, b)
+		addGroup(nmd, "g-own", targetID)
+		addGroup(nmd, "g-a", a.ID)
+		addGroup(nmd, "g-b", b.ID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", newRule([]string{"g-a"}, []string{"g-b"}))}
+
+		c := compute(nmd, targetID)
+
+		assert.Empty(t, c.Policies)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+		assert.ElementsMatch(t, []string{"g-own"}, groupIDSet(c.Groups))
+	})
+
+	t.Run("disabled policy ignored", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		src := newPeer("peer-src", 2)
+		nmd := newNMD(target, src)
+		addGroup(nmd, "g-src", src.ID)
+		addGroup(nmd, "g-dst", targetID)
+		p := newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))
+		p.Enabled = false
+		nmd.Policies = []*nmdata.Policy{p}
+
+		c := compute(nmd, targetID)
+
+		assert.Empty(t, c.Policies)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("disabled rule ignored", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		src := newPeer("peer-src", 2)
+		nmd := newNMD(target, src)
+		addGroup(nmd, "g-src", src.ID)
+		addGroup(nmd, "g-dst", targetID)
+		rule := newRule([]string{"g-src"}, []string{"g-dst"})
+		rule.Enabled = false
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", rule)}
+
+		c := compute(nmd, targetID)
+
+		assert.Empty(t, c.Policies)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("peer on both sides pulls peers from both directions", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		x := newPeer("peer-x", 2)
+		y := newPeer("peer-y", 3)
+		nmd := newNMD(target, x, y)
+		addGroup(nmd, "g-src", targetID, x.ID)
+		addGroup(nmd, "g-dst", targetID, y.ID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID, x.ID, y.ID}, peerIDSet(c.Peers),
+			"both the source-side and destination-side counterparts must connect")
+	})
+
+	t.Run("rule referencing missing group tolerated", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		nmd := newNMD(target)
+		addGroup(nmd, "g-dst", targetID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", newRule([]string{"g-ghost"}, []string{"g-dst"}))}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("nil policy and rule entries tolerated", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		dst := newPeer("peer-dst", 2)
+		nmd := newNMD(target, dst)
+		addGroup(nmd, "g-src", targetID)
+		addGroup(nmd, "g-dst", dst.ID)
+		p := newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))
+		p.Rules = append([]*nmdata.PolicyRule{nil}, p.Rules...)
+		nmd.Policies = []*nmdata.Policy{nil, p}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID, dst.ID}, peerIDSet(c.Peers))
+	})
+}
+
+func TestGetPeerNetworkMapComponents_PeerResourceRules(t *testing.T) {
+	peerResource := func(id string) nmdata.Resource {
+		return nmdata.Resource{ID: id, Type: string(nbtypes.ResourceTypePeer)}
+	}
+
+	t.Run("target as source resource", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		dst := newPeer("peer-dst", 2)
+		nmd := newNMD(target, dst)
+		addGroup(nmd, "g-dst", dst.ID)
+		rule := newRule(nil, []string{"g-dst"})
+		rule.SourceResource = peerResource(targetID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", rule)}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID, dst.ID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("target as destination resource", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		src := newPeer("peer-src", 2)
+		nmd := newNMD(target, src)
+		addGroup(nmd, "g-src", src.ID)
+		rule := newRule([]string{"g-src"}, nil)
+		rule.DestinationResource = peerResource(targetID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", rule)}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID, src.ID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("remote peer as destination resource", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		remote := newPeer("peer-remote", 2)
+		nmd := newNMD(target, remote)
+		addGroup(nmd, "g-src", targetID)
+		rule := newRule([]string{"g-src"}, nil)
+		rule.DestinationResource = peerResource(remote.ID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", rule)}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID, remote.ID}, peerIDSet(c.Peers))
+	})
+
+	// A directly referenced peer is admitted like a member of a group holding only
+	// that peer: the ValidatedPeers gate and the posture checks apply equally.
+	t.Run("unvalidated source resource peer is excluded", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		unval := newPeer("peer-unval", 2)
+		nmd := newNMD(target, unval)
+		delete(nmd.ValidatedPeers, unval.ID)
+		addGroup(nmd, "g-dst", targetID)
+		rule := newRule(nil, []string{"g-dst"})
+		rule.SourceResource = peerResource(unval.ID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", rule)}
+
+		c := compute(nmd, targetID)
+
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("source resource peer failing posture checks is excluded", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		failing := newPeer("peer-failing", 2)
+		failing.Meta.WtVersion = failingVersion
+		nmd := newNMD(target, failing)
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		addGroup(nmd, "g-dst", targetID)
+		rule := newRule(nil, []string{"g-dst"})
+		rule.SourceResource = peerResource(failing.ID)
+		p := newPolicy("p-1", rule)
+		p.SourcePostureChecks = []string{"pc-1"}
+		nmd.Policies = []*nmdata.Policy{p}
+
+		c := compute(nmd, targetID)
+
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+		assert.Empty(t, c.PostureFailedPeers)
+	})
+
+	t.Run("direct source peer failure recorded when connected via another policy", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		failing := newPeer("peer-failing", 2)
+		failing.Meta.WtVersion = failingVersion
+		nmd := newNMD(target, failing)
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		addGroup(nmd, "g-dst", targetID)
+		checkedRule := newRule(nil, []string{"g-dst"})
+		checkedRule.SourceResource = peerResource(failing.ID)
+		checked := newPolicy("p-checked", checkedRule)
+		checked.SourcePostureChecks = []string{"pc-1"}
+		openRule := newRule(nil, []string{"g-dst"})
+		openRule.SourceResource = peerResource(failing.ID)
+		nmd.Policies = []*nmdata.Policy{checked, newPolicy("p-open", openRule)}
+
+		c := compute(nmd, targetID)
+
+		assert.ElementsMatch(t, []string{targetID, failing.ID}, peerIDSet(c.Peers))
+		assert.Equal(t, map[string]map[string]struct{}{"pc-1": {failing.ID: {}}}, c.PostureFailedPeers)
+	})
+
+	t.Run("target as source resource failing posture checks gets no policy", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		target.Meta.WtVersion = failingVersion
+		dst := newPeer("peer-dst", 2)
+		nmd := newNMD(target, dst)
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		addGroup(nmd, "g-dst", dst.ID)
+		rule := newRule(nil, []string{"g-dst"})
+		rule.SourceResource = peerResource(targetID)
+		p := newPolicy("p-1", rule)
+		p.SourcePostureChecks = []string{"pc-1"}
+		nmd.Policies = []*nmdata.Policy{p}
+
+		c := compute(nmd, targetID)
+
+		assert.Empty(t, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("unvalidated destination resource peer is excluded", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		unval := newPeer("peer-unval", 2)
+		nmd := newNMD(target, unval)
+		delete(nmd.ValidatedPeers, unval.ID)
+		addGroup(nmd, "g-src", targetID)
+		rule := newRule([]string{"g-src"}, nil)
+		rule.DestinationResource = peerResource(unval.ID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", rule)}
+
+		c := compute(nmd, targetID)
+
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("unrelated peer resource rule ignored", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		a := newPeer("peer-a", 2)
+		b := newPeer("peer-b", 3)
+		nmd := newNMD(target, a, b)
+		rule := newRule(nil, nil)
+		rule.SourceResource = peerResource(a.ID)
+		rule.DestinationResource = peerResource(b.ID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", rule)}
+
+		c := compute(nmd, targetID)
+
+		assert.Empty(t, c.Policies)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+}
+
+// A destination list containing a group named "All" short-circuits peer
+// expansion to that group alone, dropping peers accumulated from earlier
+// groups. Groups themselves are still all shipped. Mirrors legacy behavior
+// that the wire encoding depends on (see
+// TestEnvelopeRoundTrip_AllGroupShortCircuitParity).
+func TestGetPeerNetworkMapComponents_AllGroupShortCircuit(t *testing.T) {
+	target := newPeer(targetID, 1)
+	first := newPeer("peer-first", 2)
+	allMember := newPeer("peer-all-member", 3)
+	nmd := newNMD(target, first, allMember)
+	addGroup(nmd, "g-src", targetID)
+	addGroup(nmd, "g-first", first.ID)
+	nmd.Groups["g-all"] = &nmdata.Group{ID: "g-all", Name: nmdata.GroupAllName, Peers: []string{targetID, allMember.ID}}
+	nmd.Policies = []*nmdata.Policy{newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-first", "g-all"}))}
+
+	c := compute(nmd, targetID)
+
+	assert.ElementsMatch(t, []string{targetID, allMember.ID}, peerIDSet(c.Peers),
+		"peers from groups before the All group must be dropped by the short-circuit")
+	assert.ElementsMatch(t, []string{"g-src", "g-first", "g-all"}, groupIDSet(c.Groups))
+	assert.Empty(t, c.Groups["g-first"].Peers)
+}
+
+func TestGetPeerNetworkMapComponents_UnvalidatedPolicyPeersExcluded(t *testing.T) {
+	target := newPeer(targetID, 1)
+	srcOK := newPeer("peer-src-ok", 2)
+	srcUnval := newPeer("peer-src-unval", 3)
+	nmd := newNMD(target, srcOK, srcUnval)
+	delete(nmd.ValidatedPeers, srcUnval.ID)
+	addGroup(nmd, "g-src", srcOK.ID, srcUnval.ID, "peer-deleted")
+	addGroup(nmd, "g-dst", targetID)
+	nmd.Policies = []*nmdata.Policy{newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))}
+
+	c := compute(nmd, targetID)
+
+	assert.ElementsMatch(t, []string{targetID, srcOK.ID}, peerIDSet(c.Peers),
+		"unvalidated and dangling group members must not connect")
+	assert.Equal(t, []string{srcOK.ID}, c.Groups["g-src"].Peers)
+}
+
+// Multi-group rules take the union path of getPeersFromGroups (no All-group
+// short-circuit); validation and source posture checks apply per member.
+func TestGetPeerNetworkMapComponents_MultiGroupSources(t *testing.T) {
+	target := newPeer(targetID, 1)
+	dup := newPeer("peer-dup", 2)
+	unval := newPeer("peer-unval", 3)
+	failing := newPeer("peer-failing", 4)
+	failing.Meta.WtVersion = failingVersion
+	solo := newPeer("peer-solo", 5)
+	nmd := newNMD(target, dup, unval, failing, solo)
+	delete(nmd.ValidatedPeers, unval.ID)
+	addVersionCheck(nmd, "pc-1", postureMinVersion)
+	addGroup(nmd, "g-1", targetID, dup.ID, unval.ID, "peer-deleted")
+	addGroup(nmd, "g-2", dup.ID, failing.ID, solo.ID)
+	addGroup(nmd, "g-tgt", targetID)
+	p := newPolicy("p-1", newRule([]string{"g-1", "g-2"}, []string{"g-tgt"}))
+	p.SourcePostureChecks = []string{"pc-1"}
+	nmd.Policies = []*nmdata.Policy{p}
+
+	c := compute(nmd, targetID)
+
+	assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+	assert.ElementsMatch(t, []string{targetID, dup.ID, solo.ID}, peerIDSet(c.Peers))
+	assert.Empty(t, c.PostureFailedPeers,
+		"failing is not otherwise connected, so its failure record is pruned")
+}
+
+func TestGetPeerNetworkMapComponents_PostureChecks(t *testing.T) {
+	t.Run("failing source peer excluded without orphan failure record", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		failing := newPeer("peer-failing", 2)
+		failing.Meta.WtVersion = failingVersion
+		nmd := newNMD(target, failing)
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		addGroup(nmd, "g-src", failing.ID)
+		addGroup(nmd, "g-dst", targetID)
+		p := newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))
+		p.SourcePostureChecks = []string{"pc-1"}
+		nmd.Policies = []*nmdata.Policy{p}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+		assert.Empty(t, c.PostureFailedPeers,
+			"failure records for peers absent from the map must be pruned")
+	})
+
+	t.Run("failure recorded when peer is connected via another policy", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		failing := newPeer("peer-failing", 2)
+		failing.Meta.WtVersion = failingVersion
+		nmd := newNMD(target, failing)
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		addGroup(nmd, "g-src", failing.ID)
+		addGroup(nmd, "g-dst", targetID)
+		checked := newPolicy("p-checked", newRule([]string{"g-src"}, []string{"g-dst"}))
+		checked.SourcePostureChecks = []string{"pc-1"}
+		open := newPolicy("p-open", newRule([]string{"g-src"}, []string{"g-dst"}))
+		nmd.Policies = []*nmdata.Policy{checked, open}
+
+		c := compute(nmd, targetID)
+
+		assert.ElementsMatch(t, []string{targetID, failing.ID}, peerIDSet(c.Peers))
+		assert.Equal(t, map[string]map[string]struct{}{"pc-1": {failing.ID: {}}}, c.PostureFailedPeers)
+	})
+
+	t.Run("destination peers bypass source posture checks", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		failing := newPeer("peer-failing", 2)
+		failing.Meta.WtVersion = failingVersion
+		nmd := newNMD(target, failing)
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		addGroup(nmd, "g-src", targetID)
+		addGroup(nmd, "g-dst", failing.ID)
+		p := newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))
+		p.SourcePostureChecks = []string{"pc-1"}
+		nmd.Policies = []*nmdata.Policy{p}
+
+		c := compute(nmd, targetID)
+
+		assert.ElementsMatch(t, []string{targetID, failing.ID}, peerIDSet(c.Peers))
+		assert.Empty(t, c.PostureFailedPeers)
+	})
+
+	t.Run("target failing its own source check drops the policy", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		target.Meta.WtVersion = failingVersion
+		dst := newPeer("peer-dst", 2)
+		nmd := newNMD(target, dst)
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		addGroup(nmd, "g-src", targetID)
+		addGroup(nmd, "g-dst", dst.ID)
+		p := newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))
+		p.SourcePostureChecks = []string{"pc-1"}
+		nmd.Policies = []*nmdata.Policy{p}
+
+		c := compute(nmd, targetID)
+
+		assert.Empty(t, c.Policies)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+		assert.Empty(t, c.PostureFailedPeers)
+	})
+
+	t.Run("failure keyed by the first failing check", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		failing := newPeer("peer-failing", 2)
+		nmd := newNMD(target, failing)
+		addVersionCheck(nmd, "pc-pass", postureMinVersion)
+		addVersionCheck(nmd, "pc-fail", "2.0.0")
+		addGroup(nmd, "g-src", failing.ID)
+		addGroup(nmd, "g-dst", targetID)
+		checked := newPolicy("p-checked", newRule([]string{"g-src"}, []string{"g-dst"}))
+		checked.SourcePostureChecks = []string{"pc-pass", "pc-fail"}
+		open := newPolicy("p-open", newRule([]string{"g-src"}, []string{"g-dst"}))
+		nmd.Policies = []*nmdata.Policy{checked, open}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, map[string]map[string]struct{}{"pc-fail": {failing.ID: {}}}, c.PostureFailedPeers,
+			"the record must be keyed by the failing check, not the first listed")
+	})
+
+	t.Run("unknown posture check id passes everyone", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		src := newPeer("peer-src", 2)
+		nmd := newNMD(target, src)
+		addGroup(nmd, "g-src", src.ID)
+		addGroup(nmd, "g-dst", targetID)
+		p := newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))
+		p.SourcePostureChecks = []string{"pc-ghost"}
+		nmd.Policies = []*nmdata.Policy{p}
+
+		c := compute(nmd, targetID)
+
+		assert.ElementsMatch(t, []string{targetID, src.ID}, peerIDSet(c.Peers))
+		assert.Empty(t, c.PostureFailedPeers)
+	})
+}
+
+func TestGetPeerNetworkMapComponents_Routes(t *testing.T) {
+	t.Run("owned route relevant even when disabled", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		dist := newPeer("peer-dist", 2)
+		nmd := newNMD(target, dist)
+		addGroup(nmd, "g-dist", dist.ID)
+		addGroup(nmd, "g-acl")
+		r := &nmdata.Route{ID: "r-1", Peer: targetID, Enabled: false, Groups: []string{"g-dist"}, AccessControlGroups: []string{"g-acl"}}
+		nmd.Routes = []*nmdata.Route{r}
+
+		c := compute(nmd, targetID)
+
+		require.Len(t, c.Routes, 1)
+		assert.Same(t, r, c.Routes[0])
+		assert.Contains(t, c.Groups, "g-dist")
+		assert.NotContains(t, c.Groups, "g-acl",
+			"access control groups of a disabled route must not be collected")
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers),
+			"distribution group members are not connected by the route itself")
+	})
+
+	t.Run("peer-group route disabled still ships and connects HA members", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		ha := newPeer("peer-ha", 2)
+		haUnval := newPeer("peer-ha-unval", 3)
+		nmd := newNMD(target, ha, haUnval)
+		delete(nmd.ValidatedPeers, haUnval.ID)
+		addGroup(nmd, "g-ha", targetID, ha.ID, haUnval.ID)
+		r := &nmdata.Route{ID: "r-1", PeerGroups: []string{"g-ha", "g-ghost"}, Enabled: false}
+		nmd.Routes = []*nmdata.Route{r}
+
+		c := compute(nmd, targetID)
+
+		require.Len(t, c.Routes, 1)
+		assert.ElementsMatch(t, []string{targetID, ha.ID}, peerIDSet(c.Peers))
+		assert.Equal(t, []string{targetID, ha.ID}, c.Groups["g-ha"].Peers)
+	})
+
+	t.Run("route consumer connects HA routing peers from peer groups", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		router1 := newPeer("peer-router-1", 2)
+		router2 := newPeer("peer-router-2", 3)
+		routerUnval := newPeer("peer-router-unval", 4)
+		nmd := newNMD(target, router1, router2, routerUnval)
+		delete(nmd.ValidatedPeers, routerUnval.ID)
+		addGroup(nmd, "g-ha", router1.ID, router2.ID, routerUnval.ID)
+		addGroup(nmd, "g-dist", targetID)
+		nmd.Routes = []*nmdata.Route{{ID: "r-1", PeerGroups: []string{"g-ha"}, Groups: []string{"g-dist"}, Enabled: true}}
+
+		c := compute(nmd, targetID)
+
+		require.Len(t, c.Routes, 1)
+		assert.ElementsMatch(t, []string{targetID, router1.ID, router2.ID}, peerIDSet(c.Peers),
+			"the consumer must connect to every validated HA router")
+		assert.Equal(t, []string{router1.ID, router2.ID}, c.Groups["g-ha"].Peers)
+	})
+
+	t.Run("distribution route connects routing peer", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		router := newPeer("peer-router", 2)
+		nmd := newNMD(target, router)
+		addGroup(nmd, "g-dist", targetID)
+		r := &nmdata.Route{ID: "r-1", Peer: router.ID, Enabled: true, Groups: []string{"g-dist"}}
+		nmd.Routes = []*nmdata.Route{r}
+
+		c := compute(nmd, targetID)
+
+		require.Len(t, c.Routes, 1)
+		assert.ElementsMatch(t, []string{targetID, router.ID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("disabled distribution route not relevant", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		router := newPeer("peer-router", 2)
+		nmd := newNMD(target, router)
+		addGroup(nmd, "g-dist", targetID)
+		nmd.Routes = []*nmdata.Route{{ID: "r-1", Peer: router.ID, Enabled: false, Groups: []string{"g-dist"}}}
+
+		c := compute(nmd, targetID)
+
+		assert.Empty(t, c.Routes)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("unvalidated routing peer excluded but route ships", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		router := newPeer("peer-router", 2)
+		nmd := newNMD(target, router)
+		delete(nmd.ValidatedPeers, router.ID)
+		addGroup(nmd, "g-dist", targetID)
+		nmd.Routes = []*nmdata.Route{{ID: "r-1", Peer: router.ID, Enabled: true, Groups: []string{"g-dist"}}}
+
+		c := compute(nmd, targetID)
+
+		require.Len(t, c.Routes, 1)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("nil and unrelated routes skipped", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		other := newPeer("peer-other", 2)
+		nmd := newNMD(target, other)
+		addGroup(nmd, "g-dist", targetID)
+		addGroup(nmd, "g-foreign", other.ID)
+		owned := &nmdata.Route{ID: "r-owned", Peer: targetID, Enabled: true}
+		nmd.Routes = []*nmdata.Route{nil, {ID: "r-foreign", Peer: other.ID, Enabled: true, Groups: []string{"g-foreign"}}, owned}
+
+		c := compute(nmd, targetID)
+
+		require.Len(t, c.Routes, 1)
+		assert.Same(t, owned, c.Routes[0])
+	})
+}
+
+// A policy whose destinations hit an enabled route's access control groups is
+// shipped so the routing peer can build route firewall rules, but its peers
+// are not connected through this bridge.
+func TestGetPeerNetworkMapComponents_RouteAccessControlBridging(t *testing.T) {
+	t.Run("policy targeting route ACG becomes relevant", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		router := newPeer("peer-router", 2)
+		remote := newPeer("peer-remote", 3)
+		nmd := newNMD(target, router, remote)
+		addGroup(nmd, "g-dist", targetID)
+		addGroup(nmd, "g-acl")
+		addGroup(nmd, "g-remote", remote.ID)
+		nmd.Routes = []*nmdata.Route{{ID: "r-1", Peer: router.ID, Enabled: true, Groups: []string{"g-dist"}, AccessControlGroups: []string{"g-acl"}}}
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-acl", newRule([]string{"g-remote"}, []string{"g-acl"}))}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-acl"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{"g-dist", "g-acl", "g-remote"}, groupIDSet(c.Groups))
+		assert.ElementsMatch(t, []string{targetID, router.ID}, peerIDSet(c.Peers),
+			"the bridged policy's source peers must not be connected")
+	})
+
+	t.Run("disabled route does not bridge its ACG policies", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		remote := newPeer("peer-remote", 2)
+		nmd := newNMD(target, remote)
+		addGroup(nmd, "g-acl")
+		addGroup(nmd, "g-remote", remote.ID)
+		nmd.Routes = []*nmdata.Route{{ID: "r-1", Peer: targetID, Enabled: false, AccessControlGroups: []string{"g-acl"}}}
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-acl", newRule([]string{"g-remote"}, []string{"g-acl"}))}
+
+		c := compute(nmd, targetID)
+
+		assert.Empty(t, c.Policies)
+	})
+}
+
+func TestGetPeerNetworkMapComponents_SSHRequirements(t *testing.T) {
+	allowedUsers := map[string]struct{}{"user-1": {}, "user-2": {}}
+	groupUsers := map[string][]string{"g-auth": {"user-a"}, "g-other": {"user-b"}}
+
+	cases := []struct {
+		name          string
+		mutateRule    func(*nmdata.PolicyRule)
+		sshEnabled    bool
+		targetInSrc   bool
+		wantAllowed   bool
+		wantGroupsMap map[string][]string
+	}{
+		{
+			name: "netbird-ssh with authorized groups",
+			mutateRule: func(r *nmdata.PolicyRule) {
+				r.Protocol = string(nbtypes.PolicyRuleProtocolNetbirdSSH)
+				r.AuthorizedGroups = map[string][]string{"g-auth": nil}
+			},
+			wantGroupsMap: map[string][]string{"g-auth": {"user-a"}},
+		},
+		{
+			name: "netbird-ssh with authorized user",
+			mutateRule: func(r *nmdata.PolicyRule) {
+				r.Protocol = string(nbtypes.PolicyRuleProtocolNetbirdSSH)
+				r.AuthorizedUser = "root"
+			},
+		},
+		{
+			name: "netbird-ssh default needs allowed users",
+			mutateRule: func(r *nmdata.PolicyRule) {
+				r.Protocol = string(nbtypes.PolicyRuleProtocolNetbirdSSH)
+			},
+			wantAllowed: true,
+		},
+		{
+			name:        "legacy all-protocol with SSH enabled",
+			mutateRule:  func(r *nmdata.PolicyRule) { r.Protocol = string(nbtypes.PolicyRuleProtocolALL) },
+			sshEnabled:  true,
+			wantAllowed: true,
+		},
+		{
+			name:       "legacy all-protocol with SSH disabled",
+			mutateRule: func(r *nmdata.PolicyRule) { r.Protocol = string(nbtypes.PolicyRuleProtocolALL) },
+		},
+		{
+			name:        "tcp port 22 with SSH enabled",
+			mutateRule:  func(r *nmdata.PolicyRule) { r.Ports = []string{"22"} },
+			sshEnabled:  true,
+			wantAllowed: true,
+		},
+		{
+			name:        "tcp port range covering 22",
+			mutateRule:  func(r *nmdata.PolicyRule) { r.PortRanges = []nmdata.RulePortRange{{Start: 20, End: 30}} },
+			sshEnabled:  true,
+			wantAllowed: true,
+		},
+		{
+			name:        "tcp native ssh port 22022",
+			mutateRule:  func(r *nmdata.PolicyRule) { r.Ports = []string{"22022"} },
+			sshEnabled:  true,
+			wantAllowed: true,
+		},
+		{
+			name:        "tcp port range covering only native ssh port",
+			mutateRule:  func(r *nmdata.PolicyRule) { r.PortRanges = []nmdata.RulePortRange{{Start: 22000, End: 23000}} },
+			sshEnabled:  true,
+			wantAllowed: true,
+		},
+		{
+			name:       "tcp unrelated port",
+			mutateRule: func(r *nmdata.PolicyRule) { r.Ports = []string{"443"} },
+			sshEnabled: true,
+		},
+		{
+			name: "netbird-ssh only counts on the destination side",
+			mutateRule: func(r *nmdata.PolicyRule) {
+				r.Protocol = string(nbtypes.PolicyRuleProtocolNetbirdSSH)
+			},
+			targetInSrc: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			target := newPeer(targetID, 1)
+			target.SSHEnabled = tc.sshEnabled
+			admin := newPeer("peer-admin", 2)
+			nmd := newNMD(target, admin)
+			nmd.AllowedUserIDs = allowedUsers
+			nmd.GroupIDToUserIDs = groupUsers
+			addGroup(nmd, "g-adm", admin.ID)
+			addGroup(nmd, "g-tgt", targetID)
+			rule := newRule([]string{"g-adm"}, []string{"g-tgt"})
+			if tc.targetInSrc {
+				rule = newRule([]string{"g-tgt"}, []string{"g-adm"})
+			}
+			tc.mutateRule(rule)
+			nmd.Policies = []*nmdata.Policy{newPolicy("p-1", rule)}
+
+			c := compute(nmd, targetID)
+
+			if tc.wantAllowed {
+				assert.Equal(t, allowedUsers, c.AllowedUserIDs)
+			} else {
+				assert.Nil(t, c.AllowedUserIDs)
+			}
+			assert.Equal(t, tc.wantGroupsMap, c.GroupIDToUserIDs)
+		})
+	}
+}
+
+func TestGetPeerNetworkMapComponents_DNSRecordFiltering(t *testing.T) {
+	record := func(name, rdata string) nmdata.SimpleRecord {
+		return nmdata.SimpleRecord{Name: name, Type: 1, Class: "IN", TTL: 300, RData: rdata}
+	}
+
+	build := func(ipv6Target bool) (*networkmap.NetworkMapData, nmdata.CustomZone) {
+		target := newPeer(targetID, 1)
+		if ipv6Target {
+			target.IPv6 = netip.MustParseAddr("fd00::1")
+			target.Meta.Capabilities = []int32{nmdata.PeerCapabilityIPv6Overlay}
+		}
+		buddy := newPeer("peer-buddy", 2)
+		buddy.IPv6 = netip.MustParseAddr("fd00::2")
+		stranger := newPeer("peer-stranger", 3)
+		nmd := newNMD(target, buddy, stranger)
+		addGroup(nmd, "g-src", targetID)
+		addGroup(nmd, "g-dst", buddy.ID)
+		nmd.Policies = []*nmdata.Policy{newPolicy("p-1", newRule([]string{"g-src"}, []string{"g-dst"}))}
+		zone := nmdata.CustomZone{
+			Domain: "acme.netbird.cloud.",
+			Records: []nmdata.SimpleRecord{
+				record(targetID, "100.64.0.1"),
+				record("peer-buddy", "100.64.0.2"),
+				record("peer-stranger", "100.64.0.3"),
+				record("outsider", "9.9.9.9"),
+				record("peer-buddy-v6", "fd00::2"),
+			},
+		}
+		return nmd, zone
+	}
+
+	t.Run("records limited to relevant peers, IPv6 dropped without capability", func(t *testing.T) {
+		nmd, zone := build(false)
+
+		c := nmd.GetPeerNetworkMapComponents(targetID, zone)
+
+		assert.Equal(t, "acme.netbird.cloud.", c.CustomZoneDomain)
+		assert.Equal(t, []nmdata.SimpleRecord{
+			record(targetID, "100.64.0.1"),
+			record("peer-buddy", "100.64.0.2"),
+		}, c.AllDNSRecords)
+	})
+
+	t.Run("IPv6 records of relevant peers kept for capable target", func(t *testing.T) {
+		nmd, zone := build(true)
+
+		c := nmd.GetPeerNetworkMapComponents(targetID, zone)
+
+		assert.Equal(t, []nmdata.SimpleRecord{
+			record(targetID, "100.64.0.1"),
+			record("peer-buddy", "100.64.0.2"),
+			record("peer-buddy-v6", "fd00::2"),
+		}, c.AllDNSRecords)
+	})
+
+	t.Run("no records yields nil", func(t *testing.T) {
+		nmd, _ := build(false)
+
+		c := nmd.GetPeerNetworkMapComponents(targetID, nmdata.CustomZone{Domain: "acme.netbird.cloud."})
+
+		assert.Nil(t, c.AllDNSRecords)
+	})
+}
+
+func TestGetPeerNetworkMapComponents_AccountZones(t *testing.T) {
+	rec := func(name string) nmdata.SimpleRecord {
+		return nmdata.SimpleRecord{Name: name, Type: 1, Class: "IN", RData: "100.64.0.9"}
+	}
+
+	t.Run("applied and private service zones for peer groups", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		nmd := newNMD(target)
+		addGroup(nmd, "g-a", targetID)
+		appliedZone := nmdata.CustomZone{Domain: "zone-one.example.com.", Records: []nmdata.SimpleRecord{rec("z1")}}
+		nmd.AppliedZoneCandidates = []networkmap.AppliedZoneCandidate{
+			{DistributionGroups: []string{"g-a"}, Zone: appliedZone},
+			{DistributionGroups: []string{"g-x"}, Zone: nmdata.CustomZone{Domain: "zone-two.example.com."}},
+		}
+		nmd.PrivateServiceCandidates = []networkmap.PrivateServiceCandidate{
+			{AccessGroups: []string{"g-a"}, Zone: nmdata.CustomZone{Domain: "svc.example.com", SearchDomainDisabled: true, NonAuthoritative: true, Records: []nmdata.SimpleRecord{rec("svc-1")}}},
+			{AccessGroups: []string{"g-a"}, Zone: nmdata.CustomZone{Domain: "svc.example.com", Records: []nmdata.SimpleRecord{rec("svc-2")}}},
+			{AccessGroups: []string{"g-x"}, Zone: nmdata.CustomZone{Domain: "other.example.com", Records: []nmdata.SimpleRecord{rec("other")}}},
+			{AccessGroups: []string{"g-a"}, Zone: nmdata.CustomZone{Domain: "empty.example.com"}},
+		}
+
+		c := compute(nmd, targetID)
+
+		require.Len(t, c.AccountZones, 2)
+		assert.Equal(t, appliedZone, c.AccountZones[0])
+		assert.Equal(t, nmdata.CustomZone{
+			Domain:               "svc.example.com",
+			SearchDomainDisabled: true,
+			NonAuthoritative:     true,
+			Records:              []nmdata.SimpleRecord{rec("svc-1"), rec("svc-2")},
+		}, c.AccountZones[1], "same-apex private service candidates must merge, flags from the first")
+	})
+
+	t.Run("groupless peer receives no zones", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		nmd := newNMD(target)
+		nmd.AppliedZoneCandidates = []networkmap.AppliedZoneCandidate{
+			{DistributionGroups: []string{"g-a"}, Zone: nmdata.CustomZone{Domain: "zone-one.example.com."}},
+		}
+		nmd.PrivateServiceCandidates = []networkmap.PrivateServiceCandidate{
+			{AccessGroups: []string{"g-a"}, Zone: nmdata.CustomZone{Domain: "svc.example.com", Records: []nmdata.SimpleRecord{rec("svc")}}},
+		}
+
+		c := compute(nmd, targetID)
+
+		assert.Empty(t, c.AccountZones)
+	})
+}
+
+func TestGetPeerNetworkMapComponents_NameServerGroups(t *testing.T) {
+	target := newPeer(targetID, 1)
+	other := newPeer("peer-other", 2)
+	nmd := newNMD(target, other)
+	addGroup(nmd, "g-own", targetID)
+	addGroup(nmd, "g-dst", other.ID)
+	addGroup(nmd, "g-foreign")
+	nmd.Policies = []*nmdata.Policy{newPolicy("p-1", newRule([]string{"g-own"}, []string{"g-dst"}))}
+	nsOwn := &nmdata.NameServerGroup{ID: "ns-own", Enabled: true, Groups: []string{"g-own"}}
+	nsDst := &nmdata.NameServerGroup{ID: "ns-dst", Enabled: true, Groups: []string{"g-dst"}}
+	nsDisabled := &nmdata.NameServerGroup{ID: "ns-disabled", Enabled: false, Groups: []string{"g-own"}}
+	nsForeign := &nmdata.NameServerGroup{ID: "ns-foreign", Enabled: true, Groups: []string{"g-foreign"}}
+	nsBoth := &nmdata.NameServerGroup{ID: "ns-both", Enabled: true, Groups: []string{"g-own", "g-dst"}}
+	nmd.NameServerGroups = []*nmdata.NameServerGroup{nsOwn, nil, nsDst, nsDisabled, nsForeign, nsBoth}
+
+	c := compute(nmd, targetID)
+
+	assert.Equal(t, []*nmdata.NameServerGroup{nsOwn, nsDst, nsBoth}, c.NameServerGroups,
+		"nameserver groups attach to any relevant group and ship once even when several groups match")
+}
+
+func TestGetPeerNetworkMapComponents_NetworkResources_SourceSide(t *testing.T) {
+	target := newPeer(targetID, 1)
+	routerOK := newPeer("peer-router-ok", 2)
+	routerUnval := newPeer("peer-router-unval", 3)
+	nmd := newNMD(target, routerOK, routerUnval)
+	delete(nmd.ValidatedPeers, routerUnval.ID)
+	addGroup(nmd, "g-clients", targetID)
+	addGroup(nmd, "g-resource")
+	res := &nmdata.NetworkResource{ID: "res-1", NetworkID: "net-1", Enabled: true}
+	nmd.NetworkResources = []*nmdata.NetworkResource{res}
+	rp := newPolicy("rp-1", newRule([]string{"g-clients"}, []string{"g-resource"}))
+	nmd.Policies = []*nmdata.Policy{rp}
+	nmd.ResourcePolicies = map[string][]*nmdata.Policy{"res-1": {rp}}
+	routers := map[string]*nmdata.NetworkRouter{
+		routerOK.ID:    {Metric: 100},
+		routerUnval.ID: {Metric: 200},
+	}
+	nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": routers}
+
+	c := compute(nmd, targetID)
+
+	assert.Equal(t, []*nmdata.NetworkResource{res}, c.NetworkResources)
+	assert.Equal(t, map[string][]*nmdata.Policy{"res-1": {rp}}, c.ResourcePoliciesMap)
+	assert.Equal(t, map[string]map[string]*nmdata.NetworkRouter{"net-1": routers}, c.RoutersMap)
+	assert.ElementsMatch(t, []string{routerOK.ID}, peerIDSet(c.RouterPeers),
+		"an unvalidated routing peer is withheld from RouterPeers too, since the envelope encoder "+
+			"indexes that map into the wire peer table and the client restores every entry from it")
+	assert.ElementsMatch(t, []string{targetID, routerOK.ID}, peerIDSet(c.Peers),
+		"only validated routing peers are connected")
+	assert.ElementsMatch(t, []string{"g-clients", "g-resource"}, groupIDSet(c.Groups))
+}
+
+func TestGetPeerNetworkMapComponents_NetworkResources_RouterSide(t *testing.T) {
+	t.Run("posture-valid validated source peers connected, failures recorded", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		clientOK := newPeer("peer-client-ok", 2)
+		clientUnval := newPeer("peer-client-unval", 3)
+		clientFail := newPeer("peer-client-fail", 4)
+		clientFail.Meta.WtVersion = failingVersion
+		nmd := newNMD(target, clientOK, clientUnval, clientFail)
+		delete(nmd.ValidatedPeers, clientUnval.ID)
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		addGroup(nmd, "g-clients", clientOK.ID, clientUnval.ID, clientFail.ID)
+		addGroup(nmd, "g-resource")
+		addGroup(nmd, "g-tgt", targetID)
+		res := &nmdata.NetworkResource{ID: "res-1", NetworkID: "net-1", Enabled: true}
+		nmd.NetworkResources = []*nmdata.NetworkResource{res}
+		rp := newPolicy("rp-1", newRule([]string{"g-clients"}, []string{"g-resource"}))
+		rp.SourcePostureChecks = []string{"pc-1"}
+		acl := newPolicy("p-acl", newRule([]string{"g-clients"}, []string{"g-tgt"}))
+		nmd.Policies = []*nmdata.Policy{acl}
+		nmd.ResourcePolicies = map[string][]*nmdata.Policy{"res-1": {rp}}
+		nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {targetID: {Metric: 100}}}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []*nmdata.NetworkResource{res}, c.NetworkResources)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.RouterPeers))
+		assert.ElementsMatch(t, []string{targetID, clientOK.ID, clientFail.ID}, peerIDSet(c.Peers),
+			"clientFail connects via the open ACL policy, clientUnval never connects")
+		assert.Equal(t, map[string]map[string]struct{}{"pc-1": {clientFail.ID: {}}}, c.PostureFailedPeers)
+	})
+
+	t.Run("peer source resource collects exactly that peer", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		client := newPeer("peer-client", 2)
+		other := newPeer("peer-other", 3)
+		nmd := newNMD(target, client, other)
+		res := &nmdata.NetworkResource{ID: "res-1", NetworkID: "net-1", Enabled: true}
+		nmd.NetworkResources = []*nmdata.NetworkResource{res}
+		rule := newRule(nil, nil)
+		rule.SourceResource = nmdata.Resource{ID: client.ID, Type: string(nbtypes.ResourceTypePeer)}
+		nmd.ResourcePolicies = map[string][]*nmdata.Policy{"res-1": {newPolicy("rp-1", rule)}}
+		nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {targetID: {}}}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []*nmdata.NetworkResource{res}, c.NetworkResources)
+		assert.ElementsMatch(t, []string{targetID, client.ID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("multiple source groups unioned, missing group tolerated", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		c1 := newPeer("peer-c1", 2)
+		c2 := newPeer("peer-c2", 3)
+		nmd := newNMD(target, c1, c2)
+		addGroup(nmd, "g-c1", c1.ID)
+		addGroup(nmd, "g-c2", c2.ID)
+		res := &nmdata.NetworkResource{ID: "res-1", NetworkID: "net-1", Enabled: true}
+		nmd.NetworkResources = []*nmdata.NetworkResource{res}
+		nmd.ResourcePolicies = map[string][]*nmdata.Policy{
+			"res-1": {newPolicy("rp-1", newRule([]string{"g-c1", "g-c2", "g-ghost"}, nil))},
+		}
+		nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {targetID: {}}}
+
+		c := compute(nmd, targetID)
+
+		assert.ElementsMatch(t, []string{targetID, c1.ID, c2.ID}, peerIDSet(c.Peers))
+	})
+}
+
+func TestGetPeerNetworkMapComponents_NetworkResources_PeerResourceSource(t *testing.T) {
+	build := func(sourcePeerID string) *networkmap.NetworkMapData {
+		target := newPeer(targetID, 1)
+		router := newPeer("peer-router", 2)
+		other := newPeer("peer-other", 3)
+		nmd := newNMD(target, router, other)
+		res := &nmdata.NetworkResource{ID: "res-1", NetworkID: "net-1", Enabled: true}
+		nmd.NetworkResources = []*nmdata.NetworkResource{res}
+		rule := newRule(nil, nil)
+		rule.SourceResource = nmdata.Resource{ID: sourcePeerID, Type: string(nbtypes.ResourceTypePeer)}
+		nmd.ResourcePolicies = map[string][]*nmdata.Policy{"res-1": {newPolicy("rp-1", rule)}}
+		nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {"peer-router": {}}}
+		return nmd
+	}
+
+	t.Run("target named as source resource gains access", func(t *testing.T) {
+		c := compute(build(targetID), targetID)
+
+		assert.Len(t, c.NetworkResources, 1)
+		assert.ElementsMatch(t, []string{targetID, "peer-router"}, peerIDSet(c.Peers))
+	})
+
+	t.Run("other peer named as source resource denies target", func(t *testing.T) {
+		c := compute(build("peer-other"), targetID)
+
+		assert.Empty(t, c.NetworkResources)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+}
+
+func TestGetPeerNetworkMapComponents_NetworkResources_Gating(t *testing.T) {
+	build := func() (*networkmap.NetworkMapData, *nmdata.NetworkResource, *nmdata.Policy) {
+		target := newPeer(targetID, 1)
+		router := newPeer("peer-router", 2)
+		nmd := newNMD(target, router)
+		addGroup(nmd, "g-clients", targetID)
+		addGroup(nmd, "g-resource")
+		res := &nmdata.NetworkResource{ID: "res-1", NetworkID: "net-1", Enabled: true}
+		nmd.NetworkResources = []*nmdata.NetworkResource{res}
+		rp := newPolicy("rp-1", newRule([]string{"g-clients"}, []string{"g-resource"}))
+		nmd.Policies = []*nmdata.Policy{rp}
+		nmd.ResourcePolicies = map[string][]*nmdata.Policy{"res-1": {rp}}
+		nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {router.ID: {}}}
+		return nmd, res, rp
+	}
+
+	assertResourceSkipped := func(t *testing.T, c *nbtypes.NetworkMapComponents) {
+		t.Helper()
+		assert.Empty(t, c.NetworkResources)
+		assert.Empty(t, c.RoutersMap)
+		assert.Empty(t, c.RouterPeers)
+		assert.Empty(t, c.ResourcePoliciesMap)
+	}
+
+	t.Run("baseline grants access", func(t *testing.T) {
+		nmd, res, _ := build()
+		c := compute(nmd, targetID)
+		assert.Equal(t, []*nmdata.NetworkResource{res}, c.NetworkResources)
+	})
+
+	t.Run("disabled resource skipped", func(t *testing.T) {
+		nmd, res, _ := build()
+		res.Enabled = false
+		assertResourceSkipped(t, compute(nmd, targetID))
+	})
+
+	t.Run("resource without policies skipped", func(t *testing.T) {
+		nmd, _, _ := build()
+		nmd.ResourcePolicies = nil
+		assertResourceSkipped(t, compute(nmd, targetID))
+	})
+
+	t.Run("peer neither router nor in sources skipped", func(t *testing.T) {
+		nmd, _, _ := build()
+		nmd.Groups["g-clients"].Peers = []string{"peer-router"}
+		c := compute(nmd, targetID)
+		assertResourceSkipped(t, c)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("nil and rule-less resource policy entries tolerated", func(t *testing.T) {
+		nmd, res, rp := build()
+		nmd.NetworkResources = append([]*nmdata.NetworkResource{nil}, nmd.NetworkResources...)
+		rp.Rules = append(rp.Rules, nil)
+		nmd.ResourcePolicies["res-1"] = append([]*nmdata.Policy{nil, {ID: "rp-empty", Enabled: true}}, nmd.ResourcePolicies["res-1"]...)
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []*nmdata.NetworkResource{res}, c.NetworkResources,
+			"poisoned sibling entries must not prevent the valid policy from granting access")
+		assert.NotPanics(t, func() { c.Calculate(context.Background()) },
+			"the downstream network map calculation must survive the poisoned components")
+	})
+
+	t.Run("granting policy without routers still ships the resource", func(t *testing.T) {
+		nmd, res, rp := build()
+		nmd.Routers = nil
+		c := compute(nmd, targetID)
+		assert.Equal(t, []*nmdata.NetworkResource{res}, c.NetworkResources)
+		assert.Equal(t, map[string][]*nmdata.Policy{"res-1": {rp}}, c.ResourcePoliciesMap)
+		assert.Contains(t, c.RoutersMap, "net-1")
+		assert.Empty(t, c.RoutersMap["net-1"])
+		assert.Empty(t, c.RouterPeers)
+	})
+
+	t.Run("target failing resource policy posture check skipped", func(t *testing.T) {
+		nmd, _, rp := build()
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		rp.SourcePostureChecks = []string{"pc-1"}
+		nmd.Policies = nil
+		nmd.Peers[targetID].Meta.WtVersion = failingVersion
+		c := compute(nmd, targetID)
+		assertResourceSkipped(t, c)
+		assert.Empty(t, c.PostureFailedPeers)
+		assert.ElementsMatch(t, []string{targetID}, peerIDSet(c.Peers))
+	})
+}
+
+// Legacy parity: resource-policy access consults only Rules[0] for peer-type
+// sources, while group sources union across all rules via SourceGroups.
+func TestGetPeerNetworkMapComponents_MultiRulePolicies(t *testing.T) {
+	t.Run("policy matching via multiple rules ships once", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		a := newPeer("peer-a", 2)
+		b := newPeer("peer-b", 3)
+		nmd := newNMD(target, a, b)
+		addGroup(nmd, "g-tgt", targetID)
+		addGroup(nmd, "g-a", a.ID)
+		addGroup(nmd, "g-b", b.ID)
+		p := newPolicy("p-1",
+			newRule([]string{"g-tgt"}, []string{"g-a"}),
+			newRule([]string{"g-tgt"}, []string{"g-b"}))
+		nmd.Policies = []*nmdata.Policy{p}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, []string{"p-1"}, policyIDs(c.Policies))
+		assert.ElementsMatch(t, []string{targetID, a.ID, b.ID}, peerIDSet(c.Peers))
+	})
+
+	t.Run("resource access consults only the first rule's peer source", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		other := newPeer("peer-other", 2)
+		router := newPeer("peer-router", 3)
+		nmd := newNMD(target, other, router)
+		addGroup(nmd, "g-other", other.ID)
+		res := &nmdata.NetworkResource{ID: "res-1", NetworkID: "net-1", Enabled: true}
+		nmd.NetworkResources = []*nmdata.NetworkResource{res}
+		second := newRule(nil, nil)
+		second.SourceResource = nmdata.Resource{ID: targetID, Type: string(nbtypes.ResourceTypePeer)}
+		rp := newPolicy("rp-1", newRule([]string{"g-other"}, nil), second)
+		nmd.ResourcePolicies = map[string][]*nmdata.Policy{"res-1": {rp}}
+		nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {router.ID: {}}}
+
+		c := compute(nmd, targetID)
+
+		assert.Empty(t, c.NetworkResources,
+			"a second rule naming the target as peer source must not grant resource access")
+	})
+
+	t.Run("router-side source collection consults only the first rule's peer source", func(t *testing.T) {
+		target := newPeer(targetID, 1)
+		x := newPeer("peer-x", 2)
+		y := newPeer("peer-y", 3)
+		nmd := newNMD(target, x, y)
+		addGroup(nmd, "g-y", y.ID)
+		res := &nmdata.NetworkResource{ID: "res-1", NetworkID: "net-1", Enabled: true}
+		nmd.NetworkResources = []*nmdata.NetworkResource{res}
+		first := newRule(nil, nil)
+		first.SourceResource = nmdata.Resource{ID: x.ID, Type: string(nbtypes.ResourceTypePeer)}
+		rp := newPolicy("rp-1", first, newRule([]string{"g-y"}, nil))
+		nmd.ResourcePolicies = map[string][]*nmdata.Policy{"res-1": {rp}}
+		nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {targetID: {}}}
+
+		c := compute(nmd, targetID)
+
+		assert.ElementsMatch(t, []string{targetID, x.ID}, peerIDSet(c.Peers),
+			"second-rule group sources are not collected when the first rule names a peer")
+	})
+}
+
+// Characterization of legacy parity: once one resource policy grants the peer
+// access, the source peers of the resource's subsequent policies are collected
+// as if the peer were a router.
+func TestGetPeerNetworkMapComponents_NetworkResources_LaterPoliciesContributeSourcePeers(t *testing.T) {
+	target := newPeer(targetID, 1)
+	otherSrc := newPeer("peer-other-src", 2)
+	router := newPeer("peer-router", 3)
+	nmd := newNMD(target, otherSrc, router)
+	addGroup(nmd, "g-a", targetID)
+	addGroup(nmd, "g-b", otherSrc.ID)
+	addGroup(nmd, "g-resource")
+	res := &nmdata.NetworkResource{ID: "res-1", NetworkID: "net-1", Enabled: true}
+	nmd.NetworkResources = []*nmdata.NetworkResource{res}
+	rpA := newPolicy("rp-a", newRule([]string{"g-a"}, []string{"g-resource"}))
+	rpB := newPolicy("rp-b", newRule([]string{"g-b"}, []string{"g-resource"}))
+	nmd.ResourcePolicies = map[string][]*nmdata.Policy{"res-1": {rpA, rpB}}
+	nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {router.ID: {}}}
+
+	c := compute(nmd, targetID)
+
+	assert.Contains(t, c.Peers, otherSrc.ID)
+}
+
+func TestGetPeerNetworkMapComponents_StoreImmutableAndDeterministic(t *testing.T) {
+	zone := nmdata.CustomZone{
+		Domain:  "acme.netbird.cloud.",
+		Records: []nmdata.SimpleRecord{{Name: "peer-src", Type: 1, Class: "IN", TTL: 300, RData: "100.64.0.2"}},
+	}
+	build := func() *networkmap.NetworkMapData {
+		target := newPeer(targetID, 1)
+		src := newPeer("peer-src", 2)
+		failing := newPeer("peer-failing", 3)
+		failing.Meta.WtVersion = failingVersion
+		router := newPeer("peer-router", 4)
+		resRouter := newPeer("peer-res-router", 5)
+		nmd := newNMD(target, src, failing, router, resRouter)
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		addGroup(nmd, "g-src", src.ID, failing.ID)
+		addGroup(nmd, "g-dst", targetID, src.ID)
+		addGroup(nmd, "g-dist", targetID, src.ID)
+		addGroup(nmd, "g-auth", src.ID)
+		addGroup(nmd, "g-clients", targetID)
+		addGroup(nmd, "g-resource")
+		nmd.AllowedUserIDs = map[string]struct{}{"user-1": {}}
+		nmd.GroupIDToUserIDs = map[string][]string{"g-auth": {"user-a"}}
+		checked := newPolicy("p-checked", newRule([]string{"g-src"}, []string{"g-dst"}))
+		checked.SourcePostureChecks = []string{"pc-1"}
+		open := newPolicy("p-open", newRule([]string{"g-src"}, []string{"g-dst"}))
+		sshAuth := newRule([]string{"g-src"}, []string{"g-dst"})
+		sshAuth.Protocol = string(nbtypes.PolicyRuleProtocolNetbirdSSH)
+		sshAuth.AuthorizedGroups = map[string][]string{"g-auth": nil}
+		sshPlain := newRule([]string{"g-src"}, []string{"g-dst"})
+		sshPlain.Protocol = string(nbtypes.PolicyRuleProtocolNetbirdSSH)
+		rp := newPolicy("rp-1", newRule([]string{"g-clients"}, []string{"g-resource"}))
+		nmd.Policies = []*nmdata.Policy{checked, open, newPolicy("p-ssh", sshAuth, sshPlain), rp}
+		nmd.Routes = []*nmdata.Route{{ID: "r-1", Peer: router.ID, Enabled: true, Groups: []string{"g-dist"}}}
+		nmd.NetworkResources = []*nmdata.NetworkResource{{ID: "res-1", NetworkID: "net-1", Enabled: true}}
+		nmd.ResourcePolicies = map[string][]*nmdata.Policy{"res-1": {rp}}
+		nmd.Routers = map[string]map[string]*nmdata.NetworkRouter{"net-1": {resRouter.ID: {Metric: 100}}}
+		nmd.NameServerGroups = []*nmdata.NameServerGroup{{ID: "ns-1", Enabled: true, Groups: []string{"g-dst"}}}
+		nmd.AppliedZoneCandidates = []networkmap.AppliedZoneCandidate{
+			{DistributionGroups: []string{"g-dst"}, Zone: nmdata.CustomZone{Domain: "zone.example.com.", Records: []nmdata.SimpleRecord{{Name: "z", Type: 1, RData: "100.64.0.9"}}}},
+		}
+		nmd.PrivateServiceCandidates = []networkmap.PrivateServiceCandidate{
+			{AccessGroups: []string{"g-dst"}, Zone: nmdata.CustomZone{Domain: "svc.example.com", Records: []nmdata.SimpleRecord{{Name: "s", Type: 1, RData: "100.64.0.8"}}}},
+		}
+		return nmd
+	}
+
+	nmd := build()
+	groupSnapshots := make(map[string][]string, len(nmd.Groups))
+	for id, g := range nmd.Groups {
+		groupSnapshots[id] = append([]string(nil), g.Peers...)
+	}
+
+	first := nmd.GetPeerNetworkMapComponents(targetID, zone)
+	_ = nmd.GetPeerNetworkMapComponents("peer-src", zone)
+	second := nmd.GetPeerNetworkMapComponents(targetID, zone)
+
+	for id, g := range nmd.Groups {
+		assert.Equal(t, groupSnapshots[id], g.Peers, "group %s mutated in the store", id)
+	}
+
+	for name, field := range map[string]any{
+		"Peers":               first.Peers,
+		"PostureFailedPeers":  first.PostureFailedPeers,
+		"RoutersMap":          first.RoutersMap,
+		"RouterPeers":         first.RouterPeers,
+		"NetworkResources":    first.NetworkResources,
+		"NameServerGroups":    first.NameServerGroups,
+		"AccountZones":        first.AccountZones,
+		"AllDNSRecords":       first.AllDNSRecords,
+		"AllowedUserIDs":      first.AllowedUserIDs,
+		"GroupIDToUserIDs":    first.GroupIDToUserIDs,
+		"ResourcePoliciesMap": first.ResourcePoliciesMap,
+	} {
+		require.NotEmpty(t, field, "fixture must populate %s or the determinism check is vacuous", name)
+	}
+
+	assert.Equal(t, first.Peers, second.Peers)
+	assert.Equal(t, first.Groups, second.Groups)
+	assert.Equal(t, first.Policies, second.Policies)
+	assert.Equal(t, first.Routes, second.Routes)
+	assert.Equal(t, first.PostureFailedPeers, second.PostureFailedPeers)
+	assert.Equal(t, first.ResourcePoliciesMap, second.ResourcePoliciesMap)
+	assert.Equal(t, first.RoutersMap, second.RoutersMap)
+	assert.Equal(t, first.RouterPeers, second.RouterPeers)
+	assert.Equal(t, first.NetworkResources, second.NetworkResources)
+	assert.Equal(t, first.NameServerGroups, second.NameServerGroups)
+	assert.Equal(t, first.AccountZones, second.AccountZones)
+	assert.Equal(t, first.AllDNSRecords, second.AllDNSRecords)
+	assert.Equal(t, first.AllowedUserIDs, second.AllowedUserIDs)
+	assert.Equal(t, first.GroupIDToUserIDs, second.GroupIDToUserIDs)
+}
+
+func TestPrecomputePostureValidation(t *testing.T) {
+	newFixture := func() *networkmap.NetworkMapData {
+		target := newPeer(targetID, 1)
+		srcPass := newPeer("peer-src-pass", 2)
+		srcFail := newPeer("peer-src-fail", 3)
+		srcFail.Meta.WtVersion = failingVersion
+		other := newPeer("peer-other", 4)
+		other.Meta.WtVersion = failingVersion
+
+		nmd := newNMD(target, srcPass, srcFail, other)
+		addVersionCheck(nmd, "pc-1", postureMinVersion)
+		addGroup(nmd, "g-src", srcPass.ID, srcFail.ID)
+		addGroup(nmd, "g-dst", targetID)
+		addGroup(nmd, "g-open", srcPass.ID, srcFail.ID, other.ID)
+
+		checked := newPolicy("p-checked", newRule([]string{"g-src"}, []string{"g-dst"}))
+		checked.SourcePostureChecks = []string{"pc-1"}
+		open := newPolicy("p-open", newRule([]string{"g-open"}, []string{"g-dst"}))
+		disabled := newPolicy("p-disabled", newRule([]string{"g-open"}, []string{"g-dst"}))
+		disabled.Enabled = false
+		disabled.SourcePostureChecks = []string{"pc-1"}
+		nmd.Policies = []*nmdata.Policy{checked, open, disabled}
+
+		return nmd
+	}
+
+	type snapshot struct {
+		peers              []string
+		postureFailedPeers map[string]map[string]struct{}
+	}
+	snapshotAll := func(nmd *networkmap.NetworkMapData) map[string]snapshot {
+		out := make(map[string]snapshot, len(nmd.Peers))
+		for peerID := range nmd.Peers {
+			c := compute(nmd, peerID)
+			out[peerID] = snapshot{peers: peerIDSet(c.Peers), postureFailedPeers: c.PostureFailedPeers}
+		}
+		return out
+	}
+
+	t.Run("memoized results match direct evaluation", func(t *testing.T) {
+		nmd := newFixture()
+		direct := snapshotAll(nmd)
+
+		nmd.PrecomputePostureValidation()
+		memoized := snapshotAll(nmd)
+
+		require.Len(t, memoized, len(direct))
+		for peerID, want := range direct {
+			assert.ElementsMatch(t, want.peers, memoized[peerID].peers, "visible peers changed for %s", peerID)
+			assert.Equal(t, want.postureFailedPeers, memoized[peerID].postureFailedPeers, "posture failures changed for %s", peerID)
+		}
+	})
+
+	t.Run("only source peers of enabled checked policies are evaluated", func(t *testing.T) {
+		nmd := newFixture()
+		nmd.PrecomputePostureValidation()
+
+		assert.Equal(t, map[string]map[string]bool{
+			"pc-1": {"peer-src-pass": true, "peer-src-fail": false},
+		}, nmd.PostureValidation)
+	})
+
+	t.Run("peer source resources are evaluated", func(t *testing.T) {
+		nmd := newFixture()
+		resourcePolicy := newPolicy("p-resource", newRule(nil, []string{"g-dst"}))
+		resourcePolicy.Rules[0].SourceResource = nmdata.Resource{ID: "peer-other", Type: string(nbtypes.ResourceTypePeer)}
+		resourcePolicy.SourcePostureChecks = []string{"pc-1"}
+		nmd.Policies = append(nmd.Policies, resourcePolicy)
+
+		nmd.PrecomputePostureValidation()
+
+		assert.Equal(t, map[string]bool{"peer-src-pass": true, "peer-src-fail": false, "peer-other": false},
+			nmd.PostureValidation["pc-1"])
+	})
+
+	t.Run("memoized result wins over direct evaluation", func(t *testing.T) {
+		nmd := newFixture()
+		nmd.PostureValidation = map[string]map[string]bool{
+			"pc-1": {"peer-src-pass": false, "peer-src-fail": true},
+		}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, map[string]map[string]struct{}{"pc-1": {"peer-src-pass": {}}}, c.PostureFailedPeers)
+	})
+
+	t.Run("no posture checks clears the memo", func(t *testing.T) {
+		nmd := newFixture()
+		nmd.PrecomputePostureValidation()
+		require.NotEmpty(t, nmd.PostureValidation)
+
+		nmd.PostureChecks = nil
+		nmd.PrecomputePostureValidation()
+
+		assert.Nil(t, nmd.PostureValidation)
+	})
+
+	t.Run("unresolvable check id memoized as passing", func(t *testing.T) {
+		nmd := newFixture()
+		nmd.Policies[0].SourcePostureChecks = []string{"pc-ghost"}
+		nmd.PrecomputePostureValidation()
+
+		require.Contains(t, nmd.PostureValidation, "pc-ghost")
+		assert.Nil(t, nmd.PostureValidation["pc-ghost"])
+
+		c := compute(nmd, targetID)
+		assert.ElementsMatch(t, []string{targetID, "peer-src-pass", "peer-src-fail", "peer-other"}, peerIDSet(c.Peers))
+		assert.Empty(t, c.PostureFailedPeers)
+	})
+
+	t.Run("peers missing from the memo fall back to direct evaluation", func(t *testing.T) {
+		nmd := newFixture()
+		nmd.PostureValidation = map[string]map[string]bool{"pc-1": {"peer-src-pass": true}}
+
+		c := compute(nmd, targetID)
+
+		assert.Equal(t, map[string]map[string]struct{}{"pc-1": {"peer-src-fail": {}}}, c.PostureFailedPeers)
+	})
+}
+
+func TestNetworkMapData_GetPeerGroups(t *testing.T) {
+	target := newPeer(targetID, 1)
+	other := newPeer("peer-other", 2)
+	nmd := newNMD(target, other)
+	addGroup(nmd, "g-1", targetID, other.ID)
+	addGroup(nmd, "g-2", targetID)
+	addGroup(nmd, "g-3", other.ID)
+	nmd.Groups["g-nil"] = nil
+
+	assert.Equal(t, map[string]struct{}{"g-1": {}, "g-2": {}}, nmd.GetPeerGroups(targetID))
+	assert.Empty(t, nmd.GetPeerGroups("missing"))
+}
diff --git a/shared/management/networkmap/networkmapdata.go b/shared/management/networkmap/networkmapdata.go
new file mode 100644
index 000000000..4e0e1c420
--- /dev/null
+++ b/shared/management/networkmap/networkmapdata.go
@@ -0,0 +1,83 @@
+package networkmap
+
+import (
+	"sync"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+// NetworkMapData is a dependency-light, slim twin of the server Account. It
+// carries only the state GetPeerNetworkMapComponents needs, expressed in the
+// fresh nmdata twin types. A builder converts an Account into a NetworkMapData
+// once per account; the per-peer components calculation then runs on this twin
+// with no reference back to the Account.
+type NetworkMapData struct { //nolint:revive // established name across the codebase
+	Peers            map[string]*nmdata.Peer
+	Groups           map[string]*nmdata.Group
+	Policies         []*nmdata.Policy
+	Routes           []*nmdata.Route
+	NameServerGroups []*nmdata.NameServerGroup
+	NetworkResources []*nmdata.NetworkResource
+
+	Network         *nmdata.Network
+	DNSSettings     *nmdata.DNSSettings
+	AccountSettings *nmdata.AccountSettingsInfo
+
+	PostureChecks map[string]*nmdata.PostureChecks
+
+	// PostureValidation holds the precomputed posture-check results, keyed by
+	// posture check ID then peer ID. Filled by PrecomputePostureValidation; a
+	// present but nil inner map marks a check ID that resolves to no posture
+	// check, which the calc treats as passing.
+	PostureValidation map[string]map[string]bool
+
+	AllowedUserIDs            map[string]struct{}
+	NetworkXIDToPublicID      map[string]string
+	PostureCheckXIDToPublicID map[string]string
+	ValidatedPeers            map[string]struct{}
+	ResourcePolicies          map[string][]*nmdata.Policy
+	Routers                   map[string]map[string]*nmdata.NetworkRouter
+	GroupIDToUserIDs          map[string][]string
+	DNSDomain                 string
+
+	// ProxyTargetedDomainResourceIDs is the account-level half of
+	// forcesRoutingPeerDNSResolution: domain network resources targeted by an
+	// enabled reverse-proxy service.
+	ProxyTargetedDomainResourceIDs map[string]struct{}
+
+	AppliedZoneCandidates    []AppliedZoneCandidate
+	PrivateServiceCandidates []PrivateServiceCandidate
+
+	// Services are the account's reverse-proxy services, persisted ones and
+	// the in-memory ones synthesised from agent-network state. They are the
+	// source of the proxy ACLs injectProxyPolicies synthesises, which no
+	// builder can load because they are never written to the database.
+	Services []*nmdata.Service
+
+	// Domains are the account's registered reverse-proxy domains, used to
+	// resolve the zone apex a private service's records hang under.
+	Domains []nmdata.ProxyDomain
+
+	peerGroupsOnce sync.Once
+	peerGroupsIdx  map[string]map[string]struct{}
+
+	proxyPoliciesOnce sync.Once
+}
+
+// AppliedZoneCandidate is an account-level custom DNS zone reduced to the
+// per-peer decision the components calc still makes: include the zone only when
+// the peer belongs to one of its distribution groups. Record conversion is done
+// once at build time.
+type AppliedZoneCandidate struct {
+	DistributionGroups []string
+	Zone               nmdata.CustomZone
+}
+
+// PrivateServiceCandidate is a single private service's synthesized records,
+// carried per apex zone. The builder resolves proxy-cluster connectivity and
+// domain-suffix matching once; the calc merges the candidates whose AccessGroups
+// the peer belongs to, grouped by Zone.Domain.
+type PrivateServiceCandidate struct {
+	AccessGroups []string
+	Zone         nmdata.CustomZone
+}
diff --git a/shared/management/networkmap/nmdata/account_settings.go b/shared/management/networkmap/nmdata/account_settings.go
new file mode 100644
index 000000000..57e29e838
--- /dev/null
+++ b/shared/management/networkmap/nmdata/account_settings.go
@@ -0,0 +1,18 @@
+package nmdata
+
+import "time"
+
+// AccountSettingsInfo is the slim twin of types.AccountSettingsInfo.
+type AccountSettingsInfo struct {
+	PeerLoginExpirationEnabled      bool
+	PeerLoginExpiration             time.Duration
+	PeerInactivityExpirationEnabled bool
+	PeerInactivityExpiration        time.Duration
+	DNSDomain                       string
+	IPv6EnabledGroups               []string
+	RoutingPeerDNSResolutionEnabled bool
+	LazyConnectionEnabled           bool
+	AutoUpdateVersion               string
+	AutoUpdateAlways                bool
+	MetricsPushEnabled              bool
+}
diff --git a/shared/management/networkmap/nmdata/dns.go b/shared/management/networkmap/nmdata/dns.go
new file mode 100644
index 000000000..fe681af1a
--- /dev/null
+++ b/shared/management/networkmap/nmdata/dns.go
@@ -0,0 +1,18 @@
+package nmdata
+
+// SimpleRecord is the slim twin of dns.SimpleRecord.
+type SimpleRecord struct {
+	Name  string
+	Type  int
+	Class string
+	TTL   int
+	RData string
+}
+
+// CustomZone is the slim twin of dns.CustomZone.
+type CustomZone struct {
+	Domain               string
+	Records              []SimpleRecord
+	SearchDomainDisabled bool
+	NonAuthoritative     bool
+}
diff --git a/shared/management/networkmap/nmdata/dns_settings.go b/shared/management/networkmap/nmdata/dns_settings.go
new file mode 100644
index 000000000..69fd5f517
--- /dev/null
+++ b/shared/management/networkmap/nmdata/dns_settings.go
@@ -0,0 +1,6 @@
+package nmdata
+
+// DNSSettings is the slim twin of types.DNSSettings.
+type DNSSettings struct {
+	DisabledManagementGroups []string
+}
diff --git a/shared/management/networkmap/nmdata/group.go b/shared/management/networkmap/nmdata/group.go
new file mode 100644
index 000000000..1cd2cd15e
--- /dev/null
+++ b/shared/management/networkmap/nmdata/group.go
@@ -0,0 +1,30 @@
+package nmdata
+
+import "slices"
+
+// GroupAllName is the reserved name of the default group that contains every
+// peer in an account.
+const GroupAllName = "All"
+
+// Group is the slim twin of types.Group.
+type Group struct {
+	ID        string
+	Name      string
+	PublicID  string
+	Peers     []string
+	Resources []Resource
+}
+
+func (g *Group) IsGroupAll() bool {
+	return g.Name == GroupAllName
+}
+
+func (g *Group) Copy() *Group {
+	return &Group{
+		ID:        g.ID,
+		Name:      g.Name,
+		PublicID:  g.PublicID,
+		Peers:     slices.Clone(g.Peers),
+		Resources: slices.Clone(g.Resources),
+	}
+}
diff --git a/shared/management/networkmap/nmdata/group_test.go b/shared/management/networkmap/nmdata/group_test.go
new file mode 100644
index 000000000..20aaa240f
--- /dev/null
+++ b/shared/management/networkmap/nmdata/group_test.go
@@ -0,0 +1,84 @@
+package nmdata
+
+import (
+	"reflect"
+	"testing"
+)
+
+// TestGroupCopy_AllFieldsCopied fills every Group field with a unique non-zero
+// value derived from its field path, so a field added to Group but forgotten
+// in Copy fails here by name without the test needing an update. The unique
+// per-path values also catch fields swapped inside Copy.
+func TestGroupCopy_AllFieldsCopied(t *testing.T) {
+	src := &Group{}
+	seed := 0
+	fillValue(t, reflect.ValueOf(src).Elem(), "Group", &seed)
+
+	copied := src.Copy()
+
+	srcV := reflect.ValueOf(src).Elem()
+	copiedV := reflect.ValueOf(copied).Elem()
+	for i := 0; i < srcV.NumField(); i++ {
+		name := srcV.Type().Field(i).Name
+		if !reflect.DeepEqual(srcV.Field(i).Interface(), copiedV.Field(i).Interface()) {
+			t.Errorf("field %s not copied: src=%#v copy=%#v",
+				name, srcV.Field(i).Interface(), copiedV.Field(i).Interface())
+		}
+	}
+
+	for i := 0; i < srcV.NumField(); i++ {
+		f := srcV.Field(i)
+		if f.Kind() != reflect.Slice || f.Len() == 0 {
+			continue
+		}
+		name := srcV.Type().Field(i).Name
+		fillValue(t, f.Index(0), name+"-mutated", &seed)
+		if reflect.DeepEqual(f.Interface(), copiedV.Field(i).Interface()) {
+			t.Errorf("field %s shares memory with the copy", name)
+		}
+	}
+}
+
+// fillValue sets v to a deterministic non-zero value derived from its field
+// path. Kinds it does not handle fail the test loudly, so the filler is
+// extended together with the struct instead of silently under-testing new
+// fields.
+func fillValue(t *testing.T, v reflect.Value, path string, seed *int) {
+	t.Helper()
+
+	switch v.Kind() {
+	case reflect.String:
+		v.SetString(path)
+	case reflect.Bool:
+		v.SetBool(true)
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		*seed++
+		v.SetInt(int64(*seed))
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		*seed++
+		v.SetUint(uint64(*seed))
+	case reflect.Float32, reflect.Float64:
+		*seed++
+		v.SetFloat(float64(*seed))
+	case reflect.Slice:
+		s := reflect.MakeSlice(v.Type(), 2, 2)
+		fillValue(t, s.Index(0), path+"[0]", seed)
+		fillValue(t, s.Index(1), path+"[1]", seed)
+		v.Set(s)
+	case reflect.Struct:
+		settable := 0
+		for i := 0; i < v.NumField(); i++ {
+			f := v.Field(i)
+			if !f.CanSet() {
+				continue
+			}
+			settable++
+			fillValue(t, f, path+"."+v.Type().Field(i).Name, seed)
+		}
+		if settable == 0 {
+			t.Fatalf("struct %s at %s has no settable fields — extend fillValue to construct it", v.Type(), path)
+		}
+	default:
+		t.Fatalf("unsupported kind %s at %s — extend fillValue", v.Kind(), path)
+	}
+}
diff --git a/shared/management/networkmap/nmdata/nameserver.go b/shared/management/networkmap/nmdata/nameserver.go
new file mode 100644
index 000000000..2698dd8d0
--- /dev/null
+++ b/shared/management/networkmap/nmdata/nameserver.go
@@ -0,0 +1,24 @@
+package nmdata
+
+import "net/netip"
+
+// NameServerGroup is the slim twin of dns.NameServerGroup.
+type NameServerGroup struct {
+	ID                   string
+	PublicID             string
+	Name                 string
+	Description          string
+	NameServers          []NameServer
+	Groups               []string
+	Primary              bool
+	Domains              []string
+	Enabled              bool
+	SearchDomainsEnabled bool
+}
+
+// NameServer is the slim twin of dns.NameServer.
+type NameServer struct {
+	IP     netip.Addr
+	NSType int
+	Port   int
+}
diff --git a/shared/management/networkmap/nmdata/network.go b/shared/management/networkmap/nmdata/network.go
new file mode 100644
index 000000000..72b6502ef
--- /dev/null
+++ b/shared/management/networkmap/nmdata/network.go
@@ -0,0 +1,16 @@
+package nmdata
+
+import "net"
+
+// Network is the slim twin of types.Network.
+type Network struct {
+	Identifier string
+	Net        net.IPNet
+	NetV6      net.IPNet
+	Dns        string
+	Serial     int64
+}
+
+func (n *Network) CurrentSerial() uint64 {
+	return uint64(n.Serial)
+}
diff --git a/shared/management/networkmap/nmdata/network_resource.go b/shared/management/networkmap/nmdata/network_resource.go
new file mode 100644
index 000000000..44f3c477b
--- /dev/null
+++ b/shared/management/networkmap/nmdata/network_resource.go
@@ -0,0 +1,18 @@
+package nmdata
+
+import "net/netip"
+
+// NetworkResource is the slim twin of resources/types.NetworkResource.
+type NetworkResource struct {
+	ID          string
+	NetworkID   string
+	AccountID   string
+	PublicID    string
+	Name        string
+	Description string
+	Type        string
+	Address     string // TODO: isn't persisted in the DB
+	Domain      string
+	Prefix      netip.Prefix
+	Enabled     bool
+}
diff --git a/shared/management/networkmap/nmdata/network_router.go b/shared/management/networkmap/nmdata/network_router.go
new file mode 100644
index 000000000..fd5df37c4
--- /dev/null
+++ b/shared/management/networkmap/nmdata/network_router.go
@@ -0,0 +1,10 @@
+package nmdata
+
+// NetworkRouter is the slim twin of routers/types.NetworkRouter.
+type NetworkRouter struct {
+	PublicID   string
+	PeerGroups []string
+	Masquerade bool
+	Metric     int
+	Enabled    bool
+}
diff --git a/shared/management/networkmap/nmdata/peer.go b/shared/management/networkmap/nmdata/peer.go
new file mode 100644
index 000000000..7c606a02c
--- /dev/null
+++ b/shared/management/networkmap/nmdata/peer.go
@@ -0,0 +1,139 @@
+package nmdata
+
+import (
+	"net"
+	"net/netip"
+	"slices"
+	"time"
+)
+
+// Peer capability constants mirror the proto enum values.
+const (
+	PeerCapabilitySourcePrefixes      int32 = 1
+	PeerCapabilityIPv6Overlay         int32 = 2
+	PeerCapabilityComponentNetworkMap int32 = 3
+)
+
+// Peer is the slim twin of peer.Peer.
+type Peer struct {
+	ID                     string
+	Key                    string
+	SSHKey                 string
+	DNSLabel               string
+	UserID                 string
+	SSHEnabled             bool
+	LoginExpirationEnabled bool
+	LastLogin              *time.Time
+	IP                     netip.Addr
+	IPv6                   netip.Addr
+	RequiresApproval       bool
+	Connected              bool
+	ExtraDNSLabels         []string
+	Meta                   PeerSystemMeta
+	ProxyMeta              ProxyMeta
+	Location               PeerLocation
+}
+
+// ProxyMeta is the slim twin of peer.ProxyMeta.
+type ProxyMeta struct {
+	Embedded bool
+	Cluster  string
+}
+
+// ProxyDomain is the slim twin of a registered reverse-proxy domain, carrying
+// what private-service zone resolution needs: the apex a service domain can sit
+// under, and the cluster it is registered against.
+type ProxyDomain struct {
+	Domain        string
+	TargetCluster string
+}
+
+// PeerSystemMeta is the slim twin of peer.PeerSystemMeta.
+type PeerSystemMeta struct {
+	WtVersion          string
+	GoOS               string
+	OSVersion          string
+	KernelVersion      string
+	NetworkAddresses   []NetworkAddress
+	Files              []File
+	Certificates       []string
+	Capabilities       []int32
+	Flags              Flags
+	SyncMessageVersion int
+}
+
+// Flags is the slim twin of peer.Flags.
+type Flags struct {
+	ServerSSHAllowed bool
+	DisableIPv6      bool
+}
+
+// NetworkAddress is the slim twin of peer.NetworkAddress.
+type NetworkAddress struct {
+	NetIP netip.Prefix
+}
+
+// File is the slim twin of peer.File.
+type File struct {
+	Path             string
+	ProcessIsRunning bool
+}
+
+// PeerLocation is the slim twin of peer.Location.
+type PeerLocation struct {
+	CountryCode  string
+	CityName     string
+	ConnectionIP net.IP
+}
+
+func (p *Peer) HasCapability(capability int32) bool {
+	return slices.Contains(p.Meta.Capabilities, capability)
+}
+
+func (p *Peer) SupportsIPv6() bool {
+	return !p.Meta.Flags.DisableIPv6 && p.HasCapability(PeerCapabilityIPv6Overlay)
+}
+
+func (p *Peer) SupportsSourcePrefixes() bool {
+	return p.HasCapability(PeerCapabilitySourcePrefixes)
+}
+
+func (p *Peer) AddedWithSSOLogin() bool {
+	return p.UserID != ""
+}
+
+func (p *Peer) FQDN(dnsDomain string) string {
+	if dnsDomain == "" {
+		return ""
+	}
+	return p.DNSLabel + "." + dnsDomain
+}
+
+func (p *Peer) GetLastLogin() time.Time {
+	if p.LastLogin != nil {
+		return *p.LastLogin
+	}
+	return time.Time{}
+}
+
+// SessionExpiresAt mirrors peer.Peer.SessionExpiresAt.
+func (p *Peer) SessionExpiresAt(accountExpirationEnabled bool, expiresIn time.Duration) time.Time {
+	if !accountExpirationEnabled || !p.AddedWithSSOLogin() || !p.LoginExpirationEnabled {
+		return time.Time{}
+	}
+	last := p.GetLastLogin()
+	if last.IsZero() {
+		return time.Time{}
+	}
+	return last.Add(expiresIn).UTC()
+}
+
+func (p *Peer) LoginExpired(expiresIn time.Duration) (bool, time.Duration) {
+	if !p.AddedWithSSOLogin() || !p.LoginExpirationEnabled {
+		return false, 0
+	}
+	expiresAt := p.GetLastLogin().Add(expiresIn)
+	now := time.Now()
+	timeLeft := expiresAt.Sub(now)
+	return timeLeft <= 0, timeLeft
+}
diff --git a/shared/management/networkmap/nmdata/policy.go b/shared/management/networkmap/nmdata/policy.go
new file mode 100644
index 000000000..df0c77518
--- /dev/null
+++ b/shared/management/networkmap/nmdata/policy.go
@@ -0,0 +1,96 @@
+package nmdata
+
+const (
+	policyRuleProtocolALL = "all"
+	policyRuleProtocolTCP = "tcp"
+
+	defaultSSHPortString        = "22"
+	nativeSSHPortString         = "22022"
+	defaultSSHPortNumber uint16 = 22
+	nativeSSHPortNumber  uint16 = 22022
+)
+
+// Policy is the slim twin of types.Policy.
+type Policy struct {
+	ID                  string
+	PublicID            string
+	Enabled             bool
+	SourcePostureChecks []string
+	Rules               []*PolicyRule
+}
+
+// PolicyRule is the slim twin of types.PolicyRule.
+type PolicyRule struct {
+	ID                  string
+	PolicyID            string
+	Enabled             bool
+	Action              string
+	Protocol            string
+	Bidirectional       bool
+	Sources             []string
+	Destinations        []string
+	SourceResource      Resource
+	DestinationResource Resource
+	Ports               []string
+	PortRanges          []RulePortRange
+	AuthorizedGroups    map[string][]string
+	AuthorizedUser      string
+}
+
+// RulePortRange is the slim twin of types.RulePortRange.
+type RulePortRange struct {
+	Start uint16
+	End   uint16
+}
+
+// Resource is the slim twin of types.Resource.
+type Resource struct {
+	ID   string
+	Type string
+}
+
+func (p *Policy) SourceGroups() []string {
+	if len(p.Rules) == 1 && p.Rules[0] != nil {
+		return p.Rules[0].Sources
+	}
+	groups := make(map[string]struct{}, len(p.Rules))
+	for _, rule := range p.Rules {
+		if rule == nil {
+			continue
+		}
+		for _, source := range rule.Sources {
+			groups[source] = struct{}{}
+		}
+	}
+
+	groupIDs := make([]string, 0, len(groups))
+	for groupID := range groups {
+		groupIDs = append(groupIDs, groupID)
+	}
+
+	return groupIDs
+}
+
+// PolicyRuleImpliesLegacySSH is the twin-typed sibling of types.PolicyRuleImpliesLegacySSH.
+func PolicyRuleImpliesLegacySSH(rule *PolicyRule) bool {
+	return rule.Protocol == policyRuleProtocolALL ||
+		(rule.Protocol == policyRuleProtocolTCP && (portsIncludesSSH(rule.Ports) || portRangeIncludesSSH(rule.PortRanges)))
+}
+
+func portRangeIncludesSSH(portRanges []RulePortRange) bool {
+	for _, pr := range portRanges {
+		if (pr.Start <= defaultSSHPortNumber && pr.End >= defaultSSHPortNumber) || (pr.Start <= nativeSSHPortNumber && pr.End >= nativeSSHPortNumber) {
+			return true
+		}
+	}
+	return false
+}
+
+func portsIncludesSSH(ports []string) bool {
+	for _, port := range ports {
+		if port == defaultSSHPortString || port == nativeSSHPortString {
+			return true
+		}
+	}
+	return false
+}
diff --git a/shared/management/networkmap/nmdata/posture.go b/shared/management/networkmap/nmdata/posture.go
new file mode 100644
index 000000000..e7c37976b
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture.go
@@ -0,0 +1,87 @@
+package nmdata
+
+const (
+	checkActionAllow = "allow"
+	checkActionDeny  = "deny"
+)
+
+// PostureChecks is the slim twin of posture.Checks.
+type PostureChecks struct {
+	ID     string
+	Checks ChecksDefinition
+}
+
+// ChecksDefinition is the slim twin of posture.ChecksDefinition.
+type ChecksDefinition struct {
+	NBVersionCheck        *NBVersionCheck
+	OSVersionCheck        *OSVersionCheck
+	GeoLocationCheck      *GeoLocationCheck
+	PeerNetworkRangeCheck *PeerNetworkRangeCheck
+	ProcessCheck          *ProcessCheck
+	CertificateCheck      *CertificateCheck
+}
+
+// Check is the slim twin of posture.Check. It is sealed: only the check types
+// in this package implement it.
+type Check interface {
+	check(peer *Peer) (bool, error)
+}
+
+// Passes reports whether the peer satisfies every check in this bundle. It
+// mirrors the server posture path: a check returning (false, _) — including on
+// an evaluation error — fails the bundle.
+func (pc *PostureChecks) Passes(peer *Peer) bool {
+	return PassesChecks(pc.GetChecks(), peer)
+}
+
+// PassesChecks is Passes over an already built check set, for callers that
+// evaluate many peers against the same bundle.
+func PassesChecks(checks []Check, peer *Peer) bool {
+	for _, c := range checks {
+		valid, _ := c.check(peer)
+		if !valid {
+			return false
+		}
+	}
+	return true
+}
+
+// PostureVerdictChanged reports whether any check in the bundles gives a different
+// verdict for newPeer than for oldPeer. Checks are replayed one by one, so a change
+// that moves a field but stays on the same side of a threshold does not count. An
+// evaluation error is a deny, like in PassesChecks.
+func PostureVerdictChanged(checks []*PostureChecks, oldPeer, newPeer *Peer) bool {
+	for _, pc := range checks {
+		for _, c := range pc.GetChecks() {
+			single := []Check{c}
+			if PassesChecks(single, oldPeer) != PassesChecks(single, newPeer) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// GetChecks returns the initialized checks in the same order as posture.Checks.GetChecks.
+func (pc *PostureChecks) GetChecks() []Check {
+	var checks []Check
+	if pc.Checks.NBVersionCheck != nil {
+		checks = append(checks, pc.Checks.NBVersionCheck)
+	}
+	if pc.Checks.OSVersionCheck != nil {
+		checks = append(checks, pc.Checks.OSVersionCheck)
+	}
+	if pc.Checks.GeoLocationCheck != nil {
+		checks = append(checks, pc.Checks.GeoLocationCheck)
+	}
+	if pc.Checks.PeerNetworkRangeCheck != nil {
+		checks = append(checks, pc.Checks.PeerNetworkRangeCheck)
+	}
+	if pc.Checks.ProcessCheck != nil {
+		checks = append(checks, pc.Checks.ProcessCheck)
+	}
+	if pc.Checks.CertificateCheck != nil {
+		checks = append(checks, pc.Checks.CertificateCheck)
+	}
+	return checks
+}
diff --git a/shared/management/networkmap/nmdata/posture_certificate.go b/shared/management/networkmap/nmdata/posture_certificate.go
new file mode 100644
index 000000000..37cfd4b5b
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture_certificate.go
@@ -0,0 +1,16 @@
+package nmdata
+
+import (
+	"time"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// CertificateCheck is the slim twin of posture.CertificateCheck.
+type CertificateCheck struct {
+	CACertificates []string
+}
+
+func (c *CertificateCheck) check(peer *Peer) (bool, error) {
+	return certposture.AnyChainMatchesCAs(peer.Meta.Certificates, c.CACertificates, time.Now()), nil
+}
diff --git a/shared/management/networkmap/nmdata/posture_certificate_test.go b/shared/management/networkmap/nmdata/posture_certificate_test.go
new file mode 100644
index 000000000..aa67dab77
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture_certificate_test.go
@@ -0,0 +1,28 @@
+package nmdata
+
+import (
+	"crypto/x509"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+func TestCertificateCheck_Check(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	otherCA := certtest.NewCA(t, "other-root")
+	chain := certposture.EncodeChainPEM([]*x509.Certificate{ca.Issue(t, certtest.ECDSAKey(t), "device")})
+
+	c := bundle(ChecksDefinition{CertificateCheck: &CertificateCheck{CACertificates: []string{ca.PEM}}})
+	without := &Peer{}
+	with := &Peer{Meta: PeerSystemMeta{Certificates: []string{chain}}}
+
+	assert.False(t, c[0].Passes(without))
+	assert.True(t, c[0].Passes(with))
+	assert.True(t, PostureVerdictChanged(c, without, with))
+
+	otherOnly := bundle(ChecksDefinition{CertificateCheck: &CertificateCheck{CACertificates: []string{otherCA.PEM}}})
+	assert.False(t, otherOnly[0].Passes(with))
+}
diff --git a/shared/management/networkmap/nmdata/posture_geo_location.go b/shared/management/networkmap/nmdata/posture_geo_location.go
new file mode 100644
index 000000000..18b0919b2
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture_geo_location.go
@@ -0,0 +1,45 @@
+package nmdata
+
+import "fmt"
+
+// GeoLocation is the slim twin of posture.Location.
+type GeoLocation struct {
+	CountryCode string
+	CityName    string
+}
+
+// GeoLocationCheck is the slim twin of posture.GeoLocationCheck.
+type GeoLocationCheck struct {
+	Locations []GeoLocation
+	Action    string
+}
+
+func (g *GeoLocationCheck) check(peer *Peer) (bool, error) {
+	if peer.Location.CountryCode == "" && peer.Location.CityName == "" {
+		return false, fmt.Errorf("peer's location is not set")
+	}
+
+	for _, loc := range g.Locations {
+		if loc.CountryCode == peer.Location.CountryCode {
+			if loc.CityName == "" || loc.CityName == peer.Location.CityName {
+				switch g.Action {
+				case checkActionDeny:
+					return false, nil
+				case checkActionAllow:
+					return true, nil
+				default:
+					return false, fmt.Errorf("invalid geo location action: %s", g.Action)
+				}
+			}
+		}
+	}
+
+	if g.Action == checkActionDeny {
+		return true, nil
+	}
+	if g.Action == checkActionAllow {
+		return false, nil
+	}
+
+	return false, fmt.Errorf("invalid geo location action: %s", g.Action)
+}
diff --git a/shared/management/networkmap/nmdata/posture_nb_version.go b/shared/management/networkmap/nmdata/posture_nb_version.go
new file mode 100644
index 000000000..3d82a4c80
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture_nb_version.go
@@ -0,0 +1,38 @@
+package nmdata
+
+import (
+	"strings"
+
+	"github.com/hashicorp/go-version"
+)
+
+// NBVersionCheck is the slim twin of posture.NBVersionCheck.
+type NBVersionCheck struct {
+	MinVersion string
+}
+
+func (n *NBVersionCheck) check(peer *Peer) (bool, error) {
+	return meetsMinVersion(n.MinVersion, peer.Meta.WtVersion)
+}
+
+func meetsMinVersion(minVer, peerVer string) (bool, error) {
+	peerVer = sanitizeVersion(peerVer)
+	minVer = sanitizeVersion(minVer)
+
+	peerNBVer, err := version.NewVersion(peerVer)
+	if err != nil {
+		return false, err
+	}
+
+	constraints, err := version.NewConstraint(">= " + minVer)
+	if err != nil {
+		return false, err
+	}
+
+	return constraints.Check(peerNBVer), nil
+}
+
+func sanitizeVersion(v string) string {
+	parts := strings.Split(v, "-")
+	return parts[0]
+}
diff --git a/shared/management/networkmap/nmdata/posture_network.go b/shared/management/networkmap/nmdata/posture_network.go
new file mode 100644
index 000000000..d8dd2cf00
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture_network.go
@@ -0,0 +1,62 @@
+package nmdata
+
+import (
+	"fmt"
+	"net/netip"
+)
+
+// PeerNetworkRangeCheck is the slim twin of posture.PeerNetworkRangeCheck.
+type PeerNetworkRangeCheck struct {
+	Action string
+	Ranges []netip.Prefix
+}
+
+func (p *PeerNetworkRangeCheck) check(peer *Peer) (bool, error) {
+	peerPrefixes := make([]netip.Prefix, 0, len(peer.Meta.NetworkAddresses)+1)
+	for _, peerNetAddr := range peer.Meta.NetworkAddresses {
+		peerPrefixes = append(peerPrefixes, peerNetAddr.NetIP)
+	}
+	if connIP := peer.Location.ConnectionIP; len(connIP) > 0 {
+		if addr, ok := netip.AddrFromSlice(connIP); ok {
+			addr = addr.Unmap()
+			peerPrefixes = append(peerPrefixes, netip.PrefixFrom(addr, addr.BitLen()))
+		}
+	}
+
+	if len(peerPrefixes) == 0 {
+		return false, fmt.Errorf("peer's does not contain peer network range addresses")
+	}
+
+	for _, peerPrefix := range peerPrefixes {
+		for _, rangePrefix := range p.Ranges {
+			if !prefixContains(rangePrefix, peerPrefix) {
+				continue
+			}
+			switch p.Action {
+			case checkActionDeny:
+				return false, nil
+			case checkActionAllow:
+				return true, nil
+			default:
+				return false, fmt.Errorf("invalid peer network range check action: %s", p.Action)
+			}
+		}
+	}
+
+	if p.Action == checkActionDeny {
+		return true, nil
+	}
+	if p.Action == checkActionAllow {
+		return false, nil
+	}
+
+	return false, fmt.Errorf("invalid peer network range check action: %s", p.Action)
+}
+
+func prefixContains(outer, inner netip.Prefix) bool {
+	outer = outer.Masked()
+	inner = inner.Masked()
+	return outer.Bits() <= inner.Bits() &&
+		outer.Addr().BitLen() == inner.Addr().BitLen() &&
+		outer.Contains(inner.Addr())
+}
diff --git a/shared/management/networkmap/nmdata/posture_os_version.go b/shared/management/networkmap/nmdata/posture_os_version.go
new file mode 100644
index 000000000..779bd2ac3
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture_os_version.go
@@ -0,0 +1,79 @@
+package nmdata
+
+import (
+	"strings"
+
+	"github.com/hashicorp/go-version"
+)
+
+// MinVersionCheck is the slim twin of posture.MinVersionCheck.
+type MinVersionCheck struct {
+	MinVersion string
+}
+
+// MinKernelVersionCheck is the slim twin of posture.MinKernelVersionCheck.
+type MinKernelVersionCheck struct {
+	MinKernelVersion string
+}
+
+// OSVersionCheck is the slim twin of posture.OSVersionCheck.
+type OSVersionCheck struct {
+	Android *MinVersionCheck
+	Darwin  *MinVersionCheck
+	Ios     *MinVersionCheck
+	Linux   *MinKernelVersionCheck
+	Windows *MinKernelVersionCheck
+}
+
+func (c *OSVersionCheck) check(peer *Peer) (bool, error) {
+	switch peer.Meta.GoOS {
+	case "android":
+		return checkMinVersion(peer.Meta.OSVersion, c.Android)
+	case "darwin":
+		return checkMinVersion(peer.Meta.OSVersion, c.Darwin)
+	case "ios":
+		return checkMinVersion(peer.Meta.OSVersion, c.Ios)
+	case "linux":
+		kernelVersion := strings.Split(peer.Meta.KernelVersion, "-")[0]
+		return checkMinKernelVersion(kernelVersion, c.Linux)
+	case "windows":
+		return checkMinKernelVersion(peer.Meta.KernelVersion, c.Windows)
+	}
+	return true, nil
+}
+
+func checkMinVersion(peerVersion string, check *MinVersionCheck) (bool, error) {
+	if check == nil {
+		return false, nil
+	}
+
+	peerNBVersion, err := version.NewVersion(peerVersion)
+	if err != nil {
+		return false, err
+	}
+
+	constraints, err := version.NewConstraint(">= " + check.MinVersion)
+	if err != nil {
+		return false, err
+	}
+
+	return constraints.Check(peerNBVersion), nil
+}
+
+func checkMinKernelVersion(peerVersion string, check *MinKernelVersionCheck) (bool, error) {
+	if check == nil {
+		return false, nil
+	}
+
+	peerNBVersion, err := version.NewVersion(peerVersion)
+	if err != nil {
+		return false, err
+	}
+
+	constraints, err := version.NewConstraint(">= " + check.MinKernelVersion)
+	if err != nil {
+		return false, err
+	}
+
+	return constraints.Check(peerNBVersion), nil
+}
diff --git a/shared/management/networkmap/nmdata/posture_process.go b/shared/management/networkmap/nmdata/posture_process.go
new file mode 100644
index 000000000..3d35613b5
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture_process.go
@@ -0,0 +1,56 @@
+package nmdata
+
+import (
+	"fmt"
+	"slices"
+)
+
+// Process is the slim twin of posture.Process.
+type Process struct {
+	LinuxPath   string
+	MacPath     string
+	WindowsPath string
+}
+
+// ProcessCheck is the slim twin of posture.ProcessCheck.
+type ProcessCheck struct {
+	Processes []Process
+}
+
+func (p *ProcessCheck) check(peer *Peer) (bool, error) {
+	peerActiveProcesses := extractPeerActiveProcesses(peer.Meta.Files)
+
+	var pathSelector func(Process) string
+	switch peer.Meta.GoOS {
+	case "linux":
+		pathSelector = func(process Process) string { return process.LinuxPath }
+	case "darwin":
+		pathSelector = func(process Process) string { return process.MacPath }
+	case "windows":
+		pathSelector = func(process Process) string { return process.WindowsPath }
+	default:
+		return false, fmt.Errorf("unsupported peer's operating system: %s", peer.Meta.GoOS)
+	}
+
+	return p.areAllProcessesRunning(peerActiveProcesses, pathSelector), nil
+}
+
+func (p *ProcessCheck) areAllProcessesRunning(activeProcesses []string, pathSelector func(Process) string) bool {
+	for _, process := range p.Processes {
+		path := pathSelector(process)
+		if path == "" || !slices.Contains(activeProcesses, path) {
+			return false
+		}
+	}
+	return true
+}
+
+func extractPeerActiveProcesses(files []File) []string {
+	activeProcesses := make([]string, 0, len(files))
+	for _, file := range files {
+		if file.ProcessIsRunning {
+			activeProcesses = append(activeProcesses, file.Path)
+		}
+	}
+	return activeProcesses
+}
diff --git a/shared/management/networkmap/nmdata/posture_test.go b/shared/management/networkmap/nmdata/posture_test.go
new file mode 100644
index 000000000..13e5f268e
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture_test.go
@@ -0,0 +1,54 @@
+package nmdata
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func bundle(def ChecksDefinition) []*PostureChecks {
+	return []*PostureChecks{{Checks: def}}
+}
+
+func TestPostureVerdictChanged_ErrorCountsAsDeny(t *testing.T) {
+	c := bundle(ChecksDefinition{NBVersionCheck: &NBVersionCheck{MinVersion: "1.2.0"}})
+
+	tests := []struct {
+		name           string
+		oldVer, newVer string
+		want           bool
+	}{
+		{"both above min, no flip", "1.3.0", "1.4.0", false},
+		{"crosses up below->above", "1.1.0", "1.3.0", true},
+		{"unparsable old only -> flip", "garbage", "1.3.0", true},
+		{"unparsable both -> no flip", "garbage", "junk", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			oldPeer := &Peer{Meta: PeerSystemMeta{WtVersion: tt.oldVer}}
+			newPeer := &Peer{Meta: PeerSystemMeta{WtVersion: tt.newVer}}
+			assert.Equal(t, tt.want, PostureVerdictChanged(c, oldPeer, newPeer))
+		})
+	}
+}
+
+func TestPostureVerdictChanged_ReplaysEachCheck(t *testing.T) {
+	// Old fails the version check, new fails the kernel check: the bundle denies on
+	// both sides, yet every single check flipped, so the posture must be re-evaluated.
+	c := bundle(ChecksDefinition{
+		NBVersionCheck: &NBVersionCheck{MinVersion: "1.0.0"},
+		OSVersionCheck: &OSVersionCheck{Linux: &MinKernelVersionCheck{MinKernelVersion: "5.0.0"}},
+	})
+	oldPeer := &Peer{Meta: PeerSystemMeta{WtVersion: "0.9.0", GoOS: "linux", KernelVersion: "6.0.0"}}
+	newPeer := &Peer{Meta: PeerSystemMeta{WtVersion: "1.1.0", GoOS: "linux", KernelVersion: "4.0.0"}}
+
+	assert.False(t, c[0].Passes(oldPeer))
+	assert.False(t, c[0].Passes(newPeer))
+	assert.True(t, PostureVerdictChanged(c, oldPeer, newPeer))
+}
+
+func TestPostureVerdictChanged_NoChecks(t *testing.T) {
+	oldPeer := &Peer{Meta: PeerSystemMeta{WtVersion: "1.0.0"}}
+	newPeer := &Peer{Meta: PeerSystemMeta{WtVersion: "2.0.0"}}
+	assert.False(t, PostureVerdictChanged(nil, oldPeer, newPeer))
+}
diff --git a/shared/management/networkmap/nmdata/route.go b/shared/management/networkmap/nmdata/route.go
new file mode 100644
index 000000000..e2301f094
--- /dev/null
+++ b/shared/management/networkmap/nmdata/route.go
@@ -0,0 +1,108 @@
+package nmdata
+
+import (
+	"net/netip"
+	"slices"
+	"strings"
+
+	"github.com/netbirdio/netbird/shared/management/domain"
+)
+
+// NetworkType mirrors route.NetworkType iota values.
+const (
+	NetworkTypeInvalid = 0
+	NetworkTypeIPv4    = 1
+	NetworkTypeIPv6    = 2
+	NetworkTypeDomain  = 3
+
+	haSeparator = "|"
+)
+
+// Route is the slim twin of route.Route.
+type Route struct {
+	ID                  string
+	AccountID           string
+	PublicID            string
+	Network             netip.Prefix
+	Domains             domain.List
+	KeepRoute           bool
+	NetID               string
+	Description         string
+	Peer                string
+	PeerID              string
+	PeerGroups          []string
+	NetworkType         int
+	Masquerade          bool
+	Metric              int
+	Enabled             bool
+	Groups              []string
+	AccessControlGroups []string
+	SkipAutoApply       bool
+}
+
+func (r *Route) Equal(other *Route) bool {
+	if r == nil && other == nil {
+		return true
+	} else if r == nil || other == nil {
+		return false
+	}
+
+	return other.ID == r.ID &&
+		other.Description == r.Description &&
+		other.NetID == r.NetID &&
+		other.Network == r.Network &&
+		slices.Equal(r.Domains, other.Domains) &&
+		other.KeepRoute == r.KeepRoute &&
+		other.NetworkType == r.NetworkType &&
+		other.Peer == r.Peer &&
+		other.PeerID == r.PeerID &&
+		other.Metric == r.Metric &&
+		other.Masquerade == r.Masquerade &&
+		other.Enabled == r.Enabled &&
+		slices.Equal(r.Groups, other.Groups) &&
+		slices.Equal(r.PeerGroups, other.PeerGroups) &&
+		slices.Equal(r.AccessControlGroups, other.AccessControlGroups) &&
+		other.SkipAutoApply == r.SkipAutoApply
+}
+
+func (r *Route) IsDynamic() bool {
+	return r.NetworkType == NetworkTypeDomain
+}
+
+func (r *Route) NetString() string {
+	if r.IsDynamic() && r.Domains != nil {
+		return r.Domains.SafeString()
+	}
+	return r.Network.String()
+}
+
+func (r *Route) GetHAUniqueID() string {
+	return r.NetID + haSeparator + r.NetString()
+}
+
+func (r *Route) GetResourceID() string {
+	return strings.Split(r.ID, ":")[0]
+}
+
+func (r *Route) Copy() *Route {
+	return &Route{
+		ID:                  r.ID,
+		AccountID:           r.AccountID,
+		PublicID:            r.PublicID,
+		Network:             r.Network,
+		Domains:             slices.Clone(r.Domains),
+		KeepRoute:           r.KeepRoute,
+		NetID:               r.NetID,
+		Description:         r.Description,
+		Peer:                r.Peer,
+		PeerID:              r.PeerID,
+		PeerGroups:          slices.Clone(r.PeerGroups),
+		NetworkType:         r.NetworkType,
+		Masquerade:          r.Masquerade,
+		Metric:              r.Metric,
+		Enabled:             r.Enabled,
+		Groups:              slices.Clone(r.Groups),
+		AccessControlGroups: slices.Clone(r.AccessControlGroups),
+		SkipAutoApply:       r.SkipAutoApply,
+	}
+}
diff --git a/shared/management/networkmap/nmdata/service.go b/shared/management/networkmap/nmdata/service.go
new file mode 100644
index 000000000..a28e7a954
--- /dev/null
+++ b/shared/management/networkmap/nmdata/service.go
@@ -0,0 +1,26 @@
+package nmdata
+
+// Service is the slim twin of the reverse-proxy service.Service. It carries
+// only the state proxy-policy injection reads: the persisted reverse-proxy
+// services and the in-memory ones synthesised from agent-network state, which
+// are never written to the database.
+type Service struct {
+	ID           string
+	Enabled      bool
+	Private      bool
+	Mode         string
+	Domain       string
+	ProxyCluster string
+	AccessGroups []string
+	Targets      []*ServiceTarget
+}
+
+// ServiceTarget is the slim twin of service.Target.
+type ServiceTarget struct {
+	Enabled    bool
+	Path       string
+	Port       uint16
+	Protocol   string
+	TargetID   string
+	TargetType string
+}
diff --git a/shared/management/networkmap/peers_custom_zone.go b/shared/management/networkmap/peers_custom_zone.go
new file mode 100644
index 000000000..063844358
--- /dev/null
+++ b/shared/management/networkmap/peers_custom_zone.go
@@ -0,0 +1,111 @@
+package networkmap
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/hashicorp/go-multierror"
+	"github.com/miekg/dns"
+	log "github.com/sirupsen/logrus"
+
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const peersZoneRecordTTL = 300
+
+// PeersCustomZone builds the peers DNS zone from twin peer rows. It is the
+// single source of the zone-record logic; Account.GetPeersCustomZone delegates
+// here via twins.
+func PeersCustomZone(ctx context.Context, accountID string, dnsDomain string, peers map[string]*nmdata.Peer, ipv6AllowedPeers map[string]struct{}) nmdata.CustomZone {
+	var merr *multierror.Error
+
+	if dnsDomain == "" {
+		log.WithContext(ctx).Error("no dns domain is set, returning empty zone")
+		return nmdata.CustomZone{}
+	}
+
+	customZone := nmdata.CustomZone{
+		Domain:  dns.Fqdn(dnsDomain),
+		Records: make([]nmdata.SimpleRecord, 0, len(peers)),
+	}
+
+	domainSuffix := "." + dnsDomain
+
+	var sb strings.Builder
+	for _, peer := range peers {
+		if peer == nil {
+			continue
+		}
+		if peer.DNSLabel == "" {
+			merr = multierror.Append(merr, fmt.Errorf("peer %s has an empty DNS label", peer.ID))
+			continue
+		}
+
+		sb.Grow(len(peer.DNSLabel) + len(domainSuffix))
+		sb.WriteString(peer.DNSLabel)
+		sb.WriteString(domainSuffix)
+
+		fqdn := sb.String()
+		customZone.Records = append(customZone.Records, nmdata.SimpleRecord{
+			Name:  fqdn,
+			Type:  int(dns.TypeA),
+			Class: nbdns.DefaultClass,
+			TTL:   peersZoneRecordTTL,
+			RData: peer.IP.String(),
+		})
+		// Only advertise AAAA for peers that have a valid IPv6, whose client supports it,
+		// and that belong to an IPv6-enabled group. Old clients don't configure v6 on their
+		// WireGuard interface, so resolving their AAAA causes connections to hang.
+		// Capability changes (client upgrade/downgrade, --disable-ipv6 toggle) propagate
+		// to other peers via SyncPeer/LoginPeer regardless of version change, so AAAA
+		// records refresh when a peer first reports the IPv6 overlay capability.
+		_, peerAllowed := ipv6AllowedPeers[peer.ID]
+		hasIPv6 := peer.IPv6.IsValid() && peer.SupportsIPv6() && peerAllowed
+		if hasIPv6 {
+			customZone.Records = append(customZone.Records, nmdata.SimpleRecord{
+				Name:  fqdn,
+				Type:  int(dns.TypeAAAA),
+				Class: nbdns.DefaultClass,
+				TTL:   peersZoneRecordTTL,
+				RData: peer.IPv6.String(),
+			})
+		}
+		sb.Reset()
+
+		for _, extraLabel := range peer.ExtraDNSLabels {
+			sb.Grow(len(extraLabel) + len(domainSuffix))
+			sb.WriteString(extraLabel)
+			sb.WriteString(domainSuffix)
+
+			extraFqdn := sb.String()
+			customZone.Records = append(customZone.Records, nmdata.SimpleRecord{
+				Name:  extraFqdn,
+				Type:  int(dns.TypeA),
+				Class: nbdns.DefaultClass,
+				TTL:   peersZoneRecordTTL,
+				RData: peer.IP.String(),
+			})
+			if hasIPv6 {
+				customZone.Records = append(customZone.Records, nmdata.SimpleRecord{
+					Name:  extraFqdn,
+					Type:  int(dns.TypeAAAA),
+					Class: nbdns.DefaultClass,
+					TTL:   peersZoneRecordTTL,
+					RData: peer.IPv6.String(),
+				})
+			}
+			sb.Reset()
+		}
+
+	}
+
+	go func() {
+		if merr != nil {
+			log.WithContext(ctx).Errorf("error generating custom zone for account %s: %v", accountID, merr)
+		}
+	}()
+
+	return customZone
+}
diff --git a/shared/management/networkmap/privatezones.go b/shared/management/networkmap/privatezones.go
new file mode 100644
index 000000000..07643c7af
--- /dev/null
+++ b/shared/management/networkmap/privatezones.go
@@ -0,0 +1,124 @@
+package networkmap
+
+import (
+	"slices"
+	"strings"
+
+	"github.com/miekg/dns"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+// privateServiceDNSRecordTTL is short so proxy-peer changes propagate quickly.
+const privateServiceDNSRecordTTL = 5
+
+// BuildPrivateServiceCandidates derives the per-service DNS records a private
+// service publishes, from the twin's own services. It is the counterpart of
+// InjectProxyPolicies: that one synthesises the ACL half of a private service,
+// this one the DNS half, and both read nmd.Services so a service added to the
+// twin after it was loaded — an agent-network service is synthesised in memory
+// and never persisted — reaches the peer with both halves rather than one.
+//
+// The per-peer access-group gate and the merge by apex stay in the components
+// calculation; this only precomputes what is account-wide.
+func (nmd *NetworkMapData) BuildPrivateServiceCandidates() {
+	if len(nmd.Services) == 0 {
+		nmd.PrivateServiceCandidates = nil
+		return
+	}
+
+	proxyPeersByCluster := nmd.connectedProxyPeersByCluster()
+	if len(proxyPeersByCluster) == 0 {
+		nmd.PrivateServiceCandidates = nil
+		return
+	}
+
+	var out []PrivateServiceCandidate
+	for _, svc := range nmd.Services {
+		if svc == nil || !svc.Enabled || !svc.Private || len(svc.AccessGroups) == 0 || svc.Domain == "" {
+			continue
+		}
+		proxyPeers := proxyPeersByCluster[svc.ProxyCluster]
+		if len(proxyPeers) == 0 {
+			continue
+		}
+		apex := nmd.privateServiceApex(svc)
+		if apex == "" {
+			continue
+		}
+
+		records := make([]nmdata.SimpleRecord, 0, len(proxyPeers))
+		for _, p := range proxyPeers {
+			records = append(records, nmdata.SimpleRecord{
+				Name:  dns.Fqdn(svc.Domain),
+				Type:  int(dns.TypeA),
+				Class: "IN",
+				TTL:   privateServiceDNSRecordTTL,
+				RData: p.IP.String(),
+			})
+		}
+
+		out = append(out, PrivateServiceCandidate{
+			AccessGroups: svc.AccessGroups,
+			Zone: nmdata.CustomZone{
+				// NonAuthoritative keeps the zone match-only, so names without
+				// an explicit record fall through to the upstream resolver
+				// instead of returning NXDOMAIN for the whole apex.
+				Domain:               dns.Fqdn(apex),
+				Records:              records,
+				NonAuthoritative:     true,
+				SearchDomainDisabled: true,
+			},
+		})
+	}
+
+	nmd.PrivateServiceCandidates = out
+}
+
+// privateServiceApex resolves the zone a service's record hangs under: the
+// cluster when the service sits directly beneath it, otherwise the longest
+// registered custom domain pointing at that same cluster. A service whose
+// domain matches no registered apex publishes nothing, since a zone the client
+// never intercepts cannot answer the query.
+func (nmd *NetworkMapData) privateServiceApex(svc *nmdata.Service) string {
+	if domainUnderSuffix(svc.Domain, svc.ProxyCluster) {
+		return svc.ProxyCluster
+	}
+
+	apex := ""
+	for _, d := range nmd.Domains {
+		if d.TargetCluster != svc.ProxyCluster {
+			continue
+		}
+		if domainUnderSuffix(svc.Domain, d.Domain) && len(d.Domain) > len(apex) {
+			apex = d.Domain
+		}
+	}
+	return apex
+}
+
+func domainUnderSuffix(domain, suffix string) bool {
+	if suffix == "" {
+		return false
+	}
+	return domain == suffix || strings.HasSuffix(domain, "."+suffix)
+}
+
+// connectedProxyPeersByCluster groups the account's embedded proxy peers by the
+// cluster they serve, keeping only connected ones.
+func (nmd *NetworkMapData) connectedProxyPeersByCluster() map[string][]*nmdata.Peer {
+	var out map[string][]*nmdata.Peer
+	for _, peer := range nmd.Peers {
+		if peer == nil || !peer.ProxyMeta.Embedded || !peer.Connected || !peer.IP.IsValid() {
+			continue
+		}
+		if out == nil {
+			out = make(map[string][]*nmdata.Peer)
+		}
+		out[peer.ProxyMeta.Cluster] = append(out[peer.ProxyMeta.Cluster], peer)
+	}
+	for _, peers := range out {
+		slices.SortFunc(peers, func(a, b *nmdata.Peer) int { return strings.Compare(a.ID, b.ID) })
+	}
+	return out
+}
diff --git a/shared/management/networkmap/privatezones_test.go b/shared/management/networkmap/privatezones_test.go
new file mode 100644
index 000000000..5700fcf79
--- /dev/null
+++ b/shared/management/networkmap/privatezones_test.go
@@ -0,0 +1,148 @@
+package networkmap
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+func proxyPeer(id, ip, cluster string, connected bool) *nmdata.Peer {
+	return &nmdata.Peer{
+		ID: id, Key: id + "-key", IP: netip.MustParseAddr(ip), Connected: connected,
+		ProxyMeta: nmdata.ProxyMeta{Embedded: true, Cluster: cluster},
+	}
+}
+
+func privateService(id, domain, cluster string, groups ...string) *nmdata.Service {
+	return &nmdata.Service{
+		ID: id, Enabled: true, Private: true, Mode: "http",
+		Domain: domain, ProxyCluster: cluster, AccessGroups: groups,
+	}
+}
+
+func twinWithProxy(services ...*nmdata.Service) *NetworkMapData {
+	return &NetworkMapData{
+		Peers: map[string]*nmdata.Peer{
+			"proxy-1": proxyPeer("proxy-1", "100.64.0.99", "eu.proxy.netbird.io", true),
+		},
+		Services: services,
+	}
+}
+
+// An agent-network service is synthesised in memory and never persisted, so it
+// only ever reaches the twin through nmd.Services. Deriving the zone from that
+// same field is what stops it from arriving with an ACL and no name.
+func TestBuildPrivateServiceCandidates_SynthesisedServiceGetsAZone(t *testing.T) {
+	nmd := twinWithProxy(privateService(
+		"agent-network-acct-1", "acct-1.agent.netbird.io", "eu.proxy.netbird.io", "grp-admins"))
+
+	nmd.BuildPrivateServiceCandidates()
+
+	require.Len(t, nmd.PrivateServiceCandidates, 0,
+		"a service whose domain sits under no registered apex publishes nothing")
+
+	nmd.Domains = []nmdata.ProxyDomain{
+		{Domain: "agent.netbird.io", TargetCluster: "eu.proxy.netbird.io"},
+	}
+	nmd.BuildPrivateServiceCandidates()
+
+	require.Len(t, nmd.PrivateServiceCandidates, 1)
+	got := nmd.PrivateServiceCandidates[0]
+	assert.Equal(t, []string{"grp-admins"}, got.AccessGroups)
+	assert.Equal(t, "agent.netbird.io.", got.Zone.Domain, "apex is the registered domain, not the service FQDN")
+	assert.True(t, got.Zone.NonAuthoritative, "zone stays match-only")
+	assert.True(t, got.Zone.SearchDomainDisabled)
+	require.Len(t, got.Zone.Records, 1)
+	assert.Equal(t, nmdata.SimpleRecord{
+		Name: "acct-1.agent.netbird.io.", Type: 1, Class: "IN", TTL: 5, RData: "100.64.0.99",
+	}, got.Zone.Records[0])
+}
+
+func TestBuildPrivateServiceCandidates_ClusterApexNeedsNoRegisteredDomain(t *testing.T) {
+	nmd := twinWithProxy(privateService("svc-1", "myapp.eu.proxy.netbird.io", "eu.proxy.netbird.io", "grp-admins"))
+
+	nmd.BuildPrivateServiceCandidates()
+
+	require.Len(t, nmd.PrivateServiceCandidates, 1)
+	assert.Equal(t, "eu.proxy.netbird.io.", nmd.PrivateServiceCandidates[0].Zone.Domain)
+}
+
+func TestBuildPrivateServiceCandidates_LongestRegisteredApexWins(t *testing.T) {
+	nmd := twinWithProxy(privateService("svc-1", "app.sub.example.com", "eu.proxy.netbird.io", "grp-admins"))
+	nmd.Domains = []nmdata.ProxyDomain{
+		{Domain: "example.com", TargetCluster: "eu.proxy.netbird.io"},
+		{Domain: "sub.example.com", TargetCluster: "eu.proxy.netbird.io"},
+		{Domain: "other.com", TargetCluster: "eu.proxy.netbird.io"},
+	}
+
+	nmd.BuildPrivateServiceCandidates()
+
+	require.Len(t, nmd.PrivateServiceCandidates, 1)
+	assert.Equal(t, "sub.example.com.", nmd.PrivateServiceCandidates[0].Zone.Domain)
+}
+
+func TestBuildPrivateServiceCandidates_RegisteredApexOfAnotherClusterIsIgnored(t *testing.T) {
+	nmd := twinWithProxy(privateService("svc-1", "app.example.com", "eu.proxy.netbird.io", "grp-admins"))
+	nmd.Domains = []nmdata.ProxyDomain{
+		{Domain: "example.com", TargetCluster: "us.proxy.netbird.io"},
+	}
+
+	nmd.BuildPrivateServiceCandidates()
+
+	assert.Empty(t, nmd.PrivateServiceCandidates)
+}
+
+// A disconnected proxy peer's tunnel IP does not answer, so publishing it
+// black-holes the name for as long as a client caches the record.
+func TestBuildPrivateServiceCandidates_OnlyConnectedProxyPeersSurface(t *testing.T) {
+	nmd := twinWithProxy(privateService("svc-1", "myapp.eu.proxy.netbird.io", "eu.proxy.netbird.io", "grp-admins"))
+	nmd.Peers["proxy-2"] = proxyPeer("proxy-2", "100.64.0.100", "eu.proxy.netbird.io", false)
+
+	nmd.BuildPrivateServiceCandidates()
+
+	require.Len(t, nmd.PrivateServiceCandidates, 1)
+	require.Len(t, nmd.PrivateServiceCandidates[0].Zone.Records, 1)
+	assert.Equal(t, "100.64.0.99", nmd.PrivateServiceCandidates[0].Zone.Records[0].RData)
+
+	nmd.Peers["proxy-1"].Connected = false
+	nmd.BuildPrivateServiceCandidates()
+	assert.Empty(t, nmd.PrivateServiceCandidates, "no connected proxy peer means no zone at all")
+}
+
+func TestBuildPrivateServiceCandidates_SkipsServicesThatGrantNothing(t *testing.T) {
+	cases := map[string]func(*nmdata.Service){
+		"disabled":         func(s *nmdata.Service) { s.Enabled = false },
+		"not private":      func(s *nmdata.Service) { s.Private = false },
+		"no access groups": func(s *nmdata.Service) { s.AccessGroups = nil },
+		"no domain":        func(s *nmdata.Service) { s.Domain = "" },
+		"other cluster":    func(s *nmdata.Service) { s.ProxyCluster = "us.proxy.netbird.io" },
+	}
+	for name, mutate := range cases {
+		t.Run(name, func(t *testing.T) {
+			svc := privateService("svc-1", "myapp.eu.proxy.netbird.io", "eu.proxy.netbird.io", "grp-admins")
+			mutate(svc)
+			nmd := twinWithProxy(svc)
+
+			nmd.BuildPrivateServiceCandidates()
+
+			assert.Empty(t, nmd.PrivateServiceCandidates)
+		})
+	}
+}
+
+func TestBuildPrivateServiceCandidates_MultipleConnectedProxyPeersEachGetARecord(t *testing.T) {
+	nmd := twinWithProxy(privateService("svc-1", "myapp.eu.proxy.netbird.io", "eu.proxy.netbird.io", "grp-admins"))
+	nmd.Peers["proxy-2"] = proxyPeer("proxy-2", "100.64.0.100", "eu.proxy.netbird.io", true)
+
+	nmd.BuildPrivateServiceCandidates()
+
+	require.Len(t, nmd.PrivateServiceCandidates, 1)
+	records := nmd.PrivateServiceCandidates[0].Zone.Records
+	require.Len(t, records, 2)
+	assert.Equal(t, "100.64.0.99", records[0].RData, "records are ordered by proxy peer id")
+	assert.Equal(t, "100.64.0.100", records[1].RData)
+}
diff --git a/shared/management/networkmap/proxypolicies.go b/shared/management/networkmap/proxypolicies.go
new file mode 100644
index 000000000..7a7c805a6
--- /dev/null
+++ b/shared/management/networkmap/proxypolicies.go
@@ -0,0 +1,209 @@
+package networkmap
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/types"
+)
+
+const (
+	serviceModeUDP = "udp"
+
+	privateServicePortHTTP  = 80
+	privateServicePortHTTPS = 443
+)
+
+// InjectProxyPolicies synthesises the in-memory ACLs that carry reverse-proxy
+// traffic and appends them to the twin's policies. They are never persisted,
+// so no builder can load them: a proxy-access policy lets a cluster's proxy
+// peers reach each enabled target of a service, and a private-access policy
+// lets a private service's AccessGroups reach those proxy peers on HTTP(S).
+//
+// GetPeerNetworkMapComponents calls it, so every caller of the twin gets the
+// same policy set no matter which builder produced it. It runs at most once
+// per twin, and is safe to call again to force the synthesis early.
+func (nmd *NetworkMapData) InjectProxyPolicies() {
+	nmd.proxyPoliciesOnce.Do(nmd.injectProxyPolicies)
+}
+
+func (nmd *NetworkMapData) injectProxyPolicies() {
+	if len(nmd.Services) == 0 {
+		return
+	}
+
+	proxyPeersByCluster := nmd.proxyPeersByCluster()
+	if len(proxyPeersByCluster) == 0 {
+		return
+	}
+
+	for _, svc := range nmd.Services {
+		if svc == nil || !svc.Enabled {
+			continue
+		}
+
+		proxyPeers := proxyPeersByCluster[svc.ProxyCluster]
+		for _, target := range svc.Targets {
+			if target == nil || !target.Enabled {
+				continue
+			}
+			port, ok := resolveTargetPort(target)
+			if !ok {
+				continue
+			}
+			for _, proxyPeer := range proxyPeers {
+				nmd.addInjectedPolicy(proxyAccessPolicy(svc, target, proxyPeer, port))
+			}
+		}
+
+		nmd.injectPrivateServicePolicies(svc, proxyPeers)
+	}
+}
+
+// injectPrivateServicePolicies synthesises AccessGroups → cluster proxy peers on TCP 80/443.
+func (nmd *NetworkMapData) injectPrivateServicePolicies(svc *nmdata.Service, proxyPeers []*nmdata.Peer) {
+	if !svc.Private || len(svc.AccessGroups) == 0 || len(proxyPeers) == 0 {
+		return
+	}
+
+	// A service's AccessGroups can name groups that no longer exist — persisted
+	// services and the agent-network synthesiser both carry the ids verbatim from
+	// their own state. An unresolvable source authorises nothing, so drop it here
+	// rather than let the network-map assembly resolve it to a nil group.
+	sources := nmd.existingGroupIDs(svc.AccessGroups)
+	if len(sources) == 0 {
+		return
+	}
+
+	for _, proxyPeer := range proxyPeers {
+		nmd.addInjectedPolicy(privateAccessPolicy(svc, proxyPeer, sources))
+	}
+}
+
+// addInjectedPolicy appends the policy to the twin's policy set, and to the
+// policies of the network resource it targets — mirroring the account path,
+// where the resource-policy map was built after injection.
+func (nmd *NetworkMapData) addInjectedPolicy(policy *nmdata.Policy) {
+	nmd.Policies = append(nmd.Policies, policy)
+
+	resourceID := policy.Rules[0].DestinationResource.ID
+	if resourceID == "" {
+		return
+	}
+	for _, resource := range nmd.NetworkResources {
+		if resource == nil || !resource.Enabled || resource.ID != resourceID {
+			continue
+		}
+		if nmd.ResourcePolicies == nil {
+			nmd.ResourcePolicies = make(map[string][]*nmdata.Policy)
+		}
+		nmd.ResourcePolicies[resourceID] = append(nmd.ResourcePolicies[resourceID], policy)
+		return
+	}
+}
+
+func proxyAccessPolicy(svc *nmdata.Service, target *nmdata.ServiceTarget, proxyPeer *nmdata.Peer, port uint16) *nmdata.Policy {
+	policyID := fmt.Sprintf("proxy-access-%s-%s-%s", svc.ID, proxyPeer.ID, target.Path)
+
+	protocol := types.PolicyRuleProtocolTCP
+	if svc.Mode == serviceModeUDP {
+		protocol = types.PolicyRuleProtocolUDP
+	}
+
+	return &nmdata.Policy{
+		ID: policyID,
+		// The envelope encoder puts public ids on the wire and degrades to an
+		// empty one when a policy has none. A synthesised policy has no
+		// persisted row to take a public id from, and its own id is already
+		// stable and unique, so it serves as both.
+		PublicID: policyID,
+		Enabled:  true,
+		Rules: []*nmdata.PolicyRule{
+			{
+				ID:                  policyID,
+				PolicyID:            policyID,
+				Enabled:             true,
+				SourceResource:      nmdata.Resource{ID: proxyPeer.ID, Type: string(types.ResourceTypePeer)},
+				DestinationResource: nmdata.Resource{ID: target.TargetID, Type: target.TargetType},
+				Bidirectional:       false,
+				Protocol:            string(protocol),
+				Action:              string(types.PolicyTrafficActionAccept),
+				PortRanges:          []nmdata.RulePortRange{{Start: port, End: port}},
+			},
+		},
+	}
+}
+
+func privateAccessPolicy(svc *nmdata.Service, proxyPeer *nmdata.Peer, accessGroups []string) *nmdata.Policy {
+	policyID := fmt.Sprintf("private-access-%s-%s", svc.ID, proxyPeer.ID)
+
+	return &nmdata.Policy{
+		ID:       policyID,
+		PublicID: policyID,
+		Enabled:  true,
+		Rules: []*nmdata.PolicyRule{
+			{
+				ID:                  policyID,
+				PolicyID:            policyID,
+				Enabled:             true,
+				Sources:             slices.Clone(accessGroups),
+				DestinationResource: nmdata.Resource{ID: proxyPeer.ID, Type: string(types.ResourceTypePeer)},
+				Bidirectional:       false,
+				Protocol:            string(types.PolicyRuleProtocolTCP),
+				Action:              string(types.PolicyTrafficActionAccept),
+				PortRanges: []nmdata.RulePortRange{
+					{Start: privateServicePortHTTP, End: privateServicePortHTTP},
+					{Start: privateServicePortHTTPS, End: privateServicePortHTTPS},
+				},
+			},
+		},
+	}
+}
+
+func resolveTargetPort(target *nmdata.ServiceTarget) (uint16, bool) {
+	if target.Port != 0 {
+		return target.Port, true
+	}
+
+	switch target.Protocol {
+	case "https", "tls":
+		return privateServicePortHTTPS, true
+	case "http":
+		return privateServicePortHTTP, true
+	default:
+		return 0, false
+	}
+}
+
+// proxyPeersByCluster groups the account's embedded proxy peers by the cluster
+// they serve. Sorted by peer ID so the synthesised policy order is stable.
+func (nmd *NetworkMapData) proxyPeersByCluster() map[string][]*nmdata.Peer {
+	var proxyPeers map[string][]*nmdata.Peer
+	for _, peer := range nmd.Peers {
+		if peer == nil || !peer.ProxyMeta.Embedded {
+			continue
+		}
+		if proxyPeers == nil {
+			proxyPeers = make(map[string][]*nmdata.Peer)
+		}
+		proxyPeers[peer.ProxyMeta.Cluster] = append(proxyPeers[peer.ProxyMeta.Cluster], peer)
+	}
+	for _, peers := range proxyPeers {
+		slices.SortFunc(peers, func(a, b *nmdata.Peer) int { return strings.Compare(a.ID, b.ID) })
+	}
+	return proxyPeers
+}
+
+// existingGroupIDs returns the subset of groupIDs that resolve to a group,
+// preserving the input order.
+func (nmd *NetworkMapData) existingGroupIDs(groupIDs []string) []string {
+	out := make([]string, 0, len(groupIDs))
+	for _, groupID := range groupIDs {
+		if _, ok := nmd.Groups[groupID]; ok {
+			out = append(out, groupID)
+		}
+	}
+	return out
+}
diff --git a/shared/management/proto/generate.sh b/shared/management/proto/generate.sh
index 7cb0f75a5..2915b7f0c 100755
--- a/shared/management/proto/generate.sh
+++ b/shared/management/proto/generate.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 if ! which realpath > /dev/null 2>&1
diff --git a/shared/management/proto/management.pb.go b/shared/management/proto/management.pb.go
index faf21e60f..a055b0b1e 100644
--- a/shared/management/proto/management.pb.go
+++ b/shared/management/proto/management.pb.go
@@ -81,6 +81,8 @@ const (
 	PeerCapability_PeerCapabilitySourcePrefixes PeerCapability = 1
 	// Client handles IPv6 overlay addresses and firewall rules.
 	PeerCapability_PeerCapabilityIPv6Overlay PeerCapability = 2
+	// Client receives NetworkMap as components and assembles it locally.
+	PeerCapability_PeerCapabilityComponentNetworkMap PeerCapability = 3
 )
 
 // Enum value maps for PeerCapability.
@@ -89,11 +91,13 @@ var (
 		0: "PeerCapabilityUnknown",
 		1: "PeerCapabilitySourcePrefixes",
 		2: "PeerCapabilityIPv6Overlay",
+		3: "PeerCapabilityComponentNetworkMap",
 	}
 	PeerCapability_value = map[string]int32{
-		"PeerCapabilityUnknown":        0,
-		"PeerCapabilitySourcePrefixes": 1,
-		"PeerCapabilityIPv6Overlay":    2,
+		"PeerCapabilityUnknown":             0,
+		"PeerCapabilitySourcePrefixes":      1,
+		"PeerCapabilityIPv6Overlay":         2,
+		"PeerCapabilityComponentNetworkMap": 3,
 	}
 )
 
@@ -124,6 +128,59 @@ func (PeerCapability) EnumDescriptor() ([]byte, []int) {
 	return file_management_proto_rawDescGZIP(), []int{1}
 }
 
+// LazyState is the management per-peer override for lazy connections.
+type LazyState int32
+
+const (
+	// Follow the account-wide lazy connection flag.
+	LazyState_LazyStateDefault LazyState = 0
+	// Force a lazy (on-demand) connection regardless of the account flag.
+	LazyState_LazyStateLazy LazyState = 1
+	// Force an always-active connection regardless of the account flag.
+	LazyState_LazyStateEager LazyState = 2
+)
+
+// Enum value maps for LazyState.
+var (
+	LazyState_name = map[int32]string{
+		0: "LazyStateDefault",
+		1: "LazyStateLazy",
+		2: "LazyStateEager",
+	}
+	LazyState_value = map[string]int32{
+		"LazyStateDefault": 0,
+		"LazyStateLazy":    1,
+		"LazyStateEager":   2,
+	}
+)
+
+func (x LazyState) Enum() *LazyState {
+	p := new(LazyState)
+	*p = x
+	return p
+}
+
+func (x LazyState) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (LazyState) Descriptor() protoreflect.EnumDescriptor {
+	return file_management_proto_enumTypes[2].Descriptor()
+}
+
+func (LazyState) Type() protoreflect.EnumType {
+	return &file_management_proto_enumTypes[2]
+}
+
+func (x LazyState) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use LazyState.Descriptor instead.
+func (LazyState) EnumDescriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{2}
+}
+
 type RuleProtocol int32
 
 const (
@@ -133,6 +190,13 @@ const (
 	RuleProtocol_UDP     RuleProtocol = 3
 	RuleProtocol_ICMP    RuleProtocol = 4
 	RuleProtocol_CUSTOM  RuleProtocol = 5
+	// NETBIRD_SSH (types.PolicyRuleProtocolType "netbird-ssh") is the marker
+	// policy rule that drives SSH-server activation in Calculate(). The legacy
+	// proto.FirewallRule path doesn't ship this value (Calculate already
+	// expands SSH rules into TCP/22 before encoding), but the components path
+	// ships RAW policies — the client must see this protocol to derive
+	// AuthorizedUsers locally.
+	RuleProtocol_NETBIRD_SSH RuleProtocol = 6
 )
 
 // Enum value maps for RuleProtocol.
@@ -144,14 +208,16 @@ var (
 		3: "UDP",
 		4: "ICMP",
 		5: "CUSTOM",
+		6: "NETBIRD_SSH",
 	}
 	RuleProtocol_value = map[string]int32{
-		"UNKNOWN": 0,
-		"ALL":     1,
-		"TCP":     2,
-		"UDP":     3,
-		"ICMP":    4,
-		"CUSTOM":  5,
+		"UNKNOWN":     0,
+		"ALL":         1,
+		"TCP":         2,
+		"UDP":         3,
+		"ICMP":        4,
+		"CUSTOM":      5,
+		"NETBIRD_SSH": 6,
 	}
 )
 
@@ -166,11 +232,11 @@ func (x RuleProtocol) String() string {
 }
 
 func (RuleProtocol) Descriptor() protoreflect.EnumDescriptor {
-	return file_management_proto_enumTypes[2].Descriptor()
+	return file_management_proto_enumTypes[3].Descriptor()
 }
 
 func (RuleProtocol) Type() protoreflect.EnumType {
-	return &file_management_proto_enumTypes[2]
+	return &file_management_proto_enumTypes[3]
 }
 
 func (x RuleProtocol) Number() protoreflect.EnumNumber {
@@ -179,7 +245,7 @@ func (x RuleProtocol) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use RuleProtocol.Descriptor instead.
 func (RuleProtocol) EnumDescriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{2}
+	return file_management_proto_rawDescGZIP(), []int{3}
 }
 
 type RuleDirection int32
@@ -212,11 +278,11 @@ func (x RuleDirection) String() string {
 }
 
 func (RuleDirection) Descriptor() protoreflect.EnumDescriptor {
-	return file_management_proto_enumTypes[3].Descriptor()
+	return file_management_proto_enumTypes[4].Descriptor()
 }
 
 func (RuleDirection) Type() protoreflect.EnumType {
-	return &file_management_proto_enumTypes[3]
+	return &file_management_proto_enumTypes[4]
 }
 
 func (x RuleDirection) Number() protoreflect.EnumNumber {
@@ -225,7 +291,7 @@ func (x RuleDirection) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use RuleDirection.Descriptor instead.
 func (RuleDirection) EnumDescriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{3}
+	return file_management_proto_rawDescGZIP(), []int{4}
 }
 
 type RuleAction int32
@@ -258,11 +324,11 @@ func (x RuleAction) String() string {
 }
 
 func (RuleAction) Descriptor() protoreflect.EnumDescriptor {
-	return file_management_proto_enumTypes[4].Descriptor()
+	return file_management_proto_enumTypes[5].Descriptor()
 }
 
 func (RuleAction) Type() protoreflect.EnumType {
-	return &file_management_proto_enumTypes[4]
+	return &file_management_proto_enumTypes[5]
 }
 
 func (x RuleAction) Number() protoreflect.EnumNumber {
@@ -271,7 +337,7 @@ func (x RuleAction) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use RuleAction.Descriptor instead.
 func (RuleAction) EnumDescriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{4}
+	return file_management_proto_rawDescGZIP(), []int{5}
 }
 
 type ExposeProtocol int32
@@ -313,11 +379,11 @@ func (x ExposeProtocol) String() string {
 }
 
 func (ExposeProtocol) Descriptor() protoreflect.EnumDescriptor {
-	return file_management_proto_enumTypes[5].Descriptor()
+	return file_management_proto_enumTypes[6].Descriptor()
 }
 
 func (ExposeProtocol) Type() protoreflect.EnumType {
-	return &file_management_proto_enumTypes[5]
+	return &file_management_proto_enumTypes[6]
 }
 
 func (x ExposeProtocol) Number() protoreflect.EnumNumber {
@@ -326,7 +392,7 @@ func (x ExposeProtocol) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ExposeProtocol.Descriptor instead.
 func (ExposeProtocol) EnumDescriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{5}
+	return file_management_proto_rawDescGZIP(), []int{6}
 }
 
 type HostConfig_Protocol int32
@@ -368,11 +434,11 @@ func (x HostConfig_Protocol) String() string {
 }
 
 func (HostConfig_Protocol) Descriptor() protoreflect.EnumDescriptor {
-	return file_management_proto_enumTypes[6].Descriptor()
+	return file_management_proto_enumTypes[7].Descriptor()
 }
 
 func (HostConfig_Protocol) Type() protoreflect.EnumType {
-	return &file_management_proto_enumTypes[6]
+	return &file_management_proto_enumTypes[7]
 }
 
 func (x HostConfig_Protocol) Number() protoreflect.EnumNumber {
@@ -411,11 +477,11 @@ func (x DeviceAuthorizationFlowProvider) String() string {
 }
 
 func (DeviceAuthorizationFlowProvider) Descriptor() protoreflect.EnumDescriptor {
-	return file_management_proto_enumTypes[7].Descriptor()
+	return file_management_proto_enumTypes[8].Descriptor()
 }
 
 func (DeviceAuthorizationFlowProvider) Type() protoreflect.EnumType {
-	return &file_management_proto_enumTypes[7]
+	return &file_management_proto_enumTypes[8]
 }
 
 func (x DeviceAuthorizationFlowProvider) Number() protoreflect.EnumNumber {
@@ -668,6 +734,13 @@ type BundleParameters struct {
 	BundleForTime int64 `protobuf:"varint,2,opt,name=bundle_for_time,json=bundleForTime,proto3" json:"bundle_for_time,omitempty"`
 	LogFileCount  int32 `protobuf:"varint,3,opt,name=log_file_count,json=logFileCount,proto3" json:"log_file_count,omitempty"`
 	Anonymize     bool  `protobuf:"varint,4,opt,name=anonymize,proto3" json:"anonymize,omitempty"`
+	// anonymize_level selects how much the anonymizer redacts: "default"
+	// (or empty) keeps internal IP ranges, "strict" also anonymizes them.
+	// Unknown values are treated as "strict".
+	AnonymizeLevel string `protobuf:"bytes,5,opt,name=anonymize_level,json=anonymizeLevel,proto3" json:"anonymize_level,omitempty"`
+	// upload_url is the service URL the client requests an upload URL from
+	// before uploading the bundle. Empty selects the default upload server.
+	UploadUrl string `protobuf:"bytes,6,opt,name=upload_url,json=uploadUrl,proto3" json:"upload_url,omitempty"`
 }
 
 func (x *BundleParameters) Reset() {
@@ -730,6 +803,20 @@ func (x *BundleParameters) GetAnonymize() bool {
 	return false
 }
 
+func (x *BundleParameters) GetAnonymizeLevel() string {
+	if x != nil {
+		return x.AnonymizeLevel
+	}
+	return ""
+}
+
+func (x *BundleParameters) GetUploadUrl() string {
+	if x != nil {
+		return x.UploadUrl
+	}
+	return ""
+}
+
 type BundleResult struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -852,6 +939,12 @@ type SyncResponse struct {
 	//	                           SSO-registered; client clears its anchor
 	//	set, valid timestamp     → new absolute UTC deadline
 	SessionExpiresAt *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=sessionExpiresAt,proto3" json:"sessionExpiresAt,omitempty"`
+	// NetworkMapEnvelope carries the component-based wire format for peers that
+	// advertise PeerCapabilityComponentNetworkMap. When set, NetworkMap (field 5)
+	// is left empty: management ships components and the client runs Calculate()
+	// locally instead of receiving an expanded NetworkMap.
+	NetworkMapEnvelope *NetworkMapEnvelope `protobuf:"bytes,8,opt,name=NetworkMapEnvelope,proto3" json:"NetworkMapEnvelope,omitempty"`
+	Version            int32               `protobuf:"varint,9,opt,name=Version,proto3" json:"Version,omitempty"`
 }
 
 func (x *SyncResponse) Reset() {
@@ -935,6 +1028,20 @@ func (x *SyncResponse) GetSessionExpiresAt() *timestamppb.Timestamp {
 	return nil
 }
 
+func (x *SyncResponse) GetNetworkMapEnvelope() *NetworkMapEnvelope {
+	if x != nil {
+		return x.NetworkMapEnvelope
+	}
+	return nil
+}
+
+func (x *SyncResponse) GetVersion() int32 {
+	if x != nil {
+		return x.Version
+	}
+	return 0
+}
+
 type SyncMetaRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1271,6 +1378,10 @@ type Flags struct {
 	EnableSSHRemotePortForwarding bool `protobuf:"varint,14,opt,name=enableSSHRemotePortForwarding,proto3" json:"enableSSHRemotePortForwarding,omitempty"`
 	DisableSSHAuth                bool `protobuf:"varint,15,opt,name=disableSSHAuth,proto3" json:"disableSSHAuth,omitempty"`
 	DisableIPv6                   bool `protobuf:"varint,16,opt,name=disableIPv6,proto3" json:"disableIPv6,omitempty"`
+	// remoteJobsAllowed mirrors the peer's local opt-in for management-requested
+	// remote jobs (e.g. debug bundles). Reported so the dashboard can surface
+	// peers that have opted out.
+	RemoteJobsAllowed bool `protobuf:"varint,17,opt,name=remoteJobsAllowed,proto3" json:"remoteJobsAllowed,omitempty"`
 }
 
 func (x *Flags) Reset() {
@@ -1417,30 +1528,39 @@ func (x *Flags) GetDisableIPv6() bool {
 	return false
 }
 
+func (x *Flags) GetRemoteJobsAllowed() bool {
+	if x != nil {
+		return x.RemoteJobsAllowed
+	}
+	return false
+}
+
 // PeerSystemMeta is machine meta data like OS and version.
 type PeerSystemMeta struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Hostname         string            `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
-	GoOS             string            `protobuf:"bytes,2,opt,name=goOS,proto3" json:"goOS,omitempty"`
-	Kernel           string            `protobuf:"bytes,3,opt,name=kernel,proto3" json:"kernel,omitempty"`
-	Core             string            `protobuf:"bytes,4,opt,name=core,proto3" json:"core,omitempty"`
-	Platform         string            `protobuf:"bytes,5,opt,name=platform,proto3" json:"platform,omitempty"`
-	OS               string            `protobuf:"bytes,6,opt,name=OS,proto3" json:"OS,omitempty"`
-	NetbirdVersion   string            `protobuf:"bytes,7,opt,name=netbirdVersion,proto3" json:"netbirdVersion,omitempty"`
-	UiVersion        string            `protobuf:"bytes,8,opt,name=uiVersion,proto3" json:"uiVersion,omitempty"`
-	KernelVersion    string            `protobuf:"bytes,9,opt,name=kernelVersion,proto3" json:"kernelVersion,omitempty"`
-	OSVersion        string            `protobuf:"bytes,10,opt,name=OSVersion,proto3" json:"OSVersion,omitempty"`
-	NetworkAddresses []*NetworkAddress `protobuf:"bytes,11,rep,name=networkAddresses,proto3" json:"networkAddresses,omitempty"`
-	SysSerialNumber  string            `protobuf:"bytes,12,opt,name=sysSerialNumber,proto3" json:"sysSerialNumber,omitempty"`
-	SysProductName   string            `protobuf:"bytes,13,opt,name=sysProductName,proto3" json:"sysProductName,omitempty"`
-	SysManufacturer  string            `protobuf:"bytes,14,opt,name=sysManufacturer,proto3" json:"sysManufacturer,omitempty"`
-	Environment      *Environment      `protobuf:"bytes,15,opt,name=environment,proto3" json:"environment,omitempty"`
-	Files            []*File           `protobuf:"bytes,16,rep,name=files,proto3" json:"files,omitempty"`
-	Flags            *Flags            `protobuf:"bytes,17,opt,name=flags,proto3" json:"flags,omitempty"`
-	Capabilities     []PeerCapability  `protobuf:"varint,18,rep,packed,name=capabilities,proto3,enum=management.PeerCapability" json:"capabilities,omitempty"`
+	Hostname           string              `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	GoOS               string              `protobuf:"bytes,2,opt,name=goOS,proto3" json:"goOS,omitempty"`
+	Kernel             string              `protobuf:"bytes,3,opt,name=kernel,proto3" json:"kernel,omitempty"`
+	Core               string              `protobuf:"bytes,4,opt,name=core,proto3" json:"core,omitempty"`
+	Platform           string              `protobuf:"bytes,5,opt,name=platform,proto3" json:"platform,omitempty"`
+	OS                 string              `protobuf:"bytes,6,opt,name=OS,proto3" json:"OS,omitempty"`
+	NetbirdVersion     string              `protobuf:"bytes,7,opt,name=netbirdVersion,proto3" json:"netbirdVersion,omitempty"`
+	UiVersion          string              `protobuf:"bytes,8,opt,name=uiVersion,proto3" json:"uiVersion,omitempty"`
+	KernelVersion      string              `protobuf:"bytes,9,opt,name=kernelVersion,proto3" json:"kernelVersion,omitempty"`
+	OSVersion          string              `protobuf:"bytes,10,opt,name=OSVersion,proto3" json:"OSVersion,omitempty"`
+	NetworkAddresses   []*NetworkAddress   `protobuf:"bytes,11,rep,name=networkAddresses,proto3" json:"networkAddresses,omitempty"`
+	SysSerialNumber    string              `protobuf:"bytes,12,opt,name=sysSerialNumber,proto3" json:"sysSerialNumber,omitempty"`
+	SysProductName     string              `protobuf:"bytes,13,opt,name=sysProductName,proto3" json:"sysProductName,omitempty"`
+	SysManufacturer    string              `protobuf:"bytes,14,opt,name=sysManufacturer,proto3" json:"sysManufacturer,omitempty"`
+	Environment        *Environment        `protobuf:"bytes,15,opt,name=environment,proto3" json:"environment,omitempty"`
+	Files              []*File             `protobuf:"bytes,16,rep,name=files,proto3" json:"files,omitempty"`
+	Flags              *Flags              `protobuf:"bytes,17,opt,name=flags,proto3" json:"flags,omitempty"`
+	Capabilities       []PeerCapability    `protobuf:"varint,18,rep,packed,name=capabilities,proto3,enum=management.PeerCapability" json:"capabilities,omitempty"`
+	SyncMessageVersion int32               `protobuf:"varint,19,opt,name=syncMessageVersion,proto3" json:"syncMessageVersion,omitempty"`
+	CertificateProofs  []*CertificateProof `protobuf:"bytes,20,rep,name=certificateProofs,proto3" json:"certificateProofs,omitempty"`
 }
 
 func (x *PeerSystemMeta) Reset() {
@@ -1601,6 +1721,20 @@ func (x *PeerSystemMeta) GetCapabilities() []PeerCapability {
 	return nil
 }
 
+func (x *PeerSystemMeta) GetSyncMessageVersion() int32 {
+	if x != nil {
+		return x.SyncMessageVersion
+	}
+	return 0
+}
+
+func (x *PeerSystemMeta) GetCertificateProofs() []*CertificateProof {
+	if x != nil {
+		return x.CertificateProofs
+	}
+	return nil
+}
+
 type LoginResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2613,8 +2747,11 @@ type NetworkMap struct {
 	// RoutesFirewallRules represents a list of routes firewall rules to be applied to peer
 	RoutesFirewallRules []*RouteFirewallRule `protobuf:"bytes,10,rep,name=routesFirewallRules,proto3" json:"routesFirewallRules,omitempty"`
 	// RoutesFirewallRulesIsEmpty indicates whether RouteFirewallRule array is empty or not to bypass protobuf null and empty array equality.
-	RoutesFirewallRulesIsEmpty bool              `protobuf:"varint,11,opt,name=routesFirewallRulesIsEmpty,proto3" json:"routesFirewallRulesIsEmpty,omitempty"`
-	ForwardingRules            []*ForwardingRule `protobuf:"bytes,12,rep,name=forwardingRules,proto3" json:"forwardingRules,omitempty"`
+	RoutesFirewallRulesIsEmpty bool `protobuf:"varint,11,opt,name=routesFirewallRulesIsEmpty,proto3" json:"routesFirewallRulesIsEmpty,omitempty"`
+	// Unused; the ingress port-forwarding feature was discontinued.
+	//
+	// Deprecated: Do not use.
+	ForwardingRules []*ForwardingRule `protobuf:"bytes,12,rep,name=forwardingRules,proto3" json:"forwardingRules,omitempty"`
 	// SSHAuth represents SSH authorization configuration
 	SshAuth *SSHAuth `protobuf:"bytes,13,opt,name=sshAuth,proto3" json:"sshAuth,omitempty"`
 }
@@ -2728,6 +2865,7 @@ func (x *NetworkMap) GetRoutesFirewallRulesIsEmpty() bool {
 	return false
 }
 
+// Deprecated: Do not use.
 func (x *NetworkMap) GetForwardingRules() []*ForwardingRule {
 	if x != nil {
 		return x.ForwardingRules
@@ -2871,6 +3009,11 @@ type RemotePeerConfig struct {
 	// Peer fully qualified domain name
 	Fqdn         string `protobuf:"bytes,4,opt,name=fqdn,proto3" json:"fqdn,omitempty"`
 	AgentVersion string `protobuf:"bytes,5,opt,name=agentVersion,proto3" json:"agentVersion,omitempty"`
+	// lazyState is the management per-peer override for lazy (on-demand)
+	// connections to this remote peer. LazyStateDefault follows the account-wide
+	// flag; LazyStateLazy forces lazy; LazyStateEager forces an always-active
+	// connection. A local NB_LAZY_CONN/MDM override still wins over this.
+	LazyState LazyState `protobuf:"varint,6,opt,name=lazyState,proto3,enum=management.LazyState" json:"lazyState,omitempty"`
 }
 
 func (x *RemotePeerConfig) Reset() {
@@ -2940,6 +3083,13 @@ func (x *RemotePeerConfig) GetAgentVersion() string {
 	return ""
 }
 
+func (x *RemotePeerConfig) GetLazyState() LazyState {
+	if x != nil {
+		return x.LazyState
+	}
+	return LazyState_LazyStateDefault
+}
+
 // SSHConfig represents SSH configurations of a peer.
 type SSHConfig struct {
 	state         protoimpl.MessageState
@@ -3105,11 +3255,21 @@ func (x *DeviceAuthorizationFlow) GetProviderConfig() *ProviderConfig {
 	return nil
 }
 
-// PKCEAuthorizationFlowRequest empty struct for future expansion
+// PKCEAuthorizationFlowRequest asks for the PKCE flow configuration to use for
+// an upcoming authorization request.
 type PKCEAuthorizationFlowRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
+
+	// SessionExtend indicates the flow will renew the SSO session of a peer that
+	// is already registered, rather than log in or register one. An extend is
+	// bound to the account that peer belongs to, so the server must not answer it
+	// with a configuration that lets the IdP reply from whatever session is
+	// already active: with several accounts signed in at the IdP that need not be
+	// the peer's own, and the resulting token is rejected as a peer/user mismatch
+	// with no way for the user to correct it.
+	SessionExtend bool `protobuf:"varint,1,opt,name=SessionExtend,proto3" json:"SessionExtend,omitempty"`
 }
 
 func (x *PKCEAuthorizationFlowRequest) Reset() {
@@ -3144,6 +3304,13 @@ func (*PKCEAuthorizationFlowRequest) Descriptor() ([]byte, []int) {
 	return file_management_proto_rawDescGZIP(), []int{35}
 }
 
+func (x *PKCEAuthorizationFlowRequest) GetSessionExtend() bool {
+	if x != nil {
+		return x.SessionExtend
+	}
+	return false
+}
+
 // PKCEAuthorizationFlow represents Authorization Code Flow information
 // that can be used by the client to login initiate a Oauth 2.0 authorization code grant flow
 // with Proof Key for Code Exchange (PKCE). See https://datatracker.ietf.org/doc/html/rfc7636
@@ -4011,6 +4178,8 @@ type Checks struct {
 	unknownFields protoimpl.UnknownFields
 
 	Files []string `protobuf:"bytes,1,rep,name=Files,proto3" json:"Files,omitempty"`
+	// certificateChallenge asks the peer to prove possession of a certificate chaining to caCertificates.
+	CertificateChallenge *CertificateChallenge `protobuf:"bytes,2,opt,name=certificateChallenge,proto3" json:"certificateChallenge,omitempty"`
 }
 
 func (x *Checks) Reset() {
@@ -4052,6 +4221,143 @@ func (x *Checks) GetFiles() []string {
 	return nil
 }
 
+func (x *Checks) GetCertificateChallenge() *CertificateChallenge {
+	if x != nil {
+		return x.CertificateChallenge
+	}
+	return nil
+}
+
+type CertificateChallenge struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// nonce is issued by management, bound to the peer and a time window; the peer signs it.
+	Nonce []byte `protobuf:"bytes,1,opt,name=nonce,proto3" json:"nonce,omitempty"`
+	// caCertificates are PEM encoded trust anchors the presented certificate must chain to.
+	CaCertificates []string `protobuf:"bytes,2,rep,name=caCertificates,proto3" json:"caCertificates,omitempty"`
+}
+
+func (x *CertificateChallenge) Reset() {
+	*x = CertificateChallenge{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[47]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CertificateChallenge) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CertificateChallenge) ProtoMessage() {}
+
+func (x *CertificateChallenge) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[47]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CertificateChallenge.ProtoReflect.Descriptor instead.
+func (*CertificateChallenge) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{47}
+}
+
+func (x *CertificateChallenge) GetNonce() []byte {
+	if x != nil {
+		return x.Nonce
+	}
+	return nil
+}
+
+func (x *CertificateChallenge) GetCaCertificates() []string {
+	if x != nil {
+		return x.CaCertificates
+	}
+	return nil
+}
+
+// CertificateProof demonstrates possession of the private key of chain[0] by signing the challenge nonce.
+type CertificateProof struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Nonce []byte `protobuf:"bytes,1,opt,name=nonce,proto3" json:"nonce,omitempty"`
+	// chain is DER encoded, leaf first.
+	Chain     [][]byte `protobuf:"bytes,2,rep,name=chain,proto3" json:"chain,omitempty"`
+	SigAlg    string   `protobuf:"bytes,3,opt,name=sigAlg,proto3" json:"sigAlg,omitempty"`
+	Signature []byte   `protobuf:"bytes,4,opt,name=signature,proto3" json:"signature,omitempty"`
+}
+
+func (x *CertificateProof) Reset() {
+	*x = CertificateProof{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[48]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CertificateProof) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CertificateProof) ProtoMessage() {}
+
+func (x *CertificateProof) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[48]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CertificateProof.ProtoReflect.Descriptor instead.
+func (*CertificateProof) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{48}
+}
+
+func (x *CertificateProof) GetNonce() []byte {
+	if x != nil {
+		return x.Nonce
+	}
+	return nil
+}
+
+func (x *CertificateProof) GetChain() [][]byte {
+	if x != nil {
+		return x.Chain
+	}
+	return nil
+}
+
+func (x *CertificateProof) GetSigAlg() string {
+	if x != nil {
+		return x.SigAlg
+	}
+	return ""
+}
+
+func (x *CertificateProof) GetSignature() []byte {
+	if x != nil {
+		return x.Signature
+	}
+	return nil
+}
+
 type PortInfo struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -4067,7 +4373,7 @@ type PortInfo struct {
 func (x *PortInfo) Reset() {
 	*x = PortInfo{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[47]
+		mi := &file_management_proto_msgTypes[49]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4080,7 +4386,7 @@ func (x *PortInfo) String() string {
 func (*PortInfo) ProtoMessage() {}
 
 func (x *PortInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[47]
+	mi := &file_management_proto_msgTypes[49]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4093,7 +4399,7 @@ func (x *PortInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PortInfo.ProtoReflect.Descriptor instead.
 func (*PortInfo) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{47}
+	return file_management_proto_rawDescGZIP(), []int{49}
 }
 
 func (m *PortInfo) GetPortSelection() isPortInfo_PortSelection {
@@ -4164,7 +4470,7 @@ type RouteFirewallRule struct {
 func (x *RouteFirewallRule) Reset() {
 	*x = RouteFirewallRule{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[48]
+		mi := &file_management_proto_msgTypes[50]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4177,7 +4483,7 @@ func (x *RouteFirewallRule) String() string {
 func (*RouteFirewallRule) ProtoMessage() {}
 
 func (x *RouteFirewallRule) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[48]
+	mi := &file_management_proto_msgTypes[50]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4190,7 +4496,7 @@ func (x *RouteFirewallRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RouteFirewallRule.ProtoReflect.Descriptor instead.
 func (*RouteFirewallRule) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{48}
+	return file_management_proto_rawDescGZIP(), []int{50}
 }
 
 func (x *RouteFirewallRule) GetSourceRanges() []string {
@@ -4263,25 +4569,24 @@ func (x *RouteFirewallRule) GetRouteID() string {
 	return ""
 }
 
+// ForwardingRule is unused; the ingress port-forwarding feature was discontinued.
+//
+// Deprecated: Do not use.
 type ForwardingRule struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// Protocol of the forwarding rule
-	Protocol RuleProtocol `protobuf:"varint,1,opt,name=protocol,proto3,enum=management.RuleProtocol" json:"protocol,omitempty"`
-	// portInfo is the ingress destination port information, where the traffic arrives in the gateway node
-	DestinationPort *PortInfo `protobuf:"bytes,2,opt,name=destinationPort,proto3" json:"destinationPort,omitempty"`
-	// IP address of the translated address (remote peer) to send traffic to
-	TranslatedAddress []byte `protobuf:"bytes,3,opt,name=translatedAddress,proto3" json:"translatedAddress,omitempty"`
-	// Translated port information, where the traffic should be forwarded to
-	TranslatedPort *PortInfo `protobuf:"bytes,4,opt,name=translatedPort,proto3" json:"translatedPort,omitempty"`
+	Protocol          RuleProtocol `protobuf:"varint,1,opt,name=protocol,proto3,enum=management.RuleProtocol" json:"protocol,omitempty"`
+	DestinationPort   *PortInfo    `protobuf:"bytes,2,opt,name=destinationPort,proto3" json:"destinationPort,omitempty"`
+	TranslatedAddress []byte       `protobuf:"bytes,3,opt,name=translatedAddress,proto3" json:"translatedAddress,omitempty"`
+	TranslatedPort    *PortInfo    `protobuf:"bytes,4,opt,name=translatedPort,proto3" json:"translatedPort,omitempty"`
 }
 
 func (x *ForwardingRule) Reset() {
 	*x = ForwardingRule{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[49]
+		mi := &file_management_proto_msgTypes[51]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4294,7 +4599,7 @@ func (x *ForwardingRule) String() string {
 func (*ForwardingRule) ProtoMessage() {}
 
 func (x *ForwardingRule) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[49]
+	mi := &file_management_proto_msgTypes[51]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4307,7 +4612,7 @@ func (x *ForwardingRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ForwardingRule.ProtoReflect.Descriptor instead.
 func (*ForwardingRule) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{49}
+	return file_management_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *ForwardingRule) GetProtocol() RuleProtocol {
@@ -4356,7 +4661,7 @@ type ExposeServiceRequest struct {
 func (x *ExposeServiceRequest) Reset() {
 	*x = ExposeServiceRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[50]
+		mi := &file_management_proto_msgTypes[52]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4369,7 +4674,7 @@ func (x *ExposeServiceRequest) String() string {
 func (*ExposeServiceRequest) ProtoMessage() {}
 
 func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[50]
+	mi := &file_management_proto_msgTypes[52]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4382,7 +4687,7 @@ func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceRequest.ProtoReflect.Descriptor instead.
 func (*ExposeServiceRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{50}
+	return file_management_proto_rawDescGZIP(), []int{52}
 }
 
 func (x *ExposeServiceRequest) GetPort() uint32 {
@@ -4455,7 +4760,7 @@ type ExposeServiceResponse struct {
 func (x *ExposeServiceResponse) Reset() {
 	*x = ExposeServiceResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[51]
+		mi := &file_management_proto_msgTypes[53]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4468,7 +4773,7 @@ func (x *ExposeServiceResponse) String() string {
 func (*ExposeServiceResponse) ProtoMessage() {}
 
 func (x *ExposeServiceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[51]
+	mi := &file_management_proto_msgTypes[53]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4481,7 +4786,7 @@ func (x *ExposeServiceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceResponse.ProtoReflect.Descriptor instead.
 func (*ExposeServiceResponse) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{51}
+	return file_management_proto_rawDescGZIP(), []int{53}
 }
 
 func (x *ExposeServiceResponse) GetServiceName() string {
@@ -4523,7 +4828,7 @@ type RenewExposeRequest struct {
 func (x *RenewExposeRequest) Reset() {
 	*x = RenewExposeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[52]
+		mi := &file_management_proto_msgTypes[54]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4536,7 +4841,7 @@ func (x *RenewExposeRequest) String() string {
 func (*RenewExposeRequest) ProtoMessage() {}
 
 func (x *RenewExposeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[52]
+	mi := &file_management_proto_msgTypes[54]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4549,7 +4854,7 @@ func (x *RenewExposeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RenewExposeRequest.ProtoReflect.Descriptor instead.
 func (*RenewExposeRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{52}
+	return file_management_proto_rawDescGZIP(), []int{54}
 }
 
 func (x *RenewExposeRequest) GetDomain() string {
@@ -4568,7 +4873,7 @@ type RenewExposeResponse struct {
 func (x *RenewExposeResponse) Reset() {
 	*x = RenewExposeResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[53]
+		mi := &file_management_proto_msgTypes[55]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4581,7 +4886,7 @@ func (x *RenewExposeResponse) String() string {
 func (*RenewExposeResponse) ProtoMessage() {}
 
 func (x *RenewExposeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[53]
+	mi := &file_management_proto_msgTypes[55]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4594,7 +4899,7 @@ func (x *RenewExposeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RenewExposeResponse.ProtoReflect.Descriptor instead.
 func (*RenewExposeResponse) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{53}
+	return file_management_proto_rawDescGZIP(), []int{55}
 }
 
 type StopExposeRequest struct {
@@ -4608,7 +4913,7 @@ type StopExposeRequest struct {
 func (x *StopExposeRequest) Reset() {
 	*x = StopExposeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[54]
+		mi := &file_management_proto_msgTypes[56]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4621,7 +4926,7 @@ func (x *StopExposeRequest) String() string {
 func (*StopExposeRequest) ProtoMessage() {}
 
 func (x *StopExposeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[54]
+	mi := &file_management_proto_msgTypes[56]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4634,7 +4939,7 @@ func (x *StopExposeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopExposeRequest.ProtoReflect.Descriptor instead.
 func (*StopExposeRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{54}
+	return file_management_proto_rawDescGZIP(), []int{56}
 }
 
 func (x *StopExposeRequest) GetDomain() string {
@@ -4653,7 +4958,7 @@ type StopExposeResponse struct {
 func (x *StopExposeResponse) Reset() {
 	*x = StopExposeResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[55]
+		mi := &file_management_proto_msgTypes[57]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4666,7 +4971,7 @@ func (x *StopExposeResponse) String() string {
 func (*StopExposeResponse) ProtoMessage() {}
 
 func (x *StopExposeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[55]
+	mi := &file_management_proto_msgTypes[57]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4679,7 +4984,1959 @@ func (x *StopExposeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopExposeResponse.ProtoReflect.Descriptor instead.
 func (*StopExposeResponse) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{55}
+	return file_management_proto_rawDescGZIP(), []int{57}
+}
+
+// NetworkMapEnvelope wraps either a full snapshot or a delta. Only Full is
+// emitted today; Delta is reserved for the incremental-update work.
+type NetworkMapEnvelope struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Payload:
+	//
+	//	*NetworkMapEnvelope_Full
+	//	*NetworkMapEnvelope_Delta
+	Payload isNetworkMapEnvelope_Payload `protobuf_oneof:"payload"`
+}
+
+func (x *NetworkMapEnvelope) Reset() {
+	*x = NetworkMapEnvelope{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[58]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NetworkMapEnvelope) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NetworkMapEnvelope) ProtoMessage() {}
+
+func (x *NetworkMapEnvelope) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[58]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NetworkMapEnvelope.ProtoReflect.Descriptor instead.
+func (*NetworkMapEnvelope) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{58}
+}
+
+func (m *NetworkMapEnvelope) GetPayload() isNetworkMapEnvelope_Payload {
+	if m != nil {
+		return m.Payload
+	}
+	return nil
+}
+
+func (x *NetworkMapEnvelope) GetFull() *NetworkMapComponentsFull {
+	if x, ok := x.GetPayload().(*NetworkMapEnvelope_Full); ok {
+		return x.Full
+	}
+	return nil
+}
+
+func (x *NetworkMapEnvelope) GetDelta() *NetworkMapComponentsDelta {
+	if x, ok := x.GetPayload().(*NetworkMapEnvelope_Delta); ok {
+		return x.Delta
+	}
+	return nil
+}
+
+type isNetworkMapEnvelope_Payload interface {
+	isNetworkMapEnvelope_Payload()
+}
+
+type NetworkMapEnvelope_Full struct {
+	Full *NetworkMapComponentsFull `protobuf:"bytes,1,opt,name=full,proto3,oneof"`
+}
+
+type NetworkMapEnvelope_Delta struct {
+	Delta *NetworkMapComponentsDelta `protobuf:"bytes,2,opt,name=delta,proto3,oneof"`
+}
+
+func (*NetworkMapEnvelope_Full) isNetworkMapEnvelope_Payload() {}
+
+func (*NetworkMapEnvelope_Delta) isNetworkMapEnvelope_Payload() {}
+
+// NetworkMapComponentsFull is the full per-peer component snapshot. The
+// client decodes it into a types.NetworkMapComponents and runs Calculate()
+// locally to produce the same NetworkMap the legacy server path would have
+// produced. Every field carries RAW component data — no server-side
+// expansion (firewall rules, DNS config, SSH auth, route firewall rules)
+// is shipped; the client computes those itself.
+type NetworkMapComponentsFull struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Serial uint64 `protobuf:"varint,1,opt,name=serial,proto3" json:"serial,omitempty"`
+	// Peer config for the receiving peer (legacy proto.PeerConfig kept as-is —
+	// it carries the receiving peer's own overlay address, FQDN, SSH config).
+	PeerConfig *PeerConfig `protobuf:"bytes,2,opt,name=peer_config,json=peerConfig,proto3" json:"peer_config,omitempty"`
+	// Account-level network metadata (id, IPv4/IPv6 overlay subnets, DNS,
+	// serial). Mirrors types.Network.
+	Network *AccountNetwork `protobuf:"bytes,3,opt,name=network,proto3" json:"network,omitempty"`
+	// Account-level settings the client needs for its local Calculate().
+	AccountSettings *AccountSettingsCompact `protobuf:"bytes,4,opt,name=account_settings,json=accountSettings,proto3" json:"account_settings,omitempty"`
+	// Account DNS settings (mirrors types.DNSSettings).
+	DnsSettings *DNSSettingsCompact `protobuf:"bytes,5,opt,name=dns_settings,json=dnsSettings,proto3" json:"dns_settings,omitempty"`
+	// Domain shared across all peers in this account, e.g. "netbird.cloud".
+	// Each peer's FQDN is dns_label + "." + dns_domain.
+	DnsDomain string `protobuf:"bytes,6,opt,name=dns_domain,json=dnsDomain,proto3" json:"dns_domain,omitempty"`
+	// Custom-zone domain for this peer's view (c.CustomZoneDomain). Empty when
+	// the peer has no custom zone records.
+	CustomZoneDomain string `protobuf:"bytes,7,opt,name=custom_zone_domain,json=customZoneDomain,proto3" json:"custom_zone_domain,omitempty"`
+	// Deduplicated agent versions; PeerCompact.agent_version_idx indexes here.
+	// Empty string at index 0 if any peer has no version.
+	AgentVersions []string `protobuf:"bytes,8,rep,name=agent_versions,json=agentVersions,proto3" json:"agent_versions,omitempty"`
+	// All peers (deduplicated). The client splits peers into online / offline
+	// locally using account_settings.peer_login_expiration on receive.
+	Peers []*PeerCompact `protobuf:"bytes,9,rep,name=peers,proto3" json:"peers,omitempty"`
+	// Indexes into peers for the subset that may act as routers.
+	RouterPeerIndexes []uint32 `protobuf:"varint,10,rep,packed,name=router_peer_indexes,json=routerPeerIndexes,proto3" json:"router_peer_indexes,omitempty"`
+	// Policies that affect the receiving peer.
+	Policies []*PolicyCompact `protobuf:"bytes,11,rep,name=policies,proto3" json:"policies,omitempty"`
+	// Groups in unspecified order — clients key off id (public_id).
+	Groups []*GroupCompact `protobuf:"bytes,12,rep,name=groups,proto3" json:"groups,omitempty"`
+	// Routes relevant to this peer, raw shape (mirrors []*route.Route).
+	Routes []*RouteRaw `protobuf:"bytes,13,rep,name=routes,proto3" json:"routes,omitempty"`
+	// Nameserver groups (mirrors []*nbdns.NameServerGroup).
+	NameserverGroups []*NameServerGroupRaw `protobuf:"bytes,14,rep,name=nameserver_groups,json=nameserverGroups,proto3" json:"nameserver_groups,omitempty"`
+	// All DNS records the client needs to assemble its custom zone. Reuses
+	// the existing SimpleRecord wire shape.
+	AllDnsRecords []*SimpleRecord `protobuf:"bytes,15,rep,name=all_dns_records,json=allDnsRecords,proto3" json:"all_dns_records,omitempty"`
+	// Custom zones (typically the peer's own zone). Reuses the existing
+	// CustomZone wire shape.
+	AccountZones []*CustomZone `protobuf:"bytes,16,rep,name=account_zones,json=accountZones,proto3" json:"account_zones,omitempty"`
+	// Network resources (mirrors []*resourceTypes.NetworkResource).
+	NetworkResources []*NetworkResourceRaw `protobuf:"bytes,17,rep,name=network_resources,json=networkResources,proto3" json:"network_resources,omitempty"`
+	// Routers per network. Outer key: network public_id. Each entry is
+	// the set of routers backing that network for this peer's view.
+	RoutersMap map[string]*NetworkRouterList `protobuf:"bytes,18,rep,name=routers_map,json=routersMap,proto3" json:"routers_map,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// For each NetworkResource public_id, the indexes into policies[]
+	// that apply to it.
+	ResourcePoliciesMap map[string]*PolicyIds `protobuf:"bytes,19,rep,name=resource_policies_map,json=resourcePoliciesMap,proto3" json:"resource_policies_map,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// Group-id (public_id) → user ids authorized for SSH on members.
+	GroupIdToUserIds map[string]*UserIDList `protobuf:"bytes,20,rep,name=group_id_to_user_ids,json=groupIdToUserIds,proto3" json:"group_id_to_user_ids,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// Account-level allowed user ids (used by Calculate() when assembling SSH
+	// authorized users for the receiving peer).
+	AllowedUserIds []string `protobuf:"bytes,21,rep,name=allowed_user_ids,json=allowedUserIds,proto3" json:"allowed_user_ids,omitempty"`
+	// Per posture-check public_id, the set of peer indexes that failed
+	// the check. Server-side evaluation result; clients do not re-evaluate.
+	PostureFailedPeers map[string]*PeerIndexSet `protobuf:"bytes,22,rep,name=posture_failed_peers,json=postureFailedPeers,proto3" json:"posture_failed_peers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// Account-level DNS forwarder port (mirrors the legacy
+	// proto.DNSConfig.ForwarderPort). Computed by the controller from peer
+	// versions; clients fold it into their Calculate() DNS output.
+	DnsForwarderPort int64 `protobuf:"varint,23,opt,name=dns_forwarder_port,json=dnsForwarderPort,proto3" json:"dns_forwarder_port,omitempty"`
+	// Unused; the ingress port-forwarding feature was discontinued.
+	//
+	// Deprecated: Do not use.
+	ProxyPatch *ProxyPatch `protobuf:"bytes,24,opt,name=proxy_patch,json=proxyPatch,proto3" json:"proxy_patch,omitempty"`
+	// SSH UserIDClaim — server-side HttpServerConfig.AuthUserIDClaim, or
+	// "sub" by default. Populated in proto.SSHAuth.UserIDClaim when the
+	// client rebuilds the NetworkMap from this envelope. Empty when the
+	// account has no AuthorizedUsers (and thus no SshAuth to populate).
+	UserIdClaim string `protobuf:"bytes,25,opt,name=user_id_claim,json=userIdClaim,proto3" json:"user_id_claim,omitempty"`
+}
+
+func (x *NetworkMapComponentsFull) Reset() {
+	*x = NetworkMapComponentsFull{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[59]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NetworkMapComponentsFull) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NetworkMapComponentsFull) ProtoMessage() {}
+
+func (x *NetworkMapComponentsFull) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[59]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NetworkMapComponentsFull.ProtoReflect.Descriptor instead.
+func (*NetworkMapComponentsFull) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{59}
+}
+
+func (x *NetworkMapComponentsFull) GetSerial() uint64 {
+	if x != nil {
+		return x.Serial
+	}
+	return 0
+}
+
+func (x *NetworkMapComponentsFull) GetPeerConfig() *PeerConfig {
+	if x != nil {
+		return x.PeerConfig
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetNetwork() *AccountNetwork {
+	if x != nil {
+		return x.Network
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetAccountSettings() *AccountSettingsCompact {
+	if x != nil {
+		return x.AccountSettings
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetDnsSettings() *DNSSettingsCompact {
+	if x != nil {
+		return x.DnsSettings
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetDnsDomain() string {
+	if x != nil {
+		return x.DnsDomain
+	}
+	return ""
+}
+
+func (x *NetworkMapComponentsFull) GetCustomZoneDomain() string {
+	if x != nil {
+		return x.CustomZoneDomain
+	}
+	return ""
+}
+
+func (x *NetworkMapComponentsFull) GetAgentVersions() []string {
+	if x != nil {
+		return x.AgentVersions
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetPeers() []*PeerCompact {
+	if x != nil {
+		return x.Peers
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetRouterPeerIndexes() []uint32 {
+	if x != nil {
+		return x.RouterPeerIndexes
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetPolicies() []*PolicyCompact {
+	if x != nil {
+		return x.Policies
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetGroups() []*GroupCompact {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetRoutes() []*RouteRaw {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetNameserverGroups() []*NameServerGroupRaw {
+	if x != nil {
+		return x.NameserverGroups
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetAllDnsRecords() []*SimpleRecord {
+	if x != nil {
+		return x.AllDnsRecords
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetAccountZones() []*CustomZone {
+	if x != nil {
+		return x.AccountZones
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetNetworkResources() []*NetworkResourceRaw {
+	if x != nil {
+		return x.NetworkResources
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetRoutersMap() map[string]*NetworkRouterList {
+	if x != nil {
+		return x.RoutersMap
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetResourcePoliciesMap() map[string]*PolicyIds {
+	if x != nil {
+		return x.ResourcePoliciesMap
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetGroupIdToUserIds() map[string]*UserIDList {
+	if x != nil {
+		return x.GroupIdToUserIds
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetAllowedUserIds() []string {
+	if x != nil {
+		return x.AllowedUserIds
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetPostureFailedPeers() map[string]*PeerIndexSet {
+	if x != nil {
+		return x.PostureFailedPeers
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetDnsForwarderPort() int64 {
+	if x != nil {
+		return x.DnsForwarderPort
+	}
+	return 0
+}
+
+// Deprecated: Do not use.
+func (x *NetworkMapComponentsFull) GetProxyPatch() *ProxyPatch {
+	if x != nil {
+		return x.ProxyPatch
+	}
+	return nil
+}
+
+func (x *NetworkMapComponentsFull) GetUserIdClaim() string {
+	if x != nil {
+		return x.UserIdClaim
+	}
+	return ""
+}
+
+// ProxyPatch is unused; the ingress port-forwarding feature was discontinued.
+//
+// Deprecated: Do not use.
+type ProxyPatch struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Peers              []*RemotePeerConfig  `protobuf:"bytes,1,rep,name=peers,proto3" json:"peers,omitempty"`
+	OfflinePeers       []*RemotePeerConfig  `protobuf:"bytes,2,rep,name=offline_peers,json=offlinePeers,proto3" json:"offline_peers,omitempty"`
+	FirewallRules      []*FirewallRule      `protobuf:"bytes,3,rep,name=firewall_rules,json=firewallRules,proto3" json:"firewall_rules,omitempty"`
+	Routes             []*Route             `protobuf:"bytes,4,rep,name=routes,proto3" json:"routes,omitempty"`
+	RouteFirewallRules []*RouteFirewallRule `protobuf:"bytes,5,rep,name=route_firewall_rules,json=routeFirewallRules,proto3" json:"route_firewall_rules,omitempty"`
+	ForwardingRules    []*ForwardingRule    `protobuf:"bytes,6,rep,name=forwarding_rules,json=forwardingRules,proto3" json:"forwarding_rules,omitempty"`
+}
+
+func (x *ProxyPatch) Reset() {
+	*x = ProxyPatch{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[60]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ProxyPatch) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProxyPatch) ProtoMessage() {}
+
+func (x *ProxyPatch) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[60]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProxyPatch.ProtoReflect.Descriptor instead.
+func (*ProxyPatch) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{60}
+}
+
+func (x *ProxyPatch) GetPeers() []*RemotePeerConfig {
+	if x != nil {
+		return x.Peers
+	}
+	return nil
+}
+
+func (x *ProxyPatch) GetOfflinePeers() []*RemotePeerConfig {
+	if x != nil {
+		return x.OfflinePeers
+	}
+	return nil
+}
+
+func (x *ProxyPatch) GetFirewallRules() []*FirewallRule {
+	if x != nil {
+		return x.FirewallRules
+	}
+	return nil
+}
+
+func (x *ProxyPatch) GetRoutes() []*Route {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
+func (x *ProxyPatch) GetRouteFirewallRules() []*RouteFirewallRule {
+	if x != nil {
+		return x.RouteFirewallRules
+	}
+	return nil
+}
+
+func (x *ProxyPatch) GetForwardingRules() []*ForwardingRule {
+	if x != nil {
+		return x.ForwardingRules
+	}
+	return nil
+}
+
+// AccountSettingsCompact carries the account-level settings the client needs
+// to evaluate locally. Mirrors the subset of types.AccountSettingsInfo that
+// Calculate() actually reads — login-expiration (used to filter expired
+// peers). Inactivity expiration is purely server-side bookkeeping and is not
+// shipped.
+type AccountSettingsCompact struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PeerLoginExpirationEnabled bool `protobuf:"varint,1,opt,name=peer_login_expiration_enabled,json=peerLoginExpirationEnabled,proto3" json:"peer_login_expiration_enabled,omitempty"`
+	// Login expiration window. Unit is nanoseconds (matches time.Duration).
+	PeerLoginExpirationNs int64 `protobuf:"varint,2,opt,name=peer_login_expiration_ns,json=peerLoginExpirationNs,proto3" json:"peer_login_expiration_ns,omitempty"`
+}
+
+func (x *AccountSettingsCompact) Reset() {
+	*x = AccountSettingsCompact{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[61]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccountSettingsCompact) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccountSettingsCompact) ProtoMessage() {}
+
+func (x *AccountSettingsCompact) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[61]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccountSettingsCompact.ProtoReflect.Descriptor instead.
+func (*AccountSettingsCompact) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{61}
+}
+
+func (x *AccountSettingsCompact) GetPeerLoginExpirationEnabled() bool {
+	if x != nil {
+		return x.PeerLoginExpirationEnabled
+	}
+	return false
+}
+
+func (x *AccountSettingsCompact) GetPeerLoginExpirationNs() int64 {
+	if x != nil {
+		return x.PeerLoginExpirationNs
+	}
+	return 0
+}
+
+// AccountNetwork is the account-level overlay metadata. Mirrors types.Network
+// so the client can populate NetworkMap.Network without a server round-trip.
+type AccountNetwork struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Identifier string `protobuf:"bytes,1,opt,name=identifier,proto3" json:"identifier,omitempty"`
+	// IPv4 overlay subnet in CIDR form (e.g. "100.64.0.0/16").
+	NetCidr string `protobuf:"bytes,2,opt,name=net_cidr,json=netCidr,proto3" json:"net_cidr,omitempty"`
+	// IPv6 ULA overlay subnet in CIDR form (e.g. "fd00:4e42::/64"). Empty when
+	// the account has no IPv6 overlay yet.
+	NetV6Cidr string `protobuf:"bytes,3,opt,name=net_v6_cidr,json=netV6Cidr,proto3" json:"net_v6_cidr,omitempty"`
+	Dns       string `protobuf:"bytes,4,opt,name=dns,proto3" json:"dns,omitempty"`
+	Serial    uint64 `protobuf:"varint,5,opt,name=serial,proto3" json:"serial,omitempty"`
+}
+
+func (x *AccountNetwork) Reset() {
+	*x = AccountNetwork{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[62]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccountNetwork) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccountNetwork) ProtoMessage() {}
+
+func (x *AccountNetwork) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[62]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccountNetwork.ProtoReflect.Descriptor instead.
+func (*AccountNetwork) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{62}
+}
+
+func (x *AccountNetwork) GetIdentifier() string {
+	if x != nil {
+		return x.Identifier
+	}
+	return ""
+}
+
+func (x *AccountNetwork) GetNetCidr() string {
+	if x != nil {
+		return x.NetCidr
+	}
+	return ""
+}
+
+func (x *AccountNetwork) GetNetV6Cidr() string {
+	if x != nil {
+		return x.NetV6Cidr
+	}
+	return ""
+}
+
+func (x *AccountNetwork) GetDns() string {
+	if x != nil {
+		return x.Dns
+	}
+	return ""
+}
+
+func (x *AccountNetwork) GetSerial() uint64 {
+	if x != nil {
+		return x.Serial
+	}
+	return 0
+}
+
+// NetworkMapComponentsDelta is reserved for the incremental update
+// protocol. Field numbers 1–100 are pre-allocated to keep room for the
+// planned event types without needing a renumber.
+type NetworkMapComponentsDelta struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *NetworkMapComponentsDelta) Reset() {
+	*x = NetworkMapComponentsDelta{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[63]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NetworkMapComponentsDelta) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NetworkMapComponentsDelta) ProtoMessage() {}
+
+func (x *NetworkMapComponentsDelta) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[63]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NetworkMapComponentsDelta.ProtoReflect.Descriptor instead.
+func (*NetworkMapComponentsDelta) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{63}
+}
+
+// PeerCompact is the wire-shape of a remote peer used by the component
+// format. It carries every field of types.Peer that the client's local
+// Calculate() reads — including the trio needed to evaluate
+// LoginExpired() (added_with_sso_login + login_expiration_enabled +
+// last_login_unix_nano). Fields the client does not consume (Status,
+// CreatedAt, etc.) are not shipped.
+type PeerCompact struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Raw 32-byte WireGuard public key (no base64 wrapping).
+	WgPubKey []byte `protobuf:"bytes,1,opt,name=wg_pub_key,json=wgPubKey,proto3" json:"wg_pub_key,omitempty"`
+	// Raw 4-byte IPv4 overlay address. Always a /32 host route, so no prefix
+	// byte is needed.
+	Ip []byte `protobuf:"bytes,2,opt,name=ip,proto3" json:"ip,omitempty"`
+	// Raw 16-byte IPv6 overlay address; always a /128 host route. Empty when
+	// the peer has no IPv6 overlay address.
+	Ipv6 []byte `protobuf:"bytes,3,opt,name=ipv6,proto3" json:"ipv6,omitempty"`
+	// Raw SSH public key bytes (or empty).
+	SshPubKey []byte `protobuf:"bytes,4,opt,name=ssh_pub_key,json=sshPubKey,proto3" json:"ssh_pub_key,omitempty"`
+	// DNS label without the account's domain suffix. Full FQDN is
+	// dns_label + "." + NetworkMapComponentsFull.dns_domain.
+	DnsLabel     string `protobuf:"bytes,5,opt,name=dns_label,json=dnsLabel,proto3" json:"dns_label,omitempty"`
+	AgentVersion string `protobuf:"bytes,6,opt,name=agent_version,json=agentVersion,proto3" json:"agent_version,omitempty"`
+	// True iff the peer was added via SSO login (i.e., types.Peer.UserID is
+	// non-empty). Combined with login_expiration_enabled and
+	// last_login_unix_nano this lets the client reproduce
+	// (*Peer).LoginExpired() locally.
+	AddedWithSsoLogin bool `protobuf:"varint,7,opt,name=added_with_sso_login,json=addedWithSsoLogin,proto3" json:"added_with_sso_login,omitempty"`
+	// True when the peer's login can expire — mirrors
+	// types.Peer.LoginExpirationEnabled.
+	LoginExpirationEnabled bool `protobuf:"varint,8,opt,name=login_expiration_enabled,json=loginExpirationEnabled,proto3" json:"login_expiration_enabled,omitempty"`
+	// Unix-nanosecond timestamp of the peer's last login. 0 when the peer has
+	// never logged in (server stores nil; client treats 0 as "epoch", which
+	// makes a fresh peer immediately expired iff login_expiration_enabled is
+	// true — the same semantics as types.Peer.GetLastLogin).
+	LastLoginUnixNano int64 `protobuf:"varint,9,opt,name=last_login_unix_nano,json=lastLoginUnixNano,proto3" json:"last_login_unix_nano,omitempty"`
+	// True when the peer has an SSH server enabled locally. Used by the
+	// legacy SSH path in Calculate() (`policyRuleImpliesLegacySSH`): a rule
+	// with protocol ALL/TCP-with-SSH-ports activates SSH for the receiving
+	// peer when this bit is set, even without an explicit NetbirdSSH rule.
+	SshEnabled bool `protobuf:"varint,10,opt,name=ssh_enabled,json=sshEnabled,proto3" json:"ssh_enabled,omitempty"`
+	// Mirror of types.Peer.SupportsIPv6() — !Meta.Flags.DisableIPv6 &&
+	// HasCapability(PeerCapabilityIPv6Overlay). Used by the local peer's
+	// Calculate() when deciding whether to emit IPv6 firewall rules
+	// (appendIPv6FirewallRule) against this peer's IPv6 address.
+	SupportsIpv6 bool `protobuf:"varint,11,opt,name=supports_ipv6,json=supportsIpv6,proto3" json:"supports_ipv6,omitempty"`
+	// Mirror of types.Peer.SupportsSourcePrefixes() —
+	// HasCapability(PeerCapabilitySourcePrefixes). Determines whether the
+	// local peer's Calculate() emits SourcePrefixes alongside legacy PeerIP
+	// fields in proto.FirewallRule.
+	SupportsSourcePrefixes bool `protobuf:"varint,12,opt,name=supports_source_prefixes,json=supportsSourcePrefixes,proto3" json:"supports_source_prefixes,omitempty"`
+	// Mirror of types.Peer.Meta.Flags.ServerSSHAllowed. Read by Calculate()
+	// when expanding TCP port-22 firewall rules — the native SSH companion
+	// (port 22022) is only added when this flag is set and the peer agent
+	// version supports it.
+	ServerSshAllowed bool `protobuf:"varint,13,opt,name=server_ssh_allowed,json=serverSshAllowed,proto3" json:"server_ssh_allowed,omitempty"`
+	// Mirror of types.Peer.ProxyMeta.Embedded. Connections involving an
+	// ephemeral proxy peer on either endpoint default to lazy, so this bit
+	// feeds the per-peer lazyState emitted in RemotePeerConfig.
+	ProxyEmbedded bool `protobuf:"varint,14,opt,name=proxy_embedded,json=proxyEmbedded,proto3" json:"proxy_embedded,omitempty"`
+}
+
+func (x *PeerCompact) Reset() {
+	*x = PeerCompact{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[64]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PeerCompact) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PeerCompact) ProtoMessage() {}
+
+func (x *PeerCompact) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[64]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PeerCompact.ProtoReflect.Descriptor instead.
+func (*PeerCompact) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{64}
+}
+
+func (x *PeerCompact) GetWgPubKey() []byte {
+	if x != nil {
+		return x.WgPubKey
+	}
+	return nil
+}
+
+func (x *PeerCompact) GetIp() []byte {
+	if x != nil {
+		return x.Ip
+	}
+	return nil
+}
+
+func (x *PeerCompact) GetIpv6() []byte {
+	if x != nil {
+		return x.Ipv6
+	}
+	return nil
+}
+
+func (x *PeerCompact) GetSshPubKey() []byte {
+	if x != nil {
+		return x.SshPubKey
+	}
+	return nil
+}
+
+func (x *PeerCompact) GetDnsLabel() string {
+	if x != nil {
+		return x.DnsLabel
+	}
+	return ""
+}
+
+func (x *PeerCompact) GetAgentVersion() string {
+	if x != nil {
+		return x.AgentVersion
+	}
+	return ""
+}
+
+func (x *PeerCompact) GetAddedWithSsoLogin() bool {
+	if x != nil {
+		return x.AddedWithSsoLogin
+	}
+	return false
+}
+
+func (x *PeerCompact) GetLoginExpirationEnabled() bool {
+	if x != nil {
+		return x.LoginExpirationEnabled
+	}
+	return false
+}
+
+func (x *PeerCompact) GetLastLoginUnixNano() int64 {
+	if x != nil {
+		return x.LastLoginUnixNano
+	}
+	return 0
+}
+
+func (x *PeerCompact) GetSshEnabled() bool {
+	if x != nil {
+		return x.SshEnabled
+	}
+	return false
+}
+
+func (x *PeerCompact) GetSupportsIpv6() bool {
+	if x != nil {
+		return x.SupportsIpv6
+	}
+	return false
+}
+
+func (x *PeerCompact) GetSupportsSourcePrefixes() bool {
+	if x != nil {
+		return x.SupportsSourcePrefixes
+	}
+	return false
+}
+
+func (x *PeerCompact) GetServerSshAllowed() bool {
+	if x != nil {
+		return x.ServerSshAllowed
+	}
+	return false
+}
+
+func (x *PeerCompact) GetProxyEmbedded() bool {
+	if x != nil {
+		return x.ProxyEmbedded
+	}
+	return false
+}
+
+// PolicyCompact is the compact form of a policy rule. Group references use
+// the public_ids; the client resolves
+// them against NetworkMapComponentsFull.groups. Direction is derived per-peer
+// on the client (ingress when the peer is in destination_group_ids, egress
+// when in source_group_ids; both when bidirectional).
+type PolicyCompact struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// public_id. Used as a stable reference for
+	// ResourcePoliciesMap.indexes and future delta updates.
+	Id            string       `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Action        RuleAction   `protobuf:"varint,2,opt,name=action,proto3,enum=management.RuleAction" json:"action,omitempty"`
+	Protocol      RuleProtocol `protobuf:"varint,3,opt,name=protocol,proto3,enum=management.RuleProtocol" json:"protocol,omitempty"`
+	Bidirectional bool         `protobuf:"varint,4,opt,name=bidirectional,proto3" json:"bidirectional,omitempty"`
+	// Single ports referenced by the rule.
+	Ports []uint32 `protobuf:"varint,5,rep,packed,name=ports,proto3" json:"ports,omitempty"`
+	// Port ranges (start..end) referenced by the rule.
+	PortRanges []*PortInfo_Range `protobuf:"bytes,6,rep,name=port_ranges,json=portRanges,proto3" json:"port_ranges,omitempty"`
+	// Group ids (public_ids) of source / destination groups.
+	SourceGroupIds      []string `protobuf:"bytes,7,rep,name=source_group_ids,json=sourceGroupIds,proto3" json:"source_group_ids,omitempty"`
+	DestinationGroupIds []string `protobuf:"bytes,8,rep,name=destination_group_ids,json=destinationGroupIds,proto3" json:"destination_group_ids,omitempty"`
+	// SSH authorization fields. PolicyRule.AuthorizedGroups maps the rule's
+	// applicable group ids (public_ids) to a list of local-user names —
+	// when a peer in one of those groups is the SSH destination, the named
+	// local users gain access. AuthorizedUser is the single-user form
+	// (legacy: rule scopes SSH to one specific user id).
+	//
+	// Both fields are only consumed by Calculate() when the rule's protocol
+	// is NetbirdSSH (or the legacy implicit-SSH heuristic).
+	AuthorizedGroups map[string]*UserNameList `protobuf:"bytes,9,rep,name=authorized_groups,json=authorizedGroups,proto3" json:"authorized_groups,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	AuthorizedUser   string                   `protobuf:"bytes,10,opt,name=authorized_user,json=authorizedUser,proto3" json:"authorized_user,omitempty"`
+	// Resource-typed rule sources/destinations. When a rule targets a specific
+	// peer (rather than groups), Calculate() reads SourceResource /
+	// DestinationResource — without these the rule's connection resources
+	// can't be produced on the client. ResourceCompact's peer_index refers to
+	// NetworkMapComponentsFull.peers; type is the raw ResourceType string
+	// ("peer", "host", "subnet", "domain"). Only "peer" is meaningful for
+	// Calculate's resource-typed rule path today.
+	SourceResource      *ResourceCompact `protobuf:"bytes,11,opt,name=source_resource,json=sourceResource,proto3" json:"source_resource,omitempty"`
+	DestinationResource *ResourceCompact `protobuf:"bytes,12,opt,name=destination_resource,json=destinationResource,proto3" json:"destination_resource,omitempty"`
+	// Posture-check ids gating this policy's source peers. Calculate()
+	// reads them when filtering rule peers (peers that fail any listed check
+	// are dropped from sourcePeers). Match keys in
+	// NetworkMapComponentsFull.posture_failed_peers.
+	SourcePostureCheckIds []string `protobuf:"bytes,13,rep,name=source_posture_check_ids,json=sourcePostureCheckIds,proto3" json:"source_posture_check_ids,omitempty"`
+}
+
+func (x *PolicyCompact) Reset() {
+	*x = PolicyCompact{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[65]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PolicyCompact) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PolicyCompact) ProtoMessage() {}
+
+func (x *PolicyCompact) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[65]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PolicyCompact.ProtoReflect.Descriptor instead.
+func (*PolicyCompact) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{65}
+}
+
+func (x *PolicyCompact) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *PolicyCompact) GetAction() RuleAction {
+	if x != nil {
+		return x.Action
+	}
+	return RuleAction_ACCEPT
+}
+
+func (x *PolicyCompact) GetProtocol() RuleProtocol {
+	if x != nil {
+		return x.Protocol
+	}
+	return RuleProtocol_UNKNOWN
+}
+
+func (x *PolicyCompact) GetBidirectional() bool {
+	if x != nil {
+		return x.Bidirectional
+	}
+	return false
+}
+
+func (x *PolicyCompact) GetPorts() []uint32 {
+	if x != nil {
+		return x.Ports
+	}
+	return nil
+}
+
+func (x *PolicyCompact) GetPortRanges() []*PortInfo_Range {
+	if x != nil {
+		return x.PortRanges
+	}
+	return nil
+}
+
+func (x *PolicyCompact) GetSourceGroupIds() []string {
+	if x != nil {
+		return x.SourceGroupIds
+	}
+	return nil
+}
+
+func (x *PolicyCompact) GetDestinationGroupIds() []string {
+	if x != nil {
+		return x.DestinationGroupIds
+	}
+	return nil
+}
+
+func (x *PolicyCompact) GetAuthorizedGroups() map[string]*UserNameList {
+	if x != nil {
+		return x.AuthorizedGroups
+	}
+	return nil
+}
+
+func (x *PolicyCompact) GetAuthorizedUser() string {
+	if x != nil {
+		return x.AuthorizedUser
+	}
+	return ""
+}
+
+func (x *PolicyCompact) GetSourceResource() *ResourceCompact {
+	if x != nil {
+		return x.SourceResource
+	}
+	return nil
+}
+
+func (x *PolicyCompact) GetDestinationResource() *ResourceCompact {
+	if x != nil {
+		return x.DestinationResource
+	}
+	return nil
+}
+
+func (x *PolicyCompact) GetSourcePostureCheckIds() []string {
+	if x != nil {
+		return x.SourcePostureCheckIds
+	}
+	return nil
+}
+
+// ResourceCompact mirrors types.Resource. Used by PolicyCompact to carry
+// rule.SourceResource / rule.DestinationResource when the rule targets a
+// specific resource (typically a peer) rather than groups.
+type ResourceCompact struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type         string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	PeerIndexSet bool   `protobuf:"varint,2,opt,name=peer_index_set,json=peerIndexSet,proto3" json:"peer_index_set,omitempty"`
+	PeerIndex    uint32 `protobuf:"varint,3,opt,name=peer_index,json=peerIndex,proto3" json:"peer_index,omitempty"`
+	Id           string `protobuf:"bytes,5,opt,name=id,proto3" json:"id,omitempty"` // public id for domain/host/subnet resources
+}
+
+func (x *ResourceCompact) Reset() {
+	*x = ResourceCompact{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[66]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResourceCompact) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResourceCompact) ProtoMessage() {}
+
+func (x *ResourceCompact) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[66]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResourceCompact.ProtoReflect.Descriptor instead.
+func (*ResourceCompact) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{66}
+}
+
+func (x *ResourceCompact) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *ResourceCompact) GetPeerIndexSet() bool {
+	if x != nil {
+		return x.PeerIndexSet
+	}
+	return false
+}
+
+func (x *ResourceCompact) GetPeerIndex() uint32 {
+	if x != nil {
+		return x.PeerIndex
+	}
+	return 0
+}
+
+func (x *ResourceCompact) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+// UserNameList is a list of local-user names — used as the value type in
+// PolicyCompact.authorized_groups.
+type UserNameList struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Names []string `protobuf:"bytes,1,rep,name=names,proto3" json:"names,omitempty"`
+}
+
+func (x *UserNameList) Reset() {
+	*x = UserNameList{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[67]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UserNameList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserNameList) ProtoMessage() {}
+
+func (x *UserNameList) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[67]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserNameList.ProtoReflect.Descriptor instead.
+func (*UserNameList) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{67}
+}
+
+func (x *UserNameList) GetNames() []string {
+	if x != nil {
+		return x.Names
+	}
+	return nil
+}
+
+// GroupCompact is the wire-shape of a group: public id, optional
+// name, and indexes into NetworkMapComponentsFull.peers identifying members.
+type GroupCompact struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// id comes from PublicID. Used by PolicyCompact.source_group_ids / destination_group_ids.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Indexes into NetworkMapComponentsFull.peers.
+	PeerIndexes []uint32 `protobuf:"varint,2,rep,packed,name=peer_indexes,json=peerIndexes,proto3" json:"peer_indexes,omitempty"`
+	// True when the group is named "All" (types.Group.IsGroupAll). The
+	// client-side Calculate short-circuits group→peer expansion on such
+	// groups exactly like the server does; without this bit the decoded
+	// groups lose that property and the two sides expand policy
+	// destinations differently.
+	IsAll     bool               `protobuf:"varint,3,opt,name=is_all,json=isAll,proto3" json:"is_all,omitempty"`
+	Resources []*ResourceCompact `protobuf:"bytes,4,rep,name=resources,proto3" json:"resources,omitempty"`
+}
+
+func (x *GroupCompact) Reset() {
+	*x = GroupCompact{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[68]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GroupCompact) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GroupCompact) ProtoMessage() {}
+
+func (x *GroupCompact) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[68]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GroupCompact.ProtoReflect.Descriptor instead.
+func (*GroupCompact) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{68}
+}
+
+func (x *GroupCompact) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *GroupCompact) GetPeerIndexes() []uint32 {
+	if x != nil {
+		return x.PeerIndexes
+	}
+	return nil
+}
+
+func (x *GroupCompact) GetIsAll() bool {
+	if x != nil {
+		return x.IsAll
+	}
+	return false
+}
+
+func (x *GroupCompact) GetResources() []*ResourceCompact {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+// DNSSettingsCompact mirrors types.DNSSettings.
+type DNSSettingsCompact struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Group ids (public_id) whose DNS management is disabled.
+	DisabledManagementGroupIds []string `protobuf:"bytes,1,rep,name=disabled_management_group_ids,json=disabledManagementGroupIds,proto3" json:"disabled_management_group_ids,omitempty"`
+}
+
+func (x *DNSSettingsCompact) Reset() {
+	*x = DNSSettingsCompact{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[69]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DNSSettingsCompact) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DNSSettingsCompact) ProtoMessage() {}
+
+func (x *DNSSettingsCompact) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[69]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DNSSettingsCompact.ProtoReflect.Descriptor instead.
+func (*DNSSettingsCompact) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{69}
+}
+
+func (x *DNSSettingsCompact) GetDisabledManagementGroupIds() []string {
+	if x != nil {
+		return x.DisabledManagementGroupIds
+	}
+	return nil
+}
+
+// RouteRaw mirrors *route.Route (the domain type), trimmed to fields that
+// types.NetworkMapComponents.Calculate() reads. Group references are
+// public_ids; the routing peer (when set) is referenced by index into
+// NetworkMapComponentsFull.peers.
+type RouteRaw struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id          string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` // public_id
+	NetId       string `protobuf:"bytes,2,opt,name=net_id,json=netId,proto3" json:"net_id,omitempty"`
+	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+	// Either network_cidr (e.g. "10.0.0.0/16") or domains is set, not both.
+	NetworkCidr string   `protobuf:"bytes,4,opt,name=network_cidr,json=networkCidr,proto3" json:"network_cidr,omitempty"`
+	Domains     []string `protobuf:"bytes,5,rep,name=domains,proto3" json:"domains,omitempty"`
+	KeepRoute   bool     `protobuf:"varint,6,opt,name=keep_route,json=keepRoute,proto3" json:"keep_route,omitempty"`
+	// Routing peer reference: peer_index_set tells whether peer_index is valid
+	// (proto3 uint32 cannot disambiguate "0" from "unset"). Mutually exclusive
+	// with peer_group_ids.
+	//
+	// peer_index decodes back to types.Peer.ID (the peer's xid string), NOT
+	// to its WireGuard public key. This matches the server-side data flow:
+	// c.Routes carry route.Peer = peer.ID, and getRoutingPeerRoutes mutates
+	// it to peer.Key only after the route has been admitted to the network
+	// map. Decoders MUST set Route.Peer = peer.ID; the legacy Calculate()
+	// path will substitute the WG key downstream.
+	PeerIndexSet          bool     `protobuf:"varint,7,opt,name=peer_index_set,json=peerIndexSet,proto3" json:"peer_index_set,omitempty"`
+	PeerIndex             uint32   `protobuf:"varint,8,opt,name=peer_index,json=peerIndex,proto3" json:"peer_index,omitempty"`
+	PeerGroupIds          []string `protobuf:"bytes,9,rep,name=peer_group_ids,json=peerGroupIds,proto3" json:"peer_group_ids,omitempty"`
+	NetworkType           int32    `protobuf:"varint,10,opt,name=network_type,json=networkType,proto3" json:"network_type,omitempty"`
+	Masquerade            bool     `protobuf:"varint,11,opt,name=masquerade,proto3" json:"masquerade,omitempty"`
+	Metric                int32    `protobuf:"varint,12,opt,name=metric,proto3" json:"metric,omitempty"`
+	Enabled               bool     `protobuf:"varint,13,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	GroupIds              []string `protobuf:"bytes,14,rep,name=group_ids,json=groupIds,proto3" json:"group_ids,omitempty"`
+	AccessControlGroupIds []string `protobuf:"bytes,15,rep,name=access_control_group_ids,json=accessControlGroupIds,proto3" json:"access_control_group_ids,omitempty"`
+	SkipAutoApply         bool     `protobuf:"varint,16,opt,name=skip_auto_apply,json=skipAutoApply,proto3" json:"skip_auto_apply,omitempty"`
+}
+
+func (x *RouteRaw) Reset() {
+	*x = RouteRaw{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[70]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RouteRaw) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RouteRaw) ProtoMessage() {}
+
+func (x *RouteRaw) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[70]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RouteRaw.ProtoReflect.Descriptor instead.
+func (*RouteRaw) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{70}
+}
+
+func (x *RouteRaw) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *RouteRaw) GetNetId() string {
+	if x != nil {
+		return x.NetId
+	}
+	return ""
+}
+
+func (x *RouteRaw) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *RouteRaw) GetNetworkCidr() string {
+	if x != nil {
+		return x.NetworkCidr
+	}
+	return ""
+}
+
+func (x *RouteRaw) GetDomains() []string {
+	if x != nil {
+		return x.Domains
+	}
+	return nil
+}
+
+func (x *RouteRaw) GetKeepRoute() bool {
+	if x != nil {
+		return x.KeepRoute
+	}
+	return false
+}
+
+func (x *RouteRaw) GetPeerIndexSet() bool {
+	if x != nil {
+		return x.PeerIndexSet
+	}
+	return false
+}
+
+func (x *RouteRaw) GetPeerIndex() uint32 {
+	if x != nil {
+		return x.PeerIndex
+	}
+	return 0
+}
+
+func (x *RouteRaw) GetPeerGroupIds() []string {
+	if x != nil {
+		return x.PeerGroupIds
+	}
+	return nil
+}
+
+func (x *RouteRaw) GetNetworkType() int32 {
+	if x != nil {
+		return x.NetworkType
+	}
+	return 0
+}
+
+func (x *RouteRaw) GetMasquerade() bool {
+	if x != nil {
+		return x.Masquerade
+	}
+	return false
+}
+
+func (x *RouteRaw) GetMetric() int32 {
+	if x != nil {
+		return x.Metric
+	}
+	return 0
+}
+
+func (x *RouteRaw) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *RouteRaw) GetGroupIds() []string {
+	if x != nil {
+		return x.GroupIds
+	}
+	return nil
+}
+
+func (x *RouteRaw) GetAccessControlGroupIds() []string {
+	if x != nil {
+		return x.AccessControlGroupIds
+	}
+	return nil
+}
+
+func (x *RouteRaw) GetSkipAutoApply() bool {
+	if x != nil {
+		return x.SkipAutoApply
+	}
+	return false
+}
+
+// NameServerGroupRaw mirrors *nbdns.NameServerGroup. Distinct from the
+// legacy NameServerGroup (which is the wire-trimmed shape consumed by
+// proto.DNSConfig and lacks the Name/Description/Groups/Enabled fields).
+type NameServerGroupRaw struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Reuses the legacy NameServer wire shape (IP as string).
+	Nameservers []*NameServer `protobuf:"bytes,2,rep,name=nameservers,proto3" json:"nameservers,omitempty"`
+	// Group ids the NSG distributes nameservers to.
+	GroupIds             []string `protobuf:"bytes,3,rep,name=group_ids,json=groupIds,proto3" json:"group_ids,omitempty"`
+	Primary              bool     `protobuf:"varint,4,opt,name=primary,proto3" json:"primary,omitempty"`
+	Domains              []string `protobuf:"bytes,5,rep,name=domains,proto3" json:"domains,omitempty"`
+	Enabled              bool     `protobuf:"varint,6,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	SearchDomainsEnabled bool     `protobuf:"varint,7,opt,name=search_domains_enabled,json=searchDomainsEnabled,proto3" json:"search_domains_enabled,omitempty"`
+}
+
+func (x *NameServerGroupRaw) Reset() {
+	*x = NameServerGroupRaw{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[71]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NameServerGroupRaw) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NameServerGroupRaw) ProtoMessage() {}
+
+func (x *NameServerGroupRaw) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[71]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NameServerGroupRaw.ProtoReflect.Descriptor instead.
+func (*NameServerGroupRaw) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{71}
+}
+
+func (x *NameServerGroupRaw) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *NameServerGroupRaw) GetNameservers() []*NameServer {
+	if x != nil {
+		return x.Nameservers
+	}
+	return nil
+}
+
+func (x *NameServerGroupRaw) GetGroupIds() []string {
+	if x != nil {
+		return x.GroupIds
+	}
+	return nil
+}
+
+func (x *NameServerGroupRaw) GetPrimary() bool {
+	if x != nil {
+		return x.Primary
+	}
+	return false
+}
+
+func (x *NameServerGroupRaw) GetDomains() []string {
+	if x != nil {
+		return x.Domains
+	}
+	return nil
+}
+
+func (x *NameServerGroupRaw) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *NameServerGroupRaw) GetSearchDomainsEnabled() bool {
+	if x != nil {
+		return x.SearchDomainsEnabled
+	}
+	return false
+}
+
+// NetworkResourceRaw mirrors *resourceTypes.NetworkResource.
+type NetworkResourceRaw struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id          string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	NetworkSeq  string `protobuf:"bytes,2,opt,name=network_seq,json=networkSeq,proto3" json:"network_seq,omitempty"`
+	Name        string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
+	// Resource type: "host" / "subnet" / "domain".
+	Type        string `protobuf:"bytes,5,opt,name=type,proto3" json:"type,omitempty"`
+	Address     string `protobuf:"bytes,6,opt,name=address,proto3" json:"address,omitempty"`
+	DomainValue string `protobuf:"bytes,7,opt,name=domain_value,json=domainValue,proto3" json:"domain_value,omitempty"` // resource.Domain
+	PrefixCidr  string `protobuf:"bytes,8,opt,name=prefix_cidr,json=prefixCidr,proto3" json:"prefix_cidr,omitempty"`
+	Enabled     bool   `protobuf:"varint,9,opt,name=enabled,proto3" json:"enabled,omitempty"`
+}
+
+func (x *NetworkResourceRaw) Reset() {
+	*x = NetworkResourceRaw{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[72]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NetworkResourceRaw) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NetworkResourceRaw) ProtoMessage() {}
+
+func (x *NetworkResourceRaw) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[72]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NetworkResourceRaw.ProtoReflect.Descriptor instead.
+func (*NetworkResourceRaw) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{72}
+}
+
+func (x *NetworkResourceRaw) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *NetworkResourceRaw) GetNetworkSeq() string {
+	if x != nil {
+		return x.NetworkSeq
+	}
+	return ""
+}
+
+func (x *NetworkResourceRaw) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *NetworkResourceRaw) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *NetworkResourceRaw) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *NetworkResourceRaw) GetAddress() string {
+	if x != nil {
+		return x.Address
+	}
+	return ""
+}
+
+func (x *NetworkResourceRaw) GetDomainValue() string {
+	if x != nil {
+		return x.DomainValue
+	}
+	return ""
+}
+
+func (x *NetworkResourceRaw) GetPrefixCidr() string {
+	if x != nil {
+		return x.PrefixCidr
+	}
+	return ""
+}
+
+func (x *NetworkResourceRaw) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+// NetworkRouterList carries the routers backing one network.
+type NetworkRouterList struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Routers in this network, keyed by peer_index (the routing peer).
+	Entries []*NetworkRouterEntry `protobuf:"bytes,1,rep,name=entries,proto3" json:"entries,omitempty"`
+}
+
+func (x *NetworkRouterList) Reset() {
+	*x = NetworkRouterList{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[73]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NetworkRouterList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NetworkRouterList) ProtoMessage() {}
+
+func (x *NetworkRouterList) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[73]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NetworkRouterList.ProtoReflect.Descriptor instead.
+func (*NetworkRouterList) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{73}
+}
+
+func (x *NetworkRouterList) GetEntries() []*NetworkRouterEntry {
+	if x != nil {
+		return x.Entries
+	}
+	return nil
+}
+
+// NetworkRouterEntry mirrors a single *routerTypes.NetworkRouter; the routing
+// peer is referenced by index into NetworkMapComponentsFull.peers.
+type NetworkRouterEntry struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id           string   `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	PeerIndex    uint32   `protobuf:"varint,2,opt,name=peer_index,json=peerIndex,proto3" json:"peer_index,omitempty"`
+	PeerIndexSet bool     `protobuf:"varint,3,opt,name=peer_index_set,json=peerIndexSet,proto3" json:"peer_index_set,omitempty"`
+	PeerGroupIds []string `protobuf:"bytes,4,rep,name=peer_group_ids,json=peerGroupIds,proto3" json:"peer_group_ids,omitempty"`
+	Masquerade   bool     `protobuf:"varint,5,opt,name=masquerade,proto3" json:"masquerade,omitempty"`
+	Metric       int32    `protobuf:"varint,6,opt,name=metric,proto3" json:"metric,omitempty"`
+	Enabled      bool     `protobuf:"varint,7,opt,name=enabled,proto3" json:"enabled,omitempty"`
+}
+
+func (x *NetworkRouterEntry) Reset() {
+	*x = NetworkRouterEntry{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[74]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NetworkRouterEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NetworkRouterEntry) ProtoMessage() {}
+
+func (x *NetworkRouterEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[74]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NetworkRouterEntry.ProtoReflect.Descriptor instead.
+func (*NetworkRouterEntry) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{74}
+}
+
+func (x *NetworkRouterEntry) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *NetworkRouterEntry) GetPeerIndex() uint32 {
+	if x != nil {
+		return x.PeerIndex
+	}
+	return 0
+}
+
+func (x *NetworkRouterEntry) GetPeerIndexSet() bool {
+	if x != nil {
+		return x.PeerIndexSet
+	}
+	return false
+}
+
+func (x *NetworkRouterEntry) GetPeerGroupIds() []string {
+	if x != nil {
+		return x.PeerGroupIds
+	}
+	return nil
+}
+
+func (x *NetworkRouterEntry) GetMasquerade() bool {
+	if x != nil {
+		return x.Masquerade
+	}
+	return false
+}
+
+func (x *NetworkRouterEntry) GetMetric() int32 {
+	if x != nil {
+		return x.Metric
+	}
+	return 0
+}
+
+func (x *NetworkRouterEntry) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+type PolicyIds struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ids []string `protobuf:"bytes,1,rep,name=ids,proto3" json:"ids,omitempty"`
+}
+
+func (x *PolicyIds) Reset() {
+	*x = PolicyIds{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[75]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PolicyIds) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PolicyIds) ProtoMessage() {}
+
+func (x *PolicyIds) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[75]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PolicyIds.ProtoReflect.Descriptor instead.
+func (*PolicyIds) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{75}
+}
+
+func (x *PolicyIds) GetIds() []string {
+	if x != nil {
+		return x.Ids
+	}
+	return nil
+}
+
+// UserIDList is a list of user ids — used as the value type in
+// NetworkMapComponentsFull.group_id_to_user_ids.
+type UserIDList struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	UserIds []string `protobuf:"bytes,1,rep,name=user_ids,json=userIds,proto3" json:"user_ids,omitempty"`
+}
+
+func (x *UserIDList) Reset() {
+	*x = UserIDList{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[76]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UserIDList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserIDList) ProtoMessage() {}
+
+func (x *UserIDList) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[76]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserIDList.ProtoReflect.Descriptor instead.
+func (*UserIDList) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{76}
+}
+
+func (x *UserIDList) GetUserIds() []string {
+	if x != nil {
+		return x.UserIds
+	}
+	return nil
+}
+
+// PeerIndexSet is a set of peer indexes — used as the value type in
+// NetworkMapComponentsFull.posture_failed_peers.
+type PeerIndexSet struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PeerIndexes []uint32 `protobuf:"varint,1,rep,packed,name=peer_indexes,json=peerIndexes,proto3" json:"peer_indexes,omitempty"`
+}
+
+func (x *PeerIndexSet) Reset() {
+	*x = PeerIndexSet{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[77]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PeerIndexSet) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PeerIndexSet) ProtoMessage() {}
+
+func (x *PeerIndexSet) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[77]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PeerIndexSet.ProtoReflect.Descriptor instead.
+func (*PeerIndexSet) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{77}
+}
+
+func (x *PeerIndexSet) GetPeerIndexes() []uint32 {
+	if x != nil {
+		return x.PeerIndexes
+	}
+	return nil
 }
 
 type PortInfo_Range struct {
@@ -4694,7 +6951,7 @@ type PortInfo_Range struct {
 func (x *PortInfo_Range) Reset() {
 	*x = PortInfo_Range{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[57]
+		mi := &file_management_proto_msgTypes[79]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4707,7 +6964,7 @@ func (x *PortInfo_Range) String() string {
 func (*PortInfo_Range) ProtoMessage() {}
 
 func (x *PortInfo_Range) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[57]
+	mi := &file_management_proto_msgTypes[79]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4720,7 +6977,7 @@ func (x *PortInfo_Range) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PortInfo_Range.ProtoReflect.Descriptor instead.
 func (*PortInfo_Range) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{47, 0}
+	return file_management_proto_rawDescGZIP(), []int{49, 0}
 }
 
 func (x *PortInfo_Range) GetStart() uint32 {
@@ -4769,7 +7026,7 @@ var file_management_proto_rawDesc = []byte{
 	0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x42,
 	0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x48, 0x00, 0x52, 0x06, 0x62,
 	0x75, 0x6e, 0x64, 0x6c, 0x65, 0x42, 0x12, 0x0a, 0x10, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61,
-	0x64, 0x5f, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x73, 0x22, 0x9d, 0x01, 0x0a, 0x10, 0x42, 0x75,
+	0x64, 0x5f, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x73, 0x22, 0xe5, 0x01, 0x0a, 0x10, 0x42, 0x75,
 	0x6e, 0x64, 0x6c, 0x65, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x1d,
 	0x0a, 0x0a, 0x62, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01,
 	0x28, 0x08, 0x52, 0x09, 0x62, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x46, 0x6f, 0x72, 0x12, 0x26, 0x0a,
@@ -4779,118 +7036,132 @@ var file_management_proto_rawDesc = []byte{
 	0x65, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0c, 0x6c,
 	0x6f, 0x67, 0x46, 0x69, 0x6c, 0x65, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x61,
 	0x6e, 0x6f, 0x6e, 0x79, 0x6d, 0x69, 0x7a, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
-	0x61, 0x6e, 0x6f, 0x6e, 0x79, 0x6d, 0x69, 0x7a, 0x65, 0x22, 0x2d, 0x0a, 0x0c, 0x42, 0x75, 0x6e,
-	0x64, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x70, 0x6c,
-	0x6f, 0x61, 0x64, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75,
-	0x70, 0x6c, 0x6f, 0x61, 0x64, 0x4b, 0x65, 0x79, 0x22, 0x3d, 0x0a, 0x0b, 0x53, 0x79, 0x6e, 0x63,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2e, 0x0a, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x4d, 0x65, 0x74,
-	0x61, 0x52, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x22, 0xa3, 0x03, 0x0a, 0x0c, 0x53, 0x79, 0x6e, 0x63,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x0d, 0x6e, 0x65, 0x74, 0x62,
-	0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74,
-	0x62, 0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0d, 0x6e, 0x65, 0x74, 0x62,
-	0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65, 0x65,
-	0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x3e, 0x0a, 0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73,
-	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72,
-	0x73, 0x12, 0x2e, 0x0a, 0x12, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73,
-	0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x72,
-	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74,
-	0x79, 0x12, 0x36, 0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x52, 0x0a, 0x4e,
-	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x12, 0x2a, 0x0a, 0x06, 0x43, 0x68, 0x65,
-	0x63, 0x6b, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x52, 0x06, 0x43,
-	0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x46, 0x0a, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x73, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x22, 0x41, 0x0a,
-	0x0f, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x2e, 0x0a, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72,
-	0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65, 0x74, 0x61,
-	0x22, 0xc6, 0x01, 0x0a, 0x0c, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x65, 0x74, 0x75, 0x70, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x65, 0x74, 0x75, 0x70, 0x4b, 0x65, 0x79, 0x12, 0x2e, 0x0a,
-	0x04, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x79, 0x73,
-	0x74, 0x65, 0x6d, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x12, 0x1a, 0x0a,
-	0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x30, 0x0a, 0x08, 0x70, 0x65, 0x65,
-	0x72, 0x4b, 0x65, 0x79, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x4b, 0x65, 0x79,
-	0x73, 0x52, 0x08, 0x70, 0x65, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x64,
-	0x6e, 0x73, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09,
-	0x64, 0x6e, 0x73, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x22, 0x44, 0x0a, 0x08, 0x50, 0x65, 0x65,
-	0x72, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62,
-	0x4b, 0x65, 0x79, 0x12, 0x1a, 0x0a, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x22,
-	0x3f, 0x0a, 0x0b, 0x45, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x14,
-	0x0a, 0x05, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x63,
-	0x6c, 0x6f, 0x75, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
-	0x22, 0x5c, 0x0a, 0x04, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x14, 0x0a, 0x05,
-	0x65, 0x78, 0x69, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x65, 0x78, 0x69,
-	0x73, 0x74, 0x12, 0x2a, 0x0a, 0x10, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x49, 0x73, 0x52,
-	0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x72,
-	0x6f, 0x63, 0x65, 0x73, 0x73, 0x49, 0x73, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x22, 0xe1,
-	0x05, 0x0a, 0x05, 0x46, 0x6c, 0x61, 0x67, 0x73, 0x12, 0x2a, 0x0a, 0x10, 0x72, 0x6f, 0x73, 0x65,
-	0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x10, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73,
-	0x73, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x65, 0x72, 0x6d,
-	0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x12, 0x2a, 0x0a, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x53, 0x53, 0x48, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x53, 0x48, 0x41, 0x6c, 0x6c, 0x6f, 0x77,
-	0x65, 0x64, 0x12, 0x30, 0x0a, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x43, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x44, 0x4e, 0x53, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x64, 0x69, 0x73, 0x61,
-	0x62, 0x6c, 0x65, 0x44, 0x4e, 0x53, 0x12, 0x28, 0x0a, 0x0f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c,
-	0x12, 0x26, 0x0a, 0x0e, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x4c, 0x41, 0x4e, 0x41, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x4c,
-	0x41, 0x4e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x22, 0x0a, 0x0c, 0x62, 0x6c, 0x6f, 0x63,
-	0x6b, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c,
-	0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x12, 0x34, 0x0a, 0x15,
-	0x6c, 0x61, 0x7a, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x15, 0x6c, 0x61, 0x7a,
-	0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x12, 0x24, 0x0a, 0x0d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52,
-	0x6f, 0x6f, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x65, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x53, 0x53, 0x48, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x53, 0x53, 0x48, 0x53, 0x46, 0x54, 0x50, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x53, 0x46, 0x54, 0x50, 0x12, 0x42,
-	0x0a, 0x1c, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x4c, 0x6f, 0x63, 0x61, 0x6c,
-	0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x18, 0x0d,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x1c, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x4c,
-	0x6f, 0x63, 0x61, 0x6c, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69,
-	0x6e, 0x67, 0x12, 0x44, 0x0a, 0x1d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52,
-	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
-	0x69, 0x6e, 0x67, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1d, 0x65, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x53, 0x53, 0x48, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x26, 0x0a, 0x0e, 0x64, 0x69, 0x73, 0x61,
-	0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0e, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68,
-	0x12, 0x20, 0x0a, 0x0b, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x49, 0x50, 0x76, 0x36, 0x18,
-	0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x49, 0x50,
-	0x76, 0x36, 0x22, 0xb2, 0x05, 0x0a, 0x0e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x79, 0x73, 0x74, 0x65,
+	0x61, 0x6e, 0x6f, 0x6e, 0x79, 0x6d, 0x69, 0x7a, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x61, 0x6e, 0x6f,
+	0x6e, 0x79, 0x6d, 0x69, 0x7a, 0x65, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0e, 0x61, 0x6e, 0x6f, 0x6e, 0x79, 0x6d, 0x69, 0x7a, 0x65, 0x4c, 0x65, 0x76,
+	0x65, 0x6c, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x75, 0x72, 0x6c,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x55, 0x72,
+	0x6c, 0x22, 0x2d, 0x0a, 0x0c, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x75, 0x6c,
+	0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x6b, 0x65, 0x79, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x4b, 0x65, 0x79,
+	0x22, 0x3d, 0x0a, 0x0b, 0x53, 0x79, 0x6e, 0x63, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x2e, 0x0a, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x53,
+	0x79, 0x73, 0x74, 0x65, 0x6d, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x22,
+	0x8d, 0x04, 0x0a, 0x0c, 0x53, 0x79, 0x6e, 0x63, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x3f, 0x0a, 0x0d, 0x6e, 0x65, 0x74, 0x62, 0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x62, 0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x0d, 0x6e, 0x65, 0x74, 0x62, 0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70,
+	0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3e, 0x0a, 0x0b, 0x72, 0x65, 0x6d,
+	0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f,
+	0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0b, 0x72, 0x65,
+	0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x72, 0x65, 0x6d,
+	0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65,
+	0x72, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x36, 0x0a, 0x0a, 0x4e, 0x65, 0x74,
+	0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x4d, 0x61, 0x70, 0x52, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61,
+	0x70, 0x12, 0x2a, 0x0a, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x12, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x73, 0x52, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x46, 0x0a,
+	0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41,
+	0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
+	0x61, 0x6d, 0x70, 0x52, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69,
+	0x72, 0x65, 0x73, 0x41, 0x74, 0x12, 0x4e, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x4d, 0x61, 0x70, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e,
+	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70,
+	0x65, 0x52, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x76,
+	0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x07, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22,
+	0x41, 0x0a, 0x0f, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x2e, 0x0a, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65,
+	0x65, 0x72, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65,
+	0x74, 0x61, 0x22, 0xc6, 0x01, 0x0a, 0x0c, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x65, 0x74, 0x75, 0x70, 0x4b, 0x65, 0x79, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x65, 0x74, 0x75, 0x70, 0x4b, 0x65, 0x79, 0x12,
+	0x2e, 0x0a, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x53,
+	0x79, 0x73, 0x74, 0x65, 0x6d, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x12,
+	0x1a, 0x0a, 0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x30, 0x0a, 0x08, 0x70,
+	0x65, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x4b,
+	0x65, 0x79, 0x73, 0x52, 0x08, 0x70, 0x65, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x1c, 0x0a,
+	0x09, 0x64, 0x6e, 0x73, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x09, 0x64, 0x6e, 0x73, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x22, 0x44, 0x0a, 0x08, 0x50,
+	0x65, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75,
+	0x62, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50,
+	0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x1a, 0x0a, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b, 0x65,
+	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b, 0x65,
+	0x79, 0x22, 0x3f, 0x0a, 0x0b, 0x45, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74,
+	0x12, 0x14, 0x0a, 0x05, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f,
+	0x72, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f,
+	0x72, 0x6d, 0x22, 0x5c, 0x0a, 0x04, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61,
+	0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x14,
+	0x0a, 0x05, 0x65, 0x78, 0x69, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x65,
+	0x78, 0x69, 0x73, 0x74, 0x12, 0x2a, 0x0a, 0x10, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x49,
+	0x73, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10,
+	0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x49, 0x73, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67,
+	0x22, 0x8f, 0x06, 0x0a, 0x05, 0x46, 0x6c, 0x61, 0x67, 0x73, 0x12, 0x2a, 0x0a, 0x10, 0x72, 0x6f,
+	0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70,
+	0x61, 0x73, 0x73, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x65,
+	0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x12, 0x2a, 0x0a, 0x10, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x53, 0x53, 0x48, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x53, 0x48, 0x41, 0x6c, 0x6c,
+	0x6f, 0x77, 0x65, 0x64, 0x12, 0x30, 0x0a, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x64, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x44, 0x4e, 0x53, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x64, 0x69,
+	0x73, 0x61, 0x62, 0x6c, 0x65, 0x44, 0x4e, 0x53, 0x12, 0x28, 0x0a, 0x0f, 0x64, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61,
+	0x6c, 0x6c, 0x12, 0x26, 0x0a, 0x0e, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x4c, 0x41, 0x4e, 0x41, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x62, 0x6c, 0x6f, 0x63,
+	0x6b, 0x4c, 0x41, 0x4e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x22, 0x0a, 0x0c, 0x62, 0x6c,
+	0x6f, 0x63, 0x6b, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0c, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x12, 0x34,
+	0x0a, 0x15, 0x6c, 0x61, 0x7a, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x15, 0x6c,
+	0x61, 0x7a, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x12, 0x24, 0x0a, 0x0d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53,
+	0x48, 0x52, 0x6f, 0x6f, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x65, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x65, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x53, 0x46, 0x54, 0x50, 0x18, 0x0c, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x53, 0x46, 0x54, 0x50,
+	0x12, 0x42, 0x0a, 0x1c, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x4c, 0x6f, 0x63,
+	0x61, 0x6c, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67,
+	0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1c, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53,
+	0x48, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
+	0x64, 0x69, 0x6e, 0x67, 0x12, 0x44, 0x0a, 0x1d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53,
+	0x48, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61,
+	0x72, 0x64, 0x69, 0x6e, 0x67, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1d, 0x65, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x6f, 0x72, 0x74,
+	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x26, 0x0a, 0x0e, 0x64, 0x69,
+	0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x18, 0x0f, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0e, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x41, 0x75,
+	0x74, 0x68, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x49, 0x50, 0x76,
+	0x36, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65,
+	0x49, 0x50, 0x76, 0x36, 0x12, 0x2c, 0x0a, 0x11, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x4a, 0x6f,
+	0x62, 0x73, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x18, 0x11, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x11, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x4a, 0x6f, 0x62, 0x73, 0x41, 0x6c, 0x6c, 0x6f, 0x77,
+	0x65, 0x64, 0x22, 0xae, 0x06, 0x0a, 0x0e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x79, 0x73, 0x74, 0x65,
 	0x6d, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x1a, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d,
 	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d,
 	0x65, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x4f, 0x53, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
@@ -4933,191 +7204,199 @@ var file_management_proto_rawDesc = []byte{
 	0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x12, 0x20, 0x03, 0x28, 0x0e, 0x32, 0x1a, 0x2e,
 	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43,
 	0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x52, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62,
-	0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22, 0xfc, 0x01, 0x0a, 0x0d, 0x4c, 0x6f, 0x67, 0x69,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x0d, 0x6e, 0x65, 0x74,
-	0x62, 0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65,
-	0x74, 0x62, 0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0d, 0x6e, 0x65, 0x74,
-	0x62, 0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65,
-	0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x12, 0x2a, 0x0a, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x18, 0x03, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x12, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x52, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x46,
-	0x0a, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73,
-	0x41, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70,
-	0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x22, 0x66, 0x0a, 0x18, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64,
-	0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2e,
-	0x0a, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x79,
-	0x73, 0x74, 0x65, 0x6d, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x22, 0x63,
-	0x0a, 0x19, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x46, 0x0a, 0x10, 0x73,
-	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
-	0x70, 0x52, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65,
-	0x73, 0x41, 0x74, 0x22, 0x79, 0x0a, 0x11, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x38, 0x0a, 0x09, 0x65, 0x78,
-	0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72,
-	0x65, 0x73, 0x41, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x07,
-	0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0xb4, 0x02, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x62,
-	0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c, 0x0a, 0x05, 0x73, 0x74, 0x75,
-	0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x05, 0x73, 0x74, 0x75, 0x6e, 0x73, 0x12, 0x35, 0x0a, 0x05, 0x74, 0x75, 0x72, 0x6e, 0x73,
-	0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x65, 0x63, 0x74, 0x65, 0x64, 0x48, 0x6f, 0x73,
-	0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x74, 0x75, 0x72, 0x6e, 0x73, 0x12, 0x2e,
-	0x0a, 0x06, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x12, 0x2d,
-	0x0a, 0x05, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6c, 0x61, 0x79,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x12, 0x2a, 0x0a,
-	0x04, 0x66, 0x6c, 0x6f, 0x77, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x04, 0x66, 0x6c, 0x6f, 0x77, 0x12, 0x33, 0x0a, 0x07, 0x6d, 0x65, 0x74,
-	0x72, 0x69, 0x63, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x22, 0x98,
-	0x01, 0x0a, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a,
-	0x03, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12,
-	0x3b, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48,
-	0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x22, 0x3b, 0x0a, 0x08,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x44, 0x50, 0x10,
-	0x00, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x48, 0x54,
-	0x54, 0x50, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x03, 0x12,
-	0x08, 0x0a, 0x04, 0x44, 0x54, 0x4c, 0x53, 0x10, 0x04, 0x22, 0x6d, 0x0a, 0x0b, 0x52, 0x65, 0x6c,
-	0x61, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x72, 0x6c, 0x73,
-	0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x75, 0x72, 0x6c, 0x73, 0x12, 0x22, 0x0a, 0x0c,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
-	0x12, 0x26, 0x0a, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75,
-	0x72, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53,
-	0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x22, 0xad, 0x02, 0x0a, 0x0a, 0x46, 0x6c, 0x6f,
-	0x77, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x22, 0x0a, 0x0c, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x26, 0x0a,
-	0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e,
-	0x61, 0x74, 0x75, 0x72, 0x65, 0x12, 0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61,
-	0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x18, 0x0a, 0x07,
-	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65,
-	0x72, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65,
-	0x72, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x65, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f,
-	0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12,
-	0x65, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x24, 0x0a, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f,
-	0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x29, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x72,
-	0x69, 0x63, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x22, 0xa3, 0x01, 0x0a, 0x09, 0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x16, 0x0a, 0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x75, 0x64,
-	0x69, 0x65, 0x6e, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x75, 0x64,
-	0x69, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x6b, 0x65, 0x79, 0x73, 0x4c, 0x6f, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6b, 0x65, 0x79,
-	0x73, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x6d, 0x61, 0x78,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x41, 0x67, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b,
-	0x6d, 0x61, 0x78, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x41, 0x67, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x61,
-	0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09,
-	0x61, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x22, 0x7d, 0x0a, 0x13, 0x50, 0x72, 0x6f,
-	0x74, 0x65, 0x63, 0x74, 0x65, 0x64, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x12, 0x36, 0x0a, 0x0a, 0x68, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x68, 0x6f,
-	0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x1a, 0x0a, 0x08,
-	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0xf2, 0x02, 0x0a, 0x0a, 0x50, 0x65, 0x65,
-	0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65,
-	0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73,
-	0x73, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
-	0x64, 0x6e, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x73,
-	0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12, 0x48, 0x0a, 0x1f,
-	0x52, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x50, 0x65, 0x65, 0x72, 0x44, 0x6e, 0x73, 0x52, 0x65,
-	0x73, 0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1f, 0x52, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x50, 0x65,
-	0x65, 0x72, 0x44, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x45,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x34, 0x0a, 0x15, 0x4c, 0x61, 0x7a, 0x79, 0x43, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
-	0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x15, 0x4c, 0x61, 0x7a, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x10, 0x0a, 0x03,
-	0x6d, 0x74, 0x75, 0x18, 0x07, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x6d, 0x74, 0x75, 0x12, 0x3e,
-	0x0a, 0x0a, 0x61, 0x75, 0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x08, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x41, 0x75, 0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e,
-	0x67, 0x73, 0x52, 0x0a, 0x61, 0x75, 0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x1d,
-	0x0a, 0x0a, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x76, 0x36, 0x18, 0x09, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x09, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x56, 0x36, 0x22, 0x52, 0x0a,
-	0x12, 0x41, 0x75, 0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69,
-	0x6e, 0x67, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x0a,
-	0x0c, 0x61, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x0c, 0x61, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x22, 0xe8, 0x05, 0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
-	0x12, 0x16, 0x0a, 0x06, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
-	0x52, 0x06, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x12, 0x3e, 0x0a, 0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x18,
-	0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73,
-	0x12, 0x2e, 0x0a, 0x12, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x49,
-	0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x72, 0x65,
-	0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79,
-	0x12, 0x29, 0x0a, 0x06, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x52, 0x06, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x44,
-	0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x4e, 0x53, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x12, 0x40, 0x0a, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73,
-	0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65,
-	0x72, 0x73, 0x12, 0x3e, 0x0a, 0x0d, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75,
-	0x6c, 0x65, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52,
-	0x75, 0x6c, 0x65, 0x52, 0x0d, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c,
-	0x65, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75,
-	0x6c, 0x65, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x14, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49,
-	0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x4f, 0x0a, 0x13, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
-	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x0a, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75,
-	0x6c, 0x65, 0x52, 0x13, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61,
-	0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x1a, 0x72, 0x6f, 0x75, 0x74, 0x65,
-	0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49, 0x73,
-	0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x72, 0x6f, 0x75,
-	0x74, 0x65, 0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73,
-	0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x44, 0x0a, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61,
-	0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x0f, 0x66, 0x6f,
+	0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x73, 0x79, 0x6e, 0x63, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x13, 0x20,
+	0x01, 0x28, 0x05, 0x52, 0x12, 0x73, 0x79, 0x6e, 0x63, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x4a, 0x0a, 0x11, 0x63, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x6f, 0x66, 0x73, 0x18, 0x14, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x6f, 0x66,
+	0x52, 0x11, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f,
+	0x6f, 0x66, 0x73, 0x22, 0xfc, 0x01, 0x0a, 0x0d, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x0d, 0x6e, 0x65, 0x74, 0x62, 0x69, 0x72, 0x64,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x62, 0x69, 0x72,
+	0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0d, 0x6e, 0x65, 0x74, 0x62, 0x69, 0x72, 0x64,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2a,
+	0x0a, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63,
+	0x6b, 0x73, 0x52, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x46, 0x0a, 0x10, 0x73, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x52, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73,
+	0x41, 0x74, 0x22, 0x66, 0x0a, 0x18, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x41, 0x75, 0x74, 0x68,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a,
+	0x0a, 0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2e, 0x0a, 0x04, 0x6d, 0x65,
+	0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d,
+	0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x22, 0x63, 0x0a, 0x19, 0x45, 0x78,
+	0x74, 0x65, 0x6e, 0x64, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x46, 0x0a, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x22,
+	0x79, 0x0a, 0x11, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x38, 0x0a, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65,
+	0x73, 0x41, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74,
+	0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x07, 0x0a, 0x05, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x22, 0xb4, 0x02, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x62, 0x69, 0x72, 0x64, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c, 0x0a, 0x05, 0x73, 0x74, 0x75, 0x6e, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x73, 0x74,
+	0x75, 0x6e, 0x73, 0x12, 0x35, 0x0a, 0x05, 0x74, 0x75, 0x72, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x50, 0x72, 0x6f, 0x74, 0x65, 0x63, 0x74, 0x65, 0x64, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x52, 0x05, 0x74, 0x75, 0x72, 0x6e, 0x73, 0x12, 0x2e, 0x0a, 0x06, 0x73, 0x69,
+	0x67, 0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x06, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x12, 0x2d, 0x0a, 0x05, 0x72, 0x65,
+	0x6c, 0x61, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6c, 0x61, 0x79, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x05, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x12, 0x2a, 0x0a, 0x04, 0x66, 0x6c, 0x6f,
+	0x77, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
+	0x04, 0x66, 0x6c, 0x6f, 0x77, 0x12, 0x33, 0x0a, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x22, 0x98, 0x01, 0x0a, 0x0a, 0x48,
+	0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x69,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x3b, 0x0a, 0x08, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1f, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x22, 0x3b, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x44, 0x50, 0x10, 0x00, 0x12, 0x07, 0x0a,
+	0x03, 0x54, 0x43, 0x50, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x48, 0x54, 0x54, 0x50, 0x10, 0x02,
+	0x12, 0x09, 0x0a, 0x05, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x44,
+	0x54, 0x4c, 0x53, 0x10, 0x04, 0x22, 0x6d, 0x0a, 0x0b, 0x52, 0x65, 0x6c, 0x61, 0x79, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x72, 0x6c, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x04, 0x75, 0x72, 0x6c, 0x73, 0x12, 0x22, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x26, 0x0a, 0x0e,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61,
+	0x74, 0x75, 0x72, 0x65, 0x22, 0xad, 0x02, 0x0a, 0x0a, 0x46, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x22, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61,
+	0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x26, 0x0a, 0x0e, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72,
+	0x65, 0x12, 0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x08,
+	0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x72, 0x73, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x72, 0x73, 0x12, 0x2e,
+	0x0a, 0x12, 0x65, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x65, 0x78, 0x69, 0x74,
+	0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x24,
+	0x0a, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0x29, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22,
+	0xa3, 0x01, 0x0a, 0x09, 0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x16, 0x0a,
+	0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x69,
+	0x73, 0x73, 0x75, 0x65, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63,
+	0x65, 0x12, 0x22, 0x0a, 0x0c, 0x6b, 0x65, 0x79, 0x73, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6b, 0x65, 0x79, 0x73, 0x4c, 0x6f, 0x63,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x6d, 0x61, 0x78, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x41, 0x67, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x6d, 0x61, 0x78, 0x54,
+	0x6f, 0x6b, 0x65, 0x6e, 0x41, 0x67, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x61, 0x75, 0x64, 0x69, 0x65,
+	0x6e, 0x63, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x61, 0x75, 0x64, 0x69,
+	0x65, 0x6e, 0x63, 0x65, 0x73, 0x22, 0x7d, 0x0a, 0x13, 0x50, 0x72, 0x6f, 0x74, 0x65, 0x63, 0x74,
+	0x65, 0x64, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x36, 0x0a, 0x0a,
+	0x68, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f,
+	0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x68, 0x6f, 0x73, 0x74, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x22, 0xf2, 0x02, 0x0a, 0x0a, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x10, 0x0a,
+	0x03, 0x64, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6e, 0x73, 0x12,
+	0x33, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12, 0x48, 0x0a, 0x1f, 0x52, 0x6f, 0x75, 0x74,
+	0x69, 0x6e, 0x67, 0x50, 0x65, 0x65, 0x72, 0x44, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x75,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x1f, 0x52, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x50, 0x65, 0x65, 0x72, 0x44, 0x6e,
+	0x73, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x12, 0x34, 0x0a, 0x15, 0x4c, 0x61, 0x7a, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x15, 0x4c, 0x61, 0x7a, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x74, 0x75, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x6d, 0x74, 0x75, 0x12, 0x3e, 0x0a, 0x0a, 0x61, 0x75,
+	0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x6f,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x0a,
+	0x61, 0x75, 0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x64,
+	0x64, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x76, 0x36, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09,
+	0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x56, 0x36, 0x22, 0x52, 0x0a, 0x12, 0x41, 0x75, 0x74,
+	0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12,
+	0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x61, 0x6c, 0x77,
+	0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0c, 0x61, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x22, 0xec, 0x05,
+	0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x12, 0x16, 0x0a, 0x06,
+	0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x53, 0x65,
+	0x72, 0x69, 0x61, 0x6c, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3e, 0x0a, 0x0b,
+	0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
+	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
+	0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x12,
+	0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65,
+	0x50, 0x65, 0x65, 0x72, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x29, 0x0a, 0x06,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52,
+	0x06, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x40, 0x0a, 0x0c,
+	0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x18, 0x07, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x3e,
+	0x0a, 0x0d, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18,
+	0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52,
+	0x0d, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x32,
+	0x0a, 0x14, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49,
+	0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x66, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x12, 0x4f, 0x0a, 0x13, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x46, 0x69, 0x72, 0x65,
+	0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x13,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75,
+	0x6c, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x1a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x46, 0x69, 0x72,
+	0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x46,
+	0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49, 0x73, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x12, 0x48, 0x0a, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e,
+	0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
+	0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0f, 0x66, 0x6f,
 	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x2d, 0x0a,
 	0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13,
 	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x41,
@@ -5141,7 +7420,7 @@ var file_management_proto_rawDesc = []byte{
 	0x01, 0x22, 0x2e, 0x0a, 0x12, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72,
 	0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x69, 0x6e, 0x64, 0x65, 0x78,
 	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x07, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65,
-	0x73, 0x22, 0xbb, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72,
+	0x73, 0x22, 0xf0, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72,
 	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b,
 	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b,
 	0x65, 0x79, 0x12, 0x1e, 0x0a, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x49, 0x70, 0x73,
@@ -5152,335 +7431,746 @@ var file_management_proto_rawDesc = []byte{
 	0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x18,
 	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x61,
 	0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22,
-	0x7e, 0x0a, 0x09, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1e, 0x0a, 0x0a,
-	0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1c, 0x0a, 0x09,
-	0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52,
-	0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x09, 0x6a, 0x77,
-	0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4a, 0x57, 0x54, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22,
-	0x20, 0x0a, 0x1e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x22, 0xbf, 0x01, 0x0a, 0x17, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68,
-	0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x48, 0x0a,
-	0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x2c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x65, 0x76,
-	0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x46, 0x6c, 0x6f, 0x77, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x08, 0x50,
-	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69,
-	0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f,
-	0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f,
-	0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x16, 0x0a, 0x08, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0a, 0x0a, 0x06, 0x48, 0x4f, 0x53, 0x54, 0x45,
-	0x44, 0x10, 0x00, 0x22, 0x1e, 0x0a, 0x1c, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x22, 0x5b, 0x0a, 0x15, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x42, 0x0a, 0x0e,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01,
+	0x09, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x33, 0x0a, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x22, 0x7e, 0x0a, 0x09, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x64, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12,
+	0x33, 0x0a, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x22, 0x20, 0x0a, 0x1e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xbf, 0x01, 0x0a, 0x17, 0x44, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c,
+	0x6f, 0x77, 0x12, 0x48, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x42, 0x0a, 0x0e,
+	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
 	0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
 	0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x22, 0xbc, 0x03, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x12,
-	0x26, 0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12,
-	0x1a, 0x0a, 0x08, 0x41, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x08, 0x41, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x2e, 0x0a, 0x12, 0x44,
-	0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
-	0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41,
-	0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x54,
-	0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
-	0x74, 0x12, 0x14, 0x0a, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x55, 0x73, 0x65,
-	0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x34, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
-	0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x22, 0x0a,
-	0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x18, 0x0a, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c,
-	0x73, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d,
-	0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x44,
-	0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69,
-	0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x18, 0x0c,
-	0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x22,
-	0x93, 0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x4e, 0x65, 0x74,
-	0x77, 0x6f, 0x72, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x4e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x12, 0x20, 0x0a, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79,
-	0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x65, 0x65, 0x72, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x65, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x4d, 0x65, 0x74,
-	0x72, 0x69, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69,
-	0x63, 0x12, 0x1e, 0x0a, 0x0a, 0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18,
-	0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64,
-	0x65, 0x12, 0x14, 0x0a, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x73, 0x12, 0x1c, 0x0a, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x09,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12,
-	0x24, 0x0a, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79,
-	0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f,
-	0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xde, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x12, 0x24, 0x0a, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x47, 0x0a, 0x10, 0x4e, 0x61, 0x6d,
-	0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x52, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75,
-	0x70, 0x73, 0x12, 0x38, 0x0a, 0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65,
-	0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52,
-	0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x0d,
-	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x03, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
-	0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xb8, 0x01, 0x0a, 0x0a, 0x43, 0x75, 0x73, 0x74, 0x6f,
-	0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x32, 0x0a,
-	0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70,
-	0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
-	0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2a, 0x0a, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68,
-	0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76,
-	0x65, 0x22, 0x74, 0x0a, 0x0c, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x03, 0x52, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x43, 0x6c, 0x61,
-	0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x12,
-	0x10, 0x0a, 0x03, 0x54, 0x54, 0x4c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x54, 0x54,
-	0x4c, 0x12, 0x14, 0x0a, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61, 0x22, 0xb3, 0x01, 0x0a, 0x0f, 0x4e, 0x61, 0x6d, 0x65,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x38, 0x0a, 0x0b, 0x4e,
-	0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61,
-	0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12,
-	0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61,
-	0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x48, 0x0a,
-	0x0a, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x49,
-	0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a, 0x06, 0x4e,
-	0x53, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4e, 0x53, 0x54,
-	0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x03, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xfb, 0x02, 0x0a, 0x0c, 0x46, 0x69, 0x72, 0x65,
-	0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x1a, 0x0a, 0x06, 0x50, 0x65, 0x65, 0x72,
-	0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x06, 0x50, 0x65,
-	0x65, 0x72, 0x49, 0x50, 0x12, 0x37, 0x0a, 0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a,
-	0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a,
-	0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c,
-	0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x30, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49,
-	0x6e, 0x66, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52,
-	0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50,
-	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63,
-	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x26, 0x0a,
-	0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18,
-	0x09, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65,
-	0x66, 0x69, 0x78, 0x65, 0x73, 0x22, 0x38, 0x0a, 0x0e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x12, 0x10, 0x0a,
-	0x03, 0x6d, 0x61, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x61, 0x63, 0x22,
-	0x1e, 0x0a, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x46, 0x69, 0x6c,
-	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x22,
-	0x96, 0x01, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x14, 0x0a, 0x04,
-	0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6f,
-	0x72, 0x74, 0x12, 0x32, 0x0a, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
-	0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52,
-	0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x1a, 0x2f, 0x0a, 0x05, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12,
-	0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05,
-	0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0d, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x42, 0x0f, 0x0a, 0x0d, 0x70, 0x6f, 0x72, 0x74, 0x53,
-	0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x87, 0x03, 0x0a, 0x11, 0x52, 0x6f, 0x75,
-	0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x22,
-	0x0a, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x18, 0x01,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67,
-	0x65, 0x73, 0x12, 0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
-	0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x30, 0x0a, 0x08, 0x70, 0x6f,
-	0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e,
-	0x66, 0x6f, 0x52, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1c, 0x0a, 0x09,
-	0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x73, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75,
-	0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1a, 0x0a, 0x08,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x49, 0x44, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x49, 0x44, 0x22, 0xf2, 0x01, 0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e,
-	0x67, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3e, 0x0a, 0x0f, 0x64,
-	0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x02,
+	0x22, 0x16, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0a, 0x0a, 0x06,
+	0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x00, 0x22, 0x44, 0x0a, 0x1c, 0x50, 0x4b, 0x43, 0x45,
+	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f,
+	0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0d, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x22, 0x5b,
+	0x0a, 0x15, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xbc, 0x03, 0x0a, 0x0e,
+	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a,
+	0x0a, 0x08, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0c, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x42, 0x02, 0x18, 0x01, 0x52, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72,
+	0x65, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x41, 0x75,
+	0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x41, 0x75,
+	0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45,
+	0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x54,
+	0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x05,
+	0x53, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x53, 0x63, 0x6f,
+	0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x12, 0x34, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x22, 0x0a, 0x0c, 0x52, 0x65, 0x64, 0x69,
+	0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c,
+	0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x12, 0x2e, 0x0a, 0x12,
+	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67,
+	0x69, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x0a, 0x09,
+	0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x22, 0x93, 0x02, 0x0a, 0x05, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x20,
+	0x0a, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x03, 0x52, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x50, 0x65, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x50, 0x65, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x1e, 0x0a, 0x0a,
+	0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0a, 0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x4e, 0x65, 0x74, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x4e, 0x65, 0x74,
+	0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x08, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1c, 0x0a, 0x09,
+	0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x6b,
+	0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79,
+	0x22, 0xde, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x24,
+	0x0a, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x12, 0x47, 0x0a, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x10, 0x4e, 0x61, 0x6d,
+	0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x38, 0x0a,
+	0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0b, 0x43, 0x75, 0x73, 0x74,
+	0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61,
+	0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x42, 0x02,
+	0x18, 0x01, 0x52, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72,
+	0x74, 0x22, 0xb8, 0x01, 0x0a, 0x0a, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65,
+	0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x32, 0x0a, 0x07, 0x52, 0x65, 0x63, 0x6f,
+	0x72, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63,
+	0x6f, 0x72, 0x64, 0x52, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x14,
+	0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72,
+	0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64,
+	0x12, 0x2a, 0x0a, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61,
+	0x74, 0x69, 0x76, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x4e, 0x6f, 0x6e, 0x41,
+	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x22, 0x74, 0x0a, 0x0c,
+	0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04,
+	0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x54, 0x54,
+	0x4c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x54, 0x54, 0x4c, 0x12, 0x14, 0x0a, 0x05,
+	0x52, 0x44, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x52, 0x44, 0x61,
+	0x74, 0x61, 0x22, 0xb3, 0x01, 0x0a, 0x0f, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x38, 0x0a, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x52, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
+	0x12, 0x18, 0x0a, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x48, 0x0a, 0x0a, 0x4e, 0x61, 0x6d, 0x65,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x50, 0x6f,
+	0x72, 0x74, 0x22, 0xfb, 0x02, 0x0a, 0x0c, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52,
+	0x75, 0x6c, 0x65, 0x12, 0x1a, 0x0a, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x12,
+	0x37, 0x0a, 0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x52, 0x75, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x44,
+	0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x12,
+	0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x6f,
+	0x72, 0x74, 0x12, 0x30, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x06,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0f, 0x64, 0x65, 0x73, 0x74,
-	0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x11, 0x74,
-	0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74,
-	0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x74, 0x72, 0x61,
-	0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x50, 0x6f, 0x72, 0x74,
+	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44,
+	0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44,
+	0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x26, 0x0a, 0x0e, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0c,
+	0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73,
+	0x22, 0x38, 0x0a, 0x0e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x41, 0x64, 0x64, 0x72, 0x65,
+	0x73, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x61, 0x63, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x61, 0x63, 0x22, 0x74, 0x0a, 0x06, 0x43, 0x68,
+	0x65, 0x63, 0x6b, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x12, 0x54, 0x0a, 0x14, 0x63, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e,
+	0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x14, 0x63, 0x65, 0x72, 0x74,
+	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65,
+	0x22, 0x54, 0x0a, 0x14, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43,
+	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x6f, 0x6e, 0x63,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x6e, 0x6f, 0x6e, 0x63, 0x65, 0x12, 0x26,
+	0x0a, 0x0e, 0x63, 0x61, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73,
+	0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x61, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x22, 0x74, 0x0a, 0x10, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x6f, 0x66, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x6f,
+	0x6e, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x6e, 0x6f, 0x6e, 0x63, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0c, 0x52,
+	0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x69, 0x67, 0x41, 0x6c, 0x67,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x69, 0x67, 0x41, 0x6c, 0x67, 0x12, 0x1c,
+	0x0a, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x22, 0x96, 0x01, 0x0a,
+	0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x14, 0x0a, 0x04, 0x70, 0x6f, 0x72,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12,
+	0x32, 0x0a, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74,
+	0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x05, 0x72, 0x61,
+	0x6e, 0x67, 0x65, 0x1a, 0x2f, 0x0a, 0x05, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x03, 0x65, 0x6e, 0x64, 0x42, 0x0f, 0x0a, 0x0d, 0x70, 0x6f, 0x72, 0x74, 0x53, 0x65, 0x6c, 0x65,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x87, 0x03, 0x0a, 0x11, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46,
+	0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12,
+	0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c,
+	0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x30, 0x0a, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49,
+	0x6e, 0x66, 0x6f, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52,
+	0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x69, 0x73, 0x44,
+	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73,
+	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x73, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f,
+	0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x22,
+	0xf6, 0x01, 0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75,
+	0x6c, 0x65, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3e, 0x0a, 0x0f, 0x64, 0x65, 0x73, 0x74,
+	0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
 	0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
-	0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61,
-	0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x22, 0x8b, 0x02, 0x0a, 0x14, 0x45, 0x78, 0x70, 0x6f,
-	0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04,
-	0x70, 0x6f, 0x72, 0x74, 0x12, 0x36, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x10, 0x0a, 0x03,
-	0x70, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x1a,
-	0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x75, 0x73,
-	0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x0a, 0x75, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x64,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66,
-	0x69, 0x78, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72,
-	0x65, 0x66, 0x69, 0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x70,
-	0x6f, 0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74, 0x65,
-	0x6e, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x15, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61,
-	0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x75, 0x72,
-	0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x55, 0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x70,
-	0x6f, 0x72, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65,
-	0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x6f, 0x72, 0x74, 0x41, 0x75, 0x74,
-	0x6f, 0x41, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x22, 0x2c, 0x0a, 0x12, 0x52, 0x65, 0x6e,
-	0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x15, 0x0a, 0x13, 0x52, 0x65, 0x6e, 0x65, 0x77,
-	0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2b,
-	0x0a, 0x11, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x14, 0x0a, 0x12, 0x53,
-	0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x2a, 0x3a, 0x0a, 0x09, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x12,
-	0x0a, 0x0e, 0x75, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x73, 0x75, 0x63, 0x63, 0x65, 0x65, 0x64, 0x65, 0x64, 0x10,
-	0x01, 0x12, 0x0a, 0x0a, 0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x10, 0x02, 0x2a, 0x6c, 0x0a,
-	0x0e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x12,
-	0x19, 0x0a, 0x15, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74,
-	0x79, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12, 0x20, 0x0a, 0x1c, 0x50, 0x65,
-	0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x53, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x10, 0x01, 0x12, 0x1d, 0x0a, 0x19,
-	0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x49, 0x50,
-	0x76, 0x36, 0x4f, 0x76, 0x65, 0x72, 0x6c, 0x61, 0x79, 0x10, 0x02, 0x2a, 0x4c, 0x0a, 0x0c, 0x52,
-	0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x0b, 0x0a, 0x07, 0x55,
-	0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x41, 0x4c, 0x4c, 0x10,
-	0x01, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x44,
-	0x50, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x43, 0x4d, 0x50, 0x10, 0x04, 0x12, 0x0a, 0x0a,
-	0x06, 0x43, 0x55, 0x53, 0x54, 0x4f, 0x4d, 0x10, 0x05, 0x2a, 0x20, 0x0a, 0x0d, 0x52, 0x75, 0x6c,
-	0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x06, 0x0a, 0x02, 0x49, 0x4e,
-	0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x4f, 0x55, 0x54, 0x10, 0x01, 0x2a, 0x22, 0x0a, 0x0a, 0x52,
-	0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0a, 0x0a, 0x06, 0x41, 0x43, 0x43,
-	0x45, 0x50, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x44, 0x52, 0x4f, 0x50, 0x10, 0x01, 0x2a,
-	0x63, 0x0a, 0x0e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x12, 0x0f, 0x0a, 0x0b, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x48, 0x54, 0x54, 0x50,
-	0x10, 0x00, 0x12, 0x10, 0x0a, 0x0c, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x48, 0x54, 0x54,
-	0x50, 0x53, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x54,
-	0x43, 0x50, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x55,
-	0x44, 0x50, 0x10, 0x03, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x54,
-	0x4c, 0x53, 0x10, 0x04, 0x32, 0xd0, 0x07, 0x0a, 0x11, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x45, 0x0a, 0x05, 0x4c, 0x6f,
-	0x67, 0x69, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x6e,
+	0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41,
+	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c,
+	0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74,
+	0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64,
+	0x50, 0x6f, 0x72, 0x74, 0x3a, 0x02, 0x18, 0x01, 0x22, 0x8b, 0x02, 0x0a, 0x14, 0x45, 0x78, 0x70,
+	0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x36, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
+	0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x10, 0x0a,
+	0x03, 0x70, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12,
+	0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x75,
+	0x73, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x16, 0x0a, 0x06,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65,
+	0x66, 0x69, 0x78, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50,
+	0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f,
+	0x70, 0x6f, 0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74,
+	0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x15, 0x45, 0x78, 0x70, 0x6f, 0x73,
+	0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x75,
+	0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x55, 0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12,
+	0x70, 0x6f, 0x72, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x73, 0x73, 0x69, 0x67, 0x6e,
+	0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x6f, 0x72, 0x74, 0x41, 0x75,
+	0x74, 0x6f, 0x41, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x22, 0x2c, 0x0a, 0x12, 0x52, 0x65,
+	0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x15, 0x0a, 0x13, 0x52, 0x65, 0x6e, 0x65,
+	0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x2b, 0x0a, 0x11, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x14, 0x0a, 0x12,
+	0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x9a, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61,
+	0x70, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x3a, 0x0a, 0x04, 0x66, 0x75, 0x6c,
+	0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43,
+	0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x48, 0x00, 0x52,
+	0x04, 0x66, 0x75, 0x6c, 0x6c, 0x12, 0x3d, 0x0a, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70,
+	0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x48, 0x00, 0x52, 0x05, 0x64,
+	0x65, 0x6c, 0x74, 0x61, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22,
+	0x96, 0x0f, 0x0a, 0x18, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f,
+	0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x12, 0x16, 0x0a, 0x06,
+	0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73, 0x65,
+	0x72, 0x69, 0x61, 0x6c, 0x12, 0x37, 0x0a, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x34, 0x0a,
+	0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x12, 0x4d, 0x0a, 0x10, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x73,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
+	0x74, 0x52, 0x0f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e,
+	0x67, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e,
+	0x67, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
+	0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0b, 0x64, 0x6e, 0x73, 0x53, 0x65, 0x74,
+	0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x6e, 0x73, 0x5f, 0x64, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x6e, 0x73, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x7a,
+	0x6f, 0x6e, 0x65, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x10, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e,
+	0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2d, 0x0a, 0x05, 0x70, 0x65, 0x65,
+	0x72, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
+	0x74, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x72, 0x6f, 0x75, 0x74,
+	0x65, 0x72, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18,
+	0x0a, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x11, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x50, 0x65, 0x65,
+	0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x08, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x69, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f,
+	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x12,
+	0x30, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x72, 0x6f,
+	0x75, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x12, 0x2c, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x52, 0x61, 0x77, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12,
+	0x4b, 0x0a, 0x11, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x61, 0x6d, 0x65,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x40, 0x0a, 0x0f,
+	0x61, 0x6c, 0x6c, 0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18,
+	0x0f, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52,
+	0x0d, 0x61, 0x6c, 0x6c, 0x44, 0x6e, 0x73, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x3b,
+	0x0a, 0x0d, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x73, 0x18,
+	0x10, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0c, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e,
+	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x55, 0x0a, 0x0b, 0x72, 0x6f, 0x75, 0x74,
+	0x65, 0x72, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x12, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46,
+	0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x12,
+	0x71, 0x0a, 0x15, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x69, 0x65, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x13, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3d,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73,
+	0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x13, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d,
+	0x61, 0x70, 0x12, 0x6a, 0x0a, 0x14, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x5f, 0x74,
+	0x6f, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x14, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x3a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e,
+	0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f,
+	0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x28,
+	0x0a, 0x10, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x15, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
+	0x64, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x6e, 0x0a, 0x14, 0x70, 0x6f, 0x73, 0x74,
+	0x75, 0x72, 0x65, 0x5f, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73,
+	0x18, 0x16, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f,
+	0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x50, 0x6f, 0x73,
+	0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x52, 0x12, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69,
+	0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x64, 0x6e, 0x73, 0x5f,
+	0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x17,
+	0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x64, 0x6e, 0x73, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
+	0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f,
+	0x70, 0x61, 0x74, 0x63, 0x68, 0x18, 0x18, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61,
+	0x74, 0x63, 0x68, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61,
+	0x74, 0x63, 0x68, 0x12, 0x22, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x5f, 0x63,
+	0x6c, 0x61, 0x69, 0x6d, 0x18, 0x19, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x75, 0x73, 0x65, 0x72,
+	0x49, 0x64, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x1a, 0x5c, 0x0a, 0x0f, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5d, 0x0a, 0x18, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x12, 0x2b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5b, 0x0a, 0x15, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54,
+	0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x2c, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72,
+	0x49, 0x44, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x1a, 0x5f, 0x0a, 0x17, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c,
+	0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2e,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x49,
+	0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x4a, 0x04, 0x08, 0x1a, 0x10, 0x33, 0x22, 0x8b, 0x03, 0x0a, 0x0a, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x41, 0x0a, 0x0d, 0x6f,
+	0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x3f,
+	0x0a, 0x0e, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65,
+	0x52, 0x0d, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12,
+	0x29, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x14, 0x72, 0x6f,
+	0x75, 0x74, 0x65, 0x5f, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c,
+	0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77,
+	0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x12, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x10, 0x66,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18,
+	0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c,
+	0x65, 0x52, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c,
+	0x65, 0x73, 0x3a, 0x02, 0x18, 0x01, 0x22, 0x94, 0x01, 0x0a, 0x16, 0x41, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
+	0x74, 0x12, 0x41, 0x0a, 0x1d, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f,
+	0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x70, 0x65, 0x65, 0x72, 0x4c, 0x6f,
+	0x67, 0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x12, 0x37, 0x0a, 0x18, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67,
+	0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x73,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x15, 0x70, 0x65, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x69,
+	0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x73, 0x22, 0x95, 0x01,
+	0x0a, 0x0e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x12, 0x1e, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72,
+	0x12, 0x19, 0x0a, 0x08, 0x6e, 0x65, 0x74, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x43, 0x69, 0x64, 0x72, 0x12, 0x1e, 0x0a, 0x0b, 0x6e,
+	0x65, 0x74, 0x5f, 0x76, 0x36, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x6e, 0x65, 0x74, 0x56, 0x36, 0x43, 0x69, 0x64, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x64,
+	0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6e, 0x73, 0x12, 0x16, 0x0a,
+	0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73,
+	0x65, 0x72, 0x69, 0x61, 0x6c, 0x22, 0x21, 0x0a, 0x19, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44, 0x65, 0x6c,
+	0x74, 0x61, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x65, 0x22, 0xa2, 0x04, 0x0a, 0x0b, 0x50, 0x65, 0x65,
+	0x72, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x1c, 0x0a, 0x0a, 0x77, 0x67, 0x5f, 0x70,
+	0x75, 0x62, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x77, 0x67,
+	0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x02, 0x69, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76, 0x36, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x69, 0x70, 0x76, 0x36, 0x12, 0x1e, 0x0a, 0x0b, 0x73, 0x73,
+	0x68, 0x5f, 0x70, 0x75, 0x62, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x6e,
+	0x73, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64,
+	0x6e, 0x73, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74,
+	0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
+	0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2f, 0x0a, 0x14,
+	0x61, 0x64, 0x64, 0x65, 0x64, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x5f, 0x73, 0x73, 0x6f, 0x5f, 0x6c,
+	0x6f, 0x67, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x61, 0x64, 0x64, 0x65,
+	0x64, 0x57, 0x69, 0x74, 0x68, 0x53, 0x73, 0x6f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x38, 0x0a,
+	0x18, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x16, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2f, 0x0a, 0x14, 0x6c, 0x61, 0x73, 0x74, 0x5f,
+	0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x75, 0x6e, 0x69, 0x78, 0x5f, 0x6e, 0x61, 0x6e, 0x6f, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x03, 0x52, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e,
+	0x55, 0x6e, 0x69, 0x78, 0x4e, 0x61, 0x6e, 0x6f, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x73, 0x68, 0x5f,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73,
+	0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x75, 0x70,
+	0x70, 0x6f, 0x72, 0x74, 0x73, 0x5f, 0x69, 0x70, 0x76, 0x36, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0c, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x49, 0x70, 0x76, 0x36, 0x12, 0x38,
+	0x0a, 0x18, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x16, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x5f, 0x73, 0x73, 0x68, 0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x18, 0x0d,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x73, 0x68, 0x41,
+	0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f,
+	0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d,
+	0x70, 0x72, 0x6f, 0x78, 0x79, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x22, 0x91, 0x06,
+	0x0a, 0x0d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c,
+	0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
+	0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x24, 0x0a, 0x0d, 0x62, 0x69, 0x64, 0x69, 0x72, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x62, 0x69,
+	0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x70,
+	0x6f, 0x72, 0x74, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x05, 0x70, 0x6f, 0x72, 0x74,
+	0x73, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x73,
+	0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52, 0x61, 0x6e,
+	0x67, 0x65, 0x52, 0x0a, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12, 0x28,
+	0x0a, 0x10, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x15, 0x64, 0x65, 0x73, 0x74,
+	0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64,
+	0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x5c, 0x0a, 0x11,
+	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61,
+	0x63, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x47, 0x72, 0x6f,
+	0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x61, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55,
+	0x73, 0x65, 0x72, 0x12, 0x44, 0x0a, 0x0f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x4e, 0x0a, 0x14, 0x64, 0x65, 0x73,
+	0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6d,
+	0x70, 0x61, 0x63, 0x74, 0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x37, 0x0a, 0x18, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x63, 0x68, 0x65, 0x63,
+	0x6b, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x49,
+	0x64, 0x73, 0x1a, 0x5d, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2e, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x4e, 0x61,
+	0x6d, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x22, 0x80, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f,
+	0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65,
+	0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x12,
+	0x1d, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x4a, 0x04,
+	0x08, 0x04, 0x10, 0x05, 0x22, 0x24, 0x0a, 0x0c, 0x55, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65,
+	0x4c, 0x69, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x93, 0x01, 0x0a, 0x0c, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x70,
+	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0d, 0x52, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x15,
+	0x0a, 0x06, 0x69, 0x73, 0x5f, 0x61, 0x6c, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05,
+	0x69, 0x73, 0x41, 0x6c, 0x6c, 0x12, 0x39, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f,
+	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x22, 0x57, 0x0a, 0x12, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43,
+	0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x41, 0x0a, 0x1d, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x1a, 0x64,
+	0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x22, 0x8d, 0x04, 0x0a, 0x08, 0x52, 0x6f,
+	0x75, 0x74, 0x65, 0x52, 0x61, 0x77, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x20, 0x0a,
+	0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x43, 0x69,
+	0x64, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x05, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1d, 0x0a, 0x0a,
+	0x6b, 0x65, 0x65, 0x70, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x70,
+	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x07, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65,
+	0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78,
+	0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0b, 0x6e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x6d, 0x61, 0x73,
+	0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x6d,
+	0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74,
+	0x72, 0x69, 0x63, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69,
+	0x63, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0d, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x37, 0x0a, 0x18, 0x61, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x5f, 0x69, 0x64, 0x73, 0x18, 0x0f, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x61, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64,
+	0x73, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61,
+	0x70, 0x70, 0x6c, 0x79, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69, 0x70,
+	0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xff, 0x01, 0x0a, 0x12, 0x4e, 0x61,
+	0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x61, 0x77,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x38, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x0b, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x6d, 0x61,
+	0x72, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72,
+	0x79, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x65,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x34, 0x0a, 0x16, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x5f,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x87, 0x02, 0x0a, 0x12,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
+	0x61, 0x77, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x73, 0x65,
+	0x71, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x53, 0x65, 0x71, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a,
+	0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64,
+	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72,
+	0x65, 0x66, 0x69, 0x78, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0a, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x43, 0x69, 0x64, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x65,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x4d, 0x0a, 0x11, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x38, 0x0a, 0x07, 0x65, 0x6e,
+	0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x65, 0x6e, 0x74,
+	0x72, 0x69, 0x65, 0x73, 0x22, 0xe1, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x70,
+	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65,
+	0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74,
+	0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x6d, 0x61, 0x73, 0x71, 0x75, 0x65,
+	0x72, 0x61, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x6d, 0x61, 0x73, 0x71,
+	0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x18,
+	0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x1d, 0x0a, 0x09, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x49, 0x64, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x03, 0x69, 0x64, 0x73, 0x22, 0x27, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x49,
+	0x44, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73,
+	0x22, 0x31, 0x0a, 0x0c, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74,
+	0x12, 0x21, 0x0a, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65,
+	0x78, 0x65, 0x73, 0x2a, 0x3a, 0x0a, 0x09, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x12, 0x12, 0x0a, 0x0e, 0x75, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x73, 0x75, 0x63, 0x63, 0x65, 0x65, 0x64, 0x65,
+	0x64, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x10, 0x02, 0x2a,
+	0x93, 0x01, 0x0a, 0x0e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69,
+	0x74, 0x79, 0x12, 0x19, 0x0a, 0x15, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69,
+	0x6c, 0x69, 0x74, 0x79, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12, 0x20, 0x0a,
+	0x1c, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x53,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x10, 0x01, 0x12,
+	0x1d, 0x0a, 0x19, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74,
+	0x79, 0x49, 0x50, 0x76, 0x36, 0x4f, 0x76, 0x65, 0x72, 0x6c, 0x61, 0x79, 0x10, 0x02, 0x12, 0x25,
+	0x0a, 0x21, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79,
+	0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x4d, 0x61, 0x70, 0x10, 0x03, 0x2a, 0x48, 0x0a, 0x09, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61,
+	0x74, 0x65, 0x12, 0x14, 0x0a, 0x10, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x44,
+	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x4c, 0x61, 0x7a, 0x79,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x4c, 0x61, 0x7a, 0x79, 0x10, 0x01, 0x12, 0x12, 0x0a, 0x0e, 0x4c,
+	0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x45, 0x61, 0x67, 0x65, 0x72, 0x10, 0x02, 0x2a,
+	0x5d, 0x0a, 0x0c, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12,
+	0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03,
+	0x41, 0x4c, 0x4c, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x07,
+	0x0a, 0x03, 0x55, 0x44, 0x50, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x43, 0x4d, 0x50, 0x10,
+	0x04, 0x12, 0x0a, 0x0a, 0x06, 0x43, 0x55, 0x53, 0x54, 0x4f, 0x4d, 0x10, 0x05, 0x12, 0x0f, 0x0a,
+	0x0b, 0x4e, 0x45, 0x54, 0x42, 0x49, 0x52, 0x44, 0x5f, 0x53, 0x53, 0x48, 0x10, 0x06, 0x2a, 0x20,
+	0x0a, 0x0d, 0x52, 0x75, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x06, 0x0a, 0x02, 0x49, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x4f, 0x55, 0x54, 0x10, 0x01,
+	0x2a, 0x22, 0x0a, 0x0a, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0a,
+	0x0a, 0x06, 0x41, 0x43, 0x43, 0x45, 0x50, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x44, 0x52,
+	0x4f, 0x50, 0x10, 0x01, 0x2a, 0x63, 0x0a, 0x0e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x0f, 0x0a, 0x0b, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45,
+	0x5f, 0x48, 0x54, 0x54, 0x50, 0x10, 0x00, 0x12, 0x10, 0x0a, 0x0c, 0x45, 0x58, 0x50, 0x4f, 0x53,
+	0x45, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50,
+	0x4f, 0x53, 0x45, 0x5f, 0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50,
+	0x4f, 0x53, 0x45, 0x5f, 0x55, 0x44, 0x50, 0x10, 0x03, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50,
+	0x4f, 0x53, 0x45, 0x5f, 0x54, 0x4c, 0x53, 0x10, 0x04, 0x32, 0xd0, 0x07, 0x0a, 0x11, 0x4d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
+	0x45, 0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73,
+	0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x46, 0x0a, 0x04, 0x53, 0x79, 0x6e, 0x63, 0x12, 0x1c,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
+	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
+	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x30, 0x01, 0x12, 0x42,
+	0x0a, 0x0c, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x12, 0x11,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x1a, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x33, 0x0a, 0x09, 0x69, 0x73, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x79, 0x12,
+	0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x5a, 0x0a, 0x1a, 0x47, 0x65, 0x74, 0x44, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
 	0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45,
-	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22,
-	0x00, 0x12, 0x46, 0x0a, 0x04, 0x53, 0x79, 0x6e, 0x63, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12,
+	0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79,
+	0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x3d, 0x0a,
+	0x08, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
 	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64,
-	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
-	0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x30, 0x01, 0x12, 0x42, 0x0a, 0x0c, 0x47, 0x65, 0x74,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1d, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x33, 0x0a,
-	0x09, 0x69, 0x73, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x79, 0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x11, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
-	0x22, 0x00, 0x12, 0x5a, 0x0a, 0x1a, 0x47, 0x65, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77,
+	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x3b, 0x0a, 0x06,
+	0x4c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73,
+	0x73, 0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x47, 0x0a, 0x03, 0x4a, 0x6f, 0x62,
 	0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
 	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c,
 	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
-	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x58,
-	0x0a, 0x18, 0x47, 0x65, 0x74, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
-	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x3d, 0x0a, 0x08, 0x53, 0x79, 0x6e, 0x63,
-	0x4d, 0x65, 0x74, 0x61, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x3b, 0x0a, 0x06, 0x4c, 0x6f, 0x67, 0x6f, 0x75,
-	0x74, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45,
-	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a,
-	0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70,
-	0x74, 0x79, 0x22, 0x00, 0x12, 0x47, 0x0a, 0x03, 0x4a, 0x6f, 0x62, 0x12, 0x1c, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
-	0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64,
-	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01, 0x30, 0x01, 0x12, 0x51, 0x0a,
-	0x11, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69,
-	0x6f, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01,
+	0x30, 0x01, 0x12, 0x51, 0x0a, 0x11, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x41, 0x75, 0x74, 0x68,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45,
+	0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x22, 0x00, 0x12, 0x4b, 0x0a, 0x0b, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f,
+	0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
 	0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
 	0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
 	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00,
-	0x12, 0x4c, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65,
-	0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
-	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c,
+	0x12, 0x4a, 0x0a, 0x0a, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c,
 	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
-	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x4b,
-	0x0a, 0x0b, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79,
-	0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
-	0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x4a, 0x0a, 0x0a, 0x53,
-	0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64,
-	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
-	0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
+	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x42, 0x08, 0x5a, 0x06,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -5495,178 +8185,249 @@ func file_management_proto_rawDescGZIP() []byte {
 	return file_management_proto_rawDescData
 }
 
-var file_management_proto_enumTypes = make([]protoimpl.EnumInfo, 8)
-var file_management_proto_msgTypes = make([]protoimpl.MessageInfo, 58)
+var file_management_proto_enumTypes = make([]protoimpl.EnumInfo, 9)
+var file_management_proto_msgTypes = make([]protoimpl.MessageInfo, 85)
 var file_management_proto_goTypes = []interface{}{
 	(JobStatus)(0),                         // 0: management.JobStatus
 	(PeerCapability)(0),                    // 1: management.PeerCapability
-	(RuleProtocol)(0),                      // 2: management.RuleProtocol
-	(RuleDirection)(0),                     // 3: management.RuleDirection
-	(RuleAction)(0),                        // 4: management.RuleAction
-	(ExposeProtocol)(0),                    // 5: management.ExposeProtocol
-	(HostConfig_Protocol)(0),               // 6: management.HostConfig.Protocol
-	(DeviceAuthorizationFlowProvider)(0),   // 7: management.DeviceAuthorizationFlow.provider
-	(*EncryptedMessage)(nil),               // 8: management.EncryptedMessage
-	(*JobRequest)(nil),                     // 9: management.JobRequest
-	(*JobResponse)(nil),                    // 10: management.JobResponse
-	(*BundleParameters)(nil),               // 11: management.BundleParameters
-	(*BundleResult)(nil),                   // 12: management.BundleResult
-	(*SyncRequest)(nil),                    // 13: management.SyncRequest
-	(*SyncResponse)(nil),                   // 14: management.SyncResponse
-	(*SyncMetaRequest)(nil),                // 15: management.SyncMetaRequest
-	(*LoginRequest)(nil),                   // 16: management.LoginRequest
-	(*PeerKeys)(nil),                       // 17: management.PeerKeys
-	(*Environment)(nil),                    // 18: management.Environment
-	(*File)(nil),                           // 19: management.File
-	(*Flags)(nil),                          // 20: management.Flags
-	(*PeerSystemMeta)(nil),                 // 21: management.PeerSystemMeta
-	(*LoginResponse)(nil),                  // 22: management.LoginResponse
-	(*ExtendAuthSessionRequest)(nil),       // 23: management.ExtendAuthSessionRequest
-	(*ExtendAuthSessionResponse)(nil),      // 24: management.ExtendAuthSessionResponse
-	(*ServerKeyResponse)(nil),              // 25: management.ServerKeyResponse
-	(*Empty)(nil),                          // 26: management.Empty
-	(*NetbirdConfig)(nil),                  // 27: management.NetbirdConfig
-	(*HostConfig)(nil),                     // 28: management.HostConfig
-	(*RelayConfig)(nil),                    // 29: management.RelayConfig
-	(*FlowConfig)(nil),                     // 30: management.FlowConfig
-	(*MetricsConfig)(nil),                  // 31: management.MetricsConfig
-	(*JWTConfig)(nil),                      // 32: management.JWTConfig
-	(*ProtectedHostConfig)(nil),            // 33: management.ProtectedHostConfig
-	(*PeerConfig)(nil),                     // 34: management.PeerConfig
-	(*AutoUpdateSettings)(nil),             // 35: management.AutoUpdateSettings
-	(*NetworkMap)(nil),                     // 36: management.NetworkMap
-	(*SSHAuth)(nil),                        // 37: management.SSHAuth
-	(*MachineUserIndexes)(nil),             // 38: management.MachineUserIndexes
-	(*RemotePeerConfig)(nil),               // 39: management.RemotePeerConfig
-	(*SSHConfig)(nil),                      // 40: management.SSHConfig
-	(*DeviceAuthorizationFlowRequest)(nil), // 41: management.DeviceAuthorizationFlowRequest
-	(*DeviceAuthorizationFlow)(nil),        // 42: management.DeviceAuthorizationFlow
-	(*PKCEAuthorizationFlowRequest)(nil),   // 43: management.PKCEAuthorizationFlowRequest
-	(*PKCEAuthorizationFlow)(nil),          // 44: management.PKCEAuthorizationFlow
-	(*ProviderConfig)(nil),                 // 45: management.ProviderConfig
-	(*Route)(nil),                          // 46: management.Route
-	(*DNSConfig)(nil),                      // 47: management.DNSConfig
-	(*CustomZone)(nil),                     // 48: management.CustomZone
-	(*SimpleRecord)(nil),                   // 49: management.SimpleRecord
-	(*NameServerGroup)(nil),                // 50: management.NameServerGroup
-	(*NameServer)(nil),                     // 51: management.NameServer
-	(*FirewallRule)(nil),                   // 52: management.FirewallRule
-	(*NetworkAddress)(nil),                 // 53: management.NetworkAddress
-	(*Checks)(nil),                         // 54: management.Checks
-	(*PortInfo)(nil),                       // 55: management.PortInfo
-	(*RouteFirewallRule)(nil),              // 56: management.RouteFirewallRule
-	(*ForwardingRule)(nil),                 // 57: management.ForwardingRule
-	(*ExposeServiceRequest)(nil),           // 58: management.ExposeServiceRequest
-	(*ExposeServiceResponse)(nil),          // 59: management.ExposeServiceResponse
-	(*RenewExposeRequest)(nil),             // 60: management.RenewExposeRequest
-	(*RenewExposeResponse)(nil),            // 61: management.RenewExposeResponse
-	(*StopExposeRequest)(nil),              // 62: management.StopExposeRequest
-	(*StopExposeResponse)(nil),             // 63: management.StopExposeResponse
-	nil,                                    // 64: management.SSHAuth.MachineUsersEntry
-	(*PortInfo_Range)(nil),                 // 65: management.PortInfo.Range
-	(*timestamppb.Timestamp)(nil),          // 66: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),            // 67: google.protobuf.Duration
+	(LazyState)(0),                         // 2: management.LazyState
+	(RuleProtocol)(0),                      // 3: management.RuleProtocol
+	(RuleDirection)(0),                     // 4: management.RuleDirection
+	(RuleAction)(0),                        // 5: management.RuleAction
+	(ExposeProtocol)(0),                    // 6: management.ExposeProtocol
+	(HostConfig_Protocol)(0),               // 7: management.HostConfig.Protocol
+	(DeviceAuthorizationFlowProvider)(0),   // 8: management.DeviceAuthorizationFlow.provider
+	(*EncryptedMessage)(nil),               // 9: management.EncryptedMessage
+	(*JobRequest)(nil),                     // 10: management.JobRequest
+	(*JobResponse)(nil),                    // 11: management.JobResponse
+	(*BundleParameters)(nil),               // 12: management.BundleParameters
+	(*BundleResult)(nil),                   // 13: management.BundleResult
+	(*SyncRequest)(nil),                    // 14: management.SyncRequest
+	(*SyncResponse)(nil),                   // 15: management.SyncResponse
+	(*SyncMetaRequest)(nil),                // 16: management.SyncMetaRequest
+	(*LoginRequest)(nil),                   // 17: management.LoginRequest
+	(*PeerKeys)(nil),                       // 18: management.PeerKeys
+	(*Environment)(nil),                    // 19: management.Environment
+	(*File)(nil),                           // 20: management.File
+	(*Flags)(nil),                          // 21: management.Flags
+	(*PeerSystemMeta)(nil),                 // 22: management.PeerSystemMeta
+	(*LoginResponse)(nil),                  // 23: management.LoginResponse
+	(*ExtendAuthSessionRequest)(nil),       // 24: management.ExtendAuthSessionRequest
+	(*ExtendAuthSessionResponse)(nil),      // 25: management.ExtendAuthSessionResponse
+	(*ServerKeyResponse)(nil),              // 26: management.ServerKeyResponse
+	(*Empty)(nil),                          // 27: management.Empty
+	(*NetbirdConfig)(nil),                  // 28: management.NetbirdConfig
+	(*HostConfig)(nil),                     // 29: management.HostConfig
+	(*RelayConfig)(nil),                    // 30: management.RelayConfig
+	(*FlowConfig)(nil),                     // 31: management.FlowConfig
+	(*MetricsConfig)(nil),                  // 32: management.MetricsConfig
+	(*JWTConfig)(nil),                      // 33: management.JWTConfig
+	(*ProtectedHostConfig)(nil),            // 34: management.ProtectedHostConfig
+	(*PeerConfig)(nil),                     // 35: management.PeerConfig
+	(*AutoUpdateSettings)(nil),             // 36: management.AutoUpdateSettings
+	(*NetworkMap)(nil),                     // 37: management.NetworkMap
+	(*SSHAuth)(nil),                        // 38: management.SSHAuth
+	(*MachineUserIndexes)(nil),             // 39: management.MachineUserIndexes
+	(*RemotePeerConfig)(nil),               // 40: management.RemotePeerConfig
+	(*SSHConfig)(nil),                      // 41: management.SSHConfig
+	(*DeviceAuthorizationFlowRequest)(nil), // 42: management.DeviceAuthorizationFlowRequest
+	(*DeviceAuthorizationFlow)(nil),        // 43: management.DeviceAuthorizationFlow
+	(*PKCEAuthorizationFlowRequest)(nil),   // 44: management.PKCEAuthorizationFlowRequest
+	(*PKCEAuthorizationFlow)(nil),          // 45: management.PKCEAuthorizationFlow
+	(*ProviderConfig)(nil),                 // 46: management.ProviderConfig
+	(*Route)(nil),                          // 47: management.Route
+	(*DNSConfig)(nil),                      // 48: management.DNSConfig
+	(*CustomZone)(nil),                     // 49: management.CustomZone
+	(*SimpleRecord)(nil),                   // 50: management.SimpleRecord
+	(*NameServerGroup)(nil),                // 51: management.NameServerGroup
+	(*NameServer)(nil),                     // 52: management.NameServer
+	(*FirewallRule)(nil),                   // 53: management.FirewallRule
+	(*NetworkAddress)(nil),                 // 54: management.NetworkAddress
+	(*Checks)(nil),                         // 55: management.Checks
+	(*CertificateChallenge)(nil),           // 56: management.CertificateChallenge
+	(*CertificateProof)(nil),               // 57: management.CertificateProof
+	(*PortInfo)(nil),                       // 58: management.PortInfo
+	(*RouteFirewallRule)(nil),              // 59: management.RouteFirewallRule
+	(*ForwardingRule)(nil),                 // 60: management.ForwardingRule
+	(*ExposeServiceRequest)(nil),           // 61: management.ExposeServiceRequest
+	(*ExposeServiceResponse)(nil),          // 62: management.ExposeServiceResponse
+	(*RenewExposeRequest)(nil),             // 63: management.RenewExposeRequest
+	(*RenewExposeResponse)(nil),            // 64: management.RenewExposeResponse
+	(*StopExposeRequest)(nil),              // 65: management.StopExposeRequest
+	(*StopExposeResponse)(nil),             // 66: management.StopExposeResponse
+	(*NetworkMapEnvelope)(nil),             // 67: management.NetworkMapEnvelope
+	(*NetworkMapComponentsFull)(nil),       // 68: management.NetworkMapComponentsFull
+	(*ProxyPatch)(nil),                     // 69: management.ProxyPatch
+	(*AccountSettingsCompact)(nil),         // 70: management.AccountSettingsCompact
+	(*AccountNetwork)(nil),                 // 71: management.AccountNetwork
+	(*NetworkMapComponentsDelta)(nil),      // 72: management.NetworkMapComponentsDelta
+	(*PeerCompact)(nil),                    // 73: management.PeerCompact
+	(*PolicyCompact)(nil),                  // 74: management.PolicyCompact
+	(*ResourceCompact)(nil),                // 75: management.ResourceCompact
+	(*UserNameList)(nil),                   // 76: management.UserNameList
+	(*GroupCompact)(nil),                   // 77: management.GroupCompact
+	(*DNSSettingsCompact)(nil),             // 78: management.DNSSettingsCompact
+	(*RouteRaw)(nil),                       // 79: management.RouteRaw
+	(*NameServerGroupRaw)(nil),             // 80: management.NameServerGroupRaw
+	(*NetworkResourceRaw)(nil),             // 81: management.NetworkResourceRaw
+	(*NetworkRouterList)(nil),              // 82: management.NetworkRouterList
+	(*NetworkRouterEntry)(nil),             // 83: management.NetworkRouterEntry
+	(*PolicyIds)(nil),                      // 84: management.PolicyIds
+	(*UserIDList)(nil),                     // 85: management.UserIDList
+	(*PeerIndexSet)(nil),                   // 86: management.PeerIndexSet
+	nil,                                    // 87: management.SSHAuth.MachineUsersEntry
+	(*PortInfo_Range)(nil),                 // 88: management.PortInfo.Range
+	nil,                                    // 89: management.NetworkMapComponentsFull.RoutersMapEntry
+	nil,                                    // 90: management.NetworkMapComponentsFull.ResourcePoliciesMapEntry
+	nil,                                    // 91: management.NetworkMapComponentsFull.GroupIdToUserIdsEntry
+	nil,                                    // 92: management.NetworkMapComponentsFull.PostureFailedPeersEntry
+	nil,                                    // 93: management.PolicyCompact.AuthorizedGroupsEntry
+	(*timestamppb.Timestamp)(nil),          // 94: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),            // 95: google.protobuf.Duration
 }
 var file_management_proto_depIdxs = []int32{
-	11, // 0: management.JobRequest.bundle:type_name -> management.BundleParameters
-	0,  // 1: management.JobResponse.status:type_name -> management.JobStatus
-	12, // 2: management.JobResponse.bundle:type_name -> management.BundleResult
-	21, // 3: management.SyncRequest.meta:type_name -> management.PeerSystemMeta
-	27, // 4: management.SyncResponse.netbirdConfig:type_name -> management.NetbirdConfig
-	34, // 5: management.SyncResponse.peerConfig:type_name -> management.PeerConfig
-	39, // 6: management.SyncResponse.remotePeers:type_name -> management.RemotePeerConfig
-	36, // 7: management.SyncResponse.NetworkMap:type_name -> management.NetworkMap
-	54, // 8: management.SyncResponse.Checks:type_name -> management.Checks
-	66, // 9: management.SyncResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	21, // 10: management.SyncMetaRequest.meta:type_name -> management.PeerSystemMeta
-	21, // 11: management.LoginRequest.meta:type_name -> management.PeerSystemMeta
-	17, // 12: management.LoginRequest.peerKeys:type_name -> management.PeerKeys
-	53, // 13: management.PeerSystemMeta.networkAddresses:type_name -> management.NetworkAddress
-	18, // 14: management.PeerSystemMeta.environment:type_name -> management.Environment
-	19, // 15: management.PeerSystemMeta.files:type_name -> management.File
-	20, // 16: management.PeerSystemMeta.flags:type_name -> management.Flags
-	1,  // 17: management.PeerSystemMeta.capabilities:type_name -> management.PeerCapability
-	27, // 18: management.LoginResponse.netbirdConfig:type_name -> management.NetbirdConfig
-	34, // 19: management.LoginResponse.peerConfig:type_name -> management.PeerConfig
-	54, // 20: management.LoginResponse.Checks:type_name -> management.Checks
-	66, // 21: management.LoginResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	21, // 22: management.ExtendAuthSessionRequest.meta:type_name -> management.PeerSystemMeta
-	66, // 23: management.ExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	66, // 24: management.ServerKeyResponse.expiresAt:type_name -> google.protobuf.Timestamp
-	28, // 25: management.NetbirdConfig.stuns:type_name -> management.HostConfig
-	33, // 26: management.NetbirdConfig.turns:type_name -> management.ProtectedHostConfig
-	28, // 27: management.NetbirdConfig.signal:type_name -> management.HostConfig
-	29, // 28: management.NetbirdConfig.relay:type_name -> management.RelayConfig
-	30, // 29: management.NetbirdConfig.flow:type_name -> management.FlowConfig
-	31, // 30: management.NetbirdConfig.metrics:type_name -> management.MetricsConfig
-	6,  // 31: management.HostConfig.protocol:type_name -> management.HostConfig.Protocol
-	67, // 32: management.FlowConfig.interval:type_name -> google.protobuf.Duration
-	28, // 33: management.ProtectedHostConfig.hostConfig:type_name -> management.HostConfig
-	40, // 34: management.PeerConfig.sshConfig:type_name -> management.SSHConfig
-	35, // 35: management.PeerConfig.autoUpdate:type_name -> management.AutoUpdateSettings
-	34, // 36: management.NetworkMap.peerConfig:type_name -> management.PeerConfig
-	39, // 37: management.NetworkMap.remotePeers:type_name -> management.RemotePeerConfig
-	46, // 38: management.NetworkMap.Routes:type_name -> management.Route
-	47, // 39: management.NetworkMap.DNSConfig:type_name -> management.DNSConfig
-	39, // 40: management.NetworkMap.offlinePeers:type_name -> management.RemotePeerConfig
-	52, // 41: management.NetworkMap.FirewallRules:type_name -> management.FirewallRule
-	56, // 42: management.NetworkMap.routesFirewallRules:type_name -> management.RouteFirewallRule
-	57, // 43: management.NetworkMap.forwardingRules:type_name -> management.ForwardingRule
-	37, // 44: management.NetworkMap.sshAuth:type_name -> management.SSHAuth
-	64, // 45: management.SSHAuth.machine_users:type_name -> management.SSHAuth.MachineUsersEntry
-	40, // 46: management.RemotePeerConfig.sshConfig:type_name -> management.SSHConfig
-	32, // 47: management.SSHConfig.jwtConfig:type_name -> management.JWTConfig
-	7,  // 48: management.DeviceAuthorizationFlow.Provider:type_name -> management.DeviceAuthorizationFlow.provider
-	45, // 49: management.DeviceAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
-	45, // 50: management.PKCEAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
-	50, // 51: management.DNSConfig.NameServerGroups:type_name -> management.NameServerGroup
-	48, // 52: management.DNSConfig.CustomZones:type_name -> management.CustomZone
-	49, // 53: management.CustomZone.Records:type_name -> management.SimpleRecord
-	51, // 54: management.NameServerGroup.NameServers:type_name -> management.NameServer
-	3,  // 55: management.FirewallRule.Direction:type_name -> management.RuleDirection
-	4,  // 56: management.FirewallRule.Action:type_name -> management.RuleAction
-	2,  // 57: management.FirewallRule.Protocol:type_name -> management.RuleProtocol
-	55, // 58: management.FirewallRule.PortInfo:type_name -> management.PortInfo
-	65, // 59: management.PortInfo.range:type_name -> management.PortInfo.Range
-	4,  // 60: management.RouteFirewallRule.action:type_name -> management.RuleAction
-	2,  // 61: management.RouteFirewallRule.protocol:type_name -> management.RuleProtocol
-	55, // 62: management.RouteFirewallRule.portInfo:type_name -> management.PortInfo
-	2,  // 63: management.ForwardingRule.protocol:type_name -> management.RuleProtocol
-	55, // 64: management.ForwardingRule.destinationPort:type_name -> management.PortInfo
-	55, // 65: management.ForwardingRule.translatedPort:type_name -> management.PortInfo
-	5,  // 66: management.ExposeServiceRequest.protocol:type_name -> management.ExposeProtocol
-	38, // 67: management.SSHAuth.MachineUsersEntry.value:type_name -> management.MachineUserIndexes
-	8,  // 68: management.ManagementService.Login:input_type -> management.EncryptedMessage
-	8,  // 69: management.ManagementService.Sync:input_type -> management.EncryptedMessage
-	26, // 70: management.ManagementService.GetServerKey:input_type -> management.Empty
-	26, // 71: management.ManagementService.isHealthy:input_type -> management.Empty
-	8,  // 72: management.ManagementService.GetDeviceAuthorizationFlow:input_type -> management.EncryptedMessage
-	8,  // 73: management.ManagementService.GetPKCEAuthorizationFlow:input_type -> management.EncryptedMessage
-	8,  // 74: management.ManagementService.SyncMeta:input_type -> management.EncryptedMessage
-	8,  // 75: management.ManagementService.Logout:input_type -> management.EncryptedMessage
-	8,  // 76: management.ManagementService.Job:input_type -> management.EncryptedMessage
-	8,  // 77: management.ManagementService.ExtendAuthSession:input_type -> management.EncryptedMessage
-	8,  // 78: management.ManagementService.CreateExpose:input_type -> management.EncryptedMessage
-	8,  // 79: management.ManagementService.RenewExpose:input_type -> management.EncryptedMessage
-	8,  // 80: management.ManagementService.StopExpose:input_type -> management.EncryptedMessage
-	8,  // 81: management.ManagementService.Login:output_type -> management.EncryptedMessage
-	8,  // 82: management.ManagementService.Sync:output_type -> management.EncryptedMessage
-	25, // 83: management.ManagementService.GetServerKey:output_type -> management.ServerKeyResponse
-	26, // 84: management.ManagementService.isHealthy:output_type -> management.Empty
-	8,  // 85: management.ManagementService.GetDeviceAuthorizationFlow:output_type -> management.EncryptedMessage
-	8,  // 86: management.ManagementService.GetPKCEAuthorizationFlow:output_type -> management.EncryptedMessage
-	26, // 87: management.ManagementService.SyncMeta:output_type -> management.Empty
-	26, // 88: management.ManagementService.Logout:output_type -> management.Empty
-	8,  // 89: management.ManagementService.Job:output_type -> management.EncryptedMessage
-	8,  // 90: management.ManagementService.ExtendAuthSession:output_type -> management.EncryptedMessage
-	8,  // 91: management.ManagementService.CreateExpose:output_type -> management.EncryptedMessage
-	8,  // 92: management.ManagementService.RenewExpose:output_type -> management.EncryptedMessage
-	8,  // 93: management.ManagementService.StopExpose:output_type -> management.EncryptedMessage
-	81, // [81:94] is the sub-list for method output_type
-	68, // [68:81] is the sub-list for method input_type
-	68, // [68:68] is the sub-list for extension type_name
-	68, // [68:68] is the sub-list for extension extendee
-	0,  // [0:68] is the sub-list for field type_name
+	12,  // 0: management.JobRequest.bundle:type_name -> management.BundleParameters
+	0,   // 1: management.JobResponse.status:type_name -> management.JobStatus
+	13,  // 2: management.JobResponse.bundle:type_name -> management.BundleResult
+	22,  // 3: management.SyncRequest.meta:type_name -> management.PeerSystemMeta
+	28,  // 4: management.SyncResponse.netbirdConfig:type_name -> management.NetbirdConfig
+	35,  // 5: management.SyncResponse.peerConfig:type_name -> management.PeerConfig
+	40,  // 6: management.SyncResponse.remotePeers:type_name -> management.RemotePeerConfig
+	37,  // 7: management.SyncResponse.NetworkMap:type_name -> management.NetworkMap
+	55,  // 8: management.SyncResponse.Checks:type_name -> management.Checks
+	94,  // 9: management.SyncResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	67,  // 10: management.SyncResponse.NetworkMapEnvelope:type_name -> management.NetworkMapEnvelope
+	22,  // 11: management.SyncMetaRequest.meta:type_name -> management.PeerSystemMeta
+	22,  // 12: management.LoginRequest.meta:type_name -> management.PeerSystemMeta
+	18,  // 13: management.LoginRequest.peerKeys:type_name -> management.PeerKeys
+	54,  // 14: management.PeerSystemMeta.networkAddresses:type_name -> management.NetworkAddress
+	19,  // 15: management.PeerSystemMeta.environment:type_name -> management.Environment
+	20,  // 16: management.PeerSystemMeta.files:type_name -> management.File
+	21,  // 17: management.PeerSystemMeta.flags:type_name -> management.Flags
+	1,   // 18: management.PeerSystemMeta.capabilities:type_name -> management.PeerCapability
+	57,  // 19: management.PeerSystemMeta.certificateProofs:type_name -> management.CertificateProof
+	28,  // 20: management.LoginResponse.netbirdConfig:type_name -> management.NetbirdConfig
+	35,  // 21: management.LoginResponse.peerConfig:type_name -> management.PeerConfig
+	55,  // 22: management.LoginResponse.Checks:type_name -> management.Checks
+	94,  // 23: management.LoginResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	22,  // 24: management.ExtendAuthSessionRequest.meta:type_name -> management.PeerSystemMeta
+	94,  // 25: management.ExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	94,  // 26: management.ServerKeyResponse.expiresAt:type_name -> google.protobuf.Timestamp
+	29,  // 27: management.NetbirdConfig.stuns:type_name -> management.HostConfig
+	34,  // 28: management.NetbirdConfig.turns:type_name -> management.ProtectedHostConfig
+	29,  // 29: management.NetbirdConfig.signal:type_name -> management.HostConfig
+	30,  // 30: management.NetbirdConfig.relay:type_name -> management.RelayConfig
+	31,  // 31: management.NetbirdConfig.flow:type_name -> management.FlowConfig
+	32,  // 32: management.NetbirdConfig.metrics:type_name -> management.MetricsConfig
+	7,   // 33: management.HostConfig.protocol:type_name -> management.HostConfig.Protocol
+	95,  // 34: management.FlowConfig.interval:type_name -> google.protobuf.Duration
+	29,  // 35: management.ProtectedHostConfig.hostConfig:type_name -> management.HostConfig
+	41,  // 36: management.PeerConfig.sshConfig:type_name -> management.SSHConfig
+	36,  // 37: management.PeerConfig.autoUpdate:type_name -> management.AutoUpdateSettings
+	35,  // 38: management.NetworkMap.peerConfig:type_name -> management.PeerConfig
+	40,  // 39: management.NetworkMap.remotePeers:type_name -> management.RemotePeerConfig
+	47,  // 40: management.NetworkMap.Routes:type_name -> management.Route
+	48,  // 41: management.NetworkMap.DNSConfig:type_name -> management.DNSConfig
+	40,  // 42: management.NetworkMap.offlinePeers:type_name -> management.RemotePeerConfig
+	53,  // 43: management.NetworkMap.FirewallRules:type_name -> management.FirewallRule
+	59,  // 44: management.NetworkMap.routesFirewallRules:type_name -> management.RouteFirewallRule
+	60,  // 45: management.NetworkMap.forwardingRules:type_name -> management.ForwardingRule
+	38,  // 46: management.NetworkMap.sshAuth:type_name -> management.SSHAuth
+	87,  // 47: management.SSHAuth.machine_users:type_name -> management.SSHAuth.MachineUsersEntry
+	41,  // 48: management.RemotePeerConfig.sshConfig:type_name -> management.SSHConfig
+	2,   // 49: management.RemotePeerConfig.lazyState:type_name -> management.LazyState
+	33,  // 50: management.SSHConfig.jwtConfig:type_name -> management.JWTConfig
+	8,   // 51: management.DeviceAuthorizationFlow.Provider:type_name -> management.DeviceAuthorizationFlow.provider
+	46,  // 52: management.DeviceAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
+	46,  // 53: management.PKCEAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
+	51,  // 54: management.DNSConfig.NameServerGroups:type_name -> management.NameServerGroup
+	49,  // 55: management.DNSConfig.CustomZones:type_name -> management.CustomZone
+	50,  // 56: management.CustomZone.Records:type_name -> management.SimpleRecord
+	52,  // 57: management.NameServerGroup.NameServers:type_name -> management.NameServer
+	4,   // 58: management.FirewallRule.Direction:type_name -> management.RuleDirection
+	5,   // 59: management.FirewallRule.Action:type_name -> management.RuleAction
+	3,   // 60: management.FirewallRule.Protocol:type_name -> management.RuleProtocol
+	58,  // 61: management.FirewallRule.PortInfo:type_name -> management.PortInfo
+	56,  // 62: management.Checks.certificateChallenge:type_name -> management.CertificateChallenge
+	88,  // 63: management.PortInfo.range:type_name -> management.PortInfo.Range
+	5,   // 64: management.RouteFirewallRule.action:type_name -> management.RuleAction
+	3,   // 65: management.RouteFirewallRule.protocol:type_name -> management.RuleProtocol
+	58,  // 66: management.RouteFirewallRule.portInfo:type_name -> management.PortInfo
+	3,   // 67: management.ForwardingRule.protocol:type_name -> management.RuleProtocol
+	58,  // 68: management.ForwardingRule.destinationPort:type_name -> management.PortInfo
+	58,  // 69: management.ForwardingRule.translatedPort:type_name -> management.PortInfo
+	6,   // 70: management.ExposeServiceRequest.protocol:type_name -> management.ExposeProtocol
+	68,  // 71: management.NetworkMapEnvelope.full:type_name -> management.NetworkMapComponentsFull
+	72,  // 72: management.NetworkMapEnvelope.delta:type_name -> management.NetworkMapComponentsDelta
+	35,  // 73: management.NetworkMapComponentsFull.peer_config:type_name -> management.PeerConfig
+	71,  // 74: management.NetworkMapComponentsFull.network:type_name -> management.AccountNetwork
+	70,  // 75: management.NetworkMapComponentsFull.account_settings:type_name -> management.AccountSettingsCompact
+	78,  // 76: management.NetworkMapComponentsFull.dns_settings:type_name -> management.DNSSettingsCompact
+	73,  // 77: management.NetworkMapComponentsFull.peers:type_name -> management.PeerCompact
+	74,  // 78: management.NetworkMapComponentsFull.policies:type_name -> management.PolicyCompact
+	77,  // 79: management.NetworkMapComponentsFull.groups:type_name -> management.GroupCompact
+	79,  // 80: management.NetworkMapComponentsFull.routes:type_name -> management.RouteRaw
+	80,  // 81: management.NetworkMapComponentsFull.nameserver_groups:type_name -> management.NameServerGroupRaw
+	50,  // 82: management.NetworkMapComponentsFull.all_dns_records:type_name -> management.SimpleRecord
+	49,  // 83: management.NetworkMapComponentsFull.account_zones:type_name -> management.CustomZone
+	81,  // 84: management.NetworkMapComponentsFull.network_resources:type_name -> management.NetworkResourceRaw
+	89,  // 85: management.NetworkMapComponentsFull.routers_map:type_name -> management.NetworkMapComponentsFull.RoutersMapEntry
+	90,  // 86: management.NetworkMapComponentsFull.resource_policies_map:type_name -> management.NetworkMapComponentsFull.ResourcePoliciesMapEntry
+	91,  // 87: management.NetworkMapComponentsFull.group_id_to_user_ids:type_name -> management.NetworkMapComponentsFull.GroupIdToUserIdsEntry
+	92,  // 88: management.NetworkMapComponentsFull.posture_failed_peers:type_name -> management.NetworkMapComponentsFull.PostureFailedPeersEntry
+	69,  // 89: management.NetworkMapComponentsFull.proxy_patch:type_name -> management.ProxyPatch
+	40,  // 90: management.ProxyPatch.peers:type_name -> management.RemotePeerConfig
+	40,  // 91: management.ProxyPatch.offline_peers:type_name -> management.RemotePeerConfig
+	53,  // 92: management.ProxyPatch.firewall_rules:type_name -> management.FirewallRule
+	47,  // 93: management.ProxyPatch.routes:type_name -> management.Route
+	59,  // 94: management.ProxyPatch.route_firewall_rules:type_name -> management.RouteFirewallRule
+	60,  // 95: management.ProxyPatch.forwarding_rules:type_name -> management.ForwardingRule
+	5,   // 96: management.PolicyCompact.action:type_name -> management.RuleAction
+	3,   // 97: management.PolicyCompact.protocol:type_name -> management.RuleProtocol
+	88,  // 98: management.PolicyCompact.port_ranges:type_name -> management.PortInfo.Range
+	93,  // 99: management.PolicyCompact.authorized_groups:type_name -> management.PolicyCompact.AuthorizedGroupsEntry
+	75,  // 100: management.PolicyCompact.source_resource:type_name -> management.ResourceCompact
+	75,  // 101: management.PolicyCompact.destination_resource:type_name -> management.ResourceCompact
+	75,  // 102: management.GroupCompact.resources:type_name -> management.ResourceCompact
+	52,  // 103: management.NameServerGroupRaw.nameservers:type_name -> management.NameServer
+	83,  // 104: management.NetworkRouterList.entries:type_name -> management.NetworkRouterEntry
+	39,  // 105: management.SSHAuth.MachineUsersEntry.value:type_name -> management.MachineUserIndexes
+	82,  // 106: management.NetworkMapComponentsFull.RoutersMapEntry.value:type_name -> management.NetworkRouterList
+	84,  // 107: management.NetworkMapComponentsFull.ResourcePoliciesMapEntry.value:type_name -> management.PolicyIds
+	85,  // 108: management.NetworkMapComponentsFull.GroupIdToUserIdsEntry.value:type_name -> management.UserIDList
+	86,  // 109: management.NetworkMapComponentsFull.PostureFailedPeersEntry.value:type_name -> management.PeerIndexSet
+	76,  // 110: management.PolicyCompact.AuthorizedGroupsEntry.value:type_name -> management.UserNameList
+	9,   // 111: management.ManagementService.Login:input_type -> management.EncryptedMessage
+	9,   // 112: management.ManagementService.Sync:input_type -> management.EncryptedMessage
+	27,  // 113: management.ManagementService.GetServerKey:input_type -> management.Empty
+	27,  // 114: management.ManagementService.isHealthy:input_type -> management.Empty
+	9,   // 115: management.ManagementService.GetDeviceAuthorizationFlow:input_type -> management.EncryptedMessage
+	9,   // 116: management.ManagementService.GetPKCEAuthorizationFlow:input_type -> management.EncryptedMessage
+	9,   // 117: management.ManagementService.SyncMeta:input_type -> management.EncryptedMessage
+	9,   // 118: management.ManagementService.Logout:input_type -> management.EncryptedMessage
+	9,   // 119: management.ManagementService.Job:input_type -> management.EncryptedMessage
+	9,   // 120: management.ManagementService.ExtendAuthSession:input_type -> management.EncryptedMessage
+	9,   // 121: management.ManagementService.CreateExpose:input_type -> management.EncryptedMessage
+	9,   // 122: management.ManagementService.RenewExpose:input_type -> management.EncryptedMessage
+	9,   // 123: management.ManagementService.StopExpose:input_type -> management.EncryptedMessage
+	9,   // 124: management.ManagementService.Login:output_type -> management.EncryptedMessage
+	9,   // 125: management.ManagementService.Sync:output_type -> management.EncryptedMessage
+	26,  // 126: management.ManagementService.GetServerKey:output_type -> management.ServerKeyResponse
+	27,  // 127: management.ManagementService.isHealthy:output_type -> management.Empty
+	9,   // 128: management.ManagementService.GetDeviceAuthorizationFlow:output_type -> management.EncryptedMessage
+	9,   // 129: management.ManagementService.GetPKCEAuthorizationFlow:output_type -> management.EncryptedMessage
+	27,  // 130: management.ManagementService.SyncMeta:output_type -> management.Empty
+	27,  // 131: management.ManagementService.Logout:output_type -> management.Empty
+	9,   // 132: management.ManagementService.Job:output_type -> management.EncryptedMessage
+	9,   // 133: management.ManagementService.ExtendAuthSession:output_type -> management.EncryptedMessage
+	9,   // 134: management.ManagementService.CreateExpose:output_type -> management.EncryptedMessage
+	9,   // 135: management.ManagementService.RenewExpose:output_type -> management.EncryptedMessage
+	9,   // 136: management.ManagementService.StopExpose:output_type -> management.EncryptedMessage
+	124, // [124:137] is the sub-list for method output_type
+	111, // [111:124] is the sub-list for method input_type
+	111, // [111:111] is the sub-list for extension type_name
+	111, // [111:111] is the sub-list for extension extendee
+	0,   // [0:111] is the sub-list for field type_name
 }
 
 func init() { file_management_proto_init() }
@@ -6240,7 +9001,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PortInfo); i {
+			switch v := v.(*CertificateChallenge); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6252,7 +9013,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RouteFirewallRule); i {
+			switch v := v.(*CertificateProof); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6264,7 +9025,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ForwardingRule); i {
+			switch v := v.(*PortInfo); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6276,7 +9037,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ExposeServiceRequest); i {
+			switch v := v.(*RouteFirewallRule); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6288,7 +9049,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ExposeServiceResponse); i {
+			switch v := v.(*ForwardingRule); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6300,7 +9061,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RenewExposeRequest); i {
+			switch v := v.(*ExposeServiceRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6312,7 +9073,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[53].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RenewExposeResponse); i {
+			switch v := v.(*ExposeServiceResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6324,7 +9085,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[54].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StopExposeRequest); i {
+			switch v := v.(*RenewExposeRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6336,7 +9097,19 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[55].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StopExposeResponse); i {
+			switch v := v.(*RenewExposeResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[56].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StopExposeRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6348,6 +9121,258 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[57].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StopExposeResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[58].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NetworkMapEnvelope); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[59].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NetworkMapComponentsFull); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[60].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ProxyPatch); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[61].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccountSettingsCompact); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[62].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccountNetwork); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[63].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NetworkMapComponentsDelta); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[64].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PeerCompact); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[65].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PolicyCompact); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[66].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResourceCompact); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[67].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UserNameList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[68].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GroupCompact); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[69].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DNSSettingsCompact); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[70].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RouteRaw); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[71].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NameServerGroupRaw); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[72].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NetworkResourceRaw); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[73].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NetworkRouterList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[74].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NetworkRouterEntry); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[75].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PolicyIds); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[76].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UserIDList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[77].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PeerIndexSet); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[79].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PortInfo_Range); i {
 			case 0:
 				return &v.state
@@ -6366,17 +9391,21 @@ func file_management_proto_init() {
 	file_management_proto_msgTypes[2].OneofWrappers = []interface{}{
 		(*JobResponse_Bundle)(nil),
 	}
-	file_management_proto_msgTypes[47].OneofWrappers = []interface{}{
+	file_management_proto_msgTypes[49].OneofWrappers = []interface{}{
 		(*PortInfo_Port)(nil),
 		(*PortInfo_Range_)(nil),
 	}
+	file_management_proto_msgTypes[58].OneofWrappers = []interface{}{
+		(*NetworkMapEnvelope_Full)(nil),
+		(*NetworkMapEnvelope_Delta)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_management_proto_rawDesc,
-			NumEnums:      8,
-			NumMessages:   58,
+			NumEnums:      9,
+			NumMessages:   85,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/shared/management/proto/management.proto b/shared/management/proto/management.proto
index 6b41a78d0..22c53d4e2 100644
--- a/shared/management/proto/management.proto
+++ b/shared/management/proto/management.proto
@@ -110,6 +110,13 @@ message BundleParameters {
   int64  bundle_for_time  = 2;
   int32  log_file_count   = 3;
   bool   anonymize        = 4;
+  // anonymize_level selects how much the anonymizer redacts: "default"
+  // (or empty) keeps internal IP ranges, "strict" also anonymizes them.
+  // Unknown values are treated as "strict".
+  string anonymize_level  = 5;
+  // upload_url is the service URL the client requests an upload URL from
+  // before uploading the bundle. Empty selects the default upload server.
+  string upload_url       = 6;
 }
 
 message BundleResult {
@@ -150,6 +157,14 @@ message SyncResponse {
   //                              SSO-registered; client clears its anchor
   //   set, valid timestamp     → new absolute UTC deadline
   google.protobuf.Timestamp sessionExpiresAt = 7;
+
+  // NetworkMapEnvelope carries the component-based wire format for peers that
+  // advertise PeerCapabilityComponentNetworkMap. When set, NetworkMap (field 5)
+  // is left empty: management ships components and the client runs Calculate()
+  // locally instead of receiving an expanded NetworkMap.
+  NetworkMapEnvelope NetworkMapEnvelope = 8;
+
+  int32 Version = 9;
 }
 
 message  SyncMetaRequest {
@@ -219,6 +234,11 @@ message Flags {
   bool disableSSHAuth = 15;
 
   bool disableIPv6 = 16;
+
+  // remoteJobsAllowed mirrors the peer's local opt-in for management-requested
+  // remote jobs (e.g. debug bundles). Reported so the dashboard can surface
+  // peers that have opted out.
+  bool remoteJobsAllowed = 17;
 }
 
 // PeerCapability represents a feature the client binary supports.
@@ -229,6 +249,8 @@ enum PeerCapability {
   PeerCapabilitySourcePrefixes = 1;
   // Client handles IPv6 overlay addresses and firewall rules.
   PeerCapabilityIPv6Overlay = 2;
+  // Client receives NetworkMap as components and assembles it locally.
+  PeerCapabilityComponentNetworkMap = 3;
 }
 
 // PeerSystemMeta is machine meta data like OS and version.
@@ -252,6 +274,8 @@ message PeerSystemMeta {
   Flags flags = 17;
 
   repeated PeerCapability capabilities = 18;
+  int32 syncMessageVersion = 19;
+  repeated CertificateProof certificateProofs = 20;
 }
 
 message LoginResponse {
@@ -448,7 +472,8 @@ message NetworkMap {
   // RoutesFirewallRulesIsEmpty indicates whether RouteFirewallRule array is empty or not to bypass protobuf null and empty array equality.
   bool routesFirewallRulesIsEmpty = 11;
 
-  repeated ForwardingRule forwardingRules = 12;
+  // Unused; the ingress port-forwarding feature was discontinued.
+  repeated ForwardingRule forwardingRules = 12 [deprecated = true];
 
   // SSHAuth represents SSH authorization configuration
   SSHAuth sshAuth = 13;
@@ -486,6 +511,22 @@ message RemotePeerConfig {
   string fqdn = 4;
 
   string agentVersion = 5;
+
+  // lazyState is the management per-peer override for lazy (on-demand)
+  // connections to this remote peer. LazyStateDefault follows the account-wide
+  // flag; LazyStateLazy forces lazy; LazyStateEager forces an always-active
+  // connection. A local NB_LAZY_CONN/MDM override still wins over this.
+  LazyState lazyState = 6;
+}
+
+// LazyState is the management per-peer override for lazy connections.
+enum LazyState {
+  // Follow the account-wide lazy connection flag.
+  LazyStateDefault = 0;
+  // Force a lazy (on-demand) connection regardless of the account flag.
+  LazyStateLazy = 1;
+  // Force an always-active connection regardless of the account flag.
+  LazyStateEager = 2;
 }
 
 // SSHConfig represents SSH configurations of a peer.
@@ -515,8 +556,18 @@ message DeviceAuthorizationFlow {
   }
 }
 
-// PKCEAuthorizationFlowRequest empty struct for future expansion
-message PKCEAuthorizationFlowRequest {}
+// PKCEAuthorizationFlowRequest asks for the PKCE flow configuration to use for
+// an upcoming authorization request.
+message PKCEAuthorizationFlowRequest {
+  // SessionExtend indicates the flow will renew the SSO session of a peer that
+  // is already registered, rather than log in or register one. An extend is
+  // bound to the account that peer belongs to, so the server must not answer it
+  // with a configuration that lets the IdP reply from whatever session is
+  // already active: with several accounts signed in at the IdP that need not be
+  // the peer's own, and the resulting token is rejected as a peer/user mismatch
+  // with no way for the user to correct it.
+  bool SessionExtend = 1;
+}
 
 // PKCEAuthorizationFlow represents Authorization Code Flow information
 // that can be used by the client to login initiate a Oauth 2.0 authorization code grant flow
@@ -617,6 +668,13 @@ enum RuleProtocol {
   UDP = 3;
   ICMP = 4;
   CUSTOM = 5;
+  // NETBIRD_SSH (types.PolicyRuleProtocolType "netbird-ssh") is the marker
+  // policy rule that drives SSH-server activation in Calculate(). The legacy
+  // proto.FirewallRule path doesn't ship this value (Calculate already
+  // expands SSH rules into TCP/22 before encoding), but the components path
+  // ships RAW policies — the client must see this protocol to derive
+  // AuthorizedUsers locally.
+  NETBIRD_SSH = 6;
 }
 
 enum RuleDirection {
@@ -658,6 +716,24 @@ message NetworkAddress {
 
 message Checks {
   repeated string Files = 1;
+  // certificateChallenge asks the peer to prove possession of a certificate chaining to caCertificates.
+  CertificateChallenge certificateChallenge = 2;
+}
+
+message CertificateChallenge {
+  // nonce is issued by management, bound to the peer and a time window; the peer signs it.
+  bytes nonce = 1;
+  // caCertificates are PEM encoded trust anchors the presented certificate must chain to.
+  repeated string caCertificates = 2;
+}
+
+// CertificateProof demonstrates possession of the private key of chain[0] by signing the challenge nonce.
+message CertificateProof {
+  bytes nonce = 1;
+  // chain is DER encoded, leaf first.
+  repeated bytes chain = 2;
+  string sigAlg = 3;
+  bytes signature = 4;
 }
 
 
@@ -706,17 +782,13 @@ message RouteFirewallRule {
   string RouteID = 10;
 }
 
+// ForwardingRule is unused; the ingress port-forwarding feature was discontinued.
 message ForwardingRule {
-  // Protocol of the forwarding rule
+  option deprecated = true;
+
   RuleProtocol protocol = 1;
-
-  // portInfo is the ingress destination port information, where the traffic arrives in the gateway node
   PortInfo destinationPort = 2;
-
-  // IP address of the translated address (remote peer) to send traffic to
   bytes translatedAddress = 3;
-
-  // Translated port information, where the traffic should be forwarded to
   PortInfo translatedPort = 4;
 }
 
@@ -757,3 +829,435 @@ message StopExposeRequest {
 }
 
 message StopExposeResponse {}
+
+// =====================================================================
+// Component-based NetworkMap wire format (PeerCapabilityComponentNetworkMap).
+//
+// Peers that advertise this capability receive NetworkMap building blocks
+// (peers + groups + policies + routes + dns + ssh) and run the
+// expansion (Calculate) locally instead of receiving a fully-expanded
+// NetworkMap from the server.
+// =====================================================================
+
+// NetworkMapEnvelope wraps either a full snapshot or a delta. Only Full is
+// emitted today; Delta is reserved for the incremental-update work.
+message NetworkMapEnvelope {
+  oneof payload {
+    NetworkMapComponentsFull full = 1;
+    NetworkMapComponentsDelta delta = 2;
+  }
+}
+
+// NetworkMapComponentsFull is the full per-peer component snapshot. The
+// client decodes it into a types.NetworkMapComponents and runs Calculate()
+// locally to produce the same NetworkMap the legacy server path would have
+// produced. Every field carries RAW component data — no server-side
+// expansion (firewall rules, DNS config, SSH auth, route firewall rules)
+// is shipped; the client computes those itself.
+message NetworkMapComponentsFull {
+  uint64 serial = 1;
+
+  // Peer config for the receiving peer (legacy proto.PeerConfig kept as-is —
+  // it carries the receiving peer's own overlay address, FQDN, SSH config).
+  PeerConfig peer_config = 2;
+
+  // Account-level network metadata (id, IPv4/IPv6 overlay subnets, DNS,
+  // serial). Mirrors types.Network.
+  AccountNetwork network = 3;
+
+  // Account-level settings the client needs for its local Calculate().
+  AccountSettingsCompact account_settings = 4;
+
+  // Account DNS settings (mirrors types.DNSSettings).
+  DNSSettingsCompact dns_settings = 5;
+
+  // Domain shared across all peers in this account, e.g. "netbird.cloud".
+  // Each peer's FQDN is dns_label + "." + dns_domain.
+  string dns_domain = 6;
+
+  // Custom-zone domain for this peer's view (c.CustomZoneDomain). Empty when
+  // the peer has no custom zone records.
+  string custom_zone_domain = 7;
+
+  // Deduplicated agent versions; PeerCompact.agent_version_idx indexes here.
+  // Empty string at index 0 if any peer has no version.
+  repeated string agent_versions = 8;
+
+  // All peers (deduplicated). The client splits peers into online / offline
+  // locally using account_settings.peer_login_expiration on receive.
+  repeated PeerCompact peers = 9;
+
+  // Indexes into peers for the subset that may act as routers.
+  repeated uint32 router_peer_indexes = 10;
+
+  // Policies that affect the receiving peer.
+  repeated PolicyCompact policies = 11;
+
+  // Groups in unspecified order — clients key off id (public_id).
+  repeated GroupCompact groups = 12;
+
+  // Routes relevant to this peer, raw shape (mirrors []*route.Route).
+  repeated RouteRaw routes = 13;
+
+  // Nameserver groups (mirrors []*nbdns.NameServerGroup).
+  repeated NameServerGroupRaw nameserver_groups = 14;
+
+  // All DNS records the client needs to assemble its custom zone. Reuses
+  // the existing SimpleRecord wire shape.
+  repeated SimpleRecord all_dns_records = 15;
+
+  // Custom zones (typically the peer's own zone). Reuses the existing
+  // CustomZone wire shape.
+  repeated CustomZone account_zones = 16;
+
+  // Network resources (mirrors []*resourceTypes.NetworkResource).
+  repeated NetworkResourceRaw network_resources = 17;
+
+  // Routers per network. Outer key: network public_id. Each entry is
+  // the set of routers backing that network for this peer's view.
+  map<string, NetworkRouterList> routers_map = 18;
+
+  // For each NetworkResource public_id, the indexes into policies[]
+  // that apply to it.
+  map<string, PolicyIds> resource_policies_map = 19;
+
+  // Group-id (public_id) → user ids authorized for SSH on members.
+  map<string, UserIDList> group_id_to_user_ids = 20;
+
+  // Account-level allowed user ids (used by Calculate() when assembling SSH
+  // authorized users for the receiving peer).
+  repeated string allowed_user_ids = 21;
+
+  // Per posture-check public_id, the set of peer indexes that failed
+  // the check. Server-side evaluation result; clients do not re-evaluate.
+  map<string, PeerIndexSet> posture_failed_peers = 22;
+
+  // Account-level DNS forwarder port (mirrors the legacy
+  // proto.DNSConfig.ForwarderPort). Computed by the controller from peer
+  // versions; clients fold it into their Calculate() DNS output.
+  int64 dns_forwarder_port = 23;
+
+  // Unused; the ingress port-forwarding feature was discontinued.
+  ProxyPatch proxy_patch = 24 [deprecated = true];
+
+  // SSH UserIDClaim — server-side HttpServerConfig.AuthUserIDClaim, or
+  // "sub" by default. Populated in proto.SSHAuth.UserIDClaim when the
+  // client rebuilds the NetworkMap from this envelope. Empty when the
+  // account has no AuthorizedUsers (and thus no SshAuth to populate).
+  string user_id_claim = 25;
+
+  // Reserved for future component additions (incremental_serial, parent_seq,
+  // etc.) without forcing a renumber.
+  reserved 26 to 50;
+}
+
+// ProxyPatch is unused; the ingress port-forwarding feature was discontinued.
+message ProxyPatch {
+  option deprecated = true;
+
+  repeated RemotePeerConfig peers = 1;
+  repeated RemotePeerConfig offline_peers = 2;
+  repeated FirewallRule firewall_rules = 3;
+  repeated Route routes = 4;
+  repeated RouteFirewallRule route_firewall_rules = 5;
+  repeated ForwardingRule forwarding_rules = 6;
+}
+
+// AccountSettingsCompact carries the account-level settings the client needs
+// to evaluate locally. Mirrors the subset of types.AccountSettingsInfo that
+// Calculate() actually reads — login-expiration (used to filter expired
+// peers). Inactivity expiration is purely server-side bookkeeping and is not
+// shipped.
+message AccountSettingsCompact {
+  bool peer_login_expiration_enabled = 1;
+  // Login expiration window. Unit is nanoseconds (matches time.Duration).
+  int64 peer_login_expiration_ns = 2;
+}
+
+// AccountNetwork is the account-level overlay metadata. Mirrors types.Network
+// so the client can populate NetworkMap.Network without a server round-trip.
+message AccountNetwork {
+  string identifier = 1;
+  // IPv4 overlay subnet in CIDR form (e.g. "100.64.0.0/16").
+  string net_cidr = 2;
+  // IPv6 ULA overlay subnet in CIDR form (e.g. "fd00:4e42::/64"). Empty when
+  // the account has no IPv6 overlay yet.
+  string net_v6_cidr = 3;
+  string dns = 4;
+  uint64 serial = 5;
+}
+
+// NetworkMapComponentsDelta is reserved for the incremental update
+// protocol. Field numbers 1–100 are pre-allocated to keep room for the
+// planned event types without needing a renumber.
+message NetworkMapComponentsDelta {
+  reserved 1 to 100;
+}
+
+// PeerCompact is the wire-shape of a remote peer used by the component
+// format. It carries every field of types.Peer that the client's local
+// Calculate() reads — including the trio needed to evaluate
+// LoginExpired() (added_with_sso_login + login_expiration_enabled +
+// last_login_unix_nano). Fields the client does not consume (Status,
+// CreatedAt, etc.) are not shipped.
+message PeerCompact {
+  // Raw 32-byte WireGuard public key (no base64 wrapping).
+  bytes wg_pub_key = 1;
+
+  // Raw 4-byte IPv4 overlay address. Always a /32 host route, so no prefix
+  // byte is needed.
+  bytes ip = 2;
+
+  // Raw 16-byte IPv6 overlay address; always a /128 host route. Empty when
+  // the peer has no IPv6 overlay address.
+  bytes ipv6 = 3;
+
+  // Raw SSH public key bytes (or empty).
+  bytes ssh_pub_key = 4;
+
+  // DNS label without the account's domain suffix. Full FQDN is
+  // dns_label + "." + NetworkMapComponentsFull.dns_domain.
+  string dns_label = 5;
+
+  string agent_version = 6;
+
+  // True iff the peer was added via SSO login (i.e., types.Peer.UserID is
+  // non-empty). Combined with login_expiration_enabled and
+  // last_login_unix_nano this lets the client reproduce
+  // (*Peer).LoginExpired() locally.
+  bool added_with_sso_login = 7;
+
+  // True when the peer's login can expire — mirrors
+  // types.Peer.LoginExpirationEnabled.
+  bool login_expiration_enabled = 8;
+
+  // Unix-nanosecond timestamp of the peer's last login. 0 when the peer has
+  // never logged in (server stores nil; client treats 0 as "epoch", which
+  // makes a fresh peer immediately expired iff login_expiration_enabled is
+  // true — the same semantics as types.Peer.GetLastLogin).
+  int64 last_login_unix_nano = 9;
+
+  // True when the peer has an SSH server enabled locally. Used by the
+  // legacy SSH path in Calculate() (`policyRuleImpliesLegacySSH`): a rule
+  // with protocol ALL/TCP-with-SSH-ports activates SSH for the receiving
+  // peer when this bit is set, even without an explicit NetbirdSSH rule.
+  bool ssh_enabled = 10;
+
+  // Mirror of types.Peer.SupportsIPv6() — !Meta.Flags.DisableIPv6 &&
+  // HasCapability(PeerCapabilityIPv6Overlay). Used by the local peer's
+  // Calculate() when deciding whether to emit IPv6 firewall rules
+  // (appendIPv6FirewallRule) against this peer's IPv6 address.
+  bool supports_ipv6 = 11;
+
+  // Mirror of types.Peer.SupportsSourcePrefixes() —
+  // HasCapability(PeerCapabilitySourcePrefixes). Determines whether the
+  // local peer's Calculate() emits SourcePrefixes alongside legacy PeerIP
+  // fields in proto.FirewallRule.
+  bool supports_source_prefixes = 12;
+
+  // Mirror of types.Peer.Meta.Flags.ServerSSHAllowed. Read by Calculate()
+  // when expanding TCP port-22 firewall rules — the native SSH companion
+  // (port 22022) is only added when this flag is set and the peer agent
+  // version supports it.
+  bool server_ssh_allowed = 13;
+
+  // Mirror of types.Peer.ProxyMeta.Embedded. Connections involving an
+  // ephemeral proxy peer on either endpoint default to lazy, so this bit
+  // feeds the per-peer lazyState emitted in RemotePeerConfig.
+  bool proxy_embedded = 14;
+}
+
+// PolicyCompact is the compact form of a policy rule. Group references use
+// the public_ids; the client resolves
+// them against NetworkMapComponentsFull.groups. Direction is derived per-peer
+// on the client (ingress when the peer is in destination_group_ids, egress
+// when in source_group_ids; both when bidirectional).
+message PolicyCompact {
+  // public_id. Used as a stable reference for
+  // ResourcePoliciesMap.indexes and future delta updates.
+  string id = 1;
+
+  RuleAction action = 2;
+  RuleProtocol protocol = 3;
+  bool bidirectional = 4;
+
+  // Single ports referenced by the rule.
+  repeated uint32 ports = 5;
+
+  // Port ranges (start..end) referenced by the rule.
+  repeated PortInfo.Range port_ranges = 6;
+
+  // Group ids (public_ids) of source / destination groups.
+  repeated string source_group_ids = 7;
+  repeated string destination_group_ids = 8;
+
+  // SSH authorization fields. PolicyRule.AuthorizedGroups maps the rule's
+  // applicable group ids (public_ids) to a list of local-user names —
+  // when a peer in one of those groups is the SSH destination, the named
+  // local users gain access. AuthorizedUser is the single-user form
+  // (legacy: rule scopes SSH to one specific user id).
+  //
+  // Both fields are only consumed by Calculate() when the rule's protocol
+  // is NetbirdSSH (or the legacy implicit-SSH heuristic).
+  map<string, UserNameList> authorized_groups = 9;
+  string authorized_user = 10;
+
+  // Resource-typed rule sources/destinations. When a rule targets a specific
+  // peer (rather than groups), Calculate() reads SourceResource /
+  // DestinationResource — without these the rule's connection resources
+  // can't be produced on the client. ResourceCompact's peer_index refers to
+  // NetworkMapComponentsFull.peers; type is the raw ResourceType string
+  // ("peer", "host", "subnet", "domain"). Only "peer" is meaningful for
+  // Calculate's resource-typed rule path today.
+  ResourceCompact source_resource = 11;
+  ResourceCompact destination_resource = 12;
+
+  // Posture-check ids gating this policy's source peers. Calculate()
+  // reads them when filtering rule peers (peers that fail any listed check
+  // are dropped from sourcePeers). Match keys in
+  // NetworkMapComponentsFull.posture_failed_peers.
+  repeated string source_posture_check_ids = 13;
+}
+
+// ResourceCompact mirrors types.Resource. Used by PolicyCompact to carry
+// rule.SourceResource / rule.DestinationResource when the rule targets a
+// specific resource (typically a peer) rather than groups.
+message ResourceCompact {
+  string type = 1;
+  bool peer_index_set = 2;
+  uint32 peer_index = 3;
+  reserved 4;
+  string id = 5; // public id for domain/host/subnet resources
+}
+
+// UserNameList is a list of local-user names — used as the value type in
+// PolicyCompact.authorized_groups.
+message UserNameList {
+  repeated string names = 1;
+}
+
+// GroupCompact is the wire-shape of a group: public id, optional
+// name, and indexes into NetworkMapComponentsFull.peers identifying members.
+message GroupCompact {
+  // id comes from PublicID. Used by PolicyCompact.source_group_ids / destination_group_ids.
+  string id = 1;
+
+  // Indexes into NetworkMapComponentsFull.peers.
+  repeated uint32 peer_indexes = 2;
+
+  // True when the group is named "All" (types.Group.IsGroupAll). The
+  // client-side Calculate short-circuits group→peer expansion on such
+  // groups exactly like the server does; without this bit the decoded
+  // groups lose that property and the two sides expand policy
+  // destinations differently.
+  bool is_all = 3;
+
+  repeated ResourceCompact resources = 4;
+}
+
+// DNSSettingsCompact mirrors types.DNSSettings.
+message DNSSettingsCompact {
+  // Group ids (public_id) whose DNS management is disabled.
+  repeated string disabled_management_group_ids = 1;
+}
+
+// RouteRaw mirrors *route.Route (the domain type), trimmed to fields that
+// types.NetworkMapComponents.Calculate() reads. Group references are
+// public_ids; the routing peer (when set) is referenced by index into
+// NetworkMapComponentsFull.peers.
+message RouteRaw {
+  string id = 1; // public_id
+  string net_id = 2;
+  string description = 3;
+
+  // Either network_cidr (e.g. "10.0.0.0/16") or domains is set, not both.
+  string network_cidr = 4;
+  repeated string domains = 5;
+  bool keep_route = 6;
+
+  // Routing peer reference: peer_index_set tells whether peer_index is valid
+  // (proto3 uint32 cannot disambiguate "0" from "unset"). Mutually exclusive
+  // with peer_group_ids.
+  //
+  // peer_index decodes back to types.Peer.ID (the peer's xid string), NOT
+  // to its WireGuard public key. This matches the server-side data flow:
+  // c.Routes carry route.Peer = peer.ID, and getRoutingPeerRoutes mutates
+  // it to peer.Key only after the route has been admitted to the network
+  // map. Decoders MUST set Route.Peer = peer.ID; the legacy Calculate()
+  // path will substitute the WG key downstream.
+  bool peer_index_set = 7;
+  uint32 peer_index = 8;
+  repeated string peer_group_ids = 9;
+
+  int32 network_type = 10;
+  bool masquerade = 11;
+  int32 metric = 12;
+  bool enabled = 13;
+  repeated string group_ids = 14;
+  repeated string access_control_group_ids = 15;
+  bool skip_auto_apply = 16;
+}
+
+// NameServerGroupRaw mirrors *nbdns.NameServerGroup. Distinct from the
+// legacy NameServerGroup (which is the wire-trimmed shape consumed by
+// proto.DNSConfig and lacks the Name/Description/Groups/Enabled fields).
+message NameServerGroupRaw {
+  string id = 1;
+  // Reuses the legacy NameServer wire shape (IP as string).
+  repeated NameServer nameservers = 2;
+  // Group ids the NSG distributes nameservers to.
+  repeated string group_ids = 3;
+  bool primary = 4;
+  repeated string domains = 5;
+  bool enabled = 6;
+  bool search_domains_enabled = 7;
+}
+
+// NetworkResourceRaw mirrors *resourceTypes.NetworkResource.
+//
+message NetworkResourceRaw {
+  string id = 1;
+  string network_seq = 2;
+  string name = 3;
+  string description = 4;
+  // Resource type: "host" / "subnet" / "domain".
+  string type = 5;
+  string address = 6;
+  string domain_value = 7;  // resource.Domain
+  string prefix_cidr = 8;
+  bool enabled = 9;
+}
+
+// NetworkRouterList carries the routers backing one network.
+message NetworkRouterList {
+  // Routers in this network, keyed by peer_index (the routing peer).
+  repeated NetworkRouterEntry entries = 1;
+}
+
+// NetworkRouterEntry mirrors a single *routerTypes.NetworkRouter; the routing
+// peer is referenced by index into NetworkMapComponentsFull.peers.
+message NetworkRouterEntry {
+  string id = 1;
+  uint32 peer_index = 2;
+  bool peer_index_set = 3;
+  repeated string peer_group_ids = 4;
+  bool masquerade = 5;
+  int32 metric = 6;
+  bool enabled = 7;
+}
+
+message PolicyIds {
+  repeated string ids = 1;
+}
+
+// UserIDList is a list of user ids — used as the value type in
+// NetworkMapComponentsFull.group_id_to_user_ids.
+message UserIDList {
+  repeated string user_ids = 1;
+}
+
+// PeerIndexSet is a set of peer indexes — used as the value type in
+// NetworkMapComponentsFull.posture_failed_peers.
+message PeerIndexSet {
+  repeated uint32 peer_indexes = 1;
+}
diff --git a/shared/management/proto/proxy_service.pb.go b/shared/management/proto/proxy_service.pb.go
index df42d78ff..fe5cc0125 100644
--- a/shared/management/proto/proxy_service.pb.go
+++ b/shared/management/proto/proxy_service.pb.go
@@ -117,6 +117,55 @@ func (PathRewriteMode) EnumDescriptor() ([]byte, []int) {
 	return file_proxy_service_proto_rawDescGZIP(), []int{1}
 }
 
+type TargetAccessAction int32
+
+const (
+	TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT TargetAccessAction = 0
+	TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS  TargetAccessAction = 1
+	TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK   TargetAccessAction = 2
+)
+
+// Enum value maps for TargetAccessAction.
+var (
+	TargetAccessAction_name = map[int32]string{
+		0: "TARGET_ACCESS_ACTION_INHERIT",
+		1: "TARGET_ACCESS_ACTION_BYPASS",
+		2: "TARGET_ACCESS_ACTION_BLOCK",
+	}
+	TargetAccessAction_value = map[string]int32{
+		"TARGET_ACCESS_ACTION_INHERIT": 0,
+		"TARGET_ACCESS_ACTION_BYPASS":  1,
+		"TARGET_ACCESS_ACTION_BLOCK":   2,
+	}
+)
+
+func (x TargetAccessAction) Enum() *TargetAccessAction {
+	p := new(TargetAccessAction)
+	*p = x
+	return p
+}
+
+func (x TargetAccessAction) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (TargetAccessAction) Descriptor() protoreflect.EnumDescriptor {
+	return file_proxy_service_proto_enumTypes[2].Descriptor()
+}
+
+func (TargetAccessAction) Type() protoreflect.EnumType {
+	return &file_proxy_service_proto_enumTypes[2]
+}
+
+func (x TargetAccessAction) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use TargetAccessAction.Descriptor instead.
+func (TargetAccessAction) EnumDescriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{2}
+}
+
 // MiddlewareSlot identifies where in the request lifecycle a middleware
 // runs. Mirrors proxy/internal/middleware.Slot.
 type MiddlewareSlot int32
@@ -155,11 +204,11 @@ func (x MiddlewareSlot) String() string {
 }
 
 func (MiddlewareSlot) Descriptor() protoreflect.EnumDescriptor {
-	return file_proxy_service_proto_enumTypes[2].Descriptor()
+	return file_proxy_service_proto_enumTypes[3].Descriptor()
 }
 
 func (MiddlewareSlot) Type() protoreflect.EnumType {
-	return &file_proxy_service_proto_enumTypes[2]
+	return &file_proxy_service_proto_enumTypes[3]
 }
 
 func (x MiddlewareSlot) Number() protoreflect.EnumNumber {
@@ -168,7 +217,7 @@ func (x MiddlewareSlot) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use MiddlewareSlot.Descriptor instead.
 func (MiddlewareSlot) EnumDescriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{2}
+	return file_proxy_service_proto_rawDescGZIP(), []int{3}
 }
 
 type ProxyStatus int32
@@ -213,11 +262,11 @@ func (x ProxyStatus) String() string {
 }
 
 func (ProxyStatus) Descriptor() protoreflect.EnumDescriptor {
-	return file_proxy_service_proto_enumTypes[3].Descriptor()
+	return file_proxy_service_proto_enumTypes[4].Descriptor()
 }
 
 func (ProxyStatus) Type() protoreflect.EnumType {
-	return &file_proxy_service_proto_enumTypes[3]
+	return &file_proxy_service_proto_enumTypes[4]
 }
 
 func (x ProxyStatus) Number() protoreflect.EnumNumber {
@@ -226,7 +275,7 @@ func (x ProxyStatus) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ProxyStatus.Descriptor instead.
 func (ProxyStatus) EnumDescriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{3}
+	return file_proxy_service_proto_rawDescGZIP(), []int{4}
 }
 
 type MiddlewareConfig_FailMode int32
@@ -259,11 +308,11 @@ func (x MiddlewareConfig_FailMode) String() string {
 }
 
 func (MiddlewareConfig_FailMode) Descriptor() protoreflect.EnumDescriptor {
-	return file_proxy_service_proto_enumTypes[4].Descriptor()
+	return file_proxy_service_proto_enumTypes[5].Descriptor()
 }
 
 func (MiddlewareConfig_FailMode) Type() protoreflect.EnumType {
-	return &file_proxy_service_proto_enumTypes[4]
+	return &file_proxy_service_proto_enumTypes[5]
 }
 
 func (x MiddlewareConfig_FailMode) Number() protoreflect.EnumNumber {
@@ -777,9 +826,10 @@ type PathMapping struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Path    string             `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
-	Target  string             `protobuf:"bytes,2,opt,name=target,proto3" json:"target,omitempty"`
-	Options *PathTargetOptions `protobuf:"bytes,3,opt,name=options,proto3" json:"options,omitempty"`
+	Path         string             `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
+	Target       string             `protobuf:"bytes,2,opt,name=target,proto3" json:"target,omitempty"`
+	Options      *PathTargetOptions `protobuf:"bytes,3,opt,name=options,proto3" json:"options,omitempty"`
+	AccessAction TargetAccessAction `protobuf:"varint,4,opt,name=access_action,json=accessAction,proto3,enum=management.TargetAccessAction" json:"access_action,omitempty"`
 }
 
 func (x *PathMapping) Reset() {
@@ -835,6 +885,13 @@ func (x *PathMapping) GetOptions() *PathTargetOptions {
 	return nil
 }
 
+func (x *PathMapping) GetAccessAction() TargetAccessAction {
+	if x != nil {
+		return x.AccessAction
+	}
+	return TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT
+}
+
 type HeaderAuth struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -903,6 +960,12 @@ type Authentication struct {
 	Pin                  bool          `protobuf:"varint,4,opt,name=pin,proto3" json:"pin,omitempty"`
 	Oidc                 bool          `protobuf:"varint,5,opt,name=oidc,proto3" json:"oidc,omitempty"`
 	HeaderAuths          []*HeaderAuth `protobuf:"bytes,6,rep,name=header_auths,json=headerAuths,proto3" json:"header_auths,omitempty"`
+	// Group ids allowed to reach the service through an OIDC identity. When
+	// non-empty the proxy requires the session token's groups claim to
+	// intersect this list before honouring the cookie, so a token minted for
+	// an identity outside these groups is not a bearer credential for the
+	// service. Empty means group membership does not restrict access.
+	AllowedGroupIds []string `protobuf:"bytes,7,rep,name=allowed_group_ids,json=allowedGroupIds,proto3" json:"allowed_group_ids,omitempty"`
 }
 
 func (x *Authentication) Reset() {
@@ -979,6 +1042,13 @@ func (x *Authentication) GetHeaderAuths() []*HeaderAuth {
 	return nil
 }
 
+func (x *Authentication) GetAllowedGroupIds() []string {
+	if x != nil {
+		return x.AllowedGroupIds
+	}
+	return nil
+}
+
 type AccessRestrictions struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2252,8 +2322,11 @@ type ValidateSessionRequest struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Domain       string `protobuf:"bytes,1,opt,name=domain,proto3" json:"domain,omitempty"`
+	Domain string `protobuf:"bytes,1,opt,name=domain,proto3" json:"domain,omitempty"`
+	// Deprecated: Do not use.
 	SessionToken string `protobuf:"bytes,2,opt,name=session_token,json=sessionToken,proto3" json:"session_token,omitempty"`
+	// session_code is a short-lived, single-use code exchanged for a session token.
+	SessionCode string `protobuf:"bytes,3,opt,name=session_code,json=sessionCode,proto3" json:"session_code,omitempty"`
 }
 
 func (x *ValidateSessionRequest) Reset() {
@@ -2295,6 +2368,7 @@ func (x *ValidateSessionRequest) GetDomain() string {
 	return ""
 }
 
+// Deprecated: Do not use.
 func (x *ValidateSessionRequest) GetSessionToken() string {
 	if x != nil {
 		return x.SessionToken
@@ -2302,6 +2376,13 @@ func (x *ValidateSessionRequest) GetSessionToken() string {
 	return ""
 }
 
+func (x *ValidateSessionRequest) GetSessionCode() string {
+	if x != nil {
+		return x.SessionCode
+	}
+	return ""
+}
+
 type ValidateSessionResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2320,6 +2401,8 @@ type ValidateSessionResponse struct {
 	// Stamped onto upstream requests as X-NetBird-Groups so downstream
 	// services can read names rather than opaque ids.
 	PeerGroupNames []string `protobuf:"bytes,6,rep,name=peer_group_names,json=peerGroupNames,proto3" json:"peer_group_names,omitempty"`
+	// session_token contains the durable token issued when session_code is redeemed.
+	SessionToken string `protobuf:"bytes,7,opt,name=session_token,json=sessionToken,proto3" json:"session_token,omitempty"`
 }
 
 func (x *ValidateSessionResponse) Reset() {
@@ -2396,6 +2479,13 @@ func (x *ValidateSessionResponse) GetPeerGroupNames() []string {
 	return nil
 }
 
+func (x *ValidateSessionResponse) GetSessionToken() string {
+	if x != nil {
+		return x.SessionToken
+	}
+	return ""
+}
+
 // ValidateTunnelPeerRequest carries the inbound peer's tunnel IP and the
 // service domain whose group requirements should gate access. The calling
 // account is inferred from the proxy's gRPC metadata (ProxyToken).
@@ -3292,434 +3382,454 @@ var file_proxy_service_proto_rawDesc = []byte{
 	0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x61, 0x6e, 0x4d, 0x75, 0x74, 0x61, 0x74,
 	0x65, 0x22, 0x2a, 0x0a, 0x08, 0x46, 0x61, 0x69, 0x6c, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x0d, 0x0a,
 	0x09, 0x46, 0x41, 0x49, 0x4c, 0x5f, 0x4f, 0x50, 0x45, 0x4e, 0x10, 0x00, 0x12, 0x0f, 0x0a, 0x0b,
-	0x46, 0x41, 0x49, 0x4c, 0x5f, 0x43, 0x4c, 0x4f, 0x53, 0x45, 0x44, 0x10, 0x01, 0x22, 0x72, 0x0a,
-	0x0b, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a, 0x04,
-	0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68,
-	0x12, 0x16, 0x0a, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65,
-	0x74, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x22, 0x47, 0x0a, 0x0a, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x12,
-	0x16, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x68, 0x61, 0x73, 0x68, 0x65,
-	0x64, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68,
-	0x61, 0x73, 0x68, 0x65, 0x64, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0xe5, 0x01, 0x0a, 0x0e, 0x41,
-	0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a,
-	0x0b, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x12, 0x35,
-	0x0a, 0x17, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x67,
-	0x65, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52,
-	0x14, 0x6d, 0x61, 0x78, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x67, 0x65, 0x53, 0x65,
-	0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
-	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
-	0x64, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03,
-	0x70, 0x69, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x12, 0x39, 0x0a, 0x0c, 0x68, 0x65, 0x61, 0x64, 0x65,
-	0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65,
-	0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74,
-	0x68, 0x73, 0x22, 0xdd, 0x01, 0x0a, 0x12, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73,
-	0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x6c, 0x6c,
-	0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x0c, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x69, 0x64, 0x72, 0x73, 0x12, 0x23,
-	0x0a, 0x0d, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18,
-	0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x43, 0x69,
-	0x64, 0x72, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63,
-	0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10,
-	0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73,
-	0x12, 0x2b, 0x0a, 0x11, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x75, 0x6e,
-	0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x62, 0x6c, 0x6f,
-	0x63, 0x6b, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x12, 0x23, 0x0a,
-	0x0d, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x05,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x4d, 0x6f,
-	0x64, 0x65, 0x22, 0x80, 0x04, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x12, 0x36, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
-	0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x12, 0x2b, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61,
-	0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12,
-	0x1d, 0x0a, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x06, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2e,
-	0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
-	0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x28,
-	0x0a, 0x10, 0x70, 0x61, 0x73, 0x73, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x68, 0x65, 0x61, 0x64,
-	0x65, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x61, 0x73, 0x73, 0x48, 0x6f,
-	0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x2b, 0x0a, 0x11, 0x72, 0x65, 0x77, 0x72,
-	0x69, 0x74, 0x65, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x18, 0x09, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x64, 0x69,
-	0x72, 0x65, 0x63, 0x74, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x0a, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73,
-	0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a,
-	0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x4f, 0x0a, 0x13, 0x61, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x74, 0x72,
-	0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x12, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52,
-	0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70,
-	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70, 0x72,
-	0x69, 0x76, 0x61, 0x74, 0x65, 0x22, 0x3f, 0x0a, 0x14, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63,
-	0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a,
-	0x03, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
-	0x67, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0xa9, 0x05, 0x0a, 0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x38, 0x0a,
-	0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f, 0x69,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x12, 0x1d,
-	0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x1d, 0x0a,
-	0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04,
-	0x68, 0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74,
-	0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x6d, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x64, 0x75, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x4d, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18,
-	0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x23, 0x0a,
-	0x0d, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x09,
-	0x20, 0x01, 0x28, 0x05, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x43, 0x6f,
-	0x64, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70, 0x18,
-	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70, 0x12,
-	0x25, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73,
-	0x6d, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x63,
-	0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69,
-	0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12,
-	0x21, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18,
-	0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x53, 0x75, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x75, 0x70, 0x6c, 0x6f,
-	0x61, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x62, 0x79, 0x74, 0x65, 0x73, 0x55,
-	0x70, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x64,
-	0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x62,
-	0x79, 0x74, 0x65, 0x73, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x1a, 0x0a, 0x08,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3f, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
-	0x67, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67, 0x65,
-	0x6e, 0x74, 0x5f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x12, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x1a, 0x3b,
-	0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
-	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf8, 0x01, 0x0a, 0x13,
-	0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
-	0x49, 0x64, 0x12, 0x39, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x48, 0x00, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x2a, 0x0a,
-	0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x48, 0x00, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x40, 0x0a, 0x0b, 0x68, 0x65, 0x61,
-	0x64, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x64,
-	0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52,
-	0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x42, 0x09, 0x0a, 0x07, 0x72,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x57, 0x0a, 0x11, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
-	0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x68,
-	0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f,
-	0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22,
-	0x2d, 0x0a, 0x0f, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x1e,
-	0x0a, 0x0a, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03,
-	0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x22, 0x55,
-	0x0a, 0x14, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65,
-	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xda, 0x02, 0x0a, 0x17, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64,
-	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x46, 0x41, 0x49, 0x4c, 0x5f, 0x43, 0x4c, 0x4f, 0x53, 0x45, 0x44, 0x10, 0x01, 0x22, 0xb7, 0x01,
+	0x0a, 0x0b, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a,
+	0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74,
+	0x68, 0x12, 0x16, 0x0a, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x54, 0x61, 0x72, 0x67,
+	0x65, 0x74, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x12, 0x43, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0c, 0x61, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x47, 0x0a, 0x0a, 0x48, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x41, 0x75, 0x74, 0x68, 0x12, 0x16, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x21, 0x0a,
+	0x0c, 0x68, 0x61, 0x73, 0x68, 0x65, 0x64, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x61, 0x73, 0x68, 0x65, 0x64, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x22, 0x91, 0x02, 0x0a, 0x0e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x4b, 0x65, 0x79, 0x12, 0x35, 0x0a, 0x17, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x14, 0x6d, 0x61, 0x78, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x41, 0x67, 0x65, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6f, 0x69, 0x64,
+	0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x12, 0x39, 0x0a,
+	0x0c, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x73, 0x18, 0x06, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x0b, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x65, 0x64, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x07, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x0f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75,
+	0x70, 0x49, 0x64, 0x73, 0x22, 0xdd, 0x01, 0x0a, 0x12, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52,
+	0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x61,
+	0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x0c, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x69, 0x64, 0x72, 0x73,
+	0x12, 0x23, 0x0a, 0x0d, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64,
+	0x43, 0x69, 0x64, 0x72, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64,
+	0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x10, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69,
+	0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x62,
+	0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x12,
+	0x23, 0x0a, 0x0d, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x5f, 0x6d, 0x6f, 0x64, 0x65,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63,
+	0x4d, 0x6f, 0x64, 0x65, 0x22, 0x80, 0x04, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x36, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a,
+	0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2b, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x04, 0x70, 0x61, 0x74,
+	0x68, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x12, 0x2e, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68,
+	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68,
+	0x12, 0x28, 0x0a, 0x10, 0x70, 0x61, 0x73, 0x73, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x68, 0x65,
+	0x61, 0x64, 0x65, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x61, 0x73, 0x73,
+	0x48, 0x6f, 0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x2b, 0x0a, 0x11, 0x72, 0x65,
+	0x77, 0x72, 0x69, 0x74, 0x65, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65,
+	0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6c,
+	0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05,
+	0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x4f, 0x0a, 0x13,
+	0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73,
+	0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x12, 0x61, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x52, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x18, 0x0a,
+	0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
+	0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x22, 0x3f, 0x0a, 0x14, 0x53, 0x65, 0x6e, 0x64, 0x41,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x27, 0x0a, 0x03, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x4c, 0x6f, 0x67, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x65, 0x6e, 0x64,
+	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0xa9, 0x05, 0x0a, 0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12,
+	0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09,
+	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x6c, 0x6f, 0x67,
+	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64,
+	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03,
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12,
-	0x2f, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f,
-	0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x12, 0x2d, 0x0a, 0x12, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f,
-	0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63, 0x65,
-	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x12,
-	0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x12, 0x50, 0x0a, 0x10, 0x69, 0x6e, 0x62,
-	0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x18, 0x32, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73,
-	0x74, 0x65, 0x6e, 0x65, 0x72, 0x48, 0x01, 0x52, 0x0f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64,
-	0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f,
-	0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x13, 0x0a,
-	0x11, 0x5f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e,
-	0x65, 0x72, 0x22, 0x6f, 0x0a, 0x14, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75,
-	0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x75,
-	0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74,
-	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x1d, 0x0a, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x73,
-	0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x68, 0x74, 0x74,
-	0x70, 0x73, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x70,
-	0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x68, 0x74, 0x74, 0x70, 0x50,
-	0x6f, 0x72, 0x74, 0x22, 0x1a, 0x0a, 0x18, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0xb8, 0x01, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50,
-	0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63,
-	0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65,
-	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x30,
-	0x0a, 0x14, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x5f, 0x70, 0x75, 0x62, 0x6c,
-	0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x77, 0x69,
-	0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
-	0x12, 0x18, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x17, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12,
-	0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x65, 0x72,
-	0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x65, 0x0a, 0x11, 0x47,
-	0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12,
-	0x21, 0x0a, 0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x6c, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55,
-	0x72, 0x6c, 0x22, 0x26, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x22, 0x55, 0x0a, 0x16, 0x56, 0x61,
-	0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x23, 0x0a, 0x0d,
-	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x22, 0xdc, 0x01, 0x0a, 0x17, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a,
-	0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61,
-	0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a,
-	0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x64,
-	0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e,
-	0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
-	0x64, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72,
-	0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67,
-	0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73,
-	0x22, 0x50, 0x0a, 0x19, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e,
-	0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a,
-	0x09, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x08, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x22, 0x84, 0x02, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54,
-	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f,
-	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64,
-	0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12,
-	0x23, 0x0a, 0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65,
-	0x61, 0x73, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65,
-	0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
+	0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x12,
+	0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f,
+	0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x6d, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x64, 0x75, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12,
+	0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x64, 0x65,
+	0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x43, 0x6f, 0x64, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69,
+	0x70, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49,
+	0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e,
+	0x69, 0x73, 0x6d, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x4d,
+	0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72,
+	0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49,
+	0x64, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x53, 0x75, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x75, 0x70,
+	0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x62, 0x79, 0x74, 0x65,
+	0x73, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x62, 0x79, 0x74, 0x65, 0x73,
+	0x5f, 0x64, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x0d, 0x62, 0x79, 0x74, 0x65, 0x73, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x1a,
+	0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3f, 0x0a, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x4c, 0x6f, 0x67, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x23, 0x0a, 0x0d, 0x61,
+	0x67, 0x65, 0x6e, 0x74, 0x5f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x12, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x1a, 0x3b, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf8, 0x01,
+	0x0a, 0x13, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
+	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12,
+	0x2a, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x40, 0x0a, 0x0b, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65,
+	0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48,
+	0x00, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x42, 0x09, 0x0a,
+	0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x57, 0x0a, 0x11, 0x48, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a,
+	0x0c, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4e, 0x61, 0x6d,
+	0x65, 0x22, 0x2d, 0x0a, 0x0f, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x22, 0x1e, 0x0a, 0x0a, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10,
+	0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e,
+	0x22, 0x55, 0x0a, 0x14, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xda, 0x02, 0x0a, 0x17, 0x53, 0x65, 0x6e, 0x64,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49,
+	0x64, 0x12, 0x2f, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x5f, 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11,
+	0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x49, 0x73, 0x73, 0x75, 0x65,
+	0x64, 0x12, 0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x12, 0x50, 0x0a, 0x10, 0x69,
+	0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x18,
+	0x32, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c,
+	0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x48, 0x01, 0x52, 0x0f, 0x69, 0x6e, 0x62, 0x6f, 0x75,
+	0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a,
+	0x0e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42,
+	0x13, 0x0a, 0x11, 0x5f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74,
+	0x65, 0x6e, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x14, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62,
+	0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x0a, 0x09,
+	0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x1d, 0x0a, 0x0a, 0x68, 0x74, 0x74,
+	0x70, 0x73, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x68,
+	0x74, 0x74, 0x70, 0x73, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70,
+	0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x68, 0x74, 0x74,
+	0x70, 0x50, 0x6f, 0x72, 0x74, 0x22, 0x1a, 0x0a, 0x18, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0xb8, 0x01, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78,
+	0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
+	0x12, 0x30, 0x0a, 0x14, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x5f, 0x70, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12,
+	0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
+	0x65, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x17,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x12, 0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x65, 0x0a,
+	0x11, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49,
+	0x64, 0x12, 0x21, 0x0a, 0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72,
+	0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63,
+	0x74, 0x55, 0x72, 0x6c, 0x22, 0x26, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55,
+	0x52, 0x4c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72,
+	0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x22, 0x7c, 0x0a, 0x16,
+	0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x27,
+	0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x64, 0x65, 0x22, 0x81, 0x02, 0x0a, 0x17, 0x56,
+	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07,
+	0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75,
+	0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d,
+	0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45,
+	0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72,
+	0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e,
+	0x69, 0x65, 0x64, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65,
+	0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28,
 	0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12,
 	0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x81, 0x01, 0x0a, 0x13, 0x53, 0x79,
-	0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x32, 0x0a, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e,
-	0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52,
-	0x04, 0x69, 0x6e, 0x69, 0x74, 0x12, 0x2f, 0x0a, 0x03, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b, 0x48,
-	0x00, 0x52, 0x03, 0x61, 0x63, 0x6b, 0x42, 0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0xdf, 0x01,
-	0x0a, 0x10, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e,
-	0x69, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x64, 0x12, 0x18, 0x0a,
-	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
-	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x39, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74,
-	0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64,
-	0x41, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x41, 0x0a, 0x0c,
-	0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65,
-	0x73, 0x52, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22,
-	0x11, 0x0a, 0x0f, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41,
-	0x63, 0x6b, 0x22, 0x7e, 0x0a, 0x14, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
-	0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x32, 0x0a, 0x07, 0x6d, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x07, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x32,
-	0x0a, 0x15, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x63,
-	0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x69,
-	0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x79, 0x6e, 0x63, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65,
-	0x74, 0x65, 0x22, 0xa9, 0x01, 0x0a, 0x1b, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49,
-	0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72,
-	0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67,
-	0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x64, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x6f, 0x64, 0x65,
-	0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x22, 0xff,
-	0x01, 0x0a, 0x1c, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x1a, 0x0a, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x73,
-	0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5f, 0x69,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65,
-	0x64, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x74, 0x74,
-	0x72, 0x69, 0x62, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
-	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
-	0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x77,
+	0x6d, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x50,
+	0x0a, 0x19, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c,
+	0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74,
+	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x22, 0x84, 0x02, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e,
+	0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1d,
+	0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a,
+	0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65, 0x61, 0x73,
+	0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a,
+	0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f,
+	0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x81, 0x01, 0x0a, 0x13, 0x53, 0x79, 0x6e, 0x63,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x32, 0x0a, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52, 0x04, 0x69,
+	0x6e, 0x69, 0x74, 0x12, 0x2f, 0x0a, 0x03, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79,
+	0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b, 0x48, 0x00, 0x52,
+	0x03, 0x61, 0x63, 0x6b, 0x42, 0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0xdf, 0x01, 0x0a, 0x10,
+	0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e, 0x69, 0x74,
+	0x12, 0x19, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76,
+	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x39, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64,
+	0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x41, 0x74,
+	0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x63, 0x61,
+	0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72,
+	0x6f, 0x78, 0x79, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52,
+	0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22, 0x11, 0x0a,
+	0x0f, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b,
+	0x22, 0x7e, 0x0a, 0x14, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x32, 0x0a, 0x07, 0x6d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x52, 0x07, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x32, 0x0a, 0x15,
+	0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x63, 0x6f, 0x6d,
+	0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x69, 0x6e, 0x69,
+	0x74, 0x69, 0x61, 0x6c, 0x53, 0x79, 0x6e, 0x63, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65,
+	0x22, 0xa9, 0x01, 0x0a, 0x1b, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12,
+	0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f,
+	0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x22, 0xff, 0x01, 0x0a,
+	0x1c, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c,
+	0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1a, 0x0a,
+	0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x65, 0x6c,
+	0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5f, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x74, 0x74, 0x72, 0x69,
+	0x62, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x69,
+	0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x77, 0x69, 0x6e,
+	0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73,
+	0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x6e, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a,
+	0x0b, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0a, 0x64, 0x65, 0x6e, 0x79, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x22, 0x91,
+	0x02, 0x0a, 0x15, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64,
+	0x12, 0x19, 0x0a, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x77,
 	0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x04, 0x20,
 	0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63, 0x6f, 0x6e,
-	0x64, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x6e, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x12,
-	0x1f, 0x0a, 0x0b, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x64, 0x65, 0x6e, 0x79, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e,
-	0x22, 0x91, 0x02, 0x0a, 0x15, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73,
-	0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65,
-	0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72,
-	0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a,
-	0x0e, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63,
-	0x6f, 0x6e, 0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x5f, 0x69,
-	0x6e, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x74, 0x6f, 0x6b, 0x65,
-	0x6e, 0x73, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
-	0x73, 0x5f, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x19, 0x0a, 0x08,
-	0x63, 0x6f, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x01, 0x52, 0x07,
-	0x63, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70,
-	0x5f, 0x69, 0x64, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f, 0x75,
-	0x70, 0x49, 0x64, 0x73, 0x22, 0x18, 0x0a, 0x16, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c,
-	0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0x64,
-	0x0a, 0x16, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41,
-	0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10,
-	0x00, 0x12, 0x18, 0x0a, 0x14, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45,
-	0x5f, 0x4d, 0x4f, 0x44, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x55,
-	0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x56,
-	0x45, 0x44, 0x10, 0x02, 0x2a, 0x46, 0x0a, 0x0f, 0x50, 0x61, 0x74, 0x68, 0x52, 0x65, 0x77, 0x72,
-	0x69, 0x74, 0x65, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x41, 0x54, 0x48, 0x5f,
-	0x52, 0x45, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10,
-	0x00, 0x12, 0x19, 0x0a, 0x15, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45, 0x57, 0x52, 0x49, 0x54,
-	0x45, 0x5f, 0x50, 0x52, 0x45, 0x53, 0x45, 0x52, 0x56, 0x45, 0x10, 0x01, 0x2a, 0x90, 0x01, 0x0a,
-	0x0e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x53, 0x6c, 0x6f, 0x74, 0x12,
-	0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c,
-	0x4f, 0x54, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00,
-	0x12, 0x1e, 0x0a, 0x1a, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53,
-	0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x45, 0x53, 0x54, 0x10, 0x01,
-	0x12, 0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53,
-	0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45, 0x10,
-	0x02, 0x12, 0x1c, 0x0a, 0x18, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f,
-	0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x54, 0x45, 0x52, 0x4d, 0x49, 0x4e, 0x41, 0x4c, 0x10, 0x03, 0x2a,
-	0xc8, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
-	0x18, 0x0a, 0x14, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f,
-	0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x50, 0x52, 0x4f,
-	0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x56, 0x45,
-	0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54,
-	0x55, 0x53, 0x5f, 0x54, 0x55, 0x4e, 0x4e, 0x45, 0x4c, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x43, 0x52,
-	0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x02, 0x12, 0x24, 0x0a, 0x20, 0x50, 0x52, 0x4f, 0x58, 0x59,
-	0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43,
-	0x41, 0x54, 0x45, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x03, 0x12, 0x23, 0x0a,
-	0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45,
-	0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44,
-	0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54,
-	0x55, 0x53, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x05, 0x32, 0xfc, 0x07, 0x0a, 0x0c, 0x50,
-	0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5f, 0x0a, 0x10, 0x47,
-	0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12,
-	0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74,
-	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x55, 0x0a, 0x0c,
-	0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1f, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28,
-	0x01, 0x30, 0x01, 0x12, 0x54, 0x0a, 0x0d, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x4c, 0x6f, 0x67, 0x12, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
-	0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x51, 0x0a, 0x0c, 0x41, 0x75, 0x74,
-	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
-	0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x10,
-	0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
-	0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65,
-	0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x12, 0x22,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x5f, 0x69, 0x6e, 0x70,
+	0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73,
+	0x49, 0x6e, 0x70, 0x75, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x5f,
+	0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x73, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x6f,
+	0x73, 0x74, 0x5f, 0x75, 0x73, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x01, 0x52, 0x07, 0x63, 0x6f,
+	0x73, 0x74, 0x55, 0x73, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49,
+	0x64, 0x73, 0x22, 0x18, 0x0a, 0x16, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55,
+	0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0x64, 0x0a, 0x16,
+	0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45,
+	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x00, 0x12,
+	0x18, 0x0a, 0x14, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d,
+	0x4f, 0x44, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44,
+	0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x56, 0x45, 0x44,
+	0x10, 0x02, 0x2a, 0x46, 0x0a, 0x0f, 0x50, 0x61, 0x74, 0x68, 0x52, 0x65, 0x77, 0x72, 0x69, 0x74,
+	0x65, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45,
+	0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10, 0x00, 0x12,
+	0x19, 0x0a, 0x15, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f,
+	0x50, 0x52, 0x45, 0x53, 0x45, 0x52, 0x56, 0x45, 0x10, 0x01, 0x2a, 0x77, 0x0a, 0x12, 0x54, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x20, 0x0a, 0x1c, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x41, 0x43, 0x43, 0x45, 0x53,
+	0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x49, 0x4e, 0x48, 0x45, 0x52, 0x49, 0x54,
+	0x10, 0x00, 0x12, 0x1f, 0x0a, 0x1b, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x41, 0x43, 0x43,
+	0x45, 0x53, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x59, 0x50, 0x41, 0x53,
+	0x53, 0x10, 0x01, 0x12, 0x1e, 0x0a, 0x1a, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x41, 0x43,
+	0x43, 0x45, 0x53, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4c, 0x4f, 0x43,
+	0x4b, 0x10, 0x02, 0x2a, 0x90, 0x01, 0x0a, 0x0e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61,
+	0x72, 0x65, 0x53, 0x6c, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45,
+	0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1e, 0x0a, 0x1a, 0x4d, 0x49, 0x44, 0x44, 0x4c,
+	0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45,
+	0x51, 0x55, 0x45, 0x53, 0x54, 0x10, 0x01, 0x12, 0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c,
+	0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45,
+	0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45, 0x10, 0x02, 0x12, 0x1c, 0x0a, 0x18, 0x4d, 0x49, 0x44, 0x44,
+	0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x54, 0x45, 0x52, 0x4d,
+	0x49, 0x4e, 0x41, 0x4c, 0x10, 0x03, 0x2a, 0xc8, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x78, 0x79,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f,
+	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x00,
+	0x12, 0x17, 0x0a, 0x13, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
+	0x5f, 0x41, 0x43, 0x54, 0x49, 0x56, 0x45, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52, 0x4f,
+	0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x54, 0x55, 0x4e, 0x4e, 0x45, 0x4c,
+	0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x02, 0x12, 0x24,
+	0x0a, 0x20, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43,
+	0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49,
+	0x4e, 0x47, 0x10, 0x03, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54,
+	0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45,
+	0x5f, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44, 0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x52, 0x4f,
+	0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10,
+	0x05, 0x32, 0xfc, 0x07, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x12, 0x5f, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x30, 0x01, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69,
+	0x6e, 0x67, 0x73, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x12, 0x54, 0x0a, 0x0d, 0x53, 0x65,
+	0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x20, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x51, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75,
+	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41,
+	0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x10, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78,
+	0x79, 0x50, 0x65, 0x65, 0x72, 0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65,
+	0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4b,
+	0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x12, 0x1d, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44,
+	0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43,
+	0x55, 0x52, 0x4c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x56,
+	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69,
+	0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
 	0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4f, 0x49,
-	0x44, 0x43, 0x55, 0x52, 0x4c, 0x12, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
-	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
-	0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x63, 0x0a, 0x12, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e,
-	0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x12, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e,
-	0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e,
+	0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x12, 0x56, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x12, 0x25, 0x2e,
 	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64,
-	0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x69, 0x0a, 0x14, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c,
-	0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x12, 0x27, 0x2e,
+	0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c,
+	0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x69, 0x0a, 0x14,
+	0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69,
+	0x6d, 0x69, 0x74, 0x73, 0x12, 0x27, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e,
 	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b,
 	0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x57, 0x0a, 0x0e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61,
-	0x67, 0x65, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x57, 0x0a, 0x0e, 0x52, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d,
+	0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }
 
 var (
@@ -3734,114 +3844,116 @@ func file_proxy_service_proto_rawDescGZIP() []byte {
 	return file_proxy_service_proto_rawDescData
 }
 
-var file_proxy_service_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
+var file_proxy_service_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
 var file_proxy_service_proto_msgTypes = make([]protoimpl.MessageInfo, 39)
 var file_proxy_service_proto_goTypes = []interface{}{
 	(ProxyMappingUpdateType)(0),          // 0: management.ProxyMappingUpdateType
 	(PathRewriteMode)(0),                 // 1: management.PathRewriteMode
-	(MiddlewareSlot)(0),                  // 2: management.MiddlewareSlot
-	(ProxyStatus)(0),                     // 3: management.ProxyStatus
-	(MiddlewareConfig_FailMode)(0),       // 4: management.MiddlewareConfig.FailMode
-	(*ProxyCapabilities)(nil),            // 5: management.ProxyCapabilities
-	(*GetMappingUpdateRequest)(nil),      // 6: management.GetMappingUpdateRequest
-	(*GetMappingUpdateResponse)(nil),     // 7: management.GetMappingUpdateResponse
-	(*PathTargetOptions)(nil),            // 8: management.PathTargetOptions
-	(*MiddlewareConfig)(nil),             // 9: management.MiddlewareConfig
-	(*PathMapping)(nil),                  // 10: management.PathMapping
-	(*HeaderAuth)(nil),                   // 11: management.HeaderAuth
-	(*Authentication)(nil),               // 12: management.Authentication
-	(*AccessRestrictions)(nil),           // 13: management.AccessRestrictions
-	(*ProxyMapping)(nil),                 // 14: management.ProxyMapping
-	(*SendAccessLogRequest)(nil),         // 15: management.SendAccessLogRequest
-	(*SendAccessLogResponse)(nil),        // 16: management.SendAccessLogResponse
-	(*AccessLog)(nil),                    // 17: management.AccessLog
-	(*AuthenticateRequest)(nil),          // 18: management.AuthenticateRequest
-	(*HeaderAuthRequest)(nil),            // 19: management.HeaderAuthRequest
-	(*PasswordRequest)(nil),              // 20: management.PasswordRequest
-	(*PinRequest)(nil),                   // 21: management.PinRequest
-	(*AuthenticateResponse)(nil),         // 22: management.AuthenticateResponse
-	(*SendStatusUpdateRequest)(nil),      // 23: management.SendStatusUpdateRequest
-	(*ProxyInboundListener)(nil),         // 24: management.ProxyInboundListener
-	(*SendStatusUpdateResponse)(nil),     // 25: management.SendStatusUpdateResponse
-	(*CreateProxyPeerRequest)(nil),       // 26: management.CreateProxyPeerRequest
-	(*CreateProxyPeerResponse)(nil),      // 27: management.CreateProxyPeerResponse
-	(*GetOIDCURLRequest)(nil),            // 28: management.GetOIDCURLRequest
-	(*GetOIDCURLResponse)(nil),           // 29: management.GetOIDCURLResponse
-	(*ValidateSessionRequest)(nil),       // 30: management.ValidateSessionRequest
-	(*ValidateSessionResponse)(nil),      // 31: management.ValidateSessionResponse
-	(*ValidateTunnelPeerRequest)(nil),    // 32: management.ValidateTunnelPeerRequest
-	(*ValidateTunnelPeerResponse)(nil),   // 33: management.ValidateTunnelPeerResponse
-	(*SyncMappingsRequest)(nil),          // 34: management.SyncMappingsRequest
-	(*SyncMappingsInit)(nil),             // 35: management.SyncMappingsInit
-	(*SyncMappingsAck)(nil),              // 36: management.SyncMappingsAck
-	(*SyncMappingsResponse)(nil),         // 37: management.SyncMappingsResponse
-	(*CheckLLMPolicyLimitsRequest)(nil),  // 38: management.CheckLLMPolicyLimitsRequest
-	(*CheckLLMPolicyLimitsResponse)(nil), // 39: management.CheckLLMPolicyLimitsResponse
-	(*RecordLLMUsageRequest)(nil),        // 40: management.RecordLLMUsageRequest
-	(*RecordLLMUsageResponse)(nil),       // 41: management.RecordLLMUsageResponse
-	nil,                                  // 42: management.PathTargetOptions.CustomHeadersEntry
-	nil,                                  // 43: management.AccessLog.MetadataEntry
-	(*timestamppb.Timestamp)(nil),        // 44: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),          // 45: google.protobuf.Duration
+	(TargetAccessAction)(0),              // 2: management.TargetAccessAction
+	(MiddlewareSlot)(0),                  // 3: management.MiddlewareSlot
+	(ProxyStatus)(0),                     // 4: management.ProxyStatus
+	(MiddlewareConfig_FailMode)(0),       // 5: management.MiddlewareConfig.FailMode
+	(*ProxyCapabilities)(nil),            // 6: management.ProxyCapabilities
+	(*GetMappingUpdateRequest)(nil),      // 7: management.GetMappingUpdateRequest
+	(*GetMappingUpdateResponse)(nil),     // 8: management.GetMappingUpdateResponse
+	(*PathTargetOptions)(nil),            // 9: management.PathTargetOptions
+	(*MiddlewareConfig)(nil),             // 10: management.MiddlewareConfig
+	(*PathMapping)(nil),                  // 11: management.PathMapping
+	(*HeaderAuth)(nil),                   // 12: management.HeaderAuth
+	(*Authentication)(nil),               // 13: management.Authentication
+	(*AccessRestrictions)(nil),           // 14: management.AccessRestrictions
+	(*ProxyMapping)(nil),                 // 15: management.ProxyMapping
+	(*SendAccessLogRequest)(nil),         // 16: management.SendAccessLogRequest
+	(*SendAccessLogResponse)(nil),        // 17: management.SendAccessLogResponse
+	(*AccessLog)(nil),                    // 18: management.AccessLog
+	(*AuthenticateRequest)(nil),          // 19: management.AuthenticateRequest
+	(*HeaderAuthRequest)(nil),            // 20: management.HeaderAuthRequest
+	(*PasswordRequest)(nil),              // 21: management.PasswordRequest
+	(*PinRequest)(nil),                   // 22: management.PinRequest
+	(*AuthenticateResponse)(nil),         // 23: management.AuthenticateResponse
+	(*SendStatusUpdateRequest)(nil),      // 24: management.SendStatusUpdateRequest
+	(*ProxyInboundListener)(nil),         // 25: management.ProxyInboundListener
+	(*SendStatusUpdateResponse)(nil),     // 26: management.SendStatusUpdateResponse
+	(*CreateProxyPeerRequest)(nil),       // 27: management.CreateProxyPeerRequest
+	(*CreateProxyPeerResponse)(nil),      // 28: management.CreateProxyPeerResponse
+	(*GetOIDCURLRequest)(nil),            // 29: management.GetOIDCURLRequest
+	(*GetOIDCURLResponse)(nil),           // 30: management.GetOIDCURLResponse
+	(*ValidateSessionRequest)(nil),       // 31: management.ValidateSessionRequest
+	(*ValidateSessionResponse)(nil),      // 32: management.ValidateSessionResponse
+	(*ValidateTunnelPeerRequest)(nil),    // 33: management.ValidateTunnelPeerRequest
+	(*ValidateTunnelPeerResponse)(nil),   // 34: management.ValidateTunnelPeerResponse
+	(*SyncMappingsRequest)(nil),          // 35: management.SyncMappingsRequest
+	(*SyncMappingsInit)(nil),             // 36: management.SyncMappingsInit
+	(*SyncMappingsAck)(nil),              // 37: management.SyncMappingsAck
+	(*SyncMappingsResponse)(nil),         // 38: management.SyncMappingsResponse
+	(*CheckLLMPolicyLimitsRequest)(nil),  // 39: management.CheckLLMPolicyLimitsRequest
+	(*CheckLLMPolicyLimitsResponse)(nil), // 40: management.CheckLLMPolicyLimitsResponse
+	(*RecordLLMUsageRequest)(nil),        // 41: management.RecordLLMUsageRequest
+	(*RecordLLMUsageResponse)(nil),       // 42: management.RecordLLMUsageResponse
+	nil,                                  // 43: management.PathTargetOptions.CustomHeadersEntry
+	nil,                                  // 44: management.AccessLog.MetadataEntry
+	(*timestamppb.Timestamp)(nil),        // 45: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),          // 46: google.protobuf.Duration
 }
 var file_proxy_service_proto_depIdxs = []int32{
-	44, // 0: management.GetMappingUpdateRequest.started_at:type_name -> google.protobuf.Timestamp
-	5,  // 1: management.GetMappingUpdateRequest.capabilities:type_name -> management.ProxyCapabilities
-	14, // 2: management.GetMappingUpdateResponse.mapping:type_name -> management.ProxyMapping
-	45, // 3: management.PathTargetOptions.request_timeout:type_name -> google.protobuf.Duration
+	45, // 0: management.GetMappingUpdateRequest.started_at:type_name -> google.protobuf.Timestamp
+	6,  // 1: management.GetMappingUpdateRequest.capabilities:type_name -> management.ProxyCapabilities
+	15, // 2: management.GetMappingUpdateResponse.mapping:type_name -> management.ProxyMapping
+	46, // 3: management.PathTargetOptions.request_timeout:type_name -> google.protobuf.Duration
 	1,  // 4: management.PathTargetOptions.path_rewrite:type_name -> management.PathRewriteMode
-	42, // 5: management.PathTargetOptions.custom_headers:type_name -> management.PathTargetOptions.CustomHeadersEntry
-	45, // 6: management.PathTargetOptions.session_idle_timeout:type_name -> google.protobuf.Duration
-	9,  // 7: management.PathTargetOptions.middlewares:type_name -> management.MiddlewareConfig
-	2,  // 8: management.MiddlewareConfig.slot:type_name -> management.MiddlewareSlot
-	4,  // 9: management.MiddlewareConfig.fail_mode:type_name -> management.MiddlewareConfig.FailMode
-	45, // 10: management.MiddlewareConfig.timeout:type_name -> google.protobuf.Duration
-	8,  // 11: management.PathMapping.options:type_name -> management.PathTargetOptions
-	11, // 12: management.Authentication.header_auths:type_name -> management.HeaderAuth
-	0,  // 13: management.ProxyMapping.type:type_name -> management.ProxyMappingUpdateType
-	10, // 14: management.ProxyMapping.path:type_name -> management.PathMapping
-	12, // 15: management.ProxyMapping.auth:type_name -> management.Authentication
-	13, // 16: management.ProxyMapping.access_restrictions:type_name -> management.AccessRestrictions
-	17, // 17: management.SendAccessLogRequest.log:type_name -> management.AccessLog
-	44, // 18: management.AccessLog.timestamp:type_name -> google.protobuf.Timestamp
-	43, // 19: management.AccessLog.metadata:type_name -> management.AccessLog.MetadataEntry
-	20, // 20: management.AuthenticateRequest.password:type_name -> management.PasswordRequest
-	21, // 21: management.AuthenticateRequest.pin:type_name -> management.PinRequest
-	19, // 22: management.AuthenticateRequest.header_auth:type_name -> management.HeaderAuthRequest
-	3,  // 23: management.SendStatusUpdateRequest.status:type_name -> management.ProxyStatus
-	24, // 24: management.SendStatusUpdateRequest.inbound_listener:type_name -> management.ProxyInboundListener
-	35, // 25: management.SyncMappingsRequest.init:type_name -> management.SyncMappingsInit
-	36, // 26: management.SyncMappingsRequest.ack:type_name -> management.SyncMappingsAck
-	44, // 27: management.SyncMappingsInit.started_at:type_name -> google.protobuf.Timestamp
-	5,  // 28: management.SyncMappingsInit.capabilities:type_name -> management.ProxyCapabilities
-	14, // 29: management.SyncMappingsResponse.mapping:type_name -> management.ProxyMapping
-	6,  // 30: management.ProxyService.GetMappingUpdate:input_type -> management.GetMappingUpdateRequest
-	34, // 31: management.ProxyService.SyncMappings:input_type -> management.SyncMappingsRequest
-	15, // 32: management.ProxyService.SendAccessLog:input_type -> management.SendAccessLogRequest
-	18, // 33: management.ProxyService.Authenticate:input_type -> management.AuthenticateRequest
-	23, // 34: management.ProxyService.SendStatusUpdate:input_type -> management.SendStatusUpdateRequest
-	26, // 35: management.ProxyService.CreateProxyPeer:input_type -> management.CreateProxyPeerRequest
-	28, // 36: management.ProxyService.GetOIDCURL:input_type -> management.GetOIDCURLRequest
-	30, // 37: management.ProxyService.ValidateSession:input_type -> management.ValidateSessionRequest
-	32, // 38: management.ProxyService.ValidateTunnelPeer:input_type -> management.ValidateTunnelPeerRequest
-	38, // 39: management.ProxyService.CheckLLMPolicyLimits:input_type -> management.CheckLLMPolicyLimitsRequest
-	40, // 40: management.ProxyService.RecordLLMUsage:input_type -> management.RecordLLMUsageRequest
-	7,  // 41: management.ProxyService.GetMappingUpdate:output_type -> management.GetMappingUpdateResponse
-	37, // 42: management.ProxyService.SyncMappings:output_type -> management.SyncMappingsResponse
-	16, // 43: management.ProxyService.SendAccessLog:output_type -> management.SendAccessLogResponse
-	22, // 44: management.ProxyService.Authenticate:output_type -> management.AuthenticateResponse
-	25, // 45: management.ProxyService.SendStatusUpdate:output_type -> management.SendStatusUpdateResponse
-	27, // 46: management.ProxyService.CreateProxyPeer:output_type -> management.CreateProxyPeerResponse
-	29, // 47: management.ProxyService.GetOIDCURL:output_type -> management.GetOIDCURLResponse
-	31, // 48: management.ProxyService.ValidateSession:output_type -> management.ValidateSessionResponse
-	33, // 49: management.ProxyService.ValidateTunnelPeer:output_type -> management.ValidateTunnelPeerResponse
-	39, // 50: management.ProxyService.CheckLLMPolicyLimits:output_type -> management.CheckLLMPolicyLimitsResponse
-	41, // 51: management.ProxyService.RecordLLMUsage:output_type -> management.RecordLLMUsageResponse
-	41, // [41:52] is the sub-list for method output_type
-	30, // [30:41] is the sub-list for method input_type
-	30, // [30:30] is the sub-list for extension type_name
-	30, // [30:30] is the sub-list for extension extendee
-	0,  // [0:30] is the sub-list for field type_name
+	43, // 5: management.PathTargetOptions.custom_headers:type_name -> management.PathTargetOptions.CustomHeadersEntry
+	46, // 6: management.PathTargetOptions.session_idle_timeout:type_name -> google.protobuf.Duration
+	10, // 7: management.PathTargetOptions.middlewares:type_name -> management.MiddlewareConfig
+	3,  // 8: management.MiddlewareConfig.slot:type_name -> management.MiddlewareSlot
+	5,  // 9: management.MiddlewareConfig.fail_mode:type_name -> management.MiddlewareConfig.FailMode
+	46, // 10: management.MiddlewareConfig.timeout:type_name -> google.protobuf.Duration
+	9,  // 11: management.PathMapping.options:type_name -> management.PathTargetOptions
+	2,  // 12: management.PathMapping.access_action:type_name -> management.TargetAccessAction
+	12, // 13: management.Authentication.header_auths:type_name -> management.HeaderAuth
+	0,  // 14: management.ProxyMapping.type:type_name -> management.ProxyMappingUpdateType
+	11, // 15: management.ProxyMapping.path:type_name -> management.PathMapping
+	13, // 16: management.ProxyMapping.auth:type_name -> management.Authentication
+	14, // 17: management.ProxyMapping.access_restrictions:type_name -> management.AccessRestrictions
+	18, // 18: management.SendAccessLogRequest.log:type_name -> management.AccessLog
+	45, // 19: management.AccessLog.timestamp:type_name -> google.protobuf.Timestamp
+	44, // 20: management.AccessLog.metadata:type_name -> management.AccessLog.MetadataEntry
+	21, // 21: management.AuthenticateRequest.password:type_name -> management.PasswordRequest
+	22, // 22: management.AuthenticateRequest.pin:type_name -> management.PinRequest
+	20, // 23: management.AuthenticateRequest.header_auth:type_name -> management.HeaderAuthRequest
+	4,  // 24: management.SendStatusUpdateRequest.status:type_name -> management.ProxyStatus
+	25, // 25: management.SendStatusUpdateRequest.inbound_listener:type_name -> management.ProxyInboundListener
+	36, // 26: management.SyncMappingsRequest.init:type_name -> management.SyncMappingsInit
+	37, // 27: management.SyncMappingsRequest.ack:type_name -> management.SyncMappingsAck
+	45, // 28: management.SyncMappingsInit.started_at:type_name -> google.protobuf.Timestamp
+	6,  // 29: management.SyncMappingsInit.capabilities:type_name -> management.ProxyCapabilities
+	15, // 30: management.SyncMappingsResponse.mapping:type_name -> management.ProxyMapping
+	7,  // 31: management.ProxyService.GetMappingUpdate:input_type -> management.GetMappingUpdateRequest
+	35, // 32: management.ProxyService.SyncMappings:input_type -> management.SyncMappingsRequest
+	16, // 33: management.ProxyService.SendAccessLog:input_type -> management.SendAccessLogRequest
+	19, // 34: management.ProxyService.Authenticate:input_type -> management.AuthenticateRequest
+	24, // 35: management.ProxyService.SendStatusUpdate:input_type -> management.SendStatusUpdateRequest
+	27, // 36: management.ProxyService.CreateProxyPeer:input_type -> management.CreateProxyPeerRequest
+	29, // 37: management.ProxyService.GetOIDCURL:input_type -> management.GetOIDCURLRequest
+	31, // 38: management.ProxyService.ValidateSession:input_type -> management.ValidateSessionRequest
+	33, // 39: management.ProxyService.ValidateTunnelPeer:input_type -> management.ValidateTunnelPeerRequest
+	39, // 40: management.ProxyService.CheckLLMPolicyLimits:input_type -> management.CheckLLMPolicyLimitsRequest
+	41, // 41: management.ProxyService.RecordLLMUsage:input_type -> management.RecordLLMUsageRequest
+	8,  // 42: management.ProxyService.GetMappingUpdate:output_type -> management.GetMappingUpdateResponse
+	38, // 43: management.ProxyService.SyncMappings:output_type -> management.SyncMappingsResponse
+	17, // 44: management.ProxyService.SendAccessLog:output_type -> management.SendAccessLogResponse
+	23, // 45: management.ProxyService.Authenticate:output_type -> management.AuthenticateResponse
+	26, // 46: management.ProxyService.SendStatusUpdate:output_type -> management.SendStatusUpdateResponse
+	28, // 47: management.ProxyService.CreateProxyPeer:output_type -> management.CreateProxyPeerResponse
+	30, // 48: management.ProxyService.GetOIDCURL:output_type -> management.GetOIDCURLResponse
+	32, // 49: management.ProxyService.ValidateSession:output_type -> management.ValidateSessionResponse
+	34, // 50: management.ProxyService.ValidateTunnelPeer:output_type -> management.ValidateTunnelPeerResponse
+	40, // 51: management.ProxyService.CheckLLMPolicyLimits:output_type -> management.CheckLLMPolicyLimitsResponse
+	42, // 52: management.ProxyService.RecordLLMUsage:output_type -> management.RecordLLMUsageResponse
+	42, // [42:53] is the sub-list for method output_type
+	31, // [31:42] is the sub-list for method input_type
+	31, // [31:31] is the sub-list for extension type_name
+	31, // [31:31] is the sub-list for extension extendee
+	0,  // [0:31] is the sub-list for field type_name
 }
 
 func init() { file_proxy_service_proto_init() }
@@ -4312,7 +4424,7 @@ func file_proxy_service_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_proxy_service_proto_rawDesc,
-			NumEnums:      5,
+			NumEnums:      6,
 			NumMessages:   39,
 			NumExtensions: 0,
 			NumServices:   1,
diff --git a/shared/management/proto/proxy_service.proto b/shared/management/proto/proxy_service.proto
index 89d1f8749..d988f8767 100644
--- a/shared/management/proto/proxy_service.proto
+++ b/shared/management/proto/proxy_service.proto
@@ -105,6 +105,12 @@ enum PathRewriteMode {
   PATH_REWRITE_PRESERVE = 1;
 }
 
+enum TargetAccessAction {
+  TARGET_ACCESS_ACTION_INHERIT = 0;
+  TARGET_ACCESS_ACTION_BYPASS = 1;
+  TARGET_ACCESS_ACTION_BLOCK = 2;
+}
+
 message PathTargetOptions {
   bool skip_tls_verify = 1;
   google.protobuf.Duration request_timeout = 2;
@@ -178,6 +184,7 @@ message PathMapping {
   string path = 1;
   string target = 2;
   PathTargetOptions options = 3;
+  TargetAccessAction access_action = 4;
 }
 
 message HeaderAuth {
@@ -194,6 +201,12 @@ message Authentication {
   bool pin = 4;
   bool oidc = 5;
   repeated HeaderAuth header_auths = 6;
+  // Group ids allowed to reach the service through an OIDC identity. When
+  // non-empty the proxy requires the session token's groups claim to
+  // intersect this list before honouring the cookie, so a token minted for
+  // an identity outside these groups is not a bearer credential for the
+  // service. Empty means group membership does not restrict access.
+  repeated string allowed_group_ids = 7;
 }
 
 message AccessRestrictions {
@@ -357,7 +370,9 @@ message GetOIDCURLResponse {
 
 message ValidateSessionRequest {
   string domain = 1;
-  string session_token = 2;
+  string session_token = 2 [deprecated = true];
+  // session_code is a short-lived, single-use code exchanged for a session token.
+  string session_code = 3;
 }
 
 message ValidateSessionResponse {
@@ -374,6 +389,8 @@ message ValidateSessionResponse {
   // Stamped onto upstream requests as X-NetBird-Groups so downstream
   // services can read names rather than opaque ids.
   repeated string peer_group_names = 6;
+  // session_token contains the durable token issued when session_code is redeemed.
+  string session_token = 7;
 }
 
 // ValidateTunnelPeerRequest carries the inbound peer's tunnel IP and the
@@ -500,4 +517,3 @@ message RecordLLMUsageRequest {
 
 message RecordLLMUsageResponse {
 }
-
diff --git a/shared/management/status/error.go b/shared/management/status/error.go
index e31663450..4249f27de 100644
--- a/shared/management/status/error.go
+++ b/shared/management/status/error.go
@@ -135,6 +135,11 @@ func NewUserPendingApprovalError() error {
 	return Errorf(PermissionDenied, "user is pending approval")
 }
 
+// NewUserPendingApprovalByOwnerError creates a new Error with PermissionDenied type for a blocked user pending approval, naming the masked address of the owner who can approve them
+func NewUserPendingApprovalByOwnerError(ownerEmail string) error {
+	return Errorf(PermissionDenied, "user is pending approval by owner %s", ownerEmail)
+}
+
 // NewPeerNotRegisteredError creates a new Error with Unauthenticated type unregistered peer
 func NewPeerNotRegisteredError() error {
 	return Errorf(Unauthenticated, "peer is not registered")
diff --git a/shared/management/types/firewall_helpers.go b/shared/management/types/firewall_helpers.go
new file mode 100644
index 000000000..9357d24a9
--- /dev/null
+++ b/shared/management/types/firewall_helpers.go
@@ -0,0 +1,108 @@
+package types
+
+import (
+	"strconv"
+
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/version"
+)
+
+const (
+	firewallRuleMinPortRangesVer = "0.48.0"
+	firewallRuleMinNativeSSHVer  = "0.60.0"
+
+	nativeSSHPortString  = "22022"
+	nativeSSHPortNumber  = 22022
+	defaultSSHPortString = "22"
+	defaultSSHPortNumber = 22
+)
+
+type supportedFeatures struct {
+	nativeSSH  bool
+	portRanges bool
+}
+
+type LookupMap map[string]struct{}
+
+// ExpandPortsAndRanges expands Ports and PortRanges of a rule into individual firewall rules.
+func ExpandPortsAndRanges(base FirewallRule, rule *nmdata.PolicyRule, peer *nmdata.Peer) []*FirewallRule {
+	features := peerSupportedFirewallFeatures(peer.Meta.WtVersion)
+
+	var expanded []*FirewallRule
+
+	for _, port := range rule.Ports {
+		fr := base
+		fr.Port = port
+		expanded = append(expanded, &fr)
+	}
+
+	for _, portRange := range rule.PortRanges {
+		if len(rule.Ports) > 0 {
+			break
+		}
+		fr := base
+
+		if features.portRanges {
+			fr.PortRange = RulePortRange{Start: portRange.Start, End: portRange.End}
+		} else {
+			if portRange.Start != portRange.End {
+				continue
+			}
+			fr.Port = strconv.FormatUint(uint64(portRange.Start), 10)
+		}
+		expanded = append(expanded, &fr)
+	}
+
+	if shouldCheckRulesForNativeSSH(features.nativeSSH, rule, peer) || rule.Protocol == string(PolicyRuleProtocolNetbirdSSH) {
+		expanded = addNativeSSHRule(base, expanded)
+	}
+
+	return expanded
+}
+
+func addNativeSSHRule(base FirewallRule, expanded []*FirewallRule) []*FirewallRule {
+	shouldAdd := false
+	for _, fr := range expanded {
+		if isPortInRule(nativeSSHPortString, 22022, fr) {
+			return expanded
+		}
+		if isPortInRule(defaultSSHPortString, 22, fr) {
+			shouldAdd = true
+		}
+	}
+	if !shouldAdd {
+		return expanded
+	}
+
+	fr := base
+	fr.Port = nativeSSHPortString
+	return append(expanded, &fr)
+}
+
+func isPortInRule(portString string, portInt uint16, rule *FirewallRule) bool {
+	return rule.Port == portString || (rule.PortRange.Start <= portInt && portInt <= rule.PortRange.End)
+}
+
+func shouldCheckRulesForNativeSSH(supportsNative bool, rule *nmdata.PolicyRule, peer *nmdata.Peer) bool {
+	return supportsNative && peer.SSHEnabled && peer.Meta.Flags.ServerSSHAllowed && rule.Protocol == string(PolicyRuleProtocolTCP)
+}
+
+func peerSupportedFirewallFeatures(peerVer string) supportedFeatures {
+	if version.IsDevelopmentVersion(peerVer) {
+		return supportedFeatures{true, true}
+	}
+
+	var features supportedFeatures
+
+	meetMinVer, err := version.MeetsMinVersion(firewallRuleMinNativeSSHVer, peerVer)
+	features.nativeSSH = err == nil && meetMinVer
+
+	if features.nativeSSH {
+		features.portRanges = true
+	} else {
+		meetMinVer, err = version.MeetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
+		features.portRanges = err == nil && meetMinVer
+	}
+
+	return features
+}
diff --git a/management/server/types/firewall_rule.go b/shared/management/types/firewall_rule.go
similarity index 83%
rename from management/server/types/firewall_rule.go
rename to shared/management/types/firewall_rule.go
index b76a94290..2efedf625 100644
--- a/management/server/types/firewall_rule.go
+++ b/shared/management/types/firewall_rule.go
@@ -9,8 +9,8 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	nbroute "github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 const (
@@ -47,11 +47,11 @@ func (r *FirewallRule) Equal(other *FirewallRule) bool {
 	return reflect.DeepEqual(r, other)
 }
 
-// generateRouteFirewallRules generates a list of firewall rules for a given route.
+// GenerateRouteFirewallRules generates a list of firewall rules for a given route.
 // For static routes, source ranges match the destination family (v4 or v6).
 // For dynamic routes (domain-based), separate v4 and v6 rules are generated
 // so the routing peer's forwarding chain allows both address families.
-func generateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
+func GenerateRouteFirewallRules(ctx context.Context, route *nmdata.Route, rule *nmdata.PolicyRule, groupPeers []*nmdata.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
 	rulesExists := make(map[string]struct{})
 	rules := make([]*RouteFirewallRule, 0)
 
@@ -72,11 +72,11 @@ func generateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule
 
 	baseRule := RouteFirewallRule{
 		PolicyID:     rule.PolicyID,
-		RouteID:      route.ID,
+		RouteID:      nbroute.ID(route.ID),
 		SourceRanges: sourceRanges,
-		Action:       string(rule.Action),
+		Action:       rule.Action,
 		Destination:  route.Network.String(),
-		Protocol:     string(rule.Protocol),
+		Protocol:     rule.Protocol,
 		Domains:      route.Domains,
 		IsDynamic:    route.IsDynamic(),
 	}
@@ -94,7 +94,7 @@ func generateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule
 		v6Rule.SourceRanges = v6Sources
 		if isDefaultV4 {
 			v6Rule.Destination = "::/0"
-			v6Rule.RouteID = route.ID + "-v6-default"
+			v6Rule.RouteID = nbroute.ID(route.ID + "-v6-default")
 		}
 		if len(rule.Ports) == 0 {
 			rules = append(rules, generateRulesWithPortRanges(v6Rule, rule, rulesExists)...)
@@ -107,7 +107,7 @@ func generateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule
 }
 
 // splitPeerSourcesByFamily separates peer IPs into v4 (/32) and v6 (/128) source ranges.
-func splitPeerSourcesByFamily(groupPeers []*nbpeer.Peer) (v4, v6 []string) {
+func splitPeerSourcesByFamily(groupPeers []*nmdata.Peer) (v4, v6 []string) {
 	v4 = make([]string, 0, len(groupPeers))
 	v6 = make([]string, 0, len(groupPeers))
 	for _, peer := range groupPeers {
@@ -123,7 +123,7 @@ func splitPeerSourcesByFamily(groupPeers []*nbpeer.Peer) (v4, v6 []string) {
 }
 
 // generateRulesForPeer generates rules for a given peer based on ports and port ranges.
-func generateRulesWithPortRanges(baseRule RouteFirewallRule, rule *PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
+func generateRulesWithPortRanges(baseRule RouteFirewallRule, rule *nmdata.PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
 	rules := make([]*RouteFirewallRule, 0)
 
 	ruleIDBase := generateRuleIDBase(rule, baseRule)
@@ -139,7 +139,7 @@ func generateRulesWithPortRanges(baseRule RouteFirewallRule, rule *PolicyRule, r
 				if _, ok := rulesExists[ruleID]; !ok {
 					rulesExists[ruleID] = struct{}{}
 					pr := baseRule
-					pr.PortRange = portRange
+					pr.PortRange = RulePortRange{Start: portRange.Start, End: portRange.End}
 					rules = append(rules, &pr)
 				}
 			}
@@ -151,7 +151,7 @@ func generateRulesWithPortRanges(baseRule RouteFirewallRule, rule *PolicyRule, r
 }
 
 // generateRulesWithPorts generates rules when specific ports are provided.
-func generateRulesWithPorts(ctx context.Context, baseRule RouteFirewallRule, rule *PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
+func generateRulesWithPorts(ctx context.Context, baseRule RouteFirewallRule, rule *nmdata.PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
 	rules := make([]*RouteFirewallRule, 0)
 	ruleIDBase := generateRuleIDBase(rule, baseRule)
 
@@ -177,6 +177,6 @@ func generateRulesWithPorts(ctx context.Context, baseRule RouteFirewallRule, rul
 }
 
 // generateRuleIDBase generates the base rule ID for checking duplicates.
-func generateRuleIDBase(rule *PolicyRule, baseRule RouteFirewallRule) string {
+func generateRuleIDBase(rule *nmdata.PolicyRule, baseRule RouteFirewallRule) string {
 	return rule.ID + strings.Join(baseRule.SourceRanges, ",") + strconv.Itoa(FirewallRuleDirectionIN) + baseRule.Protocol + baseRule.Action
 }
diff --git a/management/server/types/firewall_rule_test.go b/shared/management/types/firewall_rule_test.go
similarity index 71%
rename from management/server/types/firewall_rule_test.go
rename to shared/management/types/firewall_rule_test.go
index 8d97a46bc..96fef3bd9 100644
--- a/management/server/types/firewall_rule_test.go
+++ b/shared/management/types/firewall_rule_test.go
@@ -8,13 +8,12 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 func TestSplitPeerSourcesByFamily(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*nmdata.Peer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -36,7 +35,7 @@ func TestSplitPeerSourcesByFamily(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*nmdata.Peer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -46,18 +45,18 @@ func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
 		},
 	}
 
-	r := &route.Route{
+	r := &nmdata.Route{
 		ID:      "route1",
 		Network: netip.MustParsePrefix("10.0.0.0/24"),
 	}
-	rule := &PolicyRule{
+	rule := &nmdata.PolicyRule{
 		PolicyID: "policy1",
 		ID:       "rule1",
-		Action:   PolicyTrafficActionAccept,
-		Protocol: PolicyRuleProtocolALL,
+		Action:   string(PolicyTrafficActionAccept),
+		Protocol: string(PolicyRuleProtocolALL),
 	}
 
-	rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
+	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
 
 	require.Len(t, rules, 1)
 	assert.Equal(t, []string{"100.64.0.1/32", "100.64.0.2/32"}, rules[0].SourceRanges, "v4 route should only have v4 sources")
@@ -65,7 +64,7 @@ func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_V6Route(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*nmdata.Peer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -75,25 +74,25 @@ func TestGenerateRouteFirewallRules_V6Route(t *testing.T) {
 		},
 	}
 
-	r := &route.Route{
+	r := &nmdata.Route{
 		ID:      "route1",
 		Network: netip.MustParsePrefix("2001:db8::/32"),
 	}
-	rule := &PolicyRule{
+	rule := &nmdata.PolicyRule{
 		PolicyID: "policy1",
 		ID:       "rule1",
-		Action:   PolicyTrafficActionAccept,
-		Protocol: PolicyRuleProtocolALL,
+		Action:   string(PolicyTrafficActionAccept),
+		Protocol: string(PolicyRuleProtocolALL),
 	}
 
-	rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
+	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
 
 	require.Len(t, rules, 1)
 	assert.Equal(t, []string{"fd00::1/128"}, rules[0].SourceRanges, "v6 route should only have v6 sources")
 }
 
 func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*nmdata.Peer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -103,19 +102,19 @@ func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
 		},
 	}
 
-	r := &route.Route{
+	r := &nmdata.Route{
 		ID:          "route1",
-		NetworkType: route.DomainNetwork,
+		NetworkType: nmdata.NetworkTypeDomain,
 		Domains:     domain.List{"example.com"},
 	}
-	rule := &PolicyRule{
+	rule := &nmdata.PolicyRule{
 		PolicyID: "policy1",
 		ID:       "rule1",
-		Action:   PolicyTrafficActionAccept,
-		Protocol: PolicyRuleProtocolALL,
+		Action:   string(PolicyTrafficActionAccept),
+		Protocol: string(PolicyRuleProtocolALL),
 	}
 
-	rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
+	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
 
 	require.Len(t, rules, 2, "dynamic route should produce both v4 and v6 rules")
 	assert.Equal(t, []string{"100.64.0.1/32", "100.64.0.2/32"}, rules[0].SourceRanges)
@@ -126,31 +125,31 @@ func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_DynamicRoute_NoV6Peers(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*nmdata.Peer{
 		{IP: netip.MustParseAddr("100.64.0.1")},
 		{IP: netip.MustParseAddr("100.64.0.2")},
 	}
 
-	r := &route.Route{
+	r := &nmdata.Route{
 		ID:          "route1",
-		NetworkType: route.DomainNetwork,
+		NetworkType: nmdata.NetworkTypeDomain,
 		Domains:     domain.List{"example.com"},
 	}
-	rule := &PolicyRule{
+	rule := &nmdata.PolicyRule{
 		PolicyID: "policy1",
 		ID:       "rule1",
-		Action:   PolicyTrafficActionAccept,
-		Protocol: PolicyRuleProtocolALL,
+		Action:   string(PolicyTrafficActionAccept),
+		Protocol: string(PolicyRuleProtocolALL),
 	}
 
-	rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
+	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
 
 	require.Len(t, rules, 1, "no v6 peers means only v4 rule")
 	assert.Equal(t, []string{"100.64.0.1/32", "100.64.0.2/32"}, rules[0].SourceRanges)
 }
 
 func TestGenerateRouteFirewallRules_IncludeIPv6False(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*nmdata.Peer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -162,35 +161,35 @@ func TestGenerateRouteFirewallRules_IncludeIPv6False(t *testing.T) {
 	}
 
 	t.Run("v6 route excluded", func(t *testing.T) {
-		r := &route.Route{
+		r := &nmdata.Route{
 			ID:      "route1",
 			Network: netip.MustParsePrefix("2001:db8::/32"),
 		}
-		rule := &PolicyRule{
+		rule := &nmdata.PolicyRule{
 			PolicyID: "policy1",
 			ID:       "rule1",
-			Action:   PolicyTrafficActionAccept,
-			Protocol: PolicyRuleProtocolALL,
+			Action:   string(PolicyTrafficActionAccept),
+			Protocol: string(PolicyRuleProtocolALL),
 		}
 
-		rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, false)
+		rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, false)
 		assert.Empty(t, rules, "v6 route should produce no rules when includeIPv6 is false")
 	})
 
 	t.Run("dynamic route only v4", func(t *testing.T) {
-		r := &route.Route{
+		r := &nmdata.Route{
 			ID:          "route1",
-			NetworkType: route.DomainNetwork,
+			NetworkType: nmdata.NetworkTypeDomain,
 			Domains:     domain.List{"example.com"},
 		}
-		rule := &PolicyRule{
+		rule := &nmdata.PolicyRule{
 			PolicyID: "policy1",
 			ID:       "rule1",
-			Action:   PolicyTrafficActionAccept,
-			Protocol: PolicyRuleProtocolALL,
+			Action:   string(PolicyTrafficActionAccept),
+			Protocol: string(PolicyRuleProtocolALL),
 		}
 
-		rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, false)
+		rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, false)
 		require.Len(t, rules, 1, "dynamic route with includeIPv6=false should produce only v4 rule")
 		assert.Equal(t, []string{"100.64.0.1/32", "100.64.0.2/32"}, rules[0].SourceRanges)
 	})
diff --git a/shared/management/types/network.go b/shared/management/types/network.go
new file mode 100644
index 000000000..ab61d7cb2
--- /dev/null
+++ b/shared/management/types/network.go
@@ -0,0 +1,29 @@
+package types
+
+import (
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+const (
+	// AllowedIPsFormat generates Wireguard AllowedIPs format (e.g. 100.64.30.1/32)
+	AllowedIPsFormat = "%s/32"
+	// AllowedIPsV6Format generates AllowedIPs format for v6 (e.g. fd12:3456:7890::1/128)
+	AllowedIPsV6Format = "%s/128"
+)
+
+type NetworkMap struct {
+	Peers               []*nmdata.Peer
+	Network             *nmdata.Network
+	Routes              []*nmdata.Route
+	DNSConfig           nbdns.Config
+	OfflinePeers        []*nmdata.Peer
+	FirewallRules       []*FirewallRule
+	RoutesFirewallRules []*RouteFirewallRule
+	AuthorizedUsers     map[string]map[string]struct{}
+	EnableSSH           bool
+	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
+	// resolution regardless of the account-global setting, for reverse-proxy
+	// domain targets.
+	ForceRoutingPeerDNSResolution bool
+}
diff --git a/shared/management/types/networkmap_components.go b/shared/management/types/networkmap_components.go
new file mode 100644
index 000000000..7742ca244
--- /dev/null
+++ b/shared/management/types/networkmap_components.go
@@ -0,0 +1,1060 @@
+package types
+
+import (
+	"context"
+	"maps"
+	"net/netip"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/netbirdio/netbird/client/ssh/auth"
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/route"
+	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+type NetworkMapComponents struct {
+	PeerID string
+
+	Network          *nmdata.Network
+	AccountSettings  *nmdata.AccountSettingsInfo
+	DNSSettings      *nmdata.DNSSettings
+	CustomZoneDomain string
+
+	Peers               map[string]*nmdata.Peer
+	Groups              map[string]*nmdata.Group
+	Policies            []*nmdata.Policy
+	Routes              []*nmdata.Route
+	NameServerGroups    []*nmdata.NameServerGroup
+	AllDNSRecords       []nmdata.SimpleRecord
+	AccountZones        []nmdata.CustomZone
+	ResourcePoliciesMap map[string][]*nmdata.Policy
+	RoutersMap          map[string]map[string]*nmdata.NetworkRouter
+	NetworkResources    []*nmdata.NetworkResource
+
+	GroupIDToUserIDs   map[string][]string
+	AllowedUserIDs     map[string]struct{}
+	PostureFailedPeers map[string]map[string]struct{}
+
+	RouterPeers map[string]*nmdata.Peer
+
+	// NetworkXIDToPublicID maps Network.ID (xid) → PublicID.
+	// Consumed by the envelope encoder to
+	// translate RoutersMap keys and NetworkResource.NetworkID references
+	// to compact uint32 ids. Legacy Calculate() doesn't consult it.
+	NetworkXIDToPublicID map[string]string
+
+	// PostureCheckXIDToPublicID maps posture.Checks.ID (xid) → PublicID.
+	// Same role as NetworkXIDToPublicID, used for PostureFailedPeers keys and
+	// policy SourcePostureChecks references.
+	PostureCheckXIDToPublicID map[string]string
+
+	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
+	// resolution regardless of the account-global setting, for reverse-proxy
+	// domain targets.
+	ForceRoutingPeerDNSResolution bool
+
+	// SkipRouteFirewallRules drops the route firewall rule computation from
+	// Calculate. A receiver without a firewall manager never reads
+	// RoutesFirewallRules, and on a routing peer with many network resources
+	// building them dominates the cost of a sync. Defaults to false so the
+	// management server keeps producing them.
+	SkipRouteFirewallRules bool
+
+	routesByPeerOnce sync.Once
+	routesByPeerIdx  map[string][]routeIndexEntry
+
+	// true when returning an empty-like map (returned instead of nil)
+	empty bool
+}
+
+type routeIndexEntry struct {
+	route    *nmdata.Route
+	viaGroup bool
+}
+
+type AccountSettingsInfo struct {
+	PeerLoginExpirationEnabled      bool
+	PeerLoginExpiration             time.Duration
+	PeerInactivityExpirationEnabled bool
+	PeerInactivityExpiration        time.Duration
+}
+
+func EmptyNetworkMapComponents(nm *NetworkMapComponents) *NetworkMapComponents {
+	nm.empty = true
+	return nm
+}
+
+func (c *NetworkMapComponents) GetPeerInfo(peerID string) *nmdata.Peer {
+	return c.Peers[peerID]
+}
+
+func (c *NetworkMapComponents) GetRouterPeerInfo(peerID string) *nmdata.Peer {
+	return c.RouterPeers[peerID]
+}
+
+func (c *NetworkMapComponents) GetGroupInfo(groupID string) *nmdata.Group {
+	return c.Groups[groupID]
+}
+
+func (c *NetworkMapComponents) IsPeerInGroup(peerID, groupID string) bool {
+	group := c.GetGroupInfo(groupID)
+	if group == nil {
+		return false
+	}
+
+	return slices.Contains(group.Peers, peerID)
+}
+
+func (c *NetworkMapComponents) GetPeerGroups(peerID string) map[string]struct{} {
+	groups := make(map[string]struct{})
+	for groupID, group := range c.Groups {
+		if slices.Contains(group.Peers, peerID) {
+			groups[groupID] = struct{}{}
+		}
+	}
+	return groups
+}
+
+func (c *NetworkMapComponents) ValidatePostureChecksOnPeer(peerID string, postureCheckIDs []string) bool {
+	_, exists := c.Peers[peerID]
+	if !exists {
+		return false
+	}
+	if len(postureCheckIDs) == 0 {
+		return true
+	}
+	for _, checkID := range postureCheckIDs {
+		if failedPeers, exists := c.PostureFailedPeers[checkID]; exists {
+			if _, failed := failedPeers[peerID]; failed {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func CalculateNetworkMapFromComponents(ctx context.Context, components *NetworkMapComponents) *NetworkMap {
+	return components.Calculate(ctx)
+}
+
+func (c *NetworkMapComponents) Calculate(ctx context.Context) *NetworkMap {
+	targetPeerID := c.PeerID
+
+	peerGroups := c.GetPeerGroups(targetPeerID)
+
+	aclPeers, firewallRules, authorizedUsers, sshEnabled := c.getPeerConnectionResources(targetPeerID)
+
+	peersToConnect, expiredPeers := c.filterPeersByLoginExpiration(aclPeers)
+
+	includeIPv6 := false
+	if p := c.GetPeerInfo(targetPeerID); p != nil {
+		includeIPv6 = p.SupportsIPv6() && p.IPv6.IsValid()
+	}
+	routesUpdate := filterAndExpandRoutes(c.getRoutesToSync(targetPeerID, peersToConnect, peerGroups), includeIPv6)
+
+	var routesFirewallRules []*RouteFirewallRule
+	if !c.SkipRouteFirewallRules {
+		routesFirewallRules = c.getPeerRoutesFirewallRules(ctx, targetPeerID, includeIPv6)
+	}
+
+	isRouter, networkResourcesRoutes, sourcePeers := c.getNetworkResourcesRoutesToSync(targetPeerID)
+	var networkResourcesFirewallRules []*RouteFirewallRule
+	if isRouter && !c.SkipRouteFirewallRules {
+		networkResourcesFirewallRules = c.getPeerNetworkResourceFirewallRules(ctx, targetPeerID, networkResourcesRoutes, includeIPv6)
+	}
+
+	peersToConnectIncludingRouters := c.addNetworksRoutingPeers(
+		networkResourcesRoutes,
+		targetPeerID,
+		peersToConnect,
+		expiredPeers,
+		isRouter,
+		sourcePeers,
+	)
+
+	dnsManagementStatus := c.getPeerDNSManagementStatusFromGroups(peerGroups)
+	dnsUpdate := nbdns.Config{
+		ServiceEnable: dnsManagementStatus,
+	}
+
+	if dnsManagementStatus {
+		var customZones []nbdns.CustomZone
+
+		if c.CustomZoneDomain != "" && len(c.AllDNSRecords) > 0 {
+			customZones = append(customZones, nbdns.CustomZone{
+				Domain:  c.CustomZoneDomain,
+				Records: toRealRecords(c.AllDNSRecords),
+			})
+		}
+
+		customZones = append(customZones, toRealZones(c.AccountZones)...)
+
+		dnsUpdate.CustomZones = customZones
+		dnsUpdate.NameServerGroups = c.getPeerNSGroupsFromGroups(targetPeerID, peerGroups)
+	}
+
+	return &NetworkMap{
+		Peers:               peersToConnectIncludingRouters,
+		Network:             c.Network,
+		Routes:              append(filterAndExpandRoutes(networkResourcesRoutes, includeIPv6), routesUpdate...),
+		DNSConfig:           dnsUpdate,
+		OfflinePeers:        expiredPeers,
+		FirewallRules:       firewallRules,
+		RoutesFirewallRules: append(networkResourcesFirewallRules, routesFirewallRules...),
+		AuthorizedUsers:     authorizedUsers,
+		EnableSSH:           sshEnabled,
+
+		ForceRoutingPeerDNSResolution: c.ForceRoutingPeerDNSResolution,
+	}
+}
+
+func (c *NetworkMapComponents) IsEmpty() bool {
+	return c.empty
+}
+
+func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) ([]*nmdata.Peer, []*FirewallRule, map[string]map[string]struct{}, bool) {
+	targetPeer := c.GetPeerInfo(targetPeerID)
+	if targetPeer == nil {
+		return nil, nil, nil, false
+	}
+
+	generateResources, getAccumulatedResources := c.connResourcesGenerator(targetPeer)
+	authorizedUsers := make(map[string]map[string]struct{})
+	sshEnabled := false
+
+	for _, policy := range c.Policies {
+		if policy == nil || !policy.Enabled {
+			continue
+		}
+
+		for _, rule := range policy.Rules {
+			if rule == nil || !rule.Enabled {
+				continue
+			}
+
+			var sourcePeers, destinationPeers []*nmdata.Peer
+			var peerInSources, peerInDestinations bool
+
+			if rule.SourceResource.Type == string(ResourceTypePeer) && rule.SourceResource.ID != "" {
+				sourcePeers, peerInSources = c.getPeerFromResource(rule.SourceResource, targetPeerID, policy.SourcePostureChecks)
+			} else {
+				sourcePeers, peerInSources = c.getAllPeersFromGroups(rule.Sources, targetPeerID, policy.SourcePostureChecks)
+			}
+
+			if rule.DestinationResource.Type == string(ResourceTypePeer) && rule.DestinationResource.ID != "" {
+				destinationPeers, peerInDestinations = c.getPeerFromResource(rule.DestinationResource, targetPeerID, nil)
+			} else {
+				destinationPeers, peerInDestinations = c.getAllPeersFromGroups(rule.Destinations, targetPeerID, nil)
+			}
+
+			if rule.Bidirectional {
+				if peerInSources {
+					generateResources(rule, destinationPeers, FirewallRuleDirectionIN)
+				}
+				if peerInDestinations {
+					generateResources(rule, sourcePeers, FirewallRuleDirectionOUT)
+				}
+			}
+
+			if peerInSources {
+				generateResources(rule, destinationPeers, FirewallRuleDirectionOUT)
+			}
+
+			if peerInDestinations {
+				generateResources(rule, sourcePeers, FirewallRuleDirectionIN)
+			}
+
+			if peerInDestinations && rule.Protocol == string(PolicyRuleProtocolNetbirdSSH) {
+				sshEnabled = true
+				switch {
+				case len(rule.AuthorizedGroups) > 0:
+					for groupID, localUsers := range rule.AuthorizedGroups {
+						userIDs, ok := c.GroupIDToUserIDs[groupID]
+						if !ok {
+							continue
+						}
+
+						if len(localUsers) == 0 {
+							localUsers = []string{auth.Wildcard}
+						}
+
+						for _, localUser := range localUsers {
+							if authorizedUsers[localUser] == nil {
+								authorizedUsers[localUser] = make(map[string]struct{})
+							}
+							for _, userID := range userIDs {
+								authorizedUsers[localUser][userID] = struct{}{}
+							}
+						}
+					}
+				case rule.AuthorizedUser != "":
+					if authorizedUsers[auth.Wildcard] == nil {
+						authorizedUsers[auth.Wildcard] = make(map[string]struct{})
+					}
+					authorizedUsers[auth.Wildcard][rule.AuthorizedUser] = struct{}{}
+				default:
+					authorizedUsers[auth.Wildcard] = c.getAllowedUserIDs()
+				}
+			} else if peerInDestinations && nmdata.PolicyRuleImpliesLegacySSH(rule) && targetPeer.SSHEnabled {
+				sshEnabled = true
+				authorizedUsers[auth.Wildcard] = c.getAllowedUserIDs()
+			}
+		}
+	}
+
+	peers, fwRules := getAccumulatedResources()
+	return peers, fwRules, authorizedUsers, sshEnabled
+}
+
+func (c *NetworkMapComponents) getAllowedUserIDs() map[string]struct{} {
+	if c.AllowedUserIDs != nil {
+		result := make(map[string]struct{}, len(c.AllowedUserIDs))
+		maps.Copy(result, c.AllowedUserIDs)
+		return result
+	}
+	return make(map[string]struct{})
+}
+
+func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *nmdata.Peer) (func(*nmdata.PolicyRule, []*nmdata.Peer, int), func() ([]*nmdata.Peer, []*FirewallRule)) {
+	rulesExists := make(map[string]struct{})
+	peersExists := make(map[string]struct{})
+	rules := make([]*FirewallRule, 0)
+	peers := make([]*nmdata.Peer, 0)
+
+	return func(rule *nmdata.PolicyRule, groupPeers []*nmdata.Peer, direction int) {
+			protocol := rule.Protocol
+			if protocol == string(PolicyRuleProtocolNetbirdSSH) {
+				protocol = string(PolicyRuleProtocolTCP)
+			}
+
+			protocolStr := protocol
+			actionStr := string(rule.Action)
+			dirStr := strconv.Itoa(direction)
+			portsJoined := strings.Join(rule.Ports, ",")
+
+			for _, peer := range groupPeers {
+				if peer == nil {
+					continue
+				}
+
+				if _, ok := peersExists[peer.ID]; !ok {
+					peers = append(peers, peer)
+					peersExists[peer.ID] = struct{}{}
+				}
+
+				peerIP := peer.IP.String()
+
+				fr := FirewallRule{
+					PolicyID:  rule.ID,
+					PeerIP:    peerIP,
+					Direction: direction,
+					Action:    actionStr,
+					Protocol:  protocolStr,
+				}
+
+				ruleID := rule.ID + peerIP + dirStr +
+					protocolStr + actionStr + portsJoined
+				if _, ok := rulesExists[ruleID]; ok {
+					continue
+				}
+				rulesExists[ruleID] = struct{}{}
+
+				if len(rule.Ports) == 0 && len(rule.PortRanges) == 0 {
+					rules = append(rules, &fr)
+				} else {
+					rules = append(rules, ExpandPortsAndRanges(fr, rule, targetPeer)...)
+				}
+
+				rules = AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, FirewallRuleContext{
+					Direction:   direction,
+					DirStr:      dirStr,
+					ProtocolStr: protocolStr,
+					ActionStr:   actionStr,
+					PortsJoined: portsJoined,
+				})
+			}
+		}, func() ([]*nmdata.Peer, []*FirewallRule) {
+			return peers, rules
+		}
+}
+
+func (c *NetworkMapComponents) getAllPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string) ([]*nmdata.Peer, bool) {
+	return c.filterPolicyPeers(c.getUniquePeerIDsFromGroupsIDs(groups), peerID, sourcePostureChecksIDs)
+}
+
+// getPeerFromResource resolves a rule side that names a peer directly. The peer is
+// subject to the same admission as a group member, so a direct peer behaves exactly
+// like a group holding only that peer.
+func (c *NetworkMapComponents) getPeerFromResource(resource nmdata.Resource, peerID string, sourcePostureChecksIDs []string) ([]*nmdata.Peer, bool) {
+	return c.filterPolicyPeers([]string{resource.ID}, peerID, sourcePostureChecksIDs)
+}
+
+// filterPolicyPeers admits the peers of one rule side: known to the components and
+// passing the rule's posture checks. It reports the admitted peers other than peerID
+// and whether peerID itself is admitted on that side.
+func (c *NetworkMapComponents) filterPolicyPeers(uniquePeerIDs []string, peerID string, sourcePostureChecksIDs []string) ([]*nmdata.Peer, bool) {
+	peerInGroups := false
+	filteredPeers := make([]*nmdata.Peer, 0, len(uniquePeerIDs))
+
+	for _, p := range uniquePeerIDs {
+		peerInfo := c.GetPeerInfo(p)
+		if peerInfo == nil {
+			continue
+		}
+
+		if _, ok := c.Peers[p]; !ok {
+			continue
+		}
+
+		if !c.ValidatePostureChecksOnPeer(p, sourcePostureChecksIDs) {
+			continue
+		}
+
+		if p == peerID {
+			peerInGroups = true
+			continue
+		}
+
+		filteredPeers = append(filteredPeers, peerInfo)
+	}
+
+	return filteredPeers, peerInGroups
+}
+
+func (c *NetworkMapComponents) getUniquePeerIDsFromGroupsIDs(groups []string) []string {
+	peerIDs := make(map[string]struct{}, len(groups))
+	for _, groupID := range groups {
+		group := c.GetGroupInfo(groupID)
+		if group == nil {
+			continue
+		}
+
+		if group.IsGroupAll() || len(groups) == 1 {
+			return group.Peers
+		}
+
+		for _, peerID := range group.Peers {
+			peerIDs[peerID] = struct{}{}
+		}
+	}
+
+	ids := make([]string, 0, len(peerIDs))
+	for peerID := range peerIDs {
+		ids = append(ids, peerID)
+	}
+
+	return ids
+}
+
+func (c *NetworkMapComponents) filterPeersByLoginExpiration(aclPeers []*nmdata.Peer) ([]*nmdata.Peer, []*nmdata.Peer) {
+	peersToConnect := make([]*nmdata.Peer, 0, len(aclPeers))
+	var expiredPeers []*nmdata.Peer
+
+	for _, p := range aclPeers {
+		expired, _ := p.LoginExpired(c.AccountSettings.PeerLoginExpiration)
+		if c.AccountSettings.PeerLoginExpirationEnabled && expired {
+			expiredPeers = append(expiredPeers, p)
+			continue
+		}
+		peersToConnect = append(peersToConnect, p)
+	}
+
+	return peersToConnect, expiredPeers
+}
+
+func (c *NetworkMapComponents) getPeerDNSManagementStatusFromGroups(peerGroups map[string]struct{}) bool {
+	for _, groupID := range c.DNSSettings.DisabledManagementGroups {
+		if _, found := peerGroups[groupID]; found {
+			return false
+		}
+	}
+	return true
+}
+
+func (c *NetworkMapComponents) getPeerNSGroupsFromGroups(peerID string, groupList map[string]struct{}) []*nbdns.NameServerGroup {
+	var peerNSGroups []*nbdns.NameServerGroup
+
+	targetPeerInfo := c.GetPeerInfo(peerID)
+	if targetPeerInfo == nil {
+		return peerNSGroups
+	}
+
+	peerIPStr := targetPeerInfo.IP.String()
+
+	for _, nsGroup := range c.NameServerGroups {
+		if !nsGroup.Enabled {
+			continue
+		}
+		for _, gID := range nsGroup.Groups {
+			if _, found := groupList[gID]; found {
+				if !c.peerIsNameserver(peerIPStr, nsGroup) {
+					peerNSGroups = append(peerNSGroups, toRealNSGroup(nsGroup))
+				}
+				break
+			}
+		}
+	}
+
+	return peerNSGroups
+}
+
+func (c *NetworkMapComponents) peerIsNameserver(peerIPStr string, nsGroup *nmdata.NameServerGroup) bool {
+	for _, ns := range nsGroup.NameServers {
+		if peerIPStr == ns.IP.String() {
+			return true
+		}
+	}
+	return false
+}
+
+// filterAndExpandRoutes drops v6 routes for non-capable peers and duplicates
+// the default v4 route (0.0.0.0/0) as ::/0 for v6-capable peers.
+// TODO: the "-v6" suffix on IDs could collide with user-supplied route IDs.
+func filterAndExpandRoutes(routes []*nmdata.Route, includeIPv6 bool) []*nmdata.Route {
+	filtered := make([]*nmdata.Route, 0, len(routes))
+	for _, r := range routes {
+		if !includeIPv6 && r.Network.Addr().Is6() {
+			continue
+		}
+		filtered = append(filtered, r)
+
+		if includeIPv6 && r.Network.Bits() == 0 && r.Network.Addr().Is4() {
+			v6 := r.Copy()
+			v6.ID = r.ID + "-v6-default"
+			v6.NetID = r.NetID + "-v6"
+			v6.Network = netip.MustParsePrefix("::/0")
+			v6.NetworkType = nmdata.NetworkTypeIPv6
+			filtered = append(filtered, v6)
+		}
+	}
+	return filtered
+}
+
+func (c *NetworkMapComponents) getRoutesToSync(peerID string, aclPeers []*nmdata.Peer, peerGroups LookupMap) []*nmdata.Route {
+	routes, peerDisabledRoutes := c.getRoutingPeerRoutes(peerID)
+	peerRoutesMembership := make(LookupMap)
+	for _, r := range append(routes, peerDisabledRoutes...) {
+		peerRoutesMembership[string(r.GetHAUniqueID())] = struct{}{}
+	}
+
+	for _, peer := range aclPeers {
+		activeRoutes, _ := c.getRoutingPeerRoutes(peer.ID)
+		groupFilteredRoutes := c.filterRoutesByGroups(activeRoutes, peerGroups)
+		filteredRoutes := c.filterRoutesFromPeersOfSameHAGroup(groupFilteredRoutes, peerRoutesMembership)
+		routes = append(routes, filteredRoutes...)
+	}
+
+	return routes
+}
+
+func (c *NetworkMapComponents) getRoutingPeerRoutes(peerID string) (enabledRoutes []*nmdata.Route, disabledRoutes []*nmdata.Route) {
+	peerInfo := c.GetPeerInfo(peerID)
+	if peerInfo == nil {
+		peerInfo = c.GetRouterPeerInfo(peerID)
+	}
+	if peerInfo == nil {
+		return enabledRoutes, disabledRoutes
+	}
+
+	seenRoute := make(map[string]struct{})
+
+	takeRoute := func(r *nmdata.Route) {
+		if _, ok := seenRoute[r.ID]; ok {
+			return
+		}
+		seenRoute[r.ID] = struct{}{}
+
+		r.Peer = peerInfo.Key
+
+		if r.Enabled {
+			enabledRoutes = append(enabledRoutes, r)
+			return
+		}
+		disabledRoutes = append(disabledRoutes, r)
+	}
+
+	for _, entry := range c.routesByPeer()[peerID] {
+		if entry.viaGroup {
+			newPeerRoute := entry.route.Copy()
+			newPeerRoute.PeerGroups = nil
+			newPeerRoute.ID = entry.route.ID + ":" + peerID
+			takeRoute(newPeerRoute)
+			continue
+		}
+		takeRoute(entry.route.Copy())
+	}
+
+	return enabledRoutes, disabledRoutes
+}
+
+func (c *NetworkMapComponents) routesByPeer() map[string][]routeIndexEntry {
+	c.routesByPeerOnce.Do(func() {
+		idx := make(map[string][]routeIndexEntry)
+		for _, r := range c.Routes {
+			for _, groupID := range r.PeerGroups {
+				group := c.GetGroupInfo(groupID)
+				if group == nil {
+					continue
+				}
+				for _, id := range group.Peers {
+					idx[id] = append(idx[id], routeIndexEntry{route: r, viaGroup: true})
+				}
+			}
+			if r.Peer != "" {
+				idx[r.Peer] = append(idx[r.Peer], routeIndexEntry{route: r})
+			}
+		}
+		c.routesByPeerIdx = idx
+	})
+
+	return c.routesByPeerIdx
+}
+
+func (c *NetworkMapComponents) filterRoutesByGroups(routes []*nmdata.Route, groupListMap LookupMap) []*nmdata.Route {
+	var filteredRoutes []*nmdata.Route
+	for _, r := range routes {
+		for _, groupID := range r.Groups {
+			_, found := groupListMap[groupID]
+			if found {
+				filteredRoutes = append(filteredRoutes, r)
+				break
+			}
+		}
+	}
+	return filteredRoutes
+}
+
+func (c *NetworkMapComponents) filterRoutesFromPeersOfSameHAGroup(routes []*nmdata.Route, peerMemberships LookupMap) []*nmdata.Route {
+	var filteredRoutes []*nmdata.Route
+	for _, r := range routes {
+		_, found := peerMemberships[string(r.GetHAUniqueID())]
+		if !found {
+			filteredRoutes = append(filteredRoutes, r)
+		}
+	}
+	return filteredRoutes
+}
+
+func (c *NetworkMapComponents) getPeerRoutesFirewallRules(ctx context.Context, peerID string, includeIPv6 bool) []*RouteFirewallRule {
+	routesFirewallRules := make([]*RouteFirewallRule, 0)
+
+	enabledRoutes, _ := c.getRoutingPeerRoutes(peerID)
+	for _, r := range enabledRoutes {
+		if len(r.AccessControlGroups) == 0 {
+			defaultPermit := c.getDefaultPermit(r, includeIPv6)
+			routesFirewallRules = append(routesFirewallRules, defaultPermit...)
+			continue
+		}
+
+		distributionPeers := c.getDistributionGroupsPeers(r)
+
+		for _, accessGroup := range r.AccessControlGroups {
+			policies := c.getAllRoutePoliciesFromGroups([]string{accessGroup})
+			rules := c.getRouteFirewallRules(ctx, peerID, policies, r, distributionPeers, includeIPv6)
+			routesFirewallRules = append(routesFirewallRules, rules...)
+		}
+	}
+
+	return routesFirewallRules
+}
+
+func (c *NetworkMapComponents) getDefaultPermit(r *nmdata.Route, includeIPv6 bool) []*RouteFirewallRule {
+	if r.Network.Addr().Is6() && !includeIPv6 {
+		return nil
+	}
+
+	sources := []string{"0.0.0.0/0"}
+	if r.Network.Addr().Is6() {
+		sources = []string{"::/0"}
+	}
+
+	rule := RouteFirewallRule{
+		SourceRanges: sources,
+		Action:       string(PolicyTrafficActionAccept),
+		Destination:  r.Network.String(),
+		Protocol:     string(PolicyRuleProtocolALL),
+		Domains:      r.Domains,
+		IsDynamic:    r.IsDynamic(),
+		RouteID:      route.ID(r.ID),
+	}
+
+	rules := []*RouteFirewallRule{&rule}
+
+	isDefaultV4 := r.Network.Addr().Is4() && r.Network.Bits() == 0
+	if includeIPv6 && (r.IsDynamic() || isDefaultV4) {
+		ruleV6 := rule
+		ruleV6.SourceRanges = []string{"::/0"}
+		if isDefaultV4 {
+			ruleV6.Destination = "::/0"
+			ruleV6.RouteID = route.ID(r.ID + "-v6-default")
+		}
+		rules = append(rules, &ruleV6)
+	}
+
+	return rules
+}
+
+func (c *NetworkMapComponents) getDistributionGroupsPeers(r *nmdata.Route) map[string]struct{} {
+	distPeers := make(map[string]struct{})
+	for _, id := range r.Groups {
+		group := c.GetGroupInfo(id)
+		if group == nil {
+			continue
+		}
+
+		for _, pID := range group.Peers {
+			distPeers[pID] = struct{}{}
+		}
+	}
+	return distPeers
+}
+
+func (c *NetworkMapComponents) getAllRoutePoliciesFromGroups(accessControlGroups []string) []*nmdata.Policy {
+	routePolicies := make([]*nmdata.Policy, 0)
+	for _, groupID := range accessControlGroups {
+		for _, policy := range c.Policies {
+			if policy == nil {
+				continue
+			}
+			for _, rule := range policy.Rules {
+				if rule == nil {
+					continue
+				}
+				if slices.Contains(rule.Destinations, groupID) {
+					routePolicies = append(routePolicies, policy)
+				}
+			}
+		}
+	}
+
+	return routePolicies
+}
+
+func (c *NetworkMapComponents) getRouteFirewallRules(ctx context.Context, peerID string, policies []*nmdata.Policy, route *nmdata.Route, distributionPeers map[string]struct{}, includeIPv6 bool) []*RouteFirewallRule {
+	var fwRules []*RouteFirewallRule
+	for _, policy := range policies {
+		if policy == nil || !policy.Enabled {
+			continue
+		}
+
+		for _, rule := range policy.Rules {
+			if rule == nil || !rule.Enabled {
+				continue
+			}
+
+			rulePeers := c.getRulePeers(rule, policy.SourcePostureChecks, peerID, distributionPeers)
+			rules := GenerateRouteFirewallRules(ctx, route, rule, rulePeers, FirewallRuleDirectionIN, includeIPv6)
+			fwRules = append(fwRules, rules...)
+		}
+	}
+	return fwRules
+}
+
+func (c *NetworkMapComponents) getRulePeers(rule *nmdata.PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}) []*nmdata.Peer {
+	distPeersWithPolicy := make(map[string]struct{})
+	for _, id := range rule.Sources {
+		group := c.GetGroupInfo(id)
+		if group == nil {
+			continue
+		}
+
+		for _, pID := range group.Peers {
+			if pID == peerID {
+				continue
+			}
+			_, distPeer := distributionPeers[pID]
+			_, valid := c.Peers[pID]
+			if distPeer && valid && c.ValidatePostureChecksOnPeer(pID, postureChecks) {
+				distPeersWithPolicy[pID] = struct{}{}
+			}
+		}
+	}
+	if rule.SourceResource.Type == string(ResourceTypePeer) && rule.SourceResource.ID != "" {
+		_, distPeer := distributionPeers[rule.SourceResource.ID]
+		_, valid := c.Peers[rule.SourceResource.ID]
+		if distPeer && valid && c.ValidatePostureChecksOnPeer(rule.SourceResource.ID, postureChecks) {
+			distPeersWithPolicy[rule.SourceResource.ID] = struct{}{}
+		}
+	}
+
+	distributionGroupPeers := make([]*nmdata.Peer, 0, len(distPeersWithPolicy))
+	for pID := range distPeersWithPolicy {
+		peerInfo := c.GetPeerInfo(pID)
+		if peerInfo == nil {
+			continue
+		}
+		distributionGroupPeers = append(distributionGroupPeers, peerInfo)
+	}
+	return distributionGroupPeers
+}
+
+func (c *NetworkMapComponents) getNetworkResourcesRoutesToSync(peerID string) (bool, []*nmdata.Route, map[string]struct{}) {
+	var isRoutingPeer bool
+	var routes []*nmdata.Route
+	allSourcePeers := make(map[string]struct{})
+
+	for _, resource := range c.NetworkResources {
+		if !resource.Enabled {
+			continue
+		}
+
+		var addSourcePeers bool
+
+		networkRoutingPeers, exists := c.RoutersMap[resource.NetworkID]
+		if exists {
+			if router, ok := networkRoutingPeers[peerID]; ok {
+				isRoutingPeer, addSourcePeers = true, true
+				routes = append(routes, c.getNetworkResourcesRoutes(resource, peerID, router)...)
+			}
+		}
+
+		newRoutes := c.processResourcePolicies(peerID, resource, networkRoutingPeers, addSourcePeers, allSourcePeers)
+		routes = append(routes, newRoutes...)
+	}
+
+	return isRoutingPeer, routes, allSourcePeers
+}
+
+func (c *NetworkMapComponents) processResourcePolicies(
+	peerID string,
+	resource *nmdata.NetworkResource,
+	networkRoutingPeers map[string]*nmdata.NetworkRouter,
+	addSourcePeers bool,
+	allSourcePeers map[string]struct{},
+) []*nmdata.Route {
+	var routes []*nmdata.Route
+
+	for _, policy := range c.ResourcePoliciesMap[resource.ID] {
+		if policy == nil || !policy.Enabled || len(policy.Rules) == 0 || policy.Rules[0] == nil {
+			continue
+		}
+		peers := c.getResourcePolicyPeers(policy)
+		if addSourcePeers {
+			for _, pID := range c.getPostureValidPeers(peers, policy.SourcePostureChecks) {
+				allSourcePeers[pID] = struct{}{}
+			}
+			continue
+		}
+
+		if slices.Contains(peers, peerID) && c.ValidatePostureChecksOnPeer(peerID, policy.SourcePostureChecks) {
+			for peerId, router := range networkRoutingPeers {
+				routes = append(routes, c.getNetworkResourcesRoutes(resource, peerId, router)...)
+			}
+			break
+		}
+	}
+
+	return routes
+}
+
+func (c *NetworkMapComponents) getResourcePolicyPeers(policy *nmdata.Policy) []string {
+	if policy.Rules[0].SourceResource.Type == string(ResourceTypePeer) && policy.Rules[0].SourceResource.ID != "" {
+		return []string{policy.Rules[0].SourceResource.ID}
+	}
+	return c.getUniquePeerIDsFromGroupsIDs(policy.SourceGroups())
+}
+
+func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *nmdata.NetworkResource, peerID string, router *nmdata.NetworkRouter) []*nmdata.Route {
+	resourceAppliedPolicies := c.ResourcePoliciesMap[resource.ID]
+
+	var routes []*nmdata.Route
+	if len(resourceAppliedPolicies) > 0 {
+		peerInfo := c.GetPeerInfo(peerID)
+		if peerInfo != nil {
+			routes = append(routes, c.networkResourceToRoute(resource, peerInfo, router))
+		}
+	}
+
+	return routes
+}
+
+func (c *NetworkMapComponents) networkResourceToRoute(resource *nmdata.NetworkResource, peer *nmdata.Peer, router *nmdata.NetworkRouter) *nmdata.Route {
+	r := &nmdata.Route{
+		ID:          resource.ID + ":" + peer.ID,
+		AccountID:   resource.AccountID,
+		Peer:        peer.Key,
+		PeerID:      peer.ID,
+		Metric:      router.Metric,
+		Masquerade:  router.Masquerade,
+		Enabled:     resource.Enabled,
+		KeepRoute:   true,
+		NetID:       resource.Name,
+		Description: resource.Description,
+	}
+
+	if resource.Type == string(ResourceTypeHost) || resource.Type == string(ResourceTypeSubnet) {
+		r.Network = resource.Prefix
+
+		r.NetworkType = nmdata.NetworkTypeIPv4
+		if resource.Prefix.Addr().Is6() {
+			r.NetworkType = nmdata.NetworkTypeIPv6
+		}
+	}
+
+	if resource.Type == string(ResourceTypeDomain) {
+		domainList, err := domain.FromStringList([]string{resource.Domain})
+		if err == nil {
+			r.Domains = domainList
+			r.NetworkType = nmdata.NetworkTypeDomain
+			r.Network = netip.PrefixFrom(netip.AddrFrom4([4]byte{192, 0, 2, 0}), 32)
+		}
+	}
+
+	return r
+}
+
+func (c *NetworkMapComponents) getPostureValidPeers(inputPeers []string, postureChecksIDs []string) []string {
+	var dest []string
+	for _, peerID := range inputPeers {
+		if c.ValidatePostureChecksOnPeer(peerID, postureChecksIDs) {
+			dest = append(dest, peerID)
+		}
+	}
+	return dest
+}
+
+func (c *NetworkMapComponents) getPeerNetworkResourceFirewallRules(ctx context.Context, peerID string, routes []*nmdata.Route, includeIPv6 bool) []*RouteFirewallRule {
+	routesFirewallRules := make([]*RouteFirewallRule, 0)
+
+	peerInfo := c.GetPeerInfo(peerID)
+	if peerInfo == nil {
+		return routesFirewallRules
+	}
+
+	for _, r := range routes {
+		if r.Peer != peerInfo.Key {
+			continue
+		}
+
+		resourceID := string(r.GetResourceID())
+		resourcePolicies := c.ResourcePoliciesMap[resourceID]
+		distributionPeers := c.getPoliciesSourcePeers(resourcePolicies)
+
+		rules := c.getRouteFirewallRules(ctx, peerID, resourcePolicies, r, distributionPeers, includeIPv6)
+		for _, rule := range rules {
+			if len(rule.SourceRanges) > 0 {
+				routesFirewallRules = append(routesFirewallRules, rule)
+			}
+		}
+	}
+
+	return routesFirewallRules
+}
+
+func (c *NetworkMapComponents) getPoliciesSourcePeers(policies []*nmdata.Policy) map[string]struct{} {
+	sourcePeers := make(map[string]struct{})
+
+	for _, policy := range policies {
+		if policy == nil {
+			continue
+		}
+		for _, rule := range policy.Rules {
+			if rule == nil {
+				continue
+			}
+			for _, sourceGroup := range rule.Sources {
+				group := c.GetGroupInfo(sourceGroup)
+				if group == nil {
+					continue
+				}
+
+				for _, peer := range group.Peers {
+					sourcePeers[peer] = struct{}{}
+				}
+			}
+
+			if rule.SourceResource.Type == string(ResourceTypePeer) && rule.SourceResource.ID != "" {
+				sourcePeers[rule.SourceResource.ID] = struct{}{}
+			}
+		}
+	}
+
+	return sourcePeers
+}
+
+func (c *NetworkMapComponents) addNetworksRoutingPeers(
+	networkResourcesRoutes []*nmdata.Route,
+	peerID string,
+	peersToConnect []*nmdata.Peer,
+	expiredPeers []*nmdata.Peer,
+	isRouter bool,
+	sourcePeers map[string]struct{},
+) []*nmdata.Peer {
+
+	networkRoutesPeers := make(map[string]struct{}, len(networkResourcesRoutes))
+	for _, r := range networkResourcesRoutes {
+		networkRoutesPeers[r.PeerID] = struct{}{}
+	}
+
+	delete(sourcePeers, peerID)
+	delete(networkRoutesPeers, peerID)
+
+	for _, existingPeer := range peersToConnect {
+		delete(sourcePeers, existingPeer.ID)
+		delete(networkRoutesPeers, existingPeer.ID)
+	}
+	for _, expPeer := range expiredPeers {
+		delete(sourcePeers, expPeer.ID)
+		delete(networkRoutesPeers, expPeer.ID)
+	}
+
+	missingPeers := make(map[string]struct{}, len(sourcePeers)+len(networkRoutesPeers))
+	if isRouter {
+		for p := range sourcePeers {
+			missingPeers[p] = struct{}{}
+		}
+	}
+	for p := range networkRoutesPeers {
+		missingPeers[p] = struct{}{}
+	}
+
+	for p := range missingPeers {
+		peerInfo := c.GetPeerInfo(p)
+		if peerInfo == nil {
+			peerInfo = c.GetRouterPeerInfo(p)
+		}
+		if peerInfo != nil {
+			peersToConnect = append(peersToConnect, peerInfo)
+		}
+	}
+
+	return peersToConnect
+}
+
+type FirewallRuleContext struct {
+	Direction   int
+	DirStr      string
+	ProtocolStr string
+	ActionStr   string
+	PortsJoined string
+}
+
+func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *nmdata.Peer, rule *nmdata.PolicyRule, rc FirewallRuleContext) []*FirewallRule {
+	if !peer.IPv6.IsValid() || !targetPeer.SupportsIPv6() || !targetPeer.IPv6.IsValid() {
+		return rules
+	}
+
+	v6IP := peer.IPv6.String()
+	v6RuleID := rule.ID + v6IP + rc.DirStr + rc.ProtocolStr + rc.ActionStr + rc.PortsJoined
+	if _, ok := rulesExists[v6RuleID]; ok {
+		return rules
+	}
+	rulesExists[v6RuleID] = struct{}{}
+
+	v6fr := FirewallRule{
+		PolicyID:  rule.ID,
+		PeerIP:    v6IP,
+		Direction: rc.Direction,
+		Action:    rc.ActionStr,
+		Protocol:  rc.ProtocolStr,
+	}
+	if len(rule.Ports) == 0 && len(rule.PortRanges) == 0 {
+		return append(rules, &v6fr)
+	}
+	return append(rules, ExpandPortsAndRanges(v6fr, rule, targetPeer)...)
+}
diff --git a/management/server/types/networkmap_components_compact.go b/shared/management/types/networkmap_components_compact.go
similarity index 79%
rename from management/server/types/networkmap_components_compact.go
rename to shared/management/types/networkmap_components_compact.go
index b60f8bdb1..b45bc3e40 100644
--- a/management/server/types/networkmap_components_compact.go
+++ b/shared/management/types/networkmap_components_compact.go
@@ -1,11 +1,7 @@
 package types
 
 import (
-	nbdns "github.com/netbirdio/netbird/dns"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/route"
+	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 type GroupCompact struct {
@@ -16,26 +12,26 @@ type GroupCompact struct {
 type NetworkMapComponentsCompact struct {
 	PeerID string
 
-	Network          *Network
-	AccountSettings  *AccountSettingsInfo
-	DNSSettings      *DNSSettings
+	Network          *nmdata.Network
+	AccountSettings  *nmdata.AccountSettingsInfo
+	DNSSettings      *nmdata.DNSSettings
 	CustomZoneDomain string
 
-	AllPeers          []*nbpeer.Peer
+	AllPeers          []*nmdata.Peer
 	PeerIndexes       []int
 	RouterPeerIndexes []int
 
 	Groups              map[string]*GroupCompact
-	AllPolicies         []*Policy
+	AllPolicies         []*nmdata.Policy
 	PolicyIndexes       []int
 	ResourcePoliciesMap map[string][]int
-	Routes              []*route.Route
-	NameServerGroups    []*nbdns.NameServerGroup
-	AllDNSRecords       []nbdns.SimpleRecord
-	AccountZones        []nbdns.CustomZone
+	Routes              []*nmdata.Route
+	NameServerGroups    []*nmdata.NameServerGroup
+	AllDNSRecords       []nmdata.SimpleRecord
+	AccountZones        []nmdata.CustomZone
 
-	RoutersMap       map[string]map[string]*routerTypes.NetworkRouter
-	NetworkResources []*resourceTypes.NetworkResource
+	RoutersMap       map[string]map[string]*nmdata.NetworkRouter
+	NetworkResources []*nmdata.NetworkResource
 
 	GroupIDToUserIDs   map[string][]string
 	AllowedUserIDs     map[string]struct{}
@@ -44,7 +40,7 @@ type NetworkMapComponentsCompact struct {
 
 func (c *NetworkMapComponents) ToCompact() *NetworkMapComponentsCompact {
 	peerToIndex := make(map[string]int)
-	var allPeers []*nbpeer.Peer
+	var allPeers []*nmdata.Peer
 
 	for id, peer := range c.Peers {
 		if _, exists := peerToIndex[id]; !exists {
@@ -84,8 +80,8 @@ func (c *NetworkMapComponents) ToCompact() *NetworkMapComponentsCompact {
 		}
 	}
 
-	policyToIndex := make(map[*Policy]int)
-	var allPolicies []*Policy
+	policyToIndex := make(map[*nmdata.Policy]int)
+	var allPolicies []*nmdata.Policy
 
 	for _, policy := range c.Policies {
 		if _, exists := policyToIndex[policy]; !exists {
@@ -150,7 +146,7 @@ func (c *NetworkMapComponents) ToCompact() *NetworkMapComponentsCompact {
 }
 
 func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
-	peers := make(map[string]*nbpeer.Peer, len(c.PeerIndexes))
+	peers := make(map[string]*nmdata.Peer, len(c.PeerIndexes))
 	for _, idx := range c.PeerIndexes {
 		if idx >= 0 && idx < len(c.AllPeers) {
 			peer := c.AllPeers[idx]
@@ -158,7 +154,7 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 		}
 	}
 
-	routerPeers := make(map[string]*nbpeer.Peer, len(c.RouterPeerIndexes))
+	routerPeers := make(map[string]*nmdata.Peer, len(c.RouterPeerIndexes))
 	for _, idx := range c.RouterPeerIndexes {
 		if idx >= 0 && idx < len(c.AllPeers) {
 			peer := c.AllPeers[idx]
@@ -166,7 +162,7 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 		}
 	}
 
-	groups := make(map[string]*Group, len(c.Groups))
+	groups := make(map[string]*nmdata.Group, len(c.Groups))
 	for id, gc := range c.Groups {
 		peerIDs := make([]string, 0, len(gc.PeerIndexes))
 		for _, idx := range gc.PeerIndexes {
@@ -174,25 +170,24 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 				peerIDs = append(peerIDs, c.AllPeers[idx].ID)
 			}
 		}
-		groups[id] = &Group{
-			ID:    id,
+		groups[id] = &nmdata.Group{
 			Name:  gc.Name,
 			Peers: peerIDs,
 		}
 	}
 
-	policies := make([]*Policy, len(c.PolicyIndexes))
+	policies := make([]*nmdata.Policy, len(c.PolicyIndexes))
 	for i, idx := range c.PolicyIndexes {
 		if idx >= 0 && idx < len(c.AllPolicies) {
 			policies[i] = c.AllPolicies[idx]
 		}
 	}
 
-	var resourcePoliciesMap map[string][]*Policy
+	var resourcePoliciesMap map[string][]*nmdata.Policy
 	if len(c.ResourcePoliciesMap) > 0 {
-		resourcePoliciesMap = make(map[string][]*Policy, len(c.ResourcePoliciesMap))
+		resourcePoliciesMap = make(map[string][]*nmdata.Policy, len(c.ResourcePoliciesMap))
 		for resID, indexes := range c.ResourcePoliciesMap {
-			pols := make([]*Policy, 0, len(indexes))
+			pols := make([]*nmdata.Policy, 0, len(indexes))
 			for _, idx := range indexes {
 				if idx >= 0 && idx < len(c.AllPolicies) {
 					pols = append(pols, c.AllPolicies[idx])
diff --git a/shared/management/types/nmdata_convert.go b/shared/management/types/nmdata_convert.go
new file mode 100644
index 000000000..2a7998773
--- /dev/null
+++ b/shared/management/types/nmdata_convert.go
@@ -0,0 +1,70 @@
+package types
+
+import (
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+)
+
+// This file holds the twin→real converters that survive the twin-NetworkMap
+// refactor: only the DNS materialization. NetworkMap.DNSConfig stays a real
+// nbdns.Config (the client DNS type), so Calculate converts the twin DNS
+// components to nbdns at the output boundary. Peers/Routes/Network flow as
+// twins all the way through and need no conversion.
+
+func toRealNSGroup(n *nmdata.NameServerGroup) *nbdns.NameServerGroup {
+	if n == nil {
+		return nil
+	}
+	nameServers := make([]nbdns.NameServer, 0, len(n.NameServers))
+	for _, ns := range n.NameServers {
+		nameServers = append(nameServers, nbdns.NameServer{
+			IP:     ns.IP,
+			NSType: nbdns.NameServerType(ns.NSType),
+			Port:   ns.Port,
+		})
+	}
+	return &nbdns.NameServerGroup{
+		ID:                   n.ID,
+		Name:                 n.Name,
+		Description:          n.Description,
+		NameServers:          nameServers,
+		Groups:               n.Groups,
+		Primary:              n.Primary,
+		Domains:              n.Domains,
+		Enabled:              n.Enabled,
+		SearchDomainsEnabled: n.SearchDomainsEnabled,
+	}
+}
+
+func toRealRecords(recs []nmdata.SimpleRecord) []nbdns.SimpleRecord {
+	if recs == nil {
+		return nil
+	}
+	out := make([]nbdns.SimpleRecord, len(recs))
+	for i, r := range recs {
+		out[i] = nbdns.SimpleRecord{
+			Name:  r.Name,
+			Type:  r.Type,
+			Class: r.Class,
+			TTL:   r.TTL,
+			RData: r.RData,
+		}
+	}
+	return out
+}
+
+func toRealZones(zones []nmdata.CustomZone) []nbdns.CustomZone {
+	if zones == nil {
+		return nil
+	}
+	out := make([]nbdns.CustomZone, len(zones))
+	for i, z := range zones {
+		out[i] = nbdns.CustomZone{
+			Domain:               z.Domain,
+			Records:              toRealRecords(z.Records),
+			SearchDomainDisabled: z.SearchDomainDisabled,
+			NonAuthoritative:     z.NonAuthoritative,
+		}
+	}
+	return out
+}
diff --git a/shared/management/types/policyrule.go b/shared/management/types/policyrule.go
new file mode 100644
index 000000000..c951b1487
--- /dev/null
+++ b/shared/management/types/policyrule.go
@@ -0,0 +1,139 @@
+package types
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// PolicyTrafficActionType action type for the firewall
+type PolicyTrafficActionType string
+
+// PolicyRuleProtocolType type of traffic
+type PolicyRuleProtocolType string
+
+const (
+	// PolicyTrafficActionAccept indicates that the traffic is accepted
+	PolicyTrafficActionAccept = PolicyTrafficActionType("accept")
+	// PolicyTrafficActionDrop indicates that the traffic is dropped
+	PolicyTrafficActionDrop = PolicyTrafficActionType("drop")
+)
+
+const (
+	// PolicyRuleProtocolALL type of traffic
+	PolicyRuleProtocolALL = PolicyRuleProtocolType("all")
+	// PolicyRuleProtocolTCP type of traffic
+	PolicyRuleProtocolTCP = PolicyRuleProtocolType("tcp")
+	// PolicyRuleProtocolUDP type of traffic
+	PolicyRuleProtocolUDP = PolicyRuleProtocolType("udp")
+	// PolicyRuleProtocolICMP type of traffic
+	PolicyRuleProtocolICMP = PolicyRuleProtocolType("icmp")
+	// PolicyRuleProtocolNetbirdSSH type of traffic
+	PolicyRuleProtocolNetbirdSSH = PolicyRuleProtocolType("netbird-ssh")
+)
+
+// RulePortRange represents a range of ports for a firewall rule.
+type RulePortRange struct {
+	Start uint16
+	End   uint16
+}
+
+func (r *RulePortRange) ToProto() *proto.PortInfo {
+	return &proto.PortInfo{
+		PortSelection: &proto.PortInfo_Range_{
+			Range: &proto.PortInfo_Range{
+				Start: uint32(r.Start),
+				End:   uint32(r.End),
+			},
+		},
+	}
+}
+
+func (r *RulePortRange) Equal(other *RulePortRange) bool {
+	return r.Start == other.Start && r.End == other.End
+}
+
+func ParseRuleString(rule string) (PolicyRuleProtocolType, RulePortRange, error) {
+	rule = strings.TrimSpace(strings.ToLower(rule))
+	if rule == "all" {
+		return PolicyRuleProtocolALL, RulePortRange{}, nil
+	}
+	if rule == "icmp" {
+		return PolicyRuleProtocolICMP, RulePortRange{}, nil
+	}
+
+	split := strings.Split(rule, "/")
+	if len(split) != 2 {
+		return "", RulePortRange{}, errors.New("invalid rule format: expected protocol/port or protocol/port-range")
+	}
+
+	protoStr := strings.TrimSpace(split[0])
+	portStr := strings.TrimSpace(split[1])
+
+	var protocol PolicyRuleProtocolType
+	switch protoStr {
+	case "tcp":
+		protocol = PolicyRuleProtocolTCP
+	case "udp":
+		protocol = PolicyRuleProtocolUDP
+	case "icmp":
+		return "", RulePortRange{}, errors.New("icmp does not accept ports; use 'icmp' without '/…'")
+	case "netbird-ssh":
+		return PolicyRuleProtocolNetbirdSSH, RulePortRange{Start: nativeSSHPortNumber, End: nativeSSHPortNumber}, nil
+	default:
+		return "", RulePortRange{}, fmt.Errorf("invalid protocol: %q", protoStr)
+	}
+
+	portRange, err := parsePortRange(portStr)
+	if err != nil {
+		return "", RulePortRange{}, err
+	}
+
+	return protocol, portRange, nil
+}
+
+func parsePortRange(portStr string) (RulePortRange, error) {
+	if strings.Contains(portStr, "-") {
+		rangeParts := strings.Split(portStr, "-")
+		if len(rangeParts) != 2 {
+			return RulePortRange{}, fmt.Errorf("invalid port range %q", portStr)
+		}
+		start, err := parsePort(strings.TrimSpace(rangeParts[0]))
+		if err != nil {
+			return RulePortRange{}, err
+		}
+		end, err := parsePort(strings.TrimSpace(rangeParts[1]))
+		if err != nil {
+			return RulePortRange{}, err
+		}
+		if start > end {
+			return RulePortRange{}, fmt.Errorf("invalid port range: start %d > end %d", start, end)
+		}
+		return RulePortRange{Start: uint16(start), End: uint16(end)}, nil
+	}
+
+	p, err := parsePort(portStr)
+	if err != nil {
+		return RulePortRange{}, err
+	}
+
+	return RulePortRange{Start: uint16(p), End: uint16(p)}, nil
+}
+
+func parsePort(portStr string) (int, error) {
+
+	if portStr == "" {
+		return 0, errors.New("empty port")
+	}
+	p, err := strconv.Atoi(portStr)
+	if err != nil {
+		return 0, fmt.Errorf("invalid port %q: %w", portStr, err)
+	}
+	if p < 1 || p > 65535 {
+		return 0, fmt.Errorf("port out of range (1–65535): %d", p)
+	}
+	return p, nil
+}
diff --git a/shared/management/types/resource.go b/shared/management/types/resource.go
new file mode 100644
index 000000000..87f27db49
--- /dev/null
+++ b/shared/management/types/resource.go
@@ -0,0 +1,19 @@
+package types
+
+type ResourceType string
+
+const (
+	ResourceTypePeer   ResourceType = "peer"
+	ResourceTypeDomain ResourceType = "domain"
+	ResourceTypeHost   ResourceType = "host"
+	ResourceTypeSubnet ResourceType = "subnet"
+)
+
+func (t ResourceType) Valid() bool {
+	switch t {
+	case ResourceTypePeer, ResourceTypeDomain, ResourceTypeHost, ResourceTypeSubnet:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/management/server/types/route_firewall_rule.go b/shared/management/types/route_firewall_rule.go
similarity index 100%
rename from management/server/types/route_firewall_rule.go
rename to shared/management/types/route_firewall_rule.go
diff --git a/shared/profiling/profiling.go b/shared/profiling/profiling.go
new file mode 100644
index 000000000..1d893048a
--- /dev/null
+++ b/shared/profiling/profiling.go
@@ -0,0 +1,127 @@
+package profiling
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+	"net/url"
+	"os"
+	"strings"
+	"sync/atomic"
+
+	"github.com/caarlos0/env/v11"
+	"github.com/grafana/pyroscope-go"
+	log "github.com/sirupsen/logrus"
+)
+
+var errNotConfigured = errors.New("pyroscope not configured")
+
+var started atomic.Bool
+
+type config struct {
+	Address  string `env:"NB_PYROSCOPE_ADDRESS"`
+	User     string `env:"NB_PYROSCOPE_USER,notEmpty"`
+	Password string `env:"NB_PYROSCOPE_PASSWORD,notEmpty"`
+}
+
+func Start(applicationName string) func() {
+	noop := func() {}
+
+	cfg, err := loadConfig()
+	switch {
+	case errors.Is(err, errNotConfigured):
+		log.Info("pyroscope not configured, continuous profiling disabled")
+		return noop
+	case err != nil:
+		log.Errorf("failed to load pyroscope config: %v", err)
+		return noop
+	}
+
+	// pprof allows one CPU profile per process, so a second profiler (e.g. the
+	// signal server inside the combined binary) would only log errors.
+	if !started.CompareAndSwap(false, true) {
+		log.Warnf("continuous profiling already running in this process, not starting it for %s", applicationName)
+		return noop
+	}
+
+	tags := map[string]string{}
+	if hostname, err := os.Hostname(); err == nil {
+		tags["instance"] = hostname
+	} else {
+		log.Warnf("failed to resolve hostname for profile tags: %v", err)
+	}
+
+	profiler, err := pyroscope.Start(pyroscope.Config{
+		ApplicationName:   applicationName,
+		ServerAddress:     cfg.Address,
+		BasicAuthUser:     cfg.User,
+		BasicAuthPassword: cfg.Password,
+		Logger:            log.StandardLogger(),
+		Tags:              tags,
+		ProfileTypes: []pyroscope.ProfileType{
+			pyroscope.ProfileCPU,
+			pyroscope.ProfileAllocObjects,
+			pyroscope.ProfileAllocSpace,
+			pyroscope.ProfileInuseObjects,
+			pyroscope.ProfileInuseSpace,
+		},
+	})
+	if err != nil {
+		started.Store(false)
+		log.Errorf("failed to start continuous profiling: %v", err)
+		return noop
+	}
+
+	return func() {
+		_ = profiler.Stop()
+		started.Store(false)
+	}
+}
+
+func loadConfig() (config, error) {
+	var cfg config
+	if err := env.Parse(&cfg); err != nil {
+		if cfg.Address == "" {
+			return cfg, errNotConfigured
+		}
+		return cfg, fmt.Errorf("failed to parse pyroscope config: %w", err)
+	}
+
+	if cfg.Address == "" {
+		return cfg, errNotConfigured
+	}
+	if err := validateAddress(cfg.Address); err != nil {
+		return cfg, err
+	}
+
+	return cfg, nil
+}
+
+// validateAddress refuses to send the basic-auth credentials in plaintext to
+// anything but a loopback or private endpoint.
+func validateAddress(address string) error {
+	u, err := url.Parse(address)
+	if err != nil {
+		return fmt.Errorf("invalid pyroscope address %q: %w", address, err)
+	}
+
+	switch u.Scheme {
+	case "https":
+		return nil
+	case "http":
+		if isLocalOrPrivate(u.Hostname()) {
+			return nil
+		}
+		return fmt.Errorf("insecure pyroscope address %q: use https for non-local endpoints", address)
+	default:
+		return fmt.Errorf("pyroscope address %q must use http or https", address)
+	}
+}
+
+func isLocalOrPrivate(host string) bool {
+	if host == "localhost" || strings.HasSuffix(host, ".localhost") {
+		return true
+	}
+	ip, err := netip.ParseAddr(host)
+	return err == nil && (ip.IsLoopback() || ip.IsPrivate())
+}
diff --git a/shared/profiling/profiling_test.go b/shared/profiling/profiling_test.go
new file mode 100644
index 000000000..68e56bb4c
--- /dev/null
+++ b/shared/profiling/profiling_test.go
@@ -0,0 +1,202 @@
+package profiling
+
+import (
+	"os"
+	"testing"
+
+	log "github.com/sirupsen/logrus"
+	logtest "github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStartSkipsSecondProfilerInProcess(t *testing.T) {
+	clearEnv(t)
+	t.Setenv("NB_PYROSCOPE_ADDRESS", "http://127.0.0.1:1")
+	t.Setenv("NB_PYROSCOPE_USER", "user")
+	t.Setenv("NB_PYROSCOPE_PASSWORD", "token")
+
+	started.Store(true)
+	t.Cleanup(func() { started.Store(false) })
+	hook := logtest.NewGlobal()
+	t.Cleanup(hook.Reset)
+
+	stop := Start("netbird-second")
+	stop()
+
+	assert.True(t, started.Load(), "the running profiler must stay marked as started")
+	entry := hook.LastEntry()
+	require.NotNil(t, entry, "the skipped start must be logged")
+	assert.Equal(t, log.WarnLevel, entry.Level)
+	assert.Contains(t, entry.Message, "already running")
+}
+
+func TestLoadConfig(t *testing.T) {
+	tests := []struct {
+		name     string
+		env      map[string]string
+		expected config
+		errIs    error
+		wantErr  bool
+	}{
+		{
+			name:  "address unset disables profiling",
+			errIs: errNotConfigured,
+		},
+		{
+			name:  "empty address disables profiling",
+			env:   map[string]string{"NB_PYROSCOPE_ADDRESS": ""},
+			errIs: errNotConfigured,
+		},
+		{
+			name: "credentials without address disable profiling",
+			env: map[string]string{
+				"NB_PYROSCOPE_USER":     "123456",
+				"NB_PYROSCOPE_PASSWORD": "token",
+			},
+			errIs: errNotConfigured,
+		},
+		{
+			name: "address without credentials fails",
+			env: map[string]string{
+				"NB_PYROSCOPE_ADDRESS": "https://profiles-prod-001.grafana.net",
+			},
+			wantErr: true,
+		},
+		{
+			name: "address with empty credentials fails",
+			env: map[string]string{
+				"NB_PYROSCOPE_ADDRESS":  "https://profiles-prod-001.grafana.net",
+				"NB_PYROSCOPE_USER":     "",
+				"NB_PYROSCOPE_PASSWORD": "",
+			},
+			wantErr: true,
+		},
+		{
+			name: "address without password fails",
+			env: map[string]string{
+				"NB_PYROSCOPE_ADDRESS": "https://profiles-prod-001.grafana.net",
+				"NB_PYROSCOPE_USER":    "123456",
+			},
+			wantErr: true,
+		},
+		{
+			name: "full configuration",
+			env: map[string]string{
+				"NB_PYROSCOPE_ADDRESS":  "https://profiles-prod-001.grafana.net",
+				"NB_PYROSCOPE_USER":     "123456",
+				"NB_PYROSCOPE_PASSWORD": "token",
+			},
+			expected: config{
+				Address:  "https://profiles-prod-001.grafana.net",
+				User:     "123456",
+				Password: "token",
+			},
+		},
+		{
+			name: "http to loopback is allowed",
+			env: map[string]string{
+				"NB_PYROSCOPE_ADDRESS":  "http://127.0.0.1:4040",
+				"NB_PYROSCOPE_USER":     "123456",
+				"NB_PYROSCOPE_PASSWORD": "token",
+			},
+			expected: config{
+				Address:  "http://127.0.0.1:4040",
+				User:     "123456",
+				Password: "token",
+			},
+		},
+		{
+			name: "http to localhost is allowed",
+			env: map[string]string{
+				"NB_PYROSCOPE_ADDRESS":  "http://localhost:4040",
+				"NB_PYROSCOPE_USER":     "123456",
+				"NB_PYROSCOPE_PASSWORD": "token",
+			},
+			expected: config{
+				Address:  "http://localhost:4040",
+				User:     "123456",
+				Password: "token",
+			},
+		},
+		{
+			name: "http to private network is allowed",
+			env: map[string]string{
+				"NB_PYROSCOPE_ADDRESS":  "http://10.0.0.5:4040",
+				"NB_PYROSCOPE_USER":     "123456",
+				"NB_PYROSCOPE_PASSWORD": "token",
+			},
+			expected: config{
+				Address:  "http://10.0.0.5:4040",
+				User:     "123456",
+				Password: "token",
+			},
+		},
+		{
+			name: "http to public host is rejected",
+			env: map[string]string{
+				"NB_PYROSCOPE_ADDRESS":  "http://pyroscope.example.com",
+				"NB_PYROSCOPE_USER":     "123456",
+				"NB_PYROSCOPE_PASSWORD": "token",
+			},
+			wantErr: true,
+		},
+		{
+			name: "http to public address is rejected",
+			env: map[string]string{
+				"NB_PYROSCOPE_ADDRESS":  "http://203.0.113.10:4040",
+				"NB_PYROSCOPE_USER":     "123456",
+				"NB_PYROSCOPE_PASSWORD": "token",
+			},
+			wantErr: true,
+		},
+		{
+			name: "address without scheme is rejected",
+			env: map[string]string{
+				"NB_PYROSCOPE_ADDRESS":  "pyroscope.example.com:4040",
+				"NB_PYROSCOPE_USER":     "123456",
+				"NB_PYROSCOPE_PASSWORD": "token",
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			clearEnv(t)
+			for k, v := range tt.env {
+				t.Setenv(k, v)
+			}
+
+			cfg, err := loadConfig()
+
+			switch {
+			case tt.errIs != nil:
+				require.ErrorIs(t, err, tt.errIs)
+			case tt.wantErr:
+				require.Error(t, err)
+				require.NotErrorIs(t, err, errNotConfigured)
+			default:
+				require.NoError(t, err)
+				assert.Equal(t, tt.expected, cfg)
+			}
+		})
+	}
+}
+
+func TestStartWithoutConfigurationIsNoop(t *testing.T) {
+	clearEnv(t)
+
+	stop := Start("netbird-test")
+	require.NotNil(t, stop)
+	stop()
+}
+
+func clearEnv(t *testing.T) {
+	t.Helper()
+
+	for _, k := range []string{"NB_PYROSCOPE_ADDRESS", "NB_PYROSCOPE_USER", "NB_PYROSCOPE_PASSWORD"} {
+		t.Setenv(k, "")
+		require.NoError(t, os.Unsetenv(k))
+	}
+}
diff --git a/management/server/http/middleware/rate_limiter.go b/shared/ratelimit/rate_limiter.go
similarity index 77%
rename from management/server/http/middleware/rate_limiter.go
rename to shared/ratelimit/rate_limiter.go
index bfd44afee..ff9a123a3 100644
--- a/management/server/http/middleware/rate_limiter.go
+++ b/shared/ratelimit/rate_limiter.go
@@ -1,7 +1,8 @@
-package middleware
+package ratelimit
 
 import (
 	"context"
+	"encoding/json"
 	"net"
 	"net/http"
 	"os"
@@ -13,13 +14,14 @@ import (
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/time/rate"
 
-	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 const (
-	RateLimitingEnabledEnv = "NB_API_RATE_LIMITING_ENABLED"
-	RateLimitingBurstEnv   = "NB_API_RATE_LIMITING_BURST"
-	RateLimitingRPMEnv     = "NB_API_RATE_LIMITING_RPM"
+	RateLimitingEnabledEnv        = "NB_API_RATE_LIMITING_ENABLED"
+	RateLimitingBurstEnv          = "NB_API_RATE_LIMITING_BURST"
+	RateLimitingRPMEnv            = "NB_API_RATE_LIMITING_RPM"
+	RateLimitingTrustedProxiesEnv = "NB_API_RATE_LIMITING_TRUSTED_PROXIES"
 
 	defaultAPIRPM   = 6
 	defaultAPIBurst = 500
@@ -35,6 +37,9 @@ type RateLimiterConfig struct {
 	CleanupInterval time.Duration
 	// LimiterTTL defines how long a limiter should be kept after last use (age threshold for removal)
 	LimiterTTL time.Duration
+	// TrustedProxies lists the upstream proxies whose forwarding headers may be
+	// believed. Empty means requests are keyed by their direct peer address.
+	TrustedProxies *trustedproxy.List
 }
 
 // DefaultRateLimiterConfig returns a default configuration
@@ -76,11 +81,18 @@ func RateLimiterConfigFromEnv() (cfg *RateLimiterConfig, enabled bool) {
 		burst = defaultAPIBurst
 	}
 
+	trusted, err := trustedproxy.Parse(os.Getenv(RateLimitingTrustedProxiesEnv))
+	if err != nil {
+		log.Warnf("parsing %s env var: %v, trusting no proxies", RateLimitingTrustedProxiesEnv, err)
+		trusted = nil
+	}
+
 	return &RateLimiterConfig{
 		RequestsPerMinute: float64(rpm),
 		Burst:             burst,
 		CleanupInterval:   6 * time.Hour,
 		LimiterTTL:        24 * time.Hour,
+		TrustedProxies:    trusted,
 	}, os.Getenv(RateLimitingEnabledEnv) == "true"
 }
 
@@ -250,17 +262,42 @@ func (rl *APIRateLimiter) Middleware(next http.Handler) http.Handler {
 			next.ServeHTTP(w, r)
 			return
 		}
-		clientIP := getClientIP(r)
+		clientIP := getClientIP(r, rl.config.TrustedProxies)
 		if !rl.Allow(clientIP) {
-			util.WriteErrorResponse("rate limit exceeded, please try again later", http.StatusTooManyRequests, w)
+			writeTooManyRequests(w)
 			return
 		}
 		next.ServeHTTP(w, r)
 	})
 }
 
-// getClientIP extracts the client IP address from the request.
-func getClientIP(r *http.Request) string {
+// errorResponse is the JSON body of a rejected request.
+type errorResponse struct {
+	Message string `json:"message"`
+	Code    int    `json:"code"`
+}
+
+// writeTooManyRequests writes a JSON error response with status 429 Too Many Requests.
+func writeTooManyRequests(w http.ResponseWriter) {
+	w.Header().Set("Content-Type", "application/json; charset=UTF-8")
+	w.WriteHeader(http.StatusTooManyRequests)
+	if err := json.NewEncoder(w).Encode(errorResponse{
+		Message: "rate limit exceeded, please try again later",
+		Code:    http.StatusTooManyRequests,
+	}); err != nil {
+		log.Debugf("writing rate limit response: %v", err)
+	}
+}
+
+// getClientIP extracts the client IP address from the request. Forwarding headers
+// are used only when the request arrives from a trusted proxy.
+func getClientIP(r *http.Request, trusted *trustedproxy.List) string {
+	if !trusted.Empty() {
+		if addr := trusted.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For")); addr.IsValid() {
+			return addr.String()
+		}
+	}
+
 	ip, _, err := net.SplitHostPort(r.RemoteAddr)
 	if err != nil {
 		return r.RemoteAddr
diff --git a/management/server/http/middleware/rate_limiter_test.go b/shared/ratelimit/rate_limiter_test.go
similarity index 85%
rename from management/server/http/middleware/rate_limiter_test.go
rename to shared/ratelimit/rate_limiter_test.go
index 4b97d1874..c43b8e03d 100644
--- a/management/server/http/middleware/rate_limiter_test.go
+++ b/shared/ratelimit/rate_limiter_test.go
@@ -1,4 +1,4 @@
-package middleware
+package ratelimit
 
 import (
 	"fmt"
@@ -9,6 +9,9 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 func TestAPIRateLimiter_Allow(t *testing.T) {
@@ -63,6 +66,8 @@ func TestAPIRateLimiter_Middleware(t *testing.T) {
 	rr := httptest.NewRecorder()
 	handler.ServeHTTP(rr, req)
 	assert.Equal(t, http.StatusTooManyRequests, rr.Code)
+	assert.Equal(t, "application/json; charset=UTF-8", rr.Header().Get("Content-Type"))
+	assert.JSONEq(t, `{"message":"rate limit exceeded, please try again later","code":429}`, rr.Body.String())
 }
 
 func TestAPIRateLimiter_Middleware_DifferentIPs(t *testing.T) {
@@ -134,7 +139,7 @@ func TestGetClientIP(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			req := httptest.NewRequest(http.MethodGet, "/test", nil)
 			req.RemoteAddr = tc.remoteAddr
-			assert.Equal(t, tc.expected, getClientIP(req))
+			assert.Equal(t, tc.expected, getClientIP(req, nil))
 		})
 	}
 }
@@ -327,3 +332,47 @@ func TestRateLimiterConfigFromEnv(t *testing.T) {
 	assert.Equal(t, float64(defaultAPIRPM), cfg.RequestsPerMinute, "non-positive rpm must fall back to default")
 	assert.Equal(t, defaultAPIBurst, cfg.Burst, "non-positive burst must fall back to default")
 }
+
+func TestGetClientIP_TrustedProxies(t *testing.T) {
+	trusted, err := trustedproxy.Parse("10.0.0.0/8")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name       string
+		list       *trustedproxy.List
+		remoteAddr string
+		xff        string
+		expected   string
+	}{
+		{
+			name:       "no trusted proxies ignores the header",
+			remoteAddr: "10.0.0.1:5555",
+			xff:        "1.1.1.1, 2.2.2.2",
+			expected:   "10.0.0.1",
+		},
+		{
+			name:       "behind a trusted proxy uses the right-most untrusted hop",
+			list:       trusted,
+			remoteAddr: "10.0.0.1:5555",
+			xff:        "1.1.1.1, 2.2.2.2",
+			expected:   "2.2.2.2",
+		},
+		{
+			name:       "a caller reaching us directly cannot forge the header",
+			list:       trusted,
+			remoteAddr: "203.0.113.5:5555",
+			xff:        "1.1.1.1",
+			expected:   "203.0.113.5",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "/test", nil)
+			req.RemoteAddr = tc.remoteAddr
+			req.Header.Set("X-Forwarded-For", tc.xff)
+
+			assert.Equal(t, tc.expected, getClientIP(req, tc.list))
+		})
+	}
+}
diff --git a/shared/relay/auth/allow/allow_all.go b/shared/relay/auth/allow/allow_all.go
index 2d30c59c9..3074b8b1d 100644
--- a/shared/relay/auth/allow/allow_all.go
+++ b/shared/relay/auth/allow/allow_all.go
@@ -8,7 +8,3 @@ type Auth struct {
 func (a *Auth) Validate(any) error {
 	return nil
 }
-
-func (a *Auth) ValidateHelloMsgType(any) error {
-	return nil
-}
diff --git a/shared/relay/auth/hmac/token.go b/shared/relay/auth/hmac/token.go
index 581b1d6fd..c908efbff 100644
--- a/shared/relay/auth/hmac/token.go
+++ b/shared/relay/auth/hmac/token.go
@@ -1,10 +1,8 @@
 package hmac
 
 import (
-	"bytes"
 	"crypto/hmac"
 	"encoding/base64"
-	"encoding/gob"
 	"fmt"
 	"hash"
 	"strconv"
@@ -18,14 +16,6 @@ type Token struct {
 	Signature string
 }
 
-func unmarshalToken(payload []byte) (Token, error) {
-	var creds Token
-	buffer := bytes.NewBuffer(payload)
-	decoder := gob.NewDecoder(buffer)
-	err := decoder.Decode(&creds)
-	return creds, err
-}
-
 // TimedHMAC generates a token with TTL and uses a pre-shared secret known to the relay server
 type TimedHMAC struct {
 	secret     string
diff --git a/shared/relay/auth/hmac/validator.go b/shared/relay/auth/hmac/validator.go
deleted file mode 100644
index b0b7542be..000000000
--- a/shared/relay/auth/hmac/validator.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package hmac
-
-import (
-	"crypto/sha256"
-	"fmt"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-type TimedHMACValidator struct {
-	*TimedHMAC
-}
-
-func NewTimedHMACValidator(secret string, duration time.Duration) *TimedHMACValidator {
-	ta := NewTimedHMAC(secret, duration)
-	return &TimedHMACValidator{
-		ta,
-	}
-}
-
-func (a *TimedHMACValidator) Validate(credentials any) error {
-	b, ok := credentials.([]byte)
-	if !ok {
-		return fmt.Errorf("invalid credentials type")
-	}
-	c, err := unmarshalToken(b)
-	if err != nil {
-		log.Debugf("failed to unmarshal token: %s", err)
-		return err
-	}
-	return a.TimedHMAC.Validate(sha256.New, c)
-}
diff --git a/shared/relay/auth/validator.go b/shared/relay/auth/validator.go
index 8e339bb2e..158b32e1b 100644
--- a/shared/relay/auth/validator.go
+++ b/shared/relay/auth/validator.go
@@ -1,28 +1,19 @@
 package auth
 
 import (
-	"time"
-
-	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	authv2 "github.com/netbirdio/netbird/shared/relay/auth/hmac/v2"
 )
 
 type TimedHMACValidator struct {
 	authenticatorV2 *authv2.Validator
-	authenticator   *auth.TimedHMACValidator
 }
 
-func NewTimedHMACValidator(secret []byte, duration time.Duration) *TimedHMACValidator {
+func NewTimedHMACValidator(secret []byte) *TimedHMACValidator {
 	return &TimedHMACValidator{
 		authenticatorV2: authv2.NewValidator(secret),
-		authenticator:   auth.NewTimedHMACValidator(string(secret), duration),
 	}
 }
 
 func (a *TimedHMACValidator) Validate(credentials any) error {
 	return a.authenticatorV2.Validate(credentials)
 }
-
-func (a *TimedHMACValidator) ValidateHelloMsgType(credentials any) error {
-	return a.authenticator.Validate(credentials)
-}
diff --git a/shared/relay/client/client.go b/shared/relay/client/client.go
index 8d4aa6020..9bb061f6e 100644
--- a/shared/relay/client/client.go
+++ b/shared/relay/client/client.go
@@ -14,6 +14,7 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/client/netevents/sweep"
 	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	"github.com/netbirdio/netbird/shared/relay/client/dialer"
 	netErr "github.com/netbirdio/netbird/shared/relay/client/dialer/net"
@@ -29,6 +30,12 @@ const (
 
 var (
 	ErrConnAlreadyExists = fmt.Errorf("connection already exists")
+	// ErrServerDisconnected is the cancellation cause of a relayed Conn when the
+	// client lost the connection to the relay server.
+	ErrServerDisconnected = fmt.Errorf("relay server disconnected")
+	// ErrPeerDisconnected is the cancellation cause of a relayed Conn when the
+	// remote peer went offline.
+	ErrPeerDisconnected = fmt.Errorf("remote peer disconnected")
 )
 
 type internalStopFlag struct {
@@ -73,16 +80,17 @@ type connContainer struct {
 	msgChanLock sync.Mutex
 	closed      bool // flag to check if channel is closed
 	ctx         context.Context
-	cancel      context.CancelFunc
+	cancel      context.CancelCauseFunc
 }
 
 func newConnContainer(log *log.Entry, c *Client, peerID messages.PeerID, instanceURL *RelayAddr) *connContainer {
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancelCause(context.Background())
 	msgChan := make(chan Msg, connChannelSize)
 	cn := &Conn{
 		dstID:       peerID,
 		messageChan: msgChan,
 		instanceURL: instanceURL,
+		ctx:         ctx,
 	}
 	cc := &connContainer{
 		log:      log,
@@ -105,10 +113,6 @@ func newConnContainer(log *log.Entry, c *Client, peerID messages.PeerID, instanc
 	return cc
 }
 
-func (cc *connContainer) netConn() net.Conn {
-	return cc.conn
-}
-
 func (cc *connContainer) writeMsg(msg Msg) {
 	cc.msgChanLock.Lock()
 	defer cc.msgChanLock.Unlock()
@@ -127,8 +131,8 @@ func (cc *connContainer) writeMsg(msg Msg) {
 	}
 }
 
-func (cc *connContainer) close() {
-	cc.cancel()
+func (cc *connContainer) close(cause error) {
+	cc.cancel(cause)
 
 	cc.msgChanLock.Lock()
 	defer cc.msgChanLock.Unlock()
@@ -150,6 +154,14 @@ type transportConn interface {
 	Protocol() string
 }
 
+// NetEvents is the OS network event view the relay consumes: availability
+// gating for the reconnect guard and dial registration for the network change
+// sweep.
+type NetEvents interface {
+	NetworkWatcher
+	StartDial(ctx context.Context) *sweep.Dial
+}
+
 // Client is a client for the relay server. It is responsible for establishing a connection to the relay server and
 // managing connections to other peers. All exported functions are safe to call concurrently. After close the connection,
 // the client can be reused by calling Connect again. When the client is closed, all connections are closed too.
@@ -184,6 +196,11 @@ type Client struct {
 	// datagram-sized transport is avoided on subsequent connects. Shared via
 	// the manager.
 	transportFallback *transportFallback
+
+	// netEvents registers the relay dial for the network change sweep; the
+	// read loop reports the disconnect and the guard reconnects. Shared via
+	// the manager.
+	netEvents NetEvents
 	// datagramFallbackTriggered guards a single fallback per connection so a
 	// burst of oversized datagrams triggers one reconnect, not many.
 	datagramFallbackTriggered atomic.Bool
@@ -265,7 +282,7 @@ func (c *Client) Connect(ctx context.Context) error {
 	c.stateSubscription = NewPeersStateSubscription(c.log, c.relayConn, c.closeConnsByPeerID)
 
 	c.log = c.log.WithField("relay", instanceURL.String())
-	c.log.Infof("relay connection established")
+	c.log.Infof("relay connection established, server IP: %s", connectedIP(c.relayConn))
 
 	c.serviceIsRunning = true
 
@@ -279,12 +296,12 @@ func (c *Client) Connect(ctx context.Context) error {
 	return nil
 }
 
-// OpenConn create a new net.Conn for the destination peer ID. In case if the connection is in progress
+// OpenConn create a new Conn for the destination peer ID. In case if the connection is in progress
 // to the relay server, the function will block until the connection is established or timed out. Otherwise,
 // it will return immediately.
 // It block until the server confirm the peer is online.
 // todo: what should happen if call with the same peerID with multiple times?
-func (c *Client) OpenConn(ctx context.Context, dstPeerID string) (net.Conn, error) {
+func (c *Client) OpenConn(ctx context.Context, dstPeerID string) (*Conn, error) {
 	peerID := messages.HashID(dstPeerID)
 
 	c.mu.Lock()
@@ -321,7 +338,7 @@ func (c *Client) OpenConn(ctx context.Context, dstPeerID string) (net.Conn, erro
 			delete(c.conns, peerID)
 		}
 		c.mu.Unlock()
-		container.close()
+		container.close(err)
 		return nil, err
 	}
 
@@ -331,13 +348,13 @@ func (c *Client) OpenConn(ctx context.Context, dstPeerID string) (net.Conn, erro
 			delete(c.conns, peerID)
 		}
 		c.mu.Unlock()
-		container.close()
+		container.close(ErrServerDisconnected)
 		return nil, fmt.Errorf("relay connection is not established")
 	}
 	c.mu.Unlock()
 
 	c.log.Infof("remote peer is available: %s", peerID)
-	return container.netConn(), nil
+	return container.conn, nil
 }
 
 // ServerInstanceURL returns the address of the relay server. It could change after the close and reopen the connection.
@@ -350,23 +367,6 @@ func (c *Client) ServerInstanceURL() (string, error) {
 	return c.instanceURL.String(), nil
 }
 
-// ConnectedIP returns the IP address of the live relay-server connection,
-// extracted from the underlying socket's RemoteAddr. Zero value if not
-// connected or if the address is not an IP literal.
-func (c *Client) ConnectedIP() netip.Addr {
-	c.mu.Lock()
-	conn := c.relayConn
-	c.mu.Unlock()
-	if conn == nil {
-		return netip.Addr{}
-	}
-	addr := conn.RemoteAddr()
-	if addr == nil {
-		return netip.Addr{}
-	}
-	return extractIPLiteral(addr.String())
-}
-
 // SetOnDisconnectListener sets a function that will be called when the connection to the relay server is closed.
 func (c *Client) SetOnDisconnectListener(fn func(string)) {
 	c.listenerMutex.Lock()
@@ -393,6 +393,17 @@ func (c *Client) Close() error {
 }
 
 func (c *Client) connect(ctx context.Context) (*RelayAddr, error) {
+	// A sweep cancels this context, so a dial started on the old network
+	// aborts instead of waiting out its handshake timeout.
+	var dial *sweep.Dial
+	if c.netEvents != nil {
+		dial = c.netEvents.StartDial(ctx)
+	} else {
+		dial = (*sweep.Sweeper)(nil).StartDial(ctx)
+	}
+	defer dial.Release()
+	ctx = dial.Ctx()
+
 	mode := transportModeFromEnv()
 	dialers := c.getDialers(mode)
 
@@ -417,12 +428,19 @@ func (c *Client) connect(ctx context.Context) (*RelayAddr, error) {
 			return nil, fmt.Errorf("dial via FQDN: %w", err)
 		}
 	}
-	c.relayConn = conn
-	c.datagramFallbackTriggered.Store(false)
+	// Read the transport off the concrete connection: the sweeper's wrapper
+	// embeds net.Conn only, so it does not promote Protocol().
 	if tc, ok := conn.(transportConn); ok {
 		c.transport = tc.Protocol()
 	}
 
+	conn, err := dial.WrapConn(conn)
+	if err != nil {
+		return nil, fmt.Errorf("register connection: %w", err)
+	}
+	c.relayConn = conn
+	c.datagramFallbackTriggered.Store(false)
+
 	instanceURL, err := c.handShake(ctx)
 	if err != nil {
 		cErr := conn.Close()
@@ -745,9 +763,20 @@ func (c *Client) listenForStopEvents(ctx context.Context, hc *healthcheck.Receiv
 	}
 }
 
+func (c *Client) serverInstanceAddress() (string, netip.Addr, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	addr, err := c.ServerInstanceURL()
+	if err != nil {
+		return "", netip.Addr{}, err
+	}
+	return addr, connectedIP(c.relayConn), nil
+}
+
 func (c *Client) closeAllConns() {
 	for _, container := range c.conns {
-		container.close()
+		container.close(ErrServerDisconnected)
 	}
 	c.conns = make(map[messages.PeerID]*connContainer)
 
@@ -767,7 +796,7 @@ func (c *Client) closeConnsByPeerID(peerIDs []messages.PeerID) {
 		}
 
 		container.log.Infof("remote peer has been disconnected, free up connection: %s", peerID)
-		container.close()
+		container.close(ErrPeerDisconnected)
 		delete(c.conns, peerID)
 	}
 
@@ -795,7 +824,7 @@ func (c *Client) closeConn(containerRef *connContainer, id messages.PeerID) erro
 
 	c.log.Infof("free up connection to peer: %s", id)
 	delete(c.conns, id)
-	current.close()
+	current.close(net.ErrClosed)
 
 	return nil
 }
@@ -891,6 +920,17 @@ func (c *Client) handlePeersWentOfflineMsg(buf []byte) {
 	c.stateSubscription.OnPeersWentOffline(peersID)
 }
 
+func connectedIP(conn net.Conn) netip.Addr {
+	if conn == nil {
+		return netip.Addr{}
+	}
+	addr := conn.RemoteAddr()
+	if addr == nil {
+		return netip.Addr{}
+	}
+	return extractIPLiteral(addr.String())
+}
+
 // extractIPLiteral returns the IP from address forms produced by the relay
 // dialers (URL or host:port). Zero value if the host is not an IP.
 func extractIPLiteral(s string) netip.Addr {
diff --git a/shared/relay/client/client_serverip_test.go b/shared/relay/client/client_serverip_test.go
index 7e699e37d..a52d434f7 100644
--- a/shared/relay/client/client_serverip_test.go
+++ b/shared/relay/client/client_serverip_test.go
@@ -8,6 +8,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
 
 	"github.com/netbirdio/netbird/client/iface"
@@ -68,18 +70,17 @@ func TestClient_ServerIPRecoversFromUnresolvableFQDN(t *testing.T) {
 		if !c.Ready() {
 			t.Fatalf("client not ready after connect")
 		}
-		if got := c.ConnectedIP(); got.String() != "127.0.0.1" {
-			t.Fatalf("ConnectedIP = %q, want 127.0.0.1", got)
-		}
+		url, ip, err := c.serverInstanceAddress()
+		require.NoError(t, err)
+		assert.Equal(t, srvCfg.ExposedAddress, url, "relay URL must come from the handshake")
+		assert.Equal(t, netip.MustParseAddr("127.0.0.1"), ip, "relay IP must come from the connection")
 	})
 }
 
-// TestClient_ConnectedIPAfterFQDNDial verifies ConnectedIP returns the
-// resolved IP after a successful FQDN-based dial. The underlying socket's
-// RemoteAddr must be exposed through the dialer wrappers; if it returns
-// the dial-time URL instead, ConnectedIP returns empty and the dial
-// IP we advertise to peers is empty too.
-func TestClient_ConnectedIPAfterFQDNDial(t *testing.T) {
+// TestClient_ServerInstanceAddressAfterFQDNDial verifies the relay address
+// includes the resolved IP after an FQDN dial. The dialer wrappers must expose
+// the socket's RemoteAddr; returning the dial-time URL would lose the IP.
+func TestClient_ServerInstanceAddressAfterFQDNDial(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()
 
@@ -111,10 +112,10 @@ func TestClient_ConnectedIPAfterFQDNDial(t *testing.T) {
 	}
 	t.Cleanup(func() { _ = c.Close() })
 
-	got := c.ConnectedIP().String()
-	if got != "127.0.0.1" && got != "::1" {
-		t.Fatalf("ConnectedIP after FQDN dial = %q, want 127.0.0.1 or ::1", got)
-	}
+	url, ip, err := c.serverInstanceAddress()
+	require.NoError(t, err)
+	assert.Equal(t, srvCfg.ExposedAddress, url, "relay URL must come from the handshake")
+	assert.Contains(t, []string{"127.0.0.1", "::1"}, ip.String(), "relay IP must resolve to localhost")
 }
 
 func TestSubstituteHost(t *testing.T) {
@@ -214,15 +215,12 @@ func TestSubstituteHost(t *testing.T) {
 	}
 }
 
-func TestClient_ConnectedIPEmptyWhenNotConnected(t *testing.T) {
-	c := NewClient("rel://example.invalid:80", hmacTokenStore, "x", iface.DefaultMTU)
-	if got := c.ConnectedIP(); got.IsValid() {
-		t.Fatalf("ConnectedIP on disconnected client = %q, want zero", got)
-	}
+func TestConnectedIPNilConnection(t *testing.T) {
+	assert.False(t, connectedIP(nil).IsValid(), "missing connection must not provide an IP")
 }
 
 // staticAddr is a net.Addr that returns a fixed string. Used to verify
-// ConnectedIP parses RemoteAddr correctly.
+// connectedIP parses RemoteAddr correctly.
 type staticAddr struct{ s string }
 
 func (a staticAddr) Network() string { return "tcp" }
@@ -235,7 +233,7 @@ type stubConn struct {
 
 func (s stubConn) RemoteAddr() net.Addr { return s.remote }
 
-func TestClient_ConnectedIPParsesRemoteAddr(t *testing.T) {
+func TestConnectedIPParsesRemoteAddr(t *testing.T) {
 	tests := []struct {
 		name string
 		s    string
@@ -252,15 +250,12 @@ func TestClient_ConnectedIPParsesRemoteAddr(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			c := &Client{relayConn: stubConn{remote: staticAddr{s: tt.s}}}
-			got := c.ConnectedIP()
+			got := connectedIP(stubConn{remote: staticAddr{s: tt.s}})
 			var gotStr string
 			if got.IsValid() {
 				gotStr = got.String()
 			}
-			if gotStr != tt.want {
-				t.Errorf("ConnectedIP(%q) = %q, want %q", tt.s, gotStr, tt.want)
-			}
+			assert.Equal(t, tt.want, gotStr, "IP extracted from RemoteAddr %q", tt.s)
 		})
 	}
 }
diff --git a/shared/relay/client/conn.go b/shared/relay/client/conn.go
index 9e2279790..67767a2b9 100644
--- a/shared/relay/client/conn.go
+++ b/shared/relay/client/conn.go
@@ -1,6 +1,7 @@
 package client
 
 import (
+	"context"
 	"net"
 	"time"
 
@@ -12,11 +13,20 @@ type Conn struct {
 	dstID       messages.PeerID
 	messageChan chan Msg
 	instanceURL *RelayAddr
+	ctx         context.Context
 	writeFn     func(messages.PeerID, []byte) (int, error)
 	closeFn     func(messages.PeerID) error
 	localAddrFn func() net.Addr
 }
 
+// Context returns a context that is cancelled when the connection is torn down,
+// either by Close or by the relay client losing the server connection. The
+// cancellation cause carries the reason, see ErrServerDisconnected and
+// ErrPeerDisconnected.
+func (c *Conn) Context() context.Context {
+	return c.ctx
+}
+
 func (c *Conn) Write(p []byte) (n int, err error) {
 	return c.writeFn(c.dstID, p)
 }
diff --git a/shared/relay/client/dialer/quic/quic.go b/shared/relay/client/dialer/quic/quic.go
index 2e8de8af3..cbf6ea30f 100644
--- a/shared/relay/client/dialer/quic/quic.go
+++ b/shared/relay/client/dialer/quic/quic.go
@@ -9,7 +9,6 @@ import (
 	"time"
 
 	"github.com/quic-go/quic-go"
-	"github.com/quic-go/quic-go/logging"
 	log "github.com/sirupsen/logrus"
 
 	nbnet "github.com/netbirdio/netbird/client/net"
@@ -80,28 +79,6 @@ func (d Dialer) Dial(ctx context.Context, address, serverName string) (net.Conn,
 	return conn, nil
 }
 
-// connectionTracer returns a QUIC tracer that logs the DPLPMTUD result and the
-// reason a relay connection closed, so the path MTU settled on and teardown
-// cause are visible in logs. Lines carry the relay address as a structured
-// field, matching the rest of the relay client logging.
-func connectionTracer(addr string) func(context.Context, logging.Perspective, quic.ConnectionID) *logging.ConnectionTracer {
-	relayLog := log.WithField("relay", addr)
-	return func(context.Context, logging.Perspective, quic.ConnectionID) *logging.ConnectionTracer {
-		return &logging.ConnectionTracer{
-			UpdatedMTU: func(mtu logging.ByteCount, done bool) {
-				if done {
-					relayLog.Infof("QUIC path MTU settled at %d", mtu)
-					return
-				}
-				relayLog.Debugf("QUIC path MTU probing at %d", mtu)
-			},
-			ClosedConnection: func(err error) {
-				relayLog.Debugf("QUIC connection closed: %v", err)
-			},
-		}
-	}
-}
-
 func prepareURL(address string) (string, error) {
 	var host string
 	var defaultPort string
diff --git a/shared/relay/client/dialer/quic/quic_test.go b/shared/relay/client/dialer/quic/quic_test.go
new file mode 100644
index 000000000..af210eba2
--- /dev/null
+++ b/shared/relay/client/dialer/quic/quic_test.go
@@ -0,0 +1,145 @@
+package quic
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	log "github.com/sirupsen/logrus"
+	"github.com/sirupsen/logrus/hooks/test"
+)
+
+func TestCloseReason(t *testing.T) {
+	transportErr := qlog.TransportErrorCode(0x2) // CONNECTION_REFUSED
+	appErr := qlog.ApplicationErrorCode(42)
+
+	tests := []struct {
+		name  string
+		event qlog.ConnectionClosed
+		want  string
+	}{
+		{
+			// A close carrying nothing but an initiator still reads sensibly.
+			name:  "initiator only",
+			event: qlog.ConnectionClosed{Initiator: qlog.InitiatorLocal},
+			want:  "closed by local",
+		},
+		{
+			name: "transport error with trigger",
+			event: qlog.ConnectionClosed{
+				Initiator:       qlog.InitiatorRemote,
+				ConnectionError: &transportErr,
+				Trigger:         qlog.ConnectionCloseTriggerIdleTimeout,
+			},
+			want: "closed by remote, transport error: CONNECTION_REFUSED, trigger: idle_timeout",
+		},
+		{
+			name: "application error with reason",
+			event: qlog.ConnectionClosed{
+				Initiator:        qlog.InitiatorLocal,
+				ApplicationError: &appErr,
+				Reason:           "bye",
+			},
+			want: "closed by local, application error: 42, reason: bye",
+		},
+		{
+			// Transport and application errors are mutually exclusive in
+			// practice; if both are set the transport code wins.
+			name: "transport error takes precedence over application error",
+			event: qlog.ConnectionClosed{
+				Initiator:        qlog.InitiatorLocal,
+				ConnectionError:  &transportErr,
+				ApplicationError: &appErr,
+			},
+			want: "closed by local, transport error: CONNECTION_REFUSED",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := closeReason(tt.event); got != tt.want {
+				t.Errorf("closeReason() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestLogSinkRecordEvent(t *testing.T) {
+	tests := []struct {
+		name      string
+		event     qlogwriter.Event
+		wantLevel log.Level
+		wantMsg   string
+	}{
+		{
+			name:      "settled MTU is logged at info",
+			event:     qlog.MTUUpdated{Value: 1400, Done: true},
+			wantLevel: log.InfoLevel,
+			wantMsg:   "QUIC path MTU settled at 1400",
+		},
+		{
+			// Probing fires repeatedly during discovery, so it stays at debug.
+			name:      "MTU probe is logged at debug",
+			event:     qlog.MTUUpdated{Value: 1300, Done: false},
+			wantLevel: log.DebugLevel,
+			wantMsg:   "QUIC path MTU probing at 1300",
+		},
+		{
+			name:      "connection closed is logged at debug",
+			event:     qlog.ConnectionClosed{Initiator: qlog.InitiatorRemote},
+			wantLevel: log.DebugLevel,
+			wantMsg:   "QUIC connection closed: closed by remote",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			logger, hook := test.NewNullLogger()
+			logger.SetLevel(log.DebugLevel)
+			recorder := logSink{log: logger.WithField("relay", "relay.example.com:443")}
+
+			recorder.RecordEvent(tt.event)
+
+			entries := hook.AllEntries()
+			if len(entries) != 1 {
+				t.Fatalf("got %d log entries, want 1", len(entries))
+			}
+			if entries[0].Level != tt.wantLevel {
+				t.Errorf("level = %v, want %v", entries[0].Level, tt.wantLevel)
+			}
+			if entries[0].Message != tt.wantMsg {
+				t.Errorf("message = %q, want %q", entries[0].Message, tt.wantMsg)
+			}
+			if relay := entries[0].Data["relay"]; relay != "relay.example.com:443" {
+				t.Errorf("relay field = %v, want relay.example.com:443", relay)
+			}
+		})
+	}
+}
+
+// Events the relay client does not care about must not produce log lines.
+func TestLogSinkIgnoresUnhandledEvents(t *testing.T) {
+	logger, hook := test.NewNullLogger()
+	logger.SetLevel(log.DebugLevel)
+	recorder := logSink{log: logger.WithField("relay", "relay.example.com:443")}
+
+	recorder.RecordEvent(qlog.PacketLost{})
+
+	if entries := hook.AllEntries(); len(entries) != 0 {
+		t.Errorf("got %d log entries, want 0", len(entries))
+	}
+}
+
+func TestLogSinkSupportsSchemas(t *testing.T) {
+	trace := logSink{log: log.WithField("relay", "relay.example.com:443")}
+
+	if !trace.SupportsSchemas(qlog.EventSchema) {
+		t.Errorf("SupportsSchemas(%q) = false, want true", qlog.EventSchema)
+	}
+	if trace.SupportsSchemas("urn:ietf:params:qlog:events:http3-12") {
+		t.Error("SupportsSchemas() = true for an unrelated schema, want false")
+	}
+	if trace.AddProducer() == nil {
+		t.Error("AddProducer() = nil, want a recorder")
+	}
+}
diff --git a/shared/relay/client/dialer/quic/tracer.go b/shared/relay/client/dialer/quic/tracer.go
new file mode 100644
index 000000000..63be09f0c
--- /dev/null
+++ b/shared/relay/client/dialer/quic/tracer.go
@@ -0,0 +1,70 @@
+package quic
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	log "github.com/sirupsen/logrus"
+)
+
+// logSink implements both qlogwriter.Trace and qlogwriter.Recorder, forwarding
+// the few qlog events the relay client cares about to logrus instead of
+// writing a qlog file. It holds no mutable state and logrus entries are safe
+// to share, so one value can serve every producer on the connection.
+type logSink struct {
+	log *log.Entry
+}
+
+func (s logSink) AddProducer() qlogwriter.Recorder { return s }
+
+func (s logSink) SupportsSchemas(schema string) bool { return schema == qlog.EventSchema }
+
+func (s logSink) RecordEvent(event qlogwriter.Event) {
+	switch e := event.(type) {
+	case qlog.MTUUpdated:
+		if e.Done {
+			s.log.Infof("QUIC path MTU settled at %d", e.Value)
+			return
+		}
+		s.log.Debugf("QUIC path MTU probing at %d", e.Value)
+	case qlog.ConnectionClosed:
+		s.log.Debugf("QUIC connection closed: %s", closeReason(e))
+	}
+}
+
+func (s logSink) Close() error { return nil }
+
+// connectionTracer returns a QUIC tracer that logs the DPLPMTUD result and the
+// reason a relay connection closed, so the path MTU settled on and teardown
+// cause are visible in logs. Lines carry the relay address as a structured
+// field, matching the rest of the relay client logging.
+func connectionTracer(addr string) func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+	relayLog := log.WithField("relay", addr)
+	return func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+		return logSink{log: relayLog}
+	}
+}
+
+// closeReason renders a ConnectionClosed event as a single line. The event
+// carries the error as separate initiator, code, trigger and reason fields,
+// any of which may be unset.
+func closeReason(e qlog.ConnectionClosed) string {
+	parts := []string{fmt.Sprintf("closed by %s", e.Initiator)}
+	switch {
+	case e.ConnectionError != nil:
+		parts = append(parts, fmt.Sprintf("transport error: %s", *e.ConnectionError))
+	case e.ApplicationError != nil:
+		parts = append(parts, fmt.Sprintf("application error: %d", *e.ApplicationError))
+	}
+	if e.Trigger != "" {
+		parts = append(parts, fmt.Sprintf("trigger: %s", e.Trigger))
+	}
+	if e.Reason != "" {
+		parts = append(parts, fmt.Sprintf("reason: %s", e.Reason))
+	}
+	return strings.Join(parts, ", ")
+}
diff --git a/shared/relay/client/dialer/ws/close_generic.go b/shared/relay/client/dialer/ws/close_generic.go
new file mode 100644
index 000000000..35cd29bcf
--- /dev/null
+++ b/shared/relay/client/dialer/ws/close_generic.go
@@ -0,0 +1,9 @@
+//go:build !js
+
+package ws
+
+// closeConn closes the underlying WebSocket immediately, skipping the close
+// handshake.
+func (c *Conn) closeConn() error {
+	return c.Conn.CloseNow()
+}
diff --git a/shared/relay/client/dialer/ws/close_js.go b/shared/relay/client/dialer/ws/close_js.go
new file mode 100644
index 000000000..ab51531a0
--- /dev/null
+++ b/shared/relay/client/dialer/ws/close_js.go
@@ -0,0 +1,25 @@
+//go:build js
+
+package ws
+
+import (
+	"github.com/coder/websocket"
+	log "github.com/sirupsen/logrus"
+)
+
+// closeConn closes the browser WebSocket without blocking the caller.
+//
+// The browser close API only accepts codes 1000 and 3000-4999, so CloseNow's
+// 1001 (going away) throws an InvalidAccessError. Close with a valid code
+// waits for the browser close event before returning, which can park the
+// calling goroutine (the relay teardown path holds its mutexes while closing)
+// until the close handshake finishes. Run the close in the background and
+// report success; a teardown close error is not actionable.
+func (c *Conn) closeConn() error {
+	go func() {
+		if err := c.Conn.Close(websocket.StatusNormalClosure, ""); err != nil {
+			log.Debugf("failed to close relay websocket: %v", err)
+		}
+	}()
+	return nil
+}
diff --git a/shared/relay/client/dialer/ws/conn.go b/shared/relay/client/dialer/ws/conn.go
index eec417c50..5dc147fb0 100644
--- a/shared/relay/client/dialer/ws/conn.go
+++ b/shared/relay/client/dialer/ws/conn.go
@@ -77,5 +77,5 @@ func (c *Conn) SetDeadline(t time.Time) error {
 }
 
 func (c *Conn) Close() error {
-	return c.Conn.CloseNow()
+	return c.closeConn()
 }
diff --git a/shared/relay/client/early_msg_buffer.go b/shared/relay/client/early_msg_buffer.go
index 52ff4d42e..d74009d10 100644
--- a/shared/relay/client/early_msg_buffer.go
+++ b/shared/relay/client/early_msg_buffer.go
@@ -10,7 +10,7 @@ import (
 
 const (
 	earlyMsgTTL      = 5 * time.Second
-	earlyMsgCapacity = 1000
+	earlyMsgCapacity = 10000
 )
 
 // earlyMsgBuffer buffers transport messages that arrive before the corresponding
diff --git a/shared/relay/client/guard.go b/shared/relay/client/guard.go
index 98b1b333e..c0294b82d 100644
--- a/shared/relay/client/guard.go
+++ b/shared/relay/client/guard.go
@@ -9,7 +9,25 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-const defaultMaxBackoffInterval = 60 * time.Second
+const (
+	defaultMaxBackoffInterval = 60 * time.Second
+
+	// quickReconnectBudget bounds how long a quick reconnect waits for the
+	// network before handing the retry over to the ticker.
+	quickReconnectBudget = 1500 * time.Millisecond
+
+	// verdictSettleWindow is how long an online verdict must hold before it
+	// is trusted: the disconnect often precedes the OS offline flag by a few
+	// milliseconds.
+	verdictSettleWindow = 200 * time.Millisecond
+)
+
+// NetworkWatcher is the availability view the guard gates reconnects on.
+type NetworkWatcher interface {
+	Wait(ctx context.Context) (bool, error)
+	IsOnline() bool
+	WaitSettled(ctx context.Context, budget, settleWindow time.Duration) bool
+}
 
 // Guard manage the reconnection tries to the Relay server in case of disconnection event.
 type Guard struct {
@@ -22,6 +40,9 @@ type Guard struct {
 	// attempts.
 	maxBackoffInterval time.Duration
 
+	// netWatcher gates reconnect attempts on OS-reported network availability.
+	netWatcher NetworkWatcher
+
 	// lastErr is the error from the most recent failed reconnect attempt,
 	// surfaced as the home relay status while disconnected.
 	lastErr atomic.Pointer[error]
@@ -29,7 +50,7 @@ type Guard struct {
 
 // NewGuard creates a new guard for the relay client. A non-positive
 // maxBackoffInterval falls back to defaultMaxBackoffInterval.
-func NewGuard(sp *ServerPicker, maxBackoffInterval time.Duration) *Guard {
+func NewGuard(sp *ServerPicker, maxBackoffInterval time.Duration, netWatcher NetworkWatcher) *Guard {
 	if maxBackoffInterval <= 0 {
 		maxBackoffInterval = defaultMaxBackoffInterval
 	}
@@ -38,6 +59,7 @@ func NewGuard(sp *ServerPicker, maxBackoffInterval time.Duration) *Guard {
 		OnReconnected:      make(chan struct{}, 1),
 		serverPicker:       sp,
 		maxBackoffInterval: maxBackoffInterval,
+		netWatcher:         netWatcher,
 	}
 	return g
 }
@@ -70,11 +92,23 @@ func (g *Guard) StartReconnectTrys(ctx context.Context, relayClient *Client) {
 
 	// start a ticker to pick a new server
 	ticker := g.exponentTicker(ctx)
-	defer ticker.Stop()
+	defer func() {
+		ticker.Stop()
+	}()
 
 	for {
 		select {
 		case <-ticker.C:
+			// suspend reconnect attempts while the OS reports no usable network
+			if g.netWatcher != nil {
+				if waited, err := g.netWatcher.Wait(ctx); err != nil {
+					return
+				} else if waited {
+					ticker.Stop()
+					ticker = g.exponentTicker(ctx)
+					continue
+				}
+			}
 			if err := g.retry(ctx); err != nil {
 				log.Errorf("failed to pick new Relay server: %s", err)
 				g.setLastError(err)
@@ -100,8 +134,18 @@ func (g *Guard) tryToQuickReconnect(parentCtx context.Context, rc *Client) bool
 		return false
 	}
 
-	if cancelled := waiteBeforeRetry(parentCtx); !cancelled {
-		return false
+	if g.netWatcher != nil {
+		if ok := g.netWatcher.WaitSettled(parentCtx, quickReconnectBudget, verdictSettleWindow); !ok {
+			return false
+		}
+		// Still offline after the budget: leave the retry to the ticker.
+		if !g.netWatcher.IsOnline() {
+			return false
+		}
+	} else {
+		if cancelled := waitBeforeRetry(parentCtx); !cancelled {
+			return false
+		}
 	}
 
 	log.Infof("try to reconnect to Relay server: %s", rc.connectionURL)
@@ -156,16 +200,18 @@ func (g *Guard) notifyReconnected() {
 func (g *Guard) exponentTicker(ctx context.Context) *backoff.Ticker {
 	bo := backoff.WithContext(&backoff.ExponentialBackOff{
 		InitialInterval: 2 * time.Second,
-		Multiplier:      2,
-		MaxInterval:     g.maxBackoffInterval,
-		Clock:           backoff.SystemClock,
+		// Spreads the reconnects of every client that lost the same relay server.
+		RandomizationFactor: backoff.DefaultRandomizationFactor,
+		Multiplier:          2,
+		MaxInterval:         g.maxBackoffInterval,
+		Clock:               backoff.SystemClock,
 	}, ctx)
 
 	return backoff.NewTicker(bo)
 }
 
-func waiteBeforeRetry(ctx context.Context) bool {
-	timer := time.NewTimer(1500 * time.Millisecond)
+func waitBeforeRetry(ctx context.Context) bool {
+	timer := time.NewTimer(quickReconnectBudget)
 	defer timer.Stop()
 
 	select {
diff --git a/shared/relay/client/manager.go b/shared/relay/client/manager.go
index e1515401e..518a4a5fe 100644
--- a/shared/relay/client/manager.go
+++ b/shared/relay/client/manager.go
@@ -1,12 +1,9 @@
 package client
 
 import (
-	"container/list"
 	"context"
 	"fmt"
-	"net"
 	"net/netip"
-	"reflect"
 	"sync"
 	"time"
 
@@ -30,16 +27,19 @@ type RelayTrack struct {
 	relayClient *Client
 	err         error
 	created     time.Time
+	// ready is closed once the dial started by openConnVia finishes (relayClient
+	// or err is set). Callers reusing a track wait on this instead of the track
+	// lock, so the dial never runs under rt.Lock.
+	ready chan struct{}
 }
 
 func NewRelayTrack() *RelayTrack {
 	return &RelayTrack{
 		created: time.Now(),
+		ready:   make(chan struct{}),
 	}
 }
 
-type OnServerCloseListener func()
-
 // ManagerOption configures a Manager at construction time.
 type ManagerOption func(*Manager)
 
@@ -60,6 +60,11 @@ func WithMaxBackoffInterval(d time.Duration) ManagerOption {
 	return func(m *Manager) { m.maxBackoffInterval = d }
 }
 
+// WithNetEvents injects the OS network event handling.
+func WithNetEvents(events NetEvents) ManagerOption {
+	return func(m *Manager) { m.netEvents = events }
+}
+
 // Manager is a manager for the relay client instances. It establishes one persistent connection to the given relay URL
 // and automatically reconnect to them in case disconnection.
 // The manager also manage temporary relay connection. If a client wants to communicate with a client on a
@@ -81,12 +86,12 @@ type Manager struct {
 	relayClients      map[string]*RelayTrack
 	relayClientsMutex sync.RWMutex
 
-	onDisconnectedListeners map[string]*list.List
 	onReconnectedListenerFn func()
 	listenerLock            sync.Mutex
 
 	mtu                uint16
 	maxBackoffInterval time.Duration
+	netEvents          NetEvents
 
 	cleanupInterval      time.Duration
 	keepUnusedServerTime time.Duration
@@ -115,16 +120,16 @@ func NewManager(ctx context.Context, serverURLs []string, peerID string, mtu uin
 			ConnectionTimeout: defaultConnectionTimeout,
 			TransportFallback: tf,
 		},
-		relayClients:            make(map[string]*RelayTrack),
-		onDisconnectedListeners: make(map[string]*list.List),
-		cleanupInterval:         relayCleanupInterval,
-		keepUnusedServerTime:    keepUnusedServerTime,
+		relayClients:         make(map[string]*RelayTrack),
+		cleanupInterval:      relayCleanupInterval,
+		keepUnusedServerTime: keepUnusedServerTime,
 	}
 	for _, opt := range opts {
 		opt(m)
 	}
+	m.serverPicker.NetEvents = m.netEvents
 	m.serverPicker.ServerURLs.Store(serverURLs)
-	m.reconnectGuard = NewGuard(m.serverPicker, m.maxBackoffInterval)
+	m.reconnectGuard = NewGuard(m.serverPicker, m.maxBackoffInterval, m.netEvents)
 	return m
 }
 
@@ -156,29 +161,28 @@ func (m *Manager) Serve() error {
 
 // OpenConn opens a connection to the given peer key. If the peer is on the same relay server, the connection will be
 // established via the relay server. If the peer is on a different relay server, the manager will establish a new
-// connection to the relay server. It returns back with a net.Conn what represent the remote peer connection.
+// connection to the relay server. It returns the relayed connection to the remote peer.
 //
 // serverIP, when valid and serverAddress is foreign, is used as a dial target if the FQDN-based dial fails.
 // Ignored for the local home-server path. TLS verification still uses the FQDN via SNI.
-func (m *Manager) OpenConn(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (net.Conn, error) {
+func (m *Manager) OpenConn(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (*Conn, error) {
 	m.relayClientMu.RLock()
-	defer m.relayClientMu.RUnlock()
+	homeClient := m.relayClient
+	m.relayClientMu.RUnlock()
 
-	if m.relayClient == nil {
+	if homeClient == nil {
 		return nil, ErrRelayClientNotConnected
 	}
 
-	foreign, err := m.isForeignServer(serverAddress)
+	foreign, err := m.isForeignServer(homeClient, serverAddress)
 	if err != nil {
 		return nil, err
 	}
 
-	var (
-		netConn net.Conn
-	)
+	var netConn *Conn
 	if !foreign {
 		log.Debugf("open peer connection via permanent server: %s", peerKey)
-		netConn, err = m.relayClient.OpenConn(ctx, peerKey)
+		netConn, err = homeClient.OpenConn(ctx, peerKey)
 	} else {
 		log.Debugf("open peer connection via foreign server: %s", serverAddress)
 		netConn, err = m.openConnVia(ctx, serverAddress, peerKey, serverIP)
@@ -208,31 +212,6 @@ func (m *Manager) SetOnReconnectedListener(f func()) {
 	m.onReconnectedListenerFn = f
 }
 
-// AddCloseListener adds a listener to the given server instance address. The listener will be called if the connection
-// closed.
-func (m *Manager) AddCloseListener(serverAddress string, onClosedListener OnServerCloseListener) error {
-	m.relayClientMu.RLock()
-	defer m.relayClientMu.RUnlock()
-
-	if m.relayClient == nil {
-		return ErrRelayClientNotConnected
-	}
-
-	foreign, err := m.isForeignServer(serverAddress)
-	if err != nil {
-		return err
-	}
-
-	var listenerAddr string
-	if foreign {
-		listenerAddr = serverAddress
-	} else {
-		listenerAddr = m.relayClient.connectionURL
-	}
-	m.addListener(listenerAddr, onClosedListener)
-	return nil
-}
-
 // RelayInstanceAddress returns the address and resolved IP of the permanent relay server. It could change if the
 // network connection is lost. The address is sent to the target peer to choose the common relay server for the
 // communication; the IP is sent alongside so remote peers can dial directly without their own DNS lookup. Both
@@ -244,11 +223,7 @@ func (m *Manager) RelayInstanceAddress() (string, netip.Addr, error) {
 	if m.relayClient == nil {
 		return "", netip.Addr{}, ErrRelayClientNotConnected
 	}
-	addr, err := m.relayClient.ServerInstanceURL()
-	if err != nil {
-		return "", netip.Addr{}, err
-	}
-	return addr, m.relayClient.ConnectedIP(), nil
+	return m.relayClient.serverInstanceAddress()
 }
 
 // ServerURLs returns the addresses of the relay servers.
@@ -322,47 +297,40 @@ func (m *Manager) UpdateToken(token *relayAuth.Token) error {
 	return m.tokenStore.UpdateToken(token)
 }
 
-func (m *Manager) openConnVia(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (net.Conn, error) {
+func (m *Manager) openConnVia(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (*Conn, error) {
 	// check if already has a connection to the desired relay server
 	m.relayClientsMutex.RLock()
 	rt, ok := m.relayClients[serverAddress]
-	if ok {
-		rt.RLock()
-		m.relayClientsMutex.RUnlock()
-		defer rt.RUnlock()
-		if rt.err != nil {
-			return nil, rt.err
-		}
-		return rt.relayClient.OpenConn(ctx, peerKey)
-	}
 	m.relayClientsMutex.RUnlock()
+	if ok {
+		return m.openConnOnTrack(ctx, rt, peerKey)
+	}
 
 	// if not, establish a new connection but check it again (because changed the lock type) before starting the
 	// connection
 	m.relayClientsMutex.Lock()
 	rt, ok = m.relayClients[serverAddress]
 	if ok {
-		rt.RLock()
 		m.relayClientsMutex.Unlock()
-		defer rt.RUnlock()
-		if rt.err != nil {
-			return nil, rt.err
-		}
-		return rt.relayClient.OpenConn(ctx, peerKey)
+		return m.openConnOnTrack(ctx, rt, peerKey)
 	}
 
-	// create a new relay client and store it in the relayClients map
+	// Publish the track and release the map lock BEFORE dialing, so the dial does
+	// not run under rt.Lock (which would block RelayStates and the cleanup loop
+	// for the full dial). Concurrent callers find this track and wait on rt.ready.
 	rt = NewRelayTrack()
-	rt.Lock()
 	m.relayClients[serverAddress] = rt
 	m.relayClientsMutex.Unlock()
 
 	relayClient := NewClientWithServerIP(serverAddress, serverIP, m.tokenStore, m.peerID, m.mtu)
 	relayClient.SetTransportFallback(m.transportFallback)
+	relayClient.netEvents = m.netEvents
 	err := relayClient.Connect(m.ctx)
 	if err != nil {
+		rt.Lock()
 		rt.err = err
 		rt.Unlock()
+		close(rt.ready)
 		m.relayClientsMutex.Lock()
 		delete(m.relayClients, serverAddress)
 		m.relayClientsMutex.Unlock()
@@ -370,14 +338,34 @@ func (m *Manager) openConnVia(ctx context.Context, serverAddress, peerKey string
 	}
 	// if connection closed then delete the relay client from the list
 	relayClient.SetOnDisconnectListener(m.onServerDisconnected)
+	rt.Lock()
 	rt.relayClient = relayClient
 	rt.Unlock()
+	close(rt.ready)
 
-	conn, err := relayClient.OpenConn(ctx, peerKey)
-	if err != nil {
-		return nil, err
+	return relayClient.OpenConn(ctx, peerKey)
+}
+
+// openConnOnTrack opens a peer connection through an existing relay track,
+// waiting for the dial started by another openConnVia call to finish. It waits
+// on rt.ready rather than the track lock, so it neither holds nor contends the
+// track lock across the dial.
+func (m *Manager) openConnOnTrack(ctx context.Context, rt *RelayTrack, peerKey string) (*Conn, error) {
+	select {
+	case <-rt.ready:
+	case <-ctx.Done():
+		return nil, ctx.Err()
 	}
-	return conn, nil
+
+	rt.RLock()
+	defer rt.RUnlock()
+	if rt.err != nil {
+		return nil, rt.err
+	}
+	if rt.relayClient == nil {
+		return nil, ErrRelayClientNotConnected
+	}
+	return rt.relayClient.OpenConn(ctx, peerKey)
 }
 
 func (m *Manager) onServerConnected() {
@@ -407,17 +395,31 @@ func (m *Manager) onServerDisconnected(serverAddress string) {
 	if !isHome {
 		m.evictForeignRelay(serverAddress)
 	}
-
-	m.notifyOnDisconnectListeners(serverAddress)
 }
 
 func (m *Manager) evictForeignRelay(serverAddress string) {
 	m.relayClientsMutex.Lock()
 	defer m.relayClientsMutex.Unlock()
-	if _, ok := m.relayClients[serverAddress]; ok {
-		delete(m.relayClients, serverAddress)
-		log.Debugf("evicted disconnected foreign relay client: %s", serverAddress)
+
+	rt, ok := m.relayClients[serverAddress]
+	if !ok {
+		return
 	}
+
+	rt.RLock()
+	client := rt.relayClient
+	rt.RUnlock()
+	if client == nil {
+		log.Debugf("keeping foreign relay track with a dial in progress: %s", serverAddress)
+		return
+	}
+	if client.Ready() {
+		log.Debugf("keeping reconnected foreign relay client: %s", serverAddress)
+		return
+	}
+
+	delete(m.relayClients, serverAddress)
+	log.Debugf("evicted disconnected foreign relay client: %s", serverAddress)
 }
 
 func (m *Manager) listenGuardEvent(ctx context.Context) {
@@ -442,8 +444,8 @@ func (m *Manager) storeClient(client *Client) {
 	m.relayClient.SetOnDisconnectListener(m.onServerDisconnected)
 }
 
-func (m *Manager) isForeignServer(address string) (bool, error) {
-	rAddr, err := m.relayClient.ServerInstanceURL()
+func (m *Manager) isForeignServer(homeClient *Client, address string) (bool, error) {
+	rAddr, err := homeClient.ServerInstanceURL()
 	if err != nil {
 		return false, fmt.Errorf("relay client not connected")
 	}
@@ -476,6 +478,13 @@ func (m *Manager) cleanUpUnusedRelays() {
 			continue
 		}
 
+		// dial still in progress (openConnVia publishes the track before Connect
+		// completes and no longer holds rt.Lock during it), nothing to clean up.
+		if rt.relayClient == nil {
+			rt.Unlock()
+			continue
+		}
+
 		if time.Since(rt.created) <= m.keepUnusedServerTime {
 			rt.Unlock()
 			continue
@@ -495,36 +504,6 @@ func (m *Manager) cleanUpUnusedRelays() {
 	}
 }
 
-func (m *Manager) addListener(serverAddress string, onClosedListener OnServerCloseListener) {
-	m.listenerLock.Lock()
-	defer m.listenerLock.Unlock()
-	l, ok := m.onDisconnectedListeners[serverAddress]
-	if !ok {
-		l = list.New()
-	}
-	for e := l.Front(); e != nil; e = e.Next() {
-		if reflect.ValueOf(e.Value).Pointer() == reflect.ValueOf(onClosedListener).Pointer() {
-			return
-		}
-	}
-	l.PushBack(onClosedListener)
-	m.onDisconnectedListeners[serverAddress] = l
-}
-
-func (m *Manager) notifyOnDisconnectListeners(serverAddress string) {
-	m.listenerLock.Lock()
-	defer m.listenerLock.Unlock()
-
-	l, ok := m.onDisconnectedListeners[serverAddress]
-	if !ok {
-		return
-	}
-	for e := l.Front(); e != nil; e = e.Next() {
-		go e.Value.(OnServerCloseListener)()
-	}
-	delete(m.onDisconnectedListeners, serverAddress)
-}
-
 func relayConnState(c *Client) RelayConnState {
 	addr, err := c.ServerInstanceURL()
 	if err != nil {
diff --git a/shared/relay/client/manager_address_test.go b/shared/relay/client/manager_address_test.go
new file mode 100644
index 000000000..4f669e60d
--- /dev/null
+++ b/shared/relay/client/manager_address_test.go
@@ -0,0 +1,103 @@
+package client
+
+import (
+	"net/netip"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestManager_RelayInstanceAddressAcrossReconnect(t *testing.T) {
+	relays := []struct {
+		url  *RelayAddr
+		conn stubConn
+		ip   netip.Addr
+	}{
+		{
+			url:  &RelayAddr{addr: "rels://relay-a.example:443"},
+			conn: stubConn{remote: staticAddr{s: "192.0.2.1:443"}},
+			ip:   netip.MustParseAddr("192.0.2.1"),
+		},
+		{
+			url:  &RelayAddr{addr: "rels://relay-b.example:443"},
+			conn: stubConn{remote: staticAddr{s: "192.0.2.2:443"}},
+			ip:   netip.MustParseAddr("192.0.2.2"),
+		},
+	}
+	c := &Client{
+		instanceURL:      relays[0].url,
+		relayConn:        relays[0].conn,
+		serviceIsRunning: true,
+	}
+	m := &Manager{relayClient: c}
+	started := make(chan struct{})
+	stop := make(chan struct{})
+	done := make(chan struct{})
+	t.Cleanup(func() {
+		close(stop)
+		<-done
+	})
+	go func() {
+		defer close(done)
+		for i := 0; ; i++ {
+			select {
+			case <-stop:
+				return
+			default:
+			}
+			// Publish successive connection states using the lifecycle locks.
+			// Yield before publication so a getter using only muInstanceURL
+			// can read the old URL while waiting for the new connection's IP.
+			c.mu.Lock()
+			runtime.Gosched()
+			relay := relays[i%len(relays)]
+			c.muInstanceURL.Lock()
+			c.instanceURL = relay.url
+			c.muInstanceURL.Unlock()
+			c.relayConn = relay.conn
+			c.mu.Unlock()
+			if i == 0 {
+				close(started)
+			}
+		}
+	}()
+	<-started
+
+	for range 1000 {
+		url, ip, err := m.RelayInstanceAddress()
+		require.NoError(t, err)
+		wantIP := relays[0].ip
+		if url == relays[1].url.String() {
+			wantIP = relays[1].ip
+		}
+		if !assert.Equal(t, wantIP, ip, "advertised IP must belong to relay %s", url) {
+			return
+		}
+	}
+}
+
+func TestManager_RelayInstanceAddressDisconnected(t *testing.T) {
+	for _, tt := range []struct {
+		name   string
+		client *Client
+	}{
+		{name: "no client"},
+		{name: "not connected", client: &Client{}},
+		{
+			name: "closed connection",
+			client: &Client{
+				relayConn: stubConn{remote: staticAddr{s: "192.0.2.1:443"}},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			m := &Manager{relayClient: tt.client}
+			url, ip, err := m.RelayInstanceAddress()
+			assert.Error(t, err)
+			assert.Empty(t, url, "disconnected relay must not advertise a URL")
+			assert.False(t, ip.IsValid(), "disconnected relay must not advertise a stale IP")
+		})
+	}
+}
diff --git a/shared/relay/client/manager_cleanup_test.go b/shared/relay/client/manager_cleanup_test.go
new file mode 100644
index 000000000..6ac5daeac
--- /dev/null
+++ b/shared/relay/client/manager_cleanup_test.go
@@ -0,0 +1,60 @@
+package client
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial drives a real, hanging foreign
+// relay dial and asserts cleanUpUnusedRelays does not stall behind it.
+func TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial(t *testing.T) {
+	serverAddr := stallingRelayListener(t)
+
+	mCtx, mCancel := context.WithCancel(context.Background())
+	t.Cleanup(mCancel)
+
+	m := NewManager(mCtx, nil, "alice", 1280)
+
+	dialDone := make(chan struct{})
+	go func() {
+		defer close(dialDone)
+		_, _ = m.openConnVia(mCtx, serverAddr, "peerKey", netip.Addr{})
+	}()
+
+	// The track appears in the map once the dial is in flight.
+	require.Eventually(t, func() bool {
+		m.relayClientsMutex.RLock()
+		defer m.relayClientsMutex.RUnlock()
+		_, ok := m.relayClients[serverAddr]
+		return ok
+	}, 5*time.Second, 5*time.Millisecond, "relay dial did not start")
+
+	cleanupDone := make(chan struct{})
+	go func() {
+		defer close(cleanupDone)
+		m.cleanUpUnusedRelays()
+	}()
+
+	select {
+	case <-cleanupDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("cleanUpUnusedRelays blocked on an in-progress relay dial while holding the relay map lock")
+	}
+
+	m.relayClientsMutex.RLock()
+	_, stillTracked := m.relayClients[serverAddr]
+	m.relayClientsMutex.RUnlock()
+	require.True(t, stillTracked, "an in-progress relay dial must not be evicted by cleanup")
+
+	// Release the hanging dial so the goroutine can exit cleanly.
+	mCancel()
+	select {
+	case <-dialDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("openConnVia did not return after context cancellation")
+	}
+}
diff --git a/shared/relay/client/manager_foreign_stall_test.go b/shared/relay/client/manager_foreign_stall_test.go
new file mode 100644
index 000000000..431629414
--- /dev/null
+++ b/shared/relay/client/manager_foreign_stall_test.go
@@ -0,0 +1,160 @@
+package client
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/relay/server"
+)
+
+// startManagerTestRelay starts a relay server on address and returns a Manager that
+// uses it as its home relay.
+func startManagerTestRelay(t *testing.T, ctx context.Context, address, peerID string) *Manager {
+	t.Helper()
+
+	cfg := server.ListenerConfig{Address: address}
+	srv, err := server.NewServer(newManagerTestServerConfig(cfg.Address))
+	require.NoError(t, err)
+
+	errChan := make(chan error, 1)
+	go func() {
+		if err := srv.Listen(cfg); err != nil {
+			errChan <- err
+		}
+	}()
+	t.Cleanup(func() {
+		_ = srv.Shutdown(context.Background())
+	})
+	require.NoError(t, waitForServerToStart(errChan))
+
+	m := NewManager(ctx, toURL(cfg), peerID, iface.DefaultMTU)
+	require.NoError(t, m.Serve())
+	return m
+}
+
+// TestOpenConn_DoesNotHoldRelayClientLockAcrossDial asserts that dialing an
+// unreachable foreign relay does not stall the relay bookkeeping of the whole node.
+// onServerDisconnected needs relayClientMu in write mode, and a pending writer also
+// blocks later readers, so holding the lock across the dial made one unreachable
+// relay freeze every relay operation for as long as that server's connect timeout.
+func TestOpenConn_DoesNotHoldRelayClientLockAcrossDial(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	m := startManagerTestRelay(t, ctx, "localhost:52801", "alice")
+	stalling := stallingRelayListener(t)
+
+	dialDone := make(chan struct{})
+	go func() {
+		defer close(dialDone)
+		_, _ = m.OpenConn(ctx, stalling, "bob", netip.Addr{})
+	}()
+
+	// The track is published before the dial starts, so its presence means the dial
+	// is in flight and the lock, if taken, is held.
+	require.Eventually(t, func() bool {
+		m.relayClientsMutex.RLock()
+		defer m.relayClientsMutex.RUnlock()
+		_, ok := m.relayClients[stalling]
+		return ok
+	}, 5*time.Second, 5*time.Millisecond, "the foreign relay dial did not start")
+
+	writerDone := make(chan struct{})
+	go func() {
+		defer close(writerDone)
+		m.onServerDisconnected("rel://192.0.2.1:1234")
+	}()
+
+	select {
+	case <-writerDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("onServerDisconnected blocked on an in-progress foreign relay dial")
+	}
+
+	cancel()
+	select {
+	case <-dialDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("OpenConn did not return after context cancellation")
+	}
+}
+
+// TestEvictForeignRelay_KeepsConnectedClient asserts that a disconnect notice naming a
+// server whose track has since been rebuilt does not drop the live client. Evicting it
+// makes the next OpenConn build a duplicate connection, which the relay answers by
+// closing the existing one and with it every relayed channel on that server.
+func TestEvictForeignRelay_KeepsConnectedClient(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	alice := startManagerTestRelay(t, ctx, "localhost:52802", "alice")
+	bob := startManagerTestRelay(t, ctx, "localhost:52803", "bob")
+
+	bobsSrvAddr, _, err := bob.RelayInstanceAddress()
+	require.NoError(t, err)
+
+	_, err = alice.OpenConn(ctx, bobsSrvAddr, "bob", netip.Addr{})
+	require.NoError(t, err, "alice must reach bob over bob's relay")
+
+	alice.relayClientsMutex.RLock()
+	rt, tracked := alice.relayClients[bobsSrvAddr]
+	alice.relayClientsMutex.RUnlock()
+	require.True(t, tracked, "the foreign relay must be tracked after OpenConn")
+	rt.RLock()
+	require.True(t, rt.relayClient.Ready(), "the foreign relay client must be connected")
+	rt.RUnlock()
+
+	// A disconnect notice for the same address, delivered late.
+	alice.evictForeignRelay(bobsSrvAddr)
+
+	alice.relayClientsMutex.RLock()
+	_, stillTracked := alice.relayClients[bobsSrvAddr]
+	alice.relayClientsMutex.RUnlock()
+	require.True(t, stillTracked, "a late disconnect notice must not evict a connected foreign relay client")
+}
+
+// TestEvictForeignRelay_KeepsDialInProgress asserts that a disconnect notice arriving
+// while a new dial for the same server is still running does not delete the track.
+// openConnVia publishes the track before dialing and only fills relayClient once the
+// dial finishes, so an eviction in that window orphans the client that is about to
+// connect: it is no longer reachable through the map, cleanUpUnusedRelays cannot close
+// it, and the next OpenConn dials a duplicate the relay answers by closing the first.
+func TestEvictForeignRelay_KeepsDialInProgress(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	m := NewManager(ctx, nil, "alice", iface.DefaultMTU)
+	stalling := stallingRelayListener(t)
+
+	dialDone := make(chan struct{})
+	go func() {
+		defer close(dialDone)
+		_, _ = m.openConnVia(ctx, stalling, "bob", netip.Addr{})
+	}()
+
+	require.Eventually(t, func() bool {
+		m.relayClientsMutex.RLock()
+		defer m.relayClientsMutex.RUnlock()
+		_, ok := m.relayClients[stalling]
+		return ok
+	}, 5*time.Second, 5*time.Millisecond, "the foreign relay dial did not start")
+
+	m.evictForeignRelay(stalling)
+
+	m.relayClientsMutex.RLock()
+	_, stillTracked := m.relayClients[stalling]
+	m.relayClientsMutex.RUnlock()
+	require.True(t, stillTracked, "a disconnect notice must not evict a track whose dial is still in progress")
+
+	cancel()
+	select {
+	case <-dialDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("openConnVia did not return after context cancellation")
+	}
+}
diff --git a/shared/relay/client/manager_relaystates_test.go b/shared/relay/client/manager_relaystates_test.go
new file mode 100644
index 000000000..f26323323
--- /dev/null
+++ b/shared/relay/client/manager_relaystates_test.go
@@ -0,0 +1,91 @@
+package client
+
+import (
+	"context"
+	"net"
+	"net/netip"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// stallingRelayListener accepts TCP connections and holds them open without ever
+// responding, so a relay handshake dialed against it blocks until its context is
+// cancelled. It returns the "rel://host:port" URL to dial.
+func stallingRelayListener(t *testing.T) string {
+	t.Helper()
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	var mu sync.Mutex
+	var conns []net.Conn
+	go func() {
+		for {
+			c, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			mu.Lock()
+			conns = append(conns, c)
+			mu.Unlock()
+		}
+	}()
+	t.Cleanup(func() {
+		_ = ln.Close()
+		mu.Lock()
+		for _, c := range conns {
+			_ = c.Close()
+		}
+		mu.Unlock()
+	})
+
+	return "rel://" + ln.Addr().String()
+}
+
+// TestRelayStates_DoesNotBlockOnRealHangingDial is a regression test for
+// RelayStates() called by a "status -d command" hanging behind an in-progress
+// relay dial.
+func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
+	serverAddr := stallingRelayListener(t)
+
+	mCtx, mCancel := context.WithCancel(context.Background())
+	t.Cleanup(mCancel)
+
+	m := NewManager(mCtx, nil, "alice", 1280)
+
+	dialDone := make(chan struct{})
+	go func() {
+		defer close(dialDone)
+		_, _ = m.openConnVia(mCtx, serverAddr, "peerKey", netip.Addr{})
+	}()
+
+	require.Eventually(t, func() bool {
+		m.relayClientsMutex.RLock()
+		defer m.relayClientsMutex.RUnlock()
+		_, ok := m.relayClients[serverAddr]
+		return ok
+	}, 5*time.Second, 5*time.Millisecond, "relay dial did not start")
+
+	done := make(chan []RelayConnState, 1)
+	go func() {
+		done <- m.RelayStates()
+	}()
+
+	select {
+	case states := <-done:
+		require.Empty(t, states, "a relay still being dialed carries no state and must be omitted")
+	case <-time.After(2 * time.Second):
+		t.Fatal("RelayStates blocked on a foreign relay whose Connect() is in progress")
+	}
+
+	// Release the hanging dial so the goroutine can exit cleanly.
+	mCancel()
+	select {
+	case <-dialDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("openConnVia did not return after context cancellation")
+	}
+}
diff --git a/shared/relay/client/manager_test.go b/shared/relay/client/manager_test.go
index 9e964f688..4a7840dd7 100644
--- a/shared/relay/client/manager_test.go
+++ b/shared/relay/client/manager_test.go
@@ -2,7 +2,9 @@ package client
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"net"
 	"net/netip"
 	"testing"
 	"time"
@@ -291,35 +293,29 @@ func TestForeignAutoClose(t *testing.T) {
 		t.Fatalf("failed to serve manager: %s", err)
 	}
 
-	// Set up a disconnect listener to track when foreign server disconnects
 	foreignServerURL := toURL(srvCfg2)[0]
-	disconnected := make(chan struct{})
-	onDisconnect := func() {
-		select {
-		case disconnected <- struct{}{}:
-		default:
-		}
-	}
 
 	t.Log("open connection to another peer")
 	if _, err = mgr.OpenConn(ctx, foreignServerURL, "anotherpeer", netip.Addr{}); err == nil {
 		t.Fatalf("should have failed to open connection to another peer")
 	}
 
-	// Add the disconnect listener after the connection attempt
-	if err := mgr.AddCloseListener(foreignServerURL, onDisconnect); err != nil {
-		t.Logf("failed to add close listener (expected if connection failed): %s", err)
-	}
-
-	// Wait for cleanup to happen
 	timeout := relayCleanupInterval + keepUnusedServerTime + 2*time.Second
 	t.Logf("waiting for relay cleanup: %s", timeout)
-
-	select {
-	case <-disconnected:
-		t.Log("foreign relay connection cleaned up successfully")
-	case <-time.After(timeout):
-		t.Log("timeout waiting for cleanup - this might be expected if connection never established")
+	deadline := time.After(timeout)
+	for {
+		mgr.relayClientsMutex.RLock()
+		_, tracked := mgr.relayClients[foreignServerURL]
+		mgr.relayClientsMutex.RUnlock()
+		if !tracked {
+			t.Log("foreign relay connection cleaned up successfully")
+			break
+		}
+		select {
+		case <-deadline:
+			t.Fatal("foreign relay was not cleaned up")
+		case <-time.After(200 * time.Millisecond):
+		}
 	}
 
 	t.Logf("closing manager")
@@ -413,23 +409,24 @@ func waitForReady(ctx context.Context, m *Manager, timeout time.Duration) error
 	return fmt.Errorf("manager not ready within %s", timeout)
 }
 
-func TestNotifierDoubleAdd(t *testing.T) {
+func toURL(address server.ListenerConfig) []string {
+	return []string{"rel://" + address.Address}
+}
+
+func TestConnContextCancelledOnServerDisconnect(t *testing.T) {
 	ctx := context.Background()
 
-	listenerCfg1 := server.ListenerConfig{
-		Address: "localhost:52501",
-	}
-	srv, err := server.NewServer(newManagerTestServerConfig(listenerCfg1.Address))
+	srvCfg := server.ListenerConfig{Address: "localhost:52601"}
+	srv, err := server.NewServer(newManagerTestServerConfig(srvCfg.Address))
 	if err != nil {
 		t.Fatalf("failed to create server: %s", err)
 	}
 	errChan := make(chan error, 1)
 	go func() {
-		if err := srv.Listen(listenerCfg1); err != nil {
+		if err := srv.Listen(srvCfg); err != nil {
 			errChan <- err
 		}
 	}()
-
 	defer func() {
 		if err := srv.Shutdown(ctx); err != nil {
 			t.Errorf("failed to close server: %s", err)
@@ -440,46 +437,106 @@ func TestNotifierDoubleAdd(t *testing.T) {
 		t.Fatalf("failed to start server: %s", err)
 	}
 
-	log.Debugf("connect by alice")
 	mCtx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
-	clientBob := NewManager(mCtx, toURL(listenerCfg1), "bob", iface.DefaultMTU)
-	if err = clientBob.Serve(); err != nil {
+	mgrBob := NewManager(mCtx, toURL(srvCfg), "bob", iface.DefaultMTU)
+	if err := mgrBob.Serve(); err != nil {
+		t.Fatalf("failed to serve bob manager: %s", err)
+	}
+
+	mgr := NewManager(mCtx, toURL(srvCfg), "alice", iface.DefaultMTU)
+	if err := mgr.Serve(); err != nil {
 		t.Fatalf("failed to serve manager: %s", err)
 	}
 
-	clientAlice := NewManager(mCtx, toURL(listenerCfg1), "alice", iface.DefaultMTU)
-	if err = clientAlice.Serve(); err != nil {
+	ra, _, err := mgr.RelayInstanceAddress()
+	if err != nil {
+		t.Fatalf("failed to get relay address: %s", err)
+	}
+
+	relayedConn, err := mgr.OpenConn(ctx, ra, "bob", netip.Addr{})
+	if err != nil {
+		t.Fatalf("failed to open conn: %s", err)
+	}
+
+	select {
+	case <-relayedConn.Context().Done():
+		t.Fatal("conn context cancelled while the relay is still up")
+	default:
+	}
+
+	_ = mgr.relayClient.relayConn.Close()
+
+	select {
+	case <-relayedConn.Context().Done():
+	case <-time.After(15 * time.Second):
+		t.Fatal("conn context was not cancelled after the relay connection dropped")
+	}
+
+	if cause := context.Cause(relayedConn.Context()); !errors.Is(cause, ErrServerDisconnected) {
+		t.Errorf("unexpected cancellation cause: %v, want %v", cause, ErrServerDisconnected)
+	}
+}
+
+func TestConnContextCauseOnLocalClose(t *testing.T) {
+	ctx := context.Background()
+
+	srvCfg := server.ListenerConfig{Address: "localhost:52602"}
+	srv, err := server.NewServer(newManagerTestServerConfig(srvCfg.Address))
+	if err != nil {
+		t.Fatalf("failed to create server: %s", err)
+	}
+	errChan := make(chan error, 1)
+	go func() {
+		if err := srv.Listen(srvCfg); err != nil {
+			errChan <- err
+		}
+	}()
+	defer func() {
+		if err := srv.Shutdown(ctx); err != nil {
+			t.Errorf("failed to close server: %s", err)
+		}
+	}()
+
+	if err := waitForServerToStart(errChan); err != nil {
+		t.Fatalf("failed to start server: %s", err)
+	}
+
+	mCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	mgrBob := NewManager(mCtx, toURL(srvCfg), "bob", iface.DefaultMTU)
+	if err := mgrBob.Serve(); err != nil {
+		t.Fatalf("failed to serve bob manager: %s", err)
+	}
+
+	mgr := NewManager(mCtx, toURL(srvCfg), "alice", iface.DefaultMTU)
+	if err := mgr.Serve(); err != nil {
 		t.Fatalf("failed to serve manager: %s", err)
 	}
 
-	conn1, err := clientAlice.OpenConn(ctx, clientAlice.ServerURLs()[0], "bob", netip.Addr{})
+	ra, _, err := mgr.RelayInstanceAddress()
 	if err != nil {
-		t.Fatalf("failed to bind channel: %s", err)
+		t.Fatalf("failed to get relay address: %s", err)
 	}
 
-	fnCloseListener := OnServerCloseListener(func() {
-		log.Infof("close listener")
-	})
-
-	err = clientAlice.AddCloseListener(clientAlice.ServerURLs()[0], fnCloseListener)
+	relayedConn, err := mgr.OpenConn(ctx, ra, "bob", netip.Addr{})
 	if err != nil {
-		t.Fatalf("failed to add close listener: %s", err)
+		t.Fatalf("failed to open conn: %s", err)
 	}
 
-	err = clientAlice.AddCloseListener(clientAlice.ServerURLs()[0], fnCloseListener)
-	if err != nil {
-		t.Fatalf("failed to add close listener: %s", err)
+	if err := relayedConn.Close(); err != nil {
+		t.Fatalf("failed to close conn: %s", err)
 	}
 
-	err = conn1.Close()
-	if err != nil {
-		t.Errorf("failed to close connection: %s", err)
+	select {
+	case <-relayedConn.Context().Done():
+	case <-time.After(5 * time.Second):
+		t.Fatal("conn context was not cancelled after a local close")
 	}
 
-}
-
-func toURL(address server.ListenerConfig) []string {
-	return []string{"rel://" + address.Address}
+	if cause := context.Cause(relayedConn.Context()); !errors.Is(cause, net.ErrClosed) {
+		t.Errorf("unexpected cancellation cause after a local close: %v, want %v", cause, net.ErrClosed)
+	}
 }
diff --git a/shared/relay/client/picker.go b/shared/relay/client/picker.go
index bb721e4ad..fc1d8c1cb 100644
--- a/shared/relay/client/picker.go
+++ b/shared/relay/client/picker.go
@@ -30,6 +30,7 @@ type ServerPicker struct {
 	MTU               uint16
 	ConnectionTimeout time.Duration
 	TransportFallback *transportFallback
+	NetEvents         NetEvents
 }
 
 func (sp *ServerPicker) PickServer(parentCtx context.Context) (*Client, error) {
@@ -62,7 +63,12 @@ func (sp *ServerPicker) PickServer(parentCtx context.Context) (*Client, error) {
 		if !ok {
 			return nil, <-errChan
 		}
-		log.Infof("chosen home Relay server: %s", cr.Url)
+		instanceURL, serverIP, err := cr.RelayClient.serverInstanceAddress()
+		if err != nil {
+			log.Infof("chosen home Relay server: %s, instance address unavailable: %v", cr.Url, err)
+			return cr.RelayClient, nil
+		}
+		log.Infof("chosen home Relay server: %s, instance URL: %s, server IP: %s", cr.Url, instanceURL, serverIP)
 		return cr.RelayClient, nil
 	case <-ctx.Done():
 		return nil, fmt.Errorf("connect to relay server: %w", ctx.Err())
@@ -73,6 +79,7 @@ func (sp *ServerPicker) startConnection(ctx context.Context, resultChan chan con
 	log.Infof("try to connecting to relay server: %s", url)
 	relayClient := NewClient(url, sp.TokenStore, sp.PeerID, sp.MTU)
 	relayClient.SetTransportFallback(sp.TransportFallback)
+	relayClient.netEvents = sp.NetEvents
 	err := relayClient.Connect(ctx)
 	resultChan <- connResult{
 		RelayClient: relayClient,
diff --git a/shared/relay/messages/address/address.go b/shared/relay/messages/address/address.go
deleted file mode 100644
index 707e73e55..000000000
--- a/shared/relay/messages/address/address.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// Deprecated: This package is deprecated and will be removed in a future release.
-package address
-
-import (
-	"bytes"
-	"encoding/gob"
-	"fmt"
-)
-
-type Address struct {
-	URL string
-}
-
-func (addr *Address) Marshal() ([]byte, error) {
-	var buf bytes.Buffer
-	enc := gob.NewEncoder(&buf)
-	if err := enc.Encode(addr); err != nil {
-		return nil, fmt.Errorf("encode Address: %w", err)
-	}
-	return buf.Bytes(), nil
-}
diff --git a/shared/relay/messages/auth/auth.go b/shared/relay/messages/auth/auth.go
deleted file mode 100644
index 9c2511f2f..000000000
--- a/shared/relay/messages/auth/auth.go
+++ /dev/null
@@ -1,43 +0,0 @@
-// Deprecated: This package is deprecated and will be removed in a future release.
-package auth
-
-import (
-	"bytes"
-	"encoding/gob"
-	"fmt"
-)
-
-type Algorithm int
-
-const (
-	AlgoUnknown Algorithm = iota
-	AlgoHMACSHA256
-	AlgoHMACSHA512
-)
-
-func (a Algorithm) String() string {
-	switch a {
-	case AlgoHMACSHA256:
-		return "HMAC-SHA256"
-	case AlgoHMACSHA512:
-		return "HMAC-SHA512"
-	default:
-		return "Unknown"
-	}
-}
-
-type Msg struct {
-	AuthAlgorithm  Algorithm
-	AdditionalData []byte
-}
-
-func UnmarshalMsg(data []byte) (*Msg, error) {
-	var msg *Msg
-
-	buf := bytes.NewBuffer(data)
-	dec := gob.NewDecoder(buf)
-	if err := dec.Decode(&msg); err != nil {
-		return nil, fmt.Errorf("decode Msg: %w", err)
-	}
-	return msg, nil
-}
diff --git a/shared/relay/messages/message.go b/shared/relay/messages/message.go
index 54671f5df..fdbf2a6e7 100644
--- a/shared/relay/messages/message.go
+++ b/shared/relay/messages/message.go
@@ -14,9 +14,10 @@ const (
 	CurrentProtocolVersion = 1
 
 	MsgTypeUnknown MsgType = 0
-	// Deprecated: Use MsgTypeAuth instead.
-	MsgTypeHello = 1
-	// Deprecated: Use MsgTypeAuthResponse instead.
+	// MsgTypeHello and MsgTypeHelloResponse are the removed legacy handshake
+	// message types. They are retained only to reserve wire values 1 and 2 so
+	// the values are never reused; the server rejects both.
+	MsgTypeHello         = 1
 	MsgTypeHelloResponse = 2
 	MsgTypeTransport     = 3
 	MsgTypeClose         = 4
@@ -42,10 +43,6 @@ const (
 	offsetAuthPeerID    = sizeOfProtoHeader + sizeOfMagicByte
 	headerTotalSizeAuth = sizeOfProtoHeader + headerSizeAuth
 
-	// hello message
-	headerSizeHello     = sizeOfMagicByte + peerIDSize
-	headerSizeHelloResp = 0
-
 	// transport
 	headerSizeTransport      = peerIDSize
 	offsetTransportID        = sizeOfProtoHeader
@@ -113,7 +110,6 @@ func DetermineClientMessageType(msg []byte) (MsgType, error) {
 	msgType := MsgType(msg[1])
 	switch msgType {
 	case
-		MsgTypeHello,
 		MsgTypeAuth,
 		MsgTypeTransport,
 		MsgTypeClose,
@@ -135,7 +131,6 @@ func DetermineServerMessageType(msg []byte) (MsgType, error) {
 	msgType := MsgType(msg[1])
 	switch msgType {
 	case
-		MsgTypeHelloResponse,
 		MsgTypeAuthResponse,
 		MsgTypeTransport,
 		MsgTypeClose,
@@ -148,67 +143,6 @@ func DetermineServerMessageType(msg []byte) (MsgType, error) {
 	}
 }
 
-// Deprecated: Use MarshalAuthMsg instead.
-// MarshalHelloMsg initial hello message
-// The Hello message is the first message sent by a client after establishing a connection with the Relay server. This
-// message is used to authenticate the client with the server. The authentication is done using an HMAC method.
-// The protocol does not limit to use HMAC, it can be any other method. If the authentication failed the server will
-// close the network connection without any response.
-func MarshalHelloMsg(peerID PeerID, additions []byte) ([]byte, error) {
-	msg := make([]byte, sizeOfProtoHeader+sizeOfMagicByte, sizeOfProtoHeader+headerSizeHello+len(additions))
-
-	msg[0] = byte(CurrentProtocolVersion)
-	msg[1] = byte(MsgTypeHello)
-
-	copy(msg[sizeOfProtoHeader:sizeOfProtoHeader+sizeOfMagicByte], magicHeader)
-
-	msg = append(msg, peerID[:]...)
-	msg = append(msg, additions...)
-
-	return msg, nil
-}
-
-// Deprecated: Use UnmarshalAuthMsg instead.
-// UnmarshalHelloMsg extracts peerID and the additional data from the hello message. The Additional data is used to
-// authenticate the client with the server.
-func UnmarshalHelloMsg(msg []byte) (*PeerID, []byte, error) {
-	if len(msg) < sizeOfProtoHeader+headerSizeHello {
-		return nil, nil, ErrInvalidMessageLength
-	}
-	if !bytes.Equal(msg[sizeOfProtoHeader:sizeOfProtoHeader+sizeOfMagicByte], magicHeader) {
-		return nil, nil, errors.New("invalid magic header")
-	}
-
-	peerID := PeerID(msg[sizeOfProtoHeader+sizeOfMagicByte : sizeOfProtoHeader+headerSizeHello])
-
-	return &peerID, msg[headerSizeHello:], nil
-}
-
-// Deprecated: Use MarshalAuthResponse instead.
-// MarshalHelloResponse creates a response message to the hello message.
-// In case of success connection the server response with a Hello Response message. This message contains the server's
-// instance URL. This URL will be used by choose the common Relay server in case if the peers are in different Relay
-// servers.
-func MarshalHelloResponse(additionalData []byte) ([]byte, error) {
-	msg := make([]byte, sizeOfProtoHeader, sizeOfProtoHeader+headerSizeHelloResp+len(additionalData))
-
-	msg[0] = byte(CurrentProtocolVersion)
-	msg[1] = byte(MsgTypeHelloResponse)
-
-	msg = append(msg, additionalData...)
-
-	return msg, nil
-}
-
-// Deprecated: Use UnmarshalAuthResponse instead.
-// UnmarshalHelloResponse extracts the additional data from the hello response message.
-func UnmarshalHelloResponse(msg []byte) ([]byte, error) {
-	if len(msg) < sizeOfProtoHeader+headerSizeHelloResp {
-		return nil, ErrInvalidMessageLength
-	}
-	return msg, nil
-}
-
 // MarshalAuthMsg initial authentication message
 // The Auth message is the first message sent by a client after establishing a connection with the Relay server. This
 // message is used to authenticate the client with the server. The authentication is done using an HMAC method.
diff --git a/shared/relay/messages/message_test.go b/shared/relay/messages/message_test.go
index 59a89cad1..26a504063 100644
--- a/shared/relay/messages/message_test.go
+++ b/shared/relay/messages/message_test.go
@@ -4,28 +4,11 @@ import (
 	"testing"
 )
 
-func TestMarshalHelloMsg(t *testing.T) {
-	peerID := HashID("abdFAaBcawquEiCMzAabYosuUaGLtSNhKxz+")
-	msg, err := MarshalHelloMsg(peerID, nil)
-	if err != nil {
-		t.Fatalf("error: %v", err)
-	}
-
-	msgType, err := DetermineClientMessageType(msg)
-	if err != nil {
-		t.Fatalf("error: %v", err)
-	}
-
-	if msgType != MsgTypeHello {
-		t.Errorf("expected %d, got %d", MsgTypeHello, msgType)
-	}
-
-	receivedPeerID, _, err := UnmarshalHelloMsg(msg)
-	if err != nil {
-		t.Fatalf("error: %v", err)
-	}
-	if receivedPeerID.String() != peerID.String() {
-		t.Errorf("expected %s, got %s", peerID, receivedPeerID)
+func TestDetermineClientMessageTypeRejectsHello(t *testing.T) {
+	// The reserved legacy Hello message (type 1) must be rejected by the server.
+	msg := []byte{byte(CurrentProtocolVersion), byte(MsgTypeHello)}
+	if _, err := DetermineClientMessageType(msg); err == nil {
+		t.Fatalf("expected hello message type to be rejected")
 	}
 }
 
diff --git a/shared/signal/client/grpc.go b/shared/signal/client/grpc.go
index a07867263..22239047b 100644
--- a/shared/signal/client/grpc.go
+++ b/shared/signal/client/grpc.go
@@ -19,6 +19,7 @@ import (
 	"google.golang.org/grpc/status"
 
 	nbgrpc "github.com/netbirdio/netbird/client/grpc"
+	"github.com/netbirdio/netbird/client/netevents"
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/shared/management/client"
 	"github.com/netbirdio/netbird/shared/signal/proto"
@@ -37,6 +38,8 @@ const (
 	receiveProbeTimeout = 10 * time.Second
 	// receiveWatchdogInterval is how often the watchdog evaluates the stream.
 	receiveWatchdogInterval = 10 * time.Second
+	// defaultRegistrationTimeout bounds the wait for a new stream's registration header.
+	defaultRegistrationTimeout = 10 * time.Second
 )
 
 // errReceiveStreamStalled is reported when the receive stream is transport-alive
@@ -52,6 +55,7 @@ type ConnStateNotifier interface {
 // GrpcClient Wraps the Signal Exchange Service gRpc client
 type GrpcClient struct {
 	key        wgtypes.Key
+	sharedKeys *encryption.SharedKeyCache
 	realClient proto.SignalExchangeClient
 	signalConn *grpc.ClientConn
 	ctx        context.Context
@@ -65,6 +69,10 @@ type GrpcClient struct {
 	connStateCallback     ConnStateNotifier
 	connStateCallbackLock sync.RWMutex
 
+	// netMgr gates the Receive retry loop on OS-reported network
+	// availability and sweeps the transport on network change.
+	netMgr *netevents.Manager
+
 	onReconnectedListenerFn func()
 
 	decryptionWorker       *Worker
@@ -86,15 +94,43 @@ type GrpcClient struct {
 	// new stream feeds the same worker, and only triggers a reconnect storm.
 	receiveHandoffBlocked atomic.Bool
 	watchdogWg            sync.WaitGroup
+
+	registrationTimeout time.Duration
+}
+
+// Option configures optional GrpcClient behavior.
+type Option func(*GrpcClient)
+
+// WithNetEvents injects the OS network event handling.
+func WithNetEvents(events *netevents.Manager) Option {
+	return func(c *GrpcClient) { c.netMgr = events }
 }
 
 // NewClient creates a new Signal client
-func NewClient(ctx context.Context, addr string, key wgtypes.Key, tlsEnabled bool) (*GrpcClient, error) {
-	var conn *grpc.ClientConn
+func NewClient(ctx context.Context, addr string, key wgtypes.Key, tlsEnabled bool, opts ...Option) (*GrpcClient, error) {
+	// Options apply before dialing: the sweeper must wrap the first connection too.
+	c := &GrpcClient{
+		ctx:                   ctx,
+		key:                   key,
+		sharedKeys:            encryption.NewSharedKeyCache(key),
+		mux:                   sync.Mutex{},
+		status:                StreamDisconnected,
+		connStateCallbackLock: sync.RWMutex{},
+		registrationTimeout:   defaultRegistrationTimeout,
+	}
+	for _, opt := range opts {
+		opt(c)
+	}
 
+	var extraOpts []grpc.DialOption
+	if c.netMgr != nil {
+		extraOpts = append(extraOpts, nbgrpc.WithSweeper(c.netMgr))
+	}
+
+	var conn *grpc.ClientConn
 	operation := func() error {
 		var err error
-		conn, err = nbgrpc.CreateConnection(ctx, addr, tlsEnabled, wsproxy.SignalComponent)
+		conn, err = nbgrpc.CreateConnection(ctx, addr, tlsEnabled, wsproxy.SignalComponent, extraOpts...)
 		if err != nil {
 			return fmt.Errorf("create connection: %w", err)
 		}
@@ -109,15 +145,9 @@ func NewClient(ctx context.Context, addr string, key wgtypes.Key, tlsEnabled boo
 
 	log.Debugf("connected to Signal Service: %v", conn.Target())
 
-	return &GrpcClient{
-		realClient:            proto.NewSignalExchangeClient(conn),
-		ctx:                   ctx,
-		signalConn:            conn,
-		key:                   key,
-		mux:                   sync.Mutex{},
-		status:                StreamDisconnected,
-		connStateCallbackLock: sync.RWMutex{},
-	}, nil
+	c.signalConn = conn
+	c.realClient = proto.NewSignalExchangeClient(conn)
+	return c, nil
 }
 
 func (c *GrpcClient) StreamConnected() bool {
@@ -135,6 +165,7 @@ func (c *GrpcClient) Close() error {
 	}
 	c.decryptionWg.Wait()
 	c.decryptionWorker = nil
+	c.sharedKeys.Close()
 
 	return c.signalConn.Close()
 }
@@ -165,26 +196,46 @@ func defaultBackoff(ctx context.Context) backoff.BackOff {
 // The connection retry logic will try to reconnect for 30 min and if wasn't successful will propagate the error to the function caller.
 func (c *GrpcClient) Receive(ctx context.Context, msgHandler func(msg *proto.Message) error) error {
 
-	var backOff = defaultBackoff(ctx)
+	backOff := c.netMgr.QuickRetryBackoff(ctx, defaultBackoff(ctx))
 
 	operation := func() error {
+		// suspend reconnect attempts while the OS reports no usable network.
+		// Wait only errors on a cancelled context, which means shutdown, so
+		// stop the loop without reporting a failure.
+		if waited, err := c.netMgr.Wait(ctx); err != nil {
+			log.Debugf("signal connection context has been canceled while offline, this usually indicates shutdown")
+			return nil
+		} else if waited {
+			backOff.Reset()
+			// dials attempted while offline grew the channel's internal backoff;
+			// reset it too, or the reconnect waits out that timer first
+			c.signalConn.ResetConnectBackoff()
+		}
 
 		c.notifyStreamDisconnected()
 
-		log.Debugf("signal connection state %v", c.signalConn.GetState())
 		connState := c.signalConn.GetState()
+		log.Debugf("signal connection state %v", connState)
 		if connState == connectivity.Shutdown {
 			return backoff.Permanent(fmt.Errorf("connection to signal has been shut down"))
-		} else if !(connState == connectivity.Ready || connState == connectivity.Idle) {
+		}
+		if !(connState == connectivity.Ready || connState == connectivity.Idle) {
+			// A dial may already be in flight (e.g. triggered by another RPC
+			// after a network change); wait for it to settle and proceed if
+			// the channel became usable, instead of burning a backoff round on
+			// a successful dial. A failed dial errors out as before.
 			c.signalConn.WaitForStateChange(ctx, connState)
-			return fmt.Errorf("connection to signal is not ready and in %s state", connState)
+			connState = c.signalConn.GetState()
+			if !(connState == connectivity.Ready || connState == connectivity.Idle) {
+				return fmt.Errorf("connection to signal is not ready and in %s state", connState)
+			}
 		}
 
 		// connect to Signal stream identifying ourselves with a public WireGuard key
 		// todo once the key rotation logic has been implemented, consider changing to some other identifier (received from management)
 		streamCtx, cancelStream := context.WithCancel(ctx)
 		defer cancelStream()
-		stream, err := c.connect(streamCtx, c.key.PublicKey().String())
+		stream, err := c.connect(streamCtx, cancelStream, c.key.PublicKey().String())
 		if err != nil {
 			log.Warnf("disconnected from the Signal Exchange due to an error: %v", err)
 			return err
@@ -231,7 +282,7 @@ func (c *GrpcClient) Receive(ctx context.Context, msgHandler func(msg *proto.Mes
 		return nil
 	}
 
-	err := backoff.Retry(operation, backOff)
+	err := nbgrpc.Retry(ctx, operation, backOff, c.netMgr)
 	if err != nil {
 		log.Errorf("exiting the Signal service connection retry loop due to the unrecoverable error: %v", err)
 		return err
@@ -248,7 +299,6 @@ func (c *GrpcClient) notifyStreamDisconnected() {
 
 func (c *GrpcClient) notifyStreamConnected() {
 	c.mux.Lock()
-	defer c.mux.Unlock()
 
 	c.status = StreamConnected
 	if c.connectedCh != nil {
@@ -257,12 +307,16 @@ func (c *GrpcClient) notifyStreamConnected() {
 		c.connectedCh = nil
 	}
 
-	if c.onReconnectedListenerFn != nil {
-		c.onReconnectedListenerFn()
+	listener := c.onReconnectedListenerFn
+	c.mux.Unlock()
+
+	// Listeners can hold their own locks while unregistering from this client.
+	if listener != nil {
+		listener()
 	}
 }
 
-func (c *GrpcClient) connect(ctx context.Context, key string) (proto.SignalExchange_ConnectStreamClient, error) {
+func (c *GrpcClient) connect(ctx context.Context, cancel context.CancelFunc, key string) (proto.SignalExchange_ConnectStreamClient, error) {
 	c.stream = nil
 
 	// add key fingerprint to the request header to be identified on the server side
@@ -273,19 +327,30 @@ func (c *GrpcClient) connect(ctx context.Context, key string) (proto.SignalExcha
 	if err != nil {
 		return nil, err
 	}
-	// blocks
-	header, err := c.stream.Header()
-	if err != nil {
+	if err := awaitRegistration(stream, c.registrationTimeout, cancel); err != nil {
 		return nil, err
 	}
-	registered := header.Get(proto.HeaderRegistered)
-	if len(registered) == 0 {
-		return nil, fmt.Errorf("didn't receive a registration header from the Signal server whille connecting to the streams")
-	}
 
 	return stream, nil
 }
 
+func awaitRegistration(stream proto.SignalExchange_ConnectStreamClient, timeout time.Duration, cancel context.CancelFunc) error {
+	// A timer rather than a context deadline: the stream context must outlive registration.
+	timer := time.AfterFunc(timeout, cancel)
+	header, err := stream.Header()
+	if !timer.Stop() {
+		return fmt.Errorf("no registration header from the Signal server within %s", timeout)
+	}
+	if err != nil {
+		return err
+	}
+	registered := header.Get(proto.HeaderRegistered)
+	if len(registered) == 0 {
+		return fmt.Errorf("didn't receive a registration header from the Signal server whille connecting to the streams")
+	}
+	return nil
+}
+
 // Ready indicates whether the client is okay and Ready to be used
 // for now it just checks whether gRPC connection to the service is in state Ready
 func (c *GrpcClient) Ready() bool {
@@ -297,6 +362,13 @@ func (c *GrpcClient) Ready() bool {
 // recorder accordingly. It does not actively probe: the watchdog
 // (watchReceiveStream) owns probing the receive path and reconnecting.
 func (c *GrpcClient) IsHealthy() bool {
+	c.mux.Lock()
+	registered := c.status == StreamConnected
+	c.mux.Unlock()
+	if !registered {
+		return false
+	}
+
 	switch c.signalConn.GetState() {
 	case connectivity.TransientFailure:
 		return false
@@ -340,6 +412,7 @@ func (c *GrpcClient) WaitStreamConnected(ctx context.Context) {
 	}
 }
 
+// SetOnReconnectedListener replaces the listener without waiting for an in-flight callback.
 func (c *GrpcClient) SetOnReconnectedListener(fn func()) {
 	c.mux.Lock()
 	defer c.mux.Unlock()
@@ -375,7 +448,7 @@ func (c *GrpcClient) decryptMessage(msg *proto.EncryptedMessage) (*proto.Message
 	}
 
 	body := &proto.Body{}
-	err = encryption.DecryptMessage(remoteKey, c.key, msg.GetBody(), body)
+	err = c.sharedKeys.DecryptMessage(remoteKey, msg.GetBody(), body)
 	if err != nil {
 		return nil, err
 	}
@@ -395,7 +468,7 @@ func (c *GrpcClient) encryptMessage(msg *proto.Message) (*proto.EncryptedMessage
 		return nil, err
 	}
 
-	encryptedBody, err := encryption.EncryptMessage(remoteKey, c.key, msg.Body)
+	encryptedBody, err := c.sharedKeys.EncryptMessage(remoteKey, msg.Body)
 	if err != nil {
 		return nil, err
 	}
diff --git a/shared/signal/client/health_test.go b/shared/signal/client/health_test.go
new file mode 100644
index 000000000..d62ee2cc2
--- /dev/null
+++ b/shared/signal/client/health_test.go
@@ -0,0 +1,130 @@
+package client
+
+import (
+	"context"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/credentials/insecure"
+
+	sigProto "github.com/netbirdio/netbird/shared/signal/proto"
+)
+
+type recordingNotifier struct {
+	mu        sync.Mutex
+	connected bool
+}
+
+func (n *recordingNotifier) MarkSignalDisconnected(error) {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	n.connected = false
+}
+
+func (n *recordingNotifier) MarkSignalConnected() {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	n.connected = true
+}
+
+func (n *recordingNotifier) isConnected() bool {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	return n.connected
+}
+
+// TestIsHealthyRequiresRegisteredStream covers the status reporting half of a
+// stuck registration: the gRPC connection to Signal is up but no stream is
+// registered, so no peer can reach this client. The health check used to look
+// at the connection only, reporting Signal as connected throughout.
+func TestIsHealthyRequiresRegisteredStream(t *testing.T) {
+	addr := startTestSignalServer(t)
+
+	key, err := wgtypes.GenerateKey()
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	client, err := NewClient(ctx, addr, key, false)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+
+	notifier := &recordingNotifier{}
+	client.SetConnStateListener(notifier)
+
+	assert.False(t, client.IsHealthy(), "no registered stream must not be reported healthy")
+	assert.False(t, notifier.isConnected(), "no registered stream must not mark Signal connected")
+
+	// Stop Receive before Close runs (cleanups are LIFO), so the two never overlap.
+	receiveDone := make(chan struct{})
+	go func() {
+		defer close(receiveDone)
+		_ = client.Receive(ctx, func(*sigProto.Message) error { return nil })
+	}()
+	t.Cleanup(func() {
+		cancel()
+		<-receiveDone
+	})
+
+	streamReady := make(chan struct{})
+	go func() {
+		client.WaitStreamConnected(ctx)
+		close(streamReady)
+	}()
+	select {
+	case <-streamReady:
+	case <-time.After(5 * time.Second):
+		t.Fatal("signal stream did not connect within timeout")
+	}
+
+	assert.True(t, client.IsHealthy(), "a registered stream on a usable connection must be healthy")
+	assert.True(t, notifier.isConnected(), "a registered stream must mark Signal connected")
+}
+
+// TestIsHealthyConnectingWithoutStream covers the window while the connection is
+// still being established: a TCP listener that accepts but never speaks HTTP/2
+// keeps the channel in Connecting, and with no registered stream the client
+// cannot receive anything yet, so it must not be reported healthy.
+func TestIsHealthyConnectingWithoutStream(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	var mu sync.Mutex
+	var accepted []net.Conn
+	t.Cleanup(func() {
+		_ = lis.Close()
+		mu.Lock()
+		defer mu.Unlock()
+		for _, c := range accepted {
+			_ = c.Close()
+		}
+	})
+	go func() {
+		for {
+			c, err := lis.Accept()
+			if err != nil {
+				return
+			}
+			mu.Lock()
+			accepted = append(accepted, c)
+			mu.Unlock()
+		}
+	}()
+
+	conn, err := grpc.NewClient(lis.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	conn.Connect()
+	require.Eventually(t, func() bool { return conn.GetState() == connectivity.Connecting }, 5*time.Second, 10*time.Millisecond,
+		"channel should be stuck connecting to a listener that never answers")
+
+	client := &GrpcClient{signalConn: conn, status: StreamDisconnected}
+	assert.False(t, client.IsHealthy(), "a connecting channel with no registered stream must not be reported healthy")
+}
diff --git a/shared/signal/client/reconnect_test.go b/shared/signal/client/reconnect_test.go
new file mode 100644
index 000000000..bf4e2cb87
--- /dev/null
+++ b/shared/signal/client/reconnect_test.go
@@ -0,0 +1,98 @@
+package client
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestReconnectListenerCanBeClearedWhileCallbackIsBlocked(t *testing.T) {
+	client := &GrpcClient{}
+	var listenerMu sync.Mutex
+	callbackStarted := make(chan struct{})
+	callbackFinished := make(chan struct{})
+	callbackCalls := 0
+	client.SetOnReconnectedListener(func() {
+		callbackCalls++
+		close(callbackStarted)
+		listenerMu.Lock()
+		close(callbackFinished)
+		listenerMu.Unlock()
+	})
+
+	// SRWatcher.Close holds its own mutex while removing the listener. A
+	// reconnect callback waiting for that mutex must not block its removal.
+	listenerMu.Lock()
+	notificationDone := make(chan struct{})
+	go func() {
+		defer close(notificationDone)
+		client.notifyStreamConnected()
+	}()
+	var unregisterDone chan struct{}
+	t.Cleanup(func() {
+		// Release the callback even when the regression assertion fails, so
+		// the unfixed implementation does not leave deadlocked goroutines.
+		listenerMu.Unlock()
+		select {
+		case <-notificationDone:
+			select {
+			case <-callbackFinished:
+			default:
+				t.Error("in-flight callback did not finish after listener removal")
+			}
+		case <-time.After(5 * time.Second):
+			t.Error("reconnect notification did not finish after releasing the listener")
+		}
+		if unregisterDone != nil {
+			select {
+			case <-unregisterDone:
+			case <-time.After(5 * time.Second):
+				t.Error("listener removal did not finish after releasing the listener")
+			}
+		}
+	})
+
+	select {
+	case <-callbackStarted:
+	case <-time.After(5 * time.Second):
+		t.Fatal("reconnect callback did not start")
+	}
+
+	unregisterDone = make(chan struct{})
+	go func() {
+		client.SetOnReconnectedListener(nil)
+		close(unregisterDone)
+	}()
+	select {
+	case <-unregisterDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("listener removal blocked behind the reconnect callback")
+	}
+
+	// Registration still becomes visible, and future notifications do not
+	// invoke the removed listener even while its first callback is in flight.
+	assert.True(t, client.StreamConnected(), "listener removal must preserve stream registration")
+	client.notifyStreamConnected()
+	assert.Equal(t, 1, callbackCalls, "future notifications must not invoke the removed listener")
+}
+
+func TestReconnectListenerRunsAfterRegistrationWaitersAreReleased(t *testing.T) {
+	connected := make(chan struct{})
+	client := &GrpcClient{connectedCh: connected}
+	called := false
+	client.SetOnReconnectedListener(func() {
+		called = true
+		select {
+		case <-connected:
+		default:
+			t.Error("reconnect callback ran before registration waiters were released")
+		}
+	})
+
+	client.notifyStreamConnected()
+
+	assert.True(t, called, "reconnect notification must invoke its listener synchronously")
+	assert.True(t, client.StreamConnected(), "stream must remain registered after the callback")
+}
diff --git a/shared/signal/client/registration_test.go b/shared/signal/client/registration_test.go
new file mode 100644
index 000000000..7703f843d
--- /dev/null
+++ b/shared/signal/client/registration_test.go
@@ -0,0 +1,86 @@
+package client
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	sigProto "github.com/netbirdio/netbird/shared/signal/proto"
+	"github.com/netbirdio/netbird/signal/server"
+)
+
+// stallingSignalServer holds the first ConnectStream open without ever sending
+// the registration header, while the transport keeps answering keepalive pings.
+// Later streams go to the real server. This is what a responder in front of or
+// inside Signal looks like when it accepts a stream and never answers it.
+type stallingSignalServer struct {
+	*server.Server
+	stalled atomic.Bool
+	held    chan struct{}
+}
+
+func (s *stallingSignalServer) ConnectStream(stream sigProto.SignalExchange_ConnectStreamServer) error {
+	if s.stalled.CompareAndSwap(false, true) {
+		close(s.held)
+		<-stream.Context().Done()
+		return stream.Context().Err()
+	}
+	return s.Server.ConnectStream(stream)
+}
+
+// TestReceiveRetriesWhenRegistrationHeaderNeverArrives reproduces a client stuck
+// forever waiting for the registration header of a stream the server side never
+// answers: the receive watchdog only starts after registration, so nothing ended
+// the wait and Signal never came back until the daemon was restarted. The client
+// must give up on the silent stream and register on a new one.
+func TestReceiveRetriesWhenRegistrationHeaderNeverArrives(t *testing.T) {
+	realServer, err := server.NewServer(context.Background(), otel.Meter(""))
+	require.NoError(t, err)
+	stalling := &stallingSignalServer{Server: realServer, held: make(chan struct{})}
+	addr := serveTestSignalExchange(t, stalling)
+
+	key, err := wgtypes.GenerateKey()
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	client, err := NewClient(ctx, addr, key, false)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+	client.registrationTimeout = 200 * time.Millisecond
+
+	// Stop Receive before Close runs (cleanups are LIFO), so the two never overlap.
+	receiveDone := make(chan struct{})
+	go func() {
+		defer close(receiveDone)
+		_ = client.Receive(ctx, func(*sigProto.Message) error { return nil })
+	}()
+	t.Cleanup(func() {
+		cancel()
+		<-receiveDone
+	})
+
+	select {
+	case <-stalling.held:
+	case <-time.After(5 * time.Second):
+		t.Fatal("first stream did not reach the stalling server")
+	}
+
+	streamReady := make(chan struct{})
+	go func() {
+		client.WaitStreamConnected(ctx)
+		close(streamReady)
+	}()
+	select {
+	case <-streamReady:
+	case <-time.After(5 * time.Second):
+		t.Fatal("client never registered after the first stream went unanswered")
+	}
+	require.True(t, client.StreamConnected(), "client should report a registered stream")
+}
diff --git a/shared/signal/client/watchdog_test.go b/shared/signal/client/watchdog_test.go
index a8bbafa29..ab0ab512e 100644
--- a/shared/signal/client/watchdog_test.go
+++ b/shared/signal/client/watchdog_test.go
@@ -19,13 +19,20 @@ import (
 func startTestSignalServer(t *testing.T) string {
 	t.Helper()
 
+	srv, err := server.NewServer(context.Background(), otel.Meter(""))
+	require.NoError(t, err)
+
+	return serveTestSignalExchange(t, srv)
+}
+
+func serveTestSignalExchange(t *testing.T, impl sigProto.SignalExchangeServer) string {
+	t.Helper()
+
 	lis, err := net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 
 	s := grpc.NewServer()
-	srv, err := server.NewServer(context.Background(), otel.Meter(""))
-	require.NoError(t, err)
-	sigProto.RegisterSignalExchangeServer(s, srv)
+	sigProto.RegisterSignalExchangeServer(s, impl)
 
 	go func() {
 		_ = s.Serve(lis)
diff --git a/shared/signal/proto/generate.sh b/shared/signal/proto/generate.sh
index 720a5ff66..718eae152 100755
--- a/shared/signal/proto/generate.sh
+++ b/shared/signal/proto/generate.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 if ! which realpath > /dev/null 2>&1
diff --git a/shared/testing_helpers/populate_fields.go b/shared/testing_helpers/populate_fields.go
new file mode 100644
index 000000000..c93d62b69
--- /dev/null
+++ b/shared/testing_helpers/populate_fields.go
@@ -0,0 +1,101 @@
+package testing_helpers
+
+import (
+	"fmt"
+	"net/netip"
+	"reflect"
+)
+
+type PopulateFields struct {
+	CustomFieldSetters map[reflect.Type]func(this *PopulateFields, field reflect.Value) (int, error)
+	TagsToSkip         map[string]string
+}
+
+func NewPopulateFields() *PopulateFields {
+	return &PopulateFields{CustomFieldSetters: defaultCustomFieldSetters(), TagsToSkip: make(map[string]string)}
+}
+
+func (p *PopulateFields) WithCustomFieldSetter(t reflect.Type, f func(this *PopulateFields, field reflect.Value) (int, error)) *PopulateFields {
+	p.CustomFieldSetters[t] = f
+	return p
+}
+
+func (p *PopulateFields) WithSkippedTag(tag, value string) *PopulateFields {
+	p.TagsToSkip[tag] = value
+	return p
+}
+
+func (p *PopulateFields) PopulateAll(v reflect.Value) (int, error) {
+	typ := v.Type()
+	totalExportedFields := 0
+	for i := 0; i < typ.NumField(); i++ {
+		f := typ.Field(i)
+		if f.PkgPath != "" { // unexported
+			continue
+		}
+
+		if p.skippedTagPresent(f.Tag) {
+			continue
+		}
+
+		numOfExportedFields, err := p.setNonZero(v.Field(i))
+		totalExportedFields += numOfExportedFields
+		if err != nil {
+			return totalExportedFields, err
+		}
+	}
+	return totalExportedFields, nil
+}
+
+// setNonZero assigns a deterministic non-zero value to a field based on its kind,
+// recursing into nested structs and populating one element of slice fields.
+func (p *PopulateFields) setNonZero(field reflect.Value) (int, error) {
+	if f, ok := p.CustomFieldSetters[field.Type()]; ok {
+		return f(p, field)
+	}
+
+	switch field.Kind() {
+	case reflect.String:
+		field.SetString("non-zero")
+	case reflect.Bool:
+		field.SetBool(true)
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		field.SetInt(7)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		field.SetUint(7)
+	case reflect.Float32, reflect.Float64:
+		field.SetFloat(7)
+	case reflect.Struct:
+		n, err := p.PopulateAll(field)
+		return n + 1, err
+	case reflect.Slice:
+		s := reflect.MakeSlice(field.Type(), 1, 1)
+		_, err := p.setNonZero(s.Index(0))
+		if err != nil {
+			return 0, err
+		}
+		field.Set(s)
+	default:
+		return 0, fmt.Errorf("unhandled field kind %s; extend setNonZero", field.Kind())
+	}
+
+	return 1, nil
+}
+
+func defaultCustomFieldSetters() map[reflect.Type]func(this *PopulateFields, field reflect.Value) (int, error) {
+	return map[reflect.Type]func(this *PopulateFields, field reflect.Value) (int, error){
+		reflect.TypeOf(netip.Prefix{}): func(_ *PopulateFields, field reflect.Value) (int, error) {
+			field.Set(reflect.ValueOf(netip.MustParsePrefix("10.0.0.0/24")))
+			return 1, nil
+		},
+	}
+}
+
+func (p *PopulateFields) skippedTagPresent(t reflect.StructTag) bool {
+	for tag, value := range p.TagsToSkip {
+		if v := t.Get(tag); v == value {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sharedsock/example/main.go b/sharedsock/example/main.go
index da62b276e..4fa1766b6 100644
--- a/sharedsock/example/main.go
+++ b/sharedsock/example/main.go
@@ -14,8 +14,8 @@ import (
 func main() {
 
 	port := 51820
-	rawSock, err := sharedsock.Listen(port, sharedsock.NewIncomingSTUNFilter(), iface.DefaultMTU)
-	if err != nil {
+	rawSock, err := sharedsock.Listen(port, sharedsock.NewIncomingSTUNFilter(), iface.DefaultMTU) //nolint:staticcheck
+	if err != nil {                                                                               //nolint:staticcheck // always errors on non-Linux builds
 		panic(err)
 	}
 
diff --git a/sharedsock/sock_linux.go b/sharedsock/sock_linux.go
index 4855e1aed..640f813c9 100644
--- a/sharedsock/sock_linux.go
+++ b/sharedsock/sock_linux.go
@@ -10,13 +10,13 @@ import (
 	"context"
 	"fmt"
 	"net"
+	"net/netip"
 	"time"
 
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/mdlayher/socket"
 	log "github.com/sirupsen/logrus"
-	"github.com/vishvananda/netlink"
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/sys/unix"
 
@@ -24,7 +24,7 @@ import (
 )
 
 // ErrSharedSockStopped indicates that shared socket has been stopped
-var ErrSharedSockStopped = fmt.Errorf("shared socked stopped")
+var ErrSharedSockStopped = fmt.Errorf("shared socket stopped")
 
 // SharedSocket is a net.PacketConn that initiates two raw sockets (ipv4 and ipv6) and listens to UDP packets filtered
 // by BPF instructions (e.g., IncomingSTUNFilter that checks and sends only STUN packets to the listeners (ReadFrom)).
@@ -33,6 +33,8 @@ type SharedSocket struct {
 	ctx         context.Context
 	conn4       *socket.Conn
 	conn6       *socket.Conn
+	probe4      *srcProbe
+	probe6      *srcProbe
 	port        int
 	mtu         uint16
 	packetDemux chan rcvdPacket
@@ -87,14 +89,26 @@ func Listen(port int, filter BPFFilter, mtu uint16) (_ net.PacketConn, err error
 		return nil, fmt.Errorf("set SO_MARK on ipv4 socket: %w", err)
 	}
 
+	if rawSock.probe4, err = newSrcProbe(unix.AF_INET); err != nil {
+		return nil, err
+	}
+
 	var sockErr error
 	rawSock.conn6, sockErr = socket.Socket(unix.AF_INET6, unix.SOCK_RAW, unix.IPPROTO_UDP, "raw_udp6", nil)
 	if sockErr != nil {
-		log.Errorf("Failed to create ipv6 raw socket: %v", err)
+		log.Errorf("Failed to create ipv6 raw socket: %v", sockErr)
 	} else {
 		if err = nbnet.SetSocketMark(rawSock.conn6); err != nil {
 			return nil, fmt.Errorf("set SO_MARK on ipv6 socket: %w", err)
 		}
+		rawSock.probe6, sockErr = newSrcProbe(unix.AF_INET6)
+		if sockErr != nil {
+			log.Errorf("Failed to create ipv6 source probe, continuing without ipv6: %v", sockErr)
+			if closeErr := rawSock.conn6.Close(); closeErr != nil {
+				log.Debugf("failed to close ipv6 raw socket: %v", closeErr)
+			}
+			rawSock.conn6 = nil
+		}
 	}
 
 	ipv4Instructions, ipv6Instructions, err := filter.GetInstructions(uint32(rawSock.port))
@@ -121,23 +135,36 @@ func Listen(port int, filter BPFFilter, mtu uint16) (_ net.PacketConn, err error
 	return rawSock, nil
 }
 
-// resolveSrc returns the source IP the kernel will pick for a packet sent to
-// dst by these raw sockets, mirroring the fwmark the kernel will see on send.
-func (s *SharedSocket) resolveSrc(dst net.IP) (net.IP, error) {
-	opts := &netlink.RouteGetOptions{}
-	if nbnet.AdvancedRouting() {
-		opts.Mark = nbnet.ControlPlaneMark
+// sockaddr returns the raw send address for dst, carrying the scope of its zone.
+func (s *SharedSocket) sockaddr(dst netip.Addr) (unix.Sockaddr, error) {
+	if dst.Zone() == "" {
+		return rawSockaddr(dst, 0), nil
 	}
-	routes, err := netlink.RouteGetWithOptions(dst, opts)
+	if s.conn6 == nil {
+		return nil, fmt.Errorf("no raw socket for %s", dst)
+	}
+	rc, err := s.conn6.SyscallConn()
 	if err != nil {
-		return nil, fmt.Errorf("route get %s: %w", dst, err)
+		return nil, fmt.Errorf("ipv6 raw socket: %w", err)
 	}
-	for _, r := range routes {
-		if r.Src != nil {
-			return r.Src, nil
-		}
+	scope, err := zoneIndex(rc, dst.Zone())
+	if err != nil {
+		return nil, err
 	}
-	return nil, fmt.Errorf("no source IP for %s", dst)
+	return rawSockaddr(dst, scope), nil
+}
+
+// resolveSrc returns the source IP the kernel will pick for a packet sent to sa
+// by these raw sockets, mirroring the fwmark the kernel will see on send.
+func (s *SharedSocket) resolveSrc(dst netip.Addr, sa unix.Sockaddr) (netip.Addr, error) {
+	probe := s.probe4
+	if dst.Is6() {
+		probe = s.probe6
+	}
+	if probe == nil {
+		return netip.Addr{}, fmt.Errorf("no raw socket for %s", dst)
+	}
+	return probe.resolve(sa)
 }
 
 // LocalAddr returns the local address, preferring IPv4 for backward compatibility.
@@ -222,6 +249,13 @@ func (s *SharedSocket) Close() error {
 	if s.conn6 != nil {
 		errGrp.Go(s.conn6.Close)
 	}
+
+	if s.probe4 != nil {
+		errGrp.Go(s.probe4.close)
+	}
+	if s.probe6 != nil {
+		errGrp.Go(s.probe6.close)
+	}
 	return errGrp.Wait()
 }
 
@@ -296,14 +330,24 @@ func (s *SharedSocket) WriteTo(buf []byte, rAddr net.Addr) (n int, err error) {
 		DstPort: layers.UDPPort(rUDPAddr.Port),
 	}
 
-	src, err := s.resolveSrc(rUDPAddr.IP)
-	if err != nil {
-		return 0, fmt.Errorf("resolve source for %s: %w", rUDPAddr.IP, err)
+	dst := rUDPAddr.AddrPort().Addr().Unmap()
+	if !dst.IsValid() {
+		return 0, fmt.Errorf("invalid destination %s", rUDPAddr)
 	}
 
-	rSockAddr, conn, nwLayer := s.getWriterObjects(src, rUDPAddr.IP)
+	rSockAddr, err := s.sockaddr(dst)
+	if err != nil {
+		return 0, err
+	}
+
+	src, err := s.resolveSrc(dst, rSockAddr)
+	if err != nil {
+		return 0, fmt.Errorf("resolve source for %s: %w", dst, err)
+	}
+
+	conn, nwLayer := s.getWriterObjects(src, dst)
 	if conn == nil {
-		return 0, fmt.Errorf("no raw socket for %s", rUDPAddr.IP)
+		return 0, fmt.Errorf("no raw socket for %s", dst)
 	}
 
 	if err := udp.SetNetworkLayerForChecksum(nwLayer); err != nil {
@@ -320,28 +364,23 @@ func (s *SharedSocket) WriteTo(buf []byte, rAddr net.Addr) (n int, err error) {
 }
 
 // getWriterObjects returns the specific IP version objects that are used to build a packet and send it using the raw socket
-func (s *SharedSocket) getWriterObjects(src, dest net.IP) (sa unix.Sockaddr, conn *socket.Conn, layer gopacket.NetworkLayer) {
-	if dest.To4() == nil {
-		sa = &unix.SockaddrInet6{}
-		copy(sa.(*unix.SockaddrInet6).Addr[:], dest.To16())
+func (s *SharedSocket) getWriterObjects(src, dest netip.Addr) (conn *socket.Conn, layer gopacket.NetworkLayer) {
+	if dest.Is6() {
 		conn = s.conn6
-
 		layer = &layers.IPv6{
-			SrcIP: src,
-			DstIP: dest,
+			SrcIP: src.AsSlice(),
+			DstIP: dest.AsSlice(),
 		}
 	} else {
-		sa = &unix.SockaddrInet4{}
-		copy(sa.(*unix.SockaddrInet4).Addr[:], dest.To4())
 		conn = s.conn4
 		layer = &layers.IPv4{
 			Version:  4,
 			TTL:      64,
 			Protocol: layers.IPProtocolUDP,
-			SrcIP:    src,
-			DstIP:    dest,
+			SrcIP:    src.AsSlice(),
+			DstIP:    dest.AsSlice(),
 		}
 	}
 
-	return sa, conn, layer
+	return conn, layer
 }
diff --git a/sharedsock/src_probe_linux.go b/sharedsock/src_probe_linux.go
new file mode 100644
index 000000000..5e463b598
--- /dev/null
+++ b/sharedsock/src_probe_linux.go
@@ -0,0 +1,214 @@
+//go:build linux && !android
+
+package sharedsock
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+	"strconv"
+	"sync"
+	"syscall"
+	"unsafe"
+
+	"github.com/mdlayher/socket"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/unix"
+
+	nbnet "github.com/netbirdio/netbird/client/net"
+)
+
+var errProbeClosed = errors.New("source probe closed")
+
+// srcProbe finds the source address the kernel picks for a destination by connecting
+// a UDP socket that carries the raw sockets' fwmark and reading back its local address.
+// Connecting a UDP socket runs the output route lookup without sending anything.
+type srcProbe struct {
+	family int
+
+	mu sync.Mutex
+	// conn is nil while no socket is open. A failed route lookup keeps the socket,
+	// any other failure closes it and the next lookup opens a fresh one, so a socket
+	// in an unknown state is never reused.
+	conn   *socket.Conn
+	closed bool
+}
+
+// newSrcProbe opens a probe socket for the given address family.
+func newSrcProbe(family int) (*srcProbe, error) {
+	conn, err := openProbeSocket(family)
+	if err != nil {
+		return nil, err
+	}
+	return &srcProbe{family: family, conn: conn}, nil
+}
+
+// resolve returns the source address the kernel would use for a packet to sa, a
+// sockaddr of the probe's family. It is safe for concurrent use.
+func (p *srcProbe) resolve(sa unix.Sockaddr) (netip.Addr, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	if p.closed {
+		return netip.Addr{}, errProbeClosed
+	}
+
+	if p.conn == nil {
+		conn, err := openProbeSocket(p.family)
+		if err != nil {
+			return netip.Addr{}, err
+		}
+		p.conn = conn
+	}
+
+	src, err := p.lookup(sa)
+	if err != nil {
+		var rErr *routeError
+		if !errors.As(err, &rErr) {
+			if closeErr := p.closeSocket(); closeErr != nil {
+				log.Debugf("failed to close source probe socket: %v", closeErr)
+			}
+		}
+		return netip.Addr{}, err
+	}
+	return src, nil
+}
+
+// close releases the socket. Later lookups fail with errProbeClosed.
+func (p *srcProbe) close() error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.closed = true
+	return p.closeSocket()
+}
+
+// closeSocket closes the socket if one is open. Callers must hold p.mu.
+func (p *srcProbe) closeSocket() error {
+	conn := p.conn
+	p.conn = nil
+	if conn == nil {
+		return nil
+	}
+	return conn.Close()
+}
+
+// lookup runs one route lookup on the socket. Callers must hold p.mu.
+func (p *srcProbe) lookup(sa unix.Sockaddr) (netip.Addr, error) {
+	rc, err := p.conn.SyscallConn()
+	if err != nil {
+		return netip.Addr{}, fmt.Errorf("probe socket: %w", err)
+	}
+
+	var src netip.Addr
+	var lookupErr error
+	if err := rc.Control(func(fd uintptr) {
+		src, lookupErr = lookupFD(int(fd), sa)
+	}); err != nil {
+		return netip.Addr{}, fmt.Errorf("probe socket: %w", err)
+	}
+	return src, lookupErr
+}
+
+// routeError is a route lookup the kernel refused. The socket is still usable after it.
+type routeError struct {
+	err error
+}
+
+func (e *routeError) Error() string {
+	return fmt.Sprintf("route lookup: %v", e.err)
+}
+
+func (e *routeError) Unwrap() error {
+	return e.err
+}
+
+func lookupFD(fd int, sa unix.Sockaddr) (netip.Addr, error) {
+	// A connected socket keeps the source address of its first connect and reuses
+	// it for later route lookups, so dissolve the association first.
+	if err := disconnect(fd); err != nil {
+		return netip.Addr{}, fmt.Errorf("disconnect probe socket: %w", err)
+	}
+
+	if err := unix.Connect(fd, sa); err != nil {
+		return netip.Addr{}, &routeError{err: err}
+	}
+
+	local, err := unix.Getsockname(fd)
+	if err != nil {
+		return netip.Addr{}, fmt.Errorf("read probe socket address: %w", err)
+	}
+
+	var src netip.Addr
+	switch a := local.(type) {
+	case *unix.SockaddrInet4:
+		src = netip.AddrFrom4(a.Addr)
+	case *unix.SockaddrInet6:
+		src = netip.AddrFrom16(a.Addr)
+	}
+	if !src.IsValid() || src.IsUnspecified() {
+		return netip.Addr{}, &routeError{err: errors.New("no source address")}
+	}
+	return src, nil
+}
+
+func openProbeSocket(family int) (*socket.Conn, error) {
+	conn, err := socket.Socket(family, unix.SOCK_DGRAM, unix.IPPROTO_UDP, "udp_src_probe", nil)
+	if err != nil {
+		return nil, fmt.Errorf("create source probe socket: %w", err)
+	}
+
+	if err := nbnet.SetSocketMark(conn); err != nil {
+		_ = conn.Close()
+		return nil, fmt.Errorf("set SO_MARK on source probe socket: %w", err)
+	}
+	return conn, nil
+}
+
+// disconnect dissolves a UDP socket's association by connecting to AF_UNSPEC, which
+// also clears the source address the kernel pinned on the previous connect.
+func disconnect(fd int) error {
+	sa := unix.RawSockaddr{Family: unix.AF_UNSPEC}
+	_, _, errno := unix.Syscall(unix.SYS_CONNECT, uintptr(fd), uintptr(unsafe.Pointer(&sa)), unsafe.Sizeof(sa))
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+// rawSockaddr returns the sockaddr for dst with port 0 and the given scope. Port 0
+// matches a raw send, whose route lookup carries no ports. A UDP probe connected
+// to it still gets an ephemeral source port before its lookup.
+func rawSockaddr(dst netip.Addr, scope uint32) unix.Sockaddr {
+	if dst.Is4() {
+		return &unix.SockaddrInet4{Addr: dst.As4()}
+	}
+	return &unix.SockaddrInet6{Addr: dst.As16(), ZoneId: scope}
+}
+
+// zoneIndex returns the interface index for an IPv6 zone, which is either an
+// interface name or a numeric index. An empty zone is index 0. A name costs one
+// SIOCGIFINDEX ioctl on rc, which may be any socket.
+func zoneIndex(rc syscall.RawConn, zone string) (uint32, error) {
+	if zone == "" {
+		return 0, nil
+	}
+	if idx, err := strconv.ParseUint(zone, 10, 32); err == nil {
+		return uint32(idx), nil
+	}
+
+	ifr, err := unix.NewIfreq(zone)
+	if err != nil {
+		return 0, fmt.Errorf("zone %q: %w", zone, err)
+	}
+	var ioctlErr error
+	if err := rc.Control(func(fd uintptr) {
+		ioctlErr = unix.IoctlIfreq(int(fd), unix.SIOCGIFINDEX, ifr)
+	}); err != nil {
+		return 0, fmt.Errorf("zone %q: %w", zone, err)
+	}
+	if ioctlErr != nil {
+		return 0, fmt.Errorf("resolve zone %q: %w", zone, ioctlErr)
+	}
+	return ifr.Uint32(), nil
+}
diff --git a/sharedsock/src_probe_linux_test.go b/sharedsock/src_probe_linux_test.go
new file mode 100644
index 000000000..bdf8e37d8
--- /dev/null
+++ b/sharedsock/src_probe_linux_test.go
@@ -0,0 +1,218 @@
+//go:build linux && !android
+
+package sharedsock
+
+import (
+	"net"
+	"net/netip"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/vishvananda/netlink"
+	"golang.org/x/sys/unix"
+)
+
+// routeGetSrc is the kernel's answer through netlink, used as the reference.
+func routeGetSrc(t *testing.T, dst netip.Addr) (netip.Addr, bool) {
+	t.Helper()
+	routes, err := netlink.RouteGet(net.IP(dst.AsSlice()))
+	if err != nil {
+		return netip.Addr{}, false
+	}
+	for _, r := range routes {
+		if src, ok := netip.AddrFromSlice(r.Src); ok {
+			return src.Unmap(), true
+		}
+	}
+	return netip.Addr{}, false
+}
+
+func newTestProbe(t *testing.T, family int) *srcProbe {
+	t.Helper()
+	p, err := newSrcProbe(family)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = p.close() })
+	return p
+}
+
+// A reused UDP socket keeps the source address of its first connect. Alternating
+// between a loopback and an off-host destination catches a probe that forgets to
+// disconnect: the second lookup would report 127.0.0.1 for the off-host address.
+func TestSrcProbe_AlternatingDestinationsMatchRouteGet(t *testing.T) {
+	loopback := netip.MustParseAddr("127.0.0.1")
+	remote := netip.MustParseAddr("192.0.2.1")
+
+	remoteSrc, ok := routeGetSrc(t, remote)
+	if !ok {
+		t.Skip("no route to an off-host IPv4 destination")
+	}
+	require.NotEqual(t, loopback, remoteSrc, "off-host destination must not route via loopback")
+
+	p := newTestProbe(t, unix.AF_INET)
+	for i := 0; i < 3; i++ {
+		src, err := p.resolve(rawSockaddr(loopback, 0))
+		require.NoError(t, err)
+		assert.Equal(t, loopback, src, "source for loopback, round %d", i)
+
+		src, err = p.resolve(rawSockaddr(remote, 0))
+		require.NoError(t, err)
+		assert.Equal(t, remoteSrc, src, "source for %s, round %d", remote, i)
+	}
+}
+
+func TestSrcProbe_IPv6(t *testing.T) {
+	loopback := netip.MustParseAddr("::1")
+	if _, ok := routeGetSrc(t, loopback); !ok {
+		t.Skip("no IPv6 loopback")
+	}
+
+	p := newTestProbe(t, unix.AF_INET6)
+	src, err := p.resolve(rawSockaddr(loopback, 0))
+	require.NoError(t, err)
+	assert.Equal(t, loopback, src, "source for ::1")
+
+	remote := netip.MustParseAddr("2001:db8::1")
+	remoteSrc, ok := routeGetSrc(t, remote)
+	if !ok {
+		t.Skipf("no route to %s", remote)
+	}
+	src, err = p.resolve(rawSockaddr(remote, 0))
+	require.NoError(t, err)
+	assert.Equal(t, remoteSrc, src, "source for %s", remote)
+}
+
+// A route the kernel refuses is an answer, not a broken socket, so the probe keeps
+// its socket and the next lookup reuses it.
+func TestSrcProbe_RouteErrorKeepsSocket(t *testing.T) {
+	p := newTestProbe(t, unix.AF_INET)
+	conn := p.conn
+
+	// Connecting to the limited broadcast address without SO_BROADCAST fails.
+	_, err := p.resolve(rawSockaddr(netip.MustParseAddr("255.255.255.255"), 0))
+	var rErr *routeError
+	require.ErrorAs(t, err, &rErr, "lookup for the broadcast address should fail as a route error")
+	assert.Same(t, conn, p.conn, "route error should keep the probe socket")
+
+	src, err := p.resolve(rawSockaddr(netip.MustParseAddr("127.0.0.1"), 0))
+	require.NoError(t, err)
+	assert.Equal(t, netip.MustParseAddr("127.0.0.1"), src, "source after the route error")
+	assert.Same(t, conn, p.conn, "lookup after a route error should reuse the socket")
+}
+
+// A socket that stops working is dropped, and the next lookup opens a fresh one.
+func TestSrcProbe_ReopensAfterSocketError(t *testing.T) {
+	p := newTestProbe(t, unix.AF_INET)
+	require.NoError(t, p.conn.Close())
+
+	_, err := p.resolve(rawSockaddr(netip.MustParseAddr("127.0.0.1"), 0))
+	require.Error(t, err, "lookup on a closed socket should fail")
+	assert.Nil(t, p.conn, "socket error should drop the probe socket")
+
+	src, err := p.resolve(rawSockaddr(netip.MustParseAddr("127.0.0.1"), 0))
+	require.NoError(t, err)
+	assert.Equal(t, netip.MustParseAddr("127.0.0.1"), src, "source after reopening")
+	assert.NotNil(t, p.conn, "probe socket should be open again")
+}
+
+// A link-local destination is only routable with its scope. The probe must pass the
+// scope to the kernel and get the interface's own link-local address back.
+func TestSrcProbe_LinkLocalWithZone(t *testing.T) {
+	iface, want := linkLocalInterface(t)
+	dst := netip.MustParseAddr("fe80::1")
+
+	p := newTestProbe(t, unix.AF_INET6)
+	rc, err := p.conn.SyscallConn()
+	require.NoError(t, err)
+
+	for _, zone := range []string{iface.Name, strconv.Itoa(iface.Index)} {
+		scope, err := zoneIndex(rc, zone)
+		require.NoError(t, err, "zone %q", zone)
+		assert.Equal(t, uint32(iface.Index), scope, "index for zone %q", zone)
+
+		src, err := p.resolve(rawSockaddr(dst.WithZone(zone), scope))
+		require.NoError(t, err, "zone %q", zone)
+		assert.Equal(t, want, src, "source for %s%%%s", dst, zone)
+	}
+
+	_, err = p.resolve(rawSockaddr(dst, 0))
+	var rErr *routeError
+	assert.ErrorAs(t, err, &rErr, "link-local destination without a scope should fail as a route error")
+}
+
+func TestZoneIndex(t *testing.T) {
+	p := newTestProbe(t, unix.AF_INET6)
+	rc, err := p.conn.SyscallConn()
+	require.NoError(t, err)
+
+	scope, err := zoneIndex(rc, "")
+	require.NoError(t, err)
+	assert.Zero(t, scope, "empty zone should be index 0")
+
+	_, err = zoneIndex(rc, "nb-no-such-if0")
+	assert.Error(t, err, "unknown interface name should fail")
+}
+
+// linkLocalInterface returns an up interface and its IPv6 link-local address.
+func linkLocalInterface(t *testing.T) (net.Interface, netip.Addr) {
+	t.Helper()
+	ifaces, err := net.Interfaces()
+	require.NoError(t, err)
+	for _, iface := range ifaces {
+		if iface.Flags&net.FlagUp == 0 || iface.Flags&net.FlagLoopback != 0 {
+			continue
+		}
+		addrs, err := iface.Addrs()
+		if err != nil {
+			continue
+		}
+		for _, a := range addrs {
+			prefix, err := netip.ParsePrefix(a.String())
+			if err == nil && prefix.Addr().IsLinkLocalUnicast() {
+				return iface, prefix.Addr()
+			}
+		}
+	}
+	t.Skip("no interface with an IPv6 link-local address")
+	return net.Interface{}, netip.Addr{}
+}
+
+func TestSrcProbe_ClosedRejectsLookups(t *testing.T) {
+	p, err := newSrcProbe(unix.AF_INET)
+	require.NoError(t, err)
+	require.NoError(t, p.close())
+	require.NoError(t, p.close(), "close must be idempotent")
+
+	_, err = p.resolve(rawSockaddr(netip.MustParseAddr("127.0.0.1"), 0))
+	assert.ErrorIs(t, err, errProbeClosed)
+	assert.Nil(t, p.conn, "closed probe must not reopen")
+}
+
+func BenchmarkSrcProbe(b *testing.B) {
+	p, err := newSrcProbe(unix.AF_INET)
+	require.NoError(b, err)
+	defer p.close()
+
+	dst := netip.MustParseAddr("192.0.2.1")
+	if _, err := p.resolve(rawSockaddr(dst, 0)); err != nil {
+		b.Skipf("no route to %s: %v", dst, err)
+	}
+
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		if _, err := p.resolve(rawSockaddr(dst, 0)); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkSrcRouteGet(b *testing.B) {
+	dst := net.ParseIP("192.0.2.1")
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		if _, err := netlink.RouteGetWithOptions(dst, &netlink.RouteGetOptions{}); err != nil {
+			b.Skipf("no route to %s: %v", dst, err)
+		}
+	}
+}
diff --git a/sharedsock/src_probe_privileged_linux_test.go b/sharedsock/src_probe_privileged_linux_test.go
new file mode 100644
index 000000000..fed1d3985
--- /dev/null
+++ b/sharedsock/src_probe_privileged_linux_test.go
@@ -0,0 +1,92 @@
+//go:build privileged
+
+package sharedsock
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/vishvananda/netlink"
+	"golang.org/x/sys/unix"
+
+	nbnet "github.com/netbirdio/netbird/client/net"
+)
+
+// The probe must pick the source the raw sockets get on send, which carry the
+// control-plane fwmark. The test installs the same shape of policy rule the client
+// uses: unmarked traffic to 192.0.2.0/24 is diverted into a table that routes it
+// via loopback, so an unmarked lookup reports 127.0.0.1 and a marked one does not.
+func TestSrcProbe_HonoursControlPlaneMark(t *testing.T) {
+	nbnet.Init()
+	if !nbnet.AdvancedRouting() {
+		t.Skip("advanced routing not supported")
+	}
+
+	const (
+		table = 4242
+		// Below the client's own rules, so a default route in the netbird table cannot win.
+		priority = 90
+	)
+	dst := netip.MustParseAddr("192.0.2.1")
+
+	marked, err := netlink.RouteGetWithOptions(net.IP(dst.AsSlice()), &netlink.RouteGetOptions{Mark: nbnet.ControlPlaneMark})
+	if err != nil {
+		t.Skipf("no route to %s: %v", dst, err)
+	}
+	if len(marked) == 0 || marked[0].Src == nil {
+		t.Skipf("marked route to %s has no source address", dst)
+	}
+	markedSrc, ok := netip.AddrFromSlice(marked[0].Src)
+	require.True(t, ok, "parse marked source")
+	markedSrc = markedSrc.Unmap()
+	if markedSrc == netip.MustParseAddr("127.0.0.1") {
+		t.Skipf("marked route to %s already uses loopback, no contrast to test", dst)
+	}
+
+	rules, err := netlink.RuleList(unix.AF_INET)
+	require.NoError(t, err)
+	for _, r := range rules {
+		if r.Priority == priority || r.Table == table {
+			t.Skipf("rule priority %d or table %d already in use", priority, table)
+		}
+	}
+
+	lo, err := netlink.LinkByName("lo")
+	require.NoError(t, err)
+
+	route := &netlink.Route{
+		Dst:       &net.IPNet{IP: net.IPv4(192, 0, 2, 0), Mask: net.CIDRMask(24, 32)},
+		LinkIndex: lo.Attrs().Index,
+		// 127.0.0.1 is host-scoped, so a link-scoped route only picks it when told to.
+		Src:   net.IPv4(127, 0, 0, 1),
+		Table: table,
+		Scope: netlink.SCOPE_LINK,
+	}
+	require.NoError(t, netlink.RouteAdd(route))
+	t.Cleanup(func() { _ = netlink.RouteDel(route) })
+
+	rule := netlink.NewRule()
+	rule.Family = unix.AF_INET
+	rule.Priority = priority
+	rule.Table = table
+	rule.Mark = nbnet.ControlPlaneMark
+	rule.Invert = true
+	require.NoError(t, netlink.RuleAdd(rule))
+	t.Cleanup(func() { _ = netlink.RuleDel(rule) })
+
+	unmarked, err := netlink.RouteGet(net.IP(dst.AsSlice()))
+	require.NoError(t, err)
+	require.NotEmpty(t, unmarked)
+	require.True(t, unmarked[0].Src.Equal(net.IPv4(127, 0, 0, 1)), "unmarked lookup should be diverted to loopback, got %s", unmarked[0].Src)
+
+	p, err := newSrcProbe(unix.AF_INET)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = p.close() })
+
+	src, err := p.resolve(rawSockaddr(dst, 0))
+	require.NoError(t, err)
+	assert.Equal(t, markedSrc, src, "probe should resolve the source of the marked lookup")
+}
diff --git a/signal/Dockerfile.ubi b/signal/Dockerfile.ubi
new file mode 100644
index 000000000..f0a6552da
--- /dev/null
+++ b/signal/Dockerfile.ubi
@@ -0,0 +1,38 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-signal" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Signal" \
+      description="NetBird Signal brokers the connection handshakes between peers in NetBird networks."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-signal /go/bin/netbird-signal
+COPY licenses/ /licenses/
+# Only the data directory shares the root group for arbitrary non-root UIDs.
+# Runtime-created Let's Encrypt keys retain the application's restrictive modes.
+RUN mkdir -p /var/lib/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+USER 1000:0
+ENV HOME=/var/lib/netbird
+ENV NB_LETSENCRYPT_DATA_DIR="/var/lib/netbird"
+# Unprivileged ports: runtimes such as OpenShift and Podman keep the kernel
+# default that reserves ports below 1024 for root, so serve on the legacy
+# gRPC port instead of 80/443. With Let's Encrypt, the empty listen address
+# answers challenges on that port when public 443 is forwarded to it.
+# 9090 is the metrics endpoint.
+ENV NB_PORT="10000"
+ENV NB_LETSENCRYPT_LISTEN_ADDRESS=""
+EXPOSE 10000 9090
+# The signal server only handles SIGINT for a graceful stop.
+STOPSIGNAL SIGINT
+ENTRYPOINT ["/go/bin/netbird-signal", "run"]
+CMD ["--log-file", "console"]
diff --git a/signal/README.md b/signal/README.md
index 0033eaf90..dd57252ad 100644
--- a/signal/README.md
+++ b/signal/README.md
@@ -16,6 +16,7 @@ Usage:
 Flags:
   -h, --help                        help for run
       --letsencrypt-domain string   a domain to issue Let's Encrypt certificate for. Enables TLS using Let's Encrypt. Will fetch and renew certificate, and run the server with TLS
+      --letsencrypt-listen-address string   address of the separate Let's Encrypt challenge listener, used when --port is not 443. Set it empty when public port 443 is forwarded to --port, which answers the challenges itself (default ":443")
       --port int                    Server port to listen on (e.g. 10000) (default 10000)
       --ssl-dir string              server ssl directory location. *Required only for Let's Encrypt certificates. (default "/var/lib/netbird/")
       --cert-file string            Location of your SSL certificate. Can be used when you have an existing certificate and don't want a new certificate be generated automatically. If letsencrypt-domain is specified this property has no effect
diff --git a/signal/cmd/root.go b/signal/cmd/root.go
index 155790482..1db6faec1 100644
--- a/signal/cmd/root.go
+++ b/signal/cmd/root.go
@@ -38,7 +38,8 @@ func Execute() error {
 }
 
 func init() {
-	stopCh = make(chan int)
+	// Buffered so a server failure before the run loop waits is not dropped.
+	stopCh = make(chan int, 1)
 	defaultLogFile = "/var/log/netbird/signal.log"
 
 	if runtime.GOOS == "windows" {
diff --git a/signal/cmd/run.go b/signal/cmd/run.go
index 681222403..5a695cb3a 100644
--- a/signal/cmd/run.go
+++ b/signal/cmd/run.go
@@ -10,13 +10,14 @@ import (
 	"net/http"
 	// nolint:gosec
 	_ "net/http/pprof"
+	"os"
 	"time"
 
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 	"go.opentelemetry.io/otel/metric"
 	"golang.org/x/crypto/acme/autocert"
 	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c"
+	"golang.org/x/net/http2/h2c" //nolint:staticcheck
 
 	"github.com/netbirdio/netbird/shared/metrics"
 
@@ -35,7 +36,12 @@ import (
 	"google.golang.org/grpc/keepalive"
 )
 
-const legacyGRPCPort = 10000
+const (
+	legacyGRPCPort = 10000
+	// defaultLetsencryptListenAddress is where Let's Encrypt connects for
+	// TLS-ALPN-01 challenges unless public port 443 is forwarded elsewhere.
+	defaultLetsencryptListenAddress = ":443"
+)
 
 var (
 	signalPort               int
@@ -43,6 +49,7 @@ var (
 	signalLetsencryptDomain  string
 	signalLetsencryptEmail   string
 	signalLetsencryptDataDir string
+	signalLetsencryptListen  string
 	signalCertFile           string
 	signalCertKey            string
 
@@ -118,12 +125,23 @@ var (
 			if err != nil {
 				return fmt.Errorf("creating signal server: %v", err)
 			}
+			defer srv.Stop()
 			proto.RegisterSignalExchangeServer(grpcServer, srv)
 
 			grpcRootHandler := grpcHandlerFunc(grpcServer, metricsServer.Meter)
 
-			if certManager != nil {
-				startServerWithCertManager(certManager, grpcRootHandler)
+			var certListener net.Listener
+			switch {
+			case certManager == nil:
+			case signalPort != 443 && signalLetsencryptListen == "":
+				// The main TLS listener uses the cert manager's TLS config, so it still
+				// answers TLS-ALPN-01 challenges when public port 443 is forwarded to it.
+				log.Infof("LetsEncrypt challenge server disabled, challenges are answered on port %d", signalPort)
+			default:
+				certListener, err = startServerWithCertManager(certManager, grpcRootHandler)
+				if err != nil {
+					return err
+				}
 			}
 
 			var compatListener net.Listener
@@ -166,7 +184,11 @@ var (
 
 			SetupCloseHandler()
 
-			<-stopCh
+			stopCode := <-stopCh
+			if certListener != nil {
+				_ = certListener.Close()
+				log.Infof("stopped LetsEncrypt challenge server")
+			}
 			if grpcListener != nil {
 				_ = grpcListener.Close()
 				log.Infof("stopped gRPC server")
@@ -189,18 +211,23 @@ var (
 
 			log.Infof("stopped Signal Service")
 
+			if stopCode != 0 {
+				return errors.New("signal service stopped after a server failure")
+			}
 			return nil
 		},
 	}
 )
 
 func startPprof() {
-	go func() {
-		log.Debugf("Starting pprof server on 127.0.0.1:6060")
-		if err := http.ListenAndServe("127.0.0.1:6060", nil); err != nil {
-			log.Fatalf("pprof server failed: %v", err)
-		}
-	}()
+	if pprofAddr := os.Getenv("NB_PPROF_ADDR"); pprofAddr != "" {
+		log.Infof("pprof enabled, listening on: %s", pprofAddr)
+		go func() {
+			if err := http.ListenAndServe(pprofAddr, nil); err != nil {
+				log.Fatalf("pprof server failed: %v", err)
+			}
+		}()
+	}
 }
 
 func getTLSConfigurations() ([]grpc.ServerOption, *autocert.Manager, *tls.Config, error) {
@@ -241,18 +268,24 @@ func getTLSConfigurations() ([]grpc.ServerOption, *autocert.Manager, *tls.Config
 	return []grpc.ServerOption{grpc.Creds(transportCredentials)}, certManager, tlsConfig, err
 }
 
-func startServerWithCertManager(certManager *autocert.Manager, grpcRootHandler http.Handler) {
-	// a call to certManager.Listener() always creates a new listener so we do it once
-	httpListener := certManager.Listener()
+func startServerWithCertManager(certManager *autocert.Manager, grpcRootHandler http.Handler) (net.Listener, error) {
 	if signalPort == 443 {
+		// a call to certManager.Listener() always creates a new listener so we do it once
+		httpListener := certManager.Listener()
 		// running gRPC and HTTP cert manager on the same port
 		serveHTTP(httpListener, certManager.HTTPHandler(grpcRootHandler))
 		log.Infof("running HTTP server (LetsEncrypt challenge handler) and gRPC server on the same port: %s", httpListener.Addr().String())
-	} else {
-		// Start the HTTP cert manager server separately
-		serveHTTP(httpListener, certManager.HTTPHandler(nil))
-		log.Infof("running HTTP server (LetsEncrypt challenge handler): %s", httpListener.Addr().String())
+		return httpListener, nil
 	}
+
+	httpListener, err := tls.Listen("tcp", signalLetsencryptListen, certManager.TLSConfig())
+	if err != nil {
+		return nil, fmt.Errorf("create LetsEncrypt challenge listener on %s: %w", signalLetsencryptListen, err)
+	}
+	// Start the HTTP cert manager server separately
+	serveHTTP(httpListener, certManager.HTTPHandler(nil))
+	log.Infof("running HTTP server (LetsEncrypt challenge handler): %s", httpListener.Addr().String())
+	return httpListener, nil
 }
 
 func grpcHandlerFunc(grpcServer *grpc.Server, meter metric.Meter) http.Handler {
@@ -281,10 +314,12 @@ func serveHTTP(httpListener net.Listener, handler http.Handler) {
 	go func() {
 		// Use h2c to support HTTP/2 without TLS (needed for gRPC)
 		h1s := &http.Server{
+			//nolint:staticcheck // h2c also handles the HTTP/1 Upgrade mechanism, which http.Server's UnencryptedHTTP2 does not
 			Handler: h2c.NewHandler(handler, &http2.Server{}),
 		}
 		err := h1s.Serve(httpListener)
-		if err != nil {
+		// Closing the listener on shutdown is not a failure.
+		if err != nil && !errors.Is(err, net.ErrClosed) {
 			notifyStop(fmt.Sprintf("failed running HTTP server %v", err))
 		}
 	}()
@@ -297,7 +332,7 @@ func serveGRPC(grpcServer *grpc.Server, port int) (net.Listener, error) {
 	}
 	go func() {
 		err := grpcServer.Serve(listener)
-		if err != nil {
+		if err != nil && !errors.Is(err, net.ErrClosed) {
 			notifyStop(fmt.Sprintf("failed running gRPC server on port %d: %v", port, err))
 		}
 	}()
@@ -329,6 +364,7 @@ func init() {
 	runCmd.PersistentFlags().StringVar(&signalLetsencryptDataDir, "letsencrypt-data-dir", "", "a directory to store Let's Encrypt data. Required if Let's Encrypt is enabled.")
 	runCmd.PersistentFlags().StringVar(&signalLetsencryptDataDir, "ssl-dir", "", "server ssl directory location. *Required only for Let's Encrypt certificates. Deprecated: use --letsencrypt-data-dir")
 	runCmd.PersistentFlags().StringVar(&signalLetsencryptDomain, "letsencrypt-domain", "", "a domain to issue Let's Encrypt certificate for. Enables TLS using Let's Encrypt. Will fetch and renew certificate, and run the server with TLS")
+	runCmd.PersistentFlags().StringVar(&signalLetsencryptListen, "letsencrypt-listen-address", defaultLetsencryptListenAddress, "address of the separate Let's Encrypt challenge listener, used when --port is not 443. Set it empty when public port 443 is forwarded to --port, which answers the challenges itself")
 	runCmd.PersistentFlags().StringVar(&signalLetsencryptEmail, "letsencrypt-email", "", "email address to use for Let's Encrypt certificate registration")
 	runCmd.PersistentFlags().StringVar(&signalCertFile, "cert-file", "", "Location of your SSL certificate. Can be used when you have an existing certificate and don't want a new certificate be generated automatically. If letsencrypt-domain is specified this property has no effect")
 	runCmd.PersistentFlags().StringVar(&signalCertKey, "cert-key", "", "Location of your SSL certificate private key. Can be used when you have an existing certificate and don't want a new certificate be generated automatically. If letsencrypt-domain is specified this property has no effect")
diff --git a/signal/cmd/run_test.go b/signal/cmd/run_test.go
new file mode 100644
index 000000000..0eee82d7c
--- /dev/null
+++ b/signal/cmd/run_test.go
@@ -0,0 +1,92 @@
+package cmd
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/acme"
+	"golang.org/x/crypto/acme/autocert"
+)
+
+func setLetsencryptListen(t *testing.T, port int, address string) {
+	t.Helper()
+	oldPort, oldAddress := signalPort, signalLetsencryptListen
+	signalPort, signalLetsencryptListen = port, address
+	t.Cleanup(func() {
+		signalPort, signalLetsencryptListen = oldPort, oldAddress
+	})
+}
+
+func drainStopCh(t *testing.T) {
+	t.Helper()
+	t.Cleanup(func() {
+		select {
+		case <-stopCh:
+		default:
+		}
+	})
+}
+
+func TestStartServerWithCertManager_CustomAddress(t *testing.T) {
+	drainStopCh(t)
+	setLetsencryptListen(t, 10000, "127.0.0.1:0")
+
+	listener, err := startServerWithCertManager(&autocert.Manager{}, http.NotFoundHandler())
+	require.NoError(t, err)
+	require.NotNil(t, listener, "challenge listener should be created on the configured address")
+	t.Cleanup(func() { _ = listener.Close() })
+
+	conn, err := net.DialTimeout("tcp", listener.Addr().String(), time.Second)
+	require.NoError(t, err)
+	require.NoError(t, conn.Close())
+}
+
+func TestStartServerWithCertManager_BindFailure(t *testing.T) {
+	occupied, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = occupied.Close() })
+	setLetsencryptListen(t, 10000, occupied.Addr().String())
+
+	listener, err := startServerWithCertManager(&autocert.Manager{}, http.NotFoundHandler())
+	require.Error(t, err)
+	require.Nil(t, listener, "no listener should be returned when the bind fails")
+}
+
+func TestCertManagerTLSConfigAnswersTLSALPN01(t *testing.T) {
+	// Disabling the separate listener relies on the main listener answering
+	// TLS-ALPN-01 challenges through the cert manager's TLS config.
+	cfg := (&autocert.Manager{}).TLSConfig()
+	require.Contains(t, cfg.NextProtos, acme.ALPNProto, "cert manager TLS config should offer the ACME TLS-ALPN protocol")
+}
+
+func TestServeHTTP_ClosedListenerIsNotAFailure(t *testing.T) {
+	drainStopCh(t)
+	listener, err := tls.Listen("tcp", "127.0.0.1:0", (&autocert.Manager{}).TLSConfig())
+	require.NoError(t, err)
+
+	serveHTTP(listener, http.NotFoundHandler())
+	require.NoError(t, listener.Close())
+
+	select {
+	case code := <-stopCh:
+		t.Fatalf("closing the listener reported a failure with code %d", code)
+	case <-time.After(200 * time.Millisecond):
+	}
+}
+
+func TestNotifyStop_KeepsEarlyFailure(t *testing.T) {
+	drainStopCh(t)
+
+	notifyStop("failed before the run loop waits")
+
+	select {
+	case code := <-stopCh:
+		require.Equal(t, 1, code, "an early failure should be reported with stop code 1")
+	default:
+		t.Fatal("a failure reported before the run loop waits was dropped")
+	}
+}
diff --git a/signal/server/signal.go b/signal/server/signal.go
index 7edbb4d34..f991b5d81 100644
--- a/signal/server/signal.go
+++ b/signal/server/signal.go
@@ -17,6 +17,8 @@ import (
 
 	"github.com/netbirdio/signal-dispatcher/dispatcher"
 
+	"github.com/netbirdio/netbird/shared/lifecycle"
+	"github.com/netbirdio/netbird/shared/profiling"
 	"github.com/netbirdio/netbird/shared/signal/proto"
 	"github.com/netbirdio/netbird/signal/metrics"
 	"github.com/netbirdio/netbird/signal/peer"
@@ -43,6 +45,8 @@ const (
 	labelRegistrationNotFound = "not_found"
 
 	sendTimeout = 10 * time.Second
+
+	applicationName = "signal"
 )
 
 var (
@@ -51,6 +55,7 @@ var (
 
 // Server an instance of a Signal server
 type Server struct {
+	lifecycle.StopHandlers
 	registry *peer.Registry
 	proto.UnimplementedSignalExchangeServer
 	dispatcher *dispatcher.Dispatcher
@@ -88,9 +93,17 @@ func NewServer(ctx context.Context, meter metric.Meter, metricsPrefix ...string)
 		sendTimeout:   sTimeout,
 	}
 
+	stopProfiling := profiling.Start(applicationName)
+	s.OnStop(stopProfiling)
+
 	return s, nil
 }
 
+// Stop runs the handlers registered with OnStop.
+func (s *Server) Stop() {
+	s.RunStopHandlers()
+}
+
 // Send forwards a message to the signal peer
 func (s *Server) Send(ctx context.Context, msg *proto.EncryptedMessage) (*proto.EncryptedMessage, error) {
 	log.Tracef("received a new message to send from peer [%s] to peer [%s]", msg.Key, msg.RemoteKey)
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 000000000..5dede20d4
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,2 @@
+sonar.projectKey=netbirdio_netbird
+sonar.organization=netbirdio
diff --git a/tools/gotestsummary/main.go b/tools/gotestsummary/main.go
new file mode 100644
index 000000000..2a5487fc6
--- /dev/null
+++ b/tools/gotestsummary/main.go
@@ -0,0 +1,402 @@
+// Package main turns a `go test -json` stream into a readable CI log.
+//
+// It prints one line per top-level test as it finishes, the captured output of
+// every failed test, the head of a package-level panic (which is where Go
+// reports "test timed out" and the list of still-running tests), and ends with
+// the per-package durations and the slowest tests. The exit code is always zero
+// unless the input cannot be read; the `go test` exit code is what CI should act
+// on, so run the two with `set -o pipefail`.
+//
+// Usage:
+//
+//	go test -json ./... | go run ./tools/gotestsummary
+//	go run ./tools/gotestsummary -slowest 60 test-output.jsonl
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"sort"
+	"strings"
+	"time"
+)
+
+const (
+	modulePrefix = "github.com/netbirdio/netbird/"
+
+	// failedTestOutputLines bounds how much captured output a single failed
+	// test may print, so one noisy failure cannot flood the job log.
+	failedTestOutputLines = 200
+	// panicHeadLines is enough for the "panic: test timed out" header, the
+	// "running tests:" list, and the first few goroutines of the dump.
+	panicHeadLines = 150
+	// bufferedOutputLines bounds the per-test output kept in memory while the
+	// test runs; only the tail is kept once the cap is reached.
+	bufferedOutputLines = 400
+)
+
+type event struct {
+	Action  string  `json:"Action"`
+	Package string  `json:"Package"`
+	Test    string  `json:"Test"`
+	Output  string  `json:"Output"`
+	Elapsed float64 `json:"Elapsed"`
+	// ImportPath is set instead of Package on build events. It carries a
+	// " [pkg.test]" suffix naming the test binary the package was compiled
+	// for, and the same package can be built for several binaries at once.
+	ImportPath string `json:"ImportPath"`
+	// FailedBuild names the ImportPath whose build failure made the package
+	// fail; go test reports the package fail event after the build-fail one.
+	FailedBuild string `json:"FailedBuild"`
+}
+
+type testKey struct {
+	pkg, name string
+}
+
+type testResult struct {
+	pkg, name string
+	action    string
+	elapsed   time.Duration
+}
+
+type packageResult struct {
+	pkg     string
+	action  string
+	elapsed time.Duration
+}
+
+type summarizer struct {
+	out io.Writer
+
+	output  map[testKey][]string
+	dropped map[testKey]int
+	// pkgOutput keeps what a package printed outside any test, which is where
+	// compiler diagnostics of a failed build end up.
+	pkgOutput map[string][]string
+	// failedBuilds holds the ImportPaths whose build failed and has not been
+	// reported through a package fail event yet.
+	failedBuilds map[string]bool
+	tests        []testResult
+	packages     []packageResult
+	// panics holds the head of a panic per package. Package streams interleave
+	// in a go test -json run, so one package's dump must not swallow another's
+	// output.
+	panics map[string][]string
+}
+
+func newSummarizer(out io.Writer) *summarizer {
+	return &summarizer{
+		out:          out,
+		output:       make(map[testKey][]string),
+		dropped:      make(map[testKey]int),
+		pkgOutput:    make(map[string][]string),
+		failedBuilds: make(map[string]bool),
+		panics:       make(map[string][]string),
+	}
+}
+
+func main() {
+	slowest := flag.Int("slowest", 40, "number of slowest top-level tests to list")
+	flag.Parse()
+
+	if err := run(flag.Arg(0), *slowest); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func run(path string, slowest int) error {
+	in := os.Stdin
+	if path != "" {
+		f, err := os.Open(path)
+		if err != nil {
+			return fmt.Errorf("open %s: %w", path, err)
+		}
+		defer f.Close()
+		in = f
+	}
+
+	s := newSummarizer(os.Stdout)
+	if err := s.consume(in); err != nil {
+		return fmt.Errorf("read input: %w", err)
+	}
+	s.printSummary(slowest)
+	return nil
+}
+
+func (s *summarizer) consume(r io.Reader) error {
+	scanner := bufio.NewScanner(r)
+	scanner.Buffer(make([]byte, 0, 1024*1024), 16*1024*1024)
+	for scanner.Scan() {
+		line := scanner.Bytes()
+		var ev event
+		if err := json.Unmarshal(line, &ev); err != nil {
+			// Build errors and other non-JSON lines are passed through untouched.
+			fmt.Fprintln(s.out, string(line))
+			continue
+		}
+		s.handle(ev)
+	}
+	return scanner.Err()
+}
+
+func (s *summarizer) handle(ev event) {
+	if ev.Package == "" {
+		// Keep the full path as the key so concurrent builds of one package for
+		// different test binaries do not share, and delete, each other's state.
+		ev.Package = ev.ImportPath
+	}
+	key := testKey{pkg: ev.Package, name: ev.Test}
+	switch ev.Action {
+	case "run":
+		// Register the test even before it prints anything, so a test that
+		// hangs silently still shows up as unfinished.
+		if ev.Test != "" {
+			if _, ok := s.output[key]; !ok {
+				s.output[key] = []string{}
+			}
+		}
+	case "output":
+		s.handleOutput(key, strings.TrimRight(ev.Output, "\n"))
+	case "build-output":
+		// Compiler output may carry several lines per event and is never test
+		// output, so it skips the panic detection.
+		for _, line := range strings.Split(strings.TrimRight(ev.Output, "\n"), "\n") {
+			s.pkgOutput[key.pkg] = appendBounded(s.pkgOutput[key.pkg], line)
+		}
+	case "build-fail":
+		// The package fail event that follows carries FailedBuild and reports
+		// the compiler output; this only remembers the build in case it never
+		// comes.
+		s.failedBuilds[key.pkg] = true
+	case "pass", "fail", "skip":
+		if ev.Test == "" {
+			s.handlePackageResult(ev)
+			return
+		}
+		s.handleTestResult(key, ev)
+	}
+}
+
+func (s *summarizer) handleOutput(key testKey, line string) {
+	if strings.HasPrefix(line, "panic: ") || strings.HasPrefix(line, "fatal error: ") {
+		if _, ok := s.panics[key.pkg]; !ok {
+			s.panics[key.pkg] = []string{}
+		}
+	}
+	if head, ok := s.panics[key.pkg]; ok {
+		// The goroutine dump that follows a panic is kept in the panic head only;
+		// letting it flood the per-test buffers would hide the test's own output.
+		if len(head) < panicHeadLines {
+			s.panics[key.pkg] = append(head, line)
+		}
+		return
+	}
+
+	if key.name == "" {
+		s.pkgOutput[key.pkg] = appendBounded(s.pkgOutput[key.pkg], line)
+		return
+	}
+	if len(s.output[key]) >= bufferedOutputLines {
+		s.dropped[key]++
+	}
+	s.output[key] = appendBounded(s.output[key], line)
+}
+
+// appendBounded keeps the most recent bufferedOutputLines lines.
+func appendBounded(buf []string, line string) []string {
+	if len(buf) >= bufferedOutputLines {
+		buf = buf[1:]
+	}
+	return append(buf, line)
+}
+
+func (s *summarizer) handleTestResult(key testKey, ev event) {
+	elapsed := time.Duration(ev.Elapsed * float64(time.Second))
+	s.tests = append(s.tests, testResult{
+		pkg:     ev.Package,
+		name:    ev.Test,
+		action:  ev.Action,
+		elapsed: elapsed,
+	})
+
+	if !strings.Contains(ev.Test, "/") || ev.Action == "fail" {
+		fmt.Fprintf(s.out, "--- %s: %s.%s (%s)\n", strings.ToUpper(ev.Action), shortPkg(ev.Package), ev.Test, elapsed.Round(time.Millisecond))
+	}
+	if ev.Action == "fail" {
+		s.printTestOutput(key)
+	}
+	delete(s.output, key)
+	delete(s.dropped, key)
+}
+
+func (s *summarizer) printTestOutput(key testKey) {
+	lines := s.output[key]
+	if len(lines) == 0 {
+		return
+	}
+	skipped := s.dropped[key]
+	if len(lines) > failedTestOutputLines {
+		skipped += len(lines) - failedTestOutputLines
+		lines = lines[len(lines)-failedTestOutputLines:]
+	}
+	if skipped > 0 {
+		fmt.Fprintf(s.out, "    ... %d earlier output lines omitted ...\n", skipped)
+	}
+	for _, l := range lines {
+		fmt.Fprintf(s.out, "    %s\n", l)
+	}
+}
+
+func (s *summarizer) handlePackageResult(ev event) {
+	elapsed := time.Duration(ev.Elapsed * float64(time.Second))
+	s.packages = append(s.packages, packageResult{pkg: ev.Package, action: ev.Action, elapsed: elapsed})
+
+	label := "ok  "
+	switch ev.Action {
+	case "fail", "build-fail":
+		label = "FAIL"
+	case "skip":
+		label = "skip"
+	}
+	fmt.Fprintf(s.out, "%s %s %s\n", label, shortPkg(ev.Package), elapsed.Round(time.Millisecond))
+
+	if label == "FAIL" {
+		if ev.FailedBuild != "" {
+			// Several test binaries can share one failed dependency, so its
+			// output stays available for the next package that names it.
+			s.printPackageOutput(ev.FailedBuild, "build output of %s")
+			delete(s.failedBuilds, ev.FailedBuild)
+		}
+		s.printPackageOutput(ev.Package, "output of %s outside tests")
+		s.printUnfinished(ev.Package)
+		s.printPanicHead(ev.Package)
+	}
+	delete(s.pkgOutput, ev.Package)
+	delete(s.panics, ev.Package)
+}
+
+// printUnclaimedBuildFailures reports the failed builds no package fail event
+// accounted for, so a compiler error never disappears from the log.
+func (s *summarizer) printUnclaimedBuildFailures() {
+	var builds []string
+	for b := range s.failedBuilds {
+		builds = append(builds, b)
+	}
+	sort.Strings(builds)
+	for _, b := range builds {
+		fmt.Fprintf(s.out, "FAIL %s [build failed]\n", shortPkg(b))
+		s.printPackageOutput(b, "build output of %s")
+	}
+}
+
+// printPackageOutput shows what a failed package printed outside its tests,
+// or the compiler errors of a failed build, under the given header.
+func (s *summarizer) printPackageOutput(pkg, header string) {
+	lines := s.pkgOutput[pkg]
+	if len(lines) == 0 {
+		return
+	}
+	if len(lines) > failedTestOutputLines {
+		lines = lines[len(lines)-failedTestOutputLines:]
+	}
+	fmt.Fprintf(s.out, "\n==== "+header+" ====\n", shortPkg(pkg))
+	for _, l := range lines {
+		fmt.Fprintf(s.out, "    %s\n", l)
+	}
+}
+
+func (s *summarizer) printPanicHead(pkg string) {
+	head := s.panics[pkg]
+	if len(head) == 0 {
+		return
+	}
+	fmt.Fprintf(s.out, "\n==== panic in %s (first %d lines) ====\n", shortPkg(pkg), len(head))
+	for _, l := range head {
+		fmt.Fprintln(s.out, l)
+	}
+	fmt.Fprintln(s.out, "==== end of panic head ====")
+	fmt.Fprintln(s.out)
+}
+
+// printUnfinished names the tests of a failed package that never reported a
+// result, which is what a timeout leaves behind, and shows their last output.
+func (s *summarizer) printUnfinished(pkg string) {
+	var keys []testKey
+	for key := range s.output {
+		if key.pkg == pkg && key.name != "" {
+			keys = append(keys, key)
+		}
+	}
+	if len(keys) == 0 {
+		return
+	}
+	sort.Slice(keys, func(i, j int) bool { return keys[i].name < keys[j].name })
+	fmt.Fprintf(s.out, "\n==== tests in %s that did not finish (%d) ====\n", shortPkg(pkg), len(keys))
+	for _, key := range keys {
+		fmt.Fprintf(s.out, "--- UNFINISHED: %s.%s\n", shortPkg(key.pkg), key.name)
+		s.printTestOutput(key)
+		delete(s.output, key)
+		delete(s.dropped, key)
+	}
+}
+
+func (s *summarizer) printSummary(slowest int) {
+	s.printUnclaimedBuildFailures()
+
+	fmt.Fprintln(s.out)
+	fmt.Fprintln(s.out, "==== package durations ====")
+	sort.Slice(s.packages, func(i, j int) bool { return s.packages[i].elapsed > s.packages[j].elapsed })
+	for _, p := range s.packages {
+		fmt.Fprintf(s.out, "%9s  %-4s  %s\n", p.elapsed.Round(time.Millisecond), p.action, shortPkg(p.pkg))
+	}
+
+	var failed []testResult
+	for _, t := range s.tests {
+		if t.action == "fail" {
+			failed = append(failed, t)
+		}
+	}
+	if len(failed) > 0 {
+		fmt.Fprintln(s.out)
+		fmt.Fprintf(s.out, "==== failed tests (%d) ====\n", len(failed))
+		for _, t := range failed {
+			fmt.Fprintf(s.out, "%9s  %s.%s\n", t.elapsed.Round(time.Millisecond), shortPkg(t.pkg), t.name)
+		}
+	}
+
+	s.printSlowest("slowest top-level tests", slowest, func(t testResult) bool { return !strings.Contains(t.name, "/") })
+	s.printSlowest("slowest subtests", slowest/2, func(t testResult) bool { return strings.Contains(t.name, "/") })
+}
+
+func (s *summarizer) printSlowest(title string, limit int, keep func(testResult) bool) {
+	var tests []testResult
+	for _, t := range s.tests {
+		if keep(t) {
+			tests = append(tests, t)
+		}
+	}
+	if len(tests) == 0 || limit <= 0 {
+		return
+	}
+	sort.Slice(tests, func(i, j int) bool { return tests[i].elapsed > tests[j].elapsed })
+	if len(tests) > limit {
+		tests = tests[:limit]
+	}
+
+	fmt.Fprintln(s.out)
+	fmt.Fprintf(s.out, "==== %s (%d) ====\n", title, len(tests))
+	for _, t := range tests {
+		fmt.Fprintf(s.out, "%9s  %-4s  %s.%s\n", t.elapsed.Round(time.Millisecond), t.action, shortPkg(t.pkg), t.name)
+	}
+}
+
+func shortPkg(pkg string) string {
+	pkg, _, _ = strings.Cut(pkg, " [")
+	return strings.TrimPrefix(pkg, modulePrefix)
+}
diff --git a/tools/gotestsummary/main_test.go b/tools/gotestsummary/main_test.go
new file mode 100644
index 000000000..d5b51e132
--- /dev/null
+++ b/tools/gotestsummary/main_test.go
@@ -0,0 +1,180 @@
+package main
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func feed(t *testing.T, events string) string {
+	t.Helper()
+	var out bytes.Buffer
+	s := newSummarizer(&out)
+	if err := s.consume(strings.NewReader(events)); err != nil {
+		t.Fatalf("consume: %v", err)
+	}
+	s.printSummary(10)
+	return out.String()
+}
+
+func TestTimeoutReportsUnfinishedTestsAndPanicHead(t *testing.T) {
+	events := `
+{"Action":"run","Package":"a","Test":"TestHang"}
+{"Action":"output","Package":"a","Test":"TestHang","Output":"=== RUN   TestHang\n"}
+{"Action":"run","Package":"a","Test":"TestSilent"}
+{"Action":"output","Package":"a","Test":"TestHang","Output":"panic: test timed out after 1s\n"}
+{"Action":"output","Package":"a","Test":"TestHang","Output":"\trunning tests:\n"}
+{"Action":"output","Package":"a","Test":"TestHang","Output":"\t\tTestHang (1s)\n"}
+{"Action":"output","Package":"a","Test":"TestHang","Output":"goroutine 7 [running]:\n"}
+{"Action":"fail","Package":"a","Elapsed":1.0}
+`
+	got := feed(t, events)
+	for _, want := range []string{
+		"--- UNFINISHED: a.TestHang",
+		"--- UNFINISHED: a.TestSilent",
+		"==== panic in a (first 4 lines) ====",
+		"\t\tTestHang (1s)",
+		"    === RUN   TestHang",
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("output lacks %q:\n%s", want, got)
+		}
+	}
+	if strings.Contains(got, "    goroutine 7 [running]:") {
+		t.Errorf("goroutine dump leaked into the test's own output:\n%s", got)
+	}
+}
+
+func TestPanicInOnePackageKeepsOtherPackageOutput(t *testing.T) {
+	events := `
+{"Action":"run","Package":"a","Test":"TestHang"}
+{"Action":"output","Package":"a","Test":"TestHang","Output":"panic: test timed out after 1s\n"}
+{"Action":"run","Package":"b","Test":"TestOther"}
+{"Action":"output","Package":"b","Test":"TestOther","Output":"    other_test.go:9: expected 1, got 2\n"}
+{"Action":"output","Package":"a","Test":"TestHang","Output":"goroutine 7 [running]:\n"}
+{"Action":"fail","Package":"b","Test":"TestOther","Elapsed":0.01}
+{"Action":"fail","Package":"b","Elapsed":0.02}
+{"Action":"fail","Package":"a","Elapsed":1.0}
+`
+	got := feed(t, events)
+	if !strings.Contains(got, "    other_test.go:9: expected 1, got 2") {
+		t.Errorf("other package's output was swallowed by the panic head:\n%s", got)
+	}
+	if strings.Contains(got, "panic in b") {
+		t.Errorf("panic head attributed to the wrong package:\n%s", got)
+	}
+	if !strings.Contains(got, "==== panic in a (first 2 lines) ====") {
+		t.Errorf("panic head missing for package a:\n%s", got)
+	}
+}
+
+func TestBuildFailureShowsCompilerOutput(t *testing.T) {
+	// The event sequence go test emits for a build failure: the build events
+	// name the test binary, then the package itself fails with FailedBuild.
+	events := `
+{"Action":"build-output","ImportPath":"a [a.test]","Output":"# a [a.test]\na_test.go:7:2: undefined: nope\na_test.go:9:2: undefined: nope2\n"}
+{"Action":"build-fail","ImportPath":"a [a.test]"}
+{"Action":"start","Package":"a"}
+{"Action":"output","Package":"a","Output":"FAIL\ta [build failed]\n"}
+{"Action":"fail","Package":"a","Elapsed":0,"FailedBuild":"a [a.test]"}
+`
+	got := feed(t, events)
+	for _, want := range []string{
+		"==== build output of a ====",
+		"    a_test.go:7:2: undefined: nope\n    a_test.go:9:2: undefined: nope2",
+		"FAIL\ta [build failed]",
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("output lacks %q:\n%s", want, got)
+		}
+	}
+	if n := strings.Count(got, "FAIL a 0s"); n != 1 {
+		t.Errorf("expected one FAIL line for the package, got %d:\n%s", n, got)
+	}
+	if n := strings.Count(got, "undefined: nope2"); n != 1 {
+		t.Errorf("expected the compiler output once, got %d:\n%s", n, got)
+	}
+}
+
+func TestFailedDependencyOutputIsShownForEveryImporter(t *testing.T) {
+	events := `
+{"Action":"build-output","ImportPath":"m/x","Output":"# m/x\nx.go:3:11: undefined: y\n"}
+{"Action":"build-fail","ImportPath":"m/x"}
+{"Action":"start","Package":"m/a"}
+{"Action":"output","Package":"m/a","Output":"FAIL\tm/a [build failed]\n"}
+{"Action":"fail","Package":"m/a","Elapsed":0,"FailedBuild":"m/x"}
+{"Action":"start","Package":"m/b"}
+{"Action":"output","Package":"m/b","Output":"FAIL\tm/b [build failed]\n"}
+{"Action":"fail","Package":"m/b","Elapsed":0,"FailedBuild":"m/x"}
+`
+	got := feed(t, events)
+	if n := strings.Count(got, "x.go:3:11: undefined: y"); n != 2 {
+		t.Errorf("expected the dependency's compiler output under both packages, got %d:\n%s", n, got)
+	}
+	if strings.Contains(got, "FAIL m/x") {
+		t.Errorf("the dependency must not be reported as a package of its own:\n%s", got)
+	}
+}
+
+func TestBuildFailureWithoutPackageEventIsStillReported(t *testing.T) {
+	events := `
+{"Action":"build-output","ImportPath":"a [a.test]","Output":"a_test.go:7:2: undefined: nope\n"}
+{"Action":"build-fail","ImportPath":"a [a.test]"}
+`
+	got := feed(t, events)
+	for _, want := range []string{"FAIL a [build failed]", "==== build output of a ====", "undefined: nope"} {
+		if !strings.Contains(got, want) {
+			t.Errorf("output lacks %q:\n%s", want, got)
+		}
+	}
+}
+
+func TestCompilerPanicIsBuildOutputNotTestPanic(t *testing.T) {
+	events := `
+{"Action":"build-output","ImportPath":"a [a.test]","Output":"# a [a.test]\npanic: internal compiler error\n\ngoroutine 1 [running]:\n"}
+{"Action":"build-fail","ImportPath":"a [a.test]"}
+{"Action":"start","Package":"a"}
+{"Action":"output","Package":"a","Output":"FAIL\ta [build failed]\n"}
+{"Action":"fail","Package":"a","Elapsed":0,"FailedBuild":"a [a.test]"}
+`
+	got := feed(t, events)
+	if !strings.Contains(got, "==== build output of a ====\n    # a [a.test]\n    panic: internal compiler error") {
+		t.Errorf("compiler diagnostic missing from the build output block:\n%s", got)
+	}
+	if strings.Contains(got, "==== panic in") {
+		t.Errorf("compiler output must not be reported as a test panic:\n%s", got)
+	}
+}
+
+func TestBuildVariantsOfOnePackageKeepSeparateOutput(t *testing.T) {
+	events := `
+{"Action":"build-output","ImportPath":"a [a.test]","Output":"a.go:1:1: broken for a.test\n"}
+{"Action":"build-output","ImportPath":"a [b.test]","Output":"a.go:1:1: broken for b.test\n"}
+{"Action":"build-fail","ImportPath":"a [a.test]"}
+{"Action":"build-fail","ImportPath":"a [b.test]"}
+{"Action":"start","Package":"a"}
+{"Action":"fail","Package":"a","Elapsed":0,"FailedBuild":"a [a.test]"}
+{"Action":"start","Package":"b"}
+{"Action":"fail","Package":"b","Elapsed":0,"FailedBuild":"a [b.test]"}
+`
+	got := feed(t, events)
+	if strings.Count(got, "==== build output of a ====") != 2 {
+		t.Errorf("expected one output block per build variant:\n%s", got)
+	}
+	for _, want := range []string{"broken for a.test", "broken for b.test"} {
+		if strings.Count(got, want) != 1 {
+			t.Errorf("expected %q exactly once:\n%s", want, got)
+		}
+	}
+}
+
+func TestPassingPackageOutputIsNotPrinted(t *testing.T) {
+	events := `
+{"Action":"output","Package":"a","Output":"level=info msg=\"noise between tests\"\n"}
+{"Action":"pass","Package":"a","Elapsed":0.5}
+`
+	got := feed(t, events)
+	if strings.Contains(got, "noise between tests") {
+		t.Errorf("package output of a passing package should stay quiet:\n%s", got)
+	}
+}
diff --git a/tools/idp-migrate/DEVELOPMENT.md b/tools/idp-migrate/DEVELOPMENT.md
index 5697ead40..41b5bc992 100644
--- a/tools/idp-migrate/DEVELOPMENT.md
+++ b/tools/idp-migrate/DEVELOPMENT.md
@@ -50,6 +50,7 @@ The build requires `CGO_ENABLED=1` because it links the SQLite driver used by `S
 | `--domain` | string | `""` | Sets both dashboard and API domain (convenience shorthand) |
 | `--dashboard-domain` | string | *(required)* | Dashboard domain (for redirect URIs) |
 | `--api-domain` | string | *(required)* | API domain (for Dex issuer and callback URLs) |
+| `--single-account-mode-domain` | string | `netbird.selfhosted` | Domain single account mode groups users under. Used only when the account has no domain of its own; passing one that conflicts with the account's existing domain is an error |
 | `--dry-run` | bool | `false` | Preview changes without writing |
 | `--force` | bool | `false` | Skip interactive confirmation prompt |
 | `--skip-config` | bool | `false` | Skip config generation (DB-only migration) |
@@ -68,6 +69,7 @@ All flags can be overridden via environment variables. Env vars take precedence
 | `NETBIRD_CONFIG_PATH` | `--config` |
 | `NETBIRD_DATA_DIR` | `--datadir` |
 | `NETBIRD_IDP_SEED_INFO` | `--idp-seed-info` |
+| `NETBIRD_SINGLE_ACCOUNT_MODE_DOMAIN` | `--single-account-mode-domain` |
 | `NETBIRD_DRY_RUN` | `--dry-run` (set to `"true"`) |
 | `NETBIRD_FORCE` | `--force` (set to `"true"`) |
 | `NETBIRD_SKIP_CONFIG` | `--skip-config` (set to `"true"`) |
diff --git a/tools/idp-migrate/config.go b/tools/idp-migrate/config.go
index f4d6b9ea2..6510fd940 100644
--- a/tools/idp-migrate/config.go
+++ b/tools/idp-migrate/config.go
@@ -6,16 +6,18 @@ import (
 	"os"
 	"strconv"
 
+	"github.com/netbirdio/netbird/management/server/idp/migration"
 	"github.com/netbirdio/netbird/util"
 )
 
 type migrationConfig struct {
 	// Data
-	dashboardURL string
-	apiURL       string
-	configPath   string
-	dataDir      string
-	idpSeedInfo  string
+	dashboardURL        string
+	apiURL              string
+	configPath          string
+	dataDir             string
+	idpSeedInfo         string
+	singleAccountDomain string
 
 	// Options
 	dryRun               bool
@@ -51,6 +53,7 @@ func configFromArgs(args []string) (*migrationConfig, error) {
 	fs.StringVar(&cfg.configPath, "config", "", "path to management.json (required)")
 	fs.StringVar(&cfg.dataDir, "datadir", "", "override data directory from config")
 	fs.StringVar(&cfg.idpSeedInfo, "idp-seed-info", "", "base64-encoded connector JSON (overrides auto-detection)")
+	fs.StringVar(&cfg.singleAccountDomain, "single-account-mode-domain", "", "domain single account mode groups users under, used only when the account has no domain of its own (default "+migration.DefaultSingleAccountDomain+")")
 	fs.BoolVar(&cfg.dryRun, "dry-run", false, "preview changes without writing")
 	fs.BoolVar(&cfg.force, "force", false, "skip confirmation prompt")
 	fs.BoolVar(&cfg.skipConfig, "skip-config", false, "skip config generation (DB migration only)")
@@ -118,6 +121,10 @@ func applyOverrides(cfg *migrationConfig, domain string) {
 		cfg.idpSeedInfo = val
 	}
 
+	if val, ok := os.LookupEnv("NETBIRD_SINGLE_ACCOUNT_MODE_DOMAIN"); ok {
+		cfg.singleAccountDomain = val
+	}
+
 	// Enforce dry run if any value is provided
 	if sval, ok := os.LookupEnv("NETBIRD_DRY_RUN"); ok {
 		if val, err := strconv.ParseBool(sval); err == nil {
@@ -170,5 +177,9 @@ func validateConfig(cfg *migrationConfig) error {
 		return fmt.Errorf("--dashboard-domain is required")
 	}
 
+	if _, err := migration.NormalizeSingleAccountDomain(cfg.singleAccountDomain); err != nil {
+		return err
+	}
+
 	return nil
 }
diff --git a/tools/idp-migrate/main.go b/tools/idp-migrate/main.go
index a8cba0750..652bf3393 100644
--- a/tools/idp-migrate/main.go
+++ b/tools/idp-migrate/main.go
@@ -71,6 +71,10 @@ func run(cfg *migrationConfig) error {
 		return err
 	}
 
+	if err := preflightAccounts(cfg, mgmtConfig); err != nil {
+		return err
+	}
+
 	if !cfg.skipPopulateUserInfo {
 		err := populateUserInfoFromIDP(cfg, mgmtConfig)
 		if err != nil {
@@ -102,6 +106,22 @@ func run(cfg *migrationConfig) error {
 	return generateConfig(cfg, connectorConfig)
 }
 
+func preflightAccounts(cfg *migrationConfig, mgmtConfig *nbconfig.Config) error {
+	ctx := context.Background()
+	migStore, migEventStore, cleanup, err := openStores(ctx, mgmtConfig, cfg.dataDir)
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	srv := &migrationServer{store: migStore, eventStore: migEventStore}
+	if err := migration.RequireSingleAccount(srv); err != nil {
+		return err
+	}
+
+	return migration.CheckSingleAccountDomain(srv, cfg.singleAccountDomain)
+}
+
 // validateSchema opens the store and checks that all required tables and columns
 // exist. If anything is missing, it returns a descriptive error telling the user
 // to upgrade their management server.
@@ -224,6 +244,8 @@ func migrateDB(cfg *migrationConfig, mgmtConfig *nbconfig.Config, connectorConfi
 	}
 	defer cleanup()
 
+	srv := &migrationServer{store: migStore, eventStore: migEventStore}
+
 	pending, err := previewUsers(ctx, migStore)
 	if err != nil {
 		return err
@@ -243,11 +265,14 @@ func migrateDB(cfg *migrationConfig, mgmtConfig *nbconfig.Config, connectorConfi
 		}
 	}
 
-	srv := &migrationServer{store: migStore, eventStore: migEventStore}
 	if err := migration.MigrateUsersToStaticConnectors(srv, connectorConfig); err != nil {
 		return fmt.Errorf("migrate users: %w", err)
 	}
 
+	if err := migration.EnsureSingleAccountDomain(srv, cfg.singleAccountDomain); err != nil {
+		return fmt.Errorf("prepare single account mode: %w", err)
+	}
+
 	if !cfg.dryRun {
 		log.Info("DB migration completed successfully")
 	}
diff --git a/tools/idp-migrate/main_test.go b/tools/idp-migrate/main_test.go
index 75d0bd7eb..286e15b88 100644
--- a/tools/idp-migrate/main_test.go
+++ b/tools/idp-migrate/main_test.go
@@ -485,3 +485,77 @@ func TestGenerateConfig(t *testing.T) {
 		assert.True(t, os.IsNotExist(err))
 	})
 }
+
+func TestValidateConfigRejectsUnusableSingleAccountDomain(t *testing.T) {
+	base := func() migrationConfig {
+		return migrationConfig{
+			configPath:          "/tmp/management.json",
+			dataDir:             "/tmp/datadir",
+			idpSeedInfo:         "seed",
+			apiURL:              "https://api.example.com",
+			dashboardURL:        "https://app.example.com",
+			singleAccountDomain: migration.DefaultSingleAccountDomain,
+		}
+	}
+
+	t.Run("usable domain is accepted", func(t *testing.T) {
+		cfg := base()
+		require.NoError(t, validateConfig(&cfg))
+	})
+
+	t.Run("empty falls back to the default", func(t *testing.T) {
+		cfg := base()
+		cfg.singleAccountDomain = ""
+		require.NoError(t, validateConfig(&cfg))
+	})
+
+	// Rejected up front so the migration cannot fail after it has rewritten user IDs.
+	t.Run("single label domain is rejected", func(t *testing.T) {
+		cfg := base()
+		cfg.singleAccountDomain = "corp"
+		err := validateConfig(&cfg)
+		require.Error(t, err)
+		assert.ErrorIs(t, err, migration.ErrUnusableDomain)
+	})
+}
+
+func TestApplyOverrides_SingleAccountDomainFromEnv(t *testing.T) {
+	t.Run("env var overrides the flag", func(t *testing.T) {
+		t.Setenv("NETBIRD_SINGLE_ACCOUNT_MODE_DOMAIN", "corp.example.com")
+
+		cfg, err := configFromArgs([]string{
+			"--config", "/tmp/management.json",
+			"--datadir", "/tmp/datadir",
+			"--idp-seed-info", "seed",
+			"--domain", "example.com",
+			"--single-account-mode-domain", "flag.example.com",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, "corp.example.com", cfg.singleAccountDomain)
+	})
+
+	t.Run("unset leaves the flag value", func(t *testing.T) {
+		cfg, err := configFromArgs([]string{
+			"--config", "/tmp/management.json",
+			"--datadir", "/tmp/datadir",
+			"--idp-seed-info", "seed",
+			"--domain", "example.com",
+			"--single-account-mode-domain", "flag.example.com",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, "flag.example.com", cfg.singleAccountDomain)
+	})
+
+	t.Run("unusable env value is rejected", func(t *testing.T) {
+		t.Setenv("NETBIRD_SINGLE_ACCOUNT_MODE_DOMAIN", "corp")
+
+		_, err := configFromArgs([]string{
+			"--config", "/tmp/management.json",
+			"--datadir", "/tmp/datadir",
+			"--idp-seed-info", "seed",
+			"--domain", "example.com",
+		})
+		require.Error(t, err)
+		assert.ErrorIs(t, err, migration.ErrUnusableDomain)
+	})
+}
diff --git a/tools/mysql-migrate/LICENSE b/tools/mysql-migrate/LICENSE
new file mode 100644
index 000000000..be3f7b28e
--- /dev/null
+++ b/tools/mysql-migrate/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/tools/mysql-migrate/copy.go b/tools/mysql-migrate/copy.go
new file mode 100644
index 000000000..85e0c5e91
--- /dev/null
+++ b/tools/mysql-migrate/copy.go
@@ -0,0 +1,357 @@
+package main
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"math"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+type dialect struct {
+	quote        func(string) string
+	tablesQuery  string
+	columnsQuery string
+}
+
+var mysqlDialect = dialect{
+	quote:        func(name string) string { return "`" + name + "`" },
+	tablesQuery:  `SELECT table_name FROM information_schema.tables WHERE table_schema = DATABASE() AND table_type = 'BASE TABLE'`,
+	columnsQuery: `SELECT column_name FROM information_schema.columns WHERE table_schema = DATABASE() AND table_name = ?`,
+}
+
+var sqliteDialect = dialect{
+	quote:        func(name string) string { return `"` + name + `"` },
+	tablesQuery:  `SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'`,
+	columnsQuery: `SELECT name FROM pragma_table_info(?)`,
+}
+
+type column struct {
+	name   string
+	pgType string
+}
+
+// copyStore copies the tables the source shares with the target schema;
+// source-only tables are legacy and skipped.
+func copyStore(ctx context.Context, src *sql.DB, d dialect, tx pgx.Tx, skip map[string]bool) (int, int64, error) {
+	srcTables, err := queryStrings(ctx, src, d.tablesQuery)
+	if err != nil {
+		return 0, 0, fmt.Errorf("list source tables: %w", err)
+	}
+	dstTables, err := pgStrings(ctx, tx, `SELECT table_name FROM information_schema.tables WHERE table_schema = current_schema() AND table_type = 'BASE TABLE'`)
+	if err != nil {
+		return 0, 0, fmt.Errorf("list target tables: %w", err)
+	}
+
+	var tables []string
+	for _, t := range srcTables {
+		if !skip[t] && slices.Contains(dstTables, t) {
+			tables = append(tables, t)
+		}
+	}
+	if len(tables) == 0 {
+		return 0, 0, fmt.Errorf("no NetBird tables found in the source")
+	}
+
+	ordered, err := parentsFirst(ctx, tx, tables)
+	if err != nil {
+		return 0, 0, err
+	}
+
+	var total int64
+	for _, table := range ordered {
+		n, err := copyTable(ctx, src, d, tx, table)
+		if err != nil {
+			return 0, 0, fmt.Errorf("table %s: %w", table, err)
+		}
+		total += n
+	}
+
+	if err := resetSequences(ctx, tx, tables); err != nil {
+		return 0, 0, err
+	}
+	return len(tables), total, nil
+}
+
+func copyTable(ctx context.Context, src *sql.DB, d dialect, tx pgx.Tx, table string) (int64, error) {
+	cols, err := targetColumns(ctx, tx, table)
+	if err != nil {
+		return 0, err
+	}
+	srcCols, err := queryStrings(ctx, src, d.columnsQuery, table)
+	if err != nil {
+		return 0, fmt.Errorf("list source columns: %w", err)
+	}
+
+	names := make([]string, len(cols))
+	quoted := make([]string, len(cols))
+	var missing []string
+	for i, c := range cols {
+		names[i] = c.name
+		quoted[i] = d.quote(c.name)
+		if !slices.Contains(srcCols, c.name) {
+			missing = append(missing, c.name)
+		}
+	}
+	if len(missing) > 0 {
+		return 0, fmt.Errorf("source lacks columns %v; start the management server once with this release before migrating", missing)
+	}
+
+	var hasRows bool
+	if err := tx.QueryRow(ctx, fmt.Sprintf("SELECT EXISTS (SELECT 1 FROM %s)", pgx.Identifier{table}.Sanitize())).Scan(&hasRows); err != nil {
+		return 0, err
+	}
+	if hasRows {
+		return 0, fmt.Errorf("target already holds data")
+	}
+
+	rows, err := src.QueryContext(ctx, fmt.Sprintf("SELECT %s FROM %s", strings.Join(quoted, ", "), d.quote(table)))
+	if err != nil {
+		return 0, fmt.Errorf("read source: %w", err)
+	}
+	defer rows.Close()
+
+	return tx.CopyFrom(ctx, pgx.Identifier{table}, names, newRowSource(rows, cols))
+}
+
+func targetColumns(ctx context.Context, tx pgx.Tx, table string) ([]column, error) {
+	rows, err := tx.Query(ctx, `SELECT column_name, data_type FROM information_schema.columns
+		WHERE table_schema = current_schema() AND table_name = $1 ORDER BY ordinal_position`, table)
+	if err != nil {
+		return nil, err
+	}
+	return pgx.CollectRows(rows, func(row pgx.CollectableRow) (column, error) {
+		var c column
+		err := row.Scan(&c.name, &c.pgType)
+		return c, err
+	})
+}
+
+func parentsFirst(ctx context.Context, tx pgx.Tx, tables []string) ([]string, error) {
+	rows, err := tx.Query(ctx, `SELECT child.relname, parent.relname FROM pg_constraint c
+		JOIN pg_class child ON child.oid = c.conrelid
+		JOIN pg_class parent ON parent.oid = c.confrelid
+		JOIN pg_namespace n ON n.oid = child.relnamespace
+		WHERE c.contype = 'f' AND n.nspname = current_schema()`)
+	if err != nil {
+		return nil, fmt.Errorf("read foreign keys: %w", err)
+	}
+	parents := map[string][]string{}
+	var child, parent string
+	_, err = pgx.ForEachRow(rows, []any{&child, &parent}, func() error {
+		if child != parent {
+			parents[child] = append(parents[child], parent)
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, fmt.Errorf("read foreign keys: %w", err)
+	}
+
+	pending := slices.Sorted(slices.Values(tables))
+	done := make(map[string]bool, len(tables))
+	ordered := make([]string, 0, len(tables))
+	for len(pending) > 0 {
+		var next []string
+		for _, t := range pending {
+			if ready(parents[t], tables, done) {
+				ordered = append(ordered, t)
+				done[t] = true
+			} else {
+				next = append(next, t)
+			}
+		}
+		if len(next) == len(pending) {
+			return nil, fmt.Errorf("foreign keys form a cycle between %v", next)
+		}
+		pending = next
+	}
+	return ordered, nil
+}
+
+func ready(parents, tables []string, done map[string]bool) bool {
+	for _, p := range parents {
+		if slices.Contains(tables, p) && !done[p] {
+			return false
+		}
+	}
+	return true
+}
+
+// resetSequences moves serial sequences past the ids COPY inserted explicitly.
+func resetSequences(ctx context.Context, tx pgx.Tx, tables []string) error {
+	rows, err := tx.Query(ctx, `SELECT table_name, column_name, pg_get_serial_sequence(quote_ident(table_name), column_name)
+		FROM information_schema.columns
+		WHERE table_schema = current_schema() AND table_name = ANY($1)
+		AND pg_get_serial_sequence(quote_ident(table_name), column_name) IS NOT NULL`, tables)
+	if err != nil {
+		return fmt.Errorf("list sequences: %w", err)
+	}
+	type sequence struct{ table, column, name string }
+	seqs, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (sequence, error) {
+		var s sequence
+		err := row.Scan(&s.table, &s.column, &s.name)
+		return s, err
+	})
+	if err != nil {
+		return fmt.Errorf("list sequences: %w", err)
+	}
+
+	for _, s := range seqs {
+		q := fmt.Sprintf("SELECT setval('%s', COALESCE(MAX(%s), 0) + 1, false) FROM %s",
+			strings.ReplaceAll(s.name, "'", "''"), pgx.Identifier{s.column}.Sanitize(), pgx.Identifier{s.table}.Sanitize())
+		if _, err := tx.Exec(ctx, q); err != nil {
+			return fmt.Errorf("reset sequence %s: %w", s.name, err)
+		}
+	}
+	return nil
+}
+
+type rowSource struct {
+	rows *sql.Rows
+	cols []column
+	vals []any
+	ptrs []any
+}
+
+func newRowSource(rows *sql.Rows, cols []column) *rowSource {
+	r := &rowSource{rows: rows, cols: cols, vals: make([]any, len(cols)), ptrs: make([]any, len(cols))}
+	for i := range r.vals {
+		r.ptrs[i] = &r.vals[i]
+	}
+	return r
+}
+
+func (r *rowSource) Next() bool { return r.rows.Next() }
+
+func (r *rowSource) Err() error { return r.rows.Err() }
+
+func (r *rowSource) Values() ([]any, error) {
+	if err := r.rows.Scan(r.ptrs...); err != nil {
+		return nil, err
+	}
+	out := make([]any, len(r.vals))
+	for i, v := range r.vals {
+		if v == nil {
+			continue
+		}
+		converted, err := convert(v, r.cols[i].pgType)
+		if err != nil {
+			return nil, fmt.Errorf("column %s: %w", r.cols[i].name, err)
+		}
+		out[i] = converted
+	}
+	return out, nil
+}
+
+// convert adapts a non-NULL value to the target column type: MySQL and SQLite
+// return text and numbers as bytes and booleans as integers.
+func convert(v any, pgType string) (any, error) {
+	switch pgType {
+	case "boolean":
+		return toBool(v)
+	case "bytea":
+		return toBytes(v), nil
+	case "smallint", "integer", "bigint":
+		return toInt64(v)
+	case "real", "double precision":
+		return toFloat64(v)
+	case "numeric":
+		return toNumeric(v)
+	default:
+		return toText(v), nil
+	}
+}
+
+func toBool(v any) (any, error) {
+	switch b := v.(type) {
+	case int64:
+		return b != 0, nil
+	case []byte:
+		return strconv.ParseBool(string(b))
+	case string:
+		return strconv.ParseBool(b)
+	}
+	return v, nil
+}
+
+func toBytes(v any) any {
+	if s, ok := v.(string); ok {
+		return []byte(s)
+	}
+	return v
+}
+
+func toInt64(v any) (any, error) {
+	switch n := v.(type) {
+	case uint64:
+		if n > math.MaxInt64 {
+			return nil, fmt.Errorf("value %d overflows bigint", n)
+		}
+		return int64(n), nil
+	case []byte:
+		return strconv.ParseInt(string(n), 10, 64)
+	}
+	return v, nil
+}
+
+func toFloat64(v any) (any, error) {
+	if b, ok := v.([]byte); ok {
+		return strconv.ParseFloat(string(b), 64)
+	}
+	return v, nil
+}
+
+func toNumeric(v any) (any, error) {
+	var s string
+	switch x := v.(type) {
+	case []byte:
+		s = string(x)
+	case string:
+		s = x
+	default:
+		return v, nil
+	}
+	var n pgtype.Numeric
+	if err := n.Scan(s); err != nil {
+		return nil, err
+	}
+	return n, nil
+}
+
+func toText(v any) any {
+	if b, ok := v.([]byte); ok {
+		return string(b)
+	}
+	return v
+}
+
+func queryStrings(ctx context.Context, db *sql.DB, query string, args ...any) ([]string, error) {
+	rows, err := db.QueryContext(ctx, query, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []string
+	for rows.Next() {
+		var s string
+		if err := rows.Scan(&s); err != nil {
+			return nil, err
+		}
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}
+
+func pgStrings(ctx context.Context, tx pgx.Tx, query string) ([]string, error) {
+	rows, err := tx.Query(ctx, query)
+	if err != nil {
+		return nil, err
+	}
+	return pgx.CollectRows(rows, pgx.RowTo[string])
+}
diff --git a/tools/mysql-migrate/main.go b/tools/mysql-migrate/main.go
new file mode 100644
index 000000000..f9531c66a
--- /dev/null
+++ b/tools/mysql-migrate/main.go
@@ -0,0 +1,242 @@
+package main
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"flag"
+	"fmt"
+	"log/slog"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/driver/mysql"
+	"gorm.io/driver/postgres"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+
+	"github.com/netbirdio/netbird/idp/dex"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+type config struct {
+	mysqlDSN          string
+	postgresDSN       string
+	eventsPostgresDSN string
+	authPostgresDSN   string
+	eventsDB          string
+	authDB            string
+	mysqlTimezone     string
+}
+
+type storeMigration struct {
+	name       string
+	source     *sql.DB
+	dialect    dialect
+	targetDSN  string
+	schema     func(ctx context.Context, dsn string) error
+	skipTables map[string]bool
+}
+
+func main() {
+	cfg, err := parseFlags(os.Args[1:])
+	if errors.Is(err, flag.ErrHelp) {
+		return
+	}
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(2)
+	}
+
+	// Silence the store constructors' migration logs.
+	log.SetLevel(log.WarnLevel)
+
+	if err := run(context.Background(), cfg); err != nil {
+		fmt.Fprintf(os.Stderr, "migration failed: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func parseFlags(args []string) (*config, error) {
+	cfg := &config{}
+	fs := flag.NewFlagSet("netbird-mysql-migrate", flag.ContinueOnError)
+	fs.StringVar(&cfg.mysqlDSN, "mysql-dsn", "", "MySQL DSN of the management store (required)")
+	fs.StringVar(&cfg.postgresDSN, "postgres-dsn", "", "Postgres DSN to migrate all stores to (required)")
+	fs.StringVar(&cfg.eventsPostgresDSN, "events-postgres-dsn", "", "Postgres DSN for activity events (default --postgres-dsn)")
+	fs.StringVar(&cfg.authPostgresDSN, "auth-postgres-dsn", "", "Postgres DSN for the embedded IdP (default --postgres-dsn)")
+	fs.StringVar(&cfg.eventsDB, "events-db", "/var/lib/netbird/events.db", "SQLite file of the activity events, skipped when missing")
+	fs.StringVar(&cfg.authDB, "auth-db", "/var/lib/netbird/idp.db", "SQLite file of the embedded IdP, skipped when missing")
+	fs.StringVar(&cfg.mysqlTimezone, "mysql-timezone", "UTC", "time zone the management server ran in, e.g. Europe/Berlin")
+	if err := fs.Parse(args); err != nil {
+		return nil, err
+	}
+	if _, err := time.LoadLocation(cfg.mysqlTimezone); err != nil {
+		return nil, fmt.Errorf("--mysql-timezone: %w", err)
+	}
+
+	if cfg.mysqlDSN == "" || cfg.postgresDSN == "" {
+		return nil, errors.New("--mysql-dsn and --postgres-dsn are required")
+	}
+	if cfg.eventsPostgresDSN == "" {
+		cfg.eventsPostgresDSN = cfg.postgresDSN
+	}
+	if cfg.authPostgresDSN == "" {
+		cfg.authPostgresDSN = cfg.postgresDSN
+	}
+	return cfg, nil
+}
+
+func run(ctx context.Context, cfg *config) error {
+	migrations, closeSources, err := openSources(cfg)
+	if err != nil {
+		return err
+	}
+	defer closeSources()
+
+	for _, m := range migrations {
+		if err := m.schema(ctx, m.targetDSN); err != nil {
+			return fmt.Errorf("create %s schema: %w", m.name, err)
+		}
+	}
+
+	var (
+		pools []*pgxpool.Pool
+		txs   []pgx.Tx
+	)
+	// Roll back first: pool Close waits for the connections open transactions hold.
+	defer func() {
+		for _, tx := range txs {
+			_ = tx.Rollback(ctx)
+		}
+		for _, pool := range pools {
+			pool.Close()
+		}
+	}()
+
+	results := make([]string, 0, len(migrations))
+	for _, m := range migrations {
+		pool, err := pgxpool.New(ctx, m.targetDSN)
+		if err != nil {
+			return fmt.Errorf("connect %s target: %w", m.name, err)
+		}
+		pools = append(pools, pool)
+
+		tx, err := pool.Begin(ctx)
+		if err != nil {
+			return fmt.Errorf("begin %s transaction: %w", m.name, err)
+		}
+		txs = append(txs, tx)
+
+		tables, rows, err := copyStore(ctx, m.source, m.dialect, tx, m.skipTables)
+		if err != nil {
+			return fmt.Errorf("%s: %w", m.name, err)
+		}
+		results = append(results, fmt.Sprintf("%s: %d rows from %d tables", m.name, rows, tables))
+	}
+
+	// Commit last so a failure in any store leaves every target empty.
+	for i, tx := range txs {
+		if err := tx.Commit(ctx); err != nil {
+			return fmt.Errorf("commit %s: %w", migrations[i].name, err)
+		}
+	}
+
+	for _, r := range results {
+		fmt.Fprintln(os.Stdout, r)
+	}
+	fmt.Fprintln(os.Stdout, "Done. Point the store, activity and auth store settings at Postgres before starting the server.")
+	return nil
+}
+
+func openSources(cfg *config) ([]storeMigration, func(), error) {
+	var opened []*gorm.DB
+	closeAll := func() {
+		for _, g := range opened {
+			if sqlDB, err := g.DB(); err == nil {
+				_ = sqlDB.Close()
+			}
+		}
+	}
+
+	open := func(dialector gorm.Dialector) (*sql.DB, error) {
+		g, err := gorm.Open(dialector, &gorm.Config{Logger: logger.Discard})
+		if err != nil {
+			return nil, err
+		}
+		opened = append(opened, g)
+		return g.DB()
+	}
+
+	mysqlDB, err := open(mysql.Open(mysqlDSN(cfg.mysqlDSN, cfg.mysqlTimezone)))
+	if err != nil {
+		closeAll()
+		return nil, nil, fmt.Errorf("open MySQL: %w", err)
+	}
+	migrations := []storeMigration{{
+		name: "management", source: mysqlDB, dialect: mysqlDialect,
+		targetDSN: cfg.postgresDSN, schema: createManagementSchema,
+	}}
+
+	sqliteStores := []storeMigration{
+		{name: "activity", targetDSN: cfg.eventsPostgresDSN, schema: createActivitySchema},
+		{name: "auth", targetDSN: cfg.authPostgresDSN, schema: createAuthSchema, skipTables: map[string]bool{"migrations": true}},
+	}
+	for i, file := range []string{cfg.eventsDB, cfg.authDB} {
+		m := sqliteStores[i]
+		if _, err := os.Stat(file); errors.Is(err, os.ErrNotExist) {
+			fmt.Fprintf(os.Stdout, "%s: %s not found, skipping\n", m.name, file)
+			continue
+		}
+		m.source, err = open(sqlite.Open("file:" + file + "?mode=ro"))
+		if err != nil {
+			closeAll()
+			return nil, nil, fmt.Errorf("open %s: %w", file, err)
+		}
+		m.dialect = sqliteDialect
+		migrations = append(migrations, m)
+	}
+
+	return migrations, closeAll, nil
+}
+
+func mysqlDSN(dsn, timezone string) string {
+	return strings.TrimSuffix(db.MysqlDSN(dsn), "&loc=Local") + "&loc=" + url.QueryEscape(timezone)
+}
+
+func createManagementSchema(ctx context.Context, dsn string) error {
+	s, err := store.NewPostgresqlStore(ctx, dsn, nil, false)
+	if err != nil {
+		return err
+	}
+	return s.Close(ctx)
+}
+
+func createActivitySchema(_ context.Context, dsn string) error {
+	g, err := gorm.Open(postgres.Open(dsn), &gorm.Config{Logger: logger.Discard})
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if sqlDB, err := g.DB(); err == nil {
+			_ = sqlDB.Close()
+		}
+	}()
+	return g.AutoMigrate(&activity.Event{}, &activity.DeletedUser{})
+}
+
+func createAuthSchema(_ context.Context, dsn string) error {
+	cfg := dex.Storage{Type: "postgres", Config: map[string]any{"dsn": dsn}}
+	s, err := cfg.OpenStorage(slog.New(slog.DiscardHandler))
+	if err != nil {
+		return err
+	}
+	return s.Close()
+}
diff --git a/tools/mysql-migrate/main_test.go b/tools/mysql-migrate/main_test.go
new file mode 100644
index 000000000..59d444440
--- /dev/null
+++ b/tools/mysql-migrate/main_test.go
@@ -0,0 +1,225 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	dexstorage "github.com/dexidp/dex/storage"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/rs/xid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/mysql"
+	"gorm.io/gorm"
+
+	"github.com/netbirdio/netbird/idp/dex"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+	"github.com/netbirdio/netbird/management/server/activity"
+	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/testutil"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/util/crypt"
+)
+
+const testAccountID = "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+func TestRun(t *testing.T) {
+	if runtime.GOOS == "windows" || (os.Getenv("CI") == "true" && runtime.GOOS != "linux") {
+		t.Skip("needs Docker with Linux containers for MySQL and Postgres")
+	}
+	// Seed in UTC to match the --mysql-timezone default.
+	time.Local = time.UTC
+	ctx := context.Background()
+	dir := t.TempDir()
+	key, err := crypt.GenerateKey()
+	require.NoError(t, err)
+
+	mysqlDSN := newMySQLDatabase(t, "run_src")
+	pgDSN := newPostgresDatabase(t, ctx, "run_dst")
+	mysqlStore := seedMySQL(t, ctx, mysqlDSN)
+	eventID := seedEvents(t, ctx, dir, key)
+	seedIdP(t, ctx, filepath.Join(dir, "idp.db"))
+
+	cfg, err := parseFlags([]string{
+		"--mysql-dsn", mysqlDSN,
+		"--postgres-dsn", pgDSN,
+		"--events-db", filepath.Join(dir, "events.db"),
+		"--auth-db", filepath.Join(dir, "idp.db"),
+	})
+	require.NoError(t, err)
+	require.NoError(t, run(ctx, cfg))
+
+	t.Run("management", func(t *testing.T) {
+		pgStore, err := store.NewPostgresqlStore(ctx, pgDSN, nil, true)
+		require.NoError(t, err)
+		t.Cleanup(func() { _ = pgStore.Close(ctx) })
+
+		assert.JSONEq(t, accountJSON(t, ctx, mysqlStore), accountJSON(t, ctx, pgStore),
+			"the account read from Postgres must match the one in MySQL")
+	})
+
+	t.Run("activity", func(t *testing.T) {
+		t.Setenv("NB_ACTIVITY_EVENT_STORE_ENGINE", "postgres")
+		t.Setenv("NB_ACTIVITY_EVENT_POSTGRES_DSN", pgDSN)
+		events, err := activitystore.NewSqlStore(ctx, dir, key)
+		require.NoError(t, err)
+		t.Cleanup(func() { _ = events.Close(ctx) })
+
+		got, err := events.Get(ctx, testAccountID, 0, 10, false)
+		require.NoError(t, err)
+		require.Len(t, got, 1, "the migrated event must be readable")
+		assert.Equal(t, eventID, got[0].ID, "the event must keep its id")
+
+		next, err := events.Save(ctx, &activity.Event{Timestamp: time.Now(), AccountID: testAccountID, InitiatorID: "u", TargetID: "p"})
+		require.NoError(t, err)
+		assert.Greater(t, next.ID, eventID, "new events must continue after the migrated ids")
+	})
+
+	t.Run("auth", func(t *testing.T) {
+		idp := dex.Storage{Type: "postgres", Config: map[string]any{"dsn": pgDSN}}
+		s, err := idp.OpenStorage(slog.New(slog.DiscardHandler))
+		require.NoError(t, err)
+		t.Cleanup(func() { _ = s.Close() })
+
+		pw, err := s.GetPassword(ctx, "admin@example.com")
+		require.NoError(t, err)
+		assert.Equal(t, []byte("hash"), pw.Hash, "the IdP password must survive the migration")
+	})
+
+	t.Run("refuses a target that holds data", func(t *testing.T) {
+		assert.ErrorContains(t, run(ctx, cfg), "target already holds data")
+	})
+}
+
+func seedMySQL(t *testing.T, ctx context.Context, dsn string) *store.SqlStore {
+	t.Helper()
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
+	seed, cleanup, err := store.NewTestStoreFromSQL(ctx, "../../management/server/testdata/extended-store.sql", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	mysqlStore, err := store.NewMysqlStoreFromSqlStore(ctx, seed.(*store.SqlStore), dsn, nil)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = mysqlStore.Close(ctx) })
+	return mysqlStore
+}
+
+func seedEvents(t *testing.T, ctx context.Context, dir, key string) uint64 {
+	t.Helper()
+	events, err := activitystore.NewSqlStore(ctx, dir, key)
+	require.NoError(t, err)
+	defer events.Close(ctx)
+
+	event, err := events.Save(ctx, &activity.Event{
+		Timestamp: time.Now(), Activity: activity.PeerAddedByUser,
+		AccountID: testAccountID, InitiatorID: "user", TargetID: "peer",
+		Meta: map[string]any{"name": "peer"},
+	})
+	require.NoError(t, err)
+	return event.ID
+}
+
+func seedIdP(t *testing.T, ctx context.Context, file string) {
+	t.Helper()
+	idp := dex.Storage{Type: "sqlite3", Config: map[string]any{"file": file}}
+	s, err := idp.OpenStorage(slog.New(slog.DiscardHandler))
+	require.NoError(t, err)
+	defer s.Close()
+
+	require.NoError(t, s.CreatePassword(ctx, dexstorage.Password{
+		Email: "admin@example.com", Hash: []byte("hash"), Username: "admin", UserID: "admin-id",
+	}))
+}
+
+func accountJSON(t *testing.T, ctx context.Context, s store.Store) string {
+	t.Helper()
+	var account *types.Account
+	require.NoError(t, s.ExecuteInTransaction(ctx, func(tx store.Store) error {
+		var err error
+		account, err = tx.GetAccount(ctx, testAccountID)
+		return err
+	}))
+	out, err := json.Marshal(account)
+	require.NoError(t, err)
+	return string(out)
+}
+
+func TestMySQLTimezone(t *testing.T) {
+	if runtime.GOOS == "windows" || (os.Getenv("CI") == "true" && runtime.GOOS != "linux") {
+		t.Skip("needs Docker with Linux containers for MySQL and Postgres")
+	}
+	ctx := context.Background()
+	mysqlDSN := newMySQLDatabase(t, "tz_src")
+	pgDSN := newPostgresDatabase(t, ctx, "tz_dst")
+	ms := seedMySQL(t, ctx, mysqlDSN)
+	require.NoError(t, ms.GetDB().Exec("UPDATE accounts SET created_at = '2026-01-02 03:04:05' WHERE id = ?", testAccountID).Error)
+
+	cfg, err := parseFlags([]string{
+		"--mysql-dsn", mysqlDSN,
+		"--postgres-dsn", pgDSN,
+		"--mysql-timezone", "Asia/Tokyo",
+		"--events-db", filepath.Join(t.TempDir(), "none.db"),
+		"--auth-db", filepath.Join(t.TempDir(), "none.db"),
+	})
+	require.NoError(t, err)
+	require.NoError(t, run(ctx, cfg))
+
+	pool, err := pgxpool.New(ctx, pgDSN)
+	require.NoError(t, err)
+	t.Cleanup(pool.Close)
+	var got time.Time
+	require.NoError(t, pool.QueryRow(ctx, "SELECT created_at FROM accounts WHERE id = $1", testAccountID).Scan(&got))
+	want := time.Date(2026, 1, 1, 18, 4, 5, 0, time.UTC)
+	assert.True(t, want.Equal(got), "created_at must keep the instant the server wrote, got %s", got.UTC())
+}
+
+func TestParseFlagsRejectsUnknownTimezone(t *testing.T) {
+	_, err := parseFlags([]string{"--mysql-dsn", "m", "--postgres-dsn", "p", "--mysql-timezone", "Mars/Base"})
+	assert.ErrorContains(t, err, "--mysql-timezone")
+}
+
+// newMySQLDatabase creates a database unique to this run in the shared
+// container, so repeated runs (-count) don't collide, and drops it afterwards.
+func newMySQLDatabase(t *testing.T, prefix string) string {
+	t.Helper()
+	_, base, err := testutil.CreateMysqlTestContainer()
+	require.NoError(t, err)
+	admin, err := gorm.Open(mysql.Open(db.MysqlDSN(base)), &gorm.Config{})
+	require.NoError(t, err)
+	name := prefix + "_" + xid.New().String()
+	require.NoError(t, admin.Exec("CREATE DATABASE "+name).Error)
+	t.Cleanup(func() {
+		_ = admin.Exec("DROP DATABASE IF EXISTS " + name).Error
+		if sqlDB, err := admin.DB(); err == nil {
+			_ = sqlDB.Close()
+		}
+	})
+	return base[:strings.LastIndex(base, "/")] + "/" + name
+}
+
+// newPostgresDatabase is the Postgres counterpart of newMySQLDatabase.
+func newPostgresDatabase(t *testing.T, ctx context.Context, prefix string) string {
+	t.Helper()
+	_, base, err := testutil.CreatePostgresTestContainer()
+	require.NoError(t, err)
+	// Dex connects through lib/pq, which requires TLS unless told otherwise.
+	base = strings.TrimSuffix(base, "?")
+	admin, err := pgxpool.New(ctx, base+"?sslmode=disable")
+	require.NoError(t, err)
+	name := prefix + "_" + xid.New().String()
+	_, err = admin.Exec(ctx, "CREATE DATABASE "+name)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_, _ = admin.Exec(context.Background(), "DROP DATABASE IF EXISTS "+name+" WITH (FORCE)")
+		admin.Close()
+	})
+	return base[:strings.LastIndex(base, "/")] + "/" + name + "?sslmode=disable"
+}
diff --git a/trustedproxy/trustedproxy.go b/trustedproxy/trustedproxy.go
new file mode 100644
index 000000000..70df01d92
--- /dev/null
+++ b/trustedproxy/trustedproxy.go
@@ -0,0 +1,132 @@
+package trustedproxy
+
+import (
+	"fmt"
+	"net/netip"
+	"strings"
+)
+
+// List holds a parsed set of trusted upstream proxy prefixes and answers trust
+// questions against it. The zero value (and a nil *List) is a valid, empty list
+// that never trusts any address, so callers can use it without a nil check.
+type List struct {
+	prefixes []netip.Prefix
+}
+
+// Parse parses a comma-separated list of CIDR prefixes or bare IPs into a List.
+// Bare IPs are converted to single-host prefixes (/32 or /128). An empty input
+// yields an empty List that trusts nothing.
+func Parse(raw string) (*List, error) {
+	if raw == "" {
+		return &List{}, nil
+	}
+
+	parts := strings.Split(raw, ",")
+	prefixes := make([]netip.Prefix, 0, len(parts))
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+
+		prefix, err := netip.ParsePrefix(part)
+		if err == nil {
+			prefixes = append(prefixes, prefix)
+			continue
+		}
+
+		addr, addrErr := netip.ParseAddr(part)
+		if addrErr != nil {
+			return nil, fmt.Errorf("parse trusted proxy %q: not a valid CIDR or IP: %w", part, addrErr)
+		}
+
+		bits := 32
+		if addr.Is6() {
+			bits = 128
+		}
+		prefixes = append(prefixes, netip.PrefixFrom(addr, bits))
+	}
+	return &List{prefixes: prefixes}, nil
+}
+
+// FromPrefixes wraps an already-parsed set of prefixes in a List.
+func FromPrefixes(prefixes []netip.Prefix) *List {
+	return &List{prefixes: prefixes}
+}
+
+// Empty reports whether the list contains no prefixes.
+func (l *List) Empty() bool {
+	return l == nil || len(l.prefixes) == 0
+}
+
+// IsTrusted reports whether the given host:port or bare IP falls within the list.
+func (l *List) IsTrusted(remoteAddr string) bool {
+	if l.Empty() {
+		return false
+	}
+	return l.Contains(ExtractHostIP(remoteAddr))
+}
+
+// Contains reports whether the given address falls within any trusted prefix.
+func (l *List) Contains(addr netip.Addr) bool {
+	if l.Empty() || !addr.IsValid() {
+		return false
+	}
+	for _, prefix := range l.prefixes {
+		if prefix.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}
+
+// ResolveClientIP extracts the real client IP from X-Forwarded-For using the
+// list. It walks the XFF chain right-to-left, skipping IPs that match trusted
+// prefixes; the first untrusted IP is the real client. If the list is empty or
+// remoteAddr is not trusted, it returns the remoteAddr IP directly, ignoring any
+// forwarding headers.
+func (l *List) ResolveClientIP(remoteAddr, xff string) netip.Addr {
+	remoteIP := ExtractHostIP(remoteAddr)
+
+	if l.Empty() || !l.Contains(remoteIP) {
+		return remoteIP
+	}
+
+	if xff == "" {
+		return remoteIP
+	}
+
+	parts := strings.Split(xff, ",")
+	for i := len(parts) - 1; i >= 0; i-- {
+		ip := strings.TrimSpace(parts[i])
+		if ip == "" {
+			continue
+		}
+		addr, err := netip.ParseAddr(ip)
+		if err != nil {
+			continue
+		}
+		addr = addr.Unmap()
+		if !l.Contains(addr) {
+			return addr
+		}
+	}
+
+	if first := strings.TrimSpace(parts[0]); first != "" {
+		if addr, err := netip.ParseAddr(first); err == nil {
+			return addr.Unmap()
+		}
+	}
+	return remoteIP
+}
+
+// ExtractHostIP parses the IP from a host:port string and returns it unmapped.
+func ExtractHostIP(hostPort string) netip.Addr {
+	if ap, err := netip.ParseAddrPort(hostPort); err == nil {
+		return ap.Addr().Unmap()
+	}
+	if addr, err := netip.ParseAddr(hostPort); err == nil {
+		return addr.Unmap()
+	}
+	return netip.Addr{}
+}
diff --git a/trustedproxy/trustedproxy_test.go b/trustedproxy/trustedproxy_test.go
new file mode 100644
index 000000000..2e702a49c
--- /dev/null
+++ b/trustedproxy/trustedproxy_test.go
@@ -0,0 +1,216 @@
+package trustedproxy
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParse(t *testing.T) {
+	tests := []struct {
+		name    string
+		raw     string
+		want    []netip.Prefix
+		wantErr bool
+	}{
+		{
+			name: "empty string returns empty list",
+			raw:  "",
+			want: nil,
+		},
+		{
+			name: "single CIDR",
+			raw:  "10.0.0.0/8",
+			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		},
+		{
+			name: "single bare IPv4",
+			raw:  "1.2.3.4",
+			want: []netip.Prefix{netip.MustParsePrefix("1.2.3.4/32")},
+		},
+		{
+			name: "single bare IPv6",
+			raw:  "::1",
+			want: []netip.Prefix{netip.MustParsePrefix("::1/128")},
+		},
+		{
+			name: "comma-separated CIDRs",
+			raw:  "10.0.0.0/8, 192.168.1.0/24",
+			want: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/8"),
+				netip.MustParsePrefix("192.168.1.0/24"),
+			},
+		},
+		{
+			name: "mixed CIDRs and bare IPs",
+			raw:  "10.0.0.0/8, 1.2.3.4, fd00::/8",
+			want: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/8"),
+				netip.MustParsePrefix("1.2.3.4/32"),
+				netip.MustParsePrefix("fd00::/8"),
+			},
+		},
+		{
+			name: "whitespace around entries",
+			raw:  "  10.0.0.0/8 , 192.168.0.0/16  ",
+			want: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/8"),
+				netip.MustParsePrefix("192.168.0.0/16"),
+			},
+		},
+		{
+			name: "trailing comma produces no extra entry",
+			raw:  "10.0.0.0/8,",
+			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		},
+		{
+			name:    "invalid entry",
+			raw:     "not-an-ip",
+			wantErr: true,
+		},
+		{
+			name:    "partially invalid",
+			raw:     "10.0.0.0/8, garbage",
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := Parse(tt.raw)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got.prefixes)
+		})
+	}
+}
+
+func TestListIsTrusted(t *testing.T) {
+	list, err := Parse("10.0.0.0/8, 192.168.1.0/24, fd00::/8")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name string
+		addr string
+		list *List
+		want bool
+	}{
+		{"nil list", "10.0.0.1", nil, false},
+		{"empty list", "10.0.0.1", &List{}, false},
+		{"IP within /8 prefix", "10.1.2.3", list, true},
+		{"IP within /24 prefix", "192.168.1.100", list, true},
+		{"IP outside all prefixes", "203.0.113.50", list, false},
+		{"boundary IP just outside prefix", "192.168.2.1", list, false},
+		{"unparsable IP", "not-an-ip", list, false},
+		{"IPv6 in trusted range", "fd00::1", list, true},
+		{"IPv6 outside range", "2001:db8::1", list, false},
+		{"empty string", "", list, false},
+		{"host:port within prefix", "10.1.2.3:9999", list, true},
+		{"host:port outside prefix", "203.0.113.50:9999", list, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.list.IsTrusted(tt.addr))
+		})
+	}
+}
+
+func TestListResolveClientIP(t *testing.T) {
+	trusted, err := Parse("10.0.0.0/8, 172.16.0.0/12")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name       string
+		remoteAddr string
+		xff        string
+		list       *List
+		want       netip.Addr
+	}{
+		{
+			name:       "empty list returns RemoteAddr",
+			remoteAddr: "203.0.113.50:9999",
+			xff:        "1.2.3.4",
+			list:       &List{},
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "nil list returns RemoteAddr",
+			remoteAddr: "203.0.113.50:9999",
+			xff:        "1.2.3.4",
+			list:       nil,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "untrusted RemoteAddr ignores XFF",
+			remoteAddr: "203.0.113.50:9999",
+			xff:        "1.2.3.4, 10.0.0.1",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "trusted RemoteAddr with single client in XFF",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "203.0.113.50",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "trusted RemoteAddr walks past trusted entries in XFF",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "203.0.113.50, 10.0.0.2, 172.16.0.5",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "trusted RemoteAddr with empty XFF falls back to RemoteAddr",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "",
+			list:       trusted,
+			want:       netip.MustParseAddr("10.0.0.1"),
+		},
+		{
+			name:       "all XFF IPs trusted returns leftmost",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "10.0.0.2, 172.16.0.1, 10.0.0.3",
+			list:       trusted,
+			want:       netip.MustParseAddr("10.0.0.2"),
+		},
+		{
+			name:       "XFF with whitespace",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        " 203.0.113.50 , 10.0.0.2 ",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "XFF with empty segments",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "203.0.113.50,,10.0.0.2",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "multi-hop with mixed trust",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "8.8.8.8, 203.0.113.50, 172.16.0.1",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "RemoteAddr without port",
+			remoteAddr: "10.0.0.1",
+			xff:        "203.0.113.50",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.list.ResolveClientIP(tt.remoteAddr, tt.xff))
+		})
+	}
+}
diff --git a/upload-server/Dockerfile b/upload-server/Dockerfile
index 3713d6f2a..8098a0186 100644
--- a/upload-server/Dockerfile
+++ b/upload-server/Dockerfile
@@ -1,4 +1,51 @@
-FROM gcr.io/distroless/base:debug
-ENTRYPOINT [ "/go/bin/netbird-upload" ]
-ARG TARGETPLATFORM
-COPY ${TARGETPLATFORM}/netbird-upload /go/bin/netbird-upload
+# syntax=docker/dockerfile:1
+
+# Builds the upload server from source. Run it from the repository root:
+#
+#   docker build -f upload-server/Dockerfile .
+#
+# Releases package the goreleaser-built binary with Dockerfile.release instead,
+# which keeps the published image as it was (distroless base, running as root).
+#
+# The image runs as the base image's nonroot user (uid 65532), which owns the
+# default STORE_DIR, /var/lib/netbird. A volume mounted there must be writable
+# by that uid: a named Docker volume takes the directory's ownership on first
+# use, a bind mount needs chown, and Kubernetes needs fsGroup: 65532.
+#
+# Build args:
+#   VARIANT=release|debug  debug swaps the base for Chainguard busybox (a shell)
+#   VERSION                stamped into the binary the same way goreleaser does
+#
+# Chainguard publishes only :latest for free, so the bases are pinned by digest
+# and moved by Dependabot.
+
+ARG VARIANT=release
+
+# Pure Go: cross-compile from the build host instead of emulating the target.
+FROM --platform=$BUILDPLATFORM golang:1.26.7-bookworm@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514 AS builder
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+
+COPY . .
+ARG TARGETOS
+ARG TARGETARCH
+ARG VERSION=development
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath \
+      -ldflags "-s -w -X github.com/netbirdio/netbird/version.version=${VERSION}" \
+      -o /out/netbird-upload ./upload-server \
+    && mkdir -p /out/var/lib/netbird
+
+FROM cgr.dev/chainguard/static:latest@sha256:41e17ed83c594a64a9396b6ab96dd26d5ddc290dacf4c177464712ff21ad534f AS base-release
+FROM cgr.dev/chainguard/busybox:latest@sha256:b2953ab1cae4a6265e18cf675851bd99975211b150d7a014774911d76eb309ba AS base-debug
+
+# hadolint ignore=DL3006
+FROM base-${VARIANT}
+COPY --from=builder --chown=65532:65532 /out/var/lib/netbird /var/lib/netbird
+COPY --from=builder /out/netbird-upload /go/bin/netbird-upload
+WORKDIR /var/lib/netbird
+USER 65532:65532
+ENTRYPOINT ["/go/bin/netbird-upload"]
diff --git a/upload-server/Dockerfile.release b/upload-server/Dockerfile.release
new file mode 100644
index 000000000..3713d6f2a
--- /dev/null
+++ b/upload-server/Dockerfile.release
@@ -0,0 +1,4 @@
+FROM gcr.io/distroless/base:debug
+ENTRYPOINT [ "/go/bin/netbird-upload" ]
+ARG TARGETPLATFORM
+COPY ${TARGETPLATFORM}/netbird-upload /go/bin/netbird-upload
diff --git a/upload-server/server/local.go b/upload-server/server/local.go
index f7ca50011..859eeb9b2 100644
--- a/upload-server/server/local.go
+++ b/upload-server/server/local.go
@@ -8,9 +8,12 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/shared/ratelimit"
+
 	"github.com/netbirdio/netbird/upload-server/types"
 )
 
@@ -20,11 +23,12 @@ const (
 )
 
 type local struct {
-	url string
-	dir string
+	url    string
+	dir    string
+	signer *signer
 }
 
-func configureLocalHandlers(mux *http.ServeMux) error {
+func configureLocalHandlers(mux *http.ServeMux, limiter *ratelimit.APIRateLimiter) error {
 	envURL, ok := os.LookupEnv("SERVER_URL")
 	if !ok {
 		return fmt.Errorf("SERVER_URL environment variable is required")
@@ -44,11 +48,17 @@ func configureLocalHandlers(mux *http.ServeMux) error {
 		dir = envDir
 	}
 
-	l := &local{
-		url: envURL,
-		dir: dir,
+	uploadSigner, err := newSigner()
+	if err != nil {
+		return err
 	}
-	mux.HandleFunc(types.GetURLPath, l.handlerGetUploadURL)
+
+	l := &local{
+		url:    envURL,
+		dir:    dir,
+		signer: uploadSigner,
+	}
+	mux.Handle(types.GetURLPath, limiter.Middleware(http.HandlerFunc(l.handlerGetUploadURL)))
 	mux.HandleFunc(putURLPath+putHandler, l.handlePutRequest)
 
 	return nil
@@ -80,10 +90,11 @@ func (l *local) getUploadURL(objectKey string) (string, error) {
 		return "", fmt.Errorf("failed to parse upload URL: %w", err)
 	}
 	newURL := parsedUploadURL.JoinPath(parsedUploadURL.Path, putURLPath, objectKey)
+	newURL.RawQuery = l.signer.sign(objectKey, time.Now()).Encode()
 	return newURL.String(), nil
 }
 
-const maxUploadSize = 150 << 20
+const maxUploadSize = 50 << 20
 
 func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPut {
@@ -91,13 +102,6 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	r.Body = http.MaxBytesReader(w, r.Body, maxUploadSize)
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		http.Error(w, "request body too large or failed to read", http.StatusRequestEntityTooLarge)
-		return
-	}
-
 	uploadDir := r.PathValue("dir")
 	if uploadDir == "" {
 		http.Error(w, "missing dir path", http.StatusBadRequest)
@@ -109,6 +113,19 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if err := l.signer.verify(uploadDir+"/"+uploadFile, r.URL.Query(), time.Now()); err != nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		log.Warnf("Rejected upload of %s/%s: %v", uploadDir, uploadFile, err)
+		return
+	}
+
+	r.Body = http.MaxBytesReader(w, r.Body, maxUploadSize)
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		http.Error(w, "request body too large or failed to read", http.StatusRequestEntityTooLarge)
+		return
+	}
+
 	cleanBase := filepath.Clean(l.dir) + string(filepath.Separator)
 
 	dirPath := filepath.Clean(filepath.Join(l.dir, uploadDir))
@@ -125,14 +142,14 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err = os.MkdirAll(dirPath, 0750); err != nil {
+	if err = os.MkdirAll(dirPath, 0o750); err != nil {
 		http.Error(w, "failed to create upload dir", http.StatusInternalServerError)
 		log.Errorf("Failed to create upload dir: %v", err)
 		return
 	}
 
 	flags := os.O_WRONLY | os.O_CREATE | os.O_EXCL
-	f, err := os.OpenFile(filePath, flags, 0600)
+	f, err := os.OpenFile(filePath, flags, 0o600)
 	if err != nil {
 		if os.IsExist(err) {
 			http.Error(w, "file already exists", http.StatusConflict)
diff --git a/upload-server/server/local_test.go b/upload-server/server/local_test.go
index 64b8fd228..3504087e9 100644
--- a/upload-server/server/local_test.go
+++ b/upload-server/server/local_test.go
@@ -8,19 +8,28 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/upload-server/types"
 )
 
+const testSigningKey = "test-signing-key-with-enough-length"
+
+func signedQuery(t *testing.T, objectKey string) string {
+	t.Helper()
+	s := &signer{key: []byte(testSigningKey)}
+	return s.sign(objectKey, time.Now()).Encode()
+}
+
 func Test_LocalHandlerGetUploadURL(t *testing.T) {
 	mockURL := "http://localhost:8080"
 	t.Setenv("SERVER_URL", mockURL)
 	t.Setenv("STORE_DIR", t.TempDir())
 
 	mux := http.NewServeMux()
-	err := configureLocalHandlers(mux)
+	err := configureLocalHandlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
 	req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
@@ -37,7 +46,6 @@ func Test_LocalHandlerGetUploadURL(t *testing.T) {
 	require.Contains(t, response.URL, "test-file/")
 	require.NotEmpty(t, response.Key)
 	require.Contains(t, response.Key, "test-file/")
-
 }
 
 func Test_LocalHandlePutRequest(t *testing.T) {
@@ -45,13 +53,15 @@ func Test_LocalHandlePutRequest(t *testing.T) {
 	mockURL := "http://localhost:8080"
 	t.Setenv("SERVER_URL", mockURL)
 	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
 
 	mux := http.NewServeMux()
-	err := configureLocalHandlers(mux)
+	err := configureLocalHandlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
 	fileContent := []byte("test file content")
-	req := httptest.NewRequest(http.MethodPut, putURLPath+"/uploads/test.txt", bytes.NewReader(fileContent))
+	req := httptest.NewRequest(http.MethodPut,
+		putURLPath+"/uploads/test.txt?"+signedQuery(t, "uploads/test.txt"), bytes.NewReader(fileContent))
 
 	rec := httptest.NewRecorder()
 	mux.ServeHTTP(rec, req)
@@ -69,13 +79,16 @@ func Test_LocalHandlePutRequest_PathTraversal(t *testing.T) {
 	mockURL := "http://localhost:8080"
 	t.Setenv("SERVER_URL", mockURL)
 	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
 
 	mux := http.NewServeMux()
-	err := configureLocalHandlers(mux)
+	err := configureLocalHandlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
 	fileContent := []byte("malicious content")
-	req := httptest.NewRequest(http.MethodPut, putURLPath+"/uploads/%2e%2e%2f%2e%2e%2fetc%2fpasswd", bytes.NewReader(fileContent))
+	req := httptest.NewRequest(http.MethodPut,
+		putURLPath+"/uploads/%2e%2e%2f%2e%2e%2fetc%2fpasswd?"+signedQuery(t, "uploads/../../etc/passwd"),
+		bytes.NewReader(fileContent))
 
 	rec := httptest.NewRecorder()
 	mux.ServeHTTP(rec, req)
@@ -90,11 +103,13 @@ func Test_LocalHandlePutRequest_DirTraversal(t *testing.T) {
 	mockDir := t.TempDir()
 	t.Setenv("SERVER_URL", "http://localhost:8080")
 	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
 
-	l := &local{url: "http://localhost:8080", dir: mockDir}
+	l := &local{url: "http://localhost:8080", dir: mockDir, signer: &signer{key: []byte(testSigningKey)}}
 
 	body := bytes.NewReader([]byte("bad"))
-	req := httptest.NewRequest(http.MethodPut, putURLPath+"/x/evil.txt", body)
+	req := httptest.NewRequest(http.MethodPut,
+		putURLPath+"/x/evil.txt?"+signedQuery(t, "../../../tmp/evil.txt"), body)
 	req.SetPathValue("dir", "../../../tmp")
 	req.SetPathValue("file", "evil.txt")
 
@@ -111,17 +126,20 @@ func Test_LocalHandlePutRequest_DuplicateFile(t *testing.T) {
 	mockDir := t.TempDir()
 	t.Setenv("SERVER_URL", "http://localhost:8080")
 	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
 
 	mux := http.NewServeMux()
-	err := configureLocalHandlers(mux)
+	err := configureLocalHandlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
-	req := httptest.NewRequest(http.MethodPut, putURLPath+"/dir/dup.txt", bytes.NewReader([]byte("first")))
+	req := httptest.NewRequest(http.MethodPut,
+		putURLPath+"/dir/dup.txt?"+signedQuery(t, "dir/dup.txt"), bytes.NewReader([]byte("first")))
 	rec := httptest.NewRecorder()
 	mux.ServeHTTP(rec, req)
 	require.Equal(t, http.StatusOK, rec.Code)
 
-	req = httptest.NewRequest(http.MethodPut, putURLPath+"/dir/dup.txt", bytes.NewReader([]byte("second")))
+	req = httptest.NewRequest(http.MethodPut,
+		putURLPath+"/dir/dup.txt?"+signedQuery(t, "dir/dup.txt"), bytes.NewReader([]byte("second")))
 	rec = httptest.NewRecorder()
 	mux.ServeHTTP(rec, req)
 	require.Equal(t, http.StatusConflict, rec.Code)
@@ -135,13 +153,15 @@ func Test_LocalHandlePutRequest_BodyTooLarge(t *testing.T) {
 	mockDir := t.TempDir()
 	t.Setenv("SERVER_URL", "http://localhost:8080")
 	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
 
 	mux := http.NewServeMux()
-	err := configureLocalHandlers(mux)
+	err := configureLocalHandlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
 	largeBody := make([]byte, maxUploadSize+1)
-	req := httptest.NewRequest(http.MethodPut, putURLPath+"/dir/big.txt", bytes.NewReader(largeBody))
+	req := httptest.NewRequest(http.MethodPut,
+		putURLPath+"/dir/big.txt?"+signedQuery(t, "dir/big.txt"), bytes.NewReader(largeBody))
 	rec := httptest.NewRecorder()
 	mux.ServeHTTP(rec, req)
 
diff --git a/upload-server/server/ratelimit.go b/upload-server/server/ratelimit.go
new file mode 100644
index 000000000..0a38e5cc3
--- /dev/null
+++ b/upload-server/server/ratelimit.go
@@ -0,0 +1,31 @@
+package server
+
+import (
+	"os"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/ratelimit"
+)
+
+const defaultUploadBurst = 100
+
+func newRateLimiter() *ratelimit.APIRateLimiter {
+	cfg, enabled := ratelimit.RateLimiterConfigFromEnv()
+	if os.Getenv(ratelimit.RateLimitingBurstEnv) == "" {
+		cfg.Burst = defaultUploadBurst
+	}
+
+	// Rate limiting is enabled by default unless explicitly disabled
+	if os.Getenv(ratelimit.RateLimitingEnabledEnv) == "" {
+		enabled = true
+	}
+
+	limiter := ratelimit.NewAPIRateLimiter(cfg)
+	limiter.SetEnabled(enabled)
+
+	log.Infof("Upload URL rate limiting: enabled=%t rate=%.0f/min burst=%d trusted_proxies=%q",
+		limiter.Enabled(), cfg.RequestsPerMinute, cfg.Burst, os.Getenv(ratelimit.RateLimitingTrustedProxiesEnv))
+
+	return limiter
+}
diff --git a/upload-server/server/ratelimit_test.go b/upload-server/server/ratelimit_test.go
new file mode 100644
index 000000000..18b5a34fd
--- /dev/null
+++ b/upload-server/server/ratelimit_test.go
@@ -0,0 +1,60 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/ratelimit"
+	"github.com/netbirdio/netbird/upload-server/types"
+)
+
+func newTestRateLimiter(t *testing.T) *ratelimit.APIRateLimiter {
+	t.Helper()
+
+	limiter := newRateLimiter()
+	t.Cleanup(limiter.Stop)
+
+	return limiter
+}
+
+func getUploadURL(t *testing.T, mux *http.ServeMux) int {
+	t.Helper()
+
+	req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
+	req.Header.Set(types.ClientHeader, types.ClientHeaderValue)
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	return rec.Code
+}
+
+func Test_GetUploadURLIsRateLimited(t *testing.T) {
+	t.Setenv(ratelimit.RateLimitingBurstEnv, "2")
+	t.Setenv(ratelimit.RateLimitingRPMEnv, "1")
+	mux, _ := newLocalMux(t)
+
+	require.Equal(t, http.StatusOK, getUploadURL(t, mux))
+	require.Equal(t, http.StatusOK, getUploadURL(t, mux))
+	require.Equal(t, http.StatusTooManyRequests, getUploadURL(t, mux))
+}
+
+func Test_RateLimitingIsOnByDefault(t *testing.T) {
+	t.Setenv(ratelimit.RateLimitingEnabledEnv, "")
+	t.Setenv(ratelimit.RateLimitingBurstEnv, "1")
+	mux, _ := newLocalMux(t)
+
+	require.Equal(t, http.StatusOK, getUploadURL(t, mux))
+	require.Equal(t, http.StatusTooManyRequests, getUploadURL(t, mux))
+}
+
+func Test_RateLimitingCanBeDisabled(t *testing.T) {
+	t.Setenv(ratelimit.RateLimitingEnabledEnv, "false")
+	t.Setenv(ratelimit.RateLimitingBurstEnv, "1")
+	mux, _ := newLocalMux(t)
+
+	require.Equal(t, http.StatusOK, getUploadURL(t, mux))
+	require.Equal(t, http.StatusOK, getUploadURL(t, mux))
+}
diff --git a/upload-server/server/s3.go b/upload-server/server/s3.go
index c0976acb5..55046fb9b 100644
--- a/upload-server/server/s3.go
+++ b/upload-server/server/s3.go
@@ -12,6 +12,8 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/shared/ratelimit"
+
 	"github.com/netbirdio/netbird/upload-server/types"
 )
 
@@ -21,7 +23,7 @@ type sThree struct {
 	presignClient *s3.PresignClient
 }
 
-func configureS3Handlers(mux *http.ServeMux) error {
+func configureS3Handlers(mux *http.ServeMux, limiter *ratelimit.APIRateLimiter) error {
 	bucket := os.Getenv(bucketVar)
 	region, ok := os.LookupEnv("AWS_REGION")
 	if !ok {
@@ -40,7 +42,7 @@ func configureS3Handlers(mux *http.ServeMux) error {
 		bucket:        bucket,
 		presignClient: s3.NewPresignClient(client),
 	}
-	mux.HandleFunc(types.GetURLPath, handler.handlerGetUploadURL)
+	mux.Handle(types.GetURLPath, limiter.Middleware(http.HandlerFunc(handler.handlerGetUploadURL)))
 	return nil
 }
 
diff --git a/upload-server/server/s3_test.go b/upload-server/server/s3_test.go
index a72356409..6c946d8d0 100644
--- a/upload-server/server/s3_test.go
+++ b/upload-server/server/s3_test.go
@@ -29,7 +29,7 @@ func Test_S3HandlerGetUploadURL(t *testing.T) {
 	ctx := context.Background()
 	c, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
 		ContainerRequest: testcontainers.ContainerRequest{
-			Image:        "minio/minio:RELEASE.2025-04-22T22-12-26Z",
+			Image:        "pgsty/silo:RELEASE.2026-09-16T00-00-00Z",
 			ExposedPorts: []string{"9000/tcp"},
 			Env: map[string]string{
 				"MINIO_ROOT_USER":     "minioadmin",
@@ -90,7 +90,7 @@ func Test_S3HandlerGetUploadURL(t *testing.T) {
 	t.Setenv(bucketVar, bucketName)
 
 	mux := http.NewServeMux()
-	err = configureS3Handlers(mux)
+	err = configureS3Handlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
 	req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
diff --git a/upload-server/server/server.go b/upload-server/server/server.go
index 29ef72732..cd9b25c2e 100644
--- a/upload-server/server/server.go
+++ b/upload-server/server/server.go
@@ -10,6 +10,7 @@ import (
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/shared/ratelimit"
 	"github.com/netbirdio/netbird/upload-server/types"
 )
 
@@ -19,7 +20,8 @@ const (
 )
 
 type Server struct {
-	srv *http.Server
+	srv     *http.Server
+	limiter *ratelimit.APIRateLimiter
 }
 
 func NewServer() *Server {
@@ -29,7 +31,7 @@ func NewServer() *Server {
 		address = "0.0.0.0:8080"
 	}
 	mux := http.NewServeMux()
-	err := configureMux(mux)
+	limiter, err := configureMux(mux)
 	if err != nil {
 		log.Fatalf("Failed to configure server: %v", err)
 	}
@@ -38,7 +40,8 @@ func NewServer() *Server {
 	})
 
 	return &Server{
-		srv: &http.Server{Addr: address, Handler: mux},
+		srv:     &http.Server{Addr: address, Handler: mux},
+		limiter: limiter,
 	}
 }
 
@@ -48,6 +51,9 @@ func (s *Server) Start() error {
 }
 
 func (s *Server) Stop() error {
+	if s.limiter != nil {
+		s.limiter.Stop()
+	}
 	if s.srv != nil {
 		log.Infof("Stopping upload server on %s", s.srv.Addr)
 		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
@@ -57,13 +63,14 @@ func (s *Server) Stop() error {
 	return nil
 }
 
-func configureMux(mux *http.ServeMux) error {
+func configureMux(mux *http.ServeMux) (*ratelimit.APIRateLimiter, error) {
+	limiter := newRateLimiter()
+
 	_, ok := os.LookupEnv(bucketVar)
 	if ok {
-		return configureS3Handlers(mux)
-	} else {
-		return configureLocalHandlers(mux)
+		return limiter, configureS3Handlers(mux, limiter)
 	}
+	return limiter, configureLocalHandlers(mux, limiter)
 }
 
 func getObjectKey(w http.ResponseWriter, r *http.Request) string {
diff --git a/upload-server/server/signing.go b/upload-server/server/signing.go
new file mode 100644
index 000000000..86ee785b2
--- /dev/null
+++ b/upload-server/server/signing.go
@@ -0,0 +1,90 @@
+package server
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"net/url"
+	"os"
+	"strconv"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	signingKeyVar = "NB_UPLOAD_SIGNING_KEY"
+
+	// signatureTTL matches the expiry the S3 backend puts on its presigned URLs.
+	signatureTTL = 15 * time.Minute
+
+	expiryParam    = "exp"
+	signatureParam = "sig"
+
+	minSigningKeyLen = 32
+)
+
+type signer struct {
+	key []byte
+}
+
+func newSigner() (*signer, error) {
+	if env, ok := os.LookupEnv(signingKeyVar); ok {
+		if env == "" {
+			return nil, fmt.Errorf("%s is set but empty", signingKeyVar)
+		}
+		if len(env) < minSigningKeyLen {
+			return nil, fmt.Errorf("%s must be at least %d bytes", signingKeyVar, minSigningKeyLen)
+		}
+		return &signer{key: []byte(env)}, nil
+	}
+
+	key := make([]byte, 32)
+	if _, err := rand.Read(key); err != nil {
+		return nil, fmt.Errorf("generate signing key: %w", err)
+	}
+	log.Infof("%s not set, generated an ephemeral upload signing key", signingKeyVar)
+
+	return &signer{key: key}, nil
+}
+
+// sign returns the query parameters that authorize an upload of objectKey.
+func (s *signer) sign(objectKey string, now time.Time) url.Values {
+	exp := now.Add(signatureTTL).Unix()
+
+	v := url.Values{}
+	v.Set(expiryParam, strconv.FormatInt(exp, 10))
+	v.Set(signatureParam, hex.EncodeToString(s.signature(objectKey, exp)))
+
+	return v
+}
+
+// verify reports whether query carries a still-valid signature over objectKey.
+func (s *signer) verify(objectKey string, query url.Values, now time.Time) error {
+	exp, err := strconv.ParseInt(query.Get(expiryParam), 10, 64)
+	if err != nil {
+		return fmt.Errorf("malformed %s parameter", expiryParam)
+	}
+
+	got, err := hex.DecodeString(query.Get(signatureParam))
+	if err != nil {
+		return fmt.Errorf("malformed %s parameter", signatureParam)
+	}
+
+	if !hmac.Equal(got, s.signature(objectKey, exp)) {
+		return fmt.Errorf("signature mismatch")
+	}
+	if now.Unix() >= exp {
+		return fmt.Errorf("upload URL expired")
+	}
+
+	return nil
+}
+
+func (s *signer) signature(objectKey string, exp int64) []byte {
+	mac := hmac.New(sha256.New, s.key)
+	fmt.Fprintf(mac, "%s\n%d", objectKey, exp)
+	return mac.Sum(nil)
+}
diff --git a/upload-server/server/signing_test.go b/upload-server/server/signing_test.go
new file mode 100644
index 000000000..2fdd4aa3f
--- /dev/null
+++ b/upload-server/server/signing_test.go
@@ -0,0 +1,148 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/upload-server/types"
+)
+
+func newLocalMux(t *testing.T) (*http.ServeMux, string) {
+	t.Helper()
+
+	mockDir := t.TempDir()
+	t.Setenv("SERVER_URL", "http://localhost:8080")
+	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
+
+	mux := http.NewServeMux()
+	require.NoError(t, configureLocalHandlers(mux, newTestRateLimiter(t)))
+
+	return mux, mockDir
+}
+
+func Test_LocalUploadURLRoundTrip(t *testing.T) {
+	mux, mockDir := newLocalMux(t)
+
+	getReq := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
+	getReq.Header.Set(types.ClientHeader, types.ClientHeaderValue)
+	getRec := httptest.NewRecorder()
+	mux.ServeHTTP(getRec, getReq)
+	require.Equal(t, http.StatusOK, getRec.Code)
+
+	var response types.GetURLResponse
+	require.NoError(t, json.Unmarshal(getRec.Body.Bytes(), &response))
+
+	minted, err := url.Parse(response.URL)
+	require.NoError(t, err)
+	require.NotEmpty(t, minted.Query().Get(signatureParam))
+
+	content := []byte("bundle")
+	putRec := httptest.NewRecorder()
+	mux.ServeHTTP(putRec, httptest.NewRequest(http.MethodPut, minted.RequestURI(), bytes.NewReader(content)))
+	require.Equal(t, http.StatusOK, putRec.Code)
+
+	written, err := os.ReadFile(filepath.Join(mockDir, response.Key))
+	require.NoError(t, err)
+	require.Equal(t, content, written)
+}
+
+func Test_LocalHandlePutRequest_RejectsUnauthorized(t *testing.T) {
+	expired := &signer{key: []byte(testSigningKey)}
+
+	tests := []struct {
+		name  string
+		query string
+	}{
+		{
+			name:  "no signature",
+			query: "",
+		},
+		{
+			name:  "tampered signature",
+			query: "exp=99999999999&sig=deadbeef",
+		},
+		{
+			name:  "malformed signature",
+			query: "exp=99999999999&sig=not-hex",
+		},
+		{
+			// A signature is only good for the key it was minted for, so a URL
+			// handed out for one bundle cannot be replayed against another.
+			name:  "signature for a different object",
+			query: signedQuery(t, "dir/other.txt"),
+		},
+		{
+			name:  "signature expiring this second",
+			query: expired.sign("dir/file.txt", time.Now().Add(-signatureTTL)).Encode(),
+		},
+		{
+			name:  "expired signature",
+			query: expired.sign("dir/file.txt", time.Now().Add(-signatureTTL-time.Minute)).Encode(),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			mux, mockDir := newLocalMux(t)
+
+			target := putURLPath + "/dir/file.txt"
+			if tc.query != "" {
+				target += "?" + tc.query
+			}
+
+			rec := httptest.NewRecorder()
+			mux.ServeHTTP(rec, httptest.NewRequest(http.MethodPut, target, bytes.NewReader([]byte("payload"))))
+
+			require.Equal(t, http.StatusUnauthorized, rec.Code)
+
+			_, err := os.Stat(filepath.Join(mockDir, "dir", "file.txt"))
+			require.True(t, os.IsNotExist(err), "unauthorized upload should not be written")
+		})
+	}
+}
+
+func Test_SignerRejectsForeignKey(t *testing.T) {
+	minted := (&signer{key: []byte("one key")}).sign("dir/file.txt", time.Now())
+
+	err := (&signer{key: []byte("another key")}).verify("dir/file.txt", minted, time.Now())
+	require.Error(t, err)
+}
+
+func Test_NewSignerGeneratesEphemeralKey(t *testing.T) {
+	// Registers the restore hook, then clears the value for this test only.
+	t.Setenv(signingKeyVar, "")
+	os.Unsetenv(signingKeyVar)
+
+	first, err := newSigner()
+	require.NoError(t, err)
+	second, err := newSigner()
+	require.NoError(t, err)
+
+	require.NotEqual(t, first.key, second.key)
+	require.Len(t, first.key, 32)
+}
+
+func Test_NewSignerRejectsEmptyKey(t *testing.T) {
+	t.Setenv(signingKeyVar, "")
+
+	_, err := newSigner()
+	require.Error(t, err)
+}
+
+func Test_NewSignerRejectsShortKey(t *testing.T) {
+	t.Setenv(signingKeyVar, strings.Repeat("a", minSigningKeyLen-1))
+
+	_, err := newSigner()
+	require.Error(t, err)
+}
diff --git a/util/common.go b/util/common.go
index 89903b609..c08be3617 100644
--- a/util/common.go
+++ b/util/common.go
@@ -3,18 +3,69 @@ package util
 import (
 	"os"
 	"os/exec"
+	"runtime"
+	"slices"
 
 	"github.com/skratchdot/open-golang/open"
 )
 
+const (
+	// envBrowser overrides the browser OpenBrowser launches
+	envBrowser = "BROWSER"
+	// envDesktopSession and envXDGCurrentDesktop are what xdg-open uses to pick a handler
+	envDesktopSession    = "DESKTOP_SESSION"
+	envXDGCurrentDesktop = "XDG_CURRENT_DESKTOP"
+	// envDisplay and envWaylandDisplay are what a graphical browser needs to reach a display
+	envDisplay        = "DISPLAY"
+	envWaylandDisplay = "WAYLAND_DISPLAY"
+	// envXDGSessionType names the session kind, e.g. tty, x11 or wayland
+	envXDGSessionType = "XDG_SESSION_TYPE"
+)
+
 // OpenBrowser opens the URL in a browser, respecting the BROWSER environment variable.
 func OpenBrowser(url string) error {
-	if browser := os.Getenv("BROWSER"); browser != "" {
+	if browser := os.Getenv(envBrowser); browser != "" {
 		return exec.Command(browser, url).Start()
 	}
 	return open.Run(url)
 }
 
+// browserSessionEnvVars returns the variables that decide whether OpenBrowser can open a URL.
+// DISPLAY and WAYLAND_DISPLAY are exactly what xdg-open's own has_display() checks, and without
+// them it degrades to terminal browsers. BROWSER is the explicit override both xdg-open and
+// OpenBrowser honor first. DESKTOP_SESSION and XDG_CURRENT_DESKTOP only tell xdg-open which
+// desktop-specific opener to prefer, so they are weaker evidence, kept because the previous
+// detection relied on them alone and dropping them would demote sessions that work today.
+func browserSessionEnvVars() []string {
+	return []string{envDisplay, envWaylandDisplay, envBrowser, envDesktopSession, envXDGCurrentDesktop}
+}
+
+// graphicalXDGSessionTypes are the systemd-logind session types that come with a display. The
+// other documented values are "tty" and "unspecified"; anything unrecognized is treated as no
+// display, so an unknown value picks the device code flow, which works without a browser.
+func graphicalXDGSessionTypes() []string {
+	return []string{"x11", "wayland", "mir"}
+}
+
+// HasGraphicalSession reports whether this process can open a browser and serve a loopback
+// redirect back to it. Windows and macOS always can. On Linux and FreeBSD the answer is env
+// based, so it only holds for a process started from the graphical session itself: a service
+// does not inherit those variables and always reports false, which is why callers running in
+// the user's session pass their own answer to the daemon.
+func HasGraphicalSession() bool {
+	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
+		return true
+	}
+
+	for _, env := range browserSessionEnvVars() {
+		if os.Getenv(env) != "" {
+			return true
+		}
+	}
+
+	return slices.Contains(graphicalXDGSessionTypes(), os.Getenv(envXDGSessionType))
+}
+
 // SliceDiff returns the elements in slice `x` that are not in slice `y`
 func SliceDiff(x, y []string) []string {
 	mapY := make(map[string]struct{}, len(y))
diff --git a/util/file.go b/util/file.go
index 73ad05b18..4eb2f3ece 100644
--- a/util/file.go
+++ b/util/file.go
@@ -26,7 +26,7 @@ func WriteBytesWithRestrictedPermission(ctx context.Context, file string, bs []b
 		return fmt.Errorf("enforce permission: %w", err)
 	}
 
-	return writeBytes(ctx, file, err, configDir, configFileName, bs)
+	return writeBytes(ctx, file, configDir, configFileName, bs)
 }
 
 // WriteJsonWithRestrictedPermission writes JSON config object to a file. Enforces permission on the parent directory
@@ -56,9 +56,9 @@ func WriteJson(ctx context.Context, file string, obj interface{}) error {
 }
 
 // DirectWriteJson writes JSON config object to a file creating parent directories if required without creating a temporary file
-func DirectWriteJson(ctx context.Context, file string, obj interface{}) error {
+func DirectWriteJson(ctx context.Context, file string, obj interface{}) (err error) {
 
-	_, _, err := prepareConfigFileDir(file)
+	_, _, err = prepareConfigFileDir(file)
 	if err != nil {
 		return err
 	}
@@ -68,11 +68,24 @@ func DirectWriteJson(ctx context.Context, file string, obj interface{}) error {
 		return err
 	}
 
+	// Named return so a failed Close is reported rather than logged and
+	// swallowed: the write is only durable once the file closes cleanly, and a
+	// caller told "written" would carry on with data that never landed.
 	defer func() {
-		err = targetFile.Close()
-		if err != nil {
-			log.Errorf("failed to close file %s: %v", file, err)
+		cerr := targetFile.Close()
+		if cerr == nil {
+			return
 		}
+		if err == nil {
+			// Returned, not logged: the caller reports it once.
+			err = cerr
+			return
+		}
+		// The body already failed and that error is the one the caller gets, so
+		// it is the one that explains the failure. This is then the only place
+		// the close failure can surface — at debug, per the logging rules for
+		// close errors on writes.
+		log.Debugf("failed to close file %s after %v: %v", file, err, cerr)
 	}()
 
 	// make it pretty
@@ -106,10 +119,10 @@ func writeJson(ctx context.Context, file string, obj interface{}, configDir stri
 		return fmt.Errorf("marshal: %w", err)
 	}
 
-	return writeBytes(ctx, file, err, configDir, configFileName, bs)
+	return writeBytes(ctx, file, configDir, configFileName, bs)
 }
 
-func writeBytes(ctx context.Context, file string, err error, configDir string, configFileName string, bs []byte) error {
+func writeBytes(ctx context.Context, file string, configDir string, configFileName string, bs []byte) error {
 	if ctx.Err() != nil {
 		return fmt.Errorf("write bytes start: %w", ctx.Err())
 	}
@@ -149,7 +162,7 @@ func writeBytes(ctx context.Context, file string, err error, configDir string, c
 		return fmt.Errorf("after temp file: %w", ctx.Err())
 	}
 
-	if err = os.Rename(tempFileName, file); err != nil {
+	if err = renameFile(tempFileName, file); err != nil {
 		return fmt.Errorf("move %s to %s: %w", tempFileName, file, err)
 	}
 
@@ -182,7 +195,7 @@ func openOrCreateFile(file string) (*os.File, error) {
 // ReadJson reads JSON config file and maps to a provided interface
 func ReadJson(file string, res interface{}) (interface{}, error) {
 
-	f, err := os.Open(file)
+	f, err := openRead(file)
 	if err != nil {
 		return nil, err
 	}
@@ -235,7 +248,7 @@ func ListFiles(dir, pattern string) ([]string, error) {
 func ReadJsonWithEnvSub(file string, res interface{}) (interface{}, error) {
 	envVars := getEnvMap()
 
-	f, err := os.Open(file)
+	f, err := openRead(file)
 	if err != nil {
 		return nil, err
 	}
diff --git a/util/file_nonwindows.go b/util/file_nonwindows.go
new file mode 100644
index 000000000..c1db10244
--- /dev/null
+++ b/util/file_nonwindows.go
@@ -0,0 +1,16 @@
+//go:build !windows
+
+package util
+
+import "os"
+
+// openRead opens path for reading. Only Windows needs more than this: there a
+// plain open holds the file against the rename that replaces it.
+func openRead(path string) (*os.File, error) {
+	return os.Open(path)
+}
+
+// renameFile replaces newpath with oldpath.
+func renameFile(oldpath, newpath string) error {
+	return os.Rename(oldpath, newpath)
+}
diff --git a/util/file_read_test.go b/util/file_read_test.go
new file mode 100644
index 000000000..d7276798f
--- /dev/null
+++ b/util/file_read_test.go
@@ -0,0 +1,58 @@
+package util
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestReadJson_ReadsTheFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
+	require.NoError(t, os.WriteFile(path, []byte(`{"SomeField": 7}`), 0o600))
+
+	var got TestConfig
+	_, err := ReadJson(path, &got)
+
+	require.NoError(t, err)
+	assert.Equal(t, 7, got.SomeField, "the decoded value")
+}
+
+// Callers tell a missing file from a broken one so they can seed a default in
+// its place. The Windows path opens through a root and rebuilds the error, so
+// the mapping has to survive that.
+func TestReadJson_MissingFileIsErrNotExist(t *testing.T) {
+	dir := t.TempDir()
+
+	for _, tc := range []struct {
+		name string
+		path string
+	}{
+		{"missing file", filepath.Join(dir, "absent.json")},
+		{"missing directory", filepath.Join(dir, "absent", "absent.json")},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var got TestConfig
+			_, err := ReadJson(tc.path, &got)
+
+			require.Error(t, err)
+			assert.ErrorIs(t, err, os.ErrNotExist)
+			assert.Contains(t, err.Error(), tc.path, "the error names the file the caller asked for")
+		})
+	}
+}
+
+func TestReadJson_MalformedFileIsNotErrNotExist(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
+	require.NoError(t, os.WriteFile(path, []byte("{not json"), 0o600))
+
+	var got TestConfig
+	_, err := ReadJson(path, &got)
+
+	require.Error(t, err)
+	assert.False(t, errors.Is(err, os.ErrNotExist),
+		"a file that is there but unreadable must not be seeded over: %v", err)
+}
diff --git a/util/file_windows.go b/util/file_windows.go
new file mode 100644
index 000000000..6abf6e308
--- /dev/null
+++ b/util/file_windows.go
@@ -0,0 +1,79 @@
+package util
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+)
+
+// openRead opens path for reading without holding it against a rename.
+//
+// os.Open does not set FILE_SHARE_DELETE on Windows, so you cannot rename an
+// open file like on UNIX. This caused concurrency issues with active state
+// config file.
+//
+// os.Root opens through NtCreateFile with delete sharing, which is the
+// behaviour Unix has.
+// https://cs.opensource.google/go/go/+/refs/tags/go1.27.1:src/os/root_windows.go;drc=a4f5d9bbdbdf42da7e2d7e976ac85753c4db5d75;l=176
+func openRead(path string) (*os.File, error) {
+	root, err := os.OpenRoot(filepath.Dir(path))
+	if err != nil {
+		// Names the file the caller asked for, not the directory the root
+		// failed on, so a missing directory reads like a missing file.
+		return nil, pathError("open", path, err)
+	}
+	defer func() { _ = root.Close() }()
+
+	// The file outlives the root: closing a Root closes the directory handle it
+	// holds, not the files opened through it.
+	f, err := root.Open(filepath.Base(path))
+	if err != nil {
+		return nil, pathError("open", path, err)
+	}
+	return f, nil
+}
+
+// renameFile replaces newpath with oldpath, including while something holds
+// newpath open for reading.
+//
+// os.Root.Rename asks for POSIX semantics, which unlink the destination
+// immediately and leave open handles reading the version they opened.
+// https://cs.opensource.google/go/go/+/master:src/internal/syscall/windows/at_windows.go;drc=a4f5d9bbdbdf42da7e2d7e976ac85753c4db5d75;l=384
+func renameFile(oldpath, newpath string) error {
+	dir := filepath.Dir(newpath)
+	if filepath.Dir(oldpath) != dir {
+		return os.Rename(oldpath, newpath)
+	}
+
+	root, err := os.OpenRoot(dir)
+	if err != nil {
+		return os.Rename(oldpath, newpath)
+	}
+	defer func() { _ = root.Close() }()
+
+	if err := root.Rename(filepath.Base(oldpath), filepath.Base(newpath)); err != nil {
+		return linkError("rename", oldpath, newpath, err)
+	}
+	return nil
+}
+
+// pathError restores the full path on an error from a root, which names the
+// file by the base name it was opened with.
+func pathError(op, path string, err error) error {
+	var perr *fs.PathError
+	if errors.As(err, &perr) {
+		err = perr.Err
+	}
+	return &fs.PathError{Op: op, Path: path, Err: err}
+}
+
+// linkError does the same as pathError for a rename, which reports both files
+// by their base names.
+func linkError(op, oldpath, newpath string, err error) error {
+	var lerr *os.LinkError
+	if errors.As(err, &lerr) {
+		err = lerr.Err
+	}
+	return &os.LinkError{Op: op, Old: oldpath, New: newpath, Err: err}
+}
diff --git a/util/file_windows_test.go b/util/file_windows_test.go
new file mode 100644
index 000000000..eb7ba344f
--- /dev/null
+++ b/util/file_windows_test.go
@@ -0,0 +1,116 @@
+package util
+
+import (
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// seedReplace lays out a write as writeBytes leaves it: the destination that
+// exists and the temp file that is to take its place.
+func seedReplace(t *testing.T) (src, dst string) {
+	t.Helper()
+	dir := t.TempDir()
+	src = filepath.Join(dir, ".tmpstate.json")
+	dst = filepath.Join(dir, "state.json")
+	require.NoError(t, os.WriteFile(src, []byte(`{"SomeField": 2}`), 0o600))
+	require.NoError(t, os.WriteFile(dst, []byte(`{"SomeField": 1}`), 0o600))
+	return src, dst
+}
+
+// The reader has to share the file for delete, or the rename cannot take
+// delete access on it. Regression test.
+func TestRenameFile_ReplacesAFileBeingRead(t *testing.T) {
+	t.Run("a reader that shares delete", func(t *testing.T) {
+		src, dst := seedReplace(t)
+
+		f, err := openRead(dst)
+		require.NoError(t, err)
+		defer f.Close()
+
+		require.Error(t, os.Rename(src, dst),
+			"delete sharing alone has to be too little, or this test proves nothing")
+		require.NoError(t, renameFile(src, dst), "POSIX semantics have to get the replace through")
+
+		// The handle stays on the file it opened, so a read in flight finishes
+		// on that version instead of seeing the replacement.
+		held, err := io.ReadAll(f)
+		require.NoError(t, err)
+		assert.JSONEq(t, `{"SomeField": 1}`, string(held), "the version the reader opened")
+
+		landed, err := os.ReadFile(dst)
+		require.NoError(t, err)
+		assert.JSONEq(t, `{"SomeField": 2}`, string(landed), "the version the writer put there")
+	})
+
+	t.Run("a reader that does not", func(t *testing.T) {
+		src, dst := seedReplace(t)
+
+		f, err := os.Open(dst)
+		require.NoError(t, err)
+		defer f.Close()
+
+		require.Error(t, renameFile(src, dst),
+			"a plain read still holds the file, and the caller is owed that error")
+	})
+
+	t.Run("no readers at all", func(t *testing.T) {
+		src, dst := seedReplace(t)
+
+		require.NoError(t, renameFile(src, dst))
+
+		landed, err := os.ReadFile(dst)
+		require.NoError(t, err)
+		assert.JSONEq(t, `{"SomeField": 2}`, string(landed), "the destination holds what replaced it")
+	})
+}
+
+// A config rewritten while it is being read, which is the daemon reading the
+// active profile against a profile switch writing it.
+func TestReadJsonWriteJson_Concurrently(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
+	require.NoError(t, WriteJson(context.Background(), path, &TestConfig{SomeField: 1}))
+
+	var wg sync.WaitGroup
+	errs := make(chan error, 128)
+
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for r := 0; r < 50; r++ {
+				var got TestConfig
+				if _, err := ReadJson(path, &got); err != nil {
+					errs <- err
+					return
+				}
+			}
+		}()
+	}
+
+	for i := 0; i < 2; i++ {
+		wg.Add(1)
+		go func(writer int) {
+			defer wg.Done()
+			for r := 0; r < 50; r++ {
+				if err := WriteJson(context.Background(), path, &TestConfig{SomeField: writer}); err != nil {
+					errs <- err
+					return
+				}
+			}
+		}(i)
+	}
+
+	wg.Wait()
+	close(errs)
+
+	for err := range errs {
+		assert.NoError(t, err, "a read and a write of the same config must not collide")
+	}
+}
diff --git a/util/log.go b/util/log.go
index 3896ff6bc..623b11e0f 100644
--- a/util/log.go
+++ b/util/log.go
@@ -40,6 +40,45 @@ func InitLogger(logger *log.Logger, logLevel string, logs ...string) error {
 	if err != nil {
 		return fmt.Errorf("failed parsing log-level %s: %w", logLevel, err)
 	}
+
+	logFmt, err := buildWriters(logger, logs...)
+	if err != nil {
+		return err
+	}
+
+	switch logFmt {
+	case "json":
+		formatter.SetJSONFormatter(logger)
+	case "syslog":
+		formatter.SetSyslogFormatter(logger)
+	default:
+		formatter.SetTextFormatter(logger)
+	}
+	logger.SetLevel(level)
+
+	setGRPCLibLogger(logger)
+
+	return nil
+}
+
+// SetLogOutputs re-points an already-initialized logger to the given targets
+// (console/syslog/file), with the same target semantics as InitLogger, but
+// without re-parsing the level or resetting the formatter. The desktop GUI uses
+// it to attach the rotated gui-client.log alongside the console when the daemon
+// enters debug, and drop back to console-only when it leaves.
+func SetLogOutputs(logger *log.Logger, logs ...string) error {
+	if _, err := buildWriters(logger, logs...); err != nil {
+		return err
+	}
+	setGRPCLibLogger(logger)
+	return nil
+}
+
+// buildWriters resolves the given log targets to writers and points the logger
+// at them (single writer or MultiWriter). It returns the log format implied by
+// the targets (syslog forces "syslog"; otherwise the NB_LOG_FORMAT env value).
+// Shared by InitLogger and SetLogOutputs.
+func buildWriters(logger *log.Logger, logs ...string) (string, error) {
 	var writers []io.Writer
 	logFmt := os.Getenv("NB_LOG_FORMAT")
 
@@ -61,7 +100,7 @@ func InitLogger(logger *log.Logger, logLevel string, logs ...string) error {
 		default:
 			writer, err := setupLogFile(logPath, isRotationDisabled(logger))
 			if err != nil {
-				return fmt.Errorf("failed setting up log file: %s, %w", logPath, err)
+				return "", fmt.Errorf("failed setting up log file: %s, %w", logPath, err)
 			}
 			writers = append(writers, writer)
 		}
@@ -73,19 +112,7 @@ func InitLogger(logger *log.Logger, logLevel string, logs ...string) error {
 		logger.SetOutput(writers[0])
 	}
 
-	switch logFmt {
-	case "json":
-		formatter.SetJSONFormatter(logger)
-	case "syslog":
-		formatter.SetSyslogFormatter(logger)
-	default:
-		formatter.SetTextFormatter(logger)
-	}
-	logger.SetLevel(level)
-
-	setGRPCLibLogger(logger)
-
-	return nil
+	return logFmt, nil
 }
 
 // FindFirstLogPath returns the first logs entry that could be a log path, that is neither empty, nor a special value
diff --git a/util/serviceurl.go b/util/serviceurl.go
new file mode 100644
index 000000000..ffd287df1
--- /dev/null
+++ b/util/serviceurl.go
@@ -0,0 +1,69 @@
+package util
+
+import (
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+// SameServiceURL reports whether two service URLs address the same endpoint.
+// One endpoint can be written several ways, and every spelling below reaches
+// the same server, so none of them is a divergence from another:
+//
+//	an implicit default port    https://mgmt.example.com   :443
+//	a zero-padded port          https://mgmt.example.com:0443
+//	a different host case       https://MGMT.example.com
+//	a trailing slash            https://mgmt.example.com/
+//
+// A path is otherwise part of the identity: https://mgmt.example.com and
+// https://mgmt.example.com/other are two endpoints.
+//
+// It lives here rather than next to any one caller because several of them
+// compare the same kind of URL — an MDM-enforced management URL against a
+// requested one, a stored profile URL against a command-line one — and every
+// copy of these rules that drifts turns an equivalent URL into a refused
+// request.
+func SameServiceURL(a, b *url.URL) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+
+	return strings.EqualFold(a.Hostname(), b.Hostname()) &&
+		strings.EqualFold(a.Scheme, b.Scheme) &&
+		ServiceURLPort(a) == ServiceURLPort(b) &&
+		strings.TrimSuffix(a.Path, "/") == strings.TrimSuffix(b.Path, "/")
+}
+
+// SameServiceURLStrings is SameServiceURL for unparsed input. Input that does
+// not parse falls back to string equality, which is the strictest thing left
+// to do with it.
+func SameServiceURLStrings(a, b string) bool {
+	ua, errA := url.ParseRequestURI(a)
+	ub, errB := url.ParseRequestURI(b)
+	if errA != nil || errB != nil {
+		return a == b
+	}
+
+	return SameServiceURL(ua, ub)
+}
+
+// ServiceURLPort is the port a URL addresses: the one it carries, normalized
+// numerically so ":0443" and ":443" are one port, or the scheme's default.
+func ServiceURLPort(u *url.URL) string {
+	port := u.Port()
+	if port == "" {
+		switch strings.ToLower(u.Scheme) {
+		case "https":
+			return "443"
+		case "http":
+			return "80"
+		default:
+			return ""
+		}
+	}
+
+	if n, err := strconv.Atoi(port); err == nil {
+		return strconv.Itoa(n)
+	}
+	return port
+}
diff --git a/util/serviceurl_test.go b/util/serviceurl_test.go
new file mode 100644
index 000000000..af32a7c29
--- /dev/null
+++ b/util/serviceurl_test.go
@@ -0,0 +1,73 @@
+package util
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSameServiceURLSpellings(t *testing.T) {
+	tests := []struct {
+		a, b string
+		want bool
+	}{
+		// One endpoint, written several ways.
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com:443", want: true},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com/", want: true},
+		{a: "https://mgmt.example.com/", b: "https://mgmt.example.com:443/", want: true},
+		{a: "https://MGMT.example.com", b: "https://mgmt.example.com", want: true},
+		{a: "https://mgmt.example.com:0443", b: "https://mgmt.example.com:443", want: true},
+		{a: "http://mgmt.example.com", b: "http://mgmt.example.com:80", want: true},
+		{a: "HTTPS://mgmt.example.com", b: "https://mgmt.example.com", want: true},
+
+		// Different endpoints.
+		{a: "https://mgmt.example.com", b: "http://mgmt.example.com", want: false},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com:8443", want: false},
+		{a: "https://mgmt.example.com", b: "https://other.example.com", want: false},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com/other", want: false},
+
+		// Unparseable input falls back to string equality.
+		{a: "mgmt.example.com", b: "mgmt.example.com", want: true},
+		{a: "mgmt.example.com", b: "https://mgmt.example.com", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.a+" vs "+tt.b, func(t *testing.T) {
+			assert.Equal(t, tt.want, SameServiceURLStrings(tt.a, tt.b))
+			assert.Equal(t, tt.want, SameServiceURLStrings(tt.b, tt.a), "the comparison must be symmetric")
+		})
+	}
+}
+
+// The parsed form is the primitive the string form delegates to, so it must
+// answer the same for a spelling that only the parser can tell apart.
+func TestSameServiceURLParsed(t *testing.T) {
+	parse := func(raw string) *url.URL {
+		t.Helper()
+		u, err := url.ParseRequestURI(raw)
+		require.NoError(t, err)
+		return u
+	}
+
+	assert.True(t, SameServiceURL(parse("https://mgmt.example.com:0443/"), parse("https://MGMT.example.com")))
+	assert.False(t, SameServiceURL(parse("https://mgmt.example.com"), parse("https://mgmt.example.com:8443")))
+
+	assert.True(t, SameServiceURL(nil, nil), "two absent URLs are the same absence")
+	assert.False(t, SameServiceURL(nil, parse("https://mgmt.example.com")))
+}
+
+func TestServiceURLPort(t *testing.T) {
+	parse := func(raw string) *url.URL {
+		t.Helper()
+		u, err := url.ParseRequestURI(raw)
+		require.NoError(t, err)
+		return u
+	}
+
+	assert.Equal(t, "443", ServiceURLPort(parse("https://mgmt.example.com")))
+	assert.Equal(t, "80", ServiceURLPort(parse("http://mgmt.example.com")))
+	assert.Equal(t, "443", ServiceURLPort(parse("https://mgmt.example.com:0443")))
+	assert.Equal(t, "8443", ServiceURLPort(parse("https://mgmt.example.com:8443")))
+}
diff --git a/util/session_test.go b/util/session_test.go
new file mode 100644
index 000000000..f301ff8f7
--- /dev/null
+++ b/util/session_test.go
@@ -0,0 +1,50 @@
+package util
+
+import (
+	"os"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestHasGraphicalSession(t *testing.T) {
+	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
+		assert.True(t, HasGraphicalSession(), "%s always has a graphical session", runtime.GOOS)
+		return
+	}
+
+	// clear anything inherited from the session running the test, restored on cleanup
+	for _, env := range append(browserSessionEnvVars(), envXDGSessionType) {
+		t.Setenv(env, "")
+		os.Unsetenv(env)
+	}
+
+	assert.False(t, HasGraphicalSession(), "no session variables means no graphical session")
+
+	tests := []struct {
+		env      string
+		value    string
+		expected bool
+	}{
+		{env: envDisplay, value: ":0", expected: true},
+		{env: envWaylandDisplay, value: "wayland-0", expected: true},
+		{env: envDesktopSession, value: "gnome", expected: true},
+		{env: envXDGCurrentDesktop, value: "KDE", expected: true},
+		{env: envBrowser, value: "firefox", expected: true},
+		{env: envXDGSessionType, value: "wayland", expected: true},
+		{env: envXDGSessionType, value: "x11", expected: true},
+		{env: envXDGSessionType, value: "mir", expected: true},
+		{env: envXDGSessionType, value: "tty", expected: false},
+		{env: envXDGSessionType, value: "unspecified", expected: false},
+		// an unrecognized type must not be read as a display: the device code flow works anyway
+		{env: envXDGSessionType, value: "something-new", expected: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.env+"="+tt.value, func(t *testing.T) {
+			t.Setenv(tt.env, tt.value)
+			assert.Equal(t, tt.expected, HasGraphicalSession(), "%s=%s", tt.env, tt.value)
+		})
+	}
+}
diff --git a/util/wsproxy/server/proxy.go b/util/wsproxy/server/proxy.go
index ffb622200..0618beb91 100644
--- a/util/wsproxy/server/proxy.go
+++ b/util/wsproxy/server/proxy.go
@@ -1,12 +1,8 @@
 package server
 
 import (
-	"context"
-	"io"
-	"net"
 	"net/http"
-	"sync"
-	"time"
+	"sync/atomic"
 
 	"github.com/coder/websocket"
 	log "github.com/sirupsen/logrus"
@@ -15,11 +11,6 @@ import (
 	"github.com/netbirdio/netbird/util/wsproxy"
 )
 
-const (
-	bufferSize = 32 * 1024
-	ioTimeout  = 5 * time.Second
-)
-
 // Config contains the configuration for the WebSocket proxy.
 type Config struct {
 	Handler         http.Handler
@@ -53,14 +44,23 @@ func New(handler http.Handler, opts ...Option) *Proxy {
 
 // Handler returns an http.Handler that proxies WebSocket connections to the local gRPC server.
 func (p *Proxy) Handler() http.Handler {
-	return http.HandlerFunc(p.handleWebSocket)
+	return &proxyHandler{
+		metrics: p.config.MetricsRecorder,
+		handler: p.config.Handler,
+	}
 }
 
-func (p *Proxy) handleWebSocket(w http.ResponseWriter, r *http.Request) {
+type proxyHandler struct {
+	metrics MetricsRecorder
+	handler http.Handler
+	conn    atomic.Pointer[wsConnAdapter]
+}
+
+func (ph *proxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 
-	p.metrics.RecordConnection(ctx)
-	defer p.metrics.RecordDisconnection(ctx)
+	ph.metrics.RecordConnection(ctx)
+	defer ph.metrics.RecordDisconnection(ctx)
 
 	log.Debugf("WebSocket proxy handling connection from %s, forwarding to internal gRPC handler", r.RemoteAddr)
 	acceptOptions := &websocket.AcceptOptions{
@@ -69,121 +69,44 @@ func (p *Proxy) handleWebSocket(w http.ResponseWriter, r *http.Request) {
 
 	wsConn, err := websocket.Accept(w, r, acceptOptions)
 	if err != nil {
-		p.metrics.RecordError(ctx, "websocket_accept_failed")
+		ph.metrics.RecordError(ctx, "websocket_accept_failed")
 		log.Errorf("WebSocket upgrade failed from %s: %v", r.RemoteAddr, err)
 		return
 	}
-	defer func() {
-		_ = wsConn.Close(websocket.StatusNormalClosure, "")
-	}()
+	serverConn := (&wsConnAdapter{
+		ctx:        ctx,
+		conn:       wsConn,
+		metrics:    ph.metrics,
+		clientAddr: r.RemoteAddr,
+	})
 
-	clientConn, serverConn := net.Pipe()
 	defer func() {
-		_ = clientConn.Close()
 		_ = serverConn.Close()
 	}()
 
+	ph.conn.Store(serverConn) // used in tests only
+
 	log.Debugf("WebSocket proxy established: %s -> gRPC handler", r.RemoteAddr)
 
-	go func() {
-		(&http2.Server{}).ServeConn(serverConn, &http2.ServeConnOpts{
-			Context: ctx,
-			Handler: p.config.Handler,
-		})
-	}()
+	(&http2.Server{
+		// TODO (dmitri) we should limit the number of concurrent streams per connection (peer)
+		// and idle timeouts
+		// MaxConcurrentStreams: 20,
+		// IdleTimeout: 10 * time.Second,
+	}).ServeConn(serverConn, &http2.ServeConnOpts{
+		Context:    ctx,
+		Handler:    ph.handler,
+		BaseConfig: &http.Server{
+			// b/c we are wrapping a ws connection, read and write connection deadlines normally set
+			// via ReadTimeout and WriteTimeout http.Server fields aren't available to us. The ws
+			// library doesn't expose connection deadline timer config, and we ignore these calls in "wsConnAdapter".
+			//
+			// Another issue is that Server.ServeConn() call bypasses setting of connection deadlines altogether,
+			// ReadTimeout and Writetimeout set here would only apply to h2 streams, i.e. after a HEADERS frame
+			// arrival and processing, turning ReadTimeout into a request body read deadline, and WriteTimeout into
+			// a response deadline (the latter not useful for streaming requests).
+		},
+	})
 
-	p.proxyData(ctx, wsConn, clientConn, r.RemoteAddr)
-}
-
-func (p *Proxy) proxyData(ctx context.Context, wsConn *websocket.Conn, pipeConn net.Conn, clientAddr string) {
-	proxyCtx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-
-	go p.wsToPipe(proxyCtx, cancel, &wg, wsConn, pipeConn, clientAddr)
-	go p.pipeToWS(proxyCtx, cancel, &wg, wsConn, pipeConn, clientAddr)
-
-	wg.Wait()
-}
-
-func (p *Proxy) wsToPipe(ctx context.Context, cancel context.CancelFunc, wg *sync.WaitGroup, wsConn *websocket.Conn, pipeConn net.Conn, clientAddr string) {
-	defer wg.Done()
-	defer cancel()
-
-	for {
-		msgType, data, err := wsConn.Read(ctx)
-		if err != nil {
-			switch {
-			case ctx.Err() != nil:
-				log.Debugf("WebSocket from %s terminating due to context cancellation", clientAddr)
-			case websocket.CloseStatus(err) != -1:
-				log.Debugf("WebSocket from %s disconnected", clientAddr)
-			default:
-				p.metrics.RecordError(ctx, "websocket_read_error")
-				log.Debugf("WebSocket read error from %s: %v", clientAddr, err)
-			}
-			return
-		}
-
-		if msgType != websocket.MessageBinary {
-			log.Warnf("Unexpected WebSocket message type from %s: %v", clientAddr, msgType)
-			continue
-		}
-
-		if ctx.Err() != nil {
-			log.Tracef("wsToPipe goroutine terminating due to context cancellation before pipe write")
-			return
-		}
-
-		if err := pipeConn.SetWriteDeadline(time.Now().Add(ioTimeout)); err != nil {
-			log.Debugf("Failed to set pipe write deadline: %v", err)
-		}
-
-		n, err := pipeConn.Write(data)
-		if err != nil {
-			p.metrics.RecordError(ctx, "pipe_write_error")
-			log.Warnf("Pipe write error for %s: %v", clientAddr, err)
-			return
-		}
-
-		p.metrics.RecordBytesTransferred(ctx, "ws_to_grpc", int64(n))
-	}
-}
-
-func (p *Proxy) pipeToWS(ctx context.Context, cancel context.CancelFunc, wg *sync.WaitGroup, wsConn *websocket.Conn, pipeConn net.Conn, clientAddr string) {
-	defer wg.Done()
-	defer cancel()
-
-	buf := make([]byte, bufferSize)
-	for {
-		n, err := pipeConn.Read(buf)
-		if err != nil {
-			if ctx.Err() != nil {
-				log.Tracef("pipeToWS goroutine terminating due to context cancellation")
-				return
-			}
-
-			if err != io.EOF {
-				log.Debugf("Pipe read error for %s: %v", clientAddr, err)
-			}
-			return
-		}
-
-		if ctx.Err() != nil {
-			log.Tracef("pipeToWS goroutine terminating due to context cancellation before WebSocket write")
-			return
-		}
-
-		if n > 0 {
-			if err := wsConn.Write(ctx, websocket.MessageBinary, buf[:n]); err != nil {
-				p.metrics.RecordError(ctx, "websocket_write_error")
-				log.Warnf("WebSocket write error for %s: %v", clientAddr, err)
-				return
-			}
-
-			p.metrics.RecordBytesTransferred(ctx, "grpc_to_ws", int64(n))
-		}
-	}
+	log.Debugf("WebSocket proxy closing: %s -> gRPC handler", r.RemoteAddr)
 }
diff --git a/util/wsproxy/server/ws_conn_adapter.go b/util/wsproxy/server/ws_conn_adapter.go
new file mode 100644
index 000000000..eb29ab0cb
--- /dev/null
+++ b/util/wsproxy/server/ws_conn_adapter.go
@@ -0,0 +1,126 @@
+package server
+
+import (
+	"context"
+	"net"
+	"sync/atomic"
+	"time"
+
+	"github.com/coder/websocket"
+	log "github.com/sirupsen/logrus"
+)
+
+type wsConnAdapter struct {
+	prefix       string
+	ctx          context.Context
+	conn         *websocket.Conn
+	metrics      MetricsRecorder
+	clientAddr   string
+	closed       atomic.Bool
+	bufferedRead []byte
+}
+
+var _ net.Conn = &wsConnAdapter{}
+
+type wsAddr struct{ prefix string }
+
+func (wa wsAddr) Network() string { return wa.prefix + "ws-proxy" }
+func (wa wsAddr) String() string  { return wa.prefix + "ws-proxy" }
+
+func (ws *wsConnAdapter) Read(b []byte) (int, error) {
+	if len(ws.bufferedRead) > 0 {
+		return ws.readFromBuffer(b)
+	}
+
+	msgType, data, err := ws.conn.Read(ws.ctx)
+	if err != nil {
+		switch {
+		case ws.ctx.Err() != nil:
+			log.Debugf("WebSocket from %s terminating due to context cancellation", ws.clientAddr)
+		case websocket.CloseStatus(err) != -1:
+			log.Debugf("WebSocket from %s disconnected", ws.clientAddr)
+		default:
+			ws.recordError(ws.ctx, "websocket_read_error")
+			log.Debugf("WebSocket read error from %s: %v", ws.clientAddr, err)
+		}
+		return copy(b, data), err
+	}
+	if msgType != websocket.MessageBinary {
+		log.Warnf("Unexpected WebSocket message type from %s: %v", ws.clientAddr, msgType)
+		return 0, nil
+	}
+
+	ws.bufferedRead = data
+	return ws.readFromBuffer(b)
+}
+
+func (ws *wsConnAdapter) readFromBuffer(b []byte) (int, error) {
+	n := copy(b, ws.bufferedRead)
+
+	ws.recordBytesTransferred(ws.ctx, "ws_to_grpc", n)
+	if n == len(ws.bufferedRead) {
+		ws.bufferedRead = nil
+		return n, nil
+	} else {
+		ws.bufferedRead = ws.bufferedRead[n:]
+	}
+	return n, nil
+}
+
+func (ws *wsConnAdapter) Write(b []byte) (int, error) {
+	maybeErr := ws.ctx.Err()
+
+	n := len(b)
+	if n == 0 {
+		return n, maybeErr
+	}
+	if maybeErr != nil {
+		return 0, maybeErr
+	}
+	if err := ws.conn.Write(ws.ctx, websocket.MessageBinary, b[:n]); err != nil {
+		ws.recordError(ws.ctx, "websocket_write_error")
+		log.Warnf("WebSocket write error for %s: %v", ws.clientAddr, err)
+		return 0, err // we don't know how many bytes have been written
+	}
+
+	ws.recordBytesTransferred(ws.ctx, "grpc_to_ws", n)
+	return n, nil
+}
+
+func (ws *wsConnAdapter) Close() error {
+	ws.closed.Store(true)
+	return ws.conn.Close(websocket.StatusNormalClosure, "")
+}
+
+func (ws *wsConnAdapter) LocalAddr() net.Addr  { return wsAddr{ws.prefix} }
+func (ws *wsConnAdapter) RemoteAddr() net.Addr { return wsAddr{ws.prefix} }
+
+func (ws *wsConnAdapter) SetDeadline(t time.Time) error {
+	return nil
+}
+
+func (ws *wsConnAdapter) SetReadDeadline(t time.Time) error {
+	return nil
+}
+
+func (ws *wsConnAdapter) SetWriteDeadline(t time.Time) error {
+	return nil
+}
+
+func (ws *wsConnAdapter) recordError(ctx context.Context, errorType string) {
+	if ws.metrics == nil {
+		return
+	}
+	ws.metrics.RecordError(ctx, errorType)
+}
+
+func (ws *wsConnAdapter) recordBytesTransferred(ctx context.Context, direction string, bytes int) {
+	if ws.metrics == nil {
+		return
+	}
+	ws.metrics.RecordBytesTransferred(ctx, direction, int64(bytes))
+}
+
+func (ws *wsConnAdapter) IsClosed() bool {
+	return ws.closed.Load()
+}
diff --git a/util/wsproxy/server/ws_conn_adapter_test.go b/util/wsproxy/server/ws_conn_adapter_test.go
new file mode 100644
index 000000000..d46e4830b
--- /dev/null
+++ b/util/wsproxy/server/ws_conn_adapter_test.go
@@ -0,0 +1,204 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"io"
+	"math/rand/v2"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/coder/websocket"
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/hpack"
+)
+
+func TestAdapterHandlingConnectionClosures(t *testing.T) {
+	var cases = []struct {
+		description string
+		casenum     int
+	}{
+		{"client-side ws connection is closed", 0},
+		{"server-side ws connection is closed", 1},
+		{"client-side context is cancelled", 2},
+		{"server-side context is cancelled", 3},
+	}
+
+	for _, c := range cases {
+		t.Run(c.description, func(t *testing.T) {
+			serversock := filepath.Join(os.TempDir(), "http-server-"+strconv.FormatInt(rand.Int64(), 10)+".sock")
+			t.Cleanup(func() { os.Remove(serversock) })
+
+			l, err := net.Listen("unix", serversock)
+			assert.NoError(t, err)
+
+			proxy := New(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				buf, _ := io.ReadAll(r.Body)
+				defer r.Body.Close()
+				w.Write([]byte("echo: " + string(buf))) //nolint:errcheck
+			}))
+
+			handler, ok := proxy.Handler().(*proxyHandler)
+			assert.True(t, ok)
+
+			protocols := new(http.Protocols)
+			protocols.SetHTTP1(true)
+			protocols.SetUnencryptedHTTP2(true)
+			httpServer := http.Server{
+				Handler: handler,
+			}
+			go httpServer.Serve(l) //nolint:errcheck
+			t.Cleanup(func() { httpServer.Close() })
+
+			clientconn, _, err := websocket.Dial(context.Background(), "http://whatever", //nolint:bodyclose
+				&websocket.DialOptions{HTTPClient: &http.Client{
+					Transport: &http.Transport{
+						DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
+							return net.Dial("unix", serversock)
+						},
+					}}})
+			assert.NoError(t, err)
+
+			clientCtx, cancel := context.WithCancel(context.Background()) //nolint:govet
+			h2client := &http.Client{
+				Transport: &http2.Transport{
+					AllowHTTP: true,
+					DialTLSContext: func(_ context.Context, _, _ string, _ *tls.Config) (net.Conn, error) {
+						return &wsConnAdapter{
+							prefix: "test-client",
+							ctx:    clientCtx,
+							conn:   clientconn,
+						}, nil
+					},
+				}}
+
+			resp, err := h2client.Post("http://whatever", "text/html", strings.NewReader("g'day"))
+			assert.NoError(t, err)
+
+			body, err := io.ReadAll(resp.Body)
+			defer resp.Body.Close()
+
+			assert.NoError(t, err)
+			assert.Equal(t, "echo: g'day", string(body))
+
+			switch c.casenum {
+			case 0:
+				clientconn.Close(websocket.StatusNormalClosure, "")
+			case 1:
+				handler.conn.Load().Close()
+			case 2:
+				cancel()
+			case 3:
+				resp.Body.Close()
+				h2client.CloseIdleConnections()
+			}
+
+			assert.EventuallyWithT(t, func(c *assert.CollectT) {
+				assert.True(c, handler.conn.Load().IsClosed())
+			}, 3*time.Second, 100*time.Millisecond)
+		}) //nolint:govet
+	}
+}
+
+func TestAdapterHandlingHttpConnection_NoHeadersSent(t *testing.T) {
+	t.Skip("currently disabled as it requires idle timeout to be set")
+
+	serversock := filepath.Join(os.TempDir(), "http-server-"+strconv.FormatInt(rand.Int64(), 10)+".sock")
+	defer os.Remove(serversock)
+
+	l, err := net.Listen("unix", serversock)
+	assert.NoError(t, err)
+
+	proxy := New(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		buf, _ := io.ReadAll(r.Body)
+		defer r.Body.Close()                    //nolint:errcheck
+		w.Write([]byte("echo: " + string(buf))) //nolint:errcheck
+	}))
+
+	handler, ok := proxy.Handler().(*proxyHandler)
+	assert.True(t, ok)
+
+	protocols := new(http.Protocols)
+	protocols.SetHTTP1(true)
+	protocols.SetUnencryptedHTTP2(true)
+	httpServer := http.Server{
+		Handler: handler,
+	}
+	go httpServer.Serve(l) //nolint:errcheck
+
+	clientconn, _, err := websocket.Dial(context.Background(), "http://whatever", //nolint:bodyclose
+		&websocket.DialOptions{HTTPClient: &http.Client{
+			Transport: &http.Transport{
+				DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
+					return net.Dial("unix", serversock)
+				},
+			}}})
+	assert.NoError(t, err)
+
+	h2client := &http.Client{
+		Transport: &http2.Transport{
+			AllowHTTP: true,
+			DialTLSContext: func(_ context.Context, _, _ string, _ *tls.Config) (net.Conn, error) {
+				return &h2ConnectionSnooper{wrappedConn: &wsConnAdapter{
+					prefix: "test-client",
+					ctx:    context.Background(),
+					conn:   clientconn,
+				}, shouldDropFrame: func(f http2.FrameType) bool { return f == http2.FrameHeaders || f == http2.FrameData }}, nil
+			},
+		}}
+
+	_, err = h2client.Post("http://whatever", "text/html", strings.NewReader("g'day"))
+	assert.Error(t, err)
+
+	assert.EventuallyWithT(t, func(c *assert.CollectT) {
+		assert.True(c, handler.conn.Load().IsClosed())
+	}, 3*time.Second, 100*time.Millisecond)
+}
+
+type h2ConnectionSnooper struct {
+	wrappedConn     net.Conn
+	shouldDropFrame func(f http2.FrameType) bool
+}
+
+func (hs *h2ConnectionSnooper) Read(b []byte) (n int, err error) {
+	return hs.wrappedConn.Read(b)
+}
+
+func (hs *h2ConnectionSnooper) Write(b []byte) (n int, err error) {
+	fr := http2.NewFramer(nil, bytes.NewReader(b))
+	fr.ReadMetaHeaders = hpack.NewDecoder(0, nil)
+	f, err := fr.ReadFrame()
+	if err != nil {
+		return hs.wrappedConn.Write(b)
+	}
+
+	if hs.shouldDropFrame != nil && hs.shouldDropFrame(f.Header().Type) {
+		return len(b), nil
+	}
+
+	return hs.wrappedConn.Write(b)
+}
+
+func (hs *h2ConnectionSnooper) Close() error { return hs.wrappedConn.Close() }
+
+func (hs *h2ConnectionSnooper) LocalAddr() net.Addr { return hs.wrappedConn.LocalAddr() }
+
+func (hs *h2ConnectionSnooper) RemoteAddr() net.Addr { return hs.wrappedConn.RemoteAddr() }
+
+func (hs *h2ConnectionSnooper) SetDeadline(t time.Time) error { return hs.wrappedConn.SetDeadline(t) }
+
+func (hs *h2ConnectionSnooper) SetReadDeadline(t time.Time) error {
+	return hs.wrappedConn.SetReadDeadline(t)
+}
+
+func (hs *h2ConnectionSnooper) SetWriteDeadline(t time.Time) error {
+	return hs.wrappedConn.SetWriteDeadline(t)
+}
diff --git a/version/compare.go b/version/compare.go
new file mode 100644
index 000000000..e7868f35a
--- /dev/null
+++ b/version/compare.go
@@ -0,0 +1,31 @@
+package version
+
+import (
+	"strings"
+
+	v "github.com/hashicorp/go-version"
+)
+
+// sanitizeVersion removes anything after the pre-release tag (e.g., "-dev", "-alpha", etc.)
+func sanitizeVersion(version string) string {
+	parts := strings.Split(version, "-")
+	return parts[0]
+}
+
+// MeetsMinVersion checks if the peer's version meets or exceeds the minimum required version
+func MeetsMinVersion(minVer, peerVer string) (bool, error) {
+	peerVer = sanitizeVersion(peerVer)
+	minVer = sanitizeVersion(minVer)
+
+	peerNBVer, err := v.NewVersion(peerVer)
+	if err != nil {
+		return false, err
+	}
+
+	constraints, err := v.NewConstraint(">= " + minVer)
+	if err != nil {
+		return false, err
+	}
+
+	return constraints.Check(peerNBVer), nil
+}
diff --git a/version/compare_test.go b/version/compare_test.go
new file mode 100644
index 000000000..9f3c7f323
--- /dev/null
+++ b/version/compare_test.go
@@ -0,0 +1,72 @@
+package version
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMeetsMinVersion(t *testing.T) {
+	tests := []struct {
+		name    string
+		minVer  string
+		peerVer string
+		want    bool
+		wantErr bool
+	}{
+		{
+			name:    "Peer version greater than min version",
+			minVer:  "0.26.0",
+			peerVer: "0.60.1",
+			want:    true,
+			wantErr: false,
+		},
+		{
+			name:    "Peer version equals min version",
+			minVer:  "1.0.0",
+			peerVer: "1.0.0",
+			want:    true,
+			wantErr: false,
+		},
+		{
+			name:    "Peer version less than min version",
+			minVer:  "1.0.0",
+			peerVer: "0.9.9",
+			want:    false,
+			wantErr: false,
+		},
+		{
+			name:    "Peer version with pre-release tag greater than min version",
+			minVer:  "1.0.0",
+			peerVer: "1.0.1-alpha",
+			want:    true,
+			wantErr: false,
+		},
+		{
+			name:    "Invalid peer version format",
+			minVer:  "1.0.0",
+			peerVer: "dev",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "Invalid min version format",
+			minVer:  "invalid.version",
+			peerVer: "1.0.0",
+			want:    false,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := MeetsMinVersion(tt.minVer, tt.peerVer)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}